diff --git a/.gitattributes b/.gitattributes
index 90733e04952..fcf268e112d 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -15,9 +15,9 @@
 .githooks/generated-artifact-merge merge=generated-artifact
 .githooks/pre-commit merge=generated-artifact
 .githooks/pre-push merge=generated-artifact
+.github/workflows/branch-run-grant-broker.yml merge=generated-artifact
 .github/workflows/fleet-converge.yml merge=generated-artifact
 .github/workflows/fleet-desired.yml merge=generated-artifact
-.github/workflows/heal-publish.yml merge=generated-artifact
 .github/workflows/heal.yml merge=generated-artifact
 .github/workflows/instrument-dispatch.yml merge=generated-artifact
 .github/workflows/microvm-shakedown.yml merge=generated-artifact
diff --git a/.github/workflows/branch-run-grant-broker.yml b/.github/workflows/branch-run-grant-broker.yml
new file mode 100644
index 00000000000..8c959b3e2e9
--- /dev/null
+++ b/.github/workflows/branch-run-grant-broker.yml
@@ -0,0 +1,77 @@
+# Generated by gunbc.branch_run_grant_broker_workflow expected_branch_run_grant_broker_workflow_yml — do not hand-edit.
+# Authority: gunbc.branch_run_grant_broker_workflow branch_run_grant_broker_workflow; regen via tools.generated_artifact_gate main_wet.
+name: branch-run-grant-broker
+on:
+  workflow_run:
+    workflows: [fleet-converge]
+    branches: ["**"]
+    types: [requested]
+env:
+  CARGO_TERM_COLOR: always
+jobs:
+  broker:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 40
+    if: github.event.workflow_run.event == 'workflow_dispatch' && github.event.workflow_run.head_repository.full_name == github.repository && (contains(github.event.workflow_run.display_title, ' hetzner_cloud_server_read '))
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - name: Checkout the default branch this broker runs from
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+      - name: Isolate toolchain homes
+        run: |-
+          # dissolve-on: ci_toolchain_home_isolation_script -- orch-emitted foreign-executor prelude step wiping and setting HOME/CARGO_HOME/RUSTUP_HOME under RUNNER_TEMP so concurrent runner slots stop sharing one toolchain; leaf rm/echo strings remain until a typed per-job filesystem-and-environment effect lands on host_effect_apply (shell-to-intent Phase 2). This obligation covers THIS carrier and ci_isolate_toolchain_script, which share that terminal construction; ci_pin_rustup_default_script carries its own obligation because it does not
+          rm -rf "$RUNNER_TEMP/rustup" "$RUNNER_TEMP/cargo"
+          echo "HOME=$RUNNER_TEMP" >> "$GITHUB_ENV"
+          echo "CARGO_HOME=$RUNNER_TEMP/cargo" >> "$GITHUB_ENV"
+          echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7
+        with:
+          components: rustfmt
+          cache: false
+          rustflags: -D warnings
+      - name: Pin rustup default (isolated RUSTUP_HOME has no default toolchain)
+        run: |-
+          # dissolve-on: ci_pin_rustup_default_script -- orch-emitted foreign-executor step selecting a rustup default toolchain inside an isolated RUSTUP_HOME, which starts with none, and resolving the cargo binary that selection implies. The leaf rustup/command/echo strings remain until a typed TOOLCHAIN-SELECTION effect lands on host_effect_apply -- NOT the filesystem-and-environment effect ci_toolchain_home_isolation_script waits on, which is why this is a separate obligation: that effect landing alone would leave this carrier standing
+          rustup default "$(rustup show active-toolchain | awk '{print $1; exit}')"
+          if [ -x "$CARGO_HOME/bin/cargo" ]; then CARGO_BIN="$CARGO_HOME/bin/cargo"; else CARGO_BIN="$(command -v cargo || true)"; fi
+          if [ -z "$CARGO_BIN" ]; then echo "::error::no cargo binary: neither the isolated $CARGO_HOME/bin/cargo shim nor PATH carries one"; exit 1; fi
+          echo "CARGO_BIN=$CARGO_BIN" >> "$GITHUB_ENV"
+      - name: Build the broker this job runs from the default branch
+        id: build_witness_fold
+        run: |+
+          GUNBC_FLOOR_LOG='gunbc-floor-cmd.log'
+          'set' '+e'
+          'set' '-o' 'pipefail'
+          ('sh' '-e' '-c' 'cargo build --release -p v1-compiler --bin gunbc') 2>&1 | 'tee' "$GUNBC_FLOOR_LOG"
+          GUNBC_FLOOR_EXIT="$?"
+          GUNBC_FLOOR_RECEIPT='gunbc-floor-outcome.txt'
+          GUNBC_FLOOR_CLASS='structural'
+          GUNBC_FLOOR_SIGNATURE=''
+          if '[' "$GUNBC_FLOOR_EXIT" '-eq' '126' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandInvokedCannotExecute'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '127' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandNotFound'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '0' ']'; then GUNBC_FLOOR_CLASS='none'; GUNBC_FLOOR_SIGNATURE=''; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'MemoryStallRefusedPageThrash' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='MemoryStallRefusedPageThrash'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'The runner has received a shutdown signal' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='RunnerLost'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: error: failed to execute compile' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFailedToExecuteCompile'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' '(exit status: 254)' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheRustcWrapperExit254'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: encountered fatal error' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFatalError'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'failed to spawn' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ProcessSpawnFailure'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'Resource temporarily unavailable' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ResourceTemporarilyUnavailable'; fi
+          if (! '[' '-f' "$GUNBC_FLOOR_RECEIPT" ']') || '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' || ('[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT"))) || ('[' "$GUNBC_FLOOR_CLASS" '=' 'none' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT")) && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=infra' "$GUNBC_FLOOR_RECEIPT"))); then 'printf' 'class=%s\nsignature=%s\nexit=%s\n' "$GUNBC_FLOOR_CLASS" "$GUNBC_FLOOR_SIGNATURE" "$GUNBC_FLOOR_EXIT" > "$GUNBC_FLOOR_RECEIPT"; if '[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']'; then 'echo' '::error title=environment::floor_class='"$GUNBC_FLOOR_CLASS"' signature='"$GUNBC_FLOOR_SIGNATURE"' exit='"$GUNBC_FLOOR_EXIT"'; this is not a verdict about the diff. Attempt receipt: '"$GUNBC_FLOOR_RECEIPT"; fi; if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']'; then 'echo' '::error title=subject::floor_class='"$GUNBC_FLOOR_CLASS"' exit='"$GUNBC_FLOOR_EXIT"'; read the step log for the subject defect'; fi; fi
+          'exit' "$GUNBC_FLOOR_EXIT"
+
+      - name: Dispatch the branch_run_grant run at main for the requested run attempt
+        run: |-
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/auth/branch_run_grant_broker.dag --function broker
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          BRANCH_RUN_KEY: ${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}
+          BRANCH_RUN_TITLE: ${{ github.event.workflow_run.display_title }}
+        timeout-minutes: 5
diff --git a/.github/workflows/fleet-converge.yml b/.github/workflows/fleet-converge.yml
index 7900ff50b53..21b8cb33775 100644
--- a/.github/workflows/fleet-converge.yml
+++ b/.github/workflows/fleet-converge.yml
@@ -5,45 +5,24 @@ run-name: fleet-converge ${{ inputs.mode }} ${{ inputs.host }} nonce=${{ inputs.
 on:
   workflow_dispatch:
     inputs:
+      workspace_image_run_id:
+        description: Image build run to download for controller install; installed bytes must match the reviewed image pin
+        required: false
+        type: string
       host:
         description: Executor fleet host (runner pinned here; plan mode observes this host)
         required: true
         options: [srv1, srv2, srv3, srv4]
         type: choice
-      mode:
-        description: "plan shows membership hunks; apply executes a prior plan artifact; org_actions_observe validates the org credential and refuses on runner-group drift; org_runner_roster_observe reads the organization's self-hosted runner registrations to exhaustion under the same token and refuses unless the roster is complete; app_control_plane_observe reads the gunbai-ci App registration and webhook config with a short-lived App JWT and refuses on hook-config drift; app_key_version_verify reads the gunbai-ci App private key at the EXACT Secret Manager version named by app_key_version, mints an installation token with it, and refuses unless GitHub accepts it and the key's rotation deadline has not passed -- no add, disable or destroy; runner_browser_toolchain_converge installs the declared Playwright/Chromium toolchain (apt host libraries as the administrator, digest-pinned node, Playwright and Chromium archives into the job user's root) on the selected host, which must be in the pool that runs the floor job, and refuses unless every digest, version and host library reads back and headless Chromium renders a local page; microvm_host_converge installs the cited Firecracker release on the selected host and reads the kvm grant back, refusing by name when the grant has not landed (the grant itself is applied by the full-host apply spine); microvm_network_apply stages the slot and host network files the model renders at the named expected_revision as root:root 0600 in a root-only directory over the fleet SSH edge as the host's ADMINISTRATOR, installs them with the modeled operations, reloads networkd, systemd-sysctl and the nft loader unit, and reads the ruleset back -- the job user is granted none of it, because install plus systemctl over content that principal can write is arbitrary root for any pull request; guest_image_observe reports the micro-VM base artifacts and their measured digests on the selected host and builds nothing; guest_image_converge builds the runner guest image there; microvm_boot_probe boots that image and reads its serial console; spark_grants and spark_bootstrap prepare the selected Spark; spark_serving_apply applies the promoted fabric groups' pair vLLM units over the password session, workers before heads; spark_native_serving_apply relaunches group B's native four-rank arm as ONE BOUNDED TRANSACTION -- an all-host preflight that mutates nothing and refuses on any unresolved artifact from an earlier run, the incumbent UNIT preserved (plus a diagnostic inspect of the incumbent container -- the container itself cannot outlive its unit, because these run --rm in the foreground under systemd), the head applied BEFORE the workers so every rank joins the head's new rendezvous store, then a readback of the COMPLETE realization through each container's own inspect -- every field the create spec states, the effective --node-rank off that container's argv, and NCCL's typed transport verdict on that incarnation -- plus the head's front door answering with this arm's served model, and then commit or a rollback of the whole arm -- and it is a separate mode because it reloads a 328 GB arm and nobody should reach it by asking for the pair units; spark_runtime_image_probe pulls the pinned runtime image on the selected Spark and reads its capabilities from inside its own digest, changing nothing; spark_wireless_link_converge reads the selected Spark's Wi-Fi power save (runtime via iw, persisted via the NetworkManager profile), link and kernel disconnect count, sets whichever realization differs from the declared intent, and refuses unless the readback decides Noop; spark_grants_observe reads every procured Spark's sudo grant listing as gunbc-automation and the bootstrap principal, and its sudoers drop-in shape, and writes nothing; spark_v41_checkpoint_materialize fetches the admitted published DeepSeek V4.1 files onto the selected Group A Spark (about 510 GB; spark_v41_row_store_encode encodes the eight Engram row stores from the verified shards on the selected Group A Spark and reads each store's sha256; spark_v41_row_store_readback reads those stores back at their header, first and last record and every rank seam, with the published source rows at the same rows, and writes nothing; spark_v41_engram_differential compares upstream's Engram lookup kernel with the design-B file-backed lookup over sampled real rows of every row store, byte for byte, and writes nothing; it states the requirement and refuses before fetching when the disk cannot hold it), publishes each only after its sha256 matches the manifest, leaves a present file with the right digest alone and refuses one with the wrong digest, and reads the storage-backed Engram spans from the verified shards; a transfer runs detached and a rerun reattaches; spark_v41_runtime_image_build PRODUCES the DeepSeek V4.1 image on the selected Spark -- it verifies the candidate's three FlashInfer wheels against the digests the candidate keys, converges the patched source tree, builds from it, reads the produced configuration digest back from inside the image through the probe route, and admits that digest against the candidate's own recipe, refusing a digest that does not recompute from it -- and it is a separate mode from the probe because it occupies one host for hours where the probe occupies it for minutes; spark_v41_runtime_image_distribute moves that produced image, named by the configuration digest its production receipt read back, from the host that receipt names to the selected Group A Spark -- save into its fabric blob root, pulled by the target straight over the fabric rail, load -- after stating its size against every filesystem a copy lands on, leaves a target already holding the digest untouched, refuses a target holding a different image under the tag, and refuses unless the target's image inspect Id reads back as that digest; spark_v41_group_a_launch reads the production image back under its tag on every Group A host, reads its registry inside its digest and every host's occupancy, and only when Group A is suspended for this candidate with every host held and vacant stages the Engram manifest and applies the V4.1 four-rank arm as one transaction at the capacity measurement's shape -- the target names only the session host; spark_v41_serving_load runs the shared serving-load runner against the V4.1 head (target must be srv6): one vllm bench serve step per capacity-measurement concurrency, metrics scraped around each, host pressure read on every Group A rank, and the staircase stop rules applied over the worst rank; it changes no unit and writes only its receipt; host_reset_return drives a rostered reset subject through its controller and measures the return FROM A PEER, and takes reset_observer rather than host because the observer must not be the subject; runner_host_file_observe reads the runner teardown drop-in, the needrestart deferral and the loaded teardown on the selected host as its administrator and writes nothing; runner_host_file_converge writes whichever of those two files differs, reloads systemd only if the drop-in changed, and refuses unless the manager then reports the declared teardown; microvm_controller_install writes the microVM slot controller's root-owned release locus (gunbc + sources + Firecracker + jailer) and the gunbc-microvm-slot@ template unit and the gunbc-microvm-slot-reserve broker unit on srv1 and starts neither; microvm_slot_reserve starts that broker unit once on srv1, which reserves the shakedown cell through the fabric broker route from inside the root process (slot, demand and offer derived from the model, never inputs), and uploads that invocation's reservation receipt, failing unless the reservation committed; microvm_slot_start starts the shakedown slot's controller unit once on srv1 (the instance is derived from the model, never an input), waits for it bounded by the unit's own stop timeout, and uploads that invocation's controller receipt; microvm_runner_group_ensure (srv1 only) reads the organization's runner groups and, only when the microvm-shakedown group is absent, files ONE operator approval, creates it restricted to the shakedown workflow on the default branch, and refuses unless the readback holds that restriction; mtcollins1_census_qemu_host_observe reads the selected host's KVM device and, under the job user's census QEMU root, the qemu-system-aarch64 build, its ldd libraries and the AAVMF images against their pins, and writes nothing; mtcollins1_census_qemu_toolchain_converge places that root as the job user (digest-pinned noble .debs unpacked with dpkg-deb -x, no apt, no Recommends) and refuses unless the same observe reads it ready; workspace_source_pack (host=srv1) enumerates the operator workspace as the job user, drops every path the credential exclusion row names and every build output, tars exactly the remainder, reads the archive back and refuses if any member is excluded, and puts it into the workspace bucket under its SHA-256, refusing by name when the runner cannot read a source root; workspace_checkpoint_measure (host=srv3, workspace_source_object = that SHA-256) refuses unless the job user's home is on btrfs, then times a read-only subvolume snapshot, a pinned kopia scan of it, the content-addressed chunk upload and the gated revision commit, and receipts every time with the 10 s / 60 s / 10 GB draft verdicts; workspace_checkpoint_restore (host=srv3) commits a small authored workspace, puts one chunk with no head advance, destroys the directory, restores it from the head closure and requires byte-equality with the uncommitted chunk absent -- both srv3 modes refuse their commit while the R2 head's CAS ground is uncited"
-        required: true
-        options: [plan, launch_environment_plan, allocation_store_plan, workspace_commissioning_plan, apply, org_actions_observe, app_control_plane_observe, microvm_host_converge, microvm_network_observe, microvm_network_apply, guest_image_observe, guest_image_converge, microvm_boot_probe, spark_grants, spark_bootstrap, spark_serving_apply, spark_native_serving_apply, spark_runtime_image_probe, spark_wireless_link_converge, spark_grants_observe, spark_v41_checkpoint_materialize, spark_v41_row_store_encode, spark_v41_row_store_readback, spark_v41_engram_differential, spark_runtime_image_produce, spark_runtime_image_distribute, spark_arm_group_load, spark_arm_checkpoint_materialize, spark_arm_group_observe, spark_arm_group_launch_plan, spark_arm_group_launch, spark_v41_serving_load, dashboard_deploy, approval_broker_dark_install, microvm_controller_install, microvm_slot_reserve, microvm_slot_start, rlm_launch_deployment_receipt, host_reset_return, runner_host_file_observe, runner_host_file_converge, site_pxe_edge_observe, site_pxe_edge_converge, runner_password_session_tool_converge, runner_browser_toolchain_converge, r2_mint_preflight, r2_object_write_mint, org_runner_roster_observe, approval_keyring_converge, approval_device_enrolment_code_issue, mtcollins1_boot, mtcollins1_fan_observe, mtcollins1_ui_bundle_observe, mtcollins1_kvm_observer_observe, mtcollins1_census_image_publish, mtcollins1_census_member_readback, mtcollins1_census_qemu_host_observe, mtcollins1_census_qemu_toolchain_converge, host_credential_custody_converge, app_key_version_verify, r2_bucket_ensure, r2_bucket_admin_mint, r2_workspace_object_read_mint, r2_workspace_object_write_mint, r2_cache_object_read_mint, r2_cache_object_write_mint, r2_conditional_put_race_probe, workspace_source_pack, workspace_checkpoint_measure, workspace_checkpoint_restore, fabric_writer_identity_observe, pair_serving_d0, microvm_runner_group_ensure, gcp_iam_converge, namecheap_observe, printer]
-        type: choice
-      target:
-        description: "Spark target host for the spark_* modes, naming the administrator credential the run materializes (any rostered Spark: srv5, srv6, srv7, srv8, srv9, srv10, srv11, srv12); apply reads the subject off the plan artifact"
-        required: false
-        options: [srv5, srv6, srv7, srv8, srv9, srv10, srv11, srv12]
-        type: choice
-      runtime_image:
-        description: "spark_runtime_image_produce / spark_runtime_image_distribute only: which runtime image to produce on, or distribute to, the target Spark (gunbc.spark.runtime_image_produce_dispatch). A closed choice"
-        required: false
-        options: [v41-dsv41-gb10, glm53-kvplan-v2-gb10]
-        type: choice
-      checkpoint:
-        description: "spark_arm_checkpoint_materialize only: which checkpoint of the arm to acquire on the target Spark (gunbc.spark.arm_group_launch_dispatch). A closed choice"
-        required: false
-        options: [glm53-native-fp8, glm53-flash-nvidia-nvfp4]
-        type: choice
-      arm:
-        description: "spark_arm_group_launch / spark_arm_group_launch_plan only: which arm on which fabric group (gunbc.spark.arm_group_launch_dispatch). A closed choice; each arm's own inputs are its module's"
-        required: false
-        options: [v41-group-a, glm53-group-a]
-        type: choice
-      staircase_step:
-        description: "spark_arm_group_launch(_plan) with arm glm53-group-a only: the staircase step (gunbc.spark.glm53_arm_staircase), checkpoint and sequence ceiling over the cold 8 x 262144 floor. A closed choice; a step outside the staircase has no spelling. Must be empty for v41-group-a"
+      arrival_subject:
+        description: "arrival_converge only: the arrival-population unit (not executor host, not managed_host). Options are gunbc.machine_intake_arrival_subject arrival_converge_subject_options. Names signed off msg_f03558d1"
         required: false
-        options: [fp8-8, fp8-12, fp8-16, fp8-24, fp8-32, fp8-64, fp8-128, nvfp4-8, nvfp4-16, nvfp4-24, nvfp4-32]
+        options: [mtjade1]
         type: choice
-      incumbent:
-        description: "spark_arm_group_launch(_plan) with arm glm53-group-a only: the serve this step supersedes, as a DECLARED unit roster (never discovered): previous-step (this arm's own units from the step before) or none. Must be empty for v41-group-a"
-        required: false
-        options: [previous-step, none]
+      mode:
+        description: "Closed choice of fleet-converge modes. Contracts: gunbc.fleet_converge_workflow."
+        required: true
+        options: [plan, launch_environment_plan, allocation_store_plan, workspace_commissioning_plan, workspace_allocation_plan, workspace_image_build, apply, org_actions_observe, app_control_plane_observe, microvm_host_converge, microvm_network_observe, microvm_network_apply, guest_image_observe, guest_image_converge, microvm_boot_probe, dashboard_deploy, approval_broker_dark_install, microvm_controller_install, microvm_slot_reserve, microvm_slot_start, rlm_launch_deployment_receipt, host_reset_return, runner_host_file_observe, runner_host_file_converge, site_pxe_edge_observe, site_pxe_edge_converge, runner_password_session_tool_converge, runner_browser_toolchain_converge, r2_mint_preflight, r2_object_write_mint, org_runner_roster_observe, approval_keyring_converge, approval_device_enrolment_code_issue, mtcollins1_boot, mtcollins1_fan_observe, mtcollins1_kvm_observer_observe, mtcollins1_census_image_publish, mtcollins1_census_member_readback, mtcollins1_census_qemu_host_observe, mtcollins1_census_qemu_toolchain_converge, host_credential_custody_converge, app_key_version_verify, r2_bucket_ensure, r2_bucket_admin_mint, r2_workspace_object_read_mint, r2_workspace_object_write_mint, r2_cache_object_read_mint, r2_cache_object_write_mint, r2_conditional_put_race_probe, workspace_source_pack, workspace_checkpoint_measure, workspace_checkpoint_restore, workspace_transcript_rate_observe, fabric_writer_identity_observe, microvm_runner_group_ensure, gcp_iam_converge, namecheap_observe, printer, arrival_converge, hetzner_cloud_server_read, branch_run_grant]
         type: choice
       reset_observer:
         description: "host_reset_return only: the PEER that observes the reset. The subject is NOT an input -- it is derived from this observer through the modeled pairing, so a job cannot be pointed at the host it is resetting"
@@ -53,12 +32,8 @@ on:
       credential:
         description: "host_credential_custody_converge only: which rostered custody row to deliver (gunbc.host_credential_custody_converge). A closed choice, never a free-text secret name: each option carries its own SecretRef, path, owner, group, mode and directory, and a row scoped to one host refuses any other"
         required: false
-        options: [controller_app_key, approval_ntfy_publisher_token, fabric_state_writer_key, oracle_oci_api_signing_key, claude_code_oauth_harness_token]
+        options: [controller_app_key, approval_ntfy_publisher_token, fabric_state_writer_key, cursor_worker_turn_api_key, codex_worker_turn_auth, oracle_oci_api_signing_key, claude_code_oauth_harness_token]
         type: choice
-      d0_consent:
-        description: "pair_serving_d0 only (Cut D, Group A on srv1; expected_revision is required and frozen with the filing): the escalation id the consent is filed under. It names the transaction, and a rerun after a crash MUST name the same id to find its frozen filing and held claim -- a fresh id is a new consent"
-        required: false
-        type: string
       app_key_version:
         description: "app_key_version_verify only: the Secret Manager version NUMBER of ci-github-app-private-key to verify. The alias latest is refused -- it names whatever is newest when it resolves, so a mint through it proves nothing about a specific key"
         required: false
@@ -72,7 +47,7 @@ on:
         required: false
         type: string
       expected_revision:
-        description: R — the exact main revision this transaction installs and proves; every run of the transaction must execute at it (RLM_EXPECTED_REVISION). Required for dashboard_deploy and rlm_launch_deployment_receipt — and for microvm_network_apply, whose installed bytes are rendered from it
+        description: Optional cross-check of the event sha (RLM_EXPECTED_REVISION). Omit to admit github.sha. Present must match the checkout. Malformed refuses. rlm_launch_deployment_receipt and microvm_network_apply still require a named revision in their own admission; dashboard_deploy does not.
         required: false
         type: string
       apply_workflow_run_id:
@@ -96,34 +71,20 @@ on:
         required: false
         options: [printer-01, printer-02]
         type: choice
-      printer_operation:
-        description: Observe credential identity or start one pinned project
-        required: false
-        options: [observe, print]
-        type: choice
-      printer_project_path:
-        description: Absolute path of staged sliced project on srv1
+      printer_request:
+        description: "Printer operation JSON: operation (observe/print), project_path, project_sha256, credential_version, bed_clear (string true/false). The existing printer admission validates every field."
         required: false
         type: string
-      printer_project_sha256:
-        description: SHA-256 of the reviewed sliced project
+      agent_state_slot:
+        description: "workspace_source_pack and workspace_transcript_rate_observe: the Claude auth slot whose agent state is packed, as <slot> in /home/briansrls/.claude@<slot> on srv1; admitted only if that directory exists, refused naming the observed slots otherwise; no default"
         required: false
         type: string
-      printer_credential_version:
-        description: Numeric Secret Manager version returned by observation
-        required: false
-        type: string
-      printer_bed_clear:
-        description: Operator reports this printer bed is clear for this dispatch
-        required: false
-        options: ["false", "true"]
-        type: choice
       workspace_source_object:
         description: "workspace_checkpoint_measure only: the lower-hex SHA-256 the workspace_source_pack receipt printed as address= (the archive's own digest; the fetched bytes must hash to it)"
         required: false
         type: string
       transaction_nonce:
-        description: "Operator-minted unique nonce for one RLM transaction; echoed into run-name so each dispatched run is API-selectable by its displayTitle, closing the run-id correlation gap (review 5062738052 B4). mtcollins1_boot only, when attempt_receipt is named: it is the boot attempt's identity, joined to the receipt's attempt and consumed once (gunbc.host_boot_attempt_admission), so a nonce admits one boot; [A-Za-z0-9_-] only"
+        description: "Operator-minted unique nonce for one RLM transaction; echoed into run-name so each dispatched run is API-selectable by its displayTitle, closing the run-id correlation gap (review 5062738052 B4). branch_run_grant: the requesting run's <run id>-<run attempt>, set by the branch-run-grant-broker workflow from GitHub's workflow_run event (gunbc.auth.branch_run_grant_broker). mtcollins1_boot only, when attempt_receipt is named: it is the boot attempt's identity, joined to the receipt's attempt and consumed once (gunbc.host_boot_attempt_admission), so a nonce admits one boot; [A-Za-z0-9_-] only"
         required: false
         type: string
       attempt_receipt:
@@ -145,7 +106,7 @@ jobs:
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
         with:
           fetch-depth: 0
-          ref: ${{ (github.event.inputs.mode == 'mtcollins1_boot' || github.event.inputs.mode == 'gcp_iam_converge' || github.event.inputs.mode == 'namecheap_observe' || github.event.inputs.mode == 'printer') && github.sha || github.event.inputs.expected_revision || github.sha }}
+          ref: ${{ github.sha }}
       - name: Isolate toolchain dirs
         run: |-
           rm -rf "$RUNNER_TEMP/rustup" "$RUNNER_TEMP/cargo"
@@ -153,7 +114,7 @@ jobs:
           echo "CARGO_HOME=$RUNNER_TEMP/cargo" >> "$GITHUB_ENV"
           echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
           echo "MAKEFLAGS=" >> "$GITHUB_ENV"
-          echo "CARGO_BUILD_JOBS=6" >> "$GITHUB_ENV"
+          echo "CARGO_BUILD_JOBS=5" >> "$GITHUB_ENV"
           if sccache --show-stats >/dev/null 2>&1; then
           echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
           echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"
@@ -187,7 +148,7 @@ jobs:
       - name: Derive release-bins key (pre-materialization axes; sha256 at cross-run scope)
         id: release_bins_key
         run: |
-          if [ "${FLEET_CONVERGE_MODE:-}" = 'approval_device_enrolment_code_issue' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_source_pack' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_measure' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_restore' ]; then
+          if [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_allocation_plan' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_image_build' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'approval_device_enrolment_code_issue' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_source_pack' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_measure' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_restore' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_transcript_rate_observe' ]; then
           set -e
           ROOT=$('git' 'rev-parse' '--show-toplevel')
           DIRTY=$('git' '-C' "$ROOT" 'status' '--porcelain' '--untracked-files=no')
@@ -393,7 +354,7 @@ jobs:
       - name: Decide release-bins outcome; verify a stored pack completely before any restored binary runs
         id: release_bins_outcome
         run: |
-          if [ "${FLEET_CONVERGE_MODE:-}" = 'approval_device_enrolment_code_issue' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_source_pack' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_measure' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_restore' ]; then
+          if [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_allocation_plan' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_image_build' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'approval_device_enrolment_code_issue' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_source_pack' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_measure' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_restore' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_transcript_rate_observe' ]; then
           set -e
           ROOT=$('git' 'rev-parse' '--show-toplevel')
           STAGE="$ROOT"'/.release-bins-staging'
@@ -531,8 +492,28 @@ jobs:
       - name: Build release bins (the dispatched mode's product)
         id: release_build
         run: |
-          if [ "${FLEET_CONVERGE_MODE:-}" = 'approval_device_enrolment_code_issue' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_source_pack' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_measure' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_restore' ]; then
-          cargo build --release -p v1-compiler --bin claim_executor --bin gunbc
+          if [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_allocation_plan' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_image_build' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'approval_device_enrolment_code_issue' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_source_pack' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_measure' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_restore' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_transcript_rate_observe' ]; then
+          GUNBC_FLOOR_LOG='gunbc-floor-cmd.log'
+          'set' '+e'
+          'set' '-o' 'pipefail'
+          ('sh' '-e' '-c' 'cargo build --release -p v1-compiler --bin claim_executor --bin gunbc') 2>&1 | 'tee' "$GUNBC_FLOOR_LOG"
+          GUNBC_FLOOR_EXIT="$?"
+          GUNBC_FLOOR_RECEIPT='gunbc-floor-outcome.txt'
+          GUNBC_FLOOR_CLASS='structural'
+          GUNBC_FLOOR_SIGNATURE=''
+          if '[' "$GUNBC_FLOOR_EXIT" '-eq' '126' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandInvokedCannotExecute'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '127' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandNotFound'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '0' ']'; then GUNBC_FLOOR_CLASS='none'; GUNBC_FLOOR_SIGNATURE=''; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'MemoryStallRefusedPageThrash' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='MemoryStallRefusedPageThrash'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'The runner has received a shutdown signal' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='RunnerLost'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: error: failed to execute compile' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFailedToExecuteCompile'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' '(exit status: 254)' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheRustcWrapperExit254'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: encountered fatal error' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFatalError'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'failed to spawn' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ProcessSpawnFailure'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'Resource temporarily unavailable' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ResourceTemporarilyUnavailable'; fi
+          if (! '[' '-f' "$GUNBC_FLOOR_RECEIPT" ']') || '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' || ('[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT"))) || ('[' "$GUNBC_FLOOR_CLASS" '=' 'none' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT")) && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=infra' "$GUNBC_FLOOR_RECEIPT"))); then 'printf' 'class=%s\nsignature=%s\nexit=%s\n' "$GUNBC_FLOOR_CLASS" "$GUNBC_FLOOR_SIGNATURE" "$GUNBC_FLOOR_EXIT" > "$GUNBC_FLOOR_RECEIPT"; if '[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']'; then 'echo' '::error title=environment::floor_class='"$GUNBC_FLOOR_CLASS"' signature='"$GUNBC_FLOOR_SIGNATURE"' exit='"$GUNBC_FLOOR_EXIT"'; this is not a verdict about the diff. Attempt receipt: '"$GUNBC_FLOOR_RECEIPT"; fi; if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']'; then 'echo' '::error title=subject::floor_class='"$GUNBC_FLOOR_CLASS"' exit='"$GUNBC_FLOOR_EXIT"'; read the step log for the subject defect'; fi; fi
+          'exit' "$GUNBC_FLOOR_EXIT"
+
           else
           ROOT=$('git' 'rev-parse' '--show-toplevel')
           set -o pipefail
@@ -566,7 +547,7 @@ jobs:
         timeout-minutes: 5
       - name: Pack release bins with member manifest into staging (build outcomes only; tar keeps exec bits)
         run: |
-          if [ "${FLEET_CONVERGE_MODE:-}" = 'approval_device_enrolment_code_issue' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_source_pack' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_measure' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_restore' ]; then
+          if [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_allocation_plan' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_image_build' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'approval_device_enrolment_code_issue' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_source_pack' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_measure' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_restore' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_transcript_rate_observe' ]; then
           set -e
           ROOT=$('git' 'rev-parse' '--show-toplevel')
           STAGE="$ROOT"'/.release-bins-staging'
@@ -616,20 +597,20 @@ jobs:
     runs-on: ${{ fromJSON(format('["self-hosted","linux","arm64","{0}"]', github.event.inputs.host)) }}
     needs: [build]
     timeout-minutes: 295
-    if: github.event.inputs.mode != 'mtcollins1_boot' && github.event.inputs.mode != 'gcp_iam_converge' && github.event.inputs.mode != 'namecheap_observe' && github.event.inputs.mode != 'printer'
+    if: github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'launch_environment_plan' || github.event.inputs.mode == 'allocation_store_plan' || github.event.inputs.mode == 'workspace_commissioning_plan' || github.event.inputs.mode == 'workspace_allocation_plan' || github.event.inputs.mode == 'workspace_image_build' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'org_actions_observe' || github.event.inputs.mode == 'app_control_plane_observe' || github.event.inputs.mode == 'microvm_host_converge' || github.event.inputs.mode == 'microvm_network_observe' || github.event.inputs.mode == 'microvm_network_apply' || github.event.inputs.mode == 'guest_image_observe' || github.event.inputs.mode == 'guest_image_converge' || github.event.inputs.mode == 'microvm_boot_probe' || github.event.inputs.mode == 'spark_grants' || github.event.inputs.mode == 'spark_bootstrap' || github.event.inputs.mode == 'spark_serving_apply' || github.event.inputs.mode == 'spark_native_serving_apply' || github.event.inputs.mode == 'spark_runtime_image_probe' || github.event.inputs.mode == 'spark_wireless_link_converge' || github.event.inputs.mode == 'spark_grants_observe' || github.event.inputs.mode == 'microvm_slot_reserve' || github.event.inputs.mode == 'microvm_slot_start' || github.event.inputs.mode == 'runner_host_file_observe' || github.event.inputs.mode == 'runner_host_file_converge' || github.event.inputs.mode == 'site_pxe_edge_observe' || github.event.inputs.mode == 'site_pxe_edge_converge' || github.event.inputs.mode == 'runner_password_session_tool_converge' || github.event.inputs.mode == 'runner_browser_toolchain_converge' || github.event.inputs.mode == 'r2_mint_preflight' || github.event.inputs.mode == 'r2_object_write_mint' || github.event.inputs.mode == 'org_runner_roster_observe' || github.event.inputs.mode == 'approval_keyring_converge' || github.event.inputs.mode == 'approval_device_enrolment_code_issue' || github.event.inputs.mode == 'mtcollins1_fan_observe' || github.event.inputs.mode == 'mtcollins1_kvm_observer_observe' || github.event.inputs.mode == 'mtcollins1_census_image_publish' || github.event.inputs.mode == 'mtcollins1_census_member_readback' || github.event.inputs.mode == 'mtcollins1_census_qemu_host_observe' || github.event.inputs.mode == 'mtcollins1_census_qemu_toolchain_converge' || github.event.inputs.mode == 'host_credential_custody_converge' || github.event.inputs.mode == 'app_key_version_verify' || github.event.inputs.mode == 'r2_bucket_ensure' || github.event.inputs.mode == 'r2_bucket_admin_mint' || github.event.inputs.mode == 'r2_workspace_object_read_mint' || github.event.inputs.mode == 'r2_workspace_object_write_mint' || github.event.inputs.mode == 'r2_cache_object_read_mint' || github.event.inputs.mode == 'r2_cache_object_write_mint' || github.event.inputs.mode == 'r2_conditional_put_race_probe' || github.event.inputs.mode == 'workspace_source_pack' || github.event.inputs.mode == 'workspace_checkpoint_measure' || github.event.inputs.mode == 'workspace_checkpoint_restore' || github.event.inputs.mode == 'workspace_transcript_rate_observe' || github.event.inputs.mode == 'fabric_writer_identity_observe' || github.event.inputs.mode == 'microvm_runner_group_ensure' || github.event.inputs.mode == 'hetzner_cloud_server_read'
     permissions:
       contents: read
       actions: read
       id-token: write
     concurrency:
-      group: ${{ github.event.inputs.mode == 'spark_serving_apply' && 'gunbc-host-mutation-srv1' || github.event.inputs.mode == 'spark_native_serving_apply' && 'gunbc-arm-mutation-glm-group-b-native' || github.event.inputs.mode == 'spark_v41_checkpoint_materialize' && 'gunbc-host-mutation-srv1' || github.event.inputs.mode == 'spark_v41_row_store_encode' && 'gunbc-host-mutation-srv1' || github.event.inputs.mode == 'spark_v41_row_store_readback' && 'gunbc-host-mutation-srv1' || github.event.inputs.mode == 'spark_v41_engram_differential' && 'gunbc-host-mutation-srv1' || github.event.inputs.mode == 'spark_runtime_image_produce' && format('gunbc-host-mutation-{0}', github.event.inputs.target) || github.event.inputs.mode == 'spark_runtime_image_distribute' && 'gunbc-host-mutation-srv1' || github.event.inputs.mode == 'spark_arm_group_load' && 'gunbc-host-mutation-srv1' || github.event.inputs.mode == 'spark_arm_checkpoint_materialize' && format('gunbc-host-mutation-{0}', github.event.inputs.target) || github.event.inputs.mode == 'spark_arm_group_observe' && format('gunbc-read-only-{0}', github.run_id) || github.event.inputs.mode == 'spark_arm_group_launch' && 'gunbc-host-mutation-srv1' || github.event.inputs.mode == 'spark_v41_serving_load' && 'gunbc-host-mutation-srv1' || github.event.inputs.mode == 'approval_device_enrolment_code_issue' && 'gunbc-subject-mutation-approval-device-store-srv1' || github.event.inputs.mode == 'r2_conditional_put_race_probe' && 'r2-conditional-put-race-probe' || github.event.inputs.mode == 'pair_serving_d0' && 'gunbc-host-mutation-srv1' || format('gunbc-host-mutation-{0}', github.event.inputs.host) }}
+      group: ${{ github.event.inputs.mode == 'spark_serving_apply' && 'gunbc-host-mutation-srv1' || github.event.inputs.mode == 'spark_native_serving_apply' && 'gunbc-arm-mutation-glm-group-b-native' || github.event.inputs.mode == 'approval_device_enrolment_code_issue' && 'gunbc-subject-mutation-approval-device-store-srv1' || github.event.inputs.mode == 'r2_conditional_put_race_probe' && 'r2-conditional-put-race-probe' || format('gunbc-host-mutation-{0}', github.event.inputs.host) }}
       cancel-in-progress: false
     steps:
       - name: Checkout
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
         with:
           fetch-depth: 0
-          ref: ${{ (github.event.inputs.mode == 'mtcollins1_boot' || github.event.inputs.mode == 'gcp_iam_converge' || github.event.inputs.mode == 'namecheap_observe' || github.event.inputs.mode == 'printer') && github.sha || github.event.inputs.expected_revision || github.sha }}
+          ref: ${{ github.sha }}
       - name: Download release-bins artifact
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
         with:
@@ -639,7 +620,7 @@ jobs:
       - name: Verify the handed-off release bins against the build key, then promote and run --verify-build-artifacts (fail-closed)
         id: release_bins
         run: |
-          if [ "${FLEET_CONVERGE_MODE:-}" = 'approval_device_enrolment_code_issue' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_source_pack' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_measure' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_restore' ]; then
+          if [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_allocation_plan' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_image_build' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'approval_device_enrolment_code_issue' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_source_pack' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_measure' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_checkpoint_restore' ] || [ "${FLEET_CONVERGE_MODE:-}" = 'workspace_transcript_rate_observe' ]; then
           set -e
           ROOT=$('git' 'rev-parse' '--show-toplevel')
           '[' '-n' "$RELEASE_BINS_KEY" ']' || ('echo' '::error title=release-bins ConsumerKeyMissing::the build job published no release-bins key'; exit 1)
@@ -757,17 +738,6 @@ jobs:
           RELEASE_BINS_KEY: ${{ needs.build.outputs.release_bins_key }}
           FLEET_CONVERGE_MODE: ${{ github.event.inputs.mode }}
         timeout-minutes: 5
-      - name: "Pair-serving D0 admission (credential-free): the executor is srv1, the consent and the expected revision are named"
-        id: pair_serving_d0_admit
-        run: |-
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/pair_serving_d0_door.dag --function pair_serving_d0_admit_executor
-        env:
-          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
-          GUNBC_D0_CONSENT: ${{ github.event.inputs.d0_consent }}
-          RLM_EXPECTED_REVISION: ${{ github.event.inputs.expected_revision }}
-        if: github.event.inputs.mode == 'pair_serving_d0'
-        timeout-minutes: 15
       - name: WIF auth (OIDC -> fleet-cloud-convergence SA, access token only)
         id: wif_auth
         uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
@@ -776,6 +746,26 @@ jobs:
           service_account: fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com
           token_format: access_token
           create_credentials_file: false
+        if: "!(github.event.inputs.mode == 'hetzner_cloud_server_read') && !(github.event.inputs.mode == 'workspace_image_build' || github.event.inputs.mode == 'workspace_allocation_plan')"
+        timeout-minutes: 5
+      - name: "Run-scoped grant: wait for the grant run main's broker dispatched for this run attempt"
+        id: branch_run_grant_await
+        run: |-
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/auth/branch_run_grant_await.dag --function await_grant
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        if: github.event.inputs.mode == 'hetzner_cloud_server_read'
+        timeout-minutes: 50
+      - name: WIF auth (OIDC -> branch-dispatch pool -> hetzner-cloud-control SA; only after this run's grant)
+        id: wif_auth_hetzner_cloud_control
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+        with:
+          workload_identity_provider: projects/582015116396/locations/global/workloadIdentityPools/github-fleet-converge-dispatch/providers/github-fleet-converge-dispatch-oidc
+          service_account: hetzner-cloud-control@gunbai-secrets.iam.gserviceaccount.com
+          token_format: access_token
+          create_credentials_file: false
+        if: github.event.inputs.mode == 'hetzner_cloud_server_read'
         timeout-minutes: 5
       - name: Materialize fleet key in-run (SM versions/1 pinned -> RUNNER_TEMP 0600 -> ssh-agent -> wipe file)
         run: |-
@@ -804,7 +794,7 @@ jobs:
           echo "fleet-key: agent loaded (identity fleet-automation@gunbc; secret versions/1 pinned; fingerprint verified against modeled authority; key file wiped)"
         env:
           WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-        if: github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'launch_environment_plan' || github.event.inputs.mode == 'allocation_store_plan' || github.event.inputs.mode == 'workspace_commissioning_plan' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'app_control_plane_observe' || github.event.inputs.mode == 'microvm_host_converge' || github.event.inputs.mode == 'microvm_network_observe' || github.event.inputs.mode == 'microvm_network_apply' || github.event.inputs.mode == 'guest_image_observe' || github.event.inputs.mode == 'guest_image_converge' || github.event.inputs.mode == 'microvm_boot_probe' || github.event.inputs.mode == 'spark_grants' || github.event.inputs.mode == 'spark_bootstrap' || github.event.inputs.mode == 'spark_serving_apply' || github.event.inputs.mode == 'spark_native_serving_apply' || github.event.inputs.mode == 'spark_runtime_image_probe' || github.event.inputs.mode == 'spark_wireless_link_converge' || github.event.inputs.mode == 'spark_grants_observe' || github.event.inputs.mode == 'spark_v41_checkpoint_materialize' || github.event.inputs.mode == 'spark_v41_row_store_encode' || github.event.inputs.mode == 'spark_v41_row_store_readback' || github.event.inputs.mode == 'spark_v41_engram_differential' || github.event.inputs.mode == 'spark_runtime_image_produce' || github.event.inputs.mode == 'spark_runtime_image_distribute' || github.event.inputs.mode == 'spark_arm_group_load' || github.event.inputs.mode == 'spark_arm_checkpoint_materialize' || github.event.inputs.mode == 'spark_arm_group_observe' || github.event.inputs.mode == 'spark_arm_group_launch_plan' || github.event.inputs.mode == 'spark_arm_group_launch' || github.event.inputs.mode == 'spark_v41_serving_load' || github.event.inputs.mode == 'dashboard_deploy' || github.event.inputs.mode == 'approval_broker_dark_install' || github.event.inputs.mode == 'microvm_controller_install' || github.event.inputs.mode == 'rlm_launch_deployment_receipt' || github.event.inputs.mode == 'host_reset_return' || github.event.inputs.mode == 'runner_host_file_observe' || github.event.inputs.mode == 'runner_host_file_converge' || github.event.inputs.mode == 'site_pxe_edge_observe' || github.event.inputs.mode == 'site_pxe_edge_converge' || github.event.inputs.mode == 'runner_password_session_tool_converge' || github.event.inputs.mode == 'runner_browser_toolchain_converge' || github.event.inputs.mode == 'r2_mint_preflight' || github.event.inputs.mode == 'r2_object_write_mint' || github.event.inputs.mode == 'approval_keyring_converge' || github.event.inputs.mode == 'approval_device_enrolment_code_issue' || github.event.inputs.mode == 'mtcollins1_boot' || github.event.inputs.mode == 'mtcollins1_census_image_publish' || github.event.inputs.mode == 'mtcollins1_census_member_readback' || github.event.inputs.mode == 'host_credential_custody_converge' || github.event.inputs.mode == 'pair_serving_d0'
+        if: github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'launch_environment_plan' || github.event.inputs.mode == 'allocation_store_plan' || github.event.inputs.mode == 'workspace_commissioning_plan' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'app_control_plane_observe' || github.event.inputs.mode == 'microvm_host_converge' || github.event.inputs.mode == 'microvm_network_observe' || github.event.inputs.mode == 'microvm_network_apply' || github.event.inputs.mode == 'guest_image_observe' || github.event.inputs.mode == 'guest_image_converge' || github.event.inputs.mode == 'microvm_boot_probe' || github.event.inputs.mode == 'spark_grants' || github.event.inputs.mode == 'spark_bootstrap' || github.event.inputs.mode == 'spark_serving_apply' || github.event.inputs.mode == 'spark_native_serving_apply' || github.event.inputs.mode == 'spark_runtime_image_probe' || github.event.inputs.mode == 'spark_wireless_link_converge' || github.event.inputs.mode == 'spark_grants_observe' || github.event.inputs.mode == 'dashboard_deploy' || github.event.inputs.mode == 'approval_broker_dark_install' || github.event.inputs.mode == 'microvm_controller_install' || github.event.inputs.mode == 'rlm_launch_deployment_receipt' || github.event.inputs.mode == 'host_reset_return' || github.event.inputs.mode == 'runner_host_file_observe' || github.event.inputs.mode == 'runner_host_file_converge' || github.event.inputs.mode == 'site_pxe_edge_observe' || github.event.inputs.mode == 'site_pxe_edge_converge' || github.event.inputs.mode == 'runner_password_session_tool_converge' || github.event.inputs.mode == 'runner_browser_toolchain_converge' || github.event.inputs.mode == 'r2_mint_preflight' || github.event.inputs.mode == 'r2_object_write_mint' || github.event.inputs.mode == 'approval_keyring_converge' || github.event.inputs.mode == 'approval_device_enrolment_code_issue' || github.event.inputs.mode == 'mtcollins1_boot' || github.event.inputs.mode == 'mtcollins1_census_image_publish' || github.event.inputs.mode == 'mtcollins1_census_member_readback' || github.event.inputs.mode == 'host_credential_custody_converge'
         timeout-minutes: 5
       - name: Fleet converge plan (membership_reconcile → artifact)
         id: plan
@@ -843,6 +833,40 @@ jobs:
           RLM_EXPECTED_REVISION: ${{ github.event.inputs.expected_revision }}
         if: github.event.inputs.mode == 'workspace_commissioning_plan'
         timeout-minutes: 15
+      - name: "Workspace: workspace_allocation_plan"
+        id: workspace_allocation_plan
+        run: |-
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/fleet/fleet_converge_plan_cli.dag --function fleet_converge_workspace_allocation_plan_wet
+        env:
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ inputs.host }}
+          RLM_EXPECTED_REVISION: ${{ inputs.expected_revision }}
+        if: github.event.inputs.mode == 'workspace_allocation_plan'
+        timeout-minutes: 30
+      - name: "Workspace: workspace_image_build"
+        id: workspace_image_build
+        run: |
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          fakeroot -- "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/workspace_image_delivery.dag --function workspace_image_build_wet
+        env:
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ inputs.host }}
+          RLM_EXPECTED_REVISION: ${{ inputs.expected_revision }}
+        if: github.event.inputs.mode == 'workspace_image_build'
+        timeout-minutes: 30
+      - name: Archive the exact workspace image build and digest receipt
+        id: workspace_image_upload
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: workspace-guest-image
+          path: |-
+            target/workspace-image-artifact/workspace.ext4
+            target/workspace-image-artifact/base/vmlinux-6.1.128
+            target/workspace-image-artifact/build-receipt.txt
+          if-no-files-found: error
+          retention-days: 90
+          compression-level: 6
+        if: github.event.inputs.mode == 'workspace_image_build'
+        timeout-minutes: 10
       - name: Upload fleet converge plan artifact
         id: plan_upload
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
@@ -852,7 +876,7 @@ jobs:
           if-no-files-found: error
           retention-days: 30
           compression-level: 0
-        if: github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'launch_environment_plan' || github.event.inputs.mode == 'allocation_store_plan' || github.event.inputs.mode == 'workspace_commissioning_plan'
+        if: github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'launch_environment_plan' || github.event.inputs.mode == 'allocation_store_plan' || github.event.inputs.mode == 'workspace_commissioning_plan' || github.event.inputs.mode == 'workspace_allocation_plan'
         timeout-minutes: 10
       - name: Download fleet converge plan artifact
         id: plan_download
@@ -1142,38 +1166,6 @@ jobs:
           retention-days: 30
         if: github.event.inputs.mode == 'mtcollins1_fan_observe'
         timeout-minutes: 10
-      - name: "Mt. Collins served UI: firmware revision, then source.min.js, viewer.html and every script they load, each with its sha256 (reads only)"
-        id: mtcollins1_ui_bundle_observe
-        run: |
-          'set' '-euo' 'pipefail'
-          'umask' '077'
-          HDR_FILE="$RUNNER_TEMP"'/mtcollins1-ui-bundle-auth-header'
-          RESP_FILE="$RUNNER_TEMP"'/mtcollins1-ui-bundle-sm.json'
-          DEST_FILE="$RUNNER_TEMP"'/mtcollins1-ui-bundle-bmc-credential'
-          'trap' ''\''rm'\'' '\''-f'\'' "$HDR_FILE" "$RESP_FILE" "$DEST_FILE"
-          ' 'EXIT'
-          'printf' 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          'curl' '-sSf' '--connect-timeout' '10' '--max-time' '60' '-o' "$RESP_FILE" '-H' '@'"$HDR_FILE" 'https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc/versions/2:access' && 'python3' '-c' 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$DEST_FILE"
-          'chmod' '600' "$DEST_FILE"
-          'export' 'GUNBC_MTCOLLINS1_BMC_CREDENTIAL_FILE='"$DEST_FILE"
-          ROOT=$('git' 'rev-parse' '--show-toplevel' 2>/dev/null || 'pwd')
-
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/machine_intake/mtcollins1_ui_bundle_observe.dag --function mtcollins1_ui_bundle_observe_wet
-        env:
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-        if: github.event.inputs.mode == 'mtcollins1_ui_bundle_observe'
-        timeout-minutes: 25
-      - name: Upload Mt. Collins served UI files and receipt
-        id: mtcollins1_ui_bundle_observe_upload
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
-        with:
-          name: mtcollins1-ui-bundle
-          path: target/mtcollins1-ui-bundle-*
-          if-no-files-found: error
-          retention-days: 90
-          compression-level: 0
-        if: always() && github.event.inputs.mode == 'mtcollins1_ui_bundle_observe'
-        timeout-minutes: 10
       - name: "Mt. Collins KVM observer, no boot: under the unit hold, log in, establish the viewer, one still, release"
         id: mtcollins1_kvm_observer_observe
         run: |
@@ -1237,27 +1229,6 @@ jobs:
           compression-level: 0
         if: always() && github.event.inputs.mode == 'fabric_writer_identity_observe'
         timeout-minutes: 10
-      - name: "Pair-serving D0 (Cut D): file the consent, wait for the operator, suspend the group's authority for the keyed successor under the admitted grant"
-        id: pair_serving_d0
-        run: |-
-          # 🟡 dissolve-on: gunbc_ci_pair_serving_d0_invoke - orch-emitted foreign-executor (GitHub Actions run:) credential runner: WIF access token by env, ONE pinned submission-MAC secret version fetched over curl through the shared auth header and SM decode, a 0600 file under RUNNER_TEMP with a trap armed BEFORE the key touches disk. The pipeline steps are modeled (gunbc_ci_pair_serving_d0_prelude) but the runner transport itself remains hand-shell; DISSOLVES WHEN the runner is authored as v2.extdeps.languages.bash_build nodes (typed, grammar-quoted words; command substitution; assignment; pipe; if/test; redirect; || true) emitted by v2.workflow.bash_emit bash_emit_stmts -- a route AVAILABLE today (#12422 retired the sibling pack runner on it), so this migration is unauthored, not blocked on a missing capability; set -euo pipefail, umask, export and trap are ordinary commands on that route, and the trap body is itself built from nodes and passed as one grammar-quoted word, so no new orchestration intent is a prerequisite
-          set -euo pipefail
-          umask 077
-          HDR_FILE="$RUNNER_TEMP/pair-serving-d0-auth-header"
-          RESP_FILE="$RUNNER_TEMP/pair-serving-d0-sm.json"
-          SUB_FILE="$RUNNER_TEMP/approval-submission-mac-key"
-          trap 'rm -f "$HDR_FILE" "$RESP_FILE" "$SUB_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          if DEST_FILE="$SUB_FILE"; curl -sSf --connect-timeout 10 --max-time 60 -o "$RESP_FILE" -H @"$HDR_FILE" "https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key/versions/1:access" && python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$DEST_FILE"; then chmod 600 "$SUB_FILE"; export GUNBC_APPROVAL_SUBMISSION_MAC_KEY_FILE="$SUB_FILE"; else rm -f "$SUB_FILE"; echo 'submission MAC key not materialized: a run that must file will refuse there; a held lifecycle resumes without it'; fi
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/pair_serving_d0_door.dag --function pair_serving_d0_ci_wet
-        env:
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
-          GUNBC_D0_CONSENT: ${{ github.event.inputs.d0_consent }}
-          RLM_EXPECTED_REVISION: ${{ github.event.inputs.expected_revision }}
-        if: github.event.inputs.mode == 'pair_serving_d0'
-        timeout-minutes: 47
       - name: "Mt. Collins census image: over fleet SSH to srv2, reproduce the pinned image in scratch, then build and publish the current derivation create-only in /srv/bmc"
         id: mtcollins1_census_image_publish
         run: |-
@@ -1448,6 +1419,25 @@ jobs:
           retention-days: 30
         if: always() && github.event.inputs.mode == 'r2_workspace_object_write_mint'
         timeout-minutes: 10
+      - name: Hetzner Cloud acquired-server read (GET /v1/servers/{id}; changes nothing)
+        id: hetzner_cloud_server_read
+        run: |-
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/fleet/hetzner_cloud_server_control.dag --function read
+        env:
+          WIF_ACCESS_TOKEN: ${{ steps.wif_auth_hetzner_cloud_control.outputs.access_token }}
+        if: github.event.inputs.mode == 'hetzner_cloud_server_read'
+        timeout-minutes: 5
+      - name: Upload Hetzner Cloud server read receipt (ids, names, statuses; no secret)
+        id: hetzner_cloud_server_read_receipt_upload
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: hetzner-cloud-server-read-receipt
+          path: target/hetzner-cloud-server-read-receipt.txt
+          if-no-files-found: warn
+          retention-days: 30
+        if: always() && github.event.inputs.mode == 'hetzner_cloud_server_read'
+        timeout-minutes: 10
       - name: R2 cache-blobs object-read token mint (AccountTokens.Create + Secret Manager custody)
         id: r2_cache_object_read_mint
         run: |-
@@ -1514,6 +1504,7 @@ jobs:
           cat "$ROOT/target/workspace-source-pack-receipt.txt"
         env:
           WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
+          WORKSPACE_AGENT_STATE_SLOT: ${{ github.event.inputs.agent_state_slot }}
         if: github.event.inputs.mode == 'workspace_source_pack'
         timeout-minutes: 120
       - name: Upload workspace source pack receipt
@@ -1570,6 +1561,27 @@ jobs:
           compression-level: 0
         if: always() && github.event.inputs.mode == 'workspace_checkpoint_restore'
         timeout-minutes: 10
+      - name: "Workspace transcript append rate: size and mtime of every transcript file on srv1, sampled per interval over a declared window, content never read"
+        id: workspace_transcript_rate_observe
+        run: |-
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/fabric/workspace_transcript_rate.dag --function workspace_transcript_rate_observe_wet
+          cat "$ROOT/target/workspace-transcript-rate-receipt.txt"
+        env:
+          WORKSPACE_AGENT_STATE_SLOT: ${{ github.event.inputs.agent_state_slot }}
+        if: github.event.inputs.mode == 'workspace_transcript_rate_observe'
+        timeout-minutes: 30
+      - name: Upload workspace transcript append-rate receipt
+        id: workspace_transcript_rate_observe_receipt_upload
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: workspace-transcript-rate-observe
+          path: target/workspace-transcript-rate-receipt.txt
+          if-no-files-found: error
+          retention-days: 90
+          compression-level: 0
+        if: always() && github.event.inputs.mode == 'workspace_transcript_rate_observe'
+        timeout-minutes: 10
       - name: Materialize approval MAC keys on srv1 (SM pinned -> sha256 prefix -> /etc/gunbc-roadmap 0640)
         id: approval_keyring_converge
         run: |-
@@ -1829,7 +1841,7 @@ jobs:
           HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
           trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
           printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
+          case "${SPARK_CONVERGE_TARGET:-}" in *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
           HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
           if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
           if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
@@ -1858,7 +1870,7 @@ jobs:
           HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
           trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
           printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
+          case "${SPARK_CONVERGE_TARGET:-}" in *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
           HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
           if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
           if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
@@ -1887,7 +1899,7 @@ jobs:
           HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
           trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
           printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
+          case "${SPARK_CONVERGE_TARGET:-}" in *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
           HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
           if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
           if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
@@ -1916,7 +1928,7 @@ jobs:
           HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
           trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
           printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
+          case "${SPARK_CONVERGE_TARGET:-}" in *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
           HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
           if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
           if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
@@ -1945,7 +1957,7 @@ jobs:
           HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
           trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
           printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
+          case "${SPARK_CONVERGE_TARGET:-}" in *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
           HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
           if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
           if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
@@ -1974,7 +1986,7 @@ jobs:
           HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
           trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
           printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
+          case "${SPARK_CONVERGE_TARGET:-}" in *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
           HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
           if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
           if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
@@ -2001,468 +2013,72 @@ jobs:
           cat "$ROOT/target/spark-exact-grant-probe-receipt.txt"
         if: github.event.inputs.mode == 'spark_grants_observe'
         timeout-minutes: 60
-      - name: Spark V4.1 checkpoint materialize (fetch the admitted published files onto the selected Group A Spark, verify each sha256 before publishing, read the storage-backed Engram spans)
-        id: spark_v41_checkpoint_materialize
+      - name: "Runner host files: observe the teardown drop-in, the needrestart deferral and the loaded teardown (no writes)"
+        id: runner_host_file_observe
         run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
           ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/v41_checkpoint_materialize.dag --function v41_checkpoint_materialize_ci_wet
-          cat "$ROOT/target/v41-checkpoint-materialize-receipt.txt"
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/runner/runner_host_file_converge.dag --function runner_host_file_observe_ci_wet
+          cat "$ROOT/target/runner-host-file-converge-receipt.txt"
         env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-        if: github.event.inputs.mode == 'spark_v41_checkpoint_materialize'
-        timeout-minutes: 60
-      - name: Spark V4.1 index selection (verify the pinned index on the selected Group A Spark and read its .engram. selection with parse_json_document, in its own process)
-        id: spark_v41_index_selection
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
+        if: github.event.inputs.mode == 'runner_host_file_observe'
+        timeout-minutes: 15
+      - name: "Runner host files: write what differs as the administrator, reload if the drop-in changed, read the loaded teardown back"
+        id: runner_host_file_converge
         run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
           ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/v41_checkpoint_materialize.dag --function v41_index_selection_ci_wet
-          cat "$ROOT/target/v41-index-selection-receipt.txt"
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/runner/runner_host_file_converge.dag --function runner_host_file_converge_ci_wet
+          cat "$ROOT/target/runner-host-file-converge-receipt.txt"
         env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-        if: always() && github.event.inputs.mode == 'spark_v41_checkpoint_materialize'
-        timeout-minutes: 60
-      - name: Spark V4.1 row store encode (encode the eight Engram row stores from the verified shards on the selected Group A Spark and read each store's sha256)
-        id: spark_v41_row_store_encode
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
+        if: github.event.inputs.mode == 'runner_host_file_converge'
+        timeout-minutes: 15
+      - name: "Password-session tools: ensure every tool password_session_host_cli_requirements enrolls is present on this runner, installing only what is measured absent"
+        id: runner_password_session_tool_converge
         run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
           ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/v41_row_store_encode_run.dag --function v41_row_store_encode_ci_wet
-          cat "$ROOT/target/v41-row-store-encode-receipt.txt"
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/runner/runner_password_session_tool_converge.dag --function runner_password_session_tool_converge_ci_wet
+          cat "$ROOT/target/runner-password-session-tool-converge-receipt.txt"
         env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-        if: github.event.inputs.mode == 'spark_v41_row_store_encode'
-        timeout-minutes: 60
-      - name: Spark V4.1 row store readback (read the eight Engram row stores' header, first and last record and the published source rows at every rank seam on the selected Group A Spark, writing nothing)
-        id: spark_v41_row_store_readback
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
+        if: github.event.inputs.mode == 'runner_password_session_tool_converge'
+        timeout-minutes: 15
+      - name: Upload password-session tool converge receipt
+        id: runner_password_session_tool_receipt_upload
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: runner-password-session-tool-converge-receipt
+          path: target/runner-password-session-tool-converge-receipt.txt
+          if-no-files-found: error
+          retention-days: 30
+        if: always() && (github.event.inputs.mode == 'runner_password_session_tool_converge')
+        timeout-minutes: 10
+      - name: "Browser toolchain: apt host libraries as the administrator, digest-pinned node/Playwright/Chromium archives into the job user's root, then read back digests, versions, libraries and a headless render"
+        id: runner_browser_toolchain_converge
         run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
           ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/v41_row_store_readback_run.dag --function v41_row_store_readback_ci_wet
-          cat "$ROOT/target/v41-row-store-readback-receipt.txt"
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/runner/runner_browser_toolchain.dag --function runner_browser_toolchain_converge_ci_wet
+          cat "$ROOT/target/runner-browser-toolchain-converge-receipt.txt"
         env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-        if: github.event.inputs.mode == 'spark_v41_row_store_readback'
-        timeout-minutes: 60
-      - name: Spark V4.1 Engram differential (upstream lookup kernel vs the design-B file-backed lookup over sampled real rows of every row store, byte for byte, on the selected Group A Spark, read-only)
-        id: spark_v41_engram_differential
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
+        if: github.event.inputs.mode == 'runner_browser_toolchain_converge'
+        timeout-minutes: 15
+      - name: Upload browser toolchain converge receipt
+        id: runner_browser_toolchain_receipt_upload
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: runner-browser-toolchain-converge-receipt
+          path: target/runner-browser-toolchain-converge-receipt.txt
+          if-no-files-found: error
+          retention-days: 30
+        if: always() && (github.event.inputs.mode == 'runner_browser_toolchain_converge')
+        timeout-minutes: 10
+      - name: "Host credential custody: deliver the chosen rostered credential from Secret Manager at its row's owner, group and mode, read owner, mode, directory, bytes and staging back"
+        id: host_credential_custody_converge
         run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
           ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/v41_engram_differential_run.dag --function v41_engram_differential_ci_wet
-          cat "$ROOT/target/v41-engram-differential-receipt.txt"
-        env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-        if: github.event.inputs.mode == 'spark_v41_engram_differential'
-        timeout-minutes: 60
-      - name: "Spark runtime image produce (the image named by the closed runtime_image input, gunbc.spark.runtime_image_produce_dispatch: built on the selected Group A Spark, read back by digest and probed inside that digest)"
-        id: spark_runtime_image_produce
-        run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/runtime_image_produce_dispatch.dag --function runtime_image_produce_ci_wet
-          cat "$ROOT/target/runtime-image-produce-receipt.txt"
-        env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-          GUNBC_RUNTIME_IMAGE: ${{ github.event.inputs.runtime_image }}
-        if: github.event.inputs.mode == 'spark_runtime_image_produce'
-        timeout-minutes: 180
-      - name: Spark runtime image distribute (the produced image named by the closed runtime_image input, by its configuration digest, from the host its production receipt names to the selected Spark of its group, read back there)
-        id: spark_runtime_image_distribute
-        run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/runtime_image_produce_dispatch.dag --function runtime_image_distribute_ci_wet
-          cat "$ROOT/target/runtime-image-distribute-receipt.txt"
-        env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-          GUNBC_RUNTIME_IMAGE: ${{ github.event.inputs.runtime_image }}
-        if: github.event.inputs.mode == 'spark_runtime_image_distribute'
-        timeout-minutes: 120
-      - name: Spark arm checkpoint materialize (the checkpoint named by the closed checkpoint input, adopted or fetched into the target Spark's Hub cache and verified)
-        id: spark_arm_checkpoint_materialize
-        run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/arm_group_launch_dispatch.dag --function arm_checkpoint_materialize_ci
-          cat "$ROOT/target/arm-checkpoint-materialize-receipt.txt"
-        env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-          GUNBC_ARM_LAUNCH: ${{ github.event.inputs.arm }}
-          GUNBC_ARM_STAIRCASE_STEP: ${{ github.event.inputs.staircase_step }}
-          GUNBC_ARM_INCUMBENT: ${{ github.event.inputs.incumbent }}
-          GUNBC_ARM_CHECKPOINT: ${{ github.event.inputs.checkpoint }}
-          GUNBC_RUNTIME_IMAGE: ${{ github.event.inputs.runtime_image }}
-        if: github.event.inputs.mode == 'spark_arm_checkpoint_materialize'
-        timeout-minutes: 180
-      - name: "Spark arm group OBSERVE (read-only: every host's running units, containers and GPU processes with their owning cgroups; nothing is changed)"
-        id: spark_arm_group_observe
-        run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/arm_group_launch_dispatch.dag --function arm_group_observe_ci
-          cat "$ROOT/target/arm-group-observe-receipt.txt"
-        env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-          GUNBC_ARM_LAUNCH: ${{ github.event.inputs.arm }}
-          GUNBC_ARM_STAIRCASE_STEP: ${{ github.event.inputs.staircase_step }}
-          GUNBC_ARM_INCUMBENT: ${{ github.event.inputs.incumbent }}
-        if: github.event.inputs.mode == 'spark_arm_group_observe'
-        timeout-minutes: 60
-      - name: Spark arm group launch PLAN (the chosen arm's plan, units, scripts, declared incumbent and admission verdict; no host is touched)
-        id: spark_arm_group_launch_plan
-        run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/arm_group_launch_dispatch.dag --function arm_group_launch_plan_ci
-          cat "$ROOT/target/arm-group-launch-plan.txt"
-        env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-          GUNBC_ARM_LAUNCH: ${{ github.event.inputs.arm }}
-          GUNBC_ARM_STAIRCASE_STEP: ${{ github.event.inputs.staircase_step }}
-          GUNBC_ARM_INCUMBENT: ${{ github.event.inputs.incumbent }}
-        if: github.event.inputs.mode == 'spark_arm_group_launch_plan'
-        timeout-minutes: 60
-      - name: Spark arm group launch (the chosen arm's reads and admission, its pre-apply, the declared incumbent stopped and the hosts re-read vacant, then the arm applied as one transaction; the incumbent restored on anything but a commit)
-        id: spark_arm_group_launch
-        run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/arm_group_launch_dispatch.dag --function arm_group_launch_ci_wet
-          cat "$ROOT/target/arm-group-launch-receipt.txt"
-        env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-          GUNBC_ARM_LAUNCH: ${{ github.event.inputs.arm }}
-          GUNBC_ARM_STAIRCASE_STEP: ${{ github.event.inputs.staircase_step }}
-          GUNBC_ARM_INCUMBENT: ${{ github.event.inputs.incumbent }}
-        if: github.event.inputs.mode == 'spark_arm_group_launch'
-        timeout-minutes: 110
-      - name: Spark arm group load (the staircase step named by the closed inputs, loaded at its cold floor and its ceiling from its head; stop rules judged; calibration receipt folded)
-        id: spark_arm_group_load
-        run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/arm_group_launch_dispatch.dag --function arm_group_load_ci
-          cat "$ROOT/target/arm-group-load-receipt.txt"
-        env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-          GUNBC_ARM_LAUNCH: ${{ github.event.inputs.arm }}
-          GUNBC_ARM_STAIRCASE_STEP: ${{ github.event.inputs.staircase_step }}
-          GUNBC_ARM_INCUMBENT: ${{ github.event.inputs.incumbent }}
-        if: github.event.inputs.mode == 'spark_arm_group_load'
-        timeout-minutes: 60
-      - name: "Spark V4.1 serving-load staircase (shared serving-load runner: per concurrency scrape, vllm bench serve, scrape, with rank pressure on srv5-8; the staircase's stop rules over the worst rank)"
-        id: spark_v41_serving_load
-        run: |-
-          set -euo pipefail
-          umask 077
-          CRED_FILE="$RUNNER_TEMP/spark-administrator-credential"
-          RESP_FILE="$RUNNER_TEMP/spark-administrator-response.json"
-          HDR_FILE="$RUNNER_TEMP/spark-administrator-auth-header"
-          trap 'rm -f "$CRED_FILE" "$RESP_FILE" "$HDR_FILE"' EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          case "${SPARK_CONVERGE_TARGET:-}" in srv5) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv6) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv7) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv8) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv9) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv10) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv11) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; srv12) SM_URL="https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/spark-administrator-password/versions/1:access"; SM_RES="projects/gunbai-secrets/secrets/spark-administrator-password/versions/1" ;; *) echo "SparkAdministratorCredentialHostUnrostered: SPARK_CONVERGE_TARGET='${SPARK_CONVERGE_TARGET:-}' names no host in the administrator credential roster; contacting NO host" >&2; exit 1 ;; esac
-          HTTP_CODE="$(curl -sS -o "$RESP_FILE" -w '%{http_code}' -H @"$HDR_FILE" "$SM_URL" || echo 000)"
-          if [ "$HTTP_CODE" = 403 ]; then echo "SparkAdministratorCredentialUnreadable: $SM_RES answered 403 to serviceAccount:fleet-cloud-convergence@gunbai-secrets.iam.gserviceaccount.com. Secret Manager returns 403 both when a version exists and is not readable AND when it does not exist, so this run cannot tell those apart -- REMEDY EITHER WAY: confirm the version exists and grant that principal roles/secretmanager.secretAccessor on it. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" = 404 ]; then echo "SparkAdministratorCredentialAbsent: $SM_RES answered 404; the modeled reference names a version Secret Manager does not hold. Contacting NO host." >&2; exit 1; fi
-          if [ "$HTTP_CODE" != 200 ]; then echo "SparkAdministratorCredentialFetchFailed: HTTP $HTTP_CODE from $SM_RES; contacting NO host." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$RESP_FILE" > "$CRED_FILE"
-          rm -f "$RESP_FILE"
-          chmod 600 "$CRED_FILE"
-          if [ ! -s "$CRED_FILE" ]; then echo "SparkAdministratorCredentialEmpty: $SM_RES returned 200 with an empty payload, which is an enrolled-but-blank secret and never a blank password; contacting NO host" >&2; exit 1; fi
-          export GUNBC_SPARK_BOOTSTRAP_CREDENTIAL_FILE="$CRED_FILE"
-          echo "spark-admin-credential: materialized from $SM_RES to a 0600 run-local file, consumed and removed within this one step"
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/spark/v41_serving_load.dag --function v41_serving_load_ci_wet
-          cat "$ROOT/target/v41-serving-load-receipt.txt"
-        env:
-          SPARK_CONVERGE_TARGET: ${{ github.event.inputs.target }}
-          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-        if: github.event.inputs.mode == 'spark_v41_serving_load'
-        timeout-minutes: 60
-      - name: "Runner host files: observe the teardown drop-in, the needrestart deferral and the loaded teardown (no writes)"
-        id: runner_host_file_observe
-        run: |-
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/runner/runner_host_file_converge.dag --function runner_host_file_observe_ci_wet
-          cat "$ROOT/target/runner-host-file-converge-receipt.txt"
-        env:
-          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
-        if: github.event.inputs.mode == 'runner_host_file_observe'
-        timeout-minutes: 15
-      - name: "Runner host files: write what differs as the administrator, reload if the drop-in changed, read the loaded teardown back"
-        id: runner_host_file_converge
-        run: |-
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/runner/runner_host_file_converge.dag --function runner_host_file_converge_ci_wet
-          cat "$ROOT/target/runner-host-file-converge-receipt.txt"
-        env:
-          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
-        if: github.event.inputs.mode == 'runner_host_file_converge'
-        timeout-minutes: 15
-      - name: "Password-session tools: ensure every tool password_session_host_cli_requirements enrolls is present on this runner, installing only what is measured absent"
-        id: runner_password_session_tool_converge
-        run: |-
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/runner/runner_password_session_tool_converge.dag --function runner_password_session_tool_converge_ci_wet
-          cat "$ROOT/target/runner-password-session-tool-converge-receipt.txt"
-        env:
-          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
-        if: github.event.inputs.mode == 'runner_password_session_tool_converge'
-        timeout-minutes: 15
-      - name: Upload password-session tool converge receipt
-        id: runner_password_session_tool_receipt_upload
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
-        with:
-          name: runner-password-session-tool-converge-receipt
-          path: target/runner-password-session-tool-converge-receipt.txt
-          if-no-files-found: error
-          retention-days: 30
-        if: always() && (github.event.inputs.mode == 'runner_password_session_tool_converge')
-        timeout-minutes: 10
-      - name: "Browser toolchain: apt host libraries as the administrator, digest-pinned node/Playwright/Chromium archives into the job user's root, then read back digests, versions, libraries and a headless render"
-        id: runner_browser_toolchain_converge
-        run: |-
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/runner/runner_browser_toolchain.dag --function runner_browser_toolchain_converge_ci_wet
-          cat "$ROOT/target/runner-browser-toolchain-converge-receipt.txt"
-        env:
-          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
-        if: github.event.inputs.mode == 'runner_browser_toolchain_converge'
-        timeout-minutes: 15
-      - name: Upload browser toolchain converge receipt
-        id: runner_browser_toolchain_receipt_upload
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
-        with:
-          name: runner-browser-toolchain-converge-receipt
-          path: target/runner-browser-toolchain-converge-receipt.txt
-          if-no-files-found: error
-          retention-days: 30
-        if: always() && (github.event.inputs.mode == 'runner_browser_toolchain_converge')
-        timeout-minutes: 10
-      - name: "Host credential custody: deliver the chosen rostered credential from Secret Manager at its row's owner, group and mode, read owner, mode, directory, bytes and staging back"
-        id: host_credential_custody_converge
-        run: |-
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/fleet/host_credential_custody_converge.dag --function host_credential_custody_converge_ci_wet
-          cat "$ROOT/target/host-credential-custody-converge-receipt.txt"
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/fleet/host_credential_custody_converge.dag --function host_credential_custody_converge_ci_wet
+          cat "$ROOT/target/host-credential-custody-converge-receipt.txt"
         env:
           FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
           FLEET_CONVERGE_CUSTODY_CREDENTIAL: ${{ github.event.inputs.credential }}
@@ -2549,7 +2165,7 @@ jobs:
           echo "CARGO_HOME=$RUNNER_TEMP/cargo" >> "$GITHUB_ENV"
           echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
           echo "MAKEFLAGS=" >> "$GITHUB_ENV"
-          echo "CARGO_BUILD_JOBS=6" >> "$GITHUB_ENV"
+          echo "CARGO_BUILD_JOBS=5" >> "$GITHUB_ENV"
           if sccache --show-stats >/dev/null 2>&1; then
           echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
           echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"
@@ -2752,7 +2368,7 @@ jobs:
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
         with:
           fetch-depth: 0
-          ref: ${{ (github.event.inputs.mode == 'mtcollins1_boot' || github.event.inputs.mode == 'gcp_iam_converge' || github.event.inputs.mode == 'namecheap_observe' || github.event.inputs.mode == 'printer') && github.sha || github.event.inputs.expected_revision || github.sha }}
+          ref: ${{ github.sha }}
       - name: Download release-bins artifact
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
         with:
@@ -2855,6 +2471,7 @@ jobs:
   dashboard-deploy:
     runs-on: ${{ fromJSON(format('["self-hosted","linux","arm64","{0}"]', github.event.inputs.host)) }}
     needs: [build]
+    environment: srv1-production
     timeout-minutes: 50
     if: github.event.inputs.mode == 'dashboard_deploy'
     concurrency:
@@ -2865,7 +2482,7 @@ jobs:
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
         with:
           fetch-depth: 0
-          ref: ${{ (github.event.inputs.mode == 'mtcollins1_boot' || github.event.inputs.mode == 'gcp_iam_converge' || github.event.inputs.mode == 'namecheap_observe' || github.event.inputs.mode == 'printer') && github.sha || github.event.inputs.expected_revision || github.sha }}
+          ref: ${{ github.sha }}
       - name: Download release-bins artifact
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
         with:
@@ -2989,6 +2606,7 @@ jobs:
   approval-broker-dark-install:
     runs-on: ${{ fromJSON(format('["self-hosted","linux","arm64","{0}"]', github.event.inputs.host)) }}
     needs: [build]
+    environment: srv1-production
     timeout-minutes: 50
     if: github.event.inputs.mode == 'approval_broker_dark_install'
     concurrency:
@@ -2999,7 +2617,7 @@ jobs:
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
         with:
           fetch-depth: 0
-          ref: ${{ (github.event.inputs.mode == 'mtcollins1_boot' || github.event.inputs.mode == 'gcp_iam_converge' || github.event.inputs.mode == 'namecheap_observe' || github.event.inputs.mode == 'printer') && github.sha || github.event.inputs.expected_revision || github.sha }}
+          ref: ${{ github.sha }}
       - name: Download release-bins artifact
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
         with:
@@ -3088,6 +2706,7 @@ jobs:
   microvm-controller-install:
     runs-on: ${{ fromJSON(format('["self-hosted","linux","arm64","{0}"]', github.event.inputs.host)) }}
     needs: [build]
+    environment: srv1-production
     timeout-minutes: 50
     if: github.event.inputs.mode == 'microvm_controller_install'
     concurrency:
@@ -3098,7 +2717,7 @@ jobs:
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
         with:
           fetch-depth: 0
-          ref: ${{ (github.event.inputs.mode == 'mtcollins1_boot' || github.event.inputs.mode == 'gcp_iam_converge' || github.event.inputs.mode == 'namecheap_observe' || github.event.inputs.mode == 'printer') && github.sha || github.event.inputs.expected_revision || github.sha }}
+          ref: ${{ github.sha }}
       - name: Download release-bins artifact
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
         with:
@@ -3178,6 +2797,15 @@ jobs:
         env:
           RELEASE_BINS_KEY: ${{ needs.build.outputs.release_bins_key }}
         timeout-minutes: 5
+      - name: Download the workspace image selected for installation
+        id: workspace_image_download
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
+        with:
+          name: workspace-guest-image
+          path: target/workspace-image-artifact
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ inputs.workspace_image_run_id }}
+        timeout-minutes: 10
       - name: Install the microVM slot controller release locus, VMM + jailer and template unit on srv1 (additive; starts no instance)
         id: microvm_controller_install
         run: |-
@@ -3201,7 +2829,7 @@ jobs:
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
         with:
           fetch-depth: 0
-          ref: ${{ (github.event.inputs.mode == 'mtcollins1_boot' || github.event.inputs.mode == 'gcp_iam_converge' || github.event.inputs.mode == 'namecheap_observe' || github.event.inputs.mode == 'printer') && github.sha || github.event.inputs.expected_revision || github.sha }}
+          ref: ${{ github.sha }}
       - name: Download release-bins artifact
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
         with:
@@ -3378,7 +3006,7 @@ jobs:
     needs: [build]
     environment: gcp-iam-converge
     timeout-minutes: 60
-    if: github.event.inputs.mode == 'gcp_iam_converge'
+    if: github.event.inputs.mode == 'gcp_iam_converge' || github.event.inputs.mode == 'branch_run_grant'
     permissions:
       contents: read
       actions: read
@@ -3498,6 +3126,17 @@ jobs:
           WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
         if: github.event.inputs.mode == 'gcp_iam_converge'
         timeout-minutes: 40
+      - name: "Branch run grant: read the run from GitHub and the account's policy as iam-observe, file one request, wait for the operator"
+        id: branch_run_grant_request
+        run: |-
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/auth/branch_run_grant.dag --function branch_run_grant_request_wet
+        env:
+          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
+          GITHUB_TOKEN: ${{ github.token }}
+          BRANCH_RUN_KEY: ${{ github.event.inputs.transaction_nonce }}
+        if: github.event.inputs.mode == 'branch_run_grant'
+        timeout-minutes: 40
       - name: WIF auth (OIDC -> dedicated gcp-iam-converge pool -> iam-converge SA; only after a live approval)
         id: wif_auth_iam_converge
         uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
@@ -3507,7 +3146,7 @@ jobs:
           token_format: access_token
           access_token_lifetime: 600s
           create_credentials_file: false
-        if: github.event.inputs.mode == 'gcp_iam_converge' && steps.gcp_iam_request.outputs.approved == 'true'
+        if: (github.event.inputs.mode == 'gcp_iam_converge' && steps.gcp_iam_request.outputs.approved == 'true') || (github.event.inputs.mode == 'branch_run_grant' && steps.branch_run_grant_request.outputs.approved == 'true')
         timeout-minutes: 5
       - name: "GCP IAM converge: re-plan, re-admit the approval, apply exactly the approved effects as iam-converge, read back as iam-observe"
         id: gcp_iam_apply
@@ -3519,6 +3158,18 @@ jobs:
           IAM_CONVERGE_ACCESS_TOKEN: ${{ steps.wif_auth_iam_converge.outputs.access_token }}
         if: github.event.inputs.mode == 'gcp_iam_converge' && steps.gcp_iam_request.outputs.approved == 'true'
         timeout-minutes: 15
+      - name: "Branch run grant: re-derive, re-admit the approval, add exactly the approved run cell as iam-converge, read back as iam-observe"
+        id: branch_run_grant_apply
+        run: |-
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/auth/branch_run_grant.dag --function branch_run_grant_apply_wet
+        env:
+          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
+          GITHUB_TOKEN: ${{ github.token }}
+          BRANCH_RUN_KEY: ${{ github.event.inputs.transaction_nonce }}
+          IAM_CONVERGE_ACCESS_TOKEN: ${{ steps.wif_auth_iam_converge.outputs.access_token }}
+        if: github.event.inputs.mode == 'branch_run_grant' && steps.branch_run_grant_request.outputs.approved == 'true'
+        timeout-minutes: 15
   namecheap-observe:
     runs-on: ${{ fromJSON(format('["self-hosted","linux","arm64","{0}"]', github.event.inputs.host)) }}
     needs: [build]
@@ -3643,6 +3294,132 @@ jobs:
           compression-level: 0
         if: success()
         timeout-minutes: 10
+  arrival-converge:
+    runs-on: [self-hosted, linux, arm64, srv1]
+    needs: [build]
+    environment: mtjade1-arrival
+    timeout-minutes: 25
+    if: github.event.inputs.mode == 'arrival_converge'
+    permissions:
+      contents: read
+      actions: read
+      id-token: write
+    concurrency:
+      group: gunbc-host-mutation-srv1
+      cancel-in-progress: false
+    steps:
+      - name: Checkout (the event sha only; no dispatch input selects these bytes)
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          fetch-depth: 0
+          ref: ${{ github.sha }}
+      - name: Download release-bins artifact
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
+        with:
+          name: release-bins
+          path: ${{ runner.temp }}/release-bins-download
+        timeout-minutes: 10
+      - name: Verify the handed-off release bins against the build key, then promote and run --verify-build-artifacts (fail-closed)
+        id: release_bins
+        run: |
+          set -e
+          ROOT=$('git' 'rev-parse' '--show-toplevel')
+          '[' '-n' "$RELEASE_BINS_KEY" ']' || ('echo' '::error title=release-bins ConsumerKeyMissing::the build job published no release-bins key'; exit 1)
+          '[' '-f' "$RUNNER_TEMP"'/release-bins-download/release-bins.preimage' ']' || ('echo' '::error title=release-bins ConsumerFileMissing::the release-bins artifact is missing release-bins.preimage'; exit 1)
+          '[' '-f' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest' ']' || ('echo' '::error title=release-bins ConsumerFileMissing::the release-bins artifact is missing release-bins.manifest'; exit 1)
+          '[' '-f' "$RUNNER_TEMP"'/release-bins-download/release-bins.tgz' ']' || ('echo' '::error title=release-bins ConsumerFileMissing::the release-bins artifact is missing release-bins.tgz'; exit 1)
+          'sha256sum' "$RUNNER_TEMP"'/release-bins-download/release-bins.preimage' > "$RUNNER_TEMP"'/DOWNLOADED_DIGEST.out'
+          DOWNLOADED_DIGEST=$('cut' '-d' ' ' '-f' '1' "$RUNNER_TEMP"'/DOWNLOADED_DIGEST.out')
+          '[' 'release-bins-'"$DOWNLOADED_DIGEST" '=' "$RELEASE_BINS_KEY" ']' || ('echo' '::error title=release-bins ConsumerPreimageKeyMismatch::the downloaded preimage does not hash to the build job'\''s key'; exit 1)
+          OBJECT_FORMAT=$('git' '-C' "$ROOT" 'rev-parse' '--show-object-format')
+          SOURCE_TREE=$('git' '-C' "$ROOT" 'rev-parse' 'HEAD^{tree}')
+          '[' '-n' "$OBJECT_FORMAT" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input OBJECT_FORMAT read back empty, so the key would not name the build; refusing to key'; exit 1)
+          '[' '-n' "$SOURCE_TREE" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input SOURCE_TREE read back empty, so the key would not name the build; refusing to key'; exit 1)
+          SOURCE_CLOSURE='tree:'"$OBJECT_FORMAT"':'"$SOURCE_TREE"
+          'grep' '-qxF' 'source_closure='"$SOURCE_CLOSURE" "$RUNNER_TEMP"'/release-bins-download/release-bins.preimage' || ('echo' '::error title=release-bins ConsumerSourceTreeMismatch::the pack was keyed on a different source tree than this job'\''s checkout'; exit 1)
+          'printf' '%s' 'claim_executor
+          gunbc
+          discover_source_root_ingest
+          claim_batch
+          interp_recorded_fixture_witness
+          v1_src_dag_parse
+          auth_declared_but_unwired_witness
+          bootstrap_witness
+          dag_collect_fingerprint_witness
+          diagnostics_witness
+          effects_rest_transport_witness
+          infer_semantics_witness
+          parse_witness
+          cssl_assemble
+          namespace_structural_root_exposure_generated_witness
+          codex_app_server_stdio_session
+          ' > "$RUNNER_TEMP"'/release-bins.roster'
+          'tar' '-tzf' "$RUNNER_TEMP"'/release-bins-download/release-bins.tgz' > "$RUNNER_TEMP"'/pack-listing.out'
+          'cmp' '-s' "$RUNNER_TEMP"'/pack-listing.out' "$RUNNER_TEMP"'/release-bins.roster' || ('echo' '::error title=release-bins PackListingNotRoster::the downloaded pack'\''s archive listing is not exactly the roster (an extra, duplicate, directory or escaping entry)'; exit 1)
+          'cut' '-c' '67-' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest' > "$RUNNER_TEMP"'/manifest-names.out'
+          'cmp' '-s' "$RUNNER_TEMP"'/manifest-names.out' "$RUNNER_TEMP"'/release-bins.roster' || ('echo' '::error title=release-bins ManifestRosterMismatch::the downloaded manifest does not name exactly the gunbc.ci_release_bins roster in order'; exit 1)
+          if 'grep' '-qvE' '^[0-9a-f]{64}  [A-Za-z0-9_]+$' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest'; then ('echo' '::error title=release-bins ManifestMalformed::the downloaded manifest has a line that is not one well-formed sha256 record for a roster member'; exit 1); fi
+          'rm' '-rf' "$RUNNER_TEMP"'/release-bins-check'
+          'mkdir' '-p' "$RUNNER_TEMP"'/release-bins-check'
+          'tar' '-xzf' "$RUNNER_TEMP"'/release-bins-download/release-bins.tgz' '-C' "$RUNNER_TEMP"'/release-bins-check' '--no-same-owner'
+          'printf' '%s' 'claim_executor:regular file:1
+          gunbc:regular file:1
+          discover_source_root_ingest:regular file:1
+          claim_batch:regular file:1
+          interp_recorded_fixture_witness:regular file:1
+          v1_src_dag_parse:regular file:1
+          auth_declared_but_unwired_witness:regular file:1
+          bootstrap_witness:regular file:1
+          dag_collect_fingerprint_witness:regular file:1
+          diagnostics_witness:regular file:1
+          effects_rest_transport_witness:regular file:1
+          infer_semantics_witness:regular file:1
+          parse_witness:regular file:1
+          cssl_assemble:regular file:1
+          namespace_structural_root_exposure_generated_witness:regular file:1
+          codex_app_server_stdio_session:regular file:1
+          ' > "$RUNNER_TEMP"'/member-types.expected'
+          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'stat' '-c' '%n:%F:%h' 'claim_executor' 'gunbc' 'discover_source_root_ingest' 'claim_batch' 'interp_recorded_fixture_witness' 'v1_src_dag_parse' 'auth_declared_but_unwired_witness' 'bootstrap_witness' 'dag_collect_fingerprint_witness' 'diagnostics_witness' 'effects_rest_transport_witness' 'infer_semantics_witness' 'parse_witness' 'cssl_assemble' 'namespace_structural_root_exposure_generated_witness' 'codex_app_server_stdio_session') > "$RUNNER_TEMP"'/member-types.out'
+          'cmp' '-s' "$RUNNER_TEMP"'/member-types.out' "$RUNNER_TEMP"'/member-types.expected' || ('diff' "$RUNNER_TEMP"'/member-types.expected' "$RUNNER_TEMP"'/member-types.out' || ':' 'no-op'; ('echo' '::error title=release-bins MemberNotRegularFile::the downloaded pack has a member that is not a self-contained regular file (a link, special file or hard-link dependency; the report above names it)'; exit 1))
+          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'find' 'claim_executor' 'gunbc' 'discover_source_root_ingest' 'claim_batch' 'interp_recorded_fixture_witness' 'v1_src_dag_parse' 'auth_declared_but_unwired_witness' 'bootstrap_witness' 'dag_collect_fingerprint_witness' 'diagnostics_witness' 'effects_rest_transport_witness' 'infer_semantics_witness' 'parse_witness' 'cssl_assemble' 'namespace_structural_root_exposure_generated_witness' 'codex_app_server_stdio_session' '-maxdepth' '0' '!' '-perm' '-u+x') > "$RUNNER_TEMP"'/member-nonexec.out'
+          '[' '!' '-s' "$RUNNER_TEMP"'/member-nonexec.out' ']' || ('cat' "$RUNNER_TEMP"'/member-nonexec.out'; ('echo' '::error title=release-bins MemberNotExecutable::the downloaded pack has a member that is not executable (listed above)'; exit 1))
+          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'sha256sum' '--strict' '--quiet' '-c' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest') || ('echo' '::error title=release-bins MemberDigestMismatch::the downloaded member bytes do not match the manifest under strict checking; refusing before any member is promoted or run'; exit 1)
+          'mkdir' '-p' "$ROOT"'/target/release'
+          ('cd' "$ROOT"'/target/release' && 'rm' '-f' 'claim_executor' 'gunbc' 'discover_source_root_ingest' 'claim_batch' 'interp_recorded_fixture_witness' 'v1_src_dag_parse' 'auth_declared_but_unwired_witness' 'bootstrap_witness' 'dag_collect_fingerprint_witness' 'diagnostics_witness' 'effects_rest_transport_witness' 'infer_semantics_witness' 'parse_witness' 'cssl_assemble' 'namespace_structural_root_exposure_generated_witness' 'codex_app_server_stdio_session')
+          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'cp' '-p' 'claim_executor' 'gunbc' 'discover_source_root_ingest' 'claim_batch' 'interp_recorded_fixture_witness' 'v1_src_dag_parse' 'auth_declared_but_unwired_witness' 'bootstrap_witness' 'dag_collect_fingerprint_witness' 'diagnostics_witness' 'effects_rest_transport_witness' 'infer_semantics_witness' 'parse_witness' 'cssl_assemble' 'namespace_structural_root_exposure_generated_witness' 'codex_app_server_stdio_session' "$ROOT"'/target/release/')
+          'rm' '-rf' "$RUNNER_TEMP"'/release-bins-check'
+          "$ROOT"'/target/release/claim_executor' '--verify-build-artifacts' "$ROOT"'/target/release/claim_executor' "$ROOT"'/target/release/gunbc' "$ROOT"'/target/release/discover_source_root_ingest' "$ROOT"'/target/release/claim_batch' "$ROOT"'/target/release/interp_recorded_fixture_witness' "$ROOT"'/target/release/v1_src_dag_parse' "$ROOT"'/target/release/auth_declared_but_unwired_witness' "$ROOT"'/target/release/bootstrap_witness' "$ROOT"'/target/release/dag_collect_fingerprint_witness' "$ROOT"'/target/release/diagnostics_witness' "$ROOT"'/target/release/effects_rest_transport_witness' "$ROOT"'/target/release/infer_semantics_witness' "$ROOT"'/target/release/parse_witness' "$ROOT"'/target/release/cssl_assemble' "$ROOT"'/target/release/namespace_structural_root_exposure_generated_witness' "$ROOT"'/target/release/codex_app_server_stdio_session'
+        env:
+          RELEASE_BINS_KEY: ${{ needs.build.outputs.release_bins_key }}
+        timeout-minutes: 5
+      - name: "Arrival admission (credential-free): store host srv1 and a population arrival_subject"
+        id: arrival_admit
+        run: |-
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/machine_intake/arrival_admission.dag --function arrival_admit_executor
+        env:
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
+          FLEET_CONVERGE_ARRIVAL_SUBJECT: ${{ github.event.inputs.arrival_subject }}
+        timeout-minutes: 5
+      - name: WIF auth (OIDC -> dedicated mtjade1-arrival pool -> mtjade1-arrival SA, access token only)
+        id: wif_auth
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+        with:
+          workload_identity_provider: projects/582015116396/locations/global/workloadIdentityPools/github-mtjade1-arrival/providers/github-mtjade1-arrival-oidc
+          service_account: mtjade1-arrival@gunbai-secrets.iam.gserviceaccount.com
+          token_format: access_token
+          create_credentials_file: false
+        timeout-minutes: 5
+      - name: arrival_converge under the standing grant and arrival interlock
+        id: arrival_converge
+        run: |-
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/machine_intake/arrival_run.dag --function arrival_converge_wet
+        env:
+          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
+          FLEET_CONVERGE_ARRIVAL_SUBJECT: ${{ github.event.inputs.arrival_subject }}
+        timeout-minutes: 5
   printer:
     runs-on: [self-hosted, linux, arm64, srv1]
     needs: [build]
@@ -3762,11 +3539,11 @@ jobs:
           GUNBC_APPROVAL_CAPABILITY_MAC_KEY_FILE: /etc/gunbc-roadmap/approval-mac-key
           GUNBC_APPROVAL_STORE_RECEIPT_MAC_KEY_FILE: /etc/gunbc-roadmap/approval-store-receipt-mac-key
           PRINTER_TARGET: ${{ inputs.printer }}
-          PRINTER_OPERATION: ${{ inputs.printer_operation }}
-          PRINTER_PROJECT_PATH: ${{ inputs.printer_project_path }}
-          PRINTER_PROJECT_SHA256: ${{ inputs.printer_project_sha256 }}
-          PRINTER_CREDENTIAL_VERSION: ${{ inputs.printer_credential_version }}
-          PRINTER_BED_CLEAR: ${{ inputs.printer_bed_clear }}
+          PRINTER_OPERATION: ${{ fromJSON(inputs.printer_request || '{}').operation }}
+          PRINTER_PROJECT_PATH: ${{ fromJSON(inputs.printer_request || '{}').project_path }}
+          PRINTER_PROJECT_SHA256: ${{ fromJSON(inputs.printer_request || '{}').project_sha256 }}
+          PRINTER_CREDENTIAL_VERSION: ${{ fromJSON(inputs.printer_request || '{}').credential_version }}
+          PRINTER_BED_CLEAR: ${{ fromJSON(inputs.printer_request || '{}').bed_clear }}
         timeout-minutes: 15
       - name: Upload printer operation receipt
         id: printer_receipt
diff --git a/.github/workflows/heal-publish.yml b/.github/workflows/heal-publish.yml
deleted file mode 100644
index 45b5d38d383..00000000000
--- a/.github/workflows/heal-publish.yml
+++ /dev/null
@@ -1,173 +0,0 @@
-# Generated by gunbc.heal_publisher_workflow expected_heal_publisher_workflow_yml — do not hand-edit.
-# Authority: gunbc.heal_publisher_workflow heal_publisher_workflow; regen via tools.generated_artifact_gate main_wet.
-name: heal-publish
-on:
-  workflow_run:
-    workflows: [witnesses]
-    branches: ["**"]
-    types: [completed]
-concurrency:
-  queue: max
-  group: heal-publish-${{ github.event.workflow_run.head_branch }}
-  cancel-in-progress: false
-env:
-  CARGO_TERM_COLOR: always
-jobs:
-  publish:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 45
-    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.head_repository.full_name == github.repository
-    permissions:
-      contents: read
-      pull-requests: read
-      actions: read
-      id-token: write
-    steps:
-      - name: Ask the triggering run whether it sealed a candidate
-        id: candidate_probe
-        run: |-
-          set -euo pipefail
-          NAMES=$(gh api --paginate "repos/$GITHUB_REPOSITORY/actions/runs/$TRIGGERING_RUN_ID/artifacts" --jq '.artifacts[].name')
-          if printf '%s\n' "$NAMES" | grep -qx "heal-repair-candidate"; then
-            echo "present=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "present=false" >> "$GITHUB_OUTPUT"
-            echo "::notice::the triggering run sealed no repair candidate, so there is nothing to publish"
-          fi
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TRIGGERING_RUN_ID: ${{ github.event.workflow_run.id }}
-      - name: Checkout the default branch this publisher runs from
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-      - name: Download the candidate the triggering heal run produced
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
-        with:
-          pattern: heal-repair-candidate
-          path: heal-candidate
-          merge-multiple: true
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ github.token }}
-        if: steps.candidate_probe.outputs.present == 'true'
-      - name: Isolate toolchain homes
-        run: |-
-          # dissolve-on: ci_toolchain_home_isolation_script -- orch-emitted foreign-executor prelude step wiping and setting HOME/CARGO_HOME/RUSTUP_HOME under RUNNER_TEMP so concurrent runner slots stop sharing one toolchain; leaf rm/echo strings remain until a typed per-job filesystem-and-environment effect lands on host_effect_apply (shell-to-intent Phase 2). This obligation covers THIS carrier and ci_isolate_toolchain_script, which share that terminal construction; ci_pin_rustup_default_script carries its own obligation because it does not
-          rm -rf "$RUNNER_TEMP/rustup" "$RUNNER_TEMP/cargo"
-          echo "HOME=$RUNNER_TEMP" >> "$GITHUB_ENV"
-          echo "CARGO_HOME=$RUNNER_TEMP/cargo" >> "$GITHUB_ENV"
-          echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
-        if: hashFiles('heal-candidate/heal-repair-candidate-blob-*') != ''
-      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7
-        with:
-          components: rustfmt
-          cache: false
-          rustflags: -D warnings
-        if: hashFiles('heal-candidate/heal-repair-candidate-blob-*') != ''
-      - name: Pin rustup default (isolated RUSTUP_HOME has no default toolchain)
-        run: |-
-          # dissolve-on: ci_pin_rustup_default_script -- orch-emitted foreign-executor step selecting a rustup default toolchain inside an isolated RUSTUP_HOME, which starts with none, and resolving the cargo binary that selection implies. The leaf rustup/command/echo strings remain until a typed TOOLCHAIN-SELECTION effect lands on host_effect_apply -- NOT the filesystem-and-environment effect ci_toolchain_home_isolation_script waits on, which is why this is a separate obligation: that effect landing alone would leave this carrier standing
-          rustup default "$(rustup show active-toolchain | awk '{print $1; exit}')"
-          if [ -x "$CARGO_HOME/bin/cargo" ]; then CARGO_BIN="$CARGO_HOME/bin/cargo"; else CARGO_BIN="$(command -v cargo || true)"; fi
-          if [ -z "$CARGO_BIN" ]; then echo "::error::no cargo binary: neither the isolated $CARGO_HOME/bin/cargo shim nor PATH carries one"; exit 1; fi
-          echo "CARGO_BIN=$CARGO_BIN" >> "$GITHUB_ENV"
-        if: hashFiles('heal-candidate/heal-repair-candidate-blob-*') != ''
-      - name: Build the publisher this job runs from the default branch
-        id: build_witness_fold
-        run: |+
-          GUNBC_FLOOR_LOG='gunbc-floor-cmd.log'
-          'set' '+e'
-          'set' '-o' 'pipefail'
-          ('sh' '-e' '-c' 'cargo build --release -p v1-compiler --bin gunbc') 2>&1 | 'tee' "$GUNBC_FLOOR_LOG"
-          GUNBC_FLOOR_EXIT="$?"
-          GUNBC_FLOOR_RECEIPT='gunbc-floor-outcome.txt'
-          GUNBC_FLOOR_CLASS='structural'
-          GUNBC_FLOOR_SIGNATURE=''
-          if '[' "$GUNBC_FLOOR_EXIT" '-eq' '126' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandInvokedCannotExecute'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '127' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandNotFound'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '0' ']'; then GUNBC_FLOOR_CLASS='none'; GUNBC_FLOOR_SIGNATURE=''; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'MemoryStallRefusedPageThrash' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='MemoryStallRefusedPageThrash'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'The runner has received a shutdown signal' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='RunnerLost'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: error: failed to execute compile' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFailedToExecuteCompile'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' '(exit status: 254)' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheRustcWrapperExit254'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: encountered fatal error' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFatalError'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'failed to spawn' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ProcessSpawnFailure'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'Resource temporarily unavailable' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ResourceTemporarilyUnavailable'; fi
-          if (! '[' '-f' "$GUNBC_FLOOR_RECEIPT" ']') || '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' || ('[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT"))) || ('[' "$GUNBC_FLOOR_CLASS" '=' 'none' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT")) && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=infra' "$GUNBC_FLOOR_RECEIPT"))); then 'printf' 'class=%s\nsignature=%s\nexit=%s\n' "$GUNBC_FLOOR_CLASS" "$GUNBC_FLOOR_SIGNATURE" "$GUNBC_FLOOR_EXIT" > "$GUNBC_FLOOR_RECEIPT"; if '[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']'; then 'echo' '::error title=environment::floor_class='"$GUNBC_FLOOR_CLASS"' signature='"$GUNBC_FLOOR_SIGNATURE"' exit='"$GUNBC_FLOOR_EXIT"'; this is not a verdict about the diff. Attempt receipt: '"$GUNBC_FLOOR_RECEIPT"; fi; if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']'; then 'echo' '::error title=subject::floor_class='"$GUNBC_FLOOR_CLASS"' exit='"$GUNBC_FLOOR_EXIT"'; read the step log for the subject defect'; fi; fi
-          'exit' "$GUNBC_FLOOR_EXIT"
-
-        if: hashFiles('heal-candidate/heal-repair-candidate-blob-*') != ''
-      - name: Admit the candidate against this checkout's policy, with no publication credential
-        run: |-
-          set -euo pipefail
-          GUNBC_CG=/sys/fs/cgroup/gunbc-publish
-          echo "+memory" | sudo tee /sys/fs/cgroup/cgroup.subtree_control >/dev/null
-          sudo mkdir -p "$GUNBC_CG"
-          echo 12884901888 | sudo tee "$GUNBC_CG/memory.max" >/dev/null
-          echo $$ | sudo tee "$GUNBC_CG/cgroup.procs" >/dev/null
-          cat "$GUNBC_CG/memory.max"
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/heal_publication.dag --function heal_publication_admit_wet
-        env:
-          HEAL_CANDIDATE_DIRECTORY: heal-candidate
-          GITHUB_TOKEN: ${{ github.token }}
-        if: hashFiles('heal-candidate/heal-repair-candidate-blob-*') != ''
-      - name: Federate to the publisher's own identity (access token only, five minutes)
-        id: heal_publisher_wif
-        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
-        with:
-          workload_identity_provider: projects/582015116396/locations/global/workloadIdentityPools/github-heal-publisher/providers/github-heal-publisher-oidc
-          service_account: heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-          token_format: access_token
-          access_token_lifetime: 300s
-          create_credentials_file: false
-          export_environment_variables: false
-        if: hashFiles('heal-candidate/heal-repair-candidate-blob-*') != ''
-      - name: Publish the admitted repair, fast-forward only, and read it back
-        run: |-
-          set -euo pipefail
-          GUNBC_CG=/sys/fs/cgroup/gunbc-publish
-          echo "+memory" | sudo tee /sys/fs/cgroup/cgroup.subtree_control >/dev/null
-          sudo mkdir -p "$GUNBC_CG"
-          echo 12884901888 | sudo tee "$GUNBC_CG/memory.max" >/dev/null
-          echo $$ | sudo tee "$GUNBC_CG/cgroup.procs" >/dev/null
-          cat "$GUNBC_CG/memory.max"
-          set -euo pipefail
-          umask 077
-          KEY_FILE="$RUNNER_TEMP/heal-publisher-app-key"
-          HDR_FILE="$RUNNER_TEMP/heal-publisher-auth-header"
-          JWT_FILE="$RUNNER_TEMP/heal-publisher-app-jwt"
-          TOKEN_HEADERS="$RUNNER_TEMP/heal-publisher-token-headers"
-          TOKEN_BODY="$RUNNER_TEMP/heal-publisher-token-body"
-          cleanup() { rm -f "$KEY_FILE" "$HDR_FILE" "$JWT_FILE" "$TOKEN_HEADERS" "$TOKEN_BODY" "$RUNNER_TEMP/heal-publisher-app-key-sm-body"; unset GITHUB_TOKEN; }
-          trap cleanup EXIT
-          printf 'Authorization: Bearer %s\n' "$WIF_ACCESS_TOKEN" > "$HDR_FILE"
-          SM_BODY="$RUNNER_TEMP/heal-publisher-app-key-sm-body"
-          SM_CODE="$(curl -sS -o "$SM_BODY" -w '%{http_code}' -H @"$HDR_FILE" "https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key/versions/latest:access")"
-          rm -f "$HDR_FILE"
-          if [ "$SM_CODE" != 200 ]; then rm -f "$SM_BODY"; echo "HealPublisherAppKeyUnreadable: Secret Manager answered HTTP $SM_CODE for projects/gunbai-secrets/secrets/agent-github-app-private-key/versions/latest to the heal-publisher@gunbai-secrets.iam.gserviceaccount.com principal. 403 means the version exists and is not readable OR does not exist -- REMEDY: run gunbc.auth.heal_publisher_provision heal_publisher_federation_provision_with_supplied_token, which creates that identity and binds roles/secretmanager.secretAccessor on the key for that service account only after reading the federation back. Minting NO token, so nothing is published." >&2; exit 1; fi
-          python3 -c 'import sys,json,base64; sys.stdout.buffer.write(base64.b64decode(json.load(open(sys.argv[1]))["payload"]["data"]))' "$SM_BODY" > "$KEY_FILE"
-          rm -f "$SM_BODY"
-          chmod 600 "$KEY_FILE"
-          NOW=$(date +%s)
-          b64url() { base64 -w0 | tr '+/' '-_' | tr -d '='; }
-          JWT_HEADER=$(printf '%s' '{"alg":"RS256","typ":"JWT"}' | b64url)
-          JWT_PAYLOAD=$(printf '{"iat":%d,"exp":%d,"iss":"%s"}' "$((NOW-60))" "$((NOW+540))" "3909950" | b64url)
-          JWT_SIG=$(printf '%s.%s' "$JWT_HEADER" "$JWT_PAYLOAD" | openssl dgst -sha256 -sign "$KEY_FILE" | b64url)
-          rm -f "$KEY_FILE"
-          printf 'Authorization: Bearer %s.%s.%s\n' "$JWT_HEADER" "$JWT_PAYLOAD" "$JWT_SIG" > "$JWT_FILE"
-          curl -sS -X POST -H @"$JWT_FILE" -H 'Accept: application/vnd.github+json' -H 'Content-Type: application/json' -d '{"repositories": ["gunbc"], "permissions": {"contents": "write"}}' -D "$TOKEN_HEADERS" -o "$TOKEN_BODY" "https://api.github.com/app/installations/136673607/access_tokens"
-          rm -f "$JWT_FILE"
-          if ! head -n1 "$TOKEN_HEADERS" | grep -q ' 201 '; then echo "HealPublisherInstallationTokenRefused: GitHub answered $(head -n1 "$TOKEN_HEADERS" | tr -d '\r') for the publisher App's installation; a revoked key, a removed installation, or a Contents permission that is no longer write each look like this -- inspect the App's installation on this repository" >&2; exit 1; fi
-          GITHUB_TOKEN="$(python3 -c 'import sys,json; print(json.load(open(sys.argv[1]))["token"])' "$TOKEN_BODY")"
-          rm -f "$TOKEN_HEADERS" "$TOKEN_BODY"
-          export GITHUB_TOKEN
-          echo "heal-publisher: installation token minted in-run for app gunbai-bot installation 136673607 (one hour, contents:write on this repository only; key wiped; token held in this step's environment only)"
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/heal_publication.dag --function heal_publication_publish_wet
-        env:
-          HEAL_CANDIDATE_DIRECTORY: heal-candidate
-          WIF_ACCESS_TOKEN: ${{ steps.heal_publisher_wif.outputs.access_token }}
-        if: hashFiles('heal-candidate/heal-repair-candidate-blob-*') != ''
diff --git a/.github/workflows/microvm-shakedown.yml b/.github/workflows/microvm-shakedown.yml
index 15cf8639986..fe717050aa5 100644
--- a/.github/workflows/microvm-shakedown.yml
+++ b/.github/workflows/microvm-shakedown.yml
@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
     inputs:
       attempt:
-        description: The attempt's registration name (its transient unit name, gunbc.runner_jit_mint jit_runner_name_for). It is REQUIRED in runs-on, so a wrong name queues forever rather than running on any other runner.
+        description: The attempt's registration name (its transient unit name, gunbc.runner.jit_registration_subject jit_runner_name_for). It is REQUIRED in runs-on, so a wrong name queues forever rather than running on any other runner.
         required: true
         type: string
 jobs:
diff --git a/.github/workflows/witnesses.yml b/.github/workflows/witnesses.yml
index 4455164783a..19a7d67a1da 100644
--- a/.github/workflows/witnesses.yml
+++ b/.github/workflows/witnesses.yml
@@ -19,73 +19,14 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 env:
   CARGO_TERM_COLOR: always
-  GUNBC_REQUIRED_CI_CONTRACT_EPOCH: 2026-09-01.1
+  GUNBC_REQUIRED_CI_CONTRACT_EPOCH: 2026-10-09.1
 jobs:
-  rust-unit-tests:
-    runs-on: [self-hosted, linux, arm64]
-    timeout-minutes: 25
-    if: github.event_name != 'pull_request'
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
-        with:
-          persist-credentials: false
-      - name: Isolate toolchain homes
-        run: |-
-          # dissolve-on: ci_toolchain_home_isolation_script -- orch-emitted foreign-executor prelude step wiping and setting HOME/CARGO_HOME/RUSTUP_HOME under RUNNER_TEMP so concurrent runner slots stop sharing one toolchain; leaf rm/echo strings remain until a typed per-job filesystem-and-environment effect lands on host_effect_apply (shell-to-intent Phase 2). This obligation covers THIS carrier and ci_isolate_toolchain_script, which share that terminal construction; ci_pin_rustup_default_script carries its own obligation because it does not
-          rm -rf "$RUNNER_TEMP/rustup" "$RUNNER_TEMP/cargo"
-          echo "HOME=$RUNNER_TEMP" >> "$GITHUB_ENV"
-          echo "CARGO_HOME=$RUNNER_TEMP/cargo" >> "$GITHUB_ENV"
-          echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
-      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7
-        with:
-          components: rustfmt
-          cache: false
-          rustflags: -D warnings
-      - name: Pin rustup default (isolated RUSTUP_HOME has no default toolchain)
-        run: |-
-          # dissolve-on: ci_pin_rustup_default_script -- orch-emitted foreign-executor step selecting a rustup default toolchain inside an isolated RUSTUP_HOME, which starts with none, and resolving the cargo binary that selection implies. The leaf rustup/command/echo strings remain until a typed TOOLCHAIN-SELECTION effect lands on host_effect_apply -- NOT the filesystem-and-environment effect ci_toolchain_home_isolation_script waits on, which is why this is a separate obligation: that effect landing alone would leave this carrier standing
-          rustup default "$(rustup show active-toolchain | awk '{print $1; exit}')"
-          if [ -x "$CARGO_HOME/bin/cargo" ]; then CARGO_BIN="$CARGO_HOME/bin/cargo"; else CARGO_BIN="$(command -v cargo || true)"; fi
-          if [ -z "$CARGO_BIN" ]; then echo "::error::no cargo binary: neither the isolated $CARGO_HOME/bin/cargo shim nor PATH carries one"; exit 1; fi
-          echo "CARGO_BIN=$CARGO_BIN" >> "$GITHUB_ENV"
-      - name: Run the v1 unit tests
-        id: rust_unit_tests
-        run: |+
-          GUNBC_FLOOR_LOG='gunbc-floor-cmd.log'
-          'set' '+e'
-          'set' '-o' 'pipefail'
-          ('sh' '-e' '-c' 'cargo test --release -p v1-compiler --lib') 2>&1 | 'tee' "$GUNBC_FLOOR_LOG"
-          GUNBC_FLOOR_EXIT="$?"
-          GUNBC_FLOOR_RECEIPT='gunbc-floor-outcome.txt'
-          GUNBC_FLOOR_CLASS='structural'
-          GUNBC_FLOOR_SIGNATURE=''
-          if '[' "$GUNBC_FLOOR_EXIT" '-eq' '126' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandInvokedCannotExecute'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '127' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandNotFound'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '0' ']'; then GUNBC_FLOOR_CLASS='none'; GUNBC_FLOOR_SIGNATURE=''; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'MemoryStallRefusedPageThrash' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='MemoryStallRefusedPageThrash'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'The runner has received a shutdown signal' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='RunnerLost'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: error: failed to execute compile' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFailedToExecuteCompile'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' '(exit status: 254)' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheRustcWrapperExit254'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: encountered fatal error' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFatalError'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'failed to spawn' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ProcessSpawnFailure'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'Resource temporarily unavailable' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ResourceTemporarilyUnavailable'; fi
-          if (! '[' '-f' "$GUNBC_FLOOR_RECEIPT" ']') || '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' || ('[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT"))) || ('[' "$GUNBC_FLOOR_CLASS" '=' 'none' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT")) && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=infra' "$GUNBC_FLOOR_RECEIPT"))); then 'printf' 'class=%s\nsignature=%s\nexit=%s\n' "$GUNBC_FLOOR_CLASS" "$GUNBC_FLOOR_SIGNATURE" "$GUNBC_FLOOR_EXIT" > "$GUNBC_FLOOR_RECEIPT"; if '[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']'; then 'echo' '::error title=environment::floor_class='"$GUNBC_FLOOR_CLASS"' signature='"$GUNBC_FLOOR_SIGNATURE"' exit='"$GUNBC_FLOOR_EXIT"'; this is not a verdict about the diff. Attempt receipt: '"$GUNBC_FLOOR_RECEIPT"; fi; if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']'; then 'echo' '::error title=subject::floor_class='"$GUNBC_FLOOR_CLASS"' exit='"$GUNBC_FLOOR_EXIT"'; read the step log for the subject defect'; fi; fi
-          'exit' "$GUNBC_FLOOR_EXIT"
-
-        timeout-minutes: 15
-  seed:
+  witnesses:
     runs-on: [self-hosted, linux, arm64]
     timeout-minutes: 90
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       contents: read
-      actions: read
-    outputs:
-      release_bins_key: ${{ steps.release_bins_key.outputs.key }}
     steps:
       - name: Checkout the commit this lane judges
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
@@ -113,176 +54,6 @@ jobs:
           if [ -x "$CARGO_HOME/bin/cargo" ]; then CARGO_BIN="$CARGO_HOME/bin/cargo"; else CARGO_BIN="$(command -v cargo || true)"; fi
           if [ -z "$CARGO_BIN" ]; then echo "::error::no cargo binary: neither the isolated $CARGO_HOME/bin/cargo shim nor PATH carries one"; exit 1; fi
           echo "CARGO_BIN=$CARGO_BIN" >> "$GITHUB_ENV"
-      - name: Key the compiler pair (stamps the build with the materialized tree)
-        id: release_bins_key
-        run: |
-          set -e
-          ROOT=$('git' 'rev-parse' '--show-toplevel')
-          DIRTY=$('git' '-C' "$ROOT" 'status' '--porcelain' '--untracked-files=no')
-          '[' '-z' "$DIRTY" ']' || ('echo' '::error title=release-bins SourceTreeDirty::tracked files differ from HEAD, so HEAD^{tree} does not name the build input; refusing to key'; exit 1)
-          'env' '-0' > "$RUNNER_TEMP"'/env.nul'
-          if 'grep' '-zqE' '^(CARGO|RUST|CC|CXX|AR|CFLAGS|CXXFLAGS|LDFLAGS|TARGET_CC|HOST_CC)[A-Za-z0-9_]*(TOKEN|CREDENTIAL|SECRET|PASSWORD|PASSWD|AUTH)[A-Za-z0-9_]*=' "$RUNNER_TEMP"'/env.nul'; then ('echo' '::error title=release-bins CredentialInBuildEnvironment::a registry or toolchain credential is present in the build environment; credentials are not build inputs and must not reach a key or a published preimage, so the build is refused'; exit 1); fi
-          if 'grep' '-zqE' '^(RUSTC|RUSTC_WORKSPACE_WRAPPER|CARGO_BUILD_RUSTC|CARGO_BUILD_RUSTC_WRAPPER|CARGO_BUILD_RUSTC_WORKSPACE_WRAPPER|CARGO_BUILD_TARGET|CARGO_BUILD_TARGET_DIR|CARGO_TARGET_DIR|CARGO_TARGET_[A-Z0-9_]*_(LINKER|RUNNER))=' "$RUNNER_TEMP"'/env.nul'; then ('echo' '::error title=release-bins BuildOverrideNotAdmitted::the environment overrides the compiler, linker, target or target directory Cargo would use; the key probes only the admitted defaults, so the build is refused rather than keyed wrongly'; exit 1); fi
-          'sed' '-z' '-nE' '/^(CARGO_[A-Z0-9_]*|RUST[A-Z0-9_]*|CC|CXX|AR|CFLAGS|CXXFLAGS|LDFLAGS|CC_[A-Za-z0-9_]*|CFLAGS_[A-Za-z0-9_]*|TARGET_CC|HOST_CC)=/p' "$RUNNER_TEMP"'/env.nul' > "$RUNNER_TEMP"'/env-keyed.nul'
-          'sed' '-z' '-E' '/^(CARGO_HOME|RUSTUP_HOME|CARGO_BIN|CARGO_TERM_COLOR|CARGO_BUILD_JOBS|RUSTC_WRAPPER)=/d' "$RUNNER_TEMP"'/env-keyed.nul' > "$RUNNER_TEMP"'/env-kept.nul'
-          'sort' '-z' "$RUNNER_TEMP"'/env-kept.nul' > "$RUNNER_TEMP"'/env-sorted.nul'
-          'sha256sum' "$RUNNER_TEMP"'/env-sorted.nul' > "$RUNNER_TEMP"'/AXIS_ENVIRONMENT_DIGEST.out'
-          AXIS_ENVIRONMENT_DIGEST=$('cut' '-d' ' ' '-f' '1' "$RUNNER_TEMP"'/AXIS_ENVIRONMENT_DIGEST.out')
-          ANCESTOR_0="$ROOT"
-          ANCESTOR_CONFIG=''
-          ANCESTOR_1=$('dirname' "$ANCESTOR_0")
-          ('[' '!' '-e' "$ANCESTOR_1"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_1"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_1"
-          ANCESTOR_2=$('dirname' "$ANCESTOR_1")
-          ('[' '!' '-e' "$ANCESTOR_2"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_2"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_2"
-          ANCESTOR_3=$('dirname' "$ANCESTOR_2")
-          ('[' '!' '-e' "$ANCESTOR_3"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_3"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_3"
-          ANCESTOR_4=$('dirname' "$ANCESTOR_3")
-          ('[' '!' '-e' "$ANCESTOR_4"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_4"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_4"
-          ANCESTOR_5=$('dirname' "$ANCESTOR_4")
-          ('[' '!' '-e' "$ANCESTOR_5"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_5"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_5"
-          ANCESTOR_6=$('dirname' "$ANCESTOR_5")
-          ('[' '!' '-e' "$ANCESTOR_6"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_6"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_6"
-          ANCESTOR_7=$('dirname' "$ANCESTOR_6")
-          ('[' '!' '-e' "$ANCESTOR_7"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_7"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_7"
-          ANCESTOR_8=$('dirname' "$ANCESTOR_7")
-          ('[' '!' '-e' "$ANCESTOR_8"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_8"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_8"
-          ANCESTOR_9=$('dirname' "$ANCESTOR_8")
-          ('[' '!' '-e' "$ANCESTOR_9"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_9"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_9"
-          ANCESTOR_10=$('dirname' "$ANCESTOR_9")
-          ('[' '!' '-e' "$ANCESTOR_10"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_10"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_10"
-          ANCESTOR_11=$('dirname' "$ANCESTOR_10")
-          ('[' '!' '-e' "$ANCESTOR_11"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_11"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_11"
-          ANCESTOR_12=$('dirname' "$ANCESTOR_11")
-          ('[' '!' '-e' "$ANCESTOR_12"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_12"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_12"
-          ANCESTOR_13=$('dirname' "$ANCESTOR_12")
-          ('[' '!' '-e' "$ANCESTOR_13"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_13"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_13"
-          ANCESTOR_14=$('dirname' "$ANCESTOR_13")
-          ('[' '!' '-e' "$ANCESTOR_14"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_14"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_14"
-          ANCESTOR_15=$('dirname' "$ANCESTOR_14")
-          ('[' '!' '-e' "$ANCESTOR_15"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_15"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_15"
-          ANCESTOR_16=$('dirname' "$ANCESTOR_15")
-          ('[' '!' '-e' "$ANCESTOR_16"'/.cargo/config.toml' ']' && '[' '!' '-e' "$ANCESTOR_16"'/.cargo/config' ']') || ANCESTOR_CONFIG="$ANCESTOR_16"
-          if '[' '-n' "$ANCESTOR_CONFIG" ']'; then 'echo' 'release-bins: Cargo config found above the checkout in '"$ANCESTOR_CONFIG"; ('echo' '::error title=release-bins AncestorCargoConfigPresent::a Cargo config file exists in a directory above the checkout; it is outside the committed tree the key covers, so the build is refused'; exit 1); fi
-          '[' "$ANCESTOR_16" '=' '/' ']' || ('echo' '::error title=release-bins CheckoutPathTooDeep::the checkout is deeper than the ancestor Cargo-config scan covers, so ancestor configuration cannot be ruled out'; exit 1)
-          OBJECT_FORMAT=$('git' '-C' "$ROOT" 'rev-parse' '--show-object-format')
-          SOURCE_TREE=$('git' '-C' "$ROOT" 'rev-parse' 'HEAD^{tree}')
-          '[' '-n' "$OBJECT_FORMAT" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input OBJECT_FORMAT read back empty, so the key would not name the build; refusing to key'; exit 1)
-          '[' '-n' "$SOURCE_TREE" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input SOURCE_TREE read back empty, so the key would not name the build; refusing to key'; exit 1)
-          SOURCE_CLOSURE='tree:'"$OBJECT_FORMAT"':'"$SOURCE_TREE"
-          EXPECTED="$RUNNER_TEMP"'/release-bins.preimage.expected'
-          AXIS_PRODUCER=$("$CARGO_BIN" '-V')
-          '[' '-n' "$AXIS_PRODUCER" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input AXIS_PRODUCER read back empty, so the key would not name the build; refusing to key'; exit 1)
-          'rustc' '-vV' > "$RUNNER_TEMP"'/rustc-host.out'
-          AXIS_HOST=$('sed' '-n' 's/^host: //p' "$RUNNER_TEMP"'/rustc-host.out')
-          'cc' '--version' > "$RUNNER_TEMP"'/AXIS_CC.out'
-          AXIS_CC=$('head' '-n' '1' "$RUNNER_TEMP"'/AXIS_CC.out')
-          'ld' '--version' > "$RUNNER_TEMP"'/AXIS_LD.out'
-          AXIS_LD=$('head' '-n' '1' "$RUNNER_TEMP"'/AXIS_LD.out')
-          'ldd' '--version' > "$RUNNER_TEMP"'/AXIS_LIBC.out'
-          AXIS_LIBC=$('head' '-n' '1' "$RUNNER_TEMP"'/AXIS_LIBC.out')
-          '[' '-n' "$AXIS_HOST" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input AXIS_HOST read back empty, so the key would not name the build; refusing to key'; exit 1)
-          '[' '-n' "$AXIS_CC" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input AXIS_CC read back empty, so the key would not name the build; refusing to key'; exit 1)
-          '[' '-n' "$AXIS_LD" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input AXIS_LD read back empty, so the key would not name the build; refusing to key'; exit 1)
-          '[' '-n' "$AXIS_LIBC" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input AXIS_LIBC read back empty, so the key would not name the build; refusing to key'; exit 1)
-          'rustc' '-vV' > "$RUNNER_TEMP"'/rustc-vV.out'
-          AXIS_TOOLCHAIN=$('paste' '-s' '-d' ';' "$RUNNER_TEMP"'/rustc-vV.out')
-          '[' '-n' "$AXIS_TOOLCHAIN" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input AXIS_TOOLCHAIN read back empty, so the key would not name the build; refusing to key'; exit 1)
-          ('printf' 'kind=%s\n' 'gunbc.compiler_pair_release_bins'; 'printf' 'address=sha256 scope=cross_run\n'; 'printf' 'producer_compiler=%s\n' "$AXIS_PRODUCER"; 'printf' 'source_closure=%s\n' "$SOURCE_CLOSURE"; 'printf' 'target_model=%s;cc=%s;ld=%s;libc=%s\n' "$AXIS_HOST" "$AXIS_CC" "$AXIS_LD" "$AXIS_LIBC"; 'printf' 'toolchain=%s\n' "$AXIS_TOOLCHAIN"; 'printf' 'build_configuration=%s;embedded_build_identity=%s;environment=%s;roster=%s\n' 'cargo build --release -p v1-compiler --bin claim_executor --bin gunbc' "$SOURCE_CLOSURE" 'sha256:'"$AXIS_ENVIRONMENT_DIGEST" 'claim_executor gunbc'; 'printf' 'required_lens_contract=none (a seed cargo build admits no lens contract)\n') > "$EXPECTED"
-          'sha256sum' "$EXPECTED" > "$RUNNER_TEMP"'/PREIMAGE_DIGEST.out'
-          PREIMAGE_DIGEST=$('cut' '-d' ' ' '-f' '1' "$RUNNER_TEMP"'/PREIMAGE_DIGEST.out')
-          KEY='release-bins-'"$PREIMAGE_DIGEST"
-          'rm' '-rf' "$ROOT"'/.release-bins-staging'
-          'mkdir' '-p' "$ROOT"'/.release-bins-staging'
-          'echo' 'release-bins request key '"$KEY"' over preimage:'
-          'cat' "$EXPECTED"
-          'echo' 'key='"$KEY" | 'tee' '-a' "$GITHUB_OUTPUT" > '/dev/null'
-          'echo' 'GUNBC_MATERIALIZED_TREE_IDENTITY='"$SOURCE_CLOSURE" | 'tee' '-a' "$GITHUB_ENV" > '/dev/null'
-        timeout-minutes: 5
-      - name: Look up release-bins by exact key under the admitted producer refs (cache API; a failed lookup is not absence)
-        id: release_bins_lookup
-        run: |
-          set -e
-          ROOT=$('git' 'rev-parse' '--show-toplevel')
-          STANDING='absent'
-          ENTRY='none'
-          'curl' '-sSf' '-H' 'Authorization: Bearer '"$GH_TOKEN" '-H' 'Accept: application/vnd.github+json' "$GITHUB_API_URL"'/repos/'"$GITHUB_REPOSITORY"'/actions/caches?per_page=100&key='"$RELEASE_BINS_KEY"'&ref=''refs/heads/main' '-o' "$ROOT"'/.release-bins-lookup-main.json' || ('echo' '::error title=release-bins LookupTransportFailed::the cache API lookup FAILED (unreachable or refused); this is not absence, so neither reuse nor rebuild is decided'; exit 1)
-          'jq' '--raw-output' '--exit-status' '. as $answer | [inputs] | if length != 0 then error("the cache-API answer is not exactly one JSON document") else $answer | if type == "object" and (.total_count | type) == "number" and (.actions_caches | type) == "array" and .total_count == (.actions_caches | length) and .total_count <= 100 and all(.actions_caches[]; type == "object" and (.key | type) == "string" and (.ref | type) == "string") then [.actions_caches[] | select(.key == $ENV.RELEASE_BINS_KEY and .ref == "refs/heads/main")] | if length == 0 then "absent" elif length == 1 then "present\nid=\(.[0].id) ref=\(.[0].ref) version=\(.[0].version) created=\(.[0].created_at)" else error("duplicate exact entries") end else error("cache-API answer is not the admitted shape") end end' '.release-bins-lookup-main.json' > "$RUNNER_TEMP"'/lookup-main.decoded' || ('echo' '::error title=release-bins LookupAnswerUnusable::the cache API answer was unreadable or incomplete; it is not treated as absence'; exit 1)
-          DECODED_STANDING=$('head' '-n' '1' "$RUNNER_TEMP"'/lookup-main.decoded')
-          if '[' "$DECODED_STANDING" '=' 'present' ']'; then STANDING='present'; ENTRY=$('sed' '-n' '2p' "$RUNNER_TEMP"'/lookup-main.decoded'); else '[' "$DECODED_STANDING" '=' 'absent' ']' || ('echo' '::error title=release-bins LookupAnswerUnusable::the cache API answer was unreadable or incomplete; it is not treated as absence'; exit 1); fi
-          'curl' '-sSf' '-H' 'Authorization: Bearer '"$GH_TOKEN" '-H' 'Accept: application/vnd.github+json' "$GITHUB_API_URL"'/repos/'"$GITHUB_REPOSITORY"'/actions/caches?per_page=100&key='"$RELEASE_BINS_KEY"'&ref='"$RELEASE_BINS_DISPATCH_SCOPE_REF" '-o' "$ROOT"'/.release-bins-lookup-dispatch.json' || ('echo' '::error title=release-bins LookupTransportFailed::the cache API lookup FAILED (unreachable or refused); this is not absence, so neither reuse nor rebuild is decided'; exit 1)
-          'jq' '--raw-output' '--exit-status' '. as $answer | [inputs] | if length != 0 then error("the cache-API answer is not exactly one JSON document") else $answer | if type == "object" and (.total_count | type) == "number" and (.actions_caches | type) == "array" and .total_count == (.actions_caches | length) and .total_count <= 100 and all(.actions_caches[]; type == "object" and (.key | type) == "string" and (.ref | type) == "string") then [.actions_caches[] | select(.key == $ENV.RELEASE_BINS_KEY and .ref == $ENV.RELEASE_BINS_DISPATCH_SCOPE_REF)] | if length == 0 then "absent" elif length == 1 then "present\nid=\(.[0].id) ref=\(.[0].ref) version=\(.[0].version) created=\(.[0].created_at)" else error("duplicate exact entries") end else error("cache-API answer is not the admitted shape") end end' '.release-bins-lookup-dispatch.json' > "$RUNNER_TEMP"'/lookup-dispatch.decoded' || ('echo' '::error title=release-bins LookupAnswerUnusable::the cache API answer was unreadable or incomplete; it is not treated as absence'; exit 1)
-          DECODED_STANDING=$('head' '-n' '1' "$RUNNER_TEMP"'/lookup-dispatch.decoded')
-          if '[' "$DECODED_STANDING" '=' 'present' ']'; then STANDING='present'; ENTRY=$('sed' '-n' '2p' "$RUNNER_TEMP"'/lookup-dispatch.decoded'); else '[' "$DECODED_STANDING" '=' 'absent' ']' || ('echo' '::error title=release-bins LookupAnswerUnusable::the cache API answer was unreadable or incomplete; it is not treated as absence'; exit 1); fi
-          'echo' 'standing='"$STANDING" | 'tee' '-a' "$GITHUB_OUTPUT" > '/dev/null'
-          'echo' 'entry='"$ENTRY" | 'tee' '-a' "$GITHUB_OUTPUT" > '/dev/null'
-          'echo' 'release-bins lookup: standing='"$STANDING"' entry='"$ENTRY"
-        env:
-          RELEASE_BINS_KEY: ${{ steps.release_bins_key.outputs.key }}
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_BINS_DISPATCH_SCOPE_REF: ${{ startsWith(github.ref, 'refs/tags/') && format('refs/heads/{0}', github.ref) || github.ref }}
-        timeout-minutes: 5
-      - name: Restore release-bins into isolated staging (transport only; publishes on a verified build)
-        id: release_bins_cache
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25
-        with:
-          path: |-
-            .release-bins-staging/release-bins.tgz
-            .release-bins-staging/release-bins.preimage
-            .release-bins-staging/release-bins.manifest
-          key: ${{ steps.release_bins_key.outputs.key }}
-        timeout-minutes: 10
-      - name: Decide the compiler pair outcome; verify a stored pack completely before any restored binary runs
-        id: release_bins_outcome
-        run: |
-          set -e
-          ROOT=$('git' 'rev-parse' '--show-toplevel')
-          STAGE="$ROOT"'/.release-bins-staging'
-          EXPECTED="$RUNNER_TEMP"'/release-bins.preimage.expected'
-          if '[' "$LOOKUP_STANDING" '=' 'present' ']' && '[' "$CACHE_HIT" '=' 'true' ']'; then ':' 'no-op'; else if '[' "$LOOKUP_STANDING" '=' 'present' ']' && '[' "$CACHE_HIT" '!=' 'true' ']'; then ('echo' '::error title=release-bins StoreTransportDisagreePresentMiss::the cache API holds an exact admitted entry for this key but the transport did not restore it exactly; refusing rather than rebuilding over a present entry'; exit 1); else if '[' "$LOOKUP_STANDING" '=' 'absent' ']' && '[' "$CACHE_HIT" '=' 'true' ']'; then ('echo' '::error title=release-bins StoreTransportDisagreeAbsentHit::the cache API holds no exact admitted entry for this key but the transport reported an exact hit; the store and its transport disagree'; exit 1); else if '[' "$LOOKUP_STANDING" '=' 'absent' ']' && '[' "$CACHE_HIT" '!=' 'true' ']'; then 'rm' '-rf' "$STAGE"; 'mkdir' '-p' "$STAGE"; 'echo' 'outcome=build' | 'tee' '-a' "$GITHUB_OUTPUT" > '/dev/null'; exit 0; else ('echo' '::error title=release-bins OutcomeInputsMissing::the lookup standing or the transport exactness is missing, so no outcome can be decided'; exit 1); fi; fi; fi; fi
-          '[' '-f' "$STAGE"'/release-bins.preimage' ']' || ('echo' '::error title=release-bins StoredEntryIncomplete::the stored entry is incomplete: release-bins.preimage is missing'; exit 1)
-          '[' '-f' "$STAGE"'/release-bins.manifest' ']' || ('echo' '::error title=release-bins StoredEntryIncomplete::the stored entry is incomplete: release-bins.manifest is missing'; exit 1)
-          '[' '-f' "$STAGE"'/release-bins.tgz' ']' || ('echo' '::error title=release-bins StoredEntryIncomplete::the stored entry is incomplete: release-bins.tgz is missing'; exit 1)
-          'cmp' '-s' "$EXPECTED" "$STAGE"'/release-bins.preimage' || ('diff' "$EXPECTED" "$STAGE"'/release-bins.preimage' || ':' 'no-op'; ('echo' '::error title=release-bins StoredPreimageDiffers::the stored preimage differs from this run'\''s independently derived preimage'; exit 1))
-          'sha256sum' "$STAGE"'/release-bins.preimage' > "$RUNNER_TEMP"'/STORED_DIGEST.out'
-          STORED_DIGEST=$('cut' '-d' ' ' '-f' '1' "$RUNNER_TEMP"'/STORED_DIGEST.out')
-          '[' 'release-bins-'"$STORED_DIGEST" '=' "$RELEASE_BINS_KEY" ']' || ('echo' '::error title=release-bins StoredPreimageKeyMismatch::the stored preimage does not hash to the probed key'; exit 1)
-          'printf' '%s' 'claim_executor
-          gunbc
-          build_diagnostics
-          claim_executor_checker_inputs
-          ' > "$RUNNER_TEMP"'/release-bins.roster'
-          'tar' '-tzf' "$STAGE"'/release-bins.tgz' > "$RUNNER_TEMP"'/pack-listing.out'
-          'cmp' '-s' "$RUNNER_TEMP"'/pack-listing.out' "$RUNNER_TEMP"'/release-bins.roster' || ('echo' '::error title=release-bins PackListingNotRoster::the stored pack'\''s archive listing is not exactly the roster (an extra, duplicate, directory or escaping entry)'; exit 1)
-          'cut' '-c' '67-' "$STAGE"'/release-bins.manifest' > "$RUNNER_TEMP"'/manifest-names.out'
-          'cmp' '-s' "$RUNNER_TEMP"'/manifest-names.out' "$RUNNER_TEMP"'/release-bins.roster' || ('echo' '::error title=release-bins ManifestRosterMismatch::the stored manifest does not name exactly the gunbc.ci_release_bins roster in order'; exit 1)
-          if 'grep' '-qvE' '^[0-9a-f]{64}  [A-Za-z0-9_]+$' "$STAGE"'/release-bins.manifest'; then ('echo' '::error title=release-bins ManifestMalformed::the stored manifest has a line that is not one well-formed sha256 record for a roster member'; exit 1); fi
-          'rm' '-rf' "$STAGE"'/unpacked'
-          'mkdir' '-p' "$STAGE"'/unpacked'
-          'tar' '-xzf' "$STAGE"'/release-bins.tgz' '-C' "$STAGE"'/unpacked' '--no-same-owner'
-          'printf' '%s' 'claim_executor:regular file:1
-          gunbc:regular file:1
-          ' > "$RUNNER_TEMP"'/member-types.expected'
-          ('cd' "$STAGE"'/unpacked' && 'stat' '-c' '%n:%F:%h' 'claim_executor' 'gunbc') > "$RUNNER_TEMP"'/member-types.out'
-          'cmp' '-s' "$RUNNER_TEMP"'/member-types.out' "$RUNNER_TEMP"'/member-types.expected' || ('diff' "$RUNNER_TEMP"'/member-types.expected' "$RUNNER_TEMP"'/member-types.out' || ':' 'no-op'; ('echo' '::error title=release-bins MemberNotRegularFile::the stored pack has a member that is not a self-contained regular file (a link, special file or hard-link dependency; the report above names it)'; exit 1))
-          ('cd' "$STAGE"'/unpacked' && 'find' 'claim_executor' 'gunbc' '-maxdepth' '0' '!' '-perm' '-u+x') > "$RUNNER_TEMP"'/member-nonexec.out'
-          '[' '!' '-s' "$RUNNER_TEMP"'/member-nonexec.out' ']' || ('cat' "$RUNNER_TEMP"'/member-nonexec.out'; ('echo' '::error title=release-bins MemberNotExecutable::the stored pack has a member that is not executable (listed above)'; exit 1))
-          ('cd' "$STAGE"'/unpacked' && 'sha256sum' '--strict' '--quiet' '-c' "$STAGE"'/release-bins.manifest') || ('echo' '::error title=release-bins MemberDigestMismatch::the stored member bytes do not match the manifest under strict checking; refusing before any member is promoted or run'; exit 1)
-          'mkdir' '-p' "$ROOT"'/target/release'
-          ('cd' "$ROOT"'/target/release' && 'rm' '-f' 'claim_executor' 'gunbc')
-          ('cd' "$STAGE"'/unpacked' && 'cp' '-p' 'claim_executor' 'gunbc' "$ROOT"'/target/release/')
-          ('cd' "$STAGE"'/unpacked' && 'cp' '-p' 'claim_executor_checker_inputs' "$ROOT"'/target/release/')
-          'rm' '-rf' "$STAGE"'/unpacked'
-          'echo' 'release-bins: stored pack verified and promoted'
-          'sha256sum' "$STAGE"'/release-bins.manifest' > "$RUNNER_TEMP"'/OUTPUT_DIGEST.out'
-          OUTPUT_DIGEST=$('cut' '-d' ' ' '-f' '1' "$RUNNER_TEMP"'/OUTPUT_DIGEST.out')
-          'echo' 'ReleaseBinsReuseReceipt: request='"$RELEASE_BINS_KEY"' output=sha256:'"$OUTPUT_DIGEST"' dispatch='"$GITHUB_RUN_ID"'/'"$GITHUB_RUN_ATTEMPT"' producer=['"$LOOKUP_ENTRY"'] built=no'
-          'echo' 'outcome=reuse' | 'tee' '-a' "$GITHUB_OUTPUT" > '/dev/null'
-        env:
-          RELEASE_BINS_KEY: ${{ steps.release_bins_key.outputs.key }}
-          LOOKUP_STANDING: ${{ steps.release_bins_lookup.outputs.standing }}
-          LOOKUP_ENTRY: ${{ steps.release_bins_lookup.outputs.entry }}
-          CACHE_HIT: ${{ steps.release_bins_cache.outputs.cache-hit }}
-        timeout-minutes: 5
       - name: Cache Cargo
         uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25
         with:
@@ -294,149 +65,6 @@ jobs:
           key: cargo-ci-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}
           restore-keys: |
             cargo-ci-${{ runner.os }}-${{ runner.arch }}-
-        if: steps.release_bins_outcome.outputs.outcome != 'reuse'
-      - name: Build the compiler pair (keyed miss only)
-        id: build_witness_fold
-        run: |+
-          GUNBC_FLOOR_LOG='gunbc-floor-cmd.log'
-          'set' '+e'
-          'set' '-o' 'pipefail'
-          ('sh' '-e' '-c' 'cargo build --release -p v1-compiler --bin claim_executor --bin gunbc') 2>&1 | 'tee' "$GUNBC_FLOOR_LOG"
-          GUNBC_FLOOR_EXIT="$?"
-          GUNBC_FLOOR_RECEIPT='gunbc-floor-outcome.txt'
-          GUNBC_FLOOR_CLASS='structural'
-          GUNBC_FLOOR_SIGNATURE=''
-          if '[' "$GUNBC_FLOOR_EXIT" '-eq' '126' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandInvokedCannotExecute'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '127' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandNotFound'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '0' ']'; then GUNBC_FLOOR_CLASS='none'; GUNBC_FLOOR_SIGNATURE=''; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'MemoryStallRefusedPageThrash' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='MemoryStallRefusedPageThrash'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'The runner has received a shutdown signal' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='RunnerLost'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: error: failed to execute compile' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFailedToExecuteCompile'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' '(exit status: 254)' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheRustcWrapperExit254'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: encountered fatal error' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFatalError'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'failed to spawn' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ProcessSpawnFailure'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'Resource temporarily unavailable' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ResourceTemporarilyUnavailable'; fi
-          if (! '[' '-f' "$GUNBC_FLOOR_RECEIPT" ']') || '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' || ('[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT"))) || ('[' "$GUNBC_FLOOR_CLASS" '=' 'none' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT")) && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=infra' "$GUNBC_FLOOR_RECEIPT"))); then 'printf' 'class=%s\nsignature=%s\nexit=%s\n' "$GUNBC_FLOOR_CLASS" "$GUNBC_FLOOR_SIGNATURE" "$GUNBC_FLOOR_EXIT" > "$GUNBC_FLOOR_RECEIPT"; if '[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']'; then 'echo' '::error title=environment::floor_class='"$GUNBC_FLOOR_CLASS"' signature='"$GUNBC_FLOOR_SIGNATURE"' exit='"$GUNBC_FLOOR_EXIT"'; this is not a verdict about the diff. Attempt receipt: '"$GUNBC_FLOOR_RECEIPT"; fi; if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']'; then 'echo' '::error title=subject::floor_class='"$GUNBC_FLOOR_CLASS"' exit='"$GUNBC_FLOOR_EXIT"'; read the step log for the subject defect'; fi; fi
-          'exit' "$GUNBC_FLOOR_EXIT"
-
-        if: steps.release_bins_outcome.outputs.outcome != 'reuse'
-      - name: Pack the compiler pair with its build log (build outcomes only)
-        run: |
-          set -e
-          ROOT=$('git' 'rev-parse' '--show-toplevel')
-          STAGE="$ROOT"'/.release-bins-staging'
-          'mkdir' '-p' "$STAGE"
-          '[' '-s' "$ROOT"'/gunbc-floor-cmd.log' ']' || ('echo' '::error title=release-bins BuildDiagnosticsMissing::the product requires the build log gunbc-floor-cmd.log as a pack member and the build step left none; a pack without its diagnostics is incomplete, not smaller'; exit 1)
-          'cp' "$ROOT"'/gunbc-floor-cmd.log' "$ROOT"'/target/release/build_diagnostics'
-          './target/release/claim_executor' '--write-checker-inputs' "$ROOT"'/target/release/claim_executor_checker_inputs'
-          '[' '-s' "$ROOT"'/target/release/claim_executor_checker_inputs' ']' || ('echo' '::error title=release-bins SidecarMissing::the product requires the sidecar claim_executor_checker_inputs as a pack member and the producing job left none; a pack without it is incomplete, not smaller'; exit 1)
-          ('cd' "$ROOT"'/target/release' && 'sha256sum' 'claim_executor' 'gunbc' 'build_diagnostics' 'claim_executor_checker_inputs') > "$STAGE"'/release-bins.manifest'
-          'tar' '-czf' "$STAGE"'/release-bins.tgz' '-C' "$ROOT"'/target/release' 'claim_executor' 'gunbc' 'build_diagnostics' 'claim_executor_checker_inputs'
-          'cp' "$RUNNER_TEMP"'/release-bins.preimage.expected' "$STAGE"'/release-bins.preimage'
-          'sha256sum' "$STAGE"'/release-bins.manifest' > "$RUNNER_TEMP"'/OUTPUT_DIGEST.out'
-          OUTPUT_DIGEST=$('cut' '-d' ' ' '-f' '1' "$RUNNER_TEMP"'/OUTPUT_DIGEST.out')
-          'echo' 'ReleaseBinsBuildReceipt: request='"$RELEASE_BINS_KEY"' output=sha256:'"$OUTPUT_DIGEST"' dispatch='"$GITHUB_RUN_ID"'/'"$GITHUB_RUN_ATTEMPT"' built=yes publish=requested-not-yet-persisted scope='"$GITHUB_REF"
-        env:
-          RELEASE_BINS_KEY: ${{ steps.release_bins_key.outputs.key }}
-        if: steps.release_bins_outcome.outputs.outcome != 'reuse'
-        timeout-minutes: 5
-      - name: Upload release-bins artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
-        with:
-          name: release-bins
-          path: |-
-            .release-bins-staging/release-bins.tgz
-            .release-bins-staging/release-bins.preimage
-            .release-bins-staging/release-bins.manifest
-          if-no-files-found: error
-          retention-days: 3
-          compression-level: 0
-        timeout-minutes: 10
-      - name: Wrap the compiler pair as the merge-group candidate object
-        run: |
-          set -e
-          ROOT=$('git' 'rev-parse' '--show-toplevel')
-          STAGE="$ROOT"'/.release-bins-staging'
-          'tar' '-cf' "$RUNNER_TEMP"'/pack.tar' '-C' "$STAGE" 'release-bins.preimage' 'release-bins.manifest' 'release-bins.tgz'
-        if: github.event_name == 'merge_group'
-        timeout-minutes: 5
-      - name: Upload the compiler pair candidate
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
-        with:
-          name: compiler-pair-candidate
-          path: ${{ runner.temp }}/pack.tar
-          if-no-files-found: error
-          retention-days: 1
-          compression-level: 0
-        if: github.event_name == 'merge_group'
-      - name: Require isolated toolchain homes
-        run: |
-          if [ -z "${CARGO_HOME:-}" ] || [ -z "${RUSTUP_HOME:-}" ]; then echo "::error::ToolchainHomesNotIsolated CARGO_HOME=${CARGO_HOME:-unset} RUSTUP_HOME=${RUSTUP_HOME:-unset} -- the isolation step did not run, so this job shares a toolchain with every other runner slot on this host and a concurrent install can replace a binary mid-run" >&2; exit 1; fi
-        if: "!cancelled()"
-    env:
-      MALLOC_ARENA_MAX: "2"
-  emit-build:
-    runs-on: [self-hosted, linux, arm64]
-    timeout-minutes: 90
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: Checkout the commit this lane judges
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha }}
-          persist-credentials: false
-      - name: Isolate toolchain homes
-        run: |-
-          # dissolve-on: ci_toolchain_home_isolation_script -- orch-emitted foreign-executor prelude step wiping and setting HOME/CARGO_HOME/RUSTUP_HOME under RUNNER_TEMP so concurrent runner slots stop sharing one toolchain; leaf rm/echo strings remain until a typed per-job filesystem-and-environment effect lands on host_effect_apply (shell-to-intent Phase 2). This obligation covers THIS carrier and ci_isolate_toolchain_script, which share that terminal construction; ci_pin_rustup_default_script carries its own obligation because it does not
-          rm -rf "$RUNNER_TEMP/rustup" "$RUNNER_TEMP/cargo"
-          echo "HOME=$RUNNER_TEMP" >> "$GITHUB_ENV"
-          echo "CARGO_HOME=$RUNNER_TEMP/cargo" >> "$GITHUB_ENV"
-          echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
-      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7
-        with:
-          components: rustfmt
-          cache: false
-          rustflags: -D warnings
-      - name: Pin rustup default (isolated RUSTUP_HOME has no default toolchain)
-        run: |-
-          # dissolve-on: ci_pin_rustup_default_script -- orch-emitted foreign-executor step selecting a rustup default toolchain inside an isolated RUSTUP_HOME, which starts with none, and resolving the cargo binary that selection implies. The leaf rustup/command/echo strings remain until a typed TOOLCHAIN-SELECTION effect lands on host_effect_apply -- NOT the filesystem-and-environment effect ci_toolchain_home_isolation_script waits on, which is why this is a separate obligation: that effect landing alone would leave this carrier standing
-          rustup default "$(rustup show active-toolchain | awk '{print $1; exit}')"
-          if [ -x "$CARGO_HOME/bin/cargo" ]; then CARGO_BIN="$CARGO_HOME/bin/cargo"; else CARGO_BIN="$(command -v cargo || true)"; fi
-          if [ -z "$CARGO_BIN" ]; then echo "::error::no cargo binary: neither the isolated $CARGO_HOME/bin/cargo shim nor PATH carries one"; exit 1; fi
-          echo "CARGO_BIN=$CARGO_BIN" >> "$GITHUB_ENV"
-      - name: Bind job-private native product store root
-        run: |-
-          # 🟡 dissolve-on: compiler_gate_native_cache_root_script — hand-authored two-line shell binding the job-private native product store root under RUNNER_TEMP. DISSOLVES WHEN the restore of the shared native product store is an emitted intent that names its job-private directory (a typed host-effect realization through v2.workflow.bash_emit bash_emit_program), so the mkdir and the GITHUB_ENV append are derived from that intent rather than spelled here.
-          mkdir -p "$RUNNER_TEMP/gunbc-native-products"
-          echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TEMP/gunbc-native-products" >> "$GITHUB_ENV"
-        if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
-      - name: WIF auth (OIDC -> native-product-read, pull requests)
-        id: native_read_wif
-        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
-        with:
-          workload_identity_provider: projects/582015116396/locations/global/workloadIdentityPools/github-actions/providers/github-oidc
-          service_account: native-product-read@gunbai-secrets.iam.gserviceaccount.com
-          token_format: access_token
-          create_credentials_file: false
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || github.event_name == 'merge_group'
-        continue-on-error: true
-        timeout-minutes: 5
-      - name: WIF auth (OIDC -> native-product-write, merge queue)
-        id: native_write_wif
-        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
-        with:
-          workload_identity_provider: projects/582015116396/locations/global/workloadIdentityPools/github-native-product-write/providers/github-native-product-write-oidc
-          service_account: native-product-write@gunbai-secrets.iam.gserviceaccount.com
-          token_format: access_token
-          create_credentials_file: false
-        if: github.event_name == 'merge_group'
-        continue-on-error: true
-        timeout-minutes: 5
       - name: Build the compiler
         id: build_witness_fold
         run: |+
@@ -491,8 +119,8 @@ jobs:
 
         env:
           GUNBC_NATIVE_FAULT_EXPERIMENT: ${{ github.event_name == 'pull_request' && 'skip_pull_request' || 'run' }}
-          WIF_ACCESS_TOKEN: ${{ steps.native_read_wif.outputs.access_token }}
-          GUNBC_PULL_REQUEST_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
+          GUNBC_NATIVE_PRODUCT_REUSE: fresh
+          GUNBC_MEMORY_ENVELOPE_REQUIRED: slot
       - name: emit and build //gunbc/instruments:v2-native-cli
         id: emit_build_v2_native_cli
         run: |+
@@ -519,435 +147,16 @@ jobs:
 
         env:
           GUNBC_NATIVE_FAULT_EXPERIMENT: ${{ github.event_name == 'pull_request' && 'skip_pull_request' || 'run' }}
-          WIF_ACCESS_TOKEN: ${{ steps.native_read_wif.outputs.access_token }}
-          GUNBC_PULL_REQUEST_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
-      - name: Save admitted native products to the shared store
-        run: |
-          'target/release/gunbc' 'run' '--source-root' 'dag' '--source-root' 'src/v2' '--entry' 'dag/gunbc/native_product_shared_transfer.dag' '--function' 'native_product_save_wet'
-        env:
-          WIF_ACCESS_TOKEN: ${{ steps.native_write_wif.outputs.access_token }}
-        if: success() && github.event_name == 'merge_group'
-        continue-on-error: true
-        timeout-minutes: 10
+          GUNBC_NATIVE_PRODUCT_REUSE: fresh
+          GUNBC_MEMORY_ENVELOPE_REQUIRED: slot
       - name: Why this lane is red, and what would be a real finding
         run: |-
           printf '%s\n' 'emit-build is a REQUIRED lane: a red here BLOCKS your merge, through the required context `witnesses`.'
           printf '%s\n' 'No standing break is declared, so a red here is a REAL FINDING -- most likely yours.'
+          printf '%s\n' 'This step ran inside the fleet slot'\''s memory envelope (gunbc.runner_slot_desired: MemoryMax 23622320128 bytes, no swap once converged), which gunbc test required (GUNBC_MEMORY_ENVELOPE_REQUIRED=slot) and receipted at exit.'
+          printf '%s\n' 'The per-step trip at 21474836480 bytes is not asked for: a fleet job runs as the setpriv'\''d job user under a root unit (gunbc.runner_host_deploy unit_user and job_user) and memory_governor apply_memory_cgroup_bind creates its leaf at the cgroup root, so no process of a job can create or join a bounded cgroup; the first required run that asked refused in four seconds (run 38002497388, MemoryCgroupBindRefused) (gunbc.runner_slot_desired gunbc_runner_slot_job_cgroup_ownership; the climb is gunbc.guarantee_stall native_step_trip_awaits_fleet_job_cgroup_stall).'
+          printf '%s\n' 'An exit of 137 here is the kernel tripping the envelope'\''s memory.max: the compiler outgrew it. There is no larger runner and no retry; the line stops until the growth is understood (DESIGN section 6b).'
+          printf '%s\n' 'A MEMORY RECEIPT line precedes every successful subject step; a run that charged swap or was OOM-killed is refused even when its instrument held.'
         if: failure()
     env:
       MALLOC_ARENA_MAX: "2"
-  floor:
-    runs-on: [self-hosted, linux, arm64]
-    needs: [seed]
-    timeout-minutes: 90
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout the commit this lane judges
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha }}
-          persist-credentials: false
-      - name: Isolate toolchain homes
-        run: |-
-          # dissolve-on: ci_toolchain_home_isolation_script -- orch-emitted foreign-executor prelude step wiping and setting HOME/CARGO_HOME/RUSTUP_HOME under RUNNER_TEMP so concurrent runner slots stop sharing one toolchain; leaf rm/echo strings remain until a typed per-job filesystem-and-environment effect lands on host_effect_apply (shell-to-intent Phase 2). This obligation covers THIS carrier and ci_isolate_toolchain_script, which share that terminal construction; ci_pin_rustup_default_script carries its own obligation because it does not
-          rm -rf "$RUNNER_TEMP/rustup" "$RUNNER_TEMP/cargo"
-          echo "HOME=$RUNNER_TEMP" >> "$GITHUB_ENV"
-          echo "CARGO_HOME=$RUNNER_TEMP/cargo" >> "$GITHUB_ENV"
-          echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
-      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7
-        with:
-          components: rustfmt
-          cache: false
-          rustflags: -D warnings
-      - name: Pin rustup default (isolated RUSTUP_HOME has no default toolchain)
-        run: |-
-          # dissolve-on: ci_pin_rustup_default_script -- orch-emitted foreign-executor step selecting a rustup default toolchain inside an isolated RUSTUP_HOME, which starts with none, and resolving the cargo binary that selection implies. The leaf rustup/command/echo strings remain until a typed TOOLCHAIN-SELECTION effect lands on host_effect_apply -- NOT the filesystem-and-environment effect ci_toolchain_home_isolation_script waits on, which is why this is a separate obligation: that effect landing alone would leave this carrier standing
-          rustup default "$(rustup show active-toolchain | awk '{print $1; exit}')"
-          if [ -x "$CARGO_HOME/bin/cargo" ]; then CARGO_BIN="$CARGO_HOME/bin/cargo"; else CARGO_BIN="$(command -v cargo || true)"; fi
-          if [ -z "$CARGO_BIN" ]; then echo "::error::no cargo binary: neither the isolated $CARGO_HOME/bin/cargo shim nor PATH carries one"; exit 1; fi
-          echo "CARGO_BIN=$CARGO_BIN" >> "$GITHUB_ENV"
-      - name: Download release-bins artifact
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
-        with:
-          name: release-bins
-          path: ${{ runner.temp }}/release-bins-download
-        timeout-minutes: 10
-      - name: Verify the seed's compiler pair against its key and promote it into this checkout
-        id: build_witness_fold
-        run: |
-          set -e
-          ROOT=$('git' 'rev-parse' '--show-toplevel')
-          '[' '-n' "$RELEASE_BINS_KEY" ']' || ('echo' '::error title=release-bins ConsumerKeyMissing::the build job published no release-bins key'; exit 1)
-          '[' '-f' "$RUNNER_TEMP"'/release-bins-download/release-bins.preimage' ']' || ('echo' '::error title=release-bins ConsumerFileMissing::the release-bins artifact is missing release-bins.preimage'; exit 1)
-          '[' '-f' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest' ']' || ('echo' '::error title=release-bins ConsumerFileMissing::the release-bins artifact is missing release-bins.manifest'; exit 1)
-          '[' '-f' "$RUNNER_TEMP"'/release-bins-download/release-bins.tgz' ']' || ('echo' '::error title=release-bins ConsumerFileMissing::the release-bins artifact is missing release-bins.tgz'; exit 1)
-          'sha256sum' "$RUNNER_TEMP"'/release-bins-download/release-bins.preimage' > "$RUNNER_TEMP"'/DOWNLOADED_DIGEST.out'
-          DOWNLOADED_DIGEST=$('cut' '-d' ' ' '-f' '1' "$RUNNER_TEMP"'/DOWNLOADED_DIGEST.out')
-          '[' 'release-bins-'"$DOWNLOADED_DIGEST" '=' "$RELEASE_BINS_KEY" ']' || ('echo' '::error title=release-bins ConsumerPreimageKeyMismatch::the downloaded preimage does not hash to the build job'\''s key'; exit 1)
-          OBJECT_FORMAT=$('git' '-C' "$ROOT" 'rev-parse' '--show-object-format')
-          SOURCE_TREE=$('git' '-C' "$ROOT" 'rev-parse' 'HEAD^{tree}')
-          '[' '-n' "$OBJECT_FORMAT" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input OBJECT_FORMAT read back empty, so the key would not name the build; refusing to key'; exit 1)
-          '[' '-n' "$SOURCE_TREE" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input SOURCE_TREE read back empty, so the key would not name the build; refusing to key'; exit 1)
-          SOURCE_CLOSURE='tree:'"$OBJECT_FORMAT"':'"$SOURCE_TREE"
-          'grep' '-qxF' 'source_closure='"$SOURCE_CLOSURE" "$RUNNER_TEMP"'/release-bins-download/release-bins.preimage' || ('echo' '::error title=release-bins ConsumerSourceTreeMismatch::the pack was keyed on a different source tree than this job'\''s checkout'; exit 1)
-          'printf' '%s' 'claim_executor
-          gunbc
-          build_diagnostics
-          claim_executor_checker_inputs
-          ' > "$RUNNER_TEMP"'/release-bins.roster'
-          'tar' '-tzf' "$RUNNER_TEMP"'/release-bins-download/release-bins.tgz' > "$RUNNER_TEMP"'/pack-listing.out'
-          'cmp' '-s' "$RUNNER_TEMP"'/pack-listing.out' "$RUNNER_TEMP"'/release-bins.roster' || ('echo' '::error title=release-bins PackListingNotRoster::the downloaded pack'\''s archive listing is not exactly the roster (an extra, duplicate, directory or escaping entry)'; exit 1)
-          'cut' '-c' '67-' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest' > "$RUNNER_TEMP"'/manifest-names.out'
-          'cmp' '-s' "$RUNNER_TEMP"'/manifest-names.out' "$RUNNER_TEMP"'/release-bins.roster' || ('echo' '::error title=release-bins ManifestRosterMismatch::the downloaded manifest does not name exactly the gunbc.ci_release_bins roster in order'; exit 1)
-          if 'grep' '-qvE' '^[0-9a-f]{64}  [A-Za-z0-9_]+$' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest'; then ('echo' '::error title=release-bins ManifestMalformed::the downloaded manifest has a line that is not one well-formed sha256 record for a roster member'; exit 1); fi
-          'rm' '-rf' "$RUNNER_TEMP"'/release-bins-check'
-          'mkdir' '-p' "$RUNNER_TEMP"'/release-bins-check'
-          'tar' '-xzf' "$RUNNER_TEMP"'/release-bins-download/release-bins.tgz' '-C' "$RUNNER_TEMP"'/release-bins-check' '--no-same-owner'
-          'printf' '%s' 'claim_executor:regular file:1
-          gunbc:regular file:1
-          ' > "$RUNNER_TEMP"'/member-types.expected'
-          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'stat' '-c' '%n:%F:%h' 'claim_executor' 'gunbc') > "$RUNNER_TEMP"'/member-types.out'
-          'cmp' '-s' "$RUNNER_TEMP"'/member-types.out' "$RUNNER_TEMP"'/member-types.expected' || ('diff' "$RUNNER_TEMP"'/member-types.expected' "$RUNNER_TEMP"'/member-types.out' || ':' 'no-op'; ('echo' '::error title=release-bins MemberNotRegularFile::the downloaded pack has a member that is not a self-contained regular file (a link, special file or hard-link dependency; the report above names it)'; exit 1))
-          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'find' 'claim_executor' 'gunbc' '-maxdepth' '0' '!' '-perm' '-u+x') > "$RUNNER_TEMP"'/member-nonexec.out'
-          '[' '!' '-s' "$RUNNER_TEMP"'/member-nonexec.out' ']' || ('cat' "$RUNNER_TEMP"'/member-nonexec.out'; ('echo' '::error title=release-bins MemberNotExecutable::the downloaded pack has a member that is not executable (listed above)'; exit 1))
-          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'sha256sum' '--strict' '--quiet' '-c' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest') || ('echo' '::error title=release-bins MemberDigestMismatch::the downloaded member bytes do not match the manifest under strict checking; refusing before any member is promoted or run'; exit 1)
-          'mkdir' '-p' "$ROOT"'/target/release'
-          ('cd' "$ROOT"'/target/release' && 'rm' '-f' 'claim_executor' 'gunbc')
-          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'cp' '-p' 'claim_executor' 'gunbc' "$ROOT"'/target/release/')
-          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'cp' '-p' 'claim_executor_checker_inputs' "$ROOT"'/target/release/')
-          'rm' '-rf' "$RUNNER_TEMP"'/release-bins-check'
-          "$ROOT"'/target/release/claim_executor' '--verify-build-artifacts' "$ROOT"'/target/release/claim_executor' "$ROOT"'/target/release/gunbc'
-        env:
-          RELEASE_BINS_KEY: ${{ needs.seed.outputs.release_bins_key }}
-        timeout-minutes: 5
-      - name: Require isolated toolchain homes
-        run: |
-          if [ -z "${CARGO_HOME:-}" ] || [ -z "${RUSTUP_HOME:-}" ]; then echo "::error::ToolchainHomesNotIsolated CARGO_HOME=${CARGO_HOME:-unset} RUSTUP_HOME=${RUSTUP_HOME:-unset} -- the isolation step did not run, so this job shares a toolchain with every other runner slot on this host and a concurrent install can replace a binary mid-run" >&2; exit 1; fi
-        if: "!cancelled()"
-      - name: Nominal witnesses (one prepared subject, one fold)
-        id: required_ci_measure
-        run: |+
-          GUNBC_FLOOR_LOG='gunbc-floor-cmd.log'
-          'set' '+e'
-          'set' '-o' 'pipefail'
-          ('sh' '-e' '-c' 'ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          cd "$ROOT"
-          '\''target/release/claim_executor'\'' '\''--required-ci'\'' '\''--source-root'\'' '\''dag'\'' '\''--source-root'\'' '\''src/v2'\'' '\''--required-lane'\'' '\''witnesses'\'' '\''--measurement-receipt'\'' '\''required_ci_measurement_receipt.json'\''
-          ') 2>&1 | 'tee' "$GUNBC_FLOOR_LOG"
-          GUNBC_FLOOR_EXIT="$?"
-          GUNBC_FLOOR_RECEIPT='gunbc-floor-outcome.txt'
-          GUNBC_FLOOR_CLASS='structural'
-          GUNBC_FLOOR_SIGNATURE=''
-          if '[' "$GUNBC_FLOOR_EXIT" '-eq' '126' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandInvokedCannotExecute'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '127' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandNotFound'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '0' ']'; then GUNBC_FLOOR_CLASS='none'; GUNBC_FLOOR_SIGNATURE=''; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'MemoryStallRefusedPageThrash' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='MemoryStallRefusedPageThrash'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'The runner has received a shutdown signal' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='RunnerLost'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: error: failed to execute compile' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFailedToExecuteCompile'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' '(exit status: 254)' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheRustcWrapperExit254'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: encountered fatal error' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFatalError'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'failed to spawn' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ProcessSpawnFailure'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'Resource temporarily unavailable' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ResourceTemporarilyUnavailable'; fi
-          if (! '[' '-f' "$GUNBC_FLOOR_RECEIPT" ']') || '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' || ('[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT"))) || ('[' "$GUNBC_FLOOR_CLASS" '=' 'none' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT")) && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=infra' "$GUNBC_FLOOR_RECEIPT"))); then 'printf' 'class=%s\nsignature=%s\nexit=%s\n' "$GUNBC_FLOOR_CLASS" "$GUNBC_FLOOR_SIGNATURE" "$GUNBC_FLOOR_EXIT" > "$GUNBC_FLOOR_RECEIPT"; if '[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']'; then 'echo' '::error title=environment::floor_class='"$GUNBC_FLOOR_CLASS"' signature='"$GUNBC_FLOOR_SIGNATURE"' exit='"$GUNBC_FLOOR_EXIT"'; this is not a verdict about the diff. Attempt receipt: '"$GUNBC_FLOOR_RECEIPT"; fi; if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']'; then 'echo' '::error title=subject::floor_class='"$GUNBC_FLOOR_CLASS"' exit='"$GUNBC_FLOOR_EXIT"'; read the step log for the subject defect'; fi; fi
-          'exit' "$GUNBC_FLOOR_EXIT"
-
-        if: "!cancelled() && steps.build_witness_fold.outcome == 'success'"
-      - name: "D0-MEASURE: seal an unreached receipt when the instrument did not return"
-        run: |+
-          GUNBC_FLOOR_LOG='gunbc-floor-cmd.log'
-          'set' '+e'
-          'set' '-o' 'pipefail'
-          ('sh' '-e' '-c' 'if '\''['\'' '\''!'\'' '\''-f'\'' '\''required_ci_measurement_receipt.json'\'' '\'']'\''; then if '\''['\'' "$REQUIRED_CI_INSTRUMENT_BUILD_OUTCOME" '\''='\'' '\''success'\'' '\'']'\''; then '\''target/release/claim_executor'\'' '\''--measurement-unreached-receipt'\'' '\''required_ci_measurement_receipt.json'\'' '\''--measurement-unreached-cause'\'' '\''measurement process exited before producing a receipt'\''; fi; if '\''['\'' "$REQUIRED_CI_INSTRUMENT_BUILD_OUTCOME" '\''!='\'' '\''success'\'' '\'']'\''; then '\''printf'\'' '\''%s\n'\'' '\''{"version": 1, "receipt": {"standing": "measurement_unreached", "cause": "instrument could not be built"}}'\'' > '\''required_ci_measurement_receipt.json'\''; fi; fi
-          ') 2>&1 | 'tee' "$GUNBC_FLOOR_LOG"
-          GUNBC_FLOOR_EXIT="$?"
-          GUNBC_FLOOR_RECEIPT='gunbc-floor-outcome.txt'
-          GUNBC_FLOOR_CLASS='structural'
-          GUNBC_FLOOR_SIGNATURE=''
-          if '[' "$GUNBC_FLOOR_EXIT" '-eq' '126' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandInvokedCannotExecute'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '127' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandNotFound'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '0' ']'; then GUNBC_FLOOR_CLASS='none'; GUNBC_FLOOR_SIGNATURE=''; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'MemoryStallRefusedPageThrash' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='MemoryStallRefusedPageThrash'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'The runner has received a shutdown signal' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='RunnerLost'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: error: failed to execute compile' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFailedToExecuteCompile'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' '(exit status: 254)' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheRustcWrapperExit254'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: encountered fatal error' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFatalError'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'failed to spawn' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ProcessSpawnFailure'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'Resource temporarily unavailable' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ResourceTemporarilyUnavailable'; fi
-          if (! '[' '-f' "$GUNBC_FLOOR_RECEIPT" ']') || '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' || ('[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT"))) || ('[' "$GUNBC_FLOOR_CLASS" '=' 'none' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT")) && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=infra' "$GUNBC_FLOOR_RECEIPT"))); then 'printf' 'class=%s\nsignature=%s\nexit=%s\n' "$GUNBC_FLOOR_CLASS" "$GUNBC_FLOOR_SIGNATURE" "$GUNBC_FLOOR_EXIT" > "$GUNBC_FLOOR_RECEIPT"; if '[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']'; then 'echo' '::error title=environment::floor_class='"$GUNBC_FLOOR_CLASS"' signature='"$GUNBC_FLOOR_SIGNATURE"' exit='"$GUNBC_FLOOR_EXIT"'; this is not a verdict about the diff. Attempt receipt: '"$GUNBC_FLOOR_RECEIPT"; fi; if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']'; then 'echo' '::error title=subject::floor_class='"$GUNBC_FLOOR_CLASS"' exit='"$GUNBC_FLOOR_EXIT"'; read the step log for the subject defect'; fi; fi
-          'exit' "$GUNBC_FLOOR_EXIT"
-
-        env:
-          REQUIRED_CI_INSTRUMENT_BUILD_OUTCOME: ${{ steps.build_witness_fold.outcome }}
-        if: always() && !cancelled()
-      - name: "D0-PUBLISH: upload the required CI measurement receipt"
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
-        with:
-          name: required-ci-measurement-receipt
-          path: required_ci_measurement_receipt.json
-          if-no-files-found: error
-          retention-days: 14
-        if: always() && !cancelled()
-      - name: "D0-ADJUDICATE: consume the published measurement receipt"
-        run: |+
-          GUNBC_FLOOR_LOG='gunbc-floor-cmd.log'
-          'set' '+e'
-          'set' '-o' 'pipefail'
-          ('sh' '-e' '-c' 'if '\''['\'' "$REQUIRED_CI_INSTRUMENT_BUILD_OUTCOME" '\''='\'' '\''success'\'' '\'']'\''; then '\''target/release/claim_executor'\'' '\''--adjudicate-measurement-receipt'\'' '\''required_ci_measurement_receipt.json'\''; fi
-          if '\''['\'' "$REQUIRED_CI_INSTRUMENT_BUILD_OUTCOME" '\''!='\'' '\''success'\'' '\'']'\''; then '\''echo'\'' '\''required-ci: adjudication REFUSED standing=measurement_unreached cause=instrument could not be built'\'' >&2; exit 1; fi
-          ') 2>&1 | 'tee' "$GUNBC_FLOOR_LOG"
-          GUNBC_FLOOR_EXIT="$?"
-          GUNBC_FLOOR_RECEIPT='gunbc-floor-outcome.txt'
-          GUNBC_FLOOR_CLASS='structural'
-          GUNBC_FLOOR_SIGNATURE=''
-          if '[' "$GUNBC_FLOOR_EXIT" '-eq' '126' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandInvokedCannotExecute'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '127' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandNotFound'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '0' ']'; then GUNBC_FLOOR_CLASS='none'; GUNBC_FLOOR_SIGNATURE=''; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'MemoryStallRefusedPageThrash' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='MemoryStallRefusedPageThrash'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'The runner has received a shutdown signal' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='RunnerLost'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: error: failed to execute compile' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFailedToExecuteCompile'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' '(exit status: 254)' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheRustcWrapperExit254'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: encountered fatal error' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFatalError'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'failed to spawn' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ProcessSpawnFailure'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'Resource temporarily unavailable' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ResourceTemporarilyUnavailable'; fi
-          if (! '[' '-f' "$GUNBC_FLOOR_RECEIPT" ']') || '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' || ('[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT"))) || ('[' "$GUNBC_FLOOR_CLASS" '=' 'none' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT")) && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=infra' "$GUNBC_FLOOR_RECEIPT"))); then 'printf' 'class=%s\nsignature=%s\nexit=%s\n' "$GUNBC_FLOOR_CLASS" "$GUNBC_FLOOR_SIGNATURE" "$GUNBC_FLOOR_EXIT" > "$GUNBC_FLOOR_RECEIPT"; if '[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']'; then 'echo' '::error title=environment::floor_class='"$GUNBC_FLOOR_CLASS"' signature='"$GUNBC_FLOOR_SIGNATURE"' exit='"$GUNBC_FLOOR_EXIT"'; this is not a verdict about the diff. Attempt receipt: '"$GUNBC_FLOOR_RECEIPT"; fi; if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']'; then 'echo' '::error title=subject::floor_class='"$GUNBC_FLOOR_CLASS"' exit='"$GUNBC_FLOOR_EXIT"'; read the step log for the subject defect'; fi; fi
-          'exit' "$GUNBC_FLOOR_EXIT"
-
-        env:
-          REQUIRED_CI_INSTRUMENT_BUILD_OUTCOME: ${{ steps.build_witness_fold.outcome }}
-        if: always() && !cancelled()
-      - name: Upload the floor's per-claim cost receipt
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
-        with:
-          name: required-floor-claim-cost
-          path: required_floor_claim_cost.tsv
-          if-no-files-found: error
-          retention-days: 14
-        if: "!cancelled() && steps.build_witness_fold.outcome == 'success'"
-      - name: Upload the floor's admission roster
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
-        with:
-          name: required-floor-disposition
-          path: required_floor_disposition.tsv
-          if-no-files-found: error
-          retention-days: 14
-        if: "!cancelled() && steps.build_witness_fold.outcome == 'success'"
-    env:
-      MALLOC_ARENA_MAX: "2"
-      GUNBC_EXPECTED_RED_ROSTER_JOIN: expected_red_roster_join.tsv
-      GUNBC_REQUIRED_FLOOR_DISPOSITION: required_floor_disposition.tsv
-      GUNBC_LONG_HOME_STORAGE_AGREEMENT: long_home_storage_agreement.tsv
-      GUNBC_REQUIRED_FLOOR_CLAIM_COST: required_floor_claim_cost.tsv
-      GUNBC_REQUIRED_FLOOR_CROSS_CLAIM_DEMAND: required_floor_cross_claim_demand.tsv
-  generated:
-    runs-on: [self-hosted, linux, arm64]
-    needs: [seed]
-    timeout-minutes: 90
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout the commit this lane judges
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha }}
-          persist-credentials: false
-      - name: Isolate toolchain homes
-        run: |-
-          # dissolve-on: ci_toolchain_home_isolation_script -- orch-emitted foreign-executor prelude step wiping and setting HOME/CARGO_HOME/RUSTUP_HOME under RUNNER_TEMP so concurrent runner slots stop sharing one toolchain; leaf rm/echo strings remain until a typed per-job filesystem-and-environment effect lands on host_effect_apply (shell-to-intent Phase 2). This obligation covers THIS carrier and ci_isolate_toolchain_script, which share that terminal construction; ci_pin_rustup_default_script carries its own obligation because it does not
-          rm -rf "$RUNNER_TEMP/rustup" "$RUNNER_TEMP/cargo"
-          echo "HOME=$RUNNER_TEMP" >> "$GITHUB_ENV"
-          echo "CARGO_HOME=$RUNNER_TEMP/cargo" >> "$GITHUB_ENV"
-          echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
-      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7
-        with:
-          components: rustfmt
-          cache: false
-          rustflags: -D warnings
-      - name: Pin rustup default (isolated RUSTUP_HOME has no default toolchain)
-        run: |-
-          # dissolve-on: ci_pin_rustup_default_script -- orch-emitted foreign-executor step selecting a rustup default toolchain inside an isolated RUSTUP_HOME, which starts with none, and resolving the cargo binary that selection implies. The leaf rustup/command/echo strings remain until a typed TOOLCHAIN-SELECTION effect lands on host_effect_apply -- NOT the filesystem-and-environment effect ci_toolchain_home_isolation_script waits on, which is why this is a separate obligation: that effect landing alone would leave this carrier standing
-          rustup default "$(rustup show active-toolchain | awk '{print $1; exit}')"
-          if [ -x "$CARGO_HOME/bin/cargo" ]; then CARGO_BIN="$CARGO_HOME/bin/cargo"; else CARGO_BIN="$(command -v cargo || true)"; fi
-          if [ -z "$CARGO_BIN" ]; then echo "::error::no cargo binary: neither the isolated $CARGO_HOME/bin/cargo shim nor PATH carries one"; exit 1; fi
-          echo "CARGO_BIN=$CARGO_BIN" >> "$GITHUB_ENV"
-      - name: Download release-bins artifact
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
-        with:
-          name: release-bins
-          path: ${{ runner.temp }}/release-bins-download
-        timeout-minutes: 10
-      - name: Verify the seed's compiler pair against its key and promote it into this checkout
-        id: build_witness_fold
-        run: |
-          set -e
-          ROOT=$('git' 'rev-parse' '--show-toplevel')
-          '[' '-n' "$RELEASE_BINS_KEY" ']' || ('echo' '::error title=release-bins ConsumerKeyMissing::the build job published no release-bins key'; exit 1)
-          '[' '-f' "$RUNNER_TEMP"'/release-bins-download/release-bins.preimage' ']' || ('echo' '::error title=release-bins ConsumerFileMissing::the release-bins artifact is missing release-bins.preimage'; exit 1)
-          '[' '-f' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest' ']' || ('echo' '::error title=release-bins ConsumerFileMissing::the release-bins artifact is missing release-bins.manifest'; exit 1)
-          '[' '-f' "$RUNNER_TEMP"'/release-bins-download/release-bins.tgz' ']' || ('echo' '::error title=release-bins ConsumerFileMissing::the release-bins artifact is missing release-bins.tgz'; exit 1)
-          'sha256sum' "$RUNNER_TEMP"'/release-bins-download/release-bins.preimage' > "$RUNNER_TEMP"'/DOWNLOADED_DIGEST.out'
-          DOWNLOADED_DIGEST=$('cut' '-d' ' ' '-f' '1' "$RUNNER_TEMP"'/DOWNLOADED_DIGEST.out')
-          '[' 'release-bins-'"$DOWNLOADED_DIGEST" '=' "$RELEASE_BINS_KEY" ']' || ('echo' '::error title=release-bins ConsumerPreimageKeyMismatch::the downloaded preimage does not hash to the build job'\''s key'; exit 1)
-          OBJECT_FORMAT=$('git' '-C' "$ROOT" 'rev-parse' '--show-object-format')
-          SOURCE_TREE=$('git' '-C' "$ROOT" 'rev-parse' 'HEAD^{tree}')
-          '[' '-n' "$OBJECT_FORMAT" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input OBJECT_FORMAT read back empty, so the key would not name the build; refusing to key'; exit 1)
-          '[' '-n' "$SOURCE_TREE" ']' || ('echo' '::error title=release-bins AxisValueUnread::the key input SOURCE_TREE read back empty, so the key would not name the build; refusing to key'; exit 1)
-          SOURCE_CLOSURE='tree:'"$OBJECT_FORMAT"':'"$SOURCE_TREE"
-          'grep' '-qxF' 'source_closure='"$SOURCE_CLOSURE" "$RUNNER_TEMP"'/release-bins-download/release-bins.preimage' || ('echo' '::error title=release-bins ConsumerSourceTreeMismatch::the pack was keyed on a different source tree than this job'\''s checkout'; exit 1)
-          'printf' '%s' 'claim_executor
-          gunbc
-          build_diagnostics
-          claim_executor_checker_inputs
-          ' > "$RUNNER_TEMP"'/release-bins.roster'
-          'tar' '-tzf' "$RUNNER_TEMP"'/release-bins-download/release-bins.tgz' > "$RUNNER_TEMP"'/pack-listing.out'
-          'cmp' '-s' "$RUNNER_TEMP"'/pack-listing.out' "$RUNNER_TEMP"'/release-bins.roster' || ('echo' '::error title=release-bins PackListingNotRoster::the downloaded pack'\''s archive listing is not exactly the roster (an extra, duplicate, directory or escaping entry)'; exit 1)
-          'cut' '-c' '67-' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest' > "$RUNNER_TEMP"'/manifest-names.out'
-          'cmp' '-s' "$RUNNER_TEMP"'/manifest-names.out' "$RUNNER_TEMP"'/release-bins.roster' || ('echo' '::error title=release-bins ManifestRosterMismatch::the downloaded manifest does not name exactly the gunbc.ci_release_bins roster in order'; exit 1)
-          if 'grep' '-qvE' '^[0-9a-f]{64}  [A-Za-z0-9_]+$' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest'; then ('echo' '::error title=release-bins ManifestMalformed::the downloaded manifest has a line that is not one well-formed sha256 record for a roster member'; exit 1); fi
-          'rm' '-rf' "$RUNNER_TEMP"'/release-bins-check'
-          'mkdir' '-p' "$RUNNER_TEMP"'/release-bins-check'
-          'tar' '-xzf' "$RUNNER_TEMP"'/release-bins-download/release-bins.tgz' '-C' "$RUNNER_TEMP"'/release-bins-check' '--no-same-owner'
-          'printf' '%s' 'claim_executor:regular file:1
-          gunbc:regular file:1
-          ' > "$RUNNER_TEMP"'/member-types.expected'
-          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'stat' '-c' '%n:%F:%h' 'claim_executor' 'gunbc') > "$RUNNER_TEMP"'/member-types.out'
-          'cmp' '-s' "$RUNNER_TEMP"'/member-types.out' "$RUNNER_TEMP"'/member-types.expected' || ('diff' "$RUNNER_TEMP"'/member-types.expected' "$RUNNER_TEMP"'/member-types.out' || ':' 'no-op'; ('echo' '::error title=release-bins MemberNotRegularFile::the downloaded pack has a member that is not a self-contained regular file (a link, special file or hard-link dependency; the report above names it)'; exit 1))
-          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'find' 'claim_executor' 'gunbc' '-maxdepth' '0' '!' '-perm' '-u+x') > "$RUNNER_TEMP"'/member-nonexec.out'
-          '[' '!' '-s' "$RUNNER_TEMP"'/member-nonexec.out' ']' || ('cat' "$RUNNER_TEMP"'/member-nonexec.out'; ('echo' '::error title=release-bins MemberNotExecutable::the downloaded pack has a member that is not executable (listed above)'; exit 1))
-          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'sha256sum' '--strict' '--quiet' '-c' "$RUNNER_TEMP"'/release-bins-download/release-bins.manifest') || ('echo' '::error title=release-bins MemberDigestMismatch::the downloaded member bytes do not match the manifest under strict checking; refusing before any member is promoted or run'; exit 1)
-          'mkdir' '-p' "$ROOT"'/target/release'
-          ('cd' "$ROOT"'/target/release' && 'rm' '-f' 'claim_executor' 'gunbc')
-          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'cp' '-p' 'claim_executor' 'gunbc' "$ROOT"'/target/release/')
-          ('cd' "$RUNNER_TEMP"'/release-bins-check' && 'cp' '-p' 'claim_executor_checker_inputs' "$ROOT"'/target/release/')
-          'rm' '-rf' "$RUNNER_TEMP"'/release-bins-check'
-          "$ROOT"'/target/release/claim_executor' '--verify-build-artifacts' "$ROOT"'/target/release/claim_executor' "$ROOT"'/target/release/gunbc'
-        env:
-          RELEASE_BINS_KEY: ${{ needs.seed.outputs.release_bins_key }}
-        timeout-minutes: 5
-      - name: Require isolated toolchain homes
-        run: |
-          if [ -z "${CARGO_HOME:-}" ] || [ -z "${RUSTUP_HOME:-}" ]; then echo "::error::ToolchainHomesNotIsolated CARGO_HOME=${CARGO_HOME:-unset} RUSTUP_HOME=${RUSTUP_HOME:-unset} -- the isolation step did not run, so this job shares a toolchain with every other runner slot on this host and a concurrent install can replace a binary mid-run" >&2; exit 1; fi
-        if: "!cancelled()"
-      - name: Lint every target
-        id: lint_all_targets
-        run: |+
-          GUNBC_FLOOR_LOG='gunbc-floor-cmd.log'
-          'set' '+e'
-          'set' '-o' 'pipefail'
-          ('sh' '-e' '-c' 'cargo clippy --all-targets -- -D warnings') 2>&1 | 'tee' "$GUNBC_FLOOR_LOG"
-          GUNBC_FLOOR_EXIT="$?"
-          GUNBC_FLOOR_RECEIPT='gunbc-floor-outcome.txt'
-          GUNBC_FLOOR_CLASS='structural'
-          GUNBC_FLOOR_SIGNATURE=''
-          if '[' "$GUNBC_FLOOR_EXIT" '-eq' '126' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandInvokedCannotExecute'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '127' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandNotFound'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '0' ']'; then GUNBC_FLOOR_CLASS='none'; GUNBC_FLOOR_SIGNATURE=''; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'MemoryStallRefusedPageThrash' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='MemoryStallRefusedPageThrash'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'The runner has received a shutdown signal' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='RunnerLost'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: error: failed to execute compile' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFailedToExecuteCompile'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' '(exit status: 254)' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheRustcWrapperExit254'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: encountered fatal error' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFatalError'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'failed to spawn' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ProcessSpawnFailure'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'Resource temporarily unavailable' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ResourceTemporarilyUnavailable'; fi
-          if (! '[' '-f' "$GUNBC_FLOOR_RECEIPT" ']') || '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' || ('[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT"))) || ('[' "$GUNBC_FLOOR_CLASS" '=' 'none' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT")) && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=infra' "$GUNBC_FLOOR_RECEIPT"))); then 'printf' 'class=%s\nsignature=%s\nexit=%s\n' "$GUNBC_FLOOR_CLASS" "$GUNBC_FLOOR_SIGNATURE" "$GUNBC_FLOOR_EXIT" > "$GUNBC_FLOOR_RECEIPT"; if '[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']'; then 'echo' '::error title=environment::floor_class='"$GUNBC_FLOOR_CLASS"' signature='"$GUNBC_FLOOR_SIGNATURE"' exit='"$GUNBC_FLOOR_EXIT"'; this is not a verdict about the diff. Attempt receipt: '"$GUNBC_FLOOR_RECEIPT"; fi; if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']'; then 'echo' '::error title=subject::floor_class='"$GUNBC_FLOOR_CLASS"' exit='"$GUNBC_FLOOR_EXIT"'; read the step log for the subject defect'; fi; fi
-          'exit' "$GUNBC_FLOOR_EXIT"
-
-        if: "!cancelled()"
-      - name: "Stage0 mirrors match one emission by this seed: required CI build lane"
-        id: stage0_regen
-        run: |+
-          GUNBC_FLOOR_LOG='gunbc-floor-cmd.log'
-          'set' '+e'
-          'set' '-o' 'pipefail'
-          ('sh' '-e' '-c' 'ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          cd "$ROOT"
-          '\''target/release/claim_executor'\'' '\''--required-ci'\'' '\''--source-root'\'' '\''dag'\'' '\''--source-root'\'' '\''src/v2'\'' '\''--required-lane'\'' '\''build'\''
-          ') 2>&1 | 'tee' "$GUNBC_FLOOR_LOG"
-          GUNBC_FLOOR_EXIT="$?"
-          GUNBC_FLOOR_RECEIPT='gunbc-floor-outcome.txt'
-          GUNBC_FLOOR_CLASS='structural'
-          GUNBC_FLOOR_SIGNATURE=''
-          if '[' "$GUNBC_FLOOR_EXIT" '-eq' '126' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandInvokedCannotExecute'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '127' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandNotFound'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '0' ']'; then GUNBC_FLOOR_CLASS='none'; GUNBC_FLOOR_SIGNATURE=''; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'MemoryStallRefusedPageThrash' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='MemoryStallRefusedPageThrash'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'The runner has received a shutdown signal' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='RunnerLost'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: error: failed to execute compile' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFailedToExecuteCompile'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' '(exit status: 254)' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheRustcWrapperExit254'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: encountered fatal error' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFatalError'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'failed to spawn' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ProcessSpawnFailure'; fi
-          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'Resource temporarily unavailable' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ResourceTemporarilyUnavailable'; fi
-          if (! '[' '-f' "$GUNBC_FLOOR_RECEIPT" ']') || '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' || ('[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT"))) || ('[' "$GUNBC_FLOOR_CLASS" '=' 'none' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT")) && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=infra' "$GUNBC_FLOOR_RECEIPT"))); then 'printf' 'class=%s\nsignature=%s\nexit=%s\n' "$GUNBC_FLOOR_CLASS" "$GUNBC_FLOOR_SIGNATURE" "$GUNBC_FLOOR_EXIT" > "$GUNBC_FLOOR_RECEIPT"; if '[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']'; then 'echo' '::error title=environment::floor_class='"$GUNBC_FLOOR_CLASS"' signature='"$GUNBC_FLOOR_SIGNATURE"' exit='"$GUNBC_FLOOR_EXIT"'; this is not a verdict about the diff. Attempt receipt: '"$GUNBC_FLOOR_RECEIPT"; fi; if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']'; then 'echo' '::error title=subject::floor_class='"$GUNBC_FLOOR_CLASS"' exit='"$GUNBC_FLOOR_EXIT"'; read the step log for the subject defect'; fi; fi
-          'exit' "$GUNBC_FLOOR_EXIT"
-
-        if: "!cancelled() && steps.build_witness_fold.outcome == 'success'"
-      - name: "Registry-rostered generated artifacts (gunbc.generated_artifact): which drifted, run only after the build lane refused, to decide whether the repair applies"
-        id: generated_artifact_gate
-        run: |
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/instruments/generated_artifact_gate.dag --function main
-        if: "!cancelled() && github.event_name != 'merge_group' && steps.build_witness_fold.outcome == 'success' && steps.stage0_regen.outcome == 'failure'"
-      - name: Declare which ledger rows this repair covers
-        id: repair_declaration
-        run: |-
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/instruments/generated_artifact_gate.dag --function heal_repair_declaration
-        if: failure() && steps.generated_artifact_gate.outcome == 'failure' && github.actor != 'dependabot[bot]'
-      - name: Regenerate every registry-rostered generated artifact (not the stage0 mirrors), then verify the tree it wrote
-        id: repair_regen
-        run: |
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/instruments/generated_artifact_gate.dag --function main_wet_verified
-        if: failure() && steps.generated_artifact_gate.outcome == 'failure' && github.actor != 'dependabot[bot]' && steps.repair_declaration.outcome == 'success'
-      - name: Produce the sealed repair candidate
-        id: repair_candidate
-        run: |-
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/heal_candidate.dag --function heal_candidate_produce_wet
-        env:
-          HEAL_REPOSITORY: ${{ github.repository }}
-          HEAL_PULL_NUMBER: ${{ github.event.pull_request.number }}
-          HEAL_HEAD_REF: ${{ github.event.pull_request.head.ref }}
-          HEAL_BASE_REF: ${{ github.event.pull_request.base.ref }}
-          HEAL_RUN_ID: ${{ github.run_id }}
-        if: failure() && steps.generated_artifact_gate.outcome == 'failure' && github.actor != 'dependabot[bot]' && steps.repair_declaration.outcome == 'success' && steps.repair_regen.outcome == 'success'
-      - name: Upload the sealed repair candidate
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
-        with:
-          name: heal-repair-candidate
-          path: target/heal-repair-candidate
-          if-no-files-found: error
-          retention-days: 3
-        if: failure() && steps.generated_artifact_gate.outcome == 'failure' && github.actor != 'dependabot[bot]' && steps.repair_declaration.outcome == 'success' && steps.repair_regen.outcome == 'success' && steps.repair_candidate.outcome == 'success'
-    env:
-      MALLOC_ARENA_MAX: "2"
-  witnesses:
-    runs-on: [self-hosted, linux, arm64]
-    needs: [rust-unit-tests, seed, emit-build, floor, generated]
-    timeout-minutes: 5
-    if: always()
-    permissions:
-      contents: read
-    steps:
-      - name: Every required lane must have succeeded
-        run: |-
-          echo "required lanes: rust-unit-tests=$RUST_UNIT_TESTS seed=$SEED emit-build=$EMIT_BUILD floor=$FLOOR generated=$GENERATED (same_repo=$SAME_REPO)"
-          if [ "$RUST_UNIT_TESTS" = failure ] || [ "$SEED" = failure ] || [ "$EMIT_BUILD" = failure ] || [ "$FLOOR" = failure ] || [ "$GENERATED" = failure ]; then echo "::error::a required lane concluded failure (rust-unit-tests=$RUST_UNIT_TESTS seed=$SEED emit-build=$EMIT_BUILD floor=$FLOOR generated=$GENERATED) - open that job's log" >&2; exit 1; fi
-          if [ "$RUST_UNIT_TESTS" != success ]; then if [ "$GITHUB_EVENT_NAME" = pull_request ] && [ "$RUST_UNIT_TESTS" = skipped ]; then echo "::notice::the v1 unit-test lane does not run on pull_request: it runs on merge_group and workflow_dispatch on the fleet"; else echo "::error::the v1 unit-test lane produced no success (rust-unit-tests=$RUST_UNIT_TESTS), so this head carries no verdict from that lane"; exit 1; fi; fi
-          if [ "$SEED" != success ]; then if [ "$SAME_REPO" = false ] && [ "$SEED" = skipped ]; then echo "::notice::the seed lane is skipped for a fork pull request: no compiler pair was built or restored for this head"; else echo "::error::the seed lane produced no success (seed=$SEED), so this head carries no verdict from that lane"; exit 1; fi; fi
-          if [ "$EMIT_BUILD" != success ]; then if [ "$SAME_REPO" = false ] && [ "$EMIT_BUILD" = skipped ]; then echo "::notice::the emit-build lane is skipped for a fork pull request: no self-host or native-CLI emission verdict for this head"; else echo "::error::the emit-build lane produced no success (emit-build=$EMIT_BUILD), so this head carries no verdict from that lane"; exit 1; fi; fi
-          if [ "$FLOOR" != success ]; then if [ "$SAME_REPO" = false ] && [ "$FLOOR" = skipped ]; then echo "::notice::the fleet lane is skipped for a fork pull request: no witnesses fold and no generated-artifact verdict for this head"; else echo "::error::the fleet lane produced no success (floor=$FLOOR), so this head carries no verdict from that lane"; exit 1; fi; fi
-          if [ "$GENERATED" != success ]; then if [ "$SAME_REPO" = false ] && [ "$GENERATED" = skipped ]; then echo "::notice::the generated-artifact lane is skipped for a fork pull request: no generated-artifact verdict for this head"; else echo "::error::the generated-artifact lane produced no success (generated=$GENERATED), so this head carries no verdict from that lane"; exit 1; fi; fi
-        env:
-          RUST_UNIT_TESTS: ${{ needs['rust-unit-tests'].result }}
-          SEED: ${{ needs.seed.result }}
-          EMIT_BUILD: ${{ needs['emit-build'].result }}
-          FLOOR: ${{ needs.floor.result }}
-          GENERATED: ${{ needs.generated.result }}
-          SAME_REPO: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
diff --git a/.gitignore b/.gitignore
index fd14ca42bc2..3f7654a2b5e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -77,12 +77,12 @@ __pycache__/
 # regenerable from committed source — symlink to target/release created by codegen
 /bin/
 
-# --- Derived failure-mode roster [owner: gunbc.recurring_failure_mode] ---
-# regenerable from committed source — membership list derived from sibling row files before compile; not a second authored authority
+# --- Retired failure-mode roster file [owner: gunbc.recurring_failure_mode] ---
+# superseded; canonical home: the in-memory roster module contributed by source acquisition (v1_compiler.cli_run.derived_row_roster acquire_dir_files); a file at this path is a legacy artifact of an older gunbc and is refused by the loader — legacy file an older gunbc wrote on every source walk; the roster module is now derived in memory and never written
 /dag/gunbc/recurring_failure_mode/roster.dag
 
-# --- Derived rung-drop roster [owner: gunbc.rung_drop] ---
-# regenerable from committed source — membership list derived from sibling RungDrop row files before compile; not a second authored authority
+# --- Retired rung-drop roster file [owner: gunbc.rung_drop] ---
+# superseded; canonical home: the in-memory roster module contributed by source acquisition (v1_compiler.cli_run.derived_row_roster acquire_dir_files); a file at this path is a legacy artifact of an older gunbc and is refused by the loader — legacy file an older gunbc wrote on every source walk; the roster module is now derived in memory and never written
 /dag/gunbc/rung_drop/roster.dag
 
 # --- Generator stamp files [owner: gunbc.generated_artifact] ---
diff --git a/DESIGN.md b/DESIGN.md
index a8d5389b735..5e7f84ba7a4 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -67,7 +67,7 @@ THE RULE IS ABOUT LAYERS, AND COST IS ONLY ITS SYMPTOM. A claim reaches too far
 
 When two structures answer the same semantic question and one is intended to disappear, the change is a **replacement migration**, not a refinement. §2 prices an intermediate representation destined to be discarded as redundant work, and §3 forbids X and Y both answering for one fact. Editing X from its leaves upward preserves its root while every intermediate state becomes observable and load-bearing, so the migration creates more authority before it removes any. The deeper cost is that a surviving X is an **attractor**: while it stands, every nearby question is answered in its vocabulary, so decisions keep being premised on an assumption already scheduled for death — and A3 grounds agreement only on what stays stable across time, which a dead assumption by definition does not.
 
-So the default is **delete-first**: uproot the root as early as you can, then fix forward minimally with the new solution, solving each surfaced problem from first principles rather than restoring it to its old binding. In a fail-closed substrate **the deletion is the census — but only over the population a run compiles**. Every real dependent refuses loudly, so what breaks is exactly what was load-bearing. Outside the required gate (`v2.workflow.required_floor required_gate_prefixes`) the substrate still refuses and nothing asks it to: a product-layer dependent can stop resolving, stay broken, and let every required lane report SUCCESS — so **for a root outside the gate, enumerate the consumers by name before you delete**. What cannot break loudly is covered by a declared, bounded §4b rung-drop, never by silence. Two carve-outs: a gap-intolerant boundary keeps the staged form — Y built in shadow, then one transition that switches the root and deletes X together — and where no Y can hold the boundary at all, X stays but stays **frozen**: no new investment, no new rows on its growth surfaces.
+So the default is **delete-first**: uproot the root as early as you can, then fix forward minimally with the new solution, solving each surfaced problem from first principles rather than restoring it to its old binding. In a fail-closed substrate **the deletion is the census — but only over the population a run compiles**. Every real dependent refuses loudly, so what breaks is exactly what was load-bearing. Outside the required gate (`gunbc.emitted_subject_build_gate emitted_subject_build_rows`: since the 2026-10-09 ruling the one required lane compiles only the import closures of the entries those rows emit, so nearly every root is outside it) the substrate still refuses and nothing asks it to: a product-layer dependent can stop resolving, stay broken, and let every required lane report SUCCESS — so **for a root outside the gate, enumerate the consumers by name before you delete**. What cannot break loudly is covered by a declared, bounded §4b rung-drop, never by silence. Two carve-outs: a gap-intolerant boundary keeps the staged form — Y built in shadow, then one transition that switches the root and deletes X together — and where no Y can hold the boundary at all, X stays but stays **frozen**: no new investment, no new rows on its growth surfaces.
 
 **"Atomic" describes the authority transition, not the amount of implementation work.** Y has one coherent root, ordinary production never accumulates consumers that understand both representations, and X's authority ends in one motion. Y may freely reuse stable primitives, and X may serve from history as an offline differential oracle — but Y never falls back to X, resolves through it, or derives its answer from it. And the minimum Y is not the smallest thing that executes the happy path: it must preserve every required refusal, or it has erased a correctness distinction rather than completed the replacement.
 
@@ -99,7 +99,7 @@ The domain roster is a modeled fact, not this prose: `gunbc.design_argument` `co
 
 - **external facts** — each independently versioned upstream has its own module; this is the strongest instance and was, until this section, the only one with a reviewer. Home authorities: `extdeps.external_authority::ExternalModelScope`.
 - **materialization / realization** — materialization and realization are separate interfaces with admissible handlers: materialization presents and stores an admitted identity and result contract; realization orders, places and transports work. This row owns whether a handler, provider or placement faithfully realizes that admitted identity and result contract (completeness, readback, retention, transport, refusal, binding obligations) without substituting, truncating or bypassing the admitted key. Cache purity is one discriminator across that boundary, not the whole domain. Key RELATION -- what relation, what scope, what complete canonical preimage, equality and collision disposition, and whether declared inputs are complete -- is owned by conformance-identity. Home authorities: `std.realization::Materialization`, `std.materialization_provider::ArtifactRequest`, `std.artifact_store::ArtifactStore`, `std.cache_interface::StorageSurface`.
-- **leasing / locking / grants / privileged access** — exclusive or bounded use and privileged access are one domain: leases with a declared deadline, compare-and-set expectations, scoped authorizations, grants naming who may perform an effect and how it is released, resource handles -- and, since 2026-09-19, which AUTHORIZATION PATTERN performs a privileged effect. That pattern is a §3d selection (gunbc.auth.authorization_pattern_selection consumes std.decision over the effect's frequency, reversibility, surface, workload-identity binding, minted reach and billing consequence): workload identity federation with a per-secret cell for recurring automated effects, one operator approval through the ntfy loop for one-off or witnessed effects, a named human-only step where no API exists, and a refusal for an operator token relayed by chat or between sessions. The census (gunbc.auth.privileged_effect_census) classifies every current site by executing that selection, so the reviewer's three-valued answer is derived for the sites that exist and asked of the site a change adds. A compare-and-set slot's generation line is kept whole by file_compare_and_set and observe_cas_slot_state (gunbc.durable_cas_file_store), because several slots read it as an audit trail; a slot whose only fact is its head -- the materialization store's occupancy index and family holds are the first -- uses the distinct windowed operations (file_compare_and_set_windowed, observe_cas_slot_state_windowed, and the file_hold_*_windowed family) with a CasGenerationWindow of k >= 2, so a bounded store's own bookkeeping does not grow with its commits. They are two contracts, not one operation with a mode: keep-all callers are untouched, and only a caller that names the windowed operation can delete generations. A window read takes the head from a listing of the slot root and verifies head+1 is absent, re-reading on a race and never guessing; a write reclaims below head-k only after its own commit, and a refused delete is reported, never fatal. Exclusion is unchanged -- losers re-read and retry -- so nothing waits on a hold. docs/plans/fabric-storage.md names the head-probe bound this also lifts and assigns its remedy to compaction -- a head that starts from a snapshot; a window is that head-starting-above-1 shape for a slot whose history needs no snapshot, and the fabric heads are not opted in. Home authorities: `std.temporal_effect::HeldLease`, `std.durable_compare_and_set::CasExpectation`, `gunbc.durable_cas_file_store::file_compare_and_set_windowed`, `std.durable_exclusive_hold::DurableHoldState`, `std.scoped_authorization::ScopedAuthorization`, `std.effect_grant::Grant`, `std.resources::ResourceHandle`, `gunbc.auth.authorization_pattern_selection::select_authorization_pattern`, `gunbc.auth.github_gcp_federation::github_wif_provider`, `gunbc.auth.gcp_secret_access::SecretAccessGrant`, `gunbc.auth.access_request::AccessRequest`, `gunbc.auth.approval_capability::ApprovalCapability`, `gunbc.auth.approval_broker::redeem_capability`, `gunbc.auth.access_token_source::select_access_token_source`, `gunbc.auth.privileged_effect_census::privileged_effect_census`.
+- **leasing / locking / grants / privileged access** — exclusive or bounded use and privileged access are one domain: leases with a declared deadline, compare-and-set expectations, scoped authorizations, grants naming who may perform an effect and how it is released, resource handles -- and, since 2026-09-19, which AUTHORIZATION PATTERN performs a privileged effect. That pattern is a §3d selection (gunbc.auth.authorization_pattern_selection consumes std.decision over the effect's frequency, reversibility, surface, workload-identity binding, minted reach and billing consequence): workload identity federation with a per-secret cell for recurring automated effects, one operator approval through the ntfy loop for one-off or witnessed effects, and a named human-only step where no API exists. The census (gunbc.auth.privileged_effect_census) classifies every current site by executing that selection, so the reviewer's three-valued answer is derived for the sites that exist and asked of the site a change adds. A compare-and-set slot's generation line is kept whole by file_compare_and_set and observe_cas_slot_state (gunbc.durable_cas_file_store), because several slots read it as an audit trail; a slot whose only fact is its head -- the materialization store's occupancy index and family holds are the first -- uses the distinct windowed operations (file_compare_and_set_windowed, observe_cas_slot_state_windowed, and the file_hold_*_windowed family) with a CasGenerationWindow of k >= 2, so a bounded store's own bookkeeping does not grow with its commits. They are two contracts, not one operation with a mode: keep-all callers are untouched, and only a caller that names the windowed operation can delete generations. A window read takes the head from a listing of the slot root and verifies head+1 is absent, re-reading on a race and never guessing; a write reclaims below head-k only after its own commit, and a refused delete is reported, never fatal. Exclusion is unchanged -- losers re-read and retry -- so nothing waits on a hold. docs/plans/fabric-storage.md names the head-probe bound this also lifts and assigns its remedy to compaction -- a head that starts from a snapshot; a window is that head-starting-above-1 shape for a slot whose history needs no snapshot, and the fabric heads are not opted in. Home authorities: `std.temporal_effect::HeldLease`, `std.durable_compare_and_set::CasExpectation`, `gunbc.durable_cas_file_store::file_compare_and_set_windowed`, `std.durable_exclusive_hold::DurableHoldState`, `std.scoped_authorization::ScopedAuthorization`, `std.effect_grant::Grant`, `std.resources::ResourceHandle`, `gunbc.auth.authorization_pattern_selection::select_authorization_pattern`, `gunbc.auth.github_gcp_federation::github_wif_provider`, `gunbc.auth.gcp_secret_access::SecretAccessGrant`, `gunbc.auth.access_request::AccessRequest`, `gunbc.auth.approval_capability::ApprovalCapability`, `gunbc.auth.approval_broker::redeem_capability`, `gunbc.auth.access_token_source::select_access_token_source`, `gunbc.auth.privileged_effect_census::privileged_effect_census`.
 - **fabric / compute** — allocation, placement and negotiation of resources. The shared authority is product.capacity (lease, pool, seat events) and product.fabric (priced selection over a provider parameter); the subjects that consume it are compute cells (work contracts, compute layouts, cell reservations, capacity class admission) and inference serving (seat binding, co-tenancy admission). Serving is INSIDE this domain, not beside it -- but the sharing is partial and the boundary is the point: both subjects reach the same priced selection fold, and each carries its OWN occupancy producer and linearization (serving: a termed LeaseGrant settled by fabric_seat_acquire over an event chain; compute: a timeless LeaseIdentity settled by file_compare_and_set). They differ further in what the lease is over -- a compute cell is stateless between grants and settles money, a serving seat is over a replica with loaded state and is quality-conditioned instead. The argument is [the serving capacity home ruling](docs/plans/serving-capacity-home-ruling.md). Home authorities: `product.fabric.selection::select_supply`, `product.capacity.lease::LeaseGrant`, `product.capacity.pool_events::SeatRequest`, `product.fabric.work::ExecutionRequirements`, `gunbc.fabric_event_log::fabric_seat_acquire`, `gunbc.compute.work_request::WorkOperation`, `gunbc.compute.work_provider_local::ComputeLayout`, `gunbc.fabric_control_plane::CellReservation`, `gunbc.fabric_executor_class::CapacityClassAdmission`, `gunbc.harness.harness_seat::harness_bind_seat`, `gunbc.serving.turn_admission::serving_group_admission`.
 - **decision / selection** — a choice must remain attributable to its subject, candidate field, constraints, evidence and policy, and conformance exposes accidental forks of that authority; the hard selection laws -- no answer outrunning its evidence, no front standing as a winner -- stay with the §3d reviewer, and goal assessment (std.goal_assessment) is a boundary of this row, not a member of it. Home authorities: `std.decision::DecisionSubject`, `std.decision::RealizationSelectionResult`, `std.decision::SelectionReceipt`, `std.decision::select_realization`, `std.pareto::SelectionAxis`, `std.pareto::ParetoEntry`, `std.pareto::DominanceVerdict`.
 - **keys / hashing** — the row's scope today is the three keying relations that have a consumed home: structural node identity (v2.std.node content_hash over std.content_hash HashFamily), the request and artifact keys of std.materialization_provider (request_key, artifact_request_key), and occurrence identity within one source graph (std.occurrence_identity) -- plus the declared-equality admissibility of a key TYPE (std.algebra algebra_profile_equality_extensional), which governs whether distinct keys of a finite map are decidably distinct (consumed by the map-literal duplicate-key check, docs/plans/map-literal-introduction-design.md). That admissibility is instantiation-blind at this rung: an opaque brand or a type parameter admits unjudged, and its next-rung trigger is instantiation-grain admission (v1 infer equality_admission_wall_note). This row owns the key RELATION -- what relation, what scope, what complete canonical preimage derives it, what equality and collision disposition govern it -- and whether the declared inputs are complete. Faithful realization of an admitted identity and result contract (completeness, readback, retention, transport, refusal, binding; cache purity as one discriminator) is owned by conformance-realization. Two further relations -- demand identity (the question asked) and the dependency read set an answer consumed -- are a declared frontier, not members: they have no home authority yet, are modeled by docs/plans/demand-engine-program.md, and enter this row when M1 of that program lands their carriers; until then a reviewer asks nothing about them under this row (DESIGN §3b: a home that owns only part of a claimed scope is a scope mismatch, so the scope is stated at what the homes own). Each member is a named keying relation within a named scope, derived rather than authored; the relation model is docs/plans/keying-relation-design.md. Home authorities: `std.content_hash::HashFamily`, `std.materialization_provider::request_key`, `v2.std.node::content_hash`, `std.occurrence_identity::OccurrenceIdAllocator`, `extdeps.realization.cache_purity::CachePurityVerdict`, `std.computation_identity::ComputationIdentity`, `std.algebra::algebra_profile_equality_extensional`.
@@ -261,9 +261,9 @@ One row per class, each carrying its recognition rule and its receipts, as a fil
 
 **This section assumes you already have a built `gunbc`, and nothing here tells you how to get one — so it is not the first page for a reader who has just cloned.** That reader wants [docs/onboarding.md](docs/onboarding.md): the ordered path from a bare clone to one landed reviewed change, with every command derived from the authority that owns it (`gunbc.contributor_onboarding_path`), the obstacles attached to the step each one breaks, and a reading order for THIS document saying what is needed before a first build, what is needed before a first commit, and what can wait. That page is a projection of a path that was walked, not a substitute for it: the exit it serves is measured by an outcome, so a step there that does not work is a defect worth reporting as one.
 
-- Three local checks, each named with the CI step that executes it — a check named here with no executing step is a decoration (§4b): `cargo clippy --all-targets -- -D warnings` (`gunbc.repo_self_build` `repo_self_clippy_command`, the only command that compiles the integration-test and example targets, so a red there is invisible to every other step) runs as the lint step of the `generated` job of `gunbc.compiler_gate_workflow` (`compiler_gate_lint_step`, operator ruling 2026-09-28: no lane the required context reads runs on a hosted runner), which runs on every pull request and on every merge_group (the queue's composed revision) and IS a required lane read by the `witnesses` aggregate — so a clippy red blocks a merge; `cargo fmt --all --check` runs in the generated pre-commit hook (`gunbc.githooks_pre_commit_emit`). `cargo test --release -p v1-compiler --lib` (`repo_self_test_command`) runs as the `rust_unit_tests` step of the fleet `rust-unit-tests` job (`gunbc.compiler_gate_workflow` `compiler_gate_unit_test_step`), a REQUIRED lane read by the `witnesses` aggregate that runs on merge_group and workflow_dispatch only, not pull_request (declared drop `gunbc.rung_drop` `rust_unit_tests_off_pull_requests`, operator 2026-10-06; the aggregate excuses its skip only on a pull_request event) — so a unit-test red blocks a merge at the queue. (From 2026-10-05 it reported without blocking under the declared drop `gunbc.rung_drop` `rust_unit_tests_over_their_cap`, because it overran its step cap on every head; it blocks again, and that drop is superseded (not retired by its trigger): the owner ruling carried by gunbc#13452 deleted the slow tests, and that loss is the declared drop `gunbc.rung_drop` `v1_integration_tests_deleted_from_the_unit_lane`.) It returned on 2026-09-30 as the blocking fleet lane the 2026-09-29 ruling (which deleted the non-blocking hosted measurement) named, bound by its runner slot's own MemoryMax so the regeneration-host tests read a real budget, and it retired the declared drop `gunbc.rung_drop` `rust_unit_tests_off_the_merge_path`. `cargo test --workspace` is local only: the test targets are compiled by the lint step and run by nobody.
-- one-time per clone: `git config core.hooksPath .githooks` — the only documented manual seed; generated pre-commit/pre-push hooks then idempotently converge `merge.generated-artifact.driver` and re-assert `core.hooksPath` via argv derived from `gunbc.repo_local_git_config` (clones that skip hooksPath degrade to vanilla text-merge for generated-artifact paths; drift gate still guards at CI). The driver REFUSES rather than answering `true`: git reaches a low-level merge driver only when both sides changed the path since the merge base — measured on a four-case matrix, one-sided and identical changes never reach it — and taking the ours side there dropped the other side's authority-derived bytes with no conflict, twice on #7836 against the stage0 seed. It now leaves the ours side in the worktree with no conflict markers, marks the path unmerged, and prints the regeneration recipe; the class is mechanically preventable, not structural, and its next-rung trigger is the commit-writer binding rows in `gunbc.commit_workflow`
+- Local checks, each named with what executes it — a check named here with no executing step is a decoration (§4b), and since the 2026-10-09 ruling (the v1 withdrawal, stated under **CI** below) two of the three have none. `cargo fmt --all --check` runs in the generated pre-commit hook (`gunbc.githooks_pre_commit_emit`). `cargo clippy --all-targets -- -D warnings` (`gunbc.repo_self_build` `repo_self_clippy_command`, the only command that compiles the integration-test and example targets) and `cargo test --release -p v1-compiler --lib` (`repo_self_test_command`) are LOCAL ONLY: the `generated` and `rust-unit-tests` lanes that ran them were deleted with the other v1 lanes, so a lint red or a v1 unit-test red blocks nothing. That loss is part of the declared drop `gunbc.rung_drop` `v1_required_lanes_withdrawn`. `cargo test --workspace` is local only, as it was: the test targets are compiled by nothing on the merge path and run by nobody.
+- one-time per clone: `git config core.hooksPath .githooks` — the only documented manual seed; generated pre-commit/pre-push hooks then idempotently converge `merge.generated-artifact.driver` and re-assert `core.hooksPath` via argv derived from `gunbc.repo_local_git_config` (clones that skip hooksPath degrade to vanilla text-merge for generated-artifact paths, and since the 2026-10-09 ruling no CI step compares a generated artifact with its authority: `gunbc.rung_drop` `v1_required_lanes_withdrawn`). The driver REFUSES rather than answering `true`: git reaches a low-level merge driver only when both sides changed the path since the merge base — measured on a four-case matrix, one-sided and identical changes never reach it — and taking the ours side there dropped the other side's authority-derived bytes with no conflict, twice on #7836 against the stage0 seed. It now leaves the ours side in the worktree with no conflict markers, marks the path unmerged, and prints the regeneration recipe; the class is mechanically preventable, not structural, and its next-rung trigger is the commit-writer binding rows in `gunbc.commit_workflow`
 - **`gunbc test <label>` is the dedicated CLI for invoking a v2 measurement, and a new one is a row rather than a flag** (operator ruling, 2026-09-16). The seam is `gunbc.target_binding` `TargetProducer` bound to a `gunbc.instrument_targets` label, and the host note says the extension shape outright: *adding one is a row in `instrument_registry` and an arm here; it is not a new route*. What that buys is not tidiness: the label carries its own refusal vocabulary, so an unknown or pattern label REFUSES with exit 2 rather than reporting a pass, and the three terminations stay distinct — 0 held, 1 an observation that did not hold, 2 no observation — which is the conflation §5 forbids, closed by construction for every instrument at once. The subject is the instrument's own fact and never a CLI option, so an invocation cannot quietly measure a different corpus while reporting the same target's standing. **What this rules out is the alternative that keeps suggesting itself:** a flag on `claim_executor`, whose ~20 flags are hand-parsed in a 2783-line `main` over 44,451 lines of `cli_run.rs` with NO `.dag` authority at all — v2 work that lands there is unmodeled by construction, and `--self-host` was withdrawn in the same change that added `//gunbc/instruments:self-host` rather than left standing beside it, because two routes to one fact is the §3 fork. `gunbc`'s own surface is modeled (`gunbc.cli_dispatch_surface` → `gunbc_cli_dispatch_generated.rs`); `claim_executor`'s is not, and the gap is the point.
 - **Two CLIs, and which one a session wants is decided by which compiler is running.** `gunbc` is the SEED's CLI — `std.compiler_entry` `RetainedHostCliKernel`, a clap surface dispatching into hand-authored host Rust (`v1_compiler.cli_run`) — so its verbs are unreachable from a self-emitted binary BY CONSTRUCTION, not by omission: an emitted crate does not contain that module. The v2-exclusive door is `v2.cli.compile_cli`, `.dag` in `src/v2/cli/`, declaring the fourth driver `std.compiler_entry` `NativeCliDriver`. It parses argv, decides the verb, decides every refusal, decides what to emit and decides the process exit (`std.process` `ProcessExit`); its rendered main performs only the four operations no `.dag` fold can — read argv, walk and read the source roots the PLAN named, write stdout, set the status — and hands each back as a VALUE. **That boundary is measured, not chosen for taste:** a resource method on an ordinary `fn` is a located compiler refusal (`Filesystem.Read` off a plain function refuses with *receiver type 'Primitive(Filesystem)' establishes no method surface*), because a resource METHOD is admitted only where the function declares that resource through its `uses` clause — an effect requirement, never a function kind; the authored clause is the SEED's spelling of that requirement, and for a transparent body operator D13 (`gunbc.plans.demand_engine_program`: dependency demand "is DERIVED from resolved dependency and operation references, not authored in the header") rules it derived by resolution. That derivation does not yet name a Network requirement (`gunbc.rung_drop` `network_requirement_unrepresented_after_uses_cut`), so until D13's resource-keyed DependencyDemand carrier exists the authored clause remains the only carrier of a Network requirement; v2 builds no second carrier for the row and refuses it at the clause (`gunbc.recurring_failure_mode` `uses_clause_has_no_carrier`): `workflow` was never a semantic kind, only the emitter predicate `v1.compiler.emit_rust` `is_workflow_item`, and gunbc#11528 DELETED it. The native door now acquires sources through `gunbc.source_root_read`, bound at the entry to the existing `extdeps.filesystem.filesystem_io` handler emitted by `v1.compiler.emit_rust` `emit_file_call`. `FilesystemExactRead` carries read refusal, and `Filesystem.List` supplies the existing listing plus its host-classified error kind: only NotADirectory admits a walked child as a file, while missing, unreadable and incomplete listings refuse. The effectful traversal uses the emitter's shared tail-call loop lowering. `v2_cli_main` owns parse, acquisition and compilation; its rendered main binds the handler, supplies argv and realizes output and status. The eval driver also delegates filesystem acquisition to that fold. This discharges the FILESYSTEM portion of `gunbc.source_root_eval_driver_seed_growth`, not its remaining orchestration and host-fact obligations. The legacy content-only free `filesystem_read` primitive still panics on failure and is not used by this door; it is not evidence of typed refusal. **Why a second entry module rather than a mode on the first:** one emitted crate has one entry point and the emitter admits exactly one `compiler_pipeline_entry` declaration per closure (`compiler_pipeline_entry_is_ambiguous` refuses two by name), and the CLI's closure reaches no part of `v2.compiler.compile`, so exactly-one holds by construction rather than by a flag choosing between them. The two generations are two instrument rows: `gunbc test //gunbc/instruments:self-host` is the seed emitting and building `v2.compiler.compile`, and `gunbc test //gunbc/instruments:v2-native-cli` is the seed emitting and building the CLI closure — two labels because they are two compilations, so a regression in either is reported under a name that says which. Neither is the second generation; that is the BUILT CLI emitting a closure, and it needs this door to exist first.
 - explicit actuator (CI / tooling): `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/repo/repo_local_git_config.dag --function converge`
-- **CI** is one emission, `gunbc.compiler_gate_workflow` → `.github/workflows/witnesses.yml`, invoking our own binary once per LANE: `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane witnesses` in the `floor` job on every pull request and merge_group, and the same with `--required-lane build` (the stage0 mirrors' generated-artifact phase: the committed mirrors equal one emission by the seed built from them -- one generation since operator ruling 2026-10-04 waived v1 determinism) on every pull request and merge_group (operator ruling 2026-09-28, superseding the 2026-09-23 queue-only placement: a pull request that failed it still entered the queue and failed every group stacked on it) in the `generated` job, which runs BESIDE the floor rather than after it and carries the lint, and on pull requests the registry drift discriminator and its repair (operator ruling 2026-09-27, `gunbc.compiler_gate_workflow` `compiler_gate_generated_job`), plus an aggregating job that carries the required context and reads every lane result — that last is what makes a lane block rather than merely be waited on, so read the emitting authority for the current membership rather than this sentence. **The job roster is closed to growth: adding a job needs operator sign-off, because a job is a standing claim on a paid runner on every pull request and on every queued landing** — the 2026-09-04 ruling cut three of seven on that basis (`rust-unit-tests`, `fabric-evidence`, `emit-copy-qualification-battery`), the 2026-09-27 ruling added `generated` so a run waits for its longest lane instead of their sum, the 2026-09-28 ruling put every lane the required context reads, and the aggregate, on the fleet (deleting the hosted `compiler` job, whose build the fleet lanes already run, and folding the lint into `generated`), and the reasoning an author owes before proposing a lane is stated at `witness_floor_lane_jobs`. The push-on-main trigger was CUT on 2026-09-15 under the same reasoning applied to an event rather than a job: with the merge queue enabled, the required run on the queue's composed revision proves the sha that lands, so the push run re-ran a proof that already existed — one required run per landing, not two. Which phases a lane owns is decided in the binary, never in the YAML — the partition is an exhaustive match, so a phase belonging to no job fails to compile. **Read the roster from the run's own announcement, not from here:** every required run prints one `phase <name>` line per phase it owns and one `ROUTED to lane <other>` line per phase it does not. Several capabilities that used to gate are currently declared rung drops — see §4b.
+- **CI** is one emission, `gunbc.compiler_gate_workflow` → `.github/workflows/witnesses.yml`, and since the operator ruling of 2026-10-09 (the v1 withdrawal: v1 is no longer a validation authority, and the one use left to the seed is emitting v2) the required context is ONE job, `witnesses` — the id the ruleset requires, so the job's own check is the context and no aggregate reads it. It runs on the fleet on every pull request and merge_group: it builds the seed, then runs one `gunbc test <label>` step per row of `gunbc.emitted_subject_build_gate` `emitted_subject_build_rows` — today `//gunbc/instruments:self-host` and `//gunbc/instruments:v2-native-cli` — in which the seed emits a v2 closure, cargo builds the emitted crate FRESH (every subject step passes `native_product_reuse_env_name`=`fresh`, under which the runner consults no native product store and refuses one if bound; cargo's own dependency reuse remains), and the built binary is started against its controls. A fork pull request carries no `witnesses` check at all (the job is fleet-guarded), so it is unobserved rather than excused. **The memory envelope is part of the verdict** (operator ruling 2026-10-09): the fleet slot is a fixed hard maximum with no swap (`gunbc.runner_slot_desired`: MemoryMax 22 GiB, MemorySwapMax 0); each subject step REQUIRES that envelope (`gunbc.emitted_subject_build_gate` `native_step_memory_envelope_env_name`): `gunbc test` refuses a run no cgroup `memory.max` binds, reads the bounding cgroup before the producer, and at exit prints a MEMORY RECEIPT (the OOM kills and high/max events the step added, swap charged, the peak) and refuses the run on any OOM kill or any swap, whatever the producer answered; the lower per-step trip (`native_step_memory_trip`, the slot's MemoryHigh less a declared headroom, bound as the step's own cgroup through `native_step_memory_bind_env_name`) is modeled and waits on a fleet fact, `gunbc.runner_slot_desired` `gunbc_runner_slot_job_cgroup_ownership` — a fleet job runs deprivileged under a root unit and cannot create a bounded leaf, so the bind input is withheld; the climb is rostered as `gunbc.guarantee_stall` `native_step_trip_awaits_fleet_job_cgroup_stall`, and flipping the fact when the fleet earns it returns the bind to every subject step with no other edit; the decision and verdict are `gunbc.memory_envelope`, a fold over supplied inputs that the seed mirrors; there is no larger runner and no retry. The heal publisher (`heal-publish.yml`) was deleted with the lanes: nothing seals a repair candidate for it to publish. **What a green required context does NOT say, because the lanes that said it are deleted:** `floor` (the v1 interpreter folding the rostered witnesses), `generated` (the stage0 mirrors, the registry drift discriminator with its repair, and the lint), `rust-unit-tests` and `seed` are gone. Nothing on the required path evaluates a witness, refuses on a module outside the two emitted closures, or compares a generated artifact with its authority — this document and `witnesses.yml` included. That loss is ONE declared drop, `gunbc.rung_drop` `v1_required_lanes_withdrawn`: its module population is re-derived by `gunbc test //gunbc/instruments:required-lane-resolution-census`, and its trigger is the native compiler judging that population, never the return of those lanes. The contract epoch (`gunbc.required_ci_contract_epoch`) moved with the cut, because the name `witnesses` now carries a different contract. **A verdict joins this gate as a row judged by a binary built from the seed's emission**, never as a lane that hands the corpus to the v1 interpreter; `emitted_subject_build_rows` stays the two compiler products, and the native obligation is a SEPARATE population — executed by one built `SourceRootEvalDriver`, a monotone green set plus exactly one observed frontier — whose members are eligible only once their adjudication is native (operator ruling 2026-10-09). **The job roster is closed to growth: adding a job needs operator sign-off, because a job is a standing claim on a paid runner on every pull request and on every queued landing**; the reasoning an author owes before proposing a lane is stated at `witness_floor_lane_jobs`. The push-on-main trigger was CUT on 2026-09-15 under the same reasoning applied to an event rather than a job: with the merge queue enabled, the required run on the queue's composed revision proves the sha that lands — one required run per landing, not two.
diff --git a/ROADMAP.md b/ROADMAP.md
index 96317e7e066..17af24b329d 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -68,7 +68,7 @@ Every node declares its parent in the functional decomposition: gunbc-project-ro
 - [ ] **DP-M3: extdeps-scope closure halved** — The legacy extdeps scope manifest (dag/gunbc/legacy_extdeps_scope_frontier.tsv via gunbc.extdeps_scope_frontier) halved, and tools.extdeps_scope_placement_gate enrolled on an executing route before anything is counted. The unimported-bare-provider roster the census pairs with this is not on this line (v2.workflow.floor_unimported_bare_provider_debt_roster exists on main only). Why: An undeclared external-authority placement is a §3 citation nobody can check. [authority](dag/gunbc/extdeps_scope_frontier.dag)
 - [ ] **DP-M4: closed matches are total** — gunbc.non_fold_residue non_fold_residue_frontier (about 186 rows on this tree) down to at most 100, draining the nfr_reason_mint_era rows first (82). The six seed-Rust wildcard sites are out of scope. Why: A wildcard arm silently absorbs a new variant, which is the floor-level exhaustiveness guarantee missing. [authority](dag/gunbc/non_fold_residue.dag)
 - [ ] **DP-M5: absence is established, never inferred** — extdeps.filesystem.filesystem_io filesystem_absence_establishment_adoption_standing driven to zero open sites (each routed through filesystem_file_observation / filesystem_entry_presence), and filesystem_read_outcome_adoption_standing re-measured at identity grain. Why: Each unconverted site can report "nothing there" when it could not look. [authority](dag/extdeps/filesystem/filesystem_io.dag)
-- [ ] **DP-M6: v2 native-route walls restored** — The native-route rung drops retired and the eval-step drop family shrunk. The three drops the census names (g0_type_decl_modifier_parse_without_sealing_property, variant_fields_unlowered_on_the_native_route, admit_callers_discarded_on_the_native_route) exist on main and not on this line, so this milestone's population is re-derived from gunbc.rung_drop once the line carries them. Why: Each standing drop is a known wall down on the path v2 is meant to run on. [authority](dag/gunbc/rung_drop.dag)
+- [ ] **DP-M6: v2 native-route walls restored** — The native-route rung drops retired and the eval-step drop family shrunk. The three drops the census names (g0_type_decl_modifier_parse_without_sealing_property, variant_fields_unlowered_on_the_native_route, admit_callers_discarded_on_the_native_route) existed on main and not on this line. admit_callers_discarded_on_the_native_route is now retired by its own trigger -- the native route checks caller admission from the fn's declared admit_callers list, with the Arrow carrier and its consumer landing together (v2.compiler body_lowering_fold body_lower_fn_admit_clause_edges; v2.compiler.infer infer_caller_admission_diags) -- so it no longer counts. The other two remain, re-derived from gunbc.rung_drop once the line carries them. Why: Each standing drop is a known wall down on the path v2 is meant to run on. [authority](dag/gunbc/rung_drop.dag)
 - [ ] **The factory: harness, workers, CI/floor and the daily workspace, the machine that lands and verifies work** — The steps every change traverses (orientation, implementation, test, commit, publication, review, verification) are owned by the workflow as durable state, not by an agent's memory. CI and floor verdicts name what they executed and cost what their inputs require. Why: Every obligation left in prose is re-learned per session and dropped under pressure. Every finished candidate that needs hand-integration spends operator time the factory exists to save. [authority](docs/plans/harness-work-lifecycle.md)
 - [ ] **One request travels the whole factory and comes back as an independently reviewed, published candidate** — The dogfood route as one acceptance case: request, immutable subject, shared computation, placement grant, isolated execution, durable result, metering, independent review, candidate published, cleanup, result returned (production order: the belt reviews a head before publishing it) -- each established by its own typed record from the durable records the real srv2 route wrote for ONE attempt (gunbc.roadmap_dogfood_route DogfoodRouteReceipt). The start receipt is the first complete attempt, selected in refname order, by the first successful recorder to observe one (scanning durable attempt history), recorded once, create-only; attempts operated by hand before the route existed do not qualify. Why: Without one executable case the factory is a set of stages that each pass alone while no request has crossed them all, and the operator's confidence -- the gate for the first external customer -- has nothing to rest on. [authority](dag/gunbc/roadmap/roadmap_dogfood_route.dag)
 - [ ] **Publish each attempt's worker events to the fabric event log** — The harness's per-attempt worker events, today appended only to a host-local provider-events.jsonl that gunbc.roadmap_provider_events reads, are appended to gunbc.fabric_event_log as a new payload kind over its existing partitions (product.capacity.event_chain), one partition per attempt. Any consumer then reads an attempt's events from the fabric rather than from a file on the worker's host. Why: Without it, every live view depends on sharing a filesystem with the worker, and streaming cannot go through the fabric as ruled. [authority](dag/gunbc/fabric/fabric_event_log.dag)
diff --git a/artifacts/bmc/mtcollins1-boot-run-37102391062/SHA256SUMS b/artifacts/bmc/mtcollins1-boot-run-37102391062/SHA256SUMS
index c4117401148..08cc6271965 100644
--- a/artifacts/bmc/mtcollins1-boot-run-37102391062/SHA256SUMS
+++ b/artifacts/bmc/mtcollins1-boot-run-37102391062/SHA256SUMS
@@ -1,4 +1,3 @@
-ff115761d621d17f3c5d23d2869e9f170d8ff0090145df3d2ec633cd496d8306  ./kvm/features.json
 357c2410a75c2f46e5679bc17f2c5fa46d2444e3379756037adfa57aaf75557c  ./kvm/journal
 280137e5d0f80550ddd5ecae177344fce0d7e46ab217137d769ad178ef08a5c6  ./kvm/observer.log
 649e3a034f001c421cfa31f5e9d8746e5292ebd6e95aa728201e6e98c5343daf  ./kvm/still-1.jpg
diff --git a/artifacts/bmc/mtcollins1-boot-run-37102391062/kvm/features.json b/artifacts/bmc/mtcollins1-boot-run-37102391062/kvm/features.json
deleted file mode 100644
index 928ce510bf3..00000000000
--- a/artifacts/bmc/mtcollins1-boot-run-37102391062/kvm/features.json
+++ /dev/null
@@ -1 +0,0 @@
-[{"feature": "RMEDIA_MULTI_IMAGE_SUPPORT"}, {"feature": "BIOS_SUPPORT"}, {"feature": "KVM_SESSION_RECONNECT"}, {"feature": "SYSTEM_FIREWALL"}, {"feature": "OEM_PROPRIETARY_LEVEL_SUPPORT"}, {"feature": "HTML5_KVM"}, {"feature": "DUAL_BIOS_FLASH_SUPPORT"}, {"feature": "IPV6_SUPPORT"}, {"feature": "ALLOW_NON_SECURE_COMMUNICATION"}, {"feature": "SET_SENSOR_THRESHOLDS"}, {"feature": "REPLACE_OEM_LOGO"}, {"feature": "EXTENDEDLOG"}, {"feature": "AUTO_RESIZE_KVM_CLIENT_WINDOW"}, {"feature": "SERVICES"}, {"feature": "RMEDIA"}, {"feature": "AUTOVDORECORD_REMOTE"}, {"feature": "CAPTURE_BSOD_JPEG"}, {"feature": "RADIUS_SUPPORT"}, {"feature": "SYSTEM_FIREWALL_TIMEOUT"}, {"feature": "UARTLOG"}, {"feature": "RUNTIME_HOST_LOCK"}, {"feature": "SOL_SUPPORT"}, {"feature": "HPM_SUPPORT"}, {"feature": "ADVISER_SUPPORT"}, {"feature": "AD_SUPPORT"}, {"feature": "MULTIPLE_USER_VMEDIA"}, {"feature": "LDAP_SUPPORT"}, {"feature": "KVM_SESSION_TIMEOUT"}, {"feature": "FIRMWARE_FLASH_SUPPORT"}, {"feature": "CPLD_SUPPORT"}, {"feature": "PTP_SERVER_SUPPORT"}, {"feature": "BOOTFW_SUPPORT"}, {"feature": "HOST_LOCK_AUTO"}, {"feature": "BACKUP_CONFIG"}, {"feature": "SET_SENSOR_THRESHOLDS_RESET"}, {"feature": "SAVE_SELLOG"}, {"feature": "SESSION_MANAGEMENT"}, {"feature": "RMEDIA_MULTI_CD_SUPPORT"}, {"feature": "TSIG"}, {"feature": "IPV6_COMPLIANCE"}, {"feature": "CD_SERVER_APP"}, {"feature": "WEB_DASHBOARD_WIDGETS"}, {"feature": "FOLDER_REDIRECTION"}, {"feature": "CIRCULAR_SEL"}, {"feature": "FW_IMAGE"}, {"feature": "DISABLE_EMPTY_PASSWORD"}, {"feature": "KB_LANG_SELECT_SUPPORT"}, {"feature": "DYNAMIC_KCS_LAN_SUPPORT"}, {"feature": "LMEDIA"}, {"feature": "DUAL_BOOTFW_EEPROM_SUPPORT"}, {"feature": "BLOCK_ICMP_TIMESTAMP"}, {"feature": "SINGLE_PORT_APP"}, {"feature": "MDNS"}, {"feature": "NCSI_SUPPORT"}, {"feature": "IMG_REDIRECTION"}, {"feature": "HD_SERVER_APP"}, {"feature": "PAM_REORDERING"}, {"feature": "EXTENDED_PRIV"}, {"feature": "SNMP"}, {"feature": "WEB_APP_PROXY"}, {"feature": "LMEDIA_MULTI_IMAGE_SUPPORT"}, {"feature": "VMEDIA_MAX_COUNT_FOR_KVM"}, {"feature": "MEDIA_REDIR_READ_WRITE_ONLY"}, {"feature": "RMEDIA_SESSION_RECONNECT"}, {"feature": "PRESERVECONF"}, {"feature": "TIMEZONE_SUPPORT"}, {"feature": "RMEDIA_MULTI_HD_SUPPORT"}, {"feature": "AUTOVDORECORD"}, {"feature": "YES"}, {"feature": "VERSION_CMP_FLASH"}, {"feature": "BMC_RECOVERY"}, {"feature": "NWLINK"}, {"feature": "KVM_OR_MEDIA_AVAILABLE"}]
\ No newline at end of file
diff --git a/artifacts/bmc/mtcollins1-megarac-api-surface.txt b/artifacts/bmc/mtcollins1-megarac-api-surface.txt
deleted file mode 100644
index ddad31eef40..00000000000
--- a/artifacts/bmc/mtcollins1-megarac-api-surface.txt
+++ /dev/null
@@ -1,255 +0,0 @@
-api/acd/download_crashdump
-api/acd/getcrashdumpstatus
-api/acd/set_crashdump_download
-api/acd/setcrashdumpstatus
-api/actions/chassis-led
-api/actions/power
-api/aep_inventory/aep_dimm_action
-api/aep_inventory/aepdimm_fw_flash_status
-api/aep_inventory/aep_dimm_info
-api/aep_inventory/aep_namespace_info
-api/aep_inventory/aep_pools_info
-api/aep_inventory/last_action_info
-api/ae_test
-api/chassis-status
-api/configuration/runtime
-api/dashboardsensors
-api/detail_sensors_readings
-api/fan_control/get_fan_info
-api/fan_control/get_manager_status
-api/fan_control/set_fan_speed
-api/fan_control/set_manager_status
-api/firmware-info
-api/fru
-api/host/get_crash_dump
-api/host_inventory/host_interface_baseboard_info
-api/host_inventory/host_interface_memory_info
-api/host_inventory/host_interface_pcie_device_function_info
-api/host_inventory/host_interface_power_info
-api/host_inventory/host_interface_processor_info
-api/host_inventory/host_interface_storage_info
-api/host_inventory/host_interface_system_info
-api/host_inventory/host_interface_thermal_info
-api/logs/acd
-api/logs/audit
-api/logs/dashboardevent
-api/logs/event
-api/logs/event-file
-api/logs/eventlog
-api/logs/system
-api/logs/video
-api/logs/video-data
-api/logs/video-log
-api/logs/video-log/delete
-api/maintenance/backup_config
-api/maintenance/bios-signed-image-key
-api/maintenance/bmc_recovery
-api/maintenance/bootfw-signed-image-key
-api/maintenance/cpld/enableupdatemode
-api/maintenance/cpld/getinfo
-api/maintenance/download_config
-api/maintenance/dualflashimageconfig
-api/maintenance/dual_image_config
-api/maintenance/firmware
-api/maintenance/firmware/dwldfwimg
-api/maintenance/firmware/dwldfwstatus-progress
-api/maintenance/firmware/firmware
-api/maintenance/firmware/flash-progress
-api/maintenance/firmware/upgrade
-api/maintenance/firmware/verification
-api/maintenance/flash
-api/maintenance/flashtrack
-api/maintenance/fwimage_location
-api/maintenance/hpm/
-api/maintenance/hpm/activatecomponents
-api/maintenance/hpm/componentversions
-api/maintenance/hpm/exitupdatemode
-api/maintenance/hpm/flash
-api/maintenance/hpm/freemem
-api/maintenance/hpm/getbiosversions
-api/maintenance/hpm/preparecomponents
-api/maintenance/hpm/updatemode
-api/maintenance/hpm/upgradestatus
-api/maintenance/hpm/verifyimage
-api/maintenance/hpm/verifyimagestatus
-api/maintenance/nm_activate
-api/maintenance/nm_compareversion
-api/maintenance/nm_deactivate
-api/maintenance/nm_ecfstatus
-api/maintenance/nm_eraseflash
-api/maintenance/nm_firmware_update
-api/maintenance/nm_upload
-api/maintenance/nvme/activatecomponents
-api/maintenance/nvme/fwupdate
-api/maintenance/nvme/fwupdateprogress
-api/maintenance/nvme/nvmemissdsfw
-api/maintenance/pldm/
-api/maintenance/pldm/fwupdateprogress
-api/maintenance/pldm/fwupdatestatus
-api/maintenance/pldm/getpldmfwinfo
-api/maintenance/preserve
-api/maintenance/reset
-api/maintenance/restore_config
-api/maintenance/restore_defaults
-api/maintenance/signed-image-key
-api/maintenance/system_admin
-api/maintenance/upload_restore
-api/maintenance/ValidBootfwSignImage
-api/maintenance/ValidSignImage
-api/operations/ssl/certificate/generate
-api/pldm/eids
-api/pldm/sensors
-api/pldm/state_sensors
-api/remote_control/get/kvm/launch
-api/reset-pass
-api/scripts
-api/scripts/
-api/sensors
-api/session
-api/set/dns/registration
-api/settings/active-directory-settings
-api/settings/active-directory-users
-api/settings/channels
-api/settings/dashboardntp
-api/settings/dashboarduser
-api/settings/date-time
-api/settings/dns/domain-options
-api/settings/dns-info
-api/settings/dns/registration
-api/settings/dns/restart
-api/settings/dns/server-options
-api/settings/dns/tsig-private-key
-api/settings/download_image
-api/settings/firewall
-api/settings/firewall/
-api/settings/firewall-ip-rules
-api/settings/firewall-port-rules
-api/settings/ipmi_disable_interfaces
-api/settings/javasol
-api/settings/lan_destination/snmptrap_user
-api/settings/ldap-certificates
-api/settings/ldap-settings
-api/settings/ldap-users
-api/settings/license
-api/settings/licenses
-api/settings/log
-api/settings/log-certificates
-api/settings/log-policy
-api/settings/media/active_redirections
-api/settings/media/adviser
-api/settings/media/general
-api/settings/media/instance
-api/settings/media/local/configurations
-api/settings/media/local/file
-api/settings/media/local/image
-api/settings/media/local/images
-api/settings/media/local/lmediasizecheck
-api/settings/media/local/start-media
-api/settings/media/local/stop-media
-api/settings/media/remote/configurations
-api/settings/media/remote/images
-api/settings/media/remote/lmediarefreshlist
-api/settings/media/remote/rmediarefreshlist
-api/settings/media/remotesession
-api/settings/media/remote/start-media
-api/settings/media/remote/stop-media
-api/settings/mouse
-api/settings/ncsi-interfaces
-api/settings/ncsi/mode
-api/settings/network
-api/settings/network/activelancfg
-api/settings/network-bond
-api/settings/network-link
-api/settings/nic_management/nic_controller_info
-api/settings/nvme_management/nvme_basic_mi_vpd_info
-api/settings/nvme_management/nvme_controller_info
-api/settings/nvme_management/nvme_p3700_vital_product_data
-api/settings/nvme_mi_management/nvme_mi_clear_status_flags
-api/settings/nvme_mi_management/nvme_mi_set_status_flags
-api/settings/nvme_mi_management/nvme_mi_ssd_info
-api/settings/nvme_mi_management/nvme_mi_subsystem_info
-api/settings/nvme_mi_management/nvme_mi_vpd_info
-api/settings/packages
-api/settings/pam-order
-api/settings/pcie_switch_management/get_pcie_bifurcation_info
-api/settings/pcie_switch_management/pcie_mgmt_dev_info
-api/settings/pcie_switch_management/pcie_partition_count
-api/settings/pcie_switch_management/pcie_port_bind
-api/settings/pcie_switch_management/pcie_port_link_status
-api/settings/pcie_switch_management/pcie_port_unbind
-api/settings/pcie_switch_management/pcie_switch_reset
-api/settings/pcie_switch_management/set_pcie_bifurcation_info
-api/settings/pcie_switch_management/validate_port_unbind
-api/settings/pcie_switch_mgmt/pcie_partition_info
-api/settings/pef/alert_policies
-api/settings/pef/alert_string_keys
-api/settings/pef/destinations
-api/settings/pef/event_filters
-api/settings/pef/lan_destinations
-api/settings/pef/send_test_alert
-api/settings/radius/advanced
-api/settings/radius/general
-api/settings/raid_management/bbu_info
-api/settings/raid_management/clear_all_foreign_cmd
-api/settings/raid_management/create_lu_cache
-api/settings/raid_management/create_virtual_drive
-api/settings/raid_management/dedicated_hot_spare_info
-api/settings/raid_management/delete_virtual_drive
-api/settings/raid_management/logical_consistency_check_cmd
-api/settings/raid_management/logical_device_info
-api/settings/raid_management/logical_device_progress_cmd
-api/settings/raid_management/logical_initialize_check_cmd
-api/settings/raid_management/logical_start_stop_locate_cmd
-api/settings/raid_management/manage_array_info
-api/settings/raid_management/manage_data_drive_array
-api/settings/raid_management/manage_spare_drive_array
-api/settings/raid_management/patrol_read_properties
-api/settings/raid_management/patrol_read_start_stop_cmd
-api/settings/raid_management/physical_dedicated_hotspare_cmd
-api/settings/raid_management/physical_device_info
-api/settings/raid_management/physical_hotspare_cmd
-api/settings/raid_management/physical_onlineoffline_cmd
-api/settings/raid_management/physical_removal_cmd
-api/settings/raid_management/physical_start_stop_locate_cmd
-api/settings/raid_management/physical_state_cmd
-api/settings/raid_management/raid_controller_info
-api/settings/raid_management/raid_event_log
-api/settings/raid_management/raid_levels
-api/settings/raid_management/raid_pd_count
-api/settings/raid_management/raid_topology_info
-api/settings/raid_management/sesenclosureinfo
-api/settings/raid_management/sesenclosureinfobrcm
-api/settings/raid_management/storage_summary
-api/settings/sasit_management/sasit_controller_info
-api/settings/sasit_management/sasit_enclosure_info
-api/settings/sasit_management/sasit_event_log
-api/settings/sasit_management/sasit_physical_device_info
-api/settings/sasit_management/sasit_physical_start_stop_locate_cmd
-api/settings/sasit_management/sasit_topology_info
-api/settings/sensor-threshold
-api/settings/services
-api/settings/service-sessions
-api/settings/smtp
-api/settings/smtp/smtpupload
-api/settings/sol-recorded-video
-api/settings/ssl/certificate
-api/settings/ssl/certificate-info
-api/settings/static-ipv6
-api/settings/user-preference
-api/settings/users
-api/settings/users/
-api/settings/users_read_only
-api/settings/user/ssh-key-upload/
-api/settings/video/pre-event
-api/settings/video/remote-storage
-api/settings/video/sol-remote-storage
-api/settings/video/sol-triggers
-api/settings/video/triggers
-api/sol/session
-api/sol/solcfg
-api/status/uptime
-api/system_diagnostics/download_system_diagnostics_log
-api/system_diagnostics/generate_system_diagnostics_logs
-api/system_diagnostics/log
-api/tasks
-api/updatenew_password
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/AccountService_Accounts.json b/artifacts/bmc/srv13-first-contact-2026-10-07/AccountService_Accounts.json
new file mode 100644
index 00000000000..1e53331cef2
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/AccountService_Accounts.json
@@ -0,0 +1,12 @@
+{
+  "@odata.id": "/redfish/v1/AccountService/Accounts",
+  "@odata.type": "#ManagerAccountCollection.ManagerAccountCollection",
+  "Description": "BMC User Accounts",
+  "Members": [
+    {
+      "@odata.id": "/redfish/v1/AccountService/Accounts/root"
+    }
+  ],
+  "Members@odata.count": 1,
+  "Name": "Accounts Collection"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/Chassis.json b/artifacts/bmc/srv13-first-contact-2026-10-07/Chassis.json
new file mode 100644
index 00000000000..bc18d21c41e
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/Chassis.json
@@ -0,0 +1,11 @@
+{
+  "@odata.id": "/redfish/v1/Chassis",
+  "@odata.type": "#ChassisCollection.ChassisCollection",
+  "Members": [
+    {
+      "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T"
+    }
+  ],
+  "Members@odata.count": 1,
+  "Name": "Chassis Collection"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/FINDINGS.txt b/artifacts/bmc/srv13-first-contact-2026-10-07/FINDINGS.txt
new file mode 100644
index 00000000000..f81aa6671a4
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/FINDINGS.txt
@@ -0,0 +1,54 @@
+srv13 first contact, 2026-10-07 (ASRock Rack ALTRAD8UD-1L2T), read from srv2.
+Each line names the capture file that carries it.
+
+BMC     192.168.1.247, MAC 9c:6b:00:e7:c9:83 (router reservation bmc-altrad8ud-1l2t-5),
+        OpenBMC 2.07.00, Redfish 1.17.0, factory credential            Managers_bmc.json, service-root.json
+BIOS    AMI Aptio, UEFI 2.06, Aptio core 2.22.1282, CPLD_MB 0.02         UpdateService_FirmwareInventory_bios_active.json, sol-after-reseat.log
+Host NIC Intel I210 Gigabit, 9C:6B:00:E7:CA:63                          sol-setup-walk.log (Advanced page)
+Redfish Bios resource exposes no Attributes: settings are not readable
+        or writable over Redfish on this build                         Systems_system_Bios.json
+Boot override targets: None Pxe Hdd Cd Diags BiosSetup Usb (no UefiShell) Systems_system.json
+SOL     enabled, ADMINISTRATOR                                          (ipmitool sol info, not captured)
+
+FACTORY DEFAULTS, Aptio Setup
+  Boot:     Hard Disk, NVME, CD/DVD, USB Device, Network, UEFI AP Built-in EFI Shell;
+            Setup Prompt Timeout 1; NumLock On; Boot Beep Disabled; Full Screen Logo Enabled   sol-setup-walk.log
+  Advanced > Network Stack Configuration:
+            Network Stack Enabled; IPv4 PXE Disabled; IPv4 HTTP Disabled;
+            IPv6 PXE Disabled; IPv6 HTTP Disabled; PXE boot wait time 0; Media detect count 1  sol-after-reseat.log
+
+PXE TEST  One-time Pxe override + ForceRestart landed in Aptio Setup, not a PXE client,
+          because every PXE/HTTP boot client is disabled by default.     sol-pxe-override.log
+          Enabling one is a Setup change; Redfish cannot make it on this build.
+
+INCIDENT  After that test the host went dark (power On, no console). The event log carries
+          "Undetermined system hardware failure" asserts from 2023-04-03, 2026-10-06 and
+          2026-10-07, mostly in pairs ~18 s apart. Operator reseated a DIMM and AC-cycled the
+          board; it then POSTed to Setup in ~100 s.                    sel-elist.txt, sol-after-reseat.log
+          Whether the paired asserts are a fault or this BMC's per-boot noise is not decided.
+
+THERMAL (2026-10-08)  The host had no CPU heatsink fitted. Redfish EventLog records "Thermal trip"
+          6-7 min after each successful power-on (23:13, 23:51 on 10-07; 23:39, 23:43 on 10-06),
+          and the trip latches: later Redfish power-ons leave the host dark (override never
+          consumed) until an AC cycle. All ten fan headers read "No Reading". The IPMI
+          "Undetermined system hardware failure" pairs are these thermal and power events.
+                                                                        redfish-eventlog.json, sdr-elist-host-dark.txt
+
+BMC 03.22.00 (pushed 2026-10-08 01:00Z, host off; member altrad8ud-1l2t_3.22.00.static.mtd.tar
+          sha256 cb8b8e72...; staged by UpdateService task, active after a Manager reset)
+          First authenticated request with the published credential: HTTP 403, Redfish
+          MessageId Base.1.16.0.PasswordChangeRequired (a wrong password is 401). Rotated by
+          gunbc.tools.bmc_onboard srv13_converge_credential into secret bmc-srv13-admin.
+                                                                        bmc-3.22.00-factory-login-403.json, bmc-push-3.22.00-response.json
+          Boot override targets unchanged (no UefiShell). Registries gain
+          BiosAttributeRegistryA3139.2.6.0, but its entry serves no body and Systems/system/Bios
+          carries no Attributes; Bios/Settings is 404.                  bmc-3.22.00/
+          With BIOS 2.06 the host reached Setup (override consumed ~50 s) and sat ~80 s: no
+          Attributes published.
+
+BIOS 4.01 (pushed 2026-10-08 02:26Z, host off; member obmc-bios-altrad8ud-1l2t-4.01.all.tar
+          sha256 33937359...)  bios_active reads 4.01. First boot after the flash took ~135 s to
+          reach Setup; the second ~85 s. ~2 min in Setup: no Attributes, registry still the
+          2.6.0 stub.                                                   bios-4.01/
+          Not yet tested: whether the BIOS uploads attributes only on leaving Setup for a boot
+          device (needs a heatsink).
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/Managers_bmc.json b/artifacts/bmc/srv13-first-contact-2026-10-07/Managers_bmc.json
new file mode 100644
index 00000000000..cf597b77146
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/Managers_bmc.json
@@ -0,0 +1,99 @@
+{
+  "@odata.id": "/redfish/v1/Managers/bmc",
+  "@odata.type": "#Manager.v1_14_0.Manager",
+  "Actions": {
+    "#Manager.Reset": {
+      "@Redfish.ActionInfo": "/redfish/v1/Managers/bmc/ResetActionInfo",
+      "target": "/redfish/v1/Managers/bmc/Actions/Manager.Reset"
+    },
+    "#Manager.ResetToDefaults": {
+      "ResetType@Redfish.AllowableValues": [
+        "ResetAll"
+      ],
+      "target": "/redfish/v1/Managers/bmc/Actions/Manager.ResetToDefaults"
+    }
+  },
+  "DateTime": "2026-10-07T23:05:22+00:00",
+  "DateTimeLocalOffset": "+00:00",
+  "Description": "Baseboard Management Controller",
+  "EthernetInterfaces": {
+    "@odata.id": "/redfish/v1/Managers/bmc/EthernetInterfaces"
+  },
+  "FirmwareVersion": "2.07.00",
+  "GraphicalConsole": {
+    "ConnectTypesSupported": [
+      "KVMIP"
+    ],
+    "MaxConcurrentSessions": 4,
+    "ServiceEnabled": true
+  },
+  "HostInterfaces": {
+    "@odata.id": "/redfish/v1/Managers/bmc/HostInterfaces"
+  },
+  "Id": "bmc",
+  "LastResetTime": "2026-10-07T23:02:50+00:00",
+  "Links": {
+    "ActiveSoftwareImage": {
+      "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/c1789ba5"
+    },
+    "ManagerForChassis": [
+      {
+        "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T"
+      }
+    ],
+    "ManagerForChassis@odata.count": 1,
+    "ManagerForServers": [
+      {
+        "@odata.id": "/redfish/v1/Systems/system"
+      }
+    ],
+    "ManagerForServers@odata.count": 1,
+    "ManagerInChassis": {
+      "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T"
+    },
+    "SoftwareImages": [
+      {
+        "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/c1789ba5"
+      }
+    ],
+    "SoftwareImages@odata.count": 1
+  },
+  "LogServices": {
+    "@odata.id": "/redfish/v1/Managers/bmc/LogServices"
+  },
+  "ManagerDiagnosticData": {
+    "@odata.id": "/redfish/v1/Managers/bmc/ManagerDiagnosticData"
+  },
+  "ManagerType": "BMC",
+  "Model": "OpenBmc",
+  "Name": "OpenBmc Manager",
+  "NetworkProtocol": {
+    "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol"
+  },
+  "Oem": {
+    "@odata.id": "/redfish/v1/Managers/bmc#/Oem",
+    "@odata.type": "#OemManager.Oem",
+    "OpenBmc": {
+      "@odata.id": "/redfish/v1/Managers/bmc#/Oem/OpenBmc",
+      "@odata.type": "#OemManager.OpenBmc",
+      "Certificates": {
+        "@odata.id": "/redfish/v1/Managers/bmc/Truststore/Certificates"
+      }
+    }
+  },
+  "PowerState": "On",
+  "SerialConsole": {
+    "ConnectTypesSupported": [
+      "IPMI",
+      "SSH"
+    ],
+    "MaxConcurrentSessions": 15,
+    "ServiceEnabled": true
+  },
+  "ServiceEntryPointUUID": "6e884505-ba5e-49f2-af66-cedf82ef8d8c",
+  "Status": {
+    "Health": "OK",
+    "State": "Enabled"
+  },
+  "UUID": "ffdfdf52-02ff-41ed-86e1-825b912cfd38"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/Managers_bmc_EthernetInterfaces.json b/artifacts/bmc/srv13-first-contact-2026-10-07/Managers_bmc_EthernetInterfaces.json
new file mode 100644
index 00000000000..f543b1f924f
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/Managers_bmc_EthernetInterfaces.json
@@ -0,0 +1,18 @@
+{
+  "@odata.id": "/redfish/v1/Managers/bmc/EthernetInterfaces",
+  "@odata.type": "#EthernetInterfaceCollection.EthernetInterfaceCollection",
+  "Description": "Collection of EthernetInterfaces for this Manager",
+  "Members": [
+    {
+      "@odata.id": "/redfish/v1/Managers/bmc/EthernetInterfaces/eth0"
+    },
+    {
+      "@odata.id": "/redfish/v1/Managers/bmc/EthernetInterfaces/eth1"
+    },
+    {
+      "@odata.id": "/redfish/v1/Managers/bmc/EthernetInterfaces/usb0"
+    }
+  ],
+  "Members@odata.count": 3,
+  "Name": "Ethernet Network Interface Collection"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/SHA256SUMS b/artifacts/bmc/srv13-first-contact-2026-10-07/SHA256SUMS
new file mode 100644
index 00000000000..c342906c2f5
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/SHA256SUMS
@@ -0,0 +1,36 @@
+533e714f76ac3392d2d3723214bf93769144c66d65ffb53c3e38652068057f4f  ./AccountService_Accounts.json
+d529ffd6d7c10336855e028bee8aff53d1aa1b1f0d2a9bd10ad47fa7bcc338de  ./bios-4.01/bios-push-4.01-response.json
+088b345314c19277031fcc5918b268a6177e3fec1839fce0df90b0a609cfd6f1  ./bios-4.01/bios-update-task-final.json
+9ed3cf320675dd014b1791ecb43d05cdcb125c206dbd09a450ae45f5f2df316f  ./bmc-3.22.00/bios-attribute-registry-index.json
+4e85a95511849bb353b9fb64411a08b818c86ed7500f9db8ce7722788d64a41c  ./bmc-3.22.00-factory-login-403.json
+356def19a6b04d4ee038ea2f246f5ba404681bd35486fb9137df20ce27b6a20f  ./bmc-3.22.00/root_Chassis_ALTRAD8UD_1L2T_Sensors.json
+e9bfb2890d8a2dc0cbdf689fab698dafdfceb681120aee2ae47e7734d53b33b1  ./bmc-3.22.00/root_.json
+a2a538b9ac8be12980983f7ad968b10a0d95aac7e62de0acdb9d123b2123ae26  ./bmc-3.22.00/root_Managers_bmc.json
+03a2c082df8d6e05a6ffa04cbd719c0185a69b6f7af6f5770e4c628d82f96b54  ./bmc-3.22.00/root_Registries.json
+5afa31e43baa9883ae0fb8989d1c6309609a31b8df28cbc724f6f8034519bf87  ./bmc-3.22.00/root_Systems_system_Bios.json
+b28942659c3286850f3eb778463abce376447de1d673028ceb2e218b0f850c95  ./bmc-3.22.00/root_Systems_system_Bios_Settings.json
+fd4ad69ffdbef8db4e21eedb4b7c107627abd662d9f0bc3fd0effff1484469da  ./bmc-3.22.00/root_Systems_system.json
+33a6b0ee0af70b0c028dd3e7110c307cb2cab48029aaf9f0cc2efcdf39f1de4c  ./bmc-3.22.00/root_UpdateService_FirmwareInventory.json
+8681e15a07d9bb3e237557626b00bb7ba0c0f4b81c4abe6d4f74baf98539eb73  ./bmc-3.22.00/root_UpdateService.json
+d529ffd6d7c10336855e028bee8aff53d1aa1b1f0d2a9bd10ad47fa7bcc338de  ./bmc-push-3.22.00-response.json
+41761339bcc45b979de0175029ca5cd48845629f9ce9afb45d5a8511d20df98c  ./bmc-update-task-last.json
+d6ae05a583d44ae630f0d01df364d37849bda917563c6378b20b858054210d8a  ./Chassis.json
+c5a742c14554ef622a67713e3555d2392759c3e2b91ecfd2fbae2d4a9c8f6bac  ./chassis-status.txt
+81bb5b9576a26c909ed769ebb3ae75cc85c3397192ec82e2a98613e329041567  ./FINDINGS.txt
+6db5fc5581d5b6e0f40df6cddf71095035f65e8256e93640fa7ae67a90fecc99  ./Managers_bmc_EthernetInterfaces.json
+bc29928b9410a2ffe8240cd0ba9671f99294b6f146ec436471a03ac81e15aa0b  ./Managers_bmc.json
+762feb0be02e66bb175180f037d6ececb95bd347b988dafe81b1c7f5d7e01b2f  ./redfish-eventlog.json
+66ec2013bbb722e232b1ccb8101a9e4096a46490b360fe7650a8cf24c46e35e0  ./sdr-elist-host-dark.txt
+2c829c14f85f29b9de21ff262133f75bf8e4a671fc7b7c531e04a7f3133ada77  ./sel-elist.txt
+e9bfb2890d8a2dc0cbdf689fab698dafdfceb681120aee2ae47e7734d53b33b1  ./service-root.json
+3a3ef6fc68ee7ba2f89d8d2a688da419bc5c515c4d2e07848cba14ab4f49c415  ./sol-after-reseat.log
+65e15c97b39d300cf90d90f1cc57195efa635483974cf7b486724a5797349626  ./sol-pxe-override.log
+26b07d6326f9e54001fc1559dd42cd3d695939b7a91fdc64c76ac50a575f730e  ./sol-setup-walk.log
+5b6e9dcf1d96d1077f8eb14dd059917fa9866b9724cb4a329d1eeccaf3a4a665  ./Systems.json
+5afa31e43baa9883ae0fb8989d1c6309609a31b8df28cbc724f6f8034519bf87  ./Systems_system_Bios.json
+edec8647dc4670711fb5d6eb71f174a16bc0f045cf6bc522719f25a339cf0b42  ./Systems_system_BootOptions.json
+b99147a727c4467d9a6ded317e7781d0440b545f495f28460378bcb69a2bdc3b  ./Systems_system.json
+8681e15a07d9bb3e237557626b00bb7ba0c0f4b81c4abe6d4f74baf98539eb73  ./update-service-before.json
+5c04fcde1f060ec620f4b42f30a6491118d44a2589efcd1f57a1f3990bba8e6d  ./UpdateService_FirmwareInventory_bios_active.json
+37f04ddc817b2741443901c2f9593d04432e0f4a9043a83051934f63ace1231e  ./UpdateService_FirmwareInventory_c1789ba5.json
+fcd91e7b5f9638004711ae4b6b7835517ef22a4f00392095b60f0551f0b68d4e  ./UpdateService_FirmwareInventory.json
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/Systems.json b/artifacts/bmc/srv13-first-contact-2026-10-07/Systems.json
new file mode 100644
index 00000000000..5461060bb19
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/Systems.json
@@ -0,0 +1,11 @@
+{
+  "@odata.id": "/redfish/v1/Systems",
+  "@odata.type": "#ComputerSystemCollection.ComputerSystemCollection",
+  "Members": [
+    {
+      "@odata.id": "/redfish/v1/Systems/system"
+    }
+  ],
+  "Members@odata.count": 1,
+  "Name": "Computer System Collection"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/Systems_system.json b/artifacts/bmc/srv13-first-contact-2026-10-07/Systems_system.json
new file mode 100644
index 00000000000..f9e3fefa874
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/Systems_system.json
@@ -0,0 +1,117 @@
+{
+  "@odata.id": "/redfish/v1/Systems/system",
+  "@odata.type": "#ComputerSystem.v1_16_0.ComputerSystem",
+  "Actions": {
+    "#ComputerSystem.Reset": {
+      "@Redfish.ActionInfo": "/redfish/v1/Systems/system/ResetActionInfo",
+      "target": "/redfish/v1/Systems/system/Actions/ComputerSystem.Reset"
+    }
+  },
+  "AssetTag": "",
+  "Bios": {
+    "@odata.id": "/redfish/v1/Systems/system/Bios"
+  },
+  "BiosVersion": "null",
+  "Boot": {
+    "AutomaticRetryAttempts": 3,
+    "AutomaticRetryConfig": "Disabled",
+    "AutomaticRetryConfig@Redfish.AllowableValues": [
+      "Disabled",
+      "RetryAttempts"
+    ],
+    "BootSourceOverrideEnabled": "Disabled",
+    "BootSourceOverrideMode": "UEFI",
+    "BootSourceOverrideMode@Redfish.AllowableValues": [
+      "Legacy",
+      "UEFI"
+    ],
+    "BootSourceOverrideTarget": "None",
+    "BootSourceOverrideTarget@Redfish.AllowableValues": [
+      "None",
+      "Pxe",
+      "Hdd",
+      "Cd",
+      "Diags",
+      "BiosSetup",
+      "Usb"
+    ],
+    "RemainingAutomaticRetryAttempts": 3,
+    "StopBootOnFault": "Never",
+    "TrustedModuleRequiredToBoot": "Disabled"
+  },
+  "BootProgress": {
+    "LastState": "None",
+    "LastStateTime": "1970-01-01T00:00:00.000000+00:00"
+  },
+  "Description": "Computer System",
+  "FabricAdapters": {
+    "@odata.id": "/redfish/v1/Systems/system/FabricAdapters"
+  },
+  "GraphicalConsole": {
+    "ConnectTypesSupported": [
+      "KVMIP"
+    ],
+    "MaxConcurrentSessions": 4,
+    "ServiceEnabled": true
+  },
+  "Id": "system",
+  "IndicatorLED": "Off",
+  "LastResetTime": "2026-10-07T23:04:34+00:00",
+  "Links": {
+    "Chassis": [
+      {
+        "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T"
+      }
+    ],
+    "ManagedBy": [
+      {
+        "@odata.id": "/redfish/v1/Managers/bmc"
+      }
+    ]
+  },
+  "LocationIndicatorActive": false,
+  "LogServices": {
+    "@odata.id": "/redfish/v1/Systems/system/LogServices"
+  },
+  "Manufacturer": "ASRockRack",
+  "Memory": {
+    "@odata.id": "/redfish/v1/Systems/system/Memory"
+  },
+  "MemorySummary": {
+    "TotalSystemMemoryGiB": 0.0
+  },
+  "Model": "ALTRAD8UD-1L2T",
+  "Name": "system",
+  "PCIeDevices": [],
+  "PCIeDevices@odata.count": 0,
+  "PartNumber": "$PRODUCT_PART_NUMBER",
+  "PowerRestorePolicy": "AlwaysOn",
+  "PowerState": "On",
+  "ProcessorSummary": {
+    "Count": 0
+  },
+  "Processors": {
+    "@odata.id": "/redfish/v1/Systems/system/Processors"
+  },
+  "SerialConsole": {
+    "IPMI": {
+      "ServiceEnabled": true
+    },
+    "MaxConcurrentSessions": 15,
+    "SSH": {
+      "HotKeySequenceDisplay": "Press ~. to exit console",
+      "Port": 2200,
+      "ServiceEnabled": true
+    }
+  },
+  "SerialNumber": "$PRODUCT_SERIAL_NUMBER",
+  "Status": {
+    "Health": "OK",
+    "HealthRollup": "OK",
+    "State": "Enabled"
+  },
+  "Storage": {
+    "@odata.id": "/redfish/v1/Systems/system/Storage"
+  },
+  "SystemType": "Physical"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/Systems_system_Bios.json b/artifacts/bmc/srv13-first-contact-2026-10-07/Systems_system_Bios.json
new file mode 100644
index 00000000000..cbc252c1af7
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/Systems_system_Bios.json
@@ -0,0 +1,23 @@
+{
+  "@odata.id": "/redfish/v1/Systems/system/Bios",
+  "@odata.type": "#Bios.v1_1_0.Bios",
+  "Actions": {
+    "#Bios.ResetBios": {
+      "target": "/redfish/v1/Systems/system/Bios/Actions/Bios.ResetBios"
+    }
+  },
+  "Description": "BIOS Configuration Service",
+  "Id": "BIOS",
+  "Links": {
+    "ActiveSoftwareImage": {
+      "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/bios_active"
+    },
+    "SoftwareImages": [
+      {
+        "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/bios_active"
+      }
+    ],
+    "SoftwareImages@odata.count": 1
+  },
+  "Name": "BIOS Configuration"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/Systems_system_BootOptions.json b/artifacts/bmc/srv13-first-contact-2026-10-07/Systems_system_BootOptions.json
new file mode 100644
index 00000000000..efdb5419779
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/Systems_system_BootOptions.json
@@ -0,0 +1,19 @@
+{
+  "error": {
+    "@Message.ExtendedInfo": [
+      {
+        "@odata.type": "#Message.v1_1_1.Message",
+        "Message": "The requested resource of type  named 'BootOptions' was not found.",
+        "MessageArgs": [
+          "",
+          "BootOptions"
+        ],
+        "MessageId": "Base.1.16.0.ResourceNotFound",
+        "MessageSeverity": "Critical",
+        "Resolution": "Provide a valid resource identifier and resubmit the request."
+      }
+    ],
+    "code": "Base.1.16.0.ResourceNotFound",
+    "message": "The requested resource of type  named 'BootOptions' was not found."
+  }
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/UpdateService_FirmwareInventory.json b/artifacts/bmc/srv13-first-contact-2026-10-07/UpdateService_FirmwareInventory.json
new file mode 100644
index 00000000000..a871b347c70
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/UpdateService_FirmwareInventory.json
@@ -0,0 +1,14 @@
+{
+  "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory",
+  "@odata.type": "#SoftwareInventoryCollection.SoftwareInventoryCollection",
+  "Members": [
+    {
+      "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/bios_active"
+    },
+    {
+      "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/c1789ba5"
+    }
+  ],
+  "Members@odata.count": 2,
+  "Name": "Software Inventory Collection"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/UpdateService_FirmwareInventory_bios_active.json b/artifacts/bmc/srv13-first-contact-2026-10-07/UpdateService_FirmwareInventory_bios_active.json
new file mode 100644
index 00000000000..52bb17a0def
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/UpdateService_FirmwareInventory_bios_active.json
@@ -0,0 +1,20 @@
+{
+  "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/bios_active",
+  "@odata.type": "#SoftwareInventory.v1_1_0.SoftwareInventory",
+  "Description": "Host image",
+  "Id": "bios_active",
+  "Name": "Software Inventory",
+  "RelatedItem": [
+    {
+      "@odata.id": "/redfish/v1/Systems/system/Bios"
+    }
+  ],
+  "RelatedItem@odata.count": 1,
+  "Status": {
+    "Health": "OK",
+    "HealthRollup": "OK",
+    "State": "Enabled"
+  },
+  "Updateable": false,
+  "Version": "2.06"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/UpdateService_FirmwareInventory_c1789ba5.json b/artifacts/bmc/srv13-first-contact-2026-10-07/UpdateService_FirmwareInventory_c1789ba5.json
new file mode 100644
index 00000000000..4b0e9f48647
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/UpdateService_FirmwareInventory_c1789ba5.json
@@ -0,0 +1,20 @@
+{
+  "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/c1789ba5",
+  "@odata.type": "#SoftwareInventory.v1_1_0.SoftwareInventory",
+  "Description": "BMC image",
+  "Id": "c1789ba5",
+  "Name": "Software Inventory",
+  "RelatedItem": [
+    {
+      "@odata.id": "/redfish/v1/Managers/bmc"
+    }
+  ],
+  "RelatedItem@odata.count": 1,
+  "Status": {
+    "Health": "OK",
+    "HealthRollup": "OK",
+    "State": "Enabled"
+  },
+  "Updateable": true,
+  "Version": "2.07.00"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bios-4.01/bios-push-4.01-response.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bios-4.01/bios-push-4.01-response.json
new file mode 100644
index 00000000000..c6c3428698e
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bios-4.01/bios-push-4.01-response.json
@@ -0,0 +1,8 @@
+{
+  "@odata.id": "/redfish/v1/TaskService/Tasks/0",
+  "@odata.type": "#Task.v1_4_3.Task",
+  "Id": "0",
+  "TaskState": "Running",
+  "TaskStatus": "OK"
+}
+http:202
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bios-4.01/bios-update-task-final.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bios-4.01/bios-update-task-final.json
new file mode 100644
index 00000000000..a3a769a7245
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bios-4.01/bios-update-task-final.json
@@ -0,0 +1,63 @@
+{
+  "@odata.id": "/redfish/v1/TaskService/Tasks/0",
+  "@odata.type": "#Task.v1_4_3.Task",
+  "EndTime": "2026-10-08T02:29:28+00:00",
+  "HidePayload": false,
+  "Id": "0",
+  "Messages": [
+    {
+      "@odata.type": "#Message.v1_1_1.Message",
+      "Message": "The task with Id '0' has started.",
+      "MessageArgs": [
+        "0"
+      ],
+      "MessageId": "TaskEvent.1.0.3.TaskStarted",
+      "MessageSeverity": "OK",
+      "Resolution": "None."
+    },
+    {
+      "@odata.type": "#Message.v1_1_1.Message",
+      "Message": "The task with Id '0' has changed to progress 20 percent complete.",
+      "MessageArgs": [
+        "0",
+        "20"
+      ],
+      "MessageId": "TaskEvent.1.0.3.TaskProgressChanged",
+      "MessageSeverity": "OK",
+      "Resolution": "None."
+    },
+    {
+      "@odata.type": "#Message.v1_1_1.Message",
+      "Message": "The task with Id '0' has changed to progress 100 percent complete.",
+      "MessageArgs": [
+        "0",
+        "100"
+      ],
+      "MessageId": "TaskEvent.1.0.3.TaskProgressChanged",
+      "MessageSeverity": "OK",
+      "Resolution": "None."
+    },
+    {
+      "@odata.type": "#Message.v1_1_1.Message",
+      "Message": "The task with Id '0' has completed.",
+      "MessageArgs": [
+        "0"
+      ],
+      "MessageId": "TaskEvent.1.0.3.TaskCompletedOK",
+      "MessageSeverity": "OK",
+      "Resolution": "None."
+    }
+  ],
+  "Name": "Task 0",
+  "Payload": {
+    "HttpHeaders": [],
+    "HttpOperation": "POST",
+    "JsonBody": "null",
+    "TargetUri": "/redfish/v1/UpdateService/update"
+  },
+  "PercentComplete": 100,
+  "StartTime": "2026-10-08T02:27:03+00:00",
+  "TaskMonitor": "/redfish/v1/TaskService/Tasks/0/Monitor",
+  "TaskState": "Completed",
+  "TaskStatus": "OK"
+}
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00-factory-login-403.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00-factory-login-403.json
new file mode 100644
index 00000000000..b913833e224
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00-factory-login-403.json
@@ -0,0 +1,14 @@
+{
+  "@Message.ExtendedInfo": [
+    {
+      "@odata.type": "#Message.v1_1_1.Message",
+      "Message": "The password provided for this account must be changed before access is granted.  PATCH the Password property for this account located at the target URI '/redfish/v1/AccountService/Accounts/root' to complete this process.",
+      "MessageArgs": [
+        "/redfish/v1/AccountService/Accounts/root"
+      ],
+      "MessageId": "Base.1.16.0.PasswordChangeRequired",
+      "MessageSeverity": "Critical",
+      "Resolution": "Change the password for this account using a PATCH to the Password property at the URI provided."
+    }
+  ]
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/bios-attribute-registry-index.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/bios-attribute-registry-index.json
new file mode 100644
index 00000000000..e9e7f0abe80
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/bios-attribute-registry-index.json
@@ -0,0 +1,12 @@
+{
+  "@Message.ExtendedInfo": [
+    {
+      "@odata.type": "#Message.v1_1_1.Message",
+      "Message": "The request completed successfully.",
+      "MessageArgs": [],
+      "MessageId": "Base.1.16.0.Success",
+      "MessageSeverity": "OK",
+      "Resolution": "None"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_.json
new file mode 100644
index 00000000000..e7b44dd597d
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_.json
@@ -0,0 +1,71 @@
+{
+  "@odata.id": "/redfish/v1",
+  "@odata.type": "#ServiceRoot.v1_15_0.ServiceRoot",
+  "AccountService": {
+    "@odata.id": "/redfish/v1/AccountService"
+  },
+  "Cables": {
+    "@odata.id": "/redfish/v1/Cables"
+  },
+  "CertificateService": {
+    "@odata.id": "/redfish/v1/CertificateService"
+  },
+  "Chassis": {
+    "@odata.id": "/redfish/v1/Chassis"
+  },
+  "EventService": {
+    "@odata.id": "/redfish/v1/EventService"
+  },
+  "Id": "RootService",
+  "JsonSchemas": {
+    "@odata.id": "/redfish/v1/JsonSchemas"
+  },
+  "Links": {
+    "ManagerProvidingService": {
+      "@odata.id": "/redfish/v1/Managers/bmc"
+    },
+    "Sessions": {
+      "@odata.id": "/redfish/v1/SessionService/Sessions"
+    }
+  },
+  "Managers": {
+    "@odata.id": "/redfish/v1/Managers"
+  },
+  "Name": "Root Service",
+  "ProtocolFeaturesSupported": {
+    "DeepOperations": {
+      "DeepPATCH": false,
+      "DeepPOST": false
+    },
+    "ExcerptQuery": false,
+    "ExpandQuery": {
+      "ExpandAll": false,
+      "Levels": false,
+      "Links": false,
+      "NoLinks": false
+    },
+    "FilterQuery": false,
+    "OnlyMemberQuery": true,
+    "SelectQuery": true
+  },
+  "RedfishVersion": "1.17.0",
+  "Registries": {
+    "@odata.id": "/redfish/v1/Registries"
+  },
+  "SessionService": {
+    "@odata.id": "/redfish/v1/SessionService"
+  },
+  "Systems": {
+    "@odata.id": "/redfish/v1/Systems"
+  },
+  "Tasks": {
+    "@odata.id": "/redfish/v1/TaskService"
+  },
+  "TelemetryService": {
+    "@odata.id": "/redfish/v1/TelemetryService"
+  },
+  "UUID": "6e884505-ba5e-49f2-af66-cedf82ef8d8c",
+  "UpdateService": {
+    "@odata.id": "/redfish/v1/UpdateService"
+  }
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Chassis_ALTRAD8UD_1L2T_Sensors.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Chassis_ALTRAD8UD_1L2T_Sensors.json
new file mode 100644
index 00000000000..9878201fb7f
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Chassis_ALTRAD8UD_1L2T_Sensors.json
@@ -0,0 +1,24 @@
+{
+  "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T/Sensors",
+  "@odata.type": "#SensorCollection.SensorCollection",
+  "Description": "Collection of Sensors for this Chassis",
+  "Members": [
+    {
+      "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T/Sensors/power_total_power"
+    },
+    {
+      "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T/Sensors/utilization_PSU1_AC_LOST"
+    },
+    {
+      "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T/Sensors/utilization_PSU2_AC_LOST"
+    },
+    {
+      "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T/Sensors/utilization_PSU3_AC_LOST"
+    },
+    {
+      "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T/Sensors/utilization_PSU4_AC_LOST"
+    }
+  ],
+  "Members@odata.count": 5,
+  "Name": "Sensors"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Managers_bmc.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Managers_bmc.json
new file mode 100644
index 00000000000..b372782d791
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Managers_bmc.json
@@ -0,0 +1,102 @@
+{
+  "@odata.id": "/redfish/v1/Managers/bmc",
+  "@odata.type": "#Manager.v1_14_0.Manager",
+  "Actions": {
+    "#Manager.Reset": {
+      "@Redfish.ActionInfo": "/redfish/v1/Managers/bmc/ResetActionInfo",
+      "target": "/redfish/v1/Managers/bmc/Actions/Manager.Reset"
+    },
+    "#Manager.ResetToDefaults": {
+      "ResetType@Redfish.AllowableValues": [
+        "ResetAll"
+      ],
+      "target": "/redfish/v1/Managers/bmc/Actions/Manager.ResetToDefaults"
+    }
+  },
+  "DateTime": "2026-10-08T01:48:36+00:00",
+  "DateTimeLocalOffset": "+00:00",
+  "Description": "Baseboard Management Controller",
+  "EthernetInterfaces": {
+    "@odata.id": "/redfish/v1/Managers/bmc/EthernetInterfaces"
+  },
+  "FanControl": {
+    "@odata.id": "/redfish/v1/Managers/bmc/FanControl"
+  },
+  "FirmwareVersion": "3.22.00",
+  "GraphicalConsole": {
+    "ConnectTypesSupported": [
+      "KVMIP"
+    ],
+    "MaxConcurrentSessions": 4,
+    "ServiceEnabled": true
+  },
+  "HostInterfaces": {
+    "@odata.id": "/redfish/v1/Managers/bmc/HostInterfaces"
+  },
+  "Id": "bmc",
+  "LastResetTime": "2026-10-08T01:05:54+00:00",
+  "Links": {
+    "ActiveSoftwareImage": {
+      "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/14c085a0"
+    },
+    "ManagerForChassis": [
+      {
+        "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T"
+      }
+    ],
+    "ManagerForChassis@odata.count": 1,
+    "ManagerForServers": [
+      {
+        "@odata.id": "/redfish/v1/Systems/system"
+      }
+    ],
+    "ManagerForServers@odata.count": 1,
+    "ManagerInChassis": {
+      "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T"
+    },
+    "SoftwareImages": [
+      {
+        "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/14c085a0"
+      }
+    ],
+    "SoftwareImages@odata.count": 1
+  },
+  "LogServices": {
+    "@odata.id": "/redfish/v1/Managers/bmc/LogServices"
+  },
+  "ManagerDiagnosticData": {
+    "@odata.id": "/redfish/v1/Managers/bmc/ManagerDiagnosticData"
+  },
+  "ManagerType": "BMC",
+  "Model": "OpenBmc",
+  "Name": "OpenBmc Manager",
+  "NetworkProtocol": {
+    "@odata.id": "/redfish/v1/Managers/bmc/NetworkProtocol"
+  },
+  "Oem": {
+    "@odata.id": "/redfish/v1/Managers/bmc#/Oem",
+    "@odata.type": "#OemManager.Oem",
+    "OpenBmc": {
+      "@odata.id": "/redfish/v1/Managers/bmc#/Oem/OpenBmc",
+      "@odata.type": "#OemManager.OpenBmc",
+      "Certificates": {
+        "@odata.id": "/redfish/v1/Managers/bmc/Truststore/Certificates"
+      }
+    }
+  },
+  "PowerState": "On",
+  "SerialConsole": {
+    "ConnectTypesSupported": [
+      "IPMI",
+      "SSH"
+    ],
+    "MaxConcurrentSessions": 15,
+    "ServiceEnabled": true
+  },
+  "ServiceEntryPointUUID": "6e884505-ba5e-49f2-af66-cedf82ef8d8c",
+  "Status": {
+    "Health": "OK",
+    "State": "Enabled"
+  },
+  "UUID": ""
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Registries.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Registries.json
new file mode 100644
index 00000000000..beac7a4a2dc
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Registries.json
@@ -0,0 +1,24 @@
+{
+  "@odata.id": "/redfish/v1/Registries",
+  "@odata.type": "#MessageRegistryFileCollection.MessageRegistryFileCollection",
+  "Description": "Collection of MessageRegistryFiles",
+  "Members": [
+    {
+      "@odata.id": "/redfish/v1/Registries/Base"
+    },
+    {
+      "@odata.id": "/redfish/v1/Registries/TaskEvent"
+    },
+    {
+      "@odata.id": "/redfish/v1/Registries/ResourceEvent"
+    },
+    {
+      "@odata.id": "/redfish/v1/Registries/OpenBMC"
+    },
+    {
+      "@odata.id": "/redfish/v1/Registries/BiosAttributeRegistryA3139.2.6.0"
+    }
+  ],
+  "Members@odata.count": 4,
+  "Name": "MessageRegistryFile Collection"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Systems_system.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Systems_system.json
new file mode 100644
index 00000000000..847b7743dea
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Systems_system.json
@@ -0,0 +1,116 @@
+{
+  "@odata.id": "/redfish/v1/Systems/system",
+  "@odata.type": "#ComputerSystem.v1_16_0.ComputerSystem",
+  "Actions": {
+    "#ComputerSystem.Reset": {
+      "@Redfish.ActionInfo": "/redfish/v1/Systems/system/ResetActionInfo",
+      "target": "/redfish/v1/Systems/system/Actions/ComputerSystem.Reset"
+    }
+  },
+  "Bios": {
+    "@odata.id": "/redfish/v1/Systems/system/Bios"
+  },
+  "BiosVersion": "2.06",
+  "Boot": {
+    "AutomaticRetryAttempts": 3,
+    "AutomaticRetryConfig": "Disabled",
+    "AutomaticRetryConfig@Redfish.AllowableValues": [
+      "Disabled",
+      "RetryAttempts"
+    ],
+    "BootSourceOverrideEnabled": "Once",
+    "BootSourceOverrideMode": "UEFI",
+    "BootSourceOverrideMode@Redfish.AllowableValues": [
+      "Legacy",
+      "UEFI"
+    ],
+    "BootSourceOverrideTarget": "BiosSetup",
+    "BootSourceOverrideTarget@Redfish.AllowableValues": [
+      "None",
+      "Pxe",
+      "Hdd",
+      "Cd",
+      "Diags",
+      "BiosSetup",
+      "Usb"
+    ],
+    "RemainingAutomaticRetryAttempts": 3,
+    "StopBootOnFault": "Never",
+    "TrustedModuleRequiredToBoot": "Disabled"
+  },
+  "BootProgress": {
+    "LastState": "None",
+    "LastStateTime": "1970-01-01T00:00:00.000000+00:00"
+  },
+  "Description": "Computer System",
+  "FabricAdapters": {
+    "@odata.id": "/redfish/v1/Systems/system/FabricAdapters"
+  },
+  "GraphicalConsole": {
+    "ConnectTypesSupported": [
+      "KVMIP"
+    ],
+    "MaxConcurrentSessions": 4,
+    "ServiceEnabled": true
+  },
+  "Id": "system",
+  "IndicatorLED": "Off",
+  "LastResetTime": "2026-10-08T00:38:37+00:00",
+  "Links": {
+    "Chassis": [
+      {
+        "@odata.id": "/redfish/v1/Chassis/ALTRAD8UD_1L2T"
+      }
+    ],
+    "ManagedBy": [
+      {
+        "@odata.id": "/redfish/v1/Managers/bmc"
+      }
+    ]
+  },
+  "LocationIndicatorActive": false,
+  "LogServices": {
+    "@odata.id": "/redfish/v1/Systems/system/LogServices"
+  },
+  "Manufacturer": "ASRockRack",
+  "Memory": {
+    "@odata.id": "/redfish/v1/Systems/system/Memory"
+  },
+  "MemorySummary": {
+    "TotalSystemMemoryGiB": 0.0
+  },
+  "Model": "ALTRAD8UD-1L2T",
+  "Name": "system",
+  "PCIeDevices": [],
+  "PCIeDevices@odata.count": 0,
+  "PartNumber": "$BOARD_PART_NUMBER",
+  "PowerRestorePolicy": "AlwaysOn",
+  "PowerState": "Off",
+  "ProcessorSummary": {
+    "Count": 0
+  },
+  "Processors": {
+    "@odata.id": "/redfish/v1/Systems/system/Processors"
+  },
+  "SerialConsole": {
+    "IPMI": {
+      "ServiceEnabled": true
+    },
+    "MaxConcurrentSessions": 15,
+    "SSH": {
+      "HotKeySequenceDisplay": "Press ~. to exit console",
+      "Port": 2200,
+      "ServiceEnabled": true
+    }
+  },
+  "SerialNumber": "BR80S6102300049",
+  "Status": {
+    "Health": "OK",
+    "HealthRollup": "OK",
+    "State": "Disabled"
+  },
+  "Storage": {
+    "@odata.id": "/redfish/v1/Systems/system/Storage"
+  },
+  "SystemType": "Physical"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Systems_system_Bios.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Systems_system_Bios.json
new file mode 100644
index 00000000000..cbc252c1af7
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Systems_system_Bios.json
@@ -0,0 +1,23 @@
+{
+  "@odata.id": "/redfish/v1/Systems/system/Bios",
+  "@odata.type": "#Bios.v1_1_0.Bios",
+  "Actions": {
+    "#Bios.ResetBios": {
+      "target": "/redfish/v1/Systems/system/Bios/Actions/Bios.ResetBios"
+    }
+  },
+  "Description": "BIOS Configuration Service",
+  "Id": "BIOS",
+  "Links": {
+    "ActiveSoftwareImage": {
+      "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/bios_active"
+    },
+    "SoftwareImages": [
+      {
+        "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/bios_active"
+      }
+    ],
+    "SoftwareImages@odata.count": 1
+  },
+  "Name": "BIOS Configuration"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Systems_system_Bios_Settings.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Systems_system_Bios_Settings.json
new file mode 100644
index 00000000000..c842ea939e8
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_Systems_system_Bios_Settings.json
@@ -0,0 +1,19 @@
+{
+  "error": {
+    "@Message.ExtendedInfo": [
+      {
+        "@odata.type": "#Message.v1_1_1.Message",
+        "Message": "The requested resource of type  named 'Settings' was not found.",
+        "MessageArgs": [
+          "",
+          "Settings"
+        ],
+        "MessageId": "Base.1.16.0.ResourceNotFound",
+        "MessageSeverity": "Critical",
+        "Resolution": "Provide a valid resource identifier and resubmit the request."
+      }
+    ],
+    "code": "Base.1.16.0.ResourceNotFound",
+    "message": "The requested resource of type  named 'Settings' was not found."
+  }
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_UpdateService.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_UpdateService.json
new file mode 100644
index 00000000000..65e203a2243
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_UpdateService.json
@@ -0,0 +1,19 @@
+{
+  "@odata.id": "/redfish/v1/UpdateService",
+  "@odata.type": "#UpdateService.v1_11_1.UpdateService",
+  "Description": "Service for Software Update",
+  "FirmwareInventory": {
+    "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory"
+  },
+  "HttpPushUri": "/redfish/v1/UpdateService/update",
+  "HttpPushUriOptions": {
+    "HttpPushUriApplyTime": {
+      "ApplyTime": "OnReset"
+    }
+  },
+  "Id": "UpdateService",
+  "MaxImageSizeBytes": 68157440,
+  "MultipartHttpPushUri": "/redfish/v1/UpdateService/update",
+  "Name": "Update Service",
+  "ServiceEnabled": true
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_UpdateService_FirmwareInventory.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_UpdateService_FirmwareInventory.json
new file mode 100644
index 00000000000..82cb92c7721
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-3.22.00/root_UpdateService_FirmwareInventory.json
@@ -0,0 +1,17 @@
+{
+  "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory",
+  "@odata.type": "#SoftwareInventoryCollection.SoftwareInventoryCollection",
+  "Members": [
+    {
+      "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/14c085a0"
+    },
+    {
+      "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/bios_active"
+    },
+    {
+      "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory/cpld"
+    }
+  ],
+  "Members@odata.count": 3,
+  "Name": "Software Inventory Collection"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-push-3.22.00-response.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-push-3.22.00-response.json
new file mode 100644
index 00000000000..c6c3428698e
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-push-3.22.00-response.json
@@ -0,0 +1,8 @@
+{
+  "@odata.id": "/redfish/v1/TaskService/Tasks/0",
+  "@odata.type": "#Task.v1_4_3.Task",
+  "Id": "0",
+  "TaskState": "Running",
+  "TaskStatus": "OK"
+}
+http:202
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-update-task-last.json b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-update-task-last.json
new file mode 100644
index 00000000000..433577b3c22
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/bmc-update-task-last.json
@@ -0,0 +1,63 @@
+{
+  "@odata.id": "/redfish/v1/TaskService/Tasks/0",
+  "@odata.type": "#Task.v1_4_3.Task",
+  "EndTime": "2026-10-08T01:00:28+00:00",
+  "HidePayload": false,
+  "Id": "0",
+  "Messages": [
+    {
+      "@odata.type": "#Message.v1_1_1.Message",
+      "Message": "The task with Id '0' has started.",
+      "MessageArgs": [
+        "0"
+      ],
+      "MessageId": "TaskEvent.1.0.3.TaskStarted",
+      "MessageSeverity": "OK",
+      "Resolution": "None."
+    },
+    {
+      "@odata.type": "#Message.v1_1_1.Message",
+      "Message": "The task with Id '0' has changed to progress 10 percent complete.",
+      "MessageArgs": [
+        "0",
+        "10"
+      ],
+      "MessageId": "TaskEvent.1.0.3.TaskProgressChanged",
+      "MessageSeverity": "OK",
+      "Resolution": "None."
+    },
+    {
+      "@odata.type": "#Message.v1_1_1.Message",
+      "Message": "The task with Id '0' has changed to progress 100 percent complete.",
+      "MessageArgs": [
+        "0",
+        "100"
+      ],
+      "MessageId": "TaskEvent.1.0.3.TaskProgressChanged",
+      "MessageSeverity": "OK",
+      "Resolution": "None."
+    },
+    {
+      "@odata.type": "#Message.v1_1_1.Message",
+      "Message": "The task with Id '0' has completed.",
+      "MessageArgs": [
+        "0"
+      ],
+      "MessageId": "TaskEvent.1.0.3.TaskCompletedOK",
+      "MessageSeverity": "OK",
+      "Resolution": "None."
+    }
+  ],
+  "Name": "Task 0",
+  "Payload": {
+    "HttpHeaders": [],
+    "HttpOperation": "POST",
+    "JsonBody": "null",
+    "TargetUri": "/redfish/v1/UpdateService/update"
+  },
+  "PercentComplete": 100,
+  "StartTime": "2026-10-08T01:00:25+00:00",
+  "TaskMonitor": "/redfish/v1/TaskService/Tasks/0/Monitor",
+  "TaskState": "Completed",
+  "TaskStatus": "OK"
+}
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/chassis-status.txt b/artifacts/bmc/srv13-first-contact-2026-10-07/chassis-status.txt
new file mode 100644
index 00000000000..3997634a4c0
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/chassis-status.txt
@@ -0,0 +1,12 @@
+System Power         : on
+Power Overload       : false
+Power Interlock      : inactive
+Main Power Fault     : false
+Power Control Fault  : false
+Power Restore Policy : always-on
+Last Power Event     : 
+Chassis Intrusion    : inactive
+Front-Panel Lockout  : inactive
+Drive Fault          : false
+Cooling/Fan Fault    : false
+Front Panel Control  : none
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/redfish-eventlog.json b/artifacts/bmc/srv13-first-contact-2026-10-07/redfish-eventlog.json
new file mode 100644
index 00000000000..dc929ec9c4f
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/redfish-eventlog.json
@@ -0,0 +1,457 @@
+{
+  "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries",
+  "@odata.type": "#LogEntryCollection.LogEntryCollection",
+  "Description": "Collection of System Event Log Entries",
+  "Members": [
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/1",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/1/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2023-04-03T21:00:02.839+00:00",
+      "EntryType": "Event",
+      "Id": "1",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2023-04-03T21:00:02.839+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/10",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/10/attachment",
+      "Additiondata": [
+        "Over temperature = Assert"
+      ],
+      "Created": "2026-10-06T23:31:22.586+00:00",
+      "EntryType": "Event",
+      "Id": "10",
+      "Message": "Thermal trip",
+      "Modified": "2026-10-06T23:31:22.586+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/11",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/11/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-06T23:33:39.774+00:00",
+      "EntryType": "Event",
+      "Id": "11",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-06T23:33:39.774+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/12",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/12/attachment",
+      "Additiondata": [
+        "Over temperature = Assert"
+      ],
+      "Created": "2026-10-06T23:39:02.664+00:00",
+      "EntryType": "Event",
+      "Id": "12",
+      "Message": "Thermal trip",
+      "Modified": "2026-10-06T23:39:02.664+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/13",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/13/attachment",
+      "Additiondata": [
+        "_PID=281"
+      ],
+      "Created": "2026-10-06T23:38:46.201+00:00",
+      "EntryType": "Event",
+      "Id": "13",
+      "Message": "xyz.openbmc_project.State.Shutdown.Power.Error.Blackout",
+      "Modified": "2026-10-06T23:38:46.201+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "Critical"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/14",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/14/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-06T23:39:04.724+00:00",
+      "EntryType": "Event",
+      "Id": "14",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-06T23:39:04.724+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/15",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/15/attachment",
+      "Additiondata": [
+        "Over temperature = Assert"
+      ],
+      "Created": "2026-10-06T23:43:37.297+00:00",
+      "EntryType": "Event",
+      "Id": "15",
+      "Message": "Thermal trip",
+      "Modified": "2026-10-06T23:43:37.297+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/16",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/16/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-06T23:45:48.253+00:00",
+      "EntryType": "Event",
+      "Id": "16",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-06T23:45:48.253+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/17",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/17/attachment",
+      "Additiondata": [
+        "_PID=285"
+      ],
+      "Created": "2026-10-06T23:49:05.270+00:00",
+      "EntryType": "Event",
+      "Id": "17",
+      "Message": "xyz.openbmc_project.State.Shutdown.Power.Error.Blackout",
+      "Modified": "2026-10-06T23:49:05.270+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "Critical"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/18",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/18/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-06T23:49:23.943+00:00",
+      "EntryType": "Event",
+      "Id": "18",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-06T23:49:23.943+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/19",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/19/attachment",
+      "Additiondata": [
+        "_PID=281"
+      ],
+      "Created": "2026-10-06T23:54:04.503+00:00",
+      "EntryType": "Event",
+      "Id": "19",
+      "Message": "xyz.openbmc_project.State.Shutdown.Power.Error.Blackout",
+      "Modified": "2026-10-06T23:54:04.503+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "Critical"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/2",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/2/attachment",
+      "Additiondata": [
+        "_PID=283"
+      ],
+      "Created": "2023-04-03T21:02:50.303+00:00",
+      "EntryType": "Event",
+      "Id": "2",
+      "Message": "xyz.openbmc_project.State.Shutdown.Power.Error.Blackout",
+      "Modified": "2023-04-03T21:02:50.303+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "Critical"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/20",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/20/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-06T23:54:23.237+00:00",
+      "EntryType": "Event",
+      "Id": "20",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-06T23:54:23.237+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/21",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/21/attachment",
+      "Additiondata": [
+        "_PID=286"
+      ],
+      "Created": "2026-10-07T02:56:41.255+00:00",
+      "EntryType": "Event",
+      "Id": "21",
+      "Message": "xyz.openbmc_project.State.Shutdown.Power.Error.Blackout",
+      "Modified": "2026-10-07T02:56:41.255+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "Critical"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/22",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/22/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-07T02:56:59.887+00:00",
+      "EntryType": "Event",
+      "Id": "22",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-07T02:56:59.887+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/23",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/23/attachment",
+      "Additiondata": [
+        "Over temperature = Assert"
+      ],
+      "Created": "2026-10-07T23:13:17.681+00:00",
+      "EntryType": "Event",
+      "Id": "23",
+      "Message": "Thermal trip",
+      "Modified": "2026-10-07T23:13:17.681+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/24",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/24/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-07T23:20:18.594+00:00",
+      "EntryType": "Event",
+      "Id": "24",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-07T23:20:18.594+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/25",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/25/attachment",
+      "Additiondata": [
+        "_PID=285"
+      ],
+      "Created": "2026-10-07T23:41:45.868+00:00",
+      "EntryType": "Event",
+      "Id": "25",
+      "Message": "xyz.openbmc_project.State.Shutdown.Power.Error.Blackout",
+      "Modified": "2026-10-07T23:41:45.868+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "Critical"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/26",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/26/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-07T23:42:04.490+00:00",
+      "EntryType": "Event",
+      "Id": "26",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-07T23:42:04.490+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/27",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/27/attachment",
+      "Additiondata": [
+        "Over temperature = Assert"
+      ],
+      "Created": "2026-10-07T23:51:23.327+00:00",
+      "EntryType": "Event",
+      "Id": "27",
+      "Message": "Thermal trip",
+      "Modified": "2026-10-07T23:51:23.327+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/28",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/28/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-08T00:30:37.304+00:00",
+      "EntryType": "Event",
+      "Id": "28",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-08T00:30:37.304+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/3",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/3/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2023-04-03T21:03:08.663+00:00",
+      "EntryType": "Event",
+      "Id": "3",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2023-04-03T21:03:08.663+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/4",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/4/attachment",
+      "Additiondata": [
+        "_PID=283"
+      ],
+      "Created": "2026-10-06T23:08:15.850+00:00",
+      "EntryType": "Event",
+      "Id": "4",
+      "Message": "xyz.openbmc_project.State.Shutdown.Power.Error.Blackout",
+      "Modified": "2026-10-06T23:08:15.850+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "Critical"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/5",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/5/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-06T23:08:34.210+00:00",
+      "EntryType": "Event",
+      "Id": "5",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-06T23:08:34.210+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/6",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/6/attachment",
+      "Additiondata": [
+        "_PID=285"
+      ],
+      "Created": "2026-10-06T23:11:02.914+00:00",
+      "EntryType": "Event",
+      "Id": "6",
+      "Message": "xyz.openbmc_project.State.Shutdown.Power.Error.Blackout",
+      "Modified": "2026-10-06T23:11:02.914+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "Critical"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/7",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/7/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-06T23:11:20.849+00:00",
+      "EntryType": "Event",
+      "Id": "7",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-06T23:11:20.849+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/8",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/8/attachment",
+      "Additiondata": [
+        "_PID=287"
+      ],
+      "Created": "2026-10-06T23:22:21.209+00:00",
+      "EntryType": "Event",
+      "Id": "8",
+      "Message": "xyz.openbmc_project.State.Shutdown.Power.Error.Blackout",
+      "Modified": "2026-10-06T23:22:21.209+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "Critical"
+    },
+    {
+      "@odata.id": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/9",
+      "@odata.type": "#LogEntry.v1_9_0.LogEntry",
+      "AdditionalDataURI": "/redfish/v1/Systems/system/LogServices/EventLog/Entries/9/attachment",
+      "Additiondata": [
+        "CHASSIS_ID=0"
+      ],
+      "Created": "2026-10-06T23:22:39.790+00:00",
+      "EntryType": "Event",
+      "Id": "9",
+      "Message": "xyz.openbmc_project.State.Info.ChassisPowerOnStarted",
+      "Modified": "2026-10-06T23:22:39.790+00:00",
+      "Name": "System Event Log Entry",
+      "Resolved": false,
+      "Severity": "OK"
+    }
+  ],
+  "Members@odata.count": 28,
+  "Name": "System Event Log Entries"
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/sdr-elist-host-dark.txt b/artifacts/bmc/srv13-first-contact-2026-10-07/sdr-elist-host-dark.txt
new file mode 100644
index 00000000000..9e1ea8ffb51
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/sdr-elist-host-dark.txt
@@ -0,0 +1,63 @@
+12V              | 01h | ns  | 19.0 | No Reading
+5V               | 02h | ns  | 19.0 | No Reading
+3V3              | 03h | ok  | 19.0 | 3.26 Volts
+5VSB             | 04h | ok  | 19.0 | 4.95 Volts
+0V8_VDDC_SOC     | 05h | ns  | 19.0 | No Reading
+BAT              | 06h | ok  | 19.0 | 3.12 Volts
+0V75_PCP_CPU     | 07h | ns  | 19.0 | No Reading
+1V8_PCP          | 08h | ns  | 19.0 | No Reading
+1V2_VDDQ0123     | 09h | ns  | 19.0 | No Reading
+1V2_VDDQ4567     | 0Ah | ns  | 19.0 | No Reading
+0V6_VTT0123      | 0Bh | ns  | 19.0 | No Reading
+0V6_VTT4567      | 0Ch | ns  | 19.0 | No Reading
+3V3_SOC          | 0Dh | ns  | 19.0 | No Reading
+1V8_VDDH         | 0Eh | ns  | 19.0 | No Reading
+1V5_VDDH         | 0Fh | ns  | 19.0 | No Reading
+0V85_VDDC_RCA    | 10h | ns  | 19.0 | No Reading
+TEMP_SOC         | 30h | ns  |  6.0 | No Reading
+TEMP_SOC_VRD     | 31h | ns  |  6.0 | No Reading
+TEMP_DIMM_VRD    | 32h | ns  |  6.0 | No Reading
+TEMP_Core_VRD    | 33h | ns  |  6.0 | No Reading
+TEMP_DIMM_A1     | 34h | ns  |  6.0 | No Reading
+TEMP_DIMM_B1     | 35h | ns  |  6.0 | No Reading
+TEMP_DIMM_C1     | 36h | ns  |  6.0 | No Reading
+TEMP_DIMM_D1     | 37h | ns  |  6.0 | No Reading
+TEMP_DIMM_E1     | 38h | ns  |  6.0 | No Reading
+TEMP_DIMM_F1     | 39h | ns  |  6.0 | No Reading
+TEMP_DIMM_G1     | 3Ah | ns  |  6.0 | No Reading
+TEMP_DIMM_H1     | 3Bh | ns  |  6.0 | No Reading
+TEMP_RCA_VR      | 3Ch | ns  |  6.0 | No Reading
+TEMP_X550        | 40h | ok  |  6.0 | 39 degrees C
+TEMP_CARD_SIDE   | 41h | ok  |  6.0 | 33 degrees C
+TEMP_VR          | 42h | ok  |  6.0 | 26 degrees C
+TEMP_TR1         | 43h | ok  |  6.0 | 0 degrees C
+TEMP_MB          | 44h | ok  |  6.0 | 29 degrees C
+TEMP_M2_1        | 45h | ns  |  6.0 | No Reading
+TEMP_M2_2        | 46h | ns  |  6.0 | No Reading
+FAN1             | 60h | ns  | 29.0 | No Reading
+FAN2             | 61h | ns  | 29.0 | No Reading
+FAN3             | 62h | ns  | 29.0 | No Reading
+FAN4             | 63h | ns  | 29.0 | No Reading
+FAN5             | 64h | ns  | 29.0 | No Reading
+FAN1_1           | 68h | ns  | 29.0 | No Reading
+FAN2_1           | 69h | ns  | 29.0 | No Reading
+FAN3_1           | 6Ah | ns  | 29.0 | No Reading
+FAN4_1           | 6Bh | ns  | 29.0 | No Reading
+FAN5_1           | 6Ch | ns  | 29.0 | No Reading
+PWR_Core_VRD     | 70h | ns  | 19.39 | No Reading
+PWR_SOC_VRD      | 71h | ns  | 19.39 | No Reading
+PWR_DIMM_VR1     | 72h | ns  | 19.39 | No Reading
+PWR_DIMM_VR2     | 73h | ns  | 19.39 | No Reading
+PWR_RCA_VR       | 74h | ns  | 19.39 | No Reading
+PSU1_VINPUT      | E6h | ns  | 19.74 | Disabled
+PSU2_VINPUT      | E7h | ns  | 19.75 | Disabled
+PSU1_IOUTPUT     | ECh | ns  | 19.80 | Disabled
+PSU2_IOUTPUT     | EDh | ns  | 19.81 | Disabled
+PSU1_PINPUT      | EEh | ns  | 19.82 | Disabled
+PSU2_PINPUT      | EFh | ns  | 19.83 | Disabled
+PSU1_POUTPUT     | F0h | ns  | 19.84 | Disabled
+PSU2_POUTPUT     | F1h | ns  | 19.85 | Disabled
+PSU1_TEMP        | F3h | ns  |  6.58 | Disabled
+PSU2_TEMP        | F4h | ns  |  6.59 | Disabled
+PSU1_FAN         | F5h | ns  | 29.0 | Disabled
+PSU2_FAN         | F6h | ns  | 29.0 | Disabled
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/sel-elist.txt b/artifacts/bmc/srv13-first-contact-2026-10-07/sel-elist.txt
new file mode 100644
index 00000000000..a036bf7de62
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/sel-elist.txt
@@ -0,0 +1,24 @@
+   1 | 04/03/2023 | 09:00:02 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   2 | 04/03/2023 | 09:02:50 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   3 | 04/03/2023 | 09:03:08 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   4 | 10/06/2026 | 11:08:15 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   5 | 10/06/2026 | 11:08:34 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   6 | 10/06/2026 | 11:11:02 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   7 | 10/06/2026 | 11:11:20 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   8 | 10/06/2026 | 11:22:21 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   9 | 10/06/2026 | 11:22:39 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   a | 10/06/2026 | 11:31:22 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   b | 10/06/2026 | 11:33:39 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   c | 10/06/2026 | 11:39:02 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   d | 10/06/2026 | 11:38:46 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   e | 10/06/2026 | 11:39:04 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+   f | 10/06/2026 | 11:43:37 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+  10 | 10/06/2026 | 11:45:48 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+  11 | 10/06/2026 | 11:49:05 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+  12 | 10/06/2026 | 11:49:23 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+  13 | 10/06/2026 | 11:54:04 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+  14 | 10/06/2026 | 11:54:23 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+  15 | 10/07/2026 | 02:56:41 AM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+  16 | 10/07/2026 | 02:56:59 AM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+  17 | 10/07/2026 | 11:13:17 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
+  18 | 10/07/2026 | 11:20:18 PM UTC | System Event #0x01 | Undetermined system hardware failure | Asserted
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/service-root.json b/artifacts/bmc/srv13-first-contact-2026-10-07/service-root.json
new file mode 100644
index 00000000000..e7b44dd597d
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/service-root.json
@@ -0,0 +1,71 @@
+{
+  "@odata.id": "/redfish/v1",
+  "@odata.type": "#ServiceRoot.v1_15_0.ServiceRoot",
+  "AccountService": {
+    "@odata.id": "/redfish/v1/AccountService"
+  },
+  "Cables": {
+    "@odata.id": "/redfish/v1/Cables"
+  },
+  "CertificateService": {
+    "@odata.id": "/redfish/v1/CertificateService"
+  },
+  "Chassis": {
+    "@odata.id": "/redfish/v1/Chassis"
+  },
+  "EventService": {
+    "@odata.id": "/redfish/v1/EventService"
+  },
+  "Id": "RootService",
+  "JsonSchemas": {
+    "@odata.id": "/redfish/v1/JsonSchemas"
+  },
+  "Links": {
+    "ManagerProvidingService": {
+      "@odata.id": "/redfish/v1/Managers/bmc"
+    },
+    "Sessions": {
+      "@odata.id": "/redfish/v1/SessionService/Sessions"
+    }
+  },
+  "Managers": {
+    "@odata.id": "/redfish/v1/Managers"
+  },
+  "Name": "Root Service",
+  "ProtocolFeaturesSupported": {
+    "DeepOperations": {
+      "DeepPATCH": false,
+      "DeepPOST": false
+    },
+    "ExcerptQuery": false,
+    "ExpandQuery": {
+      "ExpandAll": false,
+      "Levels": false,
+      "Links": false,
+      "NoLinks": false
+    },
+    "FilterQuery": false,
+    "OnlyMemberQuery": true,
+    "SelectQuery": true
+  },
+  "RedfishVersion": "1.17.0",
+  "Registries": {
+    "@odata.id": "/redfish/v1/Registries"
+  },
+  "SessionService": {
+    "@odata.id": "/redfish/v1/SessionService"
+  },
+  "Systems": {
+    "@odata.id": "/redfish/v1/Systems"
+  },
+  "Tasks": {
+    "@odata.id": "/redfish/v1/TaskService"
+  },
+  "TelemetryService": {
+    "@odata.id": "/redfish/v1/TelemetryService"
+  },
+  "UUID": "6e884505-ba5e-49f2-af66-cedf82ef8d8c",
+  "UpdateService": {
+    "@odata.id": "/redfish/v1/UpdateService"
+  }
+}
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/sol-after-reseat.log b/artifacts/bmc/srv13-first-contact-2026-10-07/sol-after-reseat.log
new file mode 100644
index 00000000000..c9112d1fd26
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/sol-after-reseat.log
@@ -0,0 +1,107 @@
+[SOL Session operational.  Use ~? for help]
+Checkpoint 90
+Checkpoint 91
+Checkpoint 92
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 91
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 97
+Checkpoint 98
+Checkpoint 9D
+Checkpoint 9A
+Checkpoint 9C
+Checkpoint B4
+Checkpoint B4
+Checkpoint B4
+Checkpoint B4
+Checkpoint B4
+
+Time for GET - https://169.254.0.17:443/redfish/v1/ operation - 1878 ms, Status - Success, StatusCode - 3
+
+Time for GET - https://169.254.0.17:443/redfish/v1/Oem/Ami/InventoryData operation - 3624 ms, Status - Success, StatusCode - 3
+
+Time for POST - /redfish/v1/DynamicExtension/RedfishExtensions operation - 2672 ms, Status - Success, StatusCode - 21
+
+Time for POST - /redfish/v1/DynamicExtension/RedfishExtensions operation - 2871 ms, Status - Success, StatusCode - 21
+Checkpoint B4
+Checkpoint B4
+Checkpoint B4
+Checkpoint 98
+Checkpoint B4
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+
+Press <ESC> + <2> or <DEL> to run UEFI Setup
+Press <ESC> + <6> for Instant Flash
+Press <ESC> + <SHIFT> + <1> for Boot Menu
+Press <Tab> to Switch Screen
+
+Checkpoint A9
+ABCheckpoint AB
+                               Aptio Setup - AMI                                    Main  Advanced  Server Mgmt  Security  Boot  Exit                           /----------------------------------------------------+-------------------------\|  Board Product            ALTRAD8UD-1L2T           |Motherboard Information  ||  System Product           ALTRAD8UD-1L2T           |                         ||  UEFI Version             2.06                     |                         ||  BMC Version              2.07.00                  |                         ||  CPLD_MB Version          0.02                     |                         ||                                                    |                         ||> Motherboard Information                           |                         ||> Processor Information                             |                         ||> Memory Information                                |                         ||                                                    |-------------------------||  System Date              [Wed 10/07/2026]         |<>: Select Screen        ||  System Time              [23:44:57]               |^v: Select Item          ||                                                    |Enter: Select            ||                                                    |+/-: Change Option       ||                                                    |F1: General Help         ||                                                    |F7: Discard Changes      ||                                                    |F9: Load UEFI Defaults   ||                                                    |F10: Save and Exit       ||                                                    |ESC: Exit                |\----------------------------------------------------+-------------------------/                    Version 2.22.1282 Copyright (C) 2024 AMI                   895:00123456789    Main  Advanced |> CPU Configuration                                ^|CPU Configuration        ||> RAS Configuration                                *|Parameters               ||> Chipset Configuration                            *|                         ||> NVMe Configuration                               *|                         ||> ACPI Configuration                               *|                         ||> USB Configuration                                *|                         ||> Serial Port Console Redirection                  *|                         ||> H/W Monitor                                      *|                         ||> Network Stack Configuration                      *|                         ||> Driver Health                                    *|-------------------------||                                                   +|<>: Select Screen        ||> Tls Auth Configuration                           +|^v: Select Item          ||> Intel(R) I210 Gigabit  Network Connection -      +|Enter: Select            ||  9C:6B:00:E7:CA:63                                +|+/-: Change Option       ||> VLAN Configuration (MAC:9C6B00E7CA63)            +|F1: General Help         ||> MAC:9C6B00E7CA63-IPv4 Network Configuration      +|F7: Discard Changes      ||> MAC:9C6B00E7CA63-IPv6 Network Configuration      +|F9: Load UEFI Defaults   ||                                                   v|F10: Save and Exit       ||                                                    |ESC: Exit                ||> CPU Configuration                                ^|RAS Configuration        ||> RAS Configuration          Configure Chipset        ||> RAS Configuration                                *|Settings                 ||> Chipset ConfigurationNVMe Device Options      ||> Chipset Configuration                            *|                         ||> NVMe ConfigurationConfigure ACPI Settings  |        |> NVMe Configuration                               *|                         ||> ACPI ConfigurationUSB Configuration        |Parameters|> ACPI Configuration                               *|                         ||> USB ConfigurationSerial Port Console      |Redirection|> USB Configuration                                *|                         ||> Serial Port Console RedirectionMonitor hardware status  |           |> Serial Port Console Redirection                  *|                         ||> H/W MonitorNetwork Stack Settings   ||> H/W Monitor                                      *|                         ||> Network Stack Configuration          Advanced                                   |  Network Stack            [Enabled]                |                         ||  IPv4 PXE Support         [Disabled]               |                         ||  IPv4 HTTP Support        [Disabled]               |                         ||  IPv6 PXE Support         [Disabled]               |                         ||  IPv6 HTTP Support        [Disabled]               |                         ||  PXE boot wait time       0                        |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |-------------------------||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||  Media detect count       1|  [Enabled]Enable/Disable UEFI      |Network Stack<>: Select Screen        |^v: Select ItemEnter: Select+/-: Change Option       |F1: General Help         |F7: Discard Changes      |F9: Load UEFI Defaults   |F10: Save and Exit       |ESC: Exit    Main  Advanced  Server Mgmt  Security  Boot  Exit|> CPU Configuration                                ^|Network Stack Settings   ||> RAS Configuration                                *|                         ||> Chipset Configuration                            *|                         ||> NVMe Configuration                               *|                         ||> ACPI Configuration                               *|                         ||> USB Configuration                                *|                         ||> Serial Port Console Redirection                  *|                         ||> H/W Monitor                                      *|                         ||> Network Stack Configuration                      *|                         ||> Driver Health                                    *|-------------------------||                                                   +|<>: Select Screen        ||> Tls Auth Configuration                           +|^v: Select Item          ||> Intel(R) I210 Gigabit  Network Connection -      +|Enter: Select            ||  9C:6B:00:E7:CA:63                                +|+/-: Change Option       ||> VLAN Configuration (MAC:9C6B00E7CA63)            +|F1: General Help         ||> MAC:9C6B00E7CA63-IPv4 Network Configuration      +|F7: Discard Changes      ||> MAC:9C6B00E7CA63-IPv6 Network Configuration      +|F9: Load UEFI Defaults   ||                                                   v|F10: Save and Exit       ||                                                    |ESC: Exit                |
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/sol-pxe-override.log b/artifacts/bmc/srv13-first-contact-2026-10-07/sol-pxe-override.log
new file mode 100644
index 00000000000..31b7d2e90cd
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/sol-pxe-override.log
@@ -0,0 +1,471 @@
+tcgetattr: Inappropriate ioctl for device
+[SOL Session operational.  Use ~? for help]
+Checkpoint A9
+ABCheckpoint AB
+                               Aptio Setup - AMI                                    Main  Advanced  Server Mgmt  Security  Boot  Exit                           /----------------------------------------------------+-------------------------\|  Board Product            ALTRAD8UD-1L2T           |Motherboard Information  ||  System Product           ALTRAD8UD-1L2T           |                         ||  UEFI Version             2.06                     |                         ||  BMC Version              2.07.00                  |                         ||  CPLD_MB Version          0.02                     |                         ||                                                    |                         ||> Motherboard Information                           |                         ||> Processor Information                             |                         ||> Memory Information                                |                         ||                                                    |-------------------------||  System Date              [Wed 10/07/2026]         |<>: Select Screen        ||  System Time              [23:05:02]               |^v: Select Item          ||                                                    |Enter: Select            ||                                                    |+/-: Change Option       ||                                                    |F1: General Help         ||                                                    |F7: Discard Changes      ||                                                    |F9: Load UEFI Defaults   ||                                                    |F10: Save and Exit       ||                                                    |ESC: Exit                |\----------------------------------------------------+-------------------------/                    Version 2.22.1282 Copyright (C) 2024 AMI                   345NOTICE:  DRAM FW version 220414
+CP: 0ff00900
+MEMC param:
+  mcu_enable_mask = 00000001 [default: 000000ff]
+MCU param:
+  ecc_en = 00000002 [default: 00000001]
+DRAM populated DIMMs:
+  SK0 MC0 S0: NV-RDIMM[2c:80] 16GB 2666 ECC 1R x4 RCD[b3:80] 18ASF2G72XF12G6V21AB
+CP: 3ff00100
+CP: 3ff00200
+CP: 00f01902
+CP: 0ff00a00
+CP: 0ff00b01
+CP: 00f01901
+CP: 00f01904
+CP: 00f02901
+CP: 00f01905
+CP: 00f02902
+CP: 00f02903
+CP: 00f02904
+CP: 00f01907
+CP: 00f01906
+CP: 00f01908
+CP: 00f01909
+CP: 0ff00b02
+CP: 0ff00c00
+CP: 3ff00300
+CP: 00001a02
+CP: 00001a03
+CP: 00001a04
+CP: 00001a05
+CP: 00f01a07
+CP: 00001a09
+CP: 00001a0a
+CP: 00001a0b
+CP: 00001a0c
+CP: 00001a0c
+CP: 3ff00400
+CP: 0ff01000
+CP: 0ff01101
+DRAM ECC Initialization: [6] [ ==>                  ]DRAM ECC Initialization: [12] [ ===>                 ]DRAM ECC Initialization: [18] [ ====>                ]DRAM ECC Initialization: [25] [ ======>              ]DRAM ECC Initialization: [31] [ =======>             ]DRAM ECC Initialization: [37] [ ========>            ]DRAM ECC Initialization: [43] [ =========>           ]DRAM ECC Initialization: [50] [ ===========>         ]DRAM ECC Initialization: [56] [ ============>        ]DRAM ECC Initialization: [62] [ =============>       ]DRAM ECC Initialization: [68] [ ==============>      ]DRAM ECC Initialization: [75] [ ================>    ]DRAM ECC Initialization: [81] [ =================>   ]DRAM ECC Initialization: [87] [ ==================>  ]DRAM ECC Initialization: [93] [ ===================> ]DRAM ECC Initialization: [100] [ ==================== ]
+CP: 0ff01200
+CP: 3ff00800
+DRAM memory regions:
+  Node[0] Region[0]: 0x000080000000 - 0x0000ffffffff 
+  Node[0] Region[1]: 0x080000000000 - 0x08007fffffff 
+  Node[0] Region[2]: 0x080100000000 - 0x0803ffffffff 
+DRAM: 16GB DDR4 2666 SYMBOL ECC
+Checkpoint 2F
+Checkpoint 2E
+Checkpoint 31
+Checkpoint 32
+UEFI RC version: 2.10d
+SCP FW version    : 2.10
+SCP FW build date : 20230517
+Failsafe status                 : 0
+Reset status                    : 3
+CPU info
+    CPU ID                      : 413FD0C1
+    CPU Clock                   : 3000 MHz
+    Number of active sockets    : 1
+    Number of active cores      : 80
+    Socket[0]: Core voltage     : 1050
+    Socket[0]: SCU ProductID    : A10001
+    Socket[0]: Max cores        : 80
+    Socket[0]: Warranty         : 1
+    Socket[0]: Subnuma          : 0
+    Socket[0]: RC disable mask  : 0
+    Socket[0]: AVS enabled      : 1
+    Socket[0]: AVS voltage      : 1013
+    Socket[0]: VDM capability   : 0
+SOC info
+    DDR Frequency               : 2666 MHz
+    Socket[0]: Soc voltage      : 750
+    Socket[0]: DIMM1 voltage    : 1200
+    Socket[0]: DIMM2 voltage    : 1200
+    PCP Clock                   : 1650 MHz
+    SOC Clock                   : 2000 MHz
+    SYS Clock                   : 400 MHz
+    AHB Clock                   : 200 MHz
+User Configuration Setting:
+    8028: 0x1 (1)
+    8038: 0x0 (0)
+    8070: 0x3 (3)
+    8080: 0x0 (0)
+    8088: 0x0 (0)
+    80B0: 0x0 (0)
+    80B8: 0x1 (1)
+    80C8: 0x1 (1)
+    80E0: 0x1 (1)
+    8118: 0x2 (2)
+    8130: 0x1 (1)
+    81B0: 0x0 (0)
+    81B8: 0x0 (0)
+    81C0: 0x0 (0)
+    81C8: 0xFF (255)
+    81D0: 0xFF (255)
+    8208: 0x78 (120)
+    8210: 0x4B0 (1200)
+    8218: 0x1 (1)
+    8220: 0x5A0 (1440)
+    8228: 0x0 (0)
+    8230: 0x0 (0)
+Board Configuration Setting:
+    C000: 0xCD3A (52538)
+    C008: 0x0 (0)
+    C010: 0x0 (0)
+    C018: 0x0 (0)
+    C020: 0xFFFF (65535)
+    C028: 0x0 (0)
+    C030: 0x80E8 (33000)
+    C038: 0x80E8 (33000)
+    C040: 0x2710 (10000)
+    C048: 0x2710 (10000)
+    C050: 0x0 (0)
+    C058: 0x190 (400)
+    C060: 0x190 (400)
+    C068: 0x190 (400)
+    C070: 0x64 (100)
+    C078: 0x190 (400)
+    C080: 0xFFFFFF01 (-255)
+    C088: 0x2020202 (33686018)
+    C090: 0x2020202 (33686018)
+    C098: 0x4 (4)
+    C0A0: 0x4 (4)
+    C0A8: 0x20002 (131074)
+    C0B0: 0x20002 (131074)
+    C0B8: 0x20002 (131074)
+    C0C0: 0x20002 (131074)
+    C0C8: 0x3 (3)
+    C0D0: 0x3 (3)
+    C0D8: 0x3 (3)
+    C0E0: 0x3 (3)
+    C0E8: 0x0 (0)
+    C0F0: 0x0 (0)
+    C0F8: 0x0 (0)
+    C100: 0x0 (0)
+    C108: 0x0 (0)
+    C110: 0x0 (0)
+    C118: 0x0 (0)
+    C120: 0x0 (0)
+    C128: 0x0 (0)
+    C130: 0x0 (0)
+    C138: 0x0 (0)
+    C140: 0x0 (0)
+    C148: 0x1 (1)
+    C150: 0x2 (2)
+    C158: 0x3 (3)
+    C160: 0x4 (4)
+    C168: 0xFFFFFFFF (-1)
+    C170: 0xFFFFFFFE (-2)
+    C178: 0xFFFFFFFD (-3)
+    C180: 0x0 (0)
+    C188: 0x0 (0)
+    C190: 0x0 (0)
+    C198: 0x0 (0)
+    C1A0: 0x0 (0)
+    C1A8: 0x0 (0)
+    C1B0: 0x2 (2)
+    C1B8: 0xC80 (3200)
+    C1C0: 0x20020000 (537001984)
+    C1C8: 0x20020000 (537001984)
+    C1D0: 0x31060177 (822477175)
+    C1D8: 0x31060177 (822477175)
+    C1E0: 0x30060070 (805699696)
+    C1E8: 0x30060070 (805699696)
+    C1F0: 0x0 (0)
+    C1F8: 0x0 (0)
+    C200: 0x0 (0)
+    C208: 0x0 (0)
+    C210: 0x44C0CCC (72092876)
+    C218: 0x84C0CCC (139201740)
+    C220: 0x4130333 (68354867)
+    C228: 0x8130333 (135463731)
+    C230: 0x1130333 (18023219)
+    C238: 0x2230333 (35849011)
+    C240: 0x1430333 (21168947)
+    C248: 0x2830333 (42140467)
+    C250: 0x55EDEED (90103533)
+    C258: 0xA5DEDDE (173927902)
+    C260: 0x55B7BB7 (89881527)
+    C268: 0xA57B77B (173520763)
+    C270: 0x5 (5)
+    C278: 0x90DD90 (9493904)
+    C280: 0x5 (5)
+    C288: 0x90DD90 (9493904)
+    C290: 0x5 (5)
+    C298: 0x90DD90 (9493904)
+    C2A0: 0x5 (5)
+    C2A8: 0x90DD90 (9493904)
+    C2B0: 0x24 (36)
+    C2B8: 0x1A001A (1703962)
+    C2C0: 0x50 (80)
+    C2C8: 0x240020 (2359328)
+    C2D0: 0x2800280 (41943680)
+    C2D8: 0x90909090 (-1869574000)
+    C2E0: 0x0 (0)
+    C2E8: 0xC000C0 (12583104)
+    C2F0: 0x0 (0)
+    C2F8: 0x0 (0)
+    C300: 0x0 (0)
+    C308: 0x0 (0)
+    C310: 0x2010201 (33620481)
+    C318: 0x0 (0)
+    C320: 0x0 (0)
+    C328: 0x0 (0)
+    C330: 0x1050106 (17105158)
+    C338: 0x5F4 (1524)
+    C340: 0x0 (0)
+    C348: 0x0 (0)
+    C350: 0x2020202 (33686018)
+    C358: 0x2020202 (33686018)
+    C360: 0x4 (4)
+    C368: 0x4 (4)
+    C370: 0xFFFFFFFF (-1)
+    C378: 0xFFFFFFFF (-1)
+    C380: 0xFFFFFFFF (-1)
+    C388: 0xFFFFFFFF (-1)
+    C390: 0x0 (0)
+    C398: 0x0 (0)
+    C3A0: 0x0 (0)
+    C3A8: 0x0 (0)
+    C3B0: 0x0 (0)
+    C3B8: 0x0 (0)
+    C3C0: 0x0 (0)
+    C3C8: 0x0 (0)
+    C3D0: 0xFFFFFFFF (-1)
+    C3D8: 0xFFFFFFFF (-1)
+    C3E0: 0xFFFFFFFF (-1)
+    C3E8: 0xFFFFFFFF (-1)
+    C3F0: 0x57575757 (1465341783)
+    C3F8: 0x57575757 (1465341783)
+    C400: 0x57575757 (1465341783)
+    C408: 0x57575757 (1465341783)
+    C410: 0x57575757 (1465341783)
+    C418: 0x57575757 (1465341783)
+    C420: 0x57575757 (1465341783)
+    C428: 0x57575757 (1465341783)
+    C430: 0x57575757 (1465341783)
+    C438: 0x57575757 (1465341783)
+    C440: 0x57575757 (1465341783)
+    C448: 0x57575757 (1465341783)
+    C450: 0x57575757 (1465341783)
+    C458: 0x57575757 (1465341783)
+    C460: 0x57575757 (1465341783)
+    C468: 0x57575757 (1465341783)
+    C470: 0x0 (0)
+    C478: 0x30003 (196611)
+    C480: 0x2020202 (33686018)
+    C488: 0x2020202 (33686018)
+    C490: 0x2020202 (33686018)
+    C498: 0xFFFFFFFF (-1)
+    C4A0: 0xFFFFFFFF (-1)
+    C4A8: 0x0 (0)
+    C4B0: 0x0 (0)
+    C4B8: 0x0 (0)
+    C4C0: 0x0 (0)
+    C4C8: 0x0 (0)
+    C4D0: 0x0 (0)
+    C4D8: 0x0 (0)
+    C4E0: 0x0 (0)
+    C4E8: 0xFFFFFFFF (-1)
+    C4F0: 0xFFFFFFFF (-1)
+    C4F8: 0xFFFFFFFF (-1)
+    C500: 0xFFFFFFFF (-1)
+    C508: 0x57575757 (1465341783)
+    C510: 0x57575757 (1465341783)
+    C518: 0x57575757 (1465341783)
+    C520: 0x57575757 (1465341783)
+    C528: 0x57575757 (1465341783)
+    C530: 0x57575757 (1465341783)
+    C538: 0x57575757 (1465341783)
+    C540: 0x57575757 (1465341783)
+    C548: 0x57575757 (1465341783)
+    C550: 0x57575757 (1465341783)
+    C558: 0x57575757 (1465341783)
+    C560: 0x57575757 (1465341783)
+    C568: 0x57575757 (1465341783)
+    C570: 0x57575757 (1465341783)
+    C578: 0x3 (3)
+    C580: 0x1A4 (420)
+    C588: 0x0 (0)
+    C590: 0x18000 (98304)
+    C598: 0x80018000 (-2147385344)
+    C5A0: 0x0 (0)
+    C5A8: 0x0 (0)
+    C5B0: 0x0 (0)
+    C5B8: 0x0 (0)
+    C5C0: 0x0 (0)
+    C5C8: 0x0 (0)
+    C5D0: 0x0 (0)
+    C5D8: 0x0 (0)
+    C5E0: 0x550055 (5570645)
+    C5E8: 0x64 (100)
+    C5F0: 0x5 (5)
+    C5F8: 0x1 (1)
+    C600: 0x2 (2)
+    C608: 0x5 (5)
+    C610: 0x0 (0)
+    C618: 0x0 (0)
+    C620: 0x0 (0)
+    C628: 0x0 (0)
+    C630: 0x0 (0)
+    C638: 0x0 (0)
+    C640: 0x0 (0)
+    C648: 0x0 (0)
+    C650: 0x0 (0)
+    C658: 0x0 (0)
+    C660: 0x0 (0)
+    C668: 0x1F4 (500)
+    C670: 0x1388 (5000)
+    C678: 0x0 (0)
+    C680: 0x0 (0)
+    C688: 0x0 (0)
+    C690: 0x0 (0)
+    C698: 0x0 (0)
+    C6A0: 0xFFFFFFFF (-1)
+    C6A8: 0xFFFFFFFF (-1)
+    C6B0: 0xFFFFFFFF (-1)
+    C6B8: 0xFFFFFFFF (-1)
+    C6C0: 0xFFFFFFFF (-1)
+    C6C8: 0xFFFFFFFF (-1)
+    C6D0: 0xFFFFFFFF (-1)
+    C6D8: 0xFFFFFFFF (-1)
+    C6E0: 0xFFFFFFFF (-1)
+    C6E8: 0xFFFFFFFF (-1)
+    C6F0: 0xFFFFFFFF (-1)
+    C6F8: 0xFFFFFFFF (-1)
+    C700: 0xFFFFFFFF (-1)
+    C708: 0xFFFFFFFF (-1)
+    C710: 0x57575757 (1465341783)
+    C718: 0x57575757 (1465341783)
+    C720: 0x57575757 (1465341783)
+    C728: 0x57575757 (1465341783)
+    C730: 0x57575757 (1465341783)
+    C738: 0x57575757 (1465341783)
+    C740: 0x57575757 (1465341783)
+    C748: 0x57575757 (1465341783)
+    C750: 0x57575757 (1465341783)
+    C758: 0x57575757 (1465341783)
+    C760: 0x57575757 (1465341783)
+    C768: 0x57575757 (1465341783)
+    C770: 0x57575757 (1465341783)
+    C778: 0x57575757 (1465341783)
+    C780: 0x0 (0)
+    C788: 0x0 (0)
+    C790: 0x1 (1)
+    C798: 0x0 (0)
+    C7A0: 0x0 (0)
+    C7A8: 0x0 (0)
+    C7B0: 0x0 (0)
+    C7B8: 0x0 (0)
+    C7C0: 0x1 (1)
+    C7C8: 0x0 (0)
+    C7D0: 0x0 (0)
+    C7D8: 0x0 (0)
+    C7E0: 0x0 (0)
+    C7E8: 0x0 (0)
+    C7F0: 0x0 (0)
+    C7F8: 0x0 (0)
+Checkpoint 4F
+Checkpoint 60
+Checkpoint 61
+Checkpoint 9A
+Checkpoint 90
+Checkpoint 91
+Checkpoint 92
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 94
+Checkpoint 94
+Checkpoint 94
+Checkpoint 95
+Checkpoint 96
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 91
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 97
+Checkpoint 98
+Checkpoint 9D
+Checkpoint 9A
+Checkpoint 9C
+Checkpoint B4
+Checkpoint B4
+Checkpoint B4
+Checkpoint B4
+Checkpoint B4
+
+Time for GET - https://169.254.0.17:443/redfish/v1/ operation - 295 ms, Status - Success, StatusCode - 3
+
+Time for GET - https://169.254.0.17:443/redfish/v1/Oem/Ami/InventoryData operation - 3039 ms, Status - Success, StatusCode - 3
+
+Time for POST - /redfish/v1/DynamicExtension/RedfishExtensions operation - 1824 ms, Status - Success, StatusCode - 21
+
+Time for POST - /redfish/v1/DynamicExtension/RedfishExtensions operation - 2472 ms, Status - Success, StatusCode - 21
+Checkpoint B4
+Checkpoint B4
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+Checkpoint 92
+
+Press <ESC> + <2> or <DEL> to run UEFI Setup
+Press <ESC> + <6> for Instant Flash
+Press <ESC> + <SHIFT> + <1> for Boot Menu
+Press <Tab> to Switch Screen
+
+Checkpoint A9
+ABCheckpoint AB
+                               Aptio Setup - AMI                                    Main  Advanced  Server Mgmt  Security  Boot  Exit                           /----------------------------------------------------+-------------------------\|  Board Product            ALTRAD8UD-1L2T           |Motherboard Information  ||  System Product           ALTRAD8UD-1L2T           |                         ||  UEFI Version             2.06                     |                         ||  BMC Version              2.07.00                  |                         ||  CPLD_MB Version          0.02                     |                         ||                                                    |                         ||> Motherboard Information                           |                         ||> Processor Information                             |                         ||> Memory Information                                |                         ||                                                    |-------------------------||  System Date              [Wed 10/07/2026]         |<>: Select Screen        ||  System Time              [23:07:04]               |^v: Select Item          ||                                                    |Enter: Select            ||                                                    |+/-: Change Option       ||                                                    |F1: General Help         ||                                                    |F7: Discard Changes      ||                                                    |F9: Load UEFI Defaults   ||                                                    |F10: Save and Exit       ||                                                    |ESC: Exit                |\----------------------------------------------------+-------------------------/                    Version 2.22.1282 Copyright (C) 2024 AMI                   5678910123456789201234567893012345678940123456789501234567898:0012345678910123456789201234567893012345678940123456789501234567899:00123456789101234567892012345678930123456789401234567895012345678910:0012345678910123456789201234567893012345678940123
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/sol-setup-walk.log b/artifacts/bmc/srv13-first-contact-2026-10-07/sol-setup-walk.log
new file mode 100644
index 00000000000..7b312e263bc
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/sol-setup-walk.log
@@ -0,0 +1,3 @@
+tcgetattr: Inappropriate ioctl for device
+[SOL Session operational.  Use ~? for help]
+3456789101234    Main  Advanced |> CPU Configuration                                ^|CPU Configuration        ||> RAS Configuration                                *|Parameters               ||> Chipset Configuration                            *|                         ||> NVMe Configuration                               *|                         ||> ACPI Configuration                               *|                         ||> USB Configuration                                *|                         ||> Serial Port Console Redirection                  *|                         ||> H/W Monitor                                      *|                         ||> Network Stack Configuration                      *|                         ||> Driver Health                                    *|-------------------------||                                                   +|<>: Select Screen        ||> Tls Auth Configuration                           +|^v: Select Item          ||> Intel(R) I210 Gigabit  Network Connection -      +|Enter: Select            ||  9C:6B:00:E7:CA:63                                +|+/-: Change Option       ||> VLAN Configuration (MAC:9C6B00E7CA63)            +|F1: General Help         ||> MAC:9C6B00E7CA63-IPv4 Network Configuration      +|F7: Discard Changes      ||> MAC:9C6B00E7CA63-IPv6 Network Configuration      +|F9: Load UEFI Defaults   ||                                                   v|F10: Save and Exit       ||                                                    |ESC: Exit                |    Main  Advanced  Server Mgmt |  BMC Self Test Status     PASSED                   |                         ||  BMC Device ID            32                       |                         ||  BMC Device Revision      1                        |                         ||  BMC Firmware Revision    2.07.00                  |                         ||  IPMI Version             2.0                      |                         ||  IPMI BMC Interface       SSIF                     |                         ||                                                    |                         ||  Wait For BMC             [Disabled]               |                         ||  Redfish                  [Enabled]                |                         ||  FRB-2 Timer              [Disabled]               |-------------------------||  FRB-2 Timer timeout      6                        |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||  FRB-2 Timer Policy       [Do Nothing]       |  OS Watchdog Timer        [Disabled]|  OS Wtd Timer Timeout     10  |       PASSED^|Wait For BMC response   ^||  32*|for specified time out. *||        1*|In PILOTII, BMC starts  *||      2.07.00*|at the same time when   *||  2.0*|BIOS starts during AC   *||         SSIF*|power ON. It takes      *|*|around 255 seconds to   +||  [Disabled]*|initialize Host to BMC  v|**|        6   *|              **|       10  *|  OS Wtd Timer Policy      [Reset]                 **|> BMC Network Configuration                        +|> System Event Log                                 v|        6   <>: Select Screen        ||              *|^v: Select ItemEnter: Select|       10  +/-: Change Option       ||             *|F1: General Help         |F7: Discard Changes      |F9: Load UEFI Defaults   |F10: Save and Exit       |ESC: Exit    Main  Advanced  Server Mgmt  Security |  Supervisor Password      Not Installed            |Set or change the       ^||  User Password            Not Installed            |password for the        *||                                                    |administrator account.  *||  Supervisor Password                               |Only the administrator  *||  User Password                                     |has authority to change *||                                                    |the settings in the     *||> Secure Boot                                       |UEFI Setup Utility.     +||                                                    |Leave it blank and      v||                                                    |                         ||                                                    |-------------------------||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         |<>: Select Screen        |^v: Select ItemEnter: Select+/-: Change Option       |F1: General Help         |F7: Discard Changes      |F9: Load UEFI Defaults   |F10: Save and Exit       |ESC: Exit    Main  Advanced  Server Mgmt  Security  Boot |                                                    |                         ||  FIXED BOOT ORDER Priorities                       |                         ||  Boot Option #1           [Hard Disk]              |                         ||  Boot Option #2           [NVME]                   |                         ||  Boot Option #3           [CD/DVD]                 |                         ||  Boot Option #4           [USB Device]             |                         ||  Boot Option #5           [Network]                |                         ||  Boot Option #6           [UEFI AP:UEFI:           |                         ||                           Built-in EFI Shell]      |                         ||                                                    |-------------------------||> UEFI Application Boot Priorities                  |                         ||                                                    |                         ||  Setup Prompt Timeout     1                        |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         |Sets the system boot     ||     |order<>: Select Screen        |^v: Select ItemEnter: Select|  Bootup NumLock State     [On]                     |+/-: Change Option       ||  Boot Beep                [Disabled]               |F1: General Help         ||  Full Screen Logo         [Enabled]                |F7: Discard Changes      |F9: Load UEFI Defaults   |F10: Save and Exit       |ESC: Exit Security  Boot  Exit                           |  Supervisor Password      Not Installed            |Set or change the       ^||  User Password            Not Installed            |password for the        *||                                                    |administrator account.  *||  Supervisor Password                               |Only the administrator  *||  User Password                                     |has authority to change *||                                                    |the settings in the     *||> Secure Boot                                       |UEFI Setup Utility.     +||                                                    |Leave it blank and      v||                                                    |                         ||                                                    |-------------------------||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         |<>: Select Screen        |^v: Select ItemEnter: Select+/-: Change Option       |F1: General Help         |F7: Discard Changes      |F9: Load UEFI Defaults   |F10: Save and Exit       |ESC: Exit Server Mgmt  Security  Boot  Exit                           |  BMC Self Test Status     PASSED                   |                         ||  BMC Device ID            32                       |                         ||  BMC Device Revision      1                        |                         ||  BMC Firmware Revision    2.07.00                  |                         ||  IPMI Version             2.0                      |                         ||  IPMI BMC Interface       SSIF                     |                         ||                                                    |                         ||  Wait For BMC             [Disabled]               |                         ||  Redfish                  [Enabled]                |                         ||  FRB-2 Timer              [Disabled]               |-------------------------||  FRB-2 Timer timeout      6                        |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||                                                    |                         ||  FRB-2 Timer Policy       [Do Nothing]       |  OS Watchdog Timer        [Disabled]|  OS Wtd Timer Timeout     10  |       PASSED^|Wait For BMC response   ^||  32*|for specified time out. *||        1*|In PILOTII, BMC starts  *||      2.07.00*|at the same time when   *||  2.0*|BIOS starts during AC   *||         SSIF*|power ON. It takes      *|*|around 255 seconds to   +||  [Disabled]*|initialize Host to BMC  v|**|        6   *|              **|       10  *|  OS Wtd Timer Policy      [Reset]                 **|> BMC Network Configuration                        +|> System Event Log                                 v|        6   <>: Select Screen        ||              *|^v: Select ItemEnter: Select|       10  +/-: Change Option       ||             *|F1: General Help         |F7: Discard Changes      |F9: Load UEFI Defaults   |F10: Save and Exit       |ESC: Exit    Main  Advanced  Server Mgmt  Security  Boot  Exit                           |> CPU Configuration                                ^|CPU Configuration        ||> RAS Configuration                                *|Parameters               ||> Chipset Configuration                            *|                         ||> NVMe Configuration                               *|                         ||> ACPI Configuration                               *|                         ||> USB Configuration                                *|                         ||> Serial Port Console Redirection                  *|                         ||> H/W Monitor                                      *|                         ||> Network Stack Configuration                      *|                         ||> Driver Health                                    *|-------------------------||                                                   +|<>: Select Screen        ||> Tls Auth Configuration                           +|^v: Select Item          ||> Intel(R) I210 Gigabit  Network Connection -      +|Enter: Select            ||  9C:6B:00:E7:CA:63                                +|+/-: Change Option       ||> VLAN Configuration (MAC:9C6B00E7CA63)            +|F1: General Help         ||> MAC:9C6B00E7CA63-IPv4 Network Configuration      +|F7: Discard Changes      ||> MAC:9C6B00E7CA63-IPv6 Network Configuration      +|F9: Load UEFI Defaults   ||                                                   v|F10: Save and Exit       ||                                                    |ESC: Exit                |
\ No newline at end of file
diff --git a/artifacts/bmc/srv13-first-contact-2026-10-07/update-service-before.json b/artifacts/bmc/srv13-first-contact-2026-10-07/update-service-before.json
new file mode 100644
index 00000000000..65e203a2243
--- /dev/null
+++ b/artifacts/bmc/srv13-first-contact-2026-10-07/update-service-before.json
@@ -0,0 +1,19 @@
+{
+  "@odata.id": "/redfish/v1/UpdateService",
+  "@odata.type": "#UpdateService.v1_11_1.UpdateService",
+  "Description": "Service for Software Update",
+  "FirmwareInventory": {
+    "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory"
+  },
+  "HttpPushUri": "/redfish/v1/UpdateService/update",
+  "HttpPushUriOptions": {
+    "HttpPushUriApplyTime": {
+      "ApplyTime": "OnReset"
+    }
+  },
+  "Id": "UpdateService",
+  "MaxImageSizeBytes": 68157440,
+  "MultipartHttpPushUri": "/redfish/v1/UpdateService/update",
+  "Name": "Update Service",
+  "ServiceEnabled": true
+}
\ No newline at end of file
diff --git a/dag/extdeps/ampere/mt_collins_board.dag b/dag/extdeps/ampere/mt_collins_board.dag
new file mode 100644
index 00000000000..2ead8aa6c43
--- /dev/null
+++ b/dag/extdeps/ampere/mt_collins_board.dag
@@ -0,0 +1,43 @@
+module extdeps.ampere.mt_collins_board
+
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.board_authority { BoardAuthorityRef }
+import extdeps.ampere.mt_collins_getting_started_guide.subject { mt_collins_gsg_authority }
+import extdeps.ampere.mt_collins_product_brief.subject { MtCollinsPublicProductBrief, mt_collins_public_product_brief }
+
+data extdeps_external_authority_anchor: ExternalAuthority = mt_collins_gsg_authority
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.ampere.mt_collins_board",
+      decl_name: "mt_collins_board",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps_external_authority_anchor,
+  further_citations: []
+}
+
+// THE MT. COLLINS BOARD AS A SUBJECT, joining the two Ampere documents that already own its facts
+// rather than restating either: the Getting Started Guide (figures, orientation) and the public
+// product brief. A board-grain subject exists so a bound host's board can reach its per-board
+// authority by reference instead of through a closed enum.
+type MtCollinsBoard {
+  getting_started_guide: ExternalAuthority
+  product_brief: MtCollinsPublicProductBrief
+}
+
+data mt_collins_board: MtCollinsBoard = MtCollinsBoard {
+  getting_started_guide: mt_collins_gsg_authority,
+  product_brief: mt_collins_public_product_brief,
+}
+
+data mt_collins_board_authority: BoardAuthorityRef = BoardAuthorityRef {
+  subject: DeclarationRef {
+    module_path: "extdeps.ampere.mt_collins_board",
+    decl_name: "mt_collins_board",
+    field: WholeDeclaration
+  }
+}
diff --git a/dag/extdeps/ampere/mt_collins_firmware_release.dag b/dag/extdeps/ampere/mt_collins_firmware_release.dag
index c04568dd11d..b06cab1272d 100644
--- a/dag/extdeps/ampere/mt_collins_firmware_release.dag
+++ b/dag/extdeps/ampere/mt_collins_firmware_release.dag
@@ -1,10 +1,10 @@
 module extdeps.ampere.mt_collins_firmware_release
 
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
 import std.types { Int, NonEmptyStr, List }
 import std.measure { ByteSize, byte_size, Second, second }
 import extdeps.crypto.hash { sha256_digest }
 import std.optional { Present }
-import extdeps.boards.types { AmpereMtCollins }
 import extdeps.firmware.types {
   FirmwareReleaseRow, FirmwareTarget, FirmwareSemanticVersion,
   BmcController, HostBios, ScpFirmware, MainboardCpld,
@@ -42,7 +42,7 @@ data mt_collins_firmware_delivery_authority: ExternalAuthority = ExternalAuthori
 }
 
 data mt_collins_bmc_0_45_3_hpm: FirmwareReleaseRow = FirmwareReleaseRow {
-  board: AmpereMtCollins,
+  board: mt_collins_board_authority,
   target: BmcController,
   version: firmware_semantic_version(major: 0, minor: 45, patch: 3),
   released_on: 1703635200000,
@@ -56,7 +56,7 @@ data mt_collins_bmc_0_45_3_hpm: FirmwareReleaseRow = FirmwareReleaseRow {
 }
 
 data mt_collins_bios_0acod014_hpm: FirmwareReleaseRow = FirmwareReleaseRow {
-  board: AmpereMtCollins,
+  board: mt_collins_board_authority,
   target: HostBios,
   version: firmware_semantic_version(major: 0, minor: 14, patch: 0),
   released_on: 1702339200000,
@@ -70,7 +70,7 @@ data mt_collins_bios_0acod014_hpm: FirmwareReleaseRow = FirmwareReleaseRow {
 }
 
 data mt_collins_scp_2_10_hpm: FirmwareReleaseRow = FirmwareReleaseRow {
-  board: AmpereMtCollins,
+  board: mt_collins_board_authority,
   target: ScpFirmware,
   version: firmware_semantic_version(major: 2, minor: 10, patch: 0),
   released_on: 1674691200000,
@@ -84,7 +84,7 @@ data mt_collins_scp_2_10_hpm: FirmwareReleaseRow = FirmwareReleaseRow {
 }
 
 data mt_collins_mb_cpld_v06_hpm: FirmwareReleaseRow = FirmwareReleaseRow {
-  board: AmpereMtCollins,
+  board: mt_collins_board_authority,
   target: MainboardCpld,
   version: firmware_semantic_version(major: 6, minor: 0, patch: 0),
   released_on: 1654560000000,
diff --git a/dag/extdeps/bmc/access_profile.dag b/dag/extdeps/bmc/access_profile.dag
index 5a196f7dbfa..3c2b37cbe33 100644
--- a/dag/extdeps/bmc/access_profile.dag
+++ b/dag/extdeps/bmc/access_profile.dag
@@ -8,7 +8,11 @@ import extdeps.external_authority { ExternalAuthority, ExternalModelScope, Exter
 import extdeps.uri { Uri, Https }
 import std.credentials { FactoryLogin }
 import extdeps.bmc.endpoint { BmcControllerEndpoint }
-import extdeps.boards.types { BaseboardModel }
+import extdeps.board_authority {
+  BoardAuthorityRef, BoardAuthorityBinding, BoardAuthorityLookup, BoardFruObservation,
+  board_authority_for, board_facts_authority, board_authority_ref_eq
+}
+import std.optional { Present, Absent }
 import extdeps.bmc.capability { BmcFirmwareReleaseCapabilityRow, BmcFirmwareReleaseIdentity, bmc_firmware_release_identity_eq }
 import extdeps.bmc.megarac { MegaRacImageRedirection }
 import extdeps.bmc.redfish_virtual_media { RedfishVirtualMediaProbeReceipt }
@@ -82,7 +86,7 @@ type ChassisApplicability
   | AllChassisVariants
 
 type BmcAccessProfileKey {
-  baseboard: BaseboardModel
+  board: BoardAuthorityRef
   chassis: ChassisApplicability
   firmware: BmcFirmwareReleaseIdentity
 }
@@ -147,7 +151,7 @@ fn bmc_access_profile_catalog_row_standing(row: BmcAccessProfileCatalogRow) -> B
 // alone, so a same-version endpoint cannot be paired with an unrelated board's
 // profile. The firmware is carried ONCE, here.
 type BmcObservedIdentity {
-  baseboard: BaseboardModel
+  board: BoardFruObservation
   chassis_part_number: NonEmptyStr?
   firmware: BmcFirmwareReleaseIdentity
 }
@@ -200,8 +204,17 @@ fn chassis_applicability_admits(applicability: ChassisApplicability, observed: N
 
 // The profile key binds baseboard, chassis applicability, and exact release
 // (family and raw vendor string). Equal firmware alone is not a binding.
-fn bmc_access_profile_key_matches(key: BmcAccessProfileKey, identity: BmcObservedIdentity) -> Bool {
-  key.baseboard == identity.baseboard
+// The board is the authority the host's OWN FRU reaches through the supplied bindings, and a profile
+// imports board FACTS, so only an evidence-bound board matches.
+fn bmc_observed_board_facts_authority(identity: BmcObservedIdentity, bindings: List<BoardAuthorityBinding>) -> BoardAuthorityRef? {
+  board_facts_authority(lookup: board_authority_for(observation: identity.board, bindings: bindings))
+}
+
+fn bmc_access_profile_key_matches(key: BmcAccessProfileKey, identity: BmcObservedIdentity, bindings: List<BoardAuthorityBinding>) -> Bool {
+  (match bmc_observed_board_facts_authority(identity: identity, bindings: bindings) {
+    Present { value: a } => board_authority_ref_eq(a: key.board, b: a)
+    Absent => false
+  })
     && chassis_applicability_admits(applicability: key.chassis, observed: identity.chassis_part_number)
     && bmc_firmware_release_identity_eq(a: key.firmware, b: identity.firmware)
 }
@@ -211,6 +224,7 @@ fn bmc_access_profile_key_matches(key: BmcAccessProfileKey, identity: BmcObserve
 // standings (gunbc.machine_intake_access), not arms here.
 type BmcAccessProfileLookup
   = AccessProfileKnown { profile: BmcAccessProfile, provenance: BmcAccessProfileProvenance }
+  | AccessProfileBoardNotFactsBound { observed_identity: BmcObservedIdentity, board: BoardAuthorityLookup }
   | AccessProfileUncatalogued { observed_identity: BmcObservedIdentity }
   | AccessProfileAmbiguous { observed_identity: BmcObservedIdentity, count: Int }
   | AccessProfileCatalogRowRefused { standing: BmcAccessProfileCatalogRowStanding }
@@ -238,11 +252,14 @@ fn catalog_first_refused(catalog: List<BmcAccessProfileCatalogRow>) -> BmcAccess
 fn bmc_access_profile_for(
   identity: BmcObservedIdentity,
   catalog: List<BmcAccessProfileCatalogRow>,
+  bindings: List<BoardAuthorityBinding>,
 ) -> BmcAccessProfileLookup {
   match catalog_first_refused(catalog: catalog) {
     Present { value: refused } => AccessProfileCatalogRowRefused { standing: refused }
-    Absent => {
-      let hits = catalog |> filter(row => bmc_access_profile_key_matches(key: row.profile.key, identity: identity))
+    Absent => match bmc_observed_board_facts_authority(identity: identity, bindings: bindings) {
+     Absent => AccessProfileBoardNotFactsBound { observed_identity: identity, board: board_authority_for(observation: identity.board, bindings: bindings) }
+     Present { value: _ } => {
+      let hits = catalog |> filter(row => bmc_access_profile_key_matches(key: row.profile.key, identity: identity, bindings: bindings))
       let n = count(hits)
       if n == 0 {
         AccessProfileUncatalogued { observed_identity: identity }
@@ -255,6 +272,7 @@ fn bmc_access_profile_for(
       } else {
         AccessProfileAmbiguous { observed_identity: identity, count: n }
       }
+     }
     }
   }
 }
@@ -276,8 +294,9 @@ fn bmc_surface_eligibility(
   profile: BmcAccessProfile,
   observation: BmcAccessObservation,
   surface: BmcAccessSurface,
+  bindings: List<BoardAuthorityBinding>,
 ) -> BmcSurfaceEligibility {
-  if bmc_access_profile_key_matches(key: profile.key, identity: observation.identity) == false {
+  if bmc_access_profile_key_matches(key: profile.key, identity: observation.identity, bindings: bindings) == false {
     SurfaceProfileObservationIdentityMismatch { profile: profile.key, observed: observation.identity }
   } else if bmc_surface_in(surfaces: profile.candidate_surfaces, surface: surface) == false {
     SurfaceAbsentFromProfile
diff --git a/dag/extdeps/bmc/megarac.dag b/dag/extdeps/bmc/megarac.dag
index 9e58a1d2ea3..c8ce1a0937e 100644
--- a/dag/extdeps/bmc/megarac.dag
+++ b/dag/extdeps/bmc/megarac.dag
@@ -14,7 +14,6 @@ import extdeps.uri { Uri, Https }
 import extdeps.vendor { Vendor }
 import extdeps.hardware { Hardware }
 import extdeps.vendor.ami { ami }
-import extdeps.languages.json.emit { JsonValue, json_object, json_array, json_kv, json_int, json_string, serialize_json_array }
 import std.resources { Network }
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
@@ -106,7 +105,7 @@ data megarac_op_media_images: MegaRacApiOperation = MegaRacApiOperation {
 data megarac_op_media_start: MegaRacApiOperation = MegaRacApiOperation {
   http_method: "POST",
   path: "/api/settings/media/remote/start-media",
-  contract_note: "JSON body MUST carry image_redirection:1 beside image_name, image_type (1 = CD) and image_index; without image_redirection the firmware refuses with opaque codes 13410/13460. Recovered from the firmware's own UI bundle (source.min.js), not from documentation. Success attaches a redirection session visible at /api/settings/media/remote/configurations (redirection_status started or connecting via megarac_redirection_status_of_wire, session_index bound)",
+  contract_note: "JSON body MUST carry image_redirection:1 beside image_name, image_type (1 = CD) and image_index; without image_redirection the firmware refuses with opaque codes (the executed sequence above always carries it). Success attaches a redirection session visible at /api/settings/media/remote/configurations (redirection_status started or connecting via megarac_redirection_status_of_wire, session_index bound)",
 }
 
 data megarac_op_media_stop: MegaRacApiOperation = MegaRacApiOperation {
@@ -162,14 +161,8 @@ fn megarac_image_redirection_wire(r: MegaRacImageRedirectionRequired) -> NonEmpt
   }
 }
 
-// ---------------------------------------------------------------------------------------------
-// SERVED SP-X UI SURFACE CATALOG, keyed to firmware identity 0.32. The capture receipt (path
-// and digest) is gunbc.machine_intake_megarac_served_ui_catalog_observation; this module keeps
-// only firmware-identity-keyed facts about that surface. The catalog is a FACT ABOUT THIS
-// FIRMWARE'S SERVED UI PATHS, not a family-wide MegaRAC claim, and not a redirection_status map:
-// AMI advertises Redfish on other builds; this surface does not carry it. Status-code meanings
-// are a separate fact, cited on megarac_redirection_status_of_wire.
-// ---------------------------------------------------------------------------------------------
+// FIRMWARE IDENTITY 0.32: the Foxconn Mt. Collins build these rows were executed against. Status-code
+// meanings are cited on megarac_redirection_status_of_wire.
 data megarac_firmware_0_32: BmcFirmwareReleaseIdentity = bmc_firmware_release_identity_of_wire(
   family: AmiMegaRac,
   wire: "0.32",
@@ -178,15 +171,15 @@ data megarac_firmware_0_32: BmcFirmwareReleaseIdentity = bmc_firmware_release_id
 // THE BMC IS THE NFS CLIENT. settings/media/general carries the NFS server, source path and
 // share type; the host sees a virtual CD. PXE is not a term of this route. The required
 // image_redirection fact is MegaRacImageRedirectionRequired / megarac_op_media_start.
-// REDIRECTION_STATUS. The 255-path catalog does not contain these mappings. The codes that this
+// REDIRECTION_STATUS. The codes that this
 // decoder names are the ones committed observations actually returned on firmware 0.32:
 // 0 stopped (gunbc.runner_host_media_independence_receipt mtcollins1_independence_evidence), 1 started
 // and 100 connecting (gunbc.machine_intake_mtcollins1_diskless_boot_receipt
 // mtcollins1_diskless_boot_artifact_path, and
 // gunbc.machine_intake_mtcollins1_memory_census_observation mtcollins1_media_redirection_samples).
 // Connecting is presenting: the same unit booted GRUB from a session that still read 100.
-// Any other numeric code on a catalogued firmware is an uncatalogued wire, not a named denial
-// recovered from source.min.js (those bytes are not in the tree). A firmware identity this row
+// Any other numeric code on a catalogued firmware is an uncatalogued wire, not a named denial.
+// A firmware identity this row
 // does not catalog refuses rather than inheriting 0.32's numbers.
 type MegaRacRedirectionStatus
   = RedirectionStopped
@@ -241,179 +234,6 @@ fn megarac_redirection_presentation_standing(
   }
 }
 
-// CONSOLE RECORDERS. Two recorders, two subjects. video/* records the framebuffer the KVM
-// renders; sol-triggers records the SOL stream. Both persist across resets. The SOL object's
-// chassis-power-on field is spelled chasis_power_on_events_enable (upstream typo); the video
-// object spells chassis_power_on_events_enable. Model what upstream sends.
-//
-// §3c frontier: megarac_recorder_trigger_power_on_field, megarac_trigger_power_on_field_wire,
-// megarac_recorder_reset_survival, and the four data rows they bind. Consumer: the PreOs
-// console-recorder / live-SOL axis in gunbc.machine_intake_pre_os_observation_capabilities on
-// gunbc#11110 (this PR does not mint that file). Until that lands, an arming PUT cannot be keyed
-// to the subject's wire spelling, and live sol activate cannot be distinguished from a recorder
-// that survives reset.
-type MegaRacConsoleRecorderSubject
-  = FramebufferRecorder
-  | SolStreamRecorder
-
-type MegaRacTriggerPowerOnFieldName
-  = ChassisPowerOnEventsEnable
-  | ChasisPowerOnEventsEnable
-
-fn megarac_recorder_trigger_power_on_field(subject: MegaRacConsoleRecorderSubject) -> MegaRacTriggerPowerOnFieldName {
-  match subject {
-    FramebufferRecorder => ChassisPowerOnEventsEnable
-    SolStreamRecorder => ChasisPowerOnEventsEnable
-  }
-}
-
-data megarac_video_trigger_power_on_field: MegaRacTriggerPowerOnFieldName = megarac_recorder_trigger_power_on_field(subject: FramebufferRecorder)
-
-data megarac_sol_trigger_power_on_field: MegaRacTriggerPowerOnFieldName = megarac_recorder_trigger_power_on_field(subject: SolStreamRecorder)
-
-fn megarac_trigger_power_on_field_wire(name: MegaRacTriggerPowerOnFieldName) -> NonEmptyStr {
-  match name {
-    ChassisPowerOnEventsEnable => "chassis_power_on_events_enable" as NonEmptyStr
-    ChasisPowerOnEventsEnable => "chasis_power_on_events_enable" as NonEmptyStr
-  }
-}
-
-type MegaRacResetSurvival
-  = SurvivesHostAndControllerReset
-  | DiesOnReset
-
-fn megarac_recorder_reset_survival(subject: MegaRacConsoleRecorderSubject) -> MegaRacResetSurvival {
-  match subject {
-    FramebufferRecorder => SurvivesHostAndControllerReset
-    SolStreamRecorder => SurvivesHostAndControllerReset
-  }
-}
-
-data megarac_framebuffer_recorder_reset_survival: MegaRacResetSurvival = megarac_recorder_reset_survival(subject: FramebufferRecorder)
-
-data megarac_sol_recorder_reset_survival: MegaRacResetSurvival = megarac_recorder_reset_survival(subject: SolStreamRecorder)
-
-data megarac_live_sol_activate_reset_survival: MegaRacResetSurvival = DiesOnReset
-
-// WHAT THIS SERVED UI CAN AND CANNOT DO, as PATH PRESENCE in the 0.32 catalog. They are not
-// omissions and not unit telemetry. Per-DIMM AEP inventory and api/fru ARE in the catalog
-// (api/aep_inventory/aep_dimm_info, api/fru); a controller answering nothing through those paths
-// is a unit observation, not a served-surface absence. BIOS *settings* (`settings/bios`) are
-// absent; flash/version (`api/maintenance/hpm/getbiosversions`) is present. MegaRacWebEventLogOemDescriptionUnknown
-// was the same fork: the renderer answering unknown is not a missing path. Ampere OEM SEL
-// producer layout is extdeps.ampere.oem_sel.
-//
-// §3c frontier: megarac_served_ui_surface_standing. Consumer: the PreOs capability axes that
-// would claim Redfish or a BIOS/UEFI settings surface, on
-// gunbc.machine_intake_pre_os_observation_capabilities (gunbc#11110; this PR does not mint that
-// file). Until that lands, a firmware this decoder does not catalog cannot refuse an inherited
-// 0.32 presence map. The coproduct carries present surfaces so Absent is not the only
-// constructible known answer: a Bool that can only be true is a decoration.
-type MegaRacServedUiSurface
-  = RedfishService
-  | BiosUefiSettings
-  | FruInventory
-  | AepDimmInventory
-  | BiosVersionFlash
-
-type MegaRacServedUiSurfacePresence
-  = ServedUiSurfacePresent
-  | ServedUiSurfaceAbsent
-
-// THE CATALOG SUBSTRING EACH SURFACE IS NAMED BY. The presence map below is a transcription of the
-// 0.32 served-UI catalog (gunbc.machine_intake_megarac_served_ui_catalog_observation, hashed and
-// committed); this row is the join that makes it checkable against the bytes rather than a second
-// authored list beside them (review 66694): the integrity witness asks, for every surface, that
-// the catalog contains the substring exactly when the map says Present.
-fn megarac_served_ui_surface_catalog_token(surface: MegaRacServedUiSurface) -> NonEmptyStr {
-  match surface {
-    RedfishService => "redfish"
-    BiosUefiSettings => "settings/bios"
-    FruInventory => "api/fru"
-    AepDimmInventory => "api/aep_inventory/aep_dimm_info"
-    BiosVersionFlash => "api/maintenance/hpm/getbiosversions"
-  }
-}
-
-data megarac_served_ui_surfaces: List<MegaRacServedUiSurface> = [RedfishService, BiosUefiSettings, FruInventory, AepDimmInventory, BiosVersionFlash]
-
-fn megarac_served_ui_surface_presence_at_0_32(surface: MegaRacServedUiSurface) -> MegaRacServedUiSurfacePresence {
-  match surface {
-    RedfishService => ServedUiSurfaceAbsent
-    BiosUefiSettings => ServedUiSurfaceAbsent
-    FruInventory => ServedUiSurfacePresent
-    AepDimmInventory => ServedUiSurfacePresent
-    BiosVersionFlash => ServedUiSurfacePresent
-  }
-}
-
-type MegaRacServedUiFactLookup
-  = ServedUiFactKnown { firmware: BmcFirmwareReleaseIdentity, presence: MegaRacServedUiSurfacePresence }
-  | ServedUiFactFirmwareUncatalogued { firmware: BmcFirmwareReleaseIdentity }
-
-fn megarac_served_ui_surface_standing(
-  firmware: BmcFirmwareReleaseIdentity,
-  surface: MegaRacServedUiSurface,
-) -> MegaRacServedUiFactLookup {
-  if bmc_firmware_release_identity_eq(a: firmware, b: megarac_firmware_0_32) {
-    ServedUiFactKnown {
-      firmware: firmware,
-      presence: megarac_served_ui_surface_presence_at_0_32(surface: surface),
-    }
-  } else {
-    ServedUiFactFirmwareUncatalogued { firmware: firmware }
-  }
-}
-
-// SCREEN CAPTURE SURFACES AT 0.32. Read-only probe 2026-09-27 of the bundles served at
-// https://192.168.1.228/source.min.js (gzip, sha256 5029fae278f7fc8f4dd4ad5eb8e4457e49fa25d4d0158d4bf9fbab09f57d4bf3)
-// and /viewer.min.js (sha256 8bdfbb72c6449eaf64ab232a413abe257c2eec5af5d46fbe960c14534fab3e17).
-// THERE IS NO SERVER-SIDE ON-DEMAND STILL. The H5 viewer's "Capture Screen" is captureScreen():
-// document.getElementById("kvm").toDataURL("image/jpeg") saved as CaptureScreen.jpeg. That is a canvas
-// the browser painted by decoding the AST2100 stream from wss://<bmc>/kvm (session token from
-// /api/kvm/token), so a still exists only where a KVM client is running. The firmware itself
-// keeps two retained screens: the last BSOD JPEG (feature CAPTURE_BSOD_JPEG, GET
-// /api/settings/download_image), and framebuffer recordings made by FramebufferRecorder when an
-// armed /api/settings/video/triggers event fires (chassis power on/off/reset, lpc reset, watchdog,
-// critical/non-critical/non-recoverable, fan state, or a date_time schedule), listed at
-// /api/logs/video with bytes at /api/logs/video-data?file=. No IPMI OEM capture command appears
-// in either bundle.
-type MegaRacScreenCaptureRoute
-  = KvmClientCanvasJpeg
-  | LastBsodJpeg
-  | TriggeredFramebufferRecording
-  | ServerSideOnDemandStill
-
-type MegaRacScreenCaptureStanding
-  = ScreenCaptureServedOnDemand
-  | ScreenCaptureEventRetainedOnly
-  | ScreenCaptureClientSideOnly
-  | ScreenCaptureAbsent
-
-fn megarac_screen_capture_standing_at_0_32(route: MegaRacScreenCaptureRoute) -> MegaRacScreenCaptureStanding {
-  match route {
-    KvmClientCanvasJpeg => ScreenCaptureClientSideOnly
-    LastBsodJpeg => ScreenCaptureEventRetainedOnly
-    TriggeredFramebufferRecording => ScreenCaptureEventRetainedOnly
-    ServerSideOnDemandStill => ScreenCaptureAbsent
-  }
-}
-
-type MegaRacScreenCaptureLookup
-  = ScreenCaptureFactKnown { firmware: BmcFirmwareReleaseIdentity, standing: MegaRacScreenCaptureStanding }
-  | ScreenCaptureFirmwareUncatalogued { firmware: BmcFirmwareReleaseIdentity }
-
-fn megarac_screen_capture_standing(
-  firmware: BmcFirmwareReleaseIdentity,
-  route: MegaRacScreenCaptureRoute,
-) -> MegaRacScreenCaptureLookup {
-  if bmc_firmware_release_identity_eq(a: firmware, b: megarac_firmware_0_32) {
-    ScreenCaptureFactKnown { firmware: firmware, standing: megarac_screen_capture_standing_at_0_32(route: route) }
-  } else {
-    ScreenCaptureFirmwareUncatalogued { firmware: firmware }
-  }
-}
-
 // EVENT LOG SHAPE. The web log and ipmitool are two layouts. GenID1/GenID2 on the standard-event
 // template are manufacturer bytes; they have no Sender constructor. Ampere's published producer
 // layout for those manufacturer bytes is extdeps.ampere.oem_sel.
@@ -430,47 +250,6 @@ data megarac_web_event_log_layout: MegaRacEventLogLayout = MegaRacWebEventLogOem
 
 data megarac_ipmi_sel_layout: MegaRacEventLogLayout = MegaRacIpmiSelPayloadPreserved
 
-// THE WEB SESSION AND KVM VIEWER WIRE, AS THE 0.32 UI READS IT. Recovered from the bundles served at
-// https://192.168.1.228 on 2026-09-27 (source.min.js, gzip sha256
-// 5029fae278f7fc8f4dd4ad5eb8e4457e49fa25d4d0158d4bf9fbab09f57d4bf3; viewer.min.js sha256
-// 8bdfbb72c6449eaf64ab232a413abe257c2eec5af5d46fbe960c14534fab3e17):
-// - POST /api/session (form fields username, password) answers JSON; the login handler treats
-//   `ok === 0` as success and reads CSRFToken, privilege, extendedpriv and racsession_id from it, then
-//   sends X-CSRFTOKEN on every later request.
-// - GET /api/settings/services answers a JSON list of service rows; the KVM launcher finds the row
-//   whose service_name is "kvm" and opens viewer.html only when its viewer_count is 0.
-// - DELETE /api/session (X-CSRFTOKEN) ends the session (the viewer's own logout).
-// - The H5 viewer opens a WebSocket at /kvm (subprotocols binary, base64) and paints canvas#kvm.
-// A REFUSED LOGIN'S BODY AND STATUS ON 0.32 HAVE NOT BEEN CAPTURED, so this module states none: what
-// the UI establishes is only that a reply without ok === 0 is not a session. A simulated controller's
-// refusal is its renderer's choice (gunbc.bmc_megarac_web_adapter), never this upstream's.
-// These are the fields the UI reads, not the whole reply: a reply may carry more.
-data megarac_kvm_websocket_path: NonEmptyStr = "/kvm"
-
-type MegaRacLoginSession {
-  csrf_token: String
-  privilege: Int
-  extended_privilege: Int
-  racsession_id: Int
-}
-
-fn megarac_login_session_json(session: MegaRacLoginSession) -> JsonValue {
-  json_object(members: [
-    json_kv(key: "ok", value: json_int(n: 0)),
-    json_kv(key: "CSRFToken", value: json_string(s: session.csrf_token)),
-    json_kv(key: "privilege", value: json_int(n: session.privilege)),
-    json_kv(key: "extendedpriv", value: json_int(n: session.extended_privilege)),
-    json_kv(key: "racsession_id", value: json_int(n: session.racsession_id)),
-  ])
-}
-
-fn megarac_services_kvm_json(viewer_count: Int) -> JsonValue {
-  json_array(elements: [json_object(members: [
-    json_kv(key: "service_name", value: json_string(s: "kvm")),
-    json_kv(key: "viewer_count", value: json_int(n: viewer_count)),
-  ])])
-}
-
 // THE OPERATIONS ABOVE ARE A DESCRIPTION; THESE ARE THE OPERATIONS. megarac_api_operations records
 // paths and contract notes and carries no transport, so nothing in this repository could invoke the
 // MegaRAC media surface — the first attach against a Mt. Collins unit was therefore driven by a
@@ -508,8 +287,8 @@ fn megarac_services_kvm_json(viewer_count: Int) -> JsonValue {
 // positive control that the stored bytes log in.
 //
 // StartMedia's json_body MUST CARRY image_redirection AND ITS ABSENCE IS OPAQUE. The contract note
-// on the operation row above records that omitting it makes the firmware refuse with codes
-// 13410/13460, recovered from the firmware's own UI bundle rather than from documentation. The body
+// on the operation row above records that omitting it makes the firmware refuse with opaque
+// codes; every executed attach carries it. The body
 // is a caller parameter rather than a baked literal because image_index is resolved by READING the
 // images listing, never assumed, and megarac_image_redirection_wire is the authority for the field
 // itself.
@@ -623,41 +402,3 @@ service megarac.Media {
     }
   }
 }
-
-// THE VALUE THE SP-X UI STORES AS sessionStorage "features": JSON.stringify of its project-configurations
-// collection, an array of {"feature": NAME} objects; the viewer's KVM view reads it with unguarded
-// indexOf calls. Which names a given build carries is an OBSERVATION this repository made of that
-// build's served bundle, so it is a receipt in the observing layer
-// (gunbc.machine_intake_megarac_ui_features megarac_ui_features_0_32_receipt), not a fact owned here.
-fn megarac_ui_features_json(names: List<NonEmptyStr>) -> String {
-  serialize_json_array(elements: map(names, n => json_object(members: [json_kv(key: "feature", value: json_string(s: n as String))])))
-}
-
-// THE FIRMWARE'S OWN UI BUNDLE, SERVED AT A FIXED PATH. The SP-X web UI is one minified bundle the
-// login page loads before any session exists, so the GET carries no cookie and no token and opens no
-// session to release. The codes this module cites as "recovered from source.min.js" (start-media's
-// 13410/13460, the served api/ surface, the KVM wire) were read from these bytes; the operation is the
-// route that re-reads them instead of a hand-run probe.
-//
-// THE BYTES ARE WRITTEN AS SERVED. `Accept-Encoding: gzip` without --compressed asks for the encoding
-// the 2026-09-27 read recorded (gzip) and leaves it undecoded, so a digest of dest_file is a digest of
-// the served bytes, comparable with that read. stdout carries only the write-out: the HTTP status and
-// the byte count, space-separated on one line.
-data megarac_ui_bundle_path: NonEmptyStr = "/source.min.js"
-
-service megarac.Ui {
-
-  operation GetServedBundle {
-    requires Network
-    input { bmc_host: NonEmptyStr, bundle_path: NonEmptyStr, dest_file: NonEmptyStr, max_time: NonEmptyStr }
-    output { writeout: String from "stdout", stderr: String from "stderr", exit_code: Int from "exit_code", success: Bool from "exit_success" }
-    readonly
-    transport shell {
-      argv: ["curl", "--fail-with-body", "-sS", "-k", "--max-time", "{max_time}", "-H", "Accept-Encoding: gzip", "-o", "{dest_file}", "-w", "%\{http_code} %\{size_download}", "https://{bmc_host}{bundle_path}"]
-    }
-    exit {
-      0 => Unit
-      nonzero => String "megarac UI bundle GET failed"
-    }
-  }
-}
diff --git a/dag/extdeps/bmc/megarac_observed_output.dag b/dag/extdeps/bmc/megarac_observed_output.dag
index 6633306a62b..5af3b0a87ee 100644
--- a/dag/extdeps/bmc/megarac_observed_output.dag
+++ b/dag/extdeps/bmc/megarac_observed_output.dag
@@ -53,15 +53,10 @@ fn megarac_image_row(image_name: String, image_index: Int) -> String {
 // test.claim.machine_intake.megarac_session_release_witness_test, `{"error":"invalid session"}` with 401.
 data megarac_invalid_session_body: String = "{\"error\":\"invalid session\"}"
 
-// POST /api/session. NO SESSION REPLY IS RETAINED VERBATIM. The member names are those the firmware's
-// own web UI reads (source.min.js, probed 2026-09-27 on branch session/eager-koi-811), and the production
-// decoder reads only CSRFToken.
-data megarac_session_body_standing: CitedFigureStanding = TranscribedUncited {
-  read_obligation: "a retained POST /api/session reply from the Mt. Collins MegaRAC, cited by digest" as NonEmptyStr
-}
-
-fn megarac_session_body(racsession_id: Int, csrf_token: String) -> String {
-  join(["{ \"ok\": 0, \"privilege\": 4, \"extendedpriv\": 259, \"racsession_id\": ", to_string(racsession_id), ", \"CSRFToken\": \"", csrf_token, "\" }"], "")
+// POST /api/session: a CONTROLLED FIXTURE, not a reply from the controller. It carries only the one
+// field the production decoder reads (CSRFToken); the decoder's contract is the sole ground for its shape.
+fn megarac_session_body(csrf_token: String) -> String {
+  join(["{ \"CSRFToken\": \"", csrf_token, "\" }"], "")
 }
 
 // The replies to start-media, stop-media and DELETE /api/session on success are not decoded by the
diff --git a/dag/extdeps/bmc/redfish.dag b/dag/extdeps/bmc/redfish.dag
index 53b4f34790c..d2a583593d6 100644
--- a/dag/extdeps/bmc/redfish.dag
+++ b/dag/extdeps/bmc/redfish.dag
@@ -5,8 +5,13 @@ import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
 import extdeps.bmc.types { BmcGroundedHostObservations, BmcTelemetrySnapshot, FanTachSensor, RedfishMemorySummary, RedfishPowerControl, RedfishPowerState, RedfishPowerSubsystem, RedfishProcessorSummary, RedfishSensorReading, RedfishSystemInventory, TemperatureSensor }
 import std.measure { ByteSize, Gibibyte, HardwareThreadCount, gibibyte_to_byte_size, watt, watt_count }
-import std.types { Int, List, NonEmptyStr }
+import std.types { Bool, Int, List, NonEmptyStr, String }
 import std.optional { Present, Absent }
+import extdeps.languages.json.parse {
+  parse_json_document, json_field, json_field_string,
+  JsonDocumentParsed, JsonDocumentUnreadable, FieldRead, FieldAbsent, FieldMalformed,
+}
+import extdeps.languages.json.emit { JsonValue, JsonNull, JsonBool, JsonNumber, JsonString, JsonArray, JsonObject }
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {
     scheme: Https
@@ -137,3 +142,62 @@ fn bmc_ground_host_observations(snapshot: BmcTelemetrySnapshot) -> BmcGroundedHo
 fn redfish_system_total_memory_bytes(inv: RedfishSystemInventory) -> ByteSize {
   inv.memory.total_memory_bytes
 }
+
+// DMTF REDFISH BASE MESSAGE REGISTRY, PasswordChangeRequired (DSP8011, Base 1.x): a service
+// answers an authenticated request with this message when the account's password must be changed
+// before any other access is granted, and the only admitted request is a PATCH of that account's
+// Password property. It is not an authentication failure: the credential was accepted. Observed on
+// ASRock Rack ALTRAD8UD-1L2T OpenBMC 3.22.00 (srv13, 2026-10-08) as HTTP 403 whose top-level
+// @Message.ExtendedInfo carries MessageId "Base.1.16.0.PasswordChangeRequired"; a wrong password on
+// the same service is a bare 401. The registry version varies by service, so the id is matched as
+// the "Base." registry prefix plus the ".PasswordChangeRequired" key, and the message is read from
+// either the top-level annotation (bmcweb) or the standard error object's annotation.
+type RedfishPasswordChangeVerdict
+  = RedfishPasswordChangeRequired
+  | RedfishPasswordChangeNotIndicated
+
+fn redfish_message_id_is_password_change_required(id: String) -> Bool {
+  starts_with(s: id, prefix: "Base.") && ends_with(s: id, suffix: ".PasswordChangeRequired")
+}
+
+fn redfish_message_requires_password_change(message: JsonValue) -> Bool {
+  match json_field_string(obj: message, key: "MessageId") {
+    FieldRead { value: id } => redfish_message_id_is_password_change_required(id: id)
+    FieldAbsent => false
+    FieldMalformed { cause: _ } => false
+  }
+}
+
+fn redfish_extended_info_requires_password_change(holder: JsonValue) -> Bool {
+  match json_field(obj: holder, key: "@Message.ExtendedInfo") {
+    FieldRead { value: v } =>
+      match v {
+        JsonArray { elements: elements } =>
+          fold(elements, init: false, f: fn(acc, m) { acc || redfish_message_requires_password_change(message: m) })
+        JsonNull => false
+        JsonBool { value: _ } => false
+        JsonNumber { lexeme: _ } => false
+        JsonString { value: _ } => false
+        JsonObject { members: _ } => false
+      }
+    FieldAbsent => false
+    FieldMalformed { cause: _ } => false
+  }
+}
+
+fn redfish_password_change_verdict(body: String) -> RedfishPasswordChangeVerdict {
+  match parse_json_document(s: body) {
+    JsonDocumentUnreadable { gap: _ } => RedfishPasswordChangeNotIndicated
+    JsonDocumentParsed { value: doc } =>
+      if redfish_extended_info_requires_password_change(holder: doc) {
+        RedfishPasswordChangeRequired
+      } else {
+        match json_field(obj: doc, key: "error") {
+          FieldRead { value: err } =>
+            if redfish_extended_info_requires_password_change(holder: err) { RedfishPasswordChangeRequired } else { RedfishPasswordChangeNotIndicated }
+          FieldAbsent => RedfishPasswordChangeNotIndicated
+          FieldMalformed { cause: _ } => RedfishPasswordChangeNotIndicated
+        }
+      }
+  }
+}
diff --git a/dag/extdeps/board_authority.dag b/dag/extdeps/board_authority.dag
new file mode 100644
index 00000000000..3144babf963
--- /dev/null
+++ b/dag/extdeps/board_authority.dag
@@ -0,0 +1,146 @@
+module extdeps.board_authority
+
+import std.decl_ref { DeclarationRef, WholeDeclaration, declaration_ref_eq }
+import std.types { Bool, Int, List, NonEmptyStr }
+import std.content_hash { Sha256Digest }
+import v2.std.algebra { filter }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "www.intel.com/content/dam/www/public/us/en/documents/specification-updates/ipmi-platform-mgt-fru-info-storage-def-v1-0-rev-1-3-spec-update.pdf"
+  }
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.board_authority",
+      decl_name: "BoardFruIdentity",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps_external_authority_anchor,
+  further_citations: []
+}
+
+// THE AGNOSTIC SHAPES OF "WHICH BOARD IS THIS HOST", and nothing else. This module enumerates no
+// product (DESIGN section 3, External upstream decomposition): the board a host reports is the
+// Board Area of its own FRU (Platform Management FRU Information Storage Definition, Board Area:
+// manufacturer, product name, part number), and the board a consumer reasons about is an
+// authority REFERENCE to the per-board subject module that owns that board's facts. Adding a board
+// is a per-board module plus one binding row in the consumer layer, never an edit here. The rows
+// and the table live in gunbc.board_authority_binding; this module owns only the shapes and the one
+// fold that reads a table.
+type BoardFruIdentity {
+  manufacturer: NonEmptyStr
+  product: NonEmptyStr
+  part_number: NonEmptyStr?
+}
+
+// WHY NO FRU BOARD AREA WAS READ. Never defaulted: a host whose board was not read is a different
+// fact from a host whose board is read and unbound.
+type BoardFruUnreadCause
+  = BoardAreaAbsent
+  | BoardAreaFieldsUnreadable
+
+type BoardFruObservation
+  = BoardFruRead { fru: BoardFruIdentity }
+  | BoardFruNotRead { cause: BoardFruUnreadCause }
+
+// A BOARD'S AUTHORITY IS THE DECLARATION OF ITS OWN SUBJECT. Equality is declaration_ref_eq, so two
+// references agree exactly when they name the same declaration. Each per-board module exports its
+// own reference; no consumer spells one.
+type BoardAuthorityRef {
+  subject: DeclarationRef
+}
+
+fn board_authority_ref_eq(a: BoardAuthorityRef, b: BoardAuthorityRef) -> Bool {
+  declaration_ref_eq(a: a.subject, b: b.subject)
+}
+
+// WHAT JUSTIFIES THE EDGE, in the type so a consumer cannot read the strong standing off prose.
+// BoundByNameOnly: the FRU's names agree with the subject's name and nothing else does; that is an
+// inference from a name, typed as a bet with the discriminator that would settle it.
+// BoundByObservedEvidence: an observation beyond the name (cited receipts) agrees with the
+// subject's own cited facts.
+type BoardBindingStanding
+  = BoundByNameOnly { discriminator_obligation: NonEmptyStr }
+  | BoundByObservedEvidence { first: DeclarationRef, further: List<DeclarationRef> }
+
+// THE COMMITTED FRU READ the row was authored from: path and sha256 of the bytes.
+type BoardFruReceipt {
+  artifact_path: NonEmptyStr
+  sha256: Sha256Digest
+}
+
+type BoardAuthorityBinding {
+  manufacturer: NonEmptyStr
+  product: NonEmptyStr
+  authority: BoardAuthorityRef
+  standing: BoardBindingStanding
+  fru_receipt: BoardFruReceipt
+}
+
+// IDENTITY-GRADE USES (keying a reading, pairing a reading with a board) accept either bound arm;
+// USES THAT IMPORT BOARD FACTS (figures, profile routes) accept BoardEvidenceBound only.
+type BoardAuthorityLookup
+  = BoardIdentityBound { authority: BoardAuthorityRef, discriminator_obligation: NonEmptyStr }
+  | BoardEvidenceBound { authority: BoardAuthorityRef, first: DeclarationRef, further: List<DeclarationRef> }
+  | BoardUnbound { fru: BoardFruIdentity }
+  | BoardAmbiguous { fru: BoardFruIdentity, count: Int }
+  | BoardNotRead { cause: BoardFruUnreadCause }
+
+fn binding_names_fru(binding: BoardAuthorityBinding, fru: BoardFruIdentity) -> Bool {
+  binding.manufacturer == fru.manufacturer && binding.product == fru.product
+}
+
+fn bound_lookup_of(binding: BoardAuthorityBinding) -> BoardAuthorityLookup {
+  match binding.standing {
+    BoundByNameOnly { discriminator_obligation: o } => BoardIdentityBound { authority: binding.authority, discriminator_obligation: o }
+    BoundByObservedEvidence { first: f, further: r } => BoardEvidenceBound { authority: binding.authority, first: f, further: r }
+  }
+}
+
+// THE ONE TOTAL FOLD. Exact manufacturer and product; the part number is carried, not matched.
+// Refuses on both sides of uniqueness; an unread board is never read as unbound.
+fn board_authority_for(observation: BoardFruObservation, bindings: List<BoardAuthorityBinding>) -> BoardAuthorityLookup {
+  match observation {
+    BoardFruNotRead { cause: c } => BoardNotRead { cause: c }
+    BoardFruRead { fru: f } => {
+      let hits = bindings |> filter(b => binding_names_fru(binding: b, fru: f))
+      let n = count(hits)
+      if n == 0 {
+        BoardUnbound { fru: f }
+      } else if n == 1 {
+        fold(hits, init: BoardUnbound { fru: f }, f: (_acc, b) => bound_lookup_of(binding: b))
+      } else {
+        BoardAmbiguous { fru: f, count: n }
+      }
+    }
+  }
+}
+
+// The authority a lookup reached for an IDENTITY-GRADE use, absent when the board is not bound.
+fn board_identity_authority(lookup: BoardAuthorityLookup) -> BoardAuthorityRef? {
+  match lookup {
+    BoardIdentityBound { authority: a, discriminator_obligation: _ } => Present { value: a }
+    BoardEvidenceBound { authority: a, first: _, further: _ } => Present { value: a }
+    BoardUnbound { fru: _ } => none
+    BoardAmbiguous { fru: _, count: _ } => none
+    BoardNotRead { cause: _ } => none
+  }
+}
+
+// The authority a lookup reached for a FACTS use: only the evidence-bound arm.
+fn board_facts_authority(lookup: BoardAuthorityLookup) -> BoardAuthorityRef? {
+  match lookup {
+    BoardEvidenceBound { authority: a, first: _, further: _ } => Present { value: a }
+    BoardIdentityBound { authority: _, discriminator_obligation: _ } => none
+    BoardUnbound { fru: _ } => none
+    BoardAmbiguous { fru: _, count: _ } => none
+    BoardNotRead { cause: _ } => none
+  }
+}
diff --git a/dag/extdeps/boards/asrock_altrad8ud_beta_firmware.dag b/dag/extdeps/boards/asrock_altrad8ud_beta_firmware.dag
index 7970f719a77..e259c774880 100644
--- a/dag/extdeps/boards/asrock_altrad8ud_beta_firmware.dag
+++ b/dag/extdeps/boards/asrock_altrad8ud_beta_firmware.dag
@@ -58,34 +58,40 @@ data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
 
 data asrock_altrad8ud_beta_disclaimer: NonEmptyStr = "Beta firmware is still undergoing final testing; use is at the user's risk and ASRock Rack assumes no responsibility. ASRock Rack recommends keeping current firmware when the system works properly."
 
+data asrock_altrad8ud_beta_bios_4_01_listing: AsrockAltrad8udBetaFirmwareListing = AsrockAltrad8udBetaFirmwareListing {
+  target: HostBios,
+  version: SemanticFirmwareVersion { value: firmware_semantic_version(major: 4, minor: 1, patch: 0) },
+  listed_on: 1776124800000,
+  packages: [
+    AsrockBetaFirmwarePackage { image_kind: InstantFlashRom, displayed_size: AsrockUnresolvedDisplaySize { decimal_interpretation: byte_size(count: 5110000), decimal_increment: byte_size(count: 10000) } },
+    AsrockBetaFirmwarePackage { image_kind: OpenBmcWebUiTar, displayed_size: AsrockUnresolvedDisplaySize { decimal_interpretation: byte_size(count: 5110000), decimal_increment: byte_size(count: 10000) } },
+  ],
+  description: "Updated RC to 0ACRB_022",
+}
+
+data asrock_altrad8ud_beta_bmc_3_22_00_listing: AsrockAltrad8udBetaFirmwareListing = AsrockAltrad8udBetaFirmwareListing {
+  target: BmcController,
+  version: SemanticFirmwareVersion { value: asrock_altrad8ud_bmc_3_22_00_release.version },
+  listed_on: 1772064000000,
+  packages: [
+    AsrockBetaFirmwarePackage { image_kind: OpenBmcWebUiTar, displayed_size: AsrockUnresolvedDisplaySize { decimal_interpretation: byte_size(count: 27710000), decimal_increment: byte_size(count: 10000) } },
+  ],
+  description: "A password change is enforced upon the first login to the WebUI",
+}
+
+data asrock_altrad8ud_beta_scp_2_10_20260210_listing: AsrockAltrad8udBetaFirmwareListing = AsrockAltrad8udBetaFirmwareListing {
+  target: ScpFirmware,
+  version: ScpBuildVersion { major: 2, minor: 10, build_date: Iso8601CivilDate { year: 2026, month: 2, day: 10 } },
+  listed_on: 1776729600000,
+  packages: [
+    AsrockBetaFirmwarePackage { image_kind: OpenBmcWebUiTar, displayed_size: AsrockUnresolvedDisplaySize { decimal_interpretation: byte_size(count: 165250), decimal_increment: byte_size(count: 10) } },
+    AsrockBetaFirmwarePackage { image_kind: InstantFlashSlim, displayed_size: AsrockUnresolvedDisplaySize { decimal_interpretation: byte_size(count: 165010), decimal_increment: byte_size(count: 10) } },
+  ],
+  description: "Ampere SCP firmware",
+}
+
 data asrock_altrad8ud_beta_firmware_listings: List<AsrockAltrad8udBetaFirmwareListing> = [
-  AsrockAltrad8udBetaFirmwareListing {
-    target: HostBios,
-    version: SemanticFirmwareVersion { value: firmware_semantic_version(major: 4, minor: 1, patch: 0) },
-    listed_on: 1776124800000,
-    packages: [
-      AsrockBetaFirmwarePackage { image_kind: InstantFlashRom, displayed_size: AsrockUnresolvedDisplaySize { decimal_interpretation: byte_size(count: 5110000), decimal_increment: byte_size(count: 10000) } },
-      AsrockBetaFirmwarePackage { image_kind: OpenBmcWebUiTar, displayed_size: AsrockUnresolvedDisplaySize { decimal_interpretation: byte_size(count: 5110000), decimal_increment: byte_size(count: 10000) } },
-    ],
-    description: "Updated RC to 0ACRB_022",
-  },
-  AsrockAltrad8udBetaFirmwareListing {
-    target: BmcController,
-    version: SemanticFirmwareVersion { value: asrock_altrad8ud_bmc_3_22_00_release.version },
-    listed_on: 1772064000000,
-    packages: [
-      AsrockBetaFirmwarePackage { image_kind: OpenBmcWebUiTar, displayed_size: AsrockUnresolvedDisplaySize { decimal_interpretation: byte_size(count: 27710000), decimal_increment: byte_size(count: 10000) } },
-    ],
-    description: "A password change is enforced upon the first login to the WebUI",
-  },
-  AsrockAltrad8udBetaFirmwareListing {
-    target: ScpFirmware,
-    version: ScpBuildVersion { major: 2, minor: 10, build_date: Iso8601CivilDate { year: 2026, month: 2, day: 10 } },
-    listed_on: 1776729600000,
-    packages: [
-      AsrockBetaFirmwarePackage { image_kind: OpenBmcWebUiTar, displayed_size: AsrockUnresolvedDisplaySize { decimal_interpretation: byte_size(count: 165250), decimal_increment: byte_size(count: 10) } },
-      AsrockBetaFirmwarePackage { image_kind: InstantFlashSlim, displayed_size: AsrockUnresolvedDisplaySize { decimal_interpretation: byte_size(count: 165010), decimal_increment: byte_size(count: 10) } },
-    ],
-    description: "Ampere SCP firmware",
-  },
+  asrock_altrad8ud_beta_bios_4_01_listing,
+  asrock_altrad8ud_beta_bmc_3_22_00_listing,
+  asrock_altrad8ud_beta_scp_2_10_20260210_listing,
 ]
diff --git a/dag/extdeps/boards/asrock_rack.dag b/dag/extdeps/boards/asrock_rack.dag
index 84911d45687..9c816286eb3 100644
--- a/dag/extdeps/boards/asrock_rack.dag
+++ b/dag/extdeps/boards/asrock_rack.dag
@@ -44,6 +44,7 @@ import std.coordinate_frame { CoordinateFrameIdentity, coordinate_frame_identity
 import std.affine_space { point2 }
 import std.orthogonal_geometry { AxisAlignedRectangle2, OrthogonalConstruction, axis_aligned_rectangle2 }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.board_authority { BoardAuthorityRef }
 import extdeps.standards.micro_atx { MountingLocationId, LocB, LocC, LocF, LocH, LocJ, LocL, LocM, LocR, LocS }
 import extdeps.cpu.types { CpuSocket }
 import extdeps.cpu.ampere { ampere_lga4926_socket }
@@ -81,8 +82,16 @@ data asrock_altrad8ud_srv3_nbd_proxy_ws_dry_run_authority: ExternalAuthority = E
   }
 }
 
+data asrock_altrad8ud_board_authority: BoardAuthorityRef = BoardAuthorityRef {
+  subject: DeclarationRef {
+    module_path: "extdeps.boards.asrock_rack",
+    decl_name: "asrock_altrad8ud_1l2t_catalog",
+    field: WholeDeclaration
+  }
+}
+
 data asrock_altrad8ud_1l2t_catalog: BaseboardCatalogRow = BaseboardCatalogRow {
-  model: AsrockRackAltrad8ud1l2t,
+  model: asrock_altrad8ud_board_authority,
   model_label: "ASRock Rack ALTRAD8UD-1L2T",
   vendor: asrock_rack,
   bmc_firmware: OpenBmc,
@@ -367,7 +376,7 @@ fn live_probe_confirms_nbd_slot_ws_absent() -> Bool {
 // versioned and separately flashed: srv4 runs BMC 03.22.00 and still fails to
 // boot, so "this host is on the current firmware" is not a single fact.
 data asrock_altrad8ud_bios_3_10_instant_flash_release: FirmwareReleaseRow = FirmwareReleaseRow {
-  board: AsrockRackAltrad8ud1l2t,
+  board: asrock_altrad8ud_board_authority,
   target: HostBios,
   version: firmware_semantic_version(major: 3, minor: 10, patch: 0),
   released_on: 1776124800000,
@@ -388,7 +397,7 @@ data asrock_altrad8ud_bios_3_10_instant_flash_release: FirmwareReleaseRow = Firm
 }
 
 data asrock_altrad8ud_bios_3_10_openbmc_release: FirmwareReleaseRow = FirmwareReleaseRow {
-  board: AsrockRackAltrad8ud1l2t,
+  board: asrock_altrad8ud_board_authority,
   target: HostBios,
   version: firmware_semantic_version(major: 3, minor: 10, patch: 0),
   released_on: 1776124800000,
@@ -429,7 +438,7 @@ data asrock_altrad8ud_bios_3_10_obmc_manifest_purpose: NonEmptyStr = "xyz.openbm
 data asrock_altrad8ud_bios_3_10_obmc_manifest_machine_name: NonEmptyStr = "altrad8ud-1l2t"
 
 data asrock_altrad8ud_bmc_3_22_00_release: FirmwareReleaseRow = FirmwareReleaseRow {
-  board: AsrockRackAltrad8ud1l2t,
+  board: asrock_altrad8ud_board_authority,
   target: BmcController,
   version: firmware_semantic_version(major: 3, minor: 22, patch: 0),
   released_on: 1776124800000,
@@ -438,13 +447,33 @@ data asrock_altrad8ud_bmc_3_22_00_release: FirmwareReleaseRow = FirmwareReleaseR
     scheme: Https
     locator: "www.asrockrack.com/general/productdetail.asp?Model=ALTRAD8UD-1L2T"
   },
-  image_bytes: byte_size(count: 29056000),
-  image_digest: Absent,
+  image_bytes: byte_size(count: 29060210),
+  image_digest: Present {
+    value: sha256_digest(
+      hex: "0c1f458c396aff76ae0259509ea05c53eef57809fa202721875586792fa807bb",
+    ),
+  },
   release_notes: "1. A password change is enforced upon the first login to the WebUI  2. Improved BMC web information  3. Enhanced BMC system compatibility",
   prerequisite: NoFirmwarePrerequisite,
   authority: asrock_altrad8ud_download_authority,
 }
 
+// The push member inside the 03.22.00 distribution zip: a static-layout OpenBMC image
+// (u-boot, kernel, rofs, rwfs, each RSA-SHA256 signed) whose MANIFEST declares
+// purpose BMC, version 3.22.00, BuildId 20260217040008, MachineName altrad8ud-1l2t.
+// The zip's own bytes are the release row's image_digest; these are the bytes the
+// UpdateService consumes. Measured 2026-10-08 and pushed to srv13, which then
+// reported BMC image 3.22.00 in its firmware inventory.
+data asrock_altrad8ud_bmc_3_22_00_push_artifact_name: NonEmptyStr = "altrad8ud-1l2t_3.22.00.static.mtd.tar"
+
+data asrock_altrad8ud_bmc_3_22_00_push_artifact_bytes: ByteSize = byte_size(count: 29347840)
+
+data asrock_altrad8ud_bmc_3_22_00_push_artifact_digest: Digest = sha256_digest(
+  hex: "cb8b8e727174b8383f90f36e967838c46105bd42bc76cc08c4ac1383a88ca9de",
+)
+
+data asrock_altrad8ud_bmc_3_22_00_manifest_purpose: NonEmptyStr = "xyz.openbmc_project.Software.Version.VersionPurpose.BMC"
+
 data asrock_altrad8ud_firmware_release_catalog: List<FirmwareReleaseRow> = [
   asrock_altrad8ud_bios_3_10_instant_flash_release,
   asrock_altrad8ud_bios_3_10_openbmc_release,
@@ -474,7 +503,7 @@ data asrock_altrad8ud_firmware_release_catalog: List<FirmwareReleaseRow> = [
 // the minimum evidence rather than an inference from the vendor page (which
 // states no such dependency at all).
 data asrock_altrad8ud_bios_310_push_refused_at_bmc_207: FirmwarePrerequisiteObservation = FirmwarePrerequisiteObservation {
-  board: AsrockRackAltrad8ud1l2t,
+  board: asrock_altrad8ud_board_authority,
   subject: HostBios,
   image_kind: OpenBmcWebUiTar,
   gating_target: BmcController,
@@ -486,7 +515,7 @@ data asrock_altrad8ud_bios_310_push_refused_at_bmc_207: FirmwarePrerequisiteObse
 }
 
 data asrock_altrad8ud_bios_310_push_accepted_at_bmc_322: FirmwarePrerequisiteObservation = FirmwarePrerequisiteObservation {
-  board: AsrockRackAltrad8ud1l2t,
+  board: asrock_altrad8ud_board_authority,
   subject: HostBios,
   image_kind: OpenBmcWebUiTar,
   gating_target: BmcController,
@@ -515,11 +544,11 @@ data asrock_altrad8ud_bios_openbmc_prerequisite_evidence: List<FirmwarePrerequis
 // modules installed in it — note in particular that the four-module
 // population is A1+B1+E1+F1 and is NOT one module per channel.
 data asrock_altrad8ud_documented_dimm_populations: List<DimmPopulation> = [
-  DimmPopulation { board: AsrockRackAltrad8ud1l2t, slots: ["A1"], authority: extdeps_external_authority_anchor },
-  DimmPopulation { board: AsrockRackAltrad8ud1l2t, slots: ["A1", "E1"], authority: extdeps_external_authority_anchor },
-  DimmPopulation { board: AsrockRackAltrad8ud1l2t, slots: ["A1", "B1", "E1", "F1"], authority: extdeps_external_authority_anchor },
+  DimmPopulation { board: asrock_altrad8ud_board_authority, slots: ["A1"], authority: extdeps_external_authority_anchor },
+  DimmPopulation { board: asrock_altrad8ud_board_authority, slots: ["A1", "E1"], authority: extdeps_external_authority_anchor },
+  DimmPopulation { board: asrock_altrad8ud_board_authority, slots: ["A1", "B1", "E1", "F1"], authority: extdeps_external_authority_anchor },
   DimmPopulation {
-    board: AsrockRackAltrad8ud1l2t,
+    board: asrock_altrad8ud_board_authority,
     slots: ["A1", "B1", "C1", "D1", "E1", "F1", "G1", "H1"],
     authority: extdeps_external_authority_anchor,
   },
diff --git a/dag/extdeps/boards/gigabyte.dag b/dag/extdeps/boards/gigabyte.dag
index 5670be68a37..a79b823fadf 100644
--- a/dag/extdeps/boards/gigabyte.dag
+++ b/dag/extdeps/boards/gigabyte.dag
@@ -17,6 +17,7 @@ import extdeps.boards.types {
 import extdeps.vendor.gigabyte { gigabyte }
 
 import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.board_authority { BoardAuthorityRef }
 import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
 import extdeps.uri { Uri, Https }
 
@@ -53,8 +54,22 @@ data gigabyte_mp72_hb0_marketplace_listing_authority: ExternalAuthority = Extern
   }
 }
 
+// The MP72-HB0 is a CANDIDATE reference board with no fleet instance: no PhysicalAsset cites it, no
+// host's FRU binds to it (gunbc.board_authority_binding carries no row for it), and it is consumed
+// only as the contrast row of the board-profile witness and the forged-probe control. It exists so
+// the private machine-tile carrier can compare a dual-socket profile against a vendor-grounded row
+// rather than against prose. Dissolution trigger: if no asset cites it once the procurement gate
+// closes either way, delete this authority, its catalog row and those two controls.
+data gigabyte_mp72_hb0_board_authority: BoardAuthorityRef = BoardAuthorityRef {
+  subject: DeclarationRef {
+    module_path: "extdeps.boards.gigabyte",
+    decl_name: "gigabyte_mp72_hb0_catalog",
+    field: WholeDeclaration
+  }
+}
+
 data gigabyte_mp72_hb0_catalog: BaseboardCatalogRow = BaseboardCatalogRow {
-  model: GigabyteMp72Hb0,
+  model: gigabyte_mp72_hb0_board_authority,
   model_label: "Gigabyte MP72-HB0 (rev. 3.0)",
   vendor: gigabyte,
   bmc_firmware: OpenBmc,
diff --git a/dag/extdeps/boards/types.dag b/dag/extdeps/boards/types.dag
index 0a6b8277990..ce5a548e9f8 100644
--- a/dag/extdeps/boards/types.dag
+++ b/dag/extdeps/boards/types.dag
@@ -11,6 +11,7 @@ import std.measure {
 import extdeps.bmc.endpoint { BmcFirmwareFamily, BmcEndpoint }
 import extdeps.vendor { Vendor }
 import extdeps.hardware { Hardware }
+import extdeps.board_authority { BoardAuthorityRef }
 
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
@@ -22,18 +23,8 @@ data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   }
 }
 
-// GigabyteMp72Hb0 is a CANDIDATE reference board with no fleet instance: no PhysicalAsset cites it
-// and no host resolves to it. It exists so the private machine-tile carrier can compare a
-// dual-socket profile against a vendor-grounded row rather than against prose. An arm with no
-// instantiation carries a dissolution trigger: if no asset cites it once the procurement gate
-// closes either way, delete the arm.
-type BaseboardModel
-  = AsrockRackAltrad8ud1l2t
-  | GigabyteMp72Hb0
-  | AmpereMtCollins
-
 type BaseboardCatalogRow {
-  model: BaseboardModel
+  model: BoardAuthorityRef
   model_label: NonEmptyStr
   vendor: Vendor<Hardware>
   bmc_firmware: BmcFirmwareFamily
@@ -48,7 +39,7 @@ type ServerBaseboard {
 // this list is not a smaller version of a supported one — it is an
 // unsupported configuration whose failure proves nothing about the modules.
 type DimmPopulation {
-  board: BaseboardModel
+  board: BoardAuthorityRef
   slots: List<NonEmptyStr>
   authority: ExternalAuthority
 }
diff --git a/dag/extdeps/bootloader/grub.dag b/dag/extdeps/bootloader/grub.dag
index e1e351e4ae8..7508600afb4 100644
--- a/dag/extdeps/bootloader/grub.dag
+++ b/dag/extdeps/bootloader/grub.dag
@@ -81,6 +81,19 @@ fn grub_config_render(cfg: GrubConfig) -> String {
   join([header, body], "\n")
 }
 
+// The first linux/initrd command's literal operand in a generated configuration.
+// This is a narrow read, not an interpreter for arbitrary GRUB scripts: computed
+// or quoted operands remain different from the literal path a caller expects.
+fn grub_first_command_operand(config: String, command: String) -> String? {
+  let rows = map(split(s: config, delimiter: "\n"), line =>
+    filter(flat_map(split(s: trim(s: line), delimiter: "\t"), part => split(s: part, delimiter: " ")), word => word != ""))
+  let commands = filter(rows, words => match words.first() { Present { value: word } => word == command Absent => false })
+  match commands.first() {
+    Absent => none
+    Present { value: words } => words.skip(n: 1).first()
+  }
+}
+
 data grub_console_banner_prefix: NonEmptyStr = "GNU GRUB  version "
 data grub_failed_default_and_fallback: NonEmptyStr = "Failed to boot both default and fallback entries."
 data grub_error_prefix: NonEmptyStr = "error: "
diff --git a/dag/extdeps/cache.dag b/dag/extdeps/cache.dag
index 39e9a9e6a16..a6aecf69def 100644
--- a/dag/extdeps/cache.dag
+++ b/dag/extdeps/cache.dag
@@ -25,8 +25,6 @@ import extdeps.cache.types {
   CatalogOpaqueStringKey,
   CatalogCasContentDigest,
 }
-import extdeps.realization.parse_table_memo { parse_table_memo_facts, parse_table_memo_id }
-import extdeps.realization.compile_stage_memo { compile_stage_memo_facts, compile_stage_memo_id }
 import extdeps.realization.reconcile_in_process {
   parse_cache_facts,
   typed_module_cache_facts,
@@ -128,8 +126,6 @@ data sccache_local: CacheInterfaceCatalogFacts = sccache_local_facts
 data buildbuddy_cas: CacheInterfaceCatalogFacts = buildbuddy_cas_facts
 data cargo_target_dir: CacheInterfaceCatalogFacts = cargo_target_dir_facts
 data rustup_toolchain_store: CacheInterfaceCatalogFacts = rustup_toolchain_store_facts
-data parse_table_memo: CacheInterfaceCatalogFacts = parse_table_memo_facts
-data compile_stage_memo: CacheInterfaceCatalogFacts = compile_stage_memo_facts
 
 data cache_catalog: List<CacheInterfaceCatalogFacts> = [
   gha_actions_cache,
@@ -139,8 +135,6 @@ data cache_catalog: List<CacheInterfaceCatalogFacts> = [
   rustup_toolchain_store,
   parse_cache_facts,
   typed_module_cache_facts,
-  parse_table_memo,
-  compile_stage_memo_facts,
   materialization_store_local_facts,
 ]
 
@@ -148,11 +142,10 @@ data cache_catalog_rows: List<CacheInterfaceFacts> = cache_catalog
   |> map(row => cache_interface_facts_from_catalog(row: row))
 
 data sccache_local_projected: CacheInterfaceFacts = cache_interface_facts_from_catalog(sccache_local)
-data parse_table_memo_projected: CacheInterfaceFacts = cache_interface_facts_from_catalog(parse_table_memo)
+data parse_cache_projected: CacheInterfaceFacts = cache_interface_facts_from_catalog(parse_cache_facts)
 data cargo_target_dir_projected: CacheInterfaceFacts = cache_interface_facts_from_catalog(cargo_target_dir)
 
 data cache_layer_default_order: List<CacheInterfaceId> = [
-  parse_table_memo_id,
   parse_cache_id,
   typed_module_cache_id,
   cargo_target_dir_id,
@@ -160,5 +153,4 @@ data cache_layer_default_order: List<CacheInterfaceId> = [
   rustup_toolchain_store_id,
   buildbuddy_cas_id,
   gha_actions_cache_id,
-  compile_stage_memo_id,
 ]
diff --git a/dag/extdeps/cadquery/cadquery.dag b/dag/extdeps/cadquery/cadquery.dag
index 3c2173319ae..d7b5212778e 100644
--- a/dag/extdeps/cadquery/cadquery.dag
+++ b/dag/extdeps/cadquery/cadquery.dag
@@ -1,6 +1,6 @@
 module extdeps.cadquery.cadquery
 
-import extdeps.exec.program { ProgramIdentity, uncataloged_program }
+import extdeps.python { python_program }
 
 import std.types { Bool, String, NonEmptyStr, List }
 import std.measure { Micrometer, micrometer_count }
@@ -41,7 +41,6 @@ data cadquery_ocp_distribution: OcpDistribution = OcpWithVtk
 
 // PATH-resolved, for the reason extdeps.exec.command program_spelling_is_an_observation_claim
 // records: an absolute path is a claim about a filesystem this repository has not observed.
-fn python_program() -> ProgramIdentity = uncataloged_program(invocation: "python3")
 
 // RUN ONE EMITTED PROGRAM. The script path is the caller's -- this module has no authority to
 // enumerate the programs a consumer might run, exactly as extdeps.tools.make refuses to enumerate
diff --git a/dag/extdeps/cloud/hetzner.dag b/dag/extdeps/cloud/hetzner.dag
index 51669baa568..40ec97f1e03 100644
--- a/dag/extdeps/cloud/hetzner.dag
+++ b/dag/extdeps/cloud/hetzner.dag
@@ -34,6 +34,26 @@ data hetzner_data_protection_overview_page: ExternalAuthority = ExternalAuthorit
   }
 }
 
+data hetzner_cloud_servers_faq_page: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "docs.hetzner.com/cloud/servers/faq/"
+  }
+}
+
+// Read 2026-10-07 from hetzner_cloud_servers_faq_page: "Can I run virtual machines on cloud servers,
+// or rather is nested virtualization possible? No, this is not possible on cloud server." The page
+// states it for every cloud server type, so it is one fact about the product, not a per-type row. A
+// guest therefore exposes no usable KVM device, and any execution path that boots its own VMM inside
+// the guest (extdeps.virtualization.firecracker firecracker_requires_kvm_device) cannot run there.
+data hetzner_cloud_nested_virtualization_available: Bool = false
+
+// THE SERVER METADATA SERVICE: every cloud server reaches it at the link-local address and reads its
+// own facts there, among them `instance-id`, the server's numeric id -- the same id the Cloud API
+// names it by (docs.hetzner.cloud/reference/cloud, "Server Metadata"). It answers only the server
+// asking, so what a guest reads there is which resource it is.
+data hetzner_cloud_metadata_instance_id_url: String = "http://169.254.169.254/hetzner/v1/metadata/instance-id"
+
 type HetznerCloudServerType = Cax11 | Cax21 | Cax31 | Cax41
 
 data hetzner_money_rate_frontier_rows: List<FrontierRow> = [
diff --git a/dag/extdeps/cloud/hetzner_cloud_api.dag b/dag/extdeps/cloud/hetzner_cloud_api.dag
new file mode 100644
index 00000000000..24f9e31bc82
--- /dev/null
+++ b/dag/extdeps/cloud/hetzner_cloud_api.dag
@@ -0,0 +1,213 @@
+module extdeps.cloud.hetzner_cloud_api
+import std.resources { Network }
+
+import std.types { Int, NonEmptyStr, String, Secret }
+import extdeps.transports.rest { RestResult, RestAnswered, RestRefused, RestRefusal }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import extdeps.uri { Uri, Https }
+
+// THE HETZNER CLOUD API, v1: the operation surface for servers and the actions they run. It is its
+// own module rather than rows in extdeps.cloud.hetzner, which carries the product's catalog and
+// published pages: the API is an independently versioned interface over that product (DESIGN §3,
+// external upstream decomposition), and a `service` declaration binds its first name segment in every
+// importer, so it stays out of the module the pricing consumers import.
+//
+// Only what the fleet's per-job reset reads is modeled: one server read, the rebuild action, and the
+// action read that says whether it finished. Every field below is one the reference documents for
+// that response; nothing here is inferred from an observed response.
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri { scheme: Https, locator: "docs.hetzner.cloud/reference/cloud" }
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.cloud.hetzner_cloud_api",
+      decl_name: "hetzner_cloud_api_base",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps_external_authority_anchor,
+  further_citations: []
+}
+
+data hetzner_cloud_api_base: NonEmptyStr = "https://api.hetzner.cloud/v1"
+
+// EVERY REFUSED RESPONSE CARRIES `{"error": {"code", "message"}}`, whose code is a documented token
+// (not_found, unauthorized, forbidden, locked, conflict, rate_limit_exceeded, ...).
+type HetznerCloudApiError {
+  code: String
+  message: String
+}
+
+type HetznerServerResponse {
+  id: Int
+  name: String
+  status: String
+}
+
+type HetznerActionResponse {
+  id: Int
+  command: String
+  status: String
+  progress: Int
+}
+
+// A PROJECT TOKEN CARRIES ONE OF TWO PERMISSIONS, chosen when it is created in the console and never
+// changed after: Read admits only GET requests; Read & Write admits every request the API offers. A
+// holder of a Read & Write token can therefore rebuild or delete any server of the project.
+type HetznerTokenPermission
+  = HetznerTokenRead
+  | HetznerTokenReadWrite
+
+// A PROJECT TOKEN IS THE BEARER CREDENTIAL: Hetzner scopes every API token to exactly one project, so
+// a token reads and acts only on that project's servers.
+//
+// REBUILD REPLACES THE SERVER'S DISK WITH THE IMAGE AND KEEPS THE SERVER: its id, addresses and the
+// project's SSH keys stay. Its response is the action that performs it; the rebuild is done only when
+// that action reads back as success (hcloud.Actions Get).
+service hcloud.Servers {
+  config {
+    endpoint: hetzner_cloud_api_base
+    auth: Bearer
+    auth_input: auth_token
+  }
+
+  operation Get {
+    requires Network
+    input {
+      auth_token: Secret
+      server_id: Int
+    }
+    output {
+      id: Int from "server/id"
+      name: String from "server/name"
+      status: String from "server/status"
+    }
+    readonly
+    transport rest {
+      method: GET,
+      path: "/servers/\{server_id\}"
+    }
+    response {
+      200 => HetznerServerResponse
+      401 => HetznerCloudApiError
+      403 => HetznerCloudApiError
+      404 => HetznerCloudApiError
+      429 => HetznerCloudApiError
+      5xx => HetznerCloudApiError
+    }
+  }
+
+  operation Rebuild {
+    requires Network
+    input {
+      auth_token: Secret
+      server_id: Int
+      image: String
+    }
+    output {
+      id: Int from "action/id"
+      command: String from "action/command"
+      status: String from "action/status"
+      progress: Int from "action/progress"
+    }
+    transport rest {
+      method: POST,
+      path: "/servers/\{server_id\}/actions/rebuild",
+      body: { image: image }
+    }
+    response {
+      201 => HetznerActionResponse
+      401 => HetznerCloudApiError
+      403 => HetznerCloudApiError
+      404 => HetznerCloudApiError
+      409 => HetznerCloudApiError
+      422 => HetznerCloudApiError
+      423 => HetznerCloudApiError
+      429 => HetznerCloudApiError
+      5xx => HetznerCloudApiError
+    }
+  }
+}
+
+service hcloud.Actions {
+  config {
+    endpoint: hetzner_cloud_api_base
+    auth: Bearer
+    auth_input: auth_token
+  }
+
+  operation Get {
+    requires Network
+    input {
+      auth_token: Secret
+      action_id: Int
+    }
+    output {
+      id: Int from "action/id"
+      command: String from "action/command"
+      status: String from "action/status"
+      progress: Int from "action/progress"
+    }
+    readonly
+    transport rest {
+      method: GET,
+      path: "/actions/\{action_id\}"
+    }
+    response {
+      200 => HetznerActionResponse
+      401 => HetznerCloudApiError
+      403 => HetznerCloudApiError
+      404 => HetznerCloudApiError
+      429 => HetznerCloudApiError
+      5xx => HetznerCloudApiError
+    }
+  }
+}
+
+// ── the documented status vocabularies, parsed rather than compared as strings ──────────────────
+
+type HetznerActionStatus = HetznerActionRunning | HetznerActionSuccess | HetznerActionError
+
+type HetznerActionStatusReading
+  = HetznerActionStatusKnown { status: HetznerActionStatus }
+  | HetznerActionStatusUnknown { wire: String }
+
+fn parse_hetzner_action_status(wire: String) -> HetznerActionStatusReading {
+  if wire == "running" { HetznerActionStatusKnown { status: HetznerActionRunning } }
+  else if wire == "success" { HetznerActionStatusKnown { status: HetznerActionSuccess } }
+  else if wire == "error" { HetznerActionStatusKnown { status: HetznerActionError } }
+  else { HetznerActionStatusUnknown { wire: wire } }
+}
+
+// ── classified outcomes ─────────────────────────────────────────────────────────────────────────
+
+// A REFUSED EXCHANGE IS THE TRANSPORT'S OWN extdeps.transports.rest RestRefusal, carried unchanged.
+type HetznerServerRead
+  = HetznerServerObserved { server: HetznerServerResponse }
+  | HetznerServerReadRefused { refusal: RestRefusal }
+
+type HetznerActionRead
+  = HetznerActionObserved { action: HetznerActionResponse, status: HetznerActionStatus }
+  | HetznerActionStatusUnrecognized { action: HetznerActionResponse }
+  | HetznerActionReadRefused { refusal: RestRefusal }
+
+fn classify_hetzner_server_get(outcome: RestResult<HetznerServerResponse>) -> HetznerServerRead {
+  match outcome {
+    RestAnswered { answer: a } => HetznerServerObserved { server: a }
+    RestRefused { refusal: r } => HetznerServerReadRefused { refusal: r }
+  }
+}
+
+// THE ACTION, FROM REBUILD'S ANSWER OR FROM A LATER READ: both return the same action object.
+fn classify_hetzner_action(outcome: RestResult<HetznerActionResponse>) -> HetznerActionRead {
+  match outcome {
+    RestAnswered { answer: a } => match parse_hetzner_action_status(wire: a.status) {
+      HetznerActionStatusKnown { status: s } => HetznerActionObserved { action: a, status: s }
+      HetznerActionStatusUnknown { wire: _ } => HetznerActionStatusUnrecognized { action: a }
+    }
+    RestRefused { refusal: r } => HetznerActionReadRefused { refusal: r }
+  }
+}
diff --git a/dag/extdeps/cooling/dynatron.dag b/dag/extdeps/cooling/dynatron.dag
index 55e6238bbbb..b7e023df417 100644
--- a/dag/extdeps/cooling/dynatron.dag
+++ b/dag/extdeps/cooling/dynatron.dag
@@ -1,5 +1,6 @@
 module extdeps.cooling.dynatron
 
+import extdeps.boards.asrock_rack { asrock_altrad8ud_board_authority }
 import std.types { NonEmptyStr, List }
 import std.nat { Nat }
 import std.measure { Micrometer, micrometer, watt, rack_unit, Gram, gram, Percent, percent, RevolutionsPerMinute, rpm, MillilitrePerSecond, millilitre_per_second }
@@ -7,7 +8,6 @@ import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.cooling.types { CpuCoolerCatalogRow }
 import extdeps.cpu.types {
   SocketedLandGrid, CpuSocket, LandGridArray }
-import extdeps.boards.types { AsrockRackAltrad8ud1l2t }
 import extdeps.vendor.dynatron { dynatron }
 import extdeps.vendor.ampere { ampere_vendor }
 import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef, CitedFigureStanding, CitedToAuthority, TranscribedUncited }
@@ -27,7 +27,7 @@ data dynatron_w1_catalog: CpuCoolerCatalogRow = CpuCoolerCatalogRow {
   active_passive_switchable: true,
   minimum_rack_units: rack_unit(2),
   max_design_power: watt(250),
-  supported_motherboards: [AsrockRackAltrad8ud1l2t],
+  supported_motherboards: [asrock_altrad8ud_board_authority],
 }
 
 data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
diff --git a/dag/extdeps/cooling/types.dag b/dag/extdeps/cooling/types.dag
index 57ecae64630..81049ae4d53 100644
--- a/dag/extdeps/cooling/types.dag
+++ b/dag/extdeps/cooling/types.dag
@@ -1,5 +1,6 @@
 module extdeps.cooling.types
 
+import extdeps.board_authority { BoardAuthorityRef }
 import std.types { NonEmptyStr, Int, Bool, List }
 import std.measure { Watt, watt, RackUnit }
 import extdeps.vendor { Vendor }
@@ -8,7 +9,6 @@ import extdeps.external_authority { ExternalAuthority, ExternalModelScope, Exter
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.uri { Uri, Https }
 import extdeps.cpu.types { CpuSocket }
-import extdeps.boards.types { BaseboardModel }
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {
@@ -29,10 +29,10 @@ data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
   further_citations: []
 }
 
-// supported_motherboards is grounded on the existing BaseboardModel authority, not a bare string: a
+// supported_motherboards is grounded on the board authority reference (extdeps.board_authority), not a bare string: a
 // cooler's supported-board population is the same board identities the fleet already binds, so
 // comparison must not route through label spelling. It was List<NonEmptyStr> carrying
-// "ALTRAD8UD-1L2T", matching neither the BaseboardModel arm nor the catalog model_label "ASRock
+// "ALTRAD8UD-1L2T", matching neither the board authority arm nor the catalog model_label "ASRock
 // Rack ALTRAD8UD-1L2T" — a String leaf hiding a named part, decomposed at its first consumer,
 // product.cooling_qualification.
 type CpuCoolerCatalogRow {
@@ -42,5 +42,5 @@ type CpuCoolerCatalogRow {
   active_passive_switchable: Bool
   minimum_rack_units: RackUnit
   max_design_power: Watt
-  supported_motherboards: List<BaseboardModel>
+  supported_motherboards: List<BoardAuthorityRef>
 }
diff --git a/dag/extdeps/cron/schedule_model.dag b/dag/extdeps/cron/schedule_model.dag
index 47472b62850..5b02e267593 100644
--- a/dag/extdeps/cron/schedule_model.dag
+++ b/dag/extdeps/cron/schedule_model.dag
@@ -4,6 +4,7 @@ import std.integer { NonNegativeInt, PositiveInt }
 import std.types { List }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
+import std.nat { nat_to_decimal_string }
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {
@@ -36,13 +37,13 @@ type CronEntry {
 fn render_cron_field(f: CronField) -> String {
   match f {
     Wildcard => "*"
-    Exact { value: v } => "{v}"
-    Listed { values } => values |> map(v => "{v}") |> join(separator: ",")
-    Ranged { start: s, end: e } => "{s}-{e}"
+    Exact { value: v } => nat_to_decimal_string(value: v)
+    Listed { values } => values |> map(v => nat_to_decimal_string(value: v)) |> join(separator: ",")
+    Ranged { start: s, end: e } => concat(nat_to_decimal_string(value: s), concat("-", nat_to_decimal_string(value: e)))
     Step { start: st, step: sp } =>
       match st {
-        0 => "*/{sp}"
-        _ => "{st}/{sp}"
+        0 => concat("*/", nat_to_decimal_string(value: sp))
+        _ => concat(nat_to_decimal_string(value: st), concat("/", nat_to_decimal_string(value: sp)))
       }
   }
 }
diff --git a/dag/extdeps/crypto/seeded_filler.dag b/dag/extdeps/crypto/seeded_filler.dag
new file mode 100644
index 00000000000..d69439ba684
--- /dev/null
+++ b/dag/extdeps/crypto/seeded_filler.dag
@@ -0,0 +1,94 @@
+module extdeps.crypto.seeded_filler
+
+import std.types { String, NonEmptyStr, Int, FilePath }
+import std.measure { ByteSize, byte_size, measure_count }
+import std.optional { Present, Absent }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import extdeps.uri { Uri, Https }
+import extdeps.shell
+import extdeps.tools.coreutils_truncate
+import extdeps.tools.coreutils_stat
+import extdeps.tools.openssl
+
+// A DETERMINISTIC, NON-SECRET, INCOMPRESSIBLE FILE OF EXACTLY N BYTES, KEYED BY A SEED.
+//
+// The construction is the GNU coreutils manual's own seeded random source ("Sources of random data"):
+// the AES-256-CTR keystream that `openssl enc -aes-256-ctr -pass pass:<seed> -nosalt` produces over
+// zeros. Here the zeros are a file `truncate -s N` sized exactly, so the keystream is exactly N bytes
+// long without a pipe: CTR is a stream mode, so output length equals input length. It is
+// reproducible (one seed, one key, one stream), two seeds give unrelated streams, and an AES
+// keystream is indistinguishable from random, so neither gzip nor a chunk store's dedup finds
+// structure in it -- which is why it, and not zeros or a repeated pattern, stands in for content
+// whose SIZE must be carried while its bytes must not be: a compressible filler would understate
+// what storing the real content costs. The seed is in argv and is NOT a secret; the filler carries
+// no information beyond its seed and its length.
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri { scheme: Https, locator: "www.gnu.org/software/coreutils/manual/html_node/Random-sources.html" }
+}
+
+data seeded_filler_openssl_enc_authority: ExternalAuthority = ExternalAuthority {
+  uri: Uri { scheme: Https, locator: "docs.openssl.org/3.0/man1/openssl-enc/" }
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef { module_path: "extdeps.crypto.seeded_filler", decl_name: "seeded_filler_write", field: WholeDeclaration }
+  },
+  first_citation: extdeps.crypto.seeded_filler.extdeps_external_authority_anchor,
+  further_citations: [extdeps.crypto.seeded_filler.seeded_filler_openssl_enc_authority]
+}
+
+// WHICH STEP REFUSED. The size readback is a step: a filler whose stat size is not the requested
+// size is refused, never returned.
+type SeededFillerStep
+  = FillerZeroSized
+  | FillerKeystreamWritten
+  | FillerZeroRemoved
+  | FillerSizeReadBack
+
+type SeededFiller
+  = SeededFillerWritten { path: NonEmptyStr, size: ByteSize }
+  | SeededFillerRefused { path: NonEmptyStr, step: SeededFillerStep, detail: String }
+
+fn seeded_filler_step_words(step: SeededFillerStep) -> String {
+  match step {
+    FillerZeroSized => "truncate"
+    FillerKeystreamWritten => "openssl-enc"
+    FillerZeroRemoved => "zero-input-removal"
+    FillerSizeReadBack => "size-readback"
+  }
+}
+
+// WRITE THE FILLER AT `path`, whose parent directory must exist. The zero input is a sibling
+// `<path>.zero`, sparse on every filesystem truncate extends, and removed before returning.
+fn seeded_filler_write(seed: NonEmptyStr, size: ByteSize, path: NonEmptyStr) -> SeededFiller {
+  let zero = concat(path as String, ".zero") as NonEmptyStr
+  let sized = coreutils.Truncate.ToSize(size_bytes: to_string(measure_count(m: size)) as NonEmptyStr, path: zero)
+  if sized.success == false {
+    SeededFillerRefused { path: path, step: FillerZeroSized, detail: "truncate could not size the zero input" }
+  } else {
+    let enc = openssl.Enc.Aes256CtrPassphrase(passphrase: seed, input_path: zero, output_path: path)
+    let removed = shell.Remove.FileForce(path: zero as FilePath)
+    if enc.success == false {
+      SeededFillerRefused { path: path, step: FillerKeystreamWritten, detail: enc.stderr }
+    } else if removed.success == false {
+      SeededFillerRefused { path: path, step: FillerZeroRemoved, detail: concat("the zero input could not be removed: ", zero as String) }
+    } else {
+      seeded_filler_readback(path: path, size: size)
+    }
+  }
+}
+
+fn seeded_filler_readback(path: NonEmptyStr, size: ByteSize) -> SeededFiller {
+  let st = coreutils.Stat.PathSize(path: path)
+  match parse_int(s: replace(st.size_text, "\n", "")) {
+    Absent => SeededFillerRefused { path: path, step: FillerSizeReadBack, detail: concat("stat printed no size: ", st.size_text) }
+    Present { value: n } =>
+      if st.success && n == measure_count(m: size) {
+        SeededFillerWritten { path: path, size: size }
+      } else {
+        SeededFillerRefused { path: path, step: FillerSizeReadBack, detail: join(["the filler is ", to_string(n), " bytes, not ", to_string(measure_count(m: size))], "") }
+      }
+  }
+}
diff --git a/dag/extdeps/deepseek/deepseek_v4_1_flash.dag b/dag/extdeps/deepseek/deepseek_v4_1_flash.dag
index 89282c362d1..9ffcf9b9849 100644
--- a/dag/extdeps/deepseek/deepseek_v4_1_flash.dag
+++ b/dag/extdeps/deepseek/deepseek_v4_1_flash.dag
@@ -514,7 +514,7 @@ data deepseek_v4_1_flash_mid_conversation_system_messages_supported: Bool = true
 
 // THE NAMING CONVENTION IS THE SELECTOR OF A READING. Every Engram tensor at this revision carries
 // `.engram.` in its name; a selection over the full index by that selector is an observation
-// (DeepseekV41IndexEngramSelection, read by gunbc.spark.v41_index_engram_selection), and the rows
+// (DeepseekV41IndexEngramSelection, read by gunbc.spark.v41_index_engram_selection until it was deleted with Group A, 2026-10-07), and the rows
 // below are the ones read from the two shard headers. Until a reading is supplied, the closure here
 // stays scoped to those rows.
 data deepseek_v4_1_flash_index_tensor_count: Nat = 96085
@@ -564,7 +564,7 @@ data deepseek_v4_1_flash_engram_entries_layer_14: List<SafetensorsEntry> = [
 // THE SHAPE OF A SELECTION OVER THE INDEX: the file the selection was read from, how many weight_map
 // names it covered, the selector, and the names it selected with their shards. This module OBSERVES
 // nothing and carries no live selection (DESIGN section 3: an observation is a receipt in the observing
-// layer, not a fact the upstream owns); the reading is gunbc.spark.v41_index_engram_selection's, and
+// layer, not a fact the upstream owns); the reading was gunbc.spark.v41_index_engram_selection's (deleted with Group A, 2026-10-07), and
 // this module owns only the fold that decides whether a reading closes membership at this revision.
 type DeepseekV41IndexEngramSelection sole_constructor {
   index: DeepseekV41PublishedFile
@@ -685,7 +685,7 @@ data deepseek_v4_1_flash_engram_shards: List<DeepseekV41EngramShard> = [
 // These are the publisher's DECLARED digests, cited to the tree API at the revision; a fleet-side
 // reading over bytes present on a Spark is the same declared frontier as the Engram rows
 // (DSV41-10). The ADMITTED manifest is what the V4.1 candidate's weights axis is keyed by:
-// gunbc.spark.v41_runtime_candidate digests its canonical text and never the raw rows.
+// gunbc.spark.v41_runtime_candidate (deleted with Group A, 2026-10-07) digested its canonical text and never the raw rows.
 // A PUBLISHED FILE AT THIS REVISION: its path, whole-file size and the publisher's sha256. One
 // record for every file the candidate is keyed by -- the weight shards and the tokenizer files --
 // and one canonical serialization (deepseek_v4_1_flash_published_manifest_text) for both lists.
@@ -878,7 +878,7 @@ data deepseek_v4_1_flash_index_reading: DeepseekV41IndexReading = DeepseekV41Ind
 // population equal to the files'. Only an admitted manifest has a canonical text, and that text
 // carries the INDEX FILE as a row beside the shards -- the index is the weight map, so an index
 // that changes is a different model source even over the same shard bytes; the candidate
-// (gunbc.spark.v41_runtime_candidate) consumes this standing, never the raw row list, so a
+// (gunbc.spark.v41_runtime_candidate, deleted with Group A on 2026-10-07) consumed this standing, never the raw row list, so a
 // defective population is an unestablished model source rather than a differently keyed one.
 type DeepseekV41WeightManifestStanding
   = WeightManifestAdmitted { files: List<DeepseekV41PublishedFile>, index: DeepseekV41PublishedFile, canonical_text: String }
diff --git a/dag/extdeps/ethtool/ethtool.dag b/dag/extdeps/ethtool/ethtool.dag
index 909dc3409dc..80a84073dd7 100644
--- a/dag/extdeps/ethtool/ethtool.dag
+++ b/dag/extdeps/ethtool/ethtool.dag
@@ -98,92 +98,3 @@ fn ethtool_module_info_raw_command(device: NonEmptyStr) -> NonEmptyStr {
     " ", ethtool_module_info_raw_on as String,
   ], "") as NonEmptyStr
 }
-
-// ================= THE CHANNEL READ =================
-//
-// `-l` (long form `--show-channels`) reports the device's channel counts: ethtool issues
-// ETHTOOL_MSG_CHANNELS_GET over netlink, or ETHTOOL_GCHANNELS where netlink is unavailable. Both
-// answer the same `struct ethtool_channels` (include/uapi/linux/ethtool.h). The rendering cited here
-// is netlink/channels.c in ethtool 6.7, the version measured on spark-a3ee (see
-// ethtool_binary_directory): a header line `Channel parameters for <dev>:`, then a `Pre-set
-// maximums:` block and a `Current hardware settings:` block, each holding `RX:`, `TX:`, `Other:` and
-// `Combined:` lines. A count the driver does not report is printed as `n/a`, not as 0.
-//
-// THE CURRENT COMBINED COUNT IS THE ONLY FIELD READ, because it is the one any consumer here needs:
-// struct ethtool_channels.combined_count, the field the earlier inline ioctl probe read as
-// channels[8]. Every other outcome is a refusal and never a count. That covers a nonzero exit (the
-// driver has no get_channels, or the device is gone), a missing header, a missing current block, a
-// missing `Combined:` line in that block, and `n/a` or any other non-decimal value. A refusal that
-// fell back to 0 would make an unreadable count look like an idle device.
-data ethtool_show_channels_flag: NonEmptyStr = "--show-channels" as NonEmptyStr
-
-service ethtool.Ethtool {
-  operation ShowChannels {
-    input { device: NonEmptyStr }
-    output { value: String from "stdout", success: Bool from "exit_success" }
-    readonly
-    transport shell { argv: ["/usr/sbin/ethtool", "--show-channels", "{device}"] }
-    exit { 0 => Unit nonzero => String "ethtool channel read failed" }
-    mock_response { 1 => { value: "", success: false } "no fabricated channel parameters" }
-  }
-}
-
-type EthtoolCombinedChannels
-  = EthtoolCombinedChannelsCurrent { count: Int }
-  | EthtoolCombinedChannelsUnreadable { cause: NonEmptyStr }
-
-fn ethtool_decimal_value(text: String) -> Int? {
-  let cps = text |> chars
-  if length(cps) == 0 || length(cps) > 10 || !all(cps, cp => cp >= 48 && cp <= 57) { none }
-  else { parse_int(s: text) }
-}
-
-fn ethtool_channel_line_value(line: String, label: String) -> String? {
-  if starts_with(s: line, prefix: label) {
-    Present { value: trim(s: substring(s: line, start: string_length(s: label), end: string_length(s: line))) }
-  } else { none }
-}
-
-// The current `Combined:` line is the first one AFTER the `Current hardware settings:` line, so the
-// pre-set maximum, which carries the same label, can never be read in its place.
-fn ethtool_current_combined_from(lines: List<String>) -> EthtoolCombinedChannels {
-  let after = fold(lines, init: EthtoolChannelScanBefore {}, f: (acc, line) => match acc {
-    EthtoolChannelScanBefore {} =>
-      if trim(s: line) == "Current hardware settings:" { EthtoolChannelScanCurrent {} } else { acc }
-    EthtoolChannelScanCurrent {} => match ethtool_channel_line_value(line: line, label: "Combined:") {
-      Present { value: v } => EthtoolChannelScanFound { value: v }
-      Absent => acc
-    }
-    EthtoolChannelScanFound { value: _ } => acc
-  })
-  match after {
-    EthtoolChannelScanBefore {} => EthtoolCombinedChannelsUnreadable { cause: "no current hardware settings block" as NonEmptyStr }
-    EthtoolChannelScanCurrent {} => EthtoolCombinedChannelsUnreadable { cause: "no current Combined count" as NonEmptyStr }
-    EthtoolChannelScanFound { value: v } => match ethtool_decimal_value(text: v) {
-      Present { value: n } => EthtoolCombinedChannelsCurrent { count: n }
-      Absent => EthtoolCombinedChannelsUnreadable { cause: "current Combined count is not a decimal count" as NonEmptyStr }
-    }
-  }
-}
-
-type EthtoolChannelScan
-  = EthtoolChannelScanBefore {}
-  | EthtoolChannelScanCurrent {}
-  | EthtoolChannelScanFound { value: String }
-
-fn ethtool_combined_channels(device: NonEmptyStr, success: Bool, value: String) -> EthtoolCombinedChannels {
-  let lines = split(s: value, delimiter: "\n")
-  if !success { EthtoolCombinedChannelsUnreadable { cause: "ethtool --show-channels exited nonzero" as NonEmptyStr } }
-  else { match lines |> first {
-    Absent => EthtoolCombinedChannelsUnreadable { cause: "empty channel report" as NonEmptyStr }
-    Present { value: header } =>
-      if trim(s: header) != join(["Channel parameters for ", device as String, ":"], "") {
-        EthtoolCombinedChannelsUnreadable { cause: "channel report names a different device or no device" as NonEmptyStr }
-      } else { ethtool_current_combined_from(lines: lines) }
-  } }
-}
-
-fn ethtool_observe_combined_channels(device: NonEmptyStr) -> EthtoolCombinedChannels {
-  let read = ethtool.Ethtool.ShowChannels(device: device)
-  ethtool_combined_channels(device: device, success: read.success, value: read.value)
-}
diff --git a/dag/extdeps/exec/command.dag b/dag/extdeps/exec/command.dag
index 4041e38d681..b4ac825a55a 100644
--- a/dag/extdeps/exec/command.dag
+++ b/dag/extdeps/exec/command.dag
@@ -84,6 +84,7 @@ fn argv_command(program: ProgramIdentity, arguments: List<String>) -> ArgvComman
     decl_ref(module_path: "extdeps.exec.command", decl_name: "env_cleared_command"),
     decl_ref(module_path: "extdeps.exec.command", decl_name: "command_over_transport"),
     decl_ref(module_path: "extdeps.tools.curl", decl_name: "curl_download_command"),
+    decl_ref(module_path: "extdeps.tools.curl", decl_name: "curl_bounded_get_command"),
     decl_ref(module_path: "extdeps.posix.sh_invocation", decl_name: "posix_sh_export_from_file_then_exec_command"),
     decl_ref(module_path: "extdeps.docker.cli", decl_name: "docker_create_command"),
     decl_ref(module_path: "extdeps.docker.cli", decl_name: "docker_start_command"),
@@ -107,6 +108,9 @@ fn argv_command(program: ProgramIdentity, arguments: List<String>) -> ArgvComman
     decl_ref(module_path: "extdeps.tools.tar", decl_name: "tar_extract_command"),
     decl_ref(module_path: "extdeps.tools.tar", decl_name: "tar_create_from_list_command"),
     decl_ref(module_path: "extdeps.tools.tar", decl_name: "tar_list_command"),
+    decl_ref(module_path: "extdeps.tools.tar", decl_name: "tar_create_from_two_lists_command"),
+    decl_ref(module_path: "extdeps.tools.tar", decl_name: "tar_list_sizes_command"),
+    decl_ref(module_path: "extdeps.tools.tar", decl_name: "tar_extract_listed_command"),
     decl_ref(module_path: "extdeps.tools.btrfs_progs", decl_name: "btrfs_subvolume_create_command"),
     decl_ref(module_path: "extdeps.tools.btrfs_progs", decl_name: "btrfs_subvolume_snapshot_read_only_command"),
     decl_ref(module_path: "extdeps.tools.btrfs_progs", decl_name: "btrfs_subvolume_delete_command"),
@@ -115,12 +119,14 @@ fn argv_command(program: ProgramIdentity, arguments: List<String>) -> ArgvComman
     decl_ref(module_path: "extdeps.tools.findutils", decl_name: "find_regular_files_sha256_command"),
     decl_ref(module_path: "extdeps.tools.findutils", decl_name: "find_owner_executable_files_command"),
     decl_ref(module_path: "extdeps.tools.findutils", decl_name: "find_symlink_targets_command"),
+    decl_ref(module_path: "extdeps.tools.findutils", decl_name: "find_regular_file_size_mtime_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "mv_exact_destination_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "sort_in_place_command"),
     decl_ref(module_path: "extdeps.tools.unzip", decl_name: "unzip_extract_command"),
     decl_ref(module_path: "extdeps.tools.ldd", decl_name: "ldd_command"),
     decl_ref(module_path: "extdeps.tools.dpkg_deb", decl_name: "dpkg_deb_extract_command"),
     decl_ref(module_path: "extdeps.tools.node", decl_name: "node_eval_command"),
+    decl_ref(module_path: "extdeps.tools.node", decl_name: "node_run_file_command"),
     decl_ref(module_path: "extdeps.tools.node", decl_name: "node_version_command"),
     decl_ref(module_path: "extdeps.browser.chromium", decl_name: "chromium_version_command"),
     decl_ref(module_path: "extdeps.tools.squashfs_tools", decl_name: "unsquashfs_extract_command"),
@@ -136,6 +142,9 @@ fn argv_command(program: ProgramIdentity, arguments: List<String>) -> ArgvComman
     decl_ref(module_path: "extdeps.iproute2.ip_show", decl_name: "ip_addr_show_command"),
     decl_ref(module_path: "extdeps.iproute2.ip_show", decl_name: "ip_route_show_command"),
     decl_ref(module_path: "extdeps.tools.uname", decl_name: "uname_release_command"),
+    decl_ref(module_path: "extdeps.tools.uname", decl_name: "uname_machine_command"),
+    decl_ref(module_path: "extdeps.tools.uname", decl_name: "uname_nodename_command"),
+    decl_ref(module_path: "extdeps.linux.ethtool_ioctl", decl_name: "linux_ethtool_channels_command"),
     decl_ref(module_path: "extdeps.tools.make", decl_name: "make_command"),
     decl_ref(module_path: "extdeps.systemd.systemd_run", decl_name: "systemd_run_command_of"),
     decl_ref(module_path: "extdeps.package_managers.pip", decl_name: "pip_install_pinned_command"),
@@ -153,9 +162,11 @@ fn argv_command(program: ProgramIdentity, arguments: List<String>) -> ArgvComman
     decl_ref(module_path: "extdeps.tools.xorriso", decl_name: "xorriso_list_long_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "cp_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "cat_command"),
+    decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "nproc_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "mktemp_directory_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "dd_overwrite_path_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "mkdir_parents_command"),
+    decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "mkdir_create_only_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "ln_hard_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "ls_long_directory_command"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "ls_long_directory_numeric_command"),
@@ -213,6 +224,7 @@ fn argv_command(program: ProgramIdentity, arguments: List<String>) -> ArgvComman
     decl_ref(module_path: "extdeps.posix.test_utility", decl_name: "test_exists_command"),
     decl_ref(module_path: "extdeps.posix.test_utility", decl_name: "test_writable_command"),
     decl_ref(module_path: "extdeps.posix.test_utility", decl_name: "test_executable_command"),
+    decl_ref(module_path: "extdeps.posix.test_utility", decl_name: "test_directory_command"),
     decl_ref(module_path: "extdeps.tools.id", decl_name: "id_group_names_command"),
     decl_ref(module_path: "extdeps.virtualization.firecracker", decl_name: "firecracker_version_command"),
     decl_ref(module_path: "extdeps.virtualization.qemu", decl_name: "qemu_version_command"),
@@ -251,6 +263,7 @@ fn argv_command(program: ProgramIdentity, arguments: List<String>) -> ArgvComman
     decl_ref(module_path: "extdeps.systemd.systemctl", decl_name: "systemctl_show_properties_command"),
     decl_ref(module_path: "extdeps.systemd.systemctl", decl_name: "systemctl_show_environment_command"),
     decl_ref(module_path: "extdeps.posix.getconf", decl_name: "getconf_clock_ticks_command"),
+    decl_ref(module_path: "extdeps.posix.getconf", decl_name: "getconf_online_processors_command"),
     decl_ref(module_path: "extdeps.tools.id", decl_name: "id_uid_of_command"),
     decl_ref(module_path: "extdeps.ntfy.serve", decl_name: "ntfy_version_command"),
     decl_ref(module_path: "extdeps.ntfy.access", decl_name: "ntfy_access_list_command"),
diff --git a/dag/extdeps/exec/program.dag b/dag/extdeps/exec/program.dag
index b3b316d7d6f..0535e529b7b 100644
--- a/dag/extdeps/exec/program.dag
+++ b/dag/extdeps/exec/program.dag
@@ -69,6 +69,7 @@ fn cataloged_program(invocation: NonEmptyStr) -> ProgramIdentity
     decl_ref(module_path: "extdeps.tools.busybox", decl_name: "busybox_dd_sparse_image_command"),
     decl_ref(module_path: "extdeps.tools.unzip", decl_name: "unzip_program"),
     decl_ref(module_path: "extdeps.tools.node", decl_name: "node_version_command"),
+    decl_ref(module_path: "extdeps.tools.node", decl_name: "node_run_file_command"),
     decl_ref(module_path: "extdeps.tools.node", decl_name: "node_eval_command"),
     decl_ref(module_path: "extdeps.tools.xorriso", decl_name: "xorriso_program"),
     decl_ref(module_path: "extdeps.nftables.ruleset", decl_name: "nft_program"),
@@ -125,6 +126,7 @@ fn uncataloged_program(invocation: NonEmptyStr) -> ProgramIdentity
     decl_ref(module_path: "extdeps.languages.bash.invocation", decl_name: "bash_program"),
     decl_ref(module_path: "extdeps.cargo_build", decl_name: "cargo_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "cat_program"),
+    decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "nproc_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "cp_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "install_program"),
     decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "ln_program"),
@@ -166,7 +168,7 @@ fn uncataloged_program(invocation: NonEmptyStr) -> ProgramIdentity
     decl_ref(module_path: "extdeps.storage.nbd", decl_name: "nbd_server_program"),
     decl_ref(module_path: "extdeps.package_managers.pip", decl_name: "pip_program"),
     decl_ref(module_path: "extdeps.posix.sh_invocation", decl_name: "posix_sh_program"),
-    decl_ref(module_path: "extdeps.cadquery.cadquery", decl_name: "python_program"),
+    decl_ref(module_path: "extdeps.python", decl_name: "python_program"),
     decl_ref(module_path: "extdeps.dpkg", decl_name: "dpkg_query_status_command"),
     decl_ref(module_path: "extdeps.ssh.openssh_client_commands", decl_name: "scp_program"),
     decl_ref(module_path: "extdeps.ssh.openssh_client_commands", decl_name: "ssh_add_program"),
@@ -185,6 +187,7 @@ fn uncataloged_program(invocation: NonEmptyStr) -> ProgramIdentity
     decl_ref(module_path: "extdeps.tools.uname", decl_name: "uname_program"),
     decl_ref(module_path: "extdeps.tools.squashfs_tools", decl_name: "unsquashfs_program"),
     decl_ref(module_path: "extdeps.tools.util_linux_umount", decl_name: "umount_program"),
+    decl_ref(module_path: "extdeps.tools.util_linux_flock", decl_name: "flock_program"),
     decl_ref(module_path: "extdeps.systemd.systemctl", decl_name: "systemctl_path_resolved_program"),
     decl_ref(module_path: "extdeps.systemd.systemd_run", decl_name: "systemd_run_program"),
     decl_ref(module_path: "extdeps.ntfy.serve", decl_name: "ntfy_version_command"),
diff --git a/dag/extdeps/filesystem/filesystem_rust_realization.dag b/dag/extdeps/filesystem/filesystem_rust_realization.dag
index 5f0a5d1b2ec..6f17c72c75b 100644
--- a/dag/extdeps/filesystem/filesystem_rust_realization.dag
+++ b/dag/extdeps/filesystem/filesystem_rust_realization.dag
@@ -1,5 +1,7 @@
 module extdeps.filesystem.rust_realization
 
+import std.integer { int_to_decimal_string }
+
 // THE RUST REALIZATION OF create-new PUBLISH, AS ONE AUTHORITY BOTH CONSUMERS COPY.
 //
 // `extdeps.filesystem` owns the INTERFACE shape of a filesystem operation. This module owns one
@@ -118,7 +120,7 @@ data rust_file_create_staging_candidate_attempt_limit: Int = 1024
 fn rust_file_create_staging_candidate_attempt_limit_def() -> String {
   concat(
     "pub const GUNBC_CREATE_STAGING_CANDIDATE_ATTEMPT_LIMIT: u32 = ",
-    "{rust_file_create_staging_candidate_attempt_limit}",
+    int_to_decimal_string(value: rust_file_create_staging_candidate_attempt_limit),
     ";\n",
   )
 }
diff --git a/dag/extdeps/firmware/types.dag b/dag/extdeps/firmware/types.dag
index f80cc3e6cfe..dd76e6cf32e 100644
--- a/dag/extdeps/firmware/types.dag
+++ b/dag/extdeps/firmware/types.dag
@@ -1,11 +1,11 @@
 module extdeps.firmware.types
 
+import extdeps.board_authority { BoardAuthorityRef }
 import std.nat { Nat }
 import std.measure { ByteSize, byte_size }
 import std.types { Bool, EpochMs, NonEmptyStr, List, list_length }
 import std.optional { Present, Absent }
 import extdeps.crypto.hash { Digest }
-import extdeps.boards.types { BaseboardModel }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.external_authority { ExternalModelScope, ExternalSubjectRef, ExternalAuthority }
 import extdeps.uri { Uri, Https }
@@ -105,7 +105,7 @@ type FirmwareImageKind
 // ON the release row so an unappliable push is refused from the catalog,
 // not discovered from a vendor shell script after the upload.
 type FirmwareReleaseRow {
-  board: BaseboardModel
+  board: BoardAuthorityRef
   target: FirmwareTarget
   version: FirmwareSemanticVersion
   released_on: EpochMs
@@ -168,7 +168,7 @@ type FirmwarePushOutcome
 // same version applied as an Instant Flash ROM never passes through the BMC
 // and so has no gating target at all. image_kind is carried for that reason.
 type FirmwarePrerequisiteObservation {
-  board: BaseboardModel
+  board: BoardAuthorityRef
   subject: FirmwareTarget
   image_kind: FirmwareImageKind
   gating_target: FirmwareTarget
diff --git a/dag/extdeps/git/gitignore.dag b/dag/extdeps/git/gitignore.dag
index a9abf914738..23cc97d1da7 100644
--- a/dag/extdeps/git/gitignore.dag
+++ b/dag/extdeps/git/gitignore.dag
@@ -29,7 +29,7 @@ type GitignoreFile {
 fn filter_categories(categories: List<GitignoreCategory>, build_system: String) -> List<GitignoreCategory> {
   let by_build = filter(categories, c => match c.when_build_system {
     Absent => true
-    Present { value: _ } => c.when_build_system == build_system
+    Present { value: b } => b == build_system
   })
   filter(by_build, c => c.items |> count > 0)
 }
diff --git a/dag/extdeps/git/versioning.dag b/dag/extdeps/git/versioning.dag
index 92dcfb7c44b..58b5b33eca9 100644
--- a/dag/extdeps/git/versioning.dag
+++ b/dag/extdeps/git/versioning.dag
@@ -3,8 +3,8 @@ module extdeps.git.versioning
 import std.types { NonEmptyStr, brand }
 import std.integer { NonNegativeInt }
 import std.algebra { Ordering, Equal, Greater }
-import std.nat { nat_compare }
-import extdeps.version { VersionIdentity, VersionScheme, VersionConstraint }
+import extdeps.version { VersionIdentity, VersionComparison, VersionCompared, VersionComparisonRefused, VersionScheme, VersionConstraint, ComparisonSide, LeftOperand, RightOperand }
+import extdeps.version.semver { semver_core_parse, semver_compare_numeric_digits, semver_label_from_code_points, semver_numeric_field, SemVerNumericField }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
 
@@ -16,9 +16,9 @@ data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
 }
 
 type GitReleaseVersion {
-  major: NonNegativeInt
-  minor: NonNegativeInt
-  patch: NonNegativeInt
+  major: SemVerNumericField
+  minor: SemVerNumericField
+  patch: SemVerNumericField
 }
 
 type GitVersionPlatformSuffix
@@ -30,11 +30,13 @@ type GitCliReportedVersion {
   suffix: GitVersionPlatformSuffix
 }
 
-data git_2_0_release: GitReleaseVersion = {
-  major: 2,
-  minor: 0,
-  patch: 0
-}
+// THE ANCHOR IS DERIVED THROUGH THE PARSER, never raw lists: the fields come from parsing
+// the literal release text, so the confined constructor's admission is the only producer.
+// The anchor IS the parse result — an Optional — so a refused label is a refusal carried to
+// every consumer, never a fabricated 0.0.0 standing in for a parse that did not happen
+// (review 77150: a failure arm must refuse, never widen). The round-trip witness pins the
+// admitted label to "2.0.0" by execution, so a forged or control-character field cannot pass.
+data git_2_0_release: GitReleaseVersion? = git_release_version_from_text(text: "2.0.0")
 
 data git_release_versioning_spec_url: NonEmptyStr = "https://git-scm.com/docs/BreakingChanges.html"
 
@@ -44,8 +46,8 @@ data min_git_version: GitVersionConstraint = ">= 2.0.0"
 
 fn git_release_version_label(v: GitReleaseVersion) -> String {
   concat(
-    to_string(v.major),
-    concat(".", concat(to_string(v.minor), concat(".", to_string(v.patch))))
+    semver_label_from_code_points(cps: v.major.digits),
+    concat(".", concat(semver_label_from_code_points(cps: v.minor.digits), concat(".", semver_label_from_code_points(cps: v.patch.digits))))
   )
 }
 
@@ -54,17 +56,49 @@ fn git_release_to_version_identity(v: GitReleaseVersion) -> VersionIdentity {
 }
 
 fn git_release_version_compare(a: GitReleaseVersion, b: GitReleaseVersion) -> Ordering {
-  match nat_compare(a: a.major, b: b.major) {
-    Equal => match nat_compare(a: a.minor, b: b.minor) {
-      Equal => nat_compare(a: a.patch, b: b.patch)
+  match semver_compare_numeric_digits(a: a.major, b: b.major) {
+    Equal => match semver_compare_numeric_digits(a: a.minor, b: b.minor) {
+      Equal => semver_compare_numeric_digits(a: a.patch, b: b.patch)
       other => other
     }
     other => other
   }
 }
 
-fn git_release_compare_identity(a: VersionIdentity, b: VersionIdentity) -> Ordering {
-  if a == b { Equal } else { Greater }
+// ---- identity compare -----------------------------------------------------------------------
+// The label is a VersionScheme's only handle, so the comparison parses the label back into the
+// typed form and routes through git_release_version_compare — the ONE implementation of the cited
+// numeric rule for this scheme. The LABEL GRAMMAR is not re-invented here: a git release version
+// is a bare MAJOR.MINOR.PATCH triple, which is exactly the SemVer 2.0.0 core, so the parse
+// consumes extdeps.version.semver's core parse (three dot-separated digit runs, no leading
+// zeroes) and refuses anything else. A label outside that grammar is a located refusal: the
+// carrier names the failing side, the label, and the cause.
+
+fn git_release_version_from_text(text: NonEmptyStr) -> GitReleaseVersion? {
+  match semver_core_parse(cps: chars(s: text as String)) {
+    Absent => none
+    Present { value: v } =>
+      Present { value: GitReleaseVersion { major: v.major, minor: v.minor, patch: v.patch } }
+  }
+}
+
+fn git_release_identity_parse(identity: VersionIdentity) -> GitReleaseVersion? {
+  match semver_core_parse(cps: chars(s: identity as String)) {
+    Absent => none
+    Present { value: v } =>
+      Present { value: GitReleaseVersion { major: v.major, minor: v.minor, patch: v.patch } }
+  }
+}
+
+fn git_release_compare_identity(a: VersionIdentity, b: VersionIdentity) -> VersionComparison {
+  match git_release_identity_parse(identity: a) {
+    Absent => VersionComparisonRefused { side: LeftOperand, identity: a as String, cause: "label is not a git release version: a bare MAJOR.MINOR.PATCH triple of digit runs without leading zeroes is required" }
+    Present { value: va } =>
+      match git_release_identity_parse(identity: b) {
+        Absent => VersionComparisonRefused { side: RightOperand, identity: b as String, cause: "label is not a git release version: a bare MAJOR.MINOR.PATCH triple of digit runs without leading zeroes is required" }
+        Present { value: vb } => VersionCompared { ordering: git_release_version_compare(a: va, b: vb) }
+      }
+  }
 }
 
 data git_release_version_scheme: VersionScheme = VersionScheme {
diff --git a/dag/extdeps/github/actions.dag b/dag/extdeps/github/actions.dag
index 1e37730c509..cc294b285a3 100644
--- a/dag/extdeps/github/actions.dag
+++ b/dag/extdeps/github/actions.dag
@@ -77,7 +77,20 @@ data github_event_name_schedule: String = "schedule"
 
 data github_event_name_workflow_run: String = "workflow_run"
 
-data workflow_run_activity_completed: String = "completed"
+// THE workflow_run ACTIVITY TYPES GitHub documents (docs.github.com/actions/reference/events-that-
+// trigger-workflows#workflow_run): a run being requested, in progress, or completed.
+type WorkflowRunActivity
+  = WorkflowRunRequestedActivity
+  | WorkflowRunInProgressActivity
+  | WorkflowRunCompletedActivity
+
+fn workflow_run_activity_name(activity: WorkflowRunActivity) -> String {
+  match activity {
+    WorkflowRunRequestedActivity => "requested"
+    WorkflowRunInProgressActivity => "in_progress"
+    WorkflowRunCompletedActivity => "completed"
+  }
+}
 
 type Workflow {
   name: String
@@ -106,7 +119,7 @@ type WorkflowTrigger
   | Schedule { cron: CronSchedule }
   | WorkflowDispatch { inputs: List<DispatchInput> }
   | WorkflowCall { inputs: List<DispatchInput> }
-  | WorkflowRunCompleted { workflows: List<String>, branches: List<String> }
+  | WorkflowRunTriggered { workflows: List<String>, branches: List<String>, activity: WorkflowRunActivity }
   | MergeGroup
 
 // THE CONSTRUCTOR TEST LIVES BESIDE THE COPRODUCT, because "does this trigger list admit a
@@ -128,7 +141,7 @@ fn workflow_trigger_is_merge_group(trigger: WorkflowTrigger) -> Bool {
     Schedule { cron: _ } => false
     WorkflowDispatch { inputs: _ } => false
     WorkflowCall { inputs: _ } => false
-    WorkflowRunCompleted { workflows: _, branches: _ } => false
+    WorkflowRunTriggered { workflows: _, branches: _, activity: _ } => false
   }
 }
 
@@ -411,3 +424,7 @@ data max_matrix_combinations: Int = 256
 // repository's own live ruleset row (GET /repos/gunb-ai/gunbc/rulesets, integration_id 15368,
 // 2026-08-27) and consistent with the documented app id for GitHub Actions.
 data github_actions_app_integration_id: Int = 15368
+
+// https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#onworkflow_dispatchinputs
+// GitHub increased the top-level workflow_dispatch input limit from 10 to 25 on 2025-12-04.
+data workflow_dispatch_max_inputs: Int = 25
diff --git a/dag/extdeps/github/actions_artifacts.dag b/dag/extdeps/github/actions_artifacts.dag
new file mode 100644
index 00000000000..48daa030940
--- /dev/null
+++ b/dag/extdeps/github/actions_artifacts.dag
@@ -0,0 +1,128 @@
+module extdeps.github.actions_artifacts
+
+import extdeps.github.github { default_api_base, max_per_page }
+import extdeps.github.errors { GitHubErrorShape }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+import std.credentials { EnvVar }
+import std.types { Bool, Bytes, Int, List, String }
+import std.resources { Network }
+import std.serialization { Text }
+import extdeps.ietf.http_semantics { GET }
+
+// THE GITHUB ACTIONS ARTIFACTS REST API, as the upstream names it: "List workflow run artifacts"
+// (operationId actions/list-workflow-run-artifacts) and "Download an artifact"
+// (actions/download-artifact), docs.github.com/en/rest/actions/artifacts, read 2026-10-04.
+//
+// THE DOWNLOAD IS A REDIRECT TO A ZIP, AND BOTH HALVES ARE UPSTREAM FACTS. GitHub answers
+// `GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/{archive_format}` with `302 Found` and a
+// `Location` header naming a short-lived storage URL (about one minute), and `410 Gone` once the
+// artifact has expired; `archive_format` admits exactly `zip`, and the body at the Location is the
+// artifact as a zip archive -- upload-artifact always archives, even a single file. Following the
+// redirect is the bound REST realization's work, not this interface's: the seed handler
+// (v1_interpreter observe_rest_exchange, over ureq's redirect policy) follows it and decides on the
+// final response, so the response block below names the answer at the end of the redirect.
+//
+// THE ARCHIVE IS Bytes AND NO BOUND REALIZATION CAN YET CARRY IT. The REST handler reads every body
+// as UTF-8 text (RestBodyObservation carries body: String), so a zip arrives as a body that could not
+// be read and the call answers RestBodyUndecodable with the status it came under. That refusal is the
+// honest answer today and it is typed; reading a member out of the archive needs a binary body
+// carrier on the REST transport and an inflate reader, which is
+// the trigger of gunbc.runner.runner_qualification_dispatch qualification_instrument_extraction_frontier_rows'
+// parse_claim_cost_tsv row. Its production caller is that module's read_claim_cost_artifact.
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "docs.github.com/en/rest/actions/artifacts"
+  }
+}
+
+// THE FIELDS A READER OF A RUN'S ARTIFACTS ASKS OF ONE, AND NO OTHERS. The claim-cost read
+// (gunbc.runner.runner_qualification_dispatch conclude_claim_cost_listing) finds the artifact by
+// name, refuses it when upstream's `expired` flag is set -- a download would answer 410 -- and
+// downloads it by id. Upstream's artifact object also carries size_in_bytes, archive_download_url,
+// created_at and expires_at; nothing here reads them, so they are not modeled (DESIGN 3c), and a
+// size that one day is read arrives as std.measure ByteSize, not a bare count.
+type ActionsArtifact {
+  id: Int
+  name: String
+  expired: Bool
+}
+
+type ActionsArtifactList {
+  total_count: Int
+  artifacts: List<ActionsArtifact>
+}
+
+// `archive_format` IS A PATH SEGMENT WHOSE UPSTREAM VOCABULARY HAS ONE MEMBER, `zip`, so the path
+// carries it as the literal upstream spelling rather than as an input. An input would make every
+// other spelling representable, and a coproduct input interpolated into a path is rendered by the
+// seed with its AUTHORED variant name (the regression extdeps.github.workflow_runs
+// WorkflowJobAttemptFilter records), so neither would be more faithful than the literal.
+// AUTHENTICATION IS THE CALLER'S TOKEN. Accepting an auth_token operation input does not by itself
+// bind authentication; auth_input names that input as the credential, as extdeps.github.git_database
+// and github.WorkflowRuns declare, so the controller installation token the qualification collector
+// passes is the one the request carries rather than the ambient GITHUB_TOKEN. An empty token keeps
+// the env fallback, the same dual declaration github.WorkflowRuns uses.
+service github.Artifacts {
+  config {
+    endpoint: default_api_base
+    auth: Bearer
+    auth_input: auth_token
+    auth_source: EnvVar { name: "GITHUB_TOKEN" }
+  }
+
+  operation ListWorkflowRunArtifacts {
+    requires Network
+    input {
+      auth_token: Secret
+      owner: String
+      repo: String
+      run_id: String
+      per_page: Int = max_per_page
+    }
+    output {
+      result: ActionsArtifactList
+    }
+    readonly
+    transport rest {
+      method: GET,
+      path: "/repos/\{owner\}/\{repo\}/actions/runs/\{run_id\}/artifacts",
+      query: { per_page: per_page }
+    }
+    response {
+      200 => ActionsArtifactList
+      401 => GitHubErrorShape
+      403 => GitHubErrorShape
+      404 => GitHubErrorShape
+      5xx => GitHubErrorShape
+    }
+  }
+
+  operation DownloadArtifact {
+    requires Network
+    input {
+      auth_token: Secret
+      owner: String
+      repo: String
+      artifact_id: String
+    }
+    output {
+      archive: Bytes
+    }
+    readonly
+    transport rest {
+      method: GET,
+      path: "/repos/\{owner\}/\{repo\}/actions/artifacts/\{artifact_id\}/zip",
+      response_format: Text
+    }
+    response {
+      200 => Bytes
+      401 => GitHubErrorShape
+      403 => GitHubErrorShape
+      404 => GitHubErrorShape
+      410 => GitHubErrorShape
+      5xx => GitHubErrorShape
+    }
+  }
+}
diff --git a/dag/extdeps/github/deployment_environments.dag b/dag/extdeps/github/deployment_environments.dag
new file mode 100644
index 00000000000..1b0f4f8bb5d
--- /dev/null
+++ b/dag/extdeps/github/deployment_environments.dag
@@ -0,0 +1,62 @@
+module extdeps.github.deployment_environments
+
+import std.types { String, List }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments"
+  }
+}
+
+// A GitHub Actions deployment environment's protection is a REPOSITORY SETTING, not a workflow
+// `if:` (the cited page: wait timer, required reviewers, deployment branches / tags). A
+// workflow_dispatch run executes the YAML of the DISPATCHED ref, so a branch can delete any
+// github.ref guard in that file. The environment name on the job is what GitHub consults for
+// those settings, and only those settings can refuse a branch.
+
+// THE SHAPE IS GITHUB'S, NOT A REF LIST (review 78420 on gunbc#13660). The environment object
+// carries `deployment_branch_policy`: null (all branches and tags), or
+// { protected_branches, custom_branch_policies }; the custom rules are a second resource,
+// GET /repos/{owner}/{repo}/environments/{name}/deployment-branch-policies, whose
+// `branch_policies` rows are { name, type } with type "branch" or "tag". A reading of the real
+// API therefore yields a NAME and a kind, never "refs/heads/main", so a model that stores refs can
+// never be discharged by a faithful GET.
+type DeploymentBranchPolicyRefType
+  = PolicyRefBranch
+  | PolicyRefTag
+
+type DeploymentBranchPolicyRule {
+  name: String
+  ref_type: DeploymentBranchPolicyRefType
+}
+
+type EnvironmentDeploymentBranchPolicy
+  = AllBranchesAndTags
+  | ProtectedBranchesOnly
+  | SelectedBranchesAndTags { rules: List<DeploymentBranchPolicyRule> }
+
+type EnvironmentReviewerRequirement
+  = NoRequiredReviewers
+  | RequiredReviewers
+
+type GitHubEnvironmentProtectionSettings {
+  name: String
+  deployment_branch_policy: EnvironmentDeploymentBranchPolicy
+  reviewer_requirement: EnvironmentReviewerRequirement
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.github.deployment_environments",
+      decl_name: "GitHubEnvironmentProtectionSettings",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps.github.deployment_environments.extdeps_external_authority_anchor,
+  further_citations: []
+}
diff --git a/dag/extdeps/github/git_database.dag b/dag/extdeps/github/git_database.dag
index cb0e4f68918..fa0dd1869db 100644
--- a/dag/extdeps/github/git_database.dag
+++ b/dag/extdeps/github/git_database.dag
@@ -38,6 +38,8 @@ type GitRefObjectWire {
   sha: String
 }
 
+type GitRefDeletedBody {}
+
 type GitRefWire {
   ref: String
   object: GitRefObjectWire
@@ -111,10 +113,21 @@ data git_blob_encoding_base64: NonEmptyStr = "base64"
 // so no caller of UpdateRefFastForward can express a forced update; a moved branch answers 422
 // "Update is not a fast forward" and that refusal IS the compare-and-swap. A forced variant would be
 // a different operation with its own name and its own consumer.
+// CreateRef AND DeleteRef (docs.github.com/en/rest/git/refs#create-a-reference and
+// #delete-a-reference, read 2026-10-04). CreateRef takes the FULL ref name (`refs/tags/<name>`) in its
+// body and answers 201 with the reference; an existing ref answers 422 "Reference already exists",
+// so creation never moves a ref and that 422 is the create-once refusal. DeleteRef takes the
+// `tags/<name>` form in its path and answers 204 with no body; a ref already gone answers 422
+// "Reference does not exist". Their consumer is gunbc.runner.runner_qualification_ref_pin (a create-once branch per qualification attempt and its removal).
+//
+// THE BEARER IS AN INPUT WHEN ONE IS GIVEN. Every operation already took `auth_token`; the service read
+// only GITHUB_TOKEN. Declaring both lets a caller that holds an installation token present it, and a
+// caller passing "" (gunbc.heal_publication) falls through to GITHUB_TOKEN exactly as before.
 service github.GitDatabase {
   config {
     endpoint: default_api_base
     auth: Bearer
+    auth_input: auth_token
     auth_source: EnvVar { name: "GITHUB_TOKEN" }
   }
 
@@ -306,4 +319,58 @@ service github.GitDatabase {
       5xx => GitHubErrorShape
     }
   }
+
+  operation CreateRef {
+    requires Network
+    input {
+      auth_token: Secret
+      owner: String
+      repo: String
+      full_ref: String
+      sha: String
+    }
+    output {
+      reference: GitRefWire
+    }
+    transport rest {
+      method: POST,
+      path: "/repos/\{owner\}/\{repo\}/git/refs",
+      body: { ref: full_ref, sha: sha }
+    }
+    response {
+      201 => GitRefWire
+      401 => GitHubErrorShape
+      403 => GitHubErrorShape
+      404 => GitHubErrorShape
+      409 => GitHubErrorShape
+      422 => GitHubErrorShape
+      5xx => GitHubErrorShape
+    }
+  }
+
+  operation DeleteRef {
+    requires Network
+    input {
+      auth_token: Secret
+      owner: String
+      repo: String
+      ref: String
+    }
+    output {
+      result: GitRefDeletedBody
+    }
+    transport rest {
+      method: DELETE,
+      path: "/repos/\{owner\}/\{repo\}/git/refs/\{ref\}"
+    }
+    response {
+      204 => GitRefDeletedBody
+      401 => GitHubErrorShape
+      403 => GitHubErrorShape
+      404 => GitHubErrorShape
+      409 => GitHubErrorShape
+      422 => GitHubErrorShape
+      5xx => GitHubErrorShape
+    }
+  }
 }
diff --git a/dag/extdeps/github/org_actions.dag b/dag/extdeps/github/org_actions.dag
index cf0a08e88b1..286880ccdd7 100644
--- a/dag/extdeps/github/org_actions.dag
+++ b/dag/extdeps/github/org_actions.dag
@@ -130,6 +130,16 @@ type OrgRunnerGroupListWire {
 
 data org_runner_groups_max_per_page: Int = 100
 
+// UpdateOrganizationRunnerGroupWorkflows:
+// update a self-hosted runner group for an organization (docs.github.com/en/rest/actions/
+// self-hosted-runner-groups#update-a-self-hosted-runner-group-for-an-organization, REST
+// 2022-11-28, read 2026-10-04): PATCH sets restricted_to_workflows and selected_workflows and
+// answers 200 with the group. Each selected entry is `<owner>/<repo>/<workflow path>@<ref>`; per
+// docs.github.com/en/enterprise-cloud@latest/actions/how-tos/manage-runners/self-hosted-runners/
+// manage-access (read 2026-10-04), "Pin non-reusable workflows to a branch. Pin reusable
+// workflows to a branch, tag, or full SHA" -- a dispatched (non-reusable) workflow is selectable
+// only at a branch, which is why a qualification pin is a branch and not a SHA. Its consumer is
+// gunbc.runner.runner_qualification_ref_pin, which writes only the dedicated qualification group.
 service github.OrgRunnerGroupsRest {
   config {
     endpoint: default_api_base
@@ -161,4 +171,30 @@ service github.OrgRunnerGroupsRest {
       5xx => GitHubErrorShape
     }
   }
+
+  operation UpdateOrganizationRunnerGroupWorkflows {
+    requires Network
+    input {
+      installation_token: Secret
+      org: NonEmptyStr
+      runner_group_id: Int
+      selected_workflows: List<String>
+    }
+    output {
+      result: OrgRunnerGroupWire
+    }
+    transport rest {
+      method: PATCH,
+      path: "/orgs/\{org\}/actions/runner-groups/\{runner_group_id\}",
+      body: { restricted_to_workflows: true, selected_workflows: selected_workflows }
+    }
+    response {
+      200 => OrgRunnerGroupWire
+      401 => GitHubErrorShape
+      403 => GitHubErrorShape
+      404 => GitHubErrorShape
+      422 => GitHubErrorShape
+      5xx => GitHubErrorShape
+    }
+  }
 }
diff --git a/dag/extdeps/github/workflow_run_event.dag b/dag/extdeps/github/workflow_run_event.dag
index fbd3cd40553..795d4e434df 100644
--- a/dag/extdeps/github/workflow_run_event.dag
+++ b/dag/extdeps/github/workflow_run_event.dag
@@ -247,7 +247,7 @@ fn workflow_run_event_nested_text(v: JsonValue, outer: String, inner: String) ->
 // conclusion is REQUIRED by this decoder and a null one is a located malformation rather than an
 // Absent field, because of what the envelope is FOR. GitHub delivers workflow_run at three
 // activities and leaves conclusion null until the run completes; this module is read only from a
-// WorkflowRunCompleted trigger, where the activity is `completed` and a conclusion therefore
+// WorkflowRunTriggered trigger with WorkflowRunCompletedActivity, where the activity is `completed` and a conclusion therefore
 // exists. Modeling it as optional would push a state that cannot occur on this path onto every
 // consumer as an arm they must invent an answer for — and the plausible answer (treat null as `not
 // finished yet, do nothing`) is indistinguishable from the real defect (the payload changed shape
diff --git a/dag/extdeps/github/workflow_runs.dag b/dag/extdeps/github/workflow_runs.dag
index 7deaed176de..8c1dded28e5 100644
--- a/dag/extdeps/github/workflow_runs.dag
+++ b/dag/extdeps/github/workflow_runs.dag
@@ -15,6 +15,7 @@ import std.dissolution { unbound_dissolution }
 import std.decl_ref { decl_ref }
 import std.algebra { Cons, Empty }
 import std.resources { Network }
+import std.serialization { Text }
 import extdeps.transports.rest { RestResult }
 
 // WorkflowJobRun.labels are read by gunbc.public_workload_census (observed_job_labels) to
@@ -90,6 +91,7 @@ type WorkflowRunPullRequest {
 type WorkflowRun {
   id: Int
   name: String?
+  display_title: String?
   path: String?
   head_sha: CommitSha
   head_branch: String?
@@ -194,6 +196,12 @@ fn workflow_job_attempt_filter_wire(f: WorkflowJobAttemptFilter) -> String {
 // rendered name. The parenthetical of combination VALUES in axis order is the rendering this
 // tree observed on those names; it is not a REST field. Standing is TranscribedUncited until
 // GitHub's Jobs docs state that encoding.
+// runner_id AND runner_name ARE WHICH RUNNER TOOK THE JOB, a third fact beside the declared runs-on
+// and the observed labels: two runners can carry identical labels. runner_id is the exact identity
+// GitHub returned when the JIT registration was minted (gunbc.runner.runner_qualification_dispatch
+// job_ran_on joins on it); runner_name is corroboration, since one name can resolve to several ids.
+// Upstream publishes both as nullable -- null until a runner takes the job -- and every record in
+// this tree written before the fields existed carries none rather than a guessed value.
 type WorkflowJobRun {
   id: Int
   run_id: Int
@@ -202,6 +210,8 @@ type WorkflowJobRun {
   status: WorkflowRunStatus
   conclusion: WorkflowRunConclusion?
   labels: List<String>
+  runner_id: Int?
+  runner_name: String?
   created_at: Timestamp?
   started_at: Timestamp?
   completed_at: Timestamp?
@@ -287,16 +297,32 @@ data structural_coverage_gap_workflow_run_codec_hand_rolled: List<String> = [
 // operation is not a module item, so per-operation rationale is not expressible; it belongs here
 // or nowhere.
 //
+// DOWNLOADJOBLOGSFORWORKFLOWRUN IS UPSTREAM'S "Download job logs for a workflow run"
+// (actions/download-job-logs-for-workflow-run, docs.github.com/en/rest/actions/workflow-jobs, read
+// 2026-10-04): `GET /repos/{owner}/{repo}/actions/jobs/{job_id}/logs` answers `302 Found` with a
+// `Location` naming a storage URL that expires after about a minute, and the body there is the job's
+// log as plain text, one line per row behind an RFC 3339 timestamp. The redirect is followed by the
+// bound REST realization (the seed's ureq handler), so the response block names the text at the end
+// of it. A body the handler cannot read -- not UTF-8, or past its read cap -- is RestBodyUndecodable
+// with its status, never a truncated log reported as the whole one.
+//
 // THE FILTER IS A CALLER'S CHOICE AND WAS A LITERAL. "latest" returns only the most recent attempt
 // of each job, which is the right answer for "what is the current state" and the wrong one for any
 // census of consumed capacity: a re-run mutates a job's record in place, so the attempts "latest"
 // drops are execution that really happened and really occupied a runner. A caller measuring
 // occupancy needs "all"; a caller reading current state needs "latest"; neither is a property of
 // this operation, so the choice moves to the input with "latest" as the compatible default.
+// THE BEARER IS THE CALLER'S auth_token WHEN ONE IS GIVEN. Every operation already took auth_token,
+// and the service read only GITHUB_TOKEN, so a caller holding an installation token
+// (gunbc.github_effect_perform read_run_with / read_attempt_jobs_with) was silently read under the
+// ambient Actions credential. Declaring auth_input beside auth_source makes a non-empty auth_token the
+// bearer; a caller passing "" (gunbc.pr_base_freshness, gunbc.fleet_desired_admission,
+// gunbc.roadmap_launch_deployment_cli) falls through to GITHUB_TOKEN exactly as before.
 service github.WorkflowRuns {
   config {
     endpoint: default_api_base
     auth: Bearer
+    auth_input: auth_token
     auth_source: EnvVar { name: "GITHUB_TOKEN" }
   }
 
@@ -415,6 +441,33 @@ service github.WorkflowRuns {
       500 => GitHubErrorShape
     }
   }
+  operation DownloadJobLogsForWorkflowRun {
+    requires Network
+    input {
+      auth_token: Secret
+      owner: String
+      repo: String
+      job_id: String
+    }
+    output {
+      log: String
+    }
+    readonly
+    transport rest {
+      method: GET,
+      path: "/repos/\{owner\}/\{repo\}/actions/jobs/\{job_id\}/logs",
+      response_format: Text
+    }
+    response {
+      200 => String
+      401 => GitHubErrorShape
+      403 => GitHubErrorShape
+      404 => GitHubErrorShape
+      410 => GitHubErrorShape
+      5xx => GitHubErrorShape
+    }
+  }
+
   operation ListJobs {
     requires Network
     input {
diff --git a/dag/extdeps/github/workflows.dag b/dag/extdeps/github/workflows.dag
index c0de4991178..dd7498019af 100644
--- a/dag/extdeps/github/workflows.dag
+++ b/dag/extdeps/github/workflows.dag
@@ -3,13 +3,9 @@ module extdeps.github.workflows
 import extdeps.ietf.http_semantics { POST }
 import extdeps.github.github { default_api_base }
 import extdeps.github.errors { GitHubErrorShape }
-import std.credentials { EnvVar }
-import std.types { CommitSha, List, NonEmptyStr }
+import std.types { NonEmptyStr, Secret, String }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
-import std.roster_frontier { FrontierRow, frontier_row_decl }
-import std.dissolution { unbound_dissolution }
-import std.decl_ref { decl_ref }
 import std.resources { Network }
 import extdeps.ietf.http_semantics { POST }
 import extdeps.transports.rest { RestResult }
@@ -42,40 +38,37 @@ type WorkflowDispatchReceipt {
 // WorkflowDispatchReceipt would fabricate a run that was refused. The owning workflow may be
 // retriggered after diagnosis; this operation never assumes a git push created a run.
 //
-// FROZEN UPSTREAM SHAPE: tools.ci_heal_dispatch, the only production caller, is deleted. Restoring
-// heal auto-dispatch does not consume this operation. `expected_healed_sha` is the `inputs`
-// key GitHub accepts for this repository's workflow_dispatch contract; it is not a second heal
-// policy and must not grow more heal-specific keys here. Disposition:
-// create_dispatch_unconsumed_frontier_rows.
-
-data create_dispatch_unconsumed_frontier_rows: List<FrontierRow> = [
-  frontier_row_decl(
-    ref: decl_ref(module_path: "extdeps.github.workflows", decl_name: "WorkflowDispatchReceipt"),
-    reason: "github.Workflows CreateDispatch and WorkflowDispatchReceipt are the cited REST shape with no production caller after tools.ci_heal_dispatch was deleted; frozen: no new heal-specific keys or auto-invoke rows",
-    dissolution: unbound_dissolution(description: "a production fold that is not heal auto-dispatch calls github.Workflows CreateDispatch, or CreateDispatch and WorkflowDispatchReceipt are deleted. NOT satisfied by restoring tools.ci_heal_dispatch, nor by a witness constructing WorkflowDispatchReceipt"),
-  )
-]
-
+// `inputs` IS THE UPSTREAM'S OWN SHAPE: an object of input name to value, at most 25 properties,
+// each key a workflow_dispatch input the target workflow declares (extdeps.github.actions
+// DispatchInput). It once carried exactly one key, expected_healed_sha, because the deleted
+// tools.ci_heal_dispatch was its only caller -- a consumer's policy fused into the interface
+// (DESIGN section 3). Which keys a dispatch carries is the dispatching workflow's fact, so the
+// caller supplies the object and this module names no key. GitHub answers an undeclared key with
+// 422, which is the refusal arm below, never a silently dropped input.
+//
+// THE CREDENTIAL IS AN INPUT, NOT AN AMBIENT VARIABLE. It once read GITHUB_TOKEN from the
+// environment, which fixed the executing credential to whichever job happened to run the call.
+// Which credential performs a dispatch is the caller's authorization fact (gunbc.auth), so the
+// operation takes the bearer as auth_token, as the self-hosted-runner and gist services do.
 service github.Workflows {
   config {
     endpoint: default_api_base
     auth: Bearer
-    auth_source: EnvVar { name: "GITHUB_TOKEN" }
+    auth_input: auth_token
   }
 
   operation CreateDispatch {
     requires Network
     input {
+      auth_token: Secret
       owner: String
       repo: String
       workflow_id: String
       ref: String
-      expected_healed_sha: CommitSha
+      inputs: Map<String, String>
     }
     output {
-      workflow_run_id: Int
-      run_url: NonEmptyStr
-      html_url: NonEmptyStr
+      result: WorkflowDispatchReceipt
     }
     transport rest {
       method: POST,
@@ -83,7 +76,7 @@ service github.Workflows {
       headers: { "X-GitHub-Api-Version": workflows_api_version },
       body: {
         ref: ref,
-        inputs: { expected_healed_sha: expected_healed_sha }
+        inputs: inputs
       }
     }
     response {
diff --git a/dag/extdeps/http/client.dag b/dag/extdeps/http/client.dag
index 30d078bd951..227ac12dc3c 100644
--- a/dag/extdeps/http/client.dag
+++ b/dag/extdeps/http/client.dag
@@ -96,6 +96,13 @@ fn http_client_get_unix_socket_argv(socket: NonEmptyStr, url: NonEmptyStr, max_t
 // for endpoints that read application/x-www-form-urlencoded (the OAuth token endpoint among
 // them), one content-type line differs, and the body still rides --data @{file} so a client
 // secret in the form body is never an argv word (gunbc.credential_argv_exposure).
+// PostJsonFromFileWithHeaderFile IS PostJsonFromFile FOR AN ENDPOINT THAT AUTHENTICATES, with the
+// credential carried exactly as GetFollowRedirectsBoundedWithHeaderFile carries it: one header line in
+// a caller-owned file read by curl -H @file, so the bearer is never an argv word
+// (gunbc.credential_argv_exposure) and the body still rides --data @{file}. --fail-with-body keeps an
+// error status's body, which is where a hosted API's typed refusal lives. The response headers are dumped
+// to a caller-owned file (curl -D) because a refusal's retry hints (Retry-After, X-RateLimit-*) are headers
+// and --fail-with-body returns only the body.
 // PostStdinWithinUnixSocket, THE SAME BOUNDED POST OVER A UNIX SOCKET (curl --unix-socket, curl(1)):
 // the URL still names the scheme, authority and path the server routes on, but the connection is
 // made to the socket file and the kernel attests the caller to the server. The exit codes are
@@ -309,6 +316,33 @@ service http.Client {
     }
   }
 
+  operation PostJsonFromFileWithHeaderFile {
+    requires Network
+    input { url: NonEmptyStr, request_body_file: NonEmptyStr, header_file: NonEmptyStr, response_headers_file: NonEmptyStr, max_seconds: NonEmptyStr }
+    output { body: String from "stdout", success: Bool from "exit_success" }
+    transport shell {
+      argv: [
+        "curl",
+        "--fail-with-body",
+        "-sS",
+        "--max-time", "{max_seconds}",
+        "-D", "{response_headers_file}",
+        "-X", "POST",
+        "{url}",
+        "-H", "Content-Type: application/json",
+        "-H", "@{header_file}",
+        "--data", "@{request_body_file}",
+      ]
+    }
+    exit {
+      0 => Unit
+      nonzero => String "curl POST JSON from file with header file failed"
+    }
+    mock_response {
+      0 => { body: "", success: false } "hermetic: no live endpoint; a transport that never connects, so the caller answers unreachable rather than fabricating a completion"
+    }
+  }
+
   operation PostFormFromFile {
     input { url: NonEmptyStr, request_body_file: NonEmptyStr, max_seconds: NonEmptyStr }
     output { body: String from "stdout", success: Bool from "exit_success" }
diff --git a/dag/extdeps/illumination/minions.dag b/dag/extdeps/illumination/minions.dag
new file mode 100644
index 00000000000..9073895d7b4
--- /dev/null
+++ b/dag/extdeps/illumination/minions.dag
@@ -0,0 +1,68 @@
+module extdeps.illumination.minions
+
+import std.types { List, NonEmptyStr }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+// The named Minions of Illumination's Despicable Me franchise, as the fan wiki's "Minions" category
+// enumerates them. The studio publishes no roster, so the wiki category is the authority cited; it was
+// read 2026-10-08 through the MediaWiki API (list=categorymembers, cmtitle=Category:Minions,
+// cmlimit=500), which returned 485 members with no continuation, so the read is the whole category.
+//
+// WHAT IS VENDORED: one entry per distinct first name, in the category's own order. Pages that name
+// no individual Minion (the species page, "Evil Minions", "Mega Minions", "Pit Crew", "Holiday
+// Minion", "Traveling Sales Minion", "Unnamed Referee Minion", "Minionese", trivia, biography and
+// group pages, subcategories) are excluded; a disambiguating suffix such as "(Despicable Me 2)" or
+// "Jr." is dropped, so several Minions sharing a name are one entry. Spellings are folded to
+// lowercase ASCII letters -- accents removed, punctuation and spaces dropped ("Francois" from
+// François, "jeanluc" from Jean-Luc) -- so every entry is a legal DNS label. A later read is a new
+// list beside this one, never an edit to it.
+
+data minions_fandom_category_authority: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "despicableme.fandom.com/wiki/Category:Minions"
+  }
+}
+
+data minion_first_names: List<NonEmptyStr> = [
+  "aaron", "adrian", "aiden", "akio", "akira", "alan", "alazraqui", "albert", "alberto",
+  "alejandro", "alex", "alexander", "alfonso", "alfred", "alvin", "amir", "andre", "andrei",
+  "andrew", "ang", "anthony", "ari", "arnie", "arnold", "arthur", "austin", "barry", "bastien",
+  "ben", "benjamin", "benny", "bernardo", "bert", "bertrand", "bill", "billy", "bob", "bobby",
+  "bobo", "bong", "boon", "boris", "brad", "brandon", "brett", "brian", "bruce", "bruno", "buck",
+  "butch", "calvin", "cameron", "carl", "carlos", "carter", "casey", "cecil", "chandler",
+  "charles", "charlie", "chase", "chris", "christoph", "chuck", "cillian", "cinco", "clark",
+  "claude", "claudian", "clay", "clint", "cody", "connor", "cory", "craig", "crane", "cubby",
+  "daggett", "damien", "dan", "danny", "dario", "darwin", "daryl", "dave", "david", "denis",
+  "derek", "devin", "dexter", "dick", "donald", "donnie", "donny", "doug", "douglas", "dudley",
+  "dwayne", "dwight", "ed", "edgar", "edward", "ehouarn", "elbaton", "eli", "elia", "elijah",
+  "elvis", "emerson", "enzo", "eric", "erich", "erik", "ernest", "ethan", "euchariah", "eugene",
+  "evan", "ewan", "ezekiel", "ezra", "federico", "felix", "finn", "forrest", "fox", "francis",
+  "frank", "frankie", "francois", "fred", "fritz", "gabriel", "gaetano", "garrett", "garth",
+  "gary", "gene", "george", "gerald", "gibson", "gilbert", "gilles", "gino", "gordon", "graham",
+  "grayson", "greg", "guillaume", "guillermo", "gus", "guy", "habib", "hal", "hank", "harold",
+  "harry", "hayao", "henry", "herbert", "herman", "hichem", "hiromoto", "horace", "howard", "hugo",
+  "ian", "ingmar", "ivan", "jack", "jackson", "jacob", "james", "jason", "jax", "jay", "jeanluc",
+  "jeff", "jeffrey", "jeremy", "jerome", "jerry", "jesse", "jim", "jj", "joe", "joel", "joey",
+  "jof", "john", "johnny", "jon", "jonathan", "jonny", "jordan", "jorge", "josh", "joshua", "jose",
+  "juan", "jude", "julien", "justin", "kayden", "keanu", "keith", "ken", "kenji", "kenny", "kevin",
+  "kofi", "kraig", "kyle", "lance", "larry", "lars", "lasse", "lenny", "leo", "leon", "lewis",
+  "liam", "lincoln", "lionel", "lloyd", "logan", "lorenzo", "louis", "luc", "luca", "lucas",
+  "luchino", "lucio", "luis", "luke", "mack", "malik", "manny", "marc", "marcel", "mark",
+  "marshall", "martin", "marty", "mason", "mateo", "matt", "matthew", "maurice", "mael", "mel",
+  "michael", "mike", "mil", "milan", "milo", "milos", "miquel", "moe", "monty", "morgan",
+  "muhammad", "nate", "nathan", "ned", "neil", "newman", "niall", "nick", "nicolas", "nima",
+  "nino", "noah", "nobu", "nolan", "norbert", "noe", "oliver", "omid", "orlin", "orson", "oscar",
+  "oswald", "otis", "otto", "owen", "pablo", "palmer", "park", "parker", "pascal", "patrick",
+  "paul", "paxton", "pedro", "percy", "perry", "peter", "peyton", "phil", "pierce", "pudgy",
+  "quentin", "ralph", "raphael", "raymond", "reginald", "rhett", "ricky", "ridley", "ringo",
+  "risotto", "robert", "robin", "rod", "ron", "ross", "rowan", "ryan", "sam", "samson", "samuel",
+  "satyajit", "saxon", "scott", "scrooge", "sean", "sebastian", "seth", "shawn", "sid", "silas",
+  "simon", "sonny", "soren", "spencer", "spike", "stan", "stanley", "steve", "steven", "stu",
+  "stuart", "sydney", "ted", "terence", "terry", "theodore", "thomas", "tim", "timmy", "tobias",
+  "toby", "todd", "tom", "tony", "travis", "trey", "val", "van", "varun", "vegas", "victor",
+  "vincent", "vincente", "walter", "wark", "wayne", "werner", "wes", "will", "william", "willy",
+  "wilson", "wong", "wyatt", "xander", "yasujiro", "yiannis", "yussuf", "yves", "zach", "zack",
+  "zeno", "ziggy", "zorex"
+]
diff --git a/dag/extdeps/languages/go/module.dag b/dag/extdeps/languages/go/module.dag
index fc814b911af..c7b859c4de6 100644
--- a/dag/extdeps/languages/go/module.dag
+++ b/dag/extdeps/languages/go/module.dag
@@ -2,7 +2,8 @@ module extdeps.languages.go.module
 
 import std.types { NonEmptyStr, brand }
 import std.algebra { Ordering, Less, Equal, Greater }
-import extdeps.version { VersionIdentity, VersionScheme }
+import extdeps.version { VersionIdentity, VersionComparison, VersionCompared, VersionComparisonRefused, VersionScheme, ComparisonSide, LeftOperand, RightOperand }
+import extdeps.version.semver { semver_compare, semver_version_parse, SemVerVersion }
 
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
@@ -38,37 +39,42 @@ fn go_semver_to_version_identity(v: GoSemVer) -> VersionIdentity {
   go_semver_label(v: v)
 }
 
-fn go_semver_compare(a: GoSemVer, b: GoSemVer) -> Ordering {
-  let mc = if a.major < b.major { Less } else { if a.major > b.major { Greater } else { Equal } }
-  let nc = if a.minor < b.minor { Less } else { if a.minor > b.minor { Greater } else { Equal } }
-  let pc = if a.patch < b.patch { Less } else { if a.patch > b.patch { Greater } else { Equal } }
-  let pre = match a.prerelease {
-    Absent => match b.prerelease {
-      Absent => Equal
-      Present { value: _bp } => Greater
-    }
-    Present { value: _ap } => match b.prerelease {
-      Absent => Less
-      Present { value: _bp } => Equal
-    }
+// ---- identity compare -----------------------------------------------------------------------
+// Go module versions are "v" followed by a SemVer 2.0.0 version (the cited authority:
+// module versions are semantic versions with a leading "v"), so the scheme strips the prefix and
+// reuses the SemVer grammar and semver_compare — the ONE implementation of the precedence rule.
+// The former go-local comparator is deleted: it ranked ANY two pre-release versions Equal
+// (v1.0.0-alpha == v1.0.0-beta), the exact widening the cited rule forbids, and its parser
+// accepted labels SemVer refuses (a leading-zero pre-release identifier, an empty identifier).
+// A label outside the grammar (no "v" prefix, or a non-SemVer remainder) is a located refusal:
+// the carrier names the failing side, the label, and the cause.
+
+fn go_module_semver_identity_parse(identity: VersionIdentity) -> SemVerVersion? {
+  let cps = chars(s: identity as String)
+  match cps.first() {
+    Absent => none
+    Present { value: h } =>
+      if h != 118 {
+        none
+      } else {
+        semver_version_parse(cps: cps.skip(n: 1))
+      }
   }
-  match mc {
-    Less => Less
-    Greater => Greater
-    Equal => match nc {
-      Less => Less
-      Greater => Greater
-      Equal => match pc {
-        Less => Less
-        Greater => Greater
-        Equal => pre
+}
+
+fn go_module_compare_identity(a: VersionIdentity, b: VersionIdentity) -> VersionComparison {
+  match go_module_semver_identity_parse(identity: a) {
+    Absent => VersionComparisonRefused { side: LeftOperand, identity: a as String, cause: "label is not a go module version: a go module version is 'v' followed by a SemVer 2.0.0 version" }
+    Present { value: va } =>
+      match go_module_semver_identity_parse(identity: b) {
+        Absent => VersionComparisonRefused { side: RightOperand, identity: b as String, cause: "label is not a go module version: a go module version is 'v' followed by a SemVer 2.0.0 version" }
+        Present { value: vb } => VersionCompared { ordering: semver_compare(a: va, b: vb) }
       }
-    }
   }
 }
 
 data go_module_version_scheme: VersionScheme = VersionScheme {
-  compare: (a, b) => if a == b { Equal } else { Less }
+  compare: go_module_compare_identity
 }
 
 type GoModulePath = NonEmptyStr where brand("GoModulePath")
diff --git a/dag/extdeps/languages/rust/emit.dag b/dag/extdeps/languages/rust/emit.dag
index 2bffcb57d7d..69034eef1fa 100644
--- a/dag/extdeps/languages/rust/emit.dag
+++ b/dag/extdeps/languages/rust/emit.dag
@@ -76,8 +76,8 @@ data rust_simple_method_specs: List<SimpleMethodSpec> = [
   { method_name: "first",     template: "\{recv\}.first().cloned()",                                                                   wraps_result: false },
   { method_name: "enumerate", template: "\{recv\}.iter().cloned().enumerate().map(|(i, v)| (i as i64, v)).collect::<Vec<_>>()",         wraps_result: true },
   { method_name: "chars",     template: "\{recv\}.chars().map(|c| c as i64).collect::<Vec<_>>()",                                      wraps_result: true },
-  { method_name: "skip",      template: "\{recv\}.iter().cloned().skip(\{arg\} as usize).collect::<Vec<_>>()",                         wraps_result: true },
-  { method_name: "take",      template: "\{recv\}.iter().cloned().take(\{arg\} as usize).collect::<Vec<_>>()",                         wraps_result: true },
+  { method_name: "skip",      template: "v1_rt::list_skip(&\{recv\}, \{arg\})",                                                       wraps_result: true },
+  { method_name: "take",      template: "v1_rt::list_take(&\{recv\}, \{arg\})",                                                       wraps_result: true },
   { method_name: "is_empty",  template: "\{recv\}.is_empty()",                                                                       wraps_result: false }
 ]
 
diff --git a/dag/extdeps/languages/yaml/gha_workflow.dag b/dag/extdeps/languages/yaml/gha_workflow.dag
index f749d5f9289..6c1ee0d151c 100644
--- a/dag/extdeps/languages/yaml/gha_workflow.dag
+++ b/dag/extdeps/languages/yaml/gha_workflow.dag
@@ -11,7 +11,7 @@ import extdeps.cron.schedule_model { render_cron_schedule }
 import extdeps.github.actions {
   Workflow, Job, Step, RunStep, UsesStep,
   WorkflowTrigger, Push, PullRequest, WorkflowDispatch, Schedule, MergeGroup,
-  WorkflowRunCompleted, workflow_run_activity_completed,
+  WorkflowRunTriggered, workflow_run_activity_name,
   DispatchInput, DispatchInputType, InputString, InputBoolean, InputChoice, InputEnvironment,
   PullRequestActivity, Opened, Synchronize, Reopened, ReadyForReview, Closed,
   WorkflowPermissions, PermissionLevel, PermRead, PermWrite, PermNone,
@@ -174,11 +174,11 @@ fn workflow_trigger_entry(trigger: WorkflowTrigger) -> YamlKeyValue {
       ]))
     WorkflowCall { inputs: _ } =>
       kv(key: "workflow_call", value: YamlNull)
-    WorkflowRunCompleted { workflows: ws, branches: bs } =>
+    WorkflowRunTriggered { workflows: ws, branches: bs, activity: a } =>
       kv(key: "workflow_run", value: yaml_mapping(entries: [
         kv(key: "workflows", value: string_list_flow(items: ws)),
         kv(key: "branches", value: string_list_flow(items: bs)),
-        kv(key: "types", value: string_list_flow(items: [workflow_run_activity_completed]))
+        kv(key: "types", value: string_list_flow(items: [workflow_run_activity_name(activity: a)]))
       ]))
     MergeGroup =>
       kv(key: "merge_group", value: YamlNull)
diff --git a/dag/extdeps/linux/cgroup_v2_memory.dag b/dag/extdeps/linux/cgroup_v2_memory.dag
index e6c3d0e5265..da7f9720069 100644
--- a/dag/extdeps/linux/cgroup_v2_memory.dag
+++ b/dag/extdeps/linux/cgroup_v2_memory.dag
@@ -57,6 +57,8 @@ type CgroupMemoryInterfaceFile
   | MemoryMax
   | MemoryHigh
   | MemorySwapCurrent
+  | MemorySwapMax
+  | MemorySwapPeak
   | MemoryEvents
 
 fn cgroup_memory_interface_file_name(f: CgroupMemoryInterfaceFile) -> NonEmptyStr {
@@ -66,6 +68,8 @@ fn cgroup_memory_interface_file_name(f: CgroupMemoryInterfaceFile) -> NonEmptySt
     MemoryMax => "memory.max"
     MemoryHigh => "memory.high"
     MemorySwapCurrent => "memory.swap.current"
+    MemorySwapMax => "memory.swap.max"
+    MemorySwapPeak => "memory.swap.peak"
     MemoryEvents => "memory.events"
   }
 }
@@ -77,6 +81,8 @@ fn cgroup_memory_metric_kind(f: CgroupMemoryInterfaceFile) -> CgroupMemoryMetric
     MemoryMax => Instantaneous
     MemoryHigh => Instantaneous
     MemorySwapCurrent => Instantaneous
+    MemorySwapMax => Instantaneous
+    MemorySwapPeak => LifetimeEpochScoped
     MemoryEvents => CumulativeCounter
   }
 }
diff --git a/dag/extdeps/linux/ethtool_ioctl.dag b/dag/extdeps/linux/ethtool_ioctl.dag
new file mode 100644
index 00000000000..ae1590ed022
--- /dev/null
+++ b/dag/extdeps/linux/ethtool_ioctl.dag
@@ -0,0 +1,90 @@
+module extdeps.linux.ethtool_ioctl
+
+import std.types { String, NonEmptyStr, Int, List, Bool }
+import std.algebra { trim }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+import extdeps.python { PythonProgramText, python_run_program_argv, python_program }
+import extdeps.exec.command { ArgvCommand, argv_command, LocalExec }
+import gunbc.command_runner { run_shell_command_observe_outcome }
+import extdeps.shell.exec { ProcessRan, ProcessNotSpawned }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri { scheme: Https, locator: "github.com/torvalds/linux/blob/v6.9/include/uapi/linux/ethtool.h" }
+}
+
+// Linux's ETHTOOL_GCHANNELS/SIOCETHTOOL ABI, not ethtool's diagnostic prose. The Python
+// realization only marshals the native ABI and returns the syscall's errno or all nine u32s.
+// No package selection or repair policy lives in it. PythonProgramText carries the same
+// declared second-medium boundary as extdeps.nvidia.cuda_driver. This realization admits
+// Linux's 64-bit ifreq layout (16-byte name, 24-byte union); other ABIs fail before ioctl.
+// include/uapi/linux/{ethtool.h,sockios.h,if.h}; include/uapi/asm-generic/errno.h.
+data linux_siocethtool: Int = 35142
+data linux_ethtool_gchannels: Int = 60
+data linux_eopnotsupp: Int = 95
+
+type LinuxEthtoolChannels
+  = LinuxEthtoolChannelsRead { combined: Int }
+  | LinuxEthtoolChannelsUnsupported
+  | LinuxEthtoolChannelsUnreadable { cause: NonEmptyStr }
+
+fn linux_ethtool_channels_program() -> PythonProgramText {
+  join([
+    "import array, fcntl, socket, struct, sys",
+    "name = sys.argv[1]",
+    "assert struct.calcsize('P') == 8 and array.array('I').itemsize == 4",
+    "encoded = name.encode('ascii')",
+    "assert 0 < len(encoded) < 16 and chr(0) not in name",
+    concat("channels = array.array('I', [", concat(to_string(linux_ethtool_gchannels), "] + [0] * 8)")),
+    "with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:",
+    "    request = struct.pack('16sP', encoded, channels.buffer_info()[0]).ljust(40, bytes([0]))",
+    "    try:",
+    concat("        fcntl.ioctl(sock.fileno(), ", concat(to_string(linux_siocethtool), ", request)")),
+    "    except OSError as error:",
+    "        print('errno:' + name + ':' + str(error.errno))",
+    "    else:",
+    "        print('channels:' + name + ':' + ':'.join(str(x) for x in channels))",
+  ], "\n") as PythonProgramText
+}
+
+fn linux_ethtool_channels_command(device: NonEmptyStr) -> ArgvCommand {
+  let words = python_run_program_argv(program: linux_ethtool_channels_program())
+  argv_command(program: python_program(), arguments: words.skip(n: 1) + [device as String])
+}
+
+// Eliminate first() by a match, following optional_equality_answers_by_representation:
+// the seed's raw optional carrier cannot be compared with a Present literal.
+fn linux_ethtool_channels_decode(device: NonEmptyStr, text: String) -> LinuxEthtoolChannels {
+  let fields = split(s: trim(s: text), delimiter: ":")
+  let prefix = concat("channels:", concat(device as String, ":"))
+  if trim(s: text) == concat("errno:", concat(device as String, concat(":", to_string(linux_eopnotsupp)))) {
+    LinuxEthtoolChannelsUnsupported
+  } else if fields.count() == 11 && starts_with(s: trim(s: text), prefix: prefix) {
+    let numbers = fields.skip(n: 2)
+    let valid = all(numbers, word => string_length(s: word) > 0 && string_length(s: word) <= 10
+      && all(chars(word), cp => cp >= 48 && cp <= 57)
+      && (match parse_int(s: word) { Present { value: n } => n >= 0 && n <= 4294967295 Absent => false }))
+    let command_matches = match numbers.first() {
+      Present { value: command } => command == to_string(linux_ethtool_gchannels)
+      Absent => false
+    }
+    if !valid || !command_matches {
+      LinuxEthtoolChannelsUnreadable { cause: "ETHTOOL_GCHANNELS returned malformed fields or another command" as NonEmptyStr }
+    } else { match numbers.last() {
+      Present { value: last } => match parse_int(s: last) {
+        Present { value: count } => LinuxEthtoolChannelsRead { combined: count }
+        Absent => LinuxEthtoolChannelsUnreadable { cause: "ETHTOOL_GCHANNELS combined count is malformed" as NonEmptyStr }
+      }
+      Absent => LinuxEthtoolChannelsUnreadable { cause: "ETHTOOL_GCHANNELS combined count is missing" as NonEmptyStr }
+    } }
+  } else { LinuxEthtoolChannelsUnreadable { cause: concat("ETHTOOL_GCHANNELS read refused: ", trim(s: text)) as NonEmptyStr } }
+}
+
+fn linux_ethtool_channels_observe(device: NonEmptyStr) -> LinuxEthtoolChannels {
+  match run_shell_command_observe_outcome(command: linux_ethtool_channels_command(device: device), transport: LocalExec) {
+    ProcessRan { observation } => if observation.exit_code == 0 {
+      linux_ethtool_channels_decode(device: device, text: observation.stdout)
+    } else { LinuxEthtoolChannelsUnreadable { cause: "ETHTOOL_GCHANNELS reader could not execute successfully" as NonEmptyStr } }
+    ProcessNotSpawned { program: _, cause } => LinuxEthtoolChannelsUnreadable { cause: cause }
+  }
+}
diff --git a/dag/extdeps/linux/tun_fdinfo.dag b/dag/extdeps/linux/tun_fdinfo.dag
index 3b53f33133f..464e6633ef9 100644
--- a/dag/extdeps/linux/tun_fdinfo.dag
+++ b/dag/extdeps/linux/tun_fdinfo.dag
@@ -12,7 +12,7 @@ import extdeps.filesystem.filesystem_io {
 }
 import extdeps.linux.procfs { procfs_path_literal, ProcSelfStatus, procfs_status_effective_uid }
 import extdeps.numeric.base16 { base16_word_value }
-import extdeps.ethtool { ethtool_observe_combined_channels, EthtoolCombinedChannels, EthtoolCombinedChannelsCurrent, EthtoolCombinedChannelsUnreadable }
+import extdeps.linux.ethtool_ioctl { linux_ethtool_channels_observe, LinuxEthtoolChannels, LinuxEthtoolChannelsRead, LinuxEthtoolChannelsUnsupported, LinuxEthtoolChannelsUnreadable }
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri { scheme: Https, locator: "github.com/torvalds/linux/blob/master/drivers/net/tun.c" }
@@ -24,10 +24,11 @@ data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
 // references held by io_uring/SCM_RIGHTS rather than installed process FDs. Denied reads refuse.
 //
 // WHERE THE QUEUE COUNT COMES FROM: the current combined channel count, read through
-// extdeps.ethtool. This carries over the earlier inline probe's ETHTOOL_GCHANNELS read, and with it
-// that probe's UNVERIFIED assumption that tun answers that request. If it does not, every census is
-// Unreadable, which blocks release and never reports zero. The assumption is a live check before
-// first commissioning (run `ethtool -l <tap>` against a slot's device on srv1).
+// extdeps.linux.ethtool_ioctl, preserving EOPNOTSUPP as a capability absence. Linux v6.9 drivers/net/tun.c tun_get_channels publishes tun->numqueues;
+// v6.8 has no get_channels callback. srv1's 6.8.0-138-generic returned Operation not supported
+// during PR #13607 commissioning on 2026-10-09. An unsupported query remains Unreadable, never
+// zero: descriptor sweeps alone miss SCM_RIGHTS/io_uring references. Upgrading a host requires
+// a fresh successful capability observation, not admission by a version string.
 //
 // ROOT IS ESTABLISHED, NOT INFERRED FROM DENIALS. A non-root reader is refused by the effective uid
 // on /proc/self/status before anything else is read. Denied fdinfo reads alone would not be
@@ -41,9 +42,23 @@ type TunCensusRefusal
   | TunCensusReaderNotRoot { euid: Int }
   | TunCensusFlagsUnreadable
   | TunCensusMultiQueue
+  | TunCensusQueueCountUnsupported
   | TunCensusQueueCountUnreadable { cause: NonEmptyStr }
   | TunCensusProcUnreadable { path: String }
 
+fn tun_census_refusal_text(cause: TunCensusRefusal) -> String {
+  match cause {
+    TunCensusSubjectInadmissible => "TUN census interface name is inadmissible"
+    TunCensusReaderIdentityUnreadable => "TUN census reader identity is unreadable"
+    TunCensusReaderNotRoot { euid } => concat("TUN census requires root; effective UID is ", to_string(euid))
+    TunCensusFlagsUnreadable => "TUN interface flags are unreadable or malformed"
+    TunCensusMultiQueue => "TUN census does not admit multi-queue interfaces"
+    TunCensusQueueCountUnsupported => "TUN attached-queue count requires ETHTOOL_GCHANNELS support in the running kernel (EOPNOTSUPP)"
+    TunCensusQueueCountUnreadable { cause: detail } => concat("TUN attached-queue count is unavailable: ", detail as String)
+    TunCensusProcUnreadable { path } => concat("TUN descriptor census could not read ", path)
+  }
+}
+
 // An exact nonnegative count must be affirmed; missing or malformed is not zero. `exited` counts
 // pids and threads that disappeared between being listed and being read. They were skipped, not
 // treated as holders or as refusals.
@@ -56,7 +71,7 @@ type TunDescriptorCensus
 
 fn tun_interface_name_admissible(name: String) -> Bool {
   let cps = name |> chars
-  length(cps) > 0 && all(cps, cp => (cp >= 97 && cp <= 122) || (cp >= 65 && cp <= 90) || (cp >= 48 && cp <= 57) || cp == 95 || cp == 45)
+  length(cps) > 0 && length(cps) < 16 && all(cps, cp => (cp >= 97 && cp <= 122) || (cp >= 65 && cp <= 90) || (cp >= 48 && cp <= 57) || cp == 95 || cp == 45)
 }
 
 fn tun_decimal_name(name: String) -> Bool {
@@ -87,13 +102,14 @@ type TunQueueReading
   = TunQueuesAttached { count: Int }
   | TunQueuesRefused { cause: TunCensusRefusal }
 
-fn tun_queue_reading(mode: TunQueueMode, channels: EthtoolCombinedChannels) -> TunQueueReading {
+fn tun_queue_reading(mode: TunQueueMode, channels: LinuxEthtoolChannels) -> TunQueueReading {
   match mode {
     TunFlagsMalformed => TunQueuesRefused { cause: TunCensusFlagsUnreadable }
     TunMultiQueue => TunQueuesRefused { cause: TunCensusMultiQueue }
     TunSingleQueue => match channels {
-      EthtoolCombinedChannelsCurrent { count: n } => TunQueuesAttached { count: n }
-      EthtoolCombinedChannelsUnreadable { cause: c } => TunQueuesRefused { cause: TunCensusQueueCountUnreadable { cause: c } }
+      LinuxEthtoolChannelsRead { combined: n } => TunQueuesAttached { count: n }
+      LinuxEthtoolChannelsUnsupported => TunQueuesRefused { cause: TunCensusQueueCountUnsupported }
+      LinuxEthtoolChannelsUnreadable { cause: c } => TunQueuesRefused { cause: TunCensusQueueCountUnreadable { cause: c } }
     }
   }
 }
@@ -220,7 +236,7 @@ fn tun_observe_queues(name: String) -> TunQueueReading {
   let r = Filesystem.Read(path: path)
   match filesystem_exact_read(path: path, content: r.content, success: r.success, error: r.error, error_kind: r.error_kind) {
     FilesystemExactPathRead { path: _, content: c } =>
-      tun_queue_reading(mode: tun_queue_mode(flags: c), channels: ethtool_observe_combined_channels(device: name as NonEmptyStr))
+      tun_queue_reading(mode: tun_queue_mode(flags: c), channels: linux_ethtool_channels_observe(device: name as NonEmptyStr))
     other => TunQueuesRefused { cause: TunCensusFlagsUnreadable }
   }
 }
@@ -237,6 +253,23 @@ fn tun_reader_refusal() -> TunCensusRefusal? {
   }
 }
 
+// The chosen census needs this operation on this interface. Convergence consumes the same
+// requirement; it does not maintain a parallel list of host kernel versions or tools.
+type TunAttachedQueueRequirement { interface: NonEmptyStr }
+
+fn tun_attached_queue_requirement(name: NonEmptyStr) -> TunAttachedQueueRequirement {
+  TunAttachedQueueRequirement { interface: name }
+}
+
+fn tun_attached_queue_requirement_observe(requirement: TunAttachedQueueRequirement) -> TunQueueReading {
+  if !tun_interface_name_admissible(name: requirement.interface as String) {
+    TunQueuesRefused { cause: TunCensusSubjectInadmissible }
+  } else { match tun_reader_refusal() {
+    Present { value: cause } => TunQueuesRefused { cause: cause }
+    Absent => tun_observe_queues(name: requirement.interface as String)
+  } }
+}
+
 // The census, in the order the refusals are owed: subject, reader identity, interface presence,
 // then the joined observation. Only a not_found on tun_flags is Missing; any other failure to read
 // it is Unreadable.
@@ -250,7 +283,8 @@ fn tun_descriptor_census_observe(name: String) -> TunDescriptorCensus {
       match filesystem_exact_read(path: path, content: r.content, success: r.success, error: r.error, error_kind: r.error_kind) {
         FilesystemExactPathAbsent { path: _ } => TunInterfaceMissing
         FilesystemExactPathRead { path: _, content: _ } => {
-          let before = tun_observe_queues(name: name)
+          let requirement = tun_attached_queue_requirement(name: name as NonEmptyStr)
+          let before = tun_attached_queue_requirement_observe(requirement: requirement)
           match before {
             TunQueuesRefused { cause: c } => TunDescriptorUnreadable { cause: c }
             TunQueuesAttached { count: _ } => {
@@ -259,7 +293,7 @@ fn tun_descriptor_census_observe(name: String) -> TunDescriptorCensus {
                 TunSweepRefused { cause: c } => TunDescriptorUnreadable { cause: c }
                 TunSweepComplete { holders: _, exited: _ } => {
                   let second = tun_sweep(name: name)
-                  tun_census_join(before: before, first: first, second: second, after: tun_observe_queues(name: name))
+                  tun_census_join(before: before, first: first, second: second, after: tun_attached_queue_requirement_observe(requirement: requirement))
                 }
               }
             }
diff --git a/dag/extdeps/llm/codex_auth.dag b/dag/extdeps/llm/codex_auth.dag
index b8762766e94..732f8e5b6b6 100644
--- a/dag/extdeps/llm/codex_auth.dag
+++ b/dag/extdeps/llm/codex_auth.dag
@@ -251,3 +251,33 @@ fn codex_default_organization(token: CodexIdToken) -> CodexOrganizationMembershi
 fn codex_organization_ids(token: CodexIdToken) -> List<NonEmptyStr> {
   token.openai_auth.organizations |> map(o => o.id)
 }
+
+// WHAT THE SOURCE SAYS, BESIDE WHAT ONE HOST SHOWED. codex_observed_refresh_persistence records an
+// observation on codex-cli 0.145.0 and stays as observed; this row records a separate fact, read from
+// the CLI's source at a pinned revision, so neither one gets rewritten into the other. At
+// github.com/openai/codex 7f892275e31002f0422477c6219189284560e689 (2026-10-04), crate codex-rs/login,
+// module auth/manager.rs: AuthManager::auth refreshes when should_refresh_proactively holds, meaning
+// the access_token JWT exp falls within CHATGPT_ACCESS_TOKEN_REFRESH_WINDOW_MINUTES (5) of now, or
+// last_refresh is older than TOKEN_REFRESH_INTERVAL (8 days). refresh_and_persist_chatgpt_token then
+// calls persist_tokens, which writes id_token, access_token, the refresh_token the response returned
+// and last_refresh back to the auth storage (CODEX_HOME/auth.json under the default
+// AuthCredentialsStoreMode::File). So at this revision the file is rewritten about once an hour
+// during use, not only at login.\n\nRotation stays a separate fact. The response's refresh_token is
+// an Option, and the client maps the issuer's error code refresh_token_reused to
+// RefreshTokenFailedReason::Exhausted, so the issuer detects reuse. The source shows the CLIENT is
+// ready for rotation; whether the issuer actually rotates on every exchange is server behaviour, and
+// codex_observed_refresh_rotation stays CodexRotationUnobserved until it is observed.\n\nThe source
+// also has no cross-process lock on the file: the refresh lock is per process, and the guarded
+// reload compares account ids, not a lock token. So two processes refreshing one copy can both
+// present the same refresh token.
+data codex_source_revision: NonEmptyStr = "github.com/openai/codex@7f892275e31002f0422477c6219189284560e689" as NonEmptyStr
+data codex_source_refresh_persistence: CodexRefreshPersistence = CodexPersistsOnRefresh
+data codex_source_access_token_refresh_window: Second = second(count: 300)
+
+// THE auth.json KEYS THE HARNESS READS to decide a write-back, as named by codex-rs/login
+// token_data.rs TokenData and auth/storage.rs AuthDotJson. They are wire names of the observed file layout above, not new
+// vocabulary.
+data codex_auth_file_auth_mode_key: NonEmptyStr = "auth_mode" as NonEmptyStr
+data codex_auth_file_tokens_key: NonEmptyStr = "tokens" as NonEmptyStr
+data codex_auth_file_refresh_token_key: NonEmptyStr = "refresh_token" as NonEmptyStr
+data codex_auth_file_account_id_key: NonEmptyStr = "account_id" as NonEmptyStr
diff --git a/dag/extdeps/llm/cursor_cli.dag b/dag/extdeps/llm/cursor_cli.dag
index 8d1dad9e086..47cbbe602ec 100644
--- a/dag/extdeps/llm/cursor_cli.dag
+++ b/dag/extdeps/llm/cursor_cli.dag
@@ -108,8 +108,11 @@ data cursor_model_grok_high_fast: CursorModelId = "cursor-grok-4.5-high-fast" as
 data cursor_observed_model_roster_size: Int = 193
 
 // DELIBERATELY NOT USED: -w/--worktree starts the agent in an isolated git worktree the CLI creates under ~/.cursor/worktrees/<repo>/<name>. This repository's belt already creates and owns attempt worktrees under the dashboard instance's own attempts root, with the branch name and attempt identity bound to the roadmap node.\n\nAccepting the CLI's worktree would hand that ownership to the provider: the location would move outside the instance root the model treats as owned, the naming would stop deriving from the attempt, and teardown would belong to a directory nobody declared. The flag is recorded so the choice is visible rather than looking like an oversight — a later reader finding two worktree mechanisms should know only one is ours.
-type CursorInvocation {
-  auth: CursorAuth
+// THE RUN AND THE CREDENTIAL ARE TWO FACTS. Everything but the key decides the argv; the key decides
+// only where the credential travels. Keeping them apart lets a caller whose key is not in hand (a
+// spawn that exports it from a custody file in the child, gunbc.roadmap_dispatch_actuator) build the
+// same argv this module builds, rather than spelling cursor-agent's flags a second time.
+type CursorRunShape {
   model: CursorModelId
   mode: CursorExecutionMode
   sandbox: CursorSandboxChoice
@@ -120,6 +123,11 @@ type CursorInvocation {
   prompt: NonEmptyStr
 }
 
+type CursorInvocation {
+  auth: CursorAuth
+  run: CursorRunShape
+}
+
 // THE AUTH FIELD WAS NEVER READ, SO BOTH ARMS PRODUCED THE SAME PROCESS. shape_cursor_agent_argv
 // built an argv and returned a List of String, and its accompanying note explained at length why
 // the key is deliberately absent from that argv — which was true, and which meant a
@@ -147,20 +155,20 @@ type CursorProcessInvocation {
   environment: List<CursorEnvBinding>
 }
 
-fn cursor_common_argv(inv: CursorInvocation) -> List<String> {
+fn cursor_common_argv(run: CursorRunShape) -> List<String> {
   concat(
     [cursor_cli_program, "--print"],
     concat(
-      ["--output-format", cursor_output_format_wire(f: inv.output_format)],
+      ["--output-format", cursor_output_format_wire(f: run.output_format)],
       concat(
-        ["--model", inv.model as String],
+        ["--model", run.model as String],
         concat(
-          cursor_mode_args(mode: inv.mode),
+          cursor_mode_args(mode: run.mode),
           concat(
-            cursor_sandbox_args(choice: inv.sandbox),
+            cursor_sandbox_args(choice: run.sandbox),
             concat(
-              if inv.force { ["--force"] } else { [] },
-              if inv.trust_workspace { ["--trust"] } else { [] },
+              if run.force { ["--force"] } else { [] },
+              if run.trust_workspace { ["--trust"] } else { [] },
             ),
           ),
         ),
@@ -169,28 +177,34 @@ fn cursor_common_argv(inv: CursorInvocation) -> List<String> {
   )
 }
 
-fn cursor_tail_argv(inv: CursorInvocation) -> List<String> {
+fn cursor_tail_argv(run: CursorRunShape) -> List<String> {
   concat(
-    ["--workspace", inv.workspace as String],
-    [inv.prompt as String],
+    ["--workspace", run.workspace as String],
+    [run.prompt as String],
   )
 }
 
+// The argv of a run whose key reaches the process through CURSOR_API_KEY set by someone else: the
+// environment arm's argv, with nothing about the key in it.
+fn cursor_environment_authenticated_argv(run: CursorRunShape) -> List<String> {
+  concat(cursor_common_argv(run: run), cursor_tail_argv(run: run))
+}
+
 fn shape_cursor_invocation(inv: CursorInvocation) -> CursorProcessInvocation {
   match inv.auth {
     CursorApiKeyArgument { key } =>
       CursorProcessInvocation {
         program: cursor_cli_program,
         argv: concat(
-          cursor_common_argv(inv: inv),
-          concat(["--api-key", key as String], cursor_tail_argv(inv: inv)),
+          cursor_common_argv(run: inv.run),
+          concat(["--api-key", key as String], cursor_tail_argv(run: inv.run)),
         ),
         environment: [],
       }
     CursorApiKeyEnvironment { key } =>
       CursorProcessInvocation {
         program: cursor_cli_program,
-        argv: concat(cursor_common_argv(inv: inv), cursor_tail_argv(inv: inv)),
+        argv: cursor_environment_authenticated_argv(run: inv.run),
         environment: [
           CursorEnvBinding { name: cursor_api_key_env_var, value: key },
         ],
@@ -212,14 +226,16 @@ fn cursor_automation_invocation(
 ) -> CursorInvocation {
   CursorInvocation {
     auth: CursorApiKeyEnvironment { key: key },
-    model: model,
-    mode: mode,
-    sandbox: sandbox,
-    output_format: output_format,
-    force: force,
-    trust_workspace: trust_workspace,
-    workspace: workspace,
-    prompt: prompt,
+    run: CursorRunShape {
+      model: model,
+      mode: mode,
+      sandbox: sandbox,
+      output_format: output_format,
+      force: force,
+      trust_workspace: trust_workspace,
+      workspace: workspace,
+      prompt: prompt,
+    },
   }
 }
 
diff --git a/dag/extdeps/nvidia/api_trial_terms.dag b/dag/extdeps/nvidia/api_trial_terms.dag
new file mode 100644
index 00000000000..b6a13ddbdd7
--- /dev/null
+++ b/dag/extdeps/nvidia/api_trial_terms.dag
@@ -0,0 +1,99 @@
+module extdeps.nvidia.api_trial_terms
+
+import std.types { NonEmptyStr, List }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import extdeps.uri { Uri, Https }
+
+// THE TERMS THAT GOVERN AN NVIDIA-HOSTED API SERVICE, as their own upstream because they are an
+// independently versioned document (DESIGN section 3, external upstream decomposition). They are not
+// a property of a model -- the Nemotron 3 Ultra weights are licensed under OpenMDW-1.1, a different
+// document with different obligations -- and not of a router that forwards to the service: OpenRouter
+// links this PDF as the terms of service of its Nvidia endpoint for the free slug, and the obligations
+// below are NVIDIA's whoever relays the request.
+//
+// READ 2026-10-05 from the PDF itself; the document's own last line is "v. September 19, 2025". Every
+// obligation row below cites the section that states it, and the section text was read from that
+// version, not transcribed from a summary.
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https,
+    locator: "assets.ngc.nvidia.com/products/api-catalog/legal/NVIDIA%20API%20Trial%20Terms%20of%20Service.pdf",
+  }
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.nvidia.api_trial_terms",
+      decl_name: "nvidia_api_trial_terms_v20250919",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps_external_authority_anchor,
+  further_citations: [],
+}
+
+type NvidiaApiTrialTermsVersion20250919 {}
+
+type NvidiaApiTrialTermsVersion = NvidiaApiTrialTermsVersion20250919
+
+// WHAT THE TERMS OBLIGE OF A USER, one arm per obligation a caller's conduct can breach, each named for
+// the section that states it. A closed set rather than prose because a consumer deciding whether a use
+// is admissible must be able to ask about each obligation separately; a paragraph cannot be asked.
+//
+//   - 1.2 Trial Access Rights: access "for limited trial purposes only and without use of the API
+//     Service or Generated Content in production"; 1.4 repeats the trial limit for credits.
+//   - 2.6(a): User Content may not include "any confidential information, controlled or sensitive
+//     data, including protected health information, personal data"; 4.3 forbids uploading personal,
+//     financial, health or governmental information.
+//   - 3.3(iv): NVIDIA collects "User Content and Generated Content to improve NVIDIA products and
+//     services, including AI models". This is a disclosure rather than a user duty, carried because a
+//     caller choosing what to send needs it as much as the prohibitions.
+//   - 4.2: no copying, selling, sublicensing, transferring or distributing the service or Generated
+//     Content to others.
+//   - 4.12: no use of the service or Generated Content "to develop or improve products or services
+//     that compete with the API Service".
+type NvidiaApiTrialObligation
+  = TrialPurposeNoProduction
+  | NoConfidentialOrPersonalData
+  | ContentUsedToImproveNvidiaProducts
+  | NoRedistributionOfServiceOrOutput
+  | NoCompetingProductDevelopment
+
+fn nvidia_api_trial_obligation_section(o: NvidiaApiTrialObligation) -> NonEmptyStr {
+  match o {
+    TrialPurposeNoProduction => "1.2, 1.4" as NonEmptyStr
+    NoConfidentialOrPersonalData => "2.6(a), 4.3" as NonEmptyStr
+    ContentUsedToImproveNvidiaProducts => "3.3(iv)" as NonEmptyStr
+    NoRedistributionOfServiceOrOutput => "4.2" as NonEmptyStr
+    NoCompetingProductDevelopment => "4.12" as NonEmptyStr
+  }
+}
+
+type NvidiaApiTrialTerms {
+  version: NvidiaApiTrialTermsVersion
+  version_label: NonEmptyStr
+  obligations: List<NvidiaApiTrialObligation>
+  terms: ExternalAuthority
+}
+
+data nvidia_api_trial_terms_v20250919: NvidiaApiTrialTerms = NvidiaApiTrialTerms {
+  version: NvidiaApiTrialTermsVersion20250919 {},
+  version_label: "2025-09-19" as NonEmptyStr,
+  obligations: [
+    TrialPurposeNoProduction,
+    NoConfidentialOrPersonalData,
+    ContentUsedToImproveNvidiaProducts,
+    NoRedistributionOfServiceOrOutput,
+    NoCompetingProductDevelopment,
+  ],
+  terms: extdeps_external_authority_anchor,
+}
+
+fn nvidia_api_trial_terms_wire(t: NvidiaApiTrialTerms) -> NonEmptyStr {
+  join([
+    "NVIDIA API Trial Terms of Service v. ", t.version_label as String, " (",
+    join(map(t.obligations, o => nvidia_api_trial_obligation_section(o: o) as String), "; "), ")",
+  ], "") as NonEmptyStr
+}
diff --git a/dag/extdeps/nvidia/nemotron_3_ultra.dag b/dag/extdeps/nvidia/nemotron_3_ultra.dag
new file mode 100644
index 00000000000..c6bc8a62ad5
--- /dev/null
+++ b/dag/extdeps/nvidia/nemotron_3_ultra.dag
@@ -0,0 +1,46 @@
+module extdeps.nvidia.nemotron_3_ultra
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import extdeps.uri { Uri, Https }
+
+// NVIDIA NEMOTRON 3 ULTRA, as its own extdeps authority for the reason extdeps.deepseek.deepseek_v4 and
+// extdeps.zhipu.glm_5_3_flash are: an independently versioned upstream model is not a property of
+// whatever serves it. What a HOSTED endpoint of this model admits -- its window, its output ceiling, the
+// reasoning efforts its router accepts -- is the endpoint's fact and lives with the router
+// (extdeps.openrouter.openrouter); what the endpoint's operator requires of its users lives with those
+// terms (extdeps.nvidia.api_trial_terms). This module carries only what the model card says about the
+// model.
+//
+// READ 2026-10-05 from the model card at the anchor: 550B total / 55B active parameters, a hybrid
+// Transformer-Mamba mixture-of-experts, text in and text out, weights under OpenMDW-1.1.
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https,
+    locator: "huggingface.co/nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B-BF16",
+  }
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.nvidia.nemotron_3_ultra",
+      decl_name: "nemotron_ultra_thinking_end_token",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps_external_authority_anchor,
+  further_citations: [],
+}
+
+// THE CARD'S REASONING MODES ARE NOT MODELLED HERE, AND THE ABSENCE IS DELIBERATE. The card names three --
+// off and full via chat_template_kwargs enable_thinking, and "Medium-effort reasoning" via medium_effort,
+// which "uses significantly fewer reasoning tokens than full thinking mode" -- but those keys address a
+// chat template, and the only route this repository has to the model is a router that takes its own
+// reasoning parameter and translates it unseen. Nothing here can send them, so a type for them would be
+// a declaration with no consumer. A self-hosted Nemotron unit is the consumer that would add it.
+
+// THE END-OF-THINKING CLOSER. The card's budget client splits a completion on "</think>" and appends it
+// when a capped trace never produced one, so it is the model's own delimiter.
+data nemotron_ultra_thinking_end_token: NonEmptyStr = "</think>" as NonEmptyStr
diff --git a/dag/extdeps/ocp/mt_jade/platform.dag b/dag/extdeps/ocp/mt_jade/platform.dag
index d09442f52c0..6a9f66ccc24 100644
--- a/dag/extdeps/ocp/mt_jade/platform.dag
+++ b/dag/extdeps/ocp/mt_jade/platform.dag
@@ -33,7 +33,7 @@ import extdeps.ocp.mt_jade.subject {
 
 data extdeps_external_authority_anchor: ExternalAuthority = mt_jade_subject_authority_anchor
 
-// This module does not widen extdeps.boards.types BaseboardModel. Mt. Jade identity lives here
+// This module does not widen any generic board enum (extdeps.board_authority carries references, not products). Mt. Jade identity lives here
 // and in extdeps.ocp.mt_jade.subject; Wiwynn SV328R is a separate product. Adding a board must
 // not edit a generic product enum (same standing as extdeps.ocp.mt_mitchell.platform).
 
diff --git a/dag/extdeps/ocp/mt_jade/subject.dag b/dag/extdeps/ocp/mt_jade/subject.dag
index 568ef866d9b..0f02d79d5e1 100644
--- a/dag/extdeps/ocp/mt_jade/subject.dag
+++ b/dag/extdeps/ocp/mt_jade/subject.dag
@@ -5,6 +5,7 @@ import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
 import extdeps.uri { Uri, Https }
 import extdeps.vendor { Vendor }
+import extdeps.board_authority { BoardAuthorityRef }
 import extdeps.hardware { Hardware }
 import extdeps.vendor.ampere { ampere_vendor }
 import extdeps.publication { SpecificationDocumentDate }
@@ -99,6 +100,16 @@ data mt_jade_reference_platform: MtJadeReferencePlatform = MtJadeReferencePlatfo
   excluded_appendices: mt_jade_excluded_non_normative_appendices,
 }
 
+// THE BOARD-AUTHORITY REFERENCE to this subject, exported so a binding row names the subject by
+// importing it rather than spelling a module path.
+data mt_jade_board_authority: BoardAuthorityRef = BoardAuthorityRef {
+  subject: DeclarationRef {
+    module_path: "extdeps.ocp.mt_jade.subject",
+    decl_name: "mt_jade_reference_platform",
+    field: WholeDeclaration
+  }
+}
+
 data mt_jade_model_scope: ExternalModelScope = ExternalModelScope {
   subject: ExternalSubjectRef {
     declaration: DeclarationRef {
diff --git a/dag/extdeps/ocp/mt_mitchell/platform.dag b/dag/extdeps/ocp/mt_mitchell/platform.dag
index 1f7786f8a41..0ecda166c13 100644
--- a/dag/extdeps/ocp/mt_mitchell/platform.dag
+++ b/dag/extdeps/ocp/mt_mitchell/platform.dag
@@ -22,7 +22,7 @@ import extdeps.ocp.mt_mitchell.subject {
 
 data extdeps_external_authority_anchor: ExternalAuthority = mt_mitchell_subject_authority_anchor
 
-data platform_subject_edge_note: String = "THE SPECIFICATION IDENTITY IS NOT RE-DECLARED HERE. extdeps.ocp.mt_mitchell.subject owns the marketing name, revision, version label, contributor and licence rows; this module carries the board facts the specification states and binds them to that declaration through the subject edge below — the extdeps.ocp.mt_jade.platform shape. Mt. Mitchell and the Ampere Altra Platform Hardware Design Specification stay separate authorities for the reason DESIGN section 3 gives: OCP publishes and licenses this document under the Open Web Foundation agreements with its own revision series and contributor population, Ampere publishes the other under a proprietary marking, and neither may require editing the other's module. Nothing here dispatches between them and neither module imports the other; a consumer that needs both joins them downstream. This module likewise does not widen extdeps.boards.types BaseboardModel — adding a board must not edit a generic product enum."
+data platform_subject_edge_note: String = "THE SPECIFICATION IDENTITY IS NOT RE-DECLARED HERE. extdeps.ocp.mt_mitchell.subject owns the marketing name, revision, version label, contributor and licence rows; this module carries the board facts the specification states and binds them to that declaration through the subject edge below — the extdeps.ocp.mt_jade.platform shape. Mt. Mitchell and the Ampere Altra Platform Hardware Design Specification stay separate authorities for the reason DESIGN section 3 gives: OCP publishes and licenses this document under the Open Web Foundation agreements with its own revision series and contributor population, Ampere publishes the other under a proprietary marking, and neither may require editing the other's module. Nothing here dispatches between them and neither module imports the other; a consumer that needs both joins them downstream. This module likewise does not widen any generic board enum — adding a board must not edit a generic product enum."
 
 data mt_mitchell_platform_subject: MtMitchellReferencePlatform = mt_mitchell_reference_platform
 
diff --git a/dag/extdeps/openrouter/nvidia_nemotron_3_ultra_free.dag b/dag/extdeps/openrouter/nvidia_nemotron_3_ultra_free.dag
new file mode 100644
index 00000000000..17bec64cc62
--- /dev/null
+++ b/dag/extdeps/openrouter/nvidia_nemotron_3_ultra_free.dag
@@ -0,0 +1,77 @@
+module extdeps.openrouter.nvidia_nemotron_3_ultra_free
+
+import std.types { NonEmptyStr, Bool, List }
+import std.measure { TokenCount, token_count, MoneyAmountMicro, money_amount_micro }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.external_authority {
+  ExternalAuthority, ExternalModelScope, ExternalSubjectRef,
+}
+import extdeps.uri { Uri, Https }
+import extdeps.openrouter.openrouter { OpenRouterReasoningEffort, EffortHigh, EffortMedium }
+import extdeps.nvidia.api_trial_terms { NvidiaApiTrialTerms, nvidia_api_trial_terms_v20250919 }
+
+// OPENROUTER'S LISTING OF NEMOTRON 3 ULTRA'S FREE VARIANT. What a listing admits is OpenRouter's fact
+// about its endpoint, not NVIDIA's about the model (extdeps.nvidia.nemotron_3_ultra), so it is a row in
+// OpenRouter's module family; a second listing is a second file, never an edit to this one.
+//
+// READ 2026-10-05 from the endpoints read at the anchor and from GET /api/v1/models: one endpoint,
+// provider Nvidia, upstream snapshot nvidia/nemotron-3-ultra-550b-a55b-20260604:free, context_length
+// 1000000, max_completion_tokens 65536, pricing prompt 0 / completion 0, supported_parameters reasoning,
+// include_reasoning, temperature, max_tokens, seed, top_p, tools, tool_choice, reasoning_effort; and on
+// the models listing, reasoning {mandatory: false, default_enabled: true, supported_efforts: ["high",
+// "medium"], default_effort: "high"}.
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https,
+    locator: "openrouter.ai/api/v1/models/nvidia/nemotron-3-ultra-550b-a55b:free/endpoints",
+  }
+}
+
+data openrouter_models_listing_authority: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https,
+    locator: "openrouter.ai/api/v1/models",
+  }
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.openrouter.nvidia_nemotron_3_ultra_free",
+      decl_name: "nemotron_ultra_free_model_id",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps_external_authority_anchor,
+  further_citations: [openrouter_models_listing_authority],
+}
+
+data nemotron_ultra_free_model_id: NonEmptyStr = "nvidia/nemotron-3-ultra-550b-a55b:free" as NonEmptyStr
+
+// THE ENDPOINT'S WINDOW AND OUTPUT CEILING. Both are the endpoint's admission, which is why they are here
+// and not on the model: the paid listing of the same model publishes 262144 and 16384.
+data nemotron_ultra_free_context_length: TokenCount = token_count(count: 1000000)
+
+data nemotron_ultra_free_max_completion_tokens: TokenCount = token_count(count: 65536)
+
+// THE EFFORTS THIS LISTING ACCEPTS, transcribed from supported_efforts in the listing's own order
+// (highest first), and the two facts beside them a request needs: reasoning is not mandatory, so
+// `reasoning.enabled: false` is a request the listing admits, and the default effort is high.
+data nemotron_ultra_free_supported_efforts: List<OpenRouterReasoningEffort> = [EffortHigh, EffortMedium]
+
+data nemotron_ultra_free_reasoning_mandatory: Bool = false
+
+// THE PRICE IS ZERO PER TOKEN (prompt and completion both read "0" USD) AND THE LIMIT IS PER REQUEST, which is what makes reasoning depth cost
+// neither money nor quota on this listing: a deeper effort spends latency and completion budget only.
+data nemotron_ultra_free_price_per_token: MoneyAmountMicro = money_amount_micro(count: 0)
+
+// WHICH MODEL MODE EACH ACCEPTED EFFORT REACHES IS NOT STATED, AND NOTHING HERE ASSERTS IT. The two
+// efforts coincide with the card's two thinking modes (full and medium), and "high reaches full" is the
+// obvious reading -- but neither OpenRouter nor NVIDIA publishes the translation, so it is a bet (DESIGN
+// section 4d) and no row consumes it. What IS published is the ORDER: supported_efforts is "returned in
+// descending effort order (highest first)" (the reasoning-tokens guide), so a consumer ranking depth reads
+// the position in this list, which is cited, rather than a mode, which is not.
+
+// THE TERMS THE ENDPOINT IS GOVERNED BY. OpenRouter links NVIDIA's API Trial Terms as this provider's
+// terms of service; the obligations are NVIDIA's (extdeps.nvidia.api_trial_terms).
+data nemotron_ultra_free_terms: NvidiaApiTrialTerms = nvidia_api_trial_terms_v20250919
diff --git a/dag/extdeps/openrouter/openrouter.dag b/dag/extdeps/openrouter/openrouter.dag
new file mode 100644
index 00000000000..6ab8e3954af
--- /dev/null
+++ b/dag/extdeps/openrouter/openrouter.dag
@@ -0,0 +1,630 @@
+module extdeps.openrouter.openrouter
+
+import std.types { String, Bool, Int, List, NonEmptyStr }
+import std.algebra { trim }
+import std.nat { Nat, nat_range_inclusive }
+import std.measure { Second, second, second_count }
+import std.checked_arithmetic { checked_int_to_nat }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import extdeps.uri { Uri, Https }
+import extdeps.api_rate_limit { UpstreamRateLimit, PerMinute, PerDay }
+import extdeps.languages.json.emit { JsonValue, JsonObject, JsonNumber, JsonNull, JsonBool, JsonString, JsonArray }
+import extdeps.languages.json.parse {
+  JsonDocumentParsed, JsonDocumentUnreadable, parse_json_document, json_document_gap_text,
+  JsonFieldRead, FieldAbsent, FieldRead, FieldMalformed, json_field, json_field_string, json_field_int, json_field_bool,
+}
+
+// OPENROUTER, as its own extdeps authority: an independently governed router that relays an
+// OpenAI-compatible chat-completions request to one of several providers. It is not OpenAI (its
+// errors, limits, reasoning parameter and key surface are its own), so it does not live in
+// extdeps.llm.openai_rest, and it is not any provider it relays to. A model OpenRouter lists is a row in
+// its own module beside this one (extdeps.openrouter.nvidia_nemotron_3_ultra_free), so a second listing
+// is a new file rather than an edit here.
+//
+// READ 2026-10-05: the API reference overview (the anchor), the limits page and the errors page. The
+// facts below cite which.
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https,
+    locator: "openrouter.ai/docs/api-reference/overview",
+  }
+}
+
+data openrouter_limits_authority: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https,
+    locator: "openrouter.ai/docs/api-reference/limits",
+  }
+}
+
+data openrouter_reasoning_authority: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https,
+    locator: "openrouter.ai/docs/guides/best-practices/reasoning-tokens",
+  }
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.openrouter.openrouter",
+      decl_name: "openrouter_chat_completions_url",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps_external_authority_anchor,
+  further_citations: [openrouter_limits_authority, openrouter_reasoning_authority],
+}
+
+// THE TWO ENDPOINTS THIS REPOSITORY CALLS. Chat completions is OpenAI-compatible in shape; the key read
+// answers what the presented key may still spend. Both authenticate with `Authorization: Bearer <key>`,
+// and both are HTTPS -- there is no plain-http door.
+data openrouter_chat_completions_url: NonEmptyStr = "https://openrouter.ai/api/v1/chat/completions" as NonEmptyStr
+
+data openrouter_key_url: NonEmptyStr = "https://openrouter.ai/api/v1/key" as NonEmptyStr
+
+fn openrouter_authorization_header_line(key: NonEmptyStr) -> String {
+  join(["Authorization: Bearer ", key as String, "\n"], "")
+}
+
+// ── THE FREE-MODEL LIMITS, FROM THE LIMITS PAGE ───────────────────────────────────────────────
+//
+// Free variants (model ids ending in ":free") are limited to 20 requests per minute, and per day to 50
+// when the account has purchased fewer than 10 credits all-time or 1000 when it has purchased at least
+// 10. Both limits bind at once, so a caller leases BOTH pools before each request.
+//
+// THE DAILY TIER IS SELECTED BY A TYPED FACT, NOT CHOSEN AS A LITERAL. Which row applies is a property
+// of the account, and the account says which: the key read below returns free_model_daily_requests.limit,
+// so the fact is DERIVED from what OpenRouter reports for the presented key rather than asserted beside
+// it. Both tiers share one scope and therefore one quota partition, because they are one pool on the
+// upstream whose ceiling moves with the account -- two scopes would let a caller spend both.
+type OpenRouterCreditsPurchased
+  = CreditsPurchasedBelowTen
+  | CreditsPurchasedAtLeastTen
+
+data openrouter_free_models_per_minute: UpstreamRateLimit = UpstreamRateLimit {
+  upstream: "openrouter" as NonEmptyStr,
+  scope: "free-models-minute" as NonEmptyStr,
+  requests: 20,
+  period: PerMinute,
+}
+
+fn openrouter_free_models_per_day(credits: OpenRouterCreditsPurchased) -> UpstreamRateLimit {
+  UpstreamRateLimit {
+    upstream: "openrouter" as NonEmptyStr,
+    scope: "free-models-day" as NonEmptyStr,
+    requests: match credits {
+      CreditsPurchasedBelowTen => 50
+      CreditsPurchasedAtLeastTen => 1000
+    },
+    period: PerDay,
+  }
+}
+
+// THE TIER IS READ OFF THE DAILY LIMIT THE KEY REPORTS, and a limit that is neither published tier is a
+// refusal rather than the nearer one: a third tier is a change to the limits page this module has not
+// read, and guessing it would lease against a ceiling nobody published.
+type OpenRouterCreditsReading
+  = CreditsTierObserved { credits: OpenRouterCreditsPurchased }
+  | CreditsTierUnrecognized { daily_limit: Int }
+
+fn openrouter_credits_from_daily_limit(daily_limit: Int) -> OpenRouterCreditsReading {
+  if daily_limit == 1000 {
+    CreditsTierObserved { credits: CreditsPurchasedAtLeastTen }
+  } else if daily_limit == 50 {
+    CreditsTierObserved { credits: CreditsPurchasedBelowTen }
+  } else {
+    CreditsTierUnrecognized { daily_limit: daily_limit }
+  }
+}
+
+// ── THE KEY READ ─────────────────────────────────────────────────────────────────────────────
+//
+// GET /api/v1/key answers data.{limit, limit_remaining, usage, is_free_tier, free_model_daily_requests
+// {used, limit, remaining}}. Only the members a consumer reads are decoded: whether the key is accepted
+// at all (a 200 that decodes), the key's own credit limit, and the free-model daily counters the tier
+// is derived from.
+//
+// THE KEY'S CREDIT LIMIT IS A DIFFERENT FACT FROM THE ACCOUNT'S TIER. data.limit is a per-KEY spending
+// cap set on the key (null when the key has none); the daily free-model ceiling is per ACCOUNT, set by
+// credits purchased. A key capped at zero credits can spend nothing on a priced model and is still
+// metered by the account's free tier, which is exactly the guard a free-only caller wants: a request
+// that reaches a priced model answers 402 from openrouter_key_limit instead of charging anything.
+//
+// ZERO IS READ OFF THE LEXEME, NOT A FLOAT. The wire carries a JSON number ("0", "0.0"); a lexeme whose
+// digits are all zero is zero in every notation JSON admits for it, and anything else is a positive cap
+// a free-only caller must refuse.
+type OpenRouterKeySpendLimit
+  = KeySpendUncapped
+  | KeySpendCappedAtZero
+  | KeySpendCappedAbove { lexeme: String }
+
+fn openrouter_lexeme_is_zero(lexeme: String) -> Bool {
+  lexeme != "" && trim_zero_digits(s: lexeme) == ""
+}
+
+fn trim_zero_digits(s: String) -> String {
+  replace(s: replace(s: replace(s: replace(s: replace(s: replace(s: s, from: "0", to: ""), from: ".", to: ""), from: "-", to: ""), from: "+", to: ""), from: "e", to: ""), from: "E", to: "")
+}
+
+fn openrouter_decode_key_spend_limit(key_data: JsonValue) -> OpenRouterKeySpendLimit? {
+  match json_field(obj: key_data, key: "limit") {
+    FieldAbsent => Present { value: KeySpendUncapped }
+    FieldMalformed { cause: _ } => none
+    FieldRead { value: v } =>
+      match v {
+        JsonNumber { lexeme: lx } =>
+          if openrouter_lexeme_is_zero(lexeme: lx) { Present { value: KeySpendCappedAtZero } } else { Present { value: KeySpendCappedAbove { lexeme: lx } } }
+        JsonNull => Present { value: KeySpendUncapped }
+        JsonBool { value: _ } => none
+        JsonString { value: _ } => none
+        JsonArray { elements: _ } => none
+        JsonObject { members: _ } => none
+      }
+  }
+}
+
+fn openrouter_key_spend_limit_wire(l: OpenRouterKeySpendLimit) -> String {
+  match l {
+    KeySpendUncapped => "no key credit limit"
+    KeySpendCappedAtZero => "key credit limit 0"
+    KeySpendCappedAbove { lexeme: lx } => join(["key credit limit ", lx], "")
+  }
+}
+
+type OpenRouterKeyRead {
+  is_free_tier: Bool
+  spend_limit: OpenRouterKeySpendLimit
+  free_daily_used: Int
+  free_daily_limit: Int
+  free_daily_remaining: Int
+}
+
+type OpenRouterKeyDecode
+  = OpenRouterKeyDecoded { key: OpenRouterKeyRead }
+  | OpenRouterKeyUndecodable { cause: String }
+
+fn openrouter_int_member(obj: JsonValue, key: String, subject: String) -> JsonFieldRead<Int> {
+  match json_field_int(obj: obj, key: key) {
+    FieldAbsent => FieldMalformed { cause: join([subject, " carries no ", key], "") }
+    FieldMalformed { cause: c } => FieldMalformed { cause: c }
+    FieldRead { value: n } => FieldRead { value: n }
+  }
+}
+
+fn openrouter_decode_key_daily(key_data: JsonValue, is_free_tier: Bool, spend_limit: OpenRouterKeySpendLimit) -> OpenRouterKeyDecode {
+  match json_field(obj: key_data, key: "free_model_daily_requests") {
+    FieldAbsent => OpenRouterKeyUndecodable { cause: "the key read carries no free_model_daily_requests" }
+    FieldMalformed { cause: c } => OpenRouterKeyUndecodable { cause: c }
+    FieldRead { value: daily } =>
+      match openrouter_int_member(obj: daily, key: "used", subject: "free_model_daily_requests") {
+        FieldAbsent => OpenRouterKeyUndecodable { cause: "free_model_daily_requests carries no used" }
+        FieldMalformed { cause: c } => OpenRouterKeyUndecodable { cause: c }
+        FieldRead { value: used } =>
+          match openrouter_int_member(obj: daily, key: "limit", subject: "free_model_daily_requests") {
+            FieldAbsent => OpenRouterKeyUndecodable { cause: "free_model_daily_requests carries no limit" }
+            FieldMalformed { cause: c } => OpenRouterKeyUndecodable { cause: c }
+            FieldRead { value: limit } =>
+              match openrouter_int_member(obj: daily, key: "remaining", subject: "free_model_daily_requests") {
+                FieldAbsent => OpenRouterKeyUndecodable { cause: "free_model_daily_requests carries no remaining" }
+                FieldMalformed { cause: c } => OpenRouterKeyUndecodable { cause: c }
+                FieldRead { value: remaining } =>
+                  OpenRouterKeyDecoded { key: OpenRouterKeyRead { is_free_tier: is_free_tier, spend_limit: spend_limit, free_daily_used: used, free_daily_limit: limit, free_daily_remaining: remaining } }
+              }
+          }
+      }
+  }
+}
+
+fn openrouter_decode_key_read(body: String) -> OpenRouterKeyDecode {
+  match parse_json_document(s: body) {
+    JsonDocumentUnreadable { gap: g } => OpenRouterKeyUndecodable { cause: join(["the key read is not a JSON document: ", json_document_gap_text(gap: g)], "") }
+    JsonDocumentParsed { value: doc } =>
+      match json_field(obj: doc, key: "data") {
+        FieldAbsent => OpenRouterKeyUndecodable { cause: "the key read carries no data member" }
+        FieldMalformed { cause: c } => OpenRouterKeyUndecodable { cause: c }
+        FieldRead { value: key_data } =>
+          match json_field_bool(obj: key_data, key: "is_free_tier") {
+            FieldAbsent => OpenRouterKeyUndecodable { cause: "the key read carries no is_free_tier" }
+            FieldMalformed { cause: c } => OpenRouterKeyUndecodable { cause: c }
+            FieldRead { value: free } =>
+              match openrouter_decode_key_spend_limit(key_data: key_data) {
+                Absent => OpenRouterKeyUndecodable { cause: "the key read's limit member is not a number or null" }
+                Present { value: spend } => openrouter_decode_key_daily(key_data: key_data, is_free_tier: free, spend_limit: spend)
+              }
+          }
+      }
+  }
+}
+
+// ── THE ERROR BODY, FROM THE ERRORS AND LIMITS PAGES ──────────────────────────────────────────
+//
+// Every error is {error: {code, message, metadata?}}. Two codes carry metadata a caller must branch on:
+//
+//   - 402: metadata.limit_source names WHICH budget refused -- openrouter_in_flight_budget,
+//     openrouter_key_limit or openrouter_credits -- and metadata.reason refines the in-flight case as
+//     in_flight_budget_exhausted or weight_exceeds_budget. metadata.remedy_hint is documented as
+//     log-only, so it is carried as text and never branched on. Free models are exempt from the
+//     in-flight budget, but a negative balance still answers 402 from openrouter_credits.
+//   - 429: metadata.error_type is rate_limit_exceeded, with provider_code when the limit was the
+//     provider's rather than OpenRouter's own.
+//
+// THE ENUMS ARE CLOSED AND AN UNKNOWN SPELLING REFUSES. A fourth limit_source decoded as the nearest of
+// three would send a caller to repair the wrong budget, which is the whole reason the field exists.
+type OpenRouterLimitSource
+  = InFlightBudgetLimit
+  | KeySpendLimit
+  | CreditsLimit
+
+fn openrouter_limit_source_wire(s: OpenRouterLimitSource) -> NonEmptyStr {
+  match s {
+    InFlightBudgetLimit => "openrouter_in_flight_budget" as NonEmptyStr
+    KeySpendLimit => "openrouter_key_limit" as NonEmptyStr
+    CreditsLimit => "openrouter_credits" as NonEmptyStr
+  }
+}
+
+type OpenRouterLimitReason
+  = InFlightBudgetExhausted
+  | WeightExceedsBudget
+
+fn openrouter_limit_reason_wire(r: OpenRouterLimitReason) -> NonEmptyStr {
+  match r {
+    InFlightBudgetExhausted => "in_flight_budget_exhausted" as NonEmptyStr
+    WeightExceedsBudget => "weight_exceeds_budget" as NonEmptyStr
+  }
+}
+
+type OpenRouterError
+  = OpenRouterPaymentRequired { limit_source: OpenRouterLimitSource, reason: OpenRouterLimitReason?, message: String, remedy_hint: String? }
+  | OpenRouterRateLimited { message: String, provider_code: String? }
+  | OpenRouterOtherError { code: Int, message: String }
+
+type OpenRouterErrorDecode
+  = OpenRouterErrorDecoded { error: OpenRouterError }
+  | OpenRouterErrorUndecodable { cause: String }
+
+type OpenRouterLimitSourceRead
+  = LimitSourceRead { source: OpenRouterLimitSource }
+  | LimitSourceUnrecognized { wire: String }
+
+fn openrouter_limit_source_from_wire(wire: String) -> OpenRouterLimitSourceRead {
+  if wire == "openrouter_in_flight_budget" {
+    LimitSourceRead { source: InFlightBudgetLimit }
+  } else if wire == "openrouter_key_limit" {
+    LimitSourceRead { source: KeySpendLimit }
+  } else if wire == "openrouter_credits" {
+    LimitSourceRead { source: CreditsLimit }
+  } else {
+    LimitSourceUnrecognized { wire: wire }
+  }
+}
+
+type OpenRouterLimitReasonRead
+  = LimitReasonAbsent
+  | LimitReasonRead { reason: OpenRouterLimitReason }
+  | LimitReasonUnrecognized { wire: String }
+
+fn openrouter_limit_reason_from_field(field: JsonFieldRead<String>) -> OpenRouterLimitReasonRead {
+  match field {
+    FieldAbsent => LimitReasonAbsent
+    FieldMalformed { cause: c } => LimitReasonUnrecognized { wire: c }
+    FieldRead { value: w } =>
+      if w == "in_flight_budget_exhausted" {
+        LimitReasonRead { reason: InFlightBudgetExhausted }
+      } else if w == "weight_exceeds_budget" {
+        LimitReasonRead { reason: WeightExceedsBudget }
+      } else {
+        LimitReasonUnrecognized { wire: w }
+      }
+  }
+}
+
+fn openrouter_optional_string(field: JsonFieldRead<String>) -> String? {
+  match field {
+    FieldRead { value: s } => Present { value: s }
+    FieldAbsent => none
+    FieldMalformed { cause: _ } => none
+  }
+}
+
+fn openrouter_decode_402(message: String, metadata: JsonValue) -> OpenRouterErrorDecode {
+  match json_field_string(obj: metadata, key: "limit_source") {
+    FieldAbsent => OpenRouterErrorUndecodable { cause: "a 402 whose metadata carries no limit_source names no budget to repair" }
+    FieldMalformed { cause: c } => OpenRouterErrorUndecodable { cause: join(["the 402 limit_source is unreadable: ", c], "") }
+    FieldRead { value: source_wire } =>
+      match openrouter_limit_source_from_wire(wire: source_wire) {
+        LimitSourceUnrecognized { wire: w } => OpenRouterErrorUndecodable { cause: join(["the 402 names an unpublished limit_source '", w, "'"], "") }
+        LimitSourceRead { source: source } =>
+          match openrouter_limit_reason_from_field(field: json_field_string(obj: metadata, key: "reason")) {
+            LimitReasonUnrecognized { wire: w } => OpenRouterErrorUndecodable { cause: join(["the 402 names an unpublished reason '", w, "'"], "") }
+            LimitReasonAbsent =>
+              OpenRouterErrorDecoded { error: OpenRouterPaymentRequired { limit_source: source, reason: none, message: message, remedy_hint: openrouter_optional_string(field: json_field_string(obj: metadata, key: "remedy_hint")) } }
+            LimitReasonRead { reason: r } =>
+              OpenRouterErrorDecoded { error: OpenRouterPaymentRequired { limit_source: source, reason: Present { value: r }, message: message, remedy_hint: openrouter_optional_string(field: json_field_string(obj: metadata, key: "remedy_hint")) } }
+          }
+      }
+  }
+}
+
+fn openrouter_decode_error_fields(error: JsonValue) -> OpenRouterErrorDecode {
+  match json_field_int(obj: error, key: "code") {
+    FieldAbsent => OpenRouterErrorUndecodable { cause: "the error object carries no code" }
+    FieldMalformed { cause: c } => OpenRouterErrorUndecodable { cause: c }
+    FieldRead { value: code } => {
+      let message = match json_field_string(obj: error, key: "message") {
+        FieldRead { value: m } => m
+        FieldAbsent => ""
+        FieldMalformed { cause: c } => c
+      }
+      let metadata = match json_field(obj: error, key: "metadata") {
+        FieldRead { value: m } => m
+        FieldAbsent => JsonObject { members: [] }
+        FieldMalformed { cause: _ } => JsonObject { members: [] }
+      }
+      if code == 402 {
+        openrouter_decode_402(message: message, metadata: metadata)
+      } else if code == 429 {
+        OpenRouterErrorDecoded { error: OpenRouterRateLimited { message: message, provider_code: openrouter_optional_string(field: json_field_string(obj: metadata, key: "provider_code")) } }
+      } else {
+        OpenRouterErrorDecoded { error: OpenRouterOtherError { code: code, message: message } }
+      }
+    }
+  }
+}
+
+fn openrouter_decode_error_body(body: String) -> OpenRouterErrorDecode {
+  match parse_json_document(s: body) {
+    JsonDocumentUnreadable { gap: g } => OpenRouterErrorUndecodable { cause: join(["the error body is not a JSON document: ", json_document_gap_text(gap: g)], "") }
+    JsonDocumentParsed { value: doc } =>
+      match json_field(obj: doc, key: "error") {
+        FieldAbsent => OpenRouterErrorUndecodable { cause: "the body carries no error member" }
+        FieldMalformed { cause: c } => OpenRouterErrorUndecodable { cause: c }
+        FieldRead { value: e } => openrouter_decode_error_fields(error: e)
+      }
+  }
+}
+
+// WHAT A 402'S SOURCE MEANS FOR A FREE-ONLY KEY. openrouter_key_limit on a key capped at zero credits
+// is not a budget to top up: it says the request reached a PRICED model, which a free-only caller must
+// refuse and never retry -- retrying sends the same paid request again. The other two sources keep
+// their published meaning.
+fn openrouter_limit_source_meaning(s: OpenRouterLimitSource) -> String {
+  match s {
+    KeySpendLimit => "a priced model was requested through a key whose credit limit forbids spending (never retried); "
+    InFlightBudgetLimit => ""
+    CreditsLimit => ""
+  }
+}
+
+// ── A 429 IS A TYPED REFUSAL THAT CARRIES THE UPSTREAM'S OWN RETRY HINTS ──────────────────────────
+//
+// The limits page says an error OpenRouter itself returns for a platform limit carries X-RateLimit-Limit,
+// X-RateLimit-Remaining and X-RateLimit-Reset, and that Retry-After is added when every attempted provider
+// returned a retry hint. The headers are the upstream's word about when it will answer again, so they ride
+// the refusal instead of being dropped with the transport.
+//
+// WHAT IS NOT PUBLISHED IS NOT ASSERTED (DESIGN section 4d). The page gives neither the unit of
+// X-RateLimit-Reset nor says Retry-After is seconds rather than an HTTP date (RFC 9110 allows both). So
+// Retry-After is read as delta-seconds only when it is all digits and otherwise carried as the text it
+// was; and the reset value is carried VERBATIM, never converted to an instant. A consumer that waits
+// computes its wait from Retry-After alone; the reset is evidence for the operator, with a live reading
+// the thing that would ground its unit.
+type OpenRouterRetryAfter
+  = RetryAfterSeconds { seconds: Second }
+  | RetryAfterUnparsed { text: String }
+  | RetryAfterAbsent
+  | RetryAfterUnread { cause: String }
+
+// THE HEADER DUMP IS READ OR IT IS NOT, AND THE TWO ARE DIFFERENT FACTS. A dump that was read and carries no
+// Retry-After says the upstream gave no hint; a dump that could not be read says nothing about whether it did.
+// Reading a failed read as "no hint" would invent an absence the caller then acts on, so the failure is carried.
+type OpenRouterHeaderDump
+  = HeaderDumpRead { text: String }
+  | HeaderDumpUnread { cause: String }
+
+type OpenRouterRateLimitHints {
+  retry_after: OpenRouterRetryAfter
+  reset: String?
+  limit: String?
+  remaining: String?
+}
+
+// A header dump is the status line and headers of each response curl saw, in order; only the LAST block
+// describes the answer the caller got, so a status line starts a fresh reading.
+type HeaderScan {
+  retry_after: String?
+  reset: String?
+  limit: String?
+  remaining: String?
+}
+
+// HTTP FIELD NAMES ARE CASE-INSENSITIVE (RFC 9110 section 5.1): HTTP/2 sends them lowercase, HTTP/1.1 may
+// not, and a dump is read the same either way. Folded over ASCII letters only.
+data openrouter_ascii_upper: String = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+
+data openrouter_ascii_lower: String = "abcdefghijklmnopqrstuvwxyz"
+
+fn openrouter_ascii_fold(s: String) -> String {
+  fold(nat_range_inclusive(lo: 0, hi: 25), init: s, f: (acc, i) =>
+    replace(acc, substring(s: openrouter_ascii_upper, start: i, end: i + 1), substring(s: openrouter_ascii_lower, start: i, end: i + 1)))
+}
+
+fn openrouter_header_scan_line(acc: HeaderScan, line: String) -> HeaderScan {
+  let t = trim(s: line)
+  if openrouter_ascii_fold(s: t).starts_with("http/") {
+    HeaderScan { retry_after: none, reset: none, limit: none, remaining: none }
+  } else {
+    match split(s: t, delimiter: ":").first() {
+      Absent => acc
+      Present { value: raw_name } => {
+        let name = openrouter_ascii_fold(s: trim(s: raw_name))
+        let value = if length(t) > length(raw_name) { trim(s: substring(s: t, start: length(raw_name) + 1, end: length(t))) } else { "" }
+        if length(t) <= length(raw_name) {
+          acc
+        } else if name == "retry-after" {
+          HeaderScan { retry_after: Present { value: value }, reset: acc.reset, limit: acc.limit, remaining: acc.remaining }
+        } else if name == "x-ratelimit-reset" {
+          HeaderScan { retry_after: acc.retry_after, reset: Present { value: value }, limit: acc.limit, remaining: acc.remaining }
+        } else if name == "x-ratelimit-limit" {
+          HeaderScan { retry_after: acc.retry_after, reset: acc.reset, limit: Present { value: value }, remaining: acc.remaining }
+        } else if name == "x-ratelimit-remaining" {
+          HeaderScan { retry_after: acc.retry_after, reset: acc.reset, limit: acc.limit, remaining: Present { value: value } }
+        } else {
+          acc
+        }
+      }
+    }
+  }
+}
+
+// HTTP delay-seconds IS 1*DIGIT (RFC 9110 section 10.2.3): no sign, no fraction, no unit. The integer parser
+// below accepts a leading '+' or '-' (so '+30' and '-0' would read as numbers), so the lexical shape is
+// checked first and a value that is not all ASCII digits is carried as the text it was.
+fn openrouter_is_ascii_digits(text: String) -> Bool {
+  length(text) > 0 && length(fold(nat_range_inclusive(lo: 0, hi: 9), init: text, f: (acc, i) => replace(acc, to_string(i), ""))) == 0
+}
+
+fn openrouter_retry_after_from_text(text: String) -> OpenRouterRetryAfter {
+  if !openrouter_is_ascii_digits(text: text) {
+    RetryAfterUnparsed { text: text }
+  } else {
+    openrouter_retry_after_from_digits(text: text)
+  }
+}
+
+fn openrouter_retry_after_from_digits(text: String) -> OpenRouterRetryAfter {
+  match parse_int(s: text) {
+    Absent => RetryAfterUnparsed { text: text }
+    Present { value: n } =>
+      match checked_int_to_nat(n: n) {
+        Absent => RetryAfterUnparsed { text: text }
+        Present { value: sec } => RetryAfterSeconds { seconds: second(count: sec) }
+      }
+  }
+}
+
+fn openrouter_rate_limit_hints(dump: OpenRouterHeaderDump) -> OpenRouterRateLimitHints {
+  match dump {
+    HeaderDumpUnread { cause: c } => OpenRouterRateLimitHints { retry_after: RetryAfterUnread { cause: c }, reset: none, limit: none, remaining: none }
+    HeaderDumpRead { text: t } => openrouter_rate_limit_hints_of_text(dump: t)
+  }
+}
+
+fn openrouter_rate_limit_hints_of_text(dump: String) -> OpenRouterRateLimitHints {
+  let scan = fold(split(s: dump, delimiter: "\n"), init: HeaderScan { retry_after: none, reset: none, limit: none, remaining: none }, f: (acc, line) =>
+    openrouter_header_scan_line(acc: acc, line: line))
+  OpenRouterRateLimitHints {
+    retry_after: match scan.retry_after { Absent => RetryAfterAbsent  Present { value: t } => openrouter_retry_after_from_text(text: t) },
+    reset: scan.reset,
+    limit: scan.limit,
+    remaining: scan.remaining,
+  }
+}
+
+// THE REFUSAL ITSELF: an OpenRouter 429 with its hints. It is never retried by the code that decodes it;
+// carrying the hint is how a caller that CHOOSES to wait learns how long.
+type OpenRouterRateLimitRefusal {
+  message: String
+  provider_code: String?
+  hints: OpenRouterRateLimitHints
+}
+
+fn openrouter_decode_rate_limited(body: String, header_dump: OpenRouterHeaderDump) -> OpenRouterRateLimitRefusal? {
+  match openrouter_decode_error_body(body: body) {
+    OpenRouterErrorUndecodable { cause: _ } => none
+    OpenRouterErrorDecoded { error: e } =>
+      match e {
+        OpenRouterRateLimited { message: m, provider_code: p } =>
+          Present { value: OpenRouterRateLimitRefusal { message: m, provider_code: p, hints: openrouter_rate_limit_hints(dump: header_dump) } }
+        OpenRouterPaymentRequired { limit_source: _, reason: _, message: _, remedy_hint: _ } => none
+        OpenRouterOtherError { code: _, message: _ } => none
+      }
+  }
+}
+
+fn openrouter_retry_after_wire(r: OpenRouterRetryAfter) -> String {
+  match r {
+    RetryAfterSeconds { seconds: n } => join(["Retry-After ", to_string(second_count(s: n)), " s"], "")
+    RetryAfterUnparsed { text: t } => join(["Retry-After '", t, "' (not delta-seconds; not interpreted)"], "")
+    RetryAfterAbsent => "no Retry-After"
+    RetryAfterUnread { cause: c } => join(["Retry-After unknown: the response headers could not be read (", c, ")"], "")
+  }
+}
+
+fn openrouter_rate_limit_wire(r: OpenRouterRateLimitRefusal) -> String {
+  join([
+    "OpenRouter answered 429 rate_limit_exceeded",
+    match r.provider_code { Present { value: pc } => join([" from provider ", pc], "")  Absent => " from OpenRouter" },
+    ": ", r.message, "; ", openrouter_retry_after_wire(r: r.hints.retry_after),
+    match r.hints.reset { Present { value: v } => join(["; X-RateLimit-Reset=", v, " (unit not documented; carried verbatim)"], "")  Absent => "" },
+    match r.hints.remaining { Present { value: v } => join(["; X-RateLimit-Remaining=", v], "")  Absent => "" },
+    "; the request was NOT retried",
+  ], "")
+}
+
+fn openrouter_error_wire(e: OpenRouterError) -> String {
+  match e {
+    OpenRouterPaymentRequired { limit_source: s, reason: r, message: m, remedy_hint: _ } =>
+      join([
+        openrouter_limit_source_meaning(s: s),
+        "402 from ", openrouter_limit_source_wire(s: s) as String,
+        match r { Present { value: rv } => join([" (", openrouter_limit_reason_wire(r: rv) as String, ")"], "") Absent => "" },
+        ": ", m,
+      ], "")
+    OpenRouterRateLimited { message: m, provider_code: p } =>
+      join(["429 rate_limit_exceeded", match p { Present { value: pc } => join([" from provider ", pc], "") Absent => " from OpenRouter" }, ": ", m], "")
+    OpenRouterOtherError { code: c, message: m } => join([to_string(c), ": ", m], "")
+  }
+}
+
+// ── THE REASONING PARAMETER, FROM THE REASONING-TOKENS GUIDE ─────────────────────────────────
+//
+// reasoning.effort is one of max, xhigh, high, medium, low, minimal or none; reasoning.enabled false
+// turns reasoning off where the model does not make it mandatory. Which efforts a given model honours
+// is published per model in GET /api/v1/models as reasoning.supported_efforts -- so the vocabulary is
+// OpenRouter's and the admitted subset is each listing's row, never this module's guess.
+type OpenRouterReasoningEffort
+  = EffortMax
+  | EffortXhigh
+  | EffortHigh
+  | EffortMedium
+  | EffortLow
+  | EffortMinimal
+  | EffortNone
+
+fn openrouter_reasoning_effort_wire(e: OpenRouterReasoningEffort) -> NonEmptyStr {
+  match e {
+    EffortMax => "max" as NonEmptyStr
+    EffortXhigh => "xhigh" as NonEmptyStr
+    EffortHigh => "high" as NonEmptyStr
+    EffortMedium => "medium" as NonEmptyStr
+    EffortLow => "low" as NonEmptyStr
+    EffortMinimal => "minimal" as NonEmptyStr
+    EffortNone => "none" as NonEmptyStr
+  }
+}
+
+fn openrouter_effort_eq(a: OpenRouterReasoningEffort, b: OpenRouterReasoningEffort) -> Bool {
+  (openrouter_reasoning_effort_wire(e: a) as String) == (openrouter_reasoning_effort_wire(e: b) as String)
+}
+
+// AN EFFORT OUTSIDE THE LISTING'S SUPPORTED SET IS REFUSED, NOT SENT. OpenRouter's own guide shows what
+// an unsupported effort becomes on another provider -- Gemini maps xhigh down to high -- so sending it
+// is not an error the wire reports, it is a different setting the caller never sees.
+type OpenRouterEffortAdmission
+  = EffortAdmitted { effort: OpenRouterReasoningEffort }
+  | EffortNotSupported { effort: OpenRouterReasoningEffort, supported: List<OpenRouterReasoningEffort> }
+
+fn openrouter_effort_admitted(effort: OpenRouterReasoningEffort, supported: List<OpenRouterReasoningEffort>) -> OpenRouterEffortAdmission {
+  if count(filter(supported, s => openrouter_effort_eq(a: s, b: effort))) > 0 {
+    EffortAdmitted { effort: effort }
+  } else {
+    EffortNotSupported { effort: effort, supported: supported }
+  }
+}
+
+// THE MESSAGE MEMBER REASONING RIDES ON. The guide: "Reasoning tokens will appear in the reasoning field
+// of each message", and the same field is how prior reasoning is passed back.
+data openrouter_message_reasoning_field: NonEmptyStr = "reasoning" as NonEmptyStr
diff --git a/dag/extdeps/package_managers/apt.dag b/dag/extdeps/package_managers/apt.dag
index 3c2f55ddc96..c72b6d75fad 100644
--- a/dag/extdeps/package_managers/apt.dag
+++ b/dag/extdeps/package_managers/apt.dag
@@ -62,8 +62,25 @@ data apt_man_url: NonEmptyStr = "https://manpages.debian.org/testing/apt/apt.8.e
 
 // apt_install_argv was DELETED here for the reason dpkg.dag's Status row states: it was this
 // Install row's argv authored a second time, and its last consumer now binds `package` against
-// this declaration instead.
+// this declaration instead. InstallExactNonRemoving follows SimulateInstall's selection and
+// removal policy and keeps needrestart in list-only mode during supervised host maintenance.
 service apt.PackageManager {
+  operation ShowExact {
+    input { selection: NonEmptyStr }
+    output { success: Bool from "exit_success", stdout: String from "stdout", stderr: String from "stderr" }
+    readonly
+    transport shell { argv: ["apt-cache", "show", "--no-all-versions", "{selection}"] }
+    exit { 0 => Unit nonzero => String "apt-cache could not read the selected version" }
+    mock_response { 1 => { success: false, stdout: "", stderr: "no package metadata supplied" } "no fabricated package candidate" }
+  }
+  operation SimulateInstall {
+    input { selection: NonEmptyStr }
+    output { success: Bool from "exit_success", stdout: String from "stdout", stderr: String from "stderr" }
+    readonly
+    transport shell { argv: ["env", "LC_ALL=C", "apt-get", "--simulate", "--no-install-recommends", "--no-remove", "install", "{selection}"] }
+    exit { 0 => Unit nonzero => String "apt-get simulation refused" }
+    mock_response { 1 => { success: false, stdout: "", stderr: "no package plan supplied" } "no fabricated install simulation" }
+  }
   operation Install {
     requires Network
     input { package: NonEmptyStr }
@@ -79,4 +96,12 @@ service apt.PackageManager {
       nonzero => String "apt-get install failed"
     }
   }
+  operation InstallExactNonRemoving {
+    requires Network
+    input { selection: NonEmptyStr }
+    output { success: Bool from "exit_success", stdout: String from "stdout", stderr: String from "stderr" }
+    transport shell { argv: ["env", "LC_ALL=C", "DEBIAN_FRONTEND=noninteractive", "NEEDRESTART_MODE=l", "apt-get", "--yes", "--no-install-recommends", "--no-remove", "install", "{selection}"] }
+    exit { 0 => Unit nonzero => String "apt-get exact non-removing install refused" }
+    mock_response { 1 => { success: false, stdout: "", stderr: "no installation supplied" } "no fabricated package installation" }
+  }
 }
diff --git a/dag/extdeps/package_managers/dpkg.dag b/dag/extdeps/package_managers/dpkg.dag
index 8a33afa930b..969d41193a0 100644
--- a/dag/extdeps/package_managers/dpkg.dag
+++ b/dag/extdeps/package_managers/dpkg.dag
@@ -85,6 +85,20 @@ fn dpkg_status_lines_of(record: String) -> List<String> {
     if starts_with(s: line, prefix: "Status:") { concat(acc, [trim(s: line)]) } else { acc })
 }
 
+// A status/cache stanza must name each identity field exactly once. Missing and duplicate
+// fields remain unreadable; the caller checks the expected package, version and architecture.
+fn dpkg_record_field(record: String, field: String) -> String? {
+  let prefix = concat(field, ":")
+  let rows = filter(split(s: record, delimiter: "\n"), line => starts_with(s: line, prefix: prefix))
+  if rows.count() != 1 { none } else { match rows.first() {
+    Present { value: row } => {
+      let value = trim(s: substring(s: row, start: string_length(s: prefix), end: string_length(s: row)))
+      if value == "" { none } else { Present { value: value } }
+    }
+    Absent => none
+  } }
+}
+
 fn dpkg_words_of(text: String) -> List<String> {
   fold(split(text, " "), init: [], f: (acc, w) => if w == "" { acc } else { concat(acc, [w]) })
 }
diff --git a/dag/extdeps/posix/getconf.dag b/dag/extdeps/posix/getconf.dag
index 7d00a19437f..8bb6fc86e81 100644
--- a/dag/extdeps/posix/getconf.dag
+++ b/dag/extdeps/posix/getconf.dag
@@ -43,6 +43,12 @@ fn getconf_clock_ticks_command() -> ArgvCommand {
   argv_command(program: getconf_program(), arguments: ["CLK_TCK"])
 }
 
+// _NPROCESSORS_ONLN is the number of processors online in the running system -- for a virtual
+// guest, the vCPUs the hypervisor presents, which is the figure a provider's offer entitles.
+fn getconf_online_processors_command() -> ArgvCommand {
+  argv_command(program: getconf_program(), arguments: ["_NPROCESSORS_ONLN"])
+}
+
 service posix.Getconf {
   operation ClockTicksPerSecond {
     requires none
diff --git a/dag/extdeps/posix/identity.dag b/dag/extdeps/posix/identity.dag
index 660656bd2a7..efe5c6ea048 100644
--- a/dag/extdeps/posix/identity.dag
+++ b/dag/extdeps/posix/identity.dag
@@ -5,7 +5,8 @@ import extdeps.external_authority { ExternalAuthority, ExternalModelScope, Exter
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.uri { Uri, Https }
 import std.optional { Optional, Present, Absent }
-import v2.std.integer { integer_lexeme_to_int_optional, integer_nat_to_decimal_string }
+import v2.std.integer { integer_lexeme_to_int_optional }
+import std.nat { nat_to_decimal_string }
 import std.algebra { trim }
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
@@ -100,11 +101,11 @@ fn posix_group_id_from_text(text: String) -> Optional<PosixGroupId> {
 }
 
 fn posix_user_id_text(user: PosixUserId) -> String {
-  integer_nat_to_decimal_string(value: user.value)
+  nat_to_decimal_string(value: user.value)
 }
 
 fn posix_group_id_text(group: PosixGroupId) -> String {
-  integer_nat_to_decimal_string(value: group.value)
+  nat_to_decimal_string(value: group.value)
 }
 
 // THE ONE SPELLING OF chown(1)'s OWNER[:GROUP] SEPARATOR. Both forms below -- numeric ids and names
diff --git a/dag/extdeps/posix/signal.dag b/dag/extdeps/posix/signal.dag
index 68ad9509ad7..a0b29185b73 100644
--- a/dag/extdeps/posix/signal.dag
+++ b/dag/extdeps/posix/signal.dag
@@ -1,6 +1,6 @@
 module extdeps.posix.signal
 
-import std.types { NonEmptyStr, String, Bool }
+import std.types { NonEmptyStr, String, Bool, Int }
 import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.uri { Uri, Https }
@@ -48,3 +48,122 @@ service posix.Signal {
     }
   }
 }
+
+// THE LINUX SIGNAL NUMBERS FOR THE STANDARD SIGNALS, by the name systemd reports them under
+// ($EXIT_STATUS when $EXIT_CODE is killed or dumped: the name without its SIG prefix). signal(7),
+// "Standard signals": the numbering below is the one shared by x86, ARM and most other Linux
+// architectures (the table's middle column); alpha, sparc, mips and parisc number some of these
+// differently, and no host this repository runs on is one of them. A name not listed is refused
+// with Absent rather than guessed -- including the realtime signals, which have no fixed number.
+data linux_signal_numbers_authority: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "man7.org/linux/man-pages/man7/signal.7.html"
+  }
+}
+
+// The closed set of names, so a misspelled or unlisted signal has no constructor; the one string
+// parse is linux_standard_signal_of_name, at the systemd $EXIT_STATUS boundary.
+type LinuxStandardSignal
+  = SignalHup
+  | SignalInt
+  | SignalQuit
+  | SignalIll
+  | SignalTrap
+  | SignalAbrt
+  | SignalBus
+  | SignalFpe
+  | SignalKill
+  | SignalUsr1
+  | SignalSegv
+  | SignalUsr2
+  | SignalPipe
+  | SignalAlrm
+  | SignalTerm
+  | SignalStkflt
+  | SignalChld
+  | SignalCont
+  | SignalStop
+  | SignalTstp
+  | SignalTtin
+  | SignalTtou
+  | SignalUrg
+  | SignalXcpu
+  | SignalXfsz
+  | SignalVtalrm
+  | SignalProf
+  | SignalWinch
+  | SignalIo
+  | SignalPwr
+  | SignalSys
+
+fn linux_standard_signal_of_name(name: String) -> LinuxStandardSignal? {
+  if name == "HUP" { Present { value: SignalHup } }
+  else if name == "INT" { Present { value: SignalInt } }
+  else if name == "QUIT" { Present { value: SignalQuit } }
+  else if name == "ILL" { Present { value: SignalIll } }
+  else if name == "TRAP" { Present { value: SignalTrap } }
+  else if name == "ABRT" { Present { value: SignalAbrt } }
+  else if name == "BUS" { Present { value: SignalBus } }
+  else if name == "FPE" { Present { value: SignalFpe } }
+  else if name == "KILL" { Present { value: SignalKill } }
+  else if name == "USR1" { Present { value: SignalUsr1 } }
+  else if name == "SEGV" { Present { value: SignalSegv } }
+  else if name == "USR2" { Present { value: SignalUsr2 } }
+  else if name == "PIPE" { Present { value: SignalPipe } }
+  else if name == "ALRM" { Present { value: SignalAlrm } }
+  else if name == "TERM" { Present { value: SignalTerm } }
+  else if name == "STKFLT" { Present { value: SignalStkflt } }
+  else if name == "CHLD" { Present { value: SignalChld } }
+  else if name == "CONT" { Present { value: SignalCont } }
+  else if name == "STOP" { Present { value: SignalStop } }
+  else if name == "TSTP" { Present { value: SignalTstp } }
+  else if name == "TTIN" { Present { value: SignalTtin } }
+  else if name == "TTOU" { Present { value: SignalTtou } }
+  else if name == "URG" { Present { value: SignalUrg } }
+  else if name == "XCPU" { Present { value: SignalXcpu } }
+  else if name == "XFSZ" { Present { value: SignalXfsz } }
+  else if name == "VTALRM" { Present { value: SignalVtalrm } }
+  else if name == "PROF" { Present { value: SignalProf } }
+  else if name == "WINCH" { Present { value: SignalWinch } }
+  else if name == "IO" { Present { value: SignalIo } }
+  else if name == "PWR" { Present { value: SignalPwr } }
+  else if name == "SYS" { Present { value: SignalSys } }
+  else { none }
+}
+
+fn linux_standard_signal_number(signal: LinuxStandardSignal) -> Int {
+  match signal {
+    SignalHup => 1
+    SignalInt => 2
+    SignalQuit => 3
+    SignalIll => 4
+    SignalTrap => 5
+    SignalAbrt => 6
+    SignalBus => 7
+    SignalFpe => 8
+    SignalKill => 9
+    SignalUsr1 => 10
+    SignalSegv => 11
+    SignalUsr2 => 12
+    SignalPipe => 13
+    SignalAlrm => 14
+    SignalTerm => 15
+    SignalStkflt => 16
+    SignalChld => 17
+    SignalCont => 18
+    SignalStop => 19
+    SignalTstp => 20
+    SignalTtin => 21
+    SignalTtou => 22
+    SignalUrg => 23
+    SignalXcpu => 24
+    SignalXfsz => 25
+    SignalVtalrm => 26
+    SignalProf => 27
+    SignalWinch => 28
+    SignalIo => 29
+    SignalPwr => 30
+    SignalSys => 31
+  }
+}
diff --git a/dag/extdeps/posix/test_utility.dag b/dag/extdeps/posix/test_utility.dag
index 5a13b74b18d..79bbf36e0bb 100644
--- a/dag/extdeps/posix/test_utility.dag
+++ b/dag/extdeps/posix/test_utility.dag
@@ -60,6 +60,11 @@ fn test_executable_command(path: String) -> ArgvCommand {
   argv_command(program: test_program(), arguments: ["-x", path])
 }
 
+// -d IS "EXISTS AND IS A DIRECTORY" (POSIX test, OPERANDS -d).
+fn test_directory_command(path: String) -> ArgvCommand {
+  argv_command(program: test_program(), arguments: ["-d", path])
+}
+
 // WHETHER A PATH IS THERE, OR WHY THAT COULD NOT BE DECIDED -- ONE DECLARATION, AT THE BOUNDARY THAT
 // OWNS THE UTILITY.
 //
diff --git a/dag/extdeps/provisioning/ubuntu_seeded_install_media.dag b/dag/extdeps/provisioning/ubuntu_seeded_install_media.dag
index 8858a8e3c4e..3dbbf320283 100644
--- a/dag/extdeps/provisioning/ubuntu_seeded_install_media.dag
+++ b/dag/extdeps/provisioning/ubuntu_seeded_install_media.dag
@@ -1,6 +1,6 @@
 module extdeps.provisioning.ubuntu_seeded_install_media
 
-import std.types { Int, List, NonEmptyStr, String }
+import std.types { Bool, Int, List, NonEmptyStr, String, path_segment_is_safe }
 import std.content_hash {
   Fnv1a64Structural,
   content_hash_atom,
@@ -12,6 +12,7 @@ import std.content_hash {
 import extdeps.provisioning.ubuntu_install_media { UbuntuInstallMediaArtifactRow }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
+import extdeps.crypto.hash { Digest, Sha256, Sha512 }
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {
@@ -28,6 +29,77 @@ type NoCloudSeedFile {
   content: NonEmptyStr
 }
 
+// A BINARY SEED MEMBER, NAMED BY ITS CONTENT DIGEST. A NoCloudSeedFile is text the caller renders;
+// an artifact is bytes someone else publishes, so the input carries where they are fetched from and
+// the Digest (algorithm and hex, extdeps.crypto.hash) they must have, and the build fetches them into the seed directory and refuses unless
+// the readback digest equals it. The digest is in the build key and the URL is not: the URL is
+// transport, and two URLs serving the same bytes build the same image.
+type NoCloudSeedArtifact {
+  name: NonEmptyStr
+  source_url: NonEmptyStr
+  digest: Digest
+}
+
+// AN ARTIFACT NAME IS ADMITTED BEFORE ANY BYTE MOVES, because the remaster writes it under the seed
+// directory and a name is a path: `../../boot/grub/grub.cfg` would land outside the seed, and
+// `user-data` or a seed file's own name would replace a member the input separately claims the image
+// carries -- a correct digest only proves the unintended bytes arrived. So the fetch takes an
+// AdmittedSeedArtifact, and the one constructor of its basename is the admission below: a single
+// path segment (std.types path_segment_is_safe, the one law for that), none of the NoCloud datasource's own file names,
+// no collision with a text seed file, and no duplicate among the artifacts.
+type SeedArtifactBasename sole_constructor {
+  value: NonEmptyStr
+}
+
+type AdmittedSeedArtifact sole_constructor {
+  basename: SeedArtifactBasename
+  source_url: NonEmptyStr
+  digest: Digest
+}
+
+type SeedArtifactAdmissionRefusal
+  = SeedArtifactNameNotABasename { name: NonEmptyStr }
+  | SeedArtifactNameReserved { name: NonEmptyStr }
+  | SeedArtifactNameCollidesWithSeedFile { name: NonEmptyStr }
+  | SeedArtifactNameDuplicated { name: NonEmptyStr }
+
+type SeedArtifactAdmission
+  = SeedArtifactsAdmitted { artifacts: List<AdmittedSeedArtifact> }
+  | SeedArtifactsRefused { refusals: List<SeedArtifactAdmissionRefusal> }
+
+// The NoCloud datasource reads these names from the seed directory (cloud-init NoCloud: user-data,
+// meta-data, vendor-data, network-config); an artifact may not occupy one.
+data nocloud_seed_reserved_names: List<String> = ["user-data", "meta-data", "vendor-data", "network-config"]
+
+fn seed_artifact_name_refusals(input: UbuntuSeededInstallMediaBuildInput, artifact: NoCloudSeedArtifact) -> List<SeedArtifactAdmissionRefusal> {
+  let name = artifact.name as String
+  let shape = if path_segment_is_safe(raw: name) { [] } else { [SeedArtifactNameNotABasename { name: artifact.name }] }
+  let reserved = if any(nocloud_seed_reserved_names, r => r == name) { [SeedArtifactNameReserved { name: artifact.name }] } else { [] }
+  let collides = if any(input.seed_files, f => (f.name as String) == name) { [SeedArtifactNameCollidesWithSeedFile { name: artifact.name }] } else { [] }
+  let duplicated = if count(filter(input.seed_artifacts, a => (a.name as String) == name)) > 1 { [SeedArtifactNameDuplicated { name: artifact.name }] } else { [] }
+  append(append(append(shape, items: reserved), items: collides), items: duplicated)
+}
+
+fn seeded_install_media_seed_artifact_admission(input: UbuntuSeededInstallMediaBuildInput) -> SeedArtifactAdmission {
+  let refusals = flat_map(input.seed_artifacts, a => seed_artifact_name_refusals(input: input, artifact: a))
+  if count(refusals) == 0 {
+    SeedArtifactsAdmitted {
+      artifacts: map(input.seed_artifacts, a => AdmittedSeedArtifact { basename: SeedArtifactBasename { value: a.name }, source_url: a.source_url, digest: a.digest }),
+    }
+  } else {
+    SeedArtifactsRefused { refusals: refusals }
+  }
+}
+
+fn seed_artifact_admission_refusal_text(refusal: SeedArtifactAdmissionRefusal) -> String {
+  match refusal {
+    SeedArtifactNameNotABasename { name: n } => concat("seed artifact name ", concat(n as String, " is not a single path component"))
+    SeedArtifactNameReserved { name: n } => concat("seed artifact name ", concat(n as String, " is a NoCloud datasource file"))
+    SeedArtifactNameCollidesWithSeedFile { name: n } => concat("seed artifact name ", concat(n as String, " is already a text seed file"))
+    SeedArtifactNameDuplicated { name: n } => concat("seed artifact name ", concat(n as String, " is named by more than one artifact"))
+  }
+}
+
 // WHAT A DERIVED SEEDED IMAGE IS BUILT FROM, and nothing else: every field below reaches the output
 // bytes, so each one is in the derivation key. The payload is a PARAMETER -- an install autoinstall
 // (srv3) and a live-session census program (Mt. Collins) are both a rendered user-data body plus seed
@@ -39,6 +111,7 @@ type UbuntuSeededInstallMediaBuildInput {
   nocloud_dir_on_iso: NonEmptyStr
   user_data_body: NonEmptyStr
   seed_files: List<NoCloudSeedFile>
+  seed_artifacts: List<NoCloudSeedArtifact>
   grub_kernel_cmdline: NonEmptyStr
   volume_id: NonEmptyStr
   pinned_dates: SeededInstallMediaPinnedDates
@@ -98,8 +171,29 @@ fn seeded_install_media_seed_file_key(file: NoCloudSeedFile) -> Fnv1a64Structura
   )
 }
 
+fn seeded_install_media_seed_artifact_key(artifact: NoCloudSeedArtifact) -> Fnv1a64Structural {
+  content_hash_combine_structural(
+    content_hash_atom(value: artifact.name),
+    content_hash_combine_structural(
+      content_hash_atom(value: seed_artifact_digest_algorithm_token(digest: artifact.digest)),
+      content_hash_atom(value: artifact.digest.hex),
+    ),
+  )
+}
+
+// THE ALGORITHM IS PART OF THE PIN, so it is part of the key: the same hex under another algorithm is
+// another artifact. A closed match over extdeps.crypto.hash HashAlgorithm, no fallback arm.
+fn seed_artifact_digest_algorithm_token(digest: Digest) -> NonEmptyStr {
+  match digest.algorithm {
+    Sha256 => "sha256"
+    Sha512 => "sha512"
+  }
+}
+
+// An input with no artifacts folds to the key it had before artifacts existed, so every image built
+// without one keeps its key and its published digest.
 fn seeded_install_media_build_key(input: UbuntuSeededInstallMediaBuildInput) -> NonEmptyStr {
-  let seed = fold(
+  let text_seed = fold(
     input.seed_files,
     init: content_hash_combine_structural(
       content_hash_atom(value: input.nocloud_dir_on_iso),
@@ -107,6 +201,11 @@ fn seeded_install_media_build_key(input: UbuntuSeededInstallMediaBuildInput) ->
     ),
     f: (acc, file) => content_hash_combine_structural(acc, seeded_install_media_seed_file_key(file: file)),
   )
+  let seed = fold(
+    input.seed_artifacts,
+    init: text_seed,
+    f: (acc, artifact) => content_hash_combine_structural(acc, seeded_install_media_seed_artifact_key(artifact: artifact)),
+  )
   let boot = content_hash_combine_structural(
     content_hash_combine_structural(
       content_hash_atom(value: input.grub_kernel_cmdline),
diff --git a/dag/extdeps/provisioning/ubuntu_seeded_install_media_remaster.dag b/dag/extdeps/provisioning/ubuntu_seeded_install_media_remaster.dag
index 133e5b6fbae..d47d898aa7a 100644
--- a/dag/extdeps/provisioning/ubuntu_seeded_install_media_remaster.dag
+++ b/dag/extdeps/provisioning/ubuntu_seeded_install_media_remaster.dag
@@ -6,13 +6,17 @@ import extdeps.tools.xorriso { xorriso_extract_tree_command, xorriso_replay_buil
 import extdeps.tools.gnu_coreutils { mkdir_parents_command, mktemp_directory_command, rm_recursive_force_one_file_system_command }
 import extdeps.tools.chmod { chmod_recursive_set_mode_command, chmod_path_resolved_program }
 import extdeps.posix.test_utility { test_regular_file_command }
-import extdeps.crypto.hash { sha256sum_file_command }
+import extdeps.crypto.hash { Digest, Sha256, Sha512, sha256sum_file_command }
+import extdeps.tools.curl { curl_download_command }
 import extdeps.provisioning.ubuntu_install_media { UbuntuInstallMediaGrubConfig, ubuntu_install_media_grub_cfg_for }
 import extdeps.provisioning.ubuntu_seeded_install_media {
   NoCloudSeedFile,
+  AdmittedSeedArtifact, SeedArtifactsAdmitted, SeedArtifactsRefused,
+  seeded_install_media_seed_artifact_admission, seed_artifact_admission_refusal_text,
   UbuntuSeededInstallMediaBuildInput,
 }
 import std.types { Bool, Int, List, String, NonEmptyStr }
+import std.decl_ref { decl_ref }
 import std.algebra { trim }
 import std.content_hash { sha256_hex_digest }
 import std.optional { Present }
@@ -114,7 +118,7 @@ fn install_media_remaster_seed_directory_levels(nocloud_dir_on_iso: NonEmptyStr)
 // The seed files as the image holds them (grub.cfg is the other mapped file).
 fn install_media_remaster_seed_files(input: UbuntuSeededInstallMediaBuildInput) -> List<NonEmptyStr> {
   let seed_root = concat("/", input.nocloud_dir_on_iso as String)
-  concat([concat(seed_root, "/user-data") as NonEmptyStr, concat(seed_root, "/meta-data") as NonEmptyStr], map(input.seed_files, f => concat(seed_root, "/", f.name as String) as NonEmptyStr))
+  concat([concat(seed_root, "/user-data") as NonEmptyStr, concat(seed_root, "/meta-data") as NonEmptyStr], concat(map(input.seed_files, f => concat(seed_root, "/", f.name as String) as NonEmptyStr), map(input.seed_artifacts, a => concat(seed_root, "/", a.name as String) as NonEmptyStr)))
 }
 
 // Owner and group are pinned recursively from the TOPMOST directory the seed creates -- for a nested
@@ -253,12 +257,64 @@ fn install_media_remaster_write_seeds(host: CommandHost, writes: List<SeedWrite>
   })
 }
 
-fn install_media_remaster_write_nocloud_seed(host: CommandHost, work_dir: NonEmptyStr, input: UbuntuSeededInstallMediaBuildInput) -> String? {
-  let nocloud_dir = concat(work_dir as String, "/", input.nocloud_dir_on_iso as String) as NonEmptyStr
-  match host_command(host: host, command: mkdir_parents_command(path: nocloud_dir as String)) {
+// EACH ARTIFACT IS FETCHED, THEN READ BACK: the fetch's success is not the bytes' identity, so the
+// member is admitted only when its measured sha256 equals the one the input names. The first
+// artifact that does not hold ends the seed.
+// THE READBACK IS sha256sum'S, so it holds only against a Sha256 pin with that hex: a Sha512 pin can
+// never be satisfied by it and refuses rather than being compared by its hex alone.
+fn seed_artifact_readback_holds(read_back_sha256_hex: String, pin: Digest) -> Bool {
+  match pin.algorithm {
+    Sha256 => read_back_sha256_hex == (pin.hex as String)
+    Sha512 => false
+  }
+}
+
+fn install_media_remaster_fetch_artifact(host: CommandHost, nocloud_dir: NonEmptyStr, artifact: AdmittedSeedArtifact) -> String? admit_callers: [
+  decl_ref(module_path: "extdeps.provisioning.ubuntu_seeded_install_media_remaster", decl_name: "install_media_remaster_fetch_artifacts"),
+] {
+  let path = concat(nocloud_dir as String, "/", artifact.basename.value as String) as NonEmptyStr
+  match host_command(host: host, command: curl_download_command(url: artifact.source_url as String, destination: path as String)) {
     HostCommandDone { stdout: _ } =>
-      install_media_remaster_write_seeds(host: host, writes: install_media_remaster_seed_writes(nocloud_dir: nocloud_dir, input: input), scope_root: work_dir)
-    other => Present { value: concat("mkdir -p ", nocloud_dir as String, ": ", host_command_outcome_text(e: other)) }
+      match install_media_remaster_digest(host: host, path: path) {
+        Absent => Present { value: install_media_remaster_digest_refusal(host: host, path: path) }
+        Present { value: d } =>
+          if seed_artifact_readback_holds(read_back_sha256_hex: d, pin: artifact.digest) { none } else { Present { value: concat("seed artifact ", artifact.basename.value as String, " read back sha256 ", d, " but the input names ", artifact.digest.hex as String) } }
+      }
+    other => Present { value: concat("fetching seed artifact ", artifact.basename.value as String, ": ", host_command_outcome_text(e: other)) }
+  }
+}
+
+// THE FETCH IS SEALED TO THE CHECKED ROUTE. An AdmittedSeedArtifact was admitted against ONE input's
+// seed population, and the destination is that input's seed directory under the remaster's work
+// directory; a caller that could hand either helper a different directory could replay an
+// admission against a seed it was never checked against (a name refused there as a collision would
+// become a write) or point a valid basename outside the seed. So the only caller of the pair is
+// install_media_remaster_write_nocloud_seed, which admits, derives the directory, and fetches in one
+// body (compile probe: test.probe.seed_artifact_fetch_forged_probe).
+fn install_media_remaster_fetch_artifacts(host: CommandHost, nocloud_dir: NonEmptyStr, artifacts: List<AdmittedSeedArtifact>) -> String? admit_callers: [
+  decl_ref(module_path: "extdeps.provisioning.ubuntu_seeded_install_media_remaster", decl_name: "install_media_remaster_write_nocloud_seed"),
+] {
+  fold(artifacts, init: none, f: (acc, a) => match acc {
+    Present { value: r } => Present { value: r }
+    Absent => install_media_remaster_fetch_artifact(host: host, nocloud_dir: nocloud_dir, artifact: a)
+  })
+}
+
+// THE NAMES ARE ADMITTED BEFORE THE SEED DIRECTORY IS EVEN CREATED, so a refused name moves no byte.
+fn install_media_remaster_write_nocloud_seed(host: CommandHost, work_dir: NonEmptyStr, input: UbuntuSeededInstallMediaBuildInput) -> String? {
+  match seeded_install_media_seed_artifact_admission(input: input) {
+    SeedArtifactsRefused { refusals: rs } => Present { value: join(map(rs, r => seed_artifact_admission_refusal_text(refusal: r)), "; ") }
+    SeedArtifactsAdmitted { artifacts: admitted } => {
+      let nocloud_dir = concat(work_dir as String, "/", input.nocloud_dir_on_iso as String) as NonEmptyStr
+      match host_command(host: host, command: mkdir_parents_command(path: nocloud_dir as String)) {
+        HostCommandDone { stdout: _ } =>
+          match install_media_remaster_write_seeds(host: host, writes: install_media_remaster_seed_writes(nocloud_dir: nocloud_dir, input: input), scope_root: work_dir) {
+            Present { value: r } => Present { value: r }
+            Absent => install_media_remaster_fetch_artifacts(host: host, nocloud_dir: nocloud_dir, artifacts: admitted)
+          }
+        other => Present { value: concat("mkdir -p ", nocloud_dir as String, ": ", host_command_outcome_text(e: other)) }
+      }
+    }
   }
 }
 
diff --git a/dag/extdeps/python/python.dag b/dag/extdeps/python/python.dag
index e2303e5bfeb..faa303348d4 100644
--- a/dag/extdeps/python/python.dag
+++ b/dag/extdeps/python/python.dag
@@ -1,5 +1,7 @@
 module extdeps.python
 
+import extdeps.exec.program { ProgramIdentity, uncataloged_program }
+
 import std.types { FilePath, List, Unit, NonEmptyStr }
 import std.workspace_artifact { WorkspaceFootprint, WorkspaceArtifact, CitedUpstream, RegenerableFromSource }
 import extdeps.external_authority { ExternalAuthority }
@@ -47,6 +49,8 @@ type PythonProgramText = NonEmptyStr
 data python_program_flag: String = "-c"
 data python_interpreter_command: String = "python3"
 
+fn python_program() -> ProgramIdentity = uncataloged_program(invocation: python_interpreter_command as NonEmptyStr)
+
 fn python_run_program_argv(program: PythonProgramText) -> List<String> {
   [python_interpreter_command, python_program_flag, program as String]
 }
diff --git a/dag/extdeps/realization/compile_stage_memo.dag b/dag/extdeps/realization/compile_stage_memo.dag
deleted file mode 100644
index 6f1d761b158..00000000000
--- a/dag/extdeps/realization/compile_stage_memo.dag
+++ /dev/null
@@ -1,78 +0,0 @@
-module extdeps.realization.compile_stage_memo
-
-import extdeps.external_authority { ExternalAuthority }
-import extdeps.uri { Uri, Https }
-import std.optional { Absent }
-
-import extdeps.cache.types { CacheInterfaceCatalogFacts, ContentAddressed, CatalogCasContentEncoding }
-import std.cache_identity { CacheInterfaceId }
-import std.cache_interface {
-  ContentAddressLookup,
-  OverwriteAllowed,
-  MissThenCreate,
-  StructuredArtifact,
-  InProcess,
-  PerFile,
-  None,
-  InProcessNs,
-  Strong,
-  OperatorObserved,
-  ManualPurge,
-  Repo,
-  CapacityUnbounded,
-  ReleasedAtProviderScopeExit,
-}
-
-data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
-  uri: Uri {
-    scheme: Https
-    locator: "github.com/gunb-ai/gunbc/tree/main/dag/extdeps/realization"
-  }
-}
-
-data compile_stage_memo_id: CacheInterfaceId = "compile_stage_memo_cache"
-
-data compile_stage_memo_facts: CacheInterfaceCatalogFacts = {
-  identity: compile_stage_memo_id
-  backing_surface: "gunbc-v2-compile-stage-in-process"
-  transport_encoding: CatalogCasContentEncoding
-  key_derivation: {
-
-    key_inputs: ContentAddressed
-    overwritable: true
-    prefix_fallback_allowed: false
-    content_verified_on_read: false
-    visibility_scope: Repo
-    invalidation_triggers: [ManualPurge]
-  }
-  io: {
-    lookup_semantics: ContentAddressLookup
-    write_semantics: OverwriteAllowed
-    miss_semantics: MissThenCreate
-  }
-  placement: {
-    value_shape: StructuredArtifact
-    locality: InProcess
-    retention: { release_policy: ReleasedAtProviderScopeExit, capacity: CapacityUnbounded }
-    atomicity: PerFile
-    auth: None
-    read_latency: InProcessNs
-    consistency: Strong
-  }
-  evidence: [
-    {
-      field: "locality"
-      evidence: OperatorObserved {
-        note: "scoped to compile_ingest_staging pipeline; drops with the ingest walk — within-run stage memo (v2.std.staging.cached_stage)"
-        observed_at: Absent
-      }
-    },
-    {
-      field: "key_derivation"
-      evidence: OperatorObserved {
-        note: "stage input content-addressed at the cached_stage lookup site; miss runs the stage, hit skips recompute"
-        observed_at: Absent
-      }
-    },
-  ]
-}
diff --git a/dag/extdeps/realization/materialization_store_local.dag b/dag/extdeps/realization/materialization_store_local.dag
index 9551444a2ec..69c9b474502 100644
--- a/dag/extdeps/realization/materialization_store_local.dag
+++ b/dag/extdeps/realization/materialization_store_local.dag
@@ -81,6 +81,7 @@ import gunbc.durable_cas_file_store {
   CasWindowReclamation, CasReclamationNotCommitted, CasAttemptAdmission,
   cas_window_generations, CasWindowGenerations, CasWindowGenerationsListed, CasWindowGenerationsUnlisted,
   cas_reclaim_below, CasGenerationWindow,
+  cas_verify_named_window_head, NamedWindowHeadCurrent, NamedWindowHeadMoved,
 }
 import std.durable_exclusive_hold {
   DurableHoldOwnerRef, DurableHoldReleaseRef, DurableHoldHolderReport, DurableHoldReleaseRefusal, DurableHoldRecoveryRefusal,
@@ -91,10 +92,10 @@ import std.durable_exclusive_hold {
 import gunbc.durable_exclusive_hold_file_store {
   file_hold_acquire_windowed, FileHoldAcquireOutcome, FileHoldAcquired, FileHoldOccupied, FileHoldAcquireLost,
   FileHoldAcquireStoreUnavailable, FileHoldSlotUndecodable, FileHoldKeyNotSlotAddressable,
-  file_hold_release_assess_windowed, FileHoldReleasePlanned, FileHoldReleaseNotEligible,
+  file_hold_release_assess_windowed_at, FileHoldWindowedReleasePlanned, FileHoldWindowedReleaseNotEligible, FileHoldWindowedReleaseNamedHeadMoved,
   file_hold_release_commit, FileHoldReleased, FileHoldReleaseLost, FileHoldReleaseStoreUnavailable, FileHoldReleaseKeyNotSlotAddressable,
-  file_hold_recovery_assess_windowed, FileHoldRecoveryPlanned, FileHoldRecoveryNotEligible,
-  observe_file_hold_windowed,
+  file_hold_recovery_assess_windowed, FileHoldWindowedRecoveryPlanned, FileHoldWindowedRecoveryNotEligible, FileHoldWindowedRecoveryNamedHeadMoved,
+  hold_observation_of_cas,
 }
 import gunbc.process_hold_identity {
   process_hold_text, process_hold_marker, process_hold_decode, ProcessHoldHolder,
@@ -907,6 +908,7 @@ type LocalStoreIndexRefusal
   | LocalStoreIndexContended { attempts: Int }
   | LocalStoreIndexUnsettled { settlement: LocalStoreSlotSettlement }
   | LocalStoreIndexHoldStale { observed: DurableHoldObservation }
+  | LocalStoreIndexHoldNamedWindowHeadMoved { named: CasGeneration }
 
 fn local_store_index_refusal_text(refusal: LocalStoreIndexRefusal) -> String {
   match refusal {
@@ -927,6 +929,7 @@ fn local_store_index_refusal_text(refusal: LocalStoreIndexRefusal) -> String {
     LocalStoreIndexContended { attempts: n } => concat("the occupancy index kept moving under concurrent writers past the attempt bound: ", n as String)
     LocalStoreIndexUnsettled { settlement: st } => concat("the occupancy index cannot advance: ", local_store_settlement_text(s: st))
     LocalStoreIndexHoldStale { observed: _ } => "the occupancy index write was attempted under a hold that is no longer live"
+    LocalStoreIndexHoldNamedWindowHeadMoved { named: _ } => "the occupancy index write was attempted after the named window head moved"
   }
 }
 
@@ -974,6 +977,7 @@ fn local_store_write_index(held: LocalStoreFamilyHeld, expected: CasExpectation,
 {
   match local_store_hold_check(held: held) {
     LocalStoreHoldNotCurrent { observed: o } => LocalStoreIndexWriteRefused { refusal: LocalStoreIndexHoldStale { observed: o } }
+    LocalStoreHoldNamedWindowMoved { named: n } => LocalStoreIndexWriteRefused { refusal: LocalStoreIndexHoldNamedWindowHeadMoved { named: n } }
     LocalStoreHoldCurrent => local_store_write_index_current(held: held, expected: expected, index: index)
   }
 }
@@ -1033,6 +1037,20 @@ fn local_store_write_index_settled(held: LocalStoreFamilyHeld, expected: CasExpe
 // on this host, and only a holder observed dead is recovered through file_hold_recovery_assess. An
 // unobservable holder stays held -- a family that cannot be shown free is not written. The hold slot
 // is windowed like the occupancy index (k = 2), so its bookkeeping does not grow with commits.
+//
+// HOLD CHECK AND RELEASE READ THE SLOT BY NAME. The windowed verify step is: generation G present
+// and G+1 absent. LocalStoreFamilyHeld already names G, so those two reads are cas_file_slot_path
+// Filesystem.Read -- O(1) in the number of objects in the store root. That two-read proof is sound
+// only while a surviving eligible prefix cannot have holes: cas_reclaim_below deletes in generation
+// order and stops at the first host refusal, so it cannot remove G+1 while G stays. A successor
+// present still means the slot moved; an absent G is not this hold. Unknown-head observation
+// (acquire, index) still lists, as DESIGN §3b states for a window whose generation is not named.
+//
+// ACQUIRE STILL LISTS. Windowed presence is not a prefix: generations at or below head-k are
+// deleted, so a named gallop from generation 1 would read NotFound and treat a live head at 100 as
+// an empty slot, then create-new generation 1 beside it. Listing the root to discover this key's
+// generation files is the unknown-head observation cas_observe_window already uses. A held session
+// pays that list once, not once per commit.
 
 data local_store_hold_owner_prefix: String = "materialization-store"
 
@@ -1056,6 +1074,7 @@ type LocalStoreHoldRefusal
   | LocalStoreHoldWindowTooNarrow { k: Int }
   | LocalStoreHoldUnsettled { settlement: LocalStoreSlotSettlement }
   | LocalStoreHoldStale { observed: DurableHoldObservation }
+  | LocalStoreHoldNamedWindowHeadMoved { named: CasGeneration }
   | LocalStoreHoldWrongFamily { held: ArtifactKindId, requested: ArtifactKindId }
 
 fn local_store_hold_refusal_text(refusal: LocalStoreHoldRefusal) -> String {
@@ -1071,6 +1090,7 @@ fn local_store_hold_refusal_text(refusal: LocalStoreHoldRefusal) -> String {
     LocalStoreHoldWindowTooNarrow { k: k } => concat("the family hold window is narrower than its floor: k = ", k as String)
     LocalStoreHoldUnsettled { settlement: st } => concat("the family hold slot cannot advance: ", local_store_settlement_text(s: st))
     LocalStoreHoldStale { observed: _ } => "the hold this write was given is no longer the family's live hold"
+    LocalStoreHoldNamedWindowHeadMoved { named: _ } => "the named window head moved; this hold is no longer the family's live hold"
     LocalStoreHoldWrongFamily { held: h, requested: r } => concat(concat("the hold is for family ", h as String), concat(", the write is for ", r as String))
   }
 }
@@ -1163,8 +1183,9 @@ fn local_store_hold_occupied(binding: LocalStoreBinding, family: ArtifactKindId,
             LocalStoreHoldRefused { refusal: LocalStoreHoldContended }
           } else {
             match file_hold_recovery_assess_windowed(root: root_path as NonEmptyStr, slot_key: key, report: DurableHoldHolderReport { holder: holder, generation: generation, liveness: liveness }, released_by: local_store_hold_recovery_ref, window: window) {
-              FileHoldRecoveryNotEligible { slot_key: _, refusal: r } => LocalStoreHoldRefused { refusal: LocalStoreHoldRecoveryRefused { refusal: r } }
-              FileHoldRecoveryPlanned { plan: pl, dead_holder: _, evidence: _ } =>
+              FileHoldWindowedRecoveryNotEligible { slot_key: _, refusal: r } => LocalStoreHoldRefused { refusal: LocalStoreHoldRecoveryRefused { refusal: r } }
+              FileHoldWindowedRecoveryNamedHeadMoved { slot_key: _, named: n } => LocalStoreHoldRefused { refusal: LocalStoreHoldNamedWindowHeadMoved { named: n } }
+              FileHoldWindowedRecoveryPlanned { plan: pl, dead_holder: _, evidence: _ } =>
                 match file_hold_release_commit(plan: pl) {
                   FileHoldReleased { slot_key: _, generation: _ } => local_store_acquire_family_hold(binding: binding, family: family, recovered: true)
                   FileHoldReleaseLost { slot_key: _ } => LocalStoreHoldRefused { refusal: LocalStoreHoldContended }
@@ -1186,6 +1207,7 @@ fn local_store_hold_occupied(binding: LocalStoreBinding, family: ArtifactKindId,
 type LocalStoreHoldCheck
   = LocalStoreHoldCurrent
   | LocalStoreHoldNotCurrent { observed: DurableHoldObservation }
+  | LocalStoreHoldNamedWindowMoved { named: CasGeneration }
 
 fn local_store_hold_check(held: LocalStoreFamilyHeld) -> LocalStoreHoldCheck
   admit_callers: [
@@ -1196,10 +1218,25 @@ fn local_store_hold_check(held: LocalStoreFamilyHeld) -> LocalStoreHoldCheck
     decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_commit_verified"),
   ]
 {
-  let observed = observe_file_hold_windowed(root: materialization_store_root_path(root: held.binding.root) as NonEmptyStr, key: local_store_hold_key(family: held.family), window: held.window)
+  match cas_verify_named_window_head(root: materialization_store_root_path(root: held.binding.root) as NonEmptyStr, key: local_store_hold_key(family: held.family), generation: held.generation) {
+    NamedWindowHeadMoved { named_generation: n } => LocalStoreHoldNamedWindowMoved { named: n }
+    NamedWindowHeadCurrent { observation: o } =>
+      local_store_hold_from_current_observation(held: held, observed: hold_observation_of_cas(observed: o))
+  }
+}
+
+fn local_store_hold_from_current_observation(held: LocalStoreFamilyHeld, observed: DurableHoldObservation) -> LocalStoreHoldCheck
+  admit_callers: [
+    decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_hold_check"),
+  ]
+{
   match observed {
-    HoldSlotHeld { generation: g, owner: o } =>
-      if cas_generation_count(g: g) == cas_generation_count(g: held.generation) && durable_hold_owner_equal(left: o, right: held.owner) { LocalStoreHoldCurrent } else { LocalStoreHoldNotCurrent { observed: observed } }
+    HoldSlotHeld { generation: g, owner: owner } =>
+      if cas_generation_count(g: g) == cas_generation_count(g: held.generation) && durable_hold_owner_equal(left: owner, right: held.owner) {
+        LocalStoreHoldCurrent
+      } else {
+        LocalStoreHoldNotCurrent { observed: observed }
+      }
     HoldSlotAbsent => LocalStoreHoldNotCurrent { observed: observed }
     HoldSlotFree { generation: _, released_by: _ } => LocalStoreHoldNotCurrent { observed: observed }
     HoldSlotUndecodable { generation: _, detail: _ } => LocalStoreHoldNotCurrent { observed: observed }
@@ -1223,6 +1260,7 @@ fn local_store_with_family_of<T>(binding: LocalStoreBinding, family: ArtifactKin
   admit_callers: [
     decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_with_family"),
     decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_record_recency"),
+    decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_held_session"),
   ]
 {
   match local_store_acquire_family_hold(binding: binding, family: family, recovered: false) {
@@ -1234,11 +1272,36 @@ fn local_store_with_family_of<T>(binding: LocalStoreBinding, family: ArtifactKin
   }
 }
 
+// A HELD SESSION: acquire the family once, run many lookups and commits under LocalStoreFamilyHeld,
+// release once. Distinct from local_store_commit, which still brackets every write; this operation
+// does not change that signature.
+// Consumed now by test.claim.materialization_store_local_wet_witness
+// n_commits_under_one_held_session_acquire_the_hold_once_by_real_execution (inhabitance).
+// Named later consumer: v2.compiler.compile, when its typecheck writes leave per-commit
+// local_store_commit (the host typed_module_cache still does) and take one session around the
+// family's writes; that change adds an admit_callers row here. Until then this is not a second
+// name for local_store_with_family_of -- it is the sealed session operation.
+//
+// DEADLINE AND RENEWAL follow std.durable_exclusive_hold, not a clock. That protocol recovers a
+// hold only when its holder is OBSERVED dead -- there is no timestamp, duration or silent expiry.
+// This process is the holder (gunbc.process_hold_identity). Renewal is the named re-observation
+// local_store_hold_check performs before every mutation: the slot must still be held at the
+// generation and by the owner the session recorded, or the mutation refuses as stale. A session
+// whose process has died is recovered by the next writer's liveness observation, never by age.
+fn local_store_held_session<T>(capability: LocalStoreCapability, family: ArtifactKindId, run: fn(LocalStoreFamilyHeld) -> T) -> LocalStoreBracket<T>
+  admit_callers: [
+    decl_ref(module_path: "test.claim.materialization_store_local_wet_witness", decl_name: "n_commits_under_one_held_session_acquire_the_hold_once_by_real_execution"),
+  ]
+{
+  local_store_with_family_of(binding: capability.binding, family: family, run: run)
+}
+
 // The release is reported, never fatal to the write it closes: a hold that could not be freed stays
 // held by this process, and once this process is gone the next writer recovers it by observation.
 type LocalStoreHoldRelease
   = LocalStoreHoldReleased
   | LocalStoreHoldReleaseNotEligible { refusal: DurableHoldReleaseRefusal }
+  | LocalStoreHoldReleaseNamedWindowHeadMoved { named: CasGeneration }
   | LocalStoreHoldReleaseLost
   | LocalStoreHoldReleaseStoreUnavailable { cause: CasStoreFailure }
   | LocalStoreHoldReleaseKeyNotAddressable
@@ -1250,9 +1313,10 @@ fn local_store_release_family_hold(held: LocalStoreFamilyHeld) -> LocalStoreHold
     decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_acquire_all"),
   ]
 {
-  match file_hold_release_assess_windowed(root: materialization_store_root_path(root: held.binding.root) as NonEmptyStr, slot_key: local_store_hold_key(family: held.family), owner: held.owner, acquired_generation: held.generation, released_by: local_store_hold_release_ref, window: held.window) {
-    FileHoldReleaseNotEligible { slot_key: _, refusal: r } => LocalStoreHoldReleaseNotEligible { refusal: r }
-    FileHoldReleasePlanned { plan: pl } =>
+  match file_hold_release_assess_windowed_at(root: materialization_store_root_path(root: held.binding.root) as NonEmptyStr, slot_key: local_store_hold_key(family: held.family), owner: held.owner, acquired_generation: held.generation, released_by: local_store_hold_release_ref, window: held.window) {
+    FileHoldWindowedReleaseNotEligible { slot_key: _, refusal: r } => LocalStoreHoldReleaseNotEligible { refusal: r }
+    FileHoldWindowedReleaseNamedHeadMoved { slot_key: _, named: n } => LocalStoreHoldReleaseNamedWindowHeadMoved { named: n }
+    FileHoldWindowedReleasePlanned { plan: pl } =>
       match file_hold_release_commit(plan: pl) {
         FileHoldReleased { slot_key: _, generation: _ } => LocalStoreHoldReleased
         FileHoldReleaseLost { slot_key: _ } => LocalStoreHoldReleaseLost
@@ -1644,6 +1708,7 @@ fn local_store_sweep_held(all: LocalStoreAllFamiliesHeld) -> LocalStoreSweep
     Absent => match local_store_hold_check(held: h) {
       LocalStoreHoldCurrent => none
       LocalStoreHoldNotCurrent { observed: o } => Present { value: LocalStoreSweepHoldRefused { family: h.family, refusal: LocalStoreHoldStale { observed: o }, released: [] } }
+      LocalStoreHoldNamedWindowMoved { named: n } => Present { value: LocalStoreSweepHoldRefused { family: h.family, refusal: LocalStoreHoldNamedWindowHeadMoved { named: n }, released: [] } }
     }
   })
   match stale {
@@ -1724,6 +1789,7 @@ fn local_store_record_recency_held(held: LocalStoreFamilyHeld, served: List<Stri
   let root_path = materialization_store_root_path(root: held.binding.root)
   match local_store_hold_check(held: held) {
     LocalStoreHoldNotCurrent { observed: o } => LocalStoreRecencyHoldRefused { family: family, refusal: LocalStoreHoldStale { observed: o } }
+    LocalStoreHoldNamedWindowMoved { named: n } => LocalStoreRecencyHoldRefused { family: family, refusal: LocalStoreHoldNamedWindowHeadMoved { named: n } }
     LocalStoreHoldCurrent => local_store_record_recency_current(held: held, served: served)
   }
 }
@@ -1984,6 +2050,7 @@ fn local_store_commit_verified(
   let root_path = materialization_store_root_path(root: root)
   match local_store_hold_check(held: held) {
     LocalStoreHoldNotCurrent { observed: o } => local_store_commit_hold_refused(key: key, refusal: LocalStoreHoldStale { observed: o })
+    LocalStoreHoldNamedWindowMoved { named: n } => local_store_commit_hold_refused(key: key, refusal: LocalStoreHoldNamedWindowHeadMoved { named: n })
     LocalStoreHoldCurrent =>
       local_store_commit_refused(commit: store_commit_settle(
         store: held.binding.store,
@@ -2250,6 +2317,7 @@ fn local_store_commit_under(
   } else {
     match local_store_hold_check(held: held) {
       LocalStoreHoldNotCurrent { observed: o } => local_store_commit_hold_refused(key: request_key(req: req), refusal: LocalStoreHoldStale { observed: o })
+      LocalStoreHoldNamedWindowMoved { named: n } => local_store_commit_hold_refused(key: request_key(req: req), refusal: LocalStoreHoldNamedWindowHeadMoved { named: n })
       LocalStoreHoldCurrent => {
         let staged = parts |> map(p => local_store_read_part(id: p.id, path: p.staged))
         match local_store_first_unreadable(readings: staged) {
diff --git a/dag/extdeps/realization/parse_table_memo.dag b/dag/extdeps/realization/parse_table_memo.dag
deleted file mode 100644
index a7ed67f4682..00000000000
--- a/dag/extdeps/realization/parse_table_memo.dag
+++ /dev/null
@@ -1,89 +0,0 @@
-module extdeps.realization.parse_table_memo
-
-import extdeps.external_authority { ExternalAuthority }
-import extdeps.uri { Uri, Https }
-import std.optional { Absent }
-
-import extdeps.cache.types { CacheInterfaceCatalogFacts, ContentAddressed, CatalogCasContentEncoding }
-import std.cache_identity { CacheInterfaceId }
-import std.cache_interface {
-  ContentAddressLookup,
-  OverwriteAllowed,
-  MissThenCreate,
-  StructuredArtifact,
-  InProcess,
-  PerFile,
-  None,
-  InProcessNs,
-  Strong,
-  OperatorObserved,
-  ManualPurge,
-  Repo,
-  CapacityUnbounded,
-  ReleasedAtProviderScopeExit,
-}
-import std.disposition { Disposition, Scaffold, RealizationDispatch }
-import std.decl_ref { DeclarationRef, WholeDeclaration }
-
-data parse_table_memo_seed_handler_dissolution_trigger: Disposition = Scaffold {
-  dissolves_to: RealizationDispatch,
-  bind: DeclarationRef {
-    module_path: "v2.compiler.materialization_carriers",
-    decl_name: "materialization_allows_memo_store",
-    field: WholeDeclaration
-  }
-}
-
-data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
-  uri: Uri {
-    scheme: Https
-    locator: "github.com/gunb-ai/gunbc/tree/main/dag/extdeps/realization"
-  }
-}
-
-data parse_table_memo_id: CacheInterfaceId = "parse_table_memo_cache"
-
-data parse_table_memo_facts: CacheInterfaceCatalogFacts = {
-  identity: parse_table_memo_id
-  backing_surface: "gunbc-parse-table-in-process"
-  transport_encoding: CatalogCasContentEncoding
-  key_derivation: {
-
-    key_inputs: ContentAddressed
-    overwritable: true
-    prefix_fallback_allowed: false
-    content_verified_on_read: false
-    visibility_scope: Repo
-    invalidation_triggers: [ManualPurge]
-  }
-  io: {
-    lookup_semantics: ContentAddressLookup
-    write_semantics: OverwriteAllowed
-    miss_semantics: MissThenCreate
-  }
-  placement: {
-    value_shape: StructuredArtifact
-    locality: InProcess
-    retention: { release_policy: ReleasedAtProviderScopeExit, capacity: CapacityUnbounded }
-    atomicity: PerFile
-    auth: None
-    read_latency: InProcessNs
-    consistency: Strong
-  }
-  evidence: [
-    {
-      field: "locality"
-      evidence: OperatorObserved {
-        note: "scoped to InterpContext; drops with evaluation — within-run memo (design-recompute-memoization §4.1)"
-        observed_at: Absent
-      }
-    },
-    {
-      field: "key_derivation"
-      evidence: OperatorObserved {
-        note: "ParseTableSubject = grammar_digest + token_stream_digest (full stream content-address incl. lexemes) + position + production"
-        observed_at: Absent
-      }
-    },
-  ]
-}
diff --git a/dag/extdeps/rust/cargo.dag b/dag/extdeps/rust/cargo.dag
index db76f1f2239..3dbc6a90364 100644
--- a/dag/extdeps/rust/cargo.dag
+++ b/dag/extdeps/rust/cargo.dag
@@ -1,7 +1,7 @@
 module extdeps.cargo
 
 import extdeps.cargo_version { CargoPackageVersion, CargoVersionRequirement, CargoToolVersionFloor }
-import std.types { FilePathParts, NonEmptyStr, String, List }
+import std.types { Bool, FilePathParts, NonEmptyStr, String, List }
 import std.workspace_artifact { WorkspaceFootprint, WorkspaceArtifact, FootprintProvenance, CitedUpstream, RegenerableFromSource, LocalCacheState }
 
 import extdeps.external_authority { ExternalAuthority }
@@ -40,8 +40,11 @@ type CargoPackage {
   path: String
 }
 
+// `default_features` is Cargo's `default-features` key on a registry dependency
+// (doc.rust-lang.org/cargo/reference/specifying-dependencies.html, "Dependency features"): false
+// opts the dependency out of its own default feature set.
 type CargoDepSource
-  = RegistryDep  { version: CargoVersionRequirement, features: List<String> }
+  = RegistryDep  { version: CargoVersionRequirement, default_features: Bool, features: List<String> }
   | LocalPathDep { path: String }
 
 type CargoDependency {
diff --git a/dag/extdeps/systemd/service_exec.dag b/dag/extdeps/systemd/service_exec.dag
new file mode 100644
index 00000000000..98eb50cd5fc
--- /dev/null
+++ b/dag/extdeps/systemd/service_exec.dag
@@ -0,0 +1,201 @@
+module extdeps.systemd.service_exec
+
+import std.types { String, NonEmptyStr, List, Bool }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.uri { Uri, Https }
+import extdeps.exec.command { ArgvCommand, argv_words }
+
+// WHAT THE SERVICE MANAGER HANDS A STOP COMMAND, and how a command line is spelled to it. Two
+// upstream facts, both from systemd's own manuals, and nothing about any one consumer: which unit
+// carries a stop hook, what it writes and where are workflow facts that live with the workflow.
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#Environment%20Variables%20Set%20or%20Propagated%20by%20the%20Service%20Manager"
+  }
+}
+
+data systemd_service_command_lines_authority: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "www.freedesktop.org/software/systemd/man/latest/systemd.service.html#Command%20lines"
+  }
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.systemd.service_exec",
+      decl_name: "ServiceStopVariable",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps_external_authority_anchor,
+  further_citations: [systemd_service_command_lines_authority]
+}
+
+// systemd.exec(5), "Environment Variables Set or Propagated by the Service Manager":
+//   $INVOCATION_ID  -- set for every process the manager spawns for the unit: the unit's current
+//                      invocation, a 128-bit id formatted as 32 lowercase hex characters.
+//   $SERVICE_RESULT -- set for ExecStop= and ExecStopPost= only: the service's result, one of the
+//                      words below.
+//   $EXIT_CODE      -- set for ExecStop= and ExecStopPost= only: how the main process ended:
+//                      "exited", "killed" or "dumped" (empty if it never ran).
+//   $EXIT_STATUS    -- set for ExecStop= and ExecStopPost= only: the numeric exit status when
+//                      $EXIT_CODE is "exited", otherwise the signal NAME (e.g. "TERM").
+// They exist only while the stop command runs, so a record of the main process's end that survives
+// the unit has to be written by that command, from these values.
+type ServiceStopVariable
+  = InvocationIdVariable
+  | ServiceResultVariable
+  | ExitCodeVariable
+  | ExitStatusVariable
+
+fn service_stop_variable_name(variable: ServiceStopVariable) -> NonEmptyStr {
+  match variable {
+    InvocationIdVariable => "INVOCATION_ID" as NonEmptyStr
+    ServiceResultVariable => "SERVICE_RESULT" as NonEmptyStr
+    ExitCodeVariable => "EXIT_CODE" as NonEmptyStr
+    ExitStatusVariable => "EXIT_STATUS" as NonEmptyStr
+  }
+}
+
+// $SERVICE_RESULT's documented words (systemd.exec(5)). An unlisted word is carried, not dropped:
+// a manager newer than this model may add one, and the reader must say so rather than guess.
+type ServiceResult
+  = ServiceResultSuccess
+  | ServiceResultProtocol
+  | ServiceResultTimeout
+  | ServiceResultExitCode
+  | ServiceResultSignal
+  | ServiceResultCoreDump
+  | ServiceResultWatchdog
+  | ServiceResultStartLimitHit
+  | ServiceResultResources
+  | ServiceResultOomKill
+  | ServiceResultUnlisted { word: String }
+
+fn service_result_of_wire(word: String) -> ServiceResult {
+  if word == "success" { ServiceResultSuccess }
+  else if word == "protocol" { ServiceResultProtocol }
+  else if word == "timeout" { ServiceResultTimeout }
+  else if word == "exit-code" { ServiceResultExitCode }
+  else if word == "signal" { ServiceResultSignal }
+  else if word == "core-dump" { ServiceResultCoreDump }
+  else if word == "watchdog" { ServiceResultWatchdog }
+  else if word == "start-limit-hit" { ServiceResultStartLimitHit }
+  else if word == "resources" { ServiceResultResources }
+  else if word == "oom-kill" { ServiceResultOomKill }
+  else { ServiceResultUnlisted { word: word } }
+}
+
+// $EXIT_CODE's documented words. "Exited" carries a numeric status; the other two carry a signal
+// name, and the two are different facts -- a process killed by SIGTERM did not exit 15.
+type ServiceExitCode
+  = ServiceExitCodeExited
+  | ServiceExitCodeKilled
+  | ServiceExitCodeDumped
+  | ServiceExitCodeUnlisted { word: String }
+
+fn service_exit_code_of_wire(word: String) -> ServiceExitCode {
+  if word == "exited" { ServiceExitCodeExited }
+  else if word == "killed" { ServiceExitCodeKilled }
+  else if word == "dumped" { ServiceExitCodeDumped }
+  else { ServiceExitCodeUnlisted { word: word } }
+}
+
+// ONE PIECE OF A COMMAND-LINE WORD: text the manager passes through unchanged, or a variable it
+// substitutes. systemd.service(5), "Command lines": "${FOO}" used as part of a word is replaced by
+// the variable's value with no word splitting, which is the form used here; the bare "$FOO" form
+// word-splits and is not modeled. Keeping the two pieces apart is what lets the renderer refuse a
+// literal that would be read as an expansion, instead of trusting that a string happens not to
+// contain one.
+type ExecWordPart
+  = ExecLiteral { text: String }
+  | ExecVariable { variable: ServiceStopVariable }
+
+type ExecWordRendering
+  = ExecWordRendered { word: NonEmptyStr }
+  | ExecWordRefused { reason: NonEmptyStr }
+
+// A literal is refused, never escaped, when it holds a character the command-line parser would
+// treat as syntax: whitespace or a quote (word boundaries), a backslash (escapes), "$" (expansion)
+// or "%" (unit specifiers). Escaping would be a second grammar to get right; every literal this
+// repository mints is a path or an identifier that has no need of those characters.
+fn exec_literal_admissible(text: String) -> Bool {
+  !(string_contains(s: text, pattern: " ") || string_contains(s: text, pattern: "\t") || string_contains(s: text, pattern: "\n") || string_contains(s: text, pattern: "\"")
+    || string_contains(s: text, pattern: "'") || string_contains(s: text, pattern: "\\") || string_contains(s: text, pattern: "$") || string_contains(s: text, pattern: "%"))
+}
+
+fn exec_word_render(parts: List<ExecWordPart>) -> ExecWordRendering {
+  let refused = parts |> flat_map(p => match p {
+    ExecLiteral { text } => if exec_literal_admissible(text: text) { [] as List<String> } else { [text] }
+    ExecVariable { variable: _ } => [] as List<String>
+  })
+  match refused.first() {
+    Present { value: bad } =>
+      ExecWordRefused { reason: join(["command-line literal carries a character systemd would read as syntax: ", bad], "") as NonEmptyStr }
+    Absent => {
+      let word = join(parts |> map(p => match p {
+        ExecLiteral { text } => text
+        ExecVariable { variable } => join(["${", service_stop_variable_name(variable: variable) as String, "}"], "")
+      }), "")
+      if string_length(s: word) == 0 {
+        ExecWordRefused { reason: "an empty command-line word cannot be spelled to systemd" as NonEmptyStr }
+      } else {
+        ExecWordRendered { word: word as NonEmptyStr }
+      }
+    }
+  }
+}
+
+type ExecCommandLineRendering
+  = ExecCommandLineRendered { line: NonEmptyStr }
+  | ExecCommandLineRefused { reason: NonEmptyStr }
+
+// AN ARGV AS ONE ExecStart=/ExecStopPost= VALUE. The manager splits the value on whitespace into
+// words, the first naming the program, and runs it directly: no shell is involved at any point
+// (systemd.service(5), "Command lines"), which is why a typed argv can be handed over at all. Every
+// word passes the same admissibility test as a literal part, except that a word rendered from parts
+// by exec_word_render may carry the "${...}" its variables were spelled as; that form is re-checked
+// below rather than trusted.
+fn exec_command_line(command: ArgvCommand) -> ExecCommandLineRendering {
+  let words = argv_words(command: command)
+  let refused = words |> filter(w => !exec_literal_admissible(text: w) && !exec_word_is_rendered_expansion(word: w))
+  match refused.first() {
+    Present { value: bad } =>
+      ExecCommandLineRefused { reason: join(["argv word carries a character systemd would read as syntax: ", bad], "") as NonEmptyStr }
+    Absent => ExecCommandLineRendered { line: join(words, " ") as NonEmptyStr }
+  }
+}
+
+// THE "+" COMMAND-LINE PREFIX, from the special executable prefixes systemd.service(5) documents
+// ("Command lines"): it runs that one command with full privileges -- outside the unit's file-system
+// namespacing and sandboxing (ProtectSystem=, ProtectHome=, ReadWritePaths= and the rest), while the
+// main process keeps them. That is what lets a stop hook write where the unit's own process may not.
+// In a user manager "full privileges" are the user's own; the prefix never grants more than the
+// manager's principal holds. It is the only prefix this repository uses, so it is one function rather
+// than a coproduct of one.
+data exec_full_privileges_prefix: String = "+"
+
+fn exec_command_line_full_privileges(command: ArgvCommand) -> ExecCommandLineRendering {
+  match exec_command_line(command: command) {
+    ExecCommandLineRefused { reason } => ExecCommandLineRefused { reason: reason }
+    ExecCommandLineRendered { line } => ExecCommandLineRendered { line: join([exec_full_privileges_prefix, line as String], "") as NonEmptyStr }
+  }
+}
+
+// A WORD WHOSE ONLY SYNTAX IS "${NAME}" FOR A MODELED VARIABLE. Re-reading the rendered word, not
+// trusting a flag beside it: strip every modeled expansion, and the remainder must be an
+// admissible literal. A "$" anywhere else -- an unmodeled variable, a bare $FOO -- survives the
+// strip and refuses.
+fn exec_word_is_rendered_expansion(word: String) -> Bool {
+  let stripped = fold(
+    [InvocationIdVariable, ServiceResultVariable, ExitCodeVariable, ExitStatusVariable],
+    init: word,
+    f: (acc, v) => replace(acc, join(["${", service_stop_variable_name(variable: v) as String, "}"], ""), ""),
+  )
+  stripped != word && exec_literal_admissible(text: stripped)
+}
diff --git a/dag/extdeps/systemd/systemctl.dag b/dag/extdeps/systemd/systemctl.dag
index 1acf1739c59..2feb85829c2 100644
--- a/dag/extdeps/systemd/systemctl.dag
+++ b/dag/extdeps/systemd/systemctl.dag
@@ -225,8 +225,14 @@ fn systemctl_set_property_argv(unit: NonEmptyStr, property: NonEmptyStr, value:
   ]
 }
 
+// `systemctl revert UNIT...` takes UNIT NAMES ONLY and removes every drop-in of each named unit
+// (systemctl(1), systemd 255). Property names are not arguments: an earlier argv appended
+// "MemoryMax" "MemoryHigh", which systemctl read as two more units (MemoryMax.service,
+// MemoryHigh.service) and reverted silently with exit 0 -- so the argv claimed a property-scoped
+// revert it never performed. What this reverts is the unit's whole drop-in set, including the
+// control shadows set-property wrote, and that is what the caller is relying on.
 fn systemctl_revert_memory_caps_argv(unit: NonEmptyStr) -> List<String> {
-  ["systemctl", "revert", unit as String, "MemoryMax", "MemoryHigh"]
+  ["systemctl", "revert", unit as String]
 }
 
 // THE USER MANAGER IS A DIFFERENT MANAGER, NOT A FLAG ON THE SAME QUERY. `systemctl show` without
@@ -442,6 +448,8 @@ type UnitFileState
 // actually executes. The trigger that closes it again is argv element evaluation in the
 // materializer, which `std.operation_argv` already carries as declared residue.
 //
+// MaskRuntime follows systemctl(1), v255: --runtime places a mask under /run and
+// without --now the active incarnation continues. It does not stop a workload.
 service systemd.Systemctl {
   operation Enable {
     requires Network
@@ -573,6 +581,21 @@ service systemd.Systemctl {
     }
   }
 
+  operation MaskRuntime {
+    input { unit: NonEmptyStr }
+    output { success: Bool from "exit_success", stdout: String from "stdout", stderr: String from "stderr" }
+    transport shell { argv: ["systemctl", "mask", "--runtime", "{unit}"] }
+    exit { 0 => Unit nonzero => String "runtime mask refused" }
+    mock_response { 1 => { success: false, stdout: "", stderr: "no mask supplied" } "no fabricated inhibition" }
+  }
+
+  operation Reboot {
+    output { success: Bool from "exit_success", stderr: String from "stderr" }
+    transport shell { argv: ["systemctl", "reboot"] }
+    exit { 0 => Unit nonzero => String "normal reboot request refused" }
+    mock_response { 1 => { success: false, stderr: "no reboot supplied" } "no fabricated activation" }
+  }
+
   operation SetProperty {
     requires Network
     input { unit: NonEmptyStr, property: NonEmptyStr, value: NonEmptyStr }
@@ -597,10 +620,10 @@ service systemd.Systemctl {
       success: Bool from "exit_success"
       stderr: String from "stderr"
     }
-    transport shell { argv: ["systemctl", "revert", "{unit}", "MemoryMax", "MemoryHigh"] }
+    transport shell { argv: ["systemctl", "revert", "{unit}"] }
     exit {
       0 => Unit
-      nonzero => String "systemctl revert MemoryMax MemoryHigh failed"
+      nonzero => String "systemctl revert failed"
     }
     mock_response {
       0 => { success: true, stderr: "" } "hermetic systemd.Systemctl.RevertMemoryCaps"
diff --git a/dag/extdeps/systemd/systemd.dag b/dag/extdeps/systemd/systemd.dag
index 1e514352c9d..a72ed451ba2 100644
--- a/dag/extdeps/systemd/systemd.dag
+++ b/dag/extdeps/systemd/systemd.dag
@@ -6,7 +6,7 @@ import std.algebra { trim }
 import std.types { List }
 import std.nat { Nat }
 import std.measure {
-  ByteSize, byte_size, byte_size_count, Microsecond, microsecond, microsecond_count,
+  ByteSize, byte_size, byte_size_count, Microsecond, microsecond, microsecond_count, Second, second_count,
   HardwareThreadCount, hardware_thread_count_value,
   milli_per_unit, micro_per_unit, seconds_per_minute, minutes_per_hour,
 }
@@ -71,6 +71,7 @@ type SystemdUnitProperty
   | Result
   | ExecMainStatus
   | ExecStartProperty
+  | ExecStopPostProperty
   | User
   | WorkingDirectoryProperty
   | RuntimeDirectoryProperty
@@ -96,6 +97,8 @@ type SystemdUnitProperty
   | PrivateTmpProperty
   | ReadWritePathsProperty
   | RemainAfterExitProperty
+  | RuntimeMaxSecProperty
+  | CollectModeProperty
   | JobProperty
 
 // THE WIRE SPELLING AS A SEALED WORD, SO THE CLOSED TYPE SURVIVES ALL THE WAY TO THE ARGV.
@@ -147,6 +150,7 @@ fn systemd_unit_property_wire(property: SystemdUnitProperty) -> NonEmptyStr {
     Result => "Result" as NonEmptyStr
     ExecMainStatus => "ExecMainStatus" as NonEmptyStr
     ExecStartProperty => "ExecStart" as NonEmptyStr
+    ExecStopPostProperty => "ExecStopPost" as NonEmptyStr
     User => "User" as NonEmptyStr
     WorkingDirectoryProperty => "WorkingDirectory" as NonEmptyStr
     RuntimeDirectoryProperty => "RuntimeDirectory" as NonEmptyStr
@@ -172,6 +176,8 @@ fn systemd_unit_property_wire(property: SystemdUnitProperty) -> NonEmptyStr {
     PrivateTmpProperty => "PrivateTmp" as NonEmptyStr
     ReadWritePathsProperty => "ReadWritePaths" as NonEmptyStr
     RemainAfterExitProperty => "RemainAfterExit" as NonEmptyStr
+    RuntimeMaxSecProperty => "RuntimeMaxSec" as NonEmptyStr
+    CollectModeProperty => "CollectMode" as NonEmptyStr
     JobProperty => "Job" as NonEmptyStr
   }
 }
@@ -257,6 +263,13 @@ fn systemd_time_span_split(part: String) -> SystemdTimeSpanPart? {
   }
 }
 
+// THE TYPED QUANTITY RENDERED TO SYSTEMD'S TIME-SPAN SPELLING, at the boundary and nowhere else: a
+// duration is authored as a Second and only its systemd text is a string, so no consumer parses text to
+// recover the number. Whole seconds with the `s` unit are a spelling systemd_duration_usec reads back.
+fn systemd_time_span_of_seconds(d: Second) -> NonEmptyStr {
+  join([to_string(second_count(s: d)), "s"], "") as NonEmptyStr
+}
+
 fn systemd_duration_usec(text: String) -> Microsecond? {
   let parts = filter(split(s: trim(s: text), delimiter: " "), p => p != "")
   if list_length(items: parts) == 0 {
@@ -522,3 +535,7 @@ fn systemd_slice_cgroup_path(mount_point: NonEmptyStr, slice: NonEmptyStr) -> Sy
     }
   }
 }
+
+// THE DIRECTORY sd_booted(3) TESTS: it exists exactly when systemd is the running service manager
+// (PID 1), which is what systemd-run needs to start a transient unit.
+data systemd_booted_runtime_dir: String = "/run/systemd/system"
diff --git a/dag/extdeps/systemd/udevd.dag b/dag/extdeps/systemd/udevd.dag
index db46aaf7794..0da2ef6433b 100644
--- a/dag/extdeps/systemd/udevd.dag
+++ b/dag/extdeps/systemd/udevd.dag
@@ -39,3 +39,8 @@ data systemd_log_target_env_name: NonEmptyStr = "SYSTEMD_LOG_TARGET"
 data systemd_log_target_kmsg: NonEmptyStr = "kmsg"
 
 data systemd_log_level_debug: NonEmptyStr = "debug"
+
+// THE LABEL INDEX udev MAINTAINS: 60-persistent-storage.rules links each filesystem label under
+// /dev/disk/by-label (systemd udev rules, v255), so listing the directory reads the labels the
+// booted host's block devices carry.
+data udev_disk_by_label_dir: String = "/dev/disk/by-label"
diff --git a/dag/extdeps/systemd/unit_file.dag b/dag/extdeps/systemd/unit_file.dag
index 725d146f464..f943f50772e 100644
--- a/dag/extdeps/systemd/unit_file.dag
+++ b/dag/extdeps/systemd/unit_file.dag
@@ -513,6 +513,20 @@ type SystemdTimerDirective
   | RandomizedDelaySec { duration: NonEmptyStr }
   | Persistent { enabled: Bool }
 
+// A .path UNIT'S DIRECTIVES (systemd.path(5)). A path unit activates its unit when a condition on a
+// watched path becomes true, through inotify, with no polling and no clock -- which is what makes it
+// the event source for a directory other processes write into. The two conditions modeled differ in
+// a way that matters to their consumers: DirectoryNotEmpty= is a LEVEL (it is re-checked when the
+// activated unit finishes, so an entry that arrived while it ran starts it again), PathChanged= is an
+// EDGE (a change while the activated unit is still running is coalesced into that run, and is not
+// remembered after it). PathUnit= names the unit to activate; MakeDirectory= creates the watched
+// directory if it is missing.
+type SystemdPathDirective
+  = PathUnit { target: NonEmptyStr }
+  | DirectoryNotEmpty { path: NonEmptyStr }
+  | PathChanged { path: NonEmptyStr }
+  | MakeDirectory { enabled: Bool }
+
 type SystemdInstallDirective
   = WantedBy { target: NonEmptyStr }
   | RequiredBy { target: NonEmptyStr }
@@ -774,6 +788,15 @@ fn systemd_timer_directive_line(directive: SystemdTimerDirective) -> String {
   }
 }
 
+fn systemd_path_directive_line(directive: SystemdPathDirective) -> String {
+  match directive {
+    PathUnit { target: v } => join(["Unit=", v as String], "")
+    DirectoryNotEmpty { path: v } => join(["DirectoryNotEmpty=", v as String], "")
+    PathChanged { path: v } => join(["PathChanged=", v as String], "")
+    MakeDirectory { enabled: v } => if v { "MakeDirectory=yes" } else { "MakeDirectory=no" }
+  }
+}
+
 // THE LINE HAS NO MATCH LEFT TO GET WRONG. Both halves come from an authority: the knob name from
 // `systemd_unit_property_wire` and the value from `systemd_directive_value_wire`, so a fifth knob is
 // a mint above and no edit here.
@@ -836,6 +859,11 @@ type SystemdUnitFile
       slice: List<SystemdSliceDirective>,
       install: SystemdInstallSection,
     }
+  | PathUnitFile {
+      unit: List<SystemdUnitDirective>,
+      path: List<SystemdPathDirective>,
+      install: SystemdInstallSection,
+    }
 
 // THE INSTANCE SPECIFIER IS systemd's, SO IT IS SPELLED HERE AND NOWHERE ELSE.
 //
@@ -858,6 +886,8 @@ data systemd_timer_section_header: String = "[Timer]"
 
 data systemd_slice_section_header: String = "[Slice]"
 
+data systemd_path_section_header: String = "[Path]"
+
 data systemd_install_section_header: String = "[Install]"
 
 fn systemd_install_section_block(section: SystemdInstallSection) -> List<List<String>> {
@@ -933,6 +963,16 @@ fn systemd_unit_file_lines(file: SystemdUnitFile) -> List<String> {
           systemd_install_section_block(section: inst),
         ),
       )
+    PathUnitFile { unit: u, path: pd, install: inst } =>
+      systemd_section_lines(
+        sections: concat(
+          [
+            concat([systemd_unit_section_header], map(u, d => systemd_unit_directive_line(directive: d))),
+            concat([systemd_path_section_header], map(pd, d => systemd_path_directive_line(directive: d))),
+          ],
+          systemd_install_section_block(section: inst),
+        ),
+      )
   }
 }
 
diff --git a/dag/extdeps/tailscale/acl.dag b/dag/extdeps/tailscale/acl.dag
index ea7848815f4..b9b975927a5 100644
--- a/dag/extdeps/tailscale/acl.dag
+++ b/dag/extdeps/tailscale/acl.dag
@@ -38,6 +38,12 @@ data tag_dashboard: NonEmptyStr = "tag:dashboard"
 data dashboard_tcp_port: NonEmptyStr = "tcp:3737"
 data ssh_tcp_port: NonEmptyStr = "tcp:22"
 
+// dusk-1 is the operator's desktop (WSL) serving an OpenAI-compatible inference API while the
+// Sparks are sold. It is an untagged member device, so no tag grant reaches it; this admits only
+// the dashboard plane to its API port. tag:ci stays quarantined to the dashboard port.
+data dusk_serving_ip: NonEmptyStr = "100.127.39.77"
+data dusk_serving_api_tcp_port: NonEmptyStr = "tcp:8080"
+
 type TailscaleAclSelector
   = AclTag { label: NonEmptyStr }
   | AclAutogroup { group: NonEmptyStr }
@@ -158,12 +164,21 @@ fn tag_dashboard_to_ci_ssh_grant() -> TailscaleGrant {
   }
 }
 
+fn tag_dashboard_to_dusk_serving_api_grant() -> TailscaleGrant {
+  TailscaleGrant {
+    src: [sel_tag_dashboard()],
+    dst: [sel_ipv4(address: dusk_serving_ip)],
+    ip: [sel_proto_port(spec: dusk_serving_api_tcp_port)],
+  }
+}
+
 fn operator_tailscale_acl_grants() -> List<TailscaleGrant> {
   [
     member_baseline_grant(),
     tag_ci_quarantine_grant(),
     tag_dashboard_self_grant(),
     tag_dashboard_to_ci_ssh_grant(),
+    tag_dashboard_to_dusk_serving_api_grant(),
   ]
 }
 
@@ -304,10 +319,27 @@ fn ssh_dashboard_reaches_ci_root_and_nonroot(policy: TailscaleAclPolicy) -> Bool
   )
 }
 
+fn grant_reaches_dusk_serving(g: TailscaleGrant) -> Bool {
+  selector_list_contains(items: g.dst, needle: sel_ipv4(address: dusk_serving_ip))
+}
+
+fn dusk_serving_reached_by_dashboard_api_only(policy: TailscaleAclPolicy) -> Bool {
+  let tagged = policy.grants |> filter(g => grant_reaches_dusk_serving(g: g))
+  match first(tagged) {
+    Present { value: g } =>
+      (length(tagged) == 1)
+        && (g.src == [sel_tag_dashboard()])
+        && (length(g.dst) == 1)
+        && (g.ip == [sel_proto_port(spec: dusk_serving_api_tcp_port)])
+    Absent => false
+  }
+}
+
 fn operator_acl_security_spine_holds(policy: TailscaleAclPolicy) -> Bool {
   tag_ci_quarantine_holds(policy: policy)
     && tag_dashboard_admin_plane_holds(policy: policy)
     && dashboard_cutover_ip_is_transient_in_tag_ci_grant(policy: policy)
     && ssh_members_reach_ci_nonroot_only(policy: policy)
     && ssh_dashboard_reaches_ci_root_and_nonroot(policy: policy)
+    && dusk_serving_reached_by_dashboard_api_only(policy: policy)
 }
diff --git a/dag/extdeps/tailscale/serve.dag b/dag/extdeps/tailscale/serve.dag
index 069bb40421e..9b97024572b 100644
--- a/dag/extdeps/tailscale/serve.dag
+++ b/dag/extdeps/tailscale/serve.dag
@@ -4,7 +4,7 @@ import extdeps.exec.program { ProgramIdentity, uncataloged_program }
 
 import std.types { NonEmptyStr, Port, List, Bool, Unit }
 import std.algebra { Less, Equal, Greater }
-import extdeps.version.semver { SemVerVersion, semver_compare, semver_version_label }
+import extdeps.version.semver { SemVerVersion, semver_compare, semver_version_label, semver_version_parse }
 
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
@@ -295,13 +295,11 @@ fn tailscale_serve_status_route_proxy_targets(status_json: String, key: Tailscal
 // guards is a teardown that silently removes nothing and reports success.\n\nThe boundary is stated
 // as the version the upstream itself names, not as a version this repo picked.
 
-data tailscale_scoped_serve_off_minimum: SemVerVersion = SemVerVersion {
-  major: 1,
-  minor: 52,
-  patch: 0,
-  pre_release: [],
-  build: [],
-}
+// THE BOUNDARY IS THE PARSE RESULT, never a hand-built record: the fields of a SemVerVersion
+// are confined code-point runs (semver_numeric_field is the only admission), so the boundary
+// arrives through the parser and an unadmitted label is carried as a refusal to every
+// consumer, not a fabricated version (review 77150).
+data tailscale_scoped_serve_off_minimum: SemVerVersion? = semver_version_parse(cps: chars(s: "1.52.0" as String))
 
 type TailscaleServeCapability
   = ScopedRemovalSupported { observed: SemVerVersion }
@@ -310,10 +308,14 @@ type TailscaleServeCapability
 
 // THE VERDICT CARRIES WHAT IT WAS COMPUTED FROM. A Bool capability cannot be re-derived when the boundary moves or the host is upgraded, and cannot say WHICH client it is describing — so the observed version rides on both decided arms and only the undecided arm carries prose.\n\nIt is a SemVerVersion rather than the version string tailscale prints, grounded on extdeps.version.semver, because an earlier draft of this row held both a display string and a parsed major/minor pair — two representations of one fact, free to disagree, which is the exact defect class this module is being repaired for. The label is a projection (semver_version_label), so there is nothing to keep in sync.\n\nComparison is semver_compare rather than a hand-written major/minor ladder, for the same reason: the ordering is already modeled, and a second ladder would be a second answer.
 fn tailscale_scoped_removal_capability(observed: SemVerVersion) -> TailscaleServeCapability {
-  match semver_compare(a: observed, b: tailscale_scoped_serve_off_minimum) {
-    Less => ScopedRemovalUnsupported { observed: observed }
-    Equal => ScopedRemovalSupported { observed: observed }
-    Greater => ScopedRemovalSupported { observed: observed }
+  match tailscale_scoped_serve_off_minimum {
+    Absent => ScopedRemovalUnobserved { reason: "the serve-off boundary label failed to parse — a defect in the boundary row, not an observation gap" }
+    Present { value: minimum } =>
+      match semver_compare(a: observed, b: minimum) {
+        Less => ScopedRemovalUnsupported { observed: observed }
+        Equal => ScopedRemovalSupported { observed: observed }
+        Greater => ScopedRemovalSupported { observed: observed }
+      }
   }
 }
 
diff --git a/dag/extdeps/tools/coreutils_truncate.dag b/dag/extdeps/tools/coreutils_truncate.dag
new file mode 100644
index 00000000000..9c2a3072cec
--- /dev/null
+++ b/dag/extdeps/tools/coreutils_truncate.dag
@@ -0,0 +1,29 @@
+module extdeps.tools.coreutils_truncate
+
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+import std.types { Bool, NonEmptyStr, Unit }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "www.gnu.org/software/coreutils/manual/html_node/truncate-invocation.html"
+  }
+}
+
+// `truncate -s N FILE` creates FILE if it is absent and sets its size to EXACTLY N bytes; bytes it
+// adds read as zero (coreutils "truncate invocation"). -s takes a bare decimal byte count here, never
+// a suffixed one, so the size is the caller's integer and nothing the tool reinterprets. -- ends the
+// options, so a path beginning with '-' is a path.
+service coreutils.Truncate {
+  operation ToSize {
+    requires none
+    input { size_bytes: NonEmptyStr, path: NonEmptyStr }
+    output { success: Bool from "exit_success" }
+    transport shell { argv: ["truncate", "-s", "{size_bytes}", "--", "{path}"] }
+    exit {
+      0 => Unit
+      nonzero => String "truncate could not size the path"
+    }
+  }
+}
diff --git a/dag/extdeps/tools/curl.dag b/dag/extdeps/tools/curl.dag
index 0d143cac763..82bcab21e69 100644
--- a/dag/extdeps/tools/curl.dag
+++ b/dag/extdeps/tools/curl.dag
@@ -89,6 +89,11 @@ fn curl_bounded_get_argv(url: String, connect_timeout: Second, max_time: Second)
   ]
 }
 
+// THE SAME BOUNDED GET AS A COMMAND, its body on stdout.
+fn curl_bounded_get_command(url: String, connect_timeout: Second, max_time: Second) -> ArgvCommand {
+  argv_command(program: curl_program(), arguments: curl_bounded_get_argv(url: url, connect_timeout: connect_timeout, max_time: max_time).skip(n: 1))
+}
+
 fn curl_download_command(url: String, destination: String) -> ArgvCommand {
   argv_command(program: curl_program(), arguments: ["-fsL", "-o", destination, url])
 }
diff --git a/dag/extdeps/tools/findutils.dag b/dag/extdeps/tools/findutils.dag
index 971008edf0f..595cd5faeb4 100644
--- a/dag/extdeps/tools/findutils.dag
+++ b/dag/extdeps/tools/findutils.dag
@@ -101,3 +101,27 @@ fn find_owner_executable_files_command(root: String) -> ArgvCommand {
 fn find_symlink_targets_command(root: String) -> ArgvCommand {
   argv_command(program: find_program(), arguments: [root, "-type", "l", "-printf", "l %P -> %l\\n"])
 }
+
+// THE REGULAR FILES UNDER A ROOT WITH THEIR SIZE AND MODIFICATION TIME, ONE
+// `<size>\t<mtime>\t<relative path>` LINE EACH, AND NOTHING READ BUT METADATA. Every -printf
+// directive here is answered from the inode find already holds from its own stat(2) of the entry
+// (find manual, "Format Directives"): %s is st_size in bytes, %T@ is st_mtime as seconds since the
+// epoch with a fractional part, %P is the path with the starting point removed. No directive opens
+// the file, and the expression carries no action that runs another program, so the command reads
+// no file content -- find_command_runs_another_program below is how a consumer checks the second
+// half on the value rather than on this note. The path is LAST so a name holding a tab survives as
+// the rest of the line; the escapes are find's own, so the argv word carries a backslash and a
+// letter, never a control character.
+fn find_regular_file_size_mtime_command(root: String) -> ArgvCommand {
+  argv_command(program: find_program(), arguments: [root, "-type", "f", "-printf", "%s\\t%T@\\t%P\\n"])
+}
+
+// THE ACTIONS THAT MAKE find RUN ANOTHER PROGRAM ON WHAT IT MATCHED (find manual, "Run Commands"):
+// -exec and -execdir, and their prompting forms -ok and -okdir. find itself reads directory entries
+// and inodes; every content reader it can reach -- cat, sha256sum, grep -- arrives through one of
+// these four. find_regular_files_sha256_command above is a real builder that uses one.
+data find_program_running_actions: List<String> = ["-exec", "-execdir", "-ok", "-okdir"]
+
+fn find_command_runs_another_program(command: ArgvCommand) -> Bool {
+  any(command.arguments, a => any(find_program_running_actions, x => a == x))
+}
diff --git a/dag/extdeps/tools/gnu_coreutils.dag b/dag/extdeps/tools/gnu_coreutils.dag
index 9d301182af4..e9f8de17282 100644
--- a/dag/extdeps/tools/gnu_coreutils.dag
+++ b/dag/extdeps/tools/gnu_coreutils.dag
@@ -38,6 +38,7 @@ data min_coreutils_version: VersionConstraint = ">= 8.0"
 // criterion for climbing to an absolute row, and the counter-example that makes the distinction
 // load-bearing are recorded once at extdeps.exec.command program_spelling_is_an_observation_claim.
 fn cat_program() -> ProgramIdentity = uncataloged_program(invocation: "cat")
+fn nproc_program() -> ProgramIdentity = uncataloged_program(invocation: "nproc")
 fn mktemp_program() -> ProgramIdentity = uncataloged_program(invocation: "mktemp")
 fn cp_program() -> ProgramIdentity = uncataloged_program(invocation: "cp")
 fn printf_program() -> ProgramIdentity = uncataloged_program(invocation: "printf")
@@ -78,6 +79,15 @@ fn mkdir_parents_command(path: String) -> ArgvCommand {
   argv_command(program: mkdir_program(), arguments: ["-p", "--", path])
 }
 
+// mkdir WITHOUT -p IS CREATE-ONLY: it creates exactly one directory and REFUSES with "File exists"
+// when the name is already taken, and it refuses when the parent is missing rather than creating it
+// (coreutils manual, "mkdir invocation"). The kernel's mkdir(2) is atomic, so two invocations
+// racing on one name leave one winner and one refusal and never a merged result -- which is what
+// lets the NAME of the directory be the record and a repeated invocation be harmless.
+fn mkdir_create_only_command(path: String) -> ArgvCommand {
+  argv_command(program: mkdir_program(), arguments: ["--", path])
+}
+
 // ln WITHOUT -s IS A HARD LINK, and without -f it REFUSES when the destination exists (coreutils
 // "ln invocation"): the create-only publication step. A second name for the same inode, never a
 // replacement of the bytes behind an existing name.
@@ -100,6 +110,12 @@ fn cat_command(path: String) -> ArgvCommand {
   argv_command(program: cat_program(), arguments: [path])
 }
 
+// nproc WITH NO OPERANDS PRINTS THE PROCESSING UNITS AVAILABLE TO THE CURRENT PROCESS (GNU coreutils
+// nproc), so a reading taken inside a cgroup or affinity mask is that bound, not the machine's count.
+fn nproc_command() -> ArgvCommand {
+  argv_command(program: nproc_program(), arguments: [])
+}
+
 // od(1) OVER ONE BYTE SPAN, AS HEX: -j skips `offset` bytes and -N reads at most `length`, both byte
 // counts (coreutils "od invocation"); -An drops the address column, -tx1 prints one two-digit lowercase
 // hex byte per unit, and -v prints every line rather than folding repeats into `*` -- without it a run
diff --git a/dag/extdeps/tools/gzip.dag b/dag/extdeps/tools/gzip.dag
index a2a3e845cb9..d0a78421957 100644
--- a/dag/extdeps/tools/gzip.dag
+++ b/dag/extdeps/tools/gzip.dag
@@ -58,3 +58,19 @@ service gzip.Gzip {
     }
   }
 }
+
+// COMPRESS ONE FILE BESIDE ITSELF: `--keep --best --force`, which writes <path>.gz at level 9, keeps
+// the input, and replaces a stale <path>.gz (gzip manual, "Invoking gzip"). The compressed size is a
+// stat of <path>.gz; it is how a caller asks whether bytes are compressible without carrying them.
+service gzip.Compress {
+  operation BesideKeepBest {
+    requires none
+    input { path: NonEmptyStr }
+    output { success: Bool from "exit_success" }
+    transport shell { argv: ["gzip", "--keep", "--best", "--force", "--", "{path}"] }
+    exit {
+      0 => Unit
+      nonzero => String "gzip could not compress the path"
+    }
+  }
+}
diff --git a/dag/extdeps/tools/hostname.dag b/dag/extdeps/tools/hostname.dag
index 922621bbc0e..b4dbb0fb777 100644
--- a/dag/extdeps/tools/hostname.dag
+++ b/dag/extdeps/tools/hostname.dag
@@ -38,6 +38,17 @@ data extdeps_hostnamectl_external_authority_anchor: ExternalAuthority = External
   }
 }
 
+// TWO READ ROWS BECAUSE THEY ANSWER DIFFERENT QUESTIONS. Bare `hostname` prints whatever the host is
+// configured to call itself, which may be fully qualified; `hostname -s` prints the first label only.
+// The reach probe compares its read for EXACT equality against the enrolled fleet slot label (the
+// short name a host is known by on the LAN), so it needs the configured name the host itself reports
+// — not a re-derived first label — and the probe therefore owns this row, the bare spelling, while a
+// converge that matches by short label owns `hostname_short_read_argv`. Collapsing the two would
+// silently change which name a caller compared.
+fn hostname_read_argv() -> List<String> {
+  [hostname_program().invocation as String]
+}
+
 fn hostname_short_read_argv() -> List<String> {
   ["hostname", "-s"]
 }
diff --git a/dag/extdeps/tools/id.dag b/dag/extdeps/tools/id.dag
index 5230ceffcdc..16b79d1ecc8 100644
--- a/dag/extdeps/tools/id.dag
+++ b/dag/extdeps/tools/id.dag
@@ -28,6 +28,19 @@ fn id_uid_argv() -> List<String> {
   [id_program().invocation as String, "-u"]
 }
 
+// NO OPERAND, DELIBERATELY: id(1) with no operand answers from the CALLING PROCESS's own
+// credentials, established at its exec and never changing afterwards. The reach probe asks "which
+// account did the transport actually reach", and the only account that can say is the one the session
+// IS — so the probe supplies no user and reads the login name the session itself carries. A user
+// operand would ask the account database about a different account and answer the wrong question.
+//
+// -un, NOT -u: -n selects NAMES over numeric uids (the probe records the login name it was granted,
+// not a per-host uid), and -u then prints that name alone rather than the full `id` record. One flag
+// for the name, one for the field; the probe trims the newline the remote shell leaves on stdout.
+fn id_user_name_argv() -> List<String> {
+  [id_program().invocation as String, "-un"]
+}
+
 fn id_gid_argv() -> List<String> {
   [id_program().invocation as String, "-g"]
 }
diff --git a/dag/extdeps/tools/node.dag b/dag/extdeps/tools/node.dag
index d6772b9402a..c688a65814b 100644
--- a/dag/extdeps/tools/node.dag
+++ b/dag/extdeps/tools/node.dag
@@ -114,3 +114,8 @@ fn node_version_command(node_binary: NonEmptyStr) -> ArgvCommand {
 fn node_eval_command(node_binary: NonEmptyStr, script: String, operands: List<String>) -> ArgvCommand {
   argv_command(program: cataloged_program(invocation: node_binary), arguments: concat(["-e", script], operands))
 }
+
+// `node <script> <args...>`: runs a Node script file with arguments.
+fn node_run_file_command(node_binary: NonEmptyStr, script_path: NonEmptyStr, operands: List<String> = []) -> ArgvCommand {
+  argv_command(program: cataloged_program(invocation: node_binary), arguments: concat([script_path], operands))
+}
diff --git a/dag/extdeps/tools/openssl.dag b/dag/extdeps/tools/openssl.dag
index 18b7fff6875..76a38bbfe9e 100644
--- a/dag/extdeps/tools/openssl.dag
+++ b/dag/extdeps/tools/openssl.dag
@@ -113,3 +113,28 @@ data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
   first_citation: extdeps.tools.openssl.extdeps_external_authority_anchor,
   further_citations: []
 }
+
+// `openssl enc -aes-256-ctr` ENCRYPTS ONE FILE INTO ANOTHER UNDER AES-256 IN COUNTER MODE (openssl-enc,
+// docs.openssl.org/3.0/man1/openssl-enc/). CTR is a stream mode, so the output is exactly as long as
+// the input -- no padding, and -nosalt drops the "Salted__" header -- and is the input XOR the AES
+// keystream. -pass pass:<p> derives the key and IV from the passphrase; -md sha256 pins that
+// derivation's digest, which is the default from OpenSSL 1.1.0 on, so 1.1 and 3.x hosts agree. The
+// passphrase is in argv and is therefore NOT a secret: this operation is for keyed, reproducible
+// streams whose key anyone may know (extdeps.crypto.seeded_filler), never for confidentiality.
+service openssl.Enc {
+  operation Aes256CtrPassphrase {
+    requires none
+    input { passphrase: NonEmptyStr, input_path: NonEmptyStr, output_path: NonEmptyStr }
+    output {
+      success: Bool from "exit_success"
+      stderr: String from "stderr"
+    }
+    transport shell {
+      argv: [openssl_program().invocation, "enc", "-aes-256-ctr", "-nosalt", "-md", "sha256", "-pass", "pass:{passphrase}", "-in", "{input_path}", "-out", "{output_path}"]
+    }
+    exit {
+      0 => Unit
+      nonzero => String "openssl enc refused"
+    }
+  }
+}
diff --git a/dag/extdeps/tools/sha256sum.dag b/dag/extdeps/tools/sha256sum.dag
index 3f308663bf9..f7d52c1c85b 100644
--- a/dag/extdeps/tools/sha256sum.dag
+++ b/dag/extdeps/tools/sha256sum.dag
@@ -43,6 +43,10 @@ data sha256sum_cli_tool: CliTool = CliTool {
   installable_via: [SourceCoreutils],
 }
 
+// Observed on srv1, 2026-10-09: /usr/bin/sha256sum is root:root 0755. Exact sudoers
+// digest-read grants require this resolved path, shared by their executor.
+data sha256sum_binary_path: NonEmptyStr = "/usr/bin/sha256sum"
+
 // DigestFile DIGESTS a file rather than verifying it against one a caller already has. CheckFile
 // answers "does this file match this digest", which cannot be used to LEARN a digest: a caller that
 // wants to record which bytes it actually ran has nothing to compare against yet. coreutils prints
diff --git a/dag/extdeps/tools/tar.dag b/dag/extdeps/tools/tar.dag
index 893dccb3a62..3e403b89b07 100644
--- a/dag/extdeps/tools/tar.dag
+++ b/dag/extdeps/tools/tar.dag
@@ -69,3 +69,35 @@ fn tar_create_from_list_command(archive: String, from_directory: String, member_
 fn tar_list_command(archive: String) -> ArgvCommand {
   argv_command(program: tar_program(), arguments: ["-tf", archive])
 }
+
+// CREATE FROM TWO MEMBER LISTS, EACH READ RELATIVE TO ITS OWN DIRECTORY, INTO ONE ARCHIVE. GNU tar
+// applies -C to every member named after it, including members read from a -T file ("Changing the
+// Working Directory" in the GNU tar manual), so the second list's members are taken from the second
+// directory under the SAME member names the list spells. That is how a staged tree stands in for
+// paths of the first: a member staged at <second>/<path> is archived as <path>. The flags are
+// tar_create_from_list_command's, with the same reason for each.
+fn tar_create_from_two_lists_command(archive: String, first_directory: String, first_list: String, second_directory: String, second_list: String) -> ArgvCommand {
+  argv_command(
+    program: tar_program(),
+    arguments: ["-cf", archive, "--no-recursion", "--verbatim-files-from", "-C", first_directory, "-T", first_list, "-C", second_directory, "-T", second_list],
+  )
+}
+
+// LIST AN ARCHIVE'S MEMBERS WITH THEIR SIZES: `--list --verbose --numeric-owner --full-time
+// --quoting-style=literal`. Each line is the type-and-mode word, uid/gid, the size in bytes, the
+// date, the time, then the member name unescaped (GNU tar manual, "The Verbose Listing" and
+// "Quoting Member Names"); numeric ids and full time keep each of the five leading fields a single
+// word, so the name is whatever follows the fifth.
+fn tar_list_sizes_command(archive: String) -> ArgvCommand {
+  argv_command(program: tar_program(), arguments: ["--list", "--verbose", "--numeric-owner", "--full-time", "--quoting-style=literal", "-f", archive])
+}
+
+// EXTRACT EXACTLY THE LISTED MEMBERS INTO A DIRECTORY: -C first, so every member lands beneath it
+// under its archived name; -T names the members; --no-recursion and --verbatim-files-from as on
+// create. A listed name the archive does not hold makes tar exit nonzero.
+fn tar_extract_listed_command(archive: String, into_directory: String, member_list: String) -> ArgvCommand {
+  argv_command(
+    program: tar_program(),
+    arguments: ["-xf", archive, "-C", into_directory, "--no-recursion", "--verbatim-files-from", "-T", member_list],
+  )
+}
diff --git a/dag/extdeps/tools/uname.dag b/dag/extdeps/tools/uname.dag
index 9c9873707cb..6cbab772efe 100644
--- a/dag/extdeps/tools/uname.dag
+++ b/dag/extdeps/tools/uname.dag
@@ -7,6 +7,8 @@ import extdeps.external_authority { ExternalAuthority, ExternalModelScope, Exter
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.uri { Uri, Https }
 import extdeps.exec.command { ArgvCommand, argv_command }
+import extdeps.toolchain.types { Architecture, Aarch64, X86_64, Riscv64 }
+import std.optional { Present }
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {
@@ -35,3 +37,32 @@ fn uname_program() -> ProgramIdentity = uncataloged_program(invocation: "uname")
 fn uname_release_command() -> ArgvCommand {
   argv_command(program: uname_program(), arguments: ["-r"])
 }
+
+// `-m` PRINTS THE MACHINE HARDWARE NAME the kernel reports (its UTS machine field), the spelling a
+// running Linux guest gives for its own architecture. `-n` prints the node name, the kernel's
+// hostname -- an observation of what the machine answers to, which is a different fact from the
+// hostname the fleet allocated it.
+fn uname_machine_command() -> ArgvCommand {
+  argv_command(program: uname_program(), arguments: ["-m"])
+}
+
+fn uname_nodename_command() -> ArgvCommand {
+  argv_command(program: uname_program(), arguments: ["-n"])
+}
+
+// THE LINUX MACHINE SPELLING, PROJECTED ONTO Architecture. On Linux `uname -m` prints the kernel's
+// utsname machine field, which each architecture's Makefile sets as UTS_MACHINE: `aarch64` for arm64,
+// `x86_64` for x86-64 and `riscv64` for 64-bit RISC-V. This is a PARTIAL projection, like every other
+// upstream spelling of Architecture (extdeps.toolchain.types architecture_diagnostic_name): a spelling
+// it does not cite refuses, never falls back to the closest variant.
+fn uname_linux_machine_architecture(spelling: String) -> Architecture? {
+  if spelling == "aarch64" {
+    Present { value: Aarch64 }
+  } else if spelling == "x86_64" {
+    Present { value: X86_64 }
+  } else if spelling == "riscv64" {
+    Present { value: Riscv64 }
+  } else {
+    none
+  }
+}
diff --git a/dag/extdeps/tools/util_linux_flock.dag b/dag/extdeps/tools/util_linux_flock.dag
new file mode 100644
index 00000000000..3b9aa119195
--- /dev/null
+++ b/dag/extdeps/tools/util_linux_flock.dag
@@ -0,0 +1,32 @@
+module extdeps.tools.util_linux_flock
+
+import extdeps.exec.program { ProgramIdentity, uncataloged_program }
+
+import std.types { NonEmptyStr, String, Int, List }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+// flock(1), util-linux: "flock [options] <file>|<directory> <command> [<argument>...]" -- take a lock
+// on the file, run the command, and release the lock when the command exits. Read from the
+// installed util-linux 2.41.5 --help and man7.org on 2026-10-05. The lock is held by the process for
+// exactly the command's lifetime and the kernel drops it when the process dies, so a crashed command
+// leaves no lock to recover. Only the exclusive, non-blocking form is modeled: -n/--nonblock ("fail
+// rather than wait") with -E/--conflict-exit-code naming the exit status a conflict reports, so a
+// caller can tell "someone else holds it" apart from the command's own failures. -F/--no-fork
+// ("execute command without forking") execs the command in flock's place with the lock fd inherited,
+// so the process a terminal shows in the foreground is the command, not flock.
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "man7.org/linux/man-pages/man1/flock.1.html"
+  }
+}
+
+fn flock_program() -> ProgramIdentity = uncataloged_program(invocation: "flock")
+
+fn flock_exclusive_nonblocking_words(lock_path: NonEmptyStr, conflict_exit_code: Int, command: List<String>) -> List<String> {
+  concat(
+    [flock_program().invocation as String, "--exclusive", "--nonblock", "--no-fork", "--conflict-exit-code", to_string(value: conflict_exit_code), lock_path as String],
+    command,
+  )
+}
diff --git a/dag/extdeps/version.dag b/dag/extdeps/version.dag
index 5cb3b9b5673..b794d4d6585 100644
--- a/dag/extdeps/version.dag
+++ b/dag/extdeps/version.dag
@@ -14,8 +14,20 @@ data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
 
 type VersionIdentity = NonEmptyStr where brand("VersionIdentity")
 
+// A scheme's precedence is defined over the identity grammar the scheme names. A pair the
+// grammar does not cover is a LOCATED refusal: the carrier names the side whose label failed
+// (a closed coproduct — a misspelled side is unwritable), the label itself, and the cause —
+// never a fabricated order, and never a bare Absent that a caller cannot distinguish from a
+// caller error (DESIGN section 5: a failure arm must refuse, never widen — every degradation a
+// typed, located, countable diagnostic).
+type ComparisonSide = LeftOperand | RightOperand
+
+type VersionComparison
+  = VersionCompared { ordering: Ordering }
+  | VersionComparisonRefused { side: ComparisonSide, identity: String, cause: String }
+
 type VersionScheme {
-  compare: fn(VersionIdentity, VersionIdentity) -> Ordering
+  compare: fn(VersionIdentity, VersionIdentity) -> VersionComparison
 }
 
 type VersionConstraint = NonEmptyStr where brand("VersionConstraint")
diff --git a/dag/extdeps/version/pep440.dag b/dag/extdeps/version/pep440.dag
index 2258a74d423..962a2ff7dd6 100644
--- a/dag/extdeps/version/pep440.dag
+++ b/dag/extdeps/version/pep440.dag
@@ -7,6 +7,7 @@ import std.types { List }
 import std.types { NonEmptyStr }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
+import std.nat { nat_to_decimal_string }
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {
@@ -230,21 +231,21 @@ fn pep440_pre_release_phase_label(phase: Pep440PreReleasePhase) -> String {
 fn pep440_pre_release_label(pre: Pep440PreRelease) -> String {
   concat(
     pep440_pre_release_phase_label(phase: pre.phase),
-    "{pre.number}"
+    nat_to_decimal_string(value: pre.number)
   )
 }
 
 fn pep440_release_segments_label(segments: Pep440ReleaseSegments) -> String {
-  let head = "{segments.first}"
+  let head = nat_to_decimal_string(value: segments.first)
   if segments.rest.length() == 0 {
     head
   } else {
-    concat(head, concat(".", segments.rest |> map(n => "{n}") |> join(separator: ".")))
+    concat(head, concat(".", segments.rest |> map(n => nat_to_decimal_string(value: n)) |> join(separator: ".")))
   }
 }
 
 fn pep440_epoch_prefix(epoch: NonNegativeInt) -> String {
-  if epoch == 0 { "" } else { concat("{epoch}", "!") }
+  if epoch == 0 { "" } else { concat(nat_to_decimal_string(value: epoch), "!") }
 }
 
 fn pep440_public_version_label(v: Pep440PublicVersion) -> String {
@@ -257,18 +258,18 @@ fn pep440_public_version_label(v: Pep440PublicVersion) -> String {
     Absent => base
   }
   let with_post = match v.post_release {
-    Present { value: n } => concat(with_pre, concat(".post", "{n}"))
+    Present { value: n } => concat(with_pre, concat(".post", nat_to_decimal_string(value: n)))
     Absent => with_pre
   }
   match v.dev_release {
-    Present { value: n } => concat(with_post, concat(".dev", "{n}"))
+    Present { value: n } => concat(with_post, concat(".dev", nat_to_decimal_string(value: n)))
     Absent => with_post
   }
 }
 
 fn pep440_local_segment_label(seg: Pep440LocalSegment) -> String {
   match seg {
-    Pep440LocalNumeric { value: v } => "{v}"
+    Pep440LocalNumeric { value: v } => nat_to_decimal_string(value: v)
     Pep440LocalLexicographic { label: s } => s
   }
 }
diff --git a/dag/extdeps/version/semver.dag b/dag/extdeps/version/semver.dag
index 1ffe1f45396..af3b076fc7a 100644
--- a/dag/extdeps/version/semver.dag
+++ b/dag/extdeps/version/semver.dag
@@ -1,13 +1,10 @@
 module extdeps.version.semver
 
-import extdeps.version { VersionIdentity, VersionScheme, VersionConstraint }
-import std.algebra { Ordering, Less, Equal, Greater }
+import extdeps.version { VersionIdentity, VersionComparison, VersionCompared, VersionComparisonRefused, VersionScheme, VersionConstraint, ComparisonSide, LeftOperand, RightOperand }
+import std.algebra { Ordering, Less, Equal, Greater, trim }
 import std.integer { NonNegativeInt }
-import std.types { List, Int }
-import std.nat { nat_compare }
-import std.types { NonEmptyStr, String }
-import std.algebra { trim }
-import std.checked_arithmetic { checked_int_to_nat }
+import std.types { List }
+import std.types { NonEmptyStr, String, Int }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
 
@@ -22,31 +19,95 @@ type SemVerIdentity = VersionIdentity
 
 type SemVerConstraint = VersionConstraint
 
+// A numeric component carries its code points, not a machine integer: SemVer 2.0.0 puts no
+// size limit on X.Y.Z (§2) or on numeric identifiers (§9), so an Int conversion on the
+// comparison path would invent a grammar failure the spec does not have.
+//
+// CONSTRUCTOR-SEALED: `sole_constructor` makes this record constructible ONLY inside this
+// module, so the one admission is `semver_numeric_field` (refuses an empty sequence, anything
+// outside ASCII digits 48..57, and a leading zero unless the sequence is the single digit 0).
+// An outside module writing `SemVerNumericField { .. }` meets the SoleConstructorViolation
+// refusal at compile time — the witness file holds that probe as an executing negative control
+// plus the via-constructor positive control. The native (stage0) route's modifier-parse gap is
+// a separate known defect, carried by g0_type_decl_modifier_parse_without_sealing_property and
+// cited here, not restated. Comparison and rendering project `.digits`. The emitter lowers this
+// one-field record to a plain alias, so the confinement's rung is BY-SOURCE plus the executing
+// controls — the witness file states the rung honestly.
+type SemVerNumericField sole_constructor {
+  digits: List<Int>
+}
+
+fn semver_numeric_field(cps: List<Int>) -> SemVerNumericField? {
+  if cps.count() == 0 {
+    none
+  } else if !all(cps, cp => cp >= 48 && cp <= 57) {
+    none
+  } else if cps.count() > 1 {
+    match cps.first() {
+      Present { value: 48 } => none
+      Present { value: _ } => Present { value: SemVerNumericField { digits: cps } }
+      Absent => none
+    }
+  } else {
+    Present { value: SemVerNumericField { digits: cps } }
+  }
+}
+
 type SemVerIdentifier
-  = SemVerNumericIdentifier { value: NonNegativeInt }
+  = SemVerNumericIdentifier { digits: SemVerNumericField }
   | SemVerAlphanumericIdentifier { label: NonEmptyStr }
 
 type SemVerVersion {
-  major: NonNegativeInt
-  minor: NonNegativeInt
-  patch: NonNegativeInt
+  major: SemVerNumericField
+  minor: SemVerNumericField
+  patch: SemVerNumericField
   pre_release: List<SemVerIdentifier>
   build: List<SemVerIdentifier>
 }
 
-fn semver_compare_non_negative_int(a: NonNegativeInt, b: NonNegativeInt) -> Ordering {
-  nat_compare(a: a, b: b)
+// §11 decides major, then minor, then patch "as numbers". With admission refusing leading
+// zeroes, a digit run's LENGTH is its magnitude and equal lengths compare digit-wise in ASCII
+// order — section 11's numeric comparison at any width. The comparator takes CONFINED fields
+// and projects .digits itself, so no raw code-point list can reach it (side chat review
+// 5435818773); the run-length helper below stays internal over plain lists.
+fn semver_compare_numeric_digits(a: SemVerNumericField, b: SemVerNumericField) -> Ordering {
+  semver_compare_digit_runs(a: a.digits, b: b.digits)
+}
+
+fn semver_compare_digit_runs(a: List<Int>, b: List<Int>) -> Ordering {
+  if a.count() < b.count() { Less } else if a.count() > b.count() { Greater } else { semver_compare_digits_lexical(a: a, b: b) }
+}
+
+fn semver_compare_digits_lexical(a: List<Int>, b: List<Int>) -> Ordering {
+  if a.count() == 0 {
+    Equal
+  } else {
+    match a.first() {
+      Present { value: ac } => match b.first() {
+        Present { value: bc } =>
+          if ac < bc {
+            Less
+          } else if ac > bc {
+            Greater
+          } else {
+            semver_compare_digits_lexical(a: a.skip(n: 1), b: b.skip(n: 1))
+          }
+        Absent => Greater
+      }
+      Absent => Less
+    }
+  }
 }
 
 fn semver_compare_identifier(a: SemVerIdentifier, b: SemVerIdentifier) -> Ordering {
   match a {
-    SemVerNumericIdentifier { value: av } => match b {
-      SemVerNumericIdentifier { value: bv } =>
-        semver_compare_non_negative_int(a: av, b: bv)
+    SemVerNumericIdentifier { digits: ad } => match b {
+      SemVerNumericIdentifier { digits: bd } =>
+        semver_compare_numeric_digits(a: ad, b: bd)
       SemVerAlphanumericIdentifier { label: _ } => Less
     }
     SemVerAlphanumericIdentifier { label: al } => match b {
-      SemVerNumericIdentifier { value: _ } => Greater
+      SemVerNumericIdentifier { digits: _ } => Greater
       SemVerAlphanumericIdentifier { label: bl } =>
         if al < bl { Less } else { if al > bl { Greater } else { Equal } }
     }
@@ -85,11 +146,11 @@ fn semver_compare_pre_release(a: List<SemVerIdentifier>, b: List<SemVerIdentifie
 }
 
 fn semver_compare(a: SemVerVersion, b: SemVerVersion) -> Ordering {
-  match semver_compare_non_negative_int(a: a.major, b: b.major) {
+  match semver_compare_numeric_digits(a: a.major, b: b.major) {
     Equal =>
-      match semver_compare_non_negative_int(a: a.minor, b: b.minor) {
+      match semver_compare_numeric_digits(a: a.minor, b: b.minor) {
         Equal =>
-          match semver_compare_non_negative_int(a: a.patch, b: b.patch) {
+          match semver_compare_numeric_digits(a: a.patch, b: b.patch) {
             Equal => semver_compare_pre_release(a: a.pre_release, b: b.pre_release)
             other => other
           }
@@ -99,10 +160,13 @@ fn semver_compare(a: SemVerVersion, b: SemVerVersion) -> Ordering {
   }
 }
 
+
 // A NUMERIC RELEASE "M.m" OR "M.m.p" AS A SemVerVersion CORE, the form tools that are not themselves
 // semver-governed (curl, among them) print and pin. A missing patch reads as 0, which is what "M.m"
-// means as a release floor; any other shape -- a fourth part, a non-digit, a negative -- is absent,
-// never coerced.
+// means as a release floor; any other shape -- a fourth part, a non-digit, a leading zero, a negative --
+// is absent, never coerced (the confined constructor is the admission, so an out-of-grammar part
+// refuses exactly as the section 2 grammar refuses it). PORTED to the confined field representation
+// when main's dotted-floor functions merged against this module's retype.
 fn semver_core_of_dotted(text: String) -> SemVerVersion? {
   let parts = split(s: trim(s: text), delimiter: ".")
   if length(parts) < 2 || length(parts) > 3 {
@@ -115,7 +179,11 @@ fn semver_core_of_dotted(text: String) -> SemVerVersion? {
           Absent => none
           Present { value: minor } =>
             if length(parts) == 2 {
-              Present { value: SemVerVersion { major: major, minor: minor, patch: 0, pre_release: [], build: [] } }
+              match semver_numeric_field(cps: chars(s: "0" as String)) {
+                Absent => none
+                Present { value: zero } =>
+                  Present { value: SemVerVersion { major: major, minor: minor, patch: zero, pre_release: [], build: [] } }
+              }
             } else {
               match semver_dotted_part(parts: parts, index: 2) {
                 Absent => none
@@ -127,14 +195,10 @@ fn semver_core_of_dotted(text: String) -> SemVerVersion? {
   }
 }
 
-fn semver_dotted_part(parts: List<String>, index: Int) -> NonNegativeInt? {
+fn semver_dotted_part(parts: List<String>, index: Int) -> SemVerNumericField? {
   match parts.skip(n: index).first() {
     Absent => none
-    Present { value: w } =>
-      match parse_int(s: w) {
-        Absent => none
-        Present { value: n } => checked_int_to_nat(n: n)
-      }
+    Present { value: w } => semver_numeric_field(cps: chars(s: w as String))
   }
 }
 
@@ -151,7 +215,7 @@ fn semver_minimum_of_constraint(constraint: VersionConstraint) -> SemVerVersion?
 
 fn semver_identifier_label(id: SemVerIdentifier) -> String {
   match id {
-    SemVerNumericIdentifier { value: v } => "{v}"
+    SemVerNumericIdentifier { digits: d } => semver_label_from_code_points(cps: d.digits)
     SemVerAlphanumericIdentifier { label: s } => s
   }
 }
@@ -162,8 +226,8 @@ fn semver_identifiers_label(ids: List<SemVerIdentifier>) -> String {
 
 fn semver_version_label(v: SemVerVersion) -> String {
   let core = concat(
-    to_string(v.major),
-    concat(".", concat(to_string(v.minor), concat(".", to_string(v.patch))))
+    semver_label_from_code_points(cps: v.major.digits),
+    concat(".", concat(semver_label_from_code_points(cps: v.minor.digits), concat(".", semver_label_from_code_points(cps: v.patch.digits))))
   )
   let with_pre = if v.pre_release.count() == 0 {
     core
@@ -181,8 +245,242 @@ fn semver_to_version_identity(v: SemVerVersion) -> VersionIdentity {
   semver_version_label(v: v)
 }
 
-fn semver_identity_compare(a: VersionIdentity, b: VersionIdentity) -> Ordering {
-  if a == b { Equal } else { if a < b { Less } else { Greater } }
+// CITED RULE (SemVer 2.0.0 §11, https://semver.org/#spec-item-11 — the authority this module's
+// extdeps_external_authority_anchor attests): precedence is decided by comparing major, then
+// minor, then patch as NUMBERS; a pre-release version has LOWER precedence than the normal
+// version; pre-release identifiers compare numeric < alphanumeric, numerics numerically,
+// alphanumerics lexically in ASCII sort order, and a larger set of pre-release identifiers ranks
+// higher when all preceding identifiers are equal; build metadata is ignored entirely.
+//
+// The label is a VersionScheme's only handle, so the comparison parses the label back into the
+// typed form and routes through `semver_compare` — the ONE implementation of the cited rule.
+// §11 defines precedence over VALID versions, so a label outside the §2 grammar is a located
+// refusal: the carrier names the failing side, the label, and the cause (pinned by
+// w_semver_scheme_out_of_grammar_label_refuses_precedence), never a fabricated order.
+fn semver_identity_compare(a: VersionIdentity, b: VersionIdentity) -> VersionComparison {
+  match semver_identity_parse(label: a) {
+    Present { value: av } =>
+      match semver_identity_parse(label: b) {
+        Present { value: bv } => VersionCompared { ordering: semver_compare(a: av, b: bv) }
+        Absent => VersionComparisonRefused { side: RightOperand, identity: b as String, cause: "label does not satisfy the SemVer 2.0.0 version grammar, so section 11 precedence is undefined for it" }
+      }
+    Absent => VersionComparisonRefused { side: LeftOperand, identity: a as String, cause: "label does not satisfy the SemVer 2.0.0 version grammar, so section 11 precedence is undefined for it" }
+  }
+}
+
+// ---- label parse (SemVer 2.0.0 §2 grammar) --------------------------------
+
+fn semver_identity_code_points(label: VersionIdentity) -> List<Int> {
+  chars(s: label as String)
+}
+
+fn semver_is_ascii_digit(cp: Int) -> Bool {
+  cp >= 48 && cp <= 57
+}
+
+fn semver_is_ascii_letter(cp: Int) -> Bool {
+  (cp >= 65 && cp <= 90) || (cp >= 97 && cp <= 122)
+}
+
+fn semver_is_identifier_char(cp: Int) -> Bool {
+  semver_is_ascii_digit(cp: cp) || semver_is_ascii_letter(cp: cp) || cp == 45
+}
+
+fn semver_index_of(cp: Int, cps: List<Int>) -> Int? {
+  if cps.count() == 0 {
+    none
+  } else {
+    match cps.first() {
+      Present { value: h } =>
+        if h == cp {
+          Present { value: 0 }
+        } else {
+          match semver_index_of(cp: cp, cps: cps.skip(n: 1)) {
+            Present { value: k } => Present { value: k + 1 }
+            Absent => none
+          }
+        }
+      Absent => none
+    }
+  }
+}
+
+fn semver_split_on(cp: Int, cps: List<Int>, acc: List<List<Int>>) -> List<List<Int>> {
+  match semver_index_of(cp: cp, cps: cps) {
+    Present { value: i } =>
+      semver_split_on(cp: cp, cps: cps.skip(n: i + 1), acc: concat(acc, [cps.take(n: i)]))
+    Absent => concat(acc, [cps])
+  }
+}
+
+fn semver_all_digits(cps: List<Int>) -> Bool {
+  cps.count() > 0 && all(cps, cp => semver_is_ascii_digit(cp: cp))
+}
+
+// §2: a numeric identifier MUST NOT include leading zeroes; "0" alone is fine.
+fn semver_numeric_run_without_leading_zero(cps: List<Int>) -> Bool {
+  if !semver_all_digits(cps: cps) {
+    false
+  } else {
+    match cps.first() {
+      Present { value: h } => cps.count() == 1 || h != 48
+      Absent => false
+    }
+  }
+}
+
+
+
+fn semver_label_from_code_points(cps: List<Int>) -> NonEmptyStr {
+  join(cps |> map(cp => from_code_point(cp: cp)), "") as NonEmptyStr
+}
+
+// ---- core MAJOR.MINOR.PATCH -----------------------------------------------
+
+// THE LAST FIELD CONSUMES THE WHOLE REMAINDER, never a dot-split: a leftover delimiter
+// then fails the numeric run here instead of being split off and silently accepted.
+// SemVer 2.0.0 §2 is X.Y.Z with no trailing delimiter, so "1.2.3." must refuse, not rank.
+fn semver_core_fields_parse(cps: List<Int>, remaining: Int) -> List<SemVerNumericField>? {
+  if remaining == 0 {
+    if cps.count() == 0 { Present { value: [] } } else { none }
+  } else if remaining == 1 {
+    match semver_numeric_field(cps: cps) {
+      Absent => none
+      Present { value: v } => Present { value: [v] }
+    }
+  } else {
+    match semver_index_of(cp: 46, cps: cps) {
+      Present { value: i } =>
+        match semver_numeric_field(cps: cps.take(n: i)) {
+          Absent => none
+          Present { value: v } =>
+            match semver_core_fields_parse(cps: cps.skip(n: i + 1), remaining: remaining - 1) {
+              Absent => none
+              Present { value: rest } => Present { value: concat([v], rest) }
+            }
+        }
+      Absent => none
+    }
+  }
+}
+
+fn semver_core_parse(cps: List<Int>) -> SemVerVersion? {
+  match semver_core_fields_parse(cps: cps, remaining: 3) {
+    Absent => none
+    Present { value: fields } =>
+      if fields.count() != 3 {
+        none
+      } else {
+        match fields.first() {
+          Absent => none
+          Present { value: major } =>
+            match fields.skip(n: 1).first() {
+              Absent => none
+              Present { value: minor } =>
+                match fields.skip(n: 2).first() {
+                  Absent => none
+                  Present { value: patch } =>
+                    Present { value: SemVerVersion { major: major, minor: minor, patch: patch, pre_release: [], build: [] } }
+                }
+            }
+        }
+      }
+  }
+}
+
+// ---- pre-release and build identifiers ------------------------------------
+
+// One identifier parse for both §9 pre-release and §10 build identifiers; the only real
+// difference between the two grammars is carried by strict_numeric. A no-leading-zero digit run
+// is numeric (§9, §10). In strict mode — pre-release — an all-digit run WITH a leading zero is
+// neither numeric ("Numeric identifiers MUST NOT include leading zeroes", §9) nor alphanumeric
+// (the §2 grammar requires an alphanumeric identifier to contain a non-digit), so it refuses.
+// §10 permits leading zeroes in build metadata ("1.0.0+0130"), so permissive mode keeps such a
+// run as an alphanumeric identifier. An admitted numeric identifier carries its digits as code
+// points: section 9 numerics have no size limit, so no machine-integer conversion happens on
+// the comparison path.
+fn semver_identifier_parse(cps: List<Int>, strict_numeric: Bool) -> SemVerIdentifier? {
+  if cps.count() == 0 {
+    none
+  } else if !all(cps, cp => semver_is_identifier_char(cp: cp)) {
+    none
+  } else if semver_numeric_run_without_leading_zero(cps: cps) {
+    match semver_numeric_field(cps: cps) {
+      Present { value: f } => Present { value: SemVerNumericIdentifier { digits: f } }
+      Absent => none
+    }
+  } else if strict_numeric && semver_all_digits(cps: cps) {
+    none
+  } else {
+    Present { value: SemVerAlphanumericIdentifier { label: semver_label_from_code_points(cps: cps) } }
+  }
+}
+
+fn semver_identifier_list_parse(
+  segments: List<List<Int>>,
+  strict_numeric: Bool
+) -> List<SemVerIdentifier>? {
+  segments |> fold(
+    init: Present { value: [] },
+    f: (st, seg) =>
+      match st {
+        Absent => Absent
+        Present { value: acc } =>
+          match semver_identifier_parse(cps: seg, strict_numeric: strict_numeric) {
+            Absent => Absent
+            Present { value: id } => Present { value: concat(acc, [id]) }
+          }
+      }
+  )
+}
+
+fn semver_pre_release_parse(cps: List<Int>) -> List<SemVerIdentifier>? {
+  semver_identifier_list_parse(segments: semver_split_on(cp: 46, cps: cps, acc: []), strict_numeric: true)
+}
+
+fn semver_build_parse(cps: List<Int>) -> List<SemVerIdentifier>? {
+  semver_identifier_list_parse(segments: semver_split_on(cp: 46, cps: cps, acc: []), strict_numeric: false)
+}
+
+// ---- label assembly --------------------------------------------------------
+
+fn semver_identity_head_parse(cps: List<Int>, build: List<SemVerIdentifier>) -> SemVerVersion? {
+  match semver_index_of(cp: 45, cps: cps) {
+    Present { value: pi } =>
+      match semver_core_parse(cps: cps.take(n: pi)) {
+        Absent => none
+        Present { value: core } =>
+          match semver_pre_release_parse(cps: cps.skip(n: pi + 1)) {
+            Absent => none
+            Present { value: pre } =>
+              Present { value: SemVerVersion { major: core.major, minor: core.minor, patch: core.patch, pre_release: pre, build: build } }
+          }
+      }
+    Absent =>
+      match semver_core_parse(cps: cps) {
+        Absent => none
+        Present { value: core } =>
+          Present { value: SemVerVersion { major: core.major, minor: core.minor, patch: core.patch, pre_release: [], build: build } }
+      }
+  }
+}
+
+fn semver_identity_parse(label: VersionIdentity) -> SemVerVersion? {
+  semver_version_parse(cps: semver_identity_code_points(label: label))
+}
+
+// Code-point entry for sibling schemes whose labels carry a scheme-specific prefix (go's "v"):
+// the grammar and the precedence stay HERE — the one implementation — and the sibling keeps only
+// its own prefix and acceptance rules.
+fn semver_version_parse(cps: List<Int>) -> SemVerVersion? {
+  match semver_index_of(cp: 43, cps: cps) {
+    Present { value: bi } =>
+      match semver_build_parse(cps: cps.skip(n: bi + 1)) {
+        Absent => none
+        Present { value: build } => semver_identity_head_parse(cps: cps.take(n: bi), build: build)
+      }
+    Absent => semver_identity_head_parse(cps: cps, build: [])
+  }
 }
 
 data semver_scheme: VersionScheme = VersionScheme {
diff --git a/dag/gunbc/actions_run_binding.dag b/dag/gunbc/actions_run_binding.dag
index 23f2d4513af..afa5b03ae84 100644
--- a/dag/gunbc/actions_run_binding.dag
+++ b/dag/gunbc/actions_run_binding.dag
@@ -98,9 +98,12 @@ data rlm_expected_revision_env_name: String = "RLM_EXPECTED_REVISION"
 
 data fleet_converge_expected_host_env_name: String = "FLEET_CONVERGE_EXPECTED_HOST"
 
+data fleet_converge_arrival_subject_env_name: String = "FLEET_CONVERGE_ARRIVAL_SUBJECT"
+
 type ExpectedRevisionRead
   = ExpectedRevisionPresent { revision: String }
   | ExpectedRevisionAbsent { variable: String, detail: String }
+  | ExpectedRevisionMalformed { variable: String, value: String }
 
 fn read_expected_revision() -> ExpectedRevisionRead {
   match actions_variable_read(name: rlm_expected_revision_env_name) {
@@ -109,7 +112,7 @@ fn read_expected_revision() -> ExpectedRevisionRead {
       if release_revision_text_valid(text: r) {
         ExpectedRevisionPresent { revision: r }
       } else {
-        ExpectedRevisionAbsent { variable: rlm_expected_revision_env_name, detail: join(["not a 40-digit lower-hex revision: ", r], "") }
+        ExpectedRevisionMalformed { variable: rlm_expected_revision_env_name, value: r }
       }
   }
 }
@@ -126,6 +129,25 @@ fn admit_run_revision(binding: ActionsRunBinding, expected: String) -> RunRevisi
   }
 }
 
+// A DISPATCH MAY OMIT expected_revision. The checkout is then the event sha (github.sha), and that
+// is R. Operator 2026-10-10: this optional input is a cross-check, not a second revision authority;
+// revision for a dispatch is the event sha. A present value still has to match the checkout. A
+// present-but-malformed value is its own arm and refuses: absence is not a 40-digit check hidden in
+// Absent.detail prose.
+fn admit_optional_expected_revision_given(read: ExpectedRevisionRead, binding: ActionsRunBinding) -> RunRevisionAdmission {
+  match read {
+    ExpectedRevisionPresent { revision: expected_r } => admit_run_revision(binding: binding, expected: expected_r)
+    ExpectedRevisionAbsent { variable: _, detail: _ } =>
+      RunRevisionAdmitted { revision: binding.run_revision }
+    ExpectedRevisionMalformed { variable: _, value: r } =>
+      RunRevisionRefused { expected: r, observed: binding.run_revision }
+  }
+}
+
+fn admit_optional_expected_revision(binding: ActionsRunBinding) -> RunRevisionAdmission {
+  admit_optional_expected_revision_given(read: read_expected_revision(), binding: binding)
+}
+
 // GITHUB_WORKFLOW_REF is `<repository>/<workflow path>@<ref>`; the binding names a FILE when the
 // prefix up to the `@` is exactly repository + "/" + path.
 fn run_binding_names_workflow_file(binding: ActionsRunBinding, workflow_path: String) -> Bool {
diff --git a/dag/gunbc/auth/approval_device_enrolment_code_issue.dag b/dag/gunbc/auth/approval_device_enrolment_code_issue.dag
index e7b3955fcd7..a66569f3a80 100644
--- a/dag/gunbc/auth/approval_device_enrolment_code_issue.dag
+++ b/dag/gunbc/auth/approval_device_enrolment_code_issue.dag
@@ -22,7 +22,7 @@ import gunbc.cli_run_workspace_root_scaffold { gunbc_workspace_root_env_name }
 import gunbc.fleet_host_identity { operator_host_srv1 }
 import gunbc.actions_run_binding {
   actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent, fleet_converge_expected_host_env_name,
-  read_expected_revision, ExpectedRevisionPresent, ExpectedRevisionAbsent,
+  read_expected_revision, ExpectedRevisionPresent, ExpectedRevisionAbsent, ExpectedRevisionMalformed,
 }
 import gunbc.fleet_bootstrap_principal { executor_bootstrap_principal }
 import gunbc.fleet_posix_accounts { fleet_posix_operator_user }
@@ -170,6 +170,7 @@ fn approval_device_enrolment_code_issue_wet() -> CliWireResponse
         ExitSuccess =>
           match read_expected_revision() {
             ExpectedRevisionAbsent { variable: v, detail: d } => CliWireUnprintable { cause: ("approval device enrolment code: " + v + " " + d + "; the release to run is named by the dispatch") as NonEmptyStr }
+            ExpectedRevisionMalformed { variable: v, value: r } => CliWireUnprintable { cause: ("approval device enrolment code: " + v + " is not a 40-digit lower-hex revision: " + r + "; the release to run is named by the dispatch") as NonEmptyStr }
             ExpectedRevisionPresent { revision: rev } => enrolment_code_issue_remote(revision: RevisionBoundAtEmission { revision: rev as CommitSha })
           }
         ExitFailure { code: _, reason: why } => CliWireUnprintable { cause: why as NonEmptyStr }
diff --git a/dag/gunbc/auth/approval_store_receipt.dag b/dag/gunbc/auth/approval_store_receipt.dag
index b1e43b75861..6efc8b988ac 100644
--- a/dag/gunbc/auth/approval_store_receipt.dag
+++ b/dag/gunbc/auth/approval_store_receipt.dag
@@ -2,7 +2,7 @@ module gunbc.auth.approval_store_receipt
 
 import std.logic { Bool }
 import std.types { NonEmptyStr, Timestamp, String, Int, List }
-import v2.std.algebra { skip }
+import v2.std.algebra { skip, length }
 import std.optional { Present, Absent }
 import std.scoped_authorization { AttemptIdentity }
 import std.durable_compare_and_set { cas_generation_first }
@@ -249,7 +249,7 @@ fn receipt_line_at(lines: List<String>, i: Int) -> String {
 
 fn request_field(line: String, key: String) -> String {
   let prefix = join([key, "="], "")
-  if starts_with(s: line, prefix: prefix) { substring(s: line, start: string_length(s: prefix), end: string_length(s: line)) } else { "" }
+  if starts_with(s: line, prefix: prefix) { substring(s: line, start: length(xs: prefix), end: length(xs: line)) } else { "" }
 }
 
 // THE WIRE A RECEIPT TRAVELS AS: its signing input, then its tag, one line each. The signing input
diff --git a/dag/gunbc/auth/authorization_pattern_selection.dag b/dag/gunbc/auth/authorization_pattern_selection.dag
index da59ed22db3..3589a5bb6b6 100644
--- a/dag/gunbc/auth/authorization_pattern_selection.dag
+++ b/dag/gunbc/auth/authorization_pattern_selection.dag
@@ -47,8 +47,8 @@ import extdeps.uri { Uri, Https }
 // THE READINGS ARE DERIVED FROM REAL CASES, each named in authorization_pattern_evidence: the
 // federated fetch on boot run 35249658152 (no human action), the approval on fleet-converge run
 // 35447067113 (one phone tap, capability bound to one request revision), the Cloudflare bootstrap
-// token (dashboard-only, cloudflare_account_token_bootstrap_intervention), and the 2026-09-19
-// paste relay (pasted_token_relay_receipt). Nothing here is a weight somebody guessed.
+// token (dashboard-only, cloudflare_account_token_bootstrap_intervention). Nothing here is a weight
+// somebody guessed.
 
 // ── The characteristics of a privileged effect: the context parameters ───────────────────────
 //
@@ -111,14 +111,14 @@ type BillingConsequence
 // (gunbc.auth.privileged_effect_census rulings_without_a_rostered_interlock), and the site's
 // realization must take that hold before any write.
 //
-// THREE INTERLOCK STATES, NOT AN OPTIONAL HOLD. InterlockPending is a hold not yet named: it must
+// TWO INTERLOCK STATES, NOT AN OPTIONAL HOLD. InterlockPending is a hold not yet named: it must
 // refuse, never discharge (a bindable irreversible effect under a pending ruling still owes a
-// witness). UnconditionalStanding is an intentional no-hold discharge, with its reason. InterlockedBy
-// is a named hold the census must roster against the site. Only UnconditionalStanding and
-// InterlockedBy discharge the irreversibility ground.
+// witness). InterlockedBy is a named hold the census must roster against the site; only that arm
+// discharges the irreversibility ground. A grant arm that writes BMC credentials must be InterlockedBy
+// the grounded Apply admission (admit_rotation_apply), never pending. Route A overlays that hold per
+// arm (standing_grant_arm_interlock); grant grain may stay InterlockPending for unnamed classes.
 type StandingRulingInterlock
   = InterlockPending { obligation: NonEmptyStr }
-  | UnconditionalStanding { reason: NonEmptyStr }
   | InterlockedBy { hold: DeclarationRef }
 
 type StandingDestructiveAuthorization {
@@ -130,7 +130,6 @@ type StandingDestructiveAuthorization {
 fn standing_ruling_discharges_irreversibility(r: StandingDestructiveAuthorization) -> Bool {
   match r.interlock {
     InterlockPending { obligation: _ } => false
-    UnconditionalStanding { reason: _ } => true
     InterlockedBy { hold: _ } => true
   }
 }
@@ -212,28 +211,23 @@ fn unattended_required(e: PrivilegedEffect) -> Bool {
 //     action per effect; the credential is scoped to the request; receipt is the decision store row.
 // (c) HumanOnlyStep -- the effect has no API. The selection cannot automate it and says so by naming
 //     the std.human_intervention row that models the step.
-// (d) OperatorOwnSession -- the operator's own interactive gcloud session, or the operator's own
-//     token written to a file the operator's own process reads (the GcloudPrintToken and
-//     OperatorSuppliedToken arms). ADMISSIBLE BUT ALWAYS DOMINATED: one human action like (b), a
-//     project-wide credential unlike (b), no receipt unlike (b). It is in the field so its
-//     exclusion is by dominance the fold computes, not by a rule someone could delete, and so a
-//     site still on it is classified diverges rather than unclassifiable.
-// (e) PastedOperatorToken -- (d)'s credential RELAYED: pasted into chat, forwarded by message,
-//     written into another session's token file. Excluded before Pareto by the custody constraint,
-//     every time, for every effect. The substrate cannot see how a token file was filled, so this
-//     row is the executed statement of the refusal and the census carries the tell.
+// (d) OperatorOwnSession -- the operator's own credential, supplied by the operator by any route:
+//     their interactive gcloud session, a token they pasted into a session, or a token written to
+//     a file the run reads (the GcloudPrintToken and OperatorSuppliedToken arms). ADMISSIBLE BUT
+//     ALWAYS DOMINATED: one human action like (b), a project-wide credential unlike (b), no receipt
+//     unlike (b). Its exclusion is by dominance the fold computes, so a site still on it is
+//     classified diverges rather than unclassifiable. Operator ruling 2026-10-08: how the operator
+//     hands over their own token is not a separate pattern, so no relay refusal exists.
 type AuthorizationPattern
   = FederatedScopedGrant
   | OperatorApprovedCapability
   | HumanOnlyStep { step: HumanIntervention }
   | OperatorOwnSession
-  | PastedOperatorToken
 
 data pattern_federated_scoped_grant: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "pattern_federated_scoped_grant")
 data pattern_operator_approved_capability: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "pattern_operator_approved_capability")
 data pattern_human_only_step: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "pattern_human_only_step")
 data pattern_operator_own_session: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "pattern_operator_own_session")
-data pattern_pasted_operator_token: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "pattern_pasted_operator_token")
 
 fn pattern_identity(p: AuthorizationPattern) -> DeclarationRef {
   match p {
@@ -241,7 +235,6 @@ fn pattern_identity(p: AuthorizationPattern) -> DeclarationRef {
     OperatorApprovedCapability => pattern_operator_approved_capability
     HumanOnlyStep { step: _ } => pattern_human_only_step
     OperatorOwnSession => pattern_operator_own_session
-    PastedOperatorToken => pattern_pasted_operator_token
   }
 }
 
@@ -251,7 +244,6 @@ fn pattern_label(p: AuthorizationPattern) -> NonEmptyStr {
     OperatorApprovedCapability => "per-effect operator approval via the ntfy loop" as NonEmptyStr
     HumanOnlyStep { step: s } => join(["human-only step: ", s.identity as String], "") as NonEmptyStr
     OperatorOwnSession => "the operator's own interactive session or token file" as NonEmptyStr
-    PastedOperatorToken => "an operator token relayed through chat or between sessions" as NonEmptyStr
   }
 }
 
@@ -259,7 +251,7 @@ fn pattern_label(p: AuthorizationPattern) -> NonEmptyStr {
 // anything through a console, but a candidate with no HumanIntervention row behind it would be
 // selected with nothing to name, and "do it by hand" is not a step.
 fn candidate_patterns(e: PrivilegedEffect) -> List<AuthorizationPattern> {
-  let api_patterns = [FederatedScopedGrant, OperatorApprovedCapability, OperatorOwnSession, PastedOperatorToken]
+  let api_patterns = [FederatedScopedGrant, OperatorApprovedCapability, OperatorOwnSession]
   match e.surface {
     ApiSurface => api_patterns
     HumanSurfaceOnly { step: s } => concat(api_patterns, [HumanOnlyStep { step: s }])
@@ -300,7 +292,6 @@ fn pattern_is_api_pattern(p: AuthorizationPattern) -> Bool {
     FederatedScopedGrant => true
     OperatorApprovedCapability => true
     OperatorOwnSession => true
-    PastedOperatorToken => true
   }
 }
 
@@ -323,16 +314,14 @@ fn identity_bound(e: PrivilegedEffect, p: AuthorizationPattern) -> Int {
     OperatorApprovedCapability => 1
     HumanOnlyStep { step: _ } => 1
     OperatorOwnSession => 1
-    PastedOperatorToken => 1
   }
 }
 
 // CUSTODY: the credential reaches the executing process on the path its issuer issued it on. A
 // federated token is exchanged in-process; a capability travels in the signed link to the broker;
-// the operator's own session is the operator's own process. A relayed token has left that path.
+// the operator's own session or supplied token is the operator's own credential.
 fn credential_custody(p: AuthorizationPattern) -> Int {
   match p {
-    PastedOperatorToken => 0
     FederatedScopedGrant => 1
     OperatorApprovedCapability => 1
     HumanOnlyStep { step: _ } => 1
@@ -340,27 +329,25 @@ fn credential_custody(p: AuthorizationPattern) -> Int {
   }
 }
 
-// WITNESSED: a human consented to THIS effect. An operator who pasted a token consented to a
-// session, not to any one of the effects it then performed; a federated run has no human at all.
+// WITNESSED: a human consented to THIS effect. An operator who supplied a session token consented
+// to a session, not to any one of the effects it then performed; a federated run has no human at all.
 fn witnessed(p: AuthorizationPattern) -> Int {
   match p {
     OperatorApprovedCapability => 1
     HumanOnlyStep { step: _ } => 1
     FederatedScopedGrant => 0
     OperatorOwnSession => 0
-    PastedOperatorToken => 0
   }
 }
 
-// UNATTENDED: the pattern completes with no human present. A pasted token expires in an hour and
-// needs a human to paste again, so it does not run unattended either.
+// UNATTENDED: the pattern completes with no human present. An operator's token expires in an hour
+// and needs a human to supply it again, so it does not run unattended.
 fn unattended(p: AuthorizationPattern) -> Int {
   match p {
     FederatedScopedGrant => 1
     OperatorApprovedCapability => 0
     HumanOnlyStep { step: _ } => 0
     OperatorOwnSession => 0
-    PastedOperatorToken => 0
   }
 }
 
@@ -383,7 +370,6 @@ fn human_actions_per_effect(p: AuthorizationPattern) -> Int {
     OperatorApprovedCapability => 1
     HumanOnlyStep { step: _ } => 1
     OperatorOwnSession => 1
-    PastedOperatorToken => 1
   }
 }
 
@@ -395,12 +381,11 @@ fn credential_scoped_to_resource(p: AuthorizationPattern) -> Int {
     OperatorApprovedCapability => 1
     HumanOnlyStep { step: _ } => 0
     OperatorOwnSession => 0
-    PastedOperatorToken => 0
   }
 }
 
 // RECEIPT: something the corpus can read afterwards -- the run and its cell roster, the decision
-// store row, or the intervention's discharge site when one is modeled. A chat message is not one.
+// store row, or the intervention's discharge site when one is modeled.
 fn receipt_in_substrate(p: AuthorizationPattern) -> Int {
   match p {
     FederatedScopedGrant => 1
@@ -411,7 +396,6 @@ fn receipt_in_substrate(p: AuthorizationPattern) -> Int {
         NoDischargeSiteModeled => 0
       }
     OperatorOwnSession => 0
-    PastedOperatorToken => 0
   }
 }
 
@@ -466,14 +450,12 @@ fn unique_constraint_identities(cs: List<HardConstraint>) -> List<DeclarationRef
 // guidance is the cited statement that a federated job holds a short-lived token minted for that
 // job and no long-lived secret, which is the fact every reading on the custody, scope and receipt
 // axes descends from. The coupling between the term and the pattern variable is FLEET-OBSERVED, and
-// its receipt is the paste relay this module exists because of.
+// its receipt is the evidence row below.
 data github_oidc_hardening_authority: ExternalAuthority = ExternalAuthority {
   uri: Uri { scheme: Https, locator: "docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect" },
 }
 
-data pasted_token_relay_receipt: NonEmptyStr = "2026-09-19: the R2 origin work (gunbc#11713, gunbc#11721) minted Cloudflare account tokens and created Secret Manager containers under an operator GCP access token pasted into chat three times and relayed between sessions by dashboard message. The token was a project-wide bearer with a one-hour lifetime; no receipt names which effects it authorized. The same day, fleet-converge run 35447067113 redeemed one approval capability for one request revision after one phone tap, and boot run 35249658152 fetched a BMC credential under the run's federated identity with no human action." as NonEmptyStr
-
-data authorization_pattern_evidence: NonEmptyStr = "Readings derived from: boot run 35249658152 (federated fetch, zero human actions, receipt is the run and the accessor cell in gunbc.auth.fleet_secret_accessor_roster); fleet-converge run 35447067113 (one tap, capability bound to one request revision, receipt is the approval decision store row); gunbc.cloudflare.r2_token_mint cloudflare_account_token_bootstrap_intervention (dashboard-only, NoDischargeSiteModeled); pasted_token_relay_receipt (project-wide bearer, no receipt, relayed custody)." as NonEmptyStr
+data authorization_pattern_evidence: NonEmptyStr = "Readings derived from: boot run 35249658152 (federated fetch, zero human actions, receipt is the run and the accessor cell in gunbc.auth.fleet_secret_accessor_roster); fleet-converge run 35447067113 (one tap, capability bound to one request revision, receipt is the approval decision store row); gunbc.cloudflare.r2_token_mint cloudflare_account_token_bootstrap_intervention (dashboard-only, NoDischargeSiteModeled)." as NonEmptyStr
 
 data authorization_pattern_subject: NonEmptyStr = "which authorization pattern performs this privileged effect" as NonEmptyStr
 data id_subject: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "authorization_pattern_subject")
@@ -483,7 +465,7 @@ data id_policy: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization
 data id_var_pattern: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "var_authorization_pattern")
 data id_term_exposure: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "term_credential_exposure")
 data id_region: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "authorization_pattern_region")
-data id_coupling: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "pasted_token_relay_receipt")
+data id_coupling: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "authorization_pattern_evidence")
 data id_objective: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "authorization_pattern_objective")
 data id_domain: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "authorization_pattern_domain")
 
@@ -574,7 +556,6 @@ fn minted_reach_text(m: MintedCredentialReach) -> String {
 fn standing_ruling_interlock_label(r: StandingDestructiveAuthorization) -> String {
   match r.interlock {
     InterlockPending { obligation: o } => join(["InterlockPending: ", o as String], "")
-    UnconditionalStanding { reason: s } => join(["UnconditionalStanding: ", s as String], "")
     InterlockedBy { hold: i } => declaration_ref_display_key(ref: i)
   }
 }
@@ -699,7 +680,6 @@ fn select_authorization_pattern(e: PrivilegedEffect) -> AuthorizationPatternSele
             FederatedScopedGrant => PatternSelected { pattern: p, receipt: r }
             OperatorApprovedCapability => PatternSelected { pattern: p, receipt: r }
             OperatorOwnSession => PatternSelected { pattern: p, receipt: r }
-            PastedOperatorToken => PatternSelected { pattern: p, receipt: r }
           }
       }
     CandidateFieldUnestablished { causes: cs2 } => PatternSelectionRefused { defects: cs2 }
diff --git a/dag/gunbc/auth/branch_dispatch_federation.dag b/dag/gunbc/auth/branch_dispatch_federation.dag
new file mode 100644
index 00000000000..2edb403a8ab
--- /dev/null
+++ b/dag/gunbc/auth/branch_dispatch_federation.dag
@@ -0,0 +1,181 @@
+module gunbc.auth.branch_dispatch_federation
+
+import std.types { Int, List, Map, NonEmptyStr, String, Timestamp }
+import std.optional { Present, Absent }
+import extdeps.cloud.gcp.gcp { ServiceAccountEmail, WifProvider, wif_provider_resource, wif_pool_resource }
+import extdeps.cloud.gcp.iam { GcpIamBindingCell, IamCondition }
+import gunbc.auth.github_gcp_federation { fleet_secrets_project_number, github_wif_issuer_uri, federated_service_account_member }
+import gunbc.auth.oidc_claim_pins {
+  OidcClaimPin, oidc_equals, claim_pins_attribute_condition, workflow_dispatch_event_name, fleet_converge_workflow_claim_pins,
+}
+import gunbc.auth.heal_publisher_provision { DedicatedFederation, RunScopedImpersonation }
+import gunbc.gcp_estate_observation { role_iam_workload_identity_user }
+import gunbc.hetzner_cloud_acquisition { hetzner_cloud_api_grants }
+
+// ── A FLEET-CONVERGE RUN FROM A BRANCH, ADMITTED ONE RUN AT A TIME ─────────────────────────────
+// The main-only federation (gunbc.auth.fleet_convergence_federation) keeps every account it reaches
+// away from unreviewed code by pinning the workflow file and ref at main. That is the right wall for
+// an account holding the fleet's secrets, and the wrong one for iterating on a controller: every
+// change would need a merge before it could touch the thing it changes (operator, 2026-10-09).
+//
+// THIS POOL ADMITS A DISPATCH FROM ANY BRANCH AND GRANTS NOTHING BY ITSELF. Its provider pins the
+// repository, its owner and a workflow_dispatch event, and maps the run id. No account binds the
+// pool: a run-scoped federation's account (heal_publisher_provision RunScopedImpersonation) holds
+// no standing impersonation cell. A run becomes able to act as the account only when
+// gunbc.auth.branch_run_grant -- reviewed code, at main, as iam-converge -- writes a cell naming that
+// run's id, under an IAM condition that expires, after the operator approved that exact run (its
+// branch, its commit, its mode, read from GitHub rather than from the run) over ntfy.
+//
+// SO A BRANCH CAN NOT SKIP THE APPROVAL BY EDITING ITS WORKFLOW: the approval is not a step in the
+// branch's run; without the cell no token from that run can be exchanged for the account at all.
+//
+// ONE ACCOUNT PER CAPABILITY. What an approved branch run reaches is only what its account holds, so
+// a mistaken approval costs that capability and nothing else. The first is the Hetzner Cloud
+// project token; another capability that needs branch iteration gets its own account here, never a
+// widening of this one.
+data branch_dispatch_wif_pool_id: NonEmptyStr = "github-fleet-converge-dispatch"
+
+data branch_dispatch_wif_provider_id: NonEmptyStr = "github-fleet-converge-dispatch-oidc"
+
+data branch_dispatch_attribute_mapping: Map<String, String> = {
+  "google.subject": "assertion.sub",
+  "attribute.repository_id": "assertion.repository_id",
+  "attribute.run": "assertion.run_id + '-' + assertion.run_attempt"
+}
+
+// THE REPOSITORY AND THE EVENT, AND NOT THE REF: the ref is the point of this pool. The repository
+// pins are the main-only federation's own (one authority for the repository's numeric identity).
+fn branch_dispatch_claim_pins() -> List<OidcClaimPin> {
+  concat(
+    filter(fleet_converge_workflow_claim_pins(), p => (p.claim as String) == "repository_id" || (p.claim as String) == "repository_owner_id"),
+    [oidc_equals(claim: "event_name", value: workflow_dispatch_event_name)],
+  )
+}
+
+fn branch_dispatch_attribute_condition() -> String {
+  claim_pins_attribute_condition(pins: branch_dispatch_claim_pins())
+}
+
+fn branch_dispatch_provider() -> WifProvider {
+  WifProvider {
+    name: branch_dispatch_wif_provider_id,
+    pool: branch_dispatch_wif_pool_id,
+    issuer_uri: github_wif_issuer_uri,
+    attribute_mapping: Present { value: branch_dispatch_attribute_mapping },
+    attribute_condition: Present { value: branch_dispatch_attribute_condition() },
+  }
+}
+
+fn branch_dispatch_provider_resource() -> String {
+  wif_provider_resource(project_number: fleet_secrets_project_number, provider: branch_dispatch_provider())
+}
+
+// THE ONE RUN ATTEMPT A GRANT NAMES. GitHub keeps run_id across a re-run and increments run_attempt
+// (both are claims of its OIDC token), so the provider maps their join and a grant names the join: a
+// re-run of an approved run is a new subject and needs its own approval.
+fn branch_run_key(run_id: Int, run_attempt: Int) -> String {
+  join([to_string(run_id), "-", to_string(run_attempt)], "")
+}
+
+fn branch_run_principal_set(run_id: Int, run_attempt: Int) -> String {
+  join([
+    "principalSet://iam.googleapis.com/",
+    wif_pool_resource(project_number: fleet_secrets_project_number, pool_id: branch_dispatch_wif_pool_id as String),
+    "/attribute.run/", branch_run_key(run_id: run_id, run_attempt: run_attempt),
+  ], "")
+}
+
+// THE CELL A GRANT WRITES on a run-scoped account: that run attempt may act as the account until the
+// instant the approval named. The condition is IAM's own, so expiry takes effect with no cleanup;
+// the title prefix marks the cells gunbc.auth.branch_run_grant owns, which is what lets each grant
+// remove the lapsed ones and leave every other binding alone.
+data branch_run_grant_condition_title_prefix: String = "gunbc-branch-run-"
+
+data branch_run_expiry_expression_prefix: String = "request.time < timestamp('"
+
+data branch_run_expiry_expression_suffix: String = "')"
+
+fn branch_run_impersonation_cell(run_id: Int, run_attempt: Int, expires_at: Timestamp) -> GcpIamBindingCell {
+  GcpIamBindingCell {
+    role: role_iam_workload_identity_user,
+    member: branch_run_principal_set(run_id: run_id, run_attempt: run_attempt),
+    condition: Present { value: IamCondition {
+      title: concat(branch_run_grant_condition_title_prefix, branch_run_key(run_id: run_id, run_attempt: run_attempt)),
+      description: Present { value: "One approved fleet-converge branch run attempt; granted by gunbc.auth.branch_run_grant after operator approval." },
+      expression: join([branch_run_expiry_expression_prefix, expires_at as String, branch_run_expiry_expression_suffix], ""),
+    } },
+  }
+}
+
+// THE ONE NAME THE GRANT RUN IS DISPATCHED WITH: the run and its attempt, joined as branch_run_key
+// joins them, carried in the existing transaction_nonce input (GitHub admits at most 25 dispatch
+// inputs, so the grant adds none). The broker reads both halves from GitHub's workflow_run event
+// (gunbc.auth.branch_run_grant_broker), never from the branch's own run; the grant then reads the
+// run's mode from GitHub and the account from run_scoped_modes below.
+data branch_run_key_variable: NonEmptyStr = "BRANCH_RUN_KEY"
+
+// WHICH FLEET-CONVERGE MODE NEEDS WHICH RUN-SCOPED ACCOUNT. The mode is read from the run's title,
+// which the branch's own workflow file renders, so it is the branch's claim; this table is main's, so
+// a branch can only ever reach an account a mode here maps to, and the operator reads both in the
+// request.
+type RunScopedMode {
+  mode: NonEmptyStr
+  account_id: NonEmptyStr
+}
+
+fn run_scoped_modes() -> List<RunScopedMode> {
+  [RunScopedMode { mode: "hetzner_cloud_server_read", account_id: hetzner_cloud_control_service_account_id }]
+}
+
+fn run_scoped_mode_named(mode: String) -> RunScopedMode? {
+  filter(run_scoped_modes(), m => (m.mode as String) == mode).first()
+}
+
+// THE KEY BACK INTO ITS RUN AND ATTEMPT: exactly two decimal halves, or nothing.
+type BranchRunKey {
+  run_id: Int
+  run_attempt: Int
+}
+
+fn parse_branch_run_key(key: String) -> BranchRunKey? {
+  let parts = key.split(delimiter: "-")
+  if parts.length() != 2 { none } else {
+    match parse_int(s: match parts.first() { Present { value: h } => h  Absent => "" }) {
+      Absent => none
+      Present { value: id } => match parse_int(s: match parts.last() { Present { value: t } => t  Absent => "" }) {
+        Absent => none
+        Present { value: attempt } => if id > 0 && attempt > 0 { Present { value: BranchRunKey { run_id: id, run_attempt: attempt } } } else { none }
+      }
+    }
+  }
+}
+
+// THE RUN'S MODE AS ITS TITLE CARRIES IT: fleet-converge's run-name renders
+// "fleet-converge <mode> <host> nonce=<nonce>", so the mode is the second word.
+fn mode_of_run_title(title: String) -> String {
+  match title.split(delimiter: " ").skip(n: 1).first() { Present { value: w } => w  Absent => "" }
+}
+
+// ── the run-scoped accounts ──────────────────────────────────────────────────────────────────
+
+data hetzner_cloud_control_service_account_id: NonEmptyStr = "hetzner-cloud-control"
+
+data hetzner_cloud_control_service_account: ServiceAccountEmail = "hetzner-cloud-control@gunbai-secrets.iam.gserviceaccount.com"
+
+// THE HETZNER CLOUD CONTROLLER'S ACCOUNT: it reads the project token and nothing else.
+fn hetzner_cloud_control_federation() -> DedicatedFederation {
+  DedicatedFederation {
+    label: "hetzner cloud control (approved branch runs)",
+    pool_id: branch_dispatch_wif_pool_id,
+    pool_display_name: "Fleet converge (approved branch runs)",
+    provider_id: branch_dispatch_wif_provider_id,
+    attribute_mapping: branch_dispatch_attribute_mapping,
+    attribute_condition: branch_dispatch_attribute_condition(),
+    impersonation: RunScopedImpersonation,
+    service_account: hetzner_cloud_control_service_account,
+    service_account_id: hetzner_cloud_control_service_account_id,
+    service_account_display_name: "Hetzner Cloud control (WIF-only, run-scoped, no keys)",
+    service_account_member: federated_service_account_member(email: hetzner_cloud_control_service_account),
+    secret_grants: hetzner_cloud_api_grants(),
+  }
+}
diff --git a/dag/gunbc/auth/branch_run_grant.dag b/dag/gunbc/auth/branch_run_grant.dag
new file mode 100644
index 00000000000..94ae976810b
--- /dev/null
+++ b/dag/gunbc/auth/branch_run_grant.dag
@@ -0,0 +1,392 @@
+module gunbc.auth.branch_run_grant
+
+import std.types { Bool, Int, List, NonEmptyStr, Secret, String, Timestamp, CommitSha }
+import std.optional { Present, Absent }
+import std.measure { Second, second, second_count }
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+import std.content_hash { Sha256Digest, sha256_hex_digest, as_content_hash_cryptographic }
+import std.scoped_authorization { AttemptIdentity, AuthorizationScope, AuthorizedAction, AuthorizationRequest }
+import std.effect_grant { Write, NamespacePosition, ServiceOpTree }
+import std.bytes { bytes_octets, utf8_encode_bytes }
+import extdeps.crypto.sha2 { sha256_hex }
+import extdeps.cloud.gcp.gcp { ServiceAccountEmail }
+import extdeps.cloud.gcp.iam {
+  GcpIamBindingCell, GcpPolicy, GcpIamOwnedCellUniverse, gcp_cell_in, gcp_policy_cells, reconcile_gcp_policy,
+  GcpPolicyRepresentationLossy, GcpPolicyAlreadyConverged, GcpPolicyDeltaRequired,
+}
+import extdeps.time.rfc3339 { Rfc3339Timestamp, rfc3339_compare, Rfc3339Precedes, Rfc3339Follows, Rfc3339Simultaneous, Rfc3339OrderUndecidable }
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.github.actions_environment { github_output_variable_name }
+import extdeps.github.workflow_runs { WorkflowRun, Completed }
+import extdeps.github.workflow_runs
+import extdeps.transports.rest { RestAnswered, RestRefused }
+import gunbc.repository { gunbc_repository }
+import gunbc.generated_artifact { artifact_path, FleetConvergeYamlArtifact }
+import gunbc.actions_run_binding { actions_variable_trimmed }
+import gunbc.auth.github_gcp_federation { fleet_secrets_project_id }
+import gunbc.auth.oidc_claim_pins { workflow_dispatch_event_name }
+import gunbc.auth.heal_publisher_provision { DedicatedFederation, rest_refusal_text }
+import gunbc.auth.branch_dispatch_federation {
+  branch_run_impersonation_cell, hetzner_cloud_control_federation, branch_run_key_variable, parse_branch_run_key,
+  branch_run_grant_condition_title_prefix, branch_run_expiry_expression_prefix, branch_run_expiry_expression_suffix,
+  branch_run_key, mode_of_run_title, run_scoped_mode_named,
+}
+import gunbc.auth.gcp_iam_converge {
+  PolicyReading, PolicyObserved, PolicyResourceAbsent, PolicyUnreadable, ServiceAccountPolicy, PolicyDelta, PolicyDeltaRefused,
+  read_account_policy, policy_subject_reading, policy_subject_write, PolicyWritten, PolicyWriteRefused, cell_preimage,
+}
+import gunbc.auth.gcp_iam_converge_run { observe_token, iam_converge_token_env }
+import gunbc.auth.approval_run_identity { run_attempt }
+import gunbc.auth.approved_gcp_access { approved_gcp_access_for_request, ApprovedGcpAccessReady, ApprovedGcpAccessRefused }
+import gunbc.auth.approval_gate {
+  approval_refusal_text, GateAdmitted, GateRefused, approval_gate_from_poll,
+  approval_instant_now, approval_expires_at, approval_poll_ticks, PollObservedAt, PollBudgetExhausted, PollClockUnreadable,
+  approval_file_stored_request, ApprovalFiled, ApprovalFilingRefused,
+}
+import gunbc.auth.approval_request_client { stored_request_from_authorization }
+
+// ── ONE APPROVED BRANCH RUN MAY ACT AS ONE RUN-SCOPED ACCOUNT ──────────────────────────────────
+// The other half of gunbc.auth.branch_dispatch_federation. A fleet-converge run dispatched from any
+// branch dispatches this mode at main naming its own run id and the account it needs; this job --
+// reviewed code, in the gcp-iam-converge job, which alone may become iam-converge -- reads that run
+// from GitHub, files ONE request saying exactly who is asking for what, and on the operator's tap
+// writes one IAM cell: that run attempt's principal set may impersonate that account until the run's
+// own start time plus the grant window. The run and its attempt arrive from the main-only broker
+// (gunbc.auth.branch_run_grant_broker), which read them from GitHub's workflow_run event; the branch's
+// code supplies neither. Its mode, branch, commit, dispatcher and start time are read here from
+// GitHub, and the account is main's mapping of that mode (run_scoped_modes).
+//
+// THE EXPIRY IS DERIVED FROM THE RUN, NOT FROM THE CLOCK, so the request step and the apply step
+// derive the same cell and the same digest (the apply re-derives and re-admits, as
+// gunbc.auth.gcp_iam_converge_run does): an expiry read off the clock at each step would make the
+// approved request unreproducible.
+data branch_run_grant_window: Second = second(count: 3600)
+
+// THE ACCOUNTS A BRANCH RUN MAY ASK FOR, by account id. A capability that needs branch iteration is
+// added here with its own account (gunbc.auth.branch_dispatch_federation), never by widening one.
+fn run_scoped_federations() -> List<DedicatedFederation> {
+  [hetzner_cloud_control_federation()]
+}
+
+fn run_scoped_federation_named(account_id: String) -> DedicatedFederation? {
+  filter(run_scoped_federations(), f => (f.service_account_id as String) == account_id).first()
+}
+
+// ── the branch run, as GitHub records it ─────────────────────────────────────────────────────
+
+type BranchRunFacts {
+  run_id: Int
+  run_attempt: Int
+  mode: String
+  branch: String
+  head_sha: CommitSha
+  dispatched_by: String
+  created_at: Timestamp
+}
+
+type BranchRunReading
+  = BranchRunAdmitted { facts: BranchRunFacts }
+  | BranchRunRefused { reason: NonEmptyStr }
+
+// THE RUN MUST BE A LIVE DISPATCH OF THE FLEET-CONVERGE WORKFLOW, AT THE ATTEMPT ASKED ABOUT: another
+// workflow, another event, a finished run, or a run GitHub has since re-run is refused, so an approval
+// can only ever reach the one attempt of the file this grant is for.
+fn judge_branch_run(run_id: Int, run_attempt: Int, run: WorkflowRun) -> BranchRunReading {
+  let path = match run.path { Present { value: p } => p  Absent => "" }
+  if run.id != run_id {
+    BranchRunRefused { reason: concat("GitHub answered about another run: ", to_string(run.id)) as NonEmptyStr }
+  } else if run.run_attempt != run_attempt {
+    BranchRunRefused { reason: join(["the run is at attempt ", to_string(run.run_attempt), ", not the attempt asked about (", to_string(run_attempt), ")"], "") as NonEmptyStr }
+  } else if path != artifact_path(a: FleetConvergeYamlArtifact) {
+    BranchRunRefused { reason: concat("the run is not a fleet-converge run: ", path) as NonEmptyStr }
+  } else if run.event != workflow_dispatch_event_name {
+    BranchRunRefused { reason: concat("the run was not dispatched: ", run.event) as NonEmptyStr }
+  } else if (run.status == Completed) {
+    BranchRunRefused { reason: "the run has already completed" as NonEmptyStr }
+  } else {
+    BranchRunAdmitted { facts: BranchRunFacts {
+      run_id: run_id,
+      run_attempt: run_attempt,
+      mode: mode_of_run_title(title: match run.display_title { Present { value: t } => t  Absent => "" }),
+      branch: match run.head_branch { Present { value: b } => b  Absent => "(no branch)" },
+      head_sha: run.head_sha,
+      dispatched_by: match run.triggering_actor { Present { value: u } => u.login as String  Absent => "(unknown)" },
+      created_at: run.created_at,
+    } }
+  }
+}
+
+fn read_branch_run(run_id: Int, run_attempt: Int) -> BranchRunReading {
+  match github.WorkflowRuns.GetRun(auth_token: "", owner: gunbc_repository.owner, repo: gunbc_repository.name, run_id: to_string(run_id)) {
+    RestRefused { refusal } => BranchRunRefused { reason: concat("the run could not be read: ", rest_refusal_text(o: refusal)) as NonEmptyStr }
+    RestAnswered { answer: got } => judge_branch_run(run_id: run_id, run_attempt: run_attempt, run: got.run)
+  }
+}
+
+// ── the grant, as one approvable subject ─────────────────────────────────────────────────────
+
+type BranchRunGrant {
+  run: BranchRunFacts
+  account: ServiceAccountEmail
+  cell: GcpIamBindingCell
+  pruned: List<GcpIamBindingCell>
+  observed_etag: String
+}
+
+type BranchRunGrantPlan
+  = BranchRunGrantPlanned { grant: BranchRunGrant }
+  | BranchRunGrantHeld { run: BranchRunFacts }
+  | BranchRunGrantRefused { reason: NonEmptyStr }
+
+fn branch_run_expires_at(run: BranchRunFacts) -> Timestamp {
+  approval_expires_at(issued: run.created_at, window: branch_run_grant_window)
+}
+
+// ── the cells a grant owns ──────────────────────────────────────────────────────────────────
+
+fn is_branch_run_cell(c: GcpIamBindingCell) -> Bool {
+  match c.condition { Present { value: k } => k.title.starts_with(branch_run_grant_condition_title_prefix)  Absent => false }
+}
+
+// THE INSTANT AN OWNED CELL LAPSES, read back out of the expression this module wrote. A cell under the
+// prefix whose expression is not that shape is not one this module can judge, so it refuses the plan
+// rather than keep or delete a cell it does not understand.
+fn branch_run_cell_expiry(c: GcpIamBindingCell) -> Rfc3339Timestamp? {
+  match c.condition {
+    Absent => none
+    Present { value: k } =>
+      if k.expression.starts_with(branch_run_expiry_expression_prefix) && k.expression.ends_with(branch_run_expiry_expression_suffix) {
+        let inner = k.expression.substring(start: branch_run_expiry_expression_prefix.length(), end: k.expression.length() - branch_run_expiry_expression_suffix.length())
+        if inner == "" { none } else { Present { value: inner as Rfc3339Timestamp } }
+      } else { none }
+  }
+}
+
+type CellStanding
+  = CellLapsed
+  | CellLive
+  | CellUnjudgeable { reason: String }
+
+// LAPSED AS OF THE NEW RUN'S START, not as of the clock: both steps derive the same set, so the
+// approved request is reproducible at apply, and a cell lapsing between the two only waits a grant.
+fn branch_run_cell_standing(c: GcpIamBindingCell, as_of: Timestamp) -> CellStanding {
+  match branch_run_cell_expiry(c: c) {
+    Absent => CellUnjudgeable { reason: concat("an owned cell's condition does not carry an expiry this module wrote: ", c.member) }
+    Present { value: x } => match rfc3339_compare(left: x, right: as_of as Rfc3339Timestamp) {
+      Rfc3339Precedes => CellLapsed
+      Rfc3339Simultaneous => CellLapsed
+      Rfc3339Follows => CellLive
+      Rfc3339OrderUndecidable { cause: why } => CellUnjudgeable { reason: concat("an owned cell's expiry is not comparable: ", why as String) }
+    }
+  }
+}
+
+// THE CELL AGAINST THE ACCOUNT'S POLICY AS READ. The universe this plan owns is the cells under the
+// branch-run prefix: lapsed ones are removed, live ones (another attempt still inside its window) are
+// kept, and every binding outside the prefix is preserved untouched. The run's cell already present
+// holds (a re-dispatch for an attempt already granted asks nothing); any other reading refuses.
+fn plan_branch_run_grant(f: DedicatedFederation, run: BranchRunFacts, expires_at: Timestamp, reading: PolicyReading) -> BranchRunGrantPlan {
+  let cell = branch_run_impersonation_cell(run_id: run.run_id, run_attempt: run.run_attempt, expires_at: expires_at)
+  match reading {
+    PolicyUnreadable { cause: c } => BranchRunGrantRefused { reason: concat("the account's policy is unreadable: ", c) as NonEmptyStr }
+    PolicyResourceAbsent => BranchRunGrantRefused { reason: "the run-scoped account does not exist; run the gcp_iam_converge mode first" as NonEmptyStr }
+    PolicyObserved { policy: p } => plan_against_policy(f: f, run: run, cell: cell, p: p)
+  }
+}
+
+fn plan_against_policy(f: DedicatedFederation, run: BranchRunFacts, cell: GcpIamBindingCell, p: GcpPolicy) -> BranchRunGrantPlan {
+  let owned = filter(gcp_policy_cells(p: p), c => is_branch_run_cell(c: c))
+  let unjudgeable = filter(map(owned, c => branch_run_cell_standing(c: c, as_of: run.created_at)), st => match st { CellUnjudgeable { reason: _ } => true  CellLapsed => false  CellLive => false })
+  if gcp_cell_in(c: cell, xs: owned) {
+    BranchRunGrantHeld { run: run }
+  } else if unjudgeable.length() > 0 {
+    BranchRunGrantRefused { reason: join(map(unjudgeable, st => match st { CellUnjudgeable { reason: r } => r  CellLapsed => ""  CellLive => "" }), "; ") as NonEmptyStr }
+  } else {
+    let live = filter(owned, c => match branch_run_cell_standing(c: c, as_of: run.created_at) { CellLive => true  CellLapsed => false  CellUnjudgeable { reason: _ } => false })
+    match reconcile_gcp_policy(observed: p, desired_owned: concat(live, [cell]), owned_universe: GcpIamOwnedCellUniverse { cells: concat(owned, [cell]) }) {
+      GcpPolicyRepresentationLossy { conditional_roles: _ } => BranchRunGrantRefused { reason: "the policy was read at a representation that mangles conditional bindings" as NonEmptyStr }
+      GcpPolicyAlreadyConverged { policy: _ } => BranchRunGrantHeld { run: run }
+      GcpPolicyDeltaRequired { policy: _, added: _, removed: r, preserved: _ } =>
+        BranchRunGrantPlanned { grant: BranchRunGrant { run: run, account: f.service_account, cell: cell, pruned: r, observed_etag: p.etag } }
+    }
+  }
+}
+
+// THE WRITE THE APPROVAL ADMITS, re-derived from a fresh read at the approved etag: add the cell,
+// remove exactly the approved lapsed cells, preserve everything else.
+fn approved_grant_policy(g: BranchRunGrant, reading: PolicyReading) -> GcpPolicy? {
+  match reading {
+    PolicyObserved { policy: p } =>
+      if p.etag != g.observed_etag { none } else {
+        let owned = filter(gcp_policy_cells(p: p), c => is_branch_run_cell(c: c))
+        let kept = filter(owned, c => !gcp_cell_in(c: c, xs: g.pruned))
+        match reconcile_gcp_policy(observed: p, desired_owned: concat(kept, [g.cell]), owned_universe: GcpIamOwnedCellUniverse { cells: concat(owned, [g.cell]) }) {
+          GcpPolicyDeltaRequired { policy: next, added: _, removed: _, preserved: _ } => Present { value: next }
+          GcpPolicyAlreadyConverged { policy: _ } => none
+          GcpPolicyRepresentationLossy { conditional_roles: _ } => none
+        }
+      }
+    PolicyResourceAbsent => none
+    PolicyUnreadable { cause: _ } => none
+  }
+}
+
+fn branch_run_grant_preimage(g: BranchRunGrant) -> String {
+  join([
+    "run=", branch_run_key(run_id: g.run.run_id, run_attempt: g.run.run_attempt), "\nbranch=", g.run.branch, "\nsha=", g.run.head_sha as String,
+    "\nmode=", g.run.mode, "\nby=", g.run.dispatched_by, "\naccount=", g.account as String, "\netag=", g.observed_etag,
+    "\ncell=", cell_preimage(c: g.cell),
+    "\npruned=", join(map(g.pruned, c => cell_preimage(c: c)), "\n"),
+  ], "")
+}
+
+data branch_run_grant_escalation_prefix: NonEmptyStr = "branch-run-grant-"
+
+data branch_run_grant_scope: AuthorizationScope = AuthorizationScope {
+  verb: Write,
+  resource: NamespacePosition { tree: ServiceOpTree { service: "iam.googleapis.com" }, path: ["projects", fleet_secrets_project_id as String] },
+  action: "gunbc.branch-run-grant.apply" as AuthorizedAction,
+}
+
+// THE PURPOSE IS WHAT THE OPERATOR READS: who dispatched which commit of which branch in which mode,
+// and what the attempt may do if approved. The mode is the branch's claim (its workflow file renders
+// the title); what bounds the approval is the account main maps it to and what that account holds.
+fn branch_run_grant_purpose(g: BranchRunGrant) -> NonEmptyStr {
+  join([
+    "Branch run ", to_string(g.run.run_id), " attempt ", to_string(g.run.run_attempt), " of fleet-converge (mode ", g.run.mode, ") on ", g.run.branch,
+    " at ", g.run.head_sha as String, " (dispatched by ", g.run.dispatched_by, ") asks to act as ",
+    g.account as String, " for ", to_string(second_count(s: branch_run_grant_window)), "s from its start.",
+    " Approving lets that attempt, and only that attempt, read what that account holds; it runs the branch's code.",
+  ], "") as NonEmptyStr
+}
+
+fn branch_run_grant_request(g: BranchRunGrant, attempt: AttemptIdentity) -> AuthorizationRequest<BranchRunGrant>? {
+  match sha256_hex_digest(hex: sha256_hex(message: bytes_octets(b: utf8_encode_bytes(s: branch_run_grant_preimage(g: g))))) {
+    Absent => none
+    Present { value: d } => Present { value: AuthorizationRequest {
+      escalation_id: join([branch_run_grant_escalation_prefix as String, d.hex as String, "-", attempt as String], "") as NonEmptyStr,
+      scopes: [branch_run_grant_scope],
+      subject: g,
+      purpose: branch_run_grant_purpose(g: g),
+      attempt: attempt,
+      intent_hash: as_content_hash_cryptographic(digest: d),
+      destructive: false,
+    } }
+  }
+}
+
+// ── the two entries (the gcp-iam-converge job's branch_run_grant mode) ───────────────────────
+
+data branch_run_grant_approved_output: String = "approved"
+
+data branch_run_grant_file_window: Second = second(count: 1800)
+
+data branch_run_grant_poll_cadence: Second = second(count: 15)
+
+type BranchRunGrantStanding
+  = BranchRunGrantRequestable { request: AuthorizationRequest<BranchRunGrant> }
+  | BranchRunGrantAlreadyHeld
+  | BranchRunGrantUnplannable { reason: NonEmptyStr }
+
+// THE SAME DERIVATION FOR BOTH STEPS: the inputs, the run as GitHub reads it, the account's policy as
+// iam-observe reads it, and the request over them for this run attempt.
+fn derive_branch_run_grant(observe: Secret, attempt: AttemptIdentity) -> BranchRunGrantStanding {
+  match parse_branch_run_key(key: actions_variable_trimmed(name: branch_run_key_variable)) {
+    Absent => BranchRunGrantUnplannable { reason: "BRANCH_RUN_KEY is not <run id>-<run attempt>" as NonEmptyStr }
+    Present { value: k } => match read_branch_run(run_id: k.run_id, run_attempt: k.run_attempt) {
+      BranchRunRefused { reason: r } => BranchRunGrantUnplannable { reason: r }
+      BranchRunAdmitted { facts: run } => match account_for_mode(mode: run.mode) {
+        Absent => BranchRunGrantUnplannable { reason: concat("the run's mode needs no run-scoped account: ", run.mode) as NonEmptyStr }
+        Present { value: f } => match plan_branch_run_grant(f: f, run: run, expires_at: branch_run_expires_at(run: run), reading: read_account_policy(f: f, token: observe)) {
+          BranchRunGrantRefused { reason: r } => BranchRunGrantUnplannable { reason: r }
+          BranchRunGrantHeld { run: _ } => BranchRunGrantAlreadyHeld
+          BranchRunGrantPlanned { grant: g } => match branch_run_grant_request(g: g, attempt: attempt) {
+            Absent => BranchRunGrantUnplannable { reason: "the grant's SHA-256 did not admit as a digest" as NonEmptyStr }
+            Present { value: q } => BranchRunGrantRequestable { request: q }
+          }
+        }
+      }
+    }
+  }
+}
+
+fn account_for_mode(mode: String) -> DedicatedFederation? {
+  match run_scoped_mode_named(mode: mode) {
+    Absent => none
+    Present { value: m } => run_scoped_federation_named(account_id: m.account_id as String)
+  }
+}
+
+fn mark_branch_run_grant_approved() -> ProcessExit {
+  let path = actions_variable_trimmed(name: github_output_variable_name as NonEmptyStr)
+  if path == "" { exit_failure(reason: "branch run grant: approved, but GITHUB_OUTPUT is unset; nothing granted") }
+  else {
+    let w = Filesystem.Write(path: path, content: join([branch_run_grant_approved_output, "=true\n"], ""))
+    if w.success { ExitSuccess } else { exit_failure(reason: concat("branch run grant: could not write the approval output; nothing granted: ", w.error)) }
+  }
+}
+
+fn branch_run_grant_request_wet() -> ProcessExit {
+  match run_attempt() {
+    Absent => exit_failure(reason: "branch run grant: GITHUB_RUN_ID is unset; this entry runs only as the fleet-converge gcp-iam job")
+    Present { value: attempt } => match observe_token() {
+      Absent => exit_failure(reason: "branch run grant: no workload identity token for iam-observe")
+      Present { value: observe } => match derive_branch_run_grant(observe: observe, attempt: attempt) {
+        BranchRunGrantUnplannable { reason: r } => exit_failure(reason: concat("branch run grant: refused, nothing requested: ", r as String))
+        BranchRunGrantAlreadyHeld => ExitSuccess
+        BranchRunGrantRequestable { request: q } => match approval_instant_now() {
+          Absent => exit_failure(reason: "branch run grant: clock unreadable; the request cannot be filed")
+          Present { value: issued } => {
+            let expires = approval_expires_at(issued: issued, window: branch_run_grant_file_window)
+            match approval_file_stored_request(stored: stored_request_from_authorization(request: q, issued_at: issued, expires_at: expires), body_file_name: "branch-run-grant-submit.json", submit_timeout: second(count: 30)) {
+              ApprovalFilingRefused { reason: r } => exit_failure(reason: concat("branch run grant: filing refused: ", r))
+              ApprovalFiled => match approval_poll_ticks(remaining: second_count(s: branch_run_grant_file_window) / second_count(s: branch_run_grant_poll_cadence), cadence: branch_run_grant_poll_cadence, escalation_id: q.escalation_id, expires_at: expires) {
+                PollClockUnreadable => exit_failure(reason: "branch run grant: clock unreadable while waiting for the decision")
+                PollBudgetExhausted { escalation_id: _, observed_at: _ } => exit_failure(reason: "branch run grant: no decision within the window; nothing granted")
+                PollObservedAt { standing: s, observed_at: at } => match approval_gate_from_poll(poll: s, request: q, observed_at: at) {
+                  GateRefused { cause: c } => exit_failure(reason: concat("branch run grant: not admitted, nothing granted: ", approval_refusal_text(cause: c)))
+                  GateAdmitted { authorization: _ } => mark_branch_run_grant_approved()
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+// RE-DERIVES THE REQUEST, RE-ADMITS THE APPROVAL, WRITES EXACTLY THE APPROVED POLICY AT THE APPROVED
+// ETAG as iam-converge, then reads the policy back as iam-observe: the cell present, the pruned absent.
+fn branch_run_grant_apply_wet() -> ProcessExit {
+  match run_attempt() {
+    Absent => exit_failure(reason: "branch run grant: GITHUB_RUN_ID is unset")
+    Present { value: attempt } => match observe_token() {
+      Absent => exit_failure(reason: "branch run grant: no workload identity token for iam-observe")
+      Present { value: observe } => match derive_branch_run_grant(observe: observe, attempt: attempt) {
+        BranchRunGrantUnplannable { reason: r } => exit_failure(reason: concat("branch run grant: refused at apply, nothing granted: ", r as String))
+        BranchRunGrantAlreadyHeld => exit_failure(reason: "branch run grant: the cell appeared between the tap and the apply; the iam-converge token is unused")
+        BranchRunGrantRequestable { request: q } => match approved_gcp_access_for_request(request: q, token_variable: iam_converge_token_env) {
+          ApprovedGcpAccessRefused { reason } => exit_failure(reason: concat("branch run grant: ", reason))
+          ApprovedGcpAccessReady { authorization: _, token } => {
+            let g = q.subject
+            let subject = ServiceAccountPolicy { email: g.account }
+            match approved_grant_policy(g: g, reading: policy_subject_reading(s: subject, token: token)) {
+              Absent => exit_failure(reason: "branch run grant: the policy moved since the approval or no longer admits the approved write; nothing granted")
+              Present { value: next } => match policy_subject_write(s: subject, policy: next, token: token) {
+                PolicyWriteRefused { cause: c } => exit_failure(reason: concat("branch run grant: the fenced write was refused: ", c))
+                PolicyWritten { returned: _ } => match policy_subject_reading(s: subject, token: observe) {
+                  PolicyObserved { policy: p } =>
+                    if gcp_cell_in(c: g.cell, xs: gcp_policy_cells(p: p)) && !any(g.pruned, c => gcp_cell_in(c: c, xs: gcp_policy_cells(p: p))) { ExitSuccess }
+                    else { exit_failure(reason: "branch run grant: the write returned, but the readback does not hold the cell, or still holds a lapsed one") }
+                  PolicyResourceAbsent => exit_failure(reason: "branch run grant: the account is absent on readback")
+                  PolicyUnreadable { cause: c } => exit_failure(reason: concat("branch run grant: readback unreadable: ", c))
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/dag/gunbc/auth/branch_run_grant_await.dag b/dag/gunbc/auth/branch_run_grant_await.dag
new file mode 100644
index 00000000000..08601f93704
--- /dev/null
+++ b/dag/gunbc/auth/branch_run_grant_await.dag
@@ -0,0 +1,108 @@
+module gunbc.auth.branch_run_grant_await
+
+import std.types { Bool, Int, List, NonEmptyStr, String, Timestamp }
+import std.optional { Present, Absent }
+import std.measure { Second, second, second_count }
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+import extdeps.tools.sleep { sleep_delay_seconds_second_carrier_projection }
+import extdeps.github.actions_environment { github_run_id_variable_name, github_run_attempt_variable_name }
+import extdeps.github.workflow_runs
+import extdeps.github.workflow_runs { WorkflowRun, Completed, Success }
+import extdeps.transports.rest { RestAnswered, RestRefused }
+import gunbc.repository { gunbc_repository }
+import gunbc.generated_artifact { artifact_name, FleetConvergeYamlArtifact }
+import gunbc.actions_run_binding { actions_variable_trimmed }
+import gunbc.auth.heal_publisher_provision { rest_refusal_text }
+import gunbc.auth.oidc_claim_pins { workflow_dispatch_event_name }
+import gunbc.auth.branch_dispatch_federation { branch_run_key }
+import gunbc.auth.branch_run_grant_broker { branch_run_grant_dispatch_ref }
+
+// ── THE REQUESTING RUN'S SIDE OF A RUN-SCOPED GRANT ─────────────────────────────────────────────
+// A fleet-converge run whose mode needs a run-scoped account waits here, BEFORE its auth step, for
+// the grant run main's broker dispatched for it (gunbc.auth.branch_run_grant_broker). It asks for
+// nothing and holds no credential that could: its token reads runs and nothing else. It finds the
+// grant run by the run key in that run's title and waits for it to finish. A refused, denied or
+// expired grant fails this step and the auth step never runs; a forged "grant" -- any run whose title
+// merely matches -- grants nothing either, because the auth step is refused by IAM unless the cell
+// exists. This step only decides when to try.
+
+data branch_run_grant_wait: Second = second(count: 2400)
+
+data branch_run_grant_poll: Second = second(count: 15)
+
+// IAM POLICY CHANGES PROPAGATE, THEY DO NOT LAND ATOMICALLY: Google documents that a changed
+// allow policy usually takes effect within two minutes and can take up to seven
+// (cloud.google.com/iam/docs/access-change-propagation). The auth step after this one is the
+// loud failure if propagation outruns this wait; it is never retried silently.
+data branch_run_grant_propagation: Second = second(count: 120)
+
+type GrantRunWait
+  = GrantRunSucceeded
+  | GrantRunFailed { detail: String }
+  | GrantRunTimedOut
+
+// THE GRANT RUN FOR THIS KEY: a dispatch of fleet-converge on main whose title ends with the key.
+fn is_grant_run_for(run: WorkflowRun, key: String) -> Bool {
+  let title = match run.display_title { Present { value: t } => t  Absent => "" }
+  run.event == workflow_dispatch_event_name
+    && match run.head_branch { Present { value: b } => b == branch_run_grant_dispatch_ref  Absent => false }
+    && title.ends_with(concat(" nonce=", key))
+    && title.contains(" branch_run_grant ")
+}
+
+fn grant_run_conclusion(run: WorkflowRun) -> GrantRunWait {
+  match run.conclusion {
+    Present { value: c } => if (c == Success) { GrantRunSucceeded } else { GrantRunFailed { detail: concat("the grant run did not succeed: ", run.html_url as String) } }
+    Absent => GrantRunFailed { detail: concat("the grant run completed with no conclusion: ", run.html_url as String) }
+  }
+}
+
+fn wait_on_runs(key: String, since: Timestamp, remaining: Int, runs: List<WorkflowRun>) -> GrantRunWait {
+  match filter(runs, r => is_grant_run_for(run: r, key: key)).first() {
+    Present { value: r } =>
+      if (r.status == Completed) { grant_run_conclusion(run: r) }
+      else { pace_and_retry(key: key, since: since, remaining: remaining) }
+    Absent => pace_and_retry(key: key, since: since, remaining: remaining)
+  }
+}
+
+fn pace_and_retry(key: String, since: Timestamp, remaining: Int) -> GrantRunWait {
+  let paced = sleep_delay_seconds_second_carrier_projection(duration: branch_run_grant_poll)
+  wait_for_grant_run(key: key, since: since, remaining: remaining - 1)
+}
+
+fn wait_for_grant_run(key: String, since: Timestamp, remaining: Int) -> GrantRunWait {
+  if remaining <= 0 {
+    GrantRunTimedOut
+  } else {
+    match github.WorkflowRuns.ListWorkflowRuns(auth_token: "", owner: gunbc_repository.owner, repo: gunbc_repository.name, workflow_name: artifact_name(a: FleetConvergeYamlArtifact), event: workflow_dispatch_event_name, created_range: concat(">=", since as String)) {
+      RestRefused { refusal } => GrantRunFailed { detail: concat("the grant runs could not be listed: ", rest_refusal_text(o: refusal)) }
+      RestAnswered { answer: got } => wait_on_runs(key: key, since: since, remaining: remaining, runs: got.result.workflow_runs)
+    }
+  }
+}
+
+// `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/auth/branch_run_grant_await.dag --function await_grant`
+fn await_grant() -> ProcessExit {
+  let me = actions_variable_trimmed(name: github_run_id_variable_name as NonEmptyStr)
+  match parse_int(s: me) {
+    Absent => exit_failure(reason: "branch run grant: GITHUB_RUN_ID is unset; this entry runs only in a fleet-converge job")
+    Present { value: run_id } => match parse_int(s: actions_variable_trimmed(name: github_run_attempt_variable_name as NonEmptyStr)) {
+      Absent => exit_failure(reason: "branch run grant: GITHUB_RUN_ATTEMPT is unset")
+      Present { value: attempt } => match github.WorkflowRuns.GetRun(auth_token: "", owner: gunbc_repository.owner, repo: gunbc_repository.name, run_id: me) {
+        RestRefused { refusal } => exit_failure(reason: concat("branch run grant: this run could not be read: ", rest_refusal_text(o: refusal)))
+        RestAnswered { answer: got } => {
+          let key = branch_run_key(run_id: run_id, run_attempt: attempt)
+          match wait_for_grant_run(key: key, since: got.run.created_at, remaining: second_count(s: branch_run_grant_wait) / second_count(s: branch_run_grant_poll)) {
+            GrantRunTimedOut => exit_failure(reason: concat("branch run grant: no grant run finished within the wait for ", key))
+            GrantRunFailed { detail: d } => exit_failure(reason: concat("branch run grant: refused or denied, nothing granted: ", d))
+            GrantRunSucceeded => {
+              let propagated = sleep_delay_seconds_second_carrier_projection(duration: branch_run_grant_propagation)
+              ExitSuccess
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/dag/gunbc/auth/branch_run_grant_broker.dag b/dag/gunbc/auth/branch_run_grant_broker.dag
new file mode 100644
index 00000000000..04a17e6f0fe
--- /dev/null
+++ b/dag/gunbc/auth/branch_run_grant_broker.dag
@@ -0,0 +1,66 @@
+module gunbc.auth.branch_run_grant_broker
+
+import std.types { Map, NonEmptyStr, String }
+import std.optional { Present, Absent }
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+import extdeps.github.workflows
+import extdeps.transports.rest { RestAnswered, RestRefused }
+import gunbc.repository { gunbc_repository }
+import gunbc.generated_artifact { artifact_name, FleetConvergeYamlArtifact }
+import gunbc.actions_run_binding { actions_variable_trimmed }
+import gunbc.auth.heal_publisher_provision { rest_refusal_text }
+import gunbc.auth.branch_dispatch_federation {
+  branch_run_key_variable, parse_branch_run_key, branch_run_key, mode_of_run_title, run_scoped_mode_named,
+}
+
+// ── THE REQUEST FOR A RUN-SCOPED GRANT, MADE BY MAIN ────────────────────────────────────────────
+// A fleet-converge run whose mode needs a run-scoped account (gunbc.auth.branch_dispatch_federation)
+// cannot ask for it itself: asking means dispatching a run, and a token that may dispatch runs may
+// dispatch any workflow of the repository, which branch code must not hold. So this broker asks on
+// its behalf. It is a job of its own workflow (gunbc.branch_run_grant_broker_workflow), triggered by
+// GitHub's workflow_run event when a fleet-converge run is requested; GitHub runs a workflow_run
+// workflow from the default branch only, so this code is main's whatever branch the run is on, and
+// the run id and attempt it forwards are the event's, not anything the branch's run reports.
+//
+// IT DISPATCHES AND DOES NOT WAIT. The grant run (gunbc.auth.branch_run_grant) re-reads the run from
+// GitHub, asks the operator, and writes or refuses; the requesting run finds that grant run by its
+// title and waits on it (gunbc.auth.branch_run_grant_await).
+
+data branch_run_grant_dispatch_ref: String = "main"
+
+data branch_run_grant_executor_host: String = "srv1"
+
+data branch_run_title_variable: NonEmptyStr = "BRANCH_RUN_TITLE"
+
+// THE GRANT RUN'S DISPATCH INPUTS: the mode, the executor that hosts the approval broker, and the run
+// key in the existing transaction_nonce input -- which also puts the key in the grant run's title,
+// where the requesting run finds it.
+fn branch_run_grant_inputs(key: String) -> Map<String, String> {
+  let inputs: Map<String, String> = {
+    "mode": "branch_run_grant",
+    "host": branch_run_grant_executor_host,
+    "transaction_nonce": key
+  }
+  inputs
+}
+
+// `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/auth/branch_run_grant_broker.dag --function broker`
+fn broker() -> ProcessExit {
+  let mode = mode_of_run_title(title: actions_variable_trimmed(name: branch_run_title_variable))
+  match parse_branch_run_key(key: actions_variable_trimmed(name: branch_run_key_variable)) {
+    Absent => exit_failure(reason: "branch run grant broker: BRANCH_RUN_KEY is not <run id>-<run attempt>; this entry runs only in the broker workflow")
+    Present { value: k } => match run_scoped_mode_named(mode: mode) {
+      Absent => ExitSuccess
+      Present { value: _ } => match github.Workflows.CreateDispatch(
+        owner: gunbc_repository.owner,
+        repo: gunbc_repository.name,
+        workflow_id: artifact_name(a: FleetConvergeYamlArtifact),
+        ref: branch_run_grant_dispatch_ref,
+        inputs: branch_run_grant_inputs(key: branch_run_key(run_id: k.run_id, run_attempt: k.run_attempt)),
+      ) {
+        RestRefused { refusal } => exit_failure(reason: concat("branch run grant broker: the grant run could not be dispatched: ", rest_refusal_text(o: refusal)))
+        RestAnswered { answer: _ } => ExitSuccess
+      }
+    }
+  }
+}
diff --git a/dag/gunbc/auth/fleet_convergence_federation.dag b/dag/gunbc/auth/fleet_convergence_federation.dag
index 4dc74044410..69c607ae275 100644
--- a/dag/gunbc/auth/fleet_convergence_federation.dag
+++ b/dag/gunbc/auth/fleet_convergence_federation.dag
@@ -5,17 +5,22 @@ import std.optional { Present }
 import extdeps.cloud.gcp.gcp { ServiceAccountEmail, WifProvider, wif_provider_resource, wif_pool_resource }
 import gunbc.auth.github_gcp_federation { fleet_secrets_project_number, github_wif_issuer_uri, federated_service_account_member }
 import gunbc.auth.oidc_claim_pins { OidcClaimPin, claim_pins_attribute_condition, claim_pins_admit, fleet_converge_workflow_claim_pins }
-import gunbc.auth.heal_publisher_provision { DedicatedFederation }
+import gunbc.auth.heal_publisher_provision { DedicatedFederation, StandingPoolImpersonation }
 import gunbc.gcp_estate_observation { fleet_cloud_convergence_sa_email }
 
-// ── fleet-cloud-convergence IS REACHABLE FROM THE FLEET-CONVERGE WORKFLOW AT MAIN, DISPATCHED, AND NOTHING ELSE ──
+// ── fleet-cloud-convergence IS REACHABLE FROM A FLEET-CONVERGE WORKFLOW_DISPATCH ON REVIEWED MAIN ──
 // The account holds secret access a pull request must never reach (the R2 write-token accessor among
 // it, gunbc.cloudflare.r2_mint_secret_access). Through the repository-wide github-oidc provider any
-// job in the repository -- a pull request's, the merge queue's, a branch dispatch, heal-publish,
-// witnesses -- could impersonate it. This pool's one provider pins the repository by numeric
-// identity, the fleet-converge workflow file at main, the main ref and a workflow_dispatch event
-// (the claim-pin shape of every dedicated fleet-converge federation, minus the job `environment`,
-// which the two consumer jobs below do not declare). Its principal set is this pool alone.
+// job in the repository -- a pull request's, the merge queue's, heal-publish, witnesses -- could
+// impersonate it. This pool's one provider pins the repository by numeric identity, the
+// fleet-converge workflow FILE at refs/heads/main, a dispatch on main, and a workflow_dispatch event
+// (the privileged claim-pin shape of every dedicated fleet-converge federation, minus the job
+// `environment`, which the two consumer jobs below do not declare). A pull_request event is refused.
+// A session-branch dispatch is refused. Operator 2026-10-10: this identity is not branch-dispatchable.
+// fleet_converge_development_workflow_claim_pins is the claim contract a future
+// fleet-development-convergence account may consume; no DedicatedFederation binds it in this tree
+// (witness-only). Approved one-run branch grants are gunbc.auth.branch_dispatch_federation, not this
+// account. Its principal set is this pool alone.
 //
 // PINNED CONSUMERS (the jobs of fleet-converge.yml that authenticate as this account): `fleet-converge`
 // and `rlm-launch-deployment-receipt`, both workflow_dispatch. They reach it through
@@ -62,11 +67,11 @@ fn fleet_convergence_federation() -> DedicatedFederation {
   DedicatedFederation {
     label: "fleet cloud convergence (fleet-converge dispatch at main only)",
     pool_id: fleet_convergence_wif_pool_id,
-    pool_display_name: "Fleet convergence (dispatch at main)",
+    pool_display_name: "Fleet convergence (main)",
     provider_id: fleet_convergence_wif_provider_id,
     attribute_mapping: fleet_convergence_attribute_mapping,
     attribute_condition: fleet_convergence_attribute_condition(),
-    principal_set: fleet_convergence_principal_set(),
+    impersonation: StandingPoolImpersonation { principal_set: fleet_convergence_principal_set() },
     service_account: fleet_cloud_convergence_sa_email,
     service_account_id: "fleet-cloud-convergence",
     service_account_display_name: "Fleet cloud convergence (WIF-only, no keys)",
diff --git a/dag/gunbc/auth/fleet_secret_accessor_roster.dag b/dag/gunbc/auth/fleet_secret_accessor_roster.dag
index dfd990157b0..1ae087ba61d 100644
--- a/dag/gunbc/auth/fleet_secret_accessor_roster.dag
+++ b/dag/gunbc/auth/fleet_secret_accessor_roster.dag
@@ -15,13 +15,16 @@ import gunbc.claude_code_credential { claude_code_oauth_harness_secret_ref }
 // so its consumers (the host convergence census, its witness) are not renamed by the move.
 import extdeps.cloud.gcp.secret_ref { SecretRef }
 import gunbc.spark.credential_workflow { spark_administrator_password_secret_ref }
-import gunbc.secret_provision { mtcollins1_bmc_gunbc_secret_ref }
+import gunbc.secret_provision { mtcollins1_bmc_gunbc_secret_ref, openrouter_free_tier_key_secret_ref }
 import gunbc.auth.approval_decision_store { approval_mac_key_secret_ref }
 import gunbc.auth.approval_request_submission { approval_submission_mac_key_secret_ref }
 import gunbc.auth.approval_store_receipt { approval_store_receipt_mac_key_secret_ref }
 import gunbc.auth.approval_ntfy_deployment { approval_ntfy_publisher_token_secret_ref }
 import gunbc.oracle_oci.api { oci_api_signing_key_secret_ref }
 import gunbc.auth.gcp_secret_access { SecretAccessGrant, secret_accessor_grant, secret_access_ensure_for }
+import extdeps.cloud.gcp.iam { role_secretmanager_secret_version_adder }
+import gunbc.codex_harness_credential { codex_auth_harness_secret_ref }
+import gunbc.cursor_harness_credential { cursor_api_key_harness_secret_ref }
 import gunbc.auth.access_token_source {
   AccessTokenSource, OperatorSuppliedToken, read_supplied_access_token, SuppliedTokenReady, SuppliedTokenUnavailable,
 }
@@ -60,6 +63,28 @@ data approval_ntfy_publisher_token_accessor_row: FleetAccessorGrantRow = FleetAc
 
 data fabric_state_key_accessor_row: FleetAccessorGrantRow = FleetAccessorGrantRow { lane: "fabric state service credential (controller and website custody)", target: fabric_state_key_secret_ref }
 
+// THE WORKER-TURN CREDENTIALS (node adhoc-932f2935-e8e), both read by
+// gunbc.host_credential_custody_converge over WIF for placement on their custody host. NOT YET
+// APPLIED: until the ensure runs, those reads refuse and name the secret.
+data cursor_api_key_harness_accessor_row: FleetAccessorGrantRow = FleetAccessorGrantRow { lane: "cursor worker-turn API key", target: cursor_api_key_harness_secret_ref }
+data codex_auth_harness_accessor_row: FleetAccessorGrantRow = FleetAccessorGrantRow { lane: "codex worker-turn subscription auth.json", target: codex_auth_harness_secret_ref }
+
+// THE ONE WRITE GRANT, kept as its own roster because it is a different role and a different risk:
+// codex rotates its refresh token on its custody host, and the custody converge reads the host file
+// back and adds it as a new version (gunbc.codex_harness_credential codex_harness_add_version). secretVersionAdder can add versions and cannot
+// read, disable or destroy them, so a converge that writes back cannot remove the version it read.
+data codex_auth_harness_version_adder_row: FleetAccessorGrantRow = FleetAccessorGrantRow { lane: "codex worker-turn auth.json write-back", target: codex_auth_harness_secret_ref }
+
+data fleet_version_adder_grant_roster: List<FleetAccessorGrantRow> = [
+  codex_auth_harness_version_adder_row,
+]
+
+// THE OPENROUTER FREE-TIER KEY, read by the hosted harness route (gunbc.harness.harness_hosted_route)
+// on every bind -- a recurring automated read, so it rides the workload's accessor cell rather than an
+// operator session (gunbc.auth.authorization_pattern_selection). NOT YET APPLIED: until this roster's
+// approval-gated converge runs, the hosted bind's Secret Manager read refuses and names the secret.
+data openrouter_free_tier_key_accessor_row: FleetAccessorGrantRow = FleetAccessorGrantRow { lane: "OpenRouter free-tier key (hosted harness route)", target: openrouter_free_tier_key_secret_ref }
+
 // The OCI API signing key, read on srv1 by the custody converge (gunbc.host_credential_custody_converge
 // OracleOciApiSigningKey).
 data oracle_oci_api_signing_key_accessor_row: FleetAccessorGrantRow = FleetAccessorGrantRow { lane: "oracle oci api signing key (srv1 custody)", target: oci_api_signing_key_secret_ref }
@@ -72,6 +97,8 @@ data oracle_oci_api_signing_key_accessor_row: FleetAccessorGrantRow = FleetAcces
 data claude_code_oauth_harness_accessor_row: FleetAccessorGrantRow = FleetAccessorGrantRow { lane: "claude code subscription OAuth token (srv1 belt custody)", target: claude_code_oauth_harness_secret_ref }
 
 data fleet_accessor_grant_roster: List<FleetAccessorGrantRow> = [
+  cursor_api_key_harness_accessor_row,
+  codex_auth_harness_accessor_row,
   spark_accessor_row,
   mtcollins1_bmc_accessor_row,
   approval_capability_mac_key_accessor_row,
@@ -79,6 +106,7 @@ data fleet_accessor_grant_roster: List<FleetAccessorGrantRow> = [
   approval_store_receipt_mac_key_accessor_row,
   approval_ntfy_publisher_token_accessor_row,
   fabric_state_key_accessor_row,
+  openrouter_free_tier_key_accessor_row,
   oracle_oci_api_signing_key_accessor_row,
   claude_code_oauth_harness_accessor_row,
 ]
@@ -87,16 +115,28 @@ fn fleet_accessor_grant(row: FleetAccessorGrantRow) -> SecretAccessGrant {
   secret_accessor_grant(target: row.target)
 }
 
+fn fleet_version_adder_grant(row: FleetAccessorGrantRow) -> SecretAccessGrant {
+  SecretAccessGrant { target: row.target, role: role_secretmanager_secret_version_adder, condition: none }
+}
+
+// Every cell the convergence principal must hold, accessor rows first, as the one list each entry folds.
+fn fleet_secret_grants() -> List<SecretAccessGrant> {
+  concat(
+    map(fleet_accessor_grant_roster, row => fleet_accessor_grant(row: row)),
+    map(fleet_version_adder_grant_roster, row => fleet_version_adder_grant(row: row)),
+  )
+}
+
 // THE FOLD STOPS AT THE FIRST REFUSAL: a grant that did not converge is reported with its lane, and
 // the rows after it are not attempted, so a partial pass never reads as a full one.
 fn fleet_accessor_grants_ensure(token_source: AccessTokenSource) -> ProcessExit
 {
-  fold(fleet_accessor_grant_roster, init: ExitSuccess, f: (acc, row) =>
+  fold(fleet_secret_grants(), init: ExitSuccess, f: (acc, grant) =>
     match acc {
       ExitSuccess =>
-        match secret_access_ensure_for(grant: fleet_accessor_grant(row: row), token_source: token_source) {
+        match secret_access_ensure_for(grant: grant, token_source: token_source) {
           ExitSuccess => ExitSuccess
-          ExitFailure { code: c, reason: why } => ExitFailure { code: c, reason: join(["accessor grant for ", row.lane, ": ", why], "") }
+          ExitFailure { code: c, reason: why } => ExitFailure { code: c, reason: join([grant.role, " grant on ", grant.target.secret as String, ": ", why], "") }
         }
       failed => failed
     }
@@ -113,9 +153,9 @@ fn fleet_accessor_grants_converge_with_supplied_token() -> ProcessExit
 
 // The shared approval workflow binds the exact grants and beneficiary before obtaining its credential.
 fn fleet_accessor_grants_request_approval() -> ProcessExit {
-  secret_grants_via_approval(grants: map(fleet_accessor_grant_roster, row => fleet_accessor_grant(row: row)), request_only: true)
+  secret_grants_via_approval(grants: fleet_secret_grants(), request_only: true)
 }
 
 fn fleet_accessor_grants_converge_via_approval() -> ProcessExit {
-  secret_grants_via_approval(grants: map(fleet_accessor_grant_roster, row => fleet_accessor_grant(row: row)), request_only: false)
+  secret_grants_via_approval(grants: fleet_secret_grants(), request_only: false)
 }
diff --git a/dag/gunbc/auth/gcp_iam_bootstrap.dag b/dag/gunbc/auth/gcp_iam_bootstrap.dag
index fa424e57ee0..d872c3fdcef 100644
--- a/dag/gunbc/auth/gcp_iam_bootstrap.dag
+++ b/dag/gunbc/auth/gcp_iam_bootstrap.dag
@@ -27,6 +27,7 @@ import gunbc.secret_provision_actuator {
 }
 import gunbc.auth.gcp_iam_converge { gcp_iam_observe_dedicated_federation, gcp_iam_converge_targets, gcp_iam_converge_grant_set_secrets, grant_set_payload_permissions, iam_converge_service_account, iam_observe_service_account, iam_converge_denied_permissions, same_key_set, cell_preimage, observe_and_plan_estate, GcpIamEstateRefused, GcpIamEstateNoop, GcpIamEstateApply, PolicyReading, PolicyObserved, PolicyResourceAbsent, PolicyUnreadable }
 import gunbc.auth.heal_publisher_provision {
+  standing_principal_set,
   DedicatedFederation, observe_and_classify, create_absent_subjects, federation_fully_present,
   FederationClassified, FederationUnclassified, rest_refusal_text, outcome_is_not_found,
 }
@@ -86,7 +87,7 @@ fn iam_bootstrap_plan() -> CliWireResponse {
     concat("project ", fleet_secrets_project_id as String),
     concat("workflow provider ", federation.provider_id as String),
     concat("workflow condition ", federation.attribute_condition),
-    concat("workflow principal set ", federation.principal_set),
+    concat("workflow principal set ", match standing_principal_set(f: federation) { Present { value: ps } => ps  Absent => "none standing (run-scoped)" }),
     concat("deny policy ", iam_bootstrap_deny_policy_id as String),
     concat("deny principal serviceAccount:", iam_converge_service_account as String),
     concat("deny permissions ", join(iam_converge_denied_permissions, ",")),
diff --git a/dag/gunbc/auth/gcp_iam_bootstrap_model.dag b/dag/gunbc/auth/gcp_iam_bootstrap_model.dag
index 8083f36b250..ed45146d779 100644
--- a/dag/gunbc/auth/gcp_iam_bootstrap_model.dag
+++ b/dag/gunbc/auth/gcp_iam_bootstrap_model.dag
@@ -12,7 +12,7 @@ import gunbc.auth.gcp_iam_converge {
   iam_observe_service_account, iam_converge_service_account, iam_converge_service_account_id,
   gcp_iam_observe_dedicated_federation, gcp_iam_converge_targets, gcp_iam_converge_grant_set_secrets, iam_converge_reach_excludes_its_own_trust, same_key_set, cell_preimage,
 }
-import gunbc.auth.heal_publisher_provision { DedicatedFederation, impersonation_cell }
+import gunbc.auth.heal_publisher_provision { DedicatedFederation, impersonation_cells }
 import gunbc.auth.gcp_secret_access { secret_access_desired_cells }
 
 // Bootstrap owns the job's trust. Ongoing iam-converge never receives authority over these subjects.
@@ -69,7 +69,7 @@ fn iam_bootstrap_apply_federation() -> DedicatedFederation {
   let base = gcp_iam_observe_dedicated_federation()
   DedicatedFederation { label: "gcp iam converge apply bootstrap", pool_id: base.pool_id, pool_display_name: base.pool_display_name,
     provider_id: base.provider_id, attribute_mapping: base.attribute_mapping, attribute_condition: base.attribute_condition,
-    principal_set: base.principal_set, service_account: iam_converge_service_account, service_account_id: iam_converge_service_account_id,
+    impersonation: base.impersonation, service_account: iam_converge_service_account, service_account_id: iam_converge_service_account_id,
     service_account_display_name: "GCP IAM converge apply (WIF-only, approval-gated)",
     service_account_member: federated_service_account_member(email: iam_converge_service_account), secret_grants: [] }
 }
@@ -112,8 +112,8 @@ fn iam_bootstrap_capability_bindings() -> List<IamBootstrapBinding> {
 
 // Workload trust is a separate final stage, after deny and resource-local permission readbacks.
 fn iam_bootstrap_trust_bindings() -> List<IamBootstrapBinding> {
-  map([gcp_iam_observe_dedicated_federation(), iam_bootstrap_apply_federation()], f =>
-    IamBootstrapBinding { resource: BootstrapAccount { account: f.service_account }, cell: impersonation_cell(f: f) })
+  flat_map([gcp_iam_observe_dedicated_federation(), iam_bootstrap_apply_federation()], f =>
+    map(impersonation_cells(f: f), c => IamBootstrapBinding { resource: BootstrapAccount { account: f.service_account }, cell: c }))
 }
 
 data iam_bootstrap_deny_policy_id: NonEmptyStr = "gunbc-iam-converge-boundary"
diff --git a/dag/gunbc/auth/gcp_iam_converge.dag b/dag/gunbc/auth/gcp_iam_converge.dag
index 36d35e1839f..be15c88b454 100644
--- a/dag/gunbc/auth/gcp_iam_converge.dag
+++ b/dag/gunbc/auth/gcp_iam_converge.dag
@@ -1,5 +1,6 @@
 module gunbc.auth.gcp_iam_converge
 
+import gunbc.auth.branch_dispatch_federation { hetzner_cloud_control_federation }
 import std.types { Int, List, NonEmptyStr, String, Bool, Secret, Map }
 import std.measure { Second, second, second_count }
 import std.content_hash { Sha256Digest, sha256_hex_digest, as_content_hash_cryptographic }
@@ -22,14 +23,14 @@ import gunbc.auth.github_gcp_federation { fleet_secrets_project_id, fleet_secret
 import gunbc.auth.gcp_secret_access { SecretAccessGrant, secret_access_desired_cells, GrantMemberResolution, GrantMemberResolved, GrantMemberUnresolved, grant_member_resolution }
 import gunbc.auth.heal_publisher_provision {
   DedicatedFederation, FederationClassification, FederationClassified, FederationUnclassified,
-  heal_publisher_dedicated_federation, private_heal_publisher_dedicated_federation, impersonation_cell, observe_and_classify,
-  rest_refusal_text, outcome_is_not_found,
-}
+  heal_publisher_dedicated_federation, private_heal_publisher_dedicated_federation, impersonation_cells, observe_and_classify,
+  rest_refusal_text, outcome_is_not_found, StandingPoolImpersonation }
 import gunbc.fleet.printer_federation_provision { printer_dedicated_federation }
 import gunbc.namecheap.federation_provision { namecheap_dedicated_federation }
 import gunbc.native_product_federation { native_product_federations }
 import gunbc.auth.fleet_convergence_federation { fleet_convergence_federation }
 import gunbc.auth.managed_host_boot_federation_provision { boot_dedicated_federation }
+import gunbc.auth.mtjade1_arrival_federation_provision { mtjade1_arrival_dedicated_federation }
 import gunbc.auth.managed_host_boot_federation { pinned_version_accessor_grant_for, provisioned_boot_federations }
 import gunbc.auth.approval_request_submission { approval_submission_mac_key_secret_ref }
 import gunbc.cloudflare.r2_mint_secret_access { r2_mint_custody_grants }
@@ -97,7 +98,7 @@ data iam_observe_service_account: ServiceAccountEmail = "iam-observe@gunbai-secr
 // WHO MAY BECOME iam-converge: the principal set of the job's dedicated pool
 // (gunbc.auth.gcp_iam_converge_federation), holding roles/iam.workloadIdentityUser on iam-converge's
 // own policy and no other grant. The provider's condition pins this repository, the fleet-converge
-// workflow file at main, a dispatch on main and the gcp-iam-converge environment. That binding is
+// workflow file at reviewed main, a workflow_dispatch on main and the gcp-iam-converge environment. That binding is
 // written once by the bootstrap ceremony; iam-converge's own policy is never a converge target.
 // THE ACTUATION TOKEN'S LIFETIME, passed to the impersonating auth step. Ten minutes covers a
 // provisioning run (three creates, one impersonation reconcile, a handful of secret grants, each with
@@ -196,7 +197,7 @@ fn gcp_iam_observe_dedicated_federation() -> DedicatedFederation {
     provider_id: gcp_iam_observe_wif_provider_id,
     attribute_mapping: gcp_iam_observe_wif_attribute_mapping,
     attribute_condition: gcp_iam_observe_wif_attribute_condition(),
-    principal_set: gcp_iam_observe_wif_principal_set(),
+    impersonation: StandingPoolImpersonation { principal_set: gcp_iam_observe_wif_principal_set() },
     service_account: iam_observe_service_account,
     service_account_id: iam_observe_service_account_id,
     service_account_display_name: "GCP IAM converge observer (WIF-only, read-only, no keys)",
@@ -219,7 +220,10 @@ data gcp_iam_converge_targets: List<DedicatedFederation> = concat(
     [heal_publisher_dedicated_federation(), private_heal_publisher_dedicated_federation()],
     map(provisioned_boot_federations(), f => boot_dedicated_federation(f: f)),
   ),
-  concat([namecheap_dedicated_federation(), fleet_convergence_federation(), printer_dedicated_federation()], native_product_federations()),
+  concat(
+    concat([namecheap_dedicated_federation(), fleet_convergence_federation(), printer_dedicated_federation(), hetzner_cloud_control_federation()], native_product_federations()),
+    [mtjade1_arrival_dedicated_federation()],
+  ),
 )
 
 fn service_account_resource(email: ServiceAccountEmail) -> String {
@@ -502,6 +506,9 @@ fn delta_refusals(ds: List<PolicyDelta>) -> List<String> {
 // THE PLAN IS PURE: readings in, plan out, so a witness drives every arm with supplied readings.
 // The readings must cover exactly the declared grants, by secret identity: a missing or extra reading
 // refuses, because a plan over a partial population would show the operator a partial diff as whole.
+// A RUN-SCOPED ACCOUNT OWNS NO STANDING CELL, so its policy is not a subject of this plan at all: an
+// add of no cells would be an effect with nothing in it, and the run cells on that policy belong to
+// gunbc.auth.branch_run_grant.
 fn plan_dedicated_federation(
   f: DedicatedFederation,
   classification: FederationClassification,
@@ -523,19 +530,20 @@ fn plan_dedicated_federation(
             if ca { [CreateServiceAccount { account_id: f.service_account_id, display_name: f.service_account_display_name }] } else { [] },
           ),
         )
-        let account_delta = policy_delta(
+        let owned = impersonation_cells(f: f)
+        let account_deltas = if owned.length() == 0 { [] } else { [policy_delta(
           subject: ServiceAccountPolicy { email: f.service_account },
-          desired: [impersonation_cell(f: f)],
+          desired: owned,
           reading: account_policy,
           absent_admitted: ca,
-        )
+        )] }
         let secret_deltas = map(secret_policies, gp => policy_delta(
           subject: SecretPolicy { secret: gp.grant.target.secret },
           desired: secret_access_desired_cells(member: f.service_account_member, grant: gp.grant),
           reading: gp.reading,
           absent_admitted: false,
         ))
-        let deltas = concat([account_delta], secret_deltas)
+        let deltas = concat(account_deltas, secret_deltas)
         let refusals = delta_refusals(ds: deltas)
         if refusals.length() > 0 {
           GcpIamRefused { target: f.label, reasons: refusals }
diff --git a/dag/gunbc/auth/gcp_iam_converge_federation.dag b/dag/gunbc/auth/gcp_iam_converge_federation.dag
index f7d6ae0d84c..62f8f964b67 100644
--- a/dag/gunbc/auth/gcp_iam_converge_federation.dag
+++ b/dag/gunbc/auth/gcp_iam_converge_federation.dag
@@ -10,7 +10,7 @@ import gunbc.auth.oidc_claim_pins { OidcClaimPin, claim_pins_attribute_condition
 // The plan must read before anyone approves, so the job needs a credential of its own; it gets the
 // managed-host boot's construction (gunbc.auth.managed_host_boot_federation) for the same reasons -- a
 // DEDICATED POOL WITH ONE PROVIDER, the job pinned by its `environment` claim beside the workflow
-// file at main and a dispatch on main, never the repo-wide pool whose principals every job in the
+// file at reviewed main and a workflow_dispatch, never the repo-wide pool whose principals every job in the
 // repository can become. The accounts it reaches are iam-observe, which reads policies and changes
 // nothing, and iam-converge, which the job impersonates only after a live approval.
 //
diff --git a/dag/gunbc/auth/github_deployment_environment.dag b/dag/gunbc/auth/github_deployment_environment.dag
new file mode 100644
index 00000000000..79461a9fd18
--- /dev/null
+++ b/dag/gunbc/auth/github_deployment_environment.dag
@@ -0,0 +1,64 @@
+module gunbc.auth.github_deployment_environment
+
+import std.types { String, NonEmptyStr, List, Bool }
+import extdeps.github.deployment_environments {
+  GitHubEnvironmentProtectionSettings,
+  SelectedBranchesAndTags, DeploymentBranchPolicyRule, DeploymentBranchPolicyRefType, PolicyRefBranch, PolicyRefTag,
+  RequiredReviewers,
+  EnvironmentDeploymentBranchPolicy,
+  EnvironmentReviewerRequirement,
+  AllBranchesAndTags,
+  ProtectedBranchesOnly,
+  NoRequiredReviewers,
+}
+
+// THE BOUNDARY FOR srv1 ROOT MUTATION is this environment's GitHub protection, applied by an
+// operator in the repository settings (deployment branches and tags: the selected branch rule
+// `main` only; required reviewers). Jobs that bind ci_deploy_srv1_access name this environment. A github.ref == main
+// job `if` is not that boundary: a branch dispatch runs that branch's YAML.
+
+data srv1_production_environment_name: NonEmptyStr = "srv1-production"
+
+data srv1_production_required_protection: GitHubEnvironmentProtectionSettings = GitHubEnvironmentProtectionSettings {
+  name: srv1_production_environment_name as String,
+  deployment_branch_policy: SelectedBranchesAndTags { rules: [DeploymentBranchPolicyRule { name: "main", ref_type: PolicyRefBranch }] },
+  reviewer_requirement: RequiredReviewers,
+}
+
+type EnvironmentProtectionStanding
+  = EnvironmentProtectionUnobserved { required: GitHubEnvironmentProtectionSettings, read_obligation: String }
+  | EnvironmentProtectionHolds { required: GitHubEnvironmentProtectionSettings }
+  | EnvironmentProtectionDiverges { required: GitHubEnvironmentProtectionSettings, detail: String }
+
+data srv1_production_protection_standing: EnvironmentProtectionStanding = EnvironmentProtectionUnobserved {
+  required: srv1_production_required_protection,
+  read_obligation: "GET /repos/gunb-ai/gunbc/environments/srv1-production (and its deployment-branch-policy / required-reviewers) must show deployment_branch_policy { protected_branches: false, custom_branch_policies: true } with exactly one branch rule named main in GET .../deployment-branch-policies and RequiredReviewers. The operator applies that in the GitHub environment UI; the workflow file cannot.",
+}
+
+fn deployment_rule_is_a_branch(rule: DeploymentBranchPolicyRule) -> Bool {
+  match rule.ref_type {
+    PolicyRefBranch => true
+    PolicyRefTag => false
+  }
+}
+
+fn environment_protection_restricts_to_main(settings: GitHubEnvironmentProtectionSettings) -> Bool {
+  match settings.deployment_branch_policy {
+    SelectedBranchesAndTags { rules: rs } => count(rs) == 1 && any(rs, r => r.name == "main" && deployment_rule_is_a_branch(rule: r))
+    AllBranchesAndTags => false
+    ProtectedBranchesOnly => false
+  }
+}
+
+fn environment_protection_requires_reviewers(settings: GitHubEnvironmentProtectionSettings) -> Bool {
+  match settings.reviewer_requirement {
+    RequiredReviewers => true
+    NoRequiredReviewers => false
+  }
+}
+
+fn srv1_production_required_protection_is_the_boundary() -> Bool {
+  environment_protection_restricts_to_main(settings: srv1_production_required_protection)
+    && environment_protection_requires_reviewers(settings: srv1_production_required_protection)
+    && (srv1_production_required_protection.name as String) == (srv1_production_environment_name as String)
+}
diff --git a/dag/gunbc/auth/heal_publisher_federation.dag b/dag/gunbc/auth/heal_publisher_federation.dag
index 8320d24fb44..e155050125e 100644
--- a/dag/gunbc/auth/heal_publisher_federation.dag
+++ b/dag/gunbc/auth/heal_publisher_federation.dag
@@ -13,11 +13,20 @@ import gunbc.repository {
   gunbc_repository, gunbc_repository_numeric_identity, RepositoryNumericIdentity,
   gunbc_private_repository, gunbc_private_repository_numeric_identity
 }
-import gunbc.generated_artifact { artifact_path, HealPublisherWorkflowYamlArtifact }
+
 import extdeps.github.app { permission_axis_wire_name, permission_access_wire_name }
 import extdeps.github.effect { contents_write }
 import extdeps.cloud.gcp.secret_ref { secret_ref_version_resource }
 import extdeps.languages.json.emit { json_object, json_array, json_kv, json_string, serialize_json }
+// THE WORKFLOW THIS POOL ADMITS NO LONGER EXISTS (operator ruling 2026-10-09: the heal publisher
+// was deleted with the v1 lanes, because nothing seals a repair candidate for it to publish). The
+// pool's attribute condition still names the file's path, so the path is carried here as the
+// retired literal the condition was pinned to rather than derived from a registry row that is
+// gone. The estate is DEAD, not deleted: no job can present this claim, the pool and its
+// secret-accessor binding stand until retired by hand, and that is an external-estate obligation
+// recorded beside gunbc.rung_drop v1_required_lanes_withdrawn.
+data heal_publisher_workflow_path_retired: String = ".github/workflows/heal-publish.yml"
+
 
 // THE PUBLISHER'S OWN FEDERATION, AND WHY IT IS NOT THE REPOSITORY'S.
 //
@@ -109,7 +118,7 @@ fn public_heal_publisher_federation() -> HealPublisherFederation {
   HealPublisherFederation {
     repository: gunbc_repository,
     numeric_identity: gunbc_repository_numeric_identity,
-    workflow_path: artifact_path(a: HealPublisherWorkflowYamlArtifact),
+    workflow_path: heal_publisher_workflow_path_retired,
     pool_id: heal_publisher_wif_pool_id,
     pool_display_name: heal_publisher_wif_pool_display_name,
     provider_id: heal_publisher_wif_provider_id,
@@ -124,7 +133,7 @@ fn public_heal_publisher_federation() -> HealPublisherFederation {
 // THE PRIVATE PUBLISHER'S FILE IS AT THE SAME PATH AS THIS ONE'S, and gunbc-private's emitter
 // imports this row as its output path, so the condition and the file it names have one authority.
 fn heal_publisher_private_workflow_path() -> String {
-  artifact_path(a: HealPublisherWorkflowYamlArtifact)
+  heal_publisher_workflow_path_retired
 }
 
 // Every id is under its upstream ceiling: pool id 4-32, provider id 4-32, account id 6-30, pool
diff --git a/dag/gunbc/auth/heal_publisher_provision.dag b/dag/gunbc/auth/heal_publisher_provision.dag
index 2d72c630f6e..f63a4a7579c 100644
--- a/dag/gunbc/auth/heal_publisher_provision.dag
+++ b/dag/gunbc/auth/heal_publisher_provision.dag
@@ -50,6 +50,16 @@ fn rest_refusal_text(o: RestRefusal) -> String {
 // differing only in those names would be two authorities for one provisioning protocol (DESIGN §3),
 // so the names are a record and each federation binds its own. Everything else -- the 409 handling,
 // the impersonation reconcile with readback, the grant last -- is the one protocol.
+// WHO MAY ACT AS A FEDERATION'S ACCOUNT. Every federation but one binds its whole pool standing: the
+// provider's attribute condition is the wall, and any token that passes it may impersonate. A
+// run-scoped federation binds nothing standing -- its pool admits branch dispatches, so a standing
+// binding would hand the account to unreviewed code -- and a run gains the account only through a
+// time-conditioned cell naming that run's id, written after the operator approves that exact run
+// (gunbc.auth.branch_run_grant).
+type FederationImpersonation
+  = StandingPoolImpersonation { principal_set: String }
+  | RunScopedImpersonation
+
 type DedicatedFederation {
   label: String
   pool_id: NonEmptyStr
@@ -57,7 +67,7 @@ type DedicatedFederation {
   provider_id: NonEmptyStr
   attribute_mapping: Map<String, String>
   attribute_condition: String
-  principal_set: String
+  impersonation: FederationImpersonation
   service_account: ServiceAccountEmail
   service_account_id: NonEmptyStr
   service_account_display_name: NonEmptyStr
@@ -75,7 +85,7 @@ fn publisher_dedicated_federation(label: String, f: HealPublisherFederation) ->
     provider_id: f.provider_id,
     attribute_mapping: heal_publisher_wif_attribute_mapping,
     attribute_condition: heal_publisher_federation_attribute_condition(f: f),
-    principal_set: heal_publisher_federation_principal_set(f: f),
+    impersonation: StandingPoolImpersonation { principal_set: heal_publisher_federation_principal_set(f: f) },
     service_account: f.service_account,
     service_account_id: f.service_account_id,
     service_account_display_name: f.service_account_display_name,
@@ -111,26 +121,42 @@ fn private_heal_publisher_dedicated_federation() -> DedicatedFederation {
 //
 // Until then the pool is the honest description of the member, and the guard that actually holds is
 // the provider's attribute condition -- one provider, whose condition is the wall.
-fn impersonation_cell(f: DedicatedFederation) -> GcpIamBindingCell {
+fn standing_impersonation_cell(principal_set: String) -> GcpIamBindingCell {
   GcpIamBindingCell {
     role: role_iam_workload_identity_user,
-    member: f.principal_set,
+    member: principal_set,
     condition: none
   }
 }
 
+// THE STANDING CELLS A FEDERATION OWNS on its account's policy: one for a standing pool, none for a
+// run-scoped federation, whose run cells are owned by the grant that writes them.
+fn impersonation_cells(f: DedicatedFederation) -> List<GcpIamBindingCell> {
+  match f.impersonation {
+    StandingPoolImpersonation { principal_set: ps } => [standing_impersonation_cell(principal_set: ps)]
+    RunScopedImpersonation => []
+  }
+}
+
+fn standing_principal_set(f: DedicatedFederation) -> String? {
+  match f.impersonation {
+    StandingPoolImpersonation { principal_set: ps } => Present { value: ps }
+    RunScopedImpersonation => none
+  }
+}
+
 fn heal_publisher_impersonation_cell() -> GcpIamBindingCell {
-  impersonation_cell(f: heal_publisher_dedicated_federation())
+  standing_impersonation_cell(principal_set: heal_publisher_federation_principal_set(f: public_heal_publisher_federation()))
 }
 
 fn impersonation_owned(f: DedicatedFederation) -> GcpIamOwnedCellUniverse {
-  GcpIamOwnedCellUniverse { cells: [impersonation_cell(f: f)] }
+  GcpIamOwnedCellUniverse { cells: impersonation_cells(f: f) }
 }
 
 // A WHOLE-POLICY REPLACE THAT RETURNED 200 HAS NOT BEEN SHOWN TO CONTAIN THE CELL IT WAS WRITTEN FOR,
 // so the write is followed by looking for that cell in what came back.
 fn impersonation_binding_present_for(f: DedicatedFederation, policy: GcpPolicy) -> Bool {
-  gcp_cell_in(c: impersonation_cell(f: f), xs: gcp_policy_cells(p: policy))
+  all(impersonation_cells(f: f), c => gcp_cell_in(c: c, xs: gcp_policy_cells(p: policy)))
 }
 
 fn impersonation_binding_present(policy: GcpPolicy) -> Bool {
@@ -150,7 +176,7 @@ fn bind_impersonation(f: DedicatedFederation, token: Secret) -> ProcessExit
       let observed_policy = gcp_policy_from_wire(bindings: observed.bindings, etag: observed.etag, version: observed.version)
       match reconcile_gcp_policy(
         observed: observed_policy,
-        desired_owned: [impersonation_cell(f: f)],
+        desired_owned: impersonation_cells(f: f),
         owned_universe: impersonation_owned(f: f)
       ) {
         GcpPolicyRepresentationLossy { conditional_roles: _ } =>
diff --git a/dag/gunbc/auth/login_transaction_store.dag b/dag/gunbc/auth/login_transaction_store.dag
index 2aa1aeab7af..4303aea26f1 100644
--- a/dag/gunbc/auth/login_transaction_store.dag
+++ b/dag/gunbc/auth/login_transaction_store.dag
@@ -32,9 +32,8 @@ import extdeps.languages.json.parse {
   JsonDocumentUnreadable, FieldAbsent, FieldRead, FieldMalformed,
 }
 import extdeps.auth.oidc { OidcLoginTransaction, OidcPkceCodeVerifier, RelativeReturnPath }
-import gunbc.roadmap_dashboard_instance { HostDashboardInstance }
-
-data login_transaction_store_dir_segment: String = "auth-login-transactions"
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_private_directory }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_path }
 
 data login_transaction_file_suffix: String = ".json"
 
@@ -44,9 +43,17 @@ type LoginTransactionStoreLayout {
   root: FilePath
 }
 
+// THE DIRECTORY THIS STORE DEMANDS. It used to join its own segment onto the instance root while the
+// provision plan named the same directory a second time, and nothing on the production route created
+// it; now the store declares the target and reads its root off it, and both deployment routes ensure
+// that target (gunbc.roadmap.dashboard_instance_directories).
+fn login_transaction_store_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  dashboard_instance_private_directory(instance: instance, member: "auth-login-transactions" as NonEmptyStr, child: "auth-login-transactions")
+}
+
 fn login_transaction_store_layout_for_instance(instance: HostDashboardInstance) -> LoginTransactionStoreLayout {
   LoginTransactionStoreLayout {
-    root: join([instance.instance_root as String, "/", login_transaction_store_dir_segment], "") as FilePath,
+    root: owned_directory_path(t: login_transaction_store_directory(instance: instance)),
   }
 }
 
diff --git a/dag/gunbc/auth/managed_host_boot_federation.dag b/dag/gunbc/auth/managed_host_boot_federation.dag
index 5769d258663..ffb4b04aa60 100644
--- a/dag/gunbc/auth/managed_host_boot_federation.dag
+++ b/dag/gunbc/auth/managed_host_boot_federation.dag
@@ -8,21 +8,24 @@ import extdeps.cloud.gcp.iam { IamCondition, role_secretmanager_secret_accessor
 import extdeps.cloud.gcp.secret_ref { SecretRef, gcp_version_resource_by_number }
 import gunbc.auth.github_gcp_federation { fleet_secrets_project_number, github_wif_issuer_uri, federated_service_account_member }
 import gunbc.auth.gcp_secret_access { SecretAccessGrant }
-import gunbc.auth.oidc_claim_pins { OidcClaimPin, claim_pins_attribute_condition, claim_pins_admit, fleet_converge_job_claim_pins }
+import gunbc.auth.oidc_claim_pins { OidcClaimPin, OidcPresentedClaim, claim_pins_attribute_condition, claim_pins_admit, fleet_converge_job_claim_pins }
 import gunbc.fleet_ssh_access { fleet_automation_ssh_privkey_secret }
 import gunbc.fleet_host_identity { operator_host_mtcollins1 }
 import gunbc.machine_intake_bmc_secure { BmcSecured, BmcSecureRefused }
 import gunbc.managed_host {
   ManagedHost, ManagedHostBindingStanding, ManagedHostBound, ManagedHostAccessUnobserved, ManagedHostNotSecured,
-  ManagedHostEndpointMismatch, managed_host_binding, managed_hosts,
+  ManagedHostEndpointMismatch, OrdinaryMember, MemberUnderDeclaredDrop, ManagedHostMembership, managed_host_binding,
+  managed_host_memberships, managed_membership_for,
 }
+import gunbc.machine_intake_subject { MachineIntakeSubject }
+import std.decl_ref { DeclarationRef }
 
 // ── THE BOOT'S FEDERATION IS POLICY FOR THE PAIR (MANAGED HOST, BOOT), NOT HOST IDENTITY ───────
 // (docs/plans/managed-host-untangle.md, cut 4c; operator ruling (b), 2026-10-03.) A boot of a
 // managed host is a recurring automated effect, so gunbc.auth.privileged_effect_census derives
 // FederatedScopedGrant for it: the run's own workload identity, holding one cell per secret it reads,
 // with no human per run, scoped to ONE job -- this repository, the fleet-converge workflow file at
-// main, a workflow_dispatch on refs/heads/main, and the job's GitHub environment -- never repo-wide.
+// reviewed main, a workflow_dispatch on main, and the job's GitHub environment -- never repo-wide.
 // None of the ids below is a field of gunbc.managed_host ManagedHost: a second operation on the same
 // host federates through its own pool, and the same host under another policy is a different pair.
 //
@@ -36,10 +39,11 @@ import gunbc.managed_host {
 //
 // THE JOB IS PINNED BY THE ENVIRONMENT CLAIM. OIDC tokens carry no job id; the one job-grain claim
 // GitHub asserts is `environment`, present only for a job that declares one. The honest residue: any
-// job in fleet-converge.yml AT MAIN that declared the same environment would also be admitted, which
-// is the same reviewed-main trust the workflow file itself carries. THE RUNNER IS NOT PINNED: the
-// boot runs on the hold store host's self-hosted runner, so `runner_environment == 'github-hosted'`
-// would refuse it; workflow_ref at main plus workflow_dispatch already keeps pull-request code off it.
+// job in that branch's fleet-converge.yml that declared the same environment would also be admitted.
+// Operator 2026-10-10: this privileged boot identity is equality-pinned at main; a session-branch
+// dispatch cannot impersonate it. THE RUNNER IS NOT PINNED: the boot runs on the hold store host's
+// self-hosted runner, so `runner_environment == 'github-hosted'` would refuse it. Pull-request code
+// stays off it because event_name is workflow_dispatch and workflow_ref is the reviewed main file.
 
 // THE LIVE NAMES OF ONE PAIR'S FEDERATION, which ruling (b) keeps byte-identical: they exist in GCP
 // and GitHub today, and a renamed id is a different pool, account, environment or cell to
@@ -99,8 +103,47 @@ type BootFederationUnprovisionedCause
 
 type ManagedHostBootFederationStanding
   = BootFederationProvisioned { federation: ManagedHostBootFederation }
+  | BootFederationProvisionedUnderDeclaredDrop {
+      federation: ManagedHostBootFederation
+      drop: DeclarationRef
+      standing_subject: MachineIntakeSubject
+      current_subject: MachineIntakeSubject
+    }
   | BootFederationUnprovisioned { host: HostIdentity, cause: BootFederationUnprovisionedCause }
 
+fn provisioned_federation_of(s: ManagedHostBootFederationStanding) -> ManagedHostBootFederation? {
+  match s {
+    BootFederationProvisioned { federation: f } => Present { value: f }
+    BootFederationProvisionedUnderDeclaredDrop { federation: f, drop: _, standing_subject: _, current_subject: _ } =>
+      Present { value: f }
+    BootFederationUnprovisioned { host: _, cause: _ } => none
+  }
+}
+
+fn boot_federation_standing_of(m: ManagedHostMembership) -> ManagedHostBootFederationStanding {
+  match m {
+    OrdinaryMember { host: h } => admit_boot_federation(host: h)
+    MemberUnderDeclaredDrop { drop: d, standing_subject: standing, current_subject: current, host: h } =>
+      match admit_boot_federation(host: h) {
+        BootFederationUnprovisioned { host: u, cause: c } => BootFederationUnprovisioned { host: u, cause: c }
+        BootFederationProvisioned { federation: f } =>
+          BootFederationProvisionedUnderDeclaredDrop {
+            federation: f,
+            drop: d,
+            standing_subject: standing,
+            current_subject: current,
+          }
+        BootFederationProvisionedUnderDeclaredDrop { federation: f, drop: _, standing_subject: _, current_subject: _ } =>
+          BootFederationProvisionedUnderDeclaredDrop {
+            federation: f,
+            drop: d,
+            standing_subject: standing,
+            current_subject: current,
+          }
+      }
+  }
+}
+
 // THE PAIR'S ADMISSION INCLUDES ITS POLICY, and its cells are the ROW's values. The BMC credential
 // cell is the version the row's secure standing published (gunbc.machine_intake_bmc_secure
 // ManagedCredentialReference secret), read through managed_host_binding so it is never a secured
@@ -141,22 +184,23 @@ fn admit_boot_federation(host: ManagedHost) -> ManagedHostBootFederationStanding
 // THE STANDING FOR ONE HOST NAME: a host that is not a managed host is unprovisioned by that cause,
 // never booted with defaults.
 fn boot_federation_for(host: HostIdentity) -> ManagedHostBootFederationStanding {
-  fold(
-    managed_hosts(),
-    init: BootFederationUnprovisioned { host: host, cause: BootFederationHostNotManaged },
-    f: (acc, h) => if host_identity_eq(a: h.host, b: host) { admit_boot_federation(host: h) } else { acc },
-  )
+  match managed_membership_for(host: host) {
+    Absent => BootFederationUnprovisioned { host: host, cause: BootFederationHostNotManaged }
+    Present { value: m } => boot_federation_standing_of(m: m)
+  }
 }
 
 // EVERY PROVISIONED PAIR, in managed-host order: the population gunbc.auth.gcp_iam_converge converges
 // as targets. An unprovisioned host is a non-member, not a loss -- it has no pool to converge.
 fn provisioned_boot_federations() -> List<ManagedHostBootFederation> {
   fold(
-    managed_hosts(),
+    managed_host_memberships(),
     init: [],
-    f: (acc, h) => match admit_boot_federation(host: h) {
-      BootFederationProvisioned { federation: f } => concat(acc, [f])
-      BootFederationUnprovisioned { host: _, cause: _ } => acc
+    f: (acc, m) => {
+      match provisioned_federation_of(s: boot_federation_standing_of(m: m)) {
+        Present { value: f } => concat(acc, [f])
+        Absent => acc
+      }
     },
   )
 }
@@ -172,7 +216,7 @@ fn boot_federation_attribute_condition(f: ManagedHostBootFederation) -> String {
   claim_pins_attribute_condition(pins: f.claim_pins)
 }
 
-fn boot_federation_claims_admitted(f: ManagedHostBootFederation, claims: List<OidcClaimPin>) -> Bool {
+fn boot_federation_claims_admitted(f: ManagedHostBootFederation, claims: List<OidcPresentedClaim>) -> Bool {
   claim_pins_admit(pins: f.claim_pins, claims: claims)
 }
 
diff --git a/dag/gunbc/auth/managed_host_boot_federation_provision.dag b/dag/gunbc/auth/managed_host_boot_federation_provision.dag
index c872aa63bdb..409c4b13347 100644
--- a/dag/gunbc/auth/managed_host_boot_federation_provision.dag
+++ b/dag/gunbc/auth/managed_host_boot_federation_provision.dag
@@ -2,7 +2,7 @@ module gunbc.auth.managed_host_boot_federation_provision
 
 import std.types { list_length }
 import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
-import gunbc.auth.heal_publisher_provision { DedicatedFederation, dedicated_federation_provision_with_supplied_token }
+import gunbc.auth.heal_publisher_provision { DedicatedFederation, dedicated_federation_provision_with_supplied_token, StandingPoolImpersonation }
 import gunbc.auth.managed_host_boot_federation {
   ManagedHostBootFederation, provisioned_boot_federations, boot_federation_wif_attribute_mapping,
   boot_federation_attribute_condition, boot_federation_principal_set, boot_federation_service_account_member,
@@ -22,7 +22,7 @@ fn boot_dedicated_federation(f: ManagedHostBootFederation) -> DedicatedFederatio
     provider_id: f.names.provider_id,
     attribute_mapping: boot_federation_wif_attribute_mapping,
     attribute_condition: boot_federation_attribute_condition(f: f),
-    principal_set: boot_federation_principal_set(f: f),
+    impersonation: StandingPoolImpersonation { principal_set: boot_federation_principal_set(f: f) },
     service_account: f.names.service_account,
     service_account_id: f.names.service_account_id,
     service_account_display_name: f.names.service_account_display_name,
diff --git a/dag/gunbc/auth/materialized_secret.dag b/dag/gunbc/auth/materialized_secret.dag
index 468a794ccb8..d3132e53b2b 100644
--- a/dag/gunbc/auth/materialized_secret.dag
+++ b/dag/gunbc/auth/materialized_secret.dag
@@ -43,10 +43,16 @@ import gunbc.host_phase_status { observation_verdict_eq, host_phase_verdict_from
 // all. Collapsing them to a path would force the two non-file bindings to invent a file, which is
 // how a secret ends up on disk that never needed to be there.
 
+// BearerHeaderFile is the fourth binding, added by the first consumer that performs it (the hosted harness
+// route, gunbc.harness.harness_hosted_route): an HTTP API whose credential rides one
+// "Authorization: Bearer" header line in a 0600 file that curl reads with -H @file. It is a file for the
+// same reason SshKeyFile is -- the transport reads a path -- and it is not SshKeyFile because the bytes
+// are a header line, not a key, and nothing about ssh's permission check applies to it.
 type SecretBinding
   = SshKeyFile
   | EnvVar { name: NonEmptyStr }
   | StdinPassword
+  | BearerHeaderFile
 
 type MaterializedSecret {
   ref: SecretRef
diff --git a/dag/gunbc/auth/mtjade1_arrival_federation.dag b/dag/gunbc/auth/mtjade1_arrival_federation.dag
new file mode 100644
index 00000000000..c17be2fd37e
--- /dev/null
+++ b/dag/gunbc/auth/mtjade1_arrival_federation.dag
@@ -0,0 +1,48 @@
+module gunbc.auth.mtjade1_arrival_federation
+
+import std.types { NonEmptyStr }
+import gunbc.auth.mtjade1_arrival_pair { mtjade1_arrival_principal_member }
+import gunbc.auth.authorization_pattern_selection {
+  PrivilegedEffect, ApiSurface, WorkloadIdentityBindable, WorkloadIdentityStanding,
+  MintsNoCredential, IrreversibleEffect, ReversibleByReapply,
+  NoBillingConsequence, StandingRulingUnderInterlock,
+}
+import std.human_intervention { DeviceOnce }
+import gunbc.auth.standing_operator_grant {
+  mtjade1_live_standing_grant, StandingJadeArrivalArchive, StandingJadeFirmwareQualification,
+  standing_ruling_with_arm_interlock,
+}
+
+fn mtjade1_arrival_bindable_identity() -> WorkloadIdentityStanding {
+  WorkloadIdentityBindable { member: mtjade1_arrival_principal_member() as NonEmptyStr }
+}
+
+fn mtjade1_arrival_archive_effect() -> PrivilegedEffect {
+  PrivilegedEffect {
+    subject: "mtjade1 PriorLifeBoundary archive: content-addressed evidence of BMC carriers, cursor derived from the archive, nothing cleared" as NonEmptyStr,
+    frequency: DeviceOnce,
+    reversibility: ReversibleByReapply,
+    surface: ApiSurface,
+    workload_identity: mtjade1_arrival_bindable_identity(),
+    minted_reach: MintsNoCredential,
+    billing: NoBillingConsequence,
+    witness_discharge: StandingRulingUnderInterlock {
+      ruling: standing_ruling_with_arm_interlock(g: mtjade1_live_standing_grant, e: StandingJadeArrivalArchive),
+    },
+  }
+}
+
+fn mtjade1_arrival_firmware_qualification_effect() -> PrivilegedEffect {
+  PrivilegedEffect {
+    subject: "mtjade1 MegaRAC per-build operation qualification write under the arrival job principal" as NonEmptyStr,
+    frequency: DeviceOnce,
+    reversibility: IrreversibleEffect { what_is_lost: "a controller write at a firmware build is not undone by a reapply of a different build's evidence" as NonEmptyStr },
+    surface: ApiSurface,
+    workload_identity: mtjade1_arrival_bindable_identity(),
+    minted_reach: MintsNoCredential,
+    billing: NoBillingConsequence,
+    witness_discharge: StandingRulingUnderInterlock {
+      ruling: standing_ruling_with_arm_interlock(g: mtjade1_live_standing_grant, e: StandingJadeFirmwareQualification),
+    },
+  }
+}
diff --git a/dag/gunbc/auth/mtjade1_arrival_federation_provision.dag b/dag/gunbc/auth/mtjade1_arrival_federation_provision.dag
new file mode 100644
index 00000000000..0b449146c41
--- /dev/null
+++ b/dag/gunbc/auth/mtjade1_arrival_federation_provision.dag
@@ -0,0 +1,27 @@
+module gunbc.auth.mtjade1_arrival_federation_provision
+
+import gunbc.auth.heal_publisher_provision { DedicatedFederation, StandingPoolImpersonation }
+import gunbc.auth.mtjade1_arrival_pair {
+  mtjade1_arrival_pool_id, mtjade1_arrival_pool_display_name, mtjade1_arrival_provider_id,
+  mtjade1_arrival_wif_attribute_mapping, mtjade1_arrival_claim_pins, mtjade1_arrival_principal_set,
+  mtjade1_arrival_service_account, mtjade1_arrival_service_account_id, mtjade1_arrival_principal_member,
+  mtjade1_arrival_secret_grants,
+}
+import gunbc.auth.oidc_claim_pins { claim_pins_attribute_condition }
+
+fn mtjade1_arrival_dedicated_federation() -> DedicatedFederation {
+  DedicatedFederation {
+    label: "mtjade1 arrival federation",
+    pool_id: mtjade1_arrival_pool_id,
+    pool_display_name: mtjade1_arrival_pool_display_name,
+    provider_id: mtjade1_arrival_provider_id,
+    attribute_mapping: mtjade1_arrival_wif_attribute_mapping,
+    attribute_condition: claim_pins_attribute_condition(pins: mtjade1_arrival_claim_pins()),
+    impersonation: StandingPoolImpersonation { principal_set: mtjade1_arrival_principal_set() },
+    service_account: mtjade1_arrival_service_account,
+    service_account_id: mtjade1_arrival_service_account_id,
+    service_account_display_name: "Mt. Jade arrival (one job)",
+    service_account_member: mtjade1_arrival_principal_member(),
+    secret_grants: mtjade1_arrival_secret_grants(),
+  }
+}
diff --git a/dag/gunbc/auth/mtjade1_arrival_pair.dag b/dag/gunbc/auth/mtjade1_arrival_pair.dag
new file mode 100644
index 00000000000..c021e3233ca
--- /dev/null
+++ b/dag/gunbc/auth/mtjade1_arrival_pair.dag
@@ -0,0 +1,76 @@
+module gunbc.auth.mtjade1_arrival_pair
+
+import std.types { List, Map, NonEmptyStr, String }
+import std.optional { Present }
+import extdeps.cloud.gcp.gcp {
+  ServiceAccountEmail, WifPool, WifProvider, wif_provider_resource, wif_pool_resource,
+}
+import gunbc.auth.github_gcp_federation {
+  fleet_secrets_project_id, fleet_secrets_project_number, github_wif_issuer_uri, federated_service_account_member,
+}
+import gunbc.auth.gcp_secret_access { SecretAccessGrant }
+import gunbc.auth.managed_host_boot_federation { pinned_version_accessor_grant_for }
+import gunbc.auth.oidc_claim_pins { OidcClaimPin, claim_pins_attribute_condition, fleet_converge_job_claim_pins }
+import gunbc.secret_provision { mtjade1_bmc_gunbc_arrival_accessor_ref }
+
+// Names, WIF pair and the one version-pinned accessor. PrivilegedEffect rows live in
+// gunbc.auth.mtjade1_arrival_federation so gcp-iam-converge and fleet-converge.yml do not
+// close over the selection fold.
+
+data mtjade1_arrival_pool_id: NonEmptyStr = "github-mtjade1-arrival"
+data mtjade1_arrival_pool_display_name: NonEmptyStr = "Mt. Jade arrival (one job)"
+data mtjade1_arrival_provider_id: NonEmptyStr = "github-mtjade1-arrival-oidc"
+data mtjade1_arrival_service_account_id: NonEmptyStr = "mtjade1-arrival"
+data mtjade1_arrival_service_account: ServiceAccountEmail = "mtjade1-arrival@gunbai-secrets.iam.gserviceaccount.com"
+data mtjade1_arrival_environment: NonEmptyStr = "mtjade1-arrival"
+
+data mtjade1_arrival_wif_pool: WifPool = WifPool {
+  name: mtjade1_arrival_pool_id
+  project: fleet_secrets_project_id as String
+  display_name: Present { value: mtjade1_arrival_pool_display_name }
+  disabled: false
+}
+
+fn mtjade1_arrival_claim_pins() -> List<OidcClaimPin> {
+  fleet_converge_job_claim_pins(environment: mtjade1_arrival_environment)
+}
+
+data mtjade1_arrival_wif_attribute_mapping: Map<String, String> = {
+  "google.subject": "assertion.sub",
+  "attribute.repository_id": "assertion.repository_id",
+  "attribute.workflow_ref": "assertion.workflow_ref"
+}
+
+fn mtjade1_arrival_wif_provider() -> WifProvider {
+  WifProvider {
+    name: mtjade1_arrival_provider_id
+    pool: mtjade1_arrival_pool_id
+    issuer_uri: github_wif_issuer_uri
+    attribute_mapping: Present { value: mtjade1_arrival_wif_attribute_mapping }
+    attribute_condition: Present { value: claim_pins_attribute_condition(pins: mtjade1_arrival_claim_pins()) }
+  }
+}
+
+fn mtjade1_arrival_provider_resource() -> String {
+  wif_provider_resource(project_number: fleet_secrets_project_number, provider: mtjade1_arrival_wif_provider())
+}
+
+fn mtjade1_arrival_principal_set() -> String {
+  join([
+    "principalSet://iam.googleapis.com/",
+    wif_pool_resource(project_number: fleet_secrets_project_number, pool_id: mtjade1_arrival_pool_id as String),
+    "/*"
+  ], "")
+}
+
+fn mtjade1_arrival_principal_member() -> String {
+  federated_service_account_member(email: mtjade1_arrival_service_account)
+}
+
+fn mtjade1_arrival_secret_grants() -> List<SecretAccessGrant> {
+  [pinned_version_accessor_grant_for(
+    title_prefix: "mtjade1-arrival",
+    description: "gunbc.auth.mtjade1_arrival_pair: the one version the arrival job may read for BmcSecure (signed off msg_f03558d1)",
+    target: mtjade1_bmc_gunbc_arrival_accessor_ref,
+  )]
+}
diff --git a/dag/gunbc/auth/oidc_claim_pins.dag b/dag/gunbc/auth/oidc_claim_pins.dag
index 55f4c13ea4c..84ff5dba90a 100644
--- a/dag/gunbc/auth/oidc_claim_pins.dag
+++ b/dag/gunbc/auth/oidc_claim_pins.dag
@@ -12,26 +12,74 @@ import gunbc.repo_identity { gunbc_default_branch_name }
 // not on a second description of it. This was the Mt. Collins boot federation's; the GCP IAM
 // converge's observe federation (gunbc.auth.gcp_iam_converge_federation) is the second job pinned
 // the same way, so the shape moved here rather than being written twice.
+// Equality is the default pin. Prefix is admitted only on the development claim list: GitHub
+// concatenates the workflow FILE and the git ref into one claim (`path.yml@refs/heads/<branch>`),
+// so an equality pin at main is a branch pin. Operator 2026-10-10: privileged SAs (fleet-cloud-
+// convergence, gcp-iam-converge, boot, printer, namecheap, R2 write, Secret Manager version
+// creation) use the equality list. A rung drop does not substitute for that trust boundary.
+type OidcClaimRelation
+  = OidcClaimEquals
+  | OidcClaimStartsWith
+
 type OidcClaimPin {
   claim: NonEmptyStr
   value: String
+  relation: OidcClaimRelation
+}
+
+// A PRESENTED TOKEN CLAIM is a name and a value. It is not a pin: GitHub does not send a CEL
+// relation. Admission compares presented name+value against the pin's predicate.
+type OidcPresentedClaim {
+  claim: NonEmptyStr
+  value: String
+}
+
+fn oidc_presented(claim: NonEmptyStr, value: String) -> OidcPresentedClaim {
+  OidcPresentedClaim { claim: claim, value: value }
+}
+
+fn presented_from_pins(pins: List<OidcClaimPin>) -> List<OidcPresentedClaim> {
+  map(pins, p => oidc_presented(claim: p.claim, value: p.value))
+}
+
+fn with_presented_value(claims: List<OidcPresentedClaim>, claim: String, value: String) -> List<OidcPresentedClaim> {
+  map(claims, c => if (c.claim as String) == claim { oidc_presented(claim: c.claim, value: value) } else { c })
+}
+
+fn without_presented_claim(claims: List<OidcPresentedClaim>, claim: String) -> List<OidcPresentedClaim> {
+  filter(claims, c => (c.claim as String) != claim)
+}
+
+fn oidc_equals(claim: NonEmptyStr, value: String) -> OidcClaimPin {
+  OidcClaimPin { claim: claim, value: value, relation: OidcClaimEquals }
+}
+
+fn oidc_starts_with(claim: NonEmptyStr, value: String) -> OidcClaimPin {
+  OidcClaimPin { claim: claim, value: value, relation: OidcClaimStartsWith }
+}
+
+fn claim_pin_cel(p: OidcClaimPin) -> String {
+  match p.relation {
+    OidcClaimEquals => join(["assertion.", p.claim as String, " == '", p.value, "'"], "")
+    OidcClaimStartsWith => join(["assertion.", p.claim as String, ".startsWith('", p.value, "')"], "")
+  }
 }
 
 fn claim_pins_attribute_condition(pins: List<OidcClaimPin>) -> String {
-  join(map(pins, p => join(["assertion.", p.claim as String, " == '", p.value, "'"], "")), " && ")
+  join(map(pins, p => claim_pin_cel(p: p)), " && ")
 }
 
-// A presented token's claims, as the provider sees them. An absent claim is simply not in the list,
-// which is how a job with no environment presents.
-fn claim_value_is(claims: List<OidcClaimPin>, pin: OidcClaimPin) -> Bool {
-  filter(claims, c => (c.claim as String) == (pin.claim as String) && c.value == pin.value).length() > 0
+fn claim_satisfies_pin(claims: List<OidcPresentedClaim>, pin: OidcClaimPin) -> Bool {
+  filter(claims, c => (c.claim as String) == (pin.claim as String) && match pin.relation {
+    OidcClaimEquals => c.value == pin.value
+    OidcClaimStartsWith => starts_with(s: c.value, prefix: pin.value)
+  }).length() > 0
 }
 
-fn claim_pins_admit(pins: List<OidcClaimPin>, claims: List<OidcClaimPin>) -> Bool {
-  filter(pins, p => !claim_value_is(claims: claims, pin: p)).length() == 0
+fn claim_pins_admit(pins: List<OidcClaimPin>, claims: List<OidcPresentedClaim>) -> Bool {
+  filter(pins, p => !claim_satisfies_pin(claims: claims, pin: p)).length() == 0
 }
 
-// THE FLEET-CONVERGE WORKFLOW FILE AT MAIN, as GitHub asserts it in `workflow_ref`.
 fn fleet_converge_workflow_ref_at_main() -> String {
   join([
     gunbc_repository.full_name as String, "/",
@@ -40,23 +88,46 @@ fn fleet_converge_workflow_ref_at_main() -> String {
   ], "")
 }
 
+// THE FLEET-CONVERGE WORKFLOW FILE ON ANY HEADS REF. Bound only to
+// fleet_converge_development_workflow_claim_pins -- never to fleet-cloud-convergence or any
+// privileged job pin list. FRONTIER: no DedicatedFederation consumes this list yet (operator
+// 2026-10-10 split-identity; the SA landing is fleet-development-convergence). The witness
+// a_session_branch_dispatch_is_admitted_only_on_the_development_pins is the consumer until then.
+fn fleet_converge_workflow_ref_heads_prefix() -> String {
+  join([
+    gunbc_repository.full_name as String, "/",
+    artifact_path(a: FleetConvergeYamlArtifact),
+    "@refs/heads/"
+  ], "")
+}
+
 data workflow_dispatch_event_name: String = "workflow_dispatch"
 
-// THE PINS EVERY FLEET-CONVERGE FEDERATION SHARES, at WORKFLOW grain: this repository by numeric
-// identity, the workflow file at main, and a dispatch on main. A job-grain federation adds the job's
-// own `environment`; a federation for jobs that declare none (fleet-cloud-convergence) stops here.
+// THE PINS EVERY PRIVILEGED FLEET-CONVERGE FEDERATION SHARES: this repository by numeric identity,
+// the workflow file at reviewed main, a dispatch on main, and workflow_dispatch. A job-grain
+// federation adds the job's own `environment`; fleet-cloud-convergence stops here.
 fn fleet_converge_workflow_claim_pins() -> List<OidcClaimPin> {
   [
-    OidcClaimPin { claim: "repository_id", value: to_string(gunbc_repository_numeric_identity.repository_id) },
-    OidcClaimPin { claim: "repository_owner_id", value: to_string(gunbc_repository_numeric_identity.owner_id) },
-    OidcClaimPin { claim: "workflow_ref", value: fleet_converge_workflow_ref_at_main() },
-    OidcClaimPin { claim: "ref", value: concat("refs/heads/", gunbc_default_branch_name) },
-    OidcClaimPin { claim: "event_name", value: workflow_dispatch_event_name },
+    oidc_equals(claim: "repository_id", value: to_string(gunbc_repository_numeric_identity.repository_id)),
+    oidc_equals(claim: "repository_owner_id", value: to_string(gunbc_repository_numeric_identity.owner_id)),
+    oidc_equals(claim: "workflow_ref", value: fleet_converge_workflow_ref_at_main()),
+    oidc_equals(claim: "ref", value: concat("refs/heads/", gunbc_default_branch_name)),
+    oidc_equals(claim: "event_name", value: workflow_dispatch_event_name),
   ]
 }
 
-// THE PINS EVERY DEDICATED FLEET-CONVERGE JOB SHARES: the workflow pins and the job's own
-// `environment` -- the one job-grain claim GitHub asserts.
 fn fleet_converge_job_claim_pins(environment: NonEmptyStr) -> List<OidcClaimPin> {
-  concat(fleet_converge_workflow_claim_pins(), [OidcClaimPin { claim: "environment", value: environment as String }])
+  concat(fleet_converge_workflow_claim_pins(), [oidc_equals(claim: "environment", value: environment as String)])
+}
+
+// BRANCH-DISPATCHABLE DEVELOPMENT PINS: plan/observe and narrow development deploys. Not bound to
+// fleet-cloud-convergence, gcp-iam-converge, R2 write, Secret Manager version creation, boot, or
+// root-host mutation. A session-branch dispatch is admitted here and refused by the privileged list.
+fn fleet_converge_development_workflow_claim_pins() -> List<OidcClaimPin> {
+  [
+    oidc_equals(claim: "repository_id", value: to_string(gunbc_repository_numeric_identity.repository_id)),
+    oidc_equals(claim: "repository_owner_id", value: to_string(gunbc_repository_numeric_identity.owner_id)),
+    oidc_starts_with(claim: "workflow_ref", value: fleet_converge_workflow_ref_heads_prefix()),
+    oidc_equals(claim: "event_name", value: workflow_dispatch_event_name),
+  ]
 }
diff --git a/dag/gunbc/auth/oidc_id_token_verification.dag b/dag/gunbc/auth/oidc_id_token_verification.dag
index b91e8396b6b..1f6efb0cfff 100644
--- a/dag/gunbc/auth/oidc_id_token_verification.dag
+++ b/dag/gunbc/auth/oidc_id_token_verification.dag
@@ -61,7 +61,8 @@ import extdeps.filesystem.filesystem_io {
 import extdeps.gunbc
 import gunbc.output_policy { OutcomeIsData }
 import gunbc.principal_projection { google_oidc_issuer }
-import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_auth_store_root, DashboardAuthJwksCache }
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_private_directory }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_path }
 
 // ── The Google endpoints and cache policy ──────────────────────────────────────────────────────
 // THE GOOGLE REALIZATION FACTS as data rows: the JWKS endpoint this module fetches and the
@@ -801,10 +802,16 @@ type JwksCacheLayout {
   file: String
 }
 
+// THE DIRECTORY THE JWKS CACHE DEMANDS; the layout's directory is read off it (gunbc.owned_directory).
+fn jwks_cache_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  dashboard_instance_private_directory(instance: instance, member: "auth-jwks" as NonEmptyStr, child: "auth-jwks")
+}
+
 fn jwks_cache_layout_for_instance(instance: HostDashboardInstance) -> JwksCacheLayout {
+  let dir = owned_directory_path(t: jwks_cache_directory(instance: instance))
   JwksCacheLayout {
-    dir: dashboard_instance_auth_store_root(instance: instance, store: DashboardAuthJwksCache),
-    file: join([(dashboard_instance_auth_store_root(instance: instance, store: DashboardAuthJwksCache) as String), "/", jwks_cache_file_name], ""),
+    dir: dir,
+    file: join([dir as String, "/", jwks_cache_file_name], ""),
   }
 }
 
diff --git a/dag/gunbc/auth/privileged_effect_census.dag b/dag/gunbc/auth/privileged_effect_census.dag
index d6e24a2d7a4..b1d6f44b350 100644
--- a/dag/gunbc/auth/privileged_effect_census.dag
+++ b/dag/gunbc/auth/privileged_effect_census.dag
@@ -2,7 +2,13 @@ module gunbc.auth.privileged_effect_census
 
 import gunbc.fleet.printer_federation {printer_service_account}
 import gunbc.auth.github_gcp_federation {federated_service_account_member}
-import gunbc.auth.standing_operator_grant { group_a_dev_standing_grant }
+import gunbc.auth.standing_operator_grant {
+  mtjade1_live_standing_grant,
+  StandingBmcSecureAccountWrite, standing_ruling_with_arm_interlock,
+}
+import gunbc.auth.mtjade1_arrival_federation {
+  mtjade1_arrival_archive_effect, mtjade1_arrival_firmware_qualification_effect,
+}
 import std.types { Bool, List, NonEmptyStr, String }
 import std.decl_ref { DeclarationRef, decl_ref, declaration_ref_in_list, declaration_ref_eq }
 import std.dissolution {
@@ -18,7 +24,10 @@ import gunbc.spark.bootstrap_provision {
 import gunbc.cloudflare.r2_token_mint { cloudflare_account_token_bootstrap_intervention }
 import gunbc.github_app_acquisition { census_app_registration_submit_step }
 import gunbc.fleet_host_identity { operator_host_mtcollins1 }
-import gunbc.auth.managed_host_boot_federation { BootFederationProvisioned, BootFederationUnprovisioned, boot_federation_for, boot_federation_service_account_member }
+import gunbc.auth.managed_host_boot_federation {
+  BootFederationProvisioned, BootFederationProvisionedUnderDeclaredDrop, BootFederationUnprovisioned,
+  boot_federation_for, boot_federation_service_account_member,
+}
 import gunbc.auth.authorization_pattern_selection {
   PrivilegedEffect, ProviderSurface, ApiSurface, HumanSurfaceOnly,
   WorkloadIdentityStanding, WorkloadIdentityBindable, WorkloadIdentityUnbindable,
@@ -26,9 +35,9 @@ import gunbc.auth.authorization_pattern_selection {
   ReversibleByReapply, IrreversibleEffect,
   BillsExternally, NoBillingConsequence,
   WitnessDischarge, NoWitnessDischarge, StandingRulingUnderInterlock, StandingDestructiveAuthorization,
-  InterlockPending, UnconditionalStanding, InterlockedBy,
+  InterlockPending, InterlockedBy, StandingRulingInterlock,
   AuthorizationPattern, FederatedScopedGrant, OperatorApprovedCapability, HumanOnlyStep,
-  OperatorOwnSession, PastedOperatorToken,
+  OperatorOwnSession,
   AuthorizationPatternSelection, PatternSelected, ManualStepRequired, NoAdmissiblePattern,
   PatternSelectionNeedsEvidence, PatternSelectionNeedsPolicy, PatternSelectionRefused,
   select_authorization_pattern,
@@ -147,7 +156,6 @@ fn realized_matches(selected: AuthorizationPattern, realized: RealizedAuthorizat
         RealizedHumanStep => false
         RealizedUnauthorized => false
       }
-    PastedOperatorToken => false
   }
 }
 
@@ -276,6 +284,8 @@ fn mtcollins1_boot_effect() -> PrivilegedEffect {
     root_subject: "the mtcollins1_boot mode (attach, boot device, power, SOL; census medium readback over the pinned fleet key)" as NonEmptyStr,
     identity: match boot_federation_for(host: operator_host_mtcollins1) {
       BootFederationProvisioned { federation: f } => WorkloadIdentityBindable { member: boot_federation_service_account_member(f: f) as NonEmptyStr }
+      BootFederationProvisionedUnderDeclaredDrop { federation: f, drop: _, standing_subject: _, current_subject: _ } =>
+        WorkloadIdentityBindable { member: boot_federation_service_account_member(f: f) as NonEmptyStr }
       BootFederationUnprovisioned { host: _, cause: _ } =>
         WorkloadIdentityUnbindable { cause: "mtcollins1 has no admitted boot federation (gunbc.auth.managed_host_boot_federation boot_federation_for)" as NonEmptyStr }
     },
@@ -333,24 +343,29 @@ fn route_qualification_channel_access_effect() -> PrivilegedEffect {
   }
 }
 
-// BMCSECURE ACCOUNT ROTATION (cut O1b). The Apply arm of the state-shaped BmcSecure: set the managed
-// account to a stored and exact-fetched generation and retire the published account to a break-glass
-// generation, each write over a route admitted by admit_rotation_apply. IRREVERSIBLE, AND SAID SO: the
-// value each write replaces is gone, and the published factory value is not restorable by a reapply
-// (artifacts/bmc/mtcollins1-user2-retire-2026-09-13.txt). One controller's accounts, so its reach is one
-// resource. No dispatched run carries it: in this cut it is modeled, with a dry realization only, and
-// the plan mint takes an operator-approved capability (gunbc.auth.approval_broker Redemption) per write,
-// bound to the exact controller, build and request.
+// BMCSECURE ACCOUNT ROTATION (cut O1b, discharge O1c-3). The Apply arm of the state-shaped BmcSecure:
+// set the managed account to a stored and exact-fetched generation and retire the published account
+// to a break-glass generation, each write over a route admitted by admit_rotation_apply.
+// IRREVERSIBLE, AND SAID SO: the value each write replaces is gone, and the published factory value is
+// not restorable by a reapply (artifacts/bmc/mtcollins1-user2-retire-2026-09-13.txt). One controller's
+// accounts, so its reach is one resource. arrival_converge_wet federates the archive door; it does
+// not invoke BmcSecure Apply, so this effect stays WorkloadIdentityUnbindable. Irreversibility is
+// discharged by the mtjade1 live-ops standing ruling's StandingBmcSecureAccountWrite arm (InterlockedBy
+// admit_rotation_apply via standing_ruling_with_arm_interlock), not grant-grain InterlockPending.
+// A write still needs a grounded route. Operator-approved capability remains the selected pattern
+// while the workload identity is unbindable, and is the fallback when the grant does not cover the host.
 fn bmc_secure_account_rotation_effect() -> PrivilegedEffect {
   PrivilegedEffect {
     subject: "rotate a BMC's managed account to a stored generation and retire its published account, over admitted routes on one controller at one firmware build" as NonEmptyStr,
     frequency: DeviceOnce,
     reversibility: IrreversibleEffect { what_is_lost: "each account write replaces the value it overwrites; the published factory value is not restored by a reapply" as NonEmptyStr },
     surface: ApiSurface,
-    workload_identity: WorkloadIdentityUnbindable { cause: "no dispatched run carries the BmcSecure account rotation; in cut O1b it is modeled with a dry realization only" as NonEmptyStr },
+    workload_identity: WorkloadIdentityUnbindable { cause: "arrival_converge_wet does not invoke BmcSecure Apply; account rotation stays capability-selected until a held writer lands in that door" as NonEmptyStr },
     minted_reach: MintsResourceScopedCredential,
     billing: NoBillingConsequence,
-    witness_discharge: NoWitnessDischarge,
+    witness_discharge: StandingRulingUnderInterlock {
+      ruling: standing_ruling_with_arm_interlock(g: mtjade1_live_standing_grant, e: StandingBmcSecureAccountWrite),
+    },
   }
 }
 
@@ -363,12 +378,19 @@ fn bmc_secure_account_rotation_effect() -> PrivilegedEffect {
 // active hold.
 type PrivilegedEffectInterlock {
   site: DeclarationRef
-  hold: DeclarationRef
+  hold: DeclarationRef?
   refusal: DeclarationRef
   premise: NonEmptyStr
   hold_owning_roots: List<InterlockRoot>
 }
 
+fn privileged_effect_interlock_hold(interlock: StandingRulingInterlock) -> DeclarationRef? {
+  match interlock {
+    InterlockedBy { hold: i } => Present { value: i }
+    InterlockPending { obligation: _ } => none
+  }
+}
+
 // EVERY PRODUCTION ROOT THAT REACHES A GATED WRITE ON THE UNIT, and the live acquire it owns. The set
 // is closed by the compiler rather than by this list: the BMC write wrappers take a sole_constructor
 // UnitHoldProof, and the generic operations beneath them are admit_callers-sealed to the callers named
@@ -410,39 +432,65 @@ data mtcollins1_hold_owning_roots: List<InterlockRoot> = [
 
 data privileged_effect_interlocks: List<PrivilegedEffectInterlock> = [
   PrivilegedEffectInterlock {
-    site: site(module_path: "gunbc.spark.pair_serving_d0_door", decl_name: "d0_standing_grant_for"),
-    hold: decl_ref(module_path: "gunbc.spark.pair_serving_d0", decl_name: "d0_claim_grant"),
-    refusal: site(module_path: "gunbc.spark.pair_serving_d0", decl_name: "d0_decide_release"),
-    premise: "the release runs only under D0's durable claim of the consent slot and its pending state, and refuses (D0HostNotQuiescent) unless a fresh reading taken at filing time finds every host quiescent; an unanswering host refuses as unobserved" as NonEmptyStr,
+    site: site(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "dispatch_qualification_floor"),
+    hold: runner_lifecycle_operator_ruling.interlock,
+    refusal: site(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "dispatch_qualification_floor"),
+    premise: "the dispatch takes the slot host's unit hold proof and refuses DispatchHoldForAnotherHost unless the proof's admitted host is the slot's own; the root that acquires it is the route fold the dispatch leg owes (LegAuthorityImplemented wiring_owed), so no production root is rostered yet" as NonEmptyStr,
     hold_owning_roots: [] as List<InterlockRoot>,
   },
   PrivilegedEffectInterlock {
     site: site(module_path: "gunbc.machine_intake_mtcollins1_boot_run", decl_name: "mtcollins1_boot_wet"),
-    hold: decl_ref(module_path: "gunbc.managed_host_unit_hold", decl_name: "UnitHoldProof"),
+    hold: privileged_effect_interlock_hold(interlock: mtcollins1_operator_ruling.interlock),
     refusal: site(module_path: "gunbc.managed_host_unit_hold", decl_name: "unit_hold_acquire"),
     premise: "the boot takes the unit's one durable exclusive hold before any BMC write and refuses FileHoldOccupied naming the holder" as NonEmptyStr,
     hold_owning_roots: mtcollins1_hold_owning_roots,
   },
   PrivilegedEffectInterlock {
     site: site(module_path: "gunbc.host_reset_return_run", decl_name: "host_reset_return_wet"),
-    hold: decl_ref(module_path: "gunbc.managed_host_unit_hold", decl_name: "UnitHoldProof"),
+    hold: privileged_effect_interlock_hold(interlock: mtcollins1_operator_ruling.interlock),
     refusal: site(module_path: "gunbc.managed_host_unit_hold", decl_name: "unit_hold_acquire"),
     premise: "host reset-return takes the same unit hold before it sets the boot device or power-cycles the unit" as NonEmptyStr,
     hold_owning_roots: mtcollins1_hold_owning_roots,
   },
+  PrivilegedEffectInterlock {
+    site: site(module_path: "gunbc.machine_intake_bmc_secure", decl_name: "plan_bmc_account_action"),
+    hold: Present { value: decl_ref(module_path: "gunbc.machine_intake_bmc_rotation_route", decl_name: "admit_rotation_apply") },
+    refusal: site(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "grant_discharges_bmc_secure_account_write"),
+    premise: "BmcSecure Apply discharges the mtjade1 standing ruling only when admit_rotation_apply is rostered against this site; InterlockPending never discharges, and a named hold that is not this site's rostered interlock does not discharge" as NonEmptyStr,
+    hold_owning_roots: [] as List<InterlockRoot>,
+  },
+  PrivilegedEffectInterlock {
+    site: site(module_path: "gunbc.auth.mtjade1_arrival_federation", decl_name: "mtjade1_arrival_archive_effect"),
+    hold: Present { value: decl_ref(module_path: "gunbc.machine_intake_arrival_interlock", decl_name: "arrival_archive_slot_acquire") },
+    refusal: site(module_path: "gunbc.machine_intake_arrival_interlock", decl_name: "arrival_archive_slot_acquire"),
+    premise: "the wet arrival door takes the subject's exclusive slot (file_hold_acquire) and, while ArrivalArchiveSlotHeld, calls arrival_wet_prefix_from_unobserved_world which refuses; it does not fold converge_mtjade1_arrival_prefix or write the prior-life archive until an observed BMC/archive world is bound" as NonEmptyStr,
+    hold_owning_roots: [
+      InterlockRoot {
+        root: site(module_path: "gunbc.machine_intake_arrival_run", decl_name: "arrival_converge_wet"),
+        acquires_at: site(module_path: "gunbc.machine_intake_arrival_interlock", decl_name: "arrival_archive_slot_acquire"),
+        operations: ["typed refusal of unobserved PriorLifeBoundary" as NonEmptyStr],
+        sealed_by: [
+          site(module_path: "gunbc.machine_intake_arrival_interlock", decl_name: "arrival_archive_slot_release"),
+        ],
+      },
+    ],
+  },
 ]
 
 // A STANDING RULING IS HONORED ONLY BESIDE ITS INTERLOCK. InterlockPending never discharges and is
-// always a defect. UnconditionalStanding discharges without a rostered hold. InterlockedBy discharges
-// only when that hold is rostered against the same site.
+// always a defect. InterlockedBy discharges only when that hold is rostered against the same site.
 fn ruling_interlock_is_rostered(site_ref: DeclarationRef, interlock: DeclarationRef) -> Bool {
-  any(privileged_effect_interlocks, i => declaration_ref_eq(a: i.site, b: site_ref) && declaration_ref_eq(a: i.hold, b: interlock))
+  any(privileged_effect_interlocks, i =>
+    declaration_ref_eq(a: i.site, b: site_ref)
+      && match i.hold {
+        Present { value: h } => declaration_ref_eq(a: h, b: interlock)
+        Absent => false
+      })
 }
 
 fn ruling_discharge_interlock_defect(site_ref: DeclarationRef, ruling: StandingDestructiveAuthorization) -> DeclarationRef? {
   match ruling.interlock {
     InterlockPending { obligation: _ } => Present { value: site_ref }
-    UnconditionalStanding { reason: _ } => none
     InterlockedBy { hold: i } =>
       if ruling_interlock_is_rostered(site_ref: site_ref, interlock: i) { none } else { Present { value: site_ref } }
   }
@@ -502,7 +550,7 @@ data interim_cloudflare_adapter_unlanded: DivergenceReason = DivergenceReason {
 // the dissolution; a keyed minter on srv1 was the other route and was withdrawn because the
 // credential may not hard-depend on srv1.
 data gcp_iam_approval_enforced_in_reviewed_code: DivergenceReason = DivergenceReason {
-  statement: "the GCP IAM converge federates to iam-converge through a pool pinned to fleet-converge.yml at main, a dispatch on main and the gcp-iam-converge environment, and refuses before impersonating unless a recorded approval matches the re-derived diff; approval-necessity is therefore enforced by reviewed main code, not by the credential layer -- a change merged to main that skipped the gate would federate without a tap. One pool serves both iam-observe (plan, readback) and iam-converge (apply): a second pool pinned to the same claims would add no separation, because under this pattern the credential boundary is the pinned workflow and environment either way" as NonEmptyStr,
+  statement: "the GCP IAM converge federates to iam-converge through a pool pinned to fleet-converge.yml at refs/heads/main, a workflow_dispatch on main and the gcp-iam-converge environment, and refuses before impersonating unless a recorded approval matches the re-derived diff. select_authorization_pattern still sees FederatedScopedGrant: frequency EveryProvision, reversible, ApiSurface, bindable workload identity, minted_reach MintsNoCredential (this site mints no new credential; it impersonates iam-converge). The git-ref pin is STS equality at reviewed main (operator 2026-10-10: not branch-dispatchable). Approval-necessity is enforced by the job's YAML on that reviewed file, not by STS -- a skipped gate on a branch YAML cannot federate because workflow_ref is not main. One pool serves both iam-observe and iam-converge: a second pool pinned to the same claims would add no separation" as NonEmptyStr,
   dissolution: unbound_dissolution(description: "a keyless GCP-hosted minter that verifies a device-signed approval against the enrolled key before issuing an iam-converge token, so that no federated workload identity holds a path to iam-converge without the operator's signature" as NonEmptyStr),
 }
 
@@ -515,6 +563,16 @@ data approval_bootstrap_circularity: DivergenceReason = DivergenceReason {
 
 // BOUND TO THE DECLARED FORK ROW: when that dissolution row retires, the fork it names is gone and
 // this reason with it.
+data arrival_archive_prefix_unobserved_world: DivergenceReason = DivergenceReason {
+  statement: "the arrival wet door acquires the archive slot then refuses unobserved PriorLifeBoundary (arrival_wet_prefix_from_unobserved_world); it does not fold the PriorLifeBoundary prefix or write the archive, so RealizedFederatedGrant would claim a write this job does not perform" as NonEmptyStr,
+  dissolution: unbound_dissolution(description: "NAMED CONSUMER: arrival_converge_under_archive_interlock. TRIGGER: that door binds an observed BMC/archive world and folds converge_mtjade1_arrival_prefix while holding ArrivalArchiveSlotHeld from arrival_archive_slot_acquire, then arrival_archive_slot_release. SUFFICIENT FOR retiring this reason and overlaying the archive census as RealizedFederatedGrant" as NonEmptyStr),
+}
+
+data firmware_qualification_writer_unlanded: DivergenceReason = DivergenceReason {
+  statement: "the arrival wet door acquires the archive slot then refuses unobserved PriorLifeBoundary; firmware qualification has no writer under ArrivalArchiveSlotHeld, so RealizedFederatedGrant would claim a write this job does not perform" as NonEmptyStr,
+  dissolution: unbound_dissolution(description: "NAMED CONSUMER: arrival_converge_under_archive_interlock. TRIGGER: a successor of converge_mtjade1_arrival_prefix performs the MegaRAC per-build qualification write while holding ArrivalArchiveSlotHeld from arrival_archive_slot_acquire, then arrival_archive_slot_release. SUFFICIENT FOR retiring this reason and overlaying StandingJadeFirmwareQualification as InterlockedBy arrival_archive_slot_acquire" as NonEmptyStr),
+}
+
 data eager_bootstrap_fork_declared: DivergenceReason = DivergenceReason {
   statement: "gunbc.auth.access_token_source ensure_access_token_eager_bootstrap_fork_dissolve_on declares this eager gcloud call as a §3 fork with its dissolution condition" as NonEmptyStr,
   dissolution: retires_dissolution(ref: decl_ref(module_path: "gunbc.auth.access_token_source", decl_name: "ensure_access_token_eager_bootstrap_fork_dissolve_on")),
@@ -529,12 +587,13 @@ data eager_bootstrap_fork_declared: DivergenceReason = DivergenceReason {
 // D0's door does gate on an approval before it writes, but the effect a row counts is the STORE
 // write, and the store does not see that approval: any writer reaching the DB performs the same
 // advance without it, so D0's row realizes RealizedUnauthorized like the rest (review 71933).
-// THE DISSOLUTION IS UNBOUND ON PURPOSE. d0_store_operation_wall is not retired when the capability
+// THE DISSOLUTION IS UNBOUND ON PURPOSE. The store-operation wall (now named at its home,
+// gunbc.fabric_store_operation_admission, since D0 was deleted) is not retired when the capability
 // lands -- it is flipped to StoreOperationWallRestored -- so retires_dissolution over it would fire
 // on the row's deletion, an artifact, while the capability stayed dead (§4b(3)).
 data fabric_store_write_unverified: DivergenceReason = DivergenceReason {
-  statement: "the fabric DB admits an advance of a pair-serving authority partition, the host-placement partition or a D0 consent slot on the writer's host access alone: the placed host writes in process (FabricStorageLocalFiles) and the served door carries no grant, so the pattern selected for this writer is not the one the store enforces" as NonEmptyStr,
-  dissolution: unbound_dissolution(description: "one fabric store door every writer passes, the placed host included, that admits an advance of a protected head only under the credential this writer's selected pattern names, verified by the store for that operation -- the capability gunbc.spark.pair_serving_d0 d0_store_operation_wall names" as NonEmptyStr),
+  statement: "the fabric DB admits an advance of a pair-serving authority partition, the host-placement partition or a consent slot on the writer's host access alone: the placed host writes in process (FabricStorageLocalFiles) and the served door carries no grant, so the pattern selected for this writer is not the one the store enforces" as NonEmptyStr,
+  dissolution: unbound_dissolution(description: "one fabric store door every writer passes, the placed host included, that admits an advance of a protected head only under the credential this writer's selected pattern names, verified by the store for that operation -- that is, gunbc.fabric_store_operation_admission admit_store_operation enforcing on every write path, the placed host's in-process writes included (D0, which first named this wall, was deleted with Group A on 2026-10-07; the per-operation door it named is that module)" as NonEmptyStr),
 }
 
 // THE DECLARATIONS THE BOUND TRIGGERS NAME, PRESENT BY CITATION. Each decl_ref here is checked by
@@ -594,6 +653,60 @@ data printer_operator_token_transition: DivergenceReason = DivergenceReason {
  statement:"The explicit operator compatibility entries bind an operator token file while the printer federation and guarded dispatch are unlanded. A local file is not evidence that the credential was never relayed. The physical start still requires the shared approval/IDLE/durable-claim gate; observation grants no start. This route is classified as operator session, not disguised as federation.",
  dissolution:unbound_dissolution(description:"Retire the operator-token printer entries after the main-pinned printer workflow and LAN host state are deployed and an approved print is observed under its dedicated WIF identity; owner: printer workflow lane.")
 }
+// THE OPERATOR'S 2026-10-03 RUNNER-LIFECYCLE RULING, VERBATIM, AND THE OPERATOR'S 2026-10-05 SCOPE
+// RULING BESIDE IT. The 10-03 text names registration and deregistration and is never rewritten to
+// say more. Its scope beyond those words is the operator's own second ruling, decided through
+// escalation msg_5756a200-fcb5-470a-87eb-40867bfe9cdb: no agent's reading discharges a site (review
+// 76234, DESIGN §5: approval is external to the diff, so the row cites where the operator decided).
+// covers is the single source of the operator's scope: no census row may take the 10-03 discharge
+// unless covers names its site. The converse does not hold, on purpose: a covered site whose effect
+// the selection already federates on its own parameters -- registration, deregistration and the
+// reversible branch create and delete -- does not consume the discharge, and only a consumer owes a
+// rostered interlock. The dispatch, being irreversible, is the one consumer.
+// THE DEDICATED GROUP'S SELECTED-WORKFLOW PIN IS NOT UNDER EITHER RULING. ensure_qualification_ref_pin
+// is listed for its branch create; the group pin it performs in the same function is authorized by
+// its own federated standing -- the census row's own parameters, selected without any discharge --
+// and the 10-03 and 10-05 rulings say nothing about it (eager-gull-22, 2026-10-05). The interlock is the
+// host-generic unit hold (gunbc.managed_host_unit_hold UnitHoldProof): the dispatch takes the proof
+// and refuses unless it is the slot's own host's.
+data runner_lifecycle_operator_ruling: StandingDestructiveAuthorization = StandingDestructiveAuthorization {
+  ruling_text: "Runner registration and deregistration are PRE-APPROVED. Approval moves up to the workflow dispatcher (the fleet-converge run's own authorization). There is no per-registration approval step. Classify this through gunbc.auth.authorization_pattern_selection, recording that ruling rather than a per-effect ntfy approval. (operator decision, 2026-10-03)" as NonEmptyStr,
+  effect_subject: "ephemeral JIT runner lifecycle: registration and deregistration" as NonEmptyStr,
+  interlock: decl_ref(module_path: "gunbc.managed_host_unit_hold", decl_name: "UnitHoldProof"),
+}
+
+type OperatorScopeRuling {
+  ruling: StandingDestructiveAuthorization
+  scope_text: NonEmptyStr
+  decided_on: NonEmptyStr
+  decided_through: NonEmptyStr
+  covers: List<DeclarationRef>
+}
+
+data runner_lifecycle_scope_ruling: OperatorScopeRuling = OperatorScopeRuling {
+  ruling: runner_lifecycle_operator_ruling,
+  scope_text: "decision: 'Yes, confirm the wider scope' (operator, 2026-10-05). Scope as relayed with it by quiet-stag-623 (msg_24760d96-078a-46cf-809e-2c92968dba31): the 2026-10-03 runner pre-approval covers registration, deregistration, the qualification CreateDispatch on that attempt's runner, and the per-attempt qualification/<attempt> branch create and delete" as NonEmptyStr,
+  decided_on: "2026-10-05" as NonEmptyStr,
+  decided_through: "escalation msg_5756a200-fcb5-470a-87eb-40867bfe9cdb" as NonEmptyStr,
+  covers: [
+    decl_ref(module_path: "gunbc.runner.runner_jit_perform", decl_name: "dispatch_jit_mint"),
+    decl_ref(module_path: "gunbc.runner.runner_jit_deregistration", decl_name: "ensure_jit_runner_deregistered"),
+    decl_ref(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "dispatch_qualification_floor"),
+    decl_ref(module_path: "gunbc.runner.runner_qualification_ref_pin", decl_name: "ensure_qualification_ref_pin"),
+    decl_ref(module_path: "gunbc.runner.runner_qualification_ref_pin", decl_name: "remove_qualification_ref_pin"),
+  ],
+}
+
+// A SITE IS DISCHARGED BY THE RULING ONLY WHILE THE OPERATOR'S SCOPE RULING NAMES IT. Removing a site
+// from covers turns its discharge into NoWitnessDischarge, and the selection then decides it afresh.
+fn ruling_discharge_for(scope: OperatorScopeRuling, site_ref: DeclarationRef) -> WitnessDischarge {
+  if declaration_ref_in_list(target: site_ref, refs: scope.covers) {
+    StandingRulingUnderInterlock { ruling: scope.ruling }
+  } else {
+    NoWitnessDischarge
+  }
+}
+
 data privileged_effect_census: List<PrivilegedEffectSite> = [
   PrivilegedEffectSite {site:site(module_path:"product.printed_chassis.print_workflow",decl_name:"run"),effect:printer_start_effect(),realized:RealizedOperatorSession {arm:OperatorTokenFile},divergence_reason:Present {value:printer_operator_token_transition}},
   PrivilegedEffectSite {site:site(module_path:"gunbc.fleet.printer_workflow_run",decl_name:"run"),effect:printer_start_effect(),realized:RealizedFederatedGrant,divergence_reason:Present {value:printer_approval_enforced_in_reviewed_code}},
@@ -652,6 +765,54 @@ data privileged_effect_census: List<PrivilegedEffectSite> = [
     realized: RealizedFederatedGrant,
     divergence_reason: none,
   },
+  PrivilegedEffectSite {
+    site: site(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "dispatch_qualification_floor"),
+    effect: PrivilegedEffect {
+      subject: "dispatch the generated fleet-converge workflow with the slot's attempt label as the input its floor job's runs-on reads, so only the JIT registration minted for that attempt can serve the job, under the gunbai-ci installation token whose App key is read over WIF, checked for actions: write" as NonEmptyStr,
+      frequency: EveryProvision,
+      reversibility: IrreversibleEffect { what_is_lost: "a dispatched run is durable: a second dispatch creates another run and does not undo the first, and a cancel stops it without unmaking it" as NonEmptyStr },
+      surface: ApiSurface,
+      workload_identity: convergence_principal(),
+      minted_reach: MintsNoCredential,
+      billing: NoBillingConsequence,
+      witness_discharge: ruling_discharge_for(
+        scope: runner_lifecycle_scope_ruling,
+        site_ref: site(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "dispatch_qualification_floor"),
+      ),
+    },
+    realized: RealizedFederatedGrant,
+    divergence_reason: none,
+  },
+  PrivilegedEffectSite {
+    site: site(module_path: "gunbc.runner.runner_qualification_ref_pin", decl_name: "ensure_qualification_ref_pin"),
+    effect: PrivilegedEffect {
+      subject: "create the per-attempt branch refs/heads/qualification/<attempt> once at the pinned revision (CreateRef, never moved; 422 on an existing ref is refused), read it back, and pin the dedicated runner-qualification group's selected workflow to the qualification workflow at that branch, read back; under the gunbai-ci installation token, whose contents:write reaches every ref of the repository and whose organization self-hosted-runners write reaches every runner group -- the confinement to the prefix and to the dedicated group is this module's construction, not the token's scope" as NonEmptyStr,
+      frequency: EveryProvision,
+      reversibility: ReversibleByReapply,
+      surface: ApiSurface,
+      workload_identity: convergence_principal(),
+      minted_reach: MintsNoCredential,
+      billing: NoBillingConsequence,
+      witness_discharge: NoWitnessDischarge,
+    },
+    realized: RealizedFederatedGrant,
+    divergence_reason: none,
+  },
+  PrivilegedEffectSite {
+    site: site(module_path: "gunbc.runner.runner_qualification_ref_pin", decl_name: "remove_qualification_ref_pin"),
+    effect: PrivilegedEffect {
+      subject: "on every exit, delete the attempt's refs/heads/qualification/<attempt> branch and confirm it absent by readback, under the same installation token" as NonEmptyStr,
+      frequency: EveryProvision,
+      reversibility: ReversibleByReapply,
+      surface: ApiSurface,
+      workload_identity: convergence_principal(),
+      minted_reach: MintsNoCredential,
+      billing: NoBillingConsequence,
+      witness_discharge: NoWitnessDischarge,
+    },
+    realized: RealizedFederatedGrant,
+    divergence_reason: none,
+  },
   PrivilegedEffectSite {
     site: site(module_path: "gunbc.runner_group_restriction_ensure_run", decl_name: "microvm_runner_group_after_gate"),
     effect: PrivilegedEffect {
@@ -673,12 +834,24 @@ data privileged_effect_census: List<PrivilegedEffectSite> = [
     realized: RealizedFederatedGrant,
     divergence_reason: none,
   },
+  PrivilegedEffectSite {
+    site: site(module_path: "gunbc.hetzner_cloud_server_control", decl_name: "read"),
+    effect: recurring_credential_read(subject: "as the run-scoped hetzner-cloud-control account, after the operator approved this run attempt (gunbc.auth.branch_run_grant), read the Hetzner Cloud default project's Read-only API token (Hetzner refuses it any write) and GET /v1/servers/\{id\} for every acquired server; changes nothing" as NonEmptyStr),
+    realized: RealizedFederatedGrant,
+    divergence_reason: none,
+  },
   PrivilegedEffectSite {
     site: site(module_path: "gunbc.host_credential_custody_converge", decl_name: "host_credential_custody_converge_ci_wet"),
-    effect: recurring_credential_read(subject: "read one rostered custody credential over WIF -- the gunbai-ci App key for the microVM lifecycle controller, the approval ntfy publisher token, the fabric state writer key, or the Claude Code subscription OAuth token the roadmap belt's explicit Claude dispatch reads -- and place it on one fleet host at its row's owner, group and mode" as NonEmptyStr),
+    effect: recurring_credential_read(subject: "read one rostered custody credential over WIF -- the gunbai-ci App key for the microVM lifecycle controller, the approval ntfy publisher token, the fabric state writer key, the Claude Code subscription OAuth token the roadmap belt's explicit Claude dispatch reads, or a worker-turn credential (cursor-api-key-harness, codex-auth-harness) -- and place it on one fleet host at its row's owner, group and mode; for the host-authoritative codex row, read the placed file back and add it to codex-auth-harness as a new version when codex rotated its refresh token" as NonEmptyStr),
     realized: RealizedFederatedGrant,
     divergence_reason: none,
   },
+  PrivilegedEffectSite {
+    site: site(module_path: "gunbc.harness.harness_hosted_route", decl_name: "hosted_secret_text"),
+    effect: recurring_credential_read(subject: "read the OpenRouter free-tier key on every hosted harness bind, then write it as a 0600 bearer header file removed at the binding's release" as NonEmptyStr),
+    realized: RealizedRunSelected,
+    divergence_reason: none,
+  },
   PrivilegedEffectSite {
     site: site(module_path: "gunbc.tools.bmc_health_reader_converge", decl_name: "bmc_health_reader_converge"),
     effect: recurring_credential_read(subject: "BMC health reader credential read" as NonEmptyStr),
@@ -718,6 +891,18 @@ data privileged_effect_census: List<PrivilegedEffectSite> = [
     realized: RealizedApprovalCapability,
     divergence_reason: none,
   },
+  PrivilegedEffectSite {
+    site: site(module_path: "gunbc.auth.mtjade1_arrival_federation", decl_name: "mtjade1_arrival_archive_effect"),
+    effect: mtjade1_arrival_archive_effect(),
+    realized: RealizedUnauthorized,
+    divergence_reason: Present { value: arrival_archive_prefix_unobserved_world },
+  },
+  PrivilegedEffectSite {
+    site: site(module_path: "gunbc.auth.mtjade1_arrival_federation", decl_name: "mtjade1_arrival_firmware_qualification_effect"),
+    effect: mtjade1_arrival_firmware_qualification_effect(),
+    realized: RealizedUnauthorized,
+    divergence_reason: Present { value: firmware_qualification_writer_unlanded },
+  },
   PrivilegedEffectSite {
     site: site(module_path: "gunbc.machine_intake_mtcollins1_boot_run", decl_name: "mtcollins1_boot_wet"),
     effect: mtcollins1_boot_effect(),
@@ -768,7 +953,7 @@ data privileged_effect_census: List<PrivilegedEffectSite> = [
   },
   PrivilegedEffectSite {
     site: site(module_path: "gunbc.auth.fleet_secret_accessor_roster", decl_name: "fleet_accessor_grants_converge_with_supplied_token"),
-    effect: accessor_grant(subject: "the fleet accessor roster: spark administrator password, mtcollins1 BMC credential, both approval MAC keys" as NonEmptyStr),
+    effect: accessor_grant(subject: "the fleet accessor roster: spark administrator password, mtcollins1 BMC credential, both approval MAC keys, the OpenRouter free-tier key" as NonEmptyStr),
     realized: RealizedOperatorSession { arm: OperatorTokenFile },
     divergence_reason: Present { value: interim_gcp_iam_adapter_unlanded },
   },
@@ -956,9 +1141,9 @@ data privileged_effect_census: List<PrivilegedEffectSite> = [
     divergence_reason: none,
   },
   PrivilegedEffectSite {
-    site: site(module_path: "gunbc.auth.gcp_iam_converge_run", decl_name: "gcp_iam_converge_apply_wet"),
+    site: site(module_path: "gunbc.auth.branch_run_grant", decl_name: "branch_run_grant_apply_wet"),
     effect: PrivilegedEffect {
-      subject: "converge the declared GCP IAM estate: create absent pools, providers and service accounts, and add the declared impersonation and accessor cells, including the grant sets (the R2 mint custody cells), under one operator approval of the exact diff" as NonEmptyStr,
+      subject: "let one fleet-converge branch run impersonate one run-scoped account (gunbc.auth.branch_dispatch_federation) until its start time plus the grant window: one time-conditioned workloadIdentityUser cell naming that run id, added as iam-converge under one operator approval of that run's branch, commit and dispatcher" as NonEmptyStr,
       frequency: FleetOnce,
       reversibility: ReversibleByReapply,
       surface: ApiSurface,
@@ -971,34 +1156,19 @@ data privileged_effect_census: List<PrivilegedEffectSite> = [
     divergence_reason: Present { value: gcp_iam_approval_enforced_in_reviewed_code },
   },
   PrivilegedEffectSite {
-    site: site(module_path: "gunbc.spark.pair_serving_d0_door", decl_name: "pair_serving_d0_ci_wet"),
+    site: site(module_path: "gunbc.auth.gcp_iam_converge_run", decl_name: "gcp_iam_converge_apply_wet"),
     effect: PrivilegedEffect {
-      subject: "D0: suspend a group's pair-serving authority for a keyed successor -- claim the consent slot, move the authority partition twice and finalize the host-placement preparation on the fabric DB" as NonEmptyStr,
+      subject: "converge the declared GCP IAM estate: create absent pools, providers and service accounts, and add the declared impersonation and accessor cells, including the grant sets (the R2 mint custody cells), under one operator approval of the exact diff" as NonEmptyStr,
       frequency: FleetOnce,
-      reversibility: IrreversibleEffect { what_is_lost: "the incumbent pair's serving authority: a suspended authority is not restored by re-applying, only by a further authority transition" as NonEmptyStr },
+      reversibility: ReversibleByReapply,
       surface: ApiSurface,
-      workload_identity: WorkloadIdentityBindable { member: "ghrunner on srv1, the dispatched fleet-converge run's host principal on the placed fabric DB host" as NonEmptyStr },
+      workload_identity: grant_administrator_unbindable,
       minted_reach: MintsNoCredential,
       billing: NoBillingConsequence,
       witness_discharge: NoWitnessDischarge,
     },
-    realized: RealizedUnauthorized,
-    divergence_reason: Present { value: fabric_store_write_unverified },
-  },
-  PrivilegedEffectSite {
-    site: site(module_path: "gunbc.spark.pair_serving_d0_door", decl_name: "d0_standing_grant_for"),
-    effect: PrivilegedEffect {
-      subject: "D0: release a group's pair-serving authority to the fleet under a committed standing grant -- claim the consent slot, read every host quiescent fresh, and move the authority partition to ReleasedToFleet" as NonEmptyStr,
-      frequency: FleetOnce,
-      reversibility: IrreversibleEffect { what_is_lost: "the group's pair-serving authority: a released authority is not restored by re-applying, only by a new establish" as NonEmptyStr },
-      surface: ApiSurface,
-      workload_identity: WorkloadIdentityBindable { member: "ghrunner on srv1, the dispatched fleet-converge run's host principal on the placed fabric DB host" as NonEmptyStr },
-      minted_reach: MintsNoCredential,
-      billing: NoBillingConsequence,
-      witness_discharge: StandingRulingUnderInterlock { ruling: group_a_dev_standing_grant.ruling },
-    },
-    realized: RealizedUnauthorized,
-    divergence_reason: Present { value: fabric_store_write_unverified },
+    realized: RealizedFederatedGrant,
+    divergence_reason: Present { value: gcp_iam_approval_enforced_in_reviewed_code },
   },
   PrivilegedEffectSite {
     site: site(module_path: "gunbc.spark.host_commitment", decl_name: "claim_host_effect_live"),
@@ -1030,21 +1200,6 @@ data privileged_effect_census: List<PrivilegedEffectSite> = [
     realized: RealizedUnauthorized,
     divergence_reason: Present { value: fabric_store_write_unverified },
   },
-  PrivilegedEffectSite {
-    site: site(module_path: "gunbc.spark.standing_host_effect_recover", decl_name: "standing_host_effect_recover_ci_wet"),
-    effect: PrivilegedEffect {
-      subject: "release a dead lane's host-effect claim on a Group A host under the committed standing grant: exactly one unreleased claim derived from the live partition, a typed claimant disposition, a fresh quiescence read of that claim's residue, and a readback" as NonEmptyStr,
-      frequency: EveryProvision,
-      reversibility: ReversibleByReapply,
-      surface: ApiSurface,
-      workload_identity: WorkloadIdentityBindable { member: "ghrunner on srv1, the dispatched fleet-converge run's host principal on the placed fabric DB host" as NonEmptyStr },
-      minted_reach: MintsNoCredential,
-      billing: NoBillingConsequence,
-      witness_discharge: NoWitnessDischarge,
-    },
-    realized: RealizedUnauthorized,
-    divergence_reason: Present { value: fabric_store_write_unverified },
-  },
   PrivilegedEffectSite {
     site: site(module_path: "gunbc.spark.host_commitment", decl_name: "host_effect_recover_wet"),
     effect: PrivilegedEffect {
diff --git a/dag/gunbc/auth/profile_projection.dag b/dag/gunbc/auth/profile_projection.dag
index 8097529f3cf..da13dbf15ee 100644
--- a/dag/gunbc/auth/profile_projection.dag
+++ b/dag/gunbc/auth/profile_projection.dag
@@ -22,7 +22,8 @@ import extdeps.languages.json.parse {
 import extdeps.uri { Uri, Https, Http, uri_wire }
 import extdeps.tools.sha256sum { sha256sum_stdin_digest_via_shell, Sha256FileDigest, Sha256FileDigestUnavailable }
 import gunbc.principal_projection { PrincipalRef, principal_ref_label, principal_ref_parse_label }
-import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_auth_store_root, DashboardAuthProfiles }
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_private_directory }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_path }
 import gunbc.auth.session { AuthenticatedSession }
 
 // THE PROFILE PROJECTION (Cut 4 plan, docs/plans/google-workspace-identity-convergence.md
@@ -55,9 +56,14 @@ type ProfileStoreLayout {
   root: FilePath
 }
 
+// THE DIRECTORY THIS STORE DEMANDS; the layout's root is read off it (gunbc.owned_directory).
+fn profile_store_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  dashboard_instance_private_directory(instance: instance, member: "auth-profiles" as NonEmptyStr, child: "auth-profiles")
+}
+
 fn profile_store_layout_for_instance(instance: HostDashboardInstance) -> ProfileStoreLayout {
   ProfileStoreLayout {
-    root: dashboard_instance_auth_store_root(instance: instance, store: DashboardAuthProfiles),
+    root: owned_directory_path(t: profile_store_directory(instance: instance)),
   }
 }
 
diff --git a/dag/gunbc/auth/session_store.dag b/dag/gunbc/auth/session_store.dag
index b6fd50b6651..fe65083d49e 100644
--- a/dag/gunbc/auth/session_store.dag
+++ b/dag/gunbc/auth/session_store.dag
@@ -47,7 +47,8 @@ import gunbc.auth.session {
 import gunbc.principal_projection {
   PrincipalRef, principal_ref_label, principal_ref_parse_label, principal_ref_eq,
 }
-import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_auth_store_root, DashboardAuthSessions }
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_private_directory }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_path }
 
 data session_store_file_suffix: String = ".json"
 
@@ -59,11 +60,16 @@ type SessionStoreLayout {
   root: FilePath
 }
 
-// BUILT FROM THE INSTANCE the way the event carrier builds its worktree: the instance root the
-// process already owns, plus the one directory segment this store adds.
+// THE DIRECTORY THIS STORE DEMANDS, declared here because the store is what writes into it: an
+// owned-directory target (gunbc.owned_directory) under the instance root, ensured by both deployment
+// routes through gunbc.roadmap.dashboard_instance_directories, and the layout's root is read off it.
+fn session_store_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  dashboard_instance_private_directory(instance: instance, member: "auth-sessions" as NonEmptyStr, child: "auth-sessions")
+}
+
 fn session_store_layout_for_instance(instance: HostDashboardInstance) -> SessionStoreLayout {
   SessionStoreLayout {
-    root: dashboard_instance_auth_store_root(instance: instance, store: DashboardAuthSessions),
+    root: owned_directory_path(t: session_store_directory(instance: instance)),
   }
 }
 
diff --git a/dag/gunbc/auth/standing_operator_grant.dag b/dag/gunbc/auth/standing_operator_grant.dag
index 0cca4dbb43f..a28fd779d47 100644
--- a/dag/gunbc/auth/standing_operator_grant.dag
+++ b/dag/gunbc/auth/standing_operator_grant.dag
@@ -1,13 +1,18 @@
 module gunbc.auth.standing_operator_grant
 
 import std.types { String, Bool, List, NonEmptyStr, Timestamp }
+import v2.std.algebra { length }
 import product.host_identity { HostIdentity, host_identity_eq }
+import std.optional { Present }
 import std.list { list_member }
 import std.scoped_authorization { OperatorGrant, ScopedAuthorization, AuthorizationGranted, AuthorizationRequest, Unclaimed }
 import std.decl_ref { DeclarationRef, decl_ref }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_mtjade1 }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, fabric_group_wire }
-import gunbc.auth.authorization_pattern_selection { StandingDestructiveAuthorization, InterlockedBy, InterlockPending }
+import gunbc.fleet_host_identity { operator_host_mtjade1 }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire }
+import gunbc.auth.authorization_pattern_selection {
+  StandingDestructiveAuthorization, StandingRulingInterlock,
+  InterlockPending, InterlockedBy,
+}
 
 // ── A STANDING OPERATOR GRANT, COMMITTED AS A RULING ───────────────────────────────────────────
 //
@@ -27,38 +32,40 @@ import gunbc.auth.authorization_pattern_selection { StandingDestructiveAuthoriza
 // its claim, its fresh readings and its readback. And it does not widen: a group, a host or an effect
 // outside the row is not covered, and the consumer falls back to the per-effect approval it always had.
 //
-// THE EFFECTS ARE ONLY THOSE A GATE CONSUMES (DESIGN §3c, review 74624). D0's release is consumed here
-// (gunbc.spark.pair_serving_d0_door d0_gate). ArmLaunch is consumed by gunbc.spark.group_arm_launch
-// group_arm_released_launch_causes. HostEffectRecover is consumed by gunbc.spark.standing_host_effect_recover
-// recover_covering_grant. The image, checkpoint and teardown effects the Group A ruling also covers are
-// NOT rows: nothing gates them on a grant (they are fenced by the per-host claim), and an effect row
-// nothing reads would pre-authorize what no wall asks about.
+// THE EFFECTS ARE ONLY THOSE A GATE CONSUMES (DESIGN §3c, review 74624) -- AND TODAY NONE IS. The three
+// arms below were consumed by D0's release door, the group arm launch and the standing host-effect
+// recovery, all deleted with Group A (decommissioned and sold, 2026-10-07) together with the Group A grant
+// that named them. They remain only because the type cannot be empty while the mtjade1 grant's consuming
+// gates (gunbc#13497) have not landed their own arms; that change replaces them, and no grant row names
+// them now.
 //
 // MTJADE1 LIVE OPS (operator ruling 2026-10-06, msg_7402f8df-7917-4b24-bb86-c4e7d51991f7) names BMC
-// reads/writes, boots, and firmware qualification. Those classes are a declared frontier: the first
-// consuming gate lands in gunbc#13497 (stern-ibex-771 route A -- bindable fleet-converge principal,
-// effect arm in the same closure as the secret/cell fetch) and must call standing_grant_covers for a
-// named arm -- O1c-3's BmcSecure authorization discharge, managed_host_boot admission/authorization,
-// or MegaRAC per-build operation evidence / admit_megarac_host_at_current_build. The prior-life archive
-// is a BMC read (it writes only our store) and has no grant arm. The mtjade1 grant's effects list is
-// empty until that change lands the arm. The interlock is InterlockPending until a consuming gate names
-// a hold: that state refuses to discharge irreversibility, so a bindable boot under this row does not
-// select federation.
+// reads/writes, boots, and firmware qualification. StandingBmcSecureAccountWrite is owned by
+// gunbc#13517 (O1c-3b): the variant, wire key, and InterlockedBy admit_rotation_apply. This module
+// consumes that arm on the mtjade1 effects list and standing_grant_arm_interlock overlay; J4 reads
+// it via grant_discharges_bmc_secure_account_write. Route A also consumes archive and firmware
+// arms (admit_arrival_subject). J6 boot stays a frontier until managed_host_boot.
 type StandingGrantEffect
   = StandingD0ReleaseToFleet
   | StandingArmLaunch
   | StandingHostEffectRecover
+  | StandingJadeArrivalArchive
+  | StandingJadeFirmwareQualification
+  | StandingBmcSecureAccountWrite
 
 fn standing_grant_effect_wire(e: StandingGrantEffect) -> NonEmptyStr {
   match e {
     StandingD0ReleaseToFleet => "d0-release-to-fleet" as NonEmptyStr
     StandingArmLaunch => "arm-launch" as NonEmptyStr
     StandingHostEffectRecover => "host-effect-recover" as NonEmptyStr
+    StandingJadeArrivalArchive => "jade-arrival-archive" as NonEmptyStr
+    StandingJadeFirmwareQualification => "jade-firmware-qualification" as NonEmptyStr
+    StandingBmcSecureAccountWrite => "bmc-secure-account-write" as NonEmptyStr
   }
 }
 
-// A GRANT BOUNDS EITHER A FABRIC GROUP AND ITS HOSTS, OR ONE NAMED HOST. Group A is the first;
-// mtjade1 is the second. Hosts live in the arm: a host-scoped grant does not restate its host in a
+// A GRANT BOUNDS EITHER A FABRIC GROUP AND ITS HOSTS, OR ONE NAMED HOST. Group A was the first (deleted
+// with the group, 2026-10-07); mtjade1 is the second. Hosts live in the arm: a host-scoped grant does not restate its host in a
 // parallel list. Coverage still requires every requested host to be in the grant's derived hosts.
 type StandingGrantScope
   = StandingGrantFabricGroup { group: FabricGroup, hosts: List<HostIdentity> }
@@ -95,43 +102,67 @@ fn standing_grant_scope_matches(g: StandingOperatorGrant, scope: StandingGrantSc
   }
 }
 
-// THE GROUP A DEVELOPMENT GRANT. The words are the operator's, given directly in the parent session on
-// 2026-10-03 and relayed by valiant-crab-775 (dashboard message msg_2940687d): "you have my permission to
-// use group A however you want from now on." The operator also ruled that the approval broker and app
-// are a separate lane and will not be set up now, so a per-effect approval for Group A cannot be met.
-// The interlock is D0's own durable claim of the consent (gunbc.spark.pair_serving_d0 d0_claim_grant):
-// the release runs only under that claim, its pending state and its fresh all-quiescent reading.
-data group_a_dev_standing_grant: StandingOperatorGrant = StandingOperatorGrant {
-  identity: "group-a-dev-standing-grant-2026-10-03" as NonEmptyStr,
-  principal: "operator" as NonEmptyStr,
-  ruled_at: "2026-10-03T05:00:00Z",
-  ruling: StandingDestructiveAuthorization {
-    ruling_text: "Operator ruling 2026-10-03, given directly in valiant-crab-775's session and relayed by dashboard message msg_2940687d: 'you have my permission to use group A however you want from now on.' The approval broker and app are a separate lane and will not be set up now. Scope as relayed: FabricGroupA hosts srv5-srv8; the D0 release-to-fleet plus the GLM staircase's host effects (image produce and distribute, checkpoint materialize, arm launch and teardown), and, per valiant-crab-775 on 2026-10-03, recovering a dead lane's host-effect claim on a Group A host after a fresh quiescence read. Group B is outside it." as NonEmptyStr,
-    effect_subject: "Group A development effects: the D0 release-to-fleet of Group A's pair-serving authority and the GLM-5.3-Flash staircase's host effects on srv5-srv8" as NonEmptyStr,
-    interlock: InterlockedBy { hold: decl_ref(module_path: "gunbc.spark.pair_serving_d0", decl_name: "d0_claim_grant") },
-  },
-  scope: StandingGrantFabricGroup { group: FabricGroupA, hosts: [operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8] },
-  effects: [StandingD0ReleaseToFleet, StandingArmLaunch, StandingHostEffectRecover],
-}
-
 // THE MTJADE1 LIVE-OPS GRANT. The words are the operator's, given directly in eager-gull-22's session
 // on 2026-10-06 and relayed by dashboard message msg_7402f8df-7917-4b24-bb86-c4e7d51991f7: "live operations
 // on mtjade1 are authorized whenever, indefinitely. That covers BMC reads and writes (history archive,
 // login/credential change), boots, and firmware qualification on Mt. Jade, with no per-run approval
 // needed. Scope is mtjade1 only; mtcollins1 wet steps still need their own go-ahead." Quote unchanged.
-// Effects list empty: no consuming gate has landed (O1c-3 BmcSecure discharge, managed_host_boot
-// authorization, MegaRAC current-build admission). The prior-life archive is not an arm.
+// Grant grain stays InterlockPending (no blanket hold; unnamed classes such as J6 boot still refuse
+// to discharge). Landed arms are InterlockedBy named holds via standing_grant_arm_interlock.
+// StandingJadeFirmwareQualification stays InterlockPending until a held writer lands.
+// StandingBmcSecureAccountWrite's overlay hold is #13517's admit_rotation_apply. Mode, pool, SA and
+// secret names: operator sign-off msg_f03558d1.
+// THE BMCSECURE ARM PROMOTES ONLY THIS GRAIN. A supplied InterlockPending with any other
+// obligation, or InterlockedBy a foreign hold, stays as written so grant_discharges still
+// refuses those mutants (test.claim.machine_intake_arrival_converge_witness
+// w_bmc_secure_apply_pending_interlock_refuses_at_discharge).
+data mtjade1_grant_grain_pending_obligation: NonEmptyStr = "grant grain names no hold; landed arms name holds via standing_grant_arm_interlock; J6 boot remains pending until managed_host_boot" as NonEmptyStr
+
 data mtjade1_live_standing_grant: StandingOperatorGrant = StandingOperatorGrant {
   identity: "mtjade1-live-standing-grant-2026-10-06" as NonEmptyStr,
   principal: "operator" as NonEmptyStr,
   ruled_at: "2026-10-06T00:00:00Z",
   ruling: StandingDestructiveAuthorization {
     ruling_text: "Operator ruling 2026-10-06, given directly in eager-gull-22's session and relayed by dashboard message msg_7402f8df-7917-4b24-bb86-c4e7d51991f7: 'live operations on mtjade1 are authorized whenever, indefinitely. That covers BMC reads and writes (history archive, login/credential change), boots, and firmware qualification on Mt. Jade, with no per-run approval needed. Scope is mtjade1 only; mtcollins1 wet steps still need their own go-ahead.'" as NonEmptyStr,
-    effect_subject: "mtjade1 live operations: BMC credential/login writes, boots, and MegaRAC firmware qualification -- effect rows only as consuming gates land" as NonEmptyStr,
-    interlock: InterlockPending { obligation: "consuming gates (O1c-3 BmcSecure authorization discharge, managed_host_boot admission, MegaRAC current-build admission) have not named a hold" as NonEmptyStr },
+    effect_subject: "mtjade1 live operations: BMC credential/login writes, boots, and MegaRAC firmware qualification -- effect rows only as consuming gates land. Arrival mode/input/pair/secret names (arrival_converge, arrival_subject, github-mtjade1-arrival, mtjade1-arrival@gunbai-secrets.iam.gserviceaccount.com, bmc-mtjade1-gunbc) signed off msg_f03558d1." as NonEmptyStr,
+    interlock: InterlockPending { obligation: mtjade1_grant_grain_pending_obligation },
   },
   scope: StandingGrantHost { host: operator_host_mtjade1 },
-  effects: [] as List<StandingGrantEffect>,
+  effects: [StandingJadeArrivalArchive, StandingJadeFirmwareQualification, StandingBmcSecureAccountWrite],
+}
+
+fn standing_grant_arm_interlock(g: StandingOperatorGrant, e: StandingGrantEffect) -> StandingRulingInterlock {
+  match e {
+    StandingD0ReleaseToFleet => g.ruling.interlock
+    StandingArmLaunch => g.ruling.interlock
+    StandingHostEffectRecover => g.ruling.interlock
+    StandingJadeArrivalArchive => InterlockedBy {
+      hold: decl_ref(module_path: "gunbc.machine_intake_arrival_interlock", decl_name: "arrival_archive_slot_acquire"),
+    }
+    StandingJadeFirmwareQualification => InterlockPending {
+      obligation: "firmware qualification writer is not in converge_mtjade1_arrival_prefix; discharge only when that writer runs under ArrivalArchiveSlotHeld from arrival_archive_slot_acquire" as NonEmptyStr,
+    }
+    StandingBmcSecureAccountWrite =>
+      match g.ruling.interlock {
+        InterlockPending { obligation: o } =>
+          if (o as String) == (mtjade1_grant_grain_pending_obligation as String) {
+            InterlockedBy {
+              hold: decl_ref(module_path: "gunbc.machine_intake_bmc_rotation_route", decl_name: "admit_rotation_apply"),
+            }
+          } else {
+            InterlockPending { obligation: o }
+          }
+        InterlockedBy { hold: h } => InterlockedBy { hold: h }
+      }
+  }
+}
+
+fn standing_ruling_with_arm_interlock(g: StandingOperatorGrant, e: StandingGrantEffect) -> StandingDestructiveAuthorization {
+  StandingDestructiveAuthorization {
+    ruling_text: g.ruling.ruling_text,
+    effect_subject: g.ruling.effect_subject,
+    interlock: standing_grant_arm_interlock(g: g, e: e),
+  }
 }
 
 // COVERAGE IS AN IDENTITY JOIN: the scope is the grant's, the effect is one of its effects, and EVERY host
diff --git a/dag/gunbc/bmc/bmc_converge.dag b/dag/gunbc/bmc/bmc_converge.dag
index 0795369404d..6d6ed8c792c 100644
--- a/dag/gunbc/bmc/bmc_converge.dag
+++ b/dag/gunbc/bmc/bmc_converge.dag
@@ -1,5 +1,6 @@
 module gunbc.bmc_converge
 
+import extdeps.board_authority { BoardAuthorityRef }
 import extdeps.bmc.capability {
   BmcFirmwareIntent,
   BmcFirmwareIntentMismatch,
@@ -20,7 +21,6 @@ import extdeps.bmc.types {
   BmcOverlayConfigObserved,
   BmcUpdateServiceObservation,
 }
-import extdeps.boards.types { BaseboardModel }
 import extdeps.crypto.hash { Digest }
 import extdeps.filesystem.linux {
   linux_overlay_observation_is_flash_backed,
@@ -98,7 +98,7 @@ import std.upsert_decision {
 
 type ApprovedBmcFirmwareArtifact {
   firmware: BmcFirmwareVersion
-  board: BaseboardModel
+  board: BoardAuthorityRef
   image_uri: Uri
   digest: Digest
 }
@@ -254,7 +254,7 @@ fn bmc_firmware_intent_mismatch_reason(
 
 fn bmc_firmware_classification(
   host: HostIdentity,
-  board: BaseboardModel,
+  board: BoardAuthorityRef,
   intent: BmcFirmwareIntent,
   observation: BmcFirmwareObservation?,
   artifact: ApprovedBmcFirmwareArtifact?,
@@ -421,7 +421,7 @@ fn bmc_fan_config_persistence_apply_suitability(
 fn bmc_fan_policy_apply_suitability(
   standings: List<HostBmcFanAlignmentStanding>,
   host: HostIdentity,
-  board: BaseboardModel,
+  board: BoardAuthorityRef,
   intent: BmcControlPlaneIntent,
   observation: BmcFanPolicyObservation,
   persistence: BmcConfigPersistenceObservation?,
@@ -867,7 +867,7 @@ fn bmc_fan_firmware_blocks_realizer(
 fn bmc_fan_policy_qualify_with_projection(
   standings: List<HostBmcFanAlignmentStanding>,
   host: HostIdentity,
-  board: BaseboardModel,
+  board: BoardAuthorityRef,
   intent: BmcControlPlaneIntent,
   observed: BmcFanPolicyObservation,
   persistence: BmcConfigPersistenceObservation?,
@@ -976,7 +976,7 @@ fn bmc_fan_policy_qualify_with_projection(
 fn bmc_fan_policy_classification(
   standings: List<HostBmcFanAlignmentStanding>,
   host: HostIdentity,
-  board: BaseboardModel,
+  board: BoardAuthorityRef,
   intent: BmcControlPlaneIntent,
   observation: BmcFanPolicyObservation?,
   persistence: BmcConfigPersistenceObservation?,
diff --git a/dag/gunbc/bmc/bmc_fan_converge.dag b/dag/gunbc/bmc/bmc_fan_converge.dag
index c3649235376..eebcaa4fef4 100644
--- a/dag/gunbc/bmc/bmc_fan_converge.dag
+++ b/dag/gunbc/bmc/bmc_fan_converge.dag
@@ -1,5 +1,6 @@
 module gunbc.bmc_fan_converge
 
+import extdeps.board_authority { BoardAuthorityRef }
 import std.dissolution { DissolutionCondition, dissolution_description, unbound_dissolution }
 
 import std.algebra { trim }
@@ -78,7 +79,6 @@ import extdeps.bmc.openbmc_fan_control {
   openbmc_zone_failsafe,
   openbmc_tach_health,
 }
-import extdeps.boards.types { BaseboardModel }
 import extdeps.crypto.hash { Digest }
 import extdeps.filesystem.linux {
   LinuxOverlayParsed,
@@ -199,7 +199,7 @@ data bmc_fan_atomic_transaction_dissolution_trigger: DissolutionCondition = unbo
 
 type BmcFanConvergeTarget {
   host: ComputeHost
-  board: BaseboardModel
+  board: BoardAuthorityRef
   onboarding: BmcOnboardingPlan
   projection: BmcFanPolicyProjectionCapability?
   durability_generation: StatePerturbationGeneration
diff --git a/dag/gunbc/bmc/bmc_fan_projection.dag b/dag/gunbc/bmc/bmc_fan_projection.dag
index ce43ac08209..43331dabe72 100644
--- a/dag/gunbc/bmc/bmc_fan_projection.dag
+++ b/dag/gunbc/bmc/bmc_fan_projection.dag
@@ -1,5 +1,6 @@
 module gunbc.bmc_fan_projection
 
+import extdeps.board_authority { BoardAuthorityRef }
 import extdeps.bmc.capability { BmcFirmwareVersion }
 import extdeps.bmc.types {
   BmcFanAggregatedControllerTopology,
@@ -8,7 +9,6 @@ import extdeps.bmc.types {
   BmcFanPolicyObservation,
   bmc_fan_controller_shape_aggregated_topology,
 }
-import extdeps.boards.types { BaseboardModel }
 import extdeps.crypto.hash { Digest, sha256_digest }
 import std.measure {
   celsius,
@@ -112,7 +112,7 @@ type BmcFanDurabilityEvidence =
   StateDurabilityEvidence<HostIdentity, BmcFanConfigReadbackSubject>
 
 type BmcFanPolicyProjectionCapability {
-  board: BaseboardModel
+  board: BoardAuthorityRef
   firmware: BmcFirmwareVersion
   projected_curve: BmcFanCurve
   projected_config_digest: Digest
@@ -255,7 +255,7 @@ fn bmc_fan_admitted_config_digest(
 }
 
 fn bmc_fan_policy_projection_capability(
-  board: BaseboardModel,
+  board: BoardAuthorityRef,
   firmware: BmcFirmwareVersion,
   projected_curve: BmcFanCurve,
   projected_config_digest: Digest,
@@ -306,7 +306,7 @@ fn bmc_fan_policy_projection_capability(
 // program from passing as suitable.
 fn bmc_fan_policy_projection_apply_suitability(
   capability: BmcFanPolicyProjectionCapability,
-  board: BaseboardModel,
+  board: BoardAuthorityRef,
   desired_curve: BmcFanCurve,
   observation: BmcFanPolicyObservation,
   host: HostIdentity,
diff --git a/dag/gunbc/bmc/bmc_onboarding.dag b/dag/gunbc/bmc/bmc_onboarding.dag
index 8671f924544..631ab9b67af 100644
--- a/dag/gunbc/bmc/bmc_onboarding.dag
+++ b/dag/gunbc/bmc/bmc_onboarding.dag
@@ -9,8 +9,8 @@ import extdeps.bmc.types { RedfishBootSourceOverrideTarget, RedfishAccountRole,
 import gunbc.auth.access_token_source { AccessEnsurePlan }
 import extdeps.bmc.openbmc { openbmc_factory_login }
 import extdeps.boards.asrock_rack { asrock_altrad8ud_redfish_system_id }
-import gunbc.fleet_intent { srv1_baseboard, srv2_baseboard, srv3_baseboard, srv4_baseboard }
-import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
+import gunbc.fleet_intent { srv1_baseboard, srv2_baseboard, srv3_baseboard, srv4_baseboard, srv13_baseboard }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4, operator_host_srv13 }
 import product.host_identity { HostIdentity }
 
 // QUARANTINED LEGACY LIFECYCLE (machine-intake ruling 2026-08-29, answer (b)).
@@ -253,6 +253,8 @@ data srv3_onboarding_plan: BmcOnboardingPlan = altra_onboarding_plan(host: opera
 
 data srv4_onboarding_plan: BmcOnboardingPlan = altra_onboarding_plan(host: operator_host_srv4, bmc_host: srv4_baseboard.bmc.host)
 
+data srv13_onboarding_plan: BmcOnboardingPlan = altra_onboarding_plan(host: operator_host_srv13, bmc_host: srv13_baseboard.bmc.host)
+
 // srv1 AND srv2 JOIN THE LIFECYCLE srv3 AND srv4 WENT THROUGH, with their BMC endpoints read from the
 // fleet intent rather than retyped. They do NOT start from the factory credential: both were brought
 // up by hand on an operator-chosen root password (operator, 2026-09-18), and the one factory probe
diff --git a/dag/gunbc/bmc_dry_realization.dag b/dag/gunbc/bmc_dry_realization.dag
index 373a2e849af..941a4591a17 100644
--- a/dag/gunbc/bmc_dry_realization.dag
+++ b/dag/gunbc/bmc_dry_realization.dag
@@ -233,7 +233,7 @@ fn megarac_bindings<S>(get: fn(S) -> MegaRacMediaWorld, put: fn(S, MegaRacMediaW
   [
     OperationBinding { at: megarac_operation(operation: "OpenSession"), handler: fn(state, call) {
       let opened = megarac_open_session(world: get(state), cookie_jar: call_text(call: call, name: "cookie_jar"))
-      curl_answer(state: put(state, opened.world), exit_code: 0, stdout: megarac_session_body(racsession_id: opened.racsession_id, csrf_token: opened.csrf_token), stderr: "")
+      curl_answer(state: put(state, opened.world), exit_code: 0, stdout: megarac_session_body(csrf_token: opened.csrf_token), stderr: "")
     } },
     OperationBinding { at: megarac_operation(operation: "ProbeSessionOnMediaRoute"), handler: fn(state, call) {
       if megarac_session_valid(world: get(state), cookie_jar: call_text(call: call, name: "cookie_jar"), csrf_token: call_text(call: call, name: "csrf_token")) {
diff --git a/dag/gunbc/bmc_megarac_web_adapter.dag b/dag/gunbc/bmc_megarac_web_adapter.dag
deleted file mode 100644
index b58fe10b162..00000000000
--- a/dag/gunbc/bmc_megarac_web_adapter.dag
+++ /dev/null
@@ -1,255 +0,0 @@
-module gunbc.bmc_megarac_web_adapter
-
-import std.types { Bool, HttpStatus, Int, List, Map }
-import std.measure { Second, second_count }
-import v2.std.collection { empty_map, map_insert, map_lookup }
-import std.algebra { Empty, Cons }
-import std.optional { Present, Absent }
-import extdeps.languages.json.emit { JsonValue, json_object, json_array, json_kv, json_int, json_bool, json_string, json_null, serialize_json }
-import extdeps.bmc.megarac {
-  MegaRacLoginSession, megarac_login_session_json, megarac_services_kvm_json, megarac_kvm_websocket_path,
-}
-import gunbc.bmc_model {
-  BmcWorld, BmcEvent, BmcScheduledEvent, BmcAcPowerLost, BmcPowerRestored, BmcSolSessionDropped, BmcKvmStreamClosed, BootOverrideNone, BootOverrideCdromEfiNextBoot, BmcPowerOn, BmcPowerOff, BmcKvmIdle, BmcKvmStreaming, BmcKvmClosedByController, BmcWebLoginAccepted, BmcWebLoginRefused,
-  bmc_web_login, bmc_kvm_viewer_count, bmc_kvm_connect, bmc_web_logout, bmc_advance,
-}
-
-// THE PROTOCOL ADAPTER BETWEEN THE ONE BMC MODEL AND A REAL HTTP+WebSocket CLIENT: the second
-// adapter over gunbc.bmc_model, beside gunbc.bmc_dry_realization. It holds no controller state and
-// decides nothing: every answer is a gunbc.bmc_model transition, encoded with the extdeps.bmc.megarac
-// wire renderers.
-//
-// A TRANSITION TABLE, NOT A TRANSCRIPT (hold on gunbc#12490, 2026-09-28). The adapter explores the
-// model from the initial world over a finite request alphabet -- login with each credential pair it
-// is asked about, the services read, connect and logout with every token a reachable world holds plus
-// one foreign token, and an advance to each scheduled event's instant -- and records, for each
-// reachable world and each request, the model's answer and the world it leads to. The transport keys
-// every ACTUAL request by what it carries (the submitted credentials, the X-CSRFTOKEN header, the
-// /kvm token) against the CURRENT world, answers with that row and moves to its world. A request
-// the table does not hold is refused as unmodeled; the transport never decides a BMC question itself.
-//
-// TIME IS AN INPUT, AND ABSOLUTE. A scheduled event fires at its instant on the world's clock -- the
-// transport's start -- not at a delay from each connection: an advance row exists only at the event's
-// own instant.
-type MegaRacWebRequest
-  = MegaRacWebLogin { username: String, password: String }
-  | MegaRacWebServices {}
-  | MegaRacWebConnect { token: String }
-  | MegaRacWebLogout { token: String }
-  | MegaRacWebAdvance { at: Second }
-
-// A REQUEST, ENCODED WITH ITS FIELD BOUNDARIES: the operation and its arguments as a JSON object, so
-// ("admin", "pw secret") and ("admin pw", "secret") can never become one row. The transport keys an
-// incoming request by the same structure (operation plus argument list), never by a joined string.
-fn megarac_web_request_json(r: MegaRacWebRequest) -> JsonValue {
-  let op_args = match r {
-    MegaRacWebLogin { username: u, password: p } => ["login", u, p]
-    MegaRacWebServices {} => ["services"]
-    MegaRacWebConnect { token: t } => ["connect", t]
-    MegaRacWebLogout { token: t } => ["logout", t]
-    MegaRacWebAdvance { at: a } => ["advance", to_string(second_count(s: a) as Int)]
-  }
-  json_object(members: [
-    json_kv(key: "op", value: json_string(s: match op_args.first() { Present { value: o } => o  Absent => "" })),
-    json_kv(key: "args", value: json_array(elements: map(op_args.skip(n: 1), x => json_string(s: x)))),
-  ])
-}
-
-// The answer a request gets, and the stream the transport must hold after it.
-type MegaRacWebAnswer {
-  status: HttpStatus
-  body: String
-  stream_open: Bool
-}
-
-type MegaRacWebStep {
-  world: BmcWorld
-  answer: MegaRacWebAnswer
-}
-
-fn megarac_stream_open(world: BmcWorld) -> Bool {
-  match world.web.kvm {
-    BmcKvmStreaming { session: _ } => true
-    BmcKvmIdle {} => false
-    BmcKvmClosedByController { session: _ } => false
-  }
-}
-
-// THE RENDERER'S REFUSALS. 0.32's refusal wire was not captured (extdeps.bmc.megarac states none), so a
-// refused login, connect or logout is rendered with these statuses and an empty JSON object. They are
-// this adapter's choice, typed as such: the observer keys only on "not ok === 0" and "no 101", so no
-// claim about the controller rests on them. A captured refusal replaces them.
-data megarac_web_login_refusal_status: HttpStatus = 401
-data megarac_web_connect_refusal_status: HttpStatus = 403
-data megarac_web_logout_refusal_status: HttpStatus = 401
-
-fn megarac_web_refusal(world: BmcWorld, status: HttpStatus) -> MegaRacWebAnswer {
-  MegaRacWebAnswer { status: status, body: serialize_json(v: json_object(members: [])), stream_open: megarac_stream_open(world: world) }
-}
-
-// ONE REQUEST AGAINST ONE WORLD, answered by the model.
-fn megarac_web_step(world: BmcWorld, request: MegaRacWebRequest, extended_privilege: Int) -> MegaRacWebStep {
-  match request {
-    MegaRacWebLogin { username: u, password: p } => {
-      let login = bmc_web_login(world: world, username: u, password: p)
-      match login.reply {
-        BmcWebLoginAccepted { session: x } =>
-          MegaRacWebStep { world: login.world, answer: MegaRacWebAnswer { status: 200, body: serialize_json(v: megarac_login_session_json(session: MegaRacLoginSession { csrf_token: x.csrf_token, privilege: x.privilege, extended_privilege: extended_privilege, racsession_id: x.id })), stream_open: megarac_stream_open(world: login.world) } }
-        BmcWebLoginRefused {} =>
-          MegaRacWebStep { world: login.world, answer: megarac_web_refusal(world: login.world, status: megarac_web_login_refusal_status) }
-      }
-    }
-    MegaRacWebServices {} =>
-      MegaRacWebStep { world: world, answer: MegaRacWebAnswer { status: 200, body: serialize_json(v: megarac_services_kvm_json(viewer_count: bmc_kvm_viewer_count(world: world))), stream_open: megarac_stream_open(world: world) } }
-    MegaRacWebConnect { token: t } => {
-      let c = bmc_kvm_connect(world: world, csrf_token: t)
-      MegaRacWebStep { world: c.world, answer: if c.accepted { MegaRacWebAnswer { status: 101, body: "", stream_open: megarac_stream_open(world: c.world) } } else { megarac_web_refusal(world: c.world, status: megarac_web_connect_refusal_status) } }
-    }
-    MegaRacWebLogout { token: t } => {
-      let o = bmc_web_logout(world: world, csrf_token: t)
-      MegaRacWebStep { world: o.world, answer: if o.released { MegaRacWebAnswer { status: 200, body: serialize_json(v: json_object(members: [])), stream_open: megarac_stream_open(world: o.world) } } else { megarac_web_refusal(world: o.world, status: megarac_web_logout_refusal_status) } }
-    }
-    MegaRacWebAdvance { at: a } => {
-      let w = bmc_advance(world: world, now: a)
-      MegaRacWebStep { world: w, answer: MegaRacWebAnswer { status: 200, body: "", stream_open: megarac_stream_open(world: w) } }
-    }
-  }
-}
-
-// A WORLD'S IDENTITY IN THE TABLE IS ITS COMPLETE CANONICAL ENCODING: every field of the world --
-// power, the pending schedule (each event's instant and kind), the fired history, and every web field
-// (the account, the sessions, the next session id, the other viewers, the stream, the canvas flag) --
-// through the typed JSON emitter (extdeps.languages.json.emit), whose serialization is canonical for a
-// given value. Two worlds are one table state exactly when these encodings are equal, and the
-// encoding omits nothing a transition reads, so two worlds that would answer any request differently
-// can never share a row. It is an exact key rather than a digest: a world is a record value, not a
-// v2.std.node Node, and std.content_hash over its encoding would add a collision disposition without
-// removing any work, since the table carries the key itself.
-fn bmc_event_json(e: BmcEvent) -> JsonValue {
-  match e {
-    BmcAcPowerLost {} => json_string(s: "ac_power_lost")
-    BmcKvmStreamClosed {} => json_string(s: "kvm_stream_closed")
-    BmcPowerRestored {} => json_string(s: "power_restored")
-    BmcSolSessionDropped {} => json_string(s: "sol_session_dropped")
-  }
-}
-
-fn bmc_scheduled_json(e: BmcScheduledEvent) -> JsonValue {
-  json_object(members: [json_kv(key: "at", value: json_int(n: second_count(s: e.at) as Int)), json_kv(key: "event", value: bmc_event_json(e: e.event))])
-}
-
-fn megarac_web_world_json(world: BmcWorld) -> JsonValue {
-  json_object(members: [
-    json_kv(key: "power", value: json_string(s: match world.power { BmcPowerOn => "on"  BmcPowerOff => "off" })),
-    json_kv(key: "pending", value: json_array(elements: map(world.pending, e => bmc_scheduled_json(e: e)))),
-    json_kv(key: "fired", value: json_array(elements: map(world.fired, e => bmc_scheduled_json(e: e)))),
-    json_kv(key: "account", value: match world.web.account {
-      Absent => json_null()
-      Present { value: a } => json_object(members: [json_kv(key: "username", value: json_string(s: a.username)), json_kv(key: "password", value: json_string(s: a.password)), json_kv(key: "privilege", value: json_int(n: a.privilege))])
-    }),
-    json_kv(key: "sessions", value: json_array(elements: map(world.web.sessions, x => json_object(members: [json_kv(key: "id", value: json_int(n: x.id)), json_kv(key: "csrf", value: json_string(s: x.csrf_token)), json_kv(key: "privilege", value: json_int(n: x.privilege))])))),
-    json_kv(key: "next", value: json_int(n: world.web.next_session_id)),
-    json_kv(key: "others", value: json_int(n: world.web.other_kvm_viewers)),
-    json_kv(key: "kvm", value: match world.web.kvm {
-      BmcKvmIdle {} => json_string(s: "idle")
-      BmcKvmStreaming { session: k } => json_array(elements: [json_string(s: "streaming"), json_int(n: k)])
-      BmcKvmClosedByController { session: k } => json_array(elements: [json_string(s: "closed"), json_int(n: k)])
-    }),
-    json_kv(key: "canvas_readable", value: json_bool(b: world.web.canvas_readable)),
-    json_kv(key: "boot_override", value: json_string(s: match world.boot_override { BootOverrideNone => "none"  BootOverrideCdromEfiNextBoot => "cdrom_efi_next_boot" })),
-    json_kv(key: "sel", value: json_array(elements: map(world.sel, r => json_array(elements: [json_string(s: r.id_hex), json_string(s: r.date), json_string(s: r.time), json_string(s: r.sensor), json_string(s: r.event), json_string(s: r.state)])))),
-    json_kv(key: "sol_session_open", value: json_bool(b: world.sol_session_open)),
-    json_kv(key: "cycle_off_interval", value: json_int(n: second_count(s: world.cycle_off_interval) as Int)),
-    json_kv(key: "host_booted_at", value: match world.host_booted_at { Absent => json_null()  Present { value: t } => json_int(n: second_count(s: t) as Int) }),
-    json_kv(key: "booted_via_override", value: json_bool(b: world.booted_via_override)),
-    json_kv(key: "sol_drop_after_boot", value: match world.sol_drop_after_boot { Absent => json_null()  Present { value: t } => json_int(n: second_count(s: t) as Int) }),
-  ])
-}
-
-fn megarac_web_world_text(world: BmcWorld) -> String {
-  serialize_json(v: megarac_web_world_json(world: world))
-}
-
-data megarac_web_foreign_token: String = "csrf-foreign"
-
-// THE REQUESTS ASKED OF ONE WORLD: the credential pairs the caller names, the services read, connect
-// and logout with every token this world holds plus the foreign one, and an advance to each pending
-// event's instant.
-fn megarac_web_alphabet(world: BmcWorld, credentials: List<MegaRacWebRequest>) -> List<MegaRacWebRequest> {
-  let tokens: List<String> = map(world.web.sessions, x => x.csrf_token).concat([megarac_web_foreign_token])
-  let connects: List<MegaRacWebRequest> = map(tokens, t => MegaRacWebConnect { token: t })
-  let logouts: List<MegaRacWebRequest> = map(tokens, t => MegaRacWebLogout { token: t })
-  let advances: List<MegaRacWebRequest> = map(world.pending, e => MegaRacWebAdvance { at: e.at })
-  credentials.concat([MegaRacWebServices {}]).concat(connects).concat(logouts).concat(advances)
-}
-
-type MegaRacWebRow {
-  from: String
-  request: MegaRacWebRequest
-  answer: MegaRacWebAnswer
-  to: String
-}
-
-// THE EXPLORATION'S ACCUMULATORS ARE LINEAR IN WHAT THEY HOLD: rows and the frontier grow by a Cons
-// prepend (their order carries no meaning -- the transport keys rows, and a depth level is a set), and
-// the seen worlds are a v2.std.collection Map, so membership is a lookup, not a scan.
-type MegaRacWebExploration {
-  frontier: List<BmcWorld>
-  seen: Map<String, Bool>
-  rows: List<MegaRacWebRow>
-}
-
-fn megarac_web_explore_world(acc: MegaRacWebExploration, world: BmcWorld, credentials: List<MegaRacWebRequest>, extended_privilege: Int) -> MegaRacWebExploration {
-  let from = megarac_web_world_text(world: world)
-  fold(megarac_web_alphabet(world: world, credentials: credentials), acc, (a, r) => {
-    let step = megarac_web_step(world: world, request: r, extended_privilege: extended_privilege)
-    let to = megarac_web_world_text(world: step.world)
-    let row = MegaRacWebRow { from: from, request: r, answer: step.answer, to: to }
-    match map_lookup(m: a.seen, key: to) {
-      Present { value: _ } => MegaRacWebExploration { frontier: a.frontier, seen: a.seen, rows: Cons { head: row, tail: a.rows } }
-      Absent => MegaRacWebExploration { frontier: Cons { head: step.world, tail: a.frontier }, seen: map_insert(m: a.seen, key: to, value: true), rows: Cons { head: row, tail: a.rows } }
-    }
-  })
-}
-
-// Breadth-first to a bounded depth. A request sequence longer than the depth reaches a world the
-// table does not describe, and the transport refuses there rather than guessing.
-fn megarac_web_explore(frontier: List<BmcWorld>, seen: Map<String, Bool>, rows: List<MegaRacWebRow>, depth: Int, credentials: List<MegaRacWebRequest>, extended_privilege: Int) -> List<MegaRacWebRow> {
-  if depth <= 0 || count(frontier) == 0 { rows } else {
-    let start: MegaRacWebExploration = MegaRacWebExploration { frontier: Empty, seen: seen, rows: rows }
-    let next: MegaRacWebExploration = fold(frontier, start, (acc, w) => megarac_web_explore_world(acc: acc, world: w, credentials: credentials, extended_privilege: extended_privilege))
-    megarac_web_explore(frontier: next.frontier, seen: next.seen, rows: next.rows, depth: depth - 1, credentials: credentials, extended_privilege: extended_privilege)
-  }
-}
-
-// THE DEPTH A SERVED TABLE IS EXPLORED TO: long enough for a client's whole session (login, services,
-// connect, the controller's own events, logout) with room for a retry. A caller asking a narrower
-// question -- one transition -- names a smaller depth.
-data megarac_web_exploration_depth: Int = 6
-
-// CONSUMER (DESIGN §3c, declared frontier). megarac_web_transition_table is consumed by the loopback
-// transport in gunbc#12492 (gunbc.bmc_megarac_web_transport), which enforces it against every real
-// request the KVM observer's failure controls send -- viewer seat busy, /kvm closed mid session,
-// canvas unreadable. TRIGGER: gunbc#12492 lands. The transport itself, and its process lifecycle, are
-// in that change beside their consumers; this module stays pure.
-//
-// THE TABLE THE TRANSPORT ENFORCES, as one JSON document: the initial world, the canvas flag, the
-// /kvm path, and one row per (world, request): from, the structured request, status, stream_open, to,
-// body. The transport refuses a table in which two rows share a (world, request).
-fn megarac_web_transition_table(initial: BmcWorld, credentials: List<MegaRacWebRequest>, extended_privilege: Int, depth: Int) -> String {
-  let start = megarac_web_world_text(world: initial)
-  let rows = megarac_web_explore(frontier: [initial], seen: map_insert(m: empty_map(), key: start, value: true), rows: Empty, depth: depth, credentials: credentials, extended_privilege: extended_privilege)
-  serialize_json(v: json_object(members: [
-    json_kv(key: "initial", value: json_string(s: start)),
-    json_kv(key: "canvas_readable", value: json_bool(b: initial.web.canvas_readable)),
-    json_kv(key: "kvm_path", value: json_string(s: megarac_kvm_websocket_path as String)),
-    json_kv(key: "rows", value: json_array(elements: map(rows, r => json_object(members: [
-      json_kv(key: "from", value: json_string(s: r.from)),
-      json_kv(key: "request", value: megarac_web_request_json(r: r.request)),
-      json_kv(key: "status", value: json_int(n: r.answer.status as Int)),
-      json_kv(key: "stream_open", value: json_bool(b: r.answer.stream_open)),
-      json_kv(key: "to", value: json_string(s: r.to)),
-      json_kv(key: "body", value: json_string(s: r.answer.body)),
-    ])))),
-  ]))
-}
diff --git a/dag/gunbc/bmc_megarac_web_transport.dag b/dag/gunbc/bmc_megarac_web_transport.dag
deleted file mode 100644
index d08d7eea69c..00000000000
--- a/dag/gunbc/bmc_megarac_web_transport.dag
+++ /dev/null
@@ -1,151 +0,0 @@
-module gunbc.bmc_megarac_web_transport
-
-import std.types { Bool, Int, List, NonEmptyStr }
-import std.algebra { trim }
-import std.measure { second }
-import std.decl_ref { DeclarationRef, WholeDeclaration }
-import std.disposition { Disposition, Scaffold, SingleAuthority }
-import std.dissolution { DissolutionCondition, unbound_dissolution }
-import std.optional { Present, Absent }
-import v2.std.algebra { filter }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import extdeps.tools.sleep { sleep_delay_seconds_second_carrier_projection }
-import gunbc.owned_process {
-  OwnedProcessStanding, OwnedRunning, OwnedGone, OwnedForeign, OwnedUnreadable, OwnedUnparseable, OwnedNotRecorded, OwnedRelease,
-  owned_process_standing, owned_process_release, owned_process_exit_prefix, owned_process_unpublished_line, owned_process_unpublished_survived_line,
-}
-
-// A LOOPBACK MegaRAC WEB CONTROLLER FOR THE KVM OBSERVER'S FAILURE CONTROLS, SERVING gunbc.bmc_model.
-// It serves the transition table gunbc.bmc_megarac_web_adapter megarac_web_transition_table derives
-// from the model: every actual request is keyed by what it carries -- the submitted credentials, the
-// X-CSRFTOKEN header, the /kvm token -- against the CURRENT world; the row's answer is sent and the
-// world advances to the row's; a request the table does not hold is refused as unmodeled (599), never
-// answered from a guess. The stream is closed whenever the world the model reaches says it is not
-// open (logout, the controller's own close), and scheduled events fire at their instant on the
-// transport's clock. It holds no BMC decision of its own: the only branching it does is the lookup.
-//
-// The stand-in viewer page is narrower than the vendor's: a canvas#kvm painted from the /kvm stream
-// once a frame arrives, drawn from a cross-origin image when the world's canvas_readable flag is false.
-// The stand-in viewer reads sessionStorage.features.indexOf(...) UNGUARDED before it opens /kvm, as the
-// served viewer.min.js does (crawl run 36787375313): a viewer opened without the feature list throws and
-// never connects, which is what KVM probe run 36788605665 did on the hardware.
-// The stand-in root page replaces itself on DOMContentLoaded and the transport logs that it was served:
-// the shape that destroyed the observer's in-page login on fleet-converge run 36721915217. An observer
-// that loads "/" and then evaluates in it fails here exactly as it did there.
-//
-// ADMISSION OF THIS SCAFFOLD (DESIGN §5, external to this diff): operator escalation msg_d5eebfff,
-// default-approved on recommendation A, 2026-09-28 -- not an explicit operator ruling.
-data megarac_web_transport_scaffold: Disposition = Scaffold {
-  dissolves_to: SingleAuthority,
-  bind: DeclarationRef {
-    module_path: "gunbc.bmc_megarac_web_transport",
-    decl_name: "megarac_web_transport_dissolution_trigger",
-    field: WholeDeclaration
-  }
-}
-
-data megarac_web_transport_dissolution_trigger: DissolutionCondition = unbound_dissolution(description: "🟡 dissolve-on: gunbc.bmc_megarac_web_transport megarac_web_transport_script -- the loopback HTTP+WebSocket transport is a node -e string that enforces a model-derived transition table. RETIRED BY THE CAPABILITY: gunbc serve WebSocket support SUFFICIENT TO SERVE THE gunbc.bmc_model KVM STREAM -- accept the /kvm upgrade, hold the connection across requests, deliver frames, and close it when a model transition leaves the stream closed, with every HTTP and upgrade request decoded, answered by the gunbc.bmc_model transition and encoded in .dag per request. HTTP-only serve support does not retire it. Admission: operator escalation msg_d5eebfff, default-approved on recommendation A, 2026-09-28")
-
-data megarac_web_transport_script: String = "const http=require('http');const crypto=require('crypto');const fs=require('fs');const [tablePath,logPath]=process.argv.slice(1);function log(m)\{fs.appendFileSync(logPath,Date.now()+' pid='+process.pid+' '+m+'\\n')}const T=JSON.parse(fs.readFileSync(tablePath,'utf8'));let current=T.initial;const canvasReadable=T.canvas_readable===true;const kvmPath=T.kvm_path;function key(op,args)\{return JSON.stringify([op].concat(args))}const rows=new Map();const advances=new Set();for(const r of T.rows)\{const k=r.from+'\\u0000'+key(r.request.op,r.request.args);if(rows.has(k))\{log('refused: duplicate table row '+JSON.stringify(k));process.exit(3)}rows.set(k,\{status:r.status,stream:r.stream_open?'open':'none',to:r.to,body:r.body});if(r.request.op==='advance')advances.add(+r.request.args[0])}let selfStart='unknown';try\{const st=fs.readFileSync('/proc/self/stat','utf8');selfStart=st.slice(st.lastIndexOf(')')+2).split(' ')[19]}catch(e)\{}let socket=null;function apply(k)\{const r=rows.get(current+'\\u0000'+k);if(!r)\{log('unmodeled state='+JSON.stringify(current)+' request='+k);return null} log('transition request='+k+' status='+r.status+' to='+JSON.stringify(r.to));current=r.to; if(socket&&r.stream!=='open')\{log('stream closed by the model');const s=socket;socket=null;s.destroy()}return r}const png=Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==','base64');const img=http.createServer((q,r)=>\{r.writeHead(200,\{'Content-Type':'image/png'});r.end(png)});function viewer()\{const port2=img.address().port;const taint=canvasReadable?'':\"const i=new Image();i.onload=()=>x.drawImage(i,0,0);i.src='http://localhost:\"+port2+\"/x.png';\"; return \"<!doctype html><canvas id=\\\"kvm\\\" width=\\\"1\\\" height=\\\"1\\\"></canvas><script>const c=document.getElementById('kvm');const x=c.getContext('2d');sessionStorage.features.indexOf('KVM_SESSION_RECONNECT');const ws=new WebSocket('ws://'+location.host+'\"+kvmPath+\"?token='+encodeURIComponent(sessionStorage.getItem('garc')||''));ws.onmessage=()=>\{c.width=800;c.height=600;x.fillStyle='#036';x.fillRect(0,0,800,600);\"+taint+\"};</script>\"}function refuse(r,key)\{r.writeHead(599,\{'Content-Type':'text/plain'});r.end('unmodeled request: '+key)}function answer(r,key)\{const t=apply(key);if(!t)return refuse(r,key);r.writeHead(t.status,\{'Content-Type':'application/json'});r.end(t.body)}const s=http.createServer((q,r)=>\{let body='';q.on('data',d=>body+=d);q.on('end',()=>\{ if(q.url==='/')\{log('spa-root served');r.writeHead(200,\{'Content-Type':'text/html'});r.end(\"<!doctype html><script>document.addEventListener('DOMContentLoaded',()=>location.replace('/login.html'))</script>\");return} if(q.url==='/login.html')\{r.writeHead(200,\{'Content-Type':'text/html'});r.end('<!doctype html>');return} if(q.url==='/viewer.html')\{r.writeHead(200,\{'Content-Type':'text/html'});r.end(viewer());return} if(q.url==='/api/session'&&q.method==='POST')\{const p=new URLSearchParams(body);return answer(r,key('login',[p.get('username')||'',p.get('password')||'']))} if(q.url==='/api/session'&&q.method==='DELETE')\{return answer(r,key('logout',[q.headers['x-csrftoken']||'']))} if(q.url==='/api/settings/services')\{return answer(r,key('services',[]))} r.writeHead(404);r.end()})});s.on('upgrade',(q,sock)=>\{const u=new URL(q.url,'http://x');if(u.pathname!==kvmPath)\{sock.destroy();return} const t=apply(key('connect',[u.searchParams.get('token')||'']));if(!t||t.status!==101)\{log('kvm refused');sock.destroy();return} const k=crypto.createHash('sha1').update(q.headers['sec-websocket-key']+'258EAFA5-E914-47DA-95CA-C5AB0DC85B11').digest('base64'); sock.write('HTTP/1.1 101 Switching Protocols\\r\\nUpgrade: websocket\\r\\nConnection: Upgrade\\r\\nSec-WebSocket-Accept: '+k+'\\r\\n\\r\\n'); sock.write(Buffer.from([0x81,0x05,0x66,0x72,0x61,0x6d,0x65]));socket=sock;log('kvm-open');sock.on('close',()=>\{if(socket===sock)socket=null})});const started=Date.now();for(const a of advances)\{setTimeout(()=>apply(key('advance',[String(a)])),a*1000)}img.listen(0,'127.0.0.1',()=>s.listen(0,'127.0.0.1',()=>log('listening start='+selfStart+' port='+s.address().port)));"
-
-// WHETHER THE TRANSPORT IS SERVING, AND IF NOT WHY. Readiness is bound to the whole launch INSTANCE:
-// only a listening line carrying BOTH the pid and the start time the owned launch recorded counts, so a
-// stale line from an earlier process -- even one the kernel gave the same pid -- never reads as ready.
-type MegaRacWebTransportCause
-  = TransportLaunchRefused { detail: String }
-  | TransportPidUnpublished
-  | TransportCleanupUnresolved { line: String }
-  | TransportExitedBeforeReady { exit_line: String }
-  | TransportReadinessForeign { lines: List<String> }
-  | TransportReadinessUnobserved { standing: OwnedProcessStanding }
-
-type MegaRacWebTransportStart
-  = TransportServing { port: String, pid: String }
-  | TransportNotServing { cause: MegaRacWebTransportCause }
-
-fn lines_of(text: String) -> List<String> {
-  filter(split(s: text, delimiter: "\n"), l => l != "")
-}
-
-fn listening_port(line: String) -> String {
-  match split(s: line, delimiter: " port=").skip(n: 1).first() {
-    Present { value: p } => trim(s: p)
-    Absent => ""
-  }
-}
-
-// A process that is not running is a transport that exited before ready, once its exit line is in the output.
-fn megarac_web_transport_exit_readiness(exit_lines: List<String>) -> MegaRacWebTransportStart? {
-  match exit_lines.first() {
-    Present { value: l } => Present { value: TransportNotServing { cause: TransportExitedBeforeReady { exit_line: l } } }
-    Absent => none
-  }
-}
-
-// ONE READINESS OBSERVATION, pure over what was read.
-fn megarac_web_transport_readiness(standing: OwnedProcessStanding, out: String, events: String) -> MegaRacWebTransportStart? {
-  let listening: List<String> = filter(lines_of(text: events), l => string_contains(s: l, pattern: " listening start="))
-  let exit_lines: List<String> = filter(lines_of(text: out), l => string_contains(s: l, pattern: owned_process_exit_prefix))
-  if string_contains(s: out, pattern: owned_process_unpublished_survived_line) {
-    Present { value: TransportNotServing { cause: TransportCleanupUnresolved { line: owned_process_unpublished_survived_line } } }
-  } else if string_contains(s: out, pattern: owned_process_unpublished_line) {
-    Present { value: TransportNotServing { cause: TransportPidUnpublished } }
-  } else {
-    match standing {
-      OwnedRunning { pid: p, start_time: st } => {
-        let mine: List<String> = filter(listening, l => string_contains(s: l, pattern: concat(" pid=", concat(p, concat(" listening start=", concat(st, " port="))))))
-        match mine.first() {
-          Present { value: l } => Present { value: TransportServing { port: listening_port(line: l), pid: p } }
-          Absent => none
-        }
-      }
-      OwnedGone { pid: _ } => megarac_web_transport_exit_readiness(exit_lines: exit_lines)
-      OwnedForeign { pid: _, observed_start: _ } => megarac_web_transport_exit_readiness(exit_lines: exit_lines)
-      OwnedUnreadable { pid: _, detail: _ } => megarac_web_transport_exit_readiness(exit_lines: exit_lines)
-      OwnedUnparseable { pid: _, detail: _ } => megarac_web_transport_exit_readiness(exit_lines: exit_lines)
-      OwnedNotRecorded { detail: _ } => megarac_web_transport_exit_readiness(exit_lines: exit_lines)
-    }
-  }
-}
-
-fn megarac_web_transport_await(pid_path: String, out_path: String, log_path: String, remaining: Int) -> MegaRacWebTransportStart {
-  let standing = owned_process_standing(pid_path: pid_path)
-  let out = Filesystem.Read(path: out_path)
-  let events = Filesystem.Read(path: log_path)
-  match megarac_web_transport_readiness(standing: standing, out: if out.success { out.content } else { "" }, events: if events.success { events.content } else { "" }) {
-    Present { value: answer } => answer
-    Absent =>
-      if remaining <= 0 {
-        let listening: List<String> = filter(lines_of(text: if events.success { events.content } else { "" }), l => string_contains(s: l, pattern: " listening start="))
-        if count(listening) > 0 { TransportNotServing { cause: TransportReadinessForeign { lines: listening } } }
-        else { TransportNotServing { cause: TransportReadinessUnobserved { standing: standing } } }
-      } else {
-        let _paced = sleep_delay_seconds_second_carrier_projection(duration: second(count: 1))
-        megarac_web_transport_await(pid_path: pid_path, out_path: out_path, log_path: log_path, remaining: remaining - 1)
-      }
-  }
-}
-
-data megarac_web_transport_ready_polls: Int = 10
-
-// SERVE a table from a directory the caller owns, under the node binary it names (the declared runner
-// toolchain's). The launch is gunbc.owned_process's; readiness is awaited and typed.
-fn megarac_web_transport_serve(dir: String, table: String, node_binary: String) -> MegaRacWebTransportStart {
-  let pid_path = concat(dir, "/transport.pid")
-  let out_path = concat(dir, "/transport.out")
-  let log_path = concat(dir, "/transport.log")
-  let table_path = concat(dir, "/table.json")
-  let wrote = Filesystem.Write(path: table_path, content: table)
-  if !wrote.success { return TransportNotServing { cause: TransportLaunchRefused { detail: concat("the table could not be written: ", wrote.error) } } }
-  let launched = gunbc.owned_process.launch.LaunchOwned(
-    pid_path: pid_path as NonEmptyStr,
-    log_path: out_path as NonEmptyStr,
-    command: [node_binary, "-e", megarac_web_transport_script, table_path, log_path],
-  )
-  if !launched.success { return TransportNotServing { cause: TransportLaunchRefused { detail: trim(s: launched.transport_stderr) } } }
-  megarac_web_transport_await(pid_path: pid_path, out_path: out_path, log_path: log_path, remaining: megarac_web_transport_ready_polls)
-}
-
-fn megarac_web_transport_stop(dir: String) -> OwnedRelease {
-  owned_process_release(pid_path: concat(dir, "/transport.pid"))
-}
diff --git a/dag/gunbc/bmc_model.dag b/dag/gunbc/bmc_model.dag
index f78873b1d0f..18f983c77a0 100644
--- a/dag/gunbc/bmc_model.dag
+++ b/dag/gunbc/bmc_model.dag
@@ -119,11 +119,11 @@ fn bmc_world(power: BmcPower) -> BmcWorld {
   }
 }
 
-// THE WEB AND KVM SURFACE OF A MegaRAC SP-X CONTROLLER (firmware 0.32; operations and wire shapes in
-// extdeps.bmc.megarac, cited there to the served source.min.js and viewer.min.js). World state only:
+// THE WEB AND KVM SURFACE OF A MANAGEMENT CONTROLLER, as this repository's own model (no vendor wire
+// shape is carried here). World state only:
 // the web sessions the controller holds, the account it accepts, the KVM viewers other clients hold,
 // and the one KVM stream this world's client may open. `canvas_readable` is a BROWSER-side fact the
-// protocol adapter reads -- whether the page's canvas can be exported -- and no transition changes it.
+// a protocol adapter would read -- whether the page's canvas can be exported -- and no transition changes it.
 type BmcWebSession {
   id: Int
   csrf_token: String
@@ -243,7 +243,7 @@ fn bmc_web_session_of_token(world: BmcWorld, csrf_token: String) -> List<BmcWebS
   filter(world.web.sessions, s => s.csrf_token == csrf_token)
 }
 
-// GET /api/settings/services, the kvm row: every viewer the controller is serving, ours included.
+// The KVM viewer count: every viewer the controller is serving, ours included.
 fn bmc_kvm_viewer_count(world: BmcWorld) -> Int {
   world.web.other_kvm_viewers + match world.web.kvm {
     BmcKvmStreaming { session: _ } => 1
@@ -259,12 +259,11 @@ type BmcKvmConnectStep {
 
 // The /kvm WebSocket for a session this world holds. A token naming no session is refused.
 //
-// OCCUPIED SEAT, A MODELING DECISION (not a captured 0.32 fact): while a stream is held -- by this
+// OCCUPIED SEAT, A MODELING DECISION (not a captured fact): while a stream is held -- by this
 // world's client or by another viewer (other_kvm_viewers) -- a further connect is REFUSED, never
-// allowed to take the stream over. The 0.32 UI checks viewer_count before it opens viewer.html and
-// reports "only one KVM session is allowed", but a read of viewer_count does not exclude a competing
-// connect arriving after it, so the model answers the connect itself. A captured multi-viewer answer
-// from the controller replaces this decision.
+// allowed to take the stream over. A read of the viewer count does not exclude a competing connect
+// arriving after it, so the model answers the connect itself. A captured multi-viewer answer from a
+// controller replaces this decision.
 fn bmc_kvm_connect(world: BmcWorld, csrf_token: String) -> BmcKvmConnectStep {
   let occupied = bmc_kvm_viewer_count(world: world) > 0
   match bmc_web_session_of_token(world: world, csrf_token: csrf_token).first() {
diff --git a/dag/gunbc/board_authority_binding.dag b/dag/gunbc/board_authority_binding.dag
new file mode 100644
index 00000000000..77e7f955a01
--- /dev/null
+++ b/dag/gunbc/board_authority_binding.dag
@@ -0,0 +1,137 @@
+module gunbc.board_authority_binding
+
+import std.types { String, NonEmptyStr, List }
+import std.optional { Present, Absent }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import std.content_hash { Sha256Digest }
+import extdeps.board_authority {
+  BoardAuthorityBinding, BoardAuthorityLookup, BoardFruIdentity, BoardFruObservation, BoardFruRead, BoardFruNotRead,
+  BoardAreaAbsent, BoardAreaFieldsUnreadable, BoardFruReceipt,
+  BoundByNameOnly, BoundByObservedEvidence, board_authority_for
+}
+import gunbc.ipmitool_fru_text { FruCaptureGap, FruCaptureUnreadable, FruCaptureDigestAgrees, FruCaptureDigestDiffers, fru_capture_digest_check, FruFieldValue, FruFieldGap, FruFieldAbsent, FruFieldRepeated, FruFieldEmpty, fru_field }
+import extdeps.filesystem.filesystem_io { Filesystem, FilesystemReadRefused, FilesystemReadSucceeded, filesystem_read_outcome }
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
+import extdeps.ocp.mt_jade.subject { mt_jade_board_authority }
+
+// THE CONSUMER-LAYER BINDING TABLE (DESIGN section 3, External upstream decomposition). A generic
+// hub may not enumerate concrete products or dispatch among their authorities, so the rows that
+// join a FRU's names to a per-board authority live here, in the workflow layer. Adding a board is
+// one per-board module plus one row here; no enum is edited.
+//
+// MT. COLLINS (FOXCONN, "Mt. Collins"): evidence-bound. The FRU names agree AND the host's own
+// physical receipts match the Getting Started Guide's figure (the 32-DIMM bring-up and the
+// physical-orientation anchors), so board FACTS may be read off this authority.
+data mtcollins1_fru_receipt: BoardFruReceipt = BoardFruReceipt {
+  artifact_path: "artifacts/bmc/mtcollins1-controller-fru-2026-09-12.txt",
+  sha256: Sha256Digest { hex: "dc63dabe07764dcf7688a74230e7fe1a6151ea384435f10460a1979eda637d3c" },
+}
+
+data mt_collins_board_binding: BoardAuthorityBinding = BoardAuthorityBinding {
+  manufacturer: "FOXCONN",
+  product: "Mt. Collins",
+  authority: mt_collins_board_authority,
+  standing: BoundByObservedEvidence {
+    first: DeclarationRef {
+      module_path: "gunbc.machine_intake_mtcollins1_32dimm_bringup_observation",
+      decl_name: "mtcollins1_dram_training_capture",
+      field: WholeDeclaration
+    },
+    further: [DeclarationRef {
+      module_path: "gunbc.machine_intake_mtcollins1_physical_orientation",
+      decl_name: "mtcollins1_three_stick_anchor",
+      field: WholeDeclaration
+    }]
+  },
+  fru_receipt: mtcollins1_fru_receipt,
+}
+
+// MT. JADE (WIWYNN, "Mt.Jade Motherboard", part B81.03010.0041): name-only. The FRU's names agree
+// with the OCP Mt. Jade reference platform's name and nothing else does yet, so this is an
+// inference from a name (DESIGN 4d), typed as a bet with the discriminator that would settle it.
+// Identity-grade uses accept it; uses that import board facts refuse it.
+data mtjade1_fru_receipt: BoardFruReceipt = BoardFruReceipt {
+  artifact_path: "artifacts/bmc/mtjade1-ipmitool-fru-print-192.168.1.246-2026-10-04T110207Z.txt",
+  sha256: Sha256Digest { hex: "1800e7394dc06a023dc4d9cda481a63fe3cf9f07ed20cb0491746c61e9baf46b" },
+}
+
+data mt_jade_board_binding: BoardAuthorityBinding = BoardAuthorityBinding {
+  manufacturer: "WIWYNN",
+  product: "Mt.Jade Motherboard",
+  authority: mt_jade_board_authority,
+  standing: BoundByNameOnly {
+    discriminator_obligation: "a measured reading on the host (DIMM population or SMBIOS slot map) agreeing with a CITED public Mt. Jade source, not the FRU name"
+  },
+  fru_receipt: mtjade1_fru_receipt,
+}
+
+data board_authority_bindings: List<BoardAuthorityBinding> = [mt_collins_board_binding, mt_jade_board_binding]
+
+fn observed_board_authority(observation: BoardFruObservation) -> BoardAuthorityLookup {
+  board_authority_for(observation: observation, bindings: board_authority_bindings)
+}
+
+// THE BOARD AREA OF `ipmitool fru print` TEXT, read into the observation the lookup consumes: Board
+// Mfg and Board Product are required (exact text, one line each); Board Part Number is carried when
+// present. Never defaulted: no board area is BoardAreaAbsent, a present area with an empty or
+// repeated required field is BoardAreaFieldsUnreadable.
+fn board_fru_observation_of_text(content: String) -> BoardFruObservation {
+  match fru_field(content: content, field: "Board Mfg") {
+    FruFieldGap { gap: mg } =>
+      match fru_field(content: content, field: "Board Product") {
+        FruFieldGap { gap: pg } =>
+          match mg {
+            FruFieldAbsent { field: _ } => match pg {
+              FruFieldAbsent { field: _ } => BoardFruNotRead { cause: BoardAreaAbsent }
+              FruFieldRepeated { field: _ } => BoardFruNotRead { cause: BoardAreaFieldsUnreadable }
+              FruFieldEmpty { field: _ } => BoardFruNotRead { cause: BoardAreaFieldsUnreadable }
+            }
+            FruFieldRepeated { field: _ } => BoardFruNotRead { cause: BoardAreaFieldsUnreadable }
+            FruFieldEmpty { field: _ } => BoardFruNotRead { cause: BoardAreaFieldsUnreadable }
+          }
+        FruFieldValue { value: _ } => BoardFruNotRead { cause: BoardAreaFieldsUnreadable }
+      }
+    FruFieldValue { value: mfg } =>
+      match fru_field(content: content, field: "Board Product") {
+        FruFieldGap { gap: _ } => BoardFruNotRead { cause: BoardAreaFieldsUnreadable }
+        FruFieldValue { value: product } =>
+          BoardFruRead { fru: BoardFruIdentity {
+            manufacturer: mfg,
+            product: product,
+            part_number: match fru_field(content: content, field: "Board Part Number") {
+              FruFieldValue { value: pn } => Present { value: pn }
+              FruFieldGap { gap: _ } => none
+            },
+          } }
+      }
+  }
+}
+
+fn receipt_sha256_hex(receipt: BoardFruReceipt) -> String {
+  receipt.sha256.hex as String
+}
+
+// A COMMITTED CAPTURE EITHER YIELDS A BOARD OBSERVATION OR A CAPTURE-LEVEL GAP. The gap is the one
+// gunbc.ipmitool_fru_text FruCaptureGap (unreadable file, digest mismatch) the Mt. Jade identity read
+// also uses, with the one digest check fru_capture_digest_check; the board hub carries only what the
+// FRU Board Area itself can fail to say.
+type BoardCaptureRead
+  = BoardCaptureObserved { observation: BoardFruObservation }
+  | BoardCaptureRefused { gap: FruCaptureGap }
+
+// THE DIGEST-CHECKED READ of a committed FRU capture: content whose sha256 differs from the receipt
+// the binding row was authored from is a refusal, never decoded.
+fn board_fru_observation_of_capture(content: String, receipt: BoardFruReceipt) -> BoardCaptureRead {
+  match fru_capture_digest_check(content: content, expected_sha256: receipt_sha256_hex(receipt: receipt) as NonEmptyStr) {
+    FruCaptureDigestDiffers { gap: g } => BoardCaptureRefused { gap: g }
+    FruCaptureDigestAgrees => BoardCaptureObserved { observation: board_fru_observation_of_text(content: content) }
+  }
+}
+
+fn read_board_fru_observation(receipt: BoardFruReceipt) -> BoardCaptureRead uses fs: std.resources.Filesystem {
+  let read = Filesystem.Read(path: receipt.artifact_path as String)
+  match filesystem_read_outcome(content: read.content, success: read.success, error: read.error) {
+    FilesystemReadRefused { error: e } => BoardCaptureRefused { gap: FruCaptureUnreadable { error: e } }
+    FilesystemReadSucceeded { content: text } => board_fru_observation_of_capture(content: text, receipt: receipt)
+  }
+}
diff --git a/dag/gunbc/boot_artifact_delivery.dag b/dag/gunbc/boot_artifact_delivery.dag
index 0b0f1f14590..0e2da32f776 100644
--- a/dag/gunbc/boot_artifact_delivery.dag
+++ b/dag/gunbc/boot_artifact_delivery.dag
@@ -58,6 +58,7 @@ import extdeps.bmc.access_profile {
 }
 import gunbc.machine_intake_access {
   AccessContextBound,
+  AccessContextBoardNotFactsBound,
   AccessContextCatalogRefused,
   AccessContextControlRouteEvidenceMismatch,
   AccessContextObservationEvidenceMismatch,
@@ -91,6 +92,7 @@ import gunbc.boot_artifact {
   OperatingSystemInstaller,
   intake_artifact_for,
 }
+import gunbc.board_authority_binding { board_authority_bindings }
 import gunbc.machine_intake_subject { MachineIntakeSubject }
 import gunbc.machine_intake_receipt { EvidenceRef, same_intake_subject }
 import gunbc.install_transport_qualification {
@@ -523,7 +525,7 @@ fn bind_boot_delivery_target(target: BootDeliveryTarget, access: BoundBmcAccessC
 // context's capability row must NAME the capability, and the profile and the
 // observation the context was bound from must both admit the surface.
 fn surface_candidate_standing(ctx: BoundBmcAccessContext, surface: BmcAccessSurface) -> BootDeliveryCandidateStanding {
-  match bmc_surface_eligibility(profile: ctx.profile, observation: ctx.observation, surface: surface) {
+  match bmc_surface_eligibility(profile: ctx.profile, observation: ctx.observation, surface: surface, bindings: board_authority_bindings) {
     SurfaceEligible => CandidateEligible
     SurfaceAbsentFromProfile => CandidateIneligible { cause: CandidateSurfaceAbsentFromProfile { surface: surface } }
     SurfaceAbsentFromLiveObservation => CandidateIneligible { cause: CandidateLiveSurfaceAbsent { surface: surface } }
@@ -614,7 +616,7 @@ fn nbd_proxy_websocket_candidate(ctx: BoundBmcAccessContext, request: BootDelive
 // MegaRAC's proprietary remote media: the OEM capability, the OEM surface, AND
 // the route fact its start-media contract calls required. A profile whose
 // MegaRAC route leaves image_redirection Unset cannot plan this arm — that is
-// the executed refusal (opaque codes 13410/13460) modeled as a standing.
+// the executed refusal modeled as a standing.
 fn megarac_rest_remote_media_candidate(ctx: BoundBmcAccessContext, request: BootDeliveryRequest) -> BootDeliveryCandidateStanding {
   if release_row_has_capability(row: ctx.capability_row, cap: CapabilityOemRemoteMedia) == false {
     CandidateIneligible { cause: CandidateCapabilityAbsent }
@@ -1054,6 +1056,7 @@ fn solve_boot_artifact_delivery(
     AccessContextObservationEvidenceMismatch { endpoint: _, manifest: _, raw_response: _ } => BootDeliveryRefused { cause: DeliveryAccessUnbound { standing: ev.access } }
     AccessContextProbeEvidenceMismatch { endpoint: _, manifest: _, raw_response: _ } => BootDeliveryRefused { cause: DeliveryAccessUnbound { standing: ev.access } }
     AccessContextControlRouteEvidenceMismatch { endpoint: _, manifest: _, raw_response: _ } => BootDeliveryRefused { cause: DeliveryAccessUnbound { standing: ev.access } }
+    AccessContextBoardNotFactsBound { observed_identity: _, board: _ } => BootDeliveryRefused { cause: DeliveryAccessUnbound { standing: ev.access } }
     AccessContextProfileUncatalogued { observed_identity: _ } => BootDeliveryRefused { cause: DeliveryAccessUnbound { standing: ev.access } }
     AccessContextProfileAmbiguous { observed_identity: _, count: _ } => BootDeliveryRefused { cause: DeliveryAccessUnbound { standing: ev.access } }
     AccessContextCatalogRefused { standing: _ } => BootDeliveryRefused { cause: DeliveryAccessUnbound { standing: ev.access } }
diff --git a/dag/gunbc/build_cache/build_cache_instance.dag b/dag/gunbc/build_cache/build_cache_instance.dag
index 594fdfad2f2..52d2e1628ff 100644
--- a/dag/gunbc/build_cache/build_cache_instance.dag
+++ b/dag/gunbc/build_cache/build_cache_instance.dag
@@ -176,7 +176,7 @@ type RunnerSlotIdentity {
 //
 // THE CORRECTION THAT MATTERS IS THAT ZERO IS THE WRONG ANSWER SHAPE, NOT THAT IT IS REACHED.
 // Were srv5 to arrive here it would be told it has a CI capacity of zero, when the truth is that the
-// question does not apply to an inference appliance. gunbc.host_phase_status fleet_subsumption_enrollments
+// question does not apply to an inference appliance. gunbc.fleet_enrollment fleet_enrollments
 // already carries that distinction as a participation per host, so the fact exists and this table
 // cannot see it.
 //
diff --git a/dag/gunbc/build_target.dag b/dag/gunbc/build_target.dag
index 133aebf5742..8d4c7bad6cf 100644
--- a/dag/gunbc/build_target.dag
+++ b/dag/gunbc/build_target.dag
@@ -500,10 +500,12 @@ type TargetStandingLookup
   | StandingLookupLabelNotCanonical { target: Label, cause: LabelCanonicalityCause }
 
 // THE LOOKUP SPELLING IS `lookup`, NOT `map_get`, AND THE REASON IS RESOLUTION RATHER THAN TASTE.
-// Two declarations answer to the bare name `map_get` — the builtin, returning `Optional<V>`, and
-// `v2.std.collection.map_get`, returning `Outcome<Optional<V>>` — so in a module whose imports make
-// both visible the reference is ambiguous and refuses outright. `lookup` is the dual-dispatch
-// chokepoint, has one declaration, and already returns the `Optional` these matches read.
+// HISTORICALLY the bare name `map_get` answered to two declarations — the builtin, returning
+// `Optional<V>`, and `v2.std.collection`'s declared projection, returning `Outcome<Optional<V>>` —
+// so in a module whose imports made both visible the reference was ambiguous and refused outright.
+// The declared projection now answers to `map_get_checked` alone (the fork is dissolved), and
+// `lookup` remains the dual-dispatch chokepoint: one declaration, and it already returns the
+// `Optional` these matches read.
 fn target_standing_lookup(index: TargetStandingIndex, target: Label) -> TargetStandingLookup {
   match label_canonicality(label: target) {
     LabelNonCanonical { cause: cause } =>
diff --git a/dag/gunbc/census_closure_frontier.dag b/dag/gunbc/census_closure_frontier.dag
index bd31e98983b..1b075493367 100644
--- a/dag/gunbc/census_closure_frontier.dag
+++ b/dag/gunbc/census_closure_frontier.dag
@@ -21,11 +21,11 @@ import extdeps.docker.container_stats {
 }
 import extdeps.docker.endpoint { endpoint_string_type_frontier_rows }
 import extdeps.github.merge_state { merge_state_graphql_transport_frontier_rows }
+import gunbc.runner.runner_qualification_dispatch { qualification_instrument_extraction_frontier_rows }
 import extdeps.github.workflow_runs {
   conclusion_authority_consolidation_frontier_rows,
 }
 import extdeps.github.app { modeled_webhook_event_vocabulary_frontier_rows }
-import extdeps.github.workflows { create_dispatch_unconsumed_frontier_rows }
 import gunbc.public_workload_census {
   public_workload_census_replay_consumer_frontier_rows,
   public_workload_census_run_attempt_consumer_frontier_rows,
@@ -110,7 +110,7 @@ fn census_closure_frontier_row_groups() -> List<List<FrontierRow>> {
     endpoint_string_type_frontier_rows,
     merge_state_graphql_transport_frontier_rows,
     conclusion_authority_consolidation_frontier_rows,
-    create_dispatch_unconsumed_frontier_rows,
+    qualification_instrument_extraction_frontier_rows,
     modeled_webhook_event_vocabulary_frontier_rows,
     census_app_installation_route_frontier_rows,
     census_app_installation_population_frontier_rows,
diff --git a/dag/gunbc/ci/ci_deploy_access.dag b/dag/gunbc/ci/ci_deploy_access.dag
index feeb259bd91..07213a79511 100644
--- a/dag/gunbc/ci/ci_deploy_access.dag
+++ b/dag/gunbc/ci/ci_deploy_access.dag
@@ -405,3 +405,21 @@ fn srv1_live_deploy_privileged_commands() -> List<PrivilegedCommand> {
     p: fleet_posix_ci_runner_principal()
   )
 }
+
+// EVERY ACCESS THAT APPLIES A DEPLOYMENT, AS ONE ROSTER. A host-shared resource whose content is a
+// function of who deploys to that host -- /etc/sudoers.d/gunbc-deploy -- is derived from this list
+// filtered by host, never from the one access that happens to be running, so applying any
+// deployment through any access renders the same bytes (gunbc.ci_deploy_sudoers
+// deploy_sudoers_dropin_body). A new access is a row here; one left out is a principal whose grants
+// the next apply through another access would delete.
+fn deploy_access_roster() -> List<DeployAccess> {
+  [
+    ci_deploy_srv1_access,
+    ci_deploy_srv1_operator_access,
+    ci_deploy_srv1_operator_local_access,
+  ]
+}
+
+fn deploy_accesses_on_host(host: ComputeHost) -> List<DeployAccess> {
+  filter(xs: deploy_access_roster(), predicate: a => (a.host.identity as String) == (host.identity as String))
+}
diff --git a/dag/gunbc/ci/ci_deploy_sudoers.dag b/dag/gunbc/ci/ci_deploy_sudoers.dag
index f2169cb8442..612da35305a 100644
--- a/dag/gunbc/ci/ci_deploy_sudoers.dag
+++ b/dag/gunbc/ci/ci_deploy_sudoers.dag
@@ -1,7 +1,8 @@
 module gunbc.ci_deploy_sudoers
 
 import std.types { String, NonEmptyStr, List, Bool }
-import v2.std.algebra { fold_list, any }
+import v2.std.algebra { fold_list, any, list_flat_map }
+import std.list { distinct_by_key }
 import extdeps.sudo.elevation { sudo_elevate_argv }
 import v2.extdeps.languages.bash_build {
   bash_build_command_from_lits,
@@ -30,6 +31,7 @@ import extdeps.sudo.nopasswd_execute_probe_check_op {
 import gunbc.ci_deploy_access {
   DeployAccess,
   PrivilegedCommand,
+  deploy_accesses_on_host,
   gunbc_deploy_sudoers_dropin,
   deploy_access_sudoers_line,
   posix_sudo_grant_to_privileged,
@@ -100,15 +102,27 @@ fn deploy_sudoers_line_for_grant(access: DeployAccess, g: PosixSudoGrant) -> Str
   )
 }
 
-// One line per grant, header first. The heredoc row (v2.workflow.bash_emit bash_emit_heredoc)
+// THE DROP-IN IS HOST-SHARED, SO ITS BODY IS THE UNION OVER EVERY ACCESS THAT DEPLOYS TO THE HOST
+// (gunbc.ci_deploy_access deploy_accesses_on_host), not the running access's own grants. Rendering
+// from the running access alone made an operator-local apply rewrite the file to the operator's one
+// line and delete the CI runner's grants. One line per (principal, grant), first occurrence kept
+// in roster order, header first. The heredoc row (v2.workflow.bash_emit bash_emit_heredoc)
 // terminates the body itself, so the lines are joined without a trailing newline.
-fn deploy_sudoers_dropin_body(access: DeployAccess) -> String {
-  join(
-    concat([deploy_sudoers_dropin_header()], map(access.principal.sudo_grants, g => deploy_sudoers_line_for_grant(access: access, g: g))),
-    "\n"
+fn deploy_sudoers_dropin_lines_for(accesses: List<DeployAccess>) -> List<String> {
+  distinct_by_key(
+    xs: list_flat_map(xs: accesses, f: a => map(a.principal.sudo_grants, g => deploy_sudoers_line_for_grant(access: a, g: g))),
+    key: l => l,
   )
 }
 
+fn deploy_sudoers_dropin_body_for(accesses: List<DeployAccess>) -> String {
+  join(concat([deploy_sudoers_dropin_header()], deploy_sudoers_dropin_lines_for(accesses: accesses)), "\n")
+}
+
+fn deploy_sudoers_dropin_body(access: DeployAccess) -> String {
+  deploy_sudoers_dropin_body_for(accesses: deploy_accesses_on_host(host: access.host))
+}
+
 // THE ELEVATION PREFIX IS READ FROM extdeps.sudo.elevation sudo_elevate_argv, not typed here, so the
 // two tokens that cross the privilege boundary have one authority in the repository.
 fn deploy_sudoers_elevated(command: List<String>, tail: List<Node>) -> Node {
diff --git a/dag/gunbc/ci/ci_failure_class.dag b/dag/gunbc/ci/ci_failure_class.dag
index 5f9adffb8ed..9f5e6ff0de8 100644
--- a/dag/gunbc/ci/ci_failure_class.dag
+++ b/dag/gunbc/ci/ci_failure_class.dag
@@ -7,7 +7,7 @@ import gunbc.recurring_failure_mode.command_not_found_exit_cannot_distinguish_ev
 }
 import v2.std.node { Node }
 import v2.std.diagnostic { Outcome }
-import v2.std.integer { integer_int_to_decimal_string }
+import std.integer { int_to_decimal_string }
 import v2.extdeps.languages.bash_build {
   bash_build_and_then,
   bash_build_assign,
@@ -254,7 +254,7 @@ fn floor_outcome_wire(o: FloorOutcome) -> String {
 }
 
 fn posix_exit_status_decimal(code: Int) -> String {
-  integer_int_to_decimal_string(value: code)
+  int_to_decimal_string(value: code)
 }
 
 fn infra_signature_wire(sig: InfraSignature) -> String {
diff --git a/dag/gunbc/ci/ci_fleet.dag b/dag/gunbc/ci/ci_fleet.dag
index 80db034e555..ee5767e2cc5 100644
--- a/dag/gunbc/ci/ci_fleet.dag
+++ b/dag/gunbc/ci/ci_fleet.dag
@@ -1,5 +1,6 @@
 module gunbc.ci_fleet
 
+import gunbc.fleet_enrollment { CiRunnerParticipation, hosts_enrolled_for }
 import gunbc.fleet_intent {
   ComputeHost,
   ExecutionSurface,
@@ -113,7 +114,16 @@ data srv4_offer: ComputeOffer = ComputeOffer {
   cost_quote: none,
 }
 
-data fleet_intent_offers: List<ComputeOffer> = [srv1_offer, srv2_offer, srv3_offer, srv4_offer]
+// The owned machines' offers are per-host facts; WHICH of them the CI fleet offers is the enrolled CI
+// population (gunbc.fleet_enrollment), so a host leaves or joins the offered set by its enrollment and
+// never by an edit here. A provider guest has no offer in this catalog: its supply is its provider's
+// entitlement, admitted through gunbc.provider_guest_adoption rather than authored as an owned offer.
+data fleet_owned_compute_offer_catalog: List<ComputeOffer> = [srv1_offer, srv2_offer, srv3_offer, srv4_offer]
+
+data fleet_intent_offers: List<ComputeOffer> = filter(
+  fleet_owned_compute_offer_catalog,
+  o => any(hosts_enrolled_for(wanted: CiRunnerParticipation), h => (h as String) == (o.supply.physical.identity as String)),
+)
 
 fn fleet_compute_offer_for(host: HostIdentity) -> ComputeOffer? {
   fold(fleet_intent_offers, init: none, f: (acc, o) =>
diff --git a/dag/gunbc/ci/ci_layer_roots.dag b/dag/gunbc/ci/ci_layer_roots.dag
index 78617e3ebb5..e09e48062a6 100644
--- a/dag/gunbc/ci/ci_layer_roots.dag
+++ b/dag/gunbc/ci/ci_layer_roots.dag
@@ -321,6 +321,10 @@ data excl_bin_wet_reason: String = "bin-execution witness class: fns run compile
 
 data excl_bin_wet_dissolve: DissolutionCondition = unbound_dissolution(description: "the file migrates under the execution-corpus scope prefix and enrolls as ExecutionWitnessKind rows in gunbc.commit_workflow; then this row and the roster entries delete (bin_witness_wet_note)")
 
+data excl_immutable_pin_no_ci_wet_lane_reason: String = "ioctl-set IMMUTABLE leaked-hold composition (test.claim.materialization_store_local_immutable_pin_wet_witness): pin G, second acquire/release, reuse leaked G. Needs CAP_LINUX_IMMUTABLE. No required wet lane grants that cap, so the file is BinWitnessWet and named in gunbc.rung_drop.edited_bin_witness_wet_rows_not_executed_by_ci_population: a changed identity is DeclinedNoCiWetLane, not PlannedAsChangedWitness without a terminal. The executing floor wall for the no-hole reclaim half is reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution on the LocalRepoWetLane sibling file."
+
+data excl_immutable_pin_no_ci_wet_lane_dissolve: DissolutionCondition = unbound_dissolution(description: "a required wet lane grants CAP_LINUX_IMMUTABLE, or an unlink-refusal construction that needs none; then this file re-enrolls on local_repo_wet_schedule as ExpectedToHold, this exclusion flips to LocalRepoWetLane or deletes, and the pattern leaves edited_bin_witness_wet_rows_not_executed_by_ci_population")
+
 data excl_run_verdict_exit_status_reason: String = "SUBSTANTIATED per-row (found 2026-08-16, PR #8286 CI red, run 31922786399, batch 3 discovery-corpus, 3 of 9782): every fn in this file invokes the compiled `gunbc` seed as a SUBPROCESS and reads the status of that process, so the hermetic envelope refuses them — 'no mock_response for operation Run' and 'for operation IsExecutable', the class excl_install_media_reason names. The refusal is correct and the file cannot be made hermetic: the subject IS the process exit status, which no in-process assertion can observe, and mocking the invocation would let the witness pass against a fabricated status — precisely the defect it exists to detect. The file was authored into dag/test/claim/ and so was swept into unshrunk hermetic discovery by path; the witnesses were right and the enrolment was wrong. Per DESIGN 'witness cost derives from purpose', this row alone would only remove them from hermetic discovery, which is NOT an executing consumer — so all three fns are ALSO enrolled in bin_witness_wet_entries below, which is their real per-PR executing consumer under WitnessHasExecutingConsumer standing. Size is derived, not chosen: three subprocess invocations of a three-constructor fixture, one per arm of the driver's verdict map."
 
 data excl_run_verdict_exit_status_dissolve: DissolutionCondition = unbound_dissolution(description: "the driver's exit-status seam becomes observable without a subprocess — i.e. the verdict boundary migrates under the execution-corpus scope prefix and enrolls as ExecutionWitnessKind rows in gunbc.commit_workflow, the same terminal excl_bin_wet_dissolve names; then this row and the three roster entries delete together. Publishing a mock_response for Run/IsExecutable does NOT discharge it: a mocked status is authored data, so the assertions would be re-checked against the fixture rather than against the seam, which is the vacuous pass this file's refusal-polarity note already records once.")
@@ -534,11 +538,31 @@ data witness_exclusion_frontier: List<WitnessExclusionRow> = [
     classification: LocalRepoWetLane,
     reason: excl_local_repo_wet_digest_stdin_reason,
     dissolution: excl_local_repo_wet_digest_stdin_dissolve},
+  WitnessExclusionRow {
+    pattern: "workspace_source_pack_archive_real_execution_witness_test.dag",
+    classification: LocalRepoWetLane,
+    reason: excl_local_repo_wet_tempdir_write_reason,
+    dissolution: excl_local_repo_wet_tempdir_write_dissolve},
+  WitnessExclusionRow {
+    pattern: "seeded_filler_real_execution_witness_test.dag",
+    classification: LocalRepoWetLane,
+    reason: excl_local_repo_wet_tempdir_write_reason,
+    dissolution: excl_local_repo_wet_tempdir_write_dissolve},
+  WitnessExclusionRow {
+    pattern: "workspace_transcript_rate_real_execution_witness_test.dag",
+    classification: LocalRepoWetLane,
+    reason: excl_local_repo_wet_tempdir_write_reason,
+    dissolution: excl_local_repo_wet_tempdir_write_dissolve},
   WitnessExclusionRow {
     pattern: "megarac_spx_ui_surface_artifact_integrity_witness_test.dag",
     classification: LocalRepoWetLane,
     reason: excl_local_repo_wet_tempdir_write_reason,
     dissolution: excl_local_repo_wet_tempdir_write_dissolve},
+  WitnessExclusionRow {
+    pattern: "mtcollins_sol_host_payload_integrity_witness_test.dag",
+    classification: LocalRepoWetLane,
+    reason: excl_local_repo_wet_tempdir_write_reason,
+    dissolution: excl_local_repo_wet_tempdir_write_dissolve},
   WitnessExclusionRow {
     pattern: "emit_source_store_test.dag",
     classification: OfflineLocalRecipe,
@@ -1010,11 +1034,6 @@ data witness_exclusion_frontier: List<WitnessExclusionRow> = [
     classification: LocalRepoWetLane,
     reason: excl_local_repo_wet_tempdir_write_reason,
     dissolution: excl_local_repo_wet_dissolve},
-  WitnessExclusionRow {
-    pattern: "pair_serving_d0_grant_row_wet_witness_test.dag",
-    classification: LocalRepoWetLane,
-    reason: "SUBSTANTIATED: the one fn runs git.Plumbing HashObjectStdinNoWrite (`git hash-object --no-filters --stdin`) over caller-held bytes and compares git's own blob id for them; that operation has no mock_response, and an input-blind one would return one id for every input and fabricate the fact under test. THE EXECUTION IS PURELY LOCAL -- one git process reading stdin, no repository, no network -- so it belongs on the local-repo wet lane; the hermetic half is test.claim.spark.pair_serving_d0_release_witness rw_admission_follows_the_captured_row_not_the_path." as String,
-    dissolution: unbound_dissolution(description: "git.Plumbing HashObjectStdinNoWrite gains an input-varying hermetic arm (a modeled git blob-id computation) -- at which point this claim re-enrols as ordinary hermetic discovery and this row deletes. A fixed-output mock does NOT discharge it")},
   WitnessExclusionRow {
     pattern: "login_transaction_consume_wet_witness_test.dag",
     classification: LocalRepoWetLane,
@@ -1030,21 +1049,11 @@ data witness_exclusion_frontier: List<WitnessExclusionRow> = [
     classification: LocalRepoWetLane,
     reason: excl_local_repo_wet_reason,
     dissolution: excl_local_repo_wet_dissolve},
-  WitnessExclusionRow {
-    pattern: "pair_serving_d0_real_execution_witness_test.dag",
-    classification: LocalRepoWetLane,
-    reason: excl_local_repo_wet_reason,
-    dissolution: excl_local_repo_wet_dissolve},
   WitnessExclusionRow {
     pattern: "durable_cas_fabric_storage_real_execution_witness_test.dag",
     classification: LocalRepoWetLane,
     reason: excl_local_repo_wet_reason,
     dissolution: excl_local_repo_wet_dissolve},
-  WitnessExclusionRow {
-    pattern: "pair_serving_d0_front_door_real_execution_witness_test.dag",
-    classification: LocalRepoWetLane,
-    reason: excl_local_repo_wet_reason,
-    dissolution: excl_local_repo_wet_dissolve},
   WitnessExclusionRow {
     pattern: "devboot_text_blob_real_execution_witness_test.dag",
     classification: LocalRepoWetLane,
@@ -1095,11 +1104,6 @@ data witness_exclusion_frontier: List<WitnessExclusionRow> = [
     classification: LocalRepoWetLane,
     reason: excl_local_repo_wet_declared_unit_digest_reason,
     dissolution: excl_local_repo_wet_declared_unit_digest_dissolve},
-  WitnessExclusionRow {
-    pattern: "pair_incumbent_identity_wet_witness_test.dag",
-    classification: LocalRepoWetLane,
-    reason: excl_local_repo_wet_declared_unit_digest_reason,
-    dissolution: excl_local_repo_wet_declared_unit_digest_dissolve},
   WitnessExclusionRow {
     pattern: "spark_serving_offer_route_witness_test.dag",
     classification: LocalRepoWetLane,
@@ -1110,6 +1114,11 @@ data witness_exclusion_frontier: List<WitnessExclusionRow> = [
     classification: LocalRepoWetLane,
     reason: excl_local_repo_wet_tempdir_write_reason,
     dissolution: excl_local_repo_wet_dissolve},
+  WitnessExclusionRow {
+    pattern: "materialization_store_local_immutable_pin_wet_witness_test.dag",
+    classification: BinWitnessWet,
+    reason: excl_immutable_pin_no_ci_wet_lane_reason,
+    dissolution: excl_immutable_pin_no_ci_wet_lane_dissolve},
   WitnessExclusionRow {
     pattern: "host_capacity_wet_witness_test.dag",
     classification: LocalRepoWetLane,
@@ -1130,6 +1139,11 @@ data witness_exclusion_frontier: List<WitnessExclusionRow> = [
     classification: LocalRepoWetLane,
     reason: excl_local_repo_wet_tempdir_write_reason,
     dissolution: excl_local_repo_wet_dissolve},
+  WitnessExclusionRow {
+    pattern: "roadmap_belt_exit_drain_wet_witness_test.dag",
+    classification: LocalRepoWetLane,
+    reason: excl_local_repo_wet_tempdir_write_reason,
+    dissolution: excl_local_repo_wet_dissolve},
   WitnessExclusionRow {
     pattern: "roadmap_dogfood_route_wet_witness_test.dag",
     classification: LocalRepoWetLane,
@@ -1155,11 +1169,6 @@ data witness_exclusion_frontier: List<WitnessExclusionRow> = [
     classification: LocalRepoWetLane,
     reason: excl_local_repo_wet_tempdir_write_reason,
     dissolution: excl_local_repo_wet_dissolve},
-  WitnessExclusionRow {
-    pattern: "mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-    classification: LocalRepoWetLane,
-    reason: "SUBSTANTIATED per-row: every fn launches the real held KVM observer -- the pinned node, Playwright and headless Chromium that gunbc.runner_browser_toolchain runner_browser_toolchain_here_wet resolves on the floor pool (converged green on srv1, run 36377598915) -- against a loopback controller whose every answer is a gunbc.bmc_model transition served by gunbc.bmc_megarac_web_adapter on ephemeral ports, and writes only inside a shell.Mktemp.Dir directory it removes. shell.Mktemp.Dir, Filesystem.Write, the transport launch and the observer launch carry no mock_response, so hermetic discovery refuses them by construction; their subject is what a real browser and a real WebSocket report (seat busy, a controller-closed /kvm stream, an unexportable canvas), which no mock honestly supplies. No network beyond loopback, no remote host, no BMC, no credential." as String,
-    dissolution: unbound_dissolution(description: "a .dag browser-automation realization can drive a page and observe its WebSocket lifecycle hermetically against gunbc.bmc_model, so these assertions re-run without a real browser or process; then the fns re-enrol as ordinary hermetic discovery rows, drop off local_repo_wet_schedule, and this row deletes")},
   WitnessExclusionRow {
     pattern: "sol_hold_stdin_wet_witness_test.dag",
     classification: LocalRepoWetLane,
@@ -1728,7 +1737,8 @@ data bin_witness_wet_entries: List<ScheduleWitnessEntry> = [
   bin_wet(entry: "dag/test/claim/push_event_witness_wet_test.dag", f: "witness_push_before_payload_read_refused_on_missing_path"),
   bin_wet(entry: "dag/test/claim/host/host_cli_dependency_wet_witness_test.dag", f: "observe_echo_wet_posix_command_v_check_does_not_crash"),
   bin_wet(entry: "dag/test/claim/host/host_cli_dependency_wet_witness_test.dag", f: "observe_npm_wet_posix_command_v_check_does_not_crash"),
-  bin_wet(entry: "dag/test/claim/stage0_rust_maintenance_census_report_live_witness_test.dag", f: "maintenance_census_report_positive_control_derives_from_current_head")
+  bin_wet(entry: "dag/test/claim/stage0_rust_maintenance_census_report_live_witness_test.dag", f: "maintenance_census_report_positive_control_derives_from_current_head"),
+  bin_wet(entry: "dag/test/claim/materialization_store_local_immutable_pin_wet_witness_test.dag", f: "a_leaked_hold_stays_stale_when_reclaim_cannot_remove_its_generation_by_real_execution")
 ]
 
 data bin_witness_wet_per_row_wall_budget_seconds: Int = 60
diff --git a/dag/gunbc/ci/ci_materialization.dag b/dag/gunbc/ci/ci_materialization.dag
index 869d0f066e5..198f38271e8 100644
--- a/dag/gunbc/ci/ci_materialization.dag
+++ b/dag/gunbc/ci/ci_materialization.dag
@@ -238,7 +238,7 @@ fn ci_sccache_provider_id() -> String {
   sccache_local_id
 }
 
-data ci_floor_resolve_receipt_note: String = "The counted cold-resolve receipt of the lens-infra case study (operator go, 2026-07-09; the N-lenses-recompute-one-resolve pathology loyal-wren-398 root-caused from the affected-set OOM): make the floor's cold-resolve spend a COUNTED, gated number. MEASURED (CI run 29059860791 @ 93f6a21, 2026-07-10): resolves_total = 3 with #6422's two v2 witness entry classes enrolled (compiler_materialization_witness_test.dag, parse_table_memo_governed_witness_test.dag) — the pin HELD; those entries pooled warm against the shared index and paid zero additional cold resolves ([receipt] floor resolves: 3 entry resolve(s), 21771ms on that job log). The count was already 3 before #6422's entries existed (run 29058798771 semantics: compile-clean plus two dag/test/claim entry classes on the ladder lane); per-entry attribution is not observable at the receipt's current total-grain, so no decomposition claims beyond what the ledger shows. LIVE RECEIPT of ladder enrollment semantics (run 29058798771): enrolling the ladder witness file moved the count 1 -> 3 — each enrolled entry pays its own closure resolve against the shared index — and the gate redded that exact run; the bump to 3 acknowledges witness-entry resolves as declared debt. Ratchet direction: the shared-resolve rewire (one closure resolve per source-roots set, handed to every consumer as a readonly reference — the loyal-wren lane) collapses the per-entry resolves back toward 1, lowering this row consciously. So this gate PINS measured debt consciously: a fourth cold entry resolve (a new single-claim entry class, a bypass of the shared index, a walk_memo regression) reds the same run that introduces it. claim_executor writes target/floor-resolve-receipt.txt (resolves_total = per-result entry resolves actually paid, walk-memo hits excluded; discovery_corpus_resolve_ms observational on its own key, never conflated); the derived ci.yml step compares resolves_total to the declared row. The duplication this lane still owes lives OUTSIDE this receipt: the affected-set whole-tree resolve class (loyal-wren lane: value-tier declaration plus the persistent content-keyed store) and cross-run cold compiles (the fleet frame, provider rows with warm-equals-cold receipts). The gate lives on the ci job only; the regen job runs a different plan and enrolls when its count is pinned. Naming note: an earlier draft tagged this receipt M1 — retired 2026-07-10 (operator no-codename rule; and DESIGN's floor-shared-compute-memoization thread already uses M1/M2 for a different pair). EMPIRICAL LAW (three receipts, 2026-07-10, recorded here because this row is the measuring authority and successor sessions start from carriers, not message threads): resolves_total = 1 (the batch-1 whole-tree materialization) + the number of enrolled entry classes whose closure ESCAPES what batch-1 already materialized (an escaping entry pays a cold resolve with resolve_nanos > 0; a pooled entry hits walk_memo and pays zero). Receipt 1: ladder-lane enrollment paid +2 (run 29058798771 redded 1 -> 3, conscious bump). Receipt 2: #6422's two v2 entry classes paid +0 (run 29059860791 held at 3 — pooled warm). Receipt 3: #6432's entry paid +0 and its predicted 4 was REFUSED by this gate and retracted to the measured 3 — the full declare -> measure -> refuse -> retract loop. Receipt 4: #7088 cheap-gate-early reorder (run 29970856958 @ bd5885f6, 2026-07-23): resolves_total 3 -> 4 — cheap gates now run in batch 1 before compile-clean in batch 2, so dag/gunbc/instruments/floor_effect_gate_witness.dag pays a cold resolve before the compile anchor's walk_memo warms; gate redded 4 != declared 3, conscious bump to 4. Receipt 5: the one-tree-one-resolve rewire (2026-07-23, redundant-work ledger levers 2/3): the compile-clean receipt's typed store (the main-thread process_shared_index the eager install warms) is now CONSUMED across batches by construction — the executor's lane decision (claim_executor batch_unit_lane, clause c) routes any resolve-group sharing an (entry, mode) some batch resolves on the memo path onto that same path, so receipt 4's cheap-gate cold resolve dissolves back into the one anchor resolve: the promoted cheap-gate group pays THE counted whole-tree-entry resolve fresh against the warm typed store, and the compile anchor + emit-host consume its walk_memo context as hits (excluded by this receipt's own rule); declared count 4 -> 3 consciously in the same PR, per this gate's discipline. The sibling duplication OUTSIDE this receipt closed in the same change and was then DEEPENED per the section-9 ledger correction (the cold-child class: batch walls were the SUM of serial cold children, ~26/run, invisible to this receipt by process boundary): the per-claim child-process fold (tools.host_prelude run_gunbc_claims — one cold gunbc process per CLAIM ROW) is realized as ONE claim_batch child per call, and the cheap-gate transports consolidated to one call per GATE (layering 7 rows, extdeps 5 rows — claim_batch's pre-existing pooled --entry/--function grammar, one shared index per child, per-claim verdicts named, no short-circuit; srv1 counterfactuals: single cold child 47.2s, 12 claims pooled 93.4s vs 480s serial). The vehicle stays a separate process deliberately — never in-executor evaluation (the executor is the 16GiB-pinned process; a child dies and frees). Residue — one pool build per call — is counted in the redundancy ledger (receipt TSV deleted 2026-08-16 (operator ruling: delete anything not actively derived) rows) and dissolves on the same terminal store below. Terminal condition for the shared-resolve rewire (the persistent content-keyed node store, the affected-set lane's follow-on): when the store covers the whole tree the escape set is empty BY CONSTRUCTION and this row pins at 1 permanently — resolve once, share by reference, realized at the resolve grain; the rewire PR declares the count's drop consciously in the same PR, per this gate's discipline.RECEIPT 6 — CONSCIOUS LOWERING 3 -> 1 (claude, 2026-07-26, D3b gate flips; run 30188211737 @ 8b1fd6c redded 'floor resolve count 1 differs from declared 3'). NOT the terminal store rewire, and the distinction matters for what happens next: the count fell because the two ESCAPING ENTRY CLASSES LEFT THE PER-PR FLOOR, not because the escape set became empty by construction. This row's own EMPIRICAL LAW predicts it exactly — resolves_total = 1 (the batch-1 whole-tree materialization) + the entries whose closure escapes it — and SourceRootIngestGate (floor_source_root_ingest_gate_entry) and SelfHostReadsRealBytesGate (floor_self_host_realized_comparison_gate_entry) were both such entries, each a RunnableSingleClaim on its own entry file paying its own cold closure resolve. Re-homing them to the falsifier cadence (gunbc.commit_workflow gate_gauntlet_flip_basis_note) removed both, leaving the anchor resolve alone. So this is the ratchet direction this note already names ('collapses the per-entry resolves back toward 1, lowering this row consciously'), arrived at by placement rather than by the store — and it is a MEASUREMENT of the flip's benefit, independent of wall-clock: two whole-tree cold resolves per PR, gone. CONSEQUENCE, deliberately left as a live wall rather than smoothed over: 1 is now the floor's declared debt, so if either gate ever returns to the per-PR surface — or any new escaping entry class is enrolled — this gate reds on the run that does it. That is the gate working, not a brittleness to relax; the number must go back up consciously in the PR that re-enrolls, exactly as it came down here. It does NOT discharge the terminal condition below: the escape set is empty today by ROSTER, not by construction, so the persistent content-keyed store still owes its own permanent pin at 1."
+data ci_floor_resolve_receipt_note: String = "The counted cold-resolve receipt of the lens-infra case study (operator go, 2026-07-09; the N-lenses-recompute-one-resolve pathology loyal-wren-398 root-caused from the affected-set OOM): make the floor's cold-resolve spend a COUNTED, gated number. MEASURED (CI run 29059860791 @ 93f6a21, 2026-07-10): resolves_total = 3 with #6422's two v2 witness entry classes enrolled (compiler_materialization_witness_test.dag, parse_table_memo_governed_witness_test.dag; the latter deleted with the parse memo carrier, operator ruling R2 2026-10-08) — the pin HELD; those entries pooled warm against the shared index and paid zero additional cold resolves ([receipt] floor resolves: 3 entry resolve(s), 21771ms on that job log). The count was already 3 before #6422's entries existed (run 29058798771 semantics: compile-clean plus two dag/test/claim entry classes on the ladder lane); per-entry attribution is not observable at the receipt's current total-grain, so no decomposition claims beyond what the ledger shows. LIVE RECEIPT of ladder enrollment semantics (run 29058798771): enrolling the ladder witness file moved the count 1 -> 3 — each enrolled entry pays its own closure resolve against the shared index — and the gate redded that exact run; the bump to 3 acknowledges witness-entry resolves as declared debt. Ratchet direction: the shared-resolve rewire (one closure resolve per source-roots set, handed to every consumer as a readonly reference — the loyal-wren lane) collapses the per-entry resolves back toward 1, lowering this row consciously. So this gate PINS measured debt consciously: a fourth cold entry resolve (a new single-claim entry class, a bypass of the shared index, a walk_memo regression) reds the same run that introduces it. claim_executor writes target/floor-resolve-receipt.txt (resolves_total = per-result entry resolves actually paid, walk-memo hits excluded; discovery_corpus_resolve_ms observational on its own key, never conflated); the derived ci.yml step compares resolves_total to the declared row. The duplication this lane still owes lives OUTSIDE this receipt: the affected-set whole-tree resolve class (loyal-wren lane: value-tier declaration plus the persistent content-keyed store) and cross-run cold compiles (the fleet frame, provider rows with warm-equals-cold receipts). The gate lives on the ci job only; the regen job runs a different plan and enrolls when its count is pinned. Naming note: an earlier draft tagged this receipt M1 — retired 2026-07-10 (operator no-codename rule; and DESIGN's floor-shared-compute-memoization thread already uses M1/M2 for a different pair). EMPIRICAL LAW (three receipts, 2026-07-10, recorded here because this row is the measuring authority and successor sessions start from carriers, not message threads): resolves_total = 1 (the batch-1 whole-tree materialization) + the number of enrolled entry classes whose closure ESCAPES what batch-1 already materialized (an escaping entry pays a cold resolve with resolve_nanos > 0; a pooled entry hits walk_memo and pays zero). Receipt 1: ladder-lane enrollment paid +2 (run 29058798771 redded 1 -> 3, conscious bump). Receipt 2: #6422's two v2 entry classes paid +0 (run 29059860791 held at 3 — pooled warm). Receipt 3: #6432's entry paid +0 and its predicted 4 was REFUSED by this gate and retracted to the measured 3 — the full declare -> measure -> refuse -> retract loop. Receipt 4: #7088 cheap-gate-early reorder (run 29970856958 @ bd5885f6, 2026-07-23): resolves_total 3 -> 4 — cheap gates now run in batch 1 before compile-clean in batch 2, so dag/gunbc/instruments/floor_effect_gate_witness.dag pays a cold resolve before the compile anchor's walk_memo warms; gate redded 4 != declared 3, conscious bump to 4. Receipt 5: the one-tree-one-resolve rewire (2026-07-23, redundant-work ledger levers 2/3): the compile-clean receipt's typed store (the main-thread process_shared_index the eager install warms) is now CONSUMED across batches by construction — the executor's lane decision (claim_executor batch_unit_lane, clause c) routes any resolve-group sharing an (entry, mode) some batch resolves on the memo path onto that same path, so receipt 4's cheap-gate cold resolve dissolves back into the one anchor resolve: the promoted cheap-gate group pays THE counted whole-tree-entry resolve fresh against the warm typed store, and the compile anchor + emit-host consume its walk_memo context as hits (excluded by this receipt's own rule); declared count 4 -> 3 consciously in the same PR, per this gate's discipline. The sibling duplication OUTSIDE this receipt closed in the same change and was then DEEPENED per the section-9 ledger correction (the cold-child class: batch walls were the SUM of serial cold children, ~26/run, invisible to this receipt by process boundary): the per-claim child-process fold (tools.host_prelude run_gunbc_claims — one cold gunbc process per CLAIM ROW) is realized as ONE claim_batch child per call, and the cheap-gate transports consolidated to one call per GATE (layering 7 rows, extdeps 5 rows — claim_batch's pre-existing pooled --entry/--function grammar, one shared index per child, per-claim verdicts named, no short-circuit; srv1 counterfactuals: single cold child 47.2s, 12 claims pooled 93.4s vs 480s serial). The vehicle stays a separate process deliberately — never in-executor evaluation (the executor is the 16GiB-pinned process; a child dies and frees). Residue — one pool build per call — is counted in the redundancy ledger (receipt TSV deleted 2026-08-16 (operator ruling: delete anything not actively derived) rows) and dissolves on the same terminal store below. Terminal condition for the shared-resolve rewire (the persistent content-keyed node store, the affected-set lane's follow-on): when the store covers the whole tree the escape set is empty BY CONSTRUCTION and this row pins at 1 permanently — resolve once, share by reference, realized at the resolve grain; the rewire PR declares the count's drop consciously in the same PR, per this gate's discipline.RECEIPT 6 — CONSCIOUS LOWERING 3 -> 1 (claude, 2026-07-26, D3b gate flips; run 30188211737 @ 8b1fd6c redded 'floor resolve count 1 differs from declared 3'). NOT the terminal store rewire, and the distinction matters for what happens next: the count fell because the two ESCAPING ENTRY CLASSES LEFT THE PER-PR FLOOR, not because the escape set became empty by construction. This row's own EMPIRICAL LAW predicts it exactly — resolves_total = 1 (the batch-1 whole-tree materialization) + the entries whose closure escapes it — and SourceRootIngestGate (floor_source_root_ingest_gate_entry) and SelfHostReadsRealBytesGate (floor_self_host_realized_comparison_gate_entry) were both such entries, each a RunnableSingleClaim on its own entry file paying its own cold closure resolve. Re-homing them to the falsifier cadence (gunbc.commit_workflow gate_gauntlet_flip_basis_note) removed both, leaving the anchor resolve alone. So this is the ratchet direction this note already names ('collapses the per-entry resolves back toward 1, lowering this row consciously'), arrived at by placement rather than by the store — and it is a MEASUREMENT of the flip's benefit, independent of wall-clock: two whole-tree cold resolves per PR, gone. CONSEQUENCE, deliberately left as a live wall rather than smoothed over: 1 is now the floor's declared debt, so if either gate ever returns to the per-PR surface — or any new escaping entry class is enrolled — this gate reds on the run that does it. That is the gate working, not a brittleness to relax; the number must go back up consciously in the PR that re-enrolls, exactly as it came down here. It does NOT discharge the terminal condition below: the escape set is empty today by ROSTER, not by construction, so the persistent content-keyed store still owes its own permanent pin at 1."
 
 data ci_floor_resolve_receipt_path: String = "target/floor-resolve-receipt.txt"
 
diff --git a/dag/gunbc/ci/ci_spec.dag b/dag/gunbc/ci/ci_spec.dag
index d86d550ed34..55cb87758d7 100644
--- a/dag/gunbc/ci/ci_spec.dag
+++ b/dag/gunbc/ci/ci_spec.dag
@@ -12,12 +12,6 @@ import gunbc.cloudflare.r2_conditional_put_race_probe { race_probe_receipt_path
 import gunbc.spark.managed_access_apply { spark_apply_receipt_path }
 import gunbc.spark.pair_serving_apply { spark_pair_apply_receipt_path }
 import gunbc.spark.native_serving_apply { spark_native_apply_receipt_path }
-import gunbc.spark.v41_row_store_encode_run { v41_encode_run_receipt_path }
-import gunbc.spark.v41_row_store_readback_run { v41_readback_run_receipt_path }
-import gunbc.spark.v41_engram_differential_run { v41_differential_receipt_path }
-import gunbc.spark.runtime_image_produce_dispatch { runtime_image_produce_receipt_path, runtime_image_distribute_receipt_path }
-import gunbc.spark.arm_group_launch_dispatch { arm_group_load_receipt_path, arm_checkpoint_receipt_path, arm_group_launch_plan_path, arm_group_launch_receipt_path, arm_group_observe_receipt_path }
-import gunbc.spark.v41_serving_load { v41_serving_load_receipt_path }
 import gunbc.ledger_row_coherence { heal_repair_declaration_artifact_path }
 import extdeps.cloud.gcp.secret_ref { SecretRef, secret_ref_access_url, secret_ref_version_resource }
 import gunbc.auth.ci_app_key_rotation {
@@ -78,6 +72,7 @@ import gunbc.machine_intake_mtcollins1_sol_notice { mtcollins1_sol_notice_stop_s
 import gunbc.machine_intake_mtcollins1_fan_observe { mtcollins1_fan_credential_path_env, mtcollins1_fan_observation_receipt_path }
 import gunbc.fabric_writer_identity_observe { fabric_writer_identity_receipt_path }
 import gunbc.fabric.workspace_source { workspace_source_receipt_path }
+import gunbc.fabric.workspace_transcript_rate { workspace_transcript_rate_receipt_path }
 import gunbc.fabric.workspace_checkpoint_instrument { workspace_measure_receipt_path, workspace_restore_receipt_path }
 import gunbc.machine_intake_mtcollins1_census_image_publish { mtcollins1_census_image_receipt_path }
 import gunbc.machine_intake_mtcollins1_census_member_readback { census_member_readback_receipt_path }
@@ -826,6 +821,31 @@ data gunbc_ci_r2_workspace_object_write_mint_target: GunbcRunStepTarget = GunbcR
   function: "run_workspace_object_write",
 }
 
+data gunbc_ci_branch_run_grant_request_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/auth/branch_run_grant.dag",
+  function: "branch_run_grant_request_wet",
+}
+
+data gunbc_ci_branch_run_grant_apply_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/auth/branch_run_grant.dag",
+  function: "branch_run_grant_apply_wet",
+}
+
+data gunbc_ci_branch_run_grant_await_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/auth/branch_run_grant_await.dag",
+  function: "await_grant",
+}
+
+data gunbc_ci_branch_run_grant_broker_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/auth/branch_run_grant_broker.dag",
+  function: "broker",
+}
+
+data gunbc_ci_hetzner_cloud_server_read_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/fleet/hetzner_cloud_server_control.dag",
+  function: "read",
+}
+
 data gunbc_ci_r2_cache_object_read_mint_target: GunbcRunStepTarget = GunbcRunStepTarget {
   entry: "dag/gunbc/cloudflare/r2_token_mint_run.dag",
   function: "run_cache_object_read",
@@ -856,6 +876,11 @@ data gunbc_ci_workspace_checkpoint_restore_target: GunbcRunStepTarget = GunbcRun
   function: "workspace_checkpoint_restore_wet",
 }
 
+data gunbc_ci_workspace_transcript_rate_observe_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/fabric/workspace_transcript_rate.dag",
+  function: "workspace_transcript_rate_observe_wet",
+}
+
 // THE MICRO-VM GUEST IMAGE HAS TWO TARGETS BECAUSE OBSERVE AND CONVERGE ARE TWO OPERATIONS, and
 // this repository's ordering law is what keeps them apart: an observation reports a host's standing
 // and repairs nothing, so it may run anywhere at any time; a converge builds an image on the host it
@@ -943,6 +968,16 @@ data gunbc_ci_namecheap_observe_target: GunbcRunStepTarget = GunbcRunStepTarget
   function: "namecheap_observe_ci_wet",
 }
 
+data gunbc_ci_arrival_admit_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/machine_intake/arrival_admission.dag",
+  function: "arrival_admit_executor",
+}
+
+data gunbc_ci_arrival_converge_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/machine_intake/arrival_run.dag",
+  function: "arrival_converge_wet",
+}
+
 data gunbc_ci_host_credential_custody_converge_target: GunbcRunStepTarget = GunbcRunStepTarget {
   entry: "dag/gunbc/fleet/host_credential_custody_converge.dag",
   function: "host_credential_custody_converge_ci_wet",
@@ -977,11 +1012,6 @@ data gunbc_ci_approval_device_enrolment_code_issue_target: GunbcRunStepTarget =
   function: "approval_device_enrolment_code_issue_wet",
 }
 
-data gunbc_ci_pair_serving_d0_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/pair_serving_d0_door.dag",
-  function: "pair_serving_d0_ci_wet",
-}
-
 data gunbc_ci_gcp_iam_converge_request_target: GunbcRunStepTarget = GunbcRunStepTarget {
   entry: "dag/gunbc/auth/gcp_iam_converge_run.dag",
   function: "gcp_iam_converge_request_wet",
@@ -992,11 +1022,6 @@ data gunbc_ci_gcp_iam_converge_apply_target: GunbcRunStepTarget = GunbcRunStepTa
   function: "gcp_iam_converge_apply_wet",
 }
 
-data gunbc_ci_pair_serving_d0_admit_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/pair_serving_d0_door.dag",
-  function: "pair_serving_d0_admit_executor",
-}
-
 data gunbc_ci_mtcollins1_boot_target: GunbcRunStepTarget = GunbcRunStepTarget {
   entry: "dag/gunbc/machine_intake/mtcollins1_boot_run.dag",
   function: "mtcollins1_boot_wet",
@@ -1053,11 +1078,6 @@ data gunbc_ci_mtcollins1_fan_observe_target: GunbcRunStepTarget = GunbcRunStepTa
   function: "mtcollins1_fan_observe_wet",
 }
 
-data gunbc_ci_mtcollins1_ui_bundle_observe_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/machine_intake/mtcollins1_ui_bundle_observe.dag",
-  function: "mtcollins1_ui_bundle_observe_wet",
-}
-
 data gunbc_ci_mtcollins1_kvm_observer_observe_target: GunbcRunStepTarget = GunbcRunStepTarget {
   entry: "dag/gunbc/machine_intake/mtcollins1_kvm_observer_observe.dag",
   function: "mtcollins1_kvm_observer_observe_wet",
@@ -1137,91 +1157,6 @@ data gunbc_ci_spark_wireless_link_converge_target: GunbcRunStepTarget = GunbcRun
   function: "spark_wireless_link_converge_ci_wet",
 }
 
-data gunbc_ci_spark_runtime_image_produce_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/runtime_image_produce_dispatch.dag",
-  function: "runtime_image_produce_ci_wet",
-}
-
-// THE DISTRIBUTION OF THAT PRODUCED IMAGE TO ANOTHER GROUP A SPARK: save on the host the production
-// receipt names, scp through the executor, load on the selected Spark, and the configuration digest
-// read back there. The same prelude, because docker's socket on both ends is root-owned.
-data gunbc_ci_spark_runtime_image_distribute_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/runtime_image_produce_dispatch.dag",
-  function: "runtime_image_distribute_ci_wet",
-}
-
-// THE ARM GROUP LAUNCH (gunbc.spark.arm_group_launch_dispatch): one dry-plan entry and one wet entry for
-// every arm the dispatch rosters, the arm chosen by closed dispatch inputs. The same prelude: the session
-// host is the dispatch's target.
-data gunbc_ci_spark_arm_checkpoint_materialize_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/arm_group_launch_dispatch.dag",
-  function: "arm_checkpoint_materialize_ci",
-}
-
-data gunbc_ci_spark_arm_group_observe_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/arm_group_launch_dispatch.dag",
-  function: "arm_group_observe_ci",
-}
-
-data gunbc_ci_spark_arm_group_launch_plan_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/arm_group_launch_dispatch.dag",
-  function: "arm_group_launch_plan_ci",
-}
-
-data gunbc_ci_spark_arm_group_load_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/arm_group_launch_dispatch.dag",
-  function: "arm_group_load_ci",
-}
-
-data gunbc_ci_spark_arm_group_launch_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/arm_group_launch_dispatch.dag",
-  function: "arm_group_launch_ci_wet",
-}
-
-// THE V4.1 SERVING-LOAD STAIRCASE (gunbc.spark.v41_serving_load): the shared serving-load runner against
-// the V4.1 head, with rank pressure on every Group A host. The same prelude: the session host (the head)
-// is the dispatch's target.
-data gunbc_ci_spark_v41_serving_load_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/v41_serving_load.dag",
-  function: "v41_serving_load_ci_wet",
-}
-
-// THE PUBLISHED V4.1 CHECKPOINT ON ONE GROUP A SPARK (gunbc.spark.v41_checkpoint_materialize): the same
-// administrator credential as the runtime-image probe, because every leg runs privileged on the Spark.
-data gunbc_ci_spark_v41_checkpoint_materialize_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/v41_checkpoint_materialize.dag",
-  function: "v41_checkpoint_materialize_ci_wet",
-}
-
-// THE EIGHT ENGRAM ROW STORES ON ONE GROUP A SPARK (gunbc.spark.v41_row_store_encode_run): the same
-// administrator credential, because every leg runs privileged on the Spark.
-data gunbc_ci_spark_v41_row_store_encode_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/v41_row_store_encode_run.dag",
-  function: "v41_row_store_encode_ci_wet",
-}
-
-// THE BOUNDARY-STRATIFIED READBACK OF THOSE STORES (gunbc.spark.v41_row_store_readback_run): read-only,
-// the same privileged edge because the stores and shards are read as the administrator.
-data gunbc_ci_spark_v41_row_store_readback_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/v41_row_store_readback_run.dag",
-  function: "v41_row_store_readback_ci_wet",
-}
-
-// THE DESIGN-B ENGRAM DIFFERENTIAL ON THE SPARK HOLDING THE ROW STORES
-// (gunbc.spark.v41_engram_differential_run): read-only against the stores and the served model; the
-// same privileged edge, because the GPU container is started as the administrator.
-data gunbc_ci_spark_v41_engram_differential_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/v41_engram_differential_run.dag",
-  function: "v41_engram_differential_ci_wet",
-}
-
-// ITS SECOND STEP, THE .engram. SELECTION OVER THE PINNED INDEX, run in its own process so a parse
-// stopped for memory cannot take the fetch's receipts with it.
-data gunbc_ci_spark_v41_index_selection_target: GunbcRunStepTarget = GunbcRunStepTarget {
-  entry: "dag/gunbc/spark/v41_checkpoint_materialize.dag",
-  function: "v41_index_selection_ci_wet",
-}
-
 data gunbc_ci_collect_fleet_convergence_target: GunbcRunStepTarget = GunbcRunStepTarget {
   entry: "dag/gunbc/fleet/fleet_receipt_collector.dag",
   function: "collect_fleet_convergence_wet",
@@ -1383,6 +1318,8 @@ fn gunbc_run_step_targets() -> List<GunbcRunStepTarget> {
     gunbc_ci_fleet_converge_launch_environment_plan_target,
     gunbc_ci_fleet_converge_allocation_store_plan_target,
     gunbc_ci_fleet_converge_workspace_commissioning_plan_target,
+    gunbc_ci_workspace_image_build_target,
+    gunbc_ci_workspace_allocation_plan_target,
     gunbc_ci_fleet_converge_apply_target,
     gunbc_ci_org_actions_inspect_target,
     gunbc_ci_r2_mint_preflight_target,
@@ -1392,11 +1329,17 @@ fn gunbc_run_step_targets() -> List<GunbcRunStepTarget> {
     gunbc_ci_r2_workspace_object_read_mint_target,
     gunbc_ci_r2_workspace_object_write_mint_target,
     gunbc_ci_r2_cache_object_read_mint_target,
+    gunbc_ci_hetzner_cloud_server_read_target,
+    gunbc_ci_branch_run_grant_request_target,
+    gunbc_ci_branch_run_grant_apply_target,
+    gunbc_ci_branch_run_grant_await_target,
+    gunbc_ci_branch_run_grant_broker_target,
     gunbc_ci_r2_cache_object_write_mint_target,
     gunbc_ci_r2_conditional_put_race_probe_target,
     gunbc_ci_workspace_source_pack_target,
     gunbc_ci_workspace_checkpoint_measure_target,
     gunbc_ci_workspace_checkpoint_restore_target,
+    gunbc_ci_workspace_transcript_rate_observe_target,
     gunbc_ci_runner_guest_image_observe_target,
     gunbc_ci_runner_guest_image_converge_target,
     gunbc_ci_runner_microvm_host_converge_target,
@@ -1419,7 +1362,6 @@ fn gunbc_run_step_targets() -> List<GunbcRunStepTarget> {
     gunbc_ci_host_reset_return_target,
     gunbc_ci_host_reset_dispatch_admission_target,
     gunbc_ci_mtcollins1_fan_observe_target,
-    gunbc_ci_mtcollins1_ui_bundle_observe_target,
     gunbc_ci_mtcollins1_kvm_observer_observe_target,
     gunbc_ci_mtcollins1_kvm_observer_release_target,
     gunbc_ci_mtcollins1_census_image_publish_target,
@@ -1453,10 +1395,10 @@ fn gunbc_run_step_targets() -> List<GunbcRunStepTarget> {
     gunbc_ci_mtcollins1_sol_notice_target,
     gunbc_ci_microvm_runner_group_ensure_target,
     gunbc_ci_mtcollins1_boot_admit_target,
-    gunbc_ci_pair_serving_d0_target,
-    gunbc_ci_pair_serving_d0_admit_target,
     gunbc_ci_gcp_iam_converge_request_target,
-    gunbc_ci_gcp_iam_converge_apply_target
+    gunbc_ci_gcp_iam_converge_apply_target,
+    gunbc_ci_arrival_admit_target,
+    gunbc_ci_arrival_converge_target
   ]
 }
 
@@ -2018,10 +1960,6 @@ fn gunbc_ci_mtcollins1_probe_invoke(stem: String, target: GunbcRunStepTarget) ->
   ], "")
 }
 
-fn gunbc_ci_mtcollins1_ui_bundle_observe_invoke() -> String {
-  gunbc_ci_mtcollins1_probe_invoke(stem: "mtcollins1-ui-bundle", target: gunbc_ci_mtcollins1_ui_bundle_observe_target)
-}
-
 fn gunbc_ci_mtcollins1_kvm_observer_observe_invoke() -> String {
   gunbc_ci_mtcollins1_probe_invoke(stem: "mtcollins1-kvm-observer", target: gunbc_ci_mtcollins1_kvm_observer_observe_target)
 }
@@ -2704,6 +2642,56 @@ fn gunbc_ci_r2_workspace_object_write_mint_invoke() -> String {
   )
 }
 
+fn gunbc_ci_branch_run_grant_request_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_branch_run_grant_request_target.entry,
+    function: gunbc_ci_branch_run_grant_request_target.function,
+    claim_run: false,
+    receipt_rel: none
+  )
+}
+
+fn gunbc_ci_branch_run_grant_apply_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_branch_run_grant_apply_target.entry,
+    function: gunbc_ci_branch_run_grant_apply_target.function,
+    claim_run: false,
+    receipt_rel: none
+  )
+}
+
+fn gunbc_ci_branch_run_grant_await_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_branch_run_grant_await_target.entry,
+    function: gunbc_ci_branch_run_grant_await_target.function,
+    claim_run: false,
+    receipt_rel: none
+  )
+}
+
+fn gunbc_ci_branch_run_grant_broker_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_branch_run_grant_broker_target.entry,
+    function: gunbc_ci_branch_run_grant_broker_target.function,
+    claim_run: false,
+    receipt_rel: none
+  )
+}
+
+fn gunbc_ci_hetzner_cloud_server_read_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_hetzner_cloud_server_read_target.entry,
+    function: gunbc_ci_hetzner_cloud_server_read_target.function,
+    claim_run: false,
+    receipt_rel: none
+  )
+}
+
 fn gunbc_ci_r2_cache_object_read_mint_invoke() -> String {
   gunbc_run_step_script(
     source_roots: witness_layer_roots,
@@ -2764,6 +2752,16 @@ fn gunbc_ci_workspace_checkpoint_restore_invoke() -> String {
   )
 }
 
+fn gunbc_ci_workspace_transcript_rate_observe_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_workspace_transcript_rate_observe_target.entry,
+    function: gunbc_ci_workspace_transcript_rate_observe_target.function,
+    claim_run: false,
+    receipt_rel: workspace_transcript_rate_receipt_path
+  )
+}
+
 fn gunbc_ci_runner_guest_image_observe_invoke() -> String {
   gunbc_run_step_script(
     source_roots: witness_layer_roots,
@@ -3040,151 +3038,6 @@ fn gunbc_ci_spark_wireless_link_converge_invoke() -> String {
   )
 }
 
-// The production shares the probe's prelude, for the same reason and with the same credential: one
-// fleet-key agent from the job and one per-target administrator credential materialized to one file.
-fn gunbc_ci_spark_runtime_image_distribute_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_runtime_image_distribute_target.entry,
-    function: gunbc_ci_spark_runtime_image_distribute_target.function,
-    claim_run: false,
-    receipt_rel: runtime_image_distribute_receipt_path
-  )
-}
-
-fn gunbc_ci_spark_arm_checkpoint_materialize_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_arm_checkpoint_materialize_target.entry,
-    function: gunbc_ci_spark_arm_checkpoint_materialize_target.function,
-    claim_run: false,
-    receipt_rel: arm_checkpoint_receipt_path
-  )
-}
-
-fn gunbc_ci_spark_arm_group_observe_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_arm_group_observe_target.entry,
-    function: gunbc_ci_spark_arm_group_observe_target.function,
-    claim_run: false,
-    receipt_rel: arm_group_observe_receipt_path
-  )
-}
-
-fn gunbc_ci_spark_arm_group_launch_plan_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_arm_group_launch_plan_target.entry,
-    function: gunbc_ci_spark_arm_group_launch_plan_target.function,
-    claim_run: false,
-    receipt_rel: arm_group_launch_plan_path
-  )
-}
-
-fn gunbc_ci_spark_arm_group_load_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_arm_group_load_target.entry,
-    function: gunbc_ci_spark_arm_group_load_target.function,
-    claim_run: false,
-    receipt_rel: arm_group_load_receipt_path
-  )
-}
-
-fn gunbc_ci_spark_arm_group_launch_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_arm_group_launch_target.entry,
-    function: gunbc_ci_spark_arm_group_launch_target.function,
-    claim_run: false,
-    receipt_rel: arm_group_launch_receipt_path
-  )
-}
-
-fn gunbc_ci_spark_v41_serving_load_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_v41_serving_load_target.entry,
-    function: gunbc_ci_spark_v41_serving_load_target.function,
-    claim_run: false,
-    receipt_rel: v41_serving_load_receipt_path
-  )
-}
-
-fn gunbc_ci_spark_runtime_image_produce_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_runtime_image_produce_target.entry,
-    function: gunbc_ci_spark_runtime_image_produce_target.function,
-    claim_run: false,
-    receipt_rel: runtime_image_produce_receipt_path
-  )
-}
-
-fn gunbc_ci_spark_v41_checkpoint_materialize_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_v41_checkpoint_materialize_target.entry,
-    function: gunbc_ci_spark_v41_checkpoint_materialize_target.function,
-    claim_run: false,
-    receipt_rel: "target/v41-checkpoint-materialize-receipt.txt"
-  )
-}
-
-fn gunbc_ci_spark_v41_row_store_encode_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_v41_row_store_encode_target.entry,
-    function: gunbc_ci_spark_v41_row_store_encode_target.function,
-    claim_run: false,
-    receipt_rel: v41_encode_run_receipt_path
-  )
-}
-
-fn gunbc_ci_spark_v41_row_store_readback_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_v41_row_store_readback_target.entry,
-    function: gunbc_ci_spark_v41_row_store_readback_target.function,
-    claim_run: false,
-    receipt_rel: v41_readback_run_receipt_path
-  )
-}
-
-fn gunbc_ci_spark_v41_engram_differential_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_v41_engram_differential_target.entry,
-    function: gunbc_ci_spark_v41_engram_differential_target.function,
-    claim_run: false,
-    receipt_rel: v41_differential_receipt_path
-  )
-}
-
-fn gunbc_ci_spark_v41_index_selection_invoke() -> String {
-  gunbc_run_step_script_with_prelude(
-    prelude: gunbc_ci_spark_grant_install_credential_prelude(),
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_spark_v41_index_selection_target.entry,
-    function: gunbc_ci_spark_v41_index_selection_target.function,
-    claim_run: false,
-    receipt_rel: "target/v41-index-selection-receipt.txt"
-  )
-}
-
 fn gunbc_ci_spark_grant_install_invoke() -> String {
   gunbc_run_step_script_with_prelude(
     prelude: gunbc_ci_spark_grant_install_credential_prelude(),
@@ -3552,10 +3405,6 @@ fn gunbc_ci_submission_key_prelude(stem: String) -> List<PipelineStep> {
   ]
 }
 
-fn gunbc_ci_pair_serving_d0_prelude() -> List<PipelineStep> {
-  gunbc_ci_submission_key_prelude(stem: "pair-serving-d0")
-}
-
 data gunbc_ci_gcp_iam_converge_shell_emit_dissolution_trigger: DissolutionCondition = unbound_dissolution(description: "🟡 dissolve-on: gunbc_ci_gcp_iam_converge_request_invoke - orch-emitted foreign-executor (GitHub Actions run:) credential runner sharing gunbc_ci_submission_key_prelude with the D0 door: WIF access token (iam-observe) by env, ONE pinned submission-MAC secret version fetched over curl, a 0600 file under RUNNER_TEMP with a trap armed BEFORE the key touches disk; DISSOLVES WHEN the runner is authored as v2.extdeps.languages.bash_build nodes (typed, grammar-quoted words; command substitution; assignment; pipe; if/test; redirect; || true) emitted by v2.workflow.bash_emit bash_emit_stmts -- a route AVAILABLE today (#12422 retired the sibling pack runner on it), so this migration is unauthored, not blocked on a missing capability; set -euo pipefail, umask, export and trap are ordinary commands on that route, and the trap body is itself built from nodes and passed as one grammar-quoted word, so no new orchestration intent is a prerequisite")
 
 fn gunbc_ci_gcp_iam_converge_request_invoke() -> String {
@@ -3596,43 +3445,6 @@ fn gunbc_ci_mtcollins1_boot_admit_invoke() -> String {
   )
 }
 
-// The credential-free admission: no prelude, no secret, just the door's pure fold over the
-// dispatch host, the kernel hostname, the consent and the expected revision.
-fn gunbc_ci_pair_serving_d0_admit_invoke() -> String {
-  gunbc_run_step_script(
-    source_roots: witness_layer_roots,
-    entry: gunbc_ci_pair_serving_d0_admit_target.entry,
-    function: gunbc_ci_pair_serving_d0_admit_target.function,
-    claim_run: false,
-    receipt_rel: none
-  )
-}
-
-data gunbc_ci_pair_serving_d0_shell_emit_scaffold: Disposition = Scaffold {
-  dissolves_to: SingleAuthority,
-  bind: DeclarationRef {
-    module_path: "gunbc.ci_spec",
-    decl_name: "gunbc_ci_pair_serving_d0_invoke",
-    field: WholeDeclaration
-  }
-}
-
-data gunbc_ci_pair_serving_d0_shell_emit_dissolution_trigger: DissolutionCondition = unbound_dissolution(description: "🟡 dissolve-on: gunbc_ci_pair_serving_d0_invoke - orch-emitted foreign-executor (GitHub Actions run:) credential runner: WIF access token by env, ONE pinned submission-MAC secret version fetched over curl through the shared auth header and SM decode, a 0600 file under RUNNER_TEMP with a trap armed BEFORE the key touches disk. The pipeline steps are modeled (gunbc_ci_pair_serving_d0_prelude) but the runner transport itself remains hand-shell; DISSOLVES WHEN the runner is authored as v2.extdeps.languages.bash_build nodes (typed, grammar-quoted words; command substitution; assignment; pipe; if/test; redirect; || true) emitted by v2.workflow.bash_emit bash_emit_stmts -- a route AVAILABLE today (#12422 retired the sibling pack runner on it), so this migration is unauthored, not blocked on a missing capability; set -euo pipefail, umask, export and trap are ordinary commands on that route, and the trap body is itself built from nodes and passed as one grammar-quoted word, so no new orchestration intent is a prerequisite")
-
-fn gunbc_ci_pair_serving_d0_invoke() -> String {
-  concat(
-    concat("# ", concat(dissolution_description(condition: gunbc_ci_pair_serving_d0_shell_emit_dissolution_trigger), "\n")),
-    gunbc_run_step_script_with_prelude(
-      prelude: gunbc_ci_pair_serving_d0_prelude(),
-      source_roots: witness_layer_roots,
-      entry: gunbc_ci_pair_serving_d0_target.entry,
-      function: gunbc_ci_pair_serving_d0_target.function,
-      claim_run: false,
-      receipt_rel: none
-    )
-  )
-}
-
 fn gunbc_ci_approval_keyring_converge_invoke() -> String {
   concat(
     concat("# ", concat(dissolution_description(condition: gunbc_ci_approval_keyring_converge_shell_emit_dissolution_trigger), "\n")),
@@ -4063,9 +3875,41 @@ fn gunbc_ci_namecheap_observe_invoke() -> String {
   )
 }
 
+fn gunbc_ci_arrival_admit_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_arrival_admit_target.entry,
+    function: gunbc_ci_arrival_admit_target.function,
+    claim_run: false,
+    receipt_rel: none
+  )
+}
+
+fn gunbc_ci_arrival_converge_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_arrival_converge_target.entry,
+    function: gunbc_ci_arrival_converge_target.function,
+    claim_run: false,
+    receipt_rel: none
+  )
+}
+
 fn gunbc_ci_printer_workflow_invoke() -> String {
   gunbc_run_step_script(source_roots: witness_layer_roots,
     entry: gunbc_ci_printer_workflow_target.entry,
     function: gunbc_ci_printer_workflow_target.function,
     claim_run: false, receipt_rel: printer_workflow_receipt_path)
 }
+
+data gunbc_ci_workspace_allocation_plan_target: GunbcRunStepTarget = GunbcRunStepTarget { entry: "dag/gunbc/fleet/fleet_converge_plan_cli.dag", function: "fleet_converge_workspace_allocation_plan_wet" }
+
+fn gunbc_ci_workspace_allocation_plan_invoke() -> String {
+  gunbc_run_step_script(source_roots: witness_layer_roots, entry: gunbc_ci_workspace_allocation_plan_target.entry, function: gunbc_ci_workspace_allocation_plan_target.function, claim_run: false, receipt_rel: none)
+}
+
+data gunbc_ci_workspace_image_build_target: GunbcRunStepTarget = GunbcRunStepTarget { entry: "dag/gunbc/workspace_image_delivery.dag", function: "workspace_image_build_wet" }
+
+fn gunbc_ci_workspace_image_build_invoke() -> String {
+  join([gunbc_invoke_root_stamp_script(), "fakeroot -- ", gunbc_run_command(source_roots: witness_layer_roots, entry: gunbc_ci_workspace_image_build_target.entry, function: gunbc_ci_workspace_image_build_target.function, claim_run: false), "\n"], "")
+}
diff --git a/dag/gunbc/cli_dispatch_surface.dag b/dag/gunbc/cli_dispatch_surface.dag
index da903b440b1..3f5c3e19e9b 100644
--- a/dag/gunbc/cli_dispatch_surface.dag
+++ b/dag/gunbc/cli_dispatch_surface.dag
@@ -550,7 +550,7 @@ fn gunbc_cli_subcommands() -> List<CliSubcommandRow> {
           arity: CliRepeated,
           doc: [
             "Named argument for the entry function, repeatable: `--arg name=value`.",
-            "Values enter as String; a missing `=` refuses rather than guessing."
+            "Bound against the parameter's resolved type identity: kernel String, Int, and Bool, and std.types NonEmptyStr (String where string_non_empty). Other types refuse."
           ],
           emission: CarriedByGeneratedDispatch
         }
@@ -633,15 +633,15 @@ fn gunbc_cli_subcommands() -> List<CliSubcommandRow> {
           long: "target",
           value: CliTextValue { text_default: Present { value: "" } },
           arity: CliRequired,
-          doc: ["Spark target host (srv5 | srv6); required for scope:spark-serving, refused elsewhere"],
+          doc: ["Spark target host; required for scope:spark-serving, refused elsewhere"],
           emission: CarriedByGeneratedDispatch
         },
         CliOptionRow {
           field: "candidate_branch",
           long: "candidate-branch",
-          value: CliTextValue { text_default: Present { value: "main" } },
+          value: CliTextValue { text_default: Present { value: "" } },
           arity: CliRequired,
-          doc: ["Branch the checkout must be on for --mode deploy; the candidate is HEAD of this checkout"],
+          doc: ["If set, the checkout must be on this branch for --mode deploy; empty admits HEAD's branch"],
           emission: CarriedByGeneratedDispatch
         }
       ],
diff --git a/dag/gunbc/codex_app_server_press.dag b/dag/gunbc/codex_app_server_press.dag
index a4916844438..7157325ae78 100644
--- a/dag/gunbc/codex_app_server_press.dag
+++ b/dag/gunbc/codex_app_server_press.dag
@@ -73,6 +73,7 @@ import extdeps.llm.codex_app_server {
 import extdeps.shell
 import extdeps.shell.exec
 import extdeps.tools.env { env_path_resolved_program, env_prefixed_args }
+import extdeps.tools.util_linux_flock { flock_program, flock_exclusive_nonblocking_words }
 import v2.std.orchestration { EnvSet }
 import v2.std.compilers.cli_surface {
   ProcessArgvExpansion,
@@ -544,16 +545,45 @@ fn codex_press_account_trip_request_lines() -> String {
   ) + "\n"
 }
 
+// A TRIP THAT MUST NOT RACE A TURN runs under the turn's exclusive flock: account/read may refresh
+// the token, and a refresh rotates it (gunbc.codex_harness_credential). The lock is one more argv
+// layer in front of the same env-prefixed trip, so the program becomes flock and its arguments carry
+// the env invocation; with no lock the trip is exactly as before.
+type CodexTripLock {
+  lock_path: NonEmptyStr
+  conflict_exit_code: Int
+}
+
+fn codex_press_account_trip_program(lock: CodexTripLock?) -> String {
+  match lock {
+    Absent => env_path_resolved_program().invocation as String
+    Present { value: _ } => flock_program().invocation as String
+  }
+}
+
 fn codex_press_account_trip_invocation(
   executable: FilePath,
   codex_home: FilePath,
+  lock: CodexTripLock?,
 ) -> ProcessArgvExpansion {
+  let env_args = env_prefixed_args(
+    bindings: [EnvSet { name: "CODEX_HOME", value: codex_home as String }],
+    command_argv: [executable as String, "app-server", "--stdio"],
+  )
   process_argv_expansion(
     surface: cli_surface_of_literal_words(
-      words: env_prefixed_args(
-        bindings: [EnvSet { name: "CODEX_HOME", value: codex_home as String }],
-        command_argv: [executable as String, "app-server", "--stdio"],
-      ),
+      words: match lock {
+        Absent => env_args
+        Present { value: l } =>
+          skip(
+            flock_exclusive_nonblocking_words(
+              lock_path: l.lock_path,
+              conflict_exit_code: l.conflict_exit_code,
+              command: concat([env_path_resolved_program().invocation as String], env_args),
+            ),
+            1,
+          )
+      },
     ),
   )
 }
@@ -1608,6 +1638,7 @@ fn observe_codex_account_preflight(
           arguments: codex_press_account_trip_invocation(
             executable: projected.executable.path,
             codex_home: codex_home,
+            lock: none,
           ),
           stdin_payload: codex_press_account_trip_request_lines(),
         )
diff --git a/dag/gunbc/codex_harness_credential.dag b/dag/gunbc/codex_harness_credential.dag
new file mode 100644
index 00000000000..a5764aab794
--- /dev/null
+++ b/dag/gunbc/codex_harness_credential.dag
@@ -0,0 +1,325 @@
+module gunbc.codex_harness_credential
+
+import std.types { String, NonEmptyStr, Secret, FilePath, Int, List }
+import extdeps.filesystem.filesystem_io {
+  FilesystemFileObservation,
+  FilesystemFileAbsent,
+  FilesystemFileRead,
+  FilesystemFileIndeterminate,
+  FilesystemFileObservationsDisagree,
+  FilesystemFileSubjectRefused,
+}
+import extdeps.cloud.gcp.secret_ref { SecretRef, secret_ref_secret_resource }
+import extdeps.cloud.gcp.secret_manager
+import extdeps.cloud.gcp.secret_manager { encode_sm_access_version_payload_wire }
+import extdeps.transports.rest {
+  classify_rest_refusal,
+  RestMutationExchange,
+  RestAnswered,
+  RestRefused,
+  RestExchangeStatusRefused,
+  RestExchangeCommitAmbiguous,
+  RestExchangeUnreached,
+  RestExchangeUndecodable,
+}
+import extdeps.languages.json.emit { JsonValue, JsonNull, JsonBool, JsonNumber, JsonString, JsonArray, JsonObject }
+import extdeps.languages.json.parse {
+  parse_json_document,
+  JsonDocumentParsed,
+  JsonDocumentUnreadable,
+  json_object_unique_member,
+  JsonMemberFound,
+  JsonMemberAbsent,
+  JsonMemberDuplicated,
+  JsonMemberNotAnObject,
+}
+import extdeps.llm.codex_auth {
+  codex_auth_mode_of_wire,
+  CodexChatGptMode,
+  CodexApiKeyMode,
+  codex_auth_file_relative,
+  codex_auth_file_auth_mode_key,
+  codex_auth_file_tokens_key,
+  codex_auth_file_refresh_token_key,
+  codex_auth_file_account_id_key,
+}
+import gunbc.secret_provision { fleet_secret_ref, secret_ref_pin_version }
+import gunbc.auth.access_token_source {
+  AccessTokenSource,
+  ensure_access_token,
+  AccessTokenReady,
+  AccessTokenUpsertRequired,
+  AccessTokenEnsureRefused,
+}
+import extdeps.tools.util_linux_flock { flock_exclusive_nonblocking_words }
+import gunbc.codex_app_server_press { AmbientCodexCredentialContext }
+import product.host_identity { HostIdentity }
+import gunbc.fleet_host_identity { operator_host_srv2 }
+
+// ONE CODEX SUBSCRIPTION CREDENTIAL, HELD ON ONE HOST AND WRITTEN BACK WHEN CODEX ROTATES IT.
+// The ambient route binds a CODEX_HOME someone logged into on the host; nothing in it says where the
+// login came from or who else holds a copy. This credential comes from ONE secret, codex-auth-harness,
+// whose payload is the auth.json a ChatGPT login wrote, byte for byte.
+//
+// Why the host is authoritative after placement: extdeps.llm.codex_auth
+// codex_source_refresh_persistence records that codex rewrites auth.json about once an hour while it
+// runs, replacing the refresh token with whatever the issuer returned, and that the issuer refuses a
+// reused refresh token. So the copy codex last refreshed is the only live one. The custody converge
+// (gunbc.host_credential_custody_converge CodexWorkerTurnAuth) places the file once on the one custody
+// host, never overwrites it afterwards, and on every run reads it back and adds it to the store as a
+// new version when its refresh token moved on. Turns on that host run under the flock below, so one
+// codex process refreshes at a time.
+//
+// Operator rulings this follows (relayed by swift-ibex-601, 2026-10-05): subscription (chatgpt) mode,
+// not API-key mode; never codex's upstream-labelled-internal external-token login; credential delivery
+// by host custody under the fleet-converge run's federated grant, with no per-turn Secret Manager
+// access; exactly one custody host.
+//
+// RESIDUAL, stated: the store lags the host until the next custody converge. A host lost after a
+// rotation and before that converge loses the live token; the next placement on a rebuilt host then
+// carries a spent one, codex reports login required, and dispatch refuses the credential until the
+// operator logs in again.
+//
+// DECLARED FRONTIER (operator ruling, 2026-10-05): the narrower window is a workload identity bound
+// to the codex turn runner on the custody host, holding only secretAccessor and secretVersionAdder on
+// codex-auth-harness, so a turn could add the rotated file as a version the moment codex writes it
+// rather than at the next converge. TRIGGER: gunbc.auth.access_token_source select_access_token_source
+// resolves a federated token on the custody host outside an Actions run. Until then delivery is the
+// custody converge, and nothing in a turn reaches Secret Manager.
+
+data codex_auth_harness_secret_id: NonEmptyStr = "codex-auth-harness" as NonEmptyStr
+
+// latest, because the credential moves: every write-back mints the next version. The fetch resolves
+// the alias to an exact version and the receipt carries that version.
+data codex_auth_harness_secret_ref: SecretRef = secret_ref_pin_version(
+  ref: fleet_secret_ref(secret_id: codex_auth_harness_secret_id),
+  version: "latest",
+)
+
+// THE ONE HOST THAT HOLDS THE CODEX SUBSCRIPTION CREDENTIAL, and the CODEX_HOME on it. The store lags
+// the host until the next custody converge reads the host file back, so a second host would receive a
+// spent token: gunbc.host_credential_custody_converge refuses to place a host-authoritative row on
+// more than one host, and codex harness dispatch is pinned here.
+data codex_worker_turn_custody_host: HostIdentity = operator_host_srv2
+data codex_worker_turn_codex_home: NonEmptyStr = "/etc/gunbc-codex-harness" as NonEmptyStr
+data codex_worker_turn_auth_host_path: NonEmptyStr = "/etc/gunbc-codex-harness/auth.json" as NonEmptyStr
+
+// WHAT THE HARNESS NEEDS FROM auth.json, AND NOTHING ELSE. The refresh token decides whether a
+// write-back is owed; the account id decides whether the file still belongs to the account the secret
+// holds. The whole document is what gets written back, so nothing else needs reading.
+type CodexHarnessAuthIdentity {
+  account_id: NonEmptyStr
+  refresh_token: Secret
+}
+
+type CodexHarnessAuthFileRefusal
+  = CodexHarnessAuthFileUnparseable
+  | CodexHarnessAuthModeNotChatgpt { observed: String }
+  | CodexHarnessAuthModeAbsent
+  | CodexHarnessAuthMemberMissing { member: NonEmptyStr }
+
+type CodexHarnessAuthRead
+  = CodexHarnessAuthAdmitted { identity: CodexHarnessAuthIdentity }
+  | CodexHarnessAuthRefused { cause: CodexHarnessAuthFileRefusal }
+
+fn codex_harness_string_member(v: JsonValue, key: NonEmptyStr) -> String? {
+  match json_object_unique_member(v: v, key: key as String) {
+    JsonMemberFound { value } =>
+      match value {
+        JsonString { value: s } => if s == "" { none } else { Present { value: s } }
+        JsonNull => none
+        JsonBool { value: _ } => none
+        JsonNumber { lexeme: _ } => none
+        JsonArray { elements: _ } => none
+        JsonObject { members: _ } => none
+      }
+    JsonMemberAbsent => none
+    JsonMemberDuplicated { count: _ } => none
+    JsonMemberNotAnObject => none
+  }
+}
+
+fn codex_harness_member_missing(key: NonEmptyStr) -> CodexHarnessAuthRead {
+  CodexHarnessAuthRefused { cause: CodexHarnessAuthMemberMissing { member: key } }
+}
+
+fn codex_harness_tokens_identity(tokens: JsonValue) -> CodexHarnessAuthRead {
+  match codex_harness_string_member(v: tokens, key: codex_auth_file_refresh_token_key) {
+    Absent => codex_harness_member_missing(key: codex_auth_file_refresh_token_key)
+    Present { value: refresh } =>
+      match codex_harness_string_member(v: tokens, key: codex_auth_file_account_id_key) {
+        Absent => codex_harness_member_missing(key: codex_auth_file_account_id_key)
+        Present { value: account } =>
+          CodexHarnessAuthAdmitted {
+            identity: CodexHarnessAuthIdentity {
+              account_id: account as NonEmptyStr,
+              refresh_token: refresh as Secret,
+            },
+          }
+      }
+  }
+}
+
+fn codex_harness_chatgpt_identity(doc: JsonValue) -> CodexHarnessAuthRead {
+  match json_object_unique_member(v: doc, key: codex_auth_file_tokens_key as String) {
+    JsonMemberFound { value: tokens } => codex_harness_tokens_identity(tokens: tokens)
+    JsonMemberAbsent => codex_harness_member_missing(key: codex_auth_file_tokens_key)
+    JsonMemberDuplicated { count: _ } => codex_harness_member_missing(key: codex_auth_file_tokens_key)
+    JsonMemberNotAnObject => CodexHarnessAuthRefused { cause: CodexHarnessAuthFileUnparseable }
+  }
+}
+
+// THE PAYLOAD FORMAT IS CHECKED BEFORE ANY TURN RUNS. An API-key auth.json, or anything that is not
+// an auth.json, refuses here with the reason, rather than starting codex against a file it will reject.
+fn codex_harness_auth_read(content: String) -> CodexHarnessAuthRead {
+  match parse_json_document(s: content) {
+    JsonDocumentUnreadable { gap: _ } => CodexHarnessAuthRefused { cause: CodexHarnessAuthFileUnparseable }
+    JsonDocumentParsed { value: doc } =>
+      match codex_harness_string_member(v: doc, key: codex_auth_file_auth_mode_key) {
+        Absent => CodexHarnessAuthRefused { cause: CodexHarnessAuthModeAbsent }
+        Present { value: wire } =>
+          match codex_auth_mode_of_wire(raw: wire) {
+            Present { value: mode } =>
+              match mode {
+                CodexChatGptMode => codex_harness_chatgpt_identity(doc: doc)
+                CodexApiKeyMode => CodexHarnessAuthRefused { cause: CodexHarnessAuthModeNotChatgpt { observed: wire } }
+              }
+            Absent => CodexHarnessAuthRefused { cause: CodexHarnessAuthModeNotChatgpt { observed: wire } }
+          }
+      }
+  }
+}
+
+// THE WRITE-BACK DECISION, from the identity that was materialized and the file read back after the
+// turn. A changed refresh token owes a new version carrying the whole file. An unchanged one owes
+// nothing. A file that now names a different account, or that cannot be read, is refused rather than
+// written: storing it would replace the operator's credential with something this run cannot vouch
+// for, and NOT storing it is only safe because the refusal is reported.
+type CodexHarnessWriteBackRefusal
+  = CodexHarnessReadBackUnobservable { detail: String }
+  | CodexHarnessReadBackAbsent
+  | CodexHarnessReadBackRefused { cause: CodexHarnessAuthFileRefusal }
+  | CodexHarnessReadBackAccountChanged { materialized: NonEmptyStr, read_back: NonEmptyStr }
+
+type CodexHarnessWriteBackDecision
+  = CodexHarnessWriteBackNotOwed
+  | CodexHarnessWriteBackOwed { payload: Secret }
+  | CodexHarnessWriteBackRefused { cause: CodexHarnessWriteBackRefusal }
+
+fn codex_harness_write_back_decision(
+  materialized: CodexHarnessAuthIdentity,
+  read_back: FilesystemFileObservation,
+) -> CodexHarnessWriteBackDecision {
+  match read_back {
+    FilesystemFileAbsent(_) => CodexHarnessWriteBackRefused { cause: CodexHarnessReadBackAbsent }
+    FilesystemFileIndeterminate { cause } =>
+      CodexHarnessWriteBackRefused { cause: CodexHarnessReadBackUnobservable { detail: cause } }
+    FilesystemFileObservationsDisagree { path: _, cause } =>
+      CodexHarnessWriteBackRefused { cause: CodexHarnessReadBackUnobservable { detail: cause } }
+    FilesystemFileSubjectRefused { directory: _, name: _, cause } =>
+      CodexHarnessWriteBackRefused { cause: CodexHarnessReadBackUnobservable { detail: cause } }
+    FilesystemFileRead { path: _, content } =>
+      match codex_harness_auth_read(content: content) {
+        CodexHarnessAuthRefused { cause } =>
+          CodexHarnessWriteBackRefused { cause: CodexHarnessReadBackRefused { cause: cause } }
+        CodexHarnessAuthAdmitted { identity: after } =>
+          if (after.account_id as String) != (materialized.account_id as String) {
+            CodexHarnessWriteBackRefused {
+              cause: CodexHarnessReadBackAccountChanged {
+                materialized: materialized.account_id,
+                read_back: after.account_id,
+              },
+            }
+          } else if (after.refresh_token as String) == (materialized.refresh_token as String) {
+            CodexHarnessWriteBackNotOwed
+          } else {
+            CodexHarnessWriteBackOwed { payload: content as Secret }
+          }
+      }
+  }
+}
+
+// WHAT HAPPENED TO THE STORE, as a receipt the outcome carries. VersionAddAmbiguous is the case worth
+// naming: the store may or may not hold the rotated token, so the next acquire may read a spent one.
+type CodexHarnessWriteBackReceipt
+  = CodexHarnessStoreUnchanged
+  | CodexHarnessVersionAdded { version_name: String }
+  | CodexHarnessVersionAddRefused { detail: String }
+  | CodexHarnessVersionAddAmbiguous { detail: NonEmptyStr }
+  | CodexHarnessWriteBackWithheld { cause: CodexHarnessWriteBackRefusal }
+
+// THE CONVERGE'S WRITE-BACK. gunbc.host_credential_custody_converge calls this when the host's
+// auth.json carries a refresh token the store does not, under the fleet-converge run's federated
+// token and the secretVersionAdder grant in gunbc.auth.fleet_secret_accessor_roster.
+fn codex_harness_add_version(token_source: AccessTokenSource, payload: Secret) -> CodexHarnessWriteBackReceipt {
+  match ensure_access_token(source: token_source) {
+    AccessTokenUpsertRequired { plan: _ } =>
+      CodexHarnessVersionAddRefused { detail: "no Secret Manager access token: access upsert required" }
+    AccessTokenEnsureRefused { reason } =>
+      CodexHarnessVersionAddRefused { detail: reason as String }
+    AccessTokenReady { token } => {
+      match gcp.SecretManager.AddVersion(
+        access_token: token,
+        secret_name: secret_ref_secret_resource(ref: codex_auth_harness_secret_ref),
+        payload_b64: encode_sm_access_version_payload_wire(credential: payload),
+      ) {
+        RestAnswered { answer: added } => CodexHarnessVersionAdded { version_name: added.name as String }
+        RestRefused { refusal } =>
+          match classify_rest_refusal(standing: RestMutationExchange { refusal: refusal }) {
+            RestExchangeStatusRefused { status: _, body } => CodexHarnessVersionAddRefused { detail: body }
+            RestExchangeCommitAmbiguous { detail } => CodexHarnessVersionAddAmbiguous { detail: detail }
+            RestExchangeUnreached { cause } => CodexHarnessVersionAddAmbiguous { detail: cause }
+            RestExchangeUndecodable { status: _, cause } => CodexHarnessVersionAddAmbiguous { detail: cause }
+          }
+      }
+    }
+  }
+}
+
+fn codex_harness_write_back_refusal_wire(cause: CodexHarnessWriteBackRefusal) -> String {
+  match cause {
+    CodexHarnessReadBackUnobservable { detail } => concat("host auth.json unobservable: ", detail)
+    CodexHarnessReadBackAbsent => "host auth.json absent"
+    CodexHarnessReadBackRefused { cause: _ } => "host auth.json is not a chatgpt-mode auth.json"
+    CodexHarnessReadBackAccountChanged { materialized, read_back } =>
+      join(["host auth.json names account ", read_back as String, ", the store names ", materialized as String], "")
+  }
+}
+
+fn codex_harness_write_back_receipt_wire(r: CodexHarnessWriteBackReceipt) -> String {
+  match r {
+    CodexHarnessStoreUnchanged => "unchanged"
+    CodexHarnessVersionAdded { version_name } => concat("version-added ", version_name)
+    CodexHarnessVersionAddRefused { detail } => concat("REFUSED ", detail)
+    CodexHarnessVersionAddAmbiguous { detail } => concat("AMBIGUOUS ", detail as String)
+    CodexHarnessWriteBackWithheld { cause } => concat("WITHHELD ", codex_harness_write_back_refusal_wire(cause: cause))
+  }
+}
+
+// ── The turn side: one turn at a time over the custody CODEX_HOME ───────────────────────────────
+//
+// The turn reads nothing from Secret Manager. It runs codex with CODEX_HOME set to the directory the
+// custody converge placed on the one custody host, under an exclusive flock(1) on a lock file in that
+// directory, because codex has no cross-process lock on auth.json (extdeps.llm.codex_auth
+// codex_source_revision note) and two concurrent refreshes would present one refresh token twice.
+// The lock is held by the codex process for exactly its lifetime and the kernel drops it if the
+// process dies, so a crashed turn leaves nothing to recover. A second turn while one runs does not
+// wait: it exits codex_harness_turn_busy_exit, which names the credential as busy rather than as a
+// codex failure.
+
+data codex_harness_turn_lock_path: NonEmptyStr = "/etc/gunbc-codex-harness/turn.lock" as NonEmptyStr
+
+// EX_TEMPFAIL (sysexits.h 75): the credential is in use by another turn; retrying later is the remedy.
+data codex_harness_turn_busy_exit: Int = 75
+
+fn codex_harness_credential_context() -> AmbientCodexCredentialContext {
+  AmbientCodexCredentialContext { codex_home: codex_worker_turn_codex_home as FilePath }
+}
+
+fn codex_harness_turn_argv(command: List<String>) -> List<String> {
+  flock_exclusive_nonblocking_words(
+    lock_path: codex_harness_turn_lock_path,
+    conflict_exit_code: codex_harness_turn_busy_exit,
+    command: command,
+  )
+}
diff --git a/dag/gunbc/commit_workflow.dag b/dag/gunbc/commit_workflow.dag
index 19fe9b4534c..8ea88743217 100644
--- a/dag/gunbc/commit_workflow.dag
+++ b/dag/gunbc/commit_workflow.dag
@@ -1450,41 +1450,6 @@ data commit_gate_roster: List<CommitCheckEnrollment> = [
     },
     surfaces: [GithubActionsCiJob]
   },
-  CommitCheckEnrollment {
-    check: CommitWitnessClaim {
-      entry: "src/v2/test/claim/compiler_materialization_witness_test.dag",
-      check_fns: [
-        "compiler_materialization_ladder_holds",
-        "parse_table_memo_provider_preserves_catalog_retention",
-        "compile_stage_memo_provider_preserves_catalog_retention",
-        "parse_table_carrier_inhabits_realization",
-        "compile_stage_carrier_inhabits_realization",
-        "parse_table_empty_uses_catalog_identity",
-        "single_site_demands_are_accepted_single_recompute",
-        "parse_table_memo_plural_reds_without_provider"
-      ],
-      kind: CorpusWitnessKind,
-      span: SpanUndeclared
-    },
-    surfaces: [GithubActionsCiJob]
-  },
-  CommitCheckEnrollment {
-    check: CommitWitnessClaim {
-      entry: "src/v2/test/claim/long/parse_table_memo_governed_witness_test.dag",
-      check_fns: [
-        "witness_materialization_gate_recompute_denies_store",
-        "witness_recompute_fixture_carries_recompute_verdict",
-        "witness_door_insert_refused_for_recompute_table",
-        "witness_door_lookup_refused_for_recompute_table",
-        "parse_table_memo_bypass_store_reds",
-        "witness_memoize_carrier_allows_store",
-        "witness_content_key_subject_stable"
-      ],
-      kind: CorpusWitnessKind,
-      span: SpanUndeclared
-    },
-    surfaces: [GithubActionsCiJob]
-  },
   CommitCheckEnrollment {
     check: CommitWitnessClaim {
       entry: "dag/test/claim/ci_materialization_witness_test.dag",
@@ -2980,7 +2945,7 @@ fn realization_artifact_for_surface(surface: CommitWorkflowSurface) -> Generated
 // enforcement-coverage precedent in gunbc.ci_layer_roots). The files live under
 // src/v2/test/claim/long/ with the local recipe; dissolve-on: the long-lane scheduled trigger
 // (falsifier follow-on) enrolls them and this note retires. Contrast: the parse_table_memo_governed
-// enrollment above was REPOINTED to its long/ home, not deleted — its four enrolled check_fns each
+// enrollment (since deleted with the parse memo carrier, operator ruling R2 2026-10-08) was REPOINTED to its long/ home, not deleted — its four enrolled check_fns each
 // measured 0ms (audit 2026-07-12); only unenrolled siblings in that file (warm_equals_cold) are
 // over budget, and an explicit row runs exactly its named check_fns. Delete when the enrolled fns
 // themselves are slow; repoint when only the file moved. Wave 1 Gate 1 body-producer keystones
diff --git a/dag/gunbc/compute/host_capacity.dag b/dag/gunbc/compute/host_capacity.dag
index 9e1062d483a..38af2e04c97 100644
--- a/dag/gunbc/compute/host_capacity.dag
+++ b/dag/gunbc/compute/host_capacity.dag
@@ -19,8 +19,9 @@ import gunbc.fabric_event_log {
   PoolEventAppend, PoolEventAppended, PoolEventContended, PoolEventAppendRefused, fabric_pool_event_append, pool_event_append_wire,
 }
 import gunbc.fabric_event_log_host { now_epoch_seconds }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_path }
 import gunbc.roadmap_dashboard_instance {
-  HostDashboardInstance, dashboard_instance_compute_root,
+  HostDashboardInstance, dashboard_instance_shared_directory,
   DashboardInstanceByHost, DashboardInstanceForHost, DashboardInstanceHostUnknown, dashboard_instance_for_host,
 }
 
@@ -96,8 +97,23 @@ type ComputeSubjectResolution
   = ComputeSubjectResolved { subject: ComputeCapacitySubject }
   | ComputeSubjectHostUnresolved { host: NonEmptyStr }
 
+// THE COMPUTE ROOT THE WORK PROVIDER AND THIS POOL DEMAND: leases, checkouts, the shared per-host
+// target directory, the content store and the capacity partition all live under it
+// (gunbc.compute.work_provider_local reads it from here). Declared at this, the lower of the two
+// modules, as an owned-directory target both deployment routes ensure
+// (gunbc.roadmap.dashboard_instance_directories); under a root-owned /opt/gunbc a worker's first
+// request would otherwise refuse StoreUnavailable at `install -d`. The subdirectories are the
+// provider's own and it creates them under this root.
+fn compute_root_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  dashboard_instance_shared_directory(instance: instance, member: "compute-root" as NonEmptyStr, child: "compute")
+}
+
+fn compute_root(instance: HostDashboardInstance) -> NonEmptyStr {
+  owned_directory_path(t: compute_root_directory(instance: instance)) as String as NonEmptyStr
+}
+
 fn compute_capacity_root(host_instance: HostDashboardInstance) -> NonEmptyStr {
-  join([dashboard_instance_compute_root(instance: host_instance) as String, "/capacity"], "") as NonEmptyStr
+  join([compute_root(instance: host_instance) as String, "/capacity"], "") as NonEmptyStr
 }
 
 fn compute_memory_partition(host: NonEmptyStr) -> PartitionId {
diff --git a/dag/gunbc/compute/work_provider_local.dag b/dag/gunbc/compute/work_provider_local.dag
index def52cc09c9..d682ded4bf0 100644
--- a/dag/gunbc/compute/work_provider_local.dag
+++ b/dag/gunbc/compute/work_provider_local.dag
@@ -48,7 +48,6 @@ import gunbc.compute.attempt_lifecycle {
 }
 import gunbc.roadmap_dashboard_instance {
   HostDashboardInstance, dashboard_instance_for_repo_root, DashboardInstanceResolved, DashboardInstanceRootUnknown,
-  dashboard_instance_compute_root,
 }
 import gunbc.roadmap_dispatch_actuator { dispatch_capability_program }
 import gunbc.roadmap_execution_contract {
@@ -65,16 +64,19 @@ import gunbc.compute.host_capacity {
   ComputeRelease, ComputeReleased, ComputeNothingToRelease, ComputeReleaseRefused, compute_reserve, compute_release, compute_reservation_wire, compute_memory_ceiling,
   ComputeCapacityStanding, ComputeCapacityStandingRead, ComputeCapacityStandingUnread, compute_capacity_standing, compute_capacity_standing_wire,
   ComputeCapacitySubject, ComputeSubjectResolution, ComputeSubjectResolved, ComputeSubjectHostUnresolved,
-  compute_capacity_subject, compute_capacity_store, compute_release_on,
+  compute_capacity_subject, compute_capacity_store, compute_release_on, compute_root,
 }
 import std.measure { kibibyte }
+import std.content_hash { serialize_content_hash }
+import std.materialization_provider { ComputeWorkRequest, request_key, compute_work_demand_nature }
+import std.materialization_ladder { FreshEffect, IdempotentEffect, PureComputation, WorldRead }
 import gunbc.compute.work_request {
   WorkSubject, ExactTree, WorkOperation, BuildGunbcBinaries, CompileEntry, RunClaims, CargoProfile, CargoRelease, CargoDebug,
-  WorkToolchainIdentity, work_identity, work_identity_hex, work_default_build, work_declared_outputs,
+  WorkToolchainIdentity, work_toolchain_observed, rustc_verbose_host_triple, work_default_build, work_declared_outputs,
   DeclaredOutput, WorkOutputRoot, CheckoutRoot, TargetRoot,
   WorkOutput, WorkOutcome, WorkSucceeded, WorkFailed, WorkRefusedByInfrastructure, WorkCancelled, WorkOutputMismatch,
   WorkInfrastructureRefusal, ProducerInFlight, HostComputeCapacityFull, HostBelowMemoryFloor, ComputeCapacityLedgerUnavailable,
-  CheckoutUnavailable, StoreUnavailable,
+  CheckoutUnavailable, StoreUnavailable, FreshEffectNotServed,
   ToolchainUnobserved, DependencyNotSucceeded, SubjectUnresolved, UnitMemoryGrantExceeded, UnitEndingUnclassifiable,
   work_outcome_wire, work_outcome_ending, work_outcome_ending_of, work_operation_canonical, work_outcome_identity, StoredOutcomeRead, StoredOutcomeFound, StoredOutcomeUnreadable, stored_outcome_decode, stored_outcome_is_success,
 }
@@ -112,7 +114,7 @@ type ComputeLayout {
 }
 
 fn compute_layout(instance: HostDashboardInstance, identity_hex: String) -> ComputeLayout {
-  let root = dashboard_instance_compute_root(instance: instance) as String
+  let root = compute_root(instance: instance) as String
   let work_dir = join([root, "/work/", identity_hex], "")
   ComputeLayout {
     root: root,
@@ -156,16 +158,47 @@ type ToolchainObservation
   | ToolchainObservationRefused { detail: String }
 
 fn compute_observe_toolchain(instance: HostDashboardInstance) -> ToolchainObservation {
-  match compute_exec(program: compute_program(instance: instance, cap: RustcCapability), workdir: instance.repo_root as String, args: ["--version"]) {
-    ComputeExecFailed { exit_code, stdout: _, stderr } => ToolchainObservationRefused { detail: join(["rustc --version exited ", to_string(value: exit_code), ": ", stderr], "") }
-    ComputeExecOk { stdout: rustc_line, stderr: _ } =>
-      match compute_exec(program: sccache_installed_binary_path, workdir: instance.repo_root as String, args: ["--version"]) {
-        ComputeExecFailed { exit_code, stdout: _, stderr } => ToolchainObservationRefused { detail: join(["sccache --version exited ", to_string(value: exit_code), ": ", stderr], "") }
-        ComputeExecOk { stdout: cache_line, stderr: _ } =>
-          if trim(s: rustc_line) == "" || trim(s: cache_line) == "" {
-            ToolchainObservationRefused { detail: "rustc or sccache printed an empty version line" }
-          } else {
-            ToolchainObserved { toolchain: WorkToolchainIdentity { rustc_version: trim(s: rustc_line) as NonEmptyStr, cache_release: trim(s: cache_line) as NonEmptyStr } }
+  let repo = instance.repo_root as String
+  compute_toolchain_decide(
+    rustc: compute_exec(program: compute_program(instance: instance, cap: RustcCapability), workdir: repo, args: ["-vV"]),
+    cargo: compute_exec(program: compute_program(instance: instance, cap: CargoCapability), workdir: repo, args: ["--version"]),
+    cache: compute_exec(program: sccache_installed_binary_path, workdir: repo, args: ["--version"]),
+    provider: compute_exec(program: compute_program(instance: instance, cap: GitWorkspaceCapability), workdir: repo, args: ["rev-parse", "HEAD:dag/gunbc/compute"]),
+  )
+}
+
+// PURE: four readings in, one execution identity or a located refusal out. Every axis must have been
+// read and be non-empty, and the triple must be found in rustc's own report; a missing axis is a
+// refusal, never a default, because a key with a hole names a different computation than it claims.
+fn compute_toolchain_decide(rustc: ComputeExec, cargo: ComputeExec, cache: ComputeExec, provider: ComputeExec) -> ToolchainObservation {
+  match rustc {
+    ComputeExecFailed { exit_code, stdout: _, stderr } => ToolchainObservationRefused { detail: join(["rustc -vV exited ", to_string(value: exit_code), ": ", stderr], "") }
+    ComputeExecOk { stdout: verbose, stderr: _ } =>
+      match cargo {
+        ComputeExecFailed { exit_code, stdout: _, stderr } => ToolchainObservationRefused { detail: join(["cargo --version exited ", to_string(value: exit_code), ": ", stderr], "") }
+        ComputeExecOk { stdout: cargo_line, stderr: _ } =>
+          match cache {
+            ComputeExecFailed { exit_code, stdout: _, stderr } => ToolchainObservationRefused { detail: join(["sccache --version exited ", to_string(value: exit_code), ": ", stderr], "") }
+            ComputeExecOk { stdout: cache_line, stderr: _ } =>
+              match provider {
+                ComputeExecFailed { exit_code, stdout: _, stderr } => ToolchainObservationRefused { detail: join(["the provider's source revision could not be read (git rev-parse exited ", to_string(value: exit_code), "): ", stderr], "") }
+                ComputeExecOk { stdout: provider_tree, stderr: _ } =>
+                  match rustc_verbose_host_triple(verbose: verbose) {
+                    Absent => ToolchainObservationRefused { detail: "rustc -vV reported no host: line, so the target triple is unobserved" }
+                    Present { value: triple } =>
+                      if trim(s: verbose) == "" || triple == "" || trim(s: cargo_line) == "" || trim(s: cache_line) == "" || trim(s: provider_tree) == "" {
+                        ToolchainObservationRefused { detail: "an execution-identity reading was empty (rustc -vV, its host triple, cargo, sccache or the provider revision)" }
+                      } else {
+                        ToolchainObserved { toolchain: work_toolchain_observed(
+                          rustc_verbose: trim(s: verbose) as NonEmptyStr,
+                          target_triple: triple as NonEmptyStr,
+                          cargo_version: trim(s: cargo_line) as NonEmptyStr,
+                          cache_release: trim(s: cache_line) as NonEmptyStr,
+                          provider_revision: trim(s: provider_tree) as NonEmptyStr,
+                        ) }
+                      }
+                  }
+              }
           }
       }
   }
@@ -990,7 +1023,7 @@ fn compute_list(path: String) -> ComputeListing {
 }
 
 fn compute_grant_exceeded_count(instance: HostDashboardInstance, class: WorkClass) -> GrantExceededCount {
-  let root = dashboard_instance_compute_root(instance: instance) as String
+  let root = compute_root(instance: instance) as String
   grant_exceeded_count_decide(
     root: compute_list(path: root),
     parent: compute_list(path: compute_grant_exceeded_parent(root: root)),
@@ -1488,6 +1521,15 @@ fn compute_lease_drop_record(dropped: LeaseDrop, layout: ComputeLayout) -> HostR
   }
 }
 
+// THE WORK'S IDENTITY IS THE MATERIALIZATION PROVIDER'S KEY, not a second one. It is derived from
+// the ComputeWorkRequest family's judgment contract (std.materialization_provider), so the tree,
+// the operation and the observed execution identity are the only things that move it, and the key a
+// store will be asked for at the cutover is byte-for-byte the name this provider already files the
+// work under.
+fn compute_work_identity(subject: WorkSubject, op: WorkOperation, toolchain: WorkToolchainIdentity) -> String {
+  serialize_content_hash(hash: request_key(req: ComputeWorkRequest { subject: subject, operation: op, toolchain: toolchain })) as String
+}
+
 fn compute_provide_leaf(
   instance: HostDashboardInstance,
   commit: String,
@@ -1496,7 +1538,7 @@ fn compute_provide_leaf(
   toolchain: WorkToolchainIdentity,
   dependency_store: String,
 ) -> ProvideResult {
-  let identity = work_identity_hex(id: work_identity(subject: subject, op: op, toolchain: toolchain))
+  let identity = compute_work_identity(subject: subject, op: op, toolchain: toolchain)
   let layout = compute_layout(instance: instance, identity_hex: identity)
   let attached = compute_read_stored_outcome(layout: layout)
   if stored_outcome_is_success(r: attached) {
@@ -1832,7 +1874,33 @@ fn compute_unspawned_summary() -> SystemdRunWaitSummary {
 
 // PROVIDE, WITH THE BUILD DEPENDENCY RESOLVED FIRST. The build of the same subject is itself a
 // request: attached if stored, produced once otherwise, and compile/claims consume its store.
+// A WET CLAIM RUN IS A FRESH EFFECT AND THIS PROVIDER DOES NOT SERVE ONE (ruling on gunbc#13072,
+// item 2). Its identity is the request key, and every request with that key shares one lease, one
+// work directory and one stored outcome -- so a second identical wet run would attach to the first,
+// memoizing what std.materialization_provider classifies FreshEffect and the ladder answers Recompute.
+// Serving it needs an execution-occurrence identity beside the demand identity, which the ladder
+// cutover introduces; until then the request refuses before anything is observed or run. The
+// classification is the contract's own (std.materialization_provider compute_work_demand_nature, a
+// fold over the operation alone), read here rather than re-derived, so a future FreshEffect operation
+// refuses without this function changing.
+fn compute_operation_admission(op: WorkOperation) -> String? {
+  match compute_work_demand_nature(operation: op) {
+    FreshEffect => Present { value: "the request's contract classifies it FreshEffect, and this provider has no occurrence identity, so a repeat would attach to a prior run's outcome; run it hermetic or through the materialization cutover" }
+    IdempotentEffect => none
+    PureComputation => none
+    WorldRead { staleness_envelope_declared: _ } => Present { value: "the request's contract classifies it a WorldRead, which this provider's key does not cover" }
+  }
+}
+
 fn compute_provide(instance: HostDashboardInstance, commit: String, op: WorkOperation) -> ProvideResult {
+  match compute_operation_admission(op: op) {
+    Present { value: why } =>
+      compute_fresh(outcome: WorkRefusedByInfrastructure { identity: "", cause: FreshEffectNotServed { detail: why } }, subject: ExactTree { tree: compute_null_tree() }, op: op)
+    Absent => compute_provide_admitted(instance: instance, commit: commit, op: op)
+  }
+}
+
+fn compute_provide_admitted(instance: HostDashboardInstance, commit: String, op: WorkOperation) -> ProvideResult {
   match compute_observe_toolchain(instance: instance) {
     ToolchainObservationRefused { detail } =>
       compute_fresh(outcome: WorkRefusedByInfrastructure { identity: "", cause: ToolchainUnobserved { detail: detail } }, subject: ExactTree { tree: compute_null_tree() }, op: op)
@@ -1864,7 +1932,7 @@ fn compute_provide_dependent(instance: HostDashboardInstance, commit: String, su
       r: compute_provide_leaf(instance: instance, commit: commit, subject: subject, op: op, toolchain: toolchain, dependency_store: compute_layout(instance: instance, identity_hex: build_identity).store_dir),
       carried: provide_result_host_record(r: build))
   } else {
-    let identity = work_identity_hex(id: work_identity(subject: subject, op: op, toolchain: toolchain))
+    let identity = compute_work_identity(subject: subject, op: op, toolchain: toolchain)
     provide_result_with_host_record(
       r: compute_fresh(outcome: WorkRefusedByInfrastructure { identity: identity, cause: DependencyNotSucceeded { dependency_identity: provide_result_identity(r: build), ending: provide_result_ending(r: build) } }, subject: subject, op: op),
       carried: provide_result_host_record(r: build))
@@ -1946,7 +2014,7 @@ fn compute_request_cli(repo_root: String, commit: String, operation: String, ent
 // holding a reference, not an identity. Deriving the root through a layout with an empty identity
 // would work and would also be a second spelling of the same path (DESIGN 3).
 fn compute_attempts_root(instance: HostDashboardInstance) -> NonEmptyStr {
-  join([dashboard_instance_compute_root(instance: instance) as String, "/attempts"], "") as NonEmptyStr
+  join([compute_root(instance: instance) as String, "/attempts"], "") as NonEmptyStr
 }
 
 // THE TERMINAL TRANSITION AND THE RELEASE ARE TWO FACTS AND THE MIDDLE ARM IS THE ONE THAT
diff --git a/dag/gunbc/compute/work_request.dag b/dag/gunbc/compute/work_request.dag
index e90a806a33b..a73efc395ce 100644
--- a/dag/gunbc/compute/work_request.dag
+++ b/dag/gunbc/compute/work_request.dag
@@ -1,8 +1,8 @@
 module gunbc.compute.work_request
 
 import std.types { String, Bool, Int, List, NonEmptyStr, FilePath }
+import std.algebra { trim }
 import std.measure { Kibibyte, kibibyte_count }
-import std.content_hash { Fnv1a64Structural, content_hash_atom, content_hash_tagged_structural }
 import extdeps.systemd.systemd_run { SystemdRunOptionWordsRefusedCause, systemd_run_option_words_refused_cause_detail }
 import extdeps.git.object_store { GitObjectId, git_object_id_wire_hex }
 import extdeps.languages.json.emit {
@@ -95,28 +95,64 @@ fn work_declared_outputs(op: WorkOperation) -> List<DeclaredOutput> {
   }
 }
 
-// The toolchain half of the identity: the OBSERVED rustc version line and the sccache release the
-// host serves, because the same tree under a different compiler is different work. A provider
-// observes these before computing an identity; it never spells them.
-type WorkToolchainIdentity {
-  rustc_version: NonEmptyStr
+// THE EXECUTION HALF OF THE IDENTITY: everything that can change what the same tree and operation
+// produce on a host, OBSERVED rather than spelled. Hidden fleet uniformity is not an identity axis
+// (ruling on gunbc#13072, item 4): two hosts with the same rustc release line can still target
+// different triples, run a different cargo, or interpret the operation through a different provider.
+//   rustc_verbose     -- `rustc -vV` whole: release, commit hash, LLVM version and host triple
+//   target_triple     -- the `host:` line of that output, the platform every built binary targets
+//   cargo_version     -- `cargo --version` of the cargo the build actually runs
+//   cache_release     -- the sccache release that wraps rustc
+//   provider_revision -- the git tree of the compute provider's own source (dag/gunbc/compute) in the
+//                        repository the provider runs from, which decides how an operation becomes a
+//                        command without changing the subject tree
+//
+// THE PROVENANCE WALL IS NOT YET STRUCTURAL ON THE NATIVE ROUTE, and this says so rather than claiming
+// a seal. sole_constructor and admit_callers are enforced by the seed; on the native route both are
+// standing rung drops (gunbc.rung_drop admit_callers_discarded_on_the_native_route and
+// g0_type_decl_modifier_parse_without_sealing_property), so there the mint below is callable by any
+// declaration. The provider's observation fold is its only production caller.
+type WorkToolchainIdentity sole_constructor {
+  rustc_verbose: NonEmptyStr
+  target_triple: NonEmptyStr
+  cargo_version: NonEmptyStr
   cache_release: NonEmptyStr
+  provider_revision: NonEmptyStr
 }
 
-fn work_identity(subject: WorkSubject, op: WorkOperation, toolchain: WorkToolchainIdentity) -> Fnv1a64Structural {
-  let tree = match subject { ExactTree { tree } => git_object_id_wire_hex(oid: tree) as String }
-  content_hash_tagged_structural(
-    tag: "gunbc-compute-work-v1" as NonEmptyStr,
-    payload: content_hash_atom(value: join([
-      tree, "|", work_operation_canonical(op: op), "|", toolchain.rustc_version as String, "|", toolchain.cache_release as String,
-    ], "") as NonEmptyStr),
-  )
-}
+fn work_toolchain_observed(
+  rustc_verbose: NonEmptyStr,
+  target_triple: NonEmptyStr,
+  cargo_version: NonEmptyStr,
+  cache_release: NonEmptyStr,
+  provider_revision: NonEmptyStr,
+) -> WorkToolchainIdentity
+  admit_callers: [
+    decl_ref(module_path: "gunbc.compute.work_provider_local", decl_name: "compute_toolchain_decide"),
+    decl_ref(module_path: "test.claim.compute.work_request_witness_test", decl_name: "tc"),
+  ]
+  = WorkToolchainIdentity {
+    rustc_verbose: rustc_verbose,
+    target_triple: target_triple,
+    cargo_version: cargo_version,
+    cache_release: cache_release,
+    provider_revision: provider_revision,
+  }
 
-fn work_identity_hex(id: Fnv1a64Structural) -> String {
-  id.digest as String
+// The host triple a `rustc -vV` reports, read from its one `host: ` line; absent is a refusal.
+fn rustc_verbose_host_triple(verbose: String) -> String? {
+  match verbose.split(sep: "\n") |> filter(l => starts_with(s: l, prefix: "host: ")) |> first() {
+    Present { value: l } => Present { value: trim(s: l.replace(from: "host: ", to: "")) }
+    Absent => none
+  }
 }
 
+// THERE IS NO work_identity HERE ANY MORE. It was a second key for one computation -- a private
+// tagged hash beside std.materialization_provider's request_key -- and the identity of a compute
+// request is now that provider's derived key over the ComputeWorkRequest family
+// (gunbc.compute.work_provider_local compute_work_identity). This module keeps the work VOCABULARY;
+// the materialization contract owns the key.
+
 // One returned output: the declared path, the blob identity of its bytes (git's blob object id, a
 // content hash the same authority every subject already uses), and where the store holds it.
 type WorkOutput {
@@ -179,6 +215,7 @@ type WorkInfrastructureRefusal
   | SubjectUnresolved { detail: String }
   | UnitMemoryGrantExceeded { class: String, granted: Kibibyte, peak_upper: Kibibyte?, grant_was_ceiling: Bool }
   | UnitEndingUnclassifiable { exit_code: Int, cause: String }
+  | FreshEffectNotServed { detail: String }
   | UnitLaunchRefused { cause: SystemdRunOptionWordsRefusedCause }
 
 fn work_outcome_identity(o: WorkOutcome) -> String {
@@ -246,6 +283,7 @@ fn work_refusal_detail(r: WorkInfrastructureRefusal) -> String {
     ToolchainUnobserved { detail } => join(["toolchain unobserved: ", detail], "")
     DependencyNotSucceeded { dependency_identity, ending } => join(["dependency ", dependency_identity, " ended ", ending], "")
     SubjectUnresolved { detail } => join(["subject unresolved: ", detail], "")
+    FreshEffectNotServed { detail } => join(["this provider does not serve a fresh effect: ", detail], "")
     UnitEndingUnclassifiable { exit_code, cause } =>
       join(["the unit exited ", to_string(value: exit_code), " and its ending could not be classified, so it is neither reported as failed nor as grant-exceeded: ", cause], "")
     UnitLaunchRefused { cause } =>
diff --git a/dag/gunbc/contributor_onboarding_path.dag b/dag/gunbc/contributor_onboarding_path.dag
index fcd643dd75f..533e0eb81fa 100644
--- a/dag/gunbc/contributor_onboarding_path.dag
+++ b/dag/gunbc/contributor_onboarding_path.dag
@@ -1,7 +1,7 @@
 module gunbc.contributor_onboarding_path
 
 import std.types { String, List, NonEmptyStr }
-import v2.std.integer { integer_int_to_decimal_string }
+import std.integer { int_to_decimal_string }
 import std.optional { Optional, Absent, Present }
 import std.markdown { MarkdownDocument, MarkdownBlock }
 import gunbc.plans.md_helpers { h1, h2, h3, p, li, ul, ol, hr }
@@ -111,11 +111,12 @@ type OnboardingBlocker
 
 // THE ORDINAL IS AN Int, AND THAT IS A CORRECTION RATHER THAN A PREFERENCE (review 64609).
 // It was first declared `std.nat` `Nat` -- `CommutativeSemiring<Magnitude>` -- and rendered with
-// `integer_nat_to_decimal_string`, whose parameter is `v2.std.nat.Nat`, the Peano `Zero | Succ`
+// `integer_nat_to_decimal_string` (then in `v2.std.integer`, since moved to `std.nat` as
+// `nat_to_decimal_string` by gunbc#13436), whose parameter was `v2.std.nat.Nat`, the Peano `Zero | Succ`
 // coproduct. Two materially different types sharing one spelling is the DESIGN section 3 meaning
 // fork, and this instance is invisible exactly where it is authored: under the interpreter's
 // numeric grounding the projection rendered 1 through 10 correctly, while the emitted closure
-// refuses it. `v2.std.integer` `integer_int_to_decimal_string` records that same class as already
+// refuses it. `std.integer` `int_to_decimal_string` records that same class as already
 // repaired for two Int-valued callers, so re-introducing it would have been a silent regression of
 // that fix. Every other `dag/gunbc` caller consumes the Int renderer; this one now does too.
 //
@@ -289,7 +290,7 @@ data onboarding_steps: List<OnboardingStep> = [
   },
   OnboardingStep {
     id: "run-witnesses" as NonEmptyStr,
-    goal: "Run the corpus lane the merge gate runs: the parse sweep and the witness floor. EXPECT TENS OF MINUTES, NOT SECONDS -- this and the emission lane are the two long steps on this page, and a reader who assumes a hang and kills it has thrown away the run rather than the wait." as NonEmptyStr,
+    goal: "Run the corpus lane that WAS the merge gate's floor until the v1 withdrawal of 2026-10-09 (gunbc.rung_drop v1_required_lanes_withdrawn): the parse sweep and the witness floor. Nothing on the required path executes a witness now, so this run is the only place the enrolled population is folded, and a red here reaches main unless you act on it. EXPECT TENS OF MINUTES, NOT SECONDS -- this and the emission lane are the two long steps on this page, and a reader who assumes a hang and kills it has thrown away the run rather than the wait." as NonEmptyStr,
     command: Present { value: onboarding_witness_command() as NonEmptyStr },
     verification: "The run announces one phase line per phase it owns and one routed line per phase it does not, and exits nonzero on any failed phase. QUALIFY THE HOST BEFORE SPENDING THE TIME: this is the longest step by a wide margin and the most memory-hungry, so read your own bound with `cat /sys/fs/cgroup/memory.max` and compare it against the declared per-slot allowance, which is gunbc.runner_slot_desired gunbc_runner_slot_memory_max -- the page names the symbol rather than copying the number, so look it up there and it cannot go stale on you. Confirm yours is at or above it first -- a host under it will run for a long time and then refuse or be killed. When it does refuse, classify the refusal with the three arms the run-witnesses obstacle rows carry before touching the corpus." as NonEmptyStr,
     blocker: NeedsMachine { resource: "a host whose cgroup exposes an enforceable memory bound large enough for the floor fold" as NonEmptyStr },
@@ -653,7 +654,7 @@ fn obstacles_with_undeclared_step() -> List<OnboardingObstacle> {
 // repair the rule roster above received, and the step ordinal was the last authored position left.
 
 fn step_blocks(s: OnboardingStep, position: Int) -> List<MarkdownBlock> {
-  let head = h3(text: join([integer_int_to_decimal_string(value: position), ". ", (s.id as String)], ""))
+  let head = h3(text: join([int_to_decimal_string(value: position), ". ", (s.id as String)], ""))
   let goal = p(text: (s.goal as String))
   let who = p(text: join(["Who is needed: ", blocker_rendered(b: s.blocker)], ""))
   let verify = p(text: join(["Done when: ", (s.verification as String)], ""))
@@ -690,7 +691,7 @@ fn onboarding_preamble_blocks() -> List<MarkdownBlock> {
     p(text: "Generated from `gunbc.contributor_onboarding_path`. Do not hand-edit — the generated-artifact phase adjudicates this file against that authority. Every command below is derived from the authority that owns it, so this page moves when the build, the lane partition or the source roots move."),
     p(text: "This page is an index of a path, not the proof that it works. What establishes the path is walking it: clone, build, run the lanes, make one change, get it reviewed, land it. If a step here does not work, that is a defect in the path and worth reporting as one — the obstacle roster below exists because each of its rows was hit rather than imagined."),
     p(text: "`DESIGN.md` is the authority for every judgement about a change and is not a first-day document. The reading order at the end of this page says what you need before your first build, what you need before your first commit, and what can wait."),
-    p(text: join(["**", integer_int_to_decimal_string(value: count(onboarding_rules)), " RULES APPLY TO EVERY STEP BELOW, because three strangers walking this page lost their build to them.**"], "")),
+    p(text: join(["**", int_to_decimal_string(value: count(onboarding_rules)), " RULES APPLY TO EVERY STEP BELOW, because three strangers walking this page lost their build to them.**"], "")),
     ol(items: map(onboarding_rules, r => li(text: join(["**", (r.name as String), ".** ", (r.rule as String)], "")))),
     hr(),
   ]
@@ -723,7 +724,7 @@ fn onboarding_step_blocks() -> List<MarkdownBlock> {
     [
       [
         h2(text: "The path"),
-        p(text: join([integer_int_to_decimal_string(value: count(onboarding_steps)), " steps in order. Run each verification before moving on: a step that half-worked is the expensive kind, because the failure surfaces several steps later attached to the wrong cause."], "")),
+        p(text: join([int_to_decimal_string(value: count(onboarding_steps)), " steps in order. Run each verification before moving on: a step that half-worked is the expensive kind, because the failure surfaces several steps later attached to the wrong cause."], "")),
       ],
       rendered_step_blocks(steps: onboarding_steps),
     ],
diff --git a/dag/gunbc/crate_partition.dag b/dag/gunbc/crate_partition.dag
new file mode 100644
index 00000000000..690d558c73e
--- /dev/null
+++ b/dag/gunbc/crate_partition.dag
@@ -0,0 +1,567 @@
+module gunbc.crate_partition
+
+import std.types { Bool, Int, List, NonEmptyStr, String, brand }
+import std.optional { Absent, Optional, Present, optional_present }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import std.graph {
+  CallGraph,
+  GraphEdge,
+  graph_has_multi_node_scc,
+  graph_reverse_reachable_members,
+  graph_strongly_connected_components
+}
+import gunbc.rust_emitted_edge {
+  EmittedEdge,
+  EmittedEdgeProvenance,
+  EmittedModuleTarget,
+  EmittedCrateRootTarget
+}
+
+// THE PARTITION OF A MODULE GRAPH INTO COMPILATION UNITS, OVER ITS MODULES AND EDGES ALONE.
+//
+// This is the one home of the assignment rules: the emitted-edge merge and its reverse-edge refusal,
+// the balanced policy, the admissibility verdict (no divided SCC, no unit cycle) and the unit
+// dependency edges an assignment induces. It reads a module graph as names and edges, because that
+// is all any of these rules reads. v2.std.compilers.compilation_unit's ModuleDag adds the modules'
+// interface Nodes for the partition FOLD, and v2.workflow.rust_crate_partition adapts a ModuleDag to
+// these functions; both import the ids and edges declared here, so there is one ModuleId and one
+// partition, not a v2 one and a seed one.
+//
+// It lives under dag/ because the seed calls it compiled: v1.compiler.emitted_workspace lays out
+// every emitted Rust workspace through gunbc.emitted_crate_workspace, which builds on this, and the
+// seed's compile roots are src/v1 and dag/ only (operator ruling 2026-10-08, gunbc#13597).
+
+type ModuleId = NonEmptyStr where brand("ModuleId")
+type CompilationUnitId = NonEmptyStr where brand("CompilationUnitId")
+
+type ModuleDagEdge {
+  from: ModuleId
+  to: ModuleId
+}
+
+type PartitionProvenance
+  = HandExplicit
+  | PolicyDerived { policy: DeclarationRef }
+
+fn partition_provenance_hand_explicit() -> PartitionProvenance {
+  HandExplicit
+}
+
+fn partition_provenance_policy_derived(policy: DeclarationRef) -> PartitionProvenance {
+  PolicyDerived { policy: policy }
+}
+
+type PartitionFoldRefusalCause
+  = InterfaceClosureUnreachedFixpoint { unit_id: CompilationUnitId }
+  | ModuleDagExportsLookupRejected { module: ModuleId }
+  | ModuleDagTypeDefinitionsLookupRejected { module: ModuleId }
+  | ModuleAssignmentLookupRejected { module: ModuleId }
+
+type PartitionR4ValidityCause
+  = SccSplit { detail: String }
+  | UnitGraphCycle { detail: String }
+  | LinkageCycle { detail: String }
+  | ByValueTypeCycle { detail: String }
+  | PartitionInputRejected { cause: PartitionFoldRefusalCause }
+
+type PartitionR4ValidityVerdict
+  = PartitionR4Valid
+  | PartitionR4Refused { cause: PartitionR4ValidityCause }
+
+fn list_unique_sorted_ids(items: List<CompilationUnitId>) -> List<CompilationUnitId> {
+  items
+    |> sort_by(id => id)
+    |> fold(init: [], f: (unique, item) => match unique |> last {
+      Present { value: prior } => if prior == item { unique } else { unique |> list_push(item) }
+      Absent => [item]
+    })
+}
+
+type PartitionPolicy {
+  target_crate_count: Int
+}
+
+// The declared core target the balanced policy partitions a closure into: the stage0 seed's
+// module-bearing units plus its runtime, and the default for every emitted Rust workspace. A closure
+// with fewer modules packs into fewer crates; one module is one crate.
+data crate_partition_declared_core_target: Int = 7
+
+type ExplicitPartition {
+  assignment: Map<ModuleId, CompilationUnitId>
+}
+
+type PartitionParameter
+  = ExplicitPartitionParam { partition: ExplicitPartition }
+  | PolicyPartitionParam { policy: PartitionPolicy }
+
+// AN EMITTED EDGE IS A REALIZATION EDGE WITH ITS PROVENANCE, AND THE PARTITION ADMITS IT OR REFUSES
+// IT BY NAME. A source-acyclic closure can be emitted into a crate graph that does not compile when
+// the emitter writes a path the source never declared, so the partition must decide over every
+// module edge the emitted code carries. An emitted edge whose target already reaches its source
+// through the source edges would close a cycle the source does not have: that is an emitter
+// defect, refused as EmitterReverseEdge with the provenance that produced it, never merged into a
+// graph whose R4 verdict would then report an anonymous UnitGraphCycle. An endpoint the graph does
+// not declare is refused rather than dropped, because dropping it answers for a smaller graph.
+type EmittedEdgeRefusal
+  = EmitterReverseEdge { from: ModuleId, to: ModuleId, provenance: EmittedEdgeProvenance }
+  | EmittedEdgeEndpointOutsideDag { from: String, to: String }
+
+// Every refusal names the module or the Rust rule it is about. An assignment is admitted only when
+// every module of the graph has exactly one owner (the Map gives uniqueness; coverage and the
+// absence of strangers are checked here) and the R4 verdict is valid -- on BOTH arms, because a
+// partition an author supplied is no more trusted than one the policy derived.
+type ResolvePartitionRefusalCause
+  = PolicyTargetCountNotPositive { policy: PartitionPolicy }
+  | AssignmentOmitsModule { module_id: ModuleId }
+  | AssignmentNamesModuleOutsideDag { module_id: ModuleId }
+  | PartitionRustAdmissibilityRefused { cause: PartitionR4ValidityCause }
+  | PartitionEmittedEdgeRefused { cause: EmittedEdgeRefusal }
+
+type ResolvePartitionOutcome
+  = ResolvePartitionOk {
+      assignment: Map<ModuleId, CompilationUnitId>
+      provenance: PartitionProvenance
+    }
+  | ResolvePartitionRefused { cause: ResolvePartitionRefusalCause }
+
+type Stage0PartitionCrateKind
+  = Stage0FoundationCrate
+  | Stage0LayeredCoreCrate
+  | Stage0EmitCoreCrate
+
+type Stage0PartitionCrateRow {
+  unit_id: CompilationUnitId
+  package_name: String
+  crate_dir: String
+  kind: Stage0PartitionCrateKind
+  modules: List<String>
+  reexport_packages: List<String>
+  carries_non_empty_wrappers: Bool
+}
+
+fn stage0_module_id(basename: String) -> ModuleId {
+  basename as NonEmptyStr
+}
+
+// ── THE EMITTED-EDGE MERGE ─────────────────────────────────────────────────────────────────────
+
+type EmittedEdgesMerge
+  = EmittedEdgesMerged { edges: List<ModuleDagEdge> }
+  | EmittedEdgesRefused { cause: EmittedEdgeRefusal }
+
+type EmittedEdgeMergeFold {
+  edges: List<ModuleDagEdge>
+  present: Map<String, Bool>
+  refusal: Optional<EmittedEdgeRefusal>
+}
+
+fn module_dag_edge_key(from: String, to: String) -> String {
+  concat(from, concat(" -> ", to))
+}
+
+fn string_member(set: Map<String, Bool>, key: String) -> Bool {
+  match map_get(set, key) {
+    Present { value: _ } => true
+    Absent => false
+  }
+}
+
+fn reached_set(names: List<String>, graph: CallGraph, start: String) -> Map<String, Bool> {
+  graph_reverse_reachable_members(names: names, graph: graph, start: start)
+    |> fold(init: empty_map(), f: (reached, member) => map_insert(reached, member, true))
+}
+
+// What each distinct emitted target reaches along the SOURCE edges, one walk per target rather
+// than one per edge: every emitted module shares the runtime target.
+fn emitted_target_reach(modules: List<ModuleId>, edges: List<ModuleDagEdge>, emitted: List<EmittedEdge>) -> Map<String, Map<String, Bool>> {
+  let names = modules |> map(module_id => module_id as String)
+  let forward_as_reverse = CallGraph {
+    edges: edges |> map(edge => GraphEdge { caller: edge.to as String, callee: edge.from as String })
+  }
+  emitted |> fold(init: empty_map(), f: (acc, edge) =>
+    match edge.to {
+      EmittedCrateRootTarget => acc
+      EmittedModuleTarget { module: target } =>
+        match map_get(acc, target) {
+          Present { value: _ } => acc
+          Absent => map_insert(acc, target, reached_set(names: names, graph: forward_as_reverse, start: target))
+        }
+    }
+  )
+}
+
+fn emitted_edge_merge_step(
+  acc: EmittedEdgeMergeFold,
+  edge: EmittedEdge,
+  module_set: Map<String, Bool>,
+  reach: Map<String, Map<String, Bool>>
+) -> EmittedEdgeMergeFold {
+  match acc.refusal {
+    Present { value: _ } => acc
+    Absent =>
+      match edge.to {
+        EmittedCrateRootTarget => acc
+        EmittedModuleTarget { module: target } =>
+          if edge.from == target {
+            acc
+          } else if !string_member(set: module_set, key: edge.from) || !string_member(set: module_set, key: target) {
+            EmittedEdgeMergeFold {
+              edges: acc.edges,
+              present: acc.present,
+              refusal: optional_present(value: EmittedEdgeEndpointOutsideDag { from: edge.from, to: target })
+            }
+          } else {
+            let target_reaches_source = match map_get(reach, target) {
+              Present { value: reached } => string_member(set: reached, key: edge.from)
+              Absent => false
+            }
+            if target_reaches_source {
+              EmittedEdgeMergeFold {
+                edges: acc.edges,
+                present: acc.present,
+                refusal: optional_present(value: EmitterReverseEdge {
+                  from: stage0_module_id(basename: edge.from),
+                  to: stage0_module_id(basename: target),
+                  provenance: edge.provenance
+                })
+              }
+            } else if string_member(set: acc.present, key: module_dag_edge_key(from: edge.from, to: target)) {
+              acc
+            } else {
+              EmittedEdgeMergeFold {
+                edges: acc.edges |> list_push(ModuleDagEdge {
+                  from: stage0_module_id(basename: edge.from),
+                  to: stage0_module_id(basename: target)
+                }),
+                present: map_insert(acc.present, module_dag_edge_key(from: edge.from, to: target), true),
+                refusal: Absent
+              }
+            }
+          }
+      }
+  }
+}
+
+fn merge_emitted_edges(modules: List<ModuleId>, edges: List<ModuleDagEdge>, emitted: List<EmittedEdge>) -> EmittedEdgesMerge {
+  let module_set = modules |> fold(init: empty_map(), f: (acc, module_id) => map_insert(acc, module_id as String, true))
+  let present = edges |> fold(init: empty_map(), f: (acc, edge) =>
+    map_insert(acc, module_dag_edge_key(from: edge.from as String, to: edge.to as String), true))
+  let reach = emitted_target_reach(modules: modules, edges: edges, emitted: emitted)
+  let folded = emitted |> fold(init: EmittedEdgeMergeFold { edges: edges, present: present, refusal: Absent }, f: (acc, edge) =>
+    emitted_edge_merge_step(acc: acc, edge: edge, module_set: module_set, reach: reach))
+  match folded.refusal {
+    Present { value: cause } => EmittedEdgesRefused { cause: cause }
+    Absent => EmittedEdgesMerged { edges: folded.edges }
+  }
+}
+
+// ── THE RESOLVE ────────────────────────────────────────────────────────────────────────────────
+
+// ONE COMPONENTS PASS PER RESOLVE: the policy lays out the graph's components and the R4 verdict
+// reads SCC membership from the same list, so both are handed the value rather than each
+// re-deriving it.
+fn resolve_partition_over(
+  parameter: PartitionParameter,
+  modules: List<ModuleId>,
+  edges: List<ModuleDagEdge>
+) -> ResolvePartitionOutcome {
+  let components = partition_components_dependencies_first(modules: modules, edges: edges)
+  match parameter {
+    ExplicitPartitionParam { partition: explicit } =>
+      admit_partition_assignment(
+        modules: modules,
+        edges: edges,
+        components: components,
+        assignment: explicit.assignment,
+        provenance: partition_provenance_hand_explicit()
+      )
+    PolicyPartitionParam { policy: policy } =>
+      if policy.target_crate_count < 1 {
+        ResolvePartitionRefused { cause: PolicyTargetCountNotPositive { policy: policy } }
+      } else {
+        admit_partition_assignment(
+          modules: modules,
+          edges: edges,
+          components: components,
+          assignment: policy_partition_assignment_over(modules: modules, components: components, policy: policy),
+          provenance: partition_provenance_policy_derived(policy: policy_partition_resolver_ref())
+        )
+      }
+  }
+}
+
+fn policy_partition_resolver_ref() -> DeclarationRef {
+  DeclarationRef {
+    module_path: "gunbc.crate_partition" as NonEmptyStr,
+    decl_name: "policy_partition_assignment_over" as NonEmptyStr,
+    field: WholeDeclaration,
+  }
+}
+
+fn partition_call_graph(edges: List<ModuleDagEdge>) -> CallGraph {
+  CallGraph {
+    edges: edges |> map(edge => GraphEdge { caller: edge.from as String, callee: edge.to as String })
+  }
+}
+
+// The strongly connected components of the module graph, dependencies first. Kosaraju yields them
+// importers first (std.graph graph_strongly_connected_components), so this reverses once.
+fn partition_components_dependencies_first(modules: List<ModuleId>, edges: List<ModuleDagEdge>) -> List<List<String>> {
+  graph_strongly_connected_components(
+    names: modules |> map(module_id => module_id as String),
+    graph: partition_call_graph(edges: edges)
+  ) |> reverse
+}
+
+type PolicyPartitionFill {
+  assignment: Map<ModuleId, CompilationUnitId>
+  unit_index: Int
+  filled: Int
+}
+
+fn policy_partition_unit_id(unit_index: Int) -> CompilationUnitId {
+  concat("policy-unit-", to_string(value: unit_index)) as CompilationUnitId
+}
+
+// THE BALANCED POLICY, AND WHY IT CANNOT PRODUCE AN INADMISSIBLE PARTITION. Components are laid out
+// dependencies first and cut into contiguous runs of about ceil(modules / target) members, so:
+// a component is never divided (no SccSplit), and every module edge runs from a later run to an
+// earlier or the same one, so the unit graph points strictly backwards (no UnitGraphCycle). The R4
+// verdict is still asked of the result in admit_partition_assignment -- the argument above is why
+// the policy should pass, and the verdict is what establishes that it did.
+fn policy_partition_assignment_over(
+  modules: List<ModuleId>,
+  components: List<List<String>>,
+  policy: PartitionPolicy
+) -> Map<ModuleId, CompilationUnitId> {
+  let quota = ((modules |> count) + policy.target_crate_count - 1) / policy.target_crate_count
+  let filled = components
+    |> fold(init: PolicyPartitionFill { assignment: empty_map(), unit_index: 0, filled: 0 }, f: (acc, component) =>
+      let opens_next_unit = (acc.filled >= quota) && (acc.unit_index + 1 < policy.target_crate_count)
+      let unit_index = if opens_next_unit { acc.unit_index + 1 } else { acc.unit_index }
+      let already = if opens_next_unit { 0 } else { acc.filled }
+      let unit_id = policy_partition_unit_id(unit_index: unit_index)
+      PolicyPartitionFill {
+        assignment: component |> fold(init: acc.assignment, f: (inner, member) => map_insert(inner, member as ModuleId, unit_id)),
+        unit_index: unit_index,
+        filled: already + (component |> count)
+      }
+    )
+  filled.assignment
+}
+
+fn assignment_owner(
+  assignment: Map<ModuleId, CompilationUnitId>,
+  module_id: ModuleId
+) -> Optional<CompilationUnitId> {
+  map_get(assignment, module_id)
+}
+
+fn assignment_first_omitted_module(
+  modules: List<ModuleId>,
+  assignment: Map<ModuleId, CompilationUnitId>
+) -> Optional<ModuleId> {
+  modules |> fold(init: Absent, f: (acc, module_id) =>
+    match acc {
+      Present { value: _ } => acc
+      Absent =>
+        match assignment_owner(assignment: assignment, module_id: module_id) {
+          Present { value: _ } => Absent
+          Absent => Present { value: module_id }
+        }
+    }
+  )
+}
+
+fn assignment_first_stranger(
+  modules: List<ModuleId>,
+  assignment: Map<ModuleId, CompilationUnitId>
+) -> Optional<ModuleId> {
+  let known = modules |> fold(init: empty_map(), f: (acc, module_id) => map_insert(acc, module_id, true))
+  sorted_map_keys(assignment) |> fold(init: Absent, f: (acc, module_id) =>
+    match acc {
+      Present { value: _ } => acc
+      Absent =>
+        match map_get(known, module_id) {
+          Present { value: _ } => Absent
+          Absent => Present { value: module_id }
+        }
+    }
+  )
+}
+
+fn admit_partition_assignment(
+  modules: List<ModuleId>,
+  edges: List<ModuleDagEdge>,
+  components: List<List<String>>,
+  assignment: Map<ModuleId, CompilationUnitId>,
+  provenance: PartitionProvenance
+) -> ResolvePartitionOutcome {
+  match assignment_first_omitted_module(modules: modules, assignment: assignment) {
+    Present { value: module_id } =>
+      ResolvePartitionRefused { cause: AssignmentOmitsModule { module_id: module_id } }
+    Absent =>
+      match assignment_first_stranger(modules: modules, assignment: assignment) {
+        Present { value: module_id } =>
+          ResolvePartitionRefused { cause: AssignmentNamesModuleOutsideDag { module_id: module_id } }
+        Absent =>
+          match validate_partition_r4_over(edges: edges, components: components, assignment: assignment) {
+            PartitionR4Refused { cause: cause } =>
+              ResolvePartitionRefused { cause: PartitionRustAdmissibilityRefused { cause: cause } }
+            PartitionR4Valid =>
+              ResolvePartitionOk { assignment: assignment, provenance: provenance }
+          }
+      }
+  }
+}
+
+// SCC membership is read from the components, not re-derived per pair: the pairwise reachability
+// walk this replaces had no visited set, so on a cyclic graph it did not terminate, and it paid a
+// walk per ordered pair besides.
+fn assignment_has_scc_split(
+  components: List<List<String>>,
+  assignment: Map<ModuleId, CompilationUnitId>
+) -> Bool {
+  components
+    |> any(component => {
+      let owners = component |> fold(init: [], f: (acc, member) =>
+        match assignment_owner(assignment: assignment, module_id: member as ModuleId) {
+          Present { value: owner } => if acc |> any(seen => seen == owner) { acc } else { acc |> list_push(owner) }
+          Absent => acc
+        }
+      )
+      (owners |> count) > 1
+    })
+}
+
+// The unit graph is the module edges projected through the assignment -- the same fact
+// partition_fold_outcome derives as CompilationUnit.deps, read here without asking for interfaces.
+// The projection is assignment_unit_dep_edges_over and is not repeated here.
+fn assignment_unit_graph_has_cycle(
+  edges: List<ModuleDagEdge>,
+  assignment: Map<ModuleId, CompilationUnitId>
+) -> Bool {
+  let unit_edges = assignment_unit_dep_edges_over(edges: edges, assignment: assignment)
+    |> map(e => GraphEdge { caller: e.from as String, callee: e.to as String })
+  graph_has_multi_node_scc(
+    names: map_values(assignment) |> fold(init: [], f: (acc, unit) =>
+      if acc |> any(seen => seen == (unit as String)) { acc } else { acc |> list_push(unit as String) }),
+    graph: CallGraph { edges: unit_edges }
+  )
+}
+
+fn validate_partition_r4_over(
+  edges: List<ModuleDagEdge>,
+  components: List<List<String>>,
+  assignment: Map<ModuleId, CompilationUnitId>
+) -> PartitionR4ValidityVerdict {
+  if assignment_has_scc_split(components: components, assignment: assignment) {
+    PartitionR4Refused {
+      cause: SccSplit { detail: "Rust R4: mutually dependent modules assigned to different compilation units" }
+    }
+  } else if assignment_unit_graph_has_cycle(edges: edges, assignment: assignment) {
+    PartitionR4Refused {
+      cause: UnitGraphCycle { detail: "Rust R4: compilation-unit dependency graph is cyclic" }
+    }
+  } else {
+    PartitionR4Valid
+  }
+}
+
+// ── THE UNIT DEPENDENCIES AN ASSIGNMENT INDUCES ───────────────────────────────────────────────
+
+type UnitDepEdge {
+  from: CompilationUnitId
+  to: CompilationUnitId
+}
+
+fn assignment_unit_dep_edges_over(
+  edges: List<ModuleDagEdge>,
+  assignment: Map<ModuleId, CompilationUnitId>
+) -> List<UnitDepEdge> {
+  edges |> fold(init: [], f: (acc, edge) =>
+    match assignment_owner(assignment: assignment, module_id: edge.from) {
+      Absent => acc
+      Present { value: from_unit } =>
+        match assignment_owner(assignment: assignment, module_id: edge.to) {
+          Absent => acc
+          Present { value: to_unit } =>
+            if from_unit == to_unit { acc }
+            else if acc |> any(e => (e.from == from_unit) && (e.to == to_unit)) { acc }
+            else { acc |> list_push(UnitDepEdge { from: from_unit, to: to_unit }) }
+        }
+    }
+  )
+}
+
+fn unit_direct_deps(edges: List<UnitDepEdge>, unit_id: CompilationUnitId) -> List<CompilationUnitId> {
+  edges |> fold(init: [], f: (acc, e) =>
+    if (e.from == unit_id) && !(acc |> any(seen => seen == e.to)) { acc |> list_push(e.to) } else { acc })
+}
+
+fn unit_dep_closure_step(
+  edges: List<UnitDepEdge>,
+  acc: List<CompilationUnitId>
+) -> List<CompilationUnitId> {
+  acc |> fold(init: acc, f: (outer, uid) =>
+    unit_direct_deps(edges: edges, unit_id: uid) |> fold(init: outer, f: (inner, dep) =>
+      if inner |> any(seen => seen == dep) { inner } else { inner |> list_push(dep) }))
+}
+
+// Fuel bounds the rounds: each round adds at least one unit or the closure is complete, so the
+// edge count is an upper bound rather than a guess (DESIGN section 4: bounded and forward).
+fn unit_dep_closure(
+  edges: List<UnitDepEdge>,
+  acc: List<CompilationUnitId>,
+  fuel: Int
+) -> List<CompilationUnitId> {
+  if fuel <= 0 {
+    acc
+  } else {
+    let grown = unit_dep_closure_step(edges: edges, acc: acc)
+    if (grown |> count) == (acc |> count) { acc } else {
+      unit_dep_closure(edges: edges, acc: grown, fuel: fuel - 1)
+    }
+  }
+}
+
+fn unit_package_name(rows: List<Stage0PartitionCrateRow>, unit_id: CompilationUnitId) -> Optional<String> {
+  rows |> fold(init: Absent, f: (acc, row) =>
+    match acc {
+      Present { value: _ } => acc
+      Absent => if row.unit_id == unit_id { optional_present(value: row.package_name) } else { Absent }
+    }
+  )
+}
+
+// A DEP EDGE WHOSE DESTINATION HAS NO PACKAGE ROW IS NOT A DEP THAT CONTRIBUTES NOTHING. Answering
+// Absent => acc would drop the edge, and for a FOUNDATION row whose authored reexport_packages is
+// itself [] a dropped edge leaves derived [] against authored [], so a detector over this would
+// CERTIFY AGREEMENT FROM AN INCOMPLETE PROJECTION. This is exposed over supplied inputs and
+// survives as a permanent control, so what matters is what its signature PERMITS, not what the
+// current rows reach.
+type DerivedDepPackages
+  = DerivedDepPackagesOk { packages: List<String> }
+  | DerivedDepPackagesUnitHasNoRow { unit_id: CompilationUnitId }
+
+fn derived_dep_packages(
+  edges: List<UnitDepEdge>,
+  rows: List<Stage0PartitionCrateRow>,
+  row: Stage0PartitionCrateRow
+) -> DerivedDepPackages {
+  unit_dep_closure(
+    edges: edges,
+    acc: unit_direct_deps(edges: edges, unit_id: row.unit_id),
+    fuel: (edges |> count) + 1
+  )
+    |> fold(init: DerivedDepPackagesOk { packages: [] }, f: (acc, dep) =>
+      match acc {
+        DerivedDepPackagesUnitHasNoRow { unit_id: unit_id } => DerivedDepPackagesUnitHasNoRow { unit_id: unit_id }
+        DerivedDepPackagesOk { packages: packages } =>
+          match unit_package_name(rows: rows, unit_id: dep) {
+            Present { value: pkg } => DerivedDepPackagesOk { packages: packages |> list_push(pkg) }
+            Absent => DerivedDepPackagesUnitHasNoRow { unit_id: dep }
+          }
+      }
+    )
+}
diff --git a/dag/gunbc/cursor_harness_credential.dag b/dag/gunbc/cursor_harness_credential.dag
new file mode 100644
index 00000000000..8d2a789f02a
--- /dev/null
+++ b/dag/gunbc/cursor_harness_credential.dag
@@ -0,0 +1,206 @@
+module gunbc.cursor_harness_credential
+
+import std.types { String, NonEmptyStr, Bool, List, FilePath }
+import std.upsert_decision { ObservationVerdict, Converged, Drifted, UnknownRefused }
+import extdeps.cloud.gcp.secret_ref { SecretRef }
+import extdeps.cloud.gcp.secret_manager { SmVersionState }
+import extdeps.languages.json.emit { JsonValue, JsonNull, JsonBool, JsonNumber, JsonString, JsonArray, JsonObject }
+import extdeps.languages.json.parse {
+  parse_json_document,
+  JsonDocumentParsed,
+  JsonDocumentUnreadable,
+  json_object_unique_member,
+  JsonMemberFound,
+  JsonMemberAbsent,
+  JsonMemberDuplicated,
+  JsonMemberNotAnObject,
+}
+import extdeps.llm.cursor_cli {
+  cursor_api_key_env_var,
+  CursorRunShape,
+  cursor_model_auto,
+  CursorDefaultEditMode,
+  CursorSandboxEnabled,
+  CursorStreamJson,
+  cursor_environment_authenticated_argv,
+}
+import extdeps.posix.sh_invocation { posix_sh_export_from_file_then_exec_command, PosixShExportExecReady, PosixShExportExecEmitRefused, PosixShRemoveFileAfterRead }
+import extdeps.posix.shell_command_language { admit_posix_shell_name, PosixShellNameAdmitted, PosixShellNameRefused }
+import extdeps.exec.command { argv_words }
+import product.host_identity { HostIdentity }
+import gunbc.fleet_host_identity { operator_host_srv2 }
+import gunbc.secret_provision { fleet_secret_ref, secret_ref_pin_version }
+import gunbc.readback_independence { ReadBackProbe, ProbeInert }
+import gunbc.auth.materialized_secret {
+  EnvVar,
+  MaterializedSecret,
+  MaterializationOutcome,
+  with_materialized_secret,
+}
+
+// ONE CURSOR API KEY, READ FROM gunbai-secrets, BOUND AS CURSOR_API_KEY. extdeps.llm.cursor_cli
+// records that the CLI authenticates per invocation with a value, so the fleet credential is a secret
+// and nothing else: no directory, no rotation, nothing to write back. The dispatch credential is the
+// existing CursorApiKeySecretRef arm (gunbc.dispatch_selection declared_provider_inventory_for_instance
+// builds it from this ref), and gunbc.cursor_sdk_local_binding admits it unchanged.
+//
+// The version is EXACT, not latest: gunbc.cursor_sdk_secret_admission refuses latest for Cursor, and
+// that ruling stands. Version 1 is the operator's first upload; replacing the key is a new version
+// and an edit to this row.
+
+data cursor_api_key_harness_secret_id: NonEmptyStr = "cursor-api-key-harness" as NonEmptyStr
+
+data cursor_api_key_harness_secret_ref: SecretRef = secret_ref_pin_version(
+  ref: fleet_secret_ref(secret_id: cursor_api_key_harness_secret_id),
+  version: "1",
+)
+
+
+// THE LIVENESS PROBE IS THE CLI'S OWN STATUS COMMAND. Observed on cursor-agent 2026.10.01-e373342
+// (2026-10-05) with a deliberately invalid key in CURSOR_API_KEY: `cursor-agent status --format json`
+// exits 0 and prints {"status":"unauthenticated","isAuthenticated":false,...}. It asks Cursor whether
+// the key is accepted and cannot make a rejected key accepted, so it is ProbeInert and
+// with_materialized_secret's independence gate admits it. A --print turn with the same invalid key
+// exits 1 with prose on stderr and no JSON, which is why the probe runs before the turn rather than
+// the turn's failure standing in for it.
+data cursor_status_probe: ReadBackProbe = ReadBackProbe {
+  label: "cursor-agent status --format json with CURSOR_API_KEY bound",
+  subject: "the API key cursor-api-key-harness holds is one Cursor currently accepts",
+  effect_on_subject: ProbeInert,
+}
+
+data cursor_status_is_authenticated_key: NonEmptyStr = "isAuthenticated" as NonEmptyStr
+data cursor_status_status_key: NonEmptyStr = "status" as NonEmptyStr
+
+type CursorStatusReading
+  = CursorStatusAuthenticated
+  | CursorStatusUnauthenticated { status: String }
+  | CursorStatusUnreadable { detail: String }
+
+fn cursor_status_status_text(doc: JsonValue) -> String {
+  match json_object_unique_member(v: doc, key: cursor_status_status_key as String) {
+    JsonMemberFound { value } =>
+      match value {
+        JsonString { value: s } => s
+        JsonNull => ""
+        JsonBool { value: _ } => ""
+        JsonNumber { lexeme: _ } => ""
+        JsonArray { elements: _ } => ""
+        JsonObject { members: _ } => ""
+      }
+    JsonMemberAbsent => ""
+    JsonMemberDuplicated { count: _ } => ""
+    JsonMemberNotAnObject => ""
+  }
+}
+
+fn cursor_status_reading(stdout: String) -> CursorStatusReading {
+  match parse_json_document(s: stdout) {
+    JsonDocumentUnreadable { gap: _ } => CursorStatusUnreadable { detail: "status output is not a JSON document" }
+    JsonDocumentParsed { value: doc } =>
+      match json_object_unique_member(v: doc, key: cursor_status_is_authenticated_key as String) {
+        JsonMemberFound { value } =>
+          match value {
+            JsonBool { value: authenticated } =>
+              if authenticated {
+                CursorStatusAuthenticated
+              } else {
+                CursorStatusUnauthenticated { status: cursor_status_status_text(doc: doc) }
+              }
+            JsonNull => CursorStatusUnreadable { detail: "isAuthenticated is not a boolean" }
+            JsonNumber { lexeme: _ } => CursorStatusUnreadable { detail: "isAuthenticated is not a boolean" }
+            JsonString { value: _ } => CursorStatusUnreadable { detail: "isAuthenticated is not a boolean" }
+            JsonArray { elements: _ } => CursorStatusUnreadable { detail: "isAuthenticated is not a boolean" }
+            JsonObject { members: _ } => CursorStatusUnreadable { detail: "isAuthenticated is not a boolean" }
+          }
+        JsonMemberAbsent => CursorStatusUnreadable { detail: "isAuthenticated absent" }
+        JsonMemberDuplicated { count: _ } => CursorStatusUnreadable { detail: "isAuthenticated duplicated" }
+        JsonMemberNotAnObject => CursorStatusUnreadable { detail: "status output is not a JSON object" }
+      }
+  }
+}
+
+// Rejected is Drifted (the store holds a value upstream no longer accepts), not Absent: the secret
+// exists, the key in it is dead, and the remedy is a new key, not a new secret.
+fn cursor_status_liveness(reading: CursorStatusReading) -> ObservationVerdict {
+  match reading {
+    CursorStatusAuthenticated => Converged
+    CursorStatusUnauthenticated { status: _ } => Drifted
+    CursorStatusUnreadable { detail: _ } => UnknownRefused
+  }
+}
+
+// THE BRACKET, with the status probe's stdout as the liveness observation. No probe output means no
+// observation, and with_materialized_secret refuses that as UnknownRefused.
+fn with_cursor_harness_api_key<R>(
+  existence: SmVersionState,
+  status_stdout: String?,
+  use: fn(MaterializedSecret) -> R,
+) -> MaterializationOutcome<R> {
+  let observed = match status_stdout {
+    Present { value: out } => Present { value: cursor_status_liveness(reading: cursor_status_reading(stdout: out)) }
+    Absent => none
+  }
+  with_materialized_secret(
+    ref: cursor_api_key_harness_secret_ref,
+    binding: EnvVar { name: cursor_api_key_env_var },
+    existence: existence,
+    probe: cursor_status_probe,
+    liveness_observation: observed,
+    use: use,
+  )
+}
+
+// ── The spawn: the custody file becomes CURSOR_API_KEY in the child, never argv ─────────────────
+//
+// gunbc.host_credential_custody_converge CursorWorkerTurnApiKey places the key at this path on this
+// host, read-only to the operator account the dispatch spawns run as. The spawn exports it from the
+// file inside the child through the shared extdeps.posix.sh_invocation wrapper, which exits 78 if the
+// file cannot be read, so the key is never on an argv the process table shows.
+
+data cursor_worker_turn_custody_host: HostIdentity = operator_host_srv2
+data cursor_worker_turn_api_key_host_path: NonEmptyStr = "/etc/gunbc-cursor-harness/api-key" as NonEmptyStr
+
+// THE UNATTENDED RUN: print mode with stream-json events, the default editing mode, --force so the
+// agent may run commands without a human to approve them, the sandbox explicitly enabled so --force
+// does not also mean unconfined, and --trust because an untrusted workspace prompts and an
+// unattended run would hang there (extdeps.llm.cursor_cli).
+fn cursor_worker_turn_run(worktree_path: String, prompt: NonEmptyStr) -> CursorRunShape {
+  CursorRunShape {
+    model: cursor_model_auto,
+    mode: CursorDefaultEditMode,
+    sandbox: CursorSandboxEnabled,
+    output_format: CursorStreamJson,
+    force: true,
+    trust_workspace: true,
+    workspace: worktree_path as FilePath,
+    prompt: prompt,
+  }
+}
+
+// key_path is the attempt's credential snapshot, removed by the shell before exec (the shared
+// one-snapshot rule, gunbc.roadmap_dispatch_actuator dispatch_credential_snapshot_path_for_instance).
+// The env-var name is admitted as a POSIX name before it reaches the wrapper (extdeps.posix.
+// shell_command_language admit_posix_shell_name), and the wrapper's program is emitted from the bash
+// grammar, which may refuse; either refusal is one arm carrying its reason.
+type CursorWorkerTurnArgv
+  = CursorWorkerTurnArgvReady { argv: List<String> }
+  | CursorWorkerTurnRefused { reason: NonEmptyStr }
+
+fn cursor_worker_turn_argv(key_path: NonEmptyStr, worktree_path: String, prompt: NonEmptyStr) -> CursorWorkerTurnArgv {
+  match admit_posix_shell_name(spelling: cursor_api_key_env_var as String) {
+    PosixShellNameAdmitted { name } =>
+      match posix_sh_export_from_file_then_exec_command(
+        name: name,
+        path: key_path,
+        command: cursor_environment_authenticated_argv(run: cursor_worker_turn_run(worktree_path: worktree_path, prompt: prompt)),
+        disposition: PosixShRemoveFileAfterRead,
+      ) {
+        PosixShExportExecReady { command } => CursorWorkerTurnArgvReady { argv: argv_words(command: command) }
+        PosixShExportExecEmitRefused { name: n } =>
+          CursorWorkerTurnRefused { reason: join(["the sh emitter refused the export-and-exec program for ", n as String], "") as NonEmptyStr }
+      }
+    PosixShellNameRefused { spelling } =>
+      CursorWorkerTurnRefused { reason: join(["the cursor credential variable name ", spelling, " is not a POSIX shell name"], "") as NonEmptyStr }
+  }
+}
diff --git a/dag/gunbc/deploy_transition_bootstrap.dag b/dag/gunbc/deploy_transition_bootstrap.dag
index 954f1777c89..e79f1168a66 100644
--- a/dag/gunbc/deploy_transition_bootstrap.dag
+++ b/dag/gunbc/deploy_transition_bootstrap.dag
@@ -5,7 +5,10 @@ import std.types { String, Bool, List, NonEmptyStr }
 import gunbc.live_deploy.spec {
   DeploymentNames,
   deployment_belt_service_unit_name,
-  deployment_belt_timer_unit_name,
+  deployment_belt_exit_path_unit_name,
+  deployment_belt_answer_path_unit_name,
+  deployment_belt_exit_drain_service_unit_name,
+  deployment_belt_discovery_service_unit_name,
 }
 import gunbc.live_deploy.operations {
   systemctl_mask_now_command,
@@ -82,15 +85,19 @@ fn quiescence_regime(awareness: ReleaseMarkerAwareness) -> QuiescenceRegimeDecis
   }
 }
 
-// THE QUIESCED SET IS EVERY UNIT THAT CAN ACTUATE A RELEASE, so both belt units are in it, not only
-// the timer. Disabling the timer alone leaves the one-shot service startable by anything reaching
-// systemd, and the HTTP dispatcher lives in the serve unit -- the deploy convergence design record
-// already notes that stopping only the timer leaves the click path admitting against a
-// half-published release, which is this defect one layer out.
+// THE QUIESCED SET IS EVERY UNIT THAT CAN ACTUATE A RELEASE: the belt's two event path units (a
+// recorded exit or a publication answer starts a unit that queues obligations -- there is no belt
+// timer since dogfood intervention #4), the belt service that queues the launch, the drain and discovery services those
+// paths start (static oneshots: masking only the triggers leaves them startable by any other
+// requester), and the serve unit, where the HTTP dispatcher lives -- the deploy convergence design record already notes that stopping
+// only the belt's trigger leaves the click path admitting against a half-published release.
 fn bootstrap_quiesced_units(names: DeploymentNames) -> List<NonEmptyStr> {
   [
-    deployment_belt_timer_unit_name(names: names),
+    deployment_belt_exit_path_unit_name(names: names),
+    deployment_belt_answer_path_unit_name(names: names),
     deployment_belt_service_unit_name(names: names),
+    deployment_belt_exit_drain_service_unit_name(names: names),
+    deployment_belt_discovery_service_unit_name(names: names),
     names.unit_name,
   ]
 }
@@ -102,7 +109,7 @@ fn bootstrap_quiesced_units(names: DeploymentNames) -> List<NonEmptyStr> {
 // asserted a guarantee the operation does not deliver.
 //
 // MEASURED, not reasoned: `gunbc.live_deploy.emit` renders the belt SERVICE with
-// `install: NotInstallable` -- a STATIC unit, activated by the belt timer rather than an [Install]
+// `install: NotInstallable` -- a STATIC unit, activated by another unit rather than an [Install]
 // section. A static unit has no enablement symlinks, so `systemctl disable` does nothing; only the
 // `--now` half took effect, which is exactly the non-durable `stop` rejected above. The belt
 // service's declared durability was supplied by the timer being disabled separately, not by this
diff --git a/dag/gunbc/derived_row_roster_seed_growth.dag b/dag/gunbc/derived_row_roster_seed_growth.dag
index ecf4e5777e7..844780ac6c6 100644
--- a/dag/gunbc/derived_row_roster_seed_growth.dag
+++ b/dag/gunbc/derived_row_roster_seed_growth.dag
@@ -4,8 +4,11 @@ import gunbc.roadmap_model { RoadmapNodeId }
 import gunbc.seed_growth { SeedGrowthJustification }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 
-// FORWARD-FREEZE RECEIPT for the host fold that derives gunbc.recurring_failure_mode.roster
-// from sibling row files. gunbc.seed_growth_admission seed_growth_forward_freeze_policy_note
+// FORWARD-FREEZE RECEIPT for the host fold that derives gunbc.recurring_failure_mode.roster and
+// gunbc.rung_drop.roster from sibling row files and contributes them to the compiler's input IN
+// MEMORY. The AcquiredDag impl methods (on_disk, path, is_derived, read) are not separately citable
+// as DeclarationRefs and are enumerated here instead; they are covered by the AcquiredDag row's
+// purpose and retire with it. gunbc.seed_growth_admission seed_growth_forward_freeze_policy_note
 // makes unenumerated hand growth in src/v1 a stop-line. The PR body pointing at
 // gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall is the right dissolution
 // CONTENT and is not a substitute for enumerating the added items (DESIGN §5: a dissolution
@@ -31,12 +34,22 @@ data derived_row_roster_seed_growth_justification: SeedGrowthJustification = See
     DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster", decl_name: "ROSTER_MODULE", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster", decl_name: "ROW_DIR_REL", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster", decl_name: "row_dir_roster", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster", decl_name: "ensure_if_row_dir", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster", decl_name: "ensure_if_row_dir_or_panic", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster", decl_name: "ensure_derived_roster", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster", decl_name: "write_atomically", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster", decl_name: "row_stems", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster", decl_name: "render_roster", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster", decl_name: "AcquiredDag", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster", decl_name: "acquire_dir_files", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "scratch_workspace", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "author", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "drop_row", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "tree", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "rung_drop_fixture", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "acquire_rung_drop_dir", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "derived_roster_body", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "acquisition_contributes_the_roster_in_memory_and_writes_nothing", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "adding_and_removing_a_row_file_changes_the_roster", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "a_legacy_physical_roster_refuses_located_and_is_neither_consumed_nor_deleted", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "an_unreadable_row_input_refuses_rather_than_shortening_the_roster", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "acquisition_works_over_read_only_source_roots", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "the_parse_sweep_indexes_the_derived_roster_without_writing_it", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "the_roster_module_is_the_row_module_plus_the_roster_stem", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "reader", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.derived_row_roster.tests", decl_name: "membership_is_selected_by_declared_row_type_not_by_directory", field: WholeDeclaration },
@@ -58,8 +71,8 @@ data derived_row_roster_seed_growth_justification: SeedGrowthJustification = See
     DeclarationRef { module_path: "v1_compiler.cli_run.rostered_row_join.file_roster_join_tests", decl_name: "roster_member_without_a_file_refuses", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.rostered_row_join.file_roster_join_tests", decl_name: "equal_file_and_roster_sets_are_silent", field: WholeDeclaration }
   ],
-  reason: "WHY RUST RATHER THAN .dag: the substrate has no directory enumeration sufficient to BIND each sibling `.dag` as a typed RecurringFailureMode value. Membership discovery exists (`v2.std.decl_index` `data_decl_type_facts`); value binding does not. Until that grounding lands, a checkout with no committed roster has no module for the three importers (`gunbc.design_ledgers`, `gunbc.ledger_row_coherence`, `test.claim.generated_artifact_merge_driver_real_execution_witness`) and the required parse join reports RosterModuleAbsent on the intended steady state. The host fold lists sibling files, writes gitignored roster.dag atomically, and refuses a shortened list. That is a §7 seed realization of a missing capability, not a scaffold: dissolution is grounded in gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall (declaration-value binding), not in a sentence in the Rust module.\n\nThe file-versus-roster join arms are the other half of the same host: a skip in the writer must still refuse. They execute inside run_rostered_row_join on the required parse path (witnesses lane). file_roster_join_tests are the off-path REDs for those arms; they are enumerated because test items are still hand Rust.\n\nWHY ADMITTED AGAINST THE v1 FREEZE: gunbc.v1_maintenance_standing v1_seed_standing admits by PURPOSE. Removing the silent-drop constructor from the failure-mode ledger is an instrument tax every self-host lane was paying (merge hotspot). No new language behavior, no escape hatch, no emitted public surface.\n\nTHE BASE SIDE OF THE DERIVED ROSTER (gunbc#10856, three production items and three test items). is_derived_roster_path, roster_root_prefix and roster_from_path_listing exist because a DERIVED artifact has no base side in a diff and must not be inherited from the head. roster.dag is gitignored and written on the read path, so it can never appear in `git diff --name-status`, and the baseline reconstruction -- carrying forward every head record the diff did not touch -- was therefore standing the HEAD`s generated roster up as the BASE`s. That made an ordinary row append read as a name resolving into a pool rather than an authored reference, because the roster`s two sides were the same bytes. They live HERE rather than beside their caller for the reason this module exists: roster_from_path_listing renders through render_roster, the same function the writer uses, so the roster`s bytes keep ONE authority whether the question is asked of a directory or of a base tree listing. They carry the same trigger as the rest of this population -- with declaration-value binding the derivation has no name-list at all, on either side, and these delete with the writer.\n\nTHE SECOND LEDGER, NOT A SECOND MECHANISM (gunbc.rung_drop cutover). gunbc.rung_drop.roster was a hand-appended list, so a drop file nobody also listed there was absent from docs/design-rung-drops.md. The same fold now derives it: DerivedRowRoster is one table row per ledger (DERIVED_ROW_ROSTERS), and declares_row selects a sibling file only when it declares its own stem as a row of the ledger's type, because the rung-drop directory also holds helper modules (shared_capability, standing). That selector is a line-shape read and not the authority on what was declared; the parse join's DeclaredNotRostered reads the compiled population and refuses any RungDrop row it missed. The base side reads each listed row file at the base revision for the same reason. These carry the same trigger as the rest of the population.\n\nRe-derive this list with tools.seed_growth_change_population rather than maintaining a count.",
+  reason: "WHY RUST RATHER THAN .dag: the substrate has no directory enumeration sufficient to BIND each sibling `.dag` as a typed row value. Membership discovery exists (`v2.std.decl_index` `data_decl_type_facts`); value binding does not. Until that grounding lands, a checkout carries no roster module for the importers (`gunbc.design_ledgers`, `gunbc.ledger_row_coherence`, `gunbc.rung_drop.standing` and its readers, `test.claim.generated_artifact_merge_driver_real_execution_witness`) unless the host contributes one, and the required parse join reports RosterModuleAbsent on the intended steady state. THE BOUNDARY IS SOURCE ACQUISITION, AND IT WRITES NOTHING: every walk that acquires a source population hands each directory's listing to acquire_dir_files, which returns AcquiredDag sources -- the listed files, plus for a row directory the roster rendered (render_roster) from the sibling contents that same call read -- so compiler_sources = acquired_sources + derive_rosters(acquired_sources) from one read of the rows. AcquiredDag has no Deref to Path, so a consumer cannot reach the disk for a module that has no file. A physical file at a reserved roster identity refuses, located, and is never consumed, overridden or deleted by the loader; an unreadable row refuses rather than shortening the roster. The earlier realization wrote a gitignored roster.dag into the checkout on every walk, which dirtied the checkout each invocation admitted and made deploy candidate admission refuse; that writer (ensure_if_row_dir, ensure_if_row_dir_or_panic, ensure_derived_roster, write_atomically, row_stems) is DELETED, and the deploy-scope exemption it forced is deleted with it. That is a section 7 seed realization of a missing capability, not a scaffold: dissolution is grounded in gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall (declaration-value binding), not in a sentence in the Rust module.\n\nThe file-versus-roster join arms are the other half of the same host: a skip in the derivation must still refuse. They execute inside run_rostered_row_join on the required parse path (witnesses lane). file_roster_join_tests are the off-path REDs for those arms; they are enumerated because test items are still hand Rust.\n\nWHY ADMITTED AGAINST THE v1 FREEZE: gunbc.v1_maintenance_standing v1_seed_standing admits by PURPOSE. Removing the silent-drop constructor from the failure-mode ledger is an instrument tax every self-host lane was paying (merge hotspot). No new language behavior, no escape hatch, no emitted public surface.\n\nTHE BASE SIDE OF THE DERIVED ROSTER (gunbc#10856, three production items and three test items). is_derived_roster_path, roster_root_prefix and roster_from_path_listing exist because a DERIVED artifact has no base side in a diff and must not be inherited from the head. the roster module has no committed file (it is contributed in memory on the read path), so it can never appear in `git diff --name-status`, and the baseline reconstruction -- carrying forward every head record the diff did not touch -- was therefore standing the HEAD`s generated roster up as the BASE`s. That made an ordinary row append read as a name resolving into a pool rather than an authored reference, because the roster`s two sides were the same bytes. They live HERE rather than beside their caller for the reason this module exists: roster_from_path_listing renders through render_roster, the same function head acquisition uses, so the roster`s bytes keep ONE authority whether the question is asked of a directory or of a base tree listing. They carry the same trigger as the rest of this population -- with declaration-value binding the derivation has no name-list at all, on either side, and these delete with the derivation.\n\nTHE SECOND LEDGER, NOT A SECOND MECHANISM (gunbc.rung_drop cutover). gunbc.rung_drop.roster was a hand-appended list, so a drop file nobody also listed there was absent from docs/design-rung-drops.md. The same fold now derives it: DerivedRowRoster is one table row per ledger (DERIVED_ROW_ROSTERS), and declares_row selects a sibling file only when it declares its own stem as a row of the ledger's type, because the rung-drop directory also holds helper modules (shared_capability, standing). That selector is a line-shape read and not the authority on what was declared; the parse join's DeclaredNotRostered reads the compiled population and refuses any RungDrop row it missed. The base side reads each listed row file at the base revision for the same reason. These carry the same trigger as the rest of the population.\n\nRe-derive this list with tools.seed_growth_change_population rather than maintaining a count.",
   owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
   trigger: "THE SUBJECT IS THESE DECLARATIONS, and they retire with declaration introspection sufficient to BIND a discovered data declaration as a typed value of its declared type — the same capability named by gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall — at which point the host fold and the file-join arms DELETE because there is no authored or derived name-list to omit a row from. A differently named hand writer is not dissolution: it is this obligation under a new key. Registering roster.dag on gunbc.generated_artifact does not discharge this: that would restore heal/drift rewrite of a gitignored file. data_decl_type_facts already exists and does not discharge a trigger that names BINDING.",
-  current_boundary: "v1_compiler.cli_run.derived_row_roster is reached from run_required_wave_admission (is_derived_roster_path, roster_root_prefix and roster_from_path_listing, which is the phase`s base side and the only consumer of those three), collect_dag_files_result, collect_dag_files_tolerant (write errors ignored), main.rs collect_dag_files, compiler_tests collect_dag_recursive, and run_dag_parse_sweep (the loud required-CI writer). Its DERIVED_ROW_ROSTERS table covers gunbc.recurring_failure_mode.roster and gunbc.rung_drop.roster. join_row_files_to_roster_members is reached only from join_recurring_failure_mode_files_to_roster inside run_rostered_row_join. The derived files are gitignored and are not gunbc.generated_artifact rows. Docs gate main agrees only DesignRungDropsArtifact."
+  current_boundary: "v1_compiler.cli_run.derived_row_roster is reached from run_required_wave_admission (is_derived_roster_path, roster_root_prefix and roster_from_path_listing, the phase`s base side; namespace_baseline reads a committed base roster as source and synthesizes none beside it), from entry_source_from_index_or_disk (is_derived_roster_path, answering an entry that names a derived roster from the index), and through acquire_dir_files from every source-acquisition walk: collect_dag_files_result, collect_dag_files_tolerant (which now returns a located refusal for a roster it cannot derive instead of swallowing it), main.rs collect_dag_files, compiler_tests collect_dag_recursive, and run_dag_parse_sweep (the required-CI parse phase). Consumers of those walks receive AcquiredDag and read through it, so module indexing, import and reference discovery, entry lookup, for_each_parsed_module_binding, try_build_module_index, try_index_source_root_into_module_index, decl_facts_corpus_walk and decls_parse_only_from_disk see the same population as the parse sweep. Nothing writes under a source root. Its DERIVED_ROW_ROSTERS table covers gunbc.recurring_failure_mode.roster and gunbc.rung_drop.roster. join_row_files_to_roster_members is reached only from join_recurring_failure_mode_files_to_roster inside run_rostered_row_join. Legacy roster files left by older binaries are gunbc.repo_workspace SupersededAuthority rows, retired by gunbc.live_deploy.repository_convergence retire_superseded_workspace_files during deployed-tree convergence. Docs gate main agrees only DesignRungDropsArtifact."
 }
diff --git a/dag/gunbc/design_argument.dag b/dag/gunbc/design_argument.dag
index 626165a13f7..0ee8ca45524 100644
--- a/dag/gunbc/design_argument.dag
+++ b/dag/gunbc/design_argument.dag
@@ -110,7 +110,7 @@ data conformance_domains: List<ConformanceDomain> = [
   ConformanceDomain {
     key: "conformance-leasing",
     label: "leasing / locking / grants / privileged access",
-    question: "Does the change take exclusive or bounded use of something -- a slot, a head, a host, a file, a budget -- or perform a privileged effect -- a Secret Manager read or write, an IAM binding, a credential mint, a GitHub App token -- without inhabiting the corpus's lease, grant and authorization-pattern model, and if it departs from that model, does it say why? Who may perform an effect and how that permission was granted is one question: the authorization pattern (workload identity federation with a scoped grant, per-effect operator approval through the ntfy loop, or a named human-only step) is SELECTED by gunbc.auth.authorization_pattern_selection from the effect's characteristics, never chosen at the call site, and an operator credential relayed by chat or between sessions is the pattern that selection refuses.",
+    question: "Does the change take exclusive or bounded use of something -- a slot, a head, a host, a file, a budget -- or perform a privileged effect -- a Secret Manager read or write, an IAM binding, a credential mint, a GitHub App token -- without inhabiting the corpus's lease, grant and authorization-pattern model, and if it departs from that model, does it say why? Who may perform an effect and how that permission was granted is one question: the authorization pattern (workload identity federation with a scoped grant, per-effect operator approval through the ntfy loop, or a named human-only step) is SELECTED by gunbc.auth.authorization_pattern_selection from the effect's characteristics, never chosen at the call site.",
     homes: ConformanceHomes {
       first: decl_ref(module_path: "std.temporal_effect", decl_name: "HeldLease"),
       rest: [
@@ -140,7 +140,7 @@ data conformance_domains: List<ConformanceDomain> = [
       "a one-off or irreversible effect performed by a dispatched run under the federated identity with no approval request, or a recurring effect gated on a per-run phone tap",
       "a dashboard-only or checkout-only action performed by prose instruction with no std.human_intervention row naming the step"
     ],
-    narrative: "exclusive or bounded use and privileged access are one domain: leases with a declared deadline, compare-and-set expectations, scoped authorizations, grants naming who may perform an effect and how it is released, resource handles -- and, since 2026-09-19, which AUTHORIZATION PATTERN performs a privileged effect. That pattern is a §3d selection (gunbc.auth.authorization_pattern_selection consumes std.decision over the effect's frequency, reversibility, surface, workload-identity binding, minted reach and billing consequence): workload identity federation with a per-secret cell for recurring automated effects, one operator approval through the ntfy loop for one-off or witnessed effects, a named human-only step where no API exists, and a refusal for an operator token relayed by chat or between sessions. The census (gunbc.auth.privileged_effect_census) classifies every current site by executing that selection, so the reviewer's three-valued answer is derived for the sites that exist and asked of the site a change adds. A compare-and-set slot's generation line is kept whole by file_compare_and_set and observe_cas_slot_state (gunbc.durable_cas_file_store), because several slots read it as an audit trail; a slot whose only fact is its head -- the materialization store's occupancy index and family holds are the first -- uses the distinct windowed operations (file_compare_and_set_windowed, observe_cas_slot_state_windowed, and the file_hold_*_windowed family) with a CasGenerationWindow of k >= 2, so a bounded store's own bookkeeping does not grow with its commits. They are two contracts, not one operation with a mode: keep-all callers are untouched, and only a caller that names the windowed operation can delete generations. A window read takes the head from a listing of the slot root and verifies head+1 is absent, re-reading on a race and never guessing; a write reclaims below head-k only after its own commit, and a refused delete is reported, never fatal. Exclusion is unchanged -- losers re-read and retry -- so nothing waits on a hold. docs/plans/fabric-storage.md names the head-probe bound this also lifts and assigns its remedy to compaction -- a head that starts from a snapshot; a window is that head-starting-above-1 shape for a slot whose history needs no snapshot, and the fabric heads are not opted in",
+    narrative: "exclusive or bounded use and privileged access are one domain: leases with a declared deadline, compare-and-set expectations, scoped authorizations, grants naming who may perform an effect and how it is released, resource handles -- and, since 2026-09-19, which AUTHORIZATION PATTERN performs a privileged effect. That pattern is a §3d selection (gunbc.auth.authorization_pattern_selection consumes std.decision over the effect's frequency, reversibility, surface, workload-identity binding, minted reach and billing consequence): workload identity federation with a per-secret cell for recurring automated effects, one operator approval through the ntfy loop for one-off or witnessed effects, and a named human-only step where no API exists. The census (gunbc.auth.privileged_effect_census) classifies every current site by executing that selection, so the reviewer's three-valued answer is derived for the sites that exist and asked of the site a change adds. A compare-and-set slot's generation line is kept whole by file_compare_and_set and observe_cas_slot_state (gunbc.durable_cas_file_store), because several slots read it as an audit trail; a slot whose only fact is its head -- the materialization store's occupancy index and family holds are the first -- uses the distinct windowed operations (file_compare_and_set_windowed, observe_cas_slot_state_windowed, and the file_hold_*_windowed family) with a CasGenerationWindow of k >= 2, so a bounded store's own bookkeeping does not grow with its commits. They are two contracts, not one operation with a mode: keep-all callers are untouched, and only a caller that names the windowed operation can delete generations. A window read takes the head from a listing of the slot root and verifies head+1 is absent, re-reading on a race and never guessing; a write reclaims below head-k only after its own commit, and a refused delete is reported, never fatal. Exclusion is unchanged -- losers re-read and retry -- so nothing waits on a hold. docs/plans/fabric-storage.md names the head-probe bound this also lifts and assigns its remedy to compaction -- a head that starts from a snapshot; a window is that head-starting-above-1 shape for a slot whose history needs no snapshot, and the fabric heads are not opted in",
   },
   ConformanceDomain {
     key: "conformance-compute",
diff --git a/dag/gunbc/design_document.dag b/dag/gunbc/design_document.dag
index 1002888c83f..6846b1b2b5d 100644
--- a/dag/gunbc/design_document.dag
+++ b/dag/gunbc/design_document.dag
@@ -10,7 +10,7 @@ import extdeps.languages.markdown { serialize_markdown_source }
 import gunbc.documentary_refs {
   documentary_ref_symbol_text,
   v1_maintenance_standing_ref,
-  required_gate_prefixes_ref,
+  required_gate_subjects_ref,
 }
 import gunbc.design_argument { conformance_domains, ConformanceDomain, conformance_home_list }
 import gunbc.roadmap.roadmap_review_criteria { review_home_text }
@@ -77,8 +77,8 @@ fn section_3_blocks() -> List<MarkdownBlock> {
     p(text: "THE RULE IS ABOUT LAYERS, AND COST IS ONLY ITS SYMPTOM. A claim reaches too far the moment its subject stops being ONE interface, and the reach is usually transitive rather than written: a fold that assembles a report from fifteen producers gives any claim over it the union of their subjects. The sharpest form is a claim that re-executes ANOTHER MODULE'S CLAIM FUNCTIONS — each of those already has its own subject and its own discriminating red, so re-running them asserts nothing new and pays for all of it again, which is §2's duplicated work wearing a test's clothes. Its enabling condition is a LAYER INVERSION worth refusing on its own: a production module that imports `test.claim.*` has made every consumer of that module a transitive consumer of those claims. RECEIPT (gunbc#11457): `gunbc.demo.semantic_system_readout` imported five witness modules and called thirteen of their claim functions; one claim over its fold measured 1,212,647 eval steps and 3,743ms against a 302ms enrolment margin, and TWO REVIEWERS APPROVED IT, one citing it as satisfying the pairing obligation. So the budget refusal is the tell that fires, not the rule that was broken — a cheap claim reaching the same way is the same defect undetected, and the remedy is to supply the values and keep ONE inhabitance claim for the real path, never to buy the reach with a debt row."),    h3(text: "§3 standing rule — replacement migrations cut over at the root"),
     p(text: "When two structures answer the same semantic question and one is intended to disappear, the change is a **replacement migration**, not a refinement. §2 prices an intermediate representation destined to be discarded as redundant work, and §3 forbids X and Y both answering for one fact. Editing X from its leaves upward preserves its root while every intermediate state becomes observable and load-bearing, so the migration creates more authority before it removes any. The deeper cost is that a surviving X is an **attractor**: while it stands, every nearby question is answered in its vocabulary, so decisions keep being premised on an assumption already scheduled for death — and A3 grounds agreement only on what stays stable across time, which a dead assumption by definition does not."),
     p(text: concat("So the default is **delete-first**: uproot the root as early as you can, then fix forward minimally with the new solution, solving each surfaced problem from first principles rather than restoring it to its old binding. In a fail-closed substrate **the deletion is the census — but only over the population a run compiles**. Every real dependent refuses loudly, so what breaks is exactly what was load-bearing. Outside the required gate (",
-      concat(documentary_ref_symbol_text(reference: required_gate_prefixes_ref),
-      ") the substrate still refuses and nothing asks it to: a product-layer dependent can stop resolving, stay broken, and let every required lane report SUCCESS — so **for a root outside the gate, enumerate the consumers by name before you delete**. What cannot break loudly is covered by a declared, bounded §4b rung-drop, never by silence. Two carve-outs: a gap-intolerant boundary keeps the staged form — Y built in shadow, then one transition that switches the root and deletes X together — and where no Y can hold the boundary at all, X stays but stays **frozen**: no new investment, no new rows on its growth surfaces."))),
+      concat(documentary_ref_symbol_text(reference: required_gate_subjects_ref),
+      ": since the 2026-10-09 ruling the one required lane compiles only the import closures of the entries those rows emit, so nearly every root is outside it) the substrate still refuses and nothing asks it to: a product-layer dependent can stop resolving, stay broken, and let every required lane report SUCCESS — so **for a root outside the gate, enumerate the consumers by name before you delete**. What cannot break loudly is covered by a declared, bounded §4b rung-drop, never by silence. Two carve-outs: a gap-intolerant boundary keeps the staged form — Y built in shadow, then one transition that switches the root and deletes X together — and where no Y can hold the boundary at all, X stays but stays **frozen**: no new investment, no new rows on its growth surfaces."))),
     p(text: "**\"Atomic\" describes the authority transition, not the amount of implementation work.** Y has one coherent root, ordinary production never accumulates consumers that understand both representations, and X's authority ends in one motion. Y may freely reuse stable primitives, and X may serve from history as an offline differential oracle — but Y never falls back to X, resolves through it, or derives its answer from it. And the minimum Y is not the smallest thing that executes the happy path: it must preserve every required refusal, or it has erased a correctness distinction rather than completed the replacement."),
     p(text: concat("The frozen-X carve-out is the wrong state for a production-critical X whose replacement was paused indefinitely, which is the v1 seed's situation. v1 is therefore reclassified — semantics frozen, maintenance active — under a PURPOSE admission test: a change is admitted when it serves the v2 self-host program, and v1 stays closed to growth for its own sake. The authority is ",
       concat(documentary_ref_symbol_text(reference: v1_maintenance_standing_ref),
@@ -275,12 +275,12 @@ fn building_checks_blocks() -> List<MarkdownBlock> {
     h2(text: "Building & checks"),
     p(text: "**This section assumes you already have a built `gunbc`, and nothing here tells you how to get one — so it is not the first page for a reader who has just cloned.** That reader wants [docs/onboarding.md](docs/onboarding.md): the ordered path from a bare clone to one landed reviewed change, with every command derived from the authority that owns it (`gunbc.contributor_onboarding_path`), the obstacles attached to the step each one breaks, and a reading order for THIS document saying what is needed before a first build, what is needed before a first commit, and what can wait. That page is a projection of a path that was walked, not a substitute for it: the exit it serves is measured by an outcome, so a step there that does not work is a defect worth reporting as one."),
     ul(items: [
-      li(text: "Three local checks, each named with the CI step that executes it — a check named here with no executing step is a decoration (§4b): `cargo clippy --all-targets -- -D warnings` (`gunbc.repo_self_build` `repo_self_clippy_command`, the only command that compiles the integration-test and example targets, so a red there is invisible to every other step) runs as the lint step of the `generated` job of `gunbc.compiler_gate_workflow` (`compiler_gate_lint_step`, operator ruling 2026-09-28: no lane the required context reads runs on a hosted runner), which runs on every pull request and on every merge_group (the queue's composed revision) and IS a required lane read by the `witnesses` aggregate — so a clippy red blocks a merge; `cargo fmt --all --check` runs in the generated pre-commit hook (`gunbc.githooks_pre_commit_emit`). `cargo test --release -p v1-compiler --lib` (`repo_self_test_command`) runs as the `rust_unit_tests` step of the fleet `rust-unit-tests` job (`gunbc.compiler_gate_workflow` `compiler_gate_unit_test_step`), a REQUIRED lane read by the `witnesses` aggregate that runs on merge_group and workflow_dispatch only, not pull_request (declared drop `gunbc.rung_drop` `rust_unit_tests_off_pull_requests`, operator 2026-10-06; the aggregate excuses its skip only on a pull_request event) — so a unit-test red blocks a merge at the queue. (From 2026-10-05 it reported without blocking under the declared drop `gunbc.rung_drop` `rust_unit_tests_over_their_cap`, because it overran its step cap on every head; it blocks again, and that drop is superseded (not retired by its trigger): the owner ruling carried by gunbc#13452 deleted the slow tests, and that loss is the declared drop `gunbc.rung_drop` `v1_integration_tests_deleted_from_the_unit_lane`.) It returned on 2026-09-30 as the blocking fleet lane the 2026-09-29 ruling (which deleted the non-blocking hosted measurement) named, bound by its runner slot's own MemoryMax so the regeneration-host tests read a real budget, and it retired the declared drop `gunbc.rung_drop` `rust_unit_tests_off_the_merge_path`. `cargo test --workspace` is local only: the test targets are compiled by the lint step and run by nobody."),
-      li(text: "one-time per clone: `git config core.hooksPath .githooks` — the only documented manual seed; generated pre-commit/pre-push hooks then idempotently converge `merge.generated-artifact.driver` and re-assert `core.hooksPath` via argv derived from `gunbc.repo_local_git_config` (clones that skip hooksPath degrade to vanilla text-merge for generated-artifact paths; drift gate still guards at CI). The driver REFUSES rather than answering `true`: git reaches a low-level merge driver only when both sides changed the path since the merge base — measured on a four-case matrix, one-sided and identical changes never reach it — and taking the ours side there dropped the other side's authority-derived bytes with no conflict, twice on #7836 against the stage0 seed. It now leaves the ours side in the worktree with no conflict markers, marks the path unmerged, and prints the regeneration recipe; the class is mechanically preventable, not structural, and its next-rung trigger is the commit-writer binding rows in `gunbc.commit_workflow`"),
+      li(text: "Local checks, each named with what executes it — a check named here with no executing step is a decoration (§4b), and since the 2026-10-09 ruling (the v1 withdrawal, stated under **CI** below) two of the three have none. `cargo fmt --all --check` runs in the generated pre-commit hook (`gunbc.githooks_pre_commit_emit`). `cargo clippy --all-targets -- -D warnings` (`gunbc.repo_self_build` `repo_self_clippy_command`, the only command that compiles the integration-test and example targets) and `cargo test --release -p v1-compiler --lib` (`repo_self_test_command`) are LOCAL ONLY: the `generated` and `rust-unit-tests` lanes that ran them were deleted with the other v1 lanes, so a lint red or a v1 unit-test red blocks nothing. That loss is part of the declared drop `gunbc.rung_drop` `v1_required_lanes_withdrawn`. `cargo test --workspace` is local only, as it was: the test targets are compiled by nothing on the merge path and run by nobody."),
+      li(text: "one-time per clone: `git config core.hooksPath .githooks` — the only documented manual seed; generated pre-commit/pre-push hooks then idempotently converge `merge.generated-artifact.driver` and re-assert `core.hooksPath` via argv derived from `gunbc.repo_local_git_config` (clones that skip hooksPath degrade to vanilla text-merge for generated-artifact paths, and since the 2026-10-09 ruling no CI step compares a generated artifact with its authority: `gunbc.rung_drop` `v1_required_lanes_withdrawn`). The driver REFUSES rather than answering `true`: git reaches a low-level merge driver only when both sides changed the path since the merge base — measured on a four-case matrix, one-sided and identical changes never reach it — and taking the ours side there dropped the other side's authority-derived bytes with no conflict, twice on #7836 against the stage0 seed. It now leaves the ours side in the worktree with no conflict markers, marks the path unmerged, and prints the regeneration recipe; the class is mechanically preventable, not structural, and its next-rung trigger is the commit-writer binding rows in `gunbc.commit_workflow`"),
       li(text: "**`gunbc test <label>` is the dedicated CLI for invoking a v2 measurement, and a new one is a row rather than a flag** (operator ruling, 2026-09-16). The seam is `gunbc.target_binding` `TargetProducer` bound to a `gunbc.instrument_targets` label, and the host note says the extension shape outright: *adding one is a row in `instrument_registry` and an arm here; it is not a new route*. What that buys is not tidiness: the label carries its own refusal vocabulary, so an unknown or pattern label REFUSES with exit 2 rather than reporting a pass, and the three terminations stay distinct — 0 held, 1 an observation that did not hold, 2 no observation — which is the conflation §5 forbids, closed by construction for every instrument at once. The subject is the instrument's own fact and never a CLI option, so an invocation cannot quietly measure a different corpus while reporting the same target's standing. **What this rules out is the alternative that keeps suggesting itself:** a flag on `claim_executor`, whose ~20 flags are hand-parsed in a 2783-line `main` over 44,451 lines of `cli_run.rs` with NO `.dag` authority at all — v2 work that lands there is unmodeled by construction, and `--self-host` was withdrawn in the same change that added `//gunbc/instruments:self-host` rather than left standing beside it, because two routes to one fact is the §3 fork. `gunbc`'s own surface is modeled (`gunbc.cli_dispatch_surface` → `gunbc_cli_dispatch_generated.rs`); `claim_executor`'s is not, and the gap is the point."),
       li(text: "**Two CLIs, and which one a session wants is decided by which compiler is running.** `gunbc` is the SEED's CLI — `std.compiler_entry` `RetainedHostCliKernel`, a clap surface dispatching into hand-authored host Rust (`v1_compiler.cli_run`) — so its verbs are unreachable from a self-emitted binary BY CONSTRUCTION, not by omission: an emitted crate does not contain that module. The v2-exclusive door is `v2.cli.compile_cli`, `.dag` in `src/v2/cli/`, declaring the fourth driver `std.compiler_entry` `NativeCliDriver`. It parses argv, decides the verb, decides every refusal, decides what to emit and decides the process exit (`std.process` `ProcessExit`); its rendered main performs only the four operations no `.dag` fold can — read argv, walk and read the source roots the PLAN named, write stdout, set the status — and hands each back as a VALUE. **That boundary is measured, not chosen for taste:** a resource method on an ordinary `fn` is a located compiler refusal (`Filesystem.Read` off a plain function refuses with *receiver type 'Primitive(Filesystem)' establishes no method surface*), because a resource METHOD is admitted only where the function declares that resource through its `uses` clause — an effect requirement, never a function kind; the authored clause is the SEED's spelling of that requirement, and for a transparent body operator D13 (`gunbc.plans.demand_engine_program`: dependency demand \"is DERIVED from resolved dependency and operation references, not authored in the header\") rules it derived by resolution. That derivation does not yet name a Network requirement (`gunbc.rung_drop` `network_requirement_unrepresented_after_uses_cut`), so until D13's resource-keyed DependencyDemand carrier exists the authored clause remains the only carrier of a Network requirement; v2 builds no second carrier for the row and refuses it at the clause (`gunbc.recurring_failure_mode` `uses_clause_has_no_carrier`): `workflow` was never a semantic kind, only the emitter predicate `v1.compiler.emit_rust` `is_workflow_item`, and gunbc#11528 DELETED it. The native door now acquires sources through `gunbc.source_root_read`, bound at the entry to the existing `extdeps.filesystem.filesystem_io` handler emitted by `v1.compiler.emit_rust` `emit_file_call`. `FilesystemExactRead` carries read refusal, and `Filesystem.List` supplies the existing listing plus its host-classified error kind: only NotADirectory admits a walked child as a file, while missing, unreadable and incomplete listings refuse. The effectful traversal uses the emitter's shared tail-call loop lowering. `v2_cli_main` owns parse, acquisition and compilation; its rendered main binds the handler, supplies argv and realizes output and status. The eval driver also delegates filesystem acquisition to that fold. This discharges the FILESYSTEM portion of `gunbc.source_root_eval_driver_seed_growth`, not its remaining orchestration and host-fact obligations. The legacy content-only free `filesystem_read` primitive still panics on failure and is not used by this door; it is not evidence of typed refusal. **Why a second entry module rather than a mode on the first:** one emitted crate has one entry point and the emitter admits exactly one `compiler_pipeline_entry` declaration per closure (`compiler_pipeline_entry_is_ambiguous` refuses two by name), and the CLI's closure reaches no part of `v2.compiler.compile`, so exactly-one holds by construction rather than by a flag choosing between them. The two generations are two instrument rows: `gunbc test //gunbc/instruments:self-host` is the seed emitting and building `v2.compiler.compile`, and `gunbc test //gunbc/instruments:v2-native-cli` is the seed emitting and building the CLI closure — two labels because they are two compilations, so a regression in either is reported under a name that says which. Neither is the second generation; that is the BUILT CLI emitting a closure, and it needs this door to exist first."),
       li(text: "explicit actuator (CI / tooling): `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/repo/repo_local_git_config.dag --function converge`"),
-      li(text: "**CI** is one emission, `gunbc.compiler_gate_workflow` → `.github/workflows/witnesses.yml`, invoking our own binary once per LANE: `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane witnesses` in the `floor` job on every pull request and merge_group, and the same with `--required-lane build` (the stage0 mirrors' generated-artifact phase: the committed mirrors equal one emission by the seed built from them -- one generation since operator ruling 2026-10-04 waived v1 determinism) on every pull request and merge_group (operator ruling 2026-09-28, superseding the 2026-09-23 queue-only placement: a pull request that failed it still entered the queue and failed every group stacked on it) in the `generated` job, which runs BESIDE the floor rather than after it and carries the lint, and on pull requests the registry drift discriminator and its repair (operator ruling 2026-09-27, `gunbc.compiler_gate_workflow` `compiler_gate_generated_job`), plus an aggregating job that carries the required context and reads every lane result — that last is what makes a lane block rather than merely be waited on, so read the emitting authority for the current membership rather than this sentence. **The job roster is closed to growth: adding a job needs operator sign-off, because a job is a standing claim on a paid runner on every pull request and on every queued landing** — the 2026-09-04 ruling cut three of seven on that basis (`rust-unit-tests`, `fabric-evidence`, `emit-copy-qualification-battery`), the 2026-09-27 ruling added `generated` so a run waits for its longest lane instead of their sum, the 2026-09-28 ruling put every lane the required context reads, and the aggregate, on the fleet (deleting the hosted `compiler` job, whose build the fleet lanes already run, and folding the lint into `generated`), and the reasoning an author owes before proposing a lane is stated at `witness_floor_lane_jobs`. The push-on-main trigger was CUT on 2026-09-15 under the same reasoning applied to an event rather than a job: with the merge queue enabled, the required run on the queue's composed revision proves the sha that lands, so the push run re-ran a proof that already existed — one required run per landing, not two. Which phases a lane owns is decided in the binary, never in the YAML — the partition is an exhaustive match, so a phase belonging to no job fails to compile. **Read the roster from the run's own announcement, not from here:** every required run prints one `phase <name>` line per phase it owns and one `ROUTED to lane <other>` line per phase it does not. Several capabilities that used to gate are currently declared rung drops — see §4b."),
+      li(text: "**CI** is one emission, `gunbc.compiler_gate_workflow` → `.github/workflows/witnesses.yml`, and since the operator ruling of 2026-10-09 (the v1 withdrawal: v1 is no longer a validation authority, and the one use left to the seed is emitting v2) the required context is ONE job, `witnesses` — the id the ruleset requires, so the job's own check is the context and no aggregate reads it. It runs on the fleet on every pull request and merge_group: it builds the seed, then runs one `gunbc test <label>` step per row of `gunbc.emitted_subject_build_gate` `emitted_subject_build_rows` — today `//gunbc/instruments:self-host` and `//gunbc/instruments:v2-native-cli` — in which the seed emits a v2 closure, cargo builds the emitted crate FRESH (every subject step passes `native_product_reuse_env_name`=`fresh`, under which the runner consults no native product store and refuses one if bound; cargo's own dependency reuse remains), and the built binary is started against its controls. A fork pull request carries no `witnesses` check at all (the job is fleet-guarded), so it is unobserved rather than excused. **The memory envelope is part of the verdict** (operator ruling 2026-10-09): the fleet slot is a fixed hard maximum with no swap (`gunbc.runner_slot_desired`: MemoryMax 22 GiB, MemorySwapMax 0); each subject step REQUIRES that envelope (`gunbc.emitted_subject_build_gate` `native_step_memory_envelope_env_name`): `gunbc test` refuses a run no cgroup `memory.max` binds, reads the bounding cgroup before the producer, and at exit prints a MEMORY RECEIPT (the OOM kills and high/max events the step added, swap charged, the peak) and refuses the run on any OOM kill or any swap, whatever the producer answered; the lower per-step trip (`native_step_memory_trip`, the slot's MemoryHigh less a declared headroom, bound as the step's own cgroup through `native_step_memory_bind_env_name`) is modeled and waits on a fleet fact, `gunbc.runner_slot_desired` `gunbc_runner_slot_job_cgroup_ownership` — a fleet job runs deprivileged under a root unit and cannot create a bounded leaf, so the bind input is withheld; the climb is rostered as `gunbc.guarantee_stall` `native_step_trip_awaits_fleet_job_cgroup_stall`, and flipping the fact when the fleet earns it returns the bind to every subject step with no other edit; the decision and verdict are `gunbc.memory_envelope`, a fold over supplied inputs that the seed mirrors; there is no larger runner and no retry. The heal publisher (`heal-publish.yml`) was deleted with the lanes: nothing seals a repair candidate for it to publish. **What a green required context does NOT say, because the lanes that said it are deleted:** `floor` (the v1 interpreter folding the rostered witnesses), `generated` (the stage0 mirrors, the registry drift discriminator with its repair, and the lint), `rust-unit-tests` and `seed` are gone. Nothing on the required path evaluates a witness, refuses on a module outside the two emitted closures, or compares a generated artifact with its authority — this document and `witnesses.yml` included. That loss is ONE declared drop, `gunbc.rung_drop` `v1_required_lanes_withdrawn`: its module population is re-derived by `gunbc test //gunbc/instruments:required-lane-resolution-census`, and its trigger is the native compiler judging that population, never the return of those lanes. The contract epoch (`gunbc.required_ci_contract_epoch`) moved with the cut, because the name `witnesses` now carries a different contract. **A verdict joins this gate as a row judged by a binary built from the seed's emission**, never as a lane that hands the corpus to the v1 interpreter; `emitted_subject_build_rows` stays the two compiler products, and the native obligation is a SEPARATE population — executed by one built `SourceRootEvalDriver`, a monotone green set plus exactly one observed frontier — whose members are eligible only once their adjudication is native (operator ruling 2026-10-09). **The job roster is closed to growth: adding a job needs operator sign-off, because a job is a standing claim on a paid runner on every pull request and on every queued landing**; the reasoning an author owes before proposing a lane is stated at `witness_floor_lane_jobs`. The push-on-main trigger was CUT on 2026-09-15 under the same reasoning applied to an event rather than a job: with the merge queue enabled, the required run on the queue's composed revision proves the sha that lands — one required run per landing, not two."),
     ]),
   ]
 }
diff --git a/dag/gunbc/dispatch_selection.dag b/dag/gunbc/dispatch_selection.dag
index 42dceb66b2d..59bb6f972bc 100644
--- a/dag/gunbc/dispatch_selection.dag
+++ b/dag/gunbc/dispatch_selection.dag
@@ -45,6 +45,7 @@ import gunbc.codex_provider_runtime_receipt {
   codex_process_fingerprint_unobserved_reason,
 }
 import extdeps.llm.cursor_cli { CursorModelId, cursor_model_auto }
+import gunbc.cursor_harness_credential { cursor_api_key_harness_secret_ref }
 import extdeps.cloud.gcp.secret_ref { SecretRef }
 import gunbc.claude_code_credential { claude_code_oauth_harness_secret_ref }
 import gunbc.roadmap_sizing {
@@ -784,6 +785,32 @@ fn inventory_with_observed_standing(inventory: ProviderInventory, kind: Provider
   }
 }
 
+// The offer the codex draw is judged on names the custody CODEX_HOME the standing was observed against
+// and the spawn binds, never the instance's ambient account state root. This is the root, not the
+// standing: the standing join is inventory_with_observed_standing.
+fn inventory_with_codex_state_root(inventory: ProviderInventory, account_state_root: FilePath) -> ProviderInventory {
+  ProviderInventory {
+    offers: map(inventory.offers, offer =>
+      match offer {
+        OfferCodex { offer: o } =>
+          OfferCodex {
+            offer: CodexOffer {
+              instance: o.instance,
+              account_state_root: account_state_root,
+              account_binding: o.account_binding,
+              standing: o.standing,
+              default_effort: o.default_effort,
+              deep: o.deep,
+              process_fingerprint: o.process_fingerprint,
+            },
+          }
+        OfferClaude { offer: _ } => offer
+        OfferCursor { offer: _ } => offer
+      }
+    ),
+  }
+}
+
 fn claude_offer_for_instance_with_standing(
   instance: HostDashboardInstance,
   standing: ProviderStanding,
@@ -945,7 +972,7 @@ fn declared_provider_inventory_for_instance(instance: HostDashboardInstance) ->
                 reason: "inventory row is declared, not observed at selection time" as NonEmptyStr,
               },
             },
-            credential: CursorLocalLoginRef,
+            credential: CursorApiKeySecretRef { secret_ref: cursor_api_key_harness_secret_ref },
             standing: provider_standing_inventory_unobserved(),
             default_model: cursor_model_auto,
             process_fingerprint: dispatch_cursor_process_fingerprint,
@@ -1470,7 +1497,7 @@ fn provider_selection_request_for_kind(kind: ProviderKind) -> ProviderSelectionR
     CursorCliProvider =>
       SelectCursor {
         profile: ProfileAutomatic,
-        credential: CursorLocalLoginRef,
+        credential: CursorApiKeySecretRef { secret_ref: cursor_api_key_harness_secret_ref },
         model: cursor_model_auto,
         agent_mode: "default-edit" as NonEmptyStr,
       }
diff --git a/dag/gunbc/doc_graph_roots.dag b/dag/gunbc/doc_graph_roots.dag
index 3fea9fd2d7b..8e68fde0be8 100644
--- a/dag/gunbc/doc_graph_roots.dag
+++ b/dag/gunbc/doc_graph_roots.dag
@@ -239,17 +239,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the required floor's in-flight shared-fill OWNERSHIP is changed so this characterization no longer describes the shipped mechanism; the row deletes with the superseded findings document. THE OTHER CONJUNCT OF THIS TRIGGER HAS ALREADY FIRED AND THE ROW IS DELIBERATELY RETAINED, which is stated here because a half-fired trigger read as unfired is how a dead assumption keeps answering questions: the deadline-accounting half died on 2026-09-12 when the claim ceiling moved onto eval_steps and CPU became observed-only for every claim, and changed_witness_cpu_deadline -- the subject this row was registered at -- was deleted with it. The registration moves to claim_cost_basis_standing, the successor decision about which quantity may refuse a claim, and the document carries a superseded-half banner at its head. The shared-fill half is untouched and is the live subject: eval steps are netted of fill exactly as CPU is, so the ownership argument transfers to the new ceiling without restatement, and it is still what required-floor-in-flight-shared-fill-design.md cites.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "fabric-ci-replacement",
-    primary_work: DeclarationRef { module_path: "gunbc.witness_floor_workflow", decl_name: "witness_floor_job", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "extdeps.github.checks", decl_name: "CheckRun", field: WholeDeclaration },
-      DeclarationRef { module_path: "product.fabric.execution", decl_name: "ExecutionGrant", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.ci_runner_target", decl_name: "CiRunnerTarget", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the cutover lands: the fabric issues the grant that runs the required floor, the check verdict is reported through the modeled Checks surface, and .github/workflows/witnesses.yml is deleted along with the emitter that produced it -- at which point this document describes a shipped system rather than a planned one and the row deletes with it. Registered at subject grain: the four systems bound here are the ones whose movement would make this document's purpose false. witness_floor_job is the thing being replaced and is bound deliberately, so that if it is renamed or restructured before the cutover this document reds rather than silently describing a job that no longer exists.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "fabric-recut-program",
@@ -360,53 +349,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "each parked item is either promoted to its own design document or retired with a reason, leaving this file with no subjects; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "affected-set-differential-falsifier",
-    primary_work: DeclarationRef { module_path: "v2.lens.module_graph", decl_name: "entry_affected_by_touched_paths", field: WholeDeclaration },
-    additional_works: [
-
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject entry_affected_by_touched_paths describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "algebra-grounding-unification-design",
-    primary_work: DeclarationRef { module_path: "std.algebra", decl_name: "FreeMonoid", field: WholeDeclaration },
-    additional_works: [
-
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject FreeMonoid describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "body-lowering-design",
-    primary_work: DeclarationRef { module_path: "std.termination", decl_name: "DescentEvidence", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.cardinality", decl_name: "node_multiplicity", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.std.cardinality", decl_name: "loop_bound_witness_for_node", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject DescentEvidence describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "build-cache-placement-receipt",
-    primary_work: DeclarationRef { module_path: "extdeps.cache.sccache", decl_name: "sccache_stats_query_does_not_spawn_note", field: WholeDeclaration },
-    additional_works: [
-
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject sccache_stats_query_does_not_spawn_note describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "c-linkage-unit-realization-design",
-    primary_work: DeclarationRef { module_path: "v2.std.compilers.compilation_unit", decl_name: "CompilationUnit", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.compilers.compilation_unit", decl_name: "partition_fold_outcome", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.std.compilers.compilation_unit", decl_name: "CompilationUnitId", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject CompilationUnit describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "cli-run-reconcile-defork",
@@ -416,55 +358,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject import_closure_live describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "compile-wall-endgame",
-    primary_work: DeclarationRef { module_path: "std.computation_identity", decl_name: "ComputationIdentity", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.termination", decl_name: "DescentEvidence", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject ComputationIdentity describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "compiler-algorithm-survey-2026-07-04",
-    primary_work: DeclarationRef { module_path: "v2.std.node", decl_name: "fold_node", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.algebra", decl_name: "list_snoc_item", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.std.compilers.lexing", decl_name: "token_stream_first", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject fold_node describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "containment-binding-cross-module-type-references-design",
-    primary_work: DeclarationRef { module_path: "std.occurrence_binding", decl_name: "OccurrenceBindingResult", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.symbol_index", decl_name: "symbol_index_lookup", field: WholeDeclaration },
-      DeclarationRef { module_path: "std.occurrence_binding", decl_name: "occurrence_binding_from_candidates", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject OccurrenceBindingResult describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "cost-risk-benefit-floor-model",
-    primary_work: DeclarationRef { module_path: "std.realization_schedule", decl_name: "WitnessKind", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.verification", decl_name: "TestClassification", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.std.live_tree", decl_name: "LiveTreeDisposition", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject WitnessKind describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "cross-entry-typed-module-memo-sketch",
-    primary_work: DeclarationRef { module_path: "std.computation_identity", decl_name: "ComputationIdentity", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.materialization_ladder", decl_name: "CacheProvider", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.host_effect", decl_name: "HostEffect", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject ComputationIdentity describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "dag-scm-design",
@@ -474,44 +367,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject GroupMembership describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "decl-emission-defork-design",
-    primary_work: DeclarationRef { module_path: "v2.std.compilers.target_model", decl_name: "TargetModel", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.compilers.semantic_decl_emission", decl_name: "TargetSemanticDeclEmission", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject TargetModel describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "declared-source-ref-selection-design",
-    primary_work: DeclarationRef { module_path: "v2.compiler.source_authority", decl_name: "SourceRef", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.compiler.source_authority", decl_name: "ModuleStorageIndex", field: WholeDeclaration },
-      DeclarationRef { module_path: "std.content_hash", decl_name: "ContentHash", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject SourceRef describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "dependency-fidelity-design",
-    primary_work: DeclarationRef { module_path: "v2.std.fn_index", decl_name: "FnArrowDecl", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.lens.dependency_fidelity", decl_name: "FidelityVerdict", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject FnArrowDecl describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "design-register-library",
-    primary_work: DeclarationRef { module_path: "gunbc.design.material", decl_name: "Material", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "gunbc.design.theme", decl_name: "Theme", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.design.material", decl_name: "AreaClass", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject Material describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "dispatch-maintain-cc",
@@ -522,44 +377,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject dispatch_brief_template describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "duplicate-work-graph-lens-design",
-    primary_work: DeclarationRef { module_path: "v2.std.materialize", decl_name: "materialize", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.realization", decl_name: "Materialization", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.std.staging", decl_name: "cached_stage", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject materialize describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "emit-host-batch-isolation",
-    primary_work: DeclarationRef { module_path: "v2.workflow.executor", decl_name: "parallel_executor_plan_from_dependencies", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.realization_schedule", decl_name: "Runnable", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject parallel_executor_plan_from_dependencies describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "emitted-crate-partition-design",
-    primary_work: DeclarationRef { module_path: "v2.std.compilers.compilation_unit", decl_name: "CompilationUnit", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.compilers.compilation_unit", decl_name: "partition_fold_outcome", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.workflow.rust_crate_partition", decl_name: "PartitionPolicy", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject CompilationUnit describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "enforcement-intent-design",
-    primary_work: DeclarationRef { module_path: "v2.lens.enforcement.contract", decl_name: "LensContract", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.lens.enforcement.standing_intent", decl_name: "StandingIntent", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject LensContract describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "engram-materialization-placement",
@@ -570,43 +387,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "gunbc.fabric.engram_materialization lands and the placement of this component is decided by a consumed select_realization fold whose result the serving subject reads, so its subject deepseek_v4_1_flash_engram is placed by shipped behavior rather than by a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "entry-graph-union-slice2-typecheck-attribution",
-    primary_work: DeclarationRef { module_path: "std.interface_summary", decl_name: "module_key", field: WholeDeclaration },
-    additional_works: [
-
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject module_key describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "eval-bind-node-eval-propose",
-    primary_work: DeclarationRef { module_path: "v2.compiler.eval", decl_name: "eval_bind_node_eval", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.runtime", decl_name: "RuntimeBehaviorInterpreter", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject eval_bind_node_eval describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "execution-spine-design",
-    primary_work: DeclarationRef { module_path: "v2.std.materialize", decl_name: "materialize", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.dependency", decl_name: "DependencyView", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.std.spine", decl_name: "spine_receipt", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject materialize describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "extdeps-std-grounding-inventory",
-    primary_work: DeclarationRef { module_path: "std.measure", decl_name: "Measure", field: WholeDeclaration },
-    additional_works: [
-
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject Measure describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "emit-type-surface-traversal-cost",
@@ -634,23 +414,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the integration/floor-cut cutover merges to main and the old generated-ci / ci_floor_plan authorities named in this plan are deleted per its terminal receipt; the row deletes with the document once the cut is no longer the active migration vehicle. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "floor-memory-pool-parse-regression-diagnosis",
-    primary_work: DeclarationRef { module_path: "v2.lens.live_read_classification", decl_name: "live_read_classification", field: WholeDeclaration },
-    additional_works: [
-
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject live_read_classification describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "floor-shared-compute-memoization",
-    primary_work: DeclarationRef { module_path: "gunbc.ci_layer_roots", decl_name: "witness_layer_roots", field: WholeDeclaration },
-    additional_works: [
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject witness_layer_roots describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "floor-time-namespace-walk-regression-diagnosis",
@@ -658,52 +421,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     additional_works: [],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the assembly cost class this document attributes stops being where the floor wall is, measured on a main floor run rather than asserted; the row deletes with the document. REBOUND 2026-10-03: this row named v1.compiler.infer rewire_type_env_import_str_binding_identity, the 58 percent row this document located. That pass is DELETED (calm-pike-525: at a fresh compile 100 percent of its rewrites were the same Rc already present, whole tree and floor subject), so the row now names reconcile_with_census_extra, the reconcile assembly the diagnosis is about; the floor-run measurement the condition asks for decides retirement. REBOUND 2026-08-21: this row named v2.workflow.ci_floor_plan gate_runnable_profile and floor_plan_at_most_one_heavy_gate_resolve_per_batch — the batch-scheduling knobs the diagnosis turned, deleted with their module by the floor cut. The diagnosis is not about scheduling: its own section 7 locates the measured root in reconcile assembly, one row of which is 58 percent of the resolve wall, and that row is the subject bound here. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "for-sugar-over-fold",
-    primary_work: DeclarationRef { module_path: "v2.compiler.emit_orchestration", decl_name: "orch_emit_step", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.compilers.sugar", decl_name: "SugarKey", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject orch_emit_step describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "formal-concepts-extdeps-grounding",
-    primary_work: DeclarationRef { module_path: "std.termination", decl_name: "DescentEvidence", field: WholeDeclaration },
-    additional_works: [
-
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject DescentEvidence describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "func-env-sigs-single-authority",
-    primary_work: DeclarationRef { module_path: "v2.compiler.resolve", decl_name: "ResolvedTree", field: WholeDeclaration },
-    additional_works: [
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject ResolvedTree describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "groupcompletion-pair-construction-design",
-    primary_work: DeclarationRef { module_path: "std.algebra", decl_name: "GroupCompletion", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.approximate_field", decl_name: "ApproximateField", field: WholeDeclaration },
-      DeclarationRef { module_path: "std.rational", decl_name: "Rational", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject GroupCompletion describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "gunb-ai-site-subsumption-design",
-    primary_work: DeclarationRef { module_path: "extdeps.languages.typescript.program", decl_name: "TsProgram", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "gunbc.design.material", decl_name: "Material", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.design.material", decl_name: "BuildRule", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject TsProgram describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "gunbc-served-dashboard-design",
@@ -714,16 +431,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject belt_dispatch_node describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "hollow-alias-construction-wall",
-    primary_work: DeclarationRef { module_path: "std.algebra", decl_name: "FieldOfFractions", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.algebra", decl_name: "GroupCompletion", field: WholeDeclaration },
-      DeclarationRef { module_path: "std.rational", decl_name: "Rational", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject FieldOfFractions describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "import-strip-witness-discovery-cascade-diagnosis",
@@ -733,34 +440,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject DeclarationRef describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "ingest-manifest-source-ref-carrier-design",
-    primary_work: DeclarationRef { module_path: "v2.compiler.source_authority", decl_name: "SourceRef", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.compiler.source_authority", decl_name: "SourceRootIngest", field: WholeDeclaration },
-      DeclarationRef { module_path: "std.content_hash", decl_name: "ContentHash", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject SourceRef describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "interface-summary-declared-use-arity",
-    primary_work: DeclarationRef { module_path: "std.interface_summary", decl_name: "InterfaceSummary", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.types", decl_name: "NonEmptyStr", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject InterfaceSummary describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "interpreter-memory-chronicle",
-    primary_work: DeclarationRef { module_path: "gunbc.fleet_intent", decl_name: "PerformanceReceipt", field: WholeDeclaration },
-    additional_works: [
-
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject PerformanceReceipt describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "keying-relation-design",
@@ -774,15 +453,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject KeyRelation describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "language-support-completion-design",
-    primary_work: DeclarationRef { module_path: "gunbc.ci_layer_roots", decl_name: "falsifier_substrate_long_lane_rows", field: WholeDeclaration },
-    additional_works: [
-
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject falsifier_substrate_long_lane_rows describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "layering-imports-reference-repoint-design",
@@ -793,34 +463,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject LayerImportFact describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "lens-consolidation-design",
-    primary_work: DeclarationRef { module_path: "std.materialization_ladder", decl_name: "LadderVerdict", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.lens.enforcement.standing_intent", decl_name: "StandingIntent", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.lens.vacuity", decl_name: "VacuityEvidence", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject LadderVerdict describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "lens-input-authority-design",
-    primary_work: DeclarationRef { module_path: "extdeps.cache.materialization", decl_name: "provider_from_catalog", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.compiler.inferred_tree", decl_name: "InferredTree", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject provider_from_catalog describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "mechanism-inventory-red-controls",
-    primary_work: DeclarationRef { module_path: "gunbc.ci_gate", decl_name: "Gate", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.process", decl_name: "ProcessExit", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject Gate describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "membership-diff-reconcile-spine-design",
@@ -878,53 +520,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject occurrence_binding_from_candidates describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "native-selected-witness-bundle-design",
-    primary_work: DeclarationRef { module_path: "std.selected_witness_bundle", decl_name: "NativeWitnessBundleIdentity", field: WholeDeclaration },
-    additional_works: [
-
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject NativeWitnessBundleIdentity describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "node-minimal-representation-sketch",
-    primary_work: DeclarationRef { module_path: "v2.std.node_minimal", decl_name: "MinimalResolvedNode", field: WholeDeclaration },
-    additional_works: [
-
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject MinimalResolvedNode describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "node-subtree-visibility-grants",
-    primary_work: DeclarationRef { module_path: "std.effect_grant", decl_name: "position_under", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.effect_grant", decl_name: "NamespacePosition", field: WholeDeclaration },
-      DeclarationRef { module_path: "std.effect_grant", decl_name: "admit_effect", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject position_under describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "non-fold-irreducible-residue-catalogue",
-    primary_work: DeclarationRef { module_path: "v2.lens.complexity_linearity_audit", decl_name: "triage_wildcard", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.induction", decl_name: "SubValueRelation", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.lens.cost", decl_name: "SymbolicCost", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject triage_wildcard describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "orchestration-as-intent-design",
-    primary_work: DeclarationRef { module_path: "v2.std.orchestration", decl_name: "Run", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.orchestration", decl_name: "Pipeline", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject Run describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "post-engine-pr-roadmap",
@@ -934,42 +529,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject is_container_type describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "provisioning-window-executor-capability-design",
-    primary_work: DeclarationRef { module_path: "v2.std.execution_surface", decl_name: "ShellEmissionJustification", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.execution_surface", decl_name: "ExecutorCapability", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.std.execution_surface", decl_name: "ProvisioningWindow", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject ShellEmissionJustification describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "real-debt-syntactic-sample-audit",
-    primary_work: DeclarationRef { module_path: "v2.lens.complexity_linearity_audit", decl_name: "triage_wildcard", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.verification", decl_name: "ManualAnchorKey", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.std.compilers.target_model", decl_name: "ConcreteSyntaxToken", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject triage_wildcard describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "resolve-regression-journey",
-    primary_work: DeclarationRef { module_path: "gunbc.ci_layer_roots", decl_name: "bin_witness_wet_per_row_wall_budget_seconds", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the resolve-regression class this document diagnoses stops recurring and the wet per-row wall budget it now binds to describes settled behavior rather than a live pressure; the row deletes with the document. REBOUND 2026-08-21: the original subject was gunbc.ci_workflow gunbc_ci_floor_step_timeout_discovery_flip_note, which the floor cut deleted along with its module — the citation outlived its subject and the cited-symbol lens refused it. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "resolver-graph-major-design",
-    primary_work: DeclarationRef { module_path: "v2.std.dependency", decl_name: "DependencyView", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.realization_schedule", decl_name: "RealizationPlan", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject DependencyView describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "resource-aware-scheduler",
@@ -1020,14 +579,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject SeedHonestyDischarge describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "seed-shrink-census",
-    primary_work: DeclarationRef { module_path: "v2.std.node", decl_name: "content_hash", field: WholeDeclaration },
-    additional_works: [
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject content_hash describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "shell-intent-emit-realization-design",
@@ -1048,16 +599,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject host_effect_apply describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "space-complexity-design",
-    primary_work: DeclarationRef { module_path: "v2.lens.cost.expr", decl_name: "CostExpr", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.termination", decl_name: "DescentEvidence", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.lens.cost.summary", decl_name: "ComplexitySummary", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject CostExpr describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "space-lens-minimal-project",
@@ -1068,33 +609,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject ResourceEnvelope describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "srv3-webui-kvm-virtual-media",
-    primary_work: DeclarationRef { module_path: "gunbc.boot_artifact_delivery", decl_name: "solve_boot_artifact_delivery", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "extdeps.external_authority", decl_name: "ExternalAuthority", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject solve_boot_artifact_delivery describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "srv4-bmc-onboarding-gap",
-    primary_work: DeclarationRef { module_path: "gunbc.host_standup", decl_name: "host_standup_spine", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "product.host_identity", decl_name: "HostIdentity", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject host_standup_spine describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "srvn-buildcache-provisioning-design",
-    primary_work: DeclarationRef { module_path: "gunbc.host_converge", decl_name: "ConvergeTarget", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "extdeps.cache.sccache", decl_name: "sccache_local_facts", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject ConvergeTarget describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "type-env-single-authority-design",
@@ -1114,72 +628,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject whole_tree_strict_resolve_exclusion_substrings describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "v2-memory-control-audit",
-    primary_work: DeclarationRef { module_path: "std.materialization_ladder", decl_name: "CacheProvider", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.std.dependency", decl_name: "DependencyView", field: WholeDeclaration },
-      DeclarationRef { module_path: "std.realization_schedule", decl_name: "CostAccount", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject CacheProvider describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "vacuity-lens-design",
-    primary_work: DeclarationRef { module_path: "v2.lens.vacuity", decl_name: "VacuityEvidence", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.lens.coverage", decl_name: "coverage_defect_vacuous_arm", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.std.verification", decl_name: "TestClaim", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject VacuityEvidence describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "witness-subject-execution-audit",
-    primary_work: DeclarationRef { module_path: "v2.std.diagnostic", decl_name: "Outcome", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.lens.module_graph", decl_name: "import_closure_live", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject Outcome describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "general-body-producer-design",
-    primary_work: body_lowering_symbol_index_ref,
-    additional_works: [
-      body_lowering_lexical_lookup_ref,
-      body_lowering_production_consumer_ref,
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the general body producer lands and the document describes a shipped fold rather than a planned one. THIS BIND EXISTS BECAUSE OF A MEASURED FAILURE IN THIS EXACT DOCUMENT: it named v2.std.symbol_index SymbolIndex as an open prerequisite gating Stage A, the prerequisite was discharged, and the sentence stayed -- four copies of that one claim were live across DESIGN.md and two plan documents. Nothing was wrong with the declaration, so no declaration-level check could fire; the sentence was not a reference to anything, so no reference-level check could either. Binding the three systems it discusses puts them inside the cited-symbol population, so a rename or deletion reds without anyone editing the prose. WHAT THIS DOES NOT ESTABLISH, stated so the bind is not over-read: a resolved reference proves the system EXISTS and is uniquely identified, not that the named consumer invokes the named implementation on a production path -- that is a relationship claim, it needs an executing witness, and this row makes none.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "ci0-witness-execution-census",
-    primary_work: DeclarationRef { module_path: "gunbc.witness_execution_class", decl_name: "witness_execution_class_note", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "gunbc.witness_execution_class", decl_name: "native_blocked_cause_note", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the general witness→TargetModel producer lands (body-lowering keystone) and the enrolled-roster census is re-derived from executed emission attempts rather than the fixture-bound dispatch surface; the census numbers are superseded by that re-derivation and this receipt deletes with the NativeBlocked\{GeneralWitnessTargetModelUnavailable\} population it counts.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "ci2-native-cutover-reobservation",
-    primary_work: DeclarationRef { module_path: "gunbc.ci_materialization", decl_name: "ci_native_cache_root_exempt_note", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "gunbc.native_witness_transition_receipt", decl_name: "native_at_small_scale_transition_receipt", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the CI2 correctness flip lands — the native-selected population is native-required with the counted interpreter fallback deleted — and a main floor run's [native-selected-bundle] receipt shows verdict accepted with fallback = interpreted = unavailable = 0. The measured-standing content is superseded at that point by the run receipts and the transition-receipt authority; this doc records the pre-flip standing and its two located defects, and deletes with the fallback machinery it diagnosed.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "witness-bridge-reobservation",
-    primary_work: DeclarationRef { module_path: "v2.compiler.body_producer_forward", decl_name: "body_producer_forward_note", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lowering_fold_note", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the first witness-bridge stage lands (lowered body -> derived TargetModel -> bundle member -> native execution with planted-red control) and the bridge carrier's own notes record the standing this receipt captured; then this doc folds into the bridge design/receipt and deletes.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "review-surface-subject-map",
@@ -1191,32 +639,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "every row in the map has been deleted, consumed by a named live edge, or transferred to a typed roadmap obligation with an owner and acceptance. The four bound works are the map's load-bearing subjects and each names its own end state: the completeness roster note's exemption for v2.lens.grounding_ledger cites consumption by v2.lens.grounding that does not exist, and dissolves when the ledger is deleted so the row disappears rather than being reworded; LedgerEntry is that inert module's carrier; first_coincident_target folds to the FIRST non-self match while GroundingWorklistEntry stores a single coincides_with string, which is the silent-pick defect blocking any exclusive-candidate review and dissolves when the candidate population becomes complete, zero/one/many explicit, and identified by DeclarationRef rather than presentation strings; MergeReadinessTally has no producer outside fixtures and a dormant consumer whose kernel has no in-tree driver, and its unread approval_count field dissolves when the two-approval rule becomes a typed obligation with a zero-approval RED. The map is a worksheet, not an authority: it registers here so it cannot sit unreachable, and it deletes outright rather than migrating to DESIGN.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "witness-evidence-lifecycle-design",
-    primary_work: DeclarationRef { module_path: "v2.workflow.floor_discovery_producer", decl_name: "floor_discovery_process_dag_file", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "gunbc.ci_layer_roots", decl_name: "long_lane_exclusion_note", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.explicit_witness_admission", decl_name: "known_red_class_note", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "steps 3-5 land or are honestly retired (steps 1-2 are done: the modeling decision was signed by the operator 2026-08-04 and the typed direct-rust-door observation executes green). Remaining: census-before-routing in floor_discovery_process_dag_file, the attempt/evidence algebra retiring QuarantineProbeExpectRed and batch-wide expect_red inversion, and route derived from execution requirement — with test/claim/long DELETED as the terminal state per the operator step-5 ruling (it may persist as migration scaffolding meanwhile, but no new semantic dependence may be added to it, and operator visibility comes from a generated long-route projection rather than the directory name). Then the surviving policy rows migrate to DESIGN or a registered gunbc.plan.Plan row and this bind deletes with the doc.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "production-stage-origin-carrier-design",
-    primary_work: DeclarationRef { module_path: "v2.compiler.self_host.candidate_generation", decl_name: "mint_provenanced_rust_artifact", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.compiler.self_host.fixture_synthetic_emission", decl_name: "fixture_synthetic_emission_note", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "B1-B4 land or are honestly retired: covered-form construction admission, call-occurrence population closure consuming the #7786 successor, production API migration removing raw stage outputs from qualification boundaries, and bypass closure for casts / module identity / fail-open lookup. The ProductionOriginClosureCertificate becomes constructible - constructor and consumer populations closed, fixture reachability zero, unknown-origin zero - at which point the carrier law lives in the substrate and this note deletes. If the census successor proves the class cannot close under the current sole_constructor mechanism, this note is superseded by the recut rather than deleted silently.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "candidate-scoped-gates-atomic-landing",
-    primary_work: DeclarationRef { module_path: "gunbc.extdeps_scope_frontier", decl_name: "legacy_manifest_freeze_sha", field: WholeDeclaration },
-    additional_works: [DeclarationRef { module_path: "gunbc.ci_failure_class", decl_name: "merge_freshness_gating_status", field: WholeDeclaration }, DeclarationRef { module_path: "tools.floor_effect_gate_witness", decl_name: "emit_host_gate_passes", field: WholeDeclaration }, DeclarationRef { module_path: "gunbc.merge_admission", decl_name: "merge_admission_required_check_binding_dissolution_trigger", field: WholeDeclaration }],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the four program walls are live: the merge-queue landing boundary enforced (MergeQueueOnly + ALLGREEN, dashboard enqueue-only), the candidate/freeze/manifest observations split with the false law text corrected and the DefaultBranchAudit backstop scheduled, the RunnableProcessExitClaim migration complete with the Boolean gate adapters deleted, and the repository ruleset modeled as desired state with read-back. Then the surviving policy rows migrate to DESIGN or a registered gunbc.plan.Plan row and this bind deletes with the doc.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "generated-file-conflict-policy",
@@ -1224,20 +646,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     additional_works: [DeclarationRef { module_path: "tools.generated_artifact_gate", decl_name: "run_generated_artifact_drift_gate", field: WholeDeclaration }, DeclarationRef { module_path: "gunbc.commit_workflow", decl_name: "commit_gate_roster", field: WholeDeclaration }, DeclarationRef { module_path: "gunbc.stage0_rust_source_lifecycle_scaffold", decl_name: "derived_generated_stage0_repo_paths", field: WholeDeclaration }, DeclarationRef { module_path: "std.keyed_roster", decl_name: "keyed_roster_build", field: WholeDeclaration }],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "all four charter lanes are landed AND bound: commit-writer admission consumed at every writer transport (the heal arm and the dashboard autocommit daemon), the .gitattributes + repo-local git-config projections live with read-back, stage0 membership derived with its host-supply scaffold dissolved or re-triggered, and the keyed-roster construction wall enrolled per-PR. Then the surviving policy rows migrate to DESIGN or a registered gunbc.plan.Plan row and this bind deletes with the doc.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "seamless-deploys-design",
-    primary_work: DeclarationRef { module_path: "gunbc.live_deploy.service_ready", decl_name: "live_deploy_service_ready_poll_bound_reason", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "all four items the note models are landed or retired: the observation-outcome de-conflation, the systemd F1 readiness assertion, the deploy reconcile (comparable artifact value, service de-fused from the unit file, observed provider), and the handover. Registers as a gunbc.plan.Plan row if the design freezes before they land; deletes outright if they land first. The reasoning and receipts live in the note, not here.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "inner-cost-lanes-scoping",
-    primary_work: DeclarationRef { module_path: "gunbc.roadmap_authority", decl_name: "roadmap_authority", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "both lanes have landed or been retired: Lane A when process_escapes_loop is migrated onto source_chars with its discriminating non-ASCII receipt, Lane B when the shared-overlap measurement it asks for exists and either opens the program or prices it down. The note is scoping for two roadmap nodes, so it dissolves when those nodes close, not into a gunbc.plan.Plan row.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "five-minute-ci-gate-design",
@@ -1251,47 +659,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "every sub-lane row is accepted or honestly retired and the program parent five-minute-ci-gate is accepted on fleet receipts showing a representative leaf .dag PR at ≤5 minutes wall with byte-identical verdicts vs a cold recompute control — or the operator recuts the program and this note is superseded by a registered plan row.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "spark-standup-program-accounting",
-    primary_work: DeclarationRef { module_path: "gunbc.plans.fleet_subsumption_manual_gaps", decl_name: "fleet_subsumption_manual_gaps_plan", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "gunbc.spark.dgx_procurement", decl_name: "dgx_spark_arrival_standing", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.spark.dgx_procurement", decl_name: "dgx_spark_router_bindings", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the Spark standup lanes are carried as registered rows rather than by this note — the manual-gap items reach zero and srv5/srv6 are enrolled with their arrival obligations modeled where that arrival lives, at which point the accounting has no facts of its own and this bind deletes with the doc.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "floor-prep-tax-program",
-    primary_work: DeclarationRef { module_path: "gunbc.executor_schedule_retention", decl_name: "schedule_retention_policy_note", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "gunbc.roadmap_authority", decl_name: "five_minute_ci_gate_program_note", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.roadmap_authority", decl_name: "roadmap_authority", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.p1_retention_cohort_receipt", decl_name: "p1_retention_cohort_receipt_verdict", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.ci_cost_arc_closeout_receipt", decl_name: "end_to_end_residual", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.ci_cost_arc_closeout_receipt", decl_name: "retention_settle", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "floor receipts show amortized prep (entries 2..N ≪ ~2s setup), selection receipts expose state/ratio/fallback on every affected run, and width>1 / broad native decisions cite those receipts (and the index-share conjunction) — or the operator folds this bridge into the five-minute / materialization authorities and this bind deletes with the doc.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "worker-private-memory-decomposition",
-    primary_work: DeclarationRef { module_path: "gunbc.executor_schedule_retention", decl_name: "schedule_retention_heads_stay_resident", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "gunbc.executor_schedule_retention", decl_name: "schedule_retention_policy_note", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.p1_retention_cohort_receipt", decl_name: "p1_retention_cohort_receipt_verdict", field: WholeDeclaration },
-      DeclarationRef { module_path: "gunbc.roadmap_authority", decl_name: "five_minute_ci_gate_program_note", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the width-2 crossover decision is taken and cites these terms or a superseding measurement, or the ResolvedGraph-anchored bundle this receipt names becomes shared — at which point the decomposition no longer describes a worker and this bind deletes with the doc.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "accelerator-demo-roundtrip",
-    primary_work: DeclarationRef { module_path: "extdeps.languages.simd.kernel", decl_name: "simd_kernel_medium", field: WholeDeclaration },
-    additional_works: [DeclarationRef { module_path: "gunbc.accelerator_demo_plan", decl_name: "AcceleratorRecognitionOutcome", field: WholeDeclaration }],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "doc migrates into a registered gunbc.plan.Plan row (the registration becomes the binding); §6 item 2 execution lane lands on the simd handler (merged from a two-row form 2026-07-31: home+slug is this list's symbolic identity, so two rows gave one doc two independently removable authority rows)") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "machine-shape-orthogonal-scheduling",
@@ -1313,27 +680,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     additional_works: [DeclarationRef { module_path: "v2.compiler.self_host", decl_name: "canonical_emitted_bytes_digest", field: WholeDeclaration }, DeclarationRef { module_path: "gunbc.bootstrap", decl_name: "CompilerStage", field: WholeDeclaration }],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "Stages 1–9 in the design doc land or are honestly retired: candidate/promoted lifecycle with RecoveryAnchor retention, SuccessorCapabilityReceipt fix-forward gate, declared-change vs regression on the merge path, generation lineage binds ConsumerRead on regen and warm-merge (Promoted bindings only), bridge-generation protocol for incompatible requirement revisions, phased-single-process CI prelude-duplication witness is green on a representative PR, and the doc migrates into a registered gunbc.plan.Plan row (the registration becomes the binding)") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "fleet-self-converge-enforcement-design",
-    primary_work: DeclarationRef { module_path: "gunbc.plans.host_effect_orchestration", decl_name: "host_effect_orchestration_plan", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "companion detail for the host-effect plan's Phase E (pull-mode self-converge); dissolves when Phase E's enforcement topology lands in carriers or the doc registers as a gunbc.plan.Plan row") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "holds-base-runtime-error-investigation-receipts",
-    primary_work: DeclarationRef { module_path: "v2.std.witness", decl_name: "Witness", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the deferred verify-7916-holds-base receipt (CI floor with selection-applied on the reproducing tree, plus cargo test -p v1-compiler --lib) runs against a healthy fleet and its outcome is folded into #7916's history, or the doc is otherwise superseded; either way this bind and the doc delete together") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "e0599-implementation-proposal",
-    primary_work: DeclarationRef { module_path: "tools.e0599_probe_census", decl_name: "e0599_probe_census_note", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "Phase 0 consumer graph accepted and each named predicate (P-fn, P-derive, P-optional) lands with measured receipt or the doc migrates into a registered gunbc.plan.Plan row") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "rc-ownership-wrap-decision-design",
@@ -1347,45 +693,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "doc migrates into a registered gunbc.plan.Plan row (the registration becomes the binding)") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "arc-store-path-migration-decision",
-    primary_work: DeclarationRef { module_path: "v1.compiler.languages", decl_name: "sharing_wrap_ctor_for_target", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.compiler.wrap_decision", decl_name: "WrapDecisionBundleChildLookup", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the v1-run-stability width>1 resumption trigger in this note fires and the parked alias-flip plus C1 in-memory store land in one motion — or the decision record migrates into a registered gunbc.plan.Plan row") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "module-identity-storage-binding-design",
-    primary_work: DeclarationRef { module_path: "v2.lens.effect_reach", decl_name: "effect_reach_law", field: WholeDeclaration },
-    additional_works: [DeclarationRef { module_path: "v2.workflow.witness_admission", decl_name: "consumer_for_explicit_rosters", field: WholeDeclaration }],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "BOTH conditions gate dissolution (merged from a two-row form 2026-07-31, same identity rule as the guarantee-recovery row): typed SourceRef at host boundaries is ENFORCED and the bare-string file-dependency class is migrated (effect_reach_law's own dissolve condition), and the doc migrates into a registered gunbc.plan.Plan row (the registration becomes the binding)") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "live-read-witness-classification-design",
-    primary_work: DeclarationRef { module_path: "v2.lens.live_read_classification", decl_name: "live_read_classification_law", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "doc migrates into a registered gunbc.plan.Plan row (the registration becomes the binding)") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "witness-realization-plan",
-    primary_work: DeclarationRef { module_path: "std.emit_on_demand", decl_name: "witness_family_build_grain_ruling", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "std.realize_pack", decl_name: "realize_pack_width", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "dissolves into a registered gunbc.plan.Plan row when its P1 lands. REBOUND 2026-08-21: this row named v2.workflow.ci_floor_plan gunbc_ci_floor_plan — the floor plan that would have SCHEDULED the realized witnesses, deleted with its module by the floor cut. The plan itself is live (six documents cite it as their parent authority), and its landed subjects are the two carriers named here: the family build-grain ruling that answers its FLAG B, and the packing law its P4 derives. Scheduling re-enters as a consumer when a floor plan exists again; it was never the subject of this document.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "ci-floor-time-45-72-band-attribution",
-    primary_work: DeclarationRef { module_path: "gunbc.ci_materialization", decl_name: "ci_floor_declared_resolve_count", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "dissolves when realization_measurement_loop Phase-0 Gantt carrier supersedes prose receipts (same trigger as ci-floor-fractal-gantt)") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "ci-floor-child-spawn-attribution",
@@ -1393,13 +700,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     additional_works: [],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "dissolves when the child-spawn class is dissolved — run_gunbc_claims_ready pools ClaimRuns into one process or runs them against the executor's warm process_shared_index (the ci_floor_resolve_receipt_note 'resolve once, share by reference' terminal); this receipt's counterfactuals become that PR's before/after") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "progress-observation-design",
-    primary_work: DeclarationRef { module_path: "std.observation", decl_name: "ObservationEvent", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "P0 lands the observation laws + glyph authority as .dag data rows (roadmap 2d ts-obs-model) — the carriers become the authority and this doc stays as the design record. REBOUND 2026-08-21: this row named v2.workflow.ci_floor_plan gunbc_ci_floor_plan, the floor plan the doc measured its displaced cost against, which the floor cut deleted with its module; the doc is a live roadmap deliverable authority, so the repair is to bind it to the subject it actually designs — std.observation's event model — rather than to a consumer that no longer exists") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "roadmap-workspace-ux-plan",
@@ -1424,52 +724,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the RLM-6 terminal receipt is recorded -- one receipt joining every frozen identity of the serial gate chain (the canary parent Done by explicit acceptance, its child Ready, the parent's relaunch refused AlreadyAccepted); at that point the plan describes shipped behavior and the row deletes with the document") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "recursive-workflow-advancement-design",
-    primary_work: DeclarationRef { module_path: "gunbc.workflow_reconcile", decl_name: "workflow_recursive_reconcile_note", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the advancement plan, exact-candidate receipt producers through goal audit, and recursive child-workflow realization land as typed carriers and register as a gunbc.plan.Plan row; then this bind deletes while the md remains the design record") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "ci-two-tier-placement-redesign",
-    primary_work: DeclarationRef { module_path: "gunbc.ci_spec", decl_name: "gunbc_ci_spec", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "D3 lands the placement axis (PrTier | Gauntlet) on CiSpec rows with the measured 5s-rule roster — the spec rows become the authority; the D4 audit-step deletion and D0/D1 preconditions are tracked on their carriers") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "test-decomposition-wcf-cut",
-    primary_work: DeclarationRef { module_path: "gunbc.witness_row_cost", decl_name: "gunbc_ci_fast_lane_rule_note", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "every Class C row on the measured head lands fixture/cadence split (or reclassifies F with a named cost-shape owner); dark long/ files classify only at Gauntlet enrollment — then authority collapses into CiSpec placement rows + enrolled cadence rosters and this doc deletes") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "fallback-arm-census",
-    primary_work: DeclarationRef { module_path: "v2.lens.fallback_arm_census", decl_name: "fallback_arm_census_law", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "W3 promotes the lens to a compile refusal (zero-false-positive corpus-wide) and/or the doc migrates into a registered gunbc.plan.Plan row — then this bind deletes with the md") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "dag-note-prose-census",
-    primary_work: DeclarationRef { module_path: "v2.lens.enforcement.standing_intent", decl_name: "StandingIntent", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the typed annotation carriers land (ruling rows on StandingIntent, an event log keyed to the declaration, citation edges) and the annotation-budget lens counts ROWS — at which point a lexical census over prose is superseded by a fold over typed rows, and the doc plus its instrument delete together") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "dag-prose-policy-audit",
-    primary_work: DeclarationRef { module_path: "v2.std.compilers.lexing", decl_name: "LexRule", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.compiler.parse", decl_name: "ParseArtifact", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.extdeps.languages.dag", decl_name: "dag_line_comment_fidelity", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.test.round_trip.dag_comment_wall_test", decl_name: "dag_comment_wall_line_comment_refused", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the source-annotation carrier lands with its executed controls — line comments captured on a THIRD lexical channel (AnnotationRule, never TriviaRule and never an ordinary TokenRule) returning an authored wrapper around an unchanged semantic artifact, consuming no semantic occurrence identity, attached at module-item grain with trailing/body/unattached/block forms refusing, and erasure established by the seven D-C proofs rather than by emitted-byte equality alone (which cannot detect a moved occurrence-identity graph) — and the representation partition over the measured prose population completes; at which point a lexical audit over prose is superseded by a fold over the annotation graph and the typed populations beside it, and this doc plus its uncommitted instrument delete together (same trigger family as dag-note-prose-census)") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "dissolution-census-a-ci-layer-roots",
@@ -1477,41 +731,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     additional_works: [DeclarationRef { module_path: "v2.lens.enforcement.standing_intent", decl_name: "StandingIntent", field: WholeDeclaration }],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the typed annotation carriers land (StandingIntent, event log, citation edges) and an annotation-budget lens counts rows — at which point a lexical census over ci_layer_roots prose is superseded by a fold over typed rows, and this doc plus its instrument delete together (same trigger as dag-note-prose-census)") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "extdeps-positioning-restructure",
-    primary_work: DeclarationRef { module_path: "v2.lens.extdeps_shape_transport_policy", decl_name: "extdeps_shape_transport_policy_clean_holds", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the extdeps positioning restructure PR (pure git mv + import repoint: os/ de-grab-bag + findings 1-4 hub-loose, all under the §3 extdeps discipline this lens enforces) lands and the extdeps directories are §3-congruent — the brief's scope is discharged; delete this row and the doc together") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "v1rt-witness-diagnostic-carrier-decouple-design",
-    primary_work: DeclarationRef { module_path: "v2.std.witness", decl_name: "witness_from_optional", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "Stage-4 Gate-1 E0308 burn-down probe receipt lands (design note §3 — measurement only); doc archives or registers as a gunbc.plan.Plan row") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "hermetic-tool-provisioning-design",
-    primary_work: DeclarationRef { module_path: "extdeps.tools", decl_name: "CliTool", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "P1/P2 land the digest-bearing pin and the tool instantiation of gunbc.membership_reconcile — the host-program ensure over the CliTool catalog row lands (program-install lane, successor to the deleted extdeps.tools.resolve) and the four forked resolvers delete; the pin carrier becomes the authority and the plan registers as a gunbc.plan.Plan row") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "ci-invocation-fixed-tax-attribution",
-    primary_work: DeclarationRef { module_path: "v1.compiler.tokenize", decl_name: "process_escapes_loop", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "REBOUND 2026-08-21: this row named gunbc.ci_workflow gunbc_ci_selection_control_step_note, the demotion rationale this receipt supplied the basis for; the floor cut deleted gunbc.ci_workflow whole and the citation outlived it. The measurement itself is about the invocation fixed tax, whose located root this note names as its lever 1 — the unmigrated frontend construction in v1.compiler.tokenize process_escapes_loop — so the doc is rebound to the system whose movement would make its purpose false. Dissolves when the pre-evaluation whole-corpus passes are persisted across processes or derived from the containment tree (namespace-only resolution lane) — its levers then re-price against the new baseline, and the demotion's outcome-based return trigger (selection control back per-PR once a named receipt shows the whole control step consistently below a seconds-scale ceiling on the CI fleet across a full falsifier window) consumes its measurements") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "srv1-deploy-serialization-and-false-greens",
-    primary_work: DeclarationRef { module_path: "gunbc.ci_spec", decl_name: "gunbc_ci_deploy_srv1_stage", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "all FOUR findings this diagnosis names are facts on their carriers: (1) srv1 deployment holds a typed HOST-SIDE lease spanning mutation, readiness and identity readback — a runner label or concurrency group is mitigation only, since neither excludes the operator apply path — plus a counted refusal when the candidate is not the authoritative revision under whichever revision authority is ruled, (2) the healthz fingerprint identifies what is DEPLOYED (source closure and binary artifact identity, not build provenance alone) rather than five rendered bodies, (3) the refusal path preserves the decl's located diagnosis instead of substituting a render complaint, with control-byte admission decided per CursorAction and DynamicLineState rather than one global roster, and (4) job_yaml emits Job.concurrency with a discriminating RED. Then the doc deletes with this row. Twice corrected in review: review 44735 caught that the trigger omitted the misattributed-refusal defect entirely, and review 44766 caught that it would have accepted scheduler-only exclusion, source-only identity and a global byte-roster fix") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "compiler-guarantee-recovery-gap-analysis",
@@ -1526,51 +745,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     additional_works: [DeclarationRef { module_path: "gunbc.roadmap_component", decl_name: "roadmap_row_archetype_note", field: WholeDeclaration }],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the A2 presentation seam lands on its carriers — the view projection module (WorkRowView/ActivityView/ActionView/DailyWorkspaceView/ObservationImpactView), the row archetype's ActivityRegion placed UnderHead with ActuatorRegion shrunk to actions only, and the attention-rule witnesses including the falsifier specimen (active attempt + seven obligations + session-present/process-exited + long title, coherent at three widths) — and the plan registers as a gunbc.plan.Plan row (extends roadmap-workspace-ux-plan and roadmap-workspace-remodel-plan, whose rows dissolve on their own triggers)") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "p1-retention-vs-drain-cohort-receipt",
-    primary_work: DeclarationRef { module_path: "gunbc.p1_retention_cohort_receipt", decl_name: "p1_retention_cohort_receipt_reproduction_steps", field: WholeDeclaration },
-    additional_works: [DeclarationRef { module_path: "gunbc.p1_retention_cohort_receipt", decl_name: "p1_retention_cohort_receipt_verdict", field: WholeDeclaration }],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the redirected assembly/materialization lane this receipt's REJECT verdict points to is picked up and either supersedes this pinned measurement with a canonical carrier or the parent floor-prep-tax-program plan closes P1 outright — then this receipt and its anchor module delete together, per the same scaffold trigger named beside p1_cohort_receipt_enabled in cli_run.rs.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "p3-classification-cost-ab-receipt",
-    primary_work: DeclarationRef { module_path: "v2.lens.live_read_classification", decl_name: "live_read_classification_law", field: WholeDeclaration },
-    additional_works: [],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "paired fleet receipts for ClassificationCostStanding land on the pinned merge SHA with headSha-verified control/candidate arms and the five-valued verdict is recorded — then surviving measurement facts migrate to the canonical carrier and this bind deletes with the doc.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "push-event-affected-set-baseline-design",
-    primary_work: DeclarationRef { module_path: "gunbc.diff_baseline", decl_name: "resolve_diff_baseline", field: WholeDeclaration },
-    additional_works: [DeclarationRef { module_path: "v2.workflow.floor_diff_observe", decl_name: "floor_observe_ci_diff_event", field: WholeDeclaration }, DeclarationRef { module_path: "gunbc.diff_baseline", decl_name: "diff_baseline_fail_closed_law", field: WholeDeclaration }],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the before..head push baseline lands AND the merge-queue candidate gate is enforcing (gunbc.ci_failure_class merge_freshness_gating_status = GatingEnforced) — at which point the exact tree becoming main is verified before it becomes main and this note describes the past. CORRECTED 2026-08-03 (operator ruling): this trigger previously read \"the last-green baseline lands\". Last-green was REJECTED for ordinary selection, so that condition could never be met and this row would have been permanently undissolvable — an unfireable trigger is indistinguishable from an unfired one, so no gate would ever have flagged it.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "provider-control-interface-audit",
-    primary_work: DeclarationRef { module_path: "gunbc.dispatch_selection", decl_name: "DispatchResolvedExecution", field: WholeDeclaration },
-    additional_works: [DeclarationRef { module_path: "extdeps.llm.cli_lifecycle", decl_name: "ProviderReadiness", field: WholeDeclaration }, DeclarationRef { module_path: "gunbc.roadmap_provider_events", decl_name: "provider_execution_state", field: WholeDeclaration }],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the audit's locked decisions are facts on their carriers, not prose. PROVIDER INTERFACE HALF: DispatchResolvedExecution carries ONE nested ProviderInterfaceBinding whose runtime is a CLOSURE identity (package closure + runtime toolchain + adapter artifact + protocol identity — not a single artifact digest), provider identity is split from control interface and both from transport, ProviderReadiness is decomposed into independent installation/auth/entitlement/limit/turn standings with an open native limit token, and provider_execution_state reads typed app-server terminals instead of the exec --json category-discarding arm. PACKAGE DELIVERY HALF (added 2026-08-03 per operator ruling — the audit's §2 gap is a package-management gap, not a provider problem, so closing only the provider carriers would leave the note's load-bearing half undelivered): the generic package-delivery authority exists and is CONSUMED IN PRODUCTION — requirement vs exact selection, lock graph with artifact integrity admitted before unpack, materialization receipt with install scripts forbidden unless explicitly admitted, executable-vs-module consumer binding, runtime-bundle identity, ReleaseBundled posture with no acquisition on the deployed host, and an explicit reviewed lock-refresh path — with the Codex realization delivered through it and srv1's exec/tmux offer removed. The §4 paired Claude entitlement probe must also have RUN, deciding whether ClaudeDirectStreamJson survives as an interface or dissolves; an undecided probe leaves this row live because the audit's retraction of the entitlement claim is what makes the row honest. Then the note becomes the design record and this bind deletes with it.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "sole-modeled-publisher-design",
-    primary_work: DeclarationRef { module_path: "tools.publication_publisher", decl_name: "PublicationAuthority", field: WholeDeclaration },
-    additional_works: [DeclarationRef { module_path: "tools.publication_push_shadow", decl_name: "shadow_replay_public_pushes", field: WholeDeclaration }],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "live slice lands: ordinary sessions lose public-write credentials, git.PublicationTransport dispatch binds to PublicationAuthority, and shadow witness becomes regression control — then register as gunbc.plan.Plan row or delete with carriers") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "c1-cost-expr-authority-design",
-    primary_work: DeclarationRef { module_path: "v2.lens.cost", decl_name: "cost_lens", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "gunbc.plans.v2_complexity_capability_parity", decl_name: "v2_complexity_capability_parity_plan", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.lens.enforcement.complexity_contract_subject", decl_name: "complexity_derived_kernel_boundary", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "v2.lens.cost carries grounded SizeExpr/CostExpr with normalize_cost_expr_to_symbolic live, the C1 blocking-wall baseline roster is green post-carrier, bounded-summation and CostRefused witnesses execute green, and parity note C1 acceptance is met — then the carriers state the capability and this bind deletes with the doc.") },
-  },
   HandAuthoredDocBind {
     home: ProbeDoc,
     slug: "leading_minus_continuation_silently_truncates_2026-08-23",
@@ -1578,25 +752,6 @@ data hand_authored_doc_bind_incomings: List<HandAuthoredDocBind> = [
     additional_works: [],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the reduced parser cases this document carries are held by an EXECUTING REGRESSION CARRIER -- a witness that authors `100 \\n - 1` and its `+` and `*` controls and refuses when the leading-minus continuation is truncated again -- the production citation in extdeps.cpu_attachment.lotes_azifa072 is repointed to that carrier, and no other evidence consumer names this document. Then the receipt is the carrier and this bind deletes with the md. IT IS DELIBERATELY NOT PlanHasNoRetirement: the evidence being load-bearing TODAY is not grounds for making a Markdown file the permanent terminal form of a parser guarantee, which is exactly the shape the three g1 controls were wrongly given before they moved to v2.lens.cited_symbol_resolution.") },
   },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "v2-frontend-std-ingestion-frontier",
-    primary_work: DeclarationRef { module_path: "v2.compiler.normalize", decl_name: "normalize", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "v2.compiler.parse", decl_name: "parse_module", field: WholeDeclaration },
-      DeclarationRef { module_path: "v2.compiler.tokenize", decl_name: "lex_walk_artifact", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the measured frontier closes: the v2 frontend ingests the std substrate modules this receipt records as rejecting, at each of the three stages it attributes them to — normalize's retention-then-rejection contract violation first, then the lex and parse gaps — and the per-module stage-and-reason table describes shipped behaviour rather than a standing frontier, at which point the receipt and this bind delete together. Registered at subject grain: the bound declarations are the three frontend stages whose movement would make the table false, not every module its rows name.") },
-  },
-  HandAuthoredDocBind {
-    home: PlanDoc,
-    slug: "four-lane-closeout-and-root",
-    primary_work: DeclarationRef { module_path: "gunbc.roadmap_authority", decl_name: "five_minute_ci_gate_program_note", field: WholeDeclaration },
-    additional_works: [
-      DeclarationRef { module_path: "gunbc.witness_floor_workflow", decl_name: "witness_floor_concurrency_group", field: WholeDeclaration },
-    ],
-    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the six findings this note records outlive their archived lanes only until each has a carrier of its own: the rejected_with_pending diagnostic-order defect, the entry-vs-member position divergence, the three-entrypoint admission divergence, the standing section 4c population that makes a full-corpus compile exit 1, the floor-gated deploy, and the concurrency-group key -- that last one now carried by gunbc.witness_floor_workflow witness_floor_concurrency_group, which keys merge_group by sha, heal dispatch by expected_healed_sha, pull_request by number, push by github.ref, and run_id only as the bare-dispatch fallback, with the 2026-08-17 every-main-must-finish unique-run_id reading retired as gunbc.rung_drop main_per_commit_floor_verdict, and by witness_floor_concurrency_policy, which derives the cancel axis from the observed fleet standing; the note is repointed there because the ci.yml-era second authority it used to cite was deleted with its workflow. When each is either fixed or carried as a typed row, the note is a historical account and deletes with this bind. It is registered rather than deleted today because four sessions were archived holding these measurements and nothing else records them — but a cross-lane status narrative is the parallel-ledger shape DESIGN section 6 warns about, so its home is a question for the operator, not a settled one.") },
-  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "self-host-cargo-refusal-root-partition",
diff --git a/dag/gunbc/documentary_refs.dag b/dag/gunbc/documentary_refs.dag
index f975d1cbbdb..e31eb56898c 100644
--- a/dag/gunbc/documentary_refs.dag
+++ b/dag/gunbc/documentary_refs.dag
@@ -36,12 +36,16 @@ import std.decl_ref { DeclarationRef, decl_ref }
 
 data v1_maintenance_standing_ref: DeclarationRef = decl_ref(module_path: "gunbc.v1_maintenance_standing", decl_name: "v1_seed_standing")
 
-data required_gate_prefixes_ref: DeclarationRef = decl_ref(module_path: "v2.workflow.required_floor", decl_name: "required_gate_prefixes")
+// THE REQUIRED GATE'S SUBJECTS. Until the 2026-10-09 ruling (the v1 withdrawal) this row named
+// v2.workflow.required_floor required_gate_prefixes, the roster the deleted floor lane prepared. The
+// one required lane now compiles the import closures of the entries these rows emit, so this is the
+// declaration that says what "inside the required gate" means.
+data required_gate_subjects_ref: DeclarationRef = decl_ref(module_path: "gunbc.emitted_subject_build_gate", decl_name: "emitted_subject_build_rows")
 
 fn documentary_ref_symbol_text(reference: DeclarationRef) -> String {
   concat("`", reference.module_path as String, " ", reference.decl_name as String, "`")
 }
 
 fn generated_document_declaration_refs() -> List<DeclarationRef> {
-  [v1_maintenance_standing_ref, required_gate_prefixes_ref]
+  [v1_maintenance_standing_ref, required_gate_subjects_ref]
 }
diff --git a/dag/gunbc/durable_cas_file_store.dag b/dag/gunbc/durable_cas_file_store.dag
index 29889384b6d..99b3ec830c2 100644
--- a/dag/gunbc/durable_cas_file_store.dag
+++ b/dag/gunbc/durable_cas_file_store.dag
@@ -5,7 +5,7 @@ import std.algebra { trim }
 import std.decimal { decimal_digits_only }
 import std.list { distinct_by_key }
 import std.content_hash { ContentHash, content_hash_of_value, compare_content_hash, ContentHashEqual, ContentHashDifferent, ContentHashCrossFamilyIncomparable }
-import std.durable_compare_and_set { CasAttempt, cas_attempt, CasOutcome, CasCommitted, CasPreconditionFailed, CasStoreRefused, CasExpectation, ExpectSlotAbsent, ExpectSlotGeneration, CasGeneration, CasSlotVersion, CasReadableAbsent, CasReadablePresent, CasSlotObservation, CasObservedReadable, CasObservedUnreadable, CasUnreadableMalformed, CasUnreadableReadRefused, CasStoreFailure, CasSlotObservationRefused, CasGenerationPublicationRefused, cas_generation_exhausted, cas_generation_first, cas_generation_count, cas_generation_successor, CasSuccessorGeneration, CasSuccessorExhausted }
+import std.durable_compare_and_set { CasAttempt, cas_attempt, CasOutcome, CasCommitted, CasPreconditionFailed, CasStoreRefused, CasExpectation, ExpectSlotAbsent, ExpectSlotGeneration, CasGeneration, CasSlotVersion, CasReadableAbsent, CasReadablePresent, CasSlotObservation, CasObservedReadable, CasObservedUnreadable, CasUnreadableMalformed, CasUnreadableReadRefused, CasUnreadableObservationBoundExceeded, CasStoreFailure, CasSlotObservationRefused, CasGenerationPublicationRefused, cas_generation_exhausted, cas_generation_first, cas_generation_count, cas_generation_successor, CasSuccessorGeneration, CasSuccessorExhausted }
 import std.checked_arithmetic { int_inclusive_max }
 import v2.std.algebra { skip }
 import extdeps.access.posix { FileMode, file_mode_bits }
@@ -456,9 +456,6 @@ type CasSlotRetention
   = KeepAllGenerations
   | KeepGenerationWindow { window: CasGenerationWindow }
 
-// A window read that keeps observing a moving head stops here and refuses with the attempt count.
-data cas_window_observation_attempt_bound: Int = 8
-
 // "<digits>" -> the generation it names; none for anything else, for zero, and for a value past the
 // Int maximum. The multiplication is pre-checked (std.checked_arithmetic: check before, never after).
 fn cas_generation_of_digits(s: String) -> CasGeneration? {
@@ -491,7 +488,7 @@ fn cas_key_generation_of_name(key: NonEmptyStr, name: String) -> CasGeneration?
 fn cas_window_generations(root: NonEmptyStr, key: NonEmptyStr) -> CasWindowGenerations
   admit_callers: [
     decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_settle_slot"),
-    decl_ref(module_path: "gunbc.durable_cas_file_store", decl_name: "cas_observe_window"),
+    decl_ref(module_path: "gunbc.durable_cas_file_store", decl_name: "cas_observe_window_once"),
     decl_ref(module_path: "gunbc.durable_cas_file_store", decl_name: "cas_reclaim_below"),
   ]
 {
@@ -516,37 +513,54 @@ fn cas_window_max_generation(generations: List<CasGeneration>) -> CasGeneration?
   })
 }
 
-fn cas_observe_window(root: NonEmptyStr, key: NonEmptyStr, attempt: Int) -> CasSlotProbe
+// THE ONE AUTHORITY FOR THE WINDOWED OBSERVATION BOUND: the roster is the bound. Exhaustion
+// reports CasUnreadableObservationBoundExceeded { bound: count(cas_window_observation_attempts) }.
+data cas_window_observation_attempts: List<Int> = [1, 2, 3, 4, 5, 6, 7, 8]
+
+// ONE LIST-AND-VERIFY PASS. Recursion here was the unbounded arm: a window whose listed max is
+// strictly below a generation that still reads present (stale listing, or a TCO lowering that does
+// not increment `attempt`) re-entered cas_observe_window forever, re-reading G and G+1 with no
+// further List. A fold over a finite attempt roster cannot fail to stop.
+fn cas_observe_window_once(root: NonEmptyStr, key: NonEmptyStr) -> CasSlotProbe?
   admit_callers: [
-    decl_ref(module_path: "gunbc.durable_cas_file_store", decl_name: "cas_observe_retained_slot"),
     decl_ref(module_path: "gunbc.durable_cas_file_store", decl_name: "cas_observe_window"),
   ]
 {
-  if attempt > cas_window_observation_attempt_bound {
-    ProbedWindowHeadUnsettled { attempts: cas_window_observation_attempt_bound }
-  } else {
-    match cas_window_generations(root: root, key: key) {
-      CasWindowGenerationsUnlisted { cause: c } => ProbedAbsenceUnestablished { cause: c }
-      CasWindowGenerationsListed { generations: gs } =>
-        match cas_window_max_generation(generations: gs) {
-          Absent => ProbedAbsent
-          Present { value: head } =>
-            match cas_read_generation(root: root, key: key, generation: head) {
-              GenerationRefused { probe: p } => p
-              GenerationAbsent => cas_observe_window(root: root, key: key, attempt: attempt + 1)
-              GenerationPresent { content: c } =>
-                match cas_generation_successor(g: head) {
-                  CasSuccessorExhausted { head: _ } => ProbedHead { generation: head, value: c }
-                  CasSuccessorGeneration { generation: next } =>
-                    match cas_read_generation(root: root, key: key, generation: next) {
-                      GenerationRefused { probe: p } => p
-                      GenerationAbsent => ProbedHead { generation: head, value: c }
-                      GenerationPresent { content: _ } => cas_observe_window(root: root, key: key, attempt: attempt + 1)
-                    }
-                }
-            }
-        }
-    }
+  match cas_window_generations(root: root, key: key) {
+    CasWindowGenerationsUnlisted { cause: c } => Present { value: ProbedAbsenceUnestablished { cause: c } }
+    CasWindowGenerationsListed { generations: gs } =>
+      match cas_window_max_generation(generations: gs) {
+        Absent => Present { value: ProbedAbsent }
+        Present { value: head } =>
+          match cas_read_generation(root: root, key: key, generation: head) {
+            GenerationRefused { probe: p } => Present { value: p }
+            GenerationAbsent => none
+            GenerationPresent { content: c } =>
+              match cas_generation_successor(g: head) {
+                CasSuccessorExhausted { head: _ } => Present { value: ProbedHead { generation: head, value: c } }
+                CasSuccessorGeneration { generation: next } =>
+                  match cas_read_generation(root: root, key: key, generation: next) {
+                    GenerationRefused { probe: p } => Present { value: p }
+                    GenerationAbsent => Present { value: ProbedHead { generation: head, value: c } }
+                    GenerationPresent { content: _ } => none
+                  }
+              }
+          }
+      }
+  }
+}
+
+fn cas_observe_window(root: NonEmptyStr, key: NonEmptyStr) -> CasSlotProbe
+  admit_callers: [
+    decl_ref(module_path: "gunbc.durable_cas_file_store", decl_name: "cas_observe_retained_slot"),
+  ]
+{
+  match fold(cas_window_observation_attempts, init: none, f: (acc, _) => match acc {
+    Present { value: p } => Present { value: p }
+    Absent => cas_observe_window_once(root: root, key: key)
+  }) {
+    Present { value: p } => p
+    Absent => ProbedWindowHeadUnsettled { attempts: count(cas_window_observation_attempts) }
   }
 }
 
@@ -560,14 +574,12 @@ fn cas_observe_retained_slot(root: NonEmptyStr, key: NonEmptyStr, retention: Cas
 {
   match retention {
     KeepAllGenerations => cas_observe_slot(root: root, key: key)
-    KeepGenerationWindow { window: _ } => cas_observe_window(root: root, key: key, attempt: 1)
+    KeepGenerationWindow { window: _ } => cas_observe_window(root: root, key: key)
   }
 }
 
 fn cas_window_head_unsettled(attempts: Int) -> CasUnreadableSlot {
-  CasUnreadableReadRefused {
-    detail: concat(concat("the window head moved during ", attempts as String), " observations and was not settled; a head is never guessed") as NonEmptyStr
-  }
+  CasUnreadableObservationBoundExceeded { bound: attempts }
 }
 
 // THE PROJECTION TAKES A HEAD, NOT A PROBE, AND THE DELETED ARM IS THE REPAIR.
@@ -677,11 +689,62 @@ fn observe_cas_slot_state_windowed(root: NonEmptyStr, key: NonEmptyStr, window:
   admit_callers: [
     decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_read_index"),
     decl_ref(module_path: "test.claim.durable_cas_file_store_wet_witness", decl_name: "a_window_slot_holds_at_most_k_plus_one_generations_by_real_execution"),
+    decl_ref(module_path: "test.claim.durable_cas_file_store_wet_witness", decl_name: "a_window_observation_at_generation_1500_terminates_by_real_execution"),
   ]
 {
   observe_cas_slot_state_retained(root: root, key: key, retention: KeepGenerationWindow { window: window })
 }
 
+// A WINDOWED HEAD READ BY CONSTRUCTED NAME, NOT BY LISTING THE SLOT ROOT.
+//
+// cas_observe_window finds the head by listing every name under the store root and keeping this
+// key's generation files. That is the correct discovery when the generation is unknown, because a
+// windowed slot is NOT a presence prefix: generations at or below head-k are deleted, so galloping
+// from generation 1 would read NotFound and report an empty slot while the live head sat at 100.
+// Listing is therefore retained for unknown-head observation (cas_observe_window).
+//
+// When the caller already names the generation it believes is head -- a hold it just acquired, a
+// release at the generation the protocol recorded -- the existing correctness argument does not
+// need the listing. The windowed contract's verify step is: the named generation reads present and
+// its successor reads absent. Those two reads are Filesystem.Read of cas_file_slot_path, O(1) in
+// the store's object count. A successor that is present means the head moved; an absent named
+// generation is not this head. The observation is never guessed.
+// Realization-private: named verify is not CasSlotProbe and not DurableHoldObservation. G+1 present
+// is a moved head, not eight-pass BoundExceeded. Consumers are the windowed hold check and the
+// windowed release assessment; they match HeadMoved directly.
+type CasNamedWindowVerify
+  = NamedWindowHeadCurrent { observation: CasSlotObservation<NonEmptyStr> }
+  | NamedWindowHeadMoved { named_generation: CasGeneration }
+
+fn cas_verify_named_window_head(root: NonEmptyStr, key: NonEmptyStr, generation: CasGeneration) -> CasNamedWindowVerify
+  admit_callers: [
+    decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_hold_check"),
+    decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "file_hold_release_assess_windowed_at"),
+    decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "file_hold_recovery_assess_windowed"),
+  ]
+{
+  if !cas_key_is_slot_addressable(key: key) {
+    NamedWindowHeadCurrent { observation: CasObservedUnreadable { cause: CasUnreadableReadRefused { detail: cas_key_not_slot_addressable_detail } } }
+  } else {
+    match cas_read_generation(root: root, key: key, generation: generation) {
+      GenerationRefused { probe: p } => NamedWindowHeadCurrent { observation: cas_probe_as_observation(probe: p) }
+      GenerationAbsent => NamedWindowHeadCurrent { observation: cas_probe_as_observation(probe: ProbedAbsent) }
+      GenerationPresent { content: c } =>
+        match cas_generation_successor(g: generation) {
+          CasSuccessorExhausted { head: _ } =>
+            NamedWindowHeadCurrent { observation: cas_probe_as_observation(probe: ProbedHead { generation: generation, value: c }) }
+          CasSuccessorGeneration { generation: next } =>
+            match cas_read_generation(root: root, key: key, generation: next) {
+              GenerationRefused { probe: p } => NamedWindowHeadCurrent { observation: cas_probe_as_observation(probe: p) }
+              GenerationAbsent =>
+                NamedWindowHeadCurrent { observation: cas_probe_as_observation(probe: ProbedHead { generation: generation, value: c }) }
+              GenerationPresent { content: _ } => NamedWindowHeadMoved { named_generation: generation }
+            }
+        }
+    }
+  }
+}
+
 data cas_key_not_slot_addressable_detail: NonEmptyStr = "key is not slot-addressable: it carries a path separator"
 
 
@@ -1035,23 +1098,42 @@ type CasFileWrite {
   reclamation: CasWindowReclamation
 }
 
+type CasReclaimProgress {
+  removed: List<CasGeneration>
+  failed: List<CasGenerationReclaimFailure>
+}
+
+// ASCENDING, AND STOP AT THE FIRST HOST REFUSAL. Independent deletes of every generation at or
+// below the floor could remove G+1 while G survived, which punches a hole: named window verify
+// (G present and G+1 absent) would then report G as head while a later generation was live.
+// One sort_by of the eligible set, then one walk that leaves every later generation in place when
+// a delete fails, keeps that prefix contiguous without a min-and-filter per step.
 fn cas_reclaim_below(root: NonEmptyStr, key: NonEmptyStr, window: CasGenerationWindow, head: CasGeneration) -> CasWindowReclamation
   admit_callers: [
     decl_ref(module_path: "gunbc.durable_cas_file_store", decl_name: "file_compare_and_set_retained"),
     decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_settle_slot"),
+    decl_ref(module_path: "test.claim.durable_cas_file_store_wet_witness", decl_name: "reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution"),
   ]
 {
   match cas_window_generations(root: root, key: key) {
     CasWindowGenerationsUnlisted { cause: c } => CasReclamationUnlisted { cause: c }
     CasWindowGenerationsListed { generations: gs } => {
       let floor = cas_generation_count(g: head) - window.k
-      let attempts = gs |> filter(g => cas_generation_count(g: g) <= floor) |> map(g => {
-        let d = Filesystem.Delete(path: cas_file_slot_path(root: root, key: key, generation: g))
-        CasGenerationDeleteAttempt { generation: g, success: d.success, error: d.error }
-      })
-      let removed = attempts |> filter(t => t.success) |> map(t => t.generation)
-      let failed = attempts |> filter(t => !t.success) |> map(t => CasGenerationReclaimFailure { generation: t.generation, host_error: t.error })
-      if count(failed) == 0 { CasReclaimed { removed: removed } } else { CasReclamationIncomplete { removed: removed, failed: failed } }
+      let ordered = gs |> filter(g => cas_generation_count(g: g) <= floor) |> sort_by(g => cas_generation_count(g: g))
+      let walk = fold(ordered, init: CasReclaimProgress { removed: [], failed: [] }, f: (acc, g) =>
+        if count(acc.failed) != 0 { acc } else {
+          let d = Filesystem.Delete(path: cas_file_slot_path(root: root, key: key, generation: g))
+          if d.success {
+            CasReclaimProgress { removed: acc.removed |> list_push(g), failed: acc.failed }
+          } else {
+            CasReclaimProgress {
+              removed: acc.removed,
+              failed: [CasGenerationReclaimFailure { generation: g, host_error: d.error }],
+            }
+          }
+        }
+      )
+      if count(walk.failed) == 0 { CasReclaimed { removed: walk.removed } } else { CasReclamationIncomplete { removed: walk.removed, failed: walk.failed } }
     }
   }
 }
diff --git a/dag/gunbc/durable_exclusive_hold_file_store.dag b/dag/gunbc/durable_exclusive_hold_file_store.dag
index fa5efa93c9d..1b1f6f35ba9 100644
--- a/dag/gunbc/durable_exclusive_hold_file_store.dag
+++ b/dag/gunbc/durable_exclusive_hold_file_store.dag
@@ -37,14 +37,16 @@ import std.durable_exclusive_hold {
   HoldSlotUndecodable, HoldObservationUnavailable,
   DurableHoldAcquireRefusal, HoldAcquireEligible, HoldAcquireRefused,
   HoldAcquireOccupied, HoldAcquireSlotUndecodable, HoldAcquireObservationUnavailable,
-  HoldReleaseEligible, HoldReleaseRefused, DurableHoldReleaseRefusal,
+  HoldReleaseEligible, HoldReleaseRefused, DurableHoldReleaseAssessment, DurableHoldReleaseRefusal,
   durable_hold_acquire_assess, durable_hold_release_assess,
-  DurableHoldHolderReport, DurableHoldRecoveryRefusal, HoldRecoveryEligible, HoldRecoveryRefused,
+  DurableHoldHolderReport, DurableHoldRecoveryRefusal, DurableHoldRecoveryAssessment, HoldRecoveryEligible, HoldRecoveryRefused,
   durable_hold_recovery_assess,
 }
-import gunbc.durable_cas_file_store { KeepAllGenerations, CasSlotRetention,
-  DefaultAccessCreateOnly, DerivedPayloadAdmitted, DerivedPayloadKeyNotSlotAddressable,
-  admit_cas_attempt_for_derived_payload, file_compare_and_set, observe_cas_slot_state,
+import gunbc.durable_cas_file_store { KeepAllGenerations, KeepGenerationWindow, CasSlotRetention,
+  CasGenerationWindow, DefaultAccessCreateOnly, DerivedPayloadAdmitted, DerivedPayloadKeyNotSlotAddressable,
+  admit_cas_attempt_for_derived_payload, file_compare_and_set, file_compare_and_set_retained,
+  observe_cas_slot_state, observe_cas_slot_state_retained,
+  cas_verify_named_window_head, CasNamedWindowVerify, NamedWindowHeadCurrent, NamedWindowHeadMoved,
 }
 
 // THE TAGS ARE NAMED ONCE AND THE BODY IS DERIVED FROM THE TAG THAT MATCHED.
@@ -142,7 +144,6 @@ fn hold_observation_of_cas(observed: CasSlotObservation<NonEmptyStr>) -> Durable
 fn observe_file_hold_retained(root: NonEmptyStr, key: NonEmptyStr, retention: CasSlotRetention) -> DurableHoldObservation
   admit_callers: [
     decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "observe_file_hold"),
-    decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "observe_file_hold_windowed"),
     decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "file_hold_acquire_prepare_retained"),
     decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "file_hold_release_assess_retained"),
     decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "file_hold_recovery_assess_retained"),
@@ -155,12 +156,54 @@ fn observe_file_hold(root: NonEmptyStr, key: NonEmptyStr) -> DurableHoldObservat
   observe_file_hold_retained(root: root, key: key, retention: KeepAllGenerations)
 }
 
-fn observe_file_hold_windowed(root: NonEmptyStr, key: NonEmptyStr, window: CasGenerationWindow) -> DurableHoldObservation
+// Named-window head movement is a file/window realization outcome, not a
+// protocol refusal. Keep-all consumers of DurableHoldReleaseAssessment never
+// see it; only windowed named verify mints these arms.
+type WindowedHoldReleaseFromVerify
+  = WindowedHoldReleaseProtocol { assessment: DurableHoldReleaseAssessment }
+  | WindowedHoldReleaseNamedHeadMoved { named: CasGeneration }
+
+type WindowedHoldRecoveryFromVerify
+  = WindowedHoldRecoveryProtocol { assessment: DurableHoldRecoveryAssessment }
+  | WindowedHoldRecoveryNamedHeadMoved { named: CasGeneration }
+
+fn windowed_hold_release_from_verify(
+  verify: CasNamedWindowVerify,
+  owner: DurableHoldOwnerRef,
+  acquired_generation: CasGeneration,
+) -> WindowedHoldReleaseFromVerify
   admit_callers: [
-    decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_hold_check"),
+    decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "file_hold_release_assess_windowed_at"),
+    decl_ref(module_path: "test.claim.durable_exclusive_hold_witness", decl_name: "named_window_head_moved_release_does_not_claim_an_observed_current_generation"),
+  ]
+{
+  match verify {
+    NamedWindowHeadMoved { named_generation: n } =>
+      WindowedHoldReleaseNamedHeadMoved { named: n }
+    NamedWindowHeadCurrent { observation: o } =>
+      WindowedHoldReleaseProtocol {
+        assessment: durable_hold_release_assess(observed: hold_observation_of_cas(observed: o), owner: owner, acquired_generation: acquired_generation),
+      }
+  }
+}
+
+fn windowed_hold_recovery_from_verify(
+  verify: CasNamedWindowVerify,
+  report: DurableHoldHolderReport,
+) -> WindowedHoldRecoveryFromVerify
+  admit_callers: [
+    decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "file_hold_recovery_assess_windowed"),
+    decl_ref(module_path: "test.claim.durable_exclusive_hold_witness", decl_name: "named_window_head_moved_recovery_does_not_claim_an_observed_current_generation"),
   ]
 {
-  observe_file_hold_retained(root: root, key: key, retention: KeepGenerationWindow { window: window })
+  match verify {
+    NamedWindowHeadMoved { named_generation: n } =>
+      WindowedHoldRecoveryNamedHeadMoved { named: n }
+    NamedWindowHeadCurrent { observation: o } =>
+      WindowedHoldRecoveryProtocol {
+        assessment: durable_hold_recovery_assess(observed: hold_observation_of_cas(observed: o), report: report),
+      }
+  }
 }
 
 // EVERY EFFECTFUL HOLD WRITE IS LIVE READ -> SEALED PLAN -> CAS COMMIT, AND NO
@@ -325,6 +368,11 @@ type FileHoldReleaseAssessment
   = FileHoldReleasePlanned { plan: FileHoldReleasePlan }
   | FileHoldReleaseNotEligible { slot_key: NonEmptyStr, refusal: DurableHoldReleaseRefusal }
 
+type FileHoldWindowedReleaseAssessment
+  = FileHoldWindowedReleasePlanned { plan: FileHoldReleasePlan }
+  | FileHoldWindowedReleaseNotEligible { slot_key: NonEmptyStr, refusal: DurableHoldReleaseRefusal }
+  | FileHoldWindowedReleaseNamedHeadMoved { slot_key: NonEmptyStr, named: CasGeneration }
+
 // THE ONLY MINT OF A RELEASE PLAN READS THE SLOT ITSELF. There is deliberately
 // no variant over a supplied observation: a synthetic "held by A at N" handed to
 // such a mint would produce a plan that frees a real hold of B's at N, and the
@@ -340,7 +388,6 @@ fn file_hold_release_assess_retained(
 ) -> FileHoldReleaseAssessment
   admit_callers: [
     decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "file_hold_release_assess"),
-    decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "file_hold_release_assess_windowed"),
   ]
 {
   match durable_hold_release_assess(
@@ -367,12 +414,34 @@ fn file_hold_release_assess(root: NonEmptyStr, slot_key: NonEmptyStr, owner: Dur
   file_hold_release_assess_retained(root: root, slot_key: slot_key, owner: owner, acquired_generation: acquired_generation, released_by: released_by, retention: KeepAllGenerations)
 }
 
-fn file_hold_release_assess_windowed(root: NonEmptyStr, slot_key: NonEmptyStr, owner: DurableHoldOwnerRef, acquired_generation: CasGeneration, released_by: DurableHoldReleaseRef, window: CasGenerationWindow) -> FileHoldReleaseAssessment
+fn file_hold_release_assess_windowed_at(root: NonEmptyStr, slot_key: NonEmptyStr, owner: DurableHoldOwnerRef, acquired_generation: CasGeneration, released_by: DurableHoldReleaseRef, window: CasGenerationWindow) -> FileHoldWindowedReleaseAssessment
   admit_callers: [
     decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_release_family_hold"),
   ]
 {
-  file_hold_release_assess_retained(root: root, slot_key: slot_key, owner: owner, acquired_generation: acquired_generation, released_by: released_by, retention: KeepGenerationWindow { window: window })
+  match windowed_hold_release_from_verify(
+    verify: cas_verify_named_window_head(root: root, key: slot_key, generation: acquired_generation),
+    owner: owner,
+    acquired_generation: acquired_generation,
+  ) {
+    WindowedHoldReleaseNamedHeadMoved { named: n } =>
+      FileHoldWindowedReleaseNamedHeadMoved { slot_key: slot_key, named: n }
+    WindowedHoldReleaseProtocol { assessment: a } =>
+      match a {
+        HoldReleaseRefused { refusal: r } => FileHoldWindowedReleaseNotEligible { slot_key: slot_key, refusal: r }
+        HoldReleaseEligible { generation: g } =>
+          FileHoldWindowedReleasePlanned {
+            plan: FileHoldReleasePlan {
+              root: root,
+              slot_key: slot_key,
+              owner: owner,
+              generation: g,
+              free_payload: hold_slot_payload(state: DurableHoldFree { released_by: released_by }),
+              retention: KeepGenerationWindow { window: window },
+            },
+          }
+      }
+  }
 }
 
 // The commit still tells a lost race from an unavailable store. A release
@@ -416,6 +485,11 @@ type FileHoldRecoveryAssessment
   = FileHoldRecoveryPlanned { plan: FileHoldReleasePlan, dead_holder: DurableHoldOwnerRef, evidence: NonEmptyStr }
   | FileHoldRecoveryNotEligible { slot_key: NonEmptyStr, refusal: DurableHoldRecoveryRefusal }
 
+type FileHoldWindowedRecoveryAssessment
+  = FileHoldWindowedRecoveryPlanned { plan: FileHoldReleasePlan, dead_holder: DurableHoldOwnerRef, evidence: NonEmptyStr }
+  | FileHoldWindowedRecoveryNotEligible { slot_key: NonEmptyStr, refusal: DurableHoldRecoveryRefusal }
+  | FileHoldWindowedRecoveryNamedHeadMoved { slot_key: NonEmptyStr, named: CasGeneration }
+
 fn file_hold_recovery_assess_retained(
   root: NonEmptyStr,
   slot_key: NonEmptyStr,
@@ -425,7 +499,6 @@ fn file_hold_recovery_assess_retained(
 ) -> FileHoldRecoveryAssessment
   admit_callers: [
     decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "file_hold_recovery_assess"),
-    decl_ref(module_path: "gunbc.durable_exclusive_hold_file_store", decl_name: "file_hold_recovery_assess_windowed"),
   ]
 {
   match durable_hold_recovery_assess(observed: observe_file_hold_retained(root: root, key: slot_key, retention: retention), report: report) {
@@ -454,10 +527,33 @@ fn file_hold_recovery_assess(root: NonEmptyStr, slot_key: NonEmptyStr, report: D
   file_hold_recovery_assess_retained(root: root, slot_key: slot_key, report: report, released_by: released_by, retention: KeepAllGenerations)
 }
 
-fn file_hold_recovery_assess_windowed(root: NonEmptyStr, slot_key: NonEmptyStr, report: DurableHoldHolderReport, released_by: DurableHoldReleaseRef, window: CasGenerationWindow) -> FileHoldRecoveryAssessment
+fn file_hold_recovery_assess_windowed(root: NonEmptyStr, slot_key: NonEmptyStr, report: DurableHoldHolderReport, released_by: DurableHoldReleaseRef, window: CasGenerationWindow) -> FileHoldWindowedRecoveryAssessment
   admit_callers: [
     decl_ref(module_path: "extdeps.realization.materialization_store_local", decl_name: "local_store_hold_occupied"),
   ]
 {
-  file_hold_recovery_assess_retained(root: root, slot_key: slot_key, report: report, released_by: released_by, retention: KeepGenerationWindow { window: window })
+  match windowed_hold_recovery_from_verify(
+    verify: cas_verify_named_window_head(root: root, key: slot_key, generation: report.generation),
+    report: report,
+  ) {
+    WindowedHoldRecoveryNamedHeadMoved { named: n } =>
+      FileHoldWindowedRecoveryNamedHeadMoved { slot_key: slot_key, named: n }
+    WindowedHoldRecoveryProtocol { assessment: a } =>
+      match a {
+        HoldRecoveryRefused { refusal: r } => FileHoldWindowedRecoveryNotEligible { slot_key: slot_key, refusal: r }
+        HoldRecoveryEligible { generation: g, dead_holder: h, evidence: e } =>
+          FileHoldWindowedRecoveryPlanned {
+            plan: FileHoldReleasePlan {
+              root: root,
+              slot_key: slot_key,
+              owner: h,
+              generation: g,
+              free_payload: hold_slot_payload(state: DurableHoldFree { released_by: released_by }),
+              retention: KeepGenerationWindow { window: window },
+            },
+            dead_holder: h,
+            evidence: e,
+          }
+      }
+  }
 }
diff --git a/dag/gunbc/emitted_crate_workspace.dag b/dag/gunbc/emitted_crate_workspace.dag
new file mode 100644
index 00000000000..280bb43fd5e
--- /dev/null
+++ b/dag/gunbc/emitted_crate_workspace.dag
@@ -0,0 +1,487 @@
+module gunbc.emitted_crate_workspace
+
+import gunbc.crate_partition {
+  EmittedEdgeRefusal,
+  PartitionPolicy,
+  PolicyPartitionParam,
+  ResolvePartitionOk,
+  ResolvePartitionRefused,
+  ResolvePartitionRefusalCause,
+  EmitterReverseEdge,
+  EmittedEdgeEndpointOutsideDag,
+  PolicyTargetCountNotPositive,
+  AssignmentOmitsModule,
+  AssignmentNamesModuleOutsideDag,
+  PartitionRustAdmissibilityRefused,
+  PartitionEmittedEdgeRefused,
+  Stage0FoundationCrate,
+  Stage0LayeredCoreCrate,
+  Stage0PartitionCrateRow,
+  UnitDepEdge,
+  DerivedDepPackagesOk,
+  DerivedDepPackagesUnitHasNoRow,
+  derived_dep_packages,
+  unit_dep_closure,
+  unit_direct_deps,
+  CompilationUnitId,
+  ModuleDagEdge,
+  ModuleId,
+  list_unique_sorted_ids,
+  EmittedEdgesMerged,
+  EmittedEdgesRefused,
+  assignment_unit_dep_edges_over,
+  crate_partition_declared_core_target,
+  merge_emitted_edges,
+  resolve_partition_over,
+  EmittedEdgesMerge
+}
+
+import std.types { List, String, Bool, Int, NonEmptyStr }
+import std.optional { Absent, Optional, Present, optional_present }
+import extdeps.cargo { Bin, cargo_target_source_path }
+import gunbc.rust_emitted_edge {
+  EmittedEdge,
+  EmittedModuleTarget,
+  EmittedCrateRootTarget,
+  RuntimePrelude,
+  ReexportFacade,
+  SemanticSourceReference,
+  DeclaredImport,
+  InlinePathReference,
+  ServiceRuntimeSurface,
+  rust_module_emit_filename,
+  rust_runtime_prelude_module
+}
+import gunbc.stage0_crate_partition_generated {
+  GeneratedPartitionCrateRow,
+  GeneratedFoundationCrate,
+  GeneratedLayeredCoreCrate,
+  GeneratedFacadeCrate
+}
+
+// THE EMITTED COMPILER CLOSURE AS A CARGO WORKSPACE, DERIVED (Pkg7d render, Pkg7e build).
+//
+// Every fact here is derived from the EMISSION, and none is read from the committed stage0 rows or
+// from a corpus: the module graph is the emitted basenames with their source edges -- declared
+// imports and inline paths (emitted_workspace_merged_edges); the emitter's other edges
+// (gunbc.rust_emitted_edge, returned beside the text) are merged against them with the typed
+// reverse-edge refusal; the balanced policy
+// assigns modules to units; and each unit's dependency packages are the TRANSITIVE CLOSURE of the
+// unit dep edges the assignment induces (gunbc.crate_partition derived_dep_packages, the #12035
+// derivation). The rows produced here have the shape v1.compiler.stage0_crates renders, so the
+// manifests and lib.rs files come from the one partition renderer, not a second one. The plan is
+// pure over its arguments, which is what lets the seed call it compiled (v1.compiler.emitted_workspace)
+// rather than interpret it over a source tree on every emission.
+//
+// WHAT THE FACADE PROVES AND WHAT IT DOES NOT. A layered crate's lib.rs re-exports every package in
+// its transitive dependency closure as `pub use <ident>::*;`, which is how an emitted
+// `crate::<module>::` path resolves in a crate that does not own the module. That is an
+// OVER-APPROXIMATION of the direct edges: re-exporting only direct dependencies is the next rung
+// (gunbc.guarantee_stall emitted_inline_crate_path_edges_unreturned_stall). The plan reports
+// whether the facade degenerates to the whole closure (facade_is_whole_closure) so a green over that
+// degenerate case is never read as a partition.
+
+type EmittedWorkspaceRefusal
+  = EmittedWorkspaceEdgeMergeRefused { cause: EmittedEdgeRefusal }
+  | EmittedWorkspacePartitionRefused { cause: ResolvePartitionRefusalCause }
+  | EmittedWorkspaceUnitHasNoRow { unit_id: CompilationUnitId }
+  | EmittedWorkspaceNoDiscriminatingEdge
+
+// The one crate dependency the RED drops: a direct unit dep edge in the TRANSITIVE REDUCTION (no
+// other dependency of the source crate reaches the target, so no glob facade can re-export it by
+// another road) that the emitter also wrote as a use-line from a source-crate module into a
+// target-crate module, so rustc has a path that must stop resolving.
+type EmittedWorkspaceRedDrop {
+  package: String
+  dropped_package: String
+  from_module: String
+  to_module: String
+}
+
+// The layout is the production fact; the RED is the instrument's discriminator over it. A closure
+// with one module-bearing crate has no cross-crate edge to drop, so `red` is Absent there and the
+// layout is still a valid workspace. Only `emitted_workspace_red_over` refuses that absence.
+type EmittedWorkspacePlan {
+  rows: List<GeneratedPartitionCrateRow>
+  red: Optional<EmittedWorkspaceRedDrop>
+  module_count: Int
+  crate_count: Int
+  facade_is_whole_closure: Bool
+}
+
+type EmittedWorkspaceRedOutcome
+  = EmittedWorkspaceRedPlanned { red: EmittedWorkspaceRedDrop, red_rows: List<GeneratedPartitionCrateRow> }
+  | EmittedWorkspaceRedRefused { cause: EmittedWorkspaceRefusal }
+
+// The instrument's RED: the layout with one irredundant crate dependency dropped. Refuses when the
+// layout has no cross-crate edge rustc must stop resolving.
+fn emitted_workspace_red_over(plan: EmittedWorkspacePlan) -> EmittedWorkspaceRedOutcome {
+  match plan.red {
+    Absent => EmittedWorkspaceRedRefused { cause: EmittedWorkspaceNoDiscriminatingEdge }
+    Present { value: red } => EmittedWorkspaceRedPlanned { red: red, red_rows: emitted_workspace_red_rows(rows: plan.rows, red: red) }
+  }
+}
+
+type EmittedWorkspaceOutcome
+  = EmittedWorkspacePlanned { plan: EmittedWorkspacePlan }
+  | EmittedWorkspaceRefused { cause: EmittedWorkspaceRefusal }
+
+data emitted_workspace_runtime_package: String = "v2-emitted-runtime"
+
+// The module graph an emission partitions over: its module basenames and source edges.
+type EmittedModuleGraph {
+  modules: List<ModuleId>
+  edges: List<ModuleDagEdge>
+}
+
+fn emitted_workspace_package(unit_id: CompilationUnitId) -> String {
+  concat("v2-emitted-", unit_id as String)
+}
+
+fn emitted_workspace_crate_dir(package: String) -> String {
+  concat("src/v1/", package)
+}
+
+fn emitted_workspace_lookup(m: Map<String, String>, key: String) -> Optional<String> {
+  map_get(m, key)
+}
+
+// The runtime is a FIXED foundation crate every unit depends on, so the policy partitions the
+// closure without it: an edge into the runtime is a dependency on the runtime package, never a
+// reason to place a closure module beside it.
+fn emitted_workspace_without_runtime(graph: EmittedModuleGraph) -> EmittedModuleGraph {
+  EmittedModuleGraph {
+    modules: graph.modules |> filter(m => (m as String) != rust_runtime_prelude_module),
+    edges: graph.edges |> filter(e => (e.from as String) != rust_runtime_prelude_module && (e.to as String) != rust_runtime_prelude_module)
+  }
+}
+
+fn emitted_workspace_unit_rows(modules: List<ModuleId>, assignment: Map<ModuleId, CompilationUnitId>, unit_ids: List<CompilationUnitId>) -> List<Stage0PartitionCrateRow> {
+  unit_ids |> map(unit_id => {
+    let package = emitted_workspace_package(unit_id: unit_id)
+    Stage0PartitionCrateRow {
+      unit_id: unit_id,
+      package_name: package,
+      crate_dir: emitted_workspace_crate_dir(package: package),
+      kind: Stage0LayeredCoreCrate,
+      modules: modules |> filter(m => match map_get(assignment, m) {
+          Present { value: u } => u == unit_id
+          Absent => false
+        }) |> map(m => m as String) |> sort_by(m => m),
+      reexport_packages: [],
+      carries_non_empty_wrappers: false
+    }
+  })
+}
+
+fn emitted_workspace_generated_row(row: Stage0PartitionCrateRow, reexports: List<String>) -> GeneratedPartitionCrateRow {
+  GeneratedPartitionCrateRow {
+    package_name: row.package_name,
+    crate_dir: row.crate_dir,
+    kind: GeneratedLayeredCoreCrate,
+    modules: row.modules,
+    reexport_packages: reexports,
+    carries_non_empty_wrappers: false
+  }
+}
+
+fn emitted_workspace_runtime_row() -> GeneratedPartitionCrateRow {
+  GeneratedPartitionCrateRow {
+    package_name: emitted_workspace_runtime_package,
+    crate_dir: emitted_workspace_crate_dir(package: emitted_workspace_runtime_package),
+    kind: GeneratedFoundationCrate,
+    modules: [rust_runtime_prelude_module],
+    reexport_packages: [],
+    carries_non_empty_wrappers: true
+  }
+}
+
+type DerivedRowsBuild
+  = DerivedRowsOk { rows: List<GeneratedPartitionCrateRow> }
+  | DerivedRowsRefused { cause: EmittedWorkspaceRefusal }
+
+fn emitted_workspace_derived_rows(unit_rows: List<Stage0PartitionCrateRow>, unit_edges: List<UnitDepEdge>) -> DerivedRowsBuild {
+  unit_rows |> fold(init: DerivedRowsOk { rows: [emitted_workspace_runtime_row()] }, f: fn(acc, row) {
+    match acc {
+      DerivedRowsRefused { cause: c } => DerivedRowsRefused { cause: c }
+      DerivedRowsOk { rows: rows } =>
+        match derived_dep_packages(edges: unit_edges, rows: unit_rows, row: row) {
+          DerivedDepPackagesUnitHasNoRow { unit_id: u } => DerivedRowsRefused { cause: EmittedWorkspaceUnitHasNoRow { unit_id: u } }
+          DerivedDepPackagesOk { packages: packages } =>
+            DerivedRowsOk {
+              rows: rows |> list_push(emitted_workspace_generated_row(
+                row: row,
+                reexports: concat([emitted_workspace_runtime_package], packages |> sort_by(p => p))
+              ))
+            }
+        }
+    }
+  })
+}
+
+fn emitted_workspace_unit_of(assignment: Map<ModuleId, CompilationUnitId>, module: String) -> Optional<CompilationUnitId> {
+  map_get(assignment, module as ModuleId)
+}
+
+// An edge (from_unit -> to_unit) of the unit graph is in the TRANSITIVE REDUCTION when no OTHER
+// direct dependency of from_unit reaches to_unit. Only such an edge can be dropped without another
+// crate's glob facade re-exporting the target by a second road.
+fn emitted_workspace_edge_is_irredundant(unit_edges: List<UnitDepEdge>, from_unit: CompilationUnitId, to_unit: CompilationUnitId) -> Bool {
+  let others = unit_direct_deps(edges: unit_edges, unit_id: from_unit) |> filter(d => d != to_unit)
+  !(unit_dep_closure(edges: unit_edges, acc: others, fuel: (unit_edges |> count) + 1) |> any(u => u == to_unit))
+}
+
+fn emitted_workspace_red(
+  edges: List<EmittedEdge>,
+  assignment: Map<ModuleId, CompilationUnitId>,
+  unit_edges: List<UnitDepEdge>
+) -> Optional<EmittedWorkspaceRedDrop> {
+  edges |> fold(init: Absent, f: fn(acc, edge) {
+    match acc {
+      Present { value: _ } => acc
+      Absent =>
+        match edge.provenance {
+          SemanticSourceReference =>
+            match edge.to {
+              EmittedCrateRootTarget => Absent
+              EmittedModuleTarget { module: to_module } =>
+                match emitted_workspace_unit_of(assignment: assignment, module: edge.from) {
+                  Absent => Absent
+                  Present { value: from_unit } =>
+                    match emitted_workspace_unit_of(assignment: assignment, module: to_module) {
+                      Absent => Absent
+                      Present { value: to_unit } =>
+                        if from_unit != to_unit && emitted_workspace_edge_is_irredundant(unit_edges: unit_edges, from_unit: from_unit, to_unit: to_unit) {
+                          optional_present(
+                            value: EmittedWorkspaceRedDrop {
+                              package: emitted_workspace_package(unit_id: from_unit),
+                              dropped_package: emitted_workspace_package(unit_id: to_unit),
+                              from_module: edge.from,
+                              to_module: to_module
+                            }
+                          )
+                        } else { Absent }
+                    }
+                }
+            }
+          RuntimePrelude => Absent
+          ReexportFacade => Absent
+          DeclaredImport => Absent
+          InlinePathReference => Absent
+          ServiceRuntimeSurface => Absent
+        }
+    }
+  })
+}
+
+fn emitted_workspace_red_rows(rows: List<GeneratedPartitionCrateRow>, red: EmittedWorkspaceRedDrop) -> List<GeneratedPartitionCrateRow> {
+  rows |> map(row =>
+    if row.package_name == red.package {
+      GeneratedPartitionCrateRow {
+        package_name: row.package_name,
+        crate_dir: row.crate_dir,
+        kind: row.kind,
+        modules: row.modules,
+        reexport_packages: row.reexport_packages |> filter(p => p != red.dropped_package),
+        carries_non_empty_wrappers: row.carries_non_empty_wrappers
+      }
+    } else { row }
+  )
+}
+
+fn emitted_workspace_facade_is_whole_closure(rows: List<GeneratedPartitionCrateRow>) -> Bool {
+  let layered = rows |> filter(r => r.package_name != emitted_workspace_runtime_package)
+  layered |> all(r => (r.reexport_packages |> count) == (rows |> count) - 1)
+}
+
+// THE SOURCE EDGES OF AN EMISSION are its declared imports and the inline paths its renderers wrote
+// for resolved references (gunbc.rust_emitted_edge DeclaredImport, InlinePathReference); every
+// other returned edge is the emitter's.
+fn emitted_workspace_is_source_edge(edge: EmittedEdge) -> Bool {
+  match edge.provenance {
+    DeclaredImport => true
+    InlinePathReference => true
+    RuntimePrelude => false
+    ReexportFacade => false
+    SemanticSourceReference => false
+    ServiceRuntimeSurface => false
+  }
+}
+
+// The modules an emission partitions over are the basenames it wrote; its edges are merged in by
+// emitted_workspace_merged_edges.
+fn emitted_workspace_emission_graph(emitted_basenames: List<String>) -> EmittedModuleGraph {
+  EmittedModuleGraph { modules: emitted_basenames |> map(b => b as ModuleId), edges: [] }
+}
+
+// THE PRODUCTION PLAN: the layout of ANY emission, read from the emission alone -- its module
+// basenames and its returned edges -- with no corpus scan, so a fixture's virtual closure and the
+// emitted compiler partition by one route.
+fn emitted_workspace_plan_from_emission(
+  emitted_basenames: List<String>,
+  edges: List<EmittedEdge>,
+  target_crate_count: Int
+) -> EmittedWorkspaceOutcome {
+  emitted_workspace_plan_over_graph(
+    graph: emitted_workspace_emission_graph(emitted_basenames: emitted_basenames),
+    edges: edges,
+    target_crate_count: target_crate_count
+  )
+}
+
+// THE BUILDABLE WORKSPACE OF AN EMISSION: its layout plus the TOP PACKAGE the emitted main paths
+// through. The emitter names that package (gunbc.rust_emitted_crate EmittedRustCrate crate_name)
+// and its main.rs reaches the library as `<crate_name>::<module>::`, so the top package is a
+// facade (v1.compiler.stage0_crates render_partition_facade_lib_outcome) over every module of the layout -- `pub mod m { pub use <owner>::m::*; }` --
+// and the binary is a target of that package, at the workspace root. The registry dependencies are not the plan's: they
+// are the emission's demand (v1.compiler.stage0_crates emitted_crate_dependencies), which the
+// renderer reads straight from the emission. The binary's name is the caller's (one target
+// directory serves several entries, so each names its own), and its source path is Cargo's
+// convention for that name (extdeps.cargo cargo_target_source_path), never a path chosen here.
+type EmittedWorkspaceBuild {
+  layout: EmittedWorkspacePlan
+  rows: List<GeneratedPartitionCrateRow>
+  top_package: String
+  bin_name: String
+  bin_source_path: String
+}
+
+type EmittedWorkspaceBuildOutcome
+  = EmittedWorkspaceBuildPlanned { build: EmittedWorkspaceBuild }
+  | EmittedWorkspaceBuildRefused { cause: EmittedWorkspaceRefusal }
+
+// THE TOP PACKAGE IS THE WORKSPACE ROOT. A reader of an emitted workspace -- a harness appending its
+// own targets, a build reading the binary -- finds the package the emitted main paths through
+// where a single crate used to be: Cargo.toml, src/lib.rs and src/main.rs at the root, with the
+// partition crates beneath it under src/v1/.
+data emitted_workspace_root_crate_dir: String = "."
+
+fn emitted_workspace_top_row(crate_name: String, layout_rows: List<GeneratedPartitionCrateRow>) -> GeneratedPartitionCrateRow {
+  GeneratedPartitionCrateRow {
+    package_name: crate_name,
+    crate_dir: emitted_workspace_root_crate_dir,
+    kind: GeneratedFacadeCrate,
+    modules: layout_rows |> flat_map(r => r.modules),
+    reexport_packages: [],
+    carries_non_empty_wrappers: false
+  }
+}
+
+fn emitted_workspace_build_from_emission(
+  emitted_basenames: List<String>,
+  edges: List<EmittedEdge>,
+  target_crate_count: Int,
+  crate_name: String,
+  bin_name: String
+) -> EmittedWorkspaceBuildOutcome {
+  match emitted_workspace_plan_from_emission(
+    emitted_basenames: emitted_basenames,
+    edges: edges,
+    target_crate_count: target_crate_count
+  ) {
+    EmittedWorkspaceRefused { cause: c } => EmittedWorkspaceBuildRefused { cause: c }
+    EmittedWorkspacePlanned { plan: layout } => {
+      let top = emitted_workspace_top_row(crate_name: crate_name, layout_rows: layout.rows)
+      EmittedWorkspaceBuildPlanned {
+        build: EmittedWorkspaceBuild {
+          layout: layout,
+          rows: concat(layout.rows, [top]),
+          top_package: crate_name,
+          bin_name: bin_name,
+          bin_source_path: cargo_target_source_path(target: Bin { name: bin_name }, package_name: crate_name).segments |> join(separator: "/")
+        }
+      }
+    }
+  }
+}
+
+// The source edges seed the graph through the same merge -- over no prior edges, so every endpoint
+// is still checked and a source edge to a module the emission did not write refuses -- and the
+// EMITTER's edges then merge against them, so a source SCC is never judged as a reversed emitter
+// edge against its own other half.
+fn emitted_workspace_merged_edges(graph: EmittedModuleGraph, edges: List<EmittedEdge>) -> EmittedEdgesMerge {
+  match merge_emitted_edges(modules: graph.modules, edges: [], emitted: edges |> filter(e => emitted_workspace_is_source_edge(edge: e))) {
+    EmittedEdgesRefused { cause: c } => EmittedEdgesRefused { cause: c }
+    EmittedEdgesMerged { edges: source_edges } =>
+      merge_emitted_edges(modules: graph.modules, edges: source_edges, emitted: edges |> filter(e => !emitted_workspace_is_source_edge(edge: e)))
+  }
+}
+
+fn emitted_workspace_plan_over_graph(
+  graph: EmittedModuleGraph,
+  edges: List<EmittedEdge>,
+  target_crate_count: Int
+) -> EmittedWorkspaceOutcome {
+  match emitted_workspace_merged_edges(graph: graph, edges: edges) {
+    EmittedEdgesRefused { cause: c } => EmittedWorkspaceRefused { cause: EmittedWorkspaceEdgeMergeRefused { cause: c } }
+    EmittedEdgesMerged { edges: merged_edges } => {
+      let closure = emitted_workspace_without_runtime(graph: EmittedModuleGraph { modules: graph.modules, edges: merged_edges })
+      match resolve_partition_over(
+        parameter: PolicyPartitionParam { policy: PartitionPolicy { target_crate_count: target_crate_count } },
+        modules: closure.modules,
+        edges: closure.edges
+      ) {
+        ResolvePartitionRefused { cause: c } => EmittedWorkspaceRefused { cause: EmittedWorkspacePartitionRefused { cause: c } }
+        ResolvePartitionOk { assignment: assignment, provenance: _ } => {
+          let unit_ids = list_unique_sorted_ids(items: map_values(assignment))
+          let unit_edges = assignment_unit_dep_edges_over(edges: closure.edges, assignment: assignment)
+          match emitted_workspace_derived_rows(unit_rows: emitted_workspace_unit_rows(modules: closure.modules, assignment: assignment, unit_ids: unit_ids), unit_edges: unit_edges) {
+            DerivedRowsRefused { cause: c } => EmittedWorkspaceRefused { cause: c }
+            DerivedRowsOk { rows: rows } =>
+              EmittedWorkspacePlanned {
+                plan: EmittedWorkspacePlan {
+                  rows: rows,
+                  red: emitted_workspace_red(edges: edges, assignment: assignment, unit_edges: unit_edges),
+                  module_count: closure.modules |> count,
+                  crate_count: rows |> count,
+                  facade_is_whole_closure: emitted_workspace_facade_is_whole_closure(rows: rows)
+                }
+              }
+          }
+        }
+      }
+    }
+  }
+}
+
+// THE BUILD ENTRY every emitted-Rust route calls: an emission's workspace at the declared core
+// target. A closure smaller than the target packs into fewer crates; one module is one crate.
+fn emitted_workspace_build(
+  emitted_basenames: List<String>,
+  edges: List<EmittedEdge>,
+  crate_name: String,
+  bin_name: String
+) -> EmittedWorkspaceBuildOutcome {
+  emitted_workspace_build_from_emission(
+    emitted_basenames: emitted_basenames,
+    edges: edges,
+    target_crate_count: crate_partition_declared_core_target,
+    crate_name: crate_name,
+    bin_name: bin_name
+  )
+}
+
+// A refusal as the one line a writer reports. Each arm names its members, so the line says which
+// module or edge to look at; the nested admissibility cause is named by its own arm.
+fn emitted_workspace_edge_refusal_message(cause: EmittedEdgeRefusal) -> String {
+  match cause {
+    EmitterReverseEdge { from: f, to: t, provenance: _ } => concat("EmitterReverseEdge ", f as String, " -> ", t as String)
+    EmittedEdgeEndpointOutsideDag { from: f, to: t } => concat("EmittedEdgeEndpointOutsideDag ", f, " -> ", t)
+  }
+}
+
+fn emitted_workspace_refusal_message(cause: EmittedWorkspaceRefusal) -> String {
+  match cause {
+    EmittedWorkspaceEdgeMergeRefused { cause: c } => emitted_workspace_edge_refusal_message(cause: c)
+    EmittedWorkspacePartitionRefused { cause: c } =>
+      match c {
+        PolicyTargetCountNotPositive { policy: _ } => "PolicyTargetCountNotPositive"
+        AssignmentOmitsModule { module_id: m } => concat("AssignmentOmitsModule ", m as String)
+        AssignmentNamesModuleOutsideDag { module_id: m } => concat("AssignmentNamesModuleOutsideDag ", m as String)
+        PartitionRustAdmissibilityRefused { cause: _ } => "PartitionRustAdmissibilityRefused"
+        PartitionEmittedEdgeRefused { cause: e } => emitted_workspace_edge_refusal_message(cause: e)
+      }
+    EmittedWorkspaceUnitHasNoRow { unit_id: u } => concat("UnitHasNoRow ", u as String)
+    EmittedWorkspaceNoDiscriminatingEdge => "NoDiscriminatingEdge"
+  }
+}
diff --git a/dag/gunbc/emitted_crate_workspace_seed_growth.dag b/dag/gunbc/emitted_crate_workspace_seed_growth.dag
index a75a1ca7a47..36767458c4e 100644
--- a/dag/gunbc/emitted_crate_workspace_seed_growth.dag
+++ b/dag/gunbc/emitted_crate_workspace_seed_growth.dag
@@ -7,27 +7,19 @@ import std.decl_ref { DeclarationRef, WholeDeclaration }
 data emitted_crate_workspace_seed_growth_justification: SeedGrowthJustification = SeedGrowthJustification {
   hand_authored_declarations: [
     DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "WORKSPACE_ENTRY", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "PLAN_MODULE", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "EmittedCrateWorkspaceHeld", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "PlanRows", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "refusal", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "field", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "as_str", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "as_int", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "as_bool", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "as_str_list", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "str_list", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "row_from_value", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "rows_from_value", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "evaluate_plan", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "write_workspace", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "write_files", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "git_head", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "run_emitted_crate_workspace", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "EmittedWorkspace", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "realize", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emitted_crate_workspace_host", decl_name: "write_emitted_workspace", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "run_emitted_crate_workspace", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "emitted_crate_workspace_source_roots", field: WholeDeclaration }
   ],
-  reason: "The Pkg7e instrument //gunbc/instruments:emitted-crate-workspace (gunbc#12214). Every partition decision is modeled: v2.workflow.emitted_crate_workspace emitted_workspace_plan derives the crate rows, the dependency packages and the dropped RED edge, and v1.compiler.stage0_crates partition_crate_boundary_emit_outcome_over renders manifests and lib.rs files. What stays in host Rust is the effect boundary the interpreter cannot perform -- the in-process seed emission of v2.compiler.compile, file writes, git rev-parse for the receipt head, and two cargo runs through the existing emitted_closure_compile_host -- plus the TRANSPORT of values across it: the emission's basenames and edges into the plan as interpreter lists, and the plan's rows back out as GeneratedPartitionCrateRow structs (field, as_str, as_int, as_bool, as_str_list, str_list, row_from_value, rows_from_value). That transport carries no decision: an unexpected shape refuses PlanShapeUnexpected rather than defaulting. Admitted by purpose under gunbc.v1_maintenance_standing v1_seed_standing: it is the build that proves the emitted v2 compiler partitions into crates. It is an instrument, run by author invocation, not a required phase; the plan's refusals are gated separately through test.claim.emitted_crate_workspace_witness. Classified against the refused classes: no language behavior, no compatibility obligation, no escape hatch (every arm refuses typed), no seed feature (the seed compiles what it compiled), and no public surface beyond the one cli_run re-export of the runner and its receipt struct.",
+  reason: "The partitioned Cargo workspace every emitted-Rust route writes, and the Pkg7e instrument //gunbc/instruments:emitted-crate-workspace (gunbc#12214) that discriminates it. write_emitted_workspace is the one writer the probe crate route (emitted_closure_compile_host write_probe_crate), the fixture route, the v2-native lane and gunbc compile --target rust call. Every workspace decision is modeled and called COMPILED: v1.compiler.emitted_workspace emitted_workspace_realization places every emitted file and returns the workspace's complete file population, composing gunbc.emitted_crate_workspace emitted_workspace_build (the layout, from the emission alone) with v1.compiler.stage0_crates partition_crate_boundary_emit_outcome_over (manifests and crate roots, with the emission's own registry dependencies). Calling it compiled rather than interpreted is the operator ruling of 2026-10-08 on gunbc#13597: the planner and its v2 closure are stage0 mirrors, which is the seed's first v1-to-v2 import, admitted because laying out an emission must read no source tree (an interpreted planner made gunbc compile depend on the caller's working directory holding gunbc's own sources, and cost a corpus index per emission). It replaces the single-package probe_manifest adapter, which is deleted. What stays in host Rust is the effect boundary: the in-process seed emission of v2.compiler.compile, file writes, git rev-parse for the receipt head, and two cargo runs through the existing emitted_closure_compile_host. Admitted by purpose under gunbc.v1_maintenance_standing v1_seed_standing: it is the build that proves the emitted v2 compiler partitions into crates. The instrument is run by author invocation, not a required phase; the plan's refusals are gated separately through test.claim.emitted_crate_workspace_witness. Classified against the refused classes: no language behavior, no compatibility obligation, no escape hatch (every arm refuses typed), no seed feature (the seed compiles what it compiled), and public surface limited to the cli_run re-exports of the runner, its receipt struct, and write_emitted_workspace with its EmittedWorkspace result, which the gunbc binary's compile output writer calls across the library boundary.",
   owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
-  trigger: "Delete this host module when host-effect emission lets the instrument be a .dag fold end to end: the emission, the workspace writes and the two cargo runs are emitted realizations of modeled effects (the capability gunbc.source_root_eval_driver_seed_growth names for its own shim -- the rendered main becoming one call into the fold), sufficient for the plan's rows to reach the renderer and the build as values inside one evaluated program, so no interpreter-value transport or hand effect sequencing remains. Preserve the green build, the attributed dropped-dependency RED and the typed plan refusals at that replacement boundary.",
-  current_boundary: "Host only: emitted_crate_workspace_host.rs (wired by mod in cli_run.rs, one pub use of run_emitted_crate_workspace and EmittedCrateWorkspaceHeld) and one registry row plus dispatch arm in target_invocation_host.rs. It calls existing seed producers (compile_entry_emission, lane_emit_compile_probe_root, probe_cargo_invocation, run_cargo, make_eval_context) and adds none. No generated mirror is hand-edited; the stage0_crates generalization it renders through is .dag with regenerated mirrors."
+  trigger: "Delete this host module when host-effect emission lets the instrument be a .dag fold end to end: the emission, the workspace writes and the two cargo runs are emitted realizations of modeled effects (the capability gunbc.source_root_eval_driver_seed_growth names for its own shim -- the rendered main becoming one call into the fold), sufficient for the plan's rows to reach the renderer and the build as values inside one evaluated program, so no hand effect sequencing remains. Preserve the green build, the attributed dropped-dependency RED and the typed plan refusals at that replacement boundary.",
+  current_boundary: "Host only: emitted_crate_workspace_host.rs (wired by mod in cli_run.rs, pub uses of run_emitted_crate_workspace, EmittedCrateWorkspaceHeld, write_emitted_workspace and EmittedWorkspace) and one registry row plus dispatch arm in target_invocation_host.rs. The host writes the files the compiled realization returns and runs cargo; it decodes no interpreter values. It calls existing seed producers (compile_entry_emission, lane_emit_compile_probe_root, probe_cargo_invocation, run_cargo) and adds none. No generated mirror is hand-edited."
 }
diff --git a/dag/gunbc/emitted_subject_build_gate.dag b/dag/gunbc/emitted_subject_build_gate.dag
index eeca6b0d7a6..c2abb19a47c 100644
--- a/dag/gunbc/emitted_subject_build_gate.dag
+++ b/dag/gunbc/emitted_subject_build_gate.dag
@@ -3,10 +3,17 @@ module gunbc.emitted_subject_build_gate
 import std.types { Bool, String, List }
 import v2.std.algebra { list_map }
 import std.algebra { list_append }
+import std.measure { ByteSize, byte_size, byte_size_count }
+import std.realization_width { byte_size_saturating_sub }
 import extdeps.bazel.label { Label, render_label }
 import extdeps.exec.command { ArgvCommand }
 import gunbc.gunbc_cli_command { gunbc_test_command }
 import gunbc.instrument_targets { self_host_label, v2_native_cli_label }
+import gunbc.runner_slot_desired {
+  gunbc_runner_slot_desired,
+  SlotJobCgroupOwnership, JobOwnsNoBoundedCgroup, JobOwnsBoundedCgroup,
+}
+import gunbc.memory_envelope { memory_envelope_slot_requirement_value }
 
 // THE SUBJECT OF THE REQUIRED EMIT-AND-BUILD LANE, AND WHAT IT IS CAREFULLY NOT.
 //
@@ -19,13 +26,14 @@ import gunbc.instrument_targets { self_host_label, v2_native_cli_label }
 // in for a compile. Those controls are the instruments' own and are not restated here; this module
 // decides only WHICH subjects the required lane runs and with what argv.
 //
-// WHAT ITS RED DISCRIMINATES THAT NO EXISTING REQUIRED LANE DOES, which is the question
-// gunbc.compiler_gate_workflow's roster header requires an author to answer before proposing a
-// lane. Every required lane today reads the corpus through the INTERPRETER or through the SEED's
-// own Rust: the floor evaluates witnesses, the generated lane lints hand-written and stage0-mirrored
-// Rust and regenerates the stage0 mirrors, and both build the seed binary. NOTHING ON THE MERGE
-// PATH EMITS A V2 CLOSURE AND COMPILES THE RESULT. So a defect that is invisible under evaluation
-// and fatal under emission reaches main green. That is not a hypothesis: `gunbc.recurring_failure_mode`
+// WHAT ITS RED DISCRIMINATES, AND WHY IT LANDED BESIDE LANES THAT ALREADY READ THE CORPUS. Every
+// other required lane of that day read the corpus through the INTERPRETER or through the SEED's own
+// Rust: the floor evaluated witnesses, the generated lane linted hand-written and stage0-mirrored
+// Rust and regenerated the stage0 mirrors, and both built the seed binary. NOTHING ON THE MERGE
+// PATH EMITTED A V2 CLOSURE AND COMPILED THE RESULT, so a defect invisible under evaluation and
+// fatal under emission reached main green. Those lanes were withdrawn on 2026-10-09 and this is now
+// the only required lane (gunbc.compiler_gate_workflow header); the argument below is why it is the
+// one that was kept. That is not a hypothesis: `gunbc.recurring_failure_mode`
 // `bounded_natural_arithmetic_evaluated_as_unbounded_int` records it in as many words -- rows over
 // `UInt8` typecheck and their witnesses evaluate, "their emitted Rust is produced by nothing on the
 // merge path" -- and BOTH retained subjects refused on it at once, because `std.integer` is in every
@@ -103,6 +111,105 @@ data native_fault_experiment_env_name: String = "GUNBC_NATIVE_FAULT_EXPERIMENT"
 data native_fault_experiment_skip_value: String = "skip_pull_request"
 data native_fault_experiment_run_value: String = "run"
 
+// THE REQUIRED JOB EMITS AND BUILDS BOTH PRODUCTS FRESH (operator ruling 2026-10-09: "this version
+// requires fresh emission/build of both retained products and refuses a restored final-product
+// hit. Ordinary Cargo reuse may remain"). The workflow passes this input on every subject step;
+// native_lane_runner reads it and, under `fresh`, consults no native product store and commits
+// nothing -- and REFUSES a run that also binds a store root, because an invocation asking for a
+// fresh product while offering a store to serve it from is a contradiction, not a miss. The store
+// steps (job-private root, the two federations, the save) left the required job with this ruling;
+// cargo's own dependency reuse inside the job's checkout is untouched.
+data native_product_reuse_env_name: String = "GUNBC_NATIVE_PRODUCT_REUSE"
+data native_product_reuse_fresh_value: String = "fresh"
+
+// THE MEMORY ENVELOPE OF A SUBJECT STEP (operator ruling 2026-10-09: "MemorySwapMax=0 and a fixed
+// hard memory maximum; a lower compiler abort/trip threshold; a peak and swap receipt; no larger-
+// runner retry"). The fleet slot is the fixed hard maximum and the ONE authority for its numbers
+// (gunbc.runner_slot_desired: MemoryMax, MemoryHigh one GiB under it, no swap). Two inputs carry
+// the envelope to gunbc test, and which of them a subject step passes is decided by ONE fleet fact
+// (native_step_memory_inputs over gunbc.runner_slot_desired gunbc_runner_slot_job_cgroup_ownership):
+//
+// 1. native_step_memory_envelope_env_name REQUIRES an envelope; its one value is the projection of
+//    gunbc.memory_envelope EnvelopeSlotRequired: a cgroup with a NUMERIC memory.max must already
+//    bind the step -- the fleet slot's -- and gunbc test refuses a run that none binds
+//    (memory_envelope_decision over the governor's binding_cap_cgroup_dir walk, which reads `max`
+//    as unset), reads that cgroup before the producer, prints a MEMORY RECEIPT at exit (the OOM
+//    kills and high/max events the step added, swap resident at exit, whether the swap peak rose,
+//    the slot's memory.swap.max, the peak) and REFUSES the run on any OOM kill or any swap
+//    (memory_envelope_verdict), whatever the producer answered. Every subject step passes it: a
+//    required step that cannot say what bounded it is not the measurement the gate names.
+// 2. native_step_memory_bind_env_name asks gunbc test to bind the step's OWN cgroup at the TRIP
+//    (memory_governor BIND_MEMORY_CGROUP_ENV, the bind claim_executor already takes), so a product
+//    build that outgrows the envelope trips inside the step -- exit 137 -- before the slot's
+//    throttle line, with a receipt at the step's own grain. THE TRIP IS DERIVED, NOT AUTHORED: it
+//    is the slot's MemoryHigh less the headroom declared here, so this module states only how far
+//    under the throttle line the compiler trips, a slot change moves the trip with it, and a step
+//    cannot be bound above the slot that holds it. The required steps pass this input ONLY WHERE A
+//    JOB OWNS A BOUNDED CGROUP: today a fleet job runs as the deprivileged job user under a root
+//    unit and the governor creates its leaf at the cgroup root, so the first required run that
+//    asked refused in four seconds (run 38002497388, MemoryCgroupBindRefused). That fact is the
+//    slot row's gunbc_runner_slot_job_cgroup_ownership; the climb it blocks is rostered as
+//    gunbc.guarantee_stall native_step_trip_awaits_fleet_job_cgroup_stall; and flipping the fact
+//    when the fleet earns it puts the bind back on every subject step with no other edit.
+//
+// There is no larger runner and no retry: a trip, at either grain, is the line stopping.
+data native_step_memory_envelope_env_name: String = "GUNBC_MEMORY_ENVELOPE_REQUIRED"
+data native_step_memory_envelope_slot_value: String = memory_envelope_slot_requirement_value()
+data native_step_memory_bind_env_name: String = "GUNBC_BIND_MEMORY_CGROUP_BYTES"
+data native_step_memory_headroom: ByteSize = byte_size(1073741824)
+
+fn native_step_memory_trip() -> ByteSize {
+  let slot = gunbc_runner_slot_desired()
+  byte_size_saturating_sub(total: slot.memory_high, reserved: native_step_memory_headroom)
+}
+
+fn native_step_memory_trip_text() -> String {
+  to_string(byte_size_count(b: native_step_memory_trip()))
+}
+
+fn slot_memory_max_text() -> String {
+  to_string(byte_size_count(b: gunbc_runner_slot_desired().memory_max))
+}
+
+// ONE ENVELOPE INPUT OF A SUBJECT STEP: the environment name and the value it carries. The workflow
+// renders these as the step's env rows; the shape is this module's so the decision below owes
+// nothing to YAML.
+type NativeStepMemoryInput {
+  env_name: String
+  env_value: String
+}
+
+// WHICH ENVELOPE INPUTS A SUBJECT STEP PASSES, AS A FUNCTION OF THE FLEET FACT. The fact is a
+// parameter so a claim can exercise both arms by supplying it, and the workflow passes the live
+// row's. A job that owns no bounded cgroup gets the slot requirement alone; a job that does gets
+// the requirement and the bind at the derived trip.
+fn native_step_memory_inputs(ownership: SlotJobCgroupOwnership) -> List<NativeStepMemoryInput> {
+  let required = NativeStepMemoryInput { env_name: native_step_memory_envelope_env_name, env_value: native_step_memory_envelope_slot_value }
+  let bind = NativeStepMemoryInput { env_name: native_step_memory_bind_env_name, env_value: native_step_memory_trip_text() }
+  match ownership {
+    JobOwnsNoBoundedCgroup { why: _ } => [required]
+    JobOwnsBoundedCgroup { staged_by: _ } => [required, bind]
+  }
+}
+
+// THE LINES THE FAILURE NOTICE CARRIES ABOUT THE ENVELOPE, a function of the same fact so the notice
+// cannot outlive it: which grain bounded the step and the input that required it, what the trip is
+// and why it is or is not asked for, the exit code the kernel leaves, and that nothing retries bigger.
+fn emit_build_memory_envelope_lines(ownership: SlotJobCgroupOwnership) -> List<String> {
+  let trip_line = match ownership {
+    JobOwnsNoBoundedCgroup { why: why } =>
+      join(["The per-step trip at ", native_step_memory_trip_text(), " bytes is not asked for: ", why, " (gunbc.runner_slot_desired gunbc_runner_slot_job_cgroup_ownership; the climb is gunbc.guarantee_stall native_step_trip_awaits_fleet_job_cgroup_stall)."], "")
+    JobOwnsBoundedCgroup { staged_by: staged_by } =>
+      join(["This step also asked the kernel for its own bound at ", native_step_memory_trip_text(), " bytes (", staged_by, "), so an exit of 137 may be that trip rather than the slot's."], "")
+  }
+  [
+    join(["This step ran inside the fleet slot's memory envelope (gunbc.runner_slot_desired: MemoryMax ", slot_memory_max_text(), " bytes, no swap once converged), which gunbc test required (", native_step_memory_envelope_env_name, "=", native_step_memory_envelope_slot_value, ") and receipted at exit."], ""),
+    trip_line,
+    "An exit of 137 here is the kernel tripping the envelope's memory.max: the compiler outgrew it. There is no larger runner and no retry; the line stops until the growth is understood (DESIGN section 6b).",
+    "A MEMORY RECEIPT line precedes every successful subject step; a run that charged swap or was OOM-killed is refused even when its instrument held.",
+  ]
+}
+
 fn emitted_subject_build_command(row: EmittedSubjectBuildRow) -> ArgvCommand {
   gunbc_test_command(label: emitted_subject_build_label_text(row: row))
 }
diff --git a/dag/gunbc/executor_privileged_operation.dag b/dag/gunbc/executor_privileged_operation.dag
index 719f871a0b7..a90577f65f6 100644
--- a/dag/gunbc/executor_privileged_operation.dag
+++ b/dag/gunbc/executor_privileged_operation.dag
@@ -23,11 +23,14 @@ import std.disposition { Disposition, Scaffold, SingleAuthority, RealizationDisp
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.sudo.elevation { ElevatedInvocation, sudo_elevate, sudo_elevate_as, sudo_elevate_argv, sudo_elevate_command, sudo_elevate_as_command }
 import extdeps.exec.command { ArgvCommand }
+import extdeps.tools.sha256sum { sha256sum_binary_path }
+import extdeps.crypto.hash { sha256sum_file_command }
 import extdeps.tools.env { env_prefixed_argv }
 import v2.std.orchestration { EnvSet }
 import gunbc.cli_run_workspace_root_scaffold { gunbc_workspace_root_env_name }
 import gunbc.cli_invoke { gunbc_run_invocation_words_with_functions, invocation_words_bare }
 import extdeps.posix.shell_command_language { posix_single_quote }
+import gunbc.owned_directory { owned_directory_stat_format }
 import v2.std.algebra { fold_list }
 import extdeps.github.actions_runner { actions_runner_base_dir, actions_runner_cache_dir }
 import extdeps.systemd.systemctl { systemctl_enable_verb, systemctl_start_verb, systemctl_set_property_verb, systemctl_reload_verb, systemctl_restart_verb }
@@ -42,6 +45,8 @@ import gunbc.fleet_posix_accounts {
   SudoConntrack,
   SudoIptablesLegacySave,
   SudoNfct,
+  SudoStat,
+  SudoLs,
 }
 import extdeps.tools.conntrack { conntrack_list_expectations_arguments }
 import extdeps.nftables.ruleset { nft_list_ruleset_arguments, nft_list_table_arguments_wire }
@@ -82,9 +87,12 @@ type ExecutorPrivilegedOperation
   | SystemdRestartUnit { unit: NonEmptyStr }
   | ReadNftTable { family: NonEmptyStr, table: NonEmptyStr }
   | ReadNftRuleset
+  | ReadFileSha256 { path: NonEmptyStr }
   | ReadConntrackExpectations
   | ReadLegacyXtablesRules
   | ReadUserspaceConntrackHelpers
+  | ReadDirectoryIdentity { path: NonEmptyStr }
+  | ListDirectoryEntries { path: NonEmptyStr }
   | RunGunbcEntryAs {
       run_as: NonEmptyStr
       workspace_root: NonEmptyStr
@@ -196,10 +204,13 @@ fn executor_privileged_operation_argv(op: ExecutorPrivilegedOperation) -> List<N
       systemctl_restart_verb,
       u
     ]
+    ReadFileSha256 { path: p } => concat([sha256sum_binary_path], map(sha256sum_file_command(path: p as String).arguments, word => word as NonEmptyStr))
     ReadNftRuleset => concat([ci_runner_sudo_binary_path(b: SudoNft)], nft_list_ruleset_arguments)
     ReadConntrackExpectations => concat([ci_runner_sudo_binary_path(b: SudoConntrack)], conntrack_list_expectations_arguments)
     ReadLegacyXtablesRules => concat([ci_runner_sudo_binary_path(b: SudoIptablesLegacySave)], iptables_legacy_save_arguments)
     ReadUserspaceConntrackHelpers => concat([ci_runner_sudo_binary_path(b: SudoNfct)], nfct_helper_list_arguments)
+    ReadDirectoryIdentity { path: p } => [ci_runner_sudo_binary_path(b: SudoStat), "-c" as NonEmptyStr, owned_directory_stat_format as NonEmptyStr, "--" as NonEmptyStr, p]
+    ListDirectoryEntries { path: p } => [ci_runner_sudo_binary_path(b: SudoLs), "-1A" as NonEmptyStr, "--" as NonEmptyStr, p]
     ReadNftTable { family: f, table: t } => concat([ci_runner_sudo_binary_path(b: SudoNft)], nft_list_table_arguments_wire(family_wire: f, name: t))
     SystemdDaemonReload => [
       ci_runner_sudo_binary_path(b: SudoSystemctl),
@@ -242,10 +253,13 @@ fn executor_privileged_operation_principal(op: ExecutorPrivilegedOperation) -> O
     SystemdReloadUnit { unit: _ } => RunsAsRoot
     SystemdRestartUnit { unit: _ } => RunsAsRoot
     ReadNftTable { family: _, table: _ } => RunsAsRoot
+    ReadFileSha256 { path: _ } => RunsAsRoot
     ReadNftRuleset => RunsAsRoot
     ReadConntrackExpectations => RunsAsRoot
     ReadLegacyXtablesRules => RunsAsRoot
     ReadUserspaceConntrackHelpers => RunsAsRoot
+    ReadDirectoryIdentity { path: _ } => RunsAsRoot
+    ListDirectoryEntries { path: _ } => RunsAsRoot
   }
 }
 
@@ -474,10 +488,13 @@ fn executor_privileged_operation_precondition(op: ExecutorPrivilegedOperation) -
     SystemdReloadUnit { unit: _ } => NoPrecondition
     SystemdRestartUnit { unit: _ } => NoPrecondition
     ReadNftTable { family: _, table: _ } => NoPrecondition
+    ReadFileSha256 { path: _ } => NoPrecondition
     ReadNftRuleset => NoPrecondition
     ReadConntrackExpectations => NoPrecondition
     ReadLegacyXtablesRules => NoPrecondition
     ReadUserspaceConntrackHelpers => NoPrecondition
+    ReadDirectoryIdentity { path: _ } => NoPrecondition
+    ListDirectoryEntries { path: _ } => NoPrecondition
     RunGunbcEntryAs { run_as: _, workspace_root: _, binary: _, source_roots: _, entry: _, function: _ } => NoPrecondition
   }
 }
diff --git a/dag/gunbc/extdeps_scope_frontier.dag b/dag/gunbc/extdeps_scope_frontier.dag
index 94f0dcdc79a..d2068be5b8d 100644
--- a/dag/gunbc/extdeps_scope_frontier.dag
+++ b/dag/gunbc/extdeps_scope_frontier.dag
@@ -580,6 +580,10 @@ data scope_carrier_paths: List<String> = [
   "dag/extdeps/cloudflare/r2.dag",
   "dag/extdeps/cloudflare/r2_buckets.dag",
   "dag/extdeps/deepseek/deepseek_v4_1_flash.dag",
+  "dag/extdeps/nvidia/api_trial_terms.dag",
+  "dag/extdeps/nvidia/nemotron_3_ultra.dag",
+  "dag/extdeps/openrouter/openrouter.dag",
+  "dag/extdeps/openrouter/nvidia_nemotron_3_ultra_free.dag",
   "dag/extdeps/zhipu/glm_5_3.dag",
   "dag/extdeps/radixark/glm_5_3_nvfp4.dag",
   "dag/extdeps/docker/images/gitcommit90_glm_53_one_spark.dag",
diff --git a/dag/gunbc/fabric/fabric_cell_converge.dag b/dag/gunbc/fabric/fabric_cell_converge.dag
index f1bb9f67170..5e3c4063e8b 100644
--- a/dag/gunbc/fabric/fabric_cell_converge.dag
+++ b/dag/gunbc/fabric/fabric_cell_converge.dag
@@ -209,6 +209,12 @@ fn fabric_cell_member_ownership(member: FabricCellMember) -> Optional<Ownership>
 // every other slot, and a digest rendered from the fleet row alone would report the converged
 // shakedown cell as drifted on every observation (or, worse, converge it to the wrong ceiling).
 fn fabric_cell_resource_boundary_state_digest(slot: RunnerSlotIdentity) -> NonEmptyStr {
+  fabric_cell_resource_boundary_state_digest_with_quota(slot: slot, quota: gunbc_runner_slot_desired_for(slot: slot).cpu_quota)
+}
+
+// Also identifies the precise predecessor admitted by the CPU-only repair. All other
+// resource fields retain this slot's desired values; no unrelated drift is normalized.
+fn fabric_cell_resource_boundary_state_digest_with_quota(slot: RunnerSlotIdentity, quota: RunnerSlotCpuQuota) -> NonEmptyStr {
   let desired = gunbc_runner_slot_desired_for(slot: slot)
   fabric_cell_boundary_state_digest_of(
     memory_max: to_string(byte_size_count(b: desired.memory_max)),
@@ -216,7 +222,7 @@ fn fabric_cell_resource_boundary_state_digest(slot: RunnerSlotIdentity) -> NonEm
     memory_swap_max: to_string(byte_size_count(b: desired.memory_swap_max)),
     tasks_max: to_string(desired.tasks_max),
     cpu_weight: to_string(desired.cpu_weight),
-    cpu_quota_per_sec: fabric_cell_desired_cpu_quota_identity(quota: desired.cpu_quota),
+    cpu_quota_per_sec: fabric_cell_desired_cpu_quota_identity(quota: quota),
   )
 }
 
@@ -534,6 +540,11 @@ type FabricCellAddressEvidence
   | EvidenceObserved { member: FabricCellMember }
   | EvidenceConflict
 
+// TWO REFUSALS JOIN TO THE LEAST CAUSE (byte-lexicographic String order), not the first seen, so
+// the full value -- AddressUnreadable.cause included -- is a semilattice join and independent of the
+// order observations arrive in (test.claim.fabric_cell_evidence_algebra_witness
+// evidence_full_value_is_order_independent). Keeping the first cause made the class order-free
+// while the payload still moved with caller order.
 fn fabric_cell_address_evidence(
   observations: List<FabricCellAddressObservation>,
 ) -> FabricCellAddressEvidence {
@@ -541,7 +552,8 @@ fn fabric_cell_address_evidence(
     match o {
       AddressObservationRefused { slot: _, address: _, cause: c } =>
         match acc {
-          EvidenceRefused { cause: first } => EvidenceRefused { cause: first }
+          EvidenceRefused { cause: seen } =>
+            if c < seen { EvidenceRefused { cause: c } } else { EvidenceRefused { cause: seen } }
           NoEvidence => EvidenceRefused { cause: c }
           EvidenceAbsent => EvidenceRefused { cause: c }
           EvidenceObserved { member: _ } => EvidenceRefused { cause: c }
diff --git a/dag/gunbc/fabric/fabric_cell_effect.dag b/dag/gunbc/fabric/fabric_cell_effect.dag
index 68b0aed7b51..d145fed2eff 100644
--- a/dag/gunbc/fabric/fabric_cell_effect.dag
+++ b/dag/gunbc/fabric/fabric_cell_effect.dag
@@ -13,7 +13,8 @@ import extdeps.systemd.unit_file {
   slice_cpu_quota_unbounded,
 }
 import gunbc.build_cache_instance { RunnerSlotIdentity }
-import gunbc.runner_slot_allocation { gunbc_runner_slot_desired_for }
+import gunbc.runner_slot_allocation { gunbc_runner_slot_desired_for, identity_is_workspace_execution_member }
+import gunbc.change_realization { address_continuity, classify_change, HostResourceSubject, ChangeRealized, InPlaceUpdate }
 import gunbc.runner_slot_desired { gunbc_runner_slot_desired, RunnerSlotCpuQuota, CpuQuotaResolved, SlotCpuQuotaUnbounded }
 import gunbc.membership_reconcile {
   MemberAction,
@@ -35,6 +36,8 @@ import gunbc.fabric_cell_converge {
   fabric_cell_attempt_root_path,
   fabric_cell_slice_name,
   fabric_cell_resource_address_wire,
+  fabric_cell_member_key, fabric_cell_desired_state_digest,
+  fabric_cell_boundary_address_digest_of, fabric_cell_resource_boundary_state_digest_with_quota,
 }
 
 data fabric_cell_effect_authority_disposition: ConstructionMechanism = SingleAuthority
@@ -95,7 +98,7 @@ fn fabric_cell_base_directory_effect() -> FabricCellEffect {
 // DESIGN 4b forbids.
 //
 // FIVE BASE DIRECTIVES PLUS THE CPU QUOTA LINE, ALWAYS SIX. Every magnitude comes from
-// gunbc_runner_slot_desired -- the same row fabric_cell_resource_boundary_state_digest renders
+// gunbc_runner_slot_desired_for -- the same row fabric_cell_resource_boundary_state_digest renders
 // into the desired member digest -- so the directives this effect applies and the digest reconcile
 // compares are two projections of one authority and cannot disagree by drift.
 //
@@ -110,9 +113,8 @@ fn fabric_cell_base_directory_effect() -> FabricCellEffect {
 // arms nothing can produce.
 //
 // WHAT THIS DOES NOT DO, STATED SO THE RESET IS NOT READ AS A REPAIR (review F-R1, 2026-09-19).
-// The six directives are rendered only for MemberAdded. An EXISTING boundary that differs from the
-// desired row only by a finite CPU quota reconciles as MemberChanged, and every MemberChanged at
-// this address is refused as CellChangeNotYetRealizable by fabric_cell_address_realization below --
+// The six directives are rendered for MemberAdded. An EXISTING boundary that differs from the
+// desired unbounded row by a finite CPU quota reconciles as MemberChanged and is still refused --
 // so a previously installed finite quota is DETECTED (the digest compares "infinity" against the
 // host's CPUQuotaPerSecUSec identity and reports drift) and is NOT cleared by this module. That is
 // the inherited change-realization boundary, not a new one: gunbc.change_realization has not
@@ -124,6 +126,9 @@ fn fabric_cell_base_directory_effect() -> FabricCellEffect {
 // reported srv4 runner-unit census found unlimited quotas; the fabric boundary
 // (fabric-cell-srv3-06.slice) requires its own readback, and this row does not establish
 // fleet-wide quota conformity -- a cell found carrying a finite quota sits behind this block.
+// The separately admitted reverse direction repairs an enrolled workspace cell from unlimited
+// CPU to its declared finite quota, with every other resource field already exact. Its runtime
+// address is preserved, classified as InPlaceUpdate, and only the quota directive is emitted.
 //
 // WHY DIRECTIVES AND NOT A SystemdUnitFile: the effect's production realization is
 // `systemctl set-property <slice> <Property>=<value>...` -- systemd renders and owns the persisted
@@ -196,7 +201,8 @@ type FabricCellAddressRealization
 // decides WHETHER there is one. Neither axis is collapsed into the other, so a new address and a
 // new action each fail to compile here rather than inheriting an arm that happened to fit.
 //
-// TEARDOWN AND CHANGE REFUSE RATHER THAN BEING REALIZED. ADDITION always realizes: directories
+// TEARDOWN AND GENERAL CHANGE REFUSE. The CPU-only narrowing below is the sole admitted change.
+// ADDITION always realizes: directories
 // by path, the slice by the six directives of fabric_cell_slice_desired_directives_for.
 // Teardown of a cell root is a DESTRUCTIVE effect on a directory that may hold live
 // attempt state, and change realization is gunbc.change_realization's question -- it classifies a
@@ -225,17 +231,9 @@ fn fabric_cell_address_realization(
             ),
           }
         FabricCellResourceBoundaryAddress =>
-          fabric_cell_boundary_add_realization(
-            slot: m.slot,
-            quota: gunbc_runner_slot_desired().cpu_quota,
-          )
-      }
-    MemberChanged { at: _, from: _, to: m } =>
-      AddressRefused {
-        refusal: CellChangeNotYetRealizable {
-          address_wire: fabric_cell_resource_address_wire(address: m.address),
-        },
+          fabric_cell_boundary_add_realization(slot: m.slot)
       }
+    MemberChanged { at, from, to } => fabric_cell_workspace_quota_repair(at: at, from: from, to: to)
     MemberRemoved { at: _, from: m } =>
       AddressRefused {
         refusal: CellTeardownNotYetRealizable {
@@ -260,16 +258,45 @@ fn fabric_cell_address_realization(
 
 fn fabric_cell_boundary_add_realization(
   slot: RunnerSlotIdentity,
-  quota: RunnerSlotCpuQuota,
 ) -> FabricCellAddressRealization {
   AddressRealizable {
     effect: FabricCellSliceEnsure {
       slice_unit: fabric_cell_slice_name(slot: slot) as NonEmptyStr,
-      directives: fabric_cell_slice_desired_directives_for_slot(slot: slot, quota: quota),
+      directives: fabric_cell_slice_desired_directives_of_slot(slot: slot),
     },
   }
 }
 
+// A finite CPU quota limits scheduling rate; it neither deletes storage nor lowers memory.
+// Fleet apply reobserves the exact baseline under its mutation lock. This recognizes only the
+// erroneous unlimited predecessor with all other limits already exact, on the same enrolled
+// workspace address. It does not admit quota removal, other resource drift or replacement.
+fn fabric_cell_workspace_quota_repair(at: String, from: FabricCellMember, to: FabricCellMember) -> FabricCellAddressRealization {
+  let refused = AddressRefused { refusal: CellChangeNotYetRealizable {
+    address_wire: fabric_cell_resource_address_wire(address: to.address),
+  } }
+  if from.address != FabricCellResourceBoundaryAddress || to.address != FabricCellResourceBoundaryAddress
+    || from.slot != to.slot || at != fabric_cell_member_key(member: from) || at != fabric_cell_member_key(member: to)
+    || !identity_is_workspace_execution_member(identity: to.slot)
+    || to.state_digest != fabric_cell_desired_state_digest(slot: to.slot, address: to.address)
+    || from.state_digest != fabric_cell_boundary_address_digest_of(slice_name: fabric_cell_slice_name(slot: to.slot),
+      state: fabric_cell_resource_boundary_state_digest_with_quota(slot: to.slot, quota: SlotCpuQuotaUnbounded)) {
+    refused
+  } else { match gunbc_runner_slot_desired_for(slot: to.slot).cpu_quota {
+    SlotCpuQuotaUnbounded => refused
+    CpuQuotaResolved { threads } => match classify_change(subject: HostResourceSubject,
+      subject_label: fabric_cell_slice_name(slot: to.slot) as NonEmptyStr,
+      continuity: address_continuity(from: from, to: to, address_eq: (a, b) => fabric_cell_member_key(member: a) == fabric_cell_member_key(member: b)),
+      declared_intermediates: none) {
+      ChangeRealized { realization: InPlaceUpdate } => AddressRealizable { effect: FabricCellSliceEnsure {
+        slice_unit: fabric_cell_slice_name(slot: to.slot) as NonEmptyStr,
+        directives: [slice_cpu_quota(threads: threads)],
+      } }
+      other => refused
+    }
+  } }
+}
+
 // THE ALL-OR-NOTHING FOLD, AND IT IS THE POINT OF THE MODULE RATHER THAN A GUARD ON IT.
 //
 // AN EARLIER READING WOULD HAVE EMITTED THE TWO DIRECTORY CREATES AND REFUSED ONLY THE BOUNDARY,
diff --git a/dag/gunbc/fabric/fabric_cell_observe.dag b/dag/gunbc/fabric/fabric_cell_observe.dag
index a31d718d2b3..8e6c4dcbc43 100644
--- a/dag/gunbc/fabric/fabric_cell_observe.dag
+++ b/dag/gunbc/fabric/fabric_cell_observe.dag
@@ -3,6 +3,7 @@ module gunbc.fabric_cell_observe
 import std.types { String, List, Bool, NonEmptyStr }
 import std.disposition { ConstructionMechanism, SingleAuthority }
 import product.host_identity { HostIdentity }
+import extdeps.systemd { systemd_slice_ancestor_names, systemd_slice_suffix }
 import gunbc.build_cache_instance { RunnerSlotIdentity, runner_slot_instance_name, runner_slot_identity_equal, runner_slot_instance_name_prefix, slot_name_could_belong_to_host }
 import gunbc.runner_slot_allocation {
   fabric_execution_slot_identities,
@@ -495,6 +496,7 @@ fn fabric_cell_observe_host(probe: FabricCellHostProbe) -> FabricCellHostReadbac
 // foreign-artifact remedy.
 type FabricCellDiscoveredSubject
   = DiscoveredExpectedCell { slot: RunnerSlotIdentity }
+  | DiscoveredCellSliceAncestor { observed_name: String, host: HostIdentity }
   | DiscoveredUnexpectedCommittedSlot { slot: RunnerSlotIdentity }
   | DiscoveredCrossHostNamedArtifact { observed_name: String, named_slot: RunnerSlotIdentity, observed_on: HostIdentity }
   | DiscoveredForeignArtifact { observed_name: String, location: String }
@@ -503,6 +505,8 @@ type FabricCellDiscoveredSubject
 fn fabric_cell_discovered_subject_wire(s: FabricCellDiscoveredSubject) -> String {
   match s {
     DiscoveredExpectedCell { slot: sl } => join(["expected:", runner_slot_instance_name(slot: sl)], "")
+    DiscoveredCellSliceAncestor { observed_name: n, host: h } =>
+      join(["cell-slice-ancestor:", h as String, ":", n], "")
     DiscoveredUnexpectedCommittedSlot { slot: sl } => join(["unexpected-committed:", runner_slot_instance_name(slot: sl)], "")
     DiscoveredCrossHostNamedArtifact { observed_name: n, named_slot: sl, observed_on: h } =>
       join(["cross-host-named:", h as String, ":", n, ":names:", runner_slot_instance_name(slot: sl)], "")
@@ -605,6 +609,21 @@ fn fabric_cell_slot_is_fabric_expected(slot: RunnerSlotIdentity) -> Bool {
   )
 }
 
+// A SLICE NAME ALSO CREATES ITS SYSTEMD ANCESTORS. The namespace enumeration legitimately
+// returns fabric-cell-srv1.slice alongside fabric-cell-srv1-13.slice. It is neither a slot nor
+// foreign residue. Derive proper ancestors forward from this host's enrolled cell names through
+// systemd's existing hierarchy authority; a prefix exclusion would also hide unrelated slices.
+// This classification grants no resource ownership or effect, and cannot satisfy a cell address.
+fn fabric_cell_is_expected_slice_ancestor(name: String, members: List<RunnerSlotIdentity>) -> Bool {
+  fold(members, init: false, f: (seen, slot) => {
+    let slice = fabric_cell_slice_name(slot: slot)
+    let stem = substring(s: slice, start: 0, end: string_length(s: slice) - string_length(s: systemd_slice_suffix))
+    seen || (fabric_cell_slot_is_fabric_expected(slot: slot) && name != slice
+      && fold(systemd_slice_ancestor_names(stem: stem), init: false, f: (matched, ancestor) =>
+        matched || name == join([ancestor, systemd_slice_suffix], "")))
+  })
+}
+
 // CLASSIFIED AGAINST THIS HOST'S COMMITTED SLOTS, NOT THE FLEET'S. An earlier cut searched the
 // complete fleet population with no host argument, so an artifact named `srv3-06` found in srv4's
 // `/opt/fabric-cells` classified as `DiscoveredExpectedCell { srv3-06 }` -- because that name is
@@ -629,7 +648,15 @@ fn fabric_cell_classify_discovered_name(
     CommittedPopulationDerived { members: members } =>
       fold(
         fabric_cell_named_among(members: members, name: name, rendering: rendering),
-        init: fabric_cell_classify_uncommitted_here(host: host, name: name, rendering: rendering),
+        init: match rendering {
+          CellRootRendering => fabric_cell_classify_uncommitted_here(host: host, name: name, rendering: rendering)
+          SliceRendering =>
+            if fabric_cell_is_expected_slice_ancestor(name: name, members: members) {
+              DiscoveredCellSliceAncestor { observed_name: name, host: host }
+            } else {
+              fabric_cell_classify_uncommitted_here(host: host, name: name, rendering: rendering)
+            }
+        },
         f: (acc, s) =>
           if fabric_cell_slot_is_fabric_expected(slot: s) {
             DiscoveredExpectedCell { slot: s }
@@ -838,7 +865,8 @@ fn fabric_cell_projection_refusals(projection: FabricCellObserverProjection) ->
 
 // DISCOVERY PROJECTS INTO THE REFUSAL VOCABULARY gunbc.fabric_cell_converge OWNS, which is what
 // keeps the direction acyclic: this module imports that one, so that one cannot name
-// FabricCellDiscovery. ONLY ONE ARM PROJECTS NOTHING, and an earlier cut got that population wrong
+// FabricCellDiscovery. Expected cells and their structural slice ancestors project no refusal;
+// ancestors remain explicit discovery subjects but are not cell resources. An earlier cut got that population wrong
 // in a way worth recording: it also dropped DiscoveredUnexpectedCommittedSlot, on the reasoning that
 // a committed slot "reaches the classification kernel through the readback". Only EXPECTED slots do
 // -- fabric_cell_observe_host folds fabric_cell_expected_slots -- so a committed non-fabric slot
@@ -868,6 +896,7 @@ fn fabric_cell_discovery_refusals(discovery: FabricCellDiscovery) -> List<Fabric
 fn fabric_cell_discovered_refusal(host: HostIdentity, s: FabricCellDiscoveredSubject) -> List<FabricCellObservationRefusal> {
   match s {
     DiscoveredExpectedCell { slot: _ } => []
+    DiscoveredCellSliceAncestor { observed_name: _, host: _ } => []
     DiscoveredUnexpectedCommittedSlot { slot: sl } =>
       [UnexpectedCommittedSlotArtifact { host: host, slot: sl, location: fabric_cell_base_dir_name() }]
     DiscoveredCrossHostNamedArtifact { observed_name: n, named_slot: sl, observed_on: h } =>
diff --git a/dag/gunbc/fabric/fabric_event_log.dag b/dag/gunbc/fabric/fabric_event_log.dag
index bd95ae2f46a..48930300359 100644
--- a/dag/gunbc/fabric/fabric_event_log.dag
+++ b/dag/gunbc/fabric/fabric_event_log.dag
@@ -25,7 +25,7 @@ import product.capacity.event_chain {
 import product.capacity.pool_events {
   PoolEvent, pool_event_wire_text, pool_event_decode,
   PoolFold, PoolFolded, PoolFoldRefused, pool_fold, SeatRequest, SeatProposal, SeatProposed, SeatRefused, propose_acquire, grant_from_admission,
-  PoolReleased,
+  PoolReleased, pool_apply_payload,
 }
 import product.capacity.lease { LeasePolicy, LeaseGrant, release_law_eq, release_law_wire }
 import product.capacity.redemption {
@@ -415,6 +415,96 @@ fn pool_event_append_wire(a: PoolEventAppend) -> String {
   }
 }
 
+// A POOL TRANSITION THAT IS CHECKED BEFORE IT IS WRITTEN. fabric_pool_event_append appends the event it
+// is handed, and a caller that reports success on that append can report success over a transition no
+// fold will ever apply: a settlement appended after its lease lapsed, or a hold whose reference
+// duplicates an earlier one. The fold refuses such an event on replay, and pool_fold refuses the WHOLE
+// partition at the first refused event -- so one unchecked append makes every later read of the pool
+// fail while the caller believed it had succeeded.
+//
+// SO THIS IS SETTLEMENT AND OBSERVATION WITH THE ACQUISITION'S DISCIPLINE: read the partition, fold it,
+// apply the transition with the same function replay uses (product.capacity.pool_events
+// pool_apply_payload), and only if that advances, compare-and-set append against the head it was
+// decided on; a moved head is re-read and re-decided, never written blind. A refused transition is its
+// own arm and nothing is appended. The payload is built from the head because a transition that mints
+// its own hold needs an identity no other reading shares.
+type PoolTransition
+  = PoolTransitionAppended { id: EventId }
+  | PoolTransitionRefused { wire: String }
+  | PoolTransitionContended { attempts: Nat }
+  | PoolTransitionStoreRefused { step: String, reason: String }
+
+type PoolTransitionState {
+  done: PoolTransition?
+}
+
+fn pool_transition_head_word(head: HeadExpectation) -> NonEmptyStr {
+  match head {
+    HeadAbsent => "genesis" as NonEmptyStr
+    HeadAt { id: h } => h as String as NonEmptyStr
+  }
+}
+
+fn pool_transition_attempt<Q, S>(store: FabricStorageBinding, partition: PartitionId, root: Pool<Q, S>, actor: NonEmptyStr, at: EpochSecs, payload: fn(NonEmptyStr) -> PoolEvent, budget: Nat) -> PoolTransition? {
+  match event_log_read_partition(store: store, partition: partition, budget: budget) {
+    PartitionReadRefused { cause: c } => Present { value: PoolTransitionStoreRefused { step: "store", reason: event_log_refusal_wire(cause: c) } }
+    PartitionReadOk { head: head, walk: walk } =>
+      match walk {
+        ChainIncomplete { missing: m, newest_first_so_far: _ } => Present { value: PoolTransitionStoreRefused { step: "chain", reason: join(["partition chain is missing event ", m as String], "") } }
+        ChainBudgetExhausted { at: a } => Present { value: PoolTransitionStoreRefused { step: "chain", reason: join(["partition chain exceeded the read budget at ", a as String], "") } }
+        ChainWalked { oldest_first: xs } =>
+          match pool_fold(root: root, oldest_first: xs) {
+            PoolFoldRefused { at_event: e, wire: w } => Present { value: PoolTransitionStoreRefused { step: "fold", reason: join(["event ", e as String, " refused: ", w], "") } }
+            PoolFolded { pool: p, generation: _ } => {
+              let identity = join(["pending:", pool_transition_head_word(head: head) as String], "") as NonEmptyStr
+              let event_payload = payload(identity)
+              match pool_apply_payload(pool: p, payload: event_payload, at: at, identity: identity) {
+                PoolRefused { refusal: r } => Present { value: PoolTransitionRefused { wire: pool_refusal_wire(r: r) } }
+                PoolAdvanced { pool: _ } =>
+                  match event_log_append(
+                    store: store,
+                    partition: partition,
+                    event: ChainEvent {
+                      partition: partition,
+                      parent: match head { HeadAbsent => none  HeadAt { id: h } => Present { value: h } },
+                      recorded_at: at,
+                      actor: actor,
+                      payload: event_payload,
+                    },
+                    expected: head,
+                  ) {
+                    EventAppended { id: h } => Present { value: PoolTransitionAppended { id: h } }
+                    EventAppendStale { expected: _, observed: _ } => none
+                    EventAppendRefused { cause: c } => Present { value: PoolTransitionStoreRefused { step: "store", reason: event_log_refusal_wire(cause: c) } }
+                  }
+              }
+            }
+          }
+      }
+  }
+}
+
+fn fabric_pool_transition<Q, S>(store: FabricStorageBinding, partition: PartitionId, root: Pool<Q, S>, actor: NonEmptyStr, at: EpochSecs, payload: fn(NonEmptyStr) -> PoolEvent, attempts: Nat, budget: Nat) -> PoolTransition {
+  let st = fold(nat_range_inclusive(lo: 1, hi: attempts), init: PoolTransitionState { done: none }, f: (acc, _i) =>
+    match acc.done {
+      Present { value: _ } => acc
+      Absent => PoolTransitionState { done: pool_transition_attempt(store: store, partition: partition, root: root, actor: actor, at: at, payload: payload, budget: budget) }
+    })
+  match st.done {
+    Present { value: d } => d
+    Absent => PoolTransitionContended { attempts: attempts }
+  }
+}
+
+fn pool_transition_wire(t: PoolTransition) -> String {
+  match t {
+    PoolTransitionAppended { id: h } => join(["appended ", h as String], "")
+    PoolTransitionRefused { wire: w } => join(["the pool refuses the transition: ", w], "")
+    PoolTransitionContended { attempts: n } => join(["contended after ", to_string(n), " attempts"], "")
+    PoolTransitionStoreRefused { step: s, reason: why } => join(["refused at ", s, ": ", why], "")
+  }
+}
+
 // RELEASING A SEAT, AND IT IS CHECKED AGAINST THE FOLDED POOL BEFORE ANYTHING IS APPENDED.
 //
 // fabric_pool_event_append is unchecked by construction -- it writes the event a caller hands it --
diff --git a/dag/gunbc/fabric/fabric_quota.dag b/dag/gunbc/fabric/fabric_quota.dag
index 870172d2f17..20413667278 100644
--- a/dag/gunbc/fabric/fabric_quota.dag
+++ b/dag/gunbc/fabric/fabric_quota.dag
@@ -2,17 +2,19 @@ module gunbc.fabric_quota
 
 import std.types { String, Bool, Int, NonEmptyStr, List, EpochSecs }
 import std.nat { Nat }
-import std.measure { Measure }
+import std.checked_arithmetic { checked_int_to_nat }
+import std.measure { Measure, Second, second, second_count }
 import extdeps.api_rate_limit { UpstreamRateLimit, upstream_rate_limit_key }
 import product.capacity.quota { quota_partition, quota_root_pool }
 import product.capacity.event_chain { PartitionId }
-import product.capacity.pool_events { PoolSettled, SeatRequest }
+import product.capacity.pool_events { PoolSettled, PoolUpstreamObserved, SeatRequest }
+import product.capacity.pool { pool_window_at, WindowResolved, WholeLifetime, InstantBeforeAnchor }
 import product.capacity.lease { LeasePolicy, LeaseGrant, FencedResource }
 import gunbc.fabric_event_log_host { HostEventLogStore, HostStoreResolved, HostStoreRefused, event_log_store_for_host, now_epoch_seconds }
 import gunbc.fabric_storage_client { FabricStorageBinding }
 import gunbc.fabric_event_log {
   SeatAcquisition, SeatGranted, SeatFull, SeatContended, SeatAcquireRefused, fabric_seat_acquire, seat_acquisition_wire,
-  PoolEventAppend, PoolEventAppended, PoolEventContended, PoolEventAppendRefused, fabric_pool_event_append, pool_event_append_wire,
+  PoolTransition, PoolTransitionAppended, fabric_pool_transition, pool_transition_wire,
 }
 
 // A CALLER LEASES UPSTREAM QUOTA BEFORE IT SPENDS IT. The lease holds the calls it is about to
@@ -25,7 +27,7 @@ import gunbc.fabric_event_log {
 // expiry frees is the unspent remainder.
 
 type QuotaLease
-  = QuotaLeased { grant: LeaseGrant, partition: PartitionId, store: FabricStorageBinding }
+  = QuotaLeased { grant: LeaseGrant, partition: PartitionId, store: FabricStorageBinding, limit: UpstreamRateLimit }
   | QuotaFull { wire: String }
   | QuotaLeaseRefused { detail: String }
 
@@ -33,24 +35,116 @@ fn quota_policy(term_seconds: Nat) -> LeasePolicy {
   LeasePolicy { maximum_duration_seconds: term_seconds, release_law: FencedResource }
 }
 
+// A TERM IS EITHER THE CALLER'S DURATION OR "TO THE END OF THIS WINDOW". A lapsing pool refuses a lease
+// that would outlive its window (product.capacity.pool LeaseCrossesLapse), so a caller whose spend is
+// an instant -- a request counted the moment it is sent -- cannot know a fixed term that always fits:
+// at second 59 of a minute window only one second is left. The window end is read from the SAME
+// clock reading the lease is stamped with, so the term fits by construction rather than by luck.
+type QuotaTerm
+  = QuotaTermSeconds { seconds: Second }
+  | QuotaTermToWindowEnd
+
+fn quota_term_to_window_end(limit: UpstreamRateLimit, at: EpochSecs) -> Second? {
+  match pool_window_at(pool: quota_root_pool(limit: limit), at: at) {
+    WindowResolved { window: w } => if w.end > at { checked_second(n: w.end - at) } else { none }
+    WholeLifetime => none
+    InstantBeforeAnchor { anchor: _, at: _ } => none
+  }
+}
+
+fn checked_second(n: Int) -> Second? {
+  match checked_int_to_nat(n: n) {
+    Absent => none
+    Present { value: v } => Present { value: second(count: v) }
+  }
+}
+
+// THE INSTANT THE CURRENT WINDOW BEGAN, read off the same pool the term is: what a caller needs to tell
+// which of its outstanding sends were admitted in an earlier window.
+fn quota_window_start(limit: UpstreamRateLimit, at: EpochSecs) -> EpochSecs? {
+  match pool_window_at(pool: quota_root_pool(limit: limit), at: at) {
+    WindowResolved { window: w } => Present { value: w.start }
+    WholeLifetime => none
+    InstantBeforeAnchor { anchor: _, at: _ } => none
+  }
+}
+
+fn quota_term_seconds(limit: UpstreamRateLimit, term: QuotaTerm, at: EpochSecs) -> Second? {
+  match term {
+    QuotaTermSeconds { seconds: n } => Present { value: n }
+    QuotaTermToWindowEnd => quota_term_to_window_end(limit: limit, at: at)
+  }
+}
+
 fn fabric_quota_lease(short_hostname: String, limit: UpstreamRateLimit, amount: Nat, actor: NonEmptyStr, term_seconds: Nat) -> QuotaLease {
+  fabric_quota_lease_for(short_hostname: short_hostname, limit: limit, amount: amount, actor: actor, term: QuotaTermSeconds { seconds: second(count: term_seconds) })
+}
+
+fn fabric_quota_lease_for(short_hostname: String, limit: UpstreamRateLimit, amount: Nat, actor: NonEmptyStr, term: QuotaTerm) -> QuotaLease {
   match event_log_store_for_host(short_hostname: short_hostname) {
     HostStoreRefused { detail: d } => QuotaLeaseRefused { detail: d }
     HostStoreResolved { store: store, executor: _ } =>
       match now_epoch_seconds() {
         Absent => QuotaLeaseRefused { detail: "the clock could not be read as epoch seconds" }
-        Present { value: now } => {
-          let partition = quota_partition(limit: limit)
-          match fabric_seat_acquire(
-            store: store, partition: partition, root: quota_root_pool(limit: limit), actor: actor,
-            request: SeatRequest { reference: join([actor as String, "@", to_string(now)], "") as NonEmptyStr, amount: Measure { count: amount }, at: now, term_seconds: term_seconds },
-            policy: quota_policy(term_seconds: term_seconds), attempts: 3, budget: 4096,
-          ) {
-            SeatGranted { grant: g, generation: _, attempts_used: _ } => QuotaLeased { grant: g, partition: partition, store: store }
-            SeatFull { wire: w, attempts_used: _ } => QuotaFull { wire: join([upstream_rate_limit_key(l: limit) as String, ": ", w], "") }
-            other => QuotaLeaseRefused { detail: seat_acquisition_wire(a: other) }
+        Present { value: now } => fabric_quota_lease_at(store: store, now: now, limit: limit, amount: amount, actor: actor, term: term)
+      }
+  }
+}
+
+// THE LEASE AT A GIVEN STORE AND INSTANT. fabric_quota_lease_for resolves both from the executing host;
+// everything after that -- the term derivation, the seat acquisition, the fold -- is this function, so a
+// witness that supplies a store in a temporary directory and an instant runs the PRODUCTION lease rather
+// than a constructed QuotaLeased.
+fn fabric_quota_lease_at(store: FabricStorageBinding, now: EpochSecs, limit: UpstreamRateLimit, amount: Nat, actor: NonEmptyStr, term: QuotaTerm) -> QuotaLease {
+  match quota_term_seconds(limit: limit, term: term, at: now) {
+    Absent => QuotaLeaseRefused { detail: join([upstream_rate_limit_key(l: limit) as String, ": no window end is defined at this instant"], "") }
+    Present { value: term } => {
+      let term_seconds = second_count(s: term)
+      let partition = quota_partition(limit: limit)
+      match fabric_seat_acquire(
+        store: store, partition: partition, root: quota_root_pool(limit: limit), actor: actor,
+        request: SeatRequest { reference: join([actor as String, "@", to_string(now)], "") as NonEmptyStr, amount: Measure { count: amount }, at: now, term_seconds: term_seconds },
+        policy: quota_policy(term_seconds: term_seconds), attempts: 3, budget: 4096,
+      ) {
+        SeatGranted { grant: g, generation: _, attempts_used: _ } => QuotaLeased { grant: g, partition: partition, store: store, limit: limit }
+        SeatFull { wire: w, attempts_used: _ } => QuotaFull { wire: join([upstream_rate_limit_key(l: limit) as String, ": ", w], "") }
+        other => QuotaLeaseRefused { detail: seat_acquisition_wire(a: other) }
+      }
+    }
+  }
+}
+
+// WHAT THE UPSTREAM SAYS REMAINS IS RECORDED ON THE PARTITION, NOT KEPT BESIDE IT. A fresh local ledger
+// knows nothing of requests spent before it existed, or by another client of the same credential; an
+// upstream that reports how many remain is the authority on that. The reading is appended as the
+// existing PoolUpstreamObserved event, which the fold turns into a hold of the shortfall for the rest
+// of the window (product.capacity.pool observe_upstream_remaining) -- so a reading of zero leaves no
+// headroom, a partial one leaves exactly that much, and a later, larger reading never gives back what
+// an earlier one held. There is no second balance model: the pool is the balance.
+type QuotaObservation
+  = QuotaUpstreamRecorded { partition: PartitionId, remaining: Nat }
+  | QuotaObservationRefused { detail: String }
+
+fn fabric_quota_observe_upstream(short_hostname: String, limit: UpstreamRateLimit, remaining: Nat, actor: NonEmptyStr) -> QuotaObservation {
+  match event_log_store_for_host(short_hostname: short_hostname) {
+    HostStoreRefused { detail: d } => QuotaObservationRefused { detail: d }
+    HostStoreResolved { store: store, executor: _ } =>
+      match now_epoch_seconds() {
+        Absent => QuotaObservationRefused { detail: "the clock could not be read as epoch seconds" }
+        Present { value: now } =>
+          match quota_term_to_window_end(limit: limit, at: now) {
+            Absent => QuotaObservationRefused { detail: join([upstream_rate_limit_key(l: limit) as String, ": no window end is defined at this instant"], "") }
+            Present { value: term } => {
+              let partition = quota_partition(limit: limit)
+              match fabric_pool_transition(
+                store: store, partition: partition, root: quota_root_pool(limit: limit), actor: actor, at: now,
+                payload: fn(identity) { PoolUpstreamObserved { remaining: remaining, term_seconds: second_count(s: term) } }, attempts: 3, budget: 4096,
+              ) {
+                PoolTransitionAppended { id: _ } => QuotaUpstreamRecorded { partition: partition, remaining: remaining }
+                other => QuotaObservationRefused { detail: pool_transition_wire(t: other) }
+              }
+            }
           }
-        }
       }
   }
 }
@@ -59,32 +153,39 @@ type QuotaSettle
   = QuotaSettled { partition: PartitionId, actual: Nat }
   | QuotaSettleRefused { detail: String }
 
-// SETTLEMENT IS ONE PARTITION APPEND, and the observe/append/retry loop it needs is the carrier's
-// (gunbc.fabric_event_log fabric_pool_event_append), not a second copy here. It used to be a copy:
-// this module held the only one until a compute reservation needed to release, at which point the
-// loop would have existed twice and been free to disagree with itself about a contended head.
+// SETTLEMENT IS ONE CHECKED PARTITION TRANSITION (gunbc.fabric_event_log fabric_pool_transition): the
+// partition is folded and the settlement applied to it before anything is written, under the same
+// compare-and-set the acquisition used. It was an unchecked append, which reported success for a
+// settlement whose lease had already lapsed -- an event the fold refuses on replay, leaving the whole
+// partition unfoldable while the caller believed it had settled. The lease carries its own limit so the
+// settlement folds against the pool the lease was granted from.
 fn fabric_quota_settle(lease: QuotaLease, actual: Nat) -> QuotaSettle {
+  match now_epoch_seconds() {
+    Absent => QuotaSettleRefused { detail: "the clock could not be read as epoch seconds" }
+    Present { value: now } => fabric_quota_settle_at(lease: lease, actual: actual, now: now)
+  }
+}
+
+// THE SETTLEMENT AT A GIVEN INSTANT, for the same reason the lease has one: the checked transition and
+// everything after the clock read is this function.
+fn fabric_quota_settle_at(lease: QuotaLease, actual: Nat, now: EpochSecs) -> QuotaSettle {
   match lease {
     QuotaFull { wire: w } => QuotaSettleRefused { detail: join(["nothing to settle: ", w], "") }
     QuotaLeaseRefused { detail: d } => QuotaSettleRefused { detail: join(["nothing to settle: ", d], "") }
-    QuotaLeased { grant: g, partition: p, store: store } =>
-      match now_epoch_seconds() {
-        Absent => QuotaSettleRefused { detail: "the clock could not be read as epoch seconds" }
-        Present { value: now } =>
-          match fabric_pool_event_append(
-            store: store, partition: p, actor: g.reference, at: now,
-            payload: PoolSettled { reference: g.reference, actual: actual }, attempts: 3,
-          ) {
-            PoolEventAppended { id: _ } => QuotaSettled { partition: p, actual: actual }
-            other => QuotaSettleRefused { detail: pool_event_append_wire(a: other) }
-          }
+    QuotaLeased { grant: g, partition: p, store: store, limit: limit } =>
+      match fabric_pool_transition(
+        store: store, partition: p, root: quota_root_pool(limit: limit), actor: g.reference, at: now,
+        payload: fn(identity) { PoolSettled { reference: g.reference, actual: actual } }, attempts: 3, budget: 4096,
+      ) {
+        PoolTransitionAppended { id: _ } => QuotaSettled { partition: p, actual: actual }
+        other => QuotaSettleRefused { detail: pool_transition_wire(t: other) }
       }
   }
 }
 
 fn quota_lease_wire(l: QuotaLease) -> String {
   match l {
-    QuotaLeased { grant: g, partition: p, store: _ } => join(["leased ", g.reference as String, " on ", p as String, " fence=", g.fence.grant as String, "@", to_string(g.fence.generation), " expires_at=", to_string(g.expires_at)], "")
+    QuotaLeased { grant: g, partition: p, store: _, limit: _ } => join(["leased ", g.reference as String, " on ", p as String, " fence=", g.fence.grant as String, "@", to_string(g.fence.generation), " expires_at=", to_string(g.expires_at)], "")
     QuotaFull { wire: w } => join(["full ", w], "")
     QuotaLeaseRefused { detail: d } => join(["refused ", d], "")
   }
diff --git a/dag/gunbc/fabric/fabric_storage_placement.dag b/dag/gunbc/fabric/fabric_storage_placement.dag
index bebf0d3a505..1d89d886288 100644
--- a/dag/gunbc/fabric/fabric_storage_placement.dag
+++ b/dag/gunbc/fabric/fabric_storage_placement.dag
@@ -6,12 +6,13 @@ import std.types { String, NonEmptyStr, FilePath, Int, Bool, Port, List }
 import product.host_identity { HostIdentity }
 import gunbc.fleet_intent_network { fleet_intent_network }
 import gunbc.fleet_host_identity { operator_host_srv1 }
-import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_fabric_storage_root, srv1_live_dashboard_instance, dashboard_instance_child }
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, srv1_live_dashboard_instance, dashboard_instance_child }
+import gunbc.owned_directory { OwnedDirectoryTarget, OwnedDirectoryManaged }
 import std.effect_grant { Read, Write, Execute }
 import extdeps.tailscale.serve { tailscale_serve_unix_proxy_peer }
 import gunbc.ownership { Ensured }
 import gunbc.managed_directory {
-  ManagedDirectory, DirectoryDependent, ManagedDirectoryAdmission, managed_directory_admit, srv1_dashboard_service_principal,
+  ManagedDirectory, DirectoryDependent, srv1_dashboard_service_principal,
   EntriesUnmanaged, EntriesReadableByDependents, managed_directory_entry_mode, ManagedEntryModeDerived, ManagedEntryModeRefused,
 }
 import gunbc.fleet_posix_accounts { fleet_posix_ci_runner_user }
@@ -66,14 +67,21 @@ data fabric_storage_door_proxy_peer: NonEmptyStr = tailscale_serve_unix_proxy_pe
 
 
 
-// The store root is the placed instance's fabric DB root -- one authority with the deployment that
-// creates it (gunbc.roadmap_dashboard_instance dashboard_instance_fabric_storage_root).
+// THE FABRIC DB ROOT: where the fabric DB's files live on the instance that holds the placement
+// (gunbc.fabric_storage_file_store). It is this module's fact -- the placement decides where the store
+// is -- and the deployment creates exactly the directories fabric_storage_directory_demands declares
+// from it. It replaced the per-instance event-log mirror root: no executor keeps a copy of the log any
+// more, so only the placement's host holds a root at all.
 fn fabric_storage_placed_instance() -> HostDashboardInstance {
   srv1_live_dashboard_instance()
 }
 
+fn fabric_storage_root_of(instance: HostDashboardInstance) -> FilePath {
+  dashboard_instance_child(root: instance.instance_root, child: "fabric-storage")
+}
+
 fn fabric_storage_store_root() -> NonEmptyStr {
-  dashboard_instance_fabric_storage_root(instance: fabric_storage_placed_instance()) as String as NonEmptyStr
+  fabric_storage_root_of(instance: fabric_storage_placed_instance()) as String as NonEmptyStr
 }
 
 // WHETHER AN INSTANCE HOLDS THE PLACEMENT: the deployment owns the store root and the endpoint only
@@ -207,20 +215,35 @@ fn fabric_storage_placed_file_root(store_root: NonEmptyStr) -> FabricStoragePlac
   }
 }
 
-fn fabric_storage_store_directories() -> List<ManagedDirectoryAdmission> {
+fn fabric_storage_store_directories() -> List<ManagedDirectory> {
   let root = fabric_storage_store_root()
   let areas = fabric_storage_file_root(root: root)
   [
-    managed_directory_admit(d: fabric_storage_directory(member: "fabric-storage-root", path: root, writes: false)),
-    managed_directory_admit(d: fabric_storage_directory(member: "fabric-storage-objects", path: areas.objects, writes: true)),
-    managed_directory_admit(d: fabric_storage_directory(member: "fabric-storage-heads", path: areas.heads, writes: true)),
-    managed_directory_admit(d: fabric_storage_state_directory(member: "fabric-state-root", path: fabric_storage_state_root(store_root: root))),
-    managed_directory_admit(d: fabric_storage_state_directory(member: "fabric-state-objects", path: fabric_storage_state_file_root(store_root: root).objects)),
-    managed_directory_admit(d: fabric_storage_state_directory(member: "fabric-state-heads", path: fabric_storage_state_file_root(store_root: root).heads)),
-    managed_directory_admit(d: fabric_storage_door_directory()),
+    fabric_storage_directory(member: "fabric-storage-root", path: root, writes: false),
+    fabric_storage_directory(member: "fabric-storage-objects", path: areas.objects, writes: true),
+    fabric_storage_directory(member: "fabric-storage-heads", path: areas.heads, writes: true),
+    fabric_storage_state_directory(member: "fabric-state-root", path: fabric_storage_state_root(store_root: root)),
+    fabric_storage_state_directory(member: "fabric-state-objects", path: fabric_storage_state_file_root(store_root: root).objects),
+    fabric_storage_state_directory(member: "fabric-state-heads", path: fabric_storage_state_file_root(store_root: root).heads),
+    fabric_storage_door_directory(),
   ]
 }
 
+// THE STORE'S DIRECTORIES AS THE PLACED INSTANCE'S DEMAND. The root alone is not a store -- the file
+// store writes objects and heads under it, and a create-new under an absent area refuses not_found --
+// so every area is demanded, each a managed directory whose owner, group and mode derive from the
+// writers declared above; a writer the owner and group do not cover refuses in the provider
+// (gunbc.owned_directory owned_directory_mode) rather than widening. Every other instance demands
+// nothing, so a lab twin never creates srv1's store. The store is durable history: nothing the
+// deployment does removes it.
+fn fabric_storage_directory_demands(instance: HostDashboardInstance) -> List<OwnedDirectoryTarget> {
+  if fabric_storage_placed_on(instance: instance) {
+    map(fabric_storage_store_directories(), d => OwnedDirectoryManaged { directory: d })
+  } else {
+    []
+  }
+}
+
 // The authenticated state space shares the fabric DB service and CAS implementation, but never
 // shares its object directory with the legacy CI-writable namespace. A public head alias therefore
 // cannot expose private state objects. Only the store service writes here, even for local callers.
diff --git a/dag/gunbc/fabric/fabric_store_operation_admission.dag b/dag/gunbc/fabric/fabric_store_operation_admission.dag
index b2a50ba4a23..2acdd6f0cee 100644
--- a/dag/gunbc/fabric/fabric_store_operation_admission.dag
+++ b/dag/gunbc/fabric/fabric_store_operation_admission.dag
@@ -13,7 +13,6 @@ import gunbc.spark.pair_serving_authority_log {
   pair_authority_event_decode, pair_authority_partition_prefix, host_placement_partition,
 }
 import gunbc.spark.host_effect_quiescence { ClaimantTerminal, RecoveryAuthorized }
-import gunbc.spark.pair_serving_d0 { d0_required_scope, d0_filing_key_scope }
 import gunbc.durable_cas_fabric_storage { cas_slot_head_prefix }
 import gunbc.auth.approval_capability { ApprovalCapability, CapabilityRefusal }
 import gunbc.auth.approval_decision_store { ApprovalKeyringRead, ApprovalKeyLoaded, ApprovalKeyringRefused }
@@ -45,6 +44,10 @@ import gunbc.auth.approval_store_receipt { verify_store_receipt, StoreReceiptAut
 // store receipt (gunbc.auth.approval_store_receipt) whose approved intent -- presented beside it and
 // bound to it by digest -- states a scope admissible for the operation.
 
+// THE FILING HEADS D0 WROTE KEEP THEIR PREFIX: the heads already in the store were written under it, and
+// classifying them is a fact about stored data that outlives the lifecycle that wrote them.
+data consent_filing_key_scope: String = "pair-serving-d0-filing-"
+
 // Which protected head an advance names; Absent is an unprotected head this wall does not govern.
 type ProtectedHead
   = AuthorityPartitionHead
@@ -56,7 +59,7 @@ fn protected_head_of(name: String) -> ProtectedHead? {
   if starts_with(s: name, prefix: pair_authority_partition_prefix) { Present { value: AuthorityPartitionHead } }
   else if name == (host_placement_partition as String) { Present { value: HostPlacementHead } }
   else if starts_with(s: name, prefix: join([cas_slot_head_prefix, authorization_claim_key_scope], "")) { Present { value: ConsentClaimSlotHead } }
-  else if starts_with(s: name, prefix: join([cas_slot_head_prefix, d0_filing_key_scope], "")) { Present { value: ConsentFilingSlotHead } }
+  else if starts_with(s: name, prefix: join([cas_slot_head_prefix, consent_filing_key_scope], "")) { Present { value: ConsentFilingSlotHead } }
   else { none }
 }
 
@@ -126,10 +129,12 @@ type OperationRequirement
   = WorkloadGrantRequired { target: NamespacePosition }
   | ApprovedScopeRequired { admissible: List<AuthorizationScope> }
 
-// THE ADMISSIBLE SCOPES ARE THE APPROVED OPERATIONS THAT PERFORM EACH WRITE. Today one approval flow
-// exists, D0's (d0_required_scope), and it performs the suspension transaction end to end: the
-// consent claim and filing, the authority transitions and entry-state record, and the placement saga
-// it prepares, claims, finalizes, aborts or cancels. EstablishAuthority and RecoverHostEffect have
+// THE ADMISSIBLE SCOPES ARE THE APPROVED OPERATIONS THAT PERFORM EACH WRITE. TODAY NO APPROVAL FLOW EXISTS.
+// The one there was, D0's (gunbc.spark.pair_serving_d0, which performed the suspension transaction end to
+// end: the consent claim and filing, the authority transitions and entry-state record, and the placement
+// saga), had exactly one subject, Group A, and was deleted with Group A's decommissioning (operator,
+// 2026-10-07; the units were sold). So every operation it approved now refuses as
+// NoApprovalFlowForOperation until a flow for another group is ruled and lands. EstablishAuthority and RecoverHostEffect have
 // NO admissible scope yet: the operator entries that perform them (pair_serving_authority_establish_wet,
 // host_effect_recover_wet) select operator approval (gunbc.auth.privileged_effect_census). The
 // recover, finalize and abort flows are d0_store_operation_wall PR 5b, which the flip depends on, so
@@ -144,15 +149,15 @@ fn operation_requirement(operation: StoreOperation) -> OperationRequirement {
     ReleaseHostEffect => WorkloadGrantRequired { target: host_effect_position }
     EstablishAuthority => ApprovedScopeRequired { admissible: [] as List<AuthorizationScope> }
     RecoverHostEffect => ApprovedScopeRequired { admissible: [] as List<AuthorizationScope> }
-    TransitionAuthority => ApprovedScopeRequired { admissible: [d0_required_scope()] }
-    RecordEntryState => ApprovedScopeRequired { admissible: [d0_required_scope()] }
-    CancelAppend => ApprovedScopeRequired { admissible: [d0_required_scope()] }
-    PreparePlacement => ApprovedScopeRequired { admissible: [d0_required_scope()] }
-    ClaimPlacementAppend => ApprovedScopeRequired { admissible: [d0_required_scope()] }
-    FinalizePlacement => ApprovedScopeRequired { admissible: [d0_required_scope()] }
-    AbortPlacement => ApprovedScopeRequired { admissible: [d0_required_scope()] }
-    ClaimConsent => ApprovedScopeRequired { admissible: [d0_required_scope()] }
-    FreezeConsentFiling => ApprovedScopeRequired { admissible: [d0_required_scope()] }
+    TransitionAuthority => ApprovedScopeRequired { admissible: [] as List<AuthorizationScope> }
+    RecordEntryState => ApprovedScopeRequired { admissible: [] as List<AuthorizationScope> }
+    CancelAppend => ApprovedScopeRequired { admissible: [] as List<AuthorizationScope> }
+    PreparePlacement => ApprovedScopeRequired { admissible: [] as List<AuthorizationScope> }
+    ClaimPlacementAppend => ApprovedScopeRequired { admissible: [] as List<AuthorizationScope> }
+    FinalizePlacement => ApprovedScopeRequired { admissible: [] as List<AuthorizationScope> }
+    AbortPlacement => ApprovedScopeRequired { admissible: [] as List<AuthorizationScope> }
+    ClaimConsent => ApprovedScopeRequired { admissible: [] as List<AuthorizationScope> }
+    FreezeConsentFiling => ApprovedScopeRequired { admissible: [] as List<AuthorizationScope> }
   }
 }
 
diff --git a/dag/gunbc/fabric/workspace_checkpoint_instrument.dag b/dag/gunbc/fabric/workspace_checkpoint_instrument.dag
index 26834bbad79..2d90bd63902 100644
--- a/dag/gunbc/fabric/workspace_checkpoint_instrument.dag
+++ b/dag/gunbc/fabric/workspace_checkpoint_instrument.dag
@@ -62,7 +62,7 @@ import gunbc.fabric.fabric_object_r2 {
   put_fabric_object_r2, get_fabric_object_r2,
   FabricObjectR2PutVerdict, FabricObjectR2Stored, FabricObjectR2PresentVerified, FabricObjectR2OccupiedByOther, FabricObjectR2Refused, FabricObjectR2OutcomeUnknown,
 }
-import gunbc.fabric.workspace_source { fabric_workspace_source_key, workspace_put_words, workspace_put_landed }
+import gunbc.fabric.workspace_source { fabric_workspace_source_key, workspace_put_words, workspace_put_landed, workspace_transcript_caveat }
 import gunbc.fabric_storage_r2_head {
   R2HeadBinding, R2HeadCredential, r2_head_binding, r2_head_read, r2_head_advance, r2_head_fabric_advance,
   R2HeadAdvanceResult, R2HeadAdvanceKnown, R2HeadAdvanceOutcomeUnknown, R2HeadStagingCustody, r2_head_staging_of,
@@ -204,19 +204,39 @@ fn workspace_part_words(p: WorkspaceMeasuredPart) -> String {
   }
 }
 
-fn workspace_bound_words(name: String, parts: List<WorkspaceMeasuredPart>, v: WorkspaceBoundVerdict) -> String {
-  let inputs = join(map(parts, p => workspace_part_words(p: p)), " + ")
-  match v {
-    BoundHolds { total: t, bound: b } => join([name, "=holds total=", workspace_ms_words(n: t), " bound=", workspace_ms_words(n: b), " inputs: ", inputs], "")
-    BoundExceeded { at_least: t, bound: b, complete: c } => join([name, "=exceeded at_least=", workspace_ms_words(n: t), " bound=", workspace_ms_words(n: b), if c { " complete" } else { " by-measured-parts-alone" }, " inputs: ", inputs], "")
-    BoundUndecided { measured: t, bound: b, missing: m } => join([name, "=undecided measured=", workspace_ms_words(n: t), " bound=", workspace_ms_words(n: b), " missing: ", join(m, "; "), " inputs: ", inputs], "")
-  }
+// THE BOUND VERDICTS ARE WITHHELD WHILE THE SUBJECT IS A STATIC TREE WITH SYNTHETIC TRANSCRIPTS.
+// The source pack (gunbc.fabric.workspace_source) carries transcript content as same-size
+// placeholders and the tree does not change while it is measured, so a time over it says nothing
+// about checkpointing a workspace whose transcripts are being appended: the 10 s target and the 60 s
+// window are not decided by this run, holding or exceeded, and each line says so beside its measured
+// inputs. The quota is a size, and the placeholders preserve size, so the 10 GB quota is decided --
+// over the static tree, and labelled static. workspace_bound_verdict above is the fold these lines
+// will print once a churn phase measures appends (the later churn child of this lane); until then
+// it is exercised by its witness and by nothing that prints.
+fn workspace_withheld_bound_words(name: String, parts: List<WorkspaceMeasuredPart>, bound: Nanosecond) -> String {
+  join([name, "=withheld: churn not measured static_measured=", workspace_ms_words(n: workspace_parts_measured(parts: parts)), " bound=", workspace_ms_words(n: bound), " inputs: ", join(map(parts, p => workspace_part_words(p: p)), " + ")], "")
+}
+
+// THE DRAFT-NUMBER BLOCK OF THE MEASURE RECEIPT: the caveat, the four withheld bound lines, and the
+// static quota line (or why it is undecided).
+fn workspace_draft_verdict_lines(snapshot_parts: List<WorkspaceMeasuredPart>, scan_parts: List<WorkspaceMeasuredPart>, static_size: ByteSize?, n: WorkspaceDraftNumbers) -> String {
+  join([
+    workspace_transcript_caveat as String, "\n",
+    workspace_withheld_bound_words(name: "snapshot_path_vs_target", parts: snapshot_parts, bound: n.checkpoint_target), "\n",
+    workspace_withheld_bound_words(name: "snapshot_path_vs_window", parts: snapshot_parts, bound: n.window), "\n",
+    workspace_withheld_bound_words(name: "scan_path_vs_target", parts: scan_parts, bound: n.checkpoint_target), "\n",
+    workspace_withheld_bound_words(name: "scan_path_vs_window", parts: scan_parts, bound: n.window), "\n",
+    match static_size {
+      Present { value: b } => workspace_quota_words(v: workspace_quota_verdict(size: b, quota: n.quota))
+      Absent => "quota_static=undecided (the upload refused, so no byte total was established)"
+    }, "\n",
+  ], "")
 }
 
 fn workspace_quota_words(v: WorkspaceQuotaVerdict) -> String {
   match v {
-    QuotaHolds { size: n, quota: q } => join(["quota=holds bytes=", to_string(measure_count(m: n)), " quota_bytes=", to_string(measure_count(m: q))], "")
-    QuotaExceeded { size: n, quota: q } => join(["quota=exceeded bytes=", to_string(measure_count(m: n)), " quota_bytes=", to_string(measure_count(m: q))], "")
+    QuotaHolds { size: n, quota: q } => join(["quota_static=holds bytes=", to_string(measure_count(m: n)), " quota_bytes=", to_string(measure_count(m: q))], "")
+    QuotaExceeded { size: n, quota: q } => join(["quota_static=exceeded bytes=", to_string(measure_count(m: n)), " quota_bytes=", to_string(measure_count(m: q))], "")
   }
 }
 
@@ -1008,9 +1028,9 @@ fn workspace_measure_report(workspace: NonEmptyStr, snapshot: NonEmptyStr, scrat
       join(["files=", to_string(length(es)), " bytes=", to_string(measure_count(m: b)), " chunks_uploaded=", to_string(st), " chunks_already_present=", to_string(oc), " symlinks_not_carried=", to_string(sl), " ", workspace_part_words(p: upload_timed)], "")
     WorkspaceUploadRefused { detail: d, custody: _ } => join(["upload=refused ", d], "")
   }
-  let quota_line = match upload {
-    WorkspaceUploaded { entries: _, stored: _, occupied: _, bytes: b, symlinks: _, custody: _ } => workspace_quota_words(v: workspace_quota_verdict(size: b, quota: n.quota))
-    WorkspaceUploadRefused { detail: _, custody: _ } => "quota=undecided (the upload refused, so no byte total was established)"
+  let static_size = match upload {
+    WorkspaceUploaded { entries: _, stored: _, occupied: _, bytes: b, symlinks: _, custody: _ } => Present { value: b }
+    WorkspaceUploadRefused { detail: _, custody: _ } => none
   }
   let cleanup = join([
     "cleanup snapshot=", if process_ok(run: workspace_run_local(command: btrfs_subvolume_delete_command(path: snapshot as String))) { "deleted" } else { "retained" },
@@ -1023,11 +1043,7 @@ fn workspace_measure_report(workspace: NonEmptyStr, snapshot: NonEmptyStr, scrat
     kopia_scan_words(scan: scan), "\n",
     upload_words, "\n",
     "commit=", match timed_commit.commit { Present { value: c } => workspace_commit_words(c: c)  Absent => "not-attempted" }, " ", workspace_part_words(p: timed_commit.part), "\n",
-    workspace_bound_words(name: "snapshot_path_vs_target", parts: snapshot_parts, v: workspace_bound_verdict(parts: snapshot_parts, bound: n.checkpoint_target)), "\n",
-    workspace_bound_words(name: "snapshot_path_vs_window", parts: snapshot_parts, v: workspace_bound_verdict(parts: snapshot_parts, bound: n.window)), "\n",
-    workspace_bound_words(name: "scan_path_vs_target", parts: scan_parts, v: workspace_bound_verdict(parts: scan_parts, bound: n.checkpoint_target)), "\n",
-    workspace_bound_words(name: "scan_path_vs_window", parts: scan_parts, v: workspace_bound_verdict(parts: scan_parts, bound: n.window)), "\n",
-    quota_line, "\n",
+    workspace_draft_verdict_lines(snapshot_parts: snapshot_parts, scan_parts: scan_parts, static_size: static_size, n: n),
     cleanup, "\n",
     workspace_custody_words(c: run_custody), "\n",
   ], "")
diff --git a/dag/gunbc/fabric/workspace_source.dag b/dag/gunbc/fabric/workspace_source.dag
index ee02a550ef0..ab8f3a909fb 100644
--- a/dag/gunbc/fabric/workspace_source.dag
+++ b/dag/gunbc/fabric/workspace_source.dag
@@ -1,12 +1,13 @@
 module gunbc.fabric.workspace_source
 
-import std.types { String, NonEmptyStr, Int, Bool, List, FilePath }
+import std.types { String, NonEmptyStr, Int, Bool, List, Map, FilePath }
+import v2.std.collection { empty_map, map_insert, map_lookup, map_contains_key }
 import std.optional { Present, Absent }
 import std.algebra { Cons, Empty }
 import std.process { ProcessExit, ExitSuccess, exit_failure }
 import std.measure { ByteSize, byte_size, measure_count, nanosecond, nanosecond_count, ObservationInstant, ProcessMonotonic, WallClock }
 import std.checkpointed_workspace { WorkspaceAgeOf, WorkspaceAgeUndefined, workspace_age_between }
-import std.content_hash { Sha256Digest }
+import std.content_hash { Sha256Digest, sha256_hex_digest }
 import std.fabric_blob {
   FabricBlobAddress, FabricBlobReading, fabric_blob_object_name, fabric_blob_reading_digest, fabric_blob_reading_size,
   FabricBlobRead, FabricBlobReadRefused, read_staged_fabric_blob, fabric_blob_fault_text,
@@ -16,7 +17,9 @@ import extdeps.filesystem.filesystem_io { Filesystem }
 import extdeps.shell
 import extdeps.shell.exec { ProcessRunOutcome, ProcessRan, ProcessNotSpawned }
 import extdeps.exec.command { CommandTransport, LocalExec }
-import extdeps.tools.tar { tar_create_from_list_command, tar_list_command }
+import extdeps.tools.tar { tar_create_from_two_lists_command, tar_list_command, tar_list_sizes_command, tar_extract_listed_command }
+import extdeps.tools.sha256sum
+import extdeps.crypto.seeded_filler { seeded_filler_write, SeededFillerWritten, SeededFillerRefused, seeded_filler_step_words }
 import gunbc.command_runner { run_shell_command_observe_outcome }
 import gunbc.auth.access_token_source { AccessTokenSource, AccessTokenSourceSelected, AccessTokenSourceUnavailable, select_access_token_source }
 import gunbc.cloudflare.r2_origin { FabricWorkspace }
@@ -33,8 +36,10 @@ import gunbc.host_effect { LocalShell }
 // directory. No session holds a key that reaches both, and none is minted for this: the route is two
 // dispatched jobs through the workspace bucket. This module is the first job. On srv1 it enumerates
 // the source roots as the runner's own principal, drops every path the credential exclusion names
-// and every build output, packs exactly what remains into one tar from that list, reads the tar's
-// membership back and refuses if any member is excluded, and puts the tar into the workspace bucket
+// and every build output, stands a same-size, same-path synthetic placeholder in for every
+// transcript file, packs the real members and the placeholders into one tar, reads the tar's
+// membership and sizes back and refuses if any credential is carried or any transcript member is not
+// its placeholder at its planned size, and puts the tar into the workspace bucket
 // under the SHA-256 of its bytes. The srv3 job is dispatched with that address and fetches it.
 //
 // A ROOT THE RUNNER CANNOT READ REFUSES, NAMING WHAT IS MISSING. The enumeration runs as the job
@@ -53,16 +58,76 @@ type WorkspaceSourceRoot {
 }
 
 // THE SRV1 HOST PATHS, pinned rather than guessed (warm-badger-442, 2026-10-05, read from a session's
-// mountinfo on node srv1). Agent state is per auth slot on the host -- /home/briansrls/.claude@<slot>,
-// mounted at /session-home/.claude inside session containers -- so the slot is part of the declared
-// input: @gmail3 is the slot whose state the 2026-10-02 figures measured. The Codex root is its home
-// directory; its auth file is excluded as a credential and its sessions and history as transcripts.
-data workspace_source_roots: List<WorkspaceSourceRoot> = [
+// mountinfo on node srv1). The clone and the Codex home are fixed; the Codex auth file is excluded as
+// a credential and its sessions and history as transcripts.
+data workspace_source_fixed_roots: List<WorkspaceSourceRoot> = [
   WorkspaceSourceRoot { label: "gunbc-clone", path: "/home/briansrls/gunbc", build_output: ["target/"] },
-  WorkspaceSourceRoot { label: "claude-agent-state-gmail3", path: "/home/briansrls/.claude@gmail3", build_output: [] },
   WorkspaceSourceRoot { label: "codex-state", path: "/home/briansrls/.codex", build_output: [] },
 ]
 
+// ── THE AGENT-STATE ROOT: A DECLARED INPUT, ADMITTED AGAINST WHAT EXISTS (warm-badger-442) ───────
+//
+// Claude agent state lives per auth slot, /home/briansrls/.claude@<slot> (mounted at
+// /session-home/.claude inside session containers), and the operator's credential swaps move WHICH
+// slot is active -- so the slot is not a constant of this module. It is the dispatch input
+// agent_state_slot (environment WORKSPACE_AGENT_STATE_SLOT), and it is admitted only when it names
+// one of the .claude@* directories observed in the home at pack time: a closed choice over what
+// exists. There is no default and no fallback to "the active one": an absent or unknown slot refuses,
+// naming the observed slots, and the admitted slot and its path are printed in the receipt.
+data workspace_agent_state_slot_env: NonEmptyStr = "WORKSPACE_AGENT_STATE_SLOT"
+
+data workspace_agent_state_home: NonEmptyStr = "/home/briansrls"
+
+data workspace_agent_state_prefix: NonEmptyStr = ".claude@"
+
+type WorkspaceAgentStateSlot
+  = AgentStateSlotAdmitted { slot: NonEmptyStr, root: WorkspaceSourceRoot }
+  | AgentStateSlotAbsent { observed: List<String> }
+  | AgentStateSlotUnknown { requested: String, observed: List<String> }
+
+// THE SLOTS A HOME LISTING HOLDS: each directory whose last segment is .claude@<slot>, <slot> nonempty.
+fn workspace_observed_agent_state_slots(dirs: List<String>) -> List<String> {
+  flat_map(dirs, d => {
+    let last = match reverse(split(d, separator: "/")) { Cons { head: h, tail: _ } => h  Empty => "" }
+    let prefix = workspace_agent_state_prefix as String
+    if starts_with(s: last, prefix: prefix) && length(last) > length(prefix) { [substring(s: last, start: length(prefix), end: length(last))] } else { [] }
+  })
+}
+
+fn workspace_agent_state_slot_admission(requested: String?, observed: List<String>) -> WorkspaceAgentStateSlot {
+  match requested {
+    Absent => AgentStateSlotAbsent { observed: observed }
+    Present { value: r } =>
+      if r == "" {
+        AgentStateSlotAbsent { observed: observed }
+      } else if any(observed, o => o == r) {
+        AgentStateSlotAdmitted {
+          slot: r as NonEmptyStr,
+          root: WorkspaceSourceRoot { label: concat("claude-agent-state-", r) as NonEmptyStr, path: join([workspace_agent_state_home as String, "/", workspace_agent_state_prefix as String, r], "") as NonEmptyStr, build_output: [] },
+        }
+      } else {
+        AgentStateSlotUnknown { requested: r, observed: observed }
+      }
+  }
+}
+
+fn workspace_agent_state_slot_words(admission: WorkspaceAgentStateSlot) -> String {
+  match admission {
+    AgentStateSlotAdmitted { slot: s, root: r } => join(["agent_state_slot=", s as String, " path=", r.path as String], "")
+    AgentStateSlotAbsent { observed: o } => join(["agent_state_slot=refused-absent observed=", join(o, ","), " (", workspace_agent_state_slot_env as String, " names no slot; there is no default)"], "")
+    AgentStateSlotUnknown { requested: r, observed: o } => join(["agent_state_slot=refused-unknown requested=", r, " observed=", join(o, ","), " (no ", workspace_agent_state_home as String, "/", workspace_agent_state_prefix as String, r, " exists)"], "")
+  }
+}
+
+fn workspace_agent_state_slot_observe() -> WorkspaceAgentStateSlot {
+  let requested = match shell.Env.Get(name: workspace_agent_state_slot_env).value {
+    Absent => none
+    Present { value: v } => Present { value: replace(v, "\n", "") }
+  }
+  let dirs = shell.Find.ListDirs(path: workspace_agent_state_home as FilePath)
+  workspace_agent_state_slot_admission(requested: requested, observed: workspace_observed_agent_state_slots(dirs: map(dirs.dirs, d => d as String)))
+}
+
 data workspace_source_pack_host: NonEmptyStr = "srv1"
 
 // ── THE CREDENTIAL EXCLUSION: ONE ROW, LISTED VERBATIM IN EVERY RECEIPT ────────────────────────
@@ -229,7 +294,7 @@ type WorkspaceSourceMemberKind = SourceFile | SourceSymlink
 
 type WorkspaceSourceLine
   = WorkspaceSourceMember { member: NonEmptyStr, kind: WorkspaceSourceMemberKind }
-  | WorkspaceSourceExcluded { member: NonEmptyStr, by: WorkspaceExclusion, bytes: ByteSize }
+  | WorkspaceSourceExcluded { member: NonEmptyStr, kind: WorkspaceSourceMemberKind, by: WorkspaceExclusion, bytes: ByteSize }
   | WorkspaceSourceBuildOutput { member: NonEmptyStr }
   | WorkspaceSourceUnparsed { line: String }
 
@@ -256,19 +321,23 @@ fn workspace_source_line(root: WorkspaceSourceRoot, exclusions: List<WorkspaceEx
   }
 }
 
+fn workspace_source_member_kind(kind: String) -> WorkspaceSourceMemberKind? {
+  if kind == "f" { Present { value: SourceFile } } else if kind == "l" { Present { value: SourceSymlink } } else { none }
+}
+
 fn workspace_source_line_sized(root: WorkspaceSourceRoot, exclusions: List<WorkspaceExclusion>, kind: String, relative: String, size: ByteSize, line: String) -> WorkspaceSourceLine {
   let member = workspace_root_member(root: root, relative: relative) as NonEmptyStr
-  match workspace_path_exclusion(exclusions: exclusions, path: member as String) {
-    Present { value: x } => WorkspaceSourceExcluded { member: member, by: x, bytes: size }
-    Absent =>
-      if workspace_path_is_build_output(root: root, relative: relative) {
-        WorkspaceSourceBuildOutput { member: member }
-      } else if kind == "f" {
-        WorkspaceSourceMember { member: member, kind: SourceFile }
-      } else if kind == "l" {
-        WorkspaceSourceMember { member: member, kind: SourceSymlink }
-      } else {
-        WorkspaceSourceUnparsed { line: line }
+  match workspace_source_member_kind(kind: kind) {
+    Absent => WorkspaceSourceUnparsed { line: line }
+    Present { value: k } =>
+      match workspace_path_exclusion(exclusions: exclusions, path: member as String) {
+        Present { value: x } => WorkspaceSourceExcluded { member: member, kind: k, by: x, bytes: size }
+        Absent =>
+          if workspace_path_is_build_output(root: root, relative: relative) {
+            WorkspaceSourceBuildOutput { member: member }
+          } else {
+            WorkspaceSourceMember { member: member, kind: k }
+          }
       }
   }
 }
@@ -283,6 +352,7 @@ type WorkspaceSourceTally {
   excluded_credential_bytes: ByteSize
   excluded_transcripts: Int
   excluded_transcript_bytes: ByteSize
+  transcript_placeholders: List<WorkspaceTranscriptPlaceholder>
   build_output: Int
   unparsed: List<String>
 }
@@ -290,7 +360,7 @@ type WorkspaceSourceTally {
 // THE EXCLUDED SIZES OF ONE CLASS, partitioned by matching the class itself.
 fn workspace_excluded_sizes(lines: List<WorkspaceSourceLine>, class: WorkspaceExclusionClass) -> List<ByteSize> {
   flat_map(lines, l => match l {
-    WorkspaceSourceExcluded { member: _, by: x, bytes: b } =>
+    WorkspaceSourceExcluded { member: _, kind: _, by: x, bytes: b } =>
       match class {
         CredentialExclusion => match x.class { CredentialExclusion => [b]  TranscriptExclusion => [] }
         TranscriptExclusion => match x.class { CredentialExclusion => []  TranscriptExclusion => [b] }
@@ -301,6 +371,38 @@ fn workspace_excluded_sizes(lines: List<WorkspaceSourceLine>, class: WorkspaceEx
   })
 }
 
+// ── TRANSCRIPT PLACEHOLDERS: THE SIZE AND PATH CARRIED, THE CONTENT NOT (operator, 2026-10-05) ───
+//
+// Transcripts are the workspace's largest and highest-churn population, so dropping them would make
+// stage 0 describe a cheaper workspace than the operator's. Each excluded transcript FILE is carried
+// as a placeholder at the SAME member path with the SAME byte size, its bytes the seeded keystream
+// of extdeps.crypto.seeded_filler keyed by the member path: incompressible, so neither kopia nor the
+// chunk store's dedup sees less than the real content would cost, and reproducible, so two packs of
+// one unchanged tree carry identical placeholders. A placeholder is minted ONLY from a line the
+// TranscriptExclusion class excluded, and the match below has no arm that mints one from a
+// credential, so a credential's path and size never appear in the archive. A transcript SYMLINK
+// carries no content to stand in for and is excluded as before. What a placeholder cannot carry is
+// stated, not implied: the content's compressibility and its churn; the receipt says so.
+type WorkspaceTranscriptPlaceholder {
+  member: NonEmptyStr
+  size: ByteSize
+}
+
+fn workspace_transcript_placeholders(lines: List<WorkspaceSourceLine>) -> List<WorkspaceTranscriptPlaceholder> {
+  flat_map(lines, l => match l {
+    WorkspaceSourceExcluded { member: m, kind: k, by: x, bytes: b } =>
+      match x.class {
+        CredentialExclusion => []
+        TranscriptExclusion => match k { SourceFile => [WorkspaceTranscriptPlaceholder { member: m, size: b }]  SourceSymlink => [] }
+      }
+    WorkspaceSourceMember { member: _, kind: _ } => []
+    WorkspaceSourceBuildOutput { member: _ } => []
+    WorkspaceSourceUnparsed { line: _ } => []
+  })
+}
+
+data workspace_transcript_caveat: NonEmptyStr = "transcript content synthetic, sizes preserved, static tree; NOT a 10 s / 60 s verdict"
+
 fn workspace_bytes_total(sizes: List<ByteSize>) -> ByteSize {
   byte_size(count: fold(sizes, init: 0, f: (acc, b) => acc + measure_count(m: b)))
 }
@@ -310,16 +412,16 @@ fn workspace_source_tally(root: WorkspaceSourceRoot, exclusions: List<WorkspaceE
   WorkspaceSourceTally {
     members: flat_map(lines, l => match l {
       WorkspaceSourceMember { member: m, kind: _ } => [m]
-      WorkspaceSourceExcluded { member: _, by: _, bytes: _ } => []
+      WorkspaceSourceExcluded { member: _, kind: _, by: _, bytes: _ } => []
       WorkspaceSourceBuildOutput { member: _ } => []
       WorkspaceSourceUnparsed { line: _ } => []
     }),
-    files: length(filter(lines, l => match l { WorkspaceSourceMember { member: _, kind: SourceFile } => true  WorkspaceSourceMember { member: _, kind: SourceSymlink } => false  WorkspaceSourceExcluded { member: _, by: _, bytes: _ } => false  WorkspaceSourceBuildOutput { member: _ } => false  WorkspaceSourceUnparsed { line: _ } => false })),
-    symlinks: length(filter(lines, l => match l { WorkspaceSourceMember { member: _, kind: SourceSymlink } => true  WorkspaceSourceMember { member: _, kind: SourceFile } => false  WorkspaceSourceExcluded { member: _, by: _, bytes: _ } => false  WorkspaceSourceBuildOutput { member: _ } => false  WorkspaceSourceUnparsed { line: _ } => false })),
-    excluded: length(filter(lines, l => match l { WorkspaceSourceExcluded { member: _, by: _, bytes: _ } => true  WorkspaceSourceMember { member: _, kind: _ } => false  WorkspaceSourceBuildOutput { member: _ } => false  WorkspaceSourceUnparsed { line: _ } => false })),
+    files: length(filter(lines, l => match l { WorkspaceSourceMember { member: _, kind: SourceFile } => true  WorkspaceSourceMember { member: _, kind: SourceSymlink } => false  WorkspaceSourceExcluded { member: _, kind: _, by: _, bytes: _ } => false  WorkspaceSourceBuildOutput { member: _ } => false  WorkspaceSourceUnparsed { line: _ } => false })),
+    symlinks: length(filter(lines, l => match l { WorkspaceSourceMember { member: _, kind: SourceSymlink } => true  WorkspaceSourceMember { member: _, kind: SourceFile } => false  WorkspaceSourceExcluded { member: _, kind: _, by: _, bytes: _ } => false  WorkspaceSourceBuildOutput { member: _ } => false  WorkspaceSourceUnparsed { line: _ } => false })),
+    excluded: length(filter(lines, l => match l { WorkspaceSourceExcluded { member: _, kind: _, by: _, bytes: _ } => true  WorkspaceSourceMember { member: _, kind: _ } => false  WorkspaceSourceBuildOutput { member: _ } => false  WorkspaceSourceUnparsed { line: _ } => false })),
     excluded_credentials: length(workspace_excluded_sizes(lines: lines, class: CredentialExclusion)),
     excluded_credential_members: flat_map(lines, l => match l {
-      WorkspaceSourceExcluded { member: m, by: x, bytes: _ } => match x.class { CredentialExclusion => [m]  TranscriptExclusion => [] }
+      WorkspaceSourceExcluded { member: m, kind: _, by: x, bytes: _ } => match x.class { CredentialExclusion => [m]  TranscriptExclusion => [] }
       WorkspaceSourceMember { member: _, kind: _ } => []
       WorkspaceSourceBuildOutput { member: _ } => []
       WorkspaceSourceUnparsed { line: _ } => []
@@ -327,37 +429,154 @@ fn workspace_source_tally(root: WorkspaceSourceRoot, exclusions: List<WorkspaceE
     excluded_credential_bytes: workspace_bytes_total(sizes: workspace_excluded_sizes(lines: lines, class: CredentialExclusion)),
     excluded_transcripts: length(workspace_excluded_sizes(lines: lines, class: TranscriptExclusion)),
     excluded_transcript_bytes: workspace_bytes_total(sizes: workspace_excluded_sizes(lines: lines, class: TranscriptExclusion)),
-    build_output: length(filter(lines, l => match l { WorkspaceSourceBuildOutput { member: _ } => true  WorkspaceSourceMember { member: _, kind: _ } => false  WorkspaceSourceExcluded { member: _, by: _, bytes: _ } => false  WorkspaceSourceUnparsed { line: _ } => false })),
+    transcript_placeholders: workspace_transcript_placeholders(lines: lines),
+    build_output: length(filter(lines, l => match l { WorkspaceSourceBuildOutput { member: _ } => true  WorkspaceSourceMember { member: _, kind: _ } => false  WorkspaceSourceExcluded { member: _, kind: _, by: _, bytes: _ } => false  WorkspaceSourceUnparsed { line: _ } => false })),
     unparsed: flat_map(lines, l => match l {
       WorkspaceSourceUnparsed { line: t } => [t]
       WorkspaceSourceMember { member: _, kind: _ } => []
-      WorkspaceSourceExcluded { member: _, by: _, bytes: _ } => []
+      WorkspaceSourceExcluded { member: _, kind: _, by: _, bytes: _ } => []
       WorkspaceSourceBuildOutput { member: _ } => []
     }),
   }
 }
 
-// ── THE READBACK: AN ARCHIVE MEMBER THE EXCLUSION NAMES REFUSES THE UPLOAD ─────────────────────
+// ── THE READBACK: WHAT THE ARCHIVE ACTUALLY HOLDS, BEFORE ANY BYTE LEAVES THE HOST ─────────────
 //
-// The pack is built from the filtered list, so an excluded path should never be in it; this reads
-// what the archive ACTUALLY holds (tar -tf) and runs every member through the same matcher. It is the
-// check that the realization did what the list said -- a tar that recursed, or a list that was not
-// the one written -- and its red is the run's refusal, before any byte leaves the host.
+// The pack is built from the filtered lists, so a credential should never be in it and a transcript
+// should be there only as its placeholder. That is provenance by construction, and it is NOT enough
+// at a confidentiality boundary: a name and a size are exactly what a real transcript shares with
+// its placeholder. So this reads what the archive ACTUALLY holds and refuses otherwise. Names come
+// from `tar -tf` (archive_listing) and run through the same matcher: a credential-class name refuses
+// outright, and a transcript-class name refuses unless it is a staged placeholder. Every staged
+// placeholder must then be, IN THE ARCHIVE, a regular file (the verbose listing's own type letter,
+// size_listing) of its planned size whose bytes -- extracted back out of the archive and hashed,
+// archived_digests -- are the SHA-256 the filler produced when it was staged. A real transcript of
+// the same size differs in digest and refuses. Each failure is its own typed refusal.
+type WorkspaceStagedPlaceholder {
+  member: NonEmptyStr
+  size: ByteSize
+  expected_digest: Sha256Digest
+}
+
 type WorkspacePackReadback
   = WorkspacePackClean { members: Int }
   | WorkspacePackCarriesExcluded { member: NonEmptyStr, by: WorkspaceExclusion }
+  | WorkspacePackPlaceholderAbsent { member: NonEmptyStr }
+  | WorkspacePackPlaceholderNotRegular { member: NonEmptyStr, type_letter: String }
+  | WorkspacePackPlaceholderSizeDiffers { member: NonEmptyStr, planned: ByteSize, archived: ByteSize }
+  | WorkspacePackPlaceholderUnread { member: NonEmptyStr }
+  | WorkspacePackPlaceholderDigestDiffers { member: NonEmptyStr, expected: Sha256Digest, archived: String }
 
-fn workspace_pack_readback(exclusions: List<WorkspaceExclusion>, archive_listing: String) -> WorkspacePackReadback {
-  workspace_pack_readback_lines(exclusions: exclusions, lines: filter(split(archive_listing, separator: "\n"), l => l != ""), seen: 0)
+fn workspace_pack_readback(exclusions: List<WorkspaceExclusion>, placeholders: List<WorkspaceStagedPlaceholder>, archive_listing: String, size_listing: String, archived_digests: Map<String, String>) -> WorkspacePackReadback {
+  let planned = fold(placeholders, init: empty_map(), f: (m, p) => map_insert(m: m, key: p.member as String, value: p.size))
+  match workspace_pack_readback_lines(exclusions: exclusions, planned: planned, lines: filter(split(archive_listing, separator: "\n"), l => l != ""), seen: 0) {
+    WorkspacePackClean { members: n } => {
+      let archived = fold(flat_map(filter(split(size_listing, separator: "\n"), l => l != ""), l => workspace_archived_entry(line: l)), init: empty_map(), f: (m, a) => map_insert(m: m, key: a.member, value: a))
+      workspace_pack_placeholder_checks(placeholders: placeholders, archived: archived, digests: archived_digests, members: n)
+    }
+    WorkspacePackCarriesExcluded { member: m, by: x } => WorkspacePackCarriesExcluded { member: m, by: x }
+    WorkspacePackPlaceholderAbsent { member: m } => WorkspacePackPlaceholderAbsent { member: m }
+    WorkspacePackPlaceholderNotRegular { member: m, type_letter: t } => WorkspacePackPlaceholderNotRegular { member: m, type_letter: t }
+    WorkspacePackPlaceholderSizeDiffers { member: m, planned: p, archived: a } => WorkspacePackPlaceholderSizeDiffers { member: m, planned: p, archived: a }
+    WorkspacePackPlaceholderUnread { member: m } => WorkspacePackPlaceholderUnread { member: m }
+    WorkspacePackPlaceholderDigestDiffers { member: m, expected: e, archived: a } => WorkspacePackPlaceholderDigestDiffers { member: m, expected: e, archived: a }
+  }
 }
 
-fn workspace_pack_readback_lines(exclusions: List<WorkspaceExclusion>, lines: List<String>, seen: Int) -> WorkspacePackReadback {
+fn workspace_pack_readback_lines(exclusions: List<WorkspaceExclusion>, planned: Map<String, ByteSize>, lines: List<String>, seen: Int) -> WorkspacePackReadback {
   match lines {
     Empty => WorkspacePackClean { members: seen }
     Cons { head: l, tail: rest } =>
       match workspace_path_exclusion(exclusions: exclusions, path: l) {
-        Present { value: x } => WorkspacePackCarriesExcluded { member: l as NonEmptyStr, by: x }
-        Absent => workspace_pack_readback_lines(exclusions: exclusions, lines: rest, seen: seen + 1)
+        Absent => workspace_pack_readback_lines(exclusions: exclusions, planned: planned, lines: rest, seen: seen + 1)
+        Present { value: x } =>
+          match x.class {
+            CredentialExclusion => WorkspacePackCarriesExcluded { member: l as NonEmptyStr, by: x }
+            TranscriptExclusion =>
+              if map_contains_key(m: planned, key: l) {
+                workspace_pack_readback_lines(exclusions: exclusions, planned: planned, lines: rest, seen: seen + 1)
+              } else {
+                WorkspacePackCarriesExcluded { member: l as NonEmptyStr, by: x }
+              }
+          }
+      }
+  }
+}
+
+// ONE VERBOSE-LISTING LINE: its type letter (the first character of the mode word: '-' a regular
+// file, 'l' a symlink, 'h' a hard link, ...), its size, and its name. Five leading words (mode,
+// uid/gid, size, date, time), each possibly padded by several spaces; the name is the rest of the
+// line verbatim, so a name with spaces survives. A symlink's or hard link's name carries its target
+// after it (" -> t", " link to t"), so such a line never names a placeholder exactly and a planned
+// member archived as one reads as absent -- refused either way.
+type WorkspaceArchivedEntry {
+  member: String
+  type_letter: String
+  size: ByteSize
+}
+
+fn workspace_archived_entry(line: String) -> List<WorkspaceArchivedEntry> {
+  match workspace_verbose_fields(words: split(line, separator: " "), fields: [], wanted: 5) {
+    Absent => []
+    Present { value: parsed } =>
+      match parsed.fields {
+        Cons { head: mode, tail: Cons { head: _, tail: Cons { head: size_text, tail: _ } } } =>
+          match parse_int(s: size_text) {
+            Absent => []
+            Present { value: n } => if n < 0 || parsed.rest == "" { [] } else { [WorkspaceArchivedEntry { member: parsed.rest, type_letter: substring(s: mode, start: 0, end: 1), size: byte_size(count: n) }] }
+          }
+        Cons { head: _, tail: Cons { head: _, tail: Empty } } => []
+        Cons { head: _, tail: Empty } => []
+        Empty => []
+      }
+  }
+}
+
+type WorkspaceVerboseFields {
+  fields: List<String>
+  rest: String
+}
+
+fn workspace_verbose_fields(words: List<String>, fields: List<String>, wanted: Int) -> WorkspaceVerboseFields? {
+  if wanted == 0 {
+    Present { value: WorkspaceVerboseFields { fields: fields, rest: join(words, " ") } }
+  } else {
+    match words {
+      Empty => none
+      Cons { head: w, tail: rest } =>
+        if w == "" {
+          workspace_verbose_fields(words: rest, fields: fields, wanted: wanted)
+        } else {
+          workspace_verbose_fields(words: rest, fields: concat(fields, [w]), wanted: wanted - 1)
+        }
+    }
+  }
+}
+
+// Every side is keyed by member name, so the check is one lookup per placeholder rather than a scan
+// of the archive per placeholder.
+fn workspace_pack_placeholder_checks(placeholders: List<WorkspaceStagedPlaceholder>, archived: Map<String, WorkspaceArchivedEntry>, digests: Map<String, String>, members: Int) -> WorkspacePackReadback {
+  match placeholders {
+    Empty => WorkspacePackClean { members: members }
+    Cons { head: p, tail: rest } =>
+      match map_lookup(m: archived, key: p.member as String) {
+        Absent => WorkspacePackPlaceholderAbsent { member: p.member }
+        Present { value: a } =>
+          if a.type_letter != "-" {
+            WorkspacePackPlaceholderNotRegular { member: p.member, type_letter: a.type_letter }
+          } else if measure_count(m: a.size) != measure_count(m: p.size) {
+            WorkspacePackPlaceholderSizeDiffers { member: p.member, planned: p.size, archived: a.size }
+          } else {
+            match map_lookup(m: digests, key: p.member as String) {
+              Absent => WorkspacePackPlaceholderUnread { member: p.member }
+              Present { value: d } =>
+                if d != (p.expected_digest.hex as String) {
+                  WorkspacePackPlaceholderDigestDiffers { member: p.member, expected: p.expected_digest, archived: d }
+                } else {
+                  workspace_pack_placeholder_checks(placeholders: rest, archived: archived, digests: digests, members: members)
+                }
+            }
+          }
       }
   }
 }
@@ -442,7 +661,7 @@ fn workspace_source_tallies(enumerations: List<WorkspaceSourceEnumeration>) -> L
 fn workspace_tally_line(e: WorkspaceSourceEnumeration) -> String {
   match e {
     WorkspaceSourceEnumerated { root: r, tally: t } =>
-      join(["root ", r.label as String, " path=", r.path as String, " files=", to_string(t.files), " symlinks=", to_string(t.symlinks), " excluded=", to_string(t.excluded), " excluded_credentials=", to_string(t.excluded_credentials), " excluded_credential_bytes=", to_string(measure_count(m: t.excluded_credential_bytes)), " excluded_credential_paths=", join(map(t.excluded_credential_members, m => m as String), ","), " excluded_transcripts=", to_string(t.excluded_transcripts), " excluded_transcript_bytes=", to_string(measure_count(m: t.excluded_transcript_bytes)), " build_output=", to_string(t.build_output)], "")
+      join(["root ", r.label as String, " path=", r.path as String, " files=", to_string(t.files), " symlinks=", to_string(t.symlinks), " excluded=", to_string(t.excluded), " excluded_credentials=", to_string(t.excluded_credentials), " excluded_credential_bytes=", to_string(measure_count(m: t.excluded_credential_bytes)), " excluded_credential_paths=", join(map(t.excluded_credential_members, m => m as String), ","), " excluded_transcripts=", to_string(t.excluded_transcripts), " excluded_transcript_bytes=", to_string(measure_count(m: t.excluded_transcript_bytes)), " transcript_placeholders=", to_string(length(t.transcript_placeholders)), " build_output=", to_string(t.build_output)], "")
     WorkspaceSourceUnreadable { root: r, detail: _ } => join(["root ", r.label as String, " path=", r.path as String, " UNREADABLE"], "")
   }
 }
@@ -471,7 +690,7 @@ fn workspace_source_receipt_head(enumerations: List<WorkspaceSourceEnumeration>)
   join([
     "workspace_source_pack host=", workspace_source_pack_host as String, "\n",
     "credential_exclusions=", workspace_exclusion_spellings(exclusions: workspace_credential_exclusions), "\n",
-    "transcript_exclusions=", workspace_exclusion_spellings(exclusions: workspace_transcript_exclusions), "\n",
+    "transcript_exclusions=", workspace_exclusion_spellings(exclusions: workspace_transcript_exclusions), " (carried as same-size, same-path placeholders)\n",
     join(map(enumerations, e => workspace_tally_line(e: e)), "\n"), "\n",
   ], "")
 }
@@ -500,12 +719,20 @@ fn workspace_source_pack_wet() -> ProcessExit {
   if host != (workspace_source_pack_host as String) {
     exit_failure(reason: join(["workspace_source_pack: the source lives on ", workspace_source_pack_host as String, " but this job runs on '", host, "'; dispatch it with host=", workspace_source_pack_host as String], ""))
   } else {
-    let enumerations = workspace_source_enumerate_all(roots: workspace_source_roots)
-    let head = workspace_source_receipt_head(enumerations: enumerations)
-    match workspace_source_refusals(enumerations: enumerations) {
-      Cons { head: _, tail: _ } =>
-        workspace_source_finish(receipt: concat(head, "verdict=refused-source-unreadable\n"), outcome: exit_failure(reason: join(concat(["workspace_source_pack: a source root is unreadable by the runner; no permission is widened here:"], workspace_source_refusals(enumerations: enumerations)), "\n")))
-      Empty => workspace_source_pack_readable(head: head, tallies: workspace_source_tallies(enumerations: enumerations))
+    let slot = workspace_agent_state_slot_observe()
+    let slot_line = concat(workspace_agent_state_slot_words(admission: slot), "\n")
+    match slot {
+      AgentStateSlotAbsent { observed: _ } => workspace_source_finish(receipt: join(["workspace_source_pack host=", host, "\n", slot_line, "verdict=refused-agent-state-slot\n"], ""), outcome: exit_failure(reason: concat("workspace_source_pack: ", slot_line)))
+      AgentStateSlotUnknown { requested: _, observed: _ } => workspace_source_finish(receipt: join(["workspace_source_pack host=", host, "\n", slot_line, "verdict=refused-agent-state-slot\n"], ""), outcome: exit_failure(reason: concat("workspace_source_pack: ", slot_line)))
+      AgentStateSlotAdmitted { slot: _, root: agent } => {
+        let enumerations = workspace_source_enumerate_all(roots: concat(workspace_source_fixed_roots, [agent]))
+        let head = concat(workspace_source_receipt_head(enumerations: enumerations), slot_line)
+        match workspace_source_refusals(enumerations: enumerations) {
+          Cons { head: _, tail: _ } =>
+            workspace_source_finish(receipt: concat(head, "verdict=refused-source-unreadable\n"), outcome: exit_failure(reason: join(concat(["workspace_source_pack: a source root is unreadable by the runner; no permission is widened here:"], workspace_source_refusals(enumerations: enumerations)), "\n")))
+          Empty => workspace_source_pack_readable(head: head, tallies: workspace_source_tallies(enumerations: enumerations))
+        }
+      }
     }
   }
 }
@@ -515,44 +742,271 @@ fn workspace_source_pack_readable(head: String, tallies: List<WorkspaceSourceTal
   if staging.success == false {
     workspace_source_finish(receipt: concat(head, "verdict=refused-no-staging\n"), outcome: exit_failure(reason: "workspace_source_pack: no private staging directory could be minted"))
   } else {
-    let list_path = join([staging.path as String, "/members"], "")
-    let archive = join([staging.path as String, "/workspace-source.tar"], "")
-    let members = flat_map(tallies, t => t.members)
+    let placeholders = flat_map(tallies, t => t.transcript_placeholders)
+    let placeholder_root = join([staging.path as String, "/placeholders"], "")
+    let head2 = concat(head, workspace_placeholder_words(placeholders: placeholders))
+    match workspace_stage_placeholders(root: placeholder_root, placeholders: placeholders, staged: []) {
+      WorkspacePlaceholdersRefused { why: why } => {
+        let removed = shell.Remove.RecursiveForce(path: staging.path)
+        workspace_source_finish(receipt: join([head2, "verdict=refused-placeholder-unstaged staging_removed=", if removed.success { "yes" } else { "no" }, "\n"], ""), outcome: exit_failure(reason: concat("workspace_source_pack: a transcript placeholder could not be staged: ", why)))
+      }
+      WorkspacePlaceholdersStaged { placeholders: staged } => {
+        let pack_start = workspace_source_instant(label: "workspace-source-pack-start")
+        let built = workspace_pack_archive(staging: staging.path as String, members: flat_map(tallies, t => t.members), placeholders: staged, placeholder_root: placeholder_root)
+        let pack_span = workspace_source_span_words(start: pack_start, end_label: "workspace-source-pack-end")
+        match built {
+          WorkspacePackRefused { refusal: v, why: why } => workspace_source_refuse_archive(head: head2, staging: staging.path as String, refusal: v, why: why)
+          WorkspacePackBuilt { archive: archive, readback: r } =>
+            match workspace_pack_readback_refusal(readback: r) {
+              Present { value: refusal } => workspace_source_refuse_archive(head: head2, staging: staging.path as String, refusal: refusal.refusal, why: refusal.why)
+              Absent => workspace_source_publish(head: concat(head2, join(["archive_members=", to_string(workspace_pack_clean_members(readback: r)), " placeholders_digest_checked=", to_string(length(staged)), " pack=", pack_span, "\n"], "")), archive: archive, staging: staging.path as String)
+            }
+        }
+      }
+    }
+  }
+}
+
+fn workspace_placeholder_words(placeholders: List<WorkspaceTranscriptPlaceholder>) -> String {
+  join([
+    "transcript_placeholders files=", to_string(length(placeholders)),
+    " bytes=", to_string(measure_count(m: workspace_bytes_total(sizes: map(placeholders, p => p.size)))),
+    " filler=extdeps.crypto.seeded_filler seed=member-path\n",
+    workspace_transcript_caveat as String, "\n",
+  ], "")
+}
+
+type WorkspacePlaceholderStaging
+  = WorkspacePlaceholdersStaged { placeholders: List<WorkspaceStagedPlaceholder> }
+  | WorkspacePlaceholdersRefused { why: String }
+
+// EACH PLACEHOLDER AT <root>/<member>, its parent directories made first, and its SHA-256 taken from
+// the staged bytes: that digest is what the archive readback requires the archived member to hash
+// to. The first refusal stops the staging; nothing is packed from a partly staged tree.
+fn workspace_stage_placeholders(root: String, placeholders: List<WorkspaceTranscriptPlaceholder>, staged: List<WorkspaceStagedPlaceholder>) -> WorkspacePlaceholderStaging {
+  match placeholders {
+    Empty => WorkspacePlaceholdersStaged { placeholders: staged }
+    Cons { head: p, tail: rest } => {
+      let path = join([root, "/", p.member as String], "")
+      let parent = join(workspace_all_but_last(xs: split(path, separator: "/")), "/")
+      let made = shell.Mkdir.Parents(path: parent as FilePath)
+      if made.success == false {
+        WorkspacePlaceholdersRefused { why: concat("mkdir -p failed: ", parent) }
+      } else {
+        match seeded_filler_write(seed: p.member, size: p.size, path: path as NonEmptyStr) {
+          SeededFillerRefused { path: _, step: st, detail: d } => WorkspacePlaceholdersRefused { why: join([p.member as String, ": ", seeded_filler_step_words(step: st), ": ", d], "") }
+          SeededFillerWritten { path: _, size: _ } =>
+            match workspace_file_digest(path: path) {
+              Absent => WorkspacePlaceholdersRefused { why: concat("the staged placeholder could not be hashed: ", p.member as String) }
+              Present { value: d } => workspace_stage_placeholders(root: root, placeholders: rest, staged: concat(staged, [WorkspaceStagedPlaceholder { member: p.member, size: p.size, expected_digest: d }]))
+            }
+        }
+      }
+    }
+  }
+}
+
+fn workspace_file_digest(path: String) -> Sha256Digest? {
+  let d = sha256sum.Sha256.DigestFile(path: path as NonEmptyStr)
+  if d.success == false { none } else { sha256_hex_digest(hex: substring(s: d.line, start: 0, end: 64)) }
+}
+
+fn workspace_all_but_last(xs: List<String>) -> List<String> {
+  match xs {
+    Empty => []
+    Cons { head: _, tail: Empty } => []
+    Cons { head: x, tail: rest } => concat([x], workspace_all_but_last(xs: rest))
+  }
+}
+
+// ── THE ARCHIVE: BUILT FROM BOTH SOURCES, READ BACK, AND ITS PLACEHOLDERS EXTRACTED AND HASHED ──
+//
+// The real members are read relative to "/" and the placeholders relative to their staging root,
+// under the same member names, into one tar. The readback then lists the archive twice (names, then
+// types and sizes), extracts exactly the placeholder members into a fresh directory, and hashes each
+// extracted file. Every step's failure is a typed refusal; the readback's verdict is returned whole
+// so the caller words it.
+//
+// Two orderings carry the reasons. The placeholder root is made FIRST: the second -C must name a
+// directory even when no transcript was planned, so a workspace with no transcripts packs through
+// the same two-list route with an empty second list, and the staging directory the lists are written
+// into exists whatever was staged. And the LOCATED refusals come before extraction: names, types and
+// sizes are judged from the listings alone, with each placeholder's digest assumed, so a missing or
+// malformed member is refused by name rather than as a failed extract of the whole list.
+// WHY THE ARCHIVE STEP REFUSED, as a closed sum: the receipt's verdict word is rendered from it at the
+// edge by workspace_pack_refusal_words, so a refusal kind cannot be misspelled or invented at a
+// construction site. The readback arms carry the member they name.
+type WorkspacePackRefusal
+  = PackRefusedPlaceholderRootUnmade
+  | PackRefusedMemberListUnwritten
+  | PackRefusedTarFailed
+  | PackRefusedReadbackFailed
+  | PackRefusedPlaceholderExtractFailed
+  | PackRefusedMemberCountMismatch
+  | PackRefusedExcludedMember { member: NonEmptyStr, rule: String }
+  | PackRefusedPlaceholderAbsent { member: NonEmptyStr }
+  | PackRefusedPlaceholderNotRegular { member: NonEmptyStr, type_letter: String }
+  | PackRefusedPlaceholderSize { member: NonEmptyStr, planned: ByteSize, archived: ByteSize }
+  | PackRefusedPlaceholderUnread { member: NonEmptyStr }
+  | PackRefusedPlaceholderDigest { member: NonEmptyStr, expected: String, archived: String }
+
+fn workspace_pack_refusal_words(refusal: WorkspacePackRefusal) -> String {
+  match refusal {
+    PackRefusedPlaceholderRootUnmade => "refused-placeholder-root-unmade"
+    PackRefusedMemberListUnwritten => "refused-member-list-unwritten"
+    PackRefusedTarFailed => "refused-pack-failed"
+    PackRefusedReadbackFailed => "refused-readback-failed"
+    PackRefusedPlaceholderExtractFailed => "refused-placeholder-extract-failed"
+    PackRefusedMemberCountMismatch => "refused-member-count-mismatch"
+    PackRefusedExcludedMember { member: m, rule: x } => join(["refused-excluded-member member=", m as String, " rule=", x], "")
+    PackRefusedPlaceholderAbsent { member: m } => concat("refused-placeholder-absent member=", m as String)
+    PackRefusedPlaceholderNotRegular { member: m, type_letter: t } => join(["refused-placeholder-not-regular member=", m as String, " type=", t], "")
+    PackRefusedPlaceholderSize { member: m, planned: p, archived: a } => join(["refused-placeholder-size member=", m as String, " planned=", to_string(measure_count(m: p)), " archived=", to_string(measure_count(m: a))], "")
+    PackRefusedPlaceholderUnread { member: m } => concat("refused-placeholder-unread member=", m as String)
+    PackRefusedPlaceholderDigest { member: m, expected: e, archived: a } => join(["refused-placeholder-digest member=", m as String, " expected=", e, " archived=", a], "")
+  }
+}
+
+type WorkspacePackArchive
+  = WorkspacePackBuilt { archive: String, readback: WorkspacePackReadback }
+  | WorkspacePackRefused { refusal: WorkspacePackRefusal, why: String }
+
+fn workspace_pack_archive(staging: String, members: List<NonEmptyStr>, placeholders: List<WorkspaceStagedPlaceholder>, placeholder_root: String) -> WorkspacePackArchive {
+  let list_path = join([staging, "/members"], "")
+  let placeholder_list_path = join([staging, "/placeholder-members"], "")
+  let archive = join([staging, "/workspace-source.tar"], "")
+  let root_made = shell.Mkdir.Parents(path: placeholder_root as FilePath)
+  if root_made.success == false {
+    WorkspacePackRefused { refusal: PackRefusedPlaceholderRootUnmade, why: concat("the placeholder staging root could not be made: ", placeholder_root) }
+  } else {
     let listed = Filesystem.Write(path: list_path, content: concat(join(map(members, m => m as String), "\n"), "\n"))
-    if listed.success == false {
-      workspace_source_finish(receipt: concat(head, "verdict=refused-member-list-unwritten\n"), outcome: exit_failure(reason: concat("workspace_source_pack: the member list could not be written: ", listed.error)))
+    let placeholder_listed = Filesystem.Write(path: placeholder_list_path, content: join(map(placeholders, p => concat(p.member as String, "\n")), ""))
+    if listed.success == false || placeholder_listed.success == false {
+      WorkspacePackRefused { refusal: PackRefusedMemberListUnwritten, why: join(["a member list could not be written: ", listed.error, placeholder_listed.error], "") }
     } else {
-      let pack_start = workspace_source_instant(label: "workspace-source-pack-start")
-      let packed = workspace_run_ok(run: run_shell_command_observe_outcome(command: tar_create_from_list_command(archive: archive, from_directory: "/", member_list: list_path), transport: LocalExec))
-      let pack_span = workspace_source_span_words(start: pack_start, end_label: "workspace-source-pack-end")
-      match packed {
-        Present { value: why } => workspace_source_finish(receipt: concat(head, "verdict=refused-pack-failed\n"), outcome: exit_failure(reason: concat("workspace_source_pack: tar refused: ", why)))
+      match workspace_run_ok(run: run_shell_command_observe_outcome(command: tar_create_from_two_lists_command(archive: archive, first_directory: "/", first_list: list_path, second_directory: placeholder_root, second_list: placeholder_list_path), transport: LocalExec)) {
+        Present { value: why } => WorkspacePackRefused { refusal: PackRefusedTarFailed, why: concat("tar refused: ", why) }
         Absent =>
-          match run_shell_command_observe_outcome(command: tar_list_command(archive: archive), transport: LocalExec) {
-            ProcessNotSpawned { program: _, cause: c } => workspace_source_finish(receipt: concat(head, "verdict=refused-readback-unrun\n"), outcome: exit_failure(reason: concat("workspace_source_pack: the archive could not be listed back: ", c as String)))
-            ProcessRan { observation: o } =>
-              if o.exit_code != 0 {
-                workspace_source_finish(receipt: concat(head, "verdict=refused-readback-failed\n"), outcome: exit_failure(reason: concat("workspace_source_pack: tar -tf refused: ", o.stderr)))
-              } else {
-                match workspace_pack_readback(exclusions: workspace_exclusions(), archive_listing: o.stdout) {
-                  WorkspacePackCarriesExcluded { member: m, by: x } => {
-                    let removed = shell.Remove.RecursiveForce(path: staging.path)
-                    workspace_source_finish(receipt: join([head, "verdict=refused-excluded-member member=", m as String, " rule=", x.spelling as String, " archive_removed=", if removed.success { "yes" } else { "no" }, "\n"], ""), outcome: exit_failure(reason: join(["workspace_source_pack: the archive carries ", m as String, ", which the credential exclusion ", x.spelling as String, " names; nothing was uploaded"], "")))
+          match workspace_archive_listings(archive: archive) {
+            Absent => WorkspacePackRefused { refusal: PackRefusedReadbackFailed, why: "the archive could not be listed back" }
+            Present { value: listings } => {
+              let structural = workspace_pack_readback(exclusions: workspace_exclusions(), placeholders: placeholders, archive_listing: listings.names, size_listing: listings.sizes, archived_digests: fold(placeholders, init: empty_map(), f: (m, p) => map_insert(m: m, key: p.member as String, value: p.expected_digest.hex as String)))
+              match workspace_pack_readback_refusal(readback: structural) {
+                Present { value: _ } => WorkspacePackBuilt { archive: archive, readback: structural }
+                Absent =>
+              match workspace_archived_placeholder_digests(staging: staging, archive: archive, placeholder_list: placeholder_list_path, placeholders: placeholders) {
+                Absent => WorkspacePackRefused { refusal: PackRefusedPlaceholderExtractFailed, why: "the placeholder members could not be extracted back out of the archive" }
+                Present { value: digests } => {
+                  let r = workspace_pack_readback(exclusions: workspace_exclusions(), placeholders: placeholders, archive_listing: listings.names, size_listing: listings.sizes, archived_digests: digests)
+                  let expected = length(members) + length(placeholders)
+                  match r {
+                    WorkspacePackClean { members: n } =>
+                      if n != expected {
+                        WorkspacePackRefused { refusal: PackRefusedMemberCountMismatch, why: join(["the archive holds ", to_string(n), " members but the lists named ", to_string(expected)], "") }
+                      } else {
+                        WorkspacePackBuilt { archive: archive, readback: r }
+                      }
+                    WorkspacePackCarriesExcluded { member: _, by: _ } => WorkspacePackBuilt { archive: archive, readback: r }
+                    WorkspacePackPlaceholderAbsent { member: _ } => WorkspacePackBuilt { archive: archive, readback: r }
+                    WorkspacePackPlaceholderNotRegular { member: _, type_letter: _ } => WorkspacePackBuilt { archive: archive, readback: r }
+                    WorkspacePackPlaceholderSizeDiffers { member: _, planned: _, archived: _ } => WorkspacePackBuilt { archive: archive, readback: r }
+                    WorkspacePackPlaceholderUnread { member: _ } => WorkspacePackBuilt { archive: archive, readback: r }
+                    WorkspacePackPlaceholderDigestDiffers { member: _, expected: _, archived: _ } => WorkspacePackBuilt { archive: archive, readback: r }
                   }
-                  WorkspacePackClean { members: n } =>
-                    if n != length(members) {
-                      workspace_source_finish(receipt: concat(head, "verdict=refused-member-count-mismatch\n"), outcome: exit_failure(reason: join(["workspace_source_pack: the archive holds ", to_string(n), " members but the list named ", to_string(length(members))], "")))
-                    } else {
-                      workspace_source_publish(head: concat(head, join(["archive_members=", to_string(n), " pack=", pack_span, "\n"], "")), archive: archive, staging: staging.path as String)
-                    }
                 }
               }
+              }
+            }
           }
       }
     }
   }
 }
 
+// THE ARCHIVED PLACEHOLDER BYTES, HASHED: extract exactly the placeholder members into
+// <staging>/readback and sha256sum each. A member that did not extract or could not be hashed is
+// simply absent from the map, which the readback refuses as unread. An empty plan extracts nothing.
+fn workspace_archived_placeholder_digests(staging: String, archive: String, placeholder_list: String, placeholders: List<WorkspaceStagedPlaceholder>) -> Map<String, String>? {
+  match placeholders {
+    Empty => Present { value: empty_map() }
+    Cons { head: _, tail: _ } => {
+      let into = join([staging, "/readback"], "")
+      let made = shell.Mkdir.Parents(path: into as FilePath)
+      if made.success == false {
+        none
+      } else {
+        match workspace_run_ok(run: run_shell_command_observe_outcome(command: tar_extract_listed_command(archive: archive, into_directory: into, member_list: placeholder_list), transport: LocalExec)) {
+          Present { value: _ } => none
+          Absent => Present { value: fold(placeholders, init: empty_map(), f: (m, p) => match workspace_file_digest(path: join([into, "/", p.member as String], "")) {
+            Present { value: d } => map_insert(m: m, key: p.member as String, value: d.hex as String)
+            Absent => m
+          }) }
+        }
+      }
+    }
+  }
+}
+
+type WorkspaceReadbackRefusal {
+  refusal: WorkspacePackRefusal
+  why: String
+}
+
+fn workspace_pack_clean_members(readback: WorkspacePackReadback) -> Int {
+  match readback {
+    WorkspacePackClean { members: n } => n
+    WorkspacePackCarriesExcluded { member: _, by: _ } => 0
+    WorkspacePackPlaceholderAbsent { member: _ } => 0
+    WorkspacePackPlaceholderNotRegular { member: _, type_letter: _ } => 0
+    WorkspacePackPlaceholderSizeDiffers { member: _, planned: _, archived: _ } => 0
+    WorkspacePackPlaceholderUnread { member: _ } => 0
+    WorkspacePackPlaceholderDigestDiffers { member: _, expected: _, archived: _ } => 0
+  }
+}
+
+fn workspace_pack_readback_refusal(readback: WorkspacePackReadback) -> WorkspaceReadbackRefusal? {
+  match readback {
+    WorkspacePackClean { members: _ } => none
+    WorkspacePackCarriesExcluded { member: m, by: x } =>
+      Present { value: WorkspaceReadbackRefusal { refusal: PackRefusedExcludedMember { member: m, rule: x.spelling as String }, why: join(["the archive carries ", m as String, ", which the workspace exclusion ", x.spelling as String, " names and no placeholder stands for"], "") } }
+    WorkspacePackPlaceholderAbsent { member: m } =>
+      Present { value: WorkspaceReadbackRefusal { refusal: PackRefusedPlaceholderAbsent { member: m }, why: concat("the archive holds no member for the transcript placeholder ", m as String) } }
+    WorkspacePackPlaceholderNotRegular { member: m, type_letter: t } =>
+      Present { value: WorkspaceReadbackRefusal { refusal: PackRefusedPlaceholderNotRegular { member: m, type_letter: t }, why: join(["the transcript placeholder ", m as String, " is archived as type '", t, "', not a regular file"], "") } }
+    WorkspacePackPlaceholderSizeDiffers { member: m, planned: p, archived: a } =>
+      Present { value: WorkspaceReadbackRefusal { refusal: PackRefusedPlaceholderSize { member: m, planned: p, archived: a }, why: join(["the transcript placeholder ", m as String, " is archived at ", to_string(measure_count(m: a)), " bytes, not its planned ", to_string(measure_count(m: p))], "") } }
+    WorkspacePackPlaceholderUnread { member: m } =>
+      Present { value: WorkspaceReadbackRefusal { refusal: PackRefusedPlaceholderUnread { member: m }, why: concat("the archived bytes of the transcript placeholder could not be extracted and hashed: ", m as String) } }
+    WorkspacePackPlaceholderDigestDiffers { member: m, expected: e, archived: a } =>
+      Present { value: WorkspaceReadbackRefusal { refusal: PackRefusedPlaceholderDigest { member: m, expected: e.hex as String, archived: a }, why: join(["the archived bytes of ", m as String, " are not its staged placeholder (sha256 ", a, ", expected ", e.hex as String, "); the archive may carry real transcript content"], "") } }
+  }
+}
+
+fn workspace_source_refuse_archive(head: String, staging: String, refusal: WorkspacePackRefusal, why: String) -> ProcessExit {
+  let removed = shell.Remove.RecursiveForce(path: staging as FilePath)
+  workspace_source_finish(receipt: join([head, "verdict=", workspace_pack_refusal_words(refusal: refusal), " archive_removed=", if removed.success { "yes" } else { "no" }, "\n"], ""), outcome: exit_failure(reason: join(["workspace_source_pack: ", why, "; nothing was uploaded"], "")))
+}
+
+type WorkspaceArchiveListings {
+  names: String
+  sizes: String
+}
+
+fn workspace_archive_listings(archive: String) -> WorkspaceArchiveListings? {
+  match run_shell_command_observe_outcome(command: tar_list_command(archive: archive), transport: LocalExec) {
+    ProcessNotSpawned { program: _, cause: _ } => none
+    ProcessRan { observation: names } =>
+      if names.exit_code != 0 {
+        none
+      } else {
+        match run_shell_command_observe_outcome(command: tar_list_sizes_command(archive: archive), transport: LocalExec) {
+          ProcessNotSpawned { program: _, cause: _ } => none
+          ProcessRan { observation: sizes } => if sizes.exit_code != 0 { none } else { Present { value: WorkspaceArchiveListings { names: names.stdout, sizes: sizes.stdout } } }
+        }
+      }
+  }
+}
+
 fn workspace_source_publish(head: String, archive: String, staging: String) -> ProcessExit {
   match read_staged_fabric_blob(path: archive as NonEmptyStr) {
     FabricBlobReadRefused { fault: f } => workspace_source_finish(receipt: concat(head, "verdict=refused-archive-unread\n"), outcome: exit_failure(reason: concat("workspace_source_pack: ", fabric_blob_fault_text(fault: f))))
diff --git a/dag/gunbc/fabric/workspace_transcript_rate.dag b/dag/gunbc/fabric/workspace_transcript_rate.dag
new file mode 100644
index 00000000000..7a3d0da91df
--- /dev/null
+++ b/dag/gunbc/fabric/workspace_transcript_rate.dag
@@ -0,0 +1,581 @@
+module gunbc.fabric.workspace_transcript_rate
+
+import std.types { String, NonEmptyStr, Int, Bool, List, Map }
+import v2.std.collection { empty_map, map_insert, map_lookup }
+import std.optional { Present, Absent }
+import std.algebra { Cons, Empty }
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+import std.measure { ByteSize, byte_size, measure_count, Nanosecond, nanosecond, nanosecond_count, Second, second, second_count, Bandwidth, bandwidth, bandwidth_count, bits_per_byte, ObservationInstant, ProcessMonotonic, WallClock, InstantOrder, InstantAfter, InstantIncomparable, InstantBefore, InstantSame }
+import std.checkpointed_workspace { WorkspaceAgeOf, WorkspaceAgeUndefined, workspace_age_between }
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.shell.exec { ProcessRunOutcome, ProcessRan, ProcessNotSpawned }
+import extdeps.exec.command { ArgvCommand, LocalExec }
+import extdeps.tools.findutils { find_regular_file_size_mtime_command }
+import extdeps.tools.sleep { sleep_delay_seconds_second_carrier_projection }
+import gunbc.command_runner { run_shell_command_observe_outcome }
+import gunbc.floor_cost_distribution { permille_percentile }
+import gunbc.hostname_read { hostname_short_read, HostnameShortCaptured, HostnameShortCaptureRefused }
+import gunbc.host_effect { LocalShell }
+import gunbc.fabric.workspace_source {
+  WorkspaceSourceRoot, workspace_source_fixed_roots, workspace_source_pack_host,
+  WorkspaceAgentStateSlot, AgentStateSlotAdmitted, AgentStateSlotAbsent, AgentStateSlotUnknown,
+  workspace_agent_state_slot_observe, workspace_agent_state_slot_words, workspace_root_member,
+  workspace_exclusions, workspace_path_exclusion, workspace_exclusion_spellings, workspace_transcript_exclusions,
+  CredentialExclusion, TranscriptExclusion,
+}
+
+// HOW FAST THE OPERATOR'S AGENT TRANSCRIPTS ACTUALLY GROW, OBSERVED ON THE HOST THAT HOLDS THEM, FROM
+// SIZES AND MODIFICATION TIMES ALONE (step 3 of the workspace stage-0 sequence, operator decision
+// via warm-badger-442, 2026-10-05). The stage-0 pack (gunbc.fabric.workspace_source) carries every
+// transcript as a same-size synthetic placeholder of a static tree, so its checkpoint-lag figures
+// say nothing about a tree being written to; the 10 s / 60 s verdicts stay withheld until a churn
+// phase appends to those placeholders at a realistic rate. This module produces that rate. On srv1
+// it samples, once per declared interval over a declared window, the byte size and mtime of every
+// file the pack's own TranscriptExclusion rows match under the pinned agent-state roots, and
+// records per interval what grew, what appeared, what shrank and how many bytes were appended.
+//
+// CONTENT IS NEVER READ. The only reader is extdeps.tools.findutils
+// find_regular_file_size_mtime_command, whose -printf directives are answered from the inode and
+// whose expression runs no other program; the witness checks the second fact on the command value.
+// Transcript content is exactly what the operator ruled is not carried, and a rate instrument has no
+// need of it.
+//
+// WHAT ONE RUN IS: one window, on one host, during whatever agent activity happened to be live. It
+// is ONE SAMPLE OF THE WORKLOAD, NOT THE WORKLOAD, and every receipt says so (DESIGN 4d: the figure
+// is a typed reading of one occasion, and a consumer that quotes it as the operator's rate is the
+// defect).
+
+// ── WHAT IS OBSERVED, AND FOR HOW LONG ─────────────────────────────────────────────────────────
+
+// THE ROOTS ARE THE PACK'S OWN: the Claude agent-state root is the one the pack's slot admission
+// (gunbc.fabric.workspace_source workspace_agent_state_slot_observe) admits from the same
+// agent_state_slot input -- the active slot moves with the operator's credential swaps, so it is a
+// declared input with no default, never a pinned path -- and the Codex home is the pack's fixed row,
+// selected by its label. The gunbc clone is not observed: no transcript lives in it, and walking a
+// build tree each interval would cost the window its resolution.
+data workspace_transcript_rate_fixed_root_labels: List<NonEmptyStr> = ["codex-state"]
+
+// TEN MINUTES AT TEN SECONDS, declared and printed in every receipt. The interval matches the
+// stage-0 checkpoint-lag target, so one row is one target-length of appends; the window spans
+// sixty of them, which is the smallest population whose 95th percentile is not its maximum.
+data workspace_transcript_rate_window: Second = second(count: 600)
+data workspace_transcript_rate_sample_interval: Second = second(count: 10)
+
+data workspace_transcript_rate_receipt_path: String = "target/workspace-transcript-rate-receipt.txt"
+
+data workspace_transcript_rate_caveat: NonEmptyStr = "ONE SAMPLE OF WORKLOAD, NOT THE WORKLOAD: one window on one host during whatever agent activity was live; bytes_appended is a LOWER BOUND (stat sees net size change per interval, never writes undone or overwritten within it)"
+
+type TranscriptRateRootSelection
+  = TranscriptRateRootsSelected { roots: List<WorkspaceSourceRoot> }
+  | TranscriptRateRootUndeclared { label: NonEmptyStr }
+  | TranscriptRateSlotRefused { slot: WorkspaceAgentStateSlot }
+
+// The admitted slot's root first, then the fixed rows; a refused slot refuses the selection, carrying
+// the admission so the receipt prints the pack's own words for it.
+fn workspace_transcript_rate_roots(slot: WorkspaceAgentStateSlot, fixed: TranscriptRateRootSelection) -> TranscriptRateRootSelection {
+  match slot {
+    AgentStateSlotAbsent { observed: _ } => TranscriptRateSlotRefused { slot: slot }
+    AgentStateSlotUnknown { requested: _, observed: _ } => TranscriptRateSlotRefused { slot: slot }
+    AgentStateSlotAdmitted { slot: _, root: agent } =>
+      match fixed {
+        TranscriptRateRootsSelected { roots: rs } => TranscriptRateRootsSelected { roots: Cons { head: agent, tail: rs } }
+        TranscriptRateRootUndeclared { label: l } => TranscriptRateRootUndeclared { label: l }
+        TranscriptRateSlotRefused { slot: s2 } => TranscriptRateSlotRefused { slot: s2 }
+      }
+  }
+}
+
+fn workspace_transcript_rate_select_roots(labels: List<NonEmptyStr>, declared: List<WorkspaceSourceRoot>) -> TranscriptRateRootSelection {
+  match labels {
+    Empty => TranscriptRateRootsSelected { roots: [] }
+    Cons { head: l, tail: rest } =>
+      match filter(declared, r => (r.label as String) == (l as String)) {
+        Empty => TranscriptRateRootUndeclared { label: l }
+        Cons { head: r, tail: _ } =>
+          match workspace_transcript_rate_select_roots(labels: rest, declared: declared) {
+            TranscriptRateRootUndeclared { label: u } => TranscriptRateRootUndeclared { label: u }
+            TranscriptRateSlotRefused { slot: s } => TranscriptRateSlotRefused { slot: s }
+            TranscriptRateRootsSelected { roots: rs } => TranscriptRateRootsSelected { roots: Cons { head: r, tail: rs } }
+          }
+      }
+  }
+}
+
+// ── ONE READING OF ONE ROOT: SIZE AND MTIME, NEVER CONTENT ─────────────────────────────────────
+
+// A FILE'S MODIFICATION TIME IS THE FILESYSTEM'S CLOCK, NOT THIS PROCESS'S: st_mtime counted from
+// the epoch, as find's %T@ prints it. It has its own carrier so it can never stand where a sample
+// instant (an ObservationInstant on this process's monotonic clock) is expected, and the two are
+// never subtracted from each other; an mtime is only ever compared with another mtime.
+type TranscriptFileMtime {
+  since_epoch: Nanosecond
+}
+
+type TranscriptFileStat {
+  member: NonEmptyStr
+  size: ByteSize
+  mtime: TranscriptFileMtime
+}
+
+// A ROOT THAT COULD NOT BE READ REFUSES, and so does a line that is not a record: a partial listing
+// is not a smaller transcript population, it is a reading that did not happen, and an interval
+// computed against it would report every unlisted file as removed.
+type TranscriptRootReading
+  = TranscriptRootRead { files: List<TranscriptFileStat> }
+  | TranscriptRootRefused { root: WorkspaceSourceRoot, detail: String }
+
+fn workspace_transcript_rate_root_command(root: WorkspaceSourceRoot) -> ArgvCommand {
+  find_regular_file_size_mtime_command(root: root.path as String)
+}
+
+fn workspace_transcript_rate_root_reading(root: WorkspaceSourceRoot, run: ProcessRunOutcome) -> TranscriptRootReading {
+  match run {
+    ProcessNotSpawned { program: p, cause: c } => TranscriptRootRefused { root: root, detail: join([p as String, " did not run: ", c as String], "") }
+    ProcessRan { observation: o } =>
+      if o.exit_code != 0 {
+        TranscriptRootRefused { root: root, detail: join(["find exited ", to_string(o.exit_code), " reading ", root.path as String, ": ", o.stderr], "") }
+      } else {
+        workspace_transcript_rate_lines(root: root, lines: filter(split(o.stdout, separator: "\n"), l => l != ""), files: [])
+      }
+  }
+}
+
+// Each line is classified by the pack's own matcher over its member path, so this module restates
+// no rule: a path the pack excludes as a transcript is observed, a credential-class match (counted
+// first, as the pack counts it) or an unmatched path is not. Kept files accumulate in reverse and
+// the order is irrelevant to every consumer, which keys them by member.
+fn workspace_transcript_rate_lines(root: WorkspaceSourceRoot, lines: List<String>, files: List<TranscriptFileStat>) -> TranscriptRootReading {
+  match lines {
+    Empty => TranscriptRootRead { files: files }
+    Cons { head: l, tail: rest } =>
+      match workspace_transcript_rate_line(root: root, line: l) {
+        TranscriptLineUnparsed { line: bad } => TranscriptRootRefused { root: root, detail: concat("find printed a line that is not a size, mtime and path record: ", bad) }
+        TranscriptLineOther => workspace_transcript_rate_lines(root: root, lines: rest, files: files)
+        TranscriptLineFile { stat: s } => workspace_transcript_rate_lines(root: root, lines: rest, files: Cons { head: s, tail: files })
+      }
+  }
+}
+
+type TranscriptLine
+  = TranscriptLineFile { stat: TranscriptFileStat }
+  | TranscriptLineOther
+  | TranscriptLineUnparsed { line: String }
+
+fn workspace_transcript_rate_line(root: WorkspaceSourceRoot, line: String) -> TranscriptLine {
+  match split(line, separator: "\t") {
+    Cons { head: size_text, tail: Cons { head: mtime_text, tail: Cons { head: first, tail: more } } } => {
+      let relative = join(Cons { head: first, tail: more }, "\t")
+      match parse_int(s: size_text) {
+        Absent => TranscriptLineUnparsed { line: line }
+        Present { value: n } =>
+          match workspace_transcript_rate_mtime(text: mtime_text) {
+            Absent => TranscriptLineUnparsed { line: line }
+            Present { value: t } =>
+              if n < 0 || relative == "" {
+                TranscriptLineUnparsed { line: line }
+              } else {
+                workspace_transcript_rate_classify(stat: TranscriptFileStat { member: workspace_root_member(root: root, relative: relative) as NonEmptyStr, size: byte_size(count: n), mtime: t })
+              }
+          }
+      }
+    }
+    Cons { head: _, tail: Cons { head: _, tail: Empty } } => TranscriptLineUnparsed { line: line }
+    Cons { head: _, tail: Empty } => TranscriptLineUnparsed { line: line }
+    Empty => TranscriptLineUnparsed { line: line }
+  }
+}
+
+fn workspace_transcript_rate_classify(stat: TranscriptFileStat) -> TranscriptLine {
+  match workspace_path_exclusion(exclusions: workspace_exclusions(), path: stat.member as String) {
+    Absent => TranscriptLineOther
+    Present { value: x } =>
+      match x.class {
+        TranscriptExclusion => TranscriptLineFile { stat: stat }
+        CredentialExclusion => TranscriptLineOther
+      }
+  }
+}
+
+// %T@ PRINTS SECONDS, A POINT AND A FRACTION (GNU find prints ten fractional digits; a filesystem
+// with coarser timestamps prints zeros there). Nanoseconds are the first nine fractional digits,
+// right-padded, so a shorter fraction reads as the value it spells rather than a smaller one.
+fn workspace_transcript_rate_mtime(text: String) -> TranscriptFileMtime? {
+  match split(text, separator: ".") {
+    Cons { head: whole, tail: Empty } =>
+      match parse_int(s: whole) {
+        Absent => none
+        Present { value: s } => if s < 0 { none } else { Present { value: TranscriptFileMtime { since_epoch: nanosecond(count: s * 1000000000) } } }
+      }
+    Cons { head: whole, tail: Cons { head: frac, tail: Empty } } => {
+      let padded = substring(s: concat(frac, "000000000"), start: 0, end: 9)
+      match parse_int(s: whole) {
+        Absent => none
+        Present { value: s } =>
+          match parse_int(s: padded) {
+            Absent => none
+            Present { value: f } => if s < 0 || f < 0 || frac == "" { none } else { Present { value: TranscriptFileMtime { since_epoch: nanosecond(count: s * 1000000000 + f) } } }
+          }
+      }
+    }
+    Cons { head: _, tail: Cons { head: _, tail: Cons { head: _, tail: _ } } } => none
+    Empty => none
+  }
+}
+
+// ── ONE SAMPLE: EVERY ROOT, AT ONE INSTANT ─────────────────────────────────────────────────────
+//
+// The instant is read on this process's monotonic clock immediately before the first root is
+// walked, so an interval's span is the time between the starts of two walks; a walk's own duration
+// is inside the span it opens, never subtracted from it.
+type TranscriptRateSample
+  = TranscriptRateSampled { at: ObservationInstant, files: List<TranscriptFileStat> }
+  | TranscriptRateSampleRefused { refusals: List<String> }
+
+fn workspace_transcript_rate_sample_of(at: ObservationInstant, readings: List<TranscriptRootReading>) -> TranscriptRateSample {
+  let refusals = flat_map(readings, r => match r {
+    TranscriptRootRefused { root: root, detail: d } => [join([root.label as String, " (", root.path as String, "): ", d], "")]
+    TranscriptRootRead { files: _ } => []
+  })
+  match refusals {
+    Cons { head: _, tail: _ } => TranscriptRateSampleRefused { refusals: refusals }
+    Empty => TranscriptRateSampled { at: at, files: flat_map(readings, r => match r {
+      TranscriptRootRead { files: fs } => fs
+      TranscriptRootRefused { root: _, detail: _ } => []
+    }) }
+  }
+}
+
+// ONE CLOCK DOMAIN FOR EVERY SAMPLE OF A WINDOW: this process's monotonic clock, wall basis -- the
+// shape gunbc.fabric.workspace_source workspace_source_instant gives the pack's spans.
+fn workspace_transcript_rate_instant(label: String) -> ObservationInstant {
+  ObservationInstant { domain: ProcessMonotonic { process: "workspace-transcript-rate" }, basis: WallClock, since_origin: nanosecond(count: observed_monotonic_nanos(label)) }
+}
+
+fn workspace_transcript_rate_sample_wet(roots: List<WorkspaceSourceRoot>, label: String) -> TranscriptRateSample {
+  let at = workspace_transcript_rate_instant(label: label)
+  workspace_transcript_rate_sample_of(at: at, readings: map(roots, r => workspace_transcript_rate_root_reading(root: r, run: run_shell_command_observe_outcome(command: workspace_transcript_rate_root_command(root: r), transport: LocalExec))))
+}
+
+// ── ONE INTERVAL: THE DIFFERENCE OF TWO SAMPLES ────────────────────────────────────────────────
+//
+// A FILE THAT SHRANK IS A TRUNCATION, REPORTED AS ONE, never a negative append: its delta is not
+// subtracted from the bytes appended, because a rewrite that shortens a file appends nothing and
+// would otherwise cancel real appends elsewhere in the interval. A CREATED file contributes its
+// whole size, all of it written since the previous sample. A file whose mtime advanced at the same
+// size was rewritten in place and appended nothing. The ACTIVE-WRITER COUNT is the number of
+// distinct files written in the interval -- created, grown, shrunk or mtime-advanced. It counts
+// FILES, not processes: one agent session appends to its own transcript and a subagent to its own,
+// so it tracks live writers without being a process count, and stat cannot see the processes.
+type TranscriptTruncation {
+  member: NonEmptyStr
+  from: ByteSize
+  to: ByteSize
+}
+
+type TranscriptAppendInterval {
+  span: Nanosecond
+  files_grown: Int
+  files_created: Int
+  files_removed: Int
+  files_rewritten_same_size: Int
+  truncations: List<TranscriptTruncation>
+  bytes_appended: ByteSize
+  active_writers: Int
+}
+
+type TranscriptFileChange
+  = TranscriptFileCreated { size: ByteSize }
+  | TranscriptFileGrown { by: ByteSize }
+  | TranscriptFileShrank { truncation: TranscriptTruncation }
+  | TranscriptFileRewritten
+  | TranscriptFileUnchanged
+
+fn workspace_transcript_file_change(before: TranscriptFileStat?, after: TranscriptFileStat) -> TranscriptFileChange {
+  match before {
+    Absent => TranscriptFileCreated { size: after.size }
+    Present { value: b } => {
+      let delta = measure_count(m: after.size) - measure_count(m: b.size)
+      if delta > 0 {
+        TranscriptFileGrown { by: byte_size(count: delta) }
+      } else if delta < 0 {
+        TranscriptFileShrank { truncation: TranscriptTruncation { member: after.member, from: b.size, to: after.size } }
+      } else if nanosecond_count(n: after.mtime.since_epoch) != nanosecond_count(n: b.mtime.since_epoch) {
+        TranscriptFileRewritten
+      } else {
+        TranscriptFileUnchanged
+      }
+    }
+  }
+}
+
+fn workspace_transcript_rate_index(files: List<TranscriptFileStat>) -> Map<String, TranscriptFileStat> {
+  fold(files, init: empty_map(), f: (m, s) => map_insert(m: m, key: s.member as String, value: s))
+}
+
+// Every file of the later sample is looked up once in the earlier one, so an interval costs one
+// pass over each sample; a removed file is counted as the earlier files the later one did not keep.
+fn workspace_transcript_rate_interval(before: List<TranscriptFileStat>, after: List<TranscriptFileStat>, span: Nanosecond) -> TranscriptAppendInterval {
+  let index = workspace_transcript_rate_index(files: before)
+  let changes = map(after, s => workspace_transcript_file_change(before: map_lookup(m: index, key: s.member as String), after: s))
+  let created = length(filter(changes, c => match c {
+    TranscriptFileCreated { size: _ } => true
+    TranscriptFileGrown { by: _ } => false
+    TranscriptFileShrank { truncation: _ } => false
+    TranscriptFileRewritten => false
+    TranscriptFileUnchanged => false
+  }))
+  let grown = length(filter(changes, c => match c {
+    TranscriptFileCreated { size: _ } => false
+    TranscriptFileGrown { by: _ } => true
+    TranscriptFileShrank { truncation: _ } => false
+    TranscriptFileRewritten => false
+    TranscriptFileUnchanged => false
+  }))
+  let rewritten = length(filter(changes, c => match c {
+    TranscriptFileCreated { size: _ } => false
+    TranscriptFileGrown { by: _ } => false
+    TranscriptFileShrank { truncation: _ } => false
+    TranscriptFileRewritten => true
+    TranscriptFileUnchanged => false
+  }))
+  let truncations = flat_map(changes, c => match c {
+    TranscriptFileCreated { size: _ } => []
+    TranscriptFileGrown { by: _ } => []
+    TranscriptFileShrank { truncation: t } => [t]
+    TranscriptFileRewritten => []
+    TranscriptFileUnchanged => []
+  })
+  let appended = fold(changes, init: 0, f: (acc, c) => match c {
+    TranscriptFileCreated { size: s } => acc + measure_count(m: s)
+    TranscriptFileGrown { by: d } => acc + measure_count(m: d)
+    TranscriptFileShrank { truncation: _ } => acc
+    TranscriptFileRewritten => acc
+    TranscriptFileUnchanged => acc
+  })
+  TranscriptAppendInterval {
+    span: span,
+    files_grown: grown,
+    files_created: created,
+    files_removed: length(before) - (length(after) - created),
+    files_rewritten_same_size: rewritten,
+    truncations: truncations,
+    bytes_appended: byte_size(count: appended),
+    active_writers: created + grown + length(truncations) + rewritten,
+  }
+}
+
+// ── THE OBSERVED RATE: THE CARRIER THE CHURN PHASE CONSUMES ────────────────────────────────────
+//
+// THE RATE IS CARRIED AS ITS EXACT QUOTIENT PAIR -- bytes appended over a measured span, per
+// interval -- because std.measure has no bytes-per-time type to carry it as one figure: its only
+// rate of information is Bandwidth (DataRate, bits per second, a Nat count at One scale), which
+// would floor every interval to whole bits per second and lose a quiet interval to zero. That gap
+// is stated, not filled here: the receipt's rates are DERIVED from these pairs as Bandwidth (see
+// workspace_transcript_rate_bandwidth), and a consumer derives what it needs from the pairs.
+//
+// THE CONSUMER IS A DECLARED FRONTIER (DESIGN 3c): the stage-0 churn phase (step 2 of the
+// workspace stage-0 sequence, a later change under still-dove-673) appends to the synthetic
+// transcript placeholders of gunbc.fabric.workspace_source at this observed rate, and the 10 s /
+// 60 s checkpoint-lag verdicts are quotable only over a run that carries that churn. Its trigger is
+// that change landing; until it does, the receipt renderer below is this carrier's executing
+// consumer, and the receipt is the dispatch input the churn phase is parameterized from.
+type TranscriptAppendRate {
+  host: NonEmptyStr
+  window: Second
+  interval: Second
+  rows: List<TranscriptAppendInterval>
+  caveat: NonEmptyStr
+}
+
+// A WINDOW EITHER COMPLETES OR REFUSES. A root that becomes unreadable mid-window, or a sleep that
+// fails, ends the observation; the rows already taken are printed in the receipt beside the
+// refusal, never summarized as if the window had finished.
+type TranscriptRateObservation
+  = TranscriptRateObserved { rate: TranscriptAppendRate }
+  | TranscriptRateRefused { reason: String, rows: List<TranscriptAppendInterval> }
+  | TranscriptRateClockUndefined { from: ObservationInstant, to: ObservationInstant, order: InstantOrder, rows: List<TranscriptAppendInterval> }
+
+// THE SPAN IS DERIVED, NEVER SUBTRACTED: std.checkpointed_workspace workspace_age_between orders two
+// consecutive sample instants first, so a later sample that does not follow the earlier one
+// (InstantAfter) or one on another clock (InstantIncomparable) ends the window as its own typed
+// refusal, TranscriptRateClockUndefined, instead of standing in a span.
+//
+// THE PURE WINDOW: a baseline sample and one sample per interval, each interval the difference of
+// consecutive samples. The sampler and the pause are supplied, so the wet entry passes the real
+// walk and the real sleep and a witness passes recorded samples; the fold itself is one function.
+fn workspace_transcript_rate_window_of(baseline: TranscriptRateSample, remaining: Int, next: fn(Int) -> TranscriptRateSample, pause: fn(Int) -> Bool, rows: List<TranscriptAppendInterval>) -> TranscriptRateObservation {
+  match baseline {
+    TranscriptRateSampleRefused { refusals: rs } => TranscriptRateRefused { reason: concat("a transcript root could not be read; no permission is widened here: ", join(rs, "; ")), rows: reverse(rows) }
+    TranscriptRateSampled { at: at, files: files } =>
+      if remaining <= 0 {
+        TranscriptRateObserved { rate: TranscriptAppendRate { host: workspace_source_pack_host, window: workspace_transcript_rate_window, interval: workspace_transcript_rate_sample_interval, rows: reverse(rows), caveat: workspace_transcript_rate_caveat } }
+      } else if pause(remaining) == false {
+        TranscriptRateRefused { reason: "the pause between samples failed; the interval is not what the window declares", rows: reverse(rows) }
+      } else {
+        match next(remaining) {
+          TranscriptRateSampleRefused { refusals: rs } => TranscriptRateRefused { reason: concat("a transcript root became unreadable mid-window: ", join(rs, "; ")), rows: reverse(rows) }
+          TranscriptRateSampled { at: at2, files: files2 } =>
+            match workspace_age_between(from: at, to: at2) {
+              WorkspaceAgeUndefined { order: o } => TranscriptRateClockUndefined { from: at, to: at2, order: o, rows: reverse(rows) }
+              WorkspaceAgeOf { age: span } =>
+                workspace_transcript_rate_window_of(
+                  baseline: TranscriptRateSampled { at: at2, files: files2 },
+                  remaining: remaining - 1,
+                  next: next,
+                  pause: pause,
+                  rows: Cons { head: workspace_transcript_rate_interval(before: files, after: files2, span: span), tail: rows },
+                )
+            }
+        }
+      }
+  }
+}
+
+fn workspace_transcript_rate_interval_count() -> Int {
+  second_count(s: workspace_transcript_rate_window) / second_count(s: workspace_transcript_rate_sample_interval)
+}
+
+// ── THE SUMMARY, DERIVED FOR THE RECEIPT ───────────────────────────────────────────────────────
+
+// A RATE IS A std.measure Bandwidth -- DataRate, bits per second -- derived from the exact quotient
+// pair, never a bare number. Bits rather than bytes because Bandwidth is the one information-rate
+// carrier std.measure has; eight bits to the octet (bits_per_byte) makes the conversion exact, and the
+// floor is taken once, on bits. The receipt prints the carrier's own bits/s beside the bytes/s it
+// implies (bits / 8, floored), which is the figure the churn phase is quoted in.
+fn workspace_transcript_rate_bandwidth(bytes: ByteSize, span: Nanosecond) -> Bandwidth? {
+  let ns = nanosecond_count(n: span)
+  if ns <= 0 { none } else { Present { value: bandwidth(count: (measure_count(m: bytes) * bits_per_byte() * 1000000000) / ns) } }
+}
+
+fn workspace_transcript_rate_row_rates(rows: List<TranscriptAppendInterval>) -> List<Bandwidth> {
+  flat_map(rows, r => match workspace_transcript_rate_bandwidth(bytes: r.bytes_appended, span: r.span) {
+    Absent => []
+    Present { value: v } => [v]
+  })
+}
+
+fn workspace_transcript_rate_percentile(rates: List<Bandwidth>, percent: Int) -> Bandwidth? {
+  match permille_percentile(values: map(rates, b => bandwidth_count(b: b)), percent: percent) {
+    Absent => none
+    Present { value: v } => Present { value: bandwidth(count: v) }
+  }
+}
+
+fn workspace_transcript_rate_rate_words(name: String, rate: Bandwidth?, absent: String) -> String {
+  match rate {
+    Absent => join([" ", name, "_bits_per_s=", absent, " ", name, "_bytes_per_s=", absent], "")
+    Present { value: b } => join([" ", name, "_bits_per_s=", to_string(bandwidth_count(b: b)), " ", name, "_bytes_per_s=", to_string(bandwidth_count(b: b) / bits_per_byte())], "")
+  }
+}
+
+fn workspace_transcript_rate_row_line(index: Int, r: TranscriptAppendInterval) -> String {
+  join([
+    "interval ", to_string(index),
+    " span_ms=", to_string(nanosecond_count(n: r.span) / 1000000),
+    " bytes_appended=", to_string(measure_count(m: r.bytes_appended)),
+    " files_grown=", to_string(r.files_grown),
+    " files_created=", to_string(r.files_created),
+    " files_removed=", to_string(r.files_removed),
+    " files_rewritten_same_size=", to_string(r.files_rewritten_same_size),
+    " truncations=", to_string(length(r.truncations)),
+    join(map(r.truncations, t => join([" truncated=", t.member as String, ":", to_string(measure_count(m: t.from)), "->", to_string(measure_count(m: t.to))], "")), ""),
+    " active_writers=", to_string(r.active_writers),
+  ], "")
+}
+
+fn workspace_transcript_rate_rows_text(rows: List<TranscriptAppendInterval>, index: Int, acc: List<String>) -> String {
+  match rows {
+    Empty => join(reverse(acc), "")
+    Cons { head: r, tail: rest } => workspace_transcript_rate_rows_text(rows: rest, index: index + 1, acc: Cons { head: concat(workspace_transcript_rate_row_line(index: index, r: r), "\n"), tail: acc })
+  }
+}
+
+fn workspace_transcript_rate_summary(rate: TranscriptAppendRate) -> String {
+  let total_bytes = byte_size(count: fold(rate.rows, init: 0, f: (acc, r) => acc + measure_count(m: r.bytes_appended)))
+  let total_span = nanosecond(count: fold(rate.rows, init: 0, f: (acc, r) => acc + nanosecond_count(n: r.span)))
+  let touched = fold(rate.rows, init: 0, f: (acc, r) => acc + r.active_writers)
+  let n = length(rate.rows)
+  let rates = workspace_transcript_rate_row_rates(rows: rate.rows)
+  join([
+    "summary intervals=", to_string(n),
+    " measured_window_ms=", to_string(nanosecond_count(n: total_span) / 1000000),
+    " bytes_appended_total=", to_string(measure_count(m: total_bytes)),
+    workspace_transcript_rate_rate_words(name: "mean", rate: workspace_transcript_rate_bandwidth(bytes: total_bytes, span: total_span), absent: "unmeasured(no-span)"),
+    workspace_transcript_rate_rate_words(name: "p95", rate: workspace_transcript_rate_percentile(rates: rates, percent: 95), absent: "unmeasured(no-interval)"),
+    workspace_transcript_rate_rate_words(name: "max", rate: workspace_transcript_rate_percentile(rates: rates, percent: 100), absent: "unmeasured(no-interval)"),
+    " files_touched_per_interval_mean=", if n == 0 { "unmeasured(no interval)" } else { join([to_string(touched / n), " (", to_string(touched), "/", to_string(n), ")"], "") },
+    " truncations_total=", to_string(fold(rate.rows, init: 0, f: (acc, r) => acc + length(r.truncations))),
+    "\n",
+  ], "")
+}
+
+fn workspace_transcript_rate_receipt_head(roots: List<WorkspaceSourceRoot>) -> String {
+  join([
+    "workspace_transcript_rate_observe host=", workspace_source_pack_host as String, "\n",
+    "window_s=", to_string(second_count(s: workspace_transcript_rate_window)), " interval_s=", to_string(second_count(s: workspace_transcript_rate_sample_interval)), "\n",
+    "observed=", workspace_exclusion_spellings(exclusions: workspace_transcript_exclusions), " (the pack's TranscriptExclusion rows; size and mtime only, content never read)\n",
+    join(map(roots, r => join(["root ", r.label as String, " path=", r.path as String], "")), "\n"), "\n",
+    workspace_transcript_rate_caveat as String, "\n",
+  ], "")
+}
+
+fn workspace_transcript_rate_order_words(order: InstantOrder) -> String {
+  match order {
+    InstantAfter => "a later sample instant did not follow the earlier one on the same clock; no span is derived"
+    InstantIncomparable { left: _, right: _ } => "two sample instants are on different clock domains or bases; no span is derived"
+    InstantBefore => "the instants ordered, yet no span was derived"
+    InstantSame => "the instants were the same, yet no span was derived"
+  }
+}
+
+fn workspace_transcript_rate_receipt(head: String, observation: TranscriptRateObservation) -> String {
+  match observation {
+    TranscriptRateObserved { rate: r } => join([head, workspace_transcript_rate_rows_text(rows: r.rows, index: 1, acc: []), workspace_transcript_rate_summary(rate: r), "verdict=observed\n"], "")
+    TranscriptRateRefused { reason: why, rows: rows } => join([head, workspace_transcript_rate_rows_text(rows: rows, index: 1, acc: []), "refused=", why, "\nverdict=refused\n"], "")
+    TranscriptRateClockUndefined { from: _, to: _, order: o, rows: rows } => join([head, workspace_transcript_rate_rows_text(rows: rows, index: 1, acc: []), "refused=", workspace_transcript_rate_order_words(order: o), "\nverdict=refused-clock\n"], "")
+  }
+}
+
+// ── THE OBSERVATION, ON THE HOST THAT HOLDS THE TRANSCRIPTS ────────────────────────────────────
+
+fn workspace_transcript_rate_finish(receipt: String, outcome: ProcessExit) -> ProcessExit {
+  let w = Filesystem.Write(path: workspace_transcript_rate_receipt_path, content: receipt)
+  if w.success == false {
+    exit_failure(reason: join(["workspace_transcript_rate_observe: receipt write failed: ", w.error, "\n", receipt], ""))
+  } else {
+    outcome
+  }
+}
+
+fn workspace_transcript_rate_observe_wet() -> ProcessExit {
+  let host = match hostname_short_read(transport: LocalShell) {
+    HostnameShortCaptured { value: v } => v
+    HostnameShortCaptureRefused { reason: _ } => ""
+  }
+  if host != (workspace_source_pack_host as String) {
+    exit_failure(reason: join(["workspace_transcript_rate_observe: the transcripts live on ", workspace_source_pack_host as String, " but this job runs on '", host, "'; dispatch it with host=", workspace_source_pack_host as String], ""))
+  } else {
+    let slot = workspace_agent_state_slot_observe()
+    let slot_line = concat(workspace_agent_state_slot_words(admission: slot), "\n")
+    match workspace_transcript_rate_roots(slot: slot, fixed: workspace_transcript_rate_select_roots(labels: workspace_transcript_rate_fixed_root_labels, declared: workspace_source_fixed_roots)) {
+      TranscriptRateRootUndeclared { label: l } => exit_failure(reason: join(["workspace_transcript_rate_observe: no fixed workspace source root is labelled '", l as String, "'"], ""))
+      TranscriptRateSlotRefused { slot: _ } => workspace_transcript_rate_finish(receipt: join(["workspace_transcript_rate_observe host=", host, "\n", slot_line, "verdict=refused-agent-state-slot\n"], ""), outcome: exit_failure(reason: concat("workspace_transcript_rate_observe: ", slot_line)))
+      TranscriptRateRootsSelected { roots: roots } => {
+        let head = concat(workspace_transcript_rate_receipt_head(roots: roots), slot_line)
+        let observation = workspace_transcript_rate_window_of(
+          baseline: workspace_transcript_rate_sample_wet(roots: roots, label: "workspace-transcript-rate-baseline"),
+          remaining: workspace_transcript_rate_interval_count(),
+          next: k => workspace_transcript_rate_sample_wet(roots: roots, label: concat("workspace-transcript-rate-sample-", to_string(k))),
+          pause: _ => sleep_delay_seconds_second_carrier_projection(duration: workspace_transcript_rate_sample_interval),
+          rows: [],
+        )
+        let receipt = workspace_transcript_rate_receipt(head: head, observation: observation)
+        match observation {
+          TranscriptRateObserved { rate: _ } => workspace_transcript_rate_finish(receipt: receipt, outcome: ExitSuccess)
+          TranscriptRateRefused { reason: why, rows: _ } => workspace_transcript_rate_finish(receipt: receipt, outcome: exit_failure(reason: concat("workspace_transcript_rate_observe: ", why)))
+          TranscriptRateClockUndefined { from: _, to: _, order: o, rows: _ } => workspace_transcript_rate_finish(receipt: receipt, outcome: exit_failure(reason: concat("workspace_transcript_rate_observe: ", workspace_transcript_rate_order_words(order: o))))
+        }
+      }
+    }
+  }
+}
diff --git a/dag/gunbc/fleet/altra_firmware_library.dag b/dag/gunbc/fleet/altra_firmware_library.dag
index 4a4b50987cf..0b33478171f 100644
--- a/dag/gunbc/fleet/altra_firmware_library.dag
+++ b/dag/gunbc/fleet/altra_firmware_library.dag
@@ -13,9 +13,12 @@ import gunbc.fleet_bmc_observation { srv3_bmc_firmware_observation, srv4_bmc_fir
 import extdeps.boards.asrock_rack {
   asrock_altrad8ud_bios_3_10_instant_flash_release,
   asrock_altrad8ud_bmc_3_22_00_release, asrock_altrad8ud_download_authority,
+  asrock_altrad8ud_bmc_3_22_00_push_artifact_name, asrock_altrad8ud_bmc_3_22_00_push_artifact_bytes,
+  asrock_altrad8ud_bmc_3_22_00_push_artifact_digest,
 }
 import extdeps.boards.asrock_altrad8ud_beta_firmware {
   AsrockAltrad8udBetaFirmwareListing, asrock_altrad8ud_beta_firmware_listings,
+  asrock_altrad8ud_beta_bios_4_01_listing, asrock_altrad8ud_beta_scp_2_10_20260210_listing,
   asrock_altrad8ud_beta_disclaimer, AsrockBetaFirmwareVersion,
   SemanticFirmwareVersion, ScpBuildVersion,
 }
@@ -29,8 +32,11 @@ import extdeps.ampere.altra_ssif_patch {
 // The BIOS ZIP matched the existing vendor-download digest. BMC ZIP contains
 // altrad8ud-1l2t_3.22.00.static.mtd.tar; ROM ZIP contains ALTRAD8UD-1L2T_3.10.ROM.
 // A Drive /view link is for human retrieval, not an unauthenticated raw download.
+// A beta build is a listing on ASRock's beta table, not a cited release row, so
+// its archive names the listing it was downloaded against.
 type AltraLibraryArchiveSubject
   = FirmwareDistribution { firmware_release: FirmwareReleaseRow }
+  | BetaFirmwareDistribution { listing: AsrockAltrad8udBetaFirmwareListing }
   | SsifKernelPatchBundle
 
 type AltraLibraryArchive {
@@ -63,10 +69,102 @@ data altra_firmware_drive_archives: List<AltraLibraryArchive> = [
     archive_bytes: byte_size(count: 5697),
     archive_digest: Present { value: sha256_digest(hex: "74ca2343e20b682f419f3240006dfc55ed391978e57c86bdce698e8b72ee0531") },
   },
+  AltraLibraryArchive {
+    subject: BetaFirmwareDistribution { listing: asrock_altrad8ud_beta_bios_4_01_listing },
+    archive_name: "ALTRAD8UD-1L2T(4.01)TAR.zip",
+    human_retrieval: uri_https(locator: "drive.google.com/file/d/1HNtIH6UOkuBHSXgr5SWH6ERYR7Gev8wz/view"),
+    archive_bytes: byte_size(count: 5359843),
+    archive_digest: Present { value: sha256_digest(hex: "5753a13b92c5f3c9cfeb5dc5fc2f06c6f1ef34e8e594a7ed9598a2ae3177d5b0") },
+  },
+  AltraLibraryArchive {
+    subject: BetaFirmwareDistribution { listing: asrock_altrad8ud_beta_bios_4_01_listing },
+    archive_name: "ALTRAD8UD-1L2T(4.01)ROM.zip",
+    human_retrieval: uri_https(locator: "drive.google.com/file/d/1gMuW0TU0bDwCSC60jtJbC3a8OfRtcPnb/view"),
+    archive_bytes: byte_size(count: 5359521),
+    archive_digest: Present { value: sha256_digest(hex: "8adc6439518a95b5aa1d472ae37d53f2814e43008eba524d2526c027a8f0dc51") },
+  },
+  AltraLibraryArchive {
+    subject: BetaFirmwareDistribution { listing: asrock_altrad8ud_beta_scp_2_10_20260210_listing },
+    archive_name: "ALTRAD8UD-1L2T(2.10.20260210)SCP.zip",
+    human_retrieval: uri_https(locator: "drive.google.com/file/d/1nK_8RYtqWTWcTul5SL93MjlLNWB8JUvl/view"),
+    archive_bytes: byte_size(count: 169220),
+    archive_digest: Present { value: sha256_digest(hex: "2b4de6a81e7f386af0e01ad709159dd71ccef7585d85674b4647f1b361778a76") },
+  },
+  AltraLibraryArchive {
+    subject: BetaFirmwareDistribution { listing: asrock_altrad8ud_beta_scp_2_10_20260210_listing },
+    archive_name: "ALTRAD8UD-1L2T(2.10.20260210)SLIM.zip",
+    human_retrieval: uri_https(locator: "drive.google.com/file/d/1ruwky8Ye7WWLndhcWIxVr1pBRzol6Ctb/view"),
+    archive_bytes: byte_size(count: 168971),
+    archive_digest: Present { value: sha256_digest(hex: "8eac1c95fd35e36d52b2ee0ef3c896e75708aff763a591524cb50fe7cb8f610b") },
+  },
+]
+
+// THE FLASHABLE MEMBER INSIDE EACH FIRMWARE ARCHIVE. An archive digest identifies
+// the download; a flash consumes the member, a different byte sequence. Where the
+// member is an OpenBMC push tar its MANIFEST version is recorded as read, because it
+// need not equal the archive's name: the SCP archive named 2.10.20260210 carries
+// obmc-scp-altrad8ud-1l2t-4.01.tar whose MANIFEST reads version=4.01, Type=scp, so a
+// BMC reading back that push reports 4.01. Measured 2026-10-08.
+type AltraLibraryMemberManifest
+  = OpenBmcManifestVersion { version: NonEmptyStr }
+  | NoOpenBmcManifest
+
+type AltraLibraryMember {
+  archive_name: NonEmptyStr
+  member_name: NonEmptyStr
+  member_bytes: ByteSize
+  member_digest: Digest
+  manifest: AltraLibraryMemberManifest
+}
+
+data altra_firmware_archive_members: List<AltraLibraryMember> = [
+  AltraLibraryMember {
+    archive_name: "ALTRAD8UD-1L2T(3.10)ROM.zip",
+    member_name: "ALTRAD8UD-1L2T_3.10.ROM",
+    member_bytes: byte_size(count: 33554432),
+    member_digest: sha256_digest(hex: "1c8b1a9375db36bd3aba3192f0f535808addc72fd7d6a673030bd98e8a100009"),
+    manifest: NoOpenBmcManifest,
+  },
+  AltraLibraryMember {
+    archive_name: "ALTRAD8UD-1L2T(03.22.00)BMC.zip",
+    member_name: asrock_altrad8ud_bmc_3_22_00_push_artifact_name,
+    member_bytes: asrock_altrad8ud_bmc_3_22_00_push_artifact_bytes,
+    member_digest: asrock_altrad8ud_bmc_3_22_00_push_artifact_digest,
+    manifest: OpenBmcManifestVersion { version: "3.22.00" },
+  },
+  AltraLibraryMember {
+    archive_name: "ALTRAD8UD-1L2T(4.01)TAR.zip",
+    member_name: "obmc-bios-altrad8ud-1l2t-4.01.all.tar",
+    member_bytes: byte_size(count: 33566720),
+    member_digest: sha256_digest(hex: "33937359ef707cf1a2bf2c55bf6c944011ed28c41cd928ba1785e5a14193c7a6"),
+    manifest: OpenBmcManifestVersion { version: "4.01" },
+  },
+  AltraLibraryMember {
+    archive_name: "ALTRAD8UD-1L2T(4.01)ROM.zip",
+    member_name: "ALTRAD8UD-1L2T_4.01.ROM",
+    member_bytes: byte_size(count: 33554432),
+    member_digest: sha256_digest(hex: "85d549ad93bc54ed2cce9aa6ec883880bb90253286f1f0dfb4cc8d3ac4288efa"),
+    manifest: NoOpenBmcManifest,
+  },
+  AltraLibraryMember {
+    archive_name: "ALTRAD8UD-1L2T(2.10.20260210)SCP.zip",
+    member_name: "obmc-scp-altrad8ud-1l2t-4.01.tar",
+    member_bytes: byte_size(count: 266240),
+    member_digest: sha256_digest(hex: "c3f6b8903c93c8bb8d51d865ff71c6c77a5dd0c0d400e180674bdd0b8b8ac248"),
+    manifest: OpenBmcManifestVersion { version: "4.01" },
+  },
+  AltraLibraryMember {
+    archive_name: "ALTRAD8UD-1L2T(2.10.20260210)SLIM.zip",
+    member_name: "altra_scp_signed_2.10.20260210.slim",
+    member_bytes: byte_size(count: 261120),
+    member_digest: sha256_digest(hex: "d7f748c6f29fbf02f9079bd19f9b4959e645425e20996c058481d6c282cca57e"),
+    manifest: NoOpenBmcManifest,
+  },
 ]
 
 type AltraFirmwareReferenceReport {
   drive_archives: List<AltraLibraryArchive>
+  archive_members: List<AltraLibraryMember>
   ssif_patch_bundle: AltraSsifPatchBundle
   beta_reference: Uri
   beta_disclaimer: NonEmptyStr
@@ -109,6 +207,7 @@ fn beta_bmc_version_comparisons(
 fn reference_report() -> AltraFirmwareReferenceReport {
   AltraFirmwareReferenceReport {
     drive_archives: altra_firmware_drive_archives,
+    archive_members: altra_firmware_archive_members,
     ssif_patch_bundle: altra_ssif_v6,
     beta_reference: asrock_altrad8ud_download_authority.uri,
     beta_disclaimer: asrock_altrad8ud_beta_disclaimer,
diff --git a/dag/gunbc/fleet/branch_run_grant_broker_workflow.dag b/dag/gunbc/fleet/branch_run_grant_broker_workflow.dag
new file mode 100644
index 00000000000..aa790a1fc6b
--- /dev/null
+++ b/dag/gunbc/fleet/branch_run_grant_broker_workflow.dag
@@ -0,0 +1,210 @@
+module gunbc.branch_run_grant_broker_workflow
+
+import std.types { Bool, Int, List, String }
+import std.optional { Present, Absent }
+import v2.std.algebra { list_map }
+import extdeps.languages.yaml.types { yaml_string, yaml_int, yaml_bool, kv, YamlKeyValue }
+import extdeps.languages.yaml.emit { emit_yaml, EmittedYaml, YamlEmitRefused, yaml_emit_refusal_text }
+import extdeps.languages.yaml.gha_workflow { project_workflow_to_yaml }
+import extdeps.github.actions {
+  Workflow, Job, Step, RunStep, UsesStep,
+  WorkflowRunTriggered, WorkflowRunRequestedActivity,
+  WorkflowPermissions, PermRead, PermWrite,
+  HostedRunner, Ubuntu2404Arm
+}
+import gunbc.action_use_admission {
+  admit_workflow_checkout_refs, WorkflowCheckoutRefsAdmitted, WorkflowCheckoutRefsRefused, workflow_checkout_refs_refusal_reason, checkout_action,
+}
+import gunbc.roadmap_execution_contract { CargoCapability, RustcCapability, RustfmtCapability, RustupCapability }
+import gunbc.workflow_capability_closure {
+  CapabilityAnnotatedStep, StepCapabilityRole, capability_neutral, provides_only, consumes_only,
+  workflow_job_capability_closure, capability_closure_is_closed
+}
+import gunbc.toolchain_home_standing {
+  admit_workflow_toolchain_homes, WorkflowToolchainHomesAdmitted, WorkflowToolchainHomeRefused, toolchain_home_refusal_reason
+}
+import gunbc.toolchain_workflow_steps { toolchain_home_isolation_step, toolchain_pin_rustup_default_step }
+import gunbc.witness_floor_workflow { witness_floor_toolchain_step, witness_floor_build_step }
+import gunbc.repo_self_build { repo_self_build_command }
+import gunbc.ci_spec { gunbc_ci_branch_run_grant_broker_invoke }
+import gunbc.auth.branch_dispatch_federation { branch_run_key_variable, run_scoped_modes }
+import gunbc.auth.branch_run_grant_broker { branch_run_title_variable }
+
+// THE WORKFLOW THAT ASKS FOR A RUN-SCOPED GRANT ON A BRANCH RUN'S BEHALF (gunbc.auth.branch_run_grant_broker).
+//
+// IT RUNS FROM THE DEFAULT BRANCH. GitHub takes a workflow_run workflow's definition from the default
+// branch only, so nothing a branch edits decides what this job does or whether it runs; it is
+// triggered when a fleet-converge run is REQUESTED, so the grant can be on its way before the
+// requesting run reaches the step that waits for it.
+//
+// IT HOLDS THE ONE CAPABILITY THE REQUESTING RUN MUST NOT: actions: write, to dispatch the grant run.
+// It never fetches the branch's tree -- its checkout takes no ref -- and it reads the run id, attempt
+// and title from GitHub's event, passed through the environment rather than spliced into a script.
+//
+// IT RUNS ON A GITHUB-HOSTED RUNNER for the reason gunbc.heal_publisher_workflow gives: the fleet's
+// self-hosted runners also run branch jobs and share a filesystem between slots, so a token minted on
+// one of them is reachable from code a branch wrote.
+
+data branch_run_grant_broker_workflow_name: String = "branch-run-grant-broker"
+
+data branch_run_grant_broker_job_id: String = "broker"
+
+data branch_run_grant_broker_timeout_minutes: Int = 40
+
+data branch_run_grant_broker_requesting_workflow: String = "fleet-converge"
+
+data branch_run_grant_broker_required_bins: List<String> = ["gunbc"]
+
+// ONLY A DISPATCHED fleet-converge RUN OF THIS REPOSITORY WHOSE TITLE NAMES A RUN-SCOPED MODE. The
+// title test is a cheap pre-filter so other dispatches spend no runner; the broker entry re-parses the
+// mode exactly, so a title that merely contains the word asks for nothing it maps to no account.
+fn branch_run_grant_broker_job_condition() -> String {
+  join([
+    "github.event.workflow_run.event == 'workflow_dispatch'",
+    " && github.event.workflow_run.head_repository.full_name == github.repository",
+    " && (",
+    join(map(run_scoped_modes(), m => join(["contains(github.event.workflow_run.display_title, ' ", m.mode as String, " ')"], "")), " || "),
+    ")",
+  ], "")
+}
+
+fn branch_run_grant_broker_checkout_step() -> Step {
+  UsesStep {
+    name: Present { value: "Checkout the default branch this broker runs from" },
+    id: none,
+    uses: checkout_action,
+    with: Present { value: [
+      kv(key: "fetch-depth", value: yaml_int(n: 1)),
+      kv(key: "persist-credentials", value: yaml_bool(b: false)),
+    ] },
+    env: none,
+    if_condition: none,
+    continue_on_error: none,
+    timeout_minutes: none
+  }
+}
+
+data branch_run_grant_broker_build_step_name: String = "Build the broker this job runs from the default branch"
+
+fn branch_run_grant_broker_step() -> Step {
+  RunStep {
+    name: Present { value: "Dispatch the branch_run_grant run at main for the requested run attempt" },
+    id: none,
+    run: gunbc_ci_branch_run_grant_broker_invoke(),
+    shell: none,
+    env: Present { value: [
+      kv(key: "GITHUB_TOKEN", value: yaml_string(s: "${{ github.token }}")),
+      kv(key: branch_run_key_variable as String, value: yaml_string(s: "${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}")),
+      kv(key: branch_run_title_variable as String, value: yaml_string(s: "${{ github.event.workflow_run.display_title }}")),
+    ] },
+    working_directory: none,
+    if_condition: none,
+    continue_on_error: none,
+    timeout_minutes: Present { value: 5 }
+  }
+}
+
+type BrokerBoundStep {
+  step: Step
+  role: StepCapabilityRole
+  step_name: String
+}
+
+fn branch_run_grant_broker_bound_steps() -> List<BrokerBoundStep> {
+  [
+    BrokerBoundStep { step: branch_run_grant_broker_checkout_step(), role: capability_neutral, step_name: "Checkout the default branch this broker runs from" },
+    BrokerBoundStep { step: toolchain_home_isolation_step(), role: capability_neutral, step_name: "Isolate toolchain homes" },
+    BrokerBoundStep {
+      step: witness_floor_toolchain_step(),
+      role: provides_only(capabilities: [CargoCapability, RustcCapability, RustfmtCapability, RustupCapability]),
+      step_name: "Install Rust toolchain",
+    },
+    BrokerBoundStep {
+      step: toolchain_pin_rustup_default_step(),
+      role: consumes_only(capabilities: [RustupCapability, CargoCapability]),
+      step_name: "Pin rustup default (isolated RUSTUP_HOME has no default toolchain)",
+    },
+    BrokerBoundStep {
+      step: witness_floor_build_step(step_name: branch_run_grant_broker_build_step_name, build_script: repo_self_build_command(bins: branch_run_grant_broker_required_bins)),
+      role: consumes_only(capabilities: [CargoCapability]),
+      step_name: branch_run_grant_broker_build_step_name,
+    },
+    BrokerBoundStep { step: branch_run_grant_broker_step(), role: capability_neutral, step_name: "Dispatch the branch_run_grant run at main for the requested run attempt" },
+  ]
+}
+
+fn branch_run_grant_broker_capability_closure_holds() -> Bool {
+  capability_closure_is_closed(
+    v: workflow_job_capability_closure(
+      steps: list_map(xs: branch_run_grant_broker_bound_steps(), f: fn(b) { CapabilityAnnotatedStep { step_name: b.step_name, role: b.role } }),
+    ),
+  )
+}
+
+// actions: WRITE is the dispatch, and it is the job's only write; contents: READ is this checkout.
+// No id-token: the broker federates to nothing.
+data branch_run_grant_broker_job_permissions: WorkflowPermissions = WorkflowPermissions {
+  contents: Present { value: PermRead },
+  pull_requests: none,
+  issues: none,
+  actions: Present { value: PermWrite },
+  id_token: none
+}
+
+fn branch_run_grant_broker_job() -> Job {
+  Job {
+    id: branch_run_grant_broker_job_id,
+    name: none,
+    runner: HostedRunner { label: Ubuntu2404Arm },
+    environment: none,
+    steps: list_map(xs: branch_run_grant_broker_bound_steps(), f: fn(b) { b.step }),
+    needs: [],
+    env: none,
+    outputs: none,
+    if_condition: Present { value: branch_run_grant_broker_job_condition() },
+    timeout_minutes: Present { value: branch_run_grant_broker_timeout_minutes },
+    continue_on_error: none,
+    concurrency: none,
+    permissions: Present { value: branch_run_grant_broker_job_permissions }
+  }
+}
+
+data branch_run_grant_broker_workflow: Workflow = Workflow {
+  name: branch_run_grant_broker_workflow_name,
+  run_name: none,
+  on: [
+    WorkflowRunTriggered {
+      workflows: [branch_run_grant_broker_requesting_workflow],
+      branches: ["**"],
+      activity: WorkflowRunRequestedActivity
+    }
+  ],
+  concurrency: none,
+  env: Present { value: [kv(key: "CARGO_TERM_COLOR", value: yaml_string(s: "always"))] },
+  permissions: none,
+  jobs: [branch_run_grant_broker_job()]
+}
+
+type BranchRunGrantBrokerWorkflowGenerationOutcome
+  = BranchRunGrantBrokerWorkflowGenerated { content: String }
+  | BranchRunGrantBrokerWorkflowGenerationRefused { reason: String }
+
+fn expected_branch_run_grant_broker_workflow_yml() -> BranchRunGrantBrokerWorkflowGenerationOutcome {
+  match admit_workflow_checkout_refs(workflow: branch_run_grant_broker_workflow, declared: []) {
+    WorkflowCheckoutRefsRefused { refusals: crs } =>
+      BranchRunGrantBrokerWorkflowGenerationRefused { reason: workflow_checkout_refs_refusal_reason(workflow_module: "gunbc.branch_run_grant_broker_workflow", refusals: crs) }
+    WorkflowCheckoutRefsAdmitted => match admit_workflow_toolchain_homes(workflow: branch_run_grant_broker_workflow) {
+      WorkflowToolchainHomeRefused { job_id: j, refusal: r } =>
+        BranchRunGrantBrokerWorkflowGenerationRefused { reason: toolchain_home_refusal_reason(job_id: j, refusal: r) }
+      WorkflowToolchainHomesAdmitted =>
+        if !branch_run_grant_broker_capability_closure_holds() {
+          BranchRunGrantBrokerWorkflowGenerationRefused { reason: "REFUSED gunbc.branch_run_grant_broker_workflow: the job's capability closure does not hold. No workflow yaml was emitted." }
+        } else {
+          match emit_yaml(v: project_workflow_to_yaml(workflow: branch_run_grant_broker_workflow)) {
+            EmittedYaml { text: t } => BranchRunGrantBrokerWorkflowGenerated { content: t }
+            YamlEmitRefused { path: p, reason: r } => BranchRunGrantBrokerWorkflowGenerationRefused { reason: yaml_emit_refusal_text(module_path: "gunbc.branch_run_grant_broker_workflow", path: p, reason: r) }
+          }
+        }
+    }
+  }
+}
diff --git a/dag/gunbc/fleet/convergence_fold.dag b/dag/gunbc/fleet/convergence_fold.dag
index 432da9faf74..ae8065babc0 100644
--- a/dag/gunbc/fleet/convergence_fold.dag
+++ b/dag/gunbc/fleet/convergence_fold.dag
@@ -42,12 +42,18 @@ import gunbc.host_convergence_census {
 // independent readback does not ground. Incomplete is neither refused (the domain decided not to act,
 // or acting was refused before any effect) nor converged, and it never satisfies a precondition.
 //
+// WHAT THIS HOME CARRIES SINCE O1c-3, with BmcSecure as first gated consumer
+// (gunbc.machine_intake_arrival_converge): a step is Ungated or GatedOnAuthorization; a gated
+// instance whose receipt declares that authorization was required (the Apply arm) refuses without a
+// discharge for that (run, step, subject); Noop does not require one (parent D4). A discharge's
+// principal is NonEmptyStr at the sole constructor, so the fold does not re-check emptiness.
+// The pattern itself is selected before the fold (DESIGN §3d); the fold only checks discharge.
+//
 // WHAT IT STILL DOES NOT CARRY, because no consumer exercises it yet and a designed fixture is not an
-// inhabitant (DESIGN §3 pairing obligation): the authorization gate and its discharge, principals,
-// mutation lanes, pending with re-attach across runs, subject quantifiers (all-of / any-of over a
-// subject set), the domain-declared cheap readback, and order derived from preconditions alone where
-// no order authority exists. Each lands with its first real consumer: O1c-3 (BmcSecure and
-// ManagedHostAdmission), the Spark arm.
+// inhabitant (DESIGN §3 pairing obligation): pending with re-attach across runs, subject quantifiers
+// (all-of / any-of over a subject set), the domain-declared cheap readback, and order derived from
+// preconditions alone where no order authority exists. Each lands with its first real consumer: the
+// Spark arm.
 
 // A RUN AND A SUBJECT ARE THE CALLER'S IDENTITIES, BRANDED SO NEITHER IS READ AS THE OTHER. The
 // subject key is the domain's canonical spelling of what one step instance converges: for the arrival
@@ -96,10 +102,26 @@ fn precondition_key(p: StepPrecondition, key: StepInstanceKey) -> StepInstanceKe
 // A STEP: its census identity, the ONE member of the order authority it is bound to, and its
 // preconditions. The member type is the authority's own (for the arrival prefix
 // gunbc.machine_intake_phase IntakePhase); the fold reads it only through the authority's rank.
+// A STEP IS UNGATED, OR GATED ON AN AUTHORIZATION DISCHARGED FOR THAT INSTANCE. Selected before the
+// fold: the caller names which pattern discharged it. The fold never selects a pattern.
+type StepGate
+  = StepUngated
+  | StepGatedOnAuthorization
+
 type ConvergenceStep<M> {
   identity: DeclarationRef
   order_member: M
   preconditions: List<StepPrecondition>
+  gate: StepGate
+}
+
+fn ungated_readonly_step<M>(identity: DeclarationRef, order_member: M, preconditions: List<StepPrecondition>) -> ConvergenceStep<M> {
+  ConvergenceStep {
+    identity: identity,
+    order_member: order_member,
+    preconditions: preconditions,
+    gate: StepUngated,
+  }
 }
 
 // THE ORDER AUTHORITY: which declaration owns the order, and its ranking. Absent is an unranked
@@ -309,17 +331,48 @@ fn step_outcome_incomplete<R, C, I>(outcome: StepOutcome<R, C, I>) -> I? {
 type ConvergenceReceiptProjection<R> sole_constructor {
   key_of: fn(R) -> StepInstanceKey
   consumed_of: fn(R) -> List<StepInstanceKey>
+  authorization_required_of: fn(R) -> Bool
 }
 
-fn convergence_receipt_projection<R>(key_of: fn(R) -> StepInstanceKey, consumed_of: fn(R) -> List<StepInstanceKey>) -> ConvergenceReceiptProjection<R>
+fn convergence_receipt_projection<R>(key_of: fn(R) -> StepInstanceKey, consumed_of: fn(R) -> List<StepInstanceKey>, authorization_required_of: fn(R) -> Bool) -> ConvergenceReceiptProjection<R>
   admit_callers: [
     decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "arrival_receipt_projection"),
     decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_a_precondition_is_not_satisfied_by_a_receipt_for_another_subject"),
     decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_a_precondition_is_not_satisfied_by_a_receipt_from_another_run"),
     decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_an_incomplete_instance_satisfies_no_dependent_and_the_run_is_incomplete"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_noop_needs_no_discharge"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_without_discharge_refuses"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_with_the_mtjade1_standing_grant_converges_over_the_dry_world"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "apply_fold_undischarged"),
+  ]
+{
+  ConvergenceReceiptProjection { key_of: key_of, consumed_of: consumed_of, authorization_required_of: authorization_required_of }
+}
+
+// A DISCHARGE FOR ONE GATED INSTANCE, sealed: the domain verifies the selected pattern (operator
+// capability, standing grant coverage, or federated workload principal) and mints this row; the fold
+// only checks that a gated Apply has one for this key. Noop never requires it.
+type InstanceAuthorization sole_constructor {
+  key: StepInstanceKey
+  principal: NonEmptyStr
+}
+
+fn instance_authorization(key: StepInstanceKey, principal: NonEmptyStr) -> InstanceAuthorization
+  admit_callers: [
+    decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "discharge_bmc_secure_apply"),
+    decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "capability_discharge"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_without_discharge_refuses"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_noop_needs_no_discharge"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "apply_fold_undischarged"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_discharge_for_another_run_refuses"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_discharge_for_another_unit_refuses"),
   ]
 {
-  ConvergenceReceiptProjection { key_of: key_of, consumed_of: consumed_of }
+  InstanceAuthorization { key: key, principal: principal }
+}
+
+fn instance_authorization_for(discharges: List<InstanceAuthorization>, key: StepInstanceKey) -> InstanceAuthorization? {
+  discharges |> filter(d => step_instance_key_eq(a: d.key, b: key)) |> first()
 }
 
 type StepInstanceRefusal<C>
@@ -327,6 +380,7 @@ type StepInstanceRefusal<C>
   | StepOutcomeAbsent
   | PreconditionUnmet { precondition: StepInstanceKey, consumed: List<StepInstanceKey> }
   | ConsumedReceiptNotAPrecondition { consumed: StepInstanceKey }
+  | AuthorizationUndischarged
 
 type StepInstanceStanding<R, C, I>
   = InstanceConverged { key: StepInstanceKey, receipt: R }
@@ -472,6 +526,7 @@ fn walk_instance<M, R, C, I>(
   subject: StepSubjectKey,
   outcomes: List<StepOutcome<R, C, I>>,
   projection: ConvergenceReceiptProjection<R>,
+  discharges: List<InstanceAuthorization>,
 ) -> LedgerWalk<R, C, I> {
   let key = step_instance_key(run: run, step: ranked.step.identity, subject: subject)
   match acc.line {
@@ -483,11 +538,31 @@ fn walk_instance<M, R, C, I>(
         Present { value: o } =>
           match o {
             StepRefused { key: _, cause: c } => InstanceRefused { key: key, cause: DomainRefused { cause: c } }
-            StepIncomplete { key: _, cause: i } => InstanceIncomplete { key: key, cause: i }
+            StepIncomplete { key: _, cause: i } =>
+              match ranked.step.gate {
+                StepUngated => InstanceIncomplete { key: key, cause: i }
+                StepGatedOnAuthorization =>
+                  match instance_authorization_for(discharges: discharges, key: key) {
+                    Absent => InstanceRefused { key: key, cause: AuthorizationUndischarged }
+                    Present { value: _ } => InstanceIncomplete { key: key, cause: i }
+                  }
+              }
             StepEstablished { receipt: r } =>
               match precondition_refusal(step: ranked.step, key: key, consumed: projection.consumed_of(r), ledger: acc.instances) {
                 Present { value: why } => InstanceRefused { key: key, cause: why }
-                Absent => InstanceConverged { key: key, receipt: r }
+                Absent =>
+                  match ranked.step.gate {
+                    StepUngated => InstanceConverged { key: key, receipt: r }
+                    StepGatedOnAuthorization =>
+                      if projection.authorization_required_of(r) {
+                        match instance_authorization_for(discharges: discharges, key: key) {
+                          Absent => InstanceRefused { key: key, cause: AuthorizationUndischarged }
+                          Present { value: _ } => InstanceConverged { key: key, receipt: r }
+                        }
+                      } else {
+                        InstanceConverged { key: key, receipt: r }
+                      }
+                  }
               }
           }
       }
@@ -496,20 +571,19 @@ fn walk_instance<M, R, C, I>(
   }
 }
 
-// THE RUN FOLD: one ledger per run, each instance converged, refused, incomplete or not reached, in the admitted
-// order. The verdict is derived from the ledger and names the instance the line stopped at.
 fn fold_convergence_run<M, R, C, I>(
   plan: AdmittedConvergencePlan<M>,
   run: ConvergenceRunId,
   subject: StepSubjectKey,
   outcomes: List<StepOutcome<R, C, I>>,
   projection: ConvergenceReceiptProjection<R>,
+  discharges: List<InstanceAuthorization>,
 ) -> ConvergenceRunVerdict<R, C, I> {
   match first_outcome_refusal(run: run, subject: subject, plan: plan, keys: map(outcomes, o => outcome_key(outcome: o, projection: projection))) {
     Present { value: r } => RunOutcomesRefused { cause: r }
     Absent => {
       let walked = fold(plan.steps, init: LedgerWalk { line: LineOpen, instances: [] }, f: (acc, s) =>
-        walk_instance(acc: acc, ranked: s, run: run, subject: subject, outcomes: outcomes, projection: projection))
+        walk_instance(acc: acc, ranked: s, run: run, subject: subject, outcomes: outcomes, projection: projection, discharges: discharges))
       let ledger = ConvergenceRunLedger { run: run, subject: subject, order_authority: plan.authority, instances: walked.instances }
       match walked.line {
         LineOpen => RunConverged { run: ConvergedRun { ledger: ledger } }
diff --git a/dag/gunbc/fleet/fleet_asset_identity.dag b/dag/gunbc/fleet/fleet_asset_identity.dag
index 880c033172b..3d7958a773c 100644
--- a/dag/gunbc/fleet/fleet_asset_identity.dag
+++ b/dag/gunbc/fleet/fleet_asset_identity.dag
@@ -20,8 +20,6 @@ data chassis_srv1: PhysicalAssetIdentity = "chassis-srv1" as PhysicalAssetIdenti
 data chassis_srv2: PhysicalAssetIdentity = "chassis-srv2" as PhysicalAssetIdentity
 data chassis_srv3: PhysicalAssetIdentity = "chassis-srv3" as PhysicalAssetIdentity
 data chassis_srv4: PhysicalAssetIdentity = "chassis-srv4" as PhysicalAssetIdentity
-data chassis_srv5_placeholder: PhysicalAssetIdentity = "chassis-srv5-placeholder" as PhysicalAssetIdentity
-data chassis_srv6_placeholder: PhysicalAssetIdentity = "chassis-srv6-placeholder" as PhysicalAssetIdentity
 data switch_01: PhysicalAssetIdentity = "switch-01" as PhysicalAssetIdentity
 data printer_01: PhysicalAssetIdentity = "printer-01" as PhysicalAssetIdentity
 data printer_02: PhysicalAssetIdentity = "printer-02" as PhysicalAssetIdentity
diff --git a/dag/gunbc/fleet/fleet_capacity_control.dag b/dag/gunbc/fleet/fleet_capacity_control.dag
index 7ab8da165be..ba401147846 100644
--- a/dag/gunbc/fleet/fleet_capacity_control.dag
+++ b/dag/gunbc/fleet/fleet_capacity_control.dag
@@ -3,7 +3,7 @@ module gunbc.fleet_capacity_control
 import std.types { String, NonEmptyStr, Bool, List, Int }
 import product.host_identity { HostIdentity }
 import extdeps.llm.cli_lifecycle { ProviderKind, ClaudeCliProvider, CodexCliProvider, CursorCliProvider, provider_kind_label }
-import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
+import gunbc.fleet_enrollment { InteractiveSessionParticipation, hosts_enrolled_for }
 
 // THE OPERATOR'S CONTROL OVER ACTIVE FLEET CAPACITY, ON TWO AXES THAT ARE NOT THE SAME FACT.
 //
@@ -209,7 +209,7 @@ fn fleet_capacity_admission_line(admission: CapacityAdmission) -> String {
 // THE FLEET THIS CONTROL SPANS. Four hosts, taken from the fleet identity authority rather than
 // respelled, so a host added there is a host this control can reach without an edit here.
 fn capacity_controlled_hosts() -> List<HostIdentity> {
-  [operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4]
+  hosts_enrolled_for(wanted: InteractiveSessionParticipation)
 }
 
 fn capacity_controlled_providers() -> List<ProviderKind> {
diff --git a/dag/gunbc/fleet/fleet_converge_cli.dag b/dag/gunbc/fleet/fleet_converge_cli.dag
index 316ad3491ea..142ac024e52 100644
--- a/dag/gunbc/fleet/fleet_converge_cli.dag
+++ b/dag/gunbc/fleet/fleet_converge_cli.dag
@@ -43,6 +43,18 @@ import gunbc.host_effect {
 import gunbc.host_effect_realize { host_effect_apply }
 import std.realization_reconcile { Converged, NotConverged }
 import product.host_identity { HostIdentity }
+import gunbc.hostname_allocation { resolve_host_selector, HostSelectorResolved, HostSelectorAmbiguous, HostSelectorUnknown }
+import gunbc.fleet_enrollment { HostEnrollmentIntent, enrollment_for_host }
+import gunbc.fleet_host_backing { OwnedMachine, ProviderGuest }
+import gunbc.provider_guest_adoption {
+  GuestAdopted,
+  GuestAdoptionRefused,
+  MicroVmExecutionAdmissible,
+  MicroVmExecutionRefused,
+  adopt_local_provider_guest,
+  guest_adoption_refusal_text,
+  microvm_execution_refusal_text,
+}
 import gunbc.ci_runner_placement {
   HostRunnerDeploymentRefusal,
   HostRunnerDeploymentRefused, HostRunnerDeploymentDerived,
@@ -50,7 +62,7 @@ import gunbc.ci_runner_placement {
   runner_deployment_plan, runner_host_deployment_for,
   host_deployment_refusal_text,
 }
-import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4, operator_host_srv5, operator_host_srv6 }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 import std.types { FilePath }
 
 data gunbc_converge_cli_stage0_receiver_disposition: Disposition = Terminal {
@@ -73,6 +85,8 @@ type ConvergeCliRefusalCause
   = PolicyUnsound { reason: String }
   | UnknownHost { host: String }
   | SparkPreEnrollment { host: String }
+  | ProviderGuestNotAdopted { host: String, cause: String }
+  | ProviderGuestExecutionRefused { host: String, cause: String }
   | SparkManagedAccessUnmeasured { host: String, dissolves_on: String }
   | ComputeInventoryAbsent { host: String }
   | KnobFrontier { reason: String }
@@ -143,6 +157,8 @@ fn converge_cli_refusal_message(cause: ConvergeCliRefusalCause) -> String {
   match cause {
     PolicyUnsound { reason: why } => concat("gunbc converge: fleet policy unsound — ", why)
     UnknownHost { host: h } => converge_cli_unknown_host_reason(host: h)
+    ProviderGuestNotAdopted { host: h, cause: c } => join(["gunbc converge: provider guest ", h, " is not adopted -- ", c], "")
+    ProviderGuestExecutionRefused { host: h, cause: c } => join(["gunbc converge: provider guest ", h, " is adopted; its runner role cannot run -- ", c], "")
     SparkPreEnrollment { host: h } => concat(concat("gunbc converge: ", h), " is a Spark pre-enrollment host — no runner slots or host layout exist yet (SPARK-SERVE-0 owns the repair); reach is probed at its modeled endpoint, and no converge route exists until enrollment")
     SparkManagedAccessUnmeasured { host: h, dissolves_on: trigger } => concat(concat(concat("gunbc converge: ", h), " is enrolled, but its managed automation principal has never been observed — refusing rather than assuming absent. Discharged by: "), trigger)
     ComputeInventoryAbsent { host: h } => converge_cli_compute_inventory_absent_reason(host: h)
@@ -171,11 +187,14 @@ fn converge_cli_receipt_converged(r: ConvergeCliReceipt) -> Bool {
   r.verdict == VerdictConverged
 }
 
+// A fleet compute host is one the hardware catalog carries (gunbc.fleet_intent) -- read from that
+// catalog rather than re-listed here, so a host added to it is a compute host without editing this
+// predicate. A rented guest has no hardware row; it converges through the provider-guest route.
 fn converge_cli_is_fleet_compute_host(host: String) -> Bool {
-  host == (operator_host_srv1 as String)
-    || host == (operator_host_srv2 as String)
-    || host == (operator_host_srv3 as String)
-    || host == (operator_host_srv4 as String)
+  match fleet_compute_host_for_identity(identity: host as HostIdentity) {
+    Present { value: _ } => true
+    Absent => false
+  }
 }
 
 // Provider-runtime cadence (Option A): srv1–srv4 fleet compute converge runs reconcile the
@@ -198,8 +217,26 @@ fn converge_local_kernel_short_hostname() -> String {
   }
 }
 
+// THE KERNEL HOSTNAME IS AN OBSERVATION, NOT AN IDENTITY. It is resolved through the naming
+// authority (gunbc.hostname_allocation resolve_host_selector) to the stable HostIdentity it was
+// allocated to, and everything downstream carries that identity. A hostname nobody allocated, or one
+// that names more than one host, resolves to "" -- which no enrolled identity equals -- so a machine
+// answering to an unallocated name is never mistaken for a fleet host.
+fn converge_host_selector_identity(selector: String) -> String {
+  match resolve_host_selector(selector: selector) {
+    HostSelectorResolved { host: h } => h as String
+    HostSelectorAmbiguous { selector: _, candidates: _ } => ""
+    HostSelectorUnknown { selector: _ } => ""
+  }
+}
+
+fn converge_local_host_identity() -> String {
+  let kernel = converge_local_kernel_short_hostname()
+  if kernel == "" { "" } else { converge_host_selector_identity(selector: kernel) }
+}
+
 fn converge_codex_runtime_local_locus_matches_host(host: String) -> Bool {
-  let local = converge_local_kernel_short_hostname()
+  let local = converge_local_host_identity()
   local != "" && host == local
 }
 
@@ -207,7 +244,7 @@ fn converge_provider_runtime_codex_receipt(host: String) -> ConvergeCliReceipt?
   if !converge_cli_is_fleet_compute_host(host: host) {
     none
   } else {
-    let local_hostname = converge_local_kernel_short_hostname()
+    let local_hostname = converge_local_host_identity()
     if local_hostname == "" || host != local_hostname {
       Present {
         value: ConvergeCliReceipt {
@@ -326,39 +363,34 @@ type FleetConvergeApplicability
   = ConvergeSlice1Route
   | ConvergeKnobFrontier
   | ConvergeSparkRoute { access: SparkManagedAccessStanding }
+  | ConvergeProviderGuestRoute { intent: HostEnrollmentIntent }
   | ConvergeOutsideFleet
 
-// MEASURED, not assumed: a read-only probe of srv5 and srv6 found briansrls the only admitted
-// principal and every managed-sounding candidate refused. The cause travels with the standing so a
-// reader is not left to infer which of several remedies applies.
-// THIS FUNCTION DOES NOT OBSERVE, AND NOW SAYS SO. It previously returned SparkManagedAccessAbsent
-// with a cause ending "(measured, read-only probe)" -- a constant that ignored its host argument,
-// executed nothing, and would keep reporting a measurement after the host changed. The measurement
-// it referred to was performed by the hand-authored spark-canary-probe.yml, which has been deleted;
-// a claim whose producer no longer exists is not evidence, and prose asserting a guarantee the
-// mechanism does not implement is the exact class this repo keeps catching.
-//
-// It returns Unobserved rather than Absent because the model cannot cite a receipt for either
-// answer. Absent would be the same lie one arm over.
-fn spark_managed_access_standing(host: String) -> SparkManagedAccessStanding {
-  SparkManagedAccessUnobserved {
-    host: host,
-    dissolves_on: "gunbc.fleet_multi_principal_probe fleet_multi_principal_probe_wet runs with srv5/srv6 in multi_principal_probe_hosts and its typed receipt grounds this standing",
+fn enrolled_provider_guest(host: String) -> HostEnrollmentIntent? {
+  match enrollment_for_host(host: host as HostIdentity) {
+    Absent => none
+    Present { value: e } => match e.backing {
+      ProviderGuest { route: _, entitlement: _, resource: _ } => Present { value: e }
+      OwnedMachine { provisioning: _ } => none
+    }
   }
 }
 
 fn fleet_converge_applicability(host: String) -> FleetConvergeApplicability {
+  match enrolled_provider_guest(host: host) {
+    Present { value: e } => ConvergeProviderGuestRoute { intent: e }
+    Absent => fleet_converge_owned_applicability(host: host)
+  }
+}
+
+fn fleet_converge_owned_applicability(host: String) -> FleetConvergeApplicability {
   if converge_cli_routes_to_slice1(host: host) {
     ConvergeSlice1Route
   } else {
     if host == (operator_host_srv2 as String) || host == (operator_host_srv4 as String) {
       ConvergeKnobFrontier
     } else {
-      if host == (operator_host_srv5 as String) || host == (operator_host_srv6 as String) {
-        ConvergeSparkRoute { access: spark_managed_access_standing(host: host) }
-      } else {
-        ConvergeOutsideFleet
-      }
+      ConvergeOutsideFleet
     }
   }
 }
@@ -793,16 +825,17 @@ fn converge_cli_verify_output(host: String) -> ConvergeCliOutput {
 // deploy could skew. Any other value routes unchanged (the operator/CI form). An
 // unresolvable read falls through as the literal, landing in UnknownHost — a typed
 // refusal, never a fabricated identity.
+// `self` resolves through the local kernel hostname; any other selector -- a stable identity, an
+// allocated hostname, or a drawn name's shorter form -- resolves through the same naming authority.
+// An unresolvable selector is returned unchanged so the applicability below refuses it by name.
 fn converge_cli_resolve_self(host: String) -> String {
   if host == "self" {
-    let line = converge_local_kernel_short_hostname()
-    if line == "" {
-      host
-    } else {
-      line
-    }
+    let kernel = converge_local_kernel_short_hostname()
+    let resolved = if kernel == "" { "" } else { converge_host_selector_identity(selector: kernel) }
+    if resolved != "" { resolved } else if kernel != "" { kernel } else { host }
   } else {
-    host
+    let resolved = converge_host_selector_identity(selector: host)
+    if resolved == "" { host } else { resolved }
   }
 }
 
@@ -887,7 +920,41 @@ fn converge_cli_run_host_knobs(host: String) -> ConvergeCliReceipt {
               }
           }
         ConvergeKnobFrontier => converge_cli_receipt_for_listed_host(hosts: hosts, host: host)
+        ConvergeProviderGuestRoute { intent: e } => converge_cli_provider_guest_receipt(host: host, intent: e)
         ConvergeOutsideFleet => converge_cli_receipt_for_listed_host(hosts: hosts, host: host)
       }
   }
 }
+
+// THE PROVIDER-GUEST ROUTE. The adoption runs where this process runs and refuses unless the provider
+// says that machine is the named guest (gunbc.provider_guest_adoption adopt_local_provider_guest); the receipt keeps its two
+// answers apart: a refused adoption is NotAdopted with its cause; an adopted guest whose microVM
+// execution is refused is reported as exactly that -- adopted, and unable to run the runner role --
+// so a green adoption is never presented as runnable capacity. An adopted guest whose execution is
+// admissible has no runner converge modeled yet, and says so as a frontier rather than reporting
+// convergence.
+fn converge_cli_provider_guest_receipt(host: String, intent: HostEnrollmentIntent) -> ConvergeCliReceipt {
+  match adopt_local_provider_guest(intent: intent) {
+    GuestAdoptionRefused { host: _, cause: c } => ConvergeCliReceipt {
+      host: host,
+      applied: 0,
+      drifted: 0,
+      verdict: VerdictAbsent,
+      reason: Present { value: ProviderGuestNotAdopted { host: host, cause: guest_adoption_refusal_text(cause: c) } },
+    }
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: MicroVmExecutionRefused { cause: c } } => ConvergeCliReceipt {
+      host: host,
+      applied: 0,
+      drifted: 0,
+      verdict: VerdictAbsent,
+      reason: Present { value: ProviderGuestExecutionRefused { host: host, cause: microvm_execution_refusal_text(cause: c) } },
+    }
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: MicroVmExecutionAdmissible } => ConvergeCliReceipt {
+      host: host,
+      applied: 0,
+      drifted: 0,
+      verdict: VerdictAbsent,
+      reason: Present { value: KnobFrontier { reason: join(["gunbc converge: provider guest ", host, " is adopted and microVM-capable; its runner converge is not modeled yet"], "") } },
+    }
+  }
+}
diff --git a/dag/gunbc/fleet/fleet_converge_plan.dag b/dag/gunbc/fleet/fleet_converge_plan.dag
index afe22136e9d..24b08d22b27 100644
--- a/dag/gunbc/fleet/fleet_converge_plan.dag
+++ b/dag/gunbc/fleet/fleet_converge_plan.dag
@@ -3,6 +3,9 @@ module gunbc.fleet_converge_plan
 import gunbc.fleet_converge_scope { FabricAllocationStoreOnly, FabricExecutionCellsOnly, FleetConvergeScope, FullHost, LaunchEnvironment, LiveDeploy, WorkspaceAllocationOnly, WorkspaceSlotCommissioningOnly }
 import gunbc.fleet_plan_artifact_location { fleet_converge_plan_artifact_dir }
 
+import gunbc.host_kernel_dependency { HostKernelDependencyPlan, host_kernel_dependency_action_lines, host_kernel_maintenance_capability }
+import gunbc.host_kernel_dependency_wire { host_kernel_dependency_row }
+
 import gunbc.workspace_commissioning_fleet { WorkspaceCommissioningFleetBasis, workspace_commissioning_basis_rows }
 import gunbc.workspace_commissioning_executor_plan { workspace_executor_scope_wire }
 import gunbc.workspace_commissioning_dispatch_transport { workspace_dispatch_apply_script }
@@ -407,6 +410,7 @@ type FleetConvergeRequest
     }
   | WorkspaceAllocationConverge { basis: WorkspaceConvergenceBasis, release_dir: NonEmptyStr }
   | WorkspaceSlotCommissioningConverge { basis: WorkspaceCommissioningFleetBasis }
+  | WorkspaceCommissioningDependencyConverge { plan: HostKernelDependencyPlan }
   | LiveDeployConverge {
       desired: DesiredDeployment
       basis: LiveDeployMemberBasis
@@ -423,6 +427,7 @@ fn fleet_converge_request_scope(request: FleetConvergeRequest) -> FleetConvergeS
     FabricExecutionCellsConverge { host: _, observed_fabric_cells: _ } => FabricExecutionCellsOnly
     FabricAllocationStoreConverge { host: _, observed_allocation_store: _ } => FabricAllocationStoreOnly
     WorkspaceSlotCommissioningConverge { basis: _ } => WorkspaceSlotCommissioningOnly
+    WorkspaceCommissioningDependencyConverge { plan: _ } => WorkspaceSlotCommissioningOnly
     WorkspaceAllocationConverge { basis: _, release_dir: _ } => WorkspaceAllocationOnly
     LiveDeployConverge { desired: _, basis: _ } => LiveDeploy
   }
@@ -435,6 +440,7 @@ fn fleet_converge_request_host(request: FleetConvergeRequest) -> NonEmptyStr {
     FabricExecutionCellsConverge { host: h, observed_fabric_cells: _ } => h
     FabricAllocationStoreConverge { host: h, observed_allocation_store: _ } => h
     WorkspaceSlotCommissioningConverge { basis } => basis.provenance.slot.host as NonEmptyStr
+    WorkspaceCommissioningDependencyConverge { plan } => plan.host as NonEmptyStr
     WorkspaceAllocationConverge { basis: selected, release_dir: _ } => selected.host
     LiveDeployConverge { desired: d, basis: _ } => d.target.host.identity as NonEmptyStr
   }
@@ -609,6 +615,7 @@ fn fleet_converge_apply_artifact_admits(
             LaunchEnvironmentConverge { host: _, observed_timers: _ } => ApplyMemberSetMismatch
             FabricExecutionCellsConverge { host: _, observed_fabric_cells: _ } => ApplyMemberSetMismatch
             WorkspaceSlotCommissioningConverge { basis: _ } => ApplyMemberSetMismatch
+            WorkspaceCommissioningDependencyConverge { plan: _ } => ApplyMemberSetMismatch
             WorkspaceAllocationConverge { basis: _, release_dir: _ } => ApplyMemberSetMismatch
             LiveDeployConverge { desired: _, basis: _ } => ApplyMemberSetMismatch
           }
@@ -624,6 +631,7 @@ fn fleet_converge_apply_artifact_admits(
             LaunchEnvironmentConverge { host: _, observed_timers: _ } => ApplyAdmitted
             FabricExecutionCellsConverge { host: _, observed_fabric_cells: _ } => ApplyAdmitted
             WorkspaceSlotCommissioningConverge { basis: _ } => ApplyAdmitted
+            WorkspaceCommissioningDependencyConverge { plan: _ } => ApplyAwaitingCapability { capability: host_kernel_maintenance_capability }
             WorkspaceAllocationConverge { basis: _, release_dir: _ } => ApplyAdmitted
             FabricAllocationStoreConverge { host: _, observed_allocation_store: _ } => ApplyAdmitted
           }
@@ -1136,7 +1144,7 @@ fn fabric_cell_realization_refusal_line(refusal: FabricCellRealizationRefusal) -
     CellRosterDuplicateKey { address_wire: w } =>
       concat("fabric-cell ", concat(w, " roster duplicate key"))
     CellChangeNotYetRealizable { address_wire: w } =>
-      concat("fabric-cell ", concat(w, " change realization undeclared: no staged intermediates (gunbc.change_realization)"))
+      concat("fabric-cell ", concat(w, " change has no admitted resource transition (gunbc.change_realization)"))
     CellTeardownNotYetRealizable { address_wire: w } =>
       concat("fabric-cell ", concat(w, " teardown unmodeled: destructive effect over possibly-live attempt state"))
   }
@@ -1411,6 +1419,7 @@ fn fleet_converge_apply_terminal(request: FleetConvergeRequest) -> FleetConverge
       }
     }
     WorkspaceSlotCommissioningConverge { basis: _ } => FullyApplied
+    WorkspaceCommissioningDependencyConverge { plan: _ } => AwaitingCapability { capability: host_kernel_maintenance_capability }
     WorkspaceAllocationConverge { basis: _, release_dir: _ } => FullyApplied
     FabricAllocationStoreConverge { host: _, observed_allocation_store: _ } => FullyApplied
     LiveDeployConverge { desired: _, basis } =>
@@ -1458,6 +1467,7 @@ fn fleet_converge_plan_axis_lines(request: FleetConvergeRequest) -> List<String>
     FabricExecutionCellsConverge { host: host, observed_fabric_cells: observed_fabric_cells } =>
       concat(["# fabric-cell"], fleet_converge_fabric_cell_lines(host: host, observed_fabric_cells: observed_fabric_cells))
     WorkspaceSlotCommissioningConverge { basis } => [workspace_commissioning_basis_rows(basis: basis)]
+    WorkspaceCommissioningDependencyConverge { plan } => [host_kernel_dependency_row(plan: plan)] + host_kernel_dependency_action_lines(plan: plan)
     WorkspaceAllocationConverge { basis: selected, release_dir: installed } => [
       "# workspace allocation: dispatch existing slot controller; readiness is observed separately",
       concat("workspace-launch-directive:", workspace_launch_directive_text(directive: workspace_launch_directive(basis: selected, release_dir: installed))),
@@ -1518,6 +1528,7 @@ fn fleet_converge_plan_refusal_counter_lines(request: FleetConvergeRequest) -> L
         "# allocation-store-refusals=0",
       ]
     WorkspaceSlotCommissioningConverge { basis: _ } => [concat("# scope=", workspace_executor_scope_wire)]
+    WorkspaceCommissioningDependencyConverge { plan: _ } => [concat("# scope=", workspace_executor_scope_wire)]
     WorkspaceAllocationConverge { basis: _, release_dir: _ } => [concat("# scope=", fleet_converge_scope_wire(scope: WorkspaceAllocationOnly))]
     LiveDeployConverge { desired: desired, basis: _ } =>
       [
@@ -1976,6 +1987,7 @@ fn observed_baseline_text(request: FleetConvergeRequest) -> String {
         "\n",
       )
     WorkspaceSlotCommissioningConverge { basis } => join([workspace_executor_scope_wire, workspace_commissioning_basis_rows(basis: basis)], "\n")
+    WorkspaceCommissioningDependencyConverge { plan } => join([workspace_executor_scope_wire, host_kernel_dependency_row(plan: plan)], "\n")
     WorkspaceAllocationConverge { basis: selected, release_dir: installed } => join(
       [fleet_converge_scope_wire(scope: WorkspaceAllocationOnly), concat("installed-release:", installed as String)] + workspace_convergence_baseline_rows(basis: selected), "\n",
     )
@@ -2535,6 +2547,7 @@ fn fleet_converge_apply_shell_axis_note(request: FleetConvergeRequest) -> String
     FabricAllocationStoreConverge { host: _, observed_allocation_store: _ } =>
       "scope:fabric-allocation-store-only — allocation-store substrate ensure effects are emitted by fleet_converge_allocation_store_plan_artifact"
     WorkspaceSlotCommissioningConverge { basis: _ } => "commission one slot through the protected executor; wait for exact completion and durable fleet generation"
+    WorkspaceCommissioningDependencyConverge { plan: _ } => "commissioning requires host kernel maintenance; no slot readiness or generation may be published"
     WorkspaceAllocationConverge { basis: _, release_dir: _ } => "scope:workspace-allocation-only — publish typed invocation credential and start the existing selected slot controller"
     LiveDeployConverge { desired: _, basis: _ } =>
       "scope:live-deploy — this script emits no host effects; wet apply is CONVERGENCE-ONE C8 and is not this arm"
@@ -2584,6 +2597,7 @@ fn fleet_converge_apply_shell_axis_lines(request: FleetConvergeRequest) -> List<
       fabric_cell_apply_lines(host: host, observed_fabric_cells: observed_fabric_cells)
     FabricAllocationStoreConverge { host: _, observed_allocation_store: _ } => []
     WorkspaceSlotCommissioningConverge { basis } => if basis.already_committed { [] } else { [workspace_dispatch_apply_script(release_dir: basis.release_dir, slot: runner_slot_instance_name(slot: basis.provenance.slot))] }
+    WorkspaceCommissioningDependencyConverge { plan: _ } => []
     WorkspaceAllocationConverge { basis: selected, release_dir: installed } => if selected.allocation.phase == WorkspaceReleased { [] }
       else { [join(["printf '%s' ", posix_single_quote(spelling: workspace_launch_directive_text(directive: workspace_launch_directive(basis: selected, release_dir: installed))),
           " > ", posix_single_quote(spelling: workspace_launch_staging_path(slot: selected.reservation_plan.reservation.slot) as String)], "")]
diff --git a/dag/gunbc/fleet/fleet_converge_plan_cli.dag b/dag/gunbc/fleet/fleet_converge_plan_cli.dag
index 1725ef7d31c..d16eca0efd2 100644
--- a/dag/gunbc/fleet/fleet_converge_plan_cli.dag
+++ b/dag/gunbc/fleet/fleet_converge_plan_cli.dag
@@ -1,9 +1,15 @@
 module gunbc.fleet_converge_plan_cli
 
+import gunbc.live_deploy.release_locus { approval_broker_release_dir, RevisionBoundAtEmission }
+import gunbc.runner_microvm_slot_unit { microvm_controller_root }
+
 import gunbc.fleet_converge_scope { WorkspaceAllocationOnly, WorkspaceSlotCommissioningOnly, FleetConvergeScope, FullHost, FabricExecutionCellsOnly, FabricAllocationStoreOnly, LiveDeploy, LaunchEnvironment }
 import gunbc.fleet_plan_artifact_location { fleet_converge_plan_artifact_dir }
 
-import gunbc.workspace_commissioning_fleet { WorkspaceCommissioningFleetObserved, WorkspaceCommissioningFleetRefused }
+import gunbc.host_kernel_dependency { host_kernel_maintenance_capability }
+import gunbc.host_kernel_dependency_wire { host_kernel_dependency_in_plan_body }
+
+import gunbc.workspace_commissioning_fleet { WorkspaceCommissioningFleetObserved, WorkspaceCommissioningFleetDependencyObserved, WorkspaceCommissioningFleetRefused }
 import gunbc.workspace_commissioning_dispatch_transport { workspace_dispatch_captured_command, workspace_dispatch_observe }
 import gunbc.workspace_commissioning_executor_plan { workspace_executor_scope_wire, workspace_executor_plan_credential, workspace_executor_plan_bytes, WorkspaceExecutorPlanBytesVerified, WorkspaceExecutorPlanBytesRefused }
 import gunbc.workspace_commissioning_directive { workspace_commissioning_directive_from_text, WorkspaceCommissioningDirectiveReady, WorkspaceCommissioningDirectiveRefused }
@@ -15,13 +21,12 @@ import std.types { CommitSha }
 
 import gunbc.fabric_storage_binding { fabric_state_storage_binding }
 
-import gunbc.workspace_allocation_convergence { workspace_convergence_observe, WorkspaceConvergenceObserved, WorkspaceConvergenceUnobserved }
+import gunbc.workspace_allocation_convergence { WorkspaceConvergenceObserved, WorkspaceConvergenceUnobserved }
 import gunbc.workspace_allocation_launch_directive { workspace_launch_directive_from_text, WorkspaceLaunchDirectiveReady, WorkspaceLaunchDirectiveRefused }
-import gunbc.workspace_reconcile_once { workspace_reconcile_prepare }
-import gunbc.workspace_allocation_store { WorkspaceAllocation, workspace_allocation_json, workspace_record_preparation_wait, WorkspaceStoreWritten, WorkspaceStoreConflict, WorkspaceStoreWriteRefused }
-import gunbc.workspace_request_consumer { workspace_consumer_reconcile_enrolled, WorkspaceConsumerIdle, WorkspaceConsumerRefused, WorkspaceConsumerRetire, WorkspaceConsumerPrepare, WorkspaceConsumerRoute, WorkspaceConsumerSettled, WorkspaceConsumerRetry }
+import gunbc.workspace_allocation_dispatch_transport { workspace_allocation_dispatch_prepare, workspace_allocation_dispatch_readback }
+import gunbc.workspace_allocation_store { workspace_allocation_json }
 import gunbc.workspace_allocation_policy { workspace_installed_policy }
-import gunbc.workspace_allocation_admission { workspace_owner_enrollment, workspace_enrolled_owners, WorkspacePolicyAdmitted, WorkspacePolicyRefused }
+import gunbc.workspace_allocation_admission { workspace_owner_enrollment, WorkspacePolicyAdmitted, WorkspacePolicyRefused }
 import gunbc.principal_projection { PrincipalRef }
 
 import extdeps.languages.json.emit { serialize_json }
@@ -178,6 +183,7 @@ import gunbc.fleet_converge_plan {
   FabricAllocationStoreConverge,
   WorkspaceAllocationConverge,
   WorkspaceSlotCommissioningConverge,
+  WorkspaceCommissioningDependencyConverge,
   fleet_converge_scope_of_wire,
   fleet_converge_scope_matches,
   fleet_converge_plan_artifact_of_request,
@@ -208,10 +214,7 @@ import gunbc.clock_read { clock_now_probed_at }
 import gunbc.actions_run_binding {
   ActionsRunBinding, observe_actions_run_binding, ActionsRunBound, ActionsRunUnbound,
   actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent,
-  read_expected_revision,
-  ExpectedRevisionPresent,
-  ExpectedRevisionAbsent,
-  admit_run_revision,
+  admit_optional_expected_revision,
   RunRevisionAdmitted,
   RunRevisionRefused,
   fleet_converge_expected_host_env_name,
@@ -413,7 +416,7 @@ fn observe_fleet_converge_request_wet(scope_wire: String, host: NonEmptyStr) ->
       },
     }
     ScopeDecoded { scope: WorkspaceSlotCommissioningOnly } => FleetConvergeRequestUnobserved { reason: "commissioning observation requires the admitted revision" }
-    ScopeDecoded { scope: WorkspaceAllocationOnly } => observe_workspace_allocation_plan_request_wet(host: host)
+    ScopeDecoded { scope: WorkspaceAllocationOnly } => FleetConvergeRequestUnobserved { reason: "workspace allocation observation requires the admitted revision" }
     ScopeDecoded { scope: LiveDeploy } =>
       FleetConvergeRequestUnobserved {
         reason: "observe_fleet_converge_request_wet is host-and-scope-wire; LiveDeployConverge is minted from DesiredDeployment and LiveDeployMemberBasis, not a hostname",
@@ -817,14 +820,10 @@ fn fleet_converge_scoped_plan_wet(scope: FleetConvergeScope) -> ProcessExit
     ActionsRunUnbound { variable: v, detail: d } =>
       exit_failure(reason: join(["fleet_converge_plan: RunUnbound — ", v, " ", d, "; the plan mode mints a run-bound receipt and runs only inside the fleet-converge workflow"], ""))
     ActionsRunBound { binding: run } =>
-      match read_expected_revision() {
-        ExpectedRevisionAbsent =>
-          exit_failure(reason: "fleet_converge_plan: ExpectedRevisionAbsent — RLM_EXPECTED_REVISION is required so the plan run is bound to the operator-selected R, not merely to whatever ref was dispatched")
-        ExpectedRevisionPresent { revision: expected_r } =>
-          match admit_run_revision(binding: run, expected: expected_r) {
-            RunRevisionRefused { expected: e, observed: o } =>
-              exit_failure(reason: join(["fleet_converge_plan: RunRevisionRefused — expected ", e, " but this run checked out ", o], ""))
-            RunRevisionAdmitted { revision: _ } =>
+      match admit_optional_expected_revision(binding: run) {
+        RunRevisionRefused { expected: e, observed: o } =>
+          exit_failure(reason: join(["fleet_converge_plan: RunRevisionRefused — expected ", e, " but this run checked out ", o], ""))
+        RunRevisionAdmitted { revision: _ } =>
       match actions_variable_read(name: fleet_converge_expected_host_env_name) {
         ActionsVariableAbsent { variable: v, detail: d } =>
           exit_failure(reason: join(["fleet_converge_plan: ExpectedHostAbsent — ", v, " ", d], ""))
@@ -835,7 +834,6 @@ fn fleet_converge_scoped_plan_wet(scope: FleetConvergeScope) -> ProcessExit
             scope: scope,
           )
       }
-          }
       }
   }
 }
@@ -878,8 +876,13 @@ fn fleet_converge_plan_scoped_bound_wet(
   let observed = if (scope == WorkspaceSlotCommissioningOnly) {
     match workspace_dispatch_observe(host: subject_host, revision: run.run_revision as CommitSha) {
       WorkspaceCommissioningFleetObserved { basis } => FleetConvergeRequestObserved { request: WorkspaceSlotCommissioningConverge { basis: basis } }
-      WorkspaceCommissioningFleetRefused { reason: _ } => FleetConvergeRequestUnobserved { reason: "commissioning privileged observation refused" }
+      WorkspaceCommissioningFleetDependencyObserved { plan } => FleetConvergeRequestObserved { request: WorkspaceCommissioningDependencyConverge { plan: plan } }
+      WorkspaceCommissioningFleetRefused { reason } => FleetConvergeRequestUnobserved { reason: concat("commissioning privileged observation refused: ", reason) }
     }
+  } else if (scope == WorkspaceAllocationOnly) {
+    observe_workspace_allocation_plan_request_wet(host: subject_host,
+      release_dir: approval_broker_release_dir(root: microvm_controller_root,
+        revision: RevisionBoundAtEmission { revision: run.run_revision as CommitSha }) as NonEmptyStr)
   } else { observe_fleet_converge_request_wet(scope_wire: fleet_converge_scope_wire(scope: scope), host: subject_host) }
   match observed {
     FleetConvergeRequestUnobserved { reason: why } =>
@@ -1004,14 +1007,10 @@ fn fleet_converge_apply_wet() -> ProcessExit
     ActionsRunUnbound { variable: v, detail: d } =>
       exit_failure(reason: join(["fleet_converge_apply: RunUnbound — ", v, " ", d, "; the apply mode mints a run-bound receipt and runs only inside the fleet-converge workflow"], ""))
     ActionsRunBound { binding: run } =>
-      match read_expected_revision() {
-        ExpectedRevisionAbsent =>
-          exit_failure(reason: "fleet_converge_apply: ExpectedRevisionAbsent — RLM_EXPECTED_REVISION is required; without it apply can mutate srv1 at a revision the operator never selected")
-        ExpectedRevisionPresent { revision: expected_r } =>
-          match admit_run_revision(binding: run, expected: expected_r) {
-            RunRevisionRefused { expected: e, observed: o } =>
-              exit_failure(reason: join(["fleet_converge_apply: RunRevisionRefused — expected ", e, " but this run checked out ", o, "; refusing before the locked actuator"], ""))
-            RunRevisionAdmitted { revision: admitted_r } =>
+      match admit_optional_expected_revision(binding: run) {
+        RunRevisionRefused { expected: e, observed: o } =>
+          exit_failure(reason: join(["fleet_converge_apply: RunRevisionRefused — expected ", e, " but this run checked out ", o, "; refusing before the locked actuator"], ""))
+        RunRevisionAdmitted { revision: admitted_r } =>
       match actions_variable_read(name: fleet_converge_plan_run_id_env_name) {
         ActionsVariableAbsent { variable: v, detail: d } =>
           exit_failure(reason: join(["fleet_converge_apply: PlanRunIdAbsent — ", v, " ", d], ""))
@@ -1023,7 +1022,6 @@ fn fleet_converge_apply_wet() -> ProcessExit
               fleet_converge_apply_bound_wet(run: run, plan_run_id: plan_run_id, plan_receipt: plan_receipt, expected_revision_admitted: admitted_r)
           }
       }
-          }
       }
   }
 }
@@ -1129,7 +1127,7 @@ fn fleet_converge_apply_ordinary_bound_wet(
                 ApplyAllocationStorePrestateMismatch { namespace_path: n, store_path: p, observed: o } =>
                   exit_failure(reason: join(["fleet_converge_apply: AllocationStorePrestateMismatch namespace_path=", n as String, " store_path=", p as String, " observed=", o, "; rerun plan and review"], ""))
                 ApplyAwaitingCapability { capability: c } =>
-                  exit_failure(reason: join(["fleet_converge_apply: AwaitingCapability ", c, " — nonempty live-deploy plan; wet apply is C8"], ""))
+                  exit_failure(reason: join(["fleet_converge_apply: AwaitingCapability ", c, " — this plan requires an unavailable apply capability"], ""))
                 ApplyAdmitted =>
               if !fleet_converge_observed_baseline_matches(
                 observed_baseline_hex: trim(s: read_base.content),
@@ -1325,14 +1323,11 @@ data fleet_converge_operator_mode_plan: String = "plan"
 data fleet_converge_operator_mode_apply: String = "apply"
 data fleet_converge_operator_mode_deploy: String = "deploy"
 
-// THE DEPLOY CANDIDATE IS HEAD OF THE CHECKOUT BEING EXECUTED, so the branch that checkout is on
-// is workflow policy and it is asked explicitly. The workflow deploys from main; an operator who
-// wants a different branch on the dashboard says so with --candidate-branch, and the value is
-// compared to the observed branch rather than trusted. An empty requirement refuses rather than
-// admitting whatever HEAD happens to be, because "any branch" is the one policy that must never
-// be the default of a command that restarts the served dashboard.
+// THE DEPLOY CANDIDATE IS HEAD OF THE CHECKOUT BEING EXECUTED. Operator 2026-10-09: fleet-converge
+// must support an arbitrary branch. An empty --candidate-branch therefore admits the observed
+// branch. A named requirement still has to equal the checkout. An empty observed branch never admits.
 fn fleet_converge_deploy_branch_admits(observed: String, required: String) -> Bool {
-  trim(s: required) != "" && trim(s: observed) == trim(s: required)
+  trim(s: observed) != "" && (trim(s: required) == "" || trim(s: observed) == trim(s: required))
 }
 
 fn fleet_converge_operator_cli_entry(
@@ -1570,6 +1565,7 @@ fn observe_fleet_converge_request_from_plan_wet(scope_wire: String, host: NonEmp
       Present { value: credential } => match workspace_commissioning_directive_from_text(text: credential) {
         WorkspaceCommissioningDirectiveReady { provenance } => match workspace_dispatch_observe(host: host, revision: provenance.source_revision as CommitSha) {
           WorkspaceCommissioningFleetObserved { basis } => FleetConvergeRequestObserved { request: WorkspaceSlotCommissioningConverge { basis: basis } }
+          WorkspaceCommissioningFleetDependencyObserved { plan: _ } => FleetConvergeRequestUnobserved { reason: "commissioning dependency remains unresolved" }
           WorkspaceCommissioningFleetRefused { reason: _ } => FleetConvergeRequestUnobserved { reason: "commissioning no-op readback refused" }
         }
         WorkspaceCommissioningDirectiveRefused { reason: _ } => FleetConvergeRequestUnobserved { reason: "commissioning provenance unreadable" }
@@ -1586,10 +1582,7 @@ fn observe_fleet_converge_request_from_plan_wet(scope_wire: String, host: NonEmp
           WorkspaceLaunchDirectiveRefused { reason: detail } => FleetConvergeRequestUnobserved { reason: detail }
           WorkspaceLaunchDirectiveReady { directive: planned } => if !(match workspace_installed_policy() { WorkspacePolicyAdmitted { policy } => (match workspace_owner_enrollment(policy: policy, owner: planned.allocation.request.owner) { Present { value: _ } => true Absent => false }) WorkspacePolicyRefused { reason: _ } => false }) {
             FleetConvergeRequestUnobserved { reason: "workspace plan owner is not authorized by the installed allocation policy" }
-          } else { match workspace_convergence_observe(
-            store: fabric_state_storage_binding(),
-            owner: planned.allocation.request.owner, idempotency_key: planned.allocation.request.idempotency_key,
-          ) {
+          } else { match workspace_allocation_dispatch_readback(host: host, planned: planned) {
             WorkspaceConvergenceUnobserved { reason: detail } => FleetConvergeRequestUnobserved { reason: detail }
             WorkspaceConvergenceObserved { basis: current } => if current.owner_generation != planned.owner_generation
               || serialize_json(v: workspace_allocation_json(allocation: current.allocation)) != serialize_json(v: workspace_allocation_json(allocation: planned.allocation)) {
@@ -1603,64 +1596,11 @@ fn observe_fleet_converge_request_from_plan_wet(scope_wire: String, host: NonEmp
   }
 }
 
-// Discover the outstanding request from protected state rather than requiring an HTTP process
-// to remember or forward its identity. Retirement runs before installed-artifact or offer reads.
-fn observe_workspace_allocation_plan_request_wet(host: NonEmptyStr) -> FleetConvergeRequestObservation {
-  match clock_now_probed_at() {
-    Absent => FleetConvergeRequestUnobserved { reason: "workspace consumer clock is unavailable" }
-    Present { value: now } => match workspace_installed_policy() {
-    WorkspacePolicyRefused { reason: detail } => FleetConvergeRequestUnobserved { reason: detail }
-    WorkspacePolicyAdmitted { policy } => match workspace_consumer_reconcile_enrolled(store: fabric_state_storage_binding(),
-      owners: workspace_enrolled_owners(policy: policy), observed_at: now as String) {
-      WorkspaceConsumerIdle => FleetConvergeRequestUnobserved { reason: "no outstanding workspace request" }
-      WorkspaceConsumerRefused { reason: detail } => FleetConvergeRequestUnobserved { reason: detail }
-      WorkspaceConsumerRetry => FleetConvergeRequestUnobserved { reason: "workspace owner changed concurrently; reconcile again" }
-      WorkspaceConsumerRetire { allocation: _ } => FleetConvergeRequestUnobserved { reason: "workspace retirement remains outstanding" }
-      WorkspaceConsumerSettled { allocation: _ } => FleetConvergeRequestUnobserved { reason: "unplanned workspace retirement settled; no host apply required" }
-      WorkspaceConsumerPrepare { allocation: allocation } => match shell.Env.Get(name: "GUNBC_WORKSPACE_CONTROLLER_RELEASE" as NonEmptyStr).value {
-        Absent => workspace_publish_preparation_wait(allocation: allocation, reason: "workspace preparation requires the installed controller release identity")
-        Present { value: installed } => if trim(s: installed) == "" {
-          workspace_publish_preparation_wait(allocation: allocation, reason: "workspace installed controller release identity is empty")
-        } else { match workspace_reconcile_prepare(store: fabric_state_storage_binding(), allocation: allocation,
-          local_host: host as HostIdentity, release_dir: trim(s: installed) as NonEmptyStr) {
-          WorkspaceConvergenceUnobserved { reason: detail } => workspace_publish_preparation_wait(allocation: allocation, reason: detail)
-          WorkspaceConvergenceObserved { basis: planned } => if (planned.host as String) != (host as String) {
-            FleetConvergeRequestUnobserved { reason: concat("workspace plan selected host ", concat(planned.host as String, "; dispatch fleet-converge allocation plan there")) }
-          } else { observe_workspace_prepared_plan_request_wet(owner: allocation.request.owner, request_key: allocation.request.idempotency_key, host: host) }
-        } }
-      }
-      WorkspaceConsumerRoute { allocation: allocation } => observe_workspace_prepared_plan_request_wet(
-        owner: allocation.request.owner, request_key: allocation.request.idempotency_key, host: host)
-    }
-    }
-  }
-}
-
-// A preparation that could not select publishes its located reason for the owner's view and stops.
-fn workspace_publish_preparation_wait(allocation: WorkspaceAllocation, reason: String) -> FleetConvergeRequestObservation {
-  match workspace_record_preparation_wait(store: fabric_state_storage_binding(), request: allocation.request, reason: reason) {
-    WorkspaceStoreWritten { allocation: _ } => FleetConvergeRequestUnobserved { reason: reason }
-    WorkspaceStoreConflict => FleetConvergeRequestUnobserved { reason: "workspace changed while publishing preparation wait; reconcile again" }
-    WorkspaceStoreWriteRefused { reason: detail } => FleetConvergeRequestUnobserved { reason: detail }
-  }
-}
-
-// Local authorities are read only after the existing selected-host check. Apply still obtains
-// its identity and installed artifact from the hash-admitted plan, never from this environment.
-fn observe_workspace_prepared_plan_request_wet(owner: PrincipalRef, request_key: NonEmptyStr, host: NonEmptyStr) -> FleetConvergeRequestObservation {
-  match workspace_convergence_observe(store: fabric_state_storage_binding(),
-    owner: owner, idempotency_key: request_key) {
-    WorkspaceConvergenceUnobserved { reason: detail } => FleetConvergeRequestUnobserved { reason: detail }
-    WorkspaceConvergenceObserved { basis: selected } => if selected.host != host {
-      FleetConvergeRequestUnobserved { reason: "workspace plan request is executing on a different host" }
-    } else { match shell.Env.Get(name: "GUNBC_WORKSPACE_CONTROLLER_RELEASE" as NonEmptyStr).value {
-      Absent => FleetConvergeRequestUnobserved { reason: "workspace plan requires the installed controller release identity" }
-      Present { value: installed } => if trim(s: installed) == "" {
-        FleetConvergeRequestUnobserved { reason: "workspace installed controller release identity is empty" }
-      } else { FleetConvergeRequestObserved {
-        request: WorkspaceAllocationConverge { basis: selected, release_dir: trim(s: installed) as NonEmptyStr },
-      } }
-    } }
+// State access uses the exact root-owned installed helper. The runner never receives the MAC key.
+fn observe_workspace_allocation_plan_request_wet(host: NonEmptyStr, release_dir: NonEmptyStr) -> FleetConvergeRequestObservation {
+  match workspace_allocation_dispatch_prepare(host: host, release_dir: release_dir) {
+    WorkspaceConvergenceUnobserved { reason } => FleetConvergeRequestUnobserved { reason: reason }
+    WorkspaceConvergenceObserved { basis } => FleetConvergeRequestObserved { request: WorkspaceAllocationConverge { basis: basis, release_dir: release_dir } }
   }
 }
 
@@ -1675,7 +1615,9 @@ fn fleet_converge_apply_bound_wet(run: ActionsRunBinding, plan_run_id: String,
   plan_receipt: FleetConvergePlanReceipt, expected_revision_admitted: String) -> ProcessExit {
   let body = Filesystem.Read(path: fleet_converge_plan_body_path)
   let noop = body.success && count(filter(split(s: body.content, delimiter: "\n"), row => row == "commissioning-already-committed:true")) == 1
-  if plan_receipt.scope_wire != workspace_executor_scope_wire || noop {
+  if plan_receipt.scope_wire == workspace_executor_scope_wire && body.success && host_kernel_dependency_in_plan_body(body: body.content) {
+    exit_failure(reason: concat("fleet_converge_apply: AwaitingCapability — ", host_kernel_maintenance_capability))
+  } else if plan_receipt.scope_wire != workspace_executor_scope_wire || noop {
     fleet_converge_apply_ordinary_bound_wet(run: run, plan_run_id: plan_run_id,
       plan_receipt: plan_receipt, expected_revision_admitted: expected_revision_admitted)
   } else { fleet_converge_apply_commissioning_bound_wet(run: run, plan_run_id: plan_run_id,
@@ -1759,3 +1701,7 @@ fn fleet_converge_apply_commissioning_bound_wet(run: ActionsRunBinding, plan_run
 fn fleet_converge_workspace_commissioning_plan_wet() -> ProcessExit {
   fleet_converge_scoped_plan_wet(scope: WorkspaceSlotCommissioningOnly)
 }
+
+fn fleet_converge_workspace_allocation_plan_wet() -> ProcessExit {
+  fleet_converge_scoped_plan_wet(scope: WorkspaceAllocationOnly)
+}
diff --git a/dag/gunbc/fleet/fleet_converge_workflow.dag b/dag/gunbc/fleet/fleet_converge_workflow.dag
index a5898bdb942..b2c5c28d042 100644
--- a/dag/gunbc/fleet/fleet_converge_workflow.dag
+++ b/dag/gunbc/fleet/fleet_converge_workflow.dag
@@ -1,5 +1,16 @@
 module gunbc.fleet_converge_workflow
 
+import gunbc.hetzner_cloud_server_control { hetzner_cloud_server_read_receipt_path }
+import gunbc.auth.branch_dispatch_federation {
+  branch_dispatch_provider_resource, hetzner_cloud_control_service_account, hetzner_cloud_control_service_account_id,
+  branch_run_key_variable,
+}
+import gunbc.auth.branch_run_grant { branch_run_grant_approved_output }
+import extdeps.github.actions { workflow_dispatch_max_inputs }
+
+import gunbc.ci_spec { gunbc_ci_workspace_allocation_plan_invoke, gunbc_ci_workspace_image_build_invoke }
+import gunbc.workspace_image_delivery { workspace_image_artifact_name, workspace_image_staging_root, workspace_image_artifact_paths }
+
 import gunbc.fleet_printer_access {printer_access_code_loci}
 import gunbc.auth.approval_keyring_pins {approval_submission_mac_key_path_env,approval_capability_mac_key_path_env,approval_store_receipt_mac_key_path_env}
 import gunbc.auth.approval_decision_store {approval_mac_key_path}
@@ -8,7 +19,7 @@ import gunbc.auth.approval_store_receipt {approval_store_receipt_mac_key_path}
 import gunbc.fleet.printer_workflow_artifact { printer_workflow_receipt_path }
 
 import extdeps.github.expressions { Expression, ContextAccess, Github, StringLiteral, Equals, LogicalOr, LogicalAnd, interpolate }
-import gunbc.fleet_converge_scope { FleetConvergeScope, FullHost, LaunchEnvironment, FabricAllocationStoreOnly, WorkspaceSlotCommissioningOnly, LiveDeploy }
+import gunbc.fleet_converge_scope { FleetConvergeScope, FullHost, LaunchEnvironment, FabricAllocationStoreOnly, WorkspaceSlotCommissioningOnly, WorkspaceAllocationOnly, LiveDeploy }
 import gunbc.fleet_plan_artifact_location { fleet_converge_plan_artifact_dir }
 
 import gunbc.namecheap.observation_artifact { namecheap_observation_receipt_path }
@@ -16,7 +27,11 @@ import gunbc.namecheap.observation_artifact { namecheap_observation_receipt_path
 import gunbc.fleet.printer_federation { printer_environment, printer_provider_resource, printer_service_account,printer_lan_host_identity }
 import gunbc.ci_spec { gunbc_ci_printer_workflow_invoke }
 import gunbc.namecheap.federation { namecheap_environment, namecheap_provider_resource, namecheap_service_account }
-import gunbc.ci_spec { gunbc_ci_namecheap_observe_invoke, gunbc_ci_sm_max_time }
+import gunbc.auth.mtjade1_arrival_pair {
+  mtjade1_arrival_environment, mtjade1_arrival_provider_resource, mtjade1_arrival_service_account,
+}
+import gunbc.machine_intake_arrival_subject { arrival_converge_subject_options }
+import gunbc.ci_spec { gunbc_ci_namecheap_observe_invoke, gunbc_ci_arrival_admit_invoke, gunbc_ci_arrival_converge_invoke, gunbc_ci_sm_max_time }
 
 import gunbc.runner_microvm_slot_unit { microvm_slot_unit_timeout_stop, microvm_slot_start_receipt_path, microvm_slot_reserve_receipt_path, microvm_slot_reserve_wait_bound }
 import std.measure { Second, minute_count, second_count }
@@ -24,7 +39,7 @@ import std.measure { Second, minute_count, second_count }
 import extdeps.languages.yaml.types { YamlKeyValue, yaml_string, yaml_int, yaml_bool, kv }
 import extdeps.github.actions {
   Workflow, Job, Step, RunStep, UsesStep, 
-  WorkflowTrigger, WorkflowDispatch, DispatchInput, InputString, InputChoice,
+  WorkflowTrigger, WorkflowDispatch, DispatchInput, InputString, InputBoolean, InputChoice, InputEnvironment,
   WorkflowPermissions, PermRead, PermWrite, 
   RunnerSpec, RunsOnExpression, SelfHosted,
   ConcurrencySpec, ConcurrencyMappingQueueNotMax, CancelInProgressBool,
@@ -36,9 +51,6 @@ import gunbc.action_use_admission {
 }
 import gunbc.fleet.app_control_plane_inspection { app_control_plane_receipt_path }
 import gunbc.fleet.org_actions_inspection { org_actions_validation_receipt_path }
-import gunbc.spark.pair_serving_d0_door { pair_serving_d0_consent_env, pair_serving_d0_step_timeout_minutes }
-import gunbc.spark.runtime_image_produce_dispatch { runtime_image_env, runtime_image_options }
-import gunbc.spark.arm_group_launch_dispatch { arm_checkpoint_env, arm_checkpoint_options, arm_group_launch_arm_env, arm_group_launch_step_env, arm_group_launch_incumbent_env, arm_group_launch_arm_options, arm_group_launch_step_options, arm_group_launch_incumbent_options, arm_launch_step_timeout_minutes }
 import gunbc.fleet.organization_runner_roster_read { organization_runner_roster_receipt_path, runner_id_probes_env_name, roster_page_size_env_name }
 import gunbc.cloudflare.r2_permission_group_observe { r2_mint_preflight_receipt_path }
 import gunbc.cloudflare.r2_bucket_ensure { r2_bucket_ensure_receipt_path }
@@ -46,9 +58,9 @@ import gunbc.cloudflare.r2_conditional_put_race_probe { race_probe_receipt_path
 import gunbc.machine_intake_mtcollins1_fan_observe { mtcollins1_fan_observation_receipt_path }
 import gunbc.machine_intake_mtcollins1_kvm_observer_observe { mtcollins1_kvm_observer_probe_bound, mtcollins1_kvm_observer_probe_artifact_glob }
 import gunbc.machine_intake_megarac_kvm_still { megarac_kvm_observer_release_allowance }
-import gunbc.machine_intake_mtcollins1_ui_bundle_observe { mtcollins1_ui_bundle_artifact_glob, mtcollins1_ui_bundle_read_bound }
 import gunbc.fabric_writer_identity_observe { fabric_writer_identity_receipt_path }
-import gunbc.fabric.workspace_source { workspace_source_receipt_path }
+import gunbc.fabric.workspace_source { workspace_source_receipt_path, workspace_agent_state_slot_env }
+import gunbc.fabric.workspace_transcript_rate { workspace_transcript_rate_receipt_path }
 import gunbc.fabric.workspace_checkpoint_instrument { workspace_measure_receipt_path, workspace_restore_receipt_path, workspace_source_object_env }
 import gunbc.machine_intake_mtcollins1_census_image_publish { mtcollins1_census_image_receipt_path }
 import gunbc.machine_intake_mtcollins1_census_member_readback { census_member_readback_receipt_path }
@@ -73,55 +85,7 @@ import gunbc.workflow_capability_closure {
 }
 import v2.std.algebra { list_map }
 import gunbc.fleet_workflow_steps {
-  ci_prelude_steps_with_checkout,
-  ci_prelude_annotations,
-  ci_release_build_step,
-  ci_release_bins_pack_step,
-  ci_release_bins_key_step,
-  ci_release_bins_lookup_step,
-  release_bins_key_step_name,
-  release_bins_lookup_step_name,
-  release_bins_cache_step_name,
-  release_bins_outcome_step_name,
-  ci_release_bins_cache_step,
-  ci_release_bins_outcome_step,
-  ci_cache_cargo_step,
-  ci_release_bins_upload_step,
-  ci_release_bins_download_step,
-  ci_release_bins_unpack_verify_step,
-  ci_release_bins_unpack_verify_step_for,
-  ci_release_bins_key_step_for,
-  ci_release_bins_outcome_step_for,
-  ci_release_build_step_for,
-  ci_release_bins_pack_step_for,
-  ci_fleet_wif_auth_step,
-  ci_fleet_key_agent_step,
-  ci_fleet_key_agent_step_when,
-  ci_fleet_key_agent_cleanup_step,
-  ci_wif_auth_step_for,
-  gunbc_ci_mtcollins1_boot_job_backstop_timeout_minutes,
-  gunbc_ci_aux_step_timeout_minutes,
-  gunbc_ci_fleet_converge_plan_step_timeout_minutes,
-  gunbc_ci_runner_guest_image_step_timeout_minutes,
-  gunbc_ci_mtcollins1_census_image_step_timeout_minutes,
-  gunbc_ci_gunbc_run_resolve_step_timeout_minutes,
-  gunbc_ci_spark_serving_step_timeout_minutes,
-  gunbc_ci_spark_runtime_image_build_step_timeout_minutes,
-  gunbc_ci_spark_runtime_image_distribute_step_timeout_minutes,
-  gunbc_ci_artifact_transfer_step_timeout_minutes,
-  gunbc_ci_fleet_job_backstop_timeout_minutes,
-  gunbc_ci_release_build_step_timeout_minutes,
-  gunbc_ci_prelude_allowance_minutes,
-  gunbc_ci_live_deploy_step_timeout_minutes,
-  gunbc_ci_dashboard_deploy_job_backstop_timeout_minutes,
-  gunbc_ci_rlm_launch_deployment_receipt_job_backstop_timeout,
-  fleet_host_mutation_concurrency_group_expression,
-  fleet_host_mutation_group_prefix,
-  fleet_arm_mutation_group_glm_group_b_native, fleet_arm_mutation_group_deepseek_group_a, fleet_subject_mutation_group_approval_device_store,
-  checked_job_timeout_minutes,
-  JobTimeoutWithinCeiling,
-  JobTimeoutExceedsCeiling,
-  fleet_host_mutation_group_prefix, fleet_host_input_expression,
+  ci_prelude_steps_with_checkout, ci_prelude_annotations, ci_release_build_step, ci_release_bins_pack_step, ci_release_bins_key_step, ci_release_bins_lookup_step, release_bins_key_step_name, release_bins_lookup_step_name, release_bins_cache_step_name, release_bins_outcome_step_name, ci_release_bins_cache_step, ci_release_bins_outcome_step, ci_cache_cargo_step, ci_release_bins_upload_step, ci_release_bins_download_step, ci_release_bins_unpack_verify_step, ci_release_bins_unpack_verify_step_for, ci_release_bins_key_step_for, ci_release_bins_outcome_step_for, ci_release_build_step_for, ci_release_bins_pack_step_for, ci_fleet_wif_auth_step, ci_fleet_wif_auth_step_when, ci_fleet_key_agent_step, ci_fleet_key_agent_step_when, ci_fleet_key_agent_cleanup_step, ci_wif_auth_step_for, gunbc_ci_mtcollins1_boot_job_backstop_timeout_minutes, gunbc_ci_aux_step_timeout_minutes, gunbc_ci_fleet_converge_plan_step_timeout_minutes, gunbc_ci_runner_guest_image_step_timeout_minutes, gunbc_ci_mtcollins1_census_image_step_timeout_minutes, gunbc_ci_gunbc_run_resolve_step_timeout_minutes, gunbc_ci_spark_serving_step_timeout_minutes, gunbc_ci_spark_runtime_image_build_step_timeout_minutes, gunbc_ci_artifact_transfer_step_timeout_minutes, gunbc_ci_fleet_job_backstop_timeout_minutes, gunbc_ci_release_build_step_timeout_minutes, gunbc_ci_prelude_allowance_minutes, gunbc_ci_live_deploy_step_timeout_minutes, gunbc_ci_dashboard_deploy_job_backstop_timeout_minutes, gunbc_ci_rlm_launch_deployment_receipt_job_backstop_timeout, fleet_host_mutation_concurrency_group_expression, fleet_host_mutation_group_prefix, fleet_arm_mutation_group_glm_group_b_native, fleet_srv1_control_plane_mutation_group, fleet_subject_mutation_group_approval_device_store, checked_job_timeout_minutes, JobTimeoutWithinCeiling, JobTimeoutExceedsCeiling, fleet_host_mutation_group_prefix, fleet_host_input_expression,
 }
 import gunbc.runner_spec_from_offer { gunbc_ci_runner_spec }
 import gunbc.host_reset_return_run { host_reset_dispatch_mode_env }
@@ -129,14 +93,14 @@ import gunbc.managed_host_unit_hold {
   UnitHoldHostAdmission, UnitHoldHostAdmitted, UnitHoldHostNotManaged, UnitHoldHostNotRequired,
   unit_hold_admission_for, unit_hold_host_admission_refusal,
 }
-import gunbc.fleet_host_identity { operator_host_mtcollins1 }
+import gunbc.fleet_host_identity { operator_host_mtcollins1, operator_host_srv1 }
 import gunbc.auth.gcp_iam_converge_federation { gcp_iam_converge_environment, gcp_iam_observe_wif_provider_resource }
 import gunbc.auth.gcp_iam_converge { iam_observe_service_account, iam_converge_service_account, iam_converge_token_lifetime }
 import gunbc.auth.gcp_iam_converge_run { gcp_iam_converge_step_timeout_minutes, iam_converge_token_env, gcp_iam_converge_approved_output }
 import gunbc.auth.approval_broker_endpoint { approval_broker_host_identity }
 import gunbc.auth.managed_host_boot_federation {
-  ManagedHostBootFederationStanding, BootFederationProvisioned, BootFederationUnprovisioned,
-  boot_federation_for, boot_federation_provider_resource,
+  ManagedHostBootFederationStanding, BootFederationProvisioned, BootFederationProvisionedUnderDeclaredDrop,
+  BootFederationUnprovisioned, boot_federation_for, boot_federation_provider_resource,
 }
 import gunbc.fleet_host_identity { operator_host_mtcollins1 }
 import gunbc.auth.ci_app_key_rotation {
@@ -159,7 +123,6 @@ import gunbc.ci_spec {
   gunbc_ci_app_key_version_verify_mint_script,
   gunbc_ci_app_key_version_verify_verdict_invoke,
   gunbc_ci_mtcollins1_fan_observe_invoke,
-  gunbc_ci_mtcollins1_ui_bundle_observe_invoke,
   gunbc_ci_mtcollins1_kvm_observer_observe_invoke,
   gunbc_ci_mtcollins1_kvm_observer_release_invoke,
   gunbc_ci_fabric_writer_identity_observe_invoke,
@@ -174,11 +137,16 @@ import gunbc.ci_spec {
   gunbc_ci_r2_workspace_object_read_mint_invoke,
   gunbc_ci_r2_workspace_object_write_mint_invoke,
   gunbc_ci_r2_cache_object_read_mint_invoke,
+  gunbc_ci_hetzner_cloud_server_read_invoke,
+  gunbc_ci_branch_run_grant_request_invoke,
+  gunbc_ci_branch_run_grant_apply_invoke,
+  gunbc_ci_branch_run_grant_await_invoke,
   gunbc_ci_r2_cache_object_write_mint_invoke,
   gunbc_ci_r2_conditional_put_race_probe_invoke,
   gunbc_ci_workspace_source_pack_invoke,
   gunbc_ci_workspace_checkpoint_measure_invoke,
   gunbc_ci_workspace_checkpoint_restore_invoke,
+  gunbc_ci_workspace_transcript_rate_observe_invoke,
   gunbc_ci_approval_keyring_converge_invoke,
   gunbc_ci_approval_device_enrolment_code_issue_invoke,
   gunbc_ci_mtcollins1_boot_invoke,
@@ -186,8 +154,6 @@ import gunbc.ci_spec {
   gunbc_ci_mtcollins1_boot_admit_invoke,
   gunbc_ci_gcp_iam_converge_request_invoke,
   gunbc_ci_gcp_iam_converge_apply_invoke,
-  gunbc_ci_pair_serving_d0_invoke,
-  gunbc_ci_pair_serving_d0_admit_invoke,
   gunbc_ci_org_runner_roster_observe_invoke,
   gunbc_ci_runner_guest_image_observe_invoke,
   gunbc_ci_runner_guest_image_converge_invoke,
@@ -206,19 +172,6 @@ import gunbc.ci_spec {
   gunbc_ci_spark_runtime_image_probe_invoke,
   gunbc_ci_spark_wireless_link_converge_invoke,
   gunbc_ci_spark_grants_observe_invoke,
-  gunbc_ci_spark_v41_checkpoint_materialize_invoke,
-  gunbc_ci_spark_v41_row_store_encode_invoke,
-  gunbc_ci_spark_v41_row_store_readback_invoke,
-  gunbc_ci_spark_v41_engram_differential_invoke,
-  gunbc_ci_spark_v41_index_selection_invoke,
-  gunbc_ci_spark_runtime_image_produce_invoke,
-  gunbc_ci_spark_runtime_image_distribute_invoke,
-  gunbc_ci_spark_arm_checkpoint_materialize_invoke,
-  gunbc_ci_spark_arm_group_observe_invoke,
-  gunbc_ci_spark_arm_group_launch_plan_invoke,
-  gunbc_ci_spark_arm_group_load_invoke,
-  gunbc_ci_spark_arm_group_launch_invoke,
-  gunbc_ci_spark_v41_serving_load_invoke,
   gunbc_fleet_converge_plan_artifact_name,
   gunbc_ci_fleet_converge_plan_artifact_hash_env_name,
   gunbc_ci_live_deploy_transaction_invoke,
@@ -235,7 +188,8 @@ import gunbc.ci_spec {
   gunbc_rlm_launch_deployment_receipt_artifact_dir,
 }
 import gunbc.fleet_converge_receipt { fleet_converge_plan_run_id_env_name }
-import gunbc.actions_run_binding { rlm_expected_revision_env_name, fleet_converge_expected_host_env_name }
+import gunbc.actions_run_binding { rlm_expected_revision_env_name, fleet_converge_expected_host_env_name, fleet_converge_arrival_subject_env_name }
+import gunbc.auth.github_deployment_environment { srv1_production_environment_name }
 import gunbc.host_credential_custody_converge { host_custody_credential_options, host_credential_custody_env_name }
 import gunbc.spark.credential_workflow { spark_administrator_credential_roster_hosts }
 import gunbc.fleet_runner_connectivity { fleet_hosts }
@@ -257,7 +211,7 @@ import gunbc.host_reset_return {
   host_reset_return_receipt_path,
   host_reset_observer_label_env,
 }
-import gunbc.host_reset_subject_roster { reset_observer_peer_roster, reset_subject_roster }
+import gunbc.host_reset_subject_roster { reset_observer_peer_roster, reset_roster_hosts, reset_subject_roster }
 import gunbc.host_reset_return { ResetObserverPairing }
 import gunbc.live_deploy.apply_receipt { rlm_plan_run_id_env_name, rlm_apply_run_id_env_name, rlm_plan_artifact_hash_env_name }
 import gunbc.live_deploy.apply_receipt { rlm_dashboard_run_id_env_name }
@@ -292,6 +246,12 @@ data fleet_converge_enrolled_host_options: List<String> = map(fleet_hosts(), h =
 // seven enrolled units because the list was typed when there were two. The choice list is now the
 // administrator credential roster (gunbc.spark.credential_workflow), which is itself an identity join
 // with procurement, so enrolling a Spark makes it dispatchable and nothing else can.
+//
+// AN EMPTY ROSTER MUST NOT BECOME options: []. GitHub's choice input is a closed set; an empty
+// set is not a form, it is a parser/dispatch refusal (review 78408). The sold-out administrator
+// roster (gunbc.spark.credential_workflow spark_administrator_credential_roster, 2026-10-10) is
+// that emptiness. Emission omits the target input and the spark_* mode options until a host is
+// rostered again -- it does not fabricate srv5..srv12, and it does not emit a plausible empty choice.
 data fleet_converge_spark_target_options: List<String> = map(spark_administrator_credential_roster_hosts(), h => h as String)
 
 // ONE NAME PER MODE, SPELLED ONCE. The dispatch options and every `if:` expression that selects on
@@ -308,6 +268,8 @@ type FleetConvergeWorkflowMode
   | LaunchEnvironmentPlan
   | AllocationStorePlan
   | WorkspaceCommissioningPlan
+  | WorkspaceAllocationPlan
+  | WorkspaceImageBuild
   | FleetApply
   | OrgActionsObserve
   | AppControlPlaneObserve
@@ -325,18 +287,6 @@ type FleetConvergeWorkflowMode
   | SparkRuntimeImageProbe
   | SparkWirelessLinkConverge
   | SparkGrantsObserve
-  | SparkV41CheckpointMaterialize
-  | SparkV41RowStoreEncode
-  | SparkV41RowStoreReadback
-  | SparkV41EngramDifferential
-  | SparkRuntimeImageProduce
-  | SparkRuntimeImageDistribute
-  | SparkArmGroupLoad
-  | SparkArmCheckpointMaterialize
-  | SparkArmGroupObserve
-  | SparkArmGroupLaunchPlan
-  | SparkArmGroupLaunch
-  | SparkV41ServingLoad
   | DashboardDeploy
   | RlmLaunchDeploymentReceipt
   | HostResetReturn
@@ -358,17 +308,18 @@ type FleetConvergeWorkflowMode
   | R2WorkspaceObjectReadMint
   | R2WorkspaceObjectWriteMint
   | R2CacheObjectReadMint
+  | HetznerCloudServerRead
+  | BranchRunGrant
   | R2CacheObjectWriteMint
   | R2ConditionalPutRaceProbe
   | WorkspaceSourcePack
   | WorkspaceCheckpointMeasure
   | WorkspaceCheckpointRestore
+  | WorkspaceTranscriptRateObserve
   | ApprovalKeyringConverge
   | ApprovalDeviceEnrolmentCodeIssue
   | MtCollins1Boot
-  | PairServingD0
   | MtCollins1FanObserve
-  | MtCollins1UiBundleObserve
   | MtCollins1KvmObserverObserve
   | FabricWriterIdentityObserve
   | MtCollins1CensusImagePublish
@@ -379,6 +330,7 @@ type FleetConvergeWorkflowMode
   | OrgRunnerRosterObserve
   | GcpIamConverge
   | NamecheapObserve
+  | ArrivalConverge
   | PrinterWorkflow
 
 fn fleet_converge_workflow_mode_wire(mode: FleetConvergeWorkflowMode) -> String {
@@ -387,6 +339,8 @@ fn fleet_converge_workflow_mode_wire(mode: FleetConvergeWorkflowMode) -> String
     LaunchEnvironmentPlan => "launch_environment_plan"
     AllocationStorePlan => "allocation_store_plan"
     WorkspaceCommissioningPlan => "workspace_commissioning_plan"
+    WorkspaceAllocationPlan => "workspace_allocation_plan"
+    WorkspaceImageBuild => "workspace_image_build"
     FleetApply => "apply"
     OrgActionsObserve => "org_actions_observe"
     AppControlPlaneObserve => "app_control_plane_observe"
@@ -404,18 +358,6 @@ fn fleet_converge_workflow_mode_wire(mode: FleetConvergeWorkflowMode) -> String
     SparkRuntimeImageProbe => "spark_runtime_image_probe"
     SparkWirelessLinkConverge => "spark_wireless_link_converge"
     SparkGrantsObserve => "spark_grants_observe"
-    SparkV41CheckpointMaterialize => "spark_v41_checkpoint_materialize"
-    SparkV41RowStoreEncode => "spark_v41_row_store_encode"
-    SparkV41RowStoreReadback => "spark_v41_row_store_readback"
-    SparkV41EngramDifferential => "spark_v41_engram_differential"
-    SparkRuntimeImageProduce => "spark_runtime_image_produce"
-    SparkRuntimeImageDistribute => "spark_runtime_image_distribute"
-    SparkArmCheckpointMaterialize => "spark_arm_checkpoint_materialize"
-    SparkArmGroupObserve => "spark_arm_group_observe"
-    SparkArmGroupLaunchPlan => "spark_arm_group_launch_plan"
-    SparkArmGroupLoad => "spark_arm_group_load"
-    SparkArmGroupLaunch => "spark_arm_group_launch"
-    SparkV41ServingLoad => "spark_v41_serving_load"
     DashboardDeploy => "dashboard_deploy"
     RlmLaunchDeploymentReceipt => "rlm_launch_deployment_receipt"
     HostResetReturn => "host_reset_return"
@@ -437,20 +379,22 @@ fn fleet_converge_workflow_mode_wire(mode: FleetConvergeWorkflowMode) -> String
     R2WorkspaceObjectReadMint => "r2_workspace_object_read_mint"
     R2WorkspaceObjectWriteMint => "r2_workspace_object_write_mint"
     R2CacheObjectReadMint => "r2_cache_object_read_mint"
+    HetznerCloudServerRead => "hetzner_cloud_server_read"
+    BranchRunGrant => "branch_run_grant"
     R2CacheObjectWriteMint => "r2_cache_object_write_mint"
     R2ConditionalPutRaceProbe => "r2_conditional_put_race_probe"
     WorkspaceSourcePack => "workspace_source_pack"
     WorkspaceCheckpointMeasure => "workspace_checkpoint_measure"
     WorkspaceCheckpointRestore => "workspace_checkpoint_restore"
+    WorkspaceTranscriptRateObserve => "workspace_transcript_rate_observe"
     ApprovalKeyringConverge => "approval_keyring_converge"
     ApprovalDeviceEnrolmentCodeIssue => "approval_device_enrolment_code_issue"
     MtCollins1Boot => "mtcollins1_boot"
     GcpIamConverge => "gcp_iam_converge"
     NamecheapObserve => "namecheap_observe"
+    ArrivalConverge => "arrival_converge"
     PrinterWorkflow => "printer"
-    PairServingD0 => "pair_serving_d0"
     MtCollins1FanObserve => "mtcollins1_fan_observe"
-    MtCollins1UiBundleObserve => "mtcollins1_ui_bundle_observe"
     MtCollins1KvmObserverObserve => "mtcollins1_kvm_observer_observe"
     FabricWriterIdentityObserve => "fabric_writer_identity_observe"
     MtCollins1CensusImagePublish => "mtcollins1_census_image_publish"
@@ -483,7 +427,7 @@ fn fleet_converge_spark_target_description() -> String {
   ], "")
 }
 
-data fleet_converge_workflow_modes: List<FleetConvergeWorkflowMode> = [FullHostPlan, LaunchEnvironmentPlan, AllocationStorePlan, WorkspaceCommissioningPlan, FleetApply, OrgActionsObserve, AppControlPlaneObserve, MicrovmHostConverge, MicrovmNetworkObserve, MicrovmNetworkApply, GuestImageObserve, GuestImageConverge, MicrovmBootProbe, SparkGrants, SparkBootstrap, SparkServingApply, SparkNativeServingApply, SparkRuntimeImageProbe, SparkWirelessLinkConverge, SparkGrantsObserve, SparkV41CheckpointMaterialize, SparkV41RowStoreEncode, SparkV41RowStoreReadback, SparkV41EngramDifferential, SparkRuntimeImageProduce, SparkRuntimeImageDistribute, SparkArmGroupLoad, SparkArmCheckpointMaterialize, SparkArmGroupObserve, SparkArmGroupLaunchPlan, SparkArmGroupLaunch, SparkV41ServingLoad, DashboardDeploy, ApprovalBrokerDarkInstall, MicrovmControllerInstall, MicrovmSlotReserve, MicrovmSlotStart, RlmLaunchDeploymentReceipt, HostResetReturn, RunnerHostFileObserve, RunnerHostFileConverge, SitePxeEdgeObserve, SitePxeEdgeConverge, RunnerPasswordSessionToolConverge, RunnerBrowserToolchainConverge, R2MintPreflight, R2ObjectWriteMint, OrgRunnerRosterObserve, ApprovalKeyringConverge, ApprovalDeviceEnrolmentCodeIssue, MtCollins1Boot, MtCollins1FanObserve, MtCollins1UiBundleObserve, MtCollins1KvmObserverObserve, MtCollins1CensusImagePublish, MtCollins1CensusMemberReadback, MtCollins1CensusQemuHostObserve, MtCollins1CensusQemuToolchainConverge, HostCredentialCustodyConverge, AppKeyVersionVerify, R2BucketEnsure, R2BucketAdminMint, R2WorkspaceObjectReadMint, R2WorkspaceObjectWriteMint, R2CacheObjectReadMint, R2CacheObjectWriteMint, R2ConditionalPutRaceProbe, WorkspaceSourcePack, WorkspaceCheckpointMeasure, WorkspaceCheckpointRestore, FabricWriterIdentityObserve, PairServingD0, MicrovmRunnerGroupEnsure, GcpIamConverge, NamecheapObserve, PrinterWorkflow]
+data fleet_converge_workflow_modes: List<FleetConvergeWorkflowMode> = [FullHostPlan, LaunchEnvironmentPlan, AllocationStorePlan, WorkspaceCommissioningPlan, WorkspaceAllocationPlan, WorkspaceImageBuild, FleetApply, OrgActionsObserve, AppControlPlaneObserve, MicrovmHostConverge, MicrovmNetworkObserve, MicrovmNetworkApply, GuestImageObserve, GuestImageConverge, MicrovmBootProbe, SparkGrants, SparkBootstrap, SparkServingApply, SparkNativeServingApply, SparkRuntimeImageProbe, SparkWirelessLinkConverge, SparkGrantsObserve, DashboardDeploy, ApprovalBrokerDarkInstall, MicrovmControllerInstall, MicrovmSlotReserve, MicrovmSlotStart, RlmLaunchDeploymentReceipt, HostResetReturn, RunnerHostFileObserve, RunnerHostFileConverge, SitePxeEdgeObserve, SitePxeEdgeConverge, RunnerPasswordSessionToolConverge, RunnerBrowserToolchainConverge, R2MintPreflight, R2ObjectWriteMint, OrgRunnerRosterObserve, ApprovalKeyringConverge, ApprovalDeviceEnrolmentCodeIssue, MtCollins1Boot, MtCollins1FanObserve, MtCollins1KvmObserverObserve, MtCollins1CensusImagePublish, MtCollins1CensusMemberReadback, MtCollins1CensusQemuHostObserve, MtCollins1CensusQemuToolchainConverge, HostCredentialCustodyConverge, AppKeyVersionVerify, R2BucketEnsure, R2BucketAdminMint, R2WorkspaceObjectReadMint, R2WorkspaceObjectWriteMint, R2CacheObjectReadMint, R2CacheObjectWriteMint, R2ConditionalPutRaceProbe, WorkspaceSourcePack, WorkspaceCheckpointMeasure, WorkspaceCheckpointRestore, WorkspaceTranscriptRateObserve, FabricWriterIdentityObserve, MicrovmRunnerGroupEnsure, GcpIamConverge, NamecheapObserve, PrinterWorkflow, ArrivalConverge, HetznerCloudServerRead, BranchRunGrant]
 // WHICH RELEASE PRODUCT A MODE'S JOB RUNS, NAMED PER MODE WITH NO WILDCARD (as the scope and fleet-key
 // matches above name theirs). A mode whose steps run only gunbc and claim_executor declares the
 // compiler pair (gunbc.fleet_release_bins_key compiler_pair_release_product): its build job then
@@ -498,6 +442,8 @@ fn fleet_converge_mode_release_product(mode: FleetConvergeWorkflowMode) -> Fleet
     LaunchEnvironmentPlan => SixteenBinaryPack
     AllocationStorePlan => SixteenBinaryPack
     WorkspaceCommissioningPlan => SixteenBinaryPack
+    WorkspaceAllocationPlan => CompilerPairOnly
+    WorkspaceImageBuild => CompilerPairOnly
     FleetApply => SixteenBinaryPack
     OrgActionsObserve => SixteenBinaryPack
     AppControlPlaneObserve => SixteenBinaryPack
@@ -514,18 +460,6 @@ fn fleet_converge_mode_release_product(mode: FleetConvergeWorkflowMode) -> Fleet
     SparkRuntimeImageProbe => SixteenBinaryPack
     SparkWirelessLinkConverge => SixteenBinaryPack
     SparkGrantsObserve => SixteenBinaryPack
-    SparkV41CheckpointMaterialize => SixteenBinaryPack
-    SparkV41RowStoreEncode => SixteenBinaryPack
-    SparkV41RowStoreReadback => SixteenBinaryPack
-    SparkV41EngramDifferential => SixteenBinaryPack
-    SparkV41ServingLoad => SixteenBinaryPack
-    SparkRuntimeImageProduce => SixteenBinaryPack
-    SparkRuntimeImageDistribute => SixteenBinaryPack
-    SparkArmGroupLoad => SixteenBinaryPack
-    SparkArmCheckpointMaterialize => SixteenBinaryPack
-    SparkArmGroupObserve => SixteenBinaryPack
-    SparkArmGroupLaunchPlan => SixteenBinaryPack
-    SparkArmGroupLaunch => SixteenBinaryPack
     DashboardDeploy => SixteenBinaryPack
     ApprovalBrokerDarkInstall => SixteenBinaryPack
     MicrovmControllerInstall => SixteenBinaryPack
@@ -544,17 +478,19 @@ fn fleet_converge_mode_release_product(mode: FleetConvergeWorkflowMode) -> Fleet
     R2WorkspaceObjectReadMint => SixteenBinaryPack
     R2WorkspaceObjectWriteMint => SixteenBinaryPack
     R2CacheObjectReadMint => SixteenBinaryPack
+    HetznerCloudServerRead => SixteenBinaryPack
+    BranchRunGrant => SixteenBinaryPack
     R2CacheObjectWriteMint => SixteenBinaryPack
     R2ConditionalPutRaceProbe => SixteenBinaryPack
     WorkspaceSourcePack => CompilerPairOnly
     WorkspaceCheckpointMeasure => CompilerPairOnly
     WorkspaceCheckpointRestore => CompilerPairOnly
+    WorkspaceTranscriptRateObserve => CompilerPairOnly
     OrgRunnerRosterObserve => SixteenBinaryPack
     ApprovalKeyringConverge => SixteenBinaryPack
     ApprovalDeviceEnrolmentCodeIssue => CompilerPairOnly
     MtCollins1Boot => SixteenBinaryPack
     MtCollins1FanObserve => SixteenBinaryPack
-    MtCollins1UiBundleObserve => SixteenBinaryPack
     MtCollins1KvmObserverObserve => SixteenBinaryPack
     MtCollins1CensusImagePublish => SixteenBinaryPack
     MtCollins1CensusMemberReadback => SixteenBinaryPack
@@ -565,10 +501,10 @@ fn fleet_converge_mode_release_product(mode: FleetConvergeWorkflowMode) -> Fleet
     R2BucketEnsure => SixteenBinaryPack
     R2BucketAdminMint => SixteenBinaryPack
     FabricWriterIdentityObserve => SixteenBinaryPack
-    PairServingD0 => SixteenBinaryPack
     MicrovmRunnerGroupEnsure => SixteenBinaryPack
     GcpIamConverge => SixteenBinaryPack
     NamecheapObserve => SixteenBinaryPack
+    ArrivalConverge => SixteenBinaryPack
     PrinterWorkflow => SixteenBinaryPack
   }
 }
@@ -609,6 +545,8 @@ fn fleet_converge_mode_scope(mode: FleetConvergeWorkflowMode) -> FleetConvergeSc
     LaunchEnvironmentPlan => Present { value: LaunchEnvironment }
     AllocationStorePlan => Present { value: FabricAllocationStoreOnly }
     WorkspaceCommissioningPlan => Present { value: WorkspaceSlotCommissioningOnly }
+    WorkspaceAllocationPlan => Present { value: WorkspaceAllocationOnly }
+    WorkspaceImageBuild => none
     FleetApply => none
     OrgActionsObserve => none
     AppControlPlaneObserve => none
@@ -626,18 +564,6 @@ fn fleet_converge_mode_scope(mode: FleetConvergeWorkflowMode) -> FleetConvergeSc
     SparkRuntimeImageProbe => none
     SparkWirelessLinkConverge => none
     SparkGrantsObserve => none
-    SparkV41CheckpointMaterialize => none
-    SparkV41RowStoreEncode => none
-    SparkV41RowStoreReadback => none
-    SparkV41EngramDifferential => none
-    SparkRuntimeImageProduce => none
-    SparkRuntimeImageDistribute => none
-    SparkArmCheckpointMaterialize => none
-    SparkArmGroupObserve => none
-    SparkArmGroupLaunchPlan => none
-    SparkArmGroupLoad => none
-    SparkArmGroupLaunch => none
-    SparkV41ServingLoad => none
     DashboardDeploy => Present { value: LiveDeploy }
     ApprovalBrokerDarkInstall => none
     MicrovmControllerInstall => none
@@ -659,20 +585,22 @@ fn fleet_converge_mode_scope(mode: FleetConvergeWorkflowMode) -> FleetConvergeSc
     R2WorkspaceObjectReadMint => none
     R2WorkspaceObjectWriteMint => none
     R2CacheObjectReadMint => none
+    HetznerCloudServerRead => none
+    BranchRunGrant => none
     R2CacheObjectWriteMint => none
     R2ConditionalPutRaceProbe => none
     WorkspaceSourcePack => none
     WorkspaceCheckpointMeasure => none
     WorkspaceCheckpointRestore => none
+    WorkspaceTranscriptRateObserve => none
     ApprovalKeyringConverge => none
     ApprovalDeviceEnrolmentCodeIssue => none
     MtCollins1Boot => none
     GcpIamConverge => none
     NamecheapObserve => none
+    ArrivalConverge => none
     PrinterWorkflow => none
-    PairServingD0 => none
     MtCollins1FanObserve => none
-    MtCollins1UiBundleObserve => none
     MtCollins1KvmObserverObserve => none
     FabricWriterIdentityObserve => none
     MtCollins1CensusImagePublish => none
@@ -692,6 +620,16 @@ fn fleet_converge_any_mode_step_if(modes: List<FleetConvergeWorkflowMode>) -> St
   join(map(modes, m => fleet_converge_mode_step_if(mode: m)), " || ")
 }
 
+// THE MODES THAT ACT AS A RUN-SCOPED ACCOUNT (gunbc.auth.branch_dispatch_federation) instead of the
+// main-only fleet-cloud-convergence account, so they run from any branch after the operator approves
+// that run. They never mint the fleet identity: on a branch its provider would refuse them, and at
+// main they would hold the fleet's secrets for no reason.
+data fleet_converge_run_scoped_modes: List<FleetConvergeWorkflowMode> = [HetznerCloudServerRead]
+
+data fleet_converge_run_scoped_step_if: String = fleet_converge_any_mode_step_if(modes: fleet_converge_run_scoped_modes)
+
+data fleet_converge_fleet_identity_step_if: String = concat(concat("!(", fleet_converge_run_scoped_step_if), ")")
+
 // WHICH MODES CONSUME HOST SSH AUTHORITY is declared per mode, exhaustively, so a new mode cannot
 // inherit the fleet key by omission. The fleet-converge job materializes the fleet key only for a
 // dispatch whose mode consumes it: an API-only read (the org credential observe and the org runner
@@ -763,15 +701,20 @@ fn fleet_converge_mode_fleet_ssh_key_demand(mode: FleetConvergeWorkflowMode) ->
     R2WorkspaceObjectReadMint => FleetSshKeyNotConsumed
     R2WorkspaceObjectWriteMint => FleetSshKeyNotConsumed
     R2CacheObjectReadMint => FleetSshKeyNotConsumed
+    HetznerCloudServerRead => FleetSshKeyNotConsumed
+    BranchRunGrant => FleetSshKeyNotConsumed
     R2CacheObjectWriteMint => FleetSshKeyNotConsumed
     R2ConditionalPutRaceProbe => FleetSshKeyNotConsumed
     WorkspaceSourcePack => FleetSshKeyNotConsumed
     WorkspaceCheckpointMeasure => FleetSshKeyNotConsumed
     WorkspaceCheckpointRestore => FleetSshKeyNotConsumed
+    WorkspaceTranscriptRateObserve => FleetSshKeyNotConsumed
     FullHostPlan => FleetSshKeyConsumed
     LaunchEnvironmentPlan => FleetSshKeyConsumed
     AllocationStorePlan => FleetSshKeyConsumed
     WorkspaceCommissioningPlan => FleetSshKeyConsumed
+    WorkspaceAllocationPlan => FleetSshKeyNotConsumed
+    WorkspaceImageBuild => FleetSshKeyNotConsumed
     FleetApply => FleetSshKeyConsumed
     AppControlPlaneObserve => FleetSshKeyConsumed
     MicrovmHostConverge => FleetSshKeyConsumed
@@ -787,18 +730,6 @@ fn fleet_converge_mode_fleet_ssh_key_demand(mode: FleetConvergeWorkflowMode) ->
     SparkRuntimeImageProbe => FleetSshKeyConsumed
     SparkWirelessLinkConverge => FleetSshKeyConsumed
     SparkGrantsObserve => FleetSshKeyConsumed
-    SparkV41CheckpointMaterialize => FleetSshKeyConsumed
-    SparkV41RowStoreEncode => FleetSshKeyConsumed
-    SparkV41RowStoreReadback => FleetSshKeyConsumed
-    SparkV41EngramDifferential => FleetSshKeyConsumed
-    SparkRuntimeImageProduce => FleetSshKeyConsumed
-    SparkRuntimeImageDistribute => FleetSshKeyConsumed
-    SparkArmCheckpointMaterialize => FleetSshKeyConsumed
-    SparkArmGroupObserve => FleetSshKeyConsumed
-    SparkArmGroupLaunchPlan => FleetSshKeyConsumed
-    SparkArmGroupLoad => FleetSshKeyConsumed
-    SparkArmGroupLaunch => FleetSshKeyConsumed
-    SparkV41ServingLoad => FleetSshKeyConsumed
     DashboardDeploy => FleetSshKeyConsumed
     ApprovalBrokerDarkInstall => FleetSshKeyConsumed
     MicrovmControllerInstall => FleetSshKeyConsumed
@@ -818,9 +749,7 @@ fn fleet_converge_mode_fleet_ssh_key_demand(mode: FleetConvergeWorkflowMode) ->
     ApprovalKeyringConverge => FleetSshKeyConsumed
     ApprovalDeviceEnrolmentCodeIssue => FleetSshKeyConsumed
     MtCollins1Boot => FleetSshKeyConsumed
-    PairServingD0 => FleetSshKeyConsumed
     MtCollins1FanObserve => FleetSshKeyNotConsumed
-    MtCollins1UiBundleObserve => FleetSshKeyNotConsumed
     MtCollins1KvmObserverObserve => FleetSshKeyNotConsumed
     FabricWriterIdentityObserve => FleetSshKeyNotConsumed
     MtCollins1CensusImagePublish => FleetSshKeyConsumed
@@ -830,6 +759,7 @@ fn fleet_converge_mode_fleet_ssh_key_demand(mode: FleetConvergeWorkflowMode) ->
     MicrovmRunnerGroupEnsure => FleetSshKeyNotConsumed
     GcpIamConverge => FleetSshKeyNotConsumed
     NamecheapObserve => FleetSshKeyNotConsumed
+    ArrivalConverge => FleetSshKeyNotConsumed
     PrinterWorkflow => FleetSshKeyNotConsumed
   }
 }
@@ -845,7 +775,25 @@ data fleet_converge_fleet_ssh_key_modes: List<FleetConvergeWorkflowMode> = filte
 
 data fleet_converge_fleet_ssh_key_step_if: String = fleet_converge_any_mode_step_if(modes: fleet_converge_fleet_ssh_key_modes)
 
-data fleet_converge_mode_options: List<String> = map(fleet_converge_workflow_modes, m => fleet_converge_workflow_mode_wire(mode: m))
+data fleet_converge_spark_target_modes: List<FleetConvergeWorkflowMode> = [
+  SparkGrants,
+  SparkBootstrap,
+  SparkServingApply,
+  SparkNativeServingApply,
+  SparkRuntimeImageProbe,
+  SparkWirelessLinkConverge,
+  SparkGrantsObserve,
+]
+
+fn fleet_converge_mode_is_spark_target_mode(mode: FleetConvergeWorkflowMode) -> Bool {
+  any(fleet_converge_spark_target_modes, m => fleet_converge_workflow_mode_wire(mode: m) == fleet_converge_workflow_mode_wire(mode: mode))
+}
+
+fn fleet_converge_dispatchable_modes() -> List<FleetConvergeWorkflowMode> {
+  filter(fleet_converge_workflow_modes, m => count(fleet_converge_spark_target_options) > 0 || !fleet_converge_mode_is_spark_target_mode(mode: m))
+}
+
+data fleet_converge_mode_options: List<String> = map(fleet_converge_dispatchable_modes(), m => fleet_converge_workflow_mode_wire(mode: m))
 
 
 // ── the host reset-return mode ─────────────────────────────────────────────────────────────────
@@ -876,7 +824,7 @@ data fleet_converge_mode_options: List<String> = map(fleet_converge_workflow_mod
 // the one a later worker would most plausibly act on is the one that disarms the corroboration.
 // gunbc.host_reset_return carries the full argument, above reset_return_verdict_of_mint.
 data fleet_converge_reset_assignment: ResetDispatchAssignment = reset_dispatch_pairings(
-  subject_roster: reset_subject_roster(),
+  subject_roster: reset_roster_hosts(entries: reset_subject_roster()),
   peer_roster: reset_observer_peer_roster(),
 )
 
@@ -1231,7 +1179,7 @@ data fleet_converge_launch_environment_plan_step_if: String = fleet_converge_mod
 data fleet_converge_allocation_store_plan_step_if: String = fleet_converge_mode_step_if(mode: AllocationStorePlan)
 data fleet_converge_workspace_commissioning_plan_step_if: String = fleet_converge_mode_step_if(mode: WorkspaceCommissioningPlan)
 
-data fleet_converge_any_plan_step_if: String = fleet_converge_any_mode_step_if(modes: [FullHostPlan, LaunchEnvironmentPlan, AllocationStorePlan, WorkspaceCommissioningPlan])
+data fleet_converge_any_plan_step_if: String = fleet_converge_any_mode_step_if(modes: [FullHostPlan, LaunchEnvironmentPlan, AllocationStorePlan, WorkspaceCommissioningPlan, WorkspaceAllocationPlan])
 data fleet_converge_apply_step_if: String = fleet_converge_mode_step_if(mode: FleetApply)
 data fleet_converge_org_actions_step_if: String = fleet_converge_mode_step_if(mode: OrgActionsObserve)
 data fleet_converge_org_runner_roster_step_if: String = fleet_converge_mode_step_if(mode: OrgRunnerRosterObserve)
@@ -1369,10 +1317,9 @@ data fleet_converge_spark_native_serving_apply_step_if: String = fleet_converge_
 // two coincide. `spark_native_serving_apply` does not: it reaches out from whichever executor was
 // selected and relaunches Group B's four cage-2 hosts, so two dispatches naming different executors
 // would land in different domains and queue behind nothing while reloading the same 328 GB arm. Its
-// group is therefore constant for the arm. `pair_serving_d0` and `spark_serving_apply` are the same
-// shape for Group A: the door moves Group A's authority and hosts from the broker host and the pair
-// apply rewrites Group A's units from any executor, so both land in Group A's arm group and queue
-// behind each other -- an apply that read Active before D0's suspension CAS cannot execute across it.
+// group is therefore constant for the arm. `spark_serving_apply` is keyed to the srv1 control-plane
+// group (gunbc.fleet_workflow_steps fleet_srv1_control_plane_mutation_group), so it queues behind every
+// srv1 mutation whichever executor it names.
 //
 // AND THIS IS BELT, NOT THE WALL, which is worth saying because a reader could take it for the
 // protection. Actions concurrency cannot help a direct CLI invocation, which is how this entry is
@@ -1390,33 +1337,12 @@ data fleet_converge_spark_native_serving_apply_step_if: String = fleet_converge_
 // A SUBJECT IS NOT ALWAYS AN ARM: the enrolment-code issue mutates only the approval device store,
 // which no other mode writes, so it carries that store's own group (gunbc.fleet_workflow_steps
 // fleet_subject_mutation_group_approval_device_store) and no longer queues behind -- or is cancelled
-// as a superseded pending by -- the Group A work that shares srv1's key. The keyring converge and the
-// broker install do NOT move: D0 below serialises with them, and that is a reason, not an accident.
-//
-// D0 HAS TWO DOMAINS AND ONE KEY. The door runs on srv1 (the broker is loopback there, the placed
-// fabric store is in process) AND moves Group A's authority and hosts; GitHub admits one group per
-// job, so Group A's arm key IS the srv1 host key: D0 keeps serializing with every srv1 control-plane
-// mutation (the fleet apply, the keyring converge, the dashboard deploy, the broker install), and
-// the pair-serving apply -- which rewrites Group A's units from any executor -- joins that same key,
-// so an apply that read Active before D0's suspension CAS cannot execute across it. Belt, not the
-// wall: the wall is the authority log's lease and claim (gunbc.spark.pair_serving_d0).
-//
-// THE TWO V4.1 MODES JOIN THAT KEY FOR THE SAME REASON, AND THE PROBE DOES NOT. Both
-// `spark_v41_checkpoint_materialize` and `spark_v41_runtime_image_build` name a GROUP A host as their
-// target and are admitted by that group's pair subject holding it (gunbc.spark.host_commitment
-// `admit_host_held_by_subject`), so their subject is the arm, not whichever executor a dispatch
-// happened to name -- two dispatches for two Group A hosts must queue behind each other, and behind
-// D0 and the pair apply. `spark_runtime_image_probe` stays in the executor's domain because it is a
-// read: it pulls a pinned image and reports what is inside it, changing nothing on the host.
+// as a superseded pending by -- the work that shares srv1's key. The keyring converge and the
+// broker install do NOT move.
 //
-// THE GENERIC GROUP A PRODUCE AND MATERIALIZE MODES ARE KEYED BY THEIR TARGET, NOT THE ARM (operator
-// ruling relayed by valiant-crab-775, 2026-10-03). `spark_runtime_image_produce` and
-// `spark_arm_checkpoint_materialize` each occupy ONE named Spark for hours and change nothing on any
-// other, so a download on srv5 may run while srv7 builds. What fences them is not this group: it is
-// the per-host claim inside each mode (gunbc.spark.host_commitment `admit_host_held_by_subject` and
-// the placement fences it reads), which refuses a host another effect holds whatever queue the
-// dispatch sat in. Two dispatches for the SAME target still share a key and queue. The launch, the
-// load, D0, the pair apply and the distribution stay on the shared Group A key.
+// THE GROUP A MODES ARE GONE. D0, the V4.1 checkpoint/row-store/differential/load modes and the arm
+// produce/materialize/launch/load modes keyed on Group A were deleted with the group (decommissioned and
+// sold, 2026-10-07). The pair-serving apply keeps the srv1 control-plane key it shared with them.
 //
 // A READ-ONLY OBSERVE SITS IN NO QUEUE AT ALL. GitHub keeps one pending run per group and a newer
 // pending CANCELS the older, so an observe that shared the srv1 key was cancelled by an unrelated
@@ -1435,6 +1361,8 @@ fn fleet_converge_mode_mutation_domain(mode: FleetConvergeWorkflowMode) -> Fleet
     LaunchEnvironmentPlan => ExecutorDomain
     AllocationStorePlan => ExecutorDomain
     WorkspaceCommissioningPlan => ExecutorDomain
+    WorkspaceAllocationPlan => ExecutorDomain
+    WorkspaceImageBuild => ExecutorDomain
     FleetApply => ExecutorDomain
     OrgActionsObserve => ExecutorDomain
     AppControlPlaneObserve => ExecutorDomain
@@ -1447,23 +1375,11 @@ fn fleet_converge_mode_mutation_domain(mode: FleetConvergeWorkflowMode) -> Fleet
     MicrovmBootProbe => ExecutorDomain
     SparkGrants => ExecutorDomain
     SparkBootstrap => ExecutorDomain
-    SparkServingApply => SubjectDomain { group: fleet_arm_mutation_group_deepseek_group_a }
+    SparkServingApply => SubjectDomain { group: fleet_srv1_control_plane_mutation_group }
     SparkNativeServingApply => SubjectDomain { group: fleet_arm_mutation_group_glm_group_b_native }
     SparkRuntimeImageProbe => ExecutorDomain
     SparkWirelessLinkConverge => ExecutorDomain
     SparkGrantsObserve => ExecutorDomain
-    SparkV41CheckpointMaterialize => SubjectDomain { group: fleet_arm_mutation_group_deepseek_group_a }
-    SparkV41RowStoreEncode => SubjectDomain { group: fleet_arm_mutation_group_deepseek_group_a }
-    SparkV41RowStoreReadback => SubjectDomain { group: fleet_arm_mutation_group_deepseek_group_a }
-    SparkV41EngramDifferential => SubjectDomain { group: fleet_arm_mutation_group_deepseek_group_a }
-    SparkRuntimeImageProduce => TargetHostDomain
-    SparkRuntimeImageDistribute => SubjectDomain { group: fleet_arm_mutation_group_deepseek_group_a }
-    SparkArmCheckpointMaterialize => TargetHostDomain
-    SparkArmGroupObserve => ReadOnlyOwnRun
-    SparkArmGroupLaunchPlan => ExecutorDomain
-    SparkArmGroupLoad => SubjectDomain { group: fleet_arm_mutation_group_deepseek_group_a }
-    SparkArmGroupLaunch => SubjectDomain { group: fleet_arm_mutation_group_deepseek_group_a }
-    SparkV41ServingLoad => SubjectDomain { group: fleet_arm_mutation_group_deepseek_group_a }
     DashboardDeploy => ExecutorDomain
     RlmLaunchDeploymentReceipt => ExecutorDomain
     HostResetReturn => ExecutorDomain
@@ -1485,17 +1401,18 @@ fn fleet_converge_mode_mutation_domain(mode: FleetConvergeWorkflowMode) -> Fleet
     R2WorkspaceObjectReadMint => ExecutorDomain
     R2WorkspaceObjectWriteMint => ExecutorDomain
     R2CacheObjectReadMint => ExecutorDomain
+    HetznerCloudServerRead => ExecutorDomain
+    BranchRunGrant => ExecutorDomain
     R2CacheObjectWriteMint => ExecutorDomain
     R2ConditionalPutRaceProbe => SubjectDomain { group: "r2-conditional-put-race-probe" }
     WorkspaceSourcePack => ExecutorDomain
     WorkspaceCheckpointMeasure => ExecutorDomain
     WorkspaceCheckpointRestore => ExecutorDomain
+    WorkspaceTranscriptRateObserve => ExecutorDomain
     ApprovalKeyringConverge => ExecutorDomain
     ApprovalDeviceEnrolmentCodeIssue => SubjectDomain { group: fleet_subject_mutation_group_approval_device_store }
     MtCollins1Boot => ExecutorDomain
-    PairServingD0 => SubjectDomain { group: fleet_arm_mutation_group_deepseek_group_a }
     MtCollins1FanObserve => ExecutorDomain
-    MtCollins1UiBundleObserve => ExecutorDomain
     MtCollins1KvmObserverObserve => ExecutorDomain
     FabricWriterIdentityObserve => ExecutorDomain
     MtCollins1CensusImagePublish => ExecutorDomain
@@ -1506,6 +1423,7 @@ fn fleet_converge_mode_mutation_domain(mode: FleetConvergeWorkflowMode) -> Fleet
     OrgRunnerRosterObserve => ExecutorDomain
     GcpIamConverge => ExecutorDomain
     NamecheapObserve => ExecutorDomain
+    ArrivalConverge => ExecutorDomain
     PrinterWorkflow => ExecutorDomain
   }
 }
@@ -1538,23 +1456,26 @@ data fleet_converge_mutation_concurrency_group_expression: String = join([
   "format('", fleet_host_mutation_group_prefix, "{0}', ", fleet_host_input_expression, ") }}",
 ], "")
 
+fn fleet_converge_exclusive_job_concurrency(group: String) -> ConcurrencySpec? {
+  Present {
+    value: ConcurrencyMappingQueueNotMax {
+      group: group,
+      cancel_in_progress: Present { value: CancelInProgressBool { value: false } },
+      explicit_single: none
+    }
+  }
+}
+
 data fleet_converge_spark_runtime_image_probe_step_if: String = fleet_converge_mode_step_if(mode: SparkRuntimeImageProbe)
 data fleet_converge_spark_wireless_link_converge_step_if: String = fleet_converge_mode_step_if(mode: SparkWirelessLinkConverge)
 data fleet_converge_spark_grants_observe_step_if: String = fleet_converge_mode_step_if(mode: SparkGrantsObserve)
-data fleet_converge_spark_v41_checkpoint_materialize_step_if: String = fleet_converge_mode_step_if(mode: SparkV41CheckpointMaterialize)
-
-data fleet_converge_spark_v41_row_store_encode_step_if: String = fleet_converge_mode_step_if(mode: SparkV41RowStoreEncode)
-data fleet_converge_spark_v41_row_store_readback_step_if: String = fleet_converge_mode_step_if(mode: SparkV41RowStoreReadback)
-data fleet_converge_spark_v41_engram_differential_step_if: String = fleet_converge_mode_step_if(mode: SparkV41EngramDifferential)
 
-data fleet_converge_spark_runtime_image_produce_step_if: String = fleet_converge_mode_step_if(mode: SparkRuntimeImageProduce)
-data fleet_converge_spark_runtime_image_distribute_step_if: String = fleet_converge_mode_step_if(mode: SparkRuntimeImageDistribute)
-data fleet_converge_spark_arm_checkpoint_materialize_step_if: String = fleet_converge_mode_step_if(mode: SparkArmCheckpointMaterialize)
-data fleet_converge_spark_arm_group_observe_step_if: String = fleet_converge_mode_step_if(mode: SparkArmGroupObserve)
-data fleet_converge_spark_arm_group_launch_plan_step_if: String = fleet_converge_mode_step_if(mode: SparkArmGroupLaunchPlan)
-data fleet_converge_spark_arm_group_load_step_if: String = fleet_converge_mode_step_if(mode: SparkArmGroupLoad)
-data fleet_converge_spark_arm_group_launch_step_if: String = fleet_converge_mode_step_if(mode: SparkArmGroupLaunch)
-data fleet_converge_spark_v41_serving_load_step_if: String = fleet_converge_mode_step_if(mode: SparkV41ServingLoad)
+// ROOT-HOST MUTATION ON srv1 is gated by GitHub environment srv1-production
+// (gunbc.auth.github_deployment_environment). The boundary is that environment's repository
+// protection (deployment branches = refs/heads/main, required reviewers) -- an operator-applied
+// setting with a readback row, not a job `if`. A workflow_dispatch runs the DISPATCHED ref's YAML,
+// so github.ref == refs/heads/main in this file is not a trust boundary: a branch can delete it.
+data fleet_converge_srv1_root_mutation_environment: NonEmptyStr = srv1_production_environment_name
 
 data fleet_converge_dashboard_deploy_step_if: String = fleet_converge_mode_step_if(mode: DashboardDeploy)
 
@@ -2402,51 +2323,18 @@ fn fleet_converge_mtcollins1_fan_observe_step() -> Step {
   }
 }
 
-// MT. COLLINS' OWN UI BUNDLE AND ITS DIGEST (gunbc.machine_intake_mtcollins1_ui_bundle_observe): the
-// firmware revision over IPMI, then the served source.min.js bytes, only under revision 0.32. Reads
-// only, no web session. The receipt and the bytes are uploaded whatever the outcome, because a refused
-// run's receipt is the one that says why it holds no bytes; a step condition without a status
-// function is implicitly success() and would drop exactly that receipt.
 // A READ-ONLY MT. COLLINS PROBE STEP'S BUDGET IS A FOLD, NEVER A LITERAL, over the step's phases in
 // order, each counted once and rounded once: gunbc run's load of the probe's closure, whose authority is
 // the measured resolve budget (gunbc.fleet_workflow_steps gunbc_ci_gunbc_run_resolve_step_timeout_minutes),
 // then the step's own phases -- for a probe, the credential prelude's one bounded Secret Manager read
 // (gunbc.ci_spec gunbc_ci_sm_max_time; the prelude's other lines are local file writes) and the probe's
 // declared bound; for the always() release, the owned release alone. The flat aux budget
-// is what killed the UI bundle's first wet run (36759368077) while it was still typechecking.
+// is what killed a probe's first wet run while it was still typechecking.
 fn fleet_converge_mtcollins1_probe_step_timeout_minutes(phases: List<Second>) -> Int {
   let secs = fold(phases, gunbc_ci_gunbc_run_resolve_step_timeout_minutes * 60, (acc, p) => acc + (second_count(s: p) as Int))
   (secs + 59) / 60
 }
 
-data fleet_converge_mtcollins1_ui_bundle_observe_step_if: String = fleet_converge_mode_step_if(mode: MtCollins1UiBundleObserve)
-
-fn fleet_converge_mtcollins1_ui_bundle_observe_step() -> Step {
-  RunStep {
-    name: Present { value: "Mt. Collins served UI: firmware revision, then source.min.js, viewer.html and every script they load, each with its sha256 (reads only)" },
-    id: Present { value: "mtcollins1_ui_bundle_observe" },
-    run: gunbc_ci_mtcollins1_ui_bundle_observe_invoke(),
-    shell: none,
-    env: Present { value: [
-      kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
-    ] },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_mtcollins1_ui_bundle_observe_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: fleet_converge_mtcollins1_probe_step_timeout_minutes(phases: [gunbc_ci_sm_max_time, mtcollins1_ui_bundle_read_bound()]) }
-  }
-}
-
-fn fleet_converge_mtcollins1_ui_bundle_observe_upload_step() -> Step {
-  fleet_converge_receipt_upload_step(
-    id: "mtcollins1_ui_bundle_observe_upload",
-    name: "Upload Mt. Collins served UI files and receipt",
-    artifact: "mtcollins1-ui-bundle",
-    path: mtcollins1_ui_bundle_artifact_glob,
-    if_condition: join(["always() && ", fleet_converge_mtcollins1_ui_bundle_observe_step_if], "")
-  )
-}
-
 // THE REAL KVM OBSERVER AGAINST THE REAL BMC, NO BOOT (gunbc.machine_intake_mtcollins1_kvm_observer_observe):
 // under the unit hold, log in, establish the viewer, take one still, release the web session and the
 // browser. Nothing is written to media, power, boot device or SEL. The journal, its pre-teardown
@@ -2522,6 +2410,7 @@ data fleet_converge_fabric_writer_identity_observe_receipt_if: String = join(["a
 data fleet_converge_workspace_source_pack_step_if: String = fleet_converge_mode_step_if(mode: WorkspaceSourcePack)
 data fleet_converge_workspace_checkpoint_measure_step_if: String = fleet_converge_mode_step_if(mode: WorkspaceCheckpointMeasure)
 data fleet_converge_workspace_checkpoint_restore_step_if: String = fleet_converge_mode_step_if(mode: WorkspaceCheckpointRestore)
+data fleet_converge_workspace_transcript_rate_observe_step_if: String = fleet_converge_mode_step_if(mode: WorkspaceTranscriptRateObserve)
 
 // THE INSTRUMENT STEPS' ENVELOPE, STATED AS AN ENVELOPE, NOT A MEASUREMENT: the time these steps take
 // IS what stage 0 measures (a twenty-thousand-file workspace hashed and put one chunk at a time), so
@@ -2544,7 +2433,9 @@ fn fleet_converge_workspace_instrument_step(name: String, id: String, run: Strin
 }
 
 fn fleet_converge_workspace_source_pack_step() -> Step {
-  fleet_converge_workspace_instrument_step(name: "Workspace source pack: the operator workspace minus credentials and build output, into the workspace bucket by its SHA-256", id: "workspace_source_pack", run: gunbc_ci_workspace_source_pack_invoke(), if_condition: fleet_converge_workspace_source_pack_step_if, extra_env: [])
+  fleet_converge_workspace_instrument_step(name: "Workspace source pack: the operator workspace minus credentials and build output, into the workspace bucket by its SHA-256", id: "workspace_source_pack", run: gunbc_ci_workspace_source_pack_invoke(), if_condition: fleet_converge_workspace_source_pack_step_if, extra_env: [
+    kv(key: workspace_agent_state_slot_env as String, value: yaml_string(s: "${{ github.event.inputs.agent_state_slot }}")),
+  ])
 }
 
 fn fleet_converge_workspace_source_pack_receipt_upload_step() -> Step {
@@ -2587,6 +2478,37 @@ fn fleet_converge_workspace_checkpoint_restore_receipt_upload_step() -> Step {
   )
 }
 
+// THE TRANSCRIPT APPEND-RATE OBSERVATION (gunbc.fabric.workspace_transcript_rate) reads sizes and
+// mtimes on srv1 and touches no bucket, so it carries no WIF token: it is the instrument envelope
+// without the credential. Its timeout is an ENVELOPE around a declared ten-minute window plus one
+// walk of the agent-state roots per interval, three times the window so a slow walk still reaches
+// its receipt; the window, not this bound, is what the receipt reports.
+data fleet_converge_workspace_transcript_rate_step_timeout_minutes: Duration = 30
+
+fn fleet_converge_workspace_transcript_rate_observe_step() -> Step {
+  RunStep {
+    name: Present { value: "Workspace transcript append rate: size and mtime of every transcript file on srv1, sampled per interval over a declared window, content never read" },
+    id: Present { value: "workspace_transcript_rate_observe" },
+    run: gunbc_ci_workspace_transcript_rate_observe_invoke(),
+    shell: none,
+    env: Present { value: [kv(key: workspace_agent_state_slot_env as String, value: yaml_string(s: "${{ github.event.inputs.agent_state_slot }}"))] },
+    working_directory: none,
+    if_condition: Present { value: fleet_converge_workspace_transcript_rate_observe_step_if },
+    continue_on_error: none,
+    timeout_minutes: Present { value: fleet_converge_workspace_transcript_rate_step_timeout_minutes }
+  }
+}
+
+fn fleet_converge_workspace_transcript_rate_observe_receipt_upload_step() -> Step {
+  fleet_converge_receipt_upload_step(
+    id: "workspace_transcript_rate_observe_receipt_upload",
+    name: "Upload workspace transcript append-rate receipt",
+    artifact: "workspace-transcript-rate-observe",
+    path: workspace_transcript_rate_receipt_path,
+    if_condition: join(["always() && ", fleet_converge_workspace_transcript_rate_observe_step_if], "")
+  )
+}
+
 fn fleet_converge_fabric_writer_identity_observe_step() -> Step {
   RunStep {
     name: Present { value: "Fabric writer identity: the login this host presents at the fabric DB's served door (reads only)" },
@@ -3068,53 +2990,6 @@ fn fleet_converge_mtcollins1_boot_step() -> Step {
   }
 }
 
-// THE D0 DOOR AS A MODE (gunbc.spark.pair_serving_d0_door pair_serving_d0_ci_wet): on the broker
-// host, files the consent under the named escalation, waits for the operator, and runs the Cut D
-// D0 transaction over the named group under the admitted grant. It consumes the fleet ssh key
-// because the transaction's observation reads the group's hosts over ssh. The consent is an
-// operator-supplied input reused on every rerun (see the door), so nothing here derives it.
-data fleet_converge_pair_serving_d0_step_if: String = fleet_converge_mode_step_if(mode: PairServingD0)
-
-// THE ADMISSION RUNS BEFORE ANY CREDENTIAL: placed after the release bins are verified and before
-// the WIF token, the fleet key and the submission key, it refuses a dispatch to any host but srv1
-// (declared AND kernel) with no secret on that host.
-fn fleet_converge_pair_serving_d0_admit_step() -> Step {
-  RunStep {
-    name: Present { value: "Pair-serving D0 admission (credential-free): the executor is srv1, the consent and the expected revision are named" },
-    id: Present { value: "pair_serving_d0_admit" },
-    run: gunbc_ci_pair_serving_d0_admit_invoke(),
-    shell: none,
-    env: Present { value: [
-      kv(key: fleet_converge_expected_host_env_name, value: yaml_string(s: "${{ github.event.inputs.host }}")),
-      kv(key: pair_serving_d0_consent_env as String, value: yaml_string(s: "${{ github.event.inputs.d0_consent }}")),
-      kv(key: rlm_expected_revision_env_name, value: yaml_string(s: "${{ github.event.inputs.expected_revision }}")),
-    ] },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_pair_serving_d0_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_gunbc_run_resolve_step_timeout_minutes }
-  }
-}
-
-fn fleet_converge_pair_serving_d0_step() -> Step {
-  RunStep {
-    name: Present { value: "Pair-serving D0 (Cut D): file the consent, wait for the operator, suspend the group's authority for the keyed successor under the admitted grant" },
-    id: Present { value: "pair_serving_d0" },
-    run: gunbc_ci_pair_serving_d0_invoke(),
-    shell: none,
-    env: Present { value: [
-      kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
-      kv(key: fleet_converge_expected_host_env_name, value: yaml_string(s: "${{ github.event.inputs.host }}")),
-      kv(key: pair_serving_d0_consent_env as String, value: yaml_string(s: "${{ github.event.inputs.d0_consent }}")),
-      kv(key: rlm_expected_revision_env_name, value: yaml_string(s: "${{ github.event.inputs.expected_revision }}")),
-    ] },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_pair_serving_d0_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: minute_count(pair_serving_d0_step_timeout_minutes()) }
-  }
-}
-
 fn fleet_converge_mtcollins1_boot_receipt_upload_step() -> Step {
   UsesStep {
     name: Present { value: "Upload Mt. Collins unit 1 boot SOL capture and receipts" },
@@ -3499,10 +3374,10 @@ fn fleet_converge_dashboard_deploy_step() -> Step {
 // revisions already superseded before they were installed. QueueNotMax holds at most one pending and
 // REPLACES it with the newest arrival, which is what fleet_host_mutation_concurrency_group_expression's
 // annotation describes: an older pending deployment gives way to the newest arrival. NOTE the
-// weaker claim -- "newest arrival", not "newest main revision". While the trigger is
-// workflow_dispatch over a caller-selected ref, the newest arrival is whatever was dispatched last
-// and need not be main at all, so the stronger sentence would assert an ordering nothing
-// establishes. cancel_in_progress
+// weaker claim -- "newest arrival", not "newest main revision". The job if_condition now also
+// names environment srv1-production, whose GitHub protection (not this if-condition) is the
+// branch boundary. The queue still orders arrivals that entered the job.
+// cancel_in_progress
 // is false in both readings and that is the half that matters most -- a queued deploy must never
 // interrupt the one currently holding the host mutation window, which is the state that produces a
 // half-applied cutover.
@@ -3511,7 +3386,7 @@ fn fleet_converge_dashboard_deploy_job() -> Job {
     id: fleet_converge_mode_job_id(mode: DashboardDeploy) as String,
     name: none,
     runner: fleet_converge_host_pinned_runner_spec(),
-    environment: none,
+    environment: Present { value: fleet_converge_srv1_root_mutation_environment as String },
     steps: concat(
       fleet_converge_consumer_prelude_steps(),
       [
@@ -3627,12 +3502,15 @@ fn fleet_converge_microvm_controller_install_job() -> Job {
     id: fleet_converge_mode_job_id(mode: MicrovmControllerInstall) as String,
     name: none,
     runner: fleet_converge_host_pinned_runner_spec(),
-    environment: none,
+    environment: Present { value: fleet_converge_srv1_root_mutation_environment as String },
     steps: concat(
       fleet_converge_consumer_prelude_steps(),
       [
         ci_release_bins_download_step(),
         ci_release_bins_unpack_verify_step(),
+        fleet_converge_receipt_download_step(id: "workspace_image_download", name: "Download the workspace image selected for installation",
+          artifact: workspace_image_artifact_name, path: workspace_image_staging_root,
+          run_id_expression: "${{ inputs.workspace_image_run_id }}"),
         fleet_converge_microvm_controller_install_step(),
       ]
     ),
@@ -3658,7 +3536,7 @@ fn fleet_converge_approval_broker_dark_install_job() -> Job {
     id: fleet_converge_mode_job_id(mode: ApprovalBrokerDarkInstall) as String,
     name: none,
     runner: fleet_converge_host_pinned_runner_spec(),
-    environment: none,
+    environment: Present { value: fleet_converge_srv1_root_mutation_environment as String },
     steps: concat(
       fleet_converge_consumer_prelude_steps(),
       [
@@ -3841,307 +3719,6 @@ fn fleet_converge_spark_wireless_link_converge_step() -> Step {
   }
 }
 
-// THE PRODUCTION, AND THE ONE THING ABOUT IT THAT IS NOT LIKE ITS NEIGHBOURS: its budget. Every
-// other spark_* step in this job converges or observes within the hour that
-// gunbc_ci_spark_serving_step_timeout_minutes allows. This one compiles vLLM from source for
-// compute capability 12.1, which the one executed cold build of this image took about seventy-five
-// minutes to do -- so under the serving budget a from-scratch run would be cut off mid-compile and
-// report a timeout where the truth was a budget defect. gunbc.spark.vllm_runtime_image_build's
-// dissolve-on names exactly this as the reason its entry had no mode.
-//
-// THE BUDGET IS DERIVED AND NOT PICKED. vllm_build_host_effect_term is the term the build's OWN host
-// claim is admitted for -- three hours, after which an unreleased claim reads OVERDUE -- so the step
-// may run for that long and not one minute more: a step outliving the claim that fences its host is
-// the state that term exists to make visible. gunbc_ci_spark_runtime_image_build_step_timeout_minutes
-// is that term in minutes, and the job backstop takes it as its own term rather than folding it into
-// the spark-tier count, because this is a fourth tier and not a fifth spark step.
-//
-// IT IS STILL A MODE AND NOT A JOB. It costs nothing on a push, it adds no standing claim on a
-// runner, and it shares the job's prelude with the bootstrap, the grant install, the serving apply
-// and the probe -- which is the bar the job roster is closed to growth against.
-fn fleet_converge_spark_runtime_image_produce_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark runtime image produce (the image named by the closed runtime_image input, gunbc.spark.runtime_image_produce_dispatch: built on the selected Group A Spark, read back by digest and probed inside that digest)" },
-    id: Present { value: "spark_runtime_image_produce" },
-    run: gunbc_ci_spark_runtime_image_produce_invoke(),
-    shell: none,
-    env: Present {
-      value: [
-        kv(key: "SPARK_CONVERGE_TARGET", value: yaml_string(s: "${{ github.event.inputs.target }}")),
-        kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
-        kv(key: runtime_image_env as String, value: yaml_string(s: "${{ github.event.inputs.runtime_image }}")),
-      ]
-    },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_runtime_image_produce_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_runtime_image_build_step_timeout_minutes() }
-  }
-}
-
-// THE PRODUCED V4.1 IMAGE ONTO THE SELECTED GROUP A SPARK (gunbc.spark.v41_runtime_image_converge
-// v41_runtime_image_distribute_ci_wet): the source is the host the production receipt names, the target
-// is this dispatch's `target`, and the image is named by the receipt's configuration digest. Group A's
-// arm domain serializes it with the build, D0 and the pair apply.
-fn fleet_converge_spark_runtime_image_distribute_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark runtime image distribute (the produced image named by the closed runtime_image input, by its configuration digest, from the host its production receipt names to the selected Spark of its group, read back there)" },
-    id: Present { value: "spark_runtime_image_distribute" },
-    run: gunbc_ci_spark_runtime_image_distribute_invoke(),
-    shell: none,
-    env: Present {
-      value: [
-        kv(key: "SPARK_CONVERGE_TARGET", value: yaml_string(s: "${{ github.event.inputs.target }}")),
-        kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
-        kv(key: runtime_image_env as String, value: yaml_string(s: "${{ github.event.inputs.runtime_image }}")),
-      ]
-    },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_runtime_image_distribute_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_runtime_image_distribute_step_timeout_minutes() }
-  }
-}
-
-// THE ARM GROUP LAUNCH (deforking cut 8a): one launch path for every arm on a fabric group
-// (gunbc.spark.group_arm_launch), the arm chosen by closed dispatch inputs (gunbc.spark
-// arm_group_launch_dispatch). spark_arm_group_launch_plan renders the chosen arm's plan, every host's
-// unit and scripts, its declared incumbent and the admission verdict, and reaches no host;
-// spark_arm_group_launch runs the arm: its reads, the admission, its own pre-apply, the declared
-// incumbent's stop-and-restore bracket and the arm transaction. The arm, the GLM staircase step and the
-// declared incumbent reach the entries as environment words whose vocabularies are the options of the
-// dispatch inputs below, so a free-text step has no route in. Both modes serialize in Group A's arm
-// domain with D0, the build and the distribution when they mutate; the plan only reads.
-fn fleet_converge_arm_group_launch_env() -> List<YamlKeyValue> {
-  [
-    kv(key: "SPARK_CONVERGE_TARGET", value: yaml_string(s: "${{ github.event.inputs.target }}")),
-    kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
-    kv(key: arm_group_launch_arm_env as String, value: yaml_string(s: "${{ github.event.inputs.arm }}")),
-    kv(key: arm_group_launch_step_env as String, value: yaml_string(s: "${{ github.event.inputs.staircase_step }}")),
-    kv(key: arm_group_launch_incumbent_env as String, value: yaml_string(s: "${{ github.event.inputs.incumbent }}")),
-  ]
-}
-
-// THE READ-ONLY OBSERVE: the chosen arm's group, per host every running service unit, running container
-// and GPU compute process with its owning cgroup. It changes nothing on any host; it is how a declared
-// incumbent is recorded when nobody can hand it over.
-// THE ARM'S CHECKPOINT ON THE TARGET SPARK (gunbc.spark.group_checkpoint_materialize): the snapshot the
-// checkpoint's row names, adopted if it verifies in the host's Hub cache, else fetched by the Hub CLI
-// inside a recorded runtime image the host holds (the closed runtime_image input; never pulled) and
-// verified. The checkpoint is a closed dispatch input.
-fn fleet_converge_spark_arm_checkpoint_materialize_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark arm checkpoint materialize (the checkpoint named by the closed checkpoint input, adopted or fetched into the target Spark's Hub cache and verified)" },
-    id: Present { value: "spark_arm_checkpoint_materialize" },
-    run: gunbc_ci_spark_arm_checkpoint_materialize_invoke(),
-    shell: none,
-    env: Present { value: concat(fleet_converge_arm_group_launch_env(), [kv(key: arm_checkpoint_env as String, value: yaml_string(s: "${{ github.event.inputs.checkpoint }}")), kv(key: runtime_image_env as String, value: yaml_string(s: "${{ github.event.inputs.runtime_image }}"))]) },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_arm_checkpoint_materialize_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_runtime_image_build_step_timeout_minutes() }
-  }
-}
-
-fn fleet_converge_spark_arm_group_observe_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark arm group OBSERVE (read-only: every host's running units, containers and GPU processes with their owning cgroups; nothing is changed)" },
-    id: Present { value: "spark_arm_group_observe" },
-    run: gunbc_ci_spark_arm_group_observe_invoke(),
-    shell: none,
-    env: Present { value: fleet_converge_arm_group_launch_env() },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_arm_group_observe_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_serving_step_timeout_minutes }
-  }
-}
-
-fn fleet_converge_spark_arm_group_launch_plan_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark arm group launch PLAN (the chosen arm's plan, units, scripts, declared incumbent and admission verdict; no host is touched)" },
-    id: Present { value: "spark_arm_group_launch_plan" },
-    run: gunbc_ci_spark_arm_group_launch_plan_invoke(),
-    shell: none,
-    env: Present { value: fleet_converge_arm_group_launch_env() },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_arm_group_launch_plan_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_serving_step_timeout_minutes }
-  }
-}
-
-// THE ARM'S LOAD STEP (gunbc.spark.group_arm_serving_load over the shared runner): the staircase step
-// named by the closed inputs, loaded at its cold floor and its ceiling from its head, judged by the stop
-// rules, folded into a calibration receipt. The target must be the step's head.
-fn fleet_converge_spark_arm_group_load_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark arm group load (the staircase step named by the closed inputs, loaded at its cold floor and its ceiling from its head; stop rules judged; calibration receipt folded)" },
-    id: Present { value: "spark_arm_group_load" },
-    run: gunbc_ci_spark_arm_group_load_invoke(),
-    shell: none,
-    env: Present { value: fleet_converge_arm_group_launch_env() },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_arm_group_load_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_serving_step_timeout_minutes }
-  }
-}
-
-fn fleet_converge_spark_arm_group_launch_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark arm group launch (the chosen arm's reads and admission, its pre-apply, the declared incumbent stopped and the hosts re-read vacant, then the arm applied as one transaction; the incumbent restored on anything but a commit)" },
-    id: Present { value: "spark_arm_group_launch" },
-    run: gunbc_ci_spark_arm_group_launch_invoke(),
-    shell: none,
-    env: Present { value: fleet_converge_arm_group_launch_env() },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_arm_group_launch_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: arm_launch_step_timeout_minutes }
-  }
-}
-
-// THE V4.1 SERVING-LOAD STAIRCASE ON GROUP A (gunbc.spark.v41_serving_load v41_serving_load_ci_wet): the
-// shared serving-load runner drives one vllm bench serve step per capacity-measurement concurrency
-// against the head, reads host pressure on every rank around each step, and runs the staircase's stop
-// rules over the worst rank. The target must be the head (srv6). Group A's arm domain serializes it
-// with the launch, so no step is driven against an arm mid-transaction.
-fn fleet_converge_spark_v41_serving_load_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark V4.1 serving-load staircase (shared serving-load runner: per concurrency scrape, vllm bench serve, scrape, with rank pressure on srv5-8; the staircase's stop rules over the worst rank)" },
-    id: Present { value: "spark_v41_serving_load" },
-    run: gunbc_ci_spark_v41_serving_load_invoke(),
-    shell: none,
-    env: Present {
-      value: [
-        kv(key: "SPARK_CONVERGE_TARGET", value: yaml_string(s: "${{ github.event.inputs.target }}")),
-        kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
-      ]
-    },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_v41_serving_load_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_serving_step_timeout_minutes }
-  }
-}
-
-// THE PUBLISHED V4.1 CHECKPOINT ON ONE GROUP A SPARK (gunbc.spark.v41_checkpoint_materialize): every
-// admitted file fetched at the pinned revision, digested against its manifest row before it is
-// published, then the storage-backed Engram spans read from the verified shards. Its domain is Group
-// A's arm (fleet_converge_mode_mutation_domain), so it queues behind D0 and the pair apply and one
-// Group A host is written at a time; a transfer outlives the step, and a rerun reattaches.
-fn fleet_converge_spark_v41_checkpoint_materialize_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark V4.1 checkpoint materialize (fetch the admitted published files onto the selected Group A Spark, verify each sha256 before publishing, read the storage-backed Engram spans)" },
-    id: Present { value: "spark_v41_checkpoint_materialize" },
-    run: gunbc_ci_spark_v41_checkpoint_materialize_invoke(),
-    shell: none,
-    env: Present {
-      value: [
-        kv(key: "SPARK_CONVERGE_TARGET", value: yaml_string(s: "${{ github.event.inputs.target }}")),
-        kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
-      ]
-    },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_v41_checkpoint_materialize_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_serving_step_timeout_minutes }
-  }
-}
-
-// ITS SECOND STEP READS THE .engram. SELECTION OVER THE PINNED INDEX IN ITS OWN PROCESS, so a parse that
-// is stopped for memory cannot take the fetch's per-file receipts with it. It runs after the fetch whether
-// or not the fetch finished (`always()` under the mode's own condition), because it verifies the index
-// against its manifest row itself and reads nothing the fetch did not already vouch for; a fetch still in
-// flight does not stop an index that is already present from being read.
-fn fleet_converge_spark_v41_index_selection_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark V4.1 index selection (verify the pinned index on the selected Group A Spark and read its .engram. selection with parse_json_document, in its own process)" },
-    id: Present { value: "spark_v41_index_selection" },
-    run: gunbc_ci_spark_v41_index_selection_invoke(),
-    shell: none,
-    env: Present {
-      value: [
-        kv(key: "SPARK_CONVERGE_TARGET", value: yaml_string(s: "${{ github.event.inputs.target }}")),
-        kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
-      ]
-    },
-    working_directory: none,
-    if_condition: Present { value: join(["always() && ", fleet_converge_spark_v41_checkpoint_materialize_step_if], "") },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_serving_step_timeout_minutes }
-  }
-}
-
-// THE EIGHT ENGRAM ROW STORES ON ONE MATERIALIZED GROUP A SPARK (gunbc.spark.v41_row_store_encode_run):
-// the admitted host program run over the verified shards per v41_store_encode_plan, then sha256sum of
-// every store. A present store is complete and is only re-digested, so a rerun after a step timeout
-// finishes the rest; Group A's arm domain serializes it with the materialize and the pair apply.
-fn fleet_converge_spark_v41_row_store_encode_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark V4.1 row store encode (encode the eight Engram row stores from the verified shards on the selected Group A Spark and read each store's sha256)" },
-    id: Present { value: "spark_v41_row_store_encode" },
-    run: gunbc_ci_spark_v41_row_store_encode_invoke(),
-    shell: none,
-    env: Present {
-      value: [
-        kv(key: "SPARK_CONVERGE_TARGET", value: yaml_string(s: "${{ github.event.inputs.target }}")),
-        kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
-      ]
-    },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_v41_row_store_encode_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_serving_step_timeout_minutes }
-  }
-}
-
-// THE BOUNDARY-STRATIFIED READBACK OF THOSE STORES (gunbc.spark.v41_row_store_readback_run): od(1) over
-// every sample v41_readback_samples owes -- each store's magic, first and last record, and the source rows
-// at the same global rows -- on the host that holds them. It writes nothing on the host; Group A's arm
-// domain keeps it from reading a store the encode is still writing.
-// THE DESIGN-B ENGRAM DIFFERENTIAL (gunbc.spark.v41_engram_differential_run): upstream's lookup kernel
-// against the file-backed lookup over sampled real rows of every row store, byte for byte, on the
-// Group A Spark that holds the stores, after an occupancy read; read-only against stores and serving.
-fn fleet_converge_spark_v41_engram_differential_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark V4.1 Engram differential (upstream lookup kernel vs the design-B file-backed lookup over sampled real rows of every row store, byte for byte, on the selected Group A Spark, read-only)" },
-    id: Present { value: "spark_v41_engram_differential" },
-    run: gunbc_ci_spark_v41_engram_differential_invoke(),
-    shell: none,
-    env: Present {
-      value: [
-        kv(key: "SPARK_CONVERGE_TARGET", value: yaml_string(s: "${{ github.event.inputs.target }}")),
-        kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
-      ]
-    },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_v41_engram_differential_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_serving_step_timeout_minutes }
-  }
-}
-
-fn fleet_converge_spark_v41_row_store_readback_step() -> Step {
-  RunStep {
-    name: Present { value: "Spark V4.1 row store readback (read the eight Engram row stores' header, first and last record and the published source rows at every rank seam on the selected Group A Spark, writing nothing)" },
-    id: Present { value: "spark_v41_row_store_readback" },
-    run: gunbc_ci_spark_v41_row_store_readback_invoke(),
-    shell: none,
-    env: Present {
-      value: [
-        kv(key: "SPARK_CONVERGE_TARGET", value: yaml_string(s: "${{ github.event.inputs.target }}")),
-        kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
-      ]
-    },
-    working_directory: none,
-    if_condition: Present { value: fleet_converge_spark_v41_row_store_readback_step_if },
-    continue_on_error: none,
-    timeout_minutes: Present { value: gunbc_ci_spark_serving_step_timeout_minutes }
-  }
-}
-
 // EVERY JOB CHECKS OUT R, THE REVISION THE OPERATOR NAMED, NOT WHATEVER main IS WHEN THE RUNNER
 // FINALLY PICKS THE JOB UP. The run-revision guard in gunbc.fleet_converge_plan_cli compares the
 // checked-out tree to RLM_EXPECTED_REVISION and refuses on mismatch; with a plain branch checkout
@@ -4175,19 +3752,10 @@ fn fleet_converge_dispatch_mode_is(mode: FleetConvergeWorkflowMode) -> Expressio
 
 data fleet_converge_event_sha: Expression = ContextAccess { context: Github, path: ["sha"] }
 
-data fleet_converge_checkout_ref: Expression = LogicalOr {
-  left: LogicalOr {
-    left: LogicalAnd {
-      left: LogicalOr {
-        left: LogicalOr { left: fleet_converge_dispatch_mode_is(mode: MtCollins1Boot), right: fleet_converge_dispatch_mode_is(mode: GcpIamConverge) },
-        right: LogicalOr { left: fleet_converge_dispatch_mode_is(mode: NamecheapObserve), right: fleet_converge_dispatch_mode_is(mode: PrinterWorkflow) },
-      },
-      right: fleet_converge_event_sha,
-    },
-    right: ContextAccess { context: Github, path: ["event", "inputs", "expected_revision"] },
-  },
-  right: fleet_converge_event_sha,
-}
+// A DISPATCH CHECKS OUT THE EVENT SHA. expected_revision is a cross-check (admit_optional_expected_revision),
+// not a second revision authority and not a checkout selector (operator 2026-10-10). Apply's R is the
+// admitted plan receipt, not this expression.
+data fleet_converge_checkout_ref: Expression = fleet_converge_event_sha
 
 data fleet_converge_checkout_ref_expr: String = interpolate(expression: fleet_converge_checkout_ref)
 
@@ -4238,18 +3806,15 @@ fn fleet_converge_consumer_prelude_steps() -> List<Step> {
 
 // ── THE MT. COLLINS BOOT JOB (operator ruling 2026-09-23) ───────────────────────────────────
 // The boot is its own job because its identity is: OIDC tokens are minted per job, and the boot
-// federates through a dedicated pool whose provider pins this workflow file at main, a
-// workflow_dispatch on main, and the job's `environment` (gunbc.auth.managed_host_boot_federation).
+// federates through a dedicated pool whose provider pins this workflow file at reviewed main, a
+// workflow_dispatch, and the job's `environment` (gunbc.auth.managed_host_boot_federation).
 // A step inside the shared converge job could only present the shared job's token, which the
 // repo-wide provider admits for every job in the repository. It consumes the fleet key because the
 // census medium readback on srv2 runs over fleet ssh; the dedicated account holds a pinned cell for
 // that version and for the BMC credential, and nothing else.
-data fleet_converge_shared_job_if: String = join([
-  "github.event.inputs.mode != '", fleet_converge_workflow_mode_wire(mode: MtCollins1Boot), "'",
-  " && github.event.inputs.mode != '", fleet_converge_workflow_mode_wire(mode: GcpIamConverge), "'",
-  " && github.event.inputs.mode != '", fleet_converge_workflow_mode_wire(mode: NamecheapObserve), "'",
-  " && github.event.inputs.mode != '", fleet_converge_workflow_mode_wire(mode: PrinterWorkflow), "'",
-], "")
+// Job selection consumes the same mode-to-job authority as the dedicated builders. A second
+// hand-maintained exclusion list accidentally ran this credentialed job for controller install.
+data fleet_converge_shared_job_if: String = fleet_converge_any_mode_step_if(modes: filter(fleet_converge_workflow_modes, mode => fleet_converge_mode_job_id(mode: mode) == fleet_converge_shared_job_id))
 
 // THE MODE IS MT. COLLINS UNIT 1'S BOOT (its recut is cut 7 of docs/plans/managed-host-untangle.md),
 // so the job reads that pair's ADMITTED federation and nothing else. An unprovisioned standing
@@ -4263,6 +3828,8 @@ data fleet_converge_boot_federation_unprovisioned_refusal: String = "REFUSED gun
 fn fleet_converge_mtcollins1_boot_provider_resource() -> String {
   match fleet_converge_mtcollins1_boot_federation {
     BootFederationProvisioned { federation: f } => boot_federation_provider_resource(f: f)
+    BootFederationProvisionedUnderDeclaredDrop { federation: f, drop: _, standing_subject: _, current_subject: _ } =>
+      boot_federation_provider_resource(f: f)
     BootFederationUnprovisioned { host: _, cause: _ } => fleet_converge_boot_federation_unprovisioned_refusal
   }
 }
@@ -4270,6 +3837,8 @@ fn fleet_converge_mtcollins1_boot_provider_resource() -> String {
 fn fleet_converge_mtcollins1_boot_service_account() -> String {
   match fleet_converge_mtcollins1_boot_federation {
     BootFederationProvisioned { federation: f } => f.names.service_account as String
+    BootFederationProvisionedUnderDeclaredDrop { federation: f, drop: _, standing_subject: _, current_subject: _ } =>
+      f.names.service_account as String
     BootFederationUnprovisioned { host: _, cause: _ } => fleet_converge_boot_federation_unprovisioned_refusal
   }
 }
@@ -4277,6 +3846,8 @@ fn fleet_converge_mtcollins1_boot_service_account() -> String {
 fn fleet_converge_mtcollins1_boot_environment() -> String {
   match fleet_converge_mtcollins1_boot_federation {
     BootFederationProvisioned { federation: f } => f.names.environment as String
+    BootFederationProvisionedUnderDeclaredDrop { federation: f, drop: _, standing_subject: _, current_subject: _ } =>
+      f.names.environment as String
     BootFederationUnprovisioned { host: _, cause: _ } => fleet_converge_boot_federation_unprovisioned_refusal
   }
 }
@@ -4284,6 +3855,7 @@ fn fleet_converge_mtcollins1_boot_environment() -> String {
 fn fleet_converge_boot_federation_admitted() -> Bool {
   match fleet_converge_mtcollins1_boot_federation {
     BootFederationProvisioned { federation: _ } => true
+    BootFederationProvisionedUnderDeclaredDrop { federation: _, drop: _, standing_subject: _, current_subject: _ } => true
     BootFederationUnprovisioned { host: _, cause: _ } => false
   }
 }
@@ -4425,19 +3997,15 @@ fn fleet_converge_credential_prelude_steps() -> List<Step> {
   [
     ci_release_bins_download_step(),
     ci_release_bins_unpack_verify_step_for(pair_modes: fleet_converge_compiler_pair_mode_wires()),
-    fleet_converge_pair_serving_d0_admit_step(),
-    ci_fleet_wif_auth_step(),
+    ci_fleet_wif_auth_step_when(if_condition: Present { value: concat(concat(fleet_converge_fleet_identity_step_if, " && !("), concat(fleet_converge_any_mode_step_if(modes: [WorkspaceImageBuild, WorkspaceAllocationPlan]), ")")) }),
+    fleet_converge_branch_run_grant_await_step(),
+    fleet_converge_hetzner_cloud_control_auth_step(),
     ci_fleet_key_agent_step_when(if_condition: Present { value: fleet_converge_fleet_ssh_key_step_if }),
   ]
 }
 
 fn fleet_converge_job() -> Job {
-  Job {
-    id: fleet_converge_shared_job_id as String,
-    name: none,
-    runner: fleet_converge_host_pinned_runner_spec(),
-    environment: none,
-    steps: concat(
+  fleet_converge_job_with_steps(steps: concat(
       concat(
         fleet_converge_consumer_prelude_steps(),
         fleet_converge_credential_prelude_steps()
@@ -4447,6 +4015,9 @@ fn fleet_converge_job() -> Job {
         fleet_converge_launch_environment_plan_step(),
         fleet_converge_allocation_store_plan_step(),
         fleet_converge_workspace_commissioning_plan_step(),
+        fleet_converge_workspace_operation_step(mode: WorkspaceAllocationPlan, run: gunbc_ci_workspace_allocation_plan_invoke()),
+        fleet_converge_workspace_operation_step(mode: WorkspaceImageBuild, run: gunbc_ci_workspace_image_build_invoke()),
+        fleet_converge_workspace_image_upload_step(),
         fleet_converge_plan_upload_step(),
         fleet_converge_plan_download_step(),
         fleet_converge_apply_step(),
@@ -4462,14 +4033,11 @@ fn fleet_converge_job() -> Job {
         fleet_converge_app_key_version_verify_receipt_upload_step(),
         fleet_converge_mtcollins1_fan_observe_step(),
         fleet_converge_mtcollins1_fan_observe_receipt_upload_step(),
-        fleet_converge_mtcollins1_ui_bundle_observe_step(),
-        fleet_converge_mtcollins1_ui_bundle_observe_upload_step(),
         fleet_converge_mtcollins1_kvm_observer_observe_step(),
         fleet_converge_mtcollins1_kvm_observer_release_step(),
         fleet_converge_mtcollins1_kvm_observer_observe_upload_step(),
         fleet_converge_fabric_writer_identity_observe_step(),
         fleet_converge_fabric_writer_identity_observe_receipt_upload_step(),
-        fleet_converge_pair_serving_d0_step(),
         fleet_converge_mtcollins1_census_image_publish_step(),
         fleet_converge_mtcollins1_census_image_publish_receipt_upload_step(),
         fleet_converge_mtcollins1_census_member_readback_step(),
@@ -4490,6 +4058,8 @@ fn fleet_converge_job() -> Job {
         fleet_converge_r2_workspace_object_read_mint_receipt_upload_step(),
         fleet_converge_r2_workspace_object_write_mint_step(),
         fleet_converge_r2_workspace_object_write_mint_receipt_upload_step(),
+        fleet_converge_hetzner_cloud_server_read_step(),
+        fleet_converge_hetzner_cloud_server_read_receipt_upload_step(),
         fleet_converge_r2_cache_object_read_mint_step(),
         fleet_converge_r2_cache_object_read_mint_receipt_upload_step(),
         fleet_converge_r2_cache_object_write_mint_step(),
@@ -4502,6 +4072,8 @@ fn fleet_converge_job() -> Job {
         fleet_converge_workspace_checkpoint_measure_receipt_upload_step(),
         fleet_converge_workspace_checkpoint_restore_step(),
         fleet_converge_workspace_checkpoint_restore_receipt_upload_step(),
+        fleet_converge_workspace_transcript_rate_observe_step(),
+        fleet_converge_workspace_transcript_rate_observe_receipt_upload_step(),
         fleet_converge_approval_keyring_converge_step(),
         fleet_converge_approval_device_enrolment_code_issue_step(),
         fleet_converge_microvm_runner_group_ensure_step(),
@@ -4528,19 +4100,6 @@ fn fleet_converge_job() -> Job {
         fleet_converge_spark_runtime_image_probe_step(),
         fleet_converge_spark_wireless_link_converge_step(),
         fleet_converge_spark_grants_observe_step(),
-        fleet_converge_spark_v41_checkpoint_materialize_step(),
-        fleet_converge_spark_v41_index_selection_step(),
-        fleet_converge_spark_v41_row_store_encode_step(),
-        fleet_converge_spark_v41_row_store_readback_step(),
-        fleet_converge_spark_v41_engram_differential_step(),
-        fleet_converge_spark_runtime_image_produce_step(),
-        fleet_converge_spark_runtime_image_distribute_step(),
-        fleet_converge_spark_arm_checkpoint_materialize_step(),
-        fleet_converge_spark_arm_group_observe_step(),
-        fleet_converge_spark_arm_group_launch_plan_step(),
-        fleet_converge_spark_arm_group_launch_step(),
-        fleet_converge_spark_arm_group_load_step(),
-        fleet_converge_spark_v41_serving_load_step(),
         fleet_converge_runner_host_file_observe_step(),
         fleet_converge_runner_host_file_converge_step(),
         fleet_converge_runner_password_session_tool_converge_step(),
@@ -4555,7 +4114,17 @@ fn fleet_converge_job() -> Job {
         fleet_converge_site_pxe_edge_receipt_upload_step(),
         ci_fleet_key_agent_cleanup_step(),
       ]
-    ),
+    ))
+}
+
+// The shared job envelope owns selection and credentials independently of its step producers.
+fn fleet_converge_job_with_steps(steps: List<Step>) -> Job {
+  Job {
+    id: fleet_converge_shared_job_id as String,
+    name: none,
+    runner: fleet_converge_host_pinned_runner_spec(),
+    environment: none,
+    steps: steps,
     needs: fleet_converge_job_needs(id: fleet_converge_shared_job_id),
     env: none,
     outputs: none,
@@ -4698,6 +4267,8 @@ fn fleet_converge_mode_job_id(mode: FleetConvergeWorkflowMode) -> NonEmptyStr {
     LaunchEnvironmentPlan => fleet_converge_shared_job_id
     AllocationStorePlan => fleet_converge_shared_job_id
     WorkspaceCommissioningPlan => fleet_converge_shared_job_id
+    WorkspaceAllocationPlan => fleet_converge_shared_job_id
+    WorkspaceImageBuild => fleet_converge_shared_job_id
     FleetApply => fleet_converge_shared_job_id
     OrgActionsObserve => fleet_converge_shared_job_id
     AppControlPlaneObserve => fleet_converge_shared_job_id
@@ -4714,18 +4285,6 @@ fn fleet_converge_mode_job_id(mode: FleetConvergeWorkflowMode) -> NonEmptyStr {
     SparkRuntimeImageProbe => fleet_converge_shared_job_id
     SparkWirelessLinkConverge => fleet_converge_shared_job_id
     SparkGrantsObserve => fleet_converge_shared_job_id
-    SparkV41CheckpointMaterialize => fleet_converge_shared_job_id
-    SparkV41RowStoreEncode => fleet_converge_shared_job_id
-    SparkV41RowStoreReadback => fleet_converge_shared_job_id
-    SparkV41EngramDifferential => fleet_converge_shared_job_id
-    SparkRuntimeImageProduce => fleet_converge_shared_job_id
-    SparkRuntimeImageDistribute => fleet_converge_shared_job_id
-    SparkArmCheckpointMaterialize => fleet_converge_shared_job_id
-    SparkArmGroupObserve => fleet_converge_shared_job_id
-    SparkArmGroupLaunchPlan => fleet_converge_shared_job_id
-    SparkArmGroupLoad => fleet_converge_shared_job_id
-    SparkArmGroupLaunch => fleet_converge_shared_job_id
-    SparkV41ServingLoad => fleet_converge_shared_job_id
     DashboardDeploy => "dashboard-deploy" as NonEmptyStr
     ApprovalBrokerDarkInstall => "approval-broker-dark-install" as NonEmptyStr
     MicrovmControllerInstall => "microvm-controller-install" as NonEmptyStr
@@ -4746,7 +4305,6 @@ fn fleet_converge_mode_job_id(mode: FleetConvergeWorkflowMode) -> NonEmptyStr {
     ApprovalDeviceEnrolmentCodeIssue => fleet_converge_shared_job_id
     MtCollins1Boot => "mtcollins1-boot" as NonEmptyStr
     MtCollins1FanObserve => fleet_converge_shared_job_id
-    MtCollins1UiBundleObserve => fleet_converge_shared_job_id
     MtCollins1KvmObserverObserve => fleet_converge_shared_job_id
     MtCollins1CensusImagePublish => fleet_converge_shared_job_id
     MtCollins1CensusMemberReadback => fleet_converge_shared_job_id
@@ -4759,16 +4317,19 @@ fn fleet_converge_mode_job_id(mode: FleetConvergeWorkflowMode) -> NonEmptyStr {
     R2WorkspaceObjectReadMint => fleet_converge_shared_job_id
     R2WorkspaceObjectWriteMint => fleet_converge_shared_job_id
     R2CacheObjectReadMint => fleet_converge_shared_job_id
+    HetznerCloudServerRead => fleet_converge_shared_job_id
+    BranchRunGrant => "gcp-iam-converge" as NonEmptyStr
     R2CacheObjectWriteMint => fleet_converge_shared_job_id
     R2ConditionalPutRaceProbe => fleet_converge_shared_job_id
     WorkspaceSourcePack => fleet_converge_shared_job_id
     WorkspaceCheckpointMeasure => fleet_converge_shared_job_id
     WorkspaceCheckpointRestore => fleet_converge_shared_job_id
+    WorkspaceTranscriptRateObserve => fleet_converge_shared_job_id
     FabricWriterIdentityObserve => fleet_converge_shared_job_id
-    PairServingD0 => fleet_converge_shared_job_id
     MicrovmRunnerGroupEnsure => fleet_converge_shared_job_id
     GcpIamConverge => "gcp-iam-converge" as NonEmptyStr
     NamecheapObserve => "namecheap-observe" as NonEmptyStr
+    ArrivalConverge => "arrival-converge" as NonEmptyStr
     PrinterWorkflow => "printer" as NonEmptyStr
   }
 }
@@ -4816,6 +4377,7 @@ data fleet_converge_job_edges: List<FleetConvergeJobEdge> = [
   FleetConvergeJobEdge { id: fleet_converge_mode_job_id(mode: PrinterWorkflow), needs: [fleet_converge_release_bins_job_id as String] },
   FleetConvergeJobEdge { id: fleet_converge_mode_job_id(mode: NamecheapObserve), needs: [fleet_converge_release_bins_job_id as String] },
   FleetConvergeJobEdge { id: fleet_converge_mode_job_id(mode: GcpIamConverge), needs: [fleet_converge_release_bins_job_id as String] },
+  FleetConvergeJobEdge { id: fleet_converge_mode_job_id(mode: ArrivalConverge), needs: [fleet_converge_release_bins_job_id as String] },
 ]
 
 // A BUILDER ASKS THE ROSTER FOR ITS OWN EDGE BY ID AND THE LOOKUP REFUSES RATHER THAN INVENTS. An
@@ -4853,10 +4415,79 @@ fn fleet_converge_jobs() -> List<Job> {
     fleet_converge_rlm_launch_deployment_receipt_job(),
     fleet_converge_gcp_iam_converge_job(),
     fleet_converge_namecheap_observe_job(),
+    fleet_converge_arrival_converge_job(),
     fleet_converge_printer_job(),
   ]
 }
 
+// ── RUN-SCOPED ACCOUNTS (gunbc.auth.branch_dispatch_federation) ─────────────────────────────
+// A run-scoped mode first asks main for a grant naming this run and waits for the operator's tap
+// (gunbc.auth.branch_run_grant_await), then federates through the branch-dispatch pool as the
+// account the grant named. Without the grant the auth step's exchange is refused by IAM itself.
+fn fleet_converge_branch_run_grant_await_step() -> Step {
+  RunStep {
+    name: Present { value: "Run-scoped grant: wait for the grant run main's broker dispatched for this run attempt" },
+    id: Present { value: "branch_run_grant_await" },
+    run: gunbc_ci_branch_run_grant_await_invoke(),
+    shell: none,
+    env: Present { value: [
+      kv(key: "GITHUB_TOKEN", value: yaml_string(s: "${{ github.token }}")),
+    ] },
+    working_directory: none,
+    if_condition: Present { value: fleet_converge_run_scoped_step_if },
+    continue_on_error: none,
+    timeout_minutes: Present { value: 50 }
+  }
+}
+
+fn fleet_converge_hetzner_cloud_control_auth_step() -> Step {
+  ci_wif_auth_step_with_condition(
+    name: "WIF auth (OIDC -> branch-dispatch pool -> hetzner-cloud-control SA; only after this run's grant)",
+    id: "wif_auth_hetzner_cloud_control",
+    provider_resource: branch_dispatch_provider_resource(),
+    service_account: hetzner_cloud_control_service_account as String,
+    if_condition: Present { value: fleet_converge_run_scoped_step_if },
+  )
+}
+
+data fleet_converge_hetzner_cloud_server_read_step_if: String = fleet_converge_mode_step_if(mode: HetznerCloudServerRead)
+
+// THE TOKEN'S FIRST USE, READ-ONLY: every acquired Hetzner Cloud server read through the project's
+// token, joined to its acquisition row. Its receipt carries ids, names and statuses -- no secret.
+fn fleet_converge_hetzner_cloud_server_read_step() -> Step {
+  RunStep {
+    name: Present { value: "Hetzner Cloud acquired-server read (GET /v1/servers/\{id\}; changes nothing)" },
+    id: Present { value: "hetzner_cloud_server_read" },
+    run: gunbc_ci_hetzner_cloud_server_read_invoke(),
+    shell: none,
+    env: Present { value: [
+      kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth_hetzner_cloud_control.outputs.access_token }}")),
+    ] },
+    working_directory: none,
+    if_condition: Present { value: fleet_converge_hetzner_cloud_server_read_step_if },
+    continue_on_error: none,
+    timeout_minutes: Present { value: gunbc_ci_aux_step_timeout_minutes }
+  }
+}
+
+fn fleet_converge_hetzner_cloud_server_read_receipt_upload_step() -> Step {
+  UsesStep {
+    name: Present { value: "Upload Hetzner Cloud server read receipt (ids, names, statuses; no secret)" },
+    id: Present { value: "hetzner_cloud_server_read_receipt_upload" },
+    uses: upload_artifact_action,
+    with: Present { value: [
+      kv(key: "name", value: yaml_string(s: "hetzner-cloud-server-read-receipt")),
+      kv(key: "path", value: yaml_string(s: hetzner_cloud_server_read_receipt_path)),
+      kv(key: "if-no-files-found", value: yaml_string(s: "warn")),
+      kv(key: "retention-days", value: yaml_int(n: 30)),
+    ] },
+    env: none,
+    if_condition: Present { value: join(["always() && ", fleet_converge_hetzner_cloud_server_read_step_if], "") },
+    continue_on_error: none,
+    timeout_minutes: Present { value: gunbc_ci_artifact_transfer_step_timeout_minutes }
+  }
+}
+
 // ── THE GCP IAM CONVERGE JOB (operator requirement 2026-09-24; decision B 2026-09-25) ────────
 // Its own job for the boot's reason: OIDC tokens are minted per job, and this one federates through
 // its own pool pinned by the `environment` claim (gunbc.auth.gcp_iam_converge_federation). It runs on
@@ -4871,7 +4502,57 @@ data fleet_converge_gcp_iam_converge_step_if: String = fleet_converge_mode_step_
 // modeled filesystem on its one approved arm (gunbc.auth.gcp_iam_converge_run mark_approved). The
 // expression is a GitHub Actions expression and is rendered by the same concatenation every
 // fleet_converge_mode_step_if uses; it carries no shell.
-data fleet_converge_gcp_iam_approved_if: String = join([fleet_converge_gcp_iam_converge_step_if, " && steps.gcp_iam_request.outputs.", gcp_iam_converge_approved_output, " == 'true'"], "")
+data fleet_converge_gcp_iam_converge_approved_if: String = join([fleet_converge_gcp_iam_converge_step_if, " && steps.gcp_iam_request.outputs.", gcp_iam_converge_approved_output, " == 'true'"], "")
+
+// THE SAME JOB GRANTS ONE BRANCH RUN A RUN-SCOPED ACCOUNT (gunbc.auth.branch_run_grant): it is the
+// only job that may become iam-converge, and the grant is one approved policy add. Its request and
+// apply are their own steps; the iam-converge federation admits either mode's approved output.
+data fleet_converge_branch_run_grant_step_if: String = fleet_converge_mode_step_if(mode: BranchRunGrant)
+
+data fleet_converge_branch_run_grant_approved_if: String = join([fleet_converge_branch_run_grant_step_if, " && steps.branch_run_grant_request.outputs.", branch_run_grant_approved_output, " == 'true'"], "")
+
+data fleet_converge_gcp_iam_approved_if: String = join(["(", fleet_converge_gcp_iam_converge_approved_if, ") || (", fleet_converge_branch_run_grant_approved_if, ")"], "")
+
+data fleet_converge_gcp_iam_job_if: String = fleet_converge_any_mode_step_if(modes: [GcpIamConverge, BranchRunGrant])
+
+fn fleet_converge_branch_run_grant_env(with_converge_token: Bool) -> List<YamlKeyValue> {
+  concat(
+    [
+      kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
+      kv(key: "GITHUB_TOKEN", value: yaml_string(s: "${{ github.token }}")),
+      kv(key: branch_run_key_variable as String, value: yaml_string(s: "${{ github.event.inputs.transaction_nonce }}")),
+    ],
+    if with_converge_token { [kv(key: iam_converge_token_env as String, value: yaml_string(s: "${{ steps.wif_auth_iam_converge.outputs.access_token }}"))] } else { [] },
+  )
+}
+
+fn fleet_converge_branch_run_grant_request_step() -> Step {
+  RunStep {
+    name: Present { value: "Branch run grant: read the run from GitHub and the account's policy as iam-observe, file one request, wait for the operator" },
+    id: Present { value: "branch_run_grant_request" },
+    run: gunbc_ci_branch_run_grant_request_invoke(),
+    shell: none,
+    env: Present { value: fleet_converge_branch_run_grant_env(with_converge_token: false) },
+    working_directory: none,
+    if_condition: Present { value: fleet_converge_branch_run_grant_step_if },
+    continue_on_error: none,
+    timeout_minutes: Present { value: gcp_iam_converge_step_timeout_minutes() }
+  }
+}
+
+fn fleet_converge_branch_run_grant_apply_step() -> Step {
+  RunStep {
+    name: Present { value: "Branch run grant: re-derive, re-admit the approval, add exactly the approved run cell as iam-converge, read back as iam-observe" },
+    id: Present { value: "branch_run_grant_apply" },
+    run: gunbc_ci_branch_run_grant_apply_invoke(),
+    shell: none,
+    env: Present { value: fleet_converge_branch_run_grant_env(with_converge_token: true) },
+    working_directory: none,
+    if_condition: Present { value: fleet_converge_branch_run_grant_approved_if },
+    continue_on_error: none,
+    timeout_minutes: Present { value: gunbc_ci_aux_step_timeout_minutes + 10 }
+  }
+}
 
 fn fleet_converge_gcp_iam_request_step() -> Step {
   RunStep {
@@ -4923,7 +4604,7 @@ fn fleet_converge_gcp_iam_apply_step() -> Step {
       kv(key: iam_converge_token_env as String, value: yaml_string(s: "${{ steps.wif_auth_iam_converge.outputs.access_token }}")),
     ] },
     working_directory: none,
-    if_condition: Present { value: fleet_converge_gcp_iam_approved_if },
+    if_condition: Present { value: fleet_converge_gcp_iam_converge_approved_if },
     continue_on_error: none,
     timeout_minutes: Present { value: gunbc_ci_aux_step_timeout_minutes + 10 }
   }
@@ -4945,13 +4626,15 @@ fn fleet_converge_gcp_iam_converge_job() -> Job {
         service_account: iam_observe_service_account as String,
       ),
       fleet_converge_gcp_iam_request_step(),
+      fleet_converge_branch_run_grant_request_step(),
       fleet_converge_gcp_iam_actuate_auth_step(),
       fleet_converge_gcp_iam_apply_step(),
+      fleet_converge_branch_run_grant_apply_step(),
     ],
     needs: fleet_converge_job_needs(id: fleet_converge_mode_job_id(mode: GcpIamConverge)),
     env: none,
     outputs: none,
-    if_condition: Present { value: fleet_converge_gcp_iam_converge_step_if },
+    if_condition: Present { value: fleet_converge_gcp_iam_job_if },
     timeout_minutes: Present { value: gcp_iam_converge_step_timeout_minutes() + 20 },
     continue_on_error: none,
     concurrency: Present {
@@ -4975,7 +4658,17 @@ fn fleet_converge_gcp_iam_converge_job() -> Job {
 
 // THE DISPATCH INPUTS, AS THEIR OWN ROW: the workflow consumes them below, and a witness over
 // what the operator can name reads this list rather than building every job to reach it.
-data fleet_converge_dispatch_inputs: List<DispatchInput> = [
+// GITHUB'S LIMIT IS workflow_dispatch_max_inputs (25). A hand-edited fleet-converge.yml that
+// drifted above this list (30 names, including undeclared runtime_image / checkpoint / arm /
+// staircase_step / incumbent / d0_consent / printer_*) made GitHub refuse the file on push
+// (zero-job runs; 422 at 28 inputs, gunbc.recurring_failure_mode workflow_dispatch_input_limit_unchecked).
+// The repair is regeneration of FleetConvergeYamlArtifact from this list via expected_fleet_converge_yml,
+// which refuses emission when count exceeds the limit. The mode description being long was a
+// misattribution: a 25-input file with the long description dispatched. Per-mode contracts stay
+// on this module; keep the input description short anyway.
+data fleet_converge_dispatch_input_rows: List<DispatchInput> = [
+  DispatchInput { name: "workspace_image_run_id", description: Present { value: "Image build run to download for controller install; installed bytes must match the reviewed image pin" }, required: false, default: none, type: InputString },
+
   DispatchInput {
     name: "host",
     description: Present { value: "Executor fleet host (runner pinned here; plan mode observes this host)" },
@@ -4983,9 +4676,16 @@ data fleet_converge_dispatch_inputs: List<DispatchInput> = [
     default: none,
     type: InputChoice { options: fleet_converge_enrolled_host_options },
   },
+  DispatchInput {
+    name: "arrival_subject",
+    description: Present { value: "arrival_converge only: the arrival-population unit (not executor host, not managed_host). Options are gunbc.machine_intake_arrival_subject arrival_converge_subject_options. Names signed off msg_f03558d1" },
+    required: false,
+    default: none,
+    type: InputChoice { options: arrival_converge_subject_options() },
+  },
   DispatchInput {
     name: "mode",
-    description: Present { value: "plan shows membership hunks; apply executes a prior plan artifact; org_actions_observe validates the org credential and refuses on runner-group drift; org_runner_roster_observe reads the organization's self-hosted runner registrations to exhaustion under the same token and refuses unless the roster is complete; app_control_plane_observe reads the gunbai-ci App registration and webhook config with a short-lived App JWT and refuses on hook-config drift; app_key_version_verify reads the gunbai-ci App private key at the EXACT Secret Manager version named by app_key_version, mints an installation token with it, and refuses unless GitHub accepts it and the key's rotation deadline has not passed -- no add, disable or destroy; runner_browser_toolchain_converge installs the declared Playwright/Chromium toolchain (apt host libraries as the administrator, digest-pinned node, Playwright and Chromium archives into the job user's root) on the selected host, which must be in the pool that runs the floor job, and refuses unless every digest, version and host library reads back and headless Chromium renders a local page; microvm_host_converge installs the cited Firecracker release on the selected host and reads the kvm grant back, refusing by name when the grant has not landed (the grant itself is applied by the full-host apply spine); microvm_network_apply stages the slot and host network files the model renders at the named expected_revision as root:root 0600 in a root-only directory over the fleet SSH edge as the host's ADMINISTRATOR, installs them with the modeled operations, reloads networkd, systemd-sysctl and the nft loader unit, and reads the ruleset back -- the job user is granted none of it, because install plus systemctl over content that principal can write is arbitrary root for any pull request; guest_image_observe reports the micro-VM base artifacts and their measured digests on the selected host and builds nothing; guest_image_converge builds the runner guest image there; microvm_boot_probe boots that image and reads its serial console; spark_grants and spark_bootstrap prepare the selected Spark; spark_serving_apply applies the promoted fabric groups' pair vLLM units over the password session, workers before heads; spark_native_serving_apply relaunches group B's native four-rank arm as ONE BOUNDED TRANSACTION -- an all-host preflight that mutates nothing and refuses on any unresolved artifact from an earlier run, the incumbent UNIT preserved (plus a diagnostic inspect of the incumbent container -- the container itself cannot outlive its unit, because these run --rm in the foreground under systemd), the head applied BEFORE the workers so every rank joins the head's new rendezvous store, then a readback of the COMPLETE realization through each container's own inspect -- every field the create spec states, the effective --node-rank off that container's argv, and NCCL's typed transport verdict on that incarnation -- plus the head's front door answering with this arm's served model, and then commit or a rollback of the whole arm -- and it is a separate mode because it reloads a 328 GB arm and nobody should reach it by asking for the pair units; spark_runtime_image_probe pulls the pinned runtime image on the selected Spark and reads its capabilities from inside its own digest, changing nothing; spark_wireless_link_converge reads the selected Spark's Wi-Fi power save (runtime via iw, persisted via the NetworkManager profile), link and kernel disconnect count, sets whichever realization differs from the declared intent, and refuses unless the readback decides Noop; spark_grants_observe reads every procured Spark's sudo grant listing as gunbc-automation and the bootstrap principal, and its sudoers drop-in shape, and writes nothing; spark_v41_checkpoint_materialize fetches the admitted published DeepSeek V4.1 files onto the selected Group A Spark (about 510 GB; spark_v41_row_store_encode encodes the eight Engram row stores from the verified shards on the selected Group A Spark and reads each store's sha256; spark_v41_row_store_readback reads those stores back at their header, first and last record and every rank seam, with the published source rows at the same rows, and writes nothing; spark_v41_engram_differential compares upstream's Engram lookup kernel with the design-B file-backed lookup over sampled real rows of every row store, byte for byte, and writes nothing; it states the requirement and refuses before fetching when the disk cannot hold it), publishes each only after its sha256 matches the manifest, leaves a present file with the right digest alone and refuses one with the wrong digest, and reads the storage-backed Engram spans from the verified shards; a transfer runs detached and a rerun reattaches; spark_v41_runtime_image_build PRODUCES the DeepSeek V4.1 image on the selected Spark -- it verifies the candidate's three FlashInfer wheels against the digests the candidate keys, converges the patched source tree, builds from it, reads the produced configuration digest back from inside the image through the probe route, and admits that digest against the candidate's own recipe, refusing a digest that does not recompute from it -- and it is a separate mode from the probe because it occupies one host for hours where the probe occupies it for minutes; spark_v41_runtime_image_distribute moves that produced image, named by the configuration digest its production receipt read back, from the host that receipt names to the selected Group A Spark -- save into its fabric blob root, pulled by the target straight over the fabric rail, load -- after stating its size against every filesystem a copy lands on, leaves a target already holding the digest untouched, refuses a target holding a different image under the tag, and refuses unless the target's image inspect Id reads back as that digest; spark_v41_group_a_launch reads the production image back under its tag on every Group A host, reads its registry inside its digest and every host's occupancy, and only when Group A is suspended for this candidate with every host held and vacant stages the Engram manifest and applies the V4.1 four-rank arm as one transaction at the capacity measurement's shape -- the target names only the session host; spark_v41_serving_load runs the shared serving-load runner against the V4.1 head (target must be srv6): one vllm bench serve step per capacity-measurement concurrency, metrics scraped around each, host pressure read on every Group A rank, and the staircase stop rules applied over the worst rank; it changes no unit and writes only its receipt; host_reset_return drives a rostered reset subject through its controller and measures the return FROM A PEER, and takes reset_observer rather than host because the observer must not be the subject; runner_host_file_observe reads the runner teardown drop-in, the needrestart deferral and the loaded teardown on the selected host as its administrator and writes nothing; runner_host_file_converge writes whichever of those two files differs, reloads systemd only if the drop-in changed, and refuses unless the manager then reports the declared teardown; microvm_controller_install writes the microVM slot controller's root-owned release locus (gunbc + sources + Firecracker + jailer) and the gunbc-microvm-slot@ template unit and the gunbc-microvm-slot-reserve broker unit on srv1 and starts neither; microvm_slot_reserve starts that broker unit once on srv1, which reserves the shakedown cell through the fabric broker route from inside the root process (slot, demand and offer derived from the model, never inputs), and uploads that invocation's reservation receipt, failing unless the reservation committed; microvm_slot_start starts the shakedown slot's controller unit once on srv1 (the instance is derived from the model, never an input), waits for it bounded by the unit's own stop timeout, and uploads that invocation's controller receipt; microvm_runner_group_ensure (srv1 only) reads the organization's runner groups and, only when the microvm-shakedown group is absent, files ONE operator approval, creates it restricted to the shakedown workflow on the default branch, and refuses unless the readback holds that restriction; mtcollins1_census_qemu_host_observe reads the selected host's KVM device and, under the job user's census QEMU root, the qemu-system-aarch64 build, its ldd libraries and the AAVMF images against their pins, and writes nothing; mtcollins1_census_qemu_toolchain_converge places that root as the job user (digest-pinned noble .debs unpacked with dpkg-deb -x, no apt, no Recommends) and refuses unless the same observe reads it ready; workspace_source_pack (host=srv1) enumerates the operator workspace as the job user, drops every path the credential exclusion row names and every build output, tars exactly the remainder, reads the archive back and refuses if any member is excluded, and puts it into the workspace bucket under its SHA-256, refusing by name when the runner cannot read a source root; workspace_checkpoint_measure (host=srv3, workspace_source_object = that SHA-256) refuses unless the job user's home is on btrfs, then times a read-only subvolume snapshot, a pinned kopia scan of it, the content-addressed chunk upload and the gated revision commit, and receipts every time with the 10 s / 60 s / 10 GB draft verdicts; workspace_checkpoint_restore (host=srv3) commits a small authored workspace, puts one chunk with no head advance, destroys the directory, restores it from the head closure and requires byte-equality with the uncommitted chunk absent -- both srv3 modes refuse their commit while the R2 head's CAS ground is uncited" },
+    description: Present { value: "Closed choice of fleet-converge modes. Contracts: gunbc.fleet_converge_workflow." },
     required: true,
     default: none,
     type: InputChoice { options: fleet_converge_mode_options },
@@ -4997,41 +4697,6 @@ data fleet_converge_dispatch_inputs: List<DispatchInput> = [
     default: none,
     type: InputChoice { options: fleet_converge_spark_target_options },
   },
-  DispatchInput {
-    name: "runtime_image",
-    description: Present { value: "spark_runtime_image_produce / spark_runtime_image_distribute only: which runtime image to produce on, or distribute to, the target Spark (gunbc.spark.runtime_image_produce_dispatch). A closed choice" },
-    required: false,
-    default: none,
-    type: InputChoice { options: runtime_image_options() },
-  },
-  DispatchInput {
-    name: "checkpoint",
-    description: Present { value: "spark_arm_checkpoint_materialize only: which checkpoint of the arm to acquire on the target Spark (gunbc.spark.arm_group_launch_dispatch). A closed choice" },
-    required: false,
-    default: none,
-    type: InputChoice { options: arm_checkpoint_options() },
-  },
-  DispatchInput {
-    name: "arm",
-    description: Present { value: "spark_arm_group_launch / spark_arm_group_launch_plan only: which arm on which fabric group (gunbc.spark.arm_group_launch_dispatch). A closed choice; each arm's own inputs are its module's" },
-    required: false,
-    default: none,
-    type: InputChoice { options: arm_group_launch_arm_options() },
-  },
-  DispatchInput {
-    name: "staircase_step",
-    description: Present { value: "spark_arm_group_launch(_plan) with arm glm53-group-a only: the staircase step (gunbc.spark.glm53_arm_staircase), checkpoint and sequence ceiling over the cold 8 x 262144 floor. A closed choice; a step outside the staircase has no spelling. Must be empty for v41-group-a" },
-    required: false,
-    default: none,
-    type: InputChoice { options: arm_group_launch_step_options() },
-  },
-  DispatchInput {
-    name: "incumbent",
-    description: Present { value: "spark_arm_group_launch(_plan) with arm glm53-group-a only: the serve this step supersedes, as a DECLARED unit roster (never discovered): previous-step (this arm's own units from the step before) or none. Must be empty for v41-group-a" },
-    required: false,
-    default: none,
-    type: InputChoice { options: arm_group_launch_incumbent_options() },
-  },
   DispatchInput {
     name: "reset_observer",
     description: Present { value: "host_reset_return only: the PEER that observes the reset. The subject is NOT an input -- it is derived from this observer through the modeled pairing, so a job cannot be pointed at the host it is resetting" },
@@ -5046,13 +4711,6 @@ data fleet_converge_dispatch_inputs: List<DispatchInput> = [
     default: none,
     type: InputChoice { options: host_custody_credential_options },
   },
-  DispatchInput {
-    name: "d0_consent",
-    description: Present { value: "pair_serving_d0 only (Cut D, Group A on srv1; expected_revision is required and frozen with the filing): the escalation id the consent is filed under. It names the transaction, and a rerun after a crash MUST name the same id to find its frozen filing and held claim -- a fresh id is a new consent" },
-    required: false,
-    default: none,
-    type: InputString,
-  },
   DispatchInput {
     name: "app_key_version",
     description: Present { value: "app_key_version_verify only: the Secret Manager version NUMBER of ci-github-app-private-key to verify. The alias latest is refused -- it names whatever is newest when it resolves, so a mint through it proves nothing about a specific key" },
@@ -5076,7 +4734,7 @@ data fleet_converge_dispatch_inputs: List<DispatchInput> = [
   },
   DispatchInput {
     name: "expected_revision",
-    description: Present { value: "R — the exact main revision this transaction installs and proves; every run of the transaction must execute at it (RLM_EXPECTED_REVISION). Required for dashboard_deploy and rlm_launch_deployment_receipt — and for microvm_network_apply, whose installed bytes are rendered from it" },
+    description: Present { value: "Optional cross-check of the event sha (RLM_EXPECTED_REVISION). Omit to admit github.sha. Present must match the checkout. Malformed refuses. rlm_launch_deployment_receipt and microvm_network_apply still require a named revision in their own admission; dashboard_deploy does not." },
     required: false,
     default: none,
     type: InputString,
@@ -5110,11 +4768,14 @@ data fleet_converge_dispatch_inputs: List<DispatchInput> = [
     type: InputString,
   },
   DispatchInput { name: "printer", description: Present { value: "Printer identity; required for printer mode" }, required: false, default: none, type: InputChoice { options: map(printer_access_code_loci,p=>p.printer as String) } },
-  DispatchInput { name: "printer_operation", description: Present { value: "Observe credential identity or start one pinned project" }, required: false, default: none, type: InputChoice { options: ["observe", "print"] } },
-  DispatchInput { name: "printer_project_path", description: Present { value: "Absolute path of staged sliced project on srv1" }, required: false, default: none, type: InputString },
-  DispatchInput { name: "printer_project_sha256", description: Present { value: "SHA-256 of the reviewed sliced project" }, required: false, default: none, type: InputString },
-  DispatchInput { name: "printer_credential_version", description: Present { value: "Numeric Secret Manager version returned by observation" }, required: false, default: none, type: InputString },
-  DispatchInput { name: "printer_bed_clear", description: Present { value: "Operator reports this printer bed is clear for this dispatch" }, required: false, default: none, type: InputChoice { options: ["false", "true"] } },
+  DispatchInput { name: "printer_request", description: Present { value: "Printer operation JSON: operation (observe/print), project_path, project_sha256, credential_version, bed_clear (string true/false). The existing printer admission validates every field." }, required: false, default: none, type: InputString },
+  DispatchInput {
+    name: "agent_state_slot",
+    description: Present { value: "workspace_source_pack and workspace_transcript_rate_observe: the Claude auth slot whose agent state is packed, as <slot> in /home/briansrls/.claude@<slot> on srv1; admitted only if that directory exists, refused naming the observed slots otherwise; no default" },
+    required: false,
+    default: none,
+    type: InputString,
+  },
   DispatchInput {
     name: "workspace_source_object",
     description: Present { value: "workspace_checkpoint_measure only: the lower-hex SHA-256 the workspace_source_pack receipt printed as address= (the archive's own digest; the fetched bytes must hash to it)" },
@@ -5124,7 +4785,7 @@ data fleet_converge_dispatch_inputs: List<DispatchInput> = [
   },
   DispatchInput {
     name: "transaction_nonce",
-    description: Present { value: "Operator-minted unique nonce for one RLM transaction; echoed into run-name so each dispatched run is API-selectable by its displayTitle, closing the run-id correlation gap (review 5062738052 B4). mtcollins1_boot only, when attempt_receipt is named: it is the boot attempt's identity, joined to the receipt's attempt and consumed once (gunbc.host_boot_attempt_admission), so a nonce admits one boot; [A-Za-z0-9_-] only" },
+    description: Present { value: "Operator-minted unique nonce for one RLM transaction; echoed into run-name so each dispatched run is API-selectable by its displayTitle, closing the run-id correlation gap (review 5062738052 B4). branch_run_grant: the requesting run's <run id>-<run attempt>, set by the branch-run-grant-broker workflow from GitHub's workflow_run event (gunbc.auth.branch_run_grant_broker). mtcollins1_boot only, when attempt_receipt is named: it is the boot attempt's identity, joined to the receipt's attempt and consumed once (gunbc.host_boot_attempt_admission), so a nonce admits one boot; [A-Za-z0-9_-] only" },
     required: false,
     default: none,
     type: InputString,
@@ -5138,6 +4799,25 @@ data fleet_converge_dispatch_inputs: List<DispatchInput> = [
   },
 ]
 
+// Omit `target` when the Spark administrator roster is empty. Emitting InputChoice { options: [] }
+// is GitHub-invalid and dispatch-dead (review 78408). Other empty choices still refuse below.
+data fleet_converge_dispatch_inputs: List<DispatchInput> = filter(
+  fleet_converge_dispatch_input_rows,
+  i => i.name != "target" || count(fleet_converge_spark_target_options) > 0
+)
+
+fn fleet_converge_empty_choice_input_names() -> List<String> {
+  map(
+    filter(fleet_converge_dispatch_inputs, i => match i.type {
+      InputChoice { options: opts } => count(opts) == 0
+      InputString => false
+      InputBoolean => false
+      InputEnvironment => false
+    }),
+    i => i.name
+  )
+}
+
 data fleet_converge_workflow: Workflow = Workflow {
   name: "fleet-converge",
   run_name: Present { value: "fleet-converge ${{ inputs.mode }} ${{ inputs.host }} nonce=${{ inputs.transaction_nonce }}" },
@@ -5169,6 +4849,20 @@ type FleetConvergeYamlGenerationOutcome
 data fleet_converge_capability_closure_refusal: String = "REFUSED gunbc.fleet_converge_workflow: a step consumes a capability that no preceding step provides (gunbc.workflow_capability_closure). No workflow yaml was emitted. Fix the step roles in ci_prelude_bound_steps_with_checkout / fleet_converge_build_job_annotations, or the order of the steps themselves."
 
 fn expected_fleet_converge_yml() -> FleetConvergeYamlGenerationOutcome {
+  if count(fleet_converge_empty_choice_input_names()) > 0 {
+    FleetConvergeYamlGenerationRefused {
+      reason: join([
+        "fleet-converge InputChoice has no options: ",
+        join(fleet_converge_empty_choice_input_names(), ", "),
+        " (GitHub rejects an empty closed choice; DESIGN §5: refuse, do not emit options: [])",
+      ], "")
+    }
+  } else if count(fleet_converge_dispatch_inputs) > workflow_dispatch_max_inputs {
+    FleetConvergeYamlGenerationRefused { reason: "fleet-converge exceeds GitHub's workflow_dispatch input limit" }
+  } else { fleet_converge_yml_after_input_admission() }
+}
+
+fn fleet_converge_yml_after_input_admission() -> FleetConvergeYamlGenerationOutcome {
   match admit_workflow_action_uses(workflow: fleet_converge_workflow) {
     WorkflowActionUsesRefused { refusals: rs } =>
       FleetConvergeYamlGenerationRefused { reason: workflow_action_uses_refusal_reason(workflow_module: "gunbc.fleet_converge_workflow", refusals: rs) }
@@ -5260,6 +4954,70 @@ fn fleet_converge_yml_after_unit_hold_admission() -> FleetConvergeYamlGeneration
 }
 
 
+fn fleet_converge_arrival_converge_job() -> Job {
+  Job {
+    id: fleet_converge_mode_job_id(mode: ArrivalConverge) as String,
+    name: none,
+    runner: SelfHosted { labels: ["self-hosted", "linux", "arm64", operator_host_srv1 as String] },
+    environment: Present { value: mtjade1_arrival_environment as String },
+    steps: [
+      fleet_converge_event_sha_checkout_step(),
+      ci_release_bins_download_step(),
+      ci_release_bins_unpack_verify_step(),
+      RunStep {
+        name: Present { value: "Arrival admission (credential-free): store host srv1 and a population arrival_subject" },
+        id: Present { value: "arrival_admit" },
+        run: gunbc_ci_arrival_admit_invoke(),
+        shell: none,
+        env: Present { value: [
+          kv(key: fleet_converge_expected_host_env_name, value: yaml_string(s: "${{ github.event.inputs.host }}")),
+          kv(key: fleet_converge_arrival_subject_env_name, value: yaml_string(s: "${{ github.event.inputs.arrival_subject }}")),
+        ] },
+        working_directory: none,
+        if_condition: none,
+        continue_on_error: none,
+        timeout_minutes: Present { value: gunbc_ci_aux_step_timeout_minutes },
+      },
+      ci_wif_auth_step_for(
+        name: "WIF auth (OIDC -> dedicated mtjade1-arrival pool -> mtjade1-arrival SA, access token only)",
+        provider_resource: mtjade1_arrival_provider_resource(),
+        service_account: mtjade1_arrival_service_account as String,
+      ),
+      RunStep {
+        name: Present { value: "arrival_converge under the standing grant and arrival interlock" },
+        id: Present { value: "arrival_converge" },
+        run: gunbc_ci_arrival_converge_invoke(),
+        shell: none,
+        env: Present { value: [
+          kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
+          kv(key: fleet_converge_expected_host_env_name, value: yaml_string(s: "${{ github.event.inputs.host }}")),
+          kv(key: fleet_converge_arrival_subject_env_name, value: yaml_string(s: "${{ github.event.inputs.arrival_subject }}")),
+        ] },
+        working_directory: none,
+        if_condition: none,
+        continue_on_error: none,
+        timeout_minutes: Present { value: gunbc_ci_aux_step_timeout_minutes },
+      },
+    ],
+    needs: fleet_converge_job_needs(id: fleet_converge_mode_job_id(mode: ArrivalConverge)),
+    env: none,
+    outputs: none,
+    if_condition: Present { value: fleet_converge_mode_step_if(mode: ArrivalConverge) },
+    timeout_minutes: Present { value: gunbc_ci_aux_step_timeout_minutes + 20 },
+    continue_on_error: none,
+    concurrency: fleet_converge_exclusive_job_concurrency(group: join([fleet_host_mutation_group_prefix, operator_host_srv1 as String], "")),
+    permissions: Present {
+      value: WorkflowPermissions {
+        contents: Present { value: PermRead },
+        pull_requests: none,
+        issues: none,
+        actions: Present { value: PermRead },
+        id_token: Present { value: PermWrite },
+      }
+    },
+  }
+}
+
 fn fleet_converge_namecheap_observe_job() -> Job {
   Job {
     id: fleet_converge_mode_job_id(mode: NamecheapObserve) as String, name: none,
@@ -5320,11 +5078,11 @@ fn fleet_converge_printer_job() -> Job {
           kv(key:approval_capability_mac_key_path_env as String,value:yaml_string(s:approval_mac_key_path as String)),
           kv(key:approval_store_receipt_mac_key_path_env as String,value:yaml_string(s:approval_store_receipt_mac_key_path as String)),
           kv(key: "PRINTER_TARGET", value: yaml_string(s: "${{ inputs.printer }}")),
-          kv(key: "PRINTER_OPERATION", value: yaml_string(s: "${{ inputs.printer_operation }}")),
-          kv(key: "PRINTER_PROJECT_PATH", value: yaml_string(s: "${{ inputs.printer_project_path }}")),
-          kv(key: "PRINTER_PROJECT_SHA256", value: yaml_string(s: "${{ inputs.printer_project_sha256 }}")),
-          kv(key: "PRINTER_CREDENTIAL_VERSION", value: yaml_string(s: "${{ inputs.printer_credential_version }}")),
-          kv(key: "PRINTER_BED_CLEAR", value: yaml_string(s: "${{ inputs.printer_bed_clear }}")),
+          kv(key: "PRINTER_OPERATION", value: yaml_string(s: "${{ fromJSON(inputs.printer_request || '\{}').operation }}")),
+          kv(key: "PRINTER_PROJECT_PATH", value: yaml_string(s: "${{ fromJSON(inputs.printer_request || '\{}').project_path }}")),
+          kv(key: "PRINTER_PROJECT_SHA256", value: yaml_string(s: "${{ fromJSON(inputs.printer_request || '\{}').project_sha256 }}")),
+          kv(key: "PRINTER_CREDENTIAL_VERSION", value: yaml_string(s: "${{ fromJSON(inputs.printer_request || '\{}').credential_version }}")),
+          kv(key: "PRINTER_BED_CLEAR", value: yaml_string(s: "${{ fromJSON(inputs.printer_request || '\{}').bed_clear }}")),
         ] },
         working_directory: none, if_condition: none, continue_on_error: none,
         timeout_minutes: Present { value: gunbc_ci_gunbc_run_resolve_step_timeout_minutes },
@@ -5337,12 +5095,39 @@ fn fleet_converge_printer_job() -> Job {
     if_condition: Present { value: fleet_converge_mode_step_if(mode: PrinterWorkflow) },
     timeout_minutes: Present { value: gunbc_ci_gunbc_run_resolve_step_timeout_minutes + 20 },
     continue_on_error: none,
-    concurrency: Present { value: ConcurrencyMappingQueueNotMax {
-      group: "printer-${{ inputs.printer }}", cancel_in_progress: Present { value: CancelInProgressBool { value: false } }, explicit_single: none,
-    } },
+    concurrency: fleet_converge_exclusive_job_concurrency(group: "printer-${{ inputs.printer }}"),
     permissions: Present { value: WorkflowPermissions {
       contents: Present { value: PermRead }, pull_requests: none, issues: none,
       actions: Present { value: PermRead }, id_token: Present { value: PermWrite },
     } },
   }
 }
+
+// Image production and allocation preparation share the bounded host job; allocation uses reviewed apply.
+fn fleet_converge_workspace_operation_step(mode: FleetConvergeWorkflowMode, run: String) -> Step {
+  RunStep {
+    name: Present { value: concat("Workspace: ", fleet_converge_workflow_mode_wire(mode: mode)) },
+    id: Present { value: fleet_converge_workflow_mode_wire(mode: mode) }, run: run, shell: none,
+    env: Present { value: [
+      kv(key: fleet_converge_expected_host_env_name, value: yaml_string(s: "${{ inputs.host }}")),
+      kv(key: rlm_expected_revision_env_name, value: yaml_string(s: "${{ inputs.expected_revision }}")),
+    ] },
+    working_directory: none, if_condition: Present { value: fleet_converge_mode_step_if(mode: mode) },
+    continue_on_error: none, timeout_minutes: Present { value: gunbc_ci_runner_guest_image_step_timeout_minutes }
+  }
+}
+
+fn fleet_converge_workspace_image_upload_step() -> Step {
+  UsesStep {
+    name: Present { value: "Archive the exact workspace image build and digest receipt" },
+    id: Present { value: "workspace_image_upload" }, uses: upload_artifact_action,
+    with: Present { value: [
+      kv(key: "name", value: yaml_string(s: workspace_image_artifact_name)),
+      kv(key: "path", value: yaml_string(s: workspace_image_artifact_paths())),
+      kv(key: "if-no-files-found", value: yaml_string(s: "error")),
+      kv(key: "retention-days", value: yaml_int(n: 90)),
+      kv(key: "compression-level", value: yaml_int(n: 6)),
+    ] }, env: none, if_condition: Present { value: fleet_converge_mode_step_if(mode: WorkspaceImageBuild) },
+    continue_on_error: none, timeout_minutes: Present { value: gunbc_ci_artifact_transfer_step_timeout_minutes }
+  }
+}
diff --git a/dag/gunbc/fleet/fleet_convergence_verdict.dag b/dag/gunbc/fleet/fleet_convergence_verdict.dag
index 73b804bb209..e39d1bba0c2 100644
--- a/dag/gunbc/fleet/fleet_convergence_verdict.dag
+++ b/dag/gunbc/fleet/fleet_convergence_verdict.dag
@@ -16,7 +16,7 @@ import gunbc.host_phase_status {
   host_phase_cells_for_enrollment,
   host_phase_cell_verdict,
 }
-import gunbc.host_assimilation_program { HostEnrollmentIntent }
+import gunbc.fleet_enrollment { HostEnrollmentIntent }
 import gunbc.fleet_converge_cli { ConvergeCliReceipt, converge_cli_receipt_converged }
 
 // THE fleet-atomic-convergence-verdict fold (operator directive 2026-08-08): ONE verdict
diff --git a/dag/gunbc/fleet/fleet_desired_candidate.dag b/dag/gunbc/fleet/fleet_desired_candidate.dag
index 1e6b8803b6b..c0974ca2875 100644
--- a/dag/gunbc/fleet/fleet_desired_candidate.dag
+++ b/dag/gunbc/fleet/fleet_desired_candidate.dag
@@ -2,7 +2,7 @@ module gunbc.fleet_desired_candidate
 
 import std.types { String, List }
 import v2.std.node { Node }
-import v2.std.diagnostic { Outcome, Accepted, Rejected }
+import v2.std.diagnostic { Outcome, Accepted, Rejected, NonEmptyDiagnostics, diagnostics_reason_lexemes }
 import v2.workflow.bash_emit { bash_emit_stmts }
 import v2.extdeps.languages.bash_build {
   bash_build_word_lit, bash_build_word_var, bash_build_word_concat_from_nodes, bash_build_word_cmdsubst,
@@ -11,7 +11,7 @@ import v2.extdeps.languages.bash_build {
   bash_build_or_else, bash_build_subshell_from_stmts, bash_build_with_redir_to_file, bash_build_exit,
   bash_build_pipe,
 }
-import gunbc.fleet_release_bins_key { compiler_pair_candidate_artifact_name, release_bins_pack_object_name }
+import gunbc.fleet_release_bins_key { compiler_pair_candidate_artifact_name, release_bins_pack_object_name, script_emission_refused_text }
 
 // WHERE fleet-desired FINDS THE CANDIDATE THE MERGE QUEUE BUILT FOR THE REVISION THAT JUST LANDED.
 //
@@ -158,6 +158,6 @@ fn fleet_desired_candidate_fetch_statements() -> List<Node> {
 fn fleet_desired_candidate_fetch_script() -> String {
   match bash_emit_stmts(statements: fleet_desired_candidate_fetch_statements(), set_e: true) {
     Accepted { value: v, diagnostics: _ } => v
-    Rejected { diagnostics: _ } => ""
+    Rejected { diagnostics: ds } => script_emission_refused_text(script: "gunbc.fleet_desired_candidate fleet_desired_candidate_fetch_script", diagnostics: ds)
   }
 }
diff --git a/dag/gunbc/fleet/fleet_enrollment.dag b/dag/gunbc/fleet/fleet_enrollment.dag
new file mode 100644
index 00000000000..9bbe0fd1ab1
--- /dev/null
+++ b/dag/gunbc/fleet/fleet_enrollment.dag
@@ -0,0 +1,182 @@
+module gunbc.fleet_enrollment
+
+import std.types { String, Bool, List, NonEmptyStr }
+import std.decl_ref { decl_ref }
+import product.host_identity { HostIdentity }
+import extdeps.cloud.hetzner { cax41_catalog }
+import product.supplier.hetzner { hetzner_nuremberg_route, hetzner_helsinki_route }
+import product.fabric.provider_route { ProviderRoute }
+import gunbc.fleet_host_backing {
+  HostBacking,
+  OwnedMachine,
+  BmcVirtualMediaInstall,
+  ApplianceFirstBoot,
+  ProviderGuest,
+  ProviderResourceAcquired,
+  ProviderResourceBinding,
+  backing_microvm_forbidding_offer,
+}
+import gunbc.hetzner_cloud_guest { hetzner_cloud_guest_entitlement }
+import gunbc.hetzner_cloud_acquisition { hetzner_cax41_nbg1_1_acquisition, hetzner_cax41_hel1_1_acquisition }
+import gunbc.fleet_host_identity {
+  operator_host_srv1,
+  operator_host_srv2,
+  operator_host_srv3,
+  operator_host_srv4,
+  operator_host_183527,
+  operator_host_3dde7f,
+}
+
+// THE FLEET'S ENROLLMENT ROOT. Which hosts are in the fleet, what each is for and what supplies it
+// are declared ONCE, here, and every fleet population is derived from this roster -- the standup
+// phase matrix (gunbc.host_phase_status), the runner population, capacity control and session
+// residency's denominator. Before this module the same membership was re-listed as literal srv1-srv4
+// lists in several consumers, and adding a machine meant finding every list; now it is one row.
+// This module is deliberately light: a consumer that only needs WHO is enrolled imports it without
+// pulling in standup programs, provider APIs, physical inventory or convergence.
+
+// Participation is what a host DOES for the fleet, and it is a LIST because the axes are
+// independent rather than exclusive: nothing in the model forbids a host that both runs CI and
+// serves inference, and a coproduct would have forced a third fused variant the first time that
+// happened. It is deliberately NOT a host KIND enum (AltraRunner | SparkAppliance) -- kind is
+// hardware, participation is role, and binding obligations to hardware would mean a future Altra
+// dedicated to serving inherits BMC obligations because of what it is made of rather than what it
+// is for. srv5 and srv6 stay opaque host identities for the same reason: the identity survives a
+// role change or a hardware replacement, and DGX Spark remains a product fact recorded elsewhere,
+// never part of the host's permanent name.
+
+type FleetParticipation
+  = CiRunnerParticipation
+  | InferenceServingParticipation
+  | InteractiveSessionParticipation
+
+fn fleet_participation_label(p: FleetParticipation) -> String {
+  match p {
+    CiRunnerParticipation => "ci-runner"
+    InferenceServingParticipation => "inference-serving"
+    InteractiveSessionParticipation => "interactive-session"
+  }
+}
+
+fn fleet_participation_eq(a: FleetParticipation, b: FleetParticipation) -> Bool {
+  fleet_participation_label(p: a) == fleet_participation_label(p: b)
+}
+
+// An enrollment joins three separate facts about one stable identity: what the host is FOR
+// (participation), and what SUPPLIES it (backing, gunbc.fleet_host_backing). Its allocated names live
+// in gunbc.hostname_allocation and are not repeated here. A known identity can exist without a
+// participation, a participation can exist before its readiness is established, and only the
+// applicable admission downstream produces runnable capacity.
+type HostEnrollmentIntent {
+  host: HostIdentity
+  participation: List<FleetParticipation>
+  backing: HostBacking
+}
+
+fn participation_list_contains(ps: List<FleetParticipation>, wanted: FleetParticipation) -> Bool {
+  filter(ps, p => fleet_participation_eq(a: p, b: wanted)).length() > 0
+}
+
+// The CI-runner program is the identity anchor for the refactor: it must select the WHOLE spine,
+// because every phase authored to date exists to serve runner hosts. If a later phase is added that
+// no participation claims, or one that CI does not claim, this equality breaks and the witness reds
+// -- which is the intended alarm, not a maintenance burden. It is the discriminating control that
+// distinguishes 'the refactor preserved srv1-srv4 exactly' from 'the refactor produced a
+// plausible-looking matrix'.
+
+data ci_runner_enrollment_participation: List<FleetParticipation> = [CiRunnerParticipation]
+
+data inference_serving_enrollment_participation: List<FleetParticipation> = [InferenceServingParticipation]
+
+// Interactive agent sessions are their own participation, not an attribute of CI: which hosts run
+// session containers is the fact that charges a host a sessions reservation (gunbc.session_residency)
+// and scopes CLI-provider capacity control (gunbc.fleet_capacity_control). It coincided with the CI
+// hosts on srv1-srv4, and the coincidence was carried as copies of the same four-host list; a rented
+// CI guest runs no sessions, so the two are separate rows the first time they differ.
+data ci_runner_and_session_enrollment_participation: List<FleetParticipation> = [
+  CiRunnerParticipation,
+  InteractiveSessionParticipation,
+]
+
+data both_participation_enrollment_participation: List<FleetParticipation> = [
+  InferenceServingParticipation,
+  CiRunnerParticipation,
+]
+
+// THE TWO HETZNER CLOUD CAX41 GUESTS (ordered by the operator 2026-10-07 and recreated 2026-10-08: one in Nuremberg, one in Helsinki). Their
+// participation is the CI runner role the operator intends for them; whether that role can RUN is
+// not decided here -- the entitlement says nested virtualization is unavailable on Hetzner Cloud, so
+// the Firecracker execution path downstream refuses on it with that cause. Each is bound to its
+// provider resource id (gunbc.hetzner_cloud_acquisition), never to a console display name, because a
+// display name is not the resource an operation may target.
+fn cax41_guest(route: ProviderRoute, resource: ProviderResourceBinding) -> HostBacking {
+  ProviderGuest {
+    route: route,
+    entitlement: hetzner_cloud_guest_entitlement(
+      row: cax41_catalog,
+      offer: decl_ref(module_path: "extdeps.cloud.hetzner", decl_name: "cax41_catalog"),
+    ),
+    resource: resource,
+  }
+}
+
+// The enrolled fleet. gunbc.host_phase_status reads it rather than re-listing it, so the standup
+// matrix can never disagree with the roster about WHICH hosts exist. This is also
+// the enrollment prerequisite the srv4 OOM incident priced (fleet_subsumption_manual_gaps section
+// C): a host takes no fleet work until it is an intent row, so a host absent from this list has no
+// cells at all, and one that appears gains a full column of UnknownRefused cells — the work
+// becoming visible the moment the host is enrolled, which is the behaviour the incident wanted.
+
+data fleet_enrollments: List<HostEnrollmentIntent> = [
+  HostEnrollmentIntent { host: operator_host_srv1, participation: ci_runner_and_session_enrollment_participation, backing: OwnedMachine { provisioning: BmcVirtualMediaInstall } },
+  HostEnrollmentIntent { host: operator_host_srv2, participation: ci_runner_and_session_enrollment_participation, backing: OwnedMachine { provisioning: BmcVirtualMediaInstall } },
+  HostEnrollmentIntent { host: operator_host_srv3, participation: ci_runner_and_session_enrollment_participation, backing: OwnedMachine { provisioning: BmcVirtualMediaInstall } },
+  HostEnrollmentIntent { host: operator_host_srv4, participation: ci_runner_and_session_enrollment_participation, backing: OwnedMachine { provisioning: BmcVirtualMediaInstall } },
+  HostEnrollmentIntent {
+    host: operator_host_183527,
+    participation: ci_runner_enrollment_participation,
+    backing: cax41_guest(
+      route: hetzner_nuremberg_route(),
+      resource: ProviderResourceAcquired { acquisition: hetzner_cax41_nbg1_1_acquisition },
+    ),
+  },
+  HostEnrollmentIntent {
+    host: operator_host_3dde7f,
+    participation: ci_runner_enrollment_participation,
+    backing: cax41_guest(
+      route: hetzner_helsinki_route(),
+      resource: ProviderResourceAcquired { acquisition: hetzner_cax41_hel1_1_acquisition },
+    ),
+  },
+]
+
+// The hosts enrolled for one participation, in roster order. Every per-role population a consumer
+// needs is this one filter, so a consumer can never hold a host list that disagrees with the roster.
+fn hosts_enrolled_for(wanted: FleetParticipation) -> List<HostIdentity> {
+  map(
+    filter(fleet_enrollments, e => participation_list_contains(ps: e.participation, wanted: wanted)),
+    e => e.host,
+  )
+}
+
+// THE RUNNER-EXECUTOR POPULATION: hosts enrolled for CI whose backing does not forbid the microVM
+// execution path. It is narrower than the CI enrollment on purpose -- a CAX guest is enrolled for CI
+// and refused execution by its provider, so it is a member of hosts_enrolled_for(CiRunnerParticipation)
+// (its refusal is visible there) and NOT of this set, which is what a pinned runner, a workflow host
+// choice or a slot census walks. A provider whose offer permits nesting joins it with no edit here.
+fn runner_executor_hosts() -> List<HostIdentity> {
+  map(
+    filter(fleet_enrollments, e =>
+      participation_list_contains(ps: e.participation, wanted: CiRunnerParticipation)
+        && match backing_microvm_forbidding_offer(backing: e.backing) {
+          Present { value: _ } => false
+          Absent => true
+        }
+    ),
+    e => e.host,
+  )
+}
+
+fn enrollment_for_host(host: HostIdentity) -> HostEnrollmentIntent? {
+  filter(fleet_enrollments, e => (e.host as String) == (host as String)).first()
+}
diff --git a/dag/gunbc/fleet/fleet_host_backing.dag b/dag/gunbc/fleet/fleet_host_backing.dag
new file mode 100644
index 00000000000..eb8313481ac
--- /dev/null
+++ b/dag/gunbc/fleet/fleet_host_backing.dag
@@ -0,0 +1,68 @@
+module gunbc.fleet_host_backing
+
+import std.types { Bool, NonEmptyStr }
+import std.decl_ref { DeclarationRef }
+import std.measure { ByteSize, HardwareThreadCount }
+import extdeps.toolchain.types { Architecture }
+import product.fabric.provider_route { ProviderRoute }
+import gunbc.provider_acquisition { ProviderResourceAcquisition }
+
+// WHAT SUPPLIES A FLEET HOST, as a fact separate from what the host is FOR. Backing, provisioning and
+// service intent were one fact in practice -- a CI host was assumed to be an owned machine with a BMC
+// to converge and an OS to install -- and the assumption made a rented guest owe operations it has no
+// subject for. Backing answers only "what physical or provider resource is this host", and the
+// facts a rented guest is entitled to travel WITH it, because they are the provider's offer rather
+// than anything this repository observes: an Altra package's thread count is not a CAX guest's vCPU
+// allocation, and nested virtualization is a property of the provider's product, not of the silicon
+// underneath it. What the running guest actually exposes is an observation, carried downstream of
+// adoption, never authored here.
+//
+// This module enumerates no provider. A provider's adapter (gunbc.hetzner_cloud_guest) builds a
+// GuestEntitlement from that provider's cited catalog row, so adding a provider is a new adapter
+// beside the others and never a new arm here.
+
+type GuestEntitlement {
+  offer: DeclarationRef
+  architecture: Architecture
+  vcpus: HardwareThreadCount
+  memory: ByteSize
+  disk: ByteSize
+  nested_virtualization: Bool
+  self_identity_url: String
+}
+
+// THE EXACT PROVIDER RESOURCE. An operation is bound to a provider's resource identifier, never to
+// the display name the provider shows, because a display name can be edited, reused or duplicated.
+// The binding IS the acquisition (gunbc.provider_acquisition): the identifier, the account it is held
+// under and the credential that drives it arrive together, so no consumer pairs one server's id
+// with another account's credential. A host enrolled before its acquisition is recorded carries that
+// as a typed obligation naming what would ground it (DESIGN section 4d), so adoption refuses on it
+// instead of guessing.
+type ProviderResourceBinding
+  = ProviderResourceAwaited { read_obligation: NonEmptyStr }
+  | ProviderResourceAcquired { acquisition: ProviderResourceAcquisition }
+
+// HOW AN OWNED MACHINE'S OPERATING SYSTEM ARRIVES. This is not implied by ownership: an Ampere
+// Altra server is installed over its BMC's virtual media, while an appliance such as a DGX Spark has
+// no BMC to converge and provisions itself through its own first boot. A provider guest has no arm
+// here because its OS always arrives as the provider's image -- that is what ProviderGuest means --
+// so a rented guest owing a BMC operation has no constructor.
+type OwnedProvisioning
+  = BmcVirtualMediaInstall
+  | ApplianceFirstBoot
+
+type HostBacking
+  = OwnedMachine { provisioning: OwnedProvisioning }
+  | ProviderGuest { route: ProviderRoute, entitlement: GuestEntitlement, resource: ProviderResourceBinding }
+
+// THE ONE RULE FOR WHETHER A BACKING CAN HOST THE FLEET'S MICROVM EXECUTION PATH, before anything is
+// observed: an owned machine can (its readiness is then observed), and a provider guest can only when
+// its offer permits nested virtualization. Present names the cited offer that forbids it. Adoption,
+// fabric supply and the runner-executor population all read this, so no consumer restates it.
+fn backing_microvm_forbidding_offer(backing: HostBacking) -> DeclarationRef? {
+  match backing {
+    OwnedMachine { provisioning: _ } => none
+    ProviderGuest { route: _, entitlement: e, resource: _ } =>
+      if e.nested_virtualization { none } else { Present { value: e.offer } }
+  }
+}
diff --git a/dag/gunbc/fleet/fleet_host_identity.dag b/dag/gunbc/fleet/fleet_host_identity.dag
index 42deced7e0d..6eae6750098 100644
--- a/dag/gunbc/fleet/fleet_host_identity.dag
+++ b/dag/gunbc/fleet/fleet_host_identity.dag
@@ -1,5 +1,7 @@
 module gunbc.fleet_host_identity
 
+import std.types { List, NonEmptyStr, String }
+import v2.std.algebra { filter }
 import product.host_identity { HostIdentity }
 
 // THE FLEET'S HOST IDENTITIES, as a leaf. These rows were authored in gunbc.fleet_intent_network,
@@ -40,31 +42,11 @@ data operator_host_mtcollins1: HostIdentity = "mtcollins1"
 // mtjade1_live_standing_grant) binds this identity as its host scope.
 data operator_host_mtjade1: HostIdentity = "mtjade1"
 
-// SPARK-LANE-A (2026-08-06). srv5/srv6 are the operator's HostIdentity slots for the two ordered NVIDIA DGX Spark units (gunbc.spark.dgx_procurement). They live here because HostIdentity naming is this module's single authority — SPARK-0 minted `srv5_reserved`/`srv6_reserved` privately inside the procurement module only because this file was mid-refactor and out of scope, which was a §3 fork of one concept (a host's fleet identity) across two homes; those private rows are deleted and the procurement module imports these. NAMING AN IDENTITY IS NOT ENROLLMENT, and that distinction is carried structurally rather than by this prose: enrollment is membership in `fleet_intent_network.endpoints` (and in gunbc.fleet_intent's ComputeHost list), and srv5/srv6 appear in neither — HALF-SUPERSEDED 2026-09-02, see the DCH-0 clause at the end of this note: the `endpoints` half is now performed and the ComputeHost half is not. Updated 2026-08-07 for the arrived state: both units are now live on the LAN and the operator has authored two static reservations for them (spark-a3ee 192.168.1.222 and spark-3bd5 192.168.1.223, both MACs ARP-confirmed — SUPERSEDED, see the SPARK-WIFI-0 clause at the end of this note), so the missing fact is no longer the addresses. CORRECTED 2026-08-23: THE SLOT ASSIGNMENT IS ALSO NO LONGER MISSING, AND THIS NOTE WENT ON ASSERTING THAT IT WAS. It read that the operator "supplied the router table but never stated the assignment", so authoring an address here would be a 50/50 guess and thus the fabricated-plausible-output failure DESIGN §5 forbids. The decision exists and is one import away: gunbc.spark.dgx_procurement `dgx_spark_router_binding_operator_allocation` records srv5 taking spark-a3ee and srv6 taking spark-3bd5, decided 2026-08-07 under an explicit operator delegation, on an ascending-address-order basis kept precisely so the tie-break is attributable rather than looking like a measurement; `srv5_router_binding` and `srv6_router_binding` are both SlotAssigned carrying it. The two notes are the same date — the stated blocker was resolved the day it was written. THE DOCTRINE WAS INVOKED AGAINST THE WRONG TARGET, which is why this is a correction and not a refresh: §5 forbids fabricating an OBSERVATION, and an attributable ALLOCATION with a decider, a date and a basis is not one. This is the stale-citation class in its expensive form — a rotted REASON rather than a rotted line number — and it propagated: a lane read it, believed Spark work was blocked on an operator fact, and reported that upward before anyone opened the procurement carrier. WHAT WAS STILL TRUE UNTIL DCH-0, and was why no endpoint row was added here (SUPERSEDED — the clause is preserved as written because the DCH-0 clause below is a rebuttal of it rather than a refresh): srv5/srv6 remain absent from `endpoints` and from gunbc.fleet_intent's ComputeHost list, because in this module that membership IS enrollment — authoring the rows would enroll them, not merely describe them — and there is nothing to enroll into while the units are unplugged and the converge timer is retired. A PROJECTED ENDPOINT ALSO CANNOT LIVE HERE, and that is structural rather than a preference: gunbc.spark.dgx_procurement imports THIS module for operator_host_srv5/srv6, so the reverse import is refused by the import graph's one law — measured, not inferred, by adding it and compiling: `circular dependency detected: gunbc.fleet_intent_network -> gunbc.spark.dgx_procurement`. Anyone who later wants the endpoints projected from the binding starts from that constraint. Until enrollment genuinely happens, the address authority stays single because there is only ever one — the reservation rows in the procurement module. SPARK-WIFI-0 (2026-08-27): TWO THINGS IN THIS NOTE WENT STALE AT ONCE, and both are corrected in the procurement module rather than here, because that is where the address authority lives. First, the addresses: the operator moved both units onto the LAN's wireless SSID, unplugged both ethernet cables, and authored fresh CR1000A reservations keyed to the RADIO MACs — spark-a3ee is now 192.168.1.226 (F0:68:E3:B3:1A:40) and spark-3bd5 is now 192.168.1.225 (F0:68:E3:31:AB:E6). A DHCP reservation binds a MAC, and a radio has its own, so the ethernet-keyed rows could not follow the units across the medium change. Second, and more consequentially for anyone reading this note for a reason: THE UNITS ARE NO LONGER UNPLUGGED. The clause above gives "the units are unplugged and the converge timer is retired" as the standing reason there is nothing to enroll into, and the first half of that is now false — both boxes are live, reachable, and answering SSH on their enrolled host keys, which were re-scanned at the new addresses and matched exactly. Enrollment is still NOT performed here, and that is deliberate rather than leftover: membership in `endpoints` IS enrollment in this module, so authoring the rows is the act itself and belongs to the roadmap node that owns it, not to an address correction. What changed is the REASON — from "there is nothing to enroll" to "enrolling is a decision nobody has taken yet" — and that distinction is exactly the rotted-reason class this note already documents itself falling into once. DCH-0 (2026-09-02): THE ENDPOINTS HALF OF ENROLLMENT IS NOW PERFORMED — `srv5_host_lan_endpoint` and `srv6_host_lan_endpoint` are authored below and are members of `endpoints`, which retires the "enrolling is a decision nobody has taken yet" reason for this half and only this half. The decision was taken by the DCH-0 roadmap node (docs/plans/dedicated-coding-harness-plan.md), whose reasoning is that list membership was measured to have ZERO production consumers — 57 non-test modules import this one and none reads `endpoints` or `fleet_intent_network_topology()`; production reads individual rows BY NAME — so the load-bearing act is authoring rows the named-import consumers can reach, and the list is this authority's completeness statement. THE ComputeHost HALF IS DELIBERATELY NOT PERFORMED and is a decision rather than a row (DCH-0c): gunbc.fleet_intent's `fleet_intent_known_hosts` has three production consumers, it mints two RunnerHostSudoersArtifact generated artifacts, and gunbc.runner.runner_host_deploy `admit_runner_host` is a fail-closed enrollment wall returning RunnerHostUnenrolled that today protects these two machines — so enrolling there REMOVES a refusal and needs the host facts the conservation wall consumes. Every sentence in this note about the ComputeHost list therefore still stands unchanged.
-// SPARK-PAIR-1 (2026-09-02). srv7/srv8 are the operator's HostIdentity slots for the SECOND DGX
-// Spark pair -- spark-c2b1 at 192.168.1.232 and spark-ac79 at 192.168.1.233 on the wireless LAN,
-// cross-cabled to each other on dual direct-attach 200G ports. They are NAMED here and, exactly as
-// the srv5/srv6 note above sets out, naming is not enrollment: neither appears in `endpoints` or in
-// gunbc.fleet_intent's ComputeHost list, so this row describes them without admitting them. (Read
-// that note for the DISTINCTION, not for the state of srv5/srv6, which changed under DCH-0 on
-// 2026-09-02: those two are now members of `endpoints`. srv7/srv8 are members of neither list, and
-// this clause is about srv7/srv8.)
+// GROUP A DECOMMISSIONED (operator, 2026-10-07): srv5, srv6, srv7 and srv8 -- the DGX Spark units spark-a3ee,
+// spark-3bd5, spark-c2b1 and spark-ac79 on fabric cage 1 -- were sold and wiped, and their identity slots are
+// deleted with every consumer. Their history (procurement, the wireless move, the fabric cabling, the pair
+// and Group A serving) is in git before this change and in the recurring-failure-mode rows that cite it.
 //
-// They are named now because the fabric addressing between them is real, durable and modeled --
-// gunbc.spark.fabric_link_desired reads it back from /etc/netplan on both hosts -- and that module
-// needs an identity for each end. An address-carrying model keyed on a raw hostname string would be
-// the §3 fork this note already documents once.
-//
-// WHAT IS STILL MISSING, stated as the remaining acts rather than as a blocker: adoption is five
-// separable things -- physical adoption, host and network identity, fleet enrollment, cell-role
-// assignment, assembly membership -- and this row is the second alone. Convergence cannot manage
-// these hosts until enrollment happens, which is why the fabric on them was configured by hand.
-data operator_host_srv7: HostIdentity = "srv7"
-data operator_host_srv8: HostIdentity = "srv8"
-
-data operator_host_srv5: HostIdentity = "srv5"
-data operator_host_srv6: HostIdentity = "srv6"
-
 // SPARK-BATCH-3 (2026-09-05). srv9/srv10/srv11 are the identity slots for the three DGX Spark units
 // the router table showed beside the two named pairs -- spark-0c75 at 192.168.1.236, spark-3336 at
 // .237, spark-b66c at .238 -- assigned in ascending address order, the same tie-break the first pair
@@ -80,3 +62,45 @@ data operator_host_srv11: HostIdentity = "srv11"
 // lease table the day the fabric switch was cabled and landed on switch lane qsfp56-dd-2-3. srv12
 // is its identity slot, assigned by the same ascending-address rule.
 data operator_host_srv12: HostIdentity = "srv12"
+
+// ALTRA-BATCH-1 (operator, 2026-10-07). Four ASRock ALTRAD8UD hosts, not yet racked, named srv13-srv16
+// by the operator. Naming is not enrollment: no address, BMC endpoint, MAC or hardware row exists
+// for them until first contact observes one, and every procedure refuses a host it cannot name a
+// fact for.
+data operator_host_srv13: HostIdentity = "srv13"
+data operator_host_srv14: HostIdentity = "srv14"
+data operator_host_srv15: HostIdentity = "srv15"
+data operator_host_srv16: HostIdentity = "srv16"
+
+// OPAQUE IDENTITIES (2026-10-07). From here on a new fleet subject's identity carries no meaning in
+// its spelling -- not a provider, an architecture, a role or a rack position -- because every such
+// fact has its own authority and a spelling that encodes one becomes a second, unmaintained copy of
+// it. People address these hosts by the names gunbc.hostname_allocation draws for them; srv1..srv16,
+// mtcollins1 and mtjade1 keep their historical identities, whose spellings are now just keys.
+data operator_host_183527: HostIdentity = "host-183527"
+data operator_host_3dde7f: HostIdentity = "host-3dde7f"
+
+// THE NAMED ROSTER, ONE LIST BESIDE THE ROWS. A step subject or other label resolves to a host only
+// by joining this membership; a spelling that is not a row here is not a fleet host.
+data operator_hosts: List<HostIdentity> = [
+  operator_host_srv1,
+  operator_host_srv2,
+  operator_host_srv3,
+  operator_host_srv4,
+  operator_host_mtcollins1,
+  operator_host_mtjade1,
+  operator_host_srv9,
+  operator_host_srv10,
+  operator_host_srv11,
+  operator_host_srv12,
+  operator_host_srv13,
+  operator_host_srv14,
+  operator_host_srv15,
+  operator_host_srv16,
+  operator_host_183527,
+  operator_host_3dde7f,
+]
+
+fn operator_host_named(label: NonEmptyStr) -> HostIdentity? {
+  operator_hosts |> filter(h => (h as String) == (label as String)) |> first()
+}
diff --git a/dag/gunbc/fleet/fleet_host_key_enrollment.dag b/dag/gunbc/fleet/fleet_host_key_enrollment.dag
index aeac66068a3..b7fbcb60eb8 100644
--- a/dag/gunbc/fleet/fleet_host_key_enrollment.dag
+++ b/dag/gunbc/fleet/fleet_host_key_enrollment.dag
@@ -108,6 +108,14 @@ data fleet_host_key_enrollments: List<KnownHostKeyRow> = [
     sha256_fingerprint: "SHA256:hIxG0YT2jIxXbxs4XGqwehgoA63kxD4xKP2j6YjG86w",
     provenance: ScannedFirstContact { scanned_from: "srv1 via ssh-keyscan -t ed25519 from the LAN probe position; no cited reservation, procurement, or external key authority exists" as NonEmptyStr },
   },
+  KnownHostKeyRow {
+    host: "srv1" as HostIdentity,
+    endpoint: "srv1.tailecbe08.ts.net",
+    key_type: "ssh-ed25519",
+    public_key_base64: "AAAAC3NzaC1lZDI1NTE5AAAAIErU2itxhvGPRx1UxiuCYkikYIV9DtuXiELy64bQpAXL",
+    sha256_fingerprint: "SHA256:hIxG0YT2jIxXbxs4XGqwehgoA63kxD4xKP2j6YjG86w",
+    provenance: ScannedFirstContact { scanned_from: "2026-10-09 srv2 ssh-keyscan of srv1.tailecbe08.ts.net matched the existing srv1 enrollment byte-for-byte; the authenticated srv1 SSH session independently reported this DNSName through tailscale status" },
+  },
   KnownHostKeyRow {
     host: "srv2" as HostIdentity,
     endpoint: "srv2",
@@ -132,70 +140,6 @@ data fleet_host_key_enrollments: List<KnownHostKeyRow> = [
     sha256_fingerprint: "SHA256:nU6X9fCjhRYdvvvuKCbS7egf9CJMbJI6vYJ/Wgf5zxI",
     provenance: ScannedFirstContact { scanned_from: "srv4 via ssh-keyscan -t ed25519 from the LAN probe position; host address still a DHCP lease (not reserved), no cited external key authority" as NonEmptyStr },
   },
-  KnownHostKeyRow {
-    host: "srv5" as HostIdentity,
-    endpoint: "192.168.1.226",
-    key_type: "ssh-ed25519",
-    public_key_base64: "AAAAC3NzaC1lZDI1NTE5AAAAICIFwSNG7dFfeQLdMR70e/xbYdfGO9O/ArmOkB33kG/T",
-    sha256_fingerprint: "SHA256:AnxYhYR+Cz5EbOCVxirsoZlUwLRENLJmeNyk0ukD/s4",
-    provenance: ScannedFirstContact { scanned_from: "originally 192.168.1.222 via ssh-keyscan -t ed25519; ADDRESS MOVED to 192.168.1.226 on 2026-08-27 (SPARK-WIFI-0, reservation re-keyed to the wireless MAC). The key is unchanged and was re-scanned at the new address: SHA256:AnxYhYR+Cz5EbOCVxirsoZlUwLRENLJmeNyk0ukD/s4 matched the enrolled value exactly, which is what establishes that .226 is the same box .222 was. THAT IS CONTINUITY EVIDENCE AND NOT THE ANCHOR, and the distinction is the whole reason this arm does not change: re-scanning a first-contact key at a new address reproduces whatever the first contact established, so if the original scan had been intercepted this match would reproduce the interception rather than detect it. The anchored-enrollment join (enrolled key + independently observed MAC-at-address + cited reservation match) still has not been performed, so this stays first-contact" as NonEmptyStr },
-  },
-  KnownHostKeyRow {
-    host: "srv6" as HostIdentity,
-    endpoint: "192.168.1.225",
-    key_type: "ssh-ed25519",
-    public_key_base64: "AAAAC3NzaC1lZDI1NTE5AAAAIEnpVavWbt8VTjUMprf+CbKCw0tS2nQIVuN49Ob5gEsc",
-    sha256_fingerprint: "SHA256:Y5wB4G/qZFXZBaXbjWdK/HtWJP2pUgupsyjwBPehqMs",
-    provenance: ScannedFirstContact { scanned_from: "originally 192.168.1.223 via ssh-keyscan -t ed25519; ADDRESS MOVED to 192.168.1.225 on 2026-08-27 (SPARK-WIFI-0, reservation re-keyed to the wireless MAC). The key is unchanged and was re-scanned at the new address: SHA256:Y5wB4G/qZFXZBaXbjWdK/HtWJP2pUgupsyjwBPehqMs matched the enrolled value exactly, which is what establishes that .225 is the same box .223 was. THAT IS CONTINUITY EVIDENCE AND NOT THE ANCHOR, for the reason given on the srv5 row: a re-scan reproduces the first contact rather than corroborating it. The anchored-enrollment join still has not been performed, so this stays first-contact" as NonEmptyStr },
-  },
-  KnownHostKeyRow {
-    host: "srv7" as HostIdentity,
-    endpoint: "192.168.1.232",
-    key_type: "ssh-ed25519",
-    public_key_base64: "AAAAC3NzaC1lZDI1NTE5AAAAIAJgeR78lC8yVqBnOvRh0K6AuL9pGNw9HxZm9rDgaRod",
-    sha256_fingerprint: "SHA256:YT7DxbMuiqEtnnYJ05MFaGwvjfTml3ffhsiOfVM+9RY",
-    provenance: ScannedFirstContact { scanned_from: "192.168.1.232 via ssh-keyscan -t ed25519 from the srv2 LAN probe position on 2026-09-05 (router reservation 192.168.1.232 cited in fleet_intent_network); SHARED HOST KEY: srv7, srv8 and srv11 present this one identical ED25519 key, so the three units were imaged from one setup image that never regenerated /etc/ssh host keys; the key authenticates the image, not the unit, and these three are mutually indistinguishable by host key until spark_bootstrap regenerates host keys (ssh-keygen -A) and this row is re-scanned" as NonEmptyStr },
-  },
-  KnownHostKeyRow {
-    host: "srv8" as HostIdentity,
-    endpoint: "192.168.1.233",
-    key_type: "ssh-ed25519",
-    public_key_base64: "AAAAC3NzaC1lZDI1NTE5AAAAIAJgeR78lC8yVqBnOvRh0K6AuL9pGNw9HxZm9rDgaRod",
-    sha256_fingerprint: "SHA256:YT7DxbMuiqEtnnYJ05MFaGwvjfTml3ffhsiOfVM+9RY",
-    provenance: ScannedFirstContact { scanned_from: "192.168.1.233 via ssh-keyscan -t ed25519 from the srv2 LAN probe position on 2026-09-05 (router reservation 192.168.1.233 cited in fleet_intent_network); SHARED HOST KEY: srv7, srv8 and srv11 present this one identical ED25519 key, so the three units were imaged from one setup image that never regenerated /etc/ssh host keys; the key authenticates the image, not the unit, and these three are mutually indistinguishable by host key until spark_bootstrap regenerates host keys (ssh-keygen -A) and this row is re-scanned" as NonEmptyStr },
-  },
-  KnownHostKeyRow {
-    host: "srv9" as HostIdentity,
-    endpoint: "192.168.1.236",
-    key_type: "ssh-ed25519",
-    public_key_base64: "AAAAC3NzaC1lZDI1NTE5AAAAIG+Vyj4wf23aaS4HANYxhVmNIM/JoI/VkbGXCurnf2a1",
-    sha256_fingerprint: "SHA256:8tObL+Kc0eYVceiRbap8TwqqmOian1NbGfSeZ9G7Erw",
-    provenance: ScannedFirstContact { scanned_from: "192.168.1.236 via ssh-keyscan -t ed25519 from the srv2 LAN probe position on 2026-09-05 (router reservation 192.168.1.236 cited in fleet_intent_network); key distinct across the fleet" as NonEmptyStr },
-  },
-  KnownHostKeyRow {
-    host: "srv10" as HostIdentity,
-    endpoint: "192.168.1.237",
-    key_type: "ssh-ed25519",
-    public_key_base64: "AAAAC3NzaC1lZDI1NTE5AAAAII2M9X3utDqEch8AdHd9RN2fYAE2ZM/SlBkG5vA4P4IO",
-    sha256_fingerprint: "SHA256:6qfKjmplvxlMcgxsnz5x4LZp9uXw/x8HoOpazKdULTU",
-    provenance: ScannedFirstContact { scanned_from: "192.168.1.237 via ssh-keyscan -t ed25519 from the srv2 LAN probe position on 2026-09-05 (router reservation 192.168.1.237 cited in fleet_intent_network); key distinct across the fleet; unit is the defective RMA row in dgx_procurement and is enrolled for bootstrap only" as NonEmptyStr },
-  },
-  KnownHostKeyRow {
-    host: "srv11" as HostIdentity,
-    endpoint: "192.168.1.238",
-    key_type: "ssh-ed25519",
-    public_key_base64: "AAAAC3NzaC1lZDI1NTE5AAAAIAJgeR78lC8yVqBnOvRh0K6AuL9pGNw9HxZm9rDgaRod",
-    sha256_fingerprint: "SHA256:YT7DxbMuiqEtnnYJ05MFaGwvjfTml3ffhsiOfVM+9RY",
-    provenance: ScannedFirstContact { scanned_from: "192.168.1.238 via ssh-keyscan -t ed25519 from the srv2 LAN probe position on 2026-09-05 (router reservation 192.168.1.238 cited in fleet_intent_network); SHARED HOST KEY: srv7, srv8 and srv11 present this one identical ED25519 key, so the three units were imaged from one setup image that never regenerated /etc/ssh host keys; the key authenticates the image, not the unit, and these three are mutually indistinguishable by host key until spark_bootstrap regenerates host keys (ssh-keygen -A) and this row is re-scanned" as NonEmptyStr },
-  },
-  KnownHostKeyRow {
-    host: "srv12" as HostIdentity,
-    endpoint: "192.168.1.239",
-    key_type: "ssh-ed25519",
-    public_key_base64: "AAAAC3NzaC1lZDI1NTE5AAAAIPe9KmAy71Yzkbs+RnWRguTJhDgVumAo6ujERo4B5beS",
-    sha256_fingerprint: "SHA256:bxxSNGz99ATMZeSAAED01LQFUeeLmhxLNp81QnSwkA4",
-    provenance: ScannedFirstContact { scanned_from: "192.168.1.239 via ssh-keyscan -t ed25519 from the srv2 LAN probe position on 2026-09-05; key distinct across the fleet; accepts the version-1 administrator credential" as NonEmptyStr },
-  },
 ]
 
 fn enrolled_fingerprint_for(host: String) -> String? {
diff --git a/dag/gunbc/fleet/fleet_intent.dag b/dag/gunbc/fleet/fleet_intent.dag
index 81d96dd99bc..ad502f85619 100644
--- a/dag/gunbc/fleet/fleet_intent.dag
+++ b/dag/gunbc/fleet/fleet_intent.dag
@@ -282,6 +282,14 @@ data srv4_baseboard: ServerBaseboard = ServerBaseboard {
   catalog: asrock_altrad8ud_1l2t_catalog,
   bmc: BmcEndpoint { host: "192.168.1.195", protocol: Redfish },
 }
+// srv13's board and BMC endpoint as first contact observed them (2026-10-07): Redfish
+// Systems/system reported Model ALTRAD8UD-1L2T, and the controller answered at the router's
+// bmc-altrad8ud-1l2t-5 reservation, MAC 9c:6b:00:e7:c9:83. No host row yet: CPU, memory and
+// storage are not observed.
+data srv13_baseboard: ServerBaseboard = ServerBaseboard {
+  catalog: asrock_altrad8ud_1l2t_catalog,
+  bmc: BmcEndpoint { host: "192.168.1.247", protocol: Redfish },
+}
 
 data srv1_nvme0: StorageDevice = nvme_storage_device(
   catalog: wd_black_sn850x_2tb_catalog,
diff --git a/dag/gunbc/fleet/fleet_intent_network.dag b/dag/gunbc/fleet/fleet_intent_network.dag
index 8c5dd9ce72d..0dfde9d1448 100644
--- a/dag/gunbc/fleet/fleet_intent_network.dag
+++ b/dag/gunbc/fleet/fleet_intent_network.dag
@@ -32,9 +32,7 @@ import product.network_topology {
 }
 import product.host_identity { HostIdentity, host_identity_eq }
 import gunbc.fleet_host_identity {
-  operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4, operator_host_srv5, operator_host_srv6,
-  operator_host_srv7, operator_host_srv8, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12,
-  operator_host_mtcollins1,
+  operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12, operator_host_mtcollins1,
 }
 
 
@@ -166,68 +164,6 @@ data srv3_host_lan_endpoint: NetworkEndpoint = NetworkEndpoint {
   locality: Lan,
 }
 
-// DCH-0 (2026-09-02). THE TWO ROWS BELOW ARE THE ENROLMENT ACT, and this note says what they do and
-// what they deliberately do not do, because in this module authoring the row IS the act rather than
-// a description of one.
-//
-// ADDRESS PROVENANCE. Both literals are the wireless-keyed CR1000A static reservations transcribed in
-// gunbc.spark.dgx_procurement -- srv5 holds spark_a3ee_reservation (192.168.1.226) and srv6 holds
-// spark_3bd5_reservation (192.168.1.225), joined to these slots by
-// dgx_spark_router_binding_operator_allocation, an attributable OperatorAllocation and not a
-// measurement. THIS IS A SECOND SPELLING OF ONE ADDRESS AND IT IS ADMITTED RATHER THAN HIDDEN: the
-// procurement module imports THIS one for operator_host_srv5/srv6, so a projection from the binding
-// is refused by the import graph's one law -- measured by adding it and compiling, `circular
-// dependency detected: gunbc.fleet_intent_network -> gunbc.spark.dgx_procurement`. The duplication
-// therefore dissolves with the 🟡 dissolve-on note above it: when NetworkEndpoint.address re-grounds
-// onto extdeps.network.address.IpAddress, these two rows converge onto the SAME Ipv4Address value the
-// reservation rows already carry, exactly as srv2/srv3 converge onto gunbc.fleet_reach's rows. Until
-// then the reservation is the authority and this is a transcription of it, marked as one.
-//
-// WHAT ENROLMENT HERE DOES NOT DO, stated because the adjacent act is the dangerous one. Membership in
-// gunbc.fleet_intent's ComputeHost / fleet_intent_known_hosts list is a SEPARATE act with three
-// production consumers, one of which -- gunbc.runner.runner_host_deploy `admit_runner_host` -- is a
-// fail-closed enrolment wall that currently protects these two machines by returning
-// RunnerHostUnenrolled. Nothing here touches that list, so that wall still stands for srv5/srv6.
-//
-// THE LIVE RECONCILIATION IS OUTSTANDING, AND IT IS ALREADY REPRESENTABLE RATHER THAN PROSE. No
-// observed-vs-desired readback of the rendered serving unit has been performed on either host. That
-// obligation needs no new carrier: gunbc.spark.serving_observation_scope derives its observation
-// denominator from dgx_spark_reserved_identities(), which already names srv5 and srv6, so
-// spark_observation_coverage answers SparkObservationIncomplete with both hosts in `missing` until a
-// probe transaction supplies them. The readback needs host access this lane does not hold; the gap is
-// therefore reported by that join and not asserted here.
-data srv5_host_lan_endpoint: NetworkEndpoint = NetworkEndpoint {
-  label: "srv5-host-lan",
-  subject: EndpointHost { host: operator_host_srv5 },
-  address: "192.168.1.226",
-  role: HostOperatingSystem,
-  locality: Lan,
-}
-
-data srv6_host_lan_endpoint: NetworkEndpoint = NetworkEndpoint {
-  label: "srv6-host-lan",
-  subject: EndpointHost { host: operator_host_srv6 },
-  address: "192.168.1.225",
-  role: HostOperatingSystem,
-  locality: Lan,
-}
-
-data srv7_host_lan_endpoint: NetworkEndpoint = NetworkEndpoint {
-  label: "srv7-host-lan",
-  subject: EndpointHost { host: operator_host_srv7 },
-  address: "192.168.1.232",
-  role: HostOperatingSystem,
-  locality: Lan,
-}
-
-data srv8_host_lan_endpoint: NetworkEndpoint = NetworkEndpoint {
-  label: "srv8-host-lan",
-  subject: EndpointHost { host: operator_host_srv8 },
-  address: "192.168.1.233",
-  role: HostOperatingSystem,
-  locality: Lan,
-}
-
 data srv9_host_lan_endpoint: NetworkEndpoint = NetworkEndpoint {
   label: "srv9-host-lan",
   subject: EndpointHost { host: operator_host_srv9 },
@@ -340,14 +276,6 @@ data fleet_intent_network: NetworkTopology = NetworkTopology {
     srv2_host_lan_endpoint,
     srv3_host_lan_endpoint,
     srv4_host_lan_endpoint,
-    srv5_host_lan_endpoint,
-    srv6_host_lan_endpoint,
-    srv7_host_lan_endpoint,
-    srv8_host_lan_endpoint,
-    srv9_host_lan_endpoint,
-    srv10_host_lan_endpoint,
-    srv11_host_lan_endpoint,
-    srv12_host_lan_endpoint,
     srv1_bmc_endpoint,
     srv2_bmc_endpoint,
     srv3_bmc_endpoint,
diff --git a/dag/gunbc/fleet/fleet_multi_principal_probe.dag b/dag/gunbc/fleet/fleet_multi_principal_probe.dag
index 7e0556acd32..f035fb1cb53 100644
--- a/dag/gunbc/fleet/fleet_multi_principal_probe.dag
+++ b/dag/gunbc/fleet/fleet_multi_principal_probe.dag
@@ -36,7 +36,6 @@ import gunbc.fleet_ssh_credential_verify {
 }
 import extdeps.ssh.session { ssh_session_exec_portable_words }
 import v2.std.algebra { list_head, list_tail, HeadFound, HeadAbsent, TailFound, TailAbsent, filter }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6 }
 import product.host_identity { HostIdentity }
 import gunbc.auth.access_token_source { GcloudPrintToken }
 import gunbc.spark.credential_workflow { run_with_materialized_fleet_ssh_binding, spark_administrator_credential_roster_hosts }
@@ -94,7 +93,7 @@ import gunbc.fleet_posix_accounts { fleet_bootstrap_principal_login }
 // It also replaces work rather than adding any: the deleted spark-canary-probe.yml asked exactly
 // this question in hand-authored shell, against this same principal list, and a hand-written
 // workflow is hand-applying (operator ruling, 2026-08-10).
-data multi_principal_probe_hosts: List<String> = ["srv3", "srv4", "srv5", "srv6"]
+data multi_principal_probe_hosts: List<String> = ["srv3", "srv4"]
 
 data multi_principal_probe_principals: List<String> = ["ubuntu", "briansrls", "ghrunner", "root", "gunbc-automation"]
 
diff --git a/dag/gunbc/fleet/fleet_physical_inventory.dag b/dag/gunbc/fleet/fleet_physical_inventory.dag
index e19c6bd07ca..9261d538f41 100644
--- a/dag/gunbc/fleet/fleet_physical_inventory.dag
+++ b/dag/gunbc/fleet/fleet_physical_inventory.dag
@@ -28,8 +28,8 @@ import extdeps.rack.navepoint { navepoint_18u_open_frame_catalog }
 import extdeps.power.eaton_tripp_lite { eaton_tripp_lite_rs_1215_family_catalog }
 import extdeps.cooling.dynatron { dynatron_w1_catalog }
 import extdeps.cpu.ampere { altra_max_m12830_catalog }
-import gunbc.fleet_asset_identity { dgx_spark_01, dgx_spark_02, dgx_spark_03, dgx_spark_04, dgx_spark_05, dgx_spark_06, dgx_spark_07, dgx_spark_08, chassis_srv1, chassis_srv2, chassis_srv3, chassis_srv4, chassis_srv5_placeholder, chassis_srv6_placeholder, switch_01, printer_01, printer_02, ams_01, pdu_01, pi_controller, cooler_srv3, cooler_srv4 }
-import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4, operator_host_srv5, operator_host_srv6 }
+import gunbc.fleet_asset_identity { dgx_spark_01, dgx_spark_02, dgx_spark_03, dgx_spark_04, dgx_spark_05, dgx_spark_06, dgx_spark_07, dgx_spark_08, chassis_srv1, chassis_srv2, chassis_srv3, chassis_srv4, switch_01, printer_01, printer_02, ams_01, pdu_01, pi_controller, cooler_srv3, cooler_srv4 }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 import gunbc.fleet_intent { srv3_baseboard, srv4_baseboard, srv4_memory_population }
 import product.cooling_qualification { InstalledCoolingRealization }
 import std.nat { Nat }
@@ -227,22 +227,6 @@ data fleet_host_spatial_facts: List<HostSpatialFacts> = [
     relay: RelayUnprovisioned,
     bootstrap_need: BootstrapNotNeeded,
   },
-  HostSpatialFacts {
-    host: operator_host_srv5,
-    asset: chassis_srv5_placeholder,
-    residence: rack_01_unobserved_residence,
-    wireless: WirelessAdapterUnobserved,
-    relay: RelayUnprovisioned,
-    bootstrap_need: BootstrapNeeded,
-  },
-  HostSpatialFacts {
-    host: operator_host_srv6,
-    asset: chassis_srv6_placeholder,
-    residence: rack_01_unobserved_residence,
-    wireless: WirelessAdapterUnobserved,
-    relay: RelayUnprovisioned,
-    bootstrap_need: BootstrapNeeded,
-  },
 ]
 
 // FleetOnce wifi-first-relay-standing human burden row is intentionally absent here —
@@ -666,6 +650,9 @@ data dgx_spark_procurement_ledgers: List<InventoryLotEvidence> = [
   InventoryLotEvidence { lot: dgx_spark_ebay_pair_lot, events: dgx_spark_ebay_pair_lot_ledger },
 ]
 
+// THE EIGHT DGX SPARK ASSETS PROCURED AND RECEIVED, not the units held today: four were sold on 2026-10-07,
+// recorded as typed dispositions at gunbc.spark.dgx_procurement dgx_spark_disposed_units. Which four serials
+// they were is not observed (these labels do not claim host-slot order), so no sale is booked against a lot.
 data dgx_spark_asset_identities: List<PhysicalAssetIdentity> = [
   dgx_spark_01, dgx_spark_02, dgx_spark_03, dgx_spark_04,
   dgx_spark_05, dgx_spark_06, dgx_spark_07, dgx_spark_08,
diff --git a/dag/gunbc/fleet/fleet_posix_accounts.dag b/dag/gunbc/fleet/fleet_posix_accounts.dag
index c6d60bf5abc..bb982fc680c 100644
--- a/dag/gunbc/fleet/fleet_posix_accounts.dag
+++ b/dag/gunbc/fleet/fleet_posix_accounts.dag
@@ -238,6 +238,15 @@ data fleet_cp_binary_path: NonEmptyStr = "/usr/bin/cp"
 
 data fleet_mv_binary_path: NonEmptyStr = "/usr/bin/mv"
 
+// THE TWO READ-ONLY METADATA BINARIES THE DEPLOY PLAN OBSERVES DIRECTORIES THROUGH. They are NOT rows
+// of ci_runner_sudo_binaries (no path-unrestricted grant): each is granted only as a pinned-argv
+// ExecutorPrivilegedOperation over one named directory (gunbc.executor_privileged_operation
+// ReadDirectoryIdentity, ListDirectoryEntries), rendered into the runner host's sudoers by
+// gunbc.runner_host_grants. A managed directory whose mode admits only its owner cannot be traversed by
+// the job user, and its standing must still be observable before and after the apply.
+data fleet_stat_binary_path: NonEmptyStr = "/usr/bin/stat"
+data fleet_ls_binary_path: NonEmptyStr = "/usr/bin/ls"
+
 // nft LIVES IN sbin AND IS PRIVILEGED EVEN TO READ: listing a table needs CAP_NET_ADMIN, so a
 // readback of the installed ruleset is a granted command like any mutation.
 data fleet_nft_binary_path: NonEmptyStr = nft_installed_path() as NonEmptyStr
@@ -289,6 +298,8 @@ type CiRunnerSudoBinary
   | SudoNfct
   | SudoCp
   | SudoMv
+  | SudoStat
+  | SudoLs
 
 fn ci_runner_sudo_binary_path(b: CiRunnerSudoBinary) -> NonEmptyStr {
   match b {
@@ -306,6 +317,8 @@ fn ci_runner_sudo_binary_path(b: CiRunnerSudoBinary) -> NonEmptyStr {
     SudoNfct => fleet_nfct_binary_path
     SudoCp => fleet_cp_binary_path
     SudoMv => fleet_mv_binary_path
+    SudoStat => fleet_stat_binary_path
+    SudoLs => fleet_ls_binary_path
   }
 }
 
@@ -325,6 +338,8 @@ fn ci_runner_sudo_binary_probe(b: CiRunnerSudoBinary) -> SudoNopasswdProbeKind {
     SudoNfct => NopasswdExecuteCheck { check_argv: "--version" }
     SudoCp => NopasswdExecuteCheck { check_argv: "--version" }
     SudoMv => NopasswdExecuteCheck { check_argv: "--version" }
+    SudoStat => NopasswdExecuteCheck { check_argv: "--version" }
+    SudoLs => NopasswdExecuteCheck { check_argv: "--version" }
   }
 }
 
diff --git a/dag/gunbc/fleet/fleet_reach_endpoint.dag b/dag/gunbc/fleet/fleet_reach_endpoint.dag
index 708d37b7f32..76d5b8da410 100644
--- a/dag/gunbc/fleet/fleet_reach_endpoint.dag
+++ b/dag/gunbc/fleet/fleet_reach_endpoint.dag
@@ -10,6 +10,8 @@ import gunbc.spark.dgx_procurement {
   dgx_spark_router_bindings,
 }
 import extdeps.network.ipv4 { render_ipv4_address }
+import gunbc.fleet_enrollment { fleet_enrollments }
+import gunbc.fleet_host_identity { operator_host_183527, operator_host_3dde7f }
 
 // Probe-endpoint resolution (bold-eagle-107's projection, offered via witty-raven
 // msg_1c4e0bce; homed HERE — downstream of both gunbc.spark.dgx_procurement and the
@@ -45,7 +47,46 @@ fn spark_endpoint_for_binding(binding: DgxSparkRouterBinding) -> String? {
 // consumes the projection, and the identity it dispatches on comes from
 // gunbc.spark.dgx_procurement router_binding_identity, which is total over the coproduct, rather
 // than from an arm that only the assigned variant reaches.
+// A PROVIDER GUEST IS REACHED AT ITS PUBLIC ADDRESS, BOUND EXPLICITLY. Its identity is opaque and its
+// allocated name has no resolver behind it, so neither may stand in for an address -- the probe would
+// otherwise hand ssh a string nothing resolves. The addresses are the provider's assignment, relayed
+// by the operator (2026-10-07, servers recreated 2026-10-08) and carried with that provenance; the
+// provider API read that binds the resource id (gunbc.provider_guest_adoption) is what grounds them
+// further.
+type ProviderGuestEndpoint {
+  host: HostIdentity
+  ipv4: NonEmptyStr
+  provenance: NonEmptyStr
+}
+
+data provider_guest_endpoints: List<ProviderGuestEndpoint> = [
+  ProviderGuestEndpoint {
+    host: operator_host_183527,
+    ipv4: "178.104.134.135",
+    provenance: "operator relay of the recreated Hetzner Cloud server 'ubuntu-32gb-nbg1-1', logged in as root from srv2, 2026-10-08",
+  },
+  ProviderGuestEndpoint {
+    host: operator_host_3dde7f,
+    ipv4: "62.238.115.145",
+    provenance: "operator relay of the recreated Hetzner Cloud server 'ubuntu-32gb-hel1-1', logged in as root from srv2, 2026-10-08",
+  },
+]
+
+fn provider_guest_endpoint_for(host: String) -> String? {
+  match filter(provider_guest_endpoints, e => (e.host as String) == host).first() {
+    Present { value: e } => Present { value: e.ipv4 as String }
+    Absent => none
+  }
+}
+
 fn fleet_probe_endpoint_for(host: String) -> String {
+  match provider_guest_endpoint_for(host: host) {
+    Present { value: ip } => ip
+    Absent => fleet_owned_probe_endpoint_for(host: host)
+  }
+}
+
+fn fleet_owned_probe_endpoint_for(host: String) -> String {
   fold(dgx_spark_router_bindings, init: host, f: fn(acc, b) {
     if (router_binding_identity(binding: b) as String) == host {
       match spark_endpoint_for_binding(binding: b) {
@@ -76,7 +117,10 @@ fn fleet_probe_endpoint_for(host: String) -> String {
 // one, which is what proves the harness refuses the shape rather than catching the cycle. So the
 // missing multi-module compile fixture is this class's next-rung trigger, not a ceiling: when one
 // exists, the acyclic/cyclic pair above becomes an ordinary enrolled regression control.
-data fleet_reach_probe_targets: List<String> = ["srv1", "srv2", "srv3", "srv4", "srv5", "srv6"]
+//
+// THE ROSTER IS THE ENROLLED FLEET (gunbc.fleet_enrollment), every participation: a host is probed
+// because it is enrolled, so enrolling one adds it here with no edit to this module.
+data fleet_reach_probe_targets: List<String> = map(fleet_enrollments, e => e.host as String)
 
 // Ruling msg_43a8fd77 item 2: the REMOTE PRINCIPAL is an explicit typed fact per host,
 // never the implicit ssh default (local-username inheritance is an absorbing default —
@@ -108,18 +152,12 @@ type FleetProbePrincipal
 // (bootstrap actor unreachable) — a standing DISTINCT from refused and from reachable.
 
 fn fleet_probe_remote_user_for(host: String) -> FleetProbePrincipal {
-  if host == "srv5" || host == "srv6" {
-    ProbeUserPending {
-      note: "bold-eagle-107 (msg_7428d9fc): the account NAME briansrls is well-supported (operator-supplied login for both Sparks; operator confirmed the name collision with the human account is coincidence) but WHICH principal the fleet-key probe authenticated as is unverified recollection — no retained artifact records it, so this stays Pending until a receipt exists (re-measurement needs operator clearance, through the convergence path, per the interactive-Spark stop-order). The KEY axis is typed separately (fleet_ssh_access fleet_automation_ssh_key_fingerprint); both Sparks' authorized_keys carry exactly fleet-automation@gunbc today (bootstrap node-orch key installed then REMOVED from both).",
-    }
+  if host == "srv1" || host == "srv2" {
+    ProbeUserKnown { user: "gunbc-fleet" }
   } else {
-    if host == "srv1" || host == "srv2" {
-      ProbeUserKnown { user: "gunbc-fleet" }
-    } else {
-      PrincipalAllocationPending {
-        allocated: "gunbc-fleet",
-        note: "account allocated but not yet created on this host (msg_8cf3d762: bootstrap actor unreachable); probe targets the allocated name so the refusal is typed at auth, never a fabricated reachable",
-      }
+    PrincipalAllocationPending {
+      allocated: "gunbc-fleet",
+      note: "account allocated but not yet created on this host (msg_8cf3d762: bootstrap actor unreachable); probe targets the allocated name so the refusal is typed at auth, never a fabricated reachable",
     }
   }
 }
diff --git a/dag/gunbc/fleet/fleet_receipt_collector.dag b/dag/gunbc/fleet/fleet_receipt_collector.dag
index 965e1138f75..e2b1c5e4a65 100644
--- a/dag/gunbc/fleet/fleet_receipt_collector.dag
+++ b/dag/gunbc/fleet/fleet_receipt_collector.dag
@@ -31,7 +31,7 @@ import gunbc.fleet_convergence_verdict {
   FleetNotConverged,
   fleet_convergence_verdict,
 }
-import gunbc.host_phase_status { fleet_subsumption_enrollments }
+import gunbc.fleet_enrollment { fleet_enrollments }
 import gunbc.fleet_host_key_enrollment { fleet_host_key_enroll_apply }
 
 // Operator verdict join 5 (2026-08-09): the receipts hosts PUBLISH were consumed by
@@ -266,7 +266,7 @@ fn collect_fleet_convergence_wet() -> ProcessExit {
   let enroll_lines = fleet_host_key_enroll_apply(home: home)
   let collected = map(fleet_reach_probe_targets, h => collect_host_receipt(host: h))
   let verdict = fleet_convergence_verdict(
-    enrollments: fleet_subsumption_enrollments,
+    enrollments: fleet_enrollments,
     receipts: collected_receipts_only(collected: collected),
   )
   let verdict_line = match verdict {
diff --git a/dag/gunbc/fleet/fleet_release_bins_key.dag b/dag/gunbc/fleet/fleet_release_bins_key.dag
index a85e69d4457..bbe1512776c 100644
--- a/dag/gunbc/fleet/fleet_release_bins_key.dag
+++ b/dag/gunbc/fleet/fleet_release_bins_key.dag
@@ -3,7 +3,7 @@ module gunbc.fleet_release_bins_key
 import std.types { String, List, Bool, Int, list_length }
 import std.measure { Second, second, second_count, seconds_per_day }
 import v2.std.node { Node }
-import v2.std.diagnostic { Outcome, Accepted, Rejected, outcome_accepted }
+import v2.std.diagnostic { Outcome, Accepted, Rejected, NonEmptyDiagnostics, outcome_accepted, diagnostics_reason_lexemes }
 import v2.workflow.bash_emit { bash_emit_stmts }
 import extdeps.shell.exec { TransportScript, transport_script_seal }
 import std.optional { Present, Absent }
@@ -45,7 +45,7 @@ import extdeps.git.object_store { git_object_type_wire_name }
 import gunbc.ci_release_bins { ci_floor_required_artifact_names, ci_floor_invoked_bins }
 import gunbc.repo_self_build { repo_self_build_command }
 import gunbc.ci_spec { ci_release_build_line, ci_release_bins_archive_name }
-import gunbc.ci_failure_class { floor_attempt_command_log_filename }
+import gunbc.ci_failure_class { floor_attempt_command_log_filename, wrap_command_with_floor_attempt_receipt }
 
 // THE RELEASE-BINS PACK IS A CONTENT-ADDRESSED MATERIALIZATION, KEYED BEFORE IT IS BUILT (operator
 // ruling 2026-09-27, route B chosen by eager-owl-205: the fleet-converge build job is the keyed
@@ -337,9 +337,11 @@ type ReleaseBinsRefusal
   | BuildDiagnosticsMissing { file: String }
   | SidecarMissing { file: String }
   | ConsumerProductKindMismatch { kind: String }
+  | ScriptEmissionRefused { script: String, reasons: String }
 
 fn release_bins_refusal_name(refusal: ReleaseBinsRefusal) -> String {
   match refusal {
+    ScriptEmissionRefused { script: _, reasons: _ } => "ScriptEmissionRefused"
     AddressFamilyNotAdmitted => "AddressFamilyNotAdmitted"
     SourceTreeDirty => "SourceTreeDirty"
     AxisValueUnread { variable: _ } => "AxisValueUnread"
@@ -373,6 +375,7 @@ fn release_bins_refusal_name(refusal: ReleaseBinsRefusal) -> String {
 
 fn release_bins_refusal_message(refusal: ReleaseBinsRefusal) -> String {
   match refusal {
+    ScriptEmissionRefused { script: sc, reasons: rs } => join(["REFUSED ", sc, ": v2.workflow.bash_emit refused its statements (", rs, ")"], "")
     AddressFamilyNotAdmitted => "std.materialization_provider no longer admits sha256 at CrossRunScope; the release-bins address has no admitted family"
     AxisValueUnread { variable: v } => join(["the key input ", v, " read back empty, so the key would not name the build; refusing to key"], "")
     SourceTreeDirty => "tracked files differ from HEAD, so HEAD^\{tree} does not name the build input; refusing to key"
@@ -1380,8 +1383,12 @@ fn release_bins_consumer_script_dispatch(pair_modes: List<String>) -> String {
   release_bins_mode_dispatch(pair_modes: pair_modes, pair_text: release_bins_consumer_key_check_script_for(product: compiler_pair_release_product()), fleet_text: release_bins_consumer_key_check_script())
 }
 
+// The pair's pack includes the build diagnostics. Use the floor's existing capture wrapper,
+// which writes that log and preserves a failed compiler exit through tee.
 fn release_bins_build_script_dispatch(pair_modes: List<String>, fleet_build: String) -> String {
-  release_bins_mode_dispatch(pair_modes: pair_modes, pair_text: compiler_pair_release_product().build_line, fleet_text: fleet_build)
+  release_bins_mode_dispatch(pair_modes: pair_modes,
+    pair_text: wrap_command_with_floor_attempt_receipt(command: compiler_pair_release_product().build_line),
+    fleet_text: fleet_build)
 }
 
 // THE EMITTED SCRIPTS, and the one admission the workflow generation consumes: if the fold refuses any
@@ -1415,10 +1422,23 @@ fn release_bins_joined(parts: List<Outcome<String>>) -> Outcome<String> {
   })
 }
 
+// A REFUSED RUNNER IS A REFUSING STEP, NEVER AN EMPTY ONE. Its text is the ScriptEmissionRefused
+// refusal built from nodes and emitted through bash_emit like every other statement. The last arm is
+// reached only if the emitter refuses that fixed refusal statement too: its text is a marker that is
+// not shell, so the step cannot run and the committed-workflow drift gate goes red.
+data script_emission_refusal_unemittable_marker: String = "__GUNBC_SCRIPT_EMISSION_REFUSAL_UNEMITTABLE__"
+
+fn script_emission_refused_text(script: String, diagnostics: NonEmptyDiagnostics) -> String {
+  match release_bins_emitted(statements: [refuse(r: ScriptEmissionRefused { script: script, reasons: diagnostics_reason_lexemes(diagnostics: diagnostics) })]) {
+    Accepted { value: v, diagnostics: _ } => v
+    Rejected { diagnostics: _ } => script_emission_refusal_unemittable_marker
+  }
+}
+
 fn release_bins_script_text(outcome: Outcome<String>) -> String {
   match outcome {
     Accepted { value: v, diagnostics: _ } => v
-    Rejected { diagnostics: _ } => ""
+    Rejected { diagnostics: ds } => script_emission_refused_text(script: "gunbc.fleet_release_bins_key release_bins_script_text", diagnostics: ds)
   }
 }
 
diff --git a/dag/gunbc/fleet/fleet_runner_connectivity.dag b/dag/gunbc/fleet/fleet_runner_connectivity.dag
index 32b5b6ee3c5..8ea6e2d8ed7 100644
--- a/dag/gunbc/fleet/fleet_runner_connectivity.dag
+++ b/dag/gunbc/fleet/fleet_runner_connectivity.dag
@@ -16,6 +16,7 @@ import extdeps.github.effect { GitHubOrganizationRef }
 import gunbc.auth.github_apps { gunbai_ci_declared }
 import gunbc.build_cache_instance { RunnerSlotIdentity, runner_slot_index_suffix, runner_slot_instance_name_prefix, slot_name_could_belong_to_host }
 import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
+import gunbc.fleet_enrollment { runner_executor_hosts }
 import gunbc.runner_slot_allocation {
   committed_slot_identities,
   CommittedSlotPopulation, CommittedPopulationDerived, CommittedPopulationWidthUnresolved,
@@ -547,16 +548,7 @@ fn local_incarnations_for_host(host: HostIdentity, width: Int) -> List<LocalRunn
 }
 
 fn local_runner_slot_incarnations() -> List<LocalRunnerSlotIncarnation> {
-  concat(
-    local_incarnations_for_host(host: operator_host_srv1, width: materialized_width_for_host(host: operator_host_srv1)),
-    concat(
-      local_incarnations_for_host(host: operator_host_srv2, width: materialized_width_for_host(host: operator_host_srv2)),
-      concat(
-        local_incarnations_for_host(host: operator_host_srv3, width: materialized_width_for_host(host: operator_host_srv3)),
-        local_incarnations_for_host(host: operator_host_srv4, width: materialized_width_for_host(host: operator_host_srv4))
-      )
-    )
-  )
+  flat_map(fleet_hosts(), h => local_incarnations_for_host(host: h, width: materialized_width_for_host(host: h)))
 }
 
 fn partial_roster_unseen_reason(observed_count: Int, authority_total: Int) -> String {
@@ -693,8 +685,13 @@ fn count_executing_registrations(registrations: List<GitHubSelfHostedRunnerRegis
   )
 }
 
+// The runner-executor population, derived from the enrollment root rather than listed here
+// (gunbc.fleet_enrollment runner_executor_hosts): CI-enrolled hosts whose backing does not forbid the
+// execution path. Consumers fold it as the hosts a pinned runner can execute on -- the workflow host
+// choice, the eligible compile set, committed slot identities -- so a provider guest refused that
+// path is not a member, and its refusal is read from the CI enrollment instead.
 fn fleet_hosts() -> List<HostIdentity> {
-  [operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4]
+  runner_executor_hosts()
 }
 
 // THE 2026-08-06 CORPUS IS PINNED ON EVERY HOST, NOT JUST srv4, AND THAT IS THE WHOLE POINT. This
diff --git a/dag/gunbc/fleet/fleet_site_locale.dag b/dag/gunbc/fleet/fleet_site_locale.dag
index abcf3e8223a..3c695d7c013 100644
--- a/dag/gunbc/fleet/fleet_site_locale.dag
+++ b/dag/gunbc/fleet/fleet_site_locale.dag
@@ -21,7 +21,7 @@ import std.types { NonEmptyStr, Bool, List, Int }
 import product.placement_supply { SiteIdentity }
 import product.host_identity { HostIdentity }
 import gunbc.fleet_physical_inventory { operator_site }
-import gunbc.fleet_host_identity { operator_host_srv4, operator_host_srv5, operator_host_srv6 }
+import gunbc.fleet_host_identity { operator_host_srv4 }
 import gunbc.spark.dgx_procurement {
   DgxSparkRouterBinding,
   SlotAssigned,
@@ -217,8 +217,6 @@ type ObservedHostZone {
 // to report -- the ought is the derivation's job, and fusing them would rebuild the fork.
 data observed_host_zones: List<ObservedHostZone> = [
   ObservedHostZone { host: operator_host_srv4, observed_zone: zone_etc_utc },
-  ObservedHostZone { host: operator_host_srv5, observed_zone: zone_etc_utc },
-  ObservedHostZone { host: operator_host_srv6, observed_zone: zone_america_new_york },
 ]
 
 // THE PI IS MEASURED AND DELIBERATELY NOT GIVEN AN IDENTITY HERE. A reading was taken over "pi1"
@@ -255,8 +253,6 @@ type HostSiteAssignment {
 
 data fleet_host_site_assignments: List<HostSiteAssignment> = [
   HostSiteAssignment { host: operator_host_srv4, site: operator_site },
-  HostSiteAssignment { host: operator_host_srv5, site: operator_site },
-  HostSiteAssignment { host: operator_host_srv6, site: operator_site },
 ]
 
 // Three outcomes, not two, and the missing case is not folded into the mismatch case: a host with
diff --git a/dag/gunbc/fleet/fleet_wireless_link.dag b/dag/gunbc/fleet/fleet_wireless_link.dag
index 61ea99e600e..7b6aba548c1 100644
--- a/dag/gunbc/fleet/fleet_wireless_link.dag
+++ b/dag/gunbc/fleet/fleet_wireless_link.dag
@@ -37,10 +37,6 @@ import extdeps.netplan.netplan {
 import extdeps.systemd.journalctl { journalctl_kernel_current_boot_argv, journalctl_unit_current_boot_argv }
 import gunbc.spark.dgx_procurement { dgx_spark_procurement_intent }
 import gunbc.spark.host_effect_quiescence { ArgvRun, ArgvRan, ArgvLegDidNotRun, ArgvLegMayHaveRun }
-import gunbc.fleet_host_identity {
-  operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8,
-  operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12,
-}
 
 // ── DESIRED ──────────────────────────────────────────────────────────────────────────────────
 //
@@ -124,10 +120,7 @@ fn spark_wireless_link_desired(host: HostIdentity) -> WirelessLinkDesired {
 // /run/NetworkManager/system-connections/netplan-NM-a653b65d-...; an nmcli modify is written back to
 // /etc/netplan/90-NM-a653b65d-....yaml, so it persists). The radio is now measured, so it has a row,
 // and wireless_link_uncovered_spark_hosts keeps the next omission from being silent.
-data wireless_link_desired_rows: List<WirelessLinkDesired> = map(
-  [operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12],
-  h => spark_wireless_link_desired(host: h),
-)
+data wireless_link_desired_rows: List<WirelessLinkDesired> = []
 
 fn wireless_link_desired_for(host: HostIdentity) -> WirelessLinkDesired? {
   first(filter(wireless_link_desired_rows, d => host_identity_eq(a: d.host, b: host)))
diff --git a/dag/gunbc/fleet/fleet_workflow_steps.dag b/dag/gunbc/fleet/fleet_workflow_steps.dag
index 63a02d8cf08..85a76efd466 100644
--- a/dag/gunbc/fleet/fleet_workflow_steps.dag
+++ b/dag/gunbc/fleet/fleet_workflow_steps.dag
@@ -63,7 +63,6 @@ import gunbc.ci_spec {
 }
 import gunbc.fleet_host_key_enrollment { probe_identity_secret_access_requirement }
 import gunbc.spark.vllm_runtime_image_build { vllm_build_host_effect_term }
-import gunbc.spark.group_image_produce { image_distribution_host_effect_term }
 import std.types { List, String, Int }
 
 import gunbc.roadmap_execution_contract {
@@ -208,6 +207,15 @@ fn ci_setup_rust_step() -> Step {
 }
 
 fn ci_cache_cargo_step() -> Step {
+  ci_cache_cargo_step_under(condition: Present { value: release_bins_build_condition() })
+}
+
+// THE SAME CACHE STEP UNDER A CALLER-SUPPLIED CONDITION. The keyed-miss condition above belongs to
+// the compiler-pair product; a job that builds the seed on every run (gunbc.compiler_gate_workflow's
+// required `witnesses` job, which may reuse Cargo dependencies and ordinary compilation
+// intermediates but never a restored final product -- operator ruling 2026-10-09) restores and saves
+// the cache unconditionally. One step, two conditions, rather than two spellings of the paths and key.
+fn ci_cache_cargo_step_under(condition: String?) -> Step {
   UsesStep {
     name: Present { value: "Cache Cargo" },
     id: none,
@@ -220,7 +228,7 @@ fn ci_cache_cargo_step() -> Step {
       ]
     },
     env: none,
-    if_condition: Present { value: release_bins_build_condition() },
+    if_condition: condition,
     continue_on_error: none,
     timeout_minutes: none
   }
@@ -562,11 +570,15 @@ fn ci_release_bins_unpack_verify_step() -> Step {
   }
 }
 
-fn ci_fleet_wif_auth_step() -> Step {
-  ci_wif_auth_step_for(
-    name: "WIF auth (OIDC -> fleet-cloud-convergence SA, access token only)",
-    provider_resource: probe_identity_secret_access_requirement.wif_provider_resource,
-    service_account: probe_identity_secret_access_requirement.service_account,
+fn ci_fleet_wif_auth_step() -> Step { ci_fleet_wif_auth_step_when(if_condition: none) }
+
+fn ci_fleet_wif_auth_step_when(if_condition: String?) -> Step {
+  ci_wif_auth_step_with_condition(
+    "WIF auth (OIDC -> fleet-cloud-convergence SA, access token only)",
+    "wif_auth",
+    probe_identity_secret_access_requirement.wif_provider_resource,
+    probe_identity_secret_access_requirement.service_account,
+    if_condition,
   )
 }
 
@@ -580,6 +592,10 @@ fn ci_wif_auth_step_for(name: String, provider_resource: String, service_account
 // The same step under a caller-chosen id, for a job that federates to more than one identity under
 // disjoint conditions (step ids are unique per job even when their conditions are exclusive).
 fn ci_wif_auth_step_with_id(name: String, id: String, provider_resource: String, service_account: String) -> Step {
+  ci_wif_auth_step_with_condition(name: name, id: id, provider_resource: provider_resource, service_account: service_account, if_condition: none)
+}
+
+fn ci_wif_auth_step_with_condition(name: String, id: String, provider_resource: String, service_account: String, if_condition: String?) -> Step {
   UsesStep {
     name: Present { value: name },
     id: Present { value: id },
@@ -593,7 +609,7 @@ fn ci_wif_auth_step_with_id(name: String, id: String, provider_resource: String,
       ]
     },
     env: none,
-    if_condition: none,
+    if_condition: if_condition,
     continue_on_error: none,
     timeout_minutes: Present { value: gunbc_ci_aux_step_timeout_minutes }
   }
@@ -679,13 +695,6 @@ fn gunbc_ci_spark_runtime_image_build_step_timeout_minutes() -> Int {
   second_count(s: vllm_build_host_effect_term) / 60
 }
 
-// THE SAME DERIVATION FOR THE PRODUCED IMAGE'S DISTRIBUTION: its step budget is the term both of
-// its host-effect claims are admitted for (gunbc.spark.v41_runtime_image_converge
-// v41_image_distribution_host_effect_term).
-fn gunbc_ci_spark_runtime_image_distribute_step_timeout_minutes() -> Int {
-  second_count(s: image_distribution_host_effect_term) / 60
-}
-
 data gunbc_ci_spark_serving_step_timeout_note: String = "Spark serving converge/observe step budget, raised from the shared aux 5m (operator authorization 2026-08-19). STATED AS AN ENVELOPE, NOT A MEASUREMENT, because the neighbouring gates in this module earn their numbers and this one cannot yet. What IS modeled: the ollama runtime archive at 1542416321 bytes, cited on extdeps.ollama.binary_release. What is NOT: the model blob closure has no modeled byte size at all — the desired model is identified by its manifest digest rather than a size — and throughput from the executor to a spark target has never been measured. So a cold install downloads a ~1.5GB runtime plus a model of unmodeled size over a link of unmeasured bandwidth, and no honest derivation produces a minute count from that. 5m was not a considered budget for this step, it was the shared aux default, and it cannot cover a cold install under any plausible bandwidth.
 
 WHAT IS OBSERVED, and why this is not a hypothetical envelope: run 32213195686 (2026-08-19T03:49:56Z, read-only spark_observe) reports state=absent for BOTH spark targets — on srv6 the user unit is-active exits 4, the api/version and api/tags probes exit 7 against a refused connection, and the runtime receipt file does not exist. So the first canary is a guaranteed cold install of the full closure rather than a converged no-op, and the step budget has to cover acquisition of an unmodeled model closure on a host observed to hold none of it. The 5m default would have killed that install mid-download every time, and because publication is split from acquisition it would have done so silently-safely — dying in the attempt workspace, publishing nothing, and looking like a timeout rather than a budget defect.
@@ -844,10 +853,10 @@ data fleet_host_mutation_concurrency_group_expression: String = join([fleet_host
 // needed. This row stays the host-domain authority and is unchanged by that.
 data fleet_arm_mutation_group_glm_group_b_native: String = "gunbc-arm-mutation-glm-group-b-native"
 
-// Group A's arm key IS srv1's host key (gunbc.fleet.fleet_converge_workflow: the D0 door has two
-// domains, the srv1 control plane and Group A, and a job carries one group), so the pair-serving
-// apply keyed here queues behind D0 and behind every srv1 mutation whichever executor it names.
-data fleet_arm_mutation_group_deepseek_group_a: String = join([fleet_host_mutation_group_prefix, operator_host_srv1 as String], "")
+// THE srv1 CONTROL-PLANE KEY: srv1's host key, named for what it serialises. The pair-serving apply is
+// keyed here so it queues behind every srv1 mutation whichever executor it names. (It was Group A's arm
+// key while Group A and D0 existed; both were deleted on 2026-10-07.)
+data fleet_srv1_control_plane_mutation_group: String = join([fleet_host_mutation_group_prefix, operator_host_srv1 as String], "")
 
 // A SUBJECT NARROWER THAN ITS HOST GETS ITS OWN KEY WHEN NO OTHER MODE MUTATES IT (operator request
 // 2026-10-03). The approval device store -- gunbc.auth.approval_device_redemption
diff --git a/dag/gunbc/fleet/hetzner_cloud_acquisition.dag b/dag/gunbc/fleet/hetzner_cloud_acquisition.dag
new file mode 100644
index 00000000000..75c1cf7962f
--- /dev/null
+++ b/dag/gunbc/fleet/hetzner_cloud_acquisition.dag
@@ -0,0 +1,72 @@
+module gunbc.hetzner_cloud_acquisition
+
+import gunbc.secret_provision { fleet_secret_ref, secret_ref_pin_version }
+import std.types { List, NonEmptyStr }
+import extdeps.cloud.gcp.secret_ref { SecretRef }
+import extdeps.cloud.hetzner_cloud_api { HetznerTokenPermission, HetznerTokenRead, HetznerTokenReadWrite }
+import gunbc.provider_acquisition { ProviderApiAccount, ProviderResourceAcquisition, OperatorPerformed }
+import gunbc.auth.gcp_secret_access { SecretAccessGrant, secret_accessor_grant }
+
+// THE HETZNER CLOUD PROJECT THE FLEET'S GUESTS ARE HELD UNDER. A Hetzner Cloud API token is scoped to
+// exactly one project, so the project is the account. The operator created its Read & Write token
+// and stored it in Secret Manager on 2026-10-08; gunbc reads it by reference and never holds its
+// value. Version 1 is pinned: its metadata was read on 2026-10-08 as ENABLED, and it is the only
+// version. NO ACCOUNT HOLDS IT YET: it can rebuild or delete any server of the project, so it waits
+// for the reset loop's main-only controller rather than reaching any run of branch code.
+data hetzner_cloud_default_project: ProviderApiAccount = ProviderApiAccount {
+  account: "default",
+  api_credential: secret_ref_pin_version(ref: fleet_secret_ref(secret_id: "hetzner-cloud-default-api-key"), version: "1"),
+}
+
+// A PROJECT TOKEN AS ITS HOLDER RECEIVES IT: the project, what the token was created to permit, and
+// where it is stored. The permission is the console's record at creation; the read below is what
+// would show a mislabelled one, because a Read token is refused on any write.
+type HetznerProjectToken {
+  project: NonEmptyStr
+  permission: HetznerTokenPermission
+  credential: SecretRef
+}
+
+data hetzner_cloud_default_read_write_token: HetznerProjectToken = HetznerProjectToken {
+  project: hetzner_cloud_default_project.account,
+  permission: HetznerTokenReadWrite,
+  credential: hetzner_cloud_default_project.api_credential,
+}
+
+// THE READ-ONLY TOKEN OF THE SAME PROJECT, which is all an approved branch run may receive: whatever
+// that run's code does with it, Hetzner refuses every request but a GET. The operator creates it in
+// the console with permission Read and stores it as the secret's first version.
+data hetzner_cloud_default_read_token: HetznerProjectToken = HetznerProjectToken {
+  project: hetzner_cloud_default_project.account,
+  permission: HetznerTokenRead,
+  credential: secret_ref_pin_version(ref: fleet_secret_ref(secret_id: "hetzner-cloud-default-read-api-key"), version: "1"),
+}
+
+// THE ONE CELL AN APPROVED BRANCH RUN NEEDS: read the Read token's pinned version. Held by the
+// run-scoped hetzner-cloud-control account (gunbc.auth.branch_dispatch_federation); it reads, it
+// never adds a version, so no viewer or versionAdder cell is owed. Only a Read token is admitted
+// here: a run-scoped account reaches branch code, so a write-capable token here would let one
+// approved read become any write the project allows.
+fn hetzner_cloud_api_grants() -> List<SecretAccessGrant> {
+  [secret_accessor_grant(target: hetzner_cloud_default_read_token.credential)]
+}
+
+// THE TWO CAX41 GUESTS, AS THE OPERATOR ACQUIRED THEM. Every step was performed in the Hetzner Cloud
+// console and relayed into the session that enrolled them; the server ids are the console's own
+// resource numbers. Both servers were recreated on 2026-10-08 (the first pair was replaced), so these
+// rows name the recreated ids.
+data hetzner_cax41_nbg1_1_acquisition: ProviderResourceAcquisition = ProviderResourceAcquisition {
+  resource_id: "169308819",
+  account: hetzner_cloud_default_project,
+  account_established: OperatorPerformed { performed_on: "2026-10-07", relayed: "operator ordered the first CAX41 pair under the default project" },
+  login_key_registered: OperatorPerformed { performed_on: "2026-10-08", relayed: "operator ticked the project's srv2, MacBook and fleet-automation keys at creation; root login from srv2 verified" },
+  resource_acquired: OperatorPerformed { performed_on: "2026-10-08", relayed: "console: cax41 #169308819 ubuntu-32gb-nbg1-1 178.104.134.135 2a01:4f8:1c19:4ed0::/64" },
+}
+
+data hetzner_cax41_hel1_1_acquisition: ProviderResourceAcquisition = ProviderResourceAcquisition {
+  resource_id: "169308796",
+  account: hetzner_cloud_default_project,
+  account_established: OperatorPerformed { performed_on: "2026-10-07", relayed: "operator ordered the first CAX41 pair under the default project" },
+  login_key_registered: OperatorPerformed { performed_on: "2026-10-08", relayed: "operator ticked the project's srv2, MacBook and fleet-automation keys at creation; root login from srv2 verified" },
+  resource_acquired: OperatorPerformed { performed_on: "2026-10-08", relayed: "console: cax41 #169308796 ubuntu-32gb-hel1-1 62.238.115.145 2a01:4f9:c015:a9ca::/64" },
+}
diff --git a/dag/gunbc/fleet/hetzner_cloud_guest.dag b/dag/gunbc/fleet/hetzner_cloud_guest.dag
new file mode 100644
index 00000000000..e7025877337
--- /dev/null
+++ b/dag/gunbc/fleet/hetzner_cloud_guest.dag
@@ -0,0 +1,21 @@
+module gunbc.hetzner_cloud_guest
+
+import std.decl_ref { DeclarationRef }
+import extdeps.cloud.hetzner { HetznerCloudServerCatalogRow, hetzner_cloud_nested_virtualization_available, hetzner_cloud_metadata_instance_id_url }
+import gunbc.fleet_host_backing { GuestEntitlement }
+
+// Hetzner Cloud's adapter onto the generic guest entitlement. Every figure is read off the cited
+// catalog row it is handed, and nested virtualization off the cited product fact, so the entitlement
+// cannot drift from the offer it names. The row's own declaration is passed alongside as `offer`
+// because a value does not carry the name it was declared under, and the entitlement must cite it.
+fn hetzner_cloud_guest_entitlement(row: HetznerCloudServerCatalogRow, offer: DeclarationRef) -> GuestEntitlement {
+  GuestEntitlement {
+    offer: offer,
+    architecture: row.cpu_architecture,
+    vcpus: row.vcpus,
+    memory: row.memory_bytes,
+    disk: row.disk_bytes,
+    nested_virtualization: hetzner_cloud_nested_virtualization_available,
+    self_identity_url: hetzner_cloud_metadata_instance_id_url,
+  }
+}
diff --git a/dag/gunbc/fleet/hetzner_cloud_server_control.dag b/dag/gunbc/fleet/hetzner_cloud_server_control.dag
new file mode 100644
index 00000000000..c215294d98e
--- /dev/null
+++ b/dag/gunbc/fleet/hetzner_cloud_server_control.dag
@@ -0,0 +1,104 @@
+module gunbc.hetzner_cloud_server_control
+
+import std.types { Bool, Int, List, NonEmptyStr, Secret, String }
+import std.resources { Network }
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.transports.rest { RestAnswered, RestRefused, RestRefusal, RestStatusRefused, RestTransportRefused, RestBodyUndecodable }
+import extdeps.cloud.hetzner_cloud_api
+import extdeps.cloud.hetzner_cloud_api {
+  HetznerServerResponse, HetznerServerRead, HetznerServerObserved, HetznerServerReadRefused,
+  classify_hetzner_server_get,
+}
+import gunbc.provider_acquisition { ProviderResourceAcquisition }
+import gunbc.hetzner_cloud_server_reading {
+  AcquiredServerRead, AcquiredServerIdUnparsed, acquired_server_id, judge_acquired_server_read, acquired_server_read_line, acquired_server_observed,
+}
+import gunbc.hetzner_cloud_acquisition {
+  hetzner_cloud_default_read_token, HetznerProjectToken, hetzner_cax41_nbg1_1_acquisition, hetzner_cax41_hel1_1_acquisition,
+}
+import gunbc.auth.access_token_source {
+  resolve_access_token, AccessTokenReady, AccessTokenUpsertRequired, AccessTokenEnsureRefused,
+  access_token_upsert_required_reason,
+}
+import gunbc.auth.secret_ref_credential {
+  fetch_secret_ref_credential_with_token, SecretCredentialReady, SecretCredentialAccessUpsertRequired,
+  SecretCredentialWireDecodeRefused, SecretCredentialFetchRefused, SecretCredentialResolvedVersionMismatch,
+}
+
+// THE FLEET'S HANDS ON A HETZNER CLOUD GUEST THROUGH ITS PROVIDER: the out-of-band route
+// gunbc.host_control_route ProviderApiControlRoute names, driven from a controller with the
+// project's token read from Secret Manager by reference. Nothing here runs on the guest.
+
+// THE CUSTODY LADDER, as gunbc.cloudflare.r2_bucket_ensure walks it: the run's resolved GCP identity,
+// then the exact pinned version of the account's token. Each absence refuses before any Hetzner call.
+type HetznerCredentials
+  = HetznerCredentialsReady { token: Secret }
+  | HetznerCredentialsRefused { cause: NonEmptyStr }
+
+fn hetzner_credentials(token: HetznerProjectToken) -> HetznerCredentials uses net: Network {
+  match resolve_access_token() {
+    AccessTokenUpsertRequired { plan: plan } =>
+      HetznerCredentialsRefused { cause: concat("NO GCP ACCESS TOKEN: ", access_token_upsert_required_reason(plan: plan)) as NonEmptyStr }
+    AccessTokenEnsureRefused { reason: reason } =>
+      HetznerCredentialsRefused { cause: concat("NO GCP ACCESS TOKEN: ", reason as String) as NonEmptyStr }
+    AccessTokenReady { token: gcp_token } =>
+      match fetch_secret_ref_credential_with_token(secret_ref: token.credential, access_token: gcp_token) {
+        SecretCredentialAccessUpsertRequired { plan: _ } =>
+          HetznerCredentialsRefused { cause: "THE HETZNER TOKEN COULD NOT BE READ: the access ensure requires an interactive authentication this run cannot perform" as NonEmptyStr }
+        SecretCredentialFetchRefused { reason: reason } =>
+          HetznerCredentialsRefused { cause: concat("THE HETZNER TOKEN COULD NOT BE READ: ", reason as String) as NonEmptyStr }
+        SecretCredentialWireDecodeRefused { identity_cause: _, payload_cause: _ } =>
+          HetznerCredentialsRefused { cause: "THE HETZNER TOKEN COULD NOT BE READ: the access response did not decode" as NonEmptyStr }
+        SecretCredentialResolvedVersionMismatch { requested: requested, resolved: resolved } =>
+          HetznerCredentialsRefused { cause: join(["THE HETZNER TOKEN READ ANSWERED ABOUT ANOTHER VERSION: asked for ", requested, ", answered about ", resolved], "") as NonEmptyStr }
+        SecretCredentialReady { credential: token, resolved_version: _ } => HetznerCredentialsReady { token: token }
+      }
+  }
+}
+
+// ── reading one acquired server ─────────────────────────────────────────────────────────────────
+
+fn read_acquired_server(token: Secret, acquisition: ProviderResourceAcquisition) -> AcquiredServerRead uses net: Network {
+  match acquired_server_id(acquisition: acquisition) {
+    Absent => AcquiredServerIdUnparsed { acquisition: acquisition }
+    Present { value: id } => judge_acquired_server_read(
+      acquisition: acquisition,
+      id: id,
+      read: classify_hetzner_server_get(outcome: match hcloud.Servers.Get(auth_token: token, server_id: id) {
+        RestAnswered { answer: got } => RestAnswered { answer: HetznerServerResponse { id: got.id, name: got.name, status: got.status } }
+        RestRefused { refusal } => RestRefused { refusal: refusal }
+      }),
+    )
+  }
+}
+
+// ── the read-only entry ─────────────────────────────────────────────────────────────────────────
+
+data hetzner_cloud_acquired_servers: List<ProviderResourceAcquisition> = [
+  hetzner_cax41_nbg1_1_acquisition,
+  hetzner_cax41_hel1_1_acquisition,
+]
+
+data hetzner_cloud_server_read_receipt_path: String = "target/hetzner-cloud-server-read-receipt.txt"
+
+// READS EVERY ACQUIRED SERVER AND CHANGES NOTHING: the token's first use, before any rebuild, so a
+// credential or identity fault refuses on a call that cannot cost a guest its disk.
+// `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/fleet/hetzner_cloud_server_control.dag --function read`
+fn read() -> ProcessExit uses net: Network {
+  match hetzner_credentials(token: hetzner_cloud_default_read_token) {
+    HetznerCredentialsRefused { cause: cause } => exit_failure(reason: cause as String)
+    HetznerCredentialsReady { token: token } => {
+      let reads = map(hetzner_cloud_acquired_servers, a => read_acquired_server(token: token, acquisition: a))
+      let text = join(map(reads, r => acquired_server_read_line(read: r)), "\n")
+      let written = Filesystem.Write(path: hetzner_cloud_server_read_receipt_path, content: text)
+      if !written.success {
+        exit_failure(reason: concat("THE RECEIPT COULD NOT BE WRITTEN: ", written.error))
+      } else if (filter(reads, r => !acquired_server_observed(read: r)) |> count) == 0 {
+        ExitSuccess
+      } else {
+        exit_failure(reason: text)
+      }
+    }
+  }
+}
diff --git a/dag/gunbc/fleet/hetzner_cloud_server_reading.dag b/dag/gunbc/fleet/hetzner_cloud_server_reading.dag
new file mode 100644
index 00000000000..10f159424a3
--- /dev/null
+++ b/dag/gunbc/fleet/hetzner_cloud_server_reading.dag
@@ -0,0 +1,62 @@
+module gunbc.hetzner_cloud_server_reading
+
+import std.types { Bool, Int, String }
+import std.optional { Present, Absent }
+import extdeps.transports.rest { RestRefusal, RestStatusRefused, RestTransportRefused, RestBodyUndecodable }
+import extdeps.cloud.hetzner_cloud_api { HetznerServerResponse, HetznerServerRead, HetznerServerObserved, HetznerServerReadRefused }
+import gunbc.provider_acquisition { ProviderResourceAcquisition }
+
+// ONE ACQUIRED SERVER AS THE CLOUD API ANSWERED ABOUT IT, judged against its acquisition row. Pure:
+// the exchange is gunbc.hetzner_cloud_server_control's, and this is what both it and the control
+// route (gunbc.host_control_route) read, so the route does not import the transport.
+
+// THE SERVER THE API ANSWERED ABOUT MUST BE THE ONE ACQUIRED. A resource id that does not parse, or an
+// answer about another id, refuses: the acquisition row is the only authority for which server a
+// host is, and a read that cannot be joined to it establishes nothing about that host.
+type AcquiredServerRead
+  = AcquiredServerObserved { acquisition: ProviderResourceAcquisition, server: HetznerServerResponse }
+  | AcquiredServerIdUnparsed { acquisition: ProviderResourceAcquisition }
+  | AcquiredServerAnsweredForAnother { acquisition: ProviderResourceAcquisition, observed: Int }
+  | AcquiredServerReadRefused { acquisition: ProviderResourceAcquisition, refusal: RestRefusal }
+
+fn acquired_server_id(acquisition: ProviderResourceAcquisition) -> Int? {
+  parse_int(s: acquisition.resource_id as String)
+}
+
+fn judge_acquired_server_read(acquisition: ProviderResourceAcquisition, id: Int, read: HetznerServerRead) -> AcquiredServerRead {
+  match read {
+    HetznerServerReadRefused { refusal: r } => AcquiredServerReadRefused { acquisition: acquisition, refusal: r }
+    HetznerServerObserved { server: s } =>
+      if s.id == id { AcquiredServerObserved { acquisition: acquisition, server: s } }
+      else { AcquiredServerAnsweredForAnother { acquisition: acquisition, observed: s.id } }
+  }
+}
+
+fn rest_refusal_line(r: RestRefusal) -> String {
+  match r {
+    RestStatusRefused { status, body } => join(["status ", to_string(status as Int), ": ", body], "")
+    RestTransportRefused { cause } => concat("no response: ", cause as String)
+    RestBodyUndecodable { status, cause } => join(["status ", to_string(status as Int), " undecodable: ", cause as String], "")
+  }
+}
+
+fn acquired_server_read_line(read: AcquiredServerRead) -> String {
+  match read {
+    AcquiredServerObserved { acquisition: a, server: s } =>
+      join(["observed ", a.resource_id as String, " name=", s.name, " status=", s.status], "")
+    AcquiredServerIdUnparsed { acquisition: a } => join(["refused ", a.resource_id as String, ": the acquisition's resource id is not a Hetzner server id"], "")
+    AcquiredServerAnsweredForAnother { acquisition: a, observed: o } =>
+      join(["refused ", a.resource_id as String, ": the API answered about server ", to_string(o)], "")
+    AcquiredServerReadRefused { acquisition: a, refusal: r } => join(["refused ", a.resource_id as String, ": ", rest_refusal_line(r: r)], "")
+  }
+}
+
+fn acquired_server_observed(read: AcquiredServerRead) -> Bool {
+  match read {
+    AcquiredServerObserved { acquisition: _, server: _ } => true
+    AcquiredServerIdUnparsed { acquisition: _ } => false
+    AcquiredServerAnsweredForAnother { acquisition: _, observed: _ } => false
+    AcquiredServerReadRefused { acquisition: _, refusal: _ } => false
+  }
+}
+
diff --git a/dag/gunbc/fleet/host_credential_custody_converge.dag b/dag/gunbc/fleet/host_credential_custody_converge.dag
index fdcc603ac5b..ad446bee0c4 100644
--- a/dag/gunbc/fleet/host_credential_custody_converge.dag
+++ b/dag/gunbc/fleet/host_credential_custody_converge.dag
@@ -18,7 +18,32 @@ import gunbc.clock_read { clock_now_probed_at, probed_at_word }
 import gunbc.actions_run_binding { actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent, fleet_converge_expected_host_env_name }
 import gunbc.fleet_ssh_locus { prepare_fleet_ssh_agent_context, FleetSshContextReady, FleetSshContextRefused }
 import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext, SshTarget }
-import gunbc.fleet_host_identity { operator_host_srv1 }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2 }
+import gunbc.cursor_harness_credential { cursor_api_key_harness_secret_ref, cursor_worker_turn_api_key_host_path, cursor_worker_turn_custody_host }
+import gunbc.codex_harness_credential {
+  codex_auth_harness_secret_ref,
+  codex_worker_turn_auth_host_path,
+  codex_worker_turn_custody_host,
+  codex_harness_auth_read,
+  CodexHarnessAuthAdmitted,
+  CodexHarnessAuthRefused,
+  codex_harness_write_back_decision,
+  CodexHarnessWriteBackDecision,
+  CodexHarnessWriteBackNotOwed,
+  CodexHarnessWriteBackOwed,
+  CodexHarnessWriteBackRefused,
+  codex_harness_write_back_refusal_wire,
+  codex_harness_add_version,
+  CodexHarnessWriteBackReceipt,
+  CodexHarnessVersionAdded,
+  CodexHarnessStoreUnchanged,
+  CodexHarnessVersionAddRefused,
+  CodexHarnessVersionAddAmbiguous,
+  CodexHarnessWriteBackWithheld,
+  codex_harness_write_back_receipt_wire,
+}
+import std.types { Secret }
+import extdeps.filesystem.filesystem_io { FilesystemFileRead, FilesystemFileIndeterminate, FilesystemFileAbsent, FilesystemFileObservationsDisagree, FilesystemFileSubjectRefused }
 import gunbc.fleet_posix_accounts { fleet_posix_root_user }
 import gunbc.file_access { FileTreeScope, path_within_file_tree_scope }
 import gunbc.auth.github_apps { gunbai_ci_app_pem_secret }
@@ -29,6 +54,7 @@ import gunbc.managed_directory {
   DeclaredDirectoryMode,
   DirectoryOwnerOnly,
   DirectoryOwnerAllGroupTraverse,
+  DirectoryOwnerAllEveryoneTraverse,
   declared_directory_mode_octal,
   declared_directory_grants_group_traverse,
 }
@@ -50,6 +76,7 @@ import gunbc.typed_remote_file_write {
   RemoteFileMode,
   remote_file_mode_octal,
   RemoteFileModeOwnerRead,
+  RemoteFileModeOwnerReadWrite,
   RemoteFileModeOwnerReadWriteGroupRead,
   RemoteFileViaNonInteractiveSudo,
   TypedRemoteFileWrite,
@@ -62,12 +89,15 @@ import gunbc.typed_remote_file_write {
   TypedRemoteFileStepLegRefused,
   typed_remote_file_write_seal,
   typed_remote_file_staging_path,
+  typed_remote_file_stage_argv,
+  typed_remote_file_write_stdin_payload,
   typed_remote_file_compare_argv,
   typed_remote_file_step,
   classify_typed_remote_file_comparison,
   remote_file_privileged_argv,
   converge_typed_remote_file,
 }
+import extdeps.tools.chmod { chmod_path_resolved_program }
 import gunbc.runner_host_deploy { runner_host_spec_for, RunnerHostSpecFound, RunnerHostSpecAbsent }
 import gunbc.runner_host_grants { bootstrap_principal_is_not_the_job_user }
 import gunbc.fleet_bootstrap_principal { executor_bootstrap_principal }
@@ -168,21 +198,49 @@ type HostCustodyCredential
   = ControllerAppKey
   | ApprovalNtfyPublisherToken
   | FabricStateWriterKey
+  | CursorWorkerTurnApiKey
+  | CodexWorkerTurnAuth
   | OracleOciApiSigningKey
   | ClaudeCodeOauthHarnessToken
 
-data host_custody_credential_roster: List<HostCustodyCredential> = [ControllerAppKey, ApprovalNtfyPublisherToken, FabricStateWriterKey, OracleOciApiSigningKey, ClaudeCodeOauthHarnessToken]
+data host_custody_credential_roster: List<HostCustodyCredential> = [ControllerAppKey, ApprovalNtfyPublisherToken, FabricStateWriterKey, CursorWorkerTurnApiKey, CodexWorkerTurnAuth, OracleOciApiSigningKey, ClaudeCodeOauthHarnessToken]
 
 fn host_custody_credential_wire(c: HostCustodyCredential) -> String {
   match c {
     ControllerAppKey => "controller_app_key"
     ApprovalNtfyPublisherToken => "approval_ntfy_publisher_token"
     FabricStateWriterKey => "fabric_state_writer_key"
+    CursorWorkerTurnApiKey => "cursor_worker_turn_api_key"
+    CodexWorkerTurnAuth => "codex_worker_turn_auth"
     OracleOciApiSigningKey => "oracle_oci_api_signing_key"
     ClaudeCodeOauthHarnessToken => "claude_code_oauth_harness_token"
   }
 }
 
+// WHO HOLDS THE CURRENT VALUE AFTER PLACEMENT. Every row but one is store-authoritative: the secret
+// is the truth and the host copy is converged to it. The codex subscription auth.json is not: codex
+// rotates its refresh token on the host while it runs (extdeps.llm.codex_auth
+// codex_source_refresh_persistence), so after placement the HOST holds the live token and the store
+// lags until this converge reads the host file back and adds it as a new version. Overwriting that
+// host file from the store would put a spent token back, and so would placing the store's copy on a
+// second host. That is why a host-authoritative row must name exactly one host (placement refuses
+// otherwise) and why its converge never writes over a file that is already there.
+type CustodyAuthority
+  = CustodyStoreAuthoritative
+  | CustodyHostAuthoritativeAfterPlacement
+
+fn host_custody_authority(c: HostCustodyCredential) -> CustodyAuthority {
+  match c {
+    ControllerAppKey => CustodyStoreAuthoritative
+    ApprovalNtfyPublisherToken => CustodyStoreAuthoritative
+    FabricStateWriterKey => CustodyStoreAuthoritative
+    CursorWorkerTurnApiKey => CustodyStoreAuthoritative
+    CodexWorkerTurnAuth => CustodyHostAuthoritativeAfterPlacement
+    OracleOciApiSigningKey => CustodyStoreAuthoritative
+    ClaudeCodeOauthHarnessToken => CustodyStoreAuthoritative
+  }
+}
+
 data host_custody_credential_options: List<String> = map(host_custody_credential_roster, c => host_custody_credential_wire(c: c))
 
 type HostCustodyCredentialSelection
@@ -204,11 +262,13 @@ fn select_host_custody_credential(supplied: String) -> HostCustodyCredentialSele
 // and whether it grants the group read -- four facts, one match each, no octal parameter anywhere.
 type CustodyFileMode
   = CustodyFileOwnerRead
+  | CustodyFileOwnerReadWrite
   | CustodyFileOwnerReadWriteGroupRead
 
 fn custody_file_remote_mode(m: CustodyFileMode) -> RemoteFileMode {
   match m {
     CustodyFileOwnerRead => RemoteFileModeOwnerRead
+    CustodyFileOwnerReadWrite => RemoteFileModeOwnerReadWrite
     CustodyFileOwnerReadWriteGroupRead => RemoteFileModeOwnerReadWriteGroupRead
   }
 }
@@ -226,6 +286,7 @@ fn custody_file_exact_perm(m: CustodyFileMode) -> String {
 fn custody_file_forbidden_perm(m: CustodyFileMode) -> String {
   match m {
     CustodyFileOwnerRead => "/077"
+    CustodyFileOwnerReadWrite => "/077"
     CustodyFileOwnerReadWriteGroupRead => "/037"
   }
 }
@@ -233,6 +294,7 @@ fn custody_file_forbidden_perm(m: CustodyFileMode) -> String {
 fn custody_file_grants_group(m: CustodyFileMode) -> Bool {
   match m {
     CustodyFileOwnerRead => false
+    CustodyFileOwnerReadWrite => false
     CustodyFileOwnerReadWriteGroupRead => true
   }
 }
@@ -257,6 +319,7 @@ fn custody_dir_forbidden_perm(m: DeclaredDirectoryMode) -> String {
   match m {
     DirectoryOwnerOnly => "/077"
     DirectoryOwnerAllGroupTraverse => "/027"
+    DirectoryOwnerAllEveryoneTraverse => "/022"
   }
 }
 
@@ -306,6 +369,16 @@ data custody_root_owned_ntfy_group: PosixOwnerNames = PosixOwnerNames {
   group: approval_ntfy_principal_name,
 }
 
+data custody_operator_only: PosixOwnerNames = PosixOwnerNames {
+  user: fleet_posix_operator_user.name,
+  group: fleet_posix_operator_user.name,
+}
+
+// THE WORKER-TURN CREDENTIALS live on srv2, the host the declared Cursor offer and the codex harness
+// turns dispatch on, owned by the operator account the dispatch spawns run as. Cursor's key is
+// read-only on the host. The codex directory IS the turn's CODEX_HOME: codex writes auth.json,
+// sessions and logs beneath it, so the directory and the file are owner read-write.
+
 // OracleOciApiSigningKey signs every OCI request gunbc.oracle_oci.compartment_ensure makes, through
 // the signer's own key reference, never re-spelled. It is delivered to srv1 only, root-owned and
 // owner-read, because srv1 is where the OCI converge runs and nothing else signs with it.
@@ -330,6 +403,26 @@ fn host_credential_custody_row(c: HostCustodyCredential) -> HostCredentialCustod
       dir_ownership: custody_root_only,
       dir_mode: DirectoryOwnerOnly,
     }
+    CursorWorkerTurnApiKey => HostCredentialCustodyRow {
+      credential: c,
+      secret: cursor_api_key_harness_secret_ref,
+      path: cursor_worker_turn_api_key_host_path,
+      host_scope: CustodyOnlyOnHost { host: cursor_worker_turn_custody_host },
+      file_ownership: custody_operator_only,
+      file_mode: CustodyFileOwnerRead,
+      dir_ownership: custody_operator_only,
+      dir_mode: DirectoryOwnerOnly,
+    }
+    CodexWorkerTurnAuth => HostCredentialCustodyRow {
+      credential: c,
+      secret: codex_auth_harness_secret_ref,
+      path: codex_worker_turn_auth_host_path,
+      host_scope: CustodyOnlyOnHost { host: codex_worker_turn_custody_host },
+      file_ownership: custody_operator_only,
+      file_mode: CustodyFileOwnerReadWrite,
+      dir_ownership: custody_operator_only,
+      dir_mode: DirectoryOwnerOnly,
+    }
     OracleOciApiSigningKey => HostCredentialCustodyRow {
       credential: c,
       secret: oci_api_signing_key_secret_ref,
@@ -373,6 +466,7 @@ type CustodyPlacementRefusal
   | CustodyPathNoDedicatedDirectory { path: NonEmptyStr }
   | CustodyGroupCannotTraverse { path: NonEmptyStr, dir: NonEmptyStr, group: NonEmptyStr, file_perm: String, dir_perm: String }
   | CustodyDirectoryGroupDiffers { path: NonEmptyStr, file_group: NonEmptyStr, dir_group: NonEmptyStr }
+  | CustodyHostAuthoritativeNotSingleHost { path: NonEmptyStr }
 
 type CustodyPlacement
   = CustodyPlaced { row: HostCredentialCustodyRow, key_dir: NonEmptyStr, upper_ancestors: List<String> }
@@ -390,6 +484,8 @@ fn custody_placement_refusal_wire(r: CustodyPlacementRefusal) -> String {
       join(["custody row for ", p as String, " grants group ", g as String, " read (", fp, ") but its directory ", d as String, " is declared ", dp, ", which denies that group traversal -- the reader could not open the file the readback would report as held"], "")
     CustodyDirectoryGroupDiffers { path: p, file_group: fg, dir_group: dg } =>
       join(["custody row for ", p as String, " grants group ", fg as String, " read but its directory is group ", dg as String, ", so the file's group has no traversal through it"], "")
+    CustodyHostAuthoritativeNotSingleHost { path: p } =>
+      join(["custody row for ", p as String, " is host-authoritative after placement and must name exactly one host; a second host would receive the store's lagging, possibly spent, copy"], "")
   }
 }
 
@@ -404,7 +500,17 @@ fn custody_row_placement(row: HostCredentialCustodyRow) -> CustodyPlacement {
   let key_path = row.path
   let ancestors = runner_host_path_ancestors(path: key_path as String)
   let dir = last_or_empty(xs: ancestors)
-  if path_within_file_tree_scope(scope: custody_forbidden_tree, path: key_path) {
+  let host_authoritative_on_many = match host_custody_authority(c: row.credential) {
+    CustodyStoreAuthoritative => false
+    CustodyHostAuthoritativeAfterPlacement =>
+      match row.host_scope {
+        CustodyAnyRunnerHost => true
+        CustodyOnlyOnHost { host: _ } => false
+      }
+  }
+  if host_authoritative_on_many {
+    CustodyPlacementRefused { cause: CustodyHostAuthoritativeNotSingleHost { path: key_path } }
+  } else if path_within_file_tree_scope(scope: custody_forbidden_tree, path: key_path) {
     CustodyPlacementRefused { cause: CustodyPathInForbiddenTree { path: key_path } }
   } else if !path_within_file_tree_scope(scope: runner_host_file_scope, path: key_path) {
     CustodyPlacementRefused { cause: CustodyPathOutsideScope { path: key_path } }
@@ -668,12 +774,78 @@ fn host_credential_custody(row: HostCredentialCustodyRow, readback: CustodyReadb
 type CustodyAction
   = CustodyLeaveInPlace
   | CustodyWrite
+  | CustodyWriteBackToStore { payload: Secret }
+  | CustodyRepairMetadataInPlace
+  | CustodyCreateOnly
   | CustodyActionRefused { reason: String }
 
-// The directory and the ancestors are decided first because a write cannot repair them and writing
-// into a directory that is not as declared could publish the credential where an undeclared
-// principal holds bits on it. An unsafe FILE is repaired by the write: the staged sibling is
-// created by root, moded from the arm, renamed over it, and then owned from the row.
+// THE HOST-AUTHORITATIVE DECISION, layered on the store-authoritative one rather than beside it: the
+// directory, ancestor and metadata decisions are the same, and only a file that is already there and
+// DIFFERS from the store is decided differently. It is never overwritten. If its refresh token moved
+// on, it is owed to the store; if not, the host copy is merely fresher in its short-lived tokens and
+// is left alone; if it now names another account or cannot be read, the converge refuses.
+fn host_authoritative_differing_action(decision: CodexHarnessWriteBackDecision?) -> CustodyAction {
+  match decision {
+    Absent => CustodyActionRefused { reason: "host-authoritative file differs from the store and was not read back" }
+    Present { value: d } =>
+      match d {
+        CodexHarnessWriteBackNotOwed => CustodyLeaveInPlace
+        CodexHarnessWriteBackOwed { payload } => CustodyWriteBackToStore { payload: payload }
+        CodexHarnessWriteBackRefused { cause } =>
+          CustodyActionRefused { reason: concat("host file not written back: ", codex_harness_write_back_refusal_wire(cause: cause)) }
+      }
+  }
+}
+
+fn host_authoritative_custody_action(base: CustodyAction, content: RunnerHostFileStanding, decision: CodexHarnessWriteBackDecision?) -> CustodyAction {
+  match base {
+    CustodyActionRefused { reason: _ } => base
+    CustodyWriteBackToStore { payload: _ } => base
+    CustodyRepairMetadataInPlace => base
+    CustodyCreateOnly => base
+    CustodyLeaveInPlace => host_authoritative_settled_action(base: base, content: content, decision: decision)
+    CustodyWrite => host_authoritative_settled_action(base: base, content: content, decision: decision)
+  }
+}
+
+fn host_authoritative_settled_action(base: CustodyAction, content: RunnerHostFileStanding, decision: CodexHarnessWriteBackDecision?) -> CustodyAction {
+  match content {
+    HostFileDiffers => host_authoritative_differing_action(decision: decision)
+    HostFileIdentical => host_authoritative_metadata_action(base: base)
+    HostFileAbsent => host_authoritative_first_placement_action(base: base)
+    HostFileUnobservable { reason: _ } => base
+  }
+}
+
+// A HOST-AUTHORITATIVE FILE IS NEVER REPLACED FROM THE STORE, whatever the reason the ordinary
+// decision gave. Identical content with wrong owner or mode is repaired in place (chown and chmod on
+// the path, no content written): the store-to-host content write stages the STORE bytes and renames
+// them over the live file, so a refresh that moved the host file on between observation and rename
+// would be lost -- the rename is outside the codex turn lock.
+fn host_authoritative_metadata_action(base: CustodyAction) -> CustodyAction {
+  match base {
+    CustodyWrite => CustodyRepairMetadataInPlace
+    CustodyLeaveInPlace => base
+    CustodyRepairMetadataInPlace => base
+    CustodyCreateOnly => base
+    CustodyWriteBackToStore { payload: _ } => base
+    CustodyActionRefused { reason: _ } => base
+  }
+}
+
+// FIRST PLACEMENT PUBLISHES CREATE-ONLY: a file that appears after the absence was observed (codex
+// logged in by hand, or a racing converge) makes the publication fail and is left as found.
+fn host_authoritative_first_placement_action(base: CustodyAction) -> CustodyAction {
+  match base {
+    CustodyWrite => CustodyCreateOnly
+    CustodyLeaveInPlace => base
+    CustodyRepairMetadataInPlace => base
+    CustodyCreateOnly => base
+    CustodyWriteBackToStore { payload: _ } => base
+    CustodyActionRefused { reason: _ } => base
+  }
+}
+
 fn custody_action(
   dir: CustodyPathMetadata,
   upper_ancestors: RunnerHostPathMetadata,
@@ -714,6 +886,9 @@ fn custody_action_wire(a: CustodyAction) -> String {
   match a {
     CustodyLeaveInPlace => "left-in-place"
     CustodyWrite => "written"
+    CustodyWriteBackToStore { payload: _ } => "written-back-to-store"
+    CustodyRepairMetadataInPlace => "metadata-repaired-in-place"
+    CustodyCreateOnly => "created-only"
     CustodyActionRefused { reason: r } => concat("REFUSED ", r)
   }
 }
@@ -735,6 +910,14 @@ fn custody_file_chown_argv(row: HostCredentialCustodyRow) -> List<String> {
   chown_argv(owner: ChownOwnerNames { names: row.file_ownership }, path: row.path as String)
 }
 
+fn custody_chown_argv_at(row: HostCredentialCustodyRow, path: String) -> List<String> {
+  chown_argv(owner: ChownOwnerNames { names: row.file_ownership }, path: path)
+}
+
+fn custody_chmod_argv_at(row: HostCredentialCustodyRow, path: String) -> List<String> {
+  [chmod_path_resolved_program as String, remote_file_mode_octal(mode: custody_file_remote_mode(m: row.file_mode)), path]
+}
+
 fn staging_remove_argv(staging: String) -> List<String> {
   ["rm", "-f", "--", staging]
 }
@@ -958,6 +1141,7 @@ type CustodyRun {
   sm_version: SmResolvedVersionIdentity
   action: CustodyAction
   write_refusal: String?
+  store_write_back: CodexHarnessWriteBackReceipt?
   readback: CustodyReadback
 }
 
@@ -1005,9 +1189,134 @@ fn write_and_own(subject: CustodyHost, context: FleetSshExecutionContext, row: H
   }
 }
 
+type CustodyLeg {
+  argv: List<String>
+  stdin_payload: String
+}
+
+fn run_legs_until_refused(subject: CustodyHost, context: FleetSshExecutionContext, legs: List<CustodyLeg>, step: String) -> String? {
+  fold(legs, init: none, f: (acc, leg) =>
+    match acc {
+      Present { value: _ } => acc
+      Absent =>
+        match run_elevated_leg(subject: subject, context: context, argv: leg.argv, stdin_payload: leg.stdin_payload) {
+          ElevatedLegRefused { reason: r } => Present { value: join(["step=", step, " not run: ", r], "") }
+          ElevatedLegRan { exit_code: c, stdout: _, stderr: e } =>
+            if c != 0 { Present { value: join(["step=", step, " exit=", to_string(c), " ", trim(s: e)], "") } } else { none }
+        }
+    }
+  )
+}
+
+// METADATA ONLY: owner then mode on the existing path; the content is never touched.
+fn repair_metadata_in_place(subject: CustodyHost, context: FleetSshExecutionContext, row: HostCredentialCustodyRow) -> String? {
+  run_legs_until_refused(
+    subject: subject, context: context, step: "metadata",
+    legs: [
+      CustodyLeg { argv: custody_chown_argv_at(row: row, path: row.path as String), stdin_payload: "" },
+      CustodyLeg { argv: custody_chmod_argv_at(row: row, path: row.path as String), stdin_payload: "" },
+    ],
+  )
+}
+
+// CREATE-ONLY PUBLICATION: stage the store bytes beside the path, give the STAGED file the row's final
+// owner and mode, then publish with a hard link, which fails when the destination exists rather
+// than replacing it. A file that appeared after the absence observation therefore survives and the
+// converge refuses; the staging sibling is removed afterwards by the shared staging cleanup.
+fn create_only_publish(subject: CustodyHost, context: FleetSshExecutionContext, row: HostCredentialCustodyRow, write: TypedRemoteFileWrite) -> String? {
+  let staging = typed_remote_file_staging_path(write: write)
+  run_legs_until_refused(
+    subject: subject, context: context, step: "create-only",
+    legs: [
+      CustodyLeg { argv: typed_remote_file_stage_argv(write: write), stdin_payload: typed_remote_file_write_stdin_payload(write: write) },
+      CustodyLeg { argv: custody_chown_argv_at(row: row, path: staging), stdin_payload: "" },
+      CustodyLeg { argv: custody_chmod_argv_at(row: row, path: staging), stdin_payload: "" },
+      CustodyLeg { argv: ["ln", "-T", staging, row.path as String], stdin_payload: "" },
+    ],
+  )
+}
+
 // THE ANCESTORS ARE OBSERVED BEFORE ANY MUTATION (gunbc#11902): ensure_custody_dir creates, so it
 // runs only once the ancestors read root-only; otherwise the directory is only observed and the same
 // pure custody_action decides.
+// THE HOST FILE AS THE HOST HOLDS IT, read only for a host-authoritative row whose content already
+// differs from the store. A failed read is an indeterminate observation, never an empty file.
+fn read_host_custody_file(subject: CustodyHost, context: FleetSshExecutionContext, path: String) -> extdeps.filesystem.filesystem_io.FilesystemFileObservation
+{
+  match run_elevated_leg(subject: subject, context: context, argv: ["cat", path], stdin_payload: "") {
+    ElevatedLegRefused { reason: r } => FilesystemFileIndeterminate { cause: concat("host file read not run: ", r) }
+    ElevatedLegRan { exit_code: c, stdout: o, stderr: e } =>
+      if c != 0 {
+        FilesystemFileIndeterminate { cause: join(["host file read exit=", to_string(c), " ", trim(s: e)], "") }
+      } else {
+        FilesystemFileRead { path: path, content: o }
+      }
+  }
+}
+
+type HostAuthoritativeReading {
+  decision: CodexHarnessWriteBackDecision?
+  host_content: String?
+}
+
+fn read_host_authoritative(
+  subject: CustodyHost,
+  context: FleetSshExecutionContext,
+  row: HostCredentialCustodyRow,
+  store_payload: Secret,
+  content: RunnerHostFileStanding,
+) -> HostAuthoritativeReading
+{
+  match content {
+    HostFileDiffers =>
+      match codex_harness_auth_read(content: store_payload as String) {
+        CodexHarnessAuthRefused { cause: _ } => HostAuthoritativeReading { decision: none, host_content: none }
+        CodexHarnessAuthAdmitted { identity } => {
+          let observed = read_host_custody_file(subject: subject, context: context, path: row.path as String)
+          HostAuthoritativeReading {
+            decision: Present { value: codex_harness_write_back_decision(materialized: identity, read_back: observed) },
+            host_content: host_custody_file_content(observed: observed),
+          }
+        }
+      }
+    HostFileIdentical => HostAuthoritativeReading { decision: none, host_content: none }
+    HostFileAbsent => HostAuthoritativeReading { decision: none, host_content: none }
+    HostFileUnobservable { reason: _ } => HostAuthoritativeReading { decision: none, host_content: none }
+  }
+}
+
+fn host_custody_file_content(observed: extdeps.filesystem.filesystem_io.FilesystemFileObservation) -> String? {
+  match observed {
+    FilesystemFileRead { path: _, content: c } => Present { value: c }
+    FilesystemFileAbsent(_) => none
+    FilesystemFileIndeterminate { cause: _ } => none
+    FilesystemFileObservationsDisagree { path: _, cause: _ } => none
+    FilesystemFileSubjectRefused { directory: _, name: _, cause: _ } => none
+  }
+}
+
+// The content readback against the bytes the action left authoritative: the store's for a write or a
+// leave-in-place on identical content; the host file's own bytes, read again, for a host-authoritative
+// copy that was left or written back. The second is a re-read of the host, not an assumption about it.
+fn observe_custody_content_against(
+  subject: CustodyHost,
+  context: FleetSshExecutionContext,
+  row: HostCredentialCustodyRow,
+  key_dir: NonEmptyStr,
+  store_write: TypedRemoteFileWrite,
+  authoritative_content: String?,
+) -> RunnerHostFileStanding
+{
+  match authoritative_content {
+    Absent => observe_custody_content(subject: subject, context: context, write: store_write)
+    Present { value: c } =>
+      match typed_remote_file_write_seal(path: row.path as FilePath, content: c, allowed_scope: FileTreeScope { root_path: key_dir }) {
+        TypedRemoteFileWriteAdmissionRefused { cause: why } => HostFileUnobservable { reason: concat("host-authoritative readback not sealed: ", why as String) }
+        TypedRemoteFileWriteAdmitted { write: w } => observe_custody_content(subject: subject, context: context, write: w)
+      }
+  }
+}
+
 fn converge_host_credential_custody(
   subject: CustodyHost,
   context: FleetSshExecutionContext,
@@ -1015,6 +1324,7 @@ fn converge_host_credential_custody(
   key_dir: NonEmptyStr,
   upper_ancestors: List<String>,
   write: TypedRemoteFileWrite,
+  store_payload: Secret,
   sm_version: SmResolvedVersionIdentity,
 ) -> CustodyRun
 {
@@ -1029,10 +1339,39 @@ fn converge_host_credential_custody(
   }
   let content_before = observe_custody_content(subject: subject, context: context, write: write)
   let file_before = observe_custody_path(subject: subject, context: context, path: row.path as String, legs: custody_file_legs(row: row))
-  let action = custody_action(dir: dir_before, upper_ancestors: ancestors_before, content: content_before, file: file_before)
+  let base_action = custody_action(dir: dir_before, upper_ancestors: ancestors_before, content: content_before, file: file_before)
+  let host_reading = match host_custody_authority(c: row.credential) {
+    CustodyStoreAuthoritative => HostAuthoritativeReading { decision: none, host_content: none }
+    CustodyHostAuthoritativeAfterPlacement =>
+      read_host_authoritative(subject: subject, context: context, row: row, store_payload: store_payload, content: content_before)
+  }
+  let action = match host_custody_authority(c: row.credential) {
+    CustodyStoreAuthoritative => base_action
+    CustodyHostAuthoritativeAfterPlacement =>
+      host_authoritative_custody_action(base: base_action, content: content_before, decision: host_reading.decision)
+  }
   let write_refusal = match action {
     CustodyWrite => write_and_own(subject: subject, context: context, row: row, write: write)
+    CustodyRepairMetadataInPlace => repair_metadata_in_place(subject: subject, context: context, row: row)
+    CustodyCreateOnly => create_only_publish(subject: subject, context: context, row: row, write: write)
     CustodyLeaveInPlace => none
+    CustodyWriteBackToStore { payload: _ } => none
+    CustodyActionRefused { reason: _ } => none
+  }
+  let store_write_back = match action {
+    CustodyWriteBackToStore { payload } => Present { value: codex_harness_add_version(token_source: WorkloadIdentityToken, payload: payload) }
+    CustodyLeaveInPlace => none
+    CustodyWrite => none
+    CustodyRepairMetadataInPlace => none
+    CustodyCreateOnly => none
+    CustodyActionRefused { reason: _ } => none
+  }
+  let authoritative_content = match action {
+    CustodyWriteBackToStore { payload: _ } => host_reading.host_content
+    CustodyLeaveInPlace => host_reading.host_content
+    CustodyRepairMetadataInPlace => host_reading.host_content
+    CustodyCreateOnly => none
+    CustodyWrite => none
     CustodyActionRefused { reason: _ } => none
   }
   let staging_after = match admit_staging_cleanup(
@@ -1048,7 +1387,10 @@ fn converge_host_credential_custody(
   let file_after = observe_custody_path(subject: subject, context: context, path: row.path as String, legs: custody_file_legs(row: row))
   let dir_after = observe_custody_path(subject: subject, context: context, path: key_dir as String, legs: custody_dir_legs(row: row))
   let upper_ancestors_after = observe_upper_ancestors(subject: subject, context: context, paths: upper_ancestors)
-  let content_after = observe_custody_content(subject: subject, context: context, write: write)
+  let content_after = observe_custody_content_against(
+    subject: subject, context: context, row: row, key_dir: key_dir,
+    store_write: write, authoritative_content: authoritative_content,
+  )
   let readback = CustodyReadback {
     file: file_after,
     dir: dir_after,
@@ -1062,6 +1404,7 @@ fn converge_host_credential_custody(
     sm_version: sm_version,
     action: action,
     write_refusal: write_refusal,
+    store_write_back: store_write_back,
     readback: readback,
   }
 }
@@ -1071,16 +1414,30 @@ fn custody_run_settled(run: CustodyRun) -> Bool {
     CustodyActionRefused { reason: _ } => true
     CustodyLeaveInPlace => false
     CustodyWrite => false
+    CustodyRepairMetadataInPlace => false
+    CustodyCreateOnly => false
+    CustodyWriteBackToStore { payload: _ } => false
   }
   let write_failed = match run.write_refusal {
     Present { value: _ } => true
     Absent => false
   }
+  let store_write_failed = match run.store_write_back {
+    Absent => false
+    Present { value: r } =>
+      match r {
+        CodexHarnessVersionAdded { version_name: _ } => false
+        CodexHarnessStoreUnchanged => true
+        CodexHarnessVersionAddRefused { detail: _ } => true
+        CodexHarnessVersionAddAmbiguous { detail: _ } => true
+        CodexHarnessWriteBackWithheld { cause: _ } => true
+      }
+  }
   let held = match host_credential_custody(row: run.row, readback: run.readback) {
     CustodyHeld => true
     CustodyNotHeld { causes: _ } => false
   }
-  !refused_before && !write_failed && held
+  !refused_before && !write_failed && !store_write_failed && held
 }
 
 // NEVER THE BYTES. Every field below is metadata or a judgment; the content is named only by the
@@ -1097,6 +1454,10 @@ fn custody_receipt(run: CustodyRun) -> String {
       Present { value: w } => concat(" write=REFUSED ", w)
       Absent => ""
     },
+    match run.store_write_back {
+      Present { value: r } => concat(" store=", codex_harness_write_back_receipt_wire(r: r))
+      Absent => ""
+    },
     "\n  file=", custody_path_metadata_wire(m: run.readback.file, legs: custody_file_legs(row: run.row)),
     "\n  dir=", custody_path_metadata_wire(m: run.readback.dir, legs: custody_dir_legs(row: run.row)),
     "\n  ancestors=", runner_host_path_metadata_wire(m: run.readback.upper_ancestors),
@@ -1207,7 +1568,7 @@ fn host_credential_custody_converge_ci_wet() -> ProcessExit
                                     FleetSshContextReady { context: context, receipt: context_receipt } => {
                                       let run = converge_host_credential_custody(
                                         subject: subject, context: context, placement_row: placed, key_dir: kd,
-                                        upper_ancestors: ua, write: w, sm_version: version,
+                                        upper_ancestors: ua, write: w, store_payload: material, sm_version: version,
                                       )
                                       write_receipt_then_exit(
                                         body: join([stamp, "\n", context_receipt, custody_receipt(run: run)], ""),
diff --git a/dag/gunbc/fleet/mtcollins_firmware_baseline.dag b/dag/gunbc/fleet/mtcollins_firmware_baseline.dag
index 5f409ba68fa..90ecfeed87e 100644
--- a/dag/gunbc/fleet/mtcollins_firmware_baseline.dag
+++ b/dag/gunbc/fleet/mtcollins_firmware_baseline.dag
@@ -1,5 +1,6 @@
 module gunbc.fleet.mtcollins_firmware_baseline
 
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
 import std.types { Bool, Int, List, NonEmptyStr, String }
 import std.decl_ref { DeclarationRef, decl_ref, declaration_ref_eq }
 import std.interval { degenerate_interval }
@@ -262,7 +263,7 @@ fn baseline_assessment() -> DecisionAssessment {
         constraint: c.identity,
         evidence: "a gate at 1 applied to every candidate before dominance" as NonEmptyStr,
       }),
-    parameters: [ParameterBound { parameter: id_param_board, evidence: "AmpereMtCollins (mtcollins1)" as NonEmptyStr }],
+    parameters: [ParameterBound { parameter: id_param_board, evidence: "Mt. Collins board (mtcollins1)" as NonEmptyStr }],
     selected_candidate: Absent,
     term_drops: [],
     physical_model: PhysicalModelEstablished { terms: [id_term] },
diff --git a/dag/gunbc/fleet/printer_federation_provision.dag b/dag/gunbc/fleet/printer_federation_provision.dag
index ddb81957634..a0b905a93f0 100644
--- a/dag/gunbc/fleet/printer_federation_provision.dag
+++ b/dag/gunbc/fleet/printer_federation_provision.dag
@@ -1,7 +1,7 @@
 module gunbc.fleet.printer_federation_provision
 
 import std.types { List }
-import gunbc.auth.heal_publisher_provision { DedicatedFederation }
+import gunbc.auth.heal_publisher_provision { DedicatedFederation, StandingPoolImpersonation }
 import gunbc.auth.gcp_secret_access { secret_accessor_grant }
 import gunbc.auth.github_gcp_federation { federated_service_account_member }
 import gunbc.fleet_printer_access { printer_access_code_loci }
@@ -20,7 +20,7 @@ fn printer_dedicated_federation() -> DedicatedFederation {
     provider_id: printer_wif_provider_id,
     attribute_mapping: printer_attribute_mapping,
     attribute_condition: printer_attribute_condition(),
-    principal_set: printer_principal_set(),
+    impersonation: StandingPoolImpersonation { principal_set: printer_principal_set() },
     service_account: printer_service_account,
     service_account_id: "printer-lan",
     service_account_display_name: "Printer LAN credential reader",
diff --git a/dag/gunbc/fleet/provider_acquisition.dag b/dag/gunbc/fleet/provider_acquisition.dag
new file mode 100644
index 00000000000..c3d95442947
--- /dev/null
+++ b/dag/gunbc/fleet/provider_acquisition.dag
@@ -0,0 +1,35 @@
+module gunbc.provider_acquisition
+
+import std.types { NonEmptyStr }
+import extdeps.cloud.gcp.secret_ref { SecretRef }
+
+// HOW A PROVIDER RESOURCE CAME TO BE HELD, kept apart from how it is reset. Acquisition is rare,
+// depends on the provider's stock and is often a human act; an incarnation reset is per job and
+// automated. Coupling them would make every job gamble the fleet's capacity on a reorder the provider
+// may not fill (operator, 2026-10-08: CAX stock cannot be relied on), so a held resource is released
+// only by a deliberate acquisition decision and never by a job's lifecycle.
+
+// THE PROVIDER ACCOUNT A RESOURCE IS HELD UNDER, and the one credential that drives it. A provider
+// API credential is scoped to that account (a Hetzner Cloud token to one project), so the account is
+// what decides which credential may touch the resource; the credential is a Secret Manager
+// reference, never a value.
+type ProviderApiAccount {
+  account: NonEmptyStr
+  api_credential: SecretRef
+}
+
+// WHO PERFORMED EACH ACQUISITION STEP. Opening the account, registering its login key and acquiring
+// the resource are steps of one procedure; today the operator performs all of them in the provider's
+// console and relays the result, recorded here as that receipt. Automating a step later changes how
+// that step is realized, not which steps the procedure has, and lands with its first automated
+// producer -- an arm with no producer would be a vocabulary nothing writes.
+type AcquisitionRealization
+  = OperatorPerformed { performed_on: NonEmptyStr, relayed: NonEmptyStr }
+
+type ProviderResourceAcquisition {
+  resource_id: NonEmptyStr
+  account: ProviderApiAccount
+  account_established: AcquisitionRealization
+  login_key_registered: AcquisitionRealization
+  resource_acquired: AcquisitionRealization
+}
diff --git a/dag/gunbc/floor/floor_demand.dag b/dag/gunbc/floor/floor_demand.dag
index 77e0d52c5d3..0fbf8c51900 100644
--- a/dag/gunbc/floor/floor_demand.dag
+++ b/dag/gunbc/floor/floor_demand.dag
@@ -161,6 +161,16 @@ data gunbc_floor_uncensored_demand_receipt: FloorRunCgroupPeakReceipt = FloorRun
 // known to be too low; this receipt says 25 GiB is such a line. It is recorded rather than argued
 // away: a cell sized "to end welding to the throttle line" that welds a week later is a finding
 // about demand growth, and the fold below carries it into every consumer as the lower bound it is.
+// THE SLOT ENVELOPE THESE RECEIPTS WERE TAKEN UNDER, carried here because the live row moved. On
+// 2026-10-09 the v1 withdrawal (gunbc.rung_drop v1_required_lanes_withdrawn) deleted the floor from
+// the required gate and the operator re-ruled gunbc.runner_slot_desired to 22 GiB MemoryMax / 21 GiB
+// MemoryHigh / no swap for the native emit-and-build job. The receipts below are findings about the
+// 2026-09-12 envelope (26 GiB max, 25 GiB high) the floor ran in, and a claim that joined them to
+// the live row would from that day assert a relation between a dead instrument and a slot it never
+// inhabited. The floor is frozen, so its envelope is its own row.
+data gunbc_floor_pinned_memory_max: ByteSize = byte_size(27917287424)
+data gunbc_floor_pinned_memory_high: ByteSize = byte_size(26843545600)
+
 data gunbc_floor_throttle_pin_receipt_2026_09_19: FloorRunCgroupPeakReceipt = FloorRunCgroupPeakMeasured {
   run_id: "35408627003",
   runner_unit: "actions-runner@srv1-03.service",
diff --git a/dag/gunbc/generated_artifact.dag b/dag/gunbc/generated_artifact.dag
index 23ceaa121bd..72877409f8f 100644
--- a/dag/gunbc/generated_artifact.dag
+++ b/dag/gunbc/generated_artifact.dag
@@ -16,7 +16,7 @@ type GeneratedArtifact
   | MicrovmShakedownYamlArtifact
   | InstrumentDispatchYamlArtifact
   | HealWorkflowYamlArtifact
-  | HealPublisherWorkflowYamlArtifact
+  | BranchRunGrantBrokerWorkflowYamlArtifact
   | GitignoreArtifact
   | GitattributesArtifact
   | CargoConfigArtifact
@@ -177,7 +177,7 @@ fn artifact_location(a: GeneratedArtifact) -> ArtifactLocation {
     MicrovmShakedownYamlArtifact => ArtifactLocation { directory: ".github/workflows", name: "microvm-shakedown.yml" }
     InstrumentDispatchYamlArtifact => ArtifactLocation { directory: ".github/workflows", name: "instrument-dispatch.yml" }
     HealWorkflowYamlArtifact => ArtifactLocation { directory: ".github/workflows", name: "heal.yml" }
-    HealPublisherWorkflowYamlArtifact => ArtifactLocation { directory: ".github/workflows", name: "heal-publish.yml" }
+    BranchRunGrantBrokerWorkflowYamlArtifact => ArtifactLocation { directory: ".github/workflows", name: "branch-run-grant-broker.yml" }
     GitignoreArtifact => ArtifactLocation { directory: ".", name: ".gitignore" }
     GitattributesArtifact => ArtifactLocation { directory: ".", name: ".gitattributes" }
     CargoConfigArtifact => ArtifactLocation { directory: ".cargo", name: "config.toml" }
@@ -269,7 +269,7 @@ fn artifact_commit_policy(a: GeneratedArtifact) -> CommitPolicy {
     MicrovmShakedownYamlArtifact => CommitRequired { consumer: GithubActionsWorkflow }
     InstrumentDispatchYamlArtifact => CommitRequired { consumer: GithubActionsWorkflow }
     HealWorkflowYamlArtifact => CommitRequired { consumer: GithubActionsWorkflow }
-    HealPublisherWorkflowYamlArtifact => CommitRequired { consumer: GithubActionsWorkflow }
+    BranchRunGrantBrokerWorkflowYamlArtifact => CommitRequired { consumer: GithubActionsWorkflow }
     RoadmapArtifact => CommitRequired { consumer: ProjectDocumentation }
     DesignArtifact => CommitRequired { consumer: ProjectDocumentation }
     DesignFailureModesArtifact => NotCommitted
@@ -328,7 +328,7 @@ fn artifact_eq(a: GeneratedArtifact, b: GeneratedArtifact) -> Bool {
     MicrovmShakedownYamlArtifact => match b { MicrovmShakedownYamlArtifact => true  _ => false }
     InstrumentDispatchYamlArtifact => match b { InstrumentDispatchYamlArtifact => true  _ => false }
     HealWorkflowYamlArtifact => match b { HealWorkflowYamlArtifact => true  _ => false }
-    HealPublisherWorkflowYamlArtifact => match b { HealPublisherWorkflowYamlArtifact => true  _ => false }
+    BranchRunGrantBrokerWorkflowYamlArtifact => match b { BranchRunGrantBrokerWorkflowYamlArtifact => true  _ => false }
     GitignoreArtifact => match b { GitignoreArtifact => true  _ => false }
     GitattributesArtifact => match b { GitattributesArtifact => true  _ => false }
     CargoConfigArtifact => match b { CargoConfigArtifact => true  _ => false }
@@ -404,7 +404,7 @@ fn artifact_producer(a: GeneratedArtifact) -> DeclarationRef {
     MicrovmShakedownYamlArtifact => decl_ref(module_path: "gunbc.runner_microvm_shakedown_workflow", decl_name: "expected_microvm_shakedown_yml")
     InstrumentDispatchYamlArtifact => decl_ref(module_path: "gunbc.instrument_dispatch_workflow", decl_name: "expected_instrument_dispatch_yml")
     HealWorkflowYamlArtifact => decl_ref(module_path: "gunbc.heal_workflow", decl_name: "expected_heal_workflow_yml")
-    HealPublisherWorkflowYamlArtifact => decl_ref(module_path: "gunbc.heal_publisher_workflow", decl_name: "expected_heal_publisher_workflow_yml")
+    BranchRunGrantBrokerWorkflowYamlArtifact => decl_ref(module_path: "gunbc.branch_run_grant_broker_workflow", decl_name: "expected_branch_run_grant_broker_workflow_yml")
     GitignoreArtifact => decl_ref(module_path: "gunbc.gitignore_emit", decl_name: "expected_gitignore")
     GitattributesArtifact => decl_ref(module_path: "gunbc.gitattributes_emit", decl_name: "expected_gitattributes")
     CargoConfigArtifact => decl_ref(module_path: "gunbc.cargo_config_emit", decl_name: "expected_cargo_config_toml")
diff --git a/dag/gunbc/generated_artifact_emit.dag b/dag/gunbc/generated_artifact_emit.dag
index 1c04e121cd1..7a509b36e35 100644
--- a/dag/gunbc/generated_artifact_emit.dag
+++ b/dag/gunbc/generated_artifact_emit.dag
@@ -8,7 +8,7 @@ import v2.extdeps.languages.swift.rows { SwiftRowEmitted, SwiftRowEmissionRefuse
 import gunbc.approve_ios_swift_wire { expected_approve_ios_wire_swift }
 import gunbc.approve_ios_swift_protocol_vector_tests { expected_approve_ios_protocol_vector_tests_swift }
 import product.printed_chassis.cadquery_realization { CouponProgramGeneration, CouponProgramGenerated, CouponProgramRefused, expected_coupon_cadquery_program }
-import gunbc.generated_artifact { GeneratedArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, RunnerDeployArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, AutoinstallUserDataArtifact, RunnerHostSudoersArtifact, PlanArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, FileTransportRealizationGeneratedRsArtifact, Fci1BoundedExecutionContextArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact, artifact_path, artifact_commit_policy, CommitRequired, NotCommitted, GitProtocol, CargoToolchain, GithubActionsWorkflow, ProjectDocumentation, HostReconciler, CompilerRunInput, CrossLanguageClientTest, XcodeProjectGenerator, SwiftCompiler }
+import gunbc.generated_artifact { GeneratedArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, BranchRunGrantBrokerWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, RunnerDeployArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, AutoinstallUserDataArtifact, RunnerHostSudoersArtifact, PlanArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, FileTransportRealizationGeneratedRsArtifact, Fci1BoundedExecutionContextArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact, artifact_path, artifact_commit_policy, CommitRequired, NotCommitted, GitProtocol, CargoToolchain, GithubActionsWorkflow, ProjectDocumentation, HostReconciler, CompilerRunInput, CrossLanguageClientTest, XcodeProjectGenerator, SwiftCompiler }
 import gunbc.generated_artifact_registry { committed_generated_artifacts, heal_regenerated_after_provisional_merge_paths }
 import gunbc.whole_corpus_compile_demand_projection { expected_whole_corpus_compile_measured_root_demands_json }
 import gunbc.generated_workflow_provenance {
@@ -21,7 +21,7 @@ import gunbc.fleet_desired_admission_workflow { expected_fleet_desired_yml, Flee
 import gunbc.runner_microvm_shakedown_workflow { expected_microvm_shakedown_yml, MicrovmShakedownWorkflowGenerated, MicrovmShakedownWorkflowGenerationRefused }
 import gunbc.instrument_dispatch_workflow { expected_instrument_dispatch_yml, InstrumentDispatchWorkflowGenerated, InstrumentDispatchWorkflowGenerationRefused }
 import gunbc.heal_workflow { expected_heal_workflow_yml, HealWorkflowGenerated, HealWorkflowGenerationRefused }
-import gunbc.heal_publisher_workflow { expected_heal_publisher_workflow_yml, HealPublisherWorkflowGenerated, HealPublisherWorkflowGenerationRefused }
+import gunbc.branch_run_grant_broker_workflow { expected_branch_run_grant_broker_workflow_yml, BranchRunGrantBrokerWorkflowGenerated, BranchRunGrantBrokerWorkflowGenerationRefused }
 import gunbc.witness_floor_workflow { WitnessFloorGenerationOutcome, WitnessFloorGenerated, WitnessFloorGenerationRefused }
 import gunbc.compiler_gate_workflow { expected_compiler_gate_yml }
 import gunbc.ci_yaml_validate { ci_yml_parses }
@@ -106,9 +106,9 @@ fn artifact_generate_unadorned(a: GeneratedArtifact) -> ArtifactGenerationOutcom
       HealWorkflowGenerated { content } => artifact_generated(content: content)
       HealWorkflowGenerationRefused { reason } => ArtifactGenerationRefused { reason: reason }
     }
-    HealPublisherWorkflowYamlArtifact => match expected_heal_publisher_workflow_yml() {
-      HealPublisherWorkflowGenerated { content } => artifact_generated(content: content)
-      HealPublisherWorkflowGenerationRefused { reason } => ArtifactGenerationRefused { reason: reason }
+    BranchRunGrantBrokerWorkflowYamlArtifact => match expected_branch_run_grant_broker_workflow_yml() {
+      BranchRunGrantBrokerWorkflowGenerated { content } => artifact_generated(content: content)
+      BranchRunGrantBrokerWorkflowGenerationRefused { reason } => ArtifactGenerationRefused { reason: reason }
     }
     GitignoreArtifact => artifact_generated(content: expected_gitignore())
     CargoConfigArtifact => artifact_generated(content: expected_cargo_config_toml())
@@ -262,7 +262,7 @@ fn artifact_extra_valid(a: GeneratedArtifact, generated: ArtifactGenerationOutco
     MicrovmShakedownYamlArtifact => ci_yml_parses(path: artifact_path(a: a))
     InstrumentDispatchYamlArtifact => ci_yml_parses(path: artifact_path(a: a))
     HealWorkflowYamlArtifact => ci_yml_parses(path: artifact_path(a: a))
-    HealPublisherWorkflowYamlArtifact => ci_yml_parses(path: artifact_path(a: a))
+    BranchRunGrantBrokerWorkflowYamlArtifact => ci_yml_parses(path: artifact_path(a: a))
     GitignoreArtifact => true
     GitattributesArtifact => true
     CargoConfigArtifact => true
diff --git a/dag/gunbc/generated_artifact_registry.dag b/dag/gunbc/generated_artifact_registry.dag
index 817975f23b6..234bf2946d5 100644
--- a/dag/gunbc/generated_artifact_registry.dag
+++ b/dag/gunbc/generated_artifact_registry.dag
@@ -6,7 +6,7 @@ import gunbc.plan_registry { all_plans }
 import gunbc.fleet_intent { fleet_intent_known_hosts }
 import gunbc.generated_artifact {
   GeneratedArtifact, GeneratedArtifactProducerRow,
-  WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, CouponCadQueryProgramArtifact, Fci1BoundedExecutionContextArtifact, FileTransportRealizationGeneratedRsArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact,
+  WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, BranchRunGrantBrokerWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, CouponCadQueryProgramArtifact, Fci1BoundedExecutionContextArtifact, FileTransportRealizationGeneratedRsArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact,
   AutoinstallUserDataArtifact, RunnerHostSudoersArtifact, PlanArtifact,
   AuthorRegeneratesBeforeMerge, HealRegeneratesAfterProvisionalMerge,
   concurrent_divergence_repair, artifact_path, artifact_is_committed, artifact_eq, artifact_producer_row
@@ -22,7 +22,7 @@ import gunbc.generated_artifact {
 data generated_artifact_registry: List<GeneratedArtifact> = concat(
   concat(
     concat(
-      [WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, CouponCadQueryProgramArtifact, Fci1BoundedExecutionContextArtifact, FileTransportRealizationGeneratedRsArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact],
+      [WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, BranchRunGrantBrokerWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, CouponCadQueryProgramArtifact, Fci1BoundedExecutionContextArtifact, FileTransportRealizationGeneratedRsArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact],
       map(fleet_autoinstall_specs, s => AutoinstallUserDataArtifact { spec: s })
     ),
     map(fleet_intent_known_hosts, h => RunnerHostSudoersArtifact { host: h.identity })
diff --git a/dag/gunbc/generated_workflow_provenance.dag b/dag/gunbc/generated_workflow_provenance.dag
index fde3d36ef3f..59958fd1440 100644
--- a/dag/gunbc/generated_workflow_provenance.dag
+++ b/dag/gunbc/generated_workflow_provenance.dag
@@ -1,7 +1,7 @@
 module gunbc.generated_workflow_provenance
 
 import std.types { String, List }
-import gunbc.generated_artifact { GeneratedArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact }
+import gunbc.generated_artifact { GeneratedArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, BranchRunGrantBrokerWorkflowYamlArtifact }
 import gunbc.generated_artifact_registry { generated_artifact_registry }
 import std.optional { Present, Absent }
 
@@ -84,9 +84,9 @@ fn generated_workflow_provenance(a: GeneratedArtifact) -> GeneratedWorkflowProve
       generator: "gunbc.heal_workflow expected_heal_workflow_yml",
       authority: "gunbc.heal_workflow heal_workflow",
     } }
-    HealPublisherWorkflowYamlArtifact => Present { value: GeneratedWorkflowProvenance {
-      generator: "gunbc.heal_publisher_workflow expected_heal_publisher_workflow_yml",
-      authority: "gunbc.heal_publisher_workflow heal_publisher_workflow",
+    BranchRunGrantBrokerWorkflowYamlArtifact => Present { value: GeneratedWorkflowProvenance {
+      generator: "gunbc.branch_run_grant_broker_workflow expected_branch_run_grant_broker_workflow_yml",
+      authority: "gunbc.branch_run_grant_broker_workflow branch_run_grant_broker_workflow",
     } }
     _ => none
   }
diff --git a/dag/gunbc/github_effect_perform.dag b/dag/gunbc/github_effect_perform.dag
index 565bc4b9f86..7c78e17218e 100644
--- a/dag/gunbc/github_effect_perform.dag
+++ b/dag/gunbc/github_effect_perform.dag
@@ -1,7 +1,8 @@
 module gunbc.github_effect_perform
 
-import std.types { String, NonEmptyStr, Int, List, Secret, EpochSecs }
+import std.types { String, NonEmptyStr, Int, List, Secret, EpochSecs, Bytes }
 import std.resources { Network }
+import std.decl_ref { decl_ref }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
 import extdeps.clock {
   clock_unix_millis_read, ClockUnixMillisObserved, ClockUnixMillisRefused, epoch_secs_of_millis,
@@ -29,6 +30,16 @@ import extdeps.github.app
 import extdeps.github.actions_jit_runner
 import extdeps.github.actions_self_hosted_runners
 import extdeps.github.actions_self_hosted_runners { OrganizationRunnerListWire, OrganizationRunnerDeletedBody }
+import extdeps.github.workflows
+import extdeps.github.workflows { WorkflowDispatchReceipt }
+import extdeps.github.workflow_runs
+import extdeps.github.git_database
+import extdeps.github.git_database { GitRefWire, GitRefDeletedBody }
+import extdeps.github.org_actions
+import extdeps.github.org_actions { OrgRunnerGroupWire }
+import extdeps.github.workflow_runs { WorkflowRun, WorkflowJobRunList }
+import extdeps.github.actions_artifacts
+import extdeps.github.actions_artifacts { ActionsArtifactList }
 import gunbc.auth.github_apps { DeclaredGitHubApp, gunbai_ci_declared }
 import extdeps.github.app { GitHubAppInstallationId }
 import gunbc.runner.runner_jit_perform {
@@ -138,10 +149,17 @@ type JitMintAppJwt
 // same jit_config_mint_outcome every status goes through, so an empty blob under 201 is still
 // refused there; a non-2xx the remote DECIDED is a JitConfigMintOutcome refusal; an answer that
 // never arrived is commit-ambiguous and is NOT reported as a refusal.
+//
+// ADMITTED ONLY FROM THE PERFORM FUNCTION AND A CLAIM. This fold takes the dispatch and the answer
+// separately, so an open call would mint a delivery for dispatch A from any 201 body; the perform
+// function is the one caller whose answer is GitHub's response to dispatch.request.
 fn jit_mint_performance_of_generate(
   dispatch: JitMintDispatch,
   outcome: RestResult<JitConfigCreatedBody>,
-) -> JitMintPerformance {
+) -> JitMintPerformance admit_callers: [
+  decl_ref(module_path: "gunbc.github_effect_perform", decl_name: "perform_organization_jit_mint"),
+  decl_ref(module_path: "test.claim.github_effect_perform_witness", decl_name: "witness_generate_step_delivers_refuses_or_reports_ambiguity_by_what_github_answered"),
+] {
   match outcome {
     RestAnswered { answer: created } =>
       JitMintReceived {
@@ -317,3 +335,157 @@ fn delete_runner_with(token: ControllerInstallationToken, organization: NonEmpty
     RestRefused { refusal } => RestRefused { refusal: refusal }
   }
 }
+
+// THE QUALIFICATION DISPATCH AND ITS READBACK, under the same controller installation token
+// (gunbc.runner.runner_qualification_dispatch). Each answer is GitHub's RestResult, sealed so the
+// decision module receives only what GitHub returned; the decision classifies a refusal as a read's
+// or a mutation's (extdeps.transports.rest classify_rest_refusal), so for the dispatch a 5xx, a lost
+// response or an undecodable 200 is commit-ambiguous rather than refused.
+type WorkflowDispatchAnswer sole_constructor {
+  dispatch: RestResult<WorkflowDispatchReceipt>
+}
+
+fn dispatch_workflow_with(
+  token: ControllerInstallationToken,
+  owner: NonEmptyStr,
+  repo: NonEmptyStr,
+  workflow_id: NonEmptyStr,
+  git_ref: NonEmptyStr,
+  inputs: Map<String, String>,
+) -> WorkflowDispatchAnswer uses net: Network {
+  let answered = github.Workflows.CreateDispatch(
+    auth_token: token.token,
+    owner: owner as String,
+    repo: repo as String,
+    workflow_id: workflow_id as String,
+    ref: git_ref as String,
+    inputs: inputs,
+  )
+  WorkflowDispatchAnswer {
+    dispatch: match answered {
+      RestAnswered { answer } => RestAnswered { answer: answer.result }
+      RestRefused { refusal } => RestRefused { refusal: refusal }
+    },
+  }
+}
+
+type WorkflowRunRead sole_constructor {
+  run: RestResult<WorkflowRun>
+}
+
+fn read_run_with(token: ControllerInstallationToken, owner: NonEmptyStr, repo: NonEmptyStr, run_id: Int) -> WorkflowRunRead uses net: Network {
+  let read = github.WorkflowRuns.GetRun(auth_token: token.token, owner: owner as String, repo: repo as String, run_id: run_id as String)
+  WorkflowRunRead {
+    run: match read {
+      RestAnswered { answer } => RestAnswered { answer: answer.run }
+      RestRefused { refusal } => RestRefused { refusal: refusal }
+    },
+  }
+}
+
+type WorkflowAttemptJobsRead sole_constructor {
+  jobs: RestResult<WorkflowJobRunList>
+}
+
+fn read_attempt_jobs_with(token: ControllerInstallationToken, owner: NonEmptyStr, repo: NonEmptyStr, run_id: Int, attempt: Int) -> WorkflowAttemptJobsRead uses net: Network {
+  let read = github.WorkflowRuns.ListAttemptJobs(auth_token: token.token, owner: owner as String, repo: repo as String, run_id: run_id as String, attempt_number: attempt)
+  WorkflowAttemptJobsRead {
+    jobs: match read {
+      RestAnswered { answer } => RestAnswered { answer: answer.result }
+      RestRefused { refusal } => RestRefused { refusal: refusal }
+    },
+  }
+}
+
+// THE QUALIFICATION RUN'S OUTPUTS, READ UNDER THE SAME CONTROLLER TOKEN AS THE RUN ITSELF. One job's
+// log (actions/download-job-logs-for-workflow-run, followed through its redirect by the bound REST
+// handler), the run's artifact listing, and one artifact's archive. Each answer is sealed beside its
+// RestResult, like the run and job reads above, so a consumer cannot pair a body with a result it
+// did not come with. The archive is Bytes and today's handler reads bodies as text,
+// so a real download answers RestRefused with RestBodyUndecodable (extdeps.github.actions_artifacts).
+type WorkflowJobLogRead sole_constructor {
+  job_id: Int
+  log: RestResult<String>
+}
+
+fn read_job_log_with(token: ControllerInstallationToken, owner: NonEmptyStr, repo: NonEmptyStr, job_id: Int) -> WorkflowJobLogRead uses net: Network {
+  let read = github.WorkflowRuns.DownloadJobLogsForWorkflowRun(auth_token: token.token, owner: owner as String, repo: repo as String, job_id: job_id as String)
+  WorkflowJobLogRead {
+    job_id: job_id,
+    log: match read {
+      RestAnswered { answer } => RestAnswered { answer: answer.log }
+      RestRefused { refusal } => RestRefused { refusal: refusal }
+    },
+  }
+}
+
+type WorkflowRunArtifactsRead sole_constructor {
+  listed: RestResult<ActionsArtifactList>
+}
+
+fn list_run_artifacts_with(token: ControllerInstallationToken, owner: NonEmptyStr, repo: NonEmptyStr, run_id: Int) -> WorkflowRunArtifactsRead uses net: Network {
+  let read = github.Artifacts.ListWorkflowRunArtifacts(auth_token: token.token, owner: owner as String, repo: repo as String, run_id: run_id as String)
+  WorkflowRunArtifactsRead {
+    listed: match read {
+      RestAnswered { answer } => RestAnswered { answer: answer.result }
+      RestRefused { refusal } => RestRefused { refusal: refusal }
+    },
+  }
+}
+
+type ArtifactArchiveRead sole_constructor {
+  artifact_id: Int
+  archive: RestResult<Bytes>
+}
+
+fn download_artifact_with(token: ControllerInstallationToken, owner: NonEmptyStr, repo: NonEmptyStr, artifact_id: Int) -> ArtifactArchiveRead uses net: Network {
+  let read = github.Artifacts.DownloadArtifact(auth_token: token.token, owner: owner as String, repo: repo as String, artifact_id: artifact_id as String)
+  ArtifactArchiveRead {
+    artifact_id: artifact_id,
+    archive: match read {
+      RestAnswered { answer } => RestAnswered { answer: answer.archive }
+      RestRefused { refusal } => RestRefused { refusal: refusal }
+    },
+  }
+}
+
+// THE QUALIFICATION REF PIN'S EXCHANGES (gunbc.runner.runner_qualification_ref_pin), under the same
+// controller installation token. Ref and group reads are reads; the create, delete and group write
+// are mutations, so a lost answer is commit-ambiguous. Each answer is sealed for the same reason as
+// the dispatch's: the decision module judges only what GitHub returned.
+type GitRefRead sole_constructor {
+  reference: RestResult<GitRefWire>
+}
+
+fn read_git_ref_with(token: ControllerInstallationToken, owner: NonEmptyStr, repo: NonEmptyStr, ref: NonEmptyStr) -> GitRefRead uses net: Network {
+  let read = github.GitDatabase.GetRef(auth_token: token.token, owner: owner as String, repo: repo as String, ref: ref as String)
+  GitRefRead {
+    reference: match read {
+      RestAnswered { answer } => RestAnswered { answer: answer.reference }
+      RestRefused { refusal } => RestRefused { refusal: refusal }
+    },
+  }
+}
+
+fn create_git_ref_with(token: ControllerInstallationToken, owner: NonEmptyStr, repo: NonEmptyStr, full_ref: NonEmptyStr, sha: String) -> RestResult<GitRefWire> uses net: Network {
+  match github.GitDatabase.CreateRef(auth_token: token.token, owner: owner as String, repo: repo as String, full_ref: full_ref as String, sha: sha) {
+    RestAnswered { answer } => RestAnswered { answer: answer.reference }
+    RestRefused { refusal } => RestRefused { refusal: refusal }
+  }
+}
+
+fn delete_git_ref_with(token: ControllerInstallationToken, owner: NonEmptyStr, repo: NonEmptyStr, ref: NonEmptyStr) -> RestResult<GitRefDeletedBody> uses net: Network {
+  match github.GitDatabase.DeleteRef(auth_token: token.token, owner: owner as String, repo: repo as String, ref: ref as String) {
+    RestAnswered { answer } => RestAnswered { answer: answer.result }
+    RestRefused { refusal } => RestRefused { refusal: refusal }
+  }
+}
+
+fn update_runner_group_workflows_with(token: ControllerInstallationToken, organization: NonEmptyStr, runner_group_id: Int, selected_workflows: List<String>) -> RestResult<OrgRunnerGroupWire> uses net: Network {
+  match github.OrgRunnerGroupsRest.UpdateOrganizationRunnerGroupWorkflows(
+    installation_token: token.token, org: organization, runner_group_id: runner_group_id, selected_workflows: selected_workflows,
+  ) {
+    RestAnswered { answer } => RestAnswered { answer: answer.result }
+    RestRefused { refusal } => RestRefused { refusal: refusal }
+  }
+}
diff --git a/dag/gunbc/guarantee_stall/accumulator_copy_untyped_combiner_refusals_stall.dag b/dag/gunbc/guarantee_stall/accumulator_copy_untyped_combiner_refusals_stall.dag
index f09d8ea1d4d..1abc32ed95f 100644
--- a/dag/gunbc/guarantee_stall/accumulator_copy_untyped_combiner_refusals_stall.dag
+++ b/dag/gunbc/guarantee_stall/accumulator_copy_untyped_combiner_refusals_stall.dag
@@ -41,6 +41,20 @@ import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, BoundedPopula
 // containing folds, and is not established. Reading a resolved tree would also need one lens arm: resolve
 // rewrites || and && to canonical-operation wire nodes (v2.compiler.resolve resolve_surface_operator_atom),
 // which lowered_transform_combiner_optional reads as Absent today.
+//
+// RESIDUE AFTER THE KERNEL-PRIMITIVE TIER (PR 2 of this lane). A free kernel call head no declaration claims now
+// binds at RESOLVE to its std.primitives contract row (v2.compiler.primitive_authority), so concat/reverse-class
+// refusals at resolve are gone; infer then REFUSES such a call with infer_reason_primitive_without_declared_signature_authority,
+// typed and located at the callee, never typing it as unknown. What remains is the grounding this stall waits
+// on: infer needs a .dag SIGNATURE authority for primitives. Today the typed signatures live only in the seed's
+// Rust builtin_function_registry (v1_compiler_infer_method), and std.primitives PrimitiveContract carries cost,
+// not types. Modeling that in .dag is a separate model change and must become the single authority; until
+// it lands no std.change body that calls reverse (or any non-roster primitive) reaches an inferred tree.
+// KERNEL TYPES ARE NOT COVERED by that tier, deliberately: it binds call heads to a contract row, and std.primitives
+// declares no type rows. std.algebra's Map (resolve_unbound_name_is_declared_elsewhere std.types.Map) stays refused
+// because the only declaring module, std.types, imports std.algebra, so importing it back is a cycle; its resolution
+// belongs to the type's own authority, not to the call-head tier. Measured after the tier: std.types stops at the
+// free name none and std.change at none, both declared in no authority.
 data accumulator_copy_untyped_combiner_refusals_stall: GuaranteeStall = GuaranteeStall {
   subject: "v2.lens.complexity_accumulator_copy.analyze refuses combiner_unregistered_carrier_reaches where a carrier reaches an operator or named callee whose copying depends on its operand type or callee declaration, which the pre-inference subject does not carry; observed over dag/std/change.dag, src/v2/extdeps/languages/lean.dag and src/v2/lens/complexity_accumulator_copy/analyze.dag, where the three offline roster ratchets are red",
   current: Mitigatable,
diff --git a/dag/gunbc/guarantee_stall/authored_record_field_list_standing_for_type_population_stall.dag b/dag/gunbc/guarantee_stall/authored_record_field_list_standing_for_type_population_stall.dag
new file mode 100644
index 00000000000..0b65eff47d5
--- /dev/null
+++ b/dag/gunbc/guarantee_stall/authored_record_field_list_standing_for_type_population_stall.dag
@@ -0,0 +1,39 @@
+module gunbc.guarantee_stall.authored_record_field_list_standing_for_type_population_stall
+
+import gunbc.guarantee_rung { Mitigatable, StructurallyImpossible }
+import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, BoundedPopulation, climbs_when }
+
+// WHY THIS IS A STALL AND NOT A SECTION 4b(3) DROP. Nothing was lowered. Before the BmcSecure
+// observation join grew past four fields, the join already bound an authored subset; extending it
+// to the rest of BmcAccountStateObservation except controller_clock did not drop a rung that had
+// been held. DESIGN section 4b(2) requires a class below its ceiling to name its next-rung trigger.
+//
+// HOMES CHECKED BEFORE MINTING, so this is not a nickname of an existing class:
+// gunbc.guarantee_stall.axis_list_re_enumerates_its_variant_type_stall -- authored list mirroring a
+// declared COPRODUCT constructor population; waits on constructor enumeration. Record field
+// identity-and-type is a different primitive.
+// gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall -- authored roster of DATA
+// declarations; waits on declaration VALUE BINDING. A List<GuaranteeStall> is not a record field set.
+// gunbc.recurring_failure_mode.optional_equality_answers_by_representation -- Optional == answering
+// by representation (interpreter `first` vs Present). That is one ARM of this row's OR trigger, not
+// the authored-field-list class.
+// gunbc.recurring_failure_mode.handwritten_population_wrong_by_gain_and_by_loss,
+// gunbc.recurring_failure_mode.roster_is_its_own_denominator -- waiter/report lists, not type fields.
+// gunbc.recurring_failure_mode.kind_carried_but_its_fields_stay_optional -- Node payload optionality.
+// gunbc.recurring_failure_mode.a_pattern_binding_a_subset_of_fields_is_an_implicit_wildcard -- match
+// wildcards, not equality adapters.
+data authored_record_field_list_standing_for_type_population_stall: GuaranteeStall = GuaranteeStall {
+  subject: "an authored field list stands for a record type's declared population, so a new field or a new Optional can fall out of an equality join silently",
+  current: Mitigatable,
+  ceiling: StructurallyImpossible,
+  blocker: AwaitsOneGrounding {
+    grounding: "a value-layer read of a record's declared fields with their types, sufficient to refuse an unhandled field or Optional at a join; or structural == that is value-exact over Optionals (gunbc#13488), after which clock blanking and the hand match delete",
+  },
+  population: BoundedPopulation {
+    members: [
+      "gunbc.machine_intake_bmc_secure bmc_account_state_observation_same",
+      "gunbc.machine_intake_bmc_secure controller_clock_reading_same",
+    ],
+  },
+  next_rung_trigger: climbs_when(capability: "a value-layer read of a record's declared fields with their types, sufficient to refuse an unhandled field or an unhandled Optional at this join, checked by field identity and declared type never by count; OR gunbc#13488 making structural == value-exact over Optionals, after which observation_with_controller_clock blanking and controller_clock_reading_same are deleted. A count of fields, a comment claiming completeness, or a second authored list is not this capability"),
+}
diff --git a/dag/gunbc/guarantee_stall/emitted_inline_crate_path_edges_unreturned_stall.dag b/dag/gunbc/guarantee_stall/emitted_inline_crate_path_edges_unreturned_stall.dag
index 142f5b21d12..ac342d5a752 100644
--- a/dag/gunbc/guarantee_stall/emitted_inline_crate_path_edges_unreturned_stall.dag
+++ b/dag/gunbc/guarantee_stall/emitted_inline_crate_path_edges_unreturned_stall.dag
@@ -4,13 +4,15 @@ import v2.std.algebra { Cons, Empty }
 import gunbc.guarantee_rung { Mitigatable, StructurallyGuaranteed }
 import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, BoundedPopulation, climbs_when }
 
-// ROSTERED AS A STALL, NOT A RUNG DROP: nothing fell. No partition has ever seen an inline
-// crate::<module>:: path the expression emitter writes, so previous/temporary/reason would
-// fabricate an event (gunbc.rung_drop states the distinction). The use-line population reaches the
+// ROSTERED AS A STALL, NOT A RUNG DROP: nothing fell. The use-line population reaches the
 // partition through gunbc.rust_emitted_edge; these four deciders write their paths inside
-// emit_typed_expr / render_rust_type, which return String, so the edge they decide is not returned.
-// A missed inline edge is not silent: the multi-crate build of the partition (Pkg7e) fails loudly
-// with an unresolved crate path, which is the current rung.
+// emit_typed_expr / render_rust_type, which return String, so the edge they decide is not returned
+// WITH THE TEXT. Since gunbc#13597 the partition sees them anyway: v1.compiler.emit_rust
+// emitted_inline_path_edges reads every `crate::<module>` path back off each emitted module's code
+// (outside comments, use declarations and string literals) and returns it as an InlinePathReference
+// source edge. That is a reading of the text, not a structural return, so the rung is unchanged --
+// a renderer that wrote a path the reader cannot see would still fail only at the multi-crate build,
+// loudly, with an unresolved crate path. The trigger below dissolves the reader.
 data emitted_inline_crate_path_edges_unreturned_stall: GuaranteeStall = GuaranteeStall {
   subject: "cross-module crate::<module>:: paths written inline by the Rust expression and type emitter, absent from the edge set the crate partition decides over",
   current: Mitigatable,
diff --git a/dag/gunbc/guarantee_stall/grammar_change_parses_no_real_corpus_file_stall.dag b/dag/gunbc/guarantee_stall/grammar_change_parses_no_real_corpus_file_stall.dag
new file mode 100644
index 00000000000..f0323a9925a
--- /dev/null
+++ b/dag/gunbc/guarantee_stall/grammar_change_parses_no_real_corpus_file_stall.dag
@@ -0,0 +1,32 @@
+module gunbc.guarantee_stall.grammar_change_parses_no_real_corpus_file_stall
+
+import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
+import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, UncountedNotEnumerable, climbs_when }
+
+// A §4b(2) STALL, NOT A §4b(3) DROP: no control has ever parsed real corpus files on a grammar
+// change, so nothing fell and there is no previous rung to name (gunbc.rung_drop's own header
+// routes a never-held class here). Declared under sharp-raven-357's ruling of 2026-10-03 on
+// gunbc#13126, after gunbc#13056 broke src/v2/std/node.dag, dag/gunbc/scm/object_store.dag and
+// src/v2/workflow/realization_runner.dag with every merge-gating check green.
+//
+// WHAT HOLDS TODAY. The floor carries route controls on supplied source: one per production the
+// zero-overlap grammar program changed, plus the verbatim broken shapes, in the admitted
+// test.claim.parse_test family (test.claim.parse_test_grammar_program_routes and its siblings). They
+// catch a regression of those shapes and no other: a grammar change that breaks a real file through a
+// shape no control spells still merges.
+//
+// THE BLOCKER IS COST ON THE INTERPRETED ROUTE. Its instrument: one real corpus file parsed through
+// the v2 front end by v2.lens.enforcement.grammar_coverage grammar_coverage_ingest_path, executed as a
+// claim under claim_batch, which reports that claim's eval steps and CPU. On the interpreted route a
+// whole file costs orders of magnitude more than the floor's new-witness budget per claim; the
+// native-built parser does not. So the climb is the native route gating, not an interpreter ceiling
+// lane (the operator declined a long-test CI lane, so nothing gating would run interpreted whole-file
+// claims).
+data grammar_change_parses_no_real_corpus_file_stall: GuaranteeStall = GuaranteeStall {
+  subject: "A grammar-authority change merges without any control parsing the real corpus files it can affect: today no control parses real corpus files on a grammar change, which is how gunbc#13056 broke src/v2/std/node.dag unseen. Held instead: supplied-source route controls, one per changed production, plus the verbatim broken shapes",
+  current: Mitigatable,
+  ceiling: MechanicallyPreventable,
+  blocker: AwaitsOneGrounding { grounding: "the native-built parser on the merge path: a whole-file parse on the interpreted route exceeds the floor's per-claim budget by orders of magnitude (re-derived by v2.lens.enforcement.grammar_coverage grammar_coverage_ingest_path under claim_batch)" },
+  population: UncountedNotEnumerable { reason: "the corpus .dag files a grammar-authority change can affect" },
+  next_rung_trigger: climbs_when(capability: "every corpus file is parsed by the native-built parser on every pull request that changes a grammar authority, and a parse refusal blocks the merge.")
+}
diff --git a/dag/gunbc/guarantee_stall/member_kind_door_binding_executed_by_no_claim_stall.dag b/dag/gunbc/guarantee_stall/member_kind_door_binding_executed_by_no_claim_stall.dag
new file mode 100644
index 00000000000..15a0f4cb8f4
--- /dev/null
+++ b/dag/gunbc/guarantee_stall/member_kind_door_binding_executed_by_no_claim_stall.dag
@@ -0,0 +1,25 @@
+module gunbc.guarantee_stall.member_kind_door_binding_executed_by_no_claim_stall
+
+import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
+import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, BoundedPopulation, climbs_when }
+
+// A NEW LINK THAT HAS NEVER EXECUTED, RECORDED AS A STALL -- NOT A DROP: no rung stood here and none is claimed to have
+// fallen. gunbc#13513 carries the authored data-vs-fn kind from normalize to the mandatory_tag gate
+// (NormalizedTree.member_declarations -> member_kind_channel_of_tree -> ResolvedTree.member_kinds). The legs
+// normalize -> member_kind_channel_of_tree -> gate execute in test.long.mandatory_tag_gate_witness. The leg from
+// v2.compiler.name_resolve resolve_in_context (subject_member_kind_channel) through ResolvedTree.member_kinds to
+// v2.compiler.compile validate_then_compile's mandatory_tag_root_lens_with_provenance binding is compiled and
+// typechecked and executed by no claim: a door-grain control through compile_source_root_ingest_with_admission was
+// refused with member_not_a_binder by a roster lens ahead of mandatory_tag on even a trivial single-module extdeps.*
+// subject, a refusal independent of #13513 and filed as its own item. Each removed door-grain witness measured roughly
+// 470-560k eval steps against the 72300 new-witness budget, so it is a long-lane witness once runnable.
+data member_kind_door_binding_executed_by_no_claim_stall: GuaranteeStall = GuaranteeStall {
+  subject: "door-grain mandatory_tag provenance: the resolve_in_context -> ResolvedTree.member_kinds -> validate_then_compile mandatory_tag_root_lens_with_provenance link is executed by no claim",
+  current: Mitigatable,
+  ceiling: MechanicallyPreventable,
+  blocker: AwaitsOneGrounding { grounding: "the door accepting a minimal extdeps.* subject past every roster lens (the member_not_a_binder door refusal, its own item), which makes the door-grain controls runnable" },
+  population: BoundedPopulation { members: [
+      "v2.compiler.name_resolve resolve_in_context subject_member_kind_channel -> v2.compiler.resolve ResolvedTree.member_kinds -> v2.compiler.compile validate_then_compile mandatory_tag_root_lens_with_provenance, for every extdeps.* subject compiled through compile_source_root_ingest_with_admission"
+    ] },
+  next_rung_trigger: climbs_when(capability: "a minimal extdeps.* subject is accepted through compile_source_root_ingest_with_admission past every roster lens, and the door-grain mandatory_tag clean and zero-arg-fn impersonation controls execute on the long lane. SUFFICIENT FOR: deleting the ResolvedTree.member_kinds binding (or resolve_in_context's subject_member_kind_channel) turns a door-grain control red. A control that supplies the channel, runs a lens directly, or reaches the gate below the door retires nothing")
+}
diff --git a/dag/gunbc/guarantee_stall/native_step_trip_awaits_fleet_job_cgroup_stall.dag b/dag/gunbc/guarantee_stall/native_step_trip_awaits_fleet_job_cgroup_stall.dag
new file mode 100644
index 00000000000..c6c2b6c495b
--- /dev/null
+++ b/dag/gunbc/guarantee_stall/native_step_trip_awaits_fleet_job_cgroup_stall.dag
@@ -0,0 +1,43 @@
+module gunbc.guarantee_stall.native_step_trip_awaits_fleet_job_cgroup_stall
+
+import std.types { String, List }
+import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
+import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, BoundedPopulation, climbs_when }
+
+// A STALL, NOT A DROP (DESIGN section 4b(2) against 4b(3)): the per-step compiler trip the
+// 2026-10-09 ruling asked for -- the step's own cgroup bound at gunbc.emitted_subject_build_gate
+// native_step_memory_trip, under the fleet slot's throttle line, with a receipt at that grain --
+// was never held on the required path. main's witnesses.yml never carried the bind input, and the
+// first required run that passed it (38002497388 on gunbc#13658) refused in four seconds:
+// MemoryCgroupBindRefused, because memory_governor apply_memory_cgroup_bind creates its leaf at the
+// cgroup ROOT (a design for a process that is root of its own cgroup namespace, which the
+// remote-build containers are and a systemd-managed fleet host is not) and a fleet job runs as the
+// setpriv'd job user under a root unit (gunbc.runner_host_deploy). Nothing fell, so no drop's
+// previous rung is honest; what exists is a class below its ceiling with a named grounding.
+//
+// WHAT HOLDS MEANWHILE, and why `current` is Mitigatable rather than silence: every subject step
+// REQUIRES the slot's envelope (gunbc.emitted_subject_build_gate native_step_memory_envelope_env_name,
+// decided by gunbc.memory_envelope) -- gunbc test refuses a run that no cgroup with a numeric
+// memory.max binds, and refuses a run that was OOM-killed or charged swap inside that cgroup, from
+// readings taken before the producer and at exit -- and the slot's own MemoryMax with
+// MemorySwapMax=0 (gunbc.runner_slot_desired) is the hard maximum once converged.
+//
+// THE SWITCH is the fleet fact gunbc.runner_slot_desired gunbc_runner_slot_job_cgroup_ownership:
+// the gate's native_step_memory_inputs withholds the bind input while a job owns no bounded cgroup
+// and passes it the day the fact flips, with no other edit.
+data native_step_trip_awaits_fleet_job_cgroup_stall: GuaranteeStall = GuaranteeStall {
+  subject: "a required subject step outgrows its memory envelope: the compiler trips at native_step_memory_trip inside the step's own cgroup, under the slot's throttle line, with a receipt at that grain",
+  current: Mitigatable,
+  ceiling: MechanicallyPreventable,
+  blocker: AwaitsOneGrounding {
+    grounding: "a job-owned, memory-bounded cgroup on every fleet runner: the runner unit delegated (Delegate=yes with DelegateSubgroup= so the unit's own processes leave the delegated root), a per-job cgroup staged at native_step_memory_trip with no swap by the root JIT wrapper before setpriv (gunbc.runner_lifecycle runner_lifecycle_jit_wrapper_path), and the governor's UnnecessaryLimitAlreadyBinds arm reading that bound as the step's own -- or the job user able to create the leaf itself. Applied to hosts by converge, which is the operator's effect; the fact that flips is gunbc.runner_slot_desired gunbc_runner_slot_job_cgroup_ownership"
+  },
+  population: BoundedPopulation {
+    members: [
+      "the per-step trip on `emit and build //gunbc/instruments:self-host`: the step's own cgroup bound at native_step_memory_trip, so the compiler trips before the slot's throttle line and the runner process is never the kernel's candidate",
+      "the per-step trip on `emit and build //gunbc/instruments:v2-native-cli`, the same",
+      "the step-grain MEMORY RECEIPT: a peak_bytes that is this step's alone (the slot-grain receipt reports the OOM kills, high and max events the step added, swap at exit and whether the swap peak rose, and a peak since the slot's cgroup started)",
+    ]
+  },
+  next_rung_trigger: climbs_when(capability: "on every fleet runner, a required subject step runs inside a memory-bounded cgroup at native_step_memory_trip with per-step peak, OOM and swap counters of its own, observed as gunbc test's bind arm reporting Applicable or UnnecessaryLimitAlreadyBinds at the trip in a required run's log on each host class")
+}
diff --git a/dag/gunbc/guarantee_stall/roster.dag b/dag/gunbc/guarantee_stall/roster.dag
index 2240a5c4741..a58e73d6e54 100644
--- a/dag/gunbc/guarantee_stall/roster.dag
+++ b/dag/gunbc/guarantee_stall/roster.dag
@@ -30,6 +30,7 @@ import gunbc.guarantee_stall.doc_graph_dangling_link_population_stall { doc_grap
 import gunbc.guarantee_stall.enforcement_live_closure_gate_stall { enforcement_live_closure_gate_stall }
 import gunbc.guarantee_stall.mandatory_tag_live_corpus_stall { mandatory_tag_live_corpus_stall }
 import gunbc.guarantee_stall.test_reference_ledger_typed_census_stall { test_reference_ledger_typed_census_stall }
+import gunbc.guarantee_stall.grammar_change_parses_no_real_corpus_file_stall { grammar_change_parses_no_real_corpus_file_stall }
 import gunbc.guarantee_stall.parse_ingest_grammar_relation_stall { parse_ingest_grammar_relation_stall }
 import gunbc.guarantee_stall.required_regen_host_derivation_stall { required_regen_host_derivation_stall }
 import gunbc.guarantee_stall.self_host_hand_authorized_cargo_toml_stall { self_host_hand_authorized_cargo_toml_stall }
@@ -76,7 +77,10 @@ import gunbc.guarantee_stall.text_carrier_render_not_keyed_on_identity_stall { t
 import gunbc.guarantee_stall.free_semigroup_text_crossing_decided_by_spelling_stall { free_semigroup_text_crossing_decided_by_spelling_stall }
 import gunbc.guarantee_stall.emitted_inline_crate_path_edges_unreturned_stall { emitted_inline_crate_path_edges_unreturned_stall }
 import gunbc.guarantee_stall.compile_pool_provision_wired_but_unreachable_stall { compile_pool_provision_wired_but_unreachable_stall }
+import gunbc.guarantee_stall.member_kind_door_binding_executed_by_no_claim_stall { member_kind_door_binding_executed_by_no_claim_stall }
 import gunbc.guarantee_stall.filesystem_read_outcome_node_grain_census_stall { filesystem_read_outcome_node_grain_census_stall }
+import gunbc.guarantee_stall.authored_record_field_list_standing_for_type_population_stall { authored_record_field_list_standing_for_type_population_stall }
+import gunbc.guarantee_stall.native_step_trip_awaits_fleet_job_cgroup_stall { native_step_trip_awaits_fleet_job_cgroup_stall }
 
 // THE COHORT PROVENANCE NOTES BELOW WERE AUTHORED WHEN EVERY ROW SAT IN ONE FILE, and they are
 // carried here verbatim rather than split across the row modules they describe. Their membership
@@ -245,10 +249,14 @@ data all_guarantee_stalls: List<GuaranteeStall> = [
   emitted_inline_crate_path_edges_unreturned_stall,
   test_reference_ledger_typed_census_stall,
   compile_pool_provision_wired_but_unreachable_stall,
+  grammar_change_parses_no_real_corpus_file_stall,
   browser_ready_labels_fleet_route_stall,
   accumulator_copy_untyped_combiner_refusals_stall,
   keyed_apply_patch_rebuilds_rows_per_hunk_stall,
+  member_kind_door_binding_executed_by_no_claim_stall,
   filesystem_read_outcome_node_grain_census_stall,
+  authored_record_field_list_standing_for_type_population_stall,
+  native_step_trip_awaits_fleet_job_cgroup_stall,
 ]
 
 // THE FOUR SUBJECTS RESTORED TO THE ROSTER, PINNED BY IDENTITY SO THEIR LOSS REFUSES.
diff --git a/dag/gunbc/harness/harness_backend.dag b/dag/gunbc/harness/harness_backend.dag
index e000aa53412..7dbf60ae011 100644
--- a/dag/gunbc/harness/harness_backend.dag
+++ b/dag/gunbc/harness/harness_backend.dag
@@ -19,7 +19,7 @@ import extdeps.vllm.metrics {
   vllm_waiting_reason_label, vllm_waiting_reason_capacity,
 }
 import extdeps.prometheus.client { ProcessStartTimeSeconds, prometheus_process_series_name }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_wire }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire }
 import gunbc.spark.vllm_endpoint_process_launch {
   vllm_endpoint_process_launch, VllmEndpointProcessLaunchObservation, LaunchObserved, LaunchUnobserved,
 }
diff --git a/dag/gunbc/harness/harness_cli.dag b/dag/gunbc/harness/harness_cli.dag
index b4860965697..defa14d04d7 100644
--- a/dag/gunbc/harness/harness_cli.dag
+++ b/dag/gunbc/harness/harness_cli.dag
@@ -14,7 +14,7 @@ import std.process { ProcessExit, ExitSuccess, ExitFailure }
 import gunbc.harness.harness_tool { HarnessToolEnvironment }
 import gunbc.harness.harness_turn {
   HarnessTurnConfig, HarnessTurnOutcome, TurnProviderStopped, TurnCompletedByArtifact, TurnAlignmentCheckpointDue, harness_tool_contract_wire,
-  CompletesOnProviderStop, CompletesWhenEntryPresent, harness_run_turn, harness_outcome_label,
+  CompletesOnProviderStop, CompletesWhenEntryPresent, harness_run_turn, harness_outcome_label, TurnHostedQuotaFull, TurnHostedQuotaUnleasable, TurnHostedRateLimited,
   harness_outcome_detail, harness_event_placement_waiting,
 }
 import gunbc.harness.harness_guidance {
@@ -29,15 +29,16 @@ import gunbc.harness.harness_supervisor_guidance { supervisor_system_prompt_at }
 import gunbc.harness.harness_goal_audit_guidance { harness_auditor_guidance_at, audit_guidance_prose }
 import gunbc.roadmap.roadmap_review_role { review_verdict_shape_text }
 import gunbc.harness.harness_wire { harness_context_budget_for }
-import gunbc.harness.harness_reasoning_wire { HarnessServingUnit }
+import gunbc.harness.harness_reasoning_wire { HarnessServingUnit, NemotronUltraFreeOnOpenRouter }
+import gunbc.harness.harness_hosted_route { HarnessBackendAccess, BackendAdmittedBySeat, harness_hosted_backend_access, harness_hosted_access_wire }
 import gunbc.serving.turn_admission {
   ServingCoTenancyClass, InteractiveQualitySensitive, BatchQualityTolerant, serving_co_tenancy_class_wire,
 }
 import gunbc.harness.harness_seat_pointer { harness_seat_pointer_path, harness_seat_pointer_json }
 import gunbc.serving.caller_retry_contract { caller_backlog_wire, serving_route_caller_backlog }
 import gunbc.harness.harness_seat { harness_turn_request, harness_seat_pointer_of,
-  HarnessSeatBinding, HarnessSeatBound, HarnessSeatPending, HarnessSeatRefused, harness_bind_seat,
-  HarnessSeatRelease, HarnessSeatReleased, HarnessSeatReleaseRefused, harness_release_seat,
+  HarnessSeatBinding, HarnessSeatBound, HarnessSeatPending, HarnessSeatRefused, HarnessHostedBound, harness_bind_seat, harness_bind_hosted,
+  HarnessSeatRelease, HarnessSeatReleased, HarnessHostedCredentialRemoved, HarnessSeatReleaseRefused, harness_release_seat,
   harness_seat_release_wire, harness_release_held, harness_release_capability,
   HarnessReleaseCapability, harness_release_capability_wire,
   ServingModelRequirement, AnyAdmittedModel,
@@ -152,7 +153,9 @@ data harness_default_wire_shape: HarnessWireShape = OpenAiChatCompletionsShape
 // One longer round would have ended the run through the truncation refusal, correctly. At the
 // declared floor 16,384 tokens is about eleven minutes of decode, and the deadline below follows
 // by derivation rather than being re-guessed beside it.
-data harness_default_max_tokens: Int = token_count_value(t: token_count(count: 16384))
+data harness_default_max_token_count: TokenCount = token_count(count: 16384)
+
+data harness_default_max_tokens: Int = token_count_value(t: harness_default_max_token_count)
 
 // THE SLOWEST DECODE THIS DEPLOYMENT IS EXPECTED TO SUSTAIN, in tokens per second. It is a declared
 // policy floor rather than a measurement of any one run: observed rates here span 2.4 tok/s under
@@ -206,6 +209,7 @@ fn harness_executor_short_hostname() -> String {
 fn harness_turn_exit_released(outcome: HarnessTurnOutcome, seat: HarnessSeatRelease) -> ProcessExit {
   match seat {
     HarnessSeatReleased { partition: _ } => harness_turn_exit(outcome: outcome)
+    HarnessHostedCredentialRemoved => harness_turn_exit(outcome: outcome)
     HarnessSeatReleaseRefused { detail: d } =>
       ExitFailure { code: 1, reason: join([harness_outcome_label(outcome: outcome), "; seat ", harness_seat_release_wire(r: seat)], "") }
   }
@@ -236,22 +240,23 @@ fn harness_macbook_environment() -> HarnessToolEnvironment {
 // field the way it takes the worktree, the timeout program and its two paths -- so the same loop
 // runs against a different serving surface by being handed a different number, not by importing a
 // different authority.
-fn harness_macbook_config(backend_url: String, model: NonEmptyStr, unit: HarnessServingUnit) -> HarnessTurnConfig {
+fn harness_macbook_config(backend: HarnessBoundBackend) -> HarnessTurnConfig {
   HarnessTurnConfig {
-    backend_url: backend_url,
-    model: model as String,
+    backend_url: backend.url,
+    model: backend.model as String,
     max_tokens: harness_default_max_tokens,
-    serving_unit: unit,
-    reasoning_mode: harness_reasoning_mode,
+    serving_unit: backend.unit,
+    reasoning_mode: backend.reasoning,
     wire_shape: harness_default_wire_shape,
     system_prompt: harness_default_system_prompt,
     alignment_chain_fingerprint: "",
     request_scratch_path: harness_request_scratch_path,
     events_path: harness_probe_events_path,
-    context_budget: harness_context_budget_for(unit: unit),
+    context_budget: harness_context_budget_for(unit: backend.unit),
     request_deadline: harness_request_deadline,
     environment: harness_macbook_environment(),
     completion: CompletesOnProviderStop,
+    backend_access: backend.access,
   }
 }
 
@@ -262,9 +267,9 @@ fn harness_macbook_config(backend_url: String, model: NonEmptyStr, unit: Harness
 // posted, received a tool_use, executed it, posted the result back, and received a terminal.
 data harness_probe_prompt: String = "How many files in the dag/gunbc/harness directory of this repository end in .dag? Use run_command to find out, then state the number."
 
-fn harness_probe_outcome(backend_url: String, model: NonEmptyStr, unit: HarnessServingUnit) -> HarnessTurnOutcome {
+fn harness_probe_outcome(backend: HarnessBoundBackend) -> HarnessTurnOutcome {
   harness_run_turn(
-    config: harness_macbook_config(backend_url: backend_url, model: model, unit: unit),
+    config: harness_macbook_config(backend: backend),
     prompt: harness_probe_prompt,
     step_budget: harness_default_step_budget,
   )
@@ -291,6 +296,9 @@ fn harness_turn_exit(outcome: HarnessTurnOutcome) -> ProcessExit {
     TurnThinkingFormatInvalid { cause: _, steps_taken: _ } => harness_turn_refusal_exit(outcome: outcome)
     TurnUsageUnavailable { cause: _, steps_taken: _ } => harness_turn_refusal_exit(outcome: outcome)
     TurnSubmissionUndecodable { reason: _, steps_taken: _ } => harness_turn_refusal_exit(outcome: outcome)
+    TurnHostedQuotaFull { wire: _, steps_taken: _ } => harness_turn_refusal_exit(outcome: outcome)
+    TurnHostedQuotaUnleasable { detail: _, steps_taken: _ } => harness_turn_refusal_exit(outcome: outcome)
+    TurnHostedRateLimited { refusal: _, steps_taken: _ } => harness_turn_refusal_exit(outcome: outcome)
     TurnAlignmentCheckpointDue { steps_taken: _ } =>
       ExitFailure { code: 3, reason: harness_outcome_label(outcome: outcome) }
   }
@@ -367,6 +375,7 @@ fn harness_bind_seat_waiting(
         }
         HarnessSeatRefused { detail: _ } => acc
         HarnessSeatBound { url: _, grant: _, partition: _, ceiling: _, group_wire: _, launch: _, store: _, model: _, unit: _, class: _, seat: _ } => acc
+        HarnessHostedBound { url: _, model: _, unit: _, level: _, access: _ } => acc
       },
   )
   waited.binding
@@ -500,6 +509,8 @@ fn harness_place_for(request: String, attempt: String, receipt: String) -> Proce
         SeatPermitMinted { permit: permit } => harness_place_receipt(binding: binding, url: url, group_wire: group_wire, bound_model: bound_model, launch: launch, capability: capability, grant: grant, permit: permit, receipt: receipt)
       }
     }
+    HarnessHostedBound { url: _, model: _, unit: _, level: _, access: _ } =>
+      harness_place_receipt_failed(binding: binding, cause: "an any-model placement answered with a hosted binding, which holds no seat a router can be handed")
   }
 }
 
@@ -588,6 +599,7 @@ fn harness_release_admitted(partition: String, reference: String, grant: String,
   }
   match harness_release_held(short_hostname: harness_executor_short_hostname(), capability: capability, reason: reason as NonEmptyStr) {
     HarnessSeatReleased { partition: _ } => ExitSuccess
+    HarnessHostedCredentialRemoved => ExitFailure { code: 1, reason: join(["harness seat release for ", harness_release_capability_wire(c: capability), " answered as a hosted credential removal; the seat may still be held"], "") }
     HarnessSeatReleaseRefused { detail: d } =>
       ExitFailure { code: 1, reason: join(["harness seat release refused for ", harness_release_capability_wire(c: capability), ": ", d], "") }
   }
@@ -602,11 +614,11 @@ fn harness_release_admitted(partition: String, reference: String, grant: String,
 // while something else is in flight.
 fn harness_probe_cli() -> ProcessExit {
   let binding = harness_bind_seat(short_hostname: harness_executor_short_hostname(), class: BatchQualityTolerant, requirement: AnyAdmittedModel, shape: harness_default_wire_shape, inputs: harness_model_request_inputs(role: "probe", shape: harness_default_wire_shape, system_prompt: harness_default_system_prompt, user_input: harness_probe_prompt), actor: "probe" as NonEmptyStr, attempt: harness_probe_attempt(label: "probe"), policy: harness_seat_policy)
-  match binding {
-    HarnessSeatRefused { detail } => harness_backend_refusal_exit(detail: detail)
-    HarnessSeatPending { detail } => harness_placement_pending_exit(detail: detail)
-    HarnessSeatBound { url, grant: _, partition: _, ceiling: _, group_wire: _, launch: _, store: _, model: bound_model, unit: bound_unit, class: _, seat: _ } => {
-      let outcome = harness_probe_outcome(backend_url: url, model: bound_model, unit: bound_unit)
+  match harness_binding_answer(binding: binding) {
+    BindingRefused { detail } => harness_backend_refusal_exit(detail: detail)
+    BindingPending { detail } => harness_placement_pending_exit(detail: detail)
+    BindingReady { backend } => {
+      let outcome = harness_probe_outcome(backend: backend)
       let seat_release = harness_release_seat(binding: binding, reason: harness_outcome_label(outcome: outcome) as NonEmptyStr)
       harness_turn_exit_released(outcome: outcome, seat: seat_release)
     }
@@ -642,24 +654,22 @@ fn harness_worker_config(
   timeout_program: FilePath,
   request_scratch_path: FilePath,
   events_path: FilePath,
-  backend_url: String,
-  model: NonEmptyStr,
-  unit: HarnessServingUnit,
+  backend: HarnessBoundBackend,
   system_prompt: String,
   alignment_chain_fingerprint: String,
 ) -> HarnessTurnConfig {
   HarnessTurnConfig {
-    backend_url: backend_url,
-    model: model as String,
+    backend_url: backend.url,
+    model: backend.model as String,
     max_tokens: harness_default_max_tokens,
-    serving_unit: unit,
-    reasoning_mode: harness_reasoning_mode,
+    serving_unit: backend.unit,
+    reasoning_mode: backend.reasoning,
     wire_shape: harness_default_wire_shape,
     system_prompt: system_prompt,
     alignment_chain_fingerprint: alignment_chain_fingerprint,
     request_scratch_path: request_scratch_path,
     events_path: events_path,
-    context_budget: harness_context_budget_for(unit: unit),
+    context_budget: harness_context_budget_for(unit: backend.unit),
     request_deadline: harness_request_deadline,
     environment: HarnessToolEnvironment {
       working_directory: worktree,
@@ -667,6 +677,7 @@ fn harness_worker_config(
       duration_limit_seconds: harness_default_duration_limit_seconds,
     },
     completion: CompletesOnProviderStop,
+    backend_access: backend.access,
   }
 }
 
@@ -732,10 +743,10 @@ fn harness_worker_cli(
 ) -> ProcessExit {
   let system_prompt = harness_worker_system_prompt_at(worktree: worktree, repo_root: repo_root, gunbc_program: gunbc_program)
   let binding = harness_bind_seat_waiting(role: "worker", system_prompt: system_prompt, brief: brief, actor: join(["worker:", worktree], "") as NonEmptyStr, attempt: attempt_identity as NonEmptyStr, events_path: events_path)
-  match binding {
-    HarnessSeatRefused { detail } => harness_backend_refusal_exit(detail: detail)
-    HarnessSeatPending { detail } => harness_placement_pending_exit(detail: detail)
-    HarnessSeatBound { url, grant: _, partition: _, ceiling: _, group_wire: _, launch: _, store: _, model: bound_model, unit: bound_unit, class: _, seat: _ } => {
+  match harness_binding_answer(binding: binding) {
+    BindingRefused { detail } => harness_backend_refusal_exit(detail: detail)
+    BindingPending { detail } => harness_placement_pending_exit(detail: detail)
+    BindingReady { backend } => {
       match harness_seat_pointer_persist(events_path: events_path, binding: binding) {
         HarnessSeatPointerUnwritten { detail: pointer_detail } => harness_seat_pointer_refused_exit(binding: binding, detail: pointer_detail)
         HarnessSeatPointerWritten => {
@@ -745,9 +756,7 @@ fn harness_worker_cli(
               timeout_program: timeout_program as FilePath,
               request_scratch_path: request_scratch_path as FilePath,
               events_path: events_path as FilePath,
-              backend_url: url,
-              model: bound_model,
-              unit: bound_unit,
+              backend: backend,
               system_prompt: system_prompt,
               alignment_chain_fingerprint: alignment_chain_fingerprint,
             ),
@@ -787,23 +796,21 @@ fn harness_reviewer_config(
   events_path: FilePath,
   verdict_dir: String,
   verdict_name: String,
-  backend_url: String,
-  model: NonEmptyStr,
-  unit: HarnessServingUnit,
+  backend: HarnessBoundBackend,
   system_prompt: String,
 ) -> HarnessTurnConfig {
   HarnessTurnConfig {
-    backend_url: backend_url,
-    model: model as String,
+    backend_url: backend.url,
+    model: backend.model as String,
     max_tokens: harness_default_max_tokens,
-    serving_unit: unit,
-    reasoning_mode: harness_reasoning_mode,
+    serving_unit: backend.unit,
+    reasoning_mode: backend.reasoning,
     wire_shape: harness_default_wire_shape,
     system_prompt: system_prompt,
     alignment_chain_fingerprint: "",
     request_scratch_path: request_scratch_path,
     events_path: events_path,
-    context_budget: harness_context_budget_for(unit: unit),
+    context_budget: harness_context_budget_for(unit: backend.unit),
     request_deadline: harness_request_deadline,
     environment: HarnessToolEnvironment {
       working_directory: worktree,
@@ -811,6 +818,7 @@ fn harness_reviewer_config(
       duration_limit_seconds: harness_default_duration_limit_seconds,
     },
     completion: CompletesWhenEntryPresent { directory: verdict_dir, name: verdict_name },
+    backend_access: backend.access,
   }
 }
 
@@ -831,10 +839,10 @@ fn harness_reviewer_cli(
   let verdict_path = join([verdict_dir, "/", verdict_name], "")
   let system_prompt = harness_reviewer_system_prompt_at(worktree: worktree, verdict_path: verdict_path)
   let binding = harness_bind_seat_waiting(role: "reviewer", system_prompt: system_prompt, brief: brief, actor: join(["reviewer:", verdict_path], "") as NonEmptyStr, attempt: attempt_identity as NonEmptyStr, events_path: events_path)
-  match binding {
-    HarnessSeatRefused { detail } => harness_backend_refusal_exit(detail: detail)
-    HarnessSeatPending { detail } => harness_placement_pending_exit(detail: detail)
-    HarnessSeatBound { url, grant: _, partition: _, ceiling: _, group_wire: _, launch: _, store: _, model: bound_model, unit: bound_unit, class: _, seat: _ } => {
+  match harness_binding_answer(binding: binding) {
+    BindingRefused { detail } => harness_backend_refusal_exit(detail: detail)
+    BindingPending { detail } => harness_placement_pending_exit(detail: detail)
+    BindingReady { backend } => {
       match harness_seat_pointer_persist(events_path: events_path, binding: binding) {
         HarnessSeatPointerUnwritten { detail: pointer_detail } => harness_seat_pointer_refused_exit(binding: binding, detail: pointer_detail)
         HarnessSeatPointerWritten => {
@@ -846,9 +854,7 @@ fn harness_reviewer_cli(
               events_path: events_path as FilePath,
               verdict_dir: verdict_dir,
               verdict_name: verdict_name,
-              backend_url: url,
-              model: bound_model,
-              unit: bound_unit,
+              backend: backend,
               system_prompt: system_prompt,
             ),
             prompt: brief,
@@ -874,23 +880,21 @@ fn harness_auditor_config(
   events_path: FilePath,
   verdict_dir: String,
   verdict_name: String,
-  backend_url: String,
-  model: NonEmptyStr,
-  unit: HarnessServingUnit,
+  backend: HarnessBoundBackend,
   system_prompt: String,
 ) -> HarnessTurnConfig {
   HarnessTurnConfig {
-    backend_url: backend_url,
-    model: model as String,
+    backend_url: backend.url,
+    model: backend.model as String,
     max_tokens: harness_default_max_tokens,
-    serving_unit: unit,
-    reasoning_mode: harness_reasoning_mode,
+    serving_unit: backend.unit,
+    reasoning_mode: backend.reasoning,
     wire_shape: harness_default_wire_shape,
     system_prompt: system_prompt,
     alignment_chain_fingerprint: "",
     request_scratch_path: request_scratch_path,
     events_path: events_path,
-    context_budget: harness_context_budget_for(unit: unit),
+    context_budget: harness_context_budget_for(unit: backend.unit),
     request_deadline: harness_request_deadline,
     environment: HarnessToolEnvironment {
       working_directory: worktree,
@@ -898,6 +902,7 @@ fn harness_auditor_config(
       duration_limit_seconds: harness_default_duration_limit_seconds,
     },
     completion: CompletesWhenEntryPresent { directory: verdict_dir, name: verdict_name },
+    backend_access: backend.access,
   }
 }
 
@@ -917,10 +922,10 @@ fn harness_auditor_cli(
   let verdict_path = join([verdict_dir, "/", verdict_name], "")
   let system_prompt = harness_auditor_system_prompt_at(worktree: worktree, verdict_path: verdict_path)
   let binding = harness_bind_seat_waiting(role: "auditor", system_prompt: system_prompt, brief: brief, actor: join(["auditor:", verdict_path], "") as NonEmptyStr, attempt: attempt_identity as NonEmptyStr, events_path: events_path)
-  match binding {
-    HarnessSeatRefused { detail } => harness_backend_refusal_exit(detail: detail)
-    HarnessSeatPending { detail } => harness_placement_pending_exit(detail: detail)
-    HarnessSeatBound { url, grant: _, partition: _, ceiling: _, group_wire: _, launch: _, store: _, model: bound_model, unit: bound_unit, class: _, seat: _ } => {
+  match harness_binding_answer(binding: binding) {
+    BindingRefused { detail } => harness_backend_refusal_exit(detail: detail)
+    BindingPending { detail } => harness_placement_pending_exit(detail: detail)
+    BindingReady { backend } => {
       match harness_seat_pointer_persist(events_path: events_path, binding: binding) {
         HarnessSeatPointerUnwritten { detail: pointer_detail } => harness_seat_pointer_refused_exit(binding: binding, detail: pointer_detail)
         HarnessSeatPointerWritten => {
@@ -932,9 +937,7 @@ fn harness_auditor_cli(
               events_path: events_path as FilePath,
               verdict_dir: verdict_dir,
               verdict_name: verdict_name,
-              backend_url: url,
-              model: bound_model,
-              unit: bound_unit,
+              backend: backend,
               system_prompt: system_prompt,
             ),
             prompt: brief,
@@ -970,23 +973,21 @@ fn harness_supervisor_config(
   events_path: FilePath,
   verdict_dir: String,
   verdict_name: String,
-  backend_url: String,
-  model: NonEmptyStr,
-  unit: HarnessServingUnit,
+  backend: HarnessBoundBackend,
   system_prompt: String,
 ) -> HarnessTurnConfig {
   HarnessTurnConfig {
-    backend_url: backend_url,
-    model: model as String,
+    backend_url: backend.url,
+    model: backend.model as String,
     max_tokens: harness_default_max_tokens,
-    serving_unit: unit,
-    reasoning_mode: harness_reasoning_mode,
+    serving_unit: backend.unit,
+    reasoning_mode: backend.reasoning,
     wire_shape: harness_default_wire_shape,
     system_prompt: system_prompt,
     alignment_chain_fingerprint: "",
     request_scratch_path: request_scratch_path,
     events_path: events_path,
-    context_budget: harness_context_budget_for(unit: unit),
+    context_budget: harness_context_budget_for(unit: backend.unit),
     request_deadline: harness_request_deadline,
     environment: HarnessToolEnvironment {
       working_directory: worktree,
@@ -994,6 +995,7 @@ fn harness_supervisor_config(
       duration_limit_seconds: harness_default_duration_limit_seconds,
     },
     completion: CompletesWhenEntryPresent { directory: verdict_dir, name: verdict_name },
+    backend_access: backend.access,
   }
 }
 
@@ -1010,10 +1012,10 @@ fn harness_supervisor_cli(
   let verdict_path = join([verdict_dir, "/", verdict_name], "")
   let system_prompt = supervisor_system_prompt_at(worktree: worktree, verdict_path: verdict_path)
   let binding = harness_bind_seat_waiting(role: "supervisor", system_prompt: system_prompt, brief: brief, actor: join(["supervisor:", verdict_path], "") as NonEmptyStr, attempt: attempt_identity as NonEmptyStr, events_path: events_path)
-  match binding {
-    HarnessSeatRefused { detail } => harness_backend_refusal_exit(detail: detail)
-    HarnessSeatPending { detail } => harness_placement_pending_exit(detail: detail)
-    HarnessSeatBound { url, grant: _, partition: _, ceiling: _, group_wire: _, launch: _, store: _, model: bound_model, unit: bound_unit, class: _, seat: _ } => {
+  match harness_binding_answer(binding: binding) {
+    BindingRefused { detail } => harness_backend_refusal_exit(detail: detail)
+    BindingPending { detail } => harness_placement_pending_exit(detail: detail)
+    BindingReady { backend } => {
       match harness_seat_pointer_persist(events_path: events_path, binding: binding) {
         HarnessSeatPointerUnwritten { detail: pointer_detail } => harness_seat_pointer_refused_exit(binding: binding, detail: pointer_detail)
         HarnessSeatPointerWritten => {
@@ -1025,9 +1027,7 @@ fn harness_supervisor_cli(
               events_path: events_path as FilePath,
               verdict_dir: verdict_dir,
               verdict_name: verdict_name,
-              backend_url: url,
-              model: bound_model,
-              unit: bound_unit,
+              backend: backend,
               system_prompt: system_prompt,
             ),
             prompt: brief,
@@ -1045,11 +1045,11 @@ fn harness_supervisor_cli(
 // with a door beside it.
 fn harness_probe_report() -> String {
   let binding = harness_bind_seat(short_hostname: harness_executor_short_hostname(), class: BatchQualityTolerant, requirement: AnyAdmittedModel, shape: harness_default_wire_shape, inputs: harness_model_request_inputs(role: "probe", shape: harness_default_wire_shape, system_prompt: harness_default_system_prompt, user_input: harness_probe_prompt), actor: "probe-report" as NonEmptyStr, attempt: harness_probe_attempt(label: "probe-report"), policy: harness_seat_policy)
-  match binding {
-    HarnessSeatRefused { detail } => join(["harness probe refused before the turn: ", detail, "\n"], "")
-    HarnessSeatPending { detail } => join(["harness probe is pending placement: ", detail, "\n"], "")
-    HarnessSeatBound { url, grant: _, partition: _, ceiling: _, group_wire: _, launch: _, store: _, model: bound_model, unit: bound_unit, class: _, seat: _ } => {
-      let outcome = harness_probe_outcome(backend_url: url, model: bound_model, unit: bound_unit)
+  match harness_binding_answer(binding: binding) {
+    BindingRefused { detail } => join(["harness probe refused before the turn: ", detail, "\n"], "")
+    BindingPending { detail } => join(["harness probe is pending placement: ", detail, "\n"], "")
+    BindingReady { backend } => {
+      let outcome = harness_probe_outcome(backend: backend)
       let seat_release = harness_release_seat(binding: binding, reason: harness_outcome_label(outcome: outcome) as NonEmptyStr)
       join([
         "harness probe outcome: ", harness_outcome_label(outcome: outcome), "\n",
@@ -1059,3 +1059,90 @@ fn harness_probe_report() -> String {
     }
   }
 }
+
+// ── ONE BACKEND PER BINDING, WHICHEVER WAY IT WAS ADMITTED ────────────────────────────────────
+//
+// Every entry runs the same turn against what its binding names: where requests go, which model and
+// unit answer them, at which reasoning level, and how each request is admitted. A fleet seat runs at
+// the operator's declared level and posts unauthenticated over the fleet network; a hosted binding runs
+// at the level its route SELECTED and leases quota before each request. Deriving that once here is what
+// keeps the hosted arm from being a second copy of every entry body.
+type HarnessBoundBackend {
+  url: String
+  model: NonEmptyStr
+  unit: HarnessServingUnit
+  reasoning: HarnessReasoningLevel
+  access: HarnessBackendAccess
+}
+
+type HarnessBindingAnswer
+  = BindingRefused { detail: String }
+  | BindingPending { detail: String }
+  | BindingReady { backend: HarnessBoundBackend }
+
+fn harness_binding_answer(binding: HarnessSeatBinding) -> HarnessBindingAnswer {
+  match binding {
+    HarnessSeatRefused { detail: d } => BindingRefused { detail: d }
+    HarnessSeatPending { detail: d } => BindingPending { detail: d }
+    HarnessSeatBound { url: u, grant: _, partition: _, ceiling: _, group_wire: _, launch: _, store: _, model: m, unit: un, class: _, seat: _ } =>
+      BindingReady { backend: HarnessBoundBackend { url: u, model: m, unit: un, reasoning: harness_reasoning_mode, access: BackendAdmittedBySeat } }
+    HarnessHostedBound { url: u, model: m, unit: un, level: l, access: a } =>
+      BindingReady { backend: HarnessBoundBackend { url: u, model: m, unit: un, reasoning: l, access: harness_hosted_backend_access(access: a) } }
+  }
+}
+
+// THE HOSTED PROBE: the probe turn, placed on the hosted Nemotron 3 Ultra free listing by NAME. It is the
+// one entry that reaches a hosted unit, because an unnamed requirement never does (gunbc.harness.harness_seat
+// harness_requirement_placement): the listing is governed by NVIDIA's trial terms, so reaching it is an
+// operator's explicit act, not a placement default. It takes its tool environment as arguments, as the
+// worker does, so it runs on whatever host invokes it rather than assuming the MacBook's.
+// THE ROUTE'S STANDING IS WRITTEN BESIDE THE EVENTS BEFORE THE HOSTED PROBE'S TURN RUNS: the tier and daily
+// counters the key read reported, the quota rows each request is charged to, and the NVIDIA trial terms
+// that govern the endpoint. A run whose receipt cannot be written does not run, and gives its credential back.
+fn harness_hosted_route_receipt(binding: HarnessSeatBinding) -> String? {
+  match binding {
+    HarnessHostedBound { url: _, model: _, unit: _, level: _, access: a } => Present { value: harness_hosted_access_wire(access: a) }
+    HarnessSeatBound { url: _, grant: _, partition: _, ceiling: _, group_wire: _, launch: _, store: _, model: _, unit: _, class: _, seat: _ } => none
+    HarnessSeatPending { detail: _ } => none
+    HarnessSeatRefused { detail: _ } => none
+  }
+}
+
+fn harness_hosted_probe_cli(worktree: String, timeout_program: String, request_scratch_path: String, events_path: String) -> ProcessExit {
+  let binding = harness_bind_hosted(short_hostname: harness_executor_short_hostname(), unit: NemotronUltraFreeOnOpenRouter, actor: join(["hosted-probe:", worktree], "") as NonEmptyStr, max_tokens: harness_default_max_token_count)
+  match harness_binding_answer(binding: binding) {
+    BindingRefused { detail } => harness_backend_refusal_exit(detail: detail)
+    BindingPending { detail } => harness_placement_pending_exit(detail: detail)
+    BindingReady { backend } => {
+      match harness_hosted_route_receipt(binding: binding) {
+        Absent => {
+          let seat_release = harness_release_seat(binding: binding, reason: "the hosted route receipt could not be derived" as NonEmptyStr)
+          ExitFailure { code: 1, reason: join(["hosted probe: the binding carries no hosted access to describe; ", harness_seat_release_wire(r: seat_release)], "") }
+        }
+        Present { value: receipt } => {
+          let written = Filesystem.Write(path: join([events_path, ".route"], ""), content: concat(receipt, "\n"))
+          if !written.success {
+            let seat_release = harness_release_seat(binding: binding, reason: "the hosted route receipt could not be written" as NonEmptyStr)
+            ExitFailure { code: 1, reason: join(["hosted probe: the route receipt could not be written to ", events_path, ".route: ", written.error, "; ", harness_seat_release_wire(r: seat_release)], "") }
+          } else {
+            let outcome = harness_run_turn(
+              config: harness_worker_config(
+                worktree: worktree as FilePath,
+                timeout_program: timeout_program as FilePath,
+                request_scratch_path: request_scratch_path as FilePath,
+                events_path: events_path as FilePath,
+                backend: backend,
+                system_prompt: harness_default_system_prompt,
+                alignment_chain_fingerprint: "",
+              ),
+              prompt: harness_probe_prompt,
+              step_budget: harness_default_step_budget,
+            )
+            let seat_release = harness_release_seat(binding: binding, reason: harness_outcome_label(outcome: outcome) as NonEmptyStr)
+            harness_turn_exit_released(outcome: outcome, seat: seat_release)
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/dag/gunbc/harness/harness_guidance.dag b/dag/gunbc/harness/harness_guidance.dag
index 7d2d5bf52ef..13d1c4fec11 100644
--- a/dag/gunbc/harness/harness_guidance.dag
+++ b/dag/gunbc/harness/harness_guidance.dag
@@ -211,7 +211,7 @@ fn harness_worker_guidance_at(worktree: String, test_command: String, test_recei
     grounded(premise: IterationSelectsByPattern { grain: "//pkg:name" },
              module_path: "gunbc.compute.test_selection", decl_name: "select_witness_files"),
     grounded(premise: RunRebuildsOnTreeChange,
-             module_path: "gunbc.compute.work_request", decl_name: "work_identity"),
+             module_path: "gunbc.compute.work_provider_local", decl_name: "compute_work_identity"),
     grounded(premise: AcceptanceIsTheContractValidation,
              module_path: "gunbc.roadmap_execution_contract", decl_name: "validation_operation_command"),
     grounded(premise: CapabilityWithheld { capability: BuildOrTestOutsideTheProcess },
diff --git a/dag/gunbc/harness/harness_hosted_route.dag b/dag/gunbc/harness/harness_hosted_route.dag
new file mode 100644
index 00000000000..84a1d39210e
--- /dev/null
+++ b/dag/gunbc/harness/harness_hosted_route.dag
@@ -0,0 +1,670 @@
+module gunbc.harness.harness_hosted_route
+
+import std.types { String, Bool, Int, List, NonEmptyStr, FilePath, EpochSecs }
+import std.algebra { trim }
+import std.nat { Nat }
+import std.measure { TokenCount, token_count_value, Second, second, second_count, MoneyAmountMicro, money_amount_micro_count }
+import std.checked_arithmetic { checked_int_to_nat }
+import std.decl_ref { DeclarationRef, decl_ref, declaration_ref_eq }
+import std.interval { degenerate_interval }
+import std.pareto { AxisGap, AxisReading, HigherIsBetter, LowerIsBetter, ParetoEntry, SelectionAxis }
+import std.decision {
+  ChoiceDomain, ConstraintSatisfied, CausalModelEstablished, DecisionAssessment, DecisionConstraint,
+  DecisionRegion, DecisionSubject, DecisionVariable, ContextParameter, HardConstraint, ObjectiveMeasure,
+  ObjectiveTerm, ParameterBound, PhysicalModelEstablished, RealizationSelectionResult, MonotoneIncreasing,
+  UniqueSurvivorRequired, VariesAlong, VendorDocumentedCoupling, select_realization,
+  SelectedWithin, CandidateFieldUnestablished, NoFeasibleRealization, SelectionNeedsEvidence,
+  SelectionNeedsPolicy, RealizationSelectionRefused,
+}
+import std.upsert_decision { ObservationVerdict, Converged, Inaccessible }
+import extdeps.external_authority { CitedToAuthority }
+import extdeps.api_rate_limit { UpstreamRateLimit }
+import extdeps.cloud.gcp.secret_ref { SecretRef }
+import extdeps.cloud.gcp.secret_manager { SmEnabled }
+import extdeps.http.client
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.shell
+import extdeps.openrouter.openrouter {
+  OpenRouterReasoningEffort, openrouter_chat_completions_url, openrouter_key_url, openrouter_authorization_header_line,
+  openrouter_free_models_per_minute, openrouter_free_models_per_day, openrouter_reasoning_authority,
+  CreditsTierObserved, CreditsTierUnrecognized, openrouter_credits_from_daily_limit,
+  OpenRouterKeyRead, OpenRouterKeyDecoded, OpenRouterKeyUndecodable, openrouter_decode_key_read,
+  KeySpendUncapped, KeySpendCappedAtZero, KeySpendCappedAbove, openrouter_key_spend_limit_wire,
+  OpenRouterErrorDecoded, OpenRouterErrorUndecodable, openrouter_decode_error_body, openrouter_error_wire,
+  openrouter_effort_eq,
+}
+import extdeps.openrouter.nvidia_nemotron_3_ultra_free {
+  nemotron_ultra_free_max_completion_tokens, nemotron_ultra_free_supported_efforts,
+  nemotron_ultra_free_price_per_token, nemotron_ultra_free_terms,
+}
+import extdeps.nvidia.api_trial_terms { NvidiaApiTrialTerms, nvidia_api_trial_terms_wire }
+import gunbc.secret_provision { openrouter_free_tier_key_secret_ref }
+import gunbc.auth.access_token_source { AccessTokenReady, AccessTokenUpsertRequired, AccessTokenEnsureRefused, resolve_access_token, access_token_upsert_required_reason }
+import gunbc.auth.secret_ref_credential {
+  SecretCredentialReady, SecretCredentialAccessUpsertRequired, SecretCredentialWireDecodeRefused,
+  SecretCredentialFetchRefused, SecretCredentialResolvedVersionMismatch, fetch_secret_ref_credential_with_token,
+}
+import gunbc.auth.materialized_secret {
+  BearerHeaderFile, with_materialized_secret, MaterializationCompleted, MaterializationRefused,
+  SecretNotLive, SecretVersionUnusable, LivenessProbeNotIndependent,
+}
+import gunbc.readback_independence { ReadBackProbe, ProbeInert }
+import gunbc.fabric_quota {
+  QuotaLease, QuotaLeased, QuotaFull, QuotaLeaseRefused, fabric_quota_lease_for, QuotaTermToWindowEnd,
+  fabric_quota_settle, QuotaSettle, QuotaSettled, QuotaSettleRefused, quota_settle_wire,
+  fabric_quota_observe_upstream, QuotaUpstreamRecorded, QuotaObservationRefused,
+}
+import gunbc.harness.harness_reasoning_wire {
+  HarnessServingUnit, DeepseekV4FlashOnVllm, Glm53FlashOnVllm, NemotronUltraFreeOnOpenRouter,
+  HarnessReasoningLevel, ReasoningOff, ReasoningStandard, ReasoningMaximum, harness_reasoning_level_wire,
+  harness_openrouter_level_effort, harness_reasoning_kwargs_for, ReasoningKwargsAdmitted, ReasoningLevelUnsupported,
+  harness_unit_model_id, harness_serving_unit_wire,
+}
+
+// A HOSTED HARNESS ROUTE: a unit the harness reaches through an upstream it does not operate, admitted by
+// leasing that upstream's quota rather than by taking a seat on a serving group. The seat model
+// (gunbc.harness.harness_seat) is about co-tenancy on an engine with loaded state; a hosted upstream
+// meters REQUESTS against a credential, so the honest capacity fact is the per-request quota and its
+// carrier is gunbc.fabric_quota over the upstream's published UpstreamRateLimit rows.
+//
+// FOUR THINGS HAPPEN HERE AND NOWHERE ELSE: the route's facts are joined from their upstream authorities;
+// the reasoning level a turn on the route runs at is SELECTED, not written down; the credential is
+// materialized and its liveness read before any turn spends it; and each request leases both of the
+// upstream's pools before it goes out and settles them after.
+
+// ── THE ROUTE, JOINED FROM ITS AUTHORITIES ────────────────────────────────────────────────────
+
+type HarnessHostedRoute {
+  unit: HarnessServingUnit
+  url: NonEmptyStr
+  key_url: NonEmptyStr
+  secret: SecretRef
+  per_minute: UpstreamRateLimit
+  max_completion: TokenCount
+  supported_efforts: List<OpenRouterReasoningEffort>
+  price_per_token: MoneyAmountMicro
+  terms: NvidiaApiTrialTerms
+}
+
+// A FLEET UNIT HAS NO HOSTED ROUTE, and the answer is absent rather than a default route: a caller that
+// reached this function with a fleet unit has mis-dispatched, and the seat binder refuses it by name.
+fn harness_hosted_route_for(unit: HarnessServingUnit) -> HarnessHostedRoute? {
+  match unit {
+    DeepseekV4FlashOnVllm => none
+    Glm53FlashOnVllm => none
+    NemotronUltraFreeOnOpenRouter => Present { value: HarnessHostedRoute {
+      unit: unit,
+      url: openrouter_chat_completions_url,
+      key_url: openrouter_key_url,
+      secret: openrouter_free_tier_key_secret_ref,
+      per_minute: openrouter_free_models_per_minute,
+      max_completion: nemotron_ultra_free_max_completion_tokens,
+      supported_efforts: nemotron_ultra_free_supported_efforts,
+      price_per_token: nemotron_ultra_free_price_per_token,
+      terms: nemotron_ultra_free_terms,
+    } }
+  }
+}
+
+// ── THE REASONING LEVEL IS SELECTED, NOT WRITTEN DOWN ─────────────────────────────────────────
+//
+// The fleet harness runs at a declared level (gunbc.harness.harness_cli harness_reasoning_mode), chosen by
+// the operator for an engine whose compute is the fleet's. On a hosted free listing the trade is
+// different and stated by the listing itself: the price is zero per token and the limit is per request,
+// so a deeper effort costs neither money nor quota -- only latency and the completion budget its thinking
+// shares with the answer. That is a selection over a funded field (DESIGN section 3d), so it is asked of
+// std.decision rather than answered by a constant.
+//
+// THE FIELD is the harness's three levels. THE AXES are reasoning depth (higher is better; the rank is the
+// effort's position in the listing's supported_efforts, which the reasoning-tokens guide says are
+// "returned in descending effort order", with disabled below every effort), money per request and quota
+// per request (lower is better; equal across the field by the listing's price and the limits page's
+// per-request metering), and admissibility. THE HARD CONSTRAINT is admissibility: a level the unit cannot
+// express, or a request whose max_tokens exceeds the listing's completion ceiling, reads 0 and is excluded
+// before Pareto, never ranked.
+//
+// LATENCY IS NOT A FUNDED AXIS, and that is the stated reason the answer is the deepest admitted level:
+// nothing in this harness measures per-effort latency on this listing, and a turn's deadline already
+// bounds it (gunbc.harness.harness_cli harness_request_deadline). Funding latency without a reading
+// would answer SelectionNeedsEvidence, which is the honest arm the day a latency budget binds; until then
+// depth dominates on a field where money and quota are equal.
+data harness_hosted_selection_module: String = "gunbc.harness.harness_hosted_route"
+
+fn hosted_ref(name: String) -> DeclarationRef {
+  decl_ref(module_path: harness_hosted_selection_module, decl_name: name)
+}
+
+data ax_hosted_reasoning_depth: DeclarationRef = hosted_ref(name: "ax_hosted_reasoning_depth")
+data ax_hosted_money_per_request: DeclarationRef = hosted_ref(name: "ax_hosted_money_per_request")
+data ax_hosted_quota_per_request: DeclarationRef = hosted_ref(name: "ax_hosted_quota_per_request")
+data ax_hosted_level_admitted: DeclarationRef = hosted_ref(name: "ax_hosted_level_admitted")
+
+data harness_hosted_level_axes: List<SelectionAxis> = [
+  SelectionAxis { identity: ax_hosted_reasoning_depth, goal: HigherIsBetter },
+  SelectionAxis { identity: ax_hosted_money_per_request, goal: LowerIsBetter },
+  SelectionAxis { identity: ax_hosted_quota_per_request, goal: LowerIsBetter },
+  SelectionAxis { identity: ax_hosted_level_admitted, goal: HigherIsBetter },
+]
+
+data hosted_level_admitted_constraint: DeclarationRef = hosted_ref(name: "hosted_level_admitted_constraint")
+
+data harness_hosted_level_constraints: List<HardConstraint> = [
+  HardConstraint { identity: hosted_level_admitted_constraint, axis: ax_hosted_level_admitted, bound_micro: 1000000 },
+]
+
+fn hosted_level_identity(level: HarnessReasoningLevel) -> DeclarationRef {
+  hosted_ref(name: join(["hosted_level_", harness_reasoning_level_wire(level: level) as String], ""))
+}
+
+// THE DEPTH RANK, from the listing's own order. Disabled is 0; an effort at index i of an n-long
+// descending list ranks n - i; an effort the listing does not carry has no rank, and the level that maps
+// to it is inadmissible anyway, so its reading is 0 and the hard constraint is what excludes it.
+type HostedRankAcc { seen: Bool, rank: Int }
+
+fn hosted_effort_rank(efforts: List<OpenRouterReasoningEffort>, effort: OpenRouterReasoningEffort) -> Int {
+  let acc = fold(efforts, init: HostedRankAcc { seen: false, rank: 0 }, f: (a, e) => {
+    let seen = a.seen || openrouter_effort_eq(a: e, b: effort)
+    HostedRankAcc { seen: seen, rank: if seen { a.rank + 1 } else { 0 } }
+  })
+  acc.rank
+}
+
+fn hosted_level_depth_rank(route: HarnessHostedRoute, level: HarnessReasoningLevel) -> Int {
+  match harness_openrouter_level_effort(level: level) {
+    Absent => 0
+    Present { value: effort } => hosted_effort_rank(efforts: route.supported_efforts, effort: effort)
+  }
+}
+
+fn hosted_level_admitted(route: HarnessHostedRoute, level: HarnessReasoningLevel, max_tokens: TokenCount) -> Bool {
+  token_count_value(t: max_tokens) <= token_count_value(t: route.max_completion)
+    && (match harness_reasoning_kwargs_for(unit: route.unit, level: level) {
+      ReasoningKwargsAdmitted { kwargs: _ } => true
+      ReasoningLevelUnsupported { unit: _, level: _, cause: _ } => false
+    })
+}
+
+fn hosted_level_entry(route: HarnessHostedRoute, level: HarnessReasoningLevel, max_tokens: TokenCount) -> ParetoEntry {
+  let no_gaps: List<AxisGap> = []
+  ParetoEntry {
+    identity: hosted_level_identity(level: level),
+    display_label: harness_reasoning_level_wire(level: level),
+    readings: [
+      AxisReading { axis: ax_hosted_reasoning_depth, interval_micro: degenerate_interval(point: hosted_level_depth_rank(route: route, level: level) * 1000000) },
+      AxisReading { axis: ax_hosted_money_per_request, interval_micro: degenerate_interval(point: (money_amount_micro_count(m: route.price_per_token) as Int) * token_count_value(t: max_tokens)) },
+      AxisReading { axis: ax_hosted_quota_per_request, interval_micro: degenerate_interval(point: 1000000) },
+      AxisReading { axis: ax_hosted_level_admitted, interval_micro: degenerate_interval(point: if hosted_level_admitted(route: route, level: level, max_tokens: max_tokens) { 1000000 } else { 0 }) },
+    ],
+    missing_inputs: no_gaps,
+  }
+}
+
+data harness_hosted_levels: List<HarnessReasoningLevel> = [ReasoningOff, ReasoningStandard, ReasoningMaximum]
+
+fn harness_hosted_level_field(route: HarnessHostedRoute, max_tokens: TokenCount) -> List<ParetoEntry> {
+  map(harness_hosted_levels, l => hosted_level_entry(route: route, level: l, max_tokens: max_tokens))
+}
+
+fn harness_hosted_level_assessment() -> DecisionAssessment {
+  let subject_id = hosted_ref(name: "harness_hosted_level_subject")
+  let var_id = hosted_ref(name: "harness_hosted_level_variable")
+  let term_id = hosted_ref(name: "harness_hosted_reasoning_depth_term")
+  let param_id = hosted_ref(name: "harness_hosted_route_parameter")
+  DecisionAssessment {
+    subject: DecisionSubject {
+      identity: subject_id,
+      question: "which reasoning level a harness turn on a hosted free listing runs at" as NonEmptyStr,
+      parameters: [ContextParameter { identity: param_id }],
+      constraints: [DecisionConstraint { identity: hosted_level_admitted_constraint }],
+      objective: ObjectiveMeasure {
+        identity: hosted_ref(name: "harness_hosted_level_objective"),
+        goal: HigherIsBetter,
+        terms: [ObjectiveTerm { identity: term_id, ground: CitedToAuthority { authority: openrouter_reasoning_authority } }],
+      },
+      choice_domain: ChoiceDomain {
+        identity: hosted_ref(name: "harness_hosted_level_choice_domain"),
+        variables: [DecisionVariable { identity: var_id }],
+      },
+    },
+    sensitivities: [
+      VariesAlong {
+        term: term_id,
+        variable: var_id,
+        region: DecisionRegion { identity: hosted_ref(name: "harness_hosted_level_region") },
+        relation: MonotoneIncreasing,
+        coupling: CitedToAuthority { authority: openrouter_reasoning_authority },
+      },
+    ],
+    constraints: [
+      ConstraintSatisfied { constraint: hosted_level_admitted_constraint, evidence: "admissibility applied to the field as the hard constraint: the unit's reasoning seam and the listing's completion ceiling" as NonEmptyStr },
+    ],
+    parameters: [
+      ParameterBound { parameter: param_id, evidence: "the hosted route joined from its listing" as NonEmptyStr },
+    ],
+    selected_candidate: Absent,
+    term_drops: [],
+    physical_model: PhysicalModelEstablished { terms: [term_id] },
+    causal_model: CausalModelEstablished {
+      couplings: [
+        VendorDocumentedCoupling { authority: openrouter_reasoning_authority, term: term_id, variable: var_id, subject: subject_id },
+      ],
+    },
+  }
+}
+
+fn harness_hosted_level_selection(route: HarnessHostedRoute, max_tokens: TokenCount) -> RealizationSelectionResult<ParetoEntry> {
+  select_realization(
+    assessment: harness_hosted_level_assessment(),
+    candidate_field_identity: hosted_ref(name: "harness_hosted_level_field"),
+    field: harness_hosted_level_field(route: route, max_tokens: max_tokens),
+    axes: harness_hosted_level_axes,
+    constraints: harness_hosted_level_constraints,
+    constraint_authority: hosted_ref(name: "harness_hosted_level_constraints"),
+    policy: UniqueSurvivorRequired { identity: hosted_ref(name: "harness_hosted_level_policy") },
+    evidence_snapshot: hosted_ref(name: "harness_hosted_route_for"),
+  )
+}
+
+type HostedLevelChoice
+  = HostedLevelSelected { level: HarnessReasoningLevel }
+  | HostedLevelUnselected { cause: String }
+
+fn hosted_level_of_identity(identity: DeclarationRef) -> HarnessReasoningLevel? {
+  match filter(harness_hosted_levels, l => declaration_ref_eq(a: hosted_level_identity(level: l), b: identity)).first() {
+    Absent => none
+    Present { value: l } => Present { value: l }
+  }
+}
+
+// ANY ARM BUT A SELECTION IS A REFUSAL, carried with the arm's name. A turn does not run at a level the
+// selection did not choose: there is no fallback level, because a fallback is exactly the literal this
+// selection replaced.
+fn harness_hosted_level_choice(route: HarnessHostedRoute, max_tokens: TokenCount) -> HostedLevelChoice {
+  match harness_hosted_level_selection(route: route, max_tokens: max_tokens) {
+    SelectedWithin { candidate: c, receipt: _ } =>
+      match hosted_level_of_identity(identity: c.identity) {
+        Present { value: l } => HostedLevelSelected { level: l }
+        Absent => HostedLevelUnselected { cause: "the selection returned a candidate that is not one of the harness's levels" }
+      }
+    CandidateFieldUnestablished { causes: cs } => HostedLevelUnselected { cause: join(["the level field is unestablished: ", join(map(cs, c => c as String), "; ")], "") }
+    NoFeasibleRealization { causes: cs, scope: _ } => HostedLevelUnselected { cause: join(["no level is admissible on this route: ", join(map(cs, c => c as String), "; ")], "") }
+    SelectionNeedsEvidence { needs: _ } => HostedLevelUnselected { cause: "the level selection needs evidence it does not have" }
+    SelectionNeedsPolicy { survivors: _ } => HostedLevelUnselected { cause: "more than one level survives and no policy chooses between them" }
+    RealizationSelectionRefused { defects: ds } => HostedLevelUnselected { cause: join(["the level selection refused: ", join(map(ds, d => d as String), "; ")], "") }
+  }
+}
+
+// ── THE CREDENTIAL: MATERIALIZED, LIVENESS-READ, AND SCOPED TO THE BINDING ──────────────────────
+//
+// The key is fetched from Secret Manager, written as one header line into a 0600 file in a fresh
+// directory, and handed to curl by path (-H @file), so it is never an argv word. Liveness is read by the
+// key endpoint itself: GET /api/v1/key with the same header file asks OpenRouter whether this key is
+// accepted and cannot make a rejected key accepted, so the probe is inert (gunbc.readback_independence)
+// and gunbc.auth.materialized_secret with_materialized_secret is the gate that refuses a key the upstream
+// does not accept. The directory lives as long as the binding and is removed by its release.
+data openrouter_key_read_probe: ReadBackProbe = ReadBackProbe {
+  label: "GET https://openrouter.ai/api/v1/key with the materialized bearer header file",
+  subject: "the key this SecretRef holds is one OpenRouter currently accepts",
+  effect_on_subject: ProbeInert,
+}
+
+data hosted_key_read_deadline: Second = second(count: 20)
+
+type HarnessHostedQuota {
+  short_hostname: String
+  actor: NonEmptyStr
+  per_minute: UpstreamRateLimit
+  per_day: UpstreamRateLimit
+}
+
+// WHAT A HOSTED BINDING HOLDS IN PLACE OF A SEAT: the header file and the directory it lives in, the two
+// quota rows each request leases, the selected level, what the key read reported, and the terms that
+// govern the route. The terms ride the binding so every turn placed on it renders the standing it ran
+// under; they are not a gate this code can evaluate, because what the operator sends is not visible to it.
+type HarnessHostedAccess {
+  header_dir: NonEmptyStr
+  header_file: NonEmptyStr
+  quota: HarnessHostedQuota
+  key: OpenRouterKeyRead
+  terms: NvidiaApiTrialTerms
+}
+
+type HostedBindOutcome
+  = HostedBound { url: NonEmptyStr, model: NonEmptyStr, unit: HarnessServingUnit, level: HarnessReasoningLevel, access: HarnessHostedAccess }
+  | HostedBindRefused { detail: String }
+
+// EACH WAY THE KEY CAN FAIL TO ARRIVE IS ITS OWN CAUSE, because they have different remedies: no Secret
+// Manager access token to fetch with (a federation or upsert problem, nothing to do with the secret), a
+// refused read (the secret or its accessor cell), a response that did not decode, and a response that
+// answered about another version. Collapsing them to "could not be read" would send the operator to the
+// secret when the fault is the token.
+type HostedKeyFetch
+  = HostedKeyFetched { text: String }
+  | HostedKeyFetchRefused { cause: String }
+
+fn hosted_secret_text(route: HarnessHostedRoute) -> HostedKeyFetch {
+  match resolve_access_token() {
+    AccessTokenReady { token: t } =>
+      match fetch_secret_ref_credential_with_token(secret_ref: route.secret, access_token: t) {
+        SecretCredentialReady { credential: c, resolved_version: _ } => HostedKeyFetched { text: trim(s: c as String) }
+        SecretCredentialAccessUpsertRequired { plan: p } =>
+          HostedKeyFetchRefused { cause: join(["the secret read needs a Secret Manager access upsert first: ", access_token_upsert_required_reason(plan: p)], "") }
+        SecretCredentialWireDecodeRefused { identity_cause: i, payload_cause: pc } =>
+          HostedKeyFetchRefused { cause: join([
+            "the Secret Manager access response did not decode (version identity ", match i { Present { value: _ } => "refused" Absent => "decoded" },
+            ", payload ", match pc { Present { value: _ } => "refused" Absent => "decoded" }, ")",
+          ], "") }
+        SecretCredentialFetchRefused { reason: r } => HostedKeyFetchRefused { cause: join(["the Secret Manager read was refused: ", r as String], "") }
+        SecretCredentialResolvedVersionMismatch { requested: q, resolved: r } =>
+          HostedKeyFetchRefused { cause: join(["the Secret Manager read asked for version ", q, " and was answered about ", r], "") }
+      }
+    AccessTokenUpsertRequired { plan: p } =>
+      HostedKeyFetchRefused { cause: join(["no Secret Manager access token is available and an access upsert is required: ", access_token_upsert_required_reason(plan: p)], "") }
+    AccessTokenEnsureRefused { reason: r } =>
+      HostedKeyFetchRefused { cause: join(["no Secret Manager access token could be ensured: ", r as String], "") }
+  }
+}
+
+// THE KEY READ, AS AN OBSERVATION VERDICT FOR THE MATERIALIZATION GATE, plus the decoded body for the
+// binding. A transport failure is Inaccessible, never Converged: an unread key is not a live one.
+type HostedKeyObservation
+  = HostedKeyObserved { key: OpenRouterKeyRead }
+  | HostedKeyUnobserved { cause: String }
+
+fn hosted_read_key(route: HarnessHostedRoute, header_file: NonEmptyStr) -> HostedKeyObservation {
+  let read = http.Client.GetFollowRedirectsBoundedWithHeaderFile(
+    url: route.key_url,
+    max_seconds: to_string(second_count(s: hosted_key_read_deadline)) as NonEmptyStr,
+    accept: "Accept: application/json" as NonEmptyStr,
+    header_file: header_file,
+  )
+  if !read.success {
+    HostedKeyUnobserved { cause: join(["the key read failed: ", read.body], "") }
+  } else {
+    match openrouter_decode_key_read(body: read.body) {
+      OpenRouterKeyUndecodable { cause: c } => HostedKeyUnobserved { cause: c }
+      OpenRouterKeyDecoded { key: k } => HostedKeyObserved { key: k }
+    }
+  }
+}
+
+fn hosted_key_liveness(observation: HostedKeyObservation) -> ObservationVerdict? {
+  match observation {
+    HostedKeyObserved { key: _ } => Present { value: Converged }
+    HostedKeyUnobserved { cause: _ } => Present { value: Inaccessible }
+  }
+}
+
+// THE KEY MUST BE ONE THAT CANNOT SPEND MONEY, and the binding refuses one that can. The operator capped
+// this key at zero credits so a request that strays onto a priced model answers 402 instead of charging;
+// a key read showing no cap, or a positive one, means that guard is gone, and a free-only route that ran
+// anyway would be the externalized degradation DESIGN section 5 names -- the same name, a different
+// burden. The daily tier is read from the same response: it is per ACCOUNT and the key cap does not
+// change it.
+fn hosted_access_from_key(route: HarnessHostedRoute, key: OpenRouterKeyRead, level: HarnessReasoningLevel, header_dir: NonEmptyStr, header_file: NonEmptyStr, short_hostname: String, actor: NonEmptyStr) -> HostedBindOutcome? {
+  match key.spend_limit {
+    KeySpendUncapped => none
+    KeySpendCappedAbove { lexeme: _ } => none
+    KeySpendCappedAtZero =>
+      match openrouter_credits_from_daily_limit(daily_limit: key.free_daily_limit) {
+        CreditsTierUnrecognized { daily_limit: _ } => none
+        CreditsTierObserved { credits: credits } => Present { value: HostedBound {
+          url: route.url,
+          model: harness_unit_model_id(unit: route.unit),
+          unit: route.unit,
+          level: level,
+          access: HarnessHostedAccess {
+            header_dir: header_dir,
+            header_file: header_file,
+            quota: HarnessHostedQuota { short_hostname: short_hostname, actor: actor, per_minute: route.per_minute, per_day: openrouter_free_models_per_day(credits: credits) },
+            key: key,
+            terms: route.terms,
+          },
+        } }
+      }
+  }
+}
+
+// THE DAY POOL STARTS FROM WHAT THE UPSTREAM SAYS REMAINS, NOT FROM ITS CEILING. The tier sets the
+// ceiling; free_model_daily_requests.remaining says how much of it is left today, including requests
+// another client of this key spent and requests made before this ledger existed. The reading is
+// recorded on the day partition (gunbc.fabric_quota fabric_quota_observe_upstream) before the binding is
+// handed out, so the first lease already sees it. A reading that cannot be recorded refuses the bind:
+// leasing against the bare ceiling would admit requests the upstream has already refused.
+fn hosted_day_remaining(key: OpenRouterKeyRead) -> Nat? {
+  checked_int_to_nat(n: key.free_daily_remaining)
+}
+
+fn hosted_record_day_remaining(bound: HostedBindOutcome, key: OpenRouterKeyRead) -> HostedBindOutcome {
+  match bound {
+    HostedBindRefused { detail: d } => HostedBindRefused { detail: d }
+    HostedBound { url: u, model: m, unit: un, level: l, access: a } =>
+      match hosted_day_remaining(key: key) {
+        Absent => HostedBindRefused { detail: join(["the key read reports a negative free-model remaining count (", to_string(key.free_daily_remaining), ")"], "") }
+        Present { value: remaining } =>
+          match fabric_quota_observe_upstream(short_hostname: a.quota.short_hostname, limit: a.quota.per_day, remaining: remaining, actor: a.quota.actor) {
+            QuotaObservationRefused { detail: d } => HostedBindRefused { detail: join(["the upstream's remaining free-model requests could not be recorded on the day pool: ", d], "") }
+            QuotaUpstreamRecorded { partition: _, remaining: _ } => HostedBound { url: u, model: m, unit: un, level: l, access: a }
+          }
+      }
+  }
+}
+
+fn hosted_key_refusal(key: OpenRouterKeyRead) -> String {
+  match key.spend_limit {
+    KeySpendCappedAtZero =>
+      join(["the key reports a free-model daily limit of ", to_string(key.free_daily_limit), ", which is neither published tier (50 or 1000); refusing to lease against an unpublished ceiling"], "")
+    KeySpendUncapped => "the key reports no credit limit: it can spend money on a priced model, and this route admits only a key capped at zero credits"
+    KeySpendCappedAbove { lexeme: lx } => join(["the key reports a credit limit of ", lx, ": it can spend money on a priced model, and this route admits only a key capped at zero credits"], "")
+  }
+}
+
+fn hosted_bind_with_header(route: HarnessHostedRoute, header_dir: NonEmptyStr, header_file: NonEmptyStr, short_hostname: String, actor: NonEmptyStr, max_tokens: TokenCount) -> HostedBindOutcome {
+  let observation = hosted_read_key(route: route, header_file: header_file)
+  match with_materialized_secret(
+    ref: route.secret,
+    binding: BearerHeaderFile,
+    existence: SmEnabled,
+    probe: openrouter_key_read_probe,
+    liveness_observation: hosted_key_liveness(observation: observation),
+    use: m => observation,
+  ) {
+    MaterializationRefused { cause: SecretNotLive { verdict: _ } } =>
+      HostedBindRefused { detail: match observation { HostedKeyUnobserved { cause: c } => join(["the OpenRouter key is not live: ", c], "") HostedKeyObserved { key: _ } => "the OpenRouter key is not live" } }
+    MaterializationRefused { cause: SecretVersionUnusable { state: _ } } => HostedBindRefused { detail: "the OpenRouter key's secret version is not usable" }
+    MaterializationRefused { cause: LivenessProbeNotIndependent { probe_label: p } } => HostedBindRefused { detail: join(["the key liveness probe is not independent: ", p as String], "") }
+    MaterializationCompleted { value: HostedKeyUnobserved { cause: c } } => HostedBindRefused { detail: c }
+    MaterializationCompleted { value: HostedKeyObserved { key: key } } =>
+      match harness_hosted_level_choice(route: route, max_tokens: max_tokens) {
+        HostedLevelUnselected { cause: c } => HostedBindRefused { detail: c }
+        HostedLevelSelected { level: l } =>
+          match hosted_access_from_key(route: route, key: key, level: l, header_dir: header_dir, header_file: header_file, short_hostname: short_hostname, actor: actor) {
+            Absent => HostedBindRefused { detail: hosted_key_refusal(key: key) }
+            Present { value: bound } => hosted_record_day_remaining(bound: bound, key: key)
+          }
+      }
+  }
+}
+
+// THE BIND. A fetched secret that could not be written leaves nothing behind; any refusal after the
+// header file exists removes its directory before answering, so a refused bind holds no credential on
+// disk.
+fn harness_hosted_bind(unit: HarnessServingUnit, short_hostname: String, actor: NonEmptyStr, max_tokens: TokenCount) -> HostedBindOutcome {
+  match harness_hosted_route_for(unit: unit) {
+    Absent => HostedBindRefused { detail: join(["the unit ", harness_serving_unit_wire(unit: unit) as String, " is served on a fleet seat and has no hosted route"], "") }
+    Present { value: route } =>
+      match hosted_secret_text(route: route) {
+        HostedKeyFetchRefused { cause: c } => HostedBindRefused { detail: join(["the OpenRouter key (", route.secret.secret as String, ") could not be fetched: ", c], "") }
+        HostedKeyFetched { text: key_text } =>
+          if key_text == "" {
+            HostedBindRefused { detail: "the OpenRouter key secret is empty" }
+          } else {
+            let dir = shell.Mktemp.Dir()
+            if !dir.success {
+              HostedBindRefused { detail: "mktemp -d failed for the bearer header file" }
+            } else {
+              let header_file = join([dir.path as String, "/authorization"], "") as NonEmptyStr
+              let wrote = Filesystem.WriteOwnerOnly(path: header_file as String, content: openrouter_authorization_header_line(key: key_text as NonEmptyStr))
+              if !wrote.success {
+                let cleaned = shell.Remove.RecursiveForce(path: dir.path)
+                HostedBindRefused { detail: "could not write the bearer header file" }
+              } else {
+                match hosted_bind_with_header(route: route, header_dir: dir.path as String as NonEmptyStr, header_file: header_file, short_hostname: short_hostname, actor: actor, max_tokens: max_tokens) {
+                  HostedBindRefused { detail: d } => {
+                    let cleaned = shell.Remove.RecursiveForce(path: dir.path)
+                    HostedBindRefused { detail: d }
+                  }
+                  HostedBound { url: u, model: m, unit: un, level: l, access: a } => HostedBound { url: u, model: m, unit: un, level: l, access: a }
+                }
+              }
+            }
+          }
+      }
+  }
+}
+
+type HostedRelease
+  = HostedReleased
+  | HostedReleaseRefused { detail: String }
+
+fn harness_hosted_release(access: HarnessHostedAccess) -> HostedRelease {
+  let removed = shell.Remove.RecursiveForce(path: access.header_dir as String as FilePath)
+  if removed.success { HostedReleased } else { HostedReleaseRefused { detail: join(["the bearer header directory ", access.header_dir as String, " could not be removed"], "") } }
+}
+
+fn harness_hosted_access_wire(access: HarnessHostedAccess) -> String {
+  join([
+    "hosted quota ", to_string(access.quota.per_minute.requests), "/minute and ", to_string(access.quota.per_day.requests), "/day; ",
+    openrouter_key_spend_limit_wire(l: access.key.spend_limit), "; free-model requests today ", to_string(access.key.free_daily_used), "/", to_string(access.key.free_daily_limit),
+    "; governed by ", nvidia_api_trial_terms_wire(t: access.terms) as String,
+  ], "")
+}
+
+// ── EACH REQUEST IS CHARGED TO BOTH POOLS BEFORE IT IS SENT ───────────────────────────────────
+//
+// THE LOCAL QUOTA IS A CLOSE, CONSERVATIVE PRE-CHECK, NOT AN EXACT GATE, AND THE UPSTREAM'S 429 IS THE
+// BACKSTOP. This route deliberately revises the 2026-09-06 ruling that a caller refuses before the upstream
+// would have answered 429 (gunbc.fabric_quota): the pools below make an over-spend rare and keep the
+// ledger honest, but nothing here can make the local count equal the upstream's at a window boundary --
+// the upstream counts a request when it RECEIVES it, and nothing on this side bounds when a process's first
+// request byte leaves. A 429 that gets through is a typed refusal carrying the upstream's own retry hints
+// (extdeps.openrouter.openrouter OpenRouterRateLimitRefusal), reported in the turn outcome and never
+// retried (operator decision, escalation msg_46a417a3). Machinery whose only job was to make the count
+// exact -- an admission lock, charging every window a request might span -- is deliberately absent.
+//
+// THE CHARGE AND THE RESPONSE ARE TWO LIFETIMES. The upstream counts a request in the window it ARRIVES
+// in, whatever happens to its answer afterwards; the answer may take minutes. An earlier revision held
+// the lease across the response and settled it afterwards, with the response deadline as the term --
+// and a 2,348-second term can never fit a 60-second lapsing window, so the minute pool refused
+// LeaseCrossesLapse on every request and nothing was ever sent. Shortening the term would not have
+// fixed it: a lease held until the answer arrives still outlives a window the request was counted in.
+//
+// SO A REQUEST IS CHARGED, NOT HELD. Each pool is leased for the remainder of its current window
+// (gunbc.fabric_quota QuotaTermToWindowEnd, read off the same clock reading the lease is stamped with),
+// and both leases are settled at one BEFORE the request goes out. The charge then stands for the rest of
+// the window whatever the response does, which is also the conservative accounting for a request whose
+// fate is unknown: a crash after the send, or a transport that failed mid-flight, still counted upstream
+// as far as anyone here can tell, so it is never refunded.
+//
+// BOTH POOLS OR NEITHER. The minute pool is leased first because it refills soonest; if the day pool then
+// refuses, the minute lease is settled at zero so its slot returns at once.
+type HostedRoundLease
+  = HostedRoundCharged
+  | HostedRoundQuotaFull { wire: String }
+  | HostedRoundUnleasable { detail: String }
+
+// THE DECISION IS PURE AND THE LEASING IS NOT. What a pair of lease answers MEANS is decided from
+// supplied answers; the day pool is asked only when the minute pool leased, so its answer is absent
+// otherwise, and a refusal after the minute pool leased names that lease as owed back.
+type HostedRoundDecision
+  = RoundBothLeased { minute: QuotaLease, day: QuotaLease }
+  | RoundRefusedFull { wire: String, minute_to_return: QuotaLease? }
+  | RoundRefusedUnleasable { detail: String, minute_to_return: QuotaLease? }
+
+fn hosted_round_decision(minute: QuotaLease, day: QuotaLease?) -> HostedRoundDecision {
+  match minute {
+    QuotaFull { wire: w } => RoundRefusedFull { wire: w, minute_to_return: none }
+    QuotaLeaseRefused { detail: d } => RoundRefusedUnleasable { detail: d, minute_to_return: none }
+    QuotaLeased { grant: _, partition: _, store: _, limit: _ } =>
+      match day {
+        Absent => RoundRefusedUnleasable { detail: "the minute pool leased but the day pool was never asked", minute_to_return: Present { value: minute } }
+        Present { value: QuotaLeased { grant: g, partition: p, store: st, limit: l } } => RoundBothLeased { minute: minute, day: QuotaLeased { grant: g, partition: p, store: st, limit: l } }
+        Present { value: QuotaFull { wire: w } } => RoundRefusedFull { wire: w, minute_to_return: Present { value: minute } }
+        Present { value: QuotaLeaseRefused { detail: d } } => RoundRefusedUnleasable { detail: d, minute_to_return: Present { value: minute } }
+      }
+  }
+}
+
+fn hosted_return_minute(minute: QuotaLease?) -> String {
+  match minute {
+    Absent => ""
+    Present { value: m } => join(["; minute lease returned: ", quota_settle_wire(s: fabric_quota_settle(lease: m, actual: 0))], "")
+  }
+}
+
+fn hosted_settle_refusal(s: QuotaSettle, pool: String) -> List<String> {
+  match s {
+    QuotaSettled { partition: _, actual: _ } => []
+    QuotaSettleRefused { detail: d } => [join([pool, ": ", d], "")]
+  }
+}
+
+// A CHARGE THAT DID NOT RECORD IS NOT SENT. The request has not gone out yet, so refusing costs nothing
+// upstream; sending it would spend quota the ledger does not show, which is the over-admission the
+// lease exists to prevent. A lease left unsettled by the refusal still charges until its window ends,
+// so the refusal errs on the side of spending less.
+fn hosted_round_charge_both(minute: QuotaLease, day: QuotaLease, minute_amount: Nat, day_amount: Nat) -> HostedRoundLease {
+  let refused = concat(
+    hosted_settle_refusal(s: fabric_quota_settle(lease: minute, actual: minute_amount), pool: "minute"),
+    hosted_settle_refusal(s: fabric_quota_settle(lease: day, actual: day_amount), pool: "day"),
+  )
+  if count(refused) == 0 {
+    HostedRoundCharged
+  } else {
+    HostedRoundUnleasable { detail: join(["the request's charge did not record, so it was not sent: ", join(refused, "; ")], "") }
+  }
+}
+
+// THE CHARGE COVERS THIS SEND AND EVERY SEND STILL IN FLIGHT FROM AN EARLIER WINDOW
+// (gunbc.harness.harness_seat hosted_inflight_carried): each may arrive in this window, and none was
+// charged to it. A refusal carries the held seats' release hint, so a pool starved by seats whose holders
+// died says which seats and how to release them.
+fn harness_hosted_round_charge(quota: HarnessHostedQuota, carried_minute: Nat, carried_day: Nat, release_hint: String) -> HostedRoundLease {
+  let minute_amount = carried_minute + 1
+  let day_amount = carried_day + 1
+  let minute = fabric_quota_lease_for(short_hostname: quota.short_hostname, limit: quota.per_minute, amount: minute_amount, actor: quota.actor, term: QuotaTermToWindowEnd)
+  let day = match minute {
+    QuotaLeased { grant: _, partition: _, store: _, limit: _ } =>
+      Present { value: fabric_quota_lease_for(short_hostname: quota.short_hostname, limit: quota.per_day, amount: day_amount, actor: quota.actor, term: QuotaTermToWindowEnd) }
+    QuotaFull { wire: _ } => none
+    QuotaLeaseRefused { detail: _ } => none
+  }
+  match hosted_round_decision(minute: minute, day: day) {
+    RoundBothLeased { minute: m, day: d } => hosted_round_charge_both(minute: m, day: d, minute_amount: minute_amount, day_amount: day_amount)
+    RoundRefusedFull { wire: w, minute_to_return: r } => HostedRoundQuotaFull { wire: join([w, hosted_return_minute(minute: r), release_hint], "") }
+    RoundRefusedUnleasable { detail: d, minute_to_return: r } => HostedRoundUnleasable { detail: join([d, hosted_return_minute(minute: r)], "") }
+  }
+}
+
+// THE UPSTREAM'S REFUSAL, DECODED. An error body is OpenRouter's typed error when it decodes; a body that
+// does not decode is reported as itself, because a transport failure has no error object to read.
+fn harness_hosted_refusal_cause(body: String) -> String {
+  match openrouter_decode_error_body(body: body) {
+    OpenRouterErrorDecoded { error: e } => openrouter_error_wire(e: e)
+    OpenRouterErrorUndecodable { cause: _ } => body
+  }
+}
+
+// ── WHAT A TURN CARRIES ABOUT HOW ITS REQUESTS ARE ADMITTED ───────────────────────────────────
+//
+// A fleet turn's requests are admitted by the seat it already holds, unauthenticated over the fleet's
+// network. A hosted turn's requests each lease quota and carry the bearer header file. The turn config
+// carries which, so the POST is chosen by the binding the turn was placed on, never re-derived from the
+// unit inside the loop.
+type HarnessBackendAccess
+  = BackendAdmittedBySeat
+  | BackendAdmittedByHostedQuota { header_file: NonEmptyStr, quota: HarnessHostedQuota }
+
+fn harness_hosted_backend_access(access: HarnessHostedAccess) -> HarnessBackendAccess {
+  BackendAdmittedByHostedQuota { header_file: access.header_file, quota: access.quota }
+}
diff --git a/dag/gunbc/harness/harness_reasoning_wire.dag b/dag/gunbc/harness/harness_reasoning_wire.dag
index f414986029a..d033b0b52dc 100644
--- a/dag/gunbc/harness/harness_reasoning_wire.dag
+++ b/dag/gunbc/harness/harness_reasoning_wire.dag
@@ -3,6 +3,15 @@ module gunbc.harness.harness_reasoning_wire
 import std.types { String, Bool, List, NonEmptyStr }
 import std.measure { TokenCount }
 import extdeps.languages.json.emit { JsonKeyValue, JsonBool, json_kv, json_string, json_object }
+import extdeps.openrouter.openrouter {
+  OpenRouterReasoningEffort, EffortHigh, EffortMedium, OpenRouterEffortAdmission, EffortAdmitted, EffortNotSupported,
+  openrouter_effort_admitted, openrouter_reasoning_effort_wire, openrouter_message_reasoning_field,
+}
+import extdeps.openrouter.nvidia_nemotron_3_ultra_free {
+  nemotron_ultra_free_model_id, nemotron_ultra_free_context_length, nemotron_ultra_free_supported_efforts,
+  nemotron_ultra_free_reasoning_mandatory,
+}
+import extdeps.nvidia.nemotron_3_ultra { nemotron_ultra_thinking_end_token }
 import gunbc.spark.serving_arm {
   ReasoningResponseProjection, ParsedReasoningField, InlineReasoning,
   gitcommit90_sm121_exl3_row, gunbc_sparkrun_ds4_row,
@@ -38,14 +47,38 @@ import extdeps.zhipu.glm_5_3_flash {
 // for that family -- vLLM ships glm45 for GLM and, on this fleet's build, nothing for DeepSeek V4.
 // Attributing that to the model would be authority substitution; attributing it to the unit is
 // exactly right.
+//
+// A HOSTED UNIT IS A MODEL PLUS THE ROUTER IT IS REACHED THROUGH, by the same reasoning: whether reasoning
+// comes back split, under which member, and which efforts are accepted are the router's facts about its
+// listing (extdeps.openrouter.nvidia_nemotron_3_ultra_free), not the model's. How the harness PLACES a turn
+// on each unit -- a fleet seat or a hosted quota lease -- is asked of harness_unit_placement below.
 type HarnessServingUnit
   = DeepseekV4FlashOnVllm
   | Glm53FlashOnVllm
+  | NemotronUltraFreeOnOpenRouter
 
 fn harness_serving_unit_wire(unit: HarnessServingUnit) -> NonEmptyStr {
   match unit {
     DeepseekV4FlashOnVllm => "deepseek-v4-flash on vllm" as NonEmptyStr
     Glm53FlashOnVllm => "glm-5.3-flash on vllm" as NonEmptyStr
+    NemotronUltraFreeOnOpenRouter => "nemotron-3-ultra:free on openrouter" as NonEmptyStr
+  }
+}
+
+// HOW A TURN ON THIS UNIT IS ADMITTED. A fleet unit is served by an engine this repository launches, so a
+// turn takes a seat on a serving group (gunbc.harness.harness_seat harness_bind_seat). A hosted unit has no
+// group, no replica and no loaded state to share: what bounds it is the upstream's per-request quota, so a
+// turn leases that quota (gunbc.fabric_quota) before each request instead. The two are different capacity
+// facts, which is why this is a closed choice and not a flag.
+type HarnessUnitPlacement
+  = PlacedOnFleetSeat
+  | LeasedFromHostedQuota
+
+fn harness_unit_placement(unit: HarnessServingUnit) -> HarnessUnitPlacement {
+  match unit {
+    DeepseekV4FlashOnVllm => PlacedOnFleetSeat
+    Glm53FlashOnVllm => PlacedOnFleetSeat
+    NemotronUltraFreeOnOpenRouter => LeasedFromHostedQuota
   }
 }
 
@@ -133,10 +166,62 @@ fn harness_glm_reasoning_kwargs(level: HarnessReasoningLevel) -> HarnessReasonin
   }
 }
 
+// THE OPENROUTER ARM, AND ITS WIRE IS THE ROUTER'S, NOT THE MODEL'S. The request carries OpenRouter's
+// top-level `reasoning` object, never Nemotron's chat_template_kwargs: the router owns the translation to
+// the provider, and a client spelling the model's template keys past it would be addressing a template
+// it cannot see.
+//
+// EACH LEVEL IS MAPPED TO AN EFFORT AND THE EFFORT IS ADMITTED AGAINST THE LISTING'S PUBLISHED SET, so
+// what this arm may send is decided by the listing's row and never by this function. Standard is medium
+// and maximum is high, because those are the two efforts the listing accepts and that is their order;
+// off is `enabled: false`, which the listing admits because its reasoning is not mandatory. A listing
+// whose set lacks the mapped effort, or whose reasoning is mandatory, refuses the level with both names.
+fn harness_openrouter_level_effort(level: HarnessReasoningLevel) -> OpenRouterReasoningEffort? {
+  match level {
+    ReasoningOff => none
+    ReasoningStandard => Present { value: EffortMedium }
+    ReasoningMaximum => Present { value: EffortHigh }
+  }
+}
+
+fn harness_openrouter_reasoning_kwargs(unit: HarnessServingUnit, level: HarnessReasoningLevel, supported: List<OpenRouterReasoningEffort>, mandatory: Bool) -> HarnessReasoningKwargs {
+  match harness_openrouter_level_effort(level: level) {
+    Absent =>
+      if mandatory {
+        ReasoningLevelUnsupported {
+          unit: harness_serving_unit_wire(unit: unit),
+          level: harness_reasoning_level_wire(level: level),
+          cause: "the listing marks reasoning mandatory, so a request with reasoning disabled is not one it admits" as NonEmptyStr,
+        }
+      } else {
+        ReasoningKwargsAdmitted { kwargs: [json_kv(key: "reasoning", value: json_object([
+          json_kv(key: "enabled", value: JsonBool { value: false }),
+        ]))] }
+      }
+    Present { value: effort } =>
+      match openrouter_effort_admitted(effort: effort, supported: supported) {
+        EffortNotSupported { effort: e, supported: _ } => ReasoningLevelUnsupported {
+          unit: harness_serving_unit_wire(unit: unit),
+          level: harness_reasoning_level_wire(level: level),
+          cause: join([
+            "the level maps to reasoning effort ", openrouter_reasoning_effort_wire(e: e) as String,
+            ", which the listing's supported_efforts do not include; an unsupported effort is translated by the router to a setting the caller never sees, so it is refused rather than sent",
+          ], "") as NonEmptyStr,
+        }
+        EffortAdmitted { effort: e } =>
+          ReasoningKwargsAdmitted { kwargs: [json_kv(key: "reasoning", value: json_object([
+            json_kv(key: "effort", value: json_string(s: openrouter_reasoning_effort_wire(e: e) as String)),
+          ]))] }
+      }
+  }
+}
+
 fn harness_reasoning_kwargs_for(unit: HarnessServingUnit, level: HarnessReasoningLevel) -> HarnessReasoningKwargs {
   match unit {
     DeepseekV4FlashOnVllm => harness_deepseek_reasoning_kwargs(level: level)
     Glm53FlashOnVllm => harness_glm_reasoning_kwargs(level: level)
+    NemotronUltraFreeOnOpenRouter =>
+      harness_openrouter_reasoning_kwargs(unit: unit, level: level, supported: nemotron_ultra_free_supported_efforts, mandatory: nemotron_ultra_free_reasoning_mandatory)
   }
 }
 
@@ -154,6 +239,12 @@ fn harness_unit_thinking_requested(unit: HarnessServingUnit, level: HarnessReaso
         ReasoningStandard => true
         ReasoningMaximum => true
       }
+    NemotronUltraFreeOnOpenRouter =>
+      match level {
+        ReasoningOff => false
+        ReasoningStandard => true
+        ReasoningMaximum => true
+      }
   }
 }
 
@@ -163,16 +254,21 @@ fn harness_unit_model_id(unit: HarnessServingUnit) -> NonEmptyStr {
   match unit {
     DeepseekV4FlashOnVllm => "deepseek-v4-flash:iq3s-split" as NonEmptyStr
     Glm53FlashOnVllm => glm_5_3_flash_model_id
+    NemotronUltraFreeOnOpenRouter => nemotron_ultra_free_model_id
   }
 }
 
 // THE ENGINE'S TOOL-CALL PARSER FOR THIS UNIT, delegated for the same reason. The DeepSeek arm keeps
 // the string because extdeps.deepseek.deepseek_v4 carries no parser row; that asymmetry is the
 // DeepSeek module's gap, named here rather than papered over with a second GLM-shaped row.
-fn harness_unit_tool_call_parser(unit: HarnessServingUnit) -> NonEmptyStr {
+// A HOSTED UNIT HAS NO ENGINE THIS REPOSITORY LAUNCHES, so there is no parser for it to name: the
+// router's provider parses tool calls and returns them already structured. The answer is absent rather
+// than a borrowed name, because a launch reading a name here would launch a parser nobody chose.
+fn harness_unit_tool_call_parser(unit: HarnessServingUnit) -> NonEmptyStr? {
   match unit {
-    DeepseekV4FlashOnVllm => "deepseek_v4" as NonEmptyStr
-    Glm53FlashOnVllm => glm_5_3_flash_vllm_tool_call_parser
+    DeepseekV4FlashOnVllm => Present { value: "deepseek_v4" as NonEmptyStr }
+    Glm53FlashOnVllm => Present { value: glm_5_3_flash_vllm_tool_call_parser }
+    NemotronUltraFreeOnOpenRouter => none
   }
 }
 
@@ -206,6 +302,7 @@ fn harness_unit_reasoning_projection(unit: HarnessServingUnit) -> ReasoningRespo
   match unit {
     DeepseekV4FlashOnVllm => gunbc_sparkrun_ds4_row.reasoning_projection
     Glm53FlashOnVllm => gitcommit90_sm121_exl3_row.reasoning_projection
+    NemotronUltraFreeOnOpenRouter => Present { value: ParsedReasoningField { field: openrouter_message_reasoning_field } }
   }
 }
 
@@ -234,6 +331,7 @@ fn harness_unit_model_reasoning_field(unit: HarnessServingUnit) -> NonEmptyStr {
   match unit {
     DeepseekV4FlashOnVllm => deepseek_v4_chat_reasoning_field
     Glm53FlashOnVllm => glm_5_3_flash_chat_reasoning_field
+    NemotronUltraFreeOnOpenRouter => openrouter_message_reasoning_field
   }
 }
 
@@ -308,6 +406,7 @@ fn harness_unit_server_parses_reasoning(unit: HarnessServingUnit) -> Bool {
   match unit {
     DeepseekV4FlashOnVllm => false
     Glm53FlashOnVllm => true
+    NemotronUltraFreeOnOpenRouter => true
   }
 }
 
@@ -318,6 +417,7 @@ fn harness_unit_thinking_end_token(unit: HarnessServingUnit) -> NonEmptyStr {
   match unit {
     DeepseekV4FlashOnVllm => deepseek_v4_thinking_end_token
     Glm53FlashOnVllm => glm_5_3_flash_thinking_end_token
+    NemotronUltraFreeOnOpenRouter => nemotron_ultra_thinking_end_token
   }
 }
 
@@ -327,5 +427,6 @@ fn harness_unit_declared_context_ceiling(unit: HarnessServingUnit) -> TokenCount
   match unit {
     DeepseekV4FlashOnVllm => deepseek_v4_context_length
     Glm53FlashOnVllm => glm_5_3_flash_context_length
+    NemotronUltraFreeOnOpenRouter => nemotron_ultra_free_context_length
   }
 }
diff --git a/dag/gunbc/harness/harness_seat.dag b/dag/gunbc/harness/harness_seat.dag
index 19d77dcfa3a..cd24347806f 100644
--- a/dag/gunbc/harness/harness_seat.dag
+++ b/dag/gunbc/harness/harness_seat.dag
@@ -3,8 +3,10 @@ module gunbc.harness.harness_seat
 import product.host_identity { HostIdentity }
 import std.types { String, Bool, Int, NonEmptyStr, List, EpochSecs }
 import std.nat { Nat, nat_range_inclusive, nat_min }
-import std.measure { Measure, Count, One, money_amount_micro, second, measure_count }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB, fabric_group_wire, fabric_group_hosts }
+import std.measure { Measure, Count, One, money_amount_micro, second, measure_count, TokenCount, Second, second_count }
+import extdeps.accounting.encumbrance { Held, Expended, Released }
+import extdeps.api_rate_limit { upstream_rate_limit_key }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire, fabric_group_hosts }
 import gunbc.serving.serving_enrollment {
   ServingRoute, ServingRouteResolved, ServingRouteUnresolved, ServingRouteEndpoint,
   ServingRouteTurnCeiling, serving_enrolled_routes, serving_route_turn_ceiling_count,
@@ -27,7 +29,7 @@ import gunbc.fabric_storage_client { FabricStorageBinding }
 import gunbc.fabric_event_log {
   HeadExpectation, event_log_refusal_wire, SeatStoreRefused, SeatStandingStoreRefused, HeadObserved, HeadObservationRefused, event_log_observe_head, EventAppended,
   EventAppendStale, EventAppendRefused, event_log_append, SeatGranted, SeatFull, SeatContended,
-  SeatAcquireRefused, fabric_seat_acquire, SeatRoomObserved, SeatFullObserved, SeatStandingUnobserved,
+  SeatAcquireRefused, fabric_seat_acquire, seat_acquisition_wire, SeatRoomObserved, SeatFullObserved, SeatStandingUnobserved,
   fabric_seat_observe, PartitionRead, PartitionReadOk, PartitionReadRefused, event_log_read_partition,
   RedemptionReading, RedemptionReadAt, RedemptionReadRefused, fabric_redemption_read,
 }
@@ -38,7 +40,14 @@ import gunbc.harness.harness_backend {
   harness_route_availability, HarnessEngineReading, harness_observe_engine_at,
 }
 import gunbc.harness.harness_wire { HarnessWireShape, AnthropicMessagesShape, OpenAiChatCompletionsShape, harness_backend_url_for_endpoint }
-import gunbc.harness.harness_reasoning_wire { HarnessServingUnit, harness_unit_model_id }
+import gunbc.harness.harness_reasoning_wire {
+  HarnessServingUnit, harness_unit_model_id, HarnessReasoningLevel, harness_unit_placement, HarnessUnitPlacement, PlacedOnFleetSeat,
+  LeasedFromHostedQuota, harness_serving_unit_wire,
+}
+import gunbc.harness.harness_hosted_route {
+  HarnessHostedAccess, HarnessHostedQuota, HostedBound, HostedBindRefused, harness_hosted_bind, HostedReleased, HostedReleaseRefused,
+  harness_hosted_release,
+}
 import product.fabric.work { ExecutionRequirements, ControlPlaneCapacity, Work, ServiceInterfaceRef, ArtifactManifestRef, EffectContractRef, OutputContractRef, identity_frame }
 import product.fabric.supply { EstimatedGrantDuration, GrantDuration, AffinityKeyedRendezvous, PlacementAffinityKey }
 import product.fabric.selection {
@@ -291,6 +300,7 @@ type HarnessSeatBinding
   = HarnessSeatBound { url: String, grant: LeaseGrant, partition: PartitionId, ceiling: Nat, group_wire: String, launch: VllmEndpointProcessLaunch, store: FabricStorageBinding, model: NonEmptyStr, unit: HarnessServingUnit, class: ServingCoTenancyClass, seat: HarnessSeatReference }
   | HarnessSeatPending { detail: String }
   | HarnessSeatRefused { detail: String }
+  | HarnessHostedBound { url: String, model: NonEmptyStr, unit: HarnessServingUnit, level: HarnessReasoningLevel, access: HarnessHostedAccess }
 
 fn seat_bind_detail(group: FabricGroup, text: String) -> String {
   join([fabric_group_wire(g: group) as String, ": ", text], "")
@@ -669,7 +679,6 @@ fn harness_declared_unit_digest(group: FabricGroup) -> DeclaredUnitDigestStandin
 }
 
 type HarnessDeclaredUnitRoster {
-  group_a: DeclaredUnitDigestStanding
   group_b: DeclaredUnitDigestStanding
 }
 
@@ -680,15 +689,13 @@ type HarnessDeclaredUnitRoster {
 // repair is to carry the first value from the least common ancestor rather than to cache it.
 fn harness_declared_unit_roster() -> HarnessDeclaredUnitRoster {
   HarnessDeclaredUnitRoster {
-    group_a: harness_declared_unit_digest(group: FabricGroupA),
-    group_b: harness_declared_unit_digest(group: FabricGroupB),
+    group_b: harness_declared_unit_digest(group: FabricGroupB {}),
   }
 }
 
 fn harness_declared_unit_from_roster(roster: HarnessDeclaredUnitRoster, group: FabricGroup) -> DeclaredUnitDigestStanding {
   match group {
-    FabricGroupA => roster.group_a
-    FabricGroupB => roster.group_b
+    FabricGroupB {} => roster.group_b
   }
 }
 
@@ -724,21 +731,18 @@ fn harness_group_participation(access: FleetSshContextPreparation, group: Fabric
 }
 
 type HarnessGroupParticipationRoster {
-  group_a: ServingGroupRendezvousReach?
   group_b: ServingGroupRendezvousReach?
 }
 
 fn harness_group_participation_roster(access: FleetSshContextPreparation) -> HarnessGroupParticipationRoster {
   HarnessGroupParticipationRoster {
-    group_a: harness_group_participation(access: access, group: FabricGroupA),
-    group_b: harness_group_participation(access: access, group: FabricGroupB),
+    group_b: harness_group_participation(access: access, group: FabricGroupB {}),
   }
 }
 
 fn harness_participation_from_roster(roster: HarnessGroupParticipationRoster, group: FabricGroup) -> ServingGroupRendezvousReach? {
   match group {
-    FabricGroupA => roster.group_a
-    FabricGroupB => roster.group_b
+    FabricGroupB {} => roster.group_b
   }
 }
 
@@ -1204,6 +1208,7 @@ fn harness_seat_after_grant_authority(store: FabricStorageBinding, group: Fabric
     SeatAuthorityRefuses { cause: why } =>
       match release_retry(store: store, partition: partition, ceiling: ceiling, reference: grant.reference, reason: "the pair-serving authority moved between admission and the seat's acquisition" as NonEmptyStr, now: now) {
         HarnessSeatReleased { partition: _ } => SeatReleasedAuthorityMoved { cause: why }
+        HarnessHostedCredentialRemoved => SeatUnreleasedAuthorityMoved { cause: why, release_detail: "a fleet seat release answered as a hosted credential removal" }
         HarnessSeatReleaseRefused { detail: d } => SeatUnreleasedAuthorityMoved { cause: why, release_detail: d }
       }
   }
@@ -1223,6 +1228,8 @@ fn harness_fence_grant(candidate: HarnessCandidate, class: ServingCoTenancyClass
     }
     EndpointProcessWasReplaced { endpoint: _, expected: _, observed: _, observed_at: _, receipt: _ } =>
         match release_retry(store: store, partition: partition, ceiling: candidate.ceiling, reference: grant.reference, reason: "the engine was replaced between selection and acquisition" as NonEmptyStr, now: now) {
+          HarnessHostedCredentialRemoved =>
+            AcquisitionRefused { detail: seat_bind_detail(group: candidate.group, text: "a fleet seat release answered as a hosted credential removal; the seat may still be held") }
           HarnessSeatReleased { partition: _ } =>
             AcquisitionLost {
               key: candidate.key,
@@ -1421,6 +1428,37 @@ data harness_placement_rounds: Nat = 3
 // that constructed the request itself could hand in a request naming one requirement beside a
 // screen argument naming another.
 fn harness_bind_seat(short_hostname: String, class: ServingCoTenancyClass, requirement: ServingModelRequirement, shape: HarnessWireShape, inputs: List<String>, actor: NonEmptyStr, attempt: NonEmptyStr, policy: LeasePolicy) -> HarnessSeatBinding {
+  match harness_requirement_placement(requirement: requirement) {
+    LeasedFromHostedQuota => HarnessSeatRefused { detail: "the required unit is reached through a hosted quota lease, not a fleet seat; bind it with harness_bind_hosted" }
+    PlacedOnFleetSeat => harness_bind_fleet_seat(short_hostname: short_hostname, class: class, requirement: requirement, shape: shape, inputs: inputs, actor: actor, attempt: attempt, policy: policy)
+  }
+}
+
+// WHERE A REQUIREMENT IS PLACED. Any admitted model is a fleet seat: the hosted listing is governed by
+// trial terms (extdeps.nvidia.api_trial_terms), and an unnamed requirement must not quietly route a turn
+// to an upstream whose terms the caller never chose. Only a caller naming the hosted unit reaches it.
+fn harness_requirement_placement(requirement: ServingModelRequirement) -> HarnessUnitPlacement {
+  match requirement {
+    AnyAdmittedModel => PlacedOnFleetSeat
+    ExactServingUnit { unit: u } => harness_unit_placement(unit: u)
+  }
+}
+
+// THE HOSTED BIND. A hosted unit takes no seat: the credential is materialized and its liveness read, the
+// level is selected, and the binding carries the two quota rows each request will lease. A fleet unit
+// handed here refuses by name rather than being placed on a seat behind the caller's back.
+fn harness_bind_hosted(short_hostname: String, unit: HarnessServingUnit, actor: NonEmptyStr, max_tokens: TokenCount) -> HarnessSeatBinding {
+  match harness_unit_placement(unit: unit) {
+    PlacedOnFleetSeat => HarnessSeatRefused { detail: join(["the unit ", harness_serving_unit_wire(unit: unit) as String, " is served on a fleet seat; bind it with harness_bind_seat"], "") }
+    LeasedFromHostedQuota =>
+      match harness_hosted_bind(unit: unit, short_hostname: short_hostname, actor: actor, max_tokens: max_tokens) {
+        HostedBindRefused { detail: d } => HarnessSeatRefused { detail: d }
+        HostedBound { url: u, model: m, unit: un, level: l, access: a } => HarnessHostedBound { url: u as String, model: m, unit: un, level: l, access: a }
+      }
+  }
+}
+
+fn harness_bind_fleet_seat(short_hostname: String, class: ServingCoTenancyClass, requirement: ServingModelRequirement, shape: HarnessWireShape, inputs: List<String>, actor: NonEmptyStr, attempt: NonEmptyStr, policy: LeasePolicy) -> HarnessSeatBinding {
   let subject = harness_turn_subject(request: harness_turn_request(shape: shape, requirement: requirement, inputs: inputs), attempt: attempt)
   match event_log_store_for_host(short_hostname: short_hostname) {
     HostStoreRefused { detail: d } => HarnessSeatRefused { detail: d }
@@ -1445,8 +1483,12 @@ fn harness_bind_seat(short_hostname: String, class: ServingCoTenancyClass, requi
 
 // RELEASE IS AN EVENT ON THE SAME PARTITION, appended against the head observed at release time
 // and retried on stale, because the seat's neighbours keep moving the head while this turn ran.
+// A HOSTED BINDING HOLDS NO SEAT, so its release is its own arm: each request already settled its quota
+// leases, and what remains to give back is the credential's header file. Reporting it as a released
+// partition would name a pool the binding never held.
 type HarnessSeatRelease
   = HarnessSeatReleased { partition: PartitionId }
+  | HarnessHostedCredentialRemoved
   | HarnessSeatReleaseRefused { detail: String }
 
 type ReleaseFold {
@@ -1543,6 +1585,7 @@ fn harness_seat_pointer_of(binding: HarnessSeatBinding) -> HarnessSeatPointer? {
       Present { value: HarnessSeatPointer { partition: p, reference: g.reference, owner: r.attempt } }
     HarnessSeatRefused { detail: _ } => none
     HarnessSeatPending { detail: _ } => none
+    HarnessHostedBound { url: _, model: _, unit: _, level: _, access: _ } => none
   }
 }
 
@@ -1563,6 +1606,11 @@ fn harness_release_seat(binding: HarnessSeatBinding, reason: NonEmptyStr) -> Har
   match binding {
     HarnessSeatRefused { detail: d } => HarnessSeatReleaseRefused { detail: join(["nothing to release: ", d], "") }
     HarnessSeatPending { detail: d } => HarnessSeatReleaseRefused { detail: join(["nothing to release, the placement is pending: ", d], "") }
+    HarnessHostedBound { url: _, model: _, unit: _, level: _, access: a } =>
+      match harness_hosted_release(access: a) {
+        HostedReleased => HarnessHostedCredentialRemoved
+        HostedReleaseRefused { detail: d } => HarnessSeatReleaseRefused { detail: d }
+      }
     HarnessSeatBound { url: _, grant: g, partition: p, ceiling: ceiling, group_wire: _, launch: _, store: store, model: _, unit: _, class: _, seat: _ } =>
       match now_epoch_seconds() {
         Absent => HarnessSeatReleaseRefused { detail: "the clock could not be read as epoch seconds" }
@@ -1719,6 +1767,7 @@ fn harness_release_fenced(store: FabricStorageBinding, capability: HarnessReleas
 fn harness_seat_release_wire(r: HarnessSeatRelease) -> String {
   match r {
     HarnessSeatReleased { partition: p } => join(["released on ", p as String], "")
+    HarnessHostedCredentialRemoved => "hosted credential removed"
     HarnessSeatReleaseRefused { detail: d } => join(["release refused: ", d], "")
   }
 }
@@ -1726,3 +1775,141 @@ fn harness_seat_release_wire(r: HarnessSeatRelease) -> String {
 fn harness_now_epoch() -> EpochSecs? {
   now_epoch_seconds()
 }
+
+data hosted_inflight_none: Nat = 0
+
+// ── IN-FLIGHT HOSTED SENDS: A CHARGE THAT SURVIVES THE ROLLOVER ─────────────────────────────────
+//
+// A hosted request is charged to the window it is admitted in (gunbc.harness.harness_hosted_route
+// harness_hosted_round_charge), but nothing on this side can bound WHEN its first byte leaves: curl's
+// connect deadline stops applying once the connection is open, and a process can pause between the
+// admission and the write for as long as it likes. Measured: a pause before the first header write put the
+// request's first byte 8.0 s after admission, past a 5.98 s deadline, with curl exiting 0. So a send that
+// has been admitted and whose transport has not returned may arrive in ANY later window, and it must be
+// counted there too.
+//
+// THE QUOTA POOLS CANNOT CARRY THAT, because every charge in a lapsing pool belongs to one window. So an
+// admitted send also holds a SEAT in a per-credential in-flight partition, under the same pool shape every
+// harness seat uses (harness_seat_pool_root: no replenishment, quiescence required -- a held seat charges
+// until evidence releases it, never by expiry). Each later admission counts the in-flight seats acquired
+// BEFORE its window began and charges its quota pools for them as well as for itself; the seat is released
+// when the transport returns, whatever it returned.
+//
+// TWO CONSEQUENCES, BOTH CONSERVATIVE AND STATED RATHER THAN ENGINEERED AWAY. Two admissions in one window
+// each count the same carried seats, so a carried send can be charged more than once in a window. And a
+// seat held by a process that crashed charges every later window until it is released; the refusal that
+// starvation produces names each held seat, its holder, and the release that frees it -- the same
+// harness_release_cli route a stuck serving seat takes.
+fn hosted_inflight_partition(quota: HarnessHostedQuota) -> PartitionId {
+  join(["inflight-", upstream_rate_limit_key(l: quota.per_minute) as String], "") as PartitionId
+}
+
+fn hosted_inflight_ceiling(quota: HarnessHostedQuota) -> Nat {
+  quota.per_minute.requests
+}
+
+type HostedInflightSeat {
+  reference: NonEmptyStr
+  acquired_at: EpochSecs
+}
+
+fn hosted_inflight_held(pool: Pool<Count, One>) -> List<HostedInflightSeat> {
+  let held = filter(pool.ledger.entries, e => match e.state {
+    Held { maximum_liability: _ } => true
+    Expended { actual: _, settled_at: _ } => false
+    Released { reason: _, released_at: _ } => false
+  })
+  fold(held, init: [] as List<HostedInflightSeat>, f: (acc, e) =>
+    match filter(pool.terms, t => (t.reference as String) == (e.reference as String)).first() {
+      Absent => acc
+      Present { value: t } => concat(acc, [HostedInflightSeat { reference: e.reference, acquired_at: t.acquired_at }])
+    })
+}
+
+// THE SENDS A WINDOW MUST COVER BESIDES ITS OWN: those admitted before it began and not yet returned.
+fn hosted_inflight_carried(pool: Pool<Count, One>, window_start: EpochSecs) -> Nat {
+  fold(filter(hosted_inflight_held(pool: pool), s => s.acquired_at < window_start), init: hosted_inflight_none, f: (n, _s) => n + 1)
+}
+
+type HostedInflightReading
+  = HostedInflightRead { pool: Pool<Count, One>, generation: Nat, store: FabricStorageBinding, release_hint: String }
+  | HostedInflightUnread { detail: String }
+
+fn hosted_inflight_release_hint(quota: HarnessHostedQuota, pool: Pool<Count, One>, generation: Nat, walk: ChainWalk<PoolEvent>) -> String {
+  let seats = hosted_inflight_held(pool: pool)
+  if count(seats) == 0 { "" } else {
+    join([
+      "; in-flight seats held on ", hosted_inflight_partition(quota: quota) as String, " (release each once its holder is known to be gone: gunbc run --entry dag/gunbc/harness/harness_cli.dag --function harness_release_cli --arg partition=", hosted_inflight_partition(quota: quota) as String,
+      " --arg ceiling=", to_string(hosted_inflight_ceiling(quota: quota)), " --arg generation=", to_string(generation), " --arg reason=<why> --arg reference=<seat> --arg grant=<grant>): ",
+      join(map(seats, s => join([
+        s.reference as String, " acquired_at=", to_string(s.acquired_at),
+        " grant=", match admitting_event_for(walk: walk, reference: s.reference) { Present { value: g } => g as String  Absent => "unknown" },
+      ], "")), "; "),
+    ], "")
+  }
+}
+
+fn harness_hosted_inflight_read(quota: HarnessHostedQuota) -> HostedInflightReading {
+  match event_log_store_for_host(short_hostname: quota.short_hostname) {
+    HostStoreRefused { detail: d } => HostedInflightUnread { detail: d }
+    HostStoreResolved { store: store, executor: _ } => {
+      let partition = hosted_inflight_partition(quota: quota)
+      match event_log_read_partition(store: store, partition: partition, budget: 4096) {
+        PartitionReadRefused { cause: c } => HostedInflightUnread { detail: join(["the in-flight partition could not be read: ", event_log_refusal_wire(cause: c)], "") }
+        PartitionReadOk { head: _, walk: walk } =>
+          match walk {
+            ChainIncomplete { missing: m, newest_first_so_far: _ } => HostedInflightUnread { detail: join(["the in-flight partition chain is missing event ", m as String], "") }
+            ChainBudgetExhausted { at: a } => HostedInflightUnread { detail: join(["the in-flight partition exceeded the read budget at ", a as String], "") }
+            ChainWalked { oldest_first: xs } =>
+              match pool_fold(root: harness_seat_pool_root(partition: partition, ceiling: hosted_inflight_ceiling(quota: quota)), oldest_first: xs) {
+                PoolFoldRefused { at_event: e, wire: w } => HostedInflightUnread { detail: join(["the in-flight partition does not fold at ", e as String, ": ", w], "") }
+                PoolFolded { pool: p, generation: g } =>
+                  HostedInflightRead { pool: p, generation: g, store: store, release_hint: hosted_inflight_release_hint(quota: quota, pool: p, generation: g, walk: walk) }
+              }
+          }
+      }
+    }
+  }
+}
+
+type HostedInflightHold
+  = HostedInflightHeld { reference: NonEmptyStr, store: FabricStorageBinding }
+  | HostedInflightRefused { detail: String }
+
+fn harness_hosted_inflight_acquire(quota: HarnessHostedQuota, store: FabricStorageBinding, reference: NonEmptyStr, term: Second) -> HostedInflightHold {
+  match now_epoch_seconds() {
+    Absent => HostedInflightRefused { detail: "the clock could not be read as epoch seconds" }
+    Present { value: now } => {
+      let partition = hosted_inflight_partition(quota: quota)
+      let term_seconds = second_count(s: term)
+      match fabric_seat_acquire(
+        store: store, partition: partition,
+        root: harness_seat_pool_root(partition: partition, ceiling: hosted_inflight_ceiling(quota: quota)),
+        actor: quota.actor,
+        request: SeatRequest { reference: reference, amount: Measure { count: 1 }, at: now, term_seconds: term_seconds },
+        policy: LeasePolicy { maximum_duration_seconds: term_seconds, release_law: QuiescenceRequired },
+        attempts: 3, budget: 4096,
+      ) {
+        SeatGranted { grant: _, generation: _, attempts_used: _ } => HostedInflightHeld { reference: reference, store: store }
+        SeatFull { wire: w, attempts_used: _ } => HostedInflightRefused { detail: join(["every in-flight seat is held (", w, "), so another send cannot be accounted for"], "") }
+        other => HostedInflightRefused { detail: seat_acquisition_wire(a: other) }
+      }
+    }
+  }
+}
+
+fn harness_hosted_inflight_release(quota: HarnessHostedQuota, hold: HostedInflightHold, reason: NonEmptyStr) -> String? {
+  match hold {
+    HostedInflightRefused { detail: _ } => none
+    HostedInflightHeld { reference: r, store: store } =>
+      match now_epoch_seconds() {
+        Absent => Present { value: join(["the in-flight seat ", r as String, " could not be released: the clock could not be read"], "") }
+        Present { value: now } =>
+          match release_retry(store: store, partition: hosted_inflight_partition(quota: quota), ceiling: hosted_inflight_ceiling(quota: quota), reference: r, reason: reason, now: now) {
+            HarnessSeatReleased { partition: _ } => none
+            HarnessHostedCredentialRemoved => Present { value: join(["the in-flight seat ", r as String, " release answered as a credential removal"], "") }
+            HarnessSeatReleaseRefused { detail: d } => Present { value: join(["the in-flight seat ", r as String, " could not be released: ", d], "") }
+          }
+      }
+  }
+}
diff --git a/dag/gunbc/harness/harness_turn.dag b/dag/gunbc/harness/harness_turn.dag
index b96b65119c4..3c56aefa019 100644
--- a/dag/gunbc/harness/harness_turn.dag
+++ b/dag/gunbc/harness/harness_turn.dag
@@ -13,6 +13,22 @@ import gunbc.harness.harness_reasoning_wire {
   harness_unit_thinking_end_token, harness_unit_reasoning_field,
   harness_serving_unit_wire, harness_reasoning_level_wire,
 }
+import gunbc.harness.harness_hosted_route {
+  HarnessBackendAccess, BackendAdmittedBySeat, BackendAdmittedByHostedQuota, HarnessHostedQuota, HostedRoundCharged,
+  HostedRoundQuotaFull, HostedRoundUnleasable, harness_hosted_round_charge, harness_hosted_refusal_cause,
+  HostedRoundLease,
+}
+import extdeps.openrouter.openrouter {
+  OpenRouterRateLimitRefusal, OpenRouterHeaderDump, HeaderDumpRead, HeaderDumpUnread, openrouter_decode_rate_limited, openrouter_rate_limit_wire,
+}
+import gunbc.harness.harness_seat {
+  HostedInflightRead, HostedInflightUnread, HostedInflightHeld, HostedInflightRefused, harness_hosted_inflight_read,
+  harness_hosted_inflight_acquire, harness_hosted_inflight_release, hosted_inflight_carried,
+}
+import gunbc.fabric_quota { quota_window_start }
+import gunbc.fabric_event_log_host { now_epoch_seconds }
+import gunbc.fabric_storage_client { FabricStorageBinding
+}
 import extdeps.clock { ClockUnixMillisRead, ClockUnixMillisObserved, ClockUnixMillisRefused, clock_unix_millis_read }
 import extdeps.http.client
 import extdeps.git.inspect
@@ -244,6 +260,7 @@ type HarnessTurnConfig {
   request_deadline: Second
   environment: HarnessToolEnvironment
   completion: HarnessTurnCompletion
+  backend_access: HarnessBackendAccess
 }
 
 // THE WINDOW THE HARNESS WORKS IN AND THE WINDOW THE ENGINE ADMITS ARE ONE NUMBER, and this field
@@ -539,6 +556,9 @@ type HarnessTurnOutcome
   | TurnUsageUnavailable { cause: String, steps_taken: Int }
   | TurnSubmissionUndecodable { reason: String, steps_taken: Int }
   | TurnAlignmentCheckpointDue { steps_taken: Int }
+  | TurnHostedQuotaFull { wire: String, steps_taken: Int }
+  | TurnHostedQuotaUnleasable { detail: String, steps_taken: Int }
+  | TurnHostedRateLimited { refusal: OpenRouterRateLimitRefusal, steps_taken: Int }
 
 fn harness_outcome_label(outcome: HarnessTurnOutcome) -> String {
   match outcome {
@@ -557,6 +577,9 @@ fn harness_outcome_label(outcome: HarnessTurnOutcome) -> String {
     TurnUsageUnavailable { cause: _, steps_taken: _ } => "usage-unavailable"
     TurnSubmissionUndecodable { reason: _, steps_taken: _ } => "submission-undecodable"
     TurnAlignmentCheckpointDue { steps_taken: _ } => "alignment-checkpoint-due"
+    TurnHostedQuotaFull { wire: _, steps_taken: _ } => "hosted-quota-full"
+    TurnHostedQuotaUnleasable { detail: _, steps_taken: _ } => "hosted-quota-unleasable"
+    TurnHostedRateLimited { refusal: _, steps_taken: _ } => "hosted-rate-limited"
   }
 }
 
@@ -613,6 +636,21 @@ fn harness_outcome_detail(outcome: HarnessTurnOutcome) -> String {
         " control to the workflow, whose adjudication lane decides whether the same lineage",
         " resumes, steers, re-plans, routes or stops. This is not a failure and not a completion.",
       ], "")
+    TurnHostedQuotaFull { wire: w, steps_taken: n } =>
+      join([
+        "after ", to_string(value: n), " tool rounds the local quota ledger refused the request (", w,
+        "); it was not sent. The ledger is this fleet's own pre-check, not an answer from the upstream, whose count it can differ from at a window boundary",
+      ], "")
+    TurnHostedQuotaUnleasable { detail: d, steps_taken: n } =>
+      join([
+        "after ", to_string(value: n), " tool rounds the hosted upstream's quota could not be leased (", d,
+        "); the request was not sent, because an unleased request is one the fleet cannot account for",
+      ], "")
+    TurnHostedRateLimited { refusal: r, steps_taken: k } =>
+      join([
+        "after ", to_string(value: k), " tool rounds ", openrouter_rate_limit_wire(r: r),
+        "; the turn stopped rather than retrying, and a caller that waits owns when it asks again",
+      ], "")
     TurnTransportRefused { detail: d } => d
     TurnResponseUnreadable { cause: c } => c
     TurnRequestUnwritable { path: p, detail: d } =>
@@ -1042,8 +1080,29 @@ fn harness_thinking_format_cause(unit: HarnessServingUnit, blocks: List<HarnessW
 type HarnessPostedRound {
   read: HarnessResponseRead
   wire_log_detail: String?
+  inflight_release_detail: String?
+  rate_limited: OpenRouterRateLimitRefusal?
+}
+
+// AN IN-FLIGHT SEAT THAT DID NOT RELEASE IS NOT A REFUSAL OF THE ROUND -- the request went out and its
+// answer is real -- but it keeps charging every later window until someone releases it, so it is an event
+// with the seat's name, the same standing the wire log has.
+fn harness_event_inflight_release_unrecorded(detail: String) -> String {
+  serialize_json(v: json_object([
+    json_kv(key: "type", value: json_string(s: "turn.inflight_release_unrecorded")),
+    json_kv(key: "detail", value: json_string(s: detail)),
+  ]))
 }
 
+// A HOSTED ROUND THAT COULD NOT BE CHARGED IS NOT POSTED, and the loop is told which way it was refused.
+// The charge is recorded before the request goes out (gunbc.harness.harness_hosted_route
+// harness_hosted_round_charge), so nothing about the round's quota is left to do after the answer.
+type HarnessRoundPost
+  = RoundPosted { posted: HarnessPostedRound }
+  | RoundQuotaFull { wire: String }
+  | RoundQuotaUnleasable { detail: String }
+
+
 fn harness_wire_log_path(config: HarnessTurnConfig, round: Int, kind: String) -> String {
   join([config.events_path as String, ".wire/", to_string(value: round), kind], "")
 }
@@ -1056,10 +1115,10 @@ fn harness_post_round(
   config: HarnessTurnConfig,
   messages: List<JsonValue>,
   round: Int,
-) -> HarnessPostedRound {
+) -> HarnessRoundPost {
   match harness_reasoning_kwargs_for(unit: config.serving_unit, level: config.reasoning_mode) {
     ReasoningLevelUnsupported { unit, level, cause } =>
-      HarnessPostedRound {
+      RoundPosted { posted: HarnessPostedRound {
         read: HarnessResponseUnreadable {
           cause: join([
             "the serving unit ", unit as String, " cannot express reasoning level ", level as String,
@@ -1067,21 +1126,93 @@ fn harness_post_round(
           ], ""),
         },
         wire_log_detail: none,
+        inflight_release_detail: none,
+        rate_limited: none,
+      } }
+    ReasoningKwargsAdmitted { kwargs } =>
+      match harness_prepare_round(config: config, messages: messages, reasoning_kwargs: kwargs, round: round) {
+        RoundUnprepared { posted: p } => RoundPosted { posted: p }
+        RoundPrepared { wire_request_detail: wd } =>
+          match config.backend_access {
+            BackendAdmittedBySeat => RoundPosted { posted: harness_send_round(config: config, round: round, header_file: none, wire_request_detail: wd) }
+            BackendAdmittedByHostedQuota { header_file: hf, quota: q } => harness_hosted_round_post(config: config, round: round, header_file: hf, quota: q, wire_request_detail: wd)
+          }
       }
-    ReasoningKwargsAdmitted { kwargs } => harness_post_round_admitted(config: config, messages: messages, reasoning_kwargs: kwargs, round: round)
   }
 }
 
-fn harness_post_round_admitted(
+// A HOSTED ROUND IS PREPARED, THEN CHARGED, THEN SENT -- in that order, because the charge is counted in
+// the window the request ARRIVES in. Everything that can take time on this side (serializing the body,
+// writing the scratch and the wire log) is done before the charge, so the charge is as close to the send
+// as this process can put it. Nothing here bounds when the first byte actually leaves, so the send also
+// holds an in-flight seat from before it until the transport returns (gunbc.harness.harness_seat, in-flight
+// hosted sends): every later window counts the seats still held from earlier ones and charges for them as
+// well as for its own send.
+//
+// THE CHARGE IS A CLOSE PRE-CHECK AND THE UPSTREAM'S 429 IS THE BACKSTOP (operator decision, escalation
+// msg_46a417a3; gunbc.harness.harness_hosted_route): a request the pre-check admitted that OpenRouter
+// still refuses with 429 ends the turn as TurnHostedRateLimited, carrying the upstream's own retry hints,
+// and is never retried here.
+fn harness_hosted_round_post(config: HarnessTurnConfig, round: Int, header_file: NonEmptyStr, quota: HarnessHostedQuota, wire_request_detail: String?) -> HarnessRoundPost {
+  match harness_hosted_inflight_read(quota: quota) {
+    HostedInflightUnread { detail: d } => RoundQuotaUnleasable { detail: join(["the in-flight sends could not be counted, so the charge cannot cover them: ", d], "") }
+    HostedInflightRead { pool: p, generation: _, store: store, release_hint: hint } =>
+      match now_epoch_seconds() {
+        Absent => RoundQuotaUnleasable { detail: "the clock could not be read as epoch seconds" }
+        Present { value: now } =>
+          match quota_window_start(limit: quota.per_minute, at: now) {
+            Absent => RoundQuotaUnleasable { detail: "the minute window has no start at this instant" }
+            Present { value: minute_start } =>
+              match quota_window_start(limit: quota.per_day, at: now) {
+                Absent => RoundQuotaUnleasable { detail: "the day window has no start at this instant" }
+                Present { value: day_start } =>
+                  harness_hosted_round_charged_post(
+                    config: config, round: round, header_file: header_file, quota: quota, wire_request_detail: wire_request_detail, store: store,
+                    reference: join([quota.actor as String, "@", to_string(value: now), "#round", to_string(value: round)], "") as NonEmptyStr,
+                    charge: harness_hosted_round_charge(
+                      quota: quota,
+                      carried_minute: hosted_inflight_carried(pool: p, window_start: minute_start),
+                      carried_day: hosted_inflight_carried(pool: p, window_start: day_start),
+                      release_hint: hint,
+                    ),
+                  )
+              }
+          }
+      }
+  }
+}
+
+fn harness_hosted_round_charged_post(config: HarnessTurnConfig, round: Int, header_file: NonEmptyStr, quota: HarnessHostedQuota, wire_request_detail: String?, store: FabricStorageBinding, reference: NonEmptyStr, charge: HostedRoundLease) -> HarnessRoundPost {
+  match charge {
+    HostedRoundQuotaFull { wire: w } => RoundQuotaFull { wire: w }
+    HostedRoundUnleasable { detail: d } => RoundQuotaUnleasable { detail: d }
+    HostedRoundCharged =>
+      match harness_hosted_inflight_acquire(quota: quota, store: store, reference: reference, term: config.request_deadline) {
+        HostedInflightRefused { detail: d } => RoundQuotaUnleasable { detail: d }
+        HostedInflightHeld { reference: r, store: st } => {
+          let hold = HostedInflightHeld { reference: r, store: st }
+          let posted = harness_send_round(config: config, round: round, header_file: Present { value: header_file }, wire_request_detail: wire_request_detail)
+          let released = harness_hosted_inflight_release(quota: quota, hold: hold, reason: "the transport returned" as NonEmptyStr)
+          RoundPosted { posted: HarnessPostedRound { read: posted.read, wire_log_detail: posted.wire_log_detail, inflight_release_detail: released, rate_limited: posted.rate_limited } }
+        }
+      }
+  }
+}
+
+type HarnessRoundPreparation
+  = RoundPrepared { wire_request_detail: String? }
+  | RoundUnprepared { posted: HarnessPostedRound }
+
+fn harness_prepare_round(
   config: HarnessTurnConfig,
   messages: List<JsonValue>,
   reasoning_kwargs: List<JsonKeyValue>,
   round: Int,
-) -> HarnessPostedRound {
+) -> HarnessRoundPreparation {
   let body = serialize_json(v: harness_request_json(config: config, messages: messages, reasoning_kwargs: reasoning_kwargs))
   let written = Filesystem.Write(path: config.request_scratch_path as String, content: body)
   if !written.success {
-    HarnessPostedRound {
+    RoundUnprepared { posted: HarnessPostedRound {
       read: HarnessResponseUnreadable {
         cause: join([
           "request body could not be written to ", config.request_scratch_path as String,
@@ -1089,15 +1220,25 @@ fn harness_post_round_admitted(
         ], ""),
       },
       wire_log_detail: none,
-    }
+      inflight_release_detail: none,
+      rate_limited: none,
+    } }
   } else {
     let wire_request_path = harness_wire_log_path(config: config, round: round, kind: ".request.json")
     let wire_request = Filesystem.Write(path: wire_request_path, content: body)
-    let posted = http.Client.PostJsonFromFile(
-      url: config.backend_url as NonEmptyStr,
-      request_body_file: config.request_scratch_path as String as NonEmptyStr,
-      max_seconds: to_string(value: second_count(s: config.request_deadline)) as NonEmptyStr,
-    )
+    RoundPrepared {
+      wire_request_detail: if wire_request.success { none } else { Present { value: join(["request wire log ", wire_request_path, " could not be written: ", wire_request.error], "") } },
+    }
+  }
+}
+
+fn harness_send_round(
+  config: HarnessTurnConfig,
+  round: Int,
+  header_file: NonEmptyStr?,
+  wire_request_detail: String?,
+) -> HarnessPostedRound {
+    let posted = harness_post_json(config: config, header_file: header_file)
     let wire_response_path = harness_wire_log_path(config: config, round: round, kind: ".response.json")
     let wire_response = Filesystem.Write(path: wire_response_path, content: posted.body)
     let kept = Filesystem.Write(
@@ -1105,7 +1246,7 @@ fn harness_post_round_admitted(
       content: posted.body,
     )
     let wire_details = concat(
-      if wire_request.success { [] } else { [join(["request wire log ", wire_request_path, " could not be written: ", wire_request.error], "")] },
+      match wire_request_detail { Present { value: d } => [d] Absent => [] },
       if wire_response.success { [] } else { [join(["response wire log ", wire_response_path, " could not be written: ", wire_response.error], "")] },
     )
     let wire_log_detail = if count(wire_details) == 0 {
@@ -1117,10 +1258,12 @@ fn harness_post_round_admitted(
       HarnessPostedRound {
         read: HarnessResponseUnreadable {
           cause: join([
-            "the backend refused the request or the transport failed; body was: ", posted.body,
+            "the backend refused the request or the transport failed; ", harness_refusal_body_text(config: config, body: posted.body),
           ], ""),
         },
         wire_log_detail: wire_log_detail,
+        inflight_release_detail: none,
+        rate_limited: harness_hosted_rate_limited(config: config, posted: posted),
       }
     } else if !kept.success {
       HarnessPostedRound {
@@ -1128,16 +1271,84 @@ fn harness_post_round_admitted(
           cause: join(["the response could not be kept beside the request: ", kept.error, "; refusing to decode a body no one can re-read"], ""),
         },
         wire_log_detail: wire_log_detail,
+        inflight_release_detail: none,
+        rate_limited: none,
       }
     } else {
       HarnessPostedRound {
         read: harness_decode_for_shape(unit: config.serving_unit, shape: config.wire_shape, body: posted.body),
         wire_log_detail: wire_log_detail,
+        inflight_release_detail: none,
+        rate_limited: none,
+      }
+    }
+}
+
+// ONE POST, TWO ADMISSIONS. A seat-admitted backend is the fleet's own engine over its network and takes
+// no credential; a quota-admitted one is a hosted upstream and takes the bearer header file by path.
+type HarnessPostOutcome {
+  body: String
+  success: Bool
+  headers: OpenRouterHeaderDump?
+}
+
+// A 429 FROM A HOSTED UPSTREAM IS A TYPED REFUSAL WITH THE UPSTREAM'S OWN RETRY HINTS, decoded from the
+// error body and the response header dump; it is never retried here. A fleet engine has no such refusal.
+fn harness_hosted_rate_limited(config: HarnessTurnConfig, posted: HarnessPostOutcome) -> OpenRouterRateLimitRefusal? {
+  match config.backend_access {
+    BackendAdmittedBySeat => none
+    BackendAdmittedByHostedQuota { header_file: _, quota: _ } =>
+      openrouter_decode_rate_limited(
+        body: posted.body,
+        header_dump: match posted.headers {
+          Present { value: d } => d
+          Absent => HeaderDumpUnread { cause: "no response header dump was taken for this request" }
+        },
+      )
+  }
+}
+
+fn harness_response_headers_path(config: HarnessTurnConfig) -> String {
+  join([config.request_scratch_path as String, ".response.headers"], "")
+}
+
+fn harness_post_json(config: HarnessTurnConfig, header_file: NonEmptyStr?) -> HarnessPostOutcome {
+  match header_file {
+    Absent => {
+      let posted = http.Client.PostJsonFromFile(
+        url: config.backend_url as NonEmptyStr,
+        request_body_file: config.request_scratch_path as String as NonEmptyStr,
+        max_seconds: to_string(value: second_count(s: config.request_deadline)) as NonEmptyStr,
+      )
+      HarnessPostOutcome { body: posted.body, success: posted.success, headers: none }
+    }
+    Present { value: hf } => {
+      let posted = http.Client.PostJsonFromFileWithHeaderFile(
+        url: config.backend_url as NonEmptyStr,
+        request_body_file: config.request_scratch_path as String as NonEmptyStr,
+        header_file: hf,
+        response_headers_file: harness_response_headers_path(config: config) as NonEmptyStr,
+        max_seconds: to_string(value: second_count(s: config.request_deadline)) as NonEmptyStr,
+      )
+      let dump = Filesystem.Read(path: harness_response_headers_path(config: config))
+      HarnessPostOutcome {
+        body: posted.body,
+        success: posted.success,
+        headers: Present { value: if dump.success { HeaderDumpRead { text: dump.content } } else { HeaderDumpUnread { cause: join(["the curl header dump ", harness_response_headers_path(config: config), " could not be read: ", dump.error], "") } } },
       }
     }
   }
 }
 
+// A HOSTED UPSTREAM'S REFUSAL IS DECODED TO ITS TYPED ERROR, so a 402 says which budget refused and a
+// 429 says whose limit it was; a fleet engine's body is reported as it came.
+fn harness_refusal_body_text(config: HarnessTurnConfig, body: String) -> String {
+  match config.backend_access {
+    BackendAdmittedBySeat => join(["body was: ", body], "")
+    BackendAdmittedByHostedQuota { header_file: _, quota: _ } => join(["upstream answered: ", harness_hosted_refusal_cause(body: body)], "")
+  }
+}
+
 // THE LOOP. Each round either reaches a provider terminal, or executes the tool calls and recurses
 // with a strictly smaller budget. There is no arm that continues without either consuming a step or
 // terminating, which is what makes the descent argument readable rather than asserted.
@@ -1276,19 +1487,61 @@ fn harness_turn_loop(
       harness_turn_checkpoint_due(config: config, steps_taken: steps_taken, events: events)
     }
   } else {
-    let posted_round = harness_post_round(config: config, messages: messages, round: steps_taken + 1)
-    let events_after_wire = match posted_round.wire_log_detail {
-      Present { value: detail } => concat(events, [harness_event_wire_log_unwritable(detail: detail)])
-      Absent => events
-    }
-    match posted_round.read {
-      HarnessResponseUnreadable { cause: c } => {
-        let failed = concat(events_after_wire, [harness_event_turn_failed(message: c)])
+    match harness_post_round(config: config, messages: messages, round: steps_taken + 1) {
+      RoundQuotaFull { wire: w } => {
+        let failed = concat(events, [harness_event_turn_failed(message: join(["hosted quota full: ", w], ""))])
+        match harness_write_events(config: config, events: failed) {
+          HarnessEventsUnwritable { detail: d } => harness_event_write_refusal(config: config, detail: d)
+          HarnessEventsWritten => TurnHostedQuotaFull { wire: w, steps_taken: steps_taken }
+        }
+      }
+      RoundQuotaUnleasable { detail: qd } => {
+        let failed = concat(events, [harness_event_turn_failed(message: join(["hosted quota unleasable: ", qd], ""))])
         match harness_write_events(config: config, events: failed) {
           HarnessEventsUnwritable { detail: d } => harness_event_write_refusal(config: config, detail: d)
-          HarnessEventsWritten => TurnResponseUnreadable { cause: c }
+          HarnessEventsWritten => TurnHostedQuotaUnleasable { detail: qd, steps_taken: steps_taken }
         }
       }
+      RoundPosted { posted: posted_round } => harness_turn_after_post(config: config, messages: messages, steps_remaining: steps_remaining, steps_taken: steps_taken, events: events, repairs_used: repairs_used, posted_round: posted_round)
+    }
+  }
+}
+
+fn harness_turn_after_post(
+  config: HarnessTurnConfig,
+  messages: List<JsonValue>,
+  steps_remaining: Int,
+  steps_taken: Int,
+  events: List<String>,
+  repairs_used: Int,
+  posted_round: HarnessPostedRound,
+) -> HarnessTurnOutcome {
+    let events_after_release = match posted_round.inflight_release_detail {
+      Present { value: detail } => concat(events, [harness_event_inflight_release_unrecorded(detail: detail)])
+      Absent => events
+    }
+    let events_after_wire = match posted_round.wire_log_detail {
+      Present { value: detail } => concat(events_after_release, [harness_event_wire_log_unwritable(detail: detail)])
+      Absent => events_after_release
+    }
+    match posted_round.read {
+      HarnessResponseUnreadable { cause: c } =>
+        match posted_round.rate_limited {
+          Present { value: limited } => {
+            let failed = concat(events_after_wire, [harness_event_turn_failed(message: openrouter_rate_limit_wire(r: limited))])
+            match harness_write_events(config: config, events: failed) {
+              HarnessEventsUnwritable { detail: d } => harness_event_write_refusal(config: config, detail: d)
+              HarnessEventsWritten => TurnHostedRateLimited { refusal: limited, steps_taken: steps_taken }
+            }
+          }
+          Absent => {
+            let failed = concat(events_after_wire, [harness_event_turn_failed(message: c)])
+            match harness_write_events(config: config, events: failed) {
+              HarnessEventsUnwritable { detail: d } => harness_event_write_refusal(config: config, detail: d)
+              HarnessEventsWritten => TurnResponseUnreadable { cause: c }
+            }
+          }
+        }
       HarnessResponseParsed { blocks: raw_blocks, stop_reason, usage: usage_read } =>
         match usage_read {
           UsageUnreadable { cause: uc } => {
@@ -1315,7 +1568,6 @@ fn harness_turn_loop(
             )
         }
     }
-  }
 }
 
 // THE ROUND THAT DECODED AND WAS COUNTED. Factored out of the loop when usage became a typed read:
diff --git a/dag/gunbc/harness/harness_wire.dag b/dag/gunbc/harness/harness_wire.dag
index 8b53dc79dd0..3cecea3aa5f 100644
--- a/dag/gunbc/harness/harness_wire.dag
+++ b/dag/gunbc/harness/harness_wire.dag
@@ -23,7 +23,7 @@ import extdeps.llm.anthropic_messages_api {
   ModelContextWindowExceeded,
 }
 import extdeps.ollama.api { ollama_default_port }
-import gunbc.fleet_intent_network { srv5_host_lan_endpoint, srv6_host_lan_endpoint, host_lan_address }
+import gunbc.fleet_intent_network { host_lan_address }
 import gunbc.serving.serving_enrollment { ServingRouteEndpoint, serving_route_endpoint_wire }
 import product.host_identity { HostIdentity }
 
diff --git a/dag/gunbc/heal_publisher_workflow.dag b/dag/gunbc/heal_publisher_workflow.dag
deleted file mode 100644
index 9788f230f6f..00000000000
--- a/dag/gunbc/heal_publisher_workflow.dag
+++ /dev/null
@@ -1,493 +0,0 @@
-module gunbc.heal_publisher_workflow
-
-
-import std.types { Bool, Int, List, String, NonEmptyStr }
-import std.optional { Present, Absent }
-import v2.std.algebra { list_map }
-import extdeps.languages.yaml.types { yaml_string, yaml_int, yaml_bool, kv, YamlKeyValue, YamlValue }
-import extdeps.languages.yaml.emit { emit_yaml, EmittedYaml, YamlEmitRefused, yaml_emit_refusal_text }
-import extdeps.languages.yaml.gha_workflow { project_workflow_to_yaml }
-import extdeps.github.actions {
-  Workflow, Job, Step, RunStep, UsesStep,
-  WorkflowTrigger, WorkflowRunCompleted,
-  WorkflowPermissions, PermRead, PermWrite,
-  ConcurrencySpec, ConcurrencyMappingQueueMax, CancelInProgressWhenQueueMax, QueueMaxCancelInProgressFalse,
-  RunnerSpec, HostedRunner, RunnerLabel, Ubuntu2404Arm
-}
-import gunbc.action_use_admission {
-  admit_workflow_checkout_refs, WorkflowCheckoutRefsAdmitted, WorkflowCheckoutRefsRefused, workflow_checkout_refs_refusal_reason, checkout_action, download_artifact_action, google_auth_action }
-import extdeps.github.action_release { ActionRelease, action_release_same_producer }
-import gunbc.roadmap_execution_contract { CargoCapability, RustcCapability, RustfmtCapability, RustupCapability }
-import gunbc.workflow_capability_closure {
-  CapabilityAnnotatedStep, StepCapabilityRole, capability_neutral, provides_only, consumes_only,
-  workflow_job_capability_closure, capability_closure_is_closed
-}
-import gunbc.toolchain_home_standing {
-  admit_workflow_toolchain_homes, WorkflowToolchainHomesAdmitted, WorkflowToolchainHomeRefused, toolchain_home_refusal_reason
-}
-import gunbc.toolchain_workflow_steps { toolchain_home_isolation_step, toolchain_pin_rustup_default_step }
-import gunbc.witness_floor_workflow { witness_floor_toolchain_step, witness_floor_build_step, witness_floor_workflow_name }
-import gunbc.repo_self_build { repo_self_build_command }
-import gunbc.heal_workflow {
-  heal_workflow_name, heal_job_holds_publication_credential, step_uses_action, job_permissions_carry_write
-}
-import gunbc.heal_publication_boundary {
-  heal_repair_candidate_artifact_name, heal_repair_candidate_blob_file_prefix,
-  phase_isolation, phases_are_isolated
-}
-import gunbc.heal_publication { heal_publication_candidate_directory_env }
-import gunbc.auth.heal_publisher_federation {
-  heal_publisher_wif_provider_resource, heal_publisher_service_account
-}
-import gunbc.ci_spec {
-  gunbc_ci_heal_publication_admit_invoke,
-  gunbc_ci_heal_publication_publish_invoke
-}
-
-// THE PROTECTED PUBLISHER (gunbc#10958 Phase B), AND EVERY STRUCTURAL REASON IT IS SAFE TO GIVE IT A
-// CREDENTIAL.
-//
-// IT RUNS FROM THE DEFAULT BRANCH. A workflow_run workflow is taken from the default branch's own
-// definition, never from the pull request's, so nothing a branch can edit decides what this job does.
-//
-// IT NEVER FETCHES THE PULL REQUEST'S TREE. Its checkout takes no ref, so it is this workflow's own
-// commit; the branch's bytes arrive only as a downloaded candidate that the publisher reads as data
-// and re-derives every fact about. `publisher_job_executes_candidate_code` is the emit-time check.
-//
-// IT RUNS ON A GITHUB-HOSTED RUNNER, and that is a credential-isolation fact rather than a capacity
-// choice: our self-hosted runners also execute pull-request jobs and share a filesystem between
-// slots, so a token minted on one of them is reachable from code a pull request wrote. The federation
-// condition pins runner_environment to github-hosted for the same reason, so a later edit that moved
-// this job onto the fleet would fail to federate rather than quietly widen.
-//
-// ADMISSION HAPPENS BEFORE FEDERATION. The admit step runs with the job's own read-only token; only
-// if a candidate admits does the auth step run and a token get minted at all, so a malformed or stale
-// candidate never causes a credential to exist.
-
-data heal_publisher_workflow_name: String = "heal-publish"
-
-data heal_publisher_workflow_job_id: String = "publish"
-
-data heal_publisher_timeout_minutes: Int = 45
-
-data heal_publisher_candidate_directory: String = "heal-candidate"
-
-data heal_publisher_required_bins: List<String> = ["gunbc"]
-
-data heal_publisher_build_step_name: String = "Build the publisher this job runs from the default branch"
-
-data heal_publisher_wif_step_id: String = "heal_publisher_wif"
-
-// GitHub's workflow_run branch filter takes the TRIGGERING run's branch, and this publisher answers
-// for every pull request branch, so the filter is the match-all pattern rather than an omission --
-// the trigger requires the member, and `[]` would name no branch at all.
-data heal_publisher_triggering_branches: List<String> = ["**"]
-
-// ONE PUBLICATION AT A TIME PER BRANCH, AND NONE DROPPED. Two candidates for one branch are ordered
-// rather than raced: the second re-reads the branch head after the first has moved it and refuses as
-// stale, which is a decision, while a cancelled pending entry would be a repair silently lost.
-data heal_publisher_concurrency: ConcurrencySpec = ConcurrencyMappingQueueMax {
-  group: "heal-publish-${{ github.event.workflow_run.head_branch }}",
-  cancel_in_progress: Present { value: QueueMaxCancelInProgressFalse }
-}
-
-fn heal_publisher_job_condition() -> String {
-  join([
-    "github.event.workflow_run.event == 'pull_request'",
-    " && github.event.workflow_run.head_repository.full_name == github.repository"
-  ], "")
-}
-
-fn heal_publisher_checkout_step() -> Step {
-  UsesStep {
-    name: Present { value: "Checkout the default branch this publisher runs from" },
-    id: none,
-    uses: checkout_action,
-    with: Present {
-      value: [
-        kv(key: "fetch-depth", value: yaml_int(n: 1)),
-        kv(key: "persist-credentials", value: yaml_bool(b: false))
-      ]
-    },
-    env: none,
-    if_condition: none,
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-// A PATTERN RATHER THAN A NAME, because a name that matches nothing is an ERROR in the download
-// action and "nothing to publish" is this workflow's ordinary case. The run id is the triggering
-// run's, so the artifact read is bound to the run whose facts the publisher validates against.
-// ABSENCE AND FAILURE ARE DIFFERENT ANSWERS, and conflating them loses repairs silently. A run that
-// found no drift seals no candidate, so the publisher must tolerate there being nothing to fetch; a
-// download that fails transiently, or against an artifact it may not read, must NOT look like that.
-// Tolerating both on one step is what made a real repair indistinguishable from a clean tree.
-//
-// So the run is ASKED first -- one artifacts listing, which is a read the job's `actions: read`
-// grant already covers -- and the answer decides whether the download runs at all. The download
-// itself then carries no continue-on-error, so its failure is a failure.
-data heal_publisher_candidate_probe_step_id: String = "candidate_probe"
-data heal_publisher_candidate_present_output: String = "present"
-
-fn heal_publisher_candidate_probe_step() -> Step {
-  RunStep {
-    name: Present { value: "Ask the triggering run whether it sealed a candidate" },
-    id: Present { value: heal_publisher_candidate_probe_step_id },
-    run: join([
-      "set -euo pipefail",
-      concat("NAMES=$(gh api --paginate \"repos/$GITHUB_REPOSITORY/actions/runs/$TRIGGERING_RUN_ID/artifacts\" --jq '.artifacts[].name')", ""),
-      concat("if printf '%s\\n' \"$NAMES\" | grep -qx \"", concat(heal_repair_candidate_artifact_name as String, "\"; then")),
-      concat("  echo \"", concat(heal_publisher_candidate_present_output, "=true\" >> \"$GITHUB_OUTPUT\"")),
-      "else",
-      concat("  echo \"", concat(heal_publisher_candidate_present_output, "=false\" >> \"$GITHUB_OUTPUT\"")),
-      "  echo \"::notice::the triggering run sealed no repair candidate, so there is nothing to publish\"",
-      "fi"
-    ], "\n"),
-    shell: none,
-    env: Present {
-      value: [
-        kv(key: "GH_TOKEN", value: yaml_string(s: "${{ github.token }}")),
-        kv(key: "TRIGGERING_RUN_ID", value: yaml_string(s: "${{ github.event.workflow_run.id }}"))
-      ]
-    },
-    working_directory: none,
-    if_condition: none,
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-fn heal_publisher_candidate_present_condition() -> String {
-  join([
-    "steps.", heal_publisher_candidate_probe_step_id, ".outputs.",
-    heal_publisher_candidate_present_output, " == 'true'"
-  ], "")
-}
-
-fn heal_publisher_download_step() -> Step {
-  UsesStep {
-    name: Present { value: "Download the candidate the triggering heal run produced" },
-    id: none,
-    uses: download_artifact_action,
-    with: Present {
-      value: [
-        kv(key: "pattern", value: yaml_string(s: heal_repair_candidate_artifact_name as String)),
-        kv(key: "path", value: yaml_string(s: heal_publisher_candidate_directory)),
-        kv(key: "merge-multiple", value: yaml_bool(b: true)),
-        kv(key: "run-id", value: yaml_string(s: "${{ github.event.workflow_run.id }}")),
-        kv(key: "github-token", value: yaml_string(s: "${{ github.token }}"))
-      ]
-    },
-    env: none,
-    if_condition: Present { value: heal_publisher_candidate_present_condition() },
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-// A CANDIDATE THAT NAMES PATHS HAS BLOBS BESIDE ITS MANIFEST, AND THAT IS WHAT THE CREDENTIALED
-// STEPS GATE ON. The manifest itself is written on EVERY successful heal run -- an empty entries list
-// is how a clean tree says so -- which is exactly why its presence cannot gate anything: it is there
-// either way. The blob files are written only for paths that actually drifted, so their presence is
-// the candidate's own statement that there is something to publish.
-//
-// WHAT THIS BUYS IS NOT A SAVED MINUTE. Gating the mint means a token for the publisher identity, and
-// an installation token for the App, come into existence only on runs where a repair is owed. Every
-// other run of this job holds no publication credential at any moment, which is the same property the
-// candidate phase has by construction -- so the credentialed window is as narrow as the repair
-// population rather than as wide as the pull-request population.
-fn heal_publisher_candidate_has_entries_condition() -> String {
-  join([
-    "hashFiles('",
-    heal_publisher_candidate_directory, "/", heal_repair_candidate_blob_file_prefix as String, "*",
-    "') != ''"
-  ], "")
-}
-
-fn heal_publisher_gated(step_name: String, run: String, env: List<YamlKeyValue>?, id: String?, if_condition: String?) -> Step {
-  RunStep {
-    name: Present { value: step_name },
-    id: id,
-    run: run,
-    shell: none,
-    env: env,
-    working_directory: none,
-    if_condition: if_condition,
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-fn heal_publisher_candidate_directory_env_row() -> YamlKeyValue {
-  kv(key: heal_publication_candidate_directory_env as String, value: yaml_string(s: heal_publisher_candidate_directory))
-}
-
-// THE CREDENTIAL-FREE GATE. It reads the event, the candidate and the forge with the job's own
-// read-only token, and refuses before anything can be minted. It runs only when the candidate names
-// paths: since gunbc#11791 the question "did the triggering run seal a candidate at all" is the
-// probe step's (heal_publisher_candidate_probe_step), which separates absence from a failed read,
-// so a clean tree and a lost candidate no longer share one quiet green here.
-fn heal_publisher_admit_step() -> Step {
-  heal_publisher_gated(
-    step_name: "Admit the candidate against this checkout's policy, with no publication credential",
-    run: gunbc_ci_heal_publication_admit_invoke(),
-    env: Present {
-      value: [
-        heal_publisher_candidate_directory_env_row(),
-        kv(key: "GITHUB_TOKEN", value: yaml_string(s: "${{ github.token }}"))
-      ]
-    },
-    id: none,
-    if_condition: Present { value: heal_publisher_candidate_has_entries_condition() }
-  )
-}
-
-fn heal_publisher_wif_auth_step() -> Step {
-  UsesStep {
-    name: Present { value: "Federate to the publisher's own identity (access token only, five minutes)" },
-    id: Present { value: heal_publisher_wif_step_id },
-    uses: google_auth_action,
-    with: Present {
-      value: [
-        kv(key: "workload_identity_provider", value: yaml_string(s: heal_publisher_wif_provider_resource())),
-        kv(key: "service_account", value: yaml_string(s: heal_publisher_service_account as String)),
-        kv(key: "token_format", value: yaml_string(s: "access_token")),
-        kv(key: "access_token_lifetime", value: yaml_string(s: "300s")),
-        kv(key: "create_credentials_file", value: yaml_bool(b: false)),
-        kv(key: "export_environment_variables", value: yaml_bool(b: false))
-      ]
-    },
-    env: none,
-    if_condition: Present { value: heal_publisher_candidate_has_entries_condition() },
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-fn heal_publisher_publish_step() -> Step {
-  heal_publisher_gated(
-    step_name: "Publish the admitted repair, fast-forward only, and read it back",
-    run: gunbc_ci_heal_publication_publish_invoke(),
-    env: Present {
-      value: [
-        heal_publisher_candidate_directory_env_row(),
-        kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: join(["${{ steps.", heal_publisher_wif_step_id, ".outputs.access_token }}"], "")))
-      ]
-    },
-    id: none,
-    if_condition: Present { value: heal_publisher_candidate_has_entries_condition() }
-  )
-}
-
-
-// THE PUBLISHER'S TOOLCHAIN AND BUILD RUN ONLY WHEN A REPAIR IS OWED (operator, 2026-09-29). The
-// binary they produce has exactly two consumers, the admit and publish steps, and both are gated on
-// heal_publisher_candidate_has_entries_condition. Building it unconditionally spent ~5.5 minutes of
-// a GitHub-hosted runner on every pull request's witnesses completion to produce a binary nothing
-// then ran -- the ordinary case, since most runs seal an empty candidate -- and in a hosted pool of
-// 20 that cost is what queued real repairs for hours. The gate is the consumers' own condition, so
-// the build cannot be skipped on a run whose candidate a consumer would read.
-fn heal_publisher_only_when_repair_owed(step: Step) -> Step {
-  let owed = heal_publisher_candidate_has_entries_condition()
-  match step {
-    RunStep { name: n, id: i, run: r, shell: sh, env: e, working_directory: w, if_condition: c, continue_on_error: co, timeout_minutes: t } =>
-      RunStep { name: n, id: i, run: r, shell: sh, env: e, working_directory: w, if_condition: Present { value: heal_publisher_condition_and(existing: c, owed: owed) }, continue_on_error: co, timeout_minutes: t }
-    UsesStep { name: n, id: i, uses: u, with: wi, env: e, if_condition: c, continue_on_error: co, timeout_minutes: t } =>
-      UsesStep { name: n, id: i, uses: u, with: wi, env: e, if_condition: Present { value: heal_publisher_condition_and(existing: c, owed: owed) }, continue_on_error: co, timeout_minutes: t }
-  }
-}
-
-fn heal_publisher_condition_and(existing: String?, owed: String) -> String {
-  match existing {
-    Present { value: c } => join(["(", c, ") && (", owed, ")"], "")
-    Absent => owed
-  }
-}
-
-type HealPublisherBoundStep {
-  step: Step
-  role: StepCapabilityRole
-  step_name: String
-}
-
-fn heal_publisher_bound_steps() -> List<HealPublisherBoundStep> {
-  [
-    HealPublisherBoundStep {
-      step: heal_publisher_candidate_probe_step(),
-      role: capability_neutral,
-      step_name: "Ask the triggering run whether it sealed a candidate",
-    },
-    HealPublisherBoundStep {
-      step: heal_publisher_checkout_step(),
-      role: capability_neutral,
-      step_name: "Checkout the default branch this publisher runs from",
-    },
-    HealPublisherBoundStep {
-      step: heal_publisher_download_step(),
-      role: capability_neutral,
-      step_name: "Download the candidate the triggering heal run produced",
-    },
-    HealPublisherBoundStep {
-      step: heal_publisher_only_when_repair_owed(step: toolchain_home_isolation_step()),
-      role: capability_neutral,
-      step_name: "Isolate toolchain homes",
-    },
-    HealPublisherBoundStep {
-      step: heal_publisher_only_when_repair_owed(step: witness_floor_toolchain_step()),
-      role: provides_only(capabilities: [CargoCapability, RustcCapability, RustfmtCapability, RustupCapability]),
-      step_name: "Install Rust toolchain",
-    },
-    HealPublisherBoundStep {
-      step: heal_publisher_only_when_repair_owed(step: toolchain_pin_rustup_default_step()),
-      role: consumes_only(capabilities: [RustupCapability, CargoCapability]),
-      step_name: "Pin rustup default (isolated RUSTUP_HOME has no default toolchain)",
-    },
-    HealPublisherBoundStep {
-      step: heal_publisher_only_when_repair_owed(step: witness_floor_build_step(step_name: heal_publisher_build_step_name, build_script: repo_self_build_command(bins: heal_publisher_required_bins))),
-      role: consumes_only(capabilities: [CargoCapability]),
-      step_name: heal_publisher_build_step_name,
-    },
-    HealPublisherBoundStep {
-      step: heal_publisher_admit_step(),
-      role: capability_neutral,
-      step_name: "Admit the candidate against this checkout's policy, with no publication credential",
-    },
-    HealPublisherBoundStep {
-      step: heal_publisher_wif_auth_step(),
-      role: capability_neutral,
-      step_name: "Federate to the publisher's own identity (access token only, five minutes)",
-    },
-    HealPublisherBoundStep {
-      step: heal_publisher_publish_step(),
-      role: capability_neutral,
-      step_name: "Publish the admitted repair, fast-forward only, and read it back",
-    },
-  ]
-}
-
-fn heal_publisher_capability_closure_holds() -> Bool {
-  capability_closure_is_closed(
-    v: workflow_job_capability_closure(
-      steps: list_map(
-        xs: heal_publisher_bound_steps(),
-        f: fn(b) { CapabilityAnnotatedStep { step_name: b.step_name, role: b.role } },
-      )
-    ),
-  )
-}
-
-// actions: READ is the artifact download from another run. contents: READ is this checkout.
-// pull_requests: READ is the subject join the admission makes. id-token: WRITE is the federation,
-// and it is the only write on the job -- the publication credential itself is not a GitHub Actions
-// grant at all but an App installation token minted inside the publish step.
-data heal_publisher_job_permissions: WorkflowPermissions = WorkflowPermissions {
-  contents: Present { value: PermRead },
-  pull_requests: Present { value: PermRead },
-  issues: none,
-  actions: Present { value: PermRead },
-  id_token: Present { value: PermWrite }
-}
-
-fn heal_publisher_job() -> Job {
-  Job {
-    id: heal_publisher_workflow_job_id,
-    name: none,
-    runner: HostedRunner { label: Ubuntu2404Arm },
-    environment: none,
-    steps: list_map(xs: heal_publisher_bound_steps(), f: fn(b) { b.step }),
-    needs: [],
-    env: none,
-    outputs: none,
-    if_condition: Present { value: heal_publisher_job_condition() },
-    timeout_minutes: Present { value: heal_publisher_timeout_minutes },
-    continue_on_error: none,
-    concurrency: none,
-    permissions: Present { value: heal_publisher_job_permissions }
-  }
-}
-
-data heal_publisher_workflow: Workflow = Workflow {
-  name: heal_publisher_workflow_name,
-  run_name: none,
-  on: [
-    WorkflowRunCompleted {
-      workflows: [witness_floor_workflow_name],
-      branches: heal_publisher_triggering_branches
-    }
-  ],
-  concurrency: Present { value: heal_publisher_concurrency },
-  env: Present {
-    value: [
-      kv(key: "CARGO_TERM_COLOR", value: yaml_string(s: "always"))
-    ]
-  },
-  permissions: none,
-  jobs: [heal_publisher_job()]
-}
-
-// ── The isolation invariant, asked of both emitted jobs ──────────────────────────────────────
-
-fn step_input_names(step: Step) -> List<String> {
-  match step {
-    RunStep { name: _, id: _, run: _, shell: _, env: _, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => []
-    UsesStep { name: _, id: _, uses: _, with: w, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
-      match w {
-        Absent => []
-        Present { value: rows } => map(rows, row => row.key as String)
-      }
-  }
-}
-
-// A CHECKOUT THAT NAMES A REF OR A REPOSITORY IS FETCHING SOMETHING OTHER THAN THIS WORKFLOW'S OWN
-// COMMIT, and for this job the only thing it could name is the branch under review. That is the
-// second isolation direction: the phase holding publication authority must not obtain the candidate's
-// code, and the check reads the emitted steps rather than trusting the author.
-fn checkout_step_names_another_subject(step: Step) -> Bool {
-  step_uses_action(step: step, action: checkout_action)
-    && any(step_input_names(step: step), k => k == "ref" || k == "repository")
-}
-
-fn publisher_job_executes_candidate_code() -> Bool {
-  any(heal_publisher_job().steps, s => checkout_step_names_another_subject(step: s))
-}
-
-fn heal_publication_phases_isolated() -> Bool {
-  phases_are_isolated(s: phase_isolation(
-    candidate_holds_publication_credential: heal_job_holds_publication_credential(),
-    candidate_credential_detail: "the heal candidate job carries a write grant or federates to a cloud identity",
-    publication_executes_candidate_code: publisher_job_executes_candidate_code(),
-    publication_execution_detail: "the publisher job checks out a ref or repository other than its own default-branch commit"
-  ))
-}
-
-type HealPublisherWorkflowGenerationOutcome
-  = HealPublisherWorkflowGenerated { content: String }
-  | HealPublisherWorkflowGenerationRefused { reason: String }
-
-data heal_publisher_isolation_refusal_reason: String = "REFUSED gunbc.heal_publisher_workflow: the two phases are not isolated -- either the candidate job holds a publication credential or the publisher job obtains the candidate's code. No workflow yaml was emitted; this is the invariant gunbc.heal_publication_boundary states and gunbc#10887 violated."
-
-data heal_publisher_capability_refusal_reason: String = "REFUSED gunbc.heal_publisher_workflow: the job's capability closure does not hold. No workflow yaml was emitted."
-
-fn expected_heal_publisher_workflow_yml() -> HealPublisherWorkflowGenerationOutcome {
-  match admit_workflow_checkout_refs(workflow: heal_publisher_workflow, declared: []) {
-    WorkflowCheckoutRefsRefused { refusals: crs } =>
-      HealPublisherWorkflowGenerationRefused { reason: workflow_checkout_refs_refusal_reason(workflow_module: "gunbc.heal_publisher_workflow", refusals: crs) }
-    WorkflowCheckoutRefsAdmitted =>
-      match admit_workflow_toolchain_homes(workflow: heal_publisher_workflow) {
-    WorkflowToolchainHomeRefused { job_id: j, refusal: r } =>
-      HealPublisherWorkflowGenerationRefused { reason: toolchain_home_refusal_reason(job_id: j, refusal: r) }
-    WorkflowToolchainHomesAdmitted =>
-      if !heal_publication_phases_isolated() {
-        HealPublisherWorkflowGenerationRefused { reason: heal_publisher_isolation_refusal_reason }
-      } else if !heal_publisher_capability_closure_holds() {
-        HealPublisherWorkflowGenerationRefused { reason: heal_publisher_capability_refusal_reason }
-      } else {
-        match emit_yaml(v: project_workflow_to_yaml(workflow: heal_publisher_workflow)) {
-          EmittedYaml { text: t } => HealPublisherWorkflowGenerated { content: t }
-          YamlEmitRefused { path: p, reason: r } => HealPublisherWorkflowGenerationRefused { reason: yaml_emit_refusal_text(module_path: "gunbc.heal_publisher_workflow", path: p, reason: r) }
-        }
-      }
-  }
-  }
-}
diff --git a/dag/gunbc/host/baseboard_dimm_figure.dag b/dag/gunbc/host/baseboard_dimm_figure.dag
index 0067253e3e6..94f03d11b38 100644
--- a/dag/gunbc/host/baseboard_dimm_figure.dag
+++ b/dag/gunbc/host/baseboard_dimm_figure.dag
@@ -3,7 +3,9 @@ module gunbc.baseboard_dimm_figure
 import std.types { List }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.ampere.mt_collins_getting_started_guide.subject { mt_collins_gsg_authority }
-import extdeps.boards.types { BaseboardModel, AsrockRackAltrad8ud1l2t, GigabyteMp72Hb0, AmpereMtCollins }
+import std.optional { Present, Absent }
+import extdeps.board_authority { BoardAuthorityRef, BoardAuthorityLookup, board_facts_authority, board_authority_ref_eq }
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
 import extdeps.ampere.mt_collins_getting_started_guide.dimm_layout {
   MtCollinsDimmFigureBank, MtCollinsChassisFigureOrientation, dimm_figure_banks, chassis_figure_orientation,
 }
@@ -12,7 +14,7 @@ import extdeps.ampere.mt_collins_product_brief.memory_population {
 }
 
 // WHICH CITED DIMM FIGURE A BASEBOARD HAS, and nothing else. A consumer-layer dispatch over the
-// closed extdeps.boards.types BaseboardModel (DESIGN §3: the dispatch that selects among upstream
+// closed (extdeps.board_authority) (DESIGN §3: the dispatch that selects among upstream
 // authorities is not a fact of any one of them, so it lives here and never in extdeps). An arm names
 // the board's own cited model and carries that model's external authority; it carries no rows, so
 // the figure is read from its extdeps authority at every use and never restated beside it. A board with no cited figure in this repository refuses
@@ -22,14 +24,20 @@ type BaseboardDimmFigure
   = MtCollinsGettingStartedGuideFigures { guide: ExternalAuthority }
 
 type BaseboardDimmFigureStanding
-  = BaseboardDimmFigureOf { board: BaseboardModel, figure: BaseboardDimmFigure }
-  | BoardFigureUnmodeled { board: BaseboardModel }
-
-fn baseboard_dimm_figure(board: BaseboardModel) -> BaseboardDimmFigureStanding {
-  match board {
-    AmpereMtCollins => BaseboardDimmFigureOf { board: board, figure: MtCollinsGettingStartedGuideFigures { guide: mt_collins_gsg_authority } }
-    GigabyteMp72Hb0 => BoardFigureUnmodeled { board: board }
-    AsrockRackAltrad8ud1l2t => BoardFigureUnmodeled { board: board }
+  = BaseboardDimmFigureOf { board: BoardAuthorityRef, figure: BaseboardDimmFigure }
+  | BoardFigureUnmodeled { board: BoardAuthorityLookup }
+
+// A figure is a board FACT, so only an evidence-bound lookup can reach one; a name-only, unbound,
+// ambiguous or unread board is BoardFigureUnmodeled carrying the lookup that refused it.
+fn baseboard_dimm_figure(board: BoardAuthorityLookup) -> BaseboardDimmFigureStanding {
+  match board_facts_authority(lookup: board) {
+    Present { value: a } =>
+      if board_authority_ref_eq(a: a, b: mt_collins_board_authority) {
+        BaseboardDimmFigureOf { board: a, figure: MtCollinsGettingStartedGuideFigures { guide: mt_collins_gsg_authority } }
+      } else {
+        BoardFigureUnmodeled { board: board }
+      }
+    Absent => BoardFigureUnmodeled { board: board }
   }
 }
 
diff --git a/dag/gunbc/host/boot_medium.dag b/dag/gunbc/host/boot_medium.dag
index f3e977d9f37..2a26ef37b7f 100644
--- a/dag/gunbc/host/boot_medium.dag
+++ b/dag/gunbc/host/boot_medium.dag
@@ -32,9 +32,15 @@ data bmc_boot_image_export: BootImageExport = BootImageExport {
 // the census volume and nothing else does, and the stock installer prints no terminal at all, so a
 // boot of it can be refused before any controller write. A new medium adds its arm here with the
 // acceptance predicate its terminal is read by; the boot subject does not change.
+//
+// RunnerHostUp is the runner medium's terminal: the medium's volume label (so the capture binds to
+// the medium that was attached) and a host whose runner is installed and whose idle memory, thread
+// count and machine architecture were read before any job. Its predicate is runner-owned
+// (gunbc.runner.runner_host_medium runner_host_up_readback), not a property of a boot run.
 type BootMediumTerminal
   = BootMediumNoTerminal { reason: NonEmptyStr }
   | BootMediumVolumeLabel { label: NonEmptyStr }
+  | BootMediumRunnerHostUp { label: NonEmptyStr }
 
 // THE MEDIUM IS BOOT POLICY, NOT A HOST FACT: which artifact a boot attaches, named by its content
 // digest, where it is exported, and what terminal it is accepted by. The published file is the
diff --git a/dag/gunbc/host/host_assimilation_program.dag b/dag/gunbc/host/host_assimilation_program.dag
index f2a9062d062..715976c648e 100644
--- a/dag/gunbc/host/host_assimilation_program.dag
+++ b/dag/gunbc/host/host_assimilation_program.dag
@@ -11,6 +11,7 @@ import gunbc.host_standup {
   BmcCredentialConverge,
   OsInstallMechanismResolved,
   OsInstallActuated,
+  ProviderGuestAdopted,
   HostConvergePolicyDerived,
   HostIdentityConverge,
   ReachSecretsNetwork,
@@ -42,7 +43,17 @@ import gunbc.host_standup {
   assimilation_complete_input_eq,
   assimilation_input_is_required,
 }
-import product.host_identity { HostIdentity }
+import gunbc.fleet_host_backing { HostBacking, OwnedMachine, BmcVirtualMediaInstall, ApplianceFirstBoot, ProviderGuest }
+import gunbc.fleet_enrollment {
+  FleetParticipation,
+  CiRunnerParticipation,
+  InferenceServingParticipation,
+  InteractiveSessionParticipation,
+  HostEnrollmentIntent,
+  fleet_participation_label,
+  participation_list_contains,
+  ci_runner_enrollment_participation,
+}
 
 // WHY THIS EXISTS: host_standup_spine is ONE universal list, and gunbc.host_phase_status crossed
 // every enrolled host with all of it. That was correct while every enrolled host was the same kind
@@ -59,37 +70,9 @@ import product.host_identity { HostIdentity }
 // exist at all, so an obligation that does not apply is not a cell with a label -- it is not a
 // cell.
 
-// Participation is what a host DOES for the fleet, and it is a LIST because the axes are
-// independent rather than exclusive: nothing in the model forbids a host that both runs CI and
-// serves inference, and a coproduct would have forced a third fused variant the first time that
-// happened. It is deliberately NOT a host KIND enum (AltraRunner | SparkAppliance) -- kind is
-// hardware, participation is role, and binding obligations to hardware would mean a future Altra
-// dedicated to serving inherits BMC obligations because of what it is made of rather than what it
-// is for. srv5 and srv6 stay opaque host identities for the same reason: the identity survives a
-// role change or a hardware replacement, and DGX Spark remains a product fact recorded elsewhere,
-// never part of the host's permanent name.
-
-type FleetParticipation
-  = CiRunnerParticipation
-  | InferenceServingParticipation
-
-fn fleet_participation_label(p: FleetParticipation) -> String {
-  match p {
-    CiRunnerParticipation => "ci-runner"
-    InferenceServingParticipation => "inference-serving"
-  }
-}
-
-fn fleet_participation_eq(a: FleetParticipation, b: FleetParticipation) -> Bool {
-  fleet_participation_label(p: a) == fleet_participation_label(p: b)
-}
-
-type HostEnrollmentIntent {
-  host: HostIdentity
-  participation: List<FleetParticipation>
-}
 
-// The one place a standup phase is bound to the participations that require it, kept HERE rather
+// The one place a standup phase is bound to what requires it -- an assimilation phase to the
+// participations that need it, a prefix phase to the provisioning that owes it -- kept HERE rather
 // than as a field on HostStandupStep on purpose. Adding the field would reshape fourteen rows in
 // host_standup.dag, which is load-bearing, and that module's own gap-ledger note has already ruled
 // that its row-reshaping change stays separable from its status-axis change so the two are
@@ -99,21 +82,30 @@ type HostEnrollmentIntent {
 // stated. That is the construction half (DESIGN section 5) -- there is no unclassified phase to
 // detect after the fact, because an unclassified phase does not compile.
 
-// Every PREFIX phase is CI-runner only. BMC credential convergence and virtual-media OS
-// installation are the Ampere Altra provisioning path and have no analogue on an appliance that
-// self-provisions through its own first-boot flow; HostConvergePolicyDerived is grouped with them
-// because the policy it derives is that installation path's policy. A DGX Spark absolutely HAS
-// arrival obligations -- physical binding, network convergence, baseline observation -- but they
-// are its OWN obligations, authored where that arrival is modeled, and inheriting a
-// differently-shaped host's provisioning steps because they sound generic is precisely the
-// false-obligation defect this module exists to prevent.
-
-fn prefix_phase_participations(p: HostStandupPrefixPhase) -> List<FleetParticipation> {
-  match p {
-    BmcCredentialConverge => [CiRunnerParticipation]
-    OsInstallMechanismResolved => [CiRunnerParticipation]
-    OsInstallActuated => [CiRunnerParticipation]
-    HostConvergePolicyDerived => [CiRunnerParticipation]
+// A PREFIX STEP IS PROVISIONING, AND PROVISIONING FOLLOWS FROM BACKING, NOT FROM ROLE. The four
+// Altra steps -- BMC credential convergence, the virtual-media install's mechanism and actuation, and
+// the converge policy derived for that install path -- are owed by a host whose OS arrives over BMC
+// virtual media, whatever it is enrolled to do. A provider guest owes its adoption instead. An
+// appliance that provisions itself through first boot owes no prefix step here: its arrival
+// obligations are its own and are authored where that arrival is modeled. The match is exhaustive
+// over both enums, so a new phase or a new provisioning path does not compile until it is placed.
+fn prefix_phase_applies(p: HostStandupPrefixPhase, backing: HostBacking) -> Bool {
+  match backing {
+    OwnedMachine { provisioning: BmcVirtualMediaInstall } => match p {
+      BmcCredentialConverge => true
+      OsInstallMechanismResolved => true
+      OsInstallActuated => true
+      ProviderGuestAdopted => false
+      HostConvergePolicyDerived => true
+    }
+    OwnedMachine { provisioning: ApplianceFirstBoot } => false
+    ProviderGuest { route: _, entitlement: _, resource: _ } => match p {
+      BmcCredentialConverge => false
+      OsInstallMechanismResolved => false
+      OsInstallActuated => false
+      ProviderGuestAdopted => true
+      HostConvergePolicyDerived => false
+    }
   }
 }
 
@@ -137,28 +129,18 @@ fn assimilation_phase_participations(p: HostStandupAssimilationPhase) -> List<Fl
     CodexRuntimeProvision => [CiRunnerParticipation]
     ComputeFabricEnroll => [CiRunnerParticipation, InferenceServingParticipation]
     GreenPlaceReadiness => [CiRunnerParticipation]
-    SessionPlacementEnrollment => [CiRunnerParticipation]
+    SessionPlacementEnrollment => [InteractiveSessionParticipation]
     StandupAssimilationComplete => [CiRunnerParticipation, InferenceServingParticipation]
   }
 }
 
-fn host_phase_participations(phase: HostStandupPhase) -> List<FleetParticipation> {
-  match phase {
-    Prefix { phase: p } => prefix_phase_participations(p: p)
-    Assimilation { phase: p } => assimilation_phase_participations(p: p)
-  }
-}
 
-fn participation_list_contains(ps: List<FleetParticipation>, wanted: FleetParticipation) -> Bool {
-  fold_list(
-    xs: ps,
-    empty: false,
-    cons: fn(acc, p) { if acc { true } else { fleet_participation_eq(a: p, b: wanted) } }
-  )
-}
 
 fn step_serves_participation(step: HostStandupStep, wanted: FleetParticipation) -> Bool {
-  participation_list_contains(ps: host_phase_participations(phase: step.phase), wanted: wanted)
+  match step.phase {
+    Prefix { phase: _ } => false
+    Assimilation { phase: p } => participation_list_contains(ps: assimilation_phase_participations(p: p), wanted: wanted)
+  }
 }
 
 fn step_serves_any(step: HostStandupStep, wanted: List<FleetParticipation>) -> Bool {
@@ -169,6 +151,15 @@ fn step_serves_any(step: HostStandupStep, wanted: List<FleetParticipation>) -> B
   )
 }
 
+// A step is in a host's program when its provisioning owes it (a prefix step) or one of its
+// participations does (an assimilation step).
+fn step_in_program(step: HostStandupStep, intent: HostEnrollmentIntent) -> Bool {
+  match step.phase {
+    Prefix { phase: p } => prefix_phase_applies(p: p, backing: intent.backing)
+    Assimilation { phase: _ } => step_serves_any(step: step, wanted: intent.participation)
+  }
+}
+
 type HostAssimilationProgram {
   identity: NonEmptyStr
   steps: List<HostStandupStep>
@@ -185,7 +176,7 @@ type HostAssimilationProgram {
 fn assimilation_program_for(intent: HostEnrollmentIntent) -> HostAssimilationProgram {
   HostAssimilationProgram {
     identity: host_enrollment_program_identity(intent: intent),
-    steps: filter(host_standup_spine, s => step_serves_any(step: s, wanted: intent.participation)),
+    steps: filter(host_standup_spine, s => step_in_program(step: s, intent: intent)),
   }
 }
 
@@ -213,6 +204,7 @@ fn assimilation_program_for(intent: HostEnrollmentIntent) -> HostAssimilationPro
 data fleet_participation_canonical_roster: List<FleetParticipation> = [
   CiRunnerParticipation,
   InferenceServingParticipation,
+  InteractiveSessionParticipation,
 ]
 
 fn fleet_participation_in_canonical_roster(p: FleetParticipation) -> Bool {
@@ -221,6 +213,8 @@ fn fleet_participation_in_canonical_roster(p: FleetParticipation) -> Bool {
       participation_list_contains(ps: fleet_participation_canonical_roster, wanted: CiRunnerParticipation)
     InferenceServingParticipation =>
       participation_list_contains(ps: fleet_participation_canonical_roster, wanted: InferenceServingParticipation)
+    InteractiveSessionParticipation =>
+      participation_list_contains(ps: fleet_participation_canonical_roster, wanted: InteractiveSessionParticipation)
   }
 }
 
@@ -239,21 +233,6 @@ fn program_step_count(program: HostAssimilationProgram) -> Int {
   program.steps.length()
 }
 
-// The CI-runner program is the identity anchor for the refactor: it must select the WHOLE spine,
-// because every phase authored to date exists to serve runner hosts. If a later phase is added that
-// no participation claims, or one that CI does not claim, this equality breaks and the witness reds
-// -- which is the intended alarm, not a maintenance burden. It is the discriminating control that
-// distinguishes 'the refactor preserved srv1-srv4 exactly' from 'the refactor produced a
-// plausible-looking matrix'.
-
-data ci_runner_enrollment_participation: List<FleetParticipation> = [CiRunnerParticipation]
-
-data inference_serving_enrollment_participation: List<FleetParticipation> = [InferenceServingParticipation]
-
-data both_participation_enrollment_participation: List<FleetParticipation> = [
-  InferenceServingParticipation,
-  CiRunnerParticipation,
-]
 
 // Completion inputs derive as the union over enrolled participations, deduplicated by
 // AssimilationCompleteInput identity, not as a priority chain over participation kinds. A host
@@ -328,6 +307,8 @@ fn assimilation_completion_inputs_for_one(p: FleetParticipation) -> List<Assimil
       append(shared_completion_inputs, items: ci_runner_only_completion_inputs)
     InferenceServingParticipation =>
       shared_completion_inputs
+    InteractiveSessionParticipation =>
+      shared_completion_inputs
   }
 }
 
diff --git a/dag/gunbc/host/host_budget_source.dag b/dag/gunbc/host/host_budget_source.dag
index 2cb18c62a96..150633dd943 100644
--- a/dag/gunbc/host/host_budget_source.dag
+++ b/dag/gunbc/host/host_budget_source.dag
@@ -4,6 +4,11 @@ import std.types { NonEmptyStr, String, Bool, List }
 import std.measure { ByteSize, byte_size_count }
 import std.os.types { KernelFamily, Linux, Darwin, WindowsNt, LinuxGuestOnWindows }
 import extdeps.linux.cgroup_v2 { kernel_provides_cgroup_v2 }
+import extdeps.linux.cgroup_v2_memory {
+  CgroupMemoryLimitValue, CgroupMemoryLimited, CgroupMemoryUnlimited, CgroupMemoryLimitUnparseable,
+  CgroupMemoryCount, CgroupMemoryCountUnparseable, parse_cgroup_memory_limit, parse_cgroup_memory_count,
+}
+import gunbc.required_ci_phase_roster { floor_log_row_fields, floor_log_field_value }
 import std.disposition { Disposition, Terminal, Scaffold, SingleAuthority }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.linux.procfs {
@@ -333,8 +338,8 @@ fn kernel_budget_sourcing_static_source(g: KernelBudgetSourcing) -> HostBudgetSo
 // may bound a refusal; it may not stand in for a reading.
 
 // THE CGROUP-v1 ARM JOINS THIS SAME DECLARED MIRROR rather than opening a second one. The seed's
-// memory_governor CgroupV1HierarchicalMemoryLimit arm, CgroupV1MemoryLimitValue,
-// cgroup_v1_hierarchical_limit_from_stat and cgroup_v1_unlimited_bytes hand-realize
+// v1_rt HostBudgetCgroupV1 arm, host_budget_cgroup_v1_from_stat and
+// host_budget_cgroup_v1_unlimited_bytes hand-realize
 // BudgetSourceCgroupV1HierarchicalMemoryLimit here and extdeps.linux.cgroup_v1_memory's parse, under
 // the bootstrap constraint stated in the note below: the budget bounds the resolve, so it is read
 // before any .dag value exists. The mirror keeps the model's three states (limited / unlimited /
@@ -353,3 +358,69 @@ data host_budget_source_seed_mirror_disposition: Disposition = Scaffold {
 data host_budget_source_seed_mirror_note: String = "THIS MODEL IS THE AUTHORITY AND v1 STILL HAND-REALIZES IT, which is a mirror of exactly the kind that just went stale elsewhere in this change — so it is declared rather than left implicit. memory_governor::read_host_budget_bytes composes its own labels and cli_run::typed_module_cache_cap_derivation computes its own degraded flag, and neither reads these rows.\n\nWhy the mirror cannot simply be deleted today: one consumer runs strictly before any .dag value could exist. cli_run's enforce_typed_cache_entry_cap derives the typed-module-cache eviction bound from this same budget WHILE MODULES ARE BEING RESOLVED — it is the thing bounding the memory used to resolve the corpus, so it cannot be a value obtained by resolving the corpus. The governor's own arm in claim_executor is different and could in principle read a resolved value (it happens after the plan resolve), so that half is ordinary seed-shrink debt rather than a bootstrap constraint. The two must not be conflated when the emit lands: the first needs the value baked into the seed, the second only needs the seed to stop duplicating it.\n\nTHAT CHECK NOW EXISTS BUT IS NOT RUN BY CI, and the distinction is the whole point of this row: test.claim.seed_mirror_constant_lens_witness_test reads the seed's constants against their authority rows and covers the union of what this note and gunbc.typed_module_cache_capacity's seed_mirror_note each asked for separately — DECLARED_RUNNER_SLOT_MEMORY_HIGH_BYTES, DECLARED_FLOOR_MINIMUM_VIABLE_ARMED_BUDGET_BYTES, and the three typed-module-cache constants. Two notes naming different overlapping subsets, neither of which was the union, was itself two partial specifications of one mechanism.
 
 THIS NOTE'S OWN WARNING CAME TRUE AND IS WORTH KEEPING FOR IT. It cited DECLARED_RUNNER_SLOT_MEMORY_HIGH_BYTES as having drifted once already; it then drifted again and sat eleven days at 13958643712 against an authority of 16106127360 (gunbc.runner_slot_desired gunbc_runner_slot_desired, moved by #8388 on 2026-08-17). Knowing about a gap and naming its fix is not the same as closing it, and the interval is the receipt. Note also that the sibling witness could not have caught it: test.claim.host_budget_source_witness built its expectation from the mirror value retyped, so it greened whichever way the mirror went — a second inert-by-construction surface, since corrected to derive from the row."
+
+// ── THE FLOOR'S [floor-cgroup] LEVEL ROWS, READ BACK FROM A RUN'S LOG ──────────────────────────
+//
+// The floor prints, at entry and on every heartbeat, one `[floor-cgroup] when=<moment> level=<dir>`
+// row per cgroup level from its own cgroup upward, carrying that level's memory.max, memory.high,
+// memory.current and memory.peak as the kernel spelled them (plus events and pressure, which this
+// reading does not take). The budget this module resolves IS the memory.high of the slot level, so
+// the bound and the peak a qualification reads are denominated in this module's vocabulary -- which is
+// why gunbc.runner_throughput_qualification_route names HostBudgetResolution as their producer. The
+// values are decoded by extdeps.linux.cgroup_v2_memory, the kernel interface's own authority, never
+// re-parsed here: `max` is CgroupMemoryUnlimited, never a large number.
+//
+// The `when=<moment> path=<dir>` row the floor prints beside them is a different row (the process's
+// own cgroup path, no readings) and is not a level row: it reads as none, like any other line.
+type FloorCgroupLevelRow {
+  when: NonEmptyStr
+  level: NonEmptyStr
+  high: CgroupMemoryLimitValue
+  peak: ByteSize
+}
+
+type FloorCgroupRowReading
+  = FloorCgroupLevelRead { row: FloorCgroupLevelRow }
+  | FloorCgroupRowGarbled { line: String, cause: NonEmptyStr }
+
+data floor_cgroup_row_tag: String = "[floor-cgroup]"
+
+fn floor_cgroup_garbled(line: String, cause: String) -> FloorCgroupRowReading? {
+  Present { value: FloorCgroupRowGarbled { line: line, cause: cause as NonEmptyStr } }
+}
+
+fn read_floor_cgroup_level_row(line: String) -> FloorCgroupRowReading? {
+  match floor_log_row_fields(line: line, tag: floor_cgroup_row_tag) {
+    Absent => none
+    Present { value: fields } =>
+      match floor_log_field_value(fields: fields, key: "level") {
+        Absent => none
+        Present { value: level } =>
+          match floor_log_field_value(fields: fields, key: "when") {
+            Absent => floor_cgroup_garbled(line: line, cause: "[floor-cgroup] level row carries no when= field")
+            Present { value: when } =>
+              if when == "" || level == "" {
+                floor_cgroup_garbled(line: line, cause: "[floor-cgroup] level row carries an empty when= or level= field")
+              } else {
+                match floor_log_field_value(fields: fields, key: "high") {
+                  Absent => floor_cgroup_garbled(line: line, cause: "[floor-cgroup] level row carries no high= field")
+                  Present { value: raw_high } =>
+                    match parse_cgroup_memory_limit(body: raw_high) {
+                      CgroupMemoryLimitUnparseable { body: _ } => floor_cgroup_garbled(line: line, cause: "[floor-cgroup] high= is neither a byte count nor max")
+                      high =>
+                        match floor_log_field_value(fields: fields, key: "peak") {
+                          Absent => floor_cgroup_garbled(line: line, cause: "[floor-cgroup] level row carries no peak= field")
+                          Present { value: raw_peak } =>
+                            match parse_cgroup_memory_count(body: raw_peak) {
+                              CgroupMemoryCountUnparseable { body: _ } => floor_cgroup_garbled(line: line, cause: "[floor-cgroup] peak= is not a byte count")
+                              CgroupMemoryCount { bytes: peak } =>
+                                Present { value: FloorCgroupLevelRead { row: FloorCgroupLevelRow { when: when as NonEmptyStr, level: level as NonEmptyStr, high: high, peak: peak } } }
+                            }
+                        }
+                    }
+                }
+              }
+          }
+      }
+  }
+}
diff --git a/dag/gunbc/host/host_control_route.dag b/dag/gunbc/host/host_control_route.dag
new file mode 100644
index 00000000000..b79b4a2ebb9
--- /dev/null
+++ b/dag/gunbc/host/host_control_route.dag
@@ -0,0 +1,117 @@
+module gunbc.host_control_route
+
+import std.types { List, NonEmptyStr }
+import std.optional { Present, Absent }
+import extdeps.cloud.hetzner_cloud_api { HetznerServerResponse }
+import product.host_identity { HostIdentity }
+import product.fabric.provider_route { ProviderRoute }
+import gunbc.managed_host {
+  ManagedHostBinding, ManagedHostBindingStanding, ManagedHostBound, ManagedHostAccessUnobserved,
+  ManagedHostNotSecured, ManagedHostEndpointMismatch, ManagedHostFound, ManagedHostFoundUnderDeclaredDrop, ManagedHostNotManaged,
+  managed_host_binding_for,
+}
+import gunbc.provider_acquisition { ProviderResourceAcquisition }
+import gunbc.fleet_host_backing {
+  OwnedMachine, BmcVirtualMediaInstall, ApplianceFirstBoot, ProviderGuest,
+  ProviderResourceAwaited, ProviderResourceAcquired,
+}
+import gunbc.fleet_enrollment { HostEnrollmentIntent }
+import gunbc.hetzner_cloud_server_reading {
+  AcquiredServerRead, AcquiredServerObserved, AcquiredServerIdUnparsed, AcquiredServerAnsweredForAnother, AcquiredServerReadRefused, acquired_server_read_line,
+}
+
+// HOW THE FLEET KEEPS CONTROL OF A HOST WHEN ITS OPERATING SYSTEM DOES NOT ANSWER. SSH is in-band:
+// it works only while the OS is healthy. Control is the out-of-band route that can power-cycle,
+// reinstall or reset the host anyway, driven from a controller and never by software resident on the
+// target or its controller (operator rulings 2026-09-05 and 2026-10-08). An owned Altra board is
+// controlled through its BMC; a rented guest has no BMC, and its provider's API is the same route.
+//
+// gunbc.managed_host stays what it is -- a host driven through a secured baseboard controller, whose
+// row carries BMC and Altra facts (SMpro site, firmware capability) every consumer of it needs.
+// Widening it to a guest would give that name a second meaning, so the generic fact lives here and
+// the BMC route carries a managed-host binding unchanged.
+type HostControlRoute
+  = BmcControlRoute { binding: ManagedHostBinding }
+  | ProviderApiControlRoute { route: ProviderRoute, acquisition: ProviderResourceAcquisition, observed: HetznerServerResponse }
+
+// A HOST THE FLEET CAN RECOVER WITHOUT ITS OS. sole_constructor: the producers below mint it only on
+// the arm that proved the route -- a bound managed host, or a provider resource whose account's
+// token was just used to read that exact resource -- so no consumer can claim control of a host it
+// has no working route to. An acquisition record alone says the resource was bought, not that the
+// credential still reaches it.
+type ControlledHost sole_constructor {
+  host: HostIdentity
+  route: HostControlRoute
+}
+
+type HostControlRefusal
+  = BmcRouteNotBound { standing: ManagedHostBindingStanding }
+  | BmcHostNotManaged { host: HostIdentity }
+  | NoOutOfBandRoute { host: HostIdentity }
+  | ProviderResourceNotAcquired { host: HostIdentity, read_obligation: NonEmptyStr }
+  | ProviderControlUnobserved { host: HostIdentity, resource_id: NonEmptyStr, cause: String }
+
+type HostControlStanding
+  = HostControlled { controlled: ControlledHost }
+  | HostControlRefused { refusal: HostControlRefusal }
+
+// THE BMC ROUTE, from a managed host's binding standing as gunbc.managed_host decided it. A refusal
+// carries that standing unchanged rather than a re-coined cause.
+fn bmc_controlled_host(standing: ManagedHostBindingStanding) -> HostControlStanding {
+  match standing {
+    ManagedHostBound { binding: b } =>
+      HostControlled { controlled: ControlledHost { host: b.host.host, route: BmcControlRoute { binding: b } } }
+    ManagedHostAccessUnobserved { endpoint: _ } => HostControlRefused { refusal: BmcRouteNotBound { standing: standing } }
+    ManagedHostNotSecured { cause: _ } => HostControlRefused { refusal: BmcRouteNotBound { standing: standing } }
+    ManagedHostEndpointMismatch { observed: _, secured: _ } => HostControlRefused { refusal: BmcRouteNotBound { standing: standing } }
+  }
+}
+
+// AN ENROLLED HOST'S ROUTE, decided by its backing. A board installed over BMC virtual media is
+// controlled only once gunbc.managed_host binds it; an appliance that provisions itself through first
+// boot has no out-of-band route at all, and says so; a provider guest is controlled through the
+// account its acquisition is held under, and only on a provider read that answered about exactly
+// that resource -- an unrecorded acquisition, no read, or a refused one each refuse with its cause.
+fn enrolled_host_control(intent: HostEnrollmentIntent, provider_reads: List<AcquiredServerRead>) -> HostControlStanding {
+  match intent.backing {
+    OwnedMachine { provisioning: p } => match p {
+      BmcVirtualMediaInstall => match managed_host_binding_for(host: intent.host as NonEmptyStr) {
+        ManagedHostNotManaged { host: _ } => HostControlRefused { refusal: BmcHostNotManaged { host: intent.host } }
+        ManagedHostFound { standing: s } => bmc_controlled_host(standing: s)
+        ManagedHostFoundUnderDeclaredDrop { standing: s, drop: _, standing_subject: _, current_subject: _ } => bmc_controlled_host(standing: s)
+      }
+      ApplianceFirstBoot => HostControlRefused { refusal: NoOutOfBandRoute { host: intent.host } }
+    }
+    ProviderGuest { route: r, entitlement: _, resource: res } => match res {
+      ProviderResourceAwaited { read_obligation: o } =>
+        HostControlRefused { refusal: ProviderResourceNotAcquired { host: intent.host, read_obligation: o } }
+      ProviderResourceAcquired { acquisition: a } => provider_controlled_host(host: intent.host, route: r, acquisition: a, provider_reads: provider_reads)
+    }
+  }
+}
+
+fn read_is_about(read: AcquiredServerRead, resource_id: NonEmptyStr) -> Bool {
+  (read_resource_id(read: read) as String) == (resource_id as String)
+}
+
+fn read_resource_id(read: AcquiredServerRead) -> NonEmptyStr {
+  match read {
+    AcquiredServerObserved { acquisition: a, server: _ } => a.resource_id
+    AcquiredServerIdUnparsed { acquisition: a } => a.resource_id
+    AcquiredServerAnsweredForAnother { acquisition: a, observed: _ } => a.resource_id
+    AcquiredServerReadRefused { acquisition: a, refusal: _ } => a.resource_id
+  }
+}
+
+fn provider_controlled_host(host: HostIdentity, route: ProviderRoute, acquisition: ProviderResourceAcquisition, provider_reads: List<AcquiredServerRead>) -> HostControlStanding {
+  match filter(provider_reads, rd => read_is_about(read: rd, resource_id: acquisition.resource_id)).first() {
+    Absent => HostControlRefused { refusal: ProviderControlUnobserved { host: host, resource_id: acquisition.resource_id, cause: "no provider read of this resource was taken" } }
+    Present { value: rd } => match rd {
+      AcquiredServerObserved { acquisition: _, server: s } =>
+        HostControlled { controlled: ControlledHost { host: host, route: ProviderApiControlRoute { route: route, acquisition: acquisition, observed: s } } }
+      AcquiredServerIdUnparsed { acquisition: _ } => HostControlRefused { refusal: ProviderControlUnobserved { host: host, resource_id: acquisition.resource_id, cause: acquired_server_read_line(read: rd) } }
+      AcquiredServerAnsweredForAnother { acquisition: _, observed: _ } => HostControlRefused { refusal: ProviderControlUnobserved { host: host, resource_id: acquisition.resource_id, cause: acquired_server_read_line(read: rd) } }
+      AcquiredServerReadRefused { acquisition: _, refusal: _ } => HostControlRefused { refusal: ProviderControlUnobserved { host: host, resource_id: acquisition.resource_id, cause: acquired_server_read_line(read: rd) } }
+    }
+  }
+}
diff --git a/dag/gunbc/host/host_kernel_boot_selection.dag b/dag/gunbc/host/host_kernel_boot_selection.dag
new file mode 100644
index 00000000000..7cb28fceb76
--- /dev/null
+++ b/dag/gunbc/host/host_kernel_boot_selection.dag
@@ -0,0 +1,24 @@
+module gunbc.host_kernel_boot_selection
+
+import std.types { Bool, String }
+import std.algebra { trim }
+import extdeps.bootloader.grub { grub_first_command_operand }
+
+// srv1's observed Ubuntu GRUB realization uses literal default 0 and the next_entry
+// override. Refuse a different realization or a pending override instead of guessing its
+// boot selection. This changes no boot policy and retains the old kernels for BMC recovery.
+fn kernel_maintenance_grub_selects(config: String, environment: String, target: String) -> Bool {
+  let defaults = filter(map(split(s: config, delimiter: "\n"), line => trim(s: line)), line => starts_with(s: line, prefix: "set default="))
+  let overrides = ["next_entry", "prev_entry", "prev_saved_entry", "initrdfail"]
+  let next_entry_reference = "$\{next_entry}"
+  defaults.count() == 2 && any(defaults, line => line == "set default=\"0\"")
+    && any(defaults, line => line == concat("set default=\"", concat(next_entry_reference, "\"")))
+    && !any(split(s: environment, delimiter: "\n"), line => any(overrides, key =>
+      starts_with(s: line, prefix: concat(key, "=")) && line != concat(key, "=")))
+    && (match grub_first_command_operand(config: config, command: "linux") {
+      Present { value: path } => path == concat("/vmlinuz-", target) Absent => false
+    })
+    && (match grub_first_command_operand(config: config, command: "initrd") {
+      Present { value: path } => path == concat("/initrd.img-", target) Absent => false
+    })
+}
diff --git a/dag/gunbc/host/host_kernel_dependency.dag b/dag/gunbc/host/host_kernel_dependency.dag
new file mode 100644
index 00000000000..49d9576bc99
--- /dev/null
+++ b/dag/gunbc/host/host_kernel_dependency.dag
@@ -0,0 +1,158 @@
+module gunbc.host_kernel_dependency
+
+import std.types { String, NonEmptyStr, Bool, List, CommitSha }
+import std.algebra { trim }
+import std.upsert_decision { Noop, Apply, Refuse, UpsertDecision }
+import gunbc.ensure { ensure_decide, EnsureMayApply, EnsureObserved, EnsureInaccessible, EnsurePlanAvailable, EnsurePlanUnavailable }
+import extdeps.linux.kernel { LinuxKernelRelease }
+import extdeps.linux.tun_fdinfo { TunAttachedQueueRequirement, TunQueueReading, TunQueuesAttached, TunQueuesRefused, TunCensusQueueCountUnsupported, tun_census_refusal_text }
+import extdeps.dpkg { dpkg_record_field, dpkg_query_status_verdict_of, DpkgPackageInstalled, DpkgPackageNotInstalled, DpkgPackageUnknown, DpkgQueryUndecidable }
+import extdeps.shell.exec { ProcessObservation }
+import product.host_identity { HostIdentity }
+import gunbc.fleet_host_identity { operator_host_srv1 }
+
+// A provider selection is host policy, never a requirement authored by VM code. The selected
+// TUN census asks for TunAttachedQueueRequirement. This Ubuntu realization can establish it
+// by installing and booting a kernel, but only the actual queue query establishes satisfaction.
+// No minimum-version comparison: a backport that answers the query needs no mutation.
+type UbuntuTunKernelProvider {
+  package: NonEmptyStr
+  version: NonEmptyStr
+  architecture: NonEmptyStr
+  kernel_release: LinuxKernelRelease
+}
+
+// Measured package candidate and downloaded System.map (tun_get_channels), 2026-10-09.
+// Selection is permission to propose this realization, not authorization to interrupt a host.
+fn tun_kernel_provider_for_host(host: HostIdentity) -> UbuntuTunKernelProvider? {
+  if host == operator_host_srv1 { Present { value: UbuntuTunKernelProvider {
+    package: "linux-generic-hwe-24.04", version: "7.0.0-38.38~24.04.4",
+    architecture: "arm64", kernel_release: "7.0.0-38-generic" as LinuxKernelRelease,
+  } } } else { none }
+}
+
+fn kernel_provider_package_names(provider: UbuntuTunKernelProvider) -> List<NonEmptyStr> {
+  [provider.package, concat("linux-image-", provider.kernel_release as String) as NonEmptyStr,
+    concat("linux-modules-", provider.kernel_release as String) as NonEmptyStr]
+}
+
+fn kernel_provider_selection(provider: UbuntuTunKernelProvider) -> NonEmptyStr {
+  concat(provider.package as String, concat("=", provider.version as String)) as NonEmptyStr
+}
+
+type KernelPackageReading
+  = KernelPackageExact
+  | KernelPackageNeedsInstall
+  | KernelPackageReadRefused { reason: String }
+
+fn kernel_package_reading(package: NonEmptyStr, provider: UbuntuTunKernelProvider, reading: ProcessObservation) -> KernelPackageReading {
+  match dpkg_query_status_verdict_of(exit_code: reading.exit_code, stdout: reading.stdout, stderr: reading.stderr) {
+    DpkgQueryUndecidable { reason } => KernelPackageReadRefused { reason: reason }
+    DpkgPackageUnknown => KernelPackageNeedsInstall
+    DpkgPackageNotInstalled { status } => if starts_with(s: status, prefix: "Status: hold ") {
+      KernelPackageReadRefused { reason: "selected kernel package is held and not installed" }
+    } else { KernelPackageNeedsInstall }
+    DpkgPackageInstalled => {
+      let name = dpkg_record_field(record: reading.stdout, field: "Package")
+      let version = dpkg_record_field(record: reading.stdout, field: "Version")
+      let arch = dpkg_record_field(record: reading.stdout, field: "Architecture")
+      if name != Present { value: package as String } || arch != Present { value: provider.architecture as String }
+        || version == none {
+        KernelPackageReadRefused { reason: "kernel package identity or architecture is unreadable or different" }
+      } else if version == Present { value: provider.version as String } { KernelPackageExact }
+      else { KernelPackageReadRefused { reason: "an installed kernel package differs from the selected version; refuse implicit downgrade or held-package replacement" } }
+    }
+  }
+}
+
+fn kernel_package_readings_join(provider: UbuntuTunKernelProvider, readings: List<KernelPackageReading>) -> KernelPackageReading {
+  if readings.count() != kernel_provider_package_names(provider: provider).count() { KernelPackageReadRefused { reason: "kernel provider package census is incomplete" } }
+  else { fold(readings, init: KernelPackageExact, f: (acc, item) => match acc {
+    KernelPackageReadRefused { reason: _ } => acc
+    other => match item {
+      KernelPackageReadRefused { reason: _ } => item
+      KernelPackageNeedsInstall => KernelPackageNeedsInstall
+      KernelPackageExact => acc
+    }
+  }) }
+}
+
+type HostKernelRemedy
+  = InstallKernelAndActivate
+  | ActivateInstalledKernel
+
+// Intention only. Neither this plan nor its package simulation may mint cell readiness.
+// The apply effect is held at the existing AwaitingCapability boundary until host maintenance
+// authority, drained work and an external reset observer have been established for THIS plan.
+type HostKernelDependencyPlan {
+  host: HostIdentity
+  source_revision: CommitSha
+  requirement: TunAttachedQueueRequirement
+  running_release: LinuxKernelRelease
+  boot_id: NonEmptyStr
+  provider: UbuntuTunKernelProvider
+  remedy: HostKernelRemedy
+  package_simulation: String
+}
+
+type HostKernelDependencyResolution
+  = HostKernelCapabilitySatisfied
+  | HostKernelDependencyPlanned { plan: HostKernelDependencyPlan }
+  | HostKernelDependencyRefused { reason: String }
+
+// An operation's observed support decides whether any provider is demanded. A positive count
+// means the query is supported, NOT that sanitation is clean. The unchanged census still
+// rejects held devices. Only EOPNOTSUPP, established by the ioctl, reaches provider selection.
+fn tun_kernel_capability_decision(requirement: TunAttachedQueueRequirement, reading: TunQueueReading) -> UpsertDecision<TunAttachedQueueRequirement> {
+  match reading {
+    TunQueuesAttached { count: _ } => ensure_decide(policy: EnsureMayApply,
+      observation: EnsureObserved { evidence: reading }, observation_satisfies: true,
+      mismatch_reason: "", plan: EnsurePlanUnavailable { reason: "no remedy is demanded" })
+    TunQueuesRefused { cause: TunCensusQueueCountUnsupported } => ensure_decide(policy: EnsureMayApply,
+      observation: EnsureObserved { evidence: reading }, observation_satisfies: false,
+      mismatch_reason: "running kernel does not support the selected TUN queue query",
+      plan: EnsurePlanAvailable { plan: requirement })
+    TunQueuesRefused { cause } => ensure_decide(policy: EnsureMayApply,
+      observation: EnsureInaccessible { reason: tun_census_refusal_text(cause: cause) }, observation_satisfies: false,
+      mismatch_reason: "", plan: EnsurePlanUnavailable { reason: "unreadable is not absent" })
+  }
+}
+
+fn host_kernel_dependency_plan(host: HostIdentity, revision: CommitSha, requirement: TunAttachedQueueRequirement,
+  running_release: LinuxKernelRelease, boot_id: NonEmptyStr, provider: UbuntuTunKernelProvider,
+  packages: KernelPackageReading, simulation: String) -> HostKernelDependencyResolution {
+  if running_release == provider.kernel_release {
+    HostKernelDependencyRefused { reason: "the selected kernel is already running but the required query is unsupported; refuse a reboot loop" }
+  } else if (packages == KernelPackageNeedsInstall && trim(s: simulation) == "")
+    || (packages == KernelPackageExact && simulation != "") {
+    HostKernelDependencyRefused { reason: "kernel dependency plan lacks the simulation appropriate to its package state" }
+  } else { match packages {
+    KernelPackageReadRefused { reason } => HostKernelDependencyRefused { reason: reason }
+    other => HostKernelDependencyPlanned { plan: HostKernelDependencyPlan {
+      host: host, source_revision: revision, requirement: requirement, running_release: running_release,
+      boot_id: boot_id, provider: provider,
+      remedy: match packages { KernelPackageExact => ActivateInstalledKernel other => InstallKernelAndActivate },
+      package_simulation: simulation,
+    } }
+  } }
+}
+
+fn host_kernel_dependency_action_lines(plan: HostKernelDependencyPlan) -> List<String> {
+  let install = match plan.remedy {
+    InstallKernelAndActivate => [concat("install-package:", kernel_provider_selection(provider: plan.provider) as String)]
+    ActivateInstalledKernel => []
+  }
+  ["requirement:safe-slot-reuse -> TUN descriptor census -> ETHTOOL_GCHANNELS combined_count",
+    concat("required-interface:", plan.requirement.interface as String),
+    concat("observed-running-kernel:", plan.running_release as String),
+    "observed-capability:unsupported (errno EOPNOTSUPP)"] + install + [
+    concat("activate-kernel:", plan.provider.kernel_release as String),
+    "activation-prerequisites: plan-bound host interruption authority; drained runners; operator BMC recovery; external boot observer",
+    "maintenance: gunbc.host_kernel_dependency_apply administrator entries consume this canonical dependency; no job-user grant",
+    "readback: running kernel and new boot identity; KVM; network and services; successful TUN queue query",
+    "continuation: rerun the same commissioning goal; sanitation must still prove zero holders",
+    "standing: dependency remedy planned; VM remains uncommissioned",
+  ]
+}
+
+data host_kernel_maintenance_capability: String = "plan-bound host kernel maintenance: interruption authority, runner drain, console recovery and external boot observation"
diff --git a/dag/gunbc/host/host_kernel_dependency_apply.dag b/dag/gunbc/host/host_kernel_dependency_apply.dag
new file mode 100644
index 00000000000..525b7c3652b
--- /dev/null
+++ b/dag/gunbc/host/host_kernel_dependency_apply.dag
@@ -0,0 +1,209 @@
+module gunbc.host_kernel_dependency_apply
+
+import std.types { String, NonEmptyStr, Bool, List, CommitSha }
+import std.algebra { trim }
+import std.process { ExitSuccess, exit_failure }
+import std.content_hash { content_hash_validate_lower_hex_length }
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.linux.procfs { procfs_status_effective_uid }
+import extdeps.languages.json.parse { parse_json_document, JsonDocumentParsed, JsonDocumentUnreadable }
+import extdeps.systemd.systemctl
+import extdeps.apt
+import extdeps.tools.uname { uname_release_command }
+import gunbc.host_kernel_boot_selection { kernel_maintenance_grub_selects }
+import product.host_identity { HostIdentity }
+import gunbc.cli_wire { CliWireResponse, CliWirePrintable }
+import gunbc.host_effect { LocalShell }
+import gunbc.host_kernel_dependency {
+  HostKernelDependencyPlan, HostKernelDependencyResolution, HostKernelCapabilitySatisfied,
+  HostKernelDependencyPlanned, HostKernelDependencyRefused, InstallKernelAndActivate,
+  ActivateInstalledKernel, kernel_provider_selection,
+}
+import gunbc.host_kernel_dependency_observe { host_tun_kernel_dependency_observe, kernel_read_command }
+import gunbc.host_kernel_dependency_wire { kernel_dependency_field, host_kernel_dependency_from_text, host_kernel_dependency_text }
+import gunbc.runner_slot_allocation { workspace_execution_slot_identities }
+import gunbc.runner_microvm_network_sanitation_observe { slot_network_tun_queue_requirement }
+import gunbc.runner_microvm_slot_unit_identity { microvm_slot_unit_instance_name }
+import gunbc.build_cache_instance { runner_slot_instance_name }
+import gunbc.runner_slot_population_census { census_unit_name_is_slot, unit_is_owned_by_host }
+import gunbc.runner_slot_retirement {
+  observe_slot_cgroup_occupancy, CgroupAbsent, CgroupObservedEmpty,
+  CgroupObservedPopulated, CgroupUnobserved, CgroupOccupancy,
+}
+
+// Operator maintenance consumes the SAME dependency the commissioning planner emitted.
+// These entries are not enrolled in workspace_dispatch_functions or any job-user sudo grant.
+// The administrator invokes them explicitly with the reviewed canonical plan on stdin.
+// Install and activation are separate effects: a peer can retain the plan across reboot and
+// verify the changed boot identity before rerunning commissioning. No VM readiness is written.
+type HostKernelMaintenanceAction = KernelDrain | KernelInstall | KernelActivate | KernelVerify
+
+fn kernel_maintenance_refused(reason: String) -> CliWireResponse {
+  CliWirePrintable { bytes: "", exit: exit_failure(reason: reason) }
+}
+
+fn kernel_maintenance_report(text: String) -> CliWireResponse {
+  CliWirePrintable { bytes: concat(text, "\n"), exit: ExitSuccess }
+}
+
+fn kernel_maintenance_plan_read(text: String) -> HostKernelDependencyPlan? {
+  match parse_json_document(s: text) {
+    JsonDocumentUnreadable { gap: _ } => none
+    JsonDocumentParsed { value: doc } => match kernel_dependency_field(doc: doc, name: "host") {
+      Absent => none
+      Present { value: host } => match kernel_dependency_field(doc: doc, name: "source_revision") {
+        Absent => none
+        Present { value: revision } => {
+          let slots = filter(workspace_execution_slot_identities(), slot => (slot.host as String) == host)
+          if !content_hash_validate_lower_hex_length(text: revision, expected_hex_digits: 40) || slots.count() != 1 { none }
+          else { match slots.first() {
+            Absent => none
+            Present { value: slot } => host_kernel_dependency_from_text(text: text, host: slot.host,
+              revision: revision as CommitSha, requirement: slot_network_tun_queue_requirement(slot: slot))
+          } }
+        }
+      }
+    }
+  }
+}
+
+// An install may advance only package state, not the host, boot, source, requirement or
+// provider. Activation never uses an installation simulation as evidence of installed bytes.
+fn kernel_maintenance_plan_continues(reviewed: HostKernelDependencyPlan, current: HostKernelDependencyPlan,
+  action: HostKernelMaintenanceAction) -> Bool {
+  let same_subject = reviewed.host == current.host && reviewed.source_revision == current.source_revision
+    && reviewed.requirement == current.requirement && reviewed.running_release == current.running_release
+    && reviewed.boot_id == current.boot_id && reviewed.provider == current.provider
+  same_subject && (host_kernel_dependency_text(plan: reviewed) == host_kernel_dependency_text(plan: current)
+    || ((action == KernelInstall || action == KernelActivate) && current.remedy == ActivateInstalledKernel))
+}
+
+// list-units is a census, so malformed/foreign rows refuse the entire reading. All loaded
+// runner instances are included, including historical masked slots; no desired-width guess
+// may omit a still-running service. The mask leaves each ephemeral runner's current job alone.
+fn kernel_maintenance_runner_units(host: HostIdentity, text: String) -> List<NonEmptyStr>? {
+  let lines = filter(split(s: text, delimiter: "\n"), line => trim(s: line) != "")
+  let names = map(lines, line => match filter(split(s: trim(s: line), delimiter: " "), word => word != "").first() {
+    Present { value: name } => name
+    Absent => ""
+  })
+  if names.count() == 0 || !all(names, name => census_unit_name_is_slot(name: name)
+    && unit_is_owned_by_host(host: host, unit: name)
+    && count(filter(names, other => other == name)) == 1) { none }
+  else { Present { value: map(names, name => name as NonEmptyStr) } }
+}
+
+// Explicit lifecycle vocabulary: an unknown state is not quiescence. The kernel's existing
+// cgroup.events observer covers descendants; a service state alone cannot establish drain.
+fn kernel_maintenance_unit_quiet(unit: NonEmptyStr, require_mask: Bool) -> Bool {
+  let state = systemd.Systemctl.ShowProperty(unit: unit, property: "ActiveState")
+  let mask = systemd.Systemctl.ShowProperty(unit: unit, property: "UnitFileState")
+  let job = systemd.Systemctl.ShowProperty(unit: unit, property: "Job")
+  state.success && mask.success && job.success && kernel_maintenance_unit_readback_admits(
+    state: trim(s: state.value), mask: trim(s: mask.value), job: trim(s: job.value), require_mask: require_mask,
+    occupancy: observe_slot_cgroup_occupancy(transport: LocalShell, unit: unit))
+}
+
+fn kernel_maintenance_unit_readback_admits(state: String, mask: String, job: String,
+  require_mask: Bool, occupancy: CgroupOccupancy) -> Bool {
+  job == "" && (state == "inactive" || state == "failed")
+    && (!require_mask || mask == "masked" || mask == "masked-runtime")
+    && (match occupancy {
+      CgroupAbsent => true CgroupObservedEmpty => true
+      CgroupObservedPopulated => false CgroupUnobserved { cause: _ } => false
+    })
+}
+
+fn kernel_maintenance_drain(plan: HostKernelDependencyPlan, units: List<NonEmptyStr>) -> CliWireResponse {
+  let results = map(units, unit => {
+    let before = systemd.Systemctl.ShowProperty(unit: unit, property: "UnitFileState")
+    if !before.success { false }
+    else if trim(s: before.value) == "masked" || trim(s: before.value) == "masked-runtime" { true }
+    else { systemd.Systemctl.MaskRuntime(unit: unit).success }
+  })
+  if !all(results, ok => ok) { kernel_maintenance_refused(reason: "runner inhibition incomplete; read back the runtime masks before retrying; no package or reboot effect ran") }
+  else if all(units, unit => kernel_maintenance_unit_quiet(unit: unit, require_mask: true)) {
+    kernel_maintenance_report(text: "kernel-maintenance: runners drained; runtime masks expire at reboot")
+  } else { kernel_maintenance_refused(reason: "kernel-maintenance: awaiting current runner jobs and their cgroups; replacement inhibited, no jobs stopped") }
+}
+
+fn kernel_maintenance_activate(plan: HostKernelDependencyPlan) -> CliWireResponse {
+  let config = Filesystem.Read(path: "/boot/grub/grub.cfg")
+  let environment = Filesystem.Read(path: "/boot/grub/grubenv")
+  let boot = Filesystem.Read(path: "/proc/sys/kernel/random/boot_id")
+  if !config.success || !environment.success || !boot.success || trim(s: boot.content) != (plan.boot_id as String)
+    || !kernel_maintenance_grub_selects(config: config.content, environment: environment.content, target: plan.provider.kernel_release as String) {
+    kernel_maintenance_refused(reason: "reviewed boot identity or GRUB selection of the exact image/initramfs is not established")
+  } else {
+    let reboot = systemd.Systemctl.Reboot()
+    if reboot.success { kernel_maintenance_report(text: "kernel-maintenance: normal reboot requested; peer must verify a new boot, target kernel and actual queue capability") }
+    else { kernel_maintenance_refused(reason: "reboot acknowledgement unavailable; peer must read boot identity before any retry") }
+  }
+}
+
+fn kernel_maintenance_apply_observed(plan: HostKernelDependencyPlan, current: HostKernelDependencyPlan,
+  action: HostKernelMaintenanceAction) -> CliWireResponse {
+  let census = systemd.Systemctl.ListUnitsAllLoaded(pattern: "actions*runner*.service")
+  if !census.success { kernel_maintenance_refused(reason: "runner population unreadable") }
+  else { match kernel_maintenance_runner_units(host: plan.host, text: census.stdout) {
+    Absent => kernel_maintenance_refused(reason: "runner population is empty, malformed or includes a foreign unit")
+    Present { value: units } => if (action == KernelDrain) { kernel_maintenance_drain(plan: plan, units: units) }
+    else if !all(units, unit => kernel_maintenance_unit_quiet(unit: unit, require_mask: true)) {
+      kernel_maintenance_refused(reason: "kernel maintenance requires every runner inhibited and drained, including its cgroup")
+    } else {
+      let slots = filter(workspace_execution_slot_identities(), slot => slot.host == plan.host)
+      let quiet = all(slots, slot => kernel_maintenance_unit_quiet(
+        unit: microvm_slot_unit_instance_name(slot_instance: runner_slot_instance_name(slot: slot) as String), require_mask: false))
+      if !quiet { kernel_maintenance_refused(reason: "workspace controller is active or its workload is unreadable") }
+      else if (action == KernelInstall) { match current.remedy {
+        ActivateInstalledKernel => kernel_maintenance_report(text: "kernel-maintenance: exact kernel and boot artifacts already installed; activation pending")
+        InstallKernelAndActivate => {
+          let installed = apt.PackageManager.InstallExactNonRemoving(selection: kernel_provider_selection(provider: plan.provider))
+          if !installed.success { kernel_maintenance_refused(reason: concat("kernel package installation did not complete; re-observe before retry: ", installed.stderr)) }
+          else { match host_tun_kernel_dependency_observe(host: plan.host, revision: plan.source_revision, requirement: plan.requirement) {
+            HostKernelDependencyPlanned { plan: after } => if after.remedy == ActivateInstalledKernel
+              && kernel_maintenance_plan_continues(reviewed: plan, current: after, action: KernelInstall) {
+              kernel_maintenance_report(text: "kernel-maintenance: exact installed packages, boot image, initramfs and TUN implementation read back; activation pending")
+            } else { kernel_maintenance_refused(reason: "package command succeeded but installed kernel readback did not establish the reviewed target") }
+            HostKernelDependencyRefused { reason } => kernel_maintenance_refused(reason: reason)
+            HostKernelCapabilitySatisfied => kernel_maintenance_refused(reason: "running capability changed during installation; fresh observation required")
+          } }
+        }
+      } } else if action == KernelActivate && (current.remedy == ActivateInstalledKernel) {
+        kernel_maintenance_activate(plan: plan)
+      } else { kernel_maintenance_refused(reason: "activation requires installed kernel readback; verification requires a new capable boot") }
+    }
+  } }
+}
+
+fn kernel_maintenance_cli(action: HostKernelMaintenanceAction) -> CliWireResponse {
+  let self = Filesystem.Read(path: "/proc/self/status")
+  let root = self.success && (match procfs_status_effective_uid(content: self.content) { Present { value: uid } => uid == 0 Absent => false })
+  let input = Filesystem.Read(path: "/dev/stdin")
+  if !root || !input.success { kernel_maintenance_refused(reason: "kernel maintenance requires an explicit administrator invocation and reviewed plan on stdin") }
+  else { match kernel_maintenance_plan_read(text: trim(s: input.content)) {
+    Absent => kernel_maintenance_refused(reason: "kernel maintenance input is not the canonical dependency for an enrolled workspace host")
+    Present { value: plan } => match host_tun_kernel_dependency_observe(host: plan.host,
+      revision: plan.source_revision, requirement: plan.requirement) {
+      HostKernelDependencyRefused { reason } => kernel_maintenance_refused(reason: reason)
+      HostKernelCapabilitySatisfied => {
+        let boot = Filesystem.Read(path: "/proc/sys/kernel/random/boot_id")
+        let running = kernel_read_command(command: uname_release_command())
+        let target = match running { Present { value: running_kernel } => running_kernel == (plan.provider.kernel_release as String) Absent => false }
+        if (action != KernelVerify) { kernel_maintenance_report(text: "kernel-maintenance: required capability already satisfied; no mutation") }
+        else if boot.success && trim(s: boot.content) != "" && trim(s: boot.content) != (plan.boot_id as String) && target {
+          kernel_maintenance_report(text: "kernel-maintenance: new boot, target release and TUN queue capability verified; rerun commissioning for full sanitation and readiness")
+        } else { kernel_maintenance_refused(reason: "capability is supported but activation of the reviewed kernel in a new boot is not established") }
+      }
+      HostKernelDependencyPlanned { plan: current } => if !kernel_maintenance_plan_continues(reviewed: plan, current: current, action: action) {
+        kernel_maintenance_refused(reason: "reviewed kernel plan drifted; refuse installation or reboot against a different boot or package proposal")
+      } else if (action == KernelVerify) { kernel_maintenance_refused(reason: "host still lacks the required queue capability") }
+      else { kernel_maintenance_apply_observed(plan: plan, current: current, action: action) }
+    }
+  } }
+}
+
+fn host_kernel_dependency_drain_cli() -> CliWireResponse { kernel_maintenance_cli(action: KernelDrain) }
+fn host_kernel_dependency_install_cli() -> CliWireResponse { kernel_maintenance_cli(action: KernelInstall) }
+fn host_kernel_dependency_activate_cli() -> CliWireResponse { kernel_maintenance_cli(action: KernelActivate) }
+fn host_kernel_dependency_verify_cli() -> CliWireResponse { kernel_maintenance_cli(action: KernelVerify) }
diff --git a/dag/gunbc/host/host_kernel_dependency_observe.dag b/dag/gunbc/host/host_kernel_dependency_observe.dag
new file mode 100644
index 00000000000..48a7fadd0d2
--- /dev/null
+++ b/dag/gunbc/host/host_kernel_dependency_observe.dag
@@ -0,0 +1,125 @@
+module gunbc.host_kernel_dependency_observe
+
+import std.types { String, NonEmptyStr, CommitSha, Bool }
+import std.algebra { trim }
+import std.upsert_decision { Noop, Apply, Refuse }
+import extdeps.linux.kernel { LinuxKernelRelease }
+import extdeps.linux.tun_fdinfo { TunAttachedQueueRequirement, tun_attached_queue_requirement_observe }
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.tools.hostname { hostname_short_read_command }
+import extdeps.tools.uname { uname_release_command, uname_machine_command }
+import extdeps.dpkg { dpkg_query_status_command, dpkg_record_field }
+import extdeps.apt
+import extdeps.exec.command { ArgvCommand, LocalExec }
+import extdeps.shell.exec { ProcessRan, ProcessNotSpawned }
+import gunbc.command_runner { run_shell_command_observe_outcome }
+import product.host_identity { HostIdentity }
+import gunbc.host_kernel_dependency {
+  UbuntuTunKernelProvider, tun_kernel_provider_for_host, kernel_provider_package_names, kernel_provider_selection,
+  KernelPackageReading, KernelPackageExact, KernelPackageNeedsInstall, KernelPackageReadRefused,
+  kernel_package_reading, kernel_package_readings_join, tun_kernel_capability_decision, host_kernel_dependency_plan,
+  HostKernelDependencyResolution, HostKernelCapabilitySatisfied, HostKernelDependencyPlanned, HostKernelDependencyRefused,
+}
+
+fn kernel_read_command(command: ArgvCommand) -> String? {
+  match run_shell_command_observe_outcome(command: command, transport: LocalExec) {
+    ProcessRan { observation } => if observation.exit_code == 0 && trim(s: observation.stdout) != "" {
+      Present { value: trim(s: observation.stdout) }
+    } else { none }
+    ProcessNotSpawned { program: _, cause: _ } => none
+  }
+}
+
+fn kernel_provider_package_observe(package: NonEmptyStr, provider: UbuntuTunKernelProvider) -> KernelPackageReading {
+  match run_shell_command_observe_outcome(command: dpkg_query_status_command(package: package), transport: LocalExec) {
+    ProcessRan { observation } => kernel_package_reading(package: package, provider: provider, reading: observation)
+    ProcessNotSpawned { program: _, cause } => KernelPackageReadRefused { reason: cause as String }
+  }
+}
+
+fn kernel_provider_platform_admits(os_release: String, machine: String, provider: UbuntuTunKernelProvider) -> Bool {
+  let lines = split(s: os_release, delimiter: "\n")
+  filter(lines, line => starts_with(s: line, prefix: "ID=")).count() == 1
+    && filter(lines, line => starts_with(s: line, prefix: "VERSION_ID=")).count() == 1
+    && any(lines, line => line == "ID=ubuntu" || line == "ID=\"ubuntu\"")
+    && any(lines, line => line == "VERSION_ID=24.04" || line == "VERSION_ID=\"24.04\"")
+    && machine == "aarch64" && provider.architecture == "arm64"
+}
+
+fn kernel_provider_candidate_admits(provider: UbuntuTunKernelProvider, record: String) -> Bool {
+  dpkg_record_field(record: record, field: "Package") == Present { value: provider.package as String }
+    && dpkg_record_field(record: record, field: "Version") == Present { value: provider.version as String }
+    && dpkg_record_field(record: record, field: "Architecture") == Present { value: provider.architecture as String }
+}
+
+// The ordinary capability dependency is evaluated before provider lookup or any package read.
+// This makes an already-capable host a no-op even when it uses a different package or a backport.
+fn host_tun_kernel_dependency_observe(host: HostIdentity, revision: CommitSha,
+  requirement: TunAttachedQueueRequirement) -> HostKernelDependencyResolution {
+  if kernel_read_command(command: hostname_short_read_command()) != Present { value: host as String } {
+    HostKernelDependencyRefused { reason: "kernel dependency must be observed on its bound host" }
+  } else { match tun_kernel_capability_decision(requirement: requirement, reading: tun_attached_queue_requirement_observe(requirement: requirement)) {
+    Noop => HostKernelCapabilitySatisfied
+    Refuse { reason } => HostKernelDependencyRefused { reason: reason as String }
+    Apply { plan: demanded } => match tun_kernel_provider_for_host(host: host) {
+      Absent => HostKernelDependencyRefused { reason: "the selected TUN census requires kernel channel support but this host has no admitted provider" }
+      Present { value: provider } => host_tun_kernel_provider_observe(host: host, revision: revision,
+        requirement: demanded, provider: provider)
+    }
+  } }
+}
+
+fn host_tun_kernel_provider_observe(host: HostIdentity, revision: CommitSha,
+  requirement: TunAttachedQueueRequirement, provider: UbuntuTunKernelProvider) -> HostKernelDependencyResolution {
+  let os = Filesystem.Read(path: "/etc/os-release")
+  let boot = Filesystem.Read(path: "/proc/sys/kernel/random/boot_id")
+  let machine = kernel_read_command(command: uname_machine_command())
+  let running = kernel_read_command(command: uname_release_command())
+  if !os.success || !boot.success || trim(s: boot.content) == "" || machine == none || running == none {
+    HostKernelDependencyRefused { reason: "kernel provider platform or running boot identity is unreadable" }
+  } else { match machine {
+    Absent => HostKernelDependencyRefused { reason: "kernel provider machine architecture is unreadable" }
+    Present { value: arch } => if !kernel_provider_platform_admits(os_release: os.content, machine: arch, provider: provider) {
+      HostKernelDependencyRefused { reason: "kernel provider is not admitted for the observed distribution and architecture" }
+    } else { match running {
+      Absent => HostKernelDependencyRefused { reason: "running kernel release is unreadable" }
+      Present { value: kernel } => {
+        let packages = kernel_package_readings_join(provider: provider,
+          readings: map(kernel_provider_package_names(provider: provider), name => kernel_provider_package_observe(package: name, provider: provider)))
+        let decision = match packages {
+          KernelPackageReadRefused { reason } => HostKernelDependencyRefused { reason: reason }
+          KernelPackageNeedsInstall => {
+            let candidate = apt.PackageManager.ShowExact(selection: kernel_provider_selection(provider: provider))
+            if !candidate.success || !kernel_provider_candidate_admits(provider: provider, record: candidate.stdout) {
+              HostKernelDependencyRefused { reason: "the approved kernel package version is unavailable or has different metadata" }
+            } else {
+              let simulation = apt.PackageManager.SimulateInstall(selection: kernel_provider_selection(provider: provider))
+              if !simulation.success || trim(s: simulation.stdout) == "" {
+                HostKernelDependencyRefused { reason: "the selected kernel package has no successful non-removing installation plan" }
+              } else { host_kernel_dependency_plan(host: host, revision: revision, requirement: requirement,
+                running_release: kernel as LinuxKernelRelease, boot_id: trim(s: boot.content) as NonEmptyStr,
+                provider: provider, packages: packages, simulation: simulation.stdout) }
+            }
+          }
+          KernelPackageExact => {
+            let entries = Filesystem.List(path: "/boot")
+            let symbols = Filesystem.Read(path: concat("/boot/System.map-", provider.kernel_release as String))
+            let names = split(s: entries.entries, delimiter: "\n")
+            if !entries.success || !symbols.success
+              || !any(names, name => name == concat("vmlinuz-", provider.kernel_release as String))
+              || !any(names, name => name == concat("initrd.img-", provider.kernel_release as String))
+              || !any(split(s: symbols.content, delimiter: "\n"), line => line.ends_with(suffix: " tun_get_channels")) {
+              HostKernelDependencyRefused { reason: "installed kernel package lacks a verified boot image, initramfs or TUN channel implementation" }
+            } else { host_kernel_dependency_plan(host: host, revision: revision, requirement: requirement,
+              running_release: kernel as LinuxKernelRelease, boot_id: trim(s: boot.content) as NonEmptyStr,
+              provider: provider, packages: packages, simulation: "") }
+          }
+        }
+        let after = Filesystem.Read(path: "/proc/sys/kernel/random/boot_id")
+        if !after.success || after.content != boot.content {
+          HostKernelDependencyRefused { reason: "host boot changed while observing the kernel dependency" }
+        } else { decision }
+      }
+    } }
+  } }
+}
diff --git a/dag/gunbc/host/host_kernel_dependency_wire.dag b/dag/gunbc/host/host_kernel_dependency_wire.dag
new file mode 100644
index 00000000000..4f3ca8e3808
--- /dev/null
+++ b/dag/gunbc/host/host_kernel_dependency_wire.dag
@@ -0,0 +1,81 @@
+module gunbc.host_kernel_dependency_wire
+
+import std.types { String, NonEmptyStr, CommitSha, Bool }
+import extdeps.languages.json.emit { JsonValue, json_object, json_kv, json_string, serialize_json }
+import extdeps.languages.json.parse { parse_json_document, JsonDocumentParsed, JsonDocumentUnreadable, json_field_string, FieldRead, FieldAbsent, FieldMalformed }
+import extdeps.linux.kernel { LinuxKernelRelease }
+import extdeps.linux.tun_fdinfo { TunAttachedQueueRequirement }
+import product.host_identity { HostIdentity }
+import gunbc.host_kernel_dependency { HostKernelDependencyPlan, InstallKernelAndActivate, ActivateInstalledKernel, tun_kernel_provider_for_host, kernel_provider_selection }
+
+data host_kernel_dependency_row_prefix: String = "commissioning-kernel-dependency:"
+
+fn host_kernel_dependency_text(plan: HostKernelDependencyPlan) -> String {
+  serialize_json(v: json_object(members: [
+    json_kv(key: "schema", value: json_string(s: "host-kernel-dependency/v1")),
+    json_kv(key: "host", value: json_string(s: plan.host as String)),
+    json_kv(key: "source_revision", value: json_string(s: plan.source_revision as String)),
+    json_kv(key: "operation", value: json_string(s: "linux.tun.ETHTOOL_GCHANNELS")),
+    json_kv(key: "interface", value: json_string(s: plan.requirement.interface as String)),
+    json_kv(key: "running_release", value: json_string(s: plan.running_release as String)),
+    json_kv(key: "boot_id", value: json_string(s: plan.boot_id as String)),
+    json_kv(key: "package", value: json_string(s: kernel_provider_selection(provider: plan.provider) as String)),
+    json_kv(key: "architecture", value: json_string(s: plan.provider.architecture as String)),
+    json_kv(key: "target_release", value: json_string(s: plan.provider.kernel_release as String)),
+    json_kv(key: "remedy", value: json_string(s: match plan.remedy { InstallKernelAndActivate => "install-and-activate" ActivateInstalledKernel => "activate-installed" })),
+    json_kv(key: "package_simulation", value: json_string(s: plan.package_simulation)),
+  ]))
+}
+
+fn host_kernel_dependency_row(plan: HostKernelDependencyPlan) -> String {
+  concat(host_kernel_dependency_row_prefix, host_kernel_dependency_text(plan: plan))
+}
+
+fn kernel_dependency_field(doc: JsonValue, name: String) -> String? {
+  match json_field_string(obj: doc, key: name) {
+    FieldRead { value } => Present { value: value }
+    FieldAbsent => none
+    FieldMalformed { cause: _ } => none
+  }
+}
+
+// Only the privileged observer's captured response uses this decoder. Reconstruct the policy
+// selection from the host, then require canonical equality: fields cannot select another package,
+// requirement, host or source revision. A plan is still intention, never an authorization token.
+fn host_kernel_dependency_from_text(text: String, host: HostIdentity, revision: CommitSha,
+  requirement: TunAttachedQueueRequirement) -> HostKernelDependencyPlan? {
+  match parse_json_document(s: text) {
+    JsonDocumentUnreadable { gap: _ } => none
+    JsonDocumentParsed { value: doc } => match tun_kernel_provider_for_host(host: host) {
+      Absent => none
+      Present { value: provider } => match kernel_dependency_field(doc: doc, name: "running_release") {
+        Absent => none
+        Present { value: running } => match kernel_dependency_field(doc: doc, name: "boot_id") {
+          Absent => none
+          Present { value: boot } => match kernel_dependency_field(doc: doc, name: "remedy") {
+            Absent => none
+            Present { value: remedy } => match kernel_dependency_field(doc: doc, name: "package_simulation") {
+              Absent => none
+              Present { value: simulation } => if running == "" || boot == "" || running == (provider.kernel_release as String)
+                || (remedy != "install-and-activate" && remedy != "activate-installed")
+                || (remedy == "install-and-activate" && simulation == "")
+                || (remedy == "activate-installed" && simulation != "") { none }
+              else {
+                let plan = HostKernelDependencyPlan { host: host, source_revision: revision,
+                  requirement: requirement, running_release: running as LinuxKernelRelease, boot_id: boot as NonEmptyStr,
+                  provider: provider, remedy: if remedy == "install-and-activate" { InstallKernelAndActivate } else { ActivateInstalledKernel },
+                  package_simulation: simulation }
+                if host_kernel_dependency_text(plan: plan) == text { Present { value: plan } } else { none }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+// This marker can only stop apply; it never admits an action or decodes a readiness permit.
+fn host_kernel_dependency_in_plan_body(body: String) -> Bool {
+  any(split(s: body, delimiter: "\n"), row => starts_with(s: row, prefix: host_kernel_dependency_row_prefix))
+}
diff --git a/dag/gunbc/host/host_layout.dag b/dag/gunbc/host/host_layout.dag
index dcf2c3f5d64..2382978302e 100644
--- a/dag/gunbc/host/host_layout.dag
+++ b/dag/gunbc/host/host_layout.dag
@@ -317,6 +317,55 @@ fn instance_receipts_dir(instance_root: String) -> String {
   join([instance_root, "/receipts"], "")
 }
 
+// THE ATTEMPT-EXIT SPOOL, homed here for the publication spool's reason: it has consumers on both
+// sides of a process boundary that share no code path. The worker unit's stop hook
+// (gunbc.roadmap_dispatch_actuator) creates an entry, the deployment's path unit
+// (gunbc.live_deploy.emit) watches for one, and the belt's obligation edge moves it on. One string,
+// three consumers.
+//
+// AN ENTRY IS A DIRECTORY WHOSE NAME IS THE RECORD (gunbc.roadmap.roadmap_attempt_exit_spool).
+// Three siblings, never nested, because the path unit fires on DirectoryNotEmpty of ONE of them: a
+// subdirectory inside the watched directory would keep it non-empty forever. `inbox` holds exits
+// not yet handed to an obligation; `queued` holds exits whose obligation has been started and has
+// not yet written its receipt; `done` holds exits whose capture receipt exists; `refused` holds exits
+// the drain could not hand off (attempt_exit_refused_dir). Moving an entry out
+// of `inbox` when its obligation STARTS is what lets the path unit go quiet while that obligation
+// runs, rather than re-firing until systemd's trigger limit fails the unit.
+//
+// Derived from the instance root, for instance_receipts_dir's reason: two instances on one host must
+// not read each other's exits.
+fn attempt_exit_spool_root(instance_root: String) -> String {
+  join([instance_root, "/attempt-exit-spool"], "")
+}
+
+fn attempt_exit_inbox_dir(instance_root: String) -> String {
+  join([attempt_exit_spool_root(instance_root: instance_root), "/inbox"], "")
+}
+
+fn attempt_exit_queued_dir(instance_root: String) -> String {
+  join([attempt_exit_spool_root(instance_root: instance_root), "/queued"], "")
+}
+
+// `running` holds the entries a live obligation run has CLAIMED (queued -> running is the claim, taken
+// before the run's first observation) and that its receipt has not yet settled to `done`. Keeping a claim
+// out of `queued` is what lets the path unit watch `queued` as a LEVEL -- non-empty means an exit no run
+// has claimed -- without re-firing for the whole length of a long run.
+fn attempt_exit_running_dir(instance_root: String) -> String {
+  join([attempt_exit_spool_root(instance_root: instance_root), "/running"], "")
+}
+
+fn attempt_exit_done_dir(instance_root: String) -> String {
+  join([attempt_exit_spool_root(instance_root: instance_root), "/done"], "")
+}
+
+// `refused` holds an entry the drain could not hand to an obligation -- a name that is not a record,
+// or a record whose obligation unit the manager would not start -- moved out of the inbox so the path
+// unit does not re-fire on it forever, and kept, because a refused hand-off is still an exit that
+// happened and the observer still reads it.
+fn attempt_exit_refused_dir(instance_root: String) -> String {
+  join([attempt_exit_spool_root(instance_root: instance_root), "/refused"], "")
+}
+
 // THE PUBLICATION SPOOL, HOMED HERE FOR THE REASON THE TWO ROWS ABOVE ARE: it has two consumers on
 // opposite sides of a PRIVILEGE boundary, so neither may own the name. gunbc.roadmap_belt_actuate
 // writes a request into it as the service principal; the publication helper reads that request and
@@ -373,7 +422,7 @@ fn publication_refused_dir(instance_root: String) -> String {
 // EACCES was a root-owned STALE FILE from the pre-b1 unit user, not the directory.
 // Publication authority is atomic rename in gunbc.fleet_converge_cli — NOT live_deploy
 // install-d on this path and NOT per-run elevation.
-data fleet_converge_receipt_atomic_publish_note: String = "Receipt publication is gunbc.fleet_converge_cli converge_cli_atomic_receipt_write: Filesystem.Write to a same-directory *.staging file, then shell.Move.File over the final path. rename(2) takes permission from the containing directory, not the file being replaced, so a root-owned stale receipt is superseded without elevation when the service principal owns the directory. In-place Filesystem.Write on the target path fails EACCES on stale root-owned files and is crash-unsafe (truncated receipts). Deploy install-d ensures the directory exists and is owned by the service principal on fresh hosts; that bootstrap is orthogonal to publication. CORRECTED 2026-08-19: this clause named live_deploy emit FleetConvergeTimerUnit apply as the bootstrap's home, and that member is now a retired refusal poison (cadence moved to on-demand plan/apply, sleek-heron-218), so NOTHING had bootstrapped a receipts directory on any fresh instance root since that retirement — srv1's green slot has no receipts directory at all, and production's exists only because it predates it. The bootstrap now rides live_deploy emit BeltTimerUnit apply, on the consumer that needs the directory wherever it is installed — per-run sudo install on individual receipt files is not the publication fix when the directory is already service-user-owned."
+data fleet_converge_receipt_atomic_publish_note: String = "Receipt publication is gunbc.fleet_converge_cli converge_cli_atomic_receipt_write: Filesystem.Write to a same-directory *.staging file, then shell.Move.File over the final path. rename(2) takes permission from the containing directory, not the file being replaced, so a root-owned stale receipt is superseded without elevation when the service principal owns the directory. In-place Filesystem.Write on the target path fails EACCES on stale root-owned files and is crash-unsafe (truncated receipts). Deploy install-d ensures the directory exists and is owned by the service principal on fresh hosts; that bootstrap is orthogonal to publication. CORRECTED 2026-08-19: this clause named live_deploy emit FleetConvergeTimerUnit apply as the bootstrap's home, and that member is now a retired refusal poison (cadence moved to on-demand plan/apply, sleek-heron-218), so NOTHING had bootstrapped a receipts directory on any fresh instance root since that retirement — srv1's green slot has no receipts directory at all, and production's exists only because it predates it. The bootstrap now rides live_deploy emit BeltEventPathUnit apply, on the consumer that needs the directory wherever it is installed — per-run sudo install on individual receipt files is not the publication fix when the directory is already service-user-owned."
 
 // ONE host-parameterized placement for provider package/exec release trees, mutable provider state,
 // and private wire-evidence roots. Parallel to GunbcHostLayout: a second host must be describable
diff --git a/dag/gunbc/host/host_memory_qualification.dag b/dag/gunbc/host/host_memory_qualification.dag
index 84d4f1efddb..b43f0d9fda3 100644
--- a/dag/gunbc/host/host_memory_qualification.dag
+++ b/dag/gunbc/host/host_memory_qualification.dag
@@ -1,10 +1,11 @@
 module gunbc.host_memory_qualification
 
+import extdeps.board_authority { BoardAuthorityRef }
 import std.types { Bool, EpochMs, List, NonEmptyStr }
 import std.nat { Nat }
 import std.measure { ByteSize }
-import extdeps.boards.types { AsrockRackAltrad8ud1l2t, BaseboardModel, DimmPopulation }
-import extdeps.boards.asrock_rack { asrock_altrad8ud_download_authority }
+import extdeps.boards.types { DimmPopulation }
+import extdeps.boards.asrock_rack { asrock_altrad8ud_download_authority, asrock_altrad8ud_board_authority }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.cpu.ampere { ampere_altra_avl_authority, ampere_altra_avl_current_issue }
 import product.host_identity { HostIdentity }
@@ -192,7 +193,7 @@ type TrainingEvidenceStanding
 // only in a sparse population is weaker support for rejecting a part in a
 // full population, so the observation carries its own conditions.
 type PlatformTrainingFailure {
-  board: BaseboardModel
+  board: BoardAuthorityRef
   step: MemoryTrainingStep
   standing: TrainingEvidenceStanding
   observed_population: List<NonEmptyStr>
@@ -245,7 +246,7 @@ fn implication_severity(
 fn implication_for_step(
   candidate: DramModuleCatalogRow,
   failure: PlatformTrainingFailure,
-  target_board: BaseboardModel,
+  target_board: BoardAuthorityRef,
 ) -> PartImplication {
   if failure.board != target_board {
     PartNotImplicated
@@ -259,7 +260,7 @@ fn implication_for_step(
 fn part_implication(
   candidate: DramModuleCatalogRow,
   failures: List<PlatformTrainingFailure>,
-  target_board: BaseboardModel,
+  target_board: BoardAuthorityRef,
 ) -> PartImplication {
   fold(
     failures,
@@ -320,7 +321,7 @@ fn topology_pressure(
 }
 
 data altrad8ud_mrep_failure_observation: PlatformTrainingFailure = PlatformTrainingFailure {
-  board: AsrockRackAltrad8ud1l2t,
+  board: asrock_altrad8ud_board_authority,
   step: LrdimmDataBufferMrep,
   standing: AssociatedByIdenticalSignature {
     signature: "SK[0]: 00120001 / MC[0]: 00f100b4",
@@ -477,4 +478,4 @@ data srv2_failed_64gib_population_standing: HostMemoryStanding = HostMemoryStand
 // guessed. Watch for recurrence at the same coordinates. A second event there is a device-level
 // finding; scattered single events across different addresses are not.
 
-data platform_training_implication_note: String = "RELOCATED 2026-08-19 from the deleted gunbc.memory_part_selection, whose candidate/frontier half was a selection island; this evidence half is qualification, so it lives beside the four standings it grades. The grading rule is mechanical and derived: a candidate is graded by whether it must execute a training step THIS platform has been observed to fail, and by how strongly that failure is evidenced. For the ALTRAD8UD-1L2T the step is the DDR4 data-buffer read-phase calibration (MREP), which only load-reduced modules execute, so the grading is independent of vendor, part number, capacity, speed grade, and presence on any approved-vendor list. THE SEVERITY IS A FUNCTION OF EVIDENCE, and an earlier revision of this module got that wrong in a way worth recording: it refused every module executing the failing step, on any board, at any standing including EvidenceUnobserved. Because capacities near a generation's die-density ceiling are disproportionately load-reduced, that blanket rule removed most of the 64GB DDR4 market by construction — the exact blocklist this module's prose claimed to avoid, reached by a different route, and the opposite of letting a buyer shop the whole market. Now: a decode of this platform's own syndrome register refuses; an association carrying byte-identical controller status words, or an inference from sequence position, requires a SAMPLE before committing to a full population and stays on the Pareto frontier; an unobserved standing implicates nothing. gunbc holds MREP at AssociatedByIdenticalSignature, so the honest verdict for another ALTRAD8UD LRDIMM today is buy-one-and-test, not reject. Failures are scoped to the board they were observed on, so an ALTRAD8UD receipt cannot speak for a different platform. KNOWN GAP, stated rather than papered over: BaseboardModel currently has exactly one variant, so the board scoping is real in the code but has no executing cross-board control — minting a second board purely to test it would be a fabricated entity, and the control lands when a second real board is modeled. The second axis, topology pressure, is derived rather than observed: when a capacity cannot be reached as a dual-rank registered module within the generation's monolithic die-density ceiling, that capacity forces extra ranks or stacking, which is why 64GB DDR4 at older speed grades is disproportionately load-reduced while 32GB is not. A buyer economizing on speed grade at 64GB is therefore not buying the same module more slowly, it is a different topology — which is a reason to sample it, not a reason to refuse it."
+data platform_training_implication_note: String = "RELOCATED 2026-08-19 from the deleted gunbc.memory_part_selection, whose candidate/frontier half was a selection island; this evidence half is qualification, so it lives beside the four standings it grades. The grading rule is mechanical and derived: a candidate is graded by whether it must execute a training step THIS platform has been observed to fail, and by how strongly that failure is evidenced. For the ALTRAD8UD-1L2T the step is the DDR4 data-buffer read-phase calibration (MREP), which only load-reduced modules execute, so the grading is independent of vendor, part number, capacity, speed grade, and presence on any approved-vendor list. THE SEVERITY IS A FUNCTION OF EVIDENCE, and an earlier revision of this module got that wrong in a way worth recording: it refused every module executing the failing step, on any board, at any standing including EvidenceUnobserved. Because capacities near a generation's die-density ceiling are disproportionately load-reduced, that blanket rule removed most of the 64GB DDR4 market by construction — the exact blocklist this module's prose claimed to avoid, reached by a different route, and the opposite of letting a buyer shop the whole market. Now: a decode of this platform's own syndrome register refuses; an association carrying byte-identical controller status words, or an inference from sequence position, requires a SAMPLE before committing to a full population and stays on the Pareto frontier; an unobserved standing implicates nothing. gunbc holds MREP at AssociatedByIdenticalSignature, so the honest verdict for another ALTRAD8UD LRDIMM today is buy-one-and-test, not reject. Failures are scoped to the board they were observed on, so an ALTRAD8UD receipt cannot speak for a different platform. KNOWN GAP, stated rather than papered over: BoardAuthorityRef currently has exactly one variant, so the board scoping is real in the code but has no executing cross-board control — minting a second board purely to test it would be a fabricated entity, and the control lands when a second real board is modeled. The second axis, topology pressure, is derived rather than observed: when a capacity cannot be reached as a dual-rank registered module within the generation's monolithic die-density ceiling, that capacity forces extra ranks or stacking, which is why 64GB DDR4 at older speed grades is disproportionately load-reduced while 32GB is not. A buyer economizing on speed grade at 64GB is therefore not buying the same module more slowly, it is a different topology — which is a reason to sample it, not a reason to refuse it."
diff --git a/dag/gunbc/host/host_phase_status.dag b/dag/gunbc/host/host_phase_status.dag
index 8397263e9f9..48586abd43d 100644
--- a/dag/gunbc/host/host_phase_status.dag
+++ b/dag/gunbc/host/host_phase_status.dag
@@ -11,13 +11,8 @@ import gunbc.host_standup {
   DeclaredGap,
   host_standup_spine,
 }
-import gunbc.host_assimilation_program {
-  FleetParticipation,
-  HostEnrollmentIntent,
-  assimilation_program_for,
-  ci_runner_enrollment_participation,
-  inference_serving_enrollment_participation,
-}
+import gunbc.host_assimilation_program { assimilation_program_for }
+import gunbc.fleet_enrollment { FleetParticipation, HostEnrollmentIntent, fleet_enrollments }
 import gunbc.host_standup_assimilation_deduction { srv3_post_install_actuation_verdict }
 import gunbc.host_reach_identity_probe {
   observe_host_identity_converge,
@@ -35,7 +30,7 @@ import gunbc.membership_reconcile {
   membership_write_count,
 }
 import gunbc.ownership { Ownership, Owned }
-import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4, operator_host_srv5, operator_host_srv6 }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 import product.host_identity { HostIdentity }
 import std.measure { millisecond }
 
@@ -256,21 +251,6 @@ fn host_fleet_phase_matrix(enrollments: List<HostEnrollmentIntent>) -> List<Host
   flat_map(enrollments, e => host_phase_cells_for_enrollment(intent: e))
 }
 
-// The enrolled fleet, read from gunbc.fleet_intent_network's host rows rather than re-listed here —
-// the matrix must never be able to disagree with the intent about WHICH hosts exist. This is also
-// the enrollment prerequisite the srv4 OOM incident priced (fleet_subsumption_manual_gaps section
-// C): a host takes no fleet work until it is an intent row, so a host absent from this list has no
-// cells at all, and one that appears gains a full column of UnknownRefused cells — the work
-// becoming visible the moment the host is enrolled, which is the behaviour the incident wanted.
-
-data fleet_subsumption_enrollments: List<HostEnrollmentIntent> = [
-  HostEnrollmentIntent { host: operator_host_srv1, participation: ci_runner_enrollment_participation },
-  HostEnrollmentIntent { host: operator_host_srv2, participation: ci_runner_enrollment_participation },
-  HostEnrollmentIntent { host: operator_host_srv3, participation: ci_runner_enrollment_participation },
-  HostEnrollmentIntent { host: operator_host_srv4, participation: ci_runner_enrollment_participation },
-  HostEnrollmentIntent { host: operator_host_srv5, participation: inference_serving_enrollment_participation },
-  HostEnrollmentIntent { host: operator_host_srv6, participation: inference_serving_enrollment_participation },
-]
 
 // The bare host list is DERIVED from the enrollments, never authored beside them. Consumers that
 // legitimately care only about WHICH hosts exist -- toolchain components, network diagnosis, swap
@@ -279,7 +259,7 @@ data fleet_subsumption_enrollments: List<HostEnrollmentIntent> = [
 // Authoring both lists would rebuild the parallel representation this refactor removes.
 
 data fleet_subsumption_hosts: List<HostIdentity> = map(
-  fleet_subsumption_enrollments,
+  fleet_enrollments,
   e => e.host,
 )
 
diff --git a/dag/gunbc/host/host_reach_identity_probe.dag b/dag/gunbc/host/host_reach_identity_probe.dag
index 0e5ed3f69ec..fd70f2fd8aa 100644
--- a/dag/gunbc/host/host_reach_identity_probe.dag
+++ b/dag/gunbc/host/host_reach_identity_probe.dag
@@ -1,6 +1,8 @@
 module gunbc.host_reach_identity_probe
 
 import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.tools.id { id_user_name_argv }
+import extdeps.tools.hostname { hostname_read_argv }
 import std.algebra { trim }
 import std.process { ProcessExit, ExitSuccess, exit_failure }
 import gunbc.typed_argv_exec {
@@ -27,6 +29,7 @@ import std.types { String, NonEmptyStr, Bool, List, Int }
 import std.disposition { Disposition, Scaffold, SingleAuthority }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import product.host_identity { HostIdentity }
+import gunbc.hostname_allocation { canonical_hostname_for_fleet_slot }
 import std.upsert_decision {
   ObservationVerdict,
   Converged,
@@ -175,18 +178,6 @@ data host_reach_identity_probe_receipts: List<HostReachIdentityProbeReceipt> = [
     requested_principal: "gunbc-fleet",
     outcome: ProbeAuthenticationRefused { cause: "gunbc-fleet@srv4: Permission denied (publickey)." },
   },
-  HostReachIdentityProbeReceipt {
-    host: "srv5" as HostIdentity,
-    probed_at: "2026-08-10T01:11:35Z" as NonEmptyStr,
-    requested_principal: "",
-    outcome: ProbeTargetUnobserved { cause: "principal unobserved (no SSH attempted): Spark account that accepted the fleet key at OOBE is unverified recollection; awaits an authorized read-only observation" },
-  },
-  HostReachIdentityProbeReceipt {
-    host: "srv6" as HostIdentity,
-    probed_at: "2026-08-10T01:11:35Z" as NonEmptyStr,
-    requested_principal: "",
-    outcome: ProbeTargetUnobserved { cause: "principal unobserved (no SSH attempted): Spark account that accepted the fleet key at OOBE is unverified recollection; awaits an authorized read-only observation" },
-  },
 ]
 
 fn host_reach_identity_probe_receipt_for(host: HostIdentity) -> HostReachIdentityProbeReceipt? {
@@ -268,15 +259,19 @@ fn observe_reach_secrets_network(host: HostIdentity) -> ObservationVerdict? {
   }
 }
 
-// Producer 2 — P0:host-identity-converge. The enrolled slot identity is the desired
-// short hostname (fleet naming convention: the fleet_intent slot label IS the hostname
-// the SetHostnameCas converge drives toward). A reachable probe whose hostname differs
+// Producer 2 — P0:host-identity-converge. The desired short hostname is the one
+// gunbc.hostname_allocation ALLOCATED to the slot -- not the identity's spelling, which coincides
+// with it only for the legacy rows. A slot with no allocation cannot be judged Converged or Drifted
+// and refuses as UnknownRefused. A reachable probe whose hostname differs
 // is Drifted — real divergence, the thing the converge corrects — while an unreachable
 // or unauthenticated host is Inaccessible (cannot say), and a host-key mismatch is
 // Conflict (the machine answering may not be the enrolled host at all; treating its
 // hostname as an identity observation would launder a wrong-machine read into drift).
-fn host_identity_desired_short_hostname(host: HostIdentity) -> String {
-  host as String
+fn host_identity_desired_short_hostname(host: HostIdentity) -> String? {
+  match canonical_hostname_for_fleet_slot(fleet_slot: host) {
+    Present { value: h } => Present { value: h as String }
+    Absent => none
+  }
 }
 
 // Repair #2: identity Converged requires BOTH dimensions — the observed hostname equals
@@ -286,10 +281,14 @@ fn host_identity_desired_short_hostname(host: HostIdentity) -> String {
 fn identity_verdict_from_outcome(host: HostIdentity, requested_principal: String, o: ReachProbeOutcome) -> ObservationVerdict {
   match o {
     ProbeReachable { observed_short_hostname: observed, observed_principal: obs_principal } =>
-      if observed == host_identity_desired_short_hostname(host: host) && obs_principal == requested_principal {
-        Converged
-      } else {
-        Drifted
+      match host_identity_desired_short_hostname(host: host) {
+        Absent => UnknownRefused
+        Present { value: desired } =>
+          if observed == desired && obs_principal == requested_principal {
+            Converged
+          } else {
+            Drifted
+          }
       }
     ProbeTransportUnavailable { cause: _ } => Inaccessible
     ProbeAuthenticationRefused { cause: _ } => Inaccessible
@@ -326,11 +325,13 @@ type FleetReachProbeRun {
 // receipt stays keyed by fleet IDENTITY — addressing is transport, never identity.
 // Repairs #1 + #2: consult fleet_probe_target_for FIRST. A refused target (unobserved
 // principal) yields ProbeTargetUnobserved and NEVER touches SSH. A ready target runs two
-// typed argv ops against the SAME explicit principal@endpoint — `hostname` for host
-// identity and `id -un` for the account actually reached — so ProbeReachable carries both
-// dimensions and the receipt carries the requested principal for the identity verdict.
+// typed argv ops against the SAME explicit principal@endpoint — `hostname_read_argv` for
+// host identity and `id_user_name_argv` for the account actually reached — so ProbeReachable
+// carries both dimensions and the receipt carries the requested principal for the identity
+// verdict. The argv is spelled by the tool module that owns the tool, not hand-typed here:
+// the probe no longer decides how `hostname` or `id` get their flags.
 fn probe_reachable_with_principal(target: String, hostname_stdout: String) -> ReachProbeOutcome {
-  match typed_argv_probe_over_ssh(host: target as NonEmptyStr, argv: ["id", "-un"]) {
+  match typed_argv_probe_over_ssh(host: target as NonEmptyStr, argv: id_user_name_argv()) {
     TypedArgvExecConverged { result: idr } =>
       if idr.success {
         ProbeReachable { observed_short_hostname: trim(hostname_stdout), observed_principal: trim(idr.stdout) }
@@ -343,7 +344,7 @@ fn probe_reachable_with_principal(target: String, hostname_stdout: String) -> Re
 
 fn probe_ready_target_once(host: String, endpoint: String, remote_principal: String) -> ReachProbeOutcome {
   let target = fleet_probe_ready_ssh_target(t_host: host, endpoint: endpoint, remote_principal: remote_principal)
-  match typed_argv_probe_over_ssh(host: target as NonEmptyStr, argv: ["hostname"]) {
+  match typed_argv_probe_over_ssh(host: target as NonEmptyStr, argv: hostname_read_argv()) {
     TypedArgvExecConverged { result: r } =>
       if r.success {
         probe_reachable_with_principal(target: target, hostname_stdout: r.stdout)
diff --git a/dag/gunbc/host/host_reset_return_run.dag b/dag/gunbc/host/host_reset_return_run.dag
index 88f986938fb..e7a35003d65 100644
--- a/dag/gunbc/host/host_reset_return_run.dag
+++ b/dag/gunbc/host/host_reset_return_run.dag
@@ -79,7 +79,14 @@ import gunbc.host_reset_return {
   select_reset_observer,
   subject_for_observer,
 }
-import gunbc.host_reset_subject_roster { AdmittedResetSubject, reset_observer_peer_roster, reset_subject_for, reset_subject_roster }
+import gunbc.host_reset_subject_roster {
+  AdmittedResetSubject,
+  reset_lookup_subject,
+  reset_observer_peer_roster,
+  reset_roster_hosts,
+  reset_subject_for,
+  reset_subject_roster,
+}
 import gunbc.machine_intake_oob_boot_handoff {
   oob_boot_handoff,
   BootControlIssued,
@@ -417,7 +424,7 @@ fn host_reset_return_attempt(
 {
   let subject = candidate.binding.host.host as NonEmptyStr
   let selection = select_reset_observer(
-    subject_roster: reset_subject_roster(),
+    subject_roster: reset_roster_hosts(entries: reset_subject_roster()),
     peer_roster: reset_observer_peer_roster(),
     subject: subject,
     observer: observer,
@@ -670,7 +677,7 @@ fn host_reset_return_wet() -> ProcessExit
     RouteEstablished { route: r } => r
   }
   let assignment = reset_dispatch_pairings(
-    subject_roster: reset_subject_roster(),
+    subject_roster: reset_roster_hosts(entries: reset_subject_roster()),
     peer_roster: reset_observer_peer_roster(),
   )
   return match subject_for_observer(assignment: assignment, observer: observer) {
@@ -680,7 +687,7 @@ fn host_reset_return_wet() -> ProcessExit
         remedy: "this runner is not an assigned observer, so it has no subject to watch",
       )
     Present { value: subject } =>
-      match reset_subject_for(host: subject) {
+      match reset_lookup_subject(lookup: reset_subject_for(host: subject)) {
         Absent =>
           host_reset_return_preflight_exit(
             refusal: SubjectHasNoRosterRow { subject: subject },
diff --git a/dag/gunbc/host/host_reset_subject_roster.dag b/dag/gunbc/host/host_reset_subject_roster.dag
index d4fa3e93647..bfe3791095b 100644
--- a/dag/gunbc/host/host_reset_subject_roster.dag
+++ b/dag/gunbc/host/host_reset_subject_roster.dag
@@ -16,9 +16,14 @@ import gunbc.managed_host {
   ManagedHostBound,
   ManagedHostEndpointMismatch,
   ManagedHostNotSecured,
+  ManagedHostMembership,
+  OrdinaryMember,
+  MemberUnderDeclaredDrop,
   managed_host_binding,
-  managed_hosts,
+  managed_host_memberships,
 }
+import gunbc.machine_intake_subject { MachineIntakeSubject }
+import std.decl_ref { DeclarationRef }
 import gunbc.host_reset_boot_selection { reset_boot_selection }
 import gunbc.fleet_runner_connectivity { fleet_hosts }
 
@@ -92,14 +97,53 @@ fn reset_subject_roster_of(hosts: List<ManagedHost>) -> List<NonEmptyStr> {
   map(admitted_reset_subjects(hosts: hosts), s => s.binding.host.host as NonEmptyStr)
 }
 
+type ResetRosterEntry
+  = OrdinaryResetRosterHost { host: NonEmptyStr }
+  | ResetRosterHostUnderDeclaredDrop { host: NonEmptyStr, drop: DeclarationRef }
+
+fn reset_roster_hosts(entries: List<ResetRosterEntry>) -> List<NonEmptyStr> {
+  map(entries, e => match e {
+    OrdinaryResetRosterHost { host: h } => h
+    ResetRosterHostUnderDeclaredDrop { host: h, drop: _ } => h
+  })
+}
+
+type ResetSubjectLookup
+  = ResetSubjectNotAdmitted
+  | ResetSubjectAdmittedOrdinary { subject: AdmittedResetSubject }
+  | ResetSubjectAdmittedUnderDeclaredDrop {
+      subject: AdmittedResetSubject
+      drop: DeclarationRef
+      standing_subject: MachineIntakeSubject
+      current_subject: MachineIntakeSubject
+    }
+
+fn reset_lookup_subject(lookup: ResetSubjectLookup) -> AdmittedResetSubject? {
+  match lookup {
+    ResetSubjectNotAdmitted => none
+    ResetSubjectAdmittedOrdinary { subject: s } => Present { value: s }
+    ResetSubjectAdmittedUnderDeclaredDrop { subject: s, drop: _, standing_subject: _, current_subject: _ } =>
+      Present { value: s }
+  }
+}
+
+fn reset_roster_entries_of(m: ManagedHostMembership) -> List<ResetRosterEntry> {
+  match m {
+    OrdinaryMember { host: h } =>
+      map(reset_subject_roster_of(hosts: [h]), name => OrdinaryResetRosterHost { host: name })
+    MemberUnderDeclaredDrop { drop: d, standing_subject: _, current_subject: _, host: h } =>
+      map(reset_subject_roster_of(hosts: [h]), name => ResetRosterHostUnderDeclaredDrop { host: name, drop: d })
+  }
+}
+
 // THE FILTER IS A PREDICATE, NOT A FAILURE ARM, AND THE DIFFERENCE MATTERS HERE. Dropping a
 // candidate whose controller does not admit power control is not an absorbing fallback swallowing a
 // diagnostic -- it is the membership condition doing its job, and the dropped host is not a loss but
 // a non-member. The refusal that DOES have to be loud is one level up, in
 // gunbc.host_reset_return reset_dispatch_options, where an unmintable observer pairing refuses the
 // whole option list rather than quietly shrinking it.
-fn reset_subject_roster() -> List<NonEmptyStr> {
-  reset_subject_roster_of(hosts: managed_hosts())
+fn reset_subject_roster() -> List<ResetRosterEntry> {
+  fold(managed_host_memberships(), init: [], f: (acc, m) => concat(acc, reset_roster_entries_of(m: m)))
 }
 
 // THE PEERS THAT MAY OBSERVE A RESET are the executor fleet hosts, and this is the one place the two
@@ -114,13 +158,35 @@ fn reset_observer_peer_roster() -> List<NonEmptyStr> {
 // selection without re-walking the roster in its own vocabulary. Absent means the label names no
 // admitted subject, which a caller must treat as a refusal and never as a host it may drive with
 // defaults.
-fn reset_subject_for(host: NonEmptyStr) -> AdmittedResetSubject? {
+fn reset_subject_for(host: NonEmptyStr) -> ResetSubjectLookup {
   fold(
-    admitted_reset_subjects(hosts: managed_hosts()),
-    init: none,
-    f: (acc, s) => match acc {
-      Present { value: _ } => acc
-      Absent => if (s.binding.host.host as String) == (host as String) { Present { value: s } } else { acc }
+    managed_host_memberships(),
+    init: ResetSubjectNotAdmitted,
+    f: (acc, m) => match acc {
+      ResetSubjectAdmittedOrdinary { subject: _ } => acc
+      ResetSubjectAdmittedUnderDeclaredDrop { subject: _, drop: _, standing_subject: _, current_subject: _ } => acc
+      ResetSubjectNotAdmitted =>
+        match m {
+          OrdinaryMember { host: h } =>
+            fold(admitted_reset_subjects(hosts: [h]), init: ResetSubjectNotAdmitted, f: (inner, s) =>
+              if (s.binding.host.host as String) == (host as String) {
+                ResetSubjectAdmittedOrdinary { subject: s }
+              } else {
+                inner
+              })
+          MemberUnderDeclaredDrop { drop: d, standing_subject: standing, current_subject: current, host: h } =>
+            fold(admitted_reset_subjects(hosts: [h]), init: ResetSubjectNotAdmitted, f: (inner, s) =>
+              if (s.binding.host.host as String) == (host as String) {
+                ResetSubjectAdmittedUnderDeclaredDrop {
+                  subject: s,
+                  drop: d,
+                  standing_subject: standing,
+                  current_subject: current,
+                }
+              } else {
+                inner
+              })
+        }
     },
   )
 }
diff --git a/dag/gunbc/host/host_standup.dag b/dag/gunbc/host/host_standup.dag
index 5025e1406a5..0f5a207d3fa 100644
--- a/dag/gunbc/host/host_standup.dag
+++ b/dag/gunbc/host/host_standup.dag
@@ -1,9 +1,24 @@
 module gunbc.host_standup
 
+import std.types { String, NonEmptyStr, Bool, Int, List }
+import std.decl_ref { DeclarationRef, WholeDeclaration, decl_ref }
+import std.disposition { Disposition, Scaffold, SingleAuthority }
+import std.effects { IdempotencyEvidence }
+import std.upsert_decision { ObservationVerdict }
+import std.measure { millisecond }
+import product.host_identity { HostIdentity }
+import gunbc.fleet_host_identity { operator_host_srv3 }
+import gunbc.host_effect { host_effect_identity_evidence, host_effect_converge_loop_evidence }
+import gunbc.bmc_onboarding { BmcCredentialProbeResult, FactoryDefault, CredentialsRotated, bmc_credential_probe_to_phase }
+import gunbc.os_install_mechanism { OsInstallMechanismRefused, OsInstallMechanismSelected, srv3_install_mechanism_solution }
+import gunbc.host_standup_assimilation_deduction { deduce_os_install_actuated_satisfied, srv3_pre_install_actuation_verdict }
+import gunbc.host_converge { ConvergePolicy, fleet_converge_policy }
+
 type HostStandupPrefixPhase
   = BmcCredentialConverge
   | OsInstallMechanismResolved
   | OsInstallActuated
+  | ProviderGuestAdopted
   | HostConvergePolicyDerived
 
 type HostStandupAssimilationPhase
@@ -193,6 +208,15 @@ data host_standup_spine: List<HostStandupStep> = [
     refusal: "host_standup:prefix:os-install-actuated:unexecuted — refuse assimilation until NBD-proxy install actuates and OS-up witness is green-by-execution",
     effect_evidence: host_effect_identity_evidence
   ),
+  host_standup_prefix_step(
+    phase: ProviderGuestAdopted,
+    label: "prefix:provider-guest-adopt",
+    authorities: [
+      decl_ref(module_path: "gunbc.provider_guest_adoption", decl_name: "adopt_provider_guest"),
+      decl_ref(module_path: "gunbc.provider_guest_adoption", decl_name: "observe_provider_guest"),
+    ],
+    effect_evidence: host_effect_identity_evidence
+  ),
   host_standup_prefix_step(
     phase: HostConvergePolicyDerived,
     label: "prefix:host-converge",
@@ -352,6 +376,11 @@ data host_standup_gap_ledger: List<GapLedgerRow> = [
     modeling: "gap",
     authority_or_interim: "gunbc.srv3_os_install_actuate + gunbc.host_effect_nbd_proxy_serve (Srv3NbdProxyServe typed session-lease on host_effect_apply) + extdeps.bmc.os_install_actuator_toolchain + gunbc.network_identity_subsumption — live execution proof operator-gated (docs/runbooks/srv3-os-install-actuate.md)"
   },
+  GapLedgerRow {
+    phase_label: "prefix:provider-guest-adopt",
+    modeling: "modeled",
+    authority_or_interim: "gunbc.provider_guest_adoption.adopt_provider_guest (bound provider resource + entitlement-bounded observation; microVM execution standing carried beside adoption) + observe_provider_guest (uname/getconf/meminfo/kvm over the admitted host_command transport)"
+  },
   GapLedgerRow {
     phase_label: "prefix:host-converge",
     modeling: "modeled",
@@ -626,7 +655,7 @@ fn assimilation_complete_first_failure(
 ) -> AssimilationCompleteVerdict? {
   fold_list(
     xs: required,
-    empty: Absent,
+    empty: none,
     cons: fn(acc, wanted_input) {
       match acc {
         Present { value: _ } => acc
diff --git a/dag/gunbc/host/managed_host.dag b/dag/gunbc/host/managed_host.dag
index 4743680b280..a810c7e4720 100644
--- a/dag/gunbc/host/managed_host.dag
+++ b/dag/gunbc/host/managed_host.dag
@@ -1,16 +1,29 @@
 module gunbc.managed_host
 
-import std.types { List, NonEmptyStr, String }
-import std.decl_ref { decl_ref }
+import std.types { Bool, List, NonEmptyStr, String }
+import std.decl_ref { DeclarationRef, decl_ref }
 import product.host_identity { HostIdentity }
 import extdeps.bmc.endpoint { BmcControllerEndpoint }
 import extdeps.bmc.access_profile { BmcAccessObservation, BmcAccessObservationStanding, BmcAccessObserved, BmcAccessUnobserved }
 import extdeps.bmc.capability { BmcFirmwareReleaseCapabilityRow }
 import gunbc.machine_intake_bmc_secure { BmcSecureRefusalCause, BmcSecureRefused, BmcSecureStanding, BmcSecured }
+import gunbc.machine_intake_subject {
+  IntakeAttemptId,
+  MachineIntakeSubject,
+  SubjectCurrent,
+  SubjectStale,
+  compare_qualification_subject,
+}
 import gunbc.fleet_host_identity { operator_host_mtcollins1, operator_host_srv1 }
+import gunbc.hostname_allocation { HostnameAllocation, gunbc_fleet_hostname_allocations, allocated_canonical_hostname }
+import gunbc.rung_drop { RungDrop, Standing, Retired }
+import gunbc.rung_drop.standing { standing_rung_drops }
 import gunbc.machine_intake_mtcollins1_access_observation { mtcollins1_access_standing, mtcollins1_capability_row }
-import gunbc.machine_intake_mtcollins1_bmc_secure_observation { mtcollins1_bmc_secure_standing }
-import gunbc.machine_intake_ampere_smpro_observation { SmproSiteStanding, SmproPassSubjectStanding, smpro_pass_subject }
+import gunbc.machine_intake_mtcollins1_bmc_secure_observation { mtcollins1_bmc_secure_standing, mtcollins1_intake_subject }
+import gunbc.machine_intake_mtcollins1_managed_host_admission { mtcollins1_current_intake_subject }
+import gunbc.machine_intake_ampere_smpro_observation {
+  SmproSiteStanding, SmproSiteAdmitted, SmproSiteRefused, SmproPassSubjectStanding, smpro_pass_subject,
+}
 import gunbc.machine_intake_mtcollins1_smpro_observation { mtcollins1_smpro_site }
 
 // A HOST THIS FLEET DRIVES THROUGH ITS BASEBOARD CONTROLLER, and the one record a host-generic
@@ -83,37 +96,430 @@ fn managed_host_binding(host: ManagedHost) -> ManagedHostBindingStanding {
   }
 }
 
-// A UNIT IS A ROW ONLY WHEN ITS SECURE STANDING IS DERIVED, which itself requires its intake subject
-// to bind. Absent leaves the unit out rather than in with a stand-in, so a host never enters the
-// managed set on a fabricated subject; the roster witness then refuses on the missing member.
-fn managed_hosts() -> List<ManagedHost> {
+// ── MANAGED-HOST ADMISSION (cut O1c-3 PR a) ────────────────────────────────────────────────────
+//
+// One committed record per unit, authored from that unit's arrival observations. The plan's fields:
+// HostIdentity ↔ MachineIntakeSubject; access and capability standing; BmcSecureStanding; unit-hold
+// decision; receipt identity. smpro is on the record because cut 1 put it on ManagedHost: every
+// Ampere SMpro pass reads through managed_host_smpro_subject, and omitting it here would default a
+// site in the projection and fork that join. Currency is NOT receipt.subject == record.subject;
+// that would quietly call a superseded standing current. Currency is compare_qualification_subject
+// of the record's standing subject against the unit's CURRENT subject (current BMC firmware as last
+// observed). A superseded standing is a member only through MemberUnderDeclaredDrop, minted only
+// where gunbc.rung_drop.mtcollins1_bmc_secure_standing_predates_reflash is standing and its
+// population names the unit. Removing that drop makes the unit absent.
+
+type ManagedHostAdmissionReceipt sole_constructor {
+  host: HostIdentity
+  access_host: NonEmptyStr
+  secure_attempt: IntakeAttemptId
+}
+
+fn managed_host_admission_receipt(host: HostIdentity, access_host: NonEmptyStr, secure_attempt: IntakeAttemptId) -> ManagedHostAdmissionReceipt
+  admit_callers: [
+    decl_ref(module_path: "gunbc.managed_host", decl_name: "mtcollins1_managed_host_admission"),
+    decl_ref(module_path: "gunbc.managed_host", decl_name: "managed_host_admission"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_a_record_whose_subject_is_current_is_an_ordinary_member"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_a_superseded_subject_with_no_declared_drop_is_absent"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_a_missing_hold_decision_is_absent"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_a_missing_host_allocation_is_absent"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_a_receipt_for_another_host_is_absent"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_without_the_drop_mtcollins1_is_absent_and_reset_roster_empties"),
+  ]
+{
+  ManagedHostAdmissionReceipt { host: host, access_host: access_host, secure_attempt: secure_attempt }
+}
+
+type ManagedHostAdmissionHold
+  = AdmissionHoldDecided { hold: ResetUnitHold }
+  | AdmissionHoldMissing
+
+type ManagedHostAdmission sole_constructor {
+  host: HostIdentity
+  subject: MachineIntakeSubject
+  access: BmcAccessObservationStanding
+  capability_row: BmcFirmwareReleaseCapabilityRow
+  secure: BmcSecureStanding
+  hold: ManagedHostAdmissionHold
+  smpro: SmproSiteStanding
+  receipt: ManagedHostAdmissionReceipt
+  current_subject: MachineIntakeSubject?
+  covering_drop: DeclarationRef?
+}
+
+fn managed_host_admission(
+  host: HostIdentity,
+  subject: MachineIntakeSubject,
+  access: BmcAccessObservationStanding,
+  capability_row: BmcFirmwareReleaseCapabilityRow,
+  secure: BmcSecureStanding,
+  hold: ManagedHostAdmissionHold,
+  smpro: SmproSiteStanding,
+  receipt: ManagedHostAdmissionReceipt,
+  current_subject: MachineIntakeSubject?,
+  covering_drop: DeclarationRef?,
+) -> ManagedHostAdmission
+  admit_callers: [
+    decl_ref(module_path: "gunbc.managed_host", decl_name: "mtcollins1_managed_host_admission"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_a_record_whose_subject_is_current_is_an_ordinary_member"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_a_superseded_subject_with_no_declared_drop_is_absent"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_a_missing_hold_decision_is_absent"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_a_missing_host_allocation_is_absent"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_a_receipt_for_another_host_is_absent"),
+    decl_ref(module_path: "test.claim.managed_host_admission_witness", decl_name: "w_without_the_drop_mtcollins1_is_absent_and_reset_roster_empties"),
+  ]
+{
+  ManagedHostAdmission {
+    host: host,
+    subject: subject,
+    access: access,
+    capability_row: capability_row,
+    secure: secure,
+    hold: hold,
+    smpro: smpro,
+    receipt: receipt,
+    current_subject: current_subject,
+    covering_drop: covering_drop,
+  }
+}
+
+type ManagedHostMembership sole_constructor
+  = OrdinaryMember { host: ManagedHost }
+  | MemberUnderDeclaredDrop {
+      drop: DeclarationRef
+      standing_subject: MachineIntakeSubject
+      current_subject: MachineIntakeSubject
+      host: ManagedHost
+    }
+
+data mtcollins1_bmc_secure_standing_drop_ref: DeclarationRef = decl_ref(
+  module_path: "gunbc.rung_drop.mtcollins1_bmc_secure_standing_predates_reflash",
+  decl_name: "mtcollins1_bmc_secure_standing_predates_reflash",
+)
+
+// COVERING IS THE RECORD'S CITED DROP JOINED TO A STANDING ROW BY IDENTITY, NOT HOST EQUALITY
+// INSIDE THIS FOLD AND NOT POPULATION PROSE. RungDrop.population is the 4b(3) English bound for
+// the DESIGN projection; grepping it would admit any host whose name appears in a sentence.
+// Which unit a drop covers is the covering_drop the unit's admission record cites; the generic
+// join only checks that cited identity is standing in the drop list.
+fn drop_is_standing_citation(drop: RungDrop, cited: DeclarationRef) -> Bool {
+  match drop.standing {
+    Retired { trigger_fired: _ } => false
+    Superseded { ruling: _, decision_record: _, loss_holder: _ } => false
+    Standing => (drop.identity as String) == (cited.decl_name as String)
+  }
+}
+
+fn covering_bmc_secure_drop(drops: List<RungDrop>, cited: DeclarationRef) -> RungDrop? {
+  filter(drops, d => drop_is_standing_citation(drop: d, cited: cited)).first()
+}
+
+fn host_is_allocated(allocations: List<HostnameAllocation>, host: HostIdentity) -> Bool {
+  any(allocations, a => (a.fleet_slot as String) == (host as String))
+}
+
+fn store_host_is_allocated(allocations: List<HostnameAllocation>, store_host: NonEmptyStr) -> Bool {
+  any(allocations, a => (a.fleet_slot as String) == (store_host as String) || (allocated_canonical_hostname(allocation: a) as String) == (store_host as String))
+}
+
+fn access_controller_host(access: BmcAccessObservationStanding) -> NonEmptyStr? {
+  match access {
+    BmcAccessUnobserved { endpoint: _ } => none
+    BmcAccessObserved { observation: o } => Present { value: o.endpoint.host }
+  }
+}
+
+fn secure_controller_host(secure: BmcSecureStanding) -> NonEmptyStr? {
+  match secure.outcome {
+    BmcSecureRefused { cause: _ } => none
+    BmcSecured { endpoint: e, reference: _, evidence: _, latest_admitted_probe_at: _, published_credential: _ } =>
+      Present { value: e.host }
+  }
+}
+
+fn smpro_controller_host(smpro: SmproSiteStanding) -> NonEmptyStr? {
+  match smpro {
+    SmproSiteRefused { cause: _ } => none
+    SmproSiteAdmitted { site: s } => Present { value: s.endpoint.host }
+  }
+}
+
+fn receipt_matches_record(record: ManagedHostAdmission) -> Bool {
+  (record.receipt.host as String) == (record.host as String)
+    && (record.receipt.secure_attempt as NonEmptyStr) == (record.subject.attempt_id as NonEmptyStr)
+    && match access_controller_host(access: record.access) {
+      Absent => false
+      Present { value: h } => (record.receipt.access_host as String) == (h as String)
+    }
+}
+
+fn standings_bound_to_record_subject(record: ManagedHostAdmission) -> Bool {
+  (record.secure.subject.subject.unit_key as NonEmptyStr) == (record.subject.subject.unit_key as NonEmptyStr)
+    && match access_controller_host(access: record.access) {
+      Absent => false
+      Present { value: access_host } =>
+        match secure_controller_host(secure: record.secure) {
+          Absent => false
+          Present { value: secure_host } =>
+            match smpro_controller_host(smpro: record.smpro) {
+              Absent => false
+              Present { value: smpro_host } =>
+                (access_host as String) == (secure_host as String) && (secure_host as String) == (smpro_host as String)
+            }
+        }
+    }
+}
+
+fn decided_hold(record: ManagedHostAdmission, allocations: List<HostnameAllocation>) -> ResetUnitHold? {
+  match record.hold {
+    AdmissionHoldMissing => none
+    AdmissionHoldDecided { hold: h } =>
+      match h {
+        ResetNoUnitHold => Present { value: h }
+        ResetUnitHoldRequired { key: _, store_host: store } =>
+          if store_host_is_allocated(allocations: allocations, store_host: store) {
+            Present { value: h }
+          } else {
+            none
+          }
+      }
+  }
+}
+
+fn row_from_admission(record: ManagedHostAdmission, hold: ResetUnitHold) -> ManagedHost {
+  ManagedHost {
+    host: record.host,
+    access: record.access,
+    capability_row: record.capability_row,
+    secure: record.secure,
+    unit_hold: hold,
+    smpro: record.smpro,
+  }
+}
+
+fn ordinary_member(host: ManagedHost) -> ManagedHostMembership
+  admit_callers: [
+    decl_ref(module_path: "gunbc.managed_host", decl_name: "project_managed_host_admission"),
+  ]
+{
+  OrdinaryMember { host: host }
+}
+
+fn member_under_declared_drop(
+  drop: DeclarationRef,
+  standing_subject: MachineIntakeSubject,
+  current_subject: MachineIntakeSubject,
+  host: ManagedHost,
+) -> ManagedHostMembership
+  admit_callers: [
+    decl_ref(module_path: "gunbc.managed_host", decl_name: "project_managed_host_admission"),
+  ]
+{
+  MemberUnderDeclaredDrop {
+    drop: drop,
+    standing_subject: standing_subject,
+    current_subject: current_subject,
+    host: host,
+  }
+}
+
+// THE PUBLIC ENTRY. Every parameter is consumed: a hard-coded current subject, drop list, or
+// allocation list changes the arm. Incomplete records, unbound standings, a missing hold, a missing
+// allocation, a mismatched receipt, or an unreadable current subject are Absent, never defaulted.
+fn project_managed_host_admission(
+  record: ManagedHostAdmission,
+  current_subject: MachineIntakeSubject?,
+  drops: List<RungDrop>,
+  allocations: List<HostnameAllocation>,
+) -> ManagedHostMembership? {
+  if host_is_allocated(allocations: allocations, host: record.host) == false {
+    none
+  } else if receipt_matches_record(record: record) == false {
+    none
+  } else if standings_bound_to_record_subject(record: record) == false {
+    none
+  } else {
+    match decided_hold(record: record, allocations: allocations) {
+      Absent => none
+      Present { value: hold } =>
+        match current_subject {
+          Absent => none
+          Present { value: current } => {
+            let row = row_from_admission(record: record, hold: hold)
+            match compare_qualification_subject(admitted: record.subject.subject, observed: current.subject) {
+              SubjectCurrent => Present { value: ordinary_member(host: row) }
+              SubjectStale { axes: _ } =>
+                match record.covering_drop {
+                  Absent => none
+                  Present { value: cited } =>
+                    match covering_bmc_secure_drop(drops: drops, cited: cited) {
+                      Absent => none
+                      Present { value: _ } =>
+                        Present {
+                          value: member_under_declared_drop(
+                            drop: cited,
+                            standing_subject: record.subject,
+                            current_subject: current,
+                            host: row,
+                          ),
+                        }
+                    }
+                }
+            }
+          }
+        }
+    }
+  }
+}
+
+fn membership_host(membership: ManagedHostMembership) -> ManagedHost {
+  match membership {
+    OrdinaryMember { host: h } => h
+    MemberUnderDeclaredDrop { drop: _, standing_subject: _, current_subject: _, host: h } => h
+  }
+}
+
+fn membership_is_host(membership: ManagedHostMembership, host: HostIdentity) -> Bool {
+  match membership {
+    OrdinaryMember { host: h } => (h.host as String) == (host as String)
+    MemberUnderDeclaredDrop { drop: _, standing_subject: _, current_subject: _, host: h } => (h.host as String) == (host as String)
+  }
+}
+
+fn mtcollins1_unit_hold() -> ResetUnitHold {
+  ResetUnitHoldRequired { key: operator_host_mtcollins1 as NonEmptyStr, store_host: operator_host_srv1 as NonEmptyStr }
+}
+
+fn mtcollins1_managed_host_admission() -> ManagedHostAdmission? {
   match mtcollins1_bmc_secure_standing() {
-    Absent => []
+    Absent => none
     Present { value: secure } =>
-      [
-        ManagedHost {
-          host: operator_host_mtcollins1,
-          access: mtcollins1_access_standing,
-          capability_row: mtcollins1_capability_row,
-          secure: secure,
-          unit_hold: ResetUnitHoldRequired { key: operator_host_mtcollins1 as NonEmptyStr, store_host: operator_host_srv1 as NonEmptyStr },
-          smpro: mtcollins1_smpro_site(),
-        },
-      ]
+      match mtcollins1_intake_subject() {
+        Absent => none
+        Present { value: subject } =>
+          match access_controller_host(access: mtcollins1_access_standing) {
+            Absent => none
+            Present { value: access_host } =>
+              Present {
+                value: managed_host_admission(
+                  host: operator_host_mtcollins1,
+                  subject: subject,
+                  access: mtcollins1_access_standing,
+                  capability_row: mtcollins1_capability_row,
+                  secure: secure,
+                  hold: AdmissionHoldDecided { hold: mtcollins1_unit_hold() },
+                  smpro: mtcollins1_smpro_site(),
+                  receipt: managed_host_admission_receipt(
+                    host: operator_host_mtcollins1,
+                    access_host: access_host,
+                    secure_attempt: subject.attempt_id,
+                  ),
+                  current_subject: mtcollins1_current_intake_subject(),
+                  covering_drop: Present { value: mtcollins1_bmc_secure_standing_drop_ref },
+                ),
+              }
+          }
+      }
+  }
+}
+
+fn authored_managed_host_admissions() -> List<ManagedHostAdmission> {
+  match mtcollins1_managed_host_admission() {
+    Absent => []
+    Present { value: r } => [r]
   }
 }
 
+fn current_subject_for_admission(record: ManagedHostAdmission) -> MachineIntakeSubject? {
+  record.current_subject
+}
+
+fn managed_host_memberships_projected(
+  records: List<ManagedHostAdmission>,
+  drops: List<RungDrop>,
+  allocations: List<HostnameAllocation>,
+) -> List<ManagedHostMembership> {
+  fold(records, init: [], f: (acc, record) =>
+    match project_managed_host_admission(
+      record: record,
+      current_subject: current_subject_for_admission(record: record),
+      drops: drops,
+      allocations: allocations,
+    ) {
+      Absent => acc
+      Present { value: m } => concat(acc, [m])
+    })
+}
+
+fn managed_hosts_projected(
+  records: List<ManagedHostAdmission>,
+  drops: List<RungDrop>,
+  allocations: List<HostnameAllocation>,
+) -> List<ManagedHost> {
+  fold(
+    managed_host_memberships_projected(records: records, drops: drops, allocations: allocations),
+    init: [],
+    f: (acc, m) => concat(acc, [membership_host(membership: m)]),
+  )
+}
+
+fn managed_host_memberships() -> List<ManagedHostMembership> {
+  managed_host_memberships_projected(
+    records: authored_managed_host_admissions(),
+    drops: standing_rung_drops(),
+    allocations: gunbc_fleet_hostname_allocations,
+  )
+}
+
+fn managed_membership_for(host: HostIdentity) -> ManagedHostMembership? {
+  fold(
+    managed_host_memberships(),
+    init: none,
+    f: (acc, m) => match acc {
+      Present { value: _ } => acc
+      Absent => if membership_is_host(membership: m, host: host) { Present { value: m } } else { acc }
+    },
+  )
+}
+
+// A UNIT IS A MEMBER ONLY THROUGH A COMMITTED ManagedHostAdmission, projected here. Membership is
+// evidence, never a source roster: the record lives in the unit's observations; this module joins
+// completeness, the one-subject bind, allocation, hold, receipt identity, and currency against the
+// CURRENT subject (docs/plans/managed-host-untangle.md, cut O1c-3 PR a). mtjade1 has no record.
+// managed_hosts() is the host-row view of managed_host_memberships(); callers that read secure
+// standing, binding, reset, hold, boot, or MegaRAC admission walk the memberships and match
+// MemberUnderDeclaredDrop (DESIGN §4b(3): a declared drop may not reach consumers as silence).
+fn managed_hosts() -> List<ManagedHost> {
+  fold(managed_host_memberships(), init: [], f: (acc, m) => concat(acc, [membership_host(membership: m)]))
+}
+
 // A MANAGED HOST BY LABEL, AS ITS WHOLE BINDING STANDING. A caller that knows only a host's name reaches
 // the row's join here, and gets the standing -- bound with its observed endpoint and account together,
 // or the refusal -- never an account on its own.
 type ManagedHostLookup
   = ManagedHostFound { standing: ManagedHostBindingStanding }
+  | ManagedHostFoundUnderDeclaredDrop {
+      standing: ManagedHostBindingStanding
+      drop: DeclarationRef
+      standing_subject: MachineIntakeSubject
+      current_subject: MachineIntakeSubject
+    }
   | ManagedHostNotManaged { host: NonEmptyStr }
 
 fn managed_host_binding_for(host: NonEmptyStr) -> ManagedHostLookup {
-  match filter(managed_hosts(), h => (h.host as String) == (host as String)).first() {
+  match managed_membership_for(host: host as HostIdentity) {
     Absent => ManagedHostNotManaged { host: host }
-    Present { value: h } => ManagedHostFound { standing: managed_host_binding(host: h) }
+    Present { value: m } =>
+      match m {
+        OrdinaryMember { host: h } => ManagedHostFound { standing: managed_host_binding(host: h) }
+        MemberUnderDeclaredDrop { drop: d, standing_subject: standing, current_subject: current, host: h } =>
+          ManagedHostFoundUnderDeclaredDrop {
+            standing: managed_host_binding(host: h),
+            drop: d,
+            standing_subject: standing,
+            current_subject: current,
+          }
+      }
   }
 }
 
@@ -121,17 +527,22 @@ fn managed_host_binding_for(host: NonEmptyStr) -> ManagedHostLookup {
 // drive `endpoint` gets the bound account only when `endpoint` is the controller the binding observed,
 // so one host's account is never sent to another controller. Absent is every other case: the host is
 // not managed, does not bind, or is bound to a different controller than the one the caller drives.
+fn account_driving_standing(standing: ManagedHostBindingStanding, endpoint: BmcControllerEndpoint) -> NonEmptyStr? {
+  match standing {
+    ManagedHostBound { binding: b } =>
+      if (b.observation.endpoint.host as String) == (endpoint.host as String) { Present { value: b.account } } else { none }
+    ManagedHostAccessUnobserved { endpoint: _ } => none
+    ManagedHostNotSecured { cause: _ } => none
+    ManagedHostEndpointMismatch { observed: _, secured: _ } => none
+  }
+}
+
 fn managed_host_account_driving(lookup: ManagedHostLookup, endpoint: BmcControllerEndpoint) -> NonEmptyStr? {
   match lookup {
     ManagedHostNotManaged { host: _ } => none
-    ManagedHostFound { standing: s } =>
-      match s {
-        ManagedHostBound { binding: b } =>
-          if (b.observation.endpoint.host as String) == (endpoint.host as String) { Present { value: b.account } } else { none }
-        ManagedHostAccessUnobserved { endpoint: _ } => none
-        ManagedHostNotSecured { cause: _ } => none
-        ManagedHostEndpointMismatch { observed: _, secured: _ } => none
-      }
+    ManagedHostFound { standing: s } => account_driving_standing(standing: s, endpoint: endpoint)
+    ManagedHostFoundUnderDeclaredDrop { standing: s, drop: _, standing_subject: _, current_subject: _ } =>
+      account_driving_standing(standing: s, endpoint: endpoint)
   }
 }
 
diff --git a/dag/gunbc/host/managed_host_boot.dag b/dag/gunbc/host/managed_host_boot.dag
index 88a8a8e75d5..08cc35821d2 100644
--- a/dag/gunbc/host/managed_host_boot.dag
+++ b/dag/gunbc/host/managed_host_boot.dag
@@ -15,8 +15,10 @@ import gunbc.managed_host {
   ManagedHostBound,
   ManagedHostEndpointMismatch,
   ManagedHostNotSecured,
+  OrdinaryMember,
+  MemberUnderDeclaredDrop,
   managed_host_binding,
-  managed_hosts,
+  managed_membership_for,
 }
 
 // THE BOOT'S ONE-SHOT SELECTION IS BOOT POLICY for the pair (host, boot), so it is decided here and
@@ -80,7 +82,15 @@ fn boot_subject_admission_in(hosts: List<ManagedHost>, host: HostIdentity, mediu
 }
 
 fn boot_subject_admission_for(host: HostIdentity, medium: BootMedium, execution_revision: NonEmptyStr) -> BootSubjectAdmission {
-  boot_subject_admission_in(hosts: managed_hosts(), host: host, medium: medium, execution_revision: execution_revision)
+  match managed_membership_for(host: host) {
+    Absent => BootSubjectRefused { host: host, cause: BootSubjectHostNotManaged }
+    Present { value: m } =>
+      match m {
+        OrdinaryMember { host: h } => admit_boot_subject(host: h, medium: medium, execution_revision: execution_revision)
+        MemberUnderDeclaredDrop { drop: _, standing_subject: _, current_subject: _, host: h } =>
+          admit_boot_subject(host: h, medium: medium, execution_revision: execution_revision)
+      }
+  }
 }
 
 fn boot_subject_refusal_cause_text(cause: BootSubjectRefusalCause) -> String {
diff --git a/dag/gunbc/host/managed_host_boot_handoff.dag b/dag/gunbc/host/managed_host_boot_handoff.dag
index e291a140a94..8578b544bbb 100644
--- a/dag/gunbc/host/managed_host_boot_handoff.dag
+++ b/dag/gunbc/host/managed_host_boot_handoff.dag
@@ -5,7 +5,7 @@ import std.decl_ref { decl_ref }
 import std.optional { Present, Absent }
 import std.process { ExitSuccess, ProcessExit, exit_failure }
 import extdeps.bmc.capability { BmcFirmwareReleaseCapabilityRow }
-import gunbc.managed_host { ManagedHost, ManagedHostBound, ManagedHostAccessUnobserved, ManagedHostNotSecured, ManagedHostEndpointMismatch, managed_host_binding, managed_hosts }
+import gunbc.managed_host { ManagedHost, ManagedHostBound, ManagedHostAccessUnobserved, ManagedHostNotSecured, ManagedHostEndpointMismatch, OrdinaryMember, MemberUnderDeclaredDrop, managed_host_binding, managed_host_memberships }
 import gunbc.managed_host_unit_hold { UnitHoldProof, unit_hold_proof_refusal }
 import gunbc.managed_host_boot { AdmittedBootSubject, boot_subject_host }
 import gunbc.managed_host_boot_phase_timing { BootStart, BootStartUnobserved, boot_start_of }
@@ -206,7 +206,14 @@ fn boot_handoff_admission_probe_of(host: ManagedHost) -> String? {
 }
 
 fn boot_handoff_admission_probe() -> ProcessExit {
-  let hosts = managed_hosts()
+  let hosts = fold(
+    managed_host_memberships(),
+    init: [],
+    f: (acc, m) => match m {
+      OrdinaryMember { host: h } => concat(acc, [h])
+      MemberUnderDeclaredDrop { drop: _, standing_subject: _, current_subject: _, host: h } => concat(acc, [h])
+    },
+  )
   let refusals = flat_map(hosts, h => match boot_handoff_admission_probe_of(host: h) { Present { value: why } => [why]  Absent => [] })
   if count(hosts) == 0 {
     exit_failure(reason: "boot handoff admission probe: no managed host to probe")
diff --git a/dag/gunbc/host/managed_host_unit_hold.dag b/dag/gunbc/host/managed_host_unit_hold.dag
index e249d59d7f0..553c8dcc722 100644
--- a/dag/gunbc/host/managed_host_unit_hold.dag
+++ b/dag/gunbc/host/managed_host_unit_hold.dag
@@ -45,7 +45,7 @@ import gunbc.durable_exclusive_hold_file_store {
 import gunbc.actions_run_binding { actions_variable_trimmed }
 import std.decl_ref { decl_ref }
 import product.host_identity { HostIdentity, host_identity_eq }
-import gunbc.managed_host { ManagedHost, ResetNoUnitHold, ResetUnitHoldRequired, managed_hosts }
+import gunbc.managed_host { ManagedHost, ResetNoUnitHold, ResetUnitHoldRequired, OrdinaryMember, MemberUnderDeclaredDrop, managed_host_memberships, managed_membership_for }
 import gunbc.host_maintenance_hold_reason { maintenance_hold_reason_env }
 import extdeps.tools.hostname
 import gunbc.hostname_allocation { canonical_hostname_for_fleet_slot }
@@ -129,7 +129,15 @@ fn unit_hold_admission_in(hosts: List<ManagedHost>, host: NonEmptyStr) -> UnitHo
 }
 
 fn unit_hold_admission_for(host: NonEmptyStr) -> UnitHoldHostAdmission {
-  unit_hold_admission_in(hosts: managed_hosts(), host: host)
+  match managed_membership_for(host: host as HostIdentity) {
+    Absent => UnitHoldHostNotManaged { host: host }
+    Present { value: m } =>
+      match m {
+        OrdinaryMember { host: h } => unit_hold_admission_in(hosts: [h], host: host)
+        MemberUnderDeclaredDrop { drop: _, standing_subject: _, current_subject: _, host: h } =>
+          unit_hold_admission_in(hosts: [h], host: host)
+      }
+  }
 }
 
 // Absent means the host was admitted; the text is what a refused caller prints.
@@ -163,7 +171,16 @@ fn unit_hold_store_hosts_of(hosts: List<ManagedHost>) -> List<NonEmptyStr> {
 }
 
 fn unit_hold_store_hosts() -> List<NonEmptyStr> {
-  unit_hold_store_hosts_of(hosts: managed_hosts())
+  unit_hold_store_hosts_of(
+    hosts: fold(
+      managed_host_memberships(),
+      init: [],
+      f: (acc, m) => match m {
+        OrdinaryMember { host: h } => concat(acc, [h])
+        MemberUnderDeclaredDrop { drop: _, standing_subject: _, current_subject: _, host: h } => concat(acc, [h])
+      },
+    ),
+  )
 }
 
 // ── THE STORE IS A LOCAL DIRECTORY, SO THE PROCESS MUST BE ON THE STORE HOST ───────────────────
@@ -766,6 +783,18 @@ type MaintenanceHoldAdmission
   | MaintenanceHoldHostRefused { admission: UnitHoldHostAdmission }
   | MaintenanceHoldNoReasonVariable { host: HostIdentity }
 
+fn admit_maintenance_hold_for(host: NonEmptyStr) -> MaintenanceHoldAdmission {
+  match managed_membership_for(host: host as HostIdentity) {
+    Absent => MaintenanceHoldHostRefused { admission: UnitHoldHostNotManaged { host: host } }
+    Present { value: m } =>
+      match m {
+        OrdinaryMember { host: h } => admit_maintenance_hold_in(hosts: [h], host: host)
+        MemberUnderDeclaredDrop { drop: _, standing_subject: _, current_subject: _, host: h } =>
+          admit_maintenance_hold_in(hosts: [h], host: host)
+      }
+  }
+}
+
 fn admit_maintenance_hold_in(hosts: List<ManagedHost>, host: NonEmptyStr) -> MaintenanceHoldAdmission {
   match unit_hold_admission_in(hosts: hosts, host: host) {
     UnitHoldHostNotManaged { host: h } => MaintenanceHoldHostRefused { admission: UnitHoldHostNotManaged { host: h } }
@@ -797,7 +826,7 @@ fn maintenance_hold_take(host: String) -> ProcessExit {
   if trim(s: host) == "" {
     return exit_failure(reason: "maintenance hold: no host named; pass --arg host=<managed host>")
   }
-  match admit_maintenance_hold_in(hosts: managed_hosts(), host: trim(s: host) as NonEmptyStr) {
+  match admit_maintenance_hold_for(host: trim(s: host) as NonEmptyStr) {
     MaintenanceHoldAdmitted { hold: h } => maintenance_hold_take_admitted(hold: h)
     MaintenanceHoldHostRefused { admission: a } => exit_failure(reason: maintenance_hold_admission_refusal(admission: MaintenanceHoldHostRefused { admission: a }))
     MaintenanceHoldNoReasonVariable { host: x } => exit_failure(reason: maintenance_hold_admission_refusal(admission: MaintenanceHoldNoReasonVariable { host: x }))
@@ -847,7 +876,7 @@ fn maintenance_hold_release(host: String) -> ProcessExit {
   if trim(s: host) == "" {
     return exit_failure(reason: "maintenance hold: no host named; pass --arg host=<managed host>")
   }
-  match admit_maintenance_hold_in(hosts: managed_hosts(), host: trim(s: host) as NonEmptyStr) {
+  match admit_maintenance_hold_for(host: trim(s: host) as NonEmptyStr) {
     MaintenanceHoldAdmitted { hold: h } => maintenance_hold_release_admitted(hold: h)
     MaintenanceHoldHostRefused { admission: a } => exit_failure(reason: maintenance_hold_admission_refusal(admission: MaintenanceHoldHostRefused { admission: a }))
     MaintenanceHoldNoReasonVariable { host: x } => exit_failure(reason: maintenance_hold_admission_refusal(admission: MaintenanceHoldNoReasonVariable { host: x }))
diff --git a/dag/gunbc/host/megarac_managed_host.dag b/dag/gunbc/host/megarac_managed_host.dag
index 8f648453ef4..5e2f59fd54c 100644
--- a/dag/gunbc/host/megarac_managed_host.dag
+++ b/dag/gunbc/host/megarac_managed_host.dag
@@ -10,12 +10,13 @@ import extdeps.bmc.capability { BmcFirmwareReleaseIdentity, bmc_firmware_release
 import extdeps.bmc.access_profile { BmcObservedIdentity }
 import gunbc.managed_host {
   ManagedHost, ManagedHostBinding, ManagedHostBindingStanding, ManagedHostBound, ManagedHostAccessUnobserved,
-  ManagedHostNotSecured, ManagedHostEndpointMismatch, managed_host_binding, managed_hosts,
+  ManagedHostNotSecured, ManagedHostEndpointMismatch, OrdinaryMember, MemberUnderDeclaredDrop, managed_host_binding,
+  managed_membership_for,
 }
 import gunbc.megarac_operation_standing {
   MegaRacOperation, MegaRacVirtualMediaAttach, MegaRacKvmCanvasStill, MegaRacSdrSocketNaming,
   MegaRacOperationEvidence, MegaRacCurrentBuild, CurrentBuildRead, CurrentBuildKnownUnread, CurrentBuildUnobserved,
-  megarac_operation_grounded_at, megarac_operation_executed_at, megarac_current_build,
+  megarac_operation_executed_at, megarac_current_build,
 }
 import gunbc.machine_intake_megarac_operation_evidence { mtcollins1_megarac_operation_evidence }
 
@@ -29,7 +30,7 @@ import gunbc.machine_intake_megarac_operation_evidence { mtcollins1_megarac_oper
 // AN OPERATION IS ADMITTED ONLY WHERE IT IS GROUNDED. gunbc.megarac_operation_standing grounds an
 // operation at an observed controller identity -- baseboard and firmware together -- from committed
 // evidence (gunbc.machine_intake_megarac_operation_evidence): a receipt joined to a reading of that
-// build, or a route recovered from what that build served. A MegaRAC appliance of another product line
+// build. A MegaRAC appliance of another product line
 // reporting the same raw version is refused, and so is Mt. Jade's MegaRAC at 2.11, which none of these
 // operations was ever run on.
 //
@@ -83,26 +84,16 @@ fn megarac_binding_step(host: ManagedHost) -> MegaRacBindingStep {
   }
 }
 
-// WHAT GROUNDING AN ADMISSION REQUIRES: the frozen production path accepts a route recovered from a served
-// artifact; the current-build gate accepts only an executed operation.
-type MegaRacGroundingRequirement
-  = GroundedByExecutionOrServedRecovery
-  | GroundedByExecutionOnly
-
 // THE ONE MINT OF AdmittedMegaRacHost, and it decides from the sealed evidence itself, never from a
 // supplied verdict. It is admitted only to the two admissions below, each of which runs the binding and
 // family step (and, for the gate, the current-build step) before reaching it.
-fn megarac_grounded_admission(evidence: MegaRacOperationEvidence, binding: ManagedHostBinding, operation: MegaRacOperation, identity: BmcObservedIdentity, requirement: MegaRacGroundingRequirement) -> MegaRacHostAdmission
+fn megarac_grounded_admission(evidence: MegaRacOperationEvidence, binding: ManagedHostBinding, operation: MegaRacOperation, identity: BmcObservedIdentity) -> MegaRacHostAdmission
   admit_callers: [
     decl_ref(module_path: "gunbc.megarac_managed_host", decl_name: "admit_megarac_host_observed_in"),
     decl_ref(module_path: "gunbc.megarac_managed_host", decl_name: "admit_megarac_host_at_current_build"),
   ]
 {
-  let grounded = match requirement {
-    GroundedByExecutionOrServedRecovery => megarac_operation_grounded_at(evidence: evidence, operation: operation, identity: identity)
-    GroundedByExecutionOnly => megarac_operation_executed_at(evidence: evidence, operation: operation, identity: identity)
-  }
-  if grounded {
+  if megarac_operation_executed_at(evidence: evidence, operation: operation, identity: identity) {
     MegaRacHostAdmitted { host: AdmittedMegaRacHost { binding: binding, operation: operation, firmware: identity.firmware } }
   } else {
     MegaRacHostRefused { cause: MegaRacOperationNotGrounded { operation: operation, identity: identity } }
@@ -117,7 +108,7 @@ fn admit_megarac_host(host: ManagedHost, operation: MegaRacOperation) -> MegaRac
 fn admit_megarac_host_observed_in(evidence: MegaRacOperationEvidence, host: ManagedHost, operation: MegaRacOperation) -> MegaRacHostAdmission {
   match megarac_binding_step(host: host) {
     MegaRacBindingRefused { cause: c } => MegaRacHostRefused { cause: c }
-    MegaRacBindingAdmissible { binding: b } => megarac_grounded_admission(evidence: evidence, binding: b, operation: operation, identity: b.observation.identity, requirement: GroundedByExecutionOrServedRecovery)
+    MegaRacBindingAdmissible { binding: b } => megarac_grounded_admission(evidence: evidence, binding: b, operation: operation, identity: b.observation.identity)
   }
 }
 
@@ -138,7 +129,7 @@ fn admit_megarac_host_at_current_build(evidence: MegaRacOperationEvidence, host:
           MegaRacHostRefused { cause: MegaRacObservationNotCurrent { observed: observed, current: t.to } }
         CurrentBuildRead { reading: r } =>
           if bmc_firmware_release_identity_eq(a: r.identity.firmware, b: observed) {
-            megarac_grounded_admission(evidence: evidence, binding: b, operation: operation, identity: r.identity, requirement: GroundedByExecutionOnly)
+            megarac_grounded_admission(evidence: evidence, binding: b, operation: operation, identity: r.identity)
           } else {
             MegaRacHostRefused { cause: MegaRacObservationNotCurrent { observed: observed, current: r.identity.firmware } }
           }
@@ -157,7 +148,15 @@ fn megarac_host_admission_in(hosts: List<ManagedHost>, host: NonEmptyStr, operat
 }
 
 fn megarac_host_admission_for(host: NonEmptyStr, operation: MegaRacOperation) -> MegaRacHostAdmission {
-  megarac_host_admission_in(hosts: managed_hosts(), host: host, operation: operation)
+  match managed_membership_for(host: host as HostIdentity) {
+    Absent => MegaRacHostRefused { cause: MegaRacHostNotManaged { host: host } }
+    Present { value: m } =>
+      match m {
+        OrdinaryMember { host: h } => admit_megarac_host(host: h, operation: operation)
+        MemberUnderDeclaredDrop { drop: _, standing_subject: _, current_subject: _, host: h } =>
+          admit_megarac_host(host: h, operation: operation)
+      }
+  }
 }
 
 fn megarac_operation_text(operation: MegaRacOperation) -> String {
diff --git a/dag/gunbc/host/megarac_operation_standing.dag b/dag/gunbc/host/megarac_operation_standing.dag
index 6c6504ba3fc..171bca1c089 100644
--- a/dag/gunbc/host/megarac_operation_standing.dag
+++ b/dag/gunbc/host/megarac_operation_standing.dag
@@ -1,5 +1,7 @@
 module gunbc.megarac_operation_standing
 
+import extdeps.board_authority { board_identity_authority, board_authority_ref_eq }
+import gunbc.board_authority_binding { observed_board_authority }
 import std.types { Bool, EpochMs, List, NonEmptyStr, String }
 import std.content_hash { ContentHash }
 import std.decl_ref { DeclarationRef, decl_ref }
@@ -37,8 +39,21 @@ fn megarac_operation_eq(a: MegaRacOperation, b: MegaRacOperation) -> Bool {
   }
 }
 
+// IDENTITY-GRADE use of the board: both readings must reach a bound authority (either standing) and
+// the SAME one. An unread, unbound or ambiguous board equals nothing, itself included.
+fn megarac_board_identity_eq(a: BmcObservedIdentity, b: BmcObservedIdentity) -> Bool {
+  match board_identity_authority(lookup: observed_board_authority(observation: a.board)) {
+    Present { value: x } =>
+      match board_identity_authority(lookup: observed_board_authority(observation: b.board)) {
+        Present { value: y } => board_authority_ref_eq(a: x, b: y)
+        Absent => false
+      }
+    Absent => false
+  }
+}
+
 fn megarac_identity_eq(a: BmcObservedIdentity, b: BmcObservedIdentity) -> Bool {
-  a.baseboard == b.baseboard && bmc_firmware_release_identity_eq(a: a.firmware, b: b.firmware)
+  megarac_board_identity_eq(a: a, b: b) && bmc_firmware_release_identity_eq(a: a.firmware, b: b.firmware)
 }
 
 // ── THE CARRIERS. Each is sole_constructor and minted only by a function sealed to the evidence rows
@@ -74,28 +89,6 @@ type MegaRacFirmwareTransition sole_constructor {
   record: DeclarationRef
 }
 
-// AN OPERATION'S ROUTE RECOVERED FROM AN ARTIFACT THE CONTROLLER SERVES, NOT EXECUTED. The KVM canvas
-// still's route (extdeps.bmc.megarac MegaRacScreenCaptureRoute) was read from the web UI bundle the
-// controller serves to any browser at a given build. That is an OBSERVATION OF WHAT THE DEVICE SERVES --
-// the same standing as gunbc.machine_intake_megarac_served_ui_catalog_observation and
-// gunbc.machine_intake_megarac_ui_features -- not a disassembly of firmware and not a proprietary-notice
-// document, and it is distinct from O1a's cited-source arm, which cites an upstream-published source.
-// WHAT IT DOES NOT ESTABLISH: that the operation was ever executed. It grounds the route at the identity
-// that served it, and nothing that requires an executed standing admits on it
-// (megarac_operation_executed_at, and the current-build gate, refuse this arm).
-type ServedArtifactCapture
-  = ServedArtifactCommitted { evidence: EvidenceRef }
-  | ServedArtifactDigestOnly { digest: ContentHash }
-
-type MegaRacOperationServedArtifactRecovery sole_constructor {
-  operation: MegaRacOperation
-  identity: BmcObservedIdentity
-  served_by: BmcControllerEndpoint
-  artifact: NonEmptyStr
-  capture: ServedArtifactCapture
-  read_at: EpochMs
-}
-
 // THE WHOLE EVIDENCE POPULATION, SEALED. An operation's grounding and a controller's current build are
 // conclusions over the COMPLETE population: drop a recorded transition from otherwise genuine rows and a
 // superseded build reads as current. So the population is sole_constructor too, and its one mint is
@@ -105,14 +98,12 @@ type MegaRacOperationEvidence sole_constructor {
   readings: List<MegaRacBuildReading>
   receipts: List<MegaRacOperationReceipt>
   transitions: List<MegaRacFirmwareTransition>
-  recoveries: List<MegaRacOperationServedArtifactRecovery>
 }
 
 fn megarac_operation_evidence_of(
   readings: List<MegaRacBuildReading>,
   receipts: List<MegaRacOperationReceipt>,
   transitions: List<MegaRacFirmwareTransition>,
-  recoveries: List<MegaRacOperationServedArtifactRecovery>,
 ) -> MegaRacOperationEvidence
   admit_callers: [
     decl_ref(module_path: "gunbc.machine_intake_megarac_operation_evidence", decl_name: "mtcollins1_megarac_operation_evidence"),
@@ -122,7 +113,7 @@ fn megarac_operation_evidence_of(
     decl_ref(module_path: "test.claim.megarac_managed_host_witness", decl_name: "w_a_current_read_build_with_executed_evidence_is_admitted_by_the_shadow_gate"),
   ]
 {
-  MegaRacOperationEvidence { readings: readings, receipts: receipts, transitions: transitions, recoveries: recoveries }
+  MegaRacOperationEvidence { readings: readings, receipts: receipts, transitions: transitions }
 }
 
 fn megarac_build_reading(endpoint: BmcControllerEndpoint, identity: BmcObservedIdentity, evidence: EvidenceRef, observed_at: EpochMs) -> MegaRacBuildReading
@@ -158,14 +149,6 @@ fn megarac_firmware_transition(endpoint: BmcControllerEndpoint, from: BmcFirmwar
   MegaRacFirmwareTransition { endpoint: endpoint, from: from, to: to, not_before: not_before, not_after: not_after, record: record }
 }
 
-fn megarac_operation_served_artifact_recovery(operation: MegaRacOperation, identity: BmcObservedIdentity, served_by: BmcControllerEndpoint, artifact: NonEmptyStr, capture: ServedArtifactCapture, read_at: EpochMs) -> MegaRacOperationServedArtifactRecovery
-  admit_callers: [
-    decl_ref(module_path: "gunbc.machine_intake_megarac_operation_evidence", decl_name: "mtcollins1_megarac_operation_evidence"),
-  ]
-{
-  MegaRacOperationServedArtifactRecovery { operation: operation, identity: identity, served_by: served_by, artifact: artifact, capture: capture, read_at: read_at }
-}
-
 // ── THE JOIN ─────────────────────────────────────────────────────────────────────────────────────
 
 fn same_controller(a: BmcControllerEndpoint, b: BmcControllerEndpoint) -> Bool {
@@ -200,7 +183,6 @@ fn receipt_joins_reading(evidence: MegaRacOperationEvidence, receipt: MegaRacOpe
 
 type MegaRacOperationGrounding
   = OperationExecutedAtBuild { receipt: MegaRacOperationReceipt, build: MegaRacBuildReading }
-  | OperationRecoveredFromServedArtifact { recovery: MegaRacOperationServedArtifactRecovery }
 
 // ONE OPERATION GROUNDED AT ONE OBSERVED CONTROLLER IDENTITY. sole_constructor and minted only by the
 // join below, so a grounding cannot be authored beside the evidence that would have to produce it.
@@ -211,37 +193,22 @@ type MegaRacOperationStanding sole_constructor {
 }
 
 fn megarac_operation_standings(evidence: MegaRacOperationEvidence) -> List<MegaRacOperationStanding> {
-  concat(
-    flat_map(evidence.receipts, rc =>
-      flat_map(filter(evidence.readings, rd => receipt_joins_reading(evidence: evidence, receipt: rc, reading: rd)), rd =>
-        [MegaRacOperationStanding { operation: rc.operation, identity: rd.identity, grounding: OperationExecutedAtBuild { receipt: rc, build: rd } }])),
-    map(evidence.recoveries, rv =>
-      MegaRacOperationStanding { operation: rv.operation, identity: rv.identity, grounding: OperationRecoveredFromServedArtifact { recovery: rv } }),
-  )
-}
-
-fn grounding_is_executed(g: MegaRacOperationGrounding) -> Bool {
-  match g {
-    OperationExecutedAtBuild { receipt: _, build: _ } => true
-    OperationRecoveredFromServedArtifact { recovery: _ } => false
-  }
-}
-
-fn standing_grounds(standing: MegaRacOperationStanding, operation: MegaRacOperation, identity: BmcObservedIdentity, executed_only: Bool) -> Bool {
-  megarac_operation_eq(a: standing.operation, b: operation) && megarac_identity_eq(a: standing.identity, b: identity) && (!executed_only || grounding_is_executed(g: standing.grounding))
+  flat_map(evidence.receipts, rc =>
+    flat_map(filter(evidence.readings, rd => receipt_joins_reading(evidence: evidence, receipt: rc, reading: rd)), rd =>
+      [MegaRacOperationStanding { operation: rc.operation, identity: rd.identity, grounding: OperationExecutedAtBuild { receipt: rc, build: rd } }]))
 }
 
-fn standings_ground(standings: List<MegaRacOperationStanding>, operation: MegaRacOperation, identity: BmcObservedIdentity, executed_only: Bool) -> Bool {
-  count(filter(standings, st => standing_grounds(standing: st, operation: operation, identity: identity, executed_only: executed_only))) > 0
+fn standing_grounds(standing: MegaRacOperationStanding, operation: MegaRacOperation, identity: BmcObservedIdentity) -> Bool {
+  megarac_operation_eq(a: standing.operation, b: operation) && megarac_identity_eq(a: standing.identity, b: identity)
 }
 
-fn megarac_operation_grounded_at(evidence: MegaRacOperationEvidence, operation: MegaRacOperation, identity: BmcObservedIdentity) -> Bool {
-  standings_ground(standings: megarac_operation_standings(evidence: evidence), operation: operation, identity: identity, executed_only: false)
+fn standings_ground(standings: List<MegaRacOperationStanding>, operation: MegaRacOperation, identity: BmcObservedIdentity) -> Bool {
+  count(filter(standings, st => standing_grounds(standing: st, operation: operation, identity: identity))) > 0
 }
 
-// EXECUTED AT THIS IDENTITY, and only executed: a route recovered from a served artifact does not count.
+// EXECUTED AT THIS IDENTITY.
 fn megarac_operation_executed_at(evidence: MegaRacOperationEvidence, operation: MegaRacOperation, identity: BmcObservedIdentity) -> Bool {
-  standings_ground(standings: megarac_operation_standings(evidence: evidence), operation: operation, identity: identity, executed_only: true)
+  standings_ground(standings: megarac_operation_standings(evidence: evidence), operation: operation, identity: identity)
 }
 
 // ── THE CURRENT BUILD OF A CONTROLLER ────────────────────────────────────────────────────────────
diff --git a/dag/gunbc/host/memory_configuration.dag b/dag/gunbc/host/memory_configuration.dag
index 5b8ffd58cee..d336e9baaad 100644
--- a/dag/gunbc/host/memory_configuration.dag
+++ b/dag/gunbc/host/memory_configuration.dag
@@ -1,10 +1,10 @@
 module gunbc.memory_configuration
 
+import extdeps.board_authority { BoardAuthorityRef }
 import std.types { List, NonEmptyStr }
 import std.measure { ByteSize }
 import std.nat { Nat }
 import std.decl_ref { DeclarationRef }
-import extdeps.boards.types { BaseboardModel }
 import extdeps.memory.types { DramModuleCatalogRow }
 import extdeps.firmware.tianocore_edk2.sdram_spd_ddr4 { SPD4_PRIMARY_SDRAM_PACKAGE_TYPE_STRUCT }
 import product.host_identity { HostIdentity }
@@ -82,7 +82,7 @@ type MemoryFirmwareSetting {
 
 type MemoryPlatform {
   host: HostIdentity
-  board: BaseboardModel
+  board: BoardAuthorityRef
   board_part: DeclarationRef
   processor: DeclarationRef
   firmware: NonEmptyStr
diff --git a/dag/gunbc/host/memory_configuration_evaluation.dag b/dag/gunbc/host/memory_configuration_evaluation.dag
index f7d377411ac..0b09a7571b7 100644
--- a/dag/gunbc/host/memory_configuration_evaluation.dag
+++ b/dag/gunbc/host/memory_configuration_evaluation.dag
@@ -1,11 +1,11 @@
 module gunbc.memory_configuration_evaluation
 
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
 import std.types { Bool, List, NonEmptyStr }
 import std.nat { Nat }
 import std.integer { UInt8 }
 import std.algebra { FreeSemigroup }
 import std.decl_ref { DeclarationRef, decl_ref }
-import extdeps.boards.types { AmpereMtCollins }
 import extdeps.ampere.mt_collins_product_brief.memory_population {
   MtCollinsPopulationRoleRefusal, MtCollinsChannelPopulationRoleStanding,
   PopulationRolesResolved, PopulationRolesRefused, mt_collins_channel_population_roles, mt_collins_socket_dimm_sizes_supported,
@@ -211,7 +211,7 @@ fn memory_firmware_scope_facts(configuration: MemoryConfiguration, read: MemoryM
 }
 
 fn memory_placement_facts(configuration: MemoryConfiguration) -> MemoryCheckFacts {
-  if configuration.platform.board != AmpereMtCollins || count(configuration.population) == 0 {
+  if configuration.platform.board != mt_collins_board_authority || count(configuration.population) == 0 {
     memory_unknown(fact: MemoryModelMissing { obligation: MemoryPlacement })
   } else {
     memory_placement_from_roles(configuration: configuration, standing: mt_collins_channel_population_roles)
@@ -253,7 +253,7 @@ fn memory_catalog_binding_facts(configuration: MemoryConfiguration) -> MemoryChe
 }
 
 fn memory_socket_capacity_facts(configuration: MemoryConfiguration) -> MemoryCheckFacts {
-  if configuration.platform.board != AmpereMtCollins || count(configuration.population) == 0 {
+  if configuration.platform.board != mt_collins_board_authority || count(configuration.population) == 0 {
     memory_unknown(fact: MemoryModelMissing { obligation: MemorySocketCapacity })
   } else {
     let authority = decl_ref(module_path: "extdeps.ampere.mt_collins_product_brief.memory_population", decl_name: "mt_collins_socket_dimm_sizes_supported")
diff --git a/dag/gunbc/host/memory_envelope.dag b/dag/gunbc/host/memory_envelope.dag
new file mode 100644
index 00000000000..ebcefb72bbd
--- /dev/null
+++ b/dag/gunbc/host/memory_envelope.dag
@@ -0,0 +1,148 @@
+module gunbc.memory_envelope
+
+import std.types { Bool, Int, String }
+import std.optional { Present, Absent }
+import gunbc.memory_cgroup_binding {
+  CgroupBindDecision,
+  BindNotRequested,
+  BindUnnecessaryLimitAlreadyBinds,
+  BindApplicable,
+  BindRefused,
+}
+
+// WHAT BOUNDS A `gunbc test` RUN'S MEMORY, DECIDED BEFORE ANY PRODUCER, AS A FOLD OVER SUPPLIED
+// INPUTS -- the sibling of gunbc.memory_cgroup_binding cgroup_bind_decision, and for the same
+// reason: every discriminating case is reachable from a claim on any machine, and the seed
+// (v1_compiler.target_invocation_host) mirrors this module rather than authoring the decision
+// inline over the live environment, where no claim could reach it (review of gunbc#13658, option
+// B: the first version decided inline and admitted a cgroup with no numeric memory.max as a bound,
+// because it located the cgroup by the presence of memory.peak).
+//
+// THE THREE INPUTS. The bind decision the governor already took (gunbc.memory_cgroup_binding); the
+// requirement the invocation carried (gunbc.emitted_subject_build_gate
+// native_step_memory_envelope_env_name, whose one value is the projection below); and whether a
+// NUMERIC memory.max binds this process -- the governor's leaf-to-root walk
+// (memory_governor binding_cap_cgroup_dir), which reads `max` as unset
+// (extdeps.linux.cgroup_v2_memory: the sentinel is a third state, not a large number). Nothing
+// here reads a file; the host reads them and supplies the answers.
+//
+// THE ONE VALUE THE REQUIREMENT CARRIES is `slot`: the step must already sit under a cgroup
+// memory.max -- the fleet slot's (gunbc.runner_slot_desired) -- and its OOM kills and swap are
+// receipted at that grain. A bind the governor applied or found unnecessary bounds the step at a
+// finer grain and satisfies the requirement too.
+type MemoryEnvelopeRequirement
+  = EnvelopeNotRequested
+  | EnvelopeSlotRequired
+  | EnvelopeRequirementUnreadable { raw: String }
+
+fn memory_envelope_slot_requirement_value() -> String {
+  "slot"
+}
+
+// ABSENT AND UNREADABLE ARE DIFFERENT ANSWERS (the same rule as CgroupBindRequest): an unset input
+// is a question nobody asked, a value the binary does not know is a question asked badly, and the
+// second refuses rather than quietly proceeding unrequired.
+fn memory_envelope_requirement_from_text(raw: String?) -> MemoryEnvelopeRequirement {
+  match raw {
+    Absent => EnvelopeNotRequested
+    Present { value: v } =>
+      if v == memory_envelope_slot_requirement_value() { EnvelopeSlotRequired } else { EnvelopeRequirementUnreadable { raw: v } }
+  }
+}
+
+// THE GRAIN A BOUNDED RUN IS RECEIPTED AT: the leaf the bind created (a per-step cgroup), a limit
+// the governor observed already binding the process when a bind was asked, or the slot the gate
+// required. The receipt names it so a reader knows which cgroup's counters it is reading; whether
+// peak_bytes is this step's is decided by the readings (did memory.peak rise during the step), never
+// by the grain, because even the bind's leaf is reused across runs.
+type MemoryEnvelopeGrain
+  = EnvelopeLeaf
+  | EnvelopeExisting
+  | EnvelopeSlot
+
+fn memory_envelope_grain_label(g: MemoryEnvelopeGrain) -> String {
+  match g {
+    EnvelopeLeaf => "leaf"
+    EnvelopeExisting => "existing"
+    EnvelopeSlot => "slot"
+  }
+}
+
+type MemoryEnvelopeRefusalCause
+  = EnvelopeGrainUnknown { raw: String }
+  | EnvelopeAbsent { grain: MemoryEnvelopeGrain }
+
+type MemoryEnvelopeDecision
+  = EnvelopeNotRequired
+  | EnvelopeBounded { grain: MemoryEnvelopeGrain }
+  | EnvelopeRefused { cause: MemoryEnvelopeRefusalCause }
+
+fn envelope_bounded_or_absent(grain: MemoryEnvelopeGrain, numeric_max_binds: Bool) -> MemoryEnvelopeDecision {
+  if numeric_max_binds { EnvelopeBounded { grain: grain } } else { EnvelopeRefused { cause: EnvelopeAbsent { grain: grain } } }
+}
+
+// THE ARM ORDER IS THE POLICY. An unreadable requirement refuses before anything else is consulted.
+// With no requirement, a run is bounded only by a bind the governor applied or found unnecessary,
+// and is otherwise unrequired (an operator-local run measures nothing); with the slot requirement,
+// a run with no bind is bounded by the slot -- but ONLY IF A NUMERIC memory.max BINDS IT, which is
+// the input the first version never asked for. A refused bind reaches no envelope: the line already
+// stopped, and this decision says so rather than inventing one.
+fn memory_envelope_decision(
+  bind: CgroupBindDecision,
+  requirement: MemoryEnvelopeRequirement,
+  numeric_max_binds: Bool
+) -> MemoryEnvelopeDecision {
+  match requirement {
+    EnvelopeRequirementUnreadable { raw: raw } => EnvelopeRefused { cause: EnvelopeGrainUnknown { raw: raw } }
+    EnvelopeNotRequested =>
+      match bind {
+        BindApplicable { bound: _ } => envelope_bounded_or_absent(grain: EnvelopeLeaf, numeric_max_binds: numeric_max_binds)
+        BindUnnecessaryLimitAlreadyBinds { source: _ } => envelope_bounded_or_absent(grain: EnvelopeExisting, numeric_max_binds: numeric_max_binds)
+        BindNotRequested => EnvelopeNotRequired
+        BindRefused { cause: _ } => EnvelopeRefused { cause: EnvelopeAbsent { grain: EnvelopeLeaf } }
+      }
+    EnvelopeSlotRequired =>
+      match bind {
+        BindApplicable { bound: _ } => envelope_bounded_or_absent(grain: EnvelopeLeaf, numeric_max_binds: numeric_max_binds)
+        BindUnnecessaryLimitAlreadyBinds { source: _ } => envelope_bounded_or_absent(grain: EnvelopeExisting, numeric_max_binds: numeric_max_binds)
+        BindNotRequested => envelope_bounded_or_absent(grain: EnvelopeSlot, numeric_max_binds: numeric_max_binds)
+        BindRefused { cause: _ } => EnvelopeRefused { cause: EnvelopeAbsent { grain: EnvelopeLeaf } }
+      }
+  }
+}
+
+// THE VERDICT OVER TWO READINGS OF THE BOUNDING CGROUP, before the producer and at exit. The
+// counters are DIFFERENCES because a slot's cgroup outlives the step: an OOM kill an earlier job
+// suffered is not this step's. Swap is judged three ways. memory.swap.current is a gauge -- swap
+// resident at exit -- and an unreadable gauge is a violation, never a zero. memory.swap.peak is a
+// lifetime maximum, so a rise during the step means swap was charged even if it was freed before
+// exit; on a kernel without that file the rise is UNOBSERVABLE (Absent), which is not "did not
+// rise": it is a violation unless the cgroup's memory.swap.max is zero, because under a zero swap
+// limit no swap can have been charged and the missing counter has nothing to tell, while under any
+// other limit a run that could have swapped and cannot say so is not the envelope the gate names.
+type MemoryEnvelopeVerdict
+  = EnvelopeHeld
+  | EnvelopeViolated { oom_kills_delta: Int, swap_current: Int?, swap_peak_rose: Bool?, swap_max_zero: Bool }
+
+fn memory_envelope_verdict(oom_kills_delta: Int, swap_current: Int?, swap_peak_rose: Bool?, swap_max_zero: Bool) -> MemoryEnvelopeVerdict {
+  let swap_resident = match swap_current {
+    Absent => true
+    Present { value: v } => v > 0
+  }
+  let swap_rose_or_unobservable = match swap_peak_rose {
+    Absent => swap_max_zero == false
+    Present { value: rose } => rose
+  }
+  if oom_kills_delta > 0 || swap_resident || swap_rose_or_unobservable {
+    EnvelopeViolated { oom_kills_delta: oom_kills_delta, swap_current: swap_current, swap_peak_rose: swap_peak_rose, swap_max_zero: swap_max_zero }
+  } else {
+    EnvelopeHeld
+  }
+}
+
+fn memory_envelope_verdict_violates(v: MemoryEnvelopeVerdict) -> Bool {
+  match v {
+    EnvelopeHeld => false
+    EnvelopeViolated { oom_kills_delta: _, swap_current: _, swap_peak_rose: _, swap_max_zero: _ } => true
+  }
+}
diff --git a/dag/gunbc/host/mtcollins_memory_change.dag b/dag/gunbc/host/mtcollins_memory_change.dag
index b5055f734f1..d3eef9cbd7c 100644
--- a/dag/gunbc/host/mtcollins_memory_change.dag
+++ b/dag/gunbc/host/mtcollins_memory_change.dag
@@ -1,12 +1,12 @@
 module gunbc.mtcollins_memory_change
 
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
 import std.types { Bool, String, NonEmptyStr, List }
 import std.integer { UInt8 }
 import extdeps.numeric.base16 { byte_hex_lower }
 import std.process { ProcessExit, ExitSuccess, exit_failure }
 import std.decl_ref { DeclarationRef, decl_ref, decl_field_ref }
 import std.goal_assessment { ObservationAttempt, ObservationEstablished, ObservationRefused }
-import extdeps.boards.types { AmpereMtCollins }
 import extdeps.ampere.mt_collins_product_brief.memory_population {
   MtCollinsChannelPopulationRole, MtCollinsPopulationRoleRefusal,
   PopulationRolesResolved, PopulationRolesRefused, mt_collins_channel_population_roles,
@@ -74,8 +74,8 @@ fn mtcollins_memory_module(position: MemoryPosition, ads: Bool) -> PositionedMem
 // Board identity cites the existing intake observation, not a fabricated vendor catalog.
 fn mtcollins_witnessed_configuration(roles: List<MtCollinsChannelPopulationRole>) -> MemoryConfiguration {
   MemoryConfiguration {
-    platform: MemoryPlatform { host: "mtcollins1" as HostIdentity, board: AmpereMtCollins,
-      board_part: decl_field_ref(module_path: "gunbc.machine_intake_mtcollins1_access_observation", decl_name: "mtcollins1_identity", field_name: "baseboard"),
+    platform: MemoryPlatform { host: "mtcollins1" as HostIdentity, board: mt_collins_board_authority,
+      board_part: decl_field_ref(module_path: "gunbc.machine_intake_mtcollins1_access_observation", decl_name: "mtcollins1_identity", field_name: "board"),
       processor: decl_ref(module_path: "extdeps.cpu.ampere", decl_name: "altra_q8030_catalog"),
       firmware: "210525", settings: [MemoryFirmwareSetting { name: "ecc_en", value: "00000002" }],
     },
diff --git a/dag/gunbc/host/provider_guest_adoption.dag b/dag/gunbc/host/provider_guest_adoption.dag
new file mode 100644
index 00000000000..2ff1208907c
--- /dev/null
+++ b/dag/gunbc/host/provider_guest_adoption.dag
@@ -0,0 +1,289 @@
+module gunbc.provider_guest_adoption
+
+import std.types { Bool, Int, List, NonEmptyStr, String }
+import std.algebra { trim }
+import std.decl_ref { DeclarationRef }
+import std.measure { ByteSize, HardwareThreadCount, Kibibyte, byte_size_count, hardware_thread_count_value, kibibyte_count }
+import extdeps.toolchain.types { Architecture, architecture_diagnostic_name }
+import extdeps.tools.uname { uname_machine_command, uname_nodename_command, uname_linux_machine_architecture }
+import extdeps.posix.getconf { getconf_online_processors_command }
+import extdeps.posix.test_utility { test_exists_command }
+import extdeps.tools.gnu_coreutils { cat_command }
+import extdeps.tools.curl { curl_bounded_get_command }
+import std.measure { second }
+import extdeps.linux.proc_meminfo { MeminfoRead, MeminfoParsed, MeminfoFieldAbsent, parse_proc_meminfo }
+import extdeps.virtualization.firecracker { firecracker_requires_kvm_device }
+import product.host_identity { HostIdentity }
+import gunbc.host_command_binding {
+  CommandHost,
+  LocalCommandHost,
+  HostCommandOutcome,
+  HostCommandDone,
+  HostCommandFailed,
+  HostCommandUnconfirmed,
+  HostCommandNotDispatched,
+  host_command,
+  host_command_outcome_text,
+}
+import gunbc.fleet_host_backing {
+  GuestEntitlement,
+  HostBacking,
+  OwnedMachine,
+  ProviderGuest,
+  ProviderResourceAwaited,
+  ProviderResourceAcquired,
+  backing_microvm_forbidding_offer,
+}
+import gunbc.fleet_enrollment { HostEnrollmentIntent }
+
+// ADOPTING A RENTED GUEST INTO THE FLEET. An owned machine arrives through its own provisioning --
+// BMC credential convergence and a virtual-media OS install -- and a provider guest arrives already
+// installed from the provider's image, so it owes none of that and owes this instead: the exact
+// provider resource is bound, the guest is reached, and what it actually exposes is observed and
+// checked against what the provider's offer entitles. The adoption is the guest's PREFIX in the
+// standup spine (gunbc.host_standup ProviderGuestAdopted); everything after it -- identity, reach,
+// service roles -- is the same shared path every host walks.
+//
+// Two answers come out and they are kept apart. Whether the guest is ADOPTED (it is the host we
+// enrolled, and it is what we are paying for) is one; whether it can RUN the fleet's microVM
+// execution path is another, and a guest can be fully adopted while that path is refused. Folding
+// the second into the first would either refuse a perfectly good machine or admit an execution path
+// that cannot boot -- so the execution standing rides beside the adoption, with its own cause.
+
+// What a running guest reports about itself, read once over the admitted transport.
+type GuestObservation {
+  provider_resource_id: String
+  kernel_hostname: String
+  architecture: Architecture
+  online_cpus: Int
+  mem_total: Kibibyte
+  kvm_device_present: Bool
+}
+
+type GuestObservationRead
+  = GuestObserved { observation: GuestObservation }
+  | GuestObservationRefused { reading: NonEmptyStr, cause: String }
+
+type MicroVmExecutionRefusal
+  = ProviderForbidsNestedVirtualization { offer: DeclarationRef }
+  | KvmDeviceAbsentOnGuest { device: String }
+
+type MicroVmExecutionStanding
+  = MicroVmExecutionAdmissible
+  | MicroVmExecutionRefused { cause: MicroVmExecutionRefusal }
+
+type GuestAdoptionRefusal
+  = HostIsNotAProviderGuest
+  | ProviderResourceUnread { read_obligation: NonEmptyStr }
+  | GuestIsAnotherResource { enrolled: NonEmptyStr, observed: String }
+  | GuestUnobserved { reading: NonEmptyStr, cause: String }
+  | GuestArchitectureDiverges { entitled: Architecture, observed: Architecture }
+  | GuestCpusExceedEntitlement { entitled: Int, observed: Int }
+  | GuestMemoryExceedsEntitlement { entitled_bytes: Int, observed_bytes: Int }
+
+type ProviderGuestAdoption
+  = GuestAdopted { host: HostIdentity, resource_id: NonEmptyStr, observation: GuestObservation, execution: MicroVmExecutionStanding }
+  | GuestAdoptionRefused { host: HostIdentity, cause: GuestAdoptionRefusal }
+
+// THE MICROVM PATH NEEDS A KVM DEVICE INSIDE THE GUEST, and the provider decides first. When the
+// provider's offer says nested virtualization is unavailable, the path is refused on that cited
+// product fact whatever the observation says -- a device node appearing on such a guest would be
+// the anomaly, not a licence. Otherwise the observation decides.
+fn microvm_execution_standing(entitlement: GuestEntitlement, observation: GuestObservation) -> MicroVmExecutionStanding {
+  if !entitlement.nested_virtualization {
+    MicroVmExecutionRefused { cause: ProviderForbidsNestedVirtualization { offer: entitlement.offer } }
+  } else if !observation.kvm_device_present {
+    MicroVmExecutionRefused { cause: KvmDeviceAbsentOnGuest { device: firecracker_requires_kvm_device as String } }
+  } else {
+    MicroVmExecutionAdmissible
+  }
+}
+
+// THE ENTITLEMENT BOUNDS THE OBSERVATION FROM ABOVE. A guest presenting more vCPUs or memory than its
+// offer entitles is not a bonus: it is a guest of a different type than the one enrolled -- the
+// provider resource is not what we think it is -- and admitting it would let capacity planning
+// promise what the bill does not cover. Fewer is ordinary (the kernel reserves memory, and MemTotal
+// is below the offer's figure on every real guest), and the observed figure is what capacity uses.
+fn entitlement_divergence(entitlement: GuestEntitlement, observation: GuestObservation) -> GuestAdoptionRefusal? {
+  let entitled_cpus = hardware_thread_count_value(t: entitlement.vcpus)
+  let entitled_bytes = byte_size_count(entitlement.memory)
+  let observed_bytes = kibibyte_count(observation.mem_total) * 1024
+  if (architecture_diagnostic_name(arch: entitlement.architecture) as String) != (architecture_diagnostic_name(arch: observation.architecture) as String) {
+    Present { value: GuestArchitectureDiverges { entitled: entitlement.architecture, observed: observation.architecture } }
+  } else if observation.online_cpus > entitled_cpus {
+    Present { value: GuestCpusExceedEntitlement { entitled: entitled_cpus, observed: observation.online_cpus } }
+  } else if observed_bytes > entitled_bytes {
+    Present { value: GuestMemoryExceedsEntitlement { entitled_bytes: entitled_bytes, observed_bytes: observed_bytes } }
+  } else {
+    none
+  }
+}
+
+// THE PROVIDER'S ANSWER ALONE, for a consumer that must refuse before anything is observed -- the
+// fabric supply path refuses a guest's microVM supply on this, before it probes a single cell.
+// Absent means the provider does not forbid it (or the host is not a provider guest); the
+// observation, where one is taken, still decides that case.
+fn provider_microvm_refusal(backing: HostBacking) -> MicroVmExecutionRefusal? {
+  match backing_microvm_forbidding_offer(backing: backing) {
+    Present { value: offer } => Present { value: ProviderForbidsNestedVirtualization { offer: offer } }
+    Absent => none
+  }
+}
+
+fn adopt_observed_guest(
+  host: HostIdentity,
+  resource_id: NonEmptyStr,
+  entitlement: GuestEntitlement,
+  read: GuestObservationRead,
+) -> ProviderGuestAdoption {
+  match read {
+    GuestObservationRefused { reading: r, cause: c } =>
+      GuestAdoptionRefused { host: host, cause: GuestUnobserved { reading: r, cause: c } }
+    GuestObserved { observation: o } => if trim(o.provider_resource_id) != (resource_id as String) {
+      GuestAdoptionRefused { host: host, cause: GuestIsAnotherResource { enrolled: resource_id, observed: trim(o.provider_resource_id) } }
+    } else { match entitlement_divergence(entitlement: entitlement, observation: o) {
+      Present { value: refusal } => GuestAdoptionRefused { host: host, cause: refusal }
+      Absent => GuestAdopted {
+        host: host,
+        resource_id: resource_id,
+        observation: o,
+        execution: microvm_execution_standing(entitlement: entitlement, observation: o),
+      }
+    } }
+  }
+}
+
+// The pure decision. The provider resource must be BOUND before anything is observed: an unread
+// resource refuses with its own read obligation, so an observation can never be attributed to a
+// resource nobody identified.
+fn adopt_provider_guest(intent: HostEnrollmentIntent, read: GuestObservationRead) -> ProviderGuestAdoption {
+  match intent.backing {
+    OwnedMachine { provisioning: _ } => GuestAdoptionRefused { host: intent.host, cause: HostIsNotAProviderGuest }
+    ProviderGuest { route: _, entitlement: e, resource: r } => match r {
+      ProviderResourceAwaited { read_obligation: o } =>
+        GuestAdoptionRefused { host: intent.host, cause: ProviderResourceUnread { read_obligation: o } }
+      ProviderResourceAcquired { acquisition: acquired } =>
+        adopt_observed_guest(host: intent.host, resource_id: acquired.resource_id, entitlement: e, read: read)
+    }
+  }
+}
+
+// ── THE OBSERVATION: five reads over the admitted transport ───────────────────────────────────
+
+fn guest_read_stdout(reading: NonEmptyStr, outcome: HostCommandOutcome) -> String? {
+  match outcome {
+    HostCommandDone { stdout: s } => Present { value: trim(s: s) }
+    HostCommandFailed { exit_code: _, stderr: _ } => Absent
+    HostCommandUnconfirmed { exit_code: _, stdout: _, stderr: _ } => Absent
+    HostCommandNotDispatched { reason: _ } => Absent
+  }
+}
+
+fn guest_read_refusal(reading: NonEmptyStr, outcome: HostCommandOutcome) -> GuestObservationRead {
+  GuestObservationRefused { reading: reading, cause: host_command_outcome_text(e: outcome) }
+}
+
+// `test -e` answers presence by EXIT STATUS: 0 present, 1 absent. Any other termination -- the
+// command not dispatched, the reply lost, an unexpected status -- is not an answer, and is refused
+// rather than read as absence.
+fn kvm_presence_of(outcome: HostCommandOutcome) -> Bool? {
+  match outcome {
+    HostCommandDone { stdout: _ } => Present { value: true }
+    HostCommandFailed { exit_code: c, stderr: _ } => if c == 1 { Present { value: false } } else { none }
+    HostCommandUnconfirmed { exit_code: _, stdout: _, stderr: _ } => Absent
+    HostCommandNotDispatched { reason: _ } => Absent
+  }
+}
+
+// THE GUEST'S OWN ANSWER TO "WHICH RESOURCE AM I", read from its provider's metadata service. Shape
+// alone cannot tell two guests of one offer apart, so this is what joins the observation to the
+// enrolled resource; the remaining readings describe the resource that answered here.
+fn observe_provider_guest(host: CommandHost, entitlement: GuestEntitlement) -> GuestObservationRead {
+  let identity_out = host_command(host: host, command: curl_bounded_get_command(url: entitlement.self_identity_url, connect_timeout: second(count: 2), max_time: second(count: 5)))
+  match guest_read_stdout(reading: entitlement.self_identity_url, outcome: identity_out) {
+    Absent => guest_read_refusal(reading: entitlement.self_identity_url, outcome: identity_out)
+    Present { value: id } => observe_provider_guest_shape(host: host, provider_resource_id: id)
+  }
+}
+
+fn observe_provider_guest_shape(host: CommandHost, provider_resource_id: String) -> GuestObservationRead {
+  let machine_out = host_command(host: host, command: uname_machine_command())
+  let nodename_out = host_command(host: host, command: uname_nodename_command())
+  let cpus_out = host_command(host: host, command: getconf_online_processors_command())
+  let meminfo_out = host_command(host: host, command: cat_command(path: "/proc/meminfo"))
+  let kvm_out = host_command(host: host, command: test_exists_command(path: firecracker_requires_kvm_device as String))
+  match guest_read_stdout(reading: "uname -m", outcome: machine_out) {
+    Absent => guest_read_refusal(reading: "uname -m", outcome: machine_out)
+    Present { value: machine } => match uname_linux_machine_architecture(spelling: machine) {
+      Absent => GuestObservationRefused { reading: "uname -m", cause: join(["unread machine name '", machine, "'"], "") }
+      Present { value: arch } => match guest_read_stdout(reading: "uname -n", outcome: nodename_out) {
+        Absent => guest_read_refusal(reading: "uname -n", outcome: nodename_out)
+        Present { value: nodename } => match guest_read_stdout(reading: "getconf _NPROCESSORS_ONLN", outcome: cpus_out) {
+          Absent => guest_read_refusal(reading: "getconf _NPROCESSORS_ONLN", outcome: cpus_out)
+          Present { value: cpus_text } => match parse_int(s: cpus_text) {
+            Absent => GuestObservationRefused { reading: "getconf _NPROCESSORS_ONLN", cause: join(["not an integer: '", cpus_text, "'"], "") }
+            Present { value: cpus } => match guest_read_stdout(reading: "cat /proc/meminfo", outcome: meminfo_out) {
+              Absent => guest_read_refusal(reading: "cat /proc/meminfo", outcome: meminfo_out)
+              Present { value: meminfo_text } => match parse_proc_meminfo(text: meminfo_text) {
+                MeminfoFieldAbsent { field: f } => GuestObservationRefused { reading: "cat /proc/meminfo", cause: join(["field absent: ", f as String], "") }
+                MeminfoParsed { meminfo: m } => match kvm_presence_of(outcome: kvm_out) {
+                  Absent => guest_read_refusal(reading: "test -e /dev/kvm", outcome: kvm_out)
+                  Present { value: kvm } => GuestObserved {
+                    observation: GuestObservation {
+                      provider_resource_id: provider_resource_id,
+                      kernel_hostname: nodename,
+                      architecture: arch,
+                      online_cpus: cpus,
+                      mem_total: m.mem_total,
+                      kvm_device_present: kvm,
+                    },
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+// ── RENDERING AND THE LOCAL ROUTE ─────────────────────────────────────────────────────────────
+
+fn guest_adoption_refusal_text(cause: GuestAdoptionRefusal) -> String {
+  match cause {
+    HostIsNotAProviderGuest => "the host is an owned machine, not a provider guest; it arrives through its own provisioning"
+    ProviderResourceUnread { read_obligation: o } => join(["the provider resource is not bound: ", o as String], "")
+    GuestIsAnotherResource { enrolled: e, observed: o } =>
+      join(["the machine observed reports provider resource '", o, "', not the enrolled ", e as String, "; it is another guest, or the observation ran somewhere other than the named host"], "")
+    GuestUnobserved { reading: r, cause: c } => join(["the guest could not be observed at '", r as String, "': ", c], "")
+    GuestArchitectureDiverges { entitled: e, observed: o } =>
+      join(["the guest reports ", architecture_diagnostic_name(arch: o) as String, " but its offer entitles ", architecture_diagnostic_name(arch: e) as String], "")
+    GuestCpusExceedEntitlement { entitled: e, observed: o } =>
+      join(["the guest presents ", to_string(o), " vCPUs, more than the ", to_string(e), " its offer entitles -- a different resource than the one enrolled"], "")
+    GuestMemoryExceedsEntitlement { entitled_bytes: e, observed_bytes: o } =>
+      join(["the guest presents ", to_string(o), " bytes of memory, more than the ", to_string(e), " its offer entitles"], "")
+  }
+}
+
+fn microvm_execution_refusal_text(cause: MicroVmExecutionRefusal) -> String {
+  match cause {
+    ProviderForbidsNestedVirtualization { offer: o } =>
+      join(["microVM execution refused: the provider offer ", o.module_path as String, ".", o.decl_name as String, " forbids nested virtualization, so no KVM device exists inside the guest"], "")
+    KvmDeviceAbsentOnGuest { device: d } => join(["microVM execution refused: ", d, " is absent on the guest"], "")
+  }
+}
+
+// THE NAMED GUEST, OBSERVED WHERE THIS PROCESS RUNS. The observation is local, and that is safe only
+// because the first reading is the provider's answer to which resource this machine is: run against
+// any machine but the named guest -- another guest, the controller, an operator's laptop -- and the
+// metadata id differs from the enrolled resource (or the service is not there at all), and adoption
+// refuses with that cause. A remote route over the fleet's SSH anchor is a different transport for
+// the same readings, and lands when a consumer needs to adopt a guest from outside it.
+fn adopt_local_provider_guest(intent: HostEnrollmentIntent) -> ProviderGuestAdoption {
+  match intent.backing {
+    OwnedMachine { provisioning: _ } => GuestAdoptionRefused { host: intent.host, cause: HostIsNotAProviderGuest }
+    ProviderGuest { route: _, entitlement: e, resource: _ } =>
+      adopt_provider_guest(intent: intent, read: observe_provider_guest(host: LocalCommandHost, entitlement: e))
+  }
+}
diff --git a/dag/gunbc/host_convergence_census.dag b/dag/gunbc/host_convergence_census.dag
index fe27735eb1a..8b6b122ca71 100644
--- a/dag/gunbc/host_convergence_census.dag
+++ b/dag/gunbc/host_convergence_census.dag
@@ -848,6 +848,15 @@ data host_convergence_census_rows: List<HostConvergenceCensusRow> = [
     disposition: RetainAuthority,
     first_consumer: cite(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "converge_arrival_prefix"),
   ),
+  census_row(
+    identity: cite(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "bmc_secure"),
+    subject: MachineIntakeArrival,
+    phases: protocol_phases(false, true, true, true, false, true, false),
+    current_authority: cite(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "bmc_secure"),
+    persistent_host_effect: ReachesPersistentHostMutation,
+    disposition: RetainAuthority,
+    first_consumer: cite(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "converge_arrival_through_bmc_secure"),
+  ),
 ]
 
 data host_convergence_census_standing: HostConvergenceCensus = admit_host_convergence_census(rows: host_convergence_census_rows)
diff --git a/dag/gunbc/host_names/gen_z.dag b/dag/gunbc/host_names/gen_z.dag
new file mode 100644
index 00000000000..f58d02e7779
--- /dev/null
+++ b/dag/gunbc/host_names/gen_z.dag
@@ -0,0 +1,32 @@
+module gunbc.host_names_gen_z
+
+import std.types { List, NonEmptyStr }
+import extdeps.illumination.minions { minion_first_names }
+
+// THE GEN Z NAMING SCHEME FOR FLEET HOSTS (operator, 2026-10-07: "make a naming module for gen z").
+// A naming scheme is the fleet's own policy, not a fact about the world, so it is authored here and
+// cited nowhere; another scheme is another module beside this one, and gunbc.hostname_allocation
+// imports the one in force. Every entry is a lowercase ASCII letter string, so each is a legal DNS
+// label alone and every hyphenated form is too. THE ORDER IS PART OF THE FACT: a recorded draw
+// (gunbc.hostname_allocation HumanNameDraw) indexes these lists, so editing or reordering an entry
+// changes what an old draw denotes and reds test.claim.hostname_allocation_witness. Grow a list only
+// by appending.
+
+data gen_z_first_parts: List<NonEmptyStr> = [
+  "rizz", "skibidi", "sigma", "bussin", "slay", "yeet", "sus", "vibe", "drip", "goat", "bet",
+  "cap", "sheesh", "delulu", "bae", "lowkey", "highkey", "based", "cringe", "ick", "rent",
+  "boujee", "extra", "salty", "snatched", "tea", "periodt", "fire", "slaps", "bop", "glowup",
+  "npc", "yap", "aura", "mewing", "ate", "bestie", "fam", "valid", "iconic", "hits", "clutch",
+  "zesty", "demure", "mother", "era"
+]
+
+data gen_z_last_parts: List<NonEmptyStr> = [
+  "ohio", "maxxer", "core", "arc", "check", "ratio", "era", "moment", "energy", "vibes", "hours",
+  "behavior", "szn", "fit", "mode", "diaries", "dump", "unlocked", "tok", "pilled", "coded",
+  "posting", "girlboss", "slaps"
+]
+
+// THE FIRST PARTS A DRAW INDEXES: the scheme's own words, then every named Minion
+// (extdeps.illumination.minions, operator 2026-10-08). The Minion names are read from their upstream
+// module, never copied here, and "stan" appears only there.
+data host_name_first_parts: List<NonEmptyStr> = append(gen_z_first_parts, minion_first_names)
diff --git a/dag/gunbc/hostname_allocation.dag b/dag/gunbc/hostname_allocation.dag
index 8b0155845b9..11416ca275c 100644
--- a/dag/gunbc/hostname_allocation.dag
+++ b/dag/gunbc/hostname_allocation.dag
@@ -1,6 +1,6 @@
 module gunbc.hostname_allocation
 
-import std.types { List, Bool, String }
+import std.types { List, Bool, String, Int, NonEmptyStr }
 import std.allocation_roster {
   AllocationAdmission,
   AllocationAdmitted,
@@ -12,11 +12,82 @@ import std.allocation_roster {
 import std.disposition { Disposition, Terminal }
 import product.host_identity { HostIdentity }
 import extdeps.dns.domain_name { DnsLabel }
-import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4, operator_host_mtcollins1 }
+import gunbc.fleet_host_identity {
+  operator_host_srv1,
+  operator_host_srv2,
+  operator_host_srv3,
+  operator_host_srv4,
+  operator_host_mtcollins1,
+  operator_host_srv13,
+  operator_host_srv14,
+  operator_host_srv15,
+  operator_host_srv16,
+  operator_host_183527,
+  operator_host_3dde7f,
+}
+import gunbc.host_names_gen_z { host_name_first_parts, gen_z_last_parts }
+
+// A HUMAN NAME HAS THREE SHAPES AND NO OTHER: a middle part exists only beside a last part, so
+// that invalid state has no constructor rather than a validator. Each part is one DNS label, and the
+// rendered name joins them with "-", which keeps the rendering itself a DNS label.
+type HumanName
+  = FirstOnly { first: DnsLabel }
+  | FirstLast { first: DnsLabel, last: DnsLabel }
+  | FirstMiddleLast { first: DnsLabel, middle: DnsLabel, last: DnsLabel }
+
+// THE DRAW IS RECORDED, AND THE NAME IT YIELDED IS RECORDED BESIDE IT. A name re-derived from its
+// entropy on every read would silently rename every drawn host the day the corpus or the collision
+// set changed, and A3 grounds agreement only on what stays stable across time. So the entropy is
+// the receipt of how the name was chosen, the name is the allocated fact, and
+// test.claim.hostname_allocation_witness re-runs the real allocator over each recorded draw so a
+// recorded name the allocator would not have produced reds rather than standing.
+type HumanNameDraw {
+  entropy: Int
+}
+
+type AllocatedHostName
+  = LegacyHostname { label: DnsLabel }
+  | DrawnHumanName { name: HumanName, draw: HumanNameDraw }
 
 type HostnameAllocation {
   fleet_slot: HostIdentity
-  canonical_hostname: DnsLabel
+  name: AllocatedHostName
+}
+
+fn human_name_canonical_hostname(name: HumanName) -> DnsLabel {
+  match name {
+    FirstOnly { first: f } => f
+    FirstLast { first: f, last: l } => join([f as String, "-", l as String], "") as DnsLabel
+    FirstMiddleLast { first: f, middle: m, last: l } =>
+      join([f as String, "-", m as String, "-", l as String], "") as DnsLabel
+  }
+}
+
+fn allocated_canonical_hostname(allocation: HostnameAllocation) -> DnsLabel {
+  match allocation.name {
+    LegacyHostname { label: l } => l
+    DrawnHumanName { name: n, draw: _ } => human_name_canonical_hostname(name: n)
+  }
+}
+
+// Every spelling a host answers to as a SELECTOR: its stable identity, its allocated hostname, and
+// for a drawn name each shorter form of that same name. The shorter forms are conveniences -- they
+// resolve only when they pick out one host -- while the allocated hostname is the injective key.
+fn human_name_short_forms(name: HumanName) -> List<String> {
+  match name {
+    FirstOnly { first: _ } => []
+    FirstLast { first: f, last: _ } => [f as String]
+    FirstMiddleLast { first: f, middle: _, last: l } =>
+      [f as String, join([f as String, "-", l as String], "")]
+  }
+}
+
+fn allocation_selector_forms(allocation: HostnameAllocation) -> List<String> {
+  let exact = [allocation.fleet_slot as String, allocated_canonical_hostname(allocation: allocation) as String]
+  match allocation.name {
+    LegacyHostname { label: _ } => exact
+    DrawnHumanName { name: n, draw: _ } => append(exact, human_name_short_forms(name: n))
+  }
 }
 
 data gunbc_hostname_allocation_scope_disposition: Disposition = Terminal {
@@ -52,8 +123,8 @@ fn canonical_hostname_in_roster(
     rows: allocations,
     wanted: fleet_slot as String,
     primary: row => row.fleet_slot as String,
-    secondary: row => row.canonical_hostname as String,
-    value: row => row.canonical_hostname,
+    secondary: row => allocated_canonical_hostname(allocation: row) as String,
+    value: row => allocated_canonical_hostname(allocation: row),
   )
 }
 
@@ -63,8 +134,8 @@ fn hostname_allocation_admission(
   build_allocation_roster(
     rows: allocations,
     primary: row => row.fleet_slot as String,
-    secondary: row => row.canonical_hostname as String,
-    value: row => row.canonical_hostname,
+    secondary: row => allocated_canonical_hostname(allocation: row) as String,
+    value: row => allocated_canonical_hostname(allocation: row),
   )
 }
 
@@ -80,26 +151,61 @@ fn hostname_allocation_admission(
 // observation standing exactly where the check that catches fabrication runs -- the guess would
 // have disarmed the instrument it was feeding. The allocation is therefore a decision taken here
 // and consumed there, which is the only ordering in which the check keeps its meaning.
+//
+// THE TWO DRAWN ROWS (2026-10-07) are the Hetzner Cloud CAX41 guests. Their stable identities are
+// opaque (gunbc.fleet_host_identity), so nothing about provider, architecture or role is read off a
+// spelling; their names were DRAWN by draw_human_name over the Gen Z naming scheme (gunbc.host_names_gen_z), with the entropy
+// recorded as the receipt of the draw.
 data gunbc_fleet_hostname_allocations: List<HostnameAllocation> = [
   HostnameAllocation {
     fleet_slot: operator_host_srv1,
-    canonical_hostname: "srv1" as DnsLabel,
+    name: LegacyHostname { label: "srv1" as DnsLabel },
   },
   HostnameAllocation {
     fleet_slot: operator_host_srv2,
-    canonical_hostname: "srv2" as DnsLabel,
+    name: LegacyHostname { label: "srv2" as DnsLabel },
   },
   HostnameAllocation {
     fleet_slot: operator_host_srv3,
-    canonical_hostname: "srv3" as DnsLabel,
+    name: LegacyHostname { label: "srv3" as DnsLabel },
   },
   HostnameAllocation {
     fleet_slot: operator_host_srv4,
-    canonical_hostname: "srv4" as DnsLabel,
+    name: LegacyHostname { label: "srv4" as DnsLabel },
   },
   HostnameAllocation {
     fleet_slot: operator_host_mtcollins1,
-    canonical_hostname: "mtcollins1" as DnsLabel,
+    name: LegacyHostname { label: "mtcollins1" as DnsLabel },
+  },
+  HostnameAllocation {
+    fleet_slot: operator_host_183527,
+    name: DrawnHumanName {
+      name: FirstOnly { first: "damien" as DnsLabel },
+      draw: HumanNameDraw { entropy: 707054856316 },
+    },
+  },
+  HostnameAllocation {
+    fleet_slot: operator_host_3dde7f,
+    name: DrawnHumanName {
+      name: FirstOnly { first: "gus" as DnsLabel },
+      draw: HumanNameDraw { entropy: 821771404468 },
+    },
+  },
+  HostnameAllocation {
+    fleet_slot: operator_host_srv13,
+    name: LegacyHostname { label: "srv13" as DnsLabel },
+  },
+  HostnameAllocation {
+    fleet_slot: operator_host_srv14,
+    name: LegacyHostname { label: "srv14" as DnsLabel },
+  },
+  HostnameAllocation {
+    fleet_slot: operator_host_srv15,
+    name: LegacyHostname { label: "srv15" as DnsLabel },
+  },
+  HostnameAllocation {
+    fleet_slot: operator_host_srv16,
+    name: LegacyHostname { label: "srv16" as DnsLabel },
   },
 ]
 
@@ -109,3 +215,108 @@ fn canonical_hostname_for_fleet_slot(fleet_slot: HostIdentity) -> DnsLabel? {
     fleet_slot: fleet_slot,
   )
 }
+
+// THE DRAW. One entropy value indexes the first-part list for the first part, the last-part list for
+// the last part and the first-part list again for the middle part, so a draw fixes all three forms
+// at once and a collision lengthens the SAME name rather than re-rolling a different one. The
+// shortest form no existing host answers to is allocated -- shorter names while the fleet is small,
+// longer ones only where a collision demands it, with no fleet-size threshold anywhere. A draw whose
+// three forms are all taken refuses and names them; a second entropy value is the remedy, never a
+// numeric suffix that would be a fourth, unmodeled name shape.
+type HumanNameDrawOutcome
+  = HumanNameDrawn { name: HumanName }
+  | HumanNameDrawExhausted { entropy: Int, taken_forms: List<String> }
+  | HumanNameDrawRefused { reason: NonEmptyStr }
+
+fn selector_form_is_taken(taken: List<String>, form: String) -> Bool {
+  any(taken, t => t == form)
+}
+
+fn first_untaken_human_name(
+  forms: List<HumanName>,
+  taken: List<String>,
+  entropy: Int,
+) -> HumanNameDrawOutcome {
+  match filter(forms, f => !selector_form_is_taken(taken: taken, form: human_name_canonical_hostname(name: f) as String)).first() {
+    Present { value: name } => HumanNameDrawn { name: name }
+    Absent => HumanNameDrawExhausted {
+      entropy: entropy,
+      taken_forms: map(forms, f => human_name_canonical_hostname(name: f) as String),
+    }
+  }
+}
+
+fn draw_human_name(draw: HumanNameDraw, existing: List<HostnameAllocation>) -> HumanNameDrawOutcome {
+  let given = host_name_first_parts
+  let surnames = gen_z_last_parts
+  let n = draw.entropy
+  let taken = flat_map(existing, a => allocation_selector_forms(allocation: a))
+  if n < 0 {
+    HumanNameDrawRefused { reason: "a name draw needs non-negative entropy; a negative value has no index into the corpus" }
+  } else {
+    match given.get(index: n % given.length()) {
+      Absent => HumanNameDrawRefused { reason: "the given-name corpus is empty" }
+      Present { value: first } => match surnames.get(index: (n / given.length()) % surnames.length()) {
+        Absent => HumanNameDrawRefused { reason: "the surname corpus is empty" }
+        Present { value: last } => match given.get(index: (n / (given.length() * surnames.length())) % given.length()) {
+          Absent => HumanNameDrawRefused { reason: "the given-name corpus is empty" }
+          Present { value: middle } => first_untaken_human_name(
+            forms: [
+              FirstOnly { first: first as DnsLabel },
+              FirstLast { first: first as DnsLabel, last: last as DnsLabel },
+              FirstMiddleLast { first: first as DnsLabel, middle: middle as DnsLabel, last: last as DnsLabel },
+            ],
+            taken: taken,
+            entropy: n,
+          )
+        }
+      }
+    }
+  }
+}
+
+// RESOLVE ONCE, THEN CARRY THE IDENTITY. An operator selector -- a stable identity, an allocated
+// hostname, or a shorter form of a drawn name -- resolves here to one HostIdentity, and everything
+// after resolution (plan, apply, observation binding) carries that identity, so a rename between plan
+// and apply cannot retarget. An exact match on an identity or allocated hostname wins outright,
+// because those are injective by the roster; a shorter form resolves only when exactly one host
+// answers to it, and otherwise the candidates come back by their full allocated names.
+type HostSelectorResolution
+  = HostSelectorResolved { host: HostIdentity }
+  | HostSelectorAmbiguous { selector: String, candidates: List<DnsLabel> }
+  | HostSelectorUnknown { selector: String }
+
+fn resolution_of_matches(selector: String, matches: List<HostnameAllocation>) -> HostSelectorResolution? {
+  match matches.first() {
+    Absent => Absent
+    Present { value: only } =>
+      if matches.length() == 1 {
+        Present { value: HostSelectorResolved { host: only.fleet_slot } }
+      } else {
+        Present { value: HostSelectorAmbiguous {
+          selector: selector,
+          candidates: map(matches, a => allocated_canonical_hostname(allocation: a)),
+        } }
+      }
+  }
+}
+
+fn resolve_host_selector_in(allocations: List<HostnameAllocation>, selector: String) -> HostSelectorResolution {
+  let exact = filter(allocations, a =>
+    (a.fleet_slot as String) == selector || (allocated_canonical_hostname(allocation: a) as String) == selector
+  )
+  match resolution_of_matches(selector: selector, matches: exact) {
+    Present { value: r } => r
+    Absent => match resolution_of_matches(
+      selector: selector,
+      matches: filter(allocations, a => selector_form_is_taken(taken: allocation_selector_forms(allocation: a), form: selector)),
+    ) {
+      Present { value: r } => r
+      Absent => HostSelectorUnknown { selector: selector }
+    }
+  }
+}
+
+fn resolve_host_selector(selector: String) -> HostSelectorResolution {
+  resolve_host_selector_in(allocations: gunbc_fleet_hostname_allocations, selector: selector)
+}
diff --git a/dag/gunbc/instrument_targets.dag b/dag/gunbc/instrument_targets.dag
index 9eac68a8296..08b2356d41f 100644
--- a/dag/gunbc/instrument_targets.dag
+++ b/dag/gunbc/instrument_targets.dag
@@ -50,7 +50,7 @@ import gunbc.target_binding {
   DifferentialReadingExecutionRefused, DifferentialObservationAssemblyRefused,
   BareReferenceChannelOutcomeProducer,
   SelfHostBehavioralEquivalenceProducer,
-  V2NativeCensusProducer, ResolveRefusalReading, TypeDeclarationUseReading,
+  V2NativeCensusProducer, RefusalCensusReading, TypeDeclarationUseReading,
   DependencyDemandCensusProducer,
   GenericIdentityCensusProducer,
   InterpolationHoleCensusProducer,
@@ -259,14 +259,19 @@ fn v2_native_frontier_label() -> Label {
   Label { package: instruments_package() target: TargetName { name: "v2-native-frontier" } }
 }
 
-// THE NATIVE CENSUS INSTRUMENT: the emitted compiler's `census-resolve` verb over the self-host
-// corpus, every front-end and resolve refusal GROUPED BY THE FATAL REASON
-// (v2.compiler.compile native_census_cause_groups_add) with the head kept as a member field. An
-// import cascade is collapsed to its root (census C): each cascaded module is one member under the
-// root's reason, and the roots are ranked by closure fan-out (native_census_roots_ranked). It is
-// THE route to that census: the binary's `census` / `census-resolve` verbs remain only as this row's
-// realization and are not a second documented peer route, which is the --self-host precedent this
-// file states for `//gunbc/instruments:self-host` (DESIGN section 3, Building & checks).
+// THE NATIVE CENSUS INSTRUMENT: the emitted compiler's `census-infer` verb over the self-host
+// corpus (census part 2, docs/plans/census-part-2-inference-design.md section 6: the same label,
+// reaching one more stage). Every front-end, resolve and infer refusal is GROUPED BY THE FATAL REASON
+// (v2.compiler.compile native_census_cause_groups_add), with the stage and head kept as member
+// fields. An import cascade is collapsed to its root (census C): each cascaded module is one member
+// under the root's reason. At infer the only cascade is a refused closure provider leading an
+// importer's chain (native_census_infer_cascade). The roots are ranked by closure fan-out
+// (native_census_roots_ranked), and each is marked against the native test target's closure
+// (native_census_subject_closure). The receipt's stderr names the host memory budget's source. It is
+// THE route to that census: the binary's `census` / `census-resolve` / `census-infer` verbs remain
+// only as this row's realization and are not a second documented peer route, which is the
+// --self-host precedent this file states for `//gunbc/instruments:self-host` (DESIGN section 3,
+// Building & checks).
 // IT IS A REPORT, AND ITS VERDICT SAYS ONLY THAT: a census that completed is held, and a run that
 // printed no complete terminal is the subject unreached. It has NO did-not-hold arm on purpose. A
 // partition check (members summed over groups == rows reported) was tried and withdrawn in review
@@ -287,7 +292,7 @@ fn type_declaration_use_census_label() -> Label {
 }
 
 // THE EMITTED CLOSURE AS A MULTI-CRATE WORKSPACE (Pkg7e). The seed emits `v2.compiler.compile`'s
-// closure, `v2.workflow.emitted_crate_workspace` `emitted_workspace_plan` partitions it into crate
+// closure, `gunbc.emitted_crate_workspace` `emitted_workspace_plan` partitions it into crate
 // rows from the derived module DAG, the emission's returned edges and the transitive unit
 // dependencies, `v1.compiler.stage0_crates` renders those rows with the one partition renderer,
 // and cargo builds the workspace -- the POSITIVE CONTROL. In the same invocation one derived
@@ -643,7 +648,7 @@ fn type_declaration_use_census_binding() -> TargetBinding {
 }
 
 fn v2_native_census_binding() -> TargetBinding {
-  TargetBinding { target: v2_native_census_label() producer: V2NativeCensusProducer { reading: ResolveRefusalReading } }
+  TargetBinding { target: v2_native_census_label() producer: V2NativeCensusProducer { reading: RefusalCensusReading } }
 }
 
 fn v2_native_frontier_binding() -> TargetBinding {
diff --git a/dag/gunbc/instruments/dag_compile_clean_shard_totality.dag b/dag/gunbc/instruments/dag_compile_clean_shard_totality.dag
index 8028c3f9324..acf4647aef6 100644
--- a/dag/gunbc/instruments/dag_compile_clean_shard_totality.dag
+++ b/dag/gunbc/instruments/dag_compile_clean_shard_totality.dag
@@ -97,7 +97,11 @@ fn witness_totality_reds_on_synthetic_orphan() -> Bool {
   )
   match verdict {
     PartitionOrphan { unclaimed_paths: paths } =>
-      list_length(items: paths) == 1 && paths.first() == "dag/std/orphan_not_in_roster.dag"
+      list_length(items: paths) == 1
+        && match paths.first() {
+          Present { value: p } => p == "dag/std/orphan_not_in_roster.dag"
+          Absent => false
+        }
     PartitionTotal { module_count: _ } => false
     PartitionDuplicateClaim { duplicated_paths: _ } => false
     PartitionSurplusClaim { surplus_paths: _ } => false
@@ -114,7 +118,11 @@ fn witness_totality_reds_on_synthetic_double_claim() -> Bool {
   )
   match verdict {
     PartitionDuplicateClaim { duplicated_paths: paths } =>
-      list_length(items: paths) == 1 && paths.first() == "dag/std/logic.dag"
+      list_length(items: paths) == 1
+        && match paths.first() {
+          Present { value: p } => p == "dag/std/logic.dag"
+          Absent => false
+        }
     PartitionTotal { module_count: _ } => false
     PartitionOrphan { unclaimed_paths: _ } => false
     PartitionSurplusClaim { surplus_paths: _ } => false
@@ -132,7 +140,11 @@ fn witness_totality_reds_on_synthetic_surplus() -> Bool {
   )
   match verdict {
     PartitionSurplusClaim { surplus_paths: paths } =>
-      list_length(items: paths) == 1 && paths.first() == "dag/std/phantom_not_in_glob.dag"
+      list_length(items: paths) == 1
+        && match paths.first() {
+          Present { value: p } => p == "dag/std/phantom_not_in_glob.dag"
+          Absent => false
+        }
     PartitionTotal { module_count: _ } => false
     PartitionOrphan { unclaimed_paths: _ } => false
     PartitionDuplicateClaim { duplicated_paths: _ } => false
diff --git a/dag/gunbc/instruments/dag_emit_real_grammar_round_trips.dag b/dag/gunbc/instruments/dag_emit_real_grammar_round_trips.dag
index f6dfe9fcf3b..906d7c5eeda 100644
--- a/dag/gunbc/instruments/dag_emit_real_grammar_round_trips.dag
+++ b/dag/gunbc/instruments/dag_emit_real_grammar_round_trips.dag
@@ -4,10 +4,10 @@ import std.types { String, List, Bool }
 import v2.std.algebra { filter }
 import std.compiler_entry { CompilerEntryDriver, NativeClaimDriver, NativeClaimReport, NativeClaimTerminal, NativeClaimHeld, NativeClaimNotHeld }
 import v2.compiler.parse { PreparedGrammar, parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize, tokenize_prepared }
 import v2.extdeps.languages.dag { dag_emit_parse_tree, dag_lex }
-import v2.std.diagnostic { Accepted, Diagnostics, NonEmptyDiagnostics, Outcome, Rejected, bind_outcome }
+import v2.std.diagnostic { Accepted, NonEmptyDiagnostics, Outcome, Rejected, bind_outcome, Diagnostics }
 import v2.std.fn_index { non_empty_diagnostics_list }
 import v2.std.node { Node, content_hash, symbol_lexeme }
 
@@ -38,11 +38,11 @@ type DagEmitRoundTripRow {
 }
 
 // The grammar is prepared once per round trip and both ingests read it.
-fn dag_round_trip_parse(prepared: PreparedGrammar, residue: Diagnostics, text: String) -> Outcome<Node> {
+fn dag_round_trip_parse(prepared: PreparedGrammar, text: String) -> Outcome<Node> {
   bind_outcome(
-    o: tokenize(text: text, file: ^dag_emit_round_trip_source, rules: dag_lex()),
+    o: tokenize_prepared(text: text, file: ^dag_emit_round_trip_source, prepared: dag_prepared_lex()),
     f: fn(stream) {
-      match parse_module_prepared(tokens: stream, prepared: prepared, validation_residue: residue) {
+      match parse_module_prepared(tokens: stream, prepared: prepared) {
         Rejected { diagnostics: r } => Rejected { diagnostics: r }
         Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
       }
@@ -59,14 +59,14 @@ fn dag_round_trip_refused(stage: String, d: NonEmptyDiagnostics) -> String {
 fn dag_round_trip_observed(text: String) -> String {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => dag_round_trip_refused(stage: "grammar preparation", d: d)
-    Accepted { value: prepared, diagnostics: residue } =>
-      match dag_round_trip_parse(prepared: prepared, residue: residue, text: text) {
+    Accepted { value: prepared, diagnostics: _ } =>
+      match dag_round_trip_parse(prepared: prepared, text: text) {
         Rejected { diagnostics: d } => dag_round_trip_refused(stage: "first ingest", d: d)
         Accepted { value: tree, diagnostics: _ } =>
           match dag_emit_parse_tree(tree: tree) {
             Rejected { diagnostics: d } => dag_round_trip_refused(stage: "emit", d: d)
             Accepted { value: emitted, diagnostics: _ } =>
-              match dag_round_trip_parse(prepared: prepared, residue: residue, text: emitted) {
+              match dag_round_trip_parse(prepared: prepared, text: emitted) {
                 Rejected { diagnostics: d } => dag_round_trip_refused(stage: "re-ingest", d: d)
                 Accepted { value: again, diagnostics: _ } =>
                   if content_hash(n: tree) == content_hash(n: again) { "same" } else { concat("trees differ: ", emitted) }
diff --git a/dag/gunbc/instruments/docs_projection_gate.dag b/dag/gunbc/instruments/docs_projection_gate.dag
index 3a38c760916..ada58c232d0 100644
--- a/dag/gunbc/instruments/docs_projection_gate.dag
+++ b/dag/gunbc/instruments/docs_projection_gate.dag
@@ -4,7 +4,7 @@ import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
 import extdeps.filesystem.filesystem_io { Filesystem, filesystem_read_outcome, FilesystemReadSucceeded, FilesystemReadRefused }
 import gunbc.design_ledgers { expected_design_failure_modes_md, expected_design_rung_drops_md }
 import gunbc.contributor_onboarding_path { expected_contributor_onboarding_md }
-import gunbc.generated_artifact { GeneratedArtifact, artifact_path, artifact_location, artifact_is_committed, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, FileTransportRealizationGeneratedRsArtifact, Fci1BoundedExecutionContextArtifact, AutoinstallUserDataArtifact, RunnerHostSudoersArtifact, PlanArtifact, CouponCadQueryProgramArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact }
+import gunbc.generated_artifact { GeneratedArtifact, artifact_path, artifact_location, artifact_is_committed, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, BranchRunGrantBrokerWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, FileTransportRealizationGeneratedRsArtifact, Fci1BoundedExecutionContextArtifact, AutoinstallUserDataArtifact, RunnerHostSudoersArtifact, PlanArtifact, CouponCadQueryProgramArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact }
 import gunbc.generated_artifact_registry { generated_artifact_registry }
 import std.optional { Optional, Absent, Present }
 import tools.docs_projection_agreement { docs_projection_bytes_agree }
@@ -50,7 +50,7 @@ fn docs_projection_producer(a: GeneratedArtifact) -> Optional<String> {
     MicrovmShakedownYamlArtifact => Absent
     InstrumentDispatchYamlArtifact => Absent
     HealWorkflowYamlArtifact => Absent
-    HealPublisherWorkflowYamlArtifact => Absent
+    BranchRunGrantBrokerWorkflowYamlArtifact => Absent
     GitignoreArtifact => Absent
     GitattributesArtifact => Absent
     CargoConfigArtifact => Absent
diff --git a/dag/gunbc/instruments/emit_host_fixtures.dag b/dag/gunbc/instruments/emit_host_fixtures.dag
index 452bded96da..baa0e926936 100644
--- a/dag/gunbc/instruments/emit_host_fixtures.dag
+++ b/dag/gunbc/instruments/emit_host_fixtures.dag
@@ -1,6 +1,7 @@
 module tools.emit_host_fixtures
 
 import std.measure { ByteSize, byte_size }
+import std.integer { int_to_decimal_string }
 
 data rust_stdout_fixture_source: String = "fn main() { let _ = std::io::Write::write_all(&mut std::io::stdout(), &[0u8; 5]); }"
 
@@ -15,7 +16,7 @@ data ts_host_fixture_right_operand: Int = 3
 data ts_host_fixture_expected_sum: Int = ts_host_fixture_left_operand + ts_host_fixture_right_operand
 
 data ts_host_fixture_harness_suffix: String = "
-const __gunbc_r = add({ts_host_fixture_left_operand}, {ts_host_fixture_right_operand});
+const __gunbc_r = add({int_to_decimal_string(value: ts_host_fixture_left_operand)}, {int_to_decimal_string(value: ts_host_fixture_right_operand)});
 const __gunbc_b = Buffer.alloc(4);
 __gunbc_b.writeInt32LE(__gunbc_r, 0);
 process.stdout.write(__gunbc_b);
diff --git a/dag/gunbc/instruments/emit_host_transport.dag b/dag/gunbc/instruments/emit_host_transport.dag
index 84747bff561..aa1ae4c0e67 100644
--- a/dag/gunbc/instruments/emit_host_transport.dag
+++ b/dag/gunbc/instruments/emit_host_transport.dag
@@ -43,10 +43,13 @@ import tools.emit_host_fixtures {
   ts_signed_i32_le_byte_count
 }
 import gunbc.node_http_server_emit { gunbhub_node_http_server_source }
+import v2.std.orchestration { EnvSet }
 import extdeps.posix.process
 import extdeps.posix.signal
 import extdeps.http.client
 import extdeps.tools.sleep
+import extdeps.exec.command { env_prefixed_command_in }
+import extdeps.tools.node { node_run_file_command, node_program }
 import extdeps.numeric.base16
 import std.content_hash { content_hash_atom }
 import v2.std.collection { list_at_optional }
@@ -271,15 +274,22 @@ fn run_node_http_serve_smoke() -> Bool {
     Absent => false
     Present { value: port } => {
       let server_js = Filesystem.Write(path: concat(dir.path, "/server.js"), content: gunbhub_node_http_server_source())
-      let spawn = posix.Process.StartDetached(
-        program: "env" as NonEmptyStr,
-        arguments: [
-          "-C", dir.path,
-          "HOST=127.0.0.1",
-          concat("PORT=", to_string(port)),
-          "node",
-          concat(dir.path, "/server.js")
+      let inner_cmd = node_run_file_command(
+        node_binary: node_program().invocation,
+        script_path: concat(dir.path, "/server.js") as NonEmptyStr,
+        operands: []
+      )
+      let prefixed_cmd = env_prefixed_command_in(
+        directory: dir.path,
+        bindings: [
+          EnvSet { name: "HOST", value: "127.0.0.1" },
+          EnvSet { name: "PORT", value: to_string(port) }
         ],
+        command: inner_cmd
+      )
+      let spawn = posix.Process.StartDetached(
+        program: prefixed_cmd.program.invocation,
+        arguments: prefixed_cmd.arguments,
         stdout_file: concat(dir.path, "/server.stdout.log") as NonEmptyStr,
         stderr_file: concat(dir.path, "/server.stderr.log") as NonEmptyStr
       )
diff --git a/dag/gunbc/instruments/emitted_crate_harness_manifest.dag b/dag/gunbc/instruments/emitted_crate_harness_manifest.dag
index 17c8bf9e692..281ddbe3dbf 100644
--- a/dag/gunbc/instruments/emitted_crate_harness_manifest.dag
+++ b/dag/gunbc/instruments/emitted_crate_harness_manifest.dag
@@ -7,8 +7,9 @@ import v2.std.text { String }
 
 // A HARNESS MANIFEST IS THE EMITTED MANIFEST PLUS WHAT THE HARNESS ITSELF ADDS, AND NOTHING ELSE.
 //
-// The emitter writes Cargo.toml into the crate directory from the dependency demand of what it
-// emitted (v1.compiler.emit_rust emit_cargo_toml over EmittedCrateDependencyDemand). Every harness
+// The emission's Cargo workspace carries, at its root, the top package's Cargo.toml, rendered from
+// the dependency demand of what it emitted (v1.compiler.stage0_crates emitted_crate_dependencies,
+// written by cli_run::emitted_crate_workspace_host write_emitted_workspace). Every harness
 // that then builds that crate used to OVERWRITE the file with its own literal [dependencies]
 // roster, so one question -- what does this emitted crate link -- had one answer per harness, and
 // a dependency the emitted runtime gained reached a harness only when someone remembered to copy
diff --git a/dag/gunbc/instruments/fabric_capacity_standing.dag b/dag/gunbc/instruments/fabric_capacity_standing.dag
index 97b0b16d936..8d5efd09afc 100644
--- a/dag/gunbc/instruments/fabric_capacity_standing.dag
+++ b/dag/gunbc/instruments/fabric_capacity_standing.dag
@@ -7,7 +7,7 @@ import std.algebra { trim }
 import std.checked_arithmetic { checked_int_magnitude, CheckedNatReady, CheckedNatOverflow }
 import std.measure { TokenCount, token_count, concurrent_request_hundredths, AllocatorBlockCount, allocator_block_count }
 import std.process { ProcessExit, ExitSuccess, exit_failure }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_wire }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire }
 import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest }
 import product.host_identity { HostIdentity }
 import gunbc.spark.pair_serving_authority {
diff --git a/dag/gunbc/instruments/fabric_seat_probe.dag b/dag/gunbc/instruments/fabric_seat_probe.dag
index 643e939fffe..1b4e8dbe30c 100644
--- a/dag/gunbc/instruments/fabric_seat_probe.dag
+++ b/dag/gunbc/instruments/fabric_seat_probe.dag
@@ -16,7 +16,7 @@ import product.capacity.pool_events {
 import product.capacity.lease { LeasePolicy, QuiescenceRequired }
 import gunbc.harness.harness_wire { OpenAiChatCompletionsShape }
 import gunbc.harness.harness_seat { harness_turn_request,
-  HarnessSeatBound, HarnessSeatPending, HarnessSeatRefused, harness_bind_seat, HarnessSeatReleased,
+  HarnessSeatBound, HarnessSeatPending, HarnessSeatRefused, HarnessHostedBound, harness_bind_seat, HarnessSeatReleased, HarnessHostedCredentialRemoved,
   HarnessSeatReleaseRefused, harness_release_seat, harness_seat_release_wire, harness_now_epoch,
   AnyAdmittedModel,
 }
@@ -62,6 +62,7 @@ fn fabric_seat_probe(receipt: NonEmptyStr) -> ProcessExit {
   match binding {
     HarnessSeatRefused { detail: d } => exit_failure(reason: join(["seat probe: bind refused: ", d], ""))
     HarnessSeatPending { detail: d } => exit_failure(reason: join(["seat probe: placement pending: ", d], ""))
+    HarnessHostedBound { url: _, model: _, unit: _, level: _, access: _ } => exit_failure(reason: "seat probe: an any-model bind answered with a hosted binding, which harness_requirement_placement never yields")
     HarnessSeatBound { url: u, grant: g, partition: p, ceiling: _, group_wire: gw, launch: launch, store: _, model: m, unit: _, class: c, seat: _ } => {
       let line = join([
         "host=", short, " group=", gw, " launch=", launch.process_start_field as String,
@@ -73,6 +74,7 @@ fn fabric_seat_probe(receipt: NonEmptyStr) -> ProcessExit {
       let seat_release = harness_release_seat(binding: binding, reason: "seat-probe complete" as NonEmptyStr)
       let w = Filesystem.Write(path: receipt as String, content: join([line, harness_seat_release_wire(r: seat_release), "\n"], ""))
       match seat_release {
+        HarnessHostedCredentialRemoved => exit_failure(reason: "seat probe: a fleet seat release answered as a hosted credential removal")
         HarnessSeatReleased { partition: _ } => if w.success { ExitSuccess } else { exit_failure(reason: join(["seat probe: receipt write failed: ", w.error], "")) }
         HarnessSeatReleaseRefused { detail: d } => exit_failure(reason: join(["seat probe: granted but release refused: ", d], ""))
       }
diff --git a/dag/gunbc/instruments/frontier_ingestion_probe.dag b/dag/gunbc/instruments/frontier_ingestion_probe.dag
index 5f539b9746d..f07c204d843 100644
--- a/dag/gunbc/instruments/frontier_ingestion_probe.dag
+++ b/dag/gunbc/instruments/frontier_ingestion_probe.dag
@@ -7,7 +7,7 @@ import v2.std.node { Symbol }
 import std.content_hash { ContentHash, content_hash_atom, content_hash_combine_structural, as_content_hash_structural }
 import std.types { NonEmptyStr, List }
 import v2.std.grammar { ParseTree }
-import v2.std.diagnostic { Diagnostic, Diagnostics, NonEmptyDiagnostics, Accepted, Rejected, None }
+import v2.std.diagnostic { Diagnostic, NonEmptyDiagnostics, Accepted, Rejected, None }
 import v2.std.compilers.lexing { lex_artifact_semantic_tokens, LexRuleSet, LexArtifact }
 import v2.compiler.tokenize { lex_walk_artifact }
 import v2.compiler.parse { parse_module_prepared, prepare_grammar, PreparedGrammar, ParseArtifact }
@@ -214,18 +214,16 @@ fn classify_normalize_diagnostics(d: NonEmptyDiagnostics) -> FrontendStage {
 type FrontendWorld {
   lex_rules: LexRuleSet,
   prepared: PreparedGrammar,
-  validation_residue: Diagnostics,
 }
 
 fn prepare_frontend_world() -> v2.std.diagnostic.Outcome<FrontendWorld> {
   match prepare_grammar(grammar: dag_grammar()) {
     v2.std.diagnostic.Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    v2.std.diagnostic.Accepted { value: prepared, diagnostics: residue } =>
+    v2.std.diagnostic.Accepted { value: prepared, diagnostics: _ } =>
       Accepted {
         value: FrontendWorld {
           lex_rules: dag_lex_rules(),
           prepared: prepared,
-          validation_residue: residue,
         },
         diagnostics: None,
       }
@@ -234,13 +232,11 @@ fn prepare_frontend_world() -> v2.std.diagnostic.Outcome<FrontendWorld> {
 
 fn classify_after_lex(
   prepared: PreparedGrammar,
-  residue: Diagnostics,
   artifact: LexArtifact
 ) -> FrontendStage {
   match parse_module_prepared(
     tokens: lex_artifact_semantic_tokens(artifact: artifact),
-    prepared: prepared,
-    validation_residue: residue
+    prepared: prepared
   ) {
     v2.std.diagnostic.Rejected { diagnostics: _ } => ParseRefused
     v2.std.diagnostic.Accepted { value: parsed, diagnostics: _ } =>
@@ -255,7 +251,7 @@ fn classify_source_in(world: FrontendWorld, source: String) -> FrontendStage {
   match lex_walk_artifact(source: chars(s: source), file: ^frontier_probe, rules: world.lex_rules) {
     v2.std.diagnostic.Rejected { diagnostics: _ } => LexRefused
     v2.std.diagnostic.Accepted { value: a, diagnostics: _ } =>
-      classify_after_lex(prepared: world.prepared, residue: world.validation_residue, artifact: a)
+      classify_after_lex(prepared: world.prepared, artifact: a)
   }
 }
 
@@ -279,9 +275,9 @@ fn classify_source(source: String) -> v2.std.diagnostic.Outcome<FrontendStage> {
     v2.std.diagnostic.Accepted { value: a, diagnostics: _ } =>
       match prepare_grammar(grammar: dag_grammar()) {
         v2.std.diagnostic.Rejected { diagnostics: d } => Rejected { diagnostics: d }
-        v2.std.diagnostic.Accepted { value: prepared, diagnostics: residue } =>
+        v2.std.diagnostic.Accepted { value: prepared, diagnostics: _ } =>
           Accepted {
-            value: classify_after_lex(prepared: prepared, residue: residue, artifact: a),
+            value: classify_after_lex(prepared: prepared, artifact: a),
             diagnostics: None,
           }
       }
diff --git a/dag/gunbc/instruments/instrument_dispatch_workflow.dag b/dag/gunbc/instruments/instrument_dispatch_workflow.dag
index b6cba720031..ea6c1bf7aa9 100644
--- a/dag/gunbc/instruments/instrument_dispatch_workflow.dag
+++ b/dag/gunbc/instruments/instrument_dispatch_workflow.dag
@@ -126,9 +126,9 @@ data instrument_dispatch_timeout_minutes: Int = 240
 // receipt is taken on purpose (gunbc.self_host_behavioral_equivalence_receipt), never per change.
 // The type-declaration-use census (the nominal-type plan's M0) is another: it emits and builds the
 // compiler, then resolves and infers the whole corpus, past any per-change lane and the same hour cap.
-// The native resolve census is another: `census-resolve` emits and builds the compiler closure and then
-// resolves every indexed module, which outlives the free remote runner's one-hour cap twice over, and
-// its saved whole-tree receipt is what the resolve-frontier root ranking and the census lane's step D
+// The native refusal census is another: `census-infer` emits and builds the compiler closure and then
+// resolves and infers every indexed module, which outlives the free remote runner's one-hour cap twice
+// over, and its saved whole-tree receipt is what the frontier root ranking and the census lane's step D
 // read. The stage0 regen round's price is another: a seed build plus a whole-population emit and a
 // one-mirror emit, which needs a memory-bounded slot the free remote runner does not expose (its
 // host budget is unreadable there and the run refuses). A dispatchable label is on-demand only; it
diff --git a/dag/gunbc/instruments/native_emission_controls.dag b/dag/gunbc/instruments/native_emission_controls.dag
index 83958efe5cd..1ebbd024048 100644
--- a/dag/gunbc/instruments/native_emission_controls.dag
+++ b/dag/gunbc/instruments/native_emission_controls.dag
@@ -1,7 +1,7 @@
 module gunbc.instruments.native_emission_controls
 
 import std.types { Bool, Int, List, NonEmptyStr, Set, String }
-import v2.std.algebra { filter }
+import v2.std.algebra { filter, length }
 import std.list { duplicated_by_key }
 import gunbc.instruments.native_emission_controls_homonym { ControlBoxed, narrow_slot_value, narrow_slots_equal }
 import std.resource_contract { Observation, Read }
@@ -247,6 +247,38 @@ fn filter_in_branch_condition_cases() -> List<NativeEmissionCase> {
   ]
 }
 
+// RULE: a data row keeps its declared `?`, in its signature and in its body (v1.compiler.emit_rust
+// emit_data_def's named-refinement arm; v1.compiler.emit emit_optional_data_value_json). A
+// where-refinement such as NonEmptyStr took the one arm of emit_data_def with no optional wrap, so
+// gunbc.fleet_tailnet fleet_tailnet_domain (`NonEmptyStr? = Present { .. }`) was emitted
+// `-> NonEmptyStr`; and the JSON body spelled Present as a tagged map the native option cannot
+// parse.
+// Both optional rows pass through a `T?`-typed parameter, so a dropped `?` stops this closure
+// compiling, and a wrong body stops it at run time; the cases decide each row answers as declared.
+data control_optional_brand_present: NonEmptyStr? = Present { value: "tailnet.example" }
+
+data control_optional_brand_absent: NonEmptyStr? = none
+
+fn control_optional_brand_value(d: NonEmptyStr?) -> String {
+  match d {
+    Present { value: v } => v
+    Absent => ""
+  }
+}
+
+fn optional_data_row_cases() -> List<NativeEmissionCase> {
+  [
+    NativeEmissionCase {
+      identity: "optional_data_row_present_answers_its_value",
+      held: control_optional_brand_value(d: control_optional_brand_present) == "tailnet.example"
+    },
+    NativeEmissionCase {
+      identity: "optional_data_row_red_absent_answers_absent",
+      held: control_optional_brand_value(d: control_optional_brand_absent) == ""
+    }
+  ]
+}
+
 // RULE: a data row takes the JSON serializer only when its value is a literal tree
 // (v1.compiler.emit_rust data_value_is_json_literal_tree). A `"x" as NonEmptyStr` brand cast, bare or
 // inside a record literal, and an operator inside a record literal used to reach the serializer and
@@ -350,7 +382,7 @@ fn list_index_cases() -> List<NativeEmissionCase> {
 }
 
 // RULE: the NativeClaimDriver binds its declared Filesystem resource (std.compiler_entry
-// NativeClaimDriver; v1.compiler.emit_rust native_claim_report_effect_demand). Reaching Filesystem
+// NativeClaimDriver; v1.compiler.emit NativeEffectRealizationAdmission under native_claim_route_denominator). Reaching Filesystem
 // makes native_claim_report effectful, so this whole program runs only if the rendered main binds
 // the filesystem_io handler and awaits the report: remove the binding and the main calls an async,
 // handler-taking report with neither, which rustc refuses -- the red is the label's, not a row's.
@@ -417,6 +449,47 @@ fn effectful_fold_step_cases() -> List<NativeEmissionCase> {
   ]
 }
 
+// RULE: a type parameter carries its own cardinality (v1.compiler.emit_rust rust_carrier_optional_wrap,
+// gunbc.recurring_failure_mode optional_type_parameter_emitted_without_its_cardinality). `get: K?` on a
+// generic record emitted `pub get: K`, so an Absent had no representation and this carrier's
+// construction with Absent did not compile -- the red is the label's. The cases read the field back
+// both ways, and each has a red asking for an answer it does not give.
+type ControlOptionalParam<K> {
+  get: K?
+  pair: K
+}
+
+fn control_optional_param_absent() -> ControlOptionalParam<Int> {
+  ControlOptionalParam { get: Absent, pair: 1 }
+}
+
+fn control_optional_param_present() -> ControlOptionalParam<Int> {
+  ControlOptionalParam { get: Present { value: 7 }, pair: 2 }
+}
+
+fn optional_param_is_absent(c: ControlOptionalParam<Int>) -> Bool {
+  match c.get {
+    Present { value: _ } => false
+    Absent => true
+  }
+}
+
+fn optional_param_value_or_zero(c: ControlOptionalParam<Int>) -> Int {
+  match c.get {
+    Present { value: v } => v
+    Absent => 0
+  }
+}
+
+fn optional_type_parameter_cases() -> List<NativeEmissionCase> {
+  [
+    NativeEmissionCase { identity: "optional_type_param_holds_absent", held: optional_param_is_absent(c: control_optional_param_absent()) },
+    NativeEmissionCase { identity: "optional_type_param_red_present_is_not_absent", held: !optional_param_is_absent(c: control_optional_param_present()) },
+    NativeEmissionCase { identity: "optional_type_param_holds_present_value", held: optional_param_value_or_zero(c: control_optional_param_present()) == 7 },
+    NativeEmissionCase { identity: "optional_type_param_red_absent_reads_no_value", held: optional_param_value_or_zero(c: control_optional_param_absent()) == 0 }
+  ]
+}
+
 // RULE: a resource capability's output renders through the signature renderer
 // (v1.compiler.emit_rust emit_capability_method). Its anonymous output product used to fall through
 // to the env-less render_node_type, so a zero-parameter closed alias such as std.integer UInt8 =
@@ -481,6 +554,22 @@ fn control_outcome_is_bad(o: ControlOutcome<Int, String>) -> Bool {
   }
 }
 
+// RULE: `v2.std.algebra` `length` over HOST text (kernel `String`) lowers to
+// `v1_rt::string_length`. Corpus `v2.std.text.String` is structural FreeMonoid and keeps the
+// generic body. Without the host arm, kernel `String` at `request_field` is E0308; with a
+// leaf-name arm, structural text at `string_split_step` is E0308 the other way.
+fn control_algebra_length_of_string(s: String) -> Int {
+  length(xs: s)
+}
+
+fn algebra_length_on_string_cases() -> List<NativeEmissionCase> {
+  [
+    NativeEmissionCase { identity: "algebra_length_of_a_string_counts_scalars", held: control_algebra_length_of_string(s: "abc") == 3 },
+    NativeEmissionCase { identity: "algebra_length_of_a_string_red_is_not_another_count", held: control_algebra_length_of_string(s: "abc") != 4 },
+    NativeEmissionCase { identity: "algebra_length_of_a_list_is_unchanged", held: length(xs: ["a", "b"]) == 2 }
+  ]
+}
+
 fn fold_accumulator_formals_cases() -> List<NativeEmissionCase> {
   [
     NativeEmissionCase { identity: "fold_constructor_init_sums_all_nonnegative", held: control_outcome_good_value(o: control_sum_until_negative(xs: [1, 2, 3])) == 6 },
@@ -489,6 +578,80 @@ fn fold_accumulator_formals_cases() -> List<NativeEmissionCase> {
   ]
 }
 
+// RULE: a variant literal of a generic owner takes the expected application of that owner
+// (v1.compiler.infer variant_literal_expected_application). Seeded with a bare constructor in result
+// position, the fold's accumulator used to type as the uninstantiated declaration, so the payload
+// binding `items` carried the formal and `items |> list_push(x)` emitted a `.list_push(` method no
+// Rust type has -- E0599, extdeps.dns.domain_name parse_dns_label_list.
+fn control_collect_nonempty(xs: List<String>) -> ControlOutcome<List<String>, String> {
+  fold(xs, init: ControlGood { value: [] }, f: (acc, x) => match acc {
+    ControlBad { value: e } => ControlBad { value: e }
+    ControlGood { value: items } => if x == "" { ControlBad { value: "empty" } } else { ControlGood { value: items |> list_push(x) } }
+  })
+}
+
+fn control_collected_count(o: ControlOutcome<List<String>, String>) -> Int {
+  match o {
+    ControlGood { value: items } => items |> count
+    ControlBad { value: _ } => 0 - 1
+  }
+}
+
+fn variant_literal_application_cases() -> List<NativeEmissionCase> {
+  [
+    NativeEmissionCase { identity: "variant_literal_application_collects_every_element", held: control_collected_count(o: control_collect_nonempty(xs: ["a", "b", "c"])) == 3 },
+    NativeEmissionCase { identity: "variant_literal_application_red_empty_element_refuses", held: control_collected_count(o: control_collect_nonempty(xs: ["a", "", "c"])) == 0 - 1 },
+    NativeEmissionCase { identity: "variant_literal_application_red_empty_list_keeps_init", held: control_collected_count(o: control_collect_nonempty(xs: [])) == 0 }
+  ]
+}
+
+// RULE: every match whose Rc scrutinee is dereferenced and cloned owes Clone on the generics it
+// carries, wherever the match sits (v1.compiler.emit_rust v1_fn_body_rc_match_clone_bound_param_names).
+// control_first_refusal has the shape of gunbc.product.data_class admit_data_effect: one generic
+// (B) earns Clone elsewhere because the seed stores it by value, the other (A) is carried only in a
+// phantom position (ControlTag<A>, as Sink<C>), and the step matches on the accumulator, a generic
+// coproduct it clones out of its Rc. Read only at the fn body's top level, the bound was
+// missed and the header stayed `<A, B: Clone>`: E0599, `clone` exists for ControlAdmission<A, B> but its
+// trait bounds were not satisfied.
+type ControlTag<A> {
+  name: String
+}
+
+type ControlAdmission<A, B> = ControlAdmitted { tag: ControlTag<A>, value: B } | ControlRefused { cause: String }
+
+fn control_admitted_seed<A, B>(tag: ControlTag<A>, value: B) -> ControlAdmission<A, B> {
+  ControlAdmitted { tag: tag, value: value }
+}
+
+fn control_first_refusal<A, B>(tag: ControlTag<A>, value: B, causes: List<String>) -> ControlAdmission<A, B> {
+  fold(causes, init: control_admitted_seed(tag: tag, value: value), f: (acc, c) => match acc {
+    ControlAdmitted { tag: _, value: _ } => ControlRefused { cause: c }
+    ControlRefused { cause: _ } => acc
+  })
+}
+
+fn control_admitted_value(a: ControlAdmission<Int, Int>) -> Int {
+  match a {
+    ControlAdmitted { tag: _, value: v } => v
+    ControlRefused { cause: _ } => 0 - 1
+  }
+}
+
+fn control_refusal_cause(a: ControlAdmission<Int, Int>) -> String {
+  match a {
+    ControlAdmitted { tag: _, value: _ } => ""
+    ControlRefused { cause: c } => c
+  }
+}
+
+fn rc_match_clone_cases() -> List<NativeEmissionCase> {
+  [
+    NativeEmissionCase { identity: "rc_match_clone_no_refusal_keeps_the_seed", held: control_admitted_value(a: control_first_refusal(tag: ControlTag { name: "t" }, value: 7, causes: [])) == 7 },
+    NativeEmissionCase { identity: "rc_match_clone_red_first_refusal_wins", held: control_refusal_cause(a: control_first_refusal(tag: ControlTag { name: "t" }, value: 7, causes: ["a", "b"])) == "a" },
+    NativeEmissionCase { identity: "rc_match_clone_red_refused_is_not_admitted", held: control_admitted_value(a: control_first_refusal(tag: ControlTag { name: "t" }, value: 7, causes: ["x"])) == 0 - 1 }
+  ]
+}
+
 data native_emission_expected_identities: List<String> = [
   "set_struct_eq_same_members_in_another_order",
   "set_struct_eq_red_bare_field_differs",
@@ -526,6 +689,9 @@ data native_emission_expected_identities: List<String> = [
   "effectful_fold_step_red_empty_keeps_init",
   "capability_alias_output_octet_in_range",
   "capability_alias_output_red_octet_out_of_range",
+  "algebra_length_of_a_string_counts_scalars",
+  "algebra_length_of_a_string_red_is_not_another_count",
+  "algebra_length_of_a_list_is_unchanged",
   "fold_constructor_init_sums_all_nonnegative",
   "fold_constructor_init_red_negative_switches_arm",
   "fold_constructor_init_red_empty_keeps_init",
@@ -535,15 +701,27 @@ data native_emission_expected_identities: List<String> = [
   "list_index_past_the_end_is_absent",
   "list_index_negative_is_absent",
   "list_index_into_empty_is_absent",
+  "optional_data_row_present_answers_its_value",
+  "optional_data_row_red_absent_answers_absent",
+  "rc_match_clone_no_refusal_keeps_the_seed",
+  "rc_match_clone_red_first_refusal_wins",
+  "rc_match_clone_red_refused_is_not_admitted",
   "generic_return_full_arm_answers_its_value",
   "generic_return_red_empty_arm_answers_empty",
   "generic_return_effectful_call_answers_empty_on_absent_path",
   "generic_empty_map_duplicated_by_key_reports_each_repeat_once",
-  "generic_empty_map_red_no_repeat_reports_nothing"
+  "generic_empty_map_red_no_repeat_reports_nothing",
+  "variant_literal_application_collects_every_element",
+  "variant_literal_application_red_empty_element_refuses",
+  "variant_literal_application_red_empty_list_keeps_init",
+  "optional_type_param_holds_absent",
+  "optional_type_param_red_present_is_not_absent",
+  "optional_type_param_holds_present_value",
+  "optional_type_param_red_absent_reads_no_value"
 ]
 
 fn native_emission_cases() -> List<NativeEmissionCase> {
-  concat(concat(concat(concat(concat(same_leaf_declaration_cases(), concat(concat(concat(concat(concat(concat(header_bound_cases(), fn_value_bound_cases()), filter_in_branch_condition_cases()), claim_driver_filesystem_cases()), effectful_fold_step_cases()), capability_alias_output_cases()), fold_accumulator_formals_cases())), list_index_cases()), effectful_generic_return_cases()), generic_empty_map_turbofish_cases()), data_literal_tree_cases())
+  concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(same_leaf_declaration_cases(), concat(concat(concat(concat(concat(concat(header_bound_cases(), fn_value_bound_cases()), filter_in_branch_condition_cases()), claim_driver_filesystem_cases()), effectful_fold_step_cases()), capability_alias_output_cases()), fold_accumulator_formals_cases())), list_index_cases()), optional_data_row_cases()), effectful_generic_return_cases()), generic_empty_map_turbofish_cases()), data_literal_tree_cases()), variant_literal_application_cases()), rc_match_clone_cases()), optional_type_parameter_cases()), algebra_length_on_string_cases())
 }
 
 fn case_row(c: NativeEmissionCase) -> String {
diff --git a/dag/gunbc/instruments/native_emission_nested_present_specimen.dag b/dag/gunbc/instruments/native_emission_nested_present_specimen.dag
new file mode 100644
index 00000000000..24485e19d10
--- /dev/null
+++ b/dag/gunbc/instruments/native_emission_nested_present_specimen.dag
@@ -0,0 +1,38 @@
+module gunbc.instruments.native_emission_nested_present_specimen
+
+import std.types { Bool, String }
+
+// AN EXPECTING-RED SPECIMEN for gunbc.recurring_failure_mode
+// emitter_nested_variant_pattern_inside_present_drops_the_rc_deref. It is NOT enrolled in
+// gunbc.instruments.native_emission_controls: that label requires every carrier to emit as
+// compilable Rust, and specimen_nested_is_lit does not until the emitter rule lands. Enrolling it
+// there, as a case beside the green control, is the row's next-rung step.
+//
+// The shape: a record pattern whose field is an Optional of a coproduct, with the coproduct variant
+// pattern nested inside Present. The emitter renders the inner pattern against the Rc carrier
+// without dereferencing it (Some(Shade::Lit{..}) against Option<Rc<Shade>>, rustc E0308).
+type SpecimenNestedShade = SpecimenNestedLit { name: String } | SpecimenNestedDark
+
+type SpecimenNestedCard {
+  shade: SpecimenNestedShade?
+}
+
+fn specimen_nested_is_lit(card: SpecimenNestedCard) -> Bool {
+  match card {
+    SpecimenNestedCard { shade: Present { value: SpecimenNestedLit { name: _ } } } => true
+    SpecimenNestedCard { shade: Present { value: SpecimenNestedDark } } => false
+    SpecimenNestedCard { shade: Absent } => false
+  }
+}
+
+fn specimen_nested_is_lit_split(card: SpecimenNestedCard) -> Bool {
+  match card {
+    SpecimenNestedCard { shade: s } => match s {
+      Present { value: v } => match v {
+        SpecimenNestedLit { name: _ } => true
+        SpecimenNestedDark => false
+      }
+      Absent => false
+    }
+  }
+}
diff --git a/dag/gunbc/instruments/native_serve_fixture.dag b/dag/gunbc/instruments/native_serve_fixture.dag
index 898ad10c97a..fc7b1eb742d 100644
--- a/dag/gunbc/instruments/native_serve_fixture.dag
+++ b/dag/gunbc/instruments/native_serve_fixture.dag
@@ -1,9 +1,13 @@
 module gunbc.instruments.native_serve_fixture
 
-import std.types { String, CommitSha }
+import std.types { String, Int, Bool, CommitSha }
 import std.compiler_entry { CompilerEntryDriver, NativeServeDriver }
 import extdeps.http.server { ServeWireResponse, ServeWireHeader, WireHeaderLocation }
 import gunbc.native_serve { native_serve_text_plain }
+import extdeps.clock { Clock }
+import extdeps.transports.rest { RestResult, RestAnswered, RestRefused, RestStatusRefused, RestTransportRefused, RestBodyUndecodable }
+import std.resources { Network }
+import std.algebra { trim }
 
 // THE SMALLEST SERVICE THAT EXERCISES EVERY DECISION OF THE NATIVE SERVE DOOR, served by
 // `gunbc test //gunbc/instruments:native-serve` (gunbc.native_serve_probe judges what it answers).
@@ -46,7 +50,79 @@ fn native_serve_handle(method: String, path: String, body: String, tailscale_ide
     fixture_text(status: 200, body: concat("spun ", concat(to_string(value: fixture_spin(n: 1000000000000000, acc: 7)), "\n")))
   } else if path == "/echo" && method == "POST" {
     fixture_text(status: 200, body: body)
+  } else if path == "/effects/clock" && method == "GET" {
+    fixture_clock_readings()
+  } else if path == "/effects/rest" && method == "POST" {
+    fixture_peer_liveness(port_text: body)
   } else {
     fixture_text(status: 404, body: concat("no route for ", concat(method, concat(" ", concat(path, "\n")))))
   }
 }
+
+// ── THE BOUND EFFECT HANDLERS, EXERCISED (native broker 2N) ─────────────────────────────────────
+// These two routes make this entry demand effects, so its rendered main binds the handlers
+// v1.compiler.emit NativeEffectRealizationAdmission admitted for it -- extdeps.clock Clock on the
+// existing shell transport, and FixturePeer on the existing REST lowering -- and nothing else.
+// gunbc.native_serve_probe judges what they answer; this handler only reports what it observed.
+//
+// /effects/clock reads Clock.Now twice in order. The probe holds the pair plausible (an RFC 3339
+// UTC second in a sane year) and monotone (the second reading is not before the first).
+fn fixture_clock_readings() -> ServeWireResponse {
+  let first = Clock.Now()
+  let second = Clock.Now()
+  fixture_text(status: 200, body: concat(first.timestamp as String, concat("\n", concat(second.timestamp as String, "\n"))))
+}
+
+// /effects/rest asks another served process for its liveness document over the REST transport.
+// The body is the port to ask: the instrument starts a second instance of this fixture as the
+// local test server and sends its bound port (the answered arm), and sends a port nothing listens
+// on (the RestTransportRefused arm). The answer names the arm the transport produced, nothing more.
+fn fixture_peer_liveness(port_text: String) -> ServeWireResponse {
+  match parse_int(s: trim(s: port_text)) {
+    Absent => fixture_text(status: 400, body: "the body is not a port\n")
+    Present { value: port } => fixture_text(status: 200, body: concat(fixture_rest_arm(rest: native_serve_fixture.Peer.Liveness(port: port)), "\n"))
+  }
+}
+
+fn fixture_rest_arm(rest: RestResult<Bool>) -> String {
+  match rest {
+    RestAnswered { answer } => if answer { "answered live" } else { "answered not-live" }
+    RestRefused { refusal } => match refusal {
+      RestStatusRefused { status, body } => concat("refused status ", to_string(value: status))
+      RestTransportRefused { cause } => "refused transport"
+      RestBodyUndecodable { status, cause } => concat("refused body ", to_string(value: status))
+    }
+  }
+}
+
+// The peer is another native-serve process on loopback. The ORIGIN is the endpoint and the port the
+// path's first segment, because the port is the one fact only known after the peer binds port 0:
+// the REST transport's endpoint is per-service configuration, so a per-call port can only be carried
+// in the request target. This is the fixture's shape, not a pattern for production services.
+service native_serve_fixture.Peer {
+  config {
+    endpoint: "http://127.0.0.1"
+  }
+
+  operation Liveness {
+    requires Network
+    input {
+      port: Int
+    }
+    output {
+      live: Bool from "live"
+    }
+    readonly
+    transport rest {
+      method: GET,
+      path: ":\{port\}/livez"
+    }
+    response {
+      200 => FixturePeerLiveness
+    }
+  }
+}
+
+type FixturePeerLiveness {
+  live: Bool
+}
diff --git a/dag/gunbc/instruments/pair_incumbent_identity_standing.dag b/dag/gunbc/instruments/pair_incumbent_identity_standing.dag
deleted file mode 100644
index 0b3bcc0b941..00000000000
--- a/dag/gunbc/instruments/pair_incumbent_identity_standing.dag
+++ /dev/null
@@ -1,107 +0,0 @@
-module gunbc.instruments.pair_incumbent_identity_standing
-
-import std.types { String, Bool, NonEmptyStr, List }
-import std.optional { Present, Absent }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fabric_event_log_host { now_epoch_seconds }
-import gunbc.fleet_ssh_locus { FleetSshContextReady, FleetSshContextRefused, prepare_fleet_ssh_agent_context }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_wire }
-import gunbc.serving.serving_enrollment { ServingRouteResolved, ServingRouteUnresolved, serving_route }
-import gunbc.harness.harness_backend { harness_observe_engine_at }
-import gunbc.spark.vllm_endpoint_process_launch { LaunchObserved, LaunchUnobserved }
-import gunbc.spark.pair_serving_authority { spark_pair_serving_authorities, pair_serving_authority_group }
-import gunbc.spark.pair_incumbent_identity {
-  PairRealizationAgreement, pair_realization_agreement, pair_realization_is_established, pair_realization_agreement_lines,
-  declared_pair_realization, observe_pair_realization,
-  ObservedPairRealizationRefused, PairRouteUnresolved, PairLaunchUnobserved, PairFleetAccessRefused,
-}
-
-// ── THE INCUMBENT'S IDENTITY, READ AND WRITTEN DOWN ───────────────────────────────────────────
-//
-// THE READ-ONLY CONSUMER of gunbc.spark.pair_incumbent_identity. For every group the pair-serving
-// authority claims, key the declared realization, read the route's answering launch, observe the
-// four ranks over the fleet key session, fold the agreement and write one receipt. It starts
-// nothing, stops nothing and claims nothing; its verdict is an observation, and its first
-// operational consumer is Cut D's D0, which asks this same question INSIDE its fence -- an identity
-// read before the authority transfer can go stale before suspension, so this instrument's receipt
-// is standing, never authorization. It is invoked by name:
-//   gunbc run --source-root dag --source-root src/v2 \
-//     --entry dag/gunbc/instruments/pair_incumbent_identity_standing.dag --function pair_incumbent_identity_standing
-//
-// THE SUBJECT IS THE AUTHORITY ROSTER, NOT A GROUP LITERAL, so the instrument has exactly the
-// population the authority claims; an empty roster is a missing subject and refuses (the vacuity
-// rule gunbc.instruments.fabric_capacity_standing states), never a passing fleet.
-//
-// EXIT SEMANTICS. Success only when EVERY claimed group's agreement is Established. Drift, a
-// population mismatch, a conflict or an unread observation each exit non-zero with the receipt
-// body as the reason; the receipt lines are the same either way, so a reader gets the located
-// verdict rather than a bare code.
-
-data pair_incumbent_identity_receipt_path: String = "target/pair-incumbent-identity-receipt.txt"
-data pair_incumbent_identity_attempt_raw: String = "pair-incumbent-identity"
-
-type GroupIdentityStanding {
-  group: FabricGroup
-  agreement: PairRealizationAgreement
-}
-
-// The launch the route answers with is read from its metrics the way the harness reads it, so the
-// incarnation this instrument binds is the one a seat would be bound to.
-fn group_identity_standing(group: FabricGroup) -> GroupIdentityStanding
-{
-  let declared = declared_pair_realization(group: group)
-  let observed = match serving_route(group: group) {
-    ServingRouteUnresolved { group: g, obligation: o } =>
-      ObservedPairRealizationRefused { refusal: PairRouteUnresolved { group: g, obligation: o } }
-    ServingRouteResolved { endpoint: endpoint, ceiling: _ } =>
-      match now_epoch_seconds() {
-        Absent => ObservedPairRealizationRefused { refusal: PairLaunchUnobserved { group: group, obligation: "the clock could not be read as epoch seconds, so the launch read has no instant" as NonEmptyStr } }
-        Present { value: now } =>
-          match harness_observe_engine_at(endpoint: endpoint, at: now).launch {
-            LaunchUnobserved { group: g, obligation: o } =>
-              ObservedPairRealizationRefused { refusal: PairLaunchUnobserved { group: g, obligation: o } }
-            LaunchObserved { launch: launch, receipt: _ } =>
-              match prepare_fleet_ssh_agent_context(attempt_raw: pair_incumbent_identity_attempt_raw) {
-                FleetSshContextRefused { cause: c } =>
-                  ObservedPairRealizationRefused { refusal: PairFleetAccessRefused { group: group, cause: c as NonEmptyStr } }
-                FleetSshContextReady { context: context, receipt: _ } =>
-                  observe_pair_realization(context: context, group: group, endpoint: launch)
-              }
-          }
-      }
-  }
-  GroupIdentityStanding { group: group, agreement: pair_realization_agreement(declared: declared, observed: observed) }
-}
-
-fn group_identity_lines(s: GroupIdentityStanding) -> List<String> {
-  concat([join(["group ", fabric_group_wire(g: s.group) as String], "")], pair_realization_agreement_lines(a: s.agreement))
-}
-
-fn pair_incumbent_identity_receipt_body(at: String, standings: List<GroupIdentityStanding>) -> String {
-  join(concat([join(["pair incumbent identity at ", at], "")], flat_map(standings, s => group_identity_lines(s: s))), "\n")
-}
-
-fn pair_incumbent_identity_verdict(standings: List<GroupIdentityStanding>, body: String) -> ProcessExit {
-  if length(standings) == 0 {
-    exit_failure(reason: "pair incumbent identity: no serving group is claimed, so this instrument has no subject -- an empty roster is a missing subject rather than an established fleet")
-  } else if all(standings, s => pair_realization_is_established(a: s.agreement)) {
-    ExitSuccess
-  } else {
-    exit_failure(reason: join(["pair incumbent identity is not established:\n", body], ""))
-  }
-}
-
-fn pair_incumbent_identity_standing() -> ProcessExit
-{
-  let now = clock_now_probed_at()
-  let standings = map(spark_pair_serving_authorities, a => group_identity_standing(group: pair_serving_authority_group(a: a)))
-  let body = pair_incumbent_identity_receipt_body(at: probed_at_word(reading: now) as String, standings: standings)
-  let wr = Filesystem.Write(path: pair_incumbent_identity_receipt_path, content: body)
-  if !wr.success {
-    exit_failure(reason: join(["pair incumbent identity receipt write failed: ", wr.error], ""))
-  } else {
-    pair_incumbent_identity_verdict(standings: standings, body: body)
-  }
-}
diff --git a/dag/gunbc/instruments/self_host_03_normalize_declared_source_refs.dag b/dag/gunbc/instruments/self_host_03_normalize_declared_source_refs.dag
index 159cbde0661..05199167a2f 100644
--- a/dag/gunbc/instruments/self_host_03_normalize_declared_source_refs.dag
+++ b/dag/gunbc/instruments/self_host_03_normalize_declared_source_refs.dag
@@ -2,6 +2,7 @@ module tools.self_host_03_normalize_declared_source_refs
 
 import std.types { List }
 import v2.compiler.source_authority { SourceRef, source_ref_for_storage_path }
+import v2.std.cross_tree.import_model { V2Tree }
 
 // declared_source_refs for the 03_normalize behavioral witness only (review 41433 fix): this list
 // opts src/v2/compiler/03_normalize.dag's witness entry into the cli_run.rs affected-set selection
@@ -13,9 +14,9 @@ import v2.compiler.source_authority { SourceRef, source_ref_for_storage_path }
 // this selection axis onto all 16 entries; a dedicated per-entry module keeps the axis scoped to
 // 03_normalize alone, matching the roster row's module_path and contract entry exactly.
 
-data sn_source_ref: SourceRef = source_ref_for_storage_path(path: "src/v2/compiler/03_normalize.dag")
+data sn_source_ref: SourceRef = source_ref_for_storage_path(path: "src/v2/compiler/03_normalize.dag", source_root: V2Tree)
 
-data sn_contract_ref: SourceRef = source_ref_for_storage_path(path: "src/v2/test/claim/self_host_contract/normalize_emitted_contract_test.dag")
+data sn_contract_ref: SourceRef = source_ref_for_storage_path(path: "src/v2/test/claim/self_host_contract/normalize_emitted_contract_test.dag", source_root: V2Tree)
 
 // Hand-verified completeness (docs/plans/declared-source-ref-selection-design.md §5.1 flagship):
 // every storage path this transport reads from the repository is listed -- the subject .dag and the
diff --git a/dag/gunbc/instruments/source_reference_repoint.dag b/dag/gunbc/instruments/source_reference_repoint.dag
index 14a83e11708..e2226440d77 100644
--- a/dag/gunbc/instruments/source_reference_repoint.dag
+++ b/dag/gunbc/instruments/source_reference_repoint.dag
@@ -348,7 +348,7 @@ fn repoint_pending_verdict(pending: List<String>) -> ProcessExit {
 }
 
 fn repoint_root_tasks() -> List<SourceRootWalkTask> {
-  source_reference_repoint_roots |> map(path => SourceRootWalkTask { path: path, root: true })
+  source_reference_repoint_roots |> map(path => SourceRootWalkTask { path: path, root: true, origin: path })
 }
 
 // The wet entry: rewrite every file under the roots that still references a moved module.
@@ -357,10 +357,10 @@ fn repoint() -> ProcessExit {
     SourceRootPathsRefused { path: path, kind: kind, cause: cause } =>
       exit_failure(reason: join(["source reference repoint: cannot walk ", path, " (", kind, "): ", cause], ""))
     SourceRootPathsRead { paths: paths } =>
-      fold(paths, init: ExitSuccess, f: fn(acc, path) {
+      fold(paths, init: ExitSuccess, f: fn(acc, walked) {
         match acc {
           ExitFailure { code, reason } => ExitFailure { code: code, reason: reason }
-          ExitSuccess => repoint_one_path(path: path)
+          ExitSuccess => repoint_one_path(path: walked.path)
         }
       })
   }
@@ -372,6 +372,10 @@ fn repoint_pending() -> ProcessExit {
     SourceRootPathsRefused { path: path, kind: kind, cause: cause } =>
       exit_failure(reason: join(["source reference repoint: cannot walk ", path, " (", kind, "): ", cause], ""))
     SourceRootPathsRead { paths: paths } =>
-      repoint_pending_verdict(pending: paths |> filter(path => repoint_path_is_pending(path: path)))
+      repoint_pending_verdict(
+        pending: paths
+          |> filter(walked => repoint_path_is_pending(path: walked.path))
+          |> map(walked => walked.path)
+      )
   }
 }
diff --git a/dag/gunbc/ipmitool_fru_text.dag b/dag/gunbc/ipmitool_fru_text.dag
new file mode 100644
index 00000000000..1669b254b14
--- /dev/null
+++ b/dag/gunbc/ipmitool_fru_text.dag
@@ -0,0 +1,68 @@
+module gunbc.ipmitool_fru_text
+
+import std.types { String, NonEmptyStr }
+import std.algebra { trim }
+import std.optional { Present, Absent }
+import v2.std.algebra { filter }
+
+// THE PURE LINE DECODE of `ipmitool fru print` text: each field is read from exactly one line.
+// Shared by every consumer of a committed FRU capture (the Mt. Jade identity read and the board
+// authority read), so the line grammar has one home.
+// The two grains are two types: a field read can only be absent, repeated or empty, so the
+// capture-level failures are not representable in what `fru_field` returns.
+type FruFieldGapKind
+  = FruFieldAbsent { field: NonEmptyStr }
+  | FruFieldRepeated { field: NonEmptyStr }
+  | FruFieldEmpty { field: NonEmptyStr }
+
+type FruCaptureGap
+  = FruCaptureUnreadable { error: String }
+  | FruCaptureDigestMismatch { expected: NonEmptyStr, observed: String }
+  | FruFieldGapped { gap: FruFieldGapKind }
+  | FruSubjectLinkUnobserved
+  | FruBoundToAnotherLink { board_extra: String }
+
+// THE ONE DIGEST CHECK of a committed capture against the sha256 a record was authored from.
+// Every reader of a committed FRU capture asks this; a mismatch is never decoded.
+type FruCaptureDigestCheck
+  = FruCaptureDigestAgrees
+  | FruCaptureDigestDiffers { gap: FruCaptureGap }
+
+fn fru_capture_digest_check(content: String, expected_sha256: NonEmptyStr) -> FruCaptureDigestCheck {
+  let observed = sha256_hex_of_text(text: content)
+  if observed != (expected_sha256 as String) {
+    FruCaptureDigestDiffers { gap: FruCaptureDigestMismatch { expected: expected_sha256, observed: observed } }
+  } else {
+    FruCaptureDigestAgrees
+  }
+}
+
+type FruFieldRead
+  = FruFieldValue { value: NonEmptyStr }
+  | FruFieldGap { gap: FruFieldGapKind }
+
+fn fru_line_key(line: String) -> String {
+  match split(s: line, delimiter: " : ").first() {
+    Present { value: k } => trim(k)
+    Absent => ""
+  }
+}
+
+fn fru_line_value(line: String) -> String {
+  trim(join(split(s: line, delimiter: " : ").skip(n: 1), " : "))
+}
+
+fn fru_field(content: String, field: NonEmptyStr) -> FruFieldRead {
+  let hits = split(s: content, delimiter: "\n") |> filter(l => fru_line_key(line: l) == (field as String))
+  match hits.first() {
+    Absent => FruFieldGap { gap: FruFieldAbsent { field: field } }
+    Present { value: line } =>
+      if length(hits) > 1 {
+        FruFieldGap { gap: FruFieldRepeated { field: field } }
+      } else if fru_line_value(line: line) == "" {
+        FruFieldGap { gap: FruFieldEmpty { field: field } }
+      } else {
+        FruFieldValue { value: fru_line_value(line: line) as NonEmptyStr }
+      }
+  }
+}
diff --git a/dag/gunbc/ledger_row_coherence.dag b/dag/gunbc/ledger_row_coherence.dag
index e29a420905e..fef629aee94 100644
--- a/dag/gunbc/ledger_row_coherence.dag
+++ b/dag/gunbc/ledger_row_coherence.dag
@@ -4,8 +4,7 @@ import std.types { String, List, Bool }
 import gunbc.generated_artifact {
   GeneratedArtifact,
   WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact,
-  HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact,
-  GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact,
+  HealWorkflowYamlArtifact, BranchRunGrantBrokerWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact,
   DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact,
   GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact,
   RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact,
@@ -119,7 +118,7 @@ fn ledger_rows(a: GeneratedArtifact) -> List<LedgerRow> {
     MicrovmShakedownYamlArtifact => []
     InstrumentDispatchYamlArtifact => []
     HealWorkflowYamlArtifact => []
-    HealPublisherWorkflowYamlArtifact => []
+    BranchRunGrantBrokerWorkflowYamlArtifact => []
     GitignoreArtifact => []
     GitattributesArtifact => []
     CargoConfigArtifact => []
diff --git a/dag/gunbc/legacy_extdeps_scope_frontier.tsv b/dag/gunbc/legacy_extdeps_scope_frontier.tsv
index 8d4ae726ae2..f867a464377 100644
--- a/dag/gunbc/legacy_extdeps_scope_frontier.tsv
+++ b/dag/gunbc/legacy_extdeps_scope_frontier.tsv
@@ -240,13 +240,11 @@ dag/extdeps/provisioning/ubuntu_seeded_install_media_toolchain.dag
 dag/extdeps/python/python.dag
 dag/extdeps/realization/artifact_store_fs.dag
 dag/extdeps/realization/cache_purity.dag
-dag/extdeps/realization/compile_stage_memo.dag
 dag/extdeps/realization/emit_on_demand_host.dag
 dag/extdeps/realization/eval_memo.dag
 dag/extdeps/realization/frame_boundary_simulated.dag
 dag/extdeps/realization/hermetic_fixture.dag
 dag/extdeps/realization/native_artifact_cache.dag
-dag/extdeps/realization/parse_table_memo.dag
 dag/extdeps/realization/reconcile_in_process.dag
 dag/extdeps/realization/resolved_graph.dag
 dag/extdeps/realization/v1_handler.dag
diff --git a/dag/gunbc/live_deploy/apply.dag b/dag/gunbc/live_deploy/apply.dag
index b6e8cd72b3f..5e555a2ae74 100644
--- a/dag/gunbc/live_deploy/apply.dag
+++ b/dag/gunbc/live_deploy/apply.dag
@@ -1,5 +1,8 @@
 module gunbc.live_deploy.apply
 
+import gunbc.workspace_artifact_policy { workspace_demo_image_identity }
+import gunbc.workspace_guest_image { workspace_installed_image, WorkspaceImageVerified, WorkspaceImageRefused }
+
 import gunbc.workspace_commissioning_executor_input { workspace_executor_installed_adapter_matches }
 import gunbc.workspace_commissioning_executor_unit { workspace_executor_unit_instance_name }
 import gunbc.runner_microvm_slot_unit { microvm_controller_requires_ci_reservation_unit }
@@ -23,7 +26,18 @@ import gunbc.live_deploy.spec {
   deployment_plan_host_identity,
   deployment_tailnet_door_socket,
 }
-import gunbc.live_deploy.desired { deployment_spec_srv1 }
+import gunbc.live_deploy.desired {
+  deployment_spec_srv1,
+  desired_deployment_for_instance_id,
+  selected_deployment_spec,
+  srv1_production_desired_deployment,
+  instance_id_text,
+  DesiredDeploymentFound,
+  DesiredDeploymentUnknownInstanceId,
+  DesiredDeploymentRosterRefused,
+  DesiredRosterSameHostCollision,
+  DesiredRosterDuplicateInstanceId,
+}
 import std.types { String, CommitSha, NonEmptyStr }
 import gunbc.live_deploy.candidate {
   CandidateRelease,
@@ -132,8 +146,7 @@ import gunbc.clock_read { clock_now_probed_at_or_unknown }
 import extdeps.languages.json.emit { serialize_json }
 import gunbc.actions_run_binding {
   ActionsRunBinding, observe_actions_run_binding, ActionsRunBound, ActionsRunUnbound,
-  read_expected_revision, ExpectedRevisionPresent, ExpectedRevisionAbsent,
-  admit_run_revision, RunRevisionAdmitted, RunRevisionRefused,
+  admit_optional_expected_revision, RunRevisionAdmitted, RunRevisionRefused,
 }
 import gunbc.fleet_converge_receipt {
   read_fleet_converge_plan_receipt_at, FleetConvergePlanReceiptDecoded, FleetConvergePlanReceiptUnreadable,
@@ -542,6 +555,8 @@ fn live_deploy_apply_identity_readback_gate(
   }
 }
 
+// A refused mutation cannot produce this candidate. Skip startup polling, but keep the
+// cutover gate below: it must still recover an interrupted route transaction.
 fn live_deploy_apply_via_transport(
   spec: DeploymentSpec,
   candidate: CandidateRelease,
@@ -554,12 +569,14 @@ fn live_deploy_apply_via_transport(
     transport: transport,
     access: access,
   )
-  let readiness = live_deploy_poll_until_service_ready_for_deploy(
-    spec: spec,
-    candidate: candidate,
-    transport: transport,
-    access: access,
-  )
+  let readiness = if reconciliation_converged(r: mutation) {
+    live_deploy_poll_until_service_ready_for_deploy(
+      spec: spec,
+      candidate: candidate,
+      transport: transport,
+      access: access,
+    )
+  } else { tailnet_door_cutover_unpermitted_standing() }
   let cutover = live_deploy_tailnet_door_cutover_gate(
     spec: spec, candidate: candidate, transport: transport, access: access,
     readiness: tailnet_door_cutover_door_standing(mutation: mutation, readiness: readiness),
@@ -1052,7 +1069,10 @@ fn microvm_controller_install_readback_exit(candidate: CandidateRelease) -> Proc
           ExitSuccess => if workspace_executor_installed_adapter_matches(
             release_dir: approval_broker_release_dir(root: microvm_controller_root, revision: revision),
             slot: runner_slot_instance_name(slot: srv1_microvm_shakedown_slot())) {
-            ExitSuccess
+            match workspace_installed_image(release_dir: approval_broker_release_dir(root: microvm_controller_root, revision: revision), identity: workspace_demo_image_identity()) {
+              WorkspaceImageVerified { image: _ } => ExitSuccess
+              WorkspaceImageRefused { reason } => exit_failure(reason: concat("microvm_controller_install: ", reason))
+            }
           } else { exit_failure(reason: "microvm_controller_install: executor scripts or loaded unit failed exact readback") }
           refused => refused
         }
@@ -1127,19 +1147,66 @@ fn approval_broker_dark_install_srv1_wet() -> ProcessExit {
   )
 }
 
+// ONE APPLY ROUTE, SELECTED BY INSTANCE ID. The roster (gunbc.live_deploy.desired
+// desired_deployment_roster) is the selection authority; this is the only place an apply entry
+// turns an instance id into a DeploymentSpec, and the production entries below are this route
+// called with production's id rather than a second fold. A row whose target host is not the host
+// the access reaches refuses: an access is a principal on ONE host, and pointing it at another
+// row would mutate the wrong machine under a correct-looking spec.
+type DesiredApplySelection
+  = DesiredApplySelected { spec: DeploymentSpec }
+  | DesiredApplyRefused { reason: String }
+
+fn live_deploy_desired_apply_selection(instance_id: String, access: DeployAccess) -> DesiredApplySelection {
+  match desired_deployment_for_instance_id(instance_id: instance_id) {
+    DesiredDeploymentUnknownInstanceId { instance_id: id } =>
+      DesiredApplyRefused { reason: join(["live_deploy apply: DesiredDeploymentUnknownInstanceId '", id, "' names no row of desired_deployment_roster"], "") }
+    DesiredDeploymentRosterRefused { refusal } =>
+      match refusal {
+        DesiredRosterSameHostCollision { host } =>
+          DesiredApplyRefused { reason: join(["live_deploy apply: DesiredRosterSameHostCollision on host ", host], "") }
+        DesiredRosterDuplicateInstanceId { instance_id: dup } =>
+          DesiredApplyRefused { reason: join(["live_deploy apply: DesiredRosterDuplicateInstanceId ", dup], "") }
+      }
+    DesiredDeploymentFound { row } =>
+      if (row.target.host.identity as String) != (access.host.identity as String) {
+        DesiredApplyRefused { reason: join(["live_deploy apply: DesiredApplyHostMismatch — row '", instance_id, "' targets ", row.target.host.identity as String, " but the access reaches ", access.host.identity as String], "") }
+      } else {
+        DesiredApplySelected { spec: selected_deployment_spec(row: row) }
+      }
+  }
+}
+
+fn live_deploy_apply_desired_wet(instance_id: String, access: DeployAccess) -> ProcessExit {
+  match live_deploy_desired_apply_selection(instance_id: instance_id, access: access) {
+    DesiredApplyRefused { reason } => exit_failure(reason: reason)
+    DesiredApplySelected { spec } => live_deploy_wet_with_access(spec: spec, access: access)
+  }
+}
+
+// The operator-local apply of any srv1 roster row, e.g.
+// `--function live_deploy_apply_desired_operator_local_wet --arg instance_id=srv1-lab-codex-feedback-v0`.
+fn live_deploy_apply_desired_operator_local_wet(instance_id: String) -> ProcessExit {
+  live_deploy_apply_desired_wet(instance_id: instance_id, access: ci_deploy_srv1_operator_local_access)
+}
+
+fn srv1_production_instance_id() -> String {
+  instance_id_text(id: srv1_production_desired_deployment().instance.instance_id)
+}
+
 fn live_deploy_apply_srv1_wet() -> ProcessExit {
-  live_deploy_wet_with_access(spec: deployment_spec_srv1(), access: ci_deploy_srv1_access)
+  live_deploy_apply_desired_wet(instance_id: srv1_production_instance_id(), access: ci_deploy_srv1_access)
 }
 
 fn live_deploy_apply_srv1_operator_wet() -> ProcessExit {
-  live_deploy_wet_with_access(spec: deployment_spec_srv1(), access: ci_deploy_srv1_operator_access)
+  live_deploy_apply_desired_wet(instance_id: srv1_production_instance_id(), access: ci_deploy_srv1_operator_access)
 }
 
 // The converge verb's deploy mode: the same admitted path the CI entry runs, under the operator
 // principal on the host itself. Candidate observation, preflight, mutation and the readiness
 // gate are all shared; nothing here is a second deploy.
 fn live_deploy_apply_srv1_operator_local_wet() -> ProcessExit {
-  live_deploy_wet_with_access(spec: deployment_spec_srv1(), access: ci_deploy_srv1_operator_local_access)
+  live_deploy_apply_desired_operator_local_wet(instance_id: srv1_production_instance_id())
 }
 
 fn live_deploy_retract_srv1_wet() -> ProcessExit {
@@ -1278,14 +1345,10 @@ fn live_deploy_transaction_admitted_wet_with_access(spec: DeploymentSpec, access
     ActionsRunUnbound { variable: v, detail: d } =>
       exit_failure(reason: join(["live_deploy transaction: RunUnbound — ", v, " ", d, "; the transaction entry runs only inside the fleet-converge workflow"], ""))
     ActionsRunBound { binding: run } =>
-      match read_expected_revision() {
-        ExpectedRevisionAbsent { variable: v, detail: d } =>
-          exit_failure(reason: join(["live_deploy transaction: ExpectedRevisionAbsent — ", v, " ", d], ""))
-        ExpectedRevisionPresent { revision: expected } =>
-          match admit_run_revision(binding: run, expected: expected) {
+      match admit_optional_expected_revision(binding: run) {
             RunRevisionRefused { expected: e, observed: o } =>
               exit_failure(reason: join(["live_deploy transaction: RunRevisionNotExpected — this run executes ", o, " but R is ", e], ""))
-            RunRevisionAdmitted { revision: _ } =>
+            RunRevisionAdmitted { revision: admitted } =>
               match read_live_deploy_fleet_provenance() {
                 FleetProvenanceAbsent { variable: v, detail: d } =>
                   exit_failure(reason: join(["live_deploy transaction: FleetProvenanceAbsent — ", v, " ", d], ""))
@@ -1305,12 +1368,11 @@ fn live_deploy_transaction_admitted_wet_with_access(spec: DeploymentSpec, access
                     plan_receipt_identity: fleet_converge_plan_receipt_identity_hex(r: plan_receipt),
                     apply_receipt_identity: fleet_converge_apply_receipt_identity_hex(r: fleet_apply_receipt),
                   }
-                  live_deploy_transaction_admitted(spec: spec, access: access, run: run, expected: expected, provenance: provenance)
+                  live_deploy_transaction_admitted(spec: spec, access: access, run: run, expected: admitted, provenance: provenance)
                   }
                   }
                   }
               }
-          }
       }
   }
 }
diff --git a/dag/gunbc/live_deploy/belt_cadence.dag b/dag/gunbc/live_deploy/belt_cadence.dag
index 9caf801d698..621d3645369 100644
--- a/dag/gunbc/live_deploy/belt_cadence.dag
+++ b/dag/gunbc/live_deploy/belt_cadence.dag
@@ -1,6 +1,6 @@
 module gunbc.live_deploy.belt_cadence
 
-import std.types { String }
+import std.measure { Second, second }
 
 // OnUnitInactiveSec, NOT OnUnitActiveSec, and the difference is a fail-closed choice rather than a
 // formatting one. OnUnitActiveSec measures from when the tick STARTED, so a tick that runs longer
@@ -23,4 +23,23 @@ import std.types { String }
 // produces SpawnFailed rows for a condition that resolves itself within seconds. The delay costs
 // one cadence period and removes a class of self-inflicted refusals from the receipt.
 
-data belt_tick_cadence: String = "60s"
+data belt_tick_cadence: Second = second(count: 60)
+
+// THE PER-TICK WATCHDOG, and the 2026-09-21 measurement that put it here. A Type=oneshot unit with
+// no start bound runs as long as the tick runs, and OnUnitInactiveSec only schedules the next tick
+// from INACTIVITY -- so one tick that wedged in the SCM seed (measured that night: 2.25 hours at
+// 100% CPU inside one capture, the timer showing no next elapse and no receipt distinguishing
+// "nothing to do" from "stuck") halted the whole pipeline invisibly; the operator could not tell
+// the frozen cadence from an idle belt. TimeoutStartSec is the bounded-reconciliation backstop in
+// the workflow-execution ruling's sense: past the bound systemd kills the tick, the unit goes
+// inactive(failed) LOUDLY, and the timer resumes on the next cadence -- one lost pass, never a
+// lost night. The bound must clear the worst HONEST tick, which is first-capture-heavy: a fresh
+// project envelope seeds the whole ~7,050-path intake base through the git bridge once (measured
+// 2026-09-21 at roughly seven minutes of bridge time per project), and verification then runs the
+// node's validations; it must stay far below the hours a wedge needs to be noticed by a human.
+// The bound names the instrument that re-derives it, never a transcribed number (DESIGN section 6):
+// a green tick's receipt at receipts/belt-last-tick.json carries its observed_at, and the belt's
+// own stage timings re-derive the worst honest pass. 2700s (45 minutes) is the policy row: roughly six times
+// the 2026-09-21 measured seed-bridge cost, far below the hours a wedge needs to be noticed by a
+// human, and any honest growth beyond it must move this row with a reason, not the wedge.
+data belt_tick_run_bound: Second = second(count: 2700)
diff --git a/dag/gunbc/live_deploy/candidate.dag b/dag/gunbc/live_deploy/candidate.dag
index 38449b1ffb6..cd5b100e84a 100644
--- a/dag/gunbc/live_deploy/candidate.dag
+++ b/dag/gunbc/live_deploy/candidate.dag
@@ -14,22 +14,20 @@ import gunbc.running_release_identity {
   running_release_surface_equals,
 }
 
-// A REVISION NAMES A COMMIT; THE DEPLOY SHIPS A WORKING TREE. Those are the same bytes only when the
-// checkout is clean, and nothing above established that. The sync's working-tree leg rsyncs the runner
-// checkout wholesale except gunbc.live_deploy.deployed_tree_scope deployed_tree_excluded_prefixes, so an edit
-// or an untracked file is DEPLOYED while HEAD does not name it — and the resulting candidate
-// { revision: A, surface: B } is self-consistent all the way down: the emitter writes A into ExecStart, the
-// process reports A, readiness compares A against A and greens, and the ancestry decision downstream
-// orders the deployment as A. Nothing in the chain can see that the bytes were never A's, because every
-// party is reading the same wrong answer. This is the one class the identity channel cannot catch by
-// construction, which is why it is refused at admission instead.
+// A REVISION NAMES A COMMIT, AND ADMISSION ESTABLISHES THAT THE CHECKOUT IS THAT COMMIT. The deployed
+// tree is now converged git-natively (gunbc.live_deploy.repository_convergence repository_converge_wet
+// installs the candidate COMMIT, never the runner's working tree), but the deploying process still
+// builds and renders from this checkout: an edit or an untracked file here would make the candidate
+// { revision: A, surface: B } self-consistent all the way down -- the emitter writes A into ExecStart,
+// the process reports A, readiness compares A against A and greens -- while B was rendered from bytes A
+// does not name. That class cannot be caught by the identity channel by construction, which is why it is
+// refused at admission instead. Historically the working-tree leg was an rsync of the checkout with
+// `--delete`, which made a stray file load-bearing on the host; that transport is gone, and the refusal
+// stays because the render-from-checkout half of the hazard did not go with it.
 //
-// THE UNTRACKED ARM IS NOT A COURTESY. `--delete` on the working-tree leg means a stray file in the
-// checkout is copied to the host and then persists there; the deployment's own source sync is the transport
-// that makes an untracked path load-bearing. It is scoped to DEPLOYED paths for the same reason: a file
-// under target/ or .git/ is excluded by the sync, so refusing on it would be refusing on bytes that never
-// leave the runner — a fail-closed arm that fires on a state which is not the invalid one is just noise,
-// and noise is what gets suppressed later.
+// Paths under gunbc.live_deploy.deployed_tree_scope deployed_tree_excluded_prefixes (target/, .git/,
+// host session and cache state) are out of scope: refusing on them would fire on a state that is not
+// the invalid one, and noise is what gets suppressed later.
 //
 // FOUR SEPARATE PATH LISTS, NOT A COUNT OR A BOOL. Staged, unstaged-tracked, untracked-deployed and
 // ignored-deployed have different remedies — commit the index, commit or discard the edit, add or clean the
@@ -43,14 +41,12 @@ import gunbc.running_release_identity {
 // a path that .gitignore exists to keep out of the index.
 //
 // It closes a hole the first version of this admission had. `git status --porcelain=v1 -z
-// --untracked-files=all` does not report ignored files at all, while the source sync excludes only the
-// prefixes deployed_tree_scope names — so an ignored path outside them (the residue is now the .env family,
-// which stays refused because `.env.*.local` is a wildcard no prefix can spell, and, inside a source root the
-// graph actually reads, src/v2/test/claim/manual/sg2_scratch_probe.dag) was copied by rsync while the
-// admission reported the tree clean. The resulting state is self-consistent and therefore invisible to every later comparison: HEAD names
-// revision A, rsync installs bytes B, the candidate's expected surface is rendered from B, the process reports
-// A and B, and readiness compares A against A and B against B and greens. That is exactly the false identity
-// this admission exists to make unrepresentable, surviving inside it.
+// --untracked-files=all` does not report ignored files at all, so an ignored path outside the excluded
+// prefixes (the .env family, which stays refused because `.env.*.local` is a wildcard no prefix can
+// spell; inside a source root the graph actually reads, src/v2/test/claim/manual/sg2_scratch_probe.dag;
+// and a legacy ledger roster.dag an older gunbc wrote) was invisible while the admission reported the
+// tree clean -- and an ignored file under a source root changes what this checkout compiles. That is
+// exactly the false identity this admission exists to make unrepresentable, surviving inside it.
 type CandidateCheckoutObservation
   = CandidateCheckoutClean
   | CandidateCheckoutDirty {
diff --git a/dag/gunbc/live_deploy/deployed_tree_scope.dag b/dag/gunbc/live_deploy/deployed_tree_scope.dag
index a9924e7f206..ea58b4c9411 100644
--- a/dag/gunbc/live_deploy/deployed_tree_scope.dag
+++ b/dag/gunbc/live_deploy/deployed_tree_scope.dag
@@ -3,11 +3,15 @@ module gunbc.live_deploy.deployed_tree_scope
 import std.types { Bool, String, List }
 import v2.std.algebra { any }
 
-// WHAT THE DEPLOY ACTUALLY INSTALLS, DECLARED ONCE BECAUSE TWO THINGS NEED IT AND MUST NOT DISAGREE.
-// The working-tree leg of the source sync rsyncs the runner checkout wholesale except these
-// prefixes, so the deployed source is the WORKING TREE, not the commit. Two consumers read it:
+// WHICH CHECKOUT PATHS CANDIDATE ADMISSION HOLDS TO "CLEAN", DECLARED ONCE.
+// The deployed tree is converged GIT-NATIVELY (gunbc.live_deploy.repository_convergence
+// repository_converge_wet: objects fetched from the runner checkout, the base ref moved by
+// compare-and-swap, `reset --hard` to the candidate), so what is installed is the COMMIT, not the
+// runner's working tree. Admission still refuses a checkout carrying an untracked or ignored path
+// outside these prefixes, because such a path means the candidate is not the clean revision it
+// names. One consumer reads it:
 //
-//   gunbc.live_deploy.candidate  decides whether an untracked path would actually be shipped
+//   gunbc.live_deploy.candidate  decides whether an untracked or ignored path makes the checkout unclean
 //
 // A second reader once rendered it as rsync `--exclude` flags (deployed_tree_rsync_exclude_flags).
 // The tree-sync unit and then the approval broker's job-user rsync were its last production callers;
@@ -21,8 +25,7 @@ import v2.std.algebra { any }
 // and acyclicity is the import graph's one structural law (DESIGN §3). A fact needed by two modules
 // on opposite sides of a dependency chain belongs beneath both, not inside either.
 // WHY THIS LIST IS NOT JUST target AND .git, AND WHY IT IS STILL NOT EVERY IGNORED PATH.
-// The working-tree leg is rsync, which does not read .gitignore, so an ignored path outside these
-// prefixes is copied to the host under a revision that does not name it. Candidate admission
+// An ignored path outside these prefixes is state the revision does not name. Candidate admission
 // refuses on exactly that state (gunbc.live_deploy.candidate, the ignored_deployed arm), naming two
 // remedies: widen these exclusions, or remove the file. The four appended here take the first
 // because they are host state by construction -- agent session state and local tool/build caches
@@ -30,8 +33,8 @@ import v2.std.algebra { any }
 // refusing on one is pure friction.
 //
 // THE .env FAMILY IS DELIBERATELY ABSENT AND STAYS REFUSED. The repository ignores `.env`,
-// `.env.local` and `.env.*.local`; the third is a wildcard, and both this predicate and rsync's
-// `--exclude /<p>` match a literal segment. Listing the two spellable forms would silence admission
+// `.env.local` and `.env.*.local`; the third is a wildcard, and this predicate matches a literal
+// segment. Listing the two spellable forms would silence admission
 // on them while `.env.*.local` kept shipping -- partial cover on the one class where the shipped
 // bytes are secrets, strictly worse than the present loud refusal on all three. It stays refused
 // until the exclusion carrier can express a pattern. src/v2/test/claim/manual/sg2_scratch_probe.dag
@@ -62,12 +65,15 @@ data deployed_tree_excluded_prefixes: List<String> = [
 // recurring_failure_mode/roster.dag). Unlike sg2_scratch_probe, excluding it changes nothing the
 // host compiles: the host's own first invocation derives the identical file from the sibling rows
 // the revision DOES name. Exact path, segment-exact, so a sibling row file is never excluded.
+// The rung-drop roster has the same compiler-owned derivation. The srv1 workspace deployment
+// probe on 2026-10-09 refused itself on that second roster; its sibling authored rows still ship.
 data deployed_tree_excluded_derived_files: List<String> = [
   "dag/gunbc/recurring_failure_mode/roster.dag",
+  "dag/gunbc/rung_drop/roster.dag",
 ]
 
 // Segment-wise, never a character run: `targetish/x` starts with `target` but is not under it, and treating
-// it as excluded would hide from admission a path rsync goes on to ship.
+// it as excluded would hide from admission a path that is not host state.
 fn path_is_deployed(path: String) -> Bool {
   !any(deployed_tree_excluded_prefixes, p => path == p || starts_with(s: path, prefix: concat(p, "/")))
     && !any(deployed_tree_excluded_derived_files, f => path == f)
diff --git a/dag/gunbc/live_deploy/desired.dag b/dag/gunbc/live_deploy/desired.dag
index 3eeb3ead16c..21907fcb938 100644
--- a/dag/gunbc/live_deploy/desired.dag
+++ b/dag/gunbc/live_deploy/desired.dag
@@ -108,7 +108,7 @@ fn deployment_srv2_target() -> DeploymentHostTarget {
     tailscale_client: ScopedRemovalUnobserved {
       reason: "srv2 tailscale Serve scoped-removal capability has not been observed",
     },
-    ensured_directories: [],
+    host_directories: [],
   }
 }
 
diff --git a/dag/gunbc/live_deploy/emit.dag b/dag/gunbc/live_deploy/emit.dag
index ddf5413f7a0..1af5bbc2bce 100644
--- a/dag/gunbc/live_deploy/emit.dag
+++ b/dag/gunbc/live_deploy/emit.dag
@@ -1,5 +1,10 @@
 module gunbc.live_deploy.emit
 
+import gunbc.workspace_artifact_policy { workspace_demo_image_identity }
+import gunbc.workspace_image_delivery { workspace_image_staging_root }
+import gunbc.workspace_guest_image { workspace_image_path, workspace_installed_image_root }
+import gunbc.microvm_guest_artifacts { runner_guest_kernel_artifact, runner_guest_base_artifact_path, ArtifactDigestPinned, ArtifactDigestUnpinned, ArtifactDigestNotPinnable }
+
 import gunbc.workspace_commissioning_dispatch_operations { workspace_dispatch_grant_path, workspace_dispatch_grant_content }
 
 import gunbc.live_deploy.release_environment { installed_release_environment, installed_release_unit }
@@ -14,7 +19,8 @@ import gunbc.fleet_generation_execution { fleet_generation_lock }
 
 import gunbc.runner_microvm_cell_readiness_location { cell_readiness_store_location }
 import gunbc.workspace_commissioning_location { workspace_commissioning_store_location }
-import gunbc.live_deploy.belt_cadence { belt_tick_cadence }
+import gunbc.runner_microvm_network { runner_microvm_converged_receipt_root }
+import gunbc.live_deploy.belt_cadence { belt_tick_cadence, belt_tick_run_bound }
 
 import gunbc.auth.approval_device_redemption { approval_device_store_directory }
 import gunbc.live_deploy.release_locus {
@@ -47,7 +53,6 @@ import gunbc.managed_directory {
   managed_directory_admit,
   ManagedDirectoryAdmission, ManagedDirectoryAdmitted, ManagedDirectoryRefused,
   managed_directory_mode_octal,
-  attempt_state_directory_at,
   EntriesUnmanaged, EntriesReadableByDependents,
   managed_directory_entry_mode, ManagedEntryModeDerived, ManagedEntryModeRefused, entry_mode_add_read_symbolic,
 }
@@ -66,7 +71,7 @@ import extdeps.systemd.systemctl {
   systemctl_disable_now_argv,
   systemctl_show_load_state_argv,
 }
-import extdeps.systemd { systemd_unit_load_state_not_found_wire }
+import extdeps.systemd { systemd_unit_load_state_not_found_wire, systemd_time_span_of_seconds }
 import gunbc.live_deploy.repository_convergence_placement {
   convergence_receipt_path,
   convergence_unit_doc,
@@ -93,7 +98,8 @@ import gunbc.executor_privileged_operation {
 import gunbc.fleet_posix_accounts { fleet_posix_nologin_shell_path, fleet_posix_operator_user, fleet_posix_ci_runner_user, fleet_rm_binary_path }
 import gunbc.cli_invoke { NamedArgumentAdmission, admit_named_argument }
 import extdeps.systemd.unit_file {
-  SystemdUnitFile, ServiceUnitFile, TimerUnitFile, SliceUnitFile,
+  SystemdUnitFile, ServiceUnitFile, TimerUnitFile, SliceUnitFile, PathUnitFile,
+  SystemdPathDirective, PathUnit, DirectoryNotEmpty, PathChanged,
   ServiceSlice, slice_memory_max, slice_memory_high, slice_memory_swap_max,
   SystemdInstallSection, NotInstallable, Installable,
   SystemdUnitDirective, Description, After, Wants,
@@ -139,6 +145,12 @@ import gunbc.live_deploy.slice_bounds {
   repository_convergence_slice_memory_swap_max,
 }
 import gunbc.fabric_storage_placement { fabric_storage_door_socket }
+import gunbc.owned_directory {
+  OwnedDirectoryTarget, OwnedDirectoryManaged, OwnedDirectoryDeclared,
+  owned_directory_path, owned_directory_member, owned_directory_install_plan_of, owned_directory_install_argv,
+}
+import gunbc.ensure { EnsurePlanAvailable, EnsurePlanUnavailable }
+import gunbc.roadmap_dashboard_instance { dashboard_dispatch_worktree_member, dashboard_attempt_state_member }
 import gunbc.live_deploy.spec {
   deployment_slice_unit_name, deployment_slice_unit_path,
   deployment_fabric_storage_unit_name, deployment_fabric_storage_serve_endpoint, deployment_approval_broker_front_door_endpoints,
@@ -149,15 +161,16 @@ import gunbc.live_deploy.spec {
   DeploymentSpec,
   DeploymentStep, ArtifactStep, Dependency,
   DeploymentDependencyStep,
-  EnsuredSubject, EnsuredPackage, EnsuredHostDirectory, EnsuredManagedHostDirectory, ensured_subject_identity,
-  deployment_provider_state_step,
+  EnsuredSubject, EnsuredPackage, ensured_subject_identity,
+  deployment_directory_demands,
   DeploymentArtifactStep,
-  ServeBinary, GunbcSourceTree, DispatchWorktreeRoot, AttemptStateRoot, ComputeRoot, SystemdUnit, BeltTimerUnit, FleetConvergeTimerUnit, TailscaleServeMapping, DeployedTreeRemoteUnit, PublicationHelperTimerUnit, FabricStorageServeUnit, FabricStorageServeMapping, ApprovalBrokerFrontDoor, TailnetDoorServeUnit,
+  ServeBinary, GunbcSourceTree, SystemdUnit, BeltEventPathUnit, FleetConvergeTimerUnit, TailscaleServeMapping, DeployedTreeRemoteUnit, PublicationHelperTimerUnit, FabricStorageServeUnit, FabricStorageServeMapping, ApprovalBrokerFrontDoor, TailnetDoorServeUnit,
   deployment_tailnet_door_socket, deployment_tailnet_door_unit_name, deployment_tailnet_door_function_suffix,
   deployment_belt_service_unit_name,
   deployment_tree_remote_unit_name,
-  deployment_belt_timer_unit_name,
-  deployment_belt_service_unit_path,
+  deployment_belt_exit_path_unit_name, deployment_belt_exit_drain_service_unit_name, deployment_belt_answer_path_unit_name, deployment_belt_discovery_service_unit_name,
+  deployment_belt_exit_drain_service_unit_path, deployment_belt_answer_path_unit_path, deployment_belt_discovery_service_unit_path,
+  deployment_belt_service_unit_path, deployment_belt_unit_install_target,
   deployment_publication_service_unit_name,
   deployment_publication_timer_unit_name,
   deployment_publication_service_unit_path,
@@ -180,6 +193,7 @@ import gunbc.host_layout {
   publication_request_dir,
   publication_answer_dir,
   publication_refused_dir,
+  attempt_exit_spool_root, attempt_exit_inbox_dir, attempt_exit_queued_dir, attempt_exit_running_dir, attempt_exit_done_dir, attempt_exit_refused_dir,
 }
 import gunbc.host_axis_caps {
   CapAuthorizationRefused, CapAuthorizationWithheld,
@@ -740,36 +754,18 @@ fn emit_approval_broker_unit_doc_on(spec: DeploymentSpec, revision: ReleaseRevis
 
 
 
-// THE PER-TICK WATCHDOG, and the 2026-09-21 measurement that put it here. A Type=oneshot unit with
-// no start bound runs as long as the tick runs, and OnUnitInactiveSec only schedules the next tick
-// from INACTIVITY -- so one tick that wedged in the SCM seed (measured that night: 2.25 hours at
-// 100% CPU inside one capture, the timer showing no next elapse and no receipt distinguishing
-// "nothing to do" from "stuck") halted the whole pipeline invisibly; the operator could not tell
-// the frozen cadence from an idle belt. TimeoutStartSec is the bounded-reconciliation backstop in
-// the workflow-execution ruling's sense: past the bound systemd kills the tick, the unit goes
-// inactive(failed) LOUDLY, and the timer resumes on the next cadence -- one lost pass, never a
-// lost night. The bound must clear the worst HONEST tick, which is first-capture-heavy: a fresh
-// project envelope seeds the whole ~7,050-path intake base through the git bridge once (measured
-// 2026-09-21 at roughly seven minutes of bridge time per project), and verification then runs the
-// node's validations; it must stay far below the hours a wedge needs to be noticed by a human.
-// The bound names the instrument that re-derives it, never a transcribed number (DESIGN section 6):
-// a green tick's receipt at receipts/belt-last-tick.json carries its observed_at, and the belt's
-// own stage timings re-derive the worst honest pass. 45min is the policy row: roughly six times
-// the 2026-09-21 measured seed-bridge cost, far below the hours a wedge needs to be noticed by a
-// human, and any honest growth beyond it must move this row with a reason, not the wedge.
-data belt_tick_run_bound: String = "45min"
 
 fn live_deploy_belt_service_unit_file(spec: DeploymentSpec) -> SystemdUnitFile {
   let svc = spec.service
   ServiceUnitFile {
     unit: [
-      Description { text: "gunbc roadmap belt tick (one reconcile pass over the ready frontier)" as NonEmptyStr },
+      Description { text: "gunbc roadmap belt launch (queues the one launch obligation: admission, spawn, teardown, discovery)" as NonEmptyStr },
       After { target: "network-online.target" as NonEmptyStr },
       Wants { target: "network-online.target" as NonEmptyStr },
     ],
     service: concat([
       ServiceType { mode: OneshotMode },
-      TimeoutStartSec { duration: belt_tick_run_bound as NonEmptyStr },
+      TimeoutStartSec { duration: systemd_time_span_of_seconds(d: belt_tick_run_bound) },
       ServiceUser { name: svc.service_user },
       ServiceGroup { name: svc.service_user },
       ServiceSlice { name: deployment_slice_unit_name(names: spec.names) },
@@ -781,7 +777,7 @@ fn live_deploy_belt_service_unit_file(spec: DeploymentSpec) -> SystemdUnitFile {
       ExecStart { command: join([
         svc.serve_binary as String,
         " run --source-root dag --source-root src/v2",
-        " --entry dag/gunbc/roadmap/roadmap_belt_tick_cli.dag --function belt_run_once_cli",
+        " --entry dag/gunbc/roadmap/roadmap_belt_tick_cli.dag --function belt_launch_enqueue_cli",
       ], "") as NonEmptyStr },
     ])),
     install: NotInstallable,
@@ -850,7 +846,7 @@ fn emit_publication_timer_unit_doc(spec: DeploymentSpec) -> Doc {
     timer: [
       TimerUnit { target: deployment_publication_service_unit_name(names: spec.names) },
       OnBootSec { duration: "2min" as NonEmptyStr },
-      OnUnitInactiveSec { duration: belt_tick_cadence as NonEmptyStr },
+      OnUnitInactiveSec { duration: systemd_time_span_of_seconds(d: belt_tick_cadence) },
       AccuracySec { duration: "5s" as NonEmptyStr },
     ],
     install: Installable { directives: [WantedBy { target: "timers.target" as NonEmptyStr }] },
@@ -923,21 +919,91 @@ fn apply_publication_spool_steps(spec: DeploymentSpec) -> List<PipelineStep> {
   ]
 }
 
-fn live_deploy_belt_timer_unit_file(spec: DeploymentSpec) -> SystemdUnitFile {
-  TimerUnitFile {
-    unit: [Description { text: "gunbc roadmap belt tick cadence" as NonEmptyStr }],
-    timer: [
-      TimerUnit { target: deployment_belt_service_unit_name(names: spec.names) },
-      OnBootSec { duration: "2min" as NonEmptyStr },
-      OnUnitInactiveSec { duration: belt_tick_cadence as NonEmptyStr },
-      AccuracySec { duration: "5s" as NonEmptyStr },
+// THE BELT'S EVENT UNITS (dogfood intervention #4). Each service is one `gunbc run` entry of
+// gunbc.roadmap_belt_tick_cli under the belt service's principal, slice and spawn root, so the two
+// event services resolve the same instance the belt service does and start obligation units in the
+// same user manager the belt's workers run in.
+//
+// THE EXIT PATH IS A LEVEL, NOT AN EDGE (extdeps.systemd.unit_file SystemdPathDirective): with
+// DirectoryNotEmpty= systemd re-checks the inbox when the drain finishes, so an exit recorded while
+// the drain was running starts it again instead of waiting for the next one. The drain moves every
+// entry it hands off out of the inbox, so the inbox empties and the path goes quiet. `queued` is a
+// second level on the same unit: it holds exits no run has CLAIMED (a run claims queued -> running
+// before its first observation, so a long run does not keep the level up), so an exit that arrived
+// while its attempt's unit was held, or that a lost unit or a reboot left behind, starts the drain
+// again with no other event, and the drain's sweep hands it to a run.
+//
+// THE DRAIN SERVICE IS ALSO WANTED BY multi-user.target: starting once at boot is the reconciliation that
+// returns a claim orphaned by a reboot (no stop hook ran) to `queued`. The path unit cannot do it -- the
+// orphan sits in `running`, and DirectoryNotEmpty= on a directory a long run legitimately holds would
+// re-trigger while the run lives and fail the path unit at its rate limit. A unit that ends while the
+// manager is up is rescued by its own stop hook instead (belt_attempt_obligations_enqueue).
+//
+// THE PUBLICATION ANSWER PATH IS AN EDGE: answers are kept, not moved, so a level would fire forever.
+// A change while discovery is running is coalesced into that run; discovery reads every attempt's
+// evidence, so the coalesced answer is still seen.
+fn live_deploy_belt_event_service_unit_file(spec: DeploymentSpec, description: String, function: String, install: SystemdInstallSection) -> SystemdUnitFile {
+  let svc = spec.service
+  ServiceUnitFile {
+    unit: [
+      Description { text: description as NonEmptyStr },
+      After { target: "network-online.target" as NonEmptyStr },
+      Wants { target: "network-online.target" as NonEmptyStr },
     ],
-    install: Installable { directives: [WantedBy { target: "timers.target" as NonEmptyStr }] },
+    service: concat([
+      ServiceType { mode: OneshotMode },
+      TimeoutStartSec { duration: systemd_time_span_of_seconds(d: belt_tick_run_bound) },
+      ServiceUser { name: svc.service_user },
+      ServiceGroup { name: svc.service_user },
+      ServiceSlice { name: deployment_slice_unit_name(names: spec.names) },
+      WorkingDirectory { path: svc.repo_root },
+      Environment { assignment: join([
+        belt_spawn_workdir_env_var as String, "=", svc.repo_root as String,
+      ], "") as NonEmptyStr },
+    ], concat(user_manager_environment_directives(uid: svc.service_uid), [
+      ExecStart { command: join([
+        svc.serve_binary as String,
+        " run --source-root dag --source-root src/v2",
+        " --entry dag/gunbc/roadmap/roadmap_belt_tick_cli.dag --function ", function,
+      ], "") as NonEmptyStr },
+    ])),
+    install: install,
+  }
+}
+
+fn live_deploy_belt_exit_drain_service_unit_file(spec: DeploymentSpec) -> SystemdUnitFile {
+  live_deploy_belt_event_service_unit_file(spec: spec, description: "gunbc roadmap belt exit drain (hands recorded unit exits to their attempt obligations)", function: "belt_exit_drain_cli", install: Installable { directives: [WantedBy { target: deployment_belt_unit_install_target(names: spec.names) }] })
+}
+
+fn live_deploy_belt_discovery_service_unit_file(spec: DeploymentSpec) -> SystemdUnitFile {
+  live_deploy_belt_event_service_unit_file(spec: spec, description: "gunbc roadmap belt discovery (queues outstanding obligations, bounded)", function: "belt_discover_once_cli", install: NotInstallable)
+}
+
+fn live_deploy_belt_exit_path_unit_file(spec: DeploymentSpec) -> SystemdUnitFile {
+  PathUnitFile {
+    unit: [Description { text: "gunbc roadmap belt: a unit exit was recorded" as NonEmptyStr }],
+    path: [
+      PathUnit { target: deployment_belt_exit_drain_service_unit_name(names: spec.names) },
+      DirectoryNotEmpty { path: attempt_exit_inbox_dir(instance_root: spec.service.instance_root as String) as NonEmptyStr },
+      DirectoryNotEmpty { path: attempt_exit_queued_dir(instance_root: spec.service.instance_root as String) as NonEmptyStr },
+    ],
+    install: Installable { directives: [WantedBy { target: "paths.target" as NonEmptyStr }] },
   }
 }
 
-fn emit_belt_timer_unit_doc(spec: DeploymentSpec) -> Doc {
-  doc_text(text: serialize_systemd_unit_file(file: live_deploy_belt_timer_unit_file(spec: spec)))
+fn live_deploy_belt_answer_path_unit_file(spec: DeploymentSpec) -> SystemdUnitFile {
+  PathUnitFile {
+    unit: [Description { text: "gunbc roadmap belt: a publication answer arrived" as NonEmptyStr }],
+    path: [
+      PathUnit { target: deployment_belt_discovery_service_unit_name(names: spec.names) },
+      PathChanged { path: publication_answer_dir(instance_root: spec.service.instance_root as String) as NonEmptyStr },
+    ],
+    install: Installable { directives: [WantedBy { target: "paths.target" as NonEmptyStr }] },
+  }
+}
+
+fn emit_belt_unit_file_doc(file: SystemdUnitFile) -> Doc {
+  doc_text(text: serialize_systemd_unit_file(file: file))
 }
 
 // THE DEPLOYED TREE'S REMOTE, CONVERGED BY ITS OWNER.
@@ -1014,7 +1080,7 @@ fn apply_belt_service_unit_write_step(spec: DeploymentSpec) -> PipelineStep {
 // Receipt *directory bootstrap* (existence + service-principal ownership) is on deploy, but NOT
 // here: this member's apply arm is a retirement poison (the cadence is on-demand via
 // fleet-converge.yml plan/apply, sleek-heron-218), so the bootstrap it used to carry has not run
-// on any fresh instance root since that retirement. It rides BeltTimerUnit apply against the
+// on any fresh instance root since that retirement. It rides BeltEventPathUnit apply against the
 // per-instance receipts directory instead — see the annotation on emit_artifact_upsert. Publication and
 // bootstrap remain orthogonal problems; only the bootstrap's home moved.
 fn emit_fleet_converge_service_unit_doc(spec: DeploymentSpec) -> Doc {
@@ -1066,10 +1132,18 @@ fn apply_fleet_converge_timer_unit_write_step(spec: DeploymentSpec) -> PipelineS
   ))
 }
 
-fn apply_belt_timer_unit_write_step(spec: DeploymentSpec) -> PipelineStep {
+fn apply_belt_unit_file_write_step(stage_name: NonEmptyStr, file: SystemdUnitFile) -> PipelineStep {
   deploy_raw(command: deploy_stage_write_command(
-    stage_name: deployment_belt_timer_unit_name(names: spec.names) as String,
-    content: render(doc: emit_belt_timer_unit_doc(spec: spec), proto: live_deploy_protocol),
+    stage_name: stage_name as String,
+    content: render(doc: emit_belt_unit_file_doc(file: file), proto: live_deploy_protocol),
+  ))
+}
+
+fn apply_belt_unit_file_install_step(stage_name: NonEmptyStr, dest: NonEmptyStr) -> PipelineStep {
+  deploy_raw(command: deploy_stage_install_command(
+    stage_name: stage_name as String,
+    mode: install_file_shared_mode,
+    dest: dest as String,
   ))
 }
 
@@ -1115,10 +1189,7 @@ fn identity_member_of_step(step: DeploymentStep) -> ConvergedMember? {
       GunbcSourceTree => Present { value: TreePublication }
       ServeBinary => Present { value: Executable }
       SystemdUnit => Present { value: UnitFile }
-      DispatchWorktreeRoot => Present { value: DirectoryRoot { path: art.path } }
-      AttemptStateRoot => Present { value: DirectoryRoot { path: art.path } }
-      ComputeRoot => Present { value: DirectoryRoot { path: art.path } }
-      BeltTimerUnit => none
+      BeltEventPathUnit => none
       FleetConvergeTimerUnit => none
       TailscaleServeMapping => none
       DeployedTreeRemoteUnit => none
@@ -1463,26 +1534,12 @@ fn install_d_owned_command(spec: DeploymentSpec, path: String) -> String {
   install_d_owned_for_user(user: spec.service.service_user, path: path)
 }
 
-// THE DISPATCH THAT ADMITS A SECOND KIND OF ENSURED RESOURCE, written so the package arm is
-// untouched. A package still lowers to exactly the ensure step it always did, at both privilege
-// settings, so no existing emitted byte moves -- the widening adds a kind, it does not redefine
-// what ensuring a package means.\n\nA directory lowers to the same owned install -d the artifact
-// steps use, through the same single authority, with the owner taken from the ensured subject
-// rather than from a deployment spec. That is what lets a host-level resource be stated without an
-// instance: an ensured host directory is a fact about the host, and threading a spec through it
-// would have made it look like a per-instance fact again -- the exact confusion that put this root
-// in the owned roster to begin with.\n\nprivileged is consumed only by the package arm because it
-// describes how apt is invoked; install -d is privileged in both contexts and takes the same form
-// either way.
+// AN ENSURED DEPENDENCY IS A PACKAGE. The directory arms that lowered an ensured host directory to an
+// owned install -d are gone: every directory is an owned-directory target, emitted by
+// owned_directory_apply_steps below from the provider's plan. privileged describes how apt is invoked.
 fn ensure_dependency_steps(dep: DeploymentDependencyStep, privileged: Bool) -> List<PipelineStep> {
   match dep.subject {
     EnsuredPackage { package } => [ensure_apt_package_step(pkg: package, privileged: privileged)]
-    EnsuredHostDirectory { path, owner } => [
-      deploy_raw(command: install_d_owned_for_user(user: owner, path: path as String)),
-    ]
-    EnsuredManagedHostDirectory { admission } =>
-      concat([deploy_raw(command: ensure_managed_directory_command(admission: admission))],
-        map(managed_directory_entry_repair_commands(admission: admission), c => deploy_raw(command: c)))
   }
 }
 
@@ -1581,28 +1638,52 @@ fn deploy_publication_principal_ensure_command(spec: DeploymentSpec) -> String {
   })
 }
 
-// THE PROVIDER-STATE ENSURE RIDES THE PREAMBLE, DERIVED FROM THE SPEC RATHER THAN FOUND IN ITS STEP
-// LIST (C7). Every apply emits it because gunbc.live_deploy.spec deployment_provider_state_step is a
-// function of the spec, not a row an author may forget: there is no spec for which it returns
-// nothing, so there is no state in which the deploy silently stops creating the directory the
-// provider login writes into. That is the construction the earlier refusal arm was standing in for.
-//
-// Ensured means converged on every apply and never torn down, so it emits unconditionally rather
-// than gated on a plan mutation: `install -d` is idempotent, and a converged host re-running it is
-// what the category means. The read-back member reports the directory's OWNER; it does not decide
-// whether the directory is created.
-fn provider_state_ensure_steps(spec: DeploymentSpec) -> List<PipelineStep> {
-  ensure_dependency_steps(dep: deployment_provider_state_step(spec: spec), privileged: true)
+fn deploy_apply_preamble_steps(access: DeployAccess, spec: DeploymentSpec) -> List<PipelineStep> {
+  [
+    deploy_raw(command: deploy_sudoers_install_shell(access: access)),
+    deploy_raw(command: deploy_publication_principal_ensure_command(spec: spec)),
+  ]
 }
 
-fn deploy_apply_preamble_steps(access: DeployAccess, spec: DeploymentSpec) -> List<PipelineStep> {
-  concat(
-    [
-      deploy_raw(command: deploy_sudoers_install_shell(access: access)),
-      deploy_raw(command: deploy_publication_principal_ensure_command(spec: spec)),
-    ],
-    provider_state_ensure_steps(spec: spec),
-  )
+// ── EVERY DIRECTORY THE DEPLOYMENT DEMANDS, THROUGH THE ONE PROVIDER ─────────────────────────────
+//
+// The apply half of gunbc.owned_directory's lifecycle on this route. The decision was made at plan time
+// over a host observation (gunbc.live_deploy.member_observe observe_owned_directory, the provider's
+// owned_directory_decide), and it arrives here as each DirectoryRoot member's mutation: keep emits
+// nothing, create and repair emit the provider's install plan (owned_directory_install_plan_of) as the
+// granted `sudo -n install -d -m -o -g`. A refused decision never reaches the emitter -- it refused
+// the whole derivation -- and the post-apply readback re-derives the plan through the same observer.
+// A member the plan makes no claim about is emitted, never skipped (plan_mutation_of's rule).
+//
+// These run after the preamble (the sudoers grant they ride) and before every owned step, so no
+// member -- the unit's process, the belt timer's tick -- starts before the directories it writes.
+fn owned_directory_apply_steps(spec: DeploymentSpec, plan: ReleaseEffectPlan) -> List<PipelineStep> {
+  flat_map(deployment_directory_demands(spec: spec), t =>
+    match plan_mutation_of(plan: plan, member: DirectoryRoot { path: owned_directory_path(t: t) as String as NonEmptyStr }) {
+      MemberNotInPlan => owned_directory_install_steps(t: t)
+      MutationInPlan { mutation } =>
+        if mutation_is_keep(e: mutation) { [] } else { owned_directory_install_steps(t: t) }
+    })
+}
+
+// A TARGET WHOSE MODE DOES NOT DERIVE LOWERS TO A MARKER THAT IS NOT SHELL, never to an install with a
+// guessed mode. A managed target whose dependents read each other's entries also carries the entry
+// repair (managed_directory_entry_repair_commands), riding the same ensure as before.
+data owned_directory_unplannable_poison: String = "__GUNBC_DEPLOY_REFUSED__ owned directory NOT ENSURED: gunbc.owned_directory owned_directory_install_plan_of has no plan: "
+
+fn owned_directory_install_steps(t: OwnedDirectoryTarget) -> List<PipelineStep> {
+  match owned_directory_install_plan_of(t: t) {
+    EnsurePlanUnavailable { reason } => [deploy_raw(command: concat(owned_directory_unplannable_poison, reason))]
+    EnsurePlanAvailable { plan } =>
+      concat(
+        [deploy_raw(command: shell_privileged_command_text_of_argv(argv: owned_directory_install_argv(plan: plan)))],
+        match t {
+          OwnedDirectoryManaged { directory } =>
+            map(managed_directory_entry_repair_commands(admission: managed_directory_admit(d: directory)), c => deploy_raw(command: c))
+          OwnedDirectoryDeclared { member: _, path: _, owner: _, mode: _ } => []
+        },
+      )
+  }
 }
 
 // THE CAP APPLY CONSUMES RETIREMENT AUTHORIZATION, AND WITHOUT ONE IT REFUSES.
@@ -2245,7 +2326,7 @@ fn microvm_controller_install_intent(revision: ReleaseRevisionBinding) -> Pipeli
             base_root: microvm_controller_root,
             revision: revision,
           ),
-          microvm_controller_vmm_install_steps(revision: revision),
+          microvm_controller_vmm_install_steps(revision: revision) + workspace_image_install_steps(revision: revision),
         ),
       ),
       concat(
@@ -2253,6 +2334,7 @@ fn microvm_controller_install_intent(revision: ReleaseRevisionBinding) -> Pipeli
           deploy_raw(command: install_d_owned_for_user(user: microvm_controller_owner, path: microvm_slot_controller_receipt_dir)),
           deploy_raw(command: install_d_owned_for_user(user: microvm_controller_owner, path: cell_readiness_store_location)),
           deploy_raw(command: install_d_owned_for_user(user: microvm_controller_owner, path: workspace_commissioning_store_location)),
+          deploy_raw(command: install_d_owned_for_user(user: microvm_controller_owner, path: runner_microvm_converged_receipt_root)),
         ],
         concat(microvm_slot_unit_write_steps(revision: revision) + workspace_executor_install_steps(revision: revision) + workspace_dispatch_grant_steps(revision: revision), [deploy_effect(inv: systemctl_daemon_reload_effect())]),
       ),
@@ -2784,17 +2866,6 @@ fn emit_artifact_upsert(art: DeploymentArtifactStep, spec: DeploymentSpec, revis
       tree_sync_restart_step_with_diagnosis(spec: spec),
       deploy_raw(command: repository_convergence_readback_command(spec: spec)),
     ]))
-    DispatchWorktreeRoot => [
-      deploy_raw(command: install_d_owned_command(spec: spec, path: art.path as String)),
-    ]
-    AttemptStateRoot => [
-      deploy_raw(command: install_d_managed_command(
-        dir: attempt_state_directory_at(path: art.path as String as FilePath),
-      )),
-    ]
-    ComputeRoot => [
-      deploy_raw(command: install_d_owned_command(spec: spec, path: art.path as String)),
-    ]
     SystemdUnit => concat(concat([
       apply_systemd_unit_write_step(spec: spec, revision: revision),
       deploy_raw(command: deploy_stage_install_command(
@@ -2827,26 +2898,37 @@ fn emit_artifact_upsert(art: DeploymentArtifactStep, spec: DeploymentSpec, revis
         deploy_effect(inv: systemctl_restart_effect(unit: deployment_publication_timer_unit_name(names: spec.names))),
       ]
     )
-    BeltTimerUnit => [
+    BeltEventPathUnit => [
       deploy_raw(command: install_d_owned_command(
         spec: spec,
         path: instance_receipts_dir(instance_root: spec.service.instance_root as String),
       )),
+      deploy_raw(command: install_d_owned_command(spec: spec, path: attempt_exit_spool_root(instance_root: spec.service.instance_root as String))),
+      deploy_raw(command: install_d_owned_command(spec: spec, path: attempt_exit_inbox_dir(instance_root: spec.service.instance_root as String))),
+      deploy_raw(command: install_d_owned_command(spec: spec, path: attempt_exit_queued_dir(instance_root: spec.service.instance_root as String))),
+      deploy_raw(command: install_d_owned_command(spec: spec, path: attempt_exit_running_dir(instance_root: spec.service.instance_root as String))),
+      deploy_raw(command: install_d_owned_command(spec: spec, path: attempt_exit_done_dir(instance_root: spec.service.instance_root as String))),
+      deploy_raw(command: install_d_owned_command(spec: spec, path: attempt_exit_refused_dir(instance_root: spec.service.instance_root as String))),
       apply_belt_service_unit_write_step(spec: spec),
-      apply_belt_timer_unit_write_step(spec: spec),
+      apply_belt_unit_file_write_step(stage_name: deployment_belt_exit_drain_service_unit_name(names: spec.names), file: live_deploy_belt_exit_drain_service_unit_file(spec: spec)),
+      apply_belt_unit_file_write_step(stage_name: deployment_belt_discovery_service_unit_name(names: spec.names), file: live_deploy_belt_discovery_service_unit_file(spec: spec)),
+      apply_belt_unit_file_write_step(stage_name: deployment_belt_exit_path_unit_name(names: spec.names), file: live_deploy_belt_exit_path_unit_file(spec: spec)),
+      apply_belt_unit_file_write_step(stage_name: deployment_belt_answer_path_unit_name(names: spec.names), file: live_deploy_belt_answer_path_unit_file(spec: spec)),
       deploy_raw(command: deploy_stage_install_command(
         stage_name: deployment_belt_service_unit_name(names: spec.names) as String,
         mode: install_file_shared_mode,
         dest: deployment_belt_service_unit_path(names: spec.names) as String,
       )),
-      deploy_raw(command: deploy_stage_install_command(
-        stage_name: deployment_belt_timer_unit_name(names: spec.names) as String,
-        mode: install_file_shared_mode,
-        dest: art.path as String,
-      )),
+      apply_belt_unit_file_install_step(stage_name: deployment_belt_exit_drain_service_unit_name(names: spec.names), dest: deployment_belt_exit_drain_service_unit_path(names: spec.names)),
+      apply_belt_unit_file_install_step(stage_name: deployment_belt_discovery_service_unit_name(names: spec.names), dest: deployment_belt_discovery_service_unit_path(names: spec.names)),
+      apply_belt_unit_file_install_step(stage_name: deployment_belt_answer_path_unit_name(names: spec.names), dest: deployment_belt_answer_path_unit_path(names: spec.names)),
+      apply_belt_unit_file_install_step(stage_name: deployment_belt_exit_path_unit_name(names: spec.names), dest: art.path),
       deploy_effect(inv: systemctl_daemon_reload_effect()),
-      deploy_effect(inv: systemctl_enable_effect(unit: deployment_belt_timer_unit_name(names: spec.names))),
-      deploy_effect(inv: systemctl_restart_effect(unit: deployment_belt_timer_unit_name(names: spec.names))),
+      deploy_effect(inv: systemctl_enable_effect(unit: deployment_belt_exit_drain_service_unit_name(names: spec.names))),
+      deploy_effect(inv: systemctl_enable_effect(unit: deployment_belt_exit_path_unit_name(names: spec.names))),
+      deploy_effect(inv: systemctl_restart_effect(unit: deployment_belt_exit_path_unit_name(names: spec.names))),
+      deploy_effect(inv: systemctl_enable_effect(unit: deployment_belt_answer_path_unit_name(names: spec.names))),
+      deploy_effect(inv: systemctl_restart_effect(unit: deployment_belt_answer_path_unit_name(names: spec.names))),
     ]
     FleetConvergeTimerUnit => [
       deploy_raw(command: "__GUNBC_FLEET_CONVERGE_REFUSED__ FleetConvergeTimerUnit retired from deployment membership — timer cadence is on-demand via fleet-converge.yml plan/apply, not live_deploy apply (sleek-heron-218)"),
@@ -2914,11 +2996,11 @@ fn emit_artifact_upsert(art: DeploymentArtifactStep, spec: DeploymentSpec, revis
 // remove this store even by mistake -- the property the previous `rm -d` arm tried to approximate
 // by refusing on a non-empty directory is now structural, and the awkward consequence that arm
 // carried (a full retract could never complete once the store existed) simply does not arise.
-// DispatchWorktreeRoot teardown is rm -d (empty-directory removal via the granted rm — the
+// The dispatch worktree root's refusal is rm -d (empty-directory removal via the granted rm — the
 // unprivileged principal has no rmdir grant and no write on the root-owned parent), NEVER rm -rf: a
 // non-empty worktree root means live agent worktrees exist, so the retract FAILS LOUDLY there
 // instead of silently destroying sessions (DESIGN 5 — the refusal is the empty-dir precondition
-// itself, identical to the former rmdir). GunbcSourceTree teardown runs AFTER the worktree rm -d
+// itself, identical to the former rmdir). GunbcSourceTree teardown runs its rm -rf only AFTER that rm -d
 // succeeds, so the repo the worktrees are registered in is never deleted from under them.
 
 fn emit_artifact_teardown(art: DeploymentArtifactStep, spec: DeploymentSpec) -> List<PipelineStep> {
@@ -2956,11 +3038,17 @@ fn emit_artifact_teardown(art: DeploymentArtifactStep, spec: DeploymentSpec) ->
         deploy_effect(inv: systemctl_daemon_reload_effect()),
       ]
     )
-    BeltTimerUnit => concat(
-      systemctl_disable_now_if_present_steps(unit: deployment_belt_timer_unit_name(names: spec.names), privileged: true),
+    BeltEventPathUnit => concat(
+      concat(
+        systemctl_disable_now_if_present_steps(unit: deployment_belt_exit_path_unit_name(names: spec.names), privileged: true),
+        systemctl_disable_now_if_present_steps(unit: deployment_belt_answer_path_unit_name(names: spec.names), privileged: true),
+      ),
       [
         deploy_raw(command: gunbc.live_deploy.operations.rm_force_command(paths: [
           art.path as String,
+          deployment_belt_answer_path_unit_path(names: spec.names) as String,
+          deployment_belt_exit_drain_service_unit_path(names: spec.names) as String,
+          deployment_belt_discovery_service_unit_path(names: spec.names) as String,
           deployment_belt_service_unit_path(names: spec.names) as String,
         ])),
         deploy_effect(inv: systemctl_daemon_reload_effect()),
@@ -2993,30 +3081,38 @@ fn emit_artifact_teardown(art: DeploymentArtifactStep, spec: DeploymentSpec) ->
         deploy_effect(inv: systemctl_daemon_reload_effect()),
       ]
     )
-    DispatchWorktreeRoot => [
-      deploy_raw(command: rm_empty_directory_command(path: art.path as String)),
-    ]
-    AttemptStateRoot => [
-      deploy_raw(command: rm_empty_directory_command(path: art.path as String)),
-    ]
-    ComputeRoot => [
-      deploy_raw(command: rm_force_recursive_command(path: art.path as String)),
-    ]
     ServeBinary => [
       deploy_raw(command: gunbc.live_deploy.operations.rm_force_command(paths: [art.path as String])),
     ]
-    GunbcSourceTree => [
-      deploy_raw(command: gunbc.live_deploy.operations.rm_force_command(paths: [
-        tree_sync_unit_path(names: spec.names) as String,
-        spec.names.tree_sync_env_path as String,
-        deployment_slice_unit_path(names: spec.names) as String,
-      ])),
-      deploy_effect(inv: systemctl_daemon_reload_effect()),
-      deploy_raw(command: rm_force_recursive_command(path: art.path as String)),
-    ]
+    GunbcSourceTree => concat(
+      map(dispatch_root_refusal_paths(spec: spec), p => deploy_raw(command: rm_empty_directory_command(path: p))),
+      [
+        deploy_raw(command: gunbc.live_deploy.operations.rm_force_command(paths: [
+          tree_sync_unit_path(names: spec.names) as String,
+          spec.names.tree_sync_env_path as String,
+          deployment_slice_unit_path(names: spec.names) as String,
+        ])),
+        deploy_effect(inv: systemctl_daemon_reload_effect()),
+        deploy_raw(command: rm_force_recursive_command(path: art.path as String)),
+      ],
+    )
   }
 }
 
+// THE SOURCE TREE'S TEARDOWN KEEPS THE DISPATCH ROOTS' EMPTY-DIRECTORY REFUSAL. The two roots were
+// owned steps whose teardown ran before the tree's and refused on a live worktree or published attempt
+// evidence; they are owned-directory demands now and a retract does not tear directories down, but
+// deleting the tree a live worktree is registered in is the hazard that refusal stood for, so the
+// tree's own teardown begins with it. The paths are the spec's demands, read by member name.
+fn dispatch_root_refusal_paths(spec: DeploymentSpec) -> List<String> {
+  map(
+    filter(xs: spec.directories, predicate: t =>
+      (owned_directory_member(t: t) as String) == (dashboard_dispatch_worktree_member as String)
+        || (owned_directory_member(t: t) as String) == (dashboard_attempt_state_member as String)),
+    t => owned_directory_path(t: t) as String,
+  )
+}
+
 // The per-member realization HANDLER: share the DIFF (membership_reconcile), dispatch the APPLY
 // (this). One handler for both fold directions — EffectAdd dispatches on member kind to the
 // artifact/dependency install fragments; EffectRemove to the removal fragments. Orchestration is
@@ -3093,12 +3189,7 @@ fn apply_step_effects(
 ) -> List<PipelineStep> {
   match identity_member_of_step(step: step) {
     Present { value: member } => match member {
-      DirectoryRoot { path: _ } => match plan_mutation_of(plan: plan, member: member) {
-        MemberNotInPlan => step_membership_effects(step: step, effects: effects, spec: spec, plan: plan)
-        MutationInPlan { mutation } =>
-          if mutation_is_keep(e: mutation) { [] }
-          else { step_membership_effects(step: step, effects: effects, spec: spec, plan: plan) }
-      }
+      DirectoryRoot { path: _ } => []
       TreePublication => emit_release_member_effects(member: member, plan: plan, spec: spec)
       Executable => emit_release_member_effects(member: member, plan: plan, spec: spec)
       UnitFile => emit_release_member_effects(member: member, plan: plan, spec: spec)
@@ -3168,7 +3259,10 @@ fn apply_intent_from_effects(
     steps: concat(
       deploy_apply_frame_steps(spec: spec),
       concat(
-        deploy_apply_preamble_steps(access: access, spec: spec),
+        concat(
+          deploy_apply_preamble_steps(access: access, spec: spec),
+          owned_directory_apply_steps(spec: spec, plan: plan),
+        ),
         concat(
           deploy_memory_cap_apply_steps(spec: spec, authorization: cap_authorization),
           concat(
@@ -3550,7 +3644,8 @@ fn workspace_executor_install_steps(revision: ReleaseRevisionBinding) -> List<Pi
 }
 
 // The installer has already installed the exact controller release under root custody. These
-// argument-free grants name that binary, tree and three fixed entries; no job code is elevated.
+// argument-free grants name that binary, tree and the fixed entry roster; no job code is elevated.
+// The same policy also grants its exact readback operation to the installation observer.
 fn workspace_dispatch_grant_steps(revision: ReleaseRevisionBinding) -> List<PipelineStep> {
   let stage = "workspace-commissioning-sudoers"
   let pending = concat(workspace_dispatch_grant_path, ".pending")
@@ -3564,3 +3659,26 @@ fn workspace_dispatch_grant_steps(revision: ReleaseRevisionBinding) -> List<Pipe
     deploy_raw(command: installed_visudo_policy_check_command(path: workspace_dispatch_grant_path)),
   ]
 }
+
+// Copy only the named files, never extract an archive as root. Verify the administrator-owned
+// destination after copying: a transport/staging race cannot turn different bytes into admission.
+fn workspace_image_install_steps(revision: ReleaseRevisionBinding) -> List<PipelineStep> {
+  let dir = workspace_installed_image_root(release_dir: microvm_controller_release_dir(revision: revision), identity: workspace_demo_image_identity())
+  let kernel = concat(concat(dir, "/"), runner_guest_kernel_artifact.filename as String)
+  let rootfs = concat(dir, "/workspace.ext4")
+  match runner_guest_kernel_artifact.integrity {
+    ArtifactDigestPinned { digest, provenance: _ } => [
+      deploy_raw(command: install_d_owned_for_user(user: microvm_controller_owner, path: dir)),
+      deploy_raw(command: install_file_owned_command(mode: install_file_shared_mode,
+        owner: microvm_controller_owner, group: microvm_controller_owner,
+        source: runner_guest_base_artifact_path(root: workspace_image_staging_root, artifact: runner_guest_kernel_artifact), dest: kernel)),
+      deploy_raw(command: digest_shell_verify_line(digest: digest, file_path: kernel as NonEmptyStr)),
+      deploy_raw(command: install_file_owned_command(mode: install_file_shared_mode,
+        owner: microvm_controller_owner, group: microvm_controller_owner,
+        source: workspace_image_path(root: workspace_image_staging_root), dest: rootfs)),
+      deploy_raw(command: digest_shell_verify_line(digest: sha256_digest(hex: workspace_demo_image_identity()), file_path: rootfs as NonEmptyStr)),
+    ]
+    ArtifactDigestUnpinned { cause: _ } => [deploy_raw(command: "exit 1")]
+    ArtifactDigestNotPinnable { cause: _ } => [deploy_raw(command: "exit 1")]
+  }
+}
diff --git a/dag/gunbc/live_deploy/fleet_request.dag b/dag/gunbc/live_deploy/fleet_request.dag
index 72306cea507..be630906f8d 100644
--- a/dag/gunbc/live_deploy/fleet_request.dag
+++ b/dag/gunbc/live_deploy/fleet_request.dag
@@ -50,6 +50,7 @@ import gunbc.live_deploy.member_identity {
   MemberObserved,
   MemberAbsentOnHost,
   MemberUnobservable,
+  MemberRefusedOnHost,
   MemberDecision,
   AlreadyConverged,
   Create,
@@ -169,6 +170,7 @@ fn live_deploy_observe_supplied(
         MemberUnobservable { member: _, cause: c } => ObservationRefused { cause: c }
         MemberObserved { identity: _ } => ObservationEstablished { observed: o }
         MemberAbsentOnHost { member: _ } => ObservationEstablished { observed: o }
+        MemberRefusedOnHost { member: _, cause: _ } => ObservationEstablished { observed: o }
       }
   }
 }
@@ -235,6 +237,7 @@ fn first_unreadable(observed: List<ObservedMember>) -> LiveDeployAdmissionRefusa
             Present { value: LiveDeployUnreadableMember { member: m, cause: c } }
           MemberObserved { identity: _ } => none
           MemberAbsentOnHost { member: _ } => none
+          MemberRefusedOnHost { member: _, cause: _ } => none
         }
     })
 }
diff --git a/dag/gunbc/live_deploy/member_identity.dag b/dag/gunbc/live_deploy/member_identity.dag
index ca0d9674e63..6d0d8f9ed07 100644
--- a/dag/gunbc/live_deploy/member_identity.dag
+++ b/dag/gunbc/live_deploy/member_identity.dag
@@ -35,8 +35,8 @@ import extdeps.systemd { SystemdUnitActiveState, Active, Inactive, Activating, D
 // executable fixture in member_identity_witness_test is exactly that control.
 // A MEMBER CARRIES ITS OWN KEY WHERE IT HAS ONE. The release members are singular -- there is one
 // executable, one published tree, one serve unit -- so they are nullary. A directory root is not:
-// the deployment owns several, they differ only by path, and minting DispatchWorktreeRoot /
-// AttemptStateRoot / ComputeRoot as nullary variants would be several names
+// the deployment owns several, they differ only by path, and minting a nullary variant per root
+// (one per dispatch, compute or store directory) would be several names
 // for one concept (DESIGN section 2, one concept at every breadth). The path is the key, so it
 // lives on the variant and converged_member_label renders it -- which is also what keeps
 // converged_member_eq correct for a payload-carrying member, since that equality is defined
@@ -94,15 +94,21 @@ type ServiceProcessIdentity
   = ProcessRunningRelease { revision: CommitSha }
   | ProcessNotRunning { active: SystemdUnitActiveState }
 
-// A ROOT'S IDENTITY IS ITS OWNING PRINCIPAL, not its presence. Presence is already carried by
-// ObservedMember (an established absence is MemberAbsentOnHost and derives a Create), so an identity
-// that repeated it would be the same fact in two carriers. What presence CANNOT say is whether the
-// directory that is there belongs to the principal that must write it -- a root owned by root:root
-// is present, and the service user still cannot use it, which is the failure a fresh host and a
-// hand-repaired host both produce. So the identity is the owner, and a wrong owner is a Replace.
+// A ROOT'S IDENTITY IS THE OWNED-DIRECTORY PROVIDER'S STANDING FOR IT, not a second judgement of owner
+// and mode made here. Presence is already carried by ObservedMember (an established absence is
+// MemberAbsentOnHost and derives a Create), and gunbc.owned_directory owned_directory_decide is the one
+// authority on what a present directory's owner, group and mode mean: converged, a mode the provider
+// will re-apply on a directory the demanded principal already owns, or a refusal. The refusal is not an
+// identity at all -- a directory under another principal is never re-owned -- so it arrives as
+// MemberRefusedOnHost and refuses the whole derivation. The owner used to be this identity, and a wrong
+// owner derived a Replace that re-owned the directory: adoption from an observation, now deleted.
+type DirectoryRootStanding
+  = RootConverged
+  | RootModeRepairable { observed_mode: NonEmptyStr }
+
 type DirectoryRootIdentity {
   path: NonEmptyStr
-  owner: NonEmptyStr
+  standing: DirectoryRootStanding
 }
 
 type MemberIdentity
@@ -132,12 +138,14 @@ type ObservedMember
   = MemberObserved { identity: MemberIdentity }
   | MemberAbsentOnHost { member: ConvergedMember }
   | MemberUnobservable { member: ConvergedMember, cause: String }
+  | MemberRefusedOnHost { member: ConvergedMember, cause: String }
 
 fn observed_member_member(o: ObservedMember) -> ConvergedMember {
   match o {
     MemberObserved { identity } => member_identity_member(i: identity)
     MemberAbsentOnHost { member } => member
     MemberUnobservable { member, cause: _ } => member
+    MemberRefusedOnHost { member, cause: _ } => member
   }
 }
 
@@ -186,8 +194,15 @@ fn service_process_identity_wire(p: ServiceProcessIdentity) -> String {
   }
 }
 
+fn directory_root_standing_wire(s: DirectoryRootStanding) -> String {
+  match s {
+    RootConverged => "converged"
+    RootModeRepairable { observed_mode } => join(["mode-repairable=", observed_mode as String], "")
+  }
+}
+
 fn directory_root_identity_wire(r: DirectoryRootIdentity) -> String {
-  join([r.path as String, ":owner=", r.owner as String], "")
+  join([r.path as String, ":", directory_root_standing_wire(s: r.standing)], "")
 }
 
 // TOTAL: every MemberIdentity arm contributes every field that distinguishes it. A forgotten
@@ -209,6 +224,8 @@ fn observed_member_wire(o: ObservedMember) -> String {
     MemberAbsentOnHost { member: m } => join(["member-absent:", converged_member_label(m: m)], "")
     MemberUnobservable { member: m, cause: c } =>
       join(["member-unobservable:", converged_member_label(m: m), ":", c], "")
+    MemberRefusedOnHost { member: m, cause: c } =>
+      join(["member-refused:", converged_member_label(m: m), ":", c], "")
   }
 }
 
@@ -224,6 +241,7 @@ type MemberRefusalCause
   = DesiredIdentityIsForAnotherMember { desired: ConvergedMember }
   | ObservationIsOfAnotherMember { observed: ConvergedMember }
   | HostUnobservable { cause: String }
+  | HostStateRefused { cause: String }
   | DecisionFiledUnderAnotherMember { found: ConvergedMember }
   | DesiredExecutableUnreadable { cause: String }
   | DesiredExecutableAbsent
@@ -233,6 +251,7 @@ fn member_refusal_text(c: MemberRefusalCause) -> String {
     DesiredIdentityIsForAnotherMember { desired } => join(["desired identity is for ", converged_member_label(m: desired)], "")
     ObservationIsOfAnotherMember { observed } => join(["observation is of ", converged_member_label(m: observed)], "")
     HostUnobservable { cause } => join(["could not observe the host: ", cause], "")
+    HostStateRefused { cause } => join(["the host holds a state this deploy refuses to change: ", cause], "")
     DecisionFiledUnderAnotherMember { found } => join(["decision slot holds a decision about ", converged_member_label(m: found)], "")
     DesiredExecutableUnreadable { cause } => join(["the release executable could not be read in the deploying checkout: ", cause], "")
     DesiredExecutableAbsent => "the release executable target/release/gunbc is absent from the deploying checkout; build before deploying"
@@ -325,7 +344,7 @@ fn member_identity_eq(a: MemberIdentity, b: MemberIdentity) -> Bool {
       RootAt { root: _ } => false
     }
     RootAt { root: ra } => match b {
-      RootAt { root: rb } => (ra.path as String) == (rb.path as String) && (ra.owner as String) == (rb.owner as String)
+      RootAt { root: rb } => (ra.path as String) == (rb.path as String) && directory_root_standing_wire(s: ra.standing) == directory_root_standing_wire(s: rb.standing)
       TreeIdentity { tree: _ } => false
       ExecutableIdentity { digest: _ } => false
       UnitFileAt { file: _ } => false
@@ -351,6 +370,7 @@ fn decide_member(member: ConvergedMember, desired: MemberIdentity, observed: Obs
   } else {
     match observed {
       MemberUnobservable { member: _, cause } => MemberRefused { member: member, cause: HostUnobservable { cause: cause } }
+      MemberRefusedOnHost { member: _, cause } => MemberRefused { member: member, cause: HostStateRefused { cause: cause } }
       MemberAbsentOnHost { member: _ } => Create { member: member, to: desired }
       MemberObserved { identity } =>
         if member_identity_eq(a: identity, b: desired) { AlreadyConverged { member: member } }
@@ -475,7 +495,7 @@ type MemberMutation
   | DaemonReload
   | RestartService
   | CreateRoot
-  | ReownRoot
+  | RepairRootMode
 
 fn member_mutation_label(e: MemberMutation) -> String {
   match e {
@@ -486,7 +506,7 @@ fn member_mutation_label(e: MemberMutation) -> String {
     DaemonReload => "daemon-reload"
     RestartService => "restart-service"
     CreateRoot => "create-root"
-    ReownRoot => "reown-root"
+    RepairRootMode => "repair-root-mode"
   }
 }
 
@@ -524,7 +544,7 @@ type EffectDerivation
 //   unit file changed    -> WriteUnit
 //   manager stale OR the unit file changed -> DaemonReload
 //   any release member changed, or the process itself is stale or down -> RestartService
-//   a root is absent     -> CreateRoot;  a root is owned by the wrong principal -> ReownRoot
+//   a root is absent     -> CreateRoot;  a root the demanded principal owns at another mode -> RepairRootMode (a root under another principal refuses, never re-owned)
 //   nothing changed      -> KeepMember
 //
 // A ROOT DOES NOT RESTART THE SERVE PROCESS, and that is a claim rather than an omission. Roots are
@@ -555,7 +575,7 @@ fn member_mutation_for(d: MemberDecision, decisions: List<MemberDecision>) -> Me
     ServiceProcess => if release_changed || decision_changes(d: d) { RestartService } else { KeepMember }
     DirectoryRoot { path: _ } => match d {
       Create { member: _, to: _ } => CreateRoot
-      Replace { member: _, from: _, to: _ } => ReownRoot
+      Replace { member: _, from: _, to: _ } => RepairRootMode
       AlreadyConverged { member: _ } => KeepMember
       MemberRefused { member: _, cause: _ } => KeepMember
     }
@@ -648,7 +668,7 @@ fn mutation_is_keep(e: MemberMutation) -> Bool {
     DaemonReload => false
     RestartService => false
     CreateRoot => false
-    ReownRoot => false
+    RepairRootMode => false
   }
 }
 
@@ -684,7 +704,7 @@ fn member_row_label(r: MemberEffectRow, target: ReleaseTarget) -> List<String> {
     DaemonReload => ["daemon-reload"]
     RestartService => [join(["restart ", target.unit as String], "")]
     CreateRoot => [join(["create-root ", converged_member_label(m: r.member)], "")]
-    ReownRoot => [join(["reown-root ", converged_member_label(m: r.member)], "")]
+    RepairRootMode => [join(["repair-root-mode ", converged_member_label(m: r.member)], "")]
   }
 }
 
diff --git a/dag/gunbc/live_deploy/member_observe.dag b/dag/gunbc/live_deploy/member_observe.dag
index 76ada9499ed..5db06bfb4fe 100644
--- a/dag/gunbc/live_deploy/member_observe.dag
+++ b/dag/gunbc/live_deploy/member_observe.dag
@@ -1,6 +1,7 @@
 module gunbc.live_deploy.member_observe
 
 import std.types { String, Bool, List, Int, NonEmptyStr, CommitSha, FilePath }
+import std.optional { Optional, Present, Absent }
 import std.algebra { trim }
 import std.content_hash { content_hash_atom }
 import extdeps.crypto.hash { Digest, sha256sum_argv, sha256sum_line_digest }
@@ -20,11 +21,21 @@ import gunbc.host_effect_realize { run_typed_argv_transport }
 import gunbc.typed_argv_exec { TypedArgvExecOutcome, TypedArgvExecConverged, TypedArgvExecRefused }
 import gunbc.live_deploy.spec {
   DeploymentSpec, deployment_systemd_unit_path, deployment_plan_listen_port,
-  DeploymentStep, ArtifactStep, Dependency,
-  DispatchWorktreeRoot, AttemptStateRoot, ComputeRoot,
-  deployment_provider_state_path,
+  deployment_directory_demands,
 }
 import gunbc.live_deploy.candidate_identity { CandidateRelease }
+import gunbc.executor_privileged_operation { ExecutorPrivilegedOperation, ListDirectoryEntries, ReadDirectoryIdentity, executor_privileged_operation_elevated_command, executor_privileged_operation_elevated_argv }
+import gunbc.command_runner { run_shell_command_observe_outcome }
+import extdeps.exec.command { LocalExec }
+import extdeps.shell.exec { ProcessRan, ProcessNotSpawned }
+import gunbc.ensure { EnsureMayApply, EnsureObservation, EnsureObserved, EnsureAbsent, EnsureInaccessible }
+import std.upsert_decision { Noop, Apply, Refuse }
+import extdeps.access.posix { file_mode_octal }
+import gunbc.owned_directory {
+  OwnedDirectoryTarget, OwnedDirectoryReading, owned_directory_path, owned_directory_demand_at,
+  owned_directory_observe, owned_directory_decide,
+  ObserverRead, ObserverReadOut, ObserverReadFailed, ObserverNotSpawned, ObserverTransportRefused, ObserverExited,
+}
 import gunbc.live_deploy.emit { live_deploy_systemd_unit_for }
 import gunbc.live_deploy.release_locus { ReleaseRevisionBinding, RevisionBoundAtEmission }
 import gunbc.live_deploy.readiness { live_deploy_healthz_get_for_port, healthz_release_identity_refusal, healthz_refusal_reason }
@@ -43,7 +54,7 @@ import gunbc.live_deploy.member_identity {
   ObservedMember, MemberObserved, MemberAbsentOnHost, MemberUnobservable,
   MemberDecision, MemberRefused, DesiredExecutableUnreadable, DesiredExecutableAbsent, DesiredIdentityIsForAnotherMember,
   decide_member, release_member_roster, MemberDecision, ConvergedMember, ReleaseTarget,
-  DirectoryRoot, DirectoryRootIdentity, RootAt,
+  DirectoryRoot, DirectoryRootIdentity, RootAt, DirectoryRootStanding, RootConverged, RootModeRepairable, MemberRefusedOnHost,
   EffectDerivation, EffectsDerived, EffectsRefused, derive_member_plan, effect_labels, plan_mutation_count,
 }
 
@@ -159,20 +170,26 @@ fn entry_presence_in_parent(arm: ObservationArm, parent: String, name: String) -
 }
 
 fn entry_presence(arm: ObservationArm, path: String) -> EntryPresence {
+  entry_presence_above(arm: arm, path: path, below: Absent)
+}
+
+// The ancestor walk in tail position, so the Rust realization lowers it to a loop. `below` is the
+// cause read one level down: an ancestor that is present answers with that cause, an absent one
+// answers absent, and the root answers with its own cause -- the same answers the nested walk gave.
+fn entry_presence_above(arm: ObservationArm, path: String, below: Optional<String>) -> EntryPresence {
   let parent = path_parent(path: path)
   let name = path_basename(path: path)
   match entry_presence_in_parent(arm: arm, parent: parent, name: name) {
-    EntryPresent => EntryPresent
+    EntryPresent => match below {
+      Absent => EntryPresent
+      Present { value: cause } => EntryPresenceIndeterminate { cause: cause }
+    }
     EntryAbsent => EntryAbsent
     EntryPresenceIndeterminate { cause } =>
       if parent == "/" {
         EntryPresenceIndeterminate { cause: cause }
       } else {
-        match entry_presence(arm: arm, path: parent) {
-          EntryAbsent => EntryAbsent
-          EntryPresent => EntryPresenceIndeterminate { cause: cause }
-          EntryPresenceIndeterminate { cause: ancestor_cause } => EntryPresenceIndeterminate { cause: ancestor_cause }
-        }
+        entry_presence_above(arm: arm, path: parent, below: Present { value: cause })
       }
   }
 }
@@ -493,97 +510,111 @@ fn desired_tree(candidate: CandidateRelease) -> MemberIdentity {
 // mapping the roster makes them one. Adding a member is a row in the roster and an arm in each of
 // these two total functions -- the compiler names the arm it is missing, which a record of slots
 // could not do because a slot left unwritten is a type error somewhere else entirely.
-// THE ROOT ROSTER COMES FROM THE SPEC, not from a list here. A second host, or the twin, owns
-// different roots at different paths, and a roster written here would be a second authority for
-// what the deployment owns -- the steps already say it. The four directory roots join as
-// DirectoryRoot; the timer units and the tailscale route stay on the apply-all path and
-// contribute no member. A kind that names no member emits exactly as it does now. The
-// provider-state root is Ensured, not Owned: retract never tears it down. It is still a
-// DirectoryRoot for readback (C7). Its presence and owner are read like any root's, so a host whose
-// provider login has nowhere to write shows as a member to create, not as a converged host.
-fn root_members_of_step(st: DeploymentStep) -> List<ConvergedMember> {
-  match st {
-    ArtifactStep { step: art } => match art.kind {
-      DispatchWorktreeRoot => [DirectoryRoot { path: art.path }]
-      AttemptStateRoot => [DirectoryRoot { path: art.path }]
-      ComputeRoot => [DirectoryRoot { path: art.path }]
-      ServeBinary => []
-      GunbcSourceTree => []
-      SystemdUnit => []
-      BeltTimerUnit => []
-      FleetConvergeTimerUnit => []
-      TailscaleServeMapping => []
-      DeployedTreeRemoteUnit => []
-      PublicationHelperTimerUnit => []
-      FabricStorageServeUnit => []
-      FabricStorageServeMapping => []
-      ApprovalBrokerFrontDoor => []
-      TailnetDoorServeUnit => []
-    }
-    Dependency { step: _ } => []
-  }
-}
-
-// THE PROVIDER-STATE ROOT JOINS THE ROSTER FROM THE SPEC, NOT FROM ITS STEPS (C7). Its path and
-// owner are derived by gunbc.live_deploy.spec deployment_provider_state_step, the same function the
-// emitted ensure is built from, so the directory that is created and the directory that is read
-// back cannot name two different paths or two different owners. Deriving it here rather than
-// matching a step is what makes its absence unwritable: no spec can drop the member, so nothing
-// has to refuse a spec that did.
+// THE ROOT ROSTER IS THE DEPLOYMENT'S DIRECTORY DEMANDS, not a list here and not the steps. Every
+// directory the deployment creates is an owned-directory target in
+// gunbc.live_deploy.spec deployment_directory_demands -- the instance's consumers' demands
+// (gunbc.roadmap.dashboard_instance_directories) and the host's -- and each joins the roster as one
+// DirectoryRoot, so the directories created and the directories read back are one list. The first
+// roster read the dispatch roots and the compute root off the step kinds and the provider-state root
+// off the spec, and left out every auth store, the event worktree and the inbox: the production route
+// neither created nor read them back.
 fn deployment_member_roster(spec: DeploymentSpec) -> List<ConvergedMember> {
   concat(
-    concat(release_member_roster(), flat_map(spec.steps, st => root_members_of_step(st: st))),
-    [DirectoryRoot { path: deployment_provider_state_path(spec: spec) }],
+    release_member_roster(),
+    map(deployment_directory_demands(spec: spec), t => DirectoryRoot { path: owned_directory_path(t: t) as String as NonEmptyStr }),
   )
 }
 
-// A ROOT'S OWNER IS READ, NOT ASSUMED. Presence alone would call a root:root-owned directory
-// converged, and the service user still could not write it -- which is the state a hand-repaired
-// host leaves and the state a fresh host reaches if install ran under the wrong principal.
-// THE LOCAL ARM CALLS THE MODELLED OPERATION; ONLY THE REMOTE ARM GOES THROUGH THE TRANSPORT.
-//
-// The first version of this routed BOTH arms through run_typed_argv_transport, handing it LocalShell
-// for the host-itself case. That refuses by construction -- "LocalShell has no remote target" -- so
-// root ownership could not be read on the host the deploy actually runs on, and the whole member
-// plan refused. It failed closed and mutated nothing, but it meant the roots could never be
-// observed in production.
-//
-// IT SURVIVED ITS WITNESSES BECAUSE THEY NEVER EXECUTED A HOST EFFECT. The member-identity witnesses
-// are hermetic and supply observations directly, so nothing exercised this leg until the first wet
-// operator deploy. Every other local arm in this module calls its modelled operation directly
-// (Filesystem.List, git.Inspect.HeadCommitIn, shell.Mktemp.FileInDirectory); this one now does too.
-fn root_owner_leg(arm: ObservationArm, path: String) -> Leg {
-  let leg = join(["reading the owner of ", path], "")
+// THE DIRECTORY'S METADATA, READ UNDER THE DEPLOY PRINCIPAL'S PINNED READ-ONLY GRANTS. A managed
+// directory may admit only its owner (the fabric store's root derives owner-execute alone), so the job
+// user can neither list it nor stat what is under it, while a correctly protected tree must still read
+// as converged in planning and readback. Both reads are gunbc.executor_privileged_operation operations
+// bound to one named directory -- ListDirectoryEntries and ReadDirectoryIdentity -- rendered into the
+// runner host's sudoers by gunbc.runner_host_grants for exactly the directories this deployment
+// demands and their ancestors, the same authorization machinery every other root operation of this
+// principal goes through; no path-unrestricted grant is added. The local arm runs the elevated command
+// with its spawn as a value (gunbc.command_runner run_shell_command_observe_outcome); the remote arm
+// sends the same elevated argv through the transport. Either way the read's origin stays typed
+// (gunbc.owned_directory ObserverFailure) and presence and absence are the provider's to decide.
+fn privileged_directory_read(arm: ObservationArm, op: ExecutorPrivilegedOperation) -> ObserverRead {
   match arm {
-    OnTheHostItself => {
-      let r = shell.Stat.OwnerOf(path: path as FilePath)
-      if r.success { LegOut { stdout: r.stdout } }
-      else { LegRefused { cause: join([leg, " failed: ", r.stderr], "") } }
-    }
+    OnTheHostItself =>
+      match run_shell_command_observe_outcome(command: executor_privileged_operation_elevated_command(op: op), transport: LocalExec) {
+        ProcessNotSpawned { program: _, cause } => ObserverReadFailed { origin: ObserverNotSpawned { cause: cause as String } }
+        ProcessRan { observation: o } =>
+          if o.exit_code == 0 { ObserverReadOut { stdout: o.stdout } }
+          else { ObserverReadFailed { origin: ObserverExited { exit_code: o.exit_code, stderr: o.stderr } } }
+      }
     OverTransport { transport } =>
-      remote_leg(transport: transport, argv: ["stat", "-c", "%U", "--", path], leg: leg)
+      match run_typed_argv_transport(argv: executor_privileged_operation_elevated_argv(op: op), transport: transport) {
+        TypedArgvExecRefused { reason } => ObserverReadFailed { origin: ObserverTransportRefused { cause: reason } }
+        TypedArgvExecConverged { result: r } =>
+          if r.exit_code == 0 { ObserverReadOut { stdout: r.stdout } }
+          else { ObserverReadFailed { origin: ObserverExited { exit_code: r.exit_code, stderr: r.stderr } } }
+      }
   }
 }
 
-fn observe_directory_root(arm: ObservationArm, path: NonEmptyStr) -> ObservedMember {
+fn owned_directory_observation_on_host(arm: ObservationArm, path: String) -> EnsureObservation<OwnedDirectoryReading> {
+  owned_directory_observe(
+    path: path as FilePath,
+    list: p => privileged_directory_read(arm: arm, op: ListDirectoryEntries { path: p as String as NonEmptyStr }),
+    stat: p => privileged_directory_read(arm: arm, op: ReadDirectoryIdentity { path: p as String as NonEmptyStr }),
+  )
+}
+
+// THE PROVIDER DECIDES; THIS ONLY PROJECTS ITS DECISION ONTO THE MEMBER VOCABULARY. The decision is
+// gunbc.owned_directory owned_directory_decide's -- the same one the dashboard apply's provider makes --
+// so a directory is converged, created, repaired or refused here for exactly the reasons it would be
+// there:
+//   Noop                          -> observed at RootConverged (the desired identity: keep)
+//   Apply, the directory absent   -> MemberAbsentOnHost (Create -> CreateRoot)
+//   Apply, the directory present  -> observed at RootModeRepairable (Replace -> RepairRootMode)
+//   Refuse, nothing could be read -> MemberUnobservable (refuses the derivation)
+//   Refuse, a state it will not change (another principal's directory, a non-directory, a mode that
+//          cannot be derived)      -> MemberRefusedOnHost (refuses the derivation; never re-owned)
+// The post-apply readback (deployment_identity_readback) re-derives through this same function, so
+// the readback is a second independent observation of every demanded directory.
+fn observe_owned_directory(arm: ObservationArm, spec: DeploymentSpec, path: NonEmptyStr) -> ObservedMember {
   let member = DirectoryRoot { path: path }
-  match entry_presence(arm: arm, path: path as String) {
-    EntryPresenceIndeterminate { cause } => MemberUnobservable { member: member, cause: cause }
-    EntryAbsent => MemberAbsentOnHost { member: member }
-    EntryPresent => match root_owner_leg(arm: arm, path: path as String) {
-      LegRefused { cause } => MemberUnobservable { member: member, cause: cause }
-      LegOut { stdout } => {
-        let owner = trim(stdout)
-        if owner == "" {
-          MemberUnobservable { member: member, cause: join(["the owner of ", path as String, " read back empty"], "") }
-        } else {
-          MemberObserved { identity: RootAt { root: DirectoryRootIdentity { path: path, owner: owner as NonEmptyStr } } }
-        }
+  match owned_directory_demand_at(ts: deployment_directory_demands(spec: spec), path: path as String) {
+    Absent => MemberRefusedOnHost { member: member, cause: join(["no owned-directory demand names ", path as String], "") }
+    Present { value: target } => {
+      let observation = owned_directory_observation_on_host(arm: arm, path: path as String)
+      match observation {
+        EnsureInaccessible { reason } => MemberUnobservable { member: member, cause: reason }
+        EnsureAbsent { reason: _ } => owned_directory_member_of_decision(member: member, path: path, target: target, observation: observation)
+        EnsureObserved { evidence: _ } => owned_directory_member_of_decision(member: member, path: path, target: target, observation: observation)
       }
     }
   }
 }
 
+fn owned_directory_member_of_decision(
+  member: ConvergedMember,
+  path: NonEmptyStr,
+  target: OwnedDirectoryTarget,
+  observation: EnsureObservation<OwnedDirectoryReading>,
+) -> ObservedMember {
+  match owned_directory_decide(policy: EnsureMayApply, target: target, observation: observation) {
+    Noop => MemberObserved { identity: RootAt { root: DirectoryRootIdentity { path: path, standing: RootConverged } } }
+    Refuse { reason } => match observation {
+      EnsureInaccessible { reason: why } => MemberUnobservable { member: member, cause: why }
+      EnsureObserved { evidence: _ } => MemberRefusedOnHost { member: member, cause: reason as String }
+      EnsureAbsent { reason: _ } => MemberRefusedOnHost { member: member, cause: reason as String }
+    }
+    Apply { plan: _ } => match observation {
+      EnsureObserved { evidence } =>
+        MemberObserved { identity: RootAt { root: DirectoryRootIdentity {
+          path: path,
+          standing: RootModeRepairable { observed_mode: file_mode_octal(mode: evidence.mode) as NonEmptyStr },
+        } } }
+      EnsureAbsent { reason: _ } => MemberAbsentOnHost { member: member }
+      EnsureInaccessible { reason } => MemberUnobservable { member: member, cause: reason }
+    }
+  }
+}
+
 fn desired_member_identity(
   member: ConvergedMember,
   spec: DeploymentSpec,
@@ -596,7 +627,7 @@ fn desired_member_identity(
     UnitFile => desired_unit_file(spec: spec, candidate: candidate)
     UnitManager => desired_unit_manager()
     ServiceProcess => desired_service_process(candidate: candidate)
-    DirectoryRoot { path } => RootAt { root: DirectoryRootIdentity { path: path, owner: spec.service.service_user } }
+    DirectoryRoot { path } => RootAt { root: DirectoryRootIdentity { path: path, standing: RootConverged } }
   }
 }
 
@@ -613,7 +644,7 @@ fn observed_member_on_host(
     UnitFile => observe_unit_file(arm: arm, spec: spec)
     UnitManager => observe_unit_manager(arm: arm, unit: spec.service.unit_name)
     ServiceProcess => observe_service_process(spec: spec, transport: transport)
-    DirectoryRoot { path } => observe_directory_root(arm: arm, path: path)
+    DirectoryRoot { path } => observe_owned_directory(arm: arm, spec: spec, path: path)
   }
 }
 
@@ -645,6 +676,8 @@ fn deployment_effect_plan(spec: DeploymentSpec, candidate: CandidateRelease, tra
       EffectsRefused { refusals: [MemberRefused { member: Executable, cause: DesiredExecutableUnreadable { cause: cause } }] }
     MemberAbsentOnHost { member: _ } =>
       EffectsRefused { refusals: [MemberRefused { member: Executable, cause: DesiredExecutableAbsent }] }
+    MemberRefusedOnHost { member: _, cause } =>
+      EffectsRefused { refusals: [MemberRefused { member: Executable, cause: DesiredExecutableUnreadable { cause: cause } }] }
     MemberObserved { identity: desired_bin } => match desired_bin {
       ExecutableIdentity { digest } =>
         release_member_plan(
diff --git a/dag/gunbc/live_deploy/repository_convergence.dag b/dag/gunbc/live_deploy/repository_convergence.dag
index 5485e1cea5a..e4c6756ed8f 100644
--- a/dag/gunbc/live_deploy/repository_convergence.dag
+++ b/dag/gunbc/live_deploy/repository_convergence.dag
@@ -14,7 +14,31 @@ module gunbc.live_deploy.repository_convergence
 
 import std.types { String, Bool, Int, List, FilePath, NonEmptyStr }
 import extdeps.git { git_local_fetch_source_grant, git_local_fetch_upload_pack_command }
-import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.filesystem.filesystem_io {
+  Filesystem,
+  filesystem_delete,
+  FilesystemDeleted,
+  FilesystemDeleteTargetAbsent,
+  FilesystemDeleteRefused,
+  FilesystemDeleteKindUnrecognized,
+  filesystem_exact_read,
+  FilesystemExactPathRead,
+  FilesystemExactPathAbsent,
+  FilesystemExactPathUnreadable,
+  FilesystemExactPathKindUnrecognized,
+}
+import gunbc.repo_workspace { repo_workspace_footprints }
+import std.workspace_artifact {
+  WorkspaceArtifact,
+  RegenerableFromSource,
+  LocalCacheState,
+  PerDeveloperState,
+  HostOsMetadata,
+  SessionRuntimeState,
+  MayContainSecrets,
+  OutsideSubstrate,
+  SupersededAuthority,
+}
 import gunbc.repository { gunbc_repository }
 import std.algebra { trim }
 import std.process { ProcessExit, ExitSuccess, ExitFailure }
@@ -156,6 +180,7 @@ type RepositoryConvergenceOutcome
   | ConvergenceHeadNotAtCandidate { candidate: String, observed: String }
   | ConvergenceHeadMovedWithoutReflog { candidate: String }
   | ConvergenceUntrackedResidue { first_path: String }
+  | ConvergenceSupersededFileNotRetired { path: String, detail: String }
   | ConvergenceResidueUnreadable { exit_code: Int, stderr: String }
   | ConvergencePrimaryBranchNotAtCandidate { branch: String, observed: String }
   | ConvergenceIndexNotAtCandidateTree { candidate_tree: String, observed_tree: String }
@@ -738,6 +763,7 @@ fn repository_convergence_converged(outcome: RepositoryConvergenceOutcome) -> Bo
     ConvergenceHeadNotAtCandidate { candidate: _, observed: _ } => false
     ConvergenceHeadMovedWithoutReflog { candidate: _ } => false
     ConvergenceUntrackedResidue { first_path: _ } => false
+    ConvergenceSupersededFileNotRetired { path: _, detail: _ } => false
     ConvergenceResidueUnreadable { exit_code: _, stderr: _ } => false
     ConvergencePrimaryBranchNotAtCandidate { branch: _, observed: _ } => false
     ConvergenceIndexNotAtCandidateTree { candidate_tree: _, observed_tree: _ } => false
@@ -823,6 +849,11 @@ fn repository_convergence_detail(outcome: RepositoryConvergenceOutcome) -> Strin
         "the tree carries untracked files after the transition, starting at ", p,
         " -- `reset --hard` moves tracked bytes only, so this tree is the candidate plus residue and not the candidate",
       ], "")
+    ConvergenceSupersededFileNotRetired { path: p, detail: d } =>
+      join([
+        "the superseded workspace file ", p, " could not be retired: ", d,
+        " -- the current loader refuses a physical file at a derived roster identity, so a tree that keeps it cannot serve",
+      ], "")
     ConvergenceResidueUnreadable { exit_code: x, stderr: e } =>
       join([
         "the untracked-file listing could not be read (exit ", to_string(x), "): ", e,
@@ -1143,6 +1174,92 @@ fn convergence_fetch_upload_pack(remote: String) -> String {
   git_local_fetch_upload_pack_command(grant: git_local_fetch_source_grant(source: remote as NonEmptyStr))
 }
 
+// RETIRING SUPERSEDED FILES IS PART OF CONVERGING THE TREE, AND ITS POPULATION IS DERIVED, NOT LISTED.
+// Older gunbc binaries wrote each ledger roster into the checkout they read, so a deployed tree that
+// ran one carries `roster.dag` files nothing tracks. The current loader derives those modules in
+// memory and REFUSES a physical file at a reserved roster identity (it never deletes one: source
+// loading performs no cleanup), so a converged tree must not carry one. The files are ignored, so
+// the untracked-residue arm (`--exclude-standard`) cannot see them, which is why retirement is its
+// own explicit step rather than an assumption about what reset leaves behind.
+//
+// The population is every FILE-GRAIN, root-anchored workspace artifact whose declared reason is
+// `SupersededAuthority` in gunbc.repo_workspace -- the one existing descriptor that already says
+// "this path is dead, its facts live elsewhere". Directory and glob patterns are not file grain and
+// are never retired here. Bounded by construction: the rows name their own paths, so adding a row is
+// the only way to widen it.
+fn artifact_is_superseded_file(a: WorkspaceArtifact) -> Bool {
+  match a.reason {
+    SupersededAuthority { canonical: _ } =>
+      starts_with(s: a.pattern, prefix: "/")
+        && !ends_with(s: a.pattern, suffix: "/")
+        && !string_contains(s: a.pattern, pattern: "*")
+    RegenerableFromSource => false
+    LocalCacheState => false
+    PerDeveloperState => false
+    HostOsMetadata => false
+    SessionRuntimeState => false
+    MayContainSecrets => false
+    OutsideSubstrate => false
+  }
+}
+
+fn superseded_workspace_file_paths() -> List<String> {
+  fold(
+    repo_workspace_footprints(),
+    init: [],
+    f: (acc, footprint) => concat(
+      acc,
+      footprint.artifacts
+        |> filter(a => artifact_is_superseded_file(a: a))
+        |> map(a => substring(s: a.pattern, start: 1, end: string_length(s: a.pattern))),
+    ),
+  )
+}
+
+type SupersededFileRetirement
+  = SupersededFilesAbsent
+  | SupersededFileRetirementRefused { path: String, detail: String }
+
+// ONE PATH: delete, then READ BACK ABSENCE through the exact-read authority. An absent target is
+// already retired; any other delete refusal, or a read-back that is not `FilesystemExactPathAbsent`,
+// is a located refusal -- a file that may still be on disk is never reported as retired.
+fn retire_superseded_file(repo: String, rel: String) -> SupersededFileRetirement {
+  let path = join([repo, "/", rel], "")
+  let d = Filesystem.Delete(path: path)
+  match filesystem_delete(path: path, success: d.success, error: d.error, error_kind: d.error_kind) {
+    FilesystemDeleteRefused { path: p, kind: _, error: e } =>
+      SupersededFileRetirementRefused { path: p, detail: join(["delete refused: ", e], "") }
+    FilesystemDeleteKindUnrecognized { path: p, observed: o, error: e } =>
+      SupersededFileRetirementRefused { path: p, detail: join(["delete failed with unrecognized kind ", o, ": ", e], "") }
+    FilesystemDeleted { path: _ } => superseded_file_read_back(path: path)
+    FilesystemDeleteTargetAbsent { path: _ } => superseded_file_read_back(path: path)
+  }
+}
+
+fn superseded_file_read_back(path: String) -> SupersededFileRetirement {
+  let r = Filesystem.Read(path: path)
+  match filesystem_exact_read(path: path, content: r.content, success: r.success, error: r.error, error_kind: r.error_kind) {
+    FilesystemExactPathAbsent { path: _ } => SupersededFilesAbsent
+    FilesystemExactPathRead { path: p, content: _ } =>
+      SupersededFileRetirementRefused { path: p, detail: "the file is still readable after its delete" }
+    FilesystemExactPathUnreadable { path: p, kind: _, error: e } =>
+      SupersededFileRetirementRefused { path: p, detail: join(["absence could not be read back: ", e], "") }
+    FilesystemExactPathKindUnrecognized { path: p, observed: o, error: e } =>
+      SupersededFileRetirementRefused { path: p, detail: join(["absence read-back failed with unrecognized kind ", o, ": ", e], "") }
+  }
+}
+
+fn retire_superseded_workspace_files(repo: String) -> SupersededFileRetirement {
+  fold(
+    superseded_workspace_file_paths(),
+    init: SupersededFilesAbsent,
+    f: (acc, rel) => match acc {
+      SupersededFilesAbsent => retire_superseded_file(repo: repo, rel: rel)
+      SupersededFileRetirementRefused { path: _, detail: _ } => acc
+    },
+  )
+}
+
 fn repository_converge_wet(
   repo: String,
   remote: String,
@@ -1203,12 +1320,16 @@ fn repository_converge_wet(
               observed_head: git_text_or_empty(observation: observe_repository_state(repo: repo, candidate: candidate).head),
             })
           } else {
-            convergence_exit(outcome: repository_convergence_verdict(
-              before: before,
-              after: observe_repository_state(repo: repo, candidate: candidate),
-              candidate: candidate,
-              base_ref: base_ref,
-            ))
+            match retire_superseded_workspace_files(repo: repo) {
+              SupersededFileRetirementRefused { path: p, detail: d } =>
+                convergence_exit(outcome: ConvergenceSupersededFileNotRetired { path: p, detail: d })
+              SupersededFilesAbsent => convergence_exit(outcome: repository_convergence_verdict(
+                before: before,
+                after: observe_repository_state(repo: repo, candidate: candidate),
+                candidate: candidate,
+                base_ref: base_ref,
+              ))
+            }
           }
         }
       }
diff --git a/dag/gunbc/live_deploy/spec.dag b/dag/gunbc/live_deploy/spec.dag
index 1bc03c1b494..90fbfc64b24 100644
--- a/dag/gunbc/live_deploy/spec.dag
+++ b/dag/gunbc/live_deploy/spec.dag
@@ -12,7 +12,7 @@ import extdeps.apt {
   package_tailscale,
   package_tmux,
 }
-import extdeps.version.semver { SemVerVersion }
+import extdeps.version.semver { SemVerVersion, semver_version_parse }
 import extdeps.tailscale.serve {
   tailscale_scoped_removal_capability,
   tailscale_serve_unix_target,
@@ -38,17 +38,15 @@ import gunbc.host_layout {
   srv1_gunbc_repo_root,
   srv1_gunbc_approval_broker_root,
   srv1_gunbc_serve_binary,
-  srv1_dispatch_worktree_root,
-  srv1_dispatch_attempt_state_root,
   srv1_devboot_artifact_store_root,
 }
-import gunbc.fabric_storage_placement { fabric_storage_store_directories, fabric_storage_placed_on, fabric_storage_https_port, fabric_storage_door_socket }
-import gunbc.managed_directory { ManagedDirectoryAdmission, managed_directory_admission_path }
+import gunbc.fabric_storage_placement { fabric_storage_placed_on, fabric_storage_https_port, fabric_storage_door_socket }
+import gunbc.managed_directory { DirectoryOwnerAllEveryoneTraverse }
+import gunbc.owned_directory { OwnedDirectoryTarget, OwnedDirectoryDeclared }
+import extdeps.posix.identity { PosixOwnerNames }
+import gunbc.roadmap.dashboard_instance_directories { dashboard_instance_directory_demands }
 import gunbc.roadmap_dashboard_instance {
   HostDashboardInstance,
-  dashboard_instance_dispatch_worktree_root,
-  dashboard_instance_dispatch_attempt_state_root,
-  dashboard_instance_compute_root,
   dashboard_instance_provider_state_root,
   dashboard_instance_tailnet_door_socket,
 }
@@ -60,7 +58,7 @@ import gunbc.ownership { Ownership, Owned, Ensured }
 
 // Belt B membership (docs/plans/gunbc-served-dashboard-design.md section 5): the service is `gunbc
 // serve` (the seed binary), not an emitted node server.js, so the members flip — ServeBinary +
-// GunbcSourceTree + DispatchWorktreeRoot in (paths from the ONE gunbc.host_layout authority the
+// GunbcSourceTree + the dispatch worktree root in (paths from the ONE gunbc.host_layout authority the
 // belt also projects), ServerScript and the NodeJsPackage dependency out (the Ensured nodejs is
 // never torn down — R5; the stale /opt/gunbc/server.js file is left inert on disk and reaped when
 // belt A's interim retires). Deploy principal is ghrunner (DeployRunnerPrincipal.job_user;
@@ -81,26 +79,24 @@ data gunbc_service_user: NonEmptyStr = "briansrls"
 // User= line's. The user manager itself must be running, which is loginctl linger for this account.
 data gunbc_service_uid: Int = 1000
 
-// AttemptStateRoot is an owned member for the same reason DispatchWorktreeRoot is: the belt WRITES
-// there, under the service user, on every dispatch. It was missing until 2026-07-30, and the gap
-// was not visible as a gap — #7368 made a published attempt state a hard precondition of dispatch
-// while the path lived only in gunbc.roadmap_dashboard_instance's srv1 row, so this roster had
-// nothing to add it to. The result on the live host was EACCES from `install -d` against a
-// root-owned /opt/gunbc, AFTER the worktree had been created: an orphan branch per click and a
-// progress row reading `legacy attempt`. Ownership is Owned, not Ensured, because the deploy
-// creates it; teardown mirrors DispatchWorktreeRoot's empty-directory refusal rather than a
-// recursive remove, since a non-empty attempt-state root means published attempt evidence for
-// sessions that may still be live (the annotation on gunbc.live_deploy.emit emit_artifact_teardown
-// carries the same argument for the same reason).
+// NO DIRECTORY IS AN OWNED ARTIFACT OR AN ENSURED DEPENDENCY ANY MORE. The dispatch worktree root,
+// the attempt-state root, the compute root, the provider-state root, the fabric store's areas and the
+// srv1 host roots were each a kind here, created by an install -d the emitter spelled per kind and
+// read back by owner alone -- one of two creators for the dashboard's directories, the other being
+// the dashboard provision plan's mkdir. Both are deleted: a directory is an owned-directory target
+// (gunbc.owned_directory) its consumer demands, the spec carries the instance's demands
+// (DeploymentSpec.directories, from gunbc.roadmap.dashboard_instance_directories) and the host's
+// (DeploymentHostTarget.host_directories), and the one provider decides, installs and reads back
+// every one of them (gunbc.live_deploy.emit owned_directory_apply_steps,
+// gunbc.live_deploy.member_observe observe_owned_directory). No directory is torn down by a retract:
+// the roots that were Owned were removed by an empty-directory rmdir, and that teardown is not carried
+// forward -- a retract leaves directories exactly as it found them.
 
 type OwnedArtifactKind =
     ServeBinary
   | GunbcSourceTree
-  | DispatchWorktreeRoot
-  | AttemptStateRoot
-  | ComputeRoot
   | SystemdUnit
-  | BeltTimerUnit
+  | BeltEventPathUnit
   | FleetConvergeTimerUnit
   | TailscaleServeMapping
   | DeployedTreeRemoteUnit
@@ -110,43 +106,18 @@ type OwnedArtifactKind =
   | ApprovalBrokerFrontDoor
   | TailnetDoorServeUnit
 
+// AN ENSURED HOST RESOURCE: converged on every apply, never torn down, TeardownRefuses{
+// TeardownOutsideOwnership}. Only packages remain; the directory arms became owned-directory targets.
 type EnsuredDependencyKind =
     TailscalePackage
   | TmuxPackage
-  | DevbootArtifactStoreDirectory
-  | CodexRuntimeReleaseDirectory
-  | FabricStorageStoreDirectory
-  | ProviderStateRootDirectory
-
-// ONE CONCEPT -- AN ENSURED HOST RESOURCE -- WITH N KINDS, not a second ensured mechanism beside
-// the first. What Ensured means was already exactly right for the build service's artifact store:
-// converged on every apply, never torn down, TeardownRefuses{TeardownOutsideOwnership}. What was
-// wrong was that a dependency could only BE a package, so a directory had nowhere to live and got
-// put in the owned roster instead -- where Owned means torn down by retract, and produced artifacts
-// are the one thing a deploy must never delete.\n\nTHE HAZARD THAT RULED THIS, recorded because it
-// was caught rather than reasoned: appending a host-level root to every per-instance spec made a
-// lab twin's retract remove the production artifact store. Two existing claims went red on it. The
-// claims were right and the placement was wrong, so the category moved and the claims were not
-// touched.\n\nThe package arm keeps its exact prior behaviour -- same ensure step, same emitted
-// bytes -- because this widening is about admitting a second KIND of ensured resource, not about
-// changing what ensuring a package means. The directory arm carries its own owner rather than
-// reading a deployment spec, so an ensured host resource stays a fact about the HOST and needs no
-// instance to be stated.
-
-// A MANAGED host directory is the arm whose owner, group and mode are DERIVED from its declared
-// dependents (gunbc.managed_directory) rather than asserted as one owner at the shared 0755. It
-// carries the ADMISSION, not the directory, so a directory with a writer the owner and group do not
-// cover reaches the emitter as a refusal and can never be lowered to an install at all.
+
 type EnsuredSubject
   = EnsuredPackage { package: NonEmptyStr }
-  | EnsuredHostDirectory { path: NonEmptyStr, owner: NonEmptyStr }
-  | EnsuredManagedHostDirectory { admission: ManagedDirectoryAdmission }
 
 fn ensured_subject_identity(subject: EnsuredSubject) -> NonEmptyStr {
   match subject {
     EnsuredPackage { package } => package
-    EnsuredHostDirectory { path, owner } => path
-    EnsuredManagedHostDirectory { admission } => managed_directory_admission_path(a: admission) as String as NonEmptyStr
   }
 }
 
@@ -203,11 +174,8 @@ fn owned_artifact_teardown_disposition(kind: OwnedArtifactKind) -> TeardownDispo
     ServeBinary => TeardownActs
     DeployedTreeRemoteUnit => TeardownActs
     GunbcSourceTree => TeardownActs
-    DispatchWorktreeRoot => TeardownActs
-    AttemptStateRoot => TeardownActs
-    ComputeRoot => TeardownActs
     SystemdUnit => TeardownActs
-    BeltTimerUnit => TeardownActs
+    BeltEventPathUnit => TeardownActs
     FleetConvergeTimerUnit => TeardownActs
     TailscaleServeMapping => TeardownActs
     PublicationHelperTimerUnit => TeardownActs
@@ -249,7 +217,7 @@ type DeploymentHostTarget {
   tailnet_domain: NonEmptyStr?
   os_package_manager: OsPackageManager
   tailscale_client: TailscaleServeCapability
-  ensured_directories: List<DeploymentDependencyStep>
+  host_directories: List<OwnedDirectoryTarget>
 }
 
 // serve_function WAS DROPPED HERE AND THE EMITTER FELL BACK TO A LITERAL. HostDashboardInstance
@@ -640,7 +608,7 @@ fn deployment_belt_unit_stem(names: DeploymentNames) -> String {
 // THE FABRIC DB ENDPOINT'S UNIT, derived like the belt's: one per deployment identity, and emitted
 // only by the deployment whose instance holds the fabric DB placement (fabric_storage_placed_on). It is
 // deployment state -- a retract removes the unit and the tailscale mapping -- while the store's files
-// are an ensured host directory no retract touches (FabricStorageStoreDirectory).
+// are owned-directory demands no retract touches (gunbc.fabric_storage_placement fabric_storage_directory_demands).
 fn deployment_fabric_storage_unit_name(names: DeploymentNames) -> NonEmptyStr {
   join([deployment_belt_unit_stem(names: names), "-fabric-storage.service"], "") as NonEmptyStr
 }
@@ -690,8 +658,26 @@ fn deployment_belt_service_unit_name(names: DeploymentNames) -> NonEmptyStr {
   join([deployment_belt_unit_stem(names: names), "-belt.service"], "") as NonEmptyStr
 }
 
-fn deployment_belt_timer_unit_name(names: DeploymentNames) -> NonEmptyStr {
-  join([deployment_belt_unit_stem(names: names), "-belt.timer"], "") as NonEmptyStr
+// THE BELT'S EVENT UNITS (dogfood intervention #4: event-driven, not timer-driven). There is no belt
+// timer. A worker, reviewer or auditor ending writes an exit record into the instance's exit inbox
+// (gunbc.roadmap.roadmap_attempt_exit_spool), and the exit path unit starts the drain service, which
+// hands each recorded exit to its attempt's obligation unit. A publication answer arriving starts the
+// discovery service, which queues the attempts whose publication is still owed. The belt service
+// stays: it is the launch obligation, started by a drained worker exit or by an operator.
+fn deployment_belt_exit_path_unit_name(names: DeploymentNames) -> NonEmptyStr {
+  join([deployment_belt_unit_stem(names: names), "-belt-exit.path"], "") as NonEmptyStr
+}
+
+fn deployment_belt_exit_drain_service_unit_name(names: DeploymentNames) -> NonEmptyStr {
+  join([deployment_belt_unit_stem(names: names), "-belt-exit.service"], "") as NonEmptyStr
+}
+
+fn deployment_belt_answer_path_unit_name(names: DeploymentNames) -> NonEmptyStr {
+  join([deployment_belt_unit_stem(names: names), "-belt-discovery.path"], "") as NonEmptyStr
+}
+
+fn deployment_belt_discovery_service_unit_name(names: DeploymentNames) -> NonEmptyStr {
+  join([deployment_belt_unit_stem(names: names), "-belt-discovery.service"], "") as NonEmptyStr
 }
 
 // THE PUBLICATION PRINCIPAL'S ALLOCATED NAME ON srv1, stated once and carried as a DeploymentNames
@@ -814,8 +800,30 @@ fn deployment_belt_service_unit_path(names: DeploymentNames) -> NonEmptyStr {
   join(["/etc/systemd/system/", deployment_belt_service_unit_name(names: names) as String], "") as NonEmptyStr
 }
 
-fn deployment_belt_timer_unit_path(names: DeploymentNames) -> NonEmptyStr {
-  join(["/etc/systemd/system/", deployment_belt_timer_unit_name(names: names) as String], "") as NonEmptyStr
+fn deployment_belt_exit_path_unit_path(names: DeploymentNames) -> NonEmptyStr {
+  join(["/etc/systemd/system/", deployment_belt_exit_path_unit_name(names: names) as String], "") as NonEmptyStr
+}
+
+// THE BOOT TARGET FOLLOWS THE MANAGER THE UNIT IS INSTALLED INTO. Every belt unit this deployment emits is
+// written under /etc/systemd/system, so it belongs to the SYSTEM manager, whose boot target is
+// multi-user.target; a user manager would install under a user unit directory and boot at default.target
+// (and only if the principal lingers). The dispatched attempt and worker units are transient units in the
+// principal's USER manager, but they are started by these system units and are never installed. One
+// derivation, so a unit-directory change cannot leave a boot target naming a manager that never runs it.
+fn deployment_belt_unit_install_target(names: DeploymentNames) -> NonEmptyStr {
+  if starts_with(s: deployment_belt_exit_drain_service_unit_path(names: names) as String, prefix: "/etc/systemd/system/") { "multi-user.target" as NonEmptyStr } else { "default.target" as NonEmptyStr }
+}
+
+fn deployment_belt_exit_drain_service_unit_path(names: DeploymentNames) -> NonEmptyStr {
+  join(["/etc/systemd/system/", deployment_belt_exit_drain_service_unit_name(names: names) as String], "") as NonEmptyStr
+}
+
+fn deployment_belt_answer_path_unit_path(names: DeploymentNames) -> NonEmptyStr {
+  join(["/etc/systemd/system/", deployment_belt_answer_path_unit_name(names: names) as String], "") as NonEmptyStr
+}
+
+fn deployment_belt_discovery_service_unit_path(names: DeploymentNames) -> NonEmptyStr {
+  join(["/etc/systemd/system/", deployment_belt_discovery_service_unit_name(names: names) as String], "") as NonEmptyStr
 }
 
 // CONVERGE-0 loop member (operator directive 2026-08-09: 'timer in deployment membership').
@@ -982,6 +990,7 @@ type DeploymentSpec {
   approval_broker: DeploymentServiceConfig
   names: DeploymentNames
   instance_id: NonEmptyStr
+  directories: List<OwnedDirectoryTarget>
 }
 
 // TWO CONSUMERS, ONE SCOPE-FREE ROUTE LABEL (KEYING-0 follow-on, node://adhoc-907f1da5-c20):
@@ -1038,8 +1047,15 @@ type DeploymentSpec {
 // and this member is unconditional again — the mirror holds because the twin genuinely has a
 // correct timer, not because the asymmetry was argued away.
 //
-// One member, two files, exactly as GunbcSourceTree owns gunbc-tree-sync.service plus its env file:
-// the member's identity is the .timer path and its teardown removes the .service beside it. The
+// THE TIMER IS GONE (dogfood intervention #4, gunbc#13124: event-driven, not timer-driven; the timer
+// is not a product requirement and does not become a desired-state row). The member is now the belt's
+// EVENT units: the exit path unit and the drain service it starts, the publication-answer path unit
+// and the discovery service it starts, and the belt service itself, which no timer starts -- a drained
+// worker exit or an operator does. Everything the paragraphs above say about lifecycle and per-instance
+// roots holds unchanged for these units.
+//
+// One member, five files, as GunbcSourceTree owns gunbc-tree-sync.service plus its env file: the
+// member's identity is the exit .path unit and its teardown removes the four files beside it. The
 // names DERIVE from unit_name rather than being carried as DeploymentNames fields the way tree-
 // sync's are, and the difference is that tree-sync had migration debt to express — production runs
 // under names the derivation would not mint, so both constructors must state them. No belt unit
@@ -1057,15 +1073,12 @@ fn deployment_owned_steps(
       kind: DeployedTreeRemoteUnit,
       path: deployment_tree_remote_unit_path(names: names),
     },
-    DeploymentArtifactStep { kind: DispatchWorktreeRoot, path: dashboard_instance_dispatch_worktree_root(instance: instance) as String as NonEmptyStr },
-    DeploymentArtifactStep { kind: AttemptStateRoot, path: dashboard_instance_dispatch_attempt_state_root(instance: instance) as String as NonEmptyStr },
-    DeploymentArtifactStep { kind: ComputeRoot, path: dashboard_instance_compute_root(instance: instance) as String as NonEmptyStr },
     DeploymentArtifactStep { kind: SystemdUnit, path: deployment_systemd_unit_path(names: names) },
     DeploymentArtifactStep {
       kind: PublicationHelperTimerUnit,
       path: deployment_publication_timer_unit_path(names: names),
     },
-    DeploymentArtifactStep { kind: BeltTimerUnit, path: deployment_belt_timer_unit_path(names: names) },
+    DeploymentArtifactStep { kind: BeltEventPathUnit, path: deployment_belt_exit_path_unit_path(names: names) },
   ], concat(deployment_tailnet_door_steps(names: names), concat([
     DeploymentArtifactStep {
       kind: TailscaleServeMapping,
@@ -1127,25 +1140,6 @@ fn deployment_fabric_storage_steps(instance: HostDashboardInstance, names: Deplo
   }
 }
 
-// THE BUILD SERVICE'S ROOTS ARE MEMBERSHIP, PROJECTED, AND SEPARATE FROM THE PER-INSTANCE STEPS --
-// three claims, and the third is the one that took a correction. Membership: these are directories
-// the service WRITES, which is the same property that makes DispatchWorktreeRoot and
-// AttemptStateRoot owned members, and attempt_state_root_member_note records what it cost to learn
-// that a written path outside the roster is a path nothing creates. Projected: the paths come from
-// the gunbc.host_layout rows, never spelled here, so the belt and the deploy cannot drift to two
-// spellings of one directory.\n\nSEPARATE, because the first cut put them in deployment_owned_steps
-// beside the dashboard's own members and that was wrong in a way the srv1-only scope hides. Those
-// steps are built PER INSTANCE, and every instance would then have received srv1's literal paths
-// under its own name -- srv2's preview slot creating /var/lib/gunbc directories for a service that
-// does not run there. gunbc_host_layout_note names that exact defect for the exact reason it is
-// dangerous: no value is visibly wrong, so nothing surfaces, and the first host whose layout
-// genuinely diverged would silently inherit srv1's body.\n\nSo the projection is its own function,
-// called for the host that actually runs the build service, rather than folded into a per-instance
-// list that would answer for hosts nobody asked about. Dissolve-on: devboot deployed to a second
-// host. At that point the roots become fields of a host layout resolved through a total
-// host-identity lookup -- the next-rung trigger dispatch_state_scope_carries_its_roots_note already
-// names -- and this srv1-shaped function retires into that derivation.
-
 fn deployment_ensured_packages() -> List<DeploymentDependencyStep> {
   [
     DeploymentDependencyStep {
@@ -1159,128 +1153,55 @@ fn deployment_ensured_packages() -> List<DeploymentDependencyStep> {
   ]
 }
 
-// THE FABRIC DB STORE IS ENSURED, NEVER OWNED: it is durable history every partition's chain
-// lives in, so no retract may remove it -- the property this category makes structural. It
-// replaced the per-instance event-log mirror root, which was owned and torn down with rm -rf;
-// that was harmless for a cache of a remote repository and would destroy the log itself here.
-//
-// THE ROOT ALONE IS NOT A STORE. The file store writes objects under `objects/` and heads under
-// `heads/` (gunbc.fabric_storage_file_store fabric_storage_file_root), and a create-new under an
-// absent area refuses not_found -- fleet-converge run 35818578751's host-effect claim did exactly
-// that. The areas are derived from the store's own root function, so the ensured paths and the
-// written paths cannot disagree, and this deployment is the store's one production creator.
-//
-// AND AN AREA THE WRITER CANNOT WRITE IS NOT A STORE EITHER. The three directories are managed:
-// their owner, group and mode come from the writers gunbc.fabric_storage_placement
-// fabric_storage_store_directories declares (the service principal and the CI job principal), not
-// from gunbc_service_user at the shared 0755 -- which is what refused fleet-converge run
-// 36139624393's claim permission_denied. install -d re-applies owner, group and mode to a directory
-// that already exists, so the next apply repairs the areas #12126 created.
-fn deployment_ensured_srv1_host_directories() -> List<DeploymentDependencyStep> {
-  concat([
-    DeploymentDependencyStep {
-      kind: DevbootArtifactStoreDirectory,
-      subject: EnsuredHostDirectory {
-        path: srv1_devboot_artifact_store_root as String as NonEmptyStr,
-        owner: gunbc_service_user,
-      },
+// THE BUILD SERVICE'S ROOTS ARE THE HOST'S DEMAND, NOT ANY INSTANCE'S. The devboot artifact store and
+// the codex runtime release root are written by host-level services, so a per-instance list would hand
+// srv2's preview slot srv1's literal paths (gunbc_host_layout_note names that defect). They are
+// owned-directory targets on the host target, created and read back by the same provider as the
+// instance's demands, at the shared 0755 they were installed at, and no retract removes them.
+// Dissolve-on: devboot deployed to a second host, at which point the roots become fields of a host
+// layout resolved through a total host-identity lookup.
+fn deployment_srv1_host_directories() -> List<OwnedDirectoryTarget> {
+  let owner = PosixOwnerNames { user: gunbc_service_user, group: gunbc_service_user }
+  [
+    OwnedDirectoryDeclared {
+      member: "devboot-artifact-store" as NonEmptyStr,
+      path: srv1_devboot_artifact_store_root,
+      owner: owner,
+      mode: DirectoryOwnerAllEveryoneTraverse,
     },
-  ], concat(map(fabric_storage_store_directories(), a => DeploymentDependencyStep {
-      kind: FabricStorageStoreDirectory,
-      subject: EnsuredManagedHostDirectory { admission: a },
-    }), [
-    DeploymentDependencyStep {
-      kind: CodexRuntimeReleaseDirectory,
-      subject: EnsuredHostDirectory {
-        path: srv1_codex_runtime_release_root as String as NonEmptyStr,
-        owner: gunbc_service_user,
-      },
+    OwnedDirectoryDeclared {
+      member: "codex-runtime-release" as NonEmptyStr,
+      path: srv1_codex_runtime_release_root,
+      owner: owner,
+      mode: DirectoryOwnerAllEveryoneTraverse,
     },
-  ]))
+  ]
 }
 
 fn deployment_ensured_steps(target: DeploymentHostTarget) -> List<DeploymentDependencyStep> {
-  concat(deployment_ensured_packages(), target.ensured_directories)
-}
-
-// THE PROVIDER-STATE ROOT IS AN ENSURED MEMBER OF THE INSTANCE, NOT OF THE HOST (CONVERGENCE-ONE
-// C7, operator ruling 2026-09-19: live_deploy owns provider-state creation). The dashboard
-// launcher's provision plan was its only creator, so deleting that launcher without this member
-// would lose the creation silently: a fresh host would get a provider login with nowhere to write.
-//
-// It is Ensured rather than Owned for the reason the provision op already gave: the directory is
-// never torn down and never populated by the deploy. Credentials inside it are user-authored secret
-// state, so a retract that removed it would destroy a login the deploy did not create.
-//
-// IT IS DERIVED FROM THE SPEC, NOT AUTHORED INTO ITS STEP LIST, AND THAT IS THE WHOLE SAFETY
-// ARGUMENT. The first cut of this change appended the member to deployment_steps_apply_order and
-// then had the emitter REFUSE a spec whose steps omitted it -- a five-armed standing type, a poison
-// string and two witnesses, all validating a constraint the model could carry instead. DESIGN 5 is
-// explicit that construction beats validation, and review 68784 was right that the check restated
-// what the model already knew. So the path became a field of DeploymentServiceConfig, beside the
-// other instance-projected paths it already carries (serve_binary, instance_root, repo_root), the
-// owner is read from that same config's service principal, and every consumer -- the emitted ensure
-// and the read-back member -- derives from this one function. A spec cannot omit the member, carry
-// it twice, name a package instead of a directory, or give it an owner other than the principal
-// that writes the login: none of those four states has a constructor any more, so the arms that
-// once refused them are deleted rather than left as permanently-green decoration (DESIGN 4b: ask
-// whether the RED is authorable before writing the check).
-//
-// The directory is installed with the ensured-directory arm's mode (install_d_shared_mode), the
-// same mode the provision op's mkdir produced. Credential files inside carry their own modes. A
-// tighter mode is a ManagedDirectory derivation, and adopting one would change what
-// EnsuredHostDirectory means for every kind.
-//
-// DISPOSITION CENSUS, stated here because deleting a creator with a blank row is the serve-binary
-// deadlock. After this change, the provider-state root of each instance is created by:
-//   srv1_live      -- this member, on the production route (deployment_spec_srv1 ->
-//                     live_deploy_apply_script_for), read back as a DirectoryRoot. The provision
-//                     plan's DashboardEnsureProviderStateRoot is now redundant for this instance
-//                     and goes with the launcher deletion, not before.
-//   srv1_lab       -- the provision plan (gunbc.roadmap_dashboard_instance
-//   srv2_lab          dashboard_instance_provision_plan DashboardEnsureProviderStateRoot) stays
-//   srv2_deploy       the ONLY creator. Their specs carry this member, but no production caller
-//   macbook_local     applies those specs, so the member creates nothing for them yet. The
-//                     provision op may be deleted for an instance only when a production caller
-//                     applies its spec.
-// The approval broker's own service config is a SECOND unit on an instance, not a sixth instance:
-// its provider-state root is that instance's root, from the same projection, so the broker's apply
-// converges the same directory the dashboard's does. That is why the field is not optional for it --
-// an idempotent ensure of the same path is what Ensured means, and a broker-specific path would be
-// a second root for one host's login state.
-fn deployment_provider_state_step(spec: DeploymentSpec) -> DeploymentDependencyStep {
-  DeploymentDependencyStep {
-    kind: ProviderStateRootDirectory,
-    subject: EnsuredHostDirectory {
-      path: spec.service.provider_state_root,
-      owner: spec.service.service_user,
-    },
-  }
+  deployment_ensured_packages()
 }
 
-// The path the ensure creates and the path the readback reads, from one function so they cannot
-// disagree.
-fn deployment_provider_state_path(spec: DeploymentSpec) -> NonEmptyStr {
-  ensured_subject_identity(subject: deployment_provider_state_step(spec: spec).subject)
+// EVERY DIRECTORY THIS DEPLOYMENT CREATES AND READS BACK: the instance's demands, then the host's. The
+// emitted install and the read-back roster both iterate this, so a directory created and a directory
+// read back cannot be two lists.
+fn deployment_directory_demands(spec: DeploymentSpec) -> List<OwnedDirectoryTarget> {
+  concat(spec.directories, spec.target.host_directories)
 }
-
 // Apply order is dependency-honest: the binary lands before the tree, because the tree is published
 // by a service-user oneshot that RUNS the admitted binary (gunbc.live_deploy.repository_convergence_placement
 // convergence_unit_doc) -- the order used to read tree-then-binary on the grounds that the binary serves
 // the tree, which is true of the running process but not of the installation, and the identity emitter
 // had to override it downstream until this authority said it (review on PR #10696); both before the
-// two belt-spawn roots (the worktree root and the attempt-state root, which a
-// dispatch writes in that order — worktree first, then the published attempt evidence), all before
-// the unit (ExecStart references binary + tree), then the belt timer (its ExecStart references that
-// same binary and tree, and every tick it fires writes the two roots above — so it is ordered after
-// them for the same dependency reason the unit is), and the tailscale mapping last (routes to a
-// live service). FleetConvergeTimerUnit is RETIRED from deployment membership (operator directive
-// 2026-08-13, sleek-heron-218): unattended cadence is replaced by the emitted fleet-converge.yml
-// on-demand plan/apply workflow; timer teardown for hosts that still carry legacy units is owned by
+// unit (ExecStart references binary + tree), then the belt timer (its ExecStart references that same
+// binary and tree), and the tailscale mapping last (routes to a live service). The directories every
+// one of these writes into are not steps: the apply ensures all of them before the first step
+// (gunbc.live_deploy.emit owned_directory_apply_steps), so no member runs before the roots it writes.
+// FleetConvergeTimerUnit is RETIRED from deployment membership (operator directive 2026-08-13,
+// sleek-heron-218): unattended cadence is replaced by the emitted fleet-converge.yml on-demand
+// plan/apply workflow; timer teardown for hosts that still carry legacy units is owned by
 // gunbc.fleet_converge_plan timer-retirement reconcile, not this spec's apply pole. Retract is the
-// reverse, with DispatchWorktreeRoot AND AttemptStateRoot torn down by empty-directory removal —
-// LOUD failure when worktrees or published attempts exist, so a retract cannot silently destroy
-// live agent sessions or the evidence of what they did (a construction-level refusal, not a check).
+// reverse of the owned steps and touches no directory.
 fn deployment_steps_apply_order(
   instance: HostDashboardInstance,
   target: DeploymentHostTarget,
@@ -1344,20 +1265,20 @@ fn deployment_srv1_target() -> DeploymentHostTarget {
     tailnet_domain: fleet_intent_network.tailnet_domain,
     os_package_manager: ubuntu_noble_os_package_manager(),
     tailscale_client: srv1_observed_tailscale_client(),
-    ensured_directories: deployment_ensured_srv1_host_directories(),
+    host_directories: deployment_srv1_host_directories(),
   }
 }
 
-data srv1_tailscale_client_observed_version: SemVerVersion = SemVerVersion {
-  major: 1,
-  minor: 98,
-  patch: 3,
-  pre_release: [],
-  build: [],
-}
+// THE OBSERVED VERSION IS THE PARSE RESULT, never a hand-built record: SemVerVersion fields
+// are confined code-point runs, so the label arrives through the parser and an unadmitted
+// label is carried as a refusal, not a fabricated version (review 77150).
+data srv1_tailscale_client_observed_version: SemVerVersion? = semver_version_parse(cps: chars(s: "1.98.3" as String))
 
 fn srv1_observed_tailscale_client() -> TailscaleServeCapability {
-  tailscale_scoped_removal_capability(observed: srv1_tailscale_client_observed_version)
+  match srv1_tailscale_client_observed_version {
+    Absent => ScopedRemovalUnobserved { reason: "the observed client version label failed to parse — a defect in the observed-version row, not an observation gap" }
+    Present { value: observed } => tailscale_scoped_removal_capability(observed: observed)
+  }
 }
 
 fn deployment_service_config(
@@ -1413,6 +1334,7 @@ fn deployment_spec_for(
     ),
     names: names,
     instance_id: instance.instance_id,
+    directories: dashboard_instance_directory_demands(instance: instance),
   }
 }
 
diff --git a/dag/gunbc/live_deploy/unit_standing.dag b/dag/gunbc/live_deploy/unit_standing.dag
index 43159220b4e..3b3c98f5247 100644
--- a/dag/gunbc/live_deploy/unit_standing.dag
+++ b/dag/gunbc/live_deploy/unit_standing.dag
@@ -2,49 +2,38 @@ module gunbc.live_deploy.unit_standing
 
 import std.types { String, Bool, NonEmptyStr, Int, List, list_length }
 import std.algebra { trim }
-import std.measure { Microsecond, microsecond_count }
 import extdeps.systemd.systemctl
 import extdeps.systemd {
-  systemd_unit_property_wire, SystemdUnitProperty, systemd_duration_usec, AccuracyUSec,
-  LoadState, UnitFileState, ActiveState, SubState, Result, ExecMainStatus, ExecStartProperty, User, WorkingDirectoryProperty, Unit, TimersMonotonic,
+  systemd_unit_property_wire, SystemdUnitProperty,
+  LoadState, UnitFileState, ActiveState, SubState, Result, ExecMainStatus, ExecStartProperty, User, WorkingDirectoryProperty, Unit,
 }
 import extdeps.systemd.unit_file {
-  SystemdUnitFile, ServiceUnitFile, TimerUnitFile, SliceUnitFile,
-  SystemdServiceDirective, SystemdTimerDirective,
-  OnBootSec,
-  OnUnitInactiveSec,
-  AccuracySec,
-}
-
-// EXACT SYSTEMD SERVICE AND TIMER STANDING, MODELED ON WHAT THE EMITTED UNITS ACTUALLY ARE.
-// Readiness plus a fresh tick receipt cannot prove the belt timer is enabled now: a service can be
-// invoked by hand, write one fresh receipt, and sit behind a disabled timer. The RLM-2 ruling
-// (section 7) therefore keeps unit standing in scope and rejects the naive 'service and timer both
-// enabled and active', because gunbc.live_deploy.emit deliberately gives the three units different
-// semantics -- the dashboard serve service is Type=simple, the belt service is Type=oneshot with no
-// [Install] section, and the belt timer is what is enabled under timers.target. The positive
-// standing is one row per unit, and the discriminating POSITIVE control is that a correctly
-// completed, currently INACTIVE oneshot stays green.
-// 
+  SystemdUnitFile, ServiceUnitFile, TimerUnitFile, SliceUnitFile, PathUnitFile,
+  SystemdServiceDirective,
+  SystemdPathDirective, PathUnit, DirectoryNotEmpty, PathChanged, MakeDirectory,
+}
+
+// EXACT SYSTEMD UNIT STANDING, MODELED ON WHAT THE EMITTED UNITS ACTUALLY ARE. Readiness alone
+// cannot prove the belt's units are installed and armed. The RLM-2 ruling (section 7) keeps unit
+// standing in scope and rejects the naive 'every unit enabled and active', because
+// gunbc.live_deploy.emit gives the units different semantics -- the dashboard serve service is
+// Type=simple, the belt service is Type=oneshot with no [Install] section, and the belt's event path
+// units are what is enabled, under paths.target. (There was a belt timer; dogfood intervention #4
+// removed it, and with it this module's timer standing.) The positive standing is one row per unit,
+// and the discriminating POSITIVE control is that a correctly completed, currently INACTIVE oneshot
+// stays green.
+//
 // THE OBSERVER IS `systemctl show --property=X --value` (extdeps.systemd.systemctl ShowProperty),
-// system scope, which this module widened with the properties it needs rather than adding a second
-// show surface. There is still no modeled system-scope `is-enabled` operation (systemctl.dag's own
-// note); UnitFileState carries the same fact through the show surface, which is the read that
-// already existed.
-// 
-// WHAT IS COMPARED EXACTLY, member by member, stated so any residue would be visible.
-// ExecStart, User and WorkingDirectory are compared exactly against the directives of R's emitted
-// unit file (gunbc.live_deploy.emit live_deploy_serve_unit_file /
-// live_deploy_belt_service_unit_file), reading systemd's `{ path=... ; argv[]=... ; ... }`
-// rendering by its `argv[]=` segment. The timer's target unit is compared exactly through the Unit
-// property. The timer's cadence VALUES are compared exactly too: OnBootUSec and OnUnitInactiveUSec
-// from TimersMonotonic and the AccuracyUSec property are each normalized through
-// extdeps.systemd systemd_duration_usec (systemd.time(7), microsecond resolution) and compared
-// against the Microsecond expectations derived from R's emitted timer unit -- '60s' and '1min'
-// are one value, and a spelling that stops normalizing refuses rather than passing structurally.
-// This dissolves the former declared residue (cadence compared by entry presence only), whose
-// trigger -- an extdeps.systemd duration model -- is the mechanism that landed beside this text.
-// 
+// system scope. There is still no modeled system-scope `is-enabled` operation (systemctl.dag's own
+// note); UnitFileState carries the same fact through the show surface.
+//
+// WHAT IS COMPARED EXACTLY, member by member, stated so any residue would be visible. ExecStart, User
+// and WorkingDirectory are compared exactly against the directives of R's emitted unit file
+// (gunbc.live_deploy.emit live_deploy_serve_unit_file / live_deploy_belt_service_unit_file), reading
+// systemd's `{ path=... ; argv[]=... ; ... }` rendering by its `argv[]=` segment. A path unit's target
+// is compared exactly through the Unit property; its watched path is NOT read back (see
+// BeltEventPathStanding), which is this module's one declared residue.
+//
 // EVERY REFUSAL NAMES THE UNIT AND THE PROPERTY that disagreed; an unreadable property is a
 // refusal, never a pass by vacancy.
 type UnitPropertyRead
@@ -72,24 +61,10 @@ type ServiceUnitObserved {
   working_directory: String
 }
 
-type TimerUnitObserved {
-  load_state: String
-  unit_file_state: String
-  active_state: String
-  sub_state: String
-  unit: String
-  timers_monotonic: String
-  accuracy_usec_value: String
-}
-
 type ServiceUnitObservation
   = ServiceUnitObservedOk { observed: ServiceUnitObserved }
   | ServiceUnitUnobservable { unit: String, property: String }
 
-type TimerUnitObservation
-  = TimerUnitObservedOk { observed: TimerUnitObserved }
-  | TimerUnitUnobservable { unit: String, property: String }
-
 fn observe_service_unit(unit: NonEmptyStr) -> ServiceUnitObservation {
   match read_unit_property(unit: unit, property: LoadState) {
     UnitPropertyUnreadable { unit: u, property: p } => ServiceUnitUnobservable { unit: u, property: p }
@@ -142,48 +117,6 @@ fn observe_service_unit(unit: NonEmptyStr) -> ServiceUnitObservation {
   }
 }
 
-fn observe_timer_unit(unit: NonEmptyStr) -> TimerUnitObservation {
-  match read_unit_property(unit: unit, property: LoadState) {
-    UnitPropertyUnreadable { unit: u, property: p } => TimerUnitUnobservable { unit: u, property: p }
-    UnitPropertyValue { value: load_state } =>
-      match read_unit_property(unit: unit, property: UnitFileState) {
-        UnitPropertyUnreadable { unit: u, property: p } => TimerUnitUnobservable { unit: u, property: p }
-        UnitPropertyValue { value: unit_file_state } =>
-          match read_unit_property(unit: unit, property: ActiveState) {
-            UnitPropertyUnreadable { unit: u, property: p } => TimerUnitUnobservable { unit: u, property: p }
-            UnitPropertyValue { value: active_state } =>
-              match read_unit_property(unit: unit, property: SubState) {
-                UnitPropertyUnreadable { unit: u, property: p } => TimerUnitUnobservable { unit: u, property: p }
-                UnitPropertyValue { value: sub_state } =>
-                  match read_unit_property(unit: unit, property: Unit) {
-                    UnitPropertyUnreadable { unit: u, property: p } => TimerUnitUnobservable { unit: u, property: p }
-                    UnitPropertyValue { value: target } =>
-                      match read_unit_property(unit: unit, property: TimersMonotonic) {
-                        UnitPropertyUnreadable { unit: u, property: p } => TimerUnitUnobservable { unit: u, property: p }
-                        UnitPropertyValue { value: timers } =>
-                          match read_unit_property(unit: unit, property: AccuracyUSec) {
-                            UnitPropertyUnreadable { unit: u, property: p } => TimerUnitUnobservable { unit: u, property: p }
-                            UnitPropertyValue { value: accuracy } =>
-                              TimerUnitObservedOk {
-                                observed: TimerUnitObserved {
-                                  load_state: load_state,
-                                  unit_file_state: unit_file_state,
-                                  active_state: active_state,
-                                  sub_state: sub_state,
-                                  unit: target,
-                                  timers_monotonic: timers,
-                                  accuracy_usec_value: accuracy,
-                                },
-                              }
-                          }
-                      }
-                  }
-              }
-          }
-      }
-  }
-}
-
 // THE EXPECTATION IS DERIVED FROM R'S EMITTED UNIT FILE, never typed beside it.
 type ServiceUnitExpectation {
   exec_start: String
@@ -321,121 +254,7 @@ fn service_unit_expectation_of(file: SystemdUnitFile) -> ServiceUnitExpectationD
       }
     TimerUnitFile { unit: _, timer: _, install: _ } => ServiceExpectationUnderivable { detail: "expected a service unit file, got a timer" }
     SliceUnitFile { unit: _, slice: _, install: _ } => ServiceExpectationUnderivable { detail: "expected a service unit file, got a slice" }
-  }
-}
-
-type TimerUnitExpectation {
-  target_unit: String
-  on_boot_usec: Microsecond
-  on_unit_inactive_usec: Microsecond
-  accuracy_usec: Microsecond
-}
-
-// The value rendered after `Name=` in a systemctl show composite like
-// `{ OnBootUSec=2min ; next_elapse=... }, { OnUnitInactiveUSec=1min ; ... }`: the token between
-// the prefix and the next ` ;`, `,` or `}` boundary, normalized through systemd.time(7).
-fn show_rendered_duration_usec(rendering: String, prefix: String) -> Microsecond? {
-  let parts = split(s: rendering, delimiter: prefix)
-  if list_length(items: parts) < 2 {
-    none
-  } else {
-    let tail = fold(parts, init: "", f: (a, seg) => seg)
-    let token = fold(split(s: tail, delimiter: " ; "), init: "", f: (acc, seg) => if acc == "" { seg } else { acc })
-    systemd_duration_usec(text: trim(s: fold(split(s: token, delimiter: "}"), init: "", f: (acc, seg) => if acc == "" { seg } else { acc })))
-  }
-}
-
-fn timer_on_boot_duration(directives: List<SystemdTimerDirective>) -> Microsecond? {
-  fold(directives, init: none, f: (acc, d) =>
-    match acc {
-      Present { value: v } => Present { value: v }
-      Absent => match d {
-        TimerUnit { target: _ } => none
-        OnCalendar { expression: _ } => none
-        OnBootSec { duration: t } => systemd_duration_usec(text: t as String)
-        OnUnitInactiveSec { duration: _ } => none
-        AccuracySec { duration: _ } => none
-        RandomizedDelaySec { duration: _ } => none
-        Persistent { enabled: _ } => none
-      }
-    })
-}
-
-fn timer_on_unit_inactive_duration(directives: List<SystemdTimerDirective>) -> Microsecond? {
-  fold(directives, init: none, f: (acc, d) =>
-    match acc {
-      Present { value: v } => Present { value: v }
-      Absent => match d {
-        TimerUnit { target: _ } => none
-        OnCalendar { expression: _ } => none
-        OnBootSec { duration: _ } => none
-        OnUnitInactiveSec { duration: t } => systemd_duration_usec(text: t as String)
-        AccuracySec { duration: _ } => none
-        RandomizedDelaySec { duration: _ } => none
-        Persistent { enabled: _ } => none
-      }
-    })
-}
-
-fn timer_accuracy_duration(directives: List<SystemdTimerDirective>) -> Microsecond? {
-  fold(directives, init: none, f: (acc, d) =>
-    match acc {
-      Present { value: v } => Present { value: v }
-      Absent => match d {
-        TimerUnit { target: _ } => none
-        OnCalendar { expression: _ } => none
-        OnBootSec { duration: _ } => none
-        OnUnitInactiveSec { duration: _ } => none
-        AccuracySec { duration: t } => systemd_duration_usec(text: t as String)
-        RandomizedDelaySec { duration: _ } => none
-        Persistent { enabled: _ } => none
-      }
-    })
-}
-
-type TimerUnitExpectationDerivation
-  = TimerExpectationDerived { expectation: TimerUnitExpectation }
-  | TimerExpectationUnderivable { detail: String }
-
-fn timer_directive_target(directives: List<SystemdTimerDirective>) -> String? {
-  fold(directives, init: none, f: (acc, d) => match acc {
-    Present { value: v } => Present { value: v }
-    Absent => match d {
-      TimerUnit { target: t } => Present { value: t as String }
-      OnCalendar { expression: _ } => none
-      OnBootSec { duration: _ } => none
-      OnUnitInactiveSec { duration: _ } => none
-      AccuracySec { duration: _ } => none
-      RandomizedDelaySec { duration: _ } => none
-      Persistent { enabled: _ } => none
-    }
-  })
-}
-
-fn timer_unit_expectation_of(file: SystemdUnitFile) -> TimerUnitExpectationDerivation {
-  match file {
-    TimerUnitFile { unit: _, timer: directives, install: _ } =>
-      match timer_directive_target(directives: directives) {
-        Absent => TimerExpectationUnderivable { detail: "emitted timer unit carries no Unit= target" }
-        Present { value: t } =>
-          match timer_on_boot_duration(directives: directives) {
-            Absent => TimerExpectationUnderivable { detail: "emitted timer unit carries no normalizable OnBootSec" }
-            Present { value: boot } =>
-              match timer_on_unit_inactive_duration(directives: directives) {
-                Absent => TimerExpectationUnderivable { detail: "emitted timer unit carries no normalizable OnUnitInactiveSec" }
-                Present { value: inactive } =>
-                  match timer_accuracy_duration(directives: directives) {
-                    Absent => TimerExpectationUnderivable { detail: "emitted timer unit carries no normalizable AccuracySec" }
-                    Present { value: accuracy } =>
-                      TimerExpectationDerived { expectation: TimerUnitExpectation {
-                        target_unit: t, on_boot_usec: boot, on_unit_inactive_usec: inactive, accuracy_usec: accuracy,
-                      } }
-                  }
-              }
-          }
-      }
-    ServiceUnitFile { unit: _, service: _, install: _ } => TimerExpectationUnderivable { detail: "expected a timer unit file, got a service" }
-    SliceUnitFile { unit: _, slice: _, install: _ } => TimerExpectationUnderivable { detail: "expected a timer unit file, got a slice" }
+    PathUnitFile { unit: _, path: _, install: _ } => ServiceExpectationUnderivable { detail: "expected a service unit file, got a path unit" }
   }
 }
 
@@ -461,9 +280,15 @@ type DashboardServiceStanding
   = DashboardServiceConverged { unit: String }
   | DashboardServiceRefused { unit: String, property: String, expected: String, observed: String }
 
-type BeltTimerStanding
-  = BeltTimerConverged { unit: String }
-  | BeltTimerRefused { unit: String, property: String, expected: String, observed: String }
+// THE BELT'S EVENT PATH UNITS (dogfood intervention #4: there is no belt timer). A path unit is
+// converged when it is loaded, enabled, active and armed (`waiting`, or `running` while its unit runs)
+// and activates the unit the emitted file names. Its watched path is not read back here -- systemctl
+// renders Paths= as a composite this row does not parse -- so the path is established by the emitted
+// file the deploy installed and its byte comparison, not by this read; and this row proves only that
+// the watcher is ARMED. Whether events are CONSUMED is the receipt's event backlog row.
+type BeltEventPathStanding
+  = BeltEventPathConverged { unit: String }
+  | BeltEventPathRefused { unit: String, property: String, expected: String, observed: String }
 
 type BeltOneshotStanding
   = BeltOneshotConverged { unit: String, active_state: String }
@@ -499,45 +324,6 @@ fn judge_dashboard_service(unit: String, expect: ServiceUnitExpectation, o: Serv
   }
 }
 
-fn judge_belt_timer(unit: String, expect: TimerUnitExpectation, o: TimerUnitObserved) -> BeltTimerStanding {
-  if o.load_state != "loaded" {
-    BeltTimerRefused { unit: unit, property: "LoadState", expected: "loaded", observed: o.load_state }
-  } else if o.unit_file_state != "enabled" {
-    BeltTimerRefused { unit: unit, property: "UnitFileState", expected: "enabled", observed: o.unit_file_state }
-  } else if o.active_state != "active" {
-    BeltTimerRefused { unit: unit, property: "ActiveState", expected: "active", observed: o.active_state }
-  } else if o.sub_state != "waiting" && o.sub_state != "running" {
-    BeltTimerRefused { unit: unit, property: "SubState", expected: "waiting|running", observed: o.sub_state }
-  } else if o.unit != expect.target_unit {
-    BeltTimerRefused { unit: unit, property: "Unit", expected: expect.target_unit, observed: o.unit }
-  } else {
-    match show_rendered_duration_usec(rendering: o.timers_monotonic, prefix: "OnBootUSec=") {
-      Absent => BeltTimerRefused { unit: unit, property: "TimersMonotonic", expected: "a normalizable OnBootUSec entry", observed: o.timers_monotonic }
-      Present { value: boot } =>
-        if microsecond_count(boot) != microsecond_count(expect.on_boot_usec) {
-          BeltTimerRefused { unit: unit, property: "OnBootUSec", expected: to_string(microsecond_count(expect.on_boot_usec)), observed: to_string(microsecond_count(boot)) }
-        } else {
-          match show_rendered_duration_usec(rendering: o.timers_monotonic, prefix: "OnUnitInactiveUSec=") {
-            Absent => BeltTimerRefused { unit: unit, property: "TimersMonotonic", expected: "a normalizable OnUnitInactiveUSec entry", observed: o.timers_monotonic }
-            Present { value: inactive } =>
-              if microsecond_count(inactive) != microsecond_count(expect.on_unit_inactive_usec) {
-                BeltTimerRefused { unit: unit, property: "OnUnitInactiveUSec", expected: to_string(microsecond_count(expect.on_unit_inactive_usec)), observed: to_string(microsecond_count(inactive)) }
-              } else {
-                match systemd_duration_usec(text: trim(s: o.accuracy_usec_value)) {
-                  Absent => BeltTimerRefused { unit: unit, property: "AccuracyUSec", expected: "a normalizable duration", observed: o.accuracy_usec_value }
-                  Present { value: accuracy } =>
-                    if microsecond_count(accuracy) != microsecond_count(expect.accuracy_usec) {
-                      BeltTimerRefused { unit: unit, property: "AccuracyUSec", expected: to_string(microsecond_count(expect.accuracy_usec)), observed: to_string(microsecond_count(accuracy)) }
-                    } else {
-                      BeltTimerConverged { unit: unit }
-                    }
-                }
-              }
-          }
-        }
-    }
-  }
-}
 
 // THE ONESHOT IS NOT SEPARATELY ENABLED (it has no [Install] section, so its UnitFileState is
 // `static`), and it is normally INACTIVE between ticks. Both are the correct state and both are
@@ -574,7 +360,8 @@ fn judge_belt_oneshot(unit: String, expect: ServiceUnitExpectation, o: ServiceUn
 
 type LaunchUnitStanding {
   dashboard: DashboardServiceStanding
-  timer: BeltTimerStanding
+  exit_path: BeltEventPathStanding
+  answer_path: BeltEventPathStanding
   oneshot: BeltOneshotStanding
 }
 
@@ -586,11 +373,11 @@ fn dashboard_service_standing_text(s: DashboardServiceStanding) -> String {
   }
 }
 
-fn belt_timer_standing_text(s: BeltTimerStanding) -> String {
+fn belt_event_path_standing_text(s: BeltEventPathStanding) -> String {
   match s {
-    BeltTimerConverged { unit: u } => join(["belt timer ", u, " converged"], "")
-    BeltTimerRefused { unit: u, property: p, expected: e, observed: o } =>
-      join(["belt timer ", u, " ", p, " expected ", e, " observed ", o], "")
+    BeltEventPathConverged { unit: u } => join(["belt event path ", u, " converged"], "")
+    BeltEventPathRefused { unit: u, property: p, expected: e, observed: o } =>
+      join(["belt event path ", u, " ", p, " expected ", e, " observed ", o], "")
   }
 }
 
@@ -605,7 +392,8 @@ fn belt_oneshot_standing_text(s: BeltOneshotStanding) -> String {
 fn launch_unit_standing_text(s: LaunchUnitStanding) -> String {
   join([
     dashboard_service_standing_text(s: s.dashboard), "; ",
-    belt_timer_standing_text(s: s.timer), "; ",
+    belt_event_path_standing_text(s: s.exit_path), "; ",
+    belt_event_path_standing_text(s: s.answer_path), "; ",
     belt_oneshot_standing_text(s: s.oneshot),
   ], "")
 }
@@ -624,15 +412,56 @@ fn observe_dashboard_service_standing(unit: NonEmptyStr, file: SystemdUnitFile)
   }
 }
 
-fn observe_belt_timer_standing(unit: NonEmptyStr, file: SystemdUnitFile) -> BeltTimerStanding {
-  match timer_unit_expectation_of(file: file) {
-    TimerExpectationUnderivable { detail: d } =>
-      BeltTimerRefused { unit: unit as String, property: "expectation", expected: "derivable from emitted unit", observed: d }
-    TimerExpectationDerived { expectation: e } =>
-      match observe_timer_unit(unit: unit) {
-        TimerUnitUnobservable { unit: u, property: p } =>
-          BeltTimerRefused { unit: u, property: p, expected: "readable", observed: "systemctl show refused" }
-        TimerUnitObservedOk { observed: o } => judge_belt_timer(unit: unit as String, expect: e, o: o)
+fn path_unit_target_of(file: SystemdUnitFile) -> String? {
+  match file {
+    PathUnitFile { unit: _, path: directives, install: _ } =>
+      fold(directives, init: none, f: (acc, d) => match acc {
+        Present { value: v } => Present { value: v }
+        Absent => match d {
+          PathUnit { target: t } => Present { value: t as String }
+          DirectoryNotEmpty { path: _ } => none
+          PathChanged { path: _ } => none
+          MakeDirectory { enabled: _ } => none
+        }
+      })
+    ServiceUnitFile { unit: _, service: _, install: _ } => none
+    TimerUnitFile { unit: _, timer: _, install: _ } => none
+    SliceUnitFile { unit: _, slice: _, install: _ } => none
+  }
+}
+
+fn observe_belt_event_path_standing(unit: NonEmptyStr, file: SystemdUnitFile) -> BeltEventPathStanding {
+  match path_unit_target_of(file: file) {
+    Absent => BeltEventPathRefused { unit: unit as String, property: "expectation", expected: "derivable from emitted unit", observed: "the emitted unit is not a path unit naming a Unit= target" }
+    Present { value: target } =>
+      match read_unit_property(unit: unit, property: LoadState) {
+        UnitPropertyUnreadable { unit: u, property: p } => BeltEventPathRefused { unit: u, property: p, expected: "readable", observed: "systemctl show refused" }
+        UnitPropertyValue { value: load } =>
+          if load != "loaded" { BeltEventPathRefused { unit: unit as String, property: "LoadState", expected: "loaded", observed: load } } else {
+            match read_unit_property(unit: unit, property: UnitFileState) {
+              UnitPropertyUnreadable { unit: u, property: p } => BeltEventPathRefused { unit: u, property: p, expected: "readable", observed: "systemctl show refused" }
+              UnitPropertyValue { value: file_state } =>
+                if file_state != "enabled" { BeltEventPathRefused { unit: unit as String, property: "UnitFileState", expected: "enabled", observed: file_state } } else {
+                  match read_unit_property(unit: unit, property: ActiveState) {
+                    UnitPropertyUnreadable { unit: u, property: p } => BeltEventPathRefused { unit: u, property: p, expected: "readable", observed: "systemctl show refused" }
+                    UnitPropertyValue { value: active } =>
+                      if active != "active" { BeltEventPathRefused { unit: unit as String, property: "ActiveState", expected: "active", observed: active } } else {
+                        match read_unit_property(unit: unit, property: SubState) {
+                          UnitPropertyUnreadable { unit: u, property: p } => BeltEventPathRefused { unit: u, property: p, expected: "readable", observed: "systemctl show refused" }
+                          UnitPropertyValue { value: sub } =>
+                            if sub != "waiting" && sub != "running" { BeltEventPathRefused { unit: unit as String, property: "SubState", expected: "waiting|running", observed: sub } } else {
+                              match read_unit_property(unit: unit, property: Unit) {
+                                UnitPropertyUnreadable { unit: u, property: p } => BeltEventPathRefused { unit: u, property: p, expected: "readable", observed: "systemctl show refused" }
+                                UnitPropertyValue { value: observed_target } =>
+                                  if observed_target != target { BeltEventPathRefused { unit: unit as String, property: "Unit", expected: target, observed: observed_target } } else { BeltEventPathConverged { unit: unit as String } }
+                              }
+                            }
+                        }
+                      }
+                  }
+                }
+            }
+          }
       }
   }
 }
diff --git a/dag/gunbc/machine_intake/access.dag b/dag/gunbc/machine_intake/access.dag
index fec49c0c310..f8aa3af4621 100644
--- a/dag/gunbc/machine_intake/access.dag
+++ b/dag/gunbc/machine_intake/access.dag
@@ -6,6 +6,7 @@ import extdeps.bmc.endpoint { BmcControllerEndpoint }
 import extdeps.bmc.capability { BmcFirmwareReleaseCapabilityRow }
 import extdeps.bmc.access_profile {
   AccessProfileAmbiguous,
+  AccessProfileBoardNotFactsBound,
   AccessProfileCatalogRowRefused,
   AccessProfileKnown,
   AccessProfileUncatalogued,
@@ -22,6 +23,8 @@ import extdeps.bmc.access_profile {
   ProfilePromotedFromObservation,
   bmc_access_profile_for,
 }
+import extdeps.board_authority { BoardAuthorityLookup }
+import gunbc.board_authority_binding { board_authority_bindings }
 import gunbc.machine_intake_subject { MachineIntakeSubject }
 import gunbc.machine_intake_receipt { EvidenceRef, same_intake_subject }
 
@@ -108,6 +111,7 @@ type BoundBmcAccessContextStanding
   | AccessContextObservationEvidenceMismatch { endpoint: BmcControllerEndpoint, manifest: List<EvidenceRef>, raw_response: ContentHash }
   | AccessContextProbeEvidenceMismatch { endpoint: BmcControllerEndpoint, manifest: List<EvidenceRef>, raw_response: ContentHash }
   | AccessContextControlRouteEvidenceMismatch { endpoint: BmcControllerEndpoint, manifest: List<EvidenceRef>, raw_response: ContentHash }
+  | AccessContextBoardNotFactsBound { observed_identity: BmcObservedIdentity, board: BoardAuthorityLookup }
   | AccessContextProfileUncatalogued { observed_identity: BmcObservedIdentity }
   | AccessContextProfileAmbiguous { observed_identity: BmcObservedIdentity, count: Int }
   | AccessContextCatalogRefused { standing: BmcAccessProfileCatalogRowStanding }
@@ -193,9 +197,10 @@ fn bind_looked_up_access_context(
   observation: BmcAccessObservation,
   catalog: List<BmcAccessProfileCatalogRow>,
 ) -> BoundBmcAccessContextStanding {
-  match bmc_access_profile_for(identity: observation.identity, catalog: catalog) {
+  match bmc_access_profile_for(identity: observation.identity, catalog: catalog, bindings: board_authority_bindings) {
     AccessProfileKnown { profile: p, provenance: prov } =>
       bind_known_profile(subject: subject, receipt: receipt, observation: observation, profile: p, provenance: prov)
+    AccessProfileBoardNotFactsBound { observed_identity: i, board: b } => AccessContextBoardNotFactsBound { observed_identity: i, board: b }
     AccessProfileUncatalogued { observed_identity: i } => AccessContextProfileUncatalogued { observed_identity: i }
     AccessProfileAmbiguous { observed_identity: i, count: n } => AccessContextProfileAmbiguous { observed_identity: i, count: n }
     AccessProfileCatalogRowRefused { standing: s } => AccessContextCatalogRefused { standing: s }
diff --git a/dag/gunbc/machine_intake/arrival_admission.dag b/dag/gunbc/machine_intake/arrival_admission.dag
new file mode 100644
index 00000000000..e6ce1410017
--- /dev/null
+++ b/dag/gunbc/machine_intake/arrival_admission.dag
@@ -0,0 +1,45 @@
+module gunbc.machine_intake_arrival_admission
+
+import std.types { String }
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+import gunbc.actions_run_binding {
+  actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent,
+  fleet_converge_expected_host_env_name, fleet_converge_arrival_subject_env_name,
+}
+import gunbc.fleet_host_identity { operator_host_srv1 }
+import gunbc.machine_intake_arrival_subject {
+  admit_arrival_subject,
+  ArrivalSubjectInPopulation, ArrivalSubjectUnknown,
+  ArrivalSubjectIsManagedHostExecutorConfusion, ArrivalSubjectOutsideGrant,
+}
+
+// CREDENTIAL-FREE ARRIVAL ADMISSION. Same split as mtcollins1_boot_admission: the job's first
+// gunbc run typechecks this closure only. The dispatch's host input must name the store host
+// (srv1); the arrival_subject input must be in arrival_converge_population. Neither skip nor
+// WIF happens first (review 70894).
+
+fn arrival_admit_executor() -> ProcessExit {
+  match actions_variable_read(name: fleet_converge_expected_host_env_name) {
+    ActionsVariableAbsent { variable: v, detail: d } =>
+      exit_failure(reason: concat("arrival_converge: ", concat(v, concat(" ", concat(d, "; the arrival store host is srv1 only")))))
+    ActionsVariablePresent { value: host } =>
+      if host == (operator_host_srv1 as String) {
+        match actions_variable_read(name: fleet_converge_arrival_subject_env_name) {
+          ActionsVariableAbsent { variable: v, detail: d } =>
+            exit_failure(reason: concat("arrival_converge: ", concat(v, concat(" ", d))))
+          ActionsVariablePresent { value: wire } =>
+            match admit_arrival_subject(wire: wire) {
+              ArrivalSubjectInPopulation { subject: _ } => ExitSuccess
+              ArrivalSubjectUnknown { wire: w } =>
+                exit_failure(reason: concat("arrival_converge refuses unknown arrival_subject '", concat(w, "'")))
+              ArrivalSubjectIsManagedHostExecutorConfusion { wire: w } =>
+                exit_failure(reason: concat("arrival_converge refuses executor/host as arrival_subject '", concat(w, "'")))
+              ArrivalSubjectOutsideGrant { wire: w } =>
+                exit_failure(reason: concat("arrival_converge refuses arrival_subject '", concat(w, "' outside the standing grant")))
+            }
+        }
+      } else {
+        exit_failure(reason: concat("arrival_converge refuses host '", concat(host, concat("': the arrival slot store is on ", operator_host_srv1 as String))))
+      }
+  }
+}
diff --git a/dag/gunbc/machine_intake/arrival_converge.dag b/dag/gunbc/machine_intake/arrival_converge.dag
index 53321df64ec..187a98004c1 100644
--- a/dag/gunbc/machine_intake/arrival_converge.dag
+++ b/dag/gunbc/machine_intake/arrival_converge.dag
@@ -1,6 +1,7 @@
 module gunbc.machine_intake_arrival_converge
 
-import std.types { List, NonEmptyStr, String }
+import std.types { Bool, Int, List, NonEmptyStr, String }
+import std.content_hash { content_hash_equal }
 import std.decl_ref { DeclarationRef, decl_ref }
 import std.goal_assessment {
   ObservationAttempt,
@@ -19,7 +20,7 @@ import std.upsert_decision { UpsertDecision, Noop, Apply, Refuse }
 import extdeps.bmc.endpoint { BmcControllerEndpoint, BmcEndpoint, BmcFirmwareFamily, Redfish }
 import extdeps.bmc.capability { BmcFirmwareReleaseIdentity, bmc_firmware_release_identity_of_wire }
 import extdeps.bmc.access_profile { SurfaceManagerIdentity }
-import gunbc.machine_intake_receipt { EvidenceRef }
+import gunbc.machine_intake_receipt { EvidenceRef, same_intake_subject }
 import gunbc.machine_intake_phase {
   ArrivalPhase,
   AccessDiscover,
@@ -40,6 +41,7 @@ import gunbc.machine_intake_phase {
   Placement,
   arrival_phases_all,
   intake_phase_rank,
+  machine_qualification_policy_digest,
 }
 import gunbc.machine_intake_subject {
   AssemblyManifest,
@@ -77,6 +79,7 @@ import gunbc.machine_intake_mtjade1_access_observation {
   fru_gap_text,
   smbios_gap_text,
   sol_session_controller,
+  mtjade1_smbios_sol_attribution,
   provisional_assembly_of_fru,
   read_mtjade1_current_manager_read,
   read_mtjade1_fru,
@@ -85,9 +88,12 @@ import gunbc.machine_intake_mtjade1_access_observation {
 import gunbc.machine_intake_mtcollins1_bmc_secure_observation { mtcollins1_unit_key_standing }
 import gunbc.machine_intake_bmc_rotation_route {
   BmcRotationRouteStanding,
+  BmcAccountWriteRequest,
   ObservedSurfaceRead,
   rotation_route_candidate,
   redfish_account_password_write,
+  rotation_apply_authority,
+  rotation_route_request_identity,
 }
 import gunbc.machine_intake_bmc_rotation_route_evidence { manager_read_receipt, mtjade1_observed_endpoint }
 import gunbc.host_convergence_protocol { HostEffectDomainProjection, inspect_via_host_effect_projection }
@@ -104,6 +110,39 @@ import gunbc.machine_intake_prior_life_boundary {
   prior_life_receipt_key,
   prior_life_receipt_consumed_identity,
 }
+import gunbc.machine_intake_bmc_secure {
+  BmcSecureGoal,
+  BmcAccountStateObservation,
+  BmcSecureStateInspected,
+  BmcSecureStateUnobserved,
+  BmcSecurePhaseConverged,
+  BmcSecurePhaseRefused,
+  BmcSecurePhaseNoop,
+  BmcSecurePhaseApplied,
+  BmcSecurePhaseReceipt,
+  inspect_bmc_secure_state,
+  bmc_secure_phase_noop,
+  bmc_secure_phase_applied,
+  BmcAccountApplication,
+  ManagedCredentialReference,
+  managed_reference_same,
+  bmc_account_state_observation_same,
+}
+import gunbc.auth.authorization_pattern_selection {
+  InterlockedBy, InterlockPending,
+}
+import gunbc.auth.standing_operator_grant {
+  StandingOperatorGrant,
+  StandingGrantHost,
+  StandingBmcSecureAccountWrite,
+  standing_grant_covers,
+  standing_grant_arm_interlock,
+}
+import gunbc.auth.privileged_effect_census { ruling_interlock_is_rostered }
+import product.host_identity { HostIdentity, host_identity_eq }
+import gunbc.fleet_host_identity { operator_host_named, operator_host_mtjade1 }
+import gunbc.auth.approval_capability { ProposeApprove, ProposeDeny }
+import gunbc.auth.approval_broker { Redemption, RedemptionAdmitted, RedemptionRefused }
 import gunbc.fleet.convergence_fold {
   ConvergenceRunId,
   StepSubjectKey,
@@ -123,24 +162,35 @@ import gunbc.fleet.convergence_fold {
   StepIncomplete,
   ConvergenceReceiptProjection,
   ConvergenceRunVerdict,
+  RunConverged,
+  RunStopped,
+  RunIncomplete,
+  RunOutcomesRefused,
   admit_convergence_plan,
   fold_convergence_run,
   step_instance_key,
   step_outcome_receipt,
+  ungated_readonly_step,
+  StepGatedOnAuthorization,
+  InstanceAuthorization,
+  instance_authorization,
 }
 
-// THE ARRIVAL CONVERGENCE PREFIX (docs/plans/managed-host-untangle.md, cuts O1c-1 and O1c-2): the first
-// real consumer of gunbc.fleet.convergence_fold. Its three steps are the first three phases of
-// gunbc.machine_intake_phase arrival_phases_all -- AccessDiscover, IdentityBindProvisional and
-// PriorLifeBoundary -- each a protocol step through gunbc.host_convergence_protocol
+// THE ARRIVAL CONVERGENCE PREFIX (docs/plans/managed-host-untangle.md, cuts O1c-1 through O1c-3): the
+// first real consumer of gunbc.fleet.convergence_fold. Its four steps are the first four phases of
+// gunbc.machine_intake_phase arrival_phases_all -- AccessDiscover, IdentityBindProvisional,
+// PriorLifeBoundary and BmcSecure -- each a protocol step through gunbc.host_convergence_protocol
 // HostEffectDomainProjection (observe, assess, decide) with its own row in
 // gunbc.host_convergence_census. The first two are read-only: the only decision either can reach is
 // Noop (the phase's goal is read back as already holding) or Refuse; neither has an Apply, so an Apply
 // decision is itself a typed refusal, and the read each consumes is a committed capture.
 // PriorLifeBoundary is the first effectful step: its archive arm writes the controller's prior-life
 // records to the evidence store and reads them back, DRY in this cut
-// (gunbc.machine_intake_prior_life_boundary), so it is the one step that can be INCOMPLETE. Nothing
-// here performs a live BMC call or a live store write. gunbc.bmc_onboarding is not imported.
+// (gunbc.machine_intake_prior_life_boundary), so it is the one step that can be INCOMPLETE.
+// BmcSecure is the first GATED step: Apply refuses unless authorization is discharged for that unit
+// and that run (standing grant, operator capability, or federated workload principal selected before
+// the fold); Noop needs no discharge. Nothing here performs a live BMC credential write.
+// gunbc.bmc_onboarding is not imported.
 //
 // ORDERING TIME. No field of the read-only steps is an ordering clock. The controller's own DateTime is
 // kept as an AccessDiscover observation only; the observer clock (gunbc.clock_read) orders the
@@ -154,6 +204,8 @@ data identity_bind_provisional_step_ref: DeclarationRef = decl_ref(module_path:
 
 data prior_life_boundary_step_ref: DeclarationRef = decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "prior_life_boundary")
 
+data bmc_secure_step_ref: DeclarationRef = decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "bmc_secure")
+
 // A read-only phase has no remedy. The plan type of its projection is sealed to this module and this
 // module constructs none, so an Apply over a read-only phase has no value to carry.
 type ReadOnlyPhaseRemedy sole_constructor {
@@ -454,6 +506,7 @@ type ArrivalStepReceipt
   = AccessDiscoverReceipt { receipt: AccessDiscoverEstablished }
   | IdentityBindReceipt { receipt: IdentityBoundProvisional }
   | PriorLifeBoundaryReceipt { receipt: PriorLifeBoundaryEstablished }
+  | BmcSecureReceipt { receipt: BmcSecureStepEstablished }
 
 type ArrivalStepRefusal
   = AccessDiscoverObserveRefused { cause: AccessObserveRefusal }
@@ -464,17 +517,37 @@ type ArrivalStepRefusal
   | ReadOnlyPhaseSatisfiedWithoutEvidence { phase: ArrivalPhase }
   | PriorLifeIdentityForAnotherInstance { identity: StepInstanceKey }
   | PriorLifeBoundaryRefused { cause: PriorLifeRefusal }
+  | BmcSecureIdentityForAnotherInstance { identity: StepInstanceKey }
+  | BmcSecureAuthorizationUndischarged
+  | BmcSecurePhaseDomainRefused
+  | BmcSecureApplyInputsMissing
+  | BmcSecureApplicationForAnotherInstance { subject: MachineIntakeSubject }
+  | BmcSecureApplicationNotTheInspectedTransition
 
-// A STEP WHOSE EFFECT WAS ATTEMPTED AND IS NOT GROUNDED BY ITS READBACK. Only PriorLifeBoundary has
-// an effect in this prefix; the read-only phases cannot be incomplete.
 type ArrivalStepIncomplete
   = PriorLifeBoundaryIncomplete { cause: PriorLifeIncomplete }
 
+type BmcSecureStepEstablished sole_constructor {
+  key: StepInstanceKey
+  consumed_prior_life: StepInstanceKey
+  phase: BmcSecurePhaseReceipt
+}
+
+fn bmc_secure_step_established(key: StepInstanceKey, consumed_prior_life: StepInstanceKey, phase: BmcSecurePhaseReceipt) -> BmcSecureStepEstablished
+  admit_callers: [
+    decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "bmc_secure"),
+    decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "bmc_secure_bound"),
+  ]
+{
+  BmcSecureStepEstablished { key: key, consumed_prior_life: consumed_prior_life, phase: phase }
+}
+
 fn arrival_receipt_key(r: ArrivalStepReceipt) -> StepInstanceKey {
   match r {
     AccessDiscoverReceipt { receipt: a } => a.key
     IdentityBindReceipt { receipt: i } => i.key
     PriorLifeBoundaryReceipt { receipt: p } => prior_life_receipt_key(r: p)
+    BmcSecureReceipt { receipt: b } => b.key
   }
 }
 
@@ -483,11 +556,25 @@ fn arrival_receipt_consumed(r: ArrivalStepReceipt) -> List<StepInstanceKey> {
     AccessDiscoverReceipt { receipt: _ } => []
     IdentityBindReceipt { receipt: i } => [i.consumed_access]
     PriorLifeBoundaryReceipt { receipt: p } => [prior_life_receipt_consumed_identity(r: p)]
+    BmcSecureReceipt { receipt: b } => [b.consumed_prior_life]
+  }
+}
+
+fn arrival_receipt_authorization_required(r: ArrivalStepReceipt) -> Bool {
+  match r {
+    AccessDiscoverReceipt { receipt: _ } => false
+    IdentityBindReceipt { receipt: _ } => false
+    PriorLifeBoundaryReceipt { receipt: _ } => false
+    BmcSecureReceipt { receipt: b } =>
+      match b.phase.decision {
+        BmcSecurePhaseNoop { observation: _ } => false
+        BmcSecurePhaseApplied { plan: _, application: _, post_read: _ } => true
+      }
   }
 }
 
 fn arrival_receipt_projection() -> ConvergenceReceiptProjection<ArrivalStepReceipt> {
-  convergence_receipt_projection(key_of: arrival_receipt_key, consumed_of: arrival_receipt_consumed)
+  convergence_receipt_projection(key_of: arrival_receipt_key, consumed_of: arrival_receipt_consumed, authorization_required_of: arrival_receipt_authorization_required)
 }
 
 fn read_only_refusal(phase: ArrivalPhase, decision: UpsertDecision<ReadOnlyPhaseRemedy>) -> ArrivalStepRefusal {
@@ -582,6 +669,251 @@ fn prior_life_boundary(key: StepInstanceKey, identity: IdentityBoundProvisional,
   }
 }
 
+type BmcSecureApplyInputs {
+  application: BmcAccountApplication
+  post_read: BmcAccountStateObservation
+}
+
+type BmcSecureInputs {
+  goal: BmcSecureGoal
+  reading: BmcAccountStateObservation
+  grant: StandingOperatorGrant?
+  capability: Redemption?
+  apply: BmcSecureApplyInputs?
+}
+
+// A federated principal is not a discharge input. StandingBmcSecureAccountWrite on the operator-ssh
+// units is WorkloadIdentityUnbindable, so FederatedScopedGrant is not a selected pattern for this
+// effect. A NonEmptyStr here was a silent widen (review 38602): any string minted Apply.
+
+fn bmc_secure_account_rotation_site() -> DeclarationRef {
+  decl_ref(module_path: "gunbc.machine_intake_bmc_secure", decl_name: "plan_bmc_account_action")
+}
+
+fn grant_discharges_bmc_secure_account_write(g: StandingOperatorGrant, host: HostIdentity) -> Bool {
+  standing_grant_covers(g: g, scope: StandingGrantHost { host: host }, effect: StandingBmcSecureAccountWrite)
+    && match standing_grant_arm_interlock(g: g, e: StandingBmcSecureAccountWrite) {
+      InterlockPending { obligation: _ } => false
+      InterlockedBy { hold: h } =>
+        ruling_interlock_is_rostered(site_ref: bmc_secure_account_rotation_site(), interlock: h)
+    }
+}
+
+fn capability_discharges_bmc_secure_account_write(
+  r: Redemption,
+  standing: BmcRotationRouteStanding,
+  request: BmcAccountWriteRequest,
+  key: StepInstanceKey,
+) -> Bool {
+  match r {
+    RedemptionRefused { cause: _ } => false
+    RedemptionAdmitted { claims: cl, decided_by: _ } =>
+      match cl.decision {
+        ProposeDeny => false
+        ProposeApprove =>
+          cl.authority == rotation_apply_authority
+            && (cl.attempt as NonEmptyStr) == (key.run as NonEmptyStr)
+            && (cl.request_revision as String) == (rotation_route_request_identity(standing: standing, request: request) as String)
+      }
+  }
+}
+
+fn bound_bmc_secure_host(key: StepInstanceKey) -> HostIdentity? {
+  operator_host_named(label: key.subject as NonEmptyStr)
+}
+
+fn bound_host_owns_this_controller(host: HostIdentity, endpoint: BmcControllerEndpoint) -> Bool {
+  host_identity_eq(a: host, b: operator_host_mtjade1)
+    && (endpoint.host as String) == (sol_session_controller(a: mtjade1_smbios_sol_attribution).host as String)
+}
+
+fn bmc_secure_instance_joins_this_controller(
+  key: StepInstanceKey,
+  identity_subject: MachineIntakeSubject,
+  reading: BmcAccountStateObservation,
+  standing: BmcRotationRouteStanding,
+) -> Bool {
+  same_intake_subject(left: reading.subject, right: identity_subject)
+    && (key.run as String) == (identity_subject.attempt_id as String)
+    && (standing.endpoint.host as String) == (reading.endpoint.host as String)
+    && match bound_bmc_secure_host(key: key) {
+      Absent => false
+      Present { value: host } => bound_host_owns_this_controller(host: host, endpoint: standing.endpoint)
+    }
+}
+
+fn capability_discharge(
+  key: StepInstanceKey,
+  inputs: BmcSecureInputs,
+  standing: BmcRotationRouteStanding,
+  request: BmcAccountWriteRequest,
+) -> InstanceAuthorization?
+  admit_callers: [
+    decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "discharge_bmc_secure_apply"),
+  ]
+{
+  match inputs.capability {
+    Present { value: r } =>
+      if capability_discharges_bmc_secure_account_write(r: r, standing: standing, request: request, key: key) {
+        match r {
+          RedemptionAdmitted { claims: _, decided_by: by } => Present { value: instance_authorization(key: key, principal: by) }
+          RedemptionRefused { cause: _ } => none
+        }
+      } else {
+        none
+      }
+    Absent => none
+  }
+}
+
+fn discharge_bmc_secure_apply(
+  key: StepInstanceKey,
+  identity_subject: MachineIntakeSubject,
+  inputs: BmcSecureInputs,
+  standing: BmcRotationRouteStanding,
+  request: BmcAccountWriteRequest,
+) -> InstanceAuthorization?
+  admit_callers: [
+    decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "bmc_secure_bound"),
+    decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "converge_arrival_through_bmc_secure"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_uncovered_grant_falls_through_to_capability"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_uncovered_grant_refuses_a_capability_for_another_request"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_a_foreign_bound_host_key_cannot_mint_from_this_instance_controller"),
+  ]
+{
+  if !bmc_secure_instance_joins_this_controller(key: key, identity_subject: identity_subject, reading: inputs.reading, standing: standing) {
+    none
+  } else {
+    match bound_bmc_secure_host(key: key) {
+      Absent => none
+      Present { value: host } =>
+        match inputs.grant {
+          Present { value: g } =>
+            if grant_discharges_bmc_secure_account_write(g: g, host: host) {
+              Present { value: instance_authorization(key: key, principal: g.principal) }
+            } else {
+              capability_discharge(key: key, inputs: inputs, standing: standing, request: request)
+            }
+          Absent =>
+            capability_discharge(key: key, inputs: inputs, standing: standing, request: request)
+        }
+    }
+  }
+}
+
+fn managed_generation_advances_the_requested(requested: ManagedCredentialReference, planned: ManagedCredentialReference) -> Bool {
+  requested.account == planned.account
+    && requested.role == planned.role
+    && (requested.secret.project as String) == (planned.secret.project as String)
+    && requested.secret.secret == planned.secret.secret
+    && planned.credential_epoch > requested.credential_epoch
+}
+
+fn bmc_account_observation_is_the_inspected_pre_state(inspected: BmcAccountStateObservation, diverged: BmcAccountStateObservation) -> Bool {
+  bmc_account_state_observation_same(a: inspected, b: diverged)
+}
+
+fn bmc_secure_application_joins_this_instance(
+  identity_subject: MachineIntakeSubject,
+  inspected_reading: BmcAccountStateObservation,
+  requested_goal: BmcSecureGoal,
+  application: BmcAccountApplication,
+) -> ArrivalStepRefusal? {
+  if !same_intake_subject(left: application.plan.subject, right: identity_subject) {
+    Present { value: BmcSecureApplicationForAnotherInstance { subject: application.plan.subject } }
+  } else if !bmc_account_observation_is_the_inspected_pre_state(inspected: inspected_reading, diverged: application.plan.diverged) {
+    Present { value: BmcSecureApplicationNotTheInspectedTransition }
+  } else if !managed_reference_same(a: requested_goal.published_break_glass, b: application.plan.goal.published_break_glass) {
+    Present { value: BmcSecureApplicationNotTheInspectedTransition }
+  } else if !content_hash_equal(left: machine_qualification_policy_digest(policy: requested_goal.policy), right: machine_qualification_policy_digest(policy: application.plan.goal.policy)) {
+    Present { value: BmcSecureApplicationNotTheInspectedTransition }
+  } else if !managed_generation_advances_the_requested(requested: requested_goal.managed, planned: application.plan.goal.managed) {
+    Present { value: BmcSecureApplicationNotTheInspectedTransition }
+  } else {
+    none
+  }
+}
+
+// Apply and discharge consume the bound subject's identity and the instance keys, not the
+// AccessDiscover/IdentityBind capture parses. Those steps remain the prefix; this is the BMC
+// grain after PriorLifeBoundary.
+fn bmc_secure_bound(
+  key: StepInstanceKey,
+  identity_key: StepInstanceKey,
+  identity_subject: MachineIntakeSubject,
+  prior_key: StepInstanceKey,
+  inputs: BmcSecureInputs,
+) -> StepOutcome<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>
+  admit_callers: [
+    decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "bmc_secure"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "bmc_secure_bound_refuses_foreign_apply"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_without_authorization_refuses_after_a_real_apply"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_for_a_later_break_glass_generation_is_refused"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_another_channel_state_is_refused"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_a_different_present_controller_clock_is_refused"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_a_present_controller_clock_over_absent_is_refused"),
+  ]
+{
+  if (identity_key.run as NonEmptyStr) != (key.run as NonEmptyStr) || (identity_key.subject as NonEmptyStr) != (key.subject as NonEmptyStr) {
+    StepRefused { key: key, cause: BmcSecureIdentityForAnotherInstance { identity: identity_key } }
+  } else if (prior_key.run as NonEmptyStr) != (key.run as NonEmptyStr) || (prior_key.subject as NonEmptyStr) != (key.subject as NonEmptyStr) {
+    StepRefused { key: key, cause: BmcSecureIdentityForAnotherInstance { identity: prior_key } }
+  } else {
+    match inspect_bmc_secure_state(subject: identity_subject, goal: inputs.goal, reading: inputs.reading) {
+      BmcSecureStateUnobserved { cause: _ } => StepRefused { key: key, cause: BmcSecurePhaseDomainRefused }
+      BmcSecureStateInspected { observed: _, assessment: a, decision: d } =>
+        match d {
+          Noop =>
+            match bmc_secure_phase_noop(subject: identity_subject, goal: inputs.goal, reading: inputs.reading) {
+              BmcSecurePhaseConverged { receipt: phase } =>
+                StepEstablished { receipt: BmcSecureReceipt { receipt: bmc_secure_step_established(key: key, consumed_prior_life: prior_key, phase: phase) } }
+              BmcSecurePhaseRefused { cause: _ } => StepRefused { key: key, cause: BmcSecurePhaseDomainRefused }
+            }
+          Refuse { reason: _ } => StepRefused { key: key, cause: BmcSecurePhaseDomainRefused }
+          Apply { plan: _ } =>
+            match inputs.apply {
+              Absent => StepRefused { key: key, cause: BmcSecureApplyInputsMissing }
+              Present { value: ap } =>
+                match bmc_secure_application_joins_this_instance(
+                  identity_subject: identity_subject,
+                  inspected_reading: inputs.reading,
+                  requested_goal: inputs.goal,
+                  application: ap.application,
+                ) {
+                  Present { value: c } => StepRefused { key: key, cause: c }
+                  Absent =>
+                    match discharge_bmc_secure_apply(
+                      key: key,
+                      identity_subject: identity_subject,
+                      inputs: inputs,
+                      standing: ap.application.plan.managed_write.route,
+                      request: ap.application.plan.managed_write.request,
+                    ) {
+                      Absent => StepRefused { key: key, cause: BmcSecureAuthorizationUndischarged }
+                      Present { value: _ } =>
+                        match bmc_secure_phase_applied(application: ap.application, post_read: ap.post_read) {
+                          BmcSecurePhaseConverged { receipt: phase } =>
+                            StepEstablished { receipt: BmcSecureReceipt { receipt: bmc_secure_step_established(key: key, consumed_prior_life: prior_key, phase: phase) } }
+                          BmcSecurePhaseRefused { cause: _ } => StepRefused { key: key, cause: BmcSecurePhaseDomainRefused }
+                        }
+                    }
+                }
+            }
+        }
+    }
+  }
+}
+
+fn bmc_secure(key: StepInstanceKey, identity: IdentityBoundProvisional, prior: PriorLifeBoundaryEstablished, inputs: BmcSecureInputs) -> StepOutcome<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete> {
+  bmc_secure_bound(
+    key: key,
+    identity_key: identity.key,
+    identity_subject: identity.subject,
+    prior_key: prior_life_receipt_key(r: prior),
+    inputs: inputs,
+  )
+}
+
 // ── THE PLAN: a prefix of the authority's order, never a second list ───────────────────────────
 
 fn arrival_order_authority() -> ConvergenceOrderAuthority<IntakePhase> {
@@ -599,10 +931,15 @@ fn arrival_planning_authority() -> ConvergencePlanningAuthority<IntakePhase> {
 // the plan; it is never skipped.
 fn arrival_step_of_phase(phase: ArrivalPhase) -> ConvergenceStep<IntakePhase>? {
   match phase {
-    AccessDiscover => Present { value: ConvergenceStep { identity: access_discover_step_ref, order_member: Arrival { phase: AccessDiscover }, preconditions: [] } }
-    IdentityBindProvisional => Present { value: ConvergenceStep { identity: identity_bind_provisional_step_ref, order_member: Arrival { phase: IdentityBindProvisional }, preconditions: [SameSubject { step: access_discover_step_ref }] } }
-    PriorLifeBoundary => Present { value: ConvergenceStep { identity: prior_life_boundary_step_ref, order_member: Arrival { phase: PriorLifeBoundary }, preconditions: [SameSubject { step: identity_bind_provisional_step_ref }] } }
-    BmcSecure => none
+    AccessDiscover => Present { value: ungated_readonly_step(identity: access_discover_step_ref, order_member: Arrival { phase: AccessDiscover }, preconditions: []) }
+    IdentityBindProvisional => Present { value: ungated_readonly_step(identity: identity_bind_provisional_step_ref, order_member: Arrival { phase: IdentityBindProvisional }, preconditions: [SameSubject { step: access_discover_step_ref }]) }
+    PriorLifeBoundary => Present { value: ungated_readonly_step(identity: prior_life_boundary_step_ref, order_member: Arrival { phase: PriorLifeBoundary }, preconditions: [SameSubject { step: identity_bind_provisional_step_ref }]) }
+    BmcSecure => Present { value: ConvergenceStep {
+      identity: bmc_secure_step_ref,
+      order_member: Arrival { phase: BmcSecure },
+      preconditions: [SameSubject { step: prior_life_boundary_step_ref }],
+      gate: StepGatedOnAuthorization,
+    } }
     BootDeliveryEstablish => none
     DiagnosticBootAttest => none
     InventoryConform => none
@@ -682,21 +1019,56 @@ fn arrival_prefix_outcomes(run: ConvergenceRunId, subject: StepSubjectKey, read:
                   [access, identity, prior_life_boundary(key: step_instance_key(run: run, step: prior_life_boundary_step_ref, subject: subject), identity: i, platform: prior_life.platform, world: prior_life.world)]
                 AccessDiscoverReceipt { receipt: _ } => [access, identity]
                 PriorLifeBoundaryReceipt { receipt: _ } => [access, identity]
+                BmcSecureReceipt { receipt: _ } => [access, identity]
               }
             Absent => [access, identity]
           }
         }
         IdentityBindReceipt { receipt: _ } => [access]
         PriorLifeBoundaryReceipt { receipt: _ } => [access]
+        BmcSecureReceipt { receipt: _ } => [access]
+      }
+  }
+}
+
+fn arrival_prefix_outcomes_through_bmc_secure(run: ConvergenceRunId, subject: StepSubjectKey, read: CurrentManagerRead, inputs: IdentityBindInputs, prior_life: PriorLifeInputs, bmc: BmcSecureInputs) -> List<StepOutcome<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>> {
+  let prefix = arrival_prefix_outcomes(run: run, subject: subject, read: read, inputs: inputs, prior_life: prior_life)
+  match prefix.last() {
+    Absent => prefix
+    Present { value: last } =>
+      match step_outcome_receipt(outcome: last) {
+        Absent => prefix
+        Present { value: r } =>
+          match r {
+            PriorLifeBoundaryReceipt { receipt: p } =>
+              match prefix |> filter(o => match step_outcome_receipt(outcome: o) { Present { value: ir } => match ir { IdentityBindReceipt { receipt: _ } => true  _ => false }  Absent => false }) |> first() {
+                Absent => prefix
+                Present { value: id_out } =>
+                  match step_outcome_receipt(outcome: id_out) {
+                    Absent => prefix
+                    Present { value: ir } =>
+                      match ir {
+                        IdentityBindReceipt { receipt: i } =>
+                          concat(prefix, [bmc_secure(key: step_instance_key(run: run, step: bmc_secure_step_ref, subject: subject), identity: i, prior: p, inputs: bmc)])
+                        AccessDiscoverReceipt { receipt: _ } => prefix
+                        PriorLifeBoundaryReceipt { receipt: _ } => prefix
+                        BmcSecureReceipt { receipt: _ } => prefix
+                      }
+                  }
+              }
+            AccessDiscoverReceipt { receipt: _ } => prefix
+            IdentityBindReceipt { receipt: _ } => prefix
+            BmcSecureReceipt { receipt: _ } => prefix
+          }
       }
   }
 }
 
-fn fold_arrival_prefix(steps: List<ConvergenceStep<IntakePhase>>, run: ConvergenceRunId, subject: StepSubjectKey, outcomes: List<StepOutcome<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>>) -> ArrivalPrefixVerdict {
+fn fold_arrival_prefix(steps: List<ConvergenceStep<IntakePhase>>, run: ConvergenceRunId, subject: StepSubjectKey, outcomes: List<StepOutcome<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>>, discharges: List<InstanceAuthorization>) -> ArrivalPrefixVerdict {
   match admit_convergence_plan(planning: arrival_planning_authority(), steps: steps) {
     ConvergencePlanRefused { cause: c } => ArrivalPlanRefused { cause: c }
     ConvergencePlanAdmitted { plan: plan } =>
-      ArrivalRunFolded { verdict: fold_convergence_run(plan: plan, run: run, subject: subject, outcomes: outcomes, projection: arrival_receipt_projection()) }
+      ArrivalRunFolded { verdict: fold_convergence_run(plan: plan, run: run, subject: subject, outcomes: outcomes, projection: arrival_receipt_projection(), discharges: discharges) }
   }
 }
 
@@ -704,7 +1076,34 @@ fn converge_arrival_prefix(run: ConvergenceRunId, subject: StepSubjectKey, read:
   match arrival_prefix_steps(phases: arrival_prefix_through(last: arrival_prefix_last)) {
     ArrivalPrefixPhaseUnstepped { phase: p } => ArrivalPrefixUnstepped { phase: p }
     ArrivalPrefixStepped { steps: steps } =>
-      fold_arrival_prefix(steps: steps, run: run, subject: subject, outcomes: arrival_prefix_outcomes(run: run, subject: subject, read: read, inputs: inputs, prior_life: prior_life))
+      fold_arrival_prefix(steps: steps, run: run, subject: subject, outcomes: arrival_prefix_outcomes(run: run, subject: subject, read: read, inputs: inputs, prior_life: prior_life), discharges: [])
+  }
+}
+
+// Apply mints through discharge_bmc_secure_apply. Noop never requires a fold discharge
+// (arrival_receipt_authorization_required is false on BmcSecurePhaseNoop), so a grant
+// copied here would be unused.
+fn converge_arrival_through_bmc_secure(run: ConvergenceRunId, subject: StepSubjectKey, read: CurrentManagerRead, inputs: IdentityBindInputs, prior_life: PriorLifeInputs, bmc: BmcSecureInputs) -> ArrivalPrefixVerdict {
+  match arrival_prefix_steps(phases: arrival_prefix_through(last: BmcSecure)) {
+    ArrivalPrefixPhaseUnstepped { phase: p } => ArrivalPrefixUnstepped { phase: p }
+    ArrivalPrefixStepped { steps: steps } => {
+      let key = step_instance_key(run: run, step: bmc_secure_step_ref, subject: subject)
+      let discharges = match bmc.apply {
+        Present { value: ap } =>
+          match discharge_bmc_secure_apply(
+            key: key,
+            identity_subject: bmc.reading.subject,
+            inputs: bmc,
+            standing: ap.application.plan.managed_write.route,
+            request: ap.application.plan.managed_write.request,
+          ) {
+            Present { value: d } => [d]
+            Absent => []
+          }
+        Absent => []
+      }
+      fold_arrival_prefix(steps: steps, run: run, subject: subject, outcomes: arrival_prefix_outcomes_through_bmc_secure(run: run, subject: subject, read: read, inputs: inputs, prior_life: prior_life, bmc: bmc), discharges: discharges)
+    }
   }
 }
 
@@ -742,3 +1141,14 @@ fn converge_mtjade1_arrival_prefix(run: ConvergenceRunId, prior_life: DryPriorLi
     prior_life: PriorLifeInputs { platform: mt_jade_platform_ref, world: prior_life },
   )
 }
+
+fn converge_mtjade1_arrival_through_bmc_secure(run: ConvergenceRunId, prior_life: DryPriorLifeWorld, bmc: BmcSecureInputs) -> ArrivalPrefixVerdict uses fs: std.resources.Filesystem {
+  converge_arrival_through_bmc_secure(
+    run: run,
+    subject: "mtjade1" as StepSubjectKey,
+    read: read_mtjade1_current_manager_read(),
+    inputs: mtjade1_identity_bind_inputs(),
+    prior_life: PriorLifeInputs { platform: mt_jade_platform_ref, world: prior_life },
+    bmc: bmc,
+  )
+}
diff --git a/dag/gunbc/machine_intake/arrival_interlock.dag b/dag/gunbc/machine_intake/arrival_interlock.dag
new file mode 100644
index 00000000000..28c706f3869
--- /dev/null
+++ b/dag/gunbc/machine_intake/arrival_interlock.dag
@@ -0,0 +1,184 @@
+module gunbc.machine_intake_arrival_interlock
+
+import std.types { NonEmptyStr, String }
+import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
+import std.durable_compare_and_set { CasGeneration }
+import std.durable_exclusive_hold { DurableHoldOwnerRef, DurableHoldReleaseRef }
+import gunbc.durable_exclusive_hold_file_store {
+  file_hold_acquire, file_hold_release_assess, file_hold_release_commit,
+  FileHoldAcquireOutcome,
+  FileHoldAcquired, FileHoldOccupied, FileHoldAcquireLost, FileHoldAcquireStoreUnavailable,
+  FileHoldSlotUndecodable, FileHoldKeyNotSlotAddressable,
+  FileHoldReleasePlanned, FileHoldReleaseNotEligible,
+  FileHoldReleased, FileHoldReleaseLost, FileHoldReleaseStoreUnavailable, FileHoldReleaseKeyNotSlotAddressable,
+}
+import gunbc.machine_intake_bmc_rotation_route {
+  BmcRotationRouteStanding, rotation_route_is_grounded,
+}
+import gunbc.machine_intake_arrival_subject { ArrivalSubjectAdmitted }
+
+// ── THE INTERLOCK AN MTJADE1 ARRIVAL WRITE TAKES ──────────────────────────────────────────────
+// The standing grant's words cover the class; this is the physical-safety / route-ground fact the
+// run must observe. It is not UnitHoldProof: mtjade1 has no ManagedHost unit-hold row until J4
+// admission. The store host is operator_host_srv1 (the same runner the arrival job pins). A wet
+// acquire is arrival_archive_slot_acquire (file_hold_acquire on arrival_slot_key); the caller
+// runs the gated effect while ArrivalArchiveSlotHeld is in hand, then arrival_archive_slot_release.
+// admit_arrival_* are supplied-slot checks, not the live hold.
+//
+// Archive (J2) needs the exclusive slot only (reads, evidence write, no account rotation).
+// BmcSecure (J4) is InterlockedBy admit_rotation_apply (#13517). Firmware qualification stays
+// InterlockPending until a writer under ArrivalArchiveSlotHeld lands in the wet door; the prefix
+// is PriorLifeBoundary only. admit_arrival_* remain supplied-slot checks for witnesses.
+
+fn arrival_slot_key(subject_wire: NonEmptyStr) -> NonEmptyStr {
+  join(["arrival:", subject_wire as String], "") as NonEmptyStr
+}
+
+type ArrivalSlotStanding
+  = ArrivalSlotHeld { subject: ArrivalSubjectAdmitted }
+  | ArrivalSlotNotHeld { cause: NonEmptyStr }
+
+type ArrivalArchiveInterlockStanding
+  = ArrivalArchiveInterlockAdmitted { subject: ArrivalSubjectAdmitted }
+  | ArrivalArchiveInterlockRefused { cause: NonEmptyStr }
+
+type ArrivalBmcSecureInterlockStanding
+  = ArrivalBmcSecureInterlockAdmitted { subject: ArrivalSubjectAdmitted }
+  | ArrivalBmcSecureInterlockRefused { cause: NonEmptyStr }
+
+fn admit_arrival_archive_interlock(subject: ArrivalSubjectAdmitted, slot: ArrivalSlotStanding) -> ArrivalArchiveInterlockStanding {
+  match slot {
+    ArrivalSlotHeld { subject: held } =>
+      if (held.wire as String) == (subject.wire as String) {
+        ArrivalArchiveInterlockAdmitted { subject: subject }
+      } else {
+        ArrivalArchiveInterlockRefused { cause: "arrival slot was held for a different subject" as NonEmptyStr }
+      }
+    ArrivalSlotNotHeld { cause: c } => ArrivalArchiveInterlockRefused { cause: c }
+  }
+}
+
+fn admit_arrival_bmc_secure_interlock(
+  subject: ArrivalSubjectAdmitted,
+  slot: ArrivalSlotStanding,
+  route: BmcRotationRouteStanding,
+) -> ArrivalBmcSecureInterlockStanding {
+  match admit_arrival_archive_interlock(subject: subject, slot: slot) {
+    ArrivalArchiveInterlockRefused { cause: c } => ArrivalBmcSecureInterlockRefused { cause: c }
+    ArrivalArchiveInterlockAdmitted { subject: s } =>
+      if rotation_route_is_grounded(standing: route) {
+        ArrivalBmcSecureInterlockAdmitted { subject: s }
+      } else {
+        ArrivalBmcSecureInterlockRefused { cause: "rotation route is not grounded; admit_rotation_apply refuses" as NonEmptyStr }
+      }
+  }
+}
+
+fn arrival_slot_acquire_refusal(outcome: FileHoldAcquireOutcome) -> NonEmptyStr {
+  match outcome {
+    FileHoldAcquired { slot_key: _, owner: _, generation: _ } => "arrival slot acquire succeeded" as NonEmptyStr
+    FileHoldOccupied { slot_key: k, holder: h, generation: _ } =>
+      join(["arrival slot ", k as String, " is held by '", h as String, "'"], "") as NonEmptyStr
+    FileHoldAcquireLost { slot_key: k } => join(["lost the race for arrival slot ", k as String], "") as NonEmptyStr
+    FileHoldAcquireStoreUnavailable { slot_key: k, cause: _ } =>
+      join(["arrival slot store unavailable for ", k as String], "") as NonEmptyStr
+    FileHoldSlotUndecodable { slot_key: k, generation: _, detail: _ } =>
+      join(["arrival slot ", k as String, " is undecodable"], "") as NonEmptyStr
+    FileHoldKeyNotSlotAddressable { slot_key: k } =>
+      join(["arrival slot key ", k as String, " is not slot-addressable"], "") as NonEmptyStr
+  }
+}
+
+type ArrivalArchiveSlotHeld sole_constructor {
+  subject: ArrivalSubjectAdmitted
+  slot_key: NonEmptyStr
+  owner: DurableHoldOwnerRef
+  generation: CasGeneration
+}
+
+type ArrivalArchiveSlotAcquire
+  = ArrivalArchiveSlotAcquired { held: ArrivalArchiveSlotHeld }
+  | ArrivalArchiveSlotAcquireRefused { cause: NonEmptyStr }
+
+type ArrivalArchiveSlotRelease
+  = ArrivalArchiveSlotReleased { generation: CasGeneration }
+  | ArrivalArchiveSlotReleaseRefused { cause: NonEmptyStr }
+
+fn arrival_archive_slot_acquire(root: NonEmptyStr, subject: ArrivalSubjectAdmitted, owner: DurableHoldOwnerRef) -> ArrivalArchiveSlotAcquire {
+  let key = arrival_slot_key(subject_wire: subject.wire)
+  match file_hold_acquire(root: root, slot_key: key, requested_owner: owner) {
+    FileHoldOccupied { slot_key: k, holder: h, generation: g } =>
+      ArrivalArchiveSlotAcquireRefused { cause: arrival_slot_acquire_refusal(outcome: FileHoldOccupied { slot_key: k, holder: h, generation: g }) }
+    FileHoldAcquireLost { slot_key: k } =>
+      ArrivalArchiveSlotAcquireRefused { cause: arrival_slot_acquire_refusal(outcome: FileHoldAcquireLost { slot_key: k }) }
+    FileHoldAcquireStoreUnavailable { slot_key: k, cause: c } =>
+      ArrivalArchiveSlotAcquireRefused { cause: arrival_slot_acquire_refusal(outcome: FileHoldAcquireStoreUnavailable { slot_key: k, cause: c }) }
+    FileHoldSlotUndecodable { slot_key: k, generation: g, detail: d } =>
+      ArrivalArchiveSlotAcquireRefused { cause: arrival_slot_acquire_refusal(outcome: FileHoldSlotUndecodable { slot_key: k, generation: g, detail: d }) }
+    FileHoldKeyNotSlotAddressable { slot_key: k } =>
+      ArrivalArchiveSlotAcquireRefused { cause: arrival_slot_acquire_refusal(outcome: FileHoldKeyNotSlotAddressable { slot_key: k }) }
+    FileHoldAcquired { slot_key: k, owner: o, generation: g } =>
+      ArrivalArchiveSlotAcquired {
+        held: ArrivalArchiveSlotHeld { subject: subject, slot_key: k, owner: o, generation: g },
+      }
+  }
+}
+
+fn arrival_archive_slot_release(root: NonEmptyStr, held: ArrivalArchiveSlotHeld) -> ArrivalArchiveSlotRelease {
+  match file_hold_release_assess(
+    root: root,
+    slot_key: held.slot_key,
+    owner: held.owner,
+    acquired_generation: held.generation,
+    released_by: "arrival-converge-archive-interlock" as DurableHoldReleaseRef,
+  ) {
+    FileHoldReleaseNotEligible { slot_key: _, refusal: _ } =>
+      ArrivalArchiveSlotReleaseRefused { cause: "arrival slot release was not eligible" as NonEmptyStr }
+    FileHoldReleasePlanned { plan: p } =>
+      match file_hold_release_commit(plan: p) {
+        FileHoldReleased { slot_key: _, generation: g } => ArrivalArchiveSlotReleased { generation: g }
+        FileHoldReleaseLost { slot_key: _ } =>
+          ArrivalArchiveSlotReleaseRefused { cause: "arrival slot release lost the race" as NonEmptyStr }
+        FileHoldReleaseStoreUnavailable { slot_key: _, cause: _ } =>
+          ArrivalArchiveSlotReleaseRefused { cause: "arrival slot store unavailable on release" as NonEmptyStr }
+        FileHoldReleaseKeyNotSlotAddressable { slot_key: _ } =>
+          ArrivalArchiveSlotReleaseRefused { cause: "arrival slot key not addressable on release" as NonEmptyStr }
+      }
+  }
+}
+
+fn arrival_combine_prefix_and_release(prefix: ProcessExit, slot: ArrivalArchiveSlotRelease) -> ProcessExit {
+  match slot {
+    ArrivalArchiveSlotReleased { generation: _ } => prefix
+    ArrivalArchiveSlotReleaseRefused { cause: c } =>
+      match prefix {
+        ExitSuccess => exit_failure(reason: concat("arrival_converge: prefix held, then slot release refused: ", c as String))
+        ExitFailure { code: code, reason: reason } =>
+          ExitFailure { code: code, reason: concat(reason, concat("; then slot release refused: ", c as String)) }
+      }
+  }
+}
+
+fn arrival_archive_slot_held(
+  subject: ArrivalSubjectAdmitted,
+  slot_key: NonEmptyStr,
+  owner: DurableHoldOwnerRef,
+  generation: CasGeneration,
+) -> ArrivalArchiveSlotHeld {
+  ArrivalArchiveSlotHeld { subject: subject, slot_key: slot_key, owner: owner, generation: generation }
+}
+
+// Acquire, body, then the caller-supplied release. Production binds arrival_archive_slot_release
+// at the one wet-door call site. One inhabitance claim also binds that same function.
+fn arrival_after_acquire(
+  outcome: ArrivalArchiveSlotAcquire,
+  body: fn() -> ProcessExit,
+  release_fn: fn(ArrivalArchiveSlotHeld) -> ArrivalArchiveSlotRelease,
+) -> ProcessExit {
+  match outcome {
+    ArrivalArchiveSlotAcquireRefused { cause: c } =>
+      exit_failure(reason: concat("arrival_converge: ", c as String))
+    ArrivalArchiveSlotAcquired { held: h } =>
+      arrival_combine_prefix_and_release(prefix: body(), slot: release_fn(h))
+  }
+}
diff --git a/dag/gunbc/machine_intake/arrival_run.dag b/dag/gunbc/machine_intake/arrival_run.dag
new file mode 100644
index 00000000000..6a4fe275861
--- /dev/null
+++ b/dag/gunbc/machine_intake/arrival_run.dag
@@ -0,0 +1,89 @@
+module gunbc.machine_intake_arrival_run
+
+import std.types { NonEmptyStr, String }
+import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
+import std.durable_exclusive_hold { DurableHoldOwnerRef }
+import gunbc.actions_run_binding {
+  actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent,
+  fleet_converge_arrival_subject_env_name,
+}
+import extdeps.github.actions_environment { github_run_id_variable_name }
+import gunbc.auth.access_token_source {
+  select_access_token_source, AccessTokenSourceSelected, AccessTokenSourceUnavailable,
+  WorkloadIdentityToken, GcloudPrintToken, OperatorSuppliedToken,
+}
+import gunbc.machine_intake_arrival_admission { arrival_admit_executor }
+import gunbc.machine_intake_arrival_subject {
+  admit_arrival_subject, ArrivalSubjectAdmitted, ArrivalSubjectInPopulation,
+  ArrivalSubjectUnknown, ArrivalSubjectIsManagedHostExecutorConfusion, ArrivalSubjectOutsideGrant,
+}
+import gunbc.machine_intake_arrival_interlock {
+  arrival_archive_slot_acquire, arrival_archive_slot_release, arrival_after_acquire,
+}
+import gunbc.managed_host_unit_hold { unit_hold_store_root }
+
+// THE ARRIVAL JOB'S WET DOOR (review 77263, review 77435, review 77746). Re-runs credential-free
+// admit so WIF cannot outrun a refused subject, then requires WorkloadIdentityToken (the minted
+// WIF bearer, in-process — not interpolated onto argv), takes arrival_archive_slot_acquire, and
+// arrival_archive_slot_release. It does not fold a dry/unobserved PriorLifeBoundary into
+// ExitSuccess: that would be fabricated plausible output (DESIGN §5). Until a live BMC/archive
+// observation is bound as the prefix input, the held door refuses with a typed cause. Witnesses
+// still supply a DryPriorLifeWorld to converge_mtjade1_arrival_prefix. BMC account writes and
+// the pinned bmc-mtjade1-gunbc accessor stay behind this door: the locus is
+// SecretLocusReservedNotOnAccessorRoster until FamilyObserved.
+
+fn arrival_wet_prefix_from_unobserved_world() -> ProcessExit {
+  exit_failure(reason: "arrival_converge refuses unobserved PriorLifeBoundary: no production observation is bound")
+}
+
+fn arrival_converge_wet() -> ProcessExit uses fs: std.resources.Filesystem {
+  match arrival_admit_executor() {
+    ExitFailure { code, reason } => ExitFailure { code: code, reason: reason }
+    ExitSuccess => arrival_converge_after_admit()
+  }
+}
+
+fn arrival_converge_after_admit() -> ProcessExit uses fs: std.resources.Filesystem {
+  match select_access_token_source() {
+    AccessTokenSourceUnavailable { cause: c } =>
+      exit_failure(reason: concat("arrival_converge: ", c as String))
+    AccessTokenSourceSelected { source: WorkloadIdentityToken } =>
+      match actions_variable_read(name: fleet_converge_arrival_subject_env_name) {
+        ActionsVariableAbsent { variable: v, detail: d } =>
+          exit_failure(reason: concat("arrival_converge: ", concat(v, concat(" ", d))))
+        ActionsVariablePresent { value: wire } =>
+          match admit_arrival_subject(wire: wire) {
+            ArrivalSubjectInPopulation { subject: s } => arrival_converge_under_archive_interlock(subject: s)
+            ArrivalSubjectUnknown { wire: w } =>
+              exit_failure(reason: concat("arrival_converge refuses unknown arrival_subject '", concat(w, "' after admit")))
+            ArrivalSubjectIsManagedHostExecutorConfusion { wire: w } =>
+              exit_failure(reason: concat("arrival_converge refuses executor/host as arrival_subject '", concat(w, "' after admit")))
+            ArrivalSubjectOutsideGrant { wire: w } =>
+              exit_failure(reason: concat("arrival_converge refuses arrival_subject '", concat(w, "' outside the standing grant after admit")))
+          }
+      }
+    AccessTokenSourceSelected { source: GcloudPrintToken } =>
+      exit_failure(reason: "arrival_converge: this job federates; select_access_token_source must be WorkloadIdentityToken, not GcloudPrintToken")
+    AccessTokenSourceSelected { source: OperatorSuppliedToken { token: _ } } =>
+      exit_failure(reason: "arrival_converge: this job federates; select_access_token_source must be WorkloadIdentityToken, not an operator-supplied token")
+  }
+}
+
+fn arrival_converge_under_archive_interlock(subject: ArrivalSubjectAdmitted) -> ProcessExit uses fs: std.resources.Filesystem {
+  match actions_variable_read(name: github_run_id_variable_name) {
+    ActionsVariableAbsent { variable: v, detail: d } =>
+      exit_failure(reason: concat("arrival_converge: ", concat(v, concat(" ", d))))
+    ActionsVariablePresent { value: run_id } =>
+      arrival_after_acquire(
+        outcome: arrival_archive_slot_acquire(
+          root: unit_hold_store_root,
+          subject: subject,
+          owner: join(["arrival-converge:", run_id], "") as DurableHoldOwnerRef,
+        ),
+        body: fn() {
+          arrival_wet_prefix_from_unobserved_world()
+        },
+        release_fn: fn(h) { arrival_archive_slot_release(root: unit_hold_store_root, held: h) },
+      )
+  }
+}
diff --git a/dag/gunbc/machine_intake/arrival_subject.dag b/dag/gunbc/machine_intake/arrival_subject.dag
new file mode 100644
index 00000000000..aab008ad2c9
--- /dev/null
+++ b/dag/gunbc/machine_intake/arrival_subject.dag
@@ -0,0 +1,85 @@
+module gunbc.machine_intake_arrival_subject
+
+import std.types { List, NonEmptyStr, String }
+import std.optional { Present, Absent }
+import std.decl_ref { DeclarationRef, decl_ref }
+import gunbc.auth.standing_operator_grant {
+  mtjade1_live_standing_grant, standing_grant_covers, StandingGrantHost,
+  StandingJadeArrivalArchive, StandingJadeFirmwareQualification,
+}
+import gunbc.fleet_host_identity { operator_host_mtjade1, operator_host_mtcollins1 }
+
+// ── ARRIVAL-CONVERGE SUBJECT POPULATION ───────────────────────────────────────────────────────
+// J2/J4 cannot read gunbc.managed_host managed_hosts(): mtjade1 is not a member until J4's
+// ManagedHostAdmission. The dispatch input for those effects is this population, distinct from the
+// executor `host` input and from `managed_host`. Options are derived from the rows, never a second
+// hand list in fleet-converge.yml.
+//
+// A row is a unit that has an arrival-prefix producer (today: converge_mtjade1_arrival_prefix). It
+// is not a HostIdentity enrollment and not a managed-host row.
+
+// This cut's population is one row, mtjade1. Dispatch options project from the
+// rows. admit_arrival_subject then joins that singleton to mtjade1_live_standing_grant
+// on operator_host_mtjade1; the grant is not a field of the row. A second row
+// would appear in the options and still refuse ArrivalSubjectOutsideGrant until
+// the admit fold joins each row to its own standing grant and host.
+type ArrivalConvergePopulationRow {
+  wire: NonEmptyStr
+  producer: DeclarationRef
+}
+
+data arrival_converge_population: List<ArrivalConvergePopulationRow> = [
+  ArrivalConvergePopulationRow {
+    wire: "mtjade1" as NonEmptyStr,
+    producer: decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "converge_mtjade1_arrival_prefix"),
+  },
+]
+
+fn arrival_converge_subject_options() -> List<String> {
+  map(arrival_converge_population, r => r.wire as String)
+}
+
+type ArrivalSubjectAdmitted sole_constructor {
+  wire: NonEmptyStr
+  producer: DeclarationRef
+}
+
+type ArrivalSubjectAdmission
+  = ArrivalSubjectInPopulation { subject: ArrivalSubjectAdmitted }
+  | ArrivalSubjectUnknown { wire: String }
+  | ArrivalSubjectIsManagedHostExecutorConfusion { wire: String }
+  | ArrivalSubjectOutsideGrant { wire: String }
+
+fn arrival_population_row(wire: String) -> ArrivalConvergePopulationRow? {
+  filter(arrival_converge_population, r => (r.wire as String) == wire).first()
+}
+
+// THE ADMIT FOLD THE ARRIVAL JOB RUNS BEFORE WIF. mtcollins1 is not a member. A spelling that is
+// not in arrival_converge_population refuses. Grant coverage for this singleton is
+// mtjade1_live_standing_grant on operator_host_mtjade1 (archive and firmware arms).
+fn admit_arrival_subject(wire: String) -> ArrivalSubjectAdmission {
+  if wire == (operator_host_mtcollins1 as String) {
+    ArrivalSubjectIsManagedHostExecutorConfusion { wire: wire }
+  } else {
+    match arrival_population_row(wire: wire) {
+      Absent => ArrivalSubjectUnknown { wire: wire }
+      Present { value: row } =>
+        if standing_grant_covers(
+          g: mtjade1_live_standing_grant,
+          scope: StandingGrantHost { host: operator_host_mtjade1 },
+          effect: StandingJadeArrivalArchive,
+        ) && standing_grant_covers(
+          g: mtjade1_live_standing_grant,
+          scope: StandingGrantHost { host: operator_host_mtjade1 },
+          effect: StandingJadeFirmwareQualification,
+        ) && (row.wire as String) == (operator_host_mtjade1 as String) {
+          ArrivalSubjectInPopulation {
+            subject: ArrivalSubjectAdmitted { wire: row.wire, producer: row.producer },
+          }
+        } else {
+          ArrivalSubjectOutsideGrant { wire: wire }
+        }
+    }
+  }
+}
+
diff --git a/dag/gunbc/machine_intake/bmc_rotation_route.dag b/dag/gunbc/machine_intake/bmc_rotation_route.dag
index b997639aa7c..5deebbaa799 100644
--- a/dag/gunbc/machine_intake/bmc_rotation_route.dag
+++ b/dag/gunbc/machine_intake/bmc_rotation_route.dag
@@ -152,6 +152,8 @@ fn rotation_route_from_citation(
     decl_ref(module_path: "test.claim.machine_intake_bmc_secure_state_witness", decl_name: "cited_lab_route_managed_user"),
     decl_ref(module_path: "test.claim.machine_intake_bmc_secure_state_witness", decl_name: "cited_lab_route_published_user"),
     decl_ref(module_path: "test.claim.machine_intake_bmc_secure_state_witness", decl_name: "cited_lab_route_managed_user_previous_build"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "cited_mtjade1_managed_route"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "cited_mtjade1_published_route"),
     decl_ref(module_path: "test.claim.machine_intake_bmc_secure_state_witness", decl_name: "an_open_channel_is_closed_only_over_a_grounded_channel_access_route"),
     decl_ref(module_path: "test.claim.machine_intake_bmc_secure_state_witness", decl_name: "the_channel_close_readback_is_bound_to_the_observed_run_and_account"),
     decl_ref(module_path: "test.claim.machine_intake_bmc_secure_state_witness", decl_name: "a_planned_channel_close_is_applied_read_back_and_converges"),
diff --git a/dag/gunbc/machine_intake/bmc_secure.dag b/dag/gunbc/machine_intake/bmc_secure.dag
index 473f2ae3885..4a3b782bd43 100644
--- a/dag/gunbc/machine_intake/bmc_secure.dag
+++ b/dag/gunbc/machine_intake/bmc_secure.dag
@@ -3,7 +3,7 @@ module gunbc.machine_intake_bmc_secure
 import std.types { Bool, EpochMs, Int, List, Map, NonEmptyStr, String, list_length }
 import v2.std.algebra { filter }
 import std.decl_ref { decl_ref }
-import std.content_hash { ContentHash, content_hash_of_value }
+import std.content_hash { ContentHash, content_hash_of_value, content_hash_equal }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
 import std.algebra { FreeSemigroup }
 import std.goal_assessment {
@@ -1286,6 +1286,7 @@ fn observed_bmc_account_state(
 ) -> BmcAccountStateObservation
   admit_callers: [
     decl_ref(module_path: "gunbc.machine_intake_bmc_secure", decl_name: "dry_read_bmc_account_state"),
+    decl_ref(module_path: "gunbc.machine_intake_bmc_secure", decl_name: "observation_with_controller_clock"),
   ]
 {
   BmcAccountStateObservation {
@@ -1328,6 +1329,35 @@ fn observed_published_account_at_join(account: ObservedPublishedAccount) -> Publ
   }
 }
 
+fn observation_with_controller_clock(base: BmcAccountStateObservation, controller_clock: ControllerClockReading?) -> BmcAccountStateObservation
+  admit_callers: [
+    decl_ref(module_path: "gunbc.machine_intake_bmc_secure", decl_name: "bmc_account_state_observation_same"),
+    decl_ref(module_path: "gunbc.machine_intake_bmc_secure", decl_name: "apply_with_diverged_controller_clock"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_a_different_present_controller_clock_is_refused"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_a_present_controller_clock_over_absent_is_refused"),
+  ]
+{
+  observed_bmc_account_state(
+    subject: base.subject,
+    endpoint: base.endpoint,
+    firmware: base.firmware,
+    managed: base.managed,
+    managed_user: base.managed_user,
+    attempt: base.attempt,
+    read_floor: base.read_floor,
+    managed_probe: base.managed_probe,
+    channel_census: base.channel_census,
+    census_evidence: base.census_evidence,
+    census_observed_at: base.census_observed_at,
+    published_probes: base.published_probes,
+    published_user: base.published_user,
+    published_account: base.published_account,
+    break_glass: base.break_glass,
+    break_glass_probe: base.break_glass_probe,
+    controller_clock: controller_clock,
+  )
+}
+
 fn managed_reference_same(a: ManagedCredentialReference, b: ManagedCredentialReference) -> Bool {
   a.account == b.account
     && a.role == b.role
@@ -1337,6 +1367,34 @@ fn managed_reference_same(a: ManagedCredentialReference, b: ManagedCredentialRef
     && a.credential_epoch == b.credential_epoch
 }
 
+// THE OBSERVATION IS THE PAYLOAD, NOT A START TIME. Record `==` is the language's structural
+// relation on the closed type, except controller_clock: ControllerClockReading? inherits
+// optional_equality_answers_by_representation, so that field is matched explicitly and the rest
+// compared by `==` after zeroing it. That match and observation_with_controller_clock are still
+// authored field lists: a new ControllerClockReading field or a new Optional on the observation
+// is not derived from the type declaration (no .dag value-layer reader of declared fields). The
+// class is gunbc.guarantee_stall.authored_record_field_list_standing_for_type_population_stall
+// authored_record_field_list_standing_for_type_population_stall -- a stall below ceiling, not a
+// section 4b(3) drop.
+fn controller_clock_reading_same(left: ControllerClockReading?, right: ControllerClockReading?) -> Bool {
+  match left {
+    Absent => match right { Absent => true  Present { value: _ } => false }
+    Present { value: a } => match right {
+      Absent => false
+      Present { value: b } =>
+        (a.reported_millis as Int) == (b.reported_millis as Int)
+          && a.evidence.label == b.evidence.label
+          && content_hash_equal(left: a.evidence.digest, right: b.evidence.digest)
+    }
+  }
+}
+
+fn bmc_account_state_observation_same(a: BmcAccountStateObservation, b: BmcAccountStateObservation) -> Bool {
+  controller_clock_reading_same(left: a.controller_clock, right: b.controller_clock)
+    && (observation_with_controller_clock(base: a, controller_clock: none)
+      == observation_with_controller_clock(base: b, controller_clock: none))
+}
+
 // WHAT THE PHASE REQUIRES OF THE CONTROLLER: this managed generation accepted, the published
 // credential closed, under this qualification policy.
 // published_break_glass is the exact generation the published account is retired TO (or, under a
@@ -2065,6 +2123,34 @@ type BmcAccountApplication sole_constructor {
   applied_at: ObserverClockInstant
 }
 
+fn apply_with_diverged_controller_clock(application: BmcAccountApplication, controller_clock: ControllerClockReading?) -> BmcAccountApplication
+  admit_callers: [
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_a_different_present_controller_clock_is_refused"),
+  ]
+{
+  let p = application.plan
+  BmcAccountApplication {
+    plan: BmcAccountActionPlan {
+      subject: p.subject,
+      endpoint: p.endpoint,
+      firmware: p.firmware,
+      goal: p.goal,
+      diverged: observation_with_controller_clock(base: p.diverged, controller_clock: controller_clock),
+      due: p.due,
+      managed_write: p.managed_write,
+      published_write: p.published_write,
+      channel_writes: p.channel_writes,
+      planned_at: p.planned_at,
+    },
+    managed_write_completed: application.managed_write_completed,
+    published_write_completed: application.published_write_completed,
+    channel_writes_completed: application.channel_writes_completed,
+    request_receipt: application.request_receipt,
+    response_receipt: application.response_receipt,
+    applied_at: application.applied_at,
+  }
+}
+
 type BmcSecurePhaseDecision
   = BmcSecurePhaseNoop { observation: BmcAccountStateObservation }
   | BmcSecurePhaseApplied { plan: BmcAccountActionPlan, application: BmcAccountApplication, post_read: BmcAccountStateObservation }
@@ -2189,6 +2275,8 @@ fn dry_bmc_account_instant(millis: EpochMs) -> ObserverClockInstant
   admit_callers: [
     decl_ref(module_path: "gunbc.machine_intake_bmc_secure", decl_name: "dry_read_bmc_account_state"),
     decl_ref(module_path: "gunbc.machine_intake_bmc_secure", decl_name: "dry_apply_bmc_account_plan"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "mtjade1_fetched_generation"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "mtjade1_dry_applied_bmc"),
   ]
 {
   observer_clock_modeled(millis: millis, realization: bmc_secure_dry_realization_name)
@@ -2260,6 +2348,11 @@ fn dry_read_bmc_account_state(
 ) -> BmcAccountStateObservation
   admit_callers: [
     decl_ref(module_path: "test.claim.machine_intake_bmc_secure_state_witness", decl_name: "read_in"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_mtjade1_converges_through_bmc_secure_noop_on_the_real_prefix"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_mtjade1_bmc_secure_apply_inputs_missing_refuses_on_the_real_path"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "mtjade1_dry_applied_bmc"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_for_a_later_break_glass_generation_is_refused"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_another_channel_state_is_refused"),
   ]
 {
   let at = dry_bmc_account_instant(millis: read_at_millis)
@@ -2323,6 +2416,7 @@ fn dry_apply_bmc_account_plan(
     decl_ref(module_path: "test.claim.machine_intake_bmc_secure_state_witness", decl_name: "applied_with"),
     decl_ref(module_path: "test.claim.machine_intake_bmc_secure_state_witness", decl_name: "the_post_read_is_independent_of_the_reading_that_diverged"),
     decl_ref(module_path: "test.claim.machine_intake_bmc_secure_state_witness", decl_name: "a_planned_channel_close_is_applied_read_back_and_converges"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "mtjade1_dry_applied_bmc"),
   ]
 {
   let managed_step = match dry_fetch_resolves(fetch: managed_fetch, write: plan.managed_write) {
diff --git a/dag/gunbc/machine_intake/dimm_physical_orientation.dag b/dag/gunbc/machine_intake/dimm_physical_orientation.dag
index 3c9d417fa70..690662823b7 100644
--- a/dag/gunbc/machine_intake/dimm_physical_orientation.dag
+++ b/dag/gunbc/machine_intake/dimm_physical_orientation.dag
@@ -1,12 +1,13 @@
 module gunbc.machine_intake_dimm_physical_orientation
 
+import extdeps.board_authority { BoardAuthorityRef, BoardAuthorityLookup }
+import gunbc.board_authority_binding { observed_board_authority }
 import v2.std.algebra { filter }
 import std.types { String, List, list_length }
 import std.nat { Nat }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import std.roster_frontier { FrontierRow, DeclSubject }
 import std.dissolution { UnboundDissolution }
-import extdeps.boards.types { BaseboardModel }
 import product.host_identity { HostIdentity }
 import extdeps.ampere.mt_collins_product_brief.memory_population { MtCollinsDimmPopulationRow }
 import gunbc.mt_collins_dimm_physical_identity {
@@ -48,17 +49,17 @@ import gunbc.machine_intake_dimm_row_orientation {
 // handed one host's name beside another board's figure.
 type DimmOrientedHost sole_constructor {
   host: HostIdentity
-  board: BaseboardModel
+  board: BoardAuthorityRef
   figure: BaseboardDimmFigure
   outcome: DimmOrientationOutcome
 }
 
 type HostDimmOrientation
   = HostDimmOriented { oriented: DimmOrientedHost }
-  | HostDimmBoardUnmodeled { host: HostIdentity, board: BaseboardModel }
+  | HostDimmBoardUnmodeled { host: HostIdentity, board: BoardAuthorityLookup }
 
 fn host_dimm_orientation(binding: ManagedHostBinding, anchors: List<DimmPlacementAnchor>) -> HostDimmOrientation {
-  match baseboard_dimm_figure(board: binding.observation.identity.baseboard) {
+  match baseboard_dimm_figure(board: observed_board_authority(observation: binding.observation.identity.board)) {
     BoardFigureUnmodeled { board: b } => HostDimmBoardUnmodeled { host: binding.host.host, board: b }
     BaseboardDimmFigureOf { board: b, figure: f } => HostDimmOriented { oriented: DimmOrientedHost {
       host: binding.host.host,
diff --git a/dag/gunbc/machine_intake/megarac_kvm_still.dag b/dag/gunbc/machine_intake/megarac_kvm_still.dag
index ee6a5829efd..f367c406d57 100644
--- a/dag/gunbc/machine_intake/megarac_kvm_still.dag
+++ b/dag/gunbc/machine_intake/megarac_kvm_still.dag
@@ -1,24 +1,13 @@
 module gunbc.machine_intake_megarac_kvm_still
 
-import std.types { Bool, FilePath, Int, List, NonEmptyStr, Unit }
+import std.types { Bool, Int, List, NonEmptyStr, Unit }
 import std.algebra { trim }
 import std.measure { Second, second, second_count, Millisecond, millisecond, millisecond_count, second_to_millisecond }
 import std.checked_arithmetic { checked_int_to_nat }
-import std.decl_ref { DeclarationRef, WholeDeclaration, decl_ref }
-import std.disposition { Disposition, Scaffold, SingleAuthority }
-import std.dissolution { DissolutionCondition, unbound_dissolution }
 import extdeps.tools.sha256sum { Sha256FileDigest, Sha256FileDigestUnavailable, sha256sum_file_digest_via_shell }
 import extdeps.crypto.hash { Digest }
-import extdeps.exec.command { argv_words }
 import gunbc.runner_browser_toolchain {
-  RunnerBrowserToolchainResolution, BrowserToolchainReady, BrowserToolchainNotReady, BrowserToolchainUnresolved,
-  RunnerBrowserToolchainLocation, runner_browser_toolchain_node_command, runner_browser_toolchain_standing_text,
-}
-import gunbc.machine_intake_megarac_ui_features { megarac_ui_features }
-import extdeps.bmc.megarac {
-  megarac_ui_features_json,
-  ScreenCaptureFactKnown, ScreenCaptureFirmwareUncatalogued,
-  ScreenCaptureClientSideOnly, KvmClientCanvasJpeg, megarac_screen_capture_standing,
+  RunnerBrowserToolchainResolution,
 }
 import gunbc.megarac_managed_host { AdmittedMegaRacHost }
 import gunbc.megarac_operation_standing { MegaRacKvmCanvasStill, MegaRacVirtualMediaAttach, MegaRacSdrSocketNaming }
@@ -26,112 +15,25 @@ import gunbc.clock_read { clock_now_probed_at_or_unknown }
 import gunbc.owned_process { OwnedRelease, OwnedProcessStanding, OwnedRunning, owned_process_release, owned_release_text, owned_process_standing, owned_process_standing_text }
 import std.optional { Present, Absent }
 import v2.std.algebra { filter }
-import extdeps.shell
 import extdeps.filesystem.filesystem_io { Filesystem }
 import extdeps.tools.sleep { sleep_delay_seconds_second_carrier_projection }
 
-// THE BMC KVM SCREEN AS BOOT EVIDENCE (operator ruling 2026-09-27; route A, eager-owl-205 the same
-// day). On run 36335369059 the SOL collector died about 12 s into Linux and the watch went blind,
-// while the KVM screen showed casper's "Unable to find a medium containing a live file system"
-// prompt. The screen was the only witness, so this module RETAINS it: JPEG stills from one held viewer,
-// bound to the attempt, the phase that asked for it, its instants and an independently taken
-// sha256. It does not READ the image: turning a still into text or a diagnosis is the frontier
-// named at the bottom of this file.
+// THE BMC KVM SCREEN AS BOOT EVIDENCE (operator ruling 2026-09-27). On run 36335369059 the SOL
+// collector died about 12 s into Linux and the watch went blind, while the KVM screen showed casper's
+// "Unable to find a medium containing a live file system" prompt. This module retains a screen still
+// as boot evidence: a still bound to the attempt, the phase that asked for it, its instants and an
+// independently taken sha256. A CAPTURE IS AN OBSERVATION, NEVER A GATE: every arm is a value the boot
+// records beside its own verdict, and nothing here can change an attempt's outcome.
 //
-// WHY A BROWSER. extdeps.bmc.megarac megarac_screen_capture_standing records that firmware 0.32
-// serves no on-demand still: the UI's "Capture Screen" is the H5 viewer painting the AST2100 stream
-// from wss://<bmc>/kvm onto canvas#kvm and calling toDataURL("image/jpeg"). A still therefore exists
-// only where a KVM client runs, and this module runs the vendor's own client headless and takes the
-// same toDataURL the button takes -- never a decoder of our own for a proprietary stream.
+// THE OBSERVER IS NOT STARTED IN PUBLIC. The only client it ever drove was the controller vendor's own
+// served viewer, which is not public; megarac_kvm_observer_start therefore answers NotStarted with a
+// typed reason, and the capability that restores it is the declared rung drop
+// handoff_observer_is_sol_not_kvm_viewer. The journal vocabulary, parsers, standing and receipt
+// readers below read the committed journal of an observer run that did execute (the receipt cited by
+// gunbc.megarac_operation_evidence), so what was observed stays readable.
 //
-// A CAPTURE IS AN OBSERVATION, NEVER A GATE. Every arm below, including a refusal, is a value the
-// boot records beside its own verdict; nothing here can change an attempt's outcome, and the boot
-// run binds no decision to a still.
-
 // THE CONTROLLER IS AN ADMITTED MEGARAC HOST (gunbc.megarac_managed_host AdmittedMegaRacHost, operation
-// MegaRacKvmCanvasStill): its endpoint, account and firmware come off one managed host's binding, and
-// the admission refuses a controller that is not MegaRAC, is unobserved, or reports a build the
-// screen-capture route and the viewer feature list were never read on. The firmware the capture is
-// keyed to is that observed firmware, never a unit constant.
-
-// THE TOOLCHAIN IS RESOLVED, NEVER ASSUMED. gunbc.runner_browser_toolchain places the pinned node,
-// Playwright and Chromium on the fleet runners through its own converge, and hands a consumer a
-// location only over a standing that read back ready. The observer is launched through
-// runner_browser_toolchain_node_command -- the pinned node and PLAYWRIGHT_BROWSERS_PATH from that
-// location, run in the observer's own directory -- and never through a node on PATH. Playwright is
-// required by the location's absolute playwright_module path, so no workspace node_modules can shadow it. A runner the converge has not placed
-// answers NotReady or Unresolved, which the observer records as NotStarted with that text; the boot
-// does not read it.
-
-// DRIVING THE VENDOR'S VIEWER IS REALIZATION, NOT THE MEGARAC INTERFACE. The steps are the UI's own,
-// recovered from the served bundles cited on extdeps.bmc.megarac MegaRacScreenCaptureRoute: POST
-// /api/session and the sessionStorage keys its login handler sets; GET /api/settings/services and
-// the `kvm` row's viewer_count, which the UI's own launch() requires to be 0 before it opens
-// viewer.html (else "only one KVM session is allowed"); then viewer.html, and captureScreen()'s
-// canvas#kvm.toDataURL("image/jpeg").
-//
-// ONLY THE VIEWER IS A DOCUMENT (fleet-converge run 36721915217, 2026-09-30). The session POST, the
-// services read and the session DELETE are HTTP exchanges that need a cookie jar, not a page, so they
-// go through the browser context's own request client (it shares the jar the viewer's /kvm WebSocket
-// uses); the sessionStorage keys are seeded by a context init script, which runs in every document of
-// the controller's origin before that document's own scripts. The observer therefore never loads the
-// UI's root page. It used to: it loaded "/" to borrow an origin and ran the login inside it, and on
-// that run the journal read "page.evaluate: Execution context was destroyed, most likely because of a
-// navigation" with session-release login-unobserved -- the root document was replaced under the login.
-// That the vendor SPA reloads itself to #login is read from its bundle (see the navigation note below);
-// the repair does not depend on it, because no step now runs in a document the observer did not
-// navigate to itself. The only in-page evaluations left are on viewer.html: the
-// canvas wait and the toDataURL.
-//
-// ONE OBSERVER, HELD FOR THE WHOLE BOOT (side-chat acceptance (a), 2026-09-28). The observer is a
-// background process, started under the unit hold after the SOL acquire and BEFORE the handoff, that
-// logs in once, takes the seat once, opens the viewer once and keeps it. It writes a journal: one
-// line per event, each carrying the epoch-millisecond and ISO instant it was written --
-// established (bound to host, BMC web session id and attempt), connection-open, connection-lost,
-// still, acquisition-failed, refused, stop-requested, stopped. Stills are taken on a cadence (bounded
-// by count) and IMMEDIATELY on a trigger file the boot drops (power on verified, SOL channel lost,
-// terminal verdict).
-//
-// THE BOUNDARY IS OBSERVED, NEVER INFERRED FROM PIXELS (acceptance (b)). Connection is the viewer's
-// own /kvm WebSocket as the browser reports it: open, then close or error. After a close no still is
-// claimed; each asked-for still is journalled as acquisition-failed cause=not-connected. A canvas
-// that exists but cannot be read (toDataURL throws) is acquisition-failed cause=canvas-unreadable. An
-// unchanged picture is never read as a stale one: the observer does not compare pixels at all.
-//
-// EVERY MAIN-FRAME NAVIGATION IS JOURNALLED (operator, 2026-09-30: the navigation is MODELED, not
-// avoided). What the SPA does is now read from its own bundle, not inferred: the UI fetched by
-// fleet-converge run 36778446928 (gunbc.machine_intake_mtcollins1_ui_bundle_observe, firmware 0.32,
-// digest matching the 2026-09-27 read) routes by Backbone hash routing, and on session expiry, on an
-// unauthorized answer and on its logout paths sets location.href "#login" and then calls
-// location.reload() -- a FULL document reload, which is what destroys an evaluate in flight. The only
-// document the observer loads is viewer.html; every commit of its main frame is a `navigated` line (seq,
-// the observer's phase -- viewer while it opens the viewer, held after establishment -- and the URL the
-// frame committed to), so a reload to #login under the held viewer is on the journal with the instant it
-// happened, before the connection-lost or failed line it causes. A navigation is recorded, never retried
-// into a different answer. The viewer's own console errors and warnings, and any uncaught page error,
-// are journalled too (page-console / page-error, with the phase): fleet-converge run 36779479938 loaded
-// viewer.html and never requested /kvm, and what the viewer said about why is the first thing to read.
-//
-// THE SEAT. A held seat (viewer_count > 0) refuses with its count -- an operator's session is never
-// evicted -- and every exit the process reaches (stop file, SIGTERM, refusal, failure) DELETEs its web
-// session and closes the browser, journalling stopped session=<released|http-N|release-failed>. The
-// one exit it cannot reach is SIGKILL: the boot then records that no stopped line was written, so the
-// release was NOT observed, and the BMC's own session timeout frees the seat.
-//
-// It is JavaScript handed to node as a string because process-hold of a browser is not a Node in the
-// grammar -- the same standing as gunbc.machine_intake_sol_hold's bash hold, marked the same way.
-// ADMISSION OF THIS SCAFFOLD (DESIGN §5, external to this diff): operator escalation msg_d5eebfff,
-// default-approved on recommendation A, 2026-09-28 -- not an explicit operator ruling.
-data megarac_kvm_observer_script_scaffold: Disposition = Scaffold {
-  dissolves_to: SingleAuthority,
-  bind: DeclarationRef {
-    module_path: "gunbc.machine_intake_megarac_kvm_still",
-    decl_name: "megarac_kvm_observer_script_dissolution_trigger",
-    field: WholeDeclaration
-  }
-}
-
-data megarac_kvm_observer_script_dissolution_trigger: DissolutionCondition = unbound_dissolution(description: "🟡 dissolve-on: gunbc.machine_intake.kvm_observer LaunchObserver -- the held MegaRAC H5 viewer is a node -e script string launched as a bash background hold. RETIRED BY THE CAPABILITY: a .dag browser-automation realization SUFFICIENT TO DRIVE THE MegaRAC H5 VIEWER AND READ ITS CANVAS -- navigate and evaluate in page, observe the /kvm WebSocket open and close, read canvas#kvm as image/jpeg on cadence and on trigger, and release the web session on every reachable exit -- held by a typed process-hold realization. An artifact that covers only part of that (navigation without WebSocket lifecycle, or a canvas read without the guaranteed release) does not retire it. Admission: operator escalation msg_d5eebfff, default-approved on recommendation A, 2026-09-28")
+// MegaRacKvmCanvasStill).
 
 // THE OBSERVER'S JOURNAL VOCABULARY IS DECLARED HERE ONCE. The observer script receives it as the
 // EV (event) and CA (cause) constants megarac_kvm_observer_vocabulary_js renders from these rows,
@@ -237,22 +139,6 @@ fn kvm_key(keys: List<String>, i: Int) -> String {
   match keys.skip(n: i).first() { Present { value: k } => k  Absent => "" }
 }
 
-fn kvm_journal_words_js(name: String, words: List<KvmJournalWord>) -> String {
-  concat(concat(concat("const ", name), "=\{"), concat(join(map(words, w => concat(concat(w.id, ":'"), concat(w.word, "'"))), ","), "};"))
-}
-
-fn megarac_kvm_observer_vocabulary_js() -> String {
-  concat(concat(kvm_journal_words_js(name: "EV", words: kvm_journal_event_words), kvm_journal_words_js(name: "CA", words: kvm_journal_cause_words)), kvm_journal_words_js(name: "RS", words: kvm_journal_result_words))
-}
-
-data megarac_kvm_observer_script_body: String = "const fs=require('fs');const path=require('path');const [base,user,pwFile,dir,attempt,cadenceMs,frameMs,maxPeriodic,pwModule,featuresFile]=process.argv.slice(1);const J=path.join(dir,'journal');function j(ev,kv)\{const t=Date.now();try\{fs.appendFileSync(J,t+' '+new Date(t).toISOString()+' '+ev+(kv?' '+kv:'')+'\\n')}catch(e)\{try\{process.stderr.write('journal write failed: '+ev+' '+String(e&&e.message)+'\\n')}catch(e2)\{}}}function one(e)\{return String(e&&e.message||e).replace(/[^ -~]+/g,' ').replace(/ +/g,' ').slice(0,300)}let browser=null,page=null,api=null,stopping=false,login='not-attempted',token=null,seq=0,periodic=0;let gen=0,live=null;let nav=0,phase='launch';async function teardown(why,code)\{if(stopping)return;stopping=true; j(EV.stopRequested,'by='+why); let rel; if(login==='accepted'&&api&&token)\{try\{const r=await api.delete(base+'/api/session',\{headers:\{'X-CSRFTOKEN':token}});rel=r.ok()?RS.released:RS.httpPrefix+r.status()}catch(e)\{rel=RS.releaseFailed+' detail='+JSON.stringify(one(e))}} else if(login==='unobserved')\{rel=RS.loginUnobserved} else\{rel=RS.noSession} j(EV.sessionRelease,'result='+rel); let closed=RS.closed;try\{if(browser)await browser.close();else closed=RS.noBrowser}catch(e)\{closed=RS.closeFailed+' detail='+JSON.stringify(one(e))} j(EV.browserClose,'result='+closed); j(EV.stopped,'session='+rel.split(' ')[0]+' browser='+closed.split(' ')[0]); process.exit(code)}process.on('SIGTERM',()=>teardown('sigterm',0));process.on('SIGINT',()=>teardown('sigint',0));async function still(reason)\{seq+=1;const n=seq;const g=gen;const startedMs=Date.now(); if(!live||live.gen!==g)\{j(EV.acquisitionFailed,'seq='+n+' reason='+reason+' gen='+g+' cause='+CA.notConnected+'');return} try\{const url=await page.evaluate(()=>\{const c=document.getElementById('kvm');if(!c)throw new Error('no canvas#kvm');return c.toDataURL('image/jpeg')});  if(!live||live.gen!==g)\{j(EV.acquisitionFailed,'seq='+n+' reason='+reason+' gen='+g+' started_ms='+startedMs+' cause='+CA.connectionChangedDuringAcquisition+'');return}  if(!url.startsWith('data:image/jpeg;base64,'))throw new Error('toDataURL answered '+url.slice(0,40));  const b=Buffer.from(url.slice(url.indexOf(',')+1),'base64');const f='still-'+n+'.jpg';fs.writeFileSync(path.join(dir,f),b);  j(EV.still,'seq='+n+' reason='+reason+' gen='+g+' started_ms='+startedMs+' file='+f+' bytes='+b.length)} catch(e)\{j(EV.acquisitionFailed,'seq='+n+' reason='+reason+' gen='+g+' started_ms='+startedMs+' cause='+CA.canvasUnreadable+' detail='+JSON.stringify(one(e)))}}(async()=>\{ let pw;try\{pw=fs.readFileSync(pwFile,'utf8')}catch(e)\{j(EV.refused,'cause='+CA.credentialUnreadable+' detail='+JSON.stringify(one(e)));return teardown('refused',14)} let chromium;try\{chromium=require(pwModule).chromium}catch(e)\{j(EV.refused,'cause='+CA.toolchain+' detail='+JSON.stringify(one(e)));return teardown('refused',13)} try\{browser=await chromium.launch(\{headless:true})}catch(e)\{j(EV.refused,'cause='+CA.toolchain+' detail='+JSON.stringify(one(e)));return teardown('refused',13)} try\{const ctx=await browser.newContext(\{ignoreHTTPSErrors:true,viewport:\{width:1280,height:1024}});api=ctx.request;page=await ctx.newPage();  page.on('framenavigated',f=>\{if(f===page.mainFrame())\{nav+=1;j(EV.navigated,'seq='+nav+' phase='+phase+' url='+JSON.stringify(f.url()))}});  page.on('console',m=>\{const l=m.type();if(l==='error'||l==='warning')j(EV.pageConsole,'phase='+phase+' level='+l+' detail='+JSON.stringify(one(m.text())))});  page.on('pageerror',e=>\{j(EV.pageError,'phase='+phase+' detail='+JSON.stringify(one(e)))});  const expectedHost=new URL(base).host;  login='unobserved';  const lr=await api.post(base+'/api/session',\{form:\{username:user,password:pw}});let lb=null;try\{lb=await lr.json()}catch(e)\{}const reply=\{status:lr.status(),b:lb};  if(reply.status!==200||!reply.b||reply.b.ok!==0)\{login='refused';j(EV.refused,'cause='+CA.login+' http='+reply.status);return teardown('refused',11)}  login='accepted';token=reply.b.CSRFToken;  let feats='';if(featuresFile)\{try\{feats=fs.readFileSync(featuresFile,'utf8')}catch(e)\{j(EV.refused,'cause='+CA.featuresUnreadable+' detail='+JSON.stringify(one(e)));return teardown('refused',14)}} await ctx.addInitScript(([h,b,u,f])=>\{if(location.host!==h)return;if(f)sessionStorage.setItem('features',f);sessionStorage.setItem('garc',b.CSRFToken);sessionStorage.setItem('privilege_id',String(b.privilege));sessionStorage.setItem('extended_privilege',String(b.extendedpriv));sessionStorage.setItem('session_id',String(b.racsession_id));sessionStorage.setItem('username',u);sessionStorage.setItem('kvm_access','1');sessionStorage.setItem('vmedia_access','1')},[expectedHost,reply.b,user,feats]);  const sa=await(await api.get(base+'/api/settings/services',\{headers:\{'X-CSRFTOKEN':token}})).json();const kr=Array.isArray(sa)?sa.find(s=>s.service_name==='kvm'):null;const seat=kr?kr.viewer_count:null;  if(seat===null||seat===undefined)\{j(EV.refused,'cause='+CA.noKvmService+'');return teardown('refused',15)}  if(seat!==0)\{j(EV.refused,'cause='+CA.seatBusy+' viewer_count='+seat);return teardown('refused',10)}  page.on('websocket',ws=>\{let u;try\{u=new URL(ws.url())}catch(e)\{return}   if(u.host!==expectedHost||u.pathname!=='/kvm')return;   j(EV.connectionRequested,'url='+JSON.stringify(ws.url()));let mine=null;   ws.on('framereceived',()=>\{if(!mine)\{gen+=1;mine=\{gen:gen};live=mine;j(EV.connectionOpen,'gen='+mine.gen+' url='+JSON.stringify(ws.url()))}});   ws.on('socketerror',e=>\{j(EV.connectionError,'gen='+(mine?mine.gen:0)+' detail='+JSON.stringify(one(e)));if(mine&&live===mine)live=null});   ws.on('close',()=>\{if(mine&&live===mine)\{live=null;j(EV.connectionLost,'gen='+mine.gen)}else if(!mine)\{j(EV.connectionRefused,'url='+JSON.stringify(ws.url()))}})});  phase='viewer';await page.goto(base+'/viewer.html',\{waitUntil:'domcontentloaded'});  try\{await page.waitForFunction(()=>\{const c=document.getElementById('kvm');return !!c&&c.width>1&&c.height>1},null,\{timeout:Number(frameMs)})}  catch(e)\{j(EV.refused,'cause='+CA.noFrame+' detail='+JSON.stringify(one(e)));return teardown('refused',12)}  const deadline=Date.now()+Number(frameMs);while(!live&&Date.now()<deadline)\{await new Promise(r=>setTimeout(r,100))}  if(!live)\{j(EV.refused,'cause='+CA.noKvmFrame+'');return teardown('refused',12)}  j(EV.established,'host='+JSON.stringify(expectedHost)+' session='+String(reply.b.racsession_id)+' attempt='+attempt+' gen='+live.gen);  phase='held';let next=Date.now()+Number(cadenceMs);  while(!stopping)\{   if(fs.existsSync(path.join(dir,'stop')))\{return teardown('stop-file',0)}   let tf=[];try\{tf=fs.readdirSync(dir).filter(n=>n.startsWith('trigger-')).sort()}catch(e)\{j(EV.triggerScanFailed,'detail='+JSON.stringify(one(e)))}   for(const n of tf)\{const p=path.join(dir,n);try\{fs.unlinkSync(p)}catch(e)\{continue}await still('trigger:'+n.slice(8))}   if(Date.now()>=next&&periodic<Number(maxPeriodic))\{next=Date.now()+Number(cadenceMs);periodic+=1;await still('periodic')}   await new Promise(r=>setTimeout(r,250))} }catch(e)\{j(EV.failed,'detail='+JSON.stringify(one(e)));return teardown('failed',1)}})();"
-
-data megarac_kvm_observer_script: String = concat(megarac_kvm_observer_vocabulary_js(), megarac_kvm_observer_script_body)
-
-// THE LAUNCH is gunbc.owned_process's: the toolchain's node command in the background, its output in
-// observer.log beside the journal, its holder recorded as "<pid> <starttime>" in observer.pid, and its
-// release OBSERVED after the signal rather than assumed.
-
 // THE BOUNDS. A periodic still every cadence, at most periodic_limit of them; the boot waits at most
 // establish_wait for the observer to say established or refused, at most trigger_wait for a
 // triggered still to be journalled, and at most stop_wait for the stopped line before the release.
@@ -855,9 +741,12 @@ fn kvm_await_standing(dir: String, subject: KvmObserverSubject, remaining: Int)
   }
 }
 
-// START, BEFORE THE HANDOFF. The carrier must have been admitted for this operation: a MegaRAC host
-// admitted for virtual media is not thereby admitted for the viewer. The observer's directory is the
-// caller's -- it is where the caller retains the journal and stills -- and is passed in.
+// START, BEFORE THE HANDOFF. The carrier must have been admitted for this operation. No public
+// KVM client exists: the only client this module ever drove was the controller vendor's own served
+// viewer, whose source is not public, so the observer is not started here and every start is a typed
+// NotStarted that the boot records beside its verdict. The journal, standing and receipt readers
+// below still read the committed journal of an observer that did run (the executed receipt).
+// Capability that restores it: gunbc.rung_drop handoff_observer_is_sol_not_kvm_viewer.
 fn megarac_kvm_observer_start(
   host: AdmittedMegaRacHost,
   dir: String,
@@ -866,104 +755,10 @@ fn megarac_kvm_observer_start(
   attempt: String,
 ) -> KvmObserverStart {
   match host.operation {
-    MegaRacKvmCanvasStill => {}
-    MegaRacVirtualMediaAttach => return KvmObserverNotStarted { reason: "the MegaRAC host was admitted for another operation, not the KVM canvas still; no viewer was driven" }
-    MegaRacSdrSocketNaming => return KvmObserverNotStarted { reason: "the MegaRAC host was admitted for another operation, not the KVM canvas still; no viewer was driven" }
-  }
-  let firmware = host.firmware
-  let bmc_host = host.binding.observation.endpoint.host
-  match megarac_screen_capture_standing(firmware: firmware, route: KvmClientCanvasJpeg) {
-    ScreenCaptureFirmwareUncatalogued { firmware: _ } => KvmObserverNotStarted { reason: "the BMC firmware is not catalogued for screen capture; no viewer was driven" }
-    ScreenCaptureFactKnown { firmware: _, standing: s } =>
-      match s {
-        ScreenCaptureClientSideOnly =>
-          if password_file == "" { KvmObserverNotStarted { reason: "no BMC credential path is bound, so no viewer login was attempted" } }
-          else if attempt == "" { KvmObserverNotStarted { reason: "no attempt identity is bound, so the observer could not be named for it" } }
-          else if dir == "" { KvmObserverNotStarted { reason: "no observer directory is bound, so the journal would have nowhere to be retained" } }
-          else {
-            match toolchain {
-              BrowserToolchainReady { location: loc, standing: _ } =>
-                match megarac_ui_features(firmware: firmware) {
-                  Absent => KvmObserverNotStarted { reason: "no viewer feature list is observed for this firmware (gunbc.machine_intake_megarac_ui_features megarac_ui_features), and the viewer's KVM view reads it unguarded; no viewer was driven" }
-                  Present { value: names } => kvm_observer_launch(dir: dir, base_url: concat("https://", bmc_host as String), host: bmc_host as String, username: host.binding.account, password_file: password_file, toolchain: loc, attempt: attempt, features_json: megarac_ui_features_json(names: names))
-                }
-              BrowserToolchainNotReady { standing: st } => KvmObserverNotStarted { reason: concat("the runner browser toolchain is not ready: ", runner_browser_toolchain_standing_text(s: st)) as NonEmptyStr }
-              BrowserToolchainUnresolved { cause: c } => KvmObserverNotStarted { reason: concat("the runner browser toolchain is unresolved: ", c) as NonEmptyStr }
-            }
-          }
-        _ => KvmObserverNotStarted { reason: "the catalogued viewer route is not client-side; nothing was driven" }
-      }
-  }
-}
-
-// THE LAUNCH OVER A BASE URL. The boot passes https://<bmc>; the protocol controls pass a local
-// transport. `host` is the host:port the established line must name.
-fn kvm_observer_launch(dir: String, base_url: String, host: String, username: NonEmptyStr, password_file: String, toolchain: RunnerBrowserToolchainLocation, attempt: String, features_json: String) -> KvmObserverStart
-  admit_callers: [
-    decl_ref(module_path: "gunbc.machine_intake_megarac_kvm_still", decl_name: "megarac_kvm_observer_start"),
-  ]
-{
-  let made = shell.Mkdir.Parents(path: dir as FilePath)
-  if !made.success {
-    return KvmObserverNotStarted { reason: concat("the observer directory could not be made: ", dir) as NonEmptyStr }
-  }
-  kvm_observer_launch_in(dir_given: dir, base_url: base_url, host: host, username: username, password_file: password_file, toolchain: toolchain, attempt: attempt, features_json: features_json)
-}
-
-// ONE ABSOLUTE LOCATION (hold on gunbc#12492): the directory is canonicalised once, here, and that
-// absolute path is the launch's working directory, the observer's own `dir` operand, and what the boot
-// reads the journal, stills and triggers from and writes the stop request to. A relative directory
-// passed as both working directory and operand would be resolved twice -- <dir>/<dir>/journal -- and the
-// boot and the observer would address different files.
-fn kvm_observer_launch_in(dir_given: String, base_url: String, host: String, username: NonEmptyStr, password_file: String, toolchain: RunnerBrowserToolchainLocation, attempt: String, features_json: String) -> KvmObserverStart
-  admit_callers: [
-    decl_ref(module_path: "gunbc.machine_intake_megarac_kvm_still", decl_name: "kvm_observer_launch"),
-    decl_ref(module_path: "gunbc.machine_intake_megarac_kvm_still", decl_name: "kvm_observer_protocol_launch"),
-  ]
-{
-  let resolved = shell.Path.Canonical(path: dir_given as FilePath)
-  if !resolved.success {
-    return KvmObserverNotStarted { reason: concat("the observer directory could not be resolved: ", concat(dir_given, concat(": ", trim(s: resolved.stderr)))) as NonEmptyStr }
-  }
-  let dir = trim(s: resolved.stdout)
-  let features_path = concat(dir, "/features.json")
-  if features_json != "" && !Filesystem.Write(path: features_path, content: features_json).success {
-    return KvmObserverNotStarted { reason: concat("the viewer feature list could not be written: ", features_path) as NonEmptyStr }
-  }
-  let node = runner_browser_toolchain_node_command(
-    location: toolchain,
-    directory: dir,
-    script: megarac_kvm_observer_script,
-    operands: [
-      base_url, username as String, password_file, dir, attempt,
-      to_string(millisecond_count(m: second_to_millisecond(s: megarac_kvm_observer_cadence)) as Int),
-      to_string(millisecond_count(m: second_to_millisecond(s: megarac_kvm_observer_frame_wait)) as Int),
-      to_string(megarac_kvm_observer_periodic_limit),
-      toolchain.playwright_module as String,
-      if features_json == "" { "" } else { features_path },
-    ],
-  )
-  let launched = gunbc.owned_process.launch.LaunchOwned(pid_path: concat(dir, "/observer.pid") as NonEmptyStr, log_path: concat(dir, "/observer.log") as NonEmptyStr, command: argv_words(command: node))
-  if !launched.success {
-    return KvmObserverNotStarted { reason: concat("the observer launch failed: ", trim(s: launched.transport_stderr)) as NonEmptyStr }
+    MegaRacKvmCanvasStill => KvmObserverNotStarted { reason: "no public KVM client is available to drive; no viewer was driven" }
+    MegaRacVirtualMediaAttach => KvmObserverNotStarted { reason: "the MegaRAC host was admitted for another operation, not the KVM canvas still; no viewer was driven" }
+    MegaRacSdrSocketNaming => KvmObserverNotStarted { reason: "the MegaRAC host was admitted for another operation, not the KVM canvas still; no viewer was driven" }
   }
-  let subject = KvmObserverSubject { host: host, attempt: attempt }
-  let standing = kvm_await_standing(dir: dir, subject: subject, remaining: kvm_polls_within(wait: megarac_kvm_observer_establish_wait))
-  KvmObserverStarted { dir: dir as NonEmptyStr, subject: subject, standing: standing, checked_at: clock_now_probed_at_or_unknown() }
-}
-
-// THE PROTOCOL TESTS' LAUNCH, AND ONLY THEIRS. The production launch takes its endpoint and account
-// from an admitted MegaRAC carrier (megarac_kvm_observer_start) and is sealed to it; the protocol
-// witnesses drive the same observer against a local transport they stand up themselves, which has no
-// managed host behind it. This facade is the one door for that, admitted to those witness functions by
-// name, so no production caller reaches the launcher with a raw host and account.
-fn kvm_observer_protocol_launch(dir_given: String, base_url: String, host: String, username: NonEmptyStr, password_file: String, toolchain: RunnerBrowserToolchainLocation, attempt: String, features_json: String) -> KvmObserverStart
-  admit_callers: [
-    decl_ref(module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", decl_name: "rig_with"),
-    decl_ref(module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", decl_name: "a_relative_observer_directory_is_resolved_once"),
-  ]
-{
-  kvm_observer_launch_in(dir_given: dir_given, base_url: base_url, host: host, username: username, password_file: password_file, toolchain: toolchain, attempt: attempt, features_json: features_json)
 }
 
 // A TRIGGER: one file the observer consumes and answers with one still or one acquisition failure,
diff --git a/dag/gunbc/machine_intake/megarac_media_attach.dag b/dag/gunbc/machine_intake/megarac_media_attach.dag
index 517dbb216ba..0cce493fce5 100644
--- a/dag/gunbc/machine_intake/megarac_media_attach.dag
+++ b/dag/gunbc/machine_intake/megarac_media_attach.dag
@@ -4,9 +4,9 @@ import std.decl_ref { decl_ref }
 import std.types { Bool, EpochMs, Int, List, Milliseconds, NonEmptyStr, String }
 import std.content_hash { content_hash_of_value }
 import std.measure { Second, second, second_count }
-import extdeps.bmc.capability { BmcFirmwareReleaseIdentity }
+import extdeps.bmc.capability { BmcFirmwareReleaseIdentity, bmc_firmware_release_identity_eq }
 import extdeps.bmc.megarac
-import gunbc.machine_intake_megarac_ui_features { MegaRacRmediaStatus, RmediaStatusNamed, RmediaStatusOutsideTable, RmediaStatusTableUnread, megarac_rmedia_status_of_wire }
+import extdeps.bmc.megarac { megarac_firmware_0_32 }
 import extdeps.clock { ClockUnixMillisObserved, ClockUnixMillisRefused, clock_unix_millis_read }
 import extdeps.provisioning.ubuntu_seeded_install_media { ubuntu_seeded_install_media_name_digest_prefix }
 import extdeps.tools.sleep { sleep_delay_seconds_second_carrier_projection }
@@ -129,7 +129,6 @@ type MegaRacAttachOutcome
   | MegaRacMediaStateUnestablished { image_name: NonEmptyStr, route: MegaRacAttachRoute, look: ReadinessLook, looks: Int, cd_before_any_write: CdErrorReading, cd_at_ready: CdErrorReading, general_at_ready: MegaRacRawRead }
   | MegaRacMediaStateUnestablishedBeforeWrite { cd_before_any_write: CdErrorReading, reason: NonEmptyStr }
   | MegaRacReadinessRefused { image_name: NonEmptyStr, route: MegaRacAttachRoute, look: ReadinessLook, looks: Int, cd_before_any_write: CdErrorReading, cd_at_refusal: CdErrorReading }
-  | MegaRacPresentationStopped { image_name: NonEmptyStr, route: MegaRacAttachRoute, look: ReadinessLook, looks: Int, cd_before_any_write: CdErrorReading, stop: MegaRacRmediaStatus, class: MegaRacStopReasonClass, general_at_refusal: MegaRacRawRead }
   | MegaRacReadinessClockUnreadable { image_name: NonEmptyStr, route: MegaRacAttachRoute, detail: String }
   | MegaRacReadinessClockIncoherent { image_name: NonEmptyStr, route: MegaRacAttachRoute, opened_at: EpochMs, previous: EpochMs?, look: ReadinessLook, looks: Int }
   | MegaRacConfigurationsUnreadable { detail: String }
@@ -291,73 +290,36 @@ type MediaGeneralShareRead
   = MediaGeneralShareObserved { observed: MegaRacObservedShare }
   | MediaGeneralShareUnreadable { detail: String }
 
-// THE CD ERROR CODE IS THE VENDOR'S LAST-STOP REASON, AND THE VENDOR'S OWN UI SAYS WHEN IT MEANS
-// ANYTHING (operator-approved 2026-10-01, superseding the knowledge refusal of gunbc#12425 option A and
-// the held "census END marker decides delivery" design of msg_abc42f62 for every code the table names).
-// settings/media/general carries cd_error_code beside mount_cd. The SP-X UI bundle this firmware serves
-// (source.min.js sha256 5029fae2..., extdeps.bmc.megarac megarac_rmedia_status_0_32) reads it in exactly
-// one place, the single-image rmedia view, and only as `0==mount_cd && 1<=code<=17`, rendering
-// "Stopped" + the code's name; while the medium is started or starting it never consults the code, and
-// in the stopped state it leaves Start enabled whatever the code is. So the code is a LATCHED reason
-// for the last stop, not a live fault: boot run 36721915217 read 16 before any write, after its own
-// stop and at readiness, while the configurations row read Started with session_index 0.
-// Hence three readings, each a different fact:
-//   CdErrorNone          -- 0;
-//   CdErrorStopReason    -- a code the build's table names, with the class below;
-//   CdErrorUncatalogued  -- a code outside the table, a build with no table, or a named code this
-//                           policy has not classified.
-// Where the vendor does not consult the code -- the image Started or connecting -- every read code is
-// recorded and none withholds. Where it does -- nothing presented -- a named reason is refused or
-// attached past BY NAME, and an uncatalogued code stays a knowledge refusal. An UNREAD code is never a
-// reading, and withholds everywhere.
+// THE CD ERROR CODE IS AN OBSERVED NUMBER, AND NO MEANING IS ESTABLISHED FOR ANY VALUE.
+// settings/media/general carries cd_error_code beside mount_cd. Boot run 36721915217 (an executed
+// receipt) read 16 before any write, after its own stop and at readiness, while the configurations row
+// read Started with session_index 0. That is a COEXISTENCE: the value was already present before the
+// attempt stopped anything, so it does not show what produced it. No public document or executed
+// receipt gives any value a cause, so the model keeps the raw observation and names none. Two readings:
+//   CdErrorNone    -- 0;
+//   CdErrorNonzero -- any other value, with the firmware it was read from.
+// An UNREAD code is never a reading, and withholds everywhere.
 type MegaRacCdErrorCode
   = CdErrorNone
-  | CdErrorStopReason { status: MegaRacRmediaStatus, class: MegaRacStopReasonClass }
-  | CdErrorUncatalogued { wire: Int }
-
-// WHETHER A STOP REASON SAYS THE CONTROLLER FAILED TO PRESENT, FROM THE VENDOR'S NAME FOR IT. The table
-// is the vendor's (derived, never typed here); the class is this repository's reading of each name, and
-// is keyed by code so that a table row this function does not name stays unclassified and refuses.
-//   NO FAULT -- the stop was asked for, or is the end of a presentation rather than a failure of one:
-//     1  Connection Accepted      the redirection's own acceptance status; it names no failure.
-//     7  Media Detach Stage       the medium was being detached, which is what a stop request does.
-//     15 Mount Cancelled By User  an operator stopped it.
-//     16 Device Ejected           the HOST ejected the virtual device (an OS or installer eject), or the
-//                                 stop of a presentation ejected it; the controller presented, and the
-//                                 consumer let go. Boot run 36721915217's stop of the stale image left
-//                                 exactly this code.
-//   PRESENTATION FAILURE -- the controller could not present, or lost, the medium:
-//     2  Connection Denied, 3 Login Failed, 4 MAX Session Reached, 5 Permission Denied: the share or the
-//        redirection refused this presentation;
-//     6  Unknown Error: the vendor's own catch-all for a failure it could not name;
-//     8  All device instances are occupied: no virtual device was free to present on;
-//     9  Unable to Connect, 14 Connection Lost: the share was unreachable, or stopped answering;
-//     10 Invalid Image, 11 Mount Error, 12 Unable to Open: the image could not be mounted or read;
-//     13 Media License Expired: the controller refuses remote media altogether;
-//     17 Session Terminated: the session ended under the medium with no stop requested.
-type MegaRacStopReasonClass
-  = StopReasonNoFault
-  | StopReasonPresentationFailure
-
-fn megarac_stop_reason_class(status: MegaRacRmediaStatus) -> MegaRacStopReasonClass? {
-  let c = status.code
-  if c == 1 || c == 7 || c == 15 || c == 16 { Present { value: StopReasonNoFault } }
-  else if (c >= 2 && c <= 6) || (c >= 8 && c <= 14) || c == 17 { Present { value: StopReasonPresentationFailure } }
-  else { none }
+  | CdErrorNonzero { wire: Int, firmware: BmcFirmwareReleaseIdentity }
+
+// POLICY, NOT A DECODED CAUSE. A nonzero code with nothing presented admits the attach only when it is
+// 16 read from firmware 0.32: boot run 36721915217 read exactly that before it attached, and the
+// attached presentation reached Started and the run proceeded. Admitting it claims that the run
+// proceeded under this reading, not what the code means. Every other nonzero code, and 16 on another
+// build, has no such run behind it, so the fresh-presentation experiment must be admitted first.
+data cd_error_attach_policy_wire: Int = 16
+
+fn cd_error_attach_policy_admits(code: MegaRacCdErrorCode) -> Bool {
+  match code {
+    CdErrorNone => true
+    CdErrorNonzero { wire: w, firmware: f } => w == cd_error_attach_policy_wire && bmc_firmware_release_identity_eq(a: f, b: megarac_firmware_0_32)
+  }
 }
 
 fn megarac_cd_error_code_of_wire(firmware: BmcFirmwareReleaseIdentity, wire: Int) -> MegaRacCdErrorCode {
-  if wire == 0 { CdErrorNone } else {
-    match megarac_rmedia_status_of_wire(firmware: firmware, wire: wire) {
-      RmediaStatusNamed { status: st } =>
-        match megarac_stop_reason_class(status: st) {
-          Present { value: k } => CdErrorStopReason { status: st, class: k }
-          Absent => CdErrorUncatalogued { wire: wire }
-        }
-      RmediaStatusOutsideTable { firmware: _, wire: _ } => CdErrorUncatalogued { wire: wire }
-      RmediaStatusTableUnread { firmware: _, wire: _ } => CdErrorUncatalogued { wire: wire }
-    }
-  }
+  if wire == 0 { CdErrorNone }
+  else { CdErrorNonzero { wire: wire, firmware: firmware } }
 }
 
 type CdErrorReading
@@ -526,9 +488,7 @@ fn images_array_elements(doc: JsonValue) -> List<JsonValue>? {
 
 // THE START-MEDIA BODY, rendered here rather than by the caller so image_redirection cannot be
 // omitted by a caller who does not know it is required. extdeps.bmc.megarac records that omitting
-// it makes the firmware refuse with opaque codes 13410/13460, recovered from the firmware's own UI
-// bundle rather than from documentation — exactly the kind of fact that is lost when a body is
-// assembled at a call site.
+// it makes the firmware refuse, a fact that is lost when a body is assembled at a call site.
 fn start_media_body(image_name: NonEmptyStr, image_index: String) -> NonEmptyStr {
   join([
     "{\"image_name\":\"", image_name as String,
@@ -655,6 +615,20 @@ fn megarac_close_and_reobserve(
   return megarac_session_release_by_reobservation(before: before, after: after, csrf: csrf)
 }
 
+// THE SESSION REPLY'S DECODER, a pure function of the body so a claim supplies the body at this
+// interface: the one member read is CSRFToken, and a body that is not a JSON document or lacks it
+// reads as absent, which the caller refuses as MegaRacSessionTokenUnreadable.
+fn megarac_session_csrf(session_body: String) -> String? {
+  let session_doc = match parse_json_document(s: session_body) {
+    JsonDocumentParsed { value: v } => some_json_value(v)
+    JsonDocumentUnreadable { gap: _ } => none
+  }
+  return match session_doc {
+    Absent => none
+    Present { value: doc } => json_string_member(doc: doc, key: "CSRFToken")
+  }
+}
+
 fn megarac_attach_remote_image(
   bmc_host: NonEmptyStr,
   username: NonEmptyStr,
@@ -685,16 +659,7 @@ fn megarac_attach_remote_image(
     }
   }
 
-  let session_doc = match parse_json_document(s: session.body) {
-    JsonDocumentParsed { value: v } => some_json_value(v)
-    JsonDocumentUnreadable { gap: _ } => none
-  }
-  let csrf = match session_doc {
-    Absent => none
-    Present { value: doc } => json_string_member(doc: doc, key: "CSRFToken")
-  }
-
-  return match csrf {
+  return match megarac_session_csrf(session_body: session.body) {
     Absent =>
       megarac_release_unreadable_session(
         bmc_host: bmc_host,
@@ -1606,12 +1571,15 @@ fn megarac_convergence_step(
     ConvergeNothingPresented =>
       match cd_before {
         CdErrorRead { code: CdErrorNone } => ConvergeStepAttachFromListing
-        CdErrorRead { code: CdErrorStopReason { status: _, class: _ } } => ConvergeStepAttachFromListing
         CdErrorUnread { detail: _ } => ConvergeStepRefuse { outcome: unestablished_before_write(cd_before: cd_before, reason: "cd_error_code could not be read, so this attempt cannot establish the media state it would attach into") }
-        CdErrorRead { code: CdErrorUncatalogued { wire: _ } } =>
-          match detach {
-            MegaRacDetachAdmitted => ConvergeStepAttachFromListing
-            MegaRacDetachNotAdmitted { reason: why } => ConvergeStepRefuse { outcome: unestablished_before_write(cd_before: cd_before, reason: concat("nothing is presented, cd_error_code is nonzero, and the fresh-presentation experiment was not admitted: ", why as String)) }
+        CdErrorRead { code: c } =>
+          match cd_error_attach_policy_admits(code: c) {
+            true => ConvergeStepAttachFromListing
+            false =>
+              match detach {
+                MegaRacDetachAdmitted => ConvergeStepAttachFromListing
+                MegaRacDetachNotAdmitted { reason: why } => ConvergeStepRefuse { outcome: unestablished_before_write(cd_before: cd_before, reason: concat("nothing is presented, cd_error_code is nonzero, and the fresh-presentation experiment was not admitted: ", why as String)) }
+              }
           }
       }
   }
@@ -1927,36 +1895,7 @@ fn megarac_readiness_outcome(
 }
 
 // THE CODE IS READ AT THE END OF THE WAIT WHATEVER THE WAIT ANSWERED, so a refusal carries the code
-// that stood beside the unhealthy presentation, and a ready presentation carries it as historical.
-// A STOPPED PRESENTATION WITH A NAMED REASON: the look found nothing presented (the row was stopped,
-// or cleared) and the code reads a reason the build's table names. That is the one state in which the
-// vendor's UI reads the code at all, and it reads it as "Stopped - <name>", so the refusal carries the
-// name and its class instead of a timeout. Any other look, or any other code, is not this state.
-type StopReasonReading {
-  status: MegaRacRmediaStatus
-  class: MegaRacStopReasonClass
-}
-
-fn stopped_with_reason(look: ReadinessLook, cd: CdErrorReading) -> StopReasonReading? {
-  match look.reading {
-    ReadinessNotPresented { configurations: _ } =>
-      match cd {
-        CdErrorRead { code: CdErrorStopReason { status: st, class: k } } => Present { value: StopReasonReading { status: st, class: k } }
-        CdErrorRead { code: CdErrorNone } => none
-        CdErrorRead { code: CdErrorUncatalogued { wire: _ } } => none
-        CdErrorUnread { detail: _ } => none
-      }
-    ReadinessStarted { row: _ } => none
-    ReadinessConnecting { row: _ } => none
-    ReadinessStartedUnbound { row: _ } => none
-    ReadinessUnanswered { detail: _ } => none
-    ReadinessUncatalogued { image_name: _, wire: _, configurations: _ } => none
-    ReadinessMalformed { detail: _ } => none
-    ReadinessDuplicate { configurations: _ } => none
-    ReadinessWrongPresentation { image_name: _, configurations: _ } => none
-  }
-}
-
+// that stood beside the unhealthy presentation, and a ready presentation carries it beside the Started row, as an observation.
 // PURE: the wait's answer as the attach outcome. Only a Started look reaches MegaRacPresentationReady,
 // and the evidence is read from that look's row, so the record a boot is gated on is the row that
 // satisfied the policy.
@@ -1973,15 +1912,9 @@ fn readiness_wait_outcome(
     ReadinessWaitClockUnreadable { detail: d } => MegaRacReadinessClockUnreadable { image_name: image_name, route: route, detail: d }
     ReadinessWaitClockIncoherent { opened_at: o, previous: p, look: l, looks: n } => MegaRacReadinessClockIncoherent { image_name: image_name, route: route, opened_at: o, previous: p, look: l, looks: n }
     ReadinessWaitClosed { last: l, deadline: d, looks: n } =>
-      match stopped_with_reason(look: l, cd: cd_at_end) {
-        Present { value: st } => MegaRacPresentationStopped { image_name: image_name, route: route, look: l, looks: n, cd_before_any_write: cd_before, stop: st.status, class: st.class, general_at_refusal: general_at_end }
-        Absent => MegaRacReadinessTimedOut { image_name: image_name, route: route, last: l, deadline: d, looks: n, cd_before_any_write: cd_before, cd_at_refusal: cd_at_end }
-      }
+      MegaRacReadinessTimedOut { image_name: image_name, route: route, last: l, deadline: d, looks: n, cd_before_any_write: cd_before, cd_at_refusal: cd_at_end }
     ReadinessWaitRefused { look: l, looks: n } =>
-      match stopped_with_reason(look: l, cd: cd_at_end) {
-        Present { value: st } => MegaRacPresentationStopped { image_name: image_name, route: route, look: l, looks: n, cd_before_any_write: cd_before, stop: st.status, class: st.class, general_at_refusal: general_at_end }
-        Absent => MegaRacReadinessRefused { image_name: image_name, route: route, look: l, looks: n, cd_before_any_write: cd_before, cd_at_refusal: cd_at_end }
-      }
+      MegaRacReadinessRefused { image_name: image_name, route: route, look: l, looks: n, cd_before_any_write: cd_before, cd_at_refusal: cd_at_end }
     ReadinessWaitReady { look: l, looks: n } => {
       let not_ready = MegaRacReadinessRefused { image_name: image_name, route: route, look: l, looks: n, cd_before_any_write: cd_before, cd_at_refusal: cd_at_end }
       let state_unestablished = MegaRacMediaStateUnestablished { image_name: image_name, route: route, look: l, looks: n, cd_before_any_write: cd_before, cd_at_ready: cd_at_end, general_at_ready: general_at_end }
@@ -2052,11 +1985,10 @@ fn megarac_observe_with_token(
 }
 
 // THREE ANSWERS, BECAUSE THEY ARE DIFFERENT FACTS (side-chat review 5331738657). Affirmed: the look
-// was taken and the medium is not being served (a withdrawn or non-Started row, a share mismatch; a
-// stopped row beside a cd_error_code the build's table names says which stop it was). Unobserved: the
+// was taken and the medium is not being served (a withdrawn or non-Started row, a share mismatch). Unobserved: the
 // look itself failed (session, transport, an unread member, an unread cd_error_code), which says
-// nothing about the medium. A read cd_error_code beside a Started row is the last stop's latched
-// reason, which the vendor's UI does not consult while started, so it does not withhold.
+// nothing about the medium. A read cd_error_code beside a Started row is recorded as an observation and
+// does not withhold, because a Started row with a bound session is what the readiness policy asks for.
 // And the look's own session must be released: a ready medium observed through a session the
 // controller still holds is a cleanup obligation unmet, exactly as at the initial gate. Only
 // PresentationStillReady admits a handoff; each other answer withholds and says which it was.
@@ -2090,10 +2022,7 @@ fn presentation_still_served(result: MegaRacAttachResult) -> PresentationStillSe
             ReadinessConnecting { row: _ } => no_longer_ready
             ReadinessStartedUnbound { row: _ } => no_longer_ready
             ReadinessNotPresented { configurations: _ } =>
-              match cd {
-                CdErrorRead { code: CdErrorStopReason { status: st, class: k } } => PresentationNoLongerReady { reason: concat("the configurations row no longer presents the image: ", stop_reason_text(status: st, class: k)) as NonEmptyStr }
-                _ => no_longer_ready
-              }
+              no_longer_ready
             ReadinessDuplicate { configurations: _ } => no_longer_ready
             ReadinessWrongPresentation { image_name: _, configurations: _ } => no_longer_ready
           }
@@ -2104,7 +2033,6 @@ fn presentation_still_served(result: MegaRacAttachResult) -> PresentationStillSe
     MegaRacMediaStateUnestablished { image_name: _, route: _, look: _, looks: _, cd_before_any_write: _, cd_at_ready: _, general_at_ready: _ } => presentation_unobserved_before_presentation()
     MegaRacMediaStateUnestablishedBeforeWrite { cd_before_any_write: _, reason: _ } => presentation_unobserved_before_presentation()
     MegaRacReadinessRefused { image_name: _, route: _, look: _, looks: _, cd_before_any_write: _, cd_at_refusal: _ } => presentation_unobserved_before_presentation()
-    MegaRacPresentationStopped { image_name: _, route: _, look: _, looks: _, cd_before_any_write: _, stop: _, class: _, general_at_refusal: _ } => presentation_unobserved_before_presentation()
     MegaRacReadinessClockUnreadable { image_name: _, route: _, detail: _ } => presentation_unobserved_before_presentation()
     MegaRacReadinessClockIncoherent { image_name: _, route: _, opened_at: _, previous: _, look: _, looks: _ } => presentation_unobserved_before_presentation()
     MegaRacConfigurationsUnreadable { detail: _ } => presentation_unobserved_before_presentation()
@@ -2132,11 +2060,3 @@ fn presentation_still_served(result: MegaRacAttachResult) -> PresentationStillSe
 fn presentation_unobserved_before_presentation() -> PresentationStillServed {
   PresentationUnobserved { reason: "the presentation could not be observed (the session was refused or its token unreadable)" }
 }
-
-// THE VENDOR'S OWN RENDERING, "Stopped - <name>", with the code and this repository's class beside it.
-fn stop_reason_text(status: MegaRacRmediaStatus, class: MegaRacStopReasonClass) -> String {
-  join(["Stopped - ", status.name as String, " (cd_error_code ", to_string(status.code), "; ", match class {
-    StopReasonNoFault => "no fault: the stop was asked for, or the consumer let the medium go"
-    StopReasonPresentationFailure => "a presentation failure: the controller could not present, or lost, the medium"
-  }, ")"], "")
-}
diff --git a/dag/gunbc/machine_intake/megarac_operation_evidence.dag b/dag/gunbc/machine_intake/megarac_operation_evidence.dag
index 89207dc9ab1..ded723dcbe8 100644
--- a/dag/gunbc/machine_intake/megarac_operation_evidence.dag
+++ b/dag/gunbc/machine_intake/megarac_operation_evidence.dag
@@ -1,6 +1,6 @@
 module gunbc.machine_intake_megarac_operation_evidence
 
-import std.types { EpochMs, List, NonEmptyStr }
+import std.types { EpochMs, List }
 import std.content_hash { Sha256Digest, Sha256Hash }
 import std.decl_ref { decl_ref }
 import extdeps.bmc.endpoint { AmiMegaRac }
@@ -8,7 +8,7 @@ import extdeps.bmc.capability { bmc_firmware_release_identity_of_wire }
 import gunbc.machine_intake_receipt { EvidenceRef }
 import gunbc.megarac_operation_standing {
   MegaRacOperationEvidence, megarac_operation_evidence_of, MegaRacVirtualMediaAttach, MegaRacKvmCanvasStill, MegaRacSdrSocketNaming,
-  megarac_build_reading, megarac_operation_receipt, megarac_firmware_transition, megarac_operation_served_artifact_recovery, ServedArtifactDigestOnly,
+  megarac_build_reading, megarac_operation_receipt, megarac_firmware_transition,
 }
 import gunbc.machine_intake_mtcollins1_access_observation {
   mtcollins1_endpoint, mtcollins1_firmware, mtcollins1_identity, mtcollins1_evidence_manifest_digest, mtcollins1_observed_at,
@@ -17,7 +17,6 @@ import gunbc.machine_intake_mtcollins1_diskless_boot_receipt {
   mtcollins1_diskless_boot_artifact_path, mtcollins1_diskless_boot_capture_digest, mtcollins1_diskless_boot_observed_at,
 }
 import gunbc.machine_intake_mtcollins1_32dimm_bringup_observation { mtcollins1_sdr_capture }
-import gunbc.machine_intake_megarac_served_ui_catalog_observation { megarac_source_min_js_sha256_2026_09_27 }
 
 // THE COMMITTED EVIDENCE OF WHICH MEGARAC OPERATIONS RAN ON WHICH CONTROLLER BUILD, one row per capture
 // (gunbc.megarac_operation_standing joins them). Every row cites a committed artifact by path and
@@ -27,13 +26,8 @@ import gunbc.machine_intake_megarac_served_ui_catalog_observation { megarac_sour
 //
 // MT. COLLINS UNIT 1, AS OF THIS WRITING:
 //   - BMC 0.32 (Foxconn Mt. Collins), read by the 2026-09-05 intake observation. Virtual media ran on it
-//     (the 2026-09-06 diskless boot) and an SDR read with its CPU<n>_ names ran on it (2026-09-11). The
-//     KVM canvas still's route was recovered from the web UI bundle that build SERVES to a browser
-//     (https://192.168.1.228/source.min.js, read 2026-09-27; gunbc.machine_intake_megarac_served_ui_catalog_observation
-//     megarac_source_min_js_sha256_2026_09_27). That is an observation of what the device serves, not a
-//     disassembly or a proprietary-notice document. Its BYTES ARE NOT COMMITTED -- the digest is the only
-//     record, and the row says so (ServedArtifactDigestOnly). No committed still from that build exists,
-//     so the KVM still is grounded at 0.32 as RECOVERED, never as executed.
+//     (the 2026-09-06 diskless boot) and an SDR read with its CPU<n>_ names ran on it (2026-09-11).
+//     The KVM canvas still has no standing at 0.32: no committed still exists from that build.
 //   - Reflashed to BMC 0.45.3 on 2026-10-02 (the firmware converge's recorded credential effect).
 //   - Fleet-converge run 37102391062, 2026-10-03, about 21 h after the reflash, committed its media
 //     attach (diagnostics), its KVM journal with five sha256-bound stills, and a BMC sensor read. Those
@@ -64,9 +58,6 @@ data mtcollins1_sdr_32dimm_evidence: EvidenceRef = EvidenceRef {
 data mtcollins1_sdr_32dimm_read_on: EpochMs = 1789084800000
 
 
-// 2026-09-27T00:00:00Z: the bundle read names its day.
-data megarac_served_bundle_0_32_read_on: EpochMs = 1790467200000
-
 data mtcollins1_run_37102391062_diagnostics: EvidenceRef = EvidenceRef {
   label: "artifacts/bmc/mtcollins1-boot-run-37102391062/mtcollins1-boot-diagnostics.txt",
   digest: Sha256Hash(Sha256Digest { hex: "d76d874395e4b809a6d70ccbccb4d941012391feeb14e7a8a2241befbf56b2d2" }),
@@ -112,15 +103,5 @@ fn mtcollins1_megarac_operation_evidence() -> MegaRacOperationEvidence {
         record: decl_ref(module_path: "gunbc.fleet.mtcollins_firmware_converge", decl_name: "credential_effect_of"),
       ),
     ],
-    recoveries: [
-      megarac_operation_served_artifact_recovery(
-        operation: MegaRacKvmCanvasStill,
-        identity: mtcollins1_identity,
-        served_by: mtcollins1_endpoint,
-        artifact: "https://192.168.1.228/source.min.js" as NonEmptyStr,
-        capture: ServedArtifactDigestOnly { digest: Sha256Hash(Sha256Digest { hex: megarac_source_min_js_sha256_2026_09_27 as String }) },
-        read_at: megarac_served_bundle_0_32_read_on,
-      ),
-    ],
   )
 }
diff --git a/dag/gunbc/machine_intake/megarac_served_ui_catalog_observation.dag b/dag/gunbc/machine_intake/megarac_served_ui_catalog_observation.dag
deleted file mode 100644
index 2bbb9e9c70a..00000000000
--- a/dag/gunbc/machine_intake/megarac_served_ui_catalog_observation.dag
+++ /dev/null
@@ -1,20 +0,0 @@
-module gunbc.machine_intake_megarac_served_ui_catalog_observation
-
-import std.types { NonEmptyStr }
-
-// RECEIPT OF A REPOSITORY CAPTURE, not an AMI-published catalog identity. The 255 api/ paths
-// were extracted from source.min.js served at https://192.168.1.228/source.min.js on
-// 2026-09-12 and committed under artifacts/. DESIGN §3: observations produced by this repository
-// live in the observing layer. Firmware-keyed facts about what that surface contains stay in
-// extdeps.bmc.megarac; this module owns only the capture's path and digest.
-
-data megarac_spx_ui_surface_path: NonEmptyStr = "artifacts/bmc/mtcollins1-megarac-api-surface.txt" as NonEmptyStr
-
-data megarac_spx_ui_surface_sha256: NonEmptyStr = "4fc53fea3fe49bc3ed3b967511654223578d59d963546117ab524df11b419bcd" as NonEmptyStr
-
-// THE 2026-09-27 READ OF THE BUNDLE ITSELF, as its digest. extdeps.bmc.megarac cites this read for the
-// screen-capture surfaces and the KVM wire; the bytes were not committed, so the digest is the only
-// thing a later read can be compared with. gunbc.machine_intake_mtcollins1_ui_bundle_observe reports
-// match or drift against it and does not refuse on drift: a different digest is a finding about the
-// firmware's served UI, not a failed read.
-data megarac_source_min_js_sha256_2026_09_27: NonEmptyStr = "5029fae278f7fc8f4dd4ad5eb8e4457e49fa25d4d0158d4bf9fbab09f57d4bf3" as NonEmptyStr
diff --git a/dag/gunbc/machine_intake/megarac_ui_features.dag b/dag/gunbc/machine_intake/megarac_ui_features.dag
deleted file mode 100644
index 510a5efa0ae..00000000000
--- a/dag/gunbc/machine_intake/megarac_ui_features.dag
+++ /dev/null
@@ -1,403 +0,0 @@
-module gunbc.machine_intake_megarac_ui_features
-
-import extdeps.tools.sha256sum
-import extdeps.tools.gzip
-import std.algebra { trim }
-import std.types { Bool, FilePath, Int, List, NonEmptyStr, String }
-import std.optional { Present, Absent }
-import std.process { ExitSuccess, ProcessExit, exit_failure }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import gunbc.machine_intake_megarac_served_ui_catalog_observation { megarac_source_min_js_sha256_2026_09_27 }
-import extdeps.external_authority { CitedFigureStanding, TranscribedUncited }
-import extdeps.bmc.capability { BmcFirmwareReleaseIdentity, bmc_firmware_release_identity_eq }
-import extdeps.bmc.megarac { megarac_firmware_0_32 }
-
-// THE FEATURE LIST THE VENDOR UI HANDS ITS KVM VIEWER, READ FROM THE UI'S OWN BYTES (eager-owl-205,
-// 2026-09-30; operator rule: derived, never hand-typed). The served viewer.min.js (fleet-converge crawl
-// run 36787375313) initialises its KVM view with UNGUARDED sessionStorage.features.indexOf(...) reads
-// (KVM_SESSION_RECONNECT, VMEDIA_MAX_COUNT_FOR_KVM, HOST_CURSOR_ENABLED_DEFAULT): with `features` unset
-// it throws, the view never initialises, and /kvm is never opened -- KVM probe run 36788605665 journalled
-// exactly that page error and no WebSocket. The real UI stores JSON.stringify of its
-// project-configurations collection, which is seeded from the STATIC `features` module compiled into
-// source.min.js:
-//   o("features",[],function(){var e=[{feature:"RMEDIA_MULTI_IMAGE_SUPPORT"},...];return e})
-// so the list is parsed out of those bytes, and only out of the build this unit's facts are keyed on:
-// the served source.min.js must digest to the 2026-09-27 read's sha256, or nothing is read.
-//
-// THE LIST IS AN OBSERVATION RECEIPT, NOT A DERIVED FACT IN GIT (review 73613; operator decision via
-// eager-owl-205, 2026-10-01). The bundle it is read from is AMI's proprietary MegaRAC UI and is not
-// redistributable, so it is not committed and no CI job can reach it: a CI-diffed gate is unavailable,
-// and that is a DECLARED BOUNDARY, not a below-ceiling choice (DESIGN 4b, outside the modeled guarantee;
-// 4d, the typed bet). The receipt names what was read -- the firmware build, the bundle's sha256, the
-// run that retained it -- and carries TranscribedUncited with its read obligation: the route that
-// re-derives it. What gates it is that route: megarac_ui_bundle_rows_emit refuses any bundle whose
-// digest is not the pinned one, so a later fetch either reproduces these names from these bytes or
-// refuses, and never silently diverges from them.
-data megarac_ui_features_module_open: String = "o(\"features\",[],function()\{var e=["
-
-data megarac_ui_features_module_close: String = "];return e}"
-
-data megarac_ui_feature_key: String = "feature:\""
-
-// THE NAMES IN THE MODULE, IN ITS ORDER: every `feature:"NAME"` between the module's opening and its
-// `];return e}`. Absent when the module is not in the text, or holds no name.
-fn megarac_ui_features_of_bundle(text: String) -> List<String>? {
-  match split(s: text, delimiter: megarac_ui_features_module_open).skip(n: 1).first() {
-    Absent => none
-    Present { value: after } => {
-      let body = match split(s: after, delimiter: megarac_ui_features_module_close).first() { Present { value: b } => b  Absent => "" }
-      let names = map(split(s: body, delimiter: megarac_ui_feature_key).skip(n: 1), rest => match split(s: rest, delimiter: "\"").first() { Present { value: n } => n  Absent => "" })
-      if count(names) == 0 { none } else { Present { value: names } }
-    }
-  }
-}
-
-// A FEATURE NAME IS THE VENDOR'S IDENTIFIER SHAPE: upper-case letters, digits and underscores, nonempty.
-// Anything else is refused rather than written into a JSON string it could escape from.
-data megarac_ui_feature_name_characters: String = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
-
-fn megarac_ui_feature_name_admitted(name: String) -> Bool {
-  name != "" && all(split(s: name, delimiter: ""), c => c == "" || string_contains(s: megarac_ui_feature_name_characters, pattern: c))
-}
-
-
-type MegaRacUiFeatures
-  = MegaRacUiFeaturesRead { names: List<String>, source_sha256: NonEmptyStr }
-  | MegaRacUiFeaturesUnread { cause: NonEmptyStr }
-
-// THE READING FROM ALREADY-DECODED BUNDLE TEXT AND ITS DIGEST: refused unless the digest is the pinned
-// build's and the module yields only admitted names.
-fn megarac_ui_features_reading(observed_sha256: String, text: String) -> MegaRacUiFeatures {
-  if observed_sha256 != (megarac_source_min_js_sha256_2026_09_27 as String) {
-    MegaRacUiFeaturesUnread { cause: concat(concat("source.min.js digests to ", observed_sha256), concat(", not the pinned ", megarac_source_min_js_sha256_2026_09_27 as String)) as NonEmptyStr }
-  } else {
-    match megarac_ui_features_of_bundle(text: text) {
-      Absent => MegaRacUiFeaturesUnread { cause: "the features module was not found in source.min.js, or holds no name" }
-      Present { value: names } =>
-        if all(names, n => megarac_ui_feature_name_admitted(name: n)) {
-          MegaRacUiFeaturesRead { names: names, source_sha256: megarac_source_min_js_sha256_2026_09_27 }
-        } else {
-          MegaRacUiFeaturesUnread { cause: concat("the features module holds a name outside the vendor identifier shape: ", join(filter(names, n => !megarac_ui_feature_name_admitted(name: n)), " ")) as NonEmptyStr }
-        }
-    }
-  }
-}
-
-type MegaRacUiFeaturesReceipt {
-  firmware: BmcFirmwareReleaseIdentity
-  bundle_sha256: NonEmptyStr
-  producing_run: NonEmptyStr
-  names: List<NonEmptyStr>
-  standing: CitedFigureStanding
-}
-
-// The names, as megarac_ui_bundle_rows_emit wrote them from run 36787375313's retained source.min.js.
-data megarac_ui_features_0_32: List<NonEmptyStr> = [
-  "RMEDIA_MULTI_IMAGE_SUPPORT",
-  "BIOS_SUPPORT",
-  "KVM_SESSION_RECONNECT",
-  "SYSTEM_FIREWALL",
-  "OEM_PROPRIETARY_LEVEL_SUPPORT",
-  "HTML5_KVM",
-  "DUAL_BIOS_FLASH_SUPPORT",
-  "IPV6_SUPPORT",
-  "ALLOW_NON_SECURE_COMMUNICATION",
-  "SET_SENSOR_THRESHOLDS",
-  "REPLACE_OEM_LOGO",
-  "EXTENDEDLOG",
-  "AUTO_RESIZE_KVM_CLIENT_WINDOW",
-  "SERVICES",
-  "RMEDIA",
-  "AUTOVDORECORD_REMOTE",
-  "CAPTURE_BSOD_JPEG",
-  "RADIUS_SUPPORT",
-  "SYSTEM_FIREWALL_TIMEOUT",
-  "UARTLOG",
-  "RUNTIME_HOST_LOCK",
-  "SOL_SUPPORT",
-  "HPM_SUPPORT",
-  "ADVISER_SUPPORT",
-  "AD_SUPPORT",
-  "MULTIPLE_USER_VMEDIA",
-  "LDAP_SUPPORT",
-  "KVM_SESSION_TIMEOUT",
-  "FIRMWARE_FLASH_SUPPORT",
-  "CPLD_SUPPORT",
-  "PTP_SERVER_SUPPORT",
-  "BOOTFW_SUPPORT",
-  "HOST_LOCK_AUTO",
-  "BACKUP_CONFIG",
-  "SET_SENSOR_THRESHOLDS_RESET",
-  "SAVE_SELLOG",
-  "SESSION_MANAGEMENT",
-  "RMEDIA_MULTI_CD_SUPPORT",
-  "TSIG",
-  "IPV6_COMPLIANCE",
-  "CD_SERVER_APP",
-  "WEB_DASHBOARD_WIDGETS",
-  "FOLDER_REDIRECTION",
-  "CIRCULAR_SEL",
-  "FW_IMAGE",
-  "DISABLE_EMPTY_PASSWORD",
-  "KB_LANG_SELECT_SUPPORT",
-  "DYNAMIC_KCS_LAN_SUPPORT",
-  "LMEDIA",
-  "DUAL_BOOTFW_EEPROM_SUPPORT",
-  "BLOCK_ICMP_TIMESTAMP",
-  "SINGLE_PORT_APP",
-  "MDNS",
-  "NCSI_SUPPORT",
-  "IMG_REDIRECTION",
-  "HD_SERVER_APP",
-  "PAM_REORDERING",
-  "EXTENDED_PRIV",
-  "SNMP",
-  "WEB_APP_PROXY",
-  "LMEDIA_MULTI_IMAGE_SUPPORT",
-  "VMEDIA_MAX_COUNT_FOR_KVM",
-  "MEDIA_REDIR_READ_WRITE_ONLY",
-  "RMEDIA_SESSION_RECONNECT",
-  "PRESERVECONF",
-  "TIMEZONE_SUPPORT",
-  "RMEDIA_MULTI_HD_SUPPORT",
-  "AUTOVDORECORD",
-  "YES",
-  "VERSION_CMP_FLASH",
-  "BMC_RECOVERY",
-  "NWLINK",
-  "KVM_OR_MEDIA_AVAILABLE",
-]
-
-data megarac_ui_features_0_32_receipt: MegaRacUiFeaturesReceipt = MegaRacUiFeaturesReceipt {
-  firmware: megarac_firmware_0_32,
-  bundle_sha256: megarac_source_min_js_sha256_2026_09_27,
-  producing_run: "36787375313" as NonEmptyStr,
-  names: megarac_ui_features_0_32,
-  standing: TranscribedUncited { read_obligation: "re-derive by the fleet-converge mtcollins1_ui_bundle_observe mode, which retains the served source.min.js with its sha256 as the mtcollins1-ui-bundle artifact, then gunbc.machine_intake_megarac_ui_features megarac_ui_bundle_rows_emit over that file: it refuses unless the bytes digest to megarac_source_min_js_sha256_2026_09_27, and otherwise writes these names" as NonEmptyStr },
-}
-
-data megarac_ui_features_receipts: List<MegaRacUiFeaturesReceipt> = [megarac_ui_features_0_32_receipt]
-
-// THE LIST FOR A FIRMWARE BUILD: the receipt observed for that build, or none -- a build no receipt
-// covers has no list, and the observer does not drive its viewer.
-fn megarac_ui_features(firmware: BmcFirmwareReleaseIdentity) -> List<NonEmptyStr>? {
-  match filter(megarac_ui_features_receipts, r => bmc_firmware_release_identity_eq(a: r.firmware, b: firmware)).first() {
-    Present { value: r } => Present { value: r.names }
-    Absent => none
-  }
-}
-
-// THE REMOTE-MEDIA STOP REASONS, IN THE VENDOR'S OWN NAMES, AS AN OBSERVATION RECEIPT BESIDE THE FEATURE
-// LIST'S (same bundle, same boundary: AMI's proprietary UI, not committed, not reachable from CI). The
-// SP-X UI's rmedia view renders a stopped CD as its `halted` label ("Stopped") followed by the i18n
-// string rmedia:status_<code>, and only for 1 <= code <= 17 (changeInSingleImages:
-// `0==r&&l>=1&&17>=l`, r settings/media/general mount_cd, l its cd_error_code). Each row is one
-// rmedia:status_<code> entry of the English dictionary, " - " prefix removed; status_0 ("~") and
-// status_100 (" Starting..") are not stop reasons. The receipt CITES the feature receipt's firmware,
-// bundle digest and producing run rather than restating them: both lists are written by one emitter
-// from one digest-checked read, megarac_ui_bundle_rows_emit.
-type MegaRacRmediaStatus {
-  code: Int
-  name: NonEmptyStr
-}
-
-type MegaRacRmediaStatusReceipt {
-  firmware: BmcFirmwareReleaseIdentity
-  bundle_sha256: NonEmptyStr
-  producing_run: NonEmptyStr
-  rows: List<MegaRacRmediaStatus>
-  standing: CitedFigureStanding
-}
-
-// The rows, as megarac_ui_bundle_rows_emit wrote them from the same retained source.min.js.
-data megarac_rmedia_status_0_32: List<MegaRacRmediaStatus> = [
-  MegaRacRmediaStatus { code: 1, name: "Connection Accepted" },
-  MegaRacRmediaStatus { code: 2, name: "Connection Denied" },
-  MegaRacRmediaStatus { code: 3, name: "Login Failed" },
-  MegaRacRmediaStatus { code: 4, name: "MAX Session Reached" },
-  MegaRacRmediaStatus { code: 5, name: "Permission Denied" },
-  MegaRacRmediaStatus { code: 6, name: "Unknown Error" },
-  MegaRacRmediaStatus { code: 7, name: "Media Detach Stage" },
-  MegaRacRmediaStatus { code: 8, name: "All device instances are occupied" },
-  MegaRacRmediaStatus { code: 9, name: "Unable to Connect" },
-  MegaRacRmediaStatus { code: 10, name: "Invalid Image" },
-  MegaRacRmediaStatus { code: 11, name: "Mount Error" },
-  MegaRacRmediaStatus { code: 12, name: "Unable to Open" },
-  MegaRacRmediaStatus { code: 13, name: "Media License Expired" },
-  MegaRacRmediaStatus { code: 14, name: "Connection Lost" },
-  MegaRacRmediaStatus { code: 15, name: "Mount Cancelled By User" },
-  MegaRacRmediaStatus { code: 16, name: "Device Ejected" },
-  MegaRacRmediaStatus { code: 17, name: "Session Terminated" },
-]
-
-data megarac_rmedia_status_0_32_receipt: MegaRacRmediaStatusReceipt = MegaRacRmediaStatusReceipt {
-  firmware: megarac_ui_features_0_32_receipt.firmware,
-  bundle_sha256: megarac_ui_features_0_32_receipt.bundle_sha256,
-  producing_run: megarac_ui_features_0_32_receipt.producing_run,
-  rows: megarac_rmedia_status_0_32,
-  standing: megarac_ui_features_0_32_receipt.standing,
-}
-
-data megarac_rmedia_status_receipts: List<MegaRacRmediaStatusReceipt> = [megarac_rmedia_status_0_32_receipt]
-
-// A CODE THE BUILD'S TABLE NAMES, A CODE IT DOES NOT, OR A BUILD NO RECEIPT COVERS. The last two are
-// different facts: one is this firmware answering outside its own UI's vocabulary, the other is this
-// repository not having read that firmware's UI.
-type MegaRacRmediaStatusLookup
-  = RmediaStatusNamed { status: MegaRacRmediaStatus }
-  | RmediaStatusOutsideTable { firmware: BmcFirmwareReleaseIdentity, wire: Int }
-  | RmediaStatusTableUnread { firmware: BmcFirmwareReleaseIdentity, wire: Int }
-
-fn megarac_rmedia_status_of_wire(firmware: BmcFirmwareReleaseIdentity, wire: Int) -> MegaRacRmediaStatusLookup {
-  match filter(megarac_rmedia_status_receipts, r => bmc_firmware_release_identity_eq(a: r.firmware, b: firmware)).first() {
-    Absent => RmediaStatusTableUnread { firmware: firmware, wire: wire }
-    Present { value: r } =>
-      match filter(r.rows, st => st.code == wire).first() {
-        Present { value: st } => RmediaStatusNamed { status: st }
-        Absent => RmediaStatusOutsideTable { firmware: firmware, wire: wire }
-      }
-  }
-}
-
-// THE REMOTE-MEDIA STOP-REASON TABLE, READ FROM THE SAME BYTES (operator-approved 2026-10-01; rule:
-// derived, never hand-typed). The rmedia view names a stopped CD as "Stopped" + rmedia:status_<code>,
-// and its range check is compiled in beside the dictionary:
-//   0==r&&l>=1&&17>=l?(... a.t("rmedia:halted")+a.t("rmedia:status_"+l) ...)
-// The English rmedia dictionary opens once in the bundle -- rmedia:{home:"Home",... -- and a stop reason
-// is an entry status_<code>:" - <Name>"; status_0 ("~") and status_100 (" Starting..") carry no " - "
-// and are not reasons. Two readings of one fact are taken and must agree: the dictionary's entries are
-// exactly codes 1..N in order, and N is the upper bound the range check reads. A disagreement is a
-// build this parse does not understand, and refuses.
-data megarac_rmedia_dictionary_open: String = "rmedia:\{home:\"Home\","
-
-data megarac_rmedia_dictionary_close: String = "}"
-
-data megarac_rmedia_status_key: String = "status_"
-
-data megarac_rmedia_stop_reason_prefix: String = " - "
-
-data megarac_rmedia_status_bound_open: String = "0==r&&l>=1&&"
-
-data megarac_rmedia_status_bound_close: String = ">=l"
-
-// ONE DICTIONARY ENTRY that names a stop reason: status_<digits>:" - <Name>". Anything else in the
-// dictionary -- its other keys, status_0, status_100 -- is not a row.
-fn megarac_rmedia_status_entry(piece: String) -> MegaRacRmediaStatus? {
-  match split(s: piece, delimiter: ":\"").first() {
-    Absent => none
-    Present { value: key } =>
-      match parse_int(s: key) {
-        Absent => none
-        Present { value: code } => {
-          let value = match split(s: piece, delimiter: ":\"").skip(n: 1).first() { Present { value: v } => match split(s: v, delimiter: "\"").first() { Present { value: q } => q  Absent => "" }  Absent => "" }
-          if starts_with(s: value, prefix: megarac_rmedia_stop_reason_prefix) {
-            let name = join(split(s: value, delimiter: megarac_rmedia_stop_reason_prefix).skip(n: 1), megarac_rmedia_stop_reason_prefix)
-            if name == "" { none } else { Present { value: MegaRacRmediaStatus { code: code, name: name as NonEmptyStr } } }
-          } else { none }
-        }
-      }
-  }
-}
-
-// THE STOP REASONS IN THE ENGLISH rmedia DICTIONARY, IN ITS ORDER. Absent when the dictionary is not in
-// the text.
-fn megarac_rmedia_status_entries_of_bundle(text: String) -> List<MegaRacRmediaStatus>? {
-  match split(s: text, delimiter: megarac_rmedia_dictionary_open).skip(n: 1).first() {
-    Absent => none
-    Present { value: after } => {
-      let body = match split(s: after, delimiter: megarac_rmedia_dictionary_close).first() { Present { value: b } => b  Absent => "" }
-      Present { value: fold(split(s: body, delimiter: megarac_rmedia_status_key).skip(n: 1), init: [], f: (acc, p) => match megarac_rmedia_status_entry(piece: p) { Present { value: r } => acc.append(r)  Absent => acc }) }
-    }
-  }
-}
-
-// THE UPPER BOUND THE VIEW'S OWN RANGE CHECK READS. Absent when the check is not in the text.
-fn megarac_rmedia_status_bound_of_bundle(text: String) -> Int? {
-  match split(s: text, delimiter: megarac_rmedia_status_bound_open).skip(n: 1).first() {
-    Absent => none
-    Present { value: after } =>
-      match split(s: after, delimiter: megarac_rmedia_status_bound_close).first() {
-        Absent => none
-        Present { value: n } => parse_int(s: n)
-      }
-  }
-}
-
-type MegaRacRmediaStatusTable
-  = MegaRacRmediaStatusTableRead { rows: List<MegaRacRmediaStatus>, source_sha256: NonEmptyStr }
-  | MegaRacRmediaStatusTableUnread { cause: NonEmptyStr }
-
-// A NAME IS WRITTEN INTO A .dag STRING, so a quote or a backslash is refused rather than escaped.
-fn megarac_rmedia_status_name_admitted(name: String) -> Bool {
-  name != "" && !string_contains(s: name, pattern: "\"") && !string_contains(s: name, pattern: "\\")
-}
-
-// THE READING FROM ALREADY-DECODED BUNDLE TEXT AND ITS DIGEST: refused unless the digest is the pinned
-// build's, the dictionary and the range check are both present, the entries are exactly 1..bound in
-// order, and every name is admitted.
-fn megarac_rmedia_status_table_reading(observed_sha256: String, text: String) -> MegaRacRmediaStatusTable {
-  if observed_sha256 != (megarac_source_min_js_sha256_2026_09_27 as String) {
-    MegaRacRmediaStatusTableUnread { cause: concat(concat("source.min.js digests to ", observed_sha256), concat(", not the pinned ", megarac_source_min_js_sha256_2026_09_27 as String)) as NonEmptyStr }
-  } else {
-    match megarac_rmedia_status_entries_of_bundle(text: text) {
-      Absent => MegaRacRmediaStatusTableUnread { cause: "the English rmedia dictionary was not found in source.min.js" }
-      Present { value: rows } =>
-        match megarac_rmedia_status_bound_of_bundle(text: text) {
-          Absent => MegaRacRmediaStatusTableUnread { cause: "the rmedia view's stop-reason range check was not found in source.min.js" }
-          Present { value: bound } =>
-            if count(rows) != bound || count(rows) == 0 {
-              MegaRacRmediaStatusTableUnread { cause: join(["the rmedia dictionary names ", to_string(count(rows)), " stop reasons but the view's range check reads 1..", to_string(bound)], "") as NonEmptyStr }
-            } else if fold(rows, init: 1, f: (next, r) => if next > 0 && r.code == next { next + 1 } else { 0 }) != count(rows) + 1 {
-              MegaRacRmediaStatusTableUnread { cause: concat("the rmedia stop reasons are not codes 1..N in order: ", join(map(rows, r => to_string(r.code)), " ")) as NonEmptyStr }
-            } else if !all(rows, r => megarac_rmedia_status_name_admitted(name: r.name as String)) {
-              MegaRacRmediaStatusTableUnread { cause: "an rmedia stop-reason name carries a quote or a backslash" }
-            } else {
-              MegaRacRmediaStatusTableRead { rows: rows, source_sha256: megarac_source_min_js_sha256_2026_09_27 }
-            }
-        }
-    }
-  }
-}
-
-fn megarac_rmedia_status_row_text(rows: List<MegaRacRmediaStatus>) -> String {
-  concat(concat("data megarac_rmedia_status_0_32: List<MegaRacRmediaStatus> = [\n", join(map(rows, r => join(["  MegaRacRmediaStatus \{ code: ", to_string(r.code), ", name: \"", r.name as String, "\" },"], "")), "\n")), "\n]\n")
-}
-
-// THE ROWS' ONE EMITTER (the entry both receipts' read obligation names): read a RETAINED source.min.js as served -- the
-// mtcollins1-ui-bundle artifact of a crawl run -- refuse unless it digests to the pinned 2026-09-27
-// build, decode it ONCE, parse both tables, and write both rows' text to `out`. Either parse refusing writes nothing. Run:
-//   gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/machine_intake/megarac_ui_features.dag
-//     --function megarac_ui_bundle_rows_emit --arg bundle=<retained source.min.js> --arg out=<file>
-fn megarac_ui_features_row_text(names: List<String>) -> String {
-  concat(concat("data megarac_ui_features_0_32: List<NonEmptyStr> = [\n", join(map(names, n => concat(concat("  \"", n), "\",")), "\n")), "\n]\n")
-}
-
-fn megarac_ui_bundle_rows_emit(bundle: String, out: String) -> ProcessExit {
-  let digest = sha256sum.Sha256.DigestFile(path: bundle as NonEmptyStr)
-  let observed = match split(s: trim(s: digest.line), delimiter: " ").first() { Present { value: d } => d  Absent => "" }
-  if !digest.success || observed == "" {
-    return exit_failure(reason: concat("megarac ui bundle rows: the retained bundle could not be digested: ", digest.line))
-  }
-  let decoded = gzip.Gzip.DecodeToStdout(path: bundle as NonEmptyStr)
-  if !decoded.success {
-    return exit_failure(reason: concat("megarac ui bundle rows: the retained bundle could not be decoded: ", trim(s: decoded.stderr)))
-  }
-  match megarac_ui_features_reading(observed_sha256: observed, text: decoded.text) {
-    MegaRacUiFeaturesUnread { cause: c } => exit_failure(reason: concat("megarac ui features: ", c as String))
-    MegaRacUiFeaturesRead { names: n, source_sha256: _ } =>
-      match megarac_rmedia_status_table_reading(observed_sha256: observed, text: decoded.text) {
-        MegaRacRmediaStatusTableUnread { cause: c } => exit_failure(reason: concat("megarac rmedia status table: ", c as String))
-        MegaRacRmediaStatusTableRead { rows: r, source_sha256: _ } => {
-          let w = Filesystem.Write(path: out, content: concat(megarac_ui_features_row_text(names: n), megarac_rmedia_status_row_text(rows: r)))
-          if w.success { ExitSuccess } else { exit_failure(reason: concat("megarac ui bundle rows: the rows could not be written: ", w.error)) }
-        }
-      }
-  }
-}
-
-fn megarac_ui_features_text(f: MegaRacUiFeatures) -> String {
-  match f {
-    MegaRacUiFeaturesRead { names: n, source_sha256: s } => join([to_string(count(n)), " features read from source.min.js sha256 ", s as String], "")
-    MegaRacUiFeaturesUnread { cause: c } => concat("features UNREAD: ", c as String)
-  }
-}
diff --git a/dag/gunbc/machine_intake/mtcollins1_32dimm_bringup_observation.dag b/dag/gunbc/machine_intake/mtcollins1_32dimm_bringup_observation.dag
index df349e53ead..f48bac69e0e 100644
--- a/dag/gunbc/machine_intake/mtcollins1_32dimm_bringup_observation.dag
+++ b/dag/gunbc/machine_intake/mtcollins1_32dimm_bringup_observation.dag
@@ -1,5 +1,6 @@
 module gunbc.machine_intake_mtcollins1_32dimm_bringup_observation
 
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
 import gunbc.mtcollins_memory_change { mtcollins_training_capture_path, mtcollins_training_capture_sha256 }
 import std.types { Bool, EpochMs, Int, List, NonEmptyStr, String }
 import std.measure { ByteSize, byte_size }
@@ -8,7 +9,6 @@ import std.decl_ref { DeclarationRef, WholeDeclaration }
 import std.process { ExitFailure, ExitSuccess, ProcessExit, exit_failure }
 import std.scoped_authorization { AttemptIdentity }
 import std.temporal_effect { LeaseEpoch, LeaseRunningExpected, LeaseRunningStale, held_lease }
-import extdeps.boards.types { AmpereMtCollins }
 import extdeps.bmc.ipmi_sel {
   FirmwareProgress,
   InitiatedByPowerUp,
@@ -395,7 +395,7 @@ data mtcollins1_sdr_capture: SdrCapture = SdrCapture {
 // (CPU0_MEM_Pwr / CPU1_MEM_Pwr in Watts, mtcollins1_sdr_capture); managed AC no (the AC cycle was performed
 // by hand, 10-ac-meta.txt); host callback intended, not demonstrated.
 data mtcollins1_pre_os_capabilities: PreOsObservationCapabilities = PreOsObservationCapabilities {
-  baseboard: AmpereMtCollins,
+  baseboard: mt_collins_board_authority,
   controller_firmware: mtcollins1_firmware,
   console: SolPresentEmitting {
     established_by: DeclarationRef { module_path: "gunbc.machine_intake_mtcollins1_32dimm_bringup_observation", decl_name: "mtcollins1_dram_training_capture", field: WholeDeclaration },
diff --git a/dag/gunbc/machine_intake/mtcollins1_access_observation.dag b/dag/gunbc/machine_intake/mtcollins1_access_observation.dag
index 008ec57db3f..47ca3369fe8 100644
--- a/dag/gunbc/machine_intake/mtcollins1_access_observation.dag
+++ b/dag/gunbc/machine_intake/mtcollins1_access_observation.dag
@@ -1,10 +1,10 @@
 module gunbc.machine_intake_mtcollins1_access_observation
 
+import extdeps.board_authority { BoardFruIdentity, BoardFruRead }
 import std.types { EpochMs, Int, NonEmptyStr, String }
 import std.measure { Second, second }
 import extdeps.bmc.ipmi_boot_selection { IpmiBootCdrom, IpmiBootSelection, aarch64_uefi_once_boot_selection }
 import std.content_hash { ContentHash, Sha256Digest, Sha256Hash }
-import extdeps.boards.types { AmpereMtCollins }
 import extdeps.bmc.endpoint { AmiMegaRac, BmcControllerEndpoint }
 import extdeps.bmc.capability {
   BmcFirmwareReleaseCapabilityRow,
@@ -110,7 +110,11 @@ data mtcollins1_firmware: BmcFirmwareReleaseIdentity = BmcFirmwareReleaseIdentit
 // all join on one physical box — that join is what makes this an observation OF A UNIT rather than
 // of an address.
 data mtcollins1_identity: BmcObservedIdentity = BmcObservedIdentity {
-  baseboard: AmpereMtCollins,
+  board: BoardFruRead { fru: BoardFruIdentity {
+    manufacturer: "FOXCONN",
+    product: "Mt. Collins",
+    part_number: Present { value: "02030A800-600-G" },
+  } },
   chassis_part_number: Present { value: "1A624RA00-600-G" },
   firmware: mtcollins1_firmware,
 }
@@ -295,7 +299,7 @@ data mtcollins1_capability_row: BmcFirmwareReleaseCapabilityRow = BmcFirmwareRel
 
 // THE BOUND ON ONE READ-ONLY ipmitool EXCHANGE WITH THIS UNIT'S CONTROLLER, as `timeout --kill-after`
 // operands. A fact about reaching this BMC, not about any one run that reads it: the boot's diagnostic
-// bundle, its media attach and the UI bundle observation all bound their IPMI reads by it. It lives
+// bundle and its media attach bound their IPMI reads by it. It lives
 // here, with the endpoint it bounds, so a read-only mode does not import the boot closure to learn it.
 data mtcollins1_boot_ipmi_read_deadline: Second = second(count: 20)
 
diff --git a/dag/gunbc/machine_intake/mtcollins1_boot_diagnostic_bundle.dag b/dag/gunbc/machine_intake/mtcollins1_boot_diagnostic_bundle.dag
index 3dfb962c66c..3b10898b7b6 100644
--- a/dag/gunbc/machine_intake/mtcollins1_boot_diagnostic_bundle.dag
+++ b/dag/gunbc/machine_intake/mtcollins1_boot_diagnostic_bundle.dag
@@ -127,10 +127,7 @@ import gunbc.machine_intake_megarac_media_attach {
   CdErrorRead,
   CdErrorUnread,
   CdErrorNone,
-  CdErrorUncatalogued,
-  CdErrorStopReason,
-  MegaRacPresentationStopped,
-  stop_reason_text,
+  CdErrorNonzero,
   megarac_share_type_wire,
   MegaRacSessionRefused,
   MegaRacSessionTokenUnreadable,
@@ -506,8 +503,7 @@ fn stale_power_off_text(record: StaleMediumPowerOff) -> String {
 fn cd_reading_text(r: CdErrorReading) -> String {
   match r {
     CdErrorRead { code: CdErrorNone } => "0"
-    CdErrorRead { code: CdErrorStopReason { status: st, class: k } } => concat(to_string(st.code), concat(" ", stop_reason_text(status: st, class: k)))
-    CdErrorRead { code: CdErrorUncatalogued { wire: w } } => concat(to_string(w), " (uncatalogued)")
+    CdErrorRead { code: CdErrorNonzero { wire: w, firmware: _ } } => concat(to_string(w), " (observed; no meaning established)")
     CdErrorUnread { detail: d } => concat("UNREAD: ", d)
   }
 }
@@ -597,8 +593,6 @@ fn media_attach_outcome_reason(outcome: MegaRacAttachOutcome) -> String? {
       Present { value: join(["the presentation of '", n as String, "' did not reach Started with a bound session before ", to_string(d), " (", to_string(k), " looks, route: ", attach_route_text(route: r), "); last look ", readiness_look_text(l: l), "; cd_error_code before any write ", cd_reading_text(r: cb), ", at refusal ", cd_reading_text(r: ca), ". No boot-device or power handoff was made"], "") }
     MegaRacReadinessRefused { image_name: n, route: r, look: l, looks: k, cd_before_any_write: cb, cd_at_refusal: ca } =>
       Present { value: join(["the presentation of '", n as String, "' was refused by the readiness policy after ", to_string(k), " looks (route: ", attach_route_text(route: r), "): ", readiness_look_text(l: l), "; cd_error_code before any write ", cd_reading_text(r: cb), ", at refusal ", cd_reading_text(r: ca), ". No boot-device or power handoff was made"], "") }
-    MegaRacPresentationStopped { image_name: n, route: r, look: l, looks: k, cd_before_any_write: cb, stop: st, class: c, general_at_refusal: g } =>
-      Present { value: join(["the presentation of '", n as String, "' is ", stop_reason_text(status: st, class: c), " after ", to_string(k), " looks (route: ", attach_route_text(route: r), "): ", readiness_look_text(l: l), "; cd_error_code before any write ", cd_reading_text(r: cb), " (general settings ", raw_read_text(r: g), "). No boot-device or power handoff was made"], "") }
     MegaRacReadinessClockUnreadable { image_name: n, route: r, detail: d } =>
       Present { value: join(["the clock could not be read, so the readiness window for '", n as String, "' could not be declared or judged: ", d, " (route: ", attach_route_text(route: r), ")"], "") }
     MegaRacConfigurationsUnreadable { detail: d } =>
@@ -638,7 +632,7 @@ fn media_attach_outcome_reason(outcome: MegaRacAttachOutcome) -> String? {
     MegaRacOfferedAmbiguouslyAfterDetach { image_name: n, image_indices: ids, detach: x } =>
       Present { value: join(["after the stale image was stopped (", detach_evidence_text(detach: x), "), the controller offers '", n as String, "' more than once (image_index ", join(ids, ", "), "), so which file would be attached is the controller's enumeration order; nothing further was written"], "") }
     MegaRacMediaStateUnestablished { image_name: n, route: r, look: l, looks: k, cd_before_any_write: cb, cd_at_ready: ca, general_at_ready: g } =>
-      Present { value: join(["this attempt cannot establish the media state of '", n as String, "': the presentation read Started (", readiness_look_text(l: l), ", ", to_string(k), " looks, route: ", attach_route_text(route: r), ") but cd_error_code before any write was ", cd_reading_text(r: cb), " and at readiness ", cd_reading_text(r: ca), " (general settings ", raw_read_text(r: g), "). A code outside the firmware UI's stop-reason table (extdeps.bmc.megarac megarac_rmedia_status_0_32), or an unread one, has no vendor meaning, so this is a knowledge refusal, not a controller verdict. No boot-device or power handoff was made"], "") }
+      Present { value: join(["this attempt cannot establish the media state of '", n as String, "': the presentation read Started (", readiness_look_text(l: l), ", ", to_string(k), " looks, route: ", attach_route_text(route: r), ") but cd_error_code before any write was ", cd_reading_text(r: cb), " and at readiness ", cd_reading_text(r: ca), " (general settings ", raw_read_text(r: g), "). A code other than 0, or 16 on the build an executed receipt grounded it for, or an unread one, has no established meaning, so this is a knowledge refusal, not a controller verdict. No boot-device or power handoff was made"], "") }
     MegaRacMediaStateUnestablishedBeforeWrite { cd_before_any_write: cb, reason: why } =>
       Present { value: join(["this attempt cannot establish the media state, and nothing was written: cd_error_code before any write was ", cd_reading_text(r: cb), "; ", why as String], "") }
     MegaRacReadinessClockIncoherent { image_name: n, route: rt, opened_at: o, previous: p, look: l, looks: k } =>
diff --git a/dag/gunbc/machine_intake/mtcollins1_boot_dry_realization.dag b/dag/gunbc/machine_intake/mtcollins1_boot_dry_realization.dag
index 65de04f0baa..80d177690bf 100644
--- a/dag/gunbc/machine_intake/mtcollins1_boot_dry_realization.dag
+++ b/dag/gunbc/machine_intake/mtcollins1_boot_dry_realization.dag
@@ -32,12 +32,6 @@ import extdeps.units.iso8601_calendar { iso8601_utc_text }
 import std.checked_arithmetic { checked_int_to_nat }
 import std.measure { millisecond }
 import v2.std.operation_argv { InputText, InputTextList }
-import gunbc.machine_intake_megarac_kvm_still {
-  KvmInstant, KvmJournalEvent, KvmJournalRendered, KvmJournalRenderRefused, kvm_journal_line,
-  KvmJournalConnectionRequested, KvmJournalConnectionOpen, KvmJournalEstablished, KvmJournalStill,
-  KvmJournalStopRequested, KvmJournalSessionRelease, KvmJournalBrowserClose, KvmJournalStopped,
-  KvmJournalRefused, KvmNoFrame,
-}
 
 // THE DRY REALIZATION OF ONE mtcollins1 BOOT ATTEMPT'S WHOLE EFFECT DEMAND. The scenario world
 // composes the one BMC model with what the worker running the attempt has around it: its filesystem
@@ -57,7 +51,6 @@ type MtCollins1BootWorld {
   worker: ModeledWorker
   console: ModeledHostConsole
   media: MegaRacMediaWorld
-  screen: ModeledKvmViewer
 }
 
 // THE WORKER'S SSH AGENT: whether it holds the fleet automation key. Its listing follows
@@ -115,23 +108,23 @@ type ModeledHostConsole {
 }
 
 fn with_bmc(w: MtCollins1BootWorld, bmc: BmcWorld) -> MtCollins1BootWorld {
-  MtCollins1BootWorld { bmc: bmc, fs: w.fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: w.media, screen: w.screen }
+  MtCollins1BootWorld { bmc: bmc, fs: w.fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: w.media }
 }
 
 fn with_fs(w: MtCollins1BootWorld, fs: ModeledFilesystem) -> MtCollins1BootWorld {
-  MtCollins1BootWorld { bmc: w.bmc, fs: fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: w.media, screen: w.screen }
+  MtCollins1BootWorld { bmc: w.bmc, fs: fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: w.media }
 }
 
 fn with_worker(w: MtCollins1BootWorld, worker: ModeledWorker) -> MtCollins1BootWorld {
-  MtCollins1BootWorld { bmc: w.bmc, fs: w.fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: worker, console: w.console, media: w.media, screen: w.screen }
+  MtCollins1BootWorld { bmc: w.bmc, fs: w.fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: worker, console: w.console, media: w.media }
 }
 
 fn with_console(w: MtCollins1BootWorld, console: ModeledHostConsole) -> MtCollins1BootWorld {
-  MtCollins1BootWorld { bmc: w.bmc, fs: w.fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: console, media: w.media, screen: w.screen }
+  MtCollins1BootWorld { bmc: w.bmc, fs: w.fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: console, media: w.media }
 }
 
 fn with_media(w: MtCollins1BootWorld, media: MegaRacMediaWorld) -> MtCollins1BootWorld {
-  MtCollins1BootWorld { bmc: w.bmc, fs: w.fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: media, screen: w.screen }
+  MtCollins1BootWorld { bmc: w.bmc, fs: w.fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: media }
 }
 
 fn appended(fs: ModeledFilesystem, path: String, text: String) -> ModeledFilesystem {
@@ -247,7 +240,7 @@ fn with_notice_watcher(w: MtCollins1BootWorld, capture_path: String, token: Stri
   let p = ModeledProcess { pid: w.worker.next_pid, start_time: start_ticks(w: w, now: second(count: 0)), comm: "bash", cmdline: "bash -c gunbc-sol-notice-watch", capture_path: capture_path, diagnostic_path: "", alive: true }
   let fs = fs_with_file(fs: fs_with_file(fs: w.fs, path: concat(capture_path, mtcollins1_sol_notice_ready_suffix), content: concat(token, "\n")), path: mtcollins1_sol_notice_watcher_path(capture_path: capture_path), content: process_identity(p: p))
   let env = list_snoc_item(xs: w.environment, item: ModeledVariable { name: mtcollins1_sol_notice_token_env as String, value: token })
-  started(w: MtCollins1BootWorld { bmc: w.bmc, fs: w.fs, environment: env, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: w.media, screen: w.screen }, p: p, fs: fs)
+  started(w: MtCollins1BootWorld { bmc: w.bmc, fs: w.fs, environment: env, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: w.media }, p: p, fs: fs)
 }
 
 fn exited_step<S>(state: S, stdout: String, exit_code: Int) -> OperationStep<S> {
@@ -399,262 +392,7 @@ fn boot_world_idle(w: MtCollins1BootWorld) -> Bool {
 
 fn boot_advance(w: MtCollins1BootWorld, now: Second) -> MtCollins1BootWorld {
   let stepped = if boot_world_idle(w: w) { w } else { with_media(w: with_bmc(w: w, bmc: bmc_advance(world: w.bmc, now: now)), media: megarac_media_advance(world: w.media, now: now)) }
-  kvm_observers_advance(w: console_advance(w: collectors_follow_session(w: stepped), now: now), now: now)
-}
-
-// THE BMC KVM VIEWER AND THE OBSERVER HELD AGAINST IT (gunbc#12492: the boot's handoff is admitted
-// only while the observer it started is established). The observer is the process
-// gunbc.owned_process LaunchOwned starts over gunbc.machine_intake_megarac_kvm_still
-// kvm_observer_launch_in's node command. The model starts it the way the launch does -- a live process
-// in /proc, its "<pid> <start>" record at the pid path -- and writes its journal ONLY through
-// kvm_journal_line, the writer the production parser is the inverse of, so the dry observer cannot
-// speak a grammar the boot does not read. A line kvm_journal_line refuses is a harness fault, never a
-// line written anyway.
-//
-// What it answers, as the observer script does once the viewer's /kvm socket delivers a frame: the
-// connection lines, then established with the quoted host:port the base URL names, the viewer
-// session, the attempt and the generation; then, while it lives, one still per trigger file (the
-// script's 'trigger:'+name reason) and, on the stop file, stop-requested, the session release, the
-// browser close and stopped, after which the process has exited. It takes no periodic still: the
-// boot's attempt ends well inside megarac_kvm_observer_cadence's first period in every scenario
-// the matrix runs, and a longer one reports the gap through kvm_still_gaps as the real journal would.
-//
-// A still's bytes are one fixed modeled frame, and its digest is supplied beside it (the precedent is
-// gunbc.remote_host_model ModeledRemoteFile.sha256): sha256sum answers that digest for exactly those
-// bytes, reports a missing file as sha256sum does, and refuses as a harness fault for any other bytes
-// rather than inventing a digest.
-type ModeledKvmViewer {
-  session: String
-  still_bytes: String
-  still_sha256: String
-  observers: List<ModeledKvmObserver>
-}
-
-type ModeledKvmObserver {
-  pid: Int
-  dir: String
-  seq: Int
-  seen_files: Int
-}
-
-// printf '%s' '<modeled kvm still jpeg>' | sha256sum
-fn healthy_kvm_viewer() -> ModeledKvmViewer {
-  ModeledKvmViewer { session: "7", still_bytes: "<modeled kvm still jpeg>", still_sha256: "550277e71ddf7d978137c4bd140a9b5cfda25500b365a7375fb91db8790f584c", observers: [] }
-}
-
-fn with_screen(w: MtCollins1BootWorld, screen: ModeledKvmViewer) -> MtCollins1BootWorld {
-  MtCollins1BootWorld { bmc: w.bmc, fs: w.fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: w.media, screen: screen }
-}
-
-data kvm_observer_generation: String = "1"
-
-// The observer script writes Date.now() and its toISOString(); the model's wall clock is whole seconds.
-fn kvm_instant(w: MtCollins1BootWorld, now: Second) -> KvmInstant? {
-  let unix = wall_clock_unix(clock: w.clock, now: now)
-  match checked_int_to_nat(n: unix * 1000) {
-    Present { value: ms } => Present { value: KvmInstant { since_epoch: millisecond(count: ms), iso: concat(join(split(s: iso8601_utc_text(unix: unix), delimiter: "Z"), ""), ".000Z") } }
-    Absent => none
-  }
-}
-
-// The journal lines for these events, or the first event kvm_journal_line refuses to write.
-type KvmModeledLines
-  = KvmModeledRendered { text: String }
-  | KvmModeledRefused { event_word: String, would_write: String }
-
-fn kvm_lines(events: List<KvmJournalEvent>) -> KvmModeledLines {
-  fold(events, init: KvmModeledRendered { text: "" }, f: fn(acc, e) {
-    match acc {
-      KvmModeledRendered { text: t } => match kvm_journal_line(event: e) {
-        KvmJournalRendered { line: l } => KvmModeledRendered { text: concat(t, concat(l, "\n")) }
-        KvmJournalRenderRefused { event_word: word, would_write: line } => KvmModeledRefused { event_word: word, would_write: line }
-      }
-      refused => refused
-    }
-  })
-}
-
-fn operation_input_list(call: OperationCall, name: String) -> List<String>? {
-  fold(call.invocation.bindings, init: none, f: fn(acc, b) {
-    match acc {
-      Present { value: v } => Present { value: v }
-      Absent => if b.name == name { match b.value { InputTextList { items: xs } => Present { value: xs } InputText { text: _ } => none } } else { none }
-    }
-  })
-}
-
-// kvm_observer_launch_in's operands end the node command: base URL, user, credential path, dir,
-// attempt, cadence, frame wait, periodic limit, playwright module, viewer feature-list path.
-data kvm_observer_operand_count: Int = 10
-
-// THE VIEWER READS ITS FEATURE LIST UNGUARDED (KVM probe run 36788605665): the healthy viewer reaches
-// established only when the feature-list operand names a file the launch wrote; without one the vendor's
-// viewer throws in its KVM view's initialize() and never opens /kvm, which the observer journals as a
-// refusal for want of a frame.
-data kvm_observer_features_operand: Int = 9
-
-fn kvm_operand(command: List<String>, i: Int) -> String {
-  match command.skip(n: count(command) - kvm_observer_operand_count + i).first() { Present { value: v } => v Absent => "" }
-}
-
-fn url_host(base_url: String) -> String {
-  match split(s: base_url, delimiter: "://").skip(n: 1).first() {
-    Present { value: rest } => match split(s: rest, delimiter: "/").first() { Present { value: h } => h Absent => "" }
-    Absent => ""
-  }
-}
-
-// gunbc.owned_process LaunchOwned: starts the command detached, publishes "<pid> <starttime>" to the
-// pid path, and exits 0. The observer it starts reaches established at once in the healthy viewer.
-fn owned_launch_handler(w: MtCollins1BootWorld, call: OperationCall) -> OperationStep<MtCollins1BootWorld> {
-  match operation_input_text(invocation: call.invocation, name: "pid_path") {
-    Absent => OperationHarnessFault { reason: "LaunchOwned was dispatched without a pid path" as NonEmptyStr }
-    Present { value: pid_path } => match operation_input_list(call: call, name: "command") {
-      Absent => OperationHarnessFault { reason: "LaunchOwned was dispatched without a command" as NonEmptyStr }
-      Present { value: command } =>
-        if count(command) < kvm_observer_operand_count { OperationHarnessFault { reason: "LaunchOwned's command is not the KVM observer's; the dry worker models no other owned process" as NonEmptyStr } }
-        else { match kvm_instant(w: w, now: call.now) {
-          Absent => OperationHarnessFault { reason: "the modeled wall clock reads before the epoch" as NonEmptyStr }
-          Present { value: at } => {
-            let dir = kvm_operand(command: command, i: 3)
-            let p = ModeledProcess { pid: w.worker.next_pid, start_time: start_ticks(w: w, now: call.now), comm: "node", cmdline: join(command, " "), capture_path: "", diagnostic_path: "", alive: true }
-            let features = kvm_operand(command: command, i: kvm_observer_features_operand)
-            let seeded = features != "" && match fs_file(fs: w.fs, path: features) { Present { value: _ } => true  Absent => false }
-            let journal = if seeded {
-              kvm_lines(events: [
-                KvmJournalConnectionRequested { at: at },
-                KvmJournalConnectionOpen { at: at, gen: kvm_observer_generation },
-                KvmJournalEstablished { at: at, host: concat("\"", concat(url_host(base_url: kvm_operand(command: command, i: 0)), "\"")), session: w.screen.session, attempt: kvm_operand(command: command, i: 4), gen: kvm_observer_generation },
-              ])
-            } else {
-              kvm_lines(events: [KvmJournalRefused { at: at, refusal: KvmNoFrame { detail: "\"the viewer was opened without its feature list\"" } }])
-            }
-            match journal {
-              KvmModeledRefused { event_word: word, would_write: line } => OperationHarnessFault { reason: concat("kvm_journal_line refused the modeled ", concat(word, concat(" line: ", line))) as NonEmptyStr }
-              KvmModeledRendered { text: t } => {
-                let fs = appended(fs: fs_write(fs: w.fs, path: pid_path, content: process_identity(p: p), create_new: false).fs, path: concat(dir, "/journal"), text: t)
-                let screen = ModeledKvmViewer { session: w.screen.session, still_bytes: w.screen.still_bytes, still_sha256: w.screen.still_sha256, observers: list_snoc_item(xs: w.screen.observers, item: ModeledKvmObserver { pid: p.pid, dir: dir, seq: 0, seen_files: 0 }) }
-                exited_step(state: with_screen(w: started(w: w, p: p, fs: fs), screen: screen), stdout: "", exit_code: 0)
-              }
-            }
-          }
-        } }
-    }
-  }
-}
-
-fn kvm_observer_alive(w: MtCollins1BootWorld, o: ModeledKvmObserver) -> Bool {
-  !all(w.worker.processes, p => !(p.alive && p.pid == o.pid))
-}
-
-// THE OBSERVER'S LOOP, one pass per advance, in the script's order: the stop file ends it; otherwise
-// each trigger file, in name order, is consumed and answered with a still.
-fn kvm_observers_advance(w: MtCollins1BootWorld, now: Second) -> MtCollins1BootWorld {
-  if count(w.screen.observers) == 0 { w } else {
-    fold(w.screen.observers, init: w, f: fn(acc, o) { if kvm_observer_alive(w: acc, o: o) { kvm_observer_pass(w: acc, o: o, now: now) } else { acc } })
-  }
-}
-
-// A stop request and a trigger each arrive as a NEW file in the observer's directory, so a pass whose
-// filesystem holds the same number of files as the last pass looked at has nothing to answer: nearly
-// every dispatch of a boot is that pass, and it neither scans the files nor takes an instant. A pass
-// that does look records the count it left behind.
-fn kvm_observer_pass(w: MtCollins1BootWorld, o: ModeledKvmObserver, now: Second) -> MtCollins1BootWorld {
-  let n = count(w.fs.files)
-  if n == o.seen_files { w } else {
-    let answered = kvm_observer_look(w: w, o: o, now: now)
-    with_kvm_seen(w: answered, pid: o.pid, seen: count(answered.fs.files))
-  }
-}
-
-fn with_kvm_seen(w: MtCollins1BootWorld, pid: Int, seen: Int) -> MtCollins1BootWorld {
-  with_screen(w: w, screen: ModeledKvmViewer { session: w.screen.session, still_bytes: w.screen.still_bytes, still_sha256: w.screen.still_sha256, observers: map(w.screen.observers, o => if o.pid == pid { ModeledKvmObserver { pid: o.pid, dir: o.dir, seq: o.seq, seen_files: seen } } else { o }) })
-}
-
-// The instant is taken only when a line is written.
-fn kvm_observer_look(w: MtCollins1BootWorld, o: ModeledKvmObserver, now: Second) -> MtCollins1BootWorld {
-  match fs_file(fs: w.fs, path: concat(o.dir, "/stop")) {
-    Present { value: _ } => match kvm_instant(w: w, now: now) {
-      Present { value: at } => kvm_observer_stopped(w: w, o: o, at: at)
-      Absent => w
-    }
-    Absent => {
-      let triggers = kvm_trigger_files(w: w, o: o)
-      if count(triggers) == 0 { w } else {
-        match kvm_instant(w: w, now: now) {
-          Present { value: at } => kvm_observer_answer_triggers(w: w, o: o, at: at, triggers: triggers)
-          Absent => w
-        }
-      }
-    }
-  }
-}
-
-fn kvm_journal_appended(w: MtCollins1BootWorld, o: ModeledKvmObserver, events: List<KvmJournalEvent>) -> MtCollins1BootWorld {
-  match kvm_lines(events: events) {
-    KvmModeledRendered { text: t } => with_fs(w: w, fs: appended(fs: w.fs, path: concat(o.dir, "/journal"), text: t))
-    KvmModeledRefused { event_word: _, would_write: _ } => w
-  }
-}
-
-fn kvm_observer_stopped(w: MtCollins1BootWorld, o: ModeledKvmObserver, at: KvmInstant) -> MtCollins1BootWorld {
-  let journalled = kvm_journal_appended(w: w, o: o, events: [
-    KvmJournalStopRequested { at: at, by: "stop-file" },
-    KvmJournalSessionRelease { at: at, result: "released" },
-    KvmJournalBrowserClose { at: at, result: "closed" },
-    KvmJournalStopped { at: at, session: "released", browser: "closed" },
-  ])
-  exit_processes(w: journalled, ending: fn(p) { p.pid == o.pid })
-}
-
-fn kvm_trigger_files(w: MtCollins1BootWorld, o: ModeledKvmObserver) -> List<String> {
-  map(filter(w.fs.files, f => starts_with(s: f.path, prefix: concat(o.dir, "/trigger-"))), f => f.path).sort_by(p => p)
-}
-
-fn kvm_observer_answer_triggers(w: MtCollins1BootWorld, o: ModeledKvmObserver, at: KvmInstant, triggers: List<String>) -> MtCollins1BootWorld {
-  if count(triggers) == 0 { w } else {
-    let answered = fold(triggers, init: w, f: fn(acc, path) {
-      let seq = kvm_observer_seq(w: acc, pid: o.pid) + 1
-      let file = concat("still-", concat(to_string(seq), ".jpg"))
-      let name = join(split(s: path, delimiter: concat(o.dir, "/trigger-")), "")
-      let consumed = with_fs(w: acc, fs: fs_with_file(fs: fs_without_file(fs: acc.fs, path: path), path: concat(o.dir, concat("/", file)), content: acc.screen.still_bytes))
-      with_kvm_seq(w: kvm_journal_appended(w: consumed, o: o, events: [KvmJournalStill { at: at, seq: to_string(seq), reason: concat("trigger:", name), file: file, gen: kvm_observer_generation }]), pid: o.pid, seq: seq)
-    })
-    answered
-  }
-}
-
-fn kvm_observer_seq(w: MtCollins1BootWorld, pid: Int) -> Int {
-  fold(w.screen.observers, init: 0, f: fn(acc, o) { if o.pid == pid { o.seq } else { acc } })
-}
-
-fn with_kvm_seq(w: MtCollins1BootWorld, pid: Int, seq: Int) -> MtCollins1BootWorld {
-  with_screen(w: w, screen: ModeledKvmViewer { session: w.screen.session, still_bytes: w.screen.still_bytes, still_sha256: w.screen.still_sha256, observers: map(w.screen.observers, o => if o.pid == pid { ModeledKvmObserver { pid: o.pid, dir: o.dir, seq: seq, seen_files: o.seen_files } } else { o }) })
-}
-
-data owned_process_launch_operation: OperationRef = OperationRef {
-  path: "dag/gunbc/owned_process.dag",
-  service: "gunbc.owned_process.launch",
-  operation: "LaunchOwned",
-}
-
-data sha256sum_digest_file_operation: OperationRef = OperationRef {
-  path: "dag/extdeps/tools/sha256sum.dag",
-  service: "sha256sum.Sha256",
-  operation: "DigestFile",
-}
-
-// sha256sum(1): "<digest>  <path>" and exit 0; a missing file is "No such file or directory", exit 1.
-fn digest_file_handler(w: MtCollins1BootWorld, call: OperationCall) -> OperationStep<MtCollins1BootWorld> {
-  match operation_input_text(invocation: call.invocation, name: "path") {
-    Absent => OperationHarnessFault { reason: "DigestFile was dispatched without a path" as NonEmptyStr }
-    Present { value: path } => match fs_file(fs: w.fs, path: path) {
-      Absent => OperationObserved { observation: ShellObserved { observation: ShellProcessExited { exit_code: 1, stdout: "", stderr: concat("sha256sum: ", concat(path, ": No such file or directory\n")) } }, state: w, elapsed: second(count: 0) }
-      Present { value: f } =>
-        if f.content == w.screen.still_bytes { exited_step(state: w, stdout: concat(w.screen.still_sha256, concat("  ", concat(path, "\n"))), exit_code: 0) }
-        else { OperationHarnessFault { reason: concat("no digest is modeled for the bytes of ", path) as NonEmptyStr } }
-    }
-  }
+  console_advance(w: collectors_follow_session(w: stepped), now: now)
 }
 
 data sol_hold_activate_held_operation: OperationRef = OperationRef {
@@ -712,8 +450,6 @@ fn mtcollins1_boot_dry_realization(identity: NonEmptyStr, initial: MtCollins1Boo
     OperationBinding { at: sol_hold_release_held_operation, handler: sol_release_held_handler },
     OperationBinding { at: linux_procfs_read_uptime_operation, handler: uptime_handler },
     OperationBinding { at: os_hostname_read_short_operation, handler: hostname_handler },
-    OperationBinding { at: owned_process_launch_operation, handler: owned_launch_handler },
-    OperationBinding { at: sha256sum_digest_file_operation, handler: digest_file_handler },
   ]
   OperationRealization {
     identity: identity,
diff --git a/dag/gunbc/machine_intake/mtcollins1_boot_run.dag b/dag/gunbc/machine_intake/mtcollins1_boot_run.dag
index 1348fceb4f2..b6d3a2e0c2d 100644
--- a/dag/gunbc/machine_intake/mtcollins1_boot_run.dag
+++ b/dag/gunbc/machine_intake/mtcollins1_boot_run.dag
@@ -20,7 +20,8 @@ import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
 import gunbc.machine_intake_mtcollins1_census_medium_readback {
   mtcollins1_census_medium_readback, mtcollins1_census_readback_refusal_before_filing, mtcollins1_census_readback_refusal_before_attach,
 }
-import gunbc.boot_medium { BootMedium, BootMediumNoTerminal, BootMediumVolumeLabel, bmc_boot_image_export }
+import gunbc.boot_medium { BootMedium, BootMediumNoTerminal, BootMediumVolumeLabel, BootMediumRunnerHostUp, bmc_boot_image_export }
+import gunbc.runner.runner_host_medium { RunnerHostUp, RunnerHostUpRefusal, RunnerHostUpPending, RunnerHostUpRefused, RunnerHostUpObserved, runner_host_up_readback, runner_host_up_refusal_text }
 import gunbc.machine_intake_mtcollins1_census_image { mtcollins1_boot_medium, mtcollins1_census_image_stem }
 import gunbc.managed_host_boot {
   AdmittedBootSubject, BootSubjectAdmitted, BootSubjectRefused,
@@ -46,7 +47,7 @@ import gunbc.managed_host_boot_phase_timing {
   BootPhaseRunResult, PhaseVerified, PhaseRefused, BootPhaseStep, PhaseStepRan, PhaseStepSkipped, BootRoute,
   boot_phase_timing_of, boot_route_sol_refused, boot_smpro_pass_result,
 }
-import extdeps.linux.proc_uptime { proc_uptime_read, UptimeObserved, UptimeRefused }
+import extdeps.linux.proc_uptime { ProcUptimeRead, proc_uptime_read, UptimeObserved, UptimeRefused }
 import gunbc.machine_intake_oob_boot_handoff { oob_power_readback_allowance }
 import gunbc.machine_intake_mtcollins1_boot_milestone { mtcollins1_boot_topology_expectation }
 import gunbc.managed_host_boot_milestone {
@@ -89,8 +90,10 @@ import gunbc.machine_intake_ampere_smpro_observation {
 import gunbc.machine_intake_mtcollins1_smpro_observation { mtcollins1_smpro_site }
 import gunbc.fleet_host_identity { operator_host_mtcollins1 }
 import gunbc.managed_host {
-  managed_hosts, managed_host_binding, managed_host_smpro_subject,
+  ManagedHost,
+  managed_host_binding, managed_host_smpro_subject, managed_membership_for,
   ManagedHostBound, ManagedHostAccessUnobserved, ManagedHostNotSecured, ManagedHostEndpointMismatch,
+  OrdinaryMember, MemberUnderDeclaredDrop,
 }
 import extdeps.bmc.ipmi_boot_selection { IpmiBootSelection }
 import extdeps.bmc.ipmi_chassis_control { ChassisPowerObservation, chassis_observation_text }
@@ -119,7 +122,7 @@ import gunbc.owned_process { owned_process_record, OwnedRecorded, OwnedUnrecorde
 import gunbc.runner_browser_toolchain { runner_browser_toolchain_here_wet, RunnerBrowserToolchainResolution }
 import gunbc.machine_intake_megarac_kvm_still {
   KvmObserverStart, KvmObserverStarted, KvmObserverNotStarted, KvmObserverRecord, KvmJournalEvent,
-  KvmHandoffAdmitted, KvmHandoffRefused, kvm_handoff_admission, kvm_observer_standing_now, kvm_standing_text,
+  kvm_observer_standing_now, kvm_standing_text,
   KvmObserverStanding, KvmObserverProcessNotRunning, KvmObserverJournalUnread, KvmObserverStopped,
   KvmObserverEstablished, KvmObserverLost, KvmObserverMismatch, KvmObserverRefused, KvmObserverFailed, KvmObserverPending,
   megarac_kvm_observer_start, megarac_kvm_observer_finish, kvm_observer_trigger, kvm_observer_record_not_started,
@@ -845,6 +848,7 @@ fn mtcollins1_boot_medium_refusal(medium: BootMedium) -> String? {
     BootMediumNoTerminal { reason: r } =>
       Present { value: concat("mtcollins1 boot: the boot medium ", medium.image_name as String, " prints no terminal (", r as String, "), so no census terminal can be observed; switch mtcollins1_boot_medium to the published census image (census stage 0D) -- controller untouched") }
     BootMediumVolumeLabel { label: _ } => none
+    BootMediumRunnerHostUp { label: _ } => none
   }
 }
 
@@ -865,6 +869,7 @@ fn mtcollins1_boot_medium_refusal(medium: BootMedium) -> String? {
 type MtCollins1BootTerminalCause
   = TerminalMediumPrintsNoTerminal { image: NonEmptyStr, reason: NonEmptyStr }
   | TerminalCaptureUnbound { reason: String }
+  | TerminalRunnerHostNotUp { refusals: List<RunnerHostUpRefusal> }
   | TerminalSectionAbsent { name: String }
   | TerminalSectionUnterminated { name: String }
   | TerminalSectionUnobservedAtRefusal { name: String }
@@ -887,6 +892,7 @@ type MtCollins1BootTerminalVerdict
   = TerminalPending { reason: String }
   | TerminalRefused { causes: List<MtCollins1BootTerminalCause> }
   | TerminalAccepted { run: HostCaptureRunIdentity, threads: HardwareThreadCount }
+  | TerminalRunnerHostAccepted { up: RunnerHostUp }
 
 // ONE QUALIFICATION READ AS ONE OF THREE: still being written, refused with a cause, or held.
 type TerminalQualification
@@ -1281,6 +1287,11 @@ fn mtcollins1_boot_terminal_verdict(capture: String, subject: AdmittedBootSubjec
         HostCaptureOpen { envelope: envelope } => terminal_over_open(envelope: envelope, topology: topology, label: label)
         HostCaptureBound { envelope: envelope } => terminal_over_closed(envelope: envelope, topology: topology, label: label)
       }
+    BootMediumRunnerHostUp { label: _ } => match runner_host_up_readback(capture: capture, subject: subject) {
+      RunnerHostUpPending { reason: r } => TerminalPending { reason: r }
+      RunnerHostUpRefused { refusals: rs } => TerminalRefused { causes: [TerminalRunnerHostNotUp { refusals: rs }] }
+      RunnerHostUpObserved { up: up } => TerminalRunnerHostAccepted { up: up }
+    }
   }
 }
 
@@ -1289,6 +1300,7 @@ fn mtcollins1_boot_terminal_cause_text(cause: MtCollins1BootTerminalCause) -> St
     TerminalMediumPrintsNoTerminal { image: i, reason: r } =>
       concat("the admitted medium ", i as String, " prints no terminal: ", r as String)
     TerminalCaptureUnbound { reason: r } => concat("capture does not bind: ", r)
+    TerminalRunnerHostNotUp { refusals: rs } => concat("runner host not up: ", join(map(rs, x => runner_host_up_refusal_text(refusal: x)), "; "))
     TerminalSectionAbsent { name: n } => concat("closed envelope carries no ", n, " section")
     TerminalSectionUnterminated { name: n } => concat("closed envelope's ", n, " section never printed its EXIT line")
     TerminalSectionUnobservedAtRefusal { name: n } => concat(n, " not yet observed when the open envelope refused; unqualified")
@@ -1438,6 +1450,7 @@ fn sol_client_diagnostics_text(client: SolClientDiagnostics) -> String {
 // collector is not "still waiting", it is ObservationChannelLost.
 type WatchTick
   = WatchAccepted
+  | WatchRunnerHostAccepted { up: RunnerHostUp }
   | WatchRefused { causes: List<MtCollins1BootTerminalCause> }
   | WatchChannelLost { collector: SolCollectorObservation, client: SolClientDiagnostics, last: String }
   | WatchContinue { reason: String }
@@ -1450,6 +1463,7 @@ fn watch_tick(verdict: MtCollins1BootTerminalVerdict, channel: SolChannelReading
         SolChannelNotLive { collector: l, client: c } => WatchChannelLost { collector: l, client: c, last: why }
       }
     TerminalAccepted { run: _, threads: _ } => WatchAccepted
+    TerminalRunnerHostAccepted { up: up } => WatchRunnerHostAccepted { up: up }
     TerminalRefused { causes: cs } => WatchRefused { causes: cs }
   }
 }
@@ -1649,6 +1663,24 @@ fn mtcollins1_sol_supervised(stage: SolLossStage, pid_path: String, capture_path
   }
 }
 
+// THE HANDOFF'S REQUIRED OBSERVER IS THE SOL COLLECTOR OF THIS RUN (gunbc.rung_drop
+// handoff_observer_is_sol_not_kvm_viewer, operator decision msg_bb46c20f over gunbc#12492). The handoff is
+// admitted only over the SolHeldAt that mtcollins1_sol_supervised returned for THIS attempt's collector
+// (its pid and capture paths are the attempt's), and with no SOL observation the handoff refuses: this is
+// a typed admission over a run-bound observation, never an open gate. The KVM viewer that #12492 also
+// required is not started in public (megarac_kvm_observer_start answers NotStarted), so it is no longer
+// a precondition.
+type SolHandoffAdmission
+  = SolHandoffAdmitted { held_at: NonEmptyStr }
+  | SolHandoffRefused { cause: String }
+
+fn sol_handoff_admission(sol: SolSupervision) -> SolHandoffAdmission {
+  match sol {
+    SolHeldAt { at: a } => SolHandoffAdmitted { held_at: a }
+    SolLostAt { outcome: o } => SolHandoffRefused { cause: sol_supervision_refusal_reason(outcome: o) as String }
+  }
+}
+
 // A supervision refusal's reason, as the media record's non-empty reason.
 fn sol_supervision_refusal_reason(outcome: ProcessExit) -> NonEmptyStr {
   match outcome {
@@ -1767,8 +1799,9 @@ fn mtcollins1_boot_await_capture_terminal(
   let reported = mtcollins1_boot_screen_boundary_report(screen: screen, already: screen_reported)
   let ended = match seen.phase { CensusEnded => true _ => false }
   match watch_tick(verdict: seen.verdict, channel: seen.channel) {
-    WatchAccepted => TerminalWatch { outcome: ExitSuccess, census_ended: ended, smpro_census: smpro_census, screen_reported: reported }
-    WatchRefused { causes: causes } => TerminalWatch { outcome: exit_failure(reason: mtcollins1_boot_terminal_refusal_text(causes: causes)), census_ended: ended, smpro_census: smpro_census, screen_reported: reported }
+    WatchAccepted => TerminalWatch { outcome: ExitSuccess, census_ended: ended, smpro_census: smpro_census, screen_reported: reported, runner_host: none }
+    WatchRunnerHostAccepted { up: up } => TerminalWatch { outcome: ExitSuccess, census_ended: ended, smpro_census: smpro_census, screen_reported: reported, runner_host: Present { value: up } }
+    WatchRefused { causes: causes } => TerminalWatch { outcome: exit_failure(reason: mtcollins1_boot_terminal_refusal_text(causes: causes)), census_ended: ended, smpro_census: smpro_census, screen_reported: reported, runner_host: none }
     WatchChannelLost { collector: l, client: c, last: why } => {
       let lost = mtcollins1_boot_channel_lost(
         loss: SolObservationLoss { stage: SolLostDuringWatch, last_live_at: last_live_at, observed_gone_at: seen.at, collector: l, client: c, last_capture_observation: why },
@@ -1776,15 +1809,15 @@ fn mtcollins1_boot_await_capture_terminal(
         password_file: password_file,
         screen: Present { value: screen },
       )
-      TerminalWatch { outcome: exit_failure(reason: observation_channel_lost_text(lost: lost)), census_ended: ended, smpro_census: smpro_census, screen_reported: reported }
+      TerminalWatch { outcome: exit_failure(reason: observation_channel_lost_text(lost: lost)), census_ended: ended, smpro_census: smpro_census, screen_reported: reported, runner_host: none }
     }
     WatchContinue { reason: why } => {
       match mtcollins1_sol_observer_refusal(capture_path: capture_path) {
-        Present { value: gone } => return TerminalWatch { outcome: exit_failure(reason: concat(gone, "; observed during the capture watch, so the watch stops rather than continuing unreported")), census_ended: ended, smpro_census: smpro_census, screen_reported: reported }
+        Present { value: gone } => return TerminalWatch { outcome: exit_failure(reason: concat(gone, "; observed during the capture watch, so the watch stops rather than continuing unreported")), census_ended: ended, smpro_census: smpro_census, screen_reported: reported, runner_host: none }
         _ => {}
       }
       if remaining <= 0 {
-        TerminalWatch { outcome: exit_failure(reason: concat("mtcollins1 boot: deadline reached without a host-capture terminal; last observation: ", why, "; capture preserved; claim will abort, not complete")), census_ended: ended, smpro_census: smpro_census, screen_reported: reported }
+        TerminalWatch { outcome: exit_failure(reason: concat("mtcollins1 boot: deadline reached without a host-capture terminal; last observation: ", why, "; capture preserved; claim will abort, not complete")), census_ended: ended, smpro_census: smpro_census, screen_reported: reported, runner_host: none }
       } else {
         let census_pass = match smpro_census {
           SmproNotTaken { reason: _ } => match seen.phase {
@@ -1829,11 +1862,15 @@ fn mtcollins1_census_phase(capture: String, subject: AdmittedBootSubject) -> Cen
   }
 }
 
+// runner_host IS THE ONE ACCEPTED RUNNER-HOST READING (gunbc.runner.runner_host_medium RunnerHostUp),
+// carried whole so the qualification receipt's GuestIdleMeminfoAndNproc reads it here rather than
+// re-parsing the capture; none for every other medium and every non-accepting end.
 type TerminalWatch {
   outcome: ProcessExit
   census_ended: Bool
   smpro_census: SmproReading
   screen_reported: List<String>
+  runner_host: RunnerHostUp?
 }
 
 // THE SCREEN'S BOUNDARY, REPORTED IN THE TICK AND BEFORE ANY OPTIONAL READ (acceptance (b)). Every
@@ -1880,12 +1917,8 @@ fn mtcollins1_boot_screen_liveness_lines(standing: KvmObserverStanding) -> List<
 // the boot parameter 5 read and before the attach, so the phase clock counts its bounded wait
 // (megarac_kvm_observer_establish_wait) inside media_attach. Bound to the BMC host, the web session
 // it logs in with (the established line carries its id) and the attempt. The toolchain is resolved,
-// never assumed (gunbc.runner_browser_toolchain). FOR THIS DIAGNOSTIC PROFILE THE OBSERVER IS
-// REQUIRED: mtcollins1_boot_actuate re-reads it through kvm_handoff_admission immediately before the
-// handoff, and issues no handoff unless it is established for this BMC host and this attempt -- a
-// runner without the browser toolchain, a busy viewer seat, a mismatched subject or a lost connection
-// all stop the boot there, with that standing as the cause. It gates on the witness existing, never on
-// what the screen shows.
+// never assumed (gunbc.runner_browser_toolchain). // NOT REQUIRED IN PUBLIC: no public KVM client exists, so this answers NotStarted with its typed reason
+// and the record carries it; the handoff's required observer is the SOL collector (sol_handoff_admission).
 fn mtcollins1_boot_screen_start(proof: UnitHoldProof, password_file: String, attempt: String, resolve_toolchain: fn() -> RunnerBrowserToolchainResolution) -> KvmObserverStart {
   match admit_megarac_host(host: proof.subject.host, operation: MegaRacKvmCanvasStill) {
     MegaRacHostRefused { cause: c } => KvmObserverNotStarted { reason: megarac_host_refusal_text(cause: c) }
@@ -1903,22 +1936,31 @@ fn mtcollins1_boot_screen_start(proof: UnitHoldProof, password_file: String, att
 // THE PASS READS THROUGH THE MANAGED HOST'S SUBJECT (gunbc.managed_host managed_host_smpro_subject):
 // the row's bound controller joined to its SMpro site, so the reads go to the controller the site is
 // evidence about or are not taken, with the refusal as the reason.
+fn mtcollins1_boot_smpro_from_row(h: ManagedHost, username: NonEmptyStr, password_file: NonEmptyStr) -> SmproReading {
+  match managed_host_binding(host: h) {
+    ManagedHostAccessUnobserved { endpoint: _ } => SmproNotTaken { reason: "mtcollins1's controller access is unobserved, so no SMpro subject binds" }
+    ManagedHostNotSecured { cause: _ } => SmproNotTaken { reason: "mtcollins1's controller is not secured, so no SMpro subject binds" }
+    ManagedHostEndpointMismatch { observed: _, secured: _ } => SmproNotTaken { reason: "mtcollins1's access and secure standings name different controllers, so no SMpro subject binds" }
+    ManagedHostBound { binding: b } => {
+      let subject = managed_host_smpro_subject(binding: b)
+      match subject {
+        SmproPassSubjectBound { subject: s } => SmproProbed { observation: smpro_pass_probes(subject: s, username: username, password_file: password_file, deadline: mtcollins1_boot_ipmi_read_deadline, kill_after: mtcollins1_boot_ipmi_kill_after) }
+        SmproPassSiteRefused { cause: _ } => SmproNotTaken { reason: match smpro_pass_subject_refusal_text(s: subject) { Present { value: t } => t as NonEmptyStr Absent => "the SMpro site is not admitted" } }
+        SmproPassEndpointMismatch { bound: _, site: _ } => SmproNotTaken { reason: match smpro_pass_subject_refusal_text(s: subject) { Present { value: t } => t as NonEmptyStr Absent => "the SMpro site names another controller" } }
+      }
+    }
+  }
+}
+
 fn mtcollins1_boot_smpro_read(username: NonEmptyStr, password_file: NonEmptyStr) -> SmproReading {
-  match filter(managed_hosts(), h => (h.host as String) == (operator_host_mtcollins1 as String)).first() {
+  match managed_membership_for(host: operator_host_mtcollins1) {
     Absent => SmproNotTaken { reason: "mtcollins1 is not a managed host row: its secure standing is not derived" }
-    Present { value: h } => match managed_host_binding(host: h) {
-      ManagedHostAccessUnobserved { endpoint: _ } => SmproNotTaken { reason: "mtcollins1's controller access is unobserved, so no SMpro subject binds" }
-      ManagedHostNotSecured { cause: _ } => SmproNotTaken { reason: "mtcollins1's controller is not secured, so no SMpro subject binds" }
-      ManagedHostEndpointMismatch { observed: _, secured: _ } => SmproNotTaken { reason: "mtcollins1's access and secure standings name different controllers, so no SMpro subject binds" }
-      ManagedHostBound { binding: b } => {
-        let subject = managed_host_smpro_subject(binding: b)
-        match subject {
-          SmproPassSubjectBound { subject: s } => SmproProbed { observation: smpro_pass_probes(subject: s, username: username, password_file: password_file, deadline: mtcollins1_boot_ipmi_read_deadline, kill_after: mtcollins1_boot_ipmi_kill_after) }
-          SmproPassSiteRefused { cause: _ } => SmproNotTaken { reason: match smpro_pass_subject_refusal_text(s: subject) { Present { value: t } => t as NonEmptyStr Absent => "the SMpro site is not admitted" } }
-          SmproPassEndpointMismatch { bound: _, site: _ } => SmproNotTaken { reason: match smpro_pass_subject_refusal_text(s: subject) { Present { value: t } => t as NonEmptyStr Absent => "the SMpro site names another controller" } }
-        }
+    Present { value: m } =>
+      match m {
+        OrdinaryMember { host: h } => mtcollins1_boot_smpro_from_row(h: h, username: username, password_file: password_file)
+        MemberUnderDeclaredDrop { drop: _, standing_subject: _, current_subject: _, host: h } =>
+          mtcollins1_boot_smpro_from_row(h: h, username: username, password_file: password_file)
       }
-    }
   }
 }
 
@@ -1986,6 +2028,7 @@ type MtCollins1BootActuation {
   power_after: PowerAfterAttempt
   timing: BootPhaseTiming
   screen: KvmObserverRecord
+  runner_host: RunnerHostUp?
 }
 
 fn actuation_not_powered_on(outcome: ProcessExit, reason: NonEmptyStr) -> MtCollins1BootActuation {
@@ -2000,6 +2043,7 @@ fn actuation_not_powered_on(outcome: ProcessExit, reason: NonEmptyStr) -> MtColl
     power_after: PowerAfterNotTaken { reason: reason },
     screen: kvm_observer_record_not_started(attempt: "", reason: reason),
     timing: boot_phase_timing_not_taken(reason: reason),
+    runner_host: none,
   }
 }
 
@@ -2049,6 +2093,71 @@ type ActuationWatch {
   stage: MtCollins1BootActuationStage
   smpro_step: BootPhaseStep
   terminal_step: BootPhaseStep
+  runner_host: RunnerHostUp?
+}
+
+// THE ACTUATION AFTER THE WATCH, PURE: the watch's stage and its one accepted runner-host reading are
+// taken from the watch itself, so no caller can assemble an actuation that drops the reading the
+// terminal accepted. mtcollins1_boot_actuate builds its result only through this.
+fn actuation_after_watch(
+  observed: ActuationWatch,
+  media: MtCollins1MediaAttachRecord,
+  handoff_media: MtCollins1HandoffMedia,
+  end_media: MtCollins1EndMedia,
+  override_before: BootParam5Reading,
+  override_after: BootParam5Reading,
+  power_after: PowerAfterAttempt,
+  outcome: ProcessExit,
+  screen: KvmObserverRecord,
+  timing: BootPhaseTiming,
+) -> MtCollins1BootActuation {
+  MtCollins1BootActuation {
+    outcome: outcome,
+    media: media,
+    handoff_media: handoff_media,
+    end_media: end_media,
+    stage: observed.stage,
+    override_before: override_before,
+    override_after: override_after,
+    power_after: power_after,
+    timing: timing,
+    screen: screen,
+    runner_host: observed.runner_host,
+  }
+}
+
+// THE SAME ACTUATION UNDER A NEW OUTCOME (the unit hold's release), every observation carried.
+fn actuation_with_outcome(act: MtCollins1BootActuation, outcome: ProcessExit) -> MtCollins1BootActuation {
+  MtCollins1BootActuation {
+    outcome: outcome,
+    media: act.media,
+    handoff_media: act.handoff_media,
+    end_media: act.end_media,
+    stage: act.stage,
+    override_before: act.override_before,
+    override_after: act.override_after,
+    power_after: act.power_after,
+    timing: act.timing,
+    screen: act.screen,
+    runner_host: act.runner_host,
+  }
+}
+
+// THE WATCH'S RESULT AS THE ACTUATION SEES IT, PURE: the terminal watch's outcome, stage and the one
+// accepted runner-host reading pass through unchanged, so the reading the terminal accepted is the
+// reading the attempt result carries (none on every watch that did not accept a runner host).
+fn actuation_watch_of(watch: TerminalWatch, selection: IpmiBootSelection, at_power_on: SmproReading, smpro_read: ProcUptimeRead, terminal_read: ProcUptimeRead) -> ActuationWatch {
+  ActuationWatch {
+    outcome: watch.outcome,
+    stage: if watch.census_ended {
+      ActuationCensusEnded { selection: selection, smpro_power_on: at_power_on, smpro_census: watch.smpro_census }
+    } else {
+      ActuationPoweredOn { selection: selection, smpro_power_on: at_power_on, smpro_census: watch.smpro_census }
+    },
+    smpro_step: PhaseStepRan { result: smpro_phase_result(reading: at_power_on), end: smpro_read },
+    terminal_step: PhaseStepRan { result: exit_phase_result(outcome: watch.outcome), end: terminal_read },
+    runner_host: watch.runner_host,
+  }
 }
 
 // THE HANDOFF'S RESULT AND ITS ROUTE STEP, made in the one branch that issued (or skipped) it.
@@ -2344,6 +2453,7 @@ fn mtcollins1_boot_actuate(
           start: BootStartUnobserved { reason: "the SOL lease was not acquired, so nothing was written" },
           route: boot_route_sol_refused(refused_at: refused_at, cause: r),
         ),
+        runner_host: none,
       }
     }
     ExitSuccess => {
@@ -2379,13 +2489,13 @@ fn mtcollins1_boot_actuate(
         MediaGateWithheld { reason: why } => exit_failure(reason: why as String)
       }
       let attach_verified = proc_uptime_read()
-      let gated = match kvm_handoff_admission(start: screen) {
-        KvmHandoffRefused { cause: why } => MediaGatedHandoff {
-          result: boot_handoff_not_issued(outcome: exit_failure(reason: concat("mtcollins1 boot: handoff refused: the required KVM observer was not established: ", why))),
-          media: HandoffMediaNotReached { reason: concat("the required KVM observer was not established: ", why) as NonEmptyStr },
+      let gated = match sol_handoff_admission(sol: before_attach) {
+        SolHandoffRefused { cause: why } => MediaGatedHandoff {
+          result: boot_handoff_not_issued(outcome: exit_failure(reason: concat("mtcollins1 boot: handoff refused: no SOL observation of this run holds: ", why))),
+          media: HandoffMediaNotReached { reason: concat("no SOL observation of this run holds: ", why) as NonEmptyStr },
           live_at: attach_live_at,
         }
-        KvmHandoffAdmitted { session: _ } => mtcollins1_boot_handoff_when_media_ready(
+        SolHandoffAdmitted { held_at: _ } => mtcollins1_boot_handoff_when_media_ready(
           proof: proof,
           media: media,
           subject: subject,
@@ -2421,22 +2531,14 @@ fn mtcollins1_boot_actuate(
             screen_reported: [],
           )
           let terminal_read = proc_uptime_read()
-          ActuationWatch {
-            outcome: watch.outcome,
-            stage: if watch.census_ended {
-              ActuationCensusEnded { selection: subject.selection, smpro_power_on: at_power_on, smpro_census: watch.smpro_census }
-            } else {
-              ActuationPoweredOn { selection: subject.selection, smpro_power_on: at_power_on, smpro_census: watch.smpro_census }
-            },
-            smpro_step: PhaseStepRan { result: smpro_phase_result(reading: at_power_on), end: smpro_read },
-            terminal_step: PhaseStepRan { result: exit_phase_result(outcome: watch.outcome), end: terminal_read },
-          }
+          actuation_watch_of(watch: watch, selection: subject.selection, at_power_on: at_power_on, smpro_read: smpro_read, terminal_read: terminal_read)
         }
         other => ActuationWatch {
           outcome: other,
           stage: ActuationNotPoweredOn { reason: "the SOL supervision, the attach or the handoff refused, so power on was never observed" },
           smpro_step: PhaseStepSkipped { reason: "power on was never verified" },
           terminal_step: PhaseStepSkipped { reason: "power on was never verified" },
+          runner_host: none,
         }
       }
       let screen_record = megarac_kvm_observer_finish(start: screen, attempt: attempt, terminal_order: 3)
@@ -2455,7 +2557,8 @@ fn mtcollins1_boot_actuate(
       let power_after_read = proc_uptime_read()
       let teardown = mtcollins1_boot_release_sol(proof: proof, password_file: password_file, pid_path: sol_pid_path, capture_path: sol_capture_path)
       let released = proc_uptime_read()
-      MtCollins1BootActuation {
+      actuation_after_watch(
+        observed: observed,
         media: media,
         handoff_media: gated.media,
         end_media: end_media,
@@ -2467,7 +2570,6 @@ fn mtcollins1_boot_actuate(
             if sol_release_is_clean(outcome: teardown) { ExitSuccess } else { exit_failure(reason: concat("mtcollins1 boot: ", sol_release_outcome_text(outcome: teardown))) }
           other => outcome_attributing_media_loss(outcome: other, loss: media_loss_after_handoff(handoff: gated.media, end: end_media))
         },
-        stage: observed.stage,
         screen: screen_record,
         timing: boot_phase_timing_of(
           hold: hold_acquired,
@@ -2484,7 +2586,7 @@ fn mtcollins1_boot_actuate(
             sol_release: PhaseStepRan { result: sol_release_phase_result(t: teardown), end: released },
           },
         ),
-      }
+      )
     }
   }
 }
@@ -2593,7 +2695,7 @@ fn mtcollins1_boot_actuate_held(
     sol_capture_path: sol_capture_path,
     resolve_toolchain: resolve_toolchain,
   )
-  MtCollins1BootActuation { outcome: unit_hold_release(proof: proof, outcome: act.outcome), media: act.media, handoff_media: act.handoff_media, end_media: act.end_media, stage: act.stage, override_before: act.override_before, override_after: act.override_after, power_after: act.power_after, timing: act.timing, screen: act.screen }
+  actuation_with_outcome(act: act, outcome: unit_hold_release(proof: proof, outcome: act.outcome))
 }
 
 // EVERY TERMINAL ARM OF A BOOT ATTEMPT GOES THROUGH mtcollins1_boot_conclude (gunbc#12093), which
@@ -2623,6 +2725,7 @@ type MtCollins1BootAttempt {
   power_after: PowerAfterAttempt
   timing: BootPhaseTiming
   screen: KvmObserverRecord
+  runner_host: RunnerHostUp?
   configuration: AttemptConfigurationReceipt
 }
 
@@ -2633,6 +2736,26 @@ fn mtcollins1_boot_exit_reason(outcome: ProcessExit) -> String {
   }
 }
 
+// THE ACTUATION AS THE ATTEMPT RESULT, PURE: every field the actuation observed, the runner-host
+// reading among them, beside the BMC access the attempt held.
+fn mtcollins1_boot_attempt_of(act: MtCollins1BootActuation, bmc: MtCollins1BootBmcAccess, configuration: AttemptConfigurationReceipt) -> MtCollins1BootAttempt {
+  MtCollins1BootAttempt {
+    outcome: act.outcome,
+    media: act.media,
+    handoff_media: act.handoff_media,
+    end_media: act.end_media,
+    bmc: bmc,
+    stage: act.stage,
+    override_before: act.override_before,
+    override_after: act.override_after,
+    power_after: act.power_after,
+    timing: act.timing,
+    screen: act.screen,
+    runner_host: act.runner_host,
+    configuration: configuration,
+  }
+}
+
 fn mtcollins1_boot_ended_before_bmc(outcome: ProcessExit) -> MtCollins1BootAttempt {
   MtCollins1BootAttempt {
     outcome: outcome,
@@ -2646,6 +2769,7 @@ fn mtcollins1_boot_ended_before_bmc(outcome: ProcessExit) -> MtCollins1BootAttem
     power_after: PowerAfterNotTaken { reason: "the attempt ended before the unit hold" },
     timing: boot_phase_timing_not_taken(reason: "the attempt ended before the unit hold"),
     screen: kvm_observer_record_not_started(attempt: "", reason: "the attempt ended before the unit hold"),
+    runner_host: none,
     configuration: attempt_configuration_not_recorded(host: operator_host_mtcollins1 as NonEmptyStr, attempt: "not reached", reason: "the attempt ended before the unit hold, so no attempt receipt was admitted"),
   }
 }
@@ -2861,38 +2985,12 @@ fn mtcollins1_boot_on_srv1_resolving_toolchain(resolve_toolchain: fn() -> Runner
     Absent => {
       let held = mtcollins1_boot_under_live_unit_hold(run_id: run_id as NonEmptyStr, subject: subject, password_file: cred, sol_pid_path: sol_pid_path, sol_capture_path: sol_capture_path, resolve_toolchain: resolve_toolchain, baseline: fn() { baseline_not_taken(reason: "mtcollins1's BMC is not BmcSecured, so no account is modeled to read it with") })
       let act = held.actuation
-      MtCollins1BootAttempt {
-        outcome: act.outcome,
-        media: act.media,
-        handoff_media: act.handoff_media,
-        end_media: act.end_media,
-        bmc: BmcAccessNotReached { reason: "mtcollins1's BMC is not BmcSecured, so no account is modeled to read it with" },
-        stage: act.stage,
-        override_before: act.override_before,
-        override_after: act.override_after,
-        power_after: act.power_after,
-        timing: act.timing,
-        screen: act.screen,
-        configuration: held.configuration,
-      }
+      mtcollins1_boot_attempt_of(act: act, bmc: BmcAccessNotReached { reason: "mtcollins1's BMC is not BmcSecured, so no account is modeled to read it with" }, configuration: held.configuration)
     }
     Present { value: user } => {
       let held = mtcollins1_boot_under_live_unit_hold(run_id: run_id as NonEmptyStr, subject: subject, password_file: cred, sol_pid_path: sol_pid_path, sol_capture_path: sol_capture_path, resolve_toolchain: resolve_toolchain, baseline: fn() { mtcollins1_boot_baseline(username: user, password_file: cred as NonEmptyStr) })
       let act = held.actuation
-      MtCollins1BootAttempt {
-        outcome: act.outcome,
-        media: act.media,
-        handoff_media: act.handoff_media,
-        end_media: act.end_media,
-        bmc: BmcAccessHeld { username: user, password_file: cred as NonEmptyStr, password: pw_read.content, sdr_cache: held.baseline.sdr, sel_before: held.baseline.sel_before },
-        stage: act.stage,
-        override_before: act.override_before,
-        override_after: act.override_after,
-        power_after: act.power_after,
-        timing: act.timing,
-        screen: act.screen,
-        configuration: held.configuration,
-      }
+      mtcollins1_boot_attempt_of(act: act, bmc: BmcAccessHeld { username: user, password_file: cred as NonEmptyStr, password: pw_read.content, sdr_cache: held.baseline.sdr, sel_before: held.baseline.sel_before }, configuration: held.configuration)
     }
   }
 }
diff --git a/dag/gunbc/machine_intake/mtcollins1_census_image.dag b/dag/gunbc/machine_intake/mtcollins1_census_image.dag
index f3d56548f12..d8133e6c26f 100644
--- a/dag/gunbc/machine_intake/mtcollins1_census_image.dag
+++ b/dag/gunbc/machine_intake/mtcollins1_census_image.dag
@@ -16,7 +16,7 @@ import extdeps.os.ubuntu_autoinstall { UbuntuAutoinstallLiveCommands }
 import gunbc.os_install_emit { autoinstall_live_commands_user_data, AutoinstallUserData, AutoinstallUserDataRendered, AutoinstallUserDataRefused }
 import gunbc.seeded_install_media_policy { seeded_install_media_pinned_dates, seeded_install_media_builder_revision }
 import std.optional { Present }
-import gunbc.boot_medium { BootImageExport, BootMedium, BootMediumNoTerminal, BootMediumVolumeLabel, bmc_boot_image_export, boot_image_export_eq, stock_installer_boot_medium }
+import gunbc.boot_medium { BootImageExport, BootMedium, BootMediumNoTerminal, BootMediumVolumeLabel, BootMediumRunnerHostUp, bmc_boot_image_export, boot_image_export_eq, stock_installer_boot_medium }
 import gunbc.machine_intake_boot_image_fetch { boot_image_published_path }
 import gunbc.machine_intake_host_capture_envelope {
   HostCaptureStage,
@@ -167,6 +167,7 @@ fn mtcollins1_seeded_image_input_with_cmdline(
         content: mtcollins1_census_capture_program(stages: stages),
       },
     ],
+    seed_artifacts: [],
     grub_kernel_cmdline: grub_kernel_cmdline,
     volume_id: volume_id,
     pinned_dates: seeded_install_media_pinned_dates,
@@ -255,6 +256,7 @@ fn mtcollins1_census_medium_qualification(medium: BootMedium) -> CensusMediumQua
   let labelled = match medium.terminal {
     BootMediumVolumeLabel { label: l } => (l as String) == (mtcollins1_census_volume_id as String)
     BootMediumNoTerminal { reason: _ } => false
+    BootMediumRunnerHostUp { label: _ } => false
   }
   if !(labelled && (medium.image_name as String) == (census.image_name as String)) {
     CensusMediumNotCensus
diff --git a/dag/gunbc/machine_intake/mtcollins1_managed_host_admission.dag b/dag/gunbc/machine_intake/mtcollins1_managed_host_admission.dag
new file mode 100644
index 00000000000..0c29ccff7c0
--- /dev/null
+++ b/dag/gunbc/machine_intake/mtcollins1_managed_host_admission.dag
@@ -0,0 +1,71 @@
+module gunbc.machine_intake_mtcollins1_managed_host_admission
+
+import std.types { List, NonEmptyStr }
+import extdeps.bmc.capability { BmcFirmwareReleaseIdentity }
+import gunbc.machine_intake_subject {
+  FirmwareEntry,
+  FirmwareManifest,
+  MachineIntakeSubject,
+  qualification_subject_of,
+}
+import gunbc.machine_intake_mtcollins1_access_observation { mtcollins1_endpoint }
+import gunbc.machine_intake_mtcollins1_bmc_secure_observation {
+  mtcollins1_assembly,
+  mtcollins1_intake_subject,
+}
+import gunbc.megarac_operation_standing {
+  CurrentBuildKnownUnread,
+  CurrentBuildRead,
+  CurrentBuildUnobserved,
+  megarac_current_build,
+}
+import gunbc.machine_intake_megarac_operation_evidence { mtcollins1_megarac_operation_evidence }
+
+// THE UNIT'S CURRENT INTAKE SUBJECT, FROM COMMITTED BUILD EVIDENCE, NEVER INFERRED.
+// gunbc.megarac_operation_standing megarac_current_build reads the committed readings and the
+// recorded 2026-10-02 reflash. A later reading of 0.45.3 supersedes the transition's `to` the
+// moment it lands. Unobserved current firmware yields Absent: the admission projection then
+// keeps the unit out rather than guessing a subject.
+//
+// This is not a ManagedHostAdmission record. That record is assembled in gunbc.managed_host from
+// this subject, the frozen BmcSecureStanding, and the unit's other arrival observations, so this
+// module does not import the population type (no cycle, and no second roster).
+
+fn bmc_firmware_manifest(firmware: BmcFirmwareReleaseIdentity) -> FirmwareManifest {
+  FirmwareManifest {
+    entries: [FirmwareEntry { component: "bmc", version: firmware.raw_version }],
+    configuration_digests: [],
+  }
+}
+
+fn mtcollins1_current_intake_subject() -> MachineIntakeSubject? {
+  match mtcollins1_intake_subject() {
+    Absent => none
+    Present { value: standing } =>
+      match megarac_current_build(evidence: mtcollins1_megarac_operation_evidence(), endpoint: mtcollins1_endpoint) {
+        CurrentBuildUnobserved => none
+        CurrentBuildRead { reading: r } =>
+          Present {
+            value: MachineIntakeSubject {
+              subject: qualification_subject_of(
+                unit_key: standing.subject.unit_key,
+                assembly: mtcollins1_assembly,
+                firmware: bmc_firmware_manifest(firmware: r.identity.firmware),
+              ),
+              attempt_id: standing.attempt_id,
+            },
+          }
+        CurrentBuildKnownUnread { transition: t } =>
+          Present {
+            value: MachineIntakeSubject {
+              subject: qualification_subject_of(
+                unit_key: standing.subject.unit_key,
+                assembly: mtcollins1_assembly,
+                firmware: bmc_firmware_manifest(firmware: t.to),
+              ),
+              attempt_id: standing.attempt_id,
+            },
+          }
+      }
+  }
+}
diff --git a/dag/gunbc/machine_intake/mtcollins1_memory_census_observation.dag b/dag/gunbc/machine_intake/mtcollins1_memory_census_observation.dag
index dcd17cd7d5e..3bd1db95693 100644
--- a/dag/gunbc/machine_intake/mtcollins1_memory_census_observation.dag
+++ b/dag/gunbc/machine_intake/mtcollins1_memory_census_observation.dag
@@ -562,11 +562,6 @@ data mtcollins1_host_memory_population: HostMemoryPopulation = HostMemoryPopulat
 // identity, and a caller policy on top of it. Leaving it here would have made this receipt a
 // second authority for a question the migration is modelling properly.
 //
-// AND ITS PROVENANCE WAS PROSE. The mapping was read from source.min.js as served by this
-// controller, and NO SUCH ARTIFACT IS COMMITTED. A sentence naming the file it came from is not a
-// resolvable receipt; a reader cannot check it, which is the same defect as a hand-transcribed
-// number. The observation therefore does not belong in an evidence PR without its bytes.
-//
 // WHAT SURVIVES HERE IS THE MEASUREMENT ALONE, because the transition itself was observed against
 // the live controller and is evidence about this unit. It is carried as SAMPLES rather than a
 // sentence: the reading is a timestamped sequence of two raw controller fields, and a prose
@@ -575,9 +570,7 @@ data mtcollins1_host_memory_population: HostMemoryPopulation = HostMemoryPopulat
 //
 // THE STATUS AND INDEX ARE CARRIED RAW AND UNDECODED, DELIBERATELY. What any particular value
 // MEANS is an extdeps.bmc.megarac catalog keyed to a firmware identity, and the policy over it is
-// the boot-path migration's; this module draws no readiness conclusion. The decoder that used to
-// live here was removed because its source (source.min.js as served by this controller) is not a
-// committed artifact, and a sentence naming the file it came from is not a resolvable receipt.
+// the boot-path migration's; this module draws no readiness conclusion. 
 type MtCollins1MediaRedirectionSample {
   offset_from_attach: Second
   redirection_status: Nat
diff --git a/dag/gunbc/machine_intake/mtcollins1_ui_bundle_observe.dag b/dag/gunbc/machine_intake/mtcollins1_ui_bundle_observe.dag
deleted file mode 100644
index 800a5724def..00000000000
--- a/dag/gunbc/machine_intake/mtcollins1_ui_bundle_observe.dag
+++ /dev/null
@@ -1,370 +0,0 @@
-module gunbc.machine_intake_mtcollins1_ui_bundle_observe
-
-import std.decl_ref { decl_ref }
-import extdeps.shell
-import extdeps.bmc.ipmi
-import extdeps.bmc.megarac
-import extdeps.tools.sha256sum
-import extdeps.tools.gzip
-import std.algebra { trim }
-import std.types { Bool, FilePath, Int, List, NonEmptyStr, String }
-import std.process { ExitSuccess, ProcessExit, exit_failure }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import extdeps.tools.gnu_coreutils { coreutils_duration_operand }
-import extdeps.bmc.megarac { megarac_ui_bundle_path }
-import gunbc.machine_intake_mtcollins1_access_observation { mtcollins1_endpoint, mtcollins1_firmware, mtcollins1_boot_ipmi_read_deadline, mtcollins1_boot_ipmi_kill_after }
-import gunbc.managed_host { managed_host_account_driving, managed_host_binding_for }
-import gunbc.fleet_host_identity { operator_host_mtcollins1 }
-import gunbc.machine_intake_mtcollins1_fan_observe { FanCredentialPathReady, FanCredentialPathUnset, FanCredentialPathEmpty, mtcollins1_fan_credential_path, mtcollins1_fan_credential_path_env }
-import gunbc.machine_intake_megarac_media_attach { megarac_media_read_max_time, megarac_media_read_max_time_operand }
-import std.measure { Second, second, second_count }
-import std.nat { Nat }
-import std.optional { Present, Absent }
-import v2.std.algebra { any }
-import gunbc.machine_intake_megarac_served_ui_catalog_observation { megarac_source_min_js_sha256_2026_09_27 }
-
-// ONE READ OF MT. COLLINS' OWN UI BUNDLE, SO A VENDOR CODE IS INTERPRETED FROM THE VENDOR'S SOURCE
-// (operator, amended brief msg_20e45239 and decision msg_b3c77f62, 2026-09-30). The settings route
-// answers cd_error_code 16 and nothing in the tree says what 16 names; the firmware's UI names its
-// own codes in source.min.js, which is how start-media's 13410/13460 were recovered. This mode is the
-// modeled route to those bytes: the controller's firmware revision is read over IPMI (`mc info`,
-// read-only), the bundle is fetched only when that revision is the one this unit's facts are keyed
-// on, and the served bytes, their sha256 and the comparison with the 2026-09-27 read are the receipt.
-//
-// ONE READ-ONLY SERVED-FILE OBSERVATION, NOT ONE FILE (eager-owl-205, 2026-09-30). The KVM viewer's
-// /kvm video socket is not in source.min.js -- that bundle's one WebSocket is SOL -- so the mode also
-// reads viewer.html and every script it loads, derived by parsing what was served and followed to
-// closure within a declared budget (served_crawl). Each file is its own receipt row.
-//
-// NOTHING IS WRITTEN TO THE CONTROLLER AND NO WEB SESSION IS OPENED. Every file read is served to the
-// login page's origin before a session exists, so each GET carries no credential (extdeps.bmc.megarac
-// megarac.Ui.GetServedBundle); the only credential this run materializes is the IPMI one `mc info`
-// needs, through the same prelude the fan observation uses. No unit hold is taken: like the fan
-// series, nothing here changes chassis, media or boot state.
-
-// EVERYTHING THE MODE KEEPS SHARES ONE PREFIX, so the upload is one glob: the receipt, and one directory
-// holding every served file, named by its served path with "/" read as "__".
-data mtcollins1_ui_bundle_prefix: String = "target/mtcollins1-ui-bundle-"
-
-data mtcollins1_ui_bundle_artifact_glob: String = concat(mtcollins1_ui_bundle_prefix, "*")
-
-data mtcollins1_ui_bundle_dir: String = concat(mtcollins1_ui_bundle_prefix, "files")
-
-fn mtcollins1_ui_bundle_file_path(served: String) -> String {
-  concat(concat(mtcollins1_ui_bundle_dir, "/"), join(split(s: served, delimiter: "/"), "__"))
-}
-
-data mtcollins1_ui_bundle_receipt_path: String = concat(mtcollins1_ui_bundle_prefix, "receipt.txt")
-
-// THE CRAWL'S BUDGET, A DECLARED POLICY BOUND (DESIGN §5: an explicit budget, never a silent cut): at
-// most this many served files are fetched in one run. The require config the 2026-09-30 read of
-// source.min.js carries names 23 ./libs/kvm/ modules; the budget is room for roughly twice that plus the
-// two seeds. A run that reaches it records a ServedFileBudgetReached row naming every path left unvisited.
-data mtcollins1_ui_bundle_file_budget: Nat = 48
-
-// WHAT THE PROBE'S OWN READS CAN COST AT MOST: the one `mc info` under its timeout and kill-after, then
-// every served GET the budget admits under curl --max-time. The step budget adds gunbc run's load and the
-// credential prelude on the workflow side (gunbc.fleet_converge_workflow), which owns those authorities.
-fn mtcollins1_ui_bundle_read_bound() -> Second {
-  second(count: second_count(s: mtcollins1_boot_ipmi_read_deadline) + second_count(s: mtcollins1_boot_ipmi_kill_after)
-    + mtcollins1_ui_bundle_file_budget * second_count(s: megarac_media_read_max_time))
-}
-
-// THE REVISION AS `mc info` PRINTS IT: the value after the colon on the `Firmware Revision` line.
-fn firmware_revision_of_mc_info(stdout: String) -> String? {
-  let lines = filter(split(s: stdout, delimiter: "\n"), l => starts_with(s: trim(s: l), prefix: "Firmware Revision"))
-  match lines.first() {
-    Absent => none
-    Present { value: line } => {
-      let after = split(s: line, delimiter: ":").skip(n: 1)
-      let v = trim(s: join(after, ":"))
-      if v == "" { none } else { Present { value: v } }
-    }
-  }
-}
-
-// THE BUNDLE IS FETCHED ONLY UNDER THE REVISION THE UNIT'S FACTS ARE KEYED ON. Every code this
-// module exists to recover is a 0.32 fact (mtcollins1_firmware); bytes from another build would be
-// read as 0.32's table.
-type UiBundleFirmwareStanding
-  = UiBundleFirmwareExpected { revision: NonEmptyStr }
-  | UiBundleFirmwareDiffers { revision: NonEmptyStr, expected: NonEmptyStr }
-  | UiBundleFirmwareUnread { detail: String }
-
-fn ui_bundle_firmware_standing(success: Bool, stdout: String, exit_code: Int, stderr: String) -> UiBundleFirmwareStanding {
-  if !success {
-    UiBundleFirmwareUnread { detail: join(["ipmitool mc info exited ", to_string(exit_code), ": ", trim(s: stderr)], "") }
-  } else {
-    match firmware_revision_of_mc_info(stdout: stdout) {
-      Absent => UiBundleFirmwareUnread { detail: concat("mc info printed no Firmware Revision line: ", stdout) }
-      Present { value: r } =>
-        if r == (mtcollins1_firmware.raw_version as String) { UiBundleFirmwareExpected { revision: r as NonEmptyStr } }
-        else { UiBundleFirmwareDiffers { revision: r as NonEmptyStr, expected: mtcollins1_firmware.raw_version } }
-    }
-  }
-}
-
-// MATCH OR DRIFT AGAINST THE 2026-09-27 READ, REPORTED AND NEVER A REFUSAL: a different digest is a
-// finding about the served UI, not a failed read.
-type UiBundleDigestComparison
-  = UiBundleDigestMatches
-  | UiBundleDigestDrifted { cited: NonEmptyStr }
-
-fn ui_bundle_digest_comparison(observed: String) -> UiBundleDigestComparison {
-  if observed == (megarac_source_min_js_sha256_2026_09_27 as String) { UiBundleDigestMatches }
-  else { UiBundleDigestDrifted { cited: megarac_source_min_js_sha256_2026_09_27 } }
-}
-
-fn ui_bundle_digest_comparison_text(c: UiBundleDigestComparison) -> String {
-  match c {
-    UiBundleDigestMatches => "MATCH with the 2026-09-27 read"
-    UiBundleDigestDrifted { cited: d } => concat("DRIFT from the 2026-09-27 read, which was ", d as String)
-  }
-}
-
-fn ui_bundle_firmware_text(f: UiBundleFirmwareStanding) -> String {
-  match f {
-    UiBundleFirmwareExpected { revision: r } => concat("firmware revision ", concat(r as String, " (expected)"))
-    UiBundleFirmwareDiffers { revision: r, expected: e } => join(["firmware revision ", r as String, " is NOT the expected ", e as String, "; the bundle was not fetched"], "")
-    UiBundleFirmwareUnread { detail: d } => concat("firmware revision UNREAD, so the bundle was not fetched: ", d)
-  }
-}
-
-// THE RECEIPT IS WRITTEN ON EVERY PATH THAT REACHED THE CONTROLLER, and the exit carries the same
-// sentence, so a refused run's artifact says why it holds no bytes.
-fn ui_bundle_conclude(lines: List<String>, outcome: ProcessExit) -> ProcessExit {
-  let body = join(concat([concat("subject=", mtcollins1_endpoint.host as String), concat("bundle_path=", megarac_ui_bundle_path as String)], lines), "\n")
-  let kept = Filesystem.Write(path: mtcollins1_ui_bundle_receipt_path, content: concat(body, "\n"))
-  if kept.success { outcome } else {
-    match outcome {
-      ExitSuccess => exit_failure(reason: concat("mtcollins1 ui bundle: the bundle was read and its receipt could not be written: ", kept.error))
-      other => other
-    }
-  }
-}
-
-fn ui_bundle_firmware_refused(firmware: UiBundleFirmwareStanding) -> ProcessExit {
-  ui_bundle_conclude(lines: [concat("firmware=", ui_bundle_firmware_text(f: firmware))], outcome: exit_failure(reason: concat("mtcollins1 ui bundle: ", ui_bundle_firmware_text(f: firmware))))
-}
-
-// ── THE SERVED FILES, DERIVED RATHER THAN LISTED (operator rule: no hardcoded lists) ─────────────────
-// Two seeds: source.min.js, the UI bundle (still compared with the 2026-09-27 read), and viewer.html,
-// the H5 viewer the UI opens with window.open. Every further path is PARSED out of a file already
-// fetched: an HTML file's <script src> and data-main, and a script's "./libs/kvm/..." references (the
-// require config's KVM modules and the decode worker it constructs) -- followed to closure within
-// mtcollins1_ui_bundle_file_budget. Fleet-converge run 36779479938 loaded viewer.html and never opened
-// /kvm; these are the bytes that say what the viewer needs first.
-data mtcollins1_ui_bundle_seed_found_by: String = "seed"
-
-type ServedRef {
-  path: String
-  found_by: String
-}
-
-data mtcollins1_ui_bundle_seeds: List<ServedRef> = [
-  ServedRef { path: "source.min.js", found_by: mtcollins1_ui_bundle_seed_found_by },
-  ServedRef { path: "viewer.html", found_by: mtcollins1_ui_bundle_seed_found_by },
-]
-
-// A reference as the page wrote it, as a path under the controller's root: "./" and "/" prefixes
-// dropped, a query or fragment cut; a reference to another origin is not a served path of this
-// controller and is kept as such, never fetched.
-type ServedRefReading
-  = ServedRefLocal { path: String }
-  | ServedRefOtherOrigin { reference: String }
-  | ServedRefEmpty
-
-fn served_ref_reading(reference: String) -> ServedRefReading {
-  let r = trim(s: reference)
-  if starts_with(s: r, prefix: "http://") || starts_with(s: r, prefix: "https://") || starts_with(s: r, prefix: "//") { ServedRefOtherOrigin { reference: r } }
-  else {
-    let no_query = match split(s: r, delimiter: "?").first() { Present { value: p } => p  Absent => "" }
-    let no_frag = match split(s: no_query, delimiter: "#").first() { Present { value: p } => p  Absent => "" }
-    let dotless = if starts_with(s: no_frag, prefix: "./") { substring(s: no_frag, start: 2, end: string_length(no_frag)) } else { no_frag }
-    let rooted = if starts_with(s: dotless, prefix: "/") { substring(s: dotless, start: 1, end: string_length(dotless)) } else { dotless }
-    if rooted == "" { ServedRefEmpty } else { ServedRefLocal { path: rooted } }
-  }
-}
-
-// The value of attribute `name` in a tag's text, double- or single-quoted.
-fn html_attribute(tag: String, name: String) -> String? {
-  let dq = split(s: tag, delimiter: concat(name, "=\"")).skip(n: 1).first()
-  match dq {
-    Present { value: rest } => split(s: rest, delimiter: "\"").first()
-    Absent =>
-      match split(s: tag, delimiter: concat(name, "='")).skip(n: 1).first() {
-        Present { value: rest } => split(s: rest, delimiter: "'").first()
-        Absent => none
-      }
-  }
-}
-
-// AN HTML FILE'S SCRIPTS: every <script ...> tag's src and data-main (require.js's entry module, which it
-// loads as "<data-main>.js").
-fn served_html_references(html: String) -> List<String> {
-  flat_map(split(s: html, delimiter: "<script").skip(n: 1), tag_rest => {
-    let tag = match split(s: tag_rest, delimiter: ">").first() { Present { value: x } => x  Absent => "" }
-    let src = match html_attribute(tag: tag, name: "src") { Present { value: s } => [s]  Absent => [] }
-    let main = match html_attribute(tag: tag, name: "data-main") { Present { value: m } => [js_module_file(reference: m)]  Absent => [] }
-    concat(src, main)
-  })
-}
-
-// A require.js module id names "<id>.js"; a reference already naming a file keeps its name.
-fn js_module_file(reference: String) -> String {
-  if ends_with(s: reference, suffix: ".js") { reference } else { concat(reference, ".js") }
-}
-
-data served_kvm_library_prefix: String = "./libs/kvm/"
-
-// A SCRIPT'S KVM LIBRARIES: every string literal beginning "./libs/kvm/", in either quote.
-fn served_js_references_quoted(js: String, q: String) -> List<String> {
-  map(split(s: js, delimiter: concat(q, served_kvm_library_prefix)).skip(n: 1), rest => {
-    let name = match split(s: rest, delimiter: q).first() { Present { value: n } => n  Absent => "" }
-    js_module_file(reference: concat(served_kvm_library_prefix, name))
-  })
-}
-
-fn served_js_references(js: String) -> List<String> {
-  concat(served_js_references_quoted(js: js, q: "\""), served_js_references_quoted(js: js, q: "'"))
-}
-
-fn served_references(path: String, text: String) -> List<String> {
-  if ends_with(s: path, suffix: ".html") || ends_with(s: path, suffix: ".htm") { served_html_references(html: text) }
-  else if ends_with(s: path, suffix: ".js") { served_js_references(js: text) }
-  else { [] }
-}
-
-// ONE ROW PER FILE, TYPED; nothing is dropped. A fetched file carries its HTTP status, size and sha256
-// (and source.min.js its comparison with the 2026-09-27 read); a failed GET, an undigestable or
-// undecodable file, a reference to another origin and the budget's edge are each their own row.
-type ServedFileRow
-  = ServedFileFetched { path: String, found_by: String, http: String, size: String, sha256: String, kept_at: String }
-  | ServedFileGetFailed { path: String, found_by: String, detail: String }
-  | ServedFileUndigested { path: String, found_by: String, detail: String }
-  | ServedFileUnparsed { path: String, found_by: String, detail: String }
-  | ServedFileOtherOrigin { reference: String, found_by: String }
-  | ServedFileBudgetReached { budget: Int, unvisited: List<String> }
-
-fn served_file_row_text(r: ServedFileRow) -> String {
-  match r {
-    ServedFileFetched { path: p, found_by: f, http: h, size: s, sha256: d, kept_at: k } =>
-      join([
-        "file path=/", p, " http=", h, " size=", s, " sha256=", d, " found_by=", f, " kept=", k,
-        if p == "source.min.js" { concat(" comparison=", ui_bundle_digest_comparison_text(c: ui_bundle_digest_comparison(observed: d))) } else { "" },
-      ], "")
-    ServedFileGetFailed { path: p, found_by: f, detail: d } => join(["file path=/", p, " GET FAILED found_by=", f, " detail=", d], "")
-    ServedFileUndigested { path: p, found_by: f, detail: d } => join(["file path=/", p, " fetched but NOT DIGESTED found_by=", f, " detail=", d], "")
-    ServedFileUnparsed { path: p, found_by: f, detail: d } => join(["file path=/", p, " fetched and digested but NOT PARSED for references found_by=", f, " detail=", d], "")
-    ServedFileOtherOrigin { reference: r2, found_by: f } => join(["reference ", r2, " is another origin; not fetched found_by=", f], "")
-    ServedFileBudgetReached { budget: b, unvisited: u } => join(["BUDGET REACHED at ", to_string(b), " files; unvisited: ", join(u, " ")], "")
-  }
-}
-
-fn served_path_seen(seen: List<String>, path: String) -> Bool {
-  any(seen, s => s == path)
-}
-
-// ONE SERVED FILE: GET as served, digest, then decode (gzip or not) and parse its references.
-type ServedFetch {
-  rows: List<ServedFileRow>
-  refs: List<String>
-}
-
-fn served_fetch(item: ServedRef) -> ServedFetch {
-  let dest = mtcollins1_ui_bundle_file_path(served: item.path)
-  let got = megarac.Ui.GetServedBundle(
-    bmc_host: mtcollins1_endpoint.host,
-    bundle_path: concat("/", item.path) as NonEmptyStr,
-    dest_file: dest as NonEmptyStr,
-    max_time: megarac_media_read_max_time_operand(),
-  )
-  let words = split(s: trim(s: got.writeout), delimiter: " ")
-  let http = match words.first() { Present { value: w } => w  Absent => "" }
-  let size = match words.skip(n: 1).first() { Present { value: w } => w  Absent => "" }
-  if !got.success {
-    return ServedFetch { rows: [ServedFileGetFailed { path: item.path, found_by: item.found_by, detail: join(["exit ", to_string(got.exit_code), " http=", http, " ", trim(s: got.stderr)], "") }], refs: [] }
-  }
-  let digest = sha256sum.Sha256.DigestFile(path: dest as NonEmptyStr)
-  let observed = match split(s: trim(s: digest.line), delimiter: " ").first() { Present { value: d } => d  Absent => "" }
-  if !digest.success || observed == "" {
-    return ServedFetch { rows: [ServedFileUndigested { path: item.path, found_by: item.found_by, detail: digest.line }], refs: [] }
-  }
-  let fetched = ServedFileFetched { path: item.path, found_by: item.found_by, http: http, size: size, sha256: observed, kept_at: dest }
-  let decoded = gzip.Gzip.DecodeToStdout(path: dest as NonEmptyStr)
-  if !decoded.success {
-    return ServedFetch { rows: [fetched, ServedFileUnparsed { path: item.path, found_by: item.found_by, detail: join(["gzip exit ", to_string(decoded.exit_code), " ", trim(s: decoded.stderr)], "") }], refs: [] }
-  }
-  ServedFetch { rows: [fetched], refs: served_references(path: item.path, text: decoded.text) }
-}
-// THE CRAWL: a worklist in discovery order, each served path fetched once, every reference classified,
-// and the budget's edge recorded with what it left unvisited. `remaining` is the budget still unspent.
-fn served_crawl(queue: List<ServedRef>, seen: List<String>, rows: List<ServedFileRow>, remaining: Int) -> List<ServedFileRow> {
-  match queue.first() {
-    Absent => rows
-    Present { value: item } => {
-      let rest = queue.skip(n: 1)
-      if served_path_seen(seen: seen, path: item.path) { return served_crawl(queue: rest, seen: seen, rows: rows, remaining: remaining) }
-      if remaining <= 0 {
-        let unvisited = fold(queue, [], (acc, q) => if served_path_seen(seen: seen, path: q.path) || any(acc, a => a == q.path) { acc } else { list_append(acc, q.path) })
-        return list_append(rows, ServedFileBudgetReached { budget: mtcollins1_ui_bundle_file_budget as Int, unvisited: unvisited })
-      }
-      let fetched = served_fetch(item: item)
-      let readings = map(fetched.refs, r => served_ref_reading(reference: r))
-      let local = flat_map(readings, x => match x { ServedRefLocal { path: p } => [ServedRef { path: p, found_by: item.path }]  _ => [] })
-      let foreign = flat_map(readings, x => match x { ServedRefOtherOrigin { reference: r } => [ServedFileOtherOrigin { reference: r, found_by: item.path }]  _ => [] })
-      served_crawl(queue: concat(rest, local), seen: list_append(seen, item.path), rows: concat(concat(rows, fetched.rows), foreign), remaining: remaining - 1)
-    }
-  }
-}
-
-fn served_seed_fetched(rows: List<ServedFileRow>, seed: String) -> Bool {
-  any(rows, r => match r { ServedFileFetched { path: p, found_by: _, http: _, size: _, sha256: _, kept_at: _ } => p == seed  _ => false })
-}
-
-fn mtcollins1_ui_bundle_observe_with(username: NonEmptyStr, password_file: NonEmptyStr) -> ProcessExit
-  admit_callers: [
-    decl_ref(module_path: "gunbc.machine_intake_mtcollins1_ui_bundle_observe", decl_name: "mtcollins1_ui_bundle_observe_wet"),
-  ]
-{
-  let mc = diagnostic.ipmi.Tool.McInfo(
-    bmc_host: mtcollins1_endpoint.host,
-    username: username,
-    password_file: password_file,
-    deadline: coreutils_duration_operand(d: mtcollins1_boot_ipmi_read_deadline) as NonEmptyStr,
-    kill_after: coreutils_duration_operand(d: mtcollins1_boot_ipmi_kill_after) as NonEmptyStr,
-  )
-  let firmware = ui_bundle_firmware_standing(success: mc.success, stdout: mc.stdout, exit_code: mc.exit_code, stderr: mc.transport_stderr)
-  let fw_line = concat("firmware=", ui_bundle_firmware_text(f: firmware))
-  match firmware {
-    UiBundleFirmwareExpected { revision: _ } => {}
-    UiBundleFirmwareDiffers { revision: _, expected: _ } => return ui_bundle_firmware_refused(firmware: firmware)
-    UiBundleFirmwareUnread { detail: _ } => return ui_bundle_firmware_refused(firmware: firmware)
-  }
-  let made = shell.Mkdir.Parents(path: mtcollins1_ui_bundle_dir as FilePath)
-  if !made.success {
-    return ui_bundle_conclude(lines: [fw_line], outcome: exit_failure(reason: concat("mtcollins1 ui bundle: the file directory could not be made: ", mtcollins1_ui_bundle_dir)))
-  }
-  let rows = served_crawl(queue: mtcollins1_ui_bundle_seeds, seen: [], rows: [], remaining: mtcollins1_ui_bundle_file_budget as Int)
-  let lines = concat([fw_line], map(rows, r => served_file_row_text(r: r)))
-  let missing_seeds = filter(map(mtcollins1_ui_bundle_seeds, s => s.path), p => !served_seed_fetched(rows: rows, seed: p))
-  if count(missing_seeds) > 0 {
-    ui_bundle_conclude(lines: lines, outcome: exit_failure(reason: concat("mtcollins1 ui bundle: a seed was not fetched: ", join(missing_seeds, " "))))
-  } else {
-    ui_bundle_conclude(lines: lines, outcome: ExitSuccess)
-  }
-}
-
-// REFUSALS BEFORE THE FIRST REQUEST, EACH NAMING WHAT IS MISSING, exactly as the fan observation's.
-fn mtcollins1_ui_bundle_observe_wet() -> ProcessExit
-{
-  match managed_host_account_driving(lookup: managed_host_binding_for(host: operator_host_mtcollins1 as NonEmptyStr), endpoint: mtcollins1_endpoint) {
-    Absent => exit_failure(reason: "mtcollins1 ui bundle: the managed host does not bind (not BmcSecured, or its observed controller is not the secured one), so this run holds no account to read the firmware revision with; contacting NO host")
-    Present { value: username } =>
-      match mtcollins1_fan_credential_path() {
-        FanCredentialPathUnset => exit_failure(reason: join(["mtcollins1 ui bundle: no ", mtcollins1_fan_credential_path_env as String, " in the environment; contacting NO host"], ""))
-        FanCredentialPathEmpty => exit_failure(reason: join(["mtcollins1 ui bundle: ", mtcollins1_fan_credential_path_env as String, " is set but empty; contacting NO host"], ""))
-        FanCredentialPathReady { path: p } => mtcollins1_ui_bundle_observe_with(username: username, password_file: p)
-      }
-  }
-}
diff --git a/dag/gunbc/machine_intake/mtjade1_access_observation.dag b/dag/gunbc/machine_intake/mtjade1_access_observation.dag
index a676eca8d3a..41e22e0dcd4 100644
--- a/dag/gunbc/machine_intake/mtjade1_access_observation.dag
+++ b/dag/gunbc/machine_intake/mtjade1_access_observation.dag
@@ -50,6 +50,11 @@ import gunbc.machine_intake_subject {
 import std.types { Int, List, NonEmptyStr, String }
 import std.algebra { trim }
 import std.decl_ref { decl_ref }
+import gunbc.board_authority_binding { mtjade1_fru_receipt, receipt_sha256_hex }
+import gunbc.ipmitool_fru_text {
+  FruCaptureGap, FruCaptureDigestAgrees, FruCaptureDigestDiffers, fru_capture_digest_check, FruFieldGapped, FruFieldGapKind, FruCaptureUnreadable, FruCaptureDigestMismatch, FruFieldAbsent, FruFieldRepeated, FruFieldEmpty,
+  FruSubjectLinkUnobserved, FruBoundToAnotherLink, FruFieldRead, FruFieldValue, FruFieldGap, fru_field, fru_line_key, fru_line_value,
+}
 import gunbc.secret_provision { mtjade1_bmc_gunbc_secret_ref }
 import extdeps.cloud.gcp.secret_ref { SecretRef }
 import gunbc.machine_intake_megarac_media_attach {
@@ -60,7 +65,7 @@ import gunbc.machine_intake_megarac_media_attach {
 }
 
 // MT. JADE UNIT 1 BMC ACCESS. Every fact below is read from a committed capture; this module invents
-// no host, serial, or BaseboardModel arm. The unit key is not a row here: it is derived by
+// no host, serial, or board enum arm. The unit key is not a row here: it is derived by
 // gunbc.machine_intake_arrival_converge identity_bind_provisional, through bind_unit_key, from the
 // board-serial observations this module reads from the FRU and SMBIOS captures.
 
@@ -399,18 +404,10 @@ fn read_mtjade1_current_manager_read() -> CurrentManagerRead uses fs: std.resour
 // the capture is bound to this unit through Board Extra, which must equal the link observed on the
 // controller's own wire (the same binding the Redfish capture's Oem.Amp.FruInformation.BoardExtra
 // takes). A capture that fails any of these yields its typed gap, never an empty observation list.
-data mtjade1_fru_capture_path: NonEmptyStr = "artifacts/bmc/mtjade1-ipmitool-fru-print-192.168.1.246-2026-10-04T110207Z.txt"
-
-data mtjade1_fru_capture_sha256: NonEmptyStr = "1800e7394dc06a023dc4d9cda481a63fe3cf9f07ed20cb0491746c61e9baf46b"
+// One home for the capture's path and digest: the board binding's receipt (gunbc.board_authority_binding).
+data mtjade1_fru_capture_path: NonEmptyStr = mtjade1_fru_receipt.artifact_path
 
-type FruCaptureGap
-  = FruCaptureUnreadable { error: String }
-  | FruCaptureDigestMismatch { expected: NonEmptyStr, observed: String }
-  | FruFieldAbsent { field: NonEmptyStr }
-  | FruFieldRepeated { field: NonEmptyStr }
-  | FruFieldEmpty { field: NonEmptyStr }
-  | FruSubjectLinkUnobserved
-  | FruBoundToAnotherLink { board_extra: String }
+data mtjade1_fru_capture_sha256: NonEmptyStr = receipt_sha256_hex(receipt: mtjade1_fru_receipt) as NonEmptyStr
 
 // The fields the provisional identity reads, as the capture spells them. Nothing else in the capture
 // is consumed.
@@ -445,59 +442,29 @@ fn fru_gap_text(gap: FruCaptureGap) -> NonEmptyStr {
   match gap {
     FruCaptureUnreadable { error: e } => join(["the recorded FRU capture could not be read: ", e], "") as NonEmptyStr
     FruCaptureDigestMismatch { expected: x, observed: o } => join(["the recorded FRU capture hashes to ", o, ", not the recorded ", x as String], "") as NonEmptyStr
-    FruFieldAbsent { field: f } => join(["the recorded FRU capture carries no ", f as String, " line"], "") as NonEmptyStr
-    FruFieldRepeated { field: f } => join(["the recorded FRU capture carries more than one ", f as String, " line"], "") as NonEmptyStr
-    FruFieldEmpty { field: f } => join(["the recorded FRU capture's ", f as String, " is empty"], "") as NonEmptyStr
+    FruFieldGapped { gap: FruFieldAbsent { field: f } } => join(["the recorded FRU capture carries no ", f as String, " line"], "") as NonEmptyStr
+    FruFieldGapped { gap: FruFieldRepeated { field: f } } => join(["the recorded FRU capture carries more than one ", f as String, " line"], "") as NonEmptyStr
+    FruFieldGapped { gap: FruFieldEmpty { field: f } } => join(["the recorded FRU capture's ", f as String, " is empty"], "") as NonEmptyStr
     FruSubjectLinkUnobserved => "the subject unit has no observed BMC link address to bind the FRU capture to"
     FruBoundToAnotherLink { board_extra: b } => join(["the recorded FRU capture names Board Extra ", b, ", which is not this unit's observed BMC link"], "") as NonEmptyStr
   }
 }
 
-type FruFieldRead
-  = FruFieldValue { value: NonEmptyStr }
-  | FruFieldGap { gap: FruCaptureGap }
-
-fn fru_line_key(line: String) -> String {
-  match split(s: line, delimiter: " : ").first() {
-    Present { value: k } => trim(k)
-    Absent => ""
-  }
-}
-
-fn fru_line_value(line: String) -> String {
-  trim(join(split(s: line, delimiter: " : ").skip(n: 1), " : "))
-}
-
-fn fru_field(content: String, field: NonEmptyStr) -> FruFieldRead {
-  let hits = split(s: content, delimiter: "\n") |> filter(l => fru_line_key(line: l) == (field as String))
-  match hits.first() {
-    Absent => FruFieldGap { gap: FruFieldAbsent { field: field } }
-    Present { value: line } =>
-      if length(hits) > 1 {
-        FruFieldGap { gap: FruFieldRepeated { field: field } }
-      } else if fru_line_value(line: line) == "" {
-        FruFieldGap { gap: FruFieldEmpty { field: field } }
-      } else {
-        FruFieldValue { value: fru_line_value(line: line) as NonEmptyStr }
-      }
-  }
-}
-
 fn decode_fru_fields(content: String) -> FruDecode {
   match fru_field(content: content, field: "Board Serial") {
-    FruFieldGap { gap: g } => FruRefused { gap: g }
+    FruFieldGap { gap: g } => FruRefused { gap: FruFieldGapped { gap: g } }
     FruFieldValue { value: serial } =>
       match fru_field(content: content, field: "Board Part Number") {
-        FruFieldGap { gap: g } => FruRefused { gap: g }
+        FruFieldGap { gap: g } => FruRefused { gap: FruFieldGapped { gap: g } }
         FruFieldValue { value: board_pn } =>
           match fru_field(content: content, field: "Board Product") {
-            FruFieldGap { gap: g } => FruRefused { gap: g }
+            FruFieldGap { gap: g } => FruRefused { gap: FruFieldGapped { gap: g } }
             FruFieldValue { value: product } =>
               match fru_field(content: content, field: "Chassis Part Number") {
-                FruFieldGap { gap: g } => FruRefused { gap: g }
+                FruFieldGap { gap: g } => FruRefused { gap: FruFieldGapped { gap: g } }
                 FruFieldValue { value: chassis_pn } =>
                   match fru_field(content: content, field: "Chassis Serial") {
-                    FruFieldGap { gap: g } => FruRefused { gap: g }
+                    FruFieldGap { gap: g } => FruRefused { gap: FruFieldGapped { gap: g } }
                     FruFieldValue { value: chassis_serial } =>
                       FruDecoded {
                         fields: FruIdentityFields {
@@ -517,15 +484,14 @@ fn decode_fru_fields(content: String) -> FruDecode {
 
 // THE PURE HALF: digest first, then the subject binding through Board Extra, then the fields.
 fn decode_fru_capture(content: String, expected_sha256: NonEmptyStr, link: Eui48Address?) -> FruDecode {
-  let observed = sha256_hex_of_text(text: content)
-  if observed != (expected_sha256 as String) {
-    FruRefused { gap: FruCaptureDigestMismatch { expected: expected_sha256, observed: observed } }
-  } else {
+  match fru_capture_digest_check(content: content, expected_sha256: expected_sha256) {
+  FruCaptureDigestDiffers { gap: g } => FruRefused { gap: g }
+  FruCaptureDigestAgrees =>
     match link {
       Absent => FruRefused { gap: FruSubjectLinkUnobserved }
       Present { value: l } =>
         match fru_field(content: content, field: "Board Extra") {
-          FruFieldGap { gap: g } => FruRefused { gap: g }
+          FruFieldGap { gap: g } => FruRefused { gap: FruFieldGapped { gap: g } }
           FruFieldValue { value: extra } =>
             if (extra as String) == board_extra_spelling(link: l) {
               decode_fru_fields(content: content)
diff --git a/dag/gunbc/machine_intake/pre_os_observation_capabilities.dag b/dag/gunbc/machine_intake/pre_os_observation_capabilities.dag
index da12b5c5331..8db25c76e1b 100644
--- a/dag/gunbc/machine_intake/pre_os_observation_capabilities.dag
+++ b/dag/gunbc/machine_intake/pre_os_observation_capabilities.dag
@@ -1,11 +1,11 @@
 module gunbc.machine_intake_pre_os_observation_capabilities
 
+import extdeps.board_authority { BoardAuthorityRef }
 import std.types { Bool, Int, List, NonEmptyStr }
 import std.content_hash { ContentHash }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
 import std.decl_ref { DeclarationRef }
 import extdeps.bmc.capability { BmcFirmwareReleaseIdentity }
-import extdeps.boards.types { BaseboardModel }
 
 // WHAT A PLATFORM LETS AN OBSERVER SEE BEFORE AN OPERATING SYSTEM EXISTS, one profile per
 // (baseboard, controller firmware release). Every field is a MEASURED capability standing, not a
@@ -130,7 +130,7 @@ type HostCallbackCapability
   | HostCallbackAbsent
 
 type PreOsObservationCapabilities {
-  baseboard: BaseboardModel
+  baseboard: BoardAuthorityRef
   controller_firmware: BmcFirmwareReleaseIdentity
   console: ConsoleObservationCapability
   sel: SelReadCapability
diff --git a/dag/gunbc/managed_directory.dag b/dag/gunbc/managed_directory.dag
index 0e0738d9efb..1ea6259c13f 100644
--- a/dag/gunbc/managed_directory.dag
+++ b/dag/gunbc/managed_directory.dag
@@ -72,9 +72,18 @@ import gunbc.fleet_posix_accounts { fleet_posix_operator_user }
 // root-owned directory whose GROUP is another principal's -- root:gunbc-ntfy, which is exactly what
 // both ntfy directories are. Extending it to carry an owning group distinct from the owner's
 // primary group is the capability that retires these arms.
+//
+// THE THIRD ARM IS THE SHARED 0755 ITSELF, given this home rather than left as
+// gunbc.live_deploy.emit install_d_shared_mode beside it. The dashboard instance's owned directories
+// that are not attempt state, auth state or fabric storage were installed at that constant, and the
+// owned-directory provider (gunbc.owned_directory) must state their mode as a target rather than
+// inherit a literal; preserving it is deliberate -- tightening a live directory is a host-behaviour
+// change this arm refuses to hide inside a migration. It dissolves with the other two arms, directory
+// by directory, as each one's dependents are declared.
 type DeclaredDirectoryMode
   = DirectoryOwnerOnly
   | DirectoryOwnerAllGroupTraverse
+  | DirectoryOwnerAllEveryoneTraverse
 
 fn declared_directory_mode(m: DeclaredDirectoryMode) -> FileMode {
   match m {
@@ -94,6 +103,14 @@ fn declared_directory_mode(m: DeclaredDirectoryMode) -> FileMode {
       setgid: false,
       sticky: false,
     }
+    DirectoryOwnerAllEveryoneTraverse => FileMode {
+      owner: PermissionBits { read: true, write: true, execute: true },
+      group: PermissionBits { read: true, write: false, execute: true },
+      other: PermissionBits { read: true, write: false, execute: true },
+      setuid: false,
+      setgid: false,
+      sticky: false,
+    }
   }
 }
 
diff --git a/dag/gunbc/materialization_provider_targets.dag b/dag/gunbc/materialization_provider_targets.dag
index 105b5eb3dec..907351c40e2 100644
--- a/dag/gunbc/materialization_provider_targets.dag
+++ b/dag/gunbc/materialization_provider_targets.dag
@@ -4,8 +4,6 @@ import std.types { Bool, Int, List, String }
 import std.cache_identity { CacheInterfaceId }
 import std.decl_ref { DeclarationRef, WholeDeclaration, declaration_ref_eq }
 import extdeps.realization.reconcile_in_process { parse_cache_id, typed_module_cache_id }
-import extdeps.realization.compile_stage_memo { compile_stage_memo_id }
-import extdeps.realization.parse_table_memo { parse_table_memo_id }
 import extdeps.realization.eval_memo { eval_memo_id }
 import extdeps.realization.native_artifact_cache { native_artifact_cache_id }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
@@ -67,20 +65,6 @@ data materialization_provider_targets: List<ProviderContractTarget> = [
     reason: "cli_run typed-module memo already keys on the typed_module_key facts this contract's TypecheckModuleRequest derives; the carrier is still an exposed in-process map (hollowing-plan area 2.6)",
     dissolution: unbound_dissolution(description: "typecheck lookups route through provider_serve with TypecheckModuleRequest and the map carrier retires")
   },
-  ProviderContractTarget {
-    cache: compile_stage_memo_id,
-    cache_row: target_decl(module_path: "extdeps.realization.compile_stage_memo", decl_name: "compile_stage_memo_facts"),
-    consumer_seam: target_decl(module_path: "v2.std.staging", decl_name: "cached_stage"),
-    reason: "v2 compile_ingest_staging cached_stage is content-addressed done right but answers through its own lookup shape rather than the contract's typed outcomes",
-    dissolution: unbound_dissolution(description: "cached_stage lookups project through provider_serve outcomes (the DESIGN section 2 ParseTable/cached_stage grounding lane)")
-  },
-  ProviderContractTarget {
-    cache: parse_table_memo_id,
-    cache_row: target_decl(module_path: "extdeps.realization.parse_table_memo", decl_name: "parse_table_memo_facts"),
-    consumer_seam: target_decl(module_path: "v2.compiler.parse", decl_name: "ParseTable"),
-    reason: "the v2 ParseTable memo is the standing DESIGN section 2 hand-rolled-cache debt; its lookup answers are untyped hits/misses on an in-process map",
-    dissolution: unbound_dissolution(description: "ParseTable grounds on the Realization carrier and its lookups adopt the contract's typed outcomes")
-  },
   ProviderContractTarget {
     cache: eval_memo_id,
     cache_row: target_decl(module_path: "extdeps.realization.eval_memo", decl_name: "eval_memo_facts"),
diff --git a/dag/gunbc/megarac_media_model.dag b/dag/gunbc/megarac_media_model.dag
index c0a138a0c70..29509b5db79 100644
--- a/dag/gunbc/megarac_media_model.dag
+++ b/dag/gunbc/megarac_media_model.dag
@@ -81,7 +81,6 @@ fn megarac_with_cd(world: MegaRacMediaWorld, cd: MegaRacCdRow) -> MegaRacMediaWo
 
 type MegaRacOpened {
   world: MegaRacMediaWorld
-  racsession_id: Int
   csrf_token: String
 }
 
@@ -90,7 +89,6 @@ fn megarac_open_session(world: MegaRacMediaWorld, cookie_jar: String) -> MegaRac
   let token = concat("modeled-csrf-", to_string(id))
   MegaRacOpened {
     world: megarac_with_sessions(world: world, sessions: list_snoc_item(xs: world.sessions, item: MegaRacSession { cookie_jar: cookie_jar, csrf_token: token, open: true }), next_session: id + 1),
-    racsession_id: id,
     csrf_token: token,
   }
 }
@@ -157,9 +155,8 @@ fn megarac_media_advance(world: MegaRacMediaWorld, now: Second) -> MegaRacMediaW
 }
 
 // A START THE CONTROLLER ACCEPTS AND THEN DROPS: stop_at_ready, when set, is the code the row falls back
-// to Stopped with at the instant it would have become Started -- the vendor UI's "Stopped - <name>"
-// (extdeps.bmc.megarac megarac_rmedia_status_0_32), e.g. 11 Mount Error for an image the share serves
-// but the controller cannot mount. The row reads cleared and cd_error_code carries the code.
+// to Stopped with at the instant it would have become Started -- e.g. a mount
+// error for an image the share serves but the controller cannot mount. The row reads cleared and cd_error_code carries the code.
 fn megarac_media_ready(world: MegaRacMediaWorld, now: Second) -> MegaRacMediaWorld {
   match world.cd.ready_at {
     Absent => world
diff --git a/dag/gunbc/memory_envelope_receipt_seed_growth.dag b/dag/gunbc/memory_envelope_receipt_seed_growth.dag
new file mode 100644
index 00000000000..b74aa325a59
--- /dev/null
+++ b/dag/gunbc/memory_envelope_receipt_seed_growth.dag
@@ -0,0 +1,44 @@
+module gunbc.memory_envelope_receipt_seed_growth
+
+import gunbc.roadmap_model { RoadmapNodeId }
+import gunbc.seed_growth { SeedGrowthJustification }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+
+// THE ROW EXISTS BECAUSE THE SEED GREW BY HAND (review 78391 on gunbc#13658): `gunbc test` gained
+// the memory-envelope requirement and receipt in the retained CLI kernel (std.compiler_entry
+// RetainedHostCliKernel). The DECISION and the VERDICT are not hand-authored facts: they are
+// modeled in gunbc.memory_envelope as folds over supplied inputs, and the Rust rows below are their
+// mirror, exactly as memory_governor cgroup_bind_decision mirrors gunbc.memory_cgroup_binding
+// (test.claim.memory_envelope_witness_test reaches every arm by supplied value). What stays hand-
+// written is the HOST side: reading the requirement from the environment, asking the governor's
+// walk which cgroup carries the numeric memory.max that binds the process, reading memory.peak /
+// memory.events / memory.swap.* before and after the producer, and rendering the receipt. Admitted
+// under the v1 PURPOSE test (gunbc.v1_maintenance_standing v1_seed_standing): the one required job
+// is the v2 emit-and-build gate, and the operator ruled the memory envelope into its verdict
+// (2026-10-09). test_verb_checked itself is already rostered by gunbc.target_invocation_seed_growth.
+data memory_envelope_receipt_seed_growth_justification: SeedGrowthJustification = SeedGrowthJustification {
+  hand_authored_declarations: [
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "MEMORY_ENVELOPE_REQUIRED_ENV", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "MEMORY_ENVELOPE_SLOT_VALUE", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "MemoryEnvelopeRequirement", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "MemoryEnvelopeGrain", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "MemoryEnvelopeRefusalCause", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "MemoryEnvelopeDecision", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "memory_envelope_requirement_from_text", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "memory_envelope_decision", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "memory_envelope_violated", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "MemoryEnvelope", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "memory_envelope_requirement", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "memory_envelope_receipt", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.floor_memory_supervisor", decl_name: "CgroupSwapRead", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.floor_memory_supervisor", decl_name: "read_cgroup_swap", field: WholeDeclaration }
+  ],
+
+  reason: "THE HOST SIDE OF A MODELED DECISION. gunbc.memory_envelope owns the requirement, the grain, the decision and the verdict as pure folds; the mirror rows (MemoryEnvelopeRequirement .. memory_envelope_violated) restate them in the seed because the emitted compiler does not yet run that fold for the retained CLI's test verb, and the shells (memory_envelope_requirement, memory_envelope_receipt, read_cgroup_swap) acquire what no .dag fold can receive today: the environment variable, the governor's binding_cap_cgroup_dir walk, and memory.peak / memory.events / memory.swap.max / memory.swap.current / memory.swap.peak before and after the producer (the file names are extdeps.linux.cgroup_v2_memory's). Every input is modeled and pinned: gunbc.emitted_subject_build_gate native_step_memory_envelope_env_name and native_step_memory_envelope_slot_value, by test.claim.compiler_gate_emit_build_lane_witness_test. Two items ride beside the rows and are uncitable by std.decl_ref, so they are named here as the roster convention asks: the impl method MemoryEnvelopeGrain::label (the mirror of memory_envelope_grain_label) and the #[cfg(test)] module memory_envelope_tests, whose functions are the mirror rows' unit tests and compile under cargo test only.",
+
+  owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
+
+  trigger: "Delete the mirror rows when the retained CLI's test verb evaluates gunbc.memory_envelope memory_envelope_decision and memory_envelope_verdict directly (the emitted compiler running the fold); delete the shells when the native door (v2.cli.compile_cli, std.compiler_entry NativeCliDriver) can receive the cgroup readings AS VALUES -- a resource supplying memory.max, memory.peak, memory.events and the memory.swap files for the process's own cgroup, declared through the derived dependency demand of D13 (gunbc.plans.demand_engine_program). The same lane as the SourceRootEvalDriver's remaining host-fact obligations (gunbc.source_root_eval_driver_seed_growth).",
+
+  current_boundary: "gunbc.compiler_gate_workflow compiler_gate_emit_build_step -> the step's env rows (gunbc.emitted_subject_build_gate native_step_memory_inputs, decided by gunbc.runner_slot_desired gunbc_runner_slot_job_cgroup_ownership) -> gunbc test (v1_compiler.target_invocation_host test_verb_checked) -> memory_governor apply_memory_cgroup_bind and binding_cap_cgroup_dir, floor_memory_supervisor read_cgroup_memory / read_cgroup_swap -> the mirrored memory_envelope_decision / memory_envelope_violated -> the MEMORY RECEIPT line and the MemoryEnvelopeAbsent / MemoryEnvelopeGrainUnknown / MemoryReceiptUnreadable / MemoryEnvelopeViolated refusals in the required run's log."
+}
diff --git a/dag/gunbc/namecheap/federation_provision.dag b/dag/gunbc/namecheap/federation_provision.dag
index 0bc96d02b47..f4c3e1f03c3 100644
--- a/dag/gunbc/namecheap/federation_provision.dag
+++ b/dag/gunbc/namecheap/federation_provision.dag
@@ -1,6 +1,6 @@
 module gunbc.namecheap.federation_provision
 
-import gunbc.auth.heal_publisher_provision { DedicatedFederation }
+import gunbc.auth.heal_publisher_provision { DedicatedFederation, StandingPoolImpersonation }
 import gunbc.auth.gcp_secret_access { secret_accessor_grant }
 import gunbc.auth.github_gcp_federation { federated_service_account_member }
 import gunbc.namecheap.credential { namecheap_api_key_secret_ref }
@@ -19,7 +19,7 @@ fn namecheap_dedicated_federation() -> DedicatedFederation {
     provider_id: namecheap_wif_provider_id,
     attribute_mapping: namecheap_attribute_mapping,
     attribute_condition: namecheap_attribute_condition(),
-    principal_set: namecheap_principal_set(),
+    impersonation: StandingPoolImpersonation { principal_set: namecheap_principal_set() },
     service_account: namecheap_service_account,
     service_account_id: "namecheap-dns",
     service_account_display_name: "Namecheap DNS credential reader",
diff --git a/dag/gunbc/namespace/namespace_cut_subject_roster.dag b/dag/gunbc/namespace/namespace_cut_subject_roster.dag
index 1afccb3ae33..cd7418bb7ee 100644
--- a/dag/gunbc/namespace/namespace_cut_subject_roster.dag
+++ b/dag/gunbc/namespace/namespace_cut_subject_roster.dag
@@ -148,9 +148,7 @@ fn subject_probes(s: NamespaceCutSubjectIdentity) -> NamespaceCutSubjectProbes {
     }
     ImportDerivedUseLineInputs => NamespaceCutSubjectProbes {
       first: DagDeclarationProbe { module_path: "v1.compiler.emit_rust", decl_name: "emit_imports" },
-      rest: [
-        DagDeclarationProbe { module_path: "v1.compiler.emit_rust", decl_name: "emit_extract_import_paths_fn" },
-      ],
+      rest: [],
     }
     LegacyImportRepairApparatus => NamespaceCutSubjectProbes {
       first: HostRustItemProbe { crate_relative_file: "src/v1/stage0/src/cli_run.rs", item_name: "classify_unlisted_import_binding_source" },
diff --git a/dag/gunbc/native_frontier_ratchet.dag b/dag/gunbc/native_frontier_ratchet.dag
index 6e0845c16da..b690c27ebfb 100644
--- a/dag/gunbc/native_frontier_ratchet.dag
+++ b/dag/gunbc/native_frontier_ratchet.dag
@@ -5,7 +5,8 @@ import v2.std.node { symbol_lexeme }
 import v2.std.algebra { any, filter, fold_list, is_empty, length, list_flat_map, list_map }
 import std.algebra { list_append }
 import v2.std.collection { Map, map_lookup }
-import v2.std.integer { Int, integer_int_to_decimal_string }
+import v2.std.integer { Int }
+import std.integer { int_to_decimal_string }
 import std.optional { Optional, Present, Absent, optional_present, optional_absent }
 import extdeps.bazel.target_pattern { TargetPattern, target_pattern_within }
 import v2.compiler.native_test_vocabulary {
@@ -321,7 +322,7 @@ fn native_frontier_flip_accept_to_refuse_row(f: NativeFrontierOwnedCorrectnessFl
 fn native_frontier_flip_citation(f: NativeFrontierOwnedCorrectnessFlip) -> String {
   join([
     "v2.workflow.compile_door_cause_ownership correctness flip of gunbc#",
-    integer_int_to_decimal_string(value: f.flip.pull_request), " (", f.flip.why, ")"
+    int_to_decimal_string(value: f.flip.pull_request), " (", f.flip.why, ")"
   ], "")
 }
 
@@ -659,7 +660,7 @@ fn native_frontier_report_lines(v: NativeFrontierVerdict) -> List<String> {
     FrontierAdvanced { advanced: a, proposal: _ } =>
       list_append(
         left: [join([
-          integer_int_to_decimal_string(value: length(xs: a)),
+          int_to_decimal_string(value: length(xs: a)),
           " roster change(s) the run supports, NOT YET APPLIED: the committed gunbc.native_frontier_roster stays authoritative until a reviewed pull request replaces it with the proposal below"
         ], "")],
         right: a
@@ -667,14 +668,14 @@ fn native_frontier_report_lines(v: NativeFrontierVerdict) -> List<String> {
     FrontierGrewByOwnedCorrectnessFlip { flips: fl, advanced: a, proposal: _ } =>
       list_append(
         left: [join([
-          integer_int_to_decimal_string(value: length(xs: fl)),
+          int_to_decimal_string(value: length(xs: fl)),
           " added identit(ies) owed debt under an owned correctness flip, NOT YET APPLIED: the committed gunbc.native_frontier_roster stays authoritative until a reviewed pull request replaces it with the proposal below"
         ], "")],
         right: list_append(left: list_map(xs: fl, f: native_frontier_flip_text), right: a)
       )
     FrontierLost { findings: fs } => fs
     FrontierUnminted { proposal: p } =>
-      [join(["UNMINTED: gunbc.native_frontier_roster carries no roster; this complete run proposes a universe of ", integer_int_to_decimal_string(value: length(xs: p.universe)), " identities and ", integer_int_to_decimal_string(value: length(xs: p.rows)), " debt row(s) for review"], "")]
+      [join(["UNMINTED: gunbc.native_frontier_roster carries no roster; this complete run proposes a universe of ", int_to_decimal_string(value: length(xs: p.universe)), " identities and ", int_to_decimal_string(value: length(xs: p.rows)), " debt row(s) for review"], "")]
     FrontierNotAMeasurement { reasons: rs } =>
       list_map(xs: rs, f: fn(r) { join(["NOT A MEASUREMENT ", r], "") })
   }
diff --git a/dag/gunbc/native_product_federation.dag b/dag/gunbc/native_product_federation.dag
index 8906eec8f9a..f0e85766dea 100644
--- a/dag/gunbc/native_product_federation.dag
+++ b/dag/gunbc/native_product_federation.dag
@@ -4,7 +4,7 @@ import std.types { String, NonEmptyStr, List, Map }
 import std.optional { Present }
 import extdeps.cloud.gcp.gcp { ServiceAccountEmail, WifProvider, wif_provider_resource, wif_pool_resource }
 import gunbc.repository { gunbc_repository_numeric_identity }
-import gunbc.auth.heal_publisher_provision { DedicatedFederation }
+import gunbc.auth.heal_publisher_provision { DedicatedFederation, StandingPoolImpersonation }
 import gunbc.auth.gcp_secret_access { SecretAccessGrant }
 import gunbc.auth.managed_host_boot_federation { pinned_version_accessor_grant_for }
 import gunbc.auth.github_gcp_federation {
@@ -12,7 +12,7 @@ import gunbc.auth.github_gcp_federation {
   github_wif_pool_id, github_wif_provider_id, github_wif_attribute_mapping, github_wif_attribute_condition,
   github_wif_principal_set,
 }
-import gunbc.auth.oidc_claim_pins { OidcClaimPin, claim_pins_attribute_condition }
+import gunbc.auth.oidc_claim_pins { OidcClaimPin, oidc_equals, claim_pins_attribute_condition }
 import gunbc.secret_provision { fleet_secret_ref, secret_ref_pin_version }
 import gunbc.cloudflare.r2_origin { fabric_cache_blobs_read_secret_id, fabric_cache_blobs_read_secret_version, fabric_cache_blobs_write_secret_id, fabric_cache_blobs_write_secret_version }
 
@@ -28,7 +28,7 @@ import gunbc.cloudflare.r2_origin { fabric_cache_blobs_read_secret_id, fabric_ca
 // same-repository pull request job can federate to it and read exactly one pinned secret version.
 // It deliberately is NOT fleet-cloud-convergence: that account holds the R2 write-token accessor, so
 // it is bound only to the dedicated pool of gunbc.auth.fleet_convergence_federation (claim-pinned to
-// fleet-converge.yml at main and workflow_dispatch), which no pull request or queue job is a member of. This
+// fleet-converge.yml at reviewed main and workflow_dispatch), which no pull request or queue job is a member of. This
 // account is the PR-reachable one, and holds one pinned read-only secret version.
 // Fork pull requests receive no id-token and so no credential: they build cold.
 data native_product_read_service_account: ServiceAccountEmail = "native-product-read@gunbai-secrets.iam.gserviceaccount.com"
@@ -45,7 +45,7 @@ fn native_product_read_federation() -> DedicatedFederation {
     provider_id: github_wif_provider_id,
     attribute_mapping: github_wif_attribute_mapping,
     attribute_condition: github_wif_attribute_condition(),
-    principal_set: github_wif_principal_set(),
+    impersonation: StandingPoolImpersonation { principal_set: github_wif_principal_set() },
     service_account: native_product_read_service_account,
     service_account_id: "native-product-read",
     service_account_display_name: "Native product store reader (WIF-only, one pinned secret version, no keys)",
@@ -85,9 +85,9 @@ data native_product_write_attribute_mapping: Map<String, String> = {
 
 fn native_product_write_claim_pins() -> List<OidcClaimPin> {
   [
-    OidcClaimPin { claim: "repository_id", value: to_string(gunbc_repository_numeric_identity.repository_id) },
-    OidcClaimPin { claim: "repository_owner_id", value: to_string(gunbc_repository_numeric_identity.owner_id) },
-    OidcClaimPin { claim: "event_name", value: merge_group_event_name },
+    oidc_equals(claim: "repository_id", value: to_string(gunbc_repository_numeric_identity.repository_id)),
+    oidc_equals(claim: "repository_owner_id", value: to_string(gunbc_repository_numeric_identity.owner_id)),
+    oidc_equals(claim: "event_name", value: merge_group_event_name),
   ]
 }
 
@@ -121,7 +121,7 @@ fn native_product_write_federation() -> DedicatedFederation {
     provider_id: native_product_write_wif_provider_id,
     attribute_mapping: native_product_write_attribute_mapping,
     attribute_condition: native_product_write_attribute_condition(),
-    principal_set: native_product_write_principal_set(),
+    impersonation: StandingPoolImpersonation { principal_set: native_product_write_principal_set() },
     service_account: native_product_write_service_account,
     service_account_id: "native-product-write",
     service_account_display_name: "Native product store writer (WIF-only, merge_group only, no keys)",
diff --git a/dag/gunbc/native_route_advisory_summary_seed_growth.dag b/dag/gunbc/native_route_advisory_summary_seed_growth.dag
index 93632796d3e..59e3c90c3cd 100644
--- a/dag/gunbc/native_route_advisory_summary_seed_growth.dag
+++ b/dag/gunbc/native_route_advisory_summary_seed_growth.dag
@@ -38,11 +38,11 @@ data native_route_advisory_summary_seed_growth_justification: SeedGrowthJustific
     }
   ],
 
-  reason: "Decodes and renders the native route's accepted-file advisory rows, which the emitted binary prints as accepted_file_advisories lines (v2.compiler.native_test_vocabulary NativeTestFileAdvisories: path, head, tail) beside a terminal advised_files count. The decode arm in parse_native_run_output reads each row and refuses when the marker's count disagrees with the rows printed; NativeFileAdvisoriesObserved is the decoded row; native_file_advisories_summary tallies reasons and names each advised file. It decides nothing about admission. Before it, an accepted file's advisories were matched away in the context fold, so the advisory program (steps 2-4: fatal-first readers, residue reported once per grammar) had no instrument to be shown done against. The host is where the driver's rows are decoded today, so the decode and rendering sit beside the existing file-refusal decode rather than in a second reader. parse_native_run_output is listed because the change adds an arm and a count check to it; the rest of that function predates this row. The row decode and the count check are one pair of functions (decode_file_advisories_row, advised_files_agree) shared by parse_native_run_output and decode_native_census_output, the census-resolve stdout decode that run_v2_native_census uses, so the census-resolve receipt carries the same advisory population, refused the same way, as census; decode_native_census_output otherwise reads only the terminal counts that run_v2_native_census already read.",
+  reason: "Decodes and renders the native route's accepted-file advisory rows, which the emitted binary prints as accepted_file_advisories lines (v2.compiler.native_test_vocabulary NativeTestFileAdvisories: path, head, tail) beside a terminal advised_files count. The decode arm in parse_native_run_output reads each row and refuses when the marker's count disagrees with the rows printed; NativeFileAdvisoriesObserved is the decoded row; native_file_advisories_summary tallies reasons and names each advised file. It decides nothing about admission. Before it, an accepted file's advisories were matched away in the context fold, so the advisory program (steps 2-4: fatal-first readers, residue reported once per grammar) had no instrument to be shown done against. The host is where the driver's rows are decoded today, so the decode and rendering sit beside the existing file-refusal decode rather than in a second reader. parse_native_run_output is listed because the change adds an arm and a count check to it; the rest of that function predates this row. The row decode and the count check are one pair of functions (decode_file_advisories_row, advised_files_agree) shared by parse_native_run_output and decode_native_census_output, the census-infer stdout decode that run_v2_native_census uses (census-resolve before gunbc#13308), so the census-infer receipt carries the same advisory population, refused the same way, as census; decode_native_census_output otherwise reads only the terminal counts that run_v2_native_census already read.",
 
   owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
 
-  trigger: "Delete these declarations (and the advisory arm and count check in parse_native_run_output) when the native lane's row decode and summary are emitted from a .dag fold over NativeTestFileAdvisories rather than hand-decoded in native_lane_runner (including the census-resolve decode in decode_native_census_output), SUFFICIENT FOR a native-route run (gunbc test over the //v2/test/... universe, or claim_executor's required native lane, and the eval-driver census door) to print each accepted file's advisory reasons and their tally with no hand-authored decode or rendering.",
+  trigger: "Delete these declarations (and the advisory arm and count check in parse_native_run_output) when the native lane's row decode and summary are emitted from a .dag fold over NativeTestFileAdvisories rather than hand-decoded in native_lane_runner (including the census-infer decode in decode_native_census_output), SUFFICIENT FOR a native-route run (gunbc test over the //v2/test/... universe, or claim_executor's required native lane, and the eval-driver census door) to print each accepted file's advisory reasons and their tally with no hand-authored decode or rendering.",
 
   current_boundary: "src/v1/stage0/src/cli_run/native_lane_runner.rs: the accepted_file_advisories arm and advised_files check in parse_native_run_output, reached by every native run's stdout decode; native_file_advisories_summary, called once from run_required_v2_native_inner after the file-refusal summary; decode_native_census_output, reached by every run_v2_native_census (gunbc test //gunbc/instruments:v2-native-census) through the shared row decode and count check"
 }
diff --git a/dag/gunbc/native_serve.dag b/dag/gunbc/native_serve.dag
index 5cbded6c598..5b8dbb96520 100644
--- a/dag/gunbc/native_serve.dag
+++ b/dag/gunbc/native_serve.dag
@@ -368,6 +368,29 @@ fn native_serve_read_refused(reason: String) -> ServeWireResponse {
   ServeWireResponse { status: 400, content_type_label: native_serve_text_plain, body: concat("bad request: ", concat(reason, "\n")), headers: [] }
 }
 
+// The answer when the handler's effect transport failed (a bound handler -- the clock's shell call, a
+// REST exchange -- returned an error the handler propagated rather than modeled). The main observes
+// the failure, this fold says what it means: the server failed, not the request, so 500 and not 400.
+fn native_serve_effect_failed(reason: String) -> ServeWireResponse {
+  ServeWireResponse { status: 500, content_type_label: native_serve_text_plain, body: concat("effect transport failed: ", concat(reason, "\n")), headers: [] }
+}
+
+// THE EFFECT WORKER. The rendered main realizes ONE worker generation that owns the effect executor
+// and every admitted handle (none for an entry with no effects), and reuses it for each request it
+// answers; a generation that misses the deadline or panics is abandoned and a replacement realized.
+// A generation that cannot be realized is NOT an effect transport failure (native_serve_effect_failed):
+// no handler ran, and none can. At startup the main refuses with this reason before it announces --
+// exit 2, like every launch refusal -- so no process answers /livez that cannot serve a handler. A
+// REPLACEMENT that cannot be realized ends the process with native_serve_worker_replacement_exit_code
+// after the request in hand is answered, for its supervisor to restart it.
+fn native_serve_worker_unrealized(reason: String) -> String {
+  concat("the effect worker could not be realized: ", reason)
+}
+
+// EX_TEMPFAIL (sysexits.h 75): a restart re-runs the startup realization, which refuses with exit 2
+// if the condition persists.
+data native_serve_worker_replacement_exit_code: Int = 75
+
 // ── ROUTING BEFORE THE HANDLER ──────────────────────────────────────────────────────────────
 // GET /livez is answered without entering the handler, for the reason gunbc.serve_liveness
 // states: the conditions that make a served process unhealthy are the conditions under which its
diff --git a/dag/gunbc/native_serve_probe.dag b/dag/gunbc/native_serve_probe.dag
index a63928fd789..549a103e92d 100644
--- a/dag/gunbc/native_serve_probe.dag
+++ b/dag/gunbc/native_serve_probe.dag
@@ -53,6 +53,7 @@ type NativeServeExpect
   | ExpectHeader { status: Int, line: String }
   | ExpectBodyPrefix { status: Int, prefix: String }
   | ExpectLiveness
+  | ExpectClockReadings
 
 type NativeServeProbeCase {
   identity: String
@@ -60,7 +61,43 @@ type NativeServeProbeCase {
   expect: NativeServeExpect
 }
 
-fn native_serve_probe_cases() -> List<NativeServeProbeCase> {
+// THE BOUND-EFFECT CASES (native broker 2N, v1.compiler.emit NativeEffectRealizationAdmission). The
+// fixture's /effects routes make it demand extdeps.clock Clock and a REST service, so these cases
+// execute the handlers its rendered main bound. The host starts a SECOND instance of the fixture as
+// the local test server and passes its bound port here, so every byte -- the Content-Length too --
+// is still written by this module. Port 1 is the refused port: nothing listens on it.
+data native_serve_probe_refused_port: Int = 1
+
+fn native_serve_probe_rest_request(port: Int) -> String {
+  let body = to_string(value: port)
+  concat("POST /effects/rest HTTP/1.1\r\nContent-Length: ", concat(to_string(value: string_length(s: body)), concat("\r\n\r\n", body)))
+}
+
+fn native_serve_probe_effect_cases(peer_port: Int) -> List<NativeServeProbeCase> {
+  [
+    NativeServeProbeCase {
+      identity: "effect_clock_now_is_plausible_and_monotone",
+      request: "GET /effects/clock HTTP/1.1\r\n\r\n",
+      expect: ExpectClockReadings,
+    },
+    NativeServeProbeCase {
+      identity: "effect_rest_against_a_local_server_is_answered",
+      request: native_serve_probe_rest_request(port: peer_port),
+      expect: ExpectBody { status: 200, body: "answered live\n" },
+    },
+    NativeServeProbeCase {
+      identity: "effect_rest_against_a_refused_port_is_rest_transport_refused",
+      request: native_serve_probe_rest_request(port: native_serve_probe_refused_port),
+      expect: ExpectBody { status: 200, body: "refused transport\n" },
+    },
+  ]
+}
+
+fn native_serve_probe_cases(peer_port: Int) -> List<NativeServeProbeCase> {
+  concat(native_serve_probe_door_cases(), concat(native_serve_probe_effect_cases(peer_port: peer_port), native_serve_probe_budget_cases()))
+}
+
+fn native_serve_probe_door_cases() -> List<NativeServeProbeCase> {
   [
     NativeServeProbeCase {
       identity: "handler_route_reads_framed_identity",
@@ -117,6 +154,13 @@ fn native_serve_probe_cases() -> List<NativeServeProbeCase> {
       request: "GET /livez HTTP/1.1\r\n\r\n",
       expect: ExpectLiveness,
     },
+  ]
+}
+
+// THE BUDGET CASES, LAST (see the head of this module): the final one ends the served process, so no
+// case may follow it -- the bound-effect cases run before them.
+fn native_serve_probe_budget_cases() -> List<NativeServeProbeCase> {
+  [
     NativeServeProbeCase {
       identity: "budget_worker_panic_one_is_a_handler_failure_not_a_stuck_worker",
       request: "GET /panic HTTP/1.1\r\n\r\n",
@@ -181,8 +225,39 @@ fn native_serve_probe_cases() -> List<NativeServeProbeCase> {
 }
 
 // What the host writes, in case order. The host joins responses to cases by this order.
-fn native_serve_probe_requests() -> List<String> {
-  native_serve_probe_cases() |> map(c => c.request)
+fn native_serve_probe_requests(peer_port: Int) -> List<String> {
+  native_serve_probe_cases(peer_port: peer_port) |> map(c => c.request)
+}
+
+// A Clock.Now reading as the fixture returns it: an RFC 3339 UTC second, `YYYY-MM-DDTHH:MM:SSZ`
+// (extdeps.clock Clock.Now's `date -u +%Y-%m-%dT%H:%M:%SZ`), read as the integer YYYYMMDDHHMMSS so
+// two readings order. A reading in any other shape, or before 2026, is not plausible.
+fn native_serve_clock_reading_order(reading: String) -> Int? {
+  if string_length(s: reading) != 20 || substring(s: reading, start: 10, end: 11) != "T" || substring(s: reading, start: 19, end: 20) != "Z" {
+    none
+  } else {
+    let digits = concat(substring(s: reading, start: 0, end: 4), concat(substring(s: reading, start: 5, end: 7), concat(substring(s: reading, start: 8, end: 10),
+      concat(substring(s: reading, start: 11, end: 13), concat(substring(s: reading, start: 14, end: 16), substring(s: reading, start: 17, end: 19))))))
+    match parse_int(s: digits) {
+      Present { value: n } => if n >= 20260000000000 { Present { value: n } } else { none }
+      Absent => none
+    }
+  }
+}
+
+fn native_serve_clock_failure(identity: String, body: String) -> String {
+  let lines = split(s: body, delimiter: "\n") |> filter(l => l != "")
+  if (lines |> count) != 2 { concat(identity, concat(": expected two readings, got [", concat(body, "]"))) } else {
+    let first = match lines |> first { Present { value: l } => native_serve_clock_reading_order(reading: l)  Absent => none }
+    let second = match lines |> skip(1) |> first { Present { value: l } => native_serve_clock_reading_order(reading: l)  Absent => none }
+    match first {
+      Absent => concat(identity, concat(": first reading is not a plausible UTC second: [", concat(body, "]")))
+      Present { value: a } => match second {
+        Absent => concat(identity, concat(": second reading is not a plausible UTC second: [", concat(body, "]")))
+        Present { value: b } => if b >= a { "" } else { concat(identity, concat(": readings went backwards: [", concat(body, "]"))) }
+      }
+    }
+  }
 }
 
 type NativeServeWire {
@@ -205,7 +280,7 @@ fn native_serve_wire_parse(response: String) -> NativeServeWire? {
         ""
       }
       match parse_int(s: status_text) {
-        Present { value: status } => NativeServeWire { status: status, head_lines: head_lines, body: join(rest, "\r\n\r\n") }
+        Present { value: status } => Present { value: NativeServeWire { status: status, head_lines: head_lines, body: join(rest, "\r\n\r\n") } }
         Absent => none
       }
     Empty => none
@@ -255,6 +330,10 @@ fn native_serve_case_failure(c: NativeServeProbeCase, response: String) -> Strin
           if w.status != 200 { concat(c.identity, concat(": status ", to_string(value: w.status))) } else {
             native_serve_liveness_failure(identity: c.identity, read: observe_serve_liveness(body: w.body))
           }
+        ExpectClockReadings =>
+          if w.status != 200 { concat(c.identity, concat(": status ", concat(to_string(value: w.status), concat(" [", concat(w.body, "]"))))) } else {
+            native_serve_clock_failure(identity: c.identity, body: w.body)
+          }
       }
   }
 }
@@ -263,7 +342,7 @@ fn native_serve_case_failures(cases: List<NativeServeProbeCase>, responses: List
   match cases {
     Empty =>
       match responses {
-        Empty => acc
+        Empty => Present { value: acc }
         Cons { head: _, tail: _ } => none
       }
     Cons { head: c, tail: more } =>
@@ -282,17 +361,22 @@ fn no_observation(reason: String) -> ProcessExit {
 
 // announcement: the line the served process printed once bound. responses: one per request, in
 // order. refused_status / refused_stderr: the run launched with native_serve_probe_refused_revision.
-// served_exit_status: how the served process ended after the last case, as the host observed it
+// peer_announcement / peer_port: the second fixture instance the REST effect cases call, and the port
+// those requests named. served_exit_status: how the served process ended after the last case, as the host observed it
 // within a bounded wait (negative when it was still running and had to be killed). The last budget
 // case drives it past the stuck-worker ceiling, so it must have exited by itself with the code
 // gunbc.native_serve declares -- not merely answered the 503.
-fn native_serve_probe_standing(announcement: String, responses: List<String>, refused_status: Int, refused_stderr: String, served_exit_status: Int) -> ProcessExit {
+fn native_serve_probe_standing(announcement: String, peer_announcement: String, peer_port: Int, responses: List<String>, refused_status: Int, refused_stderr: String, served_exit_status: Int) -> ProcessExit {
   if !starts_with(s: announcement, prefix: "native-serve listening on ") {
     no_observation(reason: concat("the service did not announce a bound address: ", announcement))
+  } else if !starts_with(s: peer_announcement, prefix: "native-serve listening on ") {
+    no_observation(reason: concat("the peer service did not announce a bound address: ", peer_announcement))
+  } else if (split(s: peer_announcement, delimiter: concat(":", concat(to_string(value: peer_port), " "))) |> count) != 2 {
+    no_observation(reason: concat("the peer port the requests named is not the port the peer announced: ", peer_announcement))
   } else if refused_status != 2 || !starts_with(s: refused_stderr, prefix: "REFUSED: ") {
     ExitFailure { code: native_serve_probe_not_held_code, reason: concat("a launch with a non-revision release was not refused before binding (status ", concat(to_string(value: refused_status), ")")) }
   } else {
-    match native_serve_case_failures(cases: native_serve_probe_cases(), responses: responses, acc: []) {
+    match native_serve_case_failures(cases: native_serve_probe_cases(peer_port: peer_port), responses: responses, acc: []) {
       Absent => no_observation(reason: "the responses do not join the cases one for one")
       Present { value: failures } =>
         if (failures |> count) > 0 {
@@ -303,3 +387,4 @@ fn native_serve_probe_standing(announcement: String, responses: List<String>, re
     }
   }
 }
+
diff --git a/dag/gunbc/native_serve_program_seed_growth.dag b/dag/gunbc/native_serve_program_seed_growth.dag
index f94ac4d4a73..97e5c07dec3 100644
--- a/dag/gunbc/native_serve_program_seed_growth.dag
+++ b/dag/gunbc/native_serve_program_seed_growth.dag
@@ -16,6 +16,16 @@ data native_serve_program_seed_growth_justification: SeedGrowthJustification = S
       decl_name: "run_native_serve_program",
       field: WholeDeclaration
     },
+    DeclarationRef {
+      module_path: "v1_compiler.cli_run.native_lane_runner",
+      decl_name: "NativeServeInstance",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.cli_run.native_lane_runner",
+      decl_name: "native_serve_start",
+      field: WholeDeclaration
+    },
     DeclarationRef {
       module_path: "v1_compiler.target_invocation_host",
       decl_name: "run_native_serve_program",
@@ -23,7 +33,7 @@ data native_serve_program_seed_growth_justification: SeedGrowthJustification = S
     }
   ],
 
-  reason: "The one producer arm for std.compiler_entry NativeServeDriver services (gunbc.target_binding NativeServeProgramProducer { entry }), the instrument the operator ruling of 2026-10-03 asked for beside the arm. Its host part is only what no .dag fold can do: emit and build through the existing prepare_emitted_compiler_for_entry, spawn the built service, read the address it announces, write the requests gunbc.native_serve_probe native_serve_probe_requests names to real TCP connections, and carry the bytes that came back out unjudged, plus one launch with gunbc.native_serve_probe native_serve_probe_refused_revision whose status and stderr it carries the same way. Every verdict -- the cases, what each owes, the join of responses to cases, the refused start -- is native_serve_probe_standing, evaluated by the host and mapped through cli_run classify_exit, so the host adds none. It is ONE arm generic over its entry: the approval broker's native service is a binding row, not another arm.",
+  reason: "The one producer arm for std.compiler_entry NativeServeDriver services (gunbc.target_binding NativeServeProgramProducer { entry }), the instrument the operator ruling of 2026-10-03 asked for beside the arm. Its host part is only what no .dag fold can do: emit and build through the existing prepare_emitted_compiler_for_entry, spawn the built service, read the address it announces, write the requests gunbc.native_serve_probe native_serve_probe_requests names to real TCP connections, and carry the bytes that came back out unjudged, plus one launch with gunbc.native_serve_probe native_serve_probe_refused_revision whose status and stderr it carries the same way. Every verdict -- the cases, what each owes, the join of responses to cases, the refused start -- is native_serve_probe_standing, evaluated by the host and mapped through cli_run classify_exit, so the host adds none. It is ONE arm generic over its entry: the approval broker's native service is a binding row, not another arm. It also starts a SECOND instance of the same entry as the local server its bound REST handler is pointed at (native broker 2N), reads that instance's announced port, and asks native_serve_probe_requests for the requests with that port as the argument, so the request bytes are still the reader's. It also starts a SECOND instance of the same entry as the local peer its bound REST handler is pointed at (native broker 2N), reading the peer's announced port and handing it to native_serve_probe_requests, and it waits, bounded, for the subject to exit by itself past the stuck-worker ceiling: process control and byte carriage, no decision.",
 
   owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
 
diff --git a/dag/gunbc/non_fold_residue.dag b/dag/gunbc/non_fold_residue.dag
index 578bcfb740f..e9e36c9f22c 100644
--- a/dag/gunbc/non_fold_residue.dag
+++ b/dag/gunbc/non_fold_residue.dag
@@ -672,8 +672,6 @@ data non_fold_residue_frontier: List<FrontierRow> = [
   FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/megarac_kvm_still.dag::kvm_last_result" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/megarac_kvm_still.dag::kvm_observer_trigger" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/megarac_kvm_still.dag::kvm_stopped_seen" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
-  FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/megarac_kvm_still.dag::megarac_kvm_observer_start" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
-  FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/megarac_media_attach.dag::presentation_still_served" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/mtcollins1_boot_diagnostic_bundle.dag::media_loss_of_look" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/mtcollins1_boot_run.dag::mtcollins1_boot_await_capture_terminal" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/mtcollins1_boot_run.dag::mtcollins1_boot_on_srv1_resolving_toolchain" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
@@ -688,8 +686,6 @@ data non_fold_residue_frontier: List<FrontierRow> = [
   FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/mtcollins1_sol_notice.dag::sol_notice_deliver" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/mtcollins1_sol_notice.dag::sol_notice_observe" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/mtcollins1_sol_notice.dag::sol_notice_pass_saw_exit" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
-  FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/mtcollins1_ui_bundle_observe.dag::served_crawl" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
-  FrontierRow { subject: PathSubject { path: "dag/gunbc/machine_intake/mtcollins1_ui_bundle_observe.dag::served_seed_fetched" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "dag/gunbc/observation_ci_render.dag::ci_file_effect_line" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "dag/gunbc/owned_process.dag::owned_process_standing_of" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "dag/gunbc/product/capacity/cohort_observation.dag::instants_comparable" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
@@ -732,7 +728,6 @@ data non_fold_residue_frontier: List<FrontierRow> = [
   FrontierRow { subject: PathSubject { path: "src/v2/compiler/05_eval.dag::eval_node_is_callee_reference" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "src/v2/compiler/05_eval.dag::eval_node_is_transform" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "src/v2/compiler/06_translate.dag::translate_edge_is_arrow_contract" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
-  FrontierRow { subject: PathSubject { path: "src/v2/compiler/body_lowering_fold.dag::body_lower_is_unrecognised_lowered_shape" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "src/v2/compiler/emit_produced.dag::module_member_class" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "src/v2/compiler/emit_produced.dag::module_member_conj_class" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
   FrontierRow { subject: PathSubject { path: "src/v2/compiler/emit_produced.dag::refinement_row_class" }, reason: nfr_reason_typed_census_ca5ed1724b, dissolution: nfr_dissolve_owning_fold },
diff --git a/dag/gunbc/oracle_oci/always_free_ensure.dag b/dag/gunbc/oracle_oci/always_free_ensure.dag
new file mode 100644
index 00000000000..ab8b31333fe
--- /dev/null
+++ b/dag/gunbc/oracle_oci/always_free_ensure.dag
@@ -0,0 +1,60 @@
+module gunbc.oracle_oci.always_free_ensure
+
+import std.types { Bool, List, NonEmptyStr, String }
+import std.resources { Network }
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+import extdeps.filesystem.filesystem_io { Filesystem }
+import gunbc.oracle_oci.compartment_ensure {
+  ensure_oci_free_compartment, OciCompartmentStanding, CompartmentReady, CompartmentNotReady,
+}
+import gunbc.oracle_oci.network_ensure { oci_free_network, OciNetworkStanding, NetworkReady, NetworkNotReady }
+import gunbc.oracle_oci.instance_ensure { oci_free_instances }
+
+// THE OPERATOR'S ALWAYS FREE TENANCY, CONVERGED IN ORDER: the compartment, then the network inside it,
+// then the instances on that network. Each layer is the next one's input and is read back before it
+// is used, so a run stops at the first layer that has not reached its goal, names it, and creates
+// nothing above it. Run it until it exits 0. From an empty tenancy that takes a few runs, because
+// each newly created resource is provisioning when it is first read back.
+//
+// It runs on srv1, which holds the custodied API key (gunbc.host_credential_custody_converge
+// OracleOciApiSigningKey). The receipt is written whatever the outcome.
+
+data oci_always_free_ensure_receipt_path: String = "target/oci-always-free-ensure-receipt.txt"
+
+type OciAlwaysFreeOutcome {
+  lines: List<String>
+  held: Bool
+}
+
+fn oci_always_free_converge() -> OciAlwaysFreeOutcome uses net: Network {
+  let compartment = ensure_oci_free_compartment()
+  {
+    match compartment.standing {
+      CompartmentNotReady { cause } => OciAlwaysFreeOutcome { lines: [compartment.line], held: false }
+      CompartmentReady { id } =>
+        match oci_free_network(compartment: id) {
+          NetworkNotReady { lines } => OciAlwaysFreeOutcome { lines: concat([compartment.line], lines), held: false }
+          NetworkReady { subnet, lines } => {
+            let instances = oci_free_instances(compartment: id, subnet: subnet)
+            OciAlwaysFreeOutcome {
+              lines: concat(concat([compartment.line], lines), map(instances, o => o.line)),
+              held: filter(instances, o => !o.held).length() == 0,
+            }
+          }
+        }
+    }
+  }
+}
+
+fn ensure() -> ProcessExit uses net: Network {
+  let outcome = oci_always_free_converge()
+  let text = join(outcome.lines, "\n")
+  let written = Filesystem.Write(path: oci_always_free_ensure_receipt_path, content: text)
+  if !written.success {
+    exit_failure(reason: concat("THE RECEIPT COULD NOT BE WRITTEN: ", written.error))
+  } else if outcome.held {
+    ExitSuccess
+  } else {
+    exit_failure(reason: text)
+  }
+}
diff --git a/dag/gunbc/oracle_oci/instance_ensure.dag b/dag/gunbc/oracle_oci/instance_ensure.dag
new file mode 100644
index 00000000000..2eba8b01090
--- /dev/null
+++ b/dag/gunbc/oracle_oci/instance_ensure.dag
@@ -0,0 +1,703 @@
+module gunbc.oracle_oci.instance_ensure
+
+import std.types { Bool, Int, List, NonEmptyStr, String }
+import std.resources { Network }
+import std.measure { Gigabyte, gigabyte, gigabyte_count, Second, second, second_count, measure_sub, measure_le, MeasureDifference, MeasureSubtrahendExceedsMinuend }
+import std.algebra { trim }
+import extdeps.clock { Clock }
+import v2.std.algebra { any }
+import extdeps.languages.json.emit { JsonValue, json_object, json_kv, json_string, json_bool, json_int, serialize_json }
+import extdeps.cloud.oracle_oci_request_signing { OciPostJson }
+import extdeps.cloud.oracle_oci { VmStandardA1Flex, VmStandardE21Micro, OnDemandCapacity, oci_shape_wire_name }
+import extdeps.ssh { ssh_public_key_line }
+import std.optional { Absent, Present }
+import extdeps.filesystem.filesystem_io {
+  Filesystem, filesystem_exact_read,
+  FilesystemExactPathRead, FilesystemExactPathAbsent, FilesystemExactPathUnreadable, FilesystemExactPathKindUnrecognized,
+}
+import extdeps.uri { uri_percent_encode_component, UriPercentComponentEncoded, UriPercentComponentRefused }
+import product.supplier.oracle_oci {
+  OciPlannedInstance, OciInstanceSize, A1FlexSize, E2MicroSize,
+  InHomeRegion, InMicroEligibleDomain,
+  OciAllowanceFit, FitsAlwaysFree, ExceedsAlwaysFree, OciAllowanceBreach,
+  oci_always_free_fit, oci_always_free_fit_beside, oci_instance_shape,
+}
+import gunbc.oracle_oci.tenancy_usage {
+  oci_tenancy_usage, TenancyUsageObserved, TenancyUsageRefused,
+  OciNamesRead, OciNamesListed, OciNamesRefused, oci_names_of, oci_availability_domains,
+  OciWhole, OciWholeValue, OciWholeRefused, oci_shape_config_whole,
+}
+import gunbc.fleet_ssh_access { fleet_automation_ssh_key, operator_macbook_ssh_key }
+import gunbc.oracle_oci.api {
+  OciExchange, OciAnswered, OciExchangeRefused,
+  OciListRead, OciListed, OciListInaccessible, OciListRefused,
+  OciRowsAdmitted, OciRowRefused, oci_admit_rows, oci_admitted_text,
+  oci_list, oci_signed_exchange, oci_iaas_host, oci_identity_host, oci_tenancy_ocid,
+}
+
+// THE OPERATOR'S ALWAYS FREE INSTANCES, LAUNCHED INTO THE gunbc-always-free COMPARTMENT AND SUBNET.
+//
+// The plan is the operator's choice of 2026-10-05: two AMD micros and one A1 instance with 2 OCPUs
+// and 12 GB. Before anything is launched, its members still to launch are fitted beside the whole
+// tenancy's observed usage (oci_free_instances), and a plan that does not fit launches nothing. Each boot volume is 50 GB, the smallest
+// size the launch API accepts, so the three take 150 of the shared 200 GB.
+//
+// Nothing about placement is guessed. The micro's availability domain is the one whose shape list
+// (ListShapes) offers VM.Standard.E2.1.Micro, and the image is the newest Oracle Linux 9 image Oracle
+// lists for that shape. An A1 launch that Oracle refuses for lack of host capacity, which its Always
+// Free page says to answer by trying a different availability domain, is retried in the next domain.
+// When every domain has refused for capacity, that is the outcome, and it is reported as such.
+//
+// The instances authorize two keys: the fleet automation key, so the fleet can reach them, and the
+// operator's macbook key, so the operator can. Both come from gunbc.fleet_ssh_access, not re-spelled.
+
+data oci_free_boot_volume: Gigabyte = gigabyte(count: 50)
+
+fn oci_free_plan_instance(name: NonEmptyStr, size: OciInstanceSize) -> OciPlannedInstance {
+  OciPlannedInstance {
+    name: name,
+    size: size,
+    boot_volume: oci_free_boot_volume,
+    capacity: OnDemandCapacity,
+    region: InHomeRegion,
+    micro_domain: InMicroEligibleDomain,
+  }
+}
+
+// The micro_domain field is InMicroEligibleDomain by construction: this converge launches a micro only
+// into the domain ListShapes names as offering the micro shape, and refuses when no domain does.
+data oci_free_plan: List<OciPlannedInstance> = [
+  oci_free_plan_instance(name: "gunbc-free-micro-1", size: E2MicroSize),
+  oci_free_plan_instance(name: "gunbc-free-micro-2", size: E2MicroSize),
+  oci_free_plan_instance(name: "gunbc-free-a1", size: A1FlexSize { ocpus: 2, memory: gigabyte(count: 12) }),
+]
+
+fn oci_free_authorized_keys() -> String {
+  join([ssh_public_key_line(k: fleet_automation_ssh_key), ssh_public_key_line(k: operator_macbook_ssh_key)], "\n")
+}
+
+// ── QUERY ENCODING ────────────────────────────────────────────────────────────────────────────
+//
+// The signing page requires query values URL-encoded per RFC 3986, and the signed target and the sent
+// target to be one string. Availability domain names carry a colon, and the image query carries a
+// space. The encoding is extdeps.uri uri_percent_encode_component, which encodes UTF-8 and refuses
+// with a typed cause. Its refusal stops the read that needed the value.
+type OciQueryValue
+  = OciQueryEncoded { wire: String }
+  | OciQueryRefused { line: String }
+
+fn oci_query_value(value: String) -> OciQueryValue {
+  if value == "" {
+    OciQueryRefused { line: "an empty query value" }
+  } else {
+    match uri_percent_encode_component(value: value as NonEmptyStr) {
+      UriPercentComponentEncoded(wire) => OciQueryEncoded { wire: wire as String }
+      UriPercentComponentRefused { cause } => OciQueryRefused { line: join(["query value ", value, " does not percent-encode: ", to_string(cause)], "") }
+    }
+  }
+}
+
+// ── INSTANCE STATE ────────────────────────────────────────────────────────────────────────────
+
+// The lifecycle states Oracle's SDK Instance model declares.
+type OciInstanceState
+  = InstanceMoving
+  | InstanceProvisioning
+  | InstanceRunning
+  | InstanceStarting
+  | InstanceStopping
+  | InstanceStopped
+  | InstanceCreatingImage
+  | InstanceTerminating
+  | InstanceTerminated
+  | InstanceStateUnknown { raw: String }
+
+fn oci_instance_state(raw: String) -> OciInstanceState {
+  if raw == "MOVING" { InstanceMoving }
+  else if raw == "PROVISIONING" { InstanceProvisioning }
+  else if raw == "RUNNING" { InstanceRunning }
+  else if raw == "STARTING" { InstanceStarting }
+  else if raw == "STOPPING" { InstanceStopping }
+  else if raw == "STOPPED" { InstanceStopped }
+  else if raw == "CREATING_IMAGE" { InstanceCreatingImage }
+  else if raw == "TERMINATING" { InstanceTerminating }
+  else if raw == "TERMINATED" { InstanceTerminated }
+  else { InstanceStateUnknown { raw: raw } }
+}
+
+fn oci_instance_live(s: OciInstanceState) -> Bool {
+  match s {
+    InstanceTerminated => false
+    InstanceMoving => true
+    InstanceProvisioning => true
+    InstanceRunning => true
+    InstanceStarting => true
+    InstanceStopping => true
+    InstanceStopped => true
+    InstanceCreatingImage => true
+    InstanceTerminating => true
+    InstanceStateUnknown { raw } => true
+  }
+}
+
+// An A1.Flex instance's size is part of its identity for this converge, read exactly from its
+// shapeConfig. A micro has no shapeConfig to match, so its reads are kept but never consulted.
+type OciObservedInstance {
+  id: String
+  display_name: String
+  state: OciInstanceState
+  shape: String
+  ocpus: OciWhole
+  memory_gb: OciWhole
+}
+
+data oci_instance_required_fields: List<String> = ["id", "displayName", "lifecycleState", "shape"]
+
+// Only for a row ADMITTED on oci_instance_required_fields.
+fn oci_observed_instance_of(v: JsonValue) -> OciObservedInstance {
+  OciObservedInstance {
+    id: oci_admitted_text(row: v, key: "id"),
+    display_name: oci_admitted_text(row: v, key: "displayName"),
+    state: oci_instance_state(raw: oci_admitted_text(row: v, key: "lifecycleState")),
+    shape: oci_admitted_text(row: v, key: "shape"),
+    ocpus: oci_shape_config_whole(row: v, key: "ocpus"),
+    memory_gb: oci_shape_config_whole(row: v, key: "memoryInGBs"),
+  }
+}
+
+// PURE: whether an observed instance has the planned size. A micro's size is fixed by its shape. An
+// A1's OCPUs and memory must be read and must equal the plan's; an unreadable size is a refusal, never
+// a match (side-chat review on gunbc#13351).
+fn oci_size_disagreement(planned: OciPlannedInstance, o: OciObservedInstance) -> String {
+  match planned.size {
+    E2MicroSize => ""
+    A1FlexSize { ocpus, memory } =>
+      match o.ocpus {
+        OciWholeRefused { cause } => concat("its OCPUs are unreadable: ", cause)
+        OciWholeValue { value: got_ocpus } =>
+          match o.memory_gb {
+            OciWholeRefused { cause } => concat("its memory is unreadable: ", cause)
+            OciWholeValue { value: got_memory } =>
+              if got_ocpus == ocpus && got_memory == gigabyte_count(g: memory) {
+                ""
+              } else {
+                join(["it has ", to_string(got_ocpus), " OCPUs and ", to_string(got_memory), " GB where the plan has ", to_string(ocpus), " and ", to_string(gigabyte_count(g: memory))], "")
+              }
+          }
+      }
+  }
+}
+
+// PURE: what the instance list decides for one planned instance.
+type OciInstanceDecision
+  = InstanceHeld { line: String }
+  | InstanceLaunch
+  | InstanceStop { line: String }
+
+fn oci_instance_decision(planned: OciPlannedInstance, observed: List<OciObservedInstance>) -> OciInstanceDecision {
+  let name = planned.name as String
+  let shape = oci_shape_wire_name(shape: oci_instance_shape(size: planned.size)) as String
+  let live = filter(observed, o => o.display_name == name && oci_instance_live(s: o.state))
+  if live.length() == 0 {
+    InstanceLaunch
+  } else if live.length() > 1 {
+    InstanceStop { line: join(["oci instance ", name, ": more than one live instance has this name"], "") }
+  } else {
+    match live.first() {
+      Absent => InstanceStop { line: join(["oci instance ", name, ": a nonempty list had no first element"], "") }
+      Present { value: o } =>
+        if o.shape != shape {
+          InstanceStop { line: join(["oci instance ", name, " ", o.id, " is shape ", o.shape, ", not ", shape, "; this converge does not reshape an instance"], "") }
+        } else if oci_size_disagreement(planned: planned, o: o) != "" {
+          InstanceStop { line: join(["oci instance ", name, " ", o.id, " is not the planned size (", oci_size_disagreement(planned: planned, o: o), "); this converge does not resize an instance"], "") }
+        } else {
+          match o.state {
+            InstanceRunning => InstanceHeld { line: join(["oci instance ", name, " ", o.id, " RUNNING, converged"], "") }
+            InstanceProvisioning => InstanceStop { line: join(["oci instance ", name, " ", o.id, " is PROVISIONING; run again"], "") }
+            InstanceStarting => InstanceStop { line: join(["oci instance ", name, " ", o.id, " is STARTING; run again"], "") }
+            InstanceMoving => InstanceStop { line: join(["oci instance ", name, " ", o.id, " is MOVING; run again"], "") }
+            InstanceCreatingImage => InstanceStop { line: join(["oci instance ", name, " ", o.id, " is CREATING_IMAGE; run again"], "") }
+            InstanceStopping => InstanceStop { line: join(["oci instance ", name, " ", o.id, " is STOPPING; an operator stopped it, and this converge does not start it"], "") }
+            InstanceStopped => InstanceStop { line: join(["oci instance ", name, " ", o.id, " is STOPPED; an operator stopped it, and this converge does not start it"], "") }
+            InstanceTerminating => InstanceStop { line: join(["oci instance ", name, " ", o.id, " is TERMINATING; wait, then run again to relaunch it"], "") }
+            InstanceTerminated => InstanceStop { line: join(["oci instance ", name, ": a terminated instance passed the live filter"], "") }
+            InstanceStateUnknown { raw } => InstanceStop { line: join(["oci instance ", name, " ", o.id, " reports lifecycle state ", raw, ", which is not in Oracle's published set"], "") }
+          }
+        }
+    }
+  }
+}
+
+// ── PLACEMENT FACTS, READ ─────────────────────────────────────────────────────────────────────
+
+
+
+// THREE ANSWERS, NOT TWO (review 76366). A refused ListShapes read is not "this domain lacks the
+// shape": collapsing it would report a confident fact about Oracle's catalog when the real cause was a
+// failed read, and lose that cause.
+type OciDomainOffer
+  = DomainOffers
+  | DomainLacks
+  | DomainReadRefused { line: String }
+
+fn oci_domain_offers(compartment: NonEmptyStr, domain: String, shape: String) -> OciDomainOffer uses net: Network {
+  match oci_query_value(value: domain) {
+    OciQueryRefused { line } => DomainReadRefused { line: join(["ListShapes for ", domain, " not sent: ", line], "") }
+    OciQueryEncoded { wire } => oci_domain_offers_read(domain: domain, shape: shape, read: oci_list(operation: "ListShapes", host: oci_iaas_host, path_and_query: join(["/20160918/shapes?compartmentId=", compartment as String, "&availabilityDomain=", wire], "") as NonEmptyStr))
+  }
+}
+
+fn oci_domain_offers_read(domain: String, shape: String, read: OciListRead) -> OciDomainOffer {
+  match oci_names_of(
+    read: read,
+    operation: "ListShapes",
+    key: "shape",
+  ) {
+    OciNamesListed { names } => if any(names, n => n == shape) { DomainOffers } else { DomainLacks }
+    OciNamesRefused { line } => DomainReadRefused { line: join(["ListShapes for ", domain, " refused: ", line], "") }
+  }
+}
+
+// The newest Oracle Linux 9 image for a shape. Oracle sorts by TIMECREATED descending on request, so
+// the first item is the newest.
+type OciImageRead
+  = OciImageFound { id: NonEmptyStr }
+  | OciImageRefused { line: String }
+
+fn oci_newest_image(compartment: NonEmptyStr, shape: String) -> OciImageRead uses net: Network {
+  match oci_query_value(value: "Oracle Linux") {
+    OciQueryRefused { line } => OciImageRefused { line: concat("ListImages not sent: ", line) }
+    OciQueryEncoded { wire: os } =>
+      match oci_query_value(value: shape) {
+        OciQueryRefused { line } => OciImageRefused { line: concat("ListImages not sent: ", line) }
+        OciQueryEncoded { wire: shape_wire } => oci_newest_image_at(compartment: compartment, shape: shape, path: join(["/20160918/images?compartmentId=", compartment as String, "&operatingSystem=", os, "&operatingSystemVersion=9&shape=", shape_wire, "&sortBy=TIMECREATED&sortOrder=DESC"], ""))
+      }
+  }
+}
+
+fn oci_newest_image_at(compartment: NonEmptyStr, shape: String, path: String) -> OciImageRead uses net: Network {
+  match oci_names_of(read: oci_list(operation: "ListImages", host: oci_iaas_host, path_and_query: path as NonEmptyStr), operation: "ListImages", key: "id") {
+    OciNamesRefused { line } => OciImageRefused { line: line }
+    OciNamesListed { names } => match names.first() {
+      Absent => OciImageRefused { line: join(["ListImages lists no Oracle Linux 9 image for ", shape], "") }
+      Present { value: id } => if id == "" { OciImageRefused { line: "ListImages listed an image with no id" } } else { OciImageFound { id: id as NonEmptyStr } }
+    }
+  }
+}
+
+// ── LAUNCH ────────────────────────────────────────────────────────────────────────────────────
+
+fn oci_launch_body(planned: OciPlannedInstance, compartment: NonEmptyStr, subnet: NonEmptyStr, domain: String, image: NonEmptyStr) -> String {
+  let shape = oci_shape_wire_name(shape: oci_instance_shape(size: planned.size)) as String
+  let common = [
+    json_kv(key: "availabilityDomain", value: json_string(s: domain)),
+    json_kv(key: "compartmentId", value: json_string(s: compartment as String)),
+    json_kv(key: "displayName", value: json_string(s: planned.name as String)),
+    json_kv(key: "shape", value: json_string(s: shape)),
+    json_kv(key: "sourceDetails", value: json_object(members: [
+      json_kv(key: "sourceType", value: json_string(s: "image")),
+      json_kv(key: "imageId", value: json_string(s: image as String)),
+      json_kv(key: "bootVolumeSizeInGBs", value: json_int(n: gigabyte_count(g: planned.boot_volume))),
+    ])),
+    json_kv(key: "createVnicDetails", value: json_object(members: [
+      json_kv(key: "subnetId", value: json_string(s: subnet as String)),
+      json_kv(key: "assignPublicIp", value: json_bool(b: true)),
+    ])),
+    json_kv(key: "metadata", value: json_object(members: [
+      json_kv(key: "ssh_authorized_keys", value: json_string(s: oci_free_authorized_keys())),
+    ])),
+  ]
+  match planned.size {
+    E2MicroSize => serialize_json(v: json_object(members: common))
+    A1FlexSize { ocpus, memory } => serialize_json(v: json_object(members: concat(common, [
+      json_kv(key: "shapeConfig", value: json_object(members: [
+        json_kv(key: "ocpus", value: json_int(n: ocpus)),
+        json_kv(key: "memoryInGBs", value: json_int(n: gigabyte_count(g: memory))),
+      ])),
+    ])))
+  }
+}
+
+// Oracle's Always Free page names the error: "out of host capacity". It is read from the error body's
+// text, which is Oracle's message, because no distinct status or code separates it from other 500s.
+fn oci_out_of_host_capacity(status: Int, body: String) -> Bool {
+  status == 500 && (string_contains(s: body, pattern: "Out of host capacity") || string_contains(s: body, pattern: "out of host capacity"))
+}
+
+// ── ONE LOGICAL LAUNCH, HELD ACROSS RUNS (side-chat review on gunbc#13351) ─────────────────────
+//
+// A launch whose reply was lost must not be followed by a different launch for the same member. The
+// retry token is derived from the request's path and body, so it protects only a re-send of the SAME
+// body. So the exact request is recorded before it is sent, with the time it was first sent, and while
+// that record stands the converge re-sends exactly it instead of choosing again.
+//
+// THE RECORD'S LIFECYCLE IS NARROW ON PURPOSE, because retiring it is the dangerous transition:
+//   - It is CREATED only with WriteCreateNew, an exclusive create, so one run owns each generation.
+//   - It is RETIRED in exactly two cases. (a) The member is observed in the instance list, so the
+//     launch is resolved. (b) The run that created it gets a definitive non-creation on that FIRST
+//     send (a 4xx other than 409 and 429, or out of host capacity). No other run can create a record
+//     while this one exists, so that delete cannot remove a newer generation.
+//   - A RE-SEND never retires it, whatever it answers. A 401 or 403 on a re-send says nothing about
+//     what the original send did, so the record stays, and the converge asks for reconciliation.
+//   - A record older than oci_launch_replay_window is not re-sent, because Oracle's retry tokens expire
+//     after 24 hours and may be invalidated earlier. Past that window the converge refuses and asks for
+//     reconciliation, rather than re-sending on a deduplication that may no longer hold.
+// RECONCILIATION is an operator step, done with no run active: look for the instance in the console,
+// then delete the record.
+//
+// All of this runs under the instance lock (oci_free_instances), so no other run can send, re-send or
+// retire while one does.
+//
+// The record lives in /etc/gunbc/oracle-oci, the root-only directory the custody converge creates for
+// the API key (gunbc.host_credential_custody_converge OracleOciApiSigningKey). It is stable across
+// checkouts, and every run that can sign can also read it.
+//
+// There is one candidate domain per launch. A1 launches refuse (below), and a micro goes to the domain
+// ListShapes names, so the converge never moves a pending launch to another domain.
+
+data oci_launch_record_dir: String = "/etc/gunbc/oracle-oci"
+
+data oci_launch_replay_window: Second = second(count: 82800)
+
+fn oci_launch_attempt_path(planned: OciPlannedInstance) -> String {
+  join([oci_launch_record_dir, "/launch-attempt-", planned.name as String, ".json"], "")
+}
+
+// INSTANTS ARE std.measure Second COUNTED FROM THE UNIX EPOCH, the unit Clock.UnixSecs prints, so the
+// record's first-send time, the clock reading and the replay window are one carrier and are compared
+// with std.measure's own subtraction and order (review 78218), never as bare integers.
+//
+// The record is the first-send instant, one newline, then the exact body.
+fn oci_launch_record_text(sent_at: Second, body: String) -> String {
+  join([to_string(second_count(s: sent_at)), body], "\n")
+}
+
+type OciLaunchRecord
+  = OciLaunchRecorded { sent_at: Second, body: String }
+  | OciLaunchRecordMalformed { cause: String }
+
+fn oci_parse_launch_record(content: String) -> OciLaunchRecord {
+  let lines = split(s: content, delimiter: "\n")
+  match lines.first() {
+    Absent => OciLaunchRecordMalformed { cause: "the record is empty" }
+    Present { value: head } =>
+      match parse_int(s: head) {
+        Absent => OciLaunchRecordMalformed { cause: "the record's first line is not epoch seconds" }
+        Present { value: sent_at } =>
+          if sent_at < 0 { OciLaunchRecordMalformed { cause: "the record's first-send time is negative" } }
+          else if lines.length() < 2 { OciLaunchRecordMalformed { cause: "the record carries no body" } }
+          else { OciLaunchRecorded { sent_at: second(count: sent_at), body: join(lines.skip(n: 1), "\n") } }
+      }
+  }
+}
+
+// PURE: whether a recorded attempt is still inside the window in which a re-send is a retry of it. A
+// clock that reads earlier than the record is not inside the window: the elapsed time is unknown.
+fn oci_replay_window_open(sent_at: Second, now: Second) -> Bool {
+  match measure_sub(a: now, b: sent_at) {
+    MeasureSubtrahendExceedsMinuend => false
+    MeasureDifference { value: elapsed } => !measure_le(a: oci_launch_replay_window, b: elapsed)
+  }
+}
+
+fn oci_definitive_non_creation(status: Int, body: String) -> Bool {
+  (status >= 400 && status < 500 && status != 409 && status != 429) || oci_out_of_host_capacity(status: status, body: body)
+}
+
+// PURE: whether an answer retires the record. Only a first send can, and only definitively.
+fn oci_answer_retires_record(first_send: Bool, status: Int, body: String) -> Bool {
+  first_send && oci_definitive_non_creation(status: status, body: body)
+}
+
+fn oci_clear_attempt(planned: OciPlannedInstance) -> String {
+  let removed = Filesystem.Delete(path: oci_launch_attempt_path(planned: planned))
+  if removed.success || removed.error_kind == "not_found" { "" } else { join([" (the launch record ", oci_launch_attempt_path(planned: planned), " could not be removed: ", removed.error, ")"], "") }
+}
+
+fn oci_reconcile_line(planned: OciPlannedInstance, why: String) -> String {
+  join(["oci instance ", planned.name as String, " NOT LAUNCHED: ", why, ". RECONCILE: check the OCI console for an instance named ", planned.name as String, " in the compartment; if none exists, delete ", oci_launch_attempt_path(planned: planned), " and run again"], "")
+}
+
+fn oci_now() -> Second? {
+  match parse_int(s: trim(s: Clock.UnixSecs().unix_secs)) {
+    Present { value } => if value < 0 { none } else { Present { value: second(count: value) } }
+    Absent => none
+  }
+}
+
+// Send the recorded body. first_send says whether this run created the record.
+fn oci_send_attempt(planned: OciPlannedInstance, body: String, first_send: Bool) -> OciInstanceOutcome uses net: Network {
+  let name = planned.name as String
+  let how = if first_send { "launch" } else { "re-send of the recorded launch" }
+  match oci_signed_exchange(shape: OciPostJson { text: body }, host: oci_iaas_host, path_and_query: "/20160918/instances") {
+    OciExchangeRefused { cause } => OciInstanceOutcome { line: join(["oci instance ", name, " ", how, " got no answer (", cause as String, "); the launch record stays, and the next run re-sends the same request"], ""), held: false }
+    OciAnswered { status, body: answer, next_page } =>
+      if status == 200 {
+        OciInstanceOutcome { line: join(["oci instance ", name, " ", how, " accepted; run again to read it back RUNNING"], ""), held: false }
+      } else if oci_answer_retires_record(first_send: first_send, status: status, body: answer) {
+        OciInstanceOutcome { line: join(["oci instance ", name, " ", how, " refused (", to_string(status), "), nothing created: ", answer, oci_clear_attempt(planned: planned)], ""), held: false }
+      } else if first_send {
+        OciInstanceOutcome { line: join(["oci instance ", name, " ", how, " answered ", to_string(status), "; the launch record stays, and the next run re-sends the same request: ", answer], ""), held: false }
+      } else {
+        OciInstanceOutcome { line: oci_reconcile_line(planned: planned, why: join(["the ", how, " answered ", to_string(status), ", which says nothing about what the original send did: ", answer], "")), held: false }
+      }
+  }
+}
+
+fn oci_replay_attempt(planned: OciPlannedInstance, content: String) -> OciInstanceOutcome uses net: Network {
+  match oci_parse_launch_record(content: content) {
+    OciLaunchRecordMalformed { cause } => OciInstanceOutcome { line: oci_reconcile_line(planned: planned, why: concat("the launch record is malformed: ", cause)), held: false }
+    OciLaunchRecorded { sent_at, body } =>
+      match oci_now() {
+        Absent => OciInstanceOutcome { line: join(["oci instance ", planned.name as String, " NOT LAUNCHED: the host clock did not print epoch seconds, so the record's replay window cannot be judged"], ""), held: false }
+        Present { value: now } =>
+          if oci_replay_window_open(sent_at: sent_at, now: now) {
+            oci_send_attempt(planned: planned, body: body, first_send: false)
+          } else {
+            OciInstanceOutcome { line: oci_reconcile_line(planned: planned, why: "the recorded launch is outside the retry-token window, so re-sending it is no longer a retry"), held: false }
+          }
+      }
+  }
+}
+
+// A launch that has no record yet: choose the domain and image, record the exact request exclusively,
+// then send it.
+fn oci_start_attempt(planned: OciPlannedInstance, compartment: NonEmptyStr, subnet: NonEmptyStr, domains: List<String>) -> OciInstanceOutcome uses net: Network {
+  let name = planned.name as String
+  let shape = oci_shape_wire_name(shape: oci_instance_shape(size: planned.size)) as String
+  match oci_micro_domain(compartment: compartment, domains: domains, shape: shape) {
+    CandidateDomainsRefused { line } => OciInstanceOutcome { line: join(["oci instance ", name, " NOT LAUNCHED: ", line], ""), held: false }
+    CandidateDomains { domains: candidates } =>
+      match candidates.first() {
+        Absent => OciInstanceOutcome { line: join(["oci instance ", name, " NOT LAUNCHED: every availability domain answered, and none lists shape ", shape], ""), held: false }
+        Present { value: domain } =>
+          match oci_newest_image(compartment: compartment, shape: shape) {
+            OciImageRefused { line } => OciInstanceOutcome { line: join(["oci instance ", name, " NOT LAUNCHED: ", line], ""), held: false }
+            OciImageFound { id } =>
+              match oci_now() {
+                Absent => OciInstanceOutcome { line: join(["oci instance ", name, " NOT LAUNCHED: the host clock did not print epoch seconds, so the launch cannot be recorded"], ""), held: false }
+                Present { value: now } => {
+                  let body = oci_launch_body(planned: planned, compartment: compartment, subnet: subnet, domain: domain, image: id)
+                  let recorded = Filesystem.WriteCreateNew(path: oci_launch_attempt_path(planned: planned), content: oci_launch_record_text(sent_at: now, body: body))
+                  if recorded.success {
+                    oci_send_attempt(planned: planned, body: body, first_send: true)
+                  } else if recorded.error_kind == "already_exists" {
+                    OciInstanceOutcome { line: join(["oci instance ", name, " NOT LAUNCHED: another run created the launch record ", oci_launch_attempt_path(planned: planned), " first and owns this launch"], ""), held: false }
+                  } else {
+                    OciInstanceOutcome { line: join(["oci instance ", name, " NOT LAUNCHED: the launch record could not be created, so nothing was sent: ", recorded.error], ""), held: false }
+                  }
+                }
+              }
+          }
+      }
+  }
+}
+
+// The domains that offer the micro shape. Every domain's read must answer, and one refused read refuses
+// the whole selection with its cause, because a domain whose answer was lost may be the one that offers
+// the shape.
+type OciCandidateDomains
+  = CandidateDomains { domains: List<String> }
+  | CandidateDomainsRefused { line: String }
+
+fn oci_micro_domain(compartment: NonEmptyStr, domains: List<String>, shape: String) -> OciCandidateDomains uses net: Network {
+  oci_select_offering(answers: map(domains, d => oci_domain_answer(domain: d, offer: oci_domain_offers(compartment: compartment, domain: d, shape: shape))))
+}
+
+type OciDomainAnswer {
+  domain: String
+  offer: OciDomainOffer
+}
+
+fn oci_domain_answer(domain: String, offer: OciDomainOffer) -> OciDomainAnswer {
+  OciDomainAnswer { domain: domain, offer: offer }
+}
+
+fn oci_domain_refusal(a: OciDomainAnswer) -> String {
+  match a.offer {
+    DomainReadRefused { line } => line
+    DomainOffers => ""
+    DomainLacks => ""
+  }
+}
+
+fn oci_domain_offering(a: OciDomainAnswer) -> Bool {
+  match a.offer {
+    DomainOffers => true
+    DomainLacks => false
+    DomainReadRefused { line } => false
+  }
+}
+
+// PURE: the selection over every domain's answer.
+fn oci_select_offering(answers: List<OciDomainAnswer>) -> OciCandidateDomains {
+  let refusals = filter(map(answers, a => oci_domain_refusal(a: a)), l => l != "")
+  if refusals.length() > 0 {
+    CandidateDomainsRefused { line: join(refusals, "; ") }
+  } else {
+    CandidateDomains { domains: map(filter(answers, a => oci_domain_offering(a: a)), a => a.domain) }
+  }
+}
+
+type OciInstanceOutcome {
+  line: String
+  held: Bool
+}
+
+// A1 LAUNCHES REFUSE UNTIL BILLING ELIGIBILITY IS ADMITTED (side-chat review on gunbc#13351). A1's free
+// credit is a monthly meter (1,500 OCPU-hours and 9,000 GB-hours, extdeps.cloud.oracle_oci), and a
+// current inventory does not say how much of this month's credit is spent. On a Pay As You Go tenancy
+// that used it earlier in the month, launching would consume billed usage, and refusing to quote a
+// price does not remove that consequence. Micros are bounded by a count, not a meter, so they launch.
+data oci_a1_launch_eligibility_obligation: NonEmptyStr = "An A1.Flex launch could consume billed usage: A1's Always Free credit is metered monthly, and the converge observes the current inventory, not this month's consumption. RESOLVED BY an observation of the tenancy's A1 month-to-date OCPU-hours and GB-hours (or a verified constraint that the tenancy cannot be billed), admitted before an A1 launch, and a launch path that checks it."
+
+// A HELD INSTANCE IS ON THE SELECTED SUBNET (side-chat review on gunbc#13351). A namesake attached to
+// another network is not the planned instance. Its VNIC attachments are read, every ATTACHED one must
+// be on the subnet, and there must be at least one.
+fn oci_instance_on_subnet(compartment: NonEmptyStr, instance: String, subnet: NonEmptyStr) -> String uses net: Network {
+  match oci_list(operation: "ListVnicAttachments", host: oci_iaas_host, path_and_query: join(["/20160918/vnicAttachments?compartmentId=", compartment as String, "&instanceId=", instance], "") as NonEmptyStr) {
+    OciListRefused { cause } => concat("its VNIC attachments could not be read: ", cause as String)
+    OciListInaccessible { status, body } => join(["its VNIC attachments were refused by OCI (", to_string(status), "): ", body], "")
+    OciListed { items } => match oci_admit_rows(operation: "ListVnicAttachments", rows: items, keys: ["id", "lifecycleState", "subnetId"]) {
+      OciRowRefused { cause } => cause as String
+      OciRowsAdmitted { rows } => oci_attachments_disagreement(rows: rows, subnet: subnet)
+    }
+  }
+}
+
+// PURE: the subnet agreement over admitted attachment rows.
+fn oci_attachments_disagreement(rows: List<JsonValue>, subnet: NonEmptyStr) -> String {
+  let attached = filter(rows, r => oci_admitted_text(row: r, key: "lifecycleState") == "ATTACHED")
+  let elsewhere = filter(attached, r => oci_admitted_text(row: r, key: "subnetId") != (subnet as String))
+  if attached.length() == 0 {
+    "it has no ATTACHED VNIC"
+  } else if elsewhere.length() > 0 {
+    join(["it has ", to_string(elsewhere.length()), " attached VNIC(s) on a subnet other than ", subnet as String], "")
+  } else {
+    ""
+  }
+}
+
+fn oci_ensure_instance(planned: OciPlannedInstance, compartment: NonEmptyStr, subnet: NonEmptyStr, observed: List<OciObservedInstance>, domains: List<String>) -> OciInstanceOutcome uses net: Network {
+  let name = planned.name as String
+  match oci_instance_decision(planned: planned, observed: observed) {
+    InstanceHeld { line } => {
+      let cleared = oci_clear_attempt(planned: planned)
+      match oci_live_namesake(planned: planned, observed: observed) {
+        Absent => OciInstanceOutcome { line: concat("a held instance had no live namesake", cleared), held: false }
+        Present { value: o } => {
+          let disagreement = oci_instance_on_subnet(compartment: compartment, instance: o.id, subnet: subnet)
+          if disagreement == "" {
+            OciInstanceOutcome { line: concat(line, cleared), held: true }
+          } else {
+            OciInstanceOutcome { line: join(["oci instance ", name, " ", o.id, " is not on the selected subnet (", disagreement, "); this converge does not move an instance", cleared], ""), held: false }
+          }
+        }
+      }
+    }
+    InstanceStop { line } => OciInstanceOutcome { line: concat(line, oci_clear_attempt(planned: planned)), held: false }
+    InstanceLaunch =>
+      match planned.size {
+        A1FlexSize { ocpus, memory } => OciInstanceOutcome { line: join(["oci instance ", name, " NOT LAUNCHED: ", oci_a1_launch_eligibility_obligation as String], ""), held: false }
+        E2MicroSize => {
+          let record = Filesystem.Read(path: oci_launch_attempt_path(planned: planned))
+          match filesystem_exact_read(path: oci_launch_attempt_path(planned: planned), content: record.content, success: record.success, error: record.error, error_kind: record.error_kind) {
+            FilesystemExactPathRead { path, content } => oci_replay_attempt(planned: planned, content: content)
+            FilesystemExactPathAbsent { path } => oci_start_attempt(planned: planned, compartment: compartment, subnet: subnet, domains: domains)
+            FilesystemExactPathUnreadable { path, kind, error } => OciInstanceOutcome { line: join(["oci instance ", name, " NOT LAUNCHED: the launch record ", path, " exists and cannot be read: ", error], ""), held: false }
+            FilesystemExactPathKindUnrecognized { path, observed, error } => OciInstanceOutcome { line: join(["oci instance ", name, " NOT LAUNCHED: the launch record ", path, " read failed with an unrecognized kind ", observed, ": ", error], ""), held: false }
+          }
+        }
+      }
+  }
+}
+
+fn oci_live_namesake(planned: OciPlannedInstance, observed: List<OciObservedInstance>) -> OciObservedInstance? {
+  match filter(observed, o => o.display_name == (planned.name as String) && oci_instance_live(s: o.state)).first() {
+    Present { value } => Present { value: value }
+    Absent => none
+  }
+}
+
+fn oci_breach_text(b: OciAllowanceBreach) -> String {
+  to_string(b)
+}
+
+// THE INSTANCE STEP. The instance list of this compartment is read first, to learn which plan
+// members already exist. Then the whole tenancy's usage is observed (gunbc.oracle_oci.tenancy_usage),
+// and the members still to launch are fitted beside it. That makes the fit a claim about the tenancy,
+// not just the plan (review 76384). A plan that would not fit, or a usage observation that refused,
+// launches nothing. Members that already exist are counted in the observed usage, not twice.
+fn oci_launch_pending(planned: OciPlannedInstance, observed: List<OciObservedInstance>) -> Bool {
+  match oci_instance_decision(planned: planned, observed: observed) {
+    InstanceLaunch => true
+    InstanceHeld { line } => false
+    InstanceStop { line } => false
+  }
+}
+
+fn oci_not_launched(line: String) -> List<OciInstanceOutcome> {
+  [OciInstanceOutcome { line: concat("oci instances NOT LAUNCHED: ", line), held: false }]
+}
+
+// ONE RUN AT A TIME OWNS THE INSTANCE STEP (side-chat review on gunbc#13351). The launch record makes a
+// lost reply recoverable; it does not by itself stop two runs from acting on one attempt. A creator
+// could retire a record another run is re-sending, and a run holding an old observation could delete
+// a newer generation. So the whole step, from the instance observations that decide held-or-launch
+// through record publication, send, re-send and retirement, runs under one lock, taken with
+// WriteCreateNew in the record directory and released at the end. A run that finds the lock held
+// refuses as busy. A lock left by a run that died is not broken automatically: it is reported with its
+// path, and an operator who has checked that no run is active removes it. Reconciling a launch record
+// is likewise done with no run active.
+data oci_instance_lock_path: String = "/etc/gunbc/oracle-oci/instance-converge.lock"
+
+fn oci_free_instances(compartment: NonEmptyStr, subnet: NonEmptyStr) -> List<OciInstanceOutcome> uses net: Network {
+  match oci_now() {
+    Absent => oci_not_launched(line: "the host clock did not print epoch seconds, so the instance lock cannot be taken")
+    Present { value: now } => {
+      let lock = Filesystem.WriteCreateNew(path: oci_instance_lock_path, content: to_string(second_count(s: now)))
+      if !lock.success {
+        if lock.error_kind == "already_exists" {
+          oci_not_launched(line: join(["another run holds the instance lock ", oci_instance_lock_path, ". If no run is active (one that died leaves its lock behind), remove that file and run again"], ""))
+        } else {
+          oci_not_launched(line: join(["the instance lock ", oci_instance_lock_path, " could not be taken: ", lock.error], ""))
+        }
+      } else {
+        let outcomes = oci_free_instances_locked(compartment: compartment, subnet: subnet)
+        let released = Filesystem.Delete(path: oci_instance_lock_path)
+        if released.success {
+          outcomes
+        } else {
+          concat(outcomes, [OciInstanceOutcome { line: join(["the instance lock ", oci_instance_lock_path, " could not be released: ", released.error, "; remove it before the next run"], ""), held: false }])
+        }
+      }
+    }
+  }
+}
+
+fn oci_free_instances_locked(compartment: NonEmptyStr, subnet: NonEmptyStr) -> List<OciInstanceOutcome> uses net: Network {
+  match oci_list(operation: "ListInstances", host: oci_iaas_host, path_and_query: join(["/20160918/instances?compartmentId=", compartment as String], "") as NonEmptyStr) {
+    OciListRefused { cause } => oci_not_launched(line: concat("ListInstances refused: ", cause as String))
+    OciListInaccessible { status, body } => oci_not_launched(line: join(["ListInstances refused by OCI (", to_string(status), "): ", body], ""))
+    OciListed { items } =>
+      match oci_admit_rows(operation: "ListInstances", rows: items, keys: oci_instance_required_fields) {
+        OciRowRefused { cause } => oci_not_launched(line: cause as String)
+        OciRowsAdmitted { rows } => {
+          let observed = map(rows, i => oci_observed_instance_of(v: i))
+          match oci_tenancy_usage() {
+            TenancyUsageRefused { line } => oci_not_launched(line: line)
+            TenancyUsageObserved { usage, compartments } =>
+              match oci_always_free_fit_beside(plan: filter(oci_free_plan, p => oci_launch_pending(planned: p, observed: observed)), other: usage) {
+                ExceedsAlwaysFree { breaches } => oci_not_launched(line: join(["the members still to launch do not fit the Always Free allowance beside what the tenancy already uses (", to_string(compartments), " compartments read): ", join(map(breaches, b => oci_breach_text(b: b)), "; ")], ""))
+                FitsAlwaysFree =>
+                  match oci_availability_domains() {
+                    OciNamesRefused { line } => oci_not_launched(line: line)
+                    OciNamesListed { names: domains } =>
+                      map(oci_free_plan, p => oci_ensure_instance(planned: p, compartment: compartment, subnet: subnet, observed: observed, domains: domains))
+                  }
+              }
+          }
+        }
+      }
+  }
+}
diff --git a/dag/gunbc/oracle_oci/network_ensure.dag b/dag/gunbc/oracle_oci/network_ensure.dag
new file mode 100644
index 00000000000..e9fa7adb092
--- /dev/null
+++ b/dag/gunbc/oracle_oci/network_ensure.dag
@@ -0,0 +1,501 @@
+module gunbc.oracle_oci.network_ensure
+
+import std.types { Bool, Int, List, NonEmptyStr, String }
+import std.resources { Network }
+import v2.std.algebra { any }
+import extdeps.network.ipv4 { Ipv4Prefix, ipv4_prefix, render_ipv4_prefix }
+import extdeps.languages.json.emit { JsonValue, JsonArray, JsonObject, JsonNull, JsonBool, JsonNumber, JsonString, json_object, json_kv, json_string, json_bool, json_array, serialize_json }
+import extdeps.languages.json.parse { json_member_presence, JsonMemberValue, JsonMemberMissing, JsonMemberNull, JsonMemberUnreadable }
+import extdeps.cloud.oracle_oci_request_signing { OciPostJson }
+import gunbc.oracle_oci.tenancy_usage { OciWhole, OciWholeValue, OciWholeRefused, oci_whole_member }
+import gunbc.oracle_oci.api {
+  OciExchange, OciAnswered, OciExchangeRefused,
+  OciListRead, OciListed, OciListInaccessible, OciListRefused,
+  OciRowsAdmitted, OciRowRefused, oci_admit_rows, oci_admitted_text, oci_required_text, oci_field_text, oci_field_cause,
+  oci_list, oci_signed_exchange, oci_iaas_host,
+}
+
+// THE NETWORK AN ALWAYS FREE INSTANCE NEEDS, INSIDE THE gunbc-always-free COMPARTMENT: one VCN, an
+// internet gateway, a route table sending 0.0.0.0/0 to that gateway, and one regional public subnet
+// using that route table. The subnet takes the VCN's default security list, which Oracle creates with
+// the VCN and which admits SSH (TCP 22) and all egress. VCNs, gateways, route tables and subnets are
+// not billed resources.
+//
+// Every resource is found by its display name inside the compartment and created only when none is
+// live. Each Create is followed by a read-back, and a resource that is not yet AVAILABLE ends the run
+// with "run again", rather than the next resource being built on something still provisioning. So a
+// first run from nothing takes a few runs to reach the subnet, and every run after that is all Noop.
+//
+// The route table is CREATED WITH its rule, rather than the VCN's default route table being edited,
+// because editing needs a PUT and the signed transport carries GET and POST only. A route table or a
+// subnet found by name whose wiring differs (a subnet on another route table, a route table not sending
+// 0.0.0.0/0 to this gateway) refuses as a conflict, because this converge does not edit what it finds.
+
+// The lifecycle states Oracle's SDK models declare for these four resources. UPDATING occurs on a VCN
+// and a subnet only, and is harmless to admit for the other two.
+type OciNetworkState
+  = NetworkProvisioning
+  | NetworkAvailable
+  | NetworkUpdating
+  | NetworkTerminating
+  | NetworkTerminated
+  | NetworkStateUnknown { raw: String }
+
+fn oci_network_state(raw: String) -> OciNetworkState {
+  if raw == "PROVISIONING" { NetworkProvisioning }
+  else if raw == "AVAILABLE" { NetworkAvailable }
+  else if raw == "UPDATING" { NetworkUpdating }
+  else if raw == "TERMINATING" { NetworkTerminating }
+  else if raw == "TERMINATED" { NetworkTerminated }
+  else { NetworkStateUnknown { raw: raw } }
+}
+
+fn oci_network_state_live(s: OciNetworkState) -> Bool {
+  match s {
+    NetworkTerminated => false
+    NetworkProvisioning => true
+    NetworkAvailable => true
+    NetworkUpdating => true
+    NetworkTerminating => true
+    NetworkStateUnknown { raw } => true
+  }
+}
+
+type OciNamedResource {
+  id: String
+  display_name: String
+  state: OciNetworkState
+  raw: JsonValue
+}
+
+data oci_named_resource_required_fields: List<String> = ["id", "displayName", "lifecycleState"]
+
+// Only for a row ADMITTED on oci_named_resource_required_fields.
+fn oci_named_resource_of(v: JsonValue) -> OciNamedResource {
+  OciNamedResource {
+    id: oci_admitted_text(row: v, key: "id"),
+    display_name: oci_admitted_text(row: v, key: "displayName"),
+    state: oci_network_state(raw: oci_admitted_text(row: v, key: "lifecycleState")),
+    raw: v,
+  }
+}
+
+// One step of the chain: a resource ready to be referenced by the next, or a stop that ends the run.
+// held says whether the stop is the expected "run again" of a converge in progress (false either way,
+// because the run did not reach the goal) and line is what the receipt prints.
+type OciStep
+  = OciStepReady { id: NonEmptyStr, line: String, raw: JsonValue }
+  | OciStepStopped { line: String }
+
+// PURE: what one list read decides for one named resource. Absent asks for a create.
+type OciNamedDecision
+  = NamedReady { resource: OciNamedResource }
+  | NamedCreate
+  | NamedStop { line: String }
+
+fn oci_named_decision(kind: String, display_name: String, read: OciListRead) -> OciNamedDecision {
+  match read {
+    OciListRefused { cause } => NamedStop { line: join(["oci ", kind, " ", display_name, " read refused, NOTHING CREATED: ", cause as String], "") }
+    OciListInaccessible { status, body } => NamedStop { line: join(["oci ", kind, " ", display_name, " read refused by OCI (", to_string(status), "), NOTHING CREATED: ", body], "") }
+    OciListed { items } => match oci_admit_rows(operation: join(["List ", kind], ""), rows: items, keys: oci_named_resource_required_fields) {
+      OciRowRefused { cause } => NamedStop { line: join(["oci ", kind, " ", display_name, " read refused, NOTHING CREATED: ", cause as String], "") }
+      OciRowsAdmitted { rows } => oci_named_decision_over(kind: kind, display_name: display_name, resources: map(rows, r => oci_named_resource_of(v: r)))
+    }
+  }
+}
+
+fn oci_named_decision_over(kind: String, display_name: String, resources: List<OciNamedResource>) -> OciNamedDecision {
+  let live = filter(resources, r => r.display_name == display_name && oci_network_state_live(s: r.state))
+  if live.length() == 0 {
+    NamedCreate
+  } else if live.length() > 1 {
+    NamedStop { line: join(["oci ", kind, " ", display_name, ": more than one live resource has this name; this converge does not choose between them"], "") }
+  } else {
+    match live.first() {
+      Absent => NamedStop { line: join(["oci ", kind, " ", display_name, ": a nonempty list had no first element"], "") }
+      Present { value: r } => match r.state {
+        NetworkAvailable => NamedReady { resource: r }
+        NetworkProvisioning => NamedStop { line: join(["oci ", kind, " ", display_name, " ", r.id, " is PROVISIONING; run again"], "") }
+        NetworkUpdating => NamedStop { line: join(["oci ", kind, " ", display_name, " ", r.id, " is UPDATING; run again"], "") }
+        NetworkTerminating => NamedStop { line: join(["oci ", kind, " ", display_name, " ", r.id, " is TERMINATING; wait, then run again"], "") }
+        NetworkTerminated => NamedStop { line: join(["oci ", kind, " ", display_name, ": a terminated resource passed the live filter"], "") }
+        NetworkStateUnknown { raw } => NamedStop { line: join(["oci ", kind, " ", display_name, " ", r.id, " reports lifecycle state ", raw, ", which is not in Oracle's published set"], "") }
+      }
+    }
+  }
+}
+
+// A resource is admitted only if its wiring is what this converge would have created, whether it was
+// found or read back after a create: a create answered 200 is not evidence of the wiring it was asked
+// for (side-chat review on gunbc#13351). wired
+// returns the empty string when it agrees, and the disagreement otherwise.
+// PURE: the one admission both paths take, a found resource and one read back after a create. A
+// disagreement stops the chain at this resource, and nothing is edited.
+fn oci_admit_wired(kind: String, display_name: String, resource: OciNamedResource, disagreement: String, how: String) -> OciStep {
+  if disagreement == "" {
+    OciStepReady { id: resource.id as NonEmptyStr, line: join(["oci ", kind, " ", display_name, " ", resource.id, " ", how], ""), raw: resource.raw }
+  } else {
+    OciStepStopped { line: join(["oci ", kind, " ", display_name, " ", resource.id, " is wired differently, which this converge does not edit or admit: ", disagreement], "") }
+  }
+}
+
+fn oci_ensure_named(
+  kind: String,
+  display_name: String,
+  list_path: String,
+  create_path: NonEmptyStr,
+  create_body: String,
+  wired: fn(OciNamedResource) -> String,
+) -> OciStep uses net: Network {
+  match oci_named_decision(kind: kind, display_name: display_name, read: oci_list(operation: join(["List ", kind], ""), host: oci_iaas_host, path_and_query: list_path as NonEmptyStr)) {
+    NamedStop { line } => OciStepStopped { line: line }
+    NamedReady { resource } => oci_admit_wired(kind: kind, display_name: display_name, resource: resource, disagreement: wired(resource), how: "converged")
+    NamedCreate =>
+      match oci_signed_exchange(shape: OciPostJson { text: create_body }, host: oci_iaas_host, path_and_query: create_path) {
+        OciExchangeRefused { cause } => OciStepStopped { line: join(["oci ", kind, " ", display_name, " create refused before an answer: ", cause as String], "") }
+        OciAnswered { status, body, next_page } =>
+          if status != 200 {
+            OciStepStopped { line: join(["oci ", kind, " ", display_name, " create answered ", to_string(status), ": ", body], "") }
+          } else {
+            match oci_named_decision(kind: kind, display_name: display_name, read: oci_list(operation: join(["List ", kind], ""), host: oci_iaas_host, path_and_query: list_path as NonEmptyStr)) {
+              NamedReady { resource } => oci_admit_wired(kind: kind, display_name: display_name, resource: resource, disagreement: wired(resource), how: "created and AVAILABLE on read-back")
+              NamedCreate => OciStepStopped { line: join(["oci ", kind, " ", display_name, " create answered 200 and the read-back does not list it yet; run again"], "") }
+              NamedStop { line } => OciStepStopped { line: concat("(read-back after create) ", line) }
+            }
+          }
+      }
+  }
+}
+
+// A REQUIRED BOOLEAN FIELD, read as Oracle answers it. Missing, null or another type is a
+// disagreement, never a default.
+type OciFlag
+  = OciFlagValue { value: Bool }
+  | OciFlagRefused { cause: String }
+
+fn oci_required_flag(row: JsonValue, key: String) -> OciFlag {
+  match json_member_presence(obj: row, key: key) {
+    JsonMemberValue { value } => match value {
+      JsonBool { value: b } => OciFlagValue { value: b }
+      JsonNull => OciFlagRefused { cause: concat(key, " is null") }
+      JsonNumber { lexeme } => OciFlagRefused { cause: concat(key, " is a number, not a boolean") }
+      JsonString { value: t } => OciFlagRefused { cause: concat(key, " is a string, not a boolean") }
+      JsonArray { elements } => OciFlagRefused { cause: concat(key, " is an array, not a boolean") }
+      JsonObject { members } => OciFlagRefused { cause: concat(key, " is an object, not a boolean") }
+    }
+    JsonMemberMissing => OciFlagRefused { cause: concat(key, " is missing") }
+    JsonMemberNull => OciFlagRefused { cause: concat(key, " is null") }
+    JsonMemberUnreadable { cause } => OciFlagRefused { cause: join([key, " is unreadable: ", cause], "") }
+  }
+}
+
+fn oci_flag_must_be(row: JsonValue, key: String, wanted: Bool) -> String {
+  match oci_required_flag(row: row, key: key) {
+    OciFlagRefused { cause } => cause
+    OciFlagValue { value } => if value == wanted { "" } else { join([key, " is ", to_string(value), ", not ", to_string(wanted)], "") }
+  }
+}
+
+fn oci_text_must_be(row: JsonValue, key: String, wanted: String) -> String {
+  let field = oci_required_text(row: row, key: key)
+  let defect = oci_field_cause(f: field)
+  if defect != "" { defect } else if oci_field_text(f: field) == wanted { "" } else { join([key, " is ", oci_field_text(f: field), ", not ", wanted], "") }
+}
+
+fn oci_first_disagreement(defects: List<String>) -> String {
+  fold(defects, init: "", f: (acc, d) => if acc != "" { acc } else { d })
+}
+
+// THE NETWORK IS ADMITTED ON WHAT IT CLAIMS TO PROVIDE (side-chat review on gunbc#13351), on the
+// first read and on the read-back after a create alike: the VCN carries the planned address range, the
+// gateway is enabled, the route table sends 0.0.0.0/0 to that gateway, and the subnet is this VCN's,
+// on that route table, with the planned range, and allows public IPs, which the launch asks for.
+//
+// The access rules are admitted too, after the subnet: the security lists the subnet names must
+// together carry SSH (TCP 22) ingress from 0.0.0.0/0 and all egress to 0.0.0.0/0. Oracle creates the
+// VCN's default list with those rules, but an adopted network's list may have been edited since, so
+// they are read rather than assumed from creation defaults (oci_subnet_access).
+fn oci_vcn_wiring(r: OciNamedResource) -> String {
+  match json_member_presence(obj: r.raw, key: "cidrBlocks") {
+    JsonMemberValue { value } => match value {
+      JsonArray { elements } => if any(elements, e => match e { JsonString { value: c } => c == (render_ipv4_prefix(p: oci_free_vcn_cidr) as String)  JsonNull => false  JsonBool { value: b } => false  JsonNumber { lexeme } => false  JsonArray { elements: x } => false  JsonObject { members } => false }) { "" } else { concat("cidrBlocks does not include ", render_ipv4_prefix(p: oci_free_vcn_cidr) as String) }
+      JsonNull => "cidrBlocks is null"
+      JsonBool { value: b } => "cidrBlocks is not an array"
+      JsonNumber { lexeme } => "cidrBlocks is not an array"
+      JsonString { value: t } => "cidrBlocks is not an array"
+      JsonObject { members } => "cidrBlocks is not an array"
+    }
+    JsonMemberMissing => "cidrBlocks is missing"
+    JsonMemberNull => "cidrBlocks is null"
+    JsonMemberUnreadable { cause } => concat("cidrBlocks is unreadable: ", cause)
+  }
+}
+
+fn oci_igw_wiring(r: OciNamedResource, vcn: NonEmptyStr) -> String {
+  oci_first_disagreement(defects: [
+    oci_text_must_be(row: r.raw, key: "vcnId", wanted: vcn as String),
+    oci_flag_must_be(row: r.raw, key: "isEnabled", wanted: true),
+  ])
+}
+
+// ── THE FOUR RESOURCES ────────────────────────────────────────────────────────────────────────
+
+data oci_free_vcn_name: String = "gunbc-always-free"
+// The address plan, as extdeps.network.ipv4 prefixes rather than CIDR strings, so a malformed octet or
+// prefix length is unwritable and the subnet's containment in the VCN is checkable (review 76379). The
+// CIDR text is rendered at the JSON boundary.
+data oci_free_vcn_cidr: Ipv4Prefix = ipv4_prefix(o1: 10, o2: 0, o3: 0, o4: 0, length: 16)
+data oci_free_igw_name: String = "gunbc-always-free-igw"
+data oci_free_route_table_name: String = "gunbc-always-free-public"
+data oci_free_subnet_name: String = "gunbc-always-free-public"
+data oci_free_subnet_cidr: Ipv4Prefix = ipv4_prefix(o1: 10, o2: 0, o3: 0, o4: 0, length: 24)
+
+fn oci_scoped_list_path(collection: String, compartment: NonEmptyStr, vcn: String) -> String {
+  if vcn == "" {
+    join(["/20160918/", collection, "?compartmentId=", compartment as String], "")
+  } else {
+    join(["/20160918/", collection, "?compartmentId=", compartment as String, "&vcnId=", vcn], "")
+  }
+}
+
+fn oci_vcn_create_body(compartment: NonEmptyStr) -> String {
+  serialize_json(v: json_object(members: [
+    json_kv(key: "compartmentId", value: json_string(s: compartment as String)),
+    json_kv(key: "cidrBlocks", value: json_array(elements: [json_string(s: render_ipv4_prefix(p: oci_free_vcn_cidr) as String)])),
+    json_kv(key: "displayName", value: json_string(s: oci_free_vcn_name)),
+    json_kv(key: "dnsLabel", value: json_string(s: "gunbcfree")),
+  ]))
+}
+
+fn oci_igw_create_body(compartment: NonEmptyStr, vcn: NonEmptyStr) -> String {
+  serialize_json(v: json_object(members: [
+    json_kv(key: "compartmentId", value: json_string(s: compartment as String)),
+    json_kv(key: "vcnId", value: json_string(s: vcn as String)),
+    json_kv(key: "isEnabled", value: json_bool(b: true)),
+    json_kv(key: "displayName", value: json_string(s: oci_free_igw_name)),
+  ]))
+}
+
+fn oci_route_table_create_body(compartment: NonEmptyStr, vcn: NonEmptyStr, igw: NonEmptyStr) -> String {
+  serialize_json(v: json_object(members: [
+    json_kv(key: "compartmentId", value: json_string(s: compartment as String)),
+    json_kv(key: "vcnId", value: json_string(s: vcn as String)),
+    json_kv(key: "displayName", value: json_string(s: oci_free_route_table_name)),
+    json_kv(key: "routeRules", value: json_array(elements: [json_object(members: [
+      json_kv(key: "destination", value: json_string(s: "0.0.0.0/0")),
+      json_kv(key: "destinationType", value: json_string(s: "CIDR_BLOCK")),
+      json_kv(key: "networkEntityId", value: json_string(s: igw as String)),
+    ])])),
+  ]))
+}
+
+fn oci_subnet_create_body(compartment: NonEmptyStr, vcn: NonEmptyStr, route_table: NonEmptyStr) -> String {
+  serialize_json(v: json_object(members: [
+    json_kv(key: "compartmentId", value: json_string(s: compartment as String)),
+    json_kv(key: "vcnId", value: json_string(s: vcn as String)),
+    json_kv(key: "cidrBlock", value: json_string(s: render_ipv4_prefix(p: oci_free_subnet_cidr) as String)),
+    json_kv(key: "displayName", value: json_string(s: oci_free_subnet_name)),
+    json_kv(key: "dnsLabel", value: json_string(s: "public")),
+    json_kv(key: "routeTableId", value: json_string(s: route_table as String)),
+  ]))
+}
+
+// PURE: does a found route table send 0.0.0.0/0 to this gateway? Its routeRules are read from the
+// list answer as returned.
+fn oci_route_table_wiring(r: OciNamedResource, igw: NonEmptyStr) -> String {
+  match json_member_presence(obj: r.raw, key: "routeRules") {
+    JsonMemberValue { value } =>
+      if oci_route_rules_reach(rules: value, igw: igw) { "" } else { join(["route table has no rule sending 0.0.0.0/0 to ", igw as String], "") }
+    JsonMemberMissing => "route table answer carries no routeRules"
+    JsonMemberNull => "route table answer carries null routeRules"
+    JsonMemberUnreadable { cause } => concat("route table routeRules unreadable: ", cause)
+  }
+}
+
+fn oci_route_rules_reach(rules: JsonValue, igw: NonEmptyStr) -> Bool {
+  match rules {
+    JsonArray { elements } => any(elements, e => oci_field_text(f: oci_required_text(row: e, key: "destination")) == "0.0.0.0/0" && oci_field_text(f: oci_required_text(row: e, key: "networkEntityId")) == (igw as String))
+    JsonObject { members } => false
+    JsonNull => false
+    JsonBool { value: b } => false
+    JsonNumber { lexeme } => false
+    JsonString { value: t } => false
+  }
+}
+
+fn oci_subnet_wiring(r: OciNamedResource, vcn: NonEmptyStr, route_table: NonEmptyStr) -> String {
+  oci_first_disagreement(defects: [
+    oci_text_must_be(row: r.raw, key: "vcnId", wanted: vcn as String),
+    oci_subnet_route_wiring(r: r, route_table: route_table),
+    oci_text_must_be(row: r.raw, key: "cidrBlock", wanted: render_ipv4_prefix(p: oci_free_subnet_cidr) as String),
+    oci_flag_must_be(row: r.raw, key: "prohibitPublicIpOnVnic", wanted: false),
+  ])
+}
+
+fn oci_subnet_route_wiring(r: OciNamedResource, route_table: NonEmptyStr) -> String {
+  let field = oci_required_text(row: r.raw, key: "routeTableId")
+  let defect = oci_field_cause(f: field)
+  if defect != "" {
+    concat("subnet answer's ", defect)
+  } else if oci_field_text(f: field) == (route_table as String) {
+    ""
+  } else {
+    join(["subnet uses route table ", oci_field_text(f: field), ", not ", route_table as String], "")
+  }
+}
+
+// THE NETWORK CHAIN. Each resource needs the one before it, so a stop at any layer ends the run there
+// and names the layer.
+type OciNetworkStanding
+  = NetworkReady { subnet: NonEmptyStr, lines: List<String> }
+  | NetworkNotReady { lines: List<String> }
+
+fn oci_free_network(compartment: NonEmptyStr) -> OciNetworkStanding uses net: Network {
+  match oci_ensure_named(kind: "vcn", display_name: oci_free_vcn_name, list_path: oci_scoped_list_path(collection: "vcns", compartment: compartment, vcn: ""), create_path: "/20160918/vcns", create_body: oci_vcn_create_body(compartment: compartment), wired: r => oci_vcn_wiring(r: r)) {
+    OciStepStopped { line } => NetworkNotReady { lines: [line] }
+    OciStepReady { id: vcn, line: vcn_line, raw: vcn_row } =>
+      match oci_ensure_named(kind: "internet gateway", display_name: oci_free_igw_name, list_path: oci_scoped_list_path(collection: "internetGateways", compartment: compartment, vcn: vcn as String), create_path: "/20160918/internetGateways", create_body: oci_igw_create_body(compartment: compartment, vcn: vcn), wired: r => oci_igw_wiring(r: r, vcn: vcn)) {
+        OciStepStopped { line } => NetworkNotReady { lines: [vcn_line, line] }
+        OciStepReady { id: igw, line: igw_line, raw: igw_row } =>
+          match oci_ensure_named(kind: "route table", display_name: oci_free_route_table_name, list_path: oci_scoped_list_path(collection: "routeTables", compartment: compartment, vcn: vcn as String), create_path: "/20160918/routeTables", create_body: oci_route_table_create_body(compartment: compartment, vcn: vcn, igw: igw), wired: r => oci_route_table_wiring(r: r, igw: igw)) {
+            OciStepStopped { line } => NetworkNotReady { lines: [vcn_line, igw_line, line] }
+            OciStepReady { id: rt, line: rt_line, raw: rt_row } =>
+              match oci_ensure_named(kind: "subnet", display_name: oci_free_subnet_name, list_path: oci_scoped_list_path(collection: "subnets", compartment: compartment, vcn: vcn as String), create_path: "/20160918/subnets", create_body: oci_subnet_create_body(compartment: compartment, vcn: vcn, route_table: rt), wired: r => oci_subnet_wiring(r: r, vcn: vcn, route_table: rt)) {
+                OciStepStopped { line } => NetworkNotReady { lines: [vcn_line, igw_line, rt_line, line] }
+                OciStepReady { id: subnet, line: subnet_line, raw: subnet_row } => {
+                  let access = oci_subnet_access(compartment: compartment, vcn: vcn, subnet_row: subnet_row)
+                  if access == "" {
+                    NetworkReady { subnet: subnet, lines: [vcn_line, igw_line, rt_line, subnet_line, "oci subnet security lists admit SSH (TCP 22) ingress from 0.0.0.0/0 and all egress"] }
+                  } else {
+                    NetworkNotReady { lines: [vcn_line, igw_line, rt_line, subnet_line, join(["oci subnet ", subnet as String, " access rules are not admitted, and this converge does not edit them: ", access], "")] }
+                  }
+                }
+              }
+          }
+      }
+  }
+}
+
+// ── ACCESS RULES ──────────────────────────────────────────────────────────────────────────────
+
+fn oci_rule_text(rule: JsonValue, key: String) -> String {
+  oci_field_text(f: oci_required_text(row: rule, key: key))
+}
+
+// A TCP rule with no tcpOptions admits every port. Otherwise both ranges matter, because Oracle models
+// source and destination ports separately and an SSH client connects FROM an ephemeral port: the
+// destination range must cover 22, and a source range, if present, must cover every port 1..65535.
+// A source-restricted rule is refused rather than evaluated further (side-chat review on gunbc#13351).
+// An omitted range is unrestricted; an unreadable one is a refusal.
+fn oci_tcp_rule_admits_ssh(rule: JsonValue) -> Bool {
+  match json_member_presence(obj: rule, key: "tcpOptions") {
+    JsonMemberMissing => true
+    JsonMemberNull => true
+    JsonMemberUnreadable { cause } => false
+    JsonMemberValue { value: options } =>
+      oci_source_ports_unrestricted(options: options) && oci_destination_admits_ssh(options: options)
+  }
+}
+
+fn oci_source_ports_unrestricted(options: JsonValue) -> Bool {
+  match json_member_presence(obj: options, key: "sourcePortRange") {
+    JsonMemberMissing => true
+    JsonMemberNull => true
+    JsonMemberUnreadable { cause } => false
+    JsonMemberValue { value: range } =>
+      match oci_whole_member(obj: range, key: "min") {
+        OciWholeRefused { cause } => false
+        OciWholeValue { value: low } => match oci_whole_member(obj: range, key: "max") {
+          OciWholeRefused { cause } => false
+          OciWholeValue { value: high } => low <= 1 && high >= 65535
+        }
+      }
+  }
+}
+
+fn oci_destination_admits_ssh(options: JsonValue) -> Bool {
+  match json_member_presence(obj: options, key: "destinationPortRange") {
+    JsonMemberMissing => true
+    JsonMemberNull => true
+    JsonMemberUnreadable { cause } => false
+    JsonMemberValue { value: range } =>
+      match oci_whole_member(obj: range, key: "min") {
+        OciWholeRefused { cause } => false
+        OciWholeValue { value: low } => match oci_whole_member(obj: range, key: "max") {
+          OciWholeRefused { cause } => false
+          OciWholeValue { value: high } => low <= 22 && 22 <= high
+        }
+      }
+  }
+}
+
+fn oci_rules_of(list: JsonValue, key: String) -> List<JsonValue> {
+  match json_member_presence(obj: list, key: key) {
+    JsonMemberValue { value } => match value {
+      JsonArray { elements } => elements
+      JsonObject { members } => []
+      JsonNull => []
+      JsonBool { value: b } => []
+      JsonNumber { lexeme } => []
+      JsonString { value: t } => []
+    }
+    JsonMemberMissing => []
+    JsonMemberNull => []
+    JsonMemberUnreadable { cause } => []
+  }
+}
+
+fn oci_admits_ssh_ingress(list: JsonValue) -> Bool {
+  any(oci_rules_of(list: list, key: "ingressSecurityRules"), r => oci_rule_text(rule: r, key: "protocol") == "6" && oci_rule_text(rule: r, key: "source") == "0.0.0.0/0" && oci_tcp_rule_admits_ssh(rule: r))
+}
+
+fn oci_admits_all_egress(list: JsonValue) -> Bool {
+  any(oci_rules_of(list: list, key: "egressSecurityRules"), r => oci_rule_text(rule: r, key: "protocol") == "all" && oci_rule_text(rule: r, key: "destination") == "0.0.0.0/0")
+}
+
+fn oci_string_elements(v: JsonValue) -> List<String> {
+  match v {
+    JsonArray { elements } => map(elements, e => match e { JsonString { value: t } => t  JsonNull => ""  JsonBool { value: b } => ""  JsonNumber { lexeme } => ""  JsonArray { elements: x } => ""  JsonObject { members } => "" })
+    JsonObject { members } => []
+    JsonNull => []
+    JsonBool { value: b } => []
+    JsonNumber { lexeme } => []
+    JsonString { value: t } => []
+  }
+}
+
+// PURE: whether the subnet's named security lists, read from the VCN's lists, admit the access the
+// launched instances rely on. Every named list must be found, so an unread list is never assumed.
+fn oci_access_disagreement(subnet_row: JsonValue, lists: List<JsonValue>) -> String {
+  match json_member_presence(obj: subnet_row, key: "securityListIds") {
+    JsonMemberValue { value } => {
+      let ids = oci_string_elements(v: value)
+      let named = filter(lists, l => any(ids, i => i != "" && oci_rule_text(rule: l, key: "id") == i))
+      if ids.length() == 0 || any(ids, i => i == "") {
+        "securityListIds is empty or carries a non-string"
+      } else if named.length() != ids.length() {
+        "a security list the subnet names is not among the VCN's listed security lists"
+      } else if !any(named, l => oci_admits_ssh_ingress(list: l)) {
+        "no named security list admits TCP 22 ingress from 0.0.0.0/0"
+      } else if !any(named, l => oci_admits_all_egress(list: l)) {
+        "no named security list admits all egress to 0.0.0.0/0"
+      } else {
+        ""
+      }
+    }
+    JsonMemberMissing => "securityListIds is missing"
+    JsonMemberNull => "securityListIds is null"
+    JsonMemberUnreadable { cause } => concat("securityListIds is unreadable: ", cause)
+  }
+}
+
+fn oci_subnet_access(compartment: NonEmptyStr, vcn: NonEmptyStr, subnet_row: JsonValue) -> String uses net: Network {
+  match oci_list(operation: "List security lists", host: oci_iaas_host, path_and_query: oci_scoped_list_path(collection: "securityLists", compartment: compartment, vcn: vcn as String) as NonEmptyStr) {
+    OciListRefused { cause } => concat("security lists could not be read: ", cause as String)
+    OciListInaccessible { status, body } => join(["security lists were refused by OCI (", to_string(status), "): ", body], "")
+    OciListed { items } => match oci_admit_rows(operation: "List security lists", rows: items, keys: ["id"]) {
+      OciRowRefused { cause } => cause as String
+      OciRowsAdmitted { rows } => oci_access_disagreement(subnet_row: subnet_row, lists: rows)
+    }
+  }
+}
diff --git a/dag/gunbc/oracle_oci/tenancy_usage.dag b/dag/gunbc/oracle_oci/tenancy_usage.dag
new file mode 100644
index 00000000000..3d2f17f8b96
--- /dev/null
+++ b/dag/gunbc/oracle_oci/tenancy_usage.dag
@@ -0,0 +1,242 @@
+module gunbc.oracle_oci.tenancy_usage
+
+import std.types { Bool, Int, List, NonEmptyStr, String }
+import std.nat { Nat }
+import std.resources { Network }
+import std.measure { Gigabyte, gigabyte, measure_add }
+import std.decimal { ExactDecimal, decimal_pow10 }
+import std.optional { Absent, Present }
+import extdeps.languages.json.emit { JsonValue }
+import extdeps.languages.json.parse { json_member_presence, JsonMemberValue, JsonMemberMissing, JsonMemberNull, JsonMemberUnreadable }
+import extdeps.languages.json.number {
+  read_json_number_value, JsonNumberValueRead, JsonValueIsNotANumber,
+  JsonNumberExact, JsonNumberOutsideExactFragment, json_number_fragment_refusal_text,
+}
+import extdeps.cloud.oracle_oci { VmStandardA1Flex, VmStandardE21Micro, oci_shape_wire_name }
+import product.supplier.oracle_oci { OciOtherUsage }
+import extdeps.uri { uri_percent_encode_component, UriPercentComponentEncoded, UriPercentComponentRefused }
+import gunbc.oracle_oci.api {
+  OciListRead, OciListed, OciListInaccessible, OciListRefused,
+  OciRowsAdmitted, OciRowRefused, oci_admit_rows, oci_admitted_text,
+  oci_list, oci_iaas_host, oci_identity_host, oci_tenancy_ocid,
+}
+
+// WHAT THE WHOLE TENANCY ALREADY USES OF THE ALWAYS FREE ALLOWANCE (review 76384 on gunbc#13351).
+//
+// The allowance is tenancy-wide: the A1 OCPU and memory pool, the micro count, and the 200 GB of boot
+// and block volumes combined are shared by everything in every compartment. So before the instance
+// converge launches anything, it reads what is already there, in the root compartment and in every
+// active compartment beneath it:
+//   - live instances: each E2.1.Micro counts one micro, each A1.Flex adds its shapeConfig OCPUs and memory;
+//   - boot volumes that are not terminated, including those left behind by terminated instances, read
+//     per availability domain;
+//   - block volumes that are not terminated.
+// The plan's not-yet-launched members are then fitted beside that total. An instance that is stopped
+// is counted, because it still holds its allocation and its boot volume.
+//
+// Every list is a complete, admitted read (gunbc.oracle_oci.api), and one refusal anywhere refuses the
+// whole observation, because a usage total missing a compartment is an undercount, and an undercount
+// is exactly the error this exists to prevent.
+//
+// NOT CARRIED: A1 consumption is metered monthly (1,500 OCPU-hours and 9,000 GB-hours, extdeps.cloud.
+// oracle_oci). This observation is the steady-state allocation, which bounds that meter only when
+// the allocation has been held all month. A tenancy that ran more earlier in the month is not seen
+// here. That is the remaining gap product.supplier.oracle_oci oci_tenancy_allocation_unread_obligation
+// names.
+
+type OciTenancyUsageRead
+  = TenancyUsageObserved { usage: OciOtherUsage, compartments: Int }
+  | TenancyUsageRefused { line: String }
+
+// A WHOLE NUMBER FROM A JSON NUMERAL, read exactly through extdeps.languages.json.number. Oracle
+// writes ocpus and memoryInGBs as floats ("2.0"). A fractional value refuses rather than being
+// rounded, because a rounded allocation is a wrong allocation.
+type OciWhole
+  = OciWholeValue { value: Int }
+  | OciWholeRefused { cause: String }
+
+fn oci_whole_of(d: ExactDecimal) -> OciWhole {
+  let scale = decimal_pow10(exponent: d.fraction_digits)
+  if d.units % scale == 0 { OciWholeValue { value: d.units / scale } } else { OciWholeRefused { cause: "is not a whole number" } }
+}
+
+fn oci_whole_member(obj: JsonValue, key: String) -> OciWhole {
+  match json_member_presence(obj: obj, key: key) {
+    JsonMemberValue { value } => match read_json_number_value(v: value) {
+      JsonValueIsNotANumber => OciWholeRefused { cause: concat(key, " is not a number") }
+      JsonNumberValueRead { reading } => match reading {
+        JsonNumberOutsideExactFragment { lexeme, refusal } => OciWholeRefused { cause: join([key, " ", lexeme, ": ", json_number_fragment_refusal_text(r: refusal) as String], "") }
+        JsonNumberExact { value: d } => match oci_whole_of(d: d) {
+          OciWholeValue { value: n } => OciWholeValue { value: n }
+          OciWholeRefused { cause } => OciWholeRefused { cause: join([key, " ", cause], "") }
+        }
+      }
+    }
+    JsonMemberMissing => OciWholeRefused { cause: concat(key, " is missing") }
+    JsonMemberNull => OciWholeRefused { cause: concat(key, " is null") }
+    JsonMemberUnreadable { cause } => OciWholeRefused { cause: join([key, " is unreadable: ", cause], "") }
+  }
+}
+
+fn oci_shape_config_whole(row: JsonValue, key: String) -> OciWhole {
+  match json_member_presence(obj: row, key: "shapeConfig") {
+    JsonMemberValue { value } => oci_whole_member(obj: value, key: key)
+    JsonMemberMissing => OciWholeRefused { cause: "shapeConfig is missing" }
+    JsonMemberNull => OciWholeRefused { cause: "shapeConfig is null" }
+    JsonMemberUnreadable { cause } => OciWholeRefused { cause: concat("shapeConfig is unreadable: ", cause) }
+  }
+}
+
+// ── ONE COMPARTMENT'S CONTRIBUTION (PURE OVER ADMITTED ROWS) ──────────────────────────────────
+
+type OciUsagePart
+  = UsagePart { a1_ocpus: Int, a1_memory: Gigabyte, micros: Int, block: Gigabyte }
+  | UsagePartRefused { line: String }
+
+fn oci_usage_part_add(a: OciUsagePart, b: OciUsagePart) -> OciUsagePart {
+  match a {
+    UsagePartRefused { line } => a
+    UsagePart { a1_ocpus: o1, a1_memory: m1, micros: c1, block: g1 } => match b {
+      UsagePartRefused { line } => b
+      UsagePart { a1_ocpus: o2, a1_memory: m2, micros: c2, block: g2 } =>
+        UsagePart { a1_ocpus: o1 + o2, a1_memory: measure_add(a: m1, b: m2), micros: c1 + c2, block: measure_add(a: g1, b: g2) }
+    }
+  }
+}
+
+data oci_usage_zero: OciUsagePart = UsagePart { a1_ocpus: 0, a1_memory: gigabyte(count: 0), micros: 0, block: gigabyte(count: 0) }
+
+// One instance row, admitted on id, lifecycleState and shape. A terminated instance holds nothing. A
+// live A1 must carry whole shapeConfig numbers; any other shape counts nothing toward these pools.
+fn oci_instance_usage(row: JsonValue) -> OciUsagePart {
+  let state = oci_admitted_text(row: row, key: "lifecycleState")
+  let shape = oci_admitted_text(row: row, key: "shape")
+  let id = oci_admitted_text(row: row, key: "id")
+  if state == "TERMINATED" {
+    oci_usage_zero
+  } else if shape == (oci_shape_wire_name(shape: VmStandardE21Micro) as String) {
+    UsagePart { a1_ocpus: 0, a1_memory: gigabyte(count: 0), micros: 1, block: gigabyte(count: 0) }
+  } else if shape == (oci_shape_wire_name(shape: VmStandardA1Flex) as String) {
+    match oci_shape_config_whole(row: row, key: "ocpus") {
+      OciWholeRefused { cause } => UsagePartRefused { line: join(["instance ", id, " ", cause], "") }
+      OciWholeValue { value: ocpus } => match oci_shape_config_whole(row: row, key: "memoryInGBs") {
+        OciWholeRefused { cause } => UsagePartRefused { line: join(["instance ", id, " ", cause], "") }
+        OciWholeValue { value: memory } => UsagePart { a1_ocpus: ocpus, a1_memory: gigabyte(count: memory), micros: 0, block: gigabyte(count: 0) }
+      }
+    }
+  } else {
+    oci_usage_zero
+  }
+}
+
+// One boot or block volume row, admitted on id and lifecycleState. Every state but TERMINATED holds
+// storage.
+fn oci_volume_usage(row: JsonValue) -> OciUsagePart {
+  if oci_admitted_text(row: row, key: "lifecycleState") == "TERMINATED" {
+    oci_usage_zero
+  } else {
+    match oci_whole_member(obj: row, key: "sizeInGBs") {
+      OciWholeRefused { cause } => UsagePartRefused { line: join(["volume ", oci_admitted_text(row: row, key: "id"), " ", cause], "") }
+      OciWholeValue { value: gb } => UsagePart { a1_ocpus: 0, a1_memory: gigabyte(count: 0), micros: 0, block: gigabyte(count: gb) }
+    }
+  }
+}
+
+fn oci_rows_usage(operation: String, read: OciListRead, keys: List<String>, each: fn(JsonValue) -> OciUsagePart) -> OciUsagePart {
+  match read {
+    OciListRefused { cause } => UsagePartRefused { line: join([operation, " refused: ", cause as String], "") }
+    OciListInaccessible { status, body } => UsagePartRefused { line: join([operation, " refused by OCI (", to_string(status), "): ", body], "") }
+    OciListed { items } => match oci_admit_rows(operation: operation, rows: items, keys: keys) {
+      OciRowRefused { cause } => UsagePartRefused { line: cause as String }
+      OciRowsAdmitted { rows } => fold(rows, init: oci_usage_zero, f: (acc, r) => oci_usage_part_add(a: acc, b: each(r)))
+    }
+  }
+}
+
+// ── NAMES, AND THE AVAILABILITY DOMAINS ───────────────────────────────────────────────────────
+//
+// One admitted text field from every row of a list, or the list's refusal. The availability domains
+// are read here because both this module (boot volumes are domain-local) and
+// gunbc.oracle_oci.instance_ensure (micro placement, A1 retry) need them, and this module is the one
+// both can import.
+type OciNamesRead
+  = OciNamesListed { names: List<String> }
+  | OciNamesRefused { line: String }
+
+fn oci_names_of(read: OciListRead, operation: String, key: String) -> OciNamesRead {
+  match read {
+    OciListed { items } => match oci_admit_rows(operation: operation, rows: items, keys: [key]) {
+      OciRowRefused { cause } => OciNamesRefused { line: cause as String }
+      OciRowsAdmitted { rows } => OciNamesListed { names: map(rows, r => oci_admitted_text(row: r, key: key)) }
+    }
+    OciListInaccessible { status, body } => OciNamesRefused { line: join([operation, " refused by OCI (", to_string(status), "): ", body], "") }
+    OciListRefused { cause } => OciNamesRefused { line: join([operation, " refused: ", cause as String], "") }
+  }
+}
+
+fn oci_availability_domains() -> OciNamesRead uses net: Network {
+  oci_names_of(
+    read: oci_list(operation: "ListAvailabilityDomains", host: oci_identity_host, path_and_query: join(["/20160918/availabilityDomains?compartmentId=", oci_tenancy_ocid as String], "") as NonEmptyStr),
+    operation: "ListAvailabilityDomains",
+    key: "name",
+  )
+}
+
+// ── THE EFFECTFUL HALF ────────────────────────────────────────────────────────────────────────
+
+// BOOT VOLUMES ARE LISTED PER AVAILABILITY DOMAIN (review 78198). Oracle's Listing Boot Volumes page
+// says to "specify the availabilityDomain and compartmentId attributes", while its SDK marks the
+// domain optional. A per-domain read is correct under either reading: it cannot hard-fail on a missing
+// parameter, and it cannot silently undercount domains a domain-less list leaves out. Every domain's
+// read must answer, and one refusal refuses the compartment's usage.
+fn oci_boot_volume_usage(compartment: String, domains: List<String>) -> OciUsagePart uses net: Network {
+  fold(domains, init: oci_usage_zero, f: (acc, d) => oci_usage_part_add(a: acc, b: oci_boot_volume_usage_in(compartment: compartment, domain: d)))
+}
+
+fn oci_boot_volume_usage_in(compartment: String, domain: String) -> OciUsagePart uses net: Network {
+  match uri_percent_encode_component(value: domain as NonEmptyStr) {
+    UriPercentComponentRefused { cause } => UsagePartRefused { line: join(["ListBootVolumes for ", domain, " not sent: the domain name does not percent-encode"], "") }
+    UriPercentComponentEncoded(wire) => oci_rows_usage(operation: join(["ListBootVolumes in ", domain], ""), read: oci_list(operation: "ListBootVolumes", host: oci_iaas_host, path_and_query: join(["/20160918/bootVolumes?availabilityDomain=", wire as String, "&compartmentId=", compartment], "") as NonEmptyStr), keys: ["id", "lifecycleState"], each: r => oci_volume_usage(row: r))
+  }
+}
+
+fn oci_compartment_usage(compartment: String, domains: List<String>) -> OciUsagePart uses net: Network {
+  let instances = oci_rows_usage(operation: "ListInstances", read: oci_list(operation: "ListInstances", host: oci_iaas_host, path_and_query: join(["/20160918/instances?compartmentId=", compartment], "") as NonEmptyStr), keys: ["id", "lifecycleState", "shape"], each: r => oci_instance_usage(row: r))
+  let boot = oci_boot_volume_usage(compartment: compartment, domains: domains)
+  let block = oci_rows_usage(operation: "ListVolumes", read: oci_list(operation: "ListVolumes", host: oci_iaas_host, path_and_query: join(["/20160918/volumes?compartmentId=", compartment], "") as NonEmptyStr), keys: ["id", "lifecycleState"], each: r => oci_volume_usage(row: r))
+  oci_usage_part_add(a: oci_usage_part_add(a: instances, b: boot), b: block)
+}
+
+// The root compartment is the tenancy itself. ListCompartments with compartmentIdInSubtree and
+// accessLevel=ANY returns every compartment beneath it.
+fn oci_tenancy_compartments() -> OciListRead uses net: Network {
+  oci_list(operation: "ListCompartments", host: oci_identity_host, path_and_query: join(["/20160918/compartments?compartmentId=", oci_tenancy_ocid as String, "&compartmentIdInSubtree=true&accessLevel=ANY&lifecycleState=ACTIVE"], "") as NonEmptyStr)
+}
+
+fn oci_usage_of_part(part: OciUsagePart, compartments: Int) -> OciTenancyUsageRead {
+  match part {
+    UsagePartRefused { line } => TenancyUsageRefused { line: concat("tenancy usage not observed: ", line) }
+    UsagePart { a1_ocpus, a1_memory, micros, block } =>
+      TenancyUsageObserved {
+        usage: OciOtherUsage { a1_ocpus: a1_ocpus, a1_memory: a1_memory, e2_micro_instances: micros, block: block },
+        compartments: compartments,
+      }
+  }
+}
+
+fn oci_tenancy_usage() -> OciTenancyUsageRead uses net: Network {
+  match oci_tenancy_compartments() {
+    OciListRefused { cause } => TenancyUsageRefused { line: concat("tenancy usage not observed: ListCompartments refused: ", cause as String) }
+    OciListInaccessible { status, body } => TenancyUsageRefused { line: join(["tenancy usage not observed: ListCompartments refused by OCI (", to_string(status), "): ", body], "") }
+    OciListed { items } => match oci_admit_rows(operation: "ListCompartments", rows: items, keys: ["id"]) {
+      OciRowRefused { cause } => TenancyUsageRefused { line: concat("tenancy usage not observed: ", cause as String) }
+      OciRowsAdmitted { rows } => match oci_availability_domains() {
+        OciNamesRefused { line } => TenancyUsageRefused { line: concat("tenancy usage not observed: ", line) }
+        OciNamesListed { names: domains } => {
+          let ids = concat([oci_tenancy_ocid as String], map(rows, r => oci_admitted_text(row: r, key: "id")))
+          oci_usage_of_part(part: fold(ids, init: oci_usage_zero, f: (acc, c) => oci_usage_part_add(a: acc, b: oci_compartment_usage(compartment: c, domains: domains))), compartments: ids.length())
+        }
+      }
+    }
+  }
+}
diff --git a/dag/gunbc/os_install_mechanism.dag b/dag/gunbc/os_install_mechanism.dag
index 7bf9e9e20f3..d9386108daf 100644
--- a/dag/gunbc/os_install_mechanism.dag
+++ b/dag/gunbc/os_install_mechanism.dag
@@ -37,6 +37,7 @@ import gunbc.machine_intake_access {
   AccessContextObservationEvidenceMismatch,
   AccessContextObservationForOtherAttempt,
   AccessContextProbeEvidenceMismatch,
+  AccessContextBoardNotFactsBound,
   AccessContextProfileAmbiguous,
   AccessContextProfileLookupNotRun,
   AccessContextProfileUncatalogued,
@@ -155,6 +156,7 @@ fn os_install_solution_of_delivery(solution: BootDeliverySolution) -> OsInstallM
             AccessContextProbeEvidenceMismatch { endpoint: _, manifest: _, raw_response: _ } => OsInstallMechanismRefused { cause: InstallAccessContextUnbound { standing: s } }
             AccessContextControlRouteEvidenceMismatch { endpoint: _, manifest: _, raw_response: _ } => OsInstallMechanismRefused { cause: InstallAccessContextUnbound { standing: s } }
             AccessContextPromotedProfileUnverified { observation_receipt: _, promotion_receipt: _ } => OsInstallMechanismRefused { cause: InstallAccessContextUnbound { standing: s } }
+            AccessContextBoardNotFactsBound { observed_identity: _, board: _ } => OsInstallMechanismRefused { cause: InstallAccessContextUnbound { standing: s } }
             AccessContextProfileUncatalogued { observed_identity: _ } => OsInstallMechanismRefused { cause: InstallAccessContextUnbound { standing: s } }
             AccessContextProfileAmbiguous { observed_identity: _, count: _ } => OsInstallMechanismRefused { cause: InstallAccessContextUnbound { standing: s } }
             AccessContextCatalogRefused { standing: _ } => OsInstallMechanismRefused { cause: InstallAccessContextUnbound { standing: s } }
diff --git a/dag/gunbc/owned_directory.dag b/dag/gunbc/owned_directory.dag
new file mode 100644
index 00000000000..035bbdd682b
--- /dev/null
+++ b/dag/gunbc/owned_directory.dag
@@ -0,0 +1,489 @@
+module gunbc.owned_directory
+
+import std.types { String, NonEmptyStr, Bool, List, Int, FilePath }
+import std.algebra { trim }
+import std.optional { Optional, Present, Absent }
+import v2.std.collection { list_at_optional }
+import extdeps.access.posix { FileMode, file_mode_octal, file_mode_of_octal_text }
+import extdeps.posix.identity { PosixOwnerNames, posix_owner_names_text }
+import extdeps.tools.gnu_coreutils { coreutils_install_directory_owned_argv }
+import gunbc.managed_directory {
+  ManagedDirectory,
+  DeclaredDirectoryMode,
+  declared_directory_mode,
+  managed_directory_permissions,
+  managed_directory_admit,
+  ManagedDirectoryAdmitted,
+  ManagedDirectoryRefused,
+}
+import gunbc.ensure {
+  EnsurePolicy,
+  EnsureObservation,
+  EnsureObserved,
+  EnsureAbsent,
+  EnsureInaccessible,
+  EnsurePlan,
+  EnsurePlanAvailable,
+  EnsurePlanUnavailable,
+  ensure_decide,
+  ensure_reconcile,
+}
+import std.upsert_decision { UpsertDecision, Noop, Apply, Refuse }
+import std.realization_reconcile {
+  Application,
+  Applied,
+  NotApplied,
+  ReconciledEffect,
+  ConvergedEffect,
+  ReconciledOutcome,
+  EffectConverged,
+  EffectNotConverged,
+  classify_reconciled,
+}
+
+// THE OwnedDirectory TARGET OF D14 (docs/plans/ensure-closure-design.md section 3.1), built corpus-only
+// for the dashboard instance's directories ahead of D14 step 4. A target is a desired environmental
+// fact at a placement: a directory at a path, owned by a principal, at a mode. The host is the
+// placement of whatever realizes the target -- the dashboard apply's target exec or the live_deploy
+// transaction's transport -- so it is not repeated here.
+//
+// NOTHING HERE IS NEW VOCABULARY FOR OWNERSHIP OR MODE. A target's permissions are either one of the
+// closed gunbc.managed_directory DeclaredDirectoryMode arms beside a named owner, or a
+// gunbc.managed_directory ManagedDirectory whose owner, group and mode are derived from its declared
+// dependents. The owner names are extdeps.posix.identity PosixOwnerNames. What this module adds is the
+// ensure lifecycle over them, through gunbc.ensure, and the one install plan both routes realize.
+//
+// THE DISCOVERY IS NOT AUTOMATIC YET. Who demands a directory is still a composition the consumers'
+// demand functions are listed into (gunbc.roadmap.dashboard_instance_directories); D14 step 4 is what
+// derives the demand from the code that writes there.
+type OwnedDirectoryTarget
+  = OwnedDirectoryDeclared {
+      member: NonEmptyStr,
+      path: FilePath,
+      owner: PosixOwnerNames,
+      mode: DeclaredDirectoryMode,
+    }
+  | OwnedDirectoryManaged { directory: ManagedDirectory }
+
+fn owned_directory_path(t: OwnedDirectoryTarget) -> FilePath {
+  match t {
+    OwnedDirectoryDeclared { member: _, path, owner: _, mode: _ } => path
+    OwnedDirectoryManaged { directory } => directory.path
+  }
+}
+
+fn owned_directory_member(t: OwnedDirectoryTarget) -> NonEmptyStr {
+  match t {
+    OwnedDirectoryDeclared { member, path: _, owner: _, mode: _ } => member
+    OwnedDirectoryManaged { directory } => directory.member
+  }
+}
+
+// `-g` is the group principal's USER NAME for a managed directory, the coincidence
+// gunbc.live_deploy.emit install_d_managed_command records; a declared target names its group.
+fn owned_directory_owner(t: OwnedDirectoryTarget) -> PosixOwnerNames {
+  match t {
+    OwnedDirectoryDeclared { member: _, path: _, owner, mode: _ } => owner
+    OwnedDirectoryManaged { directory } =>
+      PosixOwnerNames { user: directory.owner.name, group: directory.group_principal.name }
+  }
+}
+
+type OwnedDirectoryMode
+  = OwnedDirectoryModeResolved { mode: FileMode }
+  | OwnedDirectoryModeRefused { reason: NonEmptyStr }
+
+// A MANAGED DIRECTORY WHOSE WRITER THE OWNER AND GROUP DO NOT COVER HAS NO MODE, and the refusal is
+// carried to the decision rather than lowered to a wider mode (gunbc.managed_directory
+// managed_directory_admit).
+fn owned_directory_mode(t: OwnedDirectoryTarget) -> OwnedDirectoryMode {
+  match t {
+    OwnedDirectoryDeclared { member: _, path: _, owner: _, mode } =>
+      OwnedDirectoryModeResolved { mode: declared_directory_mode(m: mode) }
+    OwnedDirectoryManaged { directory } =>
+      match managed_directory_admit(d: directory) {
+        ManagedDirectoryAdmitted { dir } =>
+          OwnedDirectoryModeResolved { mode: managed_directory_permissions(d: dir).mode }
+        ManagedDirectoryRefused { member, path, writer } =>
+          OwnedDirectoryModeRefused {
+            reason: join([
+              "owned directory ", member as String, " at ", path as String,
+              ": declared writer ", writer as String,
+              " is neither its owner nor in its group, so no mode is derived",
+            ], "") as NonEmptyStr,
+          }
+      }
+  }
+}
+
+fn owned_directory_targets_paths(ts: List<OwnedDirectoryTarget>) -> List<FilePath> {
+  map(ts, t => owned_directory_path(t: t))
+}
+
+fn owned_directory_demand_at(ts: List<OwnedDirectoryTarget>, path: String) -> Optional<OwnedDirectoryTarget> {
+  first(filter(xs: ts, predicate: t => (owned_directory_path(t: t) as String) == path))
+}
+
+// ── OBSERVATION ──────────────────────────────────────────────────────────────────────────────────
+//
+// ONE READING, ONE PARSER, EVERY ROUTE. stat(1)'s %F|%U|%G|%a is GNU coreutils (gunbc.executor_privileged_operation
+// ReadDirectoryIdentity spells the same argv); each route supplies the line, and this module alone
+// decides what it says. A line that does not parse is not a directory nobody owns: it is an
+// observation that did not happen.
+type OwnedDirectoryReading {
+  is_directory: Bool
+  owner: PosixOwnerNames
+  mode: FileMode
+}
+
+data owned_directory_stat_format: String = "%F|%U|%G|%a"
+
+fn owned_directory_stat_args(path: FilePath) -> List<String> {
+  ["-c", owned_directory_stat_format, "--", path as String]
+}
+
+fn owned_directory_reading_of_stat_line(line: String) -> Optional<OwnedDirectoryReading> {
+  let fields = split(s: trim(s: line), delimiter: "|")
+  if count(fields) != 4 {
+    none
+  } else {
+    match list_at_optional(xs: fields, index: 0) {
+      Absent => none
+      Present { value: kind } => match list_at_optional(xs: fields, index: 1) {
+        Absent => none
+        Present { value: user } => match list_at_optional(xs: fields, index: 2) {
+          Absent => none
+          Present { value: group } => match list_at_optional(xs: fields, index: 3) {
+            Absent => none
+            Present { value: mode_text } =>
+              if user == "" || group == "" {
+                none
+              } else {
+                match file_mode_of_octal_text(text: mode_text) {
+                  Absent => none
+                  Present { value: mode } => Present {
+                    value: OwnedDirectoryReading {
+                      is_directory: kind == "directory",
+                      owner: PosixOwnerNames { user: user as NonEmptyStr, group: group as NonEmptyStr },
+                      mode: mode,
+                    },
+                  }
+                }
+              }
+          }
+        }
+      }
+    }
+  }
+}
+
+// ── THE OBSERVATION CONTRACT: WHAT A ROUTE HANDS IN, AND WHAT IT MAY MEAN ───────────────────────
+//
+// A route supplies two READ-ONLY metadata reads, each bound to one directory and each returning what
+// it read or WHY it read nothing as a typed origin: list a directory's entries, and stat a directory
+// (file type, owner, group, mode). The route chooses the transport and the authority the reads run
+// under -- the dashboard apply: the instance's own toolchain as the instance's principal; the
+// live_deploy transaction: the deploy principal's pinned-argv grants (gunbc.executor_privileged_operation
+// ListDirectoryEntries, ReadDirectoryIdentity), which traverse every declared mode. This module alone
+// decides what the reads say.
+//
+// ABSENCE IS ESTABLISHED, NEVER INFERRED. A directory is absent only when a listing of its parent was
+// actually read and does not name it (or, recursively, when the parent itself was established
+// absent). No diagnostic text is consulted anywhere: a read that failed -- an observer that could not
+// be spawned, a transport that refused, an observer that ran and exited nonzero for any reason --
+// carries that origin as a value, and a failed read establishes nothing. So a missing observer binary,
+// a broken transport or a refused grant yields INACCESSIBLE, under which no policy installs.
+type ObserverFailure
+  = ObserverNotSpawned { cause: String }
+  | ObserverTransportRefused { cause: String }
+  | ObserverExited { exit_code: Int, stderr: String }
+
+type ObserverRead
+  = ObserverReadOut { stdout: String }
+  | ObserverReadFailed { origin: ObserverFailure }
+
+fn observer_failure_text(f: ObserverFailure) -> String {
+  match f {
+    ObserverNotSpawned { cause } => join(["the observer could not be spawned: ", cause], "")
+    ObserverTransportRefused { cause } => join(["the transport refused the read: ", cause], "")
+    ObserverExited { exit_code, stderr } => join(["the observer exited ", to_string(value: exit_code), ": ", trim(s: stderr)], "")
+  }
+}
+
+fn owned_directory_parent(path: FilePath) -> FilePath {
+  let segments = filter(xs: split(s: path as String, delimiter: "/"), predicate: s => s != "")
+  if count(segments) <= 1 {
+    "/" as FilePath
+  } else {
+    join(["/", join(segments.take(n: count(segments) - 1), "/")], "") as FilePath
+  }
+}
+
+fn owned_directory_basename(path: FilePath) -> String {
+  fold(split(s: path as String, delimiter: "/"), init: "", f: (acc, seg) => if seg == "" { acc } else { seg })
+}
+
+// EVERY DIRECTORY WHOSE LISTING CAN BE ASKED WHILE OBSERVING `path`: its parent and each ancestor up to
+// the root. A route that authorizes its listings per directory grants exactly these.
+fn owned_directory_listed_ancestors(path: FilePath) -> List<FilePath> {
+  if (path as String) == "/" {
+    []
+  } else {
+    concat([owned_directory_parent(path: path)], owned_directory_listed_ancestors(path: owned_directory_parent(path: path)))
+  }
+}
+
+type OwnedDirectoryPresence
+  = PresenceListed
+  | PresenceNotListed
+  | PresenceUnestablished { origin: ObserverFailure }
+
+fn owned_directory_presence(path: FilePath, list: fn(FilePath) -> ObserverRead) -> OwnedDirectoryPresence {
+  let parent = owned_directory_parent(path: path)
+  match list(parent) {
+    ObserverReadOut { stdout } =>
+      if any(split(s: stdout, delimiter: "\n"), e => e == owned_directory_basename(path: path)) { PresenceListed } else { PresenceNotListed }
+    ObserverReadFailed { origin } =>
+      if (parent as String) == "/" {
+        PresenceUnestablished { origin: origin }
+      } else {
+        match owned_directory_presence(path: parent, list: list) {
+          PresenceNotListed => PresenceNotListed
+          PresenceListed => PresenceUnestablished { origin: origin }
+          PresenceUnestablished { origin: o } => PresenceUnestablished { origin: o }
+        }
+      }
+  }
+}
+
+fn owned_directory_observe(
+  path: FilePath,
+  list: fn(FilePath) -> ObserverRead,
+  stat: fn(FilePath) -> ObserverRead,
+) -> EnsureObservation<OwnedDirectoryReading> {
+  match owned_directory_presence(path: path, list: list) {
+    PresenceNotListed => EnsureAbsent { reason: join(["owned directory ", path as String, " is not listed in its parent"], "") }
+    PresenceUnestablished { origin } =>
+      EnsureInaccessible { reason: join(["presence of ", path as String, " not established: ", observer_failure_text(f: origin)], "") }
+    PresenceListed => match stat(path) {
+      ObserverReadFailed { origin } =>
+        EnsureInaccessible { reason: join(["stat of ", path as String, ": ", observer_failure_text(f: origin)], "") }
+      ObserverReadOut { stdout } => match owned_directory_reading_of_stat_line(line: stdout) {
+        Absent => EnsureInaccessible { reason: join(["stat of ", path as String, " is not an identity line: ", trim(s: stdout)], "") }
+        Present { value: reading } => EnsureObserved { evidence: reading }
+      }
+    }
+  }
+}
+// ── DECISION ─────────────────────────────────────────────────────────────────────────────────────
+fn owned_directory_owner_matches(want: PosixOwnerNames, got: PosixOwnerNames) -> Bool {
+  (want.user as String) == (got.user as String) && (want.group as String) == (got.group as String)
+}
+
+fn owned_directory_mode_matches(t: OwnedDirectoryTarget, got: FileMode) -> Bool {
+  match owned_directory_mode(t: t) {
+    OwnedDirectoryModeRefused { reason: _ } => false
+    OwnedDirectoryModeResolved { mode } => file_mode_octal(mode: mode) == file_mode_octal(mode: got)
+  }
+}
+
+fn owned_directory_satisfied(t: OwnedDirectoryTarget, o: EnsureObservation<OwnedDirectoryReading>) -> Bool {
+  match o {
+    EnsureObserved { evidence } =>
+      evidence.is_directory
+        && owned_directory_owner_matches(want: owned_directory_owner(t: t), got: evidence.owner)
+        && owned_directory_mode_matches(t: t, got: evidence.mode)
+    EnsureAbsent { reason: _ } => false
+    EnsureInaccessible { reason: _ } => false
+  }
+}
+
+// THE INSTALL THIS TARGET IS REALIZED BY, the one plan both routes execute: `install -d -m -o -g`
+// (extdeps.tools.gnu_coreutils coreutils_install_directory_owned_argv), which puts ownership and mode
+// at creation and re-applies the mode to a directory that exists.
+type OwnedDirectoryInstallPlan {
+  path: FilePath
+  owner: PosixOwnerNames
+  mode_octal: NonEmptyStr
+}
+
+fn owned_directory_install_argv(plan: OwnedDirectoryInstallPlan) -> List<String> {
+  coreutils_install_directory_owned_argv(
+    mode: plan.mode_octal,
+    owner: plan.owner.user,
+    group: plan.owner.group,
+    path: plan.path as String,
+  )
+}
+
+// THE SAME ARGV WITHOUT ITS PROGRAM WORD, for a route that resolves the program to a host path itself
+// (the dashboard apply's toolchain, where macOS's GNU install is ginstall).
+fn owned_directory_install_args(plan: OwnedDirectoryInstallPlan) -> List<String> {
+  owned_directory_install_argv(plan: plan).skip(n: 1)
+}
+
+// OWNERSHIP IS NEVER ADOPTED FROM AN OBSERVATION. A directory that exists under another principal, or a
+// path that exists and is not a directory, has no plan: re-owning it would hand the demanding
+// principal whatever someone else put there, and replacing it would destroy it. Both refuse, under
+// every policy, with what was found. Only a mode that differs on a directory the demanded principal
+// already owns is repaired.
+fn owned_directory_plan(t: OwnedDirectoryTarget, o: EnsureObservation<OwnedDirectoryReading>) -> EnsurePlan<OwnedDirectoryInstallPlan> {
+  let foreign: String? = match o {
+    EnsureObserved { evidence } =>
+      if !evidence.is_directory {
+        Present { value: "exists and is not a directory; it is never replaced" }
+      } else if !owned_directory_owner_matches(want: owned_directory_owner(t: t), got: evidence.owner) {
+        Present {
+          value: join([
+            "is owned by ", posix_owner_names_text(names: evidence.owner),
+            ", not ", posix_owner_names_text(names: owned_directory_owner(t: t)),
+            "; ownership is never adopted",
+          ], ""),
+        }
+      } else {
+        none
+      }
+    EnsureAbsent { reason: _ } => Absent
+    EnsureInaccessible { reason: _ } => Absent
+  }
+  match foreign {
+    Present { value: why } =>
+      EnsurePlanUnavailable { reason: join(["owned directory ", owned_directory_path(t: t) as String, " ", why], "") }
+    Absent => owned_directory_install_plan_of(t: t)
+  }
+}
+
+// THE INSTALL A TARGET IS REALIZED BY, independent of any observation: available exactly when its mode
+// derives. A route that emits its apply rather than running it (the live_deploy transaction) lowers
+// this once the plan-time decision has said Apply.
+fn owned_directory_install_plan_of(t: OwnedDirectoryTarget) -> EnsurePlan<OwnedDirectoryInstallPlan> {
+  match owned_directory_mode(t: t) {
+    OwnedDirectoryModeRefused { reason } => EnsurePlanUnavailable { reason: reason as String }
+    OwnedDirectoryModeResolved { mode } =>
+      EnsurePlanAvailable {
+        plan: OwnedDirectoryInstallPlan {
+          path: owned_directory_path(t: t),
+          owner: owned_directory_owner(t: t),
+          mode_octal: file_mode_octal(mode: mode) as NonEmptyStr,
+        },
+      }
+  }
+}
+
+fn owned_directory_mismatch_reason(t: OwnedDirectoryTarget, o: EnsureObservation<OwnedDirectoryReading>) -> String {
+  match owned_directory_plan(t: t, o: o) {
+    EnsurePlanUnavailable { reason } => reason
+    EnsurePlanAvailable { plan } =>
+      match o {
+        EnsureObserved { evidence } =>
+          join([
+            "owned directory ", owned_directory_path(t: t) as String, " is at mode ",
+            file_mode_octal(mode: evidence.mode), ", not ", plan.mode_octal as String,
+          ], "")
+        EnsureAbsent { reason } => reason
+        EnsureInaccessible { reason } => reason
+      }
+  }
+}
+
+// THE DECISION IS gunbc.ensure ensure_decide's, never a second one: Inaccessible refuses under every
+// policy, observe-only refuses anything it would have to change, and May-apply applies the install
+// plan only when one exists -- which a foreign owner or a refused mode derivation never has.
+fn owned_directory_decide(
+  policy: EnsurePolicy,
+  target: OwnedDirectoryTarget,
+  observation: EnsureObservation<OwnedDirectoryReading>,
+) -> UpsertDecision<OwnedDirectoryInstallPlan> {
+  ensure_decide(
+    policy: policy,
+    observation: observation,
+    observation_satisfies: owned_directory_satisfied(t: target, o: observation),
+    mismatch_reason: owned_directory_mismatch_reason(t: target, o: observation),
+    plan: owned_directory_plan(t: target, o: observation),
+  )
+}
+
+// THE RECEIPT: the decision, the application arm and the INDEPENDENT readback classified together
+// (gunbc.ensure ensure_reconcile). The after-observation is a second read of the host, never the
+// install's exit status.
+fn owned_directory_reconcile(
+  policy: EnsurePolicy,
+  target: OwnedDirectoryTarget,
+  before: EnsureObservation<OwnedDirectoryReading>,
+  application: Application,
+  after: EnsureObservation<OwnedDirectoryReading>,
+) -> ReconciledEffect<OwnedDirectoryInstallPlan, OwnedDirectoryReading> {
+  ensure_reconcile(
+    policy: policy,
+    before: before,
+    before_satisfies: owned_directory_satisfied(t: target, o: before),
+    mismatch_reason: owned_directory_mismatch_reason(t: target, o: before),
+    plan: owned_directory_plan(t: target, o: before),
+    application: application,
+    after: after,
+    after_satisfies: owned_directory_satisfied(t: target, o: after),
+    after_mismatch_reason: owned_directory_mismatch_reason(t: target, o: after),
+  )
+}
+
+// ── THE PROVIDER ─────────────────────────────────────────────────────────────────────────────────
+//
+// ONE PROVIDER, THE D14 LIFECYCLE IN ONE NODE: observe, decide, apply when decided, observe again,
+// reconcile. The route supplies only the two host-touching operations -- how to read a path's stat
+// line and how to run the install plan -- so the dashboard apply (its target exec, local or ssh) and any other
+// route that executes synchronously realize the same decision and the same plan. The live_deploy
+// transaction emits its apply as a script rather than running it here, so it consumes the same halves
+// separately: owned_directory_decide over its plan-time observation, owned_directory_install_argv for
+// the emitted install, and the post-apply re-derivation as the readback
+// (gunbc.live_deploy.member_observe observe_owned_directory).
+type OwnedDirectoryEnsureOutcome
+  = OwnedDirectoryEnsured {
+      target: OwnedDirectoryTarget,
+      converged: ConvergedEffect<OwnedDirectoryInstallPlan, OwnedDirectoryReading>,
+    }
+  | OwnedDirectoryEnsureRefused {
+      target: OwnedDirectoryTarget,
+      reason: String,
+    }
+
+fn owned_directory_ensure(
+  policy: EnsurePolicy,
+  target: OwnedDirectoryTarget,
+  observe: fn(FilePath) -> EnsureObservation<OwnedDirectoryReading>,
+  run: fn(OwnedDirectoryInstallPlan) -> Bool,
+) -> OwnedDirectoryEnsureOutcome {
+  let before = observe(owned_directory_path(t: target))
+  let decision = owned_directory_decide(policy: policy, target: target, observation: before)
+  let application = match decision {
+    Apply { plan } => if run(plan) { Applied } else { NotApplied }
+    Noop => NotApplied
+    Refuse { reason: _ } => NotApplied
+  }
+  let after = observe(owned_directory_path(t: target))
+  match classify_reconciled(r: owned_directory_reconcile(
+    policy: policy,
+    target: target,
+    before: before,
+    application: application,
+    after: after,
+  )) {
+    EffectConverged { converged } => OwnedDirectoryEnsured { target: target, converged: converged }
+    EffectNotConverged { reason, attempt: _ } => OwnedDirectoryEnsureRefused { target: target, reason: reason }
+  }
+}
+
+fn owned_directory_outcome_converged(o: OwnedDirectoryEnsureOutcome) -> Bool {
+  match o {
+    OwnedDirectoryEnsured { target: _, converged: _ } => true
+    OwnedDirectoryEnsureRefused { target: _, reason: _ } => false
+  }
+}
+
+fn owned_directory_outcome_detail(o: OwnedDirectoryEnsureOutcome) -> String {
+  match o {
+    OwnedDirectoryEnsured { target, converged: _ } =>
+      join(["owned directory ", owned_directory_path(t: target) as String, " converged"], "")
+    OwnedDirectoryEnsureRefused { target, reason } =>
+      join(["owned directory ", owned_directory_path(t: target) as String, " refused: ", reason], "")
+  }
+}
diff --git a/dag/gunbc/pid_control_curve_decode_witness.dag b/dag/gunbc/pid_control_curve_decode_witness.dag
index f07004eadd0..ca5c9c71dd6 100644
--- a/dag/gunbc/pid_control_curve_decode_witness.dag
+++ b/dag/gunbc/pid_control_curve_decode_witness.dag
@@ -124,7 +124,7 @@ data reordered_reading_curve_text: String = "\{\"reading\": \{\"2\": 62, \"0\":
 fn member_order_does_not_change_the_semantic_curve() -> Bool {
   let points = decoded_points(text: reordered_reading_curve_text)
   points.length() == 3
-    && points.first().index == 0
+    && (match points.first() { Present { value: __v } => __v.index == 0  Absent => false })
     && exact_decimal_wire(d: measure_count(m: points.first().reading)) == "40"
     && exact_decimal_wire(d: measure_count(m: points.skip(n: 2).first().reading)) == "62"
 }
diff --git a/dag/gunbc/plans/ci_process_end_to_end.dag b/dag/gunbc/plans/ci_process_end_to_end.dag
index 0c724b22e4b..be2f60292b8 100644
--- a/dag/gunbc/plans/ci_process_end_to_end.dag
+++ b/dag/gunbc/plans/ci_process_end_to_end.dag
@@ -64,7 +64,7 @@ fn ci_process_end_to_end_body() -> List<MarkdownBlock> {
       rows: [
         row(cells: [cell(text: "**Execution as a dependency graph**"), cell(text: "**✅ WORKS — the realest layer**"), cell(text: "the floor *is* a bounded forward DAG walk; `claim_executor` interprets `ci_floor_plan.dag`, one fold (`fold_node`), batches from dependency edges. The core thesis runs in prod every push")]),
         row(cells: [cell(text: "**Scheduling**"), cell(text: "**◑ one axis live, rest inert**"), cell(text: "**Width** consumes the measured envelope (#5444), single-host. `Placement`/`Materialization` are modeled + witness-passing but have **no non-test consumer** — the same band as the host-ops gap (§3-B), substrate side. Empty `RealizationObjective.goals` deleted 2026-09-06; decision completeness is `std.decision`, not a schedule field.")]),
-        row(cells: [cell(text: "**Caching**"), cell(text: "**◑ five forks, converging**"), cell(text: "sccache live (build) · resolve-cache **dormant** (modeled, pure-proven 616/616, env var unset — biggest dormant lever) · ParseTable memo live (content-addressed, amortization witness) · RecordedFixture (record/replay) · BuildBuddy opt-in. The one-door `realize(subject)` kernel (§2 P2) is staged")]),
+        row(cells: [cell(text: "**Caching**"), cell(text: "**◑ five forks, converging**"), cell(text: "sccache live (build) · resolve-cache **dormant** (modeled, pure-proven 616/616, env var unset — biggest dormant lever) · ParseTable memo (since deleted with the parse memo carrier, operator ruling R2 2026-10-08) · RecordedFixture (record/replay) · BuildBuddy opt-in. The one-door `realize(subject)` kernel (§2 P2) is staged")]),
         row(cells: [cell(text: "**Secrets / effects**"), cell(text: "**○ ad hoc**"), cell(text: "live cgroup reads, sccache servers, BMC, tokens — no single model yet")]),
         row(cells: [cell(text: "**Emission**"), cell(text: "**✅ works**"), cell(text: "`ci.yml` + testgen are emitted + drift-gated; stage0 seed `--verify` is the one missing gate (§5 keystone)")]),
       ],
@@ -144,7 +144,7 @@ fn ci_process_end_to_end_body() -> List<MarkdownBlock> {
     h2(text: "9. The lane's real deliverable — shared abstractions"),
     p(text: "Beyond closing the gaps, the lane converges the forks CI exposes (pull each in **as CI flexes it**, §6):"),
     ul(items: [
-      li(text: "**One Materialization kernel** — collapse sccache / resolve / ParseTable-memo / RecordedFixture / BuildBuddy onto `realize(subject)` (§2 P2)."),
+      li(text: "**One Materialization kernel** — collapse sccache / resolve / RecordedFixture / BuildBuddy onto `realize(subject)` (§2 P2)."),
       li(text: "**One Placement authority** — jobs (GitHub), threads (`spawn_width`), sessions (ctrl `plans.capacity`) are three forks of \"put work on a host.\""),
       li(text: "**One secrets/effects model** — BMC, tokens, sccache-auth modeled once."),
       li(text: "**gunbhub** — owning the Git/CI engine eventually closes the irreducible GitHub boundary (links 2, 13–14 / G6). *Not pressing*; the pain that denominates the lane is timeliness-for-confidence, not engine ownership."),
diff --git a/dag/gunbc/plans/demand_engine_program.dag b/dag/gunbc/plans/demand_engine_program.dag
index 9877fe090d2..cd91089d334 100644
--- a/dag/gunbc/plans/demand_engine_program.dag
+++ b/dag/gunbc/plans/demand_engine_program.dag
@@ -211,7 +211,7 @@ fn demand_engine_program_body() -> List<MarkdownBlock> {
       li(text: "**D8 — First authority cut.** The v2 native fold's driver (M3a). Recommendation: confirm. **Deferred:** trigger is M3a's detailed plan confirming that driver as the first production scheduling cut; the consumer is not changed here."),
       li(text: "**D9 — Crate partition of the emitted closure; generator promotion is a separate fact.** Two facts joined through generation identity, not one decision (side-chat ruling, 2026-09-15). GENERATOR PROMOTION -- seed (v1 emitting v2) versus self-hosted (v2 emitting itself) -- is an admission root cut governed by DESIGN §7 and D1: the seed remains the production generator until the self-hosted route satisfies the complete judgment and refusal contract, then the root cuts over; cost never keeps the seed as a semantic fallback, and it is not a `std.decision` candidate. PARTITION SELECTION is a realization selection over the closure the ACTIVE generator produced: hard constraints first (every module owned exactly once; every source and reference edge represented; complete `CompilationUnit` interface closure; Rust R4 validity; no illegal private access or impl ownership; the stable facade; complete semantic and refusal equivalence), then `std.decision` `select_realization` over a bounded declared candidate field -- one crate (the baseline, which remains a candidate), runtime + remainder, a few derived target-count cuts via `PartitionPolicy`, the policy-derived cut, SCC-per-unit as the diagnostic extreme -- funded on clean emitted-closure build wall, warm incremental wall over a declared edit population (a leaf, a high-fan-in foundation module, a large ordinary compiler module), total CPU, peak memory and process count, link/metadata/process overhead, artifact and binary size, and emission/workspace-construction wall; scoped by closure identity, producer compiler, toolchain, build profile, machine shape, candidate-field identity, evidence snapshot and policy; result `SelectedWithin`, never 'optimal'. At self-host cutover the same authority and decision re-run over the new closure; the prior selection is evidence, not an inherited answer. MEASUREMENT: the reading taken so far is a route wall partition -- seed workspace build, closure emission and one-crate emitted build as three walls read from the native route's build-log timestamps (`build.sh` in the srv1 A/B harness is the producer) -- not a rustc phase partition; `[native-prepare-split]` measures native-driver prepare, not rustc, and is not this instrument. The trigger is therefore the direct candidate A/B: each admitted candidate built from the same emitted closure, toolchain, profile, features and warm shared dependency target, recording per-crate start/end wall, ready/running crate concurrency, total wall and CPU, peak RSS and process count, link wall and artifact size; then the three edit classes with the crate DAG's PREDICTED rebuilt set pre-registered against cargo's observed rebuilt set. Pre-registered structural consequences if a derived cut is right: more than one admitted crate is ready during a nontrivial part of the build; cargo overlaps their compilation; observed rebuilt crates equal the predicted downstream closure after each edit; semantic outputs and refusals identical; the selected candidate wins under the declared field. Line share is not a bound on front-half time and is not a prediction. SEQUENCE: this is a standalone native-route realization cut with a current production consumer (the emitted native closure build) and a current displaced route (the one-crate writer), depending on no engine, fabric supply, cross-run store or width deletion -- it does NOT wait for M5. Its serial position is after M1.a (the JudgmentContract cut) and before M1.b (the keying-relation cut) and M1.c (the cross-run hit cut): it precedes M1.c because the selected `RustCratePartitionIdentity` is part of the compiler artifact's build configuration and therefore of its evaluation identity from the first persistent implementation; if the candidate field selects the one-crate baseline, D9 records that `SelectedWithin` result, performs no physical cut, and the sequence continues; if the runner envelope cannot honestly bound multi-crate cargo concurrency, the authority and A/B still complete and execution defers to M5 -- no `-j` setting belongs here. **Deferred:** trigger = the edge-provenance classification of the emitted reference graph and the candidate A/B above; until both exist this row admits no implementation. **Declared frontier waiting on this row (DESIGN §3c): cross-run materialization of the per-file pool heads reading.** Every entry-subject run re-derives the heads reading of every pool file (`v1_compiler.cli_run.pool_acquire` `heads_reading_for`; the `[pre-entry]` rows `pool_source_tokenize`, `pool_source_newline_index` and `pool_heads_parse`) because the declared-name index it feeds is a tree-subject fact each new process demands for the same tree: recurrence across processes, not authored duplication. Its request is a sibling variant of `std.materialization_provider` `ParseModuleRequest` with the same key fields (`source_digest`, `compiler`) and its own kind and output roster, the persisted value spelling-free with spans rebound on load, stored in the bounded local store under a per-family budget sized so the whole pool fits. It is not built, because its `compiler` input must be the identity of the tokenizer and heads parser alone: the running-binary hash re-keys on every commit, and a lane-local crate digest would be a second crate-identity mechanism beside this row. TRIGGER: D9's crate partition identity exists AND the front-end unit (`v1_compiler_tokenize` and `v1_compiler_parse`, below `v1_infer`) is a partition crate, so that crate's identity is the `compiler` input. CASE ON FILE, a one-off probe of 2026-10-03 and not an instrument (uncommitted test, release build, BuildBuddy runner, the live `dag` plus `src/v2` pool of 7417 files): recomputing every heads reading took 22.5 s (16.2 s under a timer that then covered lexing AND the newline index together, heads parse 6.3 s); reloading them from per-file `serde_json` took 3.3 s (read 0.12 s from a warm page cache, deserialize 3.17 s); 7417 of 7417 reloaded readings compared equal; the JSON was 777 MB for 98 MB of source. WHAT THE PROBE DID NOT TEST: it persisted and reloaded the reading AS IS, with the file spelling still in every span, so its equality count and its reload time are evidence about that form only. The proposed form (spelling-free, spans rebound on load) was not built, not compared and not timed; no pool file had a heads refusal, so a persisted refusal was never exercised. Owed before any build, and unmeasured: an executing comparison, over the live pool, of a fresh reading against the spelling-free persisted value after rebinding, covering the module node, diagnostic and refusal spans, and the file-local intern strings and occurrence-allocator end; the measured cost of that rebinding; the size of the spelling-free form (if it stays near that figure, a compact encoding through `std.materialization_object`'s versioned encoding rather than JSON), one cold-disk read, and the family budget declared from that measurement. The tree name census is a second candidate keyed over the heads digests of a source root's closure; it waits on this one, and `UniverseArtifactRequest` is checked as its family before any new variant."),
       li(text: "**D10 — Native production admission: when the v2-compiled route becomes the production semantic route.** Operator direction (2026-09-15): anchor on the native route now and root-cause disagreements over time; v1 is not the semantic oracle -- the authority is the modeled `JudgmentContract`, and a v1/v2 disagreement is evidence demanding investigation, with neither side winning by age. Two cuts stay separate: native v2 EXECUTION becoming the production semantic route (this row) and the self-hosted GENERATOR replacing the seed (D9 / §7, which still requires the complete generation judgment and refusal contract; a native evaluator may be production while the seed still generates it). Admission is a typed whole-route verdict, `NativeProductionAdmission = NativeProductionAdmitted { contract_identity, required_subject_denominator, result_contract_coverage, refusal_census, divergence_dispositions } | NativeProductionRefused { causes }`, requiring: a named denominator of the judgments and subjects the route promises to serve; total outcomes -- every demanded subject yields an admitted result or an attributed typed refusal; zero unattributed refusals; no contract-violating acceptance; no contract-violating refusal inside the required denominator; every v1/v2 divergence classified against the independent contract or source authority; and no interpreter fallback after the cut. A v2 refusal where v1 accepted is worked after cutover only when the refusal is correct under the contract or the subject lies outside the declared denominator with that boundary explicit -- deferring a false refusal of a valid required subject is not a complete production handler. After cutover, a red parity or admission result latches `NativeProductionRevertRequired` or stops new admissions and awaits an explicit operator disposition; it never silently re-executes the judgment through v1 (the current routing consumer's fall-back-to-interpreted arm is exactly the escape hatch this row deletes). Recommendation: adopt, and run the pre-anchor census of §1 as its first instrument. **Deferred:** trigger is that census reaching zero unattributed refusals with every divergence dispositioned, at which point the admission verdict is computed for the declared denominator; the interpreter-remains-production sentence in M3a is retired by this row's `NativeProductionAdmitted` and by nothing else."),
-      li(text: "**D11 — Effects on the native route: the minimal set, and callability. Ruled 2026-09-16.** Scope (operator): Filesystem plus the Gap-B boundary of section 2.9 (argv, stdout/stderr, and the existing elapsed and peak-resident measurement seams) are realized in the emitted closure through bound realizations returning values; Clock, Network, Entropy and AuthContext are not realized by this program -- emitted interfaces refused by `NativeEffectRealizationAdmission`, outside D10's denominator; a scope ruling, not a drop. Callability (side-chat ruling, refined option (a)): resource operations are admissible in ORDINARY functions only through an explicit effect/resource requirement -- an effect envelope or capability parameter on the function -- and the entry realization supplies the matching handler; no ordinary function acquires an ambient global capability merely because a native handler exists. Option (b), entry folds as workflow functions, is refused: it makes 'workflow function' the price of any effect and pulls the workflow realization into every native entry, conflating a semantic effect requirement with one orchestration realization -- against this program's terminal goal of ordinary sequential programs receiving lawful realization for free. E1 falsifies the emitter's implementation of this ruling; it does not reopen it. The fork that option (b) would have deepened -- `uses` read as workflow identity -- is resolved by D12 below: the workflow-function concept is DELETED, not separated. There is no marker and no function-kind authority; executable-entry identity is the artifact-relative `compiler_pipeline_entry` (an executable has exactly one, a library none, and more than one or an unresolved driver refuses), never a property of a function; `uses` keeps its one meaning as an effect requirement; and sync/async derives from effects plus the bound handler, which the emitter was measured to key on `has_services` and `uses`, never on any entry role. **D11 terminal** (a condition of D10 and of this plan's dissolution): ordinary-function effect callability is implemented through explicit contracts; every in-denominator host effect has exactly one admitted native handler; unsupported effects produce typed admission refusals; the direct per-driver implementations those handlers displace are deleted; and the no-interpreter controls execute on the production route. A terminal D10 may not be reached by choosing a denominator that sidesteps this obligation."),
+      li(text: "**D11 — Effects on the native route: the minimal set, and callability. Ruled 2026-09-16.** Scope (operator): Filesystem plus the Gap-B boundary of section 2.9 (argv, stdout/stderr, and the existing elapsed and peak-resident measurement seams) are realized in the emitted closure through bound realizations returning values; Clock, Network, Entropy and AuthContext are not realized by this program -- emitted interfaces refused by `NativeEffectRealizationAdmission`, outside D10's denominator; a scope ruling, not a drop. Callability (side-chat ruling, refined option (a)): resource operations are admissible in ORDINARY functions only through an explicit effect/resource requirement -- an effect envelope or capability parameter on the function -- and the entry realization supplies the matching handler; no ordinary function acquires an ambient global capability merely because a native handler exists. Option (b), entry folds as workflow functions, is refused: it makes 'workflow function' the price of any effect and pulls the workflow realization into every native entry, conflating a semantic effect requirement with one orchestration realization -- against this program's terminal goal of ordinary sequential programs receiving lawful realization for free. E1 falsifies the emitter's implementation of this ruling; it does not reopen it. The fork that option (b) would have deepened -- `uses` read as workflow identity -- is resolved by D12 below: the workflow-function concept is DELETED, not separated. There is no marker and no function-kind authority; executable-entry identity is the artifact-relative `compiler_pipeline_entry` (an executable has exactly one, a library none, and more than one or an unresolved driver refuses), never a property of a function; `uses` keeps its one meaning as an effect requirement; and sync/async derives from effects plus the bound handler, which the emitter was measured to key on `has_services` and `uses`, never on any entry role. **D11 terminal** (a condition of D10 and of this plan's dissolution): ordinary-function effect callability is implemented through explicit contracts; every in-denominator host effect has exactly one admitted native handler; unsupported effects produce typed admission refusals; the direct per-driver implementations those handlers displace are deleted; and the no-interpreter controls execute on the production route. A terminal D10 may not be reached by choosing a denominator that sidesteps this obligation. **Declared extension for native SERVICE entries (gentle-dove-36, 2026-10-04, extending this operator ruling of 2026-09-16):** a `NativeServeDriver` entry (first consumer the approval broker) is a different denominator from the compiler route, and in it Clock and Network are admitted; Entropy and AuthContext stay out, and the compiler route keeps this ruling whole. No transport is added: the broker's clock is the `extdeps.clock` `Clock` service on the existing shell transport and its outgoing HTTP is a `transport rest` service on the existing REST lowering, so each is admitted as the one handler `bind_operation_transport` already binds. The carrier, both denominators and the emission refusal are `v1.compiler.emit` `NativeEffectRealizationAdmission`, computed by `v1.compiler.emit_rust` `native_entry_effects`, and both native mains bind exactly the handlers it admits."),
       li(text: "**D12 -- Executable composition root and legacy workflow deletion. Ruled 2026-09-17 (operator + side-chat A').** Workflow was never a semantic kind: it was an emitter heuristic (`v1.compiler.emit_rust` `is_workflow_item`, true for `uses` present, a service or resource name in the registry, or a registry miss) whose sole product was the clap subcommands `emit_main_rs` rendered. The census that grounds the ruling: every built binary is single-entry through `compiler_pipeline_entry` and pulls no workflow function into its main; a closure with no entry already renders the typed exit-2 `emit_entry_point_absent_main_rs`; `v1.compiler.infer` gates no resource operation on workflow, since admissibility is the `uses` clause; and the `is_async` signature field had no reader. So deletion breaks no production binary. Entry identity is an artifact-relative RELATION carried by `compiler_pipeline_entry`; a multi-command surface, when one is demanded, is explicit dispatch data as `gunbc.cli_dispatch_surface` models it, not a function kind. The cut deletes `is_workflow_item`, `collect_workflow_funcs`, `WorkflowFunc`, `to_workflow_func`, `validate_workflow_param_defaults`, the `emit_main_rs` workflow arm, the imported-data-reference default folding that only that arm consumed, and the dead `is_async` field; it keeps `compiler_pipeline_entry` and the entry-absent refusal, and leaves `uses` as an effect requirement -- the legacy workflow population is not marked. Enrolled discriminators (`test.claim.entry_authority_witness_test`): adding a `uses` requirement or a service call does not change the entry population, so reintroducing `uses`, a service name or a registry miss as entry identity turns a regression control red; one declared entry is the sole root beside an effect; two declarations and an unmodeled driver each refuse. The witnesses whose subject was folding an imported data reference into a CLI default are deleted with the path, because that folding had no other consumer. This SUPERSEDES the D12-marker / FunctionRole direction and its migration of the legacy workflow population. D13 below refines the remaining `uses`-as-carrier sentence: for transparent bodies the requirement is derived, not authored."),
       li(text: "**D13 -- Derived dependency demand and provider binding. Ruled 2026-09-18 (operator).** This SUPERSEDES the E1b 'add uses to every call chain' migration -- that migration is not run. For a transparent (visible-body) function, dependency demand is DERIVED from resolved dependency and operation references, not authored in the header. Direct demand is produced once by resolution; transitive demand is derived over resolved call relations. The qualified carrier is DependencyDemand (the R1/#11401 derive-once-carry pattern): produced once by resolution, not re-read per backend. Dependency identity includes the logical SUBJECT (`source_tree` is not `output_tree`), not only the interface type. Opaque declarations (no body) carry explicit dependency contracts. Policy (may-not-use-Network, upper bounds) constrains the derived set; it is not an asserted use-list. Composition roots bind demanded subjects to admitted providers. Targets may closure-convert derived demands into explicit params or a typed environment. No source operation reaches an ambient host by name; absent or ambiguous provider is a typed refusal. Existing `uses` rows are classified before migration (USES-0); restating rows are deleted because they are derived, and binder / opaque / policy rows move to their owning carriers. A local `std::fs` impl is admitted as ONE Filesystem provider, not a second source-level operation surface. D13 refines D11's uses-as-carrier: the requirement is DERIVED for transparent bodies, authored only for opaque declarations, distinct subjects, and policy envelopes. USES-0 is the identity-grain join of authored `uses` rows against resolved direct-plus-transitive demand -- not a count equality -- and it decides the split; no `uses` row is added to a call chain and no `uses` row is deleted until that census is dispositioned. The analysis that holds the join is `docs/plans/uses-occurrence-census.md`. E2 shape under this ruling: CLI code references `source_tree.list` / `source_tree.try_read`; resolution binds the `source_tree` SUBJECT; the compiler derives direct and transitive DependencyDemand; the NativeCliDriver root binds LocalFilesystem (impl Filesystem: try_read -> `std::fs::read`, list -> `read_dir`); realization threads it; `std::fs` leaves main; tests bind InMemoryFilesystem. No bare `filesystem_try_read` / `filesystem_list` globals. `emit_file_call` stays renderer machinery reused internally, not the dependency model and not a handler."),
       li(text: join(["**D13 follow-up population.** Cut (c) measured its population, then main added more `uses` rows while it was in flight; those were carried unmeasured until a final-base census over ", demand_restatement_follow_up_commit_range as String, " measured every authored row in the tree and, under the same criterion, deleted each one whose derived demand was nonempty EXCEPT the identities explicitly retained under EditedWitnessHasNoHermeticRoute. None had empty demand, so no function flipped from effectful to pure. What remains is two kinds of row, each named at the row identity USES-0 defined and each carrying the trigger that is true for IT rather than for its module. Rows the criterion cannot type: ordinary fns whose module does not resolve, one refusal probe that never will, and pattern declarations the criterion never ranged over. And rows MEASURED DELETABLE whose deletion is not yet landable: wet witnesses whose edit the floor would plan onto a hermetic route that has no arm for their operation. The retained rows, each with its trigger: ", demand_restatement_retained_row_texts() |> join(separator: "; "), "."], "")),
diff --git a/dag/gunbc/plans/deploy_convergence_observed_side.dag b/dag/gunbc/plans/deploy_convergence_observed_side.dag
index f2719f88b6d..11c8ea58397 100644
--- a/dag/gunbc/plans/deploy_convergence_observed_side.dag
+++ b/dag/gunbc/plans/deploy_convergence_observed_side.dag
@@ -77,7 +77,7 @@ fn deploy_convergence_observed_side_body() -> List<MarkdownBlock> {
 
     h2(text: "RULING: where quiescence belongs, and why neither obvious placement is complete"),
     p(text: "Three placements, and the question was which one -- the answer is that they are three different boundaries and all three are required. **At the OPERATION boundary**, a publication plan must be unconstructible without a guard proving release-consuming actuators are quiesced: the guard is a required field, so an unguarded publication has no constructor rather than being refused by a check. **At the PARENT TRANSACTION boundary**, that same frozen plan must acquire the quiescence, publish, verify, and restore actuation automatically -- because a guard supplied from outside would leave the fleet permanently undeployable (the belt is normally enabled), so someone disables it, retries, and re-enables by hand, which is out-of-band convergence wearing a safety label. **In the STEADY-STATE model**, belt admission must consume a coherent release identity rather than a repository revision."),
-    p(text: "**The objection that made this look like a new ownership claim was wrong, and it was mine.** `BeltTimerUnit` is already a live-deploy OWNED artifact kind -- its upsert installs and enables the unit, its teardown disables and removes it -- so deployment already owns that lifecycle. What changes is not who owns it but that the dependency becomes honest instead of relying on apply-all moving everything fast enough."),
+    p(text: "**The objection that made this look like a new ownership claim was wrong, and it was mine.** `BeltEventPathUnit` is already a live-deploy OWNED artifact kind -- its upsert installs and enables the unit, its teardown disables and removes it -- so deployment already owns that lifecycle. What changes is not who owns it but that the dependency becomes honest instead of relying on apply-all moving everything fast enough."),
     p(text: "**The fourth requirement sits underneath all three: the quiescence authority must span admission THROUGH actuation.** A check performed before a dispatch, followed by an unrelated mutation, is another time-of-check/time-of-use gap -- a tick that passed admission a moment before deploy acquired quiescence still executes during publication. So two mechanisms are needed, not one: a PERSISTENT inhibition that survives process failure, so a deploy that dies after publishing the tree and before restarting the service leaves the belt still refusing and the next converge resumes or rolls back with no operator re-enabling anything; and an EXECUTION LEASE that both sides hold, deploy exclusively from its final pre-mutation observation through read-back, every release-consuming belt path shared from its standing read through operation commitment. A lock that serializes only two deployment runs does not protect against the third actuator."),
     p(text: "**Two live-tree facts pin the shape.** `belt_revision_admission` is reached from exactly two call sites -- the tick and the dispatch path -- which is why it is the right single seam to replace rather than either ingress being the right thing to stop. And `BeltRunState.Paused` is NOT a live host control: production passes `roadmap_belt_default_run_state`, a constant `Running`, with no observed member or actuator changing it, so repurposing that pure planner input as quiescence would be a name borrowed for a mechanism that does not exist."),
     p(text: "The release subject is a BINDING rather than any single identity: binary B executes tree T under contract C. Executable identity alone is insufficient for the same reason revision alone is -- the failure being prevented is a coherent-looking pair of individually-correct facts about different releases."),
diff --git a/dag/gunbc/plans/fail_closed_lockdown.dag b/dag/gunbc/plans/fail_closed_lockdown.dag
index 4887a952a3f..8ae30db5a23 100644
--- a/dag/gunbc/plans/fail_closed_lockdown.dag
+++ b/dag/gunbc/plans/fail_closed_lockdown.dag
@@ -48,7 +48,7 @@ fn fail_closed_lockdown_body() -> List<MarkdownBlock> {
         row(cells: [cell(text: "`v1_interpreter.rs` `dispatch_shell`, `eval_service_call`"), cell(text: "fail-open IO"), cell(text: "`from_utf8_lossy` / `unwrap_or_default` fabricate plausible text from malformed output")]),
       ],
     },
-    p(text: "**Warm==cold coverage is incomplete, not absent everywhere.** `v2.test.long.parse_table_memo_governed_witness` `parse_table_memo_warm_equals_cold_content_hash` covers the parse-table memo, and `resolve_typed_cache_equivalence_test.rs` `typed_module_cache_matches_cold_oracle_in_every_order` covers the typed-module cache. Resolved-graph disk decoding is fail-closed: `resolved_graph_cache.rs` `read_cached_header` rejects malformed header digests directly; `read_cached_file` cannot accept its empty decode sentinel as either the validated subject digest or computed payload digest, witnessed by `resolve_cross_process_cache_test.rs` `poisoned_hit_rejected_on_subject_digest_mismatch`. The provider additionally refuses where it cannot expose a faithful probe (`resolved_graph_cache.rs` `faithful_probe_unavailable_gap`). `pure_call_memo` still lacks a warm==cold oracle, leaving its address-keyed flake surface concrete."),
+    p(text: "**Warm==cold coverage is incomplete, not absent everywhere.** `v2.test.long.parse_table_memo_governed_witness` `parse_table_memo_warm_equals_cold_content_hash` covered the parse-table memo (memo and witness both deleted with the parse memo carrier, operator ruling R2 2026-10-08), and `resolve_typed_cache_equivalence_test.rs` `typed_module_cache_matches_cold_oracle_in_every_order` covers the typed-module cache. Resolved-graph disk decoding is fail-closed: `resolved_graph_cache.rs` `read_cached_header` rejects malformed header digests directly; `read_cached_file` cannot accept its empty decode sentinel as either the validated subject digest or computed payload digest, witnessed by `resolve_cross_process_cache_test.rs` `poisoned_hit_rejected_on_subject_digest_mismatch`. The provider additionally refuses where it cannot expose a faithful probe (`resolved_graph_cache.rs` `faithful_probe_unavailable_gap`). `pure_call_memo` still lacks a warm==cold oracle, leaving its address-keyed flake surface concrete."),
     p(text: "Already fixed (precedent for the pattern): cross-representation `==` straddle (now raises `CrossRepresentationEquality`); strict record-field typecheck (#5293)."),
     h2(text: "3a. How deep does the root go — the remaining audits"),
     p(text: "§1–§3 were the first two passes (lens wiring + fail-open code). They found *symptoms*. The lane needs deeper audits before we trust the fixes are complete, because the symptoms likely share **one root**."),
@@ -58,7 +58,7 @@ fn fail_closed_lockdown_body() -> List<MarkdownBlock> {
       li(text: "**model↔realization fork audit** — ✅ DONE → [model-realization-fork.md](model-realization-fork.md). ROOT CONFIRMED (one seam, ~13 per-site bridges). Two sub-roots: numeric tower (grounds cleanly → guard dead code) + `Value::Null` overload (None/Absent/miss/Violates — needs *splitting*, the deeper root; ~131 legitimate `present==None→false` sites mean it can't be guarded)."),
       li(text: "**coercion/equality fail-closure audit** — the `==` fix landed for the numeric tower; remaining: `Bool True|False` over `Value::Bool`, `Optional/Witness` over the overloaded `Value::Null` sentinel (resists a blanket guard — `present == None` at ~131 sites is a *legitimate* `false`; needs grounding)."),
       li(text: "**inference fail-open audit** — what remains after strict record-field (#5293): return-type inference defaults, other `unwrap_or_default` type fabrications."),
-      li(text: "**cache-purity audit** — enumerate every cache (resolved_graph, parse_table_memo, pure_call_memo, typed_module, sccache); each must have a warm==cold oracle or fail-closed refusal. Coverage exists for typed_module (`resolve_typed_cache_equivalence_test.rs` `typed_module_cache_matches_cold_oracle_in_every_order`) and parse_table_memo (`v2.test.long.parse_table_memo_governed_witness` `parse_table_memo_warm_equals_cold_content_hash`); resolved_graph refuses the unavailable faithful probe (`resolved_graph_cache.rs` `faithful_probe_unavailable_gap`); pure_call_memo remains uncovered."),
+      li(text: "**cache-purity audit** — enumerate every cache (resolved_graph, parse_table_memo (deleted with the parse memo carrier, operator ruling R2 2026-10-08), pure_call_memo, typed_module, sccache); each must have a warm==cold oracle or fail-closed refusal. Coverage exists for typed_module (`resolve_typed_cache_equivalence_test.rs` `typed_module_cache_matches_cold_oracle_in_every_order`) and formerly parse_table_memo (`v2.test.long.parse_table_memo_governed_witness` `parse_table_memo_warm_equals_cold_content_hash`, both since deleted); resolved_graph refuses the unavailable faithful probe (`resolved_graph_cache.rs` `faithful_probe_unavailable_gap`); pure_call_memo remains uncovered."),
       li(text: "**CI-coverage-completeness audit** — tests/gates that *exist but don't run*. Confirmed historical instance: the now-retired Rust monolith gate (`gunbc.commit_workflow` `commit_gate_rust_suite_removed_disposition`; local-only implementation `tools.rust_gates_ci` `run_rust_monolith_gate`) admitted a narrow subset of the `src/v1/tests` corpus — the rest could rot silently (how the Behavior-arm test went stale). Also: the `discrimination` lens (the §5 discriminating-witness enforcer) is itself roster-only, not whole-corpus — the enforcer is vacuous."),
     ]),
     p(text: "The lane is done when these audits return *no new fail-open class* and §4 is green."),
diff --git a/dag/gunbc/plans/m5_fixture_store_consolidation.dag b/dag/gunbc/plans/m5_fixture_store_consolidation.dag
index a84961577bf..337832851b0 100644
--- a/dag/gunbc/plans/m5_fixture_store_consolidation.dag
+++ b/dag/gunbc/plans/m5_fixture_store_consolidation.dag
@@ -62,7 +62,7 @@ fn m5_fixture_store_consolidation_body() -> List<MarkdownBlock> {
       li(text: "`ArtifactIdentity<T> \{ subject_digest: ContentHash, artifact_kind \}` **is** the `(operation, input_hash)` key — `subject_digest = content_hash(inputs)`, one new `artifact_kind = \"hermetic_fixture\"`."),
       li(text: "`CacheLookupResult<T> = Hit\{receipt\} | Miss | RejectedHit\{reason\}` **is** the lookup outcome."),
       li(text: "`CacheRejectReason` already covers most of v1's fail-closed variants (mapping below)."),
-      li(text: "`CacheInterfaceFacts` (locality / key_derivation / lookup·write·miss semantics / eviction / `content_verified_on_read`) **is** the per-handler descriptor — exactly the shape `parse_table_memo.dag` and `resolved_graph.dag` already cite in `extdeps/realization/`."),
+      li(text: "`CacheInterfaceFacts` (locality / key_derivation / lookup·write·miss semantics / eviction / `content_verified_on_read`) **is** the per-handler descriptor — exactly the shape `parse_table_memo.dag` (since deleted with the parse memo carrier, operator ruling R2 2026-10-08) and `resolved_graph.dag` already cite in `extdeps/realization/`."),
     ]),
     p(text: "So the fixture store is a *missing pair of `CacheInterfaceFacts` rows + a shared lookup fold*, not new vocabulary. This spike lands the rows; §5 escalates the fold."),
     h3(text: "Fail-closed reason mapping (the §5 win)"),
@@ -110,7 +110,7 @@ fn m5_fixture_store_consolidation_body() -> List<MarkdownBlock> {
     p(text: "These three gaps are the model work the load-bearing follow-up adds to `std.cache_interface` **before** the folds are rewired (so the rewire never has to fall back to a stringly error)."),
     h2(text: "3. What this spike lands (NON-load-bearing — additive only)"),
     ol(items: [
-      li(text: "`dag/extdeps/realization/hermetic_fixture.dag` — the two cited `CacheInterfaceCatalogFacts` rows (`hermetic_fixture_file_facts`, `hermetic_fixture_in_process_facts`), parallel to `parse_table_memo.dag` / `resolved_graph.dag`. They describe each handler **as it is today** — the fork shows up as a key_derivation divergence (`ContentAddressedByValue` + `content_verified_on_read` vs `HandAuthoredString` + not)."),
+      li(text: "`dag/extdeps/realization/hermetic_fixture.dag` — the two cited `CacheInterfaceCatalogFacts` rows (`hermetic_fixture_file_facts`, `hermetic_fixture_in_process_facts`), parallel to `parse_table_memo.dag` (since deleted) / `resolved_graph.dag`. They describe each handler **as it is today** — the fork shows up as a key_derivation divergence (`ContentAddressedByValue` + `content_verified_on_read` vs `HandAuthoredString` + not)."),
       li(text: "`dag/std/cache_identity.dag` — one additive `hermetic_fixture_artifact_kind` data decl (the shared artifact-kind both handlers realize). No fold touched (the only `match` over `CacheInterfaceProduct` is untouched)."),
       li_blocks(blocks: [
         p(text: "`dag/test/claim/hermetic_fixture_realization_test.dag` — executing witness:"),
diff --git a/dag/gunbc/plans/model_realization_fork.dag b/dag/gunbc/plans/model_realization_fork.dag
index b8358fc197c..1874e390dc4 100644
--- a/dag/gunbc/plans/model_realization_fork.dag
+++ b/dag/gunbc/plans/model_realization_fork.dag
@@ -35,7 +35,7 @@ fn model_realization_fork_body() -> List<MarkdownBlock> {
         row(cells: [cell(text: "`eval_binop` Eq/Ne guard"), cell(text: "`:1910-1922`"), cell(text: "**FAIL-CLOSED** (raises `CrossRepresentationEquality` on numeric straddle) — landed")]),
         row(cells: [cell(text: "`pattern_matches`"), cell(text: "`:2276-2563`"), cell(text: "RECONCILED (explicit per-variant arms)")]),
         row(cells: [cell(text: "`value_hash` / `CanonKey::new`"), cell(text: "`:344` / `:309`"), cell(text: "RECONCILED / FAIL-CLOSED (reflexivity check rejects non-reflexive)")]),
-        row(cells: [cell(text: "`parse_table_memo` / `pure_call_memo` / `resolved_graph_cache`"), cell(text: "(see lock-down §3)"), cell(text: "reconciled-with-caveat → the under-keyed / lossy cache holes are this seam at the cache layer")]),
+        row(cells: [cell(text: "`parse_table_memo` (deleted with the parse memo carrier, operator ruling R2 2026-10-08) / `pure_call_memo` / `resolved_graph_cache`"), cell(text: "(see lock-down §3)"), cell(text: "reconciled-with-caveat → the under-keyed / lossy cache holes are this seam at the cache layer")]),
       ],
     },
     p(text: "`FreeMonoid` is the proof that compositional reconciliation is *possible* (one flatten, all ops). Every other primitive is per-site."),
diff --git a/dag/gunbc/plans/realization_measurement_loop.dag b/dag/gunbc/plans/realization_measurement_loop.dag
index bd6f0b89a15..d249be6c10d 100644
--- a/dag/gunbc/plans/realization_measurement_loop.dag
+++ b/dag/gunbc/plans/realization_measurement_loop.dag
@@ -131,7 +131,7 @@ fn realization_measurement_loop_body() -> List<MarkdownBlock> {
     ul(items: [
       li(text: "**F1** scheduler gives heavy nodes the budgeted width — *#5421 merged* (= Phase 1 width landing)."),
       li(text: "**F2/F3** key-completeness lens (`ToolchainChange ∈ triggers ⟹ input ∈ inputs_considered`) + `resolved_graph` keyed by construction — *#5423, in review* (= the Phase 2 key-derivation axis, spec-level)."),
-      li(text: "**P1 — honest keys, verified by execution** *(deps F2,F3)*: realizer-key lens (executed digest ⊇ declared `inputs_considered`, RED otherwise — would have caught the `from_utf8_lossy` collision); stable transform-id (reproducible source/commit/tree hash, not binary bytes); census parity for `parse_table_memo`. (= Phase 2 \"converge key derivations\".)"),
+      li(text: "**P1 — honest keys, verified by execution** *(deps F2,F3)*: realizer-key lens (executed digest ⊇ declared `inputs_considered`, RED otherwise — would have caught the `from_utf8_lossy` collision); stable transform-id (reproducible source/commit/tree hash, not binary bytes); census parity for `parse_table_memo` (since deleted with the parse memo carrier, operator ruling R2 2026-10-08). (= Phase 2 \"converge key derivations\".)"),
       li(text: "**P2 — one door: caching by inhabitance** *(deps P1)*: `realize(subject)` as the sole API; eliminate raw bypass (`build_multi_entry_index`, hand-rolled `ParseTable` HashMap → inhabited via `realize`, DESIGN §6's own example). (= Phase 2 one-kernel/N-backends.)"),
       li(text: "**P3 — reach → layer + completeness fail-closed** *(deps P2)* — **the core ask / the acceptance gate**: reach analysis lens (consumer set + boundary → minimal sufficient `Placement`); completeness gate (subject realized below reach → ERROR; non-redundant transform with no supplier at reach → ERROR — **land the redundancy-only cut first**, cost half waits on §4); supplier provisioning + typed request."),
       li(text: "**P4 — economic tier** *(deps Phase 0 measurement)*: per-transform measured cost (`PerformanceReceipt` → cost-aware reach); `Materialization` = `Recompute | Memoize | Share` chosen by measured cost."),
diff --git a/dag/gunbc/plans/shell_emission_model.dag b/dag/gunbc/plans/shell_emission_model.dag
index 572f63e845f..25c7985e9c8 100644
--- a/dag/gunbc/plans/shell_emission_model.dag
+++ b/dag/gunbc/plans/shell_emission_model.dag
@@ -48,7 +48,7 @@ fn shell_emission_model_body() -> List<MarkdownBlock> {
       li(text: "**Slice 4 — tail consumers (pre-runtime residue):** `bmc_token_federation` (two `Do\{Run\}` rows — slice-0 machinery suffices) → `ci_workflow` inline `RunStep`s (case/`uname` → model as `TargetArchitecture`; cross-link ROADMAP §1 `1-inline-shell-defork`) → githooks as a **thin shim** (ensure-built + exec `claim_batch --pre-push` with stdin passed through; the case-rosters/arrays/while-read stdin parse move into the binary)."),
     ]),
     h2(text: "6. Sidecar dissolution (parallel)"),
-    p(text: "**LANDED (#6831, Phase 0):** `dag/extdeps/languages/bash/program.dag` (`ShellProgram`/`serialize_bash`) deleted; the vacuous bash-program importer-count ratchet is pruned with it (resolve fails before the ratchet could fire). Remaining arc work is intent-layer shell→`emit(intent, Bash)` migration (Categories A–C in [shell-intent-emit-realization-design.md](shell-intent-emit-realization-design.md)), not sidecar restoration. **Phase 1 PARTIAL (#6832; corrected 2026-07-27, verified against main — was LANDED, which forked against DESIGN):** `While` emit landed and has exactly one production consumer, `ci_floor_peak_emit`. **The 'cond and body are still raw shell strings' clause was true when written and is now STALE, corrected 2026-09-05 against `origin/main` @ `70925ee89e`:** `ci_floor_peak_while_cond_command` and `ci_floor_peak_while_body_command` no longer spell bash. Each calls `bash_nearest_ancestor_locate_cond_command` / `_body_command` (`v2.extdeps.languages.bash_orch_if`) over a typed `ci_floor_peak_nearest_ancestor_spec: NearestAncestorContaining` (`std.path_intent`), with a located refusal arm (`ci_floor_peak_path_model_refused_poison`) on the empty return rather than a widened default. The third leaf the earlier text counted as separately owed, `ci_floor_peak_assign_cgroup_dir_command`, landed typed in the same vertical: it composes `v2.extdeps.languages.bash_proc_self_cgroup` unified-hierarchy membership with that path policy, procfs path grounded on `extdeps.linux.procfs` `ProcSelfCgroup`. Introduced by `ecbd0863c2a` (#7978, 'shell -> dag Phase 1 cgroup vertical', 2026-08-08), confirmed an ancestor of `origin/main`; `git log -S` on both `bash_nearest_ancestor_locate_cond_command` and `ci_floor_peak_nearest_ancestor_spec`, scoped to that file, returns exactly that commit as first introduction. `v2.workflow.orchestration_while_emit_test` records the same from the emitter side: nothing in `ci_floor_peak_emit` spells the loop's bytes any more; `BoundedPoll` had ZERO production construction sites and was DELETED (2026-08-07, Node-tree constructor census). #7303 made `Retry` fail closed for multi-step bodies, present redirect/capture, changed template log sources, and three-or-more (N-level) escalation shapes. #7318 additionally refuses every nonempty source `Run.env` while preserving empty-env emission bytes, proven by executing nonempty-refusal and empty-env accepted controls. **WHAT PHASE 1 NOW COVERS, and what it does NOT — stated together so deleting the stale claim is not read as completion.** Covered: `While` emit itself, both ascent leaves, and the cgroup-membership assign leaf, all derived from typed `std.path_intent` / `extdeps.linux.proc_self_cgroup` models rather than authored text. NOT covered, and carried forward as Phase 2 (typed filesystem observation through `host_effect_apply`): the peak calibration leaves on the same pipeline — `ci_floor_peak_test_f_memory_peak_command`, `ci_floor_peak_echo_reset_redirect_command`, `ci_floor_peak_pre_reset_ok_command`, `ci_floor_peak_pre_reset_unsupported_command`, `ci_floor_peak_pre_unavailable_command`, `ci_floor_peak_post_ok_command`, `ci_floor_peak_post_unavailable_command` — plus the foreign-executor runtime-scan transport in `bash_membership_assign_from_source`. Those are raw `String` `Run.command` values today and `ci_floor_peak_emit` declares them as Phase 2 in its own residue rows. Also still open, unchanged by #7978: `Run.command` remains String-typed, so every derived leaf still flows through an untyped seam, and the need-driven adoption-or-explicit-narrowing decision for the modeled scope is undecided; the `BoundedPoll` half of that scope question is resolved by deletion. See `roadmap_authority.dag` `6-shell-intent-phase1` for the matching acceptance criteria."),
+    p(text: "**LANDED (#6831, Phase 0):** `dag/extdeps/languages/bash/program.dag` (`ShellProgram`/`serialize_bash`) deleted; the vacuous bash-program importer-count ratchet is pruned with it (resolve fails before the ratchet could fire). Remaining arc work is intent-layer shell→`emit(intent, Bash)` migration (Categories A–C in [shell-intent-emit-realization-design.md](shell-intent-emit-realization-design.md)), not sidecar restoration. **Phase 1 PARTIAL (#6832; corrected 2026-07-27, verified against main — was LANDED, which forked against DESIGN):** `While` emit landed and has exactly one production consumer, `ci_floor_peak_emit`. **The 'cond and body are still raw shell strings' clause was true when written and is now STALE, corrected 2026-09-05 against `origin/main` @ `70925ee89e`:** `ci_floor_peak_while_cond_command` and `ci_floor_peak_while_body_command` no longer spell bash. Each calls `bash_nearest_ancestor_locate_cond_command` / `_body_command` (`v2.extdeps.languages.bash_orch_if`) over a typed `ci_floor_peak_nearest_ancestor_spec: NearestAncestorContaining` (`std.path_intent`), whose refusal is located at the producer (`v2.extdeps.languages.bash_orch_if` `bash_orch_if_leaf_text` names the refusing symbol and its reasons in a marker that is not valid shell) rather than a widened default. The third leaf the earlier text counted as separately owed, `ci_floor_peak_assign_cgroup_dir_command`, landed typed in the same vertical: it composes `v2.extdeps.languages.bash_proc_self_cgroup` unified-hierarchy membership with that path policy, procfs path grounded on `extdeps.linux.procfs` `ProcSelfCgroup`. Introduced by `ecbd0863c2a` (#7978, 'shell -> dag Phase 1 cgroup vertical', 2026-08-08), confirmed an ancestor of `origin/main`; `git log -S` on both `bash_nearest_ancestor_locate_cond_command` and `ci_floor_peak_nearest_ancestor_spec`, scoped to that file, returns exactly that commit as first introduction. `v2.workflow.orchestration_while_emit_test` records the same from the emitter side: nothing in `ci_floor_peak_emit` spells the loop's bytes any more; `BoundedPoll` had ZERO production construction sites and was DELETED (2026-08-07, Node-tree constructor census). #7303 made `Retry` fail closed for multi-step bodies, present redirect/capture, changed template log sources, and three-or-more (N-level) escalation shapes. #7318 additionally refuses every nonempty source `Run.env` while preserving empty-env emission bytes, proven by executing nonempty-refusal and empty-env accepted controls. **WHAT PHASE 1 NOW COVERS, and what it does NOT — stated together so deleting the stale claim is not read as completion.** Covered: `While` emit itself, both ascent leaves, and the cgroup-membership assign leaf, all derived from typed `std.path_intent` / `extdeps.linux.proc_self_cgroup` models rather than authored text. NOT covered, and carried forward as Phase 2 (typed filesystem observation through `host_effect_apply`): the peak calibration leaves on the same pipeline — `ci_floor_peak_test_f_memory_peak_command`, `ci_floor_peak_echo_reset_redirect_command`, `ci_floor_peak_pre_reset_ok_command`, `ci_floor_peak_pre_reset_unsupported_command`, `ci_floor_peak_pre_unavailable_command`, `ci_floor_peak_post_ok_command`, `ci_floor_peak_post_unavailable_command` — plus the foreign-executor runtime-scan transport in `bash_membership_assign_from_source`. Those are raw `String` `Run.command` values today and `ci_floor_peak_emit` declares them as Phase 2 in its own residue rows. Also still open, unchanged by #7978: `Run.command` remains String-typed, so every derived leaf still flows through an untyped seam, and the need-driven adoption-or-explicit-narrowing decision for the modeled scope is undecided; the `BoundedPoll` half of that scope question is resolved by deletion. See `roadmap_authority.dag` `6-shell-intent-phase1` for the matching acceptance criteria."),
     p(text: "Tracked in [emission-ingestion-inverse.md](emission-ingestion-inverse.md) / `emission_ingestion_inverse.dag` — **cross-link only, do not duplicate** the roster here."),
     h2(text: "7. Named residue / dissolution triggers"),
     ul(items: [
diff --git a/dag/gunbc/primitive_egress/dispositions_collection.dag b/dag/gunbc/primitive_egress/dispositions_collection.dag
index 7e69d288f11..408bf3a7f9f 100644
--- a/dag/gunbc/primitive_egress/dispositions_collection.dag
+++ b/dag/gunbc/primitive_egress/dispositions_collection.dag
@@ -66,8 +66,6 @@ fn dispositions_collection_rows() -> List<PrimitiveEvidence> {
     evidence_row(name: "append", category: CollectionKernel, external_subject: NoExternalSubject, computation: computes(authority: declared_authority(module_path: "std.algebra", decl_name: "free_monoid_collection_templates"), inputs: "xs: FreeMonoid<T>, x: T (template) -- or xs, ys (contract and method arm)", result: "disputed between xs with x appended and xs ++ ys", body: DagBodyRequired), refusals: RefusalsTyped, realization: NoNativeRealizationClaim, compiler_query: NotACompilerQuery, conflict: surfaces_disagree(detail: "append names ELEMENT PUSH on the algebra template ([ReceiverSelf, ReceiverElement]) and the free_call.list_push arm, but CONCATENATION on the method_call.concat arm (concat | append | push) and the append_contract (work m, output n+m); the same (method, append) spelling has two meanings on two surfaces"), located: "std.algebra free_monoid_collection_templates append; gunbc.v1_interpreter_primitive_surface free_call.list_push and method_call.concat; std.primitives append_contract; rt row append", next: "split the spelling: rename the concat-meaning method spelling or delete it, so append joins list_push everywhere"),
     evidence_row(name: "coproduct_nullary_inhabitants", category: LanguageKernel, external_subject: NoExternalSubject, computation: computation_unestablished(detail: "enumerates the nullary variants of a coproduct type by name: reflection over the compiled type graph carried on a v4 bridge arm with no registry row, contract or template, so neither a modeled-input contract nor a compiler-product subject is established"), refusals: RefusalsNotApplicable, realization: NoNativeRealizationClaim, compiler_query: NotACompilerQuery, conflict: NoMeaningConflict, located: "gunbc.v1_interpreter_primitive_surface v4_bridge arm coproduct_nullary_inhabitants; realized by coproduct_reflection::eval_coproduct_nullary_inhabitants", next: "SEED-QUERY-0 rules whether type-variant enumeration is a compiler query (over the accepted type product) or a std.node operation"),
     evidence_row(name: "qualified_name_from_dotted_string", category: LanguageKernel, external_subject: NoExternalSubject, computation: computes(authority: declared_authority(module_path: "v2.std.qualified_name", decl_name: "qualified_name_from_dotted_string"), inputs: "s: String", result: "QualifiedName; total", body: body_at(module_path: "v2.std.qualified_name", decl_name: "qualified_name_from_dotted_string")), refusals: RefusalsTyped, realization: NoNativeRealizationClaim, compiler_query: NotACompilerQuery, conflict: surfaces_disagree(detail: "v2.std.qualified_name declares qualified_name_from_dotted_string with a real body AND the interpreter carries a v4 bridge arm of the same name that intercepts it: two realizations for one spelling with no projection-roster row saying they are one authority"), located: "src/v2/std/qualified_name.dag declaration; gunbc.v1_interpreter_primitive_surface v4_bridge.qualified_name_from_dotted_string", next: "a std.primitive_projection row (ModeledProjection or Divergent) for the declaration, then the bridge arm is deleted or the body is"),
-    evidence_row(name: "parse_table_insert", category: CollectionKernel, external_subject: NoExternalSubject, computation: computation_unestablished(detail: "parse_table_insert/parse_table_lookup are the v2 parser memo carrier realized by try_parse_table_memo_dispatch: a mutable memo keyed on parser state, which is neither a modeled collection operation nor a declared host effect"), refusals: RefusalsNotApplicable, realization: NoNativeRealizationClaim, compiler_query: NotACompilerQuery, conflict: NoMeaningConflict, located: "gunbc.v1_interpreter_primitive_surface TryParseTableMemoDispatchSite rows; no registry row, contract, template or bridge", next: "the v2 prepared-choice plan (gunbc#11422) replaces the per-token memo; then both arms delete, else COLLECTION-KERNEL-0 models the memo as a persistent map"),
-    evidence_row(name: "parse_table_lookup", category: CollectionKernel, external_subject: NoExternalSubject, computation: computation_unestablished(detail: "the read half of the parse-table memo; see parse_table_insert"), refusals: RefusalsNotApplicable, realization: NoNativeRealizationClaim, compiler_query: NotACompilerQuery, conflict: NoMeaningConflict, located: "TryParseTableMemoDispatchSite row parse_table_lookup", next: "same as parse_table_insert"),
     evidence_row(name: "index_by", category: CollectionKernel, external_subject: NoExternalSubject, computation: computes(authority: authority_required(home: "std.algebra finitely_supported_function_templates: index_by has a contract row (index_by_contract), an rt bridge (rc_index_by) and a v4 bridge arm, but NO algebra template and NO registry row -- there is no resolver-readable signature (primitive_index_by_definition is SignatureUngrounded)"), inputs: "xs: FreeMonoid<T>, key: fn(T) -> K", result: "Map<K, T> keyed by key, last-wins; total", body: DagBodyRequired), refusals: RefusalsTyped, realization: NoNativeRealizationClaim, compiler_query: NotACompilerQuery, conflict: NoMeaningConflict, located: "index_by: the realization surfaces the census joins (registry row / contract row / algebra template / rt bridge / interpreter arm as present) and the authority named in the computation standing", next: "the owning lane lands the .dag body under the declared authority and switches one production consumer; the interpreter arm and bridge then delete for that consumer"),
   ]
 }
diff --git a/dag/gunbc/product/altra_motherboard/placement.dag b/dag/gunbc/product/altra_motherboard/placement.dag
index 4467354d3c7..790ec59eb24 100644
--- a/dag/gunbc/product/altra_motherboard/placement.dag
+++ b/dag/gunbc/product/altra_motherboard/placement.dag
@@ -1,7 +1,7 @@
 module product.altra_motherboard.placement
 
 import std.types { String, Bool, NonEmptyStr, List }
-import std.integer { Int }
+import std.integer { Int, int_to_decimal_string }
 import std.decl_ref { DeclarationRef, declaration_ref_eq, decl_ref }
 import std.coordinate_frame { CoordinateFrameIdentity, coordinate_frame_identity }
 import std.affine_space { Point2, point2 }
@@ -748,7 +748,7 @@ fn memory_slot_obligations(d: AltraMinimalMotherboard) -> List<PlannedComponent>
     let pos = dimm_slot_position_ordinal(p: s.position)
     concat(acc, [obligation(
       g: NeedsSomeoneToFindTheDocument { what_is_missing: "a selected part for the MemoryModuleSlot role; no vendor has been chosen, so there is no mechanical drawing to read a body envelope from" },
-      id: "dimm_ddr{ch}_slot{pos}",
+      id: "dimm_ddr{int_to_decimal_string(value: ch)}_slot{int_to_decimal_string(value: pos)}",
       r: MemoryModuleSlot { slot: s },
       x: 150000 + (pos * 14000),
       y: 20000 + (ch * 12000)
diff --git a/dag/gunbc/product/capacity/pool.dag b/dag/gunbc/product/capacity/pool.dag
index ca90795298f..a0197d034cf 100644
--- a/dag/gunbc/product/capacity/pool.dag
+++ b/dag/gunbc/product/capacity/pool.dag
@@ -384,7 +384,13 @@ fn lapse_pass<Q, S>(pool: Pool<Q, S>, at: EpochSecs) -> LapsePass<Q, S> {
 // reference that names the reading, for the rest of the window, so the fold shows it and a later
 // reading can supersede it. A reading that says more remains changes nothing: the ledger's
 // outstanding leases are the thing the upstream cannot see.
-fn observe_upstream_remaining<Q, S>(pool: Pool<Q, S>, remaining: Measure<Q, S, Nat>, at: EpochSecs, term_seconds: Nat) -> PoolOutcome<Q, S> {
+//
+// THE READING IS NAMED BY ITS OWN IDENTITY, NOT BY ITS SECOND. The hold's reference was
+// "upstream-observation@<instant>", so two decreasing readings in one second minted the same
+// reference and the second was a duplicate the fold refused -- making the whole partition
+// unfoldable on replay. The caller now supplies the reading's identity: at replay that is the
+// event's own id (product.capacity.pool_events pool_apply_event), which is unique by construction.
+fn observe_upstream_remaining<Q, S>(pool: Pool<Q, S>, remaining: Measure<Q, S, Nat>, at: EpochSecs, term_seconds: Nat, reading: NonEmptyStr) -> PoolOutcome<Q, S> {
   match pool_reading_at(pool: pool, at: at) {
     PoolReadingRefused { at: t, anchor: a } => PoolRefused { refusal: PoolInstantBeforeAnchor { anchor: a, at: t } }
     PoolRead { committed: _, ceiling: _, headroom: h, over_committed: _ } =>
@@ -393,7 +399,7 @@ fn observe_upstream_remaining<Q, S>(pool: Pool<Q, S>, remaining: Measure<Q, S, N
       } else {
         pool_acquire(
           pool: pool,
-          reference: join(["upstream-observation@", to_string(at)], "") as NonEmptyStr,
+          reference: join(["upstream-observation@", reading as String], "") as NonEmptyStr,
           amount: Measure { count: h.count - remaining.count },
           at: at,
           term_seconds: term_seconds,
diff --git a/dag/gunbc/product/capacity/pool_events.dag b/dag/gunbc/product/capacity/pool_events.dag
index 90d7730b1f5..966b2f34238 100644
--- a/dag/gunbc/product/capacity/pool_events.dag
+++ b/dag/gunbc/product/capacity/pool_events.dag
@@ -135,13 +135,22 @@ fn pool_event_decode(text: String) -> EventDecode<PoolEvent> {
 }
 
 fn pool_apply_event<Q, S>(pool: Pool<Q, S>, env: ChainEnvelope<PoolEvent>) -> PoolOutcome<Q, S> {
-  let at = env.event.recorded_at
-  match env.event.payload {
+  pool_apply_payload(pool: pool, payload: env.event.payload, at: env.event.recorded_at, identity: env.id as String as NonEmptyStr)
+}
+
+// THE ONE TRANSITION FUNCTION, shared by replay and by validation before an append
+// (gunbc.fabric_event_log fabric_pool_transition). An event that would be refused here on replay is
+// refused there before it is written, because both ask this function: a carrier that appended without
+// asking it could commit a transition no later fold can apply, which makes the whole partition
+// unfoldable. The identity names the event -- its id at replay, the head it was decided against
+// before append -- and is what a transition that mints its own hold (an upstream reading) is keyed by.
+fn pool_apply_payload<Q, S>(pool: Pool<Q, S>, payload: PoolEvent, at: EpochSecs, identity: NonEmptyStr) -> PoolOutcome<Q, S> {
+  match payload {
     PoolAcquired { reference: r, amount: a, term_seconds: t } => pool_replay_acquire(pool: pool, reference: r, amount: Measure { count: a }, at: at, term_seconds: t)
     PoolSettled { reference: r, actual: a } => pool_settle(pool: pool, reference: r, actual: Measure { count: a }, at: at)
     PoolReleased { reference: r, reason: why } => pool_release(pool: pool, reference: r, reason: why, at: at)
     PoolLapsed => PoolAdvanced { pool: lapse_pass(pool: pool, at: at).pool }
-    PoolUpstreamObserved { remaining: n, term_seconds: t } => observe_upstream_remaining(pool: pool, remaining: Measure { count: n }, at: at, term_seconds: t)
+    PoolUpstreamObserved { remaining: n, term_seconds: t } => observe_upstream_remaining(pool: pool, remaining: Measure { count: n }, at: at, term_seconds: t, reading: identity)
     PoolResetObserved { reset_at: r } => PoolAdvanced { pool: pool_reanchor(pool: pool, reset_at: r) }
   }
 }
diff --git a/dag/gunbc/product/cooling_qualification.dag b/dag/gunbc/product/cooling_qualification.dag
index 8645048c60e..20d8b32bdc4 100644
--- a/dag/gunbc/product/cooling_qualification.dag
+++ b/dag/gunbc/product/cooling_qualification.dag
@@ -1,12 +1,12 @@
 module product.cooling_qualification
 
+import extdeps.board_authority { BoardAuthorityRef }
 import std.types { Bool, List, String, Int }
 import std.measure { Watt, measure_le }
 import product.placement_supply { PhysicalAssetIdentity }
 import product.host_identity { HostIdentity }
 import extdeps.cooling.types { CpuCoolerCatalogRow }
 import extdeps.cpu.types { CpuModelCatalogRow, ProcessorCoolingMount, cooling_mount_eq }
-import extdeps.boards.types { BaseboardModel }
 
 // A CPU cooler is the heat-pickup realization of an installed processor. WHICH cooler is
 // installed on which host is a fleet fact (gunbc.fleet_physical_inventory); whether that
@@ -31,7 +31,7 @@ type InstalledCoolingRealization {
   cooler_asset: PhysicalAssetIdentity
   cooler: CpuCoolerCatalogRow
   processor: CpuModelCatalogRow
-  baseboard_model: BaseboardModel
+  baseboard_model: BoardAuthorityRef
 }
 
 type CoolingCatalogRefusalCause
@@ -40,7 +40,7 @@ type CoolingCatalogRefusalCause
       processor_mount: ProcessorCoolingMount
     }
   | BaseboardNotInCoolerSupportedPopulation {
-      baseboard_model: BaseboardModel
+      baseboard_model: BoardAuthorityRef
     }
   | CoolerDesignPowerBelowProcessorTdp {
       cooler_max_design_power: Watt
@@ -65,8 +65,8 @@ type CoolingCatalogVerdict
     }
 
 fn cooler_supports_baseboard(
-  supported: List<BaseboardModel>,
-  baseboard_model: BaseboardModel,
+  supported: List<BoardAuthorityRef>,
+  baseboard_model: BoardAuthorityRef,
 ) -> Bool {
   if supported.length() == 0 {
     false
diff --git a/dag/gunbc/product/spatial_dimension.dag b/dag/gunbc/product/spatial_dimension.dag
index ab12eac843c..af06cff9878 100644
--- a/dag/gunbc/product/spatial_dimension.dag
+++ b/dag/gunbc/product/spatial_dimension.dag
@@ -1,7 +1,7 @@
 module product.spatial_dimension
 
 import std.types { Bool, NonEmptyStr, brand }
-import std.nat { Nat }
+import std.nat { Nat, nat_to_decimal_string }
 import std.measure { Millimeter, millimeter_count }
 import std.interval {
   OrderedClosedInterval,
@@ -148,12 +148,12 @@ fn render_wire(dimension: RoomDimensionKnowledge) -> String {
   let style = render_style_wire(style: render_style(rendering: rendering))
   match rendering {
     RenderMeasured { value: v, uncertainty: _ } =>
-      "<line class={style} data-mm={millimeter_count(m: v)}/>"
+      "<line class={style} data-mm={nat_to_decimal_string(value: millimeter_count(m: v))}/>"
     RenderEstimated { region: r } =>
-      "<band class={style} data-low={millimeter_count(m: interval_low(interval: r))} data-high={millimeter_count(m: interval_high(interval: r))}/>"
+      "<band class={style} data-low={nat_to_decimal_string(value: millimeter_count(m: interval_low(interval: r)))} data-high={nat_to_decimal_string(value: millimeter_count(m: interval_high(interval: r)))}/>"
     RenderHypothesis { value: v, purpose: _ } =>
-      "<line class={style} data-mm={millimeter_count(m: v)}/>"
+      "<line class={style} data-mm={nat_to_decimal_string(value: millimeter_count(m: v))}/>"
     RenderUnknown { obligation: o } =>
-      "<obligation class={style} data-survey={o as String}/>"
+      concat("<obligation class=", concat(style, concat(" data-survey=", concat(o as String, "/>"))))
   }
 }
diff --git a/dag/gunbc/provider_standing_probe_bridge.dag b/dag/gunbc/provider_standing_probe_bridge.dag
index a198f42a724..7d6057eac37 100644
--- a/dag/gunbc/provider_standing_probe_bridge.dag
+++ b/dag/gunbc/provider_standing_probe_bridge.dag
@@ -43,6 +43,7 @@ import gunbc.provider_standing {
 }
 import gunbc.codex_app_server_press {
   CodexAccountStandingReceipt,
+  CodexAccountStandingEvidence,
   AmbientCodexCredentialContext,
   CodexRateLimitBucketVerdict,
   CodexBucketCapacityAvailable,
@@ -366,17 +367,38 @@ data codex_press_standing_bundle_tool_environment_unobserved_reason: NonEmptyStr
 fn provider_standing_bundle_from_codex_press_receipt(
   receipt: CodexAccountStandingReceipt,
 ) -> ProviderStandingBundle {
-  ProviderStandingBundle {
+  provider_standing_bundle_from_codex_account_evidence(
+    evidence: receipt.standing.evidence,
+    credential: receipt.subject.credential,
     installation: provider_standing_bundle_unobserved_installation(
       reason: codex_press_standing_bundle_installation_unobserved_reason,
     ),
-    authentication: provider_authentication_from_codex_press_receipt(receipt: receipt),
-    entitlement: provider_entitlement_from_codex_press_receipt(receipt: receipt),
-    limits: provider_limit_observations_from_codex_press_receipt(receipt: receipt),
-    turn: TurnNotStarted,
     tool_environment: provider_standing_bundle_unobserved_tool_environment(
       reason: codex_press_standing_bundle_tool_environment_unobserved_reason,
     ),
+  )
+}
+
+// THE ACCOUNT TRIP'S EVIDENCE AS A STANDING, for a caller that ran the trip itself and so knows the
+// two axes the receipt bridge cannot: whether the executable ran (installation) and whether the
+// spawn's environment was admitted (tool environment). The receipt bridge above is this with both
+// unobserved; the authentication, entitlement and limit projections are the same functions.
+fn provider_standing_bundle_from_codex_account_evidence(
+  evidence: CodexAccountStandingEvidence,
+  credential: AmbientCodexCredentialContext,
+  installation: ProviderInstallationStanding,
+  tool_environment: ProviderToolEnvironmentStanding,
+) -> ProviderStandingBundle {
+  ProviderStandingBundle {
+    installation: installation,
+    authentication: provider_authentication_from_codex_credential_liveness(liveness: evidence.credential_liveness),
+    entitlement: provider_entitlement_from_codex_realm(realm: evidence.account_realm),
+    limits: provider_limit_observations_from_codex_buckets(
+      credential: codex_press_credential_identity(credential: credential),
+      buckets: evidence.rate_limit_buckets,
+    ),
+    turn: TurnNotStarted,
+    tool_environment: tool_environment,
   }
 }
 
diff --git a/dag/gunbc/public_workload_census.dag b/dag/gunbc/public_workload_census.dag
index 19d698ca403..ec11c28ce47 100644
--- a/dag/gunbc/public_workload_census.dag
+++ b/dag/gunbc/public_workload_census.dag
@@ -1020,6 +1020,8 @@ data candidate_biome_test: WorkloadCandidate = WorkloadCandidate {
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["depot-ubuntu-24.04-arm-16"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:03:32Z" },
       completed_at: Present { value: "2026-09-04T16:08:13Z" },
@@ -1082,6 +1084,8 @@ data candidate_pdns_dnsdist_arm: WorkloadCandidate = WorkloadCandidate {
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["ubuntu-24.04-arm"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T09:57:28Z" },
       completed_at: Present { value: "2026-09-04T10:07:09Z" },
@@ -1149,6 +1153,8 @@ data candidate_openobserve_arm_build: WorkloadCandidate = WorkloadCandidate {
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["ubicloud-standard-16-arm"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-01T10:02:21Z" },
       completed_at: Present { value: "2026-09-01T10:27:44Z" },
@@ -1218,6 +1224,8 @@ data candidate_openobserve_amd64: WorkloadCandidate = WorkloadCandidate {
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["ubicloud-standard-8"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-01T10:02:15Z" },
       completed_at: Absent,
@@ -1271,6 +1279,8 @@ data candidate_openobserve_manifest: WorkloadCandidate = WorkloadCandidate {
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["ubicloud-standard-16-arm"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-01T10:28:12Z" },
       completed_at: Absent,
@@ -1324,6 +1334,8 @@ data candidate_biome_test_windows: WorkloadCandidate = WorkloadCandidate {
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["depot-windows-2022-16"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:03:31Z" },
       completed_at: Present { value: "2026-09-04T16:13:50Z" },
@@ -1371,6 +1383,8 @@ data candidate_biome_test_macos: WorkloadCandidate = WorkloadCandidate {
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["depot-macos-latest"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:08:06Z" },
       completed_at: Absent,
@@ -1416,6 +1430,8 @@ data candidate_openobserve_summary: WorkloadCandidate = WorkloadCandidate {
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["ubuntu-latest"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-01T10:29:11Z" },
       completed_at: Absent,
diff --git a/dag/gunbc/recurring_failure_mode/a_binding_position_recorded_as_a_declaring_identity.dag b/dag/gunbc/recurring_failure_mode/a_binding_position_recorded_as_a_declaring_identity.dag
index 9829fd077eb..7e5258bafd5 100644
--- a/dag/gunbc/recurring_failure_mode/a_binding_position_recorded_as_a_declaring_identity.dag
+++ b/dag/gunbc/recurring_failure_mode/a_binding_position_recorded_as_a_declaring_identity.dag
@@ -11,7 +11,7 @@ data a_binding_position_recorded_as_a_declaring_identity: RecurringFailureMode =
     "HARM. One declaration acquires one identity PER RELAY it is reached through, so the map that exists to make identity single-valued is the thing that forks it. Nothing refuses: every path resolves, and the reference is Accepted. It surfaces downstream as a wrong answer with no diagnostic -- a target that spells a declaration by its module emits a path into the relay module, which declares nothing and therefore has no item to name, so the emitted program refers to something that was never written.",
     "DISTINGUISHING FACTS. refusal_reason_minted_as_canonical_identity is a value minted from the WRONG VOCABULARY (a diagnostic reason standing in a name's place); this row is a value from the RIGHT vocabulary read at the WRONG LAYER -- a real qualified path, naming a real position, that is a binding rather than a declaration. The recognition rule is a question, not a spelling: when a field is named for a DECLARATION, ask whether every writer of it can only have written a declaration there, and follow one re-export before answering. An index whose lookup succeeds at a relay will answer that question wrong and stay green.",
     "RECEIPT (2026-09-22, fierce-wren-487, found by review 70003 on gunbc#12048). Uninhabited until resolution began CARRYING the declaring path: while a resolved reference was a bare leaf the recorded declaring path reached no consumer, so the fork existed in the index and was unobservable. The enrolled chain claim could not see it either -- it asserted only that the chain RESOLVES, and an index that stops at the relay resolves perfectly well. Repaired by chasing one step through symbol_index_claimants_at, which already answers who declares what lives at a position; a relay's own row was chased the same way when it bound, so one step reaches the home. Enrolled: v2.test.claim.namespace_xl0.cross_module_reference_resolution a_re_export_resolves_to_the_home_not_the_relay_holds, whose NEGATIVE conjunct is the discriminator -- measured FAIL before the chase and PASS after, with the sibling same-leaf row PASS in both runs.",
-    "RECEIPT, SECOND WRITER (2026-10-03, sunny-lynx-759, gunbc#13038). v2.compiler.symbol_index_fill symbol_index_fill_unique_variant_aliases writes a module-unique variant TWICE as an ENTRY: once at its declaring path under its coproduct (p.Resolution.Pointer, symbol_index_fill_containment_node) and again at the module-level binding position (p.Pointer), over the same arm node, through symbol_index_insert rather than a binding row. So symbol_index_declaring_path_of answers p.Pointer for p.Pointer -- the binding position is its own declaring identity, and the chase this row's first repair added cannot reach the home. MINIMAL REPRODUCER: `module p` / `type Resolution = Static | Pointer` / `type Width<bits: Resolution>` / `type UsesPointer = Width<Pointer>`. The bare `Pointer` resolves to declaration_reference p.Pointer; comparing it by declaring path against the kind's variant p.Resolution.Pointer judged a conforming argument OUTSIDE its kind (resolve_reason_type_argument_kind_not_inhabited, measured on the gunbc#13038 branch before the workaround). gunbc#13038 compares the indexed declaration NODE instead (v2.compiler.resolve resolve_path_declares_node), which is a consumer-side workaround and not the repair; v2.test.claim.type_application_kind tak_kinded_parameter_accepts_a_variant_of_its_kind is the control that went red. THE REPAIR this receipt names: the variant alias is a BINDING to its declaring path (recorded so symbol_index_claimants_at answers p.Resolution.Pointer), not a second entry, after which resolve_path_declares_node can be replaced by a declaring-path comparison.",
+    "RECEIPT, SECOND WRITER (2026-10-03, sunny-lynx-759, gunbc#13038). the pre-fusion alias writer wrote a module-unique variant TWICE as an ENTRY (the repair the receipt names is LANDED IN #13210: symbol_index_fill_containment_node now files the alias as a BINDING to its declaring path via symbol_index_bind_at, symbol_index_declaring_path_of relates the two paths, and no parallel carrier map stands beside the relation): once at its declaring path under its coproduct (p.Resolution.Pointer, symbol_index_fill_containment_node) and again at the module-level binding position (p.Pointer), over the same arm node, through symbol_index_insert rather than a binding row. So symbol_index_declaring_path_of answers p.Pointer for p.Pointer -- the binding position is its own declaring identity, and the chase this row's first repair added cannot reach the home. MINIMAL REPRODUCER: `module p` / `type Resolution = Static | Pointer` / `type Width<bits: Resolution>` / `type UsesPointer = Width<Pointer>`. The bare `Pointer` resolves to declaration_reference p.Pointer; comparing it by declaring path against the kind's variant p.Resolution.Pointer judged a conforming argument OUTSIDE its kind (resolve_reason_type_argument_kind_not_inhabited, measured on the gunbc#13038 branch before the workaround). gunbc#13038 compares the indexed declaration NODE instead (v2.compiler.resolve resolve_path_declares_node), which is a consumer-side workaround and not the repair; v2.test.claim.type_application_kind tak_kinded_parameter_accepts_a_variant_of_its_kind is the control that went red. THE REPAIR this receipt names: the variant alias is a BINDING to its declaring path (recorded so symbol_index_claimants_at answers p.Resolution.Pointer), not a second entry, after which resolve_path_declares_node can be replaced by a declaring-path comparison.",
     "RUNG FOUND AT: outside the ladder -- silent wrongness.",
     "CEILING: structurally impossible. A binding position and a declaring position are different concepts sharing one carrier (QualifiedName), so either can be written where the other is owed. The wall is the type: a declaring identity a binding path cannot inhabit, which is the same wall refusal_reason_minted_as_canonical_identity names from its own direction.",
     "NEXT-RUNG TRIGGER: a declaration-identity carrier distinct from the qualified path of an arbitrary position, so that symbol_index_bind_at cannot be handed a binding position at all; until then the enrolled row above is the wall, and it is a permanent regression control rather than an expecting-red probe.",
@@ -20,7 +20,7 @@ data a_binding_position_recorded_as_a_declaring_identity: RecurringFailureMode =
     DeclarationRef { module_path: "v2.compiler.symbol_index_fill", decl_name: "symbol_index_bind_pending_round", field: WholeDeclaration },
     DeclarationRef { module_path: "v2.std.symbol_index", decl_name: "symbol_index_declaring_path_of", field: WholeDeclaration },
     DeclarationRef { module_path: "v2.test.claim.namespace_xl0.cross_module_reference_resolution", decl_name: "a_re_export_resolves_to_the_home_not_the_relay_holds", field: WholeDeclaration },
-    DeclarationRef { module_path: "v2.compiler.symbol_index_fill", decl_name: "symbol_index_fill_unique_variant_aliases", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.compiler.symbol_index_fill", decl_name: "symbol_index_fill_containment_node", field: WholeDeclaration },
     DeclarationRef { module_path: "v2.compiler.resolve", decl_name: "resolve_path_declares_node", field: WholeDeclaration },
     DeclarationRef { module_path: "v2.test.claim.type_application_kind", decl_name: "tak_kinded_parameter_accepts_a_variant_of_its_kind", field: WholeDeclaration },
   ],
diff --git a/dag/gunbc/recurring_failure_mode/a_build_replaces_the_executable_that_is_running_it.dag b/dag/gunbc/recurring_failure_mode/a_build_replaces_the_executable_that_is_running_it.dag
new file mode 100644
index 00000000000..5c5144a9ada
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/a_build_replaces_the_executable_that_is_running_it.dag
@@ -0,0 +1,17 @@
+module gunbc.recurring_failure_mode.a_build_replaces_the_executable_that_is_running_it
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data a_build_replaces_the_executable_that_is_running_it: RecurringFailureMode = RecurringFailureMode {
+  identity: "a_build_replaces_the_executable_that_is_running_it" as NonEmptyStr,
+
+  receipts: [
+    "INVALID STATE: a process builds the very binary it is running from, and the build relinks that path, so the process continues as the OLD image while the disk holds the NEW one. Anything the process then does in its own image (an emit, a measurement) speaks for a seed the build did not produce.",
+    "SPECIMEN: `claim_executor --regen-round-cost` ran `round.seed_build` (cargo build --release --bin claim_executor) and refused on its first remote run with 'the seed build replaced the running executable' (the historical refusal was an untyped Err(String), not a typed cause); the author-side workaround was to run it twice in one dispatch, which is the DESIGN section 5 workaround (an absorbing fallback executed by the author).",
+    "DISTINGUISHING FACTS: the refusal (an untyped Err(String)) was correct but fired on a precondition the flag itself manufactured (build output path == running image path); the second run succeeds only because the build is then up to date. The earliest unjustified boundary is the build step's choice of output path, not the digest comparison.",
+    "RUNG: found at 1 (runtime mitigation: an untyped Err(String) refusal). CURRENT rung 1 still: the build re-execs the built binary exactly once, carrying the pre-handoff seed-build cost, the built-artifact digest and a source identity (HEAD plus the uncommitted tracked diff digest plus length-framed path+content digests of untracked non-ignored files; built_exe is the BUILD-OUTPUT digest, and the descriptor opened for the exec must match it (OpenedTargetNotBuildOutput) before the exec, never overwriting the carry, and the receiving image digests the running image through /proc/self/exe (not the installed path) and refuses on a mismatch with the carried digest; a rewrite of the inode between hash and exec is detected after the fact, not prevented; marker GUNBC_REGEN_ROUND_COST_REEXEC), and the receiving image refuses with the typed SeedHandoffRefusal on a wrong artifact, a changed source, a second replacement, or a ledger without exactly one round.seed_build row; the invalid state stays writable. CEILING 3, reached only by execution of the admitted build artifact with complete, or explicitly unavailable, accounting. RECOGNITION RULE: a step that builds X and then relies on running-process X must re-exec or build elsewhere; 'run it twice' is the tell.",
+    "NEXT TRIGGER: model the seed-build step in .dag so the admitted build artifact is a declared fact and is the thing executed, with its cost accounting complete or explicitly unavailable; until then the re-exec lives in required_regen_host.rs run_regen_round_cost, a v1 seed-growth item tracked beside gunbc.regen_round_cost_instrument_seed_growth and dissolved when that modeled path lands."
+  ],
+  evidence: []
+}
diff --git a/dag/gunbc/recurring_failure_mode/a_citation_attests_a_decision_rule_the_code_does_not_implement.dag b/dag/gunbc/recurring_failure_mode/a_citation_attests_a_decision_rule_the_code_does_not_implement.dag
index de9b82d5641..59c5d117e3a 100644
--- a/dag/gunbc/recurring_failure_mode/a_citation_attests_a_decision_rule_the_code_does_not_implement.dag
+++ b/dag/gunbc/recurring_failure_mode/a_citation_attests_a_decision_rule_the_code_does_not_implement.dag
@@ -15,6 +15,17 @@ data a_citation_attests_a_decision_rule_the_code_does_not_implement: RecurringFa
 
     "**RECEIPT (vivid-ibex-684, 2026-10-04, gunbc#13258, side-chat review `5406002589`; defect live in the tree).** `dag/extdeps/accessibility/wcag_contrast.dag` cites WCAG 2.2 (www.w3.org/TR/WCAG22/#dfn-relative-luminance) and its comment asserts the linearization knee is the page's published constant at 0.03928 -- and the code does use 392/10000. But the cited definition specifies the threshold 0.04045 and notes 0.03928 as the older value, so the citation attests a definition the code does not implement. The module was authored 2026-07-21 with the comment noting the page as retrieved that day, so the pairing was already false when authored -- there is no upstream-drift story here, only a misattestation that name-level checks (live URL, subject ownership) do not see. Pulled from #13258 per that review rather than fixed; the defect is live as of this receipt.",
 
+    "**REPAIR RECEIPT (vivid-lynx-377, 2026-10-05, frontier; semver half).** `dag/extdeps/version/semver.dag`'s `semver_identity_compare` now parses the label back into the typed form over the SemVer 2.0.0 section 2 grammar and routes through `semver_compare`, the module's one implementation of the section 11 precedence rule; a label outside the grammar is refused by the scheme's compare through the `VersionComparison` carrier (`extdeps.version`: `VersionCompared { ordering }` | `VersionComparisonRefused { side, identity, cause }`) -- a located refusal naming the failing side, the label, and the cause, pinned positively by `w_semver_scheme_out_of_grammar_label_refuses_precedence` -- with the sibling git and go scheme instances updated to the same carrier. The cited source was re-read live first (semver.org/#spec-item-11, retrieved 2026-10-05). Five discriminating reds failed for the documented reason before the fix (`1.10.0` vs `1.9.0` ranked Less; release above pre-release reversed; numeric-vs-alphanumeric and numeric-width pre-release cases ranked by ASCII; build metadata ranked) and pass after (dag/test/claim/extdeps_version_semver_witness_test.dag, remote claim_batch --claim-run). The regenerated stage0 mirrors are installed and `claim_executor --required-regen` now adjudicates the whole tree clean (declared_divergent=1 [main.rs] only). The wcag half of this row is repaired in a separate PR (#13414).",
+
+    "**REPAIR RECEIPT (vivid-lynx-377, 2026-10-05, review round on the same PR; semver half hardened, sibling schemes de-fabricated).** Follow-up review found the first repair incomplete in three ways, each fixed at its owner. (1) `semver_identifier_parse` accepted a pre-release identifier that is all digits with a leading zero (`1.0.0-01`): section 9 forbids leading zeroes in numeric identifiers and the section 2 grammar requires an alphanumeric identifier to contain a non-digit, so such a segment is out of grammar -- it now refuses (strict mode), pinned by `w_semver_pre_release_leading_zero_numeric_label_refuses`, which failed for the documented reason on the pre-fix head (the segment ranked as alphanumeric) and passes after. (2) The pre-release and build identifier parses were byte-identical and a `strict_numeric` flag did nothing; there is now ONE identifier parse carrying the only real difference between the section 9 and section 10 grammars -- strict mode refuses the leading-zero digit run, permissive mode (build, where section 10 permits leading zeroes, `1.0.0+0130`) keeps it alphanumeric -- pinned by `w_semver_build_leading_zero_identifier_still_parses`. (2b) A follow-up side-chat review found the bare `Ordering?` refusal not located and the go scheme's own comparator still widening (`v1.0.0-alpha` ranked Equal to `v1.0.0-beta`, its parser accepting `v1.0.0-01` and empty identifier components): the compare now returns the closed `VersionComparison` carrier (`VersionCompared { ordering }` | `VersionComparisonRefused { side: ComparisonSide, identity, cause }` — the side is the closed coproduct `LeftOperand | RightOperand`, so a misspelled side is unwritable) across all three schemes, the refusal's cause states the grammar honestly rather than claiming a specific defect the failing label may not have, and go deletes its second partial implementation entirely (prefix-strip + SemVer grammar + `semver_compare`), with new reds `w_go_module_version_scheme_orders_pre_release_identifiers` and `w_go_module_version_scheme_refuses_leading_zero_pre_release` and `w_go_module_version_scheme_refuses_label_without_v_prefix`. (3) The sibling git and go schemes still fabricated answers: git returned Equal/Greater by string equality and go returned Less for any unequal pair, each wrapped as Present; the only git-scheme consumer was an equality-only witness and the go scheme had no consumers, so no caller relied on the wrong behaviour. Git now consumes extdeps.version.semver's core parse (a git release version IS the SemVer core triple -- one grammar, no re-invention) and routes through `git_release_version_compare`; go strips its `v` prefix and reuses the SemVer grammar and `semver_compare` (the deleted go-local comparator ranked ANY two pre-release versions Equal -- `v1.0.0-alpha == v1.0.0-beta` -- the exact widening the cited rule forbids), both refusing through the `VersionComparisonRefused` carrier a label outside their grammars -- pinned by `w_git_release_version_scheme_orders_minor_numerically`, `w_git_release_version_scheme_refuses_out_of_grammar_label`, `w_go_module_version_scheme_orders_patch_numerically`, `w_go_module_version_scheme_refuses_unparsable_label`, each of which failed for the documented reason on the pre-fix head (placeholder answers wrapped as Present) and passes after (remote claim_batch --claim-run, 2026-10-05). `claim_executor --required-regen` re-adjudicates the whole tree clean after the changes (first_generation_equal=true, declared_divergent=1 [main.rs] only).",
+
+    "**REPAIR RECEIPT (vivid-lynx-377, 2026-10-06, second review round; parser still minted orders for two out-of-grammar shapes).** Follow-up review (review 76945) found two holes in the new section 2 parse, each fixed at its owner in `dag/extdeps/version/semver.dag`, with the hole on the git scheme closing automatically since git consumes this parse. (1) `1.2.3.` parsed as `1.2.3`: the last field was reached through a dot-split, so the trailing delimiter was dropped and an out-of-grammar label ranked. The last field now consumes the WHOLE remainder (a leftover delimiter then fails the numeric run), pinned by `w_semver_core_refuses_trailing_delimiter_label`, which mints `Greater` under the old code and refuses after. (2) `semver_digits_to_int` accumulated `acc * 10 + d` with unchecked `Int` arithmetic before the `checked_int_to_nat` conversion, so a 20-nines field wrapped into a small positive Int that passed the Nat check and minted a wrong precedence; the arithmetic was first re-done through `std.checked_arithmetic`, and then - see the next receipt - the conversion left the comparison path entirely. Both reds are remote claim_batch green on the fixed head (2026-10-06). A third fix in the same round is prose-only: the row's own receipt string quoted the stripped prefix with raw double quotes, which closed the .dag string literal and left a bare `v` parsed as an unimported identifier (the floor's UnimportedBareProvider refusal); backticks instead.",
+
+    "**REPAIR RECEIPT (vivid-lynx-377, 2026-10-06, third review round; the overflow refusal itself was a grammar invention).** The side chat (review 5427723272) rejected the previous round's overflow half: section 2 and section 9 numerics have NO size limit, so `1.99999999999999999999.0` is a valid label that must compare above `1.2.0`, and refusing it as out-of-grammar was inventing a failure the spec does not describe. The comparison path now carries numeric components as arbitrary-width digit sequences (code points, admitted with no leading zero except the single digit 0, per sections 2 and 9; build identifiers stay validated text with no conversion anywhere), and precedence compares by digit-run length and then ASCII digit order - section 11's numeric comparison at any width. `semver_digits_to_int` and every `checked_int` use are deleted. Controls: `w_semver_core_wide_numeric_field_compares_numerically` (20 nines in the minor field ranks Greater), `w_pre_release_wide_numeric_identifier_compares_numerically` (wide numeric pre-release above 1.0.0-2), `w_build_wide_numeric_identifier_is_valid_and_ignored` (wide build metadata parses and compares Equal).",
+    "**REPAIR RECEIPT (vivid-lynx-377, 2026-10-06, fourth and fifth review rounds; the arbitrary-width field was forgeable and three live consumers still held raw records).** Side-chat review 5429823519 rejected the type-only confinement: `SemVerNumericField` was a bare alias of `List<Int>`, so nothing in the language enforced non-empty, ASCII-digits-only, or no-leading-zero, external code could forge `[65]` or `[48,49]`, and compare still ordered the forgeries. The field is now a one-field record whose only producer is the validating constructor `semver_numeric_field` (refuses empty, non-ASCII-digit, and leading-zero sequences; admits the single digit 0), pinned by `w_numeric_field_constructor_refuses_forged_sequences`; the git anchor and every witness value derive through that constructor or the parser, never raw code-point lists. The honest rung, stated in both the type comment and the witness file: the emitter lowers the one-field record to a plain alias, so the confinement is BY-SOURCE (only the constructor produces field values; every consumer derives through it or the parser) plus the executing negative controls -- not a runtime type guarantee. Review 77150 then found the ripple the type change owed outside its own files: `SemVerVersion` field literals with raw Int values still stood in `dag/extdeps/tailscale/serve.dag`, `dag/gunbc/live_deploy/spec.dag`, and `dag/test/claim/live_deploy/emit_test.dag` (enumerated by name and migrated), each would have projected `.digits` off an Int at execution. All three now derive their version values through `semver_version_parse`, and the serve-off boundary plus the observed client version are the parse RESULT (Optionals) -- so an unadmitted label is carried to the consumer as a refusal, not a fabricated version; the same repair removed the git anchor's unreachable-but-fabricating `0.0.0` fallback (the anchor is the parse result, consumers unwrap, `w_git_2_0_anchor` pins the admitted label), rewrote every witness SemVerVersion/identifier literal through the parser or the confined constructor, and deleted the stale overflow-refusal comment the width round had superseded. Local parse-check of every touched entry: 0 blocking errors.",
+    "**REPAIR RECEIPT (vivid-lynx-377, 2026-10-07, sixth review round; the confinement was by-source only and the comparator was a raw-list bypass).** Side-chat review 5435818773 accepted the consumer migration but blocked twice. (1) The type-level seal was missing: `type SemVerNumericField { digits: List<Int> }` had a public constructor, so any module could still mint `SemVerNumericField { digits: [48,49] }` and the negative control only proved the checking fn returns Absent. The field is now `sole_constructor` -- constructible only inside extdeps.version.semver -- and the witness file executes an OUTSIDE-MODULE compile probe over the three forged literals (leading-zero run, non-digit code point, empty run), each required to meet the SoleConstructorViolation refusal, plus the via-constructor positive control (compile_dag_diagnostic_census + census_rows_of_class); the native route's modifier-parse gap remains cited, not restated (g0_type_decl_modifier_parse_without_sealing_property). (2) `semver_compare_numeric_digits(a: List<Int>, b: List<Int>)` was itself a raw-list bypass that git imported; it now takes two confined SemVerNumericField values and projects `.digits` internally, with the run-length/lexical helper internal over plain lists -- no raw code-point list reaches the comparator. Mirror regenerated (required-regen first_generation_equal=true, 163/163, declared_divergent=1 [main.rs] unchanged); witness floors on the pushed head: semver 32 PASS exit 0 (both new probe witnesses green), git 10/10 exit 0, go 24/24 exit 0.",
+
+
     "**REPAIR RECEIPT (vivid-lynx-377, 2026-10-05, frontier; wcag half).** `dag/extdeps/accessibility/wcag_contrast.dag`'s linearization knee is now the cited 0.04045 (integer `c_scaled <= 404` at scale 10000) and the comment cites the definition's Note 2 recording 0.03928 as the threshold before May 2021 (live page re-read 2026-10-05). The threshold half of the #13258 receipt was checked against the live page and already matched: 450/300/700 transcribe SC 1.4.3 (4.5:1 normal, 3:1 large-scale), SC 1.4.11 (3:1 graphical objects) and SC 1.4.6 (7:1 AAA); pinned by `witness_cited_knee_threshold_rows_match_criterion_text`, no change made. The knee's discriminating red samples the only window where the two constants disagree -- no 8-bit channel at unity white lands there (10/255 = 0.03922 is below both knees), which is why the module's earlier pins never saw it -- and pins the outcome flip: `linearize_channel_scaled(393)` returns 30 under the cited knee (29 under the defective one), and the colour pair (393,0,500)/(8000,1000,8000) FAILS AA normal text under the cited knee while the defective knee called it sufficient. Both green after the fix (dag/test/claim/wcag_contrast_witness_test.dag, remote claim_batch --claim-run). The semver half of this row is repaired in a separate PR (#13412).",
 
     "**WHY NO EXISTING WALL SEES IT, stated as a boundary rather than a gap to be closed by the neighbour.** The extdeps scope placement gate adjudicates the diff-added pairing of a subject declaration to a citation anchor at the level of NAMES: it can see that a subject is not the cited upstream's surface (tool CLI vs standard), because that mismatch is visible in what the module declares and what the anchor names. The lexical-vs-precedence difference lives in the code the declaration dispatches through, not in any name, module path, or anchor field; DESIGN section 4c makes annotations invisible to semantic passes, and a scope block's citation is an annotation about authority, not a type on the code path. So a fully green placement gate and a green namespace wave are both positive evidence about ownership and binding, and NO evidence about whether the decision the code implements is the one the standard defines.",
diff --git a/dag/gunbc/recurring_failure_mode/a_coproduct_arm_without_a_constructor_name_is_accepted.dag b/dag/gunbc/recurring_failure_mode/a_coproduct_arm_without_a_constructor_name_is_accepted.dag
new file mode 100644
index 00000000000..c998180c368
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/a_coproduct_arm_without_a_constructor_name_is_accepted.dag
@@ -0,0 +1,14 @@
+module gunbc.recurring_failure_mode.a_coproduct_arm_without_a_constructor_name_is_accepted
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data a_coproduct_arm_without_a_constructor_name_is_accepted: RecurringFailureMode = RecurringFailureMode {
+  identity: "a_coproduct_arm_without_a_constructor_name_is_accepted" as NonEmptyStr,
+  receipts: [
+    "INVALID STATE: a coproduct declaration with an arm that has no constructor name, `type T = { x: Int } | B`. Nothing can build or match that arm, so the declaration is malformed. v2 normalize accepts it, and so does v2 resolve on the single-tree door. Measured by claim_batch on BuildBuddy, 2026-10-05 (clever-raven-680): `v2.test.long.cwc_resolution_probe` `cwc_malformed_nary_coproduct_normalize_rejects` FAILs. The claim hands normalize a supplied parse tree for `type T = { x: Int } | B`; the module's real-path claim `cwc_cwc_module_resolve_accepts` checks that the real parser emits that tree for the source, by content hash.",
+    "HOW IT HID: the witness carried this claim beside its own negation (`cwc_malformed_nary_coproduct_fail_open_control`, `!cwc_norm_rejects` over the same source). Both became `test fn` in gunbc#7287; at gunbc#7002 the negation was a helper inside one conjunction. So one of the pair was red whatever normalize did, and the file read as a stale shape rather than a finding. The negation is deleted and the remaining claim discriminates. Until gunbc#13333 the module was frozen in `gunbc.witness_deferral_freeze`, so the floor never ran it. That PR retired the freeze row and enrolled this claim in `v2.workflow.floor_expected_red`, so the required floor now runs it and holds its failure as agreement.",
+    "RUNG FOUND AT: below the floor (silent acceptance of a malformed declaration). CEILING: structurally impossible. The arm's children are in hand when the Disj node is built, so the fold can refuse an arm with no name. NEXT-RUNG TRIGGER, NAMING THE CAPABILITY: the declaration fold that builds a coproduct refuses an arm with no authored constructor name, with a located diagnostic, and the claim above turns green. Owner unassigned at filing. The claim is enrolled in `v2.workflow.floor_expected_red` (`floor_expected_red_chunk_coproduct_arm_without_constructor_name`); when it turns green the roster row is deleted and the claim stays as the control.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/a_generic_variant_construct_infer_walk_costs_about_seven_times_the_new_witness_ceiling.dag b/dag/gunbc/recurring_failure_mode/a_generic_variant_construct_infer_walk_costs_about_seven_times_the_new_witness_ceiling.dag
new file mode 100644
index 00000000000..7726d592d75
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/a_generic_variant_construct_infer_walk_costs_about_seven_times_the_new_witness_ceiling.dag
@@ -0,0 +1,22 @@
+module gunbc.recurring_failure_mode.a_generic_variant_construct_infer_walk_costs_about_seven_times_the_new_witness_ceiling
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+
+data a_generic_variant_construct_infer_walk_costs_about_seven_times_the_new_witness_ceiling: RecurringFailureMode = RecurringFailureMode {
+  identity: "a_generic_variant_construct_infer_walk_costs_about_seven_times_the_new_witness_ceiling" as NonEmptyStr,
+
+  receipts: [
+    "COST-SHAPE SUSPICION, not yet a proven defect. An own-frame infer walk over a minimal one-module fixture carrying a GENERIC variant construct costs about seven times the new-witness eval-step ceiling, while the same-size NON-generic fixture's walk fits it. The fixtures (authored text, assembled through v2.compiler.program_assembly assemble_program_from_ingest, walked by infer): `module p / type Out<T> = Acc { value: T, n: Int } | Rej { n: Int } / fn make<T>(t: T) -> Out<T> { Acc { value: t, n: true } }` and the same with the field value `n: 7`. MEASURED, 2026-10-07, session clever-bat-68, floor run 37662723098 (head 583526cd4d), per-claim own-frame measurements printed by the required floor runner: the wrong-field claim 514,872 eval steps, the right-field twin 497,605 eval steps, against the new-witness ceiling of 72,300 (the 100ms-equivalent, v2.workflow.required_floor claim_ceiling_eval_step_budget NewWitnessTier). The refusal and the acceptance cost the same, so the cost is the generic MACHINERY (type-parameter binding, construct instantiation, declared-type walking), not refusal-path exploration.",
+
+    "HARM: any floor claim that honestly exercises generic-variant construct typing cannot be enrolled at the new-witness tier, so the first generic-variant construct controls (silent-deer-637's wrong-field control and its discriminating twin) were authored, measured, and DEFERRED out of #13210 (receipt in the PR body); the surface stays uncontrolled until the cost is explained. The 7x is UNEXPLAINED by inspection: the construct-typing path (v2.compiler.infer infer_record_construct_read through the declaring path) performs keyed reads, and the alias-binding repair's xl2 lesson (same trial) showed the substrate is a HAMT -- so the multiplier is not obviously a rescan, but no comparator has isolated it either.",
+
+    "RUNG FOUND AT: unmeasured comparator. ATTAINABLE CEILING: the A/B that decides it -- two same-shape fixtures differing in ONE line (generic parameter present vs absent), each walked in its own frame, per-claim eval steps compared. If the 7x tracks the generic parameter, the cost shape is in the generic machinery (per-instantiation work in infer's construct/declared-type paths) and is fixed to O(1)/O(log n) per construct before the controls are enrolled; if the non-generic own-frame walk is ALSO far over the ceiling, the gap is the tier's own-frame billing and the enrolment question goes back to the tier owner, not this row. NEXT-RUNG TRIGGER: the deep-instantiation follow-up PR (deep substitution inside v2.compiler.infer infer_frame_instantiated) runs that A/B with the floor's per-claim numbers and either lands the controls with a fixed cost shape or prices the tier question. NOT FIXED IN #13210: the controls are receipted, not enrolled; their fixture texts are recorded here so the follow-up reproduces them byte-identically.",
+  ],
+
+  evidence: [
+    DeclarationRef { module_path: "v2.compiler.infer", decl_name: "infer_record_construct_read", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.compiler.infer", decl_name: "infer_frame_instantiated", field: WholeDeclaration },
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/a_kind_level_default_hides_the_children_its_producer_minted.dag b/dag/gunbc/recurring_failure_mode/a_kind_level_default_hides_the_children_its_producer_minted.dag
new file mode 100644
index 00000000000..c022649d929
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/a_kind_level_default_hides_the_children_its_producer_minted.dag
@@ -0,0 +1,22 @@
+module gunbc.recurring_failure_mode.a_kind_level_default_hides_the_children_its_producer_minted
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data a_kind_level_default_hides_the_children_its_producer_minted: RecurringFailureMode = RecurringFailureMode {
+  identity: "a_kind_level_default_hides_the_children_its_producer_minted" as NonEmptyStr,
+
+  receipts: [
+    "A shared node reader carries a KIND-LEVEL default: for one node kind it answers `missing` unconditionally, without consulting the node's actual children, while the same query on a sibling kind folds them. Any node the pipeline mints in the defaulted kind therefore carries facts no reader can see.",
+
+    "**RECEIPT (eager-cat-664, 2026-10-06, PR #13108, this carrier).** `v2.std.node_query` `named_child_lookup` folded authored edges for `TypeNode { Conj }` and answered `NamedChildMissing` for every `ComputationNode`. Body-lowering mints a call as `comp:transform[ *=atom:callee[] @arg=atom:... ]` -- a ComputationNode whose authored edges ARE its named arguments -- so the admit-wall roster reader could hang a correct record and still read `module_path` as missing. Three probes were spent proving the carrier wrong before the accessor was instrumented; the miss was one arm in std.",
+
+    "The blindness is SILENT in both directions. The producer does not fail (it minted the edges); the reader does not fail (it answers a well-typed `missing`); the stage between them manufactures a refusal whose correction points at data that is present. A typed, located refusal -- the §5 shape -- is what turned the miss legible: the correction carried the looked-up key, and one probe printed the key next to the keys the accessor actually saw.",
+
+    "**RECOGNITION RULE: when a reader's `missing` is about to be trusted, ask what the node's PRODUCER writes at that position and whether the reader's kind-level arm ever looks.** The discriminator is one instrument run printing the node's actual children beside the answer the accessor gave.",
+
+    "THE REMEDY IS AT THE ACCESSOR, NOT THE CALL SITE: re-walking children at a call site (a parallel first-child walk) re-invents the concept and forks the shape -- the same §2/§3 violation the ctrl review policy's walker-dissolution rule names. The fix that closed this receipt changed the one arm in std and was witnessed red-then-green in the accessor's own claim file, with the missing-name control alongside, so the corpus decides whether any other reader's output moves.",
+  ],
+
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/a_namespace_root_segment_resolves_as_a_bare_reference.dag b/dag/gunbc/recurring_failure_mode/a_namespace_root_segment_resolves_as_a_bare_reference.dag
index f082028342c..1cf24d1b3cd 100644
--- a/dag/gunbc/recurring_failure_mode/a_namespace_root_segment_resolves_as_a_bare_reference.dag
+++ b/dag/gunbc/recurring_failure_mode/a_namespace_root_segment_resolves_as_a_bare_reference.dag
@@ -9,7 +9,7 @@ data a_namespace_root_segment_resolves_as_a_bare_reference: RecurringFailureMode
   receipts: [
     "a namespace root segment resolves as a bare reference: the first segment of a qualified module path -- `v2` in `v2.std.node.Node` -- is classified as a free value reference, and because the pool happens to declare something with that spelling it resolves to that declaration. The reference-derived dependency producer then publishes an edge from the reading module into a module it never names. Nothing refuses: the edge is well formed, the closure it widens still resolves, and every consumer of the closure reads a larger population as the true one.",
 
-    "SPECIMEN, found 2026-09-23 by the Pkg7e emitted-workspace plan (v2.workflow.emitted_crate_workspace), whose two-closure join refused with ClosuresDisagree: the live dependency DAG of v2.compiler.compile carried 214 modules, the seed's emission 190, and the 24 extra included test.claim.secret_rotation_witness. That test module declares `fn v2()`. Every import-free production module reading a `v2.std.*` path -- src/v2/std/artifact, src/v2/std/grounding, src/v2/std/cross_tree/resolution among them -- gained a UniqueBare edge into it, and its imports pulled in the rest.",
+    "SPECIMEN, found 2026-09-23 by the Pkg7e emitted-workspace plan (gunbc.emitted_crate_workspace), whose two-closure join refused with ClosuresDisagree: the live dependency DAG of v2.compiler.compile carried 214 modules, the seed's emission 190, and the 24 extra included test.claim.secret_rotation_witness. That test module declares `fn v2()`. Every import-free production module reading a `v2.std.*` path -- src/v2/std/artifact, src/v2/std/grounding, src/v2/std/cross_tree/resolution among them -- gained a UniqueBare edge into it, and its imports pulled in the rest.",
 
     "THE EARLIEST UNJUSTIFIED LINK (DESIGN section 6b), found by walking the producer from its output back: v1_compiler.cli_run ExprVarClassification classify decided that a dotted chain's head is a namespace segment only when NO declaration anywhere shares its spelling, and reference_resolution_facts runs with no declaration index at all, so that arm could never fire there and every head fell to the free-reference default. The dotted scan had already recorded the chain whole and resolved it Qualified by longest_declared_module_prefix; the head's role was a fact the producer held and did not consult. The repair classifies a head whose chain names a declared module as QualifiedChainHead, the member it always belonged to; only a binder outranks it, and a dotted read whose head names no module (a value row's field) keeps its edge.",
 
diff --git a/dag/gunbc/recurring_failure_mode/a_recursive_record_declaration_cascades_module_wide_grounding_failure.dag b/dag/gunbc/recurring_failure_mode/a_recursive_record_declaration_cascades_module_wide_grounding_failure.dag
new file mode 100644
index 00000000000..31085ef7a70
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/a_recursive_record_declaration_cascades_module_wide_grounding_failure.dag
@@ -0,0 +1,21 @@
+module gunbc.recurring_failure_mode.a_recursive_record_declaration_cascades_module_wide_grounding_failure
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+
+data a_recursive_record_declaration_cascades_module_wide_grounding_failure: RecurringFailureMode = RecurringFailureMode {
+  identity: "a_recursive_record_declaration_cascades_module_wide_grounding_failure" as NonEmptyStr,
+
+  receipts: [
+    "a recursive record declaration undoes grounding for the whole module. INVALID STATE: an author declares a record whose field names the record's own type (`type N = Wrap { seed: N }`) and writes an ordinary fn over it (`fn f(a: N) -> N { a }`); infer refuses the module with a cascade of ~28 infer_grounding_not_derived diagnostics -- including inhabitance_undecidable_formal_unresolved and inhabitance_undecidable_argument_type_not_derived mid-chain -- so every fact in the module is underived, with no diagnostic naming the self-referential declaration as the cause. HARM: one declaration's cycle is reported as a module-wide failure to ground; the reader is sent to debug every binding in the module instead of the one declaration that carries the cycle.",
+
+    "RECEIPT, 2026-10-06, session clever-bat-68, minimal fixture from the variant-scrutinee infer work (#13210), printed by reading the readings through the gunbc run --function decode route rather than inferred. A one-module fixture program assembled through v2.compiler.program_assembly assemble_program_from_ingest declares `type N = Wrap { seed: N }` and `fn f(a: N) -> N { a }`; infer refuses with the cascade above. The reproducer text stands in this receipt (the probe's former data row for it was removed as unexecuted -- no enrolled claim runs it and a receipt quotes its text instead). The SAME fixture shape with the recursive field removed (types carrying payload variants over bare-Int fields, non-recursive, as v2.test.claim.match_binder.match_binder_typing's mbt_decls does) grounds and its claims pass on the same route -- so the cascade tracks the recursive declaration, not the assembled-program route, the one-module shape, or the bare-Int spelling. The grounding wall reads type-name atoms through the one binding->value-type join (v2.std.inhabitance's dag_binding_denotation seam, inhabitance.dag lines ~3553-3557: 'a declared type that is a bare atom the join does not denote ... is counted UndecidableFormalUnresolved'); a self-referential record is exactly a bare atom the join does not denote, and the cascade is the wall answering module-wide for it.",
+
+    "RUNG FOUND AT: below the ladder -- the cascade is silent about its cause: no diagnostic names the recursive declaration, and the refusal chain reads as if every binding in the module were separately ungroundable. ATTAINABLE CEILING: structurally decidable -- the declaration graph of a module is finite, so a cycle in it is findable at fill time and can be named. NEXT-RUNG TRIGGER: the binding->value-type join either grounds a declaration whose field type names its own declared type (a fixpoint read) or refuses WITH the cycle's declaration named in a located diagnostic, so a module containing one self-referential record does not turn into a module-wide grounding cascade. NOT FIXED IN #13210: the probe routes around this shape (its fixtures are non-recursive) and this row records it for its own follow-up.",
+  ],
+
+  evidence: [
+    DeclarationRef { module_path: "v2.std.inhabitance", decl_name: "declared_type_inhabitance", field: WholeDeclaration },
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/a_string_literal_attests_an_emitted_reference.dag b/dag/gunbc/recurring_failure_mode/a_string_literal_attests_an_emitted_reference.dag
index 03cf8d70a14..6feca5da8da 100644
--- a/dag/gunbc/recurring_failure_mode/a_string_literal_attests_an_emitted_reference.dag
+++ b/dag/gunbc/recurring_failure_mode/a_string_literal_attests_an_emitted_reference.dag
@@ -9,7 +9,7 @@ data a_string_literal_attests_an_emitted_reference: RecurringFailureMode = Recur
   receipts: [
     "a string literal attests an emitted reference: a gate that must decide whether a name is SPELLED IN EMITTED CODE reads the emitted text whole, so a name that appears only inside a string literal -- prose the program carries as data -- passes as though the code paths into it. The Rust emitter's reference-derived use-line pass (v1.compiler.emit_rust reference_derived_use_line_plan) admits a proposed candidate only when its name is among the emitted source's identifier tokens; that attestation exists to reject misproposed candidates, and a prose mention defeated it.",
 
-    "SPECIMEN, found 2026-09-24 by the Pkg7e emitted-workspace plan (v2.workflow.emitted_crate_workspace), whose edge merge refused with EmitterReverseEdge std_content_hash -> v2_std_node. std.content_hash's grounding note names `v2.std.node.Hash`; a candidate `Hash` (v2.std.node declares `type Hash = Fnv1a64Structural`, an alias of std.content_hash's own type) passed the token gate on that prose, and std_content_hash.rs emitted `pub use crate::v2_std_node::\{Hash\};` -- used by nothing, harmless in one crate, and a reverse edge in any partition because v2.std.node imports std.content_hash.",
+    "SPECIMEN, found 2026-09-24 by the Pkg7e emitted-workspace plan (gunbc.emitted_crate_workspace), whose edge merge refused with EmitterReverseEdge std_content_hash -> v2_std_node. std.content_hash's grounding note names `v2.std.node.Hash`; a candidate `Hash` (v2.std.node declares `type Hash = Fnv1a64Structural`, an alias of std.content_hash's own type) passed the token gate on that prose, and std_content_hash.rs emitted `pub use crate::v2_std_node::\{Hash\};` -- used by nothing, harmless in one crate, and a reverse edge in any partition because v2.std.node imports std.content_hash.",
 
     "REPAIR at the gate, the earliest link that could not be justified: rust_code_outside_string_literals removes escaped backslashes and quotes, splits on the remaining quote characters and keeps the segments outside literals, and the emitted-token set is built from that. Measured: over a closure entering at v2.std.node the use-line is present before and absent after; across the whole seed the second generation drops eleven use-lines from six mirrors (v1.compiler.emit, emit_rust, infer, trait_derive_emit, gunbc occurrence_binding_parser_walk, and one claim module), every one a name that occurs in that module only inside a string literal; the seed compiles without them, and the following generation is a fixed point.",
 
diff --git a/dag/gunbc/recurring_failure_mode/a_termination_contract_is_met_by_a_trimming_transport.dag b/dag/gunbc/recurring_failure_mode/a_termination_contract_is_met_by_a_trimming_transport.dag
index 7966d6aaa40..448d0652e15 100644
--- a/dag/gunbc/recurring_failure_mode/a_termination_contract_is_met_by_a_trimming_transport.dag
+++ b/dag/gunbc/recurring_failure_mode/a_termination_contract_is_met_by_a_trimming_transport.dag
@@ -8,6 +8,7 @@ data a_termination_contract_is_met_by_a_trimming_transport: RecurringFailureMode
   identity: "a_termination_contract_is_met_by_a_trimming_transport" as NonEmptyStr,
 
   receipts: [
+    "2026-10-09, PR #13607: srv1 controller installation at edad20b0ded granted an exact sudo cat of its root-owned 0440 policy, then still refused content equality. The actual file ended in LF; bounded_shell_host_drain CapturedStreamEvidence::from_observation removed that byte with retained_utf8_lossy_trimmed before comparison. The repair measures the installed file with a narrowly granted sha256sum operation and hashes the complete expected bytes through stdin. The digest comparison retains the final-newline distinction without changing capture semantics or accepting trimmed policies. policy_digest_readback_preserves_final_newline_identity discriminates the two byte strings, absent output and refused execution. External privilege and custody still require live readback.",
     "**a reader whose contract is LINE TERMINATION is fed through a transport whose contract is TRIMMING** (each contract is sound in isolation and they compose to a false reading: the producer really finished, and the reader really reports unfinished.",
 
     "THE SHAPE. A reader of a stream being written concurrently must decide what counts as evidence, and the sound answer is TERMINATED LINES ONLY -- a final fragment with no newline is half a statement, and reading it would let a partially written value be read as a whole one. Independently, a capture transport normalizes what it hands back, and trailing-whitespace trimming is the near-universal convention for captured process output, because a caller comparing a captured word against a literal does not want the shell's newline. Neither party is wrong about its own subject. But the trim REMOVES THE EXACT BYTE the reader's contract depends on, so the producer's last line -- which is where terminators live: an END marker, a total, a verdict -- is silently dropped, and the reader reports the state it reserves for a producer that has not finished.",
diff --git a/dag/gunbc/recurring_failure_mode/adjacent_interpolation_holes_fused_into_one_operator_hole.dag b/dag/gunbc/recurring_failure_mode/adjacent_interpolation_holes_fused_into_one_operator_hole.dag
new file mode 100644
index 00000000000..42702c54d91
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/adjacent_interpolation_holes_fused_into_one_operator_hole.dag
@@ -0,0 +1,26 @@
+module gunbc.recurring_failure_mode.adjacent_interpolation_holes_fused_into_one_operator_hole
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data adjacent_interpolation_holes_fused_into_one_operator_hole: RecurringFailureMode = RecurringFailureMode {
+  identity: "adjacent_interpolation_holes_fused_into_one_operator_hole" as NonEmptyStr,
+
+  receipts: [
+    "**two interpolation holes separated only by an operator character are parsed by v1 as ONE hole holding a binary operation over both** (INVALID STATE: a template `\"\{s}-\{e}\"` or `\"\{st}/\{sp}\"` whose typed tree carries one Interpolation part, an ExprBinOp `s - e` / `st / sp`, where the source has two holes and a text part between them. The v1 lexer counts it correctly -- two holes, the `-` or `/` riding in the template-middle (ShStrMid) token -- and the parser is where the template is lost: the fused node's operator span IS that template-middle token, its source text `}-\{`, so the binary-operator loop inside the first hole (v1.compiler.parse parse_interp_parts calls parse_expr) accepted a template-middle token whose text is an operator as the operator, and consumed the second hole as its right operand.)",
+
+    "HARM: silent wrong output, no diagnostic anywhere (DESIGN section 5). v1 types the fused node, accepts it, and emits the arithmetic: extdeps.cron.schedule_model render_cron_field rendered `Ranged { start: 1, end: 5 }` as the DIFFERENCE of the two bounds where cron syntax needs the text 1-5, and a `Step` with a nonzero start as the QUOTIENT of start by step where it needs st/sp. Any rendered cron schedule with a range or an offset step was wrong. Deployment check at the time of filing: the corpus constructs exactly one CronSchedule (gunbc.tools.review cron_schedule, Step with start 0, which takes the one-hole `*/\{sp}` arm and renders correctly), no WorkflowTrigger Schedule is constructed, and no committed .github workflow carries a cron line -- so no live schedule was observed firing at the wrong time.",
+
+    "MEASURED BY: gunbc test //gunbc/instruments:interpolation-hole-census (v1.tests.claim.interpolation_hole_census), which recovers each fusion's operands as holes and marks them v1_fused_adjacent_holes; at main before gunbc#13436 it marked four holes in render_cron_field and no others, and its fixture control v1_fusion_recovered_as_two_holes holds on `\"\{path}/\{missing}\"`. The cron sites are rewritten as concat around the literal separator in gunbc#13436, and test.claim.cron_schedule_render_witness_test asserts a range renders as S-E and an offset step as ST/SP, on inputs where the arithmetic reading disagrees with the text.",
+
+    "RUNG FOUND AT: below the floor -- silent. CEILING: structurally guaranteed. Whether a token is a template part is decided by the lexer, so a hole's expression can refuse to continue across a template-middle token. NEXT-RUNG TRIGGER: v2's string-template production (XL-2 PR2b) parses each hole as an ordinary expression bounded by the template's own tokens, SUFFICIENT FOR `\"\{a}-\{b}\"` to lower to two holes and a text part, which the census fixture's fusion control discriminates. v1 is frozen and is not repaired here; its fusion stays measured until v1 is deleted.",
+
+    "RECOGNITION RULE: a template whose two holes are separated by nothing but a binary-operator character, in source v1 compiles (measured for `-` and `/`; other operator characters are the same shape and unmeasured); in the census, a row whose v1_parse column reads v1_fused_adjacent_holes."
+  ],
+
+  evidence: [
+    DeclarationRef { module_path: "extdeps.cron.schedule_model", decl_name: "render_cron_field", field: WholeDeclaration },
+    DeclarationRef { module_path: "test.claim.cron_schedule_render_witness_test", decl_name: "a_cron_range_renders_as_start_dash_end", field: WholeDeclaration }
+  ]
+}
diff --git a/dag/gunbc/recurring_failure_mode/alias_declaration_binding_row_not_carried.dag b/dag/gunbc/recurring_failure_mode/alias_declaration_binding_row_not_carried.dag
index 527d9dddbd9..66ca452d91e 100644
--- a/dag/gunbc/recurring_failure_mode/alias_declaration_binding_row_not_carried.dag
+++ b/dag/gunbc/recurring_failure_mode/alias_declaration_binding_row_not_carried.dag
@@ -8,11 +8,18 @@ data alias_declaration_binding_row_not_carried: RecurringFailureMode = Recurring
   identity: "alias_declaration_binding_row_not_carried" as NonEmptyStr,
 
   receipts: [
-    "**An `alias Name = a.b.C` declaration bound Name to its own grafted node on the native route, not to a.b.C** (INVALID STATE: the `alias` keyword form (dag_grammar_alias_decl_expr, kw_alias -- NOT a `type X = Y` type alias, which lowers as a type declaration) was lowered as metadata and grafted as a member named Name, and no alias binding row was read from the normalized tree, so symbol_index_lexical_lookup of Name HIT a node that is not the target. HARM: an accepted program whose alias name means something other than what it says -- a silent wrong answer (DESIGN section 5). DISTINGUISHING FACTS: measured at main 6296275 with v2.test.parse.alias_decl_parse alias_decl_fill_lexical_lookup_holds on the normalized route: target indexed, LexicalHit, hit != target, zero rows accepted by alias_binding_row_from_decl_node over the normalized tree. The claim was ungated and had been fed a raw parse tree, so the defect was invisible twice over (gunbc#13372 census). No .dag source declares an alias, so no compile closure reached it. RUNG FOUND AT: below the ladder (silent). INTERIM (operator ruling via stern-bear-500, 2026-10-05): the native normalize refuses the declaration, typed and located at it (v2.compiler.body_lowering_fold body_lower_alias_decl_refused), so the class now sits at structurally guaranteed-by-refusal with the form unusable. CEILING: structurally guaranteed -- an alias resolves to its declared target. NEXT-RUNG TRIGGER: alias rows carried through normalize so an alias name resolves to its target (owner: the resolve/namespace lane, sharp-raven-357 R1 / calm-ant-675); that change deletes body_lower_alias_decl_refused and turns the claim back to asserting the lexical hit equals the target.)",
+    "**An `alias Name = a.b.C` declaration bound Name to its own grafted node on the native route, not to a.b.C** (INVALID STATE: the `alias` keyword form (dag_grammar_alias_decl_expr, kw_alias -- NOT a `type X = Y` type alias, which lowers as a type declaration) was lowered as metadata and grafted as a member named Name, and no alias binding row was read from the normalized tree, so symbol_index_lexical_lookup of Name HIT a node that is not the target. HARM: an accepted program whose alias name means something other than what it says -- a silent wrong answer (DESIGN section 5). DISTINGUISHING FACTS: measured at main 6296275 with v2.test.parse.alias_decl_parse alias_decl_fill_lexical_lookup_holds on the normalized route: target indexed, LexicalHit, hit != target, zero rows accepted by alias_binding_row_from_decl_node over the normalized tree. The claim was ungated and had been fed a raw parse tree, so the defect was invisible twice over (gunbc#13372 census). No .dag source declares an alias, so no compile closure reached it. RUNG FOUND AT: below the ladder (silent). INTERIM (operator ruling via stern-bear-500, 2026-10-05, gunbc#13375): the native normalize refused the declaration, typed and located, so the form was unusable. CLIMBED (ruling B, carry, the grammar program, 2026-10-05): the alias is a ruled mechanism (docs/plans/namespace-resolution-design.md section 13, operator 2026-07-21), so it is carried rather than deleted -- the graft dissolves the declaration as it does an import (v2.compiler.namespace_graft namespace_graft_unit_disposition), normalize carries its row on import_bindings (v2.compiler.normalize import_binding_capture), and the symbol index fill binds it at the declaring module, so the name resolves to its target by unique-on-chain; the interim refusal arm is deleted. RUNG NOW: structurally guaranteed on the native normalize -> symbol index -> resolve path = CEILING. EVIDENCE (kept enrolled on the per-PR path, DESIGN section 4b(4); test.claim.parse_test_alias_decl_carry): the ROUTE claims -- the graft leaves no member named by the alias (the discriminating red: it is exactly the self-binding this class names, so it fails whenever the alias is grafted as a member again), normalize captures the one binding row, and the alias name resolves to its target; an alias to an undeclared target is unbound and resolve refuses resolve_reason_unbound_symbol at the reference; two imports of one name stay Ambiguous and an alias resolves one of them. OWNER: the grammar program lane. RESIDUE, recorded rather than fixed here: an alias whose target never resolves and that nothing references is accepted silently (unused, lintable dead code per section 13), and v2.compiler.symbol_index_fill symbol_index_alias_rows_of still reads alias rows from a raw root for hand-built fixtures, a second reader of the same row that the normalized route never reaches.)",
   ],
 
   evidence: [
-    DeclarationRef { module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lower_alias_decl_refused", field: WholeDeclaration },
-    DeclarationRef { module_path: "v2.test.parse.alias_decl_parse", decl_name: "alias_decl_fill_lexical_lookup_holds", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.compiler.namespace_graft", decl_name: "namespace_graft_unit_disposition", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.compiler.normalize", decl_name: "import_binding_capture", field: WholeDeclaration },
+    DeclarationRef { module_path: "test.claim.parse_test_alias_decl_carry", decl_name: "alias_decl_graft_dissolves_the_declaration_holds", field: WholeDeclaration },
+    DeclarationRef { module_path: "test.claim.parse_test_alias_decl_carry", decl_name: "alias_decl_normalize_captures_the_binding_row_holds", field: WholeDeclaration },
+    DeclarationRef { module_path: "test.claim.parse_test_alias_decl_carry", decl_name: "alias_decl_name_resolves_to_its_target_holds", field: WholeDeclaration },
+    DeclarationRef { module_path: "test.claim.parse_test_alias_decl_carry", decl_name: "alias_decl_to_an_undeclared_target_is_unbound_holds", field: WholeDeclaration },
+    DeclarationRef { module_path: "test.claim.parse_test_alias_decl_carry", decl_name: "alias_decl_to_an_undeclared_target_refuses_at_the_reference_holds", field: WholeDeclaration },
+    DeclarationRef { module_path: "test.claim.parse_test_alias_decl_carry", decl_name: "two_imports_of_one_name_stay_ambiguous_beside_an_alias_holds", field: WholeDeclaration },
+    DeclarationRef { module_path: "test.claim.parse_test_alias_decl_carry", decl_name: "an_alias_resolves_one_of_two_ambiguous_imports_holds", field: WholeDeclaration },
   ],
 }
diff --git a/dag/gunbc/recurring_failure_mode/an_imported_name_shadowed_by_a_kernel_name.dag b/dag/gunbc/recurring_failure_mode/an_imported_name_shadowed_by_a_kernel_name.dag
new file mode 100644
index 00000000000..25bc7f243d6
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/an_imported_name_shadowed_by_a_kernel_name.dag
@@ -0,0 +1,28 @@
+module gunbc.recurring_failure_mode.an_imported_name_shadowed_by_a_kernel_name
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data an_imported_name_shadowed_by_a_kernel_name: RecurringFailureMode = RecurringFailureMode {
+  identity: "an_imported_name_shadowed_by_a_kernel_name" as NonEmptyStr,
+
+  receipts: [
+    "an imported name shadowed by a kernel name -- residual after the Optional mint wall. v1.compiler.infer_env overlay_skips_kernel_name still sits above imports for the kernel types, the container spellings, Unit, Optional, Present, and Absent. lookup_binding still answers from env.bindings (declarations and named imports) before that overlay. INVALID STATE: one spelling, one module, two declarations, chosen by which lookup asks. The Optional instance of that fork is CLOSED: std.literal_elaboration kernel_named_import_standing / v1.compiler.resolve kernel_named_import_diags refuse a non-mint Optional import (gunbc.recurring_failure_mode.import_collides_with_a_kernel_name). The enrolled regression control is test.claim.infer_kernel_import_collision_witness importing_a_non_mint_optional_refuses_at_the_import (ImportCollidesWithKernelName). Names with no kernel_mint_declaration_rows row are KernelNamedImportAdmitted, so the two-lookup fork remains writable for every overlay_skips spelling that is not Optional.",
+
+    "RESIDUAL POPULATION: overlay_skips_kernel_name minus the one minted name. kernel_type_set is String, Int, Bool, Float, Secret, Json, Unit, Bytes; containers ride is_container_type; Present and Absent are listed beside Optional. Only Optional has a mint row (std.optional Optional). A module that declares a type of any other overlay name and is imported by that name is still admitted on v1, and the overlay can still disagree with lookup_binding. Dual-representation imports (v2.std.text String via carrier_by_spelling) are a declared admitted population, not this class -- a second String is a carrier pair, not a silent mint leak. A rival Int, List, Present, or other overlay spelling that is not a dual-rep carrier is this class.",
+
+    "HARM on the residual: silent wrongness (DESIGN section 5) wherever two readers take different paths on a non-mint overlay name. The Optional emit specimen (HeldChoice<present_value>) is historical of the closed instance; it is not the current red. FOUND 2026-10-06 on gunbc#13454 as the Optional instance; retargeted 2026-10-07 (cursor review 77440) once that instance climbed.",
+
+    "CURRENT RUNG: below the floor on the v1 residual -- the non-mint overlay import is still unrefused, so the two lookups can still disagree. The Optional path is mechanically preventable and is owned by import_collides_with_a_kernel_name; this row does not claim that rung. v2 already refuses an imported user Int at the reference (v2.test.claim.body_let_annotation bla_imported_user_int_refuses_rather_than_binding_the_kernel_int); that is a different class (kernel_type_spelling_captured_a_module_declaration) on a different compiler. ATTAINABLE CEILING: structurally guaranteed -- the residual collision is decidable at the import from overlay_skips_kernel_name and the mint-row set. NEXT-RUNG TRIGGER: the v1 import wall covers every overlay_skips spelling the same way Optional is covered (mint row or equivalent DeclarationRef ownership), except the declared dual-representation carriers, so a non-mint overlay import is unwritable and the two lookups can no longer disagree about it.",
+  ],
+
+  evidence: [
+    DeclarationRef { module_path: "v1.compiler.infer_env", decl_name: "overlay_skips_kernel_name", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1.compiler.infer_env", decl_name: "lookup_binding", field: WholeDeclaration },
+    DeclarationRef { module_path: "std.literal_elaboration", decl_name: "kernel_named_import_standing", field: WholeDeclaration },
+    DeclarationRef { module_path: "gunbc.structural_realization_bindings", decl_name: "kernel_mint_declaration_rows", field: WholeDeclaration },
+    DeclarationRef { module_path: "gunbc.recurring_failure_mode.import_collides_with_a_kernel_name", decl_name: "import_collides_with_a_kernel_name", field: WholeDeclaration },
+    DeclarationRef { module_path: "test.claim.infer_kernel_import_collision_witness", decl_name: "importing_a_non_mint_optional_refuses_at_the_import", field: WholeDeclaration },
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/anonymous_record_literal_refused_against_a_declared_record_type.dag b/dag/gunbc/recurring_failure_mode/anonymous_record_literal_refused_against_a_declared_record_type.dag
index 12986a2fbc2..8c46d37fa8c 100644
--- a/dag/gunbc/recurring_failure_mode/anonymous_record_literal_refused_against_a_declared_record_type.dag
+++ b/dag/gunbc/recurring_failure_mode/anonymous_record_literal_refused_against_a_declared_record_type.dag
@@ -10,6 +10,7 @@ data anonymous_record_literal_refused_against_a_declared_record_type: RecurringF
     "**v2 resolve refuses an anonymous record literal whose annotated type is a declared record** (INVALID STATE: a well-formed module is Rejected). `v2.test.long.cwc_resolution_probe` `cwc_cwc_module_resolve_accepts` normalizes `type CoproductWireContract { coproduct: String, encoding: VariantEncoding }` and `data review_event_wire_contract: CoproductWireContract = { coproduct: \"ReviewEvent\", encoding: StringVariant { naming: ScreamingSnakeCase } }`, and resolve refuses with `lve_anonymous_record_expected_type_not_record`. Measured by claim_batch on BuildBuddy, 2026-10-04, swift-bat-688, with a temporary probe claim reading the first diagnostic reason (not landed).",
     "DISTINGUISHING FACTS. The record is the one-line comma form, which 73 corpus files use; `v2.test.claim.body_lowering.anonymous_record_test` fixtures use the newline form and pass. Whether the form is the discriminator is NOT established. The writer that owns the refusal landed in gunbc#12740 (anonymous record literals elaborate from the authored annotation in resolve's construct-tag writer).",
     "RUNG FOUND AT: below the floor for the program (a false refusal, loud, not silent). Invisible to the floor because the witness module is outside the required gate and rostered in `gunbc.witness.witness_deferral_freeze`. NEXT TRIGGER: bisect the entry between gunbc#12740 and main; a newline-form control beside the comma form decides whether the declaration spelling is the cause.",
+    "CLIMBED (clever-raven-680, gunbc#13333). Earliest unjustified boundary: `v2.compiler.resolve` `build_program_namespace`, the single-tree door that `resolve(tree, lm)` uses. It is not #12740's writer. The door filled its symbol index under the module's path but left `module_qn` Empty, so any name that is not a root binding was looked up from the corpus root. A variant used as a value refused as `resolve_reason_unbound_symbol`. The door also passed `record_declarations: Empty`, so no declaration was marked `RecordTypePayload` and the writer correctly refused every headless record literal. The comma-versus-newline declaration form was NOT the discriminator: both refused, and so did a headed literal. Repair: `module_qn` is the declared module path and `record_declarations` is `normalized_tree_record_declarations` of the tree. Each half was shown necessary by an A/B in one BuildBuddy dispatch. EVIDENCE, enrolled and executing on the required floor: `v2.test.long.cwc_resolution_probe` `cwc_cwc_module_resolve_accepts` runs the real tokenize, parse, normalize and resolve route on this row's source and passes. It is admitted as a cost row, `v2.workflow.floor_cost_debt` `floor_cost_debt_proven_chunk_22`. The witness module's freeze row is retired. Supplied-root claims: `cwc_single_tree_variant_value_resolves` and `cwc_single_tree_headless_record_resolves` are red before the repair and green after. Controls: `cwc_single_tree_undeclared_variant_refuses` refuses with `resolve_reason_unbound_symbol` and `cwc_single_tree_headless_at_coproduct_refuses` refuses with `resolve_anonymous_record_expected_type_not_record`, so the door still refuses for those reasons. RUNG NOW: the false refusal no longer occurs on the single-tree door, and these claims are its regression controls.",
   ],
 
   evidence: [],
diff --git a/dag/gunbc/recurring_failure_mode/authored_text_fixtures_ground_nothing_at_infer.dag b/dag/gunbc/recurring_failure_mode/authored_text_fixtures_ground_nothing_at_infer.dag
new file mode 100644
index 00000000000..40749e54b29
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/authored_text_fixtures_ground_nothing_at_infer.dag
@@ -0,0 +1,25 @@
+module gunbc.recurring_failure_mode.authored_text_fixtures_ground_nothing_at_infer
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+
+data authored_text_fixtures_ground_nothing_at_infer: RecurringFailureMode = RecurringFailureMode {
+  identity: "authored_text_fixtures_ground_nothing_at_infer" as NonEmptyStr,
+
+  receipts: [
+    "a one-module program assembled from authored text through v2.compiler.program_assembly assemble_program_from_ingest resolves cleanly but grounds nothing at infer. INVALID STATE: the fixture module declares ordinary types and fns (records, coproducts, generic coproducts, param-fed constructions, variant-scrutinee matches -- exactly the shapes v2.test.claim.match_binder.match_binder_typing's mbt_decls uses), resolve accepts and the construct reads decode correctly (Boxed/Seal/Mk), and infer then reports a ~18-28-diagnostic cascade of infer_grounding_not_derived with inhabitance_undecidable_formal_unresolved and inhabitance_undecidable_argument_type_not_derived mid-chain, ending in a downstream refusal such as arrow_body_does_not_inhabit_declared_return -- so every fact-level reading in the module is underived. HARM: any claim that needs a grounded infer fact from an assembled-text fixture cannot obtain one, and the cascade's shape is identical across fixtures, so it does not point at any declaration. THE SILENT PART: no existing authored-text claim asserts a grounded infer fact -- the passing match_binder claims assert resolve-side structure or negative (not-yet-typed) states -- so nothing ever went red and the route's grounding was never exercised by a green run.",
+
+    "RECEIPT, 2026-10-06, session clever-bat-68, from the variant-scrutinee infer work (#13210), printed by reading the readings through the gunbc run --function decode route rather than inferred. The cascade reproduced on the probe's assembled combined fixture (data vfp_fixture_src in v2.test.claim.variant_field_infer_probe, since REPLACED by the lowered builders that receipt 3 sanctions -- the reproducing text is quoted in the PR #13210 probe history at commit 3ad555b), and independently on a minimal arrow-field module and a compound generic-alias module, while the same shapes ground in the real corpus compile (3054 modules resolved). The real pipeline and the fixture route differ somewhere between assembly and infer's grounding join; THE TWO CANDIDATE LINKS ARE UNDISTINGUISHED: (1) assemble_program_from_ingest's wiring does not deliver to infer what the real pipeline's assembly delivers (binding table / builtins the grounding join reads), or (2) the floor's claim-execution context does not supply it. Distinguishing them needs an instrument inside the grounding join, which is out of scope here.",
+
+    "RUNG FOUND AT: below the ladder -- the cascade is silent about the route-level cause: no diagnostic says the assembled program lacks the grounding context the real pipeline supplies; the reader is handed a module-wide failure that reads like per-binding ungroundability. ATTAINABLE CEILING: structurally decidable -- the real pipeline grounds the same shapes, so the difference is a wiring fact, findable by comparing what the two assembly routes hand infer. NEXT-RUNG TRIGGER: either assemble_program_from_ingest delivers the grounding context so an assembled-text fixture's facts derive like the corpus's, or the route refuses with a diagnostic naming the missing grounding context -- so a fact-level claim on an authored-text fixture either holds or is told why it cannot. SANCTIONED WORKAROUND (DESIGN 3's witness rule): supply the subject as a LOWERED VALUE through the real pipeline's data path (v2.test.lens_common.resolve_fixture: namespace_graft + body_lowering_fold + admit_normalized_tree) for fact-level claims; authored text remains valid for resolve-side and refusal controls. NOT FIXED IN #13210: #13210's probe switches its fact-level claims to the lowered-value route and this row records the route defect for its own follow-up.",
+
+    "RECEIPT, 2026-10-07, session clever-bat-68, SCOPE NARROWED, and the sanctioned workaround RETIRED from the probe. The earlier diagnosis was shape-relative, not route-uniform: on #13210's head, NON-generic authored-text fixtures ground fact-level reads through assemble_program_from_ingest -- the arrow fixture's arm binder (payload shorthand over a nullary call-result scrutinee) reads ^Int from the inferred facts on an Accepted-with-advisories walk, and the construct reads name their variants (Pass/Ok) -- so the headline 'grounds nothing' was too strong and this row's sanction no longer binds those shapes. #13210's probe has switched its fact-level claims BACK to the text route and deleted the hand-lowered builders receipt 3 sanctioned; the workaround is not used anywhere the route grounds. WHAT REMAINS: the two-arm named-variant coproduct rows still refuse on the assembled route (infer_match_arm_type_mismatch, terminal and anchored at the match node, between a payload binder's payload-typed fact and an integer literal arm's binding-denotation type) while the resolver's binder records carry the payload type -- under active bisect in #13210, NOT yet reproduced off the assembled route (the corpus floor and the enrolled native claims do not refuse on this shape), so the route-vs-context question stays open for that shape and this row keeps its next-rung trigger for it. #13210's probe now states this honestly: its two-arm typed-fact rows are DECLARED REDS on that located defect (asserting the terminal reason), the positive evidence for the typed payload-binder fact rides the arrow fixture's accepted-with-advisories walk (binder = ^Int) and the enrolled native claims on the real route, and the call-result scrutinee's underived fact at this route is pinned by its own declared red. RE-RUN, 2026-10-08, twice. First the untyped shape (03_resolve's resolve_payload_field_type_holds_declaring_formal left the binder untyped; the fixture's arm fact read the underived marker). Then side-chat review 5452786886 ruled that shape FAIL-OPEN -- infer_lexical_reference_facts maps the untyped binding to an advisory, the match frontier accepts, inhabitance_undecidable_accepted returns Accepted, and the native lane reports the module prepared -- so the binders fold now REFUSES the arm walk at resolve (^resolve_reason_pattern_payload_formal_uninstantiated, at the payload field), enrolled as vfp_the_formal_payload_binder_refuses_at_prepare_red (the fixture refuses with exactly that reason and construct_read = vfp_refused_at_resolve) beside vfp_the_concrete_payload_sibling_still_prepares_holds (the same two-arm shape with a concrete Int payload prepares). The generic shapes sit at a typed refusal rung and stay inside this row's scope for the derivation follow-up, which flips the refusal to grounding by installing the scrutinee's arguments.",
+
+    "RECEIPT ADDENDUM, 2026-10-07, session clever-bat-68, the N7 corpus measurement locates this row's underived-facts family on the REAL corpus (silent-deer-637, session sharp-raven-357's lane): at #13210 cbaef71a3a (pinned tree b45bedcb), all 8 members of //v2/test/parse/expression_bodied_fn_decl_parse:all refuse at PREPARE with record_field_value_does_not_inhabit, at test-file offset 509 (seed 2891478, node #2891987) -- the payload binder d at g_tokenize_parse line 38, `Rejected { diagnostics: d } => Rejected { diagnostics: d }` over dag_prepared_grammar(), a call-result scrutinee whose Rejected arm binds the payload and consumes it as a CONSTRUCT's field value. Measured on the assembled route the same day: the mirrored fixture (binder in the Rejected arm, consumed as a construct field value) walks to the SAME terminal reason (the walk's last diagnostic is record_field_value_does_not_inhabit; its first is infer_grounding_not_derived), decode-verified -- so the corpus prepare refusal and this row's infer-stage family are the same defect, and the corpus facts sharpen the location: the arm-body binder DERIVES on the arrow fixture (green), the CONSTRUCT-FIELD-consumed binder does not. #13210 pinned this facet as the declared red vfp_the_n7_shape_construct_field_binder_stays_underived_red (== ^record_field_value_does_not_inhabit, decode-verified true) and REMOVED it at 384d12093c before merge: the honest own-frame walk measured 701,440 eval steps against the 72,300 new-witness enrolment ceiling (the same cost class gunbc.recurring_failure_mode.a_generic_variant_construct_infer_walk_costs_about_seven_times_the_new_witness_ceiling records); the N7 successor lane (silent-deer-637) carries it -- its first stacked change lands the red flipped on top of #13210, with the own-frame measurement caution on record; it flips with the derived-fact derivation landing (the deep-instantiation / grounding follow-up), at which point the corpus link re-measures green.",
+  ],
+
+  evidence: [
+    DeclarationRef { module_path: "v2.compiler.program_assembly", decl_name: "assemble_program_from_ingest", field: WholeDeclaration },
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/bare_name_resolved_by_proximity_standing_in_for_resolution.dag b/dag/gunbc/recurring_failure_mode/bare_name_resolved_by_proximity_standing_in_for_resolution.dag
index 9a7dd14eaf0..ce9b9f30650 100644
--- a/dag/gunbc/recurring_failure_mode/bare_name_resolved_by_proximity_standing_in_for_resolution.dag
+++ b/dag/gunbc/recurring_failure_mode/bare_name_resolved_by_proximity_standing_in_for_resolution.dag
@@ -13,11 +13,11 @@ data bare_name_resolved_by_proximity_standing_in_for_resolution: RecurringFailur
 
     "SPECIMEN (gunbc#13526, open when this row was written): a supplied fixture declaring a homonym `Present` beside `std.optional { Present }` produced an edge from an importer of `std.optional` to the homonym's module while the reader still resolved by proximity. #13526 closed the arm for import-BEARING files (bare names there are lexically bound, only qualified chains become edges) and kept the proximity tier for import-less files only.",
 
-    "RUNG: BELOW THE FLOOR for the surviving import-less path -- silent wrongness, which is outside the ladder (§4b) and forbidden outright, not a mitigation rung. A bare name in an import-less file whose declarer the proximity rule picks wrongly yields an edge with no refusal, and the UniqueBare/AmbiguousBare typing does not make that visible to the consumer that reads the edge. For import-BEARING files the class is closed: #13526 removed the tier there (bare names are lexically bound), which is the only executed wall. CEILING 3, structurally guaranteed, at the boundary SOURCE -> ACCEPTED GRAPH: no Accepted graph contains a proximity-guessed edge. Bare names are decidable by lexical resolution, so a bare name either binds lexically or the source is refused before any graph is accepted; a runtime typed refusal at the reader alone would be mitigation and does not establish this rung. No grounding is missing.",
+    "RUNG FOUND AT (gunbc#13533): silent wrongness on the import-less UniqueBare path, outside the ladder. Import-bearing files were already closed by #13526.",
 
-    "EVIDENCE, STATED PLAINLY: there is NO executing evidence for the wrong-edge RED on the import-less path. The homonym RED in the open #13526 covers import-bearing files, where the tier no longer runs. The only executed control on the surviving path is a unit control added by the open gunbc#13526 (an import-less file resolving a bare name to a single pool declarer), which shows the proximity tier is LIVE for an import-less file resolving a bare name to a single pool declarer; it is not a discriminating RED for a wrong edge, so it does not establish a rung. A supplied-fixture RED (an import-less file whose bare name has a homonym, asserting the wrong proximity edge) is the missing evidence.",
+    "EVIDENCE, EXECUTED (gunbc#13579): two populations, not one. (a) Longest-common-prefix ranking among homonyms -- RED `cli_run` `reference_edge_producer_tests` `proximity_must_not_bind_an_importless_bare_name_to_a_sibling_homonym` over the real `dependency_resolution_facts` union. Fixture: `frontier.child.consumer` calls `duplicated()`; `frontier` and `frontier.child.plant` both declare it. RED captured on the merge-base ranking (entry_resolve.rs identical at 17ebbde83b and 82a3edfea3): `proximity UniqueBare bound the sibling plant: [\"frontier.child.plant\"]`. After the climb that test is the producer regression control; positive `an_importless_bare_name_on_the_ancestor_chain_still_resolves`. (b) Census-unique off-chain UniqueBinding -- `unique_off_chain_bare_name_compiles_and_keeps_its_uniquebare_edge` proves `test.user` can call `test.decl.shared_fn` with no import and no ancestor, and the producer keeps UniqueBare because UniqueBinding still accepts. Two off-chain homonyms: `off_chain_homonym_with_no_lexical_binder_is_refused_on_the_resolve_path` runs `compile_sources` over `load_sources_for_entry_with_pool` (not `resolve_entry_with_index`) and asserts blocking compile failure containing `function 'shared' not found in scope`; it is not a typed-and-located diagnostic identity. Live dag+src/v2 UniqueBare identity is unchanged (gunbc#13579).",
 
-    "NEXT-RUNG TRIGGER: bare names resolve lexically (locals plus imports) or the source is refused, so no Accepted graph carries a proximity-ranked edge; the proximity tier is deleted. The trigger is satisfied only by IMPORT-LESS evidence: (1) a wrong-edge RED on the import-less path -- a supplied-fixture import-less file whose bare name has a pool homonym must get NO proximity edge (or a refusal) -- and (2) a valid-binding positive control, an import-less file whose bare name is lexically bound and keeps its edge. An import-bearing RED does not count: it passes while its import-less companion keeps the guessed edge. Both stay enrolled as permanent controls.",
+    "RUNG NOW: (a) longest-common-prefix ranking among homonyms is mechanically preventable (rung 2) on the UniqueBare producer -- the RED is the producer's edge set. (b) census-unique off-chain GlobalBareUniqueBinding remains OUTSIDE the lexical guarantee; `pick_importless_bare`'s `mods.len() == 1` arm is not a lexical-scope proof, and `global_bare_lookup_candidates` UniqueBinding does not check the ancestor chain. Those UniqueBare edges stay in the reader until canonical acceptance and edge derivation change together -- dropping them from the reader alone would undercount an accepted call. The row's minimum is (b), not 2. A written import is a legitimate lexical binding even when its target is not an ancestor -- the guarantee forbids bindings without lexical authority, not off-chain references in general. CEILING 3 at source -> accepted graph. NEXT-RUNG TRIGGER: GlobalBareUniqueBinding of a name with no lexical authority is refused, and this producer stops emitting UniqueBare for that case in the same change.",
 
     "REVIEW TELL: a reader or resolver that ranks candidate declarers by path similarity, shared prefix or 'closest' instead of refusing; an edge whose only justification is that one pool declarer exists.",
   ],
diff --git a/dag/gunbc/recurring_failure_mode/bare_reference_channel_declines_a_pull_in_silence.dag b/dag/gunbc/recurring_failure_mode/bare_reference_channel_declines_a_pull_in_silence.dag
index 3b14c05d89b..71be4866645 100644
--- a/dag/gunbc/recurring_failure_mode/bare_reference_channel_declines_a_pull_in_silence.dag
+++ b/dag/gunbc/recurring_failure_mode/bare_reference_channel_declines_a_pull_in_silence.dag
@@ -33,7 +33,7 @@ data bare_reference_channel_declines_a_pull_in_silence: RecurringFailureMode = R
     "THE DEEPER READING, kept separate because it is a proposal and not a measurement: `pullable` is a HEURISTIC standing where a decidable fact was available. The kind of the declaration the census resolved to is known exactly; the predicate instead asks four proxy questions about the node's shape and declines on all-no. DESIGN section 4 rules that in a closed system a heuristic is never necessary, and section 5 names the confidence threshold that selects such an arm as the tell that LOCATES anemic modelling. The principled repair is to pull the declarer of any bare name the census resolved, whatever its shape, and to price the resulting closure growth rather than guess at it -- which is a measured change to closure size across the corpus, not an edit that can ride in on this row.",
 
     "REVIEW TELL: a module with NO import header at all is not tidy, it is on the bare channel; a module with ONE import line has the channel off and is relying on that list being complete. An `unlisted import use` advisory is the loader telling you a name resolved through the census -- for a coproduct or record it also pulled, for an alias it did not. And an `effect summary incomplete` error over a callee whose own module is reported unresolved elsewhere in the SAME run is this class, not an effect-modelling gap.",
-    "LIVE RECEIPT, Pkg14 (2026-09-22): the row's partial-import sentence, realized. `v2.test.claim.compiler_materialization_witness` carried TWO import lines (std.realization, v2.std.diagnostic) and bare-referenced 27 declarations in four modules it did not import -- `v2.compiler.materialization_carriers`, `v2.compiler.parse`, `extdeps.realization.compile_stage_memo`, `extdeps.realization.parse_table_memo`. Gate one turned the bare channel off for the file, so `claim_batch --print-entry-closure` showed a closure of 74 files with none of the four, every name resolved through the census, and `claim_batch --entry` on the module refused with 30 `effect summary incomplete: <claim> calls <callee>, whose identity is established but names no registry row` errors: the module's claims could not run locally at all, only on the required floor. Two of the 27 callees were `data` declarations (`compile_stage_memo_id`, `parse_table_memo_id`), which sent three lanes after the REFERENCE SHAPE -- every data reference, a name collision with a near-twin fn, `==` with a literal or resolved left operand -- over four probes in `v2.test.provenance.parse_memo_frame_replay`, a ZERO-import module whose closure already held all three of the modules those probes touched, so no probe could reproduce it. A `data` callee is not a defect: `v1.compiler.infer` `analyze_item` gives an initialised data declaration a zero-arg signature and `build_item_info` gives every item a registry row, so it joins whenever its module is realized. REPAIR: the witness imports every name it references (closure 97 modules, all 13 claims PASS locally, 0 effect-summary errors); nothing in the loader or the effect join changed, because the refusal was correct. NO NEW FIXTURE: gate one is already discriminated by `fixtures/bare_reference_channel/imported_record_consumer`. SIZING IS NOT RECORDED because no available reader can produce it: `v1_compiler.cli_run` `bare_reference_channel_readings` answers whether the bare half ran and what it pulled, not which names a gate-one file resolved through the census; a count of files with an import line is an upper bound on exposure, not the class. The count waits on this row's CEILING TRIGGER, the per-file decline carrier.",
+    "LIVE RECEIPT, Pkg14 (2026-09-22): the row's partial-import sentence, realized. `v2.test.claim.compiler_materialization_witness` carried TWO import lines (std.realization, v2.std.diagnostic) and bare-referenced 27 declarations in four modules it did not import -- `v2.compiler.materialization_carriers`, `v2.compiler.parse`, `extdeps.realization.compile_stage_memo`, `extdeps.realization.parse_table_memo` (that module and `parse_table_memo_id` were later deleted with the parse memo carrier, operator ruling R2 2026-10-08). Gate one turned the bare channel off for the file, so `claim_batch --print-entry-closure` showed a closure of 74 files with none of the four, every name resolved through the census, and `claim_batch --entry` on the module refused with 30 `effect summary incomplete: <claim> calls <callee>, whose identity is established but names no registry row` errors: the module's claims could not run locally at all, only on the required floor. Two of the 27 callees were `data` declarations (`compile_stage_memo_id`, `parse_table_memo_id`), which sent three lanes after the REFERENCE SHAPE -- every data reference, a name collision with a near-twin fn, `==` with a literal or resolved left operand -- over four probes in `v2.test.provenance.parse_memo_frame_replay`, a ZERO-import module whose closure already held all three of the modules those probes touched, so no probe could reproduce it. A `data` callee is not a defect: `v1.compiler.infer` `analyze_item` gives an initialised data declaration a zero-arg signature and `build_item_info` gives every item a registry row, so it joins whenever its module is realized. REPAIR: the witness imports every name it references (closure 97 modules, all 13 claims PASS locally, 0 effect-summary errors); nothing in the loader or the effect join changed, because the refusal was correct. NO NEW FIXTURE: gate one is already discriminated by `fixtures/bare_reference_channel/imported_record_consumer`. SIZING IS NOT RECORDED because no available reader can produce it: `v1_compiler.cli_run` `bare_reference_channel_readings` answers whether the bare half ran and what it pulled, not which names a gate-one file resolved through the census; a count of files with an import line is an upper bound on exposure, not the class. The count waits on this row's CEILING TRIGGER, the per-file decline carrier.",
     "RECEIPT 2026-09-23 (wise-ibex-457), GATE ONE IS A POPULATION, NOT AN INCIDENT, AND THE FLOOR CANNOT SEE ANY OF IT. SPECIMENS, each a partial-import witness file that claim_batch --entry refused with this row's registry-row symptom on main, named so each is re-checkable by running it: test.claim.host_standup_assimilation_deduction (all 11 claims), and host_standup_spine, host_phase_status, fleet_intent_network, ci_failure_class, roadmap_launch_deployment_receipt and samsung_dram_module under dag/test/claim. CONTROLS, run the same way and evaluating: zero-import files (machine_word, host_build_cache_provision_design, cargo_target_path, tokenize_stage) and partial-import files whose callees all lie inside their import closure (github_app_registry, output_policy, approval_decision_store). WHY THE FLOOR DOES NOT SEE IT: floor preparation serves every entry through v1_compiler.cli_run whole_pool_closure_edge_index, so every module is realized and the gate-one decline never reaches the registry join -- gunbc#11989's floor run lists the first specimen's claims planned_as_changed_witness outcome=passed while claim_batch --entry refused all eleven. The two routes share the gate-one derivation; they differ only in whether closure membership is consulted. SIZE IS NOT RECORDED HERE, for the reason the Pkg14 receipt gives: the membership rule is decidable (a file with an import line that calls a declaration outside its transitive import closure), but no entry point computes it yet, and a count copied from a one-off scan would rot at the first repaired file (DESIGN section 6). SPECIMEN REPAIR: gunbc#12191 imports every name the first specimen calls; its claims evaluate under --entry and a mutated expected verdict turns its first claim FAIL.",
 
     "GATE ONE STAYS, AND WHY: THE DEEPER READING WAS MEASURED AND REFUSED ON COST (2026-09-24, wise-ibex-457, ruled by the parent lane). The proposal above -- pull the declarer of every census-resolved bare name whatever the file's import header -- was built as two claim_batch binaries from main cc90b751bb7 that differ ONLY in removing `source_declares_import_lines` from `v1_compiler.cli_run` `admit_pool_bare_references` and `build_both_closure_edge_index`, and each witness below was run under `claim_batch --entry` with all its claims. Reproduce by rebuilding that pair; the figures are that experiment's and are not a standing measurement. Gate on -> gate off, (entry-closure files; per-shard peak RSS; wall): test.claim.host_standup_spine 114 -> 914 files, peak unreported (the gate-on run refused first) -> 10.7 GiB, 174s -> 337s, every claim refused -> 21/21 PASS; test.claim.host_phase_status 114 -> 917, unreported -> 10.8 GiB, 190s -> 325s, refused -> 30/30 PASS; test.claim.fleet_converge_plan 1727 -> 1862, 14.7 -> 15.3 GiB, 492s -> 547s, verdicts unchanged; test.claim.long.roadmap_page 760 -> 838, 10.2 -> 10.5 GiB; v2.test.claim.provenance.occurrence_file_attribution 206 -> 212, 8.7 -> 8.7 GiB. Whole-pool admission refused nothing new. THE STOP: fleet_converge_plan crosses the 15.0 GiB admitted entry budget that gunbc#11092 measured against, from a baseline already at 14.7. THE MECHANISM, which is why the growth is not the witness's own: removing the gate turns the bare channel on for EVERY partial-import module already in the closure, production modules included, so a witness's closure grows by those modules' own bare pulls, transitively -- 114 -> 914 is mostly passengers. The specimen repaired by imports alone (gunbc#12191) evaluates at 10.4 GiB with the gate kept.",
diff --git a/dag/gunbc/recurring_failure_mode/bind_helper_overlaps_the_controller_in_its_single_process_budget.dag b/dag/gunbc/recurring_failure_mode/bind_helper_overlaps_the_controller_in_its_single_process_budget.dag
new file mode 100644
index 00000000000..51b94c7d20f
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/bind_helper_overlaps_the_controller_in_its_single_process_budget.dag
@@ -0,0 +1,15 @@
+module gunbc.recurring_failure_mode.bind_helper_overlaps_the_controller_in_its_single_process_budget
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data bind_helper_overlaps_the_controller_in_its_single_process_budget: RecurringFailureMode = RecurringFailureMode {
+  identity: "bind_helper_overlaps_the_controller_in_its_single_process_budget" as NonEmptyStr,
+  receipts: [
+    "2026-10-09, PR #13607, pre-commissioning review: workspace_executor_submit_once started the controller and immediately invoked the bind interpreter in the same 24 GiB controller slice. The slice budget derives from one compiler preparation plus headroom; scheduling a second preparation does not establish that their aggregate fits. Bringup interpreters were using multiple GiB each. No live commissioning OOM is claimed: the defect was found before submission.",
+    "The controller already publishes its invocation through workspace_executor_claim_controller before commissioning effects. The executor's bind remains useful for independent readback and a controller that fails before claiming, but it need not overlap controller execution. Move it after the existing bounded wait has observed the exact invocation inactive, with MainPID zero and no pending job. The bind helper still independently checks manager identity, executor membership and exact mutation generation, so replacement after the wait refuses. The prior unbound-submission fence/drain recovery path remains intact.",
+    "Executed discriminator: the local bringup experiment target/srv1-bringup-evidence/executor-bind-order-controls.py runs the actual emitted Bash against bounded helper and manager doubles. The predecessor attempts bind while active and exits 73; the revised start and drain paths complete. Replaced invocation and surviving PID refuse before finish; a readable but incorrect finish result refuses. Wait, settlement and completion replay retain their behavior. These are manual native-transport controls, not hermetic floor evidence or a measurement of recovery-path memory.",
+    "Rung: the normal start path now orders the bind process after observed controller termination; live systemd state remains an external readback obligation. This does not establish aggregate resource qualification for every recovery helper or externally started controller. Ceiling and next trigger: a consumed resource admission model for concurrently resident controller/helper processes, discriminated on all normal and recovery routes. Source-level sequencing alone cannot prove a host-memory bound over external starts.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/call_expression_erased_at_v2_body_lowering.dag b/dag/gunbc/recurring_failure_mode/call_expression_erased_at_v2_body_lowering.dag
index c57f4097a71..211f7fd3c68 100644
--- a/dag/gunbc/recurring_failure_mode/call_expression_erased_at_v2_body_lowering.dag
+++ b/dag/gunbc/recurring_failure_mode/call_expression_erased_at_v2_body_lowering.dag
@@ -34,7 +34,7 @@ data call_expression_erased_at_v2_body_lowering: RecurringFailureMode = Recurrin
 
     "THE ARGUMENT HALF, REPAIRED, AND A CORRECTION TO THIS ROW'S OWN PREMISE (2026-09-23, gunbc#12108, merge b0d307c31b, measured_at b8e0cc4eb9). The premise elsewhere in the XL-2 program that call arguments were represented after lowering was FALSE, and this row's earlier reading that named-argument VALUES survive as positional operands does not hold for plain calls on the production normalize route: v2.compiler.body_lowering_fold body_lower_call_args_from_capture asked the PARAMETER-list spine reader for a comma spine, that reader answered Present on the first argument's inner sequence because an argument capture arrives with its parentheses already consumed, and the collector beneath it found nothing -- so every argument of a plain call, named or positional, lowered to a call with ZERO arguments, and the fact was absent from the normalized tree rather than lost between the tree and the denominator. The repair is a structural, fail-closed reader of the grammar's own comma-list shape that refuses any position it cannot read. Executed: v2.test.claim.namespace_xl0.call_argument_mention_survival a_call_argument_mention_is_reachable_by_the_collector_holds and its positional and tree-grain rows, and v2.test.claim.namespace_xl0.call_argument_resolve_refusal, whose undeclared named and positional argument rows refuse at resolve located at the argument and FAIL on b8e0cc4eb9. This discharges clause (ii)'s argument analogue and clause (iii) for plain calls; it does NOT fire this row's trigger, which still names argument-dependent NATIVE execution over the whole call population; the mid-chain call (a.f().b) is the preceding receipt's. The XL-2 carrier records this as gunbc.compiler_frontend_program_status Xl2Prerequisite PlainCallArgumentReferenceVisibility.",
 
-    "THE CALL-THEN-FIELD RESIDUE, AND A SILENT TRUNCATION FOUND ON THE WAY (2026-09-25, MQ-1, fierce-boar-95). warm-bear-132's chunk c02590 (v2.compiler.parse parse_memo_recurrence_census: `acc + expr_parse_demand_fold(expr: p.expression).discarding_sites`) refused operator_operand_unread once gunbc#12210 lowered the enclosing fn literal. Re-deriving the slice found TWO boundaries. (1) The chain door v2.compiler.body_lowering_fold body_lower_postfix_chain_lowered_from_steps could lower a head that was a bare segment or an operand reference, but not a RAW call: on the top-down walker route the head `f(x)` is still a primary carrying its call suffix, so the door declined and the operand refused. A call head now takes the one computed-head path cast chains use (body_lower_postfix_cast_chain_computed_head, lowering the head through body_lower_primary_expr, gated by body_lower_postfix_head_is_call), and every step after it folds as it does off any value. (2) Worse and silent: the projection the chain fold produces (v2.std.node_query field_projection_node) was not recognised by body_lower_is_core_substrate, so on the bottom-up route every reader above the postfix reduce -- an operator operand, a paren group, a unary operand -- re-read it as unlowered and descended to its BASE: `p + g(x).a` lowered to `p + g(x)` with no diagnostic, while a match scrutinee (read through body_lower_value_lowered) kept it. The predicate now admits the projection through field_projection_optional, the construct arm's reason. (3) Reference conservation then refused the projected field as a dropped reference while the field atom carried the whole chain's occurrence; that is now closed by #12210's own change, which carries each step's segment as its authored node (PostfixProjection.segment: Node, field_projection_node's field a Node), and the conservation control below holds over it. Controls: v2.test.claim.namespace_xl0.value_position_whole_read a_field_projection_on_a_call_result_in_an_operand_lowers_whole and a_two_step_projection_on_a_call_result_lowers_every_step, and v2.test.claim.namespace_xl0.reference_conservation_admission a_field_projection_on_a_call_result_in_an_operand_is_admitted_holds; removing either change reds them (measured).",
+    "THE CALL-THEN-FIELD RESIDUE, AND A SILENT TRUNCATION FOUND ON THE WAY (2026-09-25, MQ-1, fierce-boar-95). warm-bear-132's chunk c02590 (v2.compiler.parse parse_memo_recurrence_census: `acc + expr_parse_demand_fold(expr: p.expression).discarding_sites`; both later deleted with the parse memo carrier, operator ruling R2 2026-10-08) refused operator_operand_unread once gunbc#12210 lowered the enclosing fn literal. Re-deriving the slice found TWO boundaries. (1) The chain door v2.compiler.body_lowering_fold body_lower_postfix_chain_lowered_from_steps could lower a head that was a bare segment or an operand reference, but not a RAW call: on the top-down walker route the head `f(x)` is still a primary carrying its call suffix, so the door declined and the operand refused. A call head now takes the one computed-head path cast chains use (body_lower_postfix_cast_chain_computed_head, lowering the head through body_lower_primary_expr, gated by body_lower_postfix_head_is_call), and every step after it folds as it does off any value. (2) Worse and silent: the projection the chain fold produces (v2.std.node_query field_projection_node) was not recognised by body_lower_is_core_substrate, so on the bottom-up route every reader above the postfix reduce -- an operator operand, a paren group, a unary operand -- re-read it as unlowered and descended to its BASE: `p + g(x).a` lowered to `p + g(x)` with no diagnostic, while a match scrutinee (read through body_lower_value_lowered) kept it. The predicate now admits the projection through field_projection_optional, the construct arm's reason. (3) Reference conservation then refused the projected field as a dropped reference while the field atom carried the whole chain's occurrence; that is now closed by #12210's own change, which carries each step's segment as its authored node (PostfixProjection.segment: Node, field_projection_node's field a Node), and the conservation control below holds over it. Controls: v2.test.claim.namespace_xl0.value_position_whole_read a_field_projection_on_a_call_result_in_an_operand_lowers_whole and a_two_step_projection_on_a_call_result_lowers_every_step, and v2.test.claim.namespace_xl0.reference_conservation_admission a_field_projection_on_a_call_result_in_an_operand_is_admitted_holds; removing either change reds them (measured).",
   ],
 
   evidence: [],
diff --git a/dag/gunbc/recurring_failure_mode/carrier_by_spelling.dag b/dag/gunbc/recurring_failure_mode/carrier_by_spelling.dag
index 0360e6ee250..b8030b23ce8 100644
--- a/dag/gunbc/recurring_failure_mode/carrier_by_spelling.dag
+++ b/dag/gunbc/recurring_failure_mode/carrier_by_spelling.dag
@@ -8,7 +8,7 @@ data carrier_by_spelling: RecurringFailureMode = RecurringFailureMode {
   identity: "carrier_by_spelling" as NonEmptyStr,
 
   receipts: [
-    "**carrier by spelling** (INVALID STATE: a module imports the structural text carrier `v2.std.text` `String` and then authors a BARE `String` as if that import bound it; KERNEL NAMES ARE NEVER OVERRIDDEN BY IMPORTS (`v1.compiler.infer` `overlay_skips_kernel_name`, kernel overlay unconditional since #9813), so the bare spelling binds the KERNEL host carrier beside the unused import.",
+    "**carrier by spelling** (INVALID STATE: a module imports the structural text carrier `v2.std.text` `String` and then authors a BARE `String` as if that import bound it; KERNEL NAMES ARE NEVER OVERRIDDEN BY IMPORTS (`v1.compiler.infer_env` `overlay_skips_kernel_name`, kernel overlay unconditional since #9813), so the bare spelling binds the KERNEL host carrier beside the unused import.",
 
     "A host-carrier value can therefore flow into a fold whose declared positions are the STRUCTURAL carrier, and the front end ACCEPTS the program.",
 
@@ -46,7 +46,7 @@ data carrier_by_spelling: RecurringFailureMode = RecurringFailureMode {
   ],
 
   evidence: [
-    DeclarationRef { module_path: "v1.compiler.infer", decl_name: "overlay_skips_kernel_name", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1.compiler.infer_env", decl_name: "overlay_skips_kernel_name", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.rust_source_type_bindings", decl_name: "checkpoint_row_migration_rows", field: WholeDeclaration },
     DeclarationRef { module_path: "test.claim.self_host_structural_text_witness_test", decl_name: "w_bare_string_with_text_import_stays_host_deterministically", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.self_host_compile_phase_frontier", decl_name: "receipt_2_66765317_raw_error_diagnostic_identities", field: WholeDeclaration },
diff --git a/dag/gunbc/recurring_failure_mode/cell_add_overrides_the_slot_cpu_policy.dag b/dag/gunbc/recurring_failure_mode/cell_add_overrides_the_slot_cpu_policy.dag
new file mode 100644
index 00000000000..a2c59562fdf
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/cell_add_overrides_the_slot_cpu_policy.dag
@@ -0,0 +1,14 @@
+module gunbc.recurring_failure_mode.cell_add_overrides_the_slot_cpu_policy
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data cell_add_overrides_the_slot_cpu_policy: RecurringFailureMode = RecurringFailureMode {
+  identity: "cell_add_overrides_the_slot_cpu_policy" as NonEmptyStr,
+  receipts: [
+    "2026-10-09, PR #13607: commissioning at f99e440ce59 refused the cell-boundary digest. Independent systemd readback found CPUQuotaPerSecUSec=infinity while all five other fields matched. The persisted quota drop-in dates to the initial 03:47:23 cell apply, whose FullyApplied terminal recorded successful commands, not full boundary convergence. The MemberAdded realization passed the fleet-wide unlimited quota into a slot-specific renderer, overriding srv1-13's declared four-CPU limit.",
+    "Repair: the production boundary-add constructor now accepts only a slot and derives every directive from its desired row. The fixture quota renderer remains available for its bounded/unbounded controls. A regression drives the actual MemberAdded dispatch and requires CPUQuota=400%, with no unlimited assignment.",
+    "Existing-state repair is limited to an enrolled workspace boundary with all non-CPU fields exact and an unlimited predecessor. The same runtime address is classified through gunbc.change_realization as InPlaceUpdate; realization emits only its policy-derived CPUQuota directive. Memory drift, a finite predecessor, quota removal, a moved address and an unreviewed target refuse. It never deletes or recreates the slice. The fleet apply's locked baseline reobservation still gates execution; independent live boundary readback is required before commissioning. Rung: the add constructor no longer accepts a conflicting quota authority, and the bounded repair has discriminating claim controls. External systemd state remains a readback obligation. Ceiling/trigger: complete applied-state readback at the fabric-cell apply terminal, so command success alone cannot be confused with convergence.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/changed_declaration_signature_consumer_unplanned.dag b/dag/gunbc/recurring_failure_mode/changed_declaration_signature_consumer_unplanned.dag
index 5fd5f4a880a..019bac22a13 100644
--- a/dag/gunbc/recurring_failure_mode/changed_declaration_signature_consumer_unplanned.dag
+++ b/dag/gunbc/recurring_failure_mode/changed_declaration_signature_consumer_unplanned.dag
@@ -8,6 +8,7 @@ data changed_declaration_signature_consumer_unplanned: RecurringFailureMode = Re
   identity: "changed_declaration_signature_consumer_unplanned" as NonEmptyStr,
 
   receipts: [
+    "2026-10-09, PR #13607 bringup: runner_microvm_network_observe had been replaced by per-attempt sanitation helpers while ci_spec still named its removed runner_microvm_network_observe_wet CLI. The reference is workflow data, outside the declaration-call population described below. Restoring the observer and moving sanitation into runner_microvm_network_sanitation_observe preserves both consumers; workspace_network_producer_witness_test imports the restored production observer so the focused suite prepares its closure. Remaining ceiling: admission must resolve every emitted workflow entry/function pair, including data-carried references, before the required gate accepts it. This repair restores the particular route without claiming that broader gate exists.",
     "**a declaration's INTERFACE changes -- a product field retyped, an alias re-branded, a function parameter or result retyped, a constructor payload changed, a declaration removed -- and the untouched modules that READ it stay outside the required floor's prepared subject, so main admits an importer that no longer typechecks** (THE INVALID STATE is a merged tree holding a module that refuses under Strict preparation while every required lane that ran on the merging change reported green. The floor prepares the gate closure plus what the diff names: the touched modules and their DEPENDENCY closure. A reader of the changed declaration is a REVERSE dependent with an empty diff, so no diff-keyed selector sees it and it is never prepared.)",
 
     "THE HARM is deferred and misattributed. The broken reader sits on main until some LATER, UNRELATED change happens to pull it into its own subject -- and that change's author is the one who meets the refusal, in a file they did not touch, caused by a change they did not make. Every PR in between merges over a red it cannot see. It is the ordinary compiler floor (DESIGN section 4b: values inhabit declared types, fields exist) failing silently on the merge path, which is a below-baseline regression, not a missing differentiator.",
diff --git a/dag/gunbc/recurring_failure_mode/commissioning_refusal_discards_the_unproven_fact.dag b/dag/gunbc/recurring_failure_mode/commissioning_refusal_discards_the_unproven_fact.dag
new file mode 100644
index 00000000000..7964d101ad2
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/commissioning_refusal_discards_the_unproven_fact.dag
@@ -0,0 +1,13 @@
+module gunbc.recurring_failure_mode.commissioning_refusal_discards_the_unproven_fact
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data commissioning_refusal_discards_the_unproven_fact: RecurringFailureMode = RecurringFailureMode {
+  identity: "commissioning_refusal_discards_the_unproven_fact" as NonEmptyStr,
+  receipts: [
+    "2026-10-09, PR #13607: the live commissioning plan at 4fa60f71342 passed runtime and store observations, then returned only initial commissioning obligations are not admitted. Its TUN census had already observed ethtool --show-channels gunbc-tap13 fail with Operation not supported on 6.8.0-138-generic. The census cause became a generic TAP refusal, sanitation discarded its unproven facts, and fleet planning reduced the admission sum to a Bool. Three lossy projections hid the failing external capability.",
+    "The producer now renders the typed census refusal, commissioning uses product.fabric.sanitation.cell_readiness_line, and fleet planning retains the admission refusal. The safety verdict is unchanged: an unavailable kernel queue count cannot become zero, and process descriptor sweeps alone cannot establish absence of SCM_RIGHTS/io_uring-held references. Linux v6.9 drivers/net/tun.c tun_get_channels supplies numqueues; v6.8 lacks that callback. Host capability must be read successfully after any kernel maintenance, not assumed from a version string. Tests distinguish unsupported queue observation and the exact unobservable sanitation fact. Rung: observed refusal with preserved cause, not a guarantee of host capability.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/construct_field_value_not_typed_against_the_record_declaration.dag b/dag/gunbc/recurring_failure_mode/construct_field_value_not_typed_against_the_record_declaration.dag
index 9a04506f79c..ca53e499e3c 100644
--- a/dag/gunbc/recurring_failure_mode/construct_field_value_not_typed_against_the_record_declaration.dag
+++ b/dag/gunbc/recurring_failure_mode/construct_field_value_not_typed_against_the_record_declaration.dag
@@ -13,10 +13,10 @@ data construct_field_value_not_typed_against_the_record_declaration: RecurringFa
     "WHY INFER DID NOT SEE IT: its declared-type judgments had two producers, a call argument at its formal and an Arrow body at its declared return. No site took a construct's resolved record declaration and judged each field value against the field the record declares, and a construct's own type was the product of its children, which never derived because its tag is a reference.",
     "HARM: below the ordinary compiler floor. DESIGN section 4b names 'values inhabit declared types' among the floor properties whose failure is a below-baseline regression. It was silent: no diagnostic, and a downstream emitter or evaluator received a construct its declaration says cannot exist.",
     "THE REPAIR (the change that rewrote this row): a record construct is its constructor applied by name. v2.compiler.infer infer_record_construct_facts reads the fields the record declares, pairs each with the value that fills it through the one binding plan (v2.std.arrow_signature application_binding_plan_over), and judges each pair through the one judge (infer_judge_declared_position) at a third position, v2.std.inhabitance PositionRecordField, under one instantiation of the record's binders (infer_judge_formal_args, the application's own walk). A missing, undeclared or twice-named field refuses; each refusal names the record, the field and, for a value, the declared and produced types. The construct's type is the declared record, instantiated at its binders.",
-    "CURRENT RUNG, PER PATH, on the v2 resolve-to-infer route. STRUCTURALLY GUARANTEED (3): the field SET of every record construct, in any module; and the field VALUES of a record declared in the subject module whose field type is Int or Bool, one of the record's own type variables, or a declaration the subject module resolves (a nested record). BELOW THAT, COUNTED AND NOT SILENT, two populations, each an Accepted construct carrying an UndecidableFormalUnresolved obligation at the value and staying on the frontier: (a) a record declared in ANOTHER module, because v2.compiler.resolve ResolvedTree resolved_declarations holds only the subject module's declarations with resolved bodies and symbol_index holds a declaration as authored; (b) a field declared as a kernel type that has no value-type node in a v2 std authority, and so no row in v2.extdeps.languages.dag dag_kernel_value_type_roster: Float, Secret, Json, Unit and Bytes, each rostered as kernel_type_<name>_has_no_v2_value_type_node. Int and Bool are judged: the roster made the resolver's binding and the denotation join's key one symbol, which for Bool they had not been. The class's rung is the minimum across these paths, so the class as a whole is NOT at 3 and this row stays open.",
-    "CEILING: structurally guaranteed. A declaration can always be spelled with a value of the wrong type, so the state is writable in source; what is attainable is that no Accepted program contains one. Both remaining populations are decidable and fully modelled, so neither is a ceiling.",
-    "NEXT-RUNG TRIGGERS, at capability grain. (a) CROSS-MODULE: v2 infer reads the RESOLVED member types of any declaration a reference resolves to, across modules. That is gunbc#12726 PR2 (royal-stag-371, branch session/royal-stag-371-pr2-declaration-bodies): declaration-body types resolved once per ingest in the declaring module's scope, with every reader of resolved_declarations cut over in the same motion. It is sufficient for this row only when the record construct reader in v2.compiler.infer (infer_record_formals) reads that provider, so that a construct of a record declared in another module is judged field by field; the capability is shared with callee signatures, field projection and match fields (gunbc#12506). (b) KERNEL TYPES WITHOUT A VALUE-TYPE NODE: each of the five rows above names its own trigger, the std authority owning a value-type node for that type and the roster carrying a row for it. Neither trigger is satisfied by a hand-built tree carrying the binding.",
-    "ENROLLED EVIDENCE, all on the real route from source text: v2.test.claim.compiler.infer_record_construct_field_inhabitance_witness_test. The discriminating red is rcf_a_field_value_of_the_wrong_type_refuses_holds with rcf_the_refusal_names_the_record_the_field_and_both_types_holds; the positive control, one term away and asserted DECIDED, is rcf_inhabiting_field_values_are_accepted_and_decided_holds, with a generic and a nested control beside it. The cross-module population is pinned as it is by rcf_a_cross_module_records_field_value_is_counted_not_judged_holds, which goes red when its trigger lands and is then rewritten to assert the refusal. The Bool-declared field was pinned the same way until the kernel value-type roster landed, and is now the refusal rcf_a_bool_declared_field_value_of_the_wrong_type_refuses_holds.",
+    "CURRENT RUNG, PER PATH, on the v2 resolve-to-infer route. STRUCTURALLY GUARANTEED (3): the field SET of every record construct, in any module; and the field VALUES of a record whose field type is Int or Bool, one of the record's own type variables, or a declaration the subject module resolves (a nested record) — including a record declared in ANOTHER module. MEASURED 2026-10-09 (zesty-heron-486, claim_batch on BuildBuddy at d0f2067f8b): `rcf_a_cross_module_records_field_value_is_counted_not_judged_holds` went red because infer now REFUSES `n: true` against `RcfFar` declared in `v2.test.rcfp`; the claim is rewritten as `rcf_a_cross_module_records_field_value_of_the_wrong_type_refuses_holds`. BELOW THAT, COUNTED AND NOT SILENT, one remaining population: a field declared as a kernel type that has no value-type node in a v2 std authority, and so no row in v2.extdeps.languages.dag dag_kernel_value_type_roster: Float, Secret, Json, Unit and Bytes, each rostered as kernel_type_<name>_has_no_v2_value_type_node. Int and Bool are judged: the roster made the resolver's binding and the denotation join's key one symbol, which for Bool they had not been. The class's rung is the minimum across these paths, so the class as a whole is NOT at 3 and this row stays open.",
+    "CEILING: structurally guaranteed. A declaration can always be spelled with a value of the wrong type, so the state is writable in source; what is attainable is that no Accepted program contains one. The remaining kernel-type population is decidable and fully modelled, so it is not a ceiling.",
+    "NEXT-RUNG TRIGGERS, at capability grain. CROSS-MODULE field values of Int/Bool records are no longer a remaining population (trigger (a) observed discharged 2026-10-09). Remaining: KERNEL TYPES WITHOUT A VALUE-TYPE NODE: each of the five rows above names its own trigger, the std authority owning a value-type node for that type and the roster carrying a row for it. That trigger is not satisfied by a hand-built tree carrying the binding.",
+    "ENROLLED EVIDENCE, all on the real route from source text: v2.test.claim.compiler.infer_record_construct_field_inhabitance_witness_test. The discriminating red is rcf_a_field_value_of_the_wrong_type_refuses_holds with rcf_the_refusal_names_the_record_the_field_and_both_types_holds; the positive control, one term away and asserted DECIDED, is rcf_inhabiting_field_values_are_accepted_and_decided_holds, with a generic and a nested control beside it. The cross-module Int mismatch is the refusal rcf_a_cross_module_records_field_value_of_the_wrong_type_refuses_holds. The Bool-declared field was pinned the same way until the kernel value-type roster landed, and is now the refusal rcf_a_bool_declared_field_value_of_the_wrong_type_refuses_holds.",
     "RELATED, NOT THE SAME CLASS: zero_field_construction_escapes_the_field_set_check (a missing field, measured on the v1 path) and optional_admitted_where_a_required_value_is_declared (optionality at a Required position). VARIANT constructs are not this row's subject either: a construct whose tag is a coproduct's variant keeps product introduction and stays on the counted frontier."
   ],
 
@@ -26,7 +26,7 @@ data construct_field_value_not_typed_against_the_record_declaration: RecurringFa
     DeclarationRef { module_path: "v2.std.inhabitance", decl_name: "position_record_field", field: WholeDeclaration },
     DeclarationRef { module_path: "v2.test.claim.compiler.infer_record_construct_field_inhabitance_witness_test", decl_name: "rcf_a_field_value_of_the_wrong_type_refuses_holds", field: WholeDeclaration },
     DeclarationRef { module_path: "v2.test.claim.compiler.infer_record_construct_field_inhabitance_witness_test", decl_name: "rcf_inhabiting_field_values_are_accepted_and_decided_holds", field: WholeDeclaration },
-    DeclarationRef { module_path: "v2.test.claim.compiler.infer_record_construct_field_inhabitance_witness_test", decl_name: "rcf_a_cross_module_records_field_value_is_counted_not_judged_holds", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.test.claim.compiler.infer_record_construct_field_inhabitance_witness_test", decl_name: "rcf_a_cross_module_records_field_value_of_the_wrong_type_refuses_holds", field: WholeDeclaration },
     DeclarationRef { module_path: "v2.test.claim.compiler.infer_record_construct_field_inhabitance_witness_test", decl_name: "rcf_a_bool_declared_field_value_of_the_wrong_type_refuses_holds", field: WholeDeclaration },
   ],
 }
diff --git a/dag/gunbc/recurring_failure_mode/create_only_writer_used_for_reconcilable_staging.dag b/dag/gunbc/recurring_failure_mode/create_only_writer_used_for_reconcilable_staging.dag
new file mode 100644
index 00000000000..f58a0f2e508
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/create_only_writer_used_for_reconcilable_staging.dag
@@ -0,0 +1,14 @@
+module gunbc.recurring_failure_mode.create_only_writer_used_for_reconcilable_staging
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data create_only_writer_used_for_reconcilable_staging: RecurringFailureMode = RecurringFailureMode {
+  identity: "create_only_writer_used_for_reconcilable_staging" as NonEmptyStr,
+  receipts: [
+    "2026-10-09, PR #13607: the local network apply at 682c32644e8 refused File exists for its prior root-owned staging artifacts. No network install operation ran. Filesystem.WriteOwnerOnly creates an exclusive 0600 file; the caller chose it for its custody contract but also assumed replacement semantics it does not provide. A fresh staging directory would hide the defect until the next converge.",
+    "Repair at the write realization: mktemp creates a unique 0600 inode inside the already-verified staging directory, Filesystem.Write fills that inode, and the existing mv_exact_destination_command atomically publishes it on the same filesystem. Scope admission applies to the destination and temporary path. Failures remove only this invocation's temporary inode and report cleanup refusal; final exact byte readback and the outer root-custody readback remain required.",
+    "Discriminator: test.manual.runner_microvm_network_local_stage_probe.local_stage_replaces_owned_bytes_wet executes the real production writer for creation, replacement with different bytes and replay, checks 0600 mode and trailing newlines, refuses a destination outside the supplied scope, and checks no temporary inode remains. This is a manual native filesystem control, not a hermetic CI claim. Rung: external byte/custody facts are observed and refused; constructor-level distinction between exclusive creation and replacement remains the ceiling for callers choosing a filesystem operation. Trigger: operation admission requires the caller's intended publication semantics rather than relying on the writer's name.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/emitted_field_carrier_diverges_from_the_dag_type_authored_against.dag b/dag/gunbc/recurring_failure_mode/emitted_field_carrier_diverges_from_the_dag_type_authored_against.dag
index 14ab765fab0..7fb56fa0eb2 100644
--- a/dag/gunbc/recurring_failure_mode/emitted_field_carrier_diverges_from_the_dag_type_authored_against.dag
+++ b/dag/gunbc/recurring_failure_mode/emitted_field_carrier_diverges_from_the_dag_type_authored_against.dag
@@ -18,7 +18,7 @@ data emitted_field_carrier_diverges_from_the_dag_type_authored_against: Recurrin
 
     "THE RULE THE AUTHOR CANNOT SEE, stated because the obvious summary of it is WRONG. `v1.compiler.emit_rust` `needs_box_wrapping` boxes a field whose type is in `recursive_types`, and an OPTIONAL-cardinality field inherits that decision from its inner type by recursing with required cardinality; `rust_field_carrier_final_type` then renders `Box<T>`. So it is NOT 'an Optional field boxes' -- whether it boxes depends on whether its inner type rides a recursion cycle, which is a property of the WHOLE CORPUS and not of the declaration. Two fields spelled with the same cardinality in the same record can take different carriers, and neither spelling says so.",
 
-    "SPECIMEN, gunbc PR 11206 (perf item C instrument, draft), 2026-09-12. A new carrier `v2.compiler.compile` `NativeTestFrontEnd` carries `residue: Diagnostics`, where `v2.std.diagnostic` `Diagnostics` is `Optional<NonEmptyDiagnostics>` and `NonEmptyDiagnostics` is recursive. The field emitted as `Box<Option<Rc<NonEmptyDiagnostics>>>` while `v2.compiler.program_assembly` `program_assembly_phase_parse` takes `residue` by value, so the emitter template's `front_end.residue.clone()` cloned the Box (that phase was DELETED by gunbc#11985 with the unseeded composition it served; the receipt is dated and its reading stands, and the live phase is `program_assembly_phase_parse_measured_seeded`): `error[E0308]: expected Option<Rc<NonEmptyDiagnostics>>, found Box<Option<Rc<NonEmptyDiagnostics>>>` at `src/main.rs:407`, help `consider unboxing the value`. The sibling fields on the same carrier -- `lm: LanguageModel`, `prepared: PreparedGrammar` -- took `Rc<..>` and their `.clone()` was correct, which is exactly the per-field divergence this row names. Repair: `(*front_end.residue).clone()`.",
+    "SPECIMEN, gunbc PR 11206 (perf item C instrument, draft), 2026-09-12. A new carrier `v2.compiler.compile` `NativeTestFrontEnd` carries `residue: Diagnostics`, where `v2.std.diagnostic` `Diagnostics` is `Optional<NonEmptyDiagnostics>` and `NonEmptyDiagnostics` is recursive. The field emitted as `Box<Option<Rc<NonEmptyDiagnostics>>>` while `v2.compiler.program_assembly` `program_assembly_phase_parse` takes `residue` by value, so the emitter template's `front_end.residue.clone()` cloned the Box (that phase was DELETED by gunbc#11985 with the unseeded composition it served; the receipt is dated and its reading stands, and the live phase is `program_assembly_phase_parse_seeded`, renamed from `program_assembly_phase_parse_measured_seeded` when the parse memo was deleted, operator ruling R2 2026-10-08): `error[E0308]: expected Option<Rc<NonEmptyDiagnostics>>, found Box<Option<Rc<NonEmptyDiagnostics>>>` at `src/main.rs:407`, help `consider unboxing the value`. The sibling fields on the same carrier -- `lm: LanguageModel`, `prepared: PreparedGrammar` -- took `Rc<..>` and their `.clone()` was correct, which is exactly the per-field divergence this row names. Repair: `(*front_end.residue).clone()`.",
 
     "WHAT DID NOT CATCH IT, each checked rather than assumed: `gunbc run` typechecked both changed modules under the whole `dag` + `src/v2` closure and was green; `cargo fmt --all --check` passed; `claim_executor --required-regen` regenerated the emitter's own projection and adjudicated it, reaching `first_generation_equal` on the file CONTAINING the defective template text, because regen compares emitted BYTES against the authority and never compiles the program those bytes describe.",
 
diff --git a/dag/gunbc/recurring_failure_mode/emitter_index_keyed_on_a_type_leaf_takes_the_last_declarer.dag b/dag/gunbc/recurring_failure_mode/emitter_index_keyed_on_a_type_leaf_takes_the_last_declarer.dag
index 1fd72160761..e810aea1ccb 100644
--- a/dag/gunbc/recurring_failure_mode/emitter_index_keyed_on_a_type_leaf_takes_the_last_declarer.dag
+++ b/dag/gunbc/recurring_failure_mode/emitter_index_keyed_on_a_type_leaf_takes_the_last_declarer.dag
@@ -14,11 +14,11 @@ data emitter_index_keyed_on_a_type_leaf_takes_the_last_declarer: RecurringFailur
 
     "SPECIMEN, the native approval broker closure (entry dag/gunbc/auth/approval_broker_serve.dag, lane 2A of the native-broker program, main fd30a502): std.access declares AccessRequest<S, A, O, C, E> and gunbc.auth.access_request declares AccessRequest<Subject>. v1.compiler.infer_emit_info add_emit_item_summary inserted both under `AccessRequest`; v1.compiler.trait_derive_emit v1_clone_bounded_type_params therefore held the one-element set Subject for that key, v1_item_clone_bounded_param_names filtered std.access's own [S, A, O, C, E] against it and found none, and std_access.rs printed `pub struct AccessRequest<S, A, O, C, E>` over fields naming AccessContext<C: Clone> and AccessEvidence<E: Clone>: ten rustc errors (E0277, E0369). The paired control is the same emitter over dag/std/authorization_profile.dag, whose closure has one AccessRequest and prints all five bounds.",
 
-    "WHAT IS CLOSED AND WHAT IS NOT. The trait-derive family is re-keyed on the declaration -- v1.compiler.infer_emit_info TypeDeclIndex (EmitGraphInfo.type_decl_items), and with it clone_bounded_type_params, clone_impl_required_type_params and map_key_required_type_names -- under the item registry's own identity (v1.std.core callable_identity over owner module and declared name), and a reference reaches a row through resolve_type_decl_routed, whose spelling arm REFUSES a leaf two modules declare. STILL LEAF-KEYED, LAST WRITE WINS, on v1.compiler.infer_emit_info EmitGraphInfo: type_summaries (and its `Enum::Variant` rows), fn_decl_items, recursive_type_set, fielded_variants, positional_payload_variants, shared_types and variant_to_enum. data_variant_wire_spellings is keyed on the coproduct's leaf too but stores DataVariantSpellingRefused when two declarers disagree, so it fails closed; ownership_index and read_only_params_index are module-qualified and are not members.",
+    "WHAT IS CLOSED AND WHAT IS NOT. The trait-derive family is re-keyed on the declaration -- v1.compiler.infer_emit_info TypeDeclIndex (EmitGraphInfo.type_decl_items), and with it clone_bounded_type_params, clone_impl_required_type_params and map_key_required_type_names -- under the item registry's own identity (v1.std.core callable_identity over owner module and declared name), and a reference reaches a row through resolve_type_decl_routed, whose spelling arm REFUSES a leaf two modules declare. RE-KEYED IN A SECOND CUT: type_summaries is a TypeSummaryIndex keyed by the same declaration identity (variant-payload rows under `<identity>::<Variant>`), and variant_to_enum maps each variant to its owner's identity, so a second same-leaf declaration no longer replaces the first's summary for readers in other modules (the unit row same_leaf_type_elsewhere_leaves_other_modules_emission_unchanged). Readers that hold only a NAME read it through type_summary_decided, which answers no summary for a leaf two declarations own; that residue ends when TypeSummary's field_type_map and field_import_surface_names store identities. STILL LEAF-KEYED, LAST WRITE WINS, on v1.compiler.infer_emit_info EmitGraphInfo: fn_decl_items, recursive_type_set, fielded_variants, positional_payload_variants and shared_types. data_variant_wire_spellings is keyed on the coproduct's leaf too but stores DataVariantSpellingRefused when two declarers disagree, so it fails closed; ownership_index and read_only_params_index are module-qualified and are not members.",
 
     "A DECLARED MIDDLE STATE INSIDE THE CLOSED PART: kernel spellings. A kernel spelling (std.types is_kernel_type) is a reference resolve deliberately leaves unstamped, and the corpus also declares some of those leaves in two modules: v2.std.text and v2.std.node String, std.integer and v2.std.integer Int. Bool was a third until v2.std.logic Bool was retired; the arm is about any kernel-spelled leaf with two declarers, not about a fixed list. For such a reference the routed resolution answers TypeDeclKernelSpellingUndecided: it does NOT refuse, it derives no Clone or Ord bound from either declaration, and it carries a map-key requirement to EVERY declarer of the leaf, which is what the leaf-keyed set did. So for these leaves the emitted derives are unchanged by the re-keying and the question of which declaration a kernel-spelled position denotes is still open. Each occurrence is one row of v1.tests.claim.carrier_realization_census (emitter_decl_route). TRIGGER, at capability grain: resolve identifies a kernel-spelled reference -- as the kernel type or as the corpus declaration its scope binds -- at every type position the emitter reads; the owner is the text-boundary identity work (gunbc.rung_drop text_boundary_identity_wall), not the emitter. One stamped position does not retire the arm.",
 
-    "RUNG: for the trait-derive family, mechanically preventable -- gunbc.instruments.native_emission_controls (two ControlSlot declarations of different arity in one closure, emitted, built and run) and the unit row same_leaf_type_declarations_emit_their_own_bounds are the discriminating red and the positive control. For the seven indexes still leaf-keyed, mitigatable at best: the collision is observed only when rustc happens to refuse the foreign fact. ATTAINABLE CEILING: structurally impossible -- an index keyed on the declaration has no row two declarations can share. NEXT-RUNG TRIGGER, at capability grain: every EmitGraphInfo index that answers a question about a type declaration is keyed on the declaration's identity and reached from a reference through the one routed resolution, so that adding a same-leaf declaration to any module of a closure cannot change what is emitted for an existing one. Re-keying one more map is not that capability; the trigger is the set.",
+    "RUNG: for the trait-derive family, mechanically preventable -- gunbc.instruments.native_emission_controls (two ControlSlot declarations of different arity in one closure, emitted, built and run) and the unit row same_leaf_type_declarations_emit_their_own_bounds are the discriminating red and the positive control. For the five indexes still leaf-keyed, mitigatable at best: the collision is observed only when rustc happens to refuse the foreign fact. ATTAINABLE CEILING: structurally impossible -- an index keyed on the declaration has no row two declarations can share. NEXT-RUNG TRIGGER, at capability grain: every EmitGraphInfo index that answers a question about a type declaration is keyed on the declaration's identity and reached from a reference through the one routed resolution, so that adding a same-leaf declaration to any module of a closure cannot change what is emitted for an existing one. Re-keying one more map is not that capability; the trigger is the set.",
   ],
 
   evidence: [
diff --git a/dag/gunbc/recurring_failure_mode/emitter_nested_variant_pattern_inside_present_drops_the_rc_deref.dag b/dag/gunbc/recurring_failure_mode/emitter_nested_variant_pattern_inside_present_drops_the_rc_deref.dag
new file mode 100644
index 00000000000..986abb7ea23
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/emitter_nested_variant_pattern_inside_present_drops_the_rc_deref.dag
@@ -0,0 +1,22 @@
+module gunbc.recurring_failure_mode.emitter_nested_variant_pattern_inside_present_drops_the_rc_deref
+
+import std.types { NonEmptyStr }
+import std.decl_ref { decl_ref }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data emitter_nested_variant_pattern_inside_present_drops_the_rc_deref: RecurringFailureMode = RecurringFailureMode {
+  identity: "emitter_nested_variant_pattern_inside_present_drops_the_rc_deref" as NonEmptyStr,
+
+  receipts: [
+    "INVALID STATE: a record pattern whose field is an Optional of a coproduct, with the coproduct variant pattern nested inside Present (`ExprMethodCall { method_semantics: Present { value: AlgebraMethodSemantics { .. } } }`), is emitted as `Some(MethodSemantics::AlgebraMethodSemantics{..})` against a field of type Option<Rc<MethodSemantics>>. The emitter does not dereference the Rc carrier through Present for a nested pattern, so rustc refuses with E0308 in generated code.",
+
+    "HARM: loud, not silent -- the closure stops building, located at the emitted pattern rather than the .dag arm, which is correct and accepted. Found when regenerating the infer mirror for gunbc#13574, where the working spelling (nested matches: Present { value: v } then a match on v) is used in equality_operand_list_read_name in src/v1/04_infer.dag. That spelling is a workaround under DESIGN section 5 and is filed here as the line-stop.",
+
+    "RUNG: mitigatable -- rustc stops the build; nothing in the emitter refuses or lowers the nested pattern. ATTAINABLE CEILING: structurally guaranteed -- the emitter knows the field's Rust carrier and the nested pattern's variant, so it can lower the pattern through the deref. NEXT-RUNG TRIGGER, the capability: the emitter lowers a variant pattern nested inside Present in a record-field pattern through the Rc carrier, so the specimen compiles and runs; at that point the specimen is enrolled in gunbc.instruments.native_emission_controls as a permanent regression control and the split in equality_operand_list_read_name may return to one nested pattern.",
+  ],
+
+  evidence: [
+    decl_ref(module_path: "gunbc.instruments.native_emission_nested_present_specimen", decl_name: "specimen_nested_is_lit"),
+    decl_ref(module_path: "gunbc.instruments.native_emission_nested_present_specimen", decl_name: "specimen_nested_is_lit_split"),
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/empty_list_evaluates_to_unit.dag b/dag/gunbc/recurring_failure_mode/empty_list_evaluates_to_unit.dag
new file mode 100644
index 00000000000..bdda45e76c8
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/empty_list_evaluates_to_unit.dag
@@ -0,0 +1,28 @@
+module gunbc.recurring_failure_mode.empty_list_evaluates_to_unit
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+// Consumer: directory-derived recurring_failure_mode.roster, projected by
+// gunbc.design_ledgers.expected_design_failure_modes_md through docs_projection_gate.
+data empty_list_evaluates_to_unit: RecurringFailureMode = RecurringFailureMode {
+  identity: "empty_list_evaluates_to_unit" as NonEmptyStr,
+
+  receipts: [
+    "INVALID STATE: an empty list used as a value evaluates as kernel Unit. v1_interpreter.eval_expr_inner on ExprData::NoExprData returned Value::Unit. A List/Set type node (make_container_type) and an empty literal whose typed node lost ExprListLit are NoExprData. concat then pushed that Unit into the result list, so a later field read names Unit as the runtime carrier.",
+
+    "SPECIMEN, executed 2026-10-08 on gunbc#13475 generated job 113113331249 at f2106c2cd: `cannot access field 'path' on Unit` at dag/extdeps/deepseek/deepseek_v4_1_flash.dag published_file_identity_line <- published_file_identity_eq <- list_member <- deepseek_v4_1_flash_admit_tokenizer_population. The producer is fold(..., init: [] as List<DeepseekV41PublishedFile>, concat(acc, [f])). Same class: roadmap_emit cannot access field tbuf on Unit; host-sudoers cannot cast NonEmptyStr (runtime carrier Unit) to String. The checker had already typed the accumulator as a list; the seed evaluator did not inhabit that type.",
+
+    "HARM: fabricated plausible output at eval (DESIGN section 5). The program is Accepted and then the wet/generated lanes refuse on a type the program never had. Neighbouring class unsolved_placeholder_reads_back_as_unit is checker diagnostic fabrication; this class is the evaluator substituting Unit for an empty collection.",
+
+    "PRODUCER: v1_interpreter.eval_expr_inner NoExprData arm returned Unit; concat then pushed that Unit as an element (free_monoid_to_vec had no empty-Unit flatten).",
+
+    "CLIMB, gunbc#13584: eval_expr_inner NoExprData now TypeErrors when the node is a List/Set collection type. Concat does not flatten leftover Unit as empty (review 77857). Evaluating a collection type node as [] was withdrawn (review 77868): that was a fabricated default. Empty lists that keep ExprListLit already evaluate as []. This PR does not change child_type_node or typing (review 77955). Specimens were first observed on gunbc#13475 generated job 113113331249.",
+
+    "SEED SURFACE: the TypeError is +17 hand-written lines in the existing v1_interpreter NoExprData arm, not a new seed module. There is no scaffold to delete and no ROADMAP deferral: this arm is the current-rung wall. Dissolution is the named NEXT TRIGGER (empty-list literals keep ExprListLit through typing), at which the refusal becomes unreachable on the empty-list path and the extra lines have no remaining consumer.",
+
+    "RUNG FOUND AT: mitigatable (loud TypeError at eval). CURRENT RUNG: mitigatable — an empty literal can still lose ExprListLit; nothing in this change makes that unwritable (review 77868, DESIGN §4b(1)). CEILING: 4 -- an empty list has no constructor that is Unit. NEXT TRIGGER: empty-list literals keep ExprListLit through typing so NoExprData is not the empty-list value path.",
+  ],
+
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/first_element_of_a_list_has_three_spellings.dag b/dag/gunbc/recurring_failure_mode/first_element_of_a_list_has_three_spellings.dag
new file mode 100644
index 00000000000..287108c38e4
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/first_element_of_a_list_has_three_spellings.dag
@@ -0,0 +1,21 @@
+module gunbc.recurring_failure_mode.first_element_of_a_list_has_three_spellings
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data first_element_of_a_list_has_three_spellings: RecurringFailureMode = RecurringFailureMode {
+  identity: "first_element_of_a_list_has_three_spellings" as NonEmptyStr,
+  receipts: [
+    "INVALID STATE: one operation -- the first element of a list, or its absence -- has three spellings (a DESIGN section 3 nickname fork). (1) The std.algebra free_monoid_collection_templates roster row first (ReceiverSelf -> OptionalOf<ReceiverElement>), which has no declaration, so a bare first(xs) is unbound on the v2 native route (found on N7's route at v2.compiler.dependency_demand_census demand_fact_head_is_lexical and demand_fact_head_is_parameter). (2) v2.std.algebra list_head, the most widely called of the three (its callers are re-derived by a word-grep for list_head over dag and src/v2), returning its OWN carrier ListHeadResult = HeadFound | HeadAbsent. (3) v2.std.collection list_at_optional(xs, 0). The roster siblings last and get carry the same shape of fork beside their own declared spellings.",
+    "SECOND FORK INSIDE THE FIRST: ListHeadResult is an Optional-shaped carrier -- a fourth spelling of Optional beside the generic v2.std.optional Optional -- so it is ALSO in the scope of bright-fox-661's Optional de-fork (one Optional authority on both routes), which should retire it onto that authority rather than this row restating its own.",
+    "HARM: callers pick a spelling per site, so one fact is answered three ways with two result carriers, and the undeclared roster spelling refuses on the native route. RUNG FOUND AT: mitigatable (the unbound name refuses loudly). CEILING: structurally impossible -- one typing authority per collection op. OWNER: the XL-2 roster lane (lively-crane-656); the roster binding is stern-swift-290's roster route. NEXT-RUNG TRIGGER, NAMING THE CAPABILITY: collection roster ops are the single typing authority for first/last/get, their result type the one Optional authority, with list_head and list_at_optional retired onto them delete-first (per calm-boar-904's ruling that the roster row is the single authority for collection ops), SUFFICIENT FOR no module to spell first-element, last-element or index access any other way.",
+  ],
+  evidence: [
+    DeclarationRef { module_path: "std.algebra", decl_name: "free_monoid_collection_templates", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.std.algebra", decl_name: "list_head", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.std.algebra", decl_name: "ListHeadResult", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.std.collection", decl_name: "list_at_optional", field: WholeDeclaration },
+    DeclarationRef { module_path: "std.optional", decl_name: "Optional", field: WholeDeclaration },
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/fixture_closure_union_emit_suspected_superlinear_cost.dag b/dag/gunbc/recurring_failure_mode/fixture_closure_union_emit_suspected_superlinear_cost.dag
new file mode 100644
index 00000000000..5a80f0638e1
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/fixture_closure_union_emit_suspected_superlinear_cost.dag
@@ -0,0 +1,28 @@
+module gunbc.recurring_failure_mode.fixture_closure_union_emit_suspected_superlinear_cost
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data fixture_closure_union_emit_suspected_superlinear_cost: RecurringFailureMode = RecurringFailureMode {
+  identity: "fixture_closure_union_emit_suspected_superlinear_cost" as NonEmptyStr,
+
+  receipts: [
+    "fixture-closure-union-emit suspected superlinear cost: the required floor's fixture-closure-union-emit phase (added by gunbc#13195) emits one union over the closures of the fixture-compiling members. THIS ROW RECORDS A SUSPICION, NOT A MEASUREMENT: the two data points below come from DIFFERENT INSTRUMENTS and one of them is censored, so neither establishes a scaling shape and the cost model is unknown. If the phase grows faster than its union size, a change that touches a few members can move the required floor from minutes to the job cap with no refusal naming the phase.",
+
+    "DATA POINT 1, a held line (gunbc#13575 floor run 37860278343): phase=fixture-closure-union-emit state=held members=105 fixture_compiles=247 wall_ms=100613. This is the only observation that prints members, compiles and wall time together, and it is a single size, so it fixes one point and no slope.",
+
+    "DATA POINT 2, a censored run (gunbc#13605 control run 37869158145, carrying gunbc#13211 plus gunbc#13575): the phase started at 02:27:44Z and was still running when the 90-minute job cancel fired at 02:58Z, CPU-bound with memory flat. The member count was NEVER PRINTED, so this point has no x-coordinate; it is a lower bound on wall time (at least 30 minutes against roughly 100 seconds at the first point) at an unknown union size. Flat memory with a saturated CPU is consistent with repeated work rather than a growing structure, and is not evidence of which.",
+
+    "THE ONLY STRUCTURAL FACT KNOWN ABOUT THE LARGER UNION: the 4 probes gunbc#13211 touched each close over roughly 715 modules, via gunbc.runner.runner_jit_perform. That says the touched members are wide; it does not say the union is large, nor that the phase's cost is a function of closure width rather than member count or fixture_compiles. Do not infer the dependence from it. The 2261 figure that circulated beside this incident was a pre-cut refusal count, a different quantity, and is not a size of this phase.",
+
+    "THE FAILURE SHAPE IF THE SUSPICION HOLDS, which is what makes it worth a row before it is a measurement: the phase has no budget of its own, so an overrun surfaces only as the job's wall cap cancelling the whole lane. That is a silent overrun (DESIGN section 5: a failure arm must refuse and be typed and located) -- the line does not stop at the phase, it stops at the job, and the cancellation names no cause. It also consumes a 90-minute runner slot per attempt.",
+
+    "ATTAINABLE CEILING: structurally guaranteed for the budget arm -- a phase budget is decidable and fully modeled, so exceeding it can be a typed refusal on the real acceptance path. The cost shape itself is not yet classifiable: it is a mitigatable cost until the scaling shape is known, and only then can it be derived by chain re-derivation (DESIGN section 6b) from what the union emit demands per member. Until measured, this row claims no rung above mitigatable.",
+
+    "NEXT-RUNG TRIGGER, at capability grain, in two parts that are both required. (a) TWO OR MORE UNION SIZES MEASURED ON THE SAME INSTRUMENT: the held line (phase, state, members, fixture_compiles, wall_ms) emitted at two or more distinct member counts, so the scaling shape (linear, n log n, quadratic, or worse) is read from one instrument rather than inferred across two. A censored run contributes nothing until the instrument prints members at start. (b) A BUDGET ON THE PHASE ITSELF so that exceeding it refuses with a typed cause naming fixture-closure-union-emit, members and elapsed time, instead of running silently to the job cap. This row does not change the gate; the budget and the extra measurement are the follow-up, and the budget's number must be grounded by (a), not copied from data point 1.",
+
+    "RECOGNITION RULE: a required-floor run cancelled at its job cap whose last announced phase is fixture-closure-union-emit, with CPU pegged and memory flat. The cheap discriminator is whether a held line for the phase was ever printed; if not, the phase did not finish, and the member count must be recovered before any scaling claim is made.",
+  ],
+
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/fixture_compile_retained_on_the_process_shared_index.dag b/dag/gunbc/recurring_failure_mode/fixture_compile_retained_on_the_process_shared_index.dag
new file mode 100644
index 00000000000..ddb154dbf04
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/fixture_compile_retained_on_the_process_shared_index.dag
@@ -0,0 +1,24 @@
+module gunbc.recurring_failure_mode.fixture_compile_retained_on_the_process_shared_index
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data fixture_compile_retained_on_the_process_shared_index: RecurringFailureMode = RecurringFailureMode {
+  identity: "fixture_compile_retained_on_the_process_shared_index" as NonEmptyStr,
+
+  receipts: [
+    "INVALID STATE: a nested fixture compile (`compile_dag_diagnostic_census`, `compile_dag_rust_emit_check`) extends its module closure through the required floor's process-shared MultiEntryIndex. The walk writes parse rows, bare-reference admission, both_closure_edges, and typed-module cache entries for every module the fixture's both-closure reaches, and those rows outlive the compile: they sit in the same index the claim fold consults until the thread ends. HARM: planning a compile-census witness whose probe imports a wide production stack (test.claim.megarac_managed_host_forged_probe_witness, then extend_sources_to_both_closure_fixpoint) makes that stack's both-closure resident for the rest of the floor. Re-derive from gunbc.cli_run.required_floor_runner: a floor that plans those census claims sat on memory.high from the claim fold until the lane cap with no verdict; the same floor without those claims did not. The witness stays enrolled; the loader must not retain its closure on the shared slot.",
+
+    "RECOGNITION RULE. Ask which index a fixture-closure extension mutates. If it is the run's process-shared MultiEntryIndex (try_index_for_run_or_owned_pool over witness_layer_roots), the compile's working set has been smuggled into the fold's resident set. The closure authority itself (extend_sources_to_both_closure_fixpoint) is not the defect -- an import-only walk is the sibling class import_only_walker_standing_in_for_the_closure_authority. The defect is RETENTION of that authority's writes on a slot whose lifetime is the process, not the compile. Raising memory.high, sharding the lane, excluding the witness, or a debt row is the absorbing fallback this class forbids.",
+
+    "DISTINGUISHING FACT: this is not 'the census compile is large'. One compile of the MegaRAC probe against its both-closure is the work the seven claims demand; memoizing CompileDiagnosticCensus already collapses N questions about one source to one compile. What must collapse is resident MULTIPLICITY of the closure's index rows: they belong on a scratch shell that shares the pool's source_files map and is dropped when the loader returns. Nor is it typed_snapshot_serializes_shared_structure_by_value (a copy-by-value at a serialize boundary); here the live Rc caches are the ones that grow.",
+
+    "STRUCTURAL PREDICTION (DESIGN section 6b, stated before the confirming run): fixture-closure index writes on the process-shared slot must go to zero; N planned compile-census claims over one source must not retain N typed graphs; the union recorder may intern source bytes once. A contradicting instrument is fixture_closure_extension_does_not_populate_the_process_shared_index: after resolve_virtual_source_with_imports of the enrolled syllogism specimen, the shared typed-cache length, both_closure_edges cardinality, and bare-admission cardinality are unchanged.",
+
+    "RUNG FOUND AT: silent wrongness on the floor (no typed refusal; the lane timed out). RUNG NOW: mechanically preventable -- resolve_virtual_source_with_imports extends over a scratch MultiEntryIndex and the unit control reds a regression that writes the shared slot. THE SCRATCH LOADER IS THE TERMINAL RETENTION SHAPE, not a scaffold: fixture-closure writes live on a shell that shares the pool's source_files and is dropped when the loader returns. extend_fixture_imports_on_process_shared_index is the pre-fix route, test-only, so the red control can still name the shared slot. CEILING: structurally guaranteed once a fixture compile cannot name the process-shared index as its extension target. NEXT-RUNG TRIGGER: fixture-closure extension is typed so that the shared MultiEntryIndex is not in the function's reachable parameter set; the unit control remains enrolled.",
+
+    "CONSUMPTION: this per-class record joins the derived gunbc.recurring_failure_mode.roster recurring_failure_mode_roster. Production consumer: v1_compiler.cli_run resolve_virtual_source_with_imports. GREEN: v1_compiler.cli_run.emit_host fixture_closure_extension_does_not_populate_the_process_shared_index. RED (pre-fix route): v1_compiler.cli_run.emit_host fixture_closure_extension_via_shared_index_grows_both_closure_edges.",
+  ],
+
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/fold_cons_handler_binder_unbound_on_the_native_resolver.dag b/dag/gunbc/recurring_failure_mode/fold_cons_handler_binder_unbound_on_the_native_resolver.dag
index 47031fdbdc9..76b5a7d41f0 100644
--- a/dag/gunbc/recurring_failure_mode/fold_cons_handler_binder_unbound_on_the_native_resolver.dag
+++ b/dag/gunbc/recurring_failure_mode/fold_cons_handler_binder_unbound_on_the_native_resolver.dag
@@ -1,20 +1,29 @@
 module gunbc.recurring_failure_mode.fold_cons_handler_binder_unbound_on_the_native_resolver
 
 import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
 import gunbc.recurring_failure_mode { RecurringFailureMode }
 
 data fold_cons_handler_binder_unbound_on_the_native_resolver: RecurringFailureMode = RecurringFailureMode {
   identity: "fold_cons_handler_binder_unbound_on_the_native_resolver" as NonEmptyStr,
 
   receipts: [
-    "**the native resolver does not bind a fold handler's binder -- a `cons: fn(acc, candidate)` handler over fold_list refuses its module at prepare with resolve_reason_unbound_symbol anchored at the fold spine, so a claim that observes a std fn's result by folding over it cannot run on the native route** (INVALID STATE: the same spelling binds on the interpreted floor, so the two routes disagree about an ordinary fold).",
-    "RECEIPT (2026-10-02, eager-cat-664, head 17fccbf3f62): `gunbc test '//v2/test/claim/variant_field_native_specimen:all'` (same emitted closure ae6fb52183d56945c0dedad90047279110c416c3f7ea5dcb6b5a10724ab7cff6, built clean, discriminating red and malformed control established): target/v2-native-lane/driver-rows.jsonl records all three identities of v2.test.claim.variant_field_native_specimen (vfb_specimen_binder_present_value_node_binds, vfb_specimen_variant_binder_binds, vfb_specimen_unbound_name_yields_no_candidates) as NativeTestRefused at NativeTestStagePrepare with head reason resolve_reason_unbound_symbol, anchor a fold_list_node spine over the atoms `candidate` and `path` -- the handler binder and the field read through it (candidate.path) in the claim's own cons handler. The same three claims are GREEN on the interpreted floor (gunbc run --claim-run, pool 7223 modules, exit 0).",
+    "(a) OBSERVED HISTORICAL REFUSAL (2026-10-02, eager-cat-664, head 17fccbf3f62): `gunbc test '//v2/test/claim/variant_field_native_specimen:all'` (emitted closure ae6fb52183d56945c0dedad90047279110c416c3f7ea5dcb6b5a10724ab7cff6): target/v2-native-lane/driver-rows.jsonl records all three identities of v2.test.claim.variant_field_native_specimen (vfb_specimen_binder_present_value_node_binds, vfb_specimen_variant_binder_binds, vfb_specimen_unbound_name_yields_no_candidates) as NativeTestRefused at NativeTestStagePrepare with head reason resolve_reason_unbound_symbol, anchor a fold_list_node spine over the atoms `candidate` and `path` in the claim's own cons handler. The same three claims are GREEN on the interpreted floor (gunbc run --claim-run, pool 7223 modules, exit 0). THE EXACT PREPARE-REFUSAL CAUSE IS UNESTABLISHED. It is not established that resolve_projection_base answered Absent for a LexicalFrame binder: #13028's parent f7303bb078 already had a BoundInFrame arm that gives LexicalFrame an accepted canonical-atom base.",
     "HARM: any test claim that observes a result by folding over it -- the spelling the floor prefers for list observation -- refuses natively before its subject is reached, so native observations are pushed onto spellings the floor does not prefer, and the two routes' agreement surface shrinks by whole claim modules.",
     "DISTINGUISHING FACTS. Not native_infer_accepts_only_bool_and_int_match_scrutinees (stage resolve, not infer; the anchor is a fold spine, not a match). Not a_wildcard_match_arm_resolves_as_an_unbound_name (that class is a wildcard in a match arm; here it is a lambda parameter of a fold handler). Not unapplied_function_value_admitted_at_a_value_position (nothing is admitted; a binder is missing). The closure's pre-existing file refusals in the same run (dag/std/occurrence_identity.dag normalized_tree_reason_wrapper_retention_not_normalized, src/v2/compiler/body_lowering_fold.dag and dag/std/machine_constraints.dag parse_g0_tokens_remain, dag/extdeps/uri_path.dag body_lowering_reason_function_value_body_unread -- 4 file_refusal rows in the terminal tally) are NOT this class: the anchor is in the claim's own handler, and the unbound name is the handler's own binder, not a name from a refused file.",
-    "RUNG FOUND AT: mitigatable -- typed and loud at prepare, anchor names the spine.",
-    "CEILING: structurally guaranteed. A fold handler's parameter is a lambda over the folded item; binding it is the same mechanism the floor already applies to the identical spelling.",
-    "NEXT-RUNG TRIGGER, naming the capability: fold-handler binder resolution in the native resolver -- a `cons: fn(acc, item)` handler's parameter binds at resolve on the native route, and the three vfb_specimen_* identities pass native prepare beside the floor green.",
+    "(b) TODAY'S PASSING SUBJECTS (fierce-fox-380): native ingest of a minimal `fold(..., fn(acc, candidate) { acc || candidate.path })` module is NativeCensusModuleResolved; the same fn as a call argument resolves; an undeclared name in a fold handler is the sole resolve_reason_unbound_symbol at fhb_undeclared_item. Route: native_test_context_from_ingest then native_census_module_resolution. The 2026-10-02 vfb_specimen NativeTestRefused receipt remains the historical observation, not a re-derived cause.",
+    "(c) CURRENT-HEAD FAULT INJECTION (fierce-fox-380, not landed, not a historical revert): on this head, restricting resolve_projection_base BoundInFrame to ParameterFrame only (LexicalFrame and TypeParameterFrame to Absent) makes v2.test.claim.resolve.fold_handler_binder_resolve `a_non_fold_lambda_argument_still_resolves` FAIL. That is a regression discriminator for the enrolled positive control. It does not establish that the 2026-10-02 prepare refusal was that Absent arm, and it is not a reading of f7303bb078 (today's seed refuses that revision's `v2.std.optional` imports as kernel-name collisions).",
+    "(d) WHAT gunbc#13028 (9446711d34) CHANGED: resolve_projection_base returns Outcome<ResolvedAtom> and every BoundInFrame kind is minted by one producer, resolve_frame_bound_reference, carrying lexical evidence on ResolvedAtom.lexical for a LexicalFrame head. Parent f7303bb078 already accepted a LexicalFrame projection base as the canonical atom (BoundInFrame { kind: _ }, not Absent); its Outcome<Node> route carried no lexical entries, which that parent named as a declared frontier.",
+    "#13423 RE-ATTRIBUTION, NARROWED TO THE NAMED MISSING-DECLARATION OBSERVATIONS. gunbc.guarantee_stall.accumulator_copy_untyped_combiner_refusals_stall (gunbc#13423, e2213343de, on aae7da34ca) records that a copy of std.change's six-file import closure refused at resolve at `concat` (resolve_reason_unbound_symbol), `map_get` (declared in v2.std.collection, not imported), and `Map` (resolve_unbound_name_is_declared_elsewhere std.types.Map). Those three names are not this class. The same stall separately records native-CLI fold-projection refusals on small modules and attributed those to this row; that attribution is not withdrawn here.",
+    "RUNG FOUND AT: mitigatable -- the 2026-10-02 native prepare refusal was typed and located. RUNG NOW, at the native ingest/resolve boundary: mechanically preventable, by v2.test.claim.resolve.fold_handler_binder_resolve `a_fold_handler_item_binder_resolves`, `a_non_fold_lambda_argument_still_resolves`, `an_undeclared_name_in_a_fold_handler_is_the_sole_refusal_at_its_atom` (three planned claims over one nullary native ingest) and v2.test.claim.binder_admission.callable_binder_slice `cbs_the_fold_encoding_step_admits_handler_binders_holds`.",
+    "CEILING: structurally guaranteed. A BoundInFrame projection base that is not the same reference a bare use of that binder is remains writable as source.",
+    "NEXT-RUNG TRIGGER, naming the capability: construction that makes an unbound fold-handler parameter unwritable. The three vfb_specimen_* identities passing native prepare remain inhabitance on a production claim module and do not raise the rung by themselves.",
   ],
 
-  evidence: [],
+  evidence: [
+    DeclarationRef { module_path: "v2.test.claim.resolve.fold_handler_binder_resolve", decl_name: "a_fold_handler_item_binder_resolves", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.test.claim.resolve.fold_handler_binder_resolve", decl_name: "a_non_fold_lambda_argument_still_resolves", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.test.claim.resolve.fold_handler_binder_resolve", decl_name: "an_undeclared_name_in_a_fold_handler_is_the_sole_refusal_at_its_atom", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.test.claim.binder_admission.callable_binder_slice", decl_name: "cbs_the_fold_encoding_step_admits_handler_binders_holds", field: WholeDeclaration },
+  ],
 }
diff --git a/dag/gunbc/recurring_failure_mode/gate_reported_success_on_a_phase_it_refused.dag b/dag/gunbc/recurring_failure_mode/gate_reported_success_on_a_phase_it_refused.dag
index 0a228069b92..d0b0bd338b1 100644
--- a/dag/gunbc/recurring_failure_mode/gate_reported_success_on_a_phase_it_refused.dag
+++ b/dag/gunbc/recurring_failure_mode/gate_reported_success_on_a_phase_it_refused.dag
@@ -37,7 +37,6 @@ data gate_reported_success_on_a_phase_it_refused: RecurringFailureMode = Recurri
     DeclarationRef { module_path: "v2.workflow.required_ci_measurement", decl_name: "required_ci_measurement_admitted", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.required_ci_measurement", decl_name: "adjudicate_required_ci_measurement", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run.required_ci_measurement", decl_name: "adjudicate_required_ci_measurement_receipt_file", field: WholeDeclaration },
-    DeclarationRef { module_path: "gunbc.compiler_gate_workflow", decl_name: "compiler_gate_floor_run_step", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.witness_floor_workflow", decl_name: "required_ci_measurement_adjudicate_step", field: WholeDeclaration },
   ],
 }
diff --git a/dag/gunbc/recurring_failure_mode/generated_population_split_across_two_unjoined_rosters.dag b/dag/gunbc/recurring_failure_mode/generated_population_split_across_two_unjoined_rosters.dag
index 18665e95a0a..6838619e5fd 100644
--- a/dag/gunbc/recurring_failure_mode/generated_population_split_across_two_unjoined_rosters.dag
+++ b/dag/gunbc/recurring_failure_mode/generated_population_split_across_two_unjoined_rosters.dag
@@ -23,7 +23,6 @@ data generated_population_split_across_two_unjoined_rosters: RecurringFailureMod
 
   evidence: [
     DeclarationRef { module_path: "gunbc.generated_artifact_registry", decl_name: "committed_generated_artifacts", field: WholeDeclaration },
-    DeclarationRef { module_path: "gunbc.compiler_gate_workflow", decl_name: "compiler_gate_drift_step", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.rung_drop.witness_floor_off_the_required_gate", decl_name: "witness_floor_off_the_required_gate", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.required_ci_phase_roster", decl_name: "RequiredCiPhase", field: WholeDeclaration },
   ],
diff --git a/dag/gunbc/recurring_failure_mode/green_floor_executes_no_claim_whose_verdict_a_body_change_can_move.dag b/dag/gunbc/recurring_failure_mode/green_floor_executes_no_claim_whose_verdict_a_body_change_can_move.dag
index c7fec68baa2..bab505487aa 100644
--- a/dag/gunbc/recurring_failure_mode/green_floor_executes_no_claim_whose_verdict_a_body_change_can_move.dag
+++ b/dag/gunbc/recurring_failure_mode/green_floor_executes_no_claim_whose_verdict_a_body_change_can_move.dag
@@ -21,6 +21,7 @@ data green_floor_executes_no_claim_whose_verdict_a_body_change_can_move: Recurri
     "NEXT-RUNG TRIGGER, NAMING THE CAPABILITY: the required floor executes, on every pull request, every enrolled claim whose declaration reach contains a declaration the diff changed, at the diff's base and at its head. A claim blocks only when it held at base and fails at head, and a selection over its declared budget refuses with a typed cause rather than truncating or widening. The design was ruled by neat-boar-16 on 2026-09-26. It makes `v2.test.*` claims differentially merge-blocking for the first time. The operator ruled on 2026-09-27 that the per-PR v2 claim comparison is merge-blocking over this selection intersected with the v2 claim set, never over the whole set, and the enabling step is its own change (work item adhoc-6969b422-bec). LANDED WITH THIS ROW, observe-only: `namespace_baseline` `body_reach_from_changed_declarations` closes the diff's changed declarations under every read channel over the index the parse phase already built. Its seeds are the declaration grain of the floor's own line attribution plus every interface change. The floor prints one `[floor-plan] BodyReachWitness` line per reached witness declaration and a `[floor-phase] phase=body-reach-selection` summary, and plans nothing from it. The propagation rule is modeled as `v2.workflow.floor_subject_seed` `reach_propagates`: a body read propagates for `ClaimExecution` and not for `StrictPreparation`. The executed red is `a_body_only_change_reaches_the_witness_two_calls_away`: the compile walk plans nothing, and the reach walk selects the witness two calls away and neither the idle importer nor the unrelated witness. THE BASE-VERDICT CACHE THE ENABLING STEP NEEDS is a materialization (`std.materialization_ladder`). Its key must cover the claim identity, a digest of the base tree over every declaration in the claim's reach, and the seed and interpreter identity, or it is a stale-answer source.",
 
     "THE BOUND, STATED SO THE OBSERVE-ONLY GREEN IS NOT OVER-READ. (1) Until the enabling switch lands, nothing in this row blocks a merge. The class is still below rung 1 on the merge path and is now counted rather than silent. (2) Reach is at the grain of the reference index: a read only through an INFERRED type that no declaration on the path spells is not reached (the same limit as the compile-grain peer, with the same trigger, the resolver's own reference relation replacing name occurrences). (3) A reached declaration is a witness only if its module is a fixture carrier (`declaration_index` `module_is_fixture_carrier`). The floor's own discovery decides which of those are claims. (4) MEASURED ON THE REAL HISTORY (srv1 planning receipts, replay heads on branches `replay/cool-otter-576/*`): #12361's replay reaches all ten of its base-pass/head-fail claims among 3655 witness declarations; the unrelated-diff control (#12353) reaches 522, confined to readers of what it changed; a one-declaration body edit to `v2.std.node` reaches 3286; and the selection costs about 1.8 s of wall time in each. The first round of the same replay FAILED its control (13147 for the unrelated diff) through two defects, and both are the reason this walk does not simply reuse the compile walk's flat channel: a dotted field access (`cfg.root`) and an ambiguous bare name were read as reads of a changed top-level declaration, and an import edit seeded every declaration in its file. The cost of EXECUTING a selection at base and head is the enabling step's receipt, not this row's.",
+    "SPECIMEN, WHOLE-MODULE FORM (gunbc#13556, floor run 37707872269; node adhoc-01443378-ec9). `test.claim.target_invocation_witness` (dag/test/claim/target_invocation_witness_test.dag) is named by neither `required_gate_prefixes` nor `required_gate_authored_modules`, so the static gate plans none of its claims; the only population planned on a pull request is the changed witnesses, the test fns whose own line range the diff edits. The PR added five claims and renamed one, and the floor's `required_floor_claim_cost` artifact lists exactly 14 of the module's 57 claims. THE OTHER CLAIMS WERE ENROLLED IN THE CORPUS AND EXECUTED BY NO LANE, AND TWO OF THEM WERE FALSE ON MAIN at 13b91523a9: `the_instrument_target_and_its_binding_are_the_same_identity` compared the live instrument registry to the literal 8 (a measurement copied from the tree it measures, false once the registry grew), and `the_instrument_label_is_absent_from_the_derived_required_aggregate` placed its planned fixture site at `v2.test.some_witness`, whose `v2.test.` prefix the revert gunbc#12852 removed from the gate roster, so the presence conjunct read DeclinedOutsideRequiredGate. Both were repaired in the change that files this receipt (identity-grain join of targets to bindings in place of the counts; the planned fixture site moved onto the `test.claim.infer_` family row); a standalone claim_batch over the module read 57/57 after, 55/57 before. NOT claim_batch-only: neither false claim depends on the harness, both reduce to a pure fold over a live population the claim literal disagreed with. THE UNPLANNED POPULATION AT THE BASE, BY IDENTITY, ALL FOR THE SAME REASON (module outside the static gate, claim not edited by the diff): `a_binary_whose_inputs_did_not_move_is_fresh`, `a_moved_bare_channel_gate_does_not_hold`, `an_absent_bare_channel_fixture_root_is_not_a_moved_gate`, `an_input_from_another_worktree_outranks_staleness`, `an_invented_population_routes_through_the_same_fold`, `an_unreached_subject_is_not_reported_as_a_failed_reading`, `a_prefix_of_a_registered_label_is_not_the_registered_target`, `a_registered_target_with_no_producer_refuses_as_a_registry_gap`, `a_relative_operand_refuses_as_not_absolute_and_not_as_a_pattern`, `a_subtree_is_not_contained_in_a_package_pattern`, `a_well_formed_label_naming_no_registered_target_refuses`, `every_behavioral_instrument_operand_routes_to_its_own_producer`, `narrowing_holds_while_divergence_does_not`, `target_patterns_refuse_with_the_cited_grammars_own_cause`, `the_acceptance_operand_routes_to_the_real_differential_producer`, `the_bare_channel_instrument_is_a_real_row_on_the_shared_registry`, `the_bare_channel_join_is_at_identity_grain_and_total`, `the_bare_channel_rendering_names_the_channel_and_the_pull_set`, `the_bare_channel_standing_rendering_locates_an_unreached_subject`, `the_bare_channel_standing_rendering_reports_the_read_populations`, `the_canonicality_cause_reaches_the_rendered_refusal`, `the_canonicality_cause_survives_into_the_routes_refusal`, `the_dependency_demand_census_operand_routes_to_its_own_producer`, `the_diagnostic_census_operand_routes_to_its_own_producer`, `the_diagnostic_census_refusal_renders_its_own_cause`, `the_diagnostic_census_rendering_reports_the_raw_counts_and_identity`, `the_diagnostic_census_wall_is_class_specific_and_severity_independent`, `the_direct_standing_is_not_the_aggregate_verdict_nor_the_blaze_export`, `the_evaluation_store_address_exact_head_operand_routes_to_its_own_producer`, `the_first_changed_input_is_named_as_stale`, `the_generic_identity_census_operand_routes_to_its_own_producer`, `the_instrument_label_is_absent_from_the_derived_required_aggregate`, `the_instrument_target_and_its_binding_are_the_same_identity`, `the_interpolation_hole_census_operand_routes_to_its_own_producer`, `the_nearest_discoverable_site_label_is_still_not_the_instrument_label`, `the_primitive_egress_census_operand_routes_to_its_own_producer`, `the_primitive_egress_census_v2_operand_routes_to_its_own_producer`, `the_regen_round_cost_operand_routes_to_its_own_producer`, `the_rendering_reports_the_populations_the_differential_measured`, `the_required_lane_resolution_census_operand_routes_to_its_own_producer`, `the_self_host_behavioral_equivalence_operand_routes_to_its_own_producer`, `the_universe_contains_itself_and_not_its_siblings`, `unreadable_dep_info_is_undecided_not_fresh`. Re-derive it with the artifact diff named above, never by transcribing this list as a count. This is the executed instance of the class, not a new class: the climb is the trigger above, and a module-grain gate row (`required_gate_authored_modules`) would be the stopgap, which is a gate change owed to a ruling and is NOT made here.",
   ],
 
   evidence: [
diff --git a/dag/gunbc/recurring_failure_mode/installation_observer_cannot_read_its_installed_policy.dag b/dag/gunbc/recurring_failure_mode/installation_observer_cannot_read_its_installed_policy.dag
new file mode 100644
index 00000000000..10d9005d30d
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/installation_observer_cannot_read_its_installed_policy.dag
@@ -0,0 +1,15 @@
+module gunbc.recurring_failure_mode.installation_observer_cannot_read_its_installed_policy
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data installation_observer_cannot_read_its_installed_policy: RecurringFailureMode = RecurringFailureMode {
+  identity: "installation_observer_cannot_read_its_installed_policy" as NonEmptyStr,
+  receipts: [
+    "2026-10-09, PR #13607: microvm_controller_install_srv1_wet installed release a85cc481af5 on srv1, then refused exact adapter readback. The installed sudoers policy was correctly root:root 0440, but workspace_executor_installed_adapter_matches attempted an ordinary Filesystem.Read as ghrunner. The observer had neither filesystem read permission nor an exact privileged read grant. No VM was commissioned by this installation.",
+    "Earliest unjustified boundary: installation establishes restricted policy custody, while the adapter observer assumes its caller can read every installed artifact directly. Correct installation makes that assumption false. This differs from demanding an output grant before installation: the read runs after installation, but the installed capability set never provided it.",
+    "Repair: workspace_dispatch_grant_read_operation names a SHA-256 measurement of the single policy path. Both its sudoers row and the actual elevated measurement derive from that operation. Root custody and equality with the digest of the complete expected bytes still gate acceptance; unreadable, absent or mismatched policy refuses. Neither file permissions nor access to the protected-state credential is widened. Raw cat readback was replaced after its normalized stdout lost the final LF, recorded in a_termination_contract_is_met_by_a_trimming_transport.",
+    "Guarantee: the operation and permission cannot disagree about argv because they share one value; installation_readback_grants_only_the_exact_policy_file executes the grant producer and discriminates this exact path from a wildcard or credential read. Actual account privileges and filesystem custody remain external facts, verified by the installed adapter readback as the job account. Live acceptance is required; the pure witness alone cannot prove sudo admitted that account.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/instrument_artifact_stopped_existing_while_cited.dag b/dag/gunbc/recurring_failure_mode/instrument_artifact_stopped_existing_while_cited.dag
index 8694873c34a..29e7f9fe32f 100644
--- a/dag/gunbc/recurring_failure_mode/instrument_artifact_stopped_existing_while_cited.dag
+++ b/dag/gunbc/recurring_failure_mode/instrument_artifact_stopped_existing_while_cited.dag
@@ -25,7 +25,6 @@ data instrument_artifact_stopped_existing_while_cited: RecurringFailureMode = Re
   evidence: [
     DeclarationRef { module_path: "gunbc.witness_floor_workflow", decl_name: "required_floor_claim_cost_upload_bound_step", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.witness_floor_workflow", decl_name: "required_floor_claim_cost_artifact_name", field: WholeDeclaration },
-    DeclarationRef { module_path: "gunbc.compiler_gate_workflow", decl_name: "compiler_gate_floor_measurement_bound_steps", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.floor_cost_distribution", decl_name: "parse_claim_cost_tsv", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.witness_floor_workflow", decl_name: "required_floor_disposition_upload_bound_step", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.gate_closure_decline_census", decl_name: "gate_closure_declined_identities", field: WholeDeclaration },
diff --git a/dag/gunbc/recurring_failure_mode/instrumentation_counters_inside_a_semantic_value_defeat_identity.dag b/dag/gunbc/recurring_failure_mode/instrumentation_counters_inside_a_semantic_value_defeat_identity.dag
index 1457f161916..c5d5a2abf2c 100644
--- a/dag/gunbc/recurring_failure_mode/instrumentation_counters_inside_a_semantic_value_defeat_identity.dag
+++ b/dag/gunbc/recurring_failure_mode/instrumentation_counters_inside_a_semantic_value_defeat_identity.dag
@@ -9,16 +9,14 @@ data instrumentation_counters_inside_a_semantic_value_defeat_identity: Recurring
 
   receipts: [
     "INVALID STATE: a value that carries semantic content also carries counters that observe its own use, which change on every operation. Two values holding the same semantic content compare unequal whenever an operation intervened between them, so an identity keyed on the value (a content-keyed memo, a demand key, a dedup) recurs only inside the windows where no counted operation happened. Every demand across those windows is a guaranteed miss that still pays key construction, stores an entry and keeps the argument alive.",
-    "INSTANCE: v2.compiler.parse ParseTableRealization carries memo_hits, memo_misses and memo_lookup_calls beside its entries, furthest failure and carried grammar analysis. parse_table_record_lookup_call, parse_table_record_hit and parse_table_record_miss rebuild the record on every lookup, so a call taking the table presents the seed eval-frame memo (extdeps.realization.eval_memo) with a key that recurs only until the next lookup (parse_table_with_furthest IS served hits inside such windows, measured on the llv probe), and misses across them. The seed memo still keys each such call, stores one entry and retains every table version (eval_call_memo_put). The repairs that closed the 02_parse quadratic -- the verification equality descending to shared allocations, and the per-insert map key beside #12066's per-push list key -- make each of those demands CHEAP; they do not remove them. That is DESIGN section 2's warning that caching makes redundant work cheap and suppresses the signal that would rank it for deletion.",
+    "INSTANCE (dissolved, see the last receipt): v2.compiler.parse ParseTableRealization carried memo_hits, memo_misses and memo_lookup_calls beside its entries, furthest failure and carried grammar analysis. parse_table_record_lookup_call, parse_table_record_hit and parse_table_record_miss rebuilt the record on every lookup, so a call taking the table presented the seed eval-frame memo (extdeps.realization.eval_memo) with a key that recurs only until the next lookup (parse_table_with_furthest IS served hits inside such windows, measured on the llv probe), and misses across them. The seed memo still keys each such call, stores one entry and retains every table version (eval_call_memo_put). The repairs that closed the 02_parse quadratic -- the verification equality descending to shared allocations, and the per-insert map key beside #12066's per-push list key -- make each of those demands CHEAP; they do not remove them. That is DESIGN section 2's warning that caching makes redundant work cheap and suppresses the signal that would rank it for deletion.",
     "HARM: bounded per call after the repairs, but unbounded in aggregate: one retained table version per missed table-taking call for the provider scope, and a miss population produced by the carrier rather than by the work. It also put the memo on the parse's hot path, where a verification cost proportional to the table (since repaired) presented under the parser's own name as a grammar defect (the 02_parse list-literal cost that blocked #12377).",
     "RUNG FOUND AT: mitigatable. Nothing stops a semantic carrier from embedding its own instrumentation; the repairs only bound the cost.",
     "ATTAINABLE CEILING: structurally impossible for carriers whose identity is consumed. Instrumentation is an observation of an occurrence (std.observation), not a field of the observed value, so a counter belongs in the observation channel beside the value, never inside it. NEXT-RUNG TRIGGER, NAMED AS A CAPABILITY: the parse's memo statistics (ParseMemoStats) produced by an observation channel the parse threads beside ParseTable, SUFFICIENT FOR ParseTable to compare equal across two calls that did the same semantic work, with every current ParseMemoStats consumer reading the channel instead of the table. The admission side of the same demand population (whether the seed memo should key a call that cannot recur) is the roadmap row eval-memo-admission-rewire-program, not this row.",
+    "INSTANCE DISSOLVED BY DELETION, NOT BY THE NAMED CAPABILITY (operator ruling R2 2026-10-08): the parse memo carrier was deleted from v2.compiler.parse -- ParseTableRealization's entries and its memo_hits, memo_misses and memo_lookup_calls fields, ParseMemoStats, parse_table_record_lookup_call, parse_table_record_hit, parse_table_record_miss and parse_table_memo_stats -- because the memo served captures whose occurrence ids were minted on abandoned backtrack paths (gunbc.recurring_failure_mode.parse_memo_hit_serves_occurrences_minted_on_an_abandoned_path). The specimen therefore has no live carrier and no counters to move into an observation channel. The class itself is unchanged: nothing yet stops another semantic carrier from embedding its own instrumentation, so the row's rung stays mitigatable and the observation-channel capability remains the trigger for the next instance.",
   ],
 
   evidence: [
-    decl_ref(module_path: "v2.compiler.parse", decl_name: "ParseTableRealization"),
-    decl_ref(module_path: "v2.compiler.parse", decl_name: "parse_table_record_lookup_call"),
-    decl_ref(module_path: "v2.compiler.parse", decl_name: "parse_table_memo_stats"),
     decl_ref(module_path: "extdeps.realization.eval_memo", decl_name: "eval_memo_facts"),
   ],
 }
diff --git a/dag/gunbc/recurring_failure_mode/located_cause_folded_to_its_reason_at_a_result_boundary.dag b/dag/gunbc/recurring_failure_mode/located_cause_folded_to_its_reason_at_a_result_boundary.dag
index 0d16c19e973..1ee305eacc0 100644
--- a/dag/gunbc/recurring_failure_mode/located_cause_folded_to_its_reason_at_a_result_boundary.dag
+++ b/dag/gunbc/recurring_failure_mode/located_cause_folded_to_its_reason_at_a_result_boundary.dag
@@ -17,7 +17,7 @@ data located_cause_folded_to_its_reason_at_a_result_boundary: RecurringFailureMo
 
     "THE SAME SHAPE AT ANOTHER GRAIN IN THE SAME LANE, LEFT STANDING AND NAMED: NativeTestFileRefusal carries `head_reason` and `fatal_reason` for a front-end refusal whose diagnostics carry Textual file-and-extent loci -- the most actionable position the pipeline produces. The row is read by the seed host runner's TSV-shaped decoder, so widening it is a change to that decoder as well; it is the declared remainder of the package that filed this row, not an oversight.",
 
-    "RECEIPT THREE, the same night, the NEIGHBOURING SHAPE: the refusing link spelled with an ADVISORY'S name. v2.compiler.translate's grounding gate refused emission with `infer_grounding_not_derived` -- the very symbol infer carries as a frontier ADVISORY on its Accepted path for the same node (review 46789 routed the gate through canonical_grounding_from_inferred_facts precisely so that symbol would propagate). The built native CLI's refusal then read as a chain of thirty-five `infer_grounding_not_derived` with the last one picked as the fatal -- correctly picked, and unreadable: one name, two contracts (DESIGN section 3, a meaning fork), so an operator could not tell the refusal from the rows that rode along. The CLI's `reason` field compounded it by carrying `d.head.reason`, the FIRST pending advisory (the grammar-global overlap residue), so every broken entry refused under one indistinguishable reason. Repaired by giving the gate its own fatal `translate_rejected_grounding_not_derived` -- eval's gate had already drawn that line with `eval_rejected_grounding_not_derived` -- and by deriving the CLI's reason through diagnostics_fatal_reason.",
+    "RECEIPT THREE, the same night, the NEIGHBOURING SHAPE: the refusing link spelled with an ADVISORY'S name. v2.compiler.translate's grounding gate refused emission with `infer_grounding_not_derived` -- the very symbol infer carries as a frontier ADVISORY on its Accepted path for the same node (review 46789 routed the gate through canonical_grounding_from_inferred_facts precisely so that symbol would propagate). The built native CLI's refusal then read as a chain of thirty-five `infer_grounding_not_derived` with the last one picked as the fatal -- correctly picked, and unreadable: one name, two contracts (DESIGN section 3, a meaning fork), so an operator could not tell the refusal from the rows that rode along. The CLI's `reason` field compounded it by carrying `d.head.reason`, the FIRST pending advisory (then the grammar-global overlap residue, a reason since retired), so every broken entry refused under one indistinguishable reason. Repaired by giving the gate its own fatal `translate_rejected_grounding_not_derived` -- eval's gate had already drawn that line with `eval_rejected_grounding_not_derived` -- and by deriving the CLI's reason through diagnostics_fatal_reason.",
 
     "WHY IT RECURS: the reason symbol is the field every AUTHORITY keys on -- cause-ownership tables, expected-red rosters, exclusion taxonomies all classify by reason -- so a carrier designed for the authority's question carries exactly the authority's key and nothing more, and the operator's question (where) has no field. The fix is never to add a second field beside the reason: it is to carry the Diagnostic and DERIVE the reason, so the authority reads the same symbol and the operator reads the same value.",
 
diff --git a/dag/gunbc/recurring_failure_mode/lowered_output_reread_as_raw_parse_at_v2_body_lowering.dag b/dag/gunbc/recurring_failure_mode/lowered_output_reread_as_raw_parse_at_v2_body_lowering.dag
index fa8c0e000a2..d30a1e706dc 100644
--- a/dag/gunbc/recurring_failure_mode/lowered_output_reread_as_raw_parse_at_v2_body_lowering.dag
+++ b/dag/gunbc/recurring_failure_mode/lowered_output_reread_as_raw_parse_at_v2_body_lowering.dag
@@ -10,13 +10,16 @@ data lowered_output_reread_as_raw_parse_at_v2_body_lowering: RecurringFailureMod
   receipts: [
     "**a lowered node that the body-lowering allowlist does not name is RE-READ AS RAW PARSE, and the parse readers' first-match descents answer a PART of it with no diagnostic** (INVALID STATE: a producer's output -- a construct, a field projection, a qualified-name spine, a literal -- reaches a reader above it in v2.compiler.body_lowering_fold, body_lower_is_core_substrate answers false because nobody added that shape to it, and the reader walks the node again as if it were unlowered, answering its first atom, its base, or a recognised descendant.) This is the SOURCE of the silent part-for-whole class that gunbc#12145 exposed site by site (as_cast_has_no_lowered_form, caret_symbol_has_no_lowered_form, else_less_if_statement_has_no_lowered_form and compound_call_argument_value_refused_as_unread all cite 12145's silent narrowing), and each earlier instance was closed at the symptom by growing the allowlist: the qualified-name spine (call_expression_erased_at_v2_body_lowering, gunbc#11683), the construct, the int literal's digit list, and #12269's field projection (`p + g(x).a` lowered to `p + g(x)`). It is DESIGN section 5's absorbing fallback: a reader that cannot classify a node widens to the parse reading instead of refusing.",
     "CENSUS (MQ-5, wise-ant-748, 2026-09-30). Instrument: at each of the nine readers that consult the allowlist and can refuse (operand_ref_read, try_body_lowered, reduce, fold, data_initializer_body, lowered_behind_shells_read, primary_expr, after_children, operator_operand), a node the allowlist rejects that is a non-atom with children and no grammar projection edge refused under a site-named reason, on a scratch pin that never merged; the native route (claim_executor --v2-native-route) ran over the full population beside a baseline at the merge-base. Positive control: the unknown shape refused, a field projection and a raw sequence passed. Result: ZERO sites. Every verdict matched the baseline cause for cause, so the allowlist names every shape today's producers emit. LIMITS, stated with the count: files refused before or during lowering are masked (27 lowering refusals, let_body_not_reachable_from_node and wrapper_retention, can hide a later hit in the same file, so the census is re-measured once those clear); the census keys on the absence of a grammar projection edge. A SEPARATE SITE the nine-reader census could not see, named here per the neat-boar-16 ruling: body_lower_find_core_substrate_optional, a first-match DESCENDANT search whose one caller is body_lower_body_subtree_lower_from_primary. When it meets an unrecognised lowered node it descends and answers the first recognised node inside it, a part for the whole. It is instrumented at its caller by body_lower_find_core_substrate_passes_unrecognised and now refuses there too.",
-    "RUNG FOUND AT: below the floor (silent wrongness). CURRENT RUNG: structurally guaranteed for the population that reaches the ten sites -- no Accepted program re-reads unrecognised lowered output there, because each refuses with body_lowering_reason_unrecognised_lowered_shape located at the node -- held by a SHAPE test (non-atom, children, no parse projection edge -- the roster is v2.compiler.parse parse_tree_projection_edge, the one authority namespace_graft and symbol_index_fill already ask; the census ran with a ten-label list that also named labels only v2.std.grammar grammar_expr_to_node mints, never parse output, and review 73534 consolidated it onto the roster), not by construction. The refusal names the node and not its producer, because nothing on a Node says which lowering built it. CEILING: structurally impossible. NEXT-RUNG TRIGGER, NAMING THE CAPABILITY: EACH BODY-LOWERING PRODUCER DECLARES THE SHAPE IT EMITS AND THE body_lower_is_core_substrate PREDICATE IS DELETED, so no reader classifies a node by shape at all and the hand-synced allowlist no longer decides recognition. STAGING, STATED PLAINLY: this rung keeps that predicate deciding, which departs from the end state of MQ-5 condition (2); the climb here is silent truncation to a located refusal, not construction. The intended realization is a LoweredShape arm returned by each producer by construction and carried in a BodyTerm (RawParse or Lowered) that every reducer consumes, exiting to Node once at the normalize boundary (neat-boar-16 ruling 2026-09-30, option A; a marker edge on Node and a roster-generated predicate were both rejected). The PR that moves the last reducer onto BodyTerm DELETES body_lower_is_core_substrate, body_lower_is_unrecognised_lowered_shape and body_lower_find_core_substrate_optional together; there is no period in which both the predicate and the tag answer for the same reducer. A KNOWN LIMIT OF THE CONTROLS, AND WHY IT IS NOT CLOSED HERE: removing ONE site's guard is not caught, because the guards overlap -- an unknown node the fold no longer refuses still reaches body_lower_reduce, which refuses it -- so the controls establish that the refusal holds, not which site holds it; the mutation that restores the re-read everywhere (the shape test forced false) reds the fold, operand-reader and descendant-search controls while the field projection stays green. The overlap is itself duplicated work (DESIGN section 2): ten sites ask one shape question about one node. It is not pinned site by site, because that would build per-site evidence for guards the cut deletes all together; under BodyTerm a Lowered term is never asked the question at all.",
+    "THE CUT (MQ-5, cool-wolf-52, neat-boar-16 rulings 2026-09-30 option A and 2026-10-01 interim B stacked on #12799; operator approval msg_63aee66e). body_lower_is_core_substrate, body_lower_is_unrecognised_lowered_shape, body_lower_find_core_substrate_optional and body_lower_find_core_substrate_passes_unrecognised are DELETED together; no reader is answered by both the allowlist and the tag. Each producer's result leaves the producer inside a wrapper whose one edge is the core marker v2.std.node BodyTermLoweredEdge, carrying a sole_constructor seal minted only for v2.compiler.body_lowering_fold body_term_seal, with the producer's LoweredShape arm as a constant. Every reader asks body_term_of, which answers Lowered (sealed), RawParse (a composite carrying a grammar projection edge, the roster v2.compiler.parse parse_tree_projection_edge), RawLeaf (a childless atom or conj, or a literal token the parse mints with its own payload edge), or refuses located at the node. A Lowered term is taken whole and never descended. The wrappers leave the tree exactly once, at v2.compiler.normalized_tree admit_retention_free (body_term_erase_tree, admit_callers-sealed to it). The one place a lowered value's interior is walked, the reify pass, reads an unstamped composite under a lowered value as lowered by position (body_lower_reify_interior_is_lowered) and is the only such reading.",
+    "RUNG FOUND AT: below the floor (silent wrongness). CURRENT RUNG, PER PATH (DESIGN section 4b(1)). Seed acceptance and interpreted path: STRUCTURALLY GUARANTEED. A reader cannot re-read lowered output as raw parse, because a sealed term is matched and taken whole and an unsealed composite refuses; and the seal cannot be forged, because a fixture building the marker without it refuses at compile, both by calling the mint (ConstructorCallAdmissionRefused) and by writing the record (SoleConstructorViolation). Native route: LOWER. admit_callers is discarded there (gunbc.rung_drop admit_callers_discarded_on_the_native_route), so the seal's mint can be called from anywhere and a forged term is admissible; that row's restoration trigger restores this path's rung and nothing else here does. CEILING: structurally impossible. NEXT-RUNG TRIGGER, NAMING THE CAPABILITY: the fold's tree is a typed BodyTerm term tree that normalize consumes, so an unsealed lowered composite has no representation at all rather than a refusal. A NARROWER LIMIT, ON THE LEAF ARM: a leaf carries no projection edge and today inherits its source occurrence, so its provenance is not on it; it has no interior, so no part of it can be read for the whole, and producers seal every atom they return, including one passed through unchanged. Its trigger is lowered nodes minting OccurrenceProjected (gunbc#12790).",
   ],
 
   evidence: [
     DeclarationRef { module_path: "v2.test.claim.body_lowering_unrecognised_lowered_shape", decl_name: "an_unrecognised_lowered_shape_refuses_at_the_fold", field: WholeDeclaration },
-    DeclarationRef { module_path: "v2.test.claim.body_lowering_unrecognised_lowered_shape", decl_name: "the_descendant_search_does_not_answer_a_part_of_an_unrecognised_shape", field: WholeDeclaration },
-    DeclarationRef { module_path: "v2.test.claim.body_lowering_unrecognised_lowered_shape", decl_name: "a_field_projection_still_lowers_whole", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.test.claim.body_lowering_unrecognised_lowered_shape", decl_name: "an_unsealed_producer_output_refuses_at_the_fold", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.test.claim.body_lowering_unrecognised_lowered_shape", decl_name: "a_passed_through_atom_leaves_the_fold_sealed", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.test.claim.body_lowering_unrecognised_lowered_shape", decl_name: "a_forged_seal_mint_call_refuses", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.test.claim.body_lowering_unrecognised_lowered_shape", decl_name: "a_forged_seal_record_refuses", field: WholeDeclaration },
     DeclarationRef { module_path: "v2.test.claim.namespace_xl0.value_position_whole_read", decl_name: "a_field_projection_on_a_call_result_in_an_operand_lowers_whole", field: WholeDeclaration },
   ],
 }
diff --git a/dag/gunbc/recurring_failure_mode/lowering_accessor_collapses_a_sequence_operand.dag b/dag/gunbc/recurring_failure_mode/lowering_accessor_collapses_a_sequence_operand.dag
index 011274f102e..3206b6c718d 100644
--- a/dag/gunbc/recurring_failure_mode/lowering_accessor_collapses_a_sequence_operand.dag
+++ b/dag/gunbc/recurring_failure_mode/lowering_accessor_collapses_a_sequence_operand.dag
@@ -16,7 +16,7 @@ data lowering_accessor_collapses_a_sequence_operand: RecurringFailureMode = Recu
     "THE ORIGINAL NARROWING IS CLOSED (gunbc#12145, ada85b9452). `v2.compiler.body_lowering_fold` `body_lower_read_operator_expression` reads the grammar's precedence tower whole and `body_lower_operand_ref_optional` no longer returns `pair.left` for a sequence, so the `a + b` / `left: seed + acc` specimen above no longer describes main: the third operand of a chain, the right of `==` and of a comparison, the operand of a prefix `!`, and a plain `a && b` inside an if-arm or a let value each reach a reference site (`v2.test.claim.namespace_xl0.sequence_operand_resolve_refusal`). `body_lower_named_arg_value_optional`, named in the specimen, no longer exists: call arguments read through `body_lower_value_lowered` since gunbc#12173. The receipts above are kept as the class's history, not as its current specimen.",
     "WHAT KEEPS THE ROW OPEN, THE CURRENT SPECIMEN (2026-09-24): an Optional operand reader ANSWERING ABSENT where it should refuse. `let x = b && (u)` followed by `x`, with `u` undeclared, RESOLVES on main: `body_lower_bound_value` asks `body_lower_arm_operand_resolved_optional` first and accepts its answer, and that reader has no arm that says `I could not read this operand` -- only Present or Absent, and Absent is indistinguishable from `not an operand` -- so the parenthesised `(u)` never reaches resolve and no diagnostic is raised. This is the silent-loss half of the class with the narrowing mechanism removed: the operand is no longer replaced by a proper part of itself, it is dropped because the reader's type cannot carry a refusal. It is gunbc.compiler_frontend_program_status `OptionalAccessorLocatedRefusal`, an outstanding XL-2 prerequisite, and it closes only by the trigger above.",
     "EXPOSED, NOT REGRESSED: THE OTHER CONSUMERS OF THE SAME READER (2026-09-24). Closing the narrowing arm (gunbc#12145) was correct, and it was proven only at the consumer it was about (`v2.test.claim.namespace_xl0.sequence_operand_resolve_refusal`). The same reader, `body_lower_operand_ref_optional`, was also the value reader of three other consumers in `v2.compiler.body_lowering_fold`: call arguments, match scrutinees, and `body_lower_operator_operand`'s fallback. For a call or a lambda there, the narrowing had been this row's silent truncation (`match f(x)` read as `f`, `f => body` read as `f`). Once it was closed, they refused their whole module (`call_argument_unread`, `match_arm_navigation_refused`, `operator_operand_unread`: 85 (cause, path) identities added and 4 removed across the native lane). This is a PAIRING / COVERAGE GAP, not a regression: the change's claims were reachability witnesses for one consumer and were read as completeness evidence for the reader, and no control exercised the reader's other consumers. The repair reads call arguments and scrutinees through `body_lower_value_lowered` (gunbc#12173, `v2.test.claim.namespace_xl0.call_argument_value_resolve_refusal`); gunbc#12198 adds the production-route SHAPE control (`v2.test.claim.namespace_xl0.value_position_whole_read`: callee, arity and argument at the authored atom) as a permanent regression control. Operator operands are gunbc#12194's. A LAMBDA ARGUMENT REMAINS THE FRONTIER: carrying its shell whole was tried and measured (srv1, 8fc9f27377) -- the module normalizes but the parameter is unscoped at resolve, a refusal moved rather than repaired -- so it was dropped, and the two lambda claims are enrolled expected-red in `v2.workflow.floor_expected_red` `floor_expected_red_chunk_lambda_argument_lowering` until lambda lowering lands. An operator-operand fallback added in the same episode was DEAD: no bare, parenthesised or mutated operand ever reached it (M1/M2 green), and removing it regressed none of the six operand files -- a second instance of this row's lesson that a claim must assert its route, not only its answer",
-    "TWO LESSONS FROM THE WHOLE-ROUTE IDENTITY DIFF THAT FOUND IT. (1) An identity diff cannot tell INTRODUCED from EXPOSED. Of the rows new relative to the parent, two (`dag/std/keyed_roster.dag`, `src/v2/std/compilers/sugar.dag`, head `parse_grammar_choice_overlap_residue`) had never refused: the narrowing had silently read a parse residue. Most of the others were parent `parse_g0_tokens_remain` files moving to a LATER stage (`else_less_if_unlowered`, `list_literal_unlowered`, `wrapper_retention_not_normalized`) once they parsed. Each row must be classified against the parent's (cause, path) set, not counted. (2) A net count hides the structure: 11 -> 92 was reported as 81 new refusals, while at identity grain it was 85 added and 4 removed, with cause SWAPS on the same path (`02_parse.dag`, `target_model.dag` and `grammar.dag` removed under wrapper_retention and re-added under match_arm_navigation)",
+    "TWO LESSONS FROM THE WHOLE-ROUTE IDENTITY DIFF THAT FOUND IT. (1) An identity diff cannot tell INTRODUCED from EXPOSED. Of the rows new relative to the parent, two (`dag/std/keyed_roster.dag`, `src/v2/std/compilers/sugar.dag`, head `parse_grammar_choice_overlap_residue`, a reason since retired: grammar validation now refuses every overlap row) had never refused: the narrowing had silently read a parse residue. Most of the others were parent `parse_g0_tokens_remain` files moving to a LATER stage (`else_less_if_unlowered`, `list_literal_unlowered`, `wrapper_retention_not_normalized`) once they parsed. Each row must be classified against the parent's (cause, path) set, not counted. (2) A net count hides the structure: 11 -> 92 was reported as 81 new refusals, while at identity grain it was 85 added and 4 removed, with cause SWAPS on the same path (`02_parse.dag`, `target_model.dag` and `grammar.dag` removed under wrapper_retention and re-added under match_arm_navigation)",
     "THE INSTRUMENT'S OWN GAP: the native lane's driver rows carry (fatal_reason, head_reason, path) and NO LOCUS. So a file refusal names a file and a cause but not the construct, and every consumer of the diff (the author, the manager, the operator) must re-derive the span by rerunning a front end over that file; three rows in this episode could not be attributed from the rows alone. A span-less file refusal is DESIGN section 5's located-diagnostic obligation unmet at the reporting boundary, and the identity diff is sufficient as a regression control only once its rows carry the refusal's locus",
     "THE REFUSAL IS NOW CARRIED; THE NARROWING IS NOT YET UNWRITABLE, SO THE TRIGGER STAYS OPEN (2026-09-24). `v2.compiler.body_lowering_fold` `OperandRefRead` gives the operand reader its third answer: `body_lower_operand_ref_read` answers the operand whole, a located refusal carried up from `body_lower_read_operator_expression`, or not an operand; `body_lower_try_operand_or_reject`, `body_lower_operand_from_shell_read` and `body_lower_arm_operand_resolved_read` propagate the refusal instead of falling to the first-match literal and pattern readers, and a parenthesised group reads as its inner expression. The let-value route that exposed the class no longer reads through the operand reader at all: `body_lower_bound_value` lowers the bound value whole through the fold. RED ON MAIN 2c097e8979, measured on the native census route (tokenize, parse, normalize, index, resolve): `let x = b && (u)` bound `b`, `let x = g(p: u)` bound the CALLEE `g`, and `let x = (u)` and `let x = if a { u } else { a }` bound a part, so all four modules RESOLVED with `u` undeclared. After the change each refuses `resolve_reason_unbound_symbol` at `u`, and the declared-shape controls resolve (`v2.test.claim.namespace_xl0.bound_value_resolve_refusal`). TWO MORE MEMBERS FOUND ON THE IF ROUTE BY THE SAME PROBE, BOTH RED ON MAIN: `body_lower_if_else_capture_optional` answered an `else if` arm as its if's captured content, hiding the if_expr identity, so `body_lower_if_arm_lowered` searched it for a statement sequence and found the nested then-arm (`if a { b } else if c { d } else { u }` lowered to Branch(a, b, d)); and `body_lower_literal_bool_atom_optional` / `body_lower_literal_int_atom_optional` searched every child, so any node with a literal anywhere under it read as that literal (`if a { a } else if a { false } else { u }` lowered to Branch(a, a, false)). The else arm is now the if_expr shell, and the literal readers descend only through `body_lower_whole_inner_optional` (a captured child or a one-element sequence), never into a proper part. WHY THE TRIGGER IS NOT MET, AT ITS GRAIN: the capability is that narrowing has no constructor, and narrowing still has several. `body_lower_operand_fold_children_read` takes the first child that is an operand, `body_lower_pattern_first_atom_optional` and the literal atom searches are deep first-match readers, and `body_lower_operand_ref_optional` remains as a projection that forgets a refusal for callers that fall back to another reader. The callee-for-call reading above is exactly a fold-children first operand standing in for the whole. It left the let route because that route stopped asking the operand reader, and the reading itself stayed writable. The accessor named in this row's trigger, `body_lower_named_arg_value_optional`, no longer exists (gunbc#12173 reads a call argument through `body_lower_value_lowered`), so the trigger is restated at the capability: every operand reader answers the whole value or a located refusal, and no first-match reader is reachable from a value position. THE CLAIMED LENS DISSOLUTION IS REFUTED, NOT PENDING: `v2.lens.complexity_accumulator_copy.analyze` `arg_value_node` answers an argument's VALUE SUBTREE, which the lens censuses for identifiers, while the compiler accessor answers what the argument LOWERS TO. The two answer different questions, so meeting this trigger would not dissolve it. Its spine decoding already delegates to `v2.extdeps.languages.dag` `dag_named_arg_value_optional`; the compiler's `body_lower_named_arg_value_capture_optional` decodes the same spine a second time, which is a separate section 3 fork and not a member of this row",
     "THE SAME COLLAPSE AT THE STATEMENT GRAIN (2026-09-24, adhoc-9d86ad93-96c, gunbc#12230). `v2.compiler.body_lowering_fold` `body_lower_try_statement_spine` routed a statement spine to `body_lower_stmt_spine` only when it was LET-HEADED, and handed every other multi-statement spine back to the expression walker, which answered with ONE statement and dropped the rest: `fn f() -> Int { 1 \\n 2 }` normalized clean. It is this row's shape one level up -- a sequence read as a proper part of itself, with no refusal -- and the claim that guards it, `v2.test.claim.body_lowering.statement_let_bind` `unbound_statement_prefix_refuses_holds`, was RED ON MAIN, visible only because MQ-6's reference-conservation admission then refused the dropped statement as `conservation_reason_dropped_reference` (srv1, neat-boar-16, round 1). REPAIR: gunbc#12221 (`body_lower_stmt_spine_has_successor`) admits every spine with a following statement, so a non-binding head refuses as `body_lowering_reason_statement_precedes_without_binding`, located. THE COVERAGE LESSON IS THE WITHHOLD: no required lane ran the claim, because its module matched no required-gate selector AND all six of its identities were withheld as cost debt in `v2.workflow.floor_cost_debt`, so even an admitted run would have declined them. gunbc#12230 removes the six from the cost-debt roster and admits the module in `v2.workflow.required_floor` `required_gate_authored_modules`. The discriminating evidence is a mutant restoring the let-headed guard, which must turn that required floor red on `unbound_statement_prefix_refuses_holds`."
diff --git a/dag/gunbc/recurring_failure_mode/memo_key_cost_proportional_to_argument_size.dag b/dag/gunbc/recurring_failure_mode/memo_key_cost_proportional_to_argument_size.dag
index 198f71dcf57..2cd296b45ad 100644
--- a/dag/gunbc/recurring_failure_mode/memo_key_cost_proportional_to_argument_size.dag
+++ b/dag/gunbc/recurring_failure_mode/memo_key_cost_proportional_to_argument_size.dag
@@ -12,7 +12,7 @@ data memo_key_cost_proportional_to_argument_size: RecurringFailureMode = Recurri
     "HARM: extdeps.languages.json parse_json_document was reported as not returning on a large document and was read as a parser defect. The parser is linear with the memo off; the cost was the interpreter's default-on eval-call memo (v1_interpreter eval_pure_named_call -> eval_recompute_key). A cost defect in a shared provider presents as a defect in its most visible consumer, which is how a victim gets repaired instead of the cause.",
     "DISTINGUISHING FACTS: the instrument is tools.json_parse_ladder (dag/gunbc/instruments/json_parse_ladder.dag), one `gunbc run --function <rung>` per rung, each rung exiting non-zero when its value is not the one it owes. The discriminator is GUNBC_EVAL_MEMO=0, the memo's declared diagnostic realization switch with identical values: a curve that bends with the memo on and runs linear with it off locates the cost in the key and not in the consumer. A recursion that only PASSES the value, never reading it, paying the whole cost is the second tell; holding the same value in scope without passing it pays nothing.",
     "TWO INSTANCES, ONE CLASS. (1) A String argument was hashed in full per call because strings bypassed the identity hash memo that composites use: CLOSED by gunbc#12065, RcStr carries its content hash once per lineage (v1.compiler.runtime_rust rt_string_carrier), key values unchanged, re-serialized documents byte-identical. (2) A freshly built accumulator argument -- a list_push result, a new Rc every step -- misses the identity hash memo on every call and is rehashed in full: OPEN, and it cannot close at a carrier. Whether the memo should key a call that cannot recur is a provider-admission question under std.materialization_ladder, dispatched as its own work item by the DS4.1 lane (adhoc-55498ebb-b04).",
-    "THIRD INSTANCE, KEY SIDE CLOSED: a freshly built accumulator MAP -- v2.compiler.parse ParseTable's memo entries, a new Rc after every map_insert -- missed the identity hash memo and was rehashed whole whenever a table-taking call was keyed. CLOSED at the key the way gunbc#12066 closed the list case, under the same ruling (key derivation, not admission): v1_interpreter eval_recompute_extend_insert_hash derives the map key per insert and overwrite in O(1) plus the changed entry, since the map hash is an order-independent sum of mix(key, value) under an invertible finalizer. Property control: push_hash_extension_tests inserted_map_hash_is_the_full_fold_under_insert_and_overwrite, through both production arms. The accumulator LIST instance (2) was closed the same way by gunbc#12066. MEASURED CAVEAT: this was NOT the dominant cost of the 02_parse list-literal quadratic that blocked #12377. With the key repaired the parse stayed quadratic. The cost was the memo's VERIFY step (value_fast_eq shortcut only on top-level identity, so a served hit on a rebuilt record fell into a deep Value::eq over its shared parts), repaired in the same change by descending to the first differing allocation. A key-cost reading of a memo-sensitive curve is a hypothesis until the lookup's phases are timed separately. What stays open for these accumulators is retention and non-recurrence: gunbc.recurring_failure_mode.instrumentation_counters_inside_a_semantic_value_defeat_identity.",
+    "THIRD INSTANCE, KEY SIDE CLOSED: a freshly built accumulator MAP -- v2.compiler.parse ParseTable's memo entries (later deleted with the parse memo carrier, operator ruling R2 2026-10-08), a new Rc after every map_insert -- missed the identity hash memo and was rehashed whole whenever a table-taking call was keyed. CLOSED at the key the way gunbc#12066 closed the list case, under the same ruling (key derivation, not admission): v1_interpreter eval_recompute_extend_insert_hash derives the map key per insert and overwrite in O(1) plus the changed entry, since the map hash is an order-independent sum of mix(key, value) under an invertible finalizer. Property control: push_hash_extension_tests inserted_map_hash_is_the_full_fold_under_insert_and_overwrite, through both production arms. The accumulator LIST instance (2) was closed the same way by gunbc#12066. MEASURED CAVEAT: this was NOT the dominant cost of the 02_parse list-literal quadratic that blocked #12377. With the key repaired the parse stayed quadratic. The cost was the memo's VERIFY step (value_fast_eq shortcut only on top-level identity, so a served hit on a rebuilt record fell into a deep Value::eq over its shared parts), repaired in the same change by descending to the first differing allocation. A key-cost reading of a memo-sensitive curve is a hypothesis until the lookup's phases are timed separately. What stays open for these accumulators is retention and non-recurrence: gunbc.recurring_failure_mode.instrumentation_counters_inside_a_semantic_value_defeat_identity.",
     "RUNG OF THE VERIFICATION REPAIR, STATED AT ITS REAL GRAIN: mechanically preventable ONLY WHERE ITS DISCRIMINATOR RUNS, and today that is local-only. The discriminator is the Rust unit test v1_interpreter push_hash_extension_tests memo_verification_equality_agrees_with_value_eq_and_descends_to_sharing (verification agrees with Value::eq and decides rebuilt-around-shared records), with inserted_map_hash_is_the_full_fold_under_insert_and_overwrite for the key side. No CI step executes either, under gunbc.rung_drop rust_unit_tests_off_the_merge_path. The floor claim v2.test.parse.list_literal_parse_cost lpc_list_literal_parses_on_prepared_route is inhabitance only: it runs the real prepared route and cannot see the cost (gunbc.recurring_failure_mode.floor_eval_step_budget_cannot_see_host_side_work). NEXT-RUNG TRIGGER, whichever comes first: Rust unit tests back on the merge path (that drop's restoration), or a CPU-gated floor instrument SUFFICIENT FOR a claim to go red when host-side memo verification regresses to proportional-to-structure cost.",
     "RUNG FOUND AT: mitigatable, for the closed instance, and ONLY by measurement. No committed control pins the interpreter ROUTE: reverting either Value::Str key site in eval_recompute_arg_key or eval_recompute_value_hash back to eval_recompute_str_hash(s) leaves every committed test green. The v1-stage0-runtime rc_str_content_hash_tests pin the carrier (one hash per lineage, carried equals free) and are silent about whether the key sites read it. That is DESIGN section 3's pairing obligation unmet: deleting the integration does not make a control fail.",
     "CEILING: mechanically preventable for the route -- a control that observes how many content hashes an interpreted pure recursion over one threaded string performs, and goes red when that count scales with the step count. The accumulator instance's ceiling is set by its provider-admission ruling, not here.",
diff --git a/dag/gunbc/recurring_failure_mode/memo_key_rehashes_a_growing_persistent_value.dag b/dag/gunbc/recurring_failure_mode/memo_key_rehashes_a_growing_persistent_value.dag
index ded6cf54130..99bf07b318e 100644
--- a/dag/gunbc/recurring_failure_mode/memo_key_rehashes_a_growing_persistent_value.dag
+++ b/dag/gunbc/recurring_failure_mode/memo_key_rehashes_a_growing_persistent_value.dag
@@ -11,7 +11,7 @@ data memo_key_rehashes_a_growing_persistent_value: RecurringFailureMode = Recurr
     "REALIZATION SELECTION: extdeps.realization.eval_memo declares GUNBC_EVAL_MEMO=0 a diagnostic recompute realization with identical semantics. The census invocation discloses that selection. tools.cause_assertion_census.bounded_census supplies the bounded module-identity control: run the same production and witness subjects under both realizations and compare complete rows by declaration identity, including all fields and identity refusals. Agreement of counts alone is not semantic agreement.",
     "RUNG FOUND AT: mitigatable by diagnosis and realization selection. The found condition is repeated whole-value memo-key construction over fresh roots sharing unchanged persistent structure; no structural guard stops that work or the retention of successive argument roots. CURRENT MITIGATION: the disclosed census invocation selects extdeps.realization.eval_memo's existing recompute realization, avoiding memo-key construction on that invocation only. The bounded memo-on/off identity comparison is a semantic experiment, not containment of other memoized demands. The defect remains on retained memo-enabled paths.",
     "ATTAINABLE CEILING: structurally guaranteed for the declared population of memoized pure-call demands over persistent composite arguments. Unchanged shared structure must carry reusable key evidence, so a persistent update constructs key evidence only for changed structure; key retention must follow an explicit bounded demand lifetime rather than retain every successive argument root. This requires a producer and consumer contract for persistent-structure key evidence and retention ownership, missing at v1_interpreter.eval_recompute_key and eval_pure_named_call. An allocation-local hash cache on each fresh root does not provide that capability. NEXT-RUNG TRIGGER: every retained demand in that population consumes such evidence without re-traversing unchanged structure, and expired demand keys release their retained roots under the declared lifetime contract.",
-    "KEY-EVIDENCE CAPABILITY, PARTIALLY LANDED (2026-09-27): for the persistent Map, the changed-structure-only key evidence this row's ceiling names now exists at the insert constructor. v1_interpreter eval_recompute_extend_insert_hash derives a demand-keyed map's hash per insert and overwrite from its parent's, so a keyed accumulator map no longer re-traverses unchanged entries. The 02_parse ParseTable instance is the receipt. The retention half of the trigger is NOT met: successive argument roots are still retained under the memo's lifetime.",
+    "KEY-EVIDENCE CAPABILITY, PARTIALLY LANDED (2026-09-27): for the persistent Map, the changed-structure-only key evidence this row's ceiling names now exists at the insert constructor. v1_interpreter eval_recompute_extend_insert_hash derives a demand-keyed map's hash per insert and overwrite from its parent's, so a keyed accumulator map no longer re-traverses unchanged entries. The 02_parse ParseTable instance is the receipt (its memo entries were later deleted with the parse memo carrier, operator ruling R2 2026-10-08). The retention half of the trigger is NOT met: successive argument roots are still retained under the memo's lifetime.",
     "PROGRAM REMEDY: retire the seed implementation rather than author a new seed cache or evaluator patch. RETIREMENT TRIGGER: v1_interpreter.eval_pure_named_call and eval_recompute_key are absent from EVERY retained demand path in the declared population, including tools.cause_assertion_census.census and other interpreted pure folds; moving the census alone to the native route does not establish retirement of this class. Interpreter retirement is the program remedy, not the property's attainable ceiling. This row admits no new cache, evaluator patch, or census-specific bypass.",
   ],
   evidence: [],
diff --git a/dag/gunbc/recurring_failure_mode/memo_retained_occurrence_id_reminted_after_a_rejected_attempt.dag b/dag/gunbc/recurring_failure_mode/memo_retained_occurrence_id_reminted_after_a_rejected_attempt.dag
new file mode 100644
index 00000000000..ecea6efe1ff
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/memo_retained_occurrence_id_reminted_after_a_rejected_attempt.dag
@@ -0,0 +1,22 @@
+module gunbc.recurring_failure_mode.memo_retained_occurrence_id_reminted_after_a_rejected_attempt
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data memo_retained_occurrence_id_reminted_after_a_rejected_attempt: RecurringFailureMode = RecurringFailureMode {
+  identity: "memo_retained_occurrence_id_reminted_after_a_rejected_attempt" as NonEmptyStr,
+
+  receipts: [
+    "**v2 parse mints one occurrence id for two nodes when a rejected attempt memoized a production that is served later** (INVALID STATE: two nodes of one parse tree carry the same minted occurrence id, and the span index resolves one of them to the other's locus). `v2.compiler.parse` keeps the allocator inside `ParseProvenanceState`, which is path-local: a rejected subparse returns no provenance and its caller resumes with what it held. The memo is not path-local. `parse_expr_not_predicate_attempt` keeps the entries its attempt filled, and so does a choice's failed alternative. A memoized node therefore carried ids the resumed allocator had not counted, the next mints reissued them, and when the entry was served `parse_prov_merge` advanced the allocator only after the reuse had happened. Its replay then kept the index's earlier event for the reissued id (`v2.std.provenance` `span_index_adopt`), so the served node's locus became the other node's.",
+    "RECEIPT, AND HOW IT WAS FIRST MISREAD (sunny-ant-198, 2026-10-05, claim_batch on BuildBuddy). gunbc#13056 made every match arm body the statement production. Its statement repetition is guarded by `!(pattern =>)`, so at arm 2 the guard memoizes `pattern` and rejects. The repetition stamp and the arm wraps are then minted from the rolled-back allocator, and arm 2 is served `pattern` from the memo. In `v2.test.claim.body_lowering.single_arm_match`, `two_arm_match_still_accepts_holds` and `three_arm_match_keeps_every_arm_holds` went red. The reason was `conservation_reason_unmeasured` (`AtomExtentUnreadable`), one per arm after the first: the arm-2 `_` atom (#130) shared its id with the repetition stamp. It was never a dropped reference. The triage receipt on `match_arms_after_the_second_are_dropped_at_v2_body_lowering` read it as that class again, but every arm was in the normalized tree. The defect was in the parse. Discarding the predicate's memo turned both claims green, which isolated the cause. This annotation names the earliest unjustified boundary: the allocator is parse-global, but it was carried as path-local state.",
+    "REPAIR AT THAT BOUNDARY. `ParseTableRealization` `minted_through` is threaded through accepted and rejected results alike. It records the allocator that each stored, accepted memo entry consumed through (`parse_memo_entry_retains_through`, in `parse_table_insert`). Provenance resumes past that point (`parse_prov_past_memo`) at the sites that resume after a rejection: the next ordered alternative, an absorbed optional, a stopped repetition and a not-predicate whose element failed. A parse with no rejected memo is unchanged, because the high-water never exceeds its allocator. Conservation was left alone: its refusal was correct.",
+    "RUNG FOUND AT: below the floor and silent at parse (normalize Accepted). It was loud only where reference conservation reads extents, and that red was masked by `v2.workflow.floor_cost_debt` censored chunk 03. RUNG NOW: mechanically preventable. The discriminating RED is `v2.test.provenance.parse_memo_frame_replay` `parse_memo_entry_from_a_rejected_guard_resolves_like_a_memo_free_parse`, a hand grammar of the arm-body guard's shape compared against a memo-free parse. It is red against the parse before this repair, green after, and asserts a memo hit so that it exercises the route. Its sibling specimens are the positive controls. CEILING: structurally guaranteed. NEXT-RUNG TRIGGER, NAMING THE CAPABILITY: the parse's mint sites read the allocator from the threaded table, so that no mint can take its id from path-local provenance.",
+    "RE-SCOPED AT THE v1-CLOSEOUT FOLD: gunbc#13582 deleted the v2 packrat parse memo carrier (ruling R2, 2026-10-08), so `minted_through`, `parse_memo_entry_retains_through` and `parse_prov_past_memo` named above no longer exist and the memo-hit test was dropped with them. The class is retained as pattern-matching history: with no memo, no stored entry can outlive a rejected attempt and re-serve ids, so the invalid state has no constructor on the v2 parse route (structurally impossible there). The match-arm controls remain enrolled as evidence.",
+  ],
+
+  evidence: [
+    DeclarationRef { module_path: "v2.test.claim.body_lowering.single_arm_match", decl_name: "two_arm_match_still_accepts_holds", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.test.claim.body_lowering.single_arm_match", decl_name: "three_arm_match_keeps_every_arm_holds", field: WholeDeclaration },
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/native_infer_accepts_only_bool_and_int_match_scrutinees.dag b/dag/gunbc/recurring_failure_mode/native_infer_accepts_only_bool_and_int_match_scrutinees.dag
index dc1768a6071..a3c28df03a5 100644
--- a/dag/gunbc/recurring_failure_mode/native_infer_accepts_only_bool_and_int_match_scrutinees.dag
+++ b/dag/gunbc/recurring_failure_mode/native_infer_accepts_only_bool_and_int_match_scrutinees.dag
@@ -12,6 +12,7 @@ data native_infer_accepts_only_bool_and_int_match_scrutinees: RecurringFailureMo
     "HARM, AND THE FLOOR BLINDNESS IS PART OF THE FINDING: the interpreted floor never runs the native front end's infer over test modules -- it evaluates them directly -- so a claim module can be green on the floor and refused on the native route with no floor signal; the floor's green is not evidence about the native infer frontier, and this class was found only by executing the route.",
     "DISTINGUISHING FACTS. Not match_on_a_call_scrutinee_refused_as_arm_navigation (that refusal is at normalize on the interpreted route because the scrutinee is a CALL expression; here the scrutinee's TYPE -- a variant -- is what the infer gate rejects, on the native route, at prepare). Not the v2 body-lowering match rows (match_arms_after_the_second_are_dropped_at_v2_body_lowering and siblings): the refusal precedes body lowering. Not gunbc.rung_drop.variant_fields_unlowered_on_the_native_route, which records the frontier this refusal BLOCKS; this row records the refusal itself, one class per row.",
     "RUNG FOUND AT: mitigatable -- typed and loud at prepare, per-identity rows persisted in driver-rows.jsonl with the reason set.",
+    "RECEIPT (2026-10-05, clever-bat-68, PR #13210, head 00cead6b3b): the prepare refusal is GONE. `gunbc test '//v2/test/claim/variant_field_native_binding:all'` with GITHUB_SHA set derives universe=4 population=4 file_refusals=0 -- the same enrolled label that recorded the four NativeTestRefused rows at head 17fccbf3f62 now selects all four identities with no file refusal, because v2.compiler.04_infer's infer accepts variant scrutinees and grounds arm binders from the declaring coproduct's payloads (the construct read types by the variant's declaring path, which symbol_index_declaring_path_of answers at the alias because symbol_index_fill_containment_node files the alias as a BINDING to its declaring path (the receipt a_binding_position_recorded_as_a_declaring_identity's named repair, landed in this PR; the earlier carrier parallel map is retired); the per-tag coverage count is replaced by the single inhabitance relation's PositionMatchCoverage position, failing closed with infer_match_coverage_undecidable when the relation cannot decide). The variant-scrutinee discriminating evidence is the probe module v2.test.claim.variant_field_infer_probe: the located refusal reds (two-arm mismatch, projection, nullary, construction, call-result scrutinee underived, formal-payload gate) and the green controls beside them (construct read names the variant, construct read carrier is the declaring coproduct, partial match refuses as not covering the carrier, call-result arm binder types from its concrete payload field, arrow fixture resolves and names its variant, partial fixture still mints its variant row, concrete-Int-payload sibling prepares), each red without the change. Side-chat review 5452786886 ruled the earlier untyped shape FAIL-OPEN -- an advisory frontier the module could prepare under and the native lane could report as prepared -- so the binders fold now REFUSES the arm walk at resolve (^resolve_reason_pattern_payload_formal_uninstantiated, at the payload field) and the bare-formal control is ENROLLED as vfp_the_formal_payload_binder_refuses_at_prepare_red, with vfp_the_concrete_payload_sibling_still_prepares_holds proving the same two-arm shape prepares when the field is not a formal. The compound Box<T> and arrow fn(Int)->T controls remain DEFERRED and no wall is claimed over them: their honest own-frame fixture walks measure 7-10x the new-witness enrolment ceiling -- readings and the A/B trigger recorded in gunbc.recurring_failure_mode.a_generic_variant_construct_infer_walk_costs_about_seven_times_the_new_witness_ceiling. NOT YET THE RETIREMENT TRIGGER: the route's verdict layer recorded no verdicts for the selection on this run (admission refused: positive_population_empty, required_native_pass_regressed, unattributed_exclusions_present -- the same three names recorded-not-chased on the main lane), so no NativeTestPassed rows exist beside the floor green; this row stays open until those rows land, and the retirement is NOT claimed here.",
     "CEILING: structurally guaranteed. The gate names its own frontier; a coproduct's Disj already carries each alternative's payload (v2.compiler.04_infer's infer_sum_nullary_payload_edge reads a nullary alternative as a childless Conj beside its payload-bearing Named arms), so arm typing from variant payloads is decidable.",
     "NEXT-RUNG TRIGGER, naming the capability: variant-scrutinee match infer plus payload binder grounding in the emitted front end -- a match whose scrutinee's type is a coproduct accepts at prepare, arm binders ground from the alternative's payload fields, and the four vfb_* round-trip identities pass native prepare (NativeTestPassed rows beside the floor green).",
   ],
diff --git a/dag/gunbc/recurring_failure_mode/native_test_route_package_pattern_over_namespace_prefix_returns_universe_zero_silently.dag b/dag/gunbc/recurring_failure_mode/native_test_route_package_pattern_over_namespace_prefix_returns_universe_zero_silently.dag
new file mode 100644
index 00000000000..94efa5be741
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/native_test_route_package_pattern_over_namespace_prefix_returns_universe_zero_silently.dag
@@ -0,0 +1,24 @@
+module gunbc.recurring_failure_mode.native_test_route_package_pattern_over_namespace_prefix_returns_universe_zero_silently
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+
+data native_test_route_package_pattern_over_namespace_prefix_returns_universe_zero_silently: RecurringFailureMode = RecurringFailureMode {
+  identity: "native_test_route_package_pattern_over_namespace_prefix_returns_universe_zero_silently" as NonEmptyStr,
+
+  receipts: [
+    "**a package pattern over a namespace prefix (`//v2/test/claim/match_binder:all`) silently returns an empty universe -- universe=0, population=0, refused universe_underived -- where the correct behavior is a typed refusal naming the operand mismatch; the package half of a target pattern matches by exact package equality, and no module's package equals the prefix, so nothing can match (INVALID STATE: the lane reports success-shaped silence -- an empty selection -- instead of the typed operand refusal a mis-targeted pattern deserves, so a caller cannot distinguish 'wrong operand' from 'the lane is dead').**",
+    "CORRECTION OF THIS ROW'S PREDECESSOR (native_test_route_set_form_refuses_universe_underived_on_pristine_main, merged in #13236, deleted here): its observed state was real (the set-form invocation refuses with universe_underived on every head tried) but its diagnosis -- a break in the universe derivation entering main in a window -- is WITHDRAWN, unverified under the corrected instrument. The one-dispatch A/B below at a single head, same build, same seed emit, separates the operand from the lane.",
+    "RECEIPT (2026-10-04, clever-bat-68, remote BuildBuddy job ja878eb10, one dispatch, pristine main ed68b5573b336eb64fc1d2aa52d1c9fa29e4b247): the recursive form `gunbc test '//v2/test/claim/match_binder/...'` derives universe=13 population=13 (file_refusals=3, unrelated -- body_lowering_reason_service_realization_unreachable, parse_g0_tokens_remain); the set-form `gunbc test '//v2/test/claim/match_binder:all'` in the SAME build derives universe=0 population=0 and refuses universe_underived. Both tallies are re-derivable with the recorded invocation at the named sha.",
+    "RECORDED, NOT CHASED HERE (same receipt, the recursive run): the lane's qualification refuses on main with required_native_pass_regressed, unattributed_exclusions_present, and positive_population_empty -- the qualification gates beside the pattern operand; a separate row owns them if they recur.",
+    "RUNG FOUND AT: loud-but-blind -- the empty universe is typed (exit 2, terminal row, [native-occurrence-census] universe=0 observed=0) yet success-shaped to exit-only consumers, and it names universe_underived (a derivation failure) when the failure is the pattern operand; no floor lane observes the difference.",
+    "CEILING: structurally decidable. The pattern matcher can compare the pattern's package against the enumerated modules' packages and refuse with the mismatch named (which packages were in the universe, which the pattern's package half asked for), so the silent zero is a finite diff in the lane's refusal path.",
+    "NEXT-RUNG TRIGGER, naming the capability: a package pattern over a namespace prefix on main refuses with a typed operand refusal naming the mismatch (the pattern's package half and the enumerated packages), and an exact-package pattern and the recursive form keep deriving their universes as they do today.",
+  ],
+
+  evidence: [
+    DeclarationRef { module_path: "gunbc.witness_v2_native_route", decl_name: "native_route_universe_derived", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.compiler.compile", decl_name: "native_lane_source_facts", field: WholeDeclaration },
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/native_test_route_set_form_refuses_universe_underived_on_pristine_main.dag b/dag/gunbc/recurring_failure_mode/native_test_route_set_form_refuses_universe_underived_on_pristine_main.dag
deleted file mode 100644
index 5c66ab9c870..00000000000
--- a/dag/gunbc/recurring_failure_mode/native_test_route_set_form_refuses_universe_underived_on_pristine_main.dag
+++ /dev/null
@@ -1,28 +0,0 @@
-module gunbc.recurring_failure_mode.native_test_route_set_form_refuses_universe_underived_on_pristine_main
-
-import std.types { NonEmptyStr }
-import gunbc.recurring_failure_mode { RecurringFailureMode }
-import std.decl_ref { DeclarationRef, WholeDeclaration }
-
-data native_test_route_set_form_refuses_universe_underived_on_pristine_main: RecurringFailureMode = RecurringFailureMode {
-  identity: "native_test_route_set_form_refuses_universe_underived_on_pristine_main" as NonEmptyStr,
-
-  receipts: [
-    "**the set-form native test route derives an empty universe on pristine main -- `gunbc test '//pkg:all'` refuses with universe_underived (beside the narrow-pattern artifacts positive_population_empty and required_native_pass_regressed), enumerates zero identities, and per-identity native evidence cannot be produced by any session** (INVALID STATE: the instrument returns 'nothing to run', which reads as success-shaped silence to anything downstream that consumes only the exit status of the required floor; the required floor itself runs claim_executor, so CI stays green while the set-form route is dead).",
-    "RECEIPT (2026-10-04, clever-bat-68, main b71e076ed33084d9a1bdbadd75e9ab9ac5bea0ba, remote BuildBuddy job j35cc88f2): `gunbc test '//v2/test/claim/match_binder:all'` with GITHUB_SHA set, bare invocation, seed emit built clean -- exit 2; driver rows carry exactly one lane row (identities=0), [native-occurrence-census] universe=0 observed=0 unobserved=0, file_refusals=0. The same refusal holds on the newer main head bc7838f7b4.",
-    "RECEIPT (2026-10-04, clever-bat-68, remote job jeac904a5, one dispatch looping three main-history shas): the rebase base 1b4d5033bf refuses (one file refusal: src/v2/std/node.dag, body_lowering_reason_function_value_body_unread) and still derives an empty universe; a8caab2618 (#13098) refuses with no file refusals at all -- the node.dag refusal is already fixed there, yet the empty universe persists, so the node.dag refusal is NOT the cause; 8102a30f6b refuses with the ingested set collapsed to a pair of paths. The per-sha tallies are re-derivable with the recorded invocation at each sha.",
-    "RECEIPT (2026-10-04, clever-bat-68, remote job j9abe886d, four shas looped): the midpoint of the pre-base window (2900bfae77) refuses; e23436ab33 (#13022, advisories counted by identity) refuses; 56a5ab92aa (#13007, StaleBinary refusal) refuses; the 861c829ac6 (#12506) run was killed by the remote runner's 1h free-tier timeout after a clean build (inconclusive). Each result is re-derivable with the recorded invocation at the named sha (remote BuildBuddy dispatch, seed emit clean, bare set-form label). The break is therefore present at or before the midpoint of the 40 first-parent commits in a66665ed93..1b4d5033bf, and in both of the hottest route commits tested from the newer half.",
-    "PRE-EXISTING GOOD STATE (2026-10-02, eager-cat-664, head 17fccbf3f62, per the sibling row native_infer_accepts_only_bool_and_int_match_scrutinees's receipt; and 2026-10-03, clever-bat-68, remote jobs j52a3bf42..j95f7798c at a66665ed93): the same invocation derived a non-empty universe (identities=8, closure_modules=15) and enumerated per-identity verdicts in driver-rows.jsonl. The break entered main in the window a66665ed93..1b4d5033bf.",
-    "INVARIANCE TO THE FINDER'S OWN CHANGES (2026-10-04, remote jobs jc3e5e428, jf14cc929, j36fcf0ae, jf6c8a28a): the refusal is identical with and without the session's probe-module commit (control at d508aee681), and passing CI's explicit roots to gunbc test (`--source-root dag --source-root src/v2`, the argv the required lane gives claim_executor) exits instantly with status 2 and no driver rows -- wrong argv for the test verb, not a fix.",
-    "MECHANISM KNOWN SO FAR: the emitted driver's grammar is `adjudicate <facts> <pattern> <roots...>` (src/v2/compiler/00_compile.dag); the universe is the join of discovery's textual answer (the facts file's discovery.rows, folded over every source through the declared discovery authority), route membership (module namespace starts with v2.test.), and the pattern (extdeps.bazel.target_pattern). Discovery read the whole corpus under the partition telemetry of the rebase base and still produced zero surviving rows, so the break is upstream of pattern matching -- in facts production or the membership join, not in the pattern matcher. In the same window the lane runner itself was heavily reworked -- `git diff a66665ed93 1b4d5033bf -- src/v1/stage0/src/cli_run/native_lane_runner.rs src/v1/stage0/src/cli_run/required_floor_runner.rs` -- (#13005 route summary, #13007 StaleBinary, #13022 advisories by identity); the driver-side occurrence census and D0-ADJUDICATE machinery are part of that movement.",
-    "DISTINGUISHING FACTS. Not an OOM or a runner limitation: the lane refuses in seconds after a clean build, on the same machine that built the emitted closure. Not the narrow-pattern artifacts (positive_population_empty, required_native_pass_regressed): those accompany a DERIVED universe on a narrow pattern and were present in the pre-break runs too; universe_underived is the new refusal class. Not stale_binary (#13007): the cause name is universe_underived, and #13007's own head refuses identically. Not the node.dag body-unread refusal (#13010's subject): a8caab2618 has no file refusals at all and still derives universe=0.",
-    "RUNG FOUND AT: loud-but-blind -- the refusal is typed (exit 2, terminal row, [native-occurrence-census] universe=0 observed=0) yet success-shaped to exit-only consumers, and it masks every per-identity verdict on every branch; no floor lane observes the set-form route's death.",
-    "CEILING: structurally decidable. The discovery fold and the membership join are total over the corpus; an empty universe after 7436 corpus reads is a join or production bug with a finite diff to find, not a frontier.",
-    "NEXT-RUNG TRIGGER, naming the capability: a set-form `gunbc test '//v2/test/claim/match_binder:all'` on main again derives a non-empty universe (at least one identity enumerated from discovery rows joined with route membership), adjudicates the pattern's identities, and persists per-identity rows in target/v2-native-lane/driver-rows.jsonl -- the instrument state that a66665ed93 had and main lost.",
-  ],
-
-  evidence: [
-    DeclarationRef { module_path: "gunbc.witness_v2_native_route", decl_name: "native_route_universe_derived", field: WholeDeclaration },
-    DeclarationRef { module_path: "v2.compiler.compile", decl_name: "native_lane_source_facts", field: WholeDeclaration },
-  ],
-}
diff --git a/dag/gunbc/recurring_failure_mode/network_receipt_decoded_against_workload_population.dag b/dag/gunbc/recurring_failure_mode/network_receipt_decoded_against_workload_population.dag
new file mode 100644
index 00000000000..994409f4ab8
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/network_receipt_decoded_against_workload_population.dag
@@ -0,0 +1,14 @@
+module gunbc.recurring_failure_mode.network_receipt_decoded_against_workload_population
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data network_receipt_decoded_against_workload_population: RecurringFailureMode = RecurringFailureMode {
+  identity: "network_receipt_decoded_against_workload_population" as NonEmptyStr,
+  receipts: [
+    "2026-10-09, PR #13607: live network convergence at 83dcbb4d6ab published ten enrolled srv1 TAPs (1 through 9 and 13). Commissioning refused immediately after reading the receipt: resolve_network_subject supplied fabric_execution_slot_identities, whose srv1 member is only 13. The receipt parsed successfully for its publisher and failed for its consumer before sanitation. Network enrollment and workload admission had been conflated at decoding.",
+    "Repair: the root-authoritative receipt reader takes a host, derives candidates through the same runner_slot_identities_of deployment authority as the publisher, and checks the decoded receipt host. A caller can no longer substitute its workload roster. Fabric execution membership remains separately enforced by the slot controller. Initial publication reads back through this same host reader; it does not replace the existing generation.",
+    "Discriminator: workspace_network_receipt_population_witness_test feeds the captured live ten-slot receipt to the production host decoder and selects the workspace sanitation subject; the old fabric-only candidate list refuses those same bytes. Separate controls refuse another receipt host and an unenrolled slot. Rung: the arbitrary caller-population choice is removed from the store interface; external receipt bytes still require observed custody and decoding. Ceiling: structural separation of network enrollment from workload admission. Trigger: every future network receipt consumer uses the host reader instead of supplying workload membership.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/one_spelling_names_a_primitive_and_a_declaration_with_different_contracts.dag b/dag/gunbc/recurring_failure_mode/one_spelling_names_a_primitive_and_a_declaration_with_different_contracts.dag
index 171ecf4a74d..c6bded7c83e 100644
--- a/dag/gunbc/recurring_failure_mode/one_spelling_names_a_primitive_and_a_declaration_with_different_contracts.dag
+++ b/dag/gunbc/recurring_failure_mode/one_spelling_names_a_primitive_and_a_declaration_with_different_contracts.dag
@@ -12,6 +12,8 @@ data one_spelling_names_a_primitive_and_a_declaration_with_different_contracts:
     "SPECIMEN, gunbc#12951 (2026-10-03): main 776c52f (#13048) moved v2.std.orchestration and v2.std.qualified_name to import List from std.types instead of v2.std.collection, which dropped v2.std.collection out of the import closure of 8 dag/ files. Their positional map_get / map_insert / empty_map() calls kept binding the primitive. The unimported-bare-provider gate, which chose a provider by census spelling ahead of the builtin, then reported 13 of them as unimported reads of the declarations and advised `import v2.std.collection { map_get }`. The gate is repaired to read v1.compiler.infer_method bare_call_non_declaration_binding, the compiler's own predicate, so that advice is no longer reachable for these names. The fork itself is untouched by that repair.",
     "DISTINGUISHING FACTS: the spelling is in v1.compiler.infer_method's non-declaration set (builtin_signature, the empty-collection constructors or the kernel-method roster) AND some module declares a function of the same name with a different signature or return contract. A declaration that only re-exports the primitive's own contract is not this class.",
     "RUNG FOUND AT: silent -- found by attribution of a gate refusal, not by any check of the fork. RUNG NOW: still silent for the fork itself; the gate repair removes one harmful consequence only. CEILING: structurally impossible -- one name, one contract: either the declaration is renamed so it no longer shares the primitive's spelling, or the primitive becomes a declared member of the module that owns the name so there is exactly one contract. NEXT-RUNG TRIGGER, NAMING THE CAPABILITY: a check over the declaration census that refuses a declared function whose name is in the non-declaration set with a contract that differs from the primitive's. That check makes the class unwritable for new spellings, and lists the existing ones (map_get, map_insert, empty_map at least) as a bounded population to rename.",
+
+    "**REPAIR RECEIPT (vivid-lynx-377, 2026-10-06, frontier; the map_get half).** The authoritative meaning was determined first: the registered primitive (`dag/std/primitives.dag` `map_get_contract`: `fn(m: Map<K,V>, key: K) -> Optional<V>`, grounded by the interpreter, total -- a miss is `Absent`, not an error) owns the spelling `map_get`; the `v2.std.collection` declaration that re-used the spelling with the DIFFERENT contract (`Outcome<Optional<V>>`, whose `Rejected` arm no producer can construct) is the route that converges. The declaration is renamed to `map_get_checked` (src/v2/std/collection.dag) so the name no longer shares the primitive's spelling; every consumer found by identity census was renamed with it (imports, qualified calls and bare calls bound to the declared form across the v2 compiler, lens, std and workflow modules, the embedded probe sources in the resolved-call-emission, callable-candidate-ambiguity and self-host call-target witness tests, and the `dag/std/primitive_projection` roster row, which still records the projection of primitive `map_get` onto the renamed declaration at `DivergentProjection` fidelity); bare calls bound to the PRIMITIVE were deliberately left (the primitive keeps its name and its contract, so they were never wrong); the floor debt roster rows naming bare-primitive sites stay as the debt record. No consumer relied on the wrong behaviour: the declared-form callers all matched `Accepted`/`Rejected` explicitly and keep their semantics under the new spelling. The projection census now REFUSES the class -- `w_projection_census_declares_no_divergent_shared_spelling` folds the roster and fails while any declared function bears its primitive's own runtime name at divergent fidelity (red on the pre-fix tree, 2026-10-05 19:11Z), and `w_projection_census_keeps_the_outcome_lookup_projection_under_its_own_name` is the positive control that the projection FACT is kept under the new spelling. The compiler-side declaration-census check named by the NEXT-RUNG TRIGGER is compiler-owned (v1.compiler.infer_method's declaration set) and is REPORTED as the next rung, not built here; the v1 stage0 test that cites the specimen (declaration_index.rs, authored-membership gate) had its synthesized fixture and doc comments updated to the new spelling, mechanism untouched.",
   ],
 
   evidence: [],
diff --git a/dag/gunbc/recurring_failure_mode/optional_equality_answers_by_representation.dag b/dag/gunbc/recurring_failure_mode/optional_equality_answers_by_representation.dag
index dccb6715809..005b6c7cf35 100644
--- a/dag/gunbc/recurring_failure_mode/optional_equality_answers_by_representation.dag
+++ b/dag/gunbc/recurring_failure_mode/optional_equality_answers_by_representation.dag
@@ -16,6 +16,8 @@ data optional_equality_answers_by_representation: RecurringFailureMode = Recurri
 
     "EVIDENCE BY EXECUTION: test.claim.optional_equality_by_representation. RED a_present_first_equals_its_present_literal is `.first()` over a data list of variant rows, compared with a Present literal. It is enrolled in v2.workflow.floor_expected_red, so it executes on every floor and is held as known-red. POSITIVE CONTROL a_match_on_the_present_first_reads_its_value is the same read eliminated by a match, an ordinary claim. First observed as probes zz_a1 (FAIL) and zz_c1 (PASS) over test.claim.os_install_actuator_selection at gunbc#13536's base.",
 
+    "2026-10-09, PR #13607: the ETHTOOL_GCHANNELS reply decoder compared numbers.first() against Present containing the command string. The live ABI probe returned the correct nine u32s, and all numeric checks passed, but the valid-reply witness failed because this comparison answered false for 60 against Present 60. The decoder follows the existing match discipline; its positive count, wrong-command, malformed and foreign-interface controls remain enrolled. This repairs that consumer, not the seed's known representation divergence.",
+
     "RUNG FOUND AT: below the ladder on the interpretation path. CEILING: 4. NEXT-RUNG TRIGGER, NAMING THE CAPABILITY: one authority for `first` from which the interpreter and the emitted realization are both derived, so the interpreter's `first` yields the modeled optional on every route (method form and pipe form). When it lands, both enrolled reds (this one and interpreter_first_returns_the_modeled_optional) pass, their roster rows are deleted, and the claims remain as regression controls (DESIGN 4b(4)). Until then, the interim discipline at a `first` read is to match on the optional.",
   ],
 
diff --git a/dag/gunbc/recurring_failure_mode/optional_type_parameter_emitted_without_its_cardinality.dag b/dag/gunbc/recurring_failure_mode/optional_type_parameter_emitted_without_its_cardinality.dag
new file mode 100644
index 00000000000..ac210453afb
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/optional_type_parameter_emitted_without_its_cardinality.dag
@@ -0,0 +1,25 @@
+module gunbc.recurring_failure_mode.optional_type_parameter_emitted_without_its_cardinality
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data optional_type_parameter_emitted_without_its_cardinality: RecurringFailureMode = RecurringFailureMode {
+  identity: "optional_type_parameter_emitted_without_its_cardinality" as NonEmptyStr,
+
+  receipts: [
+    "**an optional type parameter is emitted without its cardinality** (INVALID STATE: a generic declaration writes `K?` on one of its own type parameters -- `type Plain<K, V> { get: K? }`, `type PartialFunction<K, V> { lookup: fn(K) -> V? }` -- and the Rust emitter spells the parameter by its bare name, dropping the Optional: `pub get: K`. The four arms of v1.compiler.emit_rust that spell a type parameter (the declared-generic leaf in render_rust_decl_type and in render_rust_alias_rhs_type, the TypeVariable arms of render_rust_type and render_rust_applied_type_arg) returned to_pascal(name) and never consulted return_cardinality, which every other leaf routes through rust_carrier_optional_wrap.",
+
+    "HARM: silent wrongness. An absent value has no representation in the emitted type, so a program that stores Absent in such a field either fails to compile at the construction site or, through a generic instantiation that happens to be optional, carries the wrong shape. Measured on main (2026-10-04): `get: K?` in a generic record emitted `pub get: K`. A `fn(K) -> V?` field kept its Option only by accident: the parameter resolved through a module-scope binding (v1.compiler.infer build_type_env param_bindings) instead of as a type parameter, so it reached a different, cardinality-aware arm. Scoping type parameters to their declaration (native broker 1C, rule 2) removed that accident and made the defect visible on std.algebra PartialFunction and FinitelySupportedFunction.",
+
+    "DISTINGUISHING FACTS: the same `?` on a non-parameter leaf (`get: Int?`) emits Option<i64>. Only a leaf the emitter recognises as one of the declaration's generic parameters drops it, and only on the arms that spell the parameter by name.",
+
+    "RUNG FOUND AT: outside the ladder (silent). CLIMBED TO: mechanically preventable. Every type-parameter spelling arm wraps through rust_carrier_optional_wrap, and gunbc.instruments.native_emission_controls carries an optional-parameter carrier that is constructed with Absent and with Present and read back natively: drop the wrap and its emission refuses at rustc (no Absent for a bare K), which is the label's red. CEILING: 3 (structurally guaranteed), once cardinality is part of the type-reference node the emitter is handed rather than a field each arm must remember to read.",
+
+    "NEXT-RUNG TRIGGER, as the capability: type references reach emission as one carrier that renders cardinality and spelling together, SUFFICIENT THAT no renderer arm can return a type spelling without its Optional wrap.",
+  ],
+
+  evidence: [
+    DeclarationRef { module_path: "v1.compiler.emit_rust", decl_name: "rust_carrier_optional_wrap", field: WholeDeclaration },
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/parse_memo_hit_serves_occurrences_minted_on_an_abandoned_path.dag b/dag/gunbc/recurring_failure_mode/parse_memo_hit_serves_occurrences_minted_on_an_abandoned_path.dag
new file mode 100644
index 00000000000..ad53525ac31
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/parse_memo_hit_serves_occurrences_minted_on_an_abandoned_path.dag
@@ -0,0 +1,22 @@
+module gunbc.recurring_failure_mode.parse_memo_hit_serves_occurrences_minted_on_an_abandoned_path
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, decl_ref }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data parse_memo_hit_serves_occurrences_minted_on_an_abandoned_path: RecurringFailureMode = RecurringFailureMode {
+  identity: "parse_memo_hit_serves_occurrences_minted_on_an_abandoned_path" as NonEmptyStr,
+
+  receipts: [
+    "INVALID STATE: a parsed tree in which two different nodes carry one minted occurrence id, or a node whose id resolves to another node's span. Backtracking (ordered choice, optional, repeat, not-predicate) restores the whole ParseProvenanceState, so occurrence ids are a counter along whichever path survives and a failed attempt's ids are minted again by the next attempt. The packrat table was NOT restored: it survived rejection, so a hit served a capture whose ids were minted on another, usually abandoned, path. parse_prov_merge only advanced the allocator to the larger mark, and v2.std.provenance span_index_adopt kept an existing entry without refusal (both deleted with the parse memo carrier, operator ruling R2 2026-10-08), so when the surviving path minted more ids before the memoized production than the miss path did, the served ids coincide with ids already given to other nodes.",
+    "HARM: wrong answers on the native CLI over the real roots. Some collisions survive normalization and reach the occurrence wall, which then refuses a valid file with normalize_reason_minted_occurrence_duplicated (src/v2/std/logic.dag is one); the census is total and refusing, so one such file stops every emission. Others are silent: the tree is accepted while authored tokens resolve to another node's span or to none -- in dag/test/fixture/cross_shard_seam/importee.dag the token SeamBeta resolves to a derived parser event instead of its own bytes. The census of dag + src/v2 measured both on 2026-10-08 (comparison recorded on gunbc#13557).",
+    "RUNG FOUND AT: silent -- outside the ladder. The enrolled replay witnesses covered only the harmless direction (the miss path minted more ids than the hit path), and the occurrence wall catches only collisions between structurally different nodes that survive normalization.",
+    "ATTAINABLE CEILING: structurally impossible -- with no memo nothing is served across paths. The next-rung trigger this row named -- the parse memo carrier deleted from v2.compiler.parse (ParseTableRealization entries, ParseMemoEntry, the frame/replay/adopt machinery, v2.std.provenance span_index_adopt and the seed interceptor try_parse_table_memo_dispatch), SUFFICIENT FOR no parse to serve a capture minted outside its own surviving path -- is MET: the carrier was deleted (operator ruling R2 2026-10-08), and the interim cost-floor pricing (v2.compiler.materialization_carriers parse_table_memo_cost_floor_exempt) was deleted with it. Every nonterminal is parsed by v2.compiler.parse parse_nonterminal with no table, so a served capture has no constructor.",
+    "CURRENT RUNG: structurally impossible, at the ceiling. Per DESIGN section 4b(4) the colliding-grammar control v2.test.provenance.parse_memo_frame_replay parse_memo_production_door_keeps_occurrences_distinct_on_a_colliding_grammar stays enrolled as the permanent regression control: a reintroduced memo that served across paths turns it red.",
+  ],
+
+  evidence: [
+    decl_ref(module_path: "v2.compiler.parse", decl_name: "parse_nonterminal"),
+    decl_ref(module_path: "v2.test.provenance.parse_memo_frame_replay", decl_name: "parse_memo_production_door_keeps_occurrences_distinct_on_a_colliding_grammar"),
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/probe_manifest_overwrites_emitted_dependency_demand.dag b/dag/gunbc/recurring_failure_mode/probe_manifest_overwrites_emitted_dependency_demand.dag
index 51510f92002..a1159ed2a17 100644
--- a/dag/gunbc/recurring_failure_mode/probe_manifest_overwrites_emitted_dependency_demand.dag
+++ b/dag/gunbc/recurring_failure_mode/probe_manifest_overwrites_emitted_dependency_demand.dag
@@ -9,10 +9,11 @@ data probe_manifest_overwrites_emitted_dependency_demand: RecurringFailureMode =
     "INVALID STATE: the emitter derives Cargo dependency demand from the emitted program, then the native probe writer replaces Cargo.toml with the stage0 foundation dependency roster. The two producers answer different questions while naming one artifact.",
     "RECEIPT: native-filesystem-fold at 5c3d566a768 emitted 185 files for the native CLI, including an async service driver. The assembled native crate refused with E0433 for tokio and E0752 for async main. The focused native controls built against the original emitted manifest and passed; their green did not establish the assembled route.",
     "REPAIR: emitted_closure_compile_host consumes the unique emitted Cargo.toml and preserves its dependency and feature tables. It changes only the per-entry package name and carries the original library name so generated main.rs can still address the emitted crate.",
-    "CONTROL: manifest_preserves_emitted_dependency_demand passes both synchronous and asynchronous manifests from emit_cargo_toml through the production adapter and compares their dependency and feature tables. The crate writer refuses an absent or ambiguous emitted manifest rather than supplying a replacement roster.",
+    "CONTROL (historical, deleted with the adapter it tested): manifest_preserves_emitted_dependency_demand passed both synchronous and asynchronous manifests from emit_cargo_toml through probe_manifest. Its successor is the_clap_dependency_follows_the_emitted_cli_demand_in_both_directions over v1.compiler.stage0_crates emitted_crate_dependencies, and the workspace writer refuses an emission naming zero or several Rust crates rather than supplying a roster.",
     "CEILING: the host still adapts package identity through TOML. This construction removes its second dependency authority; it does not prove that the emitter has modeled every dependency demand correctly. The native emit/build/fault/restore route remains the executed discriminator for that larger claim.",
     "RECEIPT (second route, same class): gunbc#12861 made the emitted v1_rt read the thread CPU clock through libc and added libc to the emitter, the stage0 crates and two hand-authored .dag transport manifests. A third hand copy, the curated seed-linked harness dependency block, was missed, and every module on the behavioral transport roster builds through it: fleet run 37079504327 returned 15 of 15 rows with no verdict on E0433 for libc. //gunbc/instruments:self-host does not build through that block and stayed green. The first repair had closed the Rust probe writer only; the .dag harness routes carried the same overwrite.",
     "REPAIR (second route): tools.emitted_crate_harness_manifest derive_harness_manifest_in_place reads the Cargo.toml the emission wrote and appends only what the harness owns -- its [lib] and [[bin]] target tables and, for a seed-linked build, the v1-compiler path dependency as its own subtable. The curated harness, the emission entry instrument, the product receipt stage and both std.logic transports consume it; their hand-authored dependency blocks are deleted, and no .dag harness route names a registry crate. An absent emitted manifest refuses rather than falling back to a roster.",
+    "THIRD REPAIR (structural): the emission no longer renders a Cargo.toml at all. v1.compiler.emit_rust returns its crate facts (gunbc.rust_emitted_crate EmittedRustCrate: crate name and dependency demand), and every emitted-Rust route -- the probe crate writer, gunbc compile --target rust, the native lane -- writes the partitioned workspace through cli_run::emitted_crate_workspace_host write_emitted_workspace, whose manifests v1.compiler.stage0_crates renders with the demand's registry dependencies. probe_manifest and emit_cargo_toml are deleted, so the Rust probe writer has no manifest to overwrite or adapt. The .dag harness routes still append their own tables to the root package's manifest.",
     "CONTROL (second route): test.claim.emitted_crate_harness_manifest_witness supplies an emitted manifest carrying a dependency no harness names and requires it in the derived manifest for every target and linkage, requires the seed dependency table exactly when the build is seed-linked, and requires a refusal when the emitted manifest was not read or is empty. The inhabitance claim for the real emitter is the behavioral transport roster itself: its rows build through the derived manifest.",
   ],
   evidence: [],
diff --git a/dag/gunbc/recurring_failure_mode/qualification_floor_guard_skippable_by_a_workflow_file_edit.dag b/dag/gunbc/recurring_failure_mode/qualification_floor_guard_skippable_by_a_workflow_file_edit.dag
new file mode 100644
index 00000000000..c5d3bf017db
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/qualification_floor_guard_skippable_by_a_workflow_file_edit.dag
@@ -0,0 +1,26 @@
+module gunbc.recurring_failure_mode.qualification_floor_guard_skippable_by_a_workflow_file_edit
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, decl_ref }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data qualification_floor_guard_skippable_by_a_workflow_file_edit: RecurringFailureMode = RecurringFailureMode {
+  identity: "qualification_floor_guard_skippable_by_a_workflow_file_edit" as NonEmptyStr,
+
+  receipts: [
+    "**the qualification floor's revision guard is skippable by an edit to the workflow file on the qualification branch** (declared with sha-checkout, decision eager-gull-22 2026-10-04).",
+
+    "INVALID STATE: a qualification run whose floor job executes code other than the pinned revision while the run reports the pinned head. The dispatch names the per-attempt branch refs/heads/qualification/<attempt>; GitHub runs that branch's copy of the workflow file, and the guard that checks out inputs.qualification_revision and refuses on a mismatch is a step INSIDE that file (gunbc.runner.runner_qualification_dispatch qualification_floor_revision_guard_step). An actor who rewrites the workflow file on that branch -- deleting the guard, or adding steps before it -- runs other code on the attempt's runner.",
+
+    "HARM: a qualification receipt measured on code that is not the pinned workload, on the dedicated host. Bounded by who can cause it: writing the branch's workflow file needs repository push (contents write), an actor already trusted to change any code in the repository, and the per-attempt branch is created by the route at the pinned revision immediately before dispatch.",
+
+    "DISTINGUISHING FACTS: the guard's absence is caught by the floor contract only for the MODEL the subject mint reads (qualification_floor_admission refuses a floor job whose first step is not the guard, or whose later steps run past a failure); it is not caught for the file GitHub actually executes from the branch. The post-run check RunRevisionNotPinned (gunbc.runner.runner_qualification_dispatch decide_qualification_run) refuses a run whose head_sha is not the pinned revision, but an edit committed on the branch moves head_sha too, so that check catches a moved branch and not a rewritten file at the same head.",
+
+    "RUNG: 2 for a moved branch (the guard and RunRevisionNotPinned each refuse, before any step and after the run). 1 for a rewritten workflow file at the branch head: contained by repository-push trust, not refused. CEILING: 3 needs the executed workflow file to be an identity the route admits rather than whatever the branch holds -- e.g. a reusable workflow selected by full SHA in the dedicated group (GitHub admits a SHA pin only for REUSABLE workflows), with the guard inside it. NEXT TRIGGER: the qualification mode lands in gunbc.fleet_converge_workflow (the dispatch leg's wiring_owed); deciding there whether the floor job is a SHA-selected reusable workflow is what would climb this row.",
+  ],
+
+  evidence: [
+    decl_ref(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "qualification_floor_revision_guard_step"),
+    decl_ref(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "qualification_floor_admission"),
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/readiness_polled_after_refused_mutation.dag b/dag/gunbc/recurring_failure_mode/readiness_polled_after_refused_mutation.dag
new file mode 100644
index 00000000000..4dbe99052d5
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/readiness_polled_after_refused_mutation.dag
@@ -0,0 +1,14 @@
+module gunbc.recurring_failure_mode.readiness_polled_after_refused_mutation
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data readiness_polled_after_refused_mutation: RecurringFailureMode = RecurringFailureMode {
+  identity: "readiness_polled_after_refused_mutation" as NonEmptyStr,
+  receipts: [
+    "INVALID STATE: a deployment polls for a candidate after its mutation already refused, withholding the original error until the startup bound expires. An old service answering health probes is not evidence that the failed installation needs more startup time.",
+    "OBSERVED 2026-10-09 during srv1 workspace bringup, PR #13607, candidate 19b12d88d6c0206c3f259cf85b0b664e65000b26: the operator-local deploy installed its generated ghrunner sudoers, then refused the exact tailscale grant probe under the operator account. It nevertheless performed 720 readiness waits against the previous release before returning the refusal. Independent grant-list readback admits the same exact path for ghrunner and refuses it for the operator; the retry uses the existing deployment-account entry without widening the operator grant roster.",
+    "REPAIR: live_deploy_apply_via_transport polls only after a converged mutation. A refused mutation supplies an unpermitted door standing and still reaches the cutover recovery gate: an earlier interrupted route transaction may require rollback, even when this mutation failed. Skipping the entire remainder would remove that recovery. CURRENT RUNG: mechanically prevented at this caller; the existing readiness and cutover refusal controls remain required.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/realization_respells_a_modeled_folds_sequencing_to_instrument_it.dag b/dag/gunbc/recurring_failure_mode/realization_respells_a_modeled_folds_sequencing_to_instrument_it.dag
index 4d3b24c6614..99a6694d113 100644
--- a/dag/gunbc/recurring_failure_mode/realization_respells_a_modeled_folds_sequencing_to_instrument_it.dag
+++ b/dag/gunbc/recurring_failure_mode/realization_respells_a_modeled_folds_sequencing_to_instrument_it.dag
@@ -18,7 +18,7 @@ data realization_respells_a_modeled_folds_sequencing_to_instrument_it: Recurring
 
     "WHAT IS ALREADY SINGLE-AUTHORED, so the row is not read as wider than it is. Only the ordering and the inter-phase diagnostic merge are re-spelled. The absorbing half of the step -- the qualified-name read and the source-root index insertion -- stays one declaration that the driver calls (`v2.compiler.compile` `native_test_context_absorb`), the per-phase bodies are each one modeled declaration, and the unmeasured composition remains live and is executed by the SAME BINARY in its census mode, so the two spellings ship together rather than one replacing the other.",
 
-    "SPECIMEN, gunbc PR 11219 (perf item C instrument), 2026-09-13, found by review 65068 rather than by a mechanism. `v2.compiler.program_assembly` `program_assembly_read_to_normalized_root_prepared` composes tokenize, parse and normalize in one declaration, each phase binding the previous phase's `Outcome`. (That composition and its unseeded phases were DELETED by gunbc#11985, which threaded one occurrence allocator across the ingest and left them with no caller; the class is unchanged and its live instance is now the same loop re-spelling `program_assembly_read_to_normalized_root_seeded`, which the evidence below names.) The emitted `std.compiler_entry.SourceRootEvalDriver` opens that sequence as a Rust `for` loop over the ingest -- `program_assembly_phase_tokenize`, then `program_assembly_phase_parse_measured_seeded`, then `program_assembly_measured_outcome`, then `program_assembly_phase_normalize`, then `native_test_context_absorb` -- so that each call can be bracketed by `Instant::now()`. The diff's own comment asserted the equivalence in prose; nothing executed it.",
+    "SPECIMEN, gunbc PR 11219 (perf item C instrument), 2026-09-13, found by review 65068 rather than by a mechanism. `v2.compiler.program_assembly` `program_assembly_read_to_normalized_root_prepared` composes tokenize, parse and normalize in one declaration, each phase binding the previous phase's `Outcome`. (That composition and its unseeded phases were DELETED by gunbc#11985, which threaded one occurrence allocator across the ingest and left them with no caller; the class is unchanged and its live instance is now the same loop re-spelling `program_assembly_read_to_normalized_root_seeded`, which the evidence below names.) The emitted `std.compiler_entry.SourceRootEvalDriver` opens that sequence as a Rust `for` loop over the ingest -- `program_assembly_phase_tokenize`, then `program_assembly_phase_parse_measured_seeded`, then `program_assembly_measured_outcome`, then `program_assembly_phase_normalize`, then `native_test_context_absorb` -- so that each call can be bracketed by `Instant::now()`. (When the parse memo was deleted, operator ruling R2 2026-10-08, the parse phase was renamed `program_assembly_phase_parse_seeded` and returns the parse `Outcome` directly, and `program_assembly_measured_outcome` was deleted; the re-spelled ordering is otherwise the same.) The diff's own comment asserted the equivalence in prose; nothing executed it.",
 
     "IT IS THE MODULE THAT OWNS THE ORDER THAT IS FORKED, AND AN EARLIER REVISION OF THIS ROW DID NOT REACH IT (review 65114). The row first argued only against `v2.compiler.program_assembly` `program_assembly_read_to_normalized_root_prepared`, the composition sitting beside the phases. The declared authority for the .dag front-end ORDER is `v2.compiler.staged_front_end`, whose own header names re-inlining its calls as the section-3 nickname class; a per-phase decomposition authored anywhere else is a second copy of THAT order, and saying so against the local composition understated the fork.",
 
diff --git a/dag/gunbc/recurring_failure_mode/receipt_consumer_without_producer.dag b/dag/gunbc/recurring_failure_mode/receipt_consumer_without_producer.dag
index 12437681cc7..d3e1d468a23 100644
--- a/dag/gunbc/recurring_failure_mode/receipt_consumer_without_producer.dag
+++ b/dag/gunbc/recurring_failure_mode/receipt_consumer_without_producer.dag
@@ -6,6 +6,9 @@ import gunbc.recurring_failure_mode { RecurringFailureMode }
 data receipt_consumer_without_producer: RecurringFailureMode = RecurringFailureMode {
   identity: "receipt_consumer_without_producer" as NonEmptyStr,
   receipts: [
+    "2026-10-09, PR #13607: srv1 commissioning refused the absent /var/lib/gunbc/microvm-network/converged-slot-network.txt. The earlier observer only wrote a job artifact; no production route published the root-owned receipt the controller consumes. Repair: the installer creates the root-owned receipt directory, and runner_microvm_network_initialize_local_wet binds the local administrator, host and clean source revision, observes all existing convergence predicates, and atomically creates the receipt. A retry observes the same stored generation anew and compares it without replacement; mismatched or unreadable state refuses. Publication admits only this live observer, never caller-supplied receipt text. External network truth remains a live acceptance obligation; no unit test alone establishes it.",
+    "2026-10-09 srv1 workspace image run 37878358778, PR #13607: the compiler pair built successfully, then release-bins packing refused BuildDiagnosticsMissing because the product requires gunbc-floor-cmd.log but fleet's pair build dispatch ran the raw cargo line without the floor's capture wrapper. The pack's refusal was correct. Reusing wrap_command_with_floor_attempt_receipt at that producer captures the required diagnostics and preserves compiler failure through tee; no empty log is synthesized and no pack member is dropped.",
+    "2026-10-09 srv1 workspace bringup, PR #13607: allocation offer admission and the controller require a gateway forwarding observation no older than 60 seconds, but workspace_refresh_gateway_wet had no production caller. The observer existed and its decoder was tested, while every real offer necessarily refused an absent or stale receipt. A bounded foreground operator refresher was initially added, then removed when the operator selected direct SSH from srv1. That route does not exercise gateway forwarding and must not require its receipt: workspace_ssh_access now carries distinct host-local and gateway routes, and each consumer requires only the evidence for its enrolled route. Gateway clients retain their forwarding-proof requirement. Host-local acceptance still requires the invocation-bound guest host key and authenticated guest SSH; a fresh host observation alone is not a login receipt.",
     "PR #12421 review 5331195485: gunbc_ci_namecheap_observe_invoke supplied receipt_rel as though it captured execution output, but gunbc_invoke_receipt_steps only read an existing file. A successful observer therefore failed the shell step and suppressed its artifact upload. Invalid state: an emitted receipt read with no producer. Harm: successful observation becomes workflow failure. Discriminating facts: execute emitted shell in a clean root with only the declared output; a planted unmatched read must fail. Mitigation: writer, console display and uploader derive the path from one declaration. Ceiling: workflow construction rejects a receipt consumer without a producer edge; next trigger: that consumed workflow admission relation.",
   ],
   evidence: [],
diff --git a/dag/gunbc/recurring_failure_mode/refusal_reabsorbed_by_intermediate_default.dag b/dag/gunbc/recurring_failure_mode/refusal_reabsorbed_by_intermediate_default.dag
index 64f11c9f6f5..88bc35c134f 100644
--- a/dag/gunbc/recurring_failure_mode/refusal_reabsorbed_by_intermediate_default.dag
+++ b/dag/gunbc/recurring_failure_mode/refusal_reabsorbed_by_intermediate_default.dag
@@ -1,6 +1,7 @@
 module gunbc.recurring_failure_mode.refusal_reabsorbed_by_intermediate_default
 
 import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, decl_ref }
 import gunbc.recurring_failure_mode { RecurringFailureMode }
 
 data refusal_reabsorbed_by_intermediate_default: RecurringFailureMode = RecurringFailureMode {
@@ -30,7 +31,10 @@ data refusal_reabsorbed_by_intermediate_default: RecurringFailureMode = Recurrin
     "SPECIMEN, STILL PRESENT ON MAIN, AND FILED UNDER ITS REAL ROW RATHER THAN THIS ONE: `gunbc.roadmap_dashboard_instance_apply` `dashboard_run_target_argvs` folds its command list with `init:` set to `dashboard_exec_ok` over an empty stdout, so an EMPTY command list returns a success meaning `every command succeeded` when none ran. That is the fold-`init` minting site above, but its mechanism is NOT reabsorption: no producer refused and no consumer undid a refusal. The identity element answers over an empty domain, which is `predicate_vacuously_true_on_an_empty_domain` exactly, and it belongs to that row. It is cited here only as the third spelling of the recognition rule. It is deliberately not repaired, because CONVERGENCE-ONE C7 is scheduled to delete that whole module, and DESIGN section 2 prices work on a module scheduled for deletion as redundant. Its removal is that deletion and nothing else.",
 
     "THE REPAIR THAT WORKED, WHICH IS STRONGER THAN THE REPAIR RULE ABOVE: CONSTRUCTION, NOT A CHECK. Both repairs (EnsureInaccessible on gunbc#11424, and unobserved probes as Absent on gunbc#11445) removed the path by which the unobserved state could be spelled as a success. Neither added a check to spot a fabricated success downstream. A check that spots `a success whose stdout is empty` is validation standing where construction was available: it would be fooled by the next fabricated value with a different payload, and it re-states a distinction the carrier should own. So where the carrier can make `not observed` a separate arm or an absent field, the per-site ceiling is structural impossibility. This does NOT raise the CLASS's ceiling or change the corpus-wide trigger above, and no corpus-wide wall exists today. Each site is climbed by hand, and every site found in this program was found by a reviewer reading a body, never by CI, the floor or a lens.",
+
   ],
 
-  evidence: [],
+  evidence: [
+    decl_ref(module_path: "v2.extdeps.languages.bash_orch_if", decl_name: "bash_orch_if_leaf_text"),
+  ],
 }
diff --git a/dag/gunbc/recurring_failure_mode/required_floor_runs_at_its_memory_ceiling.dag b/dag/gunbc/recurring_failure_mode/required_floor_runs_at_its_memory_ceiling.dag
index f22fe213d7f..1420dc081bc 100644
--- a/dag/gunbc/recurring_failure_mode/required_floor_runs_at_its_memory_ceiling.dag
+++ b/dag/gunbc/recurring_failure_mode/required_floor_runs_at_its_memory_ceiling.dag
@@ -17,9 +17,11 @@ data required_floor_runs_at_its_memory_ceiling: RecurringFailureMode = Recurring
     "CONSEQUENCE FOR ANY STEP ADDED TO THE SAME JOB: another memory-heavy pass fits only as a SEPARATE process after the floor process exits (sequential peaks), never inside the floor's invocation (additive). That is a note, not a wall: claim_executor --required-ci with no --required-lane selects every phase in one process (required_ci_phase_selected with no lane answers true), so the additive form remains writable. With the floor at its ceiling, an invocation selecting all phases in the floor job is an OOM of a working required lane, and that is a consequence of the missing margin, not a defect in the CLI: running every phase in one process is an ordinary invocation, dangerous only because the floor has no headroom. Walling off the CLI would leave the no-margin condition ready to kill the next thing that grows; restoring headroom makes the additive form merely slow. The boundary this row names is the margin.",
 
     "RUNG FOUND AT: silent -- no gate or diagnostic refuses a floor at its slot ceiling; the throttling is visible only in [floor-cgroup] beats nobody adjudicates. ATTAINABLE CEILING: mechanically preventable -- a required step can refuse a floor whose measured slot peak comes within a declared margin of memory.high, from the beats the run already writes. NEXT-RUNG TRIGGER, stated as the capability: the required run adjudicates the floor's measured slot peak against a declared headroom budget and refuses a landing that consumes it. UNRANKED: this row records the finding; no lane is dispatched for it.",
+
+    "DISPOSITION OF THE LANE THIS ROW WAS FOUND ON (2026-10-09, operator ruling, the v1 withdrawal): the floor lane was DELETED rather than given headroom (gunbc.rung_drop v1_required_lanes_withdrawn). The gate's floor run step this row cited as evidence no longer exists, so the evidence names the run command that step wrapped. THE CLASS OUTLIVES THE LANE: it is stated over a required lane and its slot, not over the floor. The surviving `emit-build` lane runs in the same slot class and no step adjudicates its measured peak either, so the next-rung trigger above stands unchanged with that lane as its subject.",
   ],
 
   evidence: [
-    DeclarationRef { module_path: "gunbc.compiler_gate_workflow", decl_name: "compiler_gate_floor_run_step", field: WholeDeclaration },
+    DeclarationRef { module_path: "gunbc.witness_floor_workflow", decl_name: "witness_floor_run_script", field: WholeDeclaration },
   ],
 }
diff --git a/dag/gunbc/recurring_failure_mode/required_floor_strict_prep_sits_on_memory_high.dag b/dag/gunbc/recurring_failure_mode/required_floor_strict_prep_sits_on_memory_high.dag
new file mode 100644
index 00000000000..9660fd6d67d
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/required_floor_strict_prep_sits_on_memory_high.dag
@@ -0,0 +1,28 @@
+module gunbc.recurring_failure_mode.required_floor_strict_prep_sits_on_memory_high
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data required_floor_strict_prep_sits_on_memory_high: RecurringFailureMode = RecurringFailureMode {
+  identity: "required_floor_strict_prep_sits_on_memory_high" as NonEmptyStr,
+
+  receipts: [
+    "INVALID STATE: the required floor's Strict-prep of the gate closure already sits on the CI cgroup memory.high watermark (memory_governor DECLARED_RUNNER_SLOT_MEMORY_HIGH_BYTES) at prepared-subject-warm, on ordinary merge_group runs that do not plan the MegaRAC forged-probe census. HARM: a changed-witness seed that adds even a small extra Strict module (or extra high-event pressure while already throttled) tips the lane into a wall-time cancel. The class is the floor's resident set at the edge, not a unique typed graph of this witness.",
+
+    "RECOGNITION RULE. Read the same two seams on a green merge_group floor and on a control that only plans an extra witness: prepare-closure-resolve and prepared-subject-warm. If both already sit on memory.high (re-derive from gunbc.cli_run.required_floor_runner floor-cgroup events_local at those seams) an extra planned module is a tipping input, not a gigabyte-scale typed graph of its own. Raising memory.high, sharding, or excluding the witness is the absorbing fallback.",
+
+    "DISTINGUISHING FACT: fixture_compile_retained_on_the_process_shared_index is a different class (census-probe both-closure rows on the process-shared MultiEntryIndex). This class is Strict-prep of the prepared subject before any census probe runs. The forged-probe witness's authored imports are four production modules; unit control forged_probe_witness_module_both_closure_excludes_string_literal_imports refuses MegaRAC paths named only inside forged_probe_source.",
+
+    "MEASURED MARGIN (same phases). Re-derive from gunbc.cli_run.required_floor_runner at prepare-closure-resolve and prepared-subject-warm. Named pair: merge_group run 37744410173 (does not plan the seven forged-probe census claims) and control #13576 run 37743678634 (plans them). Both logs sit on the CI cgroup memory.high watermark at prepared-subject-warm. The extra planned seed adds high-event pressure while throttled, not a gigabyte-scale unique typed graph. A contradicting re-derivation is a with/without pair whose prepare-closure-resolve peak differs by gigabytes.",
+
+    "STRUCTURAL PREDICTION (DESIGN section 6b): deleting the changed_module_seeds Strict-prep of this witness, or not retaining its typed module on prepared.graph into discovery, cannot recover tens of GiB because those tens are already the gate closure. Prepare-only on main 15951783a2 (assemble_prepared_subject_from_corpus then prepare_repository_from_corpus over witness_layer_roots): gate seeds keep 2981 modules, peak VmHWM 19.45 GiB; the same seeds plus test.claim.megarac_managed_host_forged_probe_witness keep 2982, peak 18.71 GiB. Added identity is that witness alone (40 visible names); zero v1.compiler / v2.compiler modules. A contradicting instrument is a with/without floor pair whose prepare-closure-resolve peak differs by gigabytes.",
+
+    "LOOKUP REALIZATION (DESIGN section 6b). Demand is each bare-name resolution during typecheck. The shared-state LCA is that module's TypeEnv. Materializing ancestry_str_bindings on every typed module on prepared.graph is this class's pin, and that flatten (B1) is what ships: an empty-ancestry parent walk was tried and reverted because commit_workflow closure reconcile went ~20x (main 15951783a2 wall 62s vs walk head 1251s) while RSS stayed in the same band. The class stays UNFIXED until the next-rung trigger below holds. Do not read a walk overlay as the current retain shape.",
+
+    "RUNG FOUND AT: silent wrongness on a planned-witness floor (90-minute cancel). RUNG NOW: mitigatable at best, UNFIXED. Recording this class and isolating the sibling fixture-index leak does not discharge this class. The prepared subject's resident set at prepared-subject-warm still sits on memory.high on ordinary merge_group floors. CEILING: structurally guaranteed once the prepared graph cannot retain a flattened ancestry overlay (or any other typecheck-only carrier) whose working set reaches memory.high. NEXT-RUNG TRIGGER: the required floor can finish Strict-prep — including when it plans the MegaRAC forged-probe census claims — with prepared-subject-warm runner-local high at 0 and current well below memory.high.",
+
+    "CONSUMPTION: this per-class record joins the derived gunbc.recurring_failure_mode.roster recurring_failure_mode_roster. Observed by gunbc.cli_run.required_floor_runner prepare-closure-resolve / prepared-subject-warm. GREEN/RED for the sibling fixture-index class stay enrolled separately.",
+  ],
+
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/required_verdict_placed_only_on_the_merge_queue.dag b/dag/gunbc/recurring_failure_mode/required_verdict_placed_only_on_the_merge_queue.dag
index a4ce6ff05fe..628e2141bf4 100644
--- a/dag/gunbc/recurring_failure_mode/required_verdict_placed_only_on_the_merge_queue.dag
+++ b/dag/gunbc/recurring_failure_mode/required_verdict_placed_only_on_the_merge_queue.dag
@@ -20,7 +20,6 @@ data required_verdict_placed_only_on_the_merge_queue: RecurringFailureMode = Rec
   ],
 
   evidence: [
-    DeclarationRef { module_path: "gunbc.compiler_gate_workflow", decl_name: "compiler_gate_stage0_regen_condition", field: WholeDeclaration },
-    DeclarationRef { module_path: "gunbc.compiler_gate_workflow", decl_name: "compiler_gate_stage0_regen_step", field: WholeDeclaration },
+    DeclarationRef { module_path: "gunbc.witness_floor_workflow", decl_name: "build_lane_run_script", field: WholeDeclaration },
   ],
 }
diff --git a/dag/gunbc/recurring_failure_mode/rest_response_nested_from_key_ignored.dag b/dag/gunbc/recurring_failure_mode/rest_response_nested_from_key_ignored.dag
index 465a2f2eb53..8f8773fe30e 100644
--- a/dag/gunbc/recurring_failure_mode/rest_response_nested_from_key_ignored.dag
+++ b/dag/gunbc/recurring_failure_mode/rest_response_nested_from_key_ignored.dag
@@ -25,7 +25,7 @@ data rest_response_nested_from_key_ignored: RecurringFailureMode = RecurringFail
     DeclarationRef { module_path: "extdeps.cloud.gcp.gcp", decl_name: "WifProviderWire", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.auth.heal_publisher_provision", decl_name: "provider_reasons", field: WholeDeclaration },
     DeclarationRef { module_path: "test.claim.heal_publisher_provision_witness", decl_name: "the_live_provider_list_decodes_its_camel_case_fields", field: WholeDeclaration },
-    DeclarationRef { module_path: "test.claim.heal_publisher_provision_witness", decl_name: "the_live_mtcollins1_federation_read_back_from_the_wire_is_fully_present", field: WholeDeclaration },
+    DeclarationRef { module_path: "test.claim.heal_publisher_provision_witness", decl_name: "the_live_mtcollins1_provider_matches_the_declared_main_pin", field: WholeDeclaration },
     DeclarationRef { module_path: "test.claim.heal_publisher_provision_witness", decl_name: "an_authored_only_issuer_spelling_refuses_rather_than_populating_the_field", field: WholeDeclaration },
     DeclarationRef { module_path: "test.claim.heal_publisher_provision_witness", decl_name: "both_issuer_spellings_refuse_as_ambiguous", field: WholeDeclaration },
   ],
diff --git a/dag/gunbc/recurring_failure_mode/service_import_emitted_beside_its_authored_binding.dag b/dag/gunbc/recurring_failure_mode/service_import_emitted_beside_its_authored_binding.dag
index d9d5618404d..95d334be049 100644
--- a/dag/gunbc/recurring_failure_mode/service_import_emitted_beside_its_authored_binding.dag
+++ b/dag/gunbc/recurring_failure_mode/service_import_emitted_beside_its_authored_binding.dag
@@ -8,7 +8,7 @@ data service_import_emitted_beside_its_authored_binding: RecurringFailureMode =
   identity: "service_import_emitted_beside_its_authored_binding" as NonEmptyStr,
 
   receipts: [
-    "**a service import is emitted beside the authored import that already binds it** (INVALID STATE: an emitted Rust module carries two `use` lines for one item -- `pub use crate::m::{S};` rendered from the authored `import m { S }`, and `pub use crate::m::S;` rendered as the per-module service import for a service its functions demand -- and rustc refuses the module with E0252, the name is defined multiple times.",
+    "**a service import is emitted beside the authored import that already binds it** (INVALID STATE: an emitted Rust module carries two `use` lines for one item -- `pub use crate::m::\{S\};` rendered from the authored `import m { S }`, and `pub use crate::m::S;` rendered as the per-module service import for a service its functions demand -- and rustc refuses the module with E0252, the name is defined multiple times.",
 
     "MECHANISM: `v1.compiler.emit_rust` assembled use lines from two producers that were never compared. The authored, carrier and reference-derived lines pass through `dedupe_rust_import_lines`; the per-module service imports were appended beside them afterwards. The dedupe already knew a braced line covers a singleton for the same item (`rust_pub_use_singleton_covered`); the service imports simply never reached it.",
 
diff --git a/dag/gunbc/recurring_failure_mode/shared_precondition_re_derived_once_per_claim_frame.dag b/dag/gunbc/recurring_failure_mode/shared_precondition_re_derived_once_per_claim_frame.dag
index 06b52295c9f..0ae48f64bf0 100644
--- a/dag/gunbc/recurring_failure_mode/shared_precondition_re_derived_once_per_claim_frame.dag
+++ b/dag/gunbc/recurring_failure_mode/shared_precondition_re_derived_once_per_claim_frame.dag
@@ -20,7 +20,7 @@ data shared_precondition_re_derived_once_per_claim_frame: RecurringFailureMode =
 
     "SPECIMEN, gunbc#10882 and gunbc#10992. #10882 landed src/v2/test/native_decl_selection_test.dag into the required floor at 2026-09-10T20:53Z; its four witnesses each called collision_prepared, so the seed tokenized and parsed ~230 characters of synthetic source once per claim. required-witnesses-floor refused on main for nearly an hour with the summary claims_failed=0 interrupted_before_verdict=4 interrupted_cpu_deadline=4 -- NOTHING FAILING and the lane red, because an unreached verdict is fail-closed. Marginal CPU measured by claim_batch: 1113, 1330, 1375 and 1362ms against the 500ms line. #10992 repaired it by sharing the fixture at the resolved seam so the ingest is paid once, and the four rows fit.",
 
-    "SECOND SPECIMEN, gunbc#11032, arriving by the same recognition rule a day later and diagnosed by a lane that had not read this row. A newly landed family -- the where-refinement parse witnesses from gunbc#10946 -- refused the 500ms line on main with interrupted_before_verdict and nothing failing. Partitioned, the shared precondition dominated: v2.compiler.parse parse_grammar_digest and the production index were re-derived on EVERY PARSE CALL although prepare_grammar had fixed both before the first token, and the shared fixture sources were re-parsed per claim. The producer that named it is the floor's cross-claim demand census (main run 34556223550, required_floor_cross_claim_demand.tsv, row parse_grammar_digest). The repair was the one this row prescribes: carry both facts on the prepared grammar, the seam where the grammar is already resolved, and share the fixture trees across claims (v2.workflow.floor_pure_producer_share, whose admission is now derived by derive_cross_claim_share). Its frame is narrower than a claim -- per parse call -- which widens this row's reach rather than founding a neighbour: the question that finds it is still the one above. It also shows the census already locating the class and nothing refusing on it, which is this row's next-rung trigger unmet.",
+    "SECOND SPECIMEN, gunbc#11032, arriving by the same recognition rule a day later and diagnosed by a lane that had not read this row. A newly landed family -- the where-refinement parse witnesses from gunbc#10946 -- refused the 500ms line on main with interrupted_before_verdict and nothing failing. Partitioned, the shared precondition dominated: v2.compiler.parse parse_grammar_digest (later deleted with the parse memo key it fed, operator ruling R2 2026-10-08) and the production index were re-derived on EVERY PARSE CALL although prepare_grammar had fixed both before the first token, and the shared fixture sources were re-parsed per claim. The producer that named it is the floor's cross-claim demand census (main run 34556223550, required_floor_cross_claim_demand.tsv, row parse_grammar_digest). The repair was the one this row prescribes: carry both facts on the prepared grammar, the seam where the grammar is already resolved, and share the fixture trees across claims (v2.workflow.floor_pure_producer_share, whose admission is now derived by derive_cross_claim_share). Its frame is narrower than a claim -- per parse call -- which widens this row's reach rather than founding a neighbour: the question that finds it is still the one above. It also shows the census already locating the class and nothing refusing on it, which is this row's next-rung trigger unmet.",
 
     "THIRD SPECIMEN, gunbc#11291, and it is recorded because of WHERE it occurred rather than because the shape is new: inside the repair for the defect this row's own consumers are blocked on. The reflection guard that makes a bare type spelling refuse rather than resolve to one of several same-spelled declarations had to establish bare-name multiplicity, and v2.std.decl_index decl_facts_at is keyed by QUALIFIED name, which a bare spelling has none of -- so the only substrate answer was to fold the whole declaration corpus, once per call. The lane that was meant to make the floor's cross-claim memo keyable therefore reproduced the recurrence it was meant to unlock, which is the hazard worth naming: a repair for this class is exactly where an author is least likely to look for it.",
 
@@ -41,7 +41,7 @@ data shared_precondition_re_derived_once_per_claim_frame: RecurringFailureMode =
   ],
 
   evidence: [
-    DeclarationRef { module_path: "v2.compiler.parse", decl_name: "parse_grammar_digest", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.compiler.parse", decl_name: "prepare_grammar", field: WholeDeclaration },
     DeclarationRef { module_path: "v2.std.decl_index", decl_name: "type_declarer_qualified_names", field: WholeDeclaration },
   ],
 }
diff --git a/dag/gunbc/recurring_failure_mode/single_arm_sum_parses_as_an_alias_and_becomes_unreadable.dag b/dag/gunbc/recurring_failure_mode/single_arm_sum_parses_as_an_alias_and_becomes_unreadable.dag
index 652bcb242c6..4d74abdafbf 100644
--- a/dag/gunbc/recurring_failure_mode/single_arm_sum_parses_as_an_alias_and_becomes_unreadable.dag
+++ b/dag/gunbc/recurring_failure_mode/single_arm_sum_parses_as_an_alias_and_becomes_unreadable.dag
@@ -16,6 +16,8 @@ data single_arm_sum_parses_as_an_alias_and_becomes_unreadable: RecurringFailureM
 
     "WHY READING THE SOURCE DID NOT PREDICT IT, which is the part worth carrying: v1.compiler.infer local_binding_for_item's alias arm carries `inferred: item.inferred`, and v1.compiler.infer_env lookup_type_by_name returns `binding.resolved`. BOTH STATEMENTS ARE TRUE. Neither predicts this call site, because the single-arm parse has already made the declaration an alias before either applies. TRUE-BUT-NOT-PREDICTIVE is the failure, not a misreading, and it cost three build cycles before an instrument built into the refusal settled it in one. A related note already existed saying a single-arm coproduct is a type alias; it was filed against breakage at the IMPORT site, was read as being about that consumer, and the single-arm form was written anyway -- a note correct about the mechanism but filed under one consumer reads as covered and is worse than no note.",
 
+    "RECEIPT, 2026-10-06, session clever-bat-68, minimal fixture from the variant-scrutinee infer work (#13210). A one-module fixture program assembled through v2.compiler.program_assembly assemble_program_from_ingest declares `type A = MkA` (single arm, no payload) and a param-identity fn over it; resolve refuses with resolve_reason_unbound_symbol -- the arm parses as an alias to an unbound name, so even the declaration's own namespace does not bind it, and the unbound name is the arm's own tag. Writing the same declaration with a payload arm (`type Seal = Boxed(N) | Held { value: N }`) resolves. The smallest reproducer this row has is the one-module program `module p` declaring `type A = MkA` and `fn f() -> A { MkA }` (quoted here in full: the probe's former data row for it was removed as unexecuted -- no enrolled claim runs it and a receipt quotes its text instead) -- a one-module program, no imports, one type, one fn, so nothing but the arm-count decision is in play. It also confirms the harm reaches NEW consumers: the fixture was written to exercise infer, and resolve refuses before infer ever runs.",
+
     "RUNG FOUND AT: below the ladder -- silent wrongness at the declaration, with the author's intent and the parsed shape diverging and nothing reporting it. ATTAINABLE CEILING: structurally guaranteed. The parser knows the arm count and the `=` form at the moment it chooses between alias and coproduct, so it can refuse a one-arm sum outright, or admit it as a one-arm coproduct, rather than silently reclassifying it. NEXT-RUNG TRIGGER: v1.compiler.parse distinguishes an intended one-arm sum from an alias -- SUFFICIENT FOR no declaration to change kind as a function of its arm count without a located diagnostic, so a consumer reading a roster either reads it or is told why it cannot. STRUCTURALLY IMPOSSIBLE would additionally require the surface to make the two forms unconfusable, which is a language-design question this row does not decide.",
   ],
 
diff --git a/dag/gunbc/recurring_failure_mode/slice_census_confuses_structural_ancestors_with_foreign_cells.dag b/dag/gunbc/recurring_failure_mode/slice_census_confuses_structural_ancestors_with_foreign_cells.dag
new file mode 100644
index 00000000000..943d4bb17b0
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/slice_census_confuses_structural_ancestors_with_foreign_cells.dag
@@ -0,0 +1,13 @@
+module gunbc.recurring_failure_mode.slice_census_confuses_structural_ancestors_with_foreign_cells
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data slice_census_confuses_structural_ancestors_with_foreign_cells: RecurringFailureMode = RecurringFailureMode {
+  identity: "slice_census_confuses_structural_ancestors_with_foreign_cells" as NonEmptyStr,
+  receipts: [
+    "2026-10-09, PR #13607: srv1's systemctl list-units fabric-cell-*.slice enumerates both fabric-cell-srv1-13.slice and its implicit fabric-cell-srv1.slice ancestor. The cell observer assumed every namespace entry was either a slot or foreign residue, so provisioning a legitimate slot made its next observation refuse. Enumeration was correct; the earliest unjustified boundary was discovery's incomplete subject vocabulary.",
+    "Repair: retain a structural-ancestor subject derived from this host's enrolled fabric cells through extdeps.systemd.systemd_slice_ancestor_names. It grants no cell identity, resource ownership or effect. Only the slice namespace admits it; unknown siblings, other hosts' ancestors and matching filesystem names still refuse. The expected-address observer remains independent, so seeing only the ancestor never satisfies the cell boundary. The live census fixture reaches production admission, with discriminating refusal and conservation controls.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/two_source_files_claiming_one_module_path_misdiagnosed.dag b/dag/gunbc/recurring_failure_mode/two_source_files_claiming_one_module_path_misdiagnosed.dag
new file mode 100644
index 00000000000..ed72d939700
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/two_source_files_claiming_one_module_path_misdiagnosed.dag
@@ -0,0 +1,35 @@
+module gunbc.recurring_failure_mode.two_source_files_claiming_one_module_path_misdiagnosed
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data two_source_files_claiming_one_module_path_misdiagnosed: RecurringFailureMode = RecurringFailureMode {
+  identity: "two_source_files_claiming_one_module_path_misdiagnosed" as NonEmptyStr,
+
+  receipts: [
+    "**two source files claiming one module path are not refused as that collision, and the native door reports a later unbound name instead** (INVALID STATE: either two files declare the same module path, or one walked root's layout maps two files onto one tree identity, and ingest continues. HARM: the operator sequences on `resolve_unbound_name_is_declared_elsewhere` at a real token in an innocent module -- DESIGN section 5 silent wrongness wearing a located diagnostic.",
+
+    "TRIGGER INCIDENT, lively-bear-908: dag/std/algebra.dag (`module std.algebra`) and src/v2/std/algebra.dag (`module v2.std.algebra`) were loaded under ONE copied source root. Those are DISTINCT declared module paths. What collided was PATH-DERIVED SOURCE-ROOT IDENTITY: v2.compiler.source_authority classified a file as V2Tree from the file's storage spelling. A copied tree `/tmp/copy/src/v2/std/algebra.dag` did not start with `src/`, so both files became DagTree. Widening that classifier to 'contains /src/' moved the same silent misclassification onto a dag path such as `dag/pkg/src/leaf.dag`. Resolve then named a token in std.change as declared elsewhere rather than naming the layout.",
+
+    "THE SAME DECLARED PATH IS A SECOND ARM OF THE SAME CLASS. The census already refused a second file declaring one QualifiedName (`closure_census_duplicate_module`), but located only that second file's module node. The first file was unnamed. v1's wall at v1_compiler.cli_run module_path_collision_panic_message names BOTH paths. A refusal that names one of two files is still a misdiagnosis of the collision.",
+
+    "DISTINGUISHING FACT: this is not `two_modules_answer_to_one_logical_qualified_name` (a logical-name strip after ingest). It is ingest identity: declared module path, or a tree tag guessed from the file's path, answering for two files as one.",
+
+    "RECOGNITION RULE: a native emit or census over a small tree reports `resolve_unbound_name_is_declared_elsewhere` (or any resolve unbound) while two walked files share a declared module path OR a copied layout is tagged by file spelling rather than by the discovering --source-root. The reviewer tell: the diagnostic's file is not one of the two that share the identity.",
+
+    "RUNG FOUND AT: OUTSIDE THE LADDER -- silent wrongness. The later diagnostic is typed and located, and it is the wrong subject.",
+
+    "CEILING: 3, structurally guaranteed. Ingest can refuse a second file that declares an already-ingested module path, with loci on both files, and can stamp SourceRootRef from the walk origin that discovered the file, refusing when that origin is not a dag or src/v2 tree. It cannot make two files unwritable.",
+
+    "NEXT-RUNG TRIGGER: the native CLI, over a two-file tree whose declared module paths collide, refuses `closure_census_duplicate_module` naming both files; a copied single-root argument refuses as unrecognized rather than guessing DagTree; a file under --source-root dag whose path contains /src/ is still DagTree. Sufficient that a copied closure cannot present as an unbound name in a third module. Not satisfied by classifying the file path.",
+
+    "CONSUMPTION: this per-class record joins the derived gunbc.recurring_failure_mode.roster recurring_failure_mode_roster.",
+  ],
+
+  evidence: [
+    DeclarationRef { module_path: "v2.compiler.source_authority", decl_name: "admit_source_root_argument", field: WholeDeclaration },
+    DeclarationRef { module_path: "gunbc.source_root_read", decl_name: "source_root_read", field: WholeDeclaration },
+    DeclarationRef { module_path: "v2.compiler.self_host.closure_emission", decl_name: "closure_census_duplicate_module_outcome", field: WholeDeclaration },
+  ],
+}
diff --git a/dag/gunbc/recurring_failure_mode/unsupported_operation_stops_at_diagnostics_instead_of_demanding_its_provider.dag b/dag/gunbc/recurring_failure_mode/unsupported_operation_stops_at_diagnostics_instead_of_demanding_its_provider.dag
new file mode 100644
index 00000000000..49ec3d62fd8
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/unsupported_operation_stops_at_diagnostics_instead_of_demanding_its_provider.dag
@@ -0,0 +1,15 @@
+module gunbc.recurring_failure_mode.unsupported_operation_stops_at_diagnostics_instead_of_demanding_its_provider
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data unsupported_operation_stops_at_diagnostics_instead_of_demanding_its_provider: RecurringFailureMode = RecurringFailureMode {
+  identity: "unsupported_operation_stops_at_diagnostics_instead_of_demanding_its_provider" as NonEmptyStr,
+  receipts: [
+    "2026-10-09, PR #13607: safe workspace reuse selected a TUN descriptor census requiring the kernel attached-queue query, but commissioning carried only its failure text. The earliest missing edge was from the selected operation to its environmental requirement, before a kernel package or reboot could be chosen. The CLI reader also collapsed unsupported and unreadable into one refusal, so it could not safely select a remedy.",
+    "The census now owns TunAttachedQueueRequirement. The read-only Linux ioctl reader preserves numeric EOPNOTSUPP; all other failures stay unreadable. Commissioning consumes that requirement and the existing ensure decision: a supported query needs no provider, including a positive queue count that still fails sanitation; unsupported reaches host-selected Ubuntu package/activation planning. Host/revision/interface/boot and package observations bind the fleet plan. No version comparison establishes capability and the same already-running unsupported target refuses a reboot loop.",
+    "The production commissioning scope carries the derived dependency and the existing AwaitingCapability terminal. srv1 has no admitted reset selection, verified runner drain or console recovery, and this session has no shared-host reboot approval. Those are an explicit maintenance-actuation frontier, not a successful apply. Generic compiler completion described in ensure-closure-design remains unimplemented. Attainable ceiling: the operation demand is shared by construction; external running-kernel support requires live readback. The package/read-error controls and fleet artifact/admission witness exercise production folds; the wet reader witness executes the Python/native ioctl boundary.",
+    "2026-10-09 continuation: the operator authorized shared-host maintenance. gunbc.host_kernel_dependency_apply now executes the planner’s canonical dependency through root-only drain, exact non-removing installation, normal OS activation and post-boot capability verification. The drain uses runtime masks without --now and the existing descendant cgroup observer. Its first live invocation placed twelve masks and correctly refused while the jobs were still running. BMC reset-subject enrollment is not a prerequisite for a normal OS reboot; it remains a different effect. Generic slot apply still cannot turn a slot request into authority to reboot its shared host.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/v2_lexer_carries_no_layout_so_a_newline_before_a_dual_role_operator_merges_silently.dag b/dag/gunbc/recurring_failure_mode/v2_lexer_carries_no_layout_so_a_newline_before_a_dual_role_operator_merges_silently.dag
index c9fa97198d4..02366e990ad 100644
--- a/dag/gunbc/recurring_failure_mode/v2_lexer_carries_no_layout_so_a_newline_before_a_dual_role_operator_merges_silently.dag
+++ b/dag/gunbc/recurring_failure_mode/v2_lexer_carries_no_layout_so_a_newline_before_a_dual_role_operator_merges_silently.dag
@@ -12,7 +12,7 @@ data v2_lexer_carries_no_layout_so_a_newline_before_a_dual_role_operator_merges_
     "WHERE, cited by symbol. The seed decides it with layout: `v1.compiler.parse` `is_ambiguous_prefix_infix_newline_boundary` fires when a NEWLINE token precedes an operator in `operator_continuation_dual_role_excluded_symbols` (today exactly `-`). v2 has no such fact to decide with. `v2.std.compilers.lexing` `Token` carries `class`, `lexeme`, `file`, `start` and `end` and nothing about the layout between tokens, and the dag lex rules emit no newline token, so no grammar production can distinguish `x - 1` from `x` newline `-1`. The gap is in the LEXER MODEL, not in a production: a parser special case would be a second, positional authority for a fact the token stream does not carry.",
     "SCOPE. Only an operator that can also START an expression can open a statement and be absorbed; today that is `-`. An operator that is infix only (`*`, `&&`, `|>`, `==`) cannot begin a statement, so a line starting with it never parsed as a separate statement in either parser and is not this class. The population grows with every construct v2 reads as a complete operand: a block-headed statement (`match w {..}` then a `-` line) joins it once block forms are operands of binary_expr, which is why the block-headed left-operand repair (quiet-gull-780's grammar lane) waits on this row's trigger rather than landing a merge the seed refuses.",
     "RUNG FOUND AT: below the floor (silent wrongness): the parse accepts and the lowered value computes a different expression. CEILING: structurally guaranteed. The ambiguity is decidable from the source text, so it can refuse with a typed, located diagnostic exactly where the seed does. NEXT-RUNG TRIGGER, NAMING THE CAPABILITY: the v2 token stream carries layout (a newline boundary between two tokens is a fact the grammar can read), and the dag grammar refuses a dual-role operator that follows a newline at an operand boundary with a typed reason from the closed `v2.std.parse_refusal_reason` vocabulary, as the seed refuses it -- for every statement form, not only block-headed ones.",
-    "CLIMBED, THE TRIGGER CAPABILITY MET (gunbc#12773, gunbc#12881). The token stream carries layout: `v2.std.compilers.lexing` `TokenStream` carries a `StreamLayout` recorded in the tokenizer's own walk (`v2.compiler.tokenize` `lex_walk_step`), and `token_stream_line_break_before` answers whether a line break precedes a token by lookup; a stream with no layout answers unknown and a layout-conditioned production refuses `LayoutUnknownWithoutSource` rather than assuming one line. The grammar refuses: `v2.extdeps.languages.dag` `dag_grammar_additive_expr_helper` tries `RefuseOnMatch { AfterLineBreak { - }, NewlineBeforeDualRoleOperator }` first at every additive continuation, so a `-` that begins a line after a complete operand refuses at the `-` with that typed `v2.std.parse_refusal_reason` reason, for every statement form, block-headed ones included; a same-line `-` is subtraction. RUNG NOW: structurally guaranteed -- no Accepted program contains a line-break-preceded dual-role operator at an operand boundary. The class stays rostered: the defect is real and the evidence below is what keeps the rung honest (DESIGN 4b(4)).",
+    "CLIMBED, THE TRIGGER CAPABILITY MET (gunbc#12773, gunbc#12881). The token stream carries layout: `v2.std.compilers.lexing` `TokenStream` carries a `StreamLayout` recorded in the tokenizer's own walk (`v2.compiler.tokenize` `lex_walk_step`), and `token_stream_line_break_before` answers whether a line break precedes a token by lookup; a stream with no layout answers unknown and a layout-conditioned production refuses `LayoutUnknownWithoutSource` rather than assuming one line. The grammar refuses: `v2.extdeps.languages.dag` `dag_grammar_additive_newline_minus_guard` -- the not-predicate of `RefuseOnMatch { AfterLineBreak { - }, NewlineBeforeDualRoleOperator }` -- is the continuation guard of the binary operator table `dag_grammar_binary_expr_expr`, run at every continuation point after an operand, so a `-` that begins a line after a complete operand refuses at the `-` with that typed `v2.std.parse_refusal_reason` reason, for every statement form, block-headed ones included; a same-line `-` is subtraction. RUNG NOW: structurally guaranteed -- no Accepted program contains a line-break-preceded dual-role operator at an operand boundary. The class stays rostered: the defect is real and the evidence below is what keeps the rung honest (DESIGN 4b(4)).",
   ],
 
   evidence: [
diff --git a/dag/gunbc/recurring_failure_mode/workflow_dispatch_input_limit_unchecked.dag b/dag/gunbc/recurring_failure_mode/workflow_dispatch_input_limit_unchecked.dag
new file mode 100644
index 00000000000..6811ca37cb8
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/workflow_dispatch_input_limit_unchecked.dag
@@ -0,0 +1,14 @@
+module gunbc.recurring_failure_mode.workflow_dispatch_input_limit_unchecked
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data workflow_dispatch_input_limit_unchecked: RecurringFailureMode = RecurringFailureMode {
+  identity: "workflow_dispatch_input_limit_unchecked" as NonEmptyStr,
+  receipts: [
+    "INVALID STATE: a generated workflow is valid YAML and passes local generation but declares more workflow_dispatch inputs than GitHub accepts. Every manual mode is then unavailable, including modes that use only a few fields. A YAML parser cannot prove the hosted API's cardinality contract.",
+    "OBSERVED 2026-10-09 during srv1 workspace bringup, PR #13607: base 2a519d27f6f77db2a20696a2ffc4f540dbd88f40 declares 28 inputs. Adding the image artifact locator made 29; dispatch at 048d345cd302d412565d6b214f1e912a788ffecb returned HTTP 422 with 'you may only define up to 25 inputs'. Push run 37877157911 also failed workflow validation, before any host job ran. GitHub documents 25 at https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#onworkflow_dispatchinputs .",
+    "REPAIR: extdeps.github.actions owns workflow_dispatch_max_inputs, and the fleet YAML producer refuses above it. Consolidating five printer operation detail inputs into one JSON input retains their domain checks and brings this workflow to 25 inputs including the workspace artifact locator. RUNG FOUND AT: detectable only by the remote dispatcher. CURRENT RUNG: mechanically preventable for this producer. CEILING: structurally impossible when every workflow-dispatch carrier admits its bounded input population at construction. NEXT TRIGGER: generic workflow construction owns this admission, so another emitter cannot omit the same API limit.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/recurring_failure_mode/workflow_job_selection_diverges_from_mode_assignment.dag b/dag/gunbc/recurring_failure_mode/workflow_job_selection_diverges_from_mode_assignment.dag
new file mode 100644
index 00000000000..9ba96b1f723
--- /dev/null
+++ b/dag/gunbc/recurring_failure_mode/workflow_job_selection_diverges_from_mode_assignment.dag
@@ -0,0 +1,15 @@
+module gunbc.recurring_failure_mode.workflow_job_selection_diverges_from_mode_assignment
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data workflow_job_selection_diverges_from_mode_assignment: RecurringFailureMode = RecurringFailureMode {
+  identity: "workflow_job_selection_diverges_from_mode_assignment" as NonEmptyStr,
+  receipts: [
+    "2026-10-09, PR #13607, fleet-converge run 37887389027: microvm_controller_install maps to its dedicated job, but the shared job used a separate exclusion list that did not exclude that mode. Both jobs queued under the same host-mutation concurrency group, so the unnecessary shared job delayed installation and selected its cloud credential prelude for a local-only install.",
+    "Invalid state: execution conditions disagree with the modeled mode-to-job assignment. A dedicated job exists but does not exclusively own its dispatch. Harm: extra runner occupancy, unrelated credential demands and failure paths, and a blocked dependent operation despite a successful build.",
+    "Repair: fleet_converge_shared_job_if derives its positive selectors from fleet_converge_mode_job_id over the closed mode roster. The actual shared Job witness admits plan and workspace modes while excluding dedicated controller, dashboard and IAM modes. Deleting that integration restores the duplicate-job specimen and fails the control.",
+    "Ceiling: structurally derive every job selector from its mode assignment; no independent exclusion list remains for the shared job. Runtime acceptance still reads the dispatched job set rather than treating generated text as evidence that GitHub ran it.",
+  ],
+  evidence: [],
+}
diff --git a/dag/gunbc/regen_round_cost_instrument_seed_growth.dag b/dag/gunbc/regen_round_cost_instrument_seed_growth.dag
index 9fded8f6730..a9c4e54a486 100644
--- a/dag/gunbc/regen_round_cost_instrument_seed_growth.dag
+++ b/dag/gunbc/regen_round_cost_instrument_seed_growth.dag
@@ -8,10 +8,15 @@ data regen_round_cost_instrument_seed_growth_justification: SeedGrowthJustificat
   hand_authored_declarations: [
     DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "run_regen_round_cost_instrument", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.target_invocation_host", decl_name: "REGEN_ROUND_COST_PROBE_MIRROR", field: WholeDeclaration },
-    DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "run_regen_one_mirror_emit_probe", field: WholeDeclaration }
+    DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "run_regen_one_mirror_emit_probe", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "SeedHandoff", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "SeedHandoffRefusal", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "decide_seed_handoff", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "compose_seed_build_cost", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "admit_exec_target", field: WholeDeclaration }
   ],
 
-  reason: "The producer arm for gunbc.target_binding RegenRoundCostProducer, so the existing priced regen round (claim_executor --regen-round-cost, gunbc.regen_round_cost) can run by label on a memory-bounded fleet slot through instrument-dispatch. It adds no second emit path: the round is the existing run_regen_round_cost, and the one-mirror discriminator is the existing run_required_regen_scoped with an Affected scope of one member, its trace ledger drained and printed. Both callees are host Rust in the seed, so their caller is too. It adds no flag and no mode that skips a check; it is on-demand only and no required job reaches it.",
+  reason: "ALSO the single re-exec handoff in run_regen_round_cost (SeedHandoff, SeedHandoffRefusal, decide_seed_handoff, compose_seed_build_cost, admit_exec_target): the seed build replaces the running claim_executor, so the built image is handed the pre-handoff seed-build cost, the built-artifact digest and a source identity (HEAD, tracked diff, length-framed untracked non-ignored files; built_exe is the build-output digest checked against the exec'd descriptor, checked against the running image via /proc/self/exe), refuses on a wrong artifact, changed source or other than one seed_build row, and composes them into the receipt once; it dissolves when the seed build is modeled in .dag so the admitted build artifact is what executes, with complete or explicitly unavailable accounting (gunbc.recurring_failure_mode a_build_replaces_the_executable_that_is_running_it). The producer arm for gunbc.target_binding RegenRoundCostProducer, so the existing priced regen round (claim_executor --regen-round-cost, gunbc.regen_round_cost) can run by label on a memory-bounded fleet slot through instrument-dispatch. It adds no second emit path: the round is the existing run_regen_round_cost, and the one-mirror discriminator is the existing run_required_regen_scoped with an Affected scope of one member, its trace ledger drained and printed. Both callees are host Rust in the seed, so their caller is too. It adds no flag and no mode that skips a check; it is on-demand only and no required job reaches it.",
 
   owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
 
diff --git a/dag/gunbc/repo/repo_self_build.dag b/dag/gunbc/repo/repo_self_build.dag
index ec33246b355..5a5bbade815 100644
--- a/dag/gunbc/repo/repo_self_build.dag
+++ b/dag/gunbc/repo/repo_self_build.dag
@@ -107,6 +107,30 @@ fn repo_self_test_command() -> String {
   )
 }
 
+// A NAMED SUBSET OF ONE PACKAGE'S UNIT TESTS, for a control in a package the whole-package run above
+// does not cover: the blocking rust-unit-tests lane runs repo_self_test_command, which is
+// v1-compiler only.
+// The filters are libtest's substring filters after `--`; an empty list would run the whole
+// package, which is repo_self_test_command's request and not this one.
+fn repo_self_targeted_test_command(package: String, filters: List<String>) -> String {
+  join(concat(["cargo test", repo_self_build_profile_flag, "-p", package, "--lib", "--"], filters), " ")
+}
+
+// The crate the emitted runtime v1_rt.rs is compiled in (the stage0 partition's foundation crate).
+data repo_self_runtime_package: String = "v1-stage0-runtime"
+
+// THE EMITTED RUNTIME'S SLICE COST CONTROLS, ENROLLED. v1_rt list_slice_tests carries a RED that runs
+// the copying skip / take templates the emit table used to render and a GREEN that runs
+// list_skip / list_take, on non-ASCII code points, so the pair discriminates the quadratic rather
+// than merely exercising the slice. Only this crate is named: the interpreter's slice and drop
+// controls (v1_interpreter slice_cost_tests, value_depth_walker_tests) are in v1-compiler's own
+// unit tests, which the blocking rust-unit-tests lane already runs whole (repo_self_test_command),
+// and running them again here would be the same work twice. v1-stage0-runtime is outside that
+// lane's package, so without this step its controls would only compile.
+fn repo_self_slice_cost_control_command() -> String {
+  repo_self_targeted_test_command(package: repo_self_runtime_package, filters: ["list_slice_tests"])
+}
+
 // THE LINT PASS OVER EVERY TARGET, as the one invocation DESIGN's "Building & checks" names.
 // `--all-targets` is the whole point: the test and example targets outside `--lib` and `--bins`
 // are compiled by no build command above and executed by no test command, so before this row
diff --git a/dag/gunbc/repo_workspace.dag b/dag/gunbc/repo_workspace.dag
index 30fa3c47b4c..261230fd9fa 100644
--- a/dag/gunbc/repo_workspace.dag
+++ b/dag/gunbc/repo_workspace.dag
@@ -39,15 +39,15 @@ fn own_tool_footprints() -> List<WorkspaceFootprint> {
       ]
     },
     WorkspaceFootprint {
-      provenance: RepoTool { display: "Derived failure-mode roster", owner_module: "gunbc.recurring_failure_mode" },
+      provenance: RepoTool { display: "Retired failure-mode roster file", owner_module: "gunbc.recurring_failure_mode" },
       artifacts: [
-        WorkspaceArtifact { pattern: "/dag/gunbc/recurring_failure_mode/roster.dag", meaning: "membership list derived from sibling row files before compile; not a second authored authority", reason: RegenerableFromSource }
+        WorkspaceArtifact { pattern: "/dag/gunbc/recurring_failure_mode/roster.dag", meaning: "legacy file an older gunbc wrote on every source walk; the roster module is now derived in memory and never written", reason: SupersededAuthority { canonical: "the in-memory roster module contributed by source acquisition (v1_compiler.cli_run.derived_row_roster acquire_dir_files); a file at this path is a legacy artifact of an older gunbc and is refused by the loader" } }
       ]
     },
     WorkspaceFootprint {
-      provenance: RepoTool { display: "Derived rung-drop roster", owner_module: "gunbc.rung_drop" },
+      provenance: RepoTool { display: "Retired rung-drop roster file", owner_module: "gunbc.rung_drop" },
       artifacts: [
-        WorkspaceArtifact { pattern: "/dag/gunbc/rung_drop/roster.dag", meaning: "membership list derived from sibling RungDrop row files before compile; not a second authored authority", reason: RegenerableFromSource }
+        WorkspaceArtifact { pattern: "/dag/gunbc/rung_drop/roster.dag", meaning: "legacy file an older gunbc wrote on every source walk; the roster module is now derived in memory and never written", reason: SupersededAuthority { canonical: "the in-memory roster module contributed by source acquisition (v1_compiler.cli_run.derived_row_roster acquire_dir_files); a file at this path is a legacy artifact of an older gunbc and is refused by the loader" } }
       ]
     },
     WorkspaceFootprint {
diff --git a/dag/gunbc/required_ci_contract_epoch.dag b/dag/gunbc/required_ci_contract_epoch.dag
index dce6dbc7840..3dfa690948a 100644
--- a/dag/gunbc/required_ci_contract_epoch.dag
+++ b/dag/gunbc/required_ci_contract_epoch.dag
@@ -28,7 +28,14 @@ import std.contract_identity { ContractEpoch }
 // diligence until a contract-surface digest or a classifier distinguishes material from internal
 // change. That distinction is the next-rung trigger for this row, and it is a capability, not an
 // artifact: acceptance deriving contract materiality from the contract's own surface.
-data required_ci_contract_epoch: ContractEpoch = "2026-09-01.1" as ContractEpoch
+//
+// BUMPED 2026-10-09 (operator ruling, the v1 withdrawal). Until then a success of the required
+// context also meant the v1 interpreter had folded the rostered witnesses, the stage0 mirrors and the
+// registry-rostered generated artifacts matched their authorities, and the v1 unit tests passed. From
+// this epoch it means only that the seed emitted the two retained v2 closures and the emitted crates built and
+// started (gunbc.compiler_gate_workflow header; the loss is gunbc.rung_drop
+// v1_required_lanes_withdrawn). That is a change in what a success entitles a consumer to conclude.
+data required_ci_contract_epoch: ContractEpoch = "2026-10-09.1" as ContractEpoch
 
 // The env member name the workflow authority emits and the exact-commit reader looks up. It is
 // declared here beside the value because the KEY and the VALUE are one fact about how this epoch is
diff --git a/dag/gunbc/required_ci_phase_roster.dag b/dag/gunbc/required_ci_phase_roster.dag
index e76f1dfbaf8..50d41b63c37 100644
--- a/dag/gunbc/required_ci_phase_roster.dag
+++ b/dag/gunbc/required_ci_phase_roster.dag
@@ -1,6 +1,9 @@
 module gunbc.required_ci_phase_roster
 
-import std.types { String, Bool, List }
+import std.types { String, Bool, Int, List, NonEmptyStr }
+import std.measure { Millisecond, millisecond }
+import std.checked_arithmetic { nat_magnitude }
+import std.optional { Present, Absent }
 
 // THE SUBSTRATE AUTHORITY FOR WHICH PHASES REQUIRED CI RUNS, AND WHICH LANE OWNS EACH.
 // gunbc.required_ci_host_verdict_census recorded the gap this module closes: "Phase existence and
@@ -196,3 +199,97 @@ fn required_ci_lane_phase_rows() -> List<RequiredCiLanePhaseRow> {
       phase: required_ci_phase_name(p: p)
     })
 }
+
+// ── THE FLOOR PHASE'S OWN PROGRESS ROWS, READ BACK FROM A RUN'S LOG ─────────────────────────────
+//
+// FloorPhase is one RequiredCiPhase; inside it the host prints `[floor-phase] phase=<word> ...` rows
+// for its own preparation stages (claim_executor, cli_run). Those stage WORDS are not this roster's
+// vocabulary -- they are an open host vocabulary with no substrate authority, so a reading carries
+// the word as the host spelled it and never maps it onto RequiredCiPhase. What this module owns is
+// the reading's denominator: these rows are the timings OF required_ci_phases' FloorPhase, which is
+// why gunbc.runner_throughput_qualification_route names this module as their producer.
+//
+// THE LINE ENCODING IS `[tag] key=value key=value`, one row per line, possibly behind the timestamp
+// GitHub prefixes to each job-log line. floor_log_row_fields is the one reader of that encoding; the
+// [floor-cgroup] reader (gunbc.host_budget_source) uses it rather than tokenizing a second time. A
+// value may itself contain `=` (the cgroup pressure field does), so only the FIRST `=` splits.
+type FloorLogField {
+  key: String
+  value: String
+}
+
+fn floor_log_field(token: String) -> FloorLogField? {
+  let parts = split(s: token, delimiter: "=")
+  match parts.first() {
+    Absent => none
+    Present { value: k } =>
+      if count(parts) < 2 {
+        none
+      } else {
+        let v = substring(s: token, start: string_length(s: k) + 1, end: string_length(s: token))
+        Present { value: FloorLogField { key: k, value: v } }
+      }
+  }
+}
+
+// none: the line is not a row of this tag. A row of the tag yields its fields, possibly empty.
+fn floor_log_row_fields(line: String, tag: String) -> List<FloorLogField>? {
+  let halves = split(s: line, delimiter: concat(tag, " "))
+  match halves.skip(n: 1).first() {
+    Absent => none
+    Present { value: payload } =>
+      if count(halves) != 2 {
+        none
+      } else {
+        let tokens = split(s: payload, delimiter: " ")
+        let fields = tokens |> flat_map(t => match floor_log_field(token: t) { Absent => [] Present { value: f } => [f] })
+        Present { value: fields }
+      }
+  }
+}
+
+fn floor_log_field_value(fields: List<FloorLogField>, key: String) -> String? {
+  match fields |> filter(f => f.key == key) |> first {
+    Absent => none
+    Present { value: f } => Present { value: f.value }
+  }
+}
+
+data floor_phase_row_tag: String = "[floor-phase]"
+
+// A STAGE ROW EITHER CARRIES ITS WALL OR DOES NOT, and the two are not one row with a zero. The host
+// prints `state=started` rows and classification rows with no wall_ms; reporting those as 0 ms would
+// fabricate a timing. A row with no phase word, or a wall_ms that is not a count, is garbled and is
+// carried with its line, never skipped.
+type FloorPhaseRow
+  = FloorPhaseTimed { phase: NonEmptyStr, wall: Millisecond }
+  | FloorPhaseUntimed { phase: NonEmptyStr }
+
+type FloorPhaseRowReading
+  = FloorPhaseRowRead { row: FloorPhaseRow }
+  | FloorPhaseRowGarbled { line: String, cause: NonEmptyStr }
+
+fn read_floor_phase_row(line: String) -> FloorPhaseRowReading? {
+  match floor_log_row_fields(line: line, tag: floor_phase_row_tag) {
+    Absent => none
+    Present { value: fields } =>
+      match floor_log_field_value(fields: fields, key: "phase") {
+        Absent => Present { value: FloorPhaseRowGarbled { line: line, cause: "[floor-phase] row carries no phase= field" as NonEmptyStr } }
+        Present { value: "" } => Present { value: FloorPhaseRowGarbled { line: line, cause: "[floor-phase] row carries an empty phase= field" as NonEmptyStr } }
+        Present { value: phase } =>
+          match floor_log_field_value(fields: fields, key: "wall_ms") {
+            Absent => Present { value: FloorPhaseRowRead { row: FloorPhaseUntimed { phase: phase as NonEmptyStr } } }
+            Present { value: raw } =>
+              match parse_int(s: raw) {
+                Absent => Present { value: FloorPhaseRowGarbled { line: line, cause: "[floor-phase] wall_ms is not a count" as NonEmptyStr } }
+                Present { value: ms } =>
+                  if ms < 0 {
+                    Present { value: FloorPhaseRowGarbled { line: line, cause: "[floor-phase] wall_ms is negative" as NonEmptyStr } }
+                  } else {
+                    Present { value: FloorPhaseRowRead { row: FloorPhaseTimed { phase: phase as NonEmptyStr, wall: millisecond(count: nat_magnitude(a: ms)) } } }
+                  }
+              }
+          }
+      }
+  }
+}
diff --git a/dag/gunbc/required_lane_resolution_census_live.dag b/dag/gunbc/required_lane_resolution_census_live.dag
index 5787b001471..a469df14c06 100644
--- a/dag/gunbc/required_lane_resolution_census_live.dag
+++ b/dag/gunbc/required_lane_resolution_census_live.dag
@@ -8,9 +8,8 @@ import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
 import extdeps.github.actions { Workflow, Job }
 import gunbc.compiler_gate_workflow {
   compiler_gate_workflow, compiler_gate_merge_path_job_ids,
-  compiler_gate_emit_build_job_id, compiler_gate_floor_job_id, compiler_gate_generated_job_id, compiler_gate_aggregate_job_id,
+  compiler_gate_required_job_id,
 }
-import gunbc.ci_spec { gunbc_ci_heal_verify_target }
 import gunbc.instrument_targets { self_host_entry, v2_native_cli_entry }
 import gunbc.ci_layer_roots { witness_layer_roots }
 import gunbc.required_lane_resolution_census {
@@ -28,11 +27,17 @@ data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
 // sources to is a fact about the step scripts, and reading it out of a rendered `run:` line
 // would be a second parser of a string this repository already generates from typed rows -- but
 // its COVERAGE is checked against the emitted job list: a job the workflow carries and this
-// roster does not is a refusal, never a job read as resolving nothing. The subject rows cite the
-// same declarations the step scripts render from (gunbc.ci.ci_spec gunbc_ci_heal_verify_target
-// for the drift gate's entry; the floor's nominal seeds through the compiler query).
+// roster does not is a refusal, never a job read as resolving nothing.
 //
-// emit-build became required on 2026-10-02. Its two steps run `gunbc test` over
+// THE `floor` AND `generated` ROWS LEFT WITH THEIR JOBS (operator ruling 2026-10-09, the v1
+// withdrawal). They were the two lanes that resolved the corpus beyond the native closures, so from
+// that ruling this census DOES NOT HOLD by design: every admitted module outside the two entry
+// closures below is resolved by no required lane, and the receipt lists that population by identity.
+// The loss is the declared drop gunbc.rung_drop v1_required_lanes_withdrawn; this instrument is the
+// producer that re-derives its population.
+//
+// emit-build became required on 2026-10-02 and became THE required job, `witnesses`, with the
+// 2026-10-09 ruling. Its two subject steps run `gunbc test` over
 // //gunbc/instruments:self-host and //gunbc/instruments:v2-native-cli, whose producers
 // (v1_compiler.cli_run.native_lane_runner NATIVE_COMPILE_ENTRY and V2_NATIVE_CLI_ENTRY) ingest
 // and resolve the import closure of these two entries before emitting it. The entries are the
@@ -42,23 +47,11 @@ data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
 fn lane_resolution_roster() -> List<LaneResolutionRow> {
   [
     LaneResolutionRow {
-      job_id: compiler_gate_emit_build_job_id,
+      job_id: compiler_gate_required_job_id,
       subjects: [
         RunEntryClosure { entry_path: self_host_entry() },
         RunEntryClosure { entry_path: v2_native_cli_entry() },
       ]
-    },
-    LaneResolutionRow {
-      job_id: compiler_gate_floor_job_id,
-      subjects: [FloorNominalPreparedSubject {}]
-    },
-    LaneResolutionRow {
-      job_id: compiler_gate_generated_job_id,
-      subjects: [RunEntryClosure { entry_path: gunbc_ci_heal_verify_target.entry }]
-    },
-    LaneResolutionRow {
-      job_id: compiler_gate_aggregate_job_id,
-      subjects: [ResolvesNoDagModule { reason: "reads the other lanes' conclusions; runs no compiler" }]
     }
   ]
 }
@@ -84,7 +77,7 @@ fn count_of(xs: List<String>, x: String) -> Int {
 
 // COVERAGE IS OVER THE REQUIRED JOBS, WHICH IS WHAT THIS ROSTER'S ROWS ARE (gunbc.required_lane_resolution_census
 // LaneResolutionRow: one required job and the subjects its steps resolve). The required jobs are the
-// workflow's merge path -- the lanes the aggregate reads, and the aggregate -- read from
+// workflow's merge path -- since 2026-10-09 the one required job -- read from
 // gunbc.compiler_gate_workflow compiler_gate_merge_path_job_ids rather than restated. A lane announced
 // as not blocking is read by no required context, so a module only it resolves is resolved by no
 // required lane, and a row for it would be the inflation this census exists to refuse. Checking
diff --git a/dag/gunbc/roadmap/dashboard_instance_directories.dag b/dag/gunbc/roadmap/dashboard_instance_directories.dag
new file mode 100644
index 00000000000..cb85a7794ec
--- /dev/null
+++ b/dag/gunbc/roadmap/dashboard_instance_directories.dag
@@ -0,0 +1,41 @@
+module gunbc.roadmap.dashboard_instance_directories
+
+import std.types { List }
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_own_directory_demands }
+import gunbc.owned_directory { OwnedDirectoryTarget }
+import gunbc.auth.session_store { session_store_directory }
+import gunbc.auth.login_transaction_store { login_transaction_store_directory }
+import gunbc.auth.oidc_id_token_verification { jwks_cache_directory }
+import gunbc.auth.profile_projection { profile_store_directory }
+import gunbc.roadmap_view_preference_store { issue_view_store_directory }
+import gunbc.roadmap.roadmap_event_carrier_directory { roadmap_event_carrier_directory }
+import gunbc.compute.host_capacity { compute_root_directory }
+import gunbc.fabric_storage_placement { fabric_storage_directory_demands }
+
+// THE ONLY LIST OF AN INSTANCE'S DIRECTORIES. Every row is the demand its consumer declares -- the
+// directory it writes into, as an owned-directory target (gunbc.owned_directory) -- and both routes
+// that create them read this list and nothing else: the dashboard apply
+// (gunbc.roadmap_dashboard_instance_apply dashboard_apply_owned_directories, which also reads them
+// back in dashboard_instance_observe) and the live_deploy transaction (gunbc.live_deploy.spec
+// DeploymentSpec.directories, emitted by gunbc.live_deploy.emit owned_directory_apply_steps and read
+// back as DirectoryRoot members by gunbc.live_deploy.member_observe).
+//
+// THIS IS STILL A CONSUMER LIST, AND THAT IS ITS DECLARED LIMIT. A consumer that writes a directory
+// and is not listed here gets no creator; the composition cannot see it. D14 step 4
+// (docs/plans/ensure-closure-design.md section 12) is what derives the demand from the code that
+// writes, at which point this list stops being authored. Until then, adding a directory writer means
+// declaring its demand in its own module and adding one row here.
+//
+// It lives above the consumers rather than in gunbc.roadmap_dashboard_instance because every consumer
+// imports the instance type from there; composing them there would close a cycle.
+fn dashboard_instance_directory_demands(instance: HostDashboardInstance) -> List<OwnedDirectoryTarget> {
+  concat(dashboard_instance_own_directory_demands(instance: instance), concat([
+    session_store_directory(instance: instance),
+    login_transaction_store_directory(instance: instance),
+    jwks_cache_directory(instance: instance),
+    profile_store_directory(instance: instance),
+    issue_view_store_directory(instance: instance),
+    roadmap_event_carrier_directory(instance: instance),
+    compute_root_directory(instance: instance),
+  ], fabric_storage_directory_demands(instance: instance)))
+}
diff --git a/dag/gunbc/roadmap/roadmap_attempt_exit_spool.dag b/dag/gunbc/roadmap/roadmap_attempt_exit_spool.dag
new file mode 100644
index 00000000000..00d8ed3d5ff
--- /dev/null
+++ b/dag/gunbc/roadmap/roadmap_attempt_exit_spool.dag
@@ -0,0 +1,326 @@
+module gunbc.roadmap.roadmap_attempt_exit_spool
+
+import std.types { String, NonEmptyStr, List, Bool, Int }
+import gunbc.host_layout { attempt_exit_inbox_dir, attempt_exit_queued_dir, attempt_exit_running_dir, attempt_exit_done_dir, attempt_exit_refused_dir }
+import extdeps.systemd.service_exec {
+  ServiceStopVariable, InvocationIdVariable, ServiceResultVariable, ExitCodeVariable, ExitStatusVariable,
+  ServiceResult, service_result_of_wire, ServiceExitCode, service_exit_code_of_wire,
+  ServiceExitCodeExited, ServiceExitCodeKilled, ServiceExitCodeDumped, ServiceExitCodeUnlisted,
+  ExecWordPart, ExecLiteral, ExecVariable, ExecWordRendered, ExecWordRefused, exec_word_render,
+  ExecCommandLineRendering, ExecCommandLineRendered, ExecCommandLineRefused, exec_command_line,
+  exec_command_line_full_privileges,
+}
+import extdeps.posix.signal { LinuxStandardSignal, linux_standard_signal_of_name }
+import extdeps.tools.gnu_coreutils { mkdir_create_only_command }
+import extdeps.filesystem.filesystem_io {
+  Filesystem,
+  FilesystemListingObservation, FilesystemDirectoryListed, FilesystemDirectoryListingRefused, FilesystemDirectorySubjectRefused,
+  filesystem_listing_observation, filesystem_listing_entry_names,
+}
+
+// THE RECORD A WORKER UNIT LEAVES WHEN ITS PROCESS ENDS (dogfood interventions #4 and #6, gunbc#13124;
+// docs/plans/belt-event-driven-obligations.md). The unit's stop hook creates ONE directory in the
+// instance's exit inbox, and the directory's NAME is the record: the attempt it belongs to, the
+// manager's invocation id, and the three stop-time facts systemd hands the hook
+// (extdeps.systemd.service_exec ServiceStopVariable). There is no file to write and no shell to write
+// it with -- the hook is `mkdir -- <name>` as a typed argv, the manager substitutes the variables,
+// and mkdir(2) is atomic and create-only, so a repeated hook for one invocation fails harmlessly and
+// two invocations can never merge into one record.
+//
+// THIS RECORD REPLACES UNIT-LOADED STATE AS THE EXIT EVIDENCE. The worker unit used to set
+// RemainAfterExit=yes so that a successful exit stayed readable as `active (exited)` with its
+// ExecMainStatus (2026-09-05). That state lives in the user manager's memory: it is gone on a
+// reboot, a manager restart or a reap, and while it stands the unit never STOPS, so no stop hook can
+// run at the moment the worker exits. The entry is on disk under the instance root and is written
+// at exit, which is the event the capture obligation waits on.
+//
+// THE SEPARATOR IS "+". The name's parts are a roadmap node id (kebab-case), an attempt key (hex), the
+// unit's ROLE within the attempt (AttemptUnitRole), an invocation id (32 hex), a $SERVICE_RESULT word
+// (lowercase, may contain "-"), an $EXIT_CODE word and an $EXIT_STATUS (decimal or a signal name).
+// None of those can contain "+", so the name splits into exactly seven parts or it is not a record;
+// nothing is guessed from a partial split.
+//
+// THE ROLE IS IN THE NAME BECAUSE ONE ATTEMPT RUNS SEVERAL UNITS: its worker, one reviewer per
+// criterion and an auditor, each of which now ends with an exit record (bold-bee-114 ruling,
+// 2026-10-06: a reviewer finishing is the event its attempt's next obligation waits on, exactly as a
+// worker finishing is). The role names one LAUNCH: the worker once per attempt, a reviewer once per
+// (criterion, head), the auditor once per head -- so (node, attempt, role) identifies one unit run.
+
+data attempt_exit_entry_separator: String = "+"
+
+// THE STOP HOOK RUNS OUTSIDE THE UNIT'S SANDBOX ("+", extdeps.systemd.service_exec
+// exec_command_line_full_privileges). A reviewer's or auditor's process may write only its own review
+// directory; were the inbox added to its ReadWritePaths, the process it confines could create an exit
+// record for any unit of any attempt. With the prefix, the hook writes the inbox and the confined
+// process still cannot -- the record is the manager's statement, not the worker's.
+//
+// THE STOP HOOK'S ARGV, as one ExecStopPost= value. Refuses rather than renders if any literal part
+// would be read as command-line syntax (extdeps.systemd.service_exec exec_word_render); a refused hook
+// is a refused spawn, because a worker started without its exit record would leave its capture with
+// nothing to fire on.
+type AttemptExitHook
+  = AttemptExitHookRendered { exec_line: NonEmptyStr }
+  | AttemptExitHookRefused { reason: NonEmptyStr }
+
+// THE UNIT'S ROLE WITHIN ITS ATTEMPT, rendered as one '+'-free token.
+// A reviewer is launched per (criterion, head) and an auditor per head, so their roles carry the head:
+// a re-review of a new head is a new launch with its own record, not a second record for one launch.
+type AttemptUnitRole
+  = AttemptWorkerRole
+  | AttemptReviewerRole { criterion_key: String, head_sha: String }
+  | AttemptAuditorRole { head_sha: String }
+  | AttemptObligationRole
+
+fn attempt_unit_role_token(role: AttemptUnitRole) -> String {
+  match role {
+    AttemptWorkerRole => "worker"
+    AttemptReviewerRole { criterion_key, head_sha } => join(["review.", criterion_key, ".", head_sha], "")
+    AttemptAuditorRole { head_sha } => join(["audit.", head_sha], "")
+    AttemptObligationRole => "obligation"
+  }
+}
+
+fn attempt_exit_entry_parts(inbox: String, node_id: String, attempt_key: String, role: AttemptUnitRole) -> List<ExecWordPart> {
+  [
+    ExecLiteral { text: join([inbox, "/", node_id, attempt_exit_entry_separator, attempt_key, attempt_exit_entry_separator, attempt_unit_role_token(role: role), attempt_exit_entry_separator], "") },
+    ExecVariable { variable: InvocationIdVariable },
+    ExecLiteral { text: attempt_exit_entry_separator },
+    ExecVariable { variable: ServiceResultVariable },
+    ExecLiteral { text: attempt_exit_entry_separator },
+    ExecVariable { variable: ExitCodeVariable },
+    ExecLiteral { text: attempt_exit_entry_separator },
+    ExecVariable { variable: ExitStatusVariable },
+  ]
+}
+
+fn attempt_exit_hook(instance_root: String, node_id: String, attempt_key: String, role: AttemptUnitRole) -> AttemptExitHook {
+  match exec_word_render(parts: attempt_exit_entry_parts(inbox: attempt_exit_inbox_dir(instance_root: instance_root), node_id: node_id, attempt_key: attempt_key, role: role)) {
+    ExecWordRefused { reason } => AttemptExitHookRefused { reason: reason }
+    ExecWordRendered { word } =>
+      match exec_command_line_full_privileges(command: mkdir_create_only_command(path: word as String)) {
+        ExecCommandLineRefused { reason } => AttemptExitHookRefused { reason: reason }
+        ExecCommandLineRendered { line } => AttemptExitHookRendered { exec_line: line }
+      }
+  }
+}
+
+// ONE DECODED RECORD. The process END is a closed pair: an exit with a status, or a signal. They are
+// different facts -- a process killed by SIGTERM did not exit 15 -- and the record keeps them apart.
+type AttemptProcessEnd
+  = AttemptProcessExitedWith { status: Int }
+  | AttemptProcessSignaled { signal: LinuxStandardSignal }
+
+type AttemptExitRecord {
+  node_id: String
+  attempt_key: String
+  role: String
+  invocation_id: String
+  result: ServiceResult
+  end: AttemptProcessEnd
+  entry_name: String
+}
+
+type AttemptExitEntryDecode
+  = AttemptExitEntryDecoded { record: AttemptExitRecord }
+  | AttemptExitEntryMalformed { entry_name: String, reason: String }
+
+// THE END THE TWO STOP VARIABLES DESCRIBE, or why they describe none. "Exited" must carry a number;
+// "killed" and "dumped" carry a signal name; a word systemd.exec(5) does not document is refused
+// rather than read as either.
+type AttemptProcessEndDecode
+  = AttemptProcessEndOf { end: AttemptProcessEnd }
+  | AttemptProcessEndRefused { reason: String }
+
+fn attempt_process_signaled_of(status: String) -> AttemptProcessEndDecode {
+  match linux_standard_signal_of_name(name: status) {
+    Present { value: signal } => AttemptProcessEndOf { end: AttemptProcessSignaled { signal: signal } }
+    Absent => AttemptProcessEndRefused { reason: join(["EXIT_STATUS is not a standard Linux signal name (signal(7)): ", status], "") }
+  }
+}
+
+fn attempt_process_end_of(code: ServiceExitCode, status: String) -> AttemptProcessEndDecode {
+  match code {
+    ServiceExitCodeExited =>
+      match parse_int(text: status) {
+        Present { value: n } => AttemptProcessEndOf { end: AttemptProcessExitedWith { status: n } }
+        Absent => AttemptProcessEndRefused { reason: join(["EXIT_CODE is exited but EXIT_STATUS is not a number: ", status], "") }
+      }
+    ServiceExitCodeKilled => attempt_process_signaled_of(status: status)
+    ServiceExitCodeDumped => attempt_process_signaled_of(status: status)
+    ServiceExitCodeUnlisted { word } => AttemptProcessEndRefused { reason: join(["EXIT_CODE is not a word systemd.exec(5) documents: ", word], "") }
+  }
+}
+
+// The decoder checks the part count before reading any part, so an absent index here is a count
+// already refused; the empty string it answers is then refused by the emptiness checks below.
+fn attempt_exit_entry_part(parts: List<String>, index: Int) -> String {
+  match parts.get(index) {
+    Present { value: v } => v
+    Absent => ""
+  }
+}
+
+fn attempt_exit_entry_decode(entry_name: String) -> AttemptExitEntryDecode {
+  let parts = entry_name.split(delimiter: attempt_exit_entry_separator)
+  if count(parts) != 7 {
+    AttemptExitEntryMalformed { entry_name: entry_name, reason: join(["an exit record has seven '+'-separated parts; this name has ", to_string(value: count(parts))], "") }
+  } else {
+    let node_id = attempt_exit_entry_part(parts: parts, index: 0)
+    let attempt_key = attempt_exit_entry_part(parts: parts, index: 1)
+    let role = attempt_exit_entry_part(parts: parts, index: 2)
+    let invocation_id = attempt_exit_entry_part(parts: parts, index: 3)
+    let result_word = attempt_exit_entry_part(parts: parts, index: 4)
+    let code = service_exit_code_of_wire(word: attempt_exit_entry_part(parts: parts, index: 5))
+    let status = attempt_exit_entry_part(parts: parts, index: 6)
+    if string_length(s: node_id) == 0 || string_length(s: attempt_key) == 0 || string_length(s: role) == 0 || string_length(s: invocation_id) == 0 {
+      AttemptExitEntryMalformed { entry_name: entry_name, reason: "an exit record names its node, attempt, role and invocation; one of them is empty" }
+    } else {
+      match attempt_process_end_of(code: code, status: status) {
+        AttemptProcessEndRefused { reason } => AttemptExitEntryMalformed { entry_name: entry_name, reason: reason }
+        AttemptProcessEndOf { end } =>
+          AttemptExitEntryDecoded {
+            record: AttemptExitRecord {
+              node_id: node_id,
+              attempt_key: attempt_key,
+              role: role,
+              invocation_id: invocation_id,
+              result: service_result_of_wire(word: result_word),
+              end: end,
+              entry_name: entry_name,
+            },
+          }
+      }
+    }
+  }
+}
+
+// WHERE IN THE SPOOL AN ENTRY STANDS, which is responsibility, not evidence: the record means the
+// same thing in every stage. Inbox: no obligation has taken it. Queued: recorded and handed off, no run has
+// claimed it. Running: a live run claimed it and has not settled it. Done: its obligation's receipt exists. Refused: the drain could not hand it off.
+type AttemptExitSpoolStage
+  = AttemptExitInbox
+  | AttemptExitQueued
+  | AttemptExitRunning
+  | AttemptExitDone
+  | AttemptExitRefused
+
+fn attempt_exit_spool_stage_dir(instance_root: String, stage: AttemptExitSpoolStage) -> String {
+  match stage {
+    AttemptExitInbox => attempt_exit_inbox_dir(instance_root: instance_root)
+    AttemptExitQueued => attempt_exit_queued_dir(instance_root: instance_root)
+    AttemptExitRunning => attempt_exit_running_dir(instance_root: instance_root)
+    AttemptExitDone => attempt_exit_done_dir(instance_root: instance_root)
+    AttemptExitRefused => attempt_exit_refused_dir(instance_root: instance_root)
+  }
+}
+
+// THE EXIT RECORD OF ONE ATTEMPT, as the process observer needs it. Three arms and only three:
+// a record was found; the spool was read in every stage and holds none for this attempt; or a
+// stage could not be read. The third is never the second -- "I could not look" is not "there is
+// none" -- and the second is never "the worker never ran": it is the absence of a RECORD, which the
+// observer reports as exactly that (bold-bee-114 ruling, condition 1).
+type AttemptExitRecordObservation
+  = AttemptExitRecordFound { record: AttemptExitRecord }
+  | AttemptExitRecordNone
+  | AttemptExitRecordUnreadable { reason: String }
+
+type AttemptExitStageListing
+  = AttemptExitStageNames { names: List<String> }
+  | AttemptExitStageUnreadable { reason: String }
+
+fn attempt_exit_stage_listing(listing: FilesystemListingObservation) -> AttemptExitStageListing {
+  match listing {
+    FilesystemDirectoryListed(admitted) => AttemptExitStageNames { names: filesystem_listing_entry_names(listing: admitted) }
+    FilesystemDirectoryListingRefused { directory, error } =>
+      AttemptExitStageUnreadable { reason: join(["the attempt-exit spool stage ", directory as String, " could not be listed: ", error], "") }
+    FilesystemDirectorySubjectRefused { directory, cause } =>
+      AttemptExitStageUnreadable { reason: join(["the attempt-exit spool stage ", directory, " is not an admissible directory: ", cause], "") }
+  }
+}
+
+// PURE OVER THE THREE LISTINGS, so the decision is exercised on supplied listings and the wet read
+// below is only the listing. A launch runs once per (attempt, role), so a second record for one subject
+// is a second invocation of one unit, which the dispatch path does not do -- it is reported as
+// unreadable, never chosen between.
+fn attempt_exit_record_from_listings(
+  node_id: String,
+  attempt_key: String,
+  role: AttemptUnitRole,
+  listings: List<AttemptExitStageListing>,
+) -> AttemptExitRecordObservation {
+  attempt_exit_record_matching(matches: (n, a, r) => n == node_id && a == attempt_key && r == attempt_unit_role_token(role: role), listings: listings)
+}
+
+// THE SAME DECISION OVER ANY SUBJECT PREDICATE: the placement settlement knows a worker by its unit
+// name, and the unit name is minted above this module (gunbc.roadmap_dispatch_actuator
+// dispatch_attempt_unit_name), so the caller supplies the predicate rather than this module
+// re-deriving the name.
+fn attempt_exit_record_matching(
+  matches: fn(String, String, String) -> Bool,
+  listings: List<AttemptExitStageListing>,
+) -> AttemptExitRecordObservation {
+  let unreadable = listings |> flat_map(l => match l {
+    AttemptExitStageUnreadable { reason } => [reason]
+    AttemptExitStageNames { names: _ } => [] as List<String>
+  })
+  match unreadable.first() {
+    Present { value: why } => AttemptExitRecordUnreadable { reason: why }
+    Absent => {
+      let malformed = listings
+        |> flat_map(l => match l {
+          AttemptExitStageNames { names } => names
+          AttemptExitStageUnreadable { reason: _ } => [] as List<String>
+        })
+        |> flat_map(name => match attempt_exit_entry_decode(entry_name: name) {
+          AttemptExitEntryDecoded { record: _ } => [] as List<String>
+          AttemptExitEntryMalformed { entry_name: _, reason: why } => {
+            let parts = name.split(delimiter: attempt_exit_entry_separator)
+            if count(parts) >= 3 && matches(attempt_exit_entry_part(parts: parts, index: 0), attempt_exit_entry_part(parts: parts, index: 1), attempt_exit_entry_part(parts: parts, index: 2)) {
+              [join([name, ": ", why], "")]
+            } else {
+              [] as List<String>
+            }
+          }
+        })
+      let records = listings
+        |> flat_map(l => match l {
+          AttemptExitStageNames { names } => names
+          AttemptExitStageUnreadable { reason: _ } => [] as List<String>
+        })
+        |> flat_map(name => match attempt_exit_entry_decode(entry_name: name) {
+          AttemptExitEntryDecoded { record } => if matches(record.node_id, record.attempt_key, record.role) { [record] } else { [] as List<AttemptExitRecord> }
+          AttemptExitEntryMalformed { entry_name: _, reason: _ } => [] as List<AttemptExitRecord>
+        })
+      if count(malformed) > 0 {
+        AttemptExitRecordUnreadable { reason: join(["the attempt-exit spool holds an exit entry for this attempt that cannot be decoded, so its end is unobserved rather than absent: ", join(malformed, "; ")], "") }
+      } else if count(records) > 1 {
+        AttemptExitRecordUnreadable { reason: join(["the attempt-exit spool holds ", to_string(value: count(records)), " exit records for one attempt, and its unit runs once: ", join(records |> map(r => r.entry_name), ", ")], "") }
+      } else {
+        match records.first() {
+          Present { value: r } => AttemptExitRecordFound { record: r }
+          Absent => AttemptExitRecordNone
+        }
+      }
+    }
+  }
+}
+
+fn attempt_exit_stage_list(instance_root: String, stage: AttemptExitSpoolStage) -> AttemptExitStageListing {
+  let dir = attempt_exit_spool_stage_dir(instance_root: instance_root, stage: stage)
+  let listed = Filesystem.List(path: dir)
+  attempt_exit_stage_listing(listing: filesystem_listing_observation(directory: dir, success: listed.success, entries: listed.entries, error: listed.error))
+}
+
+fn attempt_exit_stage_listings(instance_root: String) -> List<AttemptExitStageListing> {
+  [
+    attempt_exit_stage_list(instance_root: instance_root, stage: AttemptExitInbox),
+    attempt_exit_stage_list(instance_root: instance_root, stage: AttemptExitQueued),
+    attempt_exit_stage_list(instance_root: instance_root, stage: AttemptExitRunning),
+    attempt_exit_stage_list(instance_root: instance_root, stage: AttemptExitDone),
+    attempt_exit_stage_list(instance_root: instance_root, stage: AttemptExitRefused),
+  ]
+}
+
+fn attempt_exit_record_observe(instance_root: String, node_id: String, attempt_key: String, role: AttemptUnitRole) -> AttemptExitRecordObservation {
+  attempt_exit_record_from_listings(node_id: node_id, attempt_key: attempt_key, role: role, listings: attempt_exit_stage_listings(instance_root: instance_root))
+}
diff --git a/dag/gunbc/roadmap/roadmap_authority.dag b/dag/gunbc/roadmap/roadmap_authority.dag
index a0ffe70c64b..7ac7d72abf2 100644
--- a/dag/gunbc/roadmap/roadmap_authority.dag
+++ b/dag/gunbc/roadmap/roadmap_authority.dag
@@ -1556,7 +1556,7 @@ fn declared_roadmap_nodes() -> List<RoadmapNode> {
         boundary: "Invert the roster. Today the Rust dispatch is the authority and the roster is derived from it; here the roster becomes the authority and the interpreter's local arm identity and spelling/form lookup are GENERATED from it, leaving hand Rust to supply only the handler bodies behind an exhaustive match. The semantic question of which primitive an arm realizes stays a separate join and does not move here.",
         displaced_cost: "While the denominator lives in Rust, 'which primitives does the interpreter provide' can only be answered by reading Rust, and a new dispatch site added there is invisible to every consumer that asks. That keeps interpreter deletion a judgment call instead of a derived population, and it leaves the primitive-identity join reading a surface that can grow behind its back.",
         first_slice: "Generate the arm identity and the spelling/form lookup from the roster, and make the Rust handler match exhaustive over the generated identity — compile-time on single-family sites, runtime unreachable! backstop on bridge/native-intercept until per-family enum split.",
-        red_control: "On single-family dispatch sites (eval_builtin_inner, eval_algebra_method_inner, try_v2_std_collection_map_primitive_grounding, try_parse_table_memo_dispatch), a roster row with no Rust handler must fail COMPILATION, not a test. On eval_call_bridge and eval_call_native_intercept — shared enums with per-family macro subsets — the same mismatch degrades to runtime unreachable! until per-family enum split lands (named follow-up). A Rust handler that is not reachable through a generated arm identity must not be addable as another string-dispatch path. Editing alias order or an authored spelling must not change an arm identity. One spelling under two different forms must stay representable. An accepted shape or arity is either modeled on the roster or typed as unknown -- never guessed. And no Rust-only spelling denominator may remain anywhere: if one does, this node is not done.",
+        red_control: "On single-family dispatch sites (eval_builtin_inner, eval_algebra_method_inner, try_v2_std_collection_map_primitive_grounding), a roster row with no Rust handler must fail COMPILATION, not a test. On eval_call_bridge and eval_call_native_intercept — shared enums with per-family macro subsets — the same mismatch degrades to runtime unreachable! until per-family enum split lands (named follow-up). A Rust handler that is not reachable through a generated arm identity must not be addable as another string-dispatch path. Editing alias order or an authored spelling must not change an arm identity. One spelling under two different forms must stay representable. An accepted shape or arity is either modeled on the roster or typed as unknown -- never guessed. And no Rust-only spelling denominator may remain anywhere: if one does, this node is not done.",
         out_of_scope: "Semantic primitive identity, which stays with the identity join. Deleting the interpreter, which is downstream. Any widening of what counts as a primitive: this node changes who decides, not the population. Per-family enum split for bridge/native-intercept compile-time exhaustiveness is follow-up, not a blocker for this node's narrowed bar.",
         handback: "The generated identity and lookup; site-scoped exhaustive handler match — compile-time refusal on single-family sites (witnessed in interpreter_dispatch_authority.rs), runtime unreachable! backstop on bridge/native-intercept with per-family enum split named as follow-up; deletion of the R0 macro authorities, the roster functions and the interpreter_dispatch_arm_rows self-reading bridge; a stated disposition for each of the two declared R0 residual rows -- either moved into the authority or retained with its own independently justified non-primitive reason; and the hand-Rust line delta the inversion removes."
       ), on: "2026-09-30", note: "Awaiting the operator's acceptance event: v1_interpreter_primitive_dispatch_authority_acceptance_contract_holds (dag/test/claim/v1_interpreter_primitive_dispatch_authority_acceptance_test.dag); evidence #7682.")),
@@ -2247,7 +2247,7 @@ fn declared_roadmap_nodes() -> List<RoadmapNode> {
       carriers: carrier(path: "dag/gunbc/rung_drop.dag"),
       line: ticket(t: level_fields(
           headline: "DP-M6: v2 native-route walls restored",
-          boundary: "The native-route rung drops retired and the eval-step drop family shrunk. The three drops the census names (g0_type_decl_modifier_parse_without_sealing_property, variant_fields_unlowered_on_the_native_route, admit_callers_discarded_on_the_native_route) exist on main and not on this line, so this milestone's population is re-derived from gunbc.rung_drop once the line carries them.",
+          boundary: "The native-route rung drops retired and the eval-step drop family shrunk. The three drops the census names (g0_type_decl_modifier_parse_without_sealing_property, variant_fields_unlowered_on_the_native_route, admit_callers_discarded_on_the_native_route) existed on main and not on this line. admit_callers_discarded_on_the_native_route is now retired by its own trigger -- the native route checks caller admission from the fn's declared admit_callers list, with the Arrow carrier and its consumer landing together (v2.compiler body_lowering_fold body_lower_fn_admit_clause_edges; v2.compiler.infer infer_caller_admission_diags) -- so it no longer counts. The other two remain, re-derived from gunbc.rung_drop once the line carries them.",
           approach: "Re-derive the population from gunbc.rung_drop, then one drop per change with its RED fixture and positive control.",
           red_control: "A drop retired without its restoration capability executing keeps this open (§4b(3)).",
           displaced_cost: "Each standing drop is a known wall down on the path v2 is meant to run on.",
diff --git a/dag/gunbc/roadmap/roadmap_belt_actuate.dag b/dag/gunbc/roadmap/roadmap_belt_actuate.dag
index 8c448be6fd5..d25091181cf 100644
--- a/dag/gunbc/roadmap/roadmap_belt_actuate.dag
+++ b/dag/gunbc/roadmap/roadmap_belt_actuate.dag
@@ -9,10 +9,11 @@ import gunbc.roadmap_nesting { roadmap_memberships }
 import std.algebra { trim }
 
 import gunbc.output_policy { OutcomeIsData }
-import std.types { String, Int, Bool, List, NonEmptyStr, FilePath, CommitSha, GitRef }
+import std.types { String, Int, Bool, List, NonEmptyStr, FilePath, CommitSha, GitRef, EpochSecs }
 import gunbc.roadmap_attempt_metering {
   MeteringPersist, MeteringPersisted, MeteringAlreadyFinal, MeteringNotDue, MeteringPersistRefused, metering_persist_for_attempt,
   RosterAdmitted, RosterAdmissionRefused, MeteredReviewer, MeteredAuditor, MeteredSupervisor, metering_roster_admit,
+  MeteredRole, metered_role_eq, metering_roster_for_attempt, metering_roster_launches, RosterRefused,
   MeteredAttemptsObserved, MeteredAttemptsRefused, metering_attempt_index, metering_attempt_index_admit,
 }
 import gunbc.roadmap_model { RoadmapNode, RoadmapNodeId, node_criteria_digest, node_sizing_derivation }
@@ -223,6 +224,9 @@ import gunbc.worker_lifecycle {
 }
 import gunbc.dispatch_selection { default_provider_selection_request, SizingProfileExpectation, NoDerivedSizingExpectation, sizing_profile_expectation }
 import gunbc.host_layout { srv1_gunbc_repo_root, belt_spawn_workdir_env_var, instance_receipts_dir }
+import extdeps.systemd.systemd_run { systemd_run_user_transient_command, SystemdRunProperty, SystemdSetenvBinding, SystemdRunCommandReading, SystemdRunCommandReady, SystemdRunCommandRefused }
+import extdeps.systemd { ExecStopPostProperty, WorkingDirectoryProperty, RuntimeMaxSecProperty, CollectModeProperty, MemoryMax, systemd_time_span_of_seconds }
+import std.measure { byte_size_count }
 import gunbc.deploy_transition {
   ActuationAdmission,
   ActuationAdmitted,
@@ -435,7 +439,7 @@ import gunbc.scm.object_store {
   PathUniqueManifestEntries,
   path_unique_of_record, path_unique_with_path_bound, path_unique_with_path_removed,
   store_path_unique_manifest, UniqueManifestStored, UniqueManifestLocatorCollision,
-  find_object, store_rostered_lookup, scm_object_identity, authored_source_object, path_unique_manifest_identity,
+  find_object, ObjectId, store_rostered_lookup, scm_object_identity, authored_source_object, path_unique_manifest_identity,
   CorpusManifestRecord, authored_source_target_locator, object_id_eq, CorpusManifestTarget,
 }
 import gunbc.scm.intake { IntakeRevision, GitIntakeRevision, IntakeNone, IntakeBase, IntakeAdvance, IntakeStaleCapture, IntakeUnrecordedByFormat, intake_revision_eq, encode_commit_intake, CaptureWork, CommitWork, NoWork, WorkCapture, WorkUnrecordedByFormat, encode_commit_work }
@@ -550,7 +554,33 @@ import std.content_hash {
   content_hash_combine_structural,
   as_content_hash_structural,
 }
+import gunbc.roadmap.roadmap_belt_obligation {
+  BeltAttemptObligationKind, CaptureObligation, VerifyObligation, ReviewObligation, AuditObligation, PublishObligation,
+  belt_attempt_obligation_order, belt_attempt_obligation_outstanding, belt_attempt_obligation_kind_key, belt_attempt_outstanding,
+  BeltInstanceObligationKind, belt_instance_obligation_kinds, belt_record_moved_obligation_kinds, belt_instance_obligation_kind_key, LaunchObligation,
+  belt_attempt_obligation_unit_name, belt_instance_obligation_unit_name, belt_discovery_attempt_bound,
+  BeltObligationEnqueue, BeltObligationStarted, BeltObligationHeld, BeltObligationEnqueueRefused,
+}
+import gunbc.roadmap.roadmap_attempt_exit_spool {
+  AttemptUnitRole, AttemptReviewerRole, AttemptAuditorRole,
+  attempt_exit_hook, AttemptExitHookRendered, AttemptExitHookRefused, AttemptObligationRole,
+  attempt_exit_record_observe, AttemptExitRecordNone, AttemptExitRecordFound, AttemptExitRecordUnreadable,
+  AttemptWorkerRole, attempt_unit_role_token,
+  attempt_exit_entry_decode, AttemptExitEntryDecoded, AttemptExitEntryMalformed,
+  AttemptExitSpoolStage, AttemptExitInbox, AttemptExitQueued, AttemptExitRunning, AttemptExitDone, AttemptExitRefused,
+  attempt_exit_spool_stage_dir, attempt_exit_stage_list, AttemptExitStageNames, AttemptExitStageUnreadable,
+}
+import extdeps.tools.gnu_coreutils { mv_exact_destination_command }
+import extdeps.tools.stat { stat_mtime_epoch_command }
+import gunbc.live_deploy.belt_cadence { belt_tick_run_bound }
+import gunbc.actions_run_binding { json_required_string_member, JsonStringMemberFound, JsonStringMemberRefused }
+import gunbc.roadmap_dispatch_actuator {
+  AttemptUnitStartStanding, AttemptUnitStartRecorded, AttemptUnitNeverStarted, AttemptUnitStartUnread,
+  attempt_worker_unit_observation_of,
+  AttemptUnitObservation, AttemptUnitAbsent, AttemptUnitActive, AttemptUnitFinished, AttemptUnitUnreadable,
+}
 import gunbc.roadmap_session_placement {
+  attempt_worker_unit_observe_for_instance,
   SessionPlacementGrant, SessionPlacementStores, SessionStoresResolution, SessionStoresResolved, SessionStoresUnresolved, session_placement_stores,
   session_placement_acquire, SessionPlacementGranted, SessionPlacementRefused,
   session_placement_begin_launch, SessionLaunchAdmitted, SessionLaunchRefused, session_placement_abandon,
@@ -3492,10 +3522,7 @@ type BeltTickReceipt {
   launches: List<LaunchIdentity>,
   spawn_pass: BeltPassOutcome,
   teardown_pass: BeltPassOutcome,
-  commit_pass: BeltPassOutcome,
-  verify_pass: BeltPassOutcome,
-  publish_pass: BeltPassOutcome,
-  metering_pass: BeltPassOutcome,
+  discovery_pass: BeltPassOutcome,
 }
 
 type BeltTickReceiptRead
@@ -3518,7 +3545,11 @@ type BeltTickReceiptRead
 // DispatchStateHostShared, so blue and green resolve it to ONE path and a receipt there would
 // answer for two instances. A note describing a home the implementation did not and could not
 // safely use is the stale-authority class of DESIGN section 3.
-data belt_tick_receipt_schema: String = "roadmap-belt-tick-receipt/v6"
+// v7 (dogfood intervention #6): the tick no longer captures, verifies, publishes or meters, so it no
+// longer reports those passes. It reports the passes it still runs -- spawn and teardown -- and the
+// discovery pass that hands outstanding obligations to their units. What each attempt's obligations
+// did is that attempt's own receipt (belt_attempt_obligation_receipt_path).
+data belt_tick_receipt_schema: String = "roadmap-belt-tick-receipt/v7"
 
 // THE RECEIPT HAD NO WRITABLE HOME AND HAS NEVER BEEN WRITTEN ON ANY INSTANCE. The path was
 // <instance_root>/belt-last-tick.json; every instance_root on srv1 is root:root 0755 while the belt
@@ -3529,7 +3560,7 @@ data belt_tick_receipt_schema: String = "roadmap-belt-tick-receipt/v6"
 //
 // The fix is a home the service principal owns, not an elevation at write time: the instance's
 // receipts directory, bootstrapped by the deploy through the granted install -d -o <service-user>
-// (live_deploy.emit BeltTimerUnit apply) — the mechanism and reasoning
+// (live_deploy.emit BeltEventPathUnit apply) — the mechanism and reasoning
 // fleet_converge_receipt_atomic_publish_note records for the converge receipt beside it.
 //
 // NOT the dispatch attempt-state root, though service-user-owned and closer-looking: the srv1 pair
@@ -3648,97 +3679,67 @@ fn belt_tick_receipt_decode(raw: String) -> BeltTickReceiptRead {
             BeltTickReceiptUnreadable { reason: "belt tick receipt schema is unknown" }
           } else {
             match json_object_unique_member(v: doc, key: "observed_at") {
-              JsonMemberFound { value: JsonString { value: observed_at } } =>
-                match belt_pass_outcome_from_member(doc: doc, key: "spawn_pass") {
-                  BeltPassOutcomeUnreadable { reason: r } =>
-                    BeltTickReceiptUnreadable { reason: r }
-                  BeltPassOutcomeDecoded { outcome: spawn_pass } =>
-                    match belt_pass_outcome_from_member(doc: doc, key: "teardown_pass") {
-                      BeltPassOutcomeUnreadable { reason: r } =>
-                        BeltTickReceiptUnreadable { reason: r }
-                      BeltPassOutcomeDecoded { outcome: teardown_pass } =>
-                        match belt_pass_outcome_from_member(doc: doc, key: "commit_pass") {
-                          BeltPassOutcomeUnreadable { reason: r } =>
-                            BeltTickReceiptUnreadable { reason: r }
-                          BeltPassOutcomeDecoded { outcome: commit_pass } =>
-                            match belt_pass_outcome_from_member(doc: doc, key: "verify_pass") {
-                          BeltPassOutcomeUnreadable { reason: r } =>
-                            BeltTickReceiptUnreadable { reason: r }
-                          BeltPassOutcomeDecoded { outcome: verify_pass } =>
-                            match belt_pass_outcome_from_member(doc: doc, key: "publish_pass") {
-                              BeltPassOutcomeUnreadable { reason: r } =>
-                                BeltTickReceiptUnreadable { reason: r }
-                              BeltPassOutcomeDecoded { outcome: publish_pass } =>
-                                match belt_tick_launches_from_member(doc: doc) {
-                                  BeltTickLaunchesUnreadable { reason: r } =>
-                                    BeltTickReceiptUnreadable { reason: r }
-                                  BeltTickLaunchesDecoded { launches } =>
-                                    match belt_tick_execution_from_member(doc: doc) {
-                                      BeltTickExecutionUnreadable { reason: r } =>
-                                        BeltTickReceiptUnreadable { reason: r }
-                                      BeltTickExecutionDecoded { execution } => {
-  match belt_pass_outcome_from_member(doc: doc, key: "metering_pass") {
-    BeltPassOutcomeUnreadable { reason: r } => BeltTickReceiptUnreadable { reason: r }
-    BeltPassOutcomeDecoded { outcome: metering_pass } => {
-                                        let receipt = BeltTickReceipt {
-                                          observed_at: observed_at,
-                                          execution: execution,
-                                          launches: launches,
-                                          spawn_pass: spawn_pass,
-                                          teardown_pass: teardown_pass,
-                                          commit_pass: commit_pass,
-                                          verify_pass: verify_pass,
-                                          publish_pass: publish_pass,
-                                          metering_pass: metering_pass,
-                                        }
-                                        match json_object_unique_member(v: doc, key: "receipt_identity") {
-                                          JsonMemberFound { value: JsonString { value: claimed } } =>
-                                            if claimed != belt_tick_receipt_identity_hex(receipt: receipt) {
-                                              BeltTickReceiptUnreadable { reason: "belt tick receipt identity does not match its members" }
-                                            } else {
-                                              BeltTickReceiptPresent { receipt: receipt }
-                                            }
-                                          JsonMemberFound { value: _ } =>
-                                            BeltTickReceiptUnreadable { reason: "belt tick receipt receipt_identity is missing" }
-                                          JsonMemberAbsent =>
-                                            BeltTickReceiptUnreadable { reason: "belt tick receipt receipt_identity is missing" }
-                                          JsonMemberDuplicated { count: _ } =>
-                                            BeltTickReceiptUnreadable { reason: "belt tick receipt receipt_identity is missing" }
-                                          JsonMemberNotAnObject =>
-                                            BeltTickReceiptUnreadable { reason: "belt tick receipt receipt_identity is missing" }
-                                        }
-                                      }
+              JsonMemberFound { value: JsonString { value: observed_at } } => belt_tick_receipt_decode_passes(doc: doc, observed_at: observed_at)
+              JsonMemberFound { value: _ } => BeltTickReceiptUnreadable { reason: "belt tick receipt observed_at is missing" }
+              JsonMemberAbsent => BeltTickReceiptUnreadable { reason: "belt tick receipt observed_at is missing" }
+              JsonMemberDuplicated { count: _ } => BeltTickReceiptUnreadable { reason: "belt tick receipt observed_at is missing" }
+              JsonMemberNotAnObject => BeltTickReceiptUnreadable { reason: "belt tick receipt observed_at is missing" }
+            }
+          }
+        JsonMemberFound { value: _ } => BeltTickReceiptUnreadable { reason: "belt tick receipt schema is missing" }
+        JsonMemberAbsent => BeltTickReceiptUnreadable { reason: "belt tick receipt schema is missing" }
+        JsonMemberDuplicated { count: _ } => BeltTickReceiptUnreadable { reason: "belt tick receipt schema is missing" }
+        JsonMemberNotAnObject => BeltTickReceiptUnreadable { reason: "belt tick receipt schema is missing" }
+      }
   }
 }
-                                    }
-                                }
-                            }
-                        }
-                        }
-                    }
-                }
-              JsonMemberFound { value: _ } =>
-                BeltTickReceiptUnreadable { reason: "belt tick receipt observed_at is missing" }
-              JsonMemberAbsent =>
-                BeltTickReceiptUnreadable { reason: "belt tick receipt observed_at is missing" }
-              JsonMemberDuplicated { count: _ } =>
-                BeltTickReceiptUnreadable { reason: "belt tick receipt observed_at is missing" }
-              JsonMemberNotAnObject =>
-                BeltTickReceiptUnreadable { reason: "belt tick receipt observed_at is missing" }
-            }
+
+fn belt_tick_receipt_decode_passes(doc: JsonValue, observed_at: String) -> BeltTickReceiptRead {
+  match belt_pass_outcome_from_member(doc: doc, key: "spawn_pass") {
+    BeltPassOutcomeUnreadable { reason: r } => BeltTickReceiptUnreadable { reason: r }
+    BeltPassOutcomeDecoded { outcome: spawn_pass } =>
+      match belt_pass_outcome_from_member(doc: doc, key: "teardown_pass") {
+        BeltPassOutcomeUnreadable { reason: r } => BeltTickReceiptUnreadable { reason: r }
+        BeltPassOutcomeDecoded { outcome: teardown_pass } =>
+          match belt_pass_outcome_from_member(doc: doc, key: "discovery_pass") {
+            BeltPassOutcomeUnreadable { reason: r } => BeltTickReceiptUnreadable { reason: r }
+            BeltPassOutcomeDecoded { outcome: discovery_pass } =>
+              match belt_tick_launches_from_member(doc: doc) {
+                BeltTickLaunchesUnreadable { reason: r } => BeltTickReceiptUnreadable { reason: r }
+                BeltTickLaunchesDecoded { launches } =>
+                  match belt_tick_execution_from_member(doc: doc) {
+                    BeltTickExecutionUnreadable { reason: r } => BeltTickReceiptUnreadable { reason: r }
+                    BeltTickExecutionDecoded { execution } =>
+                      belt_tick_receipt_with_identity(doc: doc, receipt: BeltTickReceipt {
+                        observed_at: observed_at,
+                        execution: execution,
+                        launches: launches,
+                        spawn_pass: spawn_pass,
+                        teardown_pass: teardown_pass,
+                        discovery_pass: discovery_pass,
+                      })
+                  }
+              }
           }
-        JsonMemberFound { value: _ } =>
-          BeltTickReceiptUnreadable { reason: "belt tick receipt schema is missing" }
-        JsonMemberAbsent =>
-          BeltTickReceiptUnreadable { reason: "belt tick receipt schema is missing" }
-        JsonMemberDuplicated { count: _ } =>
-          BeltTickReceiptUnreadable { reason: "belt tick receipt schema is missing" }
-        JsonMemberNotAnObject =>
-          BeltTickReceiptUnreadable { reason: "belt tick receipt schema is missing" }
       }
   }
 }
 
+fn belt_tick_receipt_with_identity(doc: JsonValue, receipt: BeltTickReceipt) -> BeltTickReceiptRead {
+  match json_object_unique_member(v: doc, key: "receipt_identity") {
+    JsonMemberFound { value: JsonString { value: claimed } } =>
+      if claimed != belt_tick_receipt_identity_hex(receipt: receipt) {
+        BeltTickReceiptUnreadable { reason: "belt tick receipt identity does not match its members" }
+      } else {
+        BeltTickReceiptPresent { receipt: receipt }
+      }
+    JsonMemberFound { value: _ } => BeltTickReceiptUnreadable { reason: "belt tick receipt receipt_identity is missing" }
+    JsonMemberAbsent => BeltTickReceiptUnreadable { reason: "belt tick receipt receipt_identity is missing" }
+    JsonMemberDuplicated { count: _ } => BeltTickReceiptUnreadable { reason: "belt tick receipt receipt_identity is missing" }
+    JsonMemberNotAnObject => BeltTickReceiptUnreadable { reason: "belt tick receipt receipt_identity is missing" }
+  }
+}
+
 type BeltTickLaunchesDecode
   = BeltTickLaunchesDecoded { launches: List<LaunchIdentity> }
   | BeltTickLaunchesUnreadable { reason: String }
@@ -3849,10 +3850,7 @@ fn belt_tick_receipt_identity_text(receipt: BeltTickReceipt) -> String {
     join(receipt.launches |> map(l => serialize_json(v: launch_identity_json(id: l))), ","), "|",
     belt_pass_outcome_key(o: receipt.spawn_pass), "|",
     belt_pass_outcome_key(o: receipt.teardown_pass), "|",
-    belt_pass_outcome_key(o: receipt.commit_pass), "|",
-    belt_pass_outcome_key(o: receipt.verify_pass), "|",
-    belt_pass_outcome_key(o: receipt.publish_pass), "|",
-    belt_pass_outcome_key(o: receipt.metering_pass),
+    belt_pass_outcome_key(o: receipt.discovery_pass),
   ], "")
 }
 
@@ -3933,10 +3931,7 @@ fn belt_tick_receipt_json_value(receipt: BeltTickReceipt) -> JsonValue {
     json_kv(key: "launches", value: json_array(elements: receipt.launches |> map(l => launch_identity_json(id: l)))),
     json_kv(key: "spawn_pass", value: belt_pass_outcome_json(o: receipt.spawn_pass)),
     json_kv(key: "teardown_pass", value: belt_pass_outcome_json(o: receipt.teardown_pass)),
-    json_kv(key: "commit_pass", value: belt_pass_outcome_json(o: receipt.commit_pass)),
-    json_kv(key: "verify_pass", value: belt_pass_outcome_json(o: receipt.verify_pass)),
-    json_kv(key: "publish_pass", value: belt_pass_outcome_json(o: receipt.publish_pass)),
-    json_kv(key: "metering_pass", value: belt_pass_outcome_json(o: receipt.metering_pass)),
+    json_kv(key: "discovery_pass", value: belt_pass_outcome_json(o: receipt.discovery_pass)),
   ])
 }
 
@@ -4068,12 +4063,7 @@ type BeltTickResult {
   reconcile: BeltReconcile,
   spawn_outcomes: List<BeltSpawnOutcome>,
   teardown_outcomes: List<BeltTeardownOutcome>,
-  commit_outcomes: List<BeltCommitOutcome>,
-  verify_outcomes: List<BeltVerifyOutcome>,
-  publish_outcomes: List<BeltPublishOutcome>,
-  review_outcomes: List<BeltReviewOutcome>,
-  audit_outcomes: List<BeltReviewOutcome>,
-  metering_outcomes: List<MeteringPersist>,
+  discovery: BeltDiscovery,
 }
 
 fn belt_tick_empty_reconcile(state: SpawnMode) -> BeltReconcile {
@@ -4376,32 +4366,17 @@ fn belt_tick_for_instance(
         reconcile: pass.reconcile,
         spawn_outcomes: spawn_outcomes,
         teardown_outcomes: teardown_outcomes,
-        commit_outcomes: [],
-        verify_outcomes: [],
-        publish_outcomes: [],
-        review_outcomes: [],
-        audit_outcomes: [],
-        metering_outcomes: [],
-      }
-    TickPassesRun => {
-      let commit_outcomes = belt_commit_attempts_for_instance(instance: instance)
-      let verify_outcomes = belt_verify_attempts_after_commit(instance: instance, committed: commit_outcomes)
-      let review_outcomes = belt_review_attempts_after_verify(instance: instance, verified: verify_outcomes)
-      let audit_outcomes = belt_audit_attempts_after_verify(instance: instance, verified: verify_outcomes)
+        discovery: BeltDiscoveryRefused { reason: launch_refusal_reason(r: refusal) },
+      }
+    TickPassesRun =>
       BeltTickResult {
         host_refusal: pass.host_refusal,
         wholesale: TickPassesRun,
         reconcile: pass.reconcile,
         spawn_outcomes: spawn_outcomes,
         teardown_outcomes: teardown_outcomes,
-        commit_outcomes: commit_outcomes,
-        verify_outcomes: verify_outcomes,
-        publish_outcomes: belt_publish_attempts_for_instance(instance: instance),
-        review_outcomes: review_outcomes,
-        audit_outcomes: audit_outcomes,
-        metering_outcomes: belt_metering_attempts_for_instance(instance: instance),
+        discovery: belt_discover_for_instance(instance: instance),
       }
-    }
   }
 }
 
@@ -4618,33 +4593,23 @@ fn belt_tick_teardown_ok_count(t: BeltTickResult) -> Int {
 // instance; its serialization) — `gunbc run` rejects both return types. The tick observes live
 // sessions before actuating planned spawns and teardowns through the provider
 // dispatch_actuator_selection resolves (a refused selection is a typed SpawnFailed at step
-// dispatch-selection, never a defaulted provider), then verifies and publishes attempts on their
-// independent evidence authorities. Idempotent: a spawned session is observed live next tick and
-// reconciles to noop.
+// dispatch-selection, never a defaulted provider), then DISCOVERS which attempts owe an obligation and
+// hands each to its own unit (belt_discover_for_instance) -- it no longer captures, verifies, reviews
+// or publishes anything itself (dogfood intervention #6). Idempotent: a spawned session is observed
+// live next tick and reconciles to noop, and a queued obligation whose unit is loaded is held.
 fn belt_run_once_in(
   instance: HostDashboardInstance,
   spawn_workdir: String,
 ) -> BeltTickResult {
   match roadmap_authority_projection(history: roadmap_acceptance_event_history_load()) {
     RoadmapAuthorityProjectionRefused { detail: detail } =>
-      {
-        let commit_outcomes = belt_commit_attempts_for_instance(instance: instance)
-        let verify_outcomes = belt_verify_attempts_after_commit(instance: instance, committed: commit_outcomes)
-        let review_outcomes = belt_review_attempts_after_verify(instance: instance, verified: verify_outcomes)
-        let audit_outcomes = belt_audit_attempts_after_verify(instance: instance, verified: verify_outcomes)
-        BeltTickResult {
-          host_refusal: Present { value: LaunchAuthorityUnobserved { detail: detail } },
-          wholesale: TickPassesRun,
-          reconcile: belt_tick_empty_reconcile(state: roadmap_belt_production_spawn_mode),
-          spawn_outcomes: [],
-          teardown_outcomes: [],
-          commit_outcomes: commit_outcomes,
-          verify_outcomes: verify_outcomes,
-          publish_outcomes: belt_publish_attempts_for_instance(instance: instance),
-          review_outcomes: review_outcomes,
-          audit_outcomes: audit_outcomes,
-          metering_outcomes: belt_metering_attempts_for_instance(instance: instance),
-        }
+      BeltTickResult {
+        host_refusal: Present { value: LaunchAuthorityUnobserved { detail: detail } },
+        wholesale: TickPassesRun,
+        reconcile: belt_tick_empty_reconcile(state: roadmap_belt_production_spawn_mode),
+        spawn_outcomes: [],
+        teardown_outcomes: [],
+        discovery: belt_discover_for_instance(instance: instance),
       }
     RoadmapAuthorityProjected { doc: doc, accepted: _, withheld: _ } =>
       belt_tick_for_instance(
@@ -4734,13 +4699,7 @@ fn belt_tick_result_json_value(t: BeltTickResult) -> JsonValue {
     json_kv(key: "reaped", value: json_int(n: belt_tick_teardown_ok_count(t: t))),
     json_kv(key: "spawn_outcomes", value: json_array(elements: t.spawn_outcomes |> map(o => belt_spawn_outcome_json(o: o)))),
     json_kv(key: "teardown_outcomes", value: json_array(elements: t.teardown_outcomes |> map(o => belt_teardown_outcome_json(o: o)))),
-    json_kv(key: "verified", value: json_int(n: belt_tick_verify_recorded_count(t: t))),
-    json_kv(key: "verify_outcomes", value: json_array(elements: t.verify_outcomes |> map(o => belt_verify_outcome_json(o: o)))),
-    json_kv(key: "commit_poisoned", value: json_int(n: belt_tick_commit_poisoned_count(t: t))),
-    json_kv(key: "commit_outcomes", value: json_array(elements: t.commit_outcomes |> map(o => belt_commit_outcome_json_value(o: o)))),
-    json_kv(key: "publish_outcomes", value: json_array(elements: t.publish_outcomes |> map(o => belt_publish_outcome_json_value(o: o)))),
-    json_kv(key: "review_outcomes", value: json_array(elements: t.review_outcomes |> map(o => belt_review_outcome_json(o: o)))),
-    json_kv(key: "audit_outcomes", value: json_array(elements: t.audit_outcomes |> map(o => belt_review_outcome_json(o: o)))),
+    json_kv(key: "discovery", value: belt_discovery_json(discovery: t.discovery)),
   ])
 }
 
@@ -4780,46 +4739,6 @@ fn belt_verify_outcome_json(o: BeltVerifyOutcome) -> JsonValue {
   }
 }
 
-// A POISONED CAPTURE IS COUNTED BESIDE ITS SIBLINGS' VERDICTS, never instead of them: the number
-// is how many attempts this tick classified capture-poisoned (durable refusal, see
-// BeltScmCapture), the row a human repairs against. Like the verify counts below, the number is
-// the obligation's frequency, not a quality metric.
-fn belt_tick_commit_poisoned_count(t: BeltTickResult) -> Int {
-  count(t.commit_outcomes |> filter(o => match o {
-    CommitCapturePoisoned { node_id: _, detail: _ } => true
-    CommitRecorded { node_id: _, message: _ } => false
-    CandidateCaptured { node_id: _, head_sha: _, message: _ } => false
-    CommitSkipped { node_id: _, reason: _ } => false
-    CommitFailed { node_id: _, detail: _ } => false
-    CommitDeferred { node_id: _, reason: _ } => false
-    CommitSubjectUnaddressable { node_id: _, reason: _ } => false
-  }))
-}
-
-// The tick counts verdicts RECORDED, never verdicts passed: four refusals recorded is the job done
-// as well as four passes — the obligation is the receipt, not a green — and counting passes would
-// turn the receipt into a quality metric that invites wanting fewer refusals. Write failures are
-// counted separately: they are the belt failing, not the validation.
-fn belt_tick_verify_recorded_count(t: BeltTickResult) -> Int {
-  count(t.verify_outcomes |> filter(o => match o {
-    VerifyRecorded { node_id: _, verdict_key: _, detail: _ } => true
-    VerifyDeferred { node_id: _, reason: _ } => false
-    VerifyWriteFailed { node_id: _, detail: _ } => false
-    VerifyEvidenceUnreadable { node_id: _, detail: _ } => false
-    VerifyRefused { node_id: _, cause: _ } => false
-  }))
-}
-
-fn belt_tick_verify_write_failed_count(t: BeltTickResult) -> Int {
-  count(t.verify_outcomes |> filter(o => match o {
-    VerifyWriteFailed { node_id: _, detail: _ } => true
-    VerifyEvidenceUnreadable { node_id: _, detail: _ } => true
-    VerifyRecorded { node_id: _, verdict_key: _, detail: _ } => false
-    VerifyDeferred { node_id: _, reason: _ } => false
-    VerifyRefused { node_id: _, cause: _ } => false
-  }))
-}
-
 type BeltAttempts
   = AttemptsObserved { attempts: List<DispatchAttemptRef> }
   | AttemptsRefused { reason: String }
@@ -5350,9 +5269,12 @@ fn belt_attempt_occurrences_observe_for_instance(instance: HostDashboardInstance
 //
 // The order is pane-then-unit only because the pane observation is already in hand; it is not a
 // preference between them. A vendor attempt whose pane is genuinely gone asks the manager, gets
-// not-found, and answers WorkerProcessAbsent exactly as before -- so this adds a population without
-// changing the answer for the one that already worked.
+// not-found, finds no exit record and no placement record, and answers WorkerProcessAbsent exactly as
+// before -- so this adds a population without changing the answer for the one that already worked. A
+// harness attempt whose unit has been collected is read from its exit record
+// (gunbc.roadmap_session_placement attempt_worker_unit_observe_for_instance).
 fn attempt_process_for_node(
+  instance: HostDashboardInstance,
   panes: BeltAttemptPanes,
   node_id: String,
   attempt_key: String,
@@ -5370,7 +5292,7 @@ fn attempt_process_for_node(
         Absent => {
           let unit = dispatch_attempt_unit_name(node_id: node_id, attempt_key: attempt_key)
           worker_process_from_attempt_unit(
-            observation: attempt_unit_observation(unit: unit),
+            observation: attempt_worker_unit_observe_for_instance(instance: instance, node_id: node_id, attempt_key: attempt_key),
             unit: unit,
           )
         }
@@ -5860,6 +5782,7 @@ fn belt_workflow_attempt_evidence_without_modeled_state(
     provider_events: "",
     provider_events_error: provider_events_error,
     process: attempt_process_for_node(
+      instance: instance,
       panes: panes,
       node_id: attempt.node_id,
       attempt_key: attempt.attempt_key,
@@ -6099,6 +6022,7 @@ fn belt_workflow_attempt_evidence_for_key(
       observation: events,
     ),
     process: attempt_process_for_node(
+      instance: instance,
       panes: panes,
       node_id: attempt.node_id,
       attempt_key: current_key,
@@ -6977,7 +6901,7 @@ fn belt_scm_base_advance(
       BaseAdvanceRefused { detail: belt_commit_exec_detail(step: "base-advance-diff", outcome: ExecRefused { program: program, reason: reason }) }
     ExecOk { stdout } => {
       let changes = worktree_changes_parse(stdout_nul: stdout)
-      match belt_scm_advance_texts(git_program: git_program, worktree: worktree, to_sha: to_sha, changes: changes) {
+      match belt_scm_advance_texts(git_program: git_program, worktree: worktree, to_sha: to_sha, changes: changes, step: "base-advance-file") {
         AdvanceTextsRefused { detail } => BaseAdvanceRefused { detail: detail }
         AdvanceTextsRead { texts } =>
           match materialize_objects(envelope_path: path, store: envelope.store, identities: [tip_root]) {
@@ -7021,7 +6945,7 @@ type BeltAdvanceTexts
   = AdvanceTextsRead { texts: Map<String, String> }
   | AdvanceTextsRefused { detail: String }
 
-fn belt_scm_advance_texts(git_program: String, worktree: String, to_sha: String, changes: List<WorktreeChange>) -> BeltAdvanceTexts {
+fn belt_scm_advance_texts(git_program: String, worktree: String, to_sha: String, changes: List<WorktreeChange>, step: String) -> BeltAdvanceTexts {
   fold(changes, init: AdvanceTextsRead { texts: empty_map() }, f: (acc, change) =>
     match acc {
       AdvanceTextsRefused { detail: _ } => acc
@@ -7032,9 +6956,9 @@ fn belt_scm_advance_texts(git_program: String, worktree: String, to_sha: String,
             match belt_exec(cmd: host_exec_argv(program: git_program, args: worktree_base_file_args(base_sha: to_sha, path: path as String)), workdir: worktree) {
               ExecOk { stdout } => AdvanceTextsRead { texts: map_insert(texts, path as String, stdout) }
               ExecFailed { program, exit_code, stderr } =>
-                AdvanceTextsRefused { detail: belt_commit_exec_detail(step: join(["base-advance-file ", path as String], ""), outcome: ExecFailed { program: program, exit_code: exit_code, stderr: stderr }) }
+                AdvanceTextsRefused { detail: belt_commit_exec_detail(step: join([step, " ", path as String], ""), outcome: ExecFailed { program: program, exit_code: exit_code, stderr: stderr }) }
               ExecRefused { program, reason } =>
-                AdvanceTextsRefused { detail: belt_commit_exec_detail(step: join(["base-advance-file ", path as String], ""), outcome: ExecRefused { program: program, reason: reason }) }
+                AdvanceTextsRefused { detail: belt_commit_exec_detail(step: join([step, " ", path as String], ""), outcome: ExecRefused { program: program, reason: reason }) }
             }
         }
     })
@@ -7043,7 +6967,7 @@ fn belt_scm_advance_texts(git_program: String, worktree: String, to_sha: String,
 // THE PURE RE-BINDING: the tip's entries with exactly `changes` applied, each bind to its text at
 // S_k+1. A bind whose text was not read is refused rather than skipped -- a skipped bind would leave
 // the tip's bytes at a path the diff says changed, which is the stale-base tree this exists to end.
-fn belt_scm_advance_fold(path: String, store: ObjectStore, tip_record: CorpusManifestRecord, changes: List<WorktreeChange>, texts: Map<String, String>) -> BeltDeltaFold {
+fn belt_scm_advance_fold(store: ObjectStore, tip_record: CorpusManifestRecord, changes: List<WorktreeChange>, texts: Map<String, String>) -> BeltDeltaFold {
   fold(changes, init: BeltDeltaFold { store: store, unique: path_unique_of_record(base: tip_record), refused: none }, f: (acc, change) =>
     match acc.refused {
       Present { value: _ } => acc
@@ -7055,7 +6979,7 @@ fn belt_scm_advance_fold(path: String, store: ObjectStore, tip_record: CorpusMan
             match map_get(texts, key: p as String) {
               Absent =>
                 BeltDeltaFold { store: acc.store, unique: acc.unique, refused: Present { value: join(["the advance's diff re-binds ", p as String, " but its bytes at the target revision were not read"], "") } }
-              Present { value: text } => belt_scm_delta_bind_text(path_of_envelope: path, acc: acc, path: p, text: text)
+              Present { value: text } => belt_scm_delta_bind_text(acc: acc, path: p, text: text)
             }
         }
     })
@@ -7071,7 +6995,7 @@ fn belt_scm_base_advance_mint(
   changes: List<WorktreeChange>,
   texts: Map<String, String>,
 ) -> BeltBaseAdvance {
-  let folded = belt_scm_advance_fold(path: path, store: envelope.store, tip_record: tip_record, changes: changes, texts: texts)
+  let folded = belt_scm_rebind_fold(path: path, store: envelope.store, base_record: tip_record, changes: changes, texts: texts)
   match folded.refused {
     Present { value: detail } => BaseAdvanceRefused { detail: detail }
     Absent =>
@@ -7269,19 +7193,17 @@ type BeltDeltaFold {
   refused: String?
 }
 
-// A RE-BOUND PATH WHOSE BYTES THE REPOSITORY ALREADY PERSISTS (a revert, a file restored to an
-// earlier content) is materialized before it is stored: the identity law refuses two contents under
-// one identity, and that comparison needs the one persisted object -- read from exactly its shard
-// (gunbc.scm.repository_load materialize_objects), never by decoding the repository. Bytes the
-// repository has never held need no read at all.
+// THE RE-BOUND BYTES THE REPOSITORY ALREADY PERSISTS (a revert, a file restored to an earlier
+// content) are materialized ONCE for the whole change population, before any bind: the identity law
+// refuses two contents under one identity, and that comparison needs the persisted object -- read
+// from exactly its shard (gunbc.scm.repository_load materialize_objects), never by decoding the
+// repository. The demand is derived from the texts, so every shard the population names is planned
+// and read once; a per-path demand re-read a shard for each of its members. Bytes the repository
+// has never held need no read at all.
 type BeltDeltaResident
   = DeltaResident { store: ObjectStore }
   | DeltaResidentRefused { detail: String }
 
-fn belt_scm_delta_resident_for(path: String, store: ObjectStore, text: String) -> BeltDeltaResident {
-  belt_delta_resident_of(outcome: materialize_if_rostered(envelope_path: path, store: store, identity: scm_object_identity(object: authored_source_object(text: text))))
-}
-
 fn belt_delta_resident_of(outcome: ObjectMaterialization) -> BeltDeltaResident {
   match outcome {
     ObjectMaterializationRefused { detail } => DeltaResidentRefused { detail: detail }
@@ -7289,43 +7211,76 @@ fn belt_delta_resident_of(outcome: ObjectMaterialization) -> BeltDeltaResident {
   }
 }
 
-fn belt_scm_delta_fold_step(
-  instance: HostDashboardInstance,
-  worktree: String,
-  path_of_envelope: String,
-  acc: BeltDeltaFold,
-  change: WorktreeChange,
-) -> BeltDeltaFold {
-  match acc.refused {
-    Present { value: _ } => acc
-    Absent =>
+fn belt_scm_rebound_identities(store: ObjectStore, changes: List<WorktreeChange>, texts: Map<String, String>) -> List<ObjectId> {
+  filter(
+    flat_map(changes, change =>
       match change {
-        WorktreeDelete { path } =>
-          BeltDeltaFold {
-            store: acc.store,
-            unique: path_unique_with_path_removed(unique: acc.unique, path: path),
-            refused: none,
-          }
-        WorktreeBind { path } => {
-          let read = Filesystem.Read(path: join([worktree, "/", path as String], ""))
-          match filesystem_read_outcome(content: read.content, success: read.success, error: read.error) {
-            FilesystemReadRefused { error } =>
-              BeltDeltaFold {
-                store: acc.store,
-                unique: acc.unique,
-                refused: Present {
-                  value: join([
-                    "the changed path ", path as String,
-                    " could not be read from the worktree (", error,
-                    "), so the tree cannot be captured whole",
-                  ], ""),
-                },
-              }
-            FilesystemReadSucceeded { content } =>
-              belt_scm_delta_bind_text(path_of_envelope: path_of_envelope, acc: acc, path: path, text: content)
+        WorktreeDelete { path: _ } => []
+        WorktreeBind { path } =>
+          match map_get(texts, key: path as String) {
+            Absent => []
+            Present { value: text } => [scm_object_identity(object: authored_source_object(text: text))]
           }
-        }
+      }),
+    identity => match store_rostered_lookup(store: store, identity: identity) {
+      Present { value: _ } => true
+      Absent => false
+    },
+  )
+}
+
+// THE RE-BINDING OF A CHANGE POPULATION OVER A BASE MANIFEST, shared by the tick, recapture and the
+// base advance: the bytes are read first (by the caller), the persisted objects they may shadow are
+// materialized once, and the fold is then pure.
+fn belt_scm_rebind_fold(path: String, store: ObjectStore, base_record: CorpusManifestRecord, changes: List<WorktreeChange>, texts: Map<String, String>) -> BeltDeltaFold {
+  match belt_delta_resident_of(outcome: materialize_objects(envelope_path: path, store: store, identities: belt_scm_rebound_identities(store: store, changes: changes, texts: texts))) {
+    DeltaResidentRefused { detail } =>
+      BeltDeltaFold {
+        store: store,
+        unique: path_unique_of_record(base: base_record),
+        refused: Present { value: join(["the changed paths re-bind bytes the repository already holds, and they could not be read back: ", detail], "") },
       }
+    DeltaResident { store: resident } =>
+      belt_scm_advance_fold(store: resident, tip_record: base_record, changes: changes, texts: texts)
+  }
+}
+
+// THE BYTES OF A TICK'S BOUND PATHS, read from the dirty worktree. A path that cannot be read is
+// this tick's I/O: the next tick reads again.
+fn belt_scm_worktree_texts(worktree: String, changes: List<WorktreeChange>) -> BeltAdvanceTexts {
+  fold(changes, init: AdvanceTextsRead { texts: empty_map() }, f: (acc, change) =>
+    match acc {
+      AdvanceTextsRefused { detail: _ } => acc
+      AdvanceTextsRead { texts } =>
+        match change {
+          WorktreeDelete { path: _ } => acc
+          WorktreeBind { path } => {
+            let read = Filesystem.Read(path: join([worktree, "/", path as String], ""))
+            match filesystem_read_outcome(content: read.content, success: read.success, error: read.error) {
+              FilesystemReadRefused { error } =>
+                AdvanceTextsRefused {
+                  detail: join(["the changed path ", path as String, " could not be read from the worktree (", error, "), so the tree cannot be captured whole"], ""),
+                }
+              FilesystemReadSucceeded { content } => AdvanceTextsRead { texts: map_insert(texts, path as String, content) }
+            }
+          }
+        }
+    })
+}
+
+// THE BYTES OF A CAPTURE'S BOUND PATHS: the committed revision's through the declared bridge for
+// recapture, the dirty worktree's for the tick.
+fn belt_scm_delta_texts(instance: HostDashboardInstance, worktree: String, committed_revision: String?, changes: List<WorktreeChange>) -> BeltAdvanceTexts {
+  match committed_revision {
+    Absent => belt_scm_worktree_texts(worktree: worktree, changes: changes)
+    Present { value: revision } =>
+      belt_scm_advance_texts(
+        git_program: dispatch_capability_program(environment: instance.execution_environment, cap: GitWorkspaceCapability),
+        worktree: worktree,
+        to_sha: revision,
+        changes: changes,
+        step: "recapture-file",
+      )
   }
 }
 
@@ -7333,18 +7288,8 @@ fn belt_scm_delta_fold_step(
 // the base advance (bytes read from the revision it advances to): the identity-law readback of a
 // re-bound persisted object, the store, and the path-unique re-binding are one rule, so they are one
 // function rather than two copies free to drift.
-fn belt_scm_delta_bind_text(path_of_envelope: String, acc: BeltDeltaFold, path: NonEmptyStr, text: String) -> BeltDeltaFold {
-  match belt_scm_delta_resident_for(path: path_of_envelope, store: acc.store, text: text) {
-    DeltaResidentRefused { detail } =>
-      BeltDeltaFold {
-        store: acc.store,
-        unique: acc.unique,
-        refused: Present {
-          value: join(["the changed path ", path as String, " re-binds bytes the repository already holds, and they could not be read back: ", detail], ""),
-        },
-      }
-    DeltaResident { store: resident } =>
-  match store_authored_source(store: resident, text: text) {
+fn belt_scm_delta_bind_text(acc: BeltDeltaFold, path: NonEmptyStr, text: String) -> BeltDeltaFold {
+  match store_authored_source(store: acc.store, text: text) {
     SourceLocatorCollision { identity: _, existing: _, incoming: _ } =>
       BeltDeltaFold {
         store: acc.store,
@@ -7367,62 +7312,6 @@ fn belt_scm_delta_bind_text(path_of_envelope: String, acc: BeltDeltaFold, path:
         refused: none,
       }
   }
-  }
-}
-
-// THE COMMITTED-TREE FOLD, for recapture: the same re-binding as the tick, with bytes read from the
-// committed revision through the declared bridge rather than from a dirty worktree. Deletes need no
-// read. A bind whose show fails is this observation's I/O, refused rather than guessed.
-fn belt_scm_delta_fold_step_at_revision(
-  instance: HostDashboardInstance,
-  worktree: String,
-  path_of_envelope: String,
-  revision: String,
-  acc: BeltDeltaFold,
-  change: WorktreeChange,
-) -> BeltDeltaFold {
-  match acc.refused {
-    Present { value: _ } => acc
-    Absent =>
-      match change {
-        WorktreeDelete { path } =>
-          BeltDeltaFold {
-            store: acc.store,
-            unique: path_unique_with_path_removed(unique: acc.unique, path: path),
-            refused: none,
-          }
-        WorktreeBind { path } =>
-          match belt_commit_git(
-            instance: instance,
-            worktree: worktree,
-            args: worktree_base_file_args(base_sha: revision, path: path as String),
-          ) {
-            ExecOk { stdout } => belt_scm_delta_bind_text(path_of_envelope: path_of_envelope, acc: acc, path: path, text: stdout)
-            ExecFailed { program, exit_code, stderr } =>
-              BeltDeltaFold {
-                store: acc.store,
-                unique: acc.unique,
-                refused: Present {
-                  value: belt_commit_exec_detail(
-                    step: join(["recapture-file ", path as String], ""),
-                    outcome: ExecFailed { program: program, exit_code: exit_code, stderr: stderr },
-                  ),
-                },
-              }
-            ExecRefused { program, reason } =>
-              BeltDeltaFold {
-                store: acc.store,
-                unique: acc.unique,
-                refused: Present {
-                  value: belt_commit_exec_detail(
-                    step: join(["recapture-file ", path as String], ""),
-                    outcome: ExecRefused { program: program, reason: reason },
-                  ),
-                },
-              }
-          }
-      }
-  }
 }
 
 // Two notes on the mint arms below, kept at declaration grain (the annotation channel admits no
@@ -7584,27 +7473,12 @@ fn belt_scm_delta_capture_over(
           match belt_scm_delta_changes(instance: instance, worktree: worktree, base_sha: base_sha, committed_revision: committed_revision) {
             DeltaChangesRefused { detail } => ScmCaptureMintRefused { detail: detail }
             DeltaChangesCollected { changes } => {
-                  let folded = fold(
-                    changes,
-                    init: BeltDeltaFold {
-                      store: seeded.store,
-                      unique: path_unique_of_record(base: base_record),
-                      refused: none,
-                    },
-                    f: (acc, change) =>
-                      match committed_revision {
-                        Absent => belt_scm_delta_fold_step(instance: instance, worktree: worktree, path_of_envelope: path, acc: acc, change: change)
-                        Present { value: revision } =>
-                          belt_scm_delta_fold_step_at_revision(
-                            instance: instance,
-                            worktree: worktree,
-                            path_of_envelope: path,
-                            revision: revision,
-                            acc: acc,
-                            change: change,
-                          )
-                      },
-                  )
+                  let folded = match belt_scm_delta_texts(instance: instance, worktree: worktree, committed_revision: committed_revision, changes: changes) {
+                    AdvanceTextsRefused { detail } =>
+                      BeltDeltaFold { store: seeded.store, unique: path_unique_of_record(base: base_record), refused: Present { value: detail } }
+                    AdvanceTextsRead { texts } =>
+                      belt_scm_rebind_fold(path: path, store: seeded.store, base_record: base_record, changes: changes, texts: texts)
+                  }
                   match folded.refused {
                     Present { value: detail } => ScmCaptureMintRefused { detail: detail }
                     Absent =>
@@ -8052,25 +7926,6 @@ fn belt_commit_outcome_json_value(o: BeltCommitOutcome) -> JsonValue {
   }
 }
 
-fn belt_commit_attempts_for_instance(
-  instance: HostDashboardInstance,
-) -> List<BeltCommitOutcome> {
-  match belt_workflow_attempts_observe_for_instance(instance: instance) {
-    WorkflowAttemptsRefused { reason } =>
-      [ CommitDeferred { node_id: "", reason: join(["the attempts ledger is unobservable, so no attempt can be committed: ", reason], "") } ]
-    WorkflowAttemptsObserved { attempts } =>
-      map(attempts, progress => belt_commit_attempt_for_instance(instance: instance, progress: progress))
-  }
-}
-
-fn belt_verify_attempts_after_commit(
-  instance: HostDashboardInstance,
-  committed: List<BeltCommitOutcome>,
-) -> List<BeltVerifyOutcome> {
-  let _commit_count = count(committed)
-  belt_verify_attempts_for_instance(instance: instance)
-}
-
 fn belt_commit_outcome_is_failure(o: BeltCommitOutcome) -> Bool {
   match o {
     CommitRecorded { node_id: _, message: _ } => false
@@ -9092,34 +8947,6 @@ fn belt_verify_run_and_persist(
   }
 }
 
-fn belt_verify_attempts_for_instance(
-  instance: HostDashboardInstance,
-) -> List<BeltVerifyOutcome> {
-  match belt_workflow_attempts_observe_for_instance(instance: instance) {
-    WorkflowAttemptsRefused { reason } =>
-      [
-        VerifyDeferred {
-          node_id: "",
-          reason: join([
-            "the attempts ledger is unobservable, so no attempt can be verified: ",
-            reason,
-          ], ""),
-        },
-      ]
-    WorkflowAttemptsObserved { attempts } =>
-      map(attempts, progress => belt_verify_attempt_for_instance(
-        instance: instance,
-        progress: progress,
-      ))
-  }
-}
-
-fn belt_verify_attempts() -> List<BeltVerifyOutcome> {
-  belt_verify_attempts_for_instance(
-    instance: srv1_live_dashboard_instance(),
-  )
-}
-
 // ------------------------------------------------------------------------------------------------
 // PER-ITEM OBLIGATIONS (owner ruling 2026-09-22, "The belt demoted"): the three expensive
 // obligations -- verify one candidate, convene one lineage's supervisor, integrate one verified
@@ -9475,22 +9302,14 @@ fn belt_workflow_attempt_presentation_json(
   belt_workflow_attempt_presentation_json_with_tick_read(
     progress: progress,
     tick_read: BeltTickReceiptAbsent,
-  )
-}
-
-fn belt_workflow_attempt_presentation_json_for_instance(
-  instance: HostDashboardInstance,
-  progress: WorkflowAttemptProgress,
-) -> JsonValue {
-  belt_workflow_attempt_presentation_json_with_tick_read(
-    progress: progress,
-    tick_read: belt_tick_receipt_read_for_instance(instance: instance),
+    obligation_read: BeltAttemptObligationReceiptAbsent,
   )
 }
 
 fn belt_workflow_attempt_presentation_json_with_tick_read(
   progress: WorkflowAttemptProgress,
   tick_read: BeltTickReceiptRead,
+  obligation_read: BeltAttemptObligationReceiptRead,
   stale_nodes: List<String> = [],
 ) -> JsonValue {
   json_object(members: concat(
@@ -9505,6 +9324,7 @@ fn belt_workflow_attempt_presentation_json_with_tick_read(
           s: belt_verification_presentation_detail(
             progress: progress,
             tick_read: tick_read,
+            obligation_read: obligation_read,
           ),
         ),
       ),
@@ -9566,6 +9386,7 @@ fn belt_workflow_attempts_json_value_for_instance(
             progress => belt_workflow_attempt_presentation_json_with_tick_read(
               progress: progress,
               tick_read: tick_read,
+              obligation_read: belt_attempt_obligation_receipt_read(instance: instance, node_id: progress.node_id, attempt_key: progress.attempt_key),
               stale_nodes: stale_nodes,
             ),
           )),
@@ -10847,27 +10668,20 @@ fn belt_audit_evidence(
     FilesystemFileObservationsDisagree { path: _, cause } => ReviewReceiptUnreadable { detail: cause }
     FilesystemFileSubjectRefused { directory: _, name: _, cause } => ReviewReceiptUnreadable { detail: cause }
   }
-  let unit = dispatch_audit_unit_name(node_id: node_id as String, attempt_key: attempt_key)
   [ CriterionReviewEvidence {
     criterion_key: goal_audit_criterion_key,
     source: source,
-    process: worker_process_from_attempt_unit(observation: attempt_unit_observation(unit: unit), unit: unit),
+    process: belt_launch_process(
+      instance: instance,
+      node_id: node_id as String,
+      attempt_key: attempt_key,
+      unit: dispatch_audit_unit_name(node_id: node_id as String, attempt_key: attempt_key),
+      role: AttemptAuditorRole { head_sha: head_sha },
+      metered: MeteredAuditor { head: head_sha as NonEmptyStr },
+    ),
   } ]
 }
 
-// THE AUDIT PASS: one auditor per verified head, spawned beside the reviewers on the same tick, with
-// the review's reconciliation so far in its brief. Same idempotence as the review pass: a recorded
-// verdict or a running unit skips; an exited unit without a verdict is a named failure, not respawned.
-fn belt_audit_attempts_after_verify(instance: HostDashboardInstance, verified: List<BeltVerifyOutcome>) -> List<BeltReviewOutcome> {
-  let _verify_count = count(verified)
-  match belt_workflow_attempts_observe_for_instance(instance: instance) {
-    WorkflowAttemptsRefused { reason } =>
-      [ ReviewDeferred { node_id: "", criterion: goal_audit_criterion_key, reason: join(["the attempts ledger is unobservable, so no attempt can be audited: ", reason], "") } ]
-    WorkflowAttemptsObserved { attempts } =>
-      map(attempts, progress => belt_audit_attempt_for_instance(instance: instance, progress: progress))
-  }
-}
-
 fn belt_audit_attempt_for_instance(instance: HostDashboardInstance, progress: WorkflowAttemptProgress) -> BeltReviewOutcome {
   match workflow_segment_of_kind(segments: progress.segments, kind: VerificationWorkflowSegment) {
     Absent => ReviewSkipped { node_id: progress.node_id, criterion: goal_audit_criterion_key, reason: "the attempt carries no verification segment" }
@@ -10942,10 +10756,13 @@ fn belt_audit_spawn(instance: HostDashboardInstance, progress: WorkflowAttemptPr
                 verdict_path: dispatch_attempt_audit_verdict_path_for_instance(instance: instance, node_id: node_id, attempt_key: progress.attempt_key, head_sha: head),
               )
               let unit = dispatch_audit_unit_name(node_id: progress.node_id, attempt_key: progress.attempt_key)
+              match attempt_exit_hook(instance_root: instance.instance_root as String, node_id: progress.node_id, attempt_key: progress.attempt_key, role: AttemptAuditorRole { head_sha: head }) {
+                AttemptExitHookRefused { reason } => ReviewFailed { node_id: progress.node_id, criterion: goal_audit_criterion_key, detail: join(["the auditor was not launched: its exit hook could not be rendered: ", reason as String], "") }
+                AttemptExitHookRendered { exec_line } =>
               match metering_roster_admit(instance: instance, node_id: node_id, attempt_key: progress.attempt_key, role: MeteredAuditor { head: head as NonEmptyStr }) {
                 RosterAdmissionRefused { cause: roster_cause } => ReviewFailed { node_id: progress.node_id, criterion: goal_audit_criterion_key, detail: join(["the auditor was not launched: ", roster_cause], "") }
                 RosterAdmitted =>
-              match dispatch_audit_unit_command(instance: instance, node_id: node_id, attempt_key: progress.attempt_key, worktree_path: worktree, brief: brief, head_sha: head) {
+              match dispatch_audit_unit_command(instance: instance, node_id: node_id, attempt_key: progress.attempt_key, worktree_path: worktree, brief: brief, head_sha: head, exit_hook: exec_line) {
                 SystemdRunCommandRefused { cause: why } =>
                   ReviewFailed { node_id: progress.node_id, criterion: goal_audit_criterion_key, detail: systemd_run_option_words_refused_cause_detail(cause: why) }
                 SystemdRunCommandReady { command: command } =>
@@ -10956,6 +10773,7 @@ fn belt_audit_spawn(instance: HostDashboardInstance, progress: WorkflowAttemptPr
                   }
               }
               }
+              }
             }
           }
         }
@@ -11030,7 +10848,7 @@ fn belt_review_observations(
       subject_id: review_subject_id(s: plan.subject),
       plan_revision: plan.revision,
       source: belt_review_receipt_source(instance: instance, node_id: node_id, attempt_key: attempt_key, head_sha: head_sha, criterion_key: key),
-      process: belt_review_process(node_id: node_id as String, attempt_key: attempt_key, criterion_key: key),
+      process: belt_review_process(instance: instance, node_id: node_id as String, attempt_key: attempt_key, criterion_key: key, head_sha: head_sha),
     }
   })
 }
@@ -11072,9 +10890,52 @@ fn belt_review_receipt_source(
   }
 }
 
-fn belt_review_process(node_id: String, attempt_key: String, criterion_key: String) -> WorkerProcessEvidence {
-  let unit = dispatch_review_unit_name(node_id: node_id, attempt_key: attempt_key, criterion_key: criterion_key)
-  worker_process_from_attempt_unit(observation: attempt_unit_observation(unit: unit), unit: unit)
+fn belt_review_process(instance: HostDashboardInstance, node_id: String, attempt_key: String, criterion_key: String, head_sha: String) -> WorkerProcessEvidence {
+  belt_launch_process(
+    instance: instance,
+    node_id: node_id,
+    attempt_key: attempt_key,
+    unit: dispatch_review_unit_name(node_id: node_id, attempt_key: attempt_key, criterion_key: criterion_key),
+    role: AttemptReviewerRole { criterion_key: criterion_key, head_sha: head_sha },
+    metered: MeteredReviewer { criterion_key: criterion_key as NonEmptyStr, head: head_sha as NonEmptyStr },
+  )
+}
+
+// A REVIEWER'S OR AUDITOR'S PROCESS, now that its unit is collected when it ends (the exit record
+// replaced RemainAfterExit, gunbc.roadmap_dispatch_actuator dispatch_review_unit_properties): the
+// manager while the unit is loaded, else the launch's exit record, else -- only when both are silent
+// -- whether the launch was ever admitted. The launch's START RECEIPT is its metering roster entry,
+// which belt_review_spawn and the audit spawn commit before the unit is started, so a launch with a
+// roster entry and no record is a hook that did not write (indeterminate, and never respawned), and
+// only a launch with no roster entry answers absent -- the arm on which the review pass spawns.
+fn belt_launch_process(instance: HostDashboardInstance, node_id: String, attempt_key: String, unit: NonEmptyStr, role: AttemptUnitRole, metered: MeteredRole) -> WorkerProcessEvidence {
+  let loaded = attempt_unit_observation(unit: unit)
+  let observation = match loaded {
+    AttemptUnitAbsent => {
+      let record = attempt_exit_record_observe(instance_root: instance.instance_root as String, node_id: node_id, attempt_key: attempt_key, role: role)
+      match record {
+        AttemptExitRecordNone =>
+          attempt_worker_unit_observation_of(unit: unit, loaded: loaded, record: record, start: belt_launch_start_standing(instance: instance, node_id: node_id, attempt_key: attempt_key, metered: metered))
+        AttemptExitRecordFound { record: _ } => attempt_worker_unit_observation_of(unit: unit, loaded: loaded, record: record, start: AttemptUnitStartRecorded)
+        AttemptExitRecordUnreadable { reason: _ } => attempt_worker_unit_observation_of(unit: unit, loaded: loaded, record: record, start: AttemptUnitStartRecorded)
+      }
+    }
+    AttemptUnitActive => loaded
+    AttemptUnitFinished { exit_status: _ } => loaded
+    AttemptUnitUnreadable { reason: _ } => loaded
+  }
+  worker_process_from_attempt_unit(observation: observation, unit: unit)
+}
+
+fn belt_launch_start_standing(instance: HostDashboardInstance, node_id: String, attempt_key: String, metered: MeteredRole) -> AttemptUnitStartStanding {
+  let roster = metering_roster_for_attempt(instance: instance, node_id: node_id as gunbc.roadmap_model.RoadmapNodeId, attempt_key: attempt_key)
+  match roster {
+    RosterRefused { cause } => AttemptUnitStartUnread { reason: join(["the launch roster could not be read: ", cause], "") }
+    RosterOpen { launches: _ } =>
+      if any(metering_roster_launches(roster: roster), r => metered_role_eq(a: r, b: metered)) { AttemptUnitStartRecorded } else { AttemptUnitNeverStarted }
+    RosterSealed { launches: _, digest: _ } =>
+      if any(metering_roster_launches(roster: roster), r => metered_role_eq(a: r, b: metered)) { AttemptUnitStartRecorded } else { AttemptUnitNeverStarted }
+  }
 }
 
 // THE REVIEW PASS: for every attempt whose verification passed and whose head has no verdict and no
@@ -11089,16 +10950,6 @@ type BeltReviewOutcome
   | ReviewFailed { node_id: String, criterion: String, detail: String }
   | ReviewPlanSuperseded { node_id: String, stale_verdicts: Int, revision: String }
 
-fn belt_review_attempts_after_verify(instance: HostDashboardInstance, verified: List<BeltVerifyOutcome>) -> List<BeltReviewOutcome> {
-  let _verify_count = count(verified)
-  match belt_workflow_attempts_observe_for_instance(instance: instance) {
-    WorkflowAttemptsRefused { reason } =>
-      [ ReviewDeferred { node_id: "", criterion: "", reason: join(["the attempts ledger is unobservable, so no attempt can be reviewed: ", reason], "") } ]
-    WorkflowAttemptsObserved { attempts } =>
-      attempts |> flat_map(progress => belt_review_attempt_for_instance(instance: instance, progress: progress))
-  }
-}
-
 fn belt_review_attempt_for_instance(instance: HostDashboardInstance, progress: WorkflowAttemptProgress) -> List<BeltReviewOutcome> {
   match workflow_segment_of_kind(segments: progress.segments, kind: VerificationWorkflowSegment) {
     Absent => [ ReviewSkipped { node_id: progress.node_id, criterion: "", reason: "the attempt carries no verification segment" } ]
@@ -11183,10 +11034,10 @@ fn belt_review_call(instance: HostDashboardInstance, node_id: String, attempt_ke
     ReviewReceiptPresent { text: _ } => ReviewSkipped { node_id: node_id, criterion: call.id, reason: "a verdict is recorded for this head, plan revision and criterion" }
     ReviewReceiptUnreadable { detail } => ReviewFailed { node_id: node_id, criterion: call.id, detail: detail }
     ReviewReceiptAbsent =>
-      match belt_review_process(node_id: node_id, attempt_key: attempt_key, criterion_key: key) {
+      match belt_review_process(instance: instance, node_id: node_id, attempt_key: attempt_key, criterion_key: key, head_sha: head) {
         WorkerProcessRunning { command: _ } => ReviewSkipped { node_id: node_id, criterion: call.id, reason: "a reviewer is running" }
         WorkerProcessExited { exit_code, last_command: _ } =>
-          ReviewFailed { node_id: node_id, criterion: call.id, detail: join(["the reviewer exited ", to_string(exit_code), " without writing a verdict; its unit is retained for inspection"], "") }
+          ReviewFailed { node_id: node_id, criterion: call.id, detail: join(["the reviewer exited ", to_string(exit_code), " without writing a verdict; its exit record and journal are retained for inspection"], "") }
         WorkerProcessUnobserved { reason } => ReviewDeferred { node_id: node_id, criterion: call.id, reason: reason as String }
         WorkerProcessAbsent =>
           belt_review_spawn(instance: instance, node_id: node_id, attempt_key: attempt_key, worktree: worktree, head: head, plan: plan, call: call)
@@ -11203,10 +11054,13 @@ fn belt_review_spawn(instance: HostDashboardInstance, node_id: String, attempt_k
       let verdict_path = dispatch_attempt_review_verdict_path_for_instance(instance: instance, node_id: nid, attempt_key: attempt_key, head_sha: head, criterion_key: key)
       let brief = join([call.brief, review_verdict_instruction(verdict_path: verdict_path)], "")
       let unit = dispatch_review_unit_name(node_id: node_id, attempt_key: attempt_key, criterion_key: key)
+      match attempt_exit_hook(instance_root: instance.instance_root as String, node_id: node_id, attempt_key: attempt_key, role: AttemptReviewerRole { criterion_key: key, head_sha: head }) {
+        AttemptExitHookRefused { reason } => ReviewFailed { node_id: node_id, criterion: call.id, detail: join(["the reviewer was not launched: its exit hook could not be rendered: ", reason as String], "") }
+        AttemptExitHookRendered { exec_line } =>
       match metering_roster_admit(instance: instance, node_id: nid, attempt_key: attempt_key, role: MeteredReviewer { criterion_key: key as NonEmptyStr, head: head as NonEmptyStr }) {
         RosterAdmissionRefused { cause: roster_cause } => ReviewFailed { node_id: node_id, criterion: call.id, detail: join(["the reviewer was not launched: ", roster_cause], "") }
         RosterAdmitted =>
-      match dispatch_review_unit_command(instance: instance, node_id: nid, attempt_key: attempt_key, worktree_path: worktree, brief: brief, head_sha: head, criterion_key: key) {
+      match dispatch_review_unit_command(instance: instance, node_id: nid, attempt_key: attempt_key, worktree_path: worktree, brief: brief, head_sha: head, criterion_key: key, exit_hook: exec_line) {
         SystemdRunCommandRefused { cause: why } =>
           ReviewFailed { node_id: node_id, criterion: call.id, detail: systemd_run_option_words_refused_cause_detail(cause: why) }
         SystemdRunCommandReady { command: command } =>
@@ -11217,6 +11071,7 @@ fn belt_review_spawn(instance: HostDashboardInstance, node_id: String, attempt_k
           }
       }
       }
+      }
     }
   }
 }
@@ -13437,9 +13292,15 @@ fn belt_publish_pass_outcome_from(outcomes: List<BeltPublishOutcome>) -> BeltPas
   }
 }
 
+// A PENDING VERIFICATION SAYS WHAT ITS OWN OBLIGATION FOUND. Verification is no longer a pass the tick
+// runs over every attempt (dogfood intervention #6): it is this attempt's obligation, run by this
+// attempt's unit, and that run's receipt is what can say it was blocked or failed. Only when the
+// attempt has no verify step on record does the page fall back to the tick: a refused discovery
+// pass blocks every attempt's queue, and otherwise the verification is queued for its obligation.
 fn belt_verification_presentation_detail(
   progress: WorkflowAttemptProgress,
   tick_read: BeltTickReceiptRead,
+  obligation_read: BeltAttemptObligationReceiptRead,
 ) -> String {
   match workflow_segment_of_kind(segments: progress.segments, kind: VerificationWorkflowSegment) {
     Present { value: segment } =>
@@ -13455,26 +13316,23 @@ fn belt_verification_presentation_detail(
         WorkflowSegmentActive =>
           join(["Verification running · ", progress.validation_summary], "")
         WorkflowSegmentPending =>
-          match tick_read {
-            BeltTickReceiptPresent { receipt } =>
-              match receipt.verify_pass {
-                BeltPassRefused { reason: r } =>
-                  join(["Verification blocked · ", r], "")
-                BeltPassFailed { reason: r } =>
-                  join(["Verification failed · ", r], "")
-                BeltPassDeferred { reason: _ } =>
-                  "Verification queued - next belt tick"
+          match obligation_read {
+            BeltAttemptObligationReceiptUnreadable { reason: r } =>
+              join(["Verification blocked · attempt obligation receipt unreadable: ", r], "")
+            BeltAttemptObligationReceiptPresent { verify: Present { value: pass } } =>
+              match pass {
+                BeltPassRefused { reason: r } => join(["Verification blocked · ", r], "")
+                BeltPassFailed { reason: r } => join(["Verification failed · ", r], "")
+                BeltPassDeferred { reason: r } => join(["Verification queued · ", r], "")
                 BeltPassRecorded =>
                   if string_contains(s: segment.detail, pattern: "could not be read") {
                     join(["Verification refused · ", segment.detail], "")
                   } else {
-                    join(["Verification queued - next belt tick · ", segment.detail], "")
+                    join(["Verification queued · ", segment.detail], "")
                   }
               }
-            BeltTickReceiptAbsent =>
-              "Verification queued - next belt tick"
-            BeltTickReceiptUnreadable { reason: r } =>
-              join(["Verification blocked · belt tick receipt unreadable: ", r], "")
+            BeltAttemptObligationReceiptPresent { verify: Absent } => belt_verification_queued_detail(tick_read: tick_read)
+            BeltAttemptObligationReceiptAbsent => belt_verification_queued_detail(tick_read: tick_read)
           }
       }
     Absent =>
@@ -13482,6 +13340,20 @@ fn belt_verification_presentation_detail(
   }
 }
 
+fn belt_verification_queued_detail(tick_read: BeltTickReceiptRead) -> String {
+  match tick_read {
+    BeltTickReceiptPresent { receipt } =>
+      match receipt.discovery_pass {
+        BeltPassRefused { reason: r } => join(["Verification blocked · ", r], "")
+        BeltPassFailed { reason: r } => join(["Verification blocked · ", r], "")
+        BeltPassDeferred { reason: _ } => "Verification queued - awaiting its obligation"
+        BeltPassRecorded => "Verification queued - awaiting its obligation"
+      }
+    BeltTickReceiptAbsent => "Verification queued - awaiting its obligation"
+    BeltTickReceiptUnreadable { reason: r } => join(["Verification blocked · belt tick receipt unreadable: ", r], "")
+  }
+}
+
 // THE EXECUTION STANDING IS OBSERVED AT THE MINT SITE from the instance the tick ran for and the
 // deployed tree's own revision -- the same local_tree_revision read the launch gate and the
 // dispatch preflight make, because a tick receipt that answered from a different authority than
@@ -13522,56 +13394,14 @@ fn belt_tick_receipt_from_result(
       TickPassesWithheld { refusal } => BeltPassRefused { reason: launch_refusal_reason(r: refusal) }
       TickPassesRun => belt_teardown_pass_outcome_from(host_refusal: result.host_refusal, teardown_outcomes: result.teardown_outcomes)
     }),
-    commit_pass: (match result.wholesale {
-      TickPassesWithheld { refusal } => BeltPassRefused { reason: launch_refusal_reason(r: refusal) }
-      TickPassesRun => belt_commit_pass_outcome_from(outcomes: result.commit_outcomes)
-    }),
-    verify_pass: (match result.wholesale {
-      TickPassesWithheld { refusal } => BeltPassRefused { reason: launch_refusal_reason(r: refusal) }
-      TickPassesRun => belt_verify_pass_outcome_from(outcomes: result.verify_outcomes)
-    }),
-    publish_pass: (match result.wholesale {
-      TickPassesWithheld { refusal } => BeltPassRefused { reason: launch_refusal_reason(r: refusal) }
-      TickPassesRun => belt_publish_pass_outcome_from(outcomes: result.publish_outcomes)
-    }),
-    metering_pass: (match result.wholesale {
+    discovery_pass: (match result.wholesale {
       TickPassesWithheld { refusal } => BeltPassRefused { reason: launch_refusal_reason(r: refusal) }
-      TickPassesRun => belt_metering_pass_outcome_from(outcomes: result.metering_outcomes)
+      TickPassesRun => belt_discovery_pass_outcome(discovery: result.discovery)
     }),
   }
 }
 
-data belt_publish_pass_note: String = "PUBLICATION RUNS ON THE SAME TICK AS SPAWN, TEARDOWN AND VERIFY, because it is the same kind of fact: a desired obligation reconciled against an observed one. A producer nobody calls is the defect this lane keeps producing - every piece of the publication path existed before this pass and none of it ever ran - so the wiring is the deliverable, not the type.\\n\\nIT RUNS PER ATTEMPT, OVER THE SAME OBSERVED LEDGER VERIFY USES, and it does NOT wait for the agent to finish. That is the difference from the verify pass and it is deliberate: verification is an action taken ON the attempt, so running it early would burn a validation against an unfinished tree, while publication is an OBSERVATION of the remote, so running it early records the true state - the branch is not published yet - and the next tick revises it. The gate is what makes that safe, since only a receipt saying the head is on offer stops the revisions.\\n\\nTHE TICK HOLDS NO CREDENTIAL AT ALL, and that is what this pass gave up in exchange for the publication boundary. It used to probe GITHUB_TOKEN once per tick and hand the source to every attempt; it now writes a typed request per attempt and reads the answer the publication helper wrote under its own principal. The cost is that a head is published on the SECOND tick that sees it rather than the first, which is a latency the belt already tolerates everywhere else - the first observation of a head is usually before the worker has pushed anyway. The gain is that no process holding this token spawns a provider session. See gunbc.roadmap_publication_helper for the boundary argument."
-
-fn belt_publish_attempts_for_instance(
-  instance: HostDashboardInstance,
-) -> List<BeltPublishOutcome> {
-  match belt_workflow_attempts_observe_for_instance(instance: instance) {
-    WorkflowAttemptsRefused { reason } =>
-      [
-        PublishDeferred {
-          node_id: "",
-          reason: join([
-            "the attempts ledger is unobservable, so no attempt's publication can be adjudicated: ",
-            reason,
-          ], ""),
-        },
-      ]
-    WorkflowAttemptsObserved { attempts } => {
-      map(attempts, progress => belt_publish_attempt_for_instance(
-        instance: instance,
-        node_id: progress.node_id,
-        attempt_key: progress.attempt_key,
-      ))
-    }
-  }
-}
-
-fn belt_publish_attempts() -> List<BeltPublishOutcome> {
-  belt_publish_attempts_for_instance(
-    instance: srv1_live_dashboard_instance(),
-  )
-}
+data belt_publish_pass_note: String = "PUBLICATION IS THE ATTEMPT'S LAST OBLIGATION, run by the attempt's own unit once its head is reviewed (gunbc.roadmap.roadmap_belt_obligation PublishObligation; dogfood intervention #6 moved it off the tick). It is still a desired obligation reconciled against an observed one, and a producer nobody calls is still the defect this lane keeps producing, so the wiring is the deliverable, not the type.\\n\\nIT IS AN OBSERVATION OF THE REMOTE AS WELL AS AN EFFECT: running it records the true state - the branch is not published yet - and its next run revises it. The gate is what makes repetition safe, since only a receipt saying the head is on offer stops the revisions, and one PR per work item is ensured, never created twice.\\n\\nTHE TICK HOLDS NO CREDENTIAL AT ALL, and that is what this pass gave up in exchange for the publication boundary. It used to probe GITHUB_TOKEN once per tick and hand the source to every attempt; it now writes a typed request per attempt and reads the answer the publication helper wrote under its own principal. The cost is that a head is published on the SECOND run of its obligation rather than the first: the first writes the request, and the helper's answer arriving is the event that runs it again (the deployment's publication-answer path unit). The gain is that no process holding this token spawns a provider session. See gunbc.roadmap_publication_helper for the boundary argument."
 
 // THE PRODUCER NEEDS A LIVE TRIGGER, AND belt_tick IS NOT ONE. belt_tick is the belt's actuation
 // pass and nothing calls it — not the serve routes, a timer or the CLI. A pre-existing gap shared
@@ -13741,3 +13571,927 @@ fn belt_publish_outcome_json_value(o: BeltPublishOutcome) -> JsonValue {
     json_kv(key: "detail", value: json_string(s: belt_publish_outcome_detail(o: o))),
   ])
 }
+
+// ── ONE ATTEMPT'S OBLIGATIONS, RUN BY ITS OWN UNIT ─────────────────────────────────────────────
+//
+// THE TICK NO LONGER CAPTURES, VERIFIES, REVIEWS, AUDITS OR PUBLISHES (dogfood intervention #6,
+// gunbc#13124; docs/plans/belt-event-driven-obligations.md). Each attempt's obligations run in that
+// attempt's own unit (gunbc.roadmap.roadmap_belt_obligation belt_attempt_obligation_unit_name), on
+// that attempt's evidence, so a slow obligation of one attempt cannot hold another attempt's -- the
+// fusion that held every tick at its bound on srv2 for ten hours on 2026-10-03.
+//
+// Within the unit, each kind is its own ensure over its own evidence authority, and the cores are the
+// ones the tick used to call per attempt -- belt_commit_attempt_for_instance,
+// belt_verify_attempt_for_instance, belt_review_attempt_for_instance, belt_audit_attempt_for_instance,
+// belt_publish_attempt_for_instance -- each idempotent over unchanged evidence, so a duplicated or
+// out-of-order trigger is a no-op. Kinds run in eligibility order and the attempt is re-observed after
+// each one that ran, so an obligation made eligible by the one before it (a capture that produced a
+// candidate makes verify eligible) runs in the same process, and one that is waiting on something
+// outside the process (reviewers still running) ends the run. Its next run is the event that ends the
+// wait: a reviewer's exit record.
+
+type BeltAttemptProgressRead
+  = BeltAttemptProgressFound { progress: WorkflowAttemptProgress }
+  | BeltAttemptNotCurrent { reason: String }
+  | BeltAttemptProgressRefused { reason: String }
+
+// THE ATTEMPT'S PROJECTED EVIDENCE, read through the same observation the page and the old passes
+// used, scoped to its node. Only the node's CURRENT attempt is observed there; an obligation for an
+// attempt that is no longer current is not run -- a successor attempt has replaced it, and acting on
+// the predecessor would publish or verify a head the node has moved past.
+fn belt_attempt_progress_read(instance: HostDashboardInstance, node_id: String, attempt_key: String) -> BeltAttemptProgressRead {
+  match belt_workflow_attempts_observe_scoped(instance: instance, scope: WorkflowAttemptsOneNode { node_id: node_id }) {
+    WorkflowAttemptsRefused { reason } => BeltAttemptProgressRefused { reason: reason }
+    WorkflowAttemptsObserved { attempts } =>
+      match (attempts |> filter(p => p.attempt_key == attempt_key)).first() {
+        Present { value: p } => BeltAttemptProgressFound { progress: p }
+        Absent => BeltAttemptNotCurrent { reason: join(["attempt ", attempt_key, " is not the current attempt of node ", node_id], "") }
+      }
+  }
+}
+
+type BeltAttemptObligationStep {
+  kind: BeltAttemptObligationKind
+  pass: BeltPassOutcome
+  detail: JsonValue
+}
+
+// A REVIEW OR AUDIT STEP FAILS ITS PASS when any of its calls failed; a deferred call defers it; a
+// spawned or skipped call is recorded -- the spawned reviewer's exit is the step's next event.
+fn belt_review_pass_outcome_from(outcomes: List<BeltReviewOutcome>) -> BeltPassOutcome {
+  let failed = outcomes |> flat_map(o => match o {
+    ReviewFailed { node_id: _, criterion: c, detail: d } => [join([c, ": ", d], "")]
+    ReviewSpawned { node_id: _, criterion: _, unit: _ } => [] as List<String>
+    ReviewSkipped { node_id: _, criterion: _, reason: _ } => [] as List<String>
+    ReviewDeferred { node_id: _, criterion: _, reason: _ } => [] as List<String>
+    ReviewPlanSuperseded { node_id: _, stale_verdicts: _, revision: _ } => [] as List<String>
+  })
+  let deferred = outcomes |> flat_map(o => match o {
+    ReviewDeferred { node_id: _, criterion: c, reason: r } => [join([c, ": ", r], "")]
+    ReviewFailed { node_id: _, criterion: _, detail: _ } => [] as List<String>
+    ReviewSpawned { node_id: _, criterion: _, unit: _ } => [] as List<String>
+    ReviewSkipped { node_id: _, criterion: _, reason: _ } => [] as List<String>
+    ReviewPlanSuperseded { node_id: _, stale_verdicts: _, revision: _ } => [] as List<String>
+  })
+  match failed.first() {
+    Present { value: f } => BeltPassFailed { reason: join([to_string(count(failed)), " review call(s) failed; first: ", f], "") }
+    Absent =>
+      match deferred.first() {
+        Present { value: d } => BeltPassDeferred { reason: d }
+        Absent => BeltPassRecorded
+      }
+  }
+}
+
+fn belt_attempt_obligation_step(instance: HostDashboardInstance, progress: WorkflowAttemptProgress, kind: BeltAttemptObligationKind) -> BeltAttemptObligationStep {
+  match kind {
+    CaptureObligation => {
+      let o = belt_commit_attempt_for_instance(instance: instance, progress: progress)
+      BeltAttemptObligationStep { kind: kind, pass: belt_commit_pass_outcome_from(outcomes: [o]), detail: belt_commit_outcome_json_value(o: o) }
+    }
+    VerifyObligation => {
+      let o = belt_verify_attempt_for_instance(instance: instance, progress: progress)
+      BeltAttemptObligationStep { kind: kind, pass: belt_verify_pass_outcome_from(outcomes: [o]), detail: belt_verify_outcome_json(o: o) }
+    }
+    ReviewObligation => {
+      let os = belt_review_attempt_for_instance(instance: instance, progress: progress)
+      BeltAttemptObligationStep { kind: kind, pass: belt_review_pass_outcome_from(outcomes: os), detail: json_array(elements: os |> map(o => belt_review_outcome_json(o: o))) }
+    }
+    AuditObligation => {
+      let o = belt_audit_attempt_for_instance(instance: instance, progress: progress)
+      BeltAttemptObligationStep { kind: kind, pass: belt_review_pass_outcome_from(outcomes: [o]), detail: belt_review_outcome_json(o: o) }
+    }
+    PublishObligation => {
+      let o = belt_publish_attempt_for_instance(instance: instance, node_id: progress.node_id, attempt_key: progress.attempt_key)
+      BeltAttemptObligationStep { kind: kind, pass: belt_publish_pass_outcome_from(outcomes: [o]), detail: belt_publish_outcome_json_value(o: o) }
+    }
+  }
+}
+
+type BeltAttemptObligationsFold {
+  read: BeltAttemptProgressRead
+  steps: List<BeltAttemptObligationStep>
+}
+
+type BeltAttemptObligationRun
+  = BeltAttemptObligationsRan { node_id: String, attempt_key: String, steps: List<BeltAttemptObligationStep> }
+  | BeltAttemptObligationsNotCurrent { node_id: String, attempt_key: String, reason: String }
+  | BeltAttemptObligationsRefused { node_id: String, attempt_key: String, reason: String }
+
+// THE RUN: every kind in eligibility order, each run only if it is outstanding on the evidence as it
+// stands when its turn comes. The fold re-observes after each step that ran, so the outstanding test
+// for the next kind reads what the previous one wrote. Each kind is visited once, so the run is
+// bounded by the number of kinds and never re-runs a kind it already ran (the strictly-downstream
+// rule of gunbc.roadmap.roadmap_belt_obligation belt_attempt_next_after, by construction here).
+fn belt_attempt_obligations_run(instance: HostDashboardInstance, node_id: String, attempt_key: String) -> BeltAttemptObligationRun {
+  let folded = fold(belt_attempt_obligation_order, init: BeltAttemptObligationsFold { read: belt_attempt_progress_read(instance: instance, node_id: node_id, attempt_key: attempt_key), steps: [] }, f: fn(acc, kind) {
+    match acc.read {
+      BeltAttemptProgressFound { progress } =>
+        if belt_attempt_obligation_outstanding(kind: kind, provider: progress.provider, segments: progress.segments) {
+          let step = belt_attempt_obligation_step(instance: instance, progress: progress, kind: kind)
+          BeltAttemptObligationsFold { read: belt_attempt_progress_read(instance: instance, node_id: node_id, attempt_key: attempt_key), steps: concat(acc.steps, [step]) }
+        } else {
+          acc
+        }
+      BeltAttemptNotCurrent { reason: _ } => acc
+      BeltAttemptProgressRefused { reason: _ } => acc
+    }
+  })
+  match folded.read {
+    BeltAttemptProgressFound { progress: _ } => BeltAttemptObligationsRan { node_id: node_id, attempt_key: attempt_key, steps: folded.steps }
+    BeltAttemptNotCurrent { reason } =>
+      if count(folded.steps) == 0 { BeltAttemptObligationsNotCurrent { node_id: node_id, attempt_key: attempt_key, reason: reason } } else { BeltAttemptObligationsRan { node_id: node_id, attempt_key: attempt_key, steps: folded.steps } }
+    BeltAttemptProgressRefused { reason } =>
+      BeltAttemptObligationsRefused { node_id: node_id, attempt_key: attempt_key, reason: join(["the attempt's evidence could not be observed: ", reason, if count(folded.steps) == 0 { "" } else { join([" (after ", to_string(count(folded.steps)), " obligation(s) ran)"], "") }], "") }
+  }
+}
+
+// ── THE ATTEMPT'S OBLIGATION RECEIPT ───────────────────────────────────────────────────────────
+//
+// What the attempt's last obligation run did, per kind, at the instance's receipts directory beside
+// the tick receipt and named by the attempt. The page reads it where it used to read the tick's
+// verify pass: "verification pending" now says what THIS attempt's own run found, not what the last
+// pass over every attempt found.
+data belt_attempt_obligation_receipt_schema: String = "roadmap-belt-attempt-obligations/v1"
+
+fn belt_attempt_obligation_receipt_path(instance: HostDashboardInstance, node_id: String, attempt_key: String) -> String {
+  join([instance_receipts_dir(instance_root: instance.instance_root as String), "/obligations-", node_id, "-", attempt_key, ".json"], "")
+}
+
+fn belt_attempt_obligation_step_json(step: BeltAttemptObligationStep) -> JsonValue {
+  json_object(members: [
+    json_kv(key: "kind", value: json_string(s: belt_attempt_obligation_kind_key(kind: step.kind))),
+    json_kv(key: "pass", value: belt_pass_outcome_json(o: step.pass)),
+    json_kv(key: "detail", value: step.detail),
+  ])
+}
+
+fn belt_attempt_obligation_run_json(run: BeltAttemptObligationRun, observed_at: String, claimed: List<String>) -> JsonValue {
+  match run {
+    BeltAttemptObligationsRan { node_id, attempt_key, steps } =>
+      json_object(members: [
+        json_kv(key: "schema", value: json_string(s: belt_attempt_obligation_receipt_schema)),
+        json_kv(key: "observed_at", value: json_string(s: observed_at)),
+        json_kv(key: "claimed_exits", value: json_array(elements: claimed |> map(c => json_string(s: c)))),
+        json_kv(key: "node", value: json_string(s: node_id)),
+        json_kv(key: "attempt", value: json_string(s: attempt_key)),
+        json_kv(key: "standing", value: json_string(s: "ran")),
+        json_kv(key: "steps", value: json_array(elements: steps |> map(s => belt_attempt_obligation_step_json(step: s)))),
+      ])
+    BeltAttemptObligationsNotCurrent { node_id, attempt_key, reason } =>
+      json_object(members: [
+        json_kv(key: "schema", value: json_string(s: belt_attempt_obligation_receipt_schema)),
+        json_kv(key: "observed_at", value: json_string(s: observed_at)),
+        json_kv(key: "claimed_exits", value: json_array(elements: claimed |> map(c => json_string(s: c)))),
+        json_kv(key: "node", value: json_string(s: node_id)),
+        json_kv(key: "attempt", value: json_string(s: attempt_key)),
+        json_kv(key: "standing", value: json_string(s: "not-current")),
+        json_kv(key: "reason", value: json_string(s: reason)),
+      ])
+    BeltAttemptObligationsRefused { node_id, attempt_key, reason } =>
+      json_object(members: [
+        json_kv(key: "schema", value: json_string(s: belt_attempt_obligation_receipt_schema)),
+        json_kv(key: "observed_at", value: json_string(s: observed_at)),
+        json_kv(key: "claimed_exits", value: json_array(elements: claimed |> map(c => json_string(s: c)))),
+        json_kv(key: "node", value: json_string(s: node_id)),
+        json_kv(key: "attempt", value: json_string(s: attempt_key)),
+        json_kv(key: "standing", value: json_string(s: "refused")),
+        json_kv(key: "reason", value: json_string(s: reason)),
+      ])
+  }
+}
+
+// A REFUSED RUN OR A FAILED STEP IS THE RUN'S FAILURE, so the unit ends failed and the journal and the
+// receipt both name it (the line stops for this attempt only). Deferred and recorded steps, and an
+// attempt that is no longer current, end the unit successfully.
+fn belt_attempt_obligation_run_failure(run: BeltAttemptObligationRun) -> String? {
+  match run {
+    BeltAttemptObligationsRefused { node_id: _, attempt_key: _, reason } => Present { value: reason }
+    BeltAttemptObligationsNotCurrent { node_id: _, attempt_key: _, reason: _ } => none
+    BeltAttemptObligationsRan { node_id: _, attempt_key: _, steps } =>
+      (steps |> flat_map(s => match s.pass {
+        BeltPassFailed { reason } => [join([belt_attempt_obligation_kind_key(kind: s.kind), ": ", reason], "")]
+        BeltPassRefused { reason } => [join([belt_attempt_obligation_kind_key(kind: s.kind), ": ", reason], "")]
+        BeltPassDeferred { reason: _ } => [] as List<String>
+        BeltPassRecorded => [] as List<String>
+      })).first()
+  }
+}
+
+fn belt_attempt_obligation_receipt_write(instance: HostDashboardInstance, run: BeltAttemptObligationRun, node_id: String, attempt_key: String, observed_at: String, claimed: List<String>) -> BeltPassOutcome {
+  let write = Filesystem.Write(
+    path: belt_attempt_obligation_receipt_path(instance: instance, node_id: node_id, attempt_key: attempt_key),
+    content: serialize_json(v: belt_attempt_obligation_run_json(run: run, observed_at: observed_at, claimed: claimed)),
+  )
+  if write.success { BeltPassRecorded } else { BeltPassFailed { reason: join(["the attempt's obligation receipt could not be written: ", write.error], "") } }
+}
+
+// ── HANDING AN OBLIGATION TO ITS UNIT ──────────────────────────────────────────────────────────
+//
+// AN OBLIGATION IS QUEUED BY STARTING ITS UNIT, and the caller returns at once: discovery, the exit
+// drain and the attempt run's own tail never wait on the work they hand off. The unit is a transient
+// unit in the service user's manager -- the manager that already runs every worker, reviewer and
+// auditor this belt launches -- running one `gunbc run` entry of gunbc.roadmap_belt_tick_cli, with
+// the deployment's spawn root passed in the same variable the belt service is given
+// (gunbc.host_layout belt_spawn_workdir_env_var), so the unit resolves the same instance.
+//
+// RuntimeMaxSec IS THE OBLIGATION'S DEADLINE: past it the manager stops the unit, it ends failed, and
+// the line stops for that attempt only, loudly. It is the per-tick watchdog's bound
+// (gunbc.live_deploy.emit belt_tick_run_bound) applied to one attempt instead of all of them.
+// CollectMode=inactive-or-failed lets the next trigger reuse the name after a failure; the failure
+// itself is kept in the attempt's obligation receipt and the user journal.
+data belt_obligation_entry: String = "dag/gunbc/roadmap/roadmap_belt_tick_cli.dag"
+
+fn belt_obligation_unit_command(
+  instance: HostDashboardInstance,
+  unit: NonEmptyStr,
+  function: String,
+  args: List<String>,
+  stop_hook: NonEmptyStr?,
+) -> SystemdRunCommandReading {
+  let repo = instance.repo_root as String
+  systemd_run_user_transient_command(
+    unit: unit,
+    properties: concat([
+      SystemdRunProperty { property: WorkingDirectoryProperty, value: repo as NonEmptyStr },
+      SystemdRunProperty { property: RuntimeMaxSecProperty, value: systemd_time_span_of_seconds(d: belt_tick_run_bound) },
+      SystemdRunProperty { property: CollectModeProperty, value: "inactive-or-failed" as NonEmptyStr },
+      SystemdRunProperty { property: MemoryMax, value: to_string(value: byte_size_count(instance.dispatch_worker_memory_max)) as NonEmptyStr },
+    ], match stop_hook {
+      Present { value: hook } => [SystemdRunProperty { property: ExecStopPostProperty, value: hook }]
+      Absent => [] as List<SystemdRunProperty>
+    }),
+    setenv_bindings: [SystemdSetenvBinding { name: belt_spawn_workdir_env_var, value: repo as NonEmptyStr }],
+    command_argv: concat([
+      instance.serve_binary as String,
+      "run",
+      "--source-root", join([repo, "/dag"], ""),
+      "--source-root", join([repo, "/src/v2"], ""),
+      "--entry", join([repo, "/", belt_obligation_entry], ""),
+      "--function", function,
+    ], args |> flat_map(a => ["--arg", a])),
+  )
+}
+
+// THE UNIT NAME IS THE HOLD. A loaded unit of the name means the obligation is already being worked:
+// that is read from the manager (the same LoadState/SubState read every worker observation makes)
+// before starting, and answers Held -- a no-op. A start that then fails is a located refusal; the race
+// between the read and the start can only produce that refusal, never a second process.
+// THE HOLD DECISION, PURE over the manager's answer for ONE unit name: loaded and live holds, unread
+// refuses, anything else may start. It reads nothing but that one unit, which is the whole of #6's
+// isolation: another attempt's unit -- running, slow, wedged -- is a different name and never reaches
+// this decision.
+type BeltObligationHoldDecision
+  = BeltObligationMayStart
+  | BeltObligationIsHeld
+  | BeltObligationHoldUnread { reason: String }
+
+fn belt_obligation_hold_decision(observation: AttemptUnitObservation) -> BeltObligationHoldDecision {
+  match observation {
+    AttemptUnitActive => BeltObligationIsHeld
+    AttemptUnitUnreadable { reason } => BeltObligationHoldUnread { reason: reason }
+    AttemptUnitAbsent => BeltObligationMayStart
+    AttemptUnitFinished { exit_status: _ } => BeltObligationMayStart
+  }
+}
+
+fn belt_obligation_enqueue(instance: HostDashboardInstance, unit: NonEmptyStr, function: String, args: List<String>, stop_hook: NonEmptyStr?) -> BeltObligationEnqueue {
+  match belt_obligation_hold_decision(observation: attempt_unit_observation(unit: unit)) {
+    BeltObligationIsHeld => BeltObligationHeld { unit: unit }
+    BeltObligationHoldUnread { reason } => BeltObligationEnqueueRefused { unit: unit, reason: join(["the user manager could not be asked whether the unit is loaded: ", reason], "") }
+    BeltObligationMayStart => belt_obligation_start(instance: instance, unit: unit, function: function, args: args, stop_hook: stop_hook)
+  }
+}
+
+fn belt_obligation_start(instance: HostDashboardInstance, unit: NonEmptyStr, function: String, args: List<String>, stop_hook: NonEmptyStr?) -> BeltObligationEnqueue {
+  match instance.toolchain.systemd_run {
+    Absent => BeltObligationEnqueueRefused { unit: unit, reason: join(["the toolchain for host ", instance.host_identity as String, " declares no systemd-run, and an obligation runs in its own transient unit"], "") }
+    Present { value: systemd_run } =>
+      match belt_obligation_unit_command(instance: instance, unit: unit, function: function, args: args, stop_hook: stop_hook) {
+        SystemdRunCommandRefused { cause: why } => BeltObligationEnqueueRefused { unit: unit, reason: systemd_run_option_words_refused_cause_detail(cause: why) }
+        SystemdRunCommandReady { command: command } =>
+          match belt_exec(cmd: dispatch_unit_exec_argv(command: command, resolved_program: systemd_run), workdir: belt_observe_workdir as String) {
+            ExecOk { stdout: _ } => BeltObligationStarted { unit: unit }
+            ExecFailed { program: _, exit_code, stderr } => BeltObligationEnqueueRefused { unit: unit, reason: join(["systemd-run exited ", to_string(exit_code), ": ", stderr], "") }
+            ExecRefused { program: _, reason } => BeltObligationEnqueueRefused { unit: unit, reason: reason }
+          }
+      }
+  }
+}
+
+data belt_attempt_obligations_function: String = "belt_attempt_obligations_cli"
+data belt_instance_obligation_function: String = "belt_instance_obligation_cli"
+
+// THE ATTEMPT UNIT'S OWN STOP HOOK (claimant-terminal rescue, bold-bee-114 2026-10-09). When the run that
+// claimed an exit ends for any reason -- settled, killed at RuntimeMaxSec, stopped with its manager -- the
+// manager runs this hook and it records an `obligation` exit entry for the attempt. The drain consumes
+// that entry only once the unit is gone, and before it does it moves any claim the dead run left in
+// `running` back to `queued`, so a lone orphaned claim starts a new run with no other event. The entry
+// is unconditional (a typed argv cannot test "settled"); a settled run leaves nothing to move, so it
+// costs one drain and starts nothing, which is why it cannot loop.
+fn belt_attempt_obligations_enqueue(instance: HostDashboardInstance, node_id: String, attempt_key: String) -> BeltObligationEnqueue {
+  let unit = belt_attempt_obligation_unit_name(node_id: node_id, attempt_key: attempt_key)
+  match attempt_exit_hook(instance_root: instance.instance_root as String, node_id: node_id, attempt_key: attempt_key, role: AttemptObligationRole) {
+    AttemptExitHookRefused { reason } => BeltObligationEnqueueRefused { unit: unit, reason: join(["the attempt unit's stop hook could not be rendered: ", reason as String], "") }
+    AttemptExitHookRendered { exec_line } =>
+      belt_obligation_enqueue(
+        instance: instance,
+        unit: unit,
+        function: belt_attempt_obligations_function,
+        args: [join(["node_id=", node_id], ""), join(["attempt_key=", attempt_key], "")],
+        stop_hook: Present { value: exec_line },
+      )
+  }
+}
+
+fn belt_instance_obligation_enqueue(instance: HostDashboardInstance, kind: BeltInstanceObligationKind) -> BeltObligationEnqueue {
+  belt_obligation_enqueue(
+    instance: instance,
+    unit: belt_instance_obligation_unit_name(instance_id: instance.instance_id as String, kind: kind),
+    function: belt_instance_obligation_function,
+    args: [join(["kind=", belt_instance_obligation_kind_key(kind: kind)], "")],
+    stop_hook: Absent,
+  )
+}
+
+fn belt_obligation_enqueue_json(e: BeltObligationEnqueue) -> JsonValue {
+  match e {
+    BeltObligationStarted { unit } => json_object(members: [json_kv(key: "unit", value: json_string(s: unit as String)), json_kv(key: "outcome", value: json_string(s: "started"))])
+    BeltObligationHeld { unit } => json_object(members: [json_kv(key: "unit", value: json_string(s: unit as String)), json_kv(key: "outcome", value: json_string(s: "held"))])
+    BeltObligationEnqueueRefused { unit, reason } => json_object(members: [json_kv(key: "unit", value: json_string(s: unit as String)), json_kv(key: "outcome", value: json_string(s: "refused")), json_kv(key: "reason", value: json_string(s: reason))])
+  }
+}
+
+fn belt_obligation_enqueue_pass(enqueues: List<BeltObligationEnqueue>) -> BeltPassOutcome {
+  let refused = enqueues |> flat_map(e => match e {
+    BeltObligationEnqueueRefused { unit, reason } => [join([unit as String, ": ", reason], "")]
+    BeltObligationStarted { unit: _ } => [] as List<String>
+    BeltObligationHeld { unit: _ } => [] as List<String>
+  })
+  match refused.first() {
+    Present { value: r } => BeltPassFailed { reason: join([to_string(count(refused)), " obligation(s) could not be handed to their unit; first: ", r], "") }
+    Absent => BeltPassRecorded
+  }
+}
+
+// ── DISCOVERY: THE BOUNDED ANTI-ENTROPY PASS ───────────────────────────────────────────────────
+//
+// DISCOVERY FINDS AND QUEUES; IT NEVER DOES THE WORK. It reads every current attempt's evidence --
+// it must, to know which owe something -- and hands at most belt_discovery_attempt_bound of the ones
+// that do to their units, plus the instance obligations a moved record makes owed (not launch: the
+// launch pass is what runs discovery, and a worker's exit is what queues launch). It is the recovery backstop for a missed
+// event (a reboot between an exit and its drain, an entry left in the inbox), never the primary
+// route, and nothing in the product requires it to run on a cadence: events invoke the obligations
+// they affect, and this pass is invoked by an event too (a publication answer arriving) or by an
+// operator.
+type BeltDiscovery
+  = BeltDiscovered { owed: Int, enqueues: List<BeltObligationEnqueue> }
+  | BeltDiscoveryRefused { reason: String }
+
+// PURE: which attempts are owed something, in observation order, and the bounded prefix to queue.
+fn belt_discovery_owed(attempts: List<WorkflowAttemptProgress>) -> List<WorkflowAttemptProgress> {
+  attempts |> filter(p => count(belt_attempt_outstanding(provider: p.provider, segments: p.segments)) > 0)
+}
+
+fn belt_discover_for_instance(instance: HostDashboardInstance) -> BeltDiscovery {
+  match belt_workflow_attempts_observe_for_instance(instance: instance) {
+    WorkflowAttemptsRefused { reason } => BeltDiscoveryRefused { reason: join(["the attempts ledger is unobservable, so no outstanding obligation can be discovered: ", reason], "") }
+    WorkflowAttemptsObserved { attempts } => {
+      let owed = belt_discovery_owed(attempts: attempts)
+      BeltDiscovered {
+        owed: count(owed),
+        enqueues: concat(
+          owed.take(belt_discovery_attempt_bound) |> map(p => belt_attempt_obligations_enqueue(instance: instance, node_id: p.node_id, attempt_key: p.attempt_key)),
+          belt_record_moved_obligation_kinds |> map(k => belt_instance_obligation_enqueue(instance: instance, kind: k)),
+        ),
+      }
+    }
+  }
+}
+
+fn belt_discovery_json(discovery: BeltDiscovery) -> JsonValue {
+  match discovery {
+    BeltDiscovered { owed, enqueues } =>
+      json_object(members: [
+        json_kv(key: "standing", value: json_string(s: "discovered")),
+        json_kv(key: "owed", value: json_int(n: owed)),
+        json_kv(key: "bound", value: json_int(n: belt_discovery_attempt_bound)),
+        json_kv(key: "enqueues", value: json_array(elements: enqueues |> map(e => belt_obligation_enqueue_json(e: e)))),
+      ])
+    BeltDiscoveryRefused { reason } =>
+      json_object(members: [
+        json_kv(key: "standing", value: json_string(s: "refused")),
+        json_kv(key: "reason", value: json_string(s: reason)),
+      ])
+  }
+}
+
+// THE TICK RECEIPT'S DISCOVERY PASS: refused when the ledger could not be read, failed when an
+// obligation could not be handed to its unit, recorded otherwise. Owed attempts past the bound are not
+// a failure: they are still owed, and the next pass or their own events find them.
+fn belt_discovery_pass_outcome(discovery: BeltDiscovery) -> BeltPassOutcome {
+  match discovery {
+    BeltDiscoveryRefused { reason } => BeltPassRefused { reason: reason }
+    BeltDiscovered { owed: _, enqueues } => belt_obligation_enqueue_pass(enqueues: enqueues)
+  }
+}
+
+// ── READING AN ATTEMPT'S OBLIGATION RECEIPT ────────────────────────────────────────────────────
+//
+// What the page needs from it is the verify step's pass, when the last run took one. An absent
+// receipt means no obligation has run for the attempt yet; an unreadable one is never read as absent.
+type BeltAttemptObligationReceiptRead
+  = BeltAttemptObligationReceiptPresent { verify: BeltPassOutcome? }
+  | BeltAttemptObligationReceiptAbsent
+  | BeltAttemptObligationReceiptUnreadable { reason: String }
+
+// THE DECODER IS TOTAL AND SUBJECT-BOUND (bold-bee-114, 2026-10-09): the receipt names its node and attempt and
+// both must equal the requested subject, a foreign receipt never reads as this attempt's; observed_at and the
+// run's standing are decoded and validated; every step is decoded, each kind at most once, an unknown kind, a
+// malformed kind member or a malformed pass refuses; only then is verify projected.
+type BeltObligationStepsDecode
+  = BeltObligationStepsDecoded { kinds: List<String>, verify: BeltPassOutcome? }
+  | BeltObligationStepsUnreadable { reason: String }
+
+fn belt_attempt_obligation_receipt_unreadable(reason: String) -> BeltAttemptObligationReceiptRead {
+  BeltAttemptObligationReceiptUnreadable { reason: join(["attempt obligation receipt: ", reason], "") }
+}
+
+fn belt_attempt_obligation_receipt_string_member(doc: JsonValue, key: String) -> String? {
+  match json_required_string_member(doc: doc, key: key) {
+    JsonStringMemberFound { value: v } => Present { value: v }
+    JsonStringMemberRefused { reason: _ } => none
+  }
+}
+
+fn belt_attempt_obligation_steps_decode(steps: List<JsonValue>) -> BeltObligationStepsDecode {
+  let known = belt_attempt_obligation_order |> map(k => belt_attempt_obligation_kind_key(kind: k))
+  fold(steps, init: BeltObligationStepsDecoded { kinds: [], verify: none }, f: fn(acc, step) {
+    match acc {
+      BeltObligationStepsUnreadable { reason: _ } => acc
+      BeltObligationStepsDecoded { kinds, verify } =>
+        match json_required_string_member(doc: step, key: "kind") {
+          JsonStringMemberRefused { reason } => BeltObligationStepsUnreadable { reason: join(["a step has no readable kind: ", reason], "") }
+          JsonStringMemberFound { value: k } =>
+            if !any(known, kk => kk == k) {
+              BeltObligationStepsUnreadable { reason: join(["a step names the unknown kind ", k], "") }
+            } else if any(kinds, kk => kk == k) {
+              BeltObligationStepsUnreadable { reason: join(["the ", k, " step appears more than once"], "") }
+            } else {
+              match belt_pass_outcome_from_member(doc: step, key: "pass") {
+                BeltPassOutcomeUnreadable { reason } => BeltObligationStepsUnreadable { reason: join(["the ", k, " step: ", reason], "") }
+                BeltPassOutcomeDecoded { outcome } =>
+                  BeltObligationStepsDecoded {
+                    kinds: concat(kinds, [k]),
+                    verify: if k == belt_attempt_obligation_kind_key(kind: VerifyObligation) { Present { value: outcome } } else { verify },
+                  }
+              }
+            }
+        }
+    }
+  })
+}
+
+fn belt_attempt_obligation_receipt_decode(raw: String, node_id: String, attempt_key: String) -> BeltAttemptObligationReceiptRead {
+  match parse_json_document(s: raw) {
+    JsonDocumentUnreadable { gap } => BeltAttemptObligationReceiptUnreadable { reason: concat("the attempt obligation receipt is ", json_document_gap_text(gap: gap)) }
+    JsonDocumentParsed { value: doc } =>
+      match belt_attempt_obligation_receipt_string_member(doc: doc, key: "schema") {
+        Absent => belt_attempt_obligation_receipt_unreadable(reason: "schema is missing")
+        Present { value: schema } =>
+          if schema != belt_attempt_obligation_receipt_schema {
+            belt_attempt_obligation_receipt_unreadable(reason: "schema is unknown")
+          } else {
+            match belt_attempt_obligation_receipt_string_member(doc: doc, key: "node") {
+              Absent => belt_attempt_obligation_receipt_unreadable(reason: "node is missing")
+              Present { value: node } =>
+                match belt_attempt_obligation_receipt_string_member(doc: doc, key: "attempt") {
+                  Absent => belt_attempt_obligation_receipt_unreadable(reason: "attempt is missing")
+                  Present { value: attempt } =>
+                    if node != node_id || attempt != attempt_key {
+                      belt_attempt_obligation_receipt_unreadable(reason: join(["it is for ", node, "/", attempt, ", not the requested ", node_id, "/", attempt_key], ""))
+                    } else {
+                      match belt_attempt_obligation_receipt_string_member(doc: doc, key: "observed_at") {
+                        Absent => belt_attempt_obligation_receipt_unreadable(reason: "observed_at is missing")
+                        Present { value: observed_at } =>
+                          if string_length(s: observed_at) == 0 {
+                            belt_attempt_obligation_receipt_unreadable(reason: "observed_at is empty")
+                          } else if !belt_attempt_obligation_receipt_claim_is_strings(doc: doc) {
+                            belt_attempt_obligation_receipt_unreadable(reason: "claimed_exits is missing, duplicated or not an array of strings")
+                          } else {
+                            match belt_attempt_obligation_receipt_string_member(doc: doc, key: "standing") {
+                              Absent => belt_attempt_obligation_receipt_unreadable(reason: "standing is missing")
+                              Present { value: standing } => belt_attempt_obligation_receipt_by_standing(doc: doc, standing: standing)
+                            }
+                          }
+                      }
+                    }
+                }
+            }
+          }
+      }
+  }
+}
+
+// THE CLAIM THE RUN SETTLED AGAINST is part of the receipt: a ran, not-current or refused receipt all
+// name it, and a receipt whose claim cannot be read is unreadable rather than assumed empty.
+fn belt_attempt_obligation_receipt_claim_is_strings(doc: JsonValue) -> Bool {
+  match json_object_unique_member(v: doc, key: "claimed_exits") {
+    JsonMemberFound { value: JsonArray { elements } } =>
+      all(elements, e => match e { JsonString { value: _ } => true _ => false })
+    _ => false
+  }
+}
+
+fn belt_attempt_obligation_receipt_by_standing(doc: JsonValue, standing: String) -> BeltAttemptObligationReceiptRead {
+  if standing == "ran" {
+    match json_object_unique_member(v: doc, key: "steps") {
+      JsonMemberFound { value: JsonArray { elements } } =>
+        match belt_attempt_obligation_steps_decode(steps: elements) {
+          BeltObligationStepsUnreadable { reason } => belt_attempt_obligation_receipt_unreadable(reason: reason)
+          BeltObligationStepsDecoded { kinds: _, verify } => BeltAttemptObligationReceiptPresent { verify: verify }
+        }
+      JsonMemberAbsent => belt_attempt_obligation_receipt_unreadable(reason: "a ran receipt has no steps")
+      JsonMemberFound { value: _ } => belt_attempt_obligation_receipt_unreadable(reason: "steps is not an array")
+      JsonMemberDuplicated { count: _ } => belt_attempt_obligation_receipt_unreadable(reason: "steps is duplicated")
+      JsonMemberNotAnObject => belt_attempt_obligation_receipt_unreadable(reason: "it is not an object")
+    }
+  } else if standing == "not-current" || standing == "refused" {
+    match belt_attempt_obligation_receipt_string_member(doc: doc, key: "reason") {
+      Present { value: _ } => BeltAttemptObligationReceiptPresent { verify: none }
+      Absent => belt_attempt_obligation_receipt_unreadable(reason: join(["a ", standing, " receipt has no reason"], ""))
+    }
+  } else {
+    belt_attempt_obligation_receipt_unreadable(reason: join(["standing ", standing, " is unknown"], ""))
+  }
+}
+
+fn belt_attempt_obligation_receipt_read(instance: HostDashboardInstance, node_id: String, attempt_key: String) -> BeltAttemptObligationReceiptRead {
+  match filesystem_file_observation_of_path(path: belt_attempt_obligation_receipt_path(instance: instance, node_id: node_id, attempt_key: attempt_key)) {
+    FilesystemFileAbsent(_) => BeltAttemptObligationReceiptAbsent
+    FilesystemFileRead { path: _, content } => belt_attempt_obligation_receipt_decode(raw: content, node_id: node_id, attempt_key: attempt_key)
+    FilesystemFileIndeterminate { cause } => BeltAttemptObligationReceiptUnreadable { reason: cause }
+    FilesystemFileObservationsDisagree { path: _, cause } => BeltAttemptObligationReceiptUnreadable { reason: cause }
+    FilesystemFileSubjectRefused { directory: _, name: _, cause } => BeltAttemptObligationReceiptUnreadable { reason: cause }
+  }
+}
+
+// ── THE EXIT DRAIN ─────────────────────────────────────────────────────────────────────────────
+//
+// A RECORDED EXIT IS HANDED TO ITS ATTEMPT'S OBLIGATION UNIT, and that is all the drain does (dogfood
+// intervention #4: with no timer, a worker's exit is what causes its capture to run). The deployment's
+// exit path unit starts the drain while the inbox is not empty. Each entry leaves the inbox in the
+// same pass: to `queued` once its attempt's unit was started or was already running (the unit owns
+// it now), or to `refused` when it is not a record or its unit could not be started -- a refused
+// entry stays on disk, because the exit it records still happened and the process observer still
+// reads it. An entry is never left in the inbox, so the path unit goes quiet.
+//
+// A WORKER'S EXIT ALSO QUEUES LAUNCH: its slot is free, so the ready frontier may admit the next
+// attempt. A reviewer's or auditor's exit does not -- it frees no worker capacity.
+type BeltExitDrainEntry
+  = BeltExitEntryHanded { entry: String, enqueue: BeltObligationEnqueue }
+  | BeltExitEntryRefused { entry: String, reason: String }
+
+type BeltExitDrain
+  = BeltExitDrained { entries: List<BeltExitDrainEntry>, launch: BeltObligationEnqueue? }
+  | BeltExitDrainRefused { reason: String }
+
+fn belt_exit_entry_move(instance: HostDashboardInstance, entry: String, from: AttemptExitSpoolStage, to: AttemptExitSpoolStage) -> String? {
+  belt_exit_entry_move_at(root: instance.instance_root as String, entry: entry, from: from, to: to)
+}
+
+fn belt_exit_entry_move_at(root: String, entry: String, from: AttemptExitSpoolStage, to: AttemptExitSpoolStage) -> String? {
+  let cmd = mv_exact_destination_command(
+    source: join([attempt_exit_spool_stage_dir(instance_root: root, stage: from), "/", entry], ""),
+    destination: join([attempt_exit_spool_stage_dir(instance_root: root, stage: to), "/", entry], ""),
+  )
+  match belt_exec(cmd: host_exec_argv(program: cmd.program.invocation as String, args: cmd.arguments), workdir: belt_observe_workdir as String) {
+    ExecOk { stdout: _ } => none
+    ExecFailed { program: _, exit_code, stderr } => Present { value: join(["mv exited ", to_string(exit_code), ": ", stderr], "") }
+    ExecRefused { program: _, reason } => Present { value: reason }
+  }
+}
+
+// THE DRAIN OVER A SPOOL ROOT WITH ITS HAND-OFF SUPPLIED. Production passes the instance root and the
+// real enqueue (belt_attempt_obligations_enqueue, belt_instance_obligation_enqueue); the wet witness
+// passes a temp root and a recording hand-off, so the listing, the decode and every move are the real
+// ones and only starting a unit in a user manager is supplied.
+fn belt_exit_entry_drain_at(root: String, entry: String, enqueue: fn(String, String) -> BeltObligationEnqueue) -> BeltExitDrainEntry {
+  match attempt_exit_entry_decode(entry_name: entry) {
+    AttemptExitEntryMalformed { entry_name: _, reason } =>
+      match belt_exit_entry_move_at(root: root, entry: entry, from: AttemptExitInbox, to: AttemptExitRefused) {
+        Absent => BeltExitEntryRefused { entry: entry, reason: join(["not an exit record: ", reason], "") }
+        Present { value: why } => BeltExitEntryRefused { entry: entry, reason: join(["not an exit record (", reason, ") and it could not be moved out of the inbox: ", why], "") }
+      }
+    AttemptExitEntryDecoded { record } => {
+      let handed = enqueue(record.node_id, record.attempt_key)
+      match handed {
+        BeltObligationEnqueueRefused { unit: _, reason } =>
+          match belt_exit_entry_move_at(root: root, entry: entry, from: AttemptExitInbox, to: AttemptExitRefused) {
+            Absent => BeltExitEntryRefused { entry: entry, reason: reason }
+            Present { value: why } => BeltExitEntryRefused { entry: entry, reason: join([reason, "; and it could not be moved out of the inbox: ", why], "") }
+          }
+        BeltObligationStarted { unit: _ } => belt_exit_entry_handed_at(root: root, entry: entry, enqueue: handed)
+        BeltObligationHeld { unit: _ } => belt_exit_entry_handed_at(root: root, entry: entry, enqueue: handed)
+      }
+    }
+  }
+}
+
+fn belt_exit_entry_handed_at(root: String, entry: String, enqueue: BeltObligationEnqueue) -> BeltExitDrainEntry {
+  match belt_exit_entry_move_at(root: root, entry: entry, from: AttemptExitInbox, to: AttemptExitQueued) {
+    Absent => BeltExitEntryHanded { entry: entry, enqueue: enqueue }
+    Present { value: why } => BeltExitEntryRefused { entry: entry, reason: join(["its obligation was handed to its unit, but the entry could not be moved to queued: ", why], "") }
+  }
+}
+
+fn belt_exit_entry_is_worker(entry: String) -> Bool {
+  match attempt_exit_entry_decode(entry_name: entry) {
+    AttemptExitEntryDecoded { record } => record.role == attempt_unit_role_token(role: AttemptWorkerRole)
+    AttemptExitEntryMalformed { entry_name: _, reason: _ } => false
+  }
+}
+
+// THE ORPHAN RECONCILIATION: a `running` entry whose attempt unit is not live has no owner, so it goes
+// back to `queued` where the sweep starts a new run that adopts it. Both rescues end here -- the stop
+// hook's `obligation` entry (the unit ended while the manager was up) and the drain's own start (boot,
+// where no hook ran) -- so a lone orphaned claim recovers with no exit, answer, launch or operator
+// action. A live unit keeps its claim; an unreadable manager leaves it and says so.
+fn belt_exit_running_reconcile_at(root: String, observe: fn(String, String) -> AttemptUnitObservation) -> List<BeltExitDrainEntry> {
+  match attempt_exit_stage_list(instance_root: root, stage: AttemptExitRunning) {
+    AttemptExitStageUnreadable { reason } => [BeltExitEntryRefused { entry: "running", reason: reason }]
+    AttemptExitStageNames { names } =>
+      names |> flat_map(n => match attempt_exit_entry_decode(entry_name: n) {
+        AttemptExitEntryMalformed { entry_name: _, reason } => [BeltExitEntryRefused { entry: n, reason: join(["running entry is not an exit record: ", reason], "") }]
+        AttemptExitEntryDecoded { record } =>
+          match observe(record.node_id, record.attempt_key) {
+            AttemptUnitActive => [] as List<BeltExitDrainEntry>
+            AttemptUnitUnreadable { reason } => [BeltExitEntryRefused { entry: n, reason: join(["the user manager could not say whether the claiming unit is live: ", reason], "") }]
+            AttemptUnitAbsent => belt_exit_orphan_requeue_at(root: root, entry: n)
+            AttemptUnitFinished { exit_status: _ } => belt_exit_orphan_requeue_at(root: root, entry: n)
+          }
+      })
+  }
+}
+
+fn belt_exit_orphan_requeue_at(root: String, entry: String) -> List<BeltExitDrainEntry> {
+  match belt_exit_entry_move_at(root: root, entry: entry, from: AttemptExitRunning, to: AttemptExitQueued) {
+    Absent => [] as List<BeltExitDrainEntry>
+    Present { value: why } => [BeltExitEntryRefused { entry: entry, reason: join(["an orphaned claim could not be returned to queued: ", why], "") }]
+  }
+}
+
+fn belt_exit_entry_is_obligation(entry: String) -> Bool {
+  match attempt_exit_entry_decode(entry_name: entry) {
+    AttemptExitEntryDecoded { record } => record.role == attempt_unit_role_token(role: AttemptObligationRole)
+    AttemptExitEntryMalformed { entry_name: _, reason: _ } => false
+  }
+}
+
+// THE OBLIGATION ENTRY IS A WAKE-UP, NOT A HAND-OFF. Consumed (inbox -> done) only once its attempt's unit
+// is gone -- the hook writes while the unit is still stopping, and consuming it then would lose the very
+// rescue it exists for; a live unit leaves it in the inbox and the level fires again. It is never enqueued.
+fn belt_exit_obligation_entry_at(root: String, entry: String, observe: fn(String, String) -> AttemptUnitObservation) -> List<BeltExitDrainEntry> {
+  match attempt_exit_entry_decode(entry_name: entry) {
+    AttemptExitEntryMalformed { entry_name: _, reason } => [BeltExitEntryRefused { entry: entry, reason: reason }]
+    AttemptExitEntryDecoded { record } =>
+      match observe(record.node_id, record.attempt_key) {
+        AttemptUnitActive => [] as List<BeltExitDrainEntry>
+        AttemptUnitUnreadable { reason } => [BeltExitEntryRefused { entry: entry, reason: join(["the user manager could not say whether the unit is live: ", reason], "") }]
+        AttemptUnitAbsent => belt_exit_obligation_entry_consume_at(root: root, entry: entry)
+        AttemptUnitFinished { exit_status: _ } => belt_exit_obligation_entry_consume_at(root: root, entry: entry)
+      }
+  }
+}
+
+fn belt_exit_obligation_entry_consume_at(root: String, entry: String) -> List<BeltExitDrainEntry> {
+  match belt_exit_entry_move_at(root: root, entry: entry, from: AttemptExitInbox, to: AttemptExitDone) {
+    Absent => [] as List<BeltExitDrainEntry>
+    Present { value: why } => [BeltExitEntryRefused { entry: entry, reason: join(["the obligation entry could not be moved to done: ", why], "") }]
+  }
+}
+
+fn belt_exit_drain_at(root: String, enqueue: fn(String, String) -> BeltObligationEnqueue, launch: fn() -> BeltObligationEnqueue, observe: fn(String, String) -> AttemptUnitObservation) -> BeltExitDrain {
+  match attempt_exit_stage_list(instance_root: root, stage: AttemptExitInbox) {
+    AttemptExitStageUnreadable { reason } => BeltExitDrainRefused { reason: reason }
+    AttemptExitStageNames { names: inbox } => {
+      let reconciled = belt_exit_running_reconcile_at(root: root, observe: observe)
+      let rescues = inbox |> filter(n => belt_exit_entry_is_obligation(entry: n))
+      let names = inbox |> filter(n => !belt_exit_entry_is_obligation(entry: n))
+      BeltExitDrained {
+        entries: concat(concat(reconciled, rescues |> flat_map(n => belt_exit_obligation_entry_at(root: root, entry: n, observe: observe))), concat(
+          names |> map(n => belt_exit_entry_drain_at(root: root, entry: n, enqueue: enqueue)),
+          belt_exit_queued_sweep_at(root: root, skip: names |> flat_map(n => match attempt_exit_entry_decode(entry_name: n) {
+            AttemptExitEntryDecoded { record } => [join([record.node_id, "/", record.attempt_key], "")]
+            AttemptExitEntryMalformed { entry_name: _, reason: _ } => [] as List<String>
+          }), enqueue: enqueue),
+        )),
+        launch: if any(names, n => belt_exit_entry_is_worker(entry: n)) { Present { value: launch() } } else { none },
+      }
+    }
+  }
+}
+
+fn belt_exit_drain_for_instance(instance: HostDashboardInstance) -> BeltExitDrain {
+  belt_exit_drain_at(
+    root: instance.instance_root as String,
+    enqueue: (node_id, attempt_key) => belt_attempt_obligations_enqueue(instance: instance, node_id: node_id, attempt_key: attempt_key),
+    launch: fn() { belt_instance_obligation_enqueue(instance: instance, kind: LaunchObligation) },
+    observe: (node_id, attempt_key) => attempt_unit_observation(unit: belt_attempt_obligation_unit_name(node_id: node_id, attempt_key: attempt_key)),
+  )
+}
+
+fn belt_exit_drain_entry_json(e: BeltExitDrainEntry) -> JsonValue {
+  match e {
+    BeltExitEntryHanded { entry, enqueue } => json_object(members: [json_kv(key: "entry", value: json_string(s: entry)), json_kv(key: "handed", value: belt_obligation_enqueue_json(e: enqueue))])
+    BeltExitEntryRefused { entry, reason } => json_object(members: [json_kv(key: "entry", value: json_string(s: entry)), json_kv(key: "refused", value: json_string(s: reason))])
+  }
+}
+
+fn belt_exit_drain_json(d: BeltExitDrain) -> JsonValue {
+  match d {
+    BeltExitDrained { entries, launch } =>
+      json_object(members: [
+        json_kv(key: "entries", value: json_array(elements: entries |> map(e => belt_exit_drain_entry_json(e: e)))),
+        json_kv(key: "launch", value: match launch { Present { value: l } => belt_obligation_enqueue_json(e: l) Absent => json_string(s: "not owed") }),
+      ])
+    BeltExitDrainRefused { reason } => json_object(members: [json_kv(key: "refused", value: json_string(s: reason))])
+  }
+}
+
+// A REFUSED ENTRY OR A REFUSED LAUNCH FAILS THE DRAIN, after every other entry has been handled: one
+// unhandable exit never holds another, and the failure names each one.
+fn belt_exit_drain_failures(d: BeltExitDrain) -> List<String> {
+  match d {
+    BeltExitDrainRefused { reason } => [join(["the exit inbox could not be read: ", reason], "")]
+    BeltExitDrained { entries, launch } =>
+      concat(
+        entries |> flat_map(e => match e {
+          BeltExitEntryRefused { entry, reason } => [join([entry, ": ", reason], "")]
+          BeltExitEntryHanded { entry: _, enqueue: _ } => [] as List<String>
+        }),
+        match launch {
+          Present { value: BeltObligationEnqueueRefused { unit, reason } } => [join(["launch ", unit as String, ": ", reason], "")]
+          Present { value: BeltObligationStarted { unit: _ } } => [] as List<String>
+          Present { value: BeltObligationHeld { unit: _ } } => [] as List<String>
+          Absent => [] as List<String>
+        },
+      )
+  }
+}
+
+// THE RUN CLAIMS A BOUNDED POPULATION BEFORE ITS FIRST OBSERVATION, AND ONLY WHAT IT CLAIMED IS SETTLED
+// (bold-bee-114, 2026-10-09: lost wakeup and false acknowledgment). Claiming is the create-only move
+// queued -> running of every entry this attempt has in the spool at that instant -- an entry the run's
+// observations are guaranteed to have seen, because the exit was recorded before the claim and the
+// observations come after it. The receipt names the claim (`claimed_exits`); settlement moves exactly
+// those entries running -> done once the receipt is on disk. An exit that arrives later -- after the
+// final observation but before settlement, after settlement but before the unit exits, or while the
+// unit is gone -- is not in the claim, so nothing acknowledges it: it stays queued, the queued level
+// starts the drain, and the sweep hands its attempt to a NEW run that claims it. A held unit is never
+// proof the active run includes a new event.
+//
+// A `running` entry found at claim time belongs to a predecessor whose run died before settling: the
+// unit name is the exclusive hold, so no live run can own it. The new run adopts it into its claim.
+type BeltExitClaim
+  = BeltExitClaimed { entries: List<String> }
+  | BeltExitClaimRefused { reason: String }
+
+fn belt_exit_entry_is_for(entry: String, node_id: String, attempt_key: String) -> Bool {
+  match attempt_exit_entry_decode(entry_name: entry) {
+    AttemptExitEntryDecoded { record } => record.node_id == node_id && record.attempt_key == attempt_key
+    AttemptExitEntryMalformed { entry_name: _, reason: _ } => false
+  }
+}
+
+fn belt_exit_entries_claim_at(root: String, node_id: String, attempt_key: String) -> BeltExitClaim {
+  match attempt_exit_stage_list(instance_root: root, stage: AttemptExitQueued) {
+    AttemptExitStageUnreadable { reason } => BeltExitClaimRefused { reason: join(["the queued exit entries could not be listed: ", reason], "") }
+    AttemptExitStageNames { names: queued } =>
+      match attempt_exit_stage_list(instance_root: root, stage: AttemptExitRunning) {
+        AttemptExitStageUnreadable { reason } => BeltExitClaimRefused { reason: join(["the running exit entries could not be listed: ", reason], "") }
+        AttemptExitStageNames { names: running } => {
+          let mine = queued |> filter(n => belt_exit_entry_is_for(entry: n, node_id: node_id, attempt_key: attempt_key))
+          let failed = mine |> flat_map(n => match belt_exit_entry_move_at(root: root, entry: n, from: AttemptExitQueued, to: AttemptExitRunning) {
+            Absent => [] as List<String>
+            Present { value: why } => [join([n, ": ", why], "")]
+          })
+          if count(failed) == 0 {
+            BeltExitClaimed { entries: concat(mine, running |> filter(n => belt_exit_entry_is_for(entry: n, node_id: node_id, attempt_key: attempt_key))) }
+          } else {
+            BeltExitClaimRefused { reason: join(["exit entries could not be claimed: ", join(failed, "; ")], "") }
+          }
+        }
+      }
+  }
+}
+
+fn belt_exit_entries_claim(instance: HostDashboardInstance, node_id: String, attempt_key: String) -> BeltExitClaim {
+  belt_exit_entries_claim_at(root: instance.instance_root as String, node_id: node_id, attempt_key: attempt_key)
+}
+
+// SETTLEMENT MOVES ONLY THE CLAIM running -> done, after the receipt that names it is written.
+fn belt_exit_entries_settle_at(root: String, claimed: List<String>) -> List<String> {
+  claimed |> flat_map(n => match belt_exit_entry_move_at(root: root, entry: n, from: AttemptExitRunning, to: AttemptExitDone) {
+    Absent => [] as List<String>
+    Present { value: why } => [join([n, ": ", why], "")]
+  })
+}
+
+fn belt_exit_entries_settle(instance: HostDashboardInstance, claimed: List<String>) -> List<String> {
+  belt_exit_entries_settle_at(root: instance.instance_root as String, claimed: claimed)
+}
+
+// EXITS THIS ATTEMPT STILL HAS UNCLAIMED, listed from the queue: the run's own re-check after settling
+// (a second bounded pass picks up an arrival the first one could not have seen).
+fn belt_exit_entries_pending_at(root: String, node_id: String, attempt_key: String) -> BeltExitClaim {
+  match attempt_exit_stage_list(instance_root: root, stage: AttemptExitQueued) {
+    AttemptExitStageUnreadable { reason } => BeltExitClaimRefused { reason: join(["the queued exit entries could not be listed: ", reason], "") }
+    AttemptExitStageNames { names } => BeltExitClaimed { entries: names |> filter(n => belt_exit_entry_is_for(entry: n, node_id: node_id, attempt_key: attempt_key)) }
+  }
+}
+
+// THE QUEUED SWEEP: the level-triggered half of the hand-off. Every attempt with an entry in `queued`
+// that this drain did not just hand off is enqueued again -- a held unit is a no-op (its own re-check or
+// the next drain picks the entry up), a gone unit is started and its run claims the entry. One enqueue
+// per attempt, whatever its entry count.
+fn belt_exit_queued_sweep_at(root: String, skip: List<String>, enqueue: fn(String, String) -> BeltObligationEnqueue) -> List<BeltExitDrainEntry> {
+  match attempt_exit_stage_list(instance_root: root, stage: AttemptExitQueued) {
+    AttemptExitStageUnreadable { reason } => [BeltExitEntryRefused { entry: "queued", reason: reason }]
+    AttemptExitStageNames { names } =>
+      fold(names, init: [] as List<BeltExitDrainEntry>, f: (acc, n) => match attempt_exit_entry_decode(entry_name: n) {
+        AttemptExitEntryMalformed { entry_name: _, reason } => concat(acc, [BeltExitEntryRefused { entry: n, reason: join(["queued entry is not an exit record: ", reason], "") }])
+        AttemptExitEntryDecoded { record } => {
+          let key = join([record.node_id, "/", record.attempt_key], "")
+          if any(skip, k => k == key) || any(acc, e => match e { BeltExitEntryHanded { entry, enqueue: _ } => belt_exit_entry_is_for(entry: entry, node_id: record.node_id, attempt_key: record.attempt_key) _ => false }) {
+            acc
+          } else {
+            let handed = enqueue(record.node_id, record.attempt_key)
+            match handed {
+              BeltObligationEnqueueRefused { unit: _, reason } => concat(acc, [BeltExitEntryRefused { entry: n, reason: reason }])
+              BeltObligationStarted { unit: _ } => concat(acc, [BeltExitEntryHanded { entry: n, enqueue: handed }])
+              BeltObligationHeld { unit: _ } => concat(acc, [BeltExitEntryHanded { entry: n, enqueue: handed }])
+            }
+          }
+        }
+      })
+  }
+}
+
+// THE EXIT SPOOL'S UNCONSUMED ENTRIES WITH THEIR MODIFICATION TIMES, for the launch receipt's event
+// backlog row (gunbc.roadmap_launch_deployment_observe event_backlog_judge). An entry's directory is
+// created by the stop hook and never written after, so its mtime is the instant the exit was recorded.
+// Inbox and queued only: done and refused are not a backlog -- one is consumed, the other is a refusal
+// the drain already reported. Any unreadable listing or unparseable time refuses the read whole.
+type BeltExitSpoolEntryTime {
+  stage: AttemptExitSpoolStage
+  entry: String
+  mtime_epoch: EpochSecs
+}
+
+type BeltExitSpoolTimes
+  = BeltExitSpoolTimesRead { entries: List<BeltExitSpoolEntryTime> }
+  | BeltExitSpoolTimesUnreadable { reason: String }
+
+fn belt_exit_spool_stage_times(instance: HostDashboardInstance, stage: AttemptExitSpoolStage, label: String) -> BeltExitSpoolTimes {
+  let root = instance.instance_root as String
+  match attempt_exit_stage_list(instance_root: root, stage: stage) {
+    AttemptExitStageUnreadable { reason } => BeltExitSpoolTimesUnreadable { reason: reason }
+    AttemptExitStageNames { names } =>
+      fold(names, init: BeltExitSpoolTimesRead { entries: [] }, f: (acc, n) => match acc {
+        BeltExitSpoolTimesUnreadable { reason } => BeltExitSpoolTimesUnreadable { reason: reason }
+        BeltExitSpoolTimesRead { entries } => {
+          let cmd = stat_mtime_epoch_command(path: join([attempt_exit_spool_stage_dir(instance_root: root, stage: stage), "/", n], ""))
+          match belt_exec(cmd: host_exec_argv(program: cmd.program.invocation as String, args: cmd.arguments), workdir: belt_observe_workdir as String) {
+            ExecOk { stdout } =>
+              match parse_int(text: trim(stdout)) {
+                Present { value: t } =>
+                  if t >= 0 {
+                    BeltExitSpoolTimesRead { entries: concat(entries, [BeltExitSpoolEntryTime { stage: stage, entry: n, mtime_epoch: t as EpochSecs }]) }
+                  } else {
+                    BeltExitSpoolTimesUnreadable { reason: join(["the modification time of ", label, " entry ", n, " is negative: ", stdout], "") }
+                  }
+                Absent => BeltExitSpoolTimesUnreadable { reason: join(["the modification time of ", label, " entry ", n, " did not parse: ", stdout], "") }
+              }
+            ExecFailed { program: _, exit_code: _, stderr } => BeltExitSpoolTimesUnreadable { reason: join(["the modification time of ", label, " entry ", n, " could not be read: ", stderr], "") }
+            ExecRefused { program: _, reason } => BeltExitSpoolTimesUnreadable { reason: reason }
+          }
+        }
+      })
+  }
+}
+
+fn belt_exit_spool_times(instance: HostDashboardInstance) -> BeltExitSpoolTimes {
+  match belt_exit_spool_stage_times(instance: instance, stage: AttemptExitInbox, label: "inbox") {
+    BeltExitSpoolTimesUnreadable { reason } => BeltExitSpoolTimesUnreadable { reason: reason }
+    BeltExitSpoolTimesRead { entries: inbox } =>
+      match belt_exit_spool_stage_times(instance: instance, stage: AttemptExitQueued, label: "queued") {
+        BeltExitSpoolTimesUnreadable { reason } => BeltExitSpoolTimesUnreadable { reason: reason }
+        BeltExitSpoolTimesRead { entries: queued } =>
+          match belt_exit_spool_stage_times(instance: instance, stage: AttemptExitRunning, label: "running") {
+            BeltExitSpoolTimesUnreadable { reason } => BeltExitSpoolTimesUnreadable { reason: reason }
+            BeltExitSpoolTimesRead { entries: running } => BeltExitSpoolTimesRead { entries: concat(inbox, concat(queued, running)) }
+          }
+      }
+  }
+}
diff --git a/dag/gunbc/roadmap/roadmap_belt_obligation.dag b/dag/gunbc/roadmap/roadmap_belt_obligation.dag
new file mode 100644
index 00000000000..4c66fc2d510
--- /dev/null
+++ b/dag/gunbc/roadmap/roadmap_belt_obligation.dag
@@ -0,0 +1,222 @@
+module gunbc.roadmap.roadmap_belt_obligation
+
+import std.types { String, NonEmptyStr, List, Bool, Int }
+import gunbc.roadmap_workflow_stage {
+  WorkflowSegment, WorkflowSegmentKind, WorkflowSegmentState,
+  SubmissionWorkflowSegment, VerificationWorkflowSegment, PublicationWorkflowSegment, ReviewWorkflowSegment, GoalAuditWorkflowSegment,
+  WorkflowSegmentPending, WorkflowSegmentActive, WorkflowSegmentComplete, WorkflowSegmentFailed, WorkflowSegmentRefused, WorkflowSegmentStopped,
+  workflow_segment_of_kind,
+}
+import gunbc.roadmap_provider_events {
+  ProviderExecutionState, ProviderNotStarted, ProviderStarting, ProviderAwaitingSeat, ProviderRunning,
+  ProviderCompleted, ProviderFailed, ProviderBudgetSpent, ProviderEventsRefused,
+}
+
+// THE BELT'S WORK AS OBLIGATIONS, NOT PHASES (dogfood interventions #6 and #4, gunbc#13124; the
+// "belt demoted" owner ruling of 2026-09-22 in docs/plans/harness-work-lifecycle.md; the design at
+// docs/plans/belt-event-driven-obligations.md).
+//
+// The tick used to run capture, verify, review, audit, publish and metering over EVERY attempt, in
+// that order, inside one process, followed by the result return, the served observation and the
+// dogfood start record. Each of those is a separate fact owed to a separate subject, and fusing them
+// made every stage's latency every other stage's latency: on srv2 on 2026-10-03 one slow capture
+// held every tick at its 90-minute bound for ten hours, so nothing behind it ran for any attempt.
+//
+// An obligation is (kind, subject). Its subject is an attempt for the per-attempt kinds and the
+// instance for the instance kinds. WHETHER IT IS OUTSTANDING IS DERIVED, never stored: it is read off
+// the attempt's own durable evidence -- the segments gunbc.roadmap_workflow_progress already projects
+// from the attempt's receipts -- so there is no second record of what the receipts say (bold-bee-114
+// ruling, Q1). A queued obligation is only its identity.
+
+type BeltAttemptObligationKind
+  = CaptureObligation
+  | VerifyObligation
+  | ReviewObligation
+  | AuditObligation
+  | PublishObligation
+
+// THE ORDER IN WHICH ONE ATTEMPT'S OBLIGATIONS BECOME ELIGIBLE. It is the evidence dependency, not a
+// schedule: verify needs a captured submission, review and audit need a verified head, publish needs
+// a reviewed one. Review and audit are siblings -- both launch asynchronous units and neither waits on
+// the other -- and they are listed in a fixed order only so a run is deterministic.
+data belt_attempt_obligation_order: List<BeltAttemptObligationKind> = [
+  CaptureObligation, VerifyObligation, ReviewObligation, AuditObligation, PublishObligation,
+]
+
+fn belt_attempt_obligation_kind_key(kind: BeltAttemptObligationKind) -> String {
+  match kind {
+    CaptureObligation => "capture"
+    VerifyObligation => "verify"
+    ReviewObligation => "review"
+    AuditObligation => "audit"
+    PublishObligation => "publish"
+  }
+}
+
+fn belt_attempt_obligation_kind_rank(kind: BeltAttemptObligationKind) -> Int {
+  match kind {
+    CaptureObligation => 0
+    VerifyObligation => 1
+    ReviewObligation => 2
+    AuditObligation => 2
+    PublishObligation => 3
+  }
+}
+
+// THE INSTANCE'S OBLIGATIONS: each a fold over the instance's durable records, owed whenever any
+// attempt's record moves. None of them is a phase of any other and none waits on one.
+//
+// LAUNCH IS ONE OF THEM, and it is what the belt tick now is: launch admission over the ready frontier,
+// spawn and teardown, and discovery. It is owed when capacity may have freed -- a worker's exit -- or
+// when an operator asks; there is no clock. It has ONE unit name per instance, so two launches never
+// run at once and capacity is never admitted twice; the deployment's belt service only queues it.
+type BeltInstanceObligationKind
+  = LaunchObligation
+  | ServedObservationObligation
+  | ResultReturnObligation
+  | MeteringObligation
+  | DogfoodStartRecordObligation
+  | SnapshotCensusObligation
+
+data belt_instance_obligation_kinds: List<BeltInstanceObligationKind> = [
+  LaunchObligation, MeteringObligation, ResultReturnObligation, ServedObservationObligation, DogfoodStartRecordObligation, SnapshotCensusObligation,
+]
+
+// THE INSTANCE OBLIGATIONS AN ATTEMPT'S RECORD MOVING MAKES OWED: every one but launch. Launch is owed
+// on a worker's exit (the exit drain queues it) and on an operator's request, not on every record an
+// obligation writes -- a launch per review verdict would admit against unchanged capacity for nothing.
+data belt_record_moved_obligation_kinds: List<BeltInstanceObligationKind> = [
+  MeteringObligation, ResultReturnObligation, ServedObservationObligation, DogfoodStartRecordObligation, SnapshotCensusObligation,
+]
+
+fn belt_instance_obligation_kind_key(kind: BeltInstanceObligationKind) -> String {
+  match kind {
+    LaunchObligation => "launch"
+    ServedObservationObligation => "observe"
+    ResultReturnObligation => "result-return"
+    MeteringObligation => "metering"
+    DogfoodStartRecordObligation => "dogfood-start"
+    SnapshotCensusObligation => "snapshot-census"
+  }
+}
+
+fn belt_instance_obligation_kind_of_key(key: String) -> BeltInstanceObligationKind? {
+  belt_instance_obligation_kinds |> filter(k => belt_instance_obligation_kind_key(kind: k) == key) |> first()
+}
+
+// A STAGE IS SETTLED WHEN ITS EVIDENCE HAS A VERDICT. Complete, Failed, Refused and Stopped are
+// verdicts; Pending and Active are not. A failed or refused stage is NOT outstanding: it stops the
+// line for that attempt, loudly, and is resumed by the operator (2026-10-03 manual-resume ruling) --
+// re-running it automatically on every discovery would be the retry loop that ruling refuses.
+fn belt_segment_unsettled(segments: List<WorkflowSegment>, kind: WorkflowSegmentKind) -> Bool {
+  match workflow_segment_of_kind(segments: segments, kind: kind) {
+    Absent => false
+    Present { value: s } =>
+      match s.state {
+        WorkflowSegmentPending => true
+        WorkflowSegmentActive => true
+        WorkflowSegmentComplete => false
+        WorkflowSegmentFailed => false
+        WorkflowSegmentRefused => false
+        WorkflowSegmentStopped => false
+      }
+  }
+}
+
+fn belt_segment_complete(segments: List<WorkflowSegment>, kind: WorkflowSegmentKind) -> Bool {
+  match workflow_segment_of_kind(segments: segments, kind: kind) {
+    Absent => false
+    Present { value: s } =>
+      match s.state {
+        WorkflowSegmentComplete => true
+        WorkflowSegmentPending => false
+        WorkflowSegmentActive => false
+        WorkflowSegmentFailed => false
+        WorkflowSegmentRefused => false
+        WorkflowSegmentStopped => false
+      }
+  }
+}
+
+// THE WORKER HAS ENDED when the provider's own evidence says so -- the same three arms
+// gunbc.roadmap.roadmap_belt_commit belt_commit_decision treats as terminal, so capture is outstanding
+// exactly when the capture core would act.
+fn belt_provider_terminal(provider: ProviderExecutionState) -> Bool {
+  match provider {
+    ProviderCompleted { activity: _ } => true
+    ProviderFailed { activity: _, detail: _ } => true
+    ProviderBudgetSpent { activity: _, detail: _ } => true
+    ProviderNotStarted => false
+    ProviderStarting { activity: _ } => false
+    ProviderAwaitingSeat { detail: _ } => false
+    ProviderRunning { activity: _ } => false
+    ProviderEventsRefused { activity: _, detail: _ } => false
+  }
+}
+
+// ONE ATTEMPT'S OUTSTANDING OBLIGATIONS, in eligibility order. Pure over the attempt's projected
+// evidence, so it is the ONE derivation behind both the event chain (after an obligation runs, its
+// attempt is re-observed and this says what is next) and the anti-entropy discovery (which applies it
+// to every observed attempt).
+fn belt_attempt_outstanding(provider: ProviderExecutionState, segments: List<WorkflowSegment>) -> List<BeltAttemptObligationKind> {
+  belt_attempt_obligation_order |> filter(kind => belt_attempt_obligation_outstanding(kind: kind, provider: provider, segments: segments))
+}
+
+fn belt_attempt_obligation_outstanding(kind: BeltAttemptObligationKind, provider: ProviderExecutionState, segments: List<WorkflowSegment>) -> Bool {
+  match kind {
+    CaptureObligation => belt_provider_terminal(provider: provider) && belt_segment_unsettled(segments: segments, kind: SubmissionWorkflowSegment)
+    VerifyObligation => belt_segment_complete(segments: segments, kind: SubmissionWorkflowSegment) && belt_segment_unsettled(segments: segments, kind: VerificationWorkflowSegment)
+    ReviewObligation => belt_segment_complete(segments: segments, kind: VerificationWorkflowSegment) && belt_segment_unsettled(segments: segments, kind: ReviewWorkflowSegment)
+    AuditObligation => belt_segment_complete(segments: segments, kind: VerificationWorkflowSegment) && belt_segment_unsettled(segments: segments, kind: GoalAuditWorkflowSegment)
+    PublishObligation => belt_segment_complete(segments: segments, kind: ReviewWorkflowSegment) && belt_segment_unsettled(segments: segments, kind: PublicationWorkflowSegment)
+  }
+}
+
+// AFTER `ran` HAS RUN, ONLY WHAT LIES STRICTLY DOWNSTREAM OF IT IS NEXT. The chain never re-invokes
+// the kind that just ran or anything before it: an obligation that ran and is still unsettled (a
+// capture that found nothing to commit, a verify still deferred) is waiting on something outside
+// this process, and re-running it here would be a loop. Its next chance is its own event or the
+// discovery backstop.
+fn belt_attempt_next_after(ran: BeltAttemptObligationKind, outstanding: List<BeltAttemptObligationKind>) -> List<BeltAttemptObligationKind> {
+  outstanding |> filter(k => belt_attempt_obligation_kind_rank(kind: k) > belt_attempt_obligation_kind_rank(kind: ran))
+}
+
+// ── IDENTITY ────────────────────────────────────────────────────────────────────────────────────
+//
+// ONE UNIT PER ATTEMPT, ONE PER INSTANCE OBLIGATION. Every `gunbc run` loads the corpus, so a unit per
+// (kind, attempt) would pay that load once per kind; the attempt's unit runs its outstanding kinds in
+// order, each still its own ensure with its own receipt. Unrelated attempts never share a unit, so a
+// long verify on one cannot delay another's publish. THE UNIT NAME IS THE EXCLUSIVE HOLD: the user
+// manager refuses a second unit of a loaded name, so a second trigger while one runs is a no-op and
+// two processes never act on one attempt at once. systemd unit names admit [A-Za-z0-9:_.-]; node ids
+// are kebab-case and attempt keys hex, so the name needs no escaping, and an id outside that alphabet
+// is refused by the manager rather than reinterpreted.
+fn belt_attempt_obligation_unit_name(node_id: String, attempt_key: String) -> NonEmptyStr {
+  join(["gunbc-obligation-attempt-", node_id, "-", attempt_key, ".service"], "") as NonEmptyStr
+}
+
+fn belt_instance_obligation_unit_name(instance_id: String, kind: BeltInstanceObligationKind) -> NonEmptyStr {
+  join(["gunbc-obligation-", instance_id, "-", belt_instance_obligation_kind_key(kind: kind), ".service"], "") as NonEmptyStr
+}
+
+// WHAT ONE ENQUEUE DID. Started: the unit was handed the obligation and owns it now. Held: a unit of
+// that name is already loaded, so the obligation is already being worked -- a no-op, not a failure.
+// Refused: the manager would not start it, located.
+type BeltObligationEnqueue
+  = BeltObligationStarted { unit: NonEmptyStr }
+  | BeltObligationHeld { unit: NonEmptyStr }
+  | BeltObligationEnqueueRefused { unit: NonEmptyStr, reason: String }
+
+fn belt_obligation_enqueue_refused(e: BeltObligationEnqueue) -> Bool {
+  match e {
+    BeltObligationStarted { unit: _ } => false
+    BeltObligationHeld { unit: _ } => false
+    BeltObligationEnqueueRefused { unit: _, reason: _ } => true
+  }
+}
+
+// THE ANTI-ENTROPY BOUND. Discovery reads every attempt's evidence (it must, to know which are owed)
+// but hands at most this many attempts to units in one pass: it discovers and queues, it never does the
+// work, and a bound keeps one pass from starting more corpus loads than the host has room for. Attempts
+// past the bound are still outstanding and are found by the next pass or by their own events.
+data belt_discovery_attempt_bound: Int = 8
diff --git a/dag/gunbc/roadmap/roadmap_belt_tick_cli.dag b/dag/gunbc/roadmap/roadmap_belt_tick_cli.dag
index 945061e8a1e..d9a3f5693b5 100644
--- a/dag/gunbc/roadmap/roadmap_belt_tick_cli.dag
+++ b/dag/gunbc/roadmap/roadmap_belt_tick_cli.dag
@@ -28,6 +28,11 @@ import gunbc.roadmap_belt_actuate {
   EscalateOneConvened, EscalateOneGateNoOp, EscalateOneNotDue, EscalateOneRefused,
   belt_integrate_candidate_core_for_instance, BeltIntegrationCoreStep,
   IntegrationCoreDeferred, IntegrationCoreUnreadable, IntegrationCoreBlocked, IntegrationCoreIntegrated,
+  belt_instance_obligation_enqueue, belt_obligation_enqueue_json,
+  belt_attempt_obligations_run, belt_attempt_obligation_receipt_write, belt_attempt_obligation_run_json, belt_attempt_obligation_run_failure,
+  belt_exit_entries_settle, belt_exit_entries_claim, belt_exit_entries_pending_at, BeltExitClaimed, BeltExitClaimRefused, belt_exit_drain_for_instance, belt_exit_drain_json, belt_exit_drain_failures,
+  belt_discover_for_instance, belt_discovery_json, belt_discovery_pass_outcome,
+  belt_metering_attempts_for_instance, belt_metering_pass_outcome_from,
 }
 import gunbc.roadmap_served_observation { served_observation_observe_and_write_for_instance }
 import gunbc.roadmap_dogfood_route {
@@ -39,34 +44,31 @@ import gunbc.roadmap.roadmap_result_returned {
   ResultReturnPassRun, result_return_attempts_for_instance, result_return_pass_exit, result_return_pass_failure,
 }
 import gunbc.roadmap.roadmap_event_carrier { CarrierSnapshotClose, carrier_snapshot_close_failures }
+import gunbc.roadmap.roadmap_belt_obligation {
+  BeltInstanceObligationKind, LaunchObligation, ServedObservationObligation, ResultReturnObligation, MeteringObligation,
+  DogfoodStartRecordObligation, SnapshotCensusObligation, belt_record_moved_obligation_kinds, belt_instance_obligation_kind_of_key,
+  BeltObligationEnqueue, BeltObligationStarted, BeltObligationHeld, BeltObligationEnqueueRefused,
+}
 import gunbc.roadmap.roadmap_event_snapshot_census { roadmap_snapshot_census_for_instance, belt_tick_exit_with_snapshot_census }
 import extdeps.filesystem.filesystem_io { Filesystem }
 import extdeps.languages.json.emit { json_array }
 import gunbc.roadmap.roadmap_review_function { review_report_json }
 
-// THE SCHEDULED ENTRYPOINT, and the one place the belt's three persisted artifacts are produced
-// together: the BeltTickReceipt (what the tick did), the served observation (what the host
-// looked like when it did it), and the snapshot census receipt (which of this instance's event-log
-// snapshot worktrees are registered; gunbc.roadmap.roadmap_event_snapshot_census). It lives outside gunbc.roadmap_belt_actuate because the observation
-// snapshot module imports the belt's observers, so the tick that also writes the snapshot must sit
-// above both — the import graph's only law is acyclicity (DESIGN 3).
+// THE LAUNCH ENTRYPOINT, and the home of every belt entry, because the served observation module
+// imports the belt's observers, so an entry that also writes the observation must sit above both --
+// the import graph's only law is acyclicity (DESIGN 3).
 //
-// The ProcessExit entrypoint — this is what `gunbc run --function belt_run_once_cli` invokes
-// (belt_run_once_json returns String, which `gunbc run` rejects; belt_run_once_cli is its runnable
-// wrapper). EXIT SEMANTICS (operator P0, 2026-08-02): exit 0 when the tick COMPLETED and PERSISTED
-// its BeltTickReceipt and its served observation — spawn failures, recorded validation refusals,
-// and observe_refused on the spawn pass do NOT flip the exit, because those are counted outcomes
-// in the receipt, not a failure to run or record the tick. Nonzero ONLY when the tick could not
-// persist its receipt or its served observation (BeltPassFailed on write), could not append a
-// terminal attempt's result to its issue's event history (gunbc.roadmap.roadmap_result_returned
-// result_return_pass_exit -- an answer owed to a requester and not delivered), when
-// GUNBC_BELT_SPAWN_WORKDIR is missing/empty, when the dogfood start record
-// (gunbc.roadmap_dogfood_route dogfood_start_record_for_instance), which runs only after the
-// served observation is persisted, refuses, when the result return could not remove an event-log
-// snapshot worktree it owned (belt_tick_exit_with_snapshot_closes -- the append's own result
-// stands, and a rerun of the pass is idempotent), or when the snapshot census could not be read or
-// its receipt could not be written (belt_tick_exit_with_snapshot_census). A snapshot the census
-// finds present across two censuses does NOT flip the exit: it is a finding on that receipt.
+// The tick is no longer the scheduled pass that produced the belt's artifacts together (dogfood
+// intervention #6). It is the LAUNCH obligation: admission, spawn, teardown and discovery, then it
+// writes its BeltTickReceipt and queues the instance obligations a moved record makes owed (served
+// observation, result return, metering, dogfood start record, snapshot census), each of which runs in
+// its own unit (belt_instance_obligation_cli) so none can hold another or the launch. EXIT
+// SEMANTICS (operator P0, 2026-08-02, unchanged in kind): exit 0 when the tick COMPLETED, PERSISTED
+// its BeltTickReceipt and handed its instance obligations to their units -- spawn failures, recorded
+// refusals and observe_refused on the spawn pass are counted outcomes, not failures to run. Nonzero
+// when the receipt could not be persisted, when GUNBC_BELT_SPAWN_WORKDIR is missing or empty, or when
+// an instance obligation could not be handed to its unit; each instance obligation's own failure is
+// its own unit's exit (belt_instance_obligation_run), named there.
 // systemd therefore distinguishes 'tick crashed' from
 // 'tick ran, work refused'. The stdout JSON (roadmap-belt-tick/v1) remains the per-tick
 // operational receipt for journald; the persisted BeltTickReceipt is what /workflow.json's
@@ -130,10 +132,9 @@ fn belt_run_once_cli_in(spawn_workdir: String) -> ProcessExit {
             r,
           ], ""))
         BeltPassRecorded =>
-          belt_tick_tail_after_result_return(
-            instance: instance,
-            observed_at: observed_at,
-            returned: result_return_attempts_for_instance(instance: instance, recorded_at: observed_at),
+          belt_obligations_enqueued_exit(
+            context: "belt launch",
+            enqueues: belt_record_moved_obligation_kinds |> map(k => belt_instance_obligation_enqueue(instance: instance, kind: k)),
           )
         BeltPassDeferred { reason: r } =>
           exit_failure(reason: join(["belt tick receipt write returned deferred: ", r], ""))
@@ -157,30 +158,6 @@ fn belt_start_record_exit(start: DogfoodStartRecord) -> ProcessExit {
   }
 }
 
-// THE TAIL IN ITS ORDER, EACH STEP A DEPENDENCY OF THE NEXT: result return, then served
-// observation, then start record. The result return has already run -- its pass is this function's
-// argument -- and the observation is taken INSIDE a match on that pass, so it cannot be evaluated
-// before the pass exists; every arm of the pass proceeds to the observation, because an undelivered
-// result must not freeze the page. The start record runs only after a persisted observation
-// (belt_observation_then_start_exit). So the standing the dashboard serves already reads an event
-// this tick appended, and a slow or failing recorder cannot stop the page being written.
-fn belt_tick_tail_after_result_return(instance: HostDashboardInstance, observed_at: String, returned: ResultReturnPassRun) -> ProcessExit {
-  belt_tick_exit_with_snapshot_census(
-    exit: belt_tick_exit_with_snapshot_closes(
-      exit: belt_tick_result_tail_exit(
-        returned: returned.pass,
-        tail: match returned.pass {
-          ResultReturnPassRan { outcomes: _ } => belt_observation_then_start_exit(instance: instance, observed_at: observed_at)
-          ResultReturnPassWithheld { reason: _ } => belt_observation_then_start_exit(instance: instance, observed_at: observed_at)
-          ResultReturnPassRefused { step: _, reason: _ } => belt_observation_then_start_exit(instance: instance, observed_at: observed_at)
-        },
-      ),
-      closes: returned.closes,
-    ),
-    census: roadmap_snapshot_census_for_instance(instance: instance, observed_at: observed_at),
-  )
-}
-
 // AN EVENT-LOG SNAPSHOT THE RESULT RETURN LEFT BEHIND STOPS THE LINE AT THE TICK'S EXIT, pure. The
 // pass's own outcomes are untouched: what was appended stays appended and is reported as it was.
 // The tick is the recurring caller, so a worktree it cannot remove would otherwise accumulate one
@@ -199,29 +176,6 @@ fn belt_tick_exit_with_snapshot_closes(exit: ProcessExit, closes: List<CarrierSn
   }
 }
 
-fn belt_observation_then_start_exit(instance: HostDashboardInstance, observed_at: String) -> ProcessExit {
-  match belt_served_observation_exit(instance: instance, observed_at: observed_at) {
-    ExitFailure { code, reason } => ExitFailure { code: code, reason: reason }
-    ExitSuccess => belt_start_record_exit(start: dogfood_start_record_for_instance(instance: instance))
-  }
-}
-
-// THE ONE JOIN OF THE RESULT RETURN WITH THE REST OF THE TAIL, pure: `tail` is the exit of the
-// observation-then-start chain. The result return runs on EVERY tick, including one whose passes
-// were withheld: an answer owed to a requester is a standing obligation that an unrelated launch
-// refusal does not discharge. When both the result return and the tail failed, the exit names
-// both; neither cause replaces the other.
-fn belt_tick_result_tail_exit(returned: ResultReturnPass, tail: ProcessExit) -> ProcessExit {
-  match tail {
-    ExitSuccess => result_return_pass_exit(pass: returned)
-    ExitFailure { code, reason } =>
-      match result_return_pass_failure(pass: returned) {
-        Absent => ExitFailure { code: code, reason: reason }
-        Present { value: undelivered } => ExitFailure { code: code, reason: join([reason, "\n", undelivered], "") }
-      }
-  }
-}
-
 fn belt_served_observation_exit(instance: HostDashboardInstance, observed_at: String) -> ProcessExit {
   match served_observation_observe_and_write_for_instance(instance: instance, observed_at: observed_at) {
     BeltPassRecorded => ExitSuccess
@@ -421,3 +375,146 @@ fn belt_integrate_one_cli(repo_root: String, node_id: String, attempt_key: Strin
     }
   }
 }
+
+
+// ------------------------------------------------------------------------------------------------
+// THE OBLIGATION ENTRIES (dogfood interventions #6 and #4, gunbc#13124;
+// docs/plans/belt-event-driven-obligations.md). The belt tick is demoted to launch: admission, spawn,
+// teardown and discovery. Everything it used to run after those is an obligation with its own unit,
+// started by the event that made it owed:
+//   - belt_attempt_obligations_cli  one attempt's capture, verify, review, audit and publish
+//                                   (gunbc.roadmap_belt_actuate belt_attempt_obligations_run)
+//   - belt_instance_obligation_cli  one instance fold: launch, served observation, result return,
+//                                   metering, dogfood start record, snapshot census
+//   - belt_exit_drain_cli           hands each recorded unit exit to its attempt's unit
+//   - belt_discover_once_cli        the bounded anti-entropy pass: discovers and queues, never works
+//   - belt_launch_enqueue_cli       what the deployment's belt service runs: queue the one launch
+// Every entry resolves its instance from GUNBC_BELT_SPAWN_WORKDIR, as belt_run_once_cli does and for
+// that function's fail-closed reason.
+// ------------------------------------------------------------------------------------------------
+
+fn belt_instance_from_env(entry: String, then: fn(HostDashboardInstance) -> ProcessExit) -> ProcessExit {
+  match shell.Env.Get(name: belt_spawn_workdir_env_var).value {
+    Absent => exit_failure(reason: join([entry, ": GUNBC_BELT_SPAWN_WORKDIR not set -- the instance is a per-deployment fact (fail-closed)"], ""))
+    Present { value: workdir } =>
+      if string_length(s: workdir) == 0 {
+        exit_failure(reason: join([entry, ": GUNBC_BELT_SPAWN_WORKDIR is empty -- the instance is a per-deployment fact (fail-closed)"], ""))
+      } else {
+        match dashboard_instance_for_repo_root(repo_root: workdir) {
+          DashboardInstanceRootUnknown { repo_root: w } => exit_failure(reason: join([entry, ": GUNBC_BELT_SPAWN_WORKDIR does not match a known dashboard instance repo root: ", w], ""))
+          DashboardInstanceResolved { instance } => then(instance)
+        }
+      }
+  }
+}
+
+// A QUEUE HAND-OFF THAT WAS REFUSED FAILS THE CALLER, LOCATED; started and held succeed.
+fn belt_obligations_enqueued_exit(context: String, enqueues: List<BeltObligationEnqueue>) -> ProcessExit {
+  let refused = enqueues |> flat_map(e => match e {
+    BeltObligationEnqueueRefused { unit, reason } => [join([unit as String, ": ", reason], "")]
+    BeltObligationStarted { unit: _ } => [] as List<String>
+    BeltObligationHeld { unit: _ } => [] as List<String>
+  })
+  if count(refused) == 0 { ExitSuccess } else { exit_failure(reason: join([context, ": ", to_string(value: count(refused)), " obligation(s) could not be handed to their unit: ", join(refused, "; ")], "")) }
+}
+
+// ONE PASS IS: CLAIM the attempt's queued exits, RUN, WRITE the receipt that names the claim, SETTLE
+// exactly that claim. A pass that left an unclaimed arrival queued runs again -- bounded, so a
+// hot attempt cannot hold its unit forever; what the bound leaves queued is the queued level's, which
+// starts the drain, whose sweep hands the attempt to a new run once this unit is gone.
+data belt_attempt_obligation_pass_bound: Int = 3
+
+fn belt_attempt_obligations_pass(instance: HostDashboardInstance, node_id: String, attempt_key: String, passes_left: Int) -> List<String> {
+  match belt_exit_entries_claim(instance: instance, node_id: node_id, attempt_key: attempt_key) {
+    BeltExitClaimRefused { reason } => [reason]
+    BeltExitClaimed { entries: claimed } => {
+      let observed_at = belt_tick_observed_at()
+      let run = belt_attempt_obligations_run(instance: instance, node_id: node_id, attempt_key: attempt_key)
+      match belt_attempt_obligation_receipt_write(instance: instance, run: run, node_id: node_id, attempt_key: attempt_key, observed_at: observed_at, claimed: claimed) {
+        BeltPassFailed { reason } => [join([serialize_json(v: belt_attempt_obligation_run_json(run: run, observed_at: observed_at, claimed: claimed)), "\n", reason], "")]
+        BeltPassDeferred { reason } => [reason]
+        BeltPassRefused { reason } => [reason]
+        BeltPassRecorded => {
+          let unsettled = belt_exit_entries_settle(instance: instance, claimed: claimed)
+          let own = match belt_attempt_obligation_run_failure(run: run) { Present { value: f } => [f] Absent => [] as List<String> }
+          let failures = concat(own, unsettled |> map(u => join(["exit entry not settled: ", u], "")))
+          if count(failures) > 0 || passes_left <= 1 {
+            failures
+          } else {
+            match belt_exit_entries_pending_at(root: instance.instance_root as String, node_id: node_id, attempt_key: attempt_key) {
+              BeltExitClaimRefused { reason } => [reason]
+              BeltExitClaimed { entries: pending } =>
+                if count(pending) == 0 { failures } else { belt_attempt_obligations_pass(instance: instance, node_id: node_id, attempt_key: attempt_key, passes_left: passes_left - 1) }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+fn belt_attempt_obligations_cli(node_id: String, attempt_key: String) -> ProcessExit {
+  belt_instance_from_env(entry: "belt_attempt_obligations_cli", then: instance => {
+    let run_failures = belt_attempt_obligations_pass(instance: instance, node_id: node_id, attempt_key: attempt_key, passes_left: belt_attempt_obligation_pass_bound)
+    let tail = belt_obligations_enqueued_exit(
+      context: "after the attempt's obligations",
+      enqueues: belt_record_moved_obligation_kinds |> map(k => belt_instance_obligation_enqueue(instance: instance, kind: k)),
+    )
+    let failures = concat(run_failures, match tail { ExitSuccess => [] as List<String> ExitFailure { code: _, reason } => [reason] })
+    if count(failures) == 0 { ExitSuccess } else { exit_failure(reason: join(failures, "\n")) }
+  })
+}
+
+fn belt_instance_obligation_cli(kind: String) -> ProcessExit {
+  match belt_instance_obligation_kind_of_key(key: kind) {
+    Absent => exit_failure(reason: join(["belt_instance_obligation_cli: no instance obligation is named ", kind], ""))
+    Present { value: k } =>
+      belt_instance_from_env(entry: "belt_instance_obligation_cli", then: instance => belt_instance_obligation_run(instance: instance, kind: k))
+  }
+}
+
+fn belt_instance_obligation_run(instance: HostDashboardInstance, kind: BeltInstanceObligationKind) -> ProcessExit {
+  let observed_at = belt_tick_observed_at()
+  match kind {
+    LaunchObligation => belt_run_once_cli_in(spawn_workdir: instance.repo_root as String)
+    ServedObservationObligation => belt_served_observation_exit(instance: instance, observed_at: observed_at)
+    ResultReturnObligation => {
+      let returned = result_return_attempts_for_instance(instance: instance, recorded_at: observed_at)
+      belt_tick_exit_with_snapshot_closes(exit: result_return_pass_exit(pass: returned.pass), closes: returned.closes)
+    }
+    MeteringObligation =>
+      match belt_metering_pass_outcome_from(outcomes: belt_metering_attempts_for_instance(instance: instance)) {
+        BeltPassRecorded => ExitSuccess
+        BeltPassFailed { reason } => exit_failure(reason: reason)
+        BeltPassDeferred { reason } => exit_failure(reason: reason)
+        BeltPassRefused { reason } => exit_failure(reason: reason)
+      }
+    DogfoodStartRecordObligation => belt_start_record_exit(start: dogfood_start_record_for_instance(instance: instance))
+    SnapshotCensusObligation => belt_tick_exit_with_snapshot_census(exit: ExitSuccess, census: roadmap_snapshot_census_for_instance(instance: instance, observed_at: observed_at))
+  }
+}
+
+fn belt_exit_drain_cli() -> ProcessExit {
+  belt_instance_from_env(entry: "belt_exit_drain_cli", then: instance => {
+    let drained = belt_exit_drain_for_instance(instance: instance)
+    let failures = belt_exit_drain_failures(d: drained)
+    if count(failures) == 0 { ExitSuccess } else { exit_failure(reason: join([serialize_json(v: belt_exit_drain_json(d: drained)), "\n", join(failures, "\n")], "")) }
+  })
+}
+
+fn belt_discover_once_cli() -> ProcessExit {
+  belt_instance_from_env(entry: "belt_discover_once_cli", then: instance => {
+    let discovered = belt_discover_for_instance(instance: instance)
+    match belt_discovery_pass_outcome(discovery: discovered) {
+      BeltPassRecorded => ExitSuccess
+      BeltPassFailed { reason } => exit_failure(reason: join([serialize_json(v: belt_discovery_json(discovery: discovered)), "\n", reason], ""))
+      BeltPassDeferred { reason } => exit_failure(reason: reason)
+      BeltPassRefused { reason } => exit_failure(reason: reason)
+    }
+  })
+}
+
+fn belt_launch_enqueue_cli() -> ProcessExit {
+  belt_instance_from_env(entry: "belt_launch_enqueue_cli", then: instance =>
+    belt_obligations_enqueued_exit(context: "belt_launch_enqueue_cli", enqueues: [belt_instance_obligation_enqueue(instance: instance, kind: LaunchObligation)]))
+}
diff --git a/dag/gunbc/roadmap/roadmap_dashboard_instance.dag b/dag/gunbc/roadmap/roadmap_dashboard_instance.dag
index 7e72e070ab6..15f25d1841b 100644
--- a/dag/gunbc/roadmap/roadmap_dashboard_instance.dag
+++ b/dag/gunbc/roadmap/roadmap_dashboard_instance.dag
@@ -7,6 +7,9 @@ import std.measure { ByteSize }
 import gunbc.runner_slot_desired { gunbc_runner_slot_desired }
 import extdeps.tmux { TmuxServerScope, DefaultTmuxServer, NamedTmuxServer }
 import gunbc.ensure { EnsureObserveOnly }
+import extdeps.posix.identity { PosixOwnerNames }
+import gunbc.managed_directory { DirectoryOwnerOnly, DirectoryOwnerAllEveryoneTraverse, srv1_dashboard_service_principal }
+import gunbc.owned_directory { OwnedDirectoryTarget, OwnedDirectoryDeclared, owned_directory_path }
 import gunbc.deployment_risk {
   DeploymentId,
   DeploymentRiskClass,
@@ -224,6 +227,7 @@ type HostDashboardInstance {
   admitted_revision: DashboardAdmittedRevisionSource
   toolchain: DashboardToolchain
   dispatch_worker_memory_max: ByteSize
+  directory_owner: PosixOwnerNames
 }
 
 // THE TOOLCHAIN IS CARRIED, NOT ONLY CONSUMED, because provisioning needs it too and provisioning
@@ -311,20 +315,6 @@ data dashboard_environment_binding_executable: FilePath = env_absolute_program()
 fn dashboard_instance_child(root: FilePath, child: String) -> FilePath {
   join([root as String, "/", child], "") as FilePath
 }
-
-// THE ROADMAP EVENT WORKTREE: where gunbc.roadmap.roadmap_event_carrier checks out the event
-// branch, under the instance root. It is declared here, beside the instance's other roots, so the
-// provision plan ensures the same path the carrier writes: the carrier's `git worktree add` cannot
-// create it when the instance root is not writable by the service principal (srv1's /opt/gunbc is
-// root-owned), and every issue page then answered 503.
-fn dashboard_instance_roadmap_events_worktree_under(instance_root: FilePath) -> FilePath {
-  dashboard_instance_child(root: instance_root, child: "roadmap-events")
-}
-
-fn dashboard_instance_roadmap_events_worktree(instance: HostDashboardInstance) -> FilePath {
-  dashboard_instance_roadmap_events_worktree_under(instance_root: instance.instance_root)
-}
-
 // THE INSTANCE'S TAILNET DOOR: the unix socket its door unit serves on and tailscale serve proxies
 // to. It sits in the instance root, which the service principal owns; who may open it is not what
 // the door relies on -- the handler is handed the kernel-attested peer of every connection
@@ -485,6 +475,8 @@ fn dashboard_named_tmux_server(instance_id: NonEmptyStr) -> TmuxServerScope {
 type DashboardToolchain {
   directory_create: FilePath
   path_test: FilePath
+  path_stat: FilePath
+  path_list: FilePath
   git: FilePath
   tmux: FilePath
   pipe_shell: FilePath
@@ -541,6 +533,8 @@ data dispatch_worker_memory_ceiling: ByteSize = gunbc_runner_slot_desired().memo
 data srv1_linux_toolchain: DashboardToolchain = DashboardToolchain {
   directory_create: "/usr/bin/mkdir" as FilePath,
   path_test: "/usr/bin/test" as FilePath,
+  path_stat: "/usr/bin/stat" as FilePath,
+  path_list: "/usr/bin/ls" as FilePath,
   git: "/usr/bin/git" as FilePath,
   tmux: "/usr/bin/tmux" as FilePath,
   pipe_shell: "/usr/bin/sh" as FilePath,
@@ -566,6 +560,8 @@ data srv1_linux_toolchain: DashboardToolchain = DashboardToolchain {
 data macbook_local_toolchain: DashboardToolchain = DashboardToolchain {
   directory_create: "/bin/mkdir" as FilePath,
   path_test: "/bin/test" as FilePath,
+  path_stat: "/opt/homebrew/bin/gstat" as FilePath,
+  path_list: "/opt/homebrew/bin/gls" as FilePath,
   git: "/usr/bin/git" as FilePath,
   tmux: "/opt/homebrew/bin/tmux" as FilePath,
   pipe_shell: "/bin/sh" as FilePath,
@@ -874,6 +870,24 @@ fn macbook_local_dashboard_instance() -> HostDashboardInstance {
     admitted_revision: macbook_local_admitted_revision_source,
     toolchain: macbook_local_toolchain,
     dispatch_worker_memory_max: dispatch_worker_memory_ceiling,
+    directory_owner: macbook_local_directory_owner,
+  }
+}
+
+// WHO OWNS THE INSTANCE'S DIRECTORIES, named per host because the group is a host fact: srv1's and
+// srv2's service principal sits in a primary group spelled like its login (the coincidence
+// gunbc.live_deploy.emit install_d_managed_command records), and macOS puts every login in `staff`.
+// The owned-directory provider installs and reads back exactly this pair, so a directory created
+// under another pair is refused, never re-owned.
+data macbook_local_directory_owner: PosixOwnerNames = PosixOwnerNames {
+  user: "briansrls" as NonEmptyStr,
+  group: "staff" as NonEmptyStr,
+}
+
+fn linux_service_directory_owner() -> PosixOwnerNames {
+  PosixOwnerNames {
+    user: srv1_dashboard_service_principal().name,
+    group: srv1_dashboard_service_principal().name,
   }
 }
 
@@ -957,6 +971,7 @@ fn srv1_live_dashboard_instance() -> HostDashboardInstance {
     admitted_revision: fleet_admitted_revision_source,
     toolchain: srv1_linux_toolchain,
     dispatch_worker_memory_max: dispatch_worker_memory_ceiling,
+    directory_owner: linux_service_directory_owner(),
   }
 }
 
@@ -1045,13 +1060,14 @@ fn isolated_dashboard_instance(
     provision_transport: provision_transport,
     source_seed: DashboardGitBundle {
       controller_repo: layout.controller_repo,
-      staged_bundle: dashboard_instance_child(root: root, child: "inbox/source.bundle"),
+      staged_bundle: dashboard_instance_child(root: dashboard_inbox_under(root: root), child: "source.bundle"),
       anchor_ref: source_anchor_ref,
       history_remote: "origin" as NonEmptyStr,
     },
     admitted_revision: fleet_admitted_revision_source,
     toolchain: srv1_linux_toolchain,
     dispatch_worker_memory_max: dispatch_worker_memory_ceiling,
+    directory_owner: linux_service_directory_owner(),
   }
 }
 
@@ -1063,7 +1079,7 @@ fn srv1_lab_dashboard_instance() -> HostDashboardInstance {
     root: srv1_dashboard_lab_root,
     serve_function: "roadmap_serve_handle_srv1_lab" as NonEmptyStr,
     listen_port: 18081,
-    source_anchor_ref: "refs/heads/session/codex-provider-feedback-v0" as NonEmptyStr,
+    source_anchor_ref: "refs/remotes/origin/main" as NonEmptyStr,
     actuation: DashboardActuating,
     provision_transport: DashboardSshProvision { host: "srv1" as NonEmptyStr },
   )
@@ -1189,6 +1205,7 @@ fn srv2_deploy_dashboard_instance() -> HostDashboardInstance {
     admitted_revision: srv2_deploy_admitted_revision_source,
     toolchain: srv1_linux_toolchain,
     dispatch_worker_memory_max: dispatch_worker_memory_ceiling,
+    directory_owner: linux_service_directory_owner(),
   }
 }
 
@@ -1375,75 +1392,124 @@ fn dashboard_instance_footprint_paths(instance: HostDashboardInstance) -> List<F
   ]
 }
 
+// ── THE DIRECTORIES THIS MODULE'S OWN CONSUMERS DEMAND ──────────────────────────────────────────
+//
+// Each is an owned-directory target (gunbc.owned_directory) built from the instance, and the path every
+// runtime reader uses is read OFF the target, so the directory that is ensured and the directory that
+// is written cannot name two paths. The other demands live with their consumers -- the auth stores,
+// the view-preference store, the event carrier, the compute provider, the fabric store -- and
+// gunbc.roadmap.dashboard_instance_directories dashboard_instance_directory_demands composes them.
+//
+// The worktree root keeps the shared 0755 it was installed at: dispatched workers run as the service
+// principal, and no reader of it has been established that would justify tightening a live directory.
+// The two dispatch roots' member names, named once: a live_deploy retract reads them to keep the
+// empty-directory refusal that guards the source tree (gunbc.live_deploy.emit emit_artifact_teardown).
+data dashboard_dispatch_worktree_member: NonEmptyStr = "dispatch-worktree-root" as NonEmptyStr
+
+data dashboard_attempt_state_member: NonEmptyStr = "attempt-state-root" as NonEmptyStr
+
+fn dashboard_instance_dispatch_worktree_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  OwnedDirectoryDeclared {
+    member: dashboard_dispatch_worktree_member,
+    path: match instance.dispatch_state_scope {
+      DispatchStateInstanceOwned { worktree_child, attempt_state_child: _ } =>
+        dashboard_instance_child(root: instance.instance_root, child: worktree_child)
+      DispatchStateHostShared { worktree_root, attempt_state_root: _ } => worktree_root
+    },
+    owner: instance.directory_owner,
+    mode: DirectoryOwnerAllEveryoneTraverse,
+  }
+}
+
 fn dashboard_instance_dispatch_worktree_root(instance: HostDashboardInstance) -> FilePath {
-  match instance.dispatch_state_scope {
-    DispatchStateInstanceOwned { worktree_child, attempt_state_child: _ } =>
-      dashboard_instance_child(root: instance.instance_root, child: worktree_child)
-    DispatchStateHostShared { worktree_root, attempt_state_root: _ } => worktree_root
+  owned_directory_path(t: dashboard_instance_dispatch_worktree_directory(instance: instance))
+}
+
+// AN AUTH-STATE DIRECTORY UNDER THE INSTANCE ROOT, the shape every auth store's demand shares: owned by
+// the instance's principal and closed to everyone else (sessions, login transactions, the JWKS cache,
+// profiles and view preferences are read and written only by the serve process). Each store declares
+// its own demand with this shape (gunbc.auth.session_store, gunbc.auth.login_transaction_store, ...);
+// the segment is the store's fact, not this module's.
+fn dashboard_instance_private_directory(instance: HostDashboardInstance, member: NonEmptyStr, child: String) -> OwnedDirectoryTarget {
+  OwnedDirectoryDeclared {
+    member: member,
+    path: dashboard_instance_child(root: instance.instance_root, child: child),
+    owner: instance.directory_owner,
+    mode: DirectoryOwnerOnly,
   }
 }
 
-// THE COMPUTE ROOT: where the exact work contract's provider keeps leases, checkouts, the shared
-// per-host target directory and the content store (gunbc.compute.work_provider_local). Named here so
-// the deployment (gunbc.live_deploy.spec ComputeRoot) and the provider read one authority; the first
-// srv1 converge after the provider landed had no such member, and under a root-owned /opt/gunbc a
-// worker's first request would have refused StoreUnavailable at `install -d`.
-fn dashboard_instance_compute_root(instance: HostDashboardInstance) -> FilePath {
-  dashboard_instance_child(root: instance.instance_root, child: "compute")
-}
-
-// THE FABRIC DB ROOT: where the fabric DB's files live on the instance that holds its placement
-// (gunbc.fabric_storage_placement, gunbc.fabric_storage_file_store). Named here for the same reason the compute
-// root is: the deployment (gunbc.live_deploy.spec FabricStorageStoreDirectory, an ensured host directory)
-// and the placement read one authority. It replaced the per-instance event-log mirror root: no
-// executor keeps a copy of the log any more, so only the placement's host holds a root at all.
-fn dashboard_instance_fabric_storage_root(instance: HostDashboardInstance) -> FilePath {
-  dashboard_instance_child(root: instance.instance_root, child: "fabric-storage")
-}
-
-// THE INSTANCE'S AUTH STORES, owned here beside every other root the instance provisions. Each
-// auth module derives its store directory from this function rather than joining its own segment,
-// so the provision plan below creates exactly the directories the stores write into -- before
-// this, the plan named none of them, the four existed only where someone had made them by hand,
-// and the profile store (added later) was never created, so every login's profile publication was
-// refused and every roster read came back unread.
-type DashboardAuthStore
-  = DashboardAuthSessions
-  | DashboardAuthLoginTransactions
-  | DashboardAuthJwksCache
-  | DashboardAuthProfiles
-  | DashboardIssueViewPreferences
-
-data dashboard_auth_stores: List<DashboardAuthStore> = [
-  DashboardAuthSessions,
-  DashboardAuthLoginTransactions,
-  DashboardAuthJwksCache,
-  DashboardAuthProfiles,
-  DashboardIssueViewPreferences,
-]
-
-fn dashboard_auth_store_segment(store: DashboardAuthStore) -> String {
-  match store {
-    DashboardAuthSessions => "auth-sessions"
-    DashboardAuthLoginTransactions => "auth-login-transactions"
-    DashboardAuthJwksCache => "auth-jwks"
-    DashboardAuthProfiles => "auth-profiles"
-    DashboardIssueViewPreferences => "issue-view-preferences"
+// A DIRECTORY UNDER THE INSTANCE ROOT AT THE SHARED 0755 the provision plan's mkdir produced, for a
+// consumer whose readers have not been established beyond the instance's principal.
+fn dashboard_instance_shared_directory(instance: HostDashboardInstance, member: NonEmptyStr, child: String) -> OwnedDirectoryTarget {
+  OwnedDirectoryDeclared {
+    member: member,
+    path: dashboard_instance_child(root: instance.instance_root, child: child),
+    owner: instance.directory_owner,
+    mode: DirectoryOwnerAllEveryoneTraverse,
   }
 }
 
-fn dashboard_instance_auth_store_root(instance: HostDashboardInstance, store: DashboardAuthStore) -> FilePath {
-  dashboard_instance_child(root: instance.instance_root, child: dashboard_auth_store_segment(store: store))
+// The attempt-state root is 0700: the dependents gunbc.managed_directory attempt_state_directory_at
+// states are the service principal alone, and that derivation is what this mode equals.
+fn dashboard_instance_dispatch_attempt_state_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  OwnedDirectoryDeclared {
+    member: dashboard_attempt_state_member,
+    path: match instance.dispatch_state_scope {
+      DispatchStateInstanceOwned { worktree_child: _, attempt_state_child } =>
+        dashboard_instance_child(root: instance.instance_root, child: attempt_state_child)
+      DispatchStateHostShared { worktree_root: _, attempt_state_root } => attempt_state_root
+    },
+    owner: instance.directory_owner,
+    mode: DirectoryOwnerOnly,
+  }
 }
 
 fn dashboard_instance_dispatch_attempt_state_root(instance: HostDashboardInstance) -> FilePath {
-  match instance.dispatch_state_scope {
-    DispatchStateInstanceOwned { worktree_child: _, attempt_state_child } =>
-      dashboard_instance_child(root: instance.instance_root, child: attempt_state_child)
-    DispatchStateHostShared { worktree_root: _, attempt_state_root } => attempt_state_root
+  owned_directory_path(t: dashboard_instance_dispatch_attempt_state_directory(instance: instance))
+}
+
+// THE PROVIDER STATE ROOT is a directory, never a credential: the provider login writes into it, and
+// nothing the deploy carries populates it. It lives outside the instance root (so it is never an owned
+// footprint path) and nothing tears it down.
+fn dashboard_instance_provider_state_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  OwnedDirectoryDeclared {
+    member: "provider-state-root" as NonEmptyStr,
+    path: dashboard_instance_provider_state_root(instance: instance),
+    owner: instance.directory_owner,
+    mode: DirectoryOwnerAllEveryoneTraverse,
+  }
+}
+
+// THE BUNDLE INBOX: where a bundle-seeded instance stages its source bundle. Demanded only by an
+// instance whose source seed IS a bundle, and the staged bundle path is built under the same function
+// (isolated_dashboard_instance), so the inbox ensured and the inbox written are one path.
+fn dashboard_inbox_under(root: FilePath) -> FilePath {
+  dashboard_instance_child(root: root, child: "inbox")
+}
+
+fn dashboard_instance_inbox_directories(instance: HostDashboardInstance) -> List<OwnedDirectoryTarget> {
+  match instance.source_seed {
+    DashboardExistingRepo { anchor_ref: _ } => []
+    DashboardGitBundle { controller_repo: _, staged_bundle: _, anchor_ref: _, history_remote: _ } => [
+      OwnedDirectoryDeclared {
+        member: "bundle-inbox" as NonEmptyStr,
+        path: dashboard_inbox_under(root: instance.instance_root),
+        owner: instance.directory_owner,
+        mode: DirectoryOwnerAllEveryoneTraverse,
+      },
+    ]
   }
 }
 
+// THIS MODULE'S OWN DEMANDS, in the order the deleted provision plan created them.
+fn dashboard_instance_own_directory_demands(instance: HostDashboardInstance) -> List<OwnedDirectoryTarget> {
+  concat([
+    dashboard_instance_dispatch_worktree_directory(instance: instance),
+    dashboard_instance_dispatch_attempt_state_directory(instance: instance),
+    dashboard_instance_provider_state_directory(instance: instance),
+  ], dashboard_instance_inbox_directories(instance: instance))
+}
 fn dashboard_instance_dispatch_state_paths(instance: HostDashboardInstance) -> List<FilePath> {
   [
     dashboard_instance_dispatch_worktree_root(instance: instance),
@@ -1556,23 +1622,14 @@ fn dashboard_instances_dispatch_state_is_consistent(
 // stale or missing build should refuse with the path it looked for rather than quietly producing
 // one that differs from what the operator tested.
 
-// THE MODEL VERIFIED AUTH AGAINST A DIRECTORY IT NEVER CREATED. DashboardVerifyProviderRuntime and
-// DashboardVerifyProviderAuth both read the provider state root, and nothing in the plan brought it
-// into existence — so on a fresh host the only command that can populate it fails first:
-// `CODEX_HOME=... codex login` exits with 'that path does not exist' before any OAuth begins. The
-// operator hits a CLI error in their own terminal instead of a typed refusal telling them what to
-// do, which is the gap this variant closes (operator, 2026-07-30: 'i think this stuff needs to be
-// in the workflow').\n\nIT IS A SEPARATE VARIANT BECAUSE ITS OWNERSHIP AND TEARDOWN DIFFER, and
-// reusing DashboardEnsureDirectory would state neither. The state root lives OUTSIDE the instance
-// root, so it can never be an owned path — dashboard_instance_paths_are_owned requires containment,
-// and the roster it checks deliberately excludes this. And it must never be torn down: the
-// directory holds user-authored OAuth state, so removing it on retract would destroy credentials
-// the deploy is forbidden to carry in the first place.
-// dashboard_retract_preserves_recovery_anchor_and_provider_state already asserts that preservation;
-// the type now says it too.\n\nWhat this creates is a DIRECTORY, never a credential.
-// dashboard_instance_note's rule stands unchanged — provider credentials remain pre-existing
-// user-authored state, referenced and never copied into a deployment payload. An empty state root
-// is infrastructure; the secret inside it is not, and this op cannot produce one.
+// THE PLAN CREATES NO DIRECTORY. Every directory an instance's consumers write into -- the dispatch
+// roots, the provider state root DashboardVerifyProviderRuntime and DashboardVerifyProviderAuth read,
+// the auth stores, the bundle inbox, the event worktree -- is a demand its consumer declares, composed
+// by gunbc.roadmap.dashboard_instance_directories dashboard_instance_directory_demands and ensured by
+// the one owned-directory provider (gunbc.owned_directory owned_directory_ensure) BEFORE this plan
+// runs (gunbc.roadmap_dashboard_instance_apply dashboard_apply_directories_then_plan). The two
+// directory ops this type carried were a second creator beside live_deploy's, with a different
+// meaning: a mkdir as whoever ran it, with no owner, no mode and no readback of most of what it made.
 
 type DashboardInstanceProvisionOp
   = DashboardHydrateControllerHistory {
@@ -1587,8 +1644,6 @@ type DashboardInstanceProvisionOp
       controller_repo: FilePath,
       staged_bundle: FilePath,
     }
-  | DashboardEnsureDirectory { path: FilePath }
-  | DashboardEnsureProviderStateRoot { path: FilePath }
   | DashboardEnsureServeBinary {
       controller_repo: FilePath,
       built_binary: FilePath,
@@ -1618,26 +1673,15 @@ type DashboardInstanceProvisionOp
       state_root: FilePath,
     }
 
-// live_deploy CreateRoot's DispatchWorktreeRoot and AttemptStateRoot, and systemd-launches the
-// dashboard process, only for deployment_spec_srv1 (srv1_live). deployment_spec_for has no
-// production caller. srv1_lab, srv2_lab, srv2_deploy and macbook_local still consume the dispatch
-// paths through dispatch/belt, and this plan is the only creator those instances have for those
-// directories. Naming live_deploy as owner without keeping that creator is the serve-binary
-// deadlock. Service launch is the other half of the same gap, and restoring tmux would re-fork
-// srv1_live (systemd plus a session). This plan therefore keeps the mkdirs and does not poll
-// health after launch: it does not start the process. Production process start is live_deploy
-// ServiceProcess. For every other instance, start is an operator act until deployment_spec_for
-// is a real caller. That is a declared operator act, not a silent requirement this apply cannot
-// discharge.
+// live_deploy systemd-launches the dashboard process only for deployment_spec_srv1 (srv1_live);
+// deployment_spec_for has no production caller. This plan does not start the process and does not
+// poll health after launch: production process start is live_deploy ServiceProcess, and for every
+// other instance start is a declared operator act until deployment_spec_for is a real caller.
 //
-// PROVIDER-STATE CREATION (C7, operator ruling 2026-09-19): live_deploy owns it as an ensured
-// member, gunbc.live_deploy.spec deployment_provider_state_step. The member is read back as a
-// DirectoryRoot, and no spec can lack it: the member is derived from the spec rather than authored
-// into its step list, so the state a refusal would have caught has no constructor. For srv1_live
-// that member is now the creator on the production route. DashboardEnsureProviderStateRoot stays
-// in this plan because it is still the only creator for srv1_lab, srv2_lab, srv2_deploy and
-// macbook_local; the census on deployment_provider_state_step lists each instance. It may be
-// deleted for an instance only when a production caller applies that instance's deployment spec.
+// DIRECTORIES ARE NOT IN THIS PLAN FOR ANY INSTANCE. Both routes -- this apply for srv1_lab,
+// srv2_lab, srv2_deploy and macbook_local, and the live_deploy transaction for srv1_live -- ensure the
+// same demand list through the same provider, so no instance depends on this plan to create a
+// directory and no instance is left without a creator by its removal.
 fn dashboard_instance_provision_plan(instance: HostDashboardInstance) -> List<DashboardInstanceProvisionOp> {
   let controller_source_ops = match instance.source_seed {
     DashboardExistingRepo { anchor_ref: _ } => []
@@ -1657,17 +1701,7 @@ fn dashboard_instance_provision_plan(instance: HostDashboardInstance) -> List<Da
       },
     ]
   }
-  let common = concat(concat([
-    DashboardEnsureDirectory { path: instance.instance_root },
-    DashboardEnsureDirectory { path: dashboard_instance_dispatch_worktree_root(instance: instance) },
-    DashboardEnsureDirectory { path: dashboard_instance_dispatch_attempt_state_root(instance: instance) },
-    DashboardEnsureDirectory { path: dashboard_instance_roadmap_events_worktree(instance: instance) },
-  ], map(dashboard_auth_stores, s => DashboardEnsureDirectory {
-    path: dashboard_instance_auth_store_root(instance: instance, store: s),
-  })), [
-    DashboardEnsureProviderStateRoot {
-      path: dashboard_instance_provider_state_root(instance: instance),
-    },
+  let common = [
     DashboardEnsureServeBinary {
       controller_repo: dashboard_instance_controller_workdir(instance: instance),
       built_binary: dashboard_instance_child(
@@ -1680,7 +1714,7 @@ fn dashboard_instance_provision_plan(instance: HostDashboardInstance) -> List<Da
       path: dashboard_instance_ownership_marker_path(instance: instance),
       instance_id: instance.instance_id,
     },
-  ])
+  ]
   let source_ops = match instance.source_seed {
     DashboardExistingRepo { anchor_ref: _ } => []
     DashboardGitBundle {
@@ -1689,9 +1723,6 @@ fn dashboard_instance_provision_plan(instance: HostDashboardInstance) -> List<Da
       anchor_ref,
       history_remote: _,
     } => [
-      DashboardEnsureDirectory {
-        path: dashboard_instance_child(root: instance.instance_root, child: "inbox"),
-      },
       DashboardStageGitBundle {
         controller_repo: controller_repo,
         staged_bundle: staged_bundle,
@@ -1767,18 +1798,6 @@ fn dashboard_instance_provision_op_row(
         target: staged_bundle as String,
         detail: "copy proven temporary bundle to .next, then atomically rename",
       }
-    DashboardEnsureDirectory { path } =>
-      DashboardInstanceProvisionPlanRow {
-        kind: "ensure-directory" as NonEmptyStr,
-        target: path as String,
-        detail: "mkdir parents; idempotent",
-      }
-    DashboardEnsureProviderStateRoot { path } =>
-      DashboardInstanceProvisionPlanRow {
-        kind: "ensure-provider-state-root" as NonEmptyStr,
-        target: path as String,
-        detail: "mkdir parents so the provider login has somewhere to write; never torn down, never populated by the deploy",
-      }
     DashboardEnsureServeBinary { controller_repo: _, built_binary, path } =>
       DashboardInstanceProvisionPlanRow {
         kind: "ensure-serve-binary" as NonEmptyStr,
@@ -1869,8 +1888,8 @@ type DashboardInstanceObserved {
   source_revision_observed: Bool
   source_revision_current: Bool
   source_revision_detail: String
-  attempts_present: Bool
-  attempt_state_present: Bool
+  directories_converged: Bool
+  directory_refusals: List<String>
   provider_runtime_ready: Bool
   provider_runtime_detail: String
   provider_authenticated: Bool
@@ -1930,6 +1949,13 @@ fn dashboard_instance_reconcile(
     DashboardInstanceRefused {
       reason: "production isolation read-back failed" as NonEmptyStr,
     }
+  } else if count(observed.directory_refusals) > 0 {
+    DashboardInstanceRefused {
+      reason: join([
+        "owned directories refused: ",
+        join(observed.directory_refusals, " | "),
+      ], "") as NonEmptyStr,
+    }
   } else if (observed.origin_present || observed.source_present)
       && !observed.ownership_marker_present {
     DashboardInstanceRefused {
@@ -1951,8 +1977,7 @@ fn dashboard_instance_reconcile(
       && dashboard_source_seed_ready(instance: instance, observed: observed)
       && observed.origin_present
       && observed.source_present
-      && observed.attempts_present
-      && observed.attempt_state_present
+      && observed.directories_converged
       && observed.provider_runtime_ready
       && observed.provider_authenticated
       && observed.source_anchor_matches
diff --git a/dag/gunbc/roadmap/roadmap_dashboard_instance_apply.dag b/dag/gunbc/roadmap/roadmap_dashboard_instance_apply.dag
index b46a61a743a..8c6806d5c08 100644
--- a/dag/gunbc/roadmap/roadmap_dashboard_instance_apply.dag
+++ b/dag/gunbc/roadmap/roadmap_dashboard_instance_apply.dag
@@ -5,6 +5,8 @@ import std.algebra { trim }
 import std.types { String, NonEmptyStr, Bool, List, FilePath, GitRef, CommitSha }
 import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
 import extdeps.shell
+import extdeps.gunbc
+import gunbc.output_policy { OutcomeIsData }
 import extdeps.filesystem.filesystem_io
 import extdeps.git {
   shape_git_bundle_create_argv,
@@ -78,8 +80,6 @@ import gunbc.roadmap_dashboard_instance {
   DashboardHydrateControllerHistory,
   DashboardPrepareGitBundle,
   DashboardStageGitBundle,
-  DashboardEnsureDirectory,
-  DashboardEnsureProviderStateRoot,
   DashboardEnsureServeBinary,
   DashboardEnsureOwnershipMarker,
   DashboardEnsureLocalOrigin,
@@ -114,8 +114,27 @@ import gunbc.roadmap_dashboard_instance {
   dashboard_instance_reconcile,
   dashboard_instance_dispatch_worktree_root,
   dashboard_instance_dispatch_attempt_state_root,
+  DashboardActuationPosture,
+  DashboardObserveOnly,
+  DashboardActuating,
 }
 import gunbc.dashboard_provider_readiness { dashboard_provider_device_login_command }
+import gunbc.roadmap.dashboard_instance_directories { dashboard_instance_directory_demands }
+import gunbc.ensure { EnsurePolicy, EnsureObserveOnly, EnsureMayApply, EnsureObservation, EnsureObserved, EnsureAbsent, EnsureInaccessible }
+import std.upsert_decision { Noop, Apply, Refuse }
+import gunbc.owned_directory {
+  OwnedDirectoryTarget,
+  OwnedDirectoryReading,
+  OwnedDirectoryInstallPlan,
+  owned_directory_path,
+  owned_directory_stat_args,
+  owned_directory_observe, ObserverRead, ObserverReadOut, ObserverReadFailed, ObserverExited, ObserverTransportRefused,
+  owned_directory_install_args,
+  owned_directory_decide,
+  owned_directory_ensure,
+  owned_directory_outcome_converged,
+  owned_directory_outcome_detail,
+}
 
 // The wet path is an interpreter of HostDashboardInstance, not a parallel provisioning script. Its
 // high-level provision plan is pure and browser-visible; this module projects each operation to
@@ -583,18 +602,6 @@ fn dashboard_apply_provision_op(
         staged_bundle: staged_bundle,
         temp_bundle: temp_bundle,
       )
-    DashboardEnsureDirectory { path } =>
-      dashboard_target_exec(
-        instance: instance,
-        program: instance.toolchain.directory_create,
-        args: ["-p", path as String],
-      )
-    DashboardEnsureProviderStateRoot { path } =>
-      dashboard_target_exec(
-        instance: instance,
-        program: instance.toolchain.directory_create,
-        args: ["-p", path as String],
-      )
     DashboardEnsureServeBinary { controller_repo, built_binary, path } =>
       dashboard_ensure_serve_binary(
         instance: instance,
@@ -725,6 +732,178 @@ fn dashboard_apply_plan(
   )
 }
 
+// ── THE INSTANCE'S DIRECTORIES, THROUGH THE ONE PROVIDER ─────────────────────────────────────────
+//
+// This route's host operations for gunbc.owned_directory owned_directory_ensure, and nothing else: two
+// read-only metadata reads (list a directory, stat a directory) through the instance's toolchain as the
+// instance's principal, each returning what it read or the typed origin of why it read nothing, and the
+// owned install. The decision, the plan, presence and the readback classification are the provider's,
+// shared with the live_deploy transaction. No exit status or diagnostic text is interpreted here.
+fn dashboard_observer_read(instance: HostDashboardInstance, program: FilePath, args: List<String>) -> ObserverRead {
+  match instance.provision_transport {
+    DashboardLocalProvision => {
+      let r = gunbc.WitnessBin.Run(
+        workdir: dashboard_instance_controller_workdir(instance: instance),
+        bin_path: program,
+        args: args,
+        expect: OutcomeIsData,
+      )
+      if r.success { ObserverReadOut { stdout: r.stdout } }
+      else { ObserverReadFailed { origin: ObserverExited { exit_code: r.exit_code, stderr: r.stderr } } }
+    }
+    DashboardSshProvision { host } =>
+      match typed_argv_exec_over_ssh(host: host, argv: concat([program as String], args)) {
+        TypedArgvExecRefused { reason } => ObserverReadFailed { origin: ObserverTransportRefused { cause: reason } }
+        TypedArgvExecConverged { result } =>
+          if result.exit_code == 0 { ObserverReadOut { stdout: result.stdout } }
+          else { ObserverReadFailed { origin: ObserverExited { exit_code: result.exit_code, stderr: result.stderr } } }
+      }
+  }
+}
+
+fn dashboard_owned_directory_observe(
+  instance: HostDashboardInstance,
+  path: FilePath,
+) -> EnsureObservation<OwnedDirectoryReading> {
+  owned_directory_observe(
+    path: path,
+    list: p => dashboard_observer_read(instance: instance, program: instance.toolchain.path_list, args: ["-1A", "--", p as String]),
+    stat: p => dashboard_observer_read(instance: instance, program: instance.toolchain.path_stat, args: owned_directory_stat_args(path: p)),
+  )
+}
+
+fn dashboard_owned_directory_install(instance: HostDashboardInstance, plan: OwnedDirectoryInstallPlan) -> Bool {
+  dashboard_target_exec(
+    instance: instance,
+    program: instance.toolchain.install,
+    args: owned_directory_install_args(plan: plan),
+  ).success
+}
+
+// AN OBSERVE-ONLY INSTANCE CREATES NOTHING: its posture caps the provider at EnsureObserveOnly, so an
+// absent or drifted directory refuses instead of being installed.
+fn dashboard_directory_policy(instance: HostDashboardInstance) -> EnsurePolicy {
+  match instance.actuation {
+    DashboardObserveOnly => EnsureObserveOnly
+    DashboardActuating => EnsureMayApply
+  }
+}
+
+// EVERY DEMANDED DIRECTORY, ENSURED IN THE COMPOSITION'S ORDER, one receipt each, stopping at the first
+// that does not converge. The receipt's success is the provider's reconciled verdict -- the second
+// stat's -- never the install's exit status.
+fn dashboard_apply_owned_directories(instance: HostDashboardInstance) -> DashboardApplyFold {
+  fold(
+    dashboard_instance_directory_demands(instance: instance),
+    init: DashboardApplyFold { running: true, receipts: [], refused_step: "", refused_detail: "" },
+    f: (acc, target) =>
+      if !acc.running {
+        acc
+      } else {
+        let outcome = owned_directory_ensure(
+          policy: dashboard_directory_policy(instance: instance),
+          target: target,
+          observe: p => dashboard_owned_directory_observe(instance: instance, path: p),
+          run: plan => dashboard_owned_directory_install(instance: instance, plan: plan),
+        )
+        let ok = owned_directory_outcome_converged(o: outcome)
+        let detail = owned_directory_outcome_detail(o: outcome)
+        DashboardApplyFold {
+          running: ok,
+          receipts: concat(acc.receipts, [
+            DashboardProvisionStepReceipt {
+              kind: "ensure-owned-directory" as NonEmptyStr,
+              target: owned_directory_path(t: target) as String,
+              success: ok,
+              detail: detail,
+            },
+          ]),
+          refused_step: if ok { "" } else { "ensure-owned-directory" },
+          refused_detail: if ok { "" } else { detail },
+        }
+      },
+  )
+}
+
+// THE DIRECTORIES, THEN THE PLAN. The plan's ops write into directories (the marker into the instance
+// root, the bundle into the inbox), so they run only once every demanded directory has converged.
+fn dashboard_apply_directories_then_plan(
+  instance: HostDashboardInstance,
+  plan: List<DashboardInstanceProvisionOp>,
+  temp_bundle: FilePath,
+  temp_verify_repo: FilePath,
+) -> DashboardApplyFold {
+  let directories = dashboard_apply_owned_directories(instance: instance)
+  if !directories.running {
+    directories
+  } else {
+    let applied = dashboard_apply_plan(
+      instance: instance,
+      plan: plan,
+      temp_bundle: temp_bundle,
+      temp_verify_repo: temp_verify_repo,
+    )
+    DashboardApplyFold {
+      running: applied.running,
+      receipts: concat(directories.receipts, applied.receipts),
+      refused_step: applied.refused_step,
+      refused_detail: applied.refused_detail,
+    }
+  }
+}
+
+// THE READBACK OF EVERY DEMAND, for the reconcile: the same stat the provider reads, decided under the
+// apply policy. An unreadable directory is an observation refusal (no field is evidence); a foreign
+// owner, a non-directory or a refused mode derivation is a directory refusal; anything the provider
+// would install is not yet converged.
+type DashboardDirectoriesObserved {
+  observation_refusals: List<String>
+  directory_refusals: List<String>
+  converged: Bool
+}
+
+fn dashboard_observe_owned_directories(instance: HostDashboardInstance) -> DashboardDirectoriesObserved {
+  fold(
+    dashboard_instance_directory_demands(instance: instance),
+    init: DashboardDirectoriesObserved { observation_refusals: [], directory_refusals: [], converged: true },
+    f: (acc, target) => {
+      let observation = dashboard_owned_directory_observe(instance: instance, path: owned_directory_path(t: target))
+      match observation {
+        EnsureInaccessible { reason } =>
+          DashboardDirectoriesObserved {
+            observation_refusals: concat(acc.observation_refusals, [reason]),
+            directory_refusals: acc.directory_refusals,
+            converged: false,
+          }
+        EnsureObserved { evidence: _ } => dashboard_directory_decision_fold(acc: acc, target: target, observation: observation)
+        EnsureAbsent { reason: _ } => dashboard_directory_decision_fold(acc: acc, target: target, observation: observation)
+      }
+    },
+  )
+}
+
+fn dashboard_directory_decision_fold(
+  acc: DashboardDirectoriesObserved,
+  target: OwnedDirectoryTarget,
+  observation: EnsureObservation<OwnedDirectoryReading>,
+) -> DashboardDirectoriesObserved {
+  match owned_directory_decide(policy: EnsureMayApply, target: target, observation: observation) {
+    Noop => acc
+    Apply { plan: _ } =>
+      DashboardDirectoriesObserved {
+        observation_refusals: acc.observation_refusals,
+        directory_refusals: acc.directory_refusals,
+        converged: false,
+      }
+    Refuse { reason } =>
+      DashboardDirectoriesObserved {
+        observation_refusals: acc.observation_refusals,
+        directory_refusals: concat(acc.directory_refusals, [reason as String]),
+        converged: false,
+      }
+  }
+}
+
 type DashboardProductionSnapshot {
   observed: Bool
   head: String
@@ -974,15 +1153,14 @@ fn dashboard_instance_observe(
   let obs_marker = dashboard_target_path_observe(instance: instance, flag: "-f", path: dashboard_instance_ownership_marker_path(instance: instance))
   let obs_origin = dashboard_target_path_observe(instance: instance, flag: "-d", path: instance.local_origin_root)
   let obs_source = dashboard_target_path_observe(instance: instance, flag: "-d", path: instance.repo_root)
-  let obs_attempts = dashboard_target_path_observe(instance: instance, flag: "-d", path: dashboard_instance_dispatch_worktree_root(instance: instance))
-  let obs_attempt_state = dashboard_target_path_observe(instance: instance, flag: "-d", path: dashboard_instance_dispatch_attempt_state_root(instance: instance))
+  let directories = dashboard_observe_owned_directories(instance: instance)
   let path_refusals = fold(
-    [obs_root, obs_marker, obs_origin, obs_source, obs_attempts, obs_attempt_state],
+    [obs_root, obs_marker, obs_origin, obs_source],
     init: [],
     f: fn(acc, o) { concat(acc, dashboard_path_observation_refusal(obs: o)) },
   )
   DashboardInstanceObserved {
-    observation_refusals: concat(path_refusals, probe_refusals),
+    observation_refusals: concat(concat(path_refusals, directories.observation_refusals), probe_refusals),
     root_present: dashboard_observation_present_bit(obs: obs_root),
     ownership_marker_present: dashboard_observation_present_bit(obs: obs_marker),
     bundle_present: bundle_present,
@@ -996,8 +1174,8 @@ fn dashboard_instance_observe(
       "\n",
       source_revision.stderr,
     ], "")),
-    attempts_present: dashboard_observation_present_bit(obs: obs_attempts),
-    attempt_state_present: dashboard_observation_present_bit(obs: obs_attempt_state),
+    directories_converged: directories.converged,
+    directory_refusals: directories.directory_refusals,
     provider_runtime_ready: provider_runtime.success
       && codex_runtime_version_identity_satisfied(
         combined_output: join([provider_runtime.stdout, "\n", provider_runtime.stderr], ""),
@@ -1703,7 +1881,7 @@ fn dashboard_instance_apply_after_preflight(
           } else {
             let temp_bundle = join([temp.path as String, "/source.bundle"], "") as FilePath
             let temp_verify_repo = join([temp.path as String, "/verify.git"], "") as FilePath
-            let applied = dashboard_apply_plan(
+            let applied = dashboard_apply_directories_then_plan(
               instance: instance,
               plan: plan,
               temp_bundle: temp_bundle,
@@ -1790,8 +1968,6 @@ fn dashboard_bootstrap_only_ops(
 ) -> List<DashboardInstanceProvisionOp> {
   dashboard_instance_provision_plan(instance: instance)
     |> filter(op => match op {
-      DashboardEnsureDirectory { path: _ } => true
-      DashboardEnsureProviderStateRoot { path: _ } => true
       DashboardEnsureServeBinary { controller_repo: _, built_binary: _, path: _ } => true
       DashboardHydrateControllerHistory { controller_repo: _, history_remote: _ } => false
       DashboardPrepareGitBundle { controller_repo: _, anchor_ref: _ } => false
@@ -1809,7 +1985,7 @@ fn dashboard_apply_bootstrap_then_escalate(
   state_root: FilePath,
   remediation: String,
 ) -> DashboardInstanceApplyResult {
-  let applied = dashboard_apply_plan(
+  let applied = dashboard_apply_directories_then_plan(
     instance: instance,
     plan: dashboard_bootstrap_only_ops(instance: instance),
     temp_bundle: dashboard_bootstrap_unused_temp_path,
@@ -1866,22 +2042,17 @@ fn dashboard_instance_apply(
   }
 }
 
-// THE ROOTS AN INSTANCE OWNS, PROVISIONED FROM THE INSTANCE'S OWN DECLARED PLAN.
+// THE DIRECTORIES AN INSTANCE'S CONSUMERS DEMAND, ENSURED ON THEIR OWN.
 //
 // This exists because the launch gates are ordered and the transition gate sits second: it reads
 // transition-inhibition.json under the instance root, and a root that does not exist makes the
 // ABSENCE of that file unestablished rather than established -- so it refuses, correctly, and no
-// later gate is ever reached. Provisioning the roots is therefore a prerequisite of evaluating any
-// launch at all, not a step of live_deploy. live_deploy CreateRoot's the same two dispatch
-// directories only for srv1_live; this filter is what creates them for every other instance that
-// still has an ensure-roots or apply entry.
+// later gate is ever reached. Ensuring the directories is therefore a prerequisite of evaluating any
+// launch at all.
 //
-// It is a FILTER over dashboard_instance_provision_plan, never a second list. The directory steps
-// are selected from the plan the instance already declares and executed through
-// dashboard_apply_provision_op -- the same executor the full apply runs -- so there is no second
-// spelling of which roots an instance owns, and adding a root to the plan adds it here with no edit.
-// A hand-authored mkdir would have been the out-of-band actuation DESIGN 6 names, and it would have
-// drifted from the plan the moment a root was added.
+// It is the same provider over the same list the full apply and the live_deploy transaction use
+// (gunbc.roadmap.dashboard_instance_directories dashboard_instance_directory_demands), never a second
+// list: adding a demand adds it here with no edit.
 //
 // WHAT IT DELIBERATELY DOES NOT DO. The full apply still ensures a serve binary and stages source.
 // Service launch is gunbc.live_deploy's systemd members, which have no macOS realization --
@@ -1893,25 +2064,7 @@ fn dashboard_instance_apply(
 fn dashboard_instance_ensure_dispatch_roots(
   instance: HostDashboardInstance,
 ) -> DashboardApplyFold {
-  dashboard_apply_plan(
-    instance: instance,
-    plan: dashboard_instance_provision_plan(instance: instance)
-      |> filter(op => match op {
-        DashboardEnsureDirectory { path: _ } => true
-        DashboardEnsureProviderStateRoot { path: _ } => true
-        DashboardHydrateControllerHistory { controller_repo: _, history_remote: _ } => false
-        DashboardPrepareGitBundle { controller_repo: _, anchor_ref: _ } => false
-        DashboardStageGitBundle { controller_repo: _, staged_bundle: _ } => false
-        DashboardEnsureServeBinary { controller_repo: _, built_binary: _, path: _ } => false
-        DashboardEnsureOwnershipMarker { path: _, instance_id: _ } => false
-        DashboardEnsureLocalOrigin { bundle: _, origin: _, source_ref: _, publish_ref: _ } => false
-        DashboardEnsureSourceRepo { origin: _, repo: _, anchor_ref: _ } => false
-        DashboardVerifyProviderRuntime { executable: _, state_root: _ } => false
-        DashboardVerifyProviderAuth { executable: _, state_root: _ } => false
-      }),
-    temp_bundle: "/dev/null" as FilePath,
-    temp_verify_repo: "/dev/null" as FilePath,
-  )
+  dashboard_apply_owned_directories(instance: instance)
 }
 
 fn dashboard_instance_ensure_roots_fold_for_id(instance_id: String) -> DashboardApplyFold? {
diff --git a/dag/gunbc/roadmap/roadmap_dispatch_actuator.dag b/dag/gunbc/roadmap/roadmap_dispatch_actuator.dag
index 73023923c91..bc8a43a2662 100644
--- a/dag/gunbc/roadmap/roadmap_dispatch_actuator.dag
+++ b/dag/gunbc/roadmap/roadmap_dispatch_actuator.dag
@@ -55,8 +55,15 @@ import extdeps.systemd {
   systemd_unit_property_wire, SystemdUnitProperty, LoadState, SubState, ExecMainStatus,
   MemoryMax, WorkingDirectoryProperty, StandardOutputProperty, StandardErrorProperty,
   ProtectSystemProperty, ProtectHomeProperty, PrivateTmpProperty, ReadWritePathsProperty,
-  RemainAfterExitProperty,
+  RemainAfterExitProperty, ExecStopPostProperty,
 }
+import gunbc.roadmap.roadmap_attempt_exit_spool {
+  AttemptExitHook, AttemptExitHookRendered, AttemptExitHookRefused, attempt_exit_hook,
+  AttemptUnitRole, AttemptWorkerRole, AttemptReviewerRole, AttemptAuditorRole,
+  AttemptExitRecordObservation, AttemptExitRecordFound, AttemptExitRecordNone, AttemptExitRecordUnreadable,
+  AttemptProcessExitedWith, AttemptProcessSignaled, attempt_exit_record_observe,
+}
+import extdeps.posix.signal { linux_standard_signal_number }
 import extdeps.exec.command { ArgvCommand }
 import extdeps.systemd.systemd_run {
   SystemdRunCommandReading, SystemdRunCommandReady, SystemdRunCommandRefused,
@@ -129,6 +136,7 @@ import extdeps.posix.sh_invocation { posix_sh_export_from_file_unreadable_exit,
 import gunbc.dispatch_selection {
   ClaudeCredentialRef, ClaudeOAuthTokenSecretRef, ClaudeApiKeySecretRef, ClaudeStateRootRef,
   claude_dispatch_credential, inventory_with_observed_standing, claude_offer_for_instance,
+  inventory_with_codex_state_root, OfferCodex, OfferClaude, OfferCursor,
   ExecutionProfile,
   ProfileAutomatic,
   ProviderSelectionRequest,
@@ -211,6 +219,9 @@ import gunbc.roadmap_provider_events {
   codex_provider_event_projection_args,
 }
 import gunbc.repo_identity { gunbc_merge_target_ref }
+import gunbc.codex_harness_credential { codex_worker_turn_custody_host, codex_worker_turn_codex_home, codex_harness_turn_argv }
+import gunbc.worker_turn_standing { codex_observed_standing_for_instance, cursor_observed_standing_from_snapshot }
+import gunbc.cursor_harness_credential { cursor_worker_turn_api_key_host_path, cursor_worker_turn_custody_host, cursor_worker_turn_argv, CursorWorkerTurnArgvReady, CursorWorkerTurnRefused }
 import gunbc.roadmap_dispatch_destination {
   node_dispatch_destination,
   DispatchDestinationResolved,
@@ -669,6 +680,130 @@ fn dispatch_actuator_claude_selection_observed(
   }
 }
 
+// THE CODEX AND CURSOR DRAWS OBSERVE BEFORE THEY SELECT, as the Claude draw does: the declared row's
+// standing admits no draw, so each request runs its custody-bound observation
+// (gunbc.worker_turn_standing), substitutes it into the declared row and selects over that. A rejected
+// credential, an exhausted codex bucket, a busy codex lock or a credential held on another host
+// therefore refuses typed before any spawn.
+fn codex_offer_provider_instance(inventory: ProviderInventory) -> ProviderInstance? {
+  fold(inventory.offers, init: none, f: (acc, offer) =>
+    match acc {
+      Present { value: _ } => acc
+      Absent =>
+        match offer {
+          OfferCodex { offer: o } => Present { value: o.instance }
+          OfferClaude { offer: _ } => acc
+          OfferCursor { offer: _ } => acc
+        }
+    }
+  )
+}
+
+// THE CODEX DRAW binds the custody CODEX_HOME directory itself, not a copy: a copied auth.json would
+// fork the refresh token, and the issuer refuses a reused one. So the shared one-snapshot rule
+// (dispatch_credential_snapshot_path_for_instance) is met by the directory and its flock instead --
+// admission observes it under the lock, the turn runs in it under the lock, and nothing else ever
+// writes it but codex under that lock. A turn that runs between admission and this attempt's spawn
+// may move the bucket the admission read; the spawn still binds the same credential, and a bucket
+// exhausted in that window fails the turn as the CLI reports it.
+fn codex_observed_inventory(instance: HostDashboardInstance) -> ProviderInventory {
+  let inventory = provider_inventory_for_instance(instance: instance)
+  inventory_with_codex_state_root(
+    inventory: inventory_with_observed_standing(
+      inventory: inventory,
+      kind: CodexCliProvider,
+      standing: match codex_offer_provider_instance(inventory: inventory) {
+        Absent => ProviderStandingUnobserved { reason: "this instance's inventory declares no codex offer" as NonEmptyStr }
+        Present { value: provider_instance } => codex_observed_standing_for_instance(instance: instance, provider: provider_instance)
+      },
+    ),
+    account_state_root: codex_worker_turn_codex_home as FilePath,
+  )
+}
+
+fn worker_turn_selection_of(inventory: ProviderInventory, kind: ProviderKind, sizing_expectation: SizingProfileExpectation) -> DispatchActuatorSelection {
+  match resolve_dispatch_selection(
+    inventory: inventory,
+    request: provider_selection_request_for_kind(kind: kind),
+    sizing_expectation: sizing_expectation,
+  ) {
+    DispatchSelectionResolved { receipt } =>
+      DispatchActuatorSelectionOk {
+        provider: provider_kind_to_dispatch_cli(kind: receipt.provider_kind),
+        effort: receipt.applied_effort,
+        model: resolved_model_selection(resolved: receipt.resolved_selection),
+        process_fingerprint: resolved_process_fingerprint(resolved: receipt.resolved_selection),
+      }
+    DispatchSelectionRefused { sizing_expectation: _, requested_selection: _, reason } =>
+      DispatchActuatorSelectionRefused { reason: reason }
+  }
+}
+
+// THE CURSOR DRAW takes the attempt's credential snapshot first (shared rule above): the status probe
+// reads that snapshot and keeps it, and the spawn loads the same snapshot and removes it before exec. A
+// refused draw discards the snapshot it took, as the Claude draw does; after selection the belt owns
+// the discard (gunbc.roadmap_belt_actuate belt_snapshot_owned_outcome).
+fn cursor_selection_observed(
+  instance: HostDashboardInstance,
+  node_id: RoadmapNodeId,
+  attempt_key: String,
+  sizing_expectation: SizingProfileExpectation,
+) -> DispatchActuatorSelection {
+  if (instance.host_identity as String) != (cursor_worker_turn_custody_host as String) {
+    DispatchActuatorSelectionRefused {
+      reason: provider_off_custody_host_reason(provider_label: "cursor", custody_host: cursor_worker_turn_custody_host, instance_host: instance.host_identity),
+    }
+  } else {
+    let snapshot_path = dispatch_credential_snapshot_path_for_instance(
+      instance: instance, node_id: node_id, attempt_key: attempt_key, provider: CursorDispatchProvider,
+    )
+    match dispatch_credential_snapshot_take(source: cursor_worker_turn_api_key_host_path, snapshot: snapshot_path) {
+      CredentialSnapshotRefused { reason } => DispatchActuatorSelectionRefused { reason: reason }
+      CredentialSnapshotTaken { path: snapshot } => {
+        let selection = worker_turn_selection_of(
+          inventory: inventory_with_observed_standing(
+            inventory: provider_inventory_for_instance(instance: instance),
+            kind: CursorCliProvider,
+            standing: cursor_observed_standing_from_snapshot(snapshot: snapshot),
+          ),
+          kind: CursorCliProvider,
+          sizing_expectation: sizing_expectation,
+        )
+        match selection {
+          DispatchActuatorSelectionOk { provider: _, effort: _, model: _, process_fingerprint: _ } => selection
+          DispatchActuatorSelectionRefused { reason } =>
+            if dispatch_credential_snapshot_discard(snapshot: snapshot) {
+              selection
+            } else {
+              DispatchActuatorSelectionRefused {
+                reason: join([reason as String, "; and the credential snapshot ", snapshot as String, " could not be removed"], "") as NonEmptyStr,
+              }
+            }
+        }
+      }
+    }
+  }
+}
+
+fn dispatch_actuator_worker_turn_selection_observed(
+  instance: HostDashboardInstance,
+  provider: DispatchCliProvider,
+  node_id: RoadmapNodeId,
+  attempt_key: String,
+  sizing_expectation: SizingProfileExpectation,
+) -> DispatchActuatorSelection {
+  match provider {
+    CodexDispatchProvider =>
+      worker_turn_selection_of(inventory: codex_observed_inventory(instance: instance), kind: CodexCliProvider, sizing_expectation: sizing_expectation)
+    CursorDispatchProvider =>
+      cursor_selection_observed(instance: instance, node_id: node_id, attempt_key: attempt_key, sizing_expectation: sizing_expectation)
+    ClaudeCodeProvider =>
+      DispatchActuatorSelectionRefused { reason: "the claude draw is observed by dispatch_actuator_claude_selection_observed" as NonEmptyStr }
+    GunbcHarnessProvider =>
+      DispatchActuatorSelectionRefused { reason: "worker-turn selection was asked for the gunbc harness, which has no vendor credential" as NonEmptyStr }
+  }
+}
+
 fn dispatch_actuator_selection_for_request(
   instance: HostDashboardInstance,
   request: DispatchExecutorRequest,
@@ -684,8 +819,14 @@ fn dispatch_actuator_selection_for_request(
           dispatch_actuator_claude_selection_observed(
             instance: instance, node_id: node_id, attempt_key: attempt_key, sizing_expectation: sizing_expectation,
           )
-        CodexDispatchProvider => dispatch_actuator_selection_for_provider_on(instance: instance, provider: provider, sizing_expectation: sizing_expectation)
-        CursorDispatchProvider => dispatch_actuator_selection_for_provider_on(instance: instance, provider: provider, sizing_expectation: sizing_expectation)
+        CodexDispatchProvider =>
+          dispatch_actuator_worker_turn_selection_observed(
+            instance: instance, provider: provider, node_id: node_id, attempt_key: attempt_key, sizing_expectation: sizing_expectation,
+          )
+        CursorDispatchProvider =>
+          dispatch_actuator_worker_turn_selection_observed(
+            instance: instance, provider: provider, node_id: node_id, attempt_key: attempt_key, sizing_expectation: sizing_expectation,
+          )
         GunbcHarnessProvider => dispatch_actuator_selection(sizing_expectation: sizing_expectation)
       }
   }
@@ -1513,13 +1654,24 @@ fn dispatch_review_unit_name(node_id: String, attempt_key: String, criterion_key
 // root (the first reviewer, 2026-09-05, exited 101 on exactly that with the worktree as its cwd), and
 // the worktree reaches the harness as the argument that sets its tools' directory, tool and subject
 // named separately (gunbc_harness_spawn_argv).
+//
+// THE EXIT RECORD REPLACES RemainAfterExit FOR THE REVIEWER AND AUDITOR (bold-bee-114 ruling,
+// 2026-10-06), for the worker's reason (dispatch_worker_unit_properties): a reviewer finishing is the
+// event the attempt's next obligation waits on, and a unit that stays `active (exited)` never stops,
+// so its stop hook could not fire at that moment. With an exit hook the unit stops with its process
+// and its record carries the exit; the belt reads a collected reviewer from that record
+// (gunbc.roadmap_belt_actuate belt_review_process). The SUPERVISOR shares this shape and passes no
+// hook: its convene gate still reads the retained unit, and moving it onto the record is not part of
+// this change -- so Absent keeps RemainAfterExit exactly as before, and that is the only reason the
+// parameter is optional.
 fn dispatch_review_unit_properties(
   instance: HostDashboardInstance,
   working_directory: String,
   log_path: String,
   review_dir: String,
+  exit_hook: NonEmptyStr?,
 ) -> List<SystemdRunProperty> {
-  [
+  concat([
     SystemdRunProperty { property: MemoryMax, value: to_string(value: byte_size_count(instance.dispatch_worker_memory_max)) as NonEmptyStr },
     SystemdRunProperty { property: WorkingDirectoryProperty, value: working_directory as NonEmptyStr },
     SystemdRunProperty { property: StandardOutputProperty, value: join(["append:", log_path], "") as NonEmptyStr },
@@ -1528,8 +1680,10 @@ fn dispatch_review_unit_properties(
     SystemdRunProperty { property: ProtectHomeProperty, value: "read-only" as NonEmptyStr },
     SystemdRunProperty { property: PrivateTmpProperty, value: "yes" as NonEmptyStr },
     SystemdRunProperty { property: ReadWritePathsProperty, value: review_dir as NonEmptyStr },
-    SystemdRunProperty { property: RemainAfterExitProperty, value: "yes" as NonEmptyStr },
-  ]
+  ], match exit_hook {
+    Present { value: hook } => [SystemdRunProperty { property: ExecStopPostProperty, value: hook }]
+    Absent => [SystemdRunProperty { property: RemainAfterExitProperty, value: "yes" as NonEmptyStr }]
+  })
 }
 
 data gunbc_harness_reviewer_function: String = "harness_reviewer_cli"
@@ -1587,6 +1741,7 @@ fn dispatch_review_unit_command(
   brief: String,
   head_sha: String,
   criterion_key: String,
+  exit_hook: NonEmptyStr,
 ) -> SystemdRunCommandReading {
   systemd_run_user_transient_command(
     unit: dispatch_review_unit_name(node_id: node_id as String, attempt_key: attempt_key, criterion_key: criterion_key),
@@ -1595,6 +1750,7 @@ fn dispatch_review_unit_command(
       working_directory: instance.repo_root as String,
       log_path: dispatch_attempt_review_log_path_for_instance(instance: instance, node_id: node_id, attempt_key: attempt_key, criterion_key: criterion_key),
       review_dir: dispatch_attempt_review_dir_for_instance(instance: instance, node_id: node_id, attempt_key: attempt_key),
+      exit_hook: Present { value: exit_hook },
     ),
     setenv_bindings: [],
     command_argv: gunbc_harness_review_argv(
@@ -1646,6 +1802,7 @@ fn dispatch_audit_unit_command(
   worktree_path: String,
   brief: String,
   head_sha: String,
+  exit_hook: NonEmptyStr,
 ) -> SystemdRunCommandReading {
   let dir = dispatch_attempt_audit_dir_for_instance(instance: instance, node_id: node_id, attempt_key: attempt_key)
   systemd_run_user_transient_command(
@@ -1655,6 +1812,7 @@ fn dispatch_audit_unit_command(
       working_directory: instance.repo_root as String,
       log_path: join([dir, "/auditor-stdout.log"], ""),
       review_dir: dir,
+      exit_hook: Present { value: exit_hook },
     ),
     setenv_bindings: [],
     command_argv: [
@@ -1718,6 +1876,7 @@ fn dispatch_supervisor_unit_command(
       working_directory: instance.repo_root as String,
       log_path: join([dir, "/supervisor-stdout.log"], ""),
       review_dir: dir,
+      exit_hook: none,
     ),
     setenv_bindings: [],
     command_argv: [
@@ -2235,11 +2394,22 @@ data gunbc_harness_needs_instance_reason: NonEmptyStr = "the gunbc harness worke
 type DispatchProviderInnerArgv
   = DispatchProviderInnerArgvReady { argv: List<String> }
   | CodexProviderExecutableAbsent { reason: NonEmptyStr }
-  | CursorProviderSpawnUnwired { reason: NonEmptyStr }
+  | CursorProviderOffCustodyHost { reason: NonEmptyStr }
+  | CursorProviderCredentialUnbound { reason: NonEmptyStr }
+  | CodexProviderOffCustodyHost { reason: NonEmptyStr }
   | GunbcHarnessSpawnNeedsInstance { reason: NonEmptyStr }
   | ClaudeProviderCredentialUnbound { reason: NonEmptyStr }
 
-data cursor_provider_spawn_unwired_reason: NonEmptyStr = "cursor dispatch inner argv is not wired on this actuator path" as NonEmptyStr
+// THE WORKER-TURN CREDENTIALS LIVE ON ONE HOST EACH (gunbc.cursor_harness_credential,
+// gunbc.codex_harness_credential), so a Cursor or Codex spawn on any other instance host refuses here
+// rather than running against an ambient login. The instance-less Cursor form cannot check the host
+// at all and refuses. On the custody host, codex runs with CODEX_HOME set to the custody directory,
+// never the instance's ambient login, and the run holds its flock for its whole life.
+data provider_custody_host_unknown_reason: NonEmptyStr = "no dashboard instance: the worker-turn credential's custody host cannot be checked" as NonEmptyStr
+
+fn provider_off_custody_host_reason(provider_label: String, custody_host: HostIdentity, instance_host: NonEmptyStr) -> NonEmptyStr {
+  join([provider_label, " worker-turn credential is held only on ", custody_host as String, "; this instance runs on ", instance_host as String], "") as NonEmptyStr
+}
 
 // THE HARNESS SPAWN. The worker is this repository's own binary running a .dag entry, so there is
 // no runtime to install, no provider home to seed and no version to reconcile against a committed
@@ -2351,7 +2521,7 @@ fn dispatch_provider_inner_argv(
         ),
       }
     CursorDispatchProvider =>
-      CursorProviderSpawnUnwired { reason: cursor_provider_spawn_unwired_reason }
+      CursorProviderOffCustodyHost { reason: provider_custody_host_unknown_reason }
     GunbcHarnessProvider =>
       GunbcHarnessSpawnNeedsInstance { reason: gunbc_harness_needs_instance_reason }
   }
@@ -2425,30 +2595,53 @@ fn dispatch_provider_inner_argv_for_instance(
         ),
       )
     CodexDispatchProvider =>
-      match dashboard_instance_provider_executable(instance: instance) {
-        Absent =>
-          CodexProviderExecutableAbsent {
-            reason: dashboard_instance_provider_executable_refusal_detail(instance: instance) as NonEmptyStr,
-          }
-        Present { value: codex_program } =>
-          DispatchProviderInnerArgvReady {
-            argv: shape_codex_exec_argv_for_programs(
-              env_program: dispatch_capability_program(
-                environment: instance.execution_environment,
-                cap: EnvironmentBindingCapability,
+      if (instance.host_identity as String) != (codex_worker_turn_custody_host as String) {
+        CodexProviderOffCustodyHost {
+          reason: provider_off_custody_host_reason(provider_label: "codex", custody_host: codex_worker_turn_custody_host, instance_host: instance.host_identity),
+        }
+      } else {
+        match dashboard_instance_provider_executable(instance: instance) {
+          Absent =>
+            CodexProviderExecutableAbsent {
+              reason: dashboard_instance_provider_executable_refusal_detail(instance: instance) as NonEmptyStr,
+            }
+          Present { value: codex_program } =>
+            DispatchProviderInnerArgvReady {
+              argv: codex_harness_turn_argv(
+                command: shape_codex_exec_argv_for_programs(
+                  env_program: dispatch_capability_program(
+                    environment: instance.execution_environment,
+                    cap: EnvironmentBindingCapability,
+                  ),
+                  program: codex_program as String,
+                  codex_home: codex_worker_turn_codex_home as String,
+                  cwd: worktree_path,
+                  prompt: join([brief, "\n\n", dispatch_codex_start_prompt], ""),
+                  reasoning_effort: effort,
+                  model: model,
+                  spec: dispatch_codex_exec_spec,
+                ),
               ),
-              program: codex_program as String,
-              codex_home: dashboard_instance_provider_state_root(instance: instance) as String,
-              cwd: worktree_path,
-              prompt: join([brief, "\n\n", dispatch_codex_start_prompt], ""),
-              reasoning_effort: effort,
-              model: model,
-              spec: dispatch_codex_exec_spec,
-            ),
-          }
+            }
+        }
       }
     CursorDispatchProvider =>
-      CursorProviderSpawnUnwired { reason: cursor_provider_spawn_unwired_reason }
+      if (instance.host_identity as String) != (cursor_worker_turn_custody_host as String) {
+        CursorProviderOffCustodyHost {
+          reason: provider_off_custody_host_reason(provider_label: "cursor", custody_host: cursor_worker_turn_custody_host, instance_host: instance.host_identity),
+        }
+      } else {
+        match cursor_worker_turn_argv(
+          key_path: dispatch_credential_snapshot_path_for_instance(
+            instance: instance, node_id: node_id, attempt_key: attempt_key, provider: CursorDispatchProvider,
+          ),
+          worktree_path: worktree_path,
+          prompt: brief as NonEmptyStr,
+        ) {
+          CursorWorkerTurnArgvReady { argv } => DispatchProviderInnerArgvReady { argv: argv }
+          CursorWorkerTurnRefused { reason } => CursorProviderCredentialUnbound { reason: reason }
+        }
+      }
     GunbcHarnessProvider =>
       DispatchProviderInnerArgvReady {
         argv: gunbc_harness_spawn_argv(
@@ -2652,13 +2845,16 @@ fn dispatch_attempt_unit_name(node_id: String, attempt_key: String) -> NonEmptyS
 // memory the cgroup enforces are one figure; it used to be the instance ceiling read directly. WorkingDirectory is the controller checkout for the reason
 // dispatch_pane_working_directory states. StandardOutput and StandardError append to the attempt's
 // own events path, so capture is a unit property rather than a quoted shell payload piped through
-// a terminal multiplexer.
+// a terminal multiplexer. ExecStopPost is the attempt's exit record (gunbc.roadmap.roadmap_attempt_exit_spool
+// attempt_exit_hook): one create-only mkdir whose name carries the manager's stop-time facts, written
+// at the moment the worker's process ends -- the event the capture obligation is invoked on.
 fn dispatch_worker_unit_properties(
   instance: HostDashboardInstance,
   working_directory: String,
   worker_log_path: String,
   granted: Kibibyte,
   process_bounds: UnitProcessBounds,
+  exit_hook: NonEmptyStr,
 ) -> List<SystemdRunProperty> {
   concat(
     compute_grant_unit_properties(granted: granted, working_directory: working_directory, process_bounds: Present { value: process_bounds }),
@@ -2669,19 +2865,26 @@ fn dispatch_worker_unit_properties(
       SystemdRunProperty { property: ProtectHomeProperty, value: "read-only" as NonEmptyStr },
       SystemdRunProperty { property: PrivateTmpProperty, value: "yes" as NonEmptyStr },
       SystemdRunProperty { property: ReadWritePathsProperty, value: dispatch_worker_writable_paths(instance: instance) as NonEmptyStr },
-      SystemdRunProperty { property: RemainAfterExitProperty, value: "yes" as NonEmptyStr },
+      SystemdRunProperty { property: ExecStopPostProperty, value: exit_hook },
     ],
   )
 }
 
-// THE UNIT OUTLIVES ITS PROCESS ON PURPOSE. A transient unit whose main process exits 0 is collected
-// by the manager and reads LoadState=not-found a moment later; one that exits nonzero is retained as
-// failed. The process observer below read not-found as "never ran", so a SUCCESSFUL worker was the one
-// case the belt could not commit or verify -- measured 2026-09-05 on the first worker to finish with
-// turn.completed (attempt ce21f99eb2e82ec1: worktree dirty, commit "provider not completed"), while
-// the eight failed attempts before it were all committed. RemainAfterExit keeps the unit loaded as
-// active (exited) with its ExecMainStatus readable until it is stopped, so the exit is an observable
-// fact for as long as the attempt needs it, on both exit paths alike.
+// THE UNIT NO LONGER OUTLIVES ITS PROCESS; THE EXIT RECORD DOES (reversal of the 2026-09-05 choice,
+// bold-bee-114 ruling 2026-10-06 on dogfood intervention #4). A transient unit whose main process
+// exits 0 is collected by the manager and reads LoadState=not-found a moment later. On 2026-09-05 the
+// observer read not-found as "never ran", so a SUCCESSFUL worker was the one case the belt could not
+// commit or verify (attempt ce21f99eb2e82ec1), and RemainAfterExit=yes was added to keep the unit
+// loaded as `active (exited)` with its ExecMainStatus readable.
+//
+// That kept the exit observable only as manager MEMORY -- lost on a reboot, a manager restart or a
+// reap -- and, because a RemainAfterExit unit never stops when its process ends, it made a stop hook
+// impossible: ExecStopPost would run at teardown, not at exit, so nothing could be invoked BY the
+// exit. The exit record replaces it. The hook writes it at exit, on disk, under the instance root,
+// carrying the same facts ExecMainStatus did plus the manager's result and whether the process
+// exited or was signaled. The observer reads the unit while it is loaded and the record once it is
+// not (attempt_worker_unit_observation), and a unit that is gone with NO record is reported as
+// exactly that -- never as a worker that did not run.
 
 // THE WORKER MAY WRITE ONLY UNDER THE INSTANCE ROOT: its worktree, its attempt state, the spool. The
 // second belt-dispatched attempt (2026-09-04) edited the deploy tree instead of its worktree, having
@@ -2708,6 +2911,7 @@ type DispatchWorkerUnitPlan {
   working_directory: String
   worker_log_path: String
   inner_argv: List<String>
+  exit_hook: NonEmptyStr
 }
 
 fn dispatch_worker_unit_properties_for_plan(instance: HostDashboardInstance, plan: DispatchWorkerUnitPlan, granted: Kibibyte, process_bounds: UnitProcessBounds) -> List<SystemdRunProperty> {
@@ -2717,6 +2921,7 @@ fn dispatch_worker_unit_properties_for_plan(instance: HostDashboardInstance, pla
     worker_log_path: plan.worker_log_path,
     granted: granted,
     process_bounds: process_bounds,
+    exit_hook: plan.exit_hook,
   )
 }
 
@@ -2768,16 +2973,22 @@ fn dispatch_session_container_for_provider(
             ], ""),
           }
         Present { value: program } =>
-          DispatchSessionContainerReady {
-            container: SystemdUnitContainer {
-              plan: DispatchWorkerUnitPlan {
-                systemd_run_program: program,
-                unit: dispatch_attempt_unit_name(node_id: node_id, attempt_key: attempt_key),
-                working_directory: pane_working_directory,
-                worker_log_path: worker_log_path,
-                inner_argv: provider_inner,
-              },
-            },
+          match attempt_exit_hook(instance_root: instance.instance_root as String, node_id: node_id, attempt_key: attempt_key, role: AttemptWorkerRole) {
+            AttemptExitHookRefused { reason } =>
+              DispatchSessionContainerUnavailable { step: "worker-exit-hook" as NonEmptyStr, detail: reason as String }
+            AttemptExitHookRendered { exec_line } =>
+              DispatchSessionContainerReady {
+                container: SystemdUnitContainer {
+                  plan: DispatchWorkerUnitPlan {
+                    systemd_run_program: program,
+                    unit: dispatch_attempt_unit_name(node_id: node_id, attempt_key: attempt_key),
+                    working_directory: pane_working_directory,
+                    worker_log_path: worker_log_path,
+                    inner_argv: provider_inner,
+                    exit_hook: exec_line,
+                  },
+                },
+              }
           }
       }
     ClaudeCodeProvider =>
@@ -3235,9 +3446,19 @@ fn dispatch_spawn_commands_for_resolved_instance(
     brief: brief,
     alignment_chain_fingerprint: alignment_chain_fingerprint(chain: chain),
   ) {
-    CursorProviderSpawnUnwired { reason } =>
+    CursorProviderOffCustodyHost { reason } =>
+      DispatchSpawnRefused {
+        step: "cursor-credential-custody-host" as NonEmptyStr,
+        detail: reason as String,
+      }
+    CodexProviderOffCustodyHost { reason } =>
       DispatchSpawnRefused {
-        step: "cursor-provider-spawn" as NonEmptyStr,
+        step: "codex-credential-custody-host" as NonEmptyStr,
+        detail: reason as String,
+      }
+    CursorProviderCredentialUnbound { reason } =>
+      DispatchSpawnRefused {
+        step: "cursor-credential-binding" as NonEmptyStr,
         detail: reason as String,
       }
     CodexProviderExecutableAbsent { reason } =>
@@ -4011,6 +4232,58 @@ fn attempt_unit_substate_has_exited(substate: String) -> Bool {
   substate == "exited" || substate == "failed" || substate == "dead"
 }
 
+// THE WORKER UNIT'S OBSERVATION: the manager while the unit is loaded, the exit record once it is
+// not. The worker unit no longer carries RemainAfterExit (dispatch_worker_unit_properties), so a
+// worker that exited 0 is collected and the manager answers not-found; its stop hook wrote the exit
+// record first (ExecStopPost runs before the unit leaves the manager), so a collected worker is read
+// from that record, carrying the same status ExecMainStatus carried.
+//
+// A COLLECTED UNIT WITH NO RECORD IS NOT A WORKER THAT NEVER RAN (bold-bee-114, 2026-10-06, condition
+// 1). Dispatch's own start receipt separates the two: the G5 placement record is written immediately
+// before every worker unit is started (gunbc.roadmap_belt_actuate belt_session_container_create), so
+// an attempt with a placement record and no exit record had a unit that ended without its hook
+// writing -- a failed hook, which is reported as indeterminate and located, never as absence
+// (condition 2). Only an attempt with NO placement record answers absent: it never had a unit,
+// which is the vendor (tmux) population and the attempt whose spawn never reached the unit start.
+type AttemptUnitStartStanding
+  = AttemptUnitStartRecorded
+  | AttemptUnitNeverStarted
+  | AttemptUnitStartUnread { reason: String }
+
+// A SIGNALED WORKER IS READ AS systemd's ExecMainStatus READ IT: the signal number. That is the
+// reading every consumer of WorkerProcessExited saw before this change, preserved exactly so no
+// consumer's decision moves; the record keeps the distinction (AttemptProcessSignaled) and a
+// signaled arm on WorkerProcessEvidence is the named follow-up (docs/plans/belt-event-driven-obligations.md,
+// Follow-ups; trigger: the next change to a WorkerProcessExited consumer's decision).
+fn attempt_unit_from_exit_record(unit: NonEmptyStr, record: AttemptExitRecordObservation, start: AttemptUnitStartStanding) -> AttemptUnitObservation {
+  match record {
+    AttemptExitRecordUnreadable { reason } =>
+      AttemptUnitUnreadable { reason: join(["unit ", unit as String, " is not loaded and its exit record could not be read: ", reason], "") }
+    AttemptExitRecordFound { record: r } =>
+      match r.end {
+        AttemptProcessExitedWith { status } => AttemptUnitFinished { exit_status: to_string(value: status) }
+        AttemptProcessSignaled { signal } => AttemptUnitFinished { exit_status: to_string(value: linux_standard_signal_number(signal: signal)) }
+      }
+    AttemptExitRecordNone =>
+      match start {
+        AttemptUnitNeverStarted => AttemptUnitAbsent
+        AttemptUnitStartRecorded =>
+          AttemptUnitUnreadable { reason: join(["unit ", unit as String, " was started under a placement grant and is no longer loaded, and it left no exit record: its ExecStopPost hook did not write (see the user journal for this unit)"], "") }
+        AttemptUnitStartUnread { reason } =>
+          AttemptUnitUnreadable { reason: join(["unit ", unit as String, " is not loaded and left no exit record, and whether it was started could not be read: ", reason], "") }
+      }
+  }
+}
+
+fn attempt_worker_unit_observation_of(unit: NonEmptyStr, loaded: AttemptUnitObservation, record: AttemptExitRecordObservation, start: AttemptUnitStartStanding) -> AttemptUnitObservation {
+  match loaded {
+    AttemptUnitAbsent => attempt_unit_from_exit_record(unit: unit, record: record, start: start)
+    AttemptUnitActive => AttemptUnitActive
+    AttemptUnitFinished { exit_status } => AttemptUnitFinished { exit_status: exit_status }
+    AttemptUnitUnreadable { reason } => AttemptUnitUnreadable { reason: reason }
+  }
+}
+
 fn worker_process_from_attempt_unit(
   observation: AttemptUnitObservation,
   unit: NonEmptyStr,
diff --git a/dag/gunbc/roadmap/roadmap_dogfood_route.dag b/dag/gunbc/roadmap/roadmap_dogfood_route.dag
index 17cd83faceb..5cf9ccf31ba 100644
--- a/dag/gunbc/roadmap/roadmap_dogfood_route.dag
+++ b/dag/gunbc/roadmap/roadmap_dogfood_route.dag
@@ -641,7 +641,7 @@ data dogfood_start_receipt_key: NonEmptyStr = "dogfood-start-receipt" as NonEmpt
 data dogfood_start_receipt_schema: String = "dogfood-start-receipt/v6"
 
 // THE SLOT LIVES IN A ROOT THE DEPLOYMENT ALREADY CONVERGES. The file CAS store does not create its
-// root (gunbc.durable_cas_file_store), so the slot is placed in the instance's attempt-state root --
+// the attempt-state demand (gunbc.roadmap_dashboard_instance dashboard_instance_dispatch_attempt_state_directory) both deployment routes ensure with its owner
 // the AttemptStateRoot member gunbc.live_deploy.spec deployment_owned_steps installs with its owner
 // and mode before any belt timer runs, and the directory the session placement records already
 // share -- under its own key. A root of its own would be a second deployment member for one file.
diff --git a/dag/gunbc/roadmap/roadmap_event_carrier.dag b/dag/gunbc/roadmap/roadmap_event_carrier.dag
index 69d5d4020d5..636c76c5ce7 100644
--- a/dag/gunbc/roadmap/roadmap_event_carrier.dag
+++ b/dag/gunbc/roadmap/roadmap_event_carrier.dag
@@ -38,7 +38,9 @@ import extdeps.git {
   shape_git_add_path_args, shape_git_commit_message_args, shape_git_ls_remote_heads_args,
 }
 import gunbc.roadmap_model { RoadmapNodeId }
-import gunbc.roadmap_dashboard_instance { HostDashboardInstance, srv2_dashboard_preview_id, dashboard_instance_roadmap_events_worktree, dashboard_instance_roadmap_events_worktree_under }
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, srv2_dashboard_preview_id, dashboard_instance_shared_directory, dashboard_instance_child }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_path }
+import gunbc.roadmap.roadmap_event_carrier_directory { roadmap_events_worktree_child, roadmap_event_carrier_directory }
 import gunbc.roadmap_dispatch_actuator { dispatch_capability_program }
 import gunbc.roadmap_execution_contract { GitWorkspaceCapability, AttemptStateDirectoryCapability }
 import gunbc.roadmap.roadmap_event_log {
@@ -72,7 +74,7 @@ fn roadmap_event_carrier_layout_for_instance(instance: HostDashboardInstance) ->
   RoadmapEventCarrierLayout {
     remote: if instance.instance_id == srv2_dashboard_preview_id { concat(instance.instance_root as String, "/ui-preview-events.git") } else { roadmap_events_remote },
     repo_root: instance.repo_root,
-    worktree: dashboard_instance_roadmap_events_worktree(instance: instance),
+    worktree: owned_directory_path(t: roadmap_event_carrier_directory(instance: instance)),
     git_program: dispatch_capability_program(environment: instance.execution_environment, cap: GitWorkspaceCapability),
     directory_program: dispatch_capability_program(environment: instance.execution_environment, cap: AttemptStateDirectoryCapability),
   }
@@ -82,7 +84,7 @@ fn roadmap_event_carrier_layout(repo_root: FilePath, instance_root: FilePath, gi
   RoadmapEventCarrierLayout {
     remote: roadmap_events_remote,
     repo_root: repo_root,
-    worktree: dashboard_instance_roadmap_events_worktree_under(instance_root: instance_root),
+    worktree: dashboard_instance_child(root: instance_root, child: roadmap_events_worktree_child),
     git_program: git_program,
     directory_program: directory_program,
   }
@@ -131,10 +133,24 @@ fn carrier_exec_program(program: String, workdir: String, args: List<String>) ->
 // it, so the FIRST event has a parent tree to land in. Each step that fails is named.
 type CarrierEnsure = CarrierReady | CarrierEnsureRefused { step: String, reason: String }
 
+// A LISTED DIRECTORY IS NOT A WORKTREE. The deployment ensures the worktree's directory empty and owned
+// (roadmap_event_carrier_directory), so presence alone stopped meaning "checked out": an empty
+// directory is checked out into (git worktree add accepts an empty existing directory), a directory
+// holding the worktree's `.git` link is ready, and anything else is refused rather than overwritten.
+fn roadmap_event_worktree_entries(listing: String) -> List<String> {
+  filter(xs: split(s: listing, delimiter: "\n"), predicate: e => e != "")
+}
+
 fn roadmap_event_carrier_ensure(layout: RoadmapEventCarrierLayout) -> CarrierEnsure {
   let probe = Filesystem.List(path: layout.worktree as String)
-  if probe.success {
+  let entries = if probe.success { roadmap_event_worktree_entries(listing: probe.entries) } else { [] }
+  if probe.success && any(entries, e => e == ".git") {
     CarrierReady
+  } else if probe.success && count(entries) > 0 {
+    CarrierEnsureRefused {
+      step: "worktree-probe",
+      reason: join([layout.worktree as String, " exists, is not empty and holds no .git link; it is never overwritten"], ""),
+    }
   } else {
     match carrier_exec(layout: layout, workdir: layout.repo_root as String, args: shape_git_ls_remote_heads_args(remote: layout.remote, branch: roadmap_events_branch)) {
       CarrierExecFailed { exit_code, stderr } => CarrierEnsureRefused { step: "ls-remote", reason: join(["exit ", to_string(value: exit_code), ": ", stderr], "") }
diff --git a/dag/gunbc/roadmap/roadmap_event_carrier_directory.dag b/dag/gunbc/roadmap/roadmap_event_carrier_directory.dag
new file mode 100644
index 00000000000..f27f6e1accc
--- /dev/null
+++ b/dag/gunbc/roadmap/roadmap_event_carrier_directory.dag
@@ -0,0 +1,21 @@
+module gunbc.roadmap.roadmap_event_carrier_directory
+
+import std.types { String, NonEmptyStr }
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_shared_directory }
+import gunbc.owned_directory { OwnedDirectoryTarget }
+
+// The event carrier's directory demand, split out of gunbc.roadmap.roadmap_event_carrier so that
+// gunbc.roadmap.dashboard_instance_directories can list it without importing the carrier and,
+// through it, the dispatch actuator: that edge closed an import cycle through gunbc.host_standup,
+// gunbc.host_effect and gunbc.live_deploy.spec.
+data roadmap_events_worktree_child: String = "roadmap-events"
+
+// THE DIRECTORY THE CARRIER DEMANDS: the worktree it checks the event branch out into, under the instance
+// root. The carrier's `git worktree add` cannot create it where the instance root is not the service
+// principal's to write (srv1's /opt/gunbc is root-owned), which is what answered every issue page 503;
+// so the directory is a target both deployment routes ensure (gunbc.roadmap.dashboard_instance_directories)
+// and the layout's worktree is read off it. The worktree is checked out INTO the ensured directory --
+// roadmap_event_carrier_ensure treats an empty directory as one to check out into, not as a worktree.
+fn roadmap_event_carrier_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  dashboard_instance_shared_directory(instance: instance, member: "roadmap-events" as NonEmptyStr, child: roadmap_events_worktree_child)
+}
diff --git a/dag/gunbc/roadmap/roadmap_fleet_components.dag b/dag/gunbc/roadmap/roadmap_fleet_components.dag
index 07f9b3817b4..1a4fe743a7e 100644
--- a/dag/gunbc/roadmap/roadmap_fleet_components.dag
+++ b/dag/gunbc/roadmap/roadmap_fleet_components.dag
@@ -3,7 +3,7 @@ module gunbc.roadmap_fleet_components
 import std.types { String, List, Int }
 import product.host_identity { HostIdentity }
 import extdeps.google.issue_tracker { Component }
-import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4, operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
 import gunbc.spark.fabric_switch_observed { fabric_group_of_host, fabric_group_wire }
 
 // Tracker component identifiers are existing external identities, retained across this move.
@@ -15,10 +15,6 @@ data fleet_component_bindings: List<FleetComponentBinding> = [
   FleetComponentBinding { id: 2, host: operator_host_srv2 },
   FleetComponentBinding { id: 3, host: operator_host_srv3 },
   FleetComponentBinding { id: 4, host: operator_host_srv4 },
-  FleetComponentBinding { id: 5, host: operator_host_srv5 },
-  FleetComponentBinding { id: 6, host: operator_host_srv6 },
-  FleetComponentBinding { id: 7, host: operator_host_srv7 },
-  FleetComponentBinding { id: 8, host: operator_host_srv8 },
   FleetComponentBinding { id: 9, host: operator_host_srv9 },
   FleetComponentBinding { id: 10, host: operator_host_srv10 },
   FleetComponentBinding { id: 11, host: operator_host_srv11 },
diff --git a/dag/gunbc/roadmap/roadmap_launch_deployment_cli.dag b/dag/gunbc/roadmap/roadmap_launch_deployment_cli.dag
index 152943c861f..f88c5fb782f 100644
--- a/dag/gunbc/roadmap/roadmap_launch_deployment_cli.dag
+++ b/dag/gunbc/roadmap/roadmap_launch_deployment_cli.dag
@@ -3,6 +3,7 @@ module gunbc.roadmap_launch_deployment_cli
 import std.types { String, Bool, NonEmptyStr, Int, List, FilePath, CommitSha }
 import std.algebra { trim }
 import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
+import std.measure { second, second_count }
 import extdeps.filesystem.filesystem_io { Filesystem }
 import extdeps.git
 import extdeps.git.object_store { git_object_id_from_untagged_hex, git_object_id_wire_hex }
@@ -22,7 +23,7 @@ import gunbc.clock_read { clock_now_probed_at_or_unknown }
 import gunbc.host_layout { srv1_gunbc_repo_root, instance_receipts_dir }
 import gunbc.actions_run_binding {
   ActionsRunBinding, observe_actions_run_binding, ActionsRunBound, ActionsRunUnbound,
-  read_expected_revision, ExpectedRevisionPresent, ExpectedRevisionAbsent,
+  read_expected_revision, ExpectedRevisionPresent, ExpectedRevisionAbsent, ExpectedRevisionMalformed,
   admit_run_revision, RunRevisionAdmitted, RunRevisionRefused,
   actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent,
   run_binding_names_workflow_file,
@@ -53,18 +54,19 @@ import gunbc.live_deploy.release_binding { deployed_release_binding, ReleaseBind
 import gunbc.roadmap_site_surface_observe { materialize_live_roadmap_site_surface_bundle }
 import gunbc.running_release_identity { RunningReleaseIdentified, RunningReleaseUnidentified }
 import gunbc.live_deploy.readiness { running_release_unidentified_detail }
-import gunbc.live_deploy.spec { deployment_belt_service_unit_name, deployment_belt_timer_unit_name, deployment_tailnet_url }
+import gunbc.live_deploy.spec { deployment_belt_service_unit_name, deployment_belt_exit_path_unit_name, deployment_belt_answer_path_unit_name, deployment_tailnet_url }
 import gunbc.live_deploy.desired { deployment_spec_srv1 }
 import gunbc.live_deploy.emit {
   live_deploy_serve_unit_file,
   live_deploy_belt_service_unit_file,
-  live_deploy_belt_timer_unit_file,
+  live_deploy_belt_exit_path_unit_file,
+  live_deploy_belt_answer_path_unit_file,
 }
 import gunbc.live_deploy.release_locus {
   RevisionBoundAtEmission,
 }
 import gunbc.live_deploy.unit_standing {
-  LaunchUnitStanding, observe_dashboard_service_standing, observe_belt_timer_standing, observe_belt_oneshot_standing,
+  LaunchUnitStanding, observe_dashboard_service_standing, observe_belt_event_path_standing, observe_belt_oneshot_standing,
 }
 import gunbc.deploy_transition { ActuationStanding, ActuationPermitted, ActuationInhibited, ActuationStandingUnreadable, transition_actuation_standing }
 import gunbc.roadmap_dashboard_instance { HostDashboardInstance, srv1_live_dashboard_instance }
@@ -72,6 +74,7 @@ import gunbc.roadmap_belt_actuate {
   belt_tick_receipt_read_for_instance, BeltTickReceiptPresent, BeltTickReceiptAbsent, BeltTickReceiptUnreadable,
   belt_footprint_admission_for_instance, belt_provider_preflight_for_instance,
   BeltProviderPreflight, ProviderPreflightRefused,
+  belt_exit_spool_times, BeltExitSpoolTimesRead, BeltExitSpoolTimesUnreadable,
 }
 import gunbc.roadmap_dispatch_actuator { dispatch_actuator_selection, DispatchActuatorSelectionOk, DispatchActuatorSelectionRefused }
 import gunbc.dispatch_selection { NoDerivedSizingExpectation }
@@ -81,7 +84,7 @@ import gunbc.roadmap_launch_deployment_observe {
   observe_healthz, HealthzServed, HealthzRefused,
   observe_instance_document, InstanceDocumentServed, InstanceDocumentRefused,
   observe_workflow_document, WorkflowDocumentServed, WorkflowDocumentRefused,
-  belt_tick_freshness,
+  EventBacklogFact, EventBacklogUnobserved, EventBacklogEntry, event_backlog_judge, iso8601_utc_epoch_seconds,
   observe_healthz_routed,
   observe_instance_document_routed,
   observe_workflow_document_routed,
@@ -360,15 +363,27 @@ fn dispatch_preflight_fact(instance: HostDashboardInstance) -> DispatchPreflight
   }
 }
 
-fn tick_fact(instance: HostDashboardInstance, dashboard: DashboardReceiptFact, now: String) -> TickFact {
+fn tick_fact(instance: HostDashboardInstance) -> TickFact {
   match belt_tick_receipt_read_for_instance(instance: instance) {
     BeltTickReceiptAbsent => TickUnobserved { detail: "no belt tick receipt on the instance" }
     BeltTickReceiptUnreadable { reason: r } => TickUnobserved { detail: join(["belt tick receipt unreadable: ", r], "") }
-    BeltTickReceiptPresent { receipt: t } =>
-      match dashboard {
-        DashboardReceiptUnreadable { reason: r } => TickUnobserved { detail: join(["tick freshness cannot be judged without the dashboard receipt: ", r], "") }
-        DashboardReceiptRead { receipt: d } =>
-          TickObserved { receipt: t, freshness: belt_tick_freshness(observed_at: t.observed_at, deploy_completed_at: d.completed_at, now: now) }
+    BeltTickReceiptPresent { receipt: t } => TickObserved { receipt: t }
+  }
+}
+
+// THE BACKLOG ROW'S WET HALF: the exit spool's unconsumed entries, aged against the receipt run's own
+// now. The judgment is pure (event_backlog_judge); an unreadable spool or now refuses as unobserved.
+fn event_backlog_fact(instance: HostDashboardInstance, now: String) -> EventBacklogFact {
+  match iso8601_utc_epoch_seconds(text: now) {
+    Absent => EventBacklogUnobserved { detail: join(["the receipt run's now did not parse: ", now], "") }
+    Present { value: now_s } =>
+      match belt_exit_spool_times(instance: instance) {
+        BeltExitSpoolTimesUnreadable { reason } => EventBacklogUnobserved { detail: reason }
+        BeltExitSpoolTimesRead { entries } =>
+          match (entries |> filter(e => (e.mtime_epoch as Int) > second_count(now_s))).first() {
+            Present { value: e } => EventBacklogUnobserved { detail: join(["exit spool entry ", e.entry, " is modified after the receipt run's now; the clock or the stat is unreliable"], "") }
+            Absent => event_backlog_judge(entries: entries |> map(e => EventBacklogEntry { stage: e.stage, entry: e.entry, age: second(count: second_count(now_s) - (e.mtime_epoch as Int)) }))
+          }
       }
   }
 }
@@ -381,9 +396,13 @@ fn unit_standing_fact(revision: String) -> LaunchUnitStanding
       unit: spec.names.unit_name,
       file: live_deploy_serve_unit_file(spec: spec, revision: RevisionBoundAtEmission { revision: revision as CommitSha }),
     ),
-    timer: observe_belt_timer_standing(
-      unit: deployment_belt_timer_unit_name(names: spec.names),
-      file: live_deploy_belt_timer_unit_file(spec: spec),
+    exit_path: observe_belt_event_path_standing(
+      unit: deployment_belt_exit_path_unit_name(names: spec.names),
+      file: live_deploy_belt_exit_path_unit_file(spec: spec),
+    ),
+    answer_path: observe_belt_event_path_standing(
+      unit: deployment_belt_answer_path_unit_name(names: spec.names),
+      file: live_deploy_belt_answer_path_unit_file(spec: spec),
     ),
     oneshot: observe_belt_oneshot_standing(
       unit: deployment_belt_service_unit_name(names: spec.names),
@@ -402,6 +421,8 @@ fn rlm_launch_deployment_receipt_wet() -> ProcessExit
       match read_expected_revision() {
         ExpectedRevisionAbsent { variable: v, detail: d } =>
           exit_failure(reason: join(["rlm_launch_deployment_receipt: ExpectedRevisionAbsent — ", v, " ", d], ""))
+        ExpectedRevisionMalformed { variable: v, value: r } =>
+          exit_failure(reason: join(["rlm_launch_deployment_receipt: ExpectedRevisionMalformed — ", v, " is not a 40-digit lower-hex revision: ", r], ""))
         ExpectedRevisionPresent { revision: expected } =>
           match admit_run_revision(binding: run, expected: expected) {
             RunRevisionRefused { expected: e, observed: o } =>
@@ -633,7 +654,8 @@ fn rlm_launch_deployment_receipt_bound(
     readiness: readiness,
     transition: transition_actuation_standing(instance_root: instance.instance_root as String),
     unit_standing: unit_standing,
-    tick_standing: tick_fact(instance: instance, dashboard: dashboard, now: now),
+    tick_standing: tick_fact(instance: instance),
+    event_backlog: event_backlog_fact(instance: instance, now: now),
     footprint: belt_footprint_admission_for_instance(instance: instance),
     provider_preflight: provider_fact(instance: instance),
     dispatch_preflight: dispatch_preflight_fact(instance: instance),
diff --git a/dag/gunbc/roadmap/roadmap_launch_deployment_observe.dag b/dag/gunbc/roadmap/roadmap_launch_deployment_observe.dag
index c24f0e5c529..846e6d1ff1c 100644
--- a/dag/gunbc/roadmap/roadmap_launch_deployment_observe.dag
+++ b/dag/gunbc/roadmap/roadmap_launch_deployment_observe.dag
@@ -1,9 +1,7 @@
 module gunbc.roadmap_launch_deployment_observe
 
-import extdeps.systemd { systemd_duration_usec }
-import std.measure { Second, second, second_count, microsecond_count }
+import std.measure { Second, second, second_count }
 import std.checked_arithmetic { checked_int_magnitude, CheckedNat, CheckedNatReady, CheckedNatOverflow }
-import gunbc.live_deploy.belt_cadence { belt_tick_cadence }
 
 import std.types { String, Bool, NonEmptyStr, Int, List }
 import std.algebra { trim }
@@ -18,6 +16,8 @@ import extdeps.languages.json.parse {
 }
 import gunbc.actions_run_binding { json_required_string_member, JsonStringMemberFound, JsonStringMemberRefused }
 import gunbc.running_release_identity { RunningReleaseIdentity, observe_running_release_identity }
+import gunbc.roadmap.roadmap_attempt_exit_spool { AttemptExitSpoolStage, AttemptExitInbox, AttemptExitQueued, AttemptExitRunning, AttemptExitDone, AttemptExitRefused }
+import gunbc.live_deploy.belt_cadence { belt_tick_run_bound }
 import gunbc.roadmap_belt_actuate {
   BeltTickReceipt, BeltTickReceiptRead, BeltTickReceiptPresent, BeltTickReceiptAbsent, BeltTickReceiptUnreadable,
   belt_tick_receipt_decode,
@@ -41,11 +41,8 @@ import gunbc.roadmap_belt_actuate {
 // disk. HTTP 200 is not sufficient for /workflow.json: a valid document whose belt_tick is absent
 // or unreadable refuses RLM-2 rather than reading as Idle.
 // 
-// TICK FRESHNESS is decided on two clock readings the receipt run does not control -- the tick's
-// own observed_at and the dashboard receipt's completed_at, both rendered by extdeps.clock Now on
-// srv1 as `%Y-%m-%dT%H:%M:%SZ` -- against the receipt run's own now. The bound is derived from the
-// emitted timer cadence (gunbc.live_deploy.belt_cadence belt_tick_cadence, 60s) times a fixed multiplier,
-// never typed as an independent number.
+// BELT LIVENESS is no longer tick freshness: there is no timer cadence to be fresh against. It is the
+// event backlog below (event_backlog_judge) -- events recorded and not consumed within their bound.
 // ---------------------------------------------------------------- HTTP GET
 type HttpBodyRead
   = HttpBodyServed { body: String }
@@ -325,88 +322,99 @@ fn iso8601_utc_epoch_seconds(text: String) -> Second? {
   }
 }
 
-// ---------------------------------------------------------------- tick freshness
-// THE BOUND IS DERIVED FROM THE EMITTED CADENCE: the belt timer fires OnUnitInactiveSec after each
-// tick completes, so a live timer produces a receipt at most one cadence plus one tick duration
-// old. Three cadences is the admission; a receipt older than that came from a timer that is not
-// running now, whatever the unit file says.
-// Derived from the ONE emitted cadence authority (gunbc.live_deploy.belt_cadence belt_tick_cadence),
-// normalized through systemd.time(7); a spelling that stops normalizing refuses freshness rather
-// than silently keeping an out-of-date number here.
-fn belt_tick_cadence_seconds_derived() -> Second? {
-  match systemd_duration_usec(text: belt_tick_cadence) {
-    Absent => none
-    Present { value: usec } =>
-      match checked_int_magnitude(a: microsecond_count(usec) / 1000000) {
-        CheckedNatOverflow { cause: _ } => none
-        CheckedNatReady { value: n } => Present { value: second(count: n) }
-      }
+// ---------------------------------------------------------------- event backlog
+// FRESHNESS AGAINST EVENTS, NOT A CLOCK (dogfood intervention #4; bold-bee-114 ruling 2026-10-06).
+// The belt used to be live when its tick receipt was younger than three timer cadences. There is no
+// timer: the belt runs when an event arrives, so the age of the last tick says nothing about whether
+// it is alive -- an idle belt is correctly silent. What a dead belt leaves behind is EVENTS NOBODY
+// CONSUMED. So the row reads the exit spool: an exit still in the inbox past the drain bound means the
+// path unit or its drain is not consuming; an exit still queued past the obligation bound means the
+// attempt's obligation unit did not finish. Either refuses, naming the oldest entry. An active .path
+// unit (the unit standing row) proves only that the watcher is armed; this row proves it is consumed.
+//
+// THE BOUNDS ARE DERIVED FROM THE THINGS THEY BOUND, AS DURATIONS. The drain is one `gunbc run` that
+// moves entries, so its bound is the corpus load plus slack (a policy row, in Second). The queued bound
+// IS the obligation unit's own RuntimeMaxSec (gunbc.live_deploy.belt_cadence belt_tick_run_bound,
+// a Second, no text parsed) plus the drain bound: past that the unit has been stopped
+// by its manager, and an entry still queued is one no run settled. Changing the run bound moves this
+// bound; there is no second copy of it.
+data event_backlog_drain_bound: Second = second(count: 900)
+
+fn event_backlog_queued_bound() -> Second? {
+  Present { value: second(count: second_count(s: belt_tick_run_bound) + second_count(s: event_backlog_drain_bound)) }
+}
+
+fn event_backlog_bound(stage: AttemptExitSpoolStage) -> Second? {
+  match stage {
+    AttemptExitInbox => Present { value: event_backlog_drain_bound }
+    AttemptExitQueued => event_backlog_queued_bound()
+    AttemptExitRunning => event_backlog_queued_bound()
+    AttemptExitDone => none
+    AttemptExitRefused => none
   }
 }
-data belt_tick_freshness_cadence_multiplier: Int = 3
-
-fn belt_tick_freshness_bound_seconds() -> Second? {
-  match belt_tick_cadence_seconds_derived() {
-    Absent => none
-    Present { value: cadence } =>
-      match checked_int_magnitude(a: second_count(cadence) * belt_tick_freshness_cadence_multiplier) {
-        CheckedNatOverflow { cause: _ } => none
-        CheckedNatReady { value: n } => Present { value: second(count: n) }
-      }
+
+fn event_backlog_stage_label(stage: AttemptExitSpoolStage) -> String {
+  match stage {
+    AttemptExitInbox => "inbox"
+    AttemptExitQueued => "queued"
+    AttemptExitRunning => "running"
+    AttemptExitDone => "done"
+    AttemptExitRefused => "refused"
   }
 }
 
-type TickFreshness
-  = TickFresh { age_seconds: Second }
-  | TickStale { age_seconds: Second, bound_seconds: Second }
-  | TickBeforeDeploy { observed_at: String, deploy_completed_at: String }
-  | TickInstantUnparseable { which: String, text: String }
-  | TickCadenceUnnormalizable { text: String }
-
-fn belt_tick_freshness(observed_at: String, deploy_completed_at: String, now: String) -> TickFreshness {
-  match iso8601_utc_epoch_seconds(text: observed_at) {
-    Absent => TickInstantUnparseable { which: "tick observed_at", text: observed_at }
-    Present { value: tick_s } =>
-      match iso8601_utc_epoch_seconds(text: deploy_completed_at) {
-        Absent => TickInstantUnparseable { which: "dashboard receipt completed_at", text: deploy_completed_at }
-        Present { value: deploy_s } =>
-          match iso8601_utc_epoch_seconds(text: now) {
-            Absent => TickInstantUnparseable { which: "receipt run now", text: now }
-            Present { value: now_s } =>
-              if second_count(tick_s) < second_count(deploy_s) {
-                TickBeforeDeploy { observed_at: observed_at, deploy_completed_at: deploy_completed_at }
-              } else {
-                match belt_tick_freshness_bound_seconds() {
-                  Absent => TickCadenceUnnormalizable { text: belt_tick_cadence }
-                  Present { value: bound } => {
-                    let age = second_count(now_s) - second_count(tick_s)
-                    if age < 0 {
-                      TickInstantUnparseable { which: "receipt run now (earlier than the tick observed_at)", text: now }
-                    } else {
-                      match checked_int_magnitude(a: age) {
-                        CheckedNatOverflow { cause: _ } => TickInstantUnparseable { which: "tick age", text: to_string(age) }
-                        CheckedNatReady { value: age_n } =>
-                          if age > second_count(bound) {
-                            TickStale { age_seconds: second(count: age_n), bound_seconds: bound }
-                          } else {
-                            TickFresh { age_seconds: second(count: age_n) }
-                          }
-                      }
-                    }
-                  }
-                }
-              }
-          }
+// The stage is the spool's own closed sum (gunbc.roadmap.roadmap_attempt_exit_spool), not a label.
+type EventBacklogEntry {
+  stage: AttemptExitSpoolStage
+  entry: String
+  age: Second
+}
+
+type EventBacklogFact
+  = EventBacklogClear { inbox: Int, queued: Int }
+  | StaleBacklog { stage: AttemptExitSpoolStage, entry: String, age: Second, bound: Second }
+  | EventBacklogUnobserved { detail: String }
+
+fn event_backlog_is_stale(e: EventBacklogEntry) -> Bool {
+  match event_backlog_bound(stage: e.stage) {
+    Present { value: b } => second_count(s: e.age) > second_count(s: b)
+    Absent => true
+  }
+}
+
+// PURE OVER THE AGED ENTRIES: the oldest entry past its stage's bound refuses; none past, clear. A stage
+// with no bound (done, refused are not a backlog) or an unreadable bound is stale, never silently young.
+fn event_backlog_judge(entries: List<EventBacklogEntry>) -> EventBacklogFact {
+  let stale = entries |> filter(e => event_backlog_is_stale(e: e))
+  match event_backlog_oldest(entries: stale) {
+    Present { value: o } =>
+      match event_backlog_bound(stage: o.stage) {
+        Present { value: b } => StaleBacklog { stage: o.stage, entry: o.entry, age: o.age, bound: b }
+        Absent => EventBacklogUnobserved { detail: join(["no bound exists for the ", event_backlog_stage_label(stage: o.stage), " stage (entry ", o.entry, ")"], "") }
       }
+    Absent => EventBacklogClear {
+      inbox: count(entries |> filter(e => e.stage == AttemptExitInbox)),
+      queued: count(entries |> filter(e => e.stage == AttemptExitQueued)),
+    }
+  }
+}
+
+fn event_backlog_oldest(entries: List<EventBacklogEntry>) -> EventBacklogEntry? {
+  fold(entries, init: none, f: (acc, e) => event_backlog_older(acc: acc, e: e))
+}
+
+fn event_backlog_older(acc: EventBacklogEntry?, e: EventBacklogEntry) -> EventBacklogEntry? {
+  match acc {
+    Absent => Present { value: e }
+    Present { value: o } => if second_count(s: e.age) > second_count(s: o.age) { Present { value: e } } else { Present { value: o } }
   }
 }
 
-fn tick_freshness_text(f: TickFreshness) -> String {
+fn event_backlog_text(f: EventBacklogFact) -> String {
   match f {
-    TickFresh { age_seconds: a } => join(["fresh (", to_string(second_count(a)), "s old)"], "")
-    TickStale { age_seconds: a, bound_seconds: b } => join(["stale: ", to_string(second_count(a)), "s old, bound ", to_string(second_count(b)), "s"], "")
-    TickBeforeDeploy { observed_at: o, deploy_completed_at: d } => join(["observed at ", o, ", before the dashboard deployment completed at ", d], "")
-    TickInstantUnparseable { which: w, text: t } => join([w, " is not a %Y-%m-%dT%H:%M:%SZ instant: ", t], "")
-    TickCadenceUnnormalizable { text: t } => join(["the emitted timer cadence does not normalize under systemd.time(7): ", t], "")
+    EventBacklogClear { inbox, queued } => join(["clear (", to_string(value: inbox), " in inbox, ", to_string(value: queued), " queued, none past bound)"], "")
+    StaleBacklog { stage, entry, age, bound } => join(["StaleBacklog: ", event_backlog_stage_label(stage: stage), " entry ", entry, " is ", to_string(value: second_count(s: age)), "s old, past the ", to_string(value: second_count(s: bound)), "s bound"], "")
+    EventBacklogUnobserved { detail } => join(["unobserved: ", detail], "")
   }
 }
diff --git a/dag/gunbc/roadmap/roadmap_launch_deployment_receipt.dag b/dag/gunbc/roadmap/roadmap_launch_deployment_receipt.dag
index 26721c76af2..1f86c464611 100644
--- a/dag/gunbc/roadmap/roadmap_launch_deployment_receipt.dag
+++ b/dag/gunbc/roadmap/roadmap_launch_deployment_receipt.dag
@@ -41,8 +41,9 @@ import extdeps.git.object_store { git_object_id_wire_hex }
 import gunbc.deploy_transition { ActuationStanding, ActuationPermitted, ActuationInhibited, ActuationStandingUnreadable }
 import gunbc.live_deploy.unit_standing {
   LaunchUnitStanding,
-  DashboardServiceConverged, DashboardServiceRefused, BeltTimerConverged, BeltTimerRefused, BeltOneshotConverged, BeltOneshotRefused,
-  dashboard_service_standing_text, belt_timer_standing_text, belt_oneshot_standing_text,
+  DashboardServiceConverged, DashboardServiceRefused, BeltOneshotConverged, BeltOneshotRefused,
+  BeltEventPathStanding, BeltEventPathConverged, BeltEventPathRefused,
+  dashboard_service_standing_text, belt_event_path_standing_text, belt_oneshot_standing_text,
 }
 import gunbc.roadmap_belt_actuate {
   BeltTickReceipt, BeltTickReceiptRead, BeltTickReceiptPresent, BeltTickReceiptAbsent, BeltTickReceiptUnreadable,
@@ -52,7 +53,7 @@ import gunbc.roadmap_belt_actuate {
 }
 import gunbc.roadmap_belt { SpawnMode, ManualReady, spawn_mode_label }
 import gunbc.roadmap_launch_deployment_observe {
-  TickFreshness, TickFresh, TickStale, TickBeforeDeploy, TickInstantUnparseable, TickCadenceUnnormalizable, tick_freshness_text,
+  EventBacklogFact, EventBacklogClear, StaleBacklog, EventBacklogUnobserved, event_backlog_text, event_backlog_stage_label,
 }
 
 // THE ONE JOIN THE ROADMAP LAUNCH MVP'S RLM-2 GATE PRODUCES. Every independent read RUNS -- desired
@@ -116,8 +117,11 @@ type ReadinessFact
   = ReadinessServed { revision: String, surface: String }
   | ReadinessRefused { detail: String }
 
+// THE LAST LAUNCH PASS, with no freshness bound: the launch runs on events, not on a clock, so the age
+// of its receipt is not evidence of liveness (that is the event backlog row). What the receipt still
+// establishes is which instance, revision and mode the belt last launched under.
 type TickFact
-  = TickObserved { receipt: BeltTickReceipt, freshness: TickFreshness }
+  = TickObserved { receipt: BeltTickReceipt }
   | TickUnobserved { detail: String }
 
 type DispatchPreflightFact
@@ -165,6 +169,7 @@ type RoadmapLaunchDeploymentFacts {
   transition: ActuationStanding
   unit_standing: LaunchUnitStanding
   tick_standing: TickFact
+  event_backlog: EventBacklogFact
   footprint: BeltFootprintAdmission
   provider_preflight: BeltProviderPreflight
   dispatch_preflight: DispatchPreflightFact
@@ -456,22 +461,25 @@ fn unit_standing_blockers(f: LaunchUnitStanding) -> List<RoadmapLaunchDeployment
     DashboardServiceConverged { unit: _ } => []
     DashboardServiceRefused { unit: _, property: _, expected: _, observed: _ } => blocker(member: "unit_standing", detail: dashboard_service_standing_text(s: f.dashboard))
   }
-  let timer = match f.timer {
-    BeltTimerConverged { unit: _ } => []
-    BeltTimerRefused { unit: _, property: _, expected: _, observed: _ } => blocker(member: "unit_standing", detail: belt_timer_standing_text(s: f.timer))
+  let exit_path = match f.exit_path {
+    BeltEventPathConverged { unit: _ } => []
+    BeltEventPathRefused { unit: _, property: _, expected: _, observed: _ } => blocker(member: "unit_standing", detail: belt_event_path_standing_text(s: f.exit_path))
+  }
+  let answer_path = match f.answer_path {
+    BeltEventPathConverged { unit: _ } => []
+    BeltEventPathRefused { unit: _, property: _, expected: _, observed: _ } => blocker(member: "unit_standing", detail: belt_event_path_standing_text(s: f.answer_path))
   }
   let oneshot = match f.oneshot {
     BeltOneshotConverged { unit: _, active_state: _ } => []
     BeltOneshotRefused { unit: _, property: _, expected: _, observed: _ } => blocker(member: "unit_standing", detail: belt_oneshot_standing_text(s: f.oneshot))
   }
-  concat(concat(dashboard, timer), oneshot)
+  concat(concat(concat(dashboard, exit_path), answer_path), oneshot)
 }
 
 fn tick_blockers(s: RoadmapLaunchDeploymentSubject, f: TickFact) -> List<RoadmapLaunchDeploymentBlocker> {
   match f {
     TickUnobserved { detail: d } => blocker(member: "tick_standing", detail: d)
-    TickObserved { receipt: r, freshness: fr } =>
-      concat(
+    TickObserved { receipt: r } =>
         match r.execution {
           TickExecutionWithheld { refusal: why } => blocker(member: "tick_standing", detail: join(["tick execution withheld: ", why], ""))
           TickExecuted { instance_id: i, deployed_revision: rev, spawn_mode: m } =>
@@ -486,15 +494,15 @@ fn tick_blockers(s: RoadmapLaunchDeploymentSubject, f: TickFact) -> List<Roadmap
                 AutomaticReady => blocker(member: "tick_standing", detail: join(["tick ran under ", spawn_mode_label(m: m), ", not manual_ready"], ""))
               },
             )
-        },
-        match fr {
-          TickFresh { age_seconds: _ } => []
-          TickStale { age_seconds: _, bound_seconds: _ } => blocker(member: "tick_standing", detail: tick_freshness_text(f: fr))
-          TickBeforeDeploy { observed_at: _, deploy_completed_at: _ } => blocker(member: "tick_standing", detail: tick_freshness_text(f: fr))
-          TickInstantUnparseable { which: _, text: _ } => blocker(member: "tick_standing", detail: tick_freshness_text(f: fr))
-          TickCadenceUnnormalizable { text: _ } => blocker(member: "tick_standing", detail: tick_freshness_text(f: fr))
-        },
-      )
+        }
+  }
+}
+
+fn event_backlog_blockers(f: EventBacklogFact) -> List<RoadmapLaunchDeploymentBlocker> {
+  match f {
+    EventBacklogClear { inbox: _, queued: _ } => []
+    StaleBacklog { stage: _, entry: _, age: _, bound: _ } => blocker(member: "event_backlog", detail: event_backlog_text(f: f))
+    EventBacklogUnobserved { detail: _ } => blocker(member: "event_backlog", detail: event_backlog_text(f: f))
   }
 }
 
@@ -536,7 +544,7 @@ fn workflow_endpoint_blockers(tick: TickFact, f: WorkflowEndpointFact) -> List<R
           BeltTickReceiptPresent { receipt: served_receipt } =>
             match tick {
               TickUnobserved { detail: _ } => []
-              TickObserved { receipt: on_disk, freshness: _ } =>
+              TickObserved { receipt: on_disk } =>
                 if belt_tick_receipt_identity_hex(receipt: served_receipt) != belt_tick_receipt_identity_hex(receipt: on_disk) {
                   blocker(member: "workflow_endpoint", detail: "/workflow.json embeds a tick receipt other than the one on the instance")
                 } else { [] }
@@ -682,7 +690,7 @@ fn roadmap_launch_deployment_blockers(s: RoadmapLaunchDeploymentSubject, f: Road
     ),
     concat(
       concat(
-        concat(unit_standing_blockers(f: f.unit_standing), tick_blockers(s: s, f: f.tick_standing)),
+        concat(unit_standing_blockers(f: f.unit_standing), concat(tick_blockers(s: s, f: f.tick_standing), event_backlog_blockers(f: f.event_backlog))),
         concat(footprint_blockers(f: f.footprint), provider_blockers(f: f.provider_preflight)),
       ),
       concat(
@@ -804,9 +812,10 @@ fn facts_lines(f: RoadmapLaunchDeploymentFacts) -> List<String> {
     }], ""),
     join(["unit_standing: ", launch_unit_standing_text(s: f.unit_standing)], ""),
     join(["tick_standing: ", match f.tick_standing {
-      TickObserved { receipt: r, freshness: fr } => join(["identity=", belt_tick_receipt_identity_hex(receipt: r), " observed_at=", r.observed_at, " ", tick_freshness_text(f: fr)], "")
+      TickObserved { receipt: r } => join(["identity=", belt_tick_receipt_identity_hex(receipt: r), " observed_at=", r.observed_at], "")
       TickUnobserved { detail: d } => join(["unobserved: ", d], "")
     }], ""),
+    join(["event_backlog: ", event_backlog_text(f: f.event_backlog)], ""),
     join(["footprint: ", match f.footprint {
       FootprintAdmitted => "admitted"
       FootprintRefused { step: st, detail: d } => join(["refused at ", st, ": ", d], "")
@@ -920,17 +929,15 @@ fn facts_json(f: RoadmapLaunchDeploymentFacts) -> JsonValue {
         DashboardServiceConverged { unit: u } => fact_arm(arm: "converged", members: [json_kv(key: "unit", value: json_string(s: u))])
         DashboardServiceRefused { unit: u, property: pr, expected: e, observed: o } => fact_arm(arm: "refused", members: [json_kv(key: "unit", value: json_string(s: u)), json_kv(key: "property", value: json_string(s: pr)), json_kv(key: "expected", value: json_string(s: e)), json_kv(key: "observed", value: json_string(s: o))])
       }),
-      json_kv(key: "timer", value: match f.unit_standing.timer {
-        BeltTimerConverged { unit: u } => fact_arm(arm: "converged", members: [json_kv(key: "unit", value: json_string(s: u))])
-        BeltTimerRefused { unit: u, property: pr, expected: e, observed: o } => fact_arm(arm: "refused", members: [json_kv(key: "unit", value: json_string(s: u)), json_kv(key: "property", value: json_string(s: pr)), json_kv(key: "expected", value: json_string(s: e)), json_kv(key: "observed", value: json_string(s: o))])
-      }),
+      json_kv(key: "exit_path", value: belt_event_path_standing_json(s: f.unit_standing.exit_path)),
+      json_kv(key: "answer_path", value: belt_event_path_standing_json(s: f.unit_standing.answer_path)),
       json_kv(key: "oneshot", value: match f.unit_standing.oneshot {
         BeltOneshotConverged { unit: u, active_state: a } => fact_arm(arm: "converged", members: [json_kv(key: "unit", value: json_string(s: u)), json_kv(key: "active_state", value: json_string(s: a))])
         BeltOneshotRefused { unit: u, property: pr, expected: e, observed: o } => fact_arm(arm: "refused", members: [json_kv(key: "unit", value: json_string(s: u)), json_kv(key: "property", value: json_string(s: pr)), json_kv(key: "expected", value: json_string(s: e)), json_kv(key: "observed", value: json_string(s: o))])
       }),
     ])),
     json_kv(key: "tick_standing", value: match f.tick_standing {
-      TickObserved { receipt: r, freshness: fr } =>
+      TickObserved { receipt: r } =>
         fact_arm(arm: "observed", members: [
           json_kv(key: "receipt_identity", value: json_string(s: belt_tick_receipt_identity_hex(receipt: r))),
           json_kv(key: "observed_at", value: json_string(s: r.observed_at)),
@@ -938,16 +945,14 @@ fn facts_json(f: RoadmapLaunchDeploymentFacts) -> JsonValue {
             TickExecuted { instance_id: i, deployed_revision: rev, spawn_mode: m } => fact_arm(arm: "executed", members: [json_kv(key: "instance_id", value: json_string(s: i)), json_kv(key: "deployed_revision", value: json_string(s: rev)), json_kv(key: "spawn_mode", value: json_string(s: spawn_mode_label(m: m)))])
             TickExecutionWithheld { refusal: why } => fact_arm(arm: "withheld", members: [json_kv(key: "refusal", value: json_string(s: why))])
           }),
-          json_kv(key: "freshness", value: match fr {
-            TickFresh { age_seconds: ag } => fact_arm(arm: "fresh", members: [json_kv(key: "age_seconds", value: json_string(s: to_string(second_count(ag))))])
-            TickStale { age_seconds: ag, bound_seconds: bd } => fact_arm(arm: "stale", members: [json_kv(key: "age_seconds", value: json_string(s: to_string(second_count(ag)))), json_kv(key: "bound_seconds", value: json_string(s: to_string(second_count(bd))))])
-            TickBeforeDeploy { observed_at: ob, deploy_completed_at: dc } => fact_arm(arm: "before_deploy", members: [json_kv(key: "observed_at", value: json_string(s: ob)), json_kv(key: "deploy_completed_at", value: json_string(s: dc))])
-            TickInstantUnparseable { which: wh, text: tx } => fact_arm(arm: "instant_unparseable", members: [json_kv(key: "which", value: json_string(s: wh)), json_kv(key: "text", value: json_string(s: tx))])
-            TickCadenceUnnormalizable { text: tx } => fact_arm(arm: "cadence_unnormalizable", members: [json_kv(key: "text", value: json_string(s: tx))])
-          }),
         ])
       TickUnobserved { detail: d } => fact_arm(arm: "unobserved", members: [json_kv(key: "detail", value: json_string(s: d))])
     }),
+    json_kv(key: "event_backlog", value: match f.event_backlog {
+      EventBacklogClear { inbox: i, queued: q } => fact_arm(arm: "clear", members: [json_kv(key: "inbox", value: json_string(s: to_string(value: i))), json_kv(key: "queued", value: json_string(s: to_string(value: q)))])
+      StaleBacklog { stage: st, entry: en, age: ag, bound: bd } => fact_arm(arm: "stale", members: [json_kv(key: "stage", value: json_string(s: event_backlog_stage_label(stage: st))), json_kv(key: "entry", value: json_string(s: en)), json_kv(key: "age_seconds", value: json_string(s: to_string(value: second_count(s: ag)))), json_kv(key: "bound_seconds", value: json_string(s: to_string(value: second_count(s: bd))))])
+      EventBacklogUnobserved { detail: d } => fact_arm(arm: "unobserved", members: [json_kv(key: "detail", value: json_string(s: d))])
+    }),
     json_kv(key: "footprint", value: match f.footprint {
       FootprintAdmitted => fact_arm(arm: "admitted", members: [])
       FootprintRefused { step: st, detail: d } => fact_arm(arm: "refused", members: [json_kv(key: "step", value: json_string(s: st)), json_kv(key: "detail", value: json_string(s: d))])
@@ -1046,3 +1051,10 @@ fn verdict_receipt_identity(v: RoadmapLaunchDeploymentVerdict) -> String {
     DeploymentIncomplete { subject: s, facts: f, first_blocker: _, further_blockers: _ } => roadmap_launch_deployment_receipt_identity_hex(subject: s, facts: f)
   }
 }
+
+fn belt_event_path_standing_json(s: BeltEventPathStanding) -> JsonValue {
+  match s {
+    BeltEventPathConverged { unit: u } => fact_arm(arm: "converged", members: [json_kv(key: "unit", value: json_string(s: u))])
+    BeltEventPathRefused { unit: u, property: pr, expected: e, observed: o } => fact_arm(arm: "refused", members: [json_kv(key: "unit", value: json_string(s: u)), json_kv(key: "property", value: json_string(s: pr)), json_kv(key: "expected", value: json_string(s: e)), json_kv(key: "observed", value: json_string(s: o))])
+  }
+}
diff --git a/dag/gunbc/roadmap/roadmap_publish_observe.dag b/dag/gunbc/roadmap/roadmap_publish_observe.dag
index df0e098eda0..c436ba0e1b4 100644
--- a/dag/gunbc/roadmap/roadmap_publish_observe.dag
+++ b/dag/gunbc/roadmap/roadmap_publish_observe.dag
@@ -256,7 +256,7 @@ fn observe_pull_requests(
       match lease {
         QuotaFull { wire: w } => PullRequestsUnreadable { cause: PullRequestQuotaWithheld { repository: repo.full_name, detail: w } }
         QuotaLeaseRefused { detail: d } => PullRequestsUnreadable { cause: PullRequestQuotaWithheld { repository: repo.full_name, detail: d } }
-        QuotaLeased { grant: _, partition: _, store: _ } => {
+        QuotaLeased { grant: _, partition: _, store: _, limit: _ } => {
       let result = github.Pulls.List(
         auth_token: source,
         owner: repo.owner,
diff --git a/dag/gunbc/roadmap/roadmap_session_placement.dag b/dag/gunbc/roadmap/roadmap_session_placement.dag
index b297e079567..d40b91e7f8a 100644
--- a/dag/gunbc/roadmap/roadmap_session_placement.dag
+++ b/dag/gunbc/roadmap/roadmap_session_placement.dag
@@ -37,6 +37,13 @@ import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_insta
 import gunbc.roadmap_dispatch_actuator {
   dispatch_attempt_unit_name,
   AttemptUnitObservation, AttemptUnitAbsent, AttemptUnitActive, AttemptUnitFinished, AttemptUnitUnreadable, attempt_unit_observation,
+  AttemptUnitStartStanding, AttemptUnitStartRecorded, AttemptUnitNeverStarted, AttemptUnitStartUnread,
+  attempt_worker_unit_observation_of, attempt_unit_from_exit_record,
+}
+import gunbc.roadmap.roadmap_attempt_exit_spool {
+  AttemptExitRecordObservation, AttemptExitRecordFound, AttemptExitRecordNone, AttemptExitRecordUnreadable,
+  attempt_exit_record_observe, attempt_exit_record_matching, attempt_exit_stage_listings,
+  AttemptWorkerRole, attempt_unit_role_token,
 }
 import extdeps.filesystem.filesystem_io {
   Filesystem, FilesystemFileObservation,
@@ -873,6 +880,81 @@ fn session_observe_unit_lifecycle(unit: NonEmptyStr) -> UnitLifecycle {
   session_unit_lifecycle(o: attempt_unit_observation(unit: unit))
 }
 
+// THE SETTLEMENT'S READ OF A WORKER UNIT, now that the unit is collected when its process ends
+// (gunbc.roadmap_dispatch_actuator dispatch_worker_unit_properties). A loaded unit is read as before;
+// a collected one is read from its exit record, so a worker that exited 0 settles as SUCCESS rather
+// than as cause-unknown. A collected unit with NO record keeps the arm it had: the manager has no such
+// unit, its lifetime is over, the cause is unknown -- the one arm safe to free on without a verdict,
+// and still only after the launch deadline (session_settle_decide). The settlement asks whether the
+// unit's lifetime is over, not whether a worker ran, so it needs no start receipt: the slot it is
+// settling IS one.
+fn session_worker_unit_lifecycle(unit: NonEmptyStr, loaded: AttemptUnitObservation, record: AttemptExitRecordObservation) -> UnitLifecycle {
+  match loaded {
+    AttemptUnitAbsent =>
+      match record {
+        AttemptExitRecordNone => UnitTerminatedCauseUnknown { detail: "the user manager has no such unit and it left no exit record" }
+        AttemptExitRecordFound { record: _ } => session_unit_lifecycle(o: attempt_unit_from_exit_record(unit: unit, record: record, start: AttemptUnitStartRecorded))
+        AttemptExitRecordUnreadable { reason } => UnitLifecycleUnknown { detail: reason }
+      }
+    AttemptUnitActive => session_unit_lifecycle(o: loaded)
+    AttemptUnitFinished { exit_status: _ } => session_unit_lifecycle(o: loaded)
+    AttemptUnitUnreadable { reason: _ } => session_unit_lifecycle(o: loaded)
+  }
+}
+
+fn session_worker_unit_lifecycle_for_instance(instance: HostDashboardInstance, unit: NonEmptyStr) -> UnitLifecycle {
+  let loaded = attempt_unit_observation(unit: unit)
+  match loaded {
+    AttemptUnitAbsent =>
+      session_worker_unit_lifecycle(
+        unit: unit,
+        loaded: loaded,
+        record: attempt_exit_record_matching(
+          matches: (n, a, r) => r == attempt_unit_role_token(role: AttemptWorkerRole) && (dispatch_attempt_unit_name(node_id: n, attempt_key: a) as String) == (unit as String),
+          listings: attempt_exit_stage_listings(instance_root: instance.instance_root as String),
+        ),
+      )
+    AttemptUnitActive => session_unit_lifecycle(o: loaded)
+    AttemptUnitFinished { exit_status: _ } => session_unit_lifecycle(o: loaded)
+    AttemptUnitUnreadable { reason: _ } => session_unit_lifecycle(o: loaded)
+  }
+}
+
+// THE START RECEIPT THE PROCESS OBSERVER NEEDS (gunbc.roadmap_dispatch_actuator
+// AttemptUnitStartStanding): this attempt's placement record. It is written immediately before the
+// worker unit is started, so its presence means dispatch committed to a unit; its absence means the
+// attempt never had one.
+fn session_worker_start_standing(observation: SessionPlacementObservation) -> AttemptUnitStartStanding {
+  match observation {
+    SessionPlacementObserved { slot: _, grant: _, returned: _ } => AttemptUnitStartRecorded
+    SessionPlacementAbsent { unit: _ } => AttemptUnitNeverStarted
+    SessionPlacementUnreadable { unit: _, detail } => AttemptUnitStartUnread { reason: detail }
+    SessionPlacementForeign { unit: _, detail } => AttemptUnitStartUnread { reason: detail }
+  }
+}
+
+// THE WORKER'S PROCESS OBSERVATION FOR ONE ATTEMPT: the unit, else its exit record, else -- only when
+// both are silent -- whether it was ever started. Each later read is taken only when the earlier one
+// could not answer, so a running worker costs one manager read as before.
+fn attempt_worker_unit_observe_for_instance(instance: HostDashboardInstance, node_id: String, attempt_key: String) -> AttemptUnitObservation {
+  let unit = dispatch_attempt_unit_name(node_id: node_id, attempt_key: attempt_key)
+  let loaded = attempt_unit_observation(unit: unit)
+  match loaded {
+    AttemptUnitAbsent => {
+      let record = attempt_exit_record_observe(instance_root: instance.instance_root as String, node_id: node_id, attempt_key: attempt_key, role: AttemptWorkerRole)
+      match record {
+        AttemptExitRecordNone =>
+          attempt_worker_unit_observation_of(unit: unit, loaded: loaded, record: record, start: session_worker_start_standing(observation: session_placement_observe_for_attempt(instance: instance, node_id: node_id, attempt_key: attempt_key)))
+        AttemptExitRecordFound { record: _ } => attempt_worker_unit_observation_of(unit: unit, loaded: loaded, record: record, start: AttemptUnitStartRecorded)
+        AttemptExitRecordUnreadable { reason: _ } => attempt_worker_unit_observation_of(unit: unit, loaded: loaded, record: record, start: AttemptUnitStartRecorded)
+      }
+    }
+    AttemptUnitActive => loaded
+    AttemptUnitFinished { exit_status: _ } => loaded
+    AttemptUnitUnreadable { reason: _ } => loaded
+  }
+}
+
 // THE DECISION, PURE OVER ONE SLOT. Every arm that does not release says why, and every arm that
 // releases names the generation it will close.
 type SessionSettleDecision
@@ -1008,7 +1090,8 @@ fn session_settle_release(stores: SessionPlacementStores, host: String, unit: No
 }
 
 // THE PASS TAKES THE UNIT OBSERVATIONS AS A FUNCTION OF THE UNIT NAME so a witness can plant them;
-// production passes session_observe_unit_lifecycle, the worker's own read.
+// production passes session_worker_unit_lifecycle_for_instance, the worker's own read (unit, then its
+// exit record).
 fn session_placement_settle_pass_at(stores: SessionPlacementStores, host: String, lifecycle_of: fn(NonEmptyStr) -> UnitLifecycle, now: EpochSecs) -> SessionSettlePass {
   match cas_slot_keys(root: stores.slots_root) {
     CasSlotKeysListed { keys } => SessionSettlePassRan { settlements: map(keys, k => session_settle_one(stores: stores, host: host, key: k, lifecycle: lifecycle_of(k), now: now)) }
@@ -1020,6 +1103,6 @@ fn session_placement_settle_pass_at(stores: SessionPlacementStores, host: String
 fn session_placement_settle_pass(instance: HostDashboardInstance, stores: SessionPlacementStores) -> SessionSettlePass {
   match now_epoch_seconds() {
     Absent => SessionSettlePassRefused { detail: "the host clock could not be read as epoch seconds, and the reserved-state trigger compares against a deadline" }
-    Present { value: now } => session_placement_settle_pass_at(stores: stores, host: instance.host_identity as String, lifecycle_of: session_observe_unit_lifecycle, now: now)
+    Present { value: now } => session_placement_settle_pass_at(stores: stores, host: instance.host_identity as String, lifecycle_of: u => session_worker_unit_lifecycle_for_instance(instance: instance, unit: u), now: now)
   }
 }
diff --git a/dag/gunbc/roadmap/roadmap_view_preference_store.dag b/dag/gunbc/roadmap/roadmap_view_preference_store.dag
index e12c8ff82c7..c5e132dd7a7 100644
--- a/dag/gunbc/roadmap/roadmap_view_preference_store.dag
+++ b/dag/gunbc/roadmap/roadmap_view_preference_store.dag
@@ -3,7 +3,8 @@ module gunbc.roadmap_view_preference_store
 import std.types { String, List, Int, Bool, NonEmptyStr }
 import gunbc.roadmap_view_preferences { IssueViewPreferences, issue_view_preferences_json, issue_view_preferences_of }
 import gunbc.principal_projection { PrincipalRef, principal_ref_label }
-import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_auth_store_root, DashboardIssueViewPreferences }
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_private_directory }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_path }
 import extdeps.tools.sha256sum { sha256sum_stdin_digest_via_shell, Sha256FileDigest, Sha256FileDigestUnavailable }
 import extdeps.languages.json.emit { serialize_json }
 import gunbc.durable_cas_file_store { observe_cas_slot_state, admit_cas_attempt_for_derived_payload, file_compare_and_set, OwnerOnlyCreateOnly, DerivedPayloadAdmitted, DerivedPayloadKeyNotSlotAddressable }
@@ -19,8 +20,13 @@ fn issue_view_store_key(principal: PrincipalRef) -> NonEmptyStr? {
     Sha256FileDigest { digest } => Present { value: digest.hex as NonEmptyStr }
   }
 }
+// THE DIRECTORY THIS STORE DEMANDS; the store root is read off it (gunbc.owned_directory).
+fn issue_view_store_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  dashboard_instance_private_directory(instance: instance, member: "issue-view-preferences" as NonEmptyStr, child: "issue-view-preferences")
+}
+
 fn issue_view_store_root(instance: HostDashboardInstance) -> NonEmptyStr {
-  dashboard_instance_auth_store_root(instance: instance, store: DashboardIssueViewPreferences) as NonEmptyStr
+  owned_directory_path(t: issue_view_store_directory(instance: instance)) as String as NonEmptyStr
 }
 fn issue_view_store_read(root: NonEmptyStr, key: NonEmptyStr) -> IssueViewStored {
   match observe_cas_slot_state(root: root, key: key) {
diff --git a/dag/gunbc/run_arg_typed_bind_seed_growth.dag b/dag/gunbc/run_arg_typed_bind_seed_growth.dag
new file mode 100644
index 00000000000..6ef72419740
--- /dev/null
+++ b/dag/gunbc/run_arg_typed_bind_seed_growth.dag
@@ -0,0 +1,64 @@
+module gunbc.run_arg_typed_bind_seed_growth
+
+import gunbc.roadmap_model { RoadmapNodeId }
+import gunbc.seed_growth { SeedGrowthJustification }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import std.types { String }
+
+// Seed-growth obligation for typed `gunbc run --arg` inhabitance in the seed CLI kernel.
+// `gunbc.cli_dispatch_surface` owns the option as CliTextValue (argv is text). There is no
+// `.dag` binder: `v2.cli.compile_cli` is the native compile door and has no `run` verb, so
+// the seed CLI (`std.compiler_entry` RetainedHostCliKernel) is the only production route.
+data run_arg_typed_bind_seed_growth_justification: SeedGrowthJustification = SeedGrowthJustification {
+  hand_authored_declarations: [
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "parse_run_arg_specs", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "parse_cli_decimal_int", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "CliArgAdmission", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "cli_arg_no_inhabitance_route", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "bind_cli_arg_text", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "bind_cli_int", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "cli_arg_resolved_type_node", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "type_nodes_name_the_same_declaration", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "std_types_nonempty_str_item", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "refers_to_std_types_nonempty_str", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "std_types_nonempty_str_admission", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "nonempty_str_predicates_from_decl", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "cli_arg_admission_from_type_expr", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "cli_arg_admission_for_kernel", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "bind_run_arg_specs_against_admissions", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "bind_run_args_for_entry", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "declared_parameter_type_exprs", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "type_declaration_rhs", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "cli_run_arg_channel_tests", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "spec", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "admission", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "declared", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "bind", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "named_arg_parses_to_a_named_string_value", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "value_may_contain_further_equals_signs", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "empty_value_is_admitted_and_distinct_from_absent", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "bare_token_without_equals_refuses", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "empty_parameter_name_refuses", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "one_malformed_spec_refuses_the_whole_list", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "int_parameter_given_non_numeric_refuses", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "int_parameter_given_decimal_two_is_int_two", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "unsupported_declared_type_refuses", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "qualified_or_branded_int_label_refuses_rather_than_matching_the_leaf", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "nonemptystr_non_empty_binds_as_string", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "nonemptystr_empty_refuses_naming_the_parameter", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "bool_parameter_accepts_true_false_only", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "compile_ctx", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "source", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "kernel_int_entry_ctx", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "std_types_nonempty_entry_ctx", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "bind_run_args_for_entry_int_executes_as_int_two", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "bind_run_args_for_entry_std_types_nonemptystr_inhabits_and_empty_refuses", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "isolated_std_types_nonemptystr_whose_string_is_int_refuses", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "same_spelling_user_int_or_nonemptystr_refuses", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.cli_run_arg_channel_tests", decl_name: "bind_run_args_for_entry_duplicate_or_unknown_name_refuses", field: WholeDeclaration }
+  ],
+  reason: "WHY RUST: `gunbc run --arg` is the seed CLI kernel. argv is always text (`CliTextValue`); inhabiting a parameter's resolved type identity is a later, located decision that today lives only in `v1_compiler.cli_run`. Silent String binding was fail-open: `--arg supersedes=2` inhabited Str(\"2\") against an Int parameter. Conversion is authorized from std.coercion type_reference_identity: kernel String/Int/Bool, and the exact std.types NonEmptyStr declaration whose peeled ground is KernelMinted String and whose complete where-population is exactly string_non_empty. A same-spelling user type, a std.types NonEmptyStr whose ground is not kernel String, or any deferred/extra predicate is refused. WHY ADMITTED AGAINST THE v1 FREEZE (gunbc.v1_maintenance_standing v1_seed_standing): by PURPOSE — silent wrong binding on every `gunbc run` of a v2 entry, including belt_scm_corrective_integrate_cli and fabric/fci1 NonEmptyStr recipes. It adds no language behaviour. The native CLI door (`v2.cli.compile_cli`) has no `run` verb.",
+  owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
+  trigger: "Delete these declarations when a `.dag` driver can receive argv as values AND bind `--arg` text against the entry's resolved type identity — kernel String/Int/Bool and std.types NonEmptyStr whose ground is KernelMinted String and whose predicates are exactly string_non_empty — so the seed binder is not a second authority. That capability is a modeled `gunbc run` on the native CLI. WHAT DOES NOT RETIRE IT: a leaf-name table; generic where-peel of any String/Int alias; a spelling match on the peeled ground; skipping deferred predicates; copying the binder into another host file.",
+  current_boundary: "v1_compiler.cli_run bind_run_args_for_entry (called from v1_compiler.main run_one_function); admissions from cli_arg_admission_from_type_expr over declared_parameter_type_exprs; one bind loop in bind_run_arg_specs_against_admissions; dag/gunbc/run_arg_typed_bind_seed_growth.dag"
+}
diff --git a/dag/gunbc/rung_drop/admit_callers_discarded_on_the_native_route.dag b/dag/gunbc/rung_drop/admit_callers_discarded_on_the_native_route.dag
deleted file mode 100644
index 778bd9f373a..00000000000
--- a/dag/gunbc/rung_drop/admit_callers_discarded_on_the_native_route.dag
+++ /dev/null
@@ -1,35 +0,0 @@
-module gunbc.rung_drop.admit_callers_discarded_on_the_native_route
-
-import std.types { List, NonEmptyStr, String }
-import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
-import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
-
-// DECLARED 2026-09-22 (Pkg11b batch 2, ruling via neat-boar-16). `admit_callers: [decl_ref(..)]`
-// on a fn names the only declarations allowed to call it; the seed parses it as a property of the
-// fn node (v1.compiler.parse parse_optional_admit_callers). The native front end now parses the
-// clause (v2.extdeps.languages.dag dag_grammar_admit_callers_clause_expr) and DISCARDS it when the
-// fn lowers to an Arrow, so caller admission is not enforced on the native route. It is not carried
-// on the Arrow because nothing would read it: v2.std.node arrow_signature_edges_conform admits only
-// arrow_body_edge, and widening a load-bearing substrate type for an edge with no consumer would be
-// a dangling declaration. The stage that checks caller admission adds that carrier with its consumer.
-// The empty-list refusal (`admit_callers: []`) is kept.
-
-data admit_callers_discarded_on_the_native_route_population: List<String> = [
-  "the native lane (std.compiler_entry SourceRootEvalDriver) -- every fn declaring admit_callers, the clause parsed and discarded at fn lowering",
-]
-
-data admit_callers_discarded_on_the_native_route: RungDrop = RungDrop {
-  identity: "admit_callers_discarded_on_the_native_route" as NonEmptyStr,
-  subject: "native route enforces admit_callers: a call from a declaration outside a fn's admitted caller list refuses",
-  declared: "2026-09-22",
-  standing: Standing,
-  declaration: TypedDeclaration {
-    previous: MechanicallyPreventable,
-    temporary: Mitigatable,
-    reason: ReplacementStaged {
-      replacement: "a v2 stage checks caller admission; that stage adds the Arrow carrier with its consumer"
-    },
-    population: admit_callers_discarded_on_the_native_route_population,
-    restoration_trigger: "a v2 stage checks caller admission on the native route from the fn's declared admit_callers list, refusing a call from a declaration outside it; that stage adds the Arrow carrier together with its consumer. Parsing the clause, or carrying the list with nothing reading it, does not retire this row."
-  }
-}
diff --git a/dag/gunbc/rung_drop/belt_liveness_publication_answers_unconsumed.dag b/dag/gunbc/rung_drop/belt_liveness_publication_answers_unconsumed.dag
new file mode 100644
index 00000000000..e1a58d98e8e
--- /dev/null
+++ b/dag/gunbc/rung_drop/belt_liveness_publication_answers_unconsumed.dag
@@ -0,0 +1,46 @@
+module gunbc.rung_drop.belt_liveness_publication_answers_unconsumed
+
+import std.types { NonEmptyStr }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.guarantee_rung { MechanicallyPreventable, Mitigatable }
+
+// DECLARED 2026-10-06 beside the change that removed the belt timer (dogfood intervention #4,
+// gunbc#13124; bold-bee-114 ruling the same day: replace tick freshness with an event backlog row, and
+// declare a drop for whatever half of it does not land).
+//
+// WHAT THE PREVIOUS RUNG WAS. The RLM launch receipt (gunbc.roadmap_launch_deployment_receipt) refused
+// when the belt tick receipt was older than three timer cadences. While a timer drove every pass, a
+// stale tick receipt meant nothing behind it was running -- capture, verify, publication-answer reads
+// alike -- so the receipt mechanically refused a dead belt.
+//
+// WHAT IT IS NOW. There is no timer, so the tick's age says nothing and the freshness row is gone. Its
+// replacement, the event backlog row (gunbc.roadmap_launch_deployment_observe event_backlog_judge),
+// refuses when a recorded unit exit sits unconsumed in the exit spool past its bound -- that half is
+// mechanically preventable again. The OTHER event source is not covered: a publication answer the
+// helper wrote and no publish obligation consumed. Answers are kept in place rather than moved through
+// stages, and nothing records which answer an obligation consumed, so "an answer older than its bound
+// and still unconsumed" has no observable carrier. A belt whose publication-answer path unit is armed
+// but whose discovery service never runs passes the receipt today; it is caught only by the attempt's
+// publication staying pending on the page, which an operator must notice -- mitigatable.
+
+data belt_liveness_publication_answers_unconsumed: RungDrop = RungDrop {
+  identity: "belt_liveness_publication_answers_unconsumed" as NonEmptyStr,
+
+  subject: "the RLM launch receipt's belt liveness: a publication answer that no publish obligation consumed within its bound is not refused, because nothing records which answer was consumed",
+
+  declared: "2026-10-06",
+
+  standing: Standing,
+
+  declaration: TypedDeclaration {
+    previous: MechanicallyPreventable,
+    temporary: Mitigatable,
+    reason: ReplacementStaged {
+      replacement: "gunbc.roadmap_launch_deployment_observe event_backlog_judge, which covers the exit spool's inbox and queued stages; the publication-answer half waits on a consumption record",
+    },
+    population: [
+      "every deployment's publication answer directory (gunbc.host_layout publication_answer_dir), for the window between the belt timer's removal and the restoration trigger below",
+    ],
+    restoration_trigger: "THE CAPABILITY: the launch receipt's event backlog row refuses with StaleBacklog naming a publication answer that is older than its bound and that no publish obligation has consumed -- which needs each consumption to be recorded against the answer it consumed (the attempt's obligation receipt naming the answer's spool key, or the answer moving to a consumed stage once the publish obligation's receipt exists). SUFFICIENT FOR: planting an answer older than the bound with no consuming receipt and observing the receipt refuse, and planting the same answer with its consuming receipt and observing it pass. An armed publication-answer path unit does NOT retire this row (it proves the watcher is armed, not that answers are consumed), and neither does a discovery receipt (it proves discovery ran, not that the answer it should have queued was consumed).",
+  }
+}
diff --git a/dag/gunbc/rung_drop/bmc_secure_apply_converge_new_witness_eval_step_cost.dag b/dag/gunbc/rung_drop/bmc_secure_apply_converge_new_witness_eval_step_cost.dag
new file mode 100644
index 00000000000..aeedaeaa13f
--- /dev/null
+++ b/dag/gunbc/rung_drop/bmc_secure_apply_converge_new_witness_eval_step_cost.dag
@@ -0,0 +1,38 @@
+module gunbc.rung_drop.bmc_secure_apply_converge_new_witness_eval_step_cost
+
+import std.types { String, List, NonEmptyStr }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
+import v2.workflow.floor_eval_step_cost_drop { floor_eval_step_cost_drop_bmc_secure_apply_converge_rows }
+
+// DECLARED 4b(3) DROP (gunbc#13517, 2026-10-07). Pairing requires one Apply through
+// converge_arrival_through_bmc_secure; that path still bills the arrival prefix plus the dry Apply
+// in the seed interpreter. The DECLARATION lives here; the POPULATION's authority is
+// `v2.workflow.floor_eval_step_cost_drop` `floor_eval_step_cost_drop_bmc_secure_apply_converge_rows`.
+//
+// WHAT IS LOST IS ONE WALL, AND THE CLAIM IS UNTOUCHED. The identity stays on the gate: planned,
+// executed and measured on every run, its eval_steps recorded; a semantic red and a wall-clock
+// crossing still block. Only an eval-step overrun is reported under the declared drop rather than
+// refusing. The budget is not raised.
+
+data bmc_secure_apply_converge_new_witness_eval_step_cost_population: List<String> = floor_eval_step_cost_drop_bmc_secure_apply_converge_rows |> map(m => concat(concat(m.identity, ": over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_bmc_secure_apply_converge_rows; measured by "), m.measured_by))
+
+data bmc_secure_apply_converge_new_witness_eval_step_cost: RungDrop = RungDrop {
+  identity: "bmc_secure_apply_converge_new_witness_eval_step_cost" as NonEmptyStr,
+
+  subject: "new-witness eval-step cost gate over the one Apply inhabitance of converge_arrival_through_bmc_secure: it still executes, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered",
+
+  declared: "2026-10-07",
+
+  standing: Standing,
+
+  declaration: TypedDeclaration {
+    previous: MechanicallyPreventable,
+    temporary: Mitigatable,
+    reason: ReplacementStaged {
+      replacement: "converge_arrival_through_bmc_secure executing as natively emitted code rather than in the seed interpreter, so the one Apply inhabitance fits the NewWitnessTier eval-step budget",
+    },
+    population: bmc_secure_apply_converge_new_witness_eval_step_cost_population,
+    restoration_trigger: "THE CAPABILITY: converge_arrival_through_bmc_secure (AccessDiscover through BmcSecure Apply, including the fold's Apply-discharge mint) executing as natively emitted code in a claim frame. WHAT THAT MUST BE SUFFICIENT FOR: test.claim.machine_intake_arrival_converge_witness.w_bmc_secure_apply_with_the_mtjade1_standing_grant_converges_over_the_dry_world, still calling that entry with Apply+grant and still asserting the Applied route, measures under the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives. Deleting the identity, hard-coding discharges: [] in the entry, or relocating the claim off the required gate satisfies none of it.",
+  }
+}
diff --git a/dag/gunbc/rung_drop/collection_count_result_stated_int_until_declared_results_are_judged.dag b/dag/gunbc/rung_drop/collection_count_result_stated_int_until_declared_results_are_judged.dag
new file mode 100644
index 00000000000..e343bb803fc
--- /dev/null
+++ b/dag/gunbc/rung_drop/collection_count_result_stated_int_until_declared_results_are_judged.dag
@@ -0,0 +1,37 @@
+module gunbc.rung_drop.collection_count_result_stated_int_until_declared_results_are_judged
+
+import std.types { NonEmptyStr }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.guarantee_rung { StructurallyImpossible, Mitigatable }
+
+// DECLARED 4b(3) DROP (gunbc#13307, XL-2; reviews 76222 and 76223 asked that it be a row and not prose). The free-monoid
+// size row v2 binds a bare `count` to, std.algebra collection_count_shape, states its result as the kernel Int where
+// every other size row states std.nat Nat. A Nat size has no negative constructor; an Int-typed size admits one that
+// the realizing primitive never produces. The stated Int is the honest result type ONLY because the Nat one cannot yet
+// be both honest and judged in v2 infer: (1) an integer literal compared with or passed against a Nat must elaborate
+// at the expected type (literal elaboration, gunbc#13320), and (2) a call returning a declared (non-kernel) type must
+// have its result judged at the consuming position (gunbc.recurring_failure_mode
+// call_result_of_a_declared_return_type_unjudged_in_v2_infer, gunbc#13314). Without (2) a Nat result would leave every
+// count result UNJUDGED, which is the larger drop.
+data collection_count_result_stated_int_until_declared_results_are_judged: RungDrop = RungDrop {
+  identity: "collection_count_result_stated_int_until_declared_results_are_judged" as NonEmptyStr,
+
+  subject: "std.algebra collection_count_shape: the result type of a bare count over a free monoid in v2",
+
+  declared: "2026-10-05",
+
+  standing: Standing,
+
+  declaration: TypedDeclaration {
+    previous: StructurallyImpossible,
+    temporary: Mitigatable,
+    reason: ReplacementStaged { replacement: "collection_count_shape returns std.nat Nat (the template every other size row carries), with integer literals at the consuming positions elaborating at Nat" },
+    population: [
+      "v2.std.node: every bare count( call site (sizes of edge and child lists), each bound to collection_count_shape by the collection roster",
+      "v2.std.node_query: every bare count( call site, each bound to collection_count_shape by the collection roster",
+      "every other bare count( call in src/v2 that binds to collection_count_shape (a bare head no in-scope declaration claims), each typed Int rather than Nat",
+      "the SEED's method typing: v1.compiler 04_method reads algebra_templates_for_profile, which includes free_monoid_collection_templates, so a seed method-form count (`xs |> count`, `xs.count()`) over a FreeMonoid is typed by this row's Int (review 76274). The seed grounds std.nat Nat to the kernel integer (gunbc.structural_realization_bindings kernel_grounding_rows), so the REALIZED type of that result is unchanged; the declared type is what is narrowed",
+    ],
+    restoration_trigger: "BOTH capabilities: v2 infer elaborates an integer literal at its expected type through the declared elaboration tables of std.literal_elaboration (a carrier's kernel grounding with its declared range, or a literal homomorphism, whichever row the carrier has), AND v2 infer derives and judges a call's result type when the callee returns a declared (non-kernel) type (gunbc.recurring_failure_mode call_result_of_a_declared_return_type_unjudged_in_v2_infer) -- SUFFICIENT FOR collection_count_shape to return std.nat Nat with every count result judged at its consuming position and every literal at those positions written as it is today. Restoration: the row returns Nat and this drop retires.",
+  },
+}
diff --git a/dag/gunbc/rung_drop/d0_store_walls_single_lifecycle.dag b/dag/gunbc/rung_drop/d0_store_walls_single_lifecycle.dag
index 63b527858c2..a00dda9f184 100644
--- a/dag/gunbc/rung_drop/d0_store_walls_single_lifecycle.dag
+++ b/dag/gunbc/rung_drop/d0_store_walls_single_lifecycle.dag
@@ -1,7 +1,7 @@
 module gunbc.rung_drop.d0_store_walls_single_lifecycle
 
 import std.types { NonEmptyStr }
-import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.rung_drop { RungDrop, Superseded, TypedDeclaration, ReplacementStaged }
 import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
 
 // OPERATOR-RULED, SINGLE-USE (2026-09-30, relayed by proud-deer-538, option A): take the fabric store
@@ -30,7 +30,11 @@ data d0_store_walls_single_lifecycle: RungDrop = RungDrop {
 
   declared: "2026-09-30",
 
-  standing: Standing,
+  standing: Superseded {
+    ruling: "Group A decommissioned (operator, 2026-10-07, relayed by valiant-crab-775): srv5-srv8 were sold, so this drop's whole population -- D0 lifecycles for FabricGroupA -- no longer exists, and D0 itself (gunbc.spark.pair_serving_d0 and its door) was deleted with the group it was the only lifecycle of" as NonEmptyStr,
+    decision_record: "dashboard messages msg_5d88338f (the removal, operator-approved) and msg_9e5a2fee (the arm path and D0 with it), both 2026-10-07" as NonEmptyStr,
+    loss_holder: "none: with D0 gone, gunbc.fabric_store_operation_admission operation_requirement admits no scope for any operation D0 performed, so every such store write now refuses as NoApprovalFlowForOperation -- stricter than the walls this drop suspended, not weaker" as NonEmptyStr,
+  },
 
   declaration: TypedDeclaration {
     previous: MechanicallyPreventable,
diff --git a/dag/gunbc/rung_drop/edited_bin_witness_wet_rows_not_executed_by_ci.dag b/dag/gunbc/rung_drop/edited_bin_witness_wet_rows_not_executed_by_ci.dag
index cfdddbed893..0740a1bfcdf 100644
--- a/dag/gunbc/rung_drop/edited_bin_witness_wet_rows_not_executed_by_ci.dag
+++ b/dag/gunbc/rung_drop/edited_bin_witness_wet_rows_not_executed_by_ci.dag
@@ -69,6 +69,7 @@ data edited_bin_witness_wet_rows_not_executed_by_ci_population: List<String> = [
   "repo_local_git_config_real_execution_witness_test.dag",
   "transport_script_stdin_byte_fidelity_witness_test.dag",
   "push_event_witness_wet_test.dag",
+  "materialization_store_local_immutable_pin_wet_witness_test.dag",
 ]
 
 data edited_bin_witness_wet_rows_not_executed_by_ci: RungDrop = RungDrop {
diff --git a/dag/gunbc/rung_drop/fixture_closure_union_unmodeled_stderr_capture.dag b/dag/gunbc/rung_drop/fixture_closure_union_unmodeled_stderr_capture.dag
index e9df5634113..0b70ff52377 100644
--- a/dag/gunbc/rung_drop/fixture_closure_union_unmodeled_stderr_capture.dag
+++ b/dag/gunbc/rung_drop/fixture_closure_union_unmodeled_stderr_capture.dag
@@ -1,29 +1,14 @@
 module gunbc.rung_drop.fixture_closure_union_unmodeled_stderr_capture
 
 import std.types { NonEmptyStr }
-import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.rung_drop { RungDrop, Retired, TypedDeclaration, ReplacementStaged }
 import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
-import gunbc.stderr_capture_gap_exclusion { exclusion, StderrCaptureGapExclusion }
-
-// THE FIXTURE-CLOSURE UNION RENDERS EVERY RECORDED MEMBER THROUGH THE RUST EMITTER. After
-// #13437 the walker closes by reference, so a fixture that reaches extdeps.gunbc compiles
-// gunbc.WitnessBin.Run into the union. That operation declares stderr_truncated /
-// stderr_total_bytes / stderr_retained_bytes, which v1.compiler.emit shell_channel_realized_by_target
-// refuses for rust: the emitted Command body implements no WitnessStderrCapturePolicy.
-// emit_artifact then returns no files for the WHOLE union, so those three diagnostics abort
-// every other member's render and refuse unrelated floors (specimen: #13420).
-//
-// THE EARLIEST UNJUSTIFIED BOUNDARY IS THE UNION, NOT THE WALL. The wall is the honest
-// capability gap (05_emit names the next-rung trigger: the emitted realization implementing
-// the declared policy). std.shell_stream_capture still homes the policy on the interpreter
-// drain until that trigger fires. Binding a fabricating rust handler (truncated=false) is the
-// fail-open 05_emit already refuses. So the union must not render the unmodeled operation:
-// a typed exclusion keyed on that diagnostic fact, never a silent skip, and a real emit error
-// in a member the union still renders still refuses.
-
-fn capture_gap_exclusion_population() -> StderrCaptureGapExclusion {
-  exclusion
-}
+
+// RETIRED — TRIGGER FIRED. gunbc#13472 realized rust shell WitnessStderrCapturePolicy
+// (v1.compiler.emit shell_channel_realized_by_target is true for the three capture-
+// accounting channels). The union no longer strips WitnessBin.Run. Discriminating
+// controls stay enrolled: fixture_closure_union_controls gunbc-reach emit, plus
+// emit_host realization tests (DESIGN §4b(4)).
 
 data fixture_closure_union_unmodeled_stderr_capture: RungDrop = RungDrop {
   identity: "fixture_closure_union_unmodeled_stderr_capture" as NonEmptyStr,
@@ -32,7 +17,9 @@ data fixture_closure_union_unmodeled_stderr_capture: RungDrop = RungDrop {
 
   declared: "2026-10-06",
 
-  standing: Standing,
+  standing: Retired {
+    trigger_fired: "2026-10-08 -- gunbc#13472. THE CAPABILITY, EXECUTED: v1.compiler.emit shell_channel_realized_by_target returns true for ShellChanStderrTruncated, ShellChanStderrTotalBytes and ShellChanStderrRetainedBytes on rust because emit_shell_call implements the declared WitnessStderrCapturePolicy. WitnessBin.Run emits without TransportEmissionNotModeled; the union strip of that service is deleted; this exclusion population is empty. DISCRIMINATING CONTROL, ENROLLED: v1_compiler.cli_run fixture_closure_union_controls admits a fixture whose closure reaches extdeps.gunbc, and a real emit error beside that reach still refuses as FixtureClosureUnionEmitRefused at module=efr_member. Answering the channels as untruncated whole-stream lengths did not discharge this. Deleting the channels from the interface did not discharge this." as NonEmptyStr
+  },
 
   declaration: TypedDeclaration {
     previous: MechanicallyPreventable,
@@ -41,9 +28,7 @@ data fixture_closure_union_unmodeled_stderr_capture: RungDrop = RungDrop {
 
     reason: ReplacementStaged { replacement: "the rust emitted realization implementing the declared WitnessStderrCapturePolicy, the same next-rung trigger v1.compiler.emit shell_channel_realized_by_target already names" },
 
-    population: [
-      "exactly gunbc.stderr_capture_gap_exclusion.exclusion (consumed here as capture_gap_exclusion_population): gunbc.WitnessBin.Run in extdeps.gunbc. Output channels stderr_truncated, stderr_total_bytes, stderr_retained_bytes, each a TransportEmissionNotModeled ShellChannelNotRealizedByTarget for target rust. A later shell operation with the same capture-gap fact is NOT a member: the union still renders it and still refuses. The union compiles and evaluates that record; deleting either this module or the carrier refuses the seed compile",
-    ],
+    population: [],
 
     restoration_trigger: "THE CAPABILITY: the rust emitted shell realization implements the operation's declared WitnessStderrCapturePolicy, sufficient for v1.compiler.emit shell_channel_realized_by_target to return true for ShellChanStderrTruncated, ShellChanStderrTotalBytes and ShellChanStderrRetainedBytes. WHAT THAT MUST BE SUFFICIENT FOR: those operations emit for rust without TransportEmissionNotModeled, this exclusion has an empty population and this row and the union's strip of those services delete together. Answering the channels as untruncated whole-stream lengths does NOT discharge it. Deleting the channels from the interface does NOT discharge it. Silently omitting the module from the union without naming this cause does NOT discharge it.",
   }
diff --git a/dag/gunbc/rung_drop/fleet_converge_named_revision_and_branch.dag b/dag/gunbc/rung_drop/fleet_converge_named_revision_and_branch.dag
new file mode 100644
index 00000000000..e9905cfd58b
--- /dev/null
+++ b/dag/gunbc/rung_drop/fleet_converge_named_revision_and_branch.dag
@@ -0,0 +1,35 @@
+module gunbc.rung_drop.fleet_converge_named_revision_and_branch
+
+import std.types { NonEmptyStr }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, DeletedWithoutReplacement }
+import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
+
+// ============================================================================================
+// THE DECLARED RUNG DROP for the two refusals that named R and the deploy branch, deleted so a
+// dispatch / `gunbc converge --mode deploy` can run once R is the event sha and the deploy branch
+// is the checked-out revision (operator 2026-10-09; DESIGN 4b(3)). This row's subject is whether
+// plan/apply/deploy may proceed without an operator-typed revision and branch. Privileged WIF
+// remains equality-pinned at reviewed main (operator 2026-10-10); that is not this row's subject.
+// ============================================================================================
+
+data fleet_converge_named_revision_and_branch: RungDrop = RungDrop {
+  identity: "fleet_converge_named_revision_and_branch" as NonEmptyStr,
+
+  subject: "whether fleet-converge plan, apply and live-deploy, and gunbc converge --mode deploy, refuse unless the operator typed a 40-digit expected_revision and a nonempty --candidate-branch",
+
+  declared: "2026-10-10",
+
+  standing: Standing,
+
+  declaration: TypedDeclaration {
+    previous: MechanicallyPreventable,
+    temporary: Mitigatable,
+    reason: DeletedWithoutReplacement,
+    population: [
+      "gunbc.actions_run_binding admit_optional_expected_revision: ExpectedRevisionAbsent admits binding.run_revision (the dispatched / checked-out sha). Callers: gunbc.fleet_converge_plan_cli fleet_converge_scoped_plan_wet, fleet_converge_apply_wet; gunbc.live_deploy.apply live_deploy_transaction_admitted_wet_with_access. A present expected_revision still has to match; ExpectedRevisionMalformed still refuses. Operator 2026-10-10: the input is a cross-check, not a second revision authority",
+      "gunbc.fleet_converge_plan_cli fleet_converge_deploy_branch_admits: an empty required branch admits a nonempty observed branch. An empty observed branch still refuses. A named required branch still has to equal the checkout",
+      "NOT in the population: gunbc.roadmap.roadmap_launch_deployment_cli rlm_launch_deployment_receipt and gunbc.runner.runner_microvm_network_apply microvm_network_apply_admission, which still refuse an empty expected_revision. NOT: apply's plan-receipt / plan-hash lock. NOT: privileged WIF, which is equality-pinned at reviewed main",
+    ],
+    restoration_trigger: "THE CAPABILITY: R and the deploy branch are bound to a locked identity the operator produced (a plan receipt, or a required dispatch input with no silent default) so plan/apply/deploy cannot mutate a host at a revision or branch that was never named. WHAT THAT MUST BE SUFFICIENT FOR: omitting RLM_EXPECTED_REVISION and omitting --candidate-branch each refuse, or each is filled from that locked identity (dispatch revision = event sha; apply revision = the admitted plan receipt). Restoring the old main-only expected_revision / candidate-branch == main refusals does NOT discharge it — that re-locks the branch the operator ruled out for development operations. A comment citing an operator date does NOT discharge it.",
+  }
+}
diff --git a/dag/gunbc/rung_drop/foreign_grammar_extended_parse_new_witness_eval_step_cost.dag b/dag/gunbc/rung_drop/foreign_grammar_extended_parse_new_witness_eval_step_cost.dag
new file mode 100644
index 00000000000..74703ce8e11
--- /dev/null
+++ b/dag/gunbc/rung_drop/foreign_grammar_extended_parse_new_witness_eval_step_cost.dag
@@ -0,0 +1,42 @@
+module gunbc.rung_drop.foreign_grammar_extended_parse_new_witness_eval_step_cost
+
+import std.types { String, List, NonEmptyStr }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
+import v2.workflow.floor_eval_step_cost_drop { floor_eval_step_cost_drop_foreign_grammar_extended_parse_rows }
+
+// DECLARED 4b(3) DROP (v2.test.parse census phase 4, 2026-10-05; ruling stern-bear-500, grammar
+// program, after the operator's phase-4 ruling via sharp-raven-357 to keep and gate the foreign
+// grammars). The DECLARATION lives here; the POPULATION's authority is
+// `v2.workflow.floor_eval_step_cost_drop` `floor_eval_step_cost_drop_foreign_grammar_extended_parse_rows`.
+//
+// WHAT IS LOST IS ONE WALL, AND THE CLAIMS ARE UNTOUCHED. Both identities stay on the gate: planned,
+// executed and measured; a semantic red and a wall-clock crossing still block. Only an eval-step
+// overrun is reported under this drop rather than refusing. The budget is not raised.
+//
+// WHY A DROP AND NOT A SMALLER CLAIM. Each claim parses one extended function through its language's
+// own grammar -- the smallest source exercising the constructs its label names -- and its grammar
+// preparation is billed apart (claim_batch BuildBuddy invocation 9241511f). The remaining bill is the
+// parser's honest per-token cost, the same cost gunbc.rung_drop
+// dag_text_round_trip_nested_bind_new_witness_eval_step_cost declares for the dag grammar.
+data foreign_grammar_extended_parse_new_witness_eval_step_cost_population: List<String> = floor_eval_step_cost_drop_foreign_grammar_extended_parse_rows |> map(m => concat(concat(m.identity, ": over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_foreign_grammar_extended_parse_rows; measured by "), m.measured_by))
+
+data foreign_grammar_extended_parse_new_witness_eval_step_cost: RungDrop = RungDrop {
+  identity: "foreign_grammar_extended_parse_new_witness_eval_step_cost" as NonEmptyStr,
+
+  subject: "new-witness eval-step cost gate over the kotlin and rust extended-function grammar parse claims (test.claim.parse_test_kotlin_grammar, test.claim.parse_test_rust_grammar): they still execute, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered",
+
+  declared: "2026-10-05",
+
+  standing: Standing,
+
+  declaration: TypedDeclaration {
+    previous: MechanicallyPreventable,
+    temporary: Mitigatable,
+    reason: ReplacementStaged {
+      replacement: "honest per-token parse cost of the interpreted parser over a foreign grammar; owner: grammar program (stern-bear-500)",
+    },
+    population: foreign_grammar_extended_parse_new_witness_eval_step_cost_population,
+    restoration_trigger: "THE CAPABILITY: a precedence-climbing tree contract (one node per operator application, not one per level), or parse claims evaluated on the native route -- the capability gunbc.rung_drop dag_text_round_trip_nested_bind_new_witness_eval_step_cost names. WHAT IT MUST BE SUFFICIENT FOR: both identities, still tokenizing and parsing their extended-function source once through their own language's grammar, measuring under the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives. Deleting an identity, shrinking its source below the constructs its claim names, supplying its tokens or parse, or bundling it into a shared producer does not satisfy this trigger.",
+  }
+}
diff --git a/dag/gunbc/rung_drop/handoff_observer_is_sol_not_kvm_viewer.dag b/dag/gunbc/rung_drop/handoff_observer_is_sol_not_kvm_viewer.dag
new file mode 100644
index 00000000000..8066dcf3bce
--- /dev/null
+++ b/dag/gunbc/rung_drop/handoff_observer_is_sol_not_kvm_viewer.dag
@@ -0,0 +1,44 @@
+module gunbc.rung_drop.handoff_observer_is_sol_not_kvm_viewer
+
+import std.types { NonEmptyStr }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
+
+// DECLARED 4b(3) DROP (2026-10-06; operator decision msg_bb46c20f, over gunbc#12492, following the
+// operator ruling msg_7627e67f). gunbc#12492 made an ESTABLISHED KVM observer a required precondition of
+// the mtcollins1 boot handoff. The only KVM client the observer ever drove was the controller vendor's
+// own served viewer, whose source carries a proprietary notice; everything derived from it moved out of
+// public gunbc under msg_7627e67f, so no public KVM client exists and megarac_kvm_observer_start answers
+// NotStarted. Keeping the requirement would make every public handoff refuse.
+//
+// WHAT IS LOST: the boot handoff no longer requires a screen witness. The required observer is the SOL
+// collector of this run: the handoff is admitted only over the SolHeldAt that mtcollins1_sol_supervised
+// returned for this attempt's collector (sol_handoff_admission in gunbc.machine_intake_mtcollins1_boot_run),
+// and with no such observation it refuses. The screen is recorded as not observed, never inferred.
+//
+// WHAT STAYS ENROLLED: kvm_handoff_admission still refuses an observer that is not started or not
+// established (test.claim.machine_intake.megarac_kvm_still_witness_test), now as this drop's control for
+// the day the capability returns; and the acceptance matrix holds a RED that the handoff refuses with no
+// SOL observation, with a mutant that opens the gate and must fail.
+
+data handoff_observer_is_sol_not_kvm_viewer: RungDrop = RungDrop {
+  identity: "handoff_observer_is_sol_not_kvm_viewer" as NonEmptyStr,
+
+  subject: "the mtcollins1 boot handoff no longer requires an established KVM observer; it requires this run's SOL observation instead, and the KVM screen still is recorded as not observed",
+
+  declared: "2026-10-06",
+
+  standing: Standing,
+
+  declaration: TypedDeclaration {
+    previous: MechanicallyPreventable,
+    temporary: Mitigatable,
+    reason: ReplacementStaged {
+      replacement: "gunbc.machine_intake_mtcollins1_boot_run sol_handoff_admission, a typed admission over the run-bound SolHeldAt of mtcollins1_sol_supervised, refusing the handoff without it",
+    },
+    population: [
+      "the mtcollins1 boot handoff only (gunbc.machine_intake_mtcollins1_boot_run mtcollins1_boot_actuate), for as long as no public non-vendor KVM client exists",
+    ],
+    restoration_trigger: "THE CAPABILITY: a public, non-vendor KVM client that ESTABLISHES the observer, meaning it logs in to the controller, holds one seat, and journals an established line bound to the BMC host and the attempt, readable through kvm_observer_standing_now. WHAT THAT MUST BE SUFFICIENT FOR: restoring kvm_handoff_admission as a second required precondition of the mtcollins1 handoff beside the SOL admission, with the established-or-refuse control already enrolled in test.claim.machine_intake.megarac_kvm_still_witness_test. The existence of some KVM client, or of a client that cannot establish the observer, does not satisfy this.",
+  }
+}
diff --git a/dag/gunbc/rung_drop/kvm_observer_protocol_wet_witnesses_deleted_with_the_observer.dag b/dag/gunbc/rung_drop/kvm_observer_protocol_wet_witnesses_deleted_with_the_observer.dag
new file mode 100644
index 00000000000..c55ec26a1a5
--- /dev/null
+++ b/dag/gunbc/rung_drop/kvm_observer_protocol_wet_witnesses_deleted_with_the_observer.dag
@@ -0,0 +1,35 @@
+module gunbc.rung_drop.kvm_observer_protocol_wet_witnesses_deleted_with_the_observer
+
+import std.types { NonEmptyStr }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, DeletedWithoutReplacement }
+import gunbc.guarantee_rung { MechanicallyPreventable, Mitigatable }
+
+// DECLARED 2026-10-09 beside gunbc#13503, operator decision msg_bb46c20f. The KVM observer was deleted
+// because it drove the vendor web client, and the 14-claim test.claim.machine_intake.
+// mtcollins1_kvm_observer_protocol_wet_witness population executed that observer for real on
+// v2.workflow.local_repo_wet_terminal local_repo_wet_schedule. This row is NOT a substitution and has
+// no replacement: it is separate from handoff_observer_is_sol_not_kvm_viewer, which declares only that
+// SOL stands in for the viewer at the handoff.
+
+data kvm_observer_protocol_wet_witnesses_deleted_with_the_observer: RungDrop = RungDrop {
+  identity: "kvm_observer_protocol_wet_witnesses_deleted_with_the_observer" as NonEmptyStr,
+
+  subject: "the real-execution witnesses of the deleted mtcollins1 KVM observer's protocol and process supervision no longer execute on any lane",
+
+  declared: "2026-10-09",
+
+  standing: Standing,
+
+  declaration: TypedDeclaration {
+    previous: MechanicallyPreventable,
+    temporary: Mitigatable,
+    reason: DeletedWithoutReplacement,
+    population: [
+      "THE 14 CLAIMS, by id, all of test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness, deleted with the observer and never replaced one-for-one",
+      "WITH A SURVIVING WET COUNTERPART in test.claim.machine_intake.sol_hold_stdin_wet_witness (4 of 14, each a process-supervision claim): a_launch_that_cannot_publish_its_pid_stops_its_child -> a_launch_that_cannot_publish_its_pid_stops_the_child_it_created; a_term_ignoring_child_with_an_unpublished_record_is_observed_stopped -> a_publication_failure_stops_even_a_term_ignoring_child; a_record_naming_another_process_is_foreign_and_not_released -> a_record_this_attempt_did_not_establish_is_not_released; an_owned_process_is_released_and_observed_gone -> our_collector_is_released_observed_gone_and_its_record_retired",
+      "WITH NO COUNTERPART, process supervision (2 of 14): an_unreadable_process_state_never_skips_the_kill_of_an_unpublished_child (unreadable process state); a_relative_observer_directory_is_resolved_once (observer directory)",
+      "WITH NO COUNTERPART, viewer and protocol specific (8 of 14): a_held_observer_is_admitted_and_its_triggered_still_is_hash_bound; a_root_page_that_navigates_cannot_destroy_the_login; a_viewer_without_its_feature_list_never_opens_kvm; a_busy_viewer_slot_refuses_the_observer_and_the_handoff; a_connection_lost_mid_boot_is_reported_and_no_still_is_claimed_after_it; an_unreadable_canvas_is_acquisition_failed_with_the_browsers_words; a_stale_listening_line_from_another_pid_is_not_readiness; a_transport_that_exits_at_once_is_not_serving"
+    ],
+    restoration_trigger: "THE CAPABILITY: a public, non-vendor KVM client that ESTABLISHES the observer (the same capability named by gunbc.rung_drop handoff_observer_is_sol_not_kvm_viewer), AND a real-execution protocol witness for it enrolled on v2.workflow.local_repo_wet_terminal local_repo_wet_schedule that covers the 10 claims above with no counterpart (the 8 viewer and protocol claims and the 2 process-supervision claims with none). WHAT IT MUST BE SUFFICIENT FOR: each of those 10 behaviours executed against a real process and real transport, so that deleting the client or its supervision makes a control fail. A client without such a wet witness, a hermetic-only witness, or a witness not on local_repo_wet_schedule does not satisfy this. The 4 claims with a counterpart are covered meanwhile by sol_hold_stdin_wet_witness for the supervision they share, not for the viewer.",
+  }
+}
diff --git a/dag/gunbc/rung_drop/native_serve_request_budget_unrealized.dag b/dag/gunbc/rung_drop/native_serve_request_budget_unrealized.dag
index 3482cab8465..e4c4406238d 100644
--- a/dag/gunbc/rung_drop/native_serve_request_budget_unrealized.dag
+++ b/dag/gunbc/rung_drop/native_serve_request_budget_unrealized.dag
@@ -22,16 +22,14 @@ import gunbc.guarantee_rung { OutsideTheLadder, Mitigatable }
 // THE TRIGGER NAMES THE CAPABILITY (ruling relayed by gentle-dove-36, 2026-10-03): a worker thread
 // or a pool is not the trigger; the restored wall is. And the approval broker's move off `gunbc
 // serve` is GATED on this row's retirement, because the interpreted broker has the mitigation today.
-// THE CAPABILITY IS BUILT AND NOT YET OBSERVED (gunbc#13278, 2026-10-05). gunbc.native_serve now
-// carries the deadline, the stuck-worker ceiling and both typed refusals, the rendered main enforces
-// them, and the native-serve probe carries the cases this trigger names. Measured over real TCP on a
-// scratch build of the fixture: a /spin handler that does not return is refused 500 at the deadline,
-// a later /hello on the same process answers 200, and past the ceiling the process refuses 503 and
-// exits. The row STAYS STANDING because the trigger is the INSTRUMENT observing it, and today
-// `gunbc test //gunbc/instruments:native-serve` stops before the probe runs: the emitted fixture
-// library refuses at rustc on three emitter and source defects owned by gunbc#13219, gunbc#13276 and
-// gunbc#13237. When those have landed and the instrument holds, this row retires with that run as
-// its receipt; a scratch build with hand patches is evidence, not the instrument.
+// RETIRED (gunbc#13278 built the capability; the instrument observed it after gunbc#13219 landed).
+// The trigger was the INSTRUMENT observing the wall, not the code existing: `gunbc test
+// //gunbc/instruments:native-serve` on main at the gunbc#13219 merge emits, builds and starts the
+// fixture and holds over real TCP. The probe carries the cases this trigger names, and the row's
+// discriminating evidence stays enrolled there (DESIGN 4b meta-obligation 4): /spin is refused a
+// typed 500 at the deadline, a later /hello on the same process is answered 200, and past the
+// stuck-worker ceiling the process refuses 503 and exits 75.
+
 data native_serve_request_budget_unrealized: RungDrop = RungDrop {
   identity: "native_serve_request_budget_unrealized" as NonEmptyStr,
 
@@ -39,7 +37,9 @@ data native_serve_request_budget_unrealized: RungDrop = RungDrop {
 
   declared: "2026-10-03",
 
-  standing: Standing,
+  standing: Retired {
+    trigger_fired: "2026-10-08 -- gunbc test //gunbc/instruments:native-serve held on main at the gunbc#13219 merge (23 requests, refused launch status 2): the probe's /spin cases observe the typed 500 at the 500ms request deadline for a handler that does not return, a later /hello on the same process answered 200, and past the stuck-worker ceiling the typed 503 and exit 75. The wall is gunbc.native_serve native_serve_admission / native_serve_deadline_refused enforced by the rendered main, built in gunbc#13278"
+  },
 
   declaration: TypedDeclaration {
     previous: Mitigatable,
diff --git a/dag/gunbc/rung_drop/provider_guest_ci_egress_unfiltered.dag b/dag/gunbc/rung_drop/provider_guest_ci_egress_unfiltered.dag
new file mode 100644
index 00000000000..dd384117dee
--- /dev/null
+++ b/dag/gunbc/rung_drop/provider_guest_ci_egress_unfiltered.dag
@@ -0,0 +1,41 @@
+module gunbc.rung_drop.provider_guest_ci_egress_unfiltered
+
+import std.types { NonEmptyStr }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.guarantee_rung { Mitigatable, OutsideTheLadder }
+
+// THE DECLARED DROP for CI work on a provider guest rebuilt per job, admitted WITHOUT default-deny
+// egress by operator ruling (2026-10-09). gunbc.runner.runner_isolation_admission requires seven
+// guarantees of general CI, and the last one the microVM path earned was DefaultDenyEgress -- a
+// containment of what job code can reach, held there by forward filtering with a counted receipt.
+// A Hetzner Cloud guest has open internet, and a firewall inside the guest is not containment
+// because a job with root removes it. So a job on these guests can reach any host on the internet
+// while it holds its runner registration.
+//
+// WHY THIS IS A DROP AND NOT A NEW ROW OF THE OFFER: the guarantee is not evidenced and the offer
+// says so; what this row declares is that the admission EXCUSES it for a named population, which
+// is a rung lower than the fleet holds elsewhere, and DESIGN 4b(3) allows that only declared.
+//
+// THE OPERATOR'S DIRECTION FOR THE REPAIR is the network layer, not the guest: these machines will
+// sit behind a router at a site, and the fleet owns the hosts, so egress control is an SDN / VXLAN
+// design owned below the guest rather than a firewall the job could reach.
+data provider_guest_ci_egress_unfiltered: RungDrop = RungDrop {
+  identity: "provider_guest_ci_egress_unfiltered" as NonEmptyStr,
+
+  subject: "untrusted CI job code on a per-job-rebuilt provider guest reaching hosts it was not granted (gunbc.runner.runner_isolation_admission DefaultDenyEgress), excused by gunbc.runner.provider_guest_incarnation for the population below",
+
+  declared: "2026-10-09",
+
+  standing: Standing,
+
+  declaration: TypedDeclaration {
+    previous: Mitigatable,
+    temporary: OutsideTheLadder,
+    reason: ReplacementStaged { replacement: "operator ruling 2026-10-09: a guest rebuilt from the provider's image before every job, so nothing a job leaves behind survives into the next; egress itself is uncontained" },
+    population: [
+      "gunbc.fleet_host_identity operator_host_183527 (Hetzner Cloud CAX41 169308819, nbg1)",
+      "gunbc.fleet_host_identity operator_host_3dde7f (Hetzner Cloud CAX41 169308796, hel1)",
+    ],
+    restoration_trigger: "egress from these guests is contained BELOW the guest -- at the site's network layer (SDN / VXLAN behind a router the fleet owns) or at the provider's hypervisor -- so a job with root in the guest cannot widen it, and a filtered-egress receipt on one of them records denials and grants each proven by the guest's outcome and the enforcing layer's own counter, as gunbc.runner.runner_filtered_egress_receipt does for the microVM path. SUFFICIENT FOR deleting this row: the provider-rebuild offer lists DefaultDenyEgress as evidenced on that receipt and the excuse is removed from the admission in the same change. NOT satisfied by an nftables ruleset inside the guest."
+  }
+}
diff --git a/dag/gunbc/rung_drop/rust_unit_tests_off_pull_requests.dag b/dag/gunbc/rung_drop/rust_unit_tests_off_pull_requests.dag
index e4d7a45f9ce..2819feab1b5 100644
--- a/dag/gunbc/rung_drop/rust_unit_tests_off_pull_requests.dag
+++ b/dag/gunbc/rung_drop/rust_unit_tests_off_pull_requests.dag
@@ -1,7 +1,7 @@
 module gunbc.rung_drop.rust_unit_tests_off_pull_requests
 
 import std.types { List, NonEmptyStr, String }
-import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.rung_drop { RungDrop, Superseded, TypedDeclaration, ReplacementStaged }
 import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
 
 // DECLARED 2026-10-06, operator-approved (CI short-term relief). The fleet rust-unit-tests job runs
@@ -10,6 +10,11 @@ import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
 // GateArmSkippedOnPullRequest, so the aggregate excuses its skip only on a pull_request event and
 // refuses it everywhere else. A unit-test red is therefore found at the queue's composed revision,
 // not on the pull request that introduced it.
+//
+// SUPERSEDED 2026-10-09, AND THE PARAGRAPH ABOVE IS NOW A RECOUNTING. The v1 withdrawal ruling
+// deleted the rust-unit-tests job with the other v1-judged lanes, so the lane this row says still
+// blocks at the merge queue runs nowhere. The trigger did not fire: nothing reports a failing v1
+// unit test on a pull request. The loss is carried by v1_required_lanes_withdrawn.
 
 data rust_unit_tests_off_pull_requests_population: List<String> = [
   "pull_request runs of the fleet rust-unit-tests job of gunbc.compiler_gate_workflow: cargo test --release -p v1-compiler --lib (gunbc.repo_self_test_command) is not executed per push, so a failing v1-compiler unit test blocks at merge_group instead of on the pull request",
@@ -19,7 +24,11 @@ data rust_unit_tests_off_pull_requests: RungDrop = RungDrop {
   identity: "rust_unit_tests_off_pull_requests" as NonEmptyStr,
   subject: "a failing v1-compiler --lib unit test turns the required witnesses context red on the pull request that introduced it",
   declared: "2026-10-06",
-  standing: Standing,
+  standing: Superseded {
+    ruling: "the operator ruling of 2026-10-09 (the v1 withdrawal): v1 is no longer a validation authority, and the rust-unit-tests job was deleted from gunbc.compiler_gate_workflow with the floor, generated and seed lanes. The trigger did NOT fire -- no failing v1 unit test is reported on a pull request, or anywhere on the required path" as NonEmptyStr,
+    decision_record: "the operator's brief to session smart-gull-336 on 2026-10-09 (the v2 half of the v1 withdrawal), carried by the change that declares gunbc.rung_drop v1_required_lanes_withdrawn" as NonEmptyStr,
+    loss_holder: "v1_required_lanes_withdrawn" as NonEmptyStr
+  },
   declaration: TypedDeclaration {
     previous: MechanicallyPreventable,
     temporary: Mitigatable,
diff --git a/dag/gunbc/rung_drop/self_host_emit_derisk_claim_unobserved.dag b/dag/gunbc/rung_drop/self_host_emit_derisk_claim_unobserved.dag
index c64c8e21771..16bee52cba7 100644
--- a/dag/gunbc/rung_drop/self_host_emit_derisk_claim_unobserved.dag
+++ b/dag/gunbc/rung_drop/self_host_emit_derisk_claim_unobserved.dag
@@ -24,9 +24,8 @@ import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
 // both emit rows FAIL (ownership_miss: cpu=334ms wall=1237ms eval_steps=224878;
 // two_user_types: exit 1). The sibling `self_host_frontier_infer_single_arm_module_holds`
 // also FAIL, so the emit conjunct is not an isolated emit-stage miss. On
-// `6a1e5acfae`, interpreted probes that return the diagnostic reason (head, and
-// `frontier_probe_assemble_located_reason_from_diagnostics` which skips
-// `parse_grammar_choice_overlap_residue`) all printed `resolve_reason_unbound_symbol` for
+// `6a1e5acfae`, interpreted probes that return the diagnostic reason (head, and a located-reason
+// fold that skipped the since-retired grammar overlap residue) all printed `resolve_reason_unbound_symbol` for
 // assemble, infer, and emit of both fixtures. Head and located reason agreed: this is not
 // residue masking. The interpreted claim may consume that skip fold; an emitted closure
 // currently cannot. The probes are not kept: they are not the hold-claim, and a Symbol
diff --git a/dag/gunbc/rung_drop/serving_fixtures_name_sold_group_b_hosts.dag b/dag/gunbc/rung_drop/serving_fixtures_name_sold_group_b_hosts.dag
new file mode 100644
index 00000000000..5831a41d7be
--- /dev/null
+++ b/dag/gunbc/rung_drop/serving_fixtures_name_sold_group_b_hosts.dag
@@ -0,0 +1,42 @@
+module gunbc.rung_drop.serving_fixtures_name_sold_group_b_hosts
+
+import std.types { NonEmptyStr }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, LostAsPassenger }
+import gunbc.guarantee_rung { StructurallyGuaranteed, Mitigatable }
+
+// OPERATOR-RULED (2026-10-10): every one of the eight procured DGX Sparks is sold, Group B (srv9-srv12)
+// included. The scoped cut removed srv9-srv12 from everything that can reach real hardware: the
+// operator host roster, the host-key enrolment roster, the endpoint list of gunbc.fleet_intent_network, the
+// router bindings and observed reservations of gunbc.spark.dgx_procurement (so no reserved identity
+// remains), the wireless-link desired rows, and the administrator credential roster that
+// spark_converge_target_selection resolves against. gunbc.spark.dgx_procurement dgx_spark_disposed_units
+// records all eight units as sold.
+//
+// WHAT FALLS. The witnesses that use FabricGroupB or the srv9-srv12 identity symbols (and the
+// srv9 endpoint literal) purely as TEST DATA were not re-fixtured: they still name sold hosts. The
+// identity and endpoint data symbols are retained for exactly that population and for
+// gunbc.spark.glm_serving_load; nothing rostered reaches them.
+//
+// WHAT DOES NOT FALL. No fleet-converge target, host roster, enrolment, binding, reservation or LAN
+// endpoint list names a sold unit, so no mode can dispatch to one.
+data serving_fixtures_name_sold_group_b_hosts: RungDrop = RungDrop {
+  identity: "serving_fixtures_name_sold_group_b_hosts" as NonEmptyStr,
+
+  subject: "serving, harness and fabric witnesses whose fixtures name FabricGroupB and the sold hosts srv9-srv12 as test data rather than a live host population",
+
+  declared: "2026-10-10",
+
+  standing: Standing,
+
+  declaration: TypedDeclaration {
+    previous: StructurallyGuaranteed,
+    temporary: Mitigatable,
+    reason: LostAsPassenger { carrier: "the live Group B host population (srv9-srv12) that the serving and fabric witnesses' fixtures were authored against" },
+    population: [
+      "witness fixtures under dag/test/claim that name FabricGroupB or operator_host_srv9 through operator_host_srv12 as inputs",
+      "gunbc.spark.glm_serving_load, which still addresses srv9_host_lan_endpoint",
+      "no rostered fleet target, enrolment, binding, reservation or endpoint list: those are removed, not dropped",
+    ],
+    restoration_trigger: "serving re-fixtured onto a live host population: the serving, harness and fabric witnesses and gunbc.spark.glm_serving_load take their hosts from a live roster (hosts that exist and are reachable) instead of the sold srv9-srv12 symbols, SUFFICIENT FOR the srv9-srv12 identity and endpoint data symbols to be deleted without a witness or serving module resolving them",
+  },
+}
diff --git a/dag/gunbc/rung_drop/sha256_span_program_serialize_new_witness_eval_step_cost.dag b/dag/gunbc/rung_drop/sha256_span_program_serialize_new_witness_eval_step_cost.dag
index 2c6d83488e1..9a8b869189e 100644
--- a/dag/gunbc/rung_drop/sha256_span_program_serialize_new_witness_eval_step_cost.dag
+++ b/dag/gunbc/rung_drop/sha256_span_program_serialize_new_witness_eval_step_cost.dag
@@ -1,7 +1,7 @@
 module gunbc.rung_drop.sha256_span_program_serialize_new_witness_eval_step_cost
 
 import std.types { String, List, NonEmptyStr }
-import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.rung_drop { RungDrop, Superseded, TypedDeclaration, ReplacementStaged }
 import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
 import v2.workflow.floor_eval_step_cost_drop { floor_eval_step_cost_drop_span_program_rows }
 
@@ -46,7 +46,11 @@ data sha256_span_program_serialize_new_witness_eval_step_cost: RungDrop = RungDr
 
   declared: "2026-09-22",
 
-  standing: Standing,
+  standing: Superseded {
+    ruling: "Group A decommissioned (operator, 2026-10-07, relayed by valiant-crab-775): the one claim this drop covered lived in test.claim.spark.v41_checkpoint_materialize_witness, and gunbc.spark.v41_checkpoint_materialize -- the only consumer of gunbc.sha256sum_byte_span -- acted only on Group A hosts, so the module, its witness and the byte-span producer were deleted with the group" as NonEmptyStr,
+    decision_record: "dashboard messages msg_5d88338f (the removal, operator-approved) and msg_9e5a2fee (the arm path with it), both 2026-10-07" as NonEmptyStr,
+    loss_holder: "none: no producer and no claim remain for the cost gate to be suspended over; the population is empty" as NonEmptyStr,
+  },
 
   declaration: TypedDeclaration {
     previous: MechanicallyPreventable,
diff --git a/dag/gunbc/rung_drop/slot_row_pinned_below_demonstrated_demand_unrefused.dag b/dag/gunbc/rung_drop/slot_row_pinned_below_demonstrated_demand_unrefused.dag
index ba5a393be27..e0a1df63239 100644
--- a/dag/gunbc/rung_drop/slot_row_pinned_below_demonstrated_demand_unrefused.dag
+++ b/dag/gunbc/rung_drop/slot_row_pinned_below_demonstrated_demand_unrefused.dag
@@ -1,7 +1,7 @@
 module gunbc.rung_drop.slot_row_pinned_below_demonstrated_demand_unrefused
 
 import std.types { NonEmptyStr }
-import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.rung_drop { RungDrop, Superseded, TypedDeclaration, ReplacementStaged }
 import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
 
 // ============================================================================================
@@ -58,7 +58,11 @@ data slot_row_pinned_below_demonstrated_demand_unrefused: RungDrop = RungDrop {
 
   declared: "2026-09-19",
 
-  standing: Standing,
+  standing: Superseded {
+    ruling: "the operator ruling of 2026-10-09 (the v1 withdrawal): the floor lane was deleted from gunbc.compiler_gate_workflow, so the floor no longer runs in a fleet slot and the slot wall's floor-demand conjunct (the subject of this row) was withdrawn with it; the same ruling moved the slot to a fixed 22 GiB maximum with no swap for the emit-and-build steps that do run there" as NonEmptyStr,
+    decision_record: "the relayed REQUEST_CHANGES on gunbc#13641 and the operator's brief to session smart-gull-336 (2026-10-09), carried by the change that declares gunbc.rung_drop v1_required_lanes_withdrawn and moves gunbc.runner_slot_desired to 22/21 GiB and MemorySwapMax=0; the floor's own envelope survives as gunbc.floor_demand gunbc_floor_pinned_memory_max / _high" as NonEmptyStr,
+    loss_holder: "v1_required_lanes_withdrawn" as NonEmptyStr
+  },
 
   declaration: TypedDeclaration {
     previous: MechanicallyPreventable,
diff --git a/dag/gunbc/rung_drop/v1_required_lanes_withdrawn.dag b/dag/gunbc/rung_drop/v1_required_lanes_withdrawn.dag
new file mode 100644
index 00000000000..80270f33e19
--- /dev/null
+++ b/dag/gunbc/rung_drop/v1_required_lanes_withdrawn.dag
@@ -0,0 +1,58 @@
+module gunbc.rung_drop.v1_required_lanes_withdrawn
+
+import std.types { List, NonEmptyStr, String }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, ReplacementStaged }
+import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
+
+// DECLARED 2026-10-09 ON AN OPERATOR RULING (the brief to session smart-gull-336, the v2 half of the
+// v1 withdrawal): "v1 is effectively bankrupt due to memory instability - i want to go back to pure
+// v2 native compiler development - that means deleting most of our current CI jobs", and "i suggest
+// we bankrupt the current CI first". The change that carries this row deletes four of the five lanes
+// the required context read -- `floor`, `generated`, `rust-unit-tests` and `seed` -- from
+// gunbc.compiler_gate_workflow and leaves the emit-and-build steps as the one required job,
+// `witnesses` (the same ruling collapsed `emit-build` and the aggregate that read it into that job,
+// and requires it to emit and build both products fresh on every run).
+//
+// WHY THE LANES ARE DELETED AND NOT GIVEN HEADROOM. The floor already ran at its slot's throttle
+// line (gunbc.recurring_failure_mode required_floor_runs_at_its_memory_ceiling carries that receipt),
+// and every repair on offer -- a larger slot, an allocator setting, a narrower subject -- spends work
+// on the interpreter the ruling retires. The ruling withdraws v1 as a validation authority; it does
+// not ask for a cheaper v1 gate.
+//
+// THIS IS A DROP AND NOT A CLEAN-UP, WHICH IS WHY IT IS ONE ROW WITH A WIDE POPULATION. Nothing the
+// four lanes held is held by anything else today. The surviving job establishes that the seed emits
+// two v2 closures and that the emitted crates build and start, and a green required context says
+// that and nothing more.
+//
+// WHAT THIS ROW DOES NOT DO. It does not amend the rows that already described losses on these lanes
+// (required_gate_bankruptcy, witness_floor_off_the_required_gate,
+// required_lanes_do_not_resolve_product_layer_modules, v1_integration_tests_deleted_from_the_unit_lane
+// and their neighbours). Their triggers name capabilities, and a native lane can still fire them. The
+// one row this change does supersede is rust_unit_tests_off_pull_requests, whose own text says the
+// unit lane still blocks at the merge queue; it no longer runs anywhere.
+
+data v1_required_lanes_withdrawn_population: List<String> = [
+  "every claim the `floor` lane folded on a pull request or a merge_group: the prepared subject of `v2.workflow.required_floor` `required_gate_prefixes` with its seeds, plus the changed-witness and touched-entry selection. `claim_executor --required-ci --required-lane witnesses` is run by no job",
+  "the stage0 mirrors equal one emission by the seed built from them, and the registry-rostered generated artifacts (`gunbc.generated_artifact_registry` `committed_generated_artifacts`) equal one emission of their authorities: `claim_executor --required-ci --required-lane build` is run by no job. That population includes `.github/workflows/witnesses.yml` and `DESIGN.md`, so the gate's own workflow file is compared with `gunbc.compiler_gate_workflow` by nothing; the heal publisher workflow that published repair candidates was deleted with the lanes (nothing sealed one), and its WIF pool (`gunbc.auth.heal_publisher_federation`) stands dead until retired by hand -- an external-estate obligation, not a drop",
+  "the lint: `cargo clippy --all-targets -- -D warnings` (`gunbc.repo_self_build` `repo_self_clippy_command`), the only command that compiles the integration-test and example targets",
+  "the v1 unit tests: `cargo test --release -p v1-compiler --lib` (`gunbc.repo_self_build` `repo_self_test_command`), which ran on merge_group and workflow_dispatch",
+  "module resolution: every module the source-root ingestion admits under dag/ and src/v2/ that is outside the import closures of `gunbc.instrument_targets` `self_host_entry` and `v2_native_cli_entry` is handed to a compiler by no required step, so it can stop resolving on main with the required context green. Enumerated BY IDENTITY, not by count, by `gunbc test //gunbc/instruments:required-lane-resolution-census` (`gunbc.required_lane_resolution_census_live`), which from this change does not hold by design",
+  "the consumers of those lanes' products: no merge_group run uploads a compiler pair candidate, so `gunbc.fleet_desired_admission_workflow` builds the pair itself; and `gunbc.fleet_revision_acceptance` admits a revision on a required-CI success that carries the `witnesses` job's emit-and-build verdict alone, under the contract epoch `gunbc.required_ci_contract_epoch` moved to with this change",
+  "NOT ENUMERATED HERE, and named so the gap is not read as empty: every `gunbc.recurring_failure_mode` row and every standing `gunbc.rung_drop` row whose stated current rung is held by a step of the four lanes. Those rows are not amended by this change, and each now sits no higher than this row's temporary rung",
+]
+
+data v1_required_lanes_withdrawn: RungDrop = RungDrop {
+  identity: "v1_required_lanes_withdrawn" as NonEmptyStr,
+  subject: "The four v1-judged required lanes (`floor`, `generated`, `rust-unit-tests`, `seed`) as a merge gate",
+  declared: "2026-10-09",
+  standing: Standing,
+  declaration: TypedDeclaration {
+    previous: MechanicallyPreventable,
+    temporary: Mitigatable,
+    reason: ReplacementStaged {
+      replacement: "a binary built from an emission of v2 judging this population on the required path, admitted to the gate as rows of `gunbc.emitted_subject_build_gate` `emitted_subject_build_rows`. No such row covers any member of this population at declaration"
+    },
+    population: v1_required_lanes_withdrawn_population,
+    restoration_trigger: "THE CAPABILITY: on every landing revision, a binary built from an emission of v2 -- the seed's emission today, v2's own after the generation transition -- judges this population on the required path with a discriminating red. Member by member: (1) every claim the floor folded is executed by such a binary, or its subject has been deleted; (2) every module the source-root ingestion admits is resolved, observed as `gunbc test //gunbc/instruments:required-lane-resolution-census` holding against the workflow as emitted; (3) every committed generated artifact, `.github/workflows/witnesses.yml` included, is compared with one emission of its authority; (4) for the three members whose subject is v1's own Rust -- the stage0 mirrors, the lint and the v1 unit tests -- a change to the seed's sources cannot land with the required context green unless a required step judged it, or the seed no longer exists. WHAT THAT MUST BE SUFFICIENT FOR: no member of this population can regress with the required context green. WHAT DOES NOT RETIRE THIS ROW, stated because each is the likely mistake: returning any of the four lanes, or any step that hands the corpus to the v1 interpreter, because the ruling withdraws that authority; a native row that judges part of the population, which narrows this row member by member and retires nothing; a manual or dispatched run off the required path; and a count of claims or modules standing where the identity join belongs. The TEMPORARY rung is Mitigatable only while the seed's own runners for these members exist at head, so a change that deletes one of them owes its own declaration."
+  }
+}
diff --git a/dag/gunbc/rung_drop_amendment/roster.dag b/dag/gunbc/rung_drop_amendment/roster.dag
index 5cf58025dfa..d25f0a29757 100644
--- a/dag/gunbc/rung_drop_amendment/roster.dag
+++ b/dag/gunbc/rung_drop_amendment/roster.dag
@@ -14,6 +14,7 @@ import gunbc.rung_drop_amendment.v2_test_family_reds_measured_outside_the_gate {
 import gunbc.rung_drop_amendment.value_depth_runtime_tests_named_in_the_population { value_depth_runtime_tests_named_in_the_population }
 import gunbc.rung_drop_amendment.variant_field_native_run_residuals { variant_field_native_run_residuals }
 import gunbc.rung_drop_amendment.instrument_sandbox_reference_left_with_its_witness { instrument_sandbox_reference_left_with_its_witness }
+import gunbc.rung_drop_amendment.v2_native_route_trigger_rebound_to_the_witnesses_job { v2_native_route_trigger_rebound_to_the_witnesses_job }
 
 data rung_drop_amendment_roster: List<RungDropAmendment> = [
   namespace_wave_admission_carrier_redesign,
@@ -24,6 +25,7 @@ data rung_drop_amendment_roster: List<RungDropAmendment> = [
   value_depth_runtime_tests_named_in_the_population,
   variant_field_native_run_residuals,
   instrument_sandbox_reference_left_with_its_witness,
+  v2_native_route_trigger_rebound_to_the_witnesses_job,
 ]
 
 // THE JOIN THE PROJECTION FOLDS, so a drop's amendments are selected in one place rather than at
diff --git a/dag/gunbc/rung_drop_amendment/v2_native_route_trigger_rebound_to_the_witnesses_job.dag b/dag/gunbc/rung_drop_amendment/v2_native_route_trigger_rebound_to_the_witnesses_job.dag
new file mode 100644
index 00000000000..65078d882ee
--- /dev/null
+++ b/dag/gunbc/rung_drop_amendment/v2_native_route_trigger_rebound_to_the_witnesses_job.dag
@@ -0,0 +1,22 @@
+module gunbc.rung_drop_amendment.v2_native_route_trigger_rebound_to_the_witnesses_job
+
+import std.types { NonEmptyStr }
+import gunbc.rung_drop_amendment { RungDropAmendment }
+
+// THE TRIGGER NAMED A LANE AND A ROSTER THAT NO LONGER EXIST. gunbc.rung_drop
+// v2_native_route_off_the_merge_path's restoration trigger is stated over "the `emit-build` LANE
+// (gunbc.compiler_gate_workflow compiler_gate_emit_build_job_id) AS A REQUIRED LANE -- its
+// compiler_gate_lane_rows row LaneBlocks". The operator ruling of 2026-10-09 collapsed that lane and
+// the aggregate that read it into ONE required job named `witnesses` (gunbc.compiler_gate_workflow
+// compiler_gate_required_job_id), so there is no lane row and no aggregate to name. The capability
+// the trigger names is unchanged; only the carrier moved, and this row says where.
+
+data v2_native_route_trigger_rebound_to_the_witnesses_job: RungDropAmendment = RungDropAmendment {
+  drop_identity: "v2_native_route_off_the_merge_path" as NonEmptyStr,
+
+  amended: "2026-10-09",
+
+  later_event: "the v1 withdrawal (gunbc.rung_drop v1_required_lanes_withdrawn) deleted the floor, generated, rust-unit-tests and seed lanes, and the same operator ruling collapsed `emit-build` and the `witnesses` aggregate into ONE required job named `witnesses` (gunbc.compiler_gate_workflow compiler_gate_required_job_id) that emits and builds both retained products fresh on every run. compiler_gate_emit_build_job_id, compiler_gate_lane_rows and the LaneBlocks standing the trigger cites were deleted with the aggregate" as NonEmptyStr,
+
+  bearing: "read the trigger's 'the `emit-build` LANE ... AS A REQUIRED LANE -- its compiler_gate_lane_rows row LaneBlocks and the job on the fleet runner' as 'the required `witnesses` job of gunbc.compiler_gate_workflow, on the fleet runner'. Everything else the trigger requires is unchanged: the first green merge_group run of that job which ALSO executes //gunbc/instruments:v2-native-frontier over the derived v2.test.* universe and publishes its proposal with tested_tree = the merge_group sha; a green run of the job with only the two emit-and-build subjects is still NOT sufficient. The operator's same-day rule that the native obligation is a SEPARATE population executed by one built SourceRootEvalDriver, with a monotone green set and exactly one observed frontier, is the shape that run takes; it does not retire this row either until it is observed on a landing" as NonEmptyStr,
+}
diff --git a/dag/gunbc/rung_drop_amendment/v2_test_family_reds_measured_outside_the_gate.dag b/dag/gunbc/rung_drop_amendment/v2_test_family_reds_measured_outside_the_gate.dag
index fdf3242247f..22f0254f72a 100644
--- a/dag/gunbc/rung_drop_amendment/v2_test_family_reds_measured_outside_the_gate.dag
+++ b/dag/gunbc/rung_drop_amendment/v2_test_family_reds_measured_outside_the_gate.dag
@@ -13,5 +13,5 @@ data v2_test_family_reds_measured_outside_the_gate: RungDropAmendment = RungDrop
 
   later_event: "the srv1 probe of the withdrawn v2.test. family (neat-boar-16, scratch commit eff2d73b14 = main c95f906 plus the family, artifacts on branch artifact/v2-gate-probe) measured what this row's population holds for that family: 841 v2.test.* modules declaring 5,030 test fns at c29acd041e1 have no required route; with the family restored, 4,265 were planned, 4,192 passed, 17 reached no verdict (route gaps already rostered by v2.workflow.floor_route_gap), and 44 were red on main with no lane observing them. Preparation dominated, about 3,569 modules resolved and 3,096 s wall against about 101 s of claim evaluation, the shape of this row's 2026-09-19 nominal-roster cut, so the family stays out until the trigger below. One module, v2.test.claim.cargo_build_run_argv_witness, did not typecheck on main and refused the whole floor in strict preparation when the family was restored; gunbc#12860 repaired it" as NonEmptyStr,
 
-  bearing: "of the 44 measured red identities, those still red are named here with their owners, and each leaves this amendment's list when its fix lands, so restoring the family does not inherit them as silent reds. Owner deep-ferret-305 (floor lane), fixed by work item adhoc-e6c8990b-ccf: v2.test.emit.rust_variant_construct_emit.rust_variant_construct_emit_holds_accepts (returned false); v2.test.emit.rust_variant_construct_emit.rust_variant_construct_emit_wrong_value_discriminates (returned false); v2.test.name_resolve.test_code_reference_wall.supplied_root_is_what_normalize_emits_holds (returned false). Owner calm-fox-43 (grammar lane), measured red in a SEPARATE measurement from the srv1 probe: gunbc run --claim-run on main eb60ee176d0 on 2026-10-01 (remote 48GB runner), identical on main's grammar and on gunbc#12920, so not caused by that change; cause not yet derived: v2.test.execution.emit_ingest_grammar_relation_round_trip.same_grammar_parse_ingest_bridge_holds (returned false); v2.test.execution.dag_add_emit_round_trip.dag_add_domain_coerce_accepts_holds (returned false); v2.test.execution.dag_add_emit_round_trip.dag_add_domain_translate_accepts_holds (returned false). None is an expected-red row: that roster asserts the identity executes, and these do not while the family is outside the gate" as NonEmptyStr,
+  bearing: "of the 44 measured red identities, those still red are named here with their owners, and each leaves this amendment's list when its fix lands, so restoring the family does not inherit them as silent reds. Owner deep-ferret-305 (floor lane), fixed by work item adhoc-e6c8990b-ccf: v2.test.name_resolve.test_code_reference_wall.supplied_root_is_what_normalize_emits_holds (returned false). The two rust_variant_construct_emit identities that work item named left this list when proud-wren-900 grounded unit-variant True on the binding-ref literal ladder (dag_binding_type_variant_true stays a coproduct arm, never a bool keyword), stopped treating BindingRef match as the int-bool octet channel, and retargeted complement/meet/join goldens and emit_host allocators onto dag_token_kw_true/false; emit_host_variant_construct_equals_eval left when its eval stub read ConstructTagEdge instead of a named Holds child the construct node does not carry. Owner calm-fox-43 (grammar lane), measured red in a SEPARATE measurement from the srv1 probe: gunbc run --claim-run on main eb60ee176d0 on 2026-10-01 (remote 48GB runner), identical on main's grammar and on gunbc#12920, so not caused by that change; cause not yet derived: v2.test.execution.emit_ingest_grammar_relation_round_trip.same_grammar_parse_ingest_bridge_holds (returned false); v2.test.execution.dag_add_emit_round_trip.dag_add_domain_coerce_accepts_holds (returned false); v2.test.execution.dag_add_emit_round_trip.dag_add_domain_translate_accepts_holds (returned false). None is an expected-red row: that roster asserts the identity executes, and these do not while the family is outside the gate" as NonEmptyStr,
 }
diff --git a/dag/gunbc/runner/jit_registration_subject.dag b/dag/gunbc/runner/jit_registration_subject.dag
new file mode 100644
index 00000000000..380a0aa62ca
--- /dev/null
+++ b/dag/gunbc/runner/jit_registration_subject.dag
@@ -0,0 +1,90 @@
+module gunbc.runner.jit_registration_subject
+
+import std.types { String, NonEmptyStr, Bool, List }
+import extdeps.github.actions { self_hosted_provenance_label }
+import extdeps.github.actions_jit_runner { JitRunnerName }
+import gunbc.runner_group_restriction_observation { microvm_shakedown_selected_workflow }
+import gunbc.runner_microvm_attempt {
+  MicroVmAttempt, MicroVmCellBinding, VmBoundToOwnedCell, VmUnboundCellNotOwned,
+  runner_microvm_attempt_unit_name,
+}
+import gunbc.runner.runner_host_unit_slot {
+  HostUnitSlot, HostUnitSlotStanding, HostUnitSlotBound, HostUnitSlotRefused, HostUnitSlotRefusal,
+}
+
+// WHAT A JIT REGISTRATION IS MINTED FOR: a name, the one workflow the registration exists to run,
+// and the labels it answers to. That is all gunbc.runner_jit_mint reads. It used to read them out
+// of a sum over realizations (microVM attempt | host unit), restating the realization in one match
+// per field, and every new realization widened the sum, the mint's refusals and the dispatch's
+// refusals together. The realization is not the mint's fact: how a slot comes to exist, where its
+// runner process lives and how the credential reaches it belong to the producer that proved it.
+//
+// THE ORDERING STAYS UNWRITABLE. The record is sole_constructor and its only constructors are the
+// producers below, each of which builds it only on the arm that already proved the slot exists --
+// an owned cell, a bound managed host. So a mint still cannot be planned for a slot whose existence
+// was not proven first, because no other value can reach it.
+type JitRegistrationSubject sole_constructor {
+  name: JitRunnerName
+  workflow: NonEmptyStr
+  labels: List<String>
+}
+
+// A PRODUCER THAT COULD NOT PROVE ITS SLOT refuses in its own vocabulary, carried unchanged.
+type JitRegistrationSubjectRefusal
+  = SubjectCellNotOwned { cause: String }
+  | SubjectHostUnitSlotRefused { refusal: HostUnitSlotRefusal }
+
+type JitRegistrationSubjectStanding
+  = JitRegistrationSubjectProven { subject: JitRegistrationSubject }
+  | JitRegistrationSubjectRefused { refusal: JitRegistrationSubjectRefusal }
+
+// THE RUNNER NAME IS THE UNIT NAME, not a fresh identifier minted beside it. A second naming scheme
+// for one attempt is a nickname (DESIGN §3), and it is the expensive kind: an orphaned GitHub runner
+// registration can only be reconciled against a host by name, so a name that does not appear on the
+// host makes the orphan unattributable.
+fn jit_runner_name_for(attempt: MicroVmAttempt) -> JitRunnerName {
+  JitRunnerName { value: runner_microvm_attempt_unit_name(attempt: attempt) }
+}
+
+// THE LABELS ARE THE ATTEMPT'S OWN, AND NO CALLER CAN HAND IN ANY OTHERS. A microVM attempt answers
+// to exactly two labels: the provenance label every self-hosted runner carries, and its OWN
+// registration name. It does NOT answer to the host's registration set
+// (gunbc.runner_registration_labels), because that set is what production jobs target, and a guest
+// registered under it could take a production converge job into a trusted-shakedown VM. A job
+// reaches this runner only by naming the attempt in its runs-on -- the binding
+// gunbc.runner_bound_attempt_receipt relies on for the mtcollins canary. Whether a JIT registration
+// also receives GitHub's OS and architecture defaults is not modeled; that arm is closed by the
+// runner group, not the label (gunbc.runner_jit_mint microvm_jit_runner_group_restriction_frontier).
+fn microvm_attempt_registration_labels(attempt: MicroVmAttempt) -> List<String> {
+  [self_hosted_provenance_label, jit_runner_name_for(attempt: attempt).value as String]
+}
+
+fn microvm_registration_subject_of(attempt: MicroVmAttempt) -> JitRegistrationSubject {
+  JitRegistrationSubject {
+    name: jit_runner_name_for(attempt: attempt),
+    workflow: microvm_shakedown_selected_workflow(),
+    labels: microvm_attempt_registration_labels(attempt: attempt),
+  }
+}
+
+fn microvm_registration_subject(binding: MicroVmCellBinding) -> JitRegistrationSubjectStanding {
+  match binding {
+    VmUnboundCellNotOwned { cause: c } => JitRegistrationSubjectRefused { refusal: SubjectCellNotOwned { cause: c } }
+    VmBoundToOwnedCell { attempt: a, rootfs_path: _, vm_config_path: _, unit_name: _, slice_property: _ } =>
+      JitRegistrationSubjectProven { subject: microvm_registration_subject_of(attempt: a) }
+  }
+}
+
+// A BOUND HOST-UNIT SLOT'S SUBJECT. The slot is itself the proof the producer owed (its record is
+// sole_constructor in gunbc.runner.runner_host_unit_slot), so the subject follows from it with no
+// refusal arm; a launch that already holds the slot derives the subject it expects from here.
+fn host_unit_slot_subject(slot: HostUnitSlot) -> JitRegistrationSubject {
+  JitRegistrationSubject { name: JitRunnerName { value: slot.unit }, workflow: slot.workflow, labels: slot.labels }
+}
+
+fn host_unit_registration_subject(standing: HostUnitSlotStanding) -> JitRegistrationSubjectStanding {
+  match standing {
+    HostUnitSlotRefused { refusal: r } => JitRegistrationSubjectRefused { refusal: SubjectHostUnitSlotRefused { refusal: r } }
+    HostUnitSlotBound { slot: h } => JitRegistrationSubjectProven { subject: host_unit_slot_subject(slot: h) }
+  }
+}
diff --git a/dag/gunbc/runner/provider_guest_incarnation.dag b/dag/gunbc/runner/provider_guest_incarnation.dag
new file mode 100644
index 00000000000..97408e2eaa8
--- /dev/null
+++ b/dag/gunbc/runner/provider_guest_incarnation.dag
@@ -0,0 +1,172 @@
+module gunbc.runner.provider_guest_incarnation
+
+import std.types { Bool, List, NonEmptyStr, String }
+import std.decl_ref { DeclarationRef, decl_ref }
+import product.host_identity { HostIdentity }
+import product.fabric.isolation {
+  IsolationGuarantee, IsolationProfile, DedicatedKernel, FreshWritableRoot, PrivateProcessNamespace,
+  PrivateUserNamespace, PrivateNetworkNamespace, AttemptScopedSecrets, DefaultDenyEgress,
+  unsatisfied_isolation_guarantees,
+}
+import gunbc.provider_acquisition { ProviderResourceAcquisition }
+import gunbc.fleet_host_identity { operator_host_183527, operator_host_3dde7f }
+import gunbc.host_control_route { ControlledHost, ProviderApiControlRoute, BmcControlRoute }
+import gunbc.provider_guest_adoption { ProviderGuestAdoption, GuestAdopted, GuestAdoptionRefused, GuestAdoptionRefusal }
+import gunbc.runner.runner_isolation_admission {
+  SandboxOffer, DedicatedKernelSandboxProvider, RunnerWorkProvenance, runner_work_isolation_requirement,
+  offer_profile,
+}
+
+// A PROVIDER GUEST AS ONE JOB'S SANDBOX. A rented guest cannot run the fleet's microVMs (its provider
+// forbids nested virtualization), so the guest itself is the boundary: the provider's hypervisor
+// sits beneath the job's kernel, and a rebuild from the provider's image before every job is what
+// makes the guest fresh. The guest is never released between jobs -- release is an acquisition
+// decision (gunbc.provider_acquisition), and the provider may not refill it.
+//
+// THE OFFER IS DERIVED PER INCARNATION, NEVER AUTHORED PER HOST. A guest that was not rebuilt for this
+// attempt has earned nothing, whatever its class could do: the class is capable of a dedicated
+// kernel, and only an incarnation with its receipts has one (gunbc.runner.runner_isolation_admission
+// distinguishes the two for the same reason).
+
+// THE PROVIDER'S OWN RECORD THAT THE GUEST WAS REBUILT FROM ITS IMAGE: the provider's action id for a
+// rebuild of exactly this acquired resource, to exactly the requested image, read back as finished
+// successfully, for one named attempt. sole_constructor, AND NOTHING MINTS ONE YET: its sole producer
+// is the Hetzner Cloud rebuild exchange (POST /v1/servers/{id}/actions/rebuild, then GET
+// /v1/actions/{id} until status success, joined to the resource and image asked for), which lands
+// with the controller-driven reset loop. Until it does, provider_guest_incarnation below has no
+// receipt to be handed, so NO INCARNATION IS ESTABLISHED and no provider guest offers a sandbox --
+// test.probe.provider_rebuild_receipt_forged_probe is the executed red that a receipt cannot be
+// written instead.
+//
+// THE REBUILD IS FOR ONE ATTEMPT, NAMED BEFORE IT IS ISSUED. The controller rebuilds a guest because
+// an attempt is about to run on it, and the receipt carries that attempt; the slot and registration
+// derive their names from it (gunbc.runner.runner_host_unit_slot provider_guest_slot_for), so one
+// rebuild yields one registration name. Running a second attempt on the same incarnation would need
+// a second rebuild receipt, which only the provider can produce.
+type ProviderRebuildReceipt sole_constructor {
+  acquisition: ProviderResourceAcquisition
+  attempt: NonEmptyStr
+  image: NonEmptyStr
+  action_id: NonEmptyStr
+  finished_at: NonEmptyStr
+}
+
+// ONE INCARNATION: the controlled guest, the rebuild that made it fresh, and the adoption observed
+// over SSH after that rebuild. sole_constructor, minted only by provider_guest_incarnation below,
+// which joins the three on the same resource -- so an adoption of one server cannot certify another
+// server's rebuild.
+type ProviderGuestIncarnation sole_constructor {
+  controlled: ControlledHost
+  rebuild: ProviderRebuildReceipt
+  adoption: ProviderGuestAdoption
+}
+
+type IncarnationRefusal
+  = IncarnationHostNotProviderControlled { host: HostIdentity }
+  | IncarnationRebuildForAnotherResource { controlled: NonEmptyStr, rebuilt: NonEmptyStr }
+  | IncarnationGuestNotAdopted { cause: GuestAdoptionRefusal }
+  | IncarnationAdoptionForAnotherResource { rebuilt: NonEmptyStr, adopted: NonEmptyStr }
+
+type IncarnationStanding
+  = IncarnationEstablished { incarnation: ProviderGuestIncarnation }
+  | IncarnationRefused { refusal: IncarnationRefusal }
+
+fn provider_guest_incarnation(
+  controlled: ControlledHost,
+  rebuild: ProviderRebuildReceipt,
+  adoption: ProviderGuestAdoption,
+) -> IncarnationStanding {
+  match controlled.route {
+    BmcControlRoute { binding: _ } => IncarnationRefused { refusal: IncarnationHostNotProviderControlled { host: controlled.host } }
+    ProviderApiControlRoute { route: _, acquisition: held, observed: _ } =>
+      if (held.resource_id as String) != (rebuild.acquisition.resource_id as String) {
+        IncarnationRefused { refusal: IncarnationRebuildForAnotherResource { controlled: held.resource_id, rebuilt: rebuild.acquisition.resource_id } }
+      } else { match adoption {
+        GuestAdoptionRefused { host: _, cause: c } => IncarnationRefused { refusal: IncarnationGuestNotAdopted { cause: c } }
+        GuestAdopted { host: _, resource_id: adopted, observation: _, execution: _ } =>
+          if (adopted as String) != (rebuild.acquisition.resource_id as String) {
+            IncarnationRefused { refusal: IncarnationAdoptionForAnotherResource { rebuilt: rebuild.acquisition.resource_id, adopted: adopted } }
+          } else {
+            IncarnationEstablished { incarnation: ProviderGuestIncarnation { controlled: controlled, rebuild: rebuild, adoption: adoption } }
+          }
+      } }
+  }
+}
+
+// WHAT AN ESTABLISHED INCARNATION HAS EARNED, each guarantee on its own grounds:
+//   DedicatedKernel   -- the job runs on the guest's kernel, with the provider's hypervisor beneath it
+//                        and the controller's credentials outside it; the adoption is the observation.
+//   FreshWritableRoot -- the provider's finished rebuild of this resource from its image.
+//   PrivateProcessNamespace, PrivateUserNamespace, PrivateNetworkNamespace -- the whole guest, its
+//                        process table, users and network stack, belongs to one attempt between two
+//                        rebuilds; nothing of another attempt or of the fleet's control plane shares
+//                        them. (The microVM path withholds PrivateNetworkNamespace because its VMM
+//                        runs in the HOST's namespace; a provider guest has no such host of ours.)
+// WITHHELD, with reasons in the offer's standing:
+//   AttemptScopedSecrets   -- a persistent guest can keep what an earlier job left (a token, a cache, a
+//                             customer's bytes) until something proves it gone; placing one attempt's
+//                             registration says nothing about that. It is earned by the reset loop's
+//                             revocation and rebuild after each job, not by any fact this PR holds.
+//   DefaultDenyEgress      -- the guest has open internet (gunbc.rung_drop provider_guest_ci_egress_unfiltered).
+fn incarnation_offer(incarnation: ProviderGuestIncarnation) -> SandboxOffer {
+  SandboxOffer {
+    provider_class: DedicatedKernelSandboxProvider,
+    evidenced: [DedicatedKernel, FreshWritableRoot, PrivateProcessNamespace, PrivateUserNamespace, PrivateNetworkNamespace],
+    withheld: [AttemptScopedSecrets, DefaultDenyEgress],
+    standing: join([
+      "provider guest ", incarnation.controlled.host as String,
+      " rebuilt from ", incarnation.rebuild.image as String,
+      " by provider action ", incarnation.rebuild.action_id as String,
+      "; AttemptScopedSecrets awaits the reset loop's revocation, DefaultDenyEgress is not provided",
+    ], "") as NonEmptyStr,
+  }
+}
+
+// ── admission, with the declared excuse ─────────────────────────────────────────────────────────
+
+// A GUARANTEE THE ADMISSION MAY EXCUSE, AND ONLY FOR THE HOSTS ITS DECLARED DROP NAMES. The excuse
+// cites the drop row, so it cannot outlive the drop's declaration silently: removing the row breaks
+// the reference, and the drop's trigger is what retires it.
+type IsolationExcuse {
+  guarantee: IsolationGuarantee
+  hosts: List<HostIdentity>
+  drop: DeclarationRef
+}
+
+data provider_guest_egress_excuse: IsolationExcuse = IsolationExcuse {
+  guarantee: DefaultDenyEgress,
+  hosts: [operator_host_183527, operator_host_3dde7f],
+  drop: decl_ref(module_path: "gunbc.rung_drop.provider_guest_ci_egress_unfiltered", decl_name: "provider_guest_ci_egress_unfiltered"),
+}
+
+data provider_guest_isolation_excuses: List<IsolationExcuse> = [provider_guest_egress_excuse]
+
+fn excuse_covers(excuse: IsolationExcuse, host: HostIdentity, g: IsolationGuarantee) -> Bool {
+  excuse.guarantee == g && (filter(excuse.hosts, h => (h as String) == (host as String)) |> count) > 0
+}
+
+type IncarnationAdmission
+  = IncarnationAdmitted { excused: List<IsolationGuarantee> }
+  | IncarnationAdmissionRefused { missing: List<IsolationGuarantee> }
+
+// THE WORK'S REQUIREMENT AGAINST WHAT AN OFFER ON THIS HOST EARNED. Missing guarantees refuse by
+// name; one is excused only when an excuse names exactly that guarantee AND this host. The excused
+// set is carried on the admission, so a launch records which drop it ran under. The offer is the
+// caller's because it changes over the incarnation's life: before launch it is incarnation_offer,
+// and a launch that placed one attempt's registration adds the guarantee that placement earned.
+fn admit_offer_on_host(host: HostIdentity, offer: SandboxOffer, work: RunnerWorkProvenance, excuses: List<IsolationExcuse>) -> IncarnationAdmission {
+  let missing = unsatisfied_isolation_guarantees(
+    required: runner_work_isolation_requirement(p: work),
+    provided: offer_profile(o: offer),
+  )
+  let unexcused = filter(missing, g => (filter(excuses, e => excuse_covers(excuse: e, host: host, g: g)) |> count) == 0)
+  if (unexcused |> count) == 0 {
+    IncarnationAdmitted { excused: missing }
+  } else {
+    IncarnationAdmissionRefused { missing: unexcused }
+  }
+}
+
+fn admit_incarnation_work(incarnation: ProviderGuestIncarnation, work: RunnerWorkProvenance, excuses: List<IsolationExcuse>) -> IncarnationAdmission {
+  admit_offer_on_host(host: incarnation.controlled.host, offer: incarnation_offer(incarnation: incarnation), work: work, excuses: excuses)
+}
diff --git a/dag/gunbc/runner/provider_guest_launch.dag b/dag/gunbc/runner/provider_guest_launch.dag
new file mode 100644
index 00000000000..11ac87d8a0d
--- /dev/null
+++ b/dag/gunbc/runner/provider_guest_launch.dag
@@ -0,0 +1,104 @@
+module gunbc.runner.provider_guest_launch
+
+import std.types { List, NonEmptyStr, String }
+import product.fabric.isolation {
+  IsolationGuarantee, DedicatedKernel, FreshWritableRoot, PrivateProcessNamespace, PrivateUserNamespace,
+  PrivateNetworkNamespace, AttemptScopedSecrets, DefaultDenyEgress,
+}
+import gunbc.github_effect_perform { JitMintPerformance }
+import gunbc.runner.runner_isolation_admission { SandboxOffer, DedicatedKernelSandboxProvider, RunnerWorkProvenance }
+import gunbc.runner.runner_host_unit_slot {
+  HostUnitSlot, HostUnitSlotRefusal, HostUnitSlotBound, HostUnitSlotRefused, provider_guest_slot_for,
+}
+import gunbc.runner.jit_registration_subject { host_unit_slot_subject }
+import gunbc.runner_attempt_launch {
+  AdmittedJitCredential, JitDeviceRefusal, JitCredentialAdmitted, JitCredentialRefused, admit_jit_credential_for,
+}
+import gunbc.runner.provider_guest_incarnation {
+  ProviderGuestIncarnation, IsolationExcuse, IncarnationAdmitted, IncarnationAdmissionRefused, admit_offer_on_host,
+}
+
+// ONE JOB ON ONE REBUILT PROVIDER GUEST: the incarnation, the slot on it, the one registration placed
+// into it, and what the job was admitted under. This is the provider guest's counterpart of
+// gunbc.runner_attempt_launch for a microVM, and it shares that module's credential checker
+// (admit_jit_credential_for) rather than restating it: the realizations differ in where the runner
+// process lives, not in what makes a credential this attempt's.
+//
+// CONSUMER: the controller-driven reset loop (rebuild, scan, adopt, launch, run one job, rebuild),
+// which places the admitted credential into the slot's unit over the fleet's SSH route. It lands with
+// the Hetzner Cloud rebuild exchange that produces gunbc.runner.provider_guest_incarnation
+// ProviderRebuildReceipt; until then the plan below is exercised by its witness only.
+
+// PLACING ONE REGISTRATION DOES NOT EARN AttemptScopedSecrets HERE. On a microVM the guarantee is a
+// property of the credential's carrier, a drive that exists for one VM (gunbc.runner_microvm
+// JitConfigOnReadOnlyDrive). A provider guest persists between jobs, so whatever an earlier job left
+// on it stays until something removes it, and the registration placed for this attempt is evidence
+// only about that registration. The guarantee is the reset loop's to establish -- revocation of the
+// previous attempt's credentials and a rebuild proven by its receipt -- so the offer below withholds
+// it, and general CI, which requires it, is refused here until that loop lands.
+type ProviderGuestLaunch sole_constructor {
+  incarnation: ProviderGuestIncarnation
+  slot: HostUnitSlot
+  credential: AdmittedJitCredential
+  offer: SandboxOffer
+  excused: List<IsolationGuarantee>
+}
+
+type ProviderGuestLaunchRefusal
+  = LaunchSlotRefused { refusal: HostUnitSlotRefusal }
+  | LaunchCredentialRefused { refusal: JitDeviceRefusal }
+  | LaunchIsolationRefused { offer: SandboxOffer, missing: List<IsolationGuarantee> }
+
+type ProviderGuestLaunchPlan
+  = ProviderGuestLaunchAdmitted { launch: ProviderGuestLaunch }
+  | ProviderGuestLaunchRefused { refusal: ProviderGuestLaunchRefusal }
+
+// THE OFFER ONCE ONE ATTEMPT'S REGISTRATION IS PLACED: the incarnation's five, and nothing more.
+// AttemptScopedSecrets and egress stay withheld; only egress has a declared drop that can excuse it,
+// and admission says so by carrying the excused set.
+data provider_guest_launch_evidenced: List<IsolationGuarantee> = [DedicatedKernel, FreshWritableRoot, PrivateProcessNamespace, PrivateUserNamespace, PrivateNetworkNamespace]
+
+data provider_guest_launch_withheld: List<IsolationGuarantee> = [AttemptScopedSecrets, DefaultDenyEgress]
+
+fn attempt_placed_offer(incarnation: ProviderGuestIncarnation, credential: AdmittedJitCredential) -> SandboxOffer {
+  SandboxOffer {
+    provider_class: DedicatedKernelSandboxProvider,
+    evidenced: provider_guest_launch_evidenced,
+    withheld: provider_guest_launch_withheld,
+    standing: join([
+      "provider guest ", incarnation.controlled.host as String,
+      " rebuilt from ", incarnation.rebuild.image as String,
+      " by provider action ", incarnation.rebuild.action_id as String,
+      " for attempt ", incarnation.rebuild.attempt as String,
+      "; placed runner registration ", credential.runner_name.value as String,
+      "; AttemptScopedSecrets awaits the reset loop's revocation, DefaultDenyEgress is not provided",
+    ], "") as NonEmptyStr,
+  }
+}
+
+// THE PLAN, IN THE ORDER THE FACTS DEPEND ON EACH OTHER: the slot exists on this incarnation, the
+// delivered credential was minted for exactly that slot's subject, and the offer that placement
+// earns admits the work (excusing only what a declared drop names for this host).
+fn plan_provider_guest_launch(
+  incarnation: ProviderGuestIncarnation,
+  workflow: NonEmptyStr,
+  mint: JitMintPerformance,
+  work: RunnerWorkProvenance,
+  excuses: List<IsolationExcuse>,
+) -> ProviderGuestLaunchPlan {
+  match provider_guest_slot_for(incarnation: incarnation, workflow: workflow) {
+    HostUnitSlotRefused { refusal: r } => ProviderGuestLaunchRefused { refusal: LaunchSlotRefused { refusal: r } }
+    HostUnitSlotBound { slot: slot } => match admit_jit_credential_for(expected: host_unit_slot_subject(slot: slot), mint: mint) {
+      JitCredentialRefused { refusal: r } => ProviderGuestLaunchRefused { refusal: LaunchCredentialRefused { refusal: r } }
+      JitCredentialAdmitted { admitted: credential } => {
+        let offer = attempt_placed_offer(incarnation: incarnation, credential: credential)
+        match admit_offer_on_host(host: incarnation.controlled.host, offer: offer, work: work, excuses: excuses) {
+          IncarnationAdmissionRefused { missing: m } => ProviderGuestLaunchRefused { refusal: LaunchIsolationRefused { offer: offer, missing: m } }
+          IncarnationAdmitted { excused: e } => ProviderGuestLaunchAdmitted {
+            launch: ProviderGuestLaunch { incarnation: incarnation, slot: slot, credential: credential, offer: offer, excused: e },
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/dag/gunbc/runner/runner_attempt_launch.dag b/dag/gunbc/runner/runner_attempt_launch.dag
index 653d94c7810..12a6f36ceb4 100644
--- a/dag/gunbc/runner/runner_attempt_launch.dag
+++ b/dag/gunbc/runner/runner_attempt_launch.dag
@@ -40,9 +40,9 @@ import gunbc.guarantee_rung {
 import extdeps.github.actions_jit_runner { EncodedJitConfig, JitRunnerName }
 import gunbc.github_effect_perform { JitMintPerformance, JitMintReceived }
 import gunbc.runner.runner_jit_perform {
-  JitCredentialDelivery, JitCredentialBoundToAttempt,
+  JitCredentialDelivery, JitCredentialBoundToAttempt, bound_jit_subject,
 }
-import gunbc.runner_jit_mint { jit_runner_name_for, JitSlot, MicroVmJitSlot }
+import gunbc.runner.jit_registration_subject { JitRegistrationSubject, microvm_registration_subject_of }
 import gunbc.runner.runner_jit_admission {
   SignatureAxis, ExpiryAxis, jit_admission_axis_standing, AxisRequired, HostMintAdmission,
 }
@@ -160,7 +160,7 @@ type AttemptGround
 type JitDeviceRefusal
   = JitMintNotReceived { performance: JitMintPerformance }
   | JitCredentialNotDelivered { delivery: JitCredentialDelivery }
-  | JitCredentialBoundToDifferentAttempt { bound_to: JitSlot }
+  | JitCredentialBoundToDifferentAttempt { bound_to: JitRegistrationSubject }
   | JitCredentialBelowFloor { bytes: ByteSize }
   | JitCredentialAboveCeiling { bytes: ByteSize }
   | JitMintAdmissionAxisNotRequired
@@ -207,14 +207,21 @@ fn host_mint_admission_is_required() -> Bool {
   }
 }
 
-fn admit_jit_credential(attempt: MicroVmAttempt, mint: JitMintPerformance) -> JitCredentialAdmission {
+// ONE CHECKER FOR EVERY REALIZATION OF A REGISTRATION SUBJECT. The microVM attempt and the provider
+// guest's host unit each derive the subject they expect from their own proven slot and hand it here;
+// the delivered credential is admitted only when it was minted for exactly that subject. The runner
+// name travels from the subject, so no realization restates how a runner is named.
+fn admit_jit_credential_for(expected: JitRegistrationSubject, mint: JitMintPerformance) -> JitCredentialAdmission {
   match mint {
     JitMintReceived { delivery: delivery } =>
       match delivery {
-        JitCredentialBoundToAttempt { slot: bound, credential: c, runner_id: id } =>
+        JitCredentialBoundToAttempt { bound: b } => {
+          let bound = bound_jit_subject(bound: b)
+          let c = b.credential
+          let id = b.runner_id
           if !host_mint_admission_is_required() {
             JitCredentialRefused { refusal: JitMintAdmissionAxisNotRequired }
-          } else if bound != MicroVmJitSlot { attempt: attempt } {
+          } else if !(bound == expected) {
             JitCredentialRefused { refusal: JitCredentialBoundToDifferentAttempt { bound_to: bound } }
           } else if !measure_le(a: jit_config_byte_floor, b: jit_credential_bytes(credential: c)) {
             JitCredentialRefused { refusal: JitCredentialBelowFloor { bytes: jit_credential_bytes(credential: c) } }
@@ -222,19 +229,20 @@ fn admit_jit_credential(attempt: MicroVmAttempt, mint: JitMintPerformance) -> Ji
             JitCredentialRefused { refusal: JitCredentialAboveCeiling { bytes: jit_credential_bytes(credential: c) } }
           } else {
             JitCredentialAdmitted {
-              admitted: AdmittedJitCredential {
-                credential: c,
-                runner_name: jit_runner_name_for(attempt: attempt),
-                registration_id: id,
-              },
+              admitted: AdmittedJitCredential { credential: c, runner_name: expected.name, registration_id: id },
             }
           }
+        }
         other => JitCredentialRefused { refusal: JitCredentialNotDelivered { delivery: other } }
       }
     other => JitCredentialRefused { refusal: JitMintNotReceived { performance: other } }
   }
 }
 
+fn admit_jit_credential(attempt: MicroVmAttempt, mint: JitMintPerformance) -> JitCredentialAdmission {
+  admit_jit_credential_for(expected: microvm_registration_subject_of(attempt: attempt), mint: mint)
+}
+
 // THE DEVICE, AS TWO HOST STEPS WHOSE ORDER IS THE SECURITY PROPERTY. (1) install(1) creates an
 // EMPTY file already owned by the attempt's unprivileged uid and mode 0400, inside the attempt's
 // jail; (2) the drive bytes are written into it -- through the filesystem, never an argv.
diff --git a/dag/gunbc/runner/runner_host_deploy.dag b/dag/gunbc/runner/runner_host_deploy.dag
index e5fff50a3d4..6c14125f809 100644
--- a/dag/gunbc/runner/runner_host_deploy.dag
+++ b/dag/gunbc/runner/runner_host_deploy.dag
@@ -29,6 +29,7 @@ import gunbc.runner_slot_allocation {
   runner_width_unresolved_cause_text,
 }
 import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
+import gunbc.fleet_enrollment { CiRunnerParticipation, hosts_enrolled_for }
 import std.algebra { Cons, Empty }
 
 // VOID CITATION RETIRED (operator ruling 2026-08-06): ctrl:scripts/session-dashboard/host/* path
@@ -317,29 +318,19 @@ type RunnerHostDeployResolution
 // is a second account of a fact the declaration already carries).
 
 fn runner_host_deploy_for(host: HostIdentity) -> RunnerHostDeployResolution {
-  if (host as String) == (operator_host_srv1 as String) {
-    admitted_deploy_or_refusal(host: host, spec: srv1_runner_host_spec)
-  } else if (host as String) == (operator_host_srv2 as String) {
-    admitted_deploy_or_refusal(host: host, spec: srv2_runner_host_spec)
-  } else if (host as String) == (operator_host_srv3 as String) {
-    admitted_deploy_or_refusal(host: host, spec: srv3_runner_host_spec)
-  } else if (host as String) == (operator_host_srv4 as String) {
-    admitted_deploy_or_refusal(host: host, spec: srv4_runner_host_spec)
-  } else {
-    RunnerHostDeployUnmodeled { host: host }
+  match runner_host_spec_for(host: host) {
+    RunnerHostSpecFound { spec: s } => admitted_deploy_or_refusal(host: host, spec: s)
+    RunnerHostSpecAbsent { host: h } => RunnerHostDeployUnmodeled { host: h }
   }
 }
 
-// THE FOUR-HOST ROSTER, EVERY ROW THROUGH THE SAME ADMISSION. srv2's refusal is a member of this list
-// rather than an absence from it, so "refused" cannot be read as "not modeled" and a fleet total that
-// walks this roster cannot look complete while one host cannot be sized.
-fn fleet_runner_host_admissions() -> List<RunnerHostDeployAdmission> {
-  [
-    runner_host_deploy_of(host: operator_host_srv1, spec: srv1_runner_host_spec),
-    runner_host_deploy_of(host: operator_host_srv2, spec: srv2_runner_host_spec),
-    runner_host_deploy_of(host: operator_host_srv3, spec: srv3_runner_host_spec),
-    runner_host_deploy_of(host: operator_host_srv4, spec: srv4_runner_host_spec),
-  ]
+// THE ROSTER IS THE ENROLLED CI POPULATION, EVERY HOST THROUGH THE SAME RESOLUTION. It is read off
+// gunbc.fleet_enrollment rather than listed here, so a host enrolled for CI appears with whatever
+// disposition it has: a refused width stays a member rather than an absence, and an enrolled host
+// with no runner spec -- a provider guest whose runner role is not modeled -- appears as Unmodeled,
+// so a fleet total that walks this roster cannot look complete while one host cannot be deployed.
+fn fleet_runner_host_resolutions() -> List<RunnerHostDeployResolution> {
+  map(hosts_enrolled_for(wanted: CiRunnerParticipation), h => runner_host_deploy_for(host: h))
 }
 
 // THE ADMITTED ROW FOR ONE HOST, OPTIONAL BECAUSE ADMISSION IS NOT GUARANTEED. A consumer that wants
@@ -356,17 +347,25 @@ type RunnerHostSpecLookup
   = RunnerHostSpecFound { spec: RunnerHostSpec }
   | RunnerHostSpecAbsent { host: HostIdentity }
 
+// One row per host that has a runner spec, keyed by the host's stable identity. The specs stay
+// per-host physical facts (ssh target, users, app); only the dispatch over them is a lookup now, so
+// adding a host's spec is a row here and never a new arm in every switch that used to repeat it.
+type RunnerHostSpecRow {
+  host: HostIdentity
+  spec: RunnerHostSpec
+}
+
+data runner_host_spec_rows: List<RunnerHostSpecRow> = [
+  RunnerHostSpecRow { host: operator_host_srv1, spec: srv1_runner_host_spec },
+  RunnerHostSpecRow { host: operator_host_srv2, spec: srv2_runner_host_spec },
+  RunnerHostSpecRow { host: operator_host_srv3, spec: srv3_runner_host_spec },
+  RunnerHostSpecRow { host: operator_host_srv4, spec: srv4_runner_host_spec },
+]
+
 fn runner_host_spec_for(host: HostIdentity) -> RunnerHostSpecLookup {
-  if (host as String) == (operator_host_srv1 as String) {
-    RunnerHostSpecFound { spec: srv1_runner_host_spec }
-  } else if (host as String) == (operator_host_srv2 as String) {
-    RunnerHostSpecFound { spec: srv2_runner_host_spec }
-  } else if (host as String) == (operator_host_srv3 as String) {
-    RunnerHostSpecFound { spec: srv3_runner_host_spec }
-  } else if (host as String) == (operator_host_srv4 as String) {
-    RunnerHostSpecFound { spec: srv4_runner_host_spec }
-  } else {
-    RunnerHostSpecAbsent { host: host }
+  match filter(runner_host_spec_rows, r => (r.host as String) == (host as String)).first() {
+    Present { value: r } => RunnerHostSpecFound { spec: r.spec }
+    Absent => RunnerHostSpecAbsent { host: host }
   }
 }
 
@@ -379,20 +378,21 @@ fn admitted_deploy_for(host: HostIdentity) -> RunnerHostDeploy? {
 }
 
 fn admitted_deploy_rows() -> List<RunnerHostDeploy> {
-  fleet_runner_host_admissions() |> flat_map(a => match a {
-    RunnerHostDeployAdmitted { deploy: d } => [d]
-    RunnerHostDeployWidthRefused { spec: _, host: _, cause: _ } => []
+  fleet_runner_host_resolutions() |> flat_map(r => match r {
+    RunnerHostDeployFound { deploy: d } => [d]
+    RunnerHostDeployRefused { host: _, cause: _ } => []
+    RunnerHostDeployUnmodeled { host: _ } => []
   })
 }
 
-// THE ADMITTED LIST CARRIES ONLY OPERATIONAL ROWS, and srv2 is absent from it because it has no such
-// row -- not because it was filtered. Its refusal is carried separately by
-// `fleet_runner_host_deploy_resolutions`, so a consumer that wants the whole fleet gets four
-// dispositions and a consumer that wants deployable hosts gets three positive rows. Neither can
-// silently read the other's population as complete.
+// THE ADMITTED LIST CARRIES ONLY OPERATIONAL ROWS, and a refused or unmodeled host is absent from it
+// because it has no such row -- not because it was filtered. Every disposition is carried separately
+// by `fleet_runner_host_deploy_resolutions`, so a consumer that wants the whole enrolled CI fleet gets
+// one disposition per host and a consumer that wants deployable hosts gets only the positive rows.
+// Neither can silently read the other's population as complete.
 data fleet_runner_host_deploys: List<RunnerHostDeploy> = admitted_deploy_rows()
 
-data fleet_runner_host_deploy_resolutions: List<RunnerHostDeployAdmission> = fleet_runner_host_admissions()
+data fleet_runner_host_deploy_resolutions: List<RunnerHostDeployResolution> = fleet_runner_host_resolutions()
 
 // runner_count names slots via runner_instance_names / runner_index_seq but does NOT reach
 // runner_host_installer_command_argv — install-actions-runner.sh has no slot-count parameter
diff --git a/dag/gunbc/runner/runner_host_grants.dag b/dag/gunbc/runner/runner_host_grants.dag
index d0ac9ebc6c0..a0378ebb790 100644
--- a/dag/gunbc/runner/runner_host_grants.dag
+++ b/dag/gunbc/runner/runner_host_grants.dag
@@ -11,11 +11,16 @@ import gunbc.fleet_converge_state_path { fleet_converge_state_root }
 import gunbc.workspace_allocation_operations { workspace_launch_operations }
 import gunbc.runner_slot_allocation { workspace_execution_slot_identities }
 import gunbc.fleet_bootstrap_principal { ExecutorBootstrapPrincipal, executor_bootstrap_principal }
-import std.types { String, NonEmptyStr, List, list_length }
+import std.types { String, NonEmptyStr, List, FilePath, list_length }
+import gunbc.live_deploy.desired { deployment_spec_srv1 }
+import gunbc.live_deploy.spec { deployment_directory_demands }
+import gunbc.owned_directory { owned_directory_path, owned_directory_listed_ancestors }
 import extdeps.virtualization.firecracker { kvm_device_group }
 import extdeps.github.actions_runner { actions_runner_base_dir, actions_runner_cache_dir }
 import gunbc.executor_privileged_operation {
   ExecutorPrivilegedOperation,
+  ReadDirectoryIdentity,
+  ListDirectoryEntries,
   EnsureOwnedDirectory,
   SystemdDaemonReload,
   SystemdEnableUnit,
@@ -386,6 +391,7 @@ fn runner_host_privileged_operations(deploy: RunnerHostDeploy) -> List<ExecutorP
     + microvm_slot_reserve_start_operations(deploy: deploy)
     + runner_host_wide_privileged_operations(deploy: deploy)
     + microvm_network_granted_operations()
+    + dashboard_directory_observation_operations(deploy: deploy)
 }
 
 // THE HEADER IS THE INSTALLED FILE'S ONLY POINTER BACK TO ITS AUTHORITY, so it names the module
@@ -498,3 +504,24 @@ fn bootstrap_principal_is_not_the_job_user(
 ) -> Bool {
   bootstrap.login != job_user
 }
+
+// THE DASHBOARD DEPLOYMENT'S DIRECTORY OBSERVATIONS, AS PINNED READ-ONLY GRANTS. The live_deploy
+// transaction plans and reads back every directory its spec demands (gunbc.live_deploy.spec
+// deployment_directory_demands) under the job user, and a managed directory may admit only its owner,
+// so the job user is granted exactly two read-only metadata operations per bound directory: stat of each
+// demanded directory, and a listing of each directory whose listing establishes a demand's presence
+// (its parent and ancestors, gunbc.owned_directory owned_directory_listed_ancestors). Every path is named
+// in full; nothing here mutates. Empty on every host that does not run the dashboard deployment.
+fn dashboard_directory_observation_operations(deploy: RunnerHostDeploy) -> List<ExecutorPrivilegedOperation> {
+  let spec = deployment_spec_srv1()
+  if (deploy.host_label as String) != (spec.target.host.identity as String) {
+    []
+  } else {
+    let demanded = map(deployment_directory_demands(spec: spec), t => owned_directory_path(t: t) as String)
+    let listed = fold(flat_map(demanded, p => map(owned_directory_listed_ancestors(path: p as FilePath), a => a as String)), init: [], f: (acc, a) => if any(acc, x => x == a) { acc } else { concat(acc, [a]) })
+    concat(
+      map(demanded, p => ReadDirectoryIdentity { path: p as NonEmptyStr }),
+      map(listed, p => ListDirectoryEntries { path: p as NonEmptyStr }),
+    )
+  }
+}
diff --git a/dag/gunbc/runner/runner_host_medium.dag b/dag/gunbc/runner/runner_host_medium.dag
new file mode 100644
index 00000000000..f28d80d2dc4
--- /dev/null
+++ b/dag/gunbc/runner/runner_host_medium.dag
@@ -0,0 +1,424 @@
+module gunbc.runner.runner_host_medium
+
+import std.types { Int, List, NonEmptyStr, String }
+import std.nat { Nat }
+import std.algebra { trim }
+import std.measure { Kibibyte, HardwareThreadCount, hardware_thread_count }
+import std.checked_arithmetic { checked_int_to_nat }
+import std.optional { Present }
+import extdeps.toolchain.types { Architecture, Aarch64, architecture_diagnostic_name }
+import extdeps.exec.command { shell_command_render }
+import extdeps.tools.gnu_coreutils { rm_recursive_force_command, mkdir_parents_command, cat_command, nproc_command, ls_one_per_line_command }
+import extdeps.linux.procfs { ProcMeminfo, procfs_path_literal }
+import extdeps.systemd.udevd { udev_disk_by_label_dir }
+import extdeps.systemd { systemd_booted_runtime_dir }
+import extdeps.tools.tar { tar_extract_command }
+import extdeps.posix.test_utility { test_executable_command, test_directory_command }
+import extdeps.posix.sh_invocation { posix_sh_script_command }
+import extdeps.tools.uname { uname_machine_command, uname_linux_machine_architecture }
+import extdeps.linux.proc_meminfo { MeminfoRead, MeminfoParsed, MeminfoFieldAbsent, parse_proc_meminfo }
+import extdeps.github.actions_runner {
+  ActionsRunnerBinaryArtifact, ActionsRunnerRelease,
+  actions_runner_binary_artifact_for_arch, actions_runner_release_digest, actions_runner_download_url, actions_runner_tarball_filename,
+  actions_runner_base_dir, actions_runner_listener_relative_path,
+}
+import extdeps.crypto.hash { sha256sum_file_command, sha256sum_line_digest }
+import extdeps.provisioning.ubuntu_install_media { noble_numbat_2404_3_live_server_arm64 }
+import extdeps.provisioning.ubuntu_seeded_install_media {
+  NoCloudSeedFile,
+  NoCloudSeedArtifact,
+  UbuntuSeededInstallMediaBuildInput,
+  ubuntu_seeded_install_media_grub_kernel_cmdline,
+  ubuntu_seeded_install_media_image_name,
+}
+import extdeps.os.ubuntu_autoinstall { UbuntuAutoinstallLiveCommands }
+import gunbc.os_install_emit { autoinstall_live_commands_user_data, AutoinstallUserDataRendered, AutoinstallUserDataRefused }
+import gunbc.seeded_install_media_policy { seeded_install_media_pinned_dates, seeded_install_media_builder_revision }
+import gunbc.boot_medium { BootMedium, BootMediumRunnerHostUp, BootMediumVolumeLabel, BootMediumNoTerminal, bmc_boot_image_export }
+import gunbc.managed_host_boot { AdmittedBootSubject, boot_subject_machine }
+import gunbc.machine_intake_host_capture_envelope {
+  HostCaptureStage, HostCaptureRunIdentity, BoundHostCaptureEnvelope,
+  HostCaptureBound, HostCaptureOpen, HostCaptureNotBegun, HostCaptureUnbound,
+  HostCaptureSectionReading, SectionAbsent, SectionPending, SectionComplete, SectionMalformed,
+  host_capture_program, host_capture_bind, host_capture_section_reading,
+}
+import gunbc.runner.runner_host_unit_slot { host_unit_slot_runner_release }
+
+// THE RUNNER MEDIUM: A DISKLESS LIVE HOST THAT CAN TAKE A HOST-UNIT SLOT.
+//
+// The same seeded live-server derivation the census image uses
+// (extdeps.provisioning.ubuntu_seeded_install_media UbuntuSeededInstallMediaBuildInput), with a
+// different program in the seed: instead of a census that powers off, a readiness program that
+// installs the actions runner the host-unit slot runs (gunbc.runner.runner_host_unit_slot
+// host_unit_slot_runner_release, arm64) and prints one host-capture envelope saying the host is up.
+// The program RETURNS rather than halting, so subiquity falls through to its interactive sections
+// and waits there: nothing on this medium writes a disk, and the host stays up in RAM for the slot.
+//
+// THE RUNNER TARBALL RIDES ON THE MEDIUM, SO THE BOOT OPENS NO NETWORK (the route's boot stage has
+// no egress, gunbc.runner_throughput_qualification_route stage_egress). It is a seed ARTIFACT
+// (extdeps.provisioning.ubuntu_seeded_install_media NoCloudSeedArtifact): the build fetches it from
+// the upstream release URL and refuses unless its sha256 is the release's cited arm64 digest, and
+// that digest is in the build key. The live program reads the tarball's sha256 back off the medium
+// as its own section, and the acceptance predicate refuses a mismatch with a typed cause; each
+// install step (clear, create, extract) is its own section with its own exit code, so no step's
+// refusal depends on the shell stopping.
+//
+// THE HOST PARAMETERS ARE THE CALLER'S. Which machine name the envelope carries (it must equal the
+// boot subject's machine, gunbc.managed_host_boot boot_subject_machine) and which serial console the
+// kernel and program write to are facts about the host, so this module takes them as a value and
+// names no host.
+type RunnerHostMediumHost {
+  machine: NonEmptyStr
+  console_device: NonEmptyStr
+  console_kernel_arg: NonEmptyStr
+}
+
+data runner_host_medium_nocloud_dir: NonEmptyStr = "gunbc-runner"
+data runner_host_medium_program_file: NonEmptyStr = "runner-host-up.sh"
+data runner_host_medium_volume_id: NonEmptyStr = "GUNBC_RUNNER_HOST_2404_3"
+data runner_host_medium_image_stem: NonEmptyStr = "gunbc-runner-host-ubuntu-24.04.3-arm64"
+
+// THE PROGRAM RETURNS: the halt slot of host_capture_program is the one line whose effect is on the
+// machine, and a runner host must stay up.
+data runner_host_medium_halt_command: NonEmptyStr = "true"
+
+fn runner_host_medium_tarball_on_medium(artifact: ActionsRunnerBinaryArtifact) -> String {
+  concat("/cdrom/", runner_host_medium_nocloud_dir as String, "/", actions_runner_tarball_filename(artifact: artifact))
+}
+
+fn runner_host_medium_seed_artifact(artifact: ActionsRunnerBinaryArtifact) -> NoCloudSeedArtifact {
+  NoCloudSeedArtifact {
+    name: actions_runner_tarball_filename(artifact: artifact) as NonEmptyStr,
+    source_url: actions_runner_download_url(artifact: artifact) as NonEmptyStr,
+    digest: actions_runner_release_digest(artifact: artifact),
+  }
+}
+
+
+fn runner_host_listener_path() -> String {
+  concat(actions_runner_base_dir, actions_runner_listener_relative_path)
+}
+
+// THE SECTION NAMES ARE READ BACK BY NAME, so the program's roster and the predicate's reads are one
+// set of rows.
+data runner_host_section_boot_media: NonEmptyStr = "boot-media"
+data runner_host_section_tarball_digest: NonEmptyStr = "runner-tarball-digest"
+data runner_host_section_runner_clear: NonEmptyStr = "runner-clear"
+data runner_host_section_runner_dir: NonEmptyStr = "runner-dir"
+data runner_host_section_runner_extract: NonEmptyStr = "runner-extract"
+data runner_host_section_runner_listener: NonEmptyStr = "runner-listener"
+data runner_host_section_systemd: NonEmptyStr = "systemd-manager"
+data runner_host_section_meminfo: NonEmptyStr = "meminfo"
+data runner_host_section_nproc: NonEmptyStr = "nproc"
+data runner_host_section_machine: NonEmptyStr = "uname-machine"
+
+data runner_host_up_section_names: List<NonEmptyStr> = [
+  runner_host_section_boot_media,
+  runner_host_section_tarball_digest,
+  runner_host_section_runner_clear,
+  runner_host_section_runner_dir,
+  runner_host_section_runner_extract,
+  runner_host_section_runner_listener,
+  runner_host_section_systemd,
+  runner_host_section_meminfo,
+  runner_host_section_nproc,
+  runner_host_section_machine,
+]
+
+// THE ROSTER. The slot unit is a transient systemd unit started per attempt
+// (gunbc.runner.runner_host_unit_slot HostUnitSlot.argv, systemd-run), so no slot unit exists at
+// boot; what boot can establish about a slot is that systemd is the running manager systemd-run
+// talks to (/run/systemd/system, sd_booted(3)) and that the listener the slot's argv names is
+// installed and executable. The slot unit's own activity is the launch leg's readback.
+fn runner_host_up_stages(artifact: ActionsRunnerBinaryArtifact) -> List<HostCaptureStage> {
+  [
+    HostCaptureStage { name: runner_host_section_boot_media, command: shell_command_render(command: ls_one_per_line_command(path: udev_disk_by_label_dir)) as NonEmptyStr },
+    HostCaptureStage { name: runner_host_section_tarball_digest, command: shell_command_render(command: sha256sum_file_command(path: runner_host_medium_tarball_on_medium(artifact: artifact))) as NonEmptyStr },
+    HostCaptureStage { name: runner_host_section_runner_clear, command: shell_command_render(command: rm_recursive_force_command(path: actions_runner_base_dir)) as NonEmptyStr },
+    HostCaptureStage { name: runner_host_section_runner_dir, command: shell_command_render(command: mkdir_parents_command(path: actions_runner_base_dir)) as NonEmptyStr },
+    HostCaptureStage { name: runner_host_section_runner_extract, command: shell_command_render(command: tar_extract_command(archive: runner_host_medium_tarball_on_medium(artifact: artifact), into_directory: actions_runner_base_dir, strip_components: 0)) as NonEmptyStr },
+    HostCaptureStage { name: runner_host_section_runner_listener, command: shell_command_render(command: test_executable_command(path: runner_host_listener_path())) as NonEmptyStr },
+    HostCaptureStage { name: runner_host_section_systemd, command: shell_command_render(command: test_directory_command(path: systemd_booted_runtime_dir)) as NonEmptyStr },
+    HostCaptureStage { name: runner_host_section_meminfo, command: shell_command_render(command: cat_command(path: procfs_path_literal(p: ProcMeminfo) as String)) as NonEmptyStr },
+    HostCaptureStage { name: runner_host_section_nproc, command: shell_command_render(command: nproc_command()) as NonEmptyStr },
+    HostCaptureStage { name: runner_host_section_machine, command: shell_command_render(command: uname_machine_command()) as NonEmptyStr },
+  ]
+}
+
+fn runner_host_medium_program_on_medium() -> NonEmptyStr {
+  concat("/cdrom/", runner_host_medium_nocloud_dir as String, "/", runner_host_medium_program_file as String) as NonEmptyStr
+}
+
+data runner_host_medium_live_commands: UbuntuAutoinstallLiveCommands = UbuntuAutoinstallLiveCommands {
+  autoinstall_version: 1,
+  early_commands: [shell_command_render(command: posix_sh_script_command(path: runner_host_medium_program_on_medium())) as NonEmptyStr],
+}
+
+// THE DERIVATION REFUSES RATHER THAN DEFAULTS: no published arm64 runner tarball for the release, or
+// a user-data document the renderer will not write, leaves no image.
+type RunnerHostMediumImage
+  = RunnerHostMediumImageDerived { input: UbuntuSeededInstallMediaBuildInput, runner: ActionsRunnerBinaryArtifact }
+  | RunnerHostMediumRunnerUnpublished { binary_release: ActionsRunnerRelease }
+  | RunnerHostMediumUserDataRefused { reason: String }
+
+fn runner_host_medium_image(host: RunnerHostMediumHost) -> RunnerHostMediumImage {
+  match actions_runner_binary_artifact_for_arch(binary_release: host_unit_slot_runner_release, arch: Aarch64) {
+    Absent => RunnerHostMediumRunnerUnpublished { binary_release: host_unit_slot_runner_release }
+    Present { value: artifact } =>
+      match autoinstall_live_commands_user_data(payload: runner_host_medium_live_commands) {
+        AutoinstallUserDataRefused { reason: r } => RunnerHostMediumUserDataRefused { reason: r }
+        AutoinstallUserDataRendered { content: body } =>
+          RunnerHostMediumImageDerived {
+            runner: artifact,
+            input: UbuntuSeededInstallMediaBuildInput {
+              stock_artifact: noble_numbat_2404_3_live_server_arm64,
+              nocloud_dir_on_iso: runner_host_medium_nocloud_dir,
+              user_data_body: body as NonEmptyStr,
+              seed_files: [
+                NoCloudSeedFile {
+                  name: runner_host_medium_program_file,
+                  content: host_capture_program(
+                    machine: host.machine,
+                    console_device: host.console_device,
+                    stages: runner_host_up_stages(artifact: artifact),
+                    halt_command: runner_host_medium_halt_command,
+                  ),
+                },
+              ],
+              seed_artifacts: [runner_host_medium_seed_artifact(artifact: artifact)],
+              grub_kernel_cmdline: concat(
+                ubuntu_seeded_install_media_grub_kernel_cmdline(nocloud_dir: runner_host_medium_nocloud_dir) as String,
+                " ",
+                host.console_kernel_arg as String,
+              ) as NonEmptyStr,
+              volume_id: runner_host_medium_volume_id,
+              pinned_dates: seeded_install_media_pinned_dates,
+              image_stem: runner_host_medium_image_stem,
+              builder_revision: seeded_install_media_builder_revision,
+            },
+          }
+      }
+  }
+}
+
+// THE MEDIUM AUTHORS ONE FACT, THE MEASURED OUTPUT DIGEST of the built image -- its content digest,
+// which the export's readback must equal (gunbc.boot_medium boot_medium_readback). Name and terminal
+// derive from rows above, so a runner medium naming another artifact has no spelling. No data row
+// applies this yet: no build of the runner image has run, and authoring a digest no build produced
+// would fabricate it. The row lands with the publish receipt.
+fn runner_host_boot_medium(output_digest: NonEmptyStr) -> BootMedium {
+  BootMedium {
+    image_name: ubuntu_seeded_install_media_image_name(image_stem: runner_host_medium_image_stem, output_digest: output_digest),
+    digest: output_digest,
+    export: bmc_boot_image_export,
+    terminal: BootMediumRunnerHostUp { label: runner_host_medium_volume_id },
+  }
+}
+
+// ── THE ACCEPTANCE PREDICATE ─────────────────────────────────────────────────────────────────
+
+// WHAT "RUNNER HOST UP" IS, READ BACK: the route's GuestIdleMeminfoAndNproc instrument
+// (gunbc.runner_throughput_qualification_route) at idle, before any job, plus the runner installed.
+type RunnerHostUp {
+  run: HostCaptureRunIdentity
+  mem_total: Kibibyte
+  mem_available: Kibibyte
+  threads: HardwareThreadCount
+  machine: Architecture
+}
+
+type RunnerHostUpRefusal
+  = RunnerHostCaptureUnbound { reason: String }
+  | RunnerHostSectionAbsent { name: NonEmptyStr }
+  | RunnerHostSectionMalformed { name: NonEmptyStr, reason: String }
+  | RunnerHostSectionFailed { name: NonEmptyStr, exit_code: String }
+  | RunnerHostMeminfoFieldAbsent { field: NonEmptyStr }
+  | RunnerHostNprocUnreadable { observed: String }
+  | RunnerHostMachineUnrecognized { observed: String }
+  | RunnerHostMachineNotAarch64 { observed: Architecture }
+  | RunnerHostLabelAbsent { expected: NonEmptyStr, observed: List<String> }
+  | RunnerHostTarballDigestDiffers { expected: NonEmptyStr, observed: String }
+  | RunnerHostRunnerUnpublished { binary_release: ActionsRunnerRelease }
+  | RunnerHostMediumTerminalNotRunnerHostUp { image: NonEmptyStr }
+
+type RunnerHostUpReadback
+  = RunnerHostUpPending { reason: String }
+  | RunnerHostUpRefused { refusals: List<RunnerHostUpRefusal> }
+  | RunnerHostUpObserved { up: RunnerHostUp }
+
+fn runner_host_up_refusal_text(refusal: RunnerHostUpRefusal) -> String {
+  match refusal {
+    RunnerHostCaptureUnbound { reason: r } => concat("capture does not bind: ", r)
+    RunnerHostSectionAbsent { name: n } => concat("closed envelope carries no ", n as String, " section")
+    RunnerHostSectionMalformed { name: _, reason: r } => r
+    RunnerHostSectionFailed { name: n, exit_code: c } => concat(n as String, " exited ", c)
+    RunnerHostMeminfoFieldAbsent { field: f } => concat("meminfo carries no ", f as String)
+    RunnerHostNprocUnreadable { observed: o } => concat("nproc printed ", o, ", not a positive count")
+    RunnerHostMachineUnrecognized { observed: o } => concat("uname -m printed ", concat(o, ", which is no Linux machine spelling this projection cites"))
+    RunnerHostMachineNotAarch64 { observed: a } => concat("uname -m read back ", concat(architecture_diagnostic_name(arch: a) as String, ", the runner image is arm64"))
+    RunnerHostTarballDigestDiffers { expected: e, observed: o } => concat("the runner tarball on the medium read back sha256 ", concat(o, concat(", the release cites ", e as String)))
+    RunnerHostRunnerUnpublished { binary_release: r } => concat("no arm64 runner tarball is published for release ", r.version as String)
+    RunnerHostLabelAbsent { expected: e, observed: o } => concat("no block device carries the admitted medium's label ", concat(e as String, concat("; labels read: ", join(o, ", "))))
+    RunnerHostMediumTerminalNotRunnerHostUp { image: i } => concat("the admitted medium ", concat(i as String, " does not name the runner-host-up terminal"))
+  }
+}
+
+fn runner_host_last_line(out: List<String>) -> String {
+  trim(s: fold(out, init: "", f: (acc, l) => if trim(s: l) == "" { acc } else { l }))
+}
+
+// ONE SECTION, READ ON A CLOSED ENVELOPE: absent, unterminated or failed refuses; held yields its
+// output. Acceptance is only ever over a closed envelope (the END marker is the program's own
+// statement that it wrote everything), so an unterminated section here is the program's defect.
+type RunnerHostSectionRead
+  = RunnerHostSectionHeld { output: List<String> }
+  | RunnerHostSectionRefused { refusal: RunnerHostUpRefusal }
+
+fn runner_host_section_read(envelope: BoundHostCaptureEnvelope, name: NonEmptyStr) -> RunnerHostSectionRead {
+  match host_capture_section_reading(envelope: envelope, name: name as String) {
+    SectionAbsent => RunnerHostSectionRefused { refusal: RunnerHostSectionAbsent { name: name } }
+    SectionPending { output: _ } => RunnerHostSectionRefused { refusal: RunnerHostSectionMalformed { name: name, reason: concat(name as String, " section never printed its EXIT line inside a closed envelope") } }
+    SectionMalformed { reason: r } => RunnerHostSectionRefused { refusal: RunnerHostSectionMalformed { name: name, reason: r } }
+    SectionComplete { exit_code: c, output: out } =>
+      if c == "0" { RunnerHostSectionHeld { output: out } } else { RunnerHostSectionRefused { refusal: RunnerHostSectionFailed { name: name, exit_code: c } } }
+  }
+}
+
+fn runner_host_section_refusal(read: RunnerHostSectionRead) -> List<RunnerHostUpRefusal> {
+  match read {
+    RunnerHostSectionHeld { output: _ } => []
+    RunnerHostSectionRefused { refusal: r } => [r]
+  }
+}
+
+fn runner_host_section_output(read: RunnerHostSectionRead) -> List<String> {
+  match read {
+    RunnerHostSectionHeld { output: out } => out
+    RunnerHostSectionRefused { refusal: _ } => []
+  }
+}
+
+// THE TARBALL'S DIGEST IS READ BACK AND COMPARED HERE, as a typed refusal, rather than gated in the
+// program: the medium's bytes are already established by the build (the seed artifact's readback)
+// and by the export's readback of the whole image before attach, so this reading is the boot's
+// evidence that the tarball it extracted is the cited release -- a mismatch refuses the terminal.
+fn runner_host_tarball_digest_refusals(read: RunnerHostSectionRead) -> List<RunnerHostUpRefusal> {
+  match actions_runner_binary_artifact_for_arch(binary_release: host_unit_slot_runner_release, arch: Aarch64) {
+    Absent => [RunnerHostRunnerUnpublished { binary_release: host_unit_slot_runner_release }]
+    Present { value: artifact } => {
+      let expected = actions_runner_release_digest(artifact: artifact).hex
+      match read {
+        RunnerHostSectionRefused { refusal: r } => [r]
+        RunnerHostSectionHeld { output: out } => {
+          let line = runner_host_last_line(out: out)
+          match sha256sum_line_digest(line: line) {
+            Present { value: d } => if (d.hex as String) == (expected as String) { [] } else { [RunnerHostTarballDigestDiffers { expected: expected, observed: d.hex as String }] }
+            Absent => [RunnerHostTarballDigestDiffers { expected: expected, observed: line }]
+          }
+        }
+      }
+    }
+  }
+}
+
+// EVERY REFUSAL IS NAMED, NOT THE FIRST: a host whose runner install failed AND whose nproc is short
+// reports both, so one boot answers both questions.
+fn runner_host_up_over_closed(envelope: BoundHostCaptureEnvelope, label: NonEmptyStr) -> RunnerHostUpReadback {
+  let media_read = runner_host_section_read(envelope: envelope, name: runner_host_section_boot_media)
+  let labels = filter(map(runner_host_section_output(read: media_read), l => trim(s: l)), l => l != "")
+  let media_refusals = match media_read {
+    RunnerHostSectionRefused { refusal: r } => [r]
+    RunnerHostSectionHeld { output: _ } =>
+      if any(labels, l => l == (label as String)) { [] } else { [RunnerHostLabelAbsent { expected: label, observed: labels }] }
+  }
+  let digest_refusals = runner_host_tarball_digest_refusals(read: runner_host_section_read(envelope: envelope, name: runner_host_section_tarball_digest))
+  let gates = append(append(media_refusals, items: digest_refusals), items: flat_map(
+    [runner_host_section_runner_clear, runner_host_section_runner_dir, runner_host_section_runner_extract, runner_host_section_runner_listener, runner_host_section_systemd],
+    n => runner_host_section_refusal(read: runner_host_section_read(envelope: envelope, name: n)),
+  ))
+  let mem_read = runner_host_section_read(envelope: envelope, name: runner_host_section_meminfo)
+  let nproc_read = runner_host_section_read(envelope: envelope, name: runner_host_section_nproc)
+  let machine_read = runner_host_section_read(envelope: envelope, name: runner_host_section_machine)
+  let meminfo = parse_proc_meminfo(text: join(runner_host_section_output(read: mem_read), "\n"))
+  let nproc_text = runner_host_last_line(out: runner_host_section_output(read: nproc_read))
+  let nproc = match parse_int(s: nproc_text) {
+    Absent => none
+    Present { value: n } => if n > 0 { checked_int_to_nat(n: n) } else { none }
+  }
+  let machine = runner_host_last_line(out: runner_host_section_output(read: machine_read))
+  let mem_refusals = match mem_read {
+    RunnerHostSectionRefused { refusal: r } => [r]
+    RunnerHostSectionHeld { output: _ } =>
+      match meminfo {
+        MeminfoFieldAbsent { field: f } => [RunnerHostMeminfoFieldAbsent { field: f }]
+        MeminfoParsed { meminfo: _ } => []
+      }
+  }
+  let nproc_refusals = match nproc_read {
+    RunnerHostSectionRefused { refusal: r } => [r]
+    RunnerHostSectionHeld { output: _ } =>
+      match nproc {
+        Absent => [RunnerHostNprocUnreadable { observed: nproc_text }]
+        Present { value: _ } => []
+      }
+  }
+  let arch = uname_linux_machine_architecture(spelling: machine)
+  let machine_refusals = match machine_read {
+    RunnerHostSectionRefused { refusal: r } => [r]
+    RunnerHostSectionHeld { output: _ } =>
+      match arch {
+        Absent => [RunnerHostMachineUnrecognized { observed: machine }]
+        Present { value: Aarch64 } => []
+        Present { value: other } => [RunnerHostMachineNotAarch64 { observed: other }]
+      }
+  }
+  let refusals = append(append(append(gates, items: mem_refusals), items: nproc_refusals), items: machine_refusals)
+  match meminfo {
+    MeminfoParsed { meminfo: m } =>
+      match nproc {
+        Present { value: n } =>
+          match arch {
+            Present { value: a } =>
+              if count(refusals) == 0 {
+                RunnerHostUpObserved { up: RunnerHostUp { run: envelope.run, mem_total: m.mem_total, mem_available: m.mem_available, threads: hardware_thread_count(count: n), machine: a } }
+              } else {
+                RunnerHostUpRefused { refusals: refusals }
+              }
+            Absent => RunnerHostUpRefused { refusals: refusals }
+          }
+        Absent => RunnerHostUpRefused { refusals: refusals }
+      }
+    MeminfoFieldAbsent { field: _ } => RunnerHostUpRefused { refusals: refusals }
+  }
+}
+
+// AN OPEN ENVELOPE NEVER ACCEPTS, AND REFUSES EARLY ONLY ON A COMPLETE SECTION THAT FAILED: a runner
+// install step that exited nonzero is a complete fact about that run before END is printed.
+fn runner_host_up_over_open(envelope: BoundHostCaptureEnvelope) -> RunnerHostUpReadback {
+  let failed = flat_map(runner_host_up_section_names, n => match host_capture_section_reading(envelope: envelope, name: n as String) {
+    SectionComplete { exit_code: c, output: _ } => if c == "0" { [] } else { [RunnerHostSectionFailed { name: n, exit_code: c }] }
+    SectionMalformed { reason: r } => [RunnerHostSectionMalformed { name: n, reason: r }]
+    SectionAbsent => []
+    SectionPending { output: _ } => []
+  })
+  if count(failed) == 0 { RunnerHostUpPending { reason: "envelope open; no complete section refuses" } } else { RunnerHostUpRefused { refusals: failed } }
+}
+
+// THE PREDICATE THE BOOT RUN'S TERMINAL WATCH DELEGATES TO for a BootMediumRunnerHostUp medium. The
+// capture binds to the subject's machine and run (one envelope, never a search over the stream), and
+// the label it must establish is the one on the ADMITTED subject's medium, compared to the labels the
+// host listed -- not a module constant, so a subject admitted with another label is refused by a
+// capture of this image.
+fn runner_host_up_readback(capture: String, subject: AdmittedBootSubject) -> RunnerHostUpReadback {
+  match subject.medium.terminal {
+    BootMediumRunnerHostUp { label: label } =>
+      match host_capture_bind(capture: capture, machine: boot_subject_machine(subject: subject)) {
+        HostCaptureNotBegun => RunnerHostUpPending { reason: "no begin marker for this machine yet" }
+        HostCaptureUnbound { reason: r } => RunnerHostUpRefused { refusals: [RunnerHostCaptureUnbound { reason: r }] }
+        HostCaptureOpen { envelope: e } => runner_host_up_over_open(envelope: e)
+        HostCaptureBound { envelope: e } => runner_host_up_over_closed(envelope: e, label: label)
+      }
+    BootMediumVolumeLabel { label: _ } => RunnerHostUpRefused { refusals: [RunnerHostMediumTerminalNotRunnerHostUp { image: subject.medium.image_name }] }
+    BootMediumNoTerminal { reason: _ } => RunnerHostUpRefused { refusals: [RunnerHostMediumTerminalNotRunnerHostUp { image: subject.medium.image_name }] }
+  }
+}
diff --git a/dag/gunbc/runner/runner_host_unit_slot.dag b/dag/gunbc/runner/runner_host_unit_slot.dag
index f89ff66f4d8..e1c9814b7fc 100644
--- a/dag/gunbc/runner/runner_host_unit_slot.dag
+++ b/dag/gunbc/runner/runner_host_unit_slot.dag
@@ -7,13 +7,16 @@ import extdeps.github.actions_runner {
   actions_runner_release_2_337_0, actions_runner_base_dir, actions_runner_listener_relative_path,
   actions_runner_listener_run_verb,
 }
-import gunbc.managed_host { ManagedHostBinding, ManagedHostBindingStanding, ManagedHostBound }
+import gunbc.host_control_route { ControlledHost, HostControlStanding, HostControlled, HostControlRefused, HostControlRefusal }
 import gunbc.runner_slot_desired { gunbc_runner_slot_desired }
 import extdeps.exec.command { ArgvCommand }
 import extdeps.systemd.systemd_run {
   SystemdRunCommandReady, SystemdRunCommandRefused, SystemdRunOptionWordsRefusedCause,
+  systemd_run_transient_wait_unit_command,
 }
 import gunbc.runner_throughput_qualification_route { ephemeral_slot_unit, ephemeral_slot_command, ephemeral_slot_labels }
+import extdeps.github.actions { self_hosted_provenance_label }
+import gunbc.runner.provider_guest_incarnation { ProviderGuestIncarnation }
 
 // THE SECOND BINDING OF ONE JIT MINT: A TRANSIENT systemd UNIT ON A LIVE MANAGED HOST.
 //
@@ -22,10 +25,10 @@ import gunbc.runner_throughput_qualification_route { ephemeral_slot_unit, epheme
 // realization) -- this module only decides whether a host-unit slot EXISTS, and the mint decides
 // everything else over the sum both bindings inhabit.
 //
-// The host is admitted only through the ManagedHost seam (gunbc.managed_host): a host whose binding
-// standing is anything but ManagedHostBound has no slot, and the refusal carries that standing
-// unchanged rather than a re-coined cause. No mtcollins1_* module is named here; mtcollins1 reaches
-// this fold as the gunbc.managed_host managed_hosts row and nothing else.
+// The host is admitted only as a ControlledHost (gunbc.host_control_route): a host the fleet cannot
+// recover without its OS -- through its BMC or its provider's API -- has no slot, and the refusal
+// carries the route's own refusal unchanged rather than a re-coined cause. No mtcollins1_* module is
+// named here; mtcollins1 reaches this fold through its gunbc.managed_host row and nothing else.
 //
 // The unit, its systemd-run command (the full typed ArgvCommand -- program head included, so a
 // launch seam reading this field gets exactly the invocation the route stages, not a headless
@@ -40,7 +43,7 @@ import gunbc.runner_throughput_qualification_route { ephemeral_slot_unit, epheme
 // (gunbc.credential_argv_exposure), and putting the encoded config there would re-open that class.
 // Placing the credential into the unit's environment is the launch's act, not the registration's.
 type HostUnitSlot sole_constructor {
-  host: ManagedHostBinding
+  host: ControlledHost
   attempt: NonEmptyStr
   workflow: NonEmptyStr
   unit: NonEmptyStr
@@ -50,7 +53,7 @@ type HostUnitSlot sole_constructor {
 }
 
 type HostUnitSlotRefusal
-  = HostUnitSlotHostNotBound { standing: ManagedHostBindingStanding }
+  = HostUnitSlotHostNotControlled { refusal: HostControlRefusal }
   | HostUnitSlotRunnerBinaryUnpublished { binary_release: ActionsRunnerRelease }
   | HostUnitSlotSystemdRunRefused { cause: SystemdRunOptionWordsRefusedCause }
 
@@ -67,15 +70,15 @@ fn host_unit_slot_listener_argv() -> List<String> {
 }
 
 // THE WORKFLOW IS THE CALLER'S: the slot exists to run one workflow, and the mint refuses a runner
-// group restricted to any other (gunbc.runner_jit_mint jit_slot_workflow). It is spelled the way
+// group restricted to any other (gunbc.runner_jit_mint plan_jit_mint, over gunbc.runner.jit_registration_subject workflow). It is spelled the way
 // GitHub identifies a selected workflow, `<owner>/<repo>/<path>@<ref>`.
-fn host_unit_slot_for(host: ManagedHostBindingStanding, attempt: NonEmptyStr, workflow: NonEmptyStr) -> HostUnitSlotStanding {
+fn host_unit_slot_for(host: HostControlStanding, attempt: NonEmptyStr, workflow: NonEmptyStr) -> HostUnitSlotStanding {
   match host {
-    ManagedHostBound { binding: b } =>
+    HostControlled { controlled: b } =>
       match actions_runner_binary_artifact_for_arch(binary_release: host_unit_slot_runner_release, arch: Aarch64) {
         Absent => HostUnitSlotRefused { refusal: HostUnitSlotRunnerBinaryUnpublished { binary_release: host_unit_slot_runner_release } }
         Present { value: artifact } => {
-          let unit = ephemeral_slot_unit(host: b.host.host, attempt: attempt)
+          let unit = ephemeral_slot_unit(host: b.host, attempt: attempt)
           match ephemeral_slot_command(unit: unit, desired: gunbc_runner_slot_desired(), command_argv: host_unit_slot_listener_argv()) {
             SystemdRunCommandRefused { cause: why } =>
               HostUnitSlotRefused { refusal: HostUnitSlotSystemdRunRefused { cause: why } }
@@ -86,7 +89,7 @@ fn host_unit_slot_for(host: ManagedHostBindingStanding, attempt: NonEmptyStr, wo
                   attempt: attempt,
                   workflow: workflow,
                   unit: unit,
-                  labels: ephemeral_slot_labels(host: b.host.host, attempt: attempt),
+                  labels: ephemeral_slot_labels(host: b.host, attempt: attempt),
                   argv: command,
                   runner: artifact,
                 },
@@ -94,6 +97,50 @@ fn host_unit_slot_for(host: ManagedHostBindingStanding, attempt: NonEmptyStr, wo
           }
         }
       }
-    other => HostUnitSlotRefused { refusal: HostUnitSlotHostNotBound { standing: other } }
+    HostControlRefused { refusal: r } => HostUnitSlotRefused { refusal: HostUnitSlotHostNotControlled { refusal: r } }
+  }
+}
+
+// ── the provider guest's slot ───────────────────────────────────────────────────────────────────
+
+// THE LANE A PROVIDER GUEST SERVES, as the one label a workflow names to reach it. A slot on a guest
+// rebuilt per job answers to exactly three labels: the provenance label every self-hosted runner
+// carries, this lane label, and its own registration name. It does NOT answer to the fleet's slot
+// class labels (gunbc.runner_slot_desired, which today include gunbc-heavy) or to the host label,
+// because those are what production lanes target, and a guest registered under them would take a
+// required job onto a host whose egress is uncontained
+// (gunbc.rung_drop.provider_guest_ci_egress_unfiltered). A lane reaches these guests only by naming
+// this label in its runs-on.
+data provider_guest_ci_lane_label: String = "gunbc-provider-guest-ci"
+
+fn provider_guest_slot_unit(incarnation: ProviderGuestIncarnation) -> NonEmptyStr {
+  join(["gunbc-provider-ci-", incarnation.controlled.host as String, "-", incarnation.rebuild.attempt as String, ".service"], "") as NonEmptyStr
+}
+
+// THE SLOT ON ONE INCARNATION, for the attempt that incarnation was rebuilt for. It takes the
+// incarnation rather than a controlled host, so a guest that was not rebuilt for this attempt has no
+// slot to register. The unit carries no resource properties: the whole guest is the attempt's, and
+// the fleet's slot bounds (gunbc.runner_slot_desired) are sized for shared Altra hosts, not for it.
+fn provider_guest_slot_for(incarnation: ProviderGuestIncarnation, workflow: NonEmptyStr) -> HostUnitSlotStanding {
+  match actions_runner_binary_artifact_for_arch(binary_release: host_unit_slot_runner_release, arch: Aarch64) {
+    Absent => HostUnitSlotRefused { refusal: HostUnitSlotRunnerBinaryUnpublished { binary_release: host_unit_slot_runner_release } }
+    Present { value: artifact } => {
+      let unit = provider_guest_slot_unit(incarnation: incarnation)
+      match systemd_run_transient_wait_unit_command(unit: unit, properties: [], command_argv: host_unit_slot_listener_argv()) {
+        SystemdRunCommandRefused { cause: why } => HostUnitSlotRefused { refusal: HostUnitSlotSystemdRunRefused { cause: why } }
+        SystemdRunCommandReady { command: command } =>
+          HostUnitSlotBound {
+            slot: HostUnitSlot {
+              host: incarnation.controlled,
+              attempt: incarnation.rebuild.attempt,
+              workflow: workflow,
+              unit: unit,
+              labels: [self_hosted_provenance_label, provider_guest_ci_lane_label, unit as String],
+              argv: command,
+              runner: artifact,
+            },
+          }
+      }
+    }
   }
 }
diff --git a/dag/gunbc/runner/runner_jit_deregistration.dag b/dag/gunbc/runner/runner_jit_deregistration.dag
index d400022f155..3760300029a 100644
--- a/dag/gunbc/runner/runner_jit_deregistration.dag
+++ b/dag/gunbc/runner/runner_jit_deregistration.dag
@@ -13,7 +13,7 @@ import gunbc.auth.github_apps { DeclaredGitHubApp, GitHubAppControlPlaneState }
 import gunbc.auth.github_credential {
   GitHubCredentialAuthority, CredentialCapability, credential_authorizes, unsatisfied_capabilities,
 }
-import gunbc.runner_jit_mint { JitSlot }
+import gunbc.runner.jit_registration_subject { JitRegistrationSubject }
 import gunbc.runner.runner_jit_perform {
   JitMintDispatch, JitMintDispatchAuthorized, JitMintDispatchRefused, authority_installation,
 }
@@ -44,13 +44,13 @@ type JitSlotExit
 // THE SUBJECT IS MINTED FROM THE AUTHORIZED DISPATCH AND NOWHERE ELSE. jit_registration_of is its
 // only constructor, so the runner this fold may delete is one an authorized mint named -- a caller
 // cannot point the delete at an arbitrary runner name. The name is fixed by the dispatch BEFORE
-// GitHub answers (gunbc.runner_jit_mint jit_slot_runner_name), so a mint whose answer was lost --
+// GitHub answers (gunbc.runner.jit_registration_subject JitRegistrationSubject name), so a mint whose answer was lost --
 // the one case where a runner may exist under an id nobody received -- still yields a subject. The
 // App and installation are the dispatch's, so the token that deletes must be the one that minted.
 type JitRegistration sole_constructor {
   organization: GitHubOrganizationRef
   name: JitRunnerName
-  slot: JitSlot
+  subject: JitRegistrationSubject
   app: DeclaredGitHubApp
   installation: GitHubAppInstallationId
 }
@@ -59,7 +59,7 @@ fn jit_registration_of(dispatch: JitMintDispatch) -> JitRegistration? {
   match dispatch {
     JitMintDispatchRefused { refusal: _ } => none
     JitMintDispatchAuthorized { dispatch: d } =>
-      Present { value: JitRegistration { organization: d.organization, name: d.request.name, slot: d.slot, app: d.app, installation: d.installation } }
+      Present { value: JitRegistration { organization: d.organization, name: d.request.name, subject: d.subject, app: d.app, installation: d.installation } }
   }
 }
 
diff --git a/dag/gunbc/runner/runner_jit_mint.dag b/dag/gunbc/runner/runner_jit_mint.dag
index c485c8ec8d5..8d4f47fc4bf 100644
--- a/dag/gunbc/runner/runner_jit_mint.dag
+++ b/dag/gunbc/runner/runner_jit_mint.dag
@@ -18,13 +18,9 @@ import gunbc.auth.github_apps { GitHubAppControlPlaneState }
 import gunbc.auth.github_credential {
   GitHubCredentialAuthority, CredentialCapability, credential_authorizes, unsatisfied_capabilities,
 }
-import extdeps.github.actions { self_hosted_provenance_label }
-import gunbc.runner_microvm_attempt {
-  MicroVmAttempt, MicroVmCellBinding, VmBoundToOwnedCell, VmUnboundCellNotOwned,
-  runner_microvm_attempt_unit_name,
-}
-import gunbc.runner.runner_host_unit_slot {
-  HostUnitSlot, HostUnitSlotStanding, HostUnitSlotBound, HostUnitSlotRefused, HostUnitSlotRefusal,
+import gunbc.runner.jit_registration_subject {
+  JitRegistrationSubject, JitRegistrationSubjectStanding, JitRegistrationSubjectProven,
+  JitRegistrationSubjectRefused, JitRegistrationSubjectRefusal,
 }
 
 data runner_jit_mint_disposition: ConstructionMechanism = SingleAuthority
@@ -41,27 +37,16 @@ data runner_jit_mint_disposition: ConstructionMechanism = SingleAuthority
 // caller cannot mint first and check ownership after, because the only value that names the attempt
 // a credential belongs to is produced by the arm that already proved both.
 
-// ONE MINT, TWO BINDINGS. A JIT registration is minted for a SLOT, and a slot is realized either
-// as a microVM attempt in an owned cell or as a transient systemd unit on a managed host
-// (gunbc.runner.runner_host_unit_slot). The plan below is one fold over this sum, not one fold per
-// binding (DESIGN §3: transport is realization) -- the credential, attempt-binding and runner-group
-// gates are the same gates whichever arm the slot is, and only the slot's existence proof and the
-// name and labels it registers under are the binding's own.
-type JitSlotBinding
-  = MicroVmSlotBinding { binding: MicroVmCellBinding }
-  | HostUnitSlotBinding { standing: HostUnitSlotStanding }
-
-type JitSlot
-  = MicroVmJitSlot { attempt: MicroVmAttempt }
-  | HostUnitJitSlot { slot: HostUnitSlot }
-
+// ONE MINT, ANY REALIZATION. A JIT registration is minted for a subject -- name, workflow, labels
+// (gunbc.runner.jit_registration_subject) -- and the realization that proved the slot exists is
+// the producer's fact, not the mint's. The credential, attempt-binding and runner-group gates are
+// the same gates whatever produced the subject.
 type JitMintPlan
   = JitMintAuthorized {
-      slot: JitSlot
+      subject: JitRegistrationSubject
       request: JitRunnerConfigRequest
     }
-  | JitMintRefusedCellNotOwned { cause: String }
-  | JitMintRefusedHostUnitSlot { refusal: HostUnitSlotRefusal }
+  | JitMintRefusedSubject { refusal: JitRegistrationSubjectRefusal }
   | JitMintRefusedCredential {
       organization: NonEmptyStr
       unsatisfied: List<CredentialCapability>
@@ -70,38 +55,10 @@ type JitMintPlan
   | JitMintRefusedRunnerGroupUnrestricted { group: NonEmptyStr, cause: RunnerGroupRestrictionRefusal }
   | JitMintRefusedRunnerGroupForAnotherWorkflow { group: NonEmptyStr, selected: NonEmptyStr, intended: NonEmptyStr }
 
-// THE RUNNER NAME IS THE UNIT NAME, not a fresh identifier minted beside it. A second naming scheme
-// for one attempt is a nickname (DESIGN §3), and it is the expensive kind: an orphaned GitHub runner
-// registration can only be reconciled against a host by name, so a name that does not appear on the
-// host makes the orphan unattributable.
-fn jit_runner_name_for(attempt: MicroVmAttempt) -> JitRunnerName {
-  JitRunnerName { value: runner_microvm_attempt_unit_name(attempt: attempt) }
-}
-
-// THE WORK FOLDER IS GUEST-RELATIVE, not the host attempt directory. The host path is meaningless
-// inside the VM, and handing it over would be a path from one namespace asserted in another.
+// THE WORK FOLDER IS GUEST-RELATIVE, not a host attempt directory. A host path is meaningless
+// inside the guest, and handing it over would be a path from one namespace asserted in another.
 data jit_guest_work_folder: JitWorkFolder = JitWorkFolder { value: "_work" as NonEmptyStr }
 
-// THE LABELS ARE THE ATTEMPT'S OWN, AND NO CALLER CAN HAND IN ANY OTHERS. A microVM attempt answers
-// to exactly two labels: the provenance label every self-hosted runner carries, and its OWN
-// registration name, which is the attempt's unit name and so names this attempt and no other. It
-// does NOT answer to the host's registration set (gunbc.runner_registration_labels), because that
-// set is what production jobs target: `[self-hosted, linux, arm64, srv1]` is fleet-desired.yml and
-// every srv1-pinned fleet-converge job, and a guest registered under it could take a production
-// converge job into a trusted-shakedown VM. So the list is not a parameter: the request is derived
-// from the attempt alone, and a job reaches this runner only by naming the attempt in its runs-on --
-// the binding gunbc.runner_bound_attempt_receipt already relies on for the mtcollins canary.
-//
-// WHAT THIS DOES NOT CLOSE, declared rather than assumed. GitHub documents that the runner agent
-// applies default labels (self-hosted, OS, architecture) at registration (extdeps.github.actions
-// self_hosted_provenance_label's directory row); whether a JIT registration also receives the OS and
-// architecture defaults is not modeled here. If it does, this runner would ALSO match
-// `[self-hosted, linux, arm64]`, which witnesses.yml, heal.yml and a fleet-converge job use. That arm
-// is closed by the runner group, not the label: see microvm_jit_runner_group_restriction_frontier.
-fn microvm_attempt_registration_labels(attempt: MicroVmAttempt) -> List<String> {
-  [self_hosted_provenance_label, jit_runner_name_for(attempt: attempt).value as String]
-}
-
 // THE RUNNER GROUP IS A STANDING, NOT A BARE ID, and the mint refuses every standing but one. The
 // org's Default group admits every workflow; if a JIT registration also receives GitHub's OS and
 // architecture defaults, a runner there would match witnesses.yml, heal.yml and a fleet-converge
@@ -111,85 +68,39 @@ fn microvm_attempt_registration_labels(attempt: MicroVmAttempt) -> List<String>
 // MicrovmRunnerGroupStanding, whose authorizing arm carries a sole_constructor record only that
 // module's observer can write; every other reading is RunnerGroupRestrictionRefused with a named
 // cause, which the refusal below carries to the controller unchanged.
-fn jit_slot_runner_name(slot: JitSlot) -> JitRunnerName {
-  match slot {
-    MicroVmJitSlot { attempt: a } => jit_runner_name_for(attempt: a)
-    HostUnitJitSlot { slot: h } => JitRunnerName { value: h.unit }
-  }
-}
-
-// THE WORKFLOW A SLOT EXISTS TO RUN. A restricted group is observed restricted to ONE workflow
-// (gunbc.runner_group_restriction_observation RestrictedRunnerGroup selected_workflow), and a slot
-// registered into a group restricted to a different workflow would take that workflow's jobs and
-// never its own. So the slot carries its intended workflow -- the microVM slot's is the shakedown's,
-// derived; a host-unit slot's is its caller's -- and the mint compares the two before it uses the
+// THE WORKFLOW A SUBJECT EXISTS TO RUN. A restricted group is observed restricted to ONE workflow
+// (gunbc.runner_group_restriction_observation RestrictedRunnerGroup selected_workflow), and a
+// registration into a group restricted to a different workflow would take that workflow's jobs and
+// never its own. So the mint compares the subject's workflow with the group's before it uses the
 // group id at all.
-fn jit_slot_workflow(slot: JitSlot) -> NonEmptyStr {
-  match slot {
-    MicroVmJitSlot { attempt: _ } => microvm_shakedown_selected_workflow()
-    HostUnitJitSlot { slot: h } => h.workflow
-  }
-}
-
-fn jit_slot_registration_labels(slot: JitSlot) -> List<String> {
-  match slot {
-    MicroVmJitSlot { attempt: a } => microvm_attempt_registration_labels(attempt: a)
-    HostUnitJitSlot { slot: h } => h.labels
-  }
-}
 
 data microvm_jit_runner_group_restriction_frontier: DissolutionCondition = unbound_dissolution(
   description: "NAMED CONSUMER: plan_jit_mint, which refuses every RunnerGroupRestrictionRefused (JitMintRefusedRunnerGroupUnrestricted). The controller now passes the sealed observer's result over a live read under its installation token (gunbc.runner_microvm_slot_controller mint_attempt_credential), so the code half of this row's trigger has fired; the remaining half is a fact about the organization, and until it holds every real attempt refuses at the mint with RunnerGroupAbsent. TRIGGER: the organization holds the group microvm_shakedown_runner_group_name restricted to exactly microvm_shakedown_selected_workflow, created by one run of fleet-converge mode microvm_runner_group_ensure (gunbc.runner_group_restriction_ensure_run) under one operator approval, with its readback receipt recorded. SUFFICIENT FOR deleting this row: a JIT registration that received the OS and architecture defaults still cannot take a witnesses.yml, heal.yml or fleet-converge job. Until then every real attempt refuses at the mint." as NonEmptyStr,
 )
 
 fn jit_config_request_for(
-  slot: JitSlot,
+  subject: JitRegistrationSubject,
   runner_group_id: JitRunnerGroupId,
 ) -> JitRunnerConfigRequest {
   JitRunnerConfigRequest {
-    name: jit_slot_runner_name(slot: slot),
+    name: subject.name,
     runner_group_id: runner_group_id,
-    labels: map(jit_slot_registration_labels(slot: slot), l => JitRunnerLabel { value: l as NonEmptyStr }),
+    labels: map(subject.labels, l => JitRunnerLabel { value: l as NonEmptyStr }),
     work_folder: jit_guest_work_folder,
   }
 }
 
-type JitSlotResolution
-  = JitSlotResolved { slot: JitSlot }
-  | JitSlotUnresolved { refusal: JitMintPlan }
-
-fn resolve_jit_slot(binding: JitSlotBinding) -> JitSlotResolution {
-  match binding {
-    MicroVmSlotBinding { binding: b } =>
-      match b {
-        VmUnboundCellNotOwned { cause: c } => JitSlotUnresolved { refusal: JitMintRefusedCellNotOwned { cause: c } }
-        VmBoundToOwnedCell {
-          attempt: attempt,
-          rootfs_path: _,
-          vm_config_path: _,
-          unit_name: _,
-          slice_property: _,
-        } => JitSlotResolved { slot: MicroVmJitSlot { attempt: attempt } }
-      }
-    HostUnitSlotBinding { standing: st } =>
-      match st {
-        HostUnitSlotRefused { refusal: r } => JitSlotUnresolved { refusal: JitMintRefusedHostUnitSlot { refusal: r } }
-        HostUnitSlotBound { slot: h } => JitSlotResolved { slot: HostUnitJitSlot { slot: h } }
-      }
-  }
-}
-
 fn plan_jit_mint(
-  binding: JitSlotBinding,
+  subject: JitRegistrationSubjectStanding,
   authority: GitHubCredentialAuthority,
   control_plane: GitHubAppControlPlaneState,
   organization: GitHubOrganizationRef,
   runner_group: MicrovmRunnerGroupStanding,
   attempt_binding: JitAdmissionAxisStanding
 ) -> JitMintPlan {
-  match resolve_jit_slot(binding: binding) {
-    JitSlotUnresolved { refusal: r } => r
-    JitSlotResolved { slot: slot } =>
+  match subject {
+    JitRegistrationSubjectRefused { refusal: r } => JitMintRefusedSubject { refusal: r }
+    JitRegistrationSubjectProven { subject: subject } =>
       if credential_authorizes(
            authority: authority,
            control_plane: control_plane,
@@ -200,16 +111,16 @@ fn plan_jit_mint(
             RunnerGroupRestrictionRefused { name: n, cause: c } =>
               JitMintRefusedRunnerGroupUnrestricted { group: n, cause: c }
             RunnerGroupRestrictedToWorkflow { restriction: r } =>
-              if (r.selected_workflow as String) != (jit_slot_workflow(slot: slot) as String) {
+              if (r.selected_workflow as String) != (subject.workflow as String) {
                 JitMintRefusedRunnerGroupForAnotherWorkflow {
                   group: r.name,
                   selected: r.selected_workflow,
-                  intended: jit_slot_workflow(slot: slot),
+                  intended: subject.workflow,
                 }
               } else {
                 JitMintAuthorized {
-                  slot: slot,
-                  request: jit_config_request_for(slot: slot, runner_group_id: r.group),
+                  subject: subject,
+                  request: jit_config_request_for(subject: subject, runner_group_id: r.group),
                 }
               }
           }
diff --git a/dag/gunbc/runner/runner_jit_perform.dag b/dag/gunbc/runner/runner_jit_perform.dag
index 90359964001..21e2f72e269 100644
--- a/dag/gunbc/runner/runner_jit_perform.dag
+++ b/dag/gunbc/runner/runner_jit_perform.dag
@@ -18,11 +18,11 @@ import gunbc.auth.github_credential {
   CredentialCapability,
 }
 import gunbc.runner.runner_jit_admission { JitAdmissionAxisStanding }
-import gunbc.runner.runner_host_unit_slot { HostUnitSlotRefusal }
+import gunbc.runner.jit_registration_subject { JitRegistrationSubject, JitRegistrationSubjectStanding, JitRegistrationSubjectRefusal }
 import gunbc.runner_group_restriction_observation { MicrovmRunnerGroupStanding, RunnerGroupRestrictionRefusal }
 import gunbc.runner_jit_mint {
-  JitSlotBinding, JitSlot, JitMintRefusedHostUnitSlot,
-  JitMintPlan, JitMintAuthorized, JitMintRefusedRunnerGroupForAnotherWorkflow, JitMintRefusedCellNotOwned, JitMintRefusedCredential,
+  JitMintRefusedSubject,
+  JitMintPlan, JitMintAuthorized, JitMintRefusedRunnerGroupForAnotherWorkflow, JitMintRefusedCredential,
   JitMintRefusedAttemptUnbound, JitMintRefusedRunnerGroupUnrestricted, plan_jit_mint,
 }
 
@@ -69,8 +69,7 @@ data runner_jit_perform_disposition: ConstructionMechanism = SingleAuthority
 // exhaustive match on JitMintPlan, so a new plan arm fails to compile here rather than falling into
 // a default that silently reports the wrong cause.
 type JitDispatchRefusal
-  = DispatchRefusedCellNotOwned { cause: String }
-  | DispatchRefusedHostUnitSlot { refusal: HostUnitSlotRefusal }
+  = DispatchRefusedSubject { refusal: JitRegistrationSubjectRefusal }
   | DispatchRefusedCredential {
       organization: NonEmptyStr
       unsatisfied: List<CredentialCapability>
@@ -107,7 +106,7 @@ type JitMintDispatch
 // admit_callers-sealed, as is every admitted caller that returns the dispatch onward: an admitted
 // call edge does not confine a value an exported wrapper hands back.
 type AuthorizedJitMintDispatch sole_constructor {
-  slot: JitSlot
+  subject: JitRegistrationSubject
   app: DeclaredGitHubApp
   installation: GitHubAppInstallationId
   organization: GitHubOrganizationRef
@@ -128,7 +127,7 @@ fn authority_installation(authority: GitHubCredentialAuthority) -> AuthorityInst
 }
 
 fn dispatch_jit_mint(
-  binding: JitSlotBinding,
+  subject: JitRegistrationSubjectStanding,
   authority: GitHubCredentialAuthority,
   control_plane: GitHubAppControlPlaneState,
   organization: GitHubOrganizationRef,
@@ -138,19 +137,22 @@ fn dispatch_jit_mint(
   decl_ref(module_path: "gunbc.runner_microvm_slot_controller", decl_name: "attempt_dispatch"),
   decl_ref(module_path: "test.claim.github_app_registry", decl_name: "dispatched"),
   decl_ref(module_path: "test.claim.github_app_registry", decl_name: "witness_jit_dispatch_refuses_when_the_attempt_binding_is_deferred"),
+  decl_ref(module_path: "test.claim.runner_qualification_dispatch_witness", decl_name: "the_real_mint_admits_the_attempt_through_the_sealed_subject"),
+  decl_ref(module_path: "test.claim.runner_attempt_launch_witness", decl_name: "planned_with"),
+  decl_ref(module_path: "test.claim.runner.runner_microvm_slot_controller_witness_test", decl_name: "delivered_mint"),
+  decl_ref(module_path: "test.claim.runner_qualification_dispatch_witness", decl_name: "a_delivery_from_another_dispatch_on_the_same_slot_refuses"),
+  decl_ref(module_path: "test.claim.runner_qualification_dispatch_witness", decl_name: "the_production_mint_over_todays_fleet_converge_workflow_refuses_at_the_attempt_input"),
 ] {
   match plan_jit_mint(
-    binding: binding,
+    subject: subject,
     authority: authority,
     control_plane: control_plane,
     organization: organization,
     runner_group: runner_group,
     attempt_binding: attempt_binding,
   ) {
-    JitMintRefusedCellNotOwned { cause: c } =>
-      JitMintDispatchRefused { refusal: DispatchRefusedCellNotOwned { cause: c } }
-    JitMintRefusedHostUnitSlot { refusal: r } =>
-      JitMintDispatchRefused { refusal: DispatchRefusedHostUnitSlot { refusal: r } }
+    JitMintRefusedSubject { refusal: r } =>
+      JitMintDispatchRefused { refusal: DispatchRefusedSubject { refusal: r } }
     JitMintRefusedAttemptUnbound { cause: c } =>
       JitMintDispatchRefused { refusal: DispatchRefusedAttemptUnbound { cause: c } }
     JitMintRefusedRunnerGroupUnrestricted { group: g, cause: c } =>
@@ -162,7 +164,7 @@ fn dispatch_jit_mint(
         refusal: DispatchRefusedCredential { organization: org, unsatisfied: u },
       }
     JitMintAuthorized {
-      slot: slot,
+      subject: subject,
       request: request,
     } =>
       match authority_installation(authority: authority) {
@@ -175,7 +177,7 @@ fn dispatch_jit_mint(
         Present { value: held } =>
           JitMintDispatchAuthorized {
             dispatch: AuthorizedJitMintDispatch {
-              slot: slot,
+              subject: subject,
               app: held.app,
               installation: held.installation,
               organization: organization,
@@ -201,29 +203,57 @@ fn dispatch_jit_mint(
 // mitigatable, and its next-rung trigger is a substrate capability for naming a sum minus one of
 // its arms, which does not exist today. Duplicating the vocabulary to reach rung four would trade a
 // state no fold writes for a fork that drifts.
+// THE SUCCESSFUL DELIVERY IS SEALED, AND IT CARRIES THE WHOLE AUTHORIZED DISPATCH THAT PRODUCED IT.
+// receive_jit_mint is its only constructor, so the credential, the runner id GitHub returned and the
+// dispatch -- App, installation, organization and the complete request (name, runner group, labels,
+// work folder) -- are one value no caller can re-assemble. An open arm holding these as separate
+// fields let a holder of two deliveries rewrap one's credential with the other's dispatch; a consumer
+// that needs to know which mint a credential came from (gunbc.runner.runner_qualification_dispatch)
+// compares bound.dispatch with its own sealed dispatch, which covers the complete request.
+type BoundJitCredential sole_constructor {
+  dispatch: AuthorizedJitMintDispatch
+  credential: EncodedJitConfig
+  runner_id: Int
+}
+
+fn bound_jit_subject(bound: BoundJitCredential) -> JitRegistrationSubject {
+  bound.dispatch.subject
+}
+
 type JitCredentialDelivery
-  = JitCredentialBoundToAttempt {
-      slot: JitSlot
-      credential: EncodedJitConfig
-      runner_id: Int
-    }
+  = JitCredentialBoundToAttempt { bound: BoundJitCredential }
   | JitCredentialNotDispatched { refusal: JitDispatchRefusal }
   | JitCredentialMintNotCreated { outcome: JitConfigMintOutcome }
 
+// THE MINT IS ADMITTED ONLY WHERE A RESPONSE IS BOUND TO ITS REQUEST. receive_jit_mint pairs a
+// dispatch with an outcome it is handed, so an open call relabels any delivery's credential under any
+// authorized dispatch: receive_jit_mint(dispatch: A, outcome: JitConfigMinted { B's credential, B's
+// runner id }) carries bound.dispatch == A and passes every equality on the dispatch. Production
+// reaches it only through gunbc.github_effect_perform jit_mint_performance_of_generate, which is
+// itself admitted only from the perform function that sends dispatch.request and decodes GitHub's
+// answer to that request. Every other admitted caller is a claim returning Bool, or a fixture
+// returning a value that carries no delivery, so no admitted edge hands a delivery back out.
 fn receive_jit_mint(
   dispatch: JitMintDispatch,
   outcome: JitConfigMintOutcome
-) -> JitCredentialDelivery {
+) -> JitCredentialDelivery admit_callers: [
+  decl_ref(module_path: "gunbc.github_effect_perform", decl_name: "jit_mint_performance_of_generate"),
+  decl_ref(module_path: "test.claim.github_app_registry", decl_name: "witness_a_refused_dispatch_delivers_nothing_even_from_a_minted_credential"),
+  decl_ref(module_path: "test.claim.github_app_registry", decl_name: "witness_an_authorized_dispatch_delivers_nothing_when_the_mint_was_not_created"),
+  decl_ref(module_path: "test.claim.github_app_registry", decl_name: "witness_a_minted_credential_is_bound_to_the_dispatched_attempt"),
+  decl_ref(module_path: "test.claim.runner.runner_microvm_slot_controller_witness_test", decl_name: "delivered_mint"),
+  decl_ref(module_path: "test.claim.runner_qualification_dispatch_witness", decl_name: "the_real_mint_admits_the_attempt_through_the_sealed_subject"),
+  decl_ref(module_path: "test.claim.runner_qualification_dispatch_witness", decl_name: "the_production_mint_over_todays_fleet_converge_workflow_refuses_at_the_attempt_input"),
+  decl_ref(module_path: "test.claim.runner_qualification_dispatch_witness", decl_name: "a_delivery_from_another_dispatch_on_the_same_slot_refuses"),
+  decl_ref(module_path: "test.claim.runner_attempt_launch_witness", decl_name: "planned_with"),
+] {
   match dispatch {
     JitMintDispatchRefused { refusal: r } => JitCredentialNotDispatched { refusal: r }
     JitMintDispatchAuthorized { dispatch: authorized } => {
-      let slot = authorized.slot
       match outcome {
         JitConfigMinted { config: config, runner_id: runner_id } =>
           JitCredentialBoundToAttempt {
-            slot: slot,
-            credential: config,
-            runner_id: runner_id,
+            bound: BoundJitCredential { dispatch: authorized, credential: config, runner_id: runner_id },
           }
         JitConfigMintRefused { status: s, reason: reason } =>
           JitCredentialMintNotCreated {
@@ -244,11 +274,7 @@ fn receive_jit_mint(
 
 fn jit_credential_delivered(delivery: JitCredentialDelivery) -> Bool {
   match delivery {
-    JitCredentialBoundToAttempt {
-      slot: _,
-      credential: _,
-      runner_id: _,
-    } => true
+    JitCredentialBoundToAttempt { bound: _ } => true
     JitCredentialNotDispatched { refusal: _ } => false
     JitCredentialMintNotCreated { outcome: _ } => false
   }
diff --git a/dag/gunbc/runner/runner_microvm_lifecycle_realize.dag b/dag/gunbc/runner/runner_microvm_lifecycle_realize.dag
index 32513bd0fb5..b343ec89a76 100644
--- a/dag/gunbc/runner/runner_microvm_lifecycle_realize.dag
+++ b/dag/gunbc/runner/runner_microvm_lifecycle_realize.dag
@@ -1,10 +1,11 @@
 module gunbc.runner_microvm_lifecycle_realize
 
 import extdeps.systemd.journalctl
-import gunbc.runner_microvm_network_observe { observe_slot_network_readings }
+import gunbc.runner_microvm_network_sanitation_observe { observe_slot_network_readings }
 import extdeps.virtualization.firecracker { FirecrackerVmConfig, firecracker_vm_config_document }
 
 import std.types { String, NonEmptyStr, Bool, List, Int }
+import std.optional { Present, Absent }
 import std.nat { Nat }
 import std.checked_arithmetic { checked_int_magnitude, CheckedNatReady, CheckedNatOverflow }
 import extdeps.clock { clock_unix_millis_read, epoch_secs_of_millis, ClockUnixMillisObserved, ClockUnixMillisRefused }
@@ -162,6 +163,8 @@ type CgroupWalkNode { path: NonEmptyStr, pids: List<Int> }
 
 type CgroupWalk { nodes: List<CgroupWalkNode> }
 
+type CgroupWalkPending { path: NonEmptyStr, depth: Int }
+
 fn cgroup_procs_path(cgroup_path: NonEmptyStr) -> NonEmptyStr {
   cgroup_v2_child_path(parent: cgroup_path, child: cgroup_v2_procs_interface_file)
 }
@@ -192,17 +195,26 @@ fn cgroup_child_names(cgroup_path: NonEmptyStr) -> List<String>
 
 fn walk_cgroup(cgroup_path: NonEmptyStr, depth: Int) -> CgroupWalk
 {
-  let here = CgroupWalkNode { path: cgroup_path, pids: cgroup_procs_pids(cgroup_path: cgroup_path) }
-  if depth <= 0 {
-    CgroupWalk { nodes: [here] }
-  } else {
-    fold(cgroup_child_names(cgroup_path: cgroup_path), init: CgroupWalk { nodes: [here] }, f: (acc, name) =>
-      CgroupWalk {
-        nodes: concat(
-          acc.nodes,
-          walk_cgroup(cgroup_path: cgroup_v2_child_path(parent: cgroup_path, child: trim(s: name) as NonEmptyStr), depth: depth - 1).nodes,
-        ),
-      })
+  walk_cgroup_pending(pending: [CgroupWalkPending { path: cgroup_path, depth: depth }], nodes: [])
+}
+
+// The subtree walk in tail position, so the Rust realization lowers it to a loop. The pending
+// list is the unvisited frontier in preorder: a node's children go ahead of its later siblings,
+// so nodes come out in the order the nested walk produced, and each cgroup is read the same way.
+fn walk_cgroup_pending(pending: List<CgroupWalkPending>, nodes: List<CgroupWalkNode>) -> CgroupWalk
+{
+  match pending.first() {
+    Absent => CgroupWalk { nodes: nodes }
+    Present { value: next } => {
+      let here = CgroupWalkNode { path: next.path, pids: cgroup_procs_pids(cgroup_path: next.path) }
+      let children = if next.depth <= 0 {
+        []
+      } else {
+        map(cgroup_child_names(cgroup_path: next.path), name =>
+          CgroupWalkPending { path: cgroup_v2_child_path(parent: next.path, child: trim(s: name) as NonEmptyStr), depth: next.depth - 1 })
+      }
+      walk_cgroup_pending(pending: concat(children, pending.skip(n: 1)), nodes: concat(nodes, [here]))
+    }
   }
 }
 
diff --git a/dag/gunbc/runner/runner_microvm_network.dag b/dag/gunbc/runner/runner_microvm_network.dag
index 54d627c85bd..56d32a0655c 100644
--- a/dag/gunbc/runner/runner_microvm_network.dag
+++ b/dag/gunbc/runner/runner_microvm_network.dag
@@ -644,6 +644,10 @@ fn runner_slot_netdev_text(net: RunnerSlotNetwork, owner: NonEmptyStr) -> String
 // ConfigureWithoutCarrier IS REQUIRED AND IS NOT A TUNING KNOB. A tap has no carrier until a guest
 // opens it, so without this networkd leaves the address unassigned and the host has no route to a
 // guest that has not booted yet -- which is every guest, at the moment the VM is configured.
+// systemd v255 link_ipv6_enabled and link_update_ipv6_sysctl enable IPv6 when networkd owns
+// an IPv6 link-local policy. Disable that policy as well as the per-TAP sysctl:
+// https://github.com/systemd/systemd/blob/v255/src/network/networkd-link.c
+// https://github.com/systemd/systemd/blob/v255/src/network/networkd-sysctl.c
 fn runner_slot_network_file_text(net: RunnerSlotNetwork) -> String {
   join([
     "[Match]\n",
@@ -652,6 +656,8 @@ fn runner_slot_network_file_text(net: RunnerSlotNetwork) -> String {
     "[Network]\n",
     "Address=", runner_slot_host_cidr(net: net), "\n",
     "ConfigureWithoutCarrier=yes\n",
+    "LinkLocalAddressing=no\n",
+    "IPv6AcceptRA=no\n",
   ], "")
 }
 
@@ -740,7 +746,8 @@ fn runner_slot_network_install_operations(
 // path. A job-user-writable receipt that root believes is the rostered root-equivalence class with
 // the principals swapped, so the local observe mode's target/ report is a diagnostic and never
 // this path.
-data runner_microvm_converged_receipt_path: String = "/var/lib/gunbc/microvm-network/converged-slot-network.txt"
+data runner_microvm_converged_receipt_root: String = "/var/lib/gunbc/microvm-network"
+data runner_microvm_converged_receipt_path: String = concat(runner_microvm_converged_receipt_root, "/converged-slot-network.txt")
 
 // THE DIRECTORY IS THE AUTHORITY AND THE FILE PATH IS DERIVED FROM IT, so the place the ruleset is
 // installed and the place the install ensures exists cannot become two facts. Spelling the leaf as
diff --git a/dag/gunbc/runner/runner_microvm_network_apply.dag b/dag/gunbc/runner/runner_microvm_network_apply.dag
index 59921cc29d6..3e7e914f3d0 100644
--- a/dag/gunbc/runner/runner_microvm_network_apply.dag
+++ b/dag/gunbc/runner/runner_microvm_network_apply.dag
@@ -2,11 +2,19 @@ module gunbc.runner_microvm_network_apply
 
 import std.types { String, NonEmptyStr, List, Bool, Int, FilePath }
 import std.algebra { trim }
+import extdeps.exec.command { ArgvCommand, argv_words, LocalExec }
+import extdeps.sudo.elevation { sudo_elevate_command }
+import gunbc.command_runner { run_shell_command_observe_outcome }
+import extdeps.shell.exec { ProcessRan, ProcessNotSpawned }
+import gunbc.live_deploy.candidate { CandidateCheckoutObservation, CandidateCheckoutClean, CandidateCheckoutDirty, CandidateCheckoutUnobservable, observe_candidate_checkout }
+import gunbc.hostname_read { hostname_short_read, HostnameShortCaptured, HostnameShortCaptureRefused }
 import std.process { ProcessExit, ExitSuccess, exit_failure }
 import std.content_hash { Sha256Digest, sha256_hex_digest }
 import extdeps.filesystem.filesystem_io { Filesystem }
 import extdeps.tools.sha256sum { Sha256FileDigest, Sha256FileDigestUnavailable, sha256sum_stdin_digest_via_shell }
 import extdeps.git
+import extdeps.shell
+import extdeps.tools.gnu_coreutils { mv_exact_destination_command }
 import extdeps.git.inspect
 import product.host_identity { HostIdentity }
 import gunbc.output_policy { ExpectSuccess }
@@ -14,7 +22,7 @@ import gunbc.clock_read { clock_now_probed_at, probed_at_word }
 import gunbc.actions_run_binding {
   actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent,
   fleet_converge_expected_host_env_name, rlm_expected_revision_env_name,
-  read_expected_revision, ExpectedRevisionPresent, ExpectedRevisionAbsent,
+  read_expected_revision, ExpectedRevisionPresent, ExpectedRevisionAbsent, ExpectedRevisionMalformed,
 }
 import gunbc.fleet_ssh_locus { prepare_fleet_ssh_agent_context, FleetSshContextReady, FleetSshContextRefused }
 import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext, SshTarget }
@@ -25,7 +33,7 @@ import gunbc.typed_argv_exec { typed_argv_exec_over_fleet_ssh, TypedArgvExecConv
 import gunbc.typed_remote_file_write {
   RemoteFileMode, RemoteFileModeOwnerReadWrite, RemoteFileViaNonInteractiveSudo,
   TypedRemoteFileConverged, TypedRemoteFileConvergenceRefused,
-  typed_remote_file_write_seal, converge_typed_remote_file,
+  typed_remote_file_write_seal, converge_typed_remote_file, TypedRemoteFileWriteAdmissionRefused, TypedRemoteFileWriteAdmitted,
 }
 import gunbc.runner_host_deploy {
   RunnerHostDeploy, runner_host_deploy_for, runner_slot_identities_of,
@@ -40,15 +48,16 @@ import gunbc.runner_host_file_converge {
 import gunbc.build_cache_instance { RunnerSlotIdentity }
 import extdeps.tools { CliTool, apt_package_of }
 import gunbc.host_cli_dependency { microvm_network_host_cli_requirements }
-import gunbc.host_effect { HostEffectTransport, FleetSsh }
+import gunbc.host_effect { HostEffectTransport, FleetSsh, LocalShell, SshShell, EmitArtifactThenThinRun }
 import gunbc.host_effect_realize {
   Srv3HostPredicate,
   Srv3PredicateHolds,
   Srv3PredicateFails,
   Srv3PredicateUnobserved,
   srv3_ensure_apt_tool,
+  srv3_read_token, Srv3EffectiveUserId, Srv3TokenObserved, Srv3TokenAbsent, Srv3TokenUnobserved,
 }
-import gunbc.executor_privileged_operation { ExecutorPrivilegedOperation, EnsureOwnedDirectory, executor_privileged_operation_argv }
+import gunbc.executor_privileged_operation { ExecutorPrivilegedOperation, EnsureOwnedDirectory, executor_privileged_operation_argv, executor_privileged_operation_elevated_command }
 import gunbc.runner_microvm_network {
   runner_microvm_shared_host_grain,
   runner_microvm_nft_read_operation,
@@ -220,13 +229,23 @@ type ApplyLeg
 
 fn run_admin_leg(
   subject: MicrovmNetworkApplySubject,
-  context: FleetSshExecutionContext,
-  argv: List<String>,
+  transport: HostEffectTransport,
+  command: ArgvCommand,
 ) -> ApplyLeg
 {
-  match typed_argv_exec_over_fleet_ssh(target: subject.target, context: context, argv: argv) {
-    TypedArgvExecRefused { reason: why } => ApplyLegRefused { reason: why }
-    TypedArgvExecConverged { result: r } => ApplyLegRan { exit_code: r.exit_code, stdout: r.stdout, stderr: r.stderr }
+  match transport {
+    FleetSsh { target, context } => match typed_argv_exec_over_fleet_ssh(target: target, context: context, argv: argv_words(command: command)) {
+      TypedArgvExecRefused { reason: why } => ApplyLegRefused { reason: why }
+      TypedArgvExecConverged { result: r } => ApplyLegRan { exit_code: r.exit_code, stdout: r.stdout, stderr: r.stderr }
+    }
+    LocalShell => match run_shell_command_observe_outcome(command: command, transport: LocalExec) {
+      ProcessNotSpawned { program: _, cause } => ApplyLegRefused { reason: cause as String }
+      ProcessRan { observation: run } => {
+        ApplyLegRan { exit_code: run.exit_code, stdout: run.stdout, stderr: run.stderr }
+      }
+    }
+    SshShell { ssh_host: _ } => ApplyLegRefused { reason: "network administration requires a verified fleet session or the local administrator" }
+    EmitArtifactThenThinRun { bootstrap: _, invocation: _ } => ApplyLegRefused { reason: "network administration cannot use artifact-only transport" }
   }
 }
 
@@ -236,10 +255,10 @@ type AdministratorPrivilege
 
 fn observe_administrator_privilege(
   subject: MicrovmNetworkApplySubject,
-  context: FleetSshExecutionContext,
+  transport: HostEffectTransport,
 ) -> AdministratorPrivilege
 {
-  match run_admin_leg(subject: subject, context: context, argv: elevated_argv(command: ["true"])) {
+  match run_admin_leg(subject: subject, transport: transport, command: sudo_elevate_command(command: ["true"])) {
     ApplyLegRefused { reason: why } => AdministratorPrivilegeMissing { reason: why }
     ApplyLegRan { exit_code: c, stdout: _, stderr: e } =>
       if c == 0 {
@@ -264,17 +283,22 @@ fn observe_administrator_privilege(
 // produced the defect. Split out as its own row so a claim can discriminate the sudo prefix without
 // a host.
 fn runner_microvm_root_only_probe_argv(paths: List<String>, kind: String) -> List<String> {
-  elevated_argv(command: runner_host_root_only_find_argv(paths: paths, kind: kind))
+  argv_words(command: runner_microvm_root_only_probe_command(paths: paths, kind: kind))
+}
+
+fn runner_microvm_root_only_probe_command(paths: List<String>, kind: String) -> ArgvCommand {
+  sudo_elevate_command(command: runner_host_root_only_find_argv(paths: paths, kind: kind))
 }
 
 fn observe_paths_root_only(
   subject: MicrovmNetworkApplySubject,
-  context: FleetSshExecutionContext,
+  transport: HostEffectTransport,
   paths: List<String>,
   kind: String,
 ) -> RunnerHostPathMetadata
 {
-  match run_admin_leg(subject: subject, context: context, argv: runner_microvm_root_only_probe_argv(paths: paths, kind: kind)) {
+  match run_admin_leg(subject: subject, transport: transport,
+    command: runner_microvm_root_only_probe_command(paths: paths, kind: kind)) {
     ApplyLegRefused { reason: why } => PathsUnobservable { reason: why }
     ApplyLegRan { exit_code: c, stdout: o, stderr: e } => classify_root_only_paths(requested: paths, exit_code: c, stdout: o, stderr: e)
   }
@@ -293,14 +317,14 @@ fn staging_dir_ensure_operation() -> ExecutorPrivilegedOperation {
 
 fn run_operation(
   subject: MicrovmNetworkApplySubject,
-  context: FleetSshExecutionContext,
+  transport: HostEffectTransport,
   op: ExecutorPrivilegedOperation,
 ) -> ApplyLeg
 {
   run_admin_leg(
     subject: subject,
-    context: context,
-    argv: elevated_argv(command: map(executor_privileged_operation_argv(op: op), w => w as String)),
+    transport: transport,
+    command: executor_privileged_operation_elevated_command(op: op),
   )
 }
 
@@ -346,7 +370,7 @@ type OperationSequence {
 
 fn run_operations_until_failure(
   subject: MicrovmNetworkApplySubject,
-  context: FleetSshExecutionContext,
+  transport: HostEffectTransport,
   ops: List<ExecutorPrivilegedOperation>,
 ) -> List<OperationResult>
 {
@@ -360,7 +384,7 @@ fn run_operations_until_failure(
         {
           let r = OperationResult {
             argv: elevated_argv(command: map(executor_privileged_operation_argv(op: op), w => w as String)),
-            leg: run_operation(subject: subject, context: context, op: op),
+            leg: run_operation(subject: subject, transport: transport, op: op),
           }
           OperationSequence {
             still_running: operation_result_ok(r: r),
@@ -401,29 +425,69 @@ fn staged_write_wire(r: StagedWriteResult) -> String {
 // second matters less for these files than for a key, and costs nothing.
 fn write_staged_file(
   subject: MicrovmNetworkApplySubject,
-  context: FleetSshExecutionContext,
+  transport: HostEffectTransport,
   file: StagedFile,
 ) -> StagedWriteResult
 {
   StagedWriteResult {
     path: file.path,
-    outcome: match converge_typed_remote_file(
-      target: subject.target,
-      context: context,
-      admission: typed_remote_file_write_seal(
-        path: file.path as FilePath,
-        content: file.content,
-        allowed_scope: runner_microvm_admin_staging_scope,
-      ),
-      mode: RemoteFileModeOwnerReadWrite,
-      privilege: RemoteFileViaNonInteractiveSudo,
-    ) {
-      TypedRemoteFileConvergenceRefused { step: st, reason: why } => StagedWriteRefused { step: st, reason: why }
-      TypedRemoteFileConverged { converged: _ } => StagedWritten
+    outcome: match transport {
+      FleetSsh { target, context } => match converge_typed_remote_file(
+        target: target, context: context,
+        admission: typed_remote_file_write_seal(path: file.path as FilePath,
+          content: file.content, allowed_scope: runner_microvm_admin_staging_scope),
+        mode: RemoteFileModeOwnerReadWrite, privilege: RemoteFileViaNonInteractiveSudo) {
+        TypedRemoteFileConvergenceRefused { step: st, reason: why } => StagedWriteRefused { step: st, reason: why }
+        TypedRemoteFileConverged { converged: _ } => StagedWritten
+      }
+      LocalShell => write_local_staged_file(file: file, scope: runner_microvm_admin_staging_scope)
+      SshShell { ssh_host: _ } => StagedWriteRefused { step: "transport", reason: "unanchored SSH is not an administrator transport" }
+      EmitArtifactThenThinRun { bootstrap: _, invocation: _ } => StagedWriteRefused { step: "transport", reason: "artifact-only transport cannot write host files" }
     },
   }
 }
 
+// mktemp creates the private 0600 inode; ordinary Write fills that already-owned inode.
+// Rename publishes it atomically on the same filesystem, including on a later converge.
+// WriteOwnerOnly is create-exclusive and therefore cannot update a prior staging artifact.
+// Production establishes root custody of the scope and every ancestor before calling this.
+fn write_local_staged_file(file: StagedFile, scope: FileTreeScope) -> StagedWriteOutcome {
+  match typed_remote_file_write_seal(path: file.path as FilePath, content: file.content, allowed_scope: scope) {
+    TypedRemoteFileWriteAdmissionRefused { cause } => StagedWriteRefused { step: "admission", reason: cause as String }
+    TypedRemoteFileWriteAdmitted { write: _ } => {
+      let temporary = shell.Mktemp.FileInDirectory(dir: scope.root_path as FilePath)
+      if !temporary.success { StagedWriteRefused { step: "local stage", reason: "private staging inode could not be created" } }
+      else {
+        let path = trim(s: temporary.path as String)
+        match typed_remote_file_write_seal(path: path as FilePath, content: file.content, allowed_scope: scope) {
+          TypedRemoteFileWriteAdmissionRefused { cause } => StagedWriteRefused { step: "local temporary admission", reason: cause as String }
+          TypedRemoteFileWriteAdmitted { write: _ } => {
+            let written = Filesystem.Write(path: path, content: file.content)
+            if !written.success { local_stage_cleanup_refusal(path: path, reason: written.error) }
+            else { match run_shell_command_observe_outcome(
+              command: mv_exact_destination_command(source: path, destination: file.path as String), transport: LocalExec) {
+              ProcessNotSpawned { program: _, cause } => local_stage_cleanup_refusal(path: path, reason: cause as String)
+              ProcessRan { observation } => if observation.exit_code != 0 {
+                local_stage_cleanup_refusal(path: path, reason: observation.stderr)
+              } else {
+                let read = Filesystem.Read(path: file.path as String)
+                if read.success && read.content == file.content { StagedWritten }
+                else { StagedWriteRefused { step: "local readback", reason: "staged bytes differ or cannot be read" } }
+              }
+            } }
+          }
+        }
+      }
+    }
+  }
+}
+
+fn local_stage_cleanup_refusal(path: String, reason: String) -> StagedWriteOutcome {
+  let removed = shell.Remove.FileForce(path: path as FilePath)
+  StagedWriteRefused { step: "local stage", reason: if removed.success { reason }
+    else { concat(reason, "; private staging inode cleanup also refused") } }
+}
+
 // ── The readback ─────────────────────────────────────────────────────────────────────────────────
 
 type RulesetReadback
@@ -454,10 +518,10 @@ fn listing_digest(d: Sha256FileDigest, listing: String) -> RulesetReadback {
 // which refuses; it does not fall back to the rendered text.
 fn read_back_ruleset(
   subject: MicrovmNetworkApplySubject,
-  context: FleetSshExecutionContext,
+  transport: HostEffectTransport,
 ) -> RulesetReadback
 {
-  match run_operation(subject: subject, context: context, op: runner_microvm_nft_read_operation()) {
+  match run_operation(subject: subject, transport: transport, op: runner_microvm_nft_read_operation()) {
     ApplyLegRefused { reason: why } => RulesetNotListed { reason: why }
     ApplyLegRan { exit_code: c, stdout: o, stderr: e } =>
       if c != 0 {
@@ -483,7 +547,7 @@ type HostToolPrerequisite {
   verdict: Srv3HostPredicate
 }
 
-fn ensure_host_tool(tool: CliTool, subject: MicrovmNetworkApplySubject, context: FleetSshExecutionContext) -> HostToolPrerequisite
+fn ensure_host_tool(tool: CliTool, subject: MicrovmNetworkApplySubject, transport: HostEffectTransport) -> HostToolPrerequisite
   uses net: Network
 {
   match apt_package_of(tool: tool) {
@@ -501,7 +565,7 @@ fn ensure_host_tool(tool: CliTool, subject: MicrovmNetworkApplySubject, context:
           tool: tool,
           package: p,
           require_version_probe: false,
-          transport: FleetSsh { target: subject.target, context: context },
+          transport: transport,
         ),
       }
   }
@@ -596,10 +660,10 @@ fn apply_run_text(run: MicrovmNetworkApplyRun) -> String {
 // optional: without it the run could report only that the operations exited zero.
 fn run_microvm_network_apply(
   subject: MicrovmNetworkApplySubject,
-  context: FleetSshExecutionContext,
+  transport: HostEffectTransport,
 ) -> MicrovmNetworkApplyRun
 {
-  let privilege = observe_administrator_privilege(subject: subject, context: context)
+  let privilege = observe_administrator_privilege(subject: subject, transport: transport)
   match privilege {
     AdministratorPrivilegeMissing { reason: _ } =>
       MicrovmNetworkApplyRun {
@@ -613,9 +677,9 @@ fn run_microvm_network_apply(
         readback: RulesetNotListed { reason: "the administrator holds no non-interactive sudo on this host, so nothing was staged, installed or read back" },
       }
     AdministratorPrivilegeHeld => {
-      let prerequisites = map(microvm_network_host_cli_requirements, t => ensure_host_tool(tool: t, subject: subject, context: context))
+      let prerequisites = map(microvm_network_host_cli_requirements, t => ensure_host_tool(tool: t, subject: subject, transport: transport))
       if fold(prerequisites, init: true, f: (acc, r) => acc && host_tool_prerequisite_holds(r: r)) {
-        run_privileged_microvm_network_apply(subject: subject, context: context, privilege: privilege, prerequisites: prerequisites)
+        run_privileged_microvm_network_apply(subject: subject, transport: transport, privilege: privilege, prerequisites: prerequisites)
       } else {
         MicrovmNetworkApplyRun {
           subject: subject,
@@ -653,24 +717,24 @@ fn unstaged_microvm_network_apply_run(
 
 fn run_privileged_microvm_network_apply(
   subject: MicrovmNetworkApplySubject,
-  context: FleetSshExecutionContext,
+  transport: HostEffectTransport,
   privilege: AdministratorPrivilege,
   prerequisites: List<HostToolPrerequisite>,
 ) -> MicrovmNetworkApplyRun
 {
-  let ensured = run_operation(subject: subject, context: context, op: staging_dir_ensure_operation())
+  let ensured = run_operation(subject: subject, transport: transport, op: staging_dir_ensure_operation())
   let dir = match ensured {
     ApplyLegRefused { reason: why } => PathsUnobservable { reason: concat("the staging directory could not be created: ", why) }
     ApplyLegRan { exit_code: c, stdout: _, stderr: e } =>
       if c != 0 {
         PathsUnobservable { reason: join(["the staging directory could not be created; install -d exit=", to_string(c), " ", trim(s: e)], "") }
       } else {
-        observe_paths_root_only(subject: subject, context: context, paths: staging_ancestor_paths(), kind: "d")
+        observe_paths_root_only(subject: subject, transport: transport, paths: staging_ancestor_paths(), kind: "d")
       }
   }
   match dir {
     PathsRootOnly =>
-      run_staged_microvm_network_apply(subject: subject, context: context, privilege: privilege, prerequisites: prerequisites, dir: dir)
+      run_staged_microvm_network_apply(subject: subject, transport: transport, privilege: privilege, prerequisites: prerequisites, dir: dir)
     PathsNotRootOnly { paths: _, detail: _ } => unstaged_microvm_network_apply_run(subject: subject, privilege: privilege, prerequisites: prerequisites, dir: dir)
     PathsUnobservable { reason: _ } => unstaged_microvm_network_apply_run(subject: subject, privilege: privilege, prerequisites: prerequisites, dir: dir)
     PathsNotApplicable => unstaged_microvm_network_apply_run(subject: subject, privilege: privilege, prerequisites: prerequisites, dir: dir)
@@ -700,7 +764,7 @@ fn uninstalled_microvm_network_apply_run(
 
 fn run_staged_microvm_network_apply(
   subject: MicrovmNetworkApplySubject,
-  context: FleetSshExecutionContext,
+  transport: HostEffectTransport,
   privilege: AdministratorPrivilege,
   prerequisites: List<HostToolPrerequisite>,
   dir: RunnerHostPathMetadata,
@@ -711,16 +775,16 @@ fn run_staged_microvm_network_apply(
     host: runner_microvm_shared_host_grain,
     tap_owner: subject.tap_owner,
   )
-  let staged = map(files, f => write_staged_file(subject: subject, context: context, file: f))
+  let staged = map(files, f => write_staged_file(subject: subject, transport: transport, file: f))
   let all_staged = fold(staged, init: true, f: (acc, r) => acc && staged_write_ok(r: r))
   let staged_meta = if !all_staged {
     PathsNotApplicable
   } else {
-    observe_paths_root_only(subject: subject, context: context, paths: map(files, f => f.path as String), kind: "f")
+    observe_paths_root_only(subject: subject, transport: transport, paths: map(files, f => f.path as String), kind: "f")
   }
   match staged_meta {
     PathsRootOnly => {
-        let ops = run_operations_until_failure(subject: subject, context: context, ops: microvm_network_converge_operations(slots: subject.slots))
+        let ops = run_operations_until_failure(subject: subject, transport: transport, ops: microvm_network_converge_operations(slots: subject.slots))
       let all_ops = length(ops) > 0 && fold(ops, init: true, f: (acc, r) => acc && operation_result_ok(r: r))
       MicrovmNetworkApplyRun {
         subject: subject,
@@ -731,7 +795,7 @@ fn run_staged_microvm_network_apply(
         staged_root_only: staged_meta,
         operations: ops,
         readback: if all_ops {
-          read_back_ruleset(subject: subject, context: context)
+          read_back_ruleset(subject: subject, transport: transport)
         } else {
           RulesetNotListed { reason: "an install operation did not succeed, so the listing would not describe the declared ruleset" }
         },
@@ -760,6 +824,7 @@ fn apply_expected_revision() -> String {
   match read_expected_revision() {
     ExpectedRevisionPresent { revision: r } => r
     ExpectedRevisionAbsent { variable: _, detail: _ } => ""
+    ExpectedRevisionMalformed { variable: _, value: r } => r
   }
 }
 
@@ -780,7 +845,7 @@ fn runner_microvm_network_apply_ci_wet() -> ProcessExit
       match prepare_fleet_ssh_agent_context(attempt_raw: runner_microvm_network_apply_attempt_raw) {
         FleetSshContextRefused { cause: c } => exit_failure(reason: c)
         FleetSshContextReady { context: context, receipt: context_receipt } => {
-          let run = run_microvm_network_apply(subject: subject, context: context)
+          let run = run_microvm_network_apply(subject: subject, transport: FleetSsh { target: subject.target, context: context })
           let body = join([
             "runner_microvm_network_apply probed_at=", probed_at_word(reading: clock_now_probed_at()) as String, "\n",
             context_receipt,
@@ -798,3 +863,74 @@ fn runner_microvm_network_apply_ci_wet() -> ProcessExit
       }
   }
 }
+
+
+// The same staged-file and operation folds are available on the subject host. A local caller
+// must already be root: this entry adds no grant, consumes no agent and cannot select a peer.
+fn microvm_network_local_admission(host: String, observed_host: String, effective_uid: String,
+  expected_revision: String, checked_out_revision: String) -> MicrovmNetworkApplyAdmission {
+  if trim(s: host) == "" || trim(s: host) != trim(s: observed_host) {
+    MicrovmNetworkApplyRefused { cause: "local network administration must name this host" }
+  } else if trim(s: effective_uid) != "0" {
+    MicrovmNetworkApplyRefused { cause: "local network administration requires the administrator's root process" }
+  } else { microvm_network_apply_admission(host: host, expected_revision: expected_revision,
+    checked_out_revision: checked_out_revision) }
+}
+
+fn microvm_network_local_subject(host: String, expected_revision: String) -> MicrovmNetworkApplyAdmission {
+  match observe_candidate_checkout() {
+    CandidateCheckoutClean => microvm_network_local_subject_from_clean_checkout(host: host, expected_revision: expected_revision)
+    CandidateCheckoutDirty { tracked_changes: _, staged_changes: _, untracked_deployed_paths: _, ignored_deployed_paths: _ } =>
+      MicrovmNetworkApplyRefused { cause: "local network administration requires a clean checkout of the named revision" }
+    CandidateCheckoutUnobservable { detail } => MicrovmNetworkApplyRefused { cause: detail }
+  }
+}
+
+fn microvm_network_local_subject_from_clean_checkout(host: String, expected_revision: String) -> MicrovmNetworkApplyAdmission {
+  match hostname_short_read(transport: LocalShell) {
+    HostnameShortCaptureRefused { reason } => MicrovmNetworkApplyRefused { cause: reason }
+    HostnameShortCaptured { value: actual } => {
+      let candidate = microvm_network_apply_admission(host: host, expected_revision: expected_revision,
+        checked_out_revision: apply_checked_out_revision())
+      match candidate {
+        MicrovmNetworkApplyRefused { cause } => MicrovmNetworkApplyRefused { cause: cause }
+        MicrovmNetworkApplyAdmitted { subject } => match srv3_read_token(subject: Srv3EffectiveUserId, transport: LocalShell) {
+          Srv3TokenUnobserved { reason } => MicrovmNetworkApplyRefused { cause: reason }
+          Srv3TokenAbsent =>
+            MicrovmNetworkApplyRefused { cause: "local administrator identity could not be read" }
+          Srv3TokenObserved { value: uid } => microvm_network_local_admission(host: host, observed_host: actual, effective_uid: uid,
+            expected_revision: expected_revision, checked_out_revision: subject.revision)
+        }
+      }
+    }
+  }
+}
+
+fn runner_microvm_network_plan_local_wet(host: String, expected_revision: String) -> ProcessExit {
+  match microvm_network_local_subject(host: host, expected_revision: expected_revision) {
+    MicrovmNetworkApplyRefused { cause } => exit_failure(reason: cause)
+    MicrovmNetworkApplyAdmitted { subject } => {
+      let files = converge_staged_files(slots: subject.slots, host: runner_microvm_shared_host_grain, tap_owner: subject.tap_owner)
+      let body = join(["host=", host, " revision=", subject.revision, " execution=local-root\n",
+        join(map(files, file => join(["FILE ", file.path as String, "\n", file.content, "\n"], "")), ""),
+        join(map(microvm_network_converge_operations(slots: subject.slots), op =>
+          concat(to_string(executor_privileged_operation_argv(op: op)), "\n")), "")], "")
+      let written = Filesystem.Write(path: "target/microvm-network-local-plan.txt", content: body)
+      if written.success { ExitSuccess } else { exit_failure(reason: written.error) }
+    }
+  }
+}
+
+fn runner_microvm_network_apply_local_wet(host: String, expected_revision: String) -> ProcessExit {
+  match microvm_network_local_subject(host: host, expected_revision: expected_revision) {
+    MicrovmNetworkApplyRefused { cause } => exit_failure(reason: cause)
+    MicrovmNetworkApplyAdmitted { subject } => {
+      let run = run_microvm_network_apply(subject: subject, transport: LocalShell)
+      let written = Filesystem.Write(path: runner_microvm_network_apply_receipt_path,
+        content: concat("execution=local-root\n", apply_run_text(run: run)))
+      if !written.success { exit_failure(reason: written.error) }
+      else if apply_run_succeeded(run: run) { ExitSuccess }
+      else { exit_failure(reason: apply_run_text(run: run)) }
+    }
+  }
+}
diff --git a/dag/gunbc/runner/runner_microvm_network_observe.dag b/dag/gunbc/runner/runner_microvm_network_observe.dag
index 11308eec2ff..521f2ed76fa 100644
--- a/dag/gunbc/runner/runner_microvm_network_observe.dag
+++ b/dag/gunbc/runner/runner_microvm_network_observe.dag
@@ -1,76 +1,215 @@
 module gunbc.runner_microvm_network_observe
 
-import std.types { String, NonEmptyStr, Bool }
+import std.types { String, NonEmptyStr, List }
+import gunbc.clock_read { clock_now_probed_at }
+import gunbc.runner_microvm_network_receipt_store { read_network_receipt, publish_initial_network_receipt, NetworkReceiptAbsent, NetworkReceiptPresent, StoredNetworkReceiptUnreadable }
+import gunbc.runner_microvm_network_apply { MicrovmNetworkApplySubject, microvm_network_local_subject, MicrovmNetworkApplyAdmitted, MicrovmNetworkApplyRefused }
 import std.algebra { trim }
-import std.resources { Filesystem }
-import std.content_hash { sha256_hex_digest }
-import extdeps.linux.tun_fdinfo { tun_descriptor_census_observe, TunDescriptorCensus, TunDescriptorCount, TunInterfaceMissing, TunDescriptorUnreadable }
-import extdeps.exec.command { ArgvCommand, LocalExec }
-import extdeps.shell.exec { ProcessOutputPresent, ProcessOutputAbsent }
-import extdeps.tools.sha256sum { sha256sum_stdin_digest_via_shell, Sha256FileDigest }
-import gunbc.command_runner { run_shell_command_capture }
-import gunbc.runner_microvm_network {
-  SlotNetworkSanitationSubject, SlotNetworkReadings,
-  TapHolderObservation, TapPresentUnheld, TapHeld, TapMissing, TapHoldersUnreadable,
-  TapIpv6Standing, TapIpv6Disabled, TapIpv6Enabled, TapIpv6Unread,
-  ResidueObservation, ResidueAbsent, ResiduePresent, ResidueUnreadable,
-  RulesetObservation, RulesetListed, RulesetUnreadable,
-  TapReading, TapIpv6Reading, SlotResidueReading, HostResidueReading, RulesetReading,
-  runner_slot_network, runner_slot_ipv6_disabled_proc_path,
-  runner_slot_guest_originated_conntrack_list_command, runner_slot_guest_destined_conntrack_list_command,
-  runner_slot_guest_neighbour_show_command, runner_host_expectation_list_command, runner_microvm_nft_list_command,
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+import extdeps.shell.exec { ProcessOutcome, ProcessOutputPresent, ProcessOutputAbsent, ProcessRefused }
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.tools.mkdir { mkdir_parents_command }
+import product.host_identity { HostIdentity }
+import gunbc.command_runner { run_shell_commands, run_shell_command_capture, LocalExec }
+import gunbc.hostname_read { hostname_short_read, HostnameShortCaptured, HostnameShortCaptureRefused }
+import gunbc.host_effect { HostEffectTransport, LocalShell, FleetSsh, SshShell, EmitArtifactThenThinRun }
+import gunbc.fleet_ssh_locus { prepare_fleet_ssh_agent_context, FleetSshContextReady, FleetSshContextRefused }
+import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext, SshTarget }
+import gunbc.fleet_bootstrap_principal { executor_bootstrap_principal }
+import gunbc.typed_argv_exec { typed_argv_exec_over_fleet_ssh, TypedArgvExecConverged, TypedArgvExecRefused }
+import gunbc.runner_host_deploy {
+  RunnerHostDeploy, runner_host_deploy_for,
+  RunnerHostDeployFound, RunnerHostDeployUnmodeled, RunnerHostDeployRefused,
 }
-
-fn observe_tap_holders(tap: NonEmptyStr) -> TapHolderObservation {
-  tap_holders_reading(census: tun_descriptor_census_observe(name: tap as String))
+import gunbc.runner_host_grants { bootstrap_principal_is_not_the_grantee }
+import gunbc.runner_host_file_converge { elevated_argv }
+import gunbc.build_cache_instance { RunnerSlotIdentity }
+import gunbc.executor_privileged_operation {
+  ExecutorPrivilegedOperation, ReadNftRuleset, ReadLegacyXtablesRules, ReadUserspaceConntrackHelpers,
+  ReadConntrackExpectations, executor_privileged_operation_argv, executor_privileged_operation_elevated_command,
+}
+import gunbc.runner_microvm_network { ConvergeGeneration, runner_microvm_nft_read_operation }
+import gunbc.runner_microvm_network_converge {
+  MicrovmPrivilegedReadings, ConvergedNetwork, ConvergeRefused,
+  read_slot_wet, read_host_wet, converge_outcome, receipt_text,
+  bind_requested_host, expected_host_reading, host_binding_refusal_text,
+  HostBindingHeld, HostBindingRefused, HostBindingUnnamed,
+  converge_generation_reading, runner_microvm_network_slot_identities_of,
+  runner_microvm_network_receipt_path, runner_microvm_network_receipt_dir,
 }
+import gunbc.runner_microvm_network_apply { runner_microvm_administrator_target }
 
-fn tap_holders_reading(census: TunDescriptorCensus) -> TapHolderObservation {
-  match census {
-    TunDescriptorCount { count: n, exited: _ } => if n == 0 { TapPresentUnheld } else { TapHeld { holders: n } }
-    TunInterfaceMissing => TapMissing
-    TunDescriptorUnreadable { cause: _ } => TapHoldersUnreadable { reason: "root TUN descriptor census unavailable or malformed" as NonEmptyStr }
+// THE OBSERVE READS AS TWO PRINCIPALS, AND WHICH ONE READS WHAT IS THE POINT.
+//
+// ConvergedSlotNetwork says what a host IS at a generation, so every fact it carries must be a live
+// reading. Five of them -- the installed table's listing (whose digest is the converged digest), the
+// whole ruleset, the legacy xtables rules, the userspace conntrack helpers and the conntrack
+// expectations -- are readable only by root. The job user this step runs as is granted none of
+// them, and must not be: operator decision 2026-09-22 keeps gunbc-ghrunner.sudoers modeled and
+// uninstalled, because the principal every CI step runs as holding even readbacks is a grant with
+// no need behind it once the administrator can read. So those five are read by the host's
+// ADMINISTRATOR, gunbc.fleet_bootstrap_principal executor_bootstrap_principal, over the fleet SSH
+// edge -- the same principal and the same target gunbc.runner_microvm_network_apply installs through
+// -- and everything an unprivileged principal CAN read (procfs, ip, uname) is still read locally.
+//
+// The first observe run after the apply landed (fleet-converge run 35853748081) refused with
+// `the installed ruleset could not be listed`: the listing was attempted as the job user with no
+// grant. That refusal was correct and is the reading this module answers, not one it relaxes.
+
+// A READING THAT DID NOT RUN IS NOT AN EMPTY READING. A refused edge or a non-zero exit is
+// ProcessRefused, so the fold refuses by name; only an exit-zero leg with no output is
+// ProcessOutputAbsent, which for conntrack's expectation table is a real, empty reading.
+fn admin_read_outcome(
+  target: SshTarget,
+  context: FleetSshExecutionContext,
+  op: ExecutorPrivilegedOperation,
+) -> ProcessOutcome
+{
+  let argv = elevated_argv(command: map(executor_privileged_operation_argv(op: op), w => w as String))
+  match typed_argv_exec_over_fleet_ssh(target: target, context: context, argv: argv) {
+    TypedArgvExecRefused { reason: why } => ProcessRefused { exit_code: -1, stderr: why }
+    TypedArgvExecConverged { result: r } =>
+      if r.exit_code != 0 {
+        ProcessRefused { exit_code: r.exit_code, stderr: trim(s: r.stderr) }
+      } else if r.stdout == "" {
+        ProcessOutputAbsent
+      } else {
+        ProcessOutputPresent { text: r.stdout }
+      }
   }
 }
 
-fn observe_network_residue(command: ArgvCommand) -> ResidueObservation {
-  match run_shell_command_capture(command: command, transport: LocalExec) {
-    ProcessOutputPresent { text: body } => if trim(s: body) == "" { ResidueAbsent }
-      else { ResiduePresent { entries: length(filter(split(s: body, delimiter: "\n"), line => trim(s: line) != "")) } }
-    ProcessOutputAbsent => ResidueAbsent
-    other => ResidueUnreadable { reason: "network residue listing failed" as NonEmptyStr }
+fn read_privileged_network(transport: HostEffectTransport) -> MicrovmPrivilegedReadings
+{
+  MicrovmPrivilegedReadings {
+    table: network_read_outcome(transport: transport, op: runner_microvm_nft_read_operation()),
+    ruleset: network_read_outcome(transport: transport, op: ReadNftRuleset),
+    xtables: network_read_outcome(transport: transport, op: ReadLegacyXtablesRules),
+    userspace: network_read_outcome(transport: transport, op: ReadUserspaceConntrackHelpers),
+    expectations: network_read_outcome(transport: transport, op: ReadConntrackExpectations),
   }
 }
 
-fn observe_network_ruleset() -> RulesetObservation {
-  match run_shell_command_capture(command: runner_microvm_nft_list_command(), transport: LocalExec) {
-    ProcessOutputPresent { text: body } => match sha256sum_stdin_digest_via_shell(content: body) {
-      Sha256FileDigest { digest: hashed } => match sha256_hex_digest(hex: hashed.hex as String) {
-        Present { value: actual_digest } => RulesetListed { digest: actual_digest }
-        Absent => RulesetUnreadable { reason: "listed ruleset digest malformed" as NonEmptyStr }
+data runner_microvm_network_observe_attempt_raw: String = "runner-microvm-network-observe-ci"
+
+fn runner_microvm_network_observe_wet() -> ProcessExit
+{
+  let host_reading = hostname_short_read(transport: LocalShell)
+  match host_reading {
+    HostnameShortCaptureRefused { reason: r } =>
+      exit_failure(reason: join(["microvm-network-observe: the host could not name itself: ", r], ""))
+    HostnameShortCaptured { value: name } =>
+      match bind_requested_host(expected: expected_host_reading(), observed: name) {
+        HostBindingUnnamed { detail: d } =>
+          exit_failure(reason: host_binding_refusal_text(b: HostBindingUnnamed { detail: d }))
+        HostBindingRefused { expected: e, observed: o } =>
+          exit_failure(reason: host_binding_refusal_text(b: HostBindingRefused { expected: e, observed: o }))
+        HostBindingHeld { host: bound } => observe_bound_host_wet(bound: bound)
       }
-      other => RulesetUnreadable { reason: "listed ruleset digest unavailable" as NonEmptyStr }
+  }
+}
+
+fn observe_bound_host_wet(bound: HostIdentity) -> ProcessExit
+{
+  let generation = converge_generation_reading()
+  if generation == "" {
+    exit_failure(reason: "microvm-network-observe: no run identity in the environment, so the receipt would carry a generation nobody can compare against")
+  } else {
+    match runner_host_deploy_for(host: bound) {
+      RunnerHostDeployUnmodeled { host: h } =>
+        exit_failure(reason: join(["microvm-network-observe: ", h as String, " is not a modeled runner host"], ""))
+      RunnerHostDeployRefused { host: h, cause: c } =>
+        exit_failure(reason: join(["microvm-network-observe: ", h as String, " refuses its deploy row: ", c], ""))
+      RunnerHostDeployFound { deploy: d } =>
+        observe_admitted_host_wet(deploy: d, host: bound, generation: generation as NonEmptyStr)
+    }
+  }
+}
+
+// THE READER OF THE ROOT-ONLY SURFACES MAY NOT BE THE JOB USER, for the reason the apply refuses on:
+// reading "as the administrator" when the administrator IS the job user would mean the job user
+// holds the reads, which is the grant this module exists not to need.
+fn observe_admitted_host_wet(deploy: RunnerHostDeploy, host: HostIdentity, generation: NonEmptyStr) -> ProcessExit
+{
+  if !bootstrap_principal_is_not_the_grantee(bootstrap: executor_bootstrap_principal, deploy: deploy) {
+    exit_failure(reason: join(["microvm-network-observe: the administrator principal ", executor_bootstrap_principal.login as String, " is the job user on ", host as String, ", so the root-only readings would be taken by the account CI jobs run as"], ""))
+  } else {
+    match prepare_fleet_ssh_agent_context(attempt_raw: runner_microvm_network_observe_attempt_raw) {
+      FleetSshContextRefused { cause: c } => exit_failure(reason: join(["microvm-network-observe: ", c], ""))
+      FleetSshContextReady { context: context, receipt: _ } =>
+        record_converge_readback_wet(
+          slots: runner_microvm_network_slot_identities_of(deploy: deploy),
+          host: host,
+          generation: generation,
+          reads: read_privileged_network(transport: FleetSsh { target: runner_microvm_administrator_target(host: host), context: context }),
+        )
     }
-    other => RulesetUnreadable { reason: "converged nft table could not be listed" as NonEmptyStr }
   }
 }
 
-// Actual host reads, joined by the existing subject and converge receipt. A missing tool or
-// denied kernel read is unreadable; no exited process or no-carrier state substitutes for these.
-fn observe_slot_network_readings(subject: SlotNetworkSanitationSubject) -> SlotNetworkReadings {
-  let net = runner_slot_network(slot: subject.subject.slot)
-  let ipv6 = Filesystem.Read(path: runner_slot_ipv6_disabled_proc_path(net: net))
-  let ipv6_standing = if !ipv6.success { TapIpv6Unread { reason: "tap IPv6 policy unreadable" as NonEmptyStr } }
-    else if trim(s: ipv6.content) == "1" { TapIpv6Disabled }
-    else if trim(s: ipv6.content) == "0" { TapIpv6Enabled }
-    else { TapIpv6Unread { reason: "tap IPv6 policy malformed" as NonEmptyStr } }
-  SlotNetworkReadings {
-    tap: TapReading { subject: subject.subject, observation: observe_tap_holders(tap: net.tap_device) },
-    tap_ipv6: TapIpv6Reading { subject: subject.subject, observation: ipv6_standing },
-    guest_originated_conntrack: SlotResidueReading { subject: subject.subject, observation: observe_network_residue(command: runner_slot_guest_originated_conntrack_list_command(net: net)) },
-    guest_destined_conntrack: SlotResidueReading { subject: subject.subject, observation: observe_network_residue(command: runner_slot_guest_destined_conntrack_list_command(net: net)) },
-    guest_neighbour: SlotResidueReading { subject: subject.subject, observation: observe_network_residue(command: runner_slot_guest_neighbour_show_command(net: net)) },
-    expectations: HostResidueReading { host: subject.converged.host, generation: subject.converged.generation, observation: observe_network_residue(command: runner_host_expectation_list_command()) },
-    ruleset: RulesetReading { host: subject.converged.host, generation: subject.converged.generation, observation: observe_network_ruleset() },
+fn record_converge_readback_wet(
+  slots: List<RunnerSlotIdentity>,
+  host: HostIdentity,
+  generation: NonEmptyStr,
+  reads: MicrovmPrivilegedReadings,
+) -> ProcessExit {
+  let outcome = converge_outcome(
+    slots: map(slots, s => read_slot_wet(slot: s)),
+    h: read_host_wet(host: host, generation: generation as ConvergeGeneration, reads: reads),
+  )
+  let text = receipt_text(o: outcome)
+  let _ = run_shell_commands(commands: [mkdir_parents_command(path: runner_microvm_network_receipt_dir)], transport: LocalExec)
+  let w = Filesystem.Write(path: runner_microvm_network_receipt_path, content: text)
+  if !w.success {
+    exit_failure(reason: join(["microvm-network-observe: receipt write refused: ", w.error], ""))
+  } else {
+    match outcome {
+      ConvergedNetwork { receipt: _ } => ExitSuccess
+      ConvergeRefused { refusal: _ } => exit_failure(reason: join(["microvm-network-observe: ", text], ""))
+    }
   }
 }
+
+
+fn network_read_outcome(transport: HostEffectTransport, op: ExecutorPrivilegedOperation) -> ProcessOutcome {
+  match transport {
+    FleetSsh { target, context } => admin_read_outcome(target: target, context: context, op: op)
+    LocalShell => run_shell_command_capture(command: executor_privileged_operation_elevated_command(op: op), transport: LocalExec)
+    SshShell { ssh_host: _ } => ProcessRefused { exit_code: -1, stderr: "network readback requires the local administrator or a verified fleet session" }
+    EmitArtifactThenThinRun { bootstrap: _, invocation: _ } => ProcessRefused { exit_code: -1, stderr: "network readback requires a live host" }
+  }
+}
+
+// An explicit administrator action publishes the missing controller-consumed receipt. The CI
+// observer above remains read-only apart from its job artifact. No workflow-supplied text can be
+// installed as an authoritative network generation, and this entry never overwrites one.
+fn runner_microvm_network_initialize_local_wet(host: String, expected_revision: String) -> ProcessExit {
+  match microvm_network_local_subject(host: host, expected_revision: expected_revision) {
+    MicrovmNetworkApplyRefused { cause } => exit_failure(reason: cause)
+    MicrovmNetworkApplyAdmitted { subject } => match read_network_receipt(host: subject.host) {
+      StoredNetworkReceiptUnreadable { reason } => exit_failure(reason: reason)
+      NetworkReceiptPresent { receipt } => initialize_local_network_receipt(subject: subject, generation: receipt.generation as NonEmptyStr)
+      NetworkReceiptAbsent => match clock_now_probed_at() {
+        Absent => exit_failure(reason: "network initialization clock is unavailable")
+        Present { value: now } => initialize_local_network_receipt(subject: subject,
+          generation: join(["local-", subject.revision, "-", now as String], "") as NonEmptyStr)
+      }
+    }
+  }
+}
+
+fn initialize_local_network_receipt(subject: MicrovmNetworkApplySubject, generation: NonEmptyStr) -> ProcessExit {
+  let outcome = converge_outcome(slots: map(subject.slots, slot => read_slot_wet(slot: slot)),
+    h: read_host_wet(host: subject.host, generation: generation as ConvergeGeneration,
+      reads: read_privileged_network(transport: LocalShell)))
+  let artifact = Filesystem.Write(path: runner_microvm_network_receipt_path, content: receipt_text(o: outcome))
+  if !artifact.success { exit_failure(reason: artifact.error) }
+  else { match outcome {
+    ConvergeRefused { refusal: _ } => exit_failure(reason: receipt_text(o: outcome))
+    ConvergedNetwork { receipt } => match publish_initial_network_receipt(receipt: receipt) {
+      NetworkReceiptPresent { receipt: _ } => ExitSuccess
+      NetworkReceiptAbsent => exit_failure(reason: "network receipt was not published")
+      StoredNetworkReceiptUnreadable { reason } => exit_failure(reason: reason)
+    }
+  } }
+}
diff --git a/dag/gunbc/runner/runner_microvm_network_receipt_store.dag b/dag/gunbc/runner/runner_microvm_network_receipt_store.dag
new file mode 100644
index 00000000000..bdec7762a3f
--- /dev/null
+++ b/dag/gunbc/runner/runner_microvm_network_receipt_store.dag
@@ -0,0 +1,93 @@
+module gunbc.runner_microvm_network_receipt_store
+
+import std.types { String, NonEmptyStr, Bool }
+import std.decl_ref { decl_ref }
+import product.host_identity { HostIdentity }
+import gunbc.runner_host_deploy { runner_host_deploy_for, runner_slot_identities_of,
+  RunnerHostDeployFound, RunnerHostDeployUnmodeled, RunnerHostDeployRefused }
+import gunbc.file_access { path_ancestor_prefixes }
+import gunbc.runner_microvm_cell_readiness { StoreRootOwned, StoreNotRootOwned }
+import gunbc.runner_microvm_cell_readiness_store { read_store_ownership, OwnershipRead, OwnershipUnread, entry_is_root_authoritative }
+import extdeps.filesystem.filesystem_io {
+  Filesystem, filesystem_exact_read, FilesystemExactPathRead, FilesystemExactPathAbsent,
+  FilesystemExactPathUnreadable, FilesystemExactPathKindUnrecognized,
+  filesystem_create_new, FilesystemCreated, FilesystemCreateTargetOccupied,
+  FilesystemCreateRefused, FilesystemCreateKindUnrecognized,
+}
+import gunbc.runner_microvm_network {
+  ConvergedSlotNetwork, runner_microvm_converged_receipt_path,
+  render_converged_slot_network, parse_converged_slot_network,
+  ConvergedSlotNetworkParsed, ConvergedSlotNetworkMalformed,
+}
+
+type NetworkReceiptRead
+  = NetworkReceiptAbsent
+  | NetworkReceiptPresent { receipt: ConvergedSlotNetwork }
+  | StoredNetworkReceiptUnreadable { reason: String }
+
+fn network_receipt_ancestors_owned() -> Bool {
+  all(["/"] + path_ancestor_prefixes(path: runner_microvm_converged_receipt_path), path =>
+    match read_store_ownership(path: path) {
+      OwnershipRead { ownership: StoreRootOwned } => true
+      OwnershipRead { ownership: StoreNotRootOwned { owner_uid: _, mode: _ } } => false
+      OwnershipUnread { reason: _ } => false
+    })
+}
+
+// The receipt covers the host's enrolled network population, including runner TAPs that
+// are not fabric execution cells. Consumers name the host, never a narrower workload roster.
+fn parse_host_network_receipt(text: String, host: HostIdentity) -> NetworkReceiptRead {
+  match runner_host_deploy_for(host: host) {
+    RunnerHostDeployUnmodeled { host: _ } => StoredNetworkReceiptUnreadable { reason: "network receipt host has no enrolled deployment" }
+    RunnerHostDeployRefused { host: _, cause } => StoredNetworkReceiptUnreadable { reason: cause }
+    RunnerHostDeployFound { deploy } => match parse_converged_slot_network(text: text,
+      candidates: runner_slot_identities_of(deploy: deploy)) {
+      ConvergedSlotNetworkParsed { receipt } => if receipt.host == host { NetworkReceiptPresent { receipt: receipt } }
+        else { StoredNetworkReceiptUnreadable { reason: "network receipt names another host" } }
+      ConvergedSlotNetworkMalformed { cause } => StoredNetworkReceiptUnreadable { reason: to_string(cause) }
+    }
+  }
+}
+
+fn read_network_receipt(host: HostIdentity) -> NetworkReceiptRead {
+  if !network_receipt_ancestors_owned() { StoredNetworkReceiptUnreadable { reason: "network receipt ancestors are absent or outside root custody" } }
+  else {
+    let read = Filesystem.Read(path: runner_microvm_converged_receipt_path)
+    match filesystem_exact_read(path: runner_microvm_converged_receipt_path, content: read.content,
+      success: read.success, error: read.error, error_kind: read.error_kind) {
+      FilesystemExactPathAbsent { path: _ } => NetworkReceiptAbsent
+      FilesystemExactPathUnreadable { path: _, kind: _, error } => StoredNetworkReceiptUnreadable { reason: error }
+      FilesystemExactPathKindUnrecognized { path: _, observed: _, error } => StoredNetworkReceiptUnreadable { reason: error }
+      FilesystemExactPathRead { path: _, content } => match entry_is_root_authoritative(path: runner_microvm_converged_receipt_path) {
+        Present { value: reason } => StoredNetworkReceiptUnreadable { reason: reason as String }
+        Absent => parse_host_network_receipt(text: content, host: host)
+      }
+    }
+  }
+}
+
+// Initial publication is atomic and never replaces a generation a controller may already use.
+// A rerun verifies the stored generation against fresh host readings before reaching this entry.
+fn publish_initial_network_receipt(receipt: ConvergedSlotNetwork) -> NetworkReceiptRead
+  admit_callers: [decl_ref(module_path: "gunbc.runner_microvm_network_observe", decl_name: "initialize_local_network_receipt")]
+{
+  if !network_receipt_ancestors_owned() { StoredNetworkReceiptUnreadable { reason: "network receipt store is not installed under root custody" } }
+  else {
+    let text = render_converged_slot_network(c: receipt)
+    let write = Filesystem.WriteCreateNew(path: runner_microvm_converged_receipt_path, content: text)
+    let published = match filesystem_create_new(path: runner_microvm_converged_receipt_path,
+      success: write.success, error: write.error, error_kind: write.error_kind) {
+      FilesystemCreated { path: _ } => true
+      FilesystemCreateTargetOccupied { path: _ } => true
+      FilesystemCreateRefused { path: _, kind: _, error: _ } => false
+      FilesystemCreateKindUnrecognized { path: _, observed: _, error: _ } => false
+    }
+    if !published { StoredNetworkReceiptUnreadable { reason: "network receipt publication refused" } }
+    else { match read_network_receipt(host: receipt.host) {
+      NetworkReceiptPresent { receipt: actual } => if render_converged_slot_network(c: actual) == text {
+        NetworkReceiptPresent { receipt: actual }
+      } else { StoredNetworkReceiptUnreadable { reason: "existing network generation differs; explicit recovery is required" } }
+      other => other
+    } }
+  }
+}
diff --git a/dag/gunbc/runner/runner_microvm_network_sanitation_observe.dag b/dag/gunbc/runner/runner_microvm_network_sanitation_observe.dag
new file mode 100644
index 00000000000..0ef4fe1b202
--- /dev/null
+++ b/dag/gunbc/runner/runner_microvm_network_sanitation_observe.dag
@@ -0,0 +1,83 @@
+module gunbc.runner_microvm_network_sanitation_observe
+
+import std.types { String, NonEmptyStr, Bool }
+import std.algebra { trim }
+import std.resources { Filesystem }
+import std.content_hash { sha256_hex_digest }
+import extdeps.linux.tun_fdinfo { tun_descriptor_census_observe, tun_census_refusal_text, TunDescriptorCensus, TunDescriptorCount, TunInterfaceMissing, TunDescriptorUnreadable, TunAttachedQueueRequirement, tun_attached_queue_requirement }
+import gunbc.build_cache_instance { RunnerSlotIdentity }
+import extdeps.exec.command { ArgvCommand, LocalExec }
+import extdeps.shell.exec { ProcessOutputPresent, ProcessOutputAbsent }
+import extdeps.tools.sha256sum { sha256sum_stdin_digest_via_shell, Sha256FileDigest }
+import gunbc.command_runner { run_shell_command_capture }
+import gunbc.runner_microvm_network {
+  SlotNetworkSanitationSubject, SlotNetworkReadings,
+  TapHolderObservation, TapPresentUnheld, TapHeld, TapMissing, TapHoldersUnreadable,
+  TapIpv6Standing, TapIpv6Disabled, TapIpv6Enabled, TapIpv6Unread,
+  ResidueObservation, ResidueAbsent, ResiduePresent, ResidueUnreadable,
+  RulesetObservation, RulesetListed, RulesetUnreadable,
+  TapReading, TapIpv6Reading, SlotResidueReading, HostResidueReading, RulesetReading,
+  runner_slot_network, runner_slot_ipv6_disabled_proc_path,
+  runner_slot_guest_originated_conntrack_list_command, runner_slot_guest_destined_conntrack_list_command,
+  runner_slot_guest_neighbour_show_command, runner_host_expectation_list_command, runner_microvm_nft_list_command,
+}
+
+// The selected sanitation reader owns its environmental demand. Commissioning consumes this
+// same requirement; host policy chooses a provider only if this operation is unsupported.
+fn slot_network_tun_queue_requirement(slot: RunnerSlotIdentity) -> TunAttachedQueueRequirement {
+  tun_attached_queue_requirement(name: runner_slot_network(slot: slot).tap_device)
+}
+
+fn observe_tap_holders(tap: NonEmptyStr) -> TapHolderObservation {
+  tap_holders_reading(census: tun_descriptor_census_observe(name: tap as String))
+}
+
+fn tap_holders_reading(census: TunDescriptorCensus) -> TapHolderObservation {
+  match census {
+    TunDescriptorCount { count: n, exited: _ } => if n == 0 { TapPresentUnheld } else { TapHeld { holders: n } }
+    TunInterfaceMissing => TapMissing
+    TunDescriptorUnreadable { cause } => TapHoldersUnreadable { reason: tun_census_refusal_text(cause: cause) as NonEmptyStr }
+  }
+}
+
+fn observe_network_residue(command: ArgvCommand) -> ResidueObservation {
+  match run_shell_command_capture(command: command, transport: LocalExec) {
+    ProcessOutputPresent { text: body } => if trim(s: body) == "" { ResidueAbsent }
+      else { ResiduePresent { entries: length(filter(split(s: body, delimiter: "\n"), line => trim(s: line) != "")) } }
+    ProcessOutputAbsent => ResidueAbsent
+    other => ResidueUnreadable { reason: "network residue listing failed" as NonEmptyStr }
+  }
+}
+
+fn observe_network_ruleset() -> RulesetObservation {
+  match run_shell_command_capture(command: runner_microvm_nft_list_command(), transport: LocalExec) {
+    ProcessOutputPresent { text: body } => match sha256sum_stdin_digest_via_shell(content: body) {
+      Sha256FileDigest { digest: hashed } => match sha256_hex_digest(hex: hashed.hex as String) {
+        Present { value: actual_digest } => RulesetListed { digest: actual_digest }
+        Absent => RulesetUnreadable { reason: "listed ruleset digest malformed" as NonEmptyStr }
+      }
+      other => RulesetUnreadable { reason: "listed ruleset digest unavailable" as NonEmptyStr }
+    }
+    other => RulesetUnreadable { reason: "converged nft table could not be listed" as NonEmptyStr }
+  }
+}
+
+// Actual host reads, joined by the existing subject and converge receipt. A missing tool or
+// denied kernel read is unreadable; no exited process or no-carrier state substitutes for these.
+fn observe_slot_network_readings(subject: SlotNetworkSanitationSubject) -> SlotNetworkReadings {
+  let net = runner_slot_network(slot: subject.subject.slot)
+  let ipv6 = Filesystem.Read(path: runner_slot_ipv6_disabled_proc_path(net: net))
+  let ipv6_standing = if !ipv6.success { TapIpv6Unread { reason: "tap IPv6 policy unreadable" as NonEmptyStr } }
+    else if trim(s: ipv6.content) == "1" { TapIpv6Disabled }
+    else if trim(s: ipv6.content) == "0" { TapIpv6Enabled }
+    else { TapIpv6Unread { reason: "tap IPv6 policy malformed" as NonEmptyStr } }
+  SlotNetworkReadings {
+    tap: TapReading { subject: subject.subject, observation: observe_tap_holders(tap: slot_network_tun_queue_requirement(slot: subject.subject.slot).interface) },
+    tap_ipv6: TapIpv6Reading { subject: subject.subject, observation: ipv6_standing },
+    guest_originated_conntrack: SlotResidueReading { subject: subject.subject, observation: observe_network_residue(command: runner_slot_guest_originated_conntrack_list_command(net: net)) },
+    guest_destined_conntrack: SlotResidueReading { subject: subject.subject, observation: observe_network_residue(command: runner_slot_guest_destined_conntrack_list_command(net: net)) },
+    guest_neighbour: SlotResidueReading { subject: subject.subject, observation: observe_network_residue(command: runner_slot_guest_neighbour_show_command(net: net)) },
+    expectations: HostResidueReading { host: subject.converged.host, generation: subject.converged.generation, observation: observe_network_residue(command: runner_host_expectation_list_command()) },
+    ruleset: RulesetReading { host: subject.converged.host, generation: subject.converged.generation, observation: observe_network_ruleset() },
+  }
+}
diff --git a/dag/gunbc/runner/runner_microvm_shakedown_workflow.dag b/dag/gunbc/runner/runner_microvm_shakedown_workflow.dag
index c3a2b38fb4f..7e780e23366 100644
--- a/dag/gunbc/runner/runner_microvm_shakedown_workflow.dag
+++ b/dag/gunbc/runner/runner_microvm_shakedown_workflow.dag
@@ -43,7 +43,7 @@ import v2.extdeps.languages.bash_build {
 // gunbc.runner_jit_mint plan_jit_mint refuses a mint into any group without it).
 //
 // IT RUNS ONLY WHERE THE ATTEMPT IS. runs-on is the provenance label plus the attempt's own
-// registration name -- exactly the two labels gunbc.runner_jit_mint microvm_attempt_registration_labels
+// registration name -- exactly the two labels gunbc.runner.jit_registration_subject microvm_attempt_registration_labels
 // mints -- so no other registration can take it, and GitHub's record of which runner ran it is the
 // join between this job and the attempt (the binding gunbc.runner_bound_attempt_receipt relies on).
 // The operator passes the attempt's unit name as the `attempt` input; a wrong name queues forever
@@ -218,7 +218,7 @@ fn microvm_shakedown_workflow(script: String) -> Workflow {
       inputs: [
         DispatchInput {
           name: microvm_shakedown_attempt_input,
-          description: Present { value: "The attempt's registration name (its transient unit name, gunbc.runner_jit_mint jit_runner_name_for). It is REQUIRED in runs-on, so a wrong name queues forever rather than running on any other runner." },
+          description: Present { value: "The attempt's registration name (its transient unit name, gunbc.runner.jit_registration_subject jit_runner_name_for). It is REQUIRED in runs-on, so a wrong name queues forever rather than running on any other runner." },
           required: true,
           default: none,
           type: InputString,
diff --git a/dag/gunbc/runner/runner_microvm_slot_controller.dag b/dag/gunbc/runner/runner_microvm_slot_controller.dag
index 3dbce2f7117..ec8de7009a3 100644
--- a/dag/gunbc/runner/runner_microvm_slot_controller.dag
+++ b/dag/gunbc/runner/runner_microvm_slot_controller.dag
@@ -1,5 +1,7 @@
 module gunbc.runner_microvm_slot_controller
 
+import gunbc.runner_microvm_network_receipt_store { read_network_receipt, NetworkReceiptAbsent, NetworkReceiptPresent, StoredNetworkReceiptUnreadable }
+
 import gunbc.workspace_commissioning_executor_fence { workspace_executor_claim_controller, WorkspaceExecutorControllerAdmitted, WorkspaceExecutorControllerRefused }
 
 import std.durable_exclusive_hold { DurableHoldOwnerRef }
@@ -36,14 +38,16 @@ import gunbc.workspace_allocation_acquisition { workspace_apply_recorded_plan }
 import gunbc.workspace_allocation_lifecycle { workspace_complete_teardown, workspace_recover_release }
 import gunbc.runner_attempt_launch { LaunchWithdrawn }
 import gunbc.workspace_microvm { workspace_retirement_identity }
-import gunbc.workspace_allocation_policy { workspace_installed_policy }
+import gunbc.workspace_allocation_policy { workspace_installed_policy, workspace_enrolled_ssh_access }
+import gunbc.workspace_ssh_access { WorkspaceSshFromHost, WorkspaceSshThroughGateway, WorkspaceDirectSsh, WorkspaceGatewaySsh }
+import gunbc.principal_projection { PrincipalRef }
 import gunbc.workspace_allocation_admission { workspace_owner_enrollment, WorkspacePolicyAdmitted, WorkspacePolicyRefused }
 import gunbc.workspace_allocation { WorkspaceReservation }
 import gunbc.workspace_allocation_store { WorkspaceAllocation, WorkspaceReleased, WorkspaceWanted, workspace_read_owner, WorkspaceStoreReadOk, WorkspaceStoreUnreadable }
 import gunbc.workspace_reservation_record { workspace_reservation_plan_reservation }
 import gunbc.workspace_guest_image { workspace_installed_image, WorkspaceImageVerified, WorkspaceImageRefused }
 import gunbc.workspace_microvm { bind_workspace_launch, workspace_owner_public_key, WorkspacePublicKeyAdmitted, WorkspacePublicKeyNotAdmitted, WorkspaceLaunchBound, WorkspaceLaunchRefused }
-import gunbc.workspace_gateway { WorkspaceGateway, workspace_fleet_gateway }
+import gunbc.workspace_gateway { workspace_fleet_gateway }
 import gunbc.runner_microvm_attempt { microvm_attempt, MicroVmAttemptAccepted, MicroVmAttemptRefused, attempt_segment_refusal_text }
 import gunbc.fabric_required_build_cell { observe_required_build_cell_for_identity }
 import gunbc.fabric_control_plane { fabric_cell_allocation_key }
@@ -134,7 +138,7 @@ import gunbc.runner_group_restriction_observation {
   MicrovmRunnerGroupStanding, RunnerGroupRestrictionNotYetObserved, microvm_shakedown_runner_group_name,
   runner_group_restriction_not_yet_observed, observe_shakedown_runner_group_restriction,
 }
-import gunbc.runner_jit_mint { MicroVmSlotBinding }
+import gunbc.runner.jit_registration_subject { microvm_registration_subject }
 import gunbc.runner.runner_jit_perform {
   dispatch_jit_mint, JitMintDispatch, JitMintDispatchRefused, JitMintDispatchAuthorized,
   DispatchRefusedRunnerGroupUnrestricted,
@@ -335,7 +339,7 @@ fn attempt_dispatch(binding: MicroVmCellBinding, state: GitHubAppControlPlaneSta
   decl_ref(module_path: "gunbc.runner_microvm_slot_controller", decl_name: "mint_attempt_credential"),
 ] {
   dispatch_jit_mint(
-    binding: MicroVmSlotBinding { binding: binding },
+    subject: microvm_registration_subject(binding: binding),
     authority: controller_credential_authority(),
     control_plane: state,
     organization: github_organization_ref(),
@@ -403,18 +407,12 @@ type NetworkSubjectResolution
 fn resolve_network_subject(slot: RunnerSlotIdentity) -> NetworkSubjectResolution
   uses fs: Filesystem
 {
-  let read = Filesystem.Read(path: runner_microvm_converged_receipt_path)
-  if !read.success {
-    NetworkSubjectRefused { refusal: NetworkReceiptUnreadable { path: runner_microvm_converged_receipt_path, detail: read.error } }
-  } else {
-    match parse_converged_slot_network(text: read.content, candidates: fabric_execution_slot_identities()) {
-      ConvergedSlotNetworkMalformed { cause: c } =>
-        NetworkSubjectRefused { refusal: NetworkReceiptMalformed { path: runner_microvm_converged_receipt_path, cause: c } }
-      ConvergedSlotNetworkParsed { receipt: r } =>
-        match slot_network_sanitation_subject(slot: slot, receipt: r) {
-          SanitationSubjectRefused { refusal: rf } => NetworkSubjectRefused { refusal: SanitationSubjectNotAdmitted { refusal: rf } }
-          SanitationSubjectAdmitted { subject: s } => NetworkSubjectResolved { subject: s }
-        }
+  match read_network_receipt(host: slot.host) {
+    NetworkReceiptAbsent => NetworkSubjectRefused { refusal: NetworkReceiptUnreadable { path: runner_microvm_converged_receipt_path, detail: "network receipt is absent" } }
+    StoredNetworkReceiptUnreadable { reason } => NetworkSubjectRefused { refusal: NetworkReceiptUnreadable { path: runner_microvm_converged_receipt_path, detail: reason } }
+    NetworkReceiptPresent { receipt } => match slot_network_sanitation_subject(slot: slot, receipt: receipt) {
+      SanitationSubjectRefused { refusal } => NetworkSubjectRefused { refusal: SanitationSubjectNotAdmitted { refusal: refusal } }
+      SanitationSubjectAdmitted { subject } => NetworkSubjectResolved { subject: subject }
     }
   }
 }
@@ -531,7 +529,7 @@ fn minted_registration(mint: JitMintPerformance) -> Int? {
   match mint {
     JitMintReceived { delivery: d } =>
       match d {
-        JitCredentialBoundToAttempt { slot: _, credential: _, runner_id: id } => Present { value: id }
+        JitCredentialBoundToAttempt { bound: b } => Present { value: b.runner_id }
         JitCredentialNotDispatched { refusal: _ } => none
         JitCredentialMintNotCreated { outcome: _ } => none
       }
@@ -723,7 +721,6 @@ fn run_workspace_slot(
   bins: LocusBinaries,
   invocation_id: NonEmptyStr,
   allocation_store: FabricStorageBinding,
-  gateway: WorkspaceGateway,
 ) -> ControllerOutcome {
   let identity = workspace_attempt_identity(binding: binding, invocation_id: invocation_id, firecracker_binary: bins.firecracker)
   let plan = workspace_launch_plan(binding: binding, ground: observe_attempt_ground(attempt: binding.attempt), jailer_binary: bins.jailer, firecracker_binary: bins.firecracker)
@@ -734,7 +731,7 @@ fn run_workspace_slot(
         store: allocation_store, owner: binding.reservation.request.owner,
         idempotency_key: binding.reservation.request.idempotency_key,
         identity: live, launch: launch,
-        observe_connection: (observed, started) => workspace_observe_admitted_connection(store: allocation_store, identity: observed, launch: started, gateway: gateway),
+        observe_connection: (observed, started) => workspace_observe_admitted_connection(store: allocation_store, identity: observed, launch: started, owner: binding.reservation.request.owner),
       )
       let measured = workspace_capture_runtime_metrics(store: allocation_store, reservation: binding.reservation, identity: live, launch: launch)
       if measured { terminal } else { terminal }
@@ -742,13 +739,25 @@ fn run_workspace_slot(
   )
 }
 
-// Runtime reads the operator-context forwarding observation; it never borrows the operator's key.
-fn workspace_observe_admitted_connection(store: FabricStorageBinding, identity: AttemptIdentity, launch: AttemptLaunch, gateway: WorkspaceGateway) -> WorkspaceConnectionReading {
-  match clock_now_probed_at() {
-    Absent => WorkspaceConnectionUnavailable { reason: "gateway admission clock is unreadable" }
-    Present { value: now } => match workspace_current_gateway_connection(store: store, slot: identity.attempt.slot, now: now) {
-      WorkspaceGatewayUnavailable { reason } => WorkspaceConnectionUnavailable { reason: reason as String }
-      WorkspaceGatewayReady { known_host } => workspace_observe_connection(identity: identity, launch: launch, gateway: gateway, gateway_known_host: known_host)
+// The controller has already bound this host and allocation. A host-local client needs the
+// invocation-bound guest key exchange; only a gateway client additionally needs forwarding proof.
+fn workspace_observe_admitted_connection(store: FabricStorageBinding, identity: AttemptIdentity, launch: AttemptLaunch, owner: PrincipalRef) -> WorkspaceConnectionReading {
+  match workspace_enrolled_ssh_access(owner: owner) {
+    Absent => WorkspaceConnectionUnavailable { reason: "workspace owner has no admitted SSH access policy" }
+    Present { value: access } => match access {
+      WorkspaceSshFromHost { identity_file } => workspace_observe_connection(identity: identity, launch: launch,
+        route: WorkspaceDirectSsh { slot: identity.attempt.slot, identity_file: identity_file })
+      WorkspaceSshThroughGateway => match workspace_fleet_gateway(slot: identity.attempt.slot) {
+        Absent => WorkspaceConnectionUnavailable { reason: "fleet tailnet gateway is unconfigured" }
+        Present { value: gateway } => match clock_now_probed_at() {
+          Absent => WorkspaceConnectionUnavailable { reason: "gateway admission clock is unreadable" }
+          Present { value: now } => match workspace_current_gateway_connection(store: store, slot: identity.attempt.slot, now: now) {
+            WorkspaceGatewayUnavailable { reason } => WorkspaceConnectionUnavailable { reason: reason as String }
+            WorkspaceGatewayReady { known_host } => workspace_observe_connection(identity: identity, launch: launch,
+              route: WorkspaceGatewaySsh { gateway: gateway, known_host: known_host })
+          }
+        }
+      }
     }
   }
 }
@@ -962,12 +971,9 @@ fn workspace_slot_launch_under_exclusion(reservation: WorkspaceReservation, live
         ClockUnixMillisObserved { millis } => match bind_workspace_launch(reservation: reservation, snapshot: live, attempt: attempt,
           image: image, public_key: owner_key, now_unix: epoch_secs_of_millis(millis: millis)) {
           WorkspaceLaunchRefused { reason } => workspace_slot_refused(reason: reason)
-          WorkspaceLaunchBound { binding } => match workspace_fleet_gateway(slot: reservation.slot) {
-            Absent => workspace_slot_refused(reason: "fleet tailnet gateway is unconfigured")
-            Present { value: gateway } => workspace_settle_controller_outcome(reservation: reservation, store: store,
+          WorkspaceLaunchBound { binding } => workspace_settle_controller_outcome(reservation: reservation, store: store,
               outcome: run_workspace_slot(binding: binding, subject: subject, bins: bins,
-                invocation_id: invocation_id, allocation_store: store, gateway: gateway))
-          }
+                invocation_id: invocation_id, allocation_store: store))
         }
         ClockUnixMillisRefused { detail: _ } => workspace_slot_refused(reason: "workspace launch clock is unreadable")
       }
diff --git a/dag/gunbc/runner/runner_microvm_slot_unit.dag b/dag/gunbc/runner/runner_microvm_slot_unit.dag
index 5d8701183f4..1d24843ab22 100644
--- a/dag/gunbc/runner/runner_microvm_slot_unit.dag
+++ b/dag/gunbc/runner/runner_microvm_slot_unit.dag
@@ -336,6 +336,7 @@ fn microvm_slot_unit_execs_controller(file: SystemdUnitFile) -> Bool {
       })
     TimerUnitFile { unit: _, timer: _, install: _ } => false
     SliceUnitFile { unit: _, slice: _, install: _ } => false
+    PathUnitFile { unit: _, path: _, install: _ } => false
   }
 }
 
diff --git a/dag/gunbc/runner/runner_qualification_dispatch.dag b/dag/gunbc/runner/runner_qualification_dispatch.dag
new file mode 100644
index 00000000000..1affd919ac6
--- /dev/null
+++ b/dag/gunbc/runner/runner_qualification_dispatch.dag
@@ -0,0 +1,1216 @@
+module gunbc.runner.runner_qualification_dispatch
+
+import std.types { Bool, Bytes, CommitSha, Int, List, NonEmptyStr, String }
+import std.resources { Network }
+import std.roster_frontier { FrontierRow, frontier_row_decl }
+import std.dissolution { unbound_dissolution }
+import std.decl_ref { decl_ref }
+import product.placement_supply { HostIdentity }
+import extdeps.transports.rest {
+  RestResult, RestAnswered, RestRefused, RestReadExchange, RestMutationExchange, classify_rest_refusal,
+  RestExchangeRefusal, RestExchangeStatusRefused, RestStatusRefused, RestTransportRefused, RestBodyUndecodable,
+  RestExchangeCommitAmbiguous, RestExchangeUnreached, RestExchangeUndecodable,
+}
+import extdeps.github.effect { GitHubEffect, DispatchWorkflow, GitHubWorkflowRef }
+import extdeps.github.app { GitHubAppInstallationId }
+import extdeps.github.actions {
+  Workflow, Job, DispatchInput, InputString, RunnerSpec, RunsOnExpression, HostedRunner, SelfHosted,
+  WorkflowDispatch, Push, PullRequest, Schedule, WorkflowCall, WorkflowRunCompleted, MergeGroup,
+  Step, RunStep, UsesStep,
+}
+import extdeps.languages.yaml.types { kv, yaml_string }
+import extdeps.github.expressions {
+  ingest_template, context_name, Expression, Interpolation, LiteralText,
+  ContextAccess, FunctionCall, StringLiteral, LogicalOr, LogicalAnd, Equals, NotEquals,
+}
+import extdeps.github.workflows { WorkflowDispatchReceipt }
+import extdeps.github.workflow_runs {
+  WorkflowRun, WorkflowRunStatus, Completed, WorkflowRunConclusion, WorkflowJobRun, WorkflowJobRunList,
+}
+import gunbc.repository { gunbc_repository }
+import gunbc.fleet_converge_workflow { fleet_converge_workflow, fleet_converge_dispatch_inputs }
+import gunbc.auth.github_apps { DeclaredGitHubApp, GitHubAppControlPlaneState }
+import gunbc.auth.github_credential {
+  GitHubCredentialAuthority, CredentialCapability, credential_authorizes, unsatisfied_capabilities,
+}
+import gunbc.runner.jit_registration_subject { host_unit_slot_subject }
+import gunbc.runner.runner_jit_perform { AuthorizedJitMintDispatch, JitMintDispatchAuthorized, JitCredentialDelivery, JitCredentialBoundToAttempt, authority_installation }
+import gunbc.runner.runner_jit_deregistration { JitRegistration, jit_registration_of }
+import gunbc.managed_host_unit_hold { UnitHoldProof }
+import gunbc.github_effect_perform {
+  ControllerInstallationToken, dispatch_workflow_with, read_run_with, read_attempt_jobs_with,
+  WorkflowJobLogRead, read_job_log_with, list_run_artifacts_with, download_artifact_with,
+}
+import gunbc.runner_throughput_qualification_route {
+  QualificationInstrument, qualification_instruments,
+  FloorPhaseRows, FloorCgroupRows, ClaimCostArtifactEvalSteps, CalibrationSpecimenWitnessLine,
+  GuestIdleMeminfoAndNproc, ConcurrentCohortSeatWindows,
+}
+import gunbc.required_ci_phase_roster {
+  FloorPhaseRow, FloorPhaseTimed, FloorPhaseUntimed, FloorPhaseRowReading, FloorPhaseRowRead, FloorPhaseRowGarbled,
+  read_floor_phase_row,
+}
+import gunbc.host_budget_source {
+  FloorCgroupLevelRow, FloorCgroupRowReading, FloorCgroupLevelRead, FloorCgroupRowGarbled,
+  read_floor_cgroup_level_row,
+}
+import gunbc.witness_floor_workflow { required_floor_claim_cost_artifact_name }
+import extdeps.github.actions_artifacts { ActionsArtifact, ActionsArtifactList }
+import gunbc.runner.runner_host_unit_slot { HostUnitSlot }
+import std.content_hash { Fnv1a64Structural, content_hash_atom }
+import gunbc.runner.runner_qualification_ref_pin {
+  QualificationRefPin, QualificationBranchName, qualification_workflow_path, qualification_selected_workflow,
+}
+
+// THE DISPATCH LEG OF THE QUALIFICATION ROUTE, AND THE COLLECT STAGE THAT READS ITS RUN BACK.
+//
+// The route registers one ephemeral JIT runner whose label set carries a per-boot attempt label
+// (gunbc.runner_throughput_qualification_route ephemeral_slot_labels). Dispatching the floor to it is
+// a workflow_dispatch whose input IS that attempt label, read by the floor job's runs-on, so no other
+// registration can serve the job. This module is the production caller of extdeps.github.workflows
+// github.Workflows CreateDispatch.
+//
+// THE SUBJECT IS SEALED AND ITS SCOPE IS FIXED BY CONSTRUCTION. QualificationDispatchSubject is
+// minted only by qualification_dispatch_subject_over, and only from:
+//   - the sealed AuthorizedJitMintDispatch (gunbc.runner.runner_jit_perform), whose only mint is
+//     dispatch_jit_mint's authorized arm, its registration (jit_registration_of), and a credential
+//     delivered by THAT mint -- the delivery is a sealed BoundJitCredential carrying the dispatch that
+//     produced it, which must equal this dispatch over the complete request (App, installation,
+//     organization, name, runner group, labels, work folder); a rewrap is unconstructable -- so
+//     the attempt is the slot's own and the runner the collection joins on is that registration's;
+//   - the qualification workflow, which is not a parameter of the request: its path is the generated
+//     fleet-converge artifact (gunbc.generated_artifact FleetConvergeYamlArtifact) and production
+//     supplies its model as gunbc.fleet_converge_workflow fleet_converge_workflow, where the route's
+//     mode lands with the boot leg. A slot restricted to any other workflow refuses;
+//   - a floor job in that workflow whose runs-on is exactly the declared attempt input, so the job
+//     can be served by the attempt's runner and nothing else. A literal label, another input, or a
+//     composed expression refuses.
+// The repository is gunbc_repository; a caller cannot name another.
+//
+// AUTHORIZATION. The dispatch runs under the gunbai-ci installation token the registration was
+// minted with (gunbc.github_effect_perform ControllerInstallationToken, App key read over WIF); the
+// credential is checked against the DispatchWorkflow effect (actions: write) before any request, and
+// a token for another App or installation refuses. The operator's 2026-10-03 ruling, whose scope the
+// operator confirmed on 2026-10-05 to cover this dispatch (gunbc.auth.privileged_effect_census
+// runner_lifecycle_scope_ruling), stands only beside its interlock:
+// dispatch_qualification_floor takes the host-generic unit hold proof
+// (gunbc.managed_host_unit_hold UnitHoldProof) and refuses unless it is the slot's own host's.
+
+data qualification_attempt_dispatch_input: DispatchInput = DispatchInput {
+  name: "runner_attempt_label",
+  description: Present { value: "the per-boot attempt label the ephemeral qualification slot registered with; the floor job's runs-on reads it" },
+  required: true,
+  default: none,
+  type: InputString,
+}
+
+fn qualification_workflow_file_name() -> NonEmptyStr {
+  match last(split(qualification_workflow_path() as String, "/")) {
+    Present { value: f } => f as NonEmptyStr
+    Absent => qualification_workflow_path()
+  }
+}
+
+// THE REVISION THE FLOOR RUNS IS AN INPUT TOO (decision: eager-gull-22, 2026-10-04 -- sha-checkout).
+// A dispatch names a branch, and a branch can move between the pin's readback and the run; a ruleset
+// could not stop a delete-then-recreate, and the App that would administer it could remove it. So the
+// floor job itself checks out exactly this revision as its FIRST step and refuses before any other
+// step on a mismatch (qualification_floor_revision_guard_step), and collection refuses a run whose
+// head_sha is not the pinned revision (RunRevisionNotPinned). The residual -- an edit to the workflow
+// file on the qualification branch can drop the guard -- needs repository push, and is declared as
+// gunbc.recurring_failure_mode qualification_floor_guard_skippable_by_a_workflow_file_edit.
+data qualification_revision_dispatch_input: DispatchInput = DispatchInput {
+  name: "qualification_revision",
+  description: Present { value: "the pinned revision the floor must run; the floor job's first step checks it out and refuses on a mismatch before any other step" },
+  required: true,
+  default: none,
+  type: InputString,
+}
+
+fn qualification_dispatch_inputs(attempt: NonEmptyStr, revision: CommitSha) -> Map<String, String> {
+  map_insert(
+    m: map_insert(m: empty_map(), key: qualification_attempt_dispatch_input.name, value: attempt as String),
+    key: qualification_revision_dispatch_input.name,
+    value: revision as String,
+  )
+}
+
+// THE GUARD, AS THE ONE STEP THE FLOOR JOB MUST BEGIN WITH. It fetches and checks out the revision
+// input into the runner's empty workspace and fails the job unless HEAD is exactly that revision; GitHub
+// skips every later step of a failed job unless the step opts in with an if: condition, which the floor
+// contract forbids (qualification_floor_admission). Its emission into the generated fleet-converge
+// workflow is owed with the qualification mode (the dispatch leg's wiring_owed).
+fn qualification_floor_revision_guard_step() -> Step {
+  RunStep {
+    name: Present { value: "Check out the pinned qualification revision and refuse on any mismatch" },
+    id: Present { value: "qualification_revision_guard" },
+    run: join([
+      "set -euo pipefail",
+      "git init -q .",
+      "git remote add origin \"https://github.com/$GITHUB_REPOSITORY\"",
+      "git fetch -q --no-tags --depth=1 origin \"$QUALIFICATION_REVISION\"",
+      "git checkout -q --force --detach FETCH_HEAD",
+      "observed=\"$(git rev-parse HEAD)\"",
+      "if [ \"$observed\" != \"$QUALIFICATION_REVISION\" ]; then echo \"QualificationRevisionMismatch: expected=$QUALIFICATION_REVISION observed=$observed\" >&2; exit 1; fi",
+    ], "\n"),
+    shell: none,
+    env: Present { value: [kv(key: "QUALIFICATION_REVISION", value: yaml_string(s: "${{ inputs.qualification_revision }}"))] },
+    working_directory: none,
+    if_condition: none,
+    continue_on_error: none,
+    timeout_minutes: none,
+  }
+}
+
+fn step_runs_after_a_failure(step: Step) -> Bool {
+  match step {
+    RunStep { name: _, id: _, run: _, shell: _, env: _, working_directory: _, if_condition: c, continue_on_error: e, timeout_minutes: _ } =>
+      (match c { Present { value: _ } => true Absent => false }) || (match e { Present { value: v } => v Absent => false })
+    UsesStep { name: _, id: _, uses: _, with: _, env: _, if_condition: c, continue_on_error: e, timeout_minutes: _ } =>
+      (match c { Present { value: _ } => true Absent => false }) || (match e { Present { value: v } => v Absent => false })
+  }
+}
+
+// ── THE SUBJECT ───────────────────────────────────────────────────────────────────────────────
+
+type QualificationDispatchSubject sole_constructor {
+  registration: JitRegistration
+  slot: HostUnitSlot
+  host: HostIdentity
+  attempt: NonEmptyStr
+  runner_id: Int
+  pin: QualificationRefPin
+  floor_job_name: NonEmptyStr
+}
+
+type QualificationSubjectRefusal
+  = SubjectCredentialNotDelivered { delivery: JitCredentialDelivery }
+  | SubjectNoRegistration
+  | SubjectMintedIntoAnotherGroup { minted_group: Int, pinned_group: Int }
+  | SubjectPinForAnotherAttempt { pin_attempt: NonEmptyStr, slot_attempt: NonEmptyStr }
+  | SubjectDeliveryForAnotherDispatch
+  | SubjectSlotNotHostUnit
+  | SubjectSlotForAnotherWorkflow { slot_workflow: NonEmptyStr, qualification_workflow: NonEmptyStr }
+  | SubjectAttemptInputUndeclared { input: String }
+  | SubjectFloorJobAbsent { job_id: NonEmptyStr }
+  | SubjectFloorRunsOnNotTheAttemptInput { job_id: NonEmptyStr, runs_on: String }
+  | SubjectFloorNameNotUnique { name: NonEmptyStr, jobs_with_name: Int }
+  | SubjectFloorRevisionGuardNotFirst { job_id: NonEmptyStr }
+  | SubjectFloorStepRunsPastTheGuard { job_id: NonEmptyStr }
+
+type QualificationSubjectStanding
+  = QualificationSubjectAdmitted { subject: QualificationDispatchSubject }
+  | QualificationSubjectRefused { refusal: QualificationSubjectRefusal }
+
+fn dispatch_inputs_declare(inputs: List<DispatchInput>, input: DispatchInput) -> Bool {
+  inputs |> any(i => i.name == input.name)
+}
+
+fn workflow_declares_dispatch_input(workflow: Workflow, input: DispatchInput) -> Bool {
+  workflow.on |> any(t =>
+    match t {
+      WorkflowDispatch { inputs: ins } => dispatch_inputs_declare(inputs: ins, input: input)
+      Push { branches: _, paths: _ } => false
+      PullRequest { branches: _, types: _ } => false
+      Schedule { cron: _ } => false
+      WorkflowCall { inputs: _ } => false
+      WorkflowRunCompleted { workflows: _, branches: _ } => false
+      MergeGroup => false
+    })
+}
+
+// EXACTLY `${{ inputs.<name> }}` and nothing else: one interpolation segment reading the input.
+fn runs_on_is_exactly_the_input(runner: RunnerSpec, input: DispatchInput) -> Bool {
+  match runner {
+    RunsOnExpression { expression: e } =>
+      match ingest_template(src: e) {
+        Present { value: t } =>
+          count(t.segments) == 1 && (t.segments |> all(s =>
+            match s {
+              Interpolation { expression: e } => expression_reads_exactly_the_input(expression: e, input: input)
+              LiteralText { text: _ } => false
+            }))
+        Absent => false
+      }
+    HostedRunner { label: _ } => false
+    SelfHosted { labels: _ } => false
+  }
+}
+
+fn expression_reads_exactly_the_input(expression: Expression, input: DispatchInput) -> Bool {
+  match expression {
+    ContextAccess { context: c, path: p } => context_name(context: c) == "inputs" && count(p) == 1 && (p |> all(x => x == input.name))
+    FunctionCall { function: _, args: _ } => false
+    StringLiteral { value: _ } => false
+    LogicalOr { left: _, right: _ } => false
+    LogicalAnd { left: _, right: _ } => false
+    Equals { left: _, right: _ } => false
+    NotEquals { left: _, right: _ } => false
+  }
+}
+
+fn runner_spec_text(runner: RunnerSpec) -> String {
+  match runner {
+    RunsOnExpression { expression: e } => e
+    HostedRunner { label: _ } => "a hosted runner label"
+    SelfHosted { labels: ls } => join(["self-hosted labels: ", join(ls, ",")], "")
+  }
+}
+
+fn job_display_name(job: Job) -> NonEmptyStr {
+  match job.name {
+    Present { value: n } => n as NonEmptyStr
+    Absent => job.id as NonEmptyStr
+  }
+}
+
+// THE SCOPE CHECKS ARE PURE, SO A CLAIM SUPPLIES THEIR INPUTS AS VALUES (DESIGN section 3: a witness
+// discriminates at one interface). The subject mint below composes them and is their only
+// production consumer; the witness exercises each one directly, and keeps ONE claim that runs the
+// real mint end to end.
+
+// The slot must be registered for the qualification workflow at this branch.
+fn qualification_slot_refusal(slot_workflow: NonEmptyStr, branch: NonEmptyStr) -> QualificationSubjectRefusal? {
+  if (slot_workflow as String) == (qualification_selected_workflow(branch: branch) as String) {
+    none
+  } else {
+    Present { value: SubjectSlotForAnotherWorkflow { slot_workflow: slot_workflow, qualification_workflow: qualification_selected_workflow(branch: branch) } }
+  }
+}
+
+type QualificationFloorAdmission
+  = QualificationFloorAdmitted { floor_job_name: NonEmptyStr }
+  | QualificationFloorRefused { refusal: QualificationSubjectRefusal }
+
+// The workflow must declare the attempt input, and its floor job's runs-on must be exactly it.
+fn qualification_floor_admission(workflow: Workflow, floor_job_id: NonEmptyStr) -> QualificationFloorAdmission {
+  if !workflow_declares_dispatch_input(workflow: workflow, input: qualification_attempt_dispatch_input) {
+    QualificationFloorRefused { refusal: SubjectAttemptInputUndeclared { input: qualification_attempt_dispatch_input.name } }
+  } else if !workflow_declares_dispatch_input(workflow: workflow, input: qualification_revision_dispatch_input) {
+    QualificationFloorRefused { refusal: SubjectAttemptInputUndeclared { input: qualification_revision_dispatch_input.name } }
+  } else {
+    match first(filter(workflow.jobs, j => j.id == (floor_job_id as String))) {
+      Absent => QualificationFloorRefused { refusal: SubjectFloorJobAbsent { job_id: floor_job_id } }
+      Present { value: job } =>
+        if !runs_on_is_exactly_the_input(runner: job.runner, input: qualification_attempt_dispatch_input) {
+          QualificationFloorRefused { refusal: SubjectFloorRunsOnNotTheAttemptInput { job_id: floor_job_id, runs_on: runner_spec_text(runner: job.runner) } }
+        } else {
+          let name = job_display_name(job: job)
+          let sharing = workflow.jobs |> filter(j => (job_display_name(job: j) as String) == (name as String))
+          if count(sharing) != 1 {
+            QualificationFloorRefused { refusal: SubjectFloorNameNotUnique { name: name, jobs_with_name: count(sharing) } }
+          } else {
+            match first(job.steps) {
+              Absent => QualificationFloorRefused { refusal: SubjectFloorRevisionGuardNotFirst { job_id: floor_job_id } }
+              Present { value: s0 } =>
+                if s0 != qualification_floor_revision_guard_step() {
+                  QualificationFloorRefused { refusal: SubjectFloorRevisionGuardNotFirst { job_id: floor_job_id } }
+                } else if job.steps |> any(st => step_runs_after_a_failure(step: st)) {
+                  QualificationFloorRefused { refusal: SubjectFloorStepRunsPastTheGuard { job_id: floor_job_id } }
+                } else if match job.continue_on_error { Present { value: v } => v Absent => false } {
+                  QualificationFloorRefused { refusal: SubjectFloorStepRunsPastTheGuard { job_id: floor_job_id } }
+                } else {
+                  QualificationFloorAdmitted { floor_job_name: name }
+                }
+            }
+          }
+        }
+    }
+  }
+}
+
+// THE PURE JOIN, OVER A SUPPLIED WORKFLOW MODEL. Production reaches it only through
+// qualification_dispatch_subject, which supplies fleet_converge_workflow; the witness claims supply a
+// model carrying the floor job the boot leg's mode will add. An admit list constrains the call edge,
+// not where the result goes, so every admitted witness entry is a `test fn` returning Bool.
+fn qualification_dispatch_subject_over(
+  dispatch: AuthorizedJitMintDispatch,
+  slot: HostUnitSlot,
+  delivery: JitCredentialDelivery,
+  workflow: Workflow,
+  floor_job_id: NonEmptyStr,
+  pin: QualificationRefPin,
+) -> QualificationSubjectStanding
+  admit_callers: [
+    decl_ref(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "qualification_dispatch_subject"),
+    decl_ref(module_path: "test.claim.runner_qualification_dispatch_witness", decl_name: "the_real_mint_admits_the_attempt_through_the_sealed_subject"),
+    decl_ref(module_path: "test.claim.runner_qualification_dispatch_witness", decl_name: "a_delivery_from_another_dispatch_on_the_same_slot_refuses"),
+  ]
+{
+  match jit_registration_of(dispatch: JitMintDispatchAuthorized { dispatch: dispatch }) {
+    Absent => QualificationSubjectRefused { refusal: SubjectNoRegistration }
+    Present { value: registration } =>
+  match delivery {
+    JitCredentialBoundToAttempt { bound: bound } => {
+      let runner_id = bound.runner_id
+      if bound.dispatch != dispatch {
+        QualificationSubjectRefused { refusal: SubjectDeliveryForAnotherDispatch }
+      } else {
+        let h = slot
+        if !(host_unit_slot_subject(slot: h) == registration.subject) {
+          QualificationSubjectRefused { refusal: SubjectSlotNotHostUnit }
+        } else if (pin.name.attempt as String) != (h.attempt as String) {
+              QualificationSubjectRefused { refusal: SubjectPinForAnotherAttempt { pin_attempt: pin.name.attempt, slot_attempt: h.attempt } }
+            } else if dispatch.request.runner_group_id.value != pin.group.group.value {
+              QualificationSubjectRefused { refusal: SubjectMintedIntoAnotherGroup { minted_group: dispatch.request.runner_group_id.value, pinned_group: pin.group.group.value } }
+            } else {
+            match qualification_slot_refusal(slot_workflow: h.workflow, branch: pin.name.branch) {
+              Present { value: r } => QualificationSubjectRefused { refusal: r }
+              Absent =>
+                match qualification_floor_admission(workflow: workflow, floor_job_id: floor_job_id) {
+                  QualificationFloorRefused { refusal: r } => QualificationSubjectRefused { refusal: r }
+                  QualificationFloorAdmitted { floor_job_name: n } =>
+                    QualificationSubjectAdmitted {
+                      subject: QualificationDispatchSubject {
+                        registration: registration,
+                        slot: h,
+                        host: h.host.host.host,
+                        attempt: h.attempt,
+                        runner_id: runner_id,
+                        pin: pin,
+                        floor_job_name: n,
+                      },
+                    }
+                }
+            }
+            }
+      }
+    }
+    other => QualificationSubjectRefused { refusal: SubjectCredentialNotDelivered { delivery: other } }
+  }
+  }
+}
+
+// THE PRODUCTION MINT: the qualification workflow is the generated fleet-converge model.
+//
+// THE DECLARED INPUTS ARE READ BEFORE THE WORKFLOW IS BUILT. The model's workflow_dispatch inputs are
+// their own declaration (gunbc.fleet_converge_workflow fleet_converge_dispatch_inputs), and the jobs
+// are built by fleet_converge_jobs(); evaluating the whole fleet_converge_workflow builds every job of
+// every mode, ~600k eval steps measured by the required floor, and the first check the mint makes
+// reads only the inputs. So the wrapper asks that check of the inputs declaration directly and builds
+// the workflow only when the inputs declare the attempt input -- the refusal is the same
+// SubjectAttemptInputUndeclared the mint would reach, without the construction it would never read.
+// Until the boot leg lands the qualification mode there, this refuses -- the wiring the route leg
+// owes, refused rather than faked.
+fn qualification_dispatch_subject(
+  dispatch: AuthorizedJitMintDispatch,
+  slot: HostUnitSlot,
+  delivery: JitCredentialDelivery,
+  floor_job_id: NonEmptyStr,
+  pin: QualificationRefPin,
+) -> QualificationSubjectStanding {
+  if !dispatch_inputs_declare(inputs: fleet_converge_dispatch_inputs, input: qualification_attempt_dispatch_input) {
+    QualificationSubjectRefused { refusal: SubjectAttemptInputUndeclared { input: qualification_attempt_dispatch_input.name } }
+  } else {
+    qualification_dispatch_subject_over(
+      dispatch: dispatch,
+      slot: slot,
+      delivery: delivery,
+      workflow: fleet_converge_workflow,
+      floor_job_id: floor_job_id,
+      pin: pin,
+    )
+  }
+}
+
+fn qualification_dispatch_effect(subject: QualificationDispatchSubject) -> GitHubEffect {
+  DispatchWorkflow {
+    repository: gunbc_repository,
+    workflow: GitHubWorkflowRef { file_name: qualification_workflow_file_name() },
+    subject: subject.pin.revision,
+  }
+}
+
+// ── THE DISPATCH ──────────────────────────────────────────────────────────────────────────────
+//
+// A DISPATCH IS A MUTATION AND HAS THREE STANDINGS, NOT TWO. GitHub's 2026-03-10 answer (200 with
+// the run id) is the only one that mints a DispatchedQualificationRun. A decided 4xx is refused: no
+// run exists. A 5xx, a request that got no response, or a 200 this client could not decode is
+// commit-ambiguous (extdeps.transports.rest classify_rest_refusal over RestMutationExchange): a run
+// may exist with no receipt here, so the standing keeps the subject for reconciliation and is not a
+// refusal a caller may retry as if nothing were created.
+//
+// THE DISPATCHED RUN IS SEALED, AND THAT IS WHAT PUTS COLLECTION CAUSALLY AFTER DISPATCH: only
+// dispatch_qualification_floor writes one, from a succeeded exchange, carrying the sealed subject.
+type DispatchedQualificationRun sole_constructor {
+  subject: QualificationDispatchSubject
+  receipt: WorkflowDispatchReceipt
+}
+
+type QualificationDispatchRefusal
+  = DispatchCredentialRefused { unsatisfied: List<CredentialCapability> }
+  | DispatchTokenForAnotherInstallation
+  | DispatchAuthorityForAnotherInstallation { authority_app: DeclaredGitHubApp, authority_installation: GitHubAppInstallationId }
+  | DispatchAuthorityNotAnInstallation
+  | DispatchHoldForAnotherHost { held: HostIdentity, slot: HostIdentity }
+  | DispatchStatusRefused { status: Int, body: String }
+
+type QualificationDispatchStanding
+  = DispatchStandingSucceeded { receipt: WorkflowDispatchReceipt }
+  | DispatchStandingRefused { status: Int, body: String }
+  | DispatchStandingCommitAmbiguous { detail: NonEmptyStr }
+
+type QualificationDispatch
+  = QualificationDispatched { run: DispatchedQualificationRun }
+  | QualificationDispatchRefused { subject: QualificationDispatchSubject, refusal: QualificationDispatchRefusal }
+  | QualificationDispatchCommitAmbiguous { subject: QualificationDispatchSubject, detail: NonEmptyStr }
+
+// The standing of one dispatch exchange: GitHub's answer carries the receipt, and a refusal is
+// decided by the mutation classifier and nothing else. An Unreached or Undecodable refusal is not
+// produced for a mutation; were one ever passed here, it is the ambiguous side, never a refusal.
+fn qualification_dispatch_standing(dispatch: RestResult<WorkflowDispatchReceipt>) -> QualificationDispatchStanding {
+  match dispatch {
+    RestAnswered { answer: receipt } => DispatchStandingSucceeded { receipt: receipt }
+    RestRefused { refusal } =>
+      match classify_rest_refusal(standing: RestMutationExchange { refusal: refusal }) {
+        RestExchangeStatusRefused { status: s, body: b } => DispatchStandingRefused { status: s as Int, body: b }
+        RestExchangeCommitAmbiguous { detail: d } => DispatchStandingCommitAmbiguous { detail: d }
+        RestExchangeUnreached { cause: c } => DispatchStandingCommitAmbiguous { detail: c }
+        RestExchangeUndecodable { status: _, cause: c } => DispatchStandingCommitAmbiguous { detail: c }
+      }
+  }
+}
+
+// THE PERMISSION IS ASKED OF THE INSTALLATION THAT PERFORMS THE REQUEST. credential_authorizes answers
+// for whatever authority it is given; the request is made with the controller token. So the
+// authority must name the very App and installation the registration (and therefore the token) was
+// minted under, or the actions:write it proves is some other installation's. An Actions job
+// credential names no installation at all and cannot authorize an installation-token request.
+fn dispatch_authority_refusal(authority: GitHubCredentialAuthority, app: DeclaredGitHubApp, installation: GitHubAppInstallationId) -> QualificationDispatchRefusal? {
+  match authority_installation(authority: authority) {
+    Absent => Present { value: DispatchAuthorityNotAnInstallation }
+    Present { value: held } =>
+      if held.app == app && held.installation == installation {
+        none
+      } else {
+        Present { value: DispatchAuthorityForAnotherInstallation { authority_app: held.app, authority_installation: held.installation } }
+      }
+  }
+}
+
+// THE INTERLOCK, as a pure comparison: the proof's admitted host against the slot's host.
+fn hold_covers_slot_host(held: HostIdentity, slot_host: HostIdentity) -> Bool {
+  (held as String) == (slot_host as String)
+}
+
+fn dispatch_qualification_floor(
+  subject: QualificationDispatchSubject,
+  hold: UnitHoldProof,
+  token: ControllerInstallationToken,
+  authority: GitHubCredentialAuthority,
+  control_plane: GitHubAppControlPlaneState,
+) -> QualificationDispatch uses net: Network {
+  let effect = qualification_dispatch_effect(subject: subject)
+  if !hold_covers_slot_host(held: hold.subject.host.host, slot_host: subject.host) {
+    QualificationDispatchRefused { subject: subject, refusal: DispatchHoldForAnotherHost { held: hold.subject.host.host, slot: subject.host } }
+  } else if !token_names_registration(token_app: token.app, token_installation: token.installation, subject: subject) {
+    QualificationDispatchRefused { subject: subject, refusal: DispatchTokenForAnotherInstallation }
+  } else {
+    match dispatch_authority_refusal(authority: authority, app: subject.registration.app, installation: subject.registration.installation) {
+      Present { value: r } => QualificationDispatchRefused { subject: subject, refusal: r }
+      Absent =>
+        if !credential_authorizes(authority: authority, control_plane: control_plane, effect: effect) {
+          QualificationDispatchRefused {
+            subject: subject,
+            refusal: DispatchCredentialRefused { unsatisfied: unsatisfied_capabilities(authority: authority, control_plane: control_plane, effect: effect) },
+          }
+        } else {
+          let answer = dispatch_workflow_with(
+            token: token,
+            owner: gunbc_repository.owner as NonEmptyStr,
+            repo: gunbc_repository.name as NonEmptyStr,
+            workflow_id: qualification_workflow_file_name(),
+            git_ref: subject.pin.name.branch,
+            inputs: qualification_dispatch_inputs(attempt: subject.attempt, revision: subject.pin.revision),
+          )
+          match qualification_dispatch_standing(dispatch: answer.dispatch) {
+            DispatchStandingSucceeded { receipt: r } => QualificationDispatched { run: DispatchedQualificationRun { subject: subject, receipt: r } }
+            DispatchStandingRefused { status: s, body: b } => QualificationDispatchRefused { subject: subject, refusal: DispatchStatusRefused { status: s, body: b } }
+            DispatchStandingCommitAmbiguous { detail: d } => QualificationDispatchCommitAmbiguous { subject: subject, detail: d }
+          }
+        }
+    }
+  }
+}
+
+// ── COLLECT: THE RUN READ BACK, ENSURE-STYLE ──────────────────────────────────────────────────
+//
+// THE SUBJECT IS THE DISPATCHED RUN AT ITS FIRST ATTEMPT. A dispatch creates attempt 1; a re-run
+// reuses the run id and mints attempt 2 with new jobs and a new conclusion. So the run read must
+// carry the dispatched id, the workflow_dispatch event, the qualification workflow's path, the pinned
+// revision and run_attempt 1; the jobs are read through the attempt-scoped endpoint for attempt 1
+// and every one must carry that run id and attempt. A run that has advanced past attempt 1 refuses:
+// its conclusion is no longer the dispatch's.
+//
+// THE RUNNER IS JOINED BY IDENTITY, NOT BY LABEL. Two runners can carry the same labels, and a
+// helper job on the attempt's runner says nothing about where the floor ran. So the collection takes
+// the one job whose runner_name is the registration's minted name (job_ran_on), and requires it to
+// be the floor job the subject fixed, and to have started. An ephemeral JIT runner takes exactly one
+// job, so no job on it, several, or a different job are each a typed refusal carrying what was seen.
+//
+// THE CONCLUSION IS READ BACK AND CARRIED, NOT FILTERED: a failed floor on the attempt's runner is
+// still a run of this host. The collected payload keeps the sealed dispatch and the whole observed
+// WorkflowRun, so extraction and assessment read the revision, workflow, event and attempt from
+// here rather than re-reading GitHub.
+
+type QualificationRunRefusal
+  = RunReadUnreadable { refusal: RestExchangeRefusal }
+  | RunCollectedUnderAnotherInstallation { token_app: DeclaredGitHubApp, token_installation: GitHubAppInstallationId }
+  | RunSubjectMismatch { observed_run_id: Int, observed_event: String, observed_path: String?, foreign_jobs: List<Int> }
+  | RunAdvancedPastDispatchedAttempt { observed_attempt: Int }
+  | RunRevisionNotPinned { pinned: CommitSha, observed: CommitSha }
+  | RunOnAnotherBranch { pinned: NonEmptyStr, observed: String? }
+  | RunNotCompleted { status: WorkflowRunStatus }
+  | RunCompletedWithoutConclusion
+  | RunJobsUnreadable { refusal: RestExchangeRefusal }
+  | RunJobsTruncated { returned: Int, total: Int }
+  | RunFloorJobNotUnique { floor_job_name: NonEmptyStr, matching: Int }
+  | RunNeverReachedAttemptRunner { registered_runner_id: Int, runner_ids_seen: List<Int?> }
+  | RunRunnerNameDisagrees { registered_runner_id: Int, registered_runner: NonEmptyStr, observed_runner_name: String? }
+  | RunRegisteredRunnerRanAnotherJob { registered_runner: NonEmptyStr, job_name: String }
+  | RunFloorJobNotStarted { job_id: Int }
+
+// A COLLECTED RUN SAYS WHICH JOB IS THE FLOOR AND NOTHING YET ABOUT WHAT IT MEASURED. The instruments
+// are read from it afterwards by collect_qualification_instruments, from floor_job alone.
+type CollectedQualificationRun sole_constructor {
+  dispatched: DispatchedQualificationRun
+  run: WorkflowRun
+  floor_job: WorkflowJobRun
+  conclusion: WorkflowRunConclusion
+}
+
+type QualificationRunCollection
+  = QualificationRunCollected { collected: CollectedQualificationRun }
+  | QualificationRunRefused { run_id: Int, refusal: QualificationRunRefusal }
+
+fn qualification_run_collected(c: QualificationRunCollection) -> Bool {
+  match c {
+    QualificationRunCollected { collected: _ } => true
+    QualificationRunRefused { run_id: _, refusal: _ } => false
+  }
+}
+
+data dispatched_run_attempt: Int = 1
+
+fn optional_text_is(o: String?, expected: String) -> Bool {
+  match o { Present { value: v } => v == expected Absent => false }
+}
+
+// THE ONE JOIN FROM A JOB TO A JIT REGISTRATION: the runner GitHub reports took the job is the
+// name the authorized mint fixed (gunbc.runner.runner_jit_deregistration JitRegistration name).
+// Labels cannot make this join -- two runners can carry identical labels.
+fn job_ran_on(job: WorkflowJobRun, runner_id: Int) -> Bool {
+  match job.runner_id { Present { value: v } => v == runner_id Absent => false }
+}
+
+fn job_started(job: WorkflowJobRun) -> Bool {
+  match job.started_at { Present { value: _ } => true Absent => false }
+}
+
+// THE DECISION, WITHOUT I/O, over what was read. Its verdict carries the evidence and no sealed
+// payload: minting CollectedQualificationRun is collect_qualification_run's alone, so this fold is
+// open to supplied readbacks and has no success constructor to proxy.
+type QualificationRunVerdict
+  = RunVerdictCollected { run: WorkflowRun, floor_job: WorkflowJobRun, conclusion: WorkflowRunConclusion }
+  | RunVerdictRefused { refusal: QualificationRunRefusal }
+
+// WHAT THE READBACK IS JUDGED AGAINST, as a plain value: the runner name the registration minted,
+// the floor job the subject fixed, and the pinned revision. collect_qualification_run derives it from
+// the sealed subject (qualification_run_expectation); a claim supplies it directly.
+type QualificationRunExpectation {
+  registered_runner_id: Int
+  registered_runner: NonEmptyStr
+  floor_job_name: NonEmptyStr
+  revision: CommitSha
+  branch: NonEmptyStr
+}
+
+fn qualification_run_expectation(subject: QualificationDispatchSubject) -> QualificationRunExpectation {
+  QualificationRunExpectation {
+    registered_runner_id: subject.runner_id,
+    registered_runner: subject.registration.name.value,
+    floor_job_name: subject.floor_job_name,
+    revision: subject.pin.revision,
+    branch: subject.pin.name.branch,
+  }
+}
+
+fn decide_floor_job(subject: QualificationRunExpectation, run: WorkflowRun, conclusion: WorkflowRunConclusion, jobs: List<WorkflowJobRun>) -> QualificationRunVerdict {
+  let on_runner = jobs |> filter(j => job_ran_on(job: j, runner_id: subject.registered_runner_id))
+  match first(on_runner) {
+    Absent => RunVerdictRefused { refusal: RunNeverReachedAttemptRunner { registered_runner_id: subject.registered_runner_id, runner_ids_seen: jobs |> map(j => j.runner_id) } }
+    Present { value: job } =>
+      if count(on_runner) != 1 {
+        RunVerdictRefused { refusal: RunFloorJobNotUnique { floor_job_name: subject.floor_job_name, matching: count(on_runner) } }
+      } else if !optional_text_is(o: job.runner_name, expected: subject.registered_runner as String) {
+        RunVerdictRefused { refusal: RunRunnerNameDisagrees { registered_runner_id: subject.registered_runner_id, registered_runner: subject.registered_runner, observed_runner_name: job.runner_name } }
+      } else if job.name != (subject.floor_job_name as String) {
+        RunVerdictRefused { refusal: RunRegisteredRunnerRanAnotherJob { registered_runner: subject.registered_runner, job_name: job.name } }
+      } else if !job_started(job: job) {
+        RunVerdictRefused { refusal: RunFloorJobNotStarted { job_id: job.id } }
+      } else {
+        RunVerdictCollected { run: run, floor_job: job, conclusion: conclusion }
+      }
+  }
+}
+
+fn decide_qualification_run(
+  subject: QualificationRunExpectation,
+  run_id: Int,
+  run_read: RestResult<WorkflowRun>,
+  jobs_read: RestResult<WorkflowJobRunList>,
+) -> QualificationRunVerdict {
+  match run_read {
+    RestAnswered { answer: run } =>
+      if run.id != run_id || run.event != "workflow_dispatch" || !optional_text_is(o: run.path, expected: qualification_workflow_path() as String) {
+        RunVerdictRefused { refusal: RunSubjectMismatch { observed_run_id: run.id, observed_event: run.event, observed_path: run.path, foreign_jobs: [] } }
+      } else if run.run_attempt != dispatched_run_attempt {
+        RunVerdictRefused { refusal: RunAdvancedPastDispatchedAttempt { observed_attempt: run.run_attempt } }
+      } else if !optional_text_is(o: run.head_branch, expected: subject.branch as String) {
+        RunVerdictRefused { refusal: RunOnAnotherBranch { pinned: subject.branch, observed: run.head_branch } }
+      } else if (run.head_sha as String) != (subject.revision as String) {
+        RunVerdictRefused { refusal: RunRevisionNotPinned { pinned: subject.revision, observed: run.head_sha } }
+      } else {
+        match run.status {
+          Completed =>
+            match run.conclusion {
+              Absent => RunVerdictRefused { refusal: RunCompletedWithoutConclusion }
+              Present { value: conclusion } =>
+                match jobs_read {
+                  RestAnswered { answer: jobs } =>
+                    if count(jobs.jobs) != jobs.total_count {
+                      RunVerdictRefused { refusal: RunJobsTruncated { returned: count(jobs.jobs), total: jobs.total_count } }
+                    } else {
+                      let foreign = jobs.jobs |> filter(j => j.run_id != run_id || j.run_attempt != dispatched_run_attempt) |> map(j => j.id)
+                      if count(foreign) != 0 {
+                        RunVerdictRefused { refusal: RunSubjectMismatch { observed_run_id: run.id, observed_event: run.event, observed_path: run.path, foreign_jobs: foreign } }
+                      } else {
+                        decide_floor_job(subject: subject, run: run, conclusion: conclusion, jobs: jobs.jobs)
+                      }
+                    }
+                  RestRefused { refusal: r } => RunVerdictRefused { refusal: RunJobsUnreadable { refusal: classify_rest_refusal(standing: RestReadExchange { refusal: r }) } }
+                }
+            }
+          other => RunVerdictRefused { refusal: RunNotCompleted { status: other } }
+        }
+      }
+    RestRefused { refusal: r } => RunVerdictRefused { refusal: RunReadUnreadable { refusal: classify_rest_refusal(standing: RestReadExchange { refusal: r }) } }
+  }
+}
+
+// THE READBACK IS PERFORMED UNDER THE INSTALLATION THAT DISPATCHED. A sealed controller token for some
+// other App or installation could read a run and report it as installation A's; the token is joined
+// to the registration before either read, exactly as at dispatch.
+fn token_names_registration(token_app: DeclaredGitHubApp, token_installation: GitHubAppInstallationId, subject: QualificationDispatchSubject) -> Bool {
+  token_app == subject.registration.app && token_installation == subject.registration.installation
+}
+
+// THE COLLECTION'S ADMISSION IS A PLAN, DECIDED WITHOUT I/O: the reads it will make, or the refusal
+// that makes none. collect_qualification_run performs exactly the planned reads and nothing else, so
+// "a token for another App or installation reads nothing" is a claim about this pure function a
+// witness executes over a really minted subject (test.claim.runner_qualification_dispatch_witness
+// the_real_mint_admits_the_attempt_through_the_sealed_subject), not a property of an effectful path
+// no test can reach.
+type QualificationCollectionRead
+  = ReadQualificationRun { run_id: Int }
+  | ReadQualificationAttemptJobs { run_id: Int, attempt: Int }
+
+type QualificationCollectionPlan
+  = CollectionRefusedBeforeAnyRead { refusal: QualificationRunRefusal }
+  | CollectionReadsPlanned { run_id: Int, attempt: Int }
+
+fn plan_qualification_collection(subject: QualificationDispatchSubject, run_id: Int, token_app: DeclaredGitHubApp, token_installation: GitHubAppInstallationId) -> QualificationCollectionPlan {
+  if !token_names_registration(token_app: token_app, token_installation: token_installation, subject: subject) {
+    CollectionRefusedBeforeAnyRead {
+      refusal: RunCollectedUnderAnotherInstallation { token_app: token_app, token_installation: token_installation },
+    }
+  } else {
+    CollectionReadsPlanned { run_id: run_id, attempt: dispatched_run_attempt }
+  }
+}
+
+fn planned_collection_reads(plan: QualificationCollectionPlan) -> List<QualificationCollectionRead> {
+  match plan {
+    CollectionRefusedBeforeAnyRead { refusal: _ } => []
+    CollectionReadsPlanned { run_id: id, attempt: n } =>
+      [ReadQualificationRun { run_id: id }, ReadQualificationAttemptJobs { run_id: id, attempt: n }]
+  }
+}
+
+// ONE EFFECTFUL ENTRY, AND IT PERFORMS ONLY WHAT THE PLAN NAMES: the reads take their run id and
+// attempt from the CollectionReadsPlanned arm, and the refusal arm reaches no read. The reads and the
+// mint of CollectedQualificationRun live in that arm, so there is no second function that reads under
+// an unchecked token (a split helper was exactly that bypass).
+fn collect_qualification_run(dispatched: DispatchedQualificationRun, token: ControllerInstallationToken) -> QualificationRunCollection uses net: Network {
+  match plan_qualification_collection(
+    subject: dispatched.subject, run_id: dispatched.receipt.workflow_run_id,
+    token_app: token.app, token_installation: token.installation,
+  ) {
+    CollectionRefusedBeforeAnyRead { refusal: r } =>
+      QualificationRunRefused { run_id: dispatched.receipt.workflow_run_id, refusal: r }
+    CollectionReadsPlanned { run_id: run_id, attempt: attempt } => {
+      let owner = gunbc_repository.owner as NonEmptyStr
+      let repo = gunbc_repository.name as NonEmptyStr
+      let read = read_run_with(token: token, owner: owner, repo: repo, run_id: run_id)
+      let jobs = read_attempt_jobs_with(token: token, owner: owner, repo: repo, run_id: run_id, attempt: attempt)
+      match decide_qualification_run(
+        subject: qualification_run_expectation(subject: dispatched.subject),
+        run_id: run_id,
+        run_read: read.run,
+        jobs_read: jobs.jobs,
+      ) {
+        RunVerdictRefused { refusal: r } => QualificationRunRefused { run_id: run_id, refusal: r }
+        RunVerdictCollected { run: run, floor_job: floor, conclusion: conclusion } =>
+          QualificationRunCollected {
+            collected: CollectedQualificationRun {
+              dispatched: dispatched,
+              run: run,
+              floor_job: floor,
+              conclusion: conclusion,
+            },
+          }
+      }
+    }
+  }
+}
+
+// ── EXTRACT: THE INSTRUMENTS READ FROM THE COLLECTED RUN ──────────────────────────────────────
+//
+// WHERE EACH INSTRUMENT IS READ FROM IS A TOTAL MATCH, so adding an instrument to
+// gunbc.runner_throughput_qualification_route QualificationInstrument refuses to compile here until it
+// says where its reading comes from. Two are the designated floor job's log; two are this run's
+// required-floor-claim-cost artifact, whose read is attempted on every collection and today ends in a
+// typed refusal (read_claim_cost_artifact); two are not outputs of this run at all. Each of the
+// four is carried by a row below with the capability that would read it, and the two log
+// instruments carry a row too until the route invokes collect_qualification_instruments.
+type QualificationInstrumentSource
+  = ReadFromAttemptJobLog
+  | ReadFromClaimCostArtifact
+  | ReadFromBootLegReadback
+  | ReadFromCohortObservation
+
+fn qualification_instrument_source(i: QualificationInstrument) -> QualificationInstrumentSource {
+  match i {
+    FloorPhaseRows => ReadFromAttemptJobLog
+    FloorCgroupRows => ReadFromAttemptJobLog
+    ClaimCostArtifactEvalSteps => ReadFromClaimCostArtifact
+    CalibrationSpecimenWitnessLine => ReadFromClaimCostArtifact
+    GuestIdleMeminfoAndNproc => ReadFromBootLegReadback
+    ConcurrentCohortSeatWindows => ReadFromCohortObservation
+  }
+}
+
+fn qualification_instrument_read_from_job_log(i: QualificationInstrument) -> Bool {
+  match qualification_instrument_source(i: i) {
+    ReadFromAttemptJobLog => true
+    ReadFromClaimCostArtifact => false
+    ReadFromBootLegReadback => false
+    ReadFromCohortObservation => false
+  }
+}
+
+// ── THE PURE DECODER ──────────────────────────────────────────────────────────────────────────
+//
+// It decides what one log's text says and nothing about whose log it is; identity is the subject's
+// and the receipt's. It is open so the row shapes are witnessable on supplied and recorded text.
+// The phase rows are every [floor-phase] row the log printed, timed and untimed, in log order; the
+// cgroup rows are only the [floor-cgroup] rows at the slot's own level, because the levels above it
+// are other subjects' memory and a qualification of this slot must not take their peak for its own.
+type QualificationLogReadings {
+  floor_phase_rows: List<FloorPhaseRow>
+  slot_cgroup_rows: List<FloorCgroupLevelRow>
+}
+
+type InstrumentReadRefusal
+  = FloorPhaseRowGarbledInLog { line: String, cause: NonEmptyStr }
+  | FloorCgroupRowGarbledInLog { line: String, cause: NonEmptyStr }
+  | FloorPhaseRowsAbsent
+  | SlotCgroupLevelAbsent { slot_unit: NonEmptyStr, levels_seen: List<String> }
+
+type JobLogInstrumentDecode
+  = JobLogInstrumentsDecoded { readings: QualificationLogReadings }
+  | JobLogInstrumentsUndecodable { refusal: InstrumentReadRefusal }
+
+// A garbled row stops the read: a reading assembled around a row it skipped would report a phase
+// or a level as absent that the run printed.
+type JobLogRowsReading
+  = JobLogRowsRead { phases: List<FloorPhaseRow>, levels: List<FloorCgroupLevelRow> }
+  | JobLogRowsRefused { refusal: InstrumentReadRefusal }
+
+fn read_job_log_line(acc: JobLogRowsReading, line: String) -> JobLogRowsReading {
+  match acc {
+    JobLogRowsRefused { refusal: _ } => acc
+    JobLogRowsRead { phases: ps, levels: ls } =>
+      match read_floor_phase_row(line: line) {
+        Present { value: FloorPhaseRowGarbled { line: l, cause: c } } =>
+          JobLogRowsRefused { refusal: FloorPhaseRowGarbledInLog { line: l, cause: c } }
+        Present { value: FloorPhaseRowRead { row: r } } => JobLogRowsRead { phases: list_push(ps, r), levels: ls }
+        Absent =>
+          match read_floor_cgroup_level_row(line: line) {
+            Present { value: FloorCgroupRowGarbled { line: l, cause: c } } =>
+              JobLogRowsRefused { refusal: FloorCgroupRowGarbledInLog { line: l, cause: c } }
+            Present { value: FloorCgroupLevelRead { row: r } } => JobLogRowsRead { phases: ps, levels: list_push(ls, r) }
+            Absent => acc
+          }
+      }
+  }
+}
+
+fn level_is_slot(row: FloorCgroupLevelRow, slot_unit: NonEmptyStr) -> Bool {
+  ends_with(s: row.level as String, suffix: concat("/", slot_unit as String))
+}
+
+fn phase_row_is_timed(p: FloorPhaseRow) -> Bool {
+  match p {
+    FloorPhaseTimed { phase: _, wall: _ } => true
+    FloorPhaseUntimed { phase: _ } => false
+  }
+}
+
+fn decode_job_log_instruments(log: String, slot_unit: NonEmptyStr) -> JobLogInstrumentDecode {
+  match fold(split(s: log, delimiter: "\n"), init: JobLogRowsRead { phases: [], levels: [] }, f: (acc, line) => read_job_log_line(acc: acc, line: line)) {
+    JobLogRowsRefused { refusal: r } => JobLogInstrumentsUndecodable { refusal: r }
+    JobLogRowsRead { phases: phases, levels: levels } => {
+      let slot_levels = levels |> filter(l => level_is_slot(row: l, slot_unit: slot_unit))
+      if count(phases |> filter(p => phase_row_is_timed(p: p))) == 0 {
+        JobLogInstrumentsUndecodable { refusal: FloorPhaseRowsAbsent }
+      } else if count(slot_levels) == 0 {
+        JobLogInstrumentsUndecodable { refusal: SlotCgroupLevelAbsent { slot_unit: slot_unit, levels_seen: levels |> map(l => l.level as String) } }
+      } else {
+        JobLogInstrumentsDecoded { readings: QualificationLogReadings { floor_phase_rows: phases, slot_cgroup_rows: slot_levels } }
+      }
+    }
+  }
+}
+
+// ── THE READ, AND THE RECEIPT ONLY THE READ CAN MINT ──────────────────────────────────────────
+//
+// A log is admitted only if it is the designated job's: the read is addressed by the subject's job
+// id, and the join below is what a supplied log of any other job fails.
+type AttemptJobLog
+  = AttemptJobLogRead { job_id: Int, log: String }
+  | AttemptJobLogUnreadable { job_id: Int, refusal: RestExchangeRefusal }
+
+type JobLogReadRefusal
+  = JobLogOfAnotherJob { designated_job_id: Int, read_job_id: Int }
+  | JobLogUnreadable { job_id: Int, refusal: RestExchangeRefusal }
+  | JobLogEmpty { job_id: Int }
+  | JobLogUndecodable { job_id: Int, refusal: InstrumentReadRefusal }
+
+type DesignatedJobLog
+  = DesignatedJobLogText { job_id: Int, log: NonEmptyStr }
+  | DesignatedJobLogRefused { refusal: JobLogReadRefusal }
+
+fn designated_job_log(designated_job_id: Int, log: AttemptJobLog) -> DesignatedJobLog {
+  match log {
+    AttemptJobLogUnreadable { job_id: j, refusal: o } =>
+      if j != designated_job_id {
+        DesignatedJobLogRefused { refusal: JobLogOfAnotherJob { designated_job_id: designated_job_id, read_job_id: j } }
+      } else {
+        DesignatedJobLogRefused { refusal: JobLogUnreadable { job_id: j, refusal: o } }
+      }
+    AttemptJobLogRead { job_id: j, log: text } =>
+      if j != designated_job_id {
+        DesignatedJobLogRefused { refusal: JobLogOfAnotherJob { designated_job_id: designated_job_id, read_job_id: j } }
+      } else if text == "" {
+        DesignatedJobLogRefused { refusal: JobLogEmpty { job_id: j } }
+      } else {
+        DesignatedJobLogText { job_id: j, log: text as NonEmptyStr }
+      }
+  }
+}
+
+// THE SUCCESS RECEIPT IS SEALED AND CARRIES ITS EVIDENCE. Only collect_qualification_instruments
+// writes it, and only after reading the designated job's log over the network: the subject it
+// names (the collection, which carries the sealed dispatch and the joined floor job, and the slot whose
+// unit the cgroup rows are filtered to), the length (in Unicode code points, as the transport hands the body over) and the content
+// digest of the complete log body the rows came from, and the rows. A later assessment does not
+// have to trust rows detached from the job and the bytes that produced them. The decoder above is
+// open; this record is not.
+//
+// THE SEAL IS ENROLLED AS EXECUTED REDS. test.claim.qualification_job_log_receipt_forged_probe_witness
+// compiles test.probe.qualification_job_log_receipt_forged_probe -- a receipt written from invented
+// readings, and job_log_standing called from outside the collect stage -- and requires a
+// SoleConstructorViolation at QualificationJobLogReceipt and a ConstructorCallAdmissionRefused at
+// job_log_standing, beside a control that only names this module and refuses at neither. Removing
+// sole_constructor from this record or the admit list from job_log_standing turns that witness red.
+type QualificationJobLogReceipt sole_constructor {
+  collected: CollectedQualificationRun
+  slot: HostUnitSlot
+  log_code_points: Int
+  log_digest: Fnv1a64Structural
+  readings: QualificationLogReadings
+}
+
+// A STANDING PER INSTRUMENT SOURCE, NOT ONE "INSTRUMENTS READ" ARM. The job-log instruments either
+// carry the sealed receipt or the typed reason they do not; the claim-cost read carries its own
+// typed standing beside it; the boot-leg and cohort instruments are not in this stage's payload at
+// all and are rows below. Nothing in this value says the collect stage is complete.
+type JobLogInstrumentStanding
+  = QualificationJobLogInstrumentsRead { receipt: QualificationJobLogReceipt }
+  | QualificationJobLogInstrumentsRefused { refusal: JobLogReadRefusal }
+
+type QualificationCollectStage {
+  job_log: JobLogInstrumentStanding
+  claim_cost: ClaimCostArtifactRead
+}
+
+fn job_log_standing(collected: CollectedQualificationRun, slot: HostUnitSlot, log: AttemptJobLog) -> JobLogInstrumentStanding
+  admit_callers: [
+    decl_ref(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "collect_qualification_instruments_under"),
+  ]
+{
+  match designated_job_log(designated_job_id: collected.floor_job.id, log: log) {
+    DesignatedJobLogRefused { refusal: r } => QualificationJobLogInstrumentsRefused { refusal: r }
+    DesignatedJobLogText { job_id: j, log: text } =>
+      match decode_job_log_instruments(log: text as String, slot_unit: slot.unit) {
+        JobLogInstrumentsUndecodable { refusal: r } => QualificationJobLogInstrumentsRefused { refusal: JobLogUndecodable { job_id: j, refusal: r } }
+        JobLogInstrumentsDecoded { readings: rd } =>
+          QualificationJobLogInstrumentsRead {
+            receipt: QualificationJobLogReceipt {
+              collected: collected,
+              slot: slot,
+              log_code_points: string_length(s: text as String),
+              log_digest: content_hash_atom(value: text),
+              readings: rd,
+            },
+          }
+      }
+  }
+}
+
+fn attempt_job_log_of(read: WorkflowJobLogRead) -> AttemptJobLog {
+  match read.log {
+    RestAnswered { answer: text } => AttemptJobLogRead { job_id: read.job_id, log: text }
+    RestRefused { refusal: r } => AttemptJobLogUnreadable { job_id: read.job_id, refusal: classify_rest_refusal(standing: RestReadExchange { refusal: r }) }
+  }
+}
+
+// THE CLAIM-COST ARTIFACT, READ AS FAR AS ANY BOUND REALIZATION CAN READ IT. It is looked up by the
+// name the floor workflow uploads it under (gunbc.witness_floor_workflow
+// required_floor_claim_cost_artifact_name), downloaded through GitHub's redirect, and every way that
+// can fail is its own arm. An archive that DID arrive is still not a reading: it is a zip, and no
+// inflate reader exists to take the TSV out of it, so that arm says so instead of passing bytes on
+// as if they were the TSV. There is deliberately no parsed arm yet; it lands with the capability the
+// parse_claim_cost_tsv row of qualification_instrument_extraction_frontier_rows names, at which point
+// this read hands the member to gunbc.floor_cost_distribution parse_claim_cost_tsv.
+type ClaimCostArtifactRead
+  = ClaimCostArtifactListUnreadable { refusal: RestExchangeRefusal }
+  | ClaimCostArtifactListTruncated { returned: Int, total: Int }
+  | ClaimCostArtifactAbsent { names_seen: List<String> }
+  | ClaimCostArtifactAmbiguous { artifact_ids: List<Int> }
+  | ClaimCostRunUnreadable { refusal: RestExchangeRefusal }
+  | ClaimCostRunAdvancedPastAttempt { observed_attempt: Int }
+  | ClaimCostArtifactExpired { artifact_id: Int }
+  | ClaimCostArchiveUnreadable { artifact_id: Int, refusal: RestExchangeRefusal }
+  | ClaimCostArchiveNotInflatable { artifact_id: Int }
+
+fn claim_cost_artifacts_named(listed: ActionsArtifactList) -> List<ActionsArtifact> {
+  listed.artifacts |> filter(a => a.name == required_floor_claim_cost_artifact_name)
+}
+
+fn claim_cost_artifact_listed(listed: ActionsArtifactList) -> ActionsArtifact? {
+  let named = claim_cost_artifacts_named(listed: listed)
+  if count(named) == 1 { named |> first } else { none }
+}
+
+// none: the listing names an unexpired claim-cost artifact and the download is owed.
+fn listed_claim_cost_artifact(listed: RestResult<ActionsArtifactList>) -> ActionsArtifact? {
+  match listed {
+    RestAnswered { answer: l } => claim_cost_artifact_listed(listed: l)
+    RestRefused { refusal: _ } => none
+  }
+}
+
+fn conclude_claim_cost_listing(listed: RestResult<ActionsArtifactList>) -> ClaimCostArtifactRead? {
+  match listed {
+    RestAnswered { answer: l } =>
+      if count(l.artifacts) != l.total_count {
+        Present { value: ClaimCostArtifactListTruncated { returned: count(l.artifacts), total: l.total_count } }
+      } else {
+        match claim_cost_artifact_listed(listed: l) {
+          Absent =>
+            if count(claim_cost_artifacts_named(listed: l)) > 1 {
+              Present { value: ClaimCostArtifactAmbiguous { artifact_ids: claim_cost_artifacts_named(listed: l) |> map(a => a.id) } }
+            } else {
+              Present { value: ClaimCostArtifactAbsent { names_seen: l.artifacts |> map(a => a.name) } }
+            }
+          Present { value: a } =>
+            if a.expired { Present { value: ClaimCostArtifactExpired { artifact_id: a.id } } } else { none }
+        }
+      }
+    RestRefused { refusal: r } => Present { value: ClaimCostArtifactListUnreadable { refusal: classify_rest_refusal(standing: RestReadExchange { refusal: r }) } }
+  }
+}
+
+// THE ARTIFACT IS BOUND TO ATTEMPT 1 BY READING THE RUN AFTER THE LISTING. Upstream's artifact object
+// names its workflow run's id, head SHA and branch but no attempt, and a re-run reuses the run id, so a
+// listing alone cannot tell attempt 1's artifact from a re-run's. A re-run that uploaded before the
+// listing was taken had already advanced the run, so re-reading the run AFTER the listing and requiring
+// run_attempt to still be the dispatched attempt excludes every artifact the listing could have seen
+// from a later attempt. none: the run is still at the collected attempt.
+fn conclude_claim_cost_attempt(run: RestResult<WorkflowRun>) -> ClaimCostArtifactRead? {
+  match run {
+    RestAnswered { answer: r } =>
+      if r.run_attempt != dispatched_run_attempt {
+        Present { value: ClaimCostRunAdvancedPastAttempt { observed_attempt: r.run_attempt } }
+      } else {
+        none
+      }
+    RestRefused { refusal: f } => Present { value: ClaimCostRunUnreadable { refusal: classify_rest_refusal(standing: RestReadExchange { refusal: f }) } }
+  }
+}
+
+// A 410 ON THE DOWNLOAD IS UPSTREAM'S EXPIRY ANSWER (actions/download-artifact documents 410 Gone for
+// an expired artifact), so it is ClaimCostArtifactExpired like the listing's own flag, not a generic
+// unreadable archive.
+fn conclude_claim_cost_download(artifact_id: Int, archive: RestResult<Bytes>) -> ClaimCostArtifactRead {
+  match archive {
+    RestAnswered { answer: _ } => ClaimCostArchiveNotInflatable { artifact_id: artifact_id }
+    RestRefused { refusal: r } =>
+      match r {
+        RestStatusRefused { status: st, body: _ } =>
+          if st == 410 {
+            ClaimCostArtifactExpired { artifact_id: artifact_id }
+          } else {
+            ClaimCostArchiveUnreadable { artifact_id: artifact_id, refusal: classify_rest_refusal(standing: RestReadExchange { refusal: r }) }
+          }
+        RestTransportRefused { cause: _ } => ClaimCostArchiveUnreadable { artifact_id: artifact_id, refusal: classify_rest_refusal(standing: RestReadExchange { refusal: r }) }
+        RestBodyUndecodable { status: _, cause: _ } => ClaimCostArchiveUnreadable { artifact_id: artifact_id, refusal: classify_rest_refusal(standing: RestReadExchange { refusal: r }) }
+      }
+  }
+}
+
+fn read_claim_cost_artifact(token: ControllerInstallationToken, owner: NonEmptyStr, repo: NonEmptyStr, run_id: Int) -> ClaimCostArtifactRead
+  uses net: Network
+  admit_callers: [
+    decl_ref(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "collect_qualification_instruments_under"),
+  ]
+{
+  let listed = list_run_artifacts_with(token: token, owner: owner, repo: repo, run_id: run_id)
+  let after = read_run_with(token: token, owner: owner, repo: repo, run_id: run_id)
+  match conclude_claim_cost_listing(listed: listed.listed) {
+    Present { value: refused } => refused
+    Absent =>
+      match conclude_claim_cost_attempt(run: after.run) {
+        Present { value: refused } => refused
+        Absent =>
+      match listed_claim_cost_artifact(listed: listed.listed) {
+        Absent => ClaimCostArtifactAbsent { names_seen: [] }
+        Present { value: a } => {
+          let archive = download_artifact_with(token: token, owner: owner, repo: repo, artifact_id: a.id)
+          conclude_claim_cost_download(artifact_id: a.id, archive: archive.archive)
+        }
+      }
+      }
+  }
+}
+
+// THE PRODUCTION ENTRY. It takes the sealed collection and the controller token, and refuses before any
+// read unless that token is the registration's App and installation (token_names_registration, the
+// join collect_qualification_run makes), so it reads nothing under another installation. Nothing
+// else a caller could cross-wire: the repository is gunbc_repository, the run, revision and attempt are the
+// collection's, the floor job is the one collect_qualification_run joined to the minted runner, and
+// the slot is that registration's own host-unit slot. It reads the floor job's log and the claim-cost
+// artifact and returns a standing per instrument source. Its consumer is the route's collect stage
+// (gunbc.runner_throughput_qualification_route CollectInstruments, standing mtcollins1_collect_leg),
+// which does not invoke it yet: that edge is the row below.
+type QualificationCollectOutcome
+  = QualificationCollected { stage: QualificationCollectStage }
+  | QualificationCollectUnderAnotherInstallation { token_app: DeclaredGitHubApp, token_installation: GitHubAppInstallationId }
+
+// THE READ PLAN, PURE: WHICH READS THE COLLECTOR MAY MAKE, DECIDED BEFORE ANY OF THEM. A token that
+// does not name the registration's App and installation (token_names_registration, the same join
+// collect_qualification_run makes) plans no reads at all; otherwise the plan is the designated floor
+// job's log and this run's artifacts, by id. The collector below performs exactly the reads its plan
+// names and takes the ids from the plan, so a claim on this function with supplied values is a claim
+// on what the collector reads.
+type CollectRead
+  = ReadFloorJobLog { job_id: Int }
+  | ReadRunArtifacts { run_id: Int }
+
+type CollectReadPlan
+  = CollectReadsRefused { token_app: DeclaredGitHubApp, token_installation: GitHubAppInstallationId }
+  | CollectReadsPlanned { job_id: Int, run_id: Int }
+
+fn collect_read_plan(
+  subject: QualificationDispatchSubject,
+  token_app: DeclaredGitHubApp,
+  token_installation: GitHubAppInstallationId,
+  floor_job_id: Int,
+  run_id: Int,
+) -> CollectReadPlan {
+  if token_names_registration(token_app: token_app, token_installation: token_installation, subject: subject) {
+    CollectReadsPlanned { job_id: floor_job_id, run_id: run_id }
+  } else {
+    CollectReadsRefused { token_app: token_app, token_installation: token_installation }
+  }
+}
+
+fn collect_read_plan_reads(plan: CollectReadPlan) -> List<CollectRead> {
+  match plan {
+    CollectReadsRefused { token_app: _, token_installation: _ } => []
+    CollectReadsPlanned { job_id: j, run_id: r } => [ReadFloorJobLog { job_id: j }, ReadRunArtifacts { run_id: r }]
+  }
+}
+
+fn collect_qualification_instruments(collected: CollectedQualificationRun, token: ControllerInstallationToken) -> QualificationCollectOutcome uses net: Network {
+  match collect_read_plan(
+    subject: collected.dispatched.subject,
+    token_app: token.app,
+    token_installation: token.installation,
+    floor_job_id: collected.floor_job.id,
+    run_id: collected.dispatched.receipt.workflow_run_id,
+  ) {
+    CollectReadsRefused { token_app: a, token_installation: i } => QualificationCollectUnderAnotherInstallation { token_app: a, token_installation: i }
+    CollectReadsPlanned { job_id: _, run_id: _ } => collect_qualification_instruments_under(collected: collected, token: token)
+  }
+}
+
+// THE READS, CONFINED TO THE CHECKED ENTRY. Only collect_qualification_instruments may call this, and
+// only after its read plan admitted the token; the job id and run id are the sealed collection's own,
+// never arguments, so no caller can pair a collection with another run's id or read under a token the
+// plan did not admit.
+fn collect_qualification_instruments_under(collected: CollectedQualificationRun, token: ControllerInstallationToken) -> QualificationCollectOutcome
+  uses net: Network
+  admit_callers: [
+    decl_ref(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "collect_qualification_instruments"),
+  ]
+{
+  let job_id = collected.floor_job.id
+  let run_id = collected.dispatched.receipt.workflow_run_id
+  let owner = gunbc_repository.owner as NonEmptyStr
+  let repo = gunbc_repository.name as NonEmptyStr
+  let slot = collected.dispatched.subject.slot
+  let log = attempt_job_log_of(read: read_job_log_with(token: token, owner: owner, repo: repo, job_id: job_id))
+  let claim_cost = read_claim_cost_artifact(token: token, owner: owner, repo: repo, run_id: run_id)
+  QualificationCollected { stage: QualificationCollectStage { job_log: job_log_standing(collected: collected, slot: slot, log: log), claim_cost: claim_cost } }
+}
+
+// ── THE INSTRUMENTS THIS RUN'S LOG DOES NOT CARRY, EACH WITH THE CAPABILITY THAT WOULD READ IT ──
+//
+// The extraction above reads every instrument qualification_instrument_source places on the job
+// log. The remaining four are three facts, so three rows: one per missing capability, so that each
+// row is retired by its own trigger and by nothing else.
+data qualification_instrument_extraction_frontier_rows: List<FrontierRow> = [
+  frontier_row_decl(
+    ref: decl_ref(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "collect_qualification_instruments"),
+    reason: "FloorPhaseRows and FloorCgroupRows have an implemented extraction authority and no production consumer. collect_qualification_instruments reads the designated floor job's log and mints the sealed QualificationJobLogReceipt, but nothing on the route calls it: the collect stage's standing is gunbc.runner_throughput_qualification_route mtcollins1_collect_leg, LegAuthorityImplemented, and only witnesses reach the decoder. Its input is the CollectedQualificationRun the dispatch leg's collect_qualification_run returns, whose floor job is already joined to the minted runner",
+    dissolution: unbound_dissolution(description: "the qualification route's collect stage invokes collect_qualification_instruments with the CollectedQualificationRun collect_qualification_run returned and the controller token, on an executed route, so mtcollins1_collect_leg is LegWired and FloorPhaseRows and FloorCgroupRows are read from a real run's designated job. NOT satisfied by a witness calling the decoder or the subject join, nor by the collector compiling"),
+  ),
+  frontier_row_decl(
+    ref: decl_ref(module_path: "gunbc.floor_cost_distribution", decl_name: "parse_claim_cost_tsv"),
+    reason: "ClaimCostArtifactEvalSteps and CalibrationSpecimenWitnessLine are both read from the required-floor-claim-cost TSV (gunbc.floor_cost_distribution parse_claim_cost_tsv; the calibration specimen's row is joined there by calibration_specimen_grounding). Neither is on the job log: on the recorded required-floor log of run 35048059968 / job 104642384772 (test.fixture recorded_required_floor_log_excerpt) there are zero [witness] lines and zero occurrences of the specimen identity, and eval_steps appear only on the [over-cost] preview, a 25-row truncated view that is not the instrument. The required floor job uploads the artifact (gunbc.witness_floor_workflow required_floor_claim_cost_upload_bound_step, bound by gunbc.compiler_gate_workflow), and read_claim_cost_artifact lists it under the registration's installation token, refuses zero or several same-name artifacts, binds the listing to the collected attempt by re-reading the run after it (ClaimCostRunAdvancedPastAttempt), and downloads the one artifact. What does not exist is the reading after the download: an uploaded artifact is always a zip, the REST handler reads every body as UTF-8 text (extdeps.transports.rest RestBodyObservation body: String), so DownloadArtifact answers RestBodyUndecodable today and a body that did arrive is ClaimCostArchiveNotInflatable",
+    dissolution: unbound_dissolution(description: "the REST transport carries a binary response body, AND an inflate reader takes the exact required_floor_claim_cost.tsv member out of one upload-artifact zip, AND that member is parsed by parse_claim_cost_tsv into a reading bound to this collected run -- the artifact downloaded is the one listed for the sealed run id at the collected attempt, carried with its artifact id beside the parsed rows in the sealed receipt -- SUFFICIENT FOR collect_qualification_instruments to read ClaimCostArtifactEvalSteps and CalibrationSpecimenWitnessLine from the same run as the job log, and for qualification_instrument_source to place both on that read. NOT satisfied by the binary transport or the inflate reader alone, by reading any other member, by the [over-cost] preview or any other truncated view, by a new print of eval_steps into the log, or by an artifact downloaded outside this route"),
+  ),
+  frontier_row_decl(
+    ref: decl_ref(module_path: "gunbc.runner_throughput_qualification_route", decl_name: "mtcollins1_boot_leg"),
+    reason: "GuestIdleMeminfoAndNproc is not a run output: the guest's idle MemTotal, MemAvailable (extdeps.linux.proc_meminfo), nproc and uname -m are read before the job starts, by the boot leg's runner-host-up readback, and that leg is gunbc.runner_throughput_qualification_route mtcollins1_boot_leg, still LegAwaitingAuthority",
+    dissolution: unbound_dissolution(description: "the boot leg's terminal is the runner host observed up and its readback carries the guest's idle meminfo, nproc and machine word, SUFFICIENT FOR this route to hand that readback to the qualification receipt beside this run's extraction. NOT satisfied by a meminfo read inside the floor job, which is a loaded guest rather than an idle one"),
+  ),
+  frontier_row_decl(
+    ref: decl_ref(module_path: "product.capacity.cohort_observation", decl_name: "seal_cohort"),
+    reason: "ConcurrentCohortSeatWindows is sealed by product.capacity.cohort_observation seal_cohort over a roster of seats released at one barrier, each with ready, start and end instants and a settlement. This route registers ONE ephemeral slot and dispatches one floor, so there is no cohort and no barrier to read; one job's started_at and completed_at are not a seat window",
+    dissolution: unbound_dissolution(description: "a qualification route that registers a roster of concurrent seats on the host, releases them at a barrier, and reads each seat's ready, start and end back, SUFFICIENT FOR seal_cohort to seal that reading for this host. NOT satisfied by a cohort of one, nor by job timestamps standing in for seat readiness"),
+  ),
+]
diff --git a/dag/gunbc/runner/runner_qualification_ref_pin.dag b/dag/gunbc/runner/runner_qualification_ref_pin.dag
new file mode 100644
index 00000000000..13f1645beab
--- /dev/null
+++ b/dag/gunbc/runner/runner_qualification_ref_pin.dag
@@ -0,0 +1,337 @@
+module gunbc.runner.runner_qualification_ref_pin
+
+import std.types { Bool, CommitSha, Int, List, NonEmptyStr, String }
+import std.resources { Network }
+import std.decl_ref { decl_ref }
+import extdeps.transports.rest {
+  RestResult, RestAnswered, RestRefused, RestReadExchange, RestMutationExchange, classify_rest_refusal,
+  RestRefusal, RestExchangeRefusal, RestExchangeStatusRefused,
+  RestExchangeCommitAmbiguous, RestExchangeUnreached, RestExchangeUndecodable,
+}
+import gunbc.repository { gunbc_repository }
+import gunbc.generated_artifact { artifact_path, FleetConvergeYamlArtifact }
+import gunbc.fleet.org_actions_inspection { RunnerGroupListDecode, RunnerGroupListDecoded, RunnerGroupListDecodeRefused }
+import gunbc.runner_group_restriction_observation {
+  MicrovmRunnerGroupStanding, RunnerGroupRestrictedToWorkflow, RunnerGroupRestrictionRefused, RestrictedRunnerGroup,
+  observe_runner_group_restriction,
+}
+import gunbc.github_effect_perform {
+  ControllerInstallationToken, GitRefRead, read_git_ref_with, create_git_ref_with, delete_git_ref_with,
+  read_runner_groups_with, update_runner_group_workflows_with,
+}
+import extdeps.github.git_database { GitRefWire, GitRefDeletedBody }
+
+// THE QUALIFICATION REF PIN: ONE CREATE-ONCE BRANCH PER ATTEMPT, AND THE DEDICATED GROUP PINNED TO IT.
+//
+// WHY A BRANCH. The floor must run the pinned revision and nothing else, and the runner that serves
+// it must accept no other code. The JIT slot registers into a runner group restricted to one
+// selected workflow, and GitHub selects a dispatched (non-reusable) workflow only at a branch
+// ("Pin non-reusable workflows to a branch", extdeps.github.org_actions github.OrgRunnerGroupsRest);
+// a SHA or tag pin is not available to it. So the pin is a branch created for this attempt at the
+// pinned revision, and the dedicated qualification group is restricted to the qualification workflow
+// at THAT branch. A dispatch can then only run the revision the branch was created at, and a run on
+// any other ref -- the default branch after a move, another attempt's branch -- does not match the
+// group, so the attempt's runner never takes it and collection ends RunNeverReachedAttemptRunner.
+//
+// CREATE-ONCE. The branch is created by CreateRef, which never moves an existing ref (422 "Reference
+// already exists"); a branch already present before creation is refused, never adopted or moved,
+// because its revision is not one this attempt pinned. Readback must show the exact revision.
+//
+// CONFINED BY CONSTRUCTION. Every ref this module touches is a QualificationBranchName, minted only by
+// qualification_branch_name, which admits a single path segment under refs/heads/qualification/.
+// Every group write goes through a QualificationGroupWriteTarget, minted only from a read whose name
+// is qualification_runner_group_name -- the DEDICATED group; no other group can be written.
+//
+// REMOVED ON EVERY EXIT, by readback (remove_qualification_ref_pin), the same ensure shape as
+// gunbc.runner.runner_jit_deregistration: absence is read, never inferred from a delete status.
+// The group stays restricted to the deleted branch's path until the next attempt pins it: no run can
+// match a branch that no longer exists, so the stale entry admits nothing.
+//
+// AUTHORIZATION, TWO FACTS. The per-attempt branch create and delete are pre-approved by the
+// operator's 2026-10-03 ruling, whose scope the operator confirmed on 2026-10-05
+// (gunbc.auth.privileged_effect_census runner_lifecycle_scope_ruling). The dedicated group's
+// selected-workflow pin is NOT under that ruling: it is authorized by its own federated standing, the
+// census row's parameters selected without a ruling discharge, and is limited to the dedicated
+// qualification group by this module's construction. The token is the gunbai-ci installation token
+// (contents:write for the ref; organization self-hosted-runners write for the group). No workflow
+// fires on creating the branch: see test.claim.runner_qualification_ref_pin_witness.
+
+data qualification_branch_prefix: NonEmptyStr = "qualification/"
+
+// THE QUALIFICATION WORKFLOW IS THE GENERATED FLEET-CONVERGE WORKFLOW, and the group selects it at
+// the pin branch. These live here, beside the group write that consumes them; the dispatch module
+// (gunbc.runner.runner_qualification_dispatch) imports them.
+fn qualification_workflow_path() -> NonEmptyStr {
+  artifact_path(a: FleetConvergeYamlArtifact) as NonEmptyStr
+}
+
+// The selected-workflow spelling a restricted runner group carries (owner/repo/path@ref), the same
+// form gunbc.runner_group_restriction_observation microvm_shakedown_selected_workflow derives.
+fn qualification_selected_workflow(branch: NonEmptyStr) -> NonEmptyStr {
+  join([gunbc_repository.full_name, "/", qualification_workflow_path() as String, "@refs/heads/", branch as String], "") as NonEmptyStr
+}
+data qualification_runner_group_name: NonEmptyStr = "runner-qualification"
+
+// ── THE BRANCH NAME ─────────────────────────────────────────────────────────────────────────────
+
+type QualificationBranchName sole_constructor {
+  attempt: NonEmptyStr
+  branch: NonEmptyStr
+}
+
+type QualificationBranchNameStanding
+  = QualificationBranchNamed { name: QualificationBranchName }
+  | QualificationBranchNameRefused { attempt: String, cause: NonEmptyStr }
+
+// ONE PATH SEGMENT UNDER THE PREFIX. An attempt label carrying a slash, a `..`, whitespace, a ref
+// metacharacter or a leading dot would address a ref outside refs/heads/qualification/<attempt> or an
+// invalid one, so it refuses rather than being escaped.
+fn attempt_is_one_ref_segment(attempt: String) -> Bool {
+  string_length(s: attempt) > 0
+    && !starts_with(s: attempt, prefix: ".")
+    && !string_contains(s: attempt, pattern: "/")
+    && !string_contains(s: attempt, pattern: "..")
+    && !string_contains(s: attempt, pattern: " ")
+    && !string_contains(s: attempt, pattern: "~")
+    && !string_contains(s: attempt, pattern: "^")
+    && !string_contains(s: attempt, pattern: ":")
+    && !string_contains(s: attempt, pattern: "?")
+    && !string_contains(s: attempt, pattern: "*")
+    && !string_contains(s: attempt, pattern: "[")
+    && !string_contains(s: attempt, pattern: "\\")
+    && !string_contains(s: attempt, pattern: "@{")
+    && !ends_with(s: attempt, suffix: ".lock")
+}
+
+fn qualification_branch_name(attempt: NonEmptyStr) -> QualificationBranchNameStanding {
+  if attempt_is_one_ref_segment(attempt: attempt as String) {
+    QualificationBranchNamed {
+      name: QualificationBranchName { attempt: attempt, branch: concat(qualification_branch_prefix as String, attempt as String) as NonEmptyStr },
+    }
+  } else {
+    QualificationBranchNameRefused { attempt: attempt as String, cause: "the attempt label is not one ref segment, so the branch would leave refs/heads/qualification/" as NonEmptyStr }
+  }
+}
+
+fn branch_full_ref(name: QualificationBranchName) -> NonEmptyStr {
+  concat("refs/heads/", name.branch as String) as NonEmptyStr
+}
+
+fn branch_api_ref(name: QualificationBranchName) -> NonEmptyStr {
+  concat("heads/", name.branch as String) as NonEmptyStr
+}
+
+// ── THE DEDICATED GROUP ─────────────────────────────────────────────────────────────────────────
+
+type QualificationGroupWriteTarget sole_constructor {
+  group_id: Int
+}
+
+type QualificationGroupTargetStanding
+  = QualificationGroupTargeted { target: QualificationGroupWriteTarget }
+  | QualificationGroupNotTargetable { cause: NonEmptyStr }
+
+// The only group that may be written is the one whose name is the dedicated qualification group's,
+// found exactly once in a complete read. Any other name -- the shakedown group, Default -- refuses.
+fn qualification_group_target(requested: NonEmptyStr, listed: RunnerGroupListDecode) -> QualificationGroupTargetStanding {
+  if (requested as String) != (qualification_runner_group_name as String) {
+    QualificationGroupNotTargetable { cause: concat("only the dedicated qualification group may be written; refused: ", requested as String) as NonEmptyStr }
+  } else {
+    match listed {
+      RunnerGroupListDecodeRefused { reason: r } => QualificationGroupNotTargetable { cause: r }
+      RunnerGroupListDecoded { groups: gs } => {
+        let rows = gs |> filter(g => (g.name as String) == (requested as String))
+        match first(rows) {
+          Absent => QualificationGroupNotTargetable { cause: "the dedicated qualification runner group does not exist" as NonEmptyStr }
+          Present { value: row } =>
+            if count(rows) != 1 {
+              QualificationGroupNotTargetable { cause: "the dedicated qualification runner group name is duplicated" as NonEmptyStr }
+            } else {
+              QualificationGroupTargeted { target: QualificationGroupWriteTarget { group_id: row.id } }
+            }
+        }
+      }
+    }
+  }
+}
+
+// ── THE PIN ─────────────────────────────────────────────────────────────────────────────────────
+
+type QualificationRefPin sole_constructor {
+  name: QualificationBranchName
+  revision: CommitSha
+  group: RestrictedRunnerGroup
+}
+
+type QualificationRefPinRefusal
+  = PinBranchNameRefused { cause: NonEmptyStr }
+  | PinBranchPreexisting { observed_sha: String }
+  | PinBranchReadUnreadable { refusal: RestExchangeRefusal }
+  | PinBranchCreateRefused { status: Int, body: String }
+  | PinBranchCreateAmbiguous { detail: NonEmptyStr }
+  | PinBranchReadbackMismatch { pinned: CommitSha, observed: String }
+  | PinGroupNotTargetable { cause: NonEmptyStr }
+  | PinGroupWriteNotSucceeded { refusal: RestExchangeRefusal }
+  | PinGroupReadbackRefused { standing: MicrovmRunnerGroupStanding }
+
+type QualificationRefPinStanding
+  = QualificationRefPinned { pin: QualificationRefPin }
+  | QualificationRefPinRefused { attempt: NonEmptyStr, refusal: QualificationRefPinRefusal }
+
+// A REFUSED READ OF THE REF IS ABSENCE ONLY WHEN GITHUB DECIDED 404; every other refusal is unreadable.
+fn branch_absent(refusal: RestExchangeRefusal) -> Bool {
+  match refusal {
+    RestExchangeStatusRefused { status: s, body: _ } => (s as Int) == 404
+    RestExchangeCommitAmbiguous { detail: _ } => false
+    RestExchangeUnreached { cause: _ } => false
+    RestExchangeUndecodable { status: _, cause: _ } => false
+  }
+}
+
+// THE CREATE'S STANDING, decided from the mutation classifier: only a created ref proceeds to
+// readback; a 422 is the create-once refusal (the ref exists); an ambiguous answer is its own arm --
+// the ref may exist, so removal is still owed.
+fn branch_create_refusal(created: RestResult<GitRefWire>) -> QualificationRefPinRefusal? {
+  match created {
+    RestAnswered { answer: _ } => none
+    RestRefused { refusal } =>
+      match classify_rest_refusal(standing: RestMutationExchange { refusal: refusal }) {
+        RestExchangeStatusRefused { status: s, body: b } =>
+          if (s as Int) == 422 { Present { value: PinBranchPreexisting { observed_sha: "(422 Reference already exists)" } } }
+          else { Present { value: PinBranchCreateRefused { status: s as Int, body: b } } }
+        RestExchangeCommitAmbiguous { detail: d } => Present { value: PinBranchCreateAmbiguous { detail: d } }
+        RestExchangeUnreached { cause: c } => Present { value: PinBranchCreateAmbiguous { detail: c } }
+        RestExchangeUndecodable { status: _, cause: c } => Present { value: PinBranchCreateAmbiguous { detail: c } }
+      }
+  }
+}
+
+fn ref_read_refusal(refusal: RestRefusal) -> RestExchangeRefusal {
+  classify_rest_refusal(standing: RestReadExchange { refusal: refusal })
+}
+
+// THE PIN'S ONLY MINT, over values read back. Callers are admitted by name: the effectful ensure, and
+// the witness claims that supply readbacks at this interface and return Bool.
+fn qualification_ref_pin_of(
+  name: QualificationBranchName,
+  revision: CommitSha,
+  readback: RestResult<GitRefWire>,
+  group: MicrovmRunnerGroupStanding,
+) -> QualificationRefPinStanding
+  admit_callers: [
+    decl_ref(module_path: "gunbc.runner.runner_qualification_ref_pin", decl_name: "ensure_qualification_ref_pin"),
+    decl_ref(module_path: "test.claim.runner_qualification_ref_pin_witness", decl_name: "the_pin_is_minted_only_from_the_exact_revision_and_the_pinned_group"),
+    decl_ref(module_path: "test.claim.runner_qualification_dispatch_witness", decl_name: "the_real_mint_admits_the_attempt_through_the_sealed_subject"),
+    decl_ref(module_path: "test.claim.runner_qualification_dispatch_witness", decl_name: "a_delivery_from_another_dispatch_on_the_same_slot_refuses"),
+    decl_ref(module_path: "test.claim.runner_qualification_dispatch_witness", decl_name: "the_production_mint_over_todays_fleet_converge_workflow_refuses_at_the_attempt_input"),
+  ]
+{
+  match readback {
+    RestAnswered { answer: observed } =>
+      if observed.object.sha != (revision as String) {
+        QualificationRefPinRefused { attempt: name.attempt, refusal: PinBranchReadbackMismatch { pinned: revision, observed: observed.object.sha } }
+      } else {
+        match group {
+          RunnerGroupRestrictedToWorkflow { restriction: r } =>
+            QualificationRefPinned { pin: QualificationRefPin { name: name, revision: revision, group: r } }
+          other => QualificationRefPinRefused { attempt: name.attempt, refusal: PinGroupReadbackRefused { standing: other } }
+        }
+      }
+    RestRefused { refusal } => QualificationRefPinRefused { attempt: name.attempt, refusal: PinBranchReadUnreadable { refusal: ref_read_refusal(refusal: refusal) } }
+  }
+}
+
+fn pin_refused(attempt: NonEmptyStr, refusal: QualificationRefPinRefusal) -> QualificationRefPinStanding {
+  QualificationRefPinRefused { attempt: attempt, refusal: refusal }
+}
+
+fn ensure_qualification_ref_pin(
+  token: ControllerInstallationToken,
+  organization: NonEmptyStr,
+  attempt: NonEmptyStr,
+  revision: CommitSha,
+) -> QualificationRefPinStanding uses net: Network {
+  let owner = gunbc_repository.owner as NonEmptyStr
+  let repo = gunbc_repository.name as NonEmptyStr
+  match qualification_branch_name(attempt: attempt) {
+    QualificationBranchNameRefused { attempt: _, cause: c } => pin_refused(attempt: attempt, refusal: PinBranchNameRefused { cause: c })
+    QualificationBranchNamed { name: name } => {
+      let before = read_git_ref_with(token: token, owner: owner, repo: repo, ref: branch_api_ref(name: name))
+      match before.reference {
+        RestAnswered { answer: existing } => pin_refused(attempt: attempt, refusal: PinBranchPreexisting { observed_sha: existing.object.sha })
+        RestRefused { refusal: read_refusal } =>
+          if !branch_absent(refusal: ref_read_refusal(refusal: read_refusal)) {
+            pin_refused(attempt: attempt, refusal: PinBranchReadUnreadable { refusal: ref_read_refusal(refusal: read_refusal) })
+          } else {
+            match branch_create_refusal(created: create_git_ref_with(token: token, owner: owner, repo: repo, full_ref: branch_full_ref(name: name), sha: revision as String)) {
+              Present { value: r } => pin_refused(attempt: attempt, refusal: r)
+              Absent => {
+                let after = read_git_ref_with(token: token, owner: owner, repo: repo, ref: branch_api_ref(name: name))
+                let selected = qualification_selected_workflow(branch: name.branch)
+                match qualification_group_target(requested: qualification_runner_group_name, listed: read_runner_groups_with(token: token, organization: organization)) {
+                  QualificationGroupNotTargetable { cause: c } => pin_refused(attempt: attempt, refusal: PinGroupNotTargetable { cause: c })
+                  QualificationGroupTargeted { target: t } =>
+                    match update_runner_group_workflows_with(token: token, organization: organization, runner_group_id: t.group_id, selected_workflows: [selected as String]) {
+                      RestAnswered { answer: _ } =>
+                        qualification_ref_pin_of(
+                          name: name,
+                          revision: revision,
+                          readback: after.reference,
+                          group: observe_runner_group_restriction(name: qualification_runner_group_name, selected_workflow: selected, listed: read_runner_groups_with(token: token, organization: organization)),
+                        )
+                      RestRefused { refusal: w } => pin_refused(attempt: attempt, refusal: PinGroupWriteNotSucceeded { refusal: classify_rest_refusal(standing: RestMutationExchange { refusal: w }) })
+                    }
+                }
+              }
+            }
+          }
+      }
+    }
+  }
+}
+
+// ── REMOVAL, ON EVERY EXIT ──────────────────────────────────────────────────────────────────────
+
+type QualificationRefPinRemoval
+  = QualificationBranchRemoved { name: QualificationBranchName, deleted: Bool }
+  | QualificationBranchRemovalRefused { name: QualificationBranchName, cause: QualificationBranchRemovalRefusal }
+
+type QualificationBranchRemovalRefusal
+  = BranchStillPresent { observed_sha: String, delete_refusal: RestExchangeRefusal? }
+  | BranchReadUnreadable { refusal: RestExchangeRefusal }
+
+// THE VERDICT READS THE READBACK AND NOTHING ELSE: a branch is removed when a read finds it absent.
+// delete_refusal is the delete's own refusal when one was sent and refused, carried only to explain a
+// branch still present; it never decides the verdict.
+fn classify_branch_removal(name: QualificationBranchName, readback: RestResult<GitRefWire>, deleted: Bool, delete_refusal: RestExchangeRefusal?) -> QualificationRefPinRemoval {
+  match readback {
+    RestAnswered { answer: present } => QualificationBranchRemovalRefused { name: name, cause: BranchStillPresent { observed_sha: present.object.sha, delete_refusal: delete_refusal } }
+    RestRefused { refusal } =>
+      if branch_absent(refusal: ref_read_refusal(refusal: refusal)) {
+        QualificationBranchRemoved { name: name, deleted: deleted }
+      } else {
+        QualificationBranchRemovalRefused { name: name, cause: BranchReadUnreadable { refusal: ref_read_refusal(refusal: refusal) } }
+      }
+  }
+}
+
+fn delete_refusal_of(deleted: RestResult<GitRefDeletedBody>) -> RestExchangeRefusal? {
+  match deleted {
+    RestAnswered { answer: _ } => none
+    RestRefused { refusal } => Present { value: classify_rest_refusal(standing: RestMutationExchange { refusal: refusal }) }
+  }
+}
+
+fn remove_qualification_ref_pin(token: ControllerInstallationToken, name: QualificationBranchName) -> QualificationRefPinRemoval uses net: Network {
+  let owner = gunbc_repository.owner as NonEmptyStr
+  let repo = gunbc_repository.name as NonEmptyStr
+  let before = read_git_ref_with(token: token, owner: owner, repo: repo, ref: branch_api_ref(name: name))
+  match before.reference {
+    RestAnswered { answer: _ } => {
+      let delete = delete_git_ref_with(token: token, owner: owner, repo: repo, ref: branch_api_ref(name: name))
+      let after = read_git_ref_with(token: token, owner: owner, repo: repo, ref: branch_api_ref(name: name))
+      classify_branch_removal(name: name, readback: after.reference, deleted: true, delete_refusal: delete_refusal_of(deleted: delete))
+    }
+    RestRefused { refusal } => classify_branch_removal(name: name, readback: RestRefused { refusal: refusal }, deleted: false, delete_refusal: none)
+  }
+}
diff --git a/dag/gunbc/runner/runner_registration_labels.dag b/dag/gunbc/runner/runner_registration_labels.dag
index 02de20ae300..1e3d4570607 100644
--- a/dag/gunbc/runner/runner_registration_labels.dag
+++ b/dag/gunbc/runner/runner_registration_labels.dag
@@ -51,8 +51,7 @@ fn runner_registration_labels(host: HostIdentity) -> RunnerRegistrationLabelsRes
 // ── BROWSER READINESS: A LABEL THE BROWSER-TOOLCHAIN CONVERGE GRANTS AND NOTHING ELSE ─────────────
 //
 // The floor runs real-Chromium wet claims inside its claim_executor run, so a runner on a host whose
-// browser toolchain was never converged refuses them (five test.claim.machine_intake
-// mtcollins1_kvm_observer_protocol_wet_witness claims on srv1, at the missing toolchain tree). The
+// browser toolchain was never converged refuses them (a wet claim on srv1 at the missing toolchain tree). The
 // host's readiness is therefore a LABEL: gunbc.runner_browser_toolchain
 // browser_ready_labels_converge_wet writes it as a template drop-in when that converge's readback
 // holds and removes it when it does not, and once every host in the floor's pool reads ready the
diff --git a/dag/gunbc/runner/runner_slot_allocation.dag b/dag/gunbc/runner/runner_slot_allocation.dag
index a5cb8751287..c868d920e9e 100644
--- a/dag/gunbc/runner/runner_slot_allocation.dag
+++ b/dag/gunbc/runner/runner_slot_allocation.dag
@@ -1,5 +1,6 @@
 module gunbc.runner_slot_allocation
 
+import gunbc.fleet_enrollment { CiRunnerParticipation, hosts_enrolled_for }
 import std.types { Int, String, List, Bool }
 import std.nat { Nat, nat_range_inclusive }
 import std.measure { ByteSize, byte_size, byte_size_count, measure_add, measure_sub, MeasureDifference, MeasureSubtrahendExceedsMinuend, measure_fit_count_floor, HardwareThreadCount, hardware_thread_count, hardware_thread_count_value }
@@ -10,7 +11,7 @@ import product.host_identity { HostIdentity }
 import extdeps.github.actions { runner_labels_equivalent }
 import gunbc.build_cache_instance { RunnerSlotIdentity, runner_slot_identity_equal }
 import gunbc.whole_corpus_compile_admission { whole_corpus_compile_public_root_peak }
-import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv3, operator_host_srv4 }
 import gunbc.session_reservation_policy { SessionReservationBytesResolution, ReservationBytes, ReservationBytesNotApplicable, ReservationBytesUnestablished, session_reservation_bytes }
 import gunbc.host_memory_observation { HostUsableRam, HostFixedOverhead, HostUsableRamMeasured, HostUsableRamConservativeLowerBound, HostUsableRamUnmeasured, HostFixedOverheadMeasured, HostFixedOverheadAllowance, HostFixedOverheadUnmeasured, gunbc_ci_host_usable_ram_for, gunbc_ci_host_fixed_overhead_for, oomd_actuation_floor }
 import gunbc.fabric_control_plane_charge { HostFabricControlPlaneClaim, ControlPlaneNotPlaced, ControlPlaneClaimResolved, ControlPlaneClaimUnmeasured, host_fabric_control_plane_claim }
@@ -987,14 +988,6 @@ fn gunbc_committed_host_runner_slot_allocation(host: HostIdentity) -> HostRunner
   }
 }
 
-data gunbc_runner_slot_allocation_srv1: HostRunnerSlotAllocationStanding = gunbc_committed_host_runner_slot_allocation(
-  host: operator_host_srv1
-)
-
-data gunbc_runner_slot_allocation_srv2: HostRunnerSlotAllocationStanding = gunbc_committed_host_runner_slot_allocation(
-  host: operator_host_srv2
-)
-
 data gunbc_runner_slot_allocation_srv3: HostRunnerSlotAllocationStanding = gunbc_committed_host_runner_slot_allocation(
   host: operator_host_srv3
 )
@@ -1033,13 +1026,10 @@ data gunbc_runner_slot_allocation_srv4: HostRunnerSlotAllocationStanding = gunbc
   host: operator_host_srv4
 )
 
+// One standing per enrolled CI host, read off gunbc.fleet_enrollment: a host enrolled for CI has a
+// standing -- admitted or refused with its cause -- the moment it is enrolled, without a new row here.
 fn gunbc_committed_runner_slot_allocation_standings() -> List<HostRunnerSlotAllocationStanding> {
-  [
-    gunbc_runner_slot_allocation_srv1,
-    gunbc_runner_slot_allocation_srv2,
-    gunbc_runner_slot_allocation_srv3,
-    gunbc_runner_slot_allocation_srv4,
-  ]
+  map(hosts_enrolled_for(wanted: CiRunnerParticipation), h => gunbc_committed_host_runner_slot_allocation(host: h))
 }
 
 // THE ADMITTED SUBSET IS NAMED AS A SUBSET. A consumer that sums, folds or renders rows can only do
@@ -1378,14 +1368,31 @@ fn gunbc_runner_slot_allocation_refuses_effective_readback_reconciliation(obs: R
 // discriminator (coproduct producer, alias-expanded generic at the parameter, cross-module
 // resolution) is unmeasured and the trigger is a probe matrix over producer kind x judgment
 // position with one-axis REDs and positive controls, enrolled where the floor folds it.
+// THE FLOOR CONJUNCTS ARE WITHDRAWN WITH THE FLOOR (operator ruling 2026-10-09, gunbc.rung_drop
+// v1_required_lanes_withdrawn). The paragraphs above describe MemoryHigh >= the floor's minimum
+// viable budget and >= its measured uncensored peak, guarded by the uncensored check: relations
+// between the slot and a TENANT. The floor lane is deleted and runs in no fleet slot, so a slot
+// sized to it would be a row sized to a dead tenant; the floor's own envelope lives on as
+// gunbc.floor_demand gunbc_floor_pinned_memory_max / _high, where its receipts join
+// (test.claim.floor.floor_demand_witness_test). The drop that described this conjunct's weakness,
+// gunbc.rung_drop slot_row_pinned_below_demonstrated_demand_unrefused, is Superseded under the
+// same ruling with v1_required_lanes_withdrawn as its loss holder.
+//
+// THE SWAP CONJUNCT IS INVERTED BY THE SAME RULING. It required MemorySwapMax ABOVE MemoryMax (the
+// spill the 2026-08 model allowed); the ruling is "MemorySwapMax=0 ... no thrashing allowed ever",
+// so the wall requires exactly zero, and gunbc test refuses a subject step that charged swap
+// anyway (gunbc.memory_envelope).
+//
+// WHAT THE SLOT MUST CLEAR NOW is the demand of the emit-and-build steps that run in it, and no
+// receipt measures it yet: the first cold required run's MEMORY RECEIPT (gunbc test, peak_bytes at
+// the slot grain) is that oracle, and a MemoryHigh >= measured-subject-peak conjunct returns here
+// with that receipt as its input -- a declared frontier, never a number copied from the tree
+// (DESIGN section 5, the oracle rule).
 fn gunbc_runner_slot_allocation_wall_holds() -> Bool {
   let per_slot = gunbc_runner_slot_desired()
   let gibibyte_bytes = 1073741824
   (byte_size_count(b: per_slot.memory_high) + gibibyte_bytes == byte_size_count(b: per_slot.memory_max))
-    && (byte_size_count(b: per_slot.memory_high) >= byte_size_count(b: gunbc_floor_minimum_viable_armed_budget))
-    && (byte_size_count(b: per_slot.memory_high) >= byte_size_count(b: gunbc_floor_measured_peak_observation))
-    && gunbc_floor_measured_peak_is_uncensored()
-    && (byte_size_count(b: per_slot.memory_swap_max) > byte_size_count(b: per_slot.memory_max))
+    && (byte_size_count(b: per_slot.memory_swap_max) == 0)
     && all(
       gunbc_admitted_runner_slot_allocations(),
       a =>
diff --git a/dag/gunbc/runner/runner_slot_desired.dag b/dag/gunbc/runner/runner_slot_desired.dag
index adacbbe7ca2..720938bfcc5 100644
--- a/dag/gunbc/runner/runner_slot_desired.dag
+++ b/dag/gunbc/runner/runner_slot_desired.dag
@@ -133,7 +133,21 @@ data gunbc_runner_slot_memory_max_ruling_note: String = "WHY 16GiB/15GiB, SUPERS
 // corpus-wide hazard rather than a local inconvenience -- one such expression in std.nat broke
 // resolution in unrelated modules -- so the quotient is taken over byte COUNTS and the measure is
 // reconstructed for the consumers that want a ByteSize.
-data gunbc_runner_slot_memory_max_bytes: Int = 27917287424
+// ── THE 2026-10-09 RULING: 22 GiB MemoryMax / 21 GiB MemoryHigh / NO SWAP (the v1 withdrawal) ──
+//
+// The floor this row was sized for is gone: the required job is the native emit-and-build alone
+// (gunbc.compiler_gate_workflow), whose measured peak on the former lane was about 17.7-18.0 GB
+// with no swap across 281 jobs (operator's receipt, side-chat review of gunbc#13658). The operator
+// ruled the envelope: a FIXED hard maximum of 22 GiB, swap refused outright ("no thrashing allowed
+// ever"), and a lower trip for the compiler itself -- gunbc.emitted_subject_build_gate
+// native_step_memory_trip, DERIVED from this row's MemoryHigh less that gate's declared headroom
+// (20 GiB today), to be bound per subject step by gunbc test once a fleet job can own a bounded
+// cgroup (gunbc_runner_slot_job_cgroup_ownership below; until that fact flips every subject step
+// REQUIRES this slot's envelope and is receipted at its grain) -- so the kernel will trip the step
+// under the throttle line and two GiB before it could reach this maximum. MemoryHigh stays the
+// authored max-minus-one line. The 26/25 derivation below this note is superseded and kept as the record of
+// why the number was what it was.
+data gunbc_runner_slot_memory_max_bytes: Int = 23622320128
 
 data gunbc_runner_slot_memory_max: ByteSize = byte_size(gunbc_runner_slot_memory_max_bytes)
 
@@ -150,11 +164,26 @@ fn gunbc_runner_slot_cpu_quota() -> RunnerSlotCpuQuota {
 fn gunbc_runner_slot_desired() -> RunnerSlotDesired {
   RunnerSlotDesired {
     memory_max: gunbc_runner_slot_memory_max,
-    memory_swap_max: byte_size(34359738368),
-    memory_high: byte_size(26843545600),
+    memory_swap_max: byte_size(0),
+    memory_high: byte_size(22548578304),
     tasks_max: 16384,
     cpu_weight: 100,
     cpu_quota: gunbc_runner_slot_cpu_quota(),
     labels: RunnerSlotLabels { github_labels: ["gunbc-heavy"] }
   }
 }
+
+// WHO OWNS A BOUNDED CGROUP INSIDE A SLOT -- a fleet fact, kept beside the envelope it governs and
+// consumed by gunbc.emitted_subject_build_gate native_step_memory_inputs to decide whether the
+// required subject steps ask gunbc test for a per-step bind. It is a fact about the hosts, not a
+// rung drop: nothing on the required path ever held the per-step trip (main's witnesses.yml never
+// carried the bind input), so the climb it blocks is rostered as a stall --
+// gunbc.guarantee_stall native_step_trip_awaits_fleet_job_cgroup_stall -- and this row flips when
+// the fleet earns the capability that stall names, observed on the hosts and nowhere else.
+type SlotJobCgroupOwnership
+  = JobOwnsNoBoundedCgroup { why: String }
+  | JobOwnsBoundedCgroup { staged_by: String }
+
+data gunbc_runner_slot_job_cgroup_ownership: SlotJobCgroupOwnership = JobOwnsNoBoundedCgroup {
+  why: "a fleet job runs as the setpriv'd job user under a root unit (gunbc.runner_host_deploy unit_user and job_user) and memory_governor apply_memory_cgroup_bind creates its leaf at the cgroup root, so no process of a job can create or join a bounded cgroup; the first required run that asked refused in four seconds (run 38002497388, MemoryCgroupBindRefused)"
+}
diff --git a/dag/gunbc/runner/runner_slot_population_census.dag b/dag/gunbc/runner/runner_slot_population_census.dag
index 2b20409e434..e8a70c8736f 100644
--- a/dag/gunbc/runner/runner_slot_population_census.dag
+++ b/dag/gunbc/runner/runner_slot_population_census.dag
@@ -9,6 +9,7 @@ import gunbc.runner_slot_allocation {
   gunbc_runner_committed_width,
   RunnerWidthResolution, RunnerWidthDerived, RunnerWidthUnresolved,
   runner_width_unresolved_cause_text,
+  host_committed_identities_at,
 }
 import gunbc.host_axis_caps { SurplusSlotObservation, SurplusSlotsObserved, SurplusSlotsUnobserved }
 import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext, SshTarget }
@@ -78,6 +79,17 @@ fn desired_unit_names_range(host: HostIdentity, slot: Int, limit: Int) -> List<S
   }
 }
 
+// THE COMMITTED POPULATION AS UNIT NAMES, AT IDENTITY GRAIN. Since #12339 a host's committed members
+// are not 1..width: on srv1 the microVM shakedown slot is a member by its authored index (13) and the
+// fleet range beneath it is 1..(width - 1) -- gunbc.runner_slot_allocation
+// host_committed_identities_at. A consumer that enumerated 1..width named a fleet slot the width never
+// charged for and dropped srv1-13, so the census classified the shakedown slot as retiring and the
+// transition obligation required it. Every desired-set reader goes through this one derivation.
+fn committed_unit_names_at(host: HostIdentity, committed: Int) -> List<String> {
+  host_committed_identities_at(host: host, committed: committed)
+    |> map(id => runner_slot_unit_name(slot: id) as String)
+}
+
 fn observed_unit_names(observed: List<ObservedRunnerUnit>) -> List<String> {
   observed |> map(o => o.unit)
 }
@@ -140,7 +152,7 @@ fn slot_population_census(host: HostIdentity, observed: List<ObservedRunnerUnit>
     RunnerWidthDerived { slots: slots } =>
       slot_population_census_against_desired(
         host: host,
-        desired: desired_unit_names_range(host: host, slot: 1, limit: slots),
+        desired: committed_unit_names_at(host: host, committed: slots),
         observed: observed,
       )
   }
diff --git a/dag/gunbc/runner/runner_teardown_receipt.dag b/dag/gunbc/runner/runner_teardown_receipt.dag
index 1ee500b89d5..db03397d234 100644
--- a/dag/gunbc/runner/runner_teardown_receipt.dag
+++ b/dag/gunbc/runner/runner_teardown_receipt.dag
@@ -28,7 +28,7 @@ type MicroVmEnvironmentInventory {
 }
 
 // A SLOT IS REALIZED AS A microVM ATTEMPT OR AS A TRANSIENT systemd UNIT ON A MANAGED HOST
-// (gunbc.runner_jit_mint JitSlot), and the teardown is one fold over both. The host-unit arm owns
+// (gunbc.runner.jit_registration_subject producers), and the teardown is one fold over both. The host-unit arm owns
 // no jail, jail mount, JIT drive, tap or firewall table -- the unit is the host's own process tree
 // in its own cgroup -- so its inventory names only what its launch allocates, rather than filling
 // five fields with paths that never existed. Which classes a teardown positive-controls is derived
diff --git a/dag/gunbc/runner/runner_throughput_qualification_route.dag b/dag/gunbc/runner/runner_throughput_qualification_route.dag
index 6cbd6a16c41..221a620a4f2 100644
--- a/dag/gunbc/runner/runner_throughput_qualification_route.dag
+++ b/dag/gunbc/runner/runner_throughput_qualification_route.dag
@@ -34,8 +34,9 @@ import gunbc.runner_throughput_qualification {
 // payload as a parameter) but nothing builds the derived runner image. The boot leg has no authority, and not for want of a landing:
 // the boot run on main (`gunbc.machine_intake_mtcollins1_boot_run`) boots exactly two media, the
 // census image and the stock installer, and its terminal is the census program's, so it cannot boot a
-// runner and observe it ready. `extdeps.github.workflows CreateDispatch` has no production caller
-// and a heal-specific input contract. The registration and deregistration legs have implemented authorities that nothing on the route calls yet. Each unbound leg names the CAPABILITY missing now and what it must be SUFFICIENT FOR
+// runner and observe it ready. The registration, dispatch and deregistration legs have implemented
+// authorities that nothing on the route calls yet. Each unbound leg names the CAPABILITY missing now
+// and what it must be SUFFICIENT FOR
 // (section 4b(3)), never a pull request, because a pull request can merge while the capability stays
 // missing -- which is exactly what happened to the boot leg.
 
@@ -45,13 +46,13 @@ import gunbc.runner_throughput_qualification {
 type StageEffect
   = BmcWrite { gate: DeclarationRef, boot: RouteLegStanding, image: RouteLegStanding }
   | GitHubControlPlaneWrite { authority: RouteLegStanding }
-  | ObservationOnly
+  | ObservationOnly { collection: RouteLegStanding }
 
 type QualificationStage
   = BootHostUnderApprovalGate { host: HostIdentity, boot: RouteLegStanding, image: RouteLegStanding }
   | RegisterEphemeralRunnerSlot { unit: NonEmptyStr, labels: List<String>, workspace: WorkspaceBacking, registration: RouteLegStanding }
   | DispatchFloorToSlot { workload: FloorWorkloadPin, selector: List<String>, dispatch: RouteLegStanding }
-  | CollectInstruments { instruments: List<QualificationInstrument> }
+  | CollectInstruments { instruments: List<QualificationInstrument>, collection: RouteLegStanding }
   | DeregisterRunnerSlot { unit: NonEmptyStr, deregistration: RouteLegStanding }
 
 fn stage_effect(stage: QualificationStage) -> StageEffect {
@@ -64,7 +65,7 @@ fn stage_effect(stage: QualificationStage) -> StageEffect {
       }
     RegisterEphemeralRunnerSlot { unit: _, labels: _, workspace: _, registration: r } => GitHubControlPlaneWrite { authority: r }
     DispatchFloorToSlot { workload: _, selector: _, dispatch: d } => GitHubControlPlaneWrite { authority: d }
-    CollectInstruments { instruments: _ } => ObservationOnly
+    CollectInstruments { instruments: _, collection: c } => ObservationOnly { collection: c }
     DeregisterRunnerSlot { unit: _, deregistration: d } => GitHubControlPlaneWrite { authority: d }
   }
 }
@@ -80,7 +81,7 @@ fn stage_egress(stage: QualificationStage) -> EgressPolicyShape? {
     BootHostUnderApprovalGate { host: _, boot: _, image: _ } => none
     RegisterEphemeralRunnerSlot { unit: _, labels: _, workspace: _, registration: _ } => Present { value: runner_host_egress_policy }
     DispatchFloorToSlot { workload: _, selector: _, dispatch: _ } => Present { value: runner_host_egress_policy }
-    CollectInstruments { instruments: _ } => none
+    CollectInstruments { instruments: _, collection: _ } => none
     DeregisterRunnerSlot { unit: _, deregistration: _ } => Present { value: runner_host_egress_policy }
   }
 }
@@ -209,14 +210,23 @@ data qualification_instruments: List<QualificationInstrument> = [
 // the remedy is a disk or a narrower shape, both of which are a different subject.
 data mtcollins1_qualification_workspace_backing: WorkspaceBacking = RamBackedTmpfs
 
-data mtcollins1_boot_leg: RouteLegStanding = LegAwaitingAuthority {
-  lands_with: "a runner-payload gunbc.boot_medium BootMedium row (today's rows are the census medium and stock_installer_boot_medium) with its own BootMediumTerminal arm, whose acceptance in gunbc.machine_intake_mtcollins1_boot_run is the runner host observed ready rather than the census program's terminal" as NonEmptyStr,
-  sufficient_for: "booting mtcollins1 from the derived runner image under grant_from_store with the SOL collector attached before the BMC stimulus, no controller write on deny, expiry or an unfiled request, and a terminal that says the runner host is up" as NonEmptyStr,
+// THE BOOT AND IMAGE LEGS HAVE IMPLEMENTED AUTHORITIES (gunbc.runner.runner_host_medium) AND NO
+// PRODUCTION CALLER. The boot leg's authority is the runner-host-up acceptance predicate the boot
+// run's terminal watch delegates to for a BootMediumRunnerHostUp medium; the image leg's is the
+// derivation of the runner image's seeded-media build input. Neither is wired: the boot run's medium
+// is still the one data row gunbc.machine_intake_mtcollins1_census_image mtcollins1_boot_medium, and
+// it stays the census medium until the one-socket census boot has its receipt (operator sequencing,
+// relayed 2026-10-04), so switching it is a separate one-line import change after that receipt.
+// The boot stage's egress stays none (stage_egress): the runner tarball rides on the medium as a
+// digest-keyed seed artifact fetched at BUILD time, so booting the runner image opens no network.
+data mtcollins1_boot_leg: RouteLegStanding = LegAuthorityImplemented {
+  authority: decl_ref(module_path: "gunbc.runner.runner_host_medium", decl_name: "runner_host_up_readback"),
+  wiring_owed: "after the one-socket census boot's receipt exists: a gunbc.runner.runner_host_medium runner_host_boot_medium data row carrying the published runner image's measured digest, the boot run's medium switched to it (one import change), and the boot run's census-only pre-attach readbacks (gunbc.machine_intake_mtcollins1_census_medium_readback, which refuse any medium but the census) replaced by gunbc.boot_medium boot_medium_readback over the selected medium; SUFFICIENT FOR booting mtcollins1 from the derived runner image under grant_from_store with the SOL collector attached before the BMC stimulus, no controller write on deny, expiry or an unfiled request, and a terminal accepted only by runner_host_up_readback" as NonEmptyStr,
 }
 
 data mtcollins1_image_leg: RouteLegStanding = LegAuthorityImplemented {
-  authority: decl_ref(module_path: "extdeps.provisioning.ubuntu_seeded_install_media", decl_name: "UbuntuSeededInstallMediaBuildInput"),
-  wiring_owed: "the runner medium the boot leg lands with (untangle cut 4a): a production caller that builds the derived runner image from UbuntuSeededInstallMediaBuildInput with the runner payload and hands it to the boot run as its medium; SUFFICIENT FOR the image the boot leg boots being the one this route derived, not a fixture" as NonEmptyStr,
+  authority: decl_ref(module_path: "gunbc.runner.runner_host_medium", decl_name: "runner_host_medium_image"),
+  wiring_owed: "a production caller that builds runner_host_medium_image's UbuntuSeededInstallMediaBuildInput for mtcollins1 and publishes it create-only into bmc_boot_image_export through gunbc.seeded_install_media_publish with export readback of the content digest, whose receipt is the digest the boot leg's runner_host_boot_medium row carries; SUFFICIENT FOR the image the boot leg boots being the one this route derived, not a fixture" as NonEmptyStr,
 }
 
 // THE THREE GITHUB CONTROL-PLANE LEGS. Registration and deregistration have implemented
@@ -229,15 +239,16 @@ data mtcollins1_image_leg: RouteLegStanding = LegAuthorityImplemented {
 // listing, with the host-side teardown carried by gunbc.runner.runner_teardown_receipt
 // RunnerTeardownRequest over a host-unit inventory. Both are pre-approved under the dispatching
 // run's authorization (operator ruling 2026-10-03), rowed in gunbc.auth.privileged_effect_census.
-// Dispatch names the cited REST operation that has no production caller yet.
+// Dispatch is gunbc.runner.runner_qualification_dispatch dispatch_qualification_floor: CreateDispatch
+// with the attempt label as the workflow input, under the same run's authorization.
 data mtcollins1_registration_leg: RouteLegStanding = LegAuthorityImplemented {
   authority: decl_ref(module_path: "gunbc.runner.runner_jit_perform", decl_name: "dispatch_jit_mint"),
   wiring_owed: "a production fold on this route that binds gunbc.runner.runner_host_unit_slot host_unit_slot_for to the booted managed host, mints under an observed runner group restricted to the qualification workflow and performs it through gunbc.github_effect_perform perform_organization_jit_mint; SUFFICIENT FOR one ephemeral registration per attempt label actually existing in the organization when the route runs" as NonEmptyStr,
 }
 
-data mtcollins1_dispatch_leg: RouteLegStanding = LegAwaitingAuthority {
-  lands_with: "a production fold calling extdeps.github.workflows github.Workflows CreateDispatch for the qualification workflow with the attempt label as its input -- which also dissolves that module's create_dispatch_unconsumed_frontier_rows" as NonEmptyStr,
-  sufficient_for: "dispatching the floor to the one registration whose runs-on names the attempt label, so the run is unservicable by any other runner" as NonEmptyStr,
+data mtcollins1_dispatch_leg: RouteLegStanding = LegAuthorityImplemented {
+  authority: decl_ref(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "dispatch_qualification_floor"),
+  wiring_owed: "the gunbc.fleet_converge_workflow mode that lands with the boot leg: a floor job in fleet_converge_workflow whose runs-on is exactly the qualification_attempt_dispatch_input it declares and whose first step is qualification_floor_revision_guard_step over the declared qualification_revision_dispatch_input, with no step that runs past a failure, and a route fold that takes the slot host's unit hold, ensures the per-attempt pin (gunbc.runner.runner_qualification_ref_pin ensure_qualification_ref_pin: branch qualification/<attempt> at the revision, the dedicated group pinned to it), mints the registration into that group, builds qualification_dispatch_subject from the pin, calls dispatch_qualification_floor and then collect_qualification_run, reconciling a commit-ambiguous dispatch before any retry, and removes the pin on every exit; SUFFICIENT FOR the floor run of each attempt being served only by the runner minted for that attempt at the pinned revision and read back as collected or as a typed refusal" as NonEmptyStr,
 }
 
 data mtcollins1_deregistration_leg: RouteLegStanding = LegAuthorityImplemented {
@@ -245,6 +256,13 @@ data mtcollins1_deregistration_leg: RouteLegStanding = LegAuthorityImplemented {
   wiring_owed: "the same route fold calling ensure_jit_runner_deregistered on every slot exit with the registration jit_registration_of minted from the registration leg's dispatch, joined to a host-unit gunbc.runner.runner_teardown_receipt RunnerTeardownResult; SUFFICIENT FOR the route reporting a slot retired only when the runner is absent from the organization listing and the unit's resources are observed gone" as NonEmptyStr,
 }
 
+// THE COLLECT STAGE'S STANDING. The authority reads the designated floor job's log and the
+// claim-cost artifact into a sealed receipt; nothing on the route invokes it yet.
+data mtcollins1_collect_leg: RouteLegStanding = LegAuthorityImplemented {
+  authority: decl_ref(module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "collect_qualification_instruments"),
+  wiring_owed: "the same route fold calling collect_qualification_instruments with the DispatchedQualificationRun the dispatch leg returned, the collection collect_qualification_run read back, and the JitRegistration the registration leg minted; SUFFICIENT FOR FloorPhaseRows and FloorCgroupRows being read on every executed attempt from the one job its registered runner ran, as a sealed QualificationJobLogReceipt or a typed refusal (gunbc.runner.runner_qualification_dispatch qualification_instrument_extraction_frontier_rows)" as NonEmptyStr,
+}
+
 // THE FLEET-CONVERGE MODE THIS ROUTE BECOMES IS NOT NAMED HERE. A mode row belongs to
 // `gunbc.fleet_converge_workflow` and lands there with the boot leg (section 3c: a declared frontier
 // with its trigger beside it); a mode whose boot leg has no authority on main would dispatch nothing
@@ -257,6 +275,7 @@ type QualificationRouteLegs {
   image: RouteLegStanding
   registration: RouteLegStanding
   dispatch: RouteLegStanding
+  collect: RouteLegStanding
   deregistration: RouteLegStanding
 }
 
@@ -265,6 +284,7 @@ data mtcollins1_route_legs: QualificationRouteLegs = QualificationRouteLegs {
   image: mtcollins1_image_leg,
   registration: mtcollins1_registration_leg,
   dispatch: mtcollins1_dispatch_leg,
+  collect: mtcollins1_collect_leg,
   deregistration: mtcollins1_deregistration_leg,
 }
 
@@ -281,7 +301,7 @@ fn qualification_route(
     BootHostUnderApprovalGate { host: host, boot: legs.boot, image: legs.image },
     RegisterEphemeralRunnerSlot { unit: unit, labels: labels, workspace: workspace, registration: legs.registration },
     DispatchFloorToSlot { workload: workload, selector: labels, dispatch: legs.dispatch },
-    CollectInstruments { instruments: qualification_instruments },
+    CollectInstruments { instruments: qualification_instruments, collection: legs.collect },
     DeregisterRunnerSlot { unit: unit, deregistration: legs.deregistration },
   ]
 }
@@ -300,17 +320,19 @@ fn mtcollins1_qualification_route(attempt: NonEmptyStr, workload: FloorWorkloadP
 
 fn stage_is_effectful(stage: QualificationStage) -> Bool {
   match stage_effect(stage: stage) {
-    ObservationOnly => false
+    ObservationOnly { collection: _ } => false
     BmcWrite { gate: _, boot: _, image: _ } => true
     GitHubControlPlaneWrite { authority: _ } => true
   }
 }
 
-// THE LEGS AN EFFECTFUL STAGE STANDS ON. A BMC write stands on its boot and image legs; a
-// control-plane write on its authority; observation on nothing.
+// THE LEGS A STAGE STANDS ON. A BMC write stands on its boot and image legs; a control-plane write
+// on its authority; the collect stage on its collection standing. Observation is not exempt: a
+// route whose effectful legs were all wired while nothing invoked the collector would execute and
+// read nothing, so the collect stage's standing counts toward route_is_executable like any leg.
 fn stage_legs(stage: QualificationStage) -> List<RouteLegStanding> {
   match stage_effect(stage: stage) {
-    ObservationOnly => []
+    ObservationOnly { collection: c } => [c]
     BmcWrite { gate: _, boot: b, image: i } => [b, i]
     GitHubControlPlaneWrite { authority: a } => [a]
   }
diff --git a/dag/gunbc/runner/runner_width_transition.dag b/dag/gunbc/runner/runner_width_transition.dag
index c04ef06890c..fe244884c68 100644
--- a/dag/gunbc/runner/runner_width_transition.dag
+++ b/dag/gunbc/runner/runner_width_transition.dag
@@ -3,7 +3,7 @@ module gunbc.runner_width_transition
 import std.types { Bool, List, String, NonEmptyStr, Int, list_length }
 import product.host_identity { HostIdentity }
 import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv3, operator_host_srv4 }
-import gunbc.runner_slot_population_census { desired_unit_names_range, unit_is_owned_by_host }
+import gunbc.runner_slot_population_census { desired_unit_names_range, unit_is_owned_by_host, committed_unit_names_at }
 import gunbc.runner_slot_allocation {
   gunbc_runner_committed_width,
   RunnerWidthResolution, RunnerWidthDerived, RunnerWidthUnresolved,
@@ -121,15 +121,22 @@ fn transition_required_retirees_at(t: RunnerWidthTransition, target_width: Runne
       RetireesUnresolved { host: t.host, cause: runner_width_unresolved_cause_text(cause: c) }
     RunnerWidthDerived { slots: target } =>
       RetireesKnown {
-        units: desired_unit_names_range(
-          host: t.host,
-          slot: target + 1,
-          limit: t.prior_width,
+        units: prior_minus_committed(
+          prior: desired_unit_names_range(host: t.host, slot: 1, limit: t.prior_width),
+          committed: committed_unit_names_at(host: t.host, committed: target),
         ) |> map(u => u as NonEmptyStr),
       }
   }
 }
 
+// PRIOR MINUS COMMITTED IS A SET DIFFERENCE OVER IDENTITIES, NOT `target + 1 .. prior`. The index
+// range was exact only while the committed population was 1..width; since #12339 srv1's committed
+// population is 1..(width - 1) plus the shakedown slot srv1-13, so the range both required srv1-13 --
+// a committed fabric member -- and left out the fleet slot the width stopped charging for.
+fn prior_minus_committed(prior: List<String>, committed: List<String>) -> List<String> {
+  prior |> filter(u => !any(committed, c => c == u))
+}
+
 fn transition_required_retirees(t: RunnerWidthTransition) -> RequiredRetirees {
   transition_required_retirees_at(t: t, target_width: gunbc_runner_committed_width(host: t.host))
 }
diff --git a/dag/gunbc/runner/workspace_guest_image.dag b/dag/gunbc/runner/workspace_guest_image.dag
index 73ad7592c79..00441086b6b 100644
--- a/dag/gunbc/runner/workspace_guest_image.dag
+++ b/dag/gunbc/runner/workspace_guest_image.dag
@@ -196,7 +196,11 @@ fn workspace_installed_image(release_dir: String, identity: NonEmptyStr) -> Work
   if digest.length() != 64 || !all(digest.chars(), cp => base16_is_lower_digit_code_point(cp: cp)) {
     WorkspaceImageRefused { reason: "workspace image identity must be its lowercase SHA-256" }
   } else {
-    let root = join([release_dir, "/images/workspace/", digest], "")
+    let root = workspace_installed_image_root(release_dir: release_dir, identity: identity)
     verify_workspace_image(kernel: concat(concat(root, "/"), runner_guest_kernel_artifact.filename as String), rootfs: concat(root, "/workspace.ext4"), expected_sha256: identity)
   }
 }
+
+fn workspace_installed_image_root(release_dir: String, identity: NonEmptyStr) -> String {
+  join([release_dir, "/images/workspace/", identity as String], "")
+}
diff --git a/dag/gunbc/runner/workspace_microvm_access.dag b/dag/gunbc/runner/workspace_microvm_access.dag
index ff7a3e17192..960d819954e 100644
--- a/dag/gunbc/runner/workspace_microvm_access.dag
+++ b/dag/gunbc/runner/workspace_microvm_access.dag
@@ -1,7 +1,7 @@
 module gunbc.workspace_microvm_access
 
 import extdeps.systemd.journalctl
-import gunbc.workspace_gateway { WorkspaceGateway }
+import gunbc.workspace_ssh_access { WorkspaceConnectionRoute, WorkspaceDirectSsh, WorkspaceGatewaySsh, workspace_connection_route_refusal }
 
 import std.types { String, NonEmptyStr, Bool, List, Int }
 import std.algebra { trim }
@@ -12,7 +12,6 @@ import extdeps.shell.exec { ProcessOutputPresent, ProcessOutputAbsent, ProcessRe
 import extdeps.ssh.openssh_client_commands { ssh_keyscan_command }
 import extdeps.network.ipv4 { render_ipv4_address }
 import gunbc.command_runner { run_shell_command_capture }
-import gunbc.build_cache_instance { RunnerSlotIdentity, runner_slot_identity_equal }
 import gunbc.runner_microvm_network { runner_slot_network }
 import gunbc.runner_microvm_lifecycle { AttemptIdentity, in_flight_attempt_of_identity }
 import gunbc.runner_microvm_cell_readiness_store { encode_attempt }
@@ -25,9 +24,7 @@ import gunbc.runner_microvm_lifecycle_realize {
 type WorkspaceConnection sole_constructor {
   identity: AttemptIdentity
   systemd_invocation: NonEmptyStr
-  host_account: NonEmptyStr
-  host_tailnet: NonEmptyStr
-  gateway_known_host: NonEmptyStr
+  route: WorkspaceConnectionRoute
   guest_ip: NonEmptyStr
   guest_user: NonEmptyStr
   host_key: NonEmptyStr
@@ -67,29 +64,26 @@ fn workspace_ed25519_key(line: String, offset: Int) -> String? {
 // This pure join consumes an invocation-bound console and an actual SSH key exchange.
 // A live TCP port or an address inherited from a previous incarnation cannot satisfy it.
 fn workspace_connection_from_observations(
-  identity: AttemptIdentity, gateway: WorkspaceGateway, systemd_invocation: NonEmptyStr,
-  console: String, scanned_keys: String, gateway_known_host: NonEmptyStr,
+  identity: AttemptIdentity, route: WorkspaceConnectionRoute, systemd_invocation: NonEmptyStr,
+  console: String, scanned_keys: String,
 ) -> WorkspaceConnectionReading {
-  if !starts_with(s: gateway_known_host as String, prefix: concat(gateway.tailnet_name as String, " "))
-    || string_contains(s: gateway_known_host as String, pattern: "\n") || string_contains(s: gateway_known_host as String, pattern: "\r") {
-    WorkspaceConnectionUnavailable { reason: "enrolled gateway key does not name this selected host" }
-  } else if !runner_slot_identity_equal(a: identity.attempt.slot, b: gateway.slot) {
-    WorkspaceConnectionUnavailable { reason: "gateway does not name this allocation's selected host and slot" }
-  } else { match identity.workload {
+  match workspace_connection_route_refusal(slot: identity.attempt.slot, route: route) {
+    Present { value: reason } => WorkspaceConnectionUnavailable { reason: reason as String }
+    Absent => match identity.workload {
     WorkspaceWorkload { bootstrap_identity: bootstrap, image_identity: _, lease_expires_unix: _ } =>
       match workspace_console_value(console: console, marker: "gunbc-workspace-identity=") {
         Absent => WorkspaceConnectionUnavailable { reason: "no unique invocation-bound workspace bootstrap identity" }
         Present { value: observed } => if observed != (bootstrap as String) {
           WorkspaceConnectionUnavailable { reason: "guest bootstrap identity belongs to another allocation" }
-        } else { workspace_connection_after_boot(identity: identity, gateway: gateway, systemd_invocation: systemd_invocation, console: console, scanned_keys: scanned_keys, gateway_known_host: gateway_known_host) }
+        } else { workspace_connection_after_boot(identity: identity, route: route, systemd_invocation: systemd_invocation, console: console, scanned_keys: scanned_keys) }
       }
     GitHubRunnerWorkload { registration_id: _ } => WorkspaceConnectionUnavailable { reason: "attempt is not a workspace workload" }
   } }
 }
 
 fn workspace_connection_after_boot(
-  identity: AttemptIdentity, gateway: WorkspaceGateway, systemd_invocation: NonEmptyStr,
-  console: String, scanned_keys: String, gateway_known_host: NonEmptyStr,
+  identity: AttemptIdentity, route: WorkspaceConnectionRoute, systemd_invocation: NonEmptyStr,
+  console: String, scanned_keys: String,
 ) -> WorkspaceConnectionReading {
   match workspace_console_value(console: console, marker: "gunbc-workspace-host-key=") {
     Absent => WorkspaceConnectionUnavailable { reason: "workspace host key has not been observed for this invocation" }
@@ -108,7 +102,7 @@ fn workspace_connection_after_boot(
         } else {
           WorkspaceConnectionReady { connection: WorkspaceConnection {
             identity: identity, systemd_invocation: systemd_invocation,
-            host_account: gateway.host_account, host_tailnet: gateway.tailnet_name, gateway_known_host: gateway_known_host,
+            route: route,
             guest_ip: guest_ip as NonEmptyStr, guest_user: "root", host_key: key as NonEmptyStr,
             host_key_alias: concat("workspace-", serialize_content_hash(hash: content_hash_of_value(value: serialize_json(v: encode_attempt(a: in_flight_attempt_of_identity(identity: identity))) as NonEmptyStr)) as String) as NonEmptyStr,
           } }
@@ -119,7 +113,7 @@ fn workspace_connection_after_boot(
 }
 
 // Called while the shared controller is running. No frontend request performs these reads.
-fn workspace_observe_connection(identity: AttemptIdentity, launch: AttemptLaunch, gateway: WorkspaceGateway, gateway_known_host: NonEmptyStr) -> WorkspaceConnectionReading {
+fn workspace_observe_connection(identity: AttemptIdentity, launch: AttemptLaunch, route: WorkspaceConnectionRoute) -> WorkspaceConnectionReading {
   match bind_attempt_console(identity: identity, launch: launch) {
     AttemptConsoleBound { unit: unit, systemd_invocation: invocation } => {
       let log = systemd.Journalctl.UnitInvocationLog(unit: unit, invocation_id: invocation)
@@ -132,7 +126,7 @@ fn workspace_observe_connection(identity: AttemptIdentity, launch: AttemptLaunch
               AttemptConsoleBound { unit: unit_after, systemd_invocation: after } => if unit_after != unit || after != invocation || !systemd.Systemctl.IsActive(unit: unit).active {
                 WorkspaceConnectionUnavailable { reason: "workspace incarnation stopped or changed during SSH observation" }
               } else {
-                workspace_connection_from_observations(identity: identity, gateway: gateway, systemd_invocation: invocation, console: log.stdout, scanned_keys: scanned, gateway_known_host: gateway_known_host)
+                workspace_connection_from_observations(identity: identity, route: route, systemd_invocation: invocation, console: log.stdout, scanned_keys: scanned)
               }
               AttemptConsoleUnbound { reason: _ } => WorkspaceConnectionUnavailable { reason: "workspace incarnation is no longer observable" }
               AttemptConsoleNotStarted => WorkspaceConnectionUnavailable { reason: "workspace incarnation is no longer observable" }
@@ -150,12 +144,23 @@ fn workspace_observe_connection(identity: AttemptIdentity, launch: AttemptLaunch
 fn workspace_connection_text(connection: WorkspaceConnection) -> String {
   let host_alias = connection.host_key_alias as String
   let known_host = join([host_alias, connection.host_key as String], " ")
-  let gateway = join([connection.host_account as String, "@", connection.host_tailnet as String], "")
   let target = join([connection.guest_user as String, "@", connection.guest_ip as String], "")
+  let route_words = match connection.route {
+    WorkspaceDirectSsh { slot: _, identity_file } => concat(" -o IdentitiesOnly=yes -o IdentityAgent=none -i ", posix_single_quote(spelling: identity_file as String))
+    WorkspaceGatewaySsh { gateway, known_host: _ } => concat(" -J ", posix_single_quote(spelling: join([gateway.host_account as String, "@", gateway.tailnet_name as String], "")))
+  }
+  let gateway_key = match connection.route {
+    WorkspaceDirectSsh { slot: _, identity_file: _ } => ""
+    WorkspaceGatewaySsh { gateway: _, known_host: key } => concat(posix_single_quote(spelling: key as String), " ")
+  }
+  let location = match connection.route {
+    WorkspaceDirectSsh { slot, identity_file: _ } => concat("Run on ", concat(slot.host as String, ":\n"))
+    WorkspaceGatewaySsh { gateway: _, known_host: _ } => ""
+  }
   join([
-    "mkdir -p ~/.ssh && chmod 700 ~/.ssh && printf '%s\\n' ", posix_single_quote(spelling: connection.gateway_known_host as String), " ", posix_single_quote(spelling: known_host),
-    " >> ~/.ssh/known_hosts && ssh -o StrictHostKeyChecking=yes -o ", posix_single_quote(spelling: concat("HostKeyAlias=", host_alias)),
-    " -J ", posix_single_quote(spelling: gateway), " ", posix_single_quote(spelling: target),
+    location, "mkdir -p ~/.ssh && chmod 700 ~/.ssh && printf '%s\\n' ", gateway_key, posix_single_quote(spelling: known_host),
+    " >> ~/.ssh/known_hosts && ssh -o ForwardAgent=no -o StrictHostKeyChecking=yes -o ", posix_single_quote(spelling: concat("HostKeyAlias=", host_alias)),
+    route_words, " ", posix_single_quote(spelling: target),
     "\n\nVerify allocation: cat /etc/gunbc-allocation\nExpected identity: ", connection.identity.attempt.attempt_id.value as String,
     "\nRelease or expiry permanently deletes this workspace disk.",
   ], "")
diff --git a/dag/gunbc/rust_emitted_crate.dag b/dag/gunbc/rust_emitted_crate.dag
new file mode 100644
index 00000000000..6f88e2ac35d
--- /dev/null
+++ b/dag/gunbc/rust_emitted_crate.dag
@@ -0,0 +1,36 @@
+module gunbc.rust_emitted_crate
+
+import std.types { Bool, String }
+
+// WHAT AN EMITTED RUST CLOSURE ASKS OF ITS CARGO WORKSPACE, AS A FACT THE EMISSION RETURNS. The
+// emitter decides the crate name its main.rs paths through and the external crates its rendered
+// code links; the crate partition (gunbc.emitted_crate_workspace) decides the layout those
+// facts are realized in. Before this module the emitter rendered both into one Cargo.toml, so the
+// single-package layout was baked into the emission; now the emission states what it needs and
+// owns no manifest.
+//
+// This module lives under dag/ because the v1 emitter produces it and the host workspace writer
+// reads it: one producer, several readers, no second list. It carries the facts only; the Cargo
+// dependency rows the demand implies are rendered beside the manifests that list them
+// (v1.compiler.stage0_crates emitted_crate_dependencies), so this module stays in the lowest
+// partition crate with the emitted-edge facts it travels with.
+
+// WHAT THE EMITTED CRATE DEPENDS ON IS DERIVED FROM WHAT WAS EMITTED, NOT DECLARED BESIDE IT. A
+// fixed dependency list is a second authority for the crate's dependencies, free to disagree with
+// the sources the same run just wrote, so the demand is a field the emission fills.
+//
+// THE RESIDUE IS NAMED RATHER THAN CLAIMED CLOSED. `ureq` sits in the base list on the same
+// footing `clap` used to: it is referenced only when a corpus reaches the HTTP extdep, and nothing
+// in the emitter's inputs says whether it did. NEXT-RUNG TRIGGER: an emission-level demand fact per
+// external crate -- the renderer that emits a `ureq` call recording that it did -- at which point
+// this carrier gains one field per dependency and the base list holds only what every emitted
+// crate genuinely links.
+type EmittedCrateDependencyDemand {
+  renders_clap_cli: Bool
+  renders_async_services: Bool
+}
+
+type EmittedRustCrate {
+  crate_name: String
+  demand: EmittedCrateDependencyDemand
+}
diff --git a/dag/gunbc/rust_emitted_edge.dag b/dag/gunbc/rust_emitted_edge.dag
index 7e6cafeaabc..c68fd4a95da 100644
--- a/dag/gunbc/rust_emitted_edge.dag
+++ b/dag/gunbc/rust_emitted_edge.dag
@@ -15,12 +15,25 @@ import std.types { List, String }
 
 // Only the provenances a producer emits are arms. SemanticSourceReference is a use-line the
 // emitter derives from the source: an authored import (emit_imports), a reference-derived import
-// (reference_derived_use_line_plan), or a service import (emit_module_full). Helper-carrier and
-// service/CLI runtime-surface arms land with their producers, not before them.
+// (reference_derived_use_line_plan), or a service import (emit_module_full). DeclaredImport is an
+// authored import of an emitted module, returned whether or not a use-line for it survives.
+// InlinePathReference is a `crate::<module>::` path the renderers wrote into a module's code for a
+// resolved reference -- a call to a declaration of another module, a qualified type or value --
+// including a reference the source never imported (v1.compiler.emit_rust emitted_inline_path_edges
+// reads them off the emitted code, since the renderers return text and not the edges they write:
+// gunbc.guarantee_stall emitted_inline_crate_path_edges_unreturned_stall). DeclaredImport and
+// InlinePathReference are SOURCE dependencies: the partition seeds its module DAG with them, so
+// two modules that reach each other only by reference form a legitimate SCC rather than a refused
+// reverse edge. ServiceRuntimeSurface is the service runtime the emitter writes into every module
+// that renders a service: the struct's `crate::dry_run::DryRunMode` field and constructor
+// (v1.compiler.emit_rust emit_service_struct).
 type EmittedEdgeProvenance
   = RuntimePrelude
   | ReexportFacade
   | SemanticSourceReference
+  | DeclaredImport
+  | InlinePathReference
+  | ServiceRuntimeSurface
 
 type EmittedEdgeTarget
   = EmittedModuleTarget { module: String }
@@ -35,7 +48,7 @@ type EmittedEdge {
 // THE ENDPOINT NAME. An edge row names a module by the basename of the file the emitter writes for
 // it, so the projection from a module's dotted name to that basename is this module's fact, not the
 // emitter's private one: v1.compiler.emit_rust renders files and paths with it, and a partition
-// derived over dotted module names (v2.workflow.emitted_crate_workspace) maps onto edge endpoints
+// derived over dotted module names (gunbc.emitted_crate_workspace) maps onto edge endpoints
 // with the same function. `main` renders as `main_mod` because it collides with the crate's own
 // entry file.
 fn module_to_filename(name: String) -> String {
@@ -52,14 +65,6 @@ fn rust_module_emit_filename(module_name: String) -> String {
 // the same value.
 data rust_runtime_prelude_module: String = "v1_rt"
 
-// Files the emitter writes with no .dag module behind them, beside the runtime prelude:
-// v1.compiler.emit_rust emit_dry_run_module writes dry_run.rs (the DryRunMode wrapper) whenever the
-// closure declares services. The emitter still spells that path itself, so the two are not one
-// value; the pairing is the workspace closure check, which refuses an emitted basename that is in
-// neither the DAG nor this list, so an emitter that renames or adds such a file is a located
-// refusal rather than a silent drift.
-data rust_emit_only_basenames: List<String> = ["dry_run"]
-
 fn rust_prelude_emitted_edges(module: String) -> List<EmittedEdge> {
   if module == rust_runtime_prelude_module {
     [
@@ -81,6 +86,22 @@ fn semantic_source_reference_edge(from: String, to_module: String) -> EmittedEdg
   EmittedEdge { from: from, to: EmittedModuleTarget { module: to_module }, provenance: SemanticSourceReference }
 }
 
+fn declared_import_edge(from: String, to_module: String) -> EmittedEdge {
+  EmittedEdge { from: from, to: EmittedModuleTarget { module: to_module }, provenance: DeclaredImport }
+}
+
+fn inline_path_reference_edge(from: String, to_module: String) -> EmittedEdge {
+  EmittedEdge { from: from, to: EmittedModuleTarget { module: to_module }, provenance: InlinePathReference }
+}
+
+// The module the emitter writes the service runtime into (v1.compiler.emit_rust
+// emit_dry_run_module); every service struct paths into it.
+data rust_service_runtime_module: String = "dry_run"
+
+fn service_runtime_surface_edge(from: String) -> EmittedEdge {
+  EmittedEdge { from: from, to: EmittedModuleTarget { module: rust_service_runtime_module }, provenance: ServiceRuntimeSurface }
+}
+
 fn emitted_edge_target_module(edge: EmittedEdge) -> List<String> {
   match edge.to {
     EmittedModuleTarget { module: target } => [target]
diff --git a/dag/gunbc/rust_shell_stderr_capture_seed_growth.dag b/dag/gunbc/rust_shell_stderr_capture_seed_growth.dag
new file mode 100644
index 00000000000..0e2eaecaa21
--- /dev/null
+++ b/dag/gunbc/rust_shell_stderr_capture_seed_growth.dag
@@ -0,0 +1,70 @@
+module gunbc.rust_shell_stderr_capture_seed_growth
+
+import gunbc.roadmap_model { RoadmapNodeId }
+import gunbc.seed_growth { SeedGrowthJustification }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+
+// Seed-growth obligation for rust shell stderr capture (#13472), homed beside the
+// obligation it declares rather than inside gunbc.seed_growth_admission, which owns
+// the roster and the join.
+//
+// THE AUTHORIZER. Operator ruling 2026-10-06 (escalation msg_7853a1af, via
+// silent-lark-156): "Admit, exact scope with seed-growth row". The admitted
+// SeedFeatureCompletion is scoped to the rust shell handler realizing
+// WitnessStderrCapturePolicy (stderr_truncated / stderr_total_bytes /
+// stderr_retained_bytes) and the emit_host.rs tests that compile and run that
+// fragment. This row records that ruling; it does not mint a second one.
+//
+// PURPOSE PASSES (gunbc.v1_maintenance_standing v1_seed_standing): the fixture-closure
+// union must emit extdeps.gunbc WitnessBin.Run or the required floor stays red after
+// #13437, which blocks the D2 self-host lane. The seed is the only rust shell emitter.
+//
+// THE FIVE REFUSED CLASSES. NewLanguageBehavior: no. NewCompatibilityObligation: no.
+// NewEscapeHatchOrAdmissionRow: no — absent policy and Complete overflow refuse.
+// SeedFeatureCompletion FIRES and is admitted on the ruling above. PublicSurfaceGrowth:
+// the emit_host additions are cfg(test) discriminators, not a published CLI.
+//
+// Hand items below are the emit_host executing harness. The rust-item authority keeps
+// the inline-module path, so every citation is
+// v1_compiler.cli_run.emit_host.fixture_closure_union_tests.
+//
+// THE COMPLETE CEILING IS NOT A SECOND HAND MODULE (review 77633). Complete overflow
+// reads v1_rt::read_host_budget_bytes / resolve_host_budget_join. Those functions
+// live in rust_runtime_source (runtime_rust.dag rt_host_budget) because an emitted
+// crate has no memory_governor. The stage0 v1_rt.rs mirror is generated
+// (gunbc.generated_artifact / derived_generated_stage0_repo_paths), so it is not a
+// SeedGrowthJustification hand item and must not be listed here. memory_governor
+// wraps the same join; this change deletes the second composer rather than adding
+// one. The 2026-10-06 ruling's handler scope includes that ceiling: current_boundary
+// already names WitnessStderrCaptureCompleteBudgetExceeded with the admitted limit.
+data rust_shell_stderr_capture_seed_growth_justification: SeedGrowthJustification = SeedGrowthJustification {
+  hand_authored_declarations: [
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "STDERR_CAPTURE_MEMBER", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "STDERR_CAPTURE_UNMODELED_SIBLING", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "STDERR_CAPTURE_WITHOUT_POLICY", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "STDERR_CAPTURE_STRING_POLICY", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "STDERR_CAPTURE_OPTIONAL_POLICY", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "STDERR_CAPTURE_COLLECTION_POLICY", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "STDERR_CAPTURE_HOMONYM_POLICY", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "GUNBC_MODULE_REACH_MEMBER", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "declared_stderr_capture_channels_do_not_refuse_the_union", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "an_unmodeled_shell_channel_still_refuses_the_union", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "capture_channels_without_stderr_capture_input_refuse_the_union", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "capture_channels_refuse_unless_stderr_capture_is_the_required_scalar_policy", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "capture_channels_with_string_stderr_capture_refuse_the_union", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "capture_channels_with_optional_stderr_capture_refuse_the_union", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "capture_channels_with_collection_stderr_capture_refuse_the_union", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "capture_channels_with_homonym_stderr_capture_refuse_the_union", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "reaching_extdeps_gunbc_does_not_refuse_the_union_for_capture_channels", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "rustc_and_run_emitted_capture", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "emitted_bounded_tail_truncates_and_keeps_the_tail", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "emitted_bounded_tail_under_cap_is_complete", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "emitted_complete_over_budget_refuses", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "emitted_complete_under_budget_retains_all", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.emit_host.fixture_closure_union_tests", decl_name: "emitted_stdin_and_long_stderr_does_not_deadlock", field: WholeDeclaration }
+  ],
+  reason: "Operator ruling 2026-10-06 (msg_7853a1af): admit SeedFeatureCompletion, exact scope the rust shell handler realizing WitnessStderrCapturePolicy (stderr_truncated / stderr_total_bytes / stderr_retained_bytes) and its emit_host.rs tests. The rust shell handler must realize those channels so the fixture-closure union can emit WitnessBin.Run. Complete's admitted limit is the existing host-budget join on rust_runtime_source (v1_rt::read_host_budget_bytes), not a new seed-retained module and not a second composer in memory_governor. These host tests compile and run the emitted drain against a child process, and they refuse a name-only, String, optional, or collection stderr_capture at TransportEmissionNotModeled. A .contains() on the drain string is not a consumer (DESIGN section 5). They stay rust because the subject is the rust realization fragment the seed emits.",
+  owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
+  trigger: "Delete these items when the v2-native emitter realizes the shell transport's stderr capture, a .dag witness compiles the emitted rust crate and runs the same six discriminators plus the typed-policy emit refusals without a host rustc harness, and WitnessBin.Run still emits. The union digest_hex control stays.",
+  current_boundary: "Bind and validate a required scalar stderr_capture: WitnessStderrCapturePolicy before spawn; start stdout and stderr drains immediately; write stdin concurrently; wait and join; project BoundedTail or return WitnessStderrCaptureCompleteBudgetExceeded with the measured total and the admitted limit from v1_rt::read_host_budget_bytes (rust_runtime_source / runtime_rust.dag rt_host_budget; memory_governor wraps the same join). No fallback tail length. Capture-accounting channels without that typed required scalar refuse at the rust emit diagnostic (one shared predicate) and, if that wall is skipped, as a pre-spawn return Err. Python and go still refuse those channels at emit. Unmodeled keys such as stderr_digest_hex still refuse."
+}
diff --git a/dag/gunbc/rust_source_type_bindings.dag b/dag/gunbc/rust_source_type_bindings.dag
index 4b01e3a906a..8f3ba6c12af 100644
--- a/dag/gunbc/rust_source_type_bindings.dag
+++ b/dag/gunbc/rust_source_type_bindings.dag
@@ -135,7 +135,7 @@ fn checkpoint_row_migration_rows() -> List<CheckpointRowMigration> {
     CheckpointRowMigration {
       dag_name: "String" as NonEmptyStr,
       disposition: ProvenUniqueKernelBinding {
-        proof: "The kernel string_type is minted by v1.compiler.types for every string literal and carries no declaration; both .dag declarations of the spelling (v2.std.text, std.string_type) are gated structural by v1.compiler.coercion structural_declaration_modules_for and never reach this row. THE VERDICT STANDS AND ITS ORIGINAL ARGUMENT WAS EXACTLY INVERTED, corrected here rather than softened because the inverted form would justify the wrong things if reused. It read: the bare spelling cannot be captured because the only import that could shadow it binds the SAME token, so in a module importing v2.std.text String every `String` reference IS the text carrier and the kernel spelling is unreachable there. The opposite is true. KERNEL NAMES ARE NEVER OVERRIDDEN BY IMPORTS (v1.compiler.infer direct_import_export_precedence_note, overlay_skips_kernel_name), so in such a module the import does not shadow at all and a bare `String` is ALWAYS the kernel -- the spelling the old argument called unreachable is the only one you reach. Three routes exist and all three are sound for this row: a bare reference in an importing module resolves to the kernel and IS this row's binding; a bare reference INSIDE v2.std.text resolves LOCALLY (locals beat kernel) and is gated structural, never reaching the row; and a QUALIFIED v2.std.text.String resolves through the alias to the dotted name std.algebra.FreeMonoid, which matches no bare row. Symbol was captured precisely because its token differed from its spelling, and that clause survives unchanged. ESTABLISHED BY EXECUTION, not by reading precedence -- AND THE SUBJECT NAMED HERE IS CORRECTED: this sentence previously said the census was run over A FIXTURE MODULE importing both v2.std.text String and v2.std.node Node. IT WAS NOT. The receipts carry no fixture rows at all; the subjects were LIVE CORPUS MODULES, and naming a subject that was not run is the same citation defect this row exists to correct. What v1.tests.claim.carrier_realization_census actually reports: in std.algebra, a module that imports the spelling, a bare String carries the kernel identity at declaration_field AND at fn_signature_param; inside v2.std.text the same spelling carries its own declaring module and diverges with exact identity, which is route 2 executed rather than argued; and v2.std.node Node carries its real declaring module at both position kinds as the positive control. RE-DERIVATION IS POSITION-KIND SENSITIVE AND THE OBVIOUS INSTRUCTION IS A TRAP. Running that census over a closure re-derives routes 1 and 2 soundly. It does NOT re-derive route 3: at fn_signature_param the census resolves a QUALIFIED v2.std.text.String through the alias onto the alias declaration's own name, which is the spelling String, and attributes it to <kernel:String> -- confidently naming the very carrier the qualification was written to move away from. That is measured by vivid-deer-102 and filed as recurring failure mode alias_resolution_collides_with_kernel_spelling (gunbc#9939); the same instrument is correct for qualified aliases at declaration_field. ROUTE 3 THEREFORE RESTS ON STRUCTURAL RESOLUTION PLUS A RUSTC MEASUREMENT -- the emitted crate carries an E0308 on the bare arm and not on the qualified one -- and explicitly NOT on this census, which cannot answer at that position. The instrument is named rather than its rows transcribed (DESIGN section 6). SINCE gunbc#12760 THE KERNEL HOST TEXT HAS A DECLARATION: v2.std.node String, opaque, with its own exact row above (RustStdString). So the kernel spelling now has one declaration, and this bare row and that exact row render the same carrier, std::string::String; the uniqueness this row proves is unchanged." as NonEmptyStr
+        proof: "The kernel string_type is minted by v1.compiler.types for every string literal and carries no declaration; both .dag declarations of the spelling (v2.std.text, std.string_type) are gated structural by v1.compiler.coercion structural_declaration_modules_for and never reach this row. THE VERDICT STANDS AND ITS ORIGINAL ARGUMENT WAS EXACTLY INVERTED, corrected here rather than softened because the inverted form would justify the wrong things if reused. It read: the bare spelling cannot be captured because the only import that could shadow it binds the SAME token, so in a module importing v2.std.text String every `String` reference IS the text carrier and the kernel spelling is unreachable there. The opposite is true. KERNEL NAMES ARE NEVER OVERRIDDEN BY IMPORTS (v1.compiler.infer direct_import_export_precedence_note; v1.compiler.infer_env overlay_skips_kernel_name), so in such a module the import does not shadow at all and a bare `String` is ALWAYS the kernel -- the spelling the old argument called unreachable is the only one you reach. Three routes exist and all three are sound for this row: a bare reference in an importing module resolves to the kernel and IS this row's binding; a bare reference INSIDE v2.std.text resolves LOCALLY (locals beat kernel) and is gated structural, never reaching the row; and a QUALIFIED v2.std.text.String resolves through the alias to the dotted name std.algebra.FreeMonoid, which matches no bare row. Symbol was captured precisely because its token differed from its spelling, and that clause survives unchanged. ESTABLISHED BY EXECUTION, not by reading precedence -- AND THE SUBJECT NAMED HERE IS CORRECTED: this sentence previously said the census was run over A FIXTURE MODULE importing both v2.std.text String and v2.std.node Node. IT WAS NOT. The receipts carry no fixture rows at all; the subjects were LIVE CORPUS MODULES, and naming a subject that was not run is the same citation defect this row exists to correct. What v1.tests.claim.carrier_realization_census actually reports: in std.algebra, a module that imports the spelling, a bare String carries the kernel identity at declaration_field AND at fn_signature_param; inside v2.std.text the same spelling carries its own declaring module and diverges with exact identity, which is route 2 executed rather than argued; and v2.std.node Node carries its real declaring module at both position kinds as the positive control. RE-DERIVATION IS POSITION-KIND SENSITIVE AND THE OBVIOUS INSTRUCTION IS A TRAP. Running that census over a closure re-derives routes 1 and 2 soundly. It does NOT re-derive route 3: at fn_signature_param the census resolves a QUALIFIED v2.std.text.String through the alias onto the alias declaration's own name, which is the spelling String, and attributes it to <kernel:String> -- confidently naming the very carrier the qualification was written to move away from. That is measured by vivid-deer-102 and filed as recurring failure mode alias_resolution_collides_with_kernel_spelling (gunbc#9939); the same instrument is correct for qualified aliases at declaration_field. ROUTE 3 THEREFORE RESTS ON STRUCTURAL RESOLUTION PLUS A RUSTC MEASUREMENT -- the emitted crate carries an E0308 on the bare arm and not on the qualified one -- and explicitly NOT on this census, which cannot answer at that position. The instrument is named rather than its rows transcribed (DESIGN section 6). SINCE gunbc#12760 THE KERNEL HOST TEXT HAS A DECLARATION: v2.std.node String, opaque, with its own exact row above (RustStdString). So the kernel spelling now has one declaration, and this bare row and that exact row render the same carrier, std::string::String; the uniqueness this row proves is unchanged." as NonEmptyStr
       }
     },
     CheckpointRowMigration {
diff --git a/dag/gunbc/secret_provision.dag b/dag/gunbc/secret_provision.dag
index cde05b4d270..c82e33ee6d5 100644
--- a/dag/gunbc/secret_provision.dag
+++ b/dag/gunbc/secret_provision.dag
@@ -252,6 +252,16 @@ fn fleet_secret_ref(secret_id: NonEmptyStr) -> SecretRef {
   }
 }
 
+// THE OPENROUTER FREE-TIER KEY THE HOSTED HARNESS ROUTE READS. Created by the operator 2026-10-05 as
+// Secret Manager secret openrouter-free-tier-api-key-harness; the alias "latest" is requested and the
+// fetch proves the version it resolved. It is a key whose own credit limit is zero -- a guard so it can
+// only spend on free variants -- and gunbc.harness.harness_hosted_route reads that limit back at every
+// bind rather than trusting it. Its accessor cell is a row in gunbc.auth.fleet_secret_accessor_roster.
+data openrouter_free_tier_key_secret_ref: SecretRef = secret_ref_pin_version(
+  ref: fleet_secret_ref(secret_id: "openrouter-free-tier-api-key-harness"),
+  version: "latest",
+)
+
 // MT. COLLINS UNIT 1 MANAGED BMC CREDENTIAL LOCUS. Minted 2026-09-13 as Secret Manager
 // secret bmc-mtcollins1-gunbc. The user-3 route artifact records version 2 ENABLED and set
 // on the controller, version 1 DISABLED and never deployed. Pin the observed version; hash
@@ -275,6 +285,15 @@ data mtcollins1_bmc_gunbc_secret_ref: SecretRef = secret_ref_pin_version(
 // then the first rotation (gunbc.machine_intake_mtjade1_bmc_secure_observation).
 data mtjade1_bmc_gunbc_secret_ref: SecretRef = fleet_secret_ref(secret_id: "bmc-mtjade1-gunbc")
 
+// FIRST VERSION THE ARRIVAL SA IS GRANTED (operator sign-off msg_f03558d1). The locus row stays
+// pending for JadeManagedBmcSecretStanding until FamilyObserved; the accessor names versions/1,
+// which gcp-iam-converge binds once the container exists. Creating the container is this
+// authority's mint, not a hand gcloud.
+data mtjade1_bmc_gunbc_arrival_accessor_ref: SecretRef = secret_ref_pin_version(
+  ref: mtjade1_bmc_gunbc_secret_ref,
+  version: "1",
+)
+
 fn secret_ref_pin_version(ref: SecretRef, version: NonEmptyStr) -> SecretRef {
   SecretRef {
     project: ref.project,
diff --git a/dag/gunbc/seed_growth_admission.dag b/dag/gunbc/seed_growth_admission.dag
index f1b3107ce75..c10dd58dcf8 100644
--- a/dag/gunbc/seed_growth_admission.dag
+++ b/dag/gunbc/seed_growth_admission.dag
@@ -60,6 +60,7 @@ import gunbc.qualified_pipe_callee_seed_growth { qualified_pipe_callee_seed_grow
 import gunbc.shared_fill_attribution_seed_growth { shared_fill_attribution_seed_growth_justification }
 import gunbc.pool_reading_attribution_seed_growth { pool_reading_attribution_seed_growth_justification }
 import gunbc.source_root_eval_driver_seed_growth { source_root_eval_driver_seed_growth_justification }
+import gunbc.memory_envelope_receipt_seed_growth { memory_envelope_receipt_seed_growth_justification }
 import gunbc.gen_one_executable_keep_seed_growth { gen_one_executable_keep_seed_growth_justification }
 import gunbc.emitted_build_failure_retention_seed_growth { emitted_build_failure_retention_seed_growth_justification }
 import gunbc.native_claim_program_seed_growth { native_claim_program_seed_growth_justification }
@@ -96,6 +97,8 @@ import gunbc.floor_checker_input_seed_growth { floor_checker_input_seed_growth_j
 import gunbc.data_eval_counters_seed_growth { data_eval_counters_seed_growth_justification }
 import gunbc.param_binder_seed_growth { param_binder_seed_growth_justification }
 import gunbc.process_lifecycle_seed_growth { process_lifecycle_seed_growth_justification }
+import gunbc.run_arg_typed_bind_seed_growth { run_arg_typed_bind_seed_growth_justification }
+import gunbc.rust_shell_stderr_capture_seed_growth { rust_shell_stderr_capture_seed_growth_justification }
 import gunbc.rust_item_host_observation {
   ItemDeclarationRefProjection,
   LiveHandRustObservation,
@@ -309,6 +312,7 @@ fn seed_growth_justification_roster() -> List<SeedGrowthJustification> {
     shared_fill_attribution_seed_growth_justification,
     pool_reading_attribution_seed_growth_justification,
     source_root_eval_driver_seed_growth_justification,
+    memory_envelope_receipt_seed_growth_justification,
     gen_one_executable_keep_seed_growth_justification,
     emitted_build_failure_retention_seed_growth_justification,
     native_claim_program_seed_growth_justification,
@@ -383,7 +387,9 @@ fn seed_growth_justification_roster() -> List<SeedGrowthJustification> {
     value_depth_seed_growth_justification,
     value_drop_binding_adaptation_seed_growth_justification,
     process_lifecycle_seed_growth_justification,
-    native_product_cache_seed_growth_justification
+    native_product_cache_seed_growth_justification,
+    run_arg_typed_bind_seed_growth_justification,
+    rust_shell_stderr_capture_seed_growth_justification
   ]
 }
 
diff --git a/dag/gunbc/serving/admitted_model.dag b/dag/gunbc/serving/admitted_model.dag
index ea08f36d799..c9521430d1d 100644
--- a/dag/gunbc/serving/admitted_model.dag
+++ b/dag/gunbc/serving/admitted_model.dag
@@ -2,7 +2,7 @@ module gunbc.serving.admitted_model
 
 import std.types { String, NonEmptyStr, List }
 import gunbc.harness.harness_reasoning_wire {
-  HarnessServingUnit, DeepseekV4FlashOnVllm, Glm53FlashOnVllm,
+  HarnessServingUnit, DeepseekV4FlashOnVllm, Glm53FlashOnVllm, NemotronUltraFreeOnOpenRouter,
   harness_unit_model_id, harness_serving_unit_wire,
 }
 import gunbc.spark.group_b_serving_capacity { group_b_restoration_served_alias }
@@ -51,9 +51,14 @@ fn serving_admitted_ids(unit: HarnessServingUnit) -> List<NonEmptyStr> {
   match unit {
     DeepseekV4FlashOnVllm => [harness_unit_model_id(unit: DeepseekV4FlashOnVllm)]
     Glm53FlashOnVllm => [harness_unit_model_id(unit: Glm53FlashOnVllm), group_b_restoration_served_alias]
+    NemotronUltraFreeOnOpenRouter => [] as List<NonEmptyStr>
   }
 }
 
+// A HOSTED UNIT IS ADVERTISED BY NO FLEET ROUTE, so it answers to no id a fleet probe could read: it is
+// reached by name through gunbc.harness.harness_seat harness_bind_hosted, never resolved from what a
+// serving group reports, and it is deliberately absent from serving_admitted_units below.
+
 data serving_admitted_units: List<HarnessServingUnit> = [DeepseekV4FlashOnVllm, Glm53FlashOnVllm]
 
 // ── THE RESOLUTION, AND WHAT IT REFUSES ───────────────────────────────────────────────────────
diff --git a/dag/gunbc/serving/serving_enrollment.dag b/dag/gunbc/serving/serving_enrollment.dag
index b6eea5b81bd..e19444e00ad 100644
--- a/dag/gunbc/serving/serving_enrollment.dag
+++ b/dag/gunbc/serving/serving_enrollment.dag
@@ -5,7 +5,7 @@ import std.nat { Nat }
 import std.optional { Present, Absent }
 import product.host_identity { HostIdentity }
 import gunbc.fleet_intent_network { host_lan_address }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB, fabric_group_wire }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire }
 import gunbc.spark.group_b_serving_capacity { group_b_route_offer, group_b_restoration_serve_port }
 import gunbc.spark.pair_serving_desired { spark_pair_serving_head }
 import gunbc.spark.pair_serving_realization { spark_pair_serve_port }
@@ -157,8 +157,7 @@ type ServingRouteCeilingStanding
 // (DESIGN section 3), never inside either of them.
 fn serving_route_ceiling(group: FabricGroup) -> ServingRouteCeilingStanding {
   match group {
-    FabricGroupA => RouteCeilingStands { ceiling: serving_pair_route_turn_ceiling }
-    FabricGroupB => serving_group_b_route_turn_ceiling()
+    FabricGroupB {} => serving_group_b_route_turn_ceiling()
   }
 }
 
@@ -167,8 +166,7 @@ fn serving_route_ceiling(group: FabricGroup) -> ServingRouteCeilingStanding {
 // roster that arm's launch is planned from (gunbc.spark.fabric_serving_assignment fabric_serving_head).
 fn serving_route_head(group: FabricGroup) -> FabricServingHead {
   match group {
-    FabricGroupA => FabricServingHeadResolved { host: spark_pair_serving_head(group: FabricGroupA) }
-    FabricGroupB => fabric_serving_head(a: glm_group_b_serving_assignment)
+    FabricGroupB {} => fabric_serving_head(a: glm_group_b_serving_assignment)
   }
 }
 
@@ -177,8 +175,7 @@ fn serving_route_head(group: FabricGroup) -> FabricServingHead {
 // renders as --port.
 fn serving_route_port(group: FabricGroup) -> Port {
   match group {
-    FabricGroupA => spark_pair_serve_port
-    FabricGroupB => group_b_restoration_serve_port
+    FabricGroupB {} => group_b_restoration_serve_port
   }
 }
 
@@ -250,7 +247,7 @@ fn serving_route(group: FabricGroup) -> ServingRoute {
 // about whose hosts are claimed, which engine is desired, or what is converged -- those stay with
 // gunbc.spark.pair_serving_desired and gunbc.spark.fabric_serving_assignment respectively, and neither
 // is widened by this row.
-data serving_enrolled_groups: List<FabricGroup> = [FabricGroupA, FabricGroupB]
+data serving_enrolled_groups: List<FabricGroup> = [FabricGroupB {}]
 
 fn serving_enrolled_routes() -> List<ServingRoute> {
   map(serving_enrolled_groups, g => serving_route(group: g))
diff --git a/dag/gunbc/serving/serving_front_door.dag b/dag/gunbc/serving/serving_front_door.dag
index e5d32d6c44f..8c41c609c3a 100644
--- a/dag/gunbc/serving/serving_front_door.dag
+++ b/dag/gunbc/serving/serving_front_door.dag
@@ -34,10 +34,10 @@ import gunbc.fabric_event_log {
 }
 import gunbc.serving.turn_admission { ServingCoTenancyClass, serving_co_tenancy_class_wire }
 import gunbc.spark.vllm_endpoint_process_launch { VllmEndpointProcessLaunch, vllm_endpoint_process_launch_key }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_wire }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire }
 import gunbc.harness.harness_seat {
   HarnessSeatReference, HarnessSeatPoolIdentity, harness_seat_reference_wire,
-  release_retry, HarnessSeatReleased, HarnessSeatReleaseRefused,
+  release_retry, HarnessSeatReleased, HarnessHostedCredentialRemoved, HarnessSeatReleaseRefused,
 }
 
 // ── THE SECOND DOOR, AND WHY AUTHENTICATION ALONE DOES NOT CLOSE IT ──────────────────────────
@@ -712,6 +712,7 @@ type FrontDoorStreamEnd
 fn front_door_release_after_end(store: FabricStorageBinding, pool: HarnessSeatPoolIdentity, reference: NonEmptyStr, now: EpochSecs) -> FrontDoorStreamEnd {
   match release_retry(store: store, partition: pool.partition, ceiling: pool.ceiling, reference: reference, reason: "the front door's proxied stream ended" as NonEmptyStr, now: now) {
     HarnessSeatReleased { partition: _ } => StreamEndedSeatReleased
+    HarnessHostedCredentialRemoved => StreamEndedReleaseRefused { detail: "a seat-pool release answered as a hosted credential removal; the seat may still be held" }
     HarnessSeatReleaseRefused { detail: d } => StreamEndedReleaseRefused { detail: d }
   }
 }
diff --git a/dag/gunbc/serving/turn_admission.dag b/dag/gunbc/serving/turn_admission.dag
index 37b04b87b64..40c639e6641 100644
--- a/dag/gunbc/serving/turn_admission.dag
+++ b/dag/gunbc/serving/turn_admission.dag
@@ -13,7 +13,7 @@ import product.fabric.selection {
 }
 import product.fabric.isolation { IsolationProfile }
 import product.fabric.work { TrustDomainRef }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_wire }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire }
 
 // ── CO-TENANCY IS AN ADMISSION CONSTRAINT, NOT A PRICE ────────────────────────────────────────
 //
diff --git a/dag/gunbc/session_residency.dag b/dag/gunbc/session_residency.dag
index beb3c74c95f..3a7690ec086 100644
--- a/dag/gunbc/session_residency.dag
+++ b/dag/gunbc/session_residency.dag
@@ -5,6 +5,7 @@ import std.disposition { Disposition, Terminal, Scaffold, SingleAuthority }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import product.host_identity { HostIdentity }
 import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
+import gunbc.fleet_enrollment { InteractiveSessionParticipation, hosts_enrolled_for }
 import gunbc.fleet_shell_transport_observation {
   fleet_shell_transport_observation,
   ShellTransportSucceeded,
@@ -169,7 +170,7 @@ fn host_absence_is_operator_declared(host: HostIdentity) -> Bool {
 fn operator_declared_absent_host_count() -> Int {
   count(
     filter(
-      [operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4],
+      hosts_enrolled_for(wanted: InteractiveSessionParticipation),
       h => host_absence_is_operator_declared(host: h)
     )
   )
diff --git a/dag/gunbc/sha256sum_byte_span.dag b/dag/gunbc/sha256sum_byte_span.dag
deleted file mode 100644
index a015ca7ce30..00000000000
--- a/dag/gunbc/sha256sum_byte_span.dag
+++ /dev/null
@@ -1,73 +0,0 @@
-module gunbc.sha256sum_byte_span
-
-import std.types { String, List }
-import v2.std.node { Node }
-import v2.extdeps.languages.bash_build {
-  bash_build_command_with_words, bash_build_word_lit, bash_build_word_var,
-  bash_build_word_concat_from_nodes, bash_build_pipe,
-}
-import gunbc.shell_command_text { shell_command_text_of_stmts }
-
-// A REALIZATION OF extdeps.tools.sha256sum, NOT A FACT ABOUT IT (DESIGN section 3: interface,
-// realization and policy are three facts). The pipeline below composes two coreutils tools under a
-// bash transport and renders it to text through v2.workflow.bash_command_fold_serialize, whose
-// closure is the v2 compiler's translate stage. It lived in the tool's extdeps module until every
-// closure naming that tool shape -- gunbc.auth.approval_broker_serve through gunbc.package_delivery
-// among them -- transitively compiled the v2 pipeline stages to reach a text renderer it never called.
-
-// THE SHA256 OF A BYTE SPAN OF A FILE. sha256sum has no offset operand, so the span is streamed by
-// dd(1) (iflag=skip_bytes,count_bytes makes skip and count byte counts) into sha256sum -- a PIPELINE,
-// which no argv carrier expresses. It is therefore BUILT as a bash grammar tree and serialized by the
-// one authority for that (gunbc.shell_command_text over v2.workflow.bash_command_fold_serialize),
-// never hand-spelled: that module's own header states that the cap scripts and the live-deploy
-// spellings reached for this construction independently and "a second spelling would be the section 3
-// fork". A fixed-text version of this pipeline was the THIRD such reach and is removed here.
-//
-// The path, offset and length are POSITIONAL PARAMETERS ($1..$3), never spliced: sha256sum_byte_span_argv
-// passes them after the `bash` argv0, so no caller value is ever part of the program. Quoting is the
-// serializer's structural job rather than an apostrophe an author remembered to type. pipefail makes a
-// failed read fail the whole rather than pass as the digest of a short stream (dash, /bin/sh on these
-// hosts, refuses pipefail -- see extdeps.shell).
-fn sha256sum_byte_span_operand(prefix: String, param: String) -> Node {
-  bash_build_word_concat_from_nodes(parts: [bash_build_word_lit(text: prefix), bash_build_word_var(name: param)])
-}
-
-fn sha256sum_byte_span_stmts() -> List<Node> {
-  [
-    bash_build_command_with_words(words: [
-      bash_build_word_lit(text: "set"),
-      bash_build_word_lit(text: "-o"),
-      bash_build_word_lit(text: "pipefail"),
-    ]),
-    bash_build_pipe(
-      left: bash_build_command_with_words(words: [
-        bash_build_word_lit(text: "dd"),
-        sha256sum_byte_span_operand(prefix: "if=", param: "1"),
-        bash_build_word_lit(text: "bs=4M"),
-        bash_build_word_lit(text: "iflag=skip_bytes,count_bytes"),
-        sha256sum_byte_span_operand(prefix: "skip=", param: "2"),
-        sha256sum_byte_span_operand(prefix: "count=", param: "3"),
-        bash_build_word_lit(text: "status=none"),
-      ]),
-      right: bash_build_command_with_words(words: [bash_build_word_lit(text: "sha256sum")])
-    ),
-  ]
-}
-
-data sha256sum_byte_span_program: String = shell_command_text_of_stmts(stmts: sha256sum_byte_span_stmts())
-
-
-// THE ASSEMBLY IS ITS OWN FUNCTION, TAKING THE PROGRAM AS A VALUE. Which slot each operand lands in
-// is a fact about THIS list, not about the serializer, so a claim over it supplies the program rather
-// than rendering one (DESIGN section 3: a witness discriminates at ONE interface, and its inputs belong
-// at that boundary as supplied values). The `bash` at index 3 is argv0 -- bash -c assigns the first
-// operand after the program to $0, so path/offset/length become $1..$3 and no caller value is ever
-// part of the program text.
-fn sha256sum_byte_span_argv_of(program: String, path: String, offset: String, length: String) -> List<String> {
-  ["bash", "-c", program, "bash", path, offset, length]
-}
-
-fn sha256sum_byte_span_argv(path: String, offset: String, length: String) -> List<String> {
-  sha256sum_byte_span_argv_of(program: sha256sum_byte_span_program, path: path, offset: offset, length: length)
-}
-
diff --git a/dag/gunbc/source_root_eval_driver_seed_growth.dag b/dag/gunbc/source_root_eval_driver_seed_growth.dag
index 242e50d7054..aa0d093d18b 100644
--- a/dag/gunbc/source_root_eval_driver_seed_growth.dag
+++ b/dag/gunbc/source_root_eval_driver_seed_growth.dag
@@ -18,10 +18,15 @@ data source_root_eval_driver_seed_growth_justification: SeedGrowthJustification
       module_path: "v1.compiler.emit_rust",
       decl_name: "emit_source_root_eval_driver_main_rs",
       field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.cli_run.native_lane_runner",
+      decl_name: "host_memory_budget_receipt_line",
+      field: WholeDeclaration
     }
   ],
 
-  reason: "FILESYSTEM PORTION REMOVED: gunbc.source_root_read owns traversal and typed read refusal through the existing Filesystem service, and v2.compiler.source_authority source_root_ingest_from_files constructs witnesses. emit_host_source_root_read_rs now only binds that handler and transports its outcome. NativeCliDriver calls v2_cli_main once; the eval driver still retains the other obligations below, so this row does not retire. walk_cli_door additionally executes missing-root and unreadable-source controls against the built CLI, requiring exit 2, empty stdout, and a located acquisition cause. The historical enumeration follows; its filesystem traversal and byte-read portion is superseded by this statement. One hand-authored declaration renders the SourceRootEvalDriver's main.rs as target-language text: roughly 500 lines of Rust spelled as string literals inside a .dag concat, not emitter logic over Nodes. It is a single declaration by the citable count and one program by the real one, and the gap between those two numbers is the point of this row. WHAT IS IRREDUCIBLY HOST here: argv, the source-root walk and byte reads, the monotonic and wall clocks, the /proc memory reading, stdout and stderr, and the process exit status. Nothing in .dag can perform those, and the driver exists to own exactly that boundary (std.compiler_entry SourceRootEvalDriver). WHAT IS EXPRESSIBLE IN .dag AND STILL RETAINED, each waiting on a named capability rather than on effort: the host-facts TSV decode (read_host_facts, host_fact, host_fact_int), which needs the ingest direction of the one grammar to produce NativeLaneHostFacts from bytes; the [native-cost-partition] JSON rendering, whose ROW SET and reconcile verdict are already a .dag authority this main calls (std.compiler_entry NativeDriverExclusiveRows, native_driver_cost_account) so that only the rendering is retained; and the THREE-mode orchestration (run_census, run_census_resolve, run_adjudication: phase order, refusal arms, terminal marker), which needs a .dag driver that can receive host effects as values. The third mode was added by the whole-tree census-resolve cut, and it is named here rather than left to be discovered because this row's reason is the standing enumeration of what is retained: a mode that is not in it is hand-authored Rust no row accounts for. What that cut did NOT do is grow the hand-authored DECISION surface -- the roster, the per-module verdict and the occurrence-grain rows are v2.compiler.compile folds (native_census_modules, native_census_module_resolution, native_census_residual_rows), and the mode is the same loop-and-print shape the other two already are, so the retained program grew by an orchestration arm and not by a second place where resolution is decided. WHAT THE INSTRUMENT HARNESS ADDS, ENUMERATED HERE BECAUSE THIS ROW'S OWN STANDARD DEMANDS IT (2026-09-21, review 69637). The sentence above says this reason is the standing enumeration of what is retained and that a mode absent from it is hand-authored Rust no row accounts for. v1_compiler.cli_run.native_lane_runner gained roughly 560 lines that were not enumerated: walk_eval_driver_door and walk_cli_door (the two instruments' entrypoint-execution controls), run_cli_door (a spawn whose stdout contract is the CLI driver's, not the eval driver's, so it cannot share run_native_binary), adjudicate_cli_emit_probe with cli_refusal_determining_reason and CliEmitProbeVerdict (the emit probe's closed partition over a termination plus a rendered refusal), cli_door_member_arm and CliDoorMemberArm (gunbc#12218: the probe reads the fixture member's arm out of the door's ClosureEmission carrier, so the emitted text it judges is that member's and never stdout as a whole; decoding is host-side because the carrier arrives as a spawned process's stdout, and it moves with the adjudication the day a .dag driver receives a process termination as a value), and a #[cfg(test)] module carrying their discriminating controls. gunbc#12207 added one more, emitted_text_compiles_as_rust: the emit probe's exit-0 arm now requires the door's text to name the fixture's declaration, carry its value and be accepted by the build's own rustc, and that last test is a spawn of the compiler over the emitted text -- host effect, the same kind as the door spawns, handed to the pure adjudication as a function so the partition stays a fold over values. ALL OF IT IS HOST EFFECT OR ADJUDICATION OVER ONE: spawning a built binary, reading its termination. It sits under the same reachability limit this row already states -- the required floor's hermetic envelope refuses host effects, so a .dag witness whose subject is a subprocess termination is counted executed while its assertion never runs. WHAT OF IT IS EXPRESSIBLE IN .dag AND STILL RETAINED, named rather than left implicit: the emit probe's ADJUDICATION is a pure fold over a status and two strings and wants no host at all -- it is written in Rust only because its inputs are produced by a spawn on this side of the boundary, and it moves the day a .dag driver can receive a process termination as a value, which is the same capability this row's trigger already names. The SPAWNS are irreducibly host. THE ENUMERATION IS THE POINT: a later reader counting retained Rust against this row will now find these, and a mode added beside them without a row entry is the defect this sentence exists to make visible. WHAT THE NATIVE FRONTIER RATCHET ADDS (2026-09-23), ENUMERATED ON THE SAME STANDARD. In the rendered adjudicate main: one call to gunbc.native_frontier_ratchet native_frontier_verdict beside native_route_admission, its word on the terminal marker, and two stderr loops printing native_frontier_report_lines and native_frontier_proposal_file_lines. It is orchestration and printing only: the verdict, the lines and the proposed roster file are .dag folds. In the host harness (v1_compiler.cli_run.native_lane_runner): the marker's `frontier` field, required on an adjudicate marker, and run_v2_native_frontier, which carries that word out. In v1_compiler.target_invocation_host: the V2NativeFrontier producer arm, a closed match of the word to a termination. THE LIVE PROGRAM RETIRING IT is the one this row already names, v2.cli.compile_cli's NativeCliDriver: the rendered main becomes one call into a .dag fold that receives host effects as values. At that point the frontier print loops and the marker field go with the rest of the orchestration, and nothing here needs a separate trigger.
+  reason: "FILESYSTEM PORTION REMOVED: gunbc.source_root_read owns traversal and typed read refusal through the existing Filesystem service, and v2.compiler.source_authority source_root_ingest_from_files constructs witnesses. emit_host_source_root_read_rs now only binds that handler and transports its outcome. NativeCliDriver calls v2_cli_main once; the eval driver still retains the other obligations below, so this row does not retire. walk_cli_door additionally executes missing-root and unreadable-source controls against the built CLI, requiring exit 2, empty stdout, and a located acquisition cause. The historical enumeration follows; its filesystem traversal and byte-read portion is superseded by this statement. One hand-authored declaration renders the SourceRootEvalDriver's main.rs as target-language text: roughly 500 lines of Rust spelled as string literals inside a .dag concat, not emitter logic over Nodes. It is a single declaration by the citable count and one program by the real one, and the gap between those two numbers is the point of this row. WHAT IS IRREDUCIBLY HOST here: argv, the source-root walk and byte reads, the monotonic and wall clocks, the /proc memory reading, stdout and stderr, and the process exit status. Nothing in .dag can perform those, and the driver exists to own exactly that boundary (std.compiler_entry SourceRootEvalDriver). WHAT IS EXPRESSIBLE IN .dag AND STILL RETAINED, each waiting on a named capability rather than on effort: the host-facts TSV decode (read_host_facts, host_fact, host_fact_int), which needs the ingest direction of the one grammar to produce NativeLaneHostFacts from bytes; the [native-cost-partition] JSON rendering, whose ROW SET and reconcile verdict are already a .dag authority this main calls (std.compiler_entry NativeDriverExclusiveRows, native_driver_cost_account) so that only the rendering is retained; and the THREE-mode orchestration (run_census, run_census_resolve, run_adjudication: phase order, refusal arms, terminal marker), which needs a .dag driver that can receive host effects as values. The third mode was added by the whole-tree census-resolve cut, and it is named here rather than left to be discovered because this row's reason is the standing enumeration of what is retained: a mode that is not in it is hand-authored Rust no row accounts for. What that cut did NOT do is grow the hand-authored DECISION surface -- the roster, the per-module verdict and the occurrence-grain rows are v2.compiler.compile folds (native_census_modules, native_census_module_resolution, native_census_residual_rows), and the mode is the same loop-and-print shape the other two already are, so the retained program grew by an orchestration arm and not by a second place where resolution is decided. WHAT THE INSTRUMENT HARNESS ADDS, ENUMERATED HERE BECAUSE THIS ROW'S OWN STANDARD DEMANDS IT (2026-09-21, review 69637). The sentence above says this reason is the standing enumeration of what is retained and that a mode absent from it is hand-authored Rust no row accounts for. v1_compiler.cli_run.native_lane_runner gained roughly 560 lines that were not enumerated: walk_eval_driver_door and walk_cli_door (the two instruments' entrypoint-execution controls), run_cli_door (a spawn whose stdout contract is the CLI driver's, not the eval driver's, so it cannot share run_native_binary), adjudicate_cli_emit_probe with cli_refusal_determining_reason and CliEmitProbeVerdict (the emit probe's closed partition over a termination plus a rendered refusal), cli_door_member_arm and CliDoorMemberArm (gunbc#12218: the probe reads the fixture member's arm out of the door's ClosureEmission carrier, so the emitted text it judges is that member's and never stdout as a whole; decoding is host-side because the carrier arrives as a spawned process's stdout, and it moves with the adjudication the day a .dag driver receives a process termination as a value), and a #[cfg(test)] module carrying their discriminating controls. gunbc#13590 added walk_native_ingest_layout_controls on that same walk_cli_door instrument: four inhabitance spawns of the built CLI over discovering --source-root layout fixtures (unrecognized copied root, /src/ under a dag root, two admitted roots, duplicate module naming both files). Same host kind as walk_cli_door — spawn and read termination — so it is enumerated here rather than a second SeedGrowthJustification. gunbc#12207 added one more, emitted_text_compiles_as_rust: the emit probe's exit-0 arm now requires the door's text to name the fixture's declaration, carry its value and be accepted by the build's own rustc, and that last test is a spawn of the compiler over the emitted text -- host effect, the same kind as the door spawns, handed to the pure adjudication as a function so the partition stays a fold over values. ALL OF IT IS HOST EFFECT OR ADJUDICATION OVER ONE: spawning a built binary, reading its termination. It sits under the same reachability limit this row already states -- the required floor's hermetic envelope refuses host effects, so a .dag witness whose subject is a subprocess termination is counted executed while its assertion never runs. WHAT OF IT IS EXPRESSIBLE IN .dag AND STILL RETAINED, named rather than left implicit: the emit probe's ADJUDICATION is a pure fold over a status and two strings and wants no host at all -- it is written in Rust only because its inputs are produced by a spawn on this side of the boundary, and it moves the day a .dag driver can receive a process termination as a value, which is the same capability this row's trigger already names. The SPAWNS are irreducibly host. THE ENUMERATION IS THE POINT: a later reader counting retained Rust against this row will now find these, and a mode added beside them without a row entry is the defect this sentence exists to make visible. WHAT THE NATIVE FRONTIER RATCHET ADDS (2026-09-23), ENUMERATED ON THE SAME STANDARD. In the rendered adjudicate main: one call to gunbc.native_frontier_ratchet native_frontier_verdict beside native_route_admission, its word on the terminal marker, and two stderr loops printing native_frontier_report_lines and native_frontier_proposal_file_lines. It is orchestration and printing only: the verdict, the lines and the proposed roster file are .dag folds. In the host harness (v1_compiler.cli_run.native_lane_runner): the marker's `frontier` field, required on an adjudicate marker, and run_v2_native_frontier, which carries that word out. In v1_compiler.target_invocation_host: the V2NativeFrontier producer arm, a closed match of the word to a termination. THE LIVE PROGRAM RETIRING IT is the one this row already names, v2.cli.compile_cli's NativeCliDriver: the rendered main becomes one call into a .dag fold that receives host effects as values. At that point the frontier print loops and the marker field go with the rest of the orchestration, and nothing here needs a separate trigger. WHAT CENSUS PART 2 ADDS (gunbc#13308, 2026-10-04), ENUMERATED ON THE SAME STANDARD. In the rendered main, run_census_infer grew from the type-census loop into the refusal census's orchestration as well: a per-outcome match that counts file-refused, resolve-refused, inferred and infer-refused modules; the resolve residual rows printed as run_census_resolve prints them; the cause_group, census_subject and census_root print loops; and a terminal marker carrying those counts and the type census's verdict word, printed whenever the walk completes, while the exit status stays the type census's. It is orchestration and printing only: the per-module step, the filing, the cascade attribution, the ranking, the subject closure and its membership, and every verdict are v2.compiler.compile folds (native_census_module_inference, native_census_cause_groups_add_infer_module, native_census_infer_cascade, native_census_roots_ranked, native_census_subject_closure, native_census_root_subject_membership). In the host harness (v1_compiler.cli_run.native_lane_runner): run_v2_native_census now spawns census-infer, decode_native_census_output reads its terminal (roots, inferred, infer_refused and a closed type_census word), and host_memory_budget_receipt_line renders the one typed budget resolution (memory_governor read_host_budget_resolution) into the receipt's stderr, adding no precedence of its own. The renderer is host because the budget is a host fact read in the host process. THE LIVE PROGRAM RETIRING IT is the same NativeCliDriver this row's trigger names: the census-infer print loops and terminal go with the rest of the orchestration, and the receipt line moves the day a .dag driver receives the budget resolution as a value.
 
 THE NET SEED MOTION OF THE CHANGE THAT ADDS THIS IS FAVOURABLE AND IS NOT AN EXCUSE: src/v1/stage0/src/cli_run/native_lane_runner.rs loses about 859 lines as the universe derivation, the fan-out and the admission move into the emitted compiler, and both v1-interpreter brackets are deleted at the root rather than retained as a fallback. A shrinking neighbour does not discharge this declaration; it only means the lane is moving the right way while this piece has not moved yet.",
 
@@ -29,5 +34,5 @@ THE NET SEED MOTION OF THE CHANGE THAT ADDS THIS IS FAVOURABLE AND IS NOT AN EXC
 
   trigger: "Delete this rendered main when a .dag driver function can receive the host operations above AS VALUES — argv, the walked and read source roots, the two clocks, the /proc reading, the two output sinks and the exit status — so that the rendered main becomes one call into that fold and the phase order, the refusal arms and the terminal marker are decided in .dag. That is the capability, and it retires the whole row. WHAT DOES NOT RETIRE IT, named because each is the tempting smaller artifact: migrating the TSV decode alone, which leaves the orchestration hand-authored; rendering the cost row from .dag alone, which is already half-done since the row set and the verdict are a .dag authority and only the JSON rendering is retained; and shrinking the template by moving Rust text into a second emitter helper, which relocates the hand-authored program without reducing it.",
 
-  current_boundary: "v1.compiler.emit_rust emit_source_root_eval_driver_main_rs -> the rendered main.rs of the emitted closure crate -> claim_executor --v2-native-route (v1_compiler.cli_run.native_lane_runner run_required_v2_native), which spawns that binary in census and adjudicate modes; and gunbc test //gunbc/instruments:self-host (v1_compiler.cli_run.native_lane_runner walk_eval_driver_door), which spawns it twice in census mode as that instrument's accepting and refusing controls; v1_compiler.cli_run.native_lane_runner walk_cli_door, run_cli_door, adjudicate_cli_emit_probe, cli_refusal_determining_reason, cli_door_member_arm and emitted_text_compiles_as_rust, the instrument-side harness enumerated in this row's reason"
+  current_boundary: "v1.compiler.emit_rust emit_source_root_eval_driver_main_rs -> the rendered main.rs of the emitted closure crate -> claim_executor --v2-native-route (v1_compiler.cli_run.native_lane_runner run_required_v2_native), which spawns that binary in census and adjudicate modes; and gunbc test //gunbc/instruments:self-host (v1_compiler.cli_run.native_lane_runner walk_eval_driver_door), which spawns it twice in census mode as that instrument's accepting and refusing controls; v1_compiler.cli_run.native_lane_runner walk_cli_door, walk_native_ingest_layout_controls, run_cli_door, adjudicate_cli_emit_probe, cli_refusal_determining_reason, cli_door_member_arm and emitted_text_compiles_as_rust, the instrument-side harness enumerated in this row's reason"
 }
diff --git a/dag/gunbc/source_root_read.dag b/dag/gunbc/source_root_read.dag
index dfa7317f24e..49cf2da71a3 100644
--- a/dag/gunbc/source_root_read.dag
+++ b/dag/gunbc/source_root_read.dag
@@ -15,11 +15,12 @@ import std.optional { Absent, Present }
 // directory. Only the host's NotADirectory observation admits a candidate as a file; every
 // other failure stops the walk. In particular a disappearing entry or a broken symlink cannot
 // silently shrink the compiler's source population. The transport refuses lossy name encodings.
-type SourceRootWalkTask { path: String, root: Bool }
+type SourceRootWalkTask { path: String, root: Bool, origin: String }
+type SourceRootWalkedPath { path: String, origin: String }
 type SourceRootPaths
-  = SourceRootPathsRead { paths: List<String> }
+  = SourceRootPathsRead { paths: List<SourceRootWalkedPath> }
   | SourceRootPathsRefused { path: String, kind: String, cause: String }
-type SourceRootFile { path: String, content: String }
+type SourceRootFile { path: String, content: String, origin: String }
 type SourceRootFiles
   = SourceRootFilesRead { files: List<SourceRootFile> }
   | SourceRootFilesRefused { path: String, kind: String, cause: String }
@@ -39,9 +40,9 @@ fn source_root_candidate_is_file(root: Bool, error_kind: String) -> Bool {
   }
 }
 
-fn source_root_walk(pending: List<SourceRootWalkTask>, paths: List<String>) -> SourceRootPaths {
+fn source_root_walk(pending: List<SourceRootWalkTask>, paths: List<SourceRootWalkedPath>) -> SourceRootPaths {
   match pending |> first {
-    Absent => SourceRootPathsRead { paths: paths |> sort_by(path => path) }
+    Absent => SourceRootPathsRead { paths: paths |> sort_by(walked => walked.path) }
     Present { value: task } => {
       let rest = pending.skip(n: 1)
       let listed = Filesystem.List(path: task.path)
@@ -49,13 +50,17 @@ fn source_root_walk(pending: List<SourceRootWalkTask>, paths: List<String>) -> S
         entries: listed.entries, error: listed.error) {
         FilesystemDirectoryListed(listing) => {
           let children = filesystem_listing_entry_names(listing: listing) |> map(name => SourceRootWalkTask {
-            path: source_root_child_path(directory: task.path, name: name), root: false
+            path: source_root_child_path(directory: task.path, name: name),
+            root: false,
+            origin: task.origin
           })
           source_root_walk(pending: concat(children, rest), paths: paths)
         }
         FilesystemDirectoryListingRefused { directory: _, error: cause } =>
           if source_root_candidate_is_file(root: task.root, error_kind: listed.error_kind) {
-            let next = if task.path.ends_with(suffix: ".dag") { concat(paths, [task.path]) } else { paths }
+            let next = if task.path.ends_with(suffix: ".dag") {
+              concat(paths, [SourceRootWalkedPath { path: task.path, origin: task.origin }])
+            } else { paths }
             source_root_walk(pending: rest, paths: next)
           } else {
             SourceRootPathsRefused { path: task.path, kind: listed.error_kind, cause: cause }
@@ -73,13 +78,13 @@ fn source_root_read_file(path: String) -> FilesystemExactRead {
     error: read.error, error_kind: read.error_kind)
 }
 
-fn source_root_read_paths(pending: List<String>, files: List<SourceRootFile>) -> SourceRootFiles {
+fn source_root_read_paths(pending: List<SourceRootWalkedPath>, files: List<SourceRootFile>) -> SourceRootFiles {
   match pending |> first {
     Absent => SourceRootFilesRead { files: files }
-    Present { value: path } => match source_root_read_file(path: path) {
+    Present { value: walked } => match source_root_read_file(path: walked.path) {
       FilesystemExactPathRead { path: observed, content: content } =>
         source_root_read_paths(pending: pending.skip(n: 1),
-          files: concat(files, [SourceRootFile { path: observed, content: content }]))
+          files: concat(files, [SourceRootFile { path: observed, content: content, origin: walked.origin }]))
       FilesystemExactPathAbsent { path: observed } =>
         SourceRootFilesRefused { path: observed, kind: "not_found", cause: "source disappeared before it could be read" }
       FilesystemExactPathUnreadable { path: observed, kind: kind, error: cause } =>
@@ -91,7 +96,10 @@ fn source_root_read_paths(pending: List<String>, files: List<SourceRootFile>) ->
 }
 
 fn source_root_read(roots: List<String>) -> SourceRootFiles {
-  match source_root_walk(pending: roots |> map(path => SourceRootWalkTask { path: path, root: true }), paths: []) {
+  match source_root_walk(
+    pending: roots |> map(path => SourceRootWalkTask { path: path, root: true, origin: path }),
+    paths: []
+  ) {
     SourceRootPathsRefused { path: path, kind: kind, cause: cause } =>
       SourceRootFilesRefused { path: path, kind: kind, cause: cause }
     SourceRootPathsRead { paths: paths } => source_root_read_paths(pending: paths, files: [])
diff --git a/dag/gunbc/spark/arm_group_launch_dispatch.dag b/dag/gunbc/spark/arm_group_launch_dispatch.dag
deleted file mode 100644
index 948323ccdf9..00000000000
--- a/dag/gunbc/spark/arm_group_launch_dispatch.dag
+++ /dev/null
@@ -1,293 +0,0 @@
-module gunbc.spark.arm_group_launch_dispatch
-
-import product.host_identity { HostIdentity }
-import std.types { String, List, NonEmptyStr, Int }
-import std.optional { Present, Absent }
-import std.process { ProcessExit, exit_failure }
-import gunbc.fleet_multi_principal_probe { env_var_nonempty }
-import gunbc.spark.group_arm_launch { ArmDryPlan, ArmWetSession, group_arm_dry_plan_write, group_arm_launch_wet, group_arm_occupancy_observe_session }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA }
-import gunbc.spark.serving_arm { Glm53NativeFp8, Glm53FlashNvidiaNvfp4 }
-import gunbc.spark.group_checkpoint_materialize { CheckpointMaterialization, checkpoint_materialize_wet }
-import gunbc.spark.runtime_image_produce_dispatch { runtime_image_env, runtime_image_options, runtime_image_choice_of_wire, runtime_image_held_of }
-import gunbc.spark.glm53_staircase_load { glm53_step_load, Glm53StepLoadReady, Glm53StepLoadRefused, glm53_step_load_session }
-import gunbc.spark.vllm_runtime_image_build { with_spark_build_host, SparkBuildHostRefused, SparkBuildHostRan }
-import gunbc.fleet_multi_principal_probe { spark_converge_target_selection, SparkConvergeTargetSingle, SparkConvergeTargetAllObserveOnly, SparkConvergeTargetRefused }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import std.process { ExitSuccess }
-import gunbc.spark.v41_group_a_launch { v41_group_a_dry_plan, v41_group_a_wet_session, v41_group_a_deployment_env }
-import gunbc.spark.arm_memory_fit { engine_ready_timeout_for, EngineReadyTimeoutResolved, EngineReadyTimeoutUnreadable }
-import std.measure { Second, second, second_count }
-import std.types { Duration }
-import extdeps.docker.cli { DockerEnvAssignment }
-import gunbc.spark.glm53_arm_staircase { glm53_step_deployment_env, Glm53StaircaseStep, Glm53IncumbentChoice, glm53_staircase_steps, glm53_step_wire, glm53_step_of_wire, glm53_incumbent_choices, glm53_incumbent_choice_wire, glm53_incumbent_choice_of_wire, glm53_step_dry_plan, glm53_step_wet_session }
-
-// ── WHICH ARM A GROUP-LAUNCH MODE RUNS, FROM CLOSED WORKFLOW INPUTS (deforking cut 8a) ────────────
-//
-// THE DISPATCH THAT SELECTS A REALIZATION IS ITSELF REALIZATION (DESIGN §3), so it sits here, peripheral
-// to both arms and to the one launch path: gunbc.spark.group_arm_launch knows no arm, each arm module
-// knows only itself, and this module is the only place that knows the roster. The workflow modes
-// spark_arm_group_launch_plan and spark_arm_group_launch (gunbc.fleet.fleet_converge_workflow) call
-// the two entries below; the arm, the staircase step and the declared incumbent are dispatch inputs
-// whose options are the wires of the closed types they parse into, so an unknown word refuses and names
-// the vocabulary rather than being typed through.
-//
-// V4.1 TAKES NO STEP AND NO INCUMBENT. Its shape is the capacity measurement's and it refuses every
-// occupied host, so a step or an incumbent supplied for it is a dispatch that asked for something this
-// arm does not have, and it refuses rather than ignoring the input.
-type ArmGroupLaunchChoice
-  = ArmV41GroupA
-  | ArmGlm53GroupAStep { step: Glm53StaircaseStep, incumbent: Glm53IncumbentChoice }
-
-type ArmGroupLaunchSelection
-  = ArmGroupLaunchSelected { choice: ArmGroupLaunchChoice }
-  | ArmGroupLaunchSelectionRefused { cause: String }
-
-data arm_group_launch_arm_env: NonEmptyStr = "GUNBC_ARM_LAUNCH" as NonEmptyStr
-data arm_group_launch_step_env: NonEmptyStr = "GUNBC_ARM_STAIRCASE_STEP" as NonEmptyStr
-data arm_group_launch_incumbent_env: NonEmptyStr = "GUNBC_ARM_INCUMBENT" as NonEmptyStr
-
-data arm_group_launch_arm_v41: String = "v41-group-a"
-data arm_group_launch_arm_glm53: String = "glm53-group-a"
-
-fn arm_group_launch_arm_options() -> List<String> {
-  [arm_group_launch_arm_v41, arm_group_launch_arm_glm53]
-}
-
-fn arm_group_launch_step_options() -> List<String> {
-  map(glm53_staircase_steps, s => glm53_step_wire(s: s) as String)
-}
-
-fn arm_group_launch_incumbent_options() -> List<String> {
-  map(glm53_incumbent_choices, c => glm53_incumbent_choice_wire(c: c) as String)
-}
-
-// THE DECISION, SEPARATED FROM THE ENVIRONMENT READ SO IT IS WITNESSABLE AT ALL. An absent input is the
-// empty word.
-fn arm_group_launch_select(arm: String, step: String, incumbent: String) -> ArmGroupLaunchSelection {
-  if arm == arm_group_launch_arm_v41 {
-    if step != "" || incumbent != "" {
-      ArmGroupLaunchSelectionRefused { cause: join(["the V4.1 Group A arm takes no staircase step and no declared incumbent (its shape is the capacity measurement's and it refuses every occupied host); got step `", step, "` incumbent `", incumbent, "`"], "") }
-    } else {
-      ArmGroupLaunchSelected { choice: ArmV41GroupA }
-    }
-  } else if arm == arm_group_launch_arm_glm53 {
-    match glm53_step_of_wire(word: step) {
-      Absent => ArmGroupLaunchSelectionRefused { cause: join([arm_group_launch_step_env as String, "=`", step, "` is not a GLM staircase step; the steps are ", join(arm_group_launch_step_options(), ", ")], "") }
-      Present { value: s } =>
-        match glm53_incumbent_choice_of_wire(word: incumbent) {
-          Absent => ArmGroupLaunchSelectionRefused { cause: join([arm_group_launch_incumbent_env as String, "=`", incumbent, "` is not an incumbent choice; the choices are ", join(arm_group_launch_incumbent_options(), ", ")], "") }
-          Present { value: c } => ArmGroupLaunchSelected { choice: ArmGlm53GroupAStep { step: s, incumbent: c } }
-        }
-    }
-  } else {
-    ArmGroupLaunchSelectionRefused { cause: join([arm_group_launch_arm_env as String, "=`", arm, "` is not an arm; the arms are ", join(arm_group_launch_arm_options(), ", ")], "") }
-  }
-}
-
-fn env_word(name: NonEmptyStr) -> String {
-  match env_var_nonempty(name: name) {
-    Present { value: v } => v
-    Absent => ""
-  }
-}
-
-fn arm_group_launch_selection_from_env() -> ArmGroupLaunchSelection {
-  arm_group_launch_select(arm: env_word(name: arm_group_launch_arm_env), step: env_word(name: arm_group_launch_step_env), incumbent: env_word(name: arm_group_launch_incumbent_env))
-}
-
-fn arm_group_launch_dry_plan_of(c: ArmGroupLaunchChoice) -> ArmDryPlan {
-  match c {
-    ArmV41GroupA => v41_group_a_dry_plan()
-    ArmGlm53GroupAStep { step: s, incumbent: i } => glm53_step_dry_plan(s: s, choice: i)
-  }
-}
-
-fn arm_group_launch_wet_session_of(c: ArmGroupLaunchChoice) -> ArmWetSession {
-  match c {
-    ArmV41GroupA => v41_group_a_wet_session()
-    ArmGlm53GroupAStep { step: s, incumbent: i } => glm53_step_wet_session(s: s, choice: i)
-  }
-}
-
-data arm_group_launch_plan_path: String = "target/arm-group-launch-plan.txt"
-data arm_group_launch_receipt_path: String = "target/arm-group-launch-receipt.txt"
-
-// THE DRY-PLAN ENTRY (mode spark_arm_group_launch_plan): reaches no host except the authority log's
-// read; exits zero only when the plan is ADMITTED, and writes the report either way.
-fn arm_group_launch_plan_ci() -> ProcessExit {
-  match arm_group_launch_selection_from_env() {
-    ArmGroupLaunchSelectionRefused { cause: c } => exit_failure(reason: c)
-    ArmGroupLaunchSelected { choice: c } => group_arm_dry_plan_write(title: "arm group launch", plan: arm_group_launch_dry_plan_of(c: c), path: arm_group_launch_plan_path)
-  }
-}
-
-// THE WET ENTRY (mode spark_arm_group_launch): exits zero only when the arm COMMITTED.
-fn arm_group_launch_ci_wet() -> ProcessExit {
-  match arm_group_launch_selection_from_env() {
-    ArmGroupLaunchSelectionRefused { cause: c } => exit_failure(reason: c)
-    ArmGroupLaunchSelected { choice: c } => group_arm_launch_wet(arm: arm_group_launch_wet_session_of(c: c), receipt_path: arm_group_launch_receipt_path)
-  }
-}
-
-// THE OBSERVE NEEDS ONLY THE ARM'S GROUP, so it parses only the arm word: a step or an incumbent is
-// a launch's input, and an observation that demanded one would ask the operator for a value it never
-// reads.
-type ArmGroupOfWord
-  = ArmGroupNamed { group: FabricGroup }
-  | ArmGroupWordRefused { cause: String }
-
-fn arm_group_of_word(arm: String) -> ArmGroupOfWord {
-  if arm == arm_group_launch_arm_v41 { ArmGroupNamed { group: FabricGroupA } }
-  else if arm == arm_group_launch_arm_glm53 { ArmGroupNamed { group: FabricGroupA } }
-  else { ArmGroupWordRefused { cause: join([arm_group_launch_arm_env as String, "=`", arm, "` is not an arm; the arms are ", join(arm_group_launch_arm_options(), ", ")], "") } }
-}
-
-data arm_group_observe_receipt_path: String = "target/arm-group-observe-receipt.txt"
-
-// THE READ-ONLY OBSERVE ENTRY (mode spark_arm_group_observe): the chosen arm's GROUP, every host's
-// running units, containers and GPU processes with their owning cgroups.
-fn arm_group_observe_ci() -> ProcessExit {
-  match arm_group_of_word(arm: env_word(name: arm_group_launch_arm_env)) {
-    ArmGroupWordRefused { cause: c } => exit_failure(reason: c)
-    ArmGroupNamed { group: g } => group_arm_launch_wet(arm: group_arm_occupancy_observe_session(group: g), receipt_path: arm_group_observe_receipt_path)
-  }
-}
-
-// ── WHICH CHECKPOINT THE MATERIALIZE MODE ACQUIRES, FOR WHICH ARM ─────────────────────────────────
-//
-// The GLM arm's two staircase checkpoints, by a closed word (mode spark_arm_checkpoint_materialize,
-// dispatch input `checkpoint`). V4.1 materializes through its own mode (spark_v41_checkpoint_materialize,
-// gunbc.spark.v41_checkpoint_materialize), so a V4.1 arm here refuses rather than being routed silently.
-data arm_checkpoint_env: NonEmptyStr = "GUNBC_ARM_CHECKPOINT" as NonEmptyStr
-data arm_checkpoint_glm53_fp8: String = "glm53-native-fp8"
-data arm_checkpoint_glm53_nvfp4: String = "glm53-flash-nvidia-nvfp4"
-
-fn arm_checkpoint_options() -> List<String> {
-  [arm_checkpoint_glm53_fp8, arm_checkpoint_glm53_nvfp4]
-}
-
-// THE SEED HOST OF EACH GLM CHECKPOINT ON GROUP A, AS A MODELED FACT (operator ruling, 2026-10-03: the Hub
-// seed is chosen explicitly, never inferred from "no admissible peer"). srv7 holds the produced image and fetched
-// the FP8 snapshot first; it seeds both checkpoints, and srv5, srv6 and srv8 replicate from it over the rail.
-data glm53_checkpoint_seed_host: HostIdentity = "srv7" as HostIdentity
-
-data arm_checkpoint_receipt_path: String = "target/arm-checkpoint-materialize-receipt.txt"
-
-fn arm_checkpoint_materialize_ci() -> ProcessExit {
-  let arm = env_word(name: arm_group_launch_arm_env)
-  let word = env_word(name: arm_checkpoint_env)
-  if arm != arm_group_launch_arm_glm53 {
-    exit_failure(reason: join([arm_group_launch_arm_env as String, "=`", arm, "`: only the ", arm_group_launch_arm_glm53, " arm materializes through this mode; V4.1 has its own (spark_v41_checkpoint_materialize)"], ""))
-  } else {
-    match runtime_image_choice_of_wire(word: env_word(name: runtime_image_env)) {
-      Absent => exit_failure(reason: join([runtime_image_env as String, " names the image the Hub CLI runs in, and must be one of ", join(runtime_image_options(), ", ")], ""))
-      Present { value: choice } =>
-        match runtime_image_held_of(c: choice) {
-          Absent => exit_failure(reason: "that image has no recorded production, so no tag and configuration digest exist to run the Hub CLI in; produce it first (mode spark_runtime_image_produce) or name a recorded one")
-          Present { value: held } =>
-            if word == arm_checkpoint_glm53_fp8 {
-              checkpoint_materialize_wet(m: CheckpointMaterialization { title: "glm53 checkpoint materialize" as NonEmptyStr, group: FabricGroupA, checkpoint: Glm53NativeFp8, image: held.subject, seed: glm53_checkpoint_seed_host }, receipt_path: arm_checkpoint_receipt_path)
-            } else if word == arm_checkpoint_glm53_nvfp4 {
-              checkpoint_materialize_wet(m: CheckpointMaterialization { title: "glm53 checkpoint materialize" as NonEmptyStr, group: FabricGroupA, checkpoint: Glm53FlashNvidiaNvfp4, image: held.subject, seed: glm53_checkpoint_seed_host }, receipt_path: arm_checkpoint_receipt_path)
-            } else {
-              exit_failure(reason: join([arm_checkpoint_env as String, "=`", word, "` is not a checkpoint of this arm; the checkpoints are ", join(arm_checkpoint_options(), ", ")], ""))
-            }
-        }
-    }
-  }
-}
-
-// ── THE LOAD ENTRY (mode spark_arm_group_load) ──────────────────────────────────────────────────
-//
-// The GLM staircase step named by the closed inputs, loaded at its floor and its ceiling from its head.
-// SPARK_CONVERGE_TARGET must be that head -- the bench and the scrape address its loopback -- and any
-// other host refuses. Exit zero means every load ran and was judged; the step's verdict and calibration
-// receipt are in the receipt, not the exit. V4.1 loads through its own mode (spark_v41_serving_load),
-// so a V4.1 arm here refuses rather than being routed silently.
-data arm_group_load_receipt_path: String = "target/arm-group-load-receipt.txt"
-
-fn arm_group_load_ci() -> ProcessExit {
-  match arm_group_launch_selection_from_env() {
-    ArmGroupLaunchSelectionRefused { cause: c } => exit_failure(reason: c)
-    ArmGroupLaunchSelected { choice: c } => match c {
-      ArmV41GroupA => exit_failure(reason: "the V4.1 arm loads through its own mode (spark_v41_serving_load), not this one")
-      ArmGlm53GroupAStep { step: s, incumbent: _ } =>
-        match glm53_step_load(s: s) {
-          Glm53StepLoadRefused { cause: why } => exit_failure(reason: why)
-          Glm53StepLoadReady { subject: subject, performance: _, roster: _, inputs: _ } =>
-            match spark_converge_target_selection(execute_apply: true) {
-              SparkConvergeTargetRefused { reason: why } => exit_failure(reason: why)
-              SparkConvergeTargetAllObserveOnly => exit_failure(reason: "SPARK_CONVERGE_TARGET is unset: the load opens its session on the step's head, and it refuses rather than choosing one")
-              SparkConvergeTargetSingle { host: h } =>
-                if (h as String) != (subject.host as String) {
-                  exit_failure(reason: join(["SPARK_CONVERGE_TARGET ", h as String, " is not the step's head ", subject.host as String, "; the bench and the scrape address the head's loopback"], ""))
-                } else {
-                  let run_id = join(["glm53-staircase-load-", probed_at_word(reading: clock_now_probed_at()) as String], "") as NonEmptyStr
-                  match with_spark_build_host(
-                    host: subject.host,
-                    attempt_raw: "arm-group-load",
-                    identity_file_name: "gunbc-arm-group-load-admin-password" as NonEmptyStr,
-                    use: fn(target, context, ctx) { glm53_step_load_session(s: s, run_id: run_id, ctx: ctx) },
-                  ) {
-                    SparkBuildHostRefused { cause: why } => exit_failure(reason: why)
-                    SparkBuildHostRan { work: work, endpoint: _, executor: _, trust_receipt: _ } => {
-                      let w = Filesystem.Write(path: arm_group_load_receipt_path, content: work.receipt)
-                      if !w.success { exit_failure(reason: join(["load receipt write failed: ", w.error, "\n", work.receipt], "")) }
-                      else if work.converged { ExitSuccess }
-                      else { exit_failure(reason: work.receipt) }
-                    }
-                  }
-                }
-            }
-        }
-    }
-  }
-}
-
-// ── THE LAUNCH STEP'S TIMEOUT IS DERIVED, NOT A LITERAL (gunbc.recurring_failure_mode
-// a_step_timeout_shorter_than_the_wait_it_encloses; nvfp4-8, fleet-converge 37190290418) ─────────────
-//
-// The transaction encloses a front-door wait bounded by each arm's own VLLM_ENGINE_READY_TIMEOUT_S, read by
-// the SAME reader the front door uses (gunbc.spark.arm_memory_fit engine_ready_timeout_for over the arm's
-// deployment env) -- one authority. The step must outlast the longest of those plus the transaction's work
-// before the wait (preflight, preserve, head-first apply, container readback) and its rollback after it.
-// Those two budgets are declared, not measured from one run: the apply-to-readback span measured 10-14 min
-// on Group A (launches 37178826027, 37181793223, 37185803198, 37187675945) and a four-host rollback ~15 min.
-// THE BUDGETS ARE DURATIONS (std.measure Second), and so is the derivation: the minute unit appears only
-// at the workflow Step, whose timeout_minutes field is minutes by GitHub's own schema (review 76345).
-data arm_launch_apply_budget: Second = second(count: 1800)
-data arm_launch_rollback_budget: Second = second(count: 1200)
-
-// AN UNREADABLE TIMEOUT REFUSES THE DERIVATION; IT DOES NOT CONTRIBUTE ZERO (review 76374). The
-// derivation is the only check guarding the step's literal timeout, so an arm whose
-// VLLM_ENGINE_READY_TIMEOUT_S cannot be read must make the derivation refuse by name -- a zero would
-// shrink the budget and let the check pass over exactly the arm it cannot account for.
-type ArmLaunchStepNeed
-  = ArmLaunchStepNeedDerived { need: Second }
-  | ArmLaunchStepNeedRefused { causes: List<String> }
-
-// Every arm the step can launch: the GLM staircase's steps and the V4.1 arm.
-fn arm_launch_step_needed() -> ArmLaunchStepNeed {
-  let envs = concat(map(glm53_staircase_steps, s => glm53_step_deployment_env(s: s)), [v41_group_a_deployment_env()])
-  let read = map(envs, e => engine_ready_timeout_for(env: e))
-  let causes = flat_map(read, r => match r {
-    EngineReadyTimeoutResolved { timeout: _ } => [] as List<String>
-    EngineReadyTimeoutUnreadable { cause: c } => [c as String]
-  })
-  if count(causes) > 0 { ArmLaunchStepNeedRefused { causes: causes } }
-  else {
-    let longest = fold(map(read, r => match r { EngineReadyTimeoutResolved { timeout: t } => second_count(s: t)  EngineReadyTimeoutUnreadable { cause: _ } => second_count(s: second(count: 0)) }), init: second_count(s: second(count: 0)), f: fn(a, m) { if m > a { m } else { a } })
-    ArmLaunchStepNeedDerived { need: second(count: longest + second_count(s: arm_launch_apply_budget) + second_count(s: arm_launch_rollback_budget)) }
-  }
-}
-
-// THE STEP'S TIMEOUT IS A LITERAL ONLY BECAUSE THE LANGUAGE CANNOT YET CONSTRUCT A Duration FROM A
-// COMPUTED Int: std.types Duration is `Int where range(min: 0)` and std.coercion's refinement-cast wall
-// refuses an Int-to-refinement cast (no declared conversion route exists), so the derivation above cannot
-// flow into the workflow Step's timeout_minutes field. Until it can, this literal is CHECKED against the
-// derivation -- test.claim.spark.group_arm_launch_witness w_the_launch_step_timeout_covers_every_arms_readiness
-// and drifts loudly. The check compares in seconds: the literal's minutes times sixty against arm_launch_step_needed. NEXT TRIGGER: a declared Int-to-Duration conversion (range-checked, refusing a
-// negative), at which point this row is the derivation itself.
-data arm_launch_step_timeout_minutes: Duration = 110
diff --git a/dag/gunbc/spark/bootstrap_credential.dag b/dag/gunbc/spark/bootstrap_credential.dag
index 69f2a48ccd5..470491bcd6d 100644
--- a/dag/gunbc/spark/bootstrap_credential.dag
+++ b/dag/gunbc/spark/bootstrap_credential.dag
@@ -37,14 +37,6 @@ type BootstrapNetworkIdentity {
   ssid: NonEmptyStr
 }
 
-data spark_bootstrap_ssid_a3ee: BootstrapNetworkIdentity = BootstrapNetworkIdentity {
-  ssid: "spark-a3ee",
-}
-
-data spark_bootstrap_ssid_3bd5: BootstrapNetworkIdentity = BootstrapNetworkIdentity {
-  ssid: "spark-3bd5",
-}
-
 // SECRET NAMES ARE CARRIED, NEVER DERIVED. An earlier revision built both names by
 // concatenating a rendered HostIdentity — spark-<host>-admin-password — which makes the
 // secret namespace a function of how a host happens to be spelled today: rename the slot,
diff --git a/dag/gunbc/spark/bootstrap_provision.dag b/dag/gunbc/spark/bootstrap_provision.dag
index 906175610e8..ab86041b86f 100644
--- a/dag/gunbc/spark/bootstrap_provision.dag
+++ b/dag/gunbc/spark/bootstrap_provision.dag
@@ -67,22 +67,10 @@ type SparkCredentialOccurrence {
   kind: SparkCredentialKind
 }
 
-fn spark_srv5() -> HostIdentity { "srv5" }
-fn spark_srv6() -> HostIdentity { "srv6" }
-
 fn spark_credential_occurrence(host: HostIdentity, kind: SparkCredentialKind) -> SparkCredentialOccurrence {
   SparkCredentialOccurrence { host: host, kind: kind }
 }
 
-fn spark_credential_population() -> List<SparkCredentialOccurrence> {
-  [
-    SparkCredentialOccurrence { host: spark_srv5(), kind: FactoryHotspotCredential },
-    SparkCredentialOccurrence { host: spark_srv5(), kind: AdministratorCredential },
-    SparkCredentialOccurrence { host: spark_srv6(), kind: FactoryHotspotCredential },
-    SparkCredentialOccurrence { host: spark_srv6(), kind: AdministratorCredential }
-  ]
-}
-
 fn spark_occurrence_eq(a: SparkCredentialOccurrence, b: SparkCredentialOccurrence) -> Bool {
   a.host == b.host && spark_credential_kind_eq(a: a.kind, b: b.kind)
 }
@@ -1133,14 +1121,3 @@ fn derive_install_scope(observation: HostPrivilegeObservation) -> ServiceInstall
   }
 }
 
-// The srv5 observation as measured on 2026-08-10 through the read-only canary probe, before any
-// mutation. It is an observation row: a later host with different privilege derives a different
-// scope from the same function, which is the point of deriving rather than declaring.
-fn srv5_privilege_observation() -> HostPrivilegeObservation {
-  HostPrivilegeObservation {
-    host: "srv5" as NonEmptyStr,
-    passwordless_sudo: false,
-    container_socket_admits_principal: false,
-  }
-}
-
diff --git a/dag/gunbc/spark/cell_role.dag b/dag/gunbc/spark/cell_role.dag
index eb0a6cc2dff..504c77a5562 100644
--- a/dag/gunbc/spark/cell_role.dag
+++ b/dag/gunbc/spark/cell_role.dag
@@ -2,7 +2,6 @@ module gunbc.spark.cell_role
 
 import std.types { String, Bool, List, NonEmptyStr }
 import product.host_identity { HostIdentity, host_identity_eq }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6 }
 
 // SPARK-PAIR-0 P0. The single authority for what each DGX Spark unit is FOR. Desired serving hosts
 // and, later, the training offer roster are both projections of this one assignment — neither
@@ -56,54 +55,12 @@ type SparkCellRoleAssignment {
   role: SparkCellRole
 }
 
-// THE ASSIGNMENT IS AN OPERATOR DECISION, RECORDED WITH ITS BASIS.
-//
-// srv5 serves and srv6 trains. The two units are physically identical, so nothing measured decides
-// which is which -- the same situation as the router-slot allocation in gunbc.spark.dgx_procurement,
-// and recorded the same way for the same reason: an arbitrary choice written down as attributable is
-// honest, while the same choice presented as derived reads as a fact somebody established.
-//
-// The basis is that srv5 already carries the live serving occurrence. Assigning serving to the host
-// that already serves makes the serving half of this project a model upgrade on a converged host,
-// and confines the retirement -- the part with no existing vocabulary -- to one machine.
-data spark_cell_role_assignment_basis: NonEmptyStr = "OPERATOR DECISION (SPARK-PAIR-0, 2026-09-02): srv5 and srv6 both serve. This SUPERSEDES the 2026-08-29 decision that assigned srv6 to training; the operator withdrew it as premature -- 'i wouldn't dedicate a whole node for any task - just have it converge and serve whatever task we converge it to' -- and moved training to its own lane. The units are identical, so neither assignment was ever a measurement. Consequence in gunbc.spark.serving_converge_plan: srv6 now receives full serving desired members rather than the baseline-only members a training cell receives." as NonEmptyStr
-
-data srv5_cell_role: SparkCellRoleAssignment = SparkCellRoleAssignment {
-  host: operator_host_srv5,
-  role: SparkServingCell,
-}
-
-data srv6_cell_role: SparkCellRoleAssignment = SparkCellRoleAssignment {
-  host: operator_host_srv6,
-  role: SparkServingCell,
-}
-
-// SPARK-BATCH-3 (operator, 2026-09-05): the goal for every unit is the desired serving state, IN
-// PAIRS, serving DeepSeek V4 Flash. None of the five newer units is assigned a cell role yet, and
-// that is a refusal, not an omission; the serving desired state is still per-host Ollama, which is
-// not the pair deployment the operator wants. Roles land when pair-serving is promoted to desired
-// and pairing is observed from the fabric, so that assigning a role converges a host toward the
-// right thing.
-//
-// ONE OF THE TWO REASONS THIS NOTE GAVE IS DISCHARGED, and it is corrected here rather than left to
-// be read as current (DESIGN section 4c: an annotation that restates a derived fact is the copy that
-// rots). The withdrawn clause said srv7/srv8 hold an undischarged llama.cpp RPC peer reservation
-// whose disjointness wall keeps them off the serving roster until a release receipt exists. Two
-// things in it are false as of 2026-09-05. Only ONE host ever minted such a reservation -- the
-// weights peer, srv8; a reservation is minted from an observed deployment's peer and srv7 was the
-// front door. And release receipts for BOTH hosts were authored that day, so
-// gunbc.spark.llama_cpp_rpc_observed `llama_cpp_rpc_undischarged_peer_reservation_hosts()` is empty
-// and the wall in test.claim.spark.spark_llama_cpp_rpc_witness holds vacuously, which that witness
-// asserts directly rather than leaving to be inferred.
-//
-// WHAT ACTUALLY SPEAKS FOR srv7 AND srv8 TODAY is that they are hosts of the one serving group this
-// repository claims -- cage 1 of gunbc.spark.fabric_switch_observed is srv5, srv6, srv7, srv8, and
-// gunbc.spark.pair_serving_desired claims FabricGroupA. That fact is DERIVED where it is consumed
-// (gunbc.spark.host_commitment), so this note names it rather than restating it, and a reader after
-// the next roster change gets the derivation's answer instead of this paragraph's.
+// THE ASSIGNMENT IS AN OPERATOR DECISION, RECORDED WITH ITS BASIS, AND TODAY THERE IS NONE. The only rows
+// were srv5 (serving) and srv6 (training), and both units were decommissioned and sold with Group A on
+// 2026-10-07; their history is in git and in spark_cell_role_assignment_basis. A new assignment is a new
+// operator decision with its own basis. Which hosts are committed to serving is derived where it is
+// consumed (gunbc.spark.host_commitment), not restated here.
 data spark_cell_role_assignments: List<SparkCellRoleAssignment> = [
-  srv5_cell_role,
-  srv6_cell_role,
 ]
 
 // THE ONE PLACE THE VARIANTS ARE ENUMERATED IS THE WIRE PROJECTION, AND EQUALITY READS IT.
diff --git a/dag/gunbc/spark/credential_workflow.dag b/dag/gunbc/spark/credential_workflow.dag
index ad5eb4b29a7..e6b88bcd446 100644
--- a/dag/gunbc/spark/credential_workflow.dag
+++ b/dag/gunbc/spark/credential_workflow.dag
@@ -2,7 +2,6 @@ module gunbc.spark.credential_workflow
 
 import std.types { String, NonEmptyStr, Secret, List, Bool }
 import product.host_identity { HostIdentity }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
 import std.process { ProcessExit, exit_failure }
 import extdeps.cloud.gcp.secret_ref {
   SecretRef,
@@ -321,15 +320,9 @@ type SparkAdministratorCredentialVersion {
 data spark_administrator_credential_enrolled_version: String = "1"
 
 
+// Empty since 2026-10-10: srv5-srv12 (every Spark) are sold, so no administrator credential is rostered and
+// spark_converge_target_selection resolves no host.
 data spark_administrator_credential_roster: List<SparkAdministratorCredentialVersion> = [
-  SparkAdministratorCredentialVersion { host: operator_host_srv5, version: spark_administrator_credential_enrolled_version },
-  SparkAdministratorCredentialVersion { host: operator_host_srv6, version: spark_administrator_credential_enrolled_version },
-  SparkAdministratorCredentialVersion { host: operator_host_srv7, version: spark_administrator_credential_enrolled_version },
-  SparkAdministratorCredentialVersion { host: operator_host_srv8, version: spark_administrator_credential_enrolled_version },
-  SparkAdministratorCredentialVersion { host: operator_host_srv9, version: spark_administrator_credential_enrolled_version },
-  SparkAdministratorCredentialVersion { host: operator_host_srv10, version: spark_administrator_credential_enrolled_version },
-  SparkAdministratorCredentialVersion { host: operator_host_srv11, version: spark_administrator_credential_enrolled_version },
-  SparkAdministratorCredentialVersion { host: operator_host_srv12, version: spark_administrator_credential_enrolled_version },
 ]
 
 type SparkAdministratorCredentialLookup
diff --git a/dag/gunbc/spark/dgx_procurement.dag b/dag/gunbc/spark/dgx_procurement.dag
index f84cd05039b..a8ccbe50cba 100644
--- a/dag/gunbc/spark/dgx_procurement.dag
+++ b/dag/gunbc/spark/dgx_procurement.dag
@@ -34,7 +34,6 @@ import extdeps.systems.nvidia { nvidia_dgx_spark_4tb_catalog }
 import extdeps.dhcp.v4 { MacAddress, StaticDhcpReservation, Active }
 import extdeps.network.ipv4 { Ipv4Address, ipv4_address }
 import extdeps.router.verizon_cr1000a { Cr1000aDhcpLeaseRow }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
 
 // SPARK-0 (2026-08-05). Three deliberately separate fact classes: (1) the vendor catalog (extdeps.systems.nvidia) -- what NVIDIA documents the product to be; (2) operator procurement intent (this module) -- that two units were ordered and that srv5/srv6 are RESERVED identities for them; (3) deployment observation -- physical binding evidence that must never be fabricated. A reserved identity is explicitly NOT enrollment: srv5/srv6 do not appear in gunbc.fleet_intent_network's endpoint list, gunbc.fleet_intent's ComputeHost list, or any phase matrix/compute offer.
 // SPARK-LANE-A (2026-08-06) moved the identities to gunbc.fleet_intent_network, the single authority for a host's fleet identity (§3 -- SPARK-0 forked them privately here only because that file was mid-refactor at the time).
@@ -46,29 +45,6 @@ type HardwareProcurementIntent {
   ordered_note: NonEmptyStr
 }
 
-// The two static reservations the operator authored on the CR1000A, transcribed from the router table they supplied. These are OBSERVED ROUTER FACTS and nothing more. The reservation labels are vendor-derived from the MAC tail -- they are the units' factory hotspot SSIDs -- which makes them display aliases of the box, NOT fleet identity: a label that the vendor generated cannot decide which fleet subject a machine serves, and reading one as if it could is the same presentation-as-identity error the collector-observation carrier below exists to prevent. So the join to a slot is never inferred from a label: it is the explicit OperatorAllocation recorded below.
-//
-// SPARK-WIFI-0 (2026-08-27). THE BOUND INTERFACE IS NOW THE RADIO, NOT THE RJ-45, and both the MAC and the address moved with it. The operator moved both units onto the LAN's wireless SSID and unplugged both ethernet cables (the motivating constraint: one cable served two boxes, so only one Spark could be on the network at a time -- on wifi both are up simultaneously). A DHCP reservation is keyed on MAC and a radio carries its own, so the ethernet-keyed rows this module used to hold could not follow the units across the medium change; they now name dead ports. The wifi MACs below were read from the hosts themselves rather than off the router table -- `/sys/class/net/wlP9s9/address` cross-checked against `ethtool -P`, which reports the PERMANENT address, so these are the hardware MACs and not a NetworkManager clone (`802-11-wireless.cloned-mac-address` is unset on both and `wifi.scan-rand-mac-address=no` is configured globally). That check is load-bearing rather than ceremonial: a randomized MAC would make the reservation bind to an address that changes under the fleet, which is the failure this row exists to prevent.
-//
-// AND THE PRIOR ROWS WERE NOT STATIC RESERVATIONS AT ALL, which is a correction to this module rather than a refresh of it. When the router table was read on 2026-08-27, the pre-existing 192.168.1.222 / 192.168.1.223 entries showed Lease Type DYNAMIC with a live countdown (86400s term), not Static -- so the addresses this module has asserted since 2026-08-07 as "static reservations the operator authored" were ordinary DHCP leases that happened to keep landing on the same numbers. Nothing was ever pinned. The claim was strictly stronger than the observation behind it, and the derived `dgx_spark_arrival_standing` inherited that overstatement, since it reads each row as "a Static, Active reservation the operator read off the CR1000A". The rows below ARE Static -- the operator authored them on 2026-08-27, and the router now reports Lease Type Static with expiry Never for both -- so the type is honest for the first time here. The general lesson is the one the module already carries about stored-vs-derived flags: this file cannot observe the router, so every row in it is a transcription, and a transcription can silently upgrade a fact's strength unless the source column is transcribed too.
-data spark_a3ee_reservation: Cr1000aDhcpLeaseRow = Cr1000aDhcpLeaseRow {
-  mac_address: "F0:68:E3:B3:1A:40" as MacAddress,
-  ipv4_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 226),
-  lease: StaticDhcpReservation {
-    reservation_label: "spark-a3ee" as NonEmptyStr,
-    status: Active,
-  },
-}
-
-data spark_3bd5_reservation: Cr1000aDhcpLeaseRow = Cr1000aDhcpLeaseRow {
-  mac_address: "F0:68:E3:31:AB:E6" as MacAddress,
-  ipv4_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 225),
-  lease: StaticDhcpReservation {
-    reservation_label: "spark-3bd5" as NonEmptyStr,
-    status: Active,
-  },
-}
-
 // The ethernet MACs the rows above used to carry, kept because they are what the vendor labels are derived from and because the next reader will otherwise re-derive the label/MAC correspondence and conclude the rows are mistyped: spark-a3ee's RJ-45 is 4C:BB:47:E8:A3:EE and spark-3bd5's is 4C:BB:47:E8:3B:D5. THE LABEL NOW NAMES A DIFFERENT INTERFACE THAN THE ROW BINDS, and that is the strongest available statement of the point the paragraph above makes in the abstract: `spark-a3ee` is the tail of an ethernet MAC that no longer appears anywhere in this module's bound facts. A label was never identity; now it is not even a MAC the fleet uses. Both ports read NO-CARRIER as of 2026-08-27 and are expected to stay that way.
 // 🟡 dissolve-on: spark-a3ee RJ-45 4C:BB:47:E8:A3:EE (was 192.168.1.222); spark-3bd5 RJ-45
 // 4C:BB:47:E8:3B:D5 (was 192.168.1.223). Both unplugged 2026-08-27, both carrier=0, neither address
@@ -83,72 +59,7 @@ data spark_3bd5_reservation: Cr1000aDhcpLeaseRow = Cr1000aDhcpLeaseRow {
 // MACs become ordinary retired-attachment rows keyed by (host, interface) rather than a sentence --
 // Phase 0/1 of docs/plans/host-network-attachment-converge-design.md.
 
-// The five newer units, read off the CR1000A table the operator pasted on 2026-09-05: every row is
-// Static and Active, keyed to the unit's wireless MAC exactly as the first pair's rows are.
-data spark_c2b1_reservation: Cr1000aDhcpLeaseRow = Cr1000aDhcpLeaseRow {
-  mac_address: "F0:68:E3:B3:6C:DC" as MacAddress,
-  ipv4_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 232),
-  lease: StaticDhcpReservation {
-    reservation_label: "spark-c2b1" as NonEmptyStr,
-    status: Active,
-  },
-}
-
-data spark_ac79_reservation: Cr1000aDhcpLeaseRow = Cr1000aDhcpLeaseRow {
-  mac_address: "F0:68:E3:B3:1B:56" as MacAddress,
-  ipv4_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 233),
-  lease: StaticDhcpReservation {
-    reservation_label: "spark-ac79" as NonEmptyStr,
-    status: Active,
-  },
-}
-
-data spark_0c75_reservation: Cr1000aDhcpLeaseRow = Cr1000aDhcpLeaseRow {
-  mac_address: "58:02:05:F6:13:26" as MacAddress,
-  ipv4_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 236),
-  lease: StaticDhcpReservation {
-    reservation_label: "spark-0c75" as NonEmptyStr,
-    status: Active,
-  },
-}
-
-data spark_3336_reservation: Cr1000aDhcpLeaseRow = Cr1000aDhcpLeaseRow {
-  mac_address: "F8:3D:C6:B7:1C:94" as MacAddress,
-  ipv4_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 237),
-  lease: StaticDhcpReservation {
-    reservation_label: "spark-3336" as NonEmptyStr,
-    status: Active,
-  },
-}
-
-data spark_b66c_reservation: Cr1000aDhcpLeaseRow = Cr1000aDhcpLeaseRow {
-  mac_address: "F0:68:E3:B3:1F:0C" as MacAddress,
-  ipv4_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 238),
-  lease: StaticDhcpReservation {
-    reservation_label: "spark-b66c" as NonEmptyStr,
-    status: Active,
-  },
-}
-
-data spark_2196_reservation: Cr1000aDhcpLeaseRow = Cr1000aDhcpLeaseRow {
-  mac_address: "F8:3D:C6:6C:FE:98" as MacAddress,
-  ipv4_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 239),
-  lease: StaticDhcpReservation {
-    reservation_label: "spark-2196" as NonEmptyStr,
-    status: Active,
-  },
-}
-
-data observed_dgx_spark_router_reservations: List<Cr1000aDhcpLeaseRow> = [
-  spark_a3ee_reservation,
-  spark_3bd5_reservation,
-  spark_c2b1_reservation,
-  spark_ac79_reservation,
-  spark_0c75_reservation,
-  spark_3336_reservation,
-  spark_b66c_reservation,
-  spark_2196_reservation,
-]
+data observed_dgx_spark_router_reservations: List<Cr1000aDhcpLeaseRow> = []
 
 // SPARK-LANE-A. The router-side half of a slot: a DHCP static reservation is the act that turns "a slot we intend to use" into "an address the fleet can reach", and gunbc.fleet_intent_network's endpoint note recorded that this act had no carrier anywhere in the tree. It has one here. The reservation is NOT re-modeled: it is the cited extdeps.router.verizon_cr1000a Cr1000aDhcpLeaseRow, the same row gunbc.network_identity_subsumption consumes for srv3 -- minting a second mac/address pair beside it would be the §3 nickname failure.
 //
@@ -192,35 +103,6 @@ fn router_binding_identity(binding: DgxSparkRouterBinding) -> HostIdentity {
   }
 }
 
-// SPARK-WIFI-0 (2026-08-27). The basis sentence below is a RECEIPT OF A PAST DECISION and is deliberately left
-// as it was written, including the two addresses that are no longer current. Rewriting it to match today's
-// addresses would be the more tempting edit and the wrong one: it would present the 2026-08-07 decision as
-// though it had been taken on facts that did not exist yet, which is precisely the "attributable rather than
-// looking like a measurement" property the row was created to hold. What the addresses moving DOES cost is the
-// tie-break's descriptive force -- srv5 now holds .226 and srv6 holds .225, so ascending address order would
-// today select the opposite pairing. That does not reopen the decision. The allocation joined srv5 to a BOX
-// (the unit whose vendor label is spark-a3ee), not to a number; the box is unchanged, so the join is unchanged,
-// and the ordering rationale was only ever a coin-flip's justification rather than a rule anything re-evaluates.
-// A reader who finds the basis and the current addresses disagreeing has found exactly what this comment says
-// they will find, which is the difference between a stale row and a dated one.
-data dgx_spark_router_binding_operator_allocation: OperatorAllocation = OperatorAllocation {
-  decided_by: "bold-eagle-107 (operator-delegated: 'the 5, 6 decision is arbitrary - just make it yourself')",
-  decided_on: "2026-08-07",
-  basis: "Ascending address order: srv5 takes spark-a3ee (192.168.1.222) and srv6 takes spark-3bd5 (192.168.1.223). An arbitrary tie-break between two identical units, recorded so the choice is attributable rather than appearing to be a fact someone measured. ADDRESSES SUPERSEDED 2026-08-27 (SPARK-WIFI-0): the units moved to the wireless interface and the reservations re-keyed to the radio MACs, so srv5/spark-a3ee is now 192.168.1.226 and srv6/spark-3bd5 is now 192.168.1.225. The slot-to-box join this row records is unaffected -- it binds an identity to a unit, not to an address -- and the ascending-order phrasing is preserved as written rather than restated against the new addresses, which it no longer describes.",
-}
-
-data srv5_router_binding: DgxSparkRouterBinding = SlotAssigned {
-  identity: operator_host_srv5,
-  reservation: spark_a3ee_reservation,
-  allocation: dgx_spark_router_binding_operator_allocation,
-}
-
-data srv6_router_binding: DgxSparkRouterBinding = SlotAssigned {
-  identity: operator_host_srv6,
-  reservation: spark_3bd5_reservation,
-  allocation: dgx_spark_router_binding_operator_allocation,
-}
-
 // The second and third batches are assigned by the same rule, recorded as the operator's decision on
 // 2026-09-05: srv7/srv8 keep the names SPARK-PAIR-1 gave spark-c2b1/spark-ac79, and srv9..srv11 take
 // spark-0c75, spark-3336, spark-b66c in ascending address order.
@@ -239,68 +121,74 @@ data dgx_spark_router_binding_batch_allocation_2026_09_05_fourth: OperatorAlloca
   basis: "srv12 takes spark-2196 (192.168.1.239, F8:3D:C6:6C:FE:98), the eighth unit, by the same ascending-address rule; it was observed on switch lane qsfp56-dd-2-3 with the other three of group B",
 }
 
-data srv7_router_binding: DgxSparkRouterBinding = SlotAssigned {
-  identity: operator_host_srv7,
-  reservation: spark_c2b1_reservation,
-  allocation: dgx_spark_router_binding_batch_allocation_2026_09_05,
-}
-
-data srv8_router_binding: DgxSparkRouterBinding = SlotAssigned {
-  identity: operator_host_srv8,
-  reservation: spark_ac79_reservation,
-  allocation: dgx_spark_router_binding_batch_allocation_2026_09_05,
-}
-
-data srv9_router_binding: DgxSparkRouterBinding = SlotAssigned {
-  identity: operator_host_srv9,
-  reservation: spark_0c75_reservation,
-  allocation: dgx_spark_router_binding_batch_allocation_2026_09_05,
-}
-
-data srv10_router_binding: DgxSparkRouterBinding = SlotAssigned {
-  identity: operator_host_srv10,
-  reservation: spark_3336_reservation,
-  allocation: dgx_spark_router_binding_batch_allocation_2026_09_05,
-}
-
-data srv11_router_binding: DgxSparkRouterBinding = SlotAssigned {
-  identity: operator_host_srv11,
-  reservation: spark_b66c_reservation,
-  allocation: dgx_spark_router_binding_batch_allocation_2026_09_05,
-}
-
-data srv12_router_binding: DgxSparkRouterBinding = SlotAssigned {
-  identity: operator_host_srv12,
-  reservation: spark_2196_reservation,
-  allocation: dgx_spark_router_binding_batch_allocation_2026_09_05_fourth,
-}
+data dgx_spark_router_bindings: List<DgxSparkRouterBinding> = []
 
-data dgx_spark_router_bindings: List<DgxSparkRouterBinding> = [
-  srv5_router_binding, srv6_router_binding,
-  srv7_router_binding,
-  srv8_router_binding,
-  srv9_router_binding,
-  srv10_router_binding,
-  srv11_router_binding,
-  srv12_router_binding,
+// ── WHAT BECAME OF A PROCURED UNIT: RETAINED, OR DISPOSED BY AN ATTRIBUTABLE DECISION ───────────────────
+//
+// Eight units were procured and all eight arrived. Four are RETAINED: they carry a router binding above,
+// and that binding roster is the only source of the fleet's reserved identities, so a disposed unit
+// cannot enter a fleet roster, a convergence target, a reservation or an admission. The other four --
+// the units of fabric cage 1 -- were SOLD on the operator's decision of 2026-10-07 (relayed by
+// valiant-crab-775), and are kept here as typed rows rather than erased, so the procurement still says
+// what was bought and what became of it. Each row names the unit by the router label it carried and the
+// fleet slot it held; the slot's identity row itself was deleted with every consumer.
+//
+// WHICH PROCUREMENT LOT A SOLD UNIT CAME FROM IS NOT OBSERVED: the inventory's asset labels do not claim
+// host-slot order (gunbc.fleet_physical_inventory), so no serial is joined to these router labels, and
+// recording the sale as an inventory QuantitySold would invent that attribution. The open obligation: join
+// each sold router label to its physical serial and lot, then record the sale against that lot.
+type DgxSparkAssetDisposition
+  = DgxSparkAssetSold { decision: OperatorAllocation }
+
+type DgxSparkDisposedUnit {
+  router_label: NonEmptyStr
+  former_slot: NonEmptyStr
+  disposition: DgxSparkAssetDisposition
+}
+
+data dgx_spark_group_a_sale_2026_10_07: OperatorAllocation = OperatorAllocation {
+  decided_by: "operator (relayed by valiant-crab-775, dashboard messages msg_978d81c1 and msg_5d88338f)",
+  decided_on: "2026-10-07",
+  basis: "Group A (fabric cage 1: srv5-srv8) is turned down and the units are sold and wiped; remove them from fleet config and convergence.",
+}
+
+data dgx_spark_group_b_sale_2026_10_10: OperatorAllocation = OperatorAllocation {
+  decided_by: "operator (confirmed 2026-10-10 to neat-wolf-604 via the closeout dashboard)",
+  decided_on: "2026-10-10",
+  basis: "Group B (srv9-srv12) is sold too: every one of the eight procured units is now sold, and none may remain a reachable fleet host.",
+}
+
+data dgx_spark_disposed_units: List<DgxSparkDisposedUnit> = [
+  DgxSparkDisposedUnit { router_label: "spark-a3ee" as NonEmptyStr, former_slot: "srv5" as NonEmptyStr, disposition: DgxSparkAssetSold { decision: dgx_spark_group_a_sale_2026_10_07 } },
+  DgxSparkDisposedUnit { router_label: "spark-3bd5" as NonEmptyStr, former_slot: "srv6" as NonEmptyStr, disposition: DgxSparkAssetSold { decision: dgx_spark_group_a_sale_2026_10_07 } },
+  DgxSparkDisposedUnit { router_label: "spark-c2b1" as NonEmptyStr, former_slot: "srv7" as NonEmptyStr, disposition: DgxSparkAssetSold { decision: dgx_spark_group_a_sale_2026_10_07 } },
+  DgxSparkDisposedUnit { router_label: "spark-ac79" as NonEmptyStr, former_slot: "srv8" as NonEmptyStr, disposition: DgxSparkAssetSold { decision: dgx_spark_group_a_sale_2026_10_07 } },
+  DgxSparkDisposedUnit { router_label: "spark-0c75" as NonEmptyStr, former_slot: "srv9" as NonEmptyStr, disposition: DgxSparkAssetSold { decision: dgx_spark_group_b_sale_2026_10_10 } },
+  DgxSparkDisposedUnit { router_label: "spark-3336" as NonEmptyStr, former_slot: "srv10" as NonEmptyStr, disposition: DgxSparkAssetSold { decision: dgx_spark_group_b_sale_2026_10_10 } },
+  DgxSparkDisposedUnit { router_label: "spark-b66c" as NonEmptyStr, former_slot: "srv11" as NonEmptyStr, disposition: DgxSparkAssetSold { decision: dgx_spark_group_b_sale_2026_10_10 } },
+  DgxSparkDisposedUnit { router_label: "spark-2196" as NonEmptyStr, former_slot: "srv12" as NonEmptyStr, disposition: DgxSparkAssetSold { decision: dgx_spark_group_b_sale_2026_10_10 } },
 ]
 
-// Arrival is DERIVED from the observed router rows, never stored beside them: a stored "arrived"
-// flag is a second representation of what the reservation roster already says, and it is the copy
-// that goes stale -- which is exactly how this module came to claim the units had not arrived while
-// they were sitting on the LAN. Each row is a Static, Active reservation the operator read off the
-// CR1000A, which is presence evidence; the count against unit_count is the standing.
+// Arrival is DERIVED, never stored beside its evidence: a stored "arrived" flag is a second
+// representation that goes stale -- which is exactly how this module once claimed the units had not
+// arrived while they were sitting on the LAN. A retained unit's evidence is its Static, Active
+// reservation read off the CR1000A; a disposed unit arrived and was later sold, and its row is that
+// evidence. Every procured unit is one or the other, so the count against unit_count is the standing.
 type DgxSparkArrivalStanding
-  = AllOrderedUnitsObservedOnLan { observed_count: Int }
+  = AllOrderedUnitsAccounted { on_lan: Int, disposed: Int }
   | OrderedUnitsOutstanding { ordered_count: Int, observed_count: Int }
 
+fn dgx_spark_accounted_unit_count() -> Int {
+  count(observed_dgx_spark_router_reservations) + count(dgx_spark_disposed_units)
+}
+
 fn dgx_spark_arrival_standing() -> DgxSparkArrivalStanding {
-  if count(observed_dgx_spark_router_reservations) == dgx_spark_procurement_intent.unit_count {
-    AllOrderedUnitsObservedOnLan { observed_count: count(observed_dgx_spark_router_reservations) }
+  if dgx_spark_accounted_unit_count() == dgx_spark_procurement_intent.unit_count {
+    AllOrderedUnitsAccounted { on_lan: count(observed_dgx_spark_router_reservations), disposed: count(dgx_spark_disposed_units) }
   } else {
     OrderedUnitsOutstanding {
       ordered_count: dgx_spark_procurement_intent.unit_count,
-      observed_count: count(observed_dgx_spark_router_reservations),
+      observed_count: dgx_spark_accounted_unit_count(),
     }
   }
 }
@@ -314,7 +202,7 @@ data dgx_spark_procurement_intent: HardwareProcurementIntent = HardwareProcureme
   vendor_catalog: nvidia_dgx_spark_4tb_catalog,
   unit_count: 8,
   reserved_identities: dgx_spark_reserved_identities(),
-  ordered_note: "8x NVIDIA DGX Spark across four batches (2 + 2 + 3 + 1), all live on the operator LAN as of 2026-09-05; the eighth (spark-2196) appeared the day the fabric switch was cabled. FIRST BATCH: 2x ordered. Both units arrived and are live on the operator LAN, each holding a Static, Active CR1000A reservation keyed to its WIRELESS interface (spark-a3ee 192.168.1.226 F0:68:E3:B3:1A:40 and spark-3bd5 192.168.1.225 F0:68:E3:31:AB:E6; both MACs read from the hosts as permanent hardware addresses, both ethernet ports unplugged and dark since 2026-08-27). Arrival is derived by dgx_spark_arrival_standing from those observed rows. srv5/srv6 slot assignment is recorded by dgx_spark_router_binding_operator_allocation, not inferred from router labels -- and note the labels are ethernet-MAC-derived, so they no longer share a tail with the MAC the row binds.",
+  ordered_note: "8x NVIDIA DGX Spark ordered across four batches (2 + 2 + 3 + 1); all eight arrived and were live on the operator LAN by 2026-09-05. All eight were sold: the four of Group B (spark-0c75 srv9, spark-3336 srv10, spark-b66c srv11, spark-2196 srv12) on 2026-10-10 and the four of fabric cage 1 (spark-a3ee srv5, spark-3bd5 srv6, spark-c2b1 srv7, spark-ac79 srv8) on 2026-10-07, each by operator decision, and are typed in dgx_spark_disposed_units. Arrival is derived by dgx_spark_arrival_standing from the disposed rows.",
 }
 
 type DgxSparkDeployment {
diff --git a/dag/gunbc/spark/fabric_serving_assignment.dag b/dag/gunbc/spark/fabric_serving_assignment.dag
index 3e6f67fdca2..985de61b6e3 100644
--- a/dag/gunbc/spark/fabric_serving_assignment.dag
+++ b/dag/gunbc/spark/fabric_serving_assignment.dag
@@ -52,21 +52,12 @@ type FabricServingAssignment sole_constructor {
 // yet, so every Group B launch refuses by name until one is recorded inside the tag; that refusal is
 // the correct state, and the one that stops a silent downgrade.
 data glm_group_b_serving_assignment: FabricServingAssignment = FabricServingAssignment {
-  group: FabricGroupB,
+  group: FabricGroupB {},
   checkpoint: Glm53NativeFp8,
   runtime: GunbcGlm53DerivedKvplanV2Gb10,
   topology: FourSparkTp4,
 }
 
-// A LAUNCH'S ASSIGNMENT THAT IS NOT A GROUP'S CONVERGED ONE (deforking cut 8a). The row above is what
-// clients are routed to; gunbc.spark.group_arm_launch takes the same tuple as the input of ANY arm it
-// plans -- V4.1 on Group A, whose runtime is the held image read at run time, and the GLM staircase's
-// bounded experiments -- and none of those is what enrollment reads. The tuple keeps its one home here,
-// and this mint is the only way to make one beside the row; it adds no client-facing assignment.
-fn fabric_serving_assignment_for_launch(group: FabricGroup, checkpoint: ServingCheckpoint, runtime: ServingRuntime, topology: ServingTopology) -> FabricServingAssignment {
-  FabricServingAssignment { group: group, checkpoint: checkpoint, runtime: runtime, topology: topology }
-}
-
 type FabricServingHead
   = FabricServingHeadResolved { host: HostIdentity }
   | FabricServingHeadRefused { cause: NonEmptyStr }
diff --git a/dag/gunbc/spark/fabric_switch_observed.dag b/dag/gunbc/spark/fabric_switch_observed.dag
index c49409f8c40..ee9a38010ed 100644
--- a/dag/gunbc/spark/fabric_switch_observed.dag
+++ b/dag/gunbc/spark/fabric_switch_observed.dag
@@ -17,7 +17,7 @@ import product.cable_plant_assessment {
   CablePlant, cable_plant, CableLegReading, LegReadingTaken, LegNeverRead, CablePlantInspection,
   inspect_cable_plant,
 }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
+import gunbc.fleet_host_identity { operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
 
 // THE SWITCHED FABRIC AS OBSERVED FROM BOTH ENDS ON 2026-09-05. Every Spark carries ONE leg of an FS
 // QDD-400G-4QPC015 breakout in its bottom cage; the switch's LLDP neighbour table names each Spark
@@ -249,10 +249,6 @@ data spark_fabric_leg_netdev: NonEmptyStr = "enp1s0f1np1" as NonEmptyStr
 data spark_fabric_leg_netdev_twin: NonEmptyStr = "enP2p1s0f1np1" as NonEmptyStr
 
 data fabric_lane_observations: List<FabricLaneObserved> = [
-  FabricLaneObserved { cage: 1, lane: 1, host: operator_host_srv5, spark_hostname: "spark-a3ee" as NonEmptyStr, leg_netdev: spark_fabric_leg_netdev, leg_netdev_twin: spark_fabric_leg_netdev_twin, leg_rdma_device: "rocep1s0f1" as NonEmptyStr },
-  FabricLaneObserved { cage: 1, lane: 3, host: operator_host_srv8, spark_hostname: "spark-ac79" as NonEmptyStr, leg_netdev: spark_fabric_leg_netdev, leg_netdev_twin: spark_fabric_leg_netdev_twin, leg_rdma_device: "rocep1s0f1" as NonEmptyStr },
-  FabricLaneObserved { cage: 1, lane: 5, host: operator_host_srv7, spark_hostname: "spark-c2b1" as NonEmptyStr, leg_netdev: spark_fabric_leg_netdev, leg_netdev_twin: spark_fabric_leg_netdev_twin, leg_rdma_device: "rocep1s0f1" as NonEmptyStr },
-  FabricLaneObserved { cage: 1, lane: 7, host: operator_host_srv6, spark_hostname: "spark-3bd5" as NonEmptyStr, leg_netdev: spark_fabric_leg_netdev, leg_netdev_twin: spark_fabric_leg_netdev_twin, leg_rdma_device: "rocep1s0f1" as NonEmptyStr },
   FabricLaneObserved { cage: 2, lane: 1, host: operator_host_srv10, spark_hostname: "spark-3336" as NonEmptyStr, leg_netdev: spark_fabric_leg_netdev, leg_netdev_twin: spark_fabric_leg_netdev_twin, leg_rdma_device: "rocep1s0f1" as NonEmptyStr },
   FabricLaneObserved { cage: 2, lane: 3, host: operator_host_srv12, spark_hostname: "spark-2196" as NonEmptyStr, leg_netdev: spark_fabric_leg_netdev, leg_netdev_twin: spark_fabric_leg_netdev_twin, leg_rdma_device: "rocep1s0f1" as NonEmptyStr },
   FabricLaneObserved { cage: 2, lane: 5, host: operator_host_srv9, spark_hostname: "spark-0c75" as NonEmptyStr, leg_netdev: spark_fabric_leg_netdev, leg_netdev_twin: spark_fabric_leg_netdev_twin, leg_rdma_device: "rocep1s0f1" as NonEmptyStr },
@@ -268,27 +264,27 @@ fn fabric_lane_for_host(host: HostIdentity) -> FabricLaneObserved? {
 }
 
 // A GROUP IS THE SET OF HOSTS ON ONE 400G CAGE: four legs of one breakout share the cage, so the
-// four hosts are one fabric-natural tensor-parallel group. Group A is cage 1, group B is cage 2.
-type FabricGroup = FabricGroupA | FabricGroupB
+// four hosts are one fabric-natural tensor-parallel group. Group B is cage 2. Group A (cage 1: srv5-srv8)
+// was decommissioned on 2026-10-07 -- the units were sold -- so cage 1 carries no lane and no group.
+type FabricGroupB {}
+
+type FabricGroup = FabricGroupB
 
 fn fabric_group_cage(g: FabricGroup) -> Nat {
   match g {
-    FabricGroupA => 1
-    FabricGroupB => 2
+    FabricGroupB {} => 2
   }
 }
 
 fn fabric_group_wire(g: FabricGroup) -> NonEmptyStr {
   match g {
-    FabricGroupA => "group-a" as NonEmptyStr
-    FabricGroupB => "group-b" as NonEmptyStr
+    FabricGroupB {} => "group-b" as NonEmptyStr
   }
 }
 
 // The exact inverse of fabric_group_wire; a word naming no group is no group.
 fn parse_fabric_group(wire: String) -> FabricGroup? {
-  if wire == "group-a" { Present { value: FabricGroupA } }
-  else if wire == "group-b" { Present { value: FabricGroupB } }
+  if wire == "group-b" { Present { value: FabricGroupB {} } }
   else { none }
 }
 
@@ -299,7 +295,7 @@ fn fabric_group_hosts(g: FabricGroup) -> List<HostIdentity> {
 fn fabric_group_of_host(host: HostIdentity) -> FabricGroup? {
   match fabric_lane_for_host(host: host) {
     Absent => none
-    Present { value: o } => if o.cage == 1 { Present { value: FabricGroupA } } else { Present { value: FabricGroupB } }
+    Present { value: o } => if o.cage == fabric_group_cage(g: FabricGroupB {}) { Present { value: FabricGroupB {} } } else { none }
   }
 }
 
diff --git a/dag/gunbc/spark/first_party_serving.dag b/dag/gunbc/spark/first_party_serving.dag
index 75a3e3ca440..098afbc0e6d 100644
--- a/dag/gunbc/spark/first_party_serving.dag
+++ b/dag/gunbc/spark/first_party_serving.dag
@@ -35,7 +35,7 @@ import gunbc.spark.vllm_serving_launch {
 }
 import v2.std.algebra { list_tail, TailFound, TailAbsent }
 import gunbc.fleet_physical_inventory { operator_site }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
+import gunbc.fleet_host_identity { operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
 
 // ── WHY A SERVING ROUTE EXISTS AT ALL NOW, AND WHAT KIND OF FACT IT RESTS ON ──────────────────
 //
@@ -91,7 +91,6 @@ type SparkFleetSiteAllocation {
 data spark_fleet_site_allocation: SparkFleetSiteAllocation = SparkFleetSiteAllocation {
   site: operator_site,
   units: [
-    operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8,
     operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12,
   ],
   allocation: OperatorAllocation {
diff --git a/dag/gunbc/spark/glm53_arm_staircase.dag b/dag/gunbc/spark/glm53_arm_staircase.dag
deleted file mode 100644
index 56569bc9115..00000000000
--- a/dag/gunbc/spark/glm53_arm_staircase.dag
+++ /dev/null
@@ -1,386 +0,0 @@
-module gunbc.spark.glm53_arm_staircase
-
-import std.types { String, List, NonEmptyStr }
-import std.nat { Nat }
-import std.measure { token_count, basis_point }
-import std.optional { Present, Absent }
-import gunbc.spark.vllm_runtime_image_build { SparkBuildHostWork }
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext }
-import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext }
-import extdeps.vllm.engine_args { VllmSchedulerAdmissionRequest, FullInputAdmissionExplicit, KvWatermarkExplicit, VllmPrefixCachingRequest, PrefixCachingExplicit }
-import product.host_identity { HostIdentity }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
-import gunbc.spark.fabric_serving_assignment { FabricServingAssignment, fabric_serving_assignment_for_launch }
-import gunbc.spark.serving_arm { ArmIntent, ArmBoundedExperiment, ServingLaunchProfile, ModelLaunchPolicy, ServingCheckpoint, Glm53NativeFp8, Glm53FlashNvidiaNvfp4, GunbcGlm53KvplanV2GroupAProduced, FourSparkTp4, glm53_native_launch_policy, glm53_flash_nvidia_nvfp4_launch_policy }
-import gunbc.spark.serving_capacity_intent { ServingCapacityIntent, ServingCapacityIntentAdmitted, ServingCapacityIntentRefused, uniform_cold_seats, SchedulerEnvelope, SchedulerEnvelopeAdmitted, SchedulerEnvelopeRefused, scheduler_envelope, profile_for_envelope }
-import gunbc.spark.serving_arm_launch { ArmContainerIdentity, glm_native_shm_size, glm53_staircase_container_name, glm53_staircase_head_log_path }
-import gunbc.spark.native_serving_realization { ArmUnitIdentity }
-import gunbc.spark.pair_serving_realization { spark_pair_serve_port }
-import gunbc.spark.glm_group_b_launch { glm_group_b_deployment_env }
-import extdeps.vllm.environment { vllm_environment_variable_name, VllmFlashinferAutotuneSkipOps }
-import extdeps.docker.cli { DockerEnvAssignment }
-import gunbc.spark.group_b_serving_capacity { group_b_restoration_utilization, group_b_restoration_window_tokens, group_b_restoration_max_batched_tokens, group_b_experiment_subject_seats }
-import gunbc.spark.group_arm_launch { GroupArmLaunchInputs, GroupArmLaunchPlan, GroupArmLaunchAdmission, GroupArmLaunchAdmittedForAdoptionOnly, group_arm_adopt_dangling, GroupArmLaunchAdmitted, GroupArmLaunchAdmissionRefused, group_arm_plan_hosts, ArmDeclaredIncumbent, NoIncumbentDeclared, IncumbentDeclared, ArmIncumbentUnit, group_arm_launch_plan, group_arm_row_successor, arm_successor_wire, group_arm_launch_admission_live, group_arm_dry_run_occupancy, group_arm_dry_run_report, ArmDryPlan, ArmWetSession, ArmPreApplyPassed, group_arm_read_occupancy, group_arm_memory_need, group_arm_apply_admitted }
-
-// ── THE GLM-5.3-FLASH STAIRCASE ON GROUP A: THE ARM'S INPUTS, AND NOTHING ELSE ─────────────────
-//
-// WHAT THIS MODULE IS. One caller of gunbc.spark.group_arm_launch -- the deployment-independent launch
-// transaction -- supplying what is GLM's and Group A's: the checkpoint per staircase, the cold floor, the
-// ceiling per step, the scheduler gate above the floor, the unit and container names, and the declared
-// incumbent. It plans, renders and admits nothing itself. Operator-approved program, 2026-10-02 (relayed
-// by snappy-bat-66; ruled by valiant-crab-775, deforking cut 8): Group A is a dev environment, every
-// step is a bounded experiment, and nothing here promotes.
-
-// ── THE STEPS ARE A CLOSED SET PER CHECKPOINT (ruling of valiant-crab-775, 2026-10-02) ────────────
-//
-// A step outside these has no spelling: the workflow input selecting a step is a closed choice over
-// these variants, never a number typed at dispatch. Each step's ceiling is its own row below, and each
-// derives its envelope through serving_capacity_intent scheduler_envelope -- so a ceiling above the cold
-// floor exists only with the full-input gate on and the watermark stated, and one below it refuses.
-// THE CEILING SWEEP (valiant-crab-775, approved 2026-10-04): 32, 64 and 128 are the same launch with a
-// higher scheduler ceiling over the same cold floor and the same gpu_memory_utilization; their receipts
-// are ENGINE CHARACTERIZATION, NON-QUALIFYING -- they measure what the ceiling costs (KV blocks, capture
-// sizes, time to ready) and whether it launches at all, and nothing promotes from them.
-type Glm53Fp8StaircaseStep = Fp8Seats8 | Fp8Seats12 | Fp8Seats16 | Fp8Seats24 | Fp8Seats32 | Fp8Seats64 | Fp8Seats128
-type Glm53Nvfp4StaircaseStep = Nvfp4Seats8 | Nvfp4Seats16 | Nvfp4Seats24 | Nvfp4Seats32
-
-type Glm53StaircaseStep
-  = Glm53Fp8Step { step: Glm53Fp8StaircaseStep }
-  | Glm53Nvfp4Step { step: Glm53Nvfp4StaircaseStep }
-
-fn glm53_fp8_step_ceiling(s: Glm53Fp8StaircaseStep) -> Nat {
-  match s {
-    Fp8Seats8 => 8
-    Fp8Seats12 => 12
-    Fp8Seats16 => 16
-    Fp8Seats24 => 24
-    Fp8Seats32 => 32
-    Fp8Seats64 => 64
-    Fp8Seats128 => 128
-  }
-}
-
-fn glm53_nvfp4_step_ceiling(s: Glm53Nvfp4StaircaseStep) -> Nat {
-  match s {
-    Nvfp4Seats8 => 8
-    Nvfp4Seats16 => 16
-    Nvfp4Seats24 => 24
-    Nvfp4Seats32 => 32
-  }
-}
-
-fn glm53_step_ceiling(s: Glm53StaircaseStep) -> Nat {
-  match s {
-    Glm53Fp8Step { step: f } => glm53_fp8_step_ceiling(s: f)
-    Glm53Nvfp4Step { step: n } => glm53_nvfp4_step_ceiling(s: n)
-  }
-}
-
-fn glm53_step_checkpoint(s: Glm53StaircaseStep) -> ServingCheckpoint {
-  match s {
-    Glm53Fp8Step { step: _ } => Glm53NativeFp8
-    Glm53Nvfp4Step { step: _ } => Glm53FlashNvidiaNvfp4
-  }
-}
-
-fn glm53_step_policy(s: Glm53StaircaseStep) -> ModelLaunchPolicy {
-  match s {
-    Glm53Fp8Step { step: _ } => glm53_native_launch_policy
-    Glm53Nvfp4Step { step: _ } => glm53_flash_nvidia_nvfp4_launch_policy
-  }
-}
-
-// THE WIRE IS THE WORKFLOW INPUT'S VOCABULARY, one word per variant, and the parse below is its exact
-// inverse: an unknown word is no step.
-fn glm53_step_wire(s: Glm53StaircaseStep) -> NonEmptyStr {
-  match s {
-    Glm53Fp8Step { step: Fp8Seats8 } => "fp8-8" as NonEmptyStr
-    Glm53Fp8Step { step: Fp8Seats12 } => "fp8-12" as NonEmptyStr
-    Glm53Fp8Step { step: Fp8Seats16 } => "fp8-16" as NonEmptyStr
-    Glm53Fp8Step { step: Fp8Seats24 } => "fp8-24" as NonEmptyStr
-    Glm53Fp8Step { step: Fp8Seats32 } => "fp8-32" as NonEmptyStr
-    Glm53Fp8Step { step: Fp8Seats64 } => "fp8-64" as NonEmptyStr
-    Glm53Fp8Step { step: Fp8Seats128 } => "fp8-128" as NonEmptyStr
-    Glm53Nvfp4Step { step: Nvfp4Seats8 } => "nvfp4-8" as NonEmptyStr
-    Glm53Nvfp4Step { step: Nvfp4Seats16 } => "nvfp4-16" as NonEmptyStr
-    Glm53Nvfp4Step { step: Nvfp4Seats24 } => "nvfp4-24" as NonEmptyStr
-    Glm53Nvfp4Step { step: Nvfp4Seats32 } => "nvfp4-32" as NonEmptyStr
-  }
-}
-
-data glm53_staircase_steps: List<Glm53StaircaseStep> = [
-  Glm53Fp8Step { step: Fp8Seats8 }, Glm53Fp8Step { step: Fp8Seats12 }, Glm53Fp8Step { step: Fp8Seats16 }, Glm53Fp8Step { step: Fp8Seats24 },
-  Glm53Fp8Step { step: Fp8Seats32 }, Glm53Fp8Step { step: Fp8Seats64 }, Glm53Fp8Step { step: Fp8Seats128 },
-  Glm53Nvfp4Step { step: Nvfp4Seats8 }, Glm53Nvfp4Step { step: Nvfp4Seats16 }, Glm53Nvfp4Step { step: Nvfp4Seats24 }, Glm53Nvfp4Step { step: Nvfp4Seats32 },
-]
-
-fn glm53_step_of_wire(word: String) -> Glm53StaircaseStep? {
-  first(filter(glm53_staircase_steps, s => (glm53_step_wire(s: s) as String) == word))
-}
-
-// ── THE COLD GUARANTEE IS THE SAME AT EVERY STEP: 8 x 262144 ──────────────────────────────────
-//
-// THE FLOOR IS THE GLM ARM'S COLD SERVICE, IMPORTED, NOT RESTATED: its window, its eight cold seats and
-// the batched ceiling it runs them under on GB10s are gunbc.spark.group_b_serving_capacity's rows
-// (group_b_restoration_window_tokens, group_b_experiment_subject_seats,
-// group_b_restoration_max_batched_tokens), so the floor cannot drift from the service it guarantees
-// (review 74379). The staircase moves the CEILING, not the prefill shape, so a step's receipt differs from the
-// last in one axis.
-
-fn glm53_staircase_cold_intent() -> ServingCapacityIntent? {
-  match uniform_cold_seats(each: token_count(count: group_b_restoration_window_tokens), seats: group_b_experiment_subject_seats, max_batched_tokens: token_count(count: group_b_restoration_max_batched_tokens)) {
-    ServingCapacityIntentRefused { cause: _ } => none
-    ServingCapacityIntentAdmitted { intent: i } => Present { value: i }
-  }
-}
-
-// THE GATE ABOVE THE FLOOR IS STATED AT EVERY STEP, the floor step included, so the eight-seat step is
-// the same engine configuration as the others less the ceiling, and a difference between two steps'
-// receipts is the ceiling's. The full-input gate is ON: a best-effort seat is admitted only when the
-// allocator finds its whole current sequence fits. The watermark is ZERO, stated: preemption is the
-// admitted overflow behaviour for the seats above the floor (operator ruling 2026-10-02 relayed in
-// gunbc.spark.serving_capacity_intent), so nothing is held back against it, and a declared zero is a
-// value someone chose where an inherited default would be one nobody did.
-data glm53_staircase_scheduler_admission: VllmSchedulerAdmissionRequest = VllmSchedulerAdmissionRequest {
-  full_input_admission: FullInputAdmissionExplicit { enabled: true },
-  kv_watermark: KvWatermarkExplicit { fraction: basis_point(count: 0) },
-}
-
-type Glm53StepEnvelope
-  = Glm53StepEnvelopeAdmitted { envelope: SchedulerEnvelope }
-  | Glm53StepEnvelopeRefused { cause: String }
-
-fn glm53_step_envelope(s: Glm53StaircaseStep) -> Glm53StepEnvelope {
-  match glm53_staircase_cold_intent() {
-    Absent => Glm53StepEnvelopeRefused { cause: "the staircase's cold intent (8 x 262144) refused, so no step has a floor" }
-    Present { value: cold } =>
-      match scheduler_envelope(cold: cold, hard_max_num_seqs: glm53_step_ceiling(s: s), admission: glm53_staircase_scheduler_admission) {
-        SchedulerEnvelopeRefused { cause: c } => Glm53StepEnvelopeRefused { cause: c as String }
-        SchedulerEnvelopeAdmitted { envelope: e } => Glm53StepEnvelopeAdmitted { envelope: e }
-      }
-  }
-}
-
-// THE ROUTE'S PORT AND NAME ARE GROUP A'S ROUTE (gunbc.spark.pair_serving_realization
-// spark_pair_serve_port, which gunbc.serving.serving_enrollment reads for Group A), so a step serves
-// where Group A's clients already ask. The memory fraction is the GLM arm's decided figure on a GB10
-// (gunbc.spark.group_b_serving_capacity group_b_restoration_utilization) -- the same hardware and
-// engine, read rather than re-decided; the memory wall prices it per step. Prefix caching is on, as
-// the GLM arm serves.
-data glm53_staircase_served_alias: NonEmptyStr = "glm-5.3-flash" as NonEmptyStr
-data glm53_staircase_prefix_caching: VllmPrefixCachingRequest = PrefixCachingExplicit { enabled: true }
-
-fn glm53_step_profile(s: Glm53StaircaseStep) -> ServingLaunchProfile? {
-  match glm53_step_envelope(s: s) {
-    Glm53StepEnvelopeRefused { cause: _ } => none
-    Glm53StepEnvelopeAdmitted { envelope: e } => Present { value: profile_for_envelope(
-      envelope: e,
-      policy: glm53_step_policy(s: s),
-      decided_gpu_memory_basis_points: group_b_restoration_utilization,
-      serve_port: spark_pair_serve_port,
-      served_alias: glm53_staircase_served_alias,
-      prefix_caching: glm53_staircase_prefix_caching,
-    ) }
-  }
-}
-
-// ── WHAT THIS DEPLOYMENT IS CALLED, DISTINCT FROM EVERY OTHER ────────────────────────────────
-//
-// Host occupancy is read by unit and container name, so the staircase's names are its own: a Group A
-// host still running the pair, V4.1, or Group B's glm-native names reads as occupied by THAT, never as
-// this arm already installed. The rendezvous port is the next after V4.1's 29500 and glm-native's
-// 29501, so no two arms' rendezvous share one. The shared-memory size and the vLLM environment are the
-// GLM arm's own on a GB10 (gunbc.serving_arm_launch glm_native_shm_size; gunbc.spark.glm_group_b_launch
-// glm_group_b_deployment_env, the engine-ready timeout and the sparse-indexer logits guard every GLM
-// launch on this hardware reads).
-data glm53_staircase_units: ArmUnitIdentity = ArmUnitIdentity {
-  head_unit_name: "gunbc-glm53-stair-head.service" as NonEmptyStr,
-  rank_unit_name: "gunbc-glm53-stair-rank.service" as NonEmptyStr,
-  head_log_path: glm53_staircase_head_log_path,
-  rank_log_path: "/var/log/gunbc/glm53-stair-rank.log" as NonEmptyStr,
-  description: "gunbc GLM-5.3-Flash Group A staircase arm" as NonEmptyStr,
-}
-
-data glm53_staircase_container: ArmContainerIdentity = ArmContainerIdentity {
-  container_name: glm53_staircase_container_name,
-  master_port: 29502,
-  shm_size: glm_native_shm_size,
-  extra_mounts: [],
-}
-
-// EVERY STEP IS A BOUNDED EXPERIMENT: the units render with one attempt and RuntimeMaxSec, and the memory
-// wall admits an unproved fit only under this intent.
-data glm53_staircase_intent: ArmIntent = ArmBoundedExperiment
-
-// THE RUNTIME IS THE SAME KVPLAN-V2 BUILD THE GLM ARM RUNS ON GROUP B, PRODUCED ONCE FOR GROUP A
-// (gunbc.spark.serving_arm glm53_kvplan_v2_group_a_row): one content id, moved by digest, so the step has
-// a keyed successor. Group B's per-host row is a different artifact, and a receipt here does not promote it.
-fn glm53_step_assignment(s: Glm53StaircaseStep) -> FabricServingAssignment {
-  fabric_serving_assignment_for_launch(group: FabricGroupA, checkpoint: glm53_step_checkpoint(s: s), runtime: GunbcGlm53KvplanV2GroupAProduced, topology: FourSparkTp4)
-}
-
-// THE NVFP4 STEPS DECLARE ONE MORE VARIABLE THAN THE FP8 STEPS, and it is a fact of that arm, not a
-// tuning preference: VLLM_FLASHINFER_AUTOTUNE_SKIP_OPS for the two trtllm fused_moe gemms. Without it the
-// pinned runtime's leader-only sparse-MLA pre-tune seeds rank 0 with rank-keyed fused_moe tactics and the
-// synchronized autotune deadlocks the other ranks (nvfp4-8, fleet-converge 37190290418: workers blocked
-// 30 minutes, tuned alone 26, the head's barrier closed; extdeps.vllm.environment cites the source). COST,
-// carried into every NVFP4 receipt: rank 0 runs its sparse-MLA-tuned fused_moe tactics while ranks 1-3 run
-// the heuristic tactic -- the ranks are not kernel-identical and NVFP4 throughput is a LOWER BOUND.
-// Operator-approved via valiant-crab-775, 2026-10-04, as the diagnostic configuration; not yet the standing one.
-data glm53_nvfp4_autotune_skip_ops: List<String> = ["trtllm::fused_moe::gemm1", "trtllm::fused_moe::gemm2"]
-
-fn glm53_step_deployment_env(s: Glm53StaircaseStep) -> List<DockerEnvAssignment> {
-  match s {
-    Glm53Fp8Step { step: _ } => glm_group_b_deployment_env()
-    Glm53Nvfp4Step { step: _ } => concat(glm_group_b_deployment_env(), [DockerEnvAssignment {
-      name: vllm_environment_variable_name(v: VllmFlashinferAutotuneSkipOps),
-      value: join(glm53_nvfp4_autotune_skip_ops, ","),
-    }])
-  }
-}
-
-fn glm53_step_inputs(s: Glm53StaircaseStep) -> GroupArmLaunchInputs? {
-  match glm53_step_profile(s: s) {
-    Absent => none
-    Present { value: p } => Present { value: GroupArmLaunchInputs {
-      assignment: glm53_step_assignment(s: s),
-      profile: p,
-      intent: glm53_staircase_intent,
-      deployment_env: glm53_step_deployment_env(s: s),
-      container: glm53_staircase_container,
-      units: glm53_staircase_units,
-      purpose: join(["the GLM-5.3-Flash Group A staircase step ", glm53_step_wire(s: s) as String], "") as NonEmptyStr,
-    } }
-  }
-}
-
-// ── THE DECLARED INCUMBENT, PER STEP ──────────────────────────────────────────────────────────
-//
-// STEP N > 1 SUPERSEDES STEP N - 1, WHICH IS THIS ARM'S OWN TWO UNITS ON GROUP A's FOUR HOSTS
-// (approved by valiant-crab-775, 2026-10-02). THE FIRST STEP SUPERSEDES NOTHING, AND THAT IS A READING,
-// NOT AN ASSUMPTION: the serve snappy-bat-66 handed over on .225 could not be described by its launcher
-// (archived), so Group A's occupancy was read instead -- fleet-converge run 37087495838 (mode
-// spark_arm_group_observe, 2026-10-03) found no running container and no GPU compute process on any of
-// srv5, srv6, srv7 or srv8, and no serving unit beyond the system's own. There is nothing to declare.
-// If a serve appears before the first step runs, it is an undeclared occupant and the admission
-// refuses on it, exactly as for any other.
-type Glm53StepIncumbent
-  = Glm53IncumbentResolved { incumbent: ArmDeclaredIncumbent }
-
-type Glm53IncumbentChoice = SupersedePreviousStep | SupersedeNothing
-
-fn glm53_previous_step_incumbent(lines_hosts: List<HostIdentity>) -> ArmDeclaredIncumbent {
-  IncumbentDeclared {
-    units: concat(
-      map(filter(enumerate(lines_hosts), p => p.first == 0), p => ArmIncumbentUnit { host: p.second, unit_name: glm53_staircase_units.head_unit_name }),
-      map(filter(enumerate(lines_hosts), p => p.first != 0), p => ArmIncumbentUnit { host: p.second, unit_name: glm53_staircase_units.rank_unit_name })),
-    provenance: "the staircase's previous step: this arm's own head unit on rank zero's host and its rank unit on the others" as NonEmptyStr,
-  }
-}
-
-fn glm53_step_incumbent(choice: Glm53IncumbentChoice, hosts: List<HostIdentity>) -> Glm53StepIncumbent {
-  match choice {
-    SupersedeNothing => Glm53IncumbentResolved { incumbent: NoIncumbentDeclared }
-    SupersedePreviousStep => Glm53IncumbentResolved { incumbent: glm53_previous_step_incumbent(lines_hosts: hosts) }
-  }
-}
-
-fn glm53_incumbent_choice_wire(c: Glm53IncumbentChoice) -> NonEmptyStr {
-  match c {
-    SupersedePreviousStep => "previous-step" as NonEmptyStr
-    SupersedeNothing => "none" as NonEmptyStr
-  }
-}
-
-data glm53_incumbent_choices: List<Glm53IncumbentChoice> = [SupersedePreviousStep, SupersedeNothing]
-
-fn glm53_incumbent_choice_of_wire(word: String) -> Glm53IncumbentChoice? {
-  first(filter(glm53_incumbent_choices, c => (glm53_incumbent_choice_wire(c: c) as String) == word))
-}
-
-// ── THE DRY PLAN AND THE WET SESSION ─────────────────────────────────────────────────────────────
-//
-// BOTH ARE THE ONE PATH'S, over this step's inputs. The dry plan reaches no host except the read of the
-// authority log, and reports the step's plan, every host's unit, container line, preflight and apply,
-// the declared incumbent, the admission verdict with every refusal named, and the successor key a D0
-// suspension would have to name. The wet session reads every planned host's occupancy over the
-// declared incumbent's units, admits against the live authority, and only then runs the incumbent
-// bracket and the arm transaction (gunbc.spark.group_arm_launch group_arm_apply_admitted). GLM has no
-// pre-apply work of its own.
-fn glm53_step_title(s: Glm53StaircaseStep) -> String {
-  join(["GLM-5.3-Flash Group A staircase step ", glm53_step_wire(s: s) as String], "")
-}
-
-fn glm53_step_unplanned_cause(s: Glm53StaircaseStep) -> String {
-  match glm53_step_envelope(s: s) {
-    Glm53StepEnvelopeRefused { cause: c } => c
-    Glm53StepEnvelopeAdmitted { envelope: _ } => "the step's profile did not derive"
-  }
-}
-
-fn glm53_step_report(s: Glm53StaircaseStep, inputs: GroupArmLaunchInputs, plan: GroupArmLaunchPlan, incumbent: ArmDeclaredIncumbent, admission: GroupArmLaunchAdmission) -> String {
-  join([
-    group_arm_dry_run_report(title: glm53_step_title(s: s), intent: inputs.intent, units: inputs.units, plan: plan, pre_apply: [], incumbent: incumbent, admission: admission),
-    arm_successor_wire(s: group_arm_row_successor(inputs: inputs)),
-  ], "")
-}
-
-fn glm53_step_dry_plan(s: Glm53StaircaseStep, choice: Glm53IncumbentChoice) -> ArmDryPlan {
-  match glm53_step_inputs(s: s) {
-    Absent => ArmDryPlan {
-      report: join([glm53_step_title(s: s), " -- DRY RUN\nplan: REFUSED\n  - ", glm53_step_unplanned_cause(s: s), "\n"], ""),
-      admission: GroupArmLaunchAdmissionRefused { causes: [glm53_step_unplanned_cause(s: s)] },
-    }
-    Present { value: inputs } => {
-      let plan = group_arm_launch_plan(inputs: inputs)
-      match glm53_step_incumbent(choice: choice, hosts: group_arm_plan_hosts(p: plan)) {
-        Glm53IncumbentResolved { incumbent: incumbent } => {
-          let admission = group_arm_launch_admission_live(group: FabricGroupA, purpose: inputs.purpose, plan: plan, successor: group_arm_row_successor(inputs: inputs), arm_causes: [], occupancy: group_arm_dry_run_occupancy(group: FabricGroupA), incumbent: incumbent)
-          ArmDryPlan { report: glm53_step_report(s: s, inputs: inputs, plan: plan, incumbent: incumbent, admission: admission), admission: admission }
-        }
-      }
-    }
-  }
-}
-
-fn glm53_step_session(s: Glm53StaircaseStep, choice: Glm53IncumbentChoice, now_word: String, context: FleetSshExecutionContext, ctx: SparkMaterializeContext) -> SparkBuildHostWork {
-  match glm53_step_inputs(s: s) {
-    Absent => SparkBuildHostWork { receipt: join(["NOT LAUNCHED: ", glm53_step_unplanned_cause(s: s), "\n"], ""), converged: false }
-    Present { value: inputs } => {
-      let plan = group_arm_launch_plan(inputs: inputs)
-      let hosts = group_arm_plan_hosts(p: plan)
-      match glm53_step_incumbent(choice: choice, hosts: hosts) {
-        Glm53IncumbentResolved { incumbent: incumbent } => {
-          let occupancy = group_arm_read_occupancy(ctx: ctx, hosts: hosts, units: inputs.units, incumbent: incumbent, need: group_arm_memory_need(gpu_memory_utilization: inputs.profile.decided_gpu_memory_basis_points))
-          let admission = group_arm_launch_admission_live(group: FabricGroupA, purpose: inputs.purpose, plan: plan, successor: group_arm_row_successor(inputs: inputs), arm_causes: [], occupancy: occupancy, incumbent: incumbent)
-          let report = glm53_step_report(s: s, inputs: inputs, plan: plan, incumbent: incumbent, admission: admission)
-          match admission {
-            GroupArmLaunchAdmissionRefused { causes: _ } =>
-              SparkBuildHostWork { receipt: join([report, "NOT LAUNCHED: admission refused; the incumbent and every serving unit are untouched\n"], ""), converged: false }
-            GroupArmLaunchAdmittedForAdoptionOnly { hosts: _ } => {
-              let work = group_arm_adopt_dangling(intent: inputs.intent, units: inputs.units, plan: plan, context: context, ctx: ctx, now_word: now_word)
-              SparkBuildHostWork { receipt: join([report, work.receipt], ""), converged: work.converged }
-            }
-            GroupArmLaunchAdmitted => {
-              let work = group_arm_apply_admitted(
-                intent: inputs.intent, units: inputs.units, plan: plan, incumbent: incumbent,
-                context: context, ctx: ctx, now_word: now_word,
-                pre_apply: fn(steps) { ArmPreApplyPassed { receipt: "" } })
-              SparkBuildHostWork { receipt: join([report, work.receipt], ""), converged: work.converged }
-            }
-          }
-        }
-      }
-    }
-  }
-}
-
-fn glm53_step_wet_session(s: Glm53StaircaseStep, choice: Glm53IncumbentChoice) -> ArmWetSession {
-  ArmWetSession {
-    title: glm53_step_title(s: s) as NonEmptyStr,
-    group: FabricGroupA,
-    attempt_raw: join(["glm53-group-a-staircase-", glm53_step_wire(s: s) as String], ""),
-    identity_file_name: "gunbc-glm53-group-a-staircase-admin-password" as NonEmptyStr,
-    session: fn(now_word, context, ctx) { glm53_step_session(s: s, choice: choice, now_word: now_word, context: context, ctx: ctx) },
-  }
-}
diff --git a/dag/gunbc/spark/glm53_kvplan_image.dag b/dag/gunbc/spark/glm53_kvplan_image.dag
deleted file mode 100644
index b9f78169de5..00000000000
--- a/dag/gunbc/spark/glm53_kvplan_image.dag
+++ /dev/null
@@ -1,164 +0,0 @@
-module gunbc.spark.glm53_kvplan_image
-
-import std.types { String, List, NonEmptyStr }
-import extdeps.docker.cli { docker_run_ephemeral_command }
-
-import std.algebra { trim }
-import std.optional { Present, Absent }
-
-import extdeps.filesystem.filesystem_io { Filesystem }
-import extdeps.exec.command { argv_words }
-import extdeps.vllm.source_build { VllmContainerBuildRecipe, vllm_8d09804_sm121_recipe }
-import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext, SshTarget }
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext, spark_remote_run, RemoteRan, RemoteUnreachable }
-import gunbc.spark.vllm_runtime_image_build { VllmImageBuilt, VllmImageBuildRefused, converge_vllm_image_for_recipe, vllm_image_receipt_line, SparkBuildHostWork, converge_glm53_kvplan_image, glm53_kvplan_patch_path, glm53_kvplan_package_dir }
-import gunbc.spark.group_image_produce { GroupImageProduction, ProducedImageHeld }
-import gunbc.spark.vllm_runtime_image_build { VllmImageDistributionSubject }
-import extdeps.container.oci.digest { OciSha256Digest }
-import std.content_hash { Sha256Digest, Sha256DigestHex }
-import product.host_identity { HostIdentity }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
-import gunbc.spark.runtime_architecture_registry_reading { registry_dump_architectures, registry_dump_count }
-
-// ── THE GLM-5.3-FLASH IMAGE WITH THE KV ALLOCATION-PLAN EMISSION, PRODUCED ONCE (deforking cut 8c) ──
-//
-// WHY THIS EXISTS. The GLM arm's runtime row gunbc.spark.serving_arm glm53_derived_kvplan_v2_row was
-// built by hand PER Group B host (docs/runbooks/glm-kv-allocation-plan-image-rebuild.md), so it has four
-// content ids under one tag and no single identity a D0 grant or a staircase subject could name, and it
-// is on no Group A host. This is that runbook's layer made a modeled build: the base recipe
-// (extdeps.vllm.source_build vllm_8d09804_sm121_recipe) and its flashinfer derived stage
-// (gunbc.spark.vllm_runtime_image_build converge_vllm_image_for_recipe) built on ONE Group A host, then
-// the two Python files the v2 patch changes copied over the installed package in one more layer, then
-// read back by digest and probed inside that digest. Its product is one content id; the staircase is
-// keyed to it, so a Group A winner does not describe Group B's per-host images (ruling of
-// valiant-crab-775, 2026-10-02).
-//
-// THE BUILD HALF (the pins, the prepare script, the Dockerfile, the adopt/build/readback convergence) lives
-// in gunbc.spark.vllm_runtime_image_build beside the flashinfer derived stage, the home of every
-// VllmImageIdentity mint (converge_glm53_kvplan_image). This module is the probe and the production.
-//
-// WHY A FILE LAYER AND NOT A PATCHED SOURCE BUILD, as the runbook argues: the patch touches only
-// vllm/v1/engine/core.py and vllm/envs.py, pure Python with no compiled artifact, so the base build's
-// compiled bytes are the patched source's compiled bytes.
-
-// ── THE PROBE INSIDE THE PRODUCED DIGEST ──────────────────────────────────────────────────────
-//
-// ONE EPHEMERAL CONTAINER OF THE DIGEST (never the tag), no GPU, no checkpoint: the engine's version,
-// where its package lives, whether the patched core carries the emission marker, where the Hub CLI is
-// (the runtime row's hub_cli_path, which the checkpoint materialize runs inside this image), and the whole model
-// registry (REGISTRY_COUNT, then one REGISTERED line per architecture -- the dump
-// gunbc.spark.runtime_architecture_registry_reading's fold reads). The registry dump is what a
-// runtime row's registry_reading is recorded from, citing the run.
-data glm53_kvplan_probe_script: String = "import os, shutil, vllm\nprint('HF_CLI ' + (shutil.which('hf') or 'absent'))\nprint('VLLM_VERSION ' + vllm.__version__)\nprint('VLLM_PACKAGE_DIR ' + os.path.dirname(vllm.__file__))\nimport vllm.v1.engine.core as c\nprint('KVPLAN_MARKER ' + ('present' if getattr(c, 'KV_ALLOCATION_PLAN_LOG_MARKER', None) == 'KV_ALLOCATION_PLAN_JSON ' else 'absent'))\nfrom vllm.model_executor.models.registry import ModelRegistry\na = sorted(ModelRegistry.get_supported_archs())\nprint('REGISTRY_COUNT ' + str(len(a)))\nfor x in a:\n    print('REGISTERED ' + x)\n"
-
-data glm53_kvplan_engine_version: String = "0.1.dev1+g8d09804c8"
-
-fn glm53_kvplan_probe_argv(digest: NonEmptyStr) -> List<String> {
-  argv_words(command: docker_run_ephemeral_command(image: digest, gpus_all: false, mounts: [], labels: [], memory_limit: Absent, entrypoint: "python3" as NonEmptyStr, argv: ["-c", glm53_kvplan_probe_script]))
-}
-
-fn probe_line_value(stdout: String, prefix: String) -> String? {
-  first(flat_map(split(stdout, "\n"), l => {
-    let t = trim(s: l)
-    if starts_with(s: t, prefix: prefix) { [substring(s: t, start: length(prefix), end: length(t))] } else { [] as List<String> }
-  }))
-}
-
-type Glm53KvplanProbe
-  = Glm53KvplanProbeHeld { digest: NonEmptyStr, architectures: List<NonEmptyStr>, receipt: String }
-  | Glm53KvplanProbeRefused { receipt: String }
-
-// HELD ONLY WHEN EVERY ANSWER IS THE ONE THE BUILD OWES: the pinned engine version, the package where
-// the layer copied the files, the marker present, and a registry whose REGISTERED lines number exactly
-// its count. Anything else refuses and the receipt carries what was answered.
-fn glm53_kvplan_probe(ctx: SparkMaterializeContext, digest: NonEmptyStr, r: VllmContainerBuildRecipe) -> Glm53KvplanProbe {
-  match spark_remote_run(ctx: ctx, argv: glm53_kvplan_probe_argv(digest: digest)) {
-    RemoteUnreachable { cause: c, reach: _ } => Glm53KvplanProbeRefused { receipt: join(["probe inside ", digest as String, " DID NOT RUN: ", c, "\n"], "") }
-    RemoteRan { exit_code: code, stdout: out, stderr: err } => {
-      let archs = registry_dump_architectures(stdout: out)
-      let version = probe_line_value(stdout: out, prefix: "VLLM_VERSION ")
-      let pkg = probe_line_value(stdout: out, prefix: "VLLM_PACKAGE_DIR ")
-      let marker = probe_line_value(stdout: out, prefix: "KVPLAN_MARKER ")
-      let count_ok = match registry_dump_count(stdout: out) { Present { value: n } => n > 0 && length(archs) == n  Absent => false }
-      let defects = concat(concat(concat(concat(
-        if code == 0 { [] as List<String> } else { [join(["the probe exited ", to_string(code), ": ", trim(s: err)], "")] },
-        match version { Present { value: v } => if v == glm53_kvplan_engine_version { [] as List<String> } else { [join(["the engine reports ", v, ", not ", glm53_kvplan_engine_version], "")] }  Absent => ["the engine version was not printed"] }),
-        match pkg { Present { value: d } => if d == (glm53_kvplan_package_dir(r: r) as String) { [] as List<String> } else { [join(["vLLM is installed at ", d, ", not where the layer copied the patched files (", glm53_kvplan_package_dir(r: r) as String, ")"], "")] }  Absent => ["the package directory was not printed"] }),
-        match marker { Present { value: m } => if m == "present" { [] as List<String> } else { ["the patched core does not carry KV_ALLOCATION_PLAN_LOG_MARKER"] }  Absent => ["the marker line was not printed"] }),
-        if count_ok { [] as List<String> } else { ["the registry dump's REGISTERED lines do not number its REGISTRY_COUNT"] })
-      let head = join([
-        "probe inside ", digest as String, ": version=", match version { Present { value: v } => v  Absent => "?" },
-        " package=", match pkg { Present { value: d } => d  Absent => "?" },
-        " marker=", match marker { Present { value: m } => m  Absent => "?" },
-        " hf_cli=", match probe_line_value(stdout: out, prefix: "HF_CLI ") { Present { value: h } => h  Absent => "?" },
-        " registry=", to_string(length(archs)), " architectures\n",
-      ], "")
-      if length(defects) == 0 {
-        Glm53KvplanProbeHeld { digest: digest, architectures: archs, receipt: join([head, "registry dump (record as the runtime row's reading, citing this run):\n", join(map(archs, a => join(["  REGISTERED ", a as String, "\n"], "")), "")], "") }
-      } else {
-        Glm53KvplanProbeRefused { receipt: join([head, "probe REFUSED:\n", join(map(defects, d => join(["  - ", d, "\n"], "")), ""), "stdout:\n", out], "") }
-      }
-    }
-  }
-}
-
-// ── THE PRODUCTION: BASE, FLASHINFER STAGE, KVPLAN LAYER, PROBE ─────────────────────────────────
-//
-// The patch bytes are read here, on the runner, from the corpus; the host verifies their digest before
-// applying them. Converged only when every stage built or adopted AND the probe held.
-fn glm53_kvplan_produce(target: SshTarget, context: FleetSshExecutionContext, ctx: SparkMaterializeContext) -> SparkBuildHostWork {
-  let r = vllm_8d09804_sm121_recipe
-  let read = Filesystem.Read(path: glm53_kvplan_patch_path as String)
-  if !read.success {
-    SparkBuildHostWork { receipt: join(["NOT PRODUCED: the patch could not be read from the corpus at ", glm53_kvplan_patch_path as String, ": ", read.error, "\n"], ""), converged: false }
-  } else {
-    let derived = converge_vllm_image_for_recipe(target: target, context: context, ctx: ctx, r: r)
-    match derived {
-      VllmImageBuildRefused { step: _, cause: _ } => SparkBuildHostWork { receipt: join(["base and flashinfer stage: ", vllm_image_receipt_line(b: derived)], ""), converged: false }
-      VllmImageBuilt { identity: d, already_present: _ } => {
-        let layer = converge_glm53_kvplan_image(target: target, context: context, ctx: ctx, derived: d, r: r, patch_text: read.content)
-        let built = join(["base and flashinfer stage: ", vllm_image_receipt_line(b: derived), "kvplan layer: ", vllm_image_receipt_line(b: layer)], "")
-        match layer {
-          VllmImageBuildRefused { step: _, cause: _ } => SparkBuildHostWork { receipt: built, converged: false }
-          VllmImageBuilt { identity: k, already_present: _ } =>
-            match glm53_kvplan_probe(ctx: ctx, digest: k.local_config_digest, r: r) {
-              Glm53KvplanProbeRefused { receipt: pr } => SparkBuildHostWork { receipt: join([built, pr], ""), converged: false }
-              Glm53KvplanProbeHeld { digest: dg, architectures: _, receipt: pr } =>
-                SparkBuildHostWork { receipt: join([built, "PRODUCED glm53 kvplan-v2 image tag=", k.tag as String, " config_digest=", dg as String, " on ", ctx.host as String, "\n", pr], ""), converged: true }
-            }
-        }
-      }
-    }
-  }
-}
-
-// THE GLM IMAGE AS ONE PRODUCTION OF THE ONE ENTRY (gunbc.spark.group_image_produce).
-fn glm53_kvplan_production() -> GroupImageProduction {
-  GroupImageProduction {
-    title: "glm53 kvplan-v2 runtime image produce" as NonEmptyStr,
-    group: FabricGroupA,
-    attempt_raw: "glm53-kvplan-image-produce",
-    identity_file_name: "gunbc-glm53-kvplan-image-produce-admin-password" as NonEmptyStr,
-    produce: fn(target, context, ctx) { glm53_kvplan_produce(target: target, context: context, ctx: ctx) },
-  }
-}
-
-// THE PRODUCED IMAGE'S RECEIPT ROW. Absent until a production run through spark_runtime_image_produce
-// has converged and its receipt (tag, configuration digest, host, run) is transcribed here, citing the
-// run -- the same discipline as gunbc.spark.v41_runtime_image_converge v41_production_produced_image.
-// Recorded from fleet-converge run 37100656092 (srv7, 2026-10-03): its PRODUCED line and the probe
-// inside the configuration digest. The runtime row that names this identity is gunbc.spark.serving_arm
-// glm53_kvplan_v2_group_a_row.
-fn glm53_kvplan_produced_image_held() -> ProducedImageHeld? {
-  Present { value: ProducedImageHeld {
-    title: "glm53 kvplan-v2 runtime image" as NonEmptyStr,
-    group: FabricGroupA,
-    subject: VllmImageDistributionSubject {
-      tag: "gunbc-vllm-glm53-gb10:kvplan-v2-50ba9aad263fea47" as NonEmptyStr,
-      config: OciSha256Digest(Sha256Digest { hex: "6ef84cd49a68dbefd957bfca36f0ec458ed80f8194def41642e7b37b34ae76fb" as Sha256DigestHex }),
-    },
-    held_on: "srv7" as HostIdentity,
-    receipt_run: "37100656092" as NonEmptyStr,
-  } }
-}
-
diff --git a/dag/gunbc/spark/glm53_staircase_load.dag b/dag/gunbc/spark/glm53_staircase_load.dag
deleted file mode 100644
index bfb9edcbcdc..00000000000
--- a/dag/gunbc/spark/glm53_staircase_load.dag
+++ /dev/null
@@ -1,186 +0,0 @@
-module gunbc.spark.glm53_staircase_load
-
-import extdeps.docker.cli { DockerEnvAssignment }
-import extdeps.vllm.environment { vllm_environment_variable_name, VllmFlashinferAutotuneSkipOps }
-
-import std.types { String, List, NonEmptyStr }
-import std.nat { Nat }
-import std.optional { Present, Absent }
-import product.host_identity { HostIdentity }
-import extdeps.vllm.kv_layout { AdmissionCostUnestablished }
-import gunbc.spark.fabric_reach { ReachManagementLan, spark_reach_endpoint }
-import gunbc.spark.serving_arm { serving_checkpoint_row, serving_runtime_row, runtime_pin_reference, serving_deployment_env_key }
-import gunbc.spark.serving_arm_launch { glm_native_weights_container_dir }
-import gunbc.spark.model_snapshot_acquisition { HubCachePlacement, snapshot_install_path }
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext }
-import gunbc.spark.vllm_runtime_image_build { SparkBuildHostWork }
-import gunbc.spark.serving_performance_subject { ServingPerformanceSubject, serving_subject_for_launch, serving_subject_standing }
-import gunbc.spark.serving_load_probe { ClientRateQualificationFrontier, client_rate_qualification_frontier }
-import gunbc.spark.serving_load_runner { ServingLoadSubject, serving_load_records, serving_load_receipt_body, ServingLoadRunObserved, ServingLoadRunRefused }
-import gunbc.spark.serving_promotion { WorkloadCalibrationReceipt }
-import gunbc.spark.glm_serving_load { glm_native_sweep_dataset, glm_native_bench_seed }
-import gunbc.spark.group_arm_launch { GroupArmLaunchInputs, GroupArmLaunchPlanned, GroupArmLaunchRefused, group_arm_launch_plan }
-import gunbc.spark.group_arm_serving_load { read_group_rank_pressure, load_step_result, load_step_verdict_wire, floor_and_ceiling_concurrencies, load_requests, load_trace_digest, calibration_receipt }
-import gunbc.spark.glm53_arm_staircase { Glm53StaircaseStep, glm53_step_inputs, glm53_step_wire, glm53_step_ceiling, glm53_step_title }
-import gunbc.spark.group_b_serving_capacity { group_b_experiment_subject_seats }
-
-// ── THE GLM STAIRCASE STEP'S LOAD: THE ARM'S INPUTS TO THE ONE LOAD PATH (deforking cut 8b) ──────────
-//
-// The head and the roster are the step's own plan's (rank zero serves the front door; every rank is
-// read), the container and alias are the staircase's names, the dataset and seed are the GLM arm's
-// existing rows (gunbc.spark.glm_serving_load glm_native_sweep_dataset, glm_native_bench_seed), and the
-// subject is derived from the step's launch profile by the constructor every arm uses. What is run is
-// gunbc.spark.serving_load_runner over gunbc.spark.group_arm_serving_load's rank reading and stop rules.
-//
-// THE PROTOCOL DOES NOT EXERCISE THE COLD WINDOW, and the receipt says so: 256 tokens in and 128 out
-// load the scheduler's seats, not 262144-token sequences, so a held step shows the ceiling's seats are
-// admitted and served without breaking the floor at short context -- not that 8 full-window sequences
-// fit. The cold window's own reading is the launch's memory wall and its allocation plan, not this load.
-data glm53_staircase_load_window_frontier: String = "the cold window (8 x 262144) is NOT exercised: the protocol is the GLM arm's 256-in/128-out shape, so this receipt reads seat admission and stability at short context; full-window fit is the memory wall's and the allocation plan's reading"
-
-data glm53_staircase_qualification_frontier: ClientRateQualificationFrontier = client_rate_qualification_frontier(
-  request_start_events: "per-request start events so ArrivalSkewObserved can be minted; SendAllImmediately stays ArrivalSkewUnread until that producer exists" as NonEmptyStr,
-  reserved_window: "subject-bound LeaseGrant and ExclusionEstablished over the staircase step; the step runs under Group A's D0 suspension for its successor key, which is the window's authority but not yet an exclusion receipt" as NonEmptyStr,
-  interval_occupancy: "occupancy as a time-series over the client interval; BoundaryOccupancyReceipt is two scrapes and cannot count positively" as NonEmptyStr,
-  serve_py_digest: "bind vllm_bench_serve_source_standing to the serve.py digest inside the produced GLM image, or an explicit policy that admits TranscribedUncited" as NonEmptyStr,
-)
-
-type Glm53StepLoad
-  = Glm53StepLoadReady { subject: ServingLoadSubject, performance: ServingPerformanceSubject, roster: List<HostIdentity>, inputs: GroupArmLaunchInputs }
-  | Glm53StepLoadRefused { cause: String }
-
-fn glm53_step_performance_subject(inputs: GroupArmLaunchInputs) -> ServingPerformanceSubject? {
-  match serving_runtime_row(r: inputs.assignment.runtime) {
-    Absent => none
-    Present { value: rt } => Present { value: serving_subject_for_launch(
-      checkpoint_revision: match serving_checkpoint_row(c: inputs.assignment.checkpoint) { Present { value: row } => Present { value: row.revision }  Absent => none },
-      runtime: inputs.assignment.runtime,
-      runtime_image_reference: runtime_pin_reference(p: rt.artifact.pin),
-      topology: inputs.assignment.topology,
-      profile: inputs.profile,
-      deployment_env: inputs.deployment_env,
-      collective_transport: none,
-    ) }
-  }
-}
-
-fn glm53_step_load(s: Glm53StaircaseStep) -> Glm53StepLoad {
-  match glm53_step_inputs(s: s) {
-    Absent => Glm53StepLoadRefused { cause: "the step's profile did not derive" }
-    Present { value: inputs } =>
-      match group_arm_launch_plan(inputs: inputs) {
-        GroupArmLaunchRefused { causes: c } => Glm53StepLoadRefused { cause: join(["the step's plan refused, so it has no head or roster to load: ", join(c, "; ")], "") }
-        GroupArmLaunchPlanned { lines: ls, profile: _, master_endpoint: _ } =>
-          match first(filter(ls, l => l.node.node_rank == 0)) {
-            Absent => Glm53StepLoadRefused { cause: "the plan has no rank zero, so no rank serves the front door" }
-            Present { value: head } =>
-              match spark_reach_endpoint(host: head.node.host, path: ReachManagementLan) {
-                Absent => Glm53StepLoadRefused { cause: join(["the head ", head.node.host as String, " has no management-LAN endpoint"], "") }
-                Present { value: address } =>
-                  match glm53_step_performance_subject(inputs: inputs) {
-                    Absent => Glm53StepLoadRefused { cause: "the step's runtime has no row, so no subject derives" }
-                    Present { value: perf } => Glm53StepLoadReady {
-                      subject: ServingLoadSubject {
-                        host: head.node.host,
-                        host_address: address,
-                        group: inputs.assignment.group,
-                        container: inputs.container.container_name,
-                        base_url: join(["http://127.0.0.1:", to_string(inputs.profile.serve_port)], "") as NonEmptyStr,
-                        served_alias: inputs.profile.served_alias,
-                        standing: serving_subject_standing(
-                          subject: perf,
-                          believed: "the running Group A arm is believed to be this step's launch: its image is the step's runtime pin and its argv the step's profile; collective transport is unread" as NonEmptyStr,
-                          would_settle: "read the head container's image Id and launch argv on this incarnation, and the NCCL transport announcement on every rank" as NonEmptyStr,
-                        ),
-                        admission: AdmissionCostUnestablished { cause: "the GLM arm's per-request KV cost is unread: no cache-group roster is observed for this launch" as NonEmptyStr },
-                        qualification_frontier: glm53_staircase_qualification_frontier,
-                        principal: "group-A administrator" as NonEmptyStr,
-                        receipt_heading: join([glm53_step_title(s: s), " load"], "") as NonEmptyStr,
-                        receipt_path: "target/arm-group-load-receipt.txt",
-                      },
-                      performance: perf,
-                      roster: map(ls, l => l.node.host),
-                      inputs: inputs,
-                    }
-                  }
-              }
-          }
-      }
-  }
-}
-
-fn glm53_step_concurrencies(s: Glm53StaircaseStep) -> List<Nat> {
-  floor_and_ceiling_concurrencies(cold_floor: group_b_experiment_subject_seats, ceiling: glm53_step_ceiling(s: s))
-}
-
-fn glm53_step_tokenizer(inputs: GroupArmLaunchInputs) -> NonEmptyStr? {
-  match serving_checkpoint_row(c: inputs.assignment.checkpoint) {
-    Absent => none
-    Present { value: row } => Present { value: snapshot_install_path(placement: HubCachePlacement { cache_root: glm_native_weights_container_dir }, repo: row.repo, revision: row.revision) }
-  }
-}
-
-fn count_wire(n: Nat?) -> String {
-  match n { Present { value: v } => to_string(v)  Absent => "UNREAD" }
-}
-
-fn calibration_wire(r: WorkloadCalibrationReceipt) -> String {
-  join([
-    "calibration receipt: sustained_concurrency=", to_string(r.sustained_concurrency),
-    " preemptions=", count_wire(n: r.preemptions), " engine_restarts=", count_wire(n: r.engine_restarts),
-    " oom_events=", count_wire(n: r.out_of_memory_events), " stalls_or_lost=", count_wire(n: r.stalls_or_lost_requests),
-    " accepted_turns=", count_wire(n: r.accepted_turns), " realized_transport=UNREAD (a declared frontier: no NCCL transport reading is taken by this load)\n",
-  ], "")
-}
-
-// THE SESSION, ON THE HEAD (the bench and the scrape address its loopback). It loads the step at the
-// floor and at the ceiling, judges each, and folds the calibration receipt. Converged means every load
-// ran and was judged; whether the step HELD is in the receipt, and is what the next step's admission
-// will read once the receipt is recorded.
-// THE AUTOTUNE POLICY IS STATED IN EVERY RECEIPT (side-chat ruling on #13319, finding 3), read off the
-// step's own deployment env rather than its checkpoint: with VLLM_FLASHINFER_AUTOTUNE_SKIP_OPS set, rank 0
-// runs its tuned tactics and ranks 1-3 the heuristic ones, so the ranks are not kernel-identical and the
-// measured throughput is a LOWER BOUND for the fully tuned configuration -- which is a different subject
-// (its deployment env key differs), never this one re-measured.
-fn glm53_autotune_standing_wire(env: List<DockerEnvAssignment>) -> String {
-  let name = vllm_environment_variable_name(v: VllmFlashinferAutotuneSkipOps) as String
-  match first(filter(env, a => (a.name as String) == name)) {
-    Absent => "autotune: not skipped -- every rank runs its own autotune\n"
-    Present { value: a } => join(["autotune: ", name, "=", a.value, " -- rank 0 runs tuned tactics, ranks 1-3 heuristic ones; the ranks are not kernel-identical and this throughput is a LOWER BOUND for the fully tuned configuration\n"], "")
-  }
-}
-
-fn glm53_step_load_session(s: Glm53StaircaseStep, run_id: NonEmptyStr, ctx: SparkMaterializeContext) -> SparkBuildHostWork {
-  match glm53_step_load(s: s) {
-    Glm53StepLoadRefused { cause: c } => SparkBuildHostWork { receipt: join(["load REFUSED: ", c, "\n"], ""), converged: false }
-    Glm53StepLoadReady { subject: subject, performance: perf, roster: roster, inputs: inputs } =>
-      match glm53_step_tokenizer(inputs: inputs) {
-        Absent => SparkBuildHostWork { receipt: "load REFUSED: the checkpoint has no row, so no tokenizer path derives\n", converged: false }
-        Present { value: tokenizer } => {
-          let concurrencies = glm53_step_concurrencies(s: s)
-          let steps = load_requests(base_url: subject.base_url, model: subject.served_alias, tokenizer: tokenizer, dataset: glm_native_sweep_dataset, seed: glm_native_bench_seed, concurrencies: concurrencies)
-          match serving_load_records(ctx: ctx, subject: subject, steps: steps, host_read: fn(c) { read_group_rank_pressure(ctx: c, roster: roster, container: subject.container) }) {
-            ServingLoadRunRefused { reason: r } => SparkBuildHostWork { receipt: join(["load REFUSED: ", r, "\n"], ""), converged: false }
-            ServingLoadRunObserved { records: rs } => {
-              let results = map(rs, r => load_step_result(cold_floor: group_b_experiment_subject_seats, roster: roster, r: r))
-              let receipt = calibration_receipt(
-                subject: perf,
-                trace: load_trace_digest(dataset: glm_native_sweep_dataset, seed: glm_native_bench_seed, concurrencies: concurrencies),
-                run_id: run_id,
-                results: results,
-                evidence: join(["fleet-converge mode spark_arm_group_load, arm glm53-group-a, step ", glm53_step_wire(s: s) as String, ", run ", run_id as String], "") as NonEmptyStr)
-              let extra = join([
-                "step: ", glm53_step_wire(s: s) as String, " run_id: ", run_id as String, "\n",
-                join(map(results, r => load_step_verdict_wire(concurrency: r.concurrency, v: r.verdict)), ""),
-                calibration_wire(r: receipt),
-                "window: ", glm53_staircase_load_window_frontier, "\n",
-                glm53_autotune_standing_wire(env: inputs.deployment_env),
-                "deployment env key: ", serving_deployment_env_key(env: inputs.deployment_env), "\n",
-              ], "")
-              SparkBuildHostWork { receipt: serving_load_receipt_body(subject: subject, records: rs, extra: extra), converged: true }
-            }
-          }
-        }
-      }
-  }
-}
diff --git a/dag/gunbc/spark/glm_group_b_launch.dag b/dag/gunbc/spark/glm_group_b_launch.dag
index 3e39348906a..faa37af57dd 100644
--- a/dag/gunbc/spark/glm_group_b_launch.dag
+++ b/dag/gunbc/spark/glm_group_b_launch.dag
@@ -10,7 +10,7 @@ import extdeps.docker.cli { DockerEnvAssignment }
 import extdeps.vllm.environment {
   VllmEngineReadyTimeoutSeconds, VllmSparseIndexerMaxLogitsMb, vllm_environment_variable_name,
 }
-import gunbc.spark.fabric_switch_observed { FabricGroup }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 import gunbc.spark.serving_arm {
   ArmIntent,
 }
diff --git a/dag/gunbc/spark/glm_serving_load.dag b/dag/gunbc/spark/glm_serving_load.dag
index 1e5c9c99689..8470a887984 100644
--- a/dag/gunbc/spark/glm_serving_load.dag
+++ b/dag/gunbc/spark/glm_serving_load.dag
@@ -25,7 +25,7 @@ import gunbc.spark.serving_performance_subject {
   ServingPerformanceSubject, serving_subject_for_launch, serving_subject_standing, ServingPerformanceSubjectStanding,
 }
 import gunbc.spark.glm_group_b_relaunch_cli { with_group_b_access, rank_context }
-import gunbc.spark.fabric_switch_observed { FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import gunbc.spark.serving_load_probe {
   ClientRateQualificationFrontier, client_rate_qualification_frontier,
   ProtectedSubjectField, protected_subject_field,
@@ -160,7 +160,7 @@ fn glm_native_serving_load_subject() -> ServingLoadSubject? {
     Present { value: standing } => Present { value: ServingLoadSubject {
       host: operator_host_srv9,
       host_address: srv9_host_lan_endpoint.address,
-      group: FabricGroupB,
+      group: FabricGroupB {},
       container: glm_native_container_name,
       base_url: glm_native_serve_base_url(),
       served_alias: group_b_restoration_served_alias,
diff --git a/dag/gunbc/spark/group_arm_launch.dag b/dag/gunbc/spark/group_arm_launch.dag
deleted file mode 100644
index 8afd87b498a..00000000000
--- a/dag/gunbc/spark/group_arm_launch.dag
+++ /dev/null
@@ -1,1038 +0,0 @@
-module gunbc.spark.group_arm_launch
-
-import extdeps.huggingface.hub { hub_repo_cache_directory, hub_dereferenced_bytes_argv }
-import gunbc.spark.model_snapshot_acquisition { spark_hub_cache_root }
-import gunbc.fleet_wireless_link { observe_wireless_link, spark_wireless_link_desired, wireless_link_observation_line, kernel_disconnect_line_count, dgx_spark_wireless_interface }
-import extdeps.systemd.journalctl { journalctl_kernel_current_boot_argv }
-import gunbc.auth.standing_operator_grant { standing_grant_covers, StandingArmLaunch, StandingGrantFabricGroup }
-import gunbc.spark.pair_serving_d0 { d0_standing_grants }
-import gunbc.spark.pair_serving_d0_door { StandingGrantRowStanding, StandingGrantRowOnMain, StandingGrantRowNotOnMain, fresh_grant_row_standing, executed_grant_row }
-import extdeps.git
-import gunbc.output_policy { ExpectSuccess }
-import std.types { String, Bool, List, NonEmptyStr, GitRef, Int }
-import std.optional { Present, Absent }
-import v2.std.algebra { zip_map }
-import std.measure { Kibibyte, kibibyte, basis_point_count, BasisPoint }
-import std.content_hash { ContentHash, content_hash_equal, serialize_content_hash, content_hash_atom }
-import std.artifact_store { ArtifactRealizationInput, artifact_realization_digest }
-import product.host_identity { HostIdentity }
-import extdeps.docker.cli { DockerEnvAssignment, docker_ps_running_all_command }
-import gunbc.compute.host_occupancy { HostOccupant, ServingUnitActive, GpuComputeProcess, HostOccupancyAdmission, HostUnoccupied, HostOccupiedBy, HostMemoryShort, HostOccupancyNotRead, host_operation_leg, HostOperationLegRead, HostOperationLegUnread, read_host_occupancy, admit_host_occupancy, host_occupancy_refusal, host_occupant_wire }
-import gunbc.host_operation_exec { SystemctlStop, NvidiaSmiQueryComputeApps, ProcfsReadPidCgroup }
-import extdeps.nvidia.system_management_interface { parse_compute_apps, ComputeAppsParsed, ComputeAppsUnparsed }
-import extdeps.systemd.systemctl { systemctl_list_all_service_units_argv }
-import extdeps.exec.command { argv_words }
-import std.algebra { trim }
-import gunbc.spark.host_effect_quiescence { ArgvRun, ArgvRan, ArgvLegDidNotRun, ArgvLegMayHaveRun }
-import extdeps.systemd { Active }
-import gunbc.fabric_event_log_host { now_epoch_seconds, HostStoreResolved, HostStoreRefused, event_log_store_for_host }
-import gunbc.spark.fabric_reach { ExecutorReachKnown, ExecutorReachUnknown, observe_executor_reach, ReachFabricRail, spark_reach_endpoint }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_hosts, fabric_group_wire }
-import gunbc.spark.fabric_serving_assignment { FabricServingAssignment }
-import gunbc.spark.serving_subject { PairServingUnitOn }
-import gunbc.spark.host_commitment { admit_host_held_by_subject, admit_host_held_by_subject_among, spark_serving_admissible_hosts }
-import gunbc.spark.serving_promotion { no_promotion_receipts }
-import gunbc.spark.serving_arm { Glm53NativeFp8, Glm53FlashNvidiaNvfp4, serving_checkpoint_wire, ArmIntent, ServingLaunchProfile, gb10_unified_pool_gib, serving_runtime_row, runtime_artifact_wire, GunbcGlm53KvplanV2GroupAProduced, serving_checkpoint_row, runtime_artifact_key, serving_topology_wire, serving_launch_profile_key, serving_deployment_env_key }
-import gunbc.spark.serving_arm_launch { glm53_staircase_head_log_path, ArmContainerIdentity, ArmNodeLaunch, ArmLaunchPlanned, ArmLaunchRefused, plan_arm_launch_under_memory_fit }
-import gunbc.spark.pair_serving_realization { spark_pair_serve_port }
-import gunbc.spark.native_serving_realization { ArmUnitIdentity, GlmNativeUnitRender, arm_host_unit_file_for, glm_native_rendezvous_endpoint }
-import gunbc.spark.native_serving_apply { spark_native_unit_path, spark_native_fence_suffix, spark_native_unresolved_rollback_suffix, SparkNativeArmSteps, NativeArmSteps, NativeArmStepsRefused, SparkNativeHostStep, spark_native_arm_steps_of, spark_native_preflight_plans, spark_native_apply_step_wire, spark_native_apply_transaction }
-import gunbc.spark.pair_serving_authority { PairServingGroupAuthority, PairServingActive, SuspensionPendingReconciliation, SuspendedForAuthorizedSuccessor, FencedRefusal, ReleasedToFleet, PairRealizationKeyed, PairRealizationUnestablished, pair_serving_successor_may_launch }
-import gunbc.spark.pair_serving_authority_log {
-  PreparationState, Prepared, AppendClaimed, Finalized, Aborted,
-  placement_read, PlacementReadAt, PlacementUnread, preparation_line, group_fenced_hosts, live_host_effects_on, host_effect_line_at, same_group, CurrentAuthorityRead, CurrentAuthorityUnread, current_pair_serving_authorities, current_authority_for, current_authority_wire }
-import gunbc.spark.host_occupancy_admission { spark_serving_units, spark_ctx_argv_run, restore_spark_serving_units }
-import gunbc.spark.vllm_runtime_image_build { vllm_image_target_ctx, SparkBuildHostWork, with_spark_build_host, SparkBuildHostRefused, SparkBuildHostRan }
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext, spark_remote_run, RemoteRan, RemoteUnreachable }
-import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fleet_multi_principal_probe { spark_converge_target_selection, SparkConvergeTargetSingle, SparkConvergeTargetAllObserveOnly, SparkConvergeTargetRefused }
-
-// ── ONE LAUNCH TRANSACTION FOR AN ARM ON A FABRIC GROUP, WHATEVER THE ARM IS (deforking cut 8a) ─────
-//
-// WHY THIS MODULE EXISTS. gunbc.spark.v41_group_a_launch planned, rendered, admitted and applied the
-// V4.1 arm on Group A, and every one of those steps was a fact about an ARM ON A GROUP rather than about
-// V4.1: the plan is plan_arm_launch_under_memory_fit over a serving assignment, the units are
-// arm_host_unit_file_for under the arm's own names, the apply is gunbc.spark.native_serving_apply's
-// transaction, and the admission is the group's authority, its subject's hold and its hosts' occupancy.
-// A second arm on Group A (GLM-5.3-Flash's staircase) would otherwise have been a copy of all of it. So
-// this module is the ONE path, parameterized by what actually differs -- the assignment, the profile,
-// the deployment env, the unit and container names, the successor key the authority must name, the
-// declared incumbent, and the arm's own pre-apply work -- and V4.1 is one caller of it. Its
-// V4.1-specific facts (the held production image, the Engram manifest and staging, the SM120 self-test)
-// are that caller's inputs, never this module's.
-//
-// WHAT IS NOT YET HERE, NAMED (DESIGN §3 replacement-migration standing rule): gunbc.spark.glm_group_b_launch
-// plans Group B's LIVE arm through its own route and stays a consumer of the old shape, FROZEN -- no new
-// investment -- until a named follow-up migrates it (its trigger: a Group B relaunch that runs through
-// this transaction, which changes what a Group B converge applies and so is a decision of its own, not a
-// side effect of this cut).
-
-// ── THE INPUTS: WHAT DIFFERS BETWEEN ONE ARM AND ANOTHER ────────────────────────────────────────
-//
-// THE ASSIGNMENT IS THE TUPLE'S ONE HOME (gunbc.spark.fabric_serving_assignment FabricServingAssignment),
-// not a second record of (group, checkpoint, runtime, topology). The purpose is the phrase every refusal
-// names the effect by, so a refusal says which launch it refused.
-type GroupArmLaunchInputs {
-  assignment: FabricServingAssignment
-  profile: ServingLaunchProfile
-  intent: ArmIntent
-  deployment_env: List<DockerEnvAssignment>
-  container: ArmContainerIdentity
-  units: ArmUnitIdentity
-  purpose: NonEmptyStr
-}
-
-type GroupArmLaunchPlan
-  = GroupArmLaunchPlanned { lines: List<ArmNodeLaunch>, profile: ServingLaunchProfile, master_endpoint: NonEmptyStr }
-  | GroupArmLaunchRefused { causes: List<String> }
-
-// THE PLAN IS THE MEMORY WALL'S. A FitUnestablished subject is admitted only under ArmBoundedExperiment,
-// and normal serving also passes the promotion step; this module adds no wall of its own and removes none.
-fn group_arm_launch_plan(inputs: GroupArmLaunchInputs) -> GroupArmLaunchPlan {
-  let a = inputs.assignment
-  match plan_arm_launch_under_memory_fit(
-    checkpoint: a.checkpoint,
-    runtime: a.runtime,
-    topology: a.topology,
-    group: a.group,
-    intent: inputs.intent,
-    profile: inputs.profile,
-    deployment_env: inputs.deployment_env,
-    container: inputs.container,
-    promotion_receipts: no_promotion_receipts,
-  ) {
-    ArmLaunchRefused { cause: c } => GroupArmLaunchRefused { causes: [c as String] }
-    ArmLaunchPlanned { lines: ls, master: m } =>
-      GroupArmLaunchPlanned { lines: ls, profile: inputs.profile, master_endpoint: glm_native_rendezvous_endpoint(master: m, port: inputs.container.master_port) }
-  }
-}
-
-fn group_arm_unit_renders(intent: ArmIntent, units: ArmUnitIdentity, p: GroupArmLaunchPlan) -> List<GlmNativeUnitRender> {
-  match p {
-    GroupArmLaunchPlanned { lines: ls, profile: prof, master_endpoint: _ } =>
-      map(ls, l => arm_host_unit_file_for(intent: intent, launch: l, units: units, served_alias: prof.served_alias))
-    GroupArmLaunchRefused { causes: _ } => [] as List<GlmNativeUnitRender>
-  }
-}
-
-fn group_arm_steps(intent: ArmIntent, units: ArmUnitIdentity, p: GroupArmLaunchPlan) -> SparkNativeArmSteps {
-  match p {
-    GroupArmLaunchPlanned { lines: ls, profile: prof, master_endpoint: e } =>
-      spark_native_arm_steps_of(launches: ls, renders: group_arm_unit_renders(intent: intent, units: units, p: p), master_endpoint: Present { value: e }, units: units, profile: prof)
-    GroupArmLaunchRefused { causes: c } => NativeArmStepsRefused { cause: join(c, "; ") as NonEmptyStr }
-  }
-}
-
-fn group_arm_plan_hosts(p: GroupArmLaunchPlan) -> List<HostIdentity> {
-  match p {
-    GroupArmLaunchPlanned { lines: ls, profile: _, master_endpoint: _ } => map(ls, l => l.node.host)
-    GroupArmLaunchRefused { causes: _ } => [] as List<HostIdentity>
-  }
-}
-
-// THE OCCUPANCY NEED IS THE ENGINE'S OWN REQUEST: the profile's gpu-memory-utilization share of a GB10's
-// unified pool (gunbc.spark.serving_arm gb10_unified_pool_gib), which vLLM asks the device for at startup.
-fn group_arm_memory_need(gpu_memory_utilization: BasisPoint) -> Kibibyte {
-  kibibyte(count: basis_point_count(bp: gpu_memory_utilization) * gb10_unified_pool_gib * 1048576 / 10000)
-}
-
-fn group_arm_plan_memory_need(p: GroupArmLaunchPlan) -> Kibibyte {
-  match p {
-    GroupArmLaunchPlanned { lines: _, profile: prof, master_endpoint: _ } => group_arm_memory_need(gpu_memory_utilization: prof.decided_gpu_memory_basis_points)
-    GroupArmLaunchRefused { causes: _ } => kibibyte(count: 0)
-  }
-}
-
-// ── THE DECLARED INCUMBENT (ruling of valiant-crab-775, 2026-10-02, cut 8 option A) ─────────────
-//
-// A SERVE THIS LAUNCH SUPERSEDES IS NAMED, NEVER DISCOVERED. Each row is a unit on a host, supplied by
-// whoever handed the hosts over (or, for staircase step N > 1, the arm's own units from step N - 1). No
-// pattern over `systemctl list-units` and no "whatever is running" may stand in for it: the bracket below
-// stops exactly these units and nothing else, so an undeclared occupant still refuses at admission and a
-// stray GPU process still refuses after the stop.
-//
-// THE THREE REQUIREMENTS THE RULING NAMES, AND WHERE EACH IS ENFORCED:
-//   - every other occupant still refuses -- group_arm_occupancy_causes: a host with no declared unit is
-//     judged exactly as before, and on a host with declared units any OTHER serving unit refuses;
-//   - the declared incumbent is read back running before it is stopped -- the same fold: each declared
-//     unit must appear in that host's reading as active, or the launch refuses;
-//   - on rollback the incumbent is restored and read back -- group_arm_restore_incumbent, which starts
-//     each declared unit and reads it back occupying (gunbc.spark.host_occupancy_admission
-//     restore_spark_serving_units, the same restore the pair vacate uses).
-// A GPU process cannot be attributed to a unit (gunbc.compute.host_occupancy's reader does not, by
-// ruling), so on a host with a declared incumbent the GPU processes are not judged before the stop: they
-// are judged AFTER it, by a fresh reading that must find the host vacant and its memory sufficient. A
-// process the stop did not end is therefore an undeclared occupant and refuses, with the incumbent
-// restored.
-type ArmIncumbentUnit {
-  host: HostIdentity
-  unit_name: NonEmptyStr
-}
-
-type ArmDeclaredIncumbent
-  = NoIncumbentDeclared
-  | IncumbentDeclared { units: List<ArmIncumbentUnit>, provenance: NonEmptyStr }
-
-fn incumbent_units(i: ArmDeclaredIncumbent) -> List<ArmIncumbentUnit> {
-  match i {
-    NoIncumbentDeclared => [] as List<ArmIncumbentUnit>
-    IncumbentDeclared { units: us, provenance: _ } => us
-  }
-}
-
-fn incumbent_units_on(i: ArmDeclaredIncumbent, host: HostIdentity) -> List<NonEmptyStr> {
-  map(filter(incumbent_units(i: i), u => (u.host as String) == (host as String)), u => u.unit_name)
-}
-
-fn incumbent_hosts(i: ArmDeclaredIncumbent, hosts: List<HostIdentity>) -> List<HostIdentity> {
-  filter(hosts, h => length(incumbent_units_on(i: i, host: h)) != 0)
-}
-
-// THE UNITS AN OCCUPANCY READING ASKS ABOUT: the Spark serving units every reading asks (the pair's and
-// the retired pair's), this arm's own two unit names, and every declared incumbent unit -- so a declared
-// unit is READ before it is trusted, and this arm's own units still running count as occupants.
-fn group_arm_read_units(units: ArmUnitIdentity, incumbent: ArmDeclaredIncumbent) -> List<NonEmptyStr> {
-  let base = concat(spark_serving_units(), [units.head_unit_name, units.rank_unit_name])
-  concat(base, filter(map(incumbent_units(i: incumbent), u => u.unit_name), n => !any(base, b => (b as String) == (n as String))))
-}
-
-// ── ADMISSION ─────────────────────────────────────────────────────────────────────────────────
-//
-// FOUR CONJUNCTS, EACH A REFUSAL WITH ITS OWN CAUSE.
-//   (1) THE AUTHORITY. The group's serving authority must be SuspendedForAuthorizedSuccessor with a live
-//       lease (gunbc.spark.pair_serving_authority pair_serving_successor_may_launch). Active, pending,
-//       fenced and released all refuse; an expired lease refuses to START (cleanup is another door).
-//   (2) THE SUCCESSOR IS THIS ONE. The authority's exact candidate realization must be keyed, and its key
-//       must be the launching arm's successor key. An arm with no keyed successor refuses by name: it has
-//       nothing a suspension could have been granted to.
-//   (3) EVERY HOST IS HELD BY THE SUBJECT (gunbc.spark.host_commitment admit_host_held_by_subject_among).
-//   (4) NO HOST IS OCCUPIED, except by its declared incumbent read back active (above). A host with no
-//       reading at all refuses: absence is not vacancy.
-// The arm may add its own causes (V4.1: the produced image's specification key must be its candidate's);
-// they are supplied, so this fold judges them without knowing what they are about.
-type ArmSuccessorStanding
-  = ArmSuccessorKeyed { key: ContentHash }
-  | ArmSuccessorUnkeyed { causes: List<String> }
-
-// ── THE SUCCESSOR KEY OF AN ARM WHOSE RUNTIME AND CHECKPOINT ARE ROWS ────────────────────────────
-//
-// WHAT A SUSPENSION IS GRANTED TO (ruling of valiant-crab-775, 2026-10-02): the arm's own identity --
-// the runtime artifact key (pin, source standing and patch set, gunbc.spark.serving_arm
-// runtime_artifact_key), the checkpoint's repository at its revision, the topology, the group, and the
-// launch profile's own key, which carries the staircase step's ceiling, its cold floor and its scheduler
-// gate. Composed by std.artifact_store artifact_realization_digest, the fold the V4.1 candidate is keyed
-// by (gunbc.spark.v41_runtime_candidate), so two arms differing in ANY of those are two successors and a
-// grant for one step never admits another. An arm whose runtime has no row, or whose artifact has no pin
-// (runtime_artifact_key renders an unpinned image as <unpinned:...>), has no key: an unpinned image is
-// not an identity a grant could name. V4.1's runtime is produced at run time and keys its candidate
-// through its own authority instead.
-fn realization_input(identity: String, value: String) -> ArtifactRealizationInput {
-  ArtifactRealizationInput { identity: identity as NonEmptyStr, content_digest: content_hash_atom(value: value as NonEmptyStr) }
-}
-
-fn group_arm_row_successor(inputs: GroupArmLaunchInputs) -> ArmSuccessorStanding {
-  let a = inputs.assignment
-  match serving_runtime_row(r: a.runtime) {
-    Absent => ArmSuccessorUnkeyed { causes: ["the runtime has no row, so it has no artifact identity to key a successor by"] }
-    Present { value: rt } => {
-      let rk = runtime_artifact_key(a: rt.artifact)
-      if starts_with(s: rk, prefix: "<unpinned:") {
-        ArmSuccessorUnkeyed { causes: [join(["the runtime artifact is unpinned (", rk, "), and an unpinned image is not an identity a grant could name"], "")] }
-      } else {
-        match serving_checkpoint_row(c: a.checkpoint) {
-          Absent => ArmSuccessorUnkeyed { causes: ["the checkpoint has no row, so it has no revision to key a successor by"] }
-          Present { value: ck } => ArmSuccessorKeyed { key: artifact_realization_digest(inputs: [
-            realization_input(identity: "runtime_artifact", value: rk),
-            realization_input(identity: "checkpoint", value: join([ck.repo.path as String, "@", ck.revision as String], "")),
-            realization_input(identity: "topology", value: serving_topology_wire(t: a.topology) as String),
-            realization_input(identity: "group", value: fabric_group_wire(g: a.group) as String),
-            realization_input(identity: "launch_profile", value: serving_launch_profile_key(p: inputs.profile)),
-            realization_input(identity: "deployment_env", value: serving_deployment_env_key(env: inputs.deployment_env)),
-          ]) }
-        }
-      }
-    }
-  }
-}
-
-fn arm_successor_wire(s: ArmSuccessorStanding) -> String {
-  match s {
-    ArmSuccessorKeyed { key: k } => join(["successor key: ", content_hash_text(h: k), "\n"], "")
-    ArmSuccessorUnkeyed { causes: c } => join(["successor key: NONE (", join(c, "; "), ")\n"], "")
-  }
-}
-
-type GroupArmHostOccupancy {
-  host: HostIdentity
-  admission: HostOccupancyAdmission
-  own_fence: ArmOwnFence
-}
-
-// WHETHER THIS ARM'S OWN TRANSACTION FENCE STANDS ON THE HOST (gunbc.spark.native_serving_apply
-// spark_native_fence_suffix on the arm's own unit paths) -- read, never inferred; unread is its own arm.
-type ArmOwnFence
-  = ArmOwnFenceHeld
-  | ArmOwnRollbackUnresolved
-  | ArmOwnFenceAbsent
-  | ArmOwnFenceUnread { cause: String }
-
-// ADMITTED FOR ADOPTION ONLY is its own verdict, not a loosened Admitted: a host whose only incumbent
-// problem is that a declared unit is INACTIVE UNDER THIS ARM'S OWN unresolved transaction fence (a launch
-// killed between apply and verdict, whose rank then died -- nvfp4-8, runs 37190290418 / 37198685584) is a
-// dangling transaction, and the only thing it licenses is the transaction's leftover-stage adoption:
-// resume at readback or roll back. It cannot reach a pre-apply, an incumbent stop or an apply leg; if the
-// leftover stage then finds nothing adoptable, the run refuses. A declared incumbent that is inactive with
-// no fence of this arm still refuses exactly as before.
-type GroupArmLaunchAdmission
-  = GroupArmLaunchAdmitted
-  | GroupArmLaunchAdmittedForAdoptionOnly { hosts: List<HostIdentity> }
-  | GroupArmLaunchAdmissionRefused { causes: List<String> }
-
-fn content_hash_text(h: ContentHash) -> String {
-  serialize_content_hash(hash: h) as String
-}
-
-// A RELEASED GROUP ADMITS A LAUNCH ONLY UNDER A STANDING GRANT THAT COVERS IT (operator ruling relayed
-// by valiant-crab-775, 2026-10-03). ReleasedToFleet means no pair-serving suspension exists to launch a
-// successor under, so the authority the launch acts under is the committed standing ruling
-// (gunbc.auth.standing_operator_grant), read from the one roster D0 already consumes
-// (gunbc.spark.pair_serving_d0 d0_standing_grants). It covers the launch only when a grant names
-// this group, the ArmLaunch effect and EVERY planned host; anything less refuses. The successor must
-// still be keyed, and every other wall (arm, hosts, incumbent, occupancy, memory) still applies.
-// THE GRANT COUNTS ONLY AS THE OPERATOR MERGED IT, exactly as D0's door honors it (gunbc.spark.
-// pair_serving_d0_door standing_grant_row_judged, review 74677): a grant row that is not byte-identical to
-// origin/main's covers nothing, and the launch refuses with the read's cause.
-// A LAUNCH IS ALWAYS A FRESH START: it has no frozen lifecycle to resume, so the row is judged against
-// origin/main at each launch's admission (gunbc.spark.pair_serving_d0_door fresh_grant_row_standing; D0
-// freezes the same judgement into its filing instead).
-
-fn group_arm_released_launch_causes(group: FabricGroup, hosts: List<HostIdentity>, grant_row: StandingGrantRowStanding) -> List<String> {
-  match grant_row {
-    StandingGrantRowNotOnMain { cause: c } => [join([group_label(g: group), " has been released to the fleet, and the standing grant is not honored: ", c], "")]
-    StandingGrantRowOnMain => group_arm_released_launch_coverage_causes(group: group, hosts: hosts)
-  }
-}
-
-fn group_arm_released_launch_coverage_causes(group: FabricGroup, hosts: List<HostIdentity>) -> List<String> {
-  if any(d0_standing_grants, g => standing_grant_covers(g: g, scope: StandingGrantFabricGroup { group: group, hosts: hosts }, effect: StandingArmLaunch)) {
-    [] as List<String>
-  } else {
-    [join([group_label(g: group), " has been released to the fleet and no standing grant covers an arm launch on every planned host (", join(map(hosts, h => h as String), ", "), "); there is no suspension to launch a successor under either"], "")]
-  }
-}
-
-fn group_arm_authority_causes(group: FabricGroup, hosts: List<HostIdentity>, authority: PairServingGroupAuthority?, successor: ArmSuccessorStanding, grant_row: StandingGrantRowStanding) -> List<String> {
-  let label = group_label(g: group)
-  match successor {
-    ArmSuccessorUnkeyed { causes: c } => map(c, x => join(["the launching arm has no keyed successor realization: ", x], ""))
-    ArmSuccessorKeyed { key: candidate } =>
-      match authority {
-        Absent => [join([label, " has no serving authority row; absence is not permission"], "")]
-        Present { value: a } =>
-          match a {
-            PairServingActive { group: _, exact_realization: _ } =>
-              [join([label, "'s serving authority is Active for the incumbent; a successor may launch only under SuspendedForAuthorizedSuccessor"], "")]
-            SuspensionPendingReconciliation { group: _, hosts: _, transaction: _, authorization_binding: _, lease: _ } =>
-              [join([label, "'s suspension is still pending reconciliation; D0 has not settled it to an authorized successor"], "")]
-            FencedRefusal { group: _, hosts: _, cause: c, disposition_authority: _ } =>
-              [join([label, " is fenced (", c as String, "); only cleanup may proceed"], "")]
-            ReleasedToFleet { group: _, release_receipt: _ } => group_arm_released_launch_causes(group: group, hosts: hosts, grant_row: grant_row)
-            SuspendedForAuthorizedSuccessor { group: _, hosts: _, authorization: _, exact_candidate_realization: r, lease: _, cleanup: _ } =>
-              concat(
-                if pair_serving_successor_may_launch(a: a) { [] as List<String> } else { ["the successor authorization's lease is not running as expected, so it may not START a launch (cleanup still may)"] },
-                match r {
-                  PairRealizationUnestablished { obligation: o } => [join(["the authorized successor realization is not keyed: ", o as String], "")]
-                  PairRealizationKeyed { key: k } =>
-                    if content_hash_equal(left: k, right: candidate) { [] as List<String> } else {
-                      [join(["the suspension authorizes successor ", content_hash_text(h: k), ", not this candidate ", content_hash_text(h: candidate)], "")]
-                    }
-                })
-          }
-      }
-  }
-}
-
-fn group_arm_host_causes(group: FabricGroup, hosts: List<HostIdentity>, held: List<HostIdentity>) -> List<String> {
-  flat_map(hosts, h => match admit_host_held_by_subject_among(raw: h, subject: PairServingUnitOn { group: group }, held: held) {
-    Absent => [] as List<String>
-    Present { value: why } => [why]
-  })
-}
-
-fn active_unit_named(occupants: List<HostOccupant>, unit: NonEmptyStr) -> Bool {
-  any(occupants, o => match o {
-    ServingUnitActive { unit: u, state: Active } => (u as String) == (unit as String)
-    ServingUnitActive { unit: _, state: _ } => false
-    GpuComputeProcess { pid: _, process_name: _, used: _ } => false
-  })
-}
-
-fn group_arm_incumbent_host_judged(purpose: String, h: HostIdentity, declared: List<NonEmptyStr>, occupants: List<HostOccupant>) -> List<String> {
-  let not_running = flat_map(declared, u => if active_unit_named(occupants: occupants, unit: u) { [] as List<String> } else {
-    [join([h as String, ": the declared incumbent ", u as String, " is not read back active, so it is not the serve this launch was told it supersedes; ", purpose, " is not admitted"], "")]
-  })
-  let undeclared = flat_map(occupants, o => match o {
-    ServingUnitActive { unit: u, state: _ } =>
-      if any(declared, d => (d as String) == (u as String)) { [] as List<String> } else {
-        [join([h as String, " is occupied by an undeclared serving unit (", host_occupant_wire(o: o), "), so ", purpose, " is not admitted"], "")]
-      }
-    GpuComputeProcess { pid: _, process_name: _, used: _ } => [] as List<String>
-  })
-  concat(not_running, undeclared)
-}
-
-fn group_arm_incumbent_host_causes(purpose: String, h: HostIdentity, declared: List<NonEmptyStr>, a: HostOccupancyAdmission) -> List<String> {
-  match a {
-    HostOccupancyNotRead { cause: c } => [join([h as String, " could not be read for occupancy, so its declared incumbent was not read back and ", purpose, " is not admitted: ", c], "")]
-    HostOccupiedBy { occupant: o, others: rest, gpu_used: _ } => group_arm_incumbent_host_judged(purpose: purpose, h: h, declared: declared, occupants: concat([o], rest))
-    HostUnoccupied { available: _ } => group_arm_incumbent_host_judged(purpose: purpose, h: h, declared: declared, occupants: [] as List<HostOccupant>)
-    HostMemoryShort { available: _, need: _ } => group_arm_incumbent_host_judged(purpose: purpose, h: h, declared: declared, occupants: [] as List<HostOccupant>)
-  }
-}
-
-fn group_arm_host_dangling_under_own_fence(h: HostIdentity, declared: List<NonEmptyStr>, o: GroupArmHostOccupancy) -> Bool {
-  let occupants = match o.admission {
-    HostOccupiedBy { occupant: x, others: rest, gpu_used: _ } => concat([x], rest)
-    HostUnoccupied { available: _ } => [] as List<HostOccupant>
-    HostMemoryShort { available: _, need: _ } => [] as List<HostOccupant>
-    HostOccupancyNotRead { cause: _ } => [] as List<HostOccupant>
-  }
-  let read = match o.admission {
-    HostOccupancyNotRead { cause: _ } => false
-    HostOccupiedBy { occupant: _, others: _, gpu_used: _ } => true
-    HostUnoccupied { available: _ } => true
-    HostMemoryShort { available: _, need: _ } => true
-  }
-  let held = match o.own_fence {
-    ArmOwnFenceHeld => true
-    ArmOwnRollbackUnresolved => false
-    ArmOwnFenceAbsent => false
-    ArmOwnFenceUnread { cause: _ } => false
-  }
-  read && held && length(declared) > 0
-    && any(declared, u => !active_unit_named(occupants: occupants, unit: u))
-    && length(group_arm_incumbent_host_judged(purpose: "", h: h, declared: declared, occupants: occupants)) == count(filter(declared, u => !active_unit_named(occupants: occupants, unit: u)))
-}
-
-fn group_arm_adoption_hosts(hosts: List<HostIdentity>, occupancy: List<GroupArmHostOccupancy>, incumbent: ArmDeclaredIncumbent) -> List<HostIdentity> {
-  filter(hosts, h => match first(filter(occupancy, o => (o.host as String) == (h as String))) {
-    Absent => false
-    Present { value: o } =>
-      group_arm_host_dangling_under_own_fence(h: h, declared: incumbent_units_on(i: incumbent, host: h), o: o)
-        || (match o.own_fence {
-              ArmOwnRollbackUnresolved => true
-              ArmOwnFenceHeld => false
-              ArmOwnFenceAbsent => false
-              ArmOwnFenceUnread { cause: _ } => false
-            })
-  })
-}
-
-fn group_arm_occupancy_causes(purpose: String, hosts: List<HostIdentity>, occupancy: List<GroupArmHostOccupancy>, incumbent: ArmDeclaredIncumbent) -> List<String> {
-  flat_map(hosts, h => match first(filter(occupancy, o => (o.host as String) == (h as String))) {
-    Absent => [join(["no occupancy reading was supplied for ", h as String, ", so ", purpose, " is not admitted"], "")]
-    Present { value: o } => {
-      let declared = incumbent_units_on(i: incumbent, host: h)
-      if group_arm_host_dangling_under_own_fence(h: h, declared: declared, o: o) {
-        [] as List<String>
-      } else if length(declared) == 0 {
-        match host_occupancy_refusal(host: h as String, purpose: purpose, a: o.admission) {
-          Absent => [] as List<String>
-          Present { value: why } => [why]
-        }
-      } else {
-        group_arm_incumbent_host_causes(purpose: purpose, h: h, declared: declared, a: o.admission)
-      }
-    }
-  })
-}
-
-// A DECLARED INCUMBENT ON A HOST THE PLAN DOES NOT LAUNCH ON IS A DECLARATION THAT DOES NOT FIT THIS
-// LAUNCH: stopping it would be an effect nothing here owes, so it refuses rather than being ignored.
-fn group_arm_incumbent_roster_causes(hosts: List<HostIdentity>, incumbent: ArmDeclaredIncumbent) -> List<String> {
-  flat_map(incumbent_units(i: incumbent), u =>
-    if any(hosts, h => (h as String) == (u.host as String)) { [] as List<String> } else {
-      [join(["the declared incumbent ", u.unit_name as String, " is on ", u.host as String, ", which this launch does not run on"], "")]
-    })
-}
-
-fn group_arm_launch_admission(
-  group: FabricGroup,
-  purpose: NonEmptyStr,
-  plan: GroupArmLaunchPlan,
-  authority: PairServingGroupAuthority?,
-  successor: ArmSuccessorStanding,
-  arm_causes: List<String>,
-  held: List<HostIdentity>,
-  occupancy: List<GroupArmHostOccupancy>,
-  incumbent: ArmDeclaredIncumbent,
-  grant_row: StandingGrantRowStanding,
-) -> GroupArmLaunchAdmission {
-  match plan {
-    GroupArmLaunchRefused { causes: c } => GroupArmLaunchAdmissionRefused { causes: map(c, x => join(["the plan refused: ", x], "")) }
-    GroupArmLaunchPlanned { lines: ls, profile: _, master_endpoint: _ } => {
-      let hosts = map(ls, l => l.node.host)
-      let causes = concat(concat(concat(concat(
-        group_arm_authority_causes(group: group, hosts: hosts, authority: authority, successor: successor, grant_row: grant_row),
-        arm_causes),
-        group_arm_host_causes(group: group, hosts: hosts, held: held)),
-        group_arm_incumbent_roster_causes(hosts: hosts, incumbent: incumbent)),
-        group_arm_occupancy_causes(purpose: purpose as String, hosts: hosts, occupancy: occupancy, incumbent: incumbent))
-      let dangling = group_arm_adoption_hosts(hosts: hosts, occupancy: occupancy, incumbent: incumbent)
-      if length(causes) > 0 { GroupArmLaunchAdmissionRefused { causes: causes } }
-      else if length(dangling) > 0 { GroupArmLaunchAdmittedForAdoptionOnly { hosts: dangling } }
-      else { GroupArmLaunchAdmitted }
-    }
-  }
-}
-
-fn group_label(g: FabricGroup) -> String {
-  join(["fabric ", fabric_group_wire(g: g) as String], "")
-}
-
-// THE LIVE AUTHORITY IS THE LOG'S, exactly as gunbc.spark.pair_serving_apply spark_pair_apply_plan_current
-// reads it: an unread authority refuses with the read's cause, and never falls back to the source row.
-fn group_arm_launch_admission_live(
-  group: FabricGroup,
-  purpose: NonEmptyStr,
-  plan: GroupArmLaunchPlan,
-  successor: ArmSuccessorStanding,
-  arm_causes: List<String>,
-  occupancy: List<GroupArmHostOccupancy>,
-  incumbent: ArmDeclaredIncumbent,
-) -> GroupArmLaunchAdmission {
-  let held = spark_serving_admissible_hosts(subject: PairServingUnitOn { group: group })
-  let grant_row = fresh_grant_row_standing(executed: executed_grant_row())
-  match observe_executor_reach() {
-    ExecutorReachUnknown { cause: c } => GroupArmLaunchAdmissionRefused { causes: [join(["the executor could not be identified, so the group's authority log could not be read: ", c], "")] }
-    ExecutorReachKnown { short_hostname: executor, path: _ } =>
-      match now_epoch_seconds() {
-        Absent => GroupArmLaunchAdmissionRefused { causes: ["the clock could not be read, so the authority's lease standing cannot be derived"] }
-        Present { value: at } =>
-          match current_authority_for(current: current_pair_serving_authorities(short_hostname: executor, at: at), group: group) {
-            Absent => group_arm_launch_admission(group: group, purpose: purpose, plan: plan, authority: none, successor: successor, arm_causes: arm_causes, held: held, occupancy: occupancy, incumbent: incumbent, grant_row: grant_row)
-            Present { value: c } =>
-              match c {
-                CurrentAuthorityUnread { group: _, step: _, reason: _ } =>
-                  GroupArmLaunchAdmissionRefused { causes: [join(["the group's serving authority could not be read: ", current_authority_wire(c: c)], "")] }
-                CurrentAuthorityRead { authority: a, head: _, generation: _, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } =>
-                  group_arm_launch_admission(group: group, purpose: purpose, plan: plan, authority: Present { value: a }, successor: successor, arm_causes: arm_causes, held: held, occupancy: occupancy, incumbent: incumbent, grant_row: grant_row)
-              }
-          }
-      }
-  }
-}
-
-// THE DRY RUN REACHES NO HOST, SO IT HAS NO OCCUPANCY READING, and says so per host rather than
-// assuming vacancy.
-fn group_arm_dry_run_occupancy(group: FabricGroup) -> List<GroupArmHostOccupancy> {
-  map(fabric_group_hosts(g: group), h => GroupArmHostOccupancy {
-    host: h,
-    admission: HostOccupancyNotRead { cause: "the dry run reaches no host; a launch reads occupancy on each host before it starts" },
-    own_fence: ArmOwnFenceUnread { cause: "the dry run reaches no host" },
-  })
-}
-
-// ── THE DRY-RUN REPORT ──────────────────────────────────────────────────────────────────────────
-//
-// EVERY HOST'S UNIT AND CONTAINER LINE, THE ARM'S OWN PRE-APPLY WORK FOR THAT HOST (V4.1: its Engram
-// staging), AND THE APPLY'S PREFLIGHT AND APPLY SCRIPTS -- what a wet runner would send, in the order it
-// would send it -- then the declared incumbent and the admission verdict.
-type ArmPreApplyWire {
-  label: NonEmptyStr
-  text: String
-}
-
-fn incumbent_wire(i: ArmDeclaredIncumbent) -> String {
-  match i {
-    NoIncumbentDeclared => "incumbent: none declared (every occupied host refuses)\n"
-    IncumbentDeclared { units: us, provenance: p } =>
-      join(["incumbent: declared by ", p as String, "\n", join(map(us, u => join(["  - ", u.unit_name as String, " on ", u.host as String, "\n"], "")), "")], "")
-  }
-}
-
-fn group_arm_dry_run_report(title: String, intent: ArmIntent, units: ArmUnitIdentity, plan: GroupArmLaunchPlan, pre_apply: List<ArmPreApplyWire>, incumbent: ArmDeclaredIncumbent, admission: GroupArmLaunchAdmission) -> String {
-  let verdict = match admission {
-    GroupArmLaunchAdmitted => "ADMITTED"
-    GroupArmLaunchAdmittedForAdoptionOnly { hosts: hs } => join(["ADMITTED FOR ADOPTION ONLY (a dangling transaction of this arm under its own fence on ", join(map(hs, h => h as String), ", "), "): the leftover stage may resume or roll it back; no apply leg is reachable"], "")
-    GroupArmLaunchAdmissionRefused { causes: c } => join(["REFUSED\n", join(map(c, x => join(["  - ", x], "")), "\n")], "")
-  }
-  let pre = join(map(pre_apply, w => join(["--- ", w.label as String, "\n", w.text, "\n"], "")), "")
-  let body = match plan {
-    GroupArmLaunchRefused { causes: c } => join(["plan: REFUSED\n", join(map(c, x => join(["  - ", x], "")), "\n")], "")
-    GroupArmLaunchPlanned { lines: ls, profile: prof, master_endpoint: e } =>
-      match group_arm_steps(intent: intent, units: units, p: plan) {
-        NativeArmStepsRefused { cause: c } => join(["plan: UNITS DID NOT RENDER: ", c as String], "")
-        NativeArmSteps { steps: steps, master_endpoint: _ } =>
-          join([
-            "plan: ", to_string(length(ls)), " ranks, rendezvous ", e as String,
-            ", max_num_seqs ", to_string(prof.max_num_seqs), " over ", to_string(prof.guaranteed_cold_seqs), " guaranteed cold seats\n",
-            join(zip_map(a: steps, b: zip_map(a: spark_native_preflight_plans(steps: steps), b: map(steps, st => spark_native_apply_step_wire(st: st)), f: fn(pf, ap) { join([pre, "--- preflight\n", pf.script, "\n--- apply\n", ap], "") }), f: fn(st, scripts) {
-              join([
-                "=== host ", st.host as String, " rank ", to_string(st.launch.node.node_rank), " unit ", st.unit_name as String, "\n",
-                "--- create\n", join(concat([st.launch.create.program.invocation as String], st.launch.create.arguments), " "), "\n",
-                "--- unit\n", st.unit_text, "\n",
-                scripts, "\n",
-              ], "")
-            }), "\n"),
-          ], "")
-      }
-  }
-  join([title, " -- DRY RUN (no host is touched)\n", body, "\n", incumbent_wire(i: incumbent), "admission: ", verdict, "\n"], "")
-}
-
-// ── THE INCUMBENT BRACKET AROUND THE ARM TRANSACTION ──────────────────────────────────────────
-//
-// STOP, RE-READ, APPLY, AND RESTORE ON ANYTHING BUT A COMMIT. The declared units are stopped (never
-// disabled, never masked: the transaction must be able to put them back), each incumbent host is read
-// again and must be VACANT with its memory sufficient, and only then does the arm transaction run. A
-// failed stop or a host the stop did not vacate restores the declared units and refuses with no arm
-// unit touched. After the transaction: a commit leaves the incumbent stopped (it is superseded; the
-// receipt says it stays ENABLED, so a reboot would start it -- the follow-up that disables it needs a
-// SystemctlDisable operation gunbc.host_operation_exec does not model yet); a refusal before actuation
-// or an accepted rollback restores the declared units and reads each back; an UNESTABLISHED disposition
-// restores nothing, because nothing read whether the successor still holds the GPUs, and starting the
-// incumbent beside it is the one move that could make a split arm worse.
-type GroupArmIncumbentStop
-  = IncumbentVacated { receipt: String }
-  | IncumbentNotVacated { receipt: String }
-
-fn group_arm_host_run(ctx: SparkMaterializeContext, h: HostIdentity) -> fn(List<String>) -> ArgvRun {
-  spark_ctx_argv_run(ctx: vllm_image_target_ctx(source_ctx: ctx, host: h))
-}
-
-fn group_arm_restore_incumbent(ctx: SparkMaterializeContext, incumbent: ArmDeclaredIncumbent, hosts: List<HostIdentity>) -> String {
-  join(map(incumbent_hosts(i: incumbent, hosts: hosts), h => match restore_spark_serving_units(run: group_arm_host_run(ctx: ctx, h: h), units: incumbent_units_on(i: incumbent, host: h)) {
-    Absent => join(["incumbent restore host=", h as String, ": every declared unit started and read back occupying\n"], "")
-    Present { value: why } => join(["incumbent restore host=", h as String, " INCOMPLETE: ", why, "\n"], "")
-  }), "")
-}
-
-fn group_arm_stop_incumbent(ctx: SparkMaterializeContext, incumbent: ArmDeclaredIncumbent, hosts: List<HostIdentity>, units: ArmUnitIdentity, need: Kibibyte) -> GroupArmIncumbentStop {
-  let ih = incumbent_hosts(i: incumbent, hosts: hosts)
-  let stop_failures = flat_map(ih, h => flat_map(incumbent_units_on(i: incumbent, host: h), u =>
-    match host_operation_leg(run: group_arm_host_run(ctx: ctx, h: h), operation: SystemctlStop { unit: u }, accepted_exits: [0]) {
-      HostOperationLegRead { stdout: _ } => [] as List<String>
-      HostOperationLegUnread { cause: c } => [join([h as String, ": stopping ", u as String, " failed: ", c], "")]
-    }))
-  let stopped_line = join(map(ih, h => join(["incumbent stop host=", h as String, " units=", join(map(incumbent_units_on(i: incumbent, host: h), u => u as String), ","), "\n"], "")), "")
-  if length(stop_failures) != 0 {
-    IncumbentNotVacated { receipt: join([stopped_line, "incumbent stop FAILED: ", join(stop_failures, "; "), "\n", group_arm_restore_incumbent(ctx: ctx, incumbent: incumbent, hosts: hosts)], "") }
-  } else {
-    let after = flat_map(ih, h => match host_occupancy_refusal(
-      host: h as String,
-      purpose: "the launch after its declared incumbent stopped",
-      a: admit_host_occupancy(reading: read_host_occupancy(run: group_arm_host_run(ctx: ctx, h: h), units: group_arm_read_units(units: units, incumbent: incumbent)), need: need)) {
-        Absent => [] as List<String>
-        Present { value: why } => [why]
-      })
-    if length(after) != 0 {
-      IncumbentNotVacated { receipt: join([stopped_line, "the hosts were NOT vacant after the declared incumbent stopped, so an undeclared occupant remains:\n", join(map(after, x => join(["  - ", x, "\n"], "")), ""), group_arm_restore_incumbent(ctx: ctx, incumbent: incumbent, hosts: hosts)], "") }
-    } else {
-      IncumbentVacated { receipt: join([stopped_line, "every incumbent host read back vacant after the stop\n"], "") }
-    }
-  }
-}
-
-// THE ARM'S OWN PRE-APPLY WORK (V4.1: the SM120 self-test and the Engram staging). It runs after
-// admission and before the incumbent is touched, so a refusal here leaves every host exactly as it was.
-type ArmPreApply
-  = ArmPreApplyPassed { receipt: String }
-  | ArmPreApplyStopped { receipt: String }
-
-// THE SESSION'S ACTUATING HALF: everything after admission. The caller has read, planned and admitted;
-// this runs the arm's pre-apply, the incumbent bracket and the transaction, and is the only place either
-// arm reaches a serving unit.
-fn group_arm_apply_admitted(
-  intent: ArmIntent,
-  units: ArmUnitIdentity,
-  plan: GroupArmLaunchPlan,
-  incumbent: ArmDeclaredIncumbent,
-  context: FleetSshExecutionContext,
-  ctx: SparkMaterializeContext,
-  now_word: String,
-  pre_apply: fn(List<SparkNativeHostStep>) -> ArmPreApply,
-) -> SparkBuildHostWork {
-  match group_arm_steps(intent: intent, units: units, p: plan) {
-    NativeArmStepsRefused { cause: c } => SparkBuildHostWork { receipt: join(["NOT LAUNCHED: the units did not render: ", c as String, "\n"], ""), converged: false }
-    NativeArmSteps { steps: steps, master_endpoint: _ } =>
-      match pre_apply(steps) {
-        ArmPreApplyStopped { receipt: r } => SparkBuildHostWork { receipt: join([r, "NOT LAUNCHED: the arm's pre-apply stopped; the incumbent was not touched and no serving unit was touched\n"], ""), converged: false }
-        ArmPreApplyPassed { receipt: r } => {
-          let hosts = map(steps, st => st.host)
-          match group_arm_stop_incumbent(ctx: ctx, incumbent: incumbent, hosts: hosts, units: units, need: group_arm_plan_memory_need(p: plan)) {
-            IncumbentNotVacated { receipt: s } => SparkBuildHostWork { receipt: join([r, s, "NOT LAUNCHED: the hosts were not vacated; no arm unit was touched\n"], ""), converged: false }
-            IncumbentVacated { receipt: s } => {
-              let run = spark_native_apply_transaction(context: context, trust: ctx.trust, path: ctx.path, administrator: ctx.admin_credential, steps: steps, at_word: now_word, adoption_only: false)
-              let after = if run.committed {
-                match incumbent {
-                  NoIncumbentDeclared => ""
-                  IncumbentDeclared { units: _, provenance: _ } => "the declared incumbent stays STOPPED (superseded) and ENABLED: a reboot would start it\n"
-                }
-              } else if group_arm_transaction_left_unestablished(body: run.body) {
-                "the arm's disposition is UNESTABLISHED, so the declared incumbent was NOT restarted beside it; read the arm first\n"
-              } else {
-                group_arm_restore_incumbent(ctx: ctx, incumbent: incumbent, hosts: hosts)
-              }
-              SparkBuildHostWork { receipt: join([r, s, run.body, after], ""), converged: run.committed }
-            }
-          }
-        }
-      }
-  }
-}
-
-// THE ADOPTION-ONLY PATH: no pre-apply, no incumbent stop, no incumbent restore -- the transaction alone,
-// told it may only adopt. Its outcome is the adopted transaction's (resume or rollback) or a refusal.
-fn group_arm_adopt_dangling(intent: ArmIntent, units: ArmUnitIdentity, plan: GroupArmLaunchPlan, context: FleetSshExecutionContext, ctx: SparkMaterializeContext, now_word: String) -> SparkBuildHostWork {
-  match group_arm_steps(intent: intent, units: units, p: plan) {
-    NativeArmStepsRefused { cause: c } => SparkBuildHostWork { receipt: join(["NOT ADOPTED: the units did not render: ", c as String, "\n"], ""), converged: false }
-    NativeArmSteps { steps: steps, master_endpoint: _ } => {
-      let run = spark_native_apply_transaction(context: context, trust: ctx.trust, path: ctx.path, administrator: ctx.admin_credential, steps: steps, at_word: now_word, adoption_only: true)
-      SparkBuildHostWork { receipt: run.body, converged: run.committed }
-    }
-  }
-}
-
-// THE TRANSACTION'S HEADLINE IS ITS OUTCOME'S OWN WORDING (gunbc.spark.native_serving_apply
-// spark_native_transaction_headline), and the unestablished arm is the one whose headline says so.
-fn group_arm_transaction_left_unestablished(body: String) -> Bool {
-  starts_with(s: body, prefix: "spark native serving apply left the arm's DISPOSITION UNESTABLISHED")
-}
-
-// THE WET OCCUPANCY READ, ONE PER PLANNED HOST, over the units group_arm_read_units names and against the
-// plan's own memory need -- read through the session's privileged leg to each host.
-fn group_arm_read_occupancy(ctx: SparkMaterializeContext, hosts: List<HostIdentity>, units: ArmUnitIdentity, incumbent: ArmDeclaredIncumbent, need: Kibibyte) -> List<GroupArmHostOccupancy> {
-  map(hosts, h => GroupArmHostOccupancy {
-    host: h,
-    admission: admit_host_occupancy(reading: read_host_occupancy(run: group_arm_host_run(ctx: ctx, h: h), units: group_arm_read_units(units: units, incumbent: incumbent)), need: need),
-    own_fence: group_arm_read_own_fence(run: group_arm_host_run(ctx: ctx, h: h), units: units),
-  })
-}
-
-fn group_arm_read_own_fence(run: fn(List<String>) -> ArgvRun, units: ArmUnitIdentity) -> ArmOwnFence {
-  let paths = map([units.head_unit_name, units.rank_unit_name], u => join([spark_native_unit_path(unit_name: u), spark_native_fence_suffix], ""))
-  let markers = map([units.head_unit_name, units.rank_unit_name], u => join([spark_native_unit_path(unit_name: u), spark_native_unresolved_rollback_suffix], ""))
-  match run(["sh", "-c", join(["for f in ", join(paths, " "), "; do if [ -e \"$f\" ]; then echo own-fence=held; exit 0; fi; done; for f in ", join(markers, " "), "; do if [ -e \"$f\" ]; then echo own-fence=rollback-unresolved; exit 0; fi; done; echo own-fence=absent"], "")]) {
-    ArgvLegDidNotRun { cause: c } => ArmOwnFenceUnread { cause: c }
-    ArgvLegMayHaveRun { cause: c } => ArmOwnFenceUnread { cause: join(["the fence read was sent and its result never arrived (unread, not absent): ", c], "") }
-    ArgvRan { exit_code: code, stdout: out, stderr: err } =>
-      if code != 0 { ArmOwnFenceUnread { cause: join(["exit ", to_string(code), ": ", trim(s: err)], "") } }
-      else if string_contains(s: out, pattern: "own-fence=held") { ArmOwnFenceHeld }
-      else if string_contains(s: out, pattern: "own-fence=rollback-unresolved") { ArmOwnRollbackUnresolved }
-      else if string_contains(s: out, pattern: "own-fence=absent") { ArmOwnFenceAbsent }
-      else { ArmOwnFenceUnread { cause: "the fence read printed neither answer" } }
-  }
-}
-
-// ── THE ENTRIES: ONE DRY PLAN AND ONE WET LAUNCH, WHATEVER THE ARM ────────────────────────────
-//
-// AN ARM HANDS IN WHAT IT IS AND HOW TO RUN ITS SESSION; the entry selects the session host, opens the
-// privileged session, writes the receipt and decides the exit. The paths are the CALLER's (the workflow
-// mode's), so one mode's receipt is one file whichever arm it ran.
-type ArmDryPlan {
-  report: String
-  admission: GroupArmLaunchAdmission
-}
-
-fn group_arm_dry_plan_write(title: String, plan: ArmDryPlan, path: String) -> ProcessExit {
-  let w = Filesystem.Write(path: path, content: plan.report)
-  if !w.success {
-    exit_failure(reason: join([title, " dry plan: the report could not be written: ", w.error], ""))
-  } else {
-    match plan.admission {
-      GroupArmLaunchAdmitted => ExitSuccess
-      GroupArmLaunchAdmittedForAdoptionOnly { hosts: _ } => ExitSuccess
-      GroupArmLaunchAdmissionRefused { causes: c } => exit_failure(reason: join([title, " dry plan: not admitted (report at ", path, "): ", join(c, "; ")], ""))
-    }
-  }
-}
-
-type ArmWetSession {
-  title: NonEmptyStr
-  group: FabricGroup
-  attempt_raw: String
-  identity_file_name: NonEmptyStr
-  session: fn(String, FleetSshExecutionContext, SparkMaterializeContext) -> SparkBuildHostWork
-}
-
-// THE WET ENTRY. SPARK_CONVERGE_TARGET names only the SESSION host -- where host-local reads run and the
-// host the administrator credential step resolves for -- and it must be a host the group's serving
-// subject holds; unset refuses rather than choosing. Every other host is reached over the same
-// privileged edge. Exit zero means the arm COMMITTED: every rank read back and the head's front door
-// serving this arm's model.
-fn group_arm_launch_wet(arm: ArmWetSession, receipt_path: String) -> ProcessExit
-{
-  let now = clock_now_probed_at()
-  let now_word = probed_at_word(reading: now) as String
-  match spark_converge_target_selection(execute_apply: true) {
-    SparkConvergeTargetRefused { reason: why } => exit_failure(reason: why)
-    SparkConvergeTargetAllObserveOnly =>
-      exit_failure(reason: join(["SPARK_CONVERGE_TARGET is unset: ", arm.title as String, " needs one host of its group to open its session on, and it refuses rather than choosing one"], ""))
-    SparkConvergeTargetSingle { host: session_host } =>
-      match admit_host_held_by_subject(raw: session_host, subject: PairServingUnitOn { group: arm.group }) {
-        Present { value: why } => exit_failure(reason: why)
-        Absent =>
-          match with_spark_build_host(
-            host: session_host,
-            attempt_raw: arm.attempt_raw,
-            identity_file_name: arm.identity_file_name,
-            use: fn(target, context, ctx) { arm.session(now_word, context, ctx) },
-          ) {
-            SparkBuildHostRefused { cause: c } => exit_failure(reason: c)
-            SparkBuildHostRan { work: work, endpoint: endpoint, executor: executor, trust_receipt: trust_receipt } => {
-              let body = join([
-                join([arm.title as String, " probed_at=", now_word, " session_host=", session_host as String, " endpoint=", endpoint as String, " executor=", executor, "\n"], ""),
-                trust_receipt,
-                work.receipt,
-              ], "")
-              let w = Filesystem.Write(path: receipt_path, content: body)
-              if !w.success {
-                exit_failure(reason: join([arm.title as String, " receipt write failed (the launch's own outcome is below and is NOT changed by this): ", w.error, "\n", body], ""))
-              } else if work.converged {
-                ExitSuccess
-              } else {
-                exit_failure(reason: join([arm.title as String, " did not commit:\n", body], ""))
-              }
-            }
-          }
-      }
-  }
-}
-
-// ── THE READ-ONLY OBSERVATION OF A GROUP'S OCCUPANCY (ruling of valiant-crab-775, 2026-10-03) ──────
-//
-// WHY IT EXISTS. A declared incumbent is a typed input, never discovered at launch. When nobody can
-// hand the declaration over (the session that launched Group A's old serve was archived), the
-// declaration is RECORDED from an observation instead: this read lists, per host, every running
-// service unit, every running container, every GPU compute process and the cgroup that owns it -- so
-// a process is attributed to its unit or container by the kernel's own record -- and changes
-// nothing. A person reads the receipt and writes the incumbent row citing it; the launch never reads
-// this. Every leg that did not run says so: an unread host is reported, never listed as empty.
-fn observe_leg(ctx: SparkMaterializeContext, what: String, argv: List<String>) -> String {
-  match spark_remote_run(ctx: ctx, argv: argv) {
-    RemoteUnreachable { cause: c, reach: _ } => join(["  ", what, ": NOT READ (", c, ")\n"], "")
-    RemoteRan { exit_code: code, stdout: out, stderr: err } =>
-      if code != 0 { join(["  ", what, ": NOT READ (exit ", to_string(code), ": ", trim(s: err), ")\n"], "") }
-      else { join(["  ", what, ":\n", join(map(filter(split(out, "\n"), l => trim(s: l) != ""), l => join(["    ", l, "\n"], "")), "")], "") }
-  }
-}
-
-fn running_unit_lines(ctx: SparkMaterializeContext) -> String {
-  match spark_remote_run(ctx: ctx, argv: systemctl_list_all_service_units_argv()) {
-    RemoteUnreachable { cause: c, reach: _ } => join(["  running service units: NOT READ (", c, ")\n"], "")
-    RemoteRan { exit_code: code, stdout: out, stderr: err } =>
-      if code != 0 { join(["  running service units: NOT READ (exit ", to_string(code), ": ", trim(s: err), ")\n"], "") }
-      else { join(["  running service units:\n", join(map(filter(split(out, "\n"), l => string_contains(s: l, pattern: " running ")), l => join(["    ", trim(s: l), "\n"], "")), "")], "") }
-  }
-}
-
-fn gpu_process_lines(ctx: SparkMaterializeContext, h: HostIdentity) -> String {
-  let run = group_arm_host_run(ctx: ctx, h: h)
-  match host_operation_leg(run: run, operation: NvidiaSmiQueryComputeApps, accepted_exits: [0]) {
-    HostOperationLegUnread { cause: c } => join(["  gpu compute processes: NOT READ (", c, ")\n"], "")
-    HostOperationLegRead { stdout: text } =>
-      match parse_compute_apps(text: text) {
-        ComputeAppsUnparsed { line: l } => join(["  gpu compute processes: UNPARSED row `", l, "`\n"], "")
-        ComputeAppsParsed { apps: apps } =>
-          join(["  gpu compute processes: ", to_string(length(apps)), "\n", join(map(apps, a => join([
-            "    pid ", to_string(a.pid), " (", a.process_name, ") ", host_occupant_wire(o: GpuComputeProcess { pid: a.pid, process_name: a.process_name, used: a.used }), "\n",
-            match host_operation_leg(run: run, operation: ProcfsReadPidCgroup { pid: to_string(a.pid) as NonEmptyStr }, accepted_exits: [0]) {
-              HostOperationLegUnread { cause: c } => join(["      cgroup: NOT READ (", c, ")\n"], "")
-              HostOperationLegRead { stdout: cg } => join(["      cgroup: ", trim(s: cg), "\n"], "")
-            },
-          ], "")), "")], "")
-      }
-  }
-}
-
-fn group_arm_host_observation(ctx: SparkMaterializeContext, h: HostIdentity) -> String {
-  let c = vllm_image_target_ctx(source_ctx: ctx, host: h)
-  join([
-    "=== host ", h as String, "\n",
-    running_unit_lines(ctx: c),
-    observe_leg(ctx: c, what: "running containers", argv: argv_words(command: docker_ps_running_all_command())),
-    gpu_process_lines(ctx: ctx, h: h),
-    group_host_link_health(ctx: c, h: h),
-    checkpoint_cache_bytes_lines(ctx: c),
-    if host_identity_eq(a: h, b: ctx.host) { join([group_arm_engine_capacity_lines(ctx: c), group_arm_runtime_source_lines(ctx: c)], "") } else { "" },
-  ], "")
-}
-
-// THE RUNNING ENGINE'S OWN CAPACITY REPORT, read-only, on the session host: its /metrics cache_config_info
-// (num_gpu_blocks, block_size, kv_cache_size_tokens, kv_cache_max_concurrency) and the startup lines the
-// engine logged into the arm's declared head log (KV cache size, maximum concurrency, cudagraph capture
-// sizes, time to ready). One reading per incarnation; the ceiling sweep records one per launch.
-fn group_arm_engine_capacity_lines(ctx: SparkMaterializeContext) -> String {
-  join([
-    observe_leg(ctx: ctx, what: "engine cache_config_info (this incarnation)", argv: ["sh", "-c", join(["curl -fsS --max-time 20 http://127.0.0.1:", to_string(spark_pair_serve_port), "/metrics | grep -E '^vllm:cache_config_info|^vllm:num_requests_running|^vllm:kv_cache_usage_perc'"], "")]),
-    observe_leg(ctx: ctx, what: "host memory now (GB10 unified memory: free, available, page cache)", argv: ["sh", "-c", "grep -E '^(MemTotal|MemFree|MemAvailable|Cached|Buffers|SwapTotal|SwapFree):' /proc/meminfo"]),
-    observe_leg(ctx: ctx, what: "engine KV allocation plan, this incarnation's LAST startup record (head log)", argv: ["sh", "-c", join(["grep -a 'KV_ALLOCATION_PLAN_JSON ' ", glm53_staircase_head_log_path as String, " | tail -1"], "")]),
-    observe_leg(ctx: ctx, what: "engine startup capacity lines (head log)", argv: ["sh", "-c", join(["grep -aE 'GPU KV cache size|Maximum concurrency|Graph capturing finished|init engine|Available KV cache memory|Model loading took|Memory profiling takes|memory profiling|total_gpu_memory|free memory|torch peak memory|non-torch|cuda graph|requested memory|weights memory|KV cache memory' ", glm53_staircase_head_log_path as String, " | tail -40"], "")]),
-  ], "")
-}
-
-// THE PINNED RUNTIME'S OWN SOURCES, read-only, on the session host only. The admission read (scheduler,
-// KV cache manager/coordinator, metrics, warmup) was taken by run 37205174435; this set reads what a
-// high max_num_seqs costs in this image -- cudagraph capture sizes, persistent batch buffers, the
-// runner's per-sequence allocations and the worker's memory profile -- before any ceiling is proposed. `python3 -m inspect <module>` in a
-// throwaway container of the Group A runtime's pinned digest prints the module's source -- no GPU, no
-// running arm, no quoting. What the capacity plan cites is read from here, never from memory of
-// upstream (valiant-crab-775, 2026-10-04: "establish in the pinned runtime exactly what is reserved").
-data group_arm_runtime_source_modules: List<String> = [
-  "vllm.benchmarks.datasets",
-  "flashinfer.autotuner",
-  "flashinfer.fused_moe.core",
-  "vllm.utils.flashinfer",
-  "vllm.envs",
-  "vllm.model_executor.warmup.flashinfer_autotune_cache",
-  "vllm.model_executor.warmup.flashinfer_sparse_mla_warmup",
-  "vllm.distributed.parallel_state",
-]
-
-fn group_arm_runtime_source_lines(ctx: SparkMaterializeContext) -> String {
-  match serving_runtime_row(r: GunbcGlm53KvplanV2GroupAProduced) {
-    Absent => "  runtime sources: the Group A runtime has no row\n"
-    Present { value: row } =>
-      join(map(group_arm_runtime_source_modules, m =>
-        observe_leg(ctx: ctx, what: join(["pinned runtime source ", m], ""), argv: ["docker", "run", "--rm", "--network", "none", "--entrypoint", "python3", runtime_artifact_wire(a: row.artifact) as String, "-m", "inspect", m])), "")
-  }
-}
-
-// THE CHECKPOINTS' HOST-VISIBLE BYTES, read-only. This hf keeps completed files in a HUB-LEVEL store
-// (hub/blobs/<xx>/<sha256>) and the model directory holds only links to it plus the in-flight .incomplete
-// files (valiant-crab-775's reading on srv7, 2026-10-03), so the model directory alone SHRINKS as files
-// complete. The reading is the snapshot dereferenced (completed bytes) plus the .incomplete partials, on
-// the host, so a fetch in progress is seen growing on the HOST (not only inside a container), and a restarted
-// fetch is seen keeping what it had.
-fn checkpoint_cache_bytes_lines(ctx: SparkMaterializeContext) -> String {
-  join(map([Glm53NativeFp8, Glm53FlashNvidiaNvfp4], c => match serving_checkpoint_row(c: c) {
-    Absent => ""
-    Present { value: row } =>
-      join([
-        observe_leg(ctx: ctx, what: join(["completed bytes of ", serving_checkpoint_wire(c: c) as String, " (snapshot dereferenced)"], ""), argv: hub_dereferenced_bytes_argv(path: join([hub_repo_cache_directory(cache_root: spark_hub_cache_root, repo: row.repo) as String, "/snapshots"], "") as NonEmptyStr)),
-        observe_leg(ctx: ctx, what: join(["in-flight partials of ", serving_checkpoint_wire(c: c) as String, " (bytes per .incomplete file)"], ""), argv: ["find", join([hub_repo_cache_directory(cache_root: spark_hub_cache_root, repo: row.repo) as String, "/blobs"], ""), "-name", "*.incomplete", "-printf", "%s\n"]),
-      ], "")
-  }), "")
-}
-
-// ── LINK HEALTH, READ-ONLY (valiant-crab-775, 2026-10-03) ─────────────────────────────────────────
-//
-// Two Sparks went dark over SSH mid-transfer. The question is whether the HOST wedged or its WIRELESS
-// management link dropped while the host stayed up, and every reading here discriminates between the two:
-// the boot id and uptime (a reboot says host), the kernel ring of this boot counted for OOM kills, hung
-// tasks and wireless disconnects (gunbc.fleet_wireless_link's own disconnect count), the wireless link and
-// power save (observe_wireless_link), the boots journald knows (an earlier boot ending in the dark window
-// says host), and whether every group peer answers a ping on its RAIL address from this host -- a host dark
-// on the LAN but answering on the rail is up. Nothing here changes any host.
-data link_health_oom_markers: List<String> = ["Out of memory", "oom-kill", "invoked oom-killer"]
-data link_health_hung_markers: List<String> = ["blocked for more than", "hung_task"]
-
-fn kernel_marker_count(kernel_log: String, markers: List<String>) -> Int {
-  length(filter(split(s: kernel_log, delimiter: "\n"), l => any(markers, m => string_contains(s: l, pattern: m))))
-}
-
-fn ping_word(code: Int) -> String {
-  if code == 0 { "answers" } else { "NO ANSWER" }
-}
-
-fn rail_ping_line(ctx: SparkMaterializeContext, peer: HostIdentity) -> String {
-  match spark_reach_endpoint(host: peer, path: ReachFabricRail) {
-    Absent => join(["    rail ", peer as String, ": no rail address\n"], "")
-    Present { value: addr } =>
-      match spark_remote_run(ctx: ctx, argv: ["ping", "-c", "2", "-W", "1", addr as String]) {
-        RemoteUnreachable { cause: c, reach: _ } => join(["    rail ", peer as String, " (", addr as String, "): NOT READ (", c, ")\n"], "")
-        RemoteRan { exit_code: code, stdout: _, stderr: _ } => join(["    rail ", peer as String, " (", addr as String, "): ", ping_word(code: code), "\n"], "")
-      }
-  }
-}
-
-fn group_host_link_health(ctx: SparkMaterializeContext, h: HostIdentity) -> String {
-  let run = spark_ctx_argv_run(ctx: ctx)
-  let kernel = spark_remote_run(ctx: ctx, argv: journalctl_kernel_current_boot_argv())
-  let kernel_line = match kernel {
-    RemoteUnreachable { cause: c, reach: _ } => join(["  kernel ring: NOT READ (", c, ")\n"], "")
-    RemoteRan { exit_code: code, stdout: out, stderr: err } =>
-      if code != 0 { join(["  kernel ring: NOT READ (exit ", to_string(code), ": ", trim(s: err), ")\n"], "") } else {
-        join(["  kernel ring this boot: oom=", to_string(kernel_marker_count(kernel_log: out, markers: link_health_oom_markers)),
-          " hung=", to_string(kernel_marker_count(kernel_log: out, markers: link_health_hung_markers)),
-          " wireless_disconnects=", to_string(kernel_disconnect_line_count(interface: dgx_spark_wireless_interface, kernel_log: out)), "\n"], "")
-      }
-  }
-  join([
-    observe_leg(ctx: ctx, what: "boot id and uptime", argv: ["sh", "-c", "cat /proc/sys/kernel/random/boot_id /proc/uptime"]),
-    observe_leg(ctx: ctx, what: "boots journald knows", argv: ["journalctl", "--list-boots", "--no-pager"]),
-    kernel_line,
-    observe_leg(ctx: ctx, what: "docker GPU devices the daemon discovers (the native apply preflight question)", argv: ["docker", "info", "--format", "\{\{.ServerVersion}} \{\{range .DiscoveredDevices}}\{\{.ID}} \{\{end}}"]),
-    wireless_link_observation_line(label: "  wireless", o: observe_wireless_link(desired: spark_wireless_link_desired(host: h), run: run)),
-    "  rail reachability of group peers from this host:\n",
-    join(map(filter(fabric_group_hosts(g: FabricGroupA), p => !host_identity_eq(a: p, b: h)), p => rail_ping_line(ctx: ctx, peer: p)), ""),
-  ], "")
-}
-
-// AS A WET SESSION OF THE ONE ENTRY, so it is admitted, credentialed and receipted exactly as a launch
-// is -- but it converges as soon as every host was asked, and it writes nothing to any host.
-fn group_arm_occupancy_observe_session(group: FabricGroup) -> ArmWetSession {
-  ArmWetSession {
-    title: join(["occupancy observe of fabric ", fabric_group_wire(g: group) as String, " (read-only)"], "") as NonEmptyStr,
-    group: group,
-    attempt_raw: join(["arm-group-observe-", fabric_group_wire(g: group) as String], ""),
-    identity_file_name: "gunbc-arm-group-observe-admin-password" as NonEmptyStr,
-    session: fn(now_word, context, ctx) {
-      SparkBuildHostWork {
-        receipt: join([group_authority_observation(group: group), join(map(fabric_group_hosts(g: group), h => group_arm_host_observation(ctx: ctx, h: h)), "")], ""),
-        converged: true,
-      }
-    },
-  }
-}
-
-// THE GROUP'S AUTHORITY AND ITS PLACEMENT FENCES, READ ONLY, for the same observation: the current
-// authority as the launch admission reads it, and every placement preparation of the group with its
-// operation, populations, preparer, state and record time -- the records that decide whether a host
-// effect on the group's hosts is admitted (gunbc.spark.pair_serving_authority_log host_effect_admit_at
-// groups_fencing). Nothing is written.
-fn preparation_state_word(st: PreparationState) -> String {
-  match st {
-    Prepared => "PREPARED (pending)"
-    AppendClaimed { claimant: c, expected_head: _, intent: i } => join(["APPEND-CLAIMED by ", c as String, " (pending; intent ", i.operation as String, " by ", i.actor as String, ")"], "")
-    Finalized { authority_event: e, finalized_by: f, intent: i } => join(["FINALIZED (authority event ", e as String, ", finalized by ", f as String, "; intent ", i.operation as String, " by ", i.actor as String, ")"], "")
-    Aborted => "ABORTED"
-  }
-}
-
-fn group_authority_observation(group: FabricGroup) -> String {
-  match observe_executor_reach() {
-    ExecutorReachUnknown { cause: c } => join(["authority: NOT READ (the executor could not be identified: ", c, ")\n"], "")
-    ExecutorReachKnown { short_hostname: executor, path: _ } =>
-      match now_epoch_seconds() {
-        Absent => "authority: NOT READ (the clock could not be read)\n"
-        Present { value: at } => {
-          let authority = match current_authority_for(current: current_pair_serving_authorities(short_hostname: executor, at: at), group: group) {
-            Absent => "authority: no row for this group\n"
-            Present { value: c } => join(["authority: ", current_authority_wire(c: c), "\n"], "")
-          }
-          let placement = match event_log_store_for_host(short_hostname: executor) {
-            HostStoreRefused { detail: d } => join(["placement: NOT READ (", d as String, ")\n"], "")
-            HostStoreResolved { store: store, executor: _ } =>
-              match placement_read(store: store) {
-                PlacementUnread { step: st, reason: why } => join(["placement: NOT READ at ", st, ": ", why, "\n"], "")
-                PlacementReadAt { head: _, effects: effs, preparations: preps } =>
-                  join([
-                    "placement preparations of this group (read at epoch ", to_string(at), "):\n",
-                    join(map(filter(preps, r => same_group(a: r.group, b: group)), r => join([
-                      "  - ", preparation_line(r: r), " prepared_by=", r.prepared_by as String, " recorded_at=", to_string(r.recorded_at), " state=", preparation_state_word(st: r.state), "\n",
-                    ], "")), ""),
-                    "hosts this group fences now: ", join(map(group_fenced_hosts(preps: preps, group: group), h => h as String), ", "), "\n",
-                    "live host effects on its hosts: ", join(map(live_host_effects_on(records: effs, hosts: fabric_group_hosts(g: group), at: at), r => host_effect_line_at(r: r, at: at)), "; "), "\n",
-                  ], "")
-              }
-          }
-          join([authority, placement], "")
-        }
-      }
-  }
-}
diff --git a/dag/gunbc/spark/group_arm_serving_load.dag b/dag/gunbc/spark/group_arm_serving_load.dag
deleted file mode 100644
index 6ce6de4603a..00000000000
--- a/dag/gunbc/spark/group_arm_serving_load.dag
+++ /dev/null
@@ -1,342 +0,0 @@
-module gunbc.spark.group_arm_serving_load
-
-import std.types { String, Bool, List, NonEmptyStr }
-import std.nat { Nat }
-import std.algebra { trim }
-import std.optional { Present, Absent }
-import std.content_hash { ContentHash, content_hash_atom }
-import std.measure { token_count_value }
-import gunbc.spark.serving_performance_subject { ServingPerformanceSubject, serving_subject_key }
-import gunbc.spark.serving_promotion { WorkloadCalibrationReceipt }
-import std.artifact_store { ArtifactRealizationInput, artifact_realization_digest }
-import product.host_identity { HostIdentity }
-import extdeps.exec.command { argv_words }
-import extdeps.vllm.bench_serve { VllmBenchServeRequest, vllm_bench_serve_request, RandomDatasetSpec, SendAllImmediately, OpenaiChat }
-import extdeps.linux.psi { PsiReading, parse_psi }
-import extdeps.linux.cgroup_v2_memory { parse_cgroup_memory_stat, CgroupMemoryStatRead, CgroupMemoryStatIncomplete, CgroupMemoryStat, cgroup_memory_stat_value }
-import extdeps.docker.cli { docker_container_inspect_command, docker_container_inspect_identity_from_stdout, DockerContainerInspectIdentity, DockerContainerInspectIdentityUnreadable }
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext, spark_remote_run, RemoteRan, RemoteUnreachable }
-import gunbc.spark.serving_load_probe { preemption_count, OperationLedger, LedgerClosed, LedgerIncomplete, CounterContinuity, SameExporter, ExporterChanged, ContinuityUnread }
-import gunbc.spark.serving_load_runner { ServingLoadStepRecord }
-
-// ── ONE LOAD STEP FOR AN ARM ON A FABRIC GROUP: THE RANK READING, THE STOP RULES, THE RECEIPT ──────
-//
-// (deforking cut 8b.) gunbc.spark.serving_load_runner already owns the engineering every model shares --
-// scrape, bench, scrape, observation, per step -- parameterized by the subject (head, container, alias),
-// the step list and a host reading. What was left per model was the rank reading, which V4.1 wrote as
-// its own (gunbc.spark.v41_serving_load v41_read_rank_pressure) though only one of its four reads is
-// V4.1's: the container's cgroup memory.stat, the host's PSI and now the container's memory.events are
-// the same for every arm on a Spark, and only the Engram row-store device's diskstats is V4.1's. So the
-// container-scoped reading is here, over the group's roster, and V4.1 composes its device read on it.
-//
-// AND THE STOP RULES, WHICH V4.1 HAS AS ITS OWN CAPACITY POLICY (gunbc.spark.v41_capacity_measurement)
-// AND THE STAIRCASE NEEDS AS A GUARANTEE: every step keeps the cold floor, so a step stops on anything
-// that breaks the floor or the engine, and admits preemption only above it, where it is the declared
-// overflow behaviour of a best-effort seat (gunbc.spark.serving_capacity_intent SchedulerEnvelope).
-// The result is gunbc.spark.serving_promotion WorkloadCalibrationReceipt -- this is that receipt's first
-// producer (serving_promotion_calibration_producer_frontier).
-
-// ── THE CONTAINER-SCOPED RANK READING ──────────────────────────────────────────────────────────────
-//
-// THE CGROUP PATH IS A STATED BET on dockerd's default systemd cgroup driver (extdeps.docker.cgroup:
-// the container is system.slice/docker-<id>.scope), the same bet V4.1's reading states; a daemon on the
-// cgroupfs driver makes the read refuse with the path it tried, never a misread. memory.events is
-// read for its oom_kill count: the kernel's own record that the OOM killer ended a task in this
-// container, which no engine log can be relied on to say.
-data rank_docker_scope_parent: String = "/sys/fs/cgroup/system.slice"
-
-type RankContainerPressure {
-  host: HostIdentity
-  container_id: NonEmptyStr
-  memory: CgroupMemoryStat
-  oom_kill: Nat
-  psi: PsiReading
-}
-
-type RankContainerPressureRead
-  = RankContainerPressureObserved { pressure: RankContainerPressure }
-  | RankContainerPressureUnread { host: HostIdentity, cause: String }
-
-type RemoteText
-  = RemoteTextRead { stdout: String }
-  | RemoteTextRefused { cause: String }
-
-fn remote_text(ctx: SparkMaterializeContext, what: String, argv: List<String>) -> RemoteText {
-  match spark_remote_run(ctx: ctx, argv: argv) {
-    RemoteUnreachable { cause: c, reach: _ } => RemoteTextRefused { cause: join([what, " unreachable: ", c], "") }
-    RemoteRan { exit_code: code, stdout: out, stderr: err } =>
-      if code != 0 { RemoteTextRefused { cause: join([what, " exited ", to_string(code), ": ", trim(s: err)], "") } } else { RemoteTextRead { stdout: out } }
-  }
-}
-
-fn rank_context(ctx: SparkMaterializeContext, host: HostIdentity) -> SparkMaterializeContext {
-  SparkMaterializeContext {
-    host: host, trust: ctx.trust, path: ctx.path,
-    admin_credential: ctx.admin_credential, admin_credential_file: ctx.admin_credential_file, executor: ctx.executor,
-  }
-}
-
-fn read_rank_container_pressure(ctx: SparkMaterializeContext, container: NonEmptyStr) -> RankContainerPressureRead {
-  let host = ctx.host
-  match remote_text(ctx: ctx, what: "docker container inspect", argv: argv_words(command: docker_container_inspect_command(name: container))) {
-    RemoteTextRefused { cause: c } => RankContainerPressureUnread { host: host, cause: c }
-    RemoteTextRead { stdout: inspect } => match docker_container_inspect_identity_from_stdout(stdout: inspect) {
-      DockerContainerInspectIdentityUnreadable { cause: c } => RankContainerPressureUnread { host: host, cause: c }
-      DockerContainerInspectIdentity { id: id, image: _ } => {
-        let scope = join([rank_docker_scope_parent, "/docker-", id as String, ".scope"], "")
-        match remote_text(ctx: ctx, what: join(["cat ", scope, "/memory.stat"], ""), argv: ["cat", "--", join([scope, "/memory.stat"], "")]) {
-          RemoteTextRefused { cause: c } => RankContainerPressureUnread { host: host, cause: c }
-          RemoteTextRead { stdout: stat } => match parse_cgroup_memory_stat(body: stat) {
-            CgroupMemoryStatIncomplete { missing: m } => RankContainerPressureUnread { host: host, cause: join(["memory.stat is missing ", join(m, ", ")], "") }
-            CgroupMemoryStatRead { stat: s } =>
-              match remote_text(ctx: ctx, what: join(["cat ", scope, "/memory.events"], ""), argv: ["cat", "--", join([scope, "/memory.events"], "")]) {
-                RemoteTextRefused { cause: c } => RankContainerPressureUnread { host: host, cause: c }
-                RemoteTextRead { stdout: events } => match cgroup_memory_stat_value(body: events, key: "oom_kill") {
-                  Absent => RankContainerPressureUnread { host: host, cause: "memory.events carries no oom_kill line" }
-                  Present { value: kills } =>
-                    match remote_text(ctx: ctx, what: "cat /proc/pressure/memory", argv: ["cat", "/proc/pressure/memory"]) {
-                      RemoteTextRefused { cause: c } => RankContainerPressureUnread { host: host, cause: c }
-                      RemoteTextRead { stdout: psi } => RankContainerPressureObserved { pressure: RankContainerPressure {
-                        host: host, container_id: id as NonEmptyStr, memory: s, oom_kill: kills, psi: parse_psi(body: psi),
-                      } }
-                    }
-                }
-              }
-          }
-        }
-      }
-    }
-  }
-}
-
-type GroupRankPressure { ranks: List<RankContainerPressureRead> }
-
-fn read_group_rank_pressure(ctx: SparkMaterializeContext, roster: List<HostIdentity>, container: NonEmptyStr) -> GroupRankPressure {
-  GroupRankPressure { ranks: map(roster, h => read_rank_container_pressure(ctx: rank_context(ctx: ctx, host: h), container: container)) }
-}
-
-// ── THE STOP RULES ─────────────────────────────────────────────────────────────────────────────────
-//
-// ONE VERDICT PER LOAD STEP, AND AN UNREAD READING IS A STOP, never a pass: a step that cannot say
-// whether the engine restarted or a rank was OOM-killed has not shown that it did not.
-type LoadStepVerdict
-  = LoadStepHeld { preemptions: Nat }
-  | LoadStepStopped { reasons: List<String>, unread: Bool }
-
-fn rank_by_host(p: GroupRankPressure, h: HostIdentity) -> RankContainerPressure? {
-  first(flat_map(p.ranks, r => match r {
-    RankContainerPressureObserved { pressure: x } => if (x.host as String) == (h as String) { [x] } else { [] as List<RankContainerPressure> }
-    RankContainerPressureUnread { host: _, cause: _ } => [] as List<RankContainerPressure>
-  }))
-}
-
-fn rank_unread_causes(p: GroupRankPressure, phase: String) -> List<String> {
-  flat_map(p.ranks, r => match r {
-    RankContainerPressureObserved { pressure: _ } => [] as List<String>
-    RankContainerPressureUnread { host: h, cause: c } => [join([phase, " ", h as String, ": ", c], "")]
-  })
-}
-
-// A RANK WHOSE CONTAINER CHANGED BETWEEN THE READINGS RESTARTED, and its OOM count is a different
-// cgroup's, so that is a stop in itself rather than a delta.
-fn rank_stop_reasons(roster: List<HostIdentity>, before: GroupRankPressure, after: GroupRankPressure) -> List<String> {
-  concat(concat(rank_unread_causes(p: before, phase: "before"), rank_unread_causes(p: after, phase: "after")),
-    flat_map(roster, h => match rank_by_host(p: before, h: h) {
-      Absent => [] as List<String>
-      Present { value: b } => match rank_by_host(p: after, h: h) {
-        Absent => [] as List<String>
-        Present { value: a } =>
-          if (a.container_id as String) != (b.container_id as String) {
-            [join([h as String, ": the rank container changed during the step (", b.container_id as String, " -> ", a.container_id as String, "), so the engine restarted"], "")]
-          } else if a.oom_kill > b.oom_kill {
-            [join([h as String, ": the OOM killer ended ", to_string(a.oom_kill - b.oom_kill), " task(s) in the rank container during the step"], "")]
-          } else { [] as List<String> }
-      }
-    }))
-}
-
-fn ledger_stop_reasons(l: OperationLedger) -> List<String> {
-  match l {
-    LedgerClosed { offered: _, completed: _, failed: _ } => [] as List<String>
-    LedgerIncomplete { because: b } => [join(["requests were lost or the ledger did not close: ", b as String], "")]
-  }
-}
-
-fn continuity_stop_reasons(c: CounterContinuity) -> List<String> {
-  match c {
-    SameExporter { start_field: _ } => [] as List<String>
-    ExporterChanged { before: b, after: a } => [join(["the engine's metrics exporter changed during the step (", b as String, " -> ", a as String, "), so the engine restarted"], "")]
-    ContinuityUnread { cause: c } => [join(["whether the engine restarted is unread: ", c as String], "")]
-  }
-}
-
-fn step_preemptions(before_body: String, after_body: String) -> Nat? {
-  match preemption_count(body: before_body) {
-    Absent => none
-    Present { value: b } => match preemption_count(body: after_body) {
-      Absent => none
-      Present { value: a } => if a < b { none } else { Present { value: a - b } }
-    }
-  }
-}
-
-fn load_step_verdict(cold_floor: Nat, roster: List<HostIdentity>, r: ServingLoadStepRecord<GroupRankPressure>) -> LoadStepVerdict {
-  let concurrency = match r.request.max_concurrency { Present { value: c } => c  Absent => 0 }
-  let preempt = step_preemptions(before_body: r.before_body, after_body: r.after_body)
-  let reasons = concat(concat(concat(concat(
-    if concurrency == 0 { ["the step's request carried no max_concurrency, so it names no level to judge"] } else { [] as List<String> },
-    ledger_stop_reasons(l: r.observation.ledger)),
-    continuity_stop_reasons(c: r.observation.continuity)),
-    rank_stop_reasons(roster: roster, before: r.host_before, after: r.host_after)),
-    match preempt {
-      Absent => ["the engine's preemption counter was unread before or after the step"]
-      Present { value: p } =>
-        if p > 0 && concurrency <= cold_floor {
-          [join([to_string(p), " preemption(s) at concurrency ", to_string(concurrency), ", at or below the ", to_string(cold_floor), " cold seats the service guarantees"], "")]
-        } else { [] as List<String> }
-    })
-  let unread = length(rank_unread_causes(p: r.host_before, phase: "before")) != 0
-    || length(rank_unread_causes(p: r.host_after, phase: "after")) != 0
-    || match r.observation.continuity { ContinuityUnread { cause: _ } => true  SameExporter { start_field: _ } => false  ExporterChanged { before: _, after: _ } => false }
-    || match preempt { Absent => true  Present { value: _ } => false }
-  if length(reasons) == 0 {
-    LoadStepHeld { preemptions: match preempt { Present { value: p } => p  Absent => 0 } }
-  } else {
-    LoadStepStopped { reasons: reasons, unread: unread }
-  }
-}
-
-fn load_step_verdict_wire(concurrency: Nat, v: LoadStepVerdict) -> String {
-  match v {
-    LoadStepHeld { preemptions: p } => join(["x", to_string(concurrency), ": HELD (", to_string(p), " best-effort preemption(s) above the floor)\n"], "")
-    LoadStepStopped { reasons: rs, unread: _ } => join(["x", to_string(concurrency), ": STOPPED\n", join(map(rs, x => join(["  - ", x, "\n"], "")), "")], "")
-  }
-}
-
-// ── THE STEP LIST AND THE TRACE IDENTITY ────────────────────────────────────────────────────────
-//
-// A STAIRCASE STEP AT CEILING C IS LOADED TWICE: at the cold floor, where nothing may be preempted, and
-// at C, where the seats above the floor are best-effort. Two prompts per concurrent sequence, every
-// prompt sent at once, as the shared protocol shape both arms already use.
-data load_prompts_per_concurrency: Nat = 2
-
-fn floor_and_ceiling_concurrencies(cold_floor: Nat, ceiling: Nat) -> List<Nat> {
-  if ceiling > cold_floor { [cold_floor, ceiling] } else { [cold_floor] }
-}
-
-fn load_requests(base_url: NonEmptyStr, model: NonEmptyStr, tokenizer: NonEmptyStr, dataset: RandomDatasetSpec, seed: Nat, concurrencies: List<Nat>) -> List<VllmBenchServeRequest> {
-  map(concurrencies, c => vllm_bench_serve_request(
-    backend: OpenaiChat, base_url: base_url, model: model, tokenizer: tokenizer, dataset: dataset,
-    num_prompts: c * load_prompts_per_concurrency, arrival: SendAllImmediately,
-    max_concurrency: Present { value: c }, ignore_eos: true, seed: seed,
-  ))
-}
-
-// THE TRACE A CALIBRATION RECEIPT IS KEYED BY: the dataset shape, the seed and the concurrencies, so two
-// receipts compare only when they offered the same load.
-fn load_trace_digest(dataset: RandomDatasetSpec, seed: Nat, concurrencies: List<Nat>) -> ContentHash {
-  artifact_realization_digest(inputs: [
-    ArtifactRealizationInput { identity: "dataset" as NonEmptyStr, content_digest: content_hash_atom(value: join(["random in=", to_string(token_count_value(t: dataset.input_len)), " out=", to_string(token_count_value(t: dataset.output_len)), " prefix=", to_string(token_count_value(t: dataset.prefix_len))], "") as NonEmptyStr) },
-    ArtifactRealizationInput { identity: "seed" as NonEmptyStr, content_digest: content_hash_atom(value: to_string(seed) as NonEmptyStr) },
-    ArtifactRealizationInput { identity: "concurrencies" as NonEmptyStr, content_digest: content_hash_atom(value: join(map(concurrencies, c => to_string(c)), ",") as NonEmptyStr) },
-    ArtifactRealizationInput { identity: "prompts_per_concurrency" as NonEmptyStr, content_digest: content_hash_atom(value: to_string(load_prompts_per_concurrency) as NonEmptyStr) },
-  ])
-}
-
-// ── THE CALIBRATION RECEIPT ─────────────────────────────────────────────────────────────────────────
-//
-// THE SUSTAINED CONCURRENCY IS THE HIGHEST LEVEL THAT HELD WITH EVERY LEVEL BELOW IT HOLDING: a ceiling
-// that held after the floor stopped sustains nothing, because the floor is the guarantee. The counts are
-// Present only when every step's readings were read; one unread step makes all four Absent, which
-// gunbc.spark.serving_promotion calibration_counts reports as missing rather than as zero.
-type LoadStepResult {
-  concurrency: Nat
-  verdict: LoadStepVerdict
-  completed: Nat?
-  restarts: Nat
-  oom_kills: Nat
-  lost: Nat
-}
-
-fn ledger_completed(l: OperationLedger) -> Nat? {
-  match l {
-    LedgerClosed { offered: _, completed: c, failed: _ } => Present { value: c }
-    LedgerIncomplete { because: _ } => none
-  }
-}
-
-// A CLOSED LEDGER IS MINTED ONLY WITH completed == offered AND failed == 0
-// (gunbc.spark.serving_load_probe ledger_from_bench_stdout), so its lost count is its failed count; an
-// incomplete ledger counts as one lost-or-unaccounted request, never as none.
-fn ledger_lost(l: OperationLedger) -> Nat {
-  match l {
-    LedgerClosed { offered: _, completed: _, failed: f } => f
-    LedgerIncomplete { because: _ } => 1
-  }
-}
-
-fn rank_oom_kills(roster: List<HostIdentity>, before: GroupRankPressure, after: GroupRankPressure) -> Nat {
-  fold(roster, init: 0, f: (acc, h) => match rank_by_host(p: before, h: h) {
-    Absent => acc
-    Present { value: b } => match rank_by_host(p: after, h: h) {
-      Absent => acc
-      Present { value: a } => if (a.container_id as String) == (b.container_id as String) && a.oom_kill > b.oom_kill { acc + (a.oom_kill - b.oom_kill) } else { acc }
-    }
-  })
-}
-
-fn load_step_result(cold_floor: Nat, roster: List<HostIdentity>, r: ServingLoadStepRecord<GroupRankPressure>) -> LoadStepResult {
-  LoadStepResult {
-    concurrency: match r.request.max_concurrency { Present { value: c } => c  Absent => 0 },
-    verdict: load_step_verdict(cold_floor: cold_floor, roster: roster, r: r),
-    completed: ledger_completed(l: r.observation.ledger),
-    restarts: match r.observation.continuity {
-      SameExporter { start_field: _ } => 0
-      ExporterChanged { before: _, after: _ } => 1
-      ContinuityUnread { cause: _ } => 0
-    },
-    oom_kills: rank_oom_kills(roster: roster, before: r.host_before, after: r.host_after),
-    lost: ledger_lost(l: r.observation.ledger),
-  }
-}
-
-fn step_held(r: LoadStepResult) -> Bool {
-  match r.verdict { LoadStepHeld { preemptions: _ } => true  LoadStepStopped { reasons: _, unread: _ } => false }
-}
-
-fn step_fully_read(r: LoadStepResult) -> Bool {
-  match r.verdict {
-    LoadStepHeld { preemptions: _ } => true
-    LoadStepStopped { reasons: _, unread: u } => !u
-  }
-}
-
-// THE LEVELS IN THE ORDER THEY RAN, which is ascending: the sustained level is the last of the
-// unbroken held prefix.
-fn sustained_concurrency(results: List<LoadStepResult>) -> Nat {
-  fold(results, init: SustainFold { level: 0, broken: false }, f: (acc, r) =>
-    if acc.broken { acc } else if step_held(r: r) { SustainFold { level: r.concurrency, broken: false } } else { SustainFold { level: acc.level, broken: true } }
-  ).level
-}
-
-type SustainFold { level: Nat, broken: Bool }
-
-fn calibration_receipt(subject: ServingPerformanceSubject, trace: ContentHash, run_id: NonEmptyStr, results: List<LoadStepResult>, evidence: NonEmptyStr) -> WorkloadCalibrationReceipt {
-  let read = all(results, r => step_fully_read(r: r))
-  WorkloadCalibrationReceipt {
-    subject_key: serving_subject_key(s: subject),
-    trace_digest: trace,
-    run_id: run_id,
-    accepted_turns: if all(results, r => match r.completed { Present { value: _ } => true  Absent => false }) {
-      Present { value: fold(results, init: 0, f: (acc, r) => acc + match r.completed { Present { value: c } => c  Absent => 0 }) }
-    } else { none },
-    observation_window: none,
-    sustained_concurrency: sustained_concurrency(results: results),
-    realized_transport: none,
-    preemptions: if read { Present { value: fold(results, init: 0, f: (acc, r) => acc + match r.verdict { LoadStepHeld { preemptions: p } => p  LoadStepStopped { reasons: _, unread: _ } => 0 }) } } else { none },
-    engine_restarts: if read { Present { value: fold(results, init: 0, f: (acc, r) => acc + r.restarts) } } else { none },
-    out_of_memory_events: if read { Present { value: fold(results, init: 0, f: (acc, r) => acc + r.oom_kills) } } else { none },
-    stalls_or_lost_requests: if read { Present { value: fold(results, init: 0, f: (acc, r) => acc + r.lost) } } else { none },
-    evidence: evidence,
-  }
-}
diff --git a/dag/gunbc/spark/group_checkpoint_materialize.dag b/dag/gunbc/spark/group_checkpoint_materialize.dag
deleted file mode 100644
index 92f24b41cca..00000000000
--- a/dag/gunbc/spark/group_checkpoint_materialize.dag
+++ /dev/null
@@ -1,413 +0,0 @@
-module gunbc.spark.group_checkpoint_materialize
-
-import gunbc.spark.remote_leg_began { remote_stdout_as_one_word }
-import std.types { String, NonEmptyStr, Bool, List, Int }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import std.optional { Present, Absent }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fleet_multi_principal_probe { spark_converge_target_selection, SparkConvergeTargetSingle, SparkConvergeTargetAllObserveOnly, SparkConvergeTargetRefused }
-import gunbc.artifact_acquisition { AcquisitionOutcome, AcquisitionAlreadyPresent, AcquisitionFetched, AcquisitionRefused, acquisition_refusal_text }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_hosts }
-import product.host_identity { HostIdentity, host_identity_eq }
-import gunbc.spark.snapshot_rail_replica { replicate_snapshot_over_rail, SnapshotReplicated, SnapshotReplicaRefused, snapshot_hub_paths }
-import std.measure { gibibyte_count }
-import std.algebra { trim }
-import gunbc.artifact_acquisition { AcquisitionVerified, AcquisitionAbsent, AcquisitionDigestMismatch, AcquisitionProbeFailed }
-import gunbc.spark.serving_subject { PairServingUnitOn }
-import gunbc.spark.host_commitment { admit_host_held_by_subject }
-import gunbc.spark.serving_arm { ServingCheckpoint, serving_checkpoint_row, serving_checkpoint_wire }
-import gunbc.spark.model_snapshot_acquisition { ModelSnapshotDesired, ModelSnapshotPinned, ModelSnapshotUnpinned, SnapshotPlacement, SnapshotSeed, LocalDirectoryPlacement, HubCachePlacement, model_snapshot_completion_check_argv, model_snapshot_subject_for, spark_hub_cache_root }
-import extdeps.huggingface.hub { hub_dereferenced_bytes_argv }
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext, SnapshotAcquisitionExecutor, containerized_hub_cli_for, ContainerizedHubCliBuilt, ContainerizedHubCliRefused, spark_materialize_member, SparkMaterialized, SparkMaterializeUnpinned, SparkMaterializeRefused, spark_remote_run, RemoteRan, RemoteUnreachable, spark_snapshot_verify_observation, spark_transfer_cancel, spark_transfer_unit_for, read_instrument, InstrumentVerified, InstrumentRejectedTheSubject, InstrumentDidNotRun, InstrumentContradictedItself, executor_wrap, SparkTransferCancel, TransferCancelled, TransferCancelledNothingRunning, TransferCancelRefused }
-import gunbc.spark.vllm_runtime_image_build { SparkBuildHostWork, with_spark_build_host, SparkBuildHostRefused, SparkBuildHostRan, VllmImageDistributionSubject }
-import extdeps.container.oci.digest { render_oci_content_digest_wire }
-import extdeps.docker.cli { docker_image_inspect_names_no_such_image, docker_image_inspect_id_from_stdout, DockerImageInspectId, DockerImageInspectIdUnreadable }
-
-// ── ONE ENTRY FOR MATERIALIZING A SERVING CHECKPOINT ON A HOST OF ITS GROUP (deforking cut 8c) ──────
-//
-// THE PATH IS THE EXISTING SNAPSHOT ONE, NOT A COPY OF V4.1's. gunbc.spark.model_snapshot_materialize
-// spark_materialize_member already acquires a pinned snapshot -- observe and adopt what verifies, else
-// fetch from the Hub, then verify -- and the GLM canary converges through it. The GLM checkpoints are Hub
-// snapshots in the Hub cache (their rows' placement), so they take that path: the snapshot is derived
-// from the checkpoint's own row, never spelled again. gunbc.spark.v41_checkpoint_materialize stays V4.1's
-// (a per-file population with span reads the snapshot path does not model) and is frozen as a consumer of
-// its own shape: its migration onto this entry is a named follow-up, triggered by the snapshot path
-// carrying per-file populations.
-//
-// ONE SEED, THE REST RAIL REPLICAS. The checkpoint's seed host is a modeled fact
-// (gunbc.spark.arm_group_launch_dispatch glm53_checkpoint_seed_host): only the seed fetches from the Hub;
-// every other Group A host replicates the seed's verified snapshot over the fabric rail
-// (gunbc.spark.snapshot_rail_replica replicate_snapshot_over_rail) or refuses with the seed's exact verify
-// cause -- there is no Hub fallback (checkpoint_materialize_work below). A host whose own snapshot already
-// verifies adopts it and moves nothing.
-//
-// THE HUB CLI RUNS INSIDE A RUNTIME IMAGE, because no Spark has it on the host (the executor's own
-// record). WHICH image is the caller's: any produced image whose receipt is recorded (its tag and its
-// configuration digest), because downloading a checkpoint needs only the CLI, not the serving runtime the
-// checkpoint will later run under. So the FP8 download may run inside the V4.1 image Group A already holds
-// while the GLM image is still being built.
-//
-// THE IMAGE IS NEVER PULLED AND ITS CLI PATH IS NEVER SPELLED. Before any acquisition the host is asked
-// for the image under the recorded tag and its Id must be the recorded configuration digest -- an absent
-// or different image refuses, so `docker run` never reaches a registry; then the image itself is asked
-// where its Hub CLI is (`command -v hf` inside it), and only an absolute path it answers is used.
-type CheckpointMaterialization {
-  title: NonEmptyStr
-  group: FabricGroup
-  checkpoint: ServingCheckpoint
-  image: VllmImageDistributionSubject
-  seed: HostIdentity
-}
-
-type HeldImageExecutor
-  = HeldImageExecutorRead { executor: SnapshotAcquisitionExecutor, receipt: String }
-  | HeldImageExecutorRefused { cause: String }
-
-fn snapshot_placement_of(snapshot: ModelSnapshotDesired) -> SnapshotPlacement {
-  match snapshot {
-    ModelSnapshotPinned { identity: _, repo: _, revision: _, placement: pl, revision_provenance: _ } => pl
-    ModelSnapshotUnpinned { identity: _, repo: _, cause: _ } => HubCachePlacement { cache_root: spark_hub_cache_root }
-  }
-}
-
-fn checkpoint_host_path(c: ServingCheckpoint) -> NonEmptyStr? {
-  match serving_checkpoint_row(c: c) {
-    Absent => none
-    Present { value: row } =>
-      match row.placement {
-        LocalDirectoryPlacement { host_path: p } => Present { value: p }
-        HubCachePlacement { cache_root: root } => Present { value: root }
-      }
-  }
-}
-
-fn held_image_hub_cli_executor(ctx: SparkMaterializeContext, image: VllmImageDistributionSubject, placement: SnapshotPlacement) -> HeldImageExecutor {
-  let want = render_oci_content_digest_wire(d: image.config)
-  match spark_remote_run(ctx: ctx, argv: ["docker", "image", "inspect", image.tag as String]) {
-    RemoteUnreachable { cause: c, reach: _ } => HeldImageExecutorRefused { cause: join(["the image inspect leg did not run: ", c], "") }
-    RemoteRan { exit_code: code, stdout: out, stderr: err } =>
-      if code != 0 && docker_image_inspect_names_no_such_image(stderr: err) {
-        HeldImageExecutorRefused { cause: join(["the executor image ", image.tag as String, " is not held on ", ctx.host as String, " (", err, "); it is never pulled"], "") }
-      } else if code != 0 {
-        HeldImageExecutorRefused { cause: join(["the executor image could not be read on ", ctx.host as String, ", so whether it is held is unknown (docker image inspect exited ", to_string(code), ": ", err, ")"], "") }
-      } else {
-        match docker_image_inspect_id_from_stdout(stdout: out) {
-          DockerImageInspectIdUnreadable { cause: c } => HeldImageExecutorRefused { cause: join(["the executor image's Id is unreadable: ", c], "") }
-          DockerImageInspectId { id: id } =>
-            if (id as String) != want {
-              HeldImageExecutorRefused { cause: join(["the image under ", image.tag as String, " on ", ctx.host as String, " is ", id as String, ", not the recorded ", want], "") }
-            } else {
-              match spark_remote_run(ctx: ctx, argv: ["docker", "run", "--rm", "--pull", "never", "--entrypoint", "sh", image.tag as String, "-c", "command -v hf"]) {
-                RemoteUnreachable { cause: c, reach: _ } => HeldImageExecutorRefused { cause: join(["the CLI read leg did not run: ", c], "") }
-                RemoteRan { exit_code: c2, stdout: raw_path, stderr: e2 } => {
-                  let path = remote_stdout_as_one_word(stdout: raw_path)
-                  if c2 != 0 || !starts_with(s: path, prefix: "/") || string_contains(s: path, pattern: "\n") {
-                    HeldImageExecutorRefused { cause: join(["the image ", want, " answered no Hub CLI path (exit ", to_string(c2), ", stdout `", path, "`, stderr `", e2, "`)"], "") }
-                  } else {
-                    match containerized_hub_cli_for(image: image.tag, cli_path: path as NonEmptyStr, placement: placement, container_path: "/out" as NonEmptyStr) {
-                      ContainerizedHubCliRefused { cause: why } => HeldImageExecutorRefused { cause: why as String }
-                      ContainerizedHubCliBuilt { executor: e } => HeldImageExecutorRead {
-                        executor: e,
-                        receipt: join(["executor image ", image.tag as String, " held as ", want, "; its Hub CLI read inside it at ", path, "\n"], ""),
-                      }
-                    }
-                  }
-                }
-              }
-            }
-        }
-      }
-  }
-}
-
-fn checkpoint_snapshot(c: ServingCheckpoint) -> ModelSnapshotDesired? {
-  match serving_checkpoint_row(c: c) {
-    Absent => none
-    Present { value: row } => Present { value: ModelSnapshotPinned {
-      identity: serving_checkpoint_wire(c: c),
-      repo: row.repo,
-      revision: row.revision,
-      placement: row.placement,
-      revision_provenance: row.provenance,
-    } }
-  }
-}
-
-fn with_executor_ctx(ctx: SparkMaterializeContext, executor: SnapshotAcquisitionExecutor) -> SparkMaterializeContext {
-  SparkMaterializeContext {
-    host: ctx.host,
-    trust: ctx.trust,
-    path: ctx.path,
-    admin_credential: ctx.admin_credential,
-    admin_credential_file: ctx.admin_credential_file,
-    executor: executor,
-  }
-}
-
-fn acquisition_outcome_line(o: AcquisitionOutcome) -> String {
-  match o {
-    AcquisitionAlreadyPresent { identity: i, install_path: p } => join(["ALREADY PRESENT and verified: ", i as String, " at ", p as String, "\n"], "")
-    AcquisitionFetched { identity: i, install_path: p, source: s } => join(["FETCHED and verified: ", i as String, " at ", p as String, " from ", s.identity as String, "\n"], "")
-    AcquisitionRefused { cause: c } => join(["REFUSED: ", acquisition_refusal_text(cause: c), "\n"], "")
-  }
-}
-
-fn acquisition_converged(o: AcquisitionOutcome) -> Bool {
-  match o {
-    AcquisitionAlreadyPresent { identity: _, install_path: _ } => true
-    AcquisitionFetched { identity: _, install_path: _, source: _ } => true
-    AcquisitionRefused { cause: _ } => false
-  }
-}
-
-// ── THE PEER IS ASKED BEFORE THE HUB (rulings of valiant-crab-775, 2026-10-03) ──────────────────────
-//
-// A checkpoint is fetched from the Hub ONCE in the group; every other host replicates it from a peer over
-// the fabric rail (gunbc.spark.snapshot_rail_replica, which moves each file as a fabric_blob_peer blob named
-// by the sha256 the Hub cache already keys it by). A peer is an admissible source exactly when its OWN
-// `hf cache verify` of this snapshot passes, read on the peer inside the same recorded image -- the image
-// distribution's digest-readback rule, for a checkpoint. The candidates are the group's other hosts in
-// roster order; with no admissible peer the target is the group's seed and fetches from the Hub as before.
-// A Hub transfer still running on the target for this snapshot is superseded by the replica and stopped
-// through its own cancel path (gunbc.spark.model_snapshot_materialize spark_transfer_cancel). The target's
-// result is admitted by the same verify the Hub path ends with.
-// THE VERIFY, READ AS THE INSTRUMENT ANSWERED, with its own words kept for the receipt. Three readings and no
-// fourth: it passed; it RAN and rejected the snapshot (absent or incomplete here, "not held yet"); or nothing
-// was learned (the leg did not run, the instrument never executed, it contradicted itself). Only the last is
-// a refusal of the run; the middle one is the ordinary state of a host that has yet to acquire.
-fn checkpoint_verify_with(ctx: SparkMaterializeContext, image: VllmImageDistributionSubject, host_path: NonEmptyStr, snapshot: ModelSnapshotDesired) -> CheckpointVerifyReading {
-  match held_image_hub_cli_executor(ctx: ctx, image: image, placement: snapshot_placement_of(snapshot: snapshot)) {
-    HeldImageExecutorRefused { cause: c } => CheckpointVerifyUnread { cause: c }
-    HeldImageExecutorRead { executor: e, receipt: _ } =>
-      match spark_remote_run(ctx: with_executor_ctx(ctx: ctx, executor: e), argv: executor_wrap(executor: e, argv: model_snapshot_completion_check_argv(snapshot: snapshot))) {
-        RemoteUnreachable { cause: c, reach: _ } => CheckpointVerifyUnread { cause: join(["the verify leg did not run: ", c], "") }
-        RemoteRan { exit_code: code, stdout: out, stderr: err } =>
-          match read_instrument(exit_code: code, stdout: out) {
-            InstrumentVerified => CheckpointVerified
-            InstrumentRejectedTheSubject => CheckpointVerifyFailed { cause: join(["hf cache verify exited ", to_string(code), ": ", trim(s: err), " ", trim(s: out)], "") }
-            InstrumentDidNotRun => CheckpointVerifyUnread { cause: join(["the verify instrument never executed (exit ", to_string(code), "): ", trim(s: err)], "") }
-            InstrumentContradictedItself { detail: d } => CheckpointVerifyUnread { cause: join(["the verify contradicted itself: ", d, " (exit ", to_string(code), "): ", trim(s: err)], "") }
-          }
-      }
-  }
-}
-
-type CheckpointVerifyReading
-  = CheckpointVerified
-  | CheckpointVerifyFailed { cause: String }
-  | CheckpointVerifyUnread { cause: String }
-
-// EACH NESTED HOST SESSION HAS ITS OWN CREDENTIAL FILE. A session's bracket writes its password file and
-// WIPES it when the session ends; a nested peer session that reused the outer target session's file name
-// wiped the target's credential mid-run, so every later target leg failed at `sudo` (run 37145004207). The
-// readback and serve sessions name their own files.
-// A CANDIDATE PEER'S OWN VERIFY, AS A CAUSE: none when it verified, else why not (kept for the receipt, so a
-// fall-through to the Hub names each peer's reason rather than only that none qualified).
-fn checkpoint_peer_cause(m: CheckpointMaterialization, candidate: HostIdentity, host_path: NonEmptyStr, snapshot: ModelSnapshotDesired) -> String? {
-  match with_spark_build_host(
-    host: candidate,
-    attempt_raw: "checkpoint-peer-readback",
-    identity_file_name: "gunbc-checkpoint-peer-readback-admin-password" as NonEmptyStr,
-    use: fn(t, c, sctx) {
-      match checkpoint_verify_with(ctx: sctx, image: m.image, host_path: host_path, snapshot: snapshot) {
-        CheckpointVerified => SparkBuildHostWork { receipt: "verified", converged: true }
-        CheckpointVerifyFailed { cause: x } => SparkBuildHostWork { receipt: join(["its verify rejected the snapshot: ", x], ""), converged: false }
-        CheckpointVerifyUnread { cause: x } => SparkBuildHostWork { receipt: join(["its verify could not be read: ", x], ""), converged: false }
-      }
-    },
-  ) {
-    SparkBuildHostRefused { cause: x } => Present { value: join([candidate as String, " could not be reached: ", x], "") }
-    SparkBuildHostRan { work: w, endpoint: _, executor: _, trust_receipt: _ } => if w.converged { none } else { Present { value: join([candidate as String, ": ", w.receipt], "") } }
-  }
-}
-
-fn cancel_line(c: SparkTransferCancel) -> String {
-  match c {
-    TransferCancelledNothingRunning => ""
-    TransferCancelled => "the Hub transfer still running on this host was superseded by the rail replica and stopped through its unit\n"
-    TransferCancelRefused { cause: x } => join(["the Hub transfer on this host could not be stopped: ", x, "\n"], "")
-  }
-}
-
-fn checkpoint_replicate_from(m: CheckpointMaterialization, peer: HostIdentity, tctx: SparkMaterializeContext, host_path: NonEmptyStr, snapshot: ModelSnapshotDesired) -> SparkBuildHostWork {
-  let cancel = match model_snapshot_subject_for(role: SnapshotSeed, snapshot: snapshot, cache_root: spark_hub_cache_root) {
-    Absent => TransferCancelledNothingRunning
-    Present { value: subject } => spark_transfer_cancel(ctx: tctx, subject: subject)
-  }
-  match cancel {
-    TransferCancelRefused { cause: x } => SparkBuildHostWork { receipt: join(["REFUSED: ", cancel_line(c: cancel)], ""), converged: false }
-    TransferCancelled => checkpoint_replicate_after_cancel(m: m, peer: peer, tctx: tctx, host_path: host_path, snapshot: snapshot, note: cancel_line(c: cancel))
-    TransferCancelledNothingRunning => checkpoint_replicate_after_cancel(m: m, peer: peer, tctx: tctx, host_path: host_path, snapshot: snapshot, note: "")
-  }
-}
-
-fn checkpoint_replicate_after_cancel(m: CheckpointMaterialization, peer: HostIdentity, tctx: SparkMaterializeContext, host_path: NonEmptyStr, snapshot: ModelSnapshotDesired, note: String) -> SparkBuildHostWork {
-  match with_spark_build_host(
-    host: peer,
-    attempt_raw: "checkpoint-peer-serve",
-    identity_file_name: "gunbc-checkpoint-peer-serve-admin-password" as NonEmptyStr,
-    use: fn(t, c, sctx) {
-      match replicate_snapshot_over_rail(source: sctx, target: tctx, snapshot: snapshot) {
-        SnapshotReplicaRefused { step: st, cause: x } => SparkBuildHostWork { receipt: join([note, "REFUSED at ", st as String, ": ", x, "\n"], ""), converged: false }
-        SnapshotReplicated { files: n, receipt: r } =>
-          match checkpoint_verify_with(ctx: tctx, image: m.image, host_path: host_path, snapshot: snapshot) {
-            CheckpointVerified => SparkBuildHostWork { receipt: join([note, r, "REPLICATED and verified: ", to_string(n), " files from ", peer as String, " over the rail; hf cache verify passed on the target\n"], ""), converged: true }
-            CheckpointVerifyFailed { cause: x } => SparkBuildHostWork { receipt: join([note, r, "REFUSED: the replica arrived but its verify did not pass: ", x, "\n"], ""), converged: false }
-            CheckpointVerifyUnread { cause: x } => SparkBuildHostWork { receipt: join([note, r, "REFUSED: the replica's verify could not be read: ", x, "\n"], ""), converged: false }
-          }
-      }
-    },
-  ) {
-    SparkBuildHostRefused { cause: x } => SparkBuildHostWork { receipt: join([note, "REFUSED: the peer ", peer as String, " could not be reached to serve: ", x, "\n"], ""), converged: false }
-    SparkBuildHostRan { work: w, endpoint: _, executor: _, trust_receipt: _ } => w
-  }
-}
-
-// ── THE ROLE IS EXPLICIT AND NOTHING FALLS BACK (operator ruling, 2026-10-03: "eliminate all fallbacks") ───────
-//
-// A checkpoint's seed host is a modeled fact (m.seed). The seed host fetches from the Hub; every other host is a
-// rail replica of the seed and of nothing else. A replica whose seed does not verify REFUSES with the seed's
-// exact cause -- it never fetches from the Hub instead. An own-verify that learned nothing refuses with what it
-// captured. Only an own-verify that RAN and rejected (the snapshot is not held yet) proceeds, to the action the
-// host's explicit role names.
-fn checkpoint_materialize_work(m: CheckpointMaterialization, ctx: SparkMaterializeContext) -> SparkBuildHostWork {
-  match checkpoint_snapshot(c: m.checkpoint) {
-    Absent => SparkBuildHostWork { receipt: "REFUSED: the checkpoint has no row, so no snapshot subject exists to acquire\n", converged: false }
-    Present { value: snapshot } =>
-      match checkpoint_host_path(c: m.checkpoint) {
-        Absent => SparkBuildHostWork { receipt: "REFUSED: the checkpoint has no row, so no host path exists to mount\n", converged: false }
-        Present { value: host_path } =>
-          match checkpoint_verify_with(ctx: ctx, image: m.image, host_path: host_path, snapshot: snapshot) {
-            CheckpointVerified => SparkBuildHostWork { receipt: "ALREADY PRESENT and verified on this host; nothing moved\n", converged: true }
-            CheckpointVerifyUnread { cause: c } => SparkBuildHostWork { receipt: join(["REFUSED: this host's own verify learned nothing: ", c, "\n"], ""), converged: false }
-            CheckpointVerifyFailed { cause: c } => {
-              let note = join(["this host does not hold the snapshot yet (", c, ")\n"], "")
-              if host_identity_eq(a: ctx.host, b: m.seed) {
-                let w = checkpoint_seed_from_hub(m: m, ctx: ctx, host_path: host_path, snapshot: snapshot)
-                SparkBuildHostWork { receipt: join([note, "role: SEED (", m.seed as String, " is this checkpoint's seed host), so it fetches from the Hub\n", w.receipt], ""), converged: w.converged }
-              } else {
-                match checkpoint_peer_cause(m: m, candidate: m.seed, host_path: host_path, snapshot: snapshot) {
-                  Present { value: why } => SparkBuildHostWork { receipt: join([note, "role: REPLICA of seed ", m.seed as String, "\nREFUSED: the seed is not an admissible source, and a replica never fetches from the Hub instead: ", why, "\n"], ""), converged: false }
-                  Absent => {
-                    let w = checkpoint_replicate_from(m: m, peer: m.seed, tctx: ctx, host_path: host_path, snapshot: snapshot)
-                    SparkBuildHostWork { receipt: join([note, "role: REPLICA of seed ", m.seed as String, " (its own verify passed)\n", w.receipt], ""), converged: w.converged }
-                  }
-                }
-              }
-            }
-          }
-      }
-  }
-}
-
-// THE BYTES ARE ON THE HOST, NOT WHERE THE CLI HAPPENED TO PUT THEM (valiant-crab-775, 2026-10-03). A verify
-// run in the same container as the fetch can agree with a fetch that never reached the host (both used the
-// container's default cache), so after a converged acquisition the HOST's repo directory is measured by
-// `du` and must hold at least 95% of the checkpoint's recorded weight (the row's weight_gib, which is
-// rounded); anything less refuses, naming both figures.
-fn checkpoint_landed_on_host(ctx: SparkMaterializeContext, m: CheckpointMaterialization, snapshot: ModelSnapshotDesired) -> String? {
-  match serving_checkpoint_row(c: m.checkpoint) {
-    Absent => Present { value: "the checkpoint has no row, so its expected size is unknown" }
-    Present { value: row } =>
-      match snapshot_hub_paths(snapshot: snapshot) {
-        Absent => none
-        Present { value: paths } =>
-          match spark_remote_run(ctx: ctx, argv: hub_dereferenced_bytes_argv(path: paths.repo_dir)) {
-            RemoteUnreachable { cause: c, reach: _ } => Present { value: join(["the host's checkpoint size could not be read: ", c], "") }
-            RemoteRan { exit_code: code, stdout: out, stderr: err } =>
-              if code != 0 { Present { value: join(["du exited ", to_string(code), ": ", err], "") } } else {
-                match first(split(s: out, delimiter: "\t")) {
-                  Absent => Present { value: "du printed no size" }
-                  Present { value: word } =>
-                    match parse_int(s: trim(s: word)) {
-                      Absent => Present { value: join(["du printed `", word, "`, not a size"], "") }
-                      Present { value: bytes } => {
-                        let floor = (gibibyte_count(g: row.weight_gib) as Int) * 1020054732
-                        if bytes < floor { Present { value: join(["the host path ", paths.repo_dir as String, " holds ", to_string(bytes), " bytes, under the ", to_string(floor), " a landed checkpoint of ", to_string(gibibyte_count(g: row.weight_gib) as Int), " GiB holds; the fetch did not land on the host"], "") } }
-                        else { none }
-                      }
-                    }
-                }
-              }
-          }
-      }
-  }
-}
-
-// EVERY RESTART OF THE TRANSFER UNIT IS COUNTED AND REPORTED (operator ruling, 2026-10-03): Restart=on-failure
-// survives a radio drop, and its cost is that a failure is retried rather than surfaced, so the receipt states
-// systemd's own restart count for the unit; an unread count is said to be unread, never zero.
-fn transfer_restarts_line(ctx: SparkMaterializeContext, snapshot: ModelSnapshotDesired) -> String {
-  match model_snapshot_subject_for(role: SnapshotSeed, snapshot: snapshot, cache_root: spark_hub_cache_root) {
-    Absent => "transfer unit restarts: UNREAD (no subject)\n"
-    Present { value: subject } =>
-      match spark_remote_run(ctx: ctx, argv: ["systemctl", "show", spark_transfer_unit_for(subject: subject) as String, "--property=NRestarts", "--value"]) {
-        RemoteUnreachable { cause: c, reach: _ } => join(["transfer unit restarts: UNREAD (", c, ")\n"], "")
-        RemoteRan { exit_code: code, stdout: out, stderr: err } =>
-          if code != 0 { join(["transfer unit restarts: UNREAD (exit ", to_string(code), ": ", trim(s: err), ")\n"], "") }
-          else { join(["transfer unit restarts: ", remote_stdout_as_one_word(stdout: out), " (each a failure retried by Restart=on-failure)\n"], "") }
-      }
-  }
-}
-
-// THE SEED: no group host verifies this snapshot yet, so this host fetches it from the Hub.
-fn checkpoint_seed_from_hub(m: CheckpointMaterialization, ctx: SparkMaterializeContext, host_path: NonEmptyStr, snapshot: ModelSnapshotDesired) -> SparkBuildHostWork {
-  match held_image_hub_cli_executor(ctx: ctx, image: m.image, placement: snapshot_placement_of(snapshot: snapshot)) {
-    HeldImageExecutorRefused { cause: c } => SparkBuildHostWork { receipt: join(["REFUSED: ", c, "\n"], ""), converged: false }
-    HeldImageExecutorRead { executor: executor, receipt: r } =>
-      match spark_materialize_member(ctx: with_executor_ctx(ctx: ctx, executor: executor), role: SnapshotSeed, snapshot: snapshot) {
-        SparkMaterializeRefused { host: _, cause: c } => SparkBuildHostWork { receipt: join([r, "REFUSED: ", c as String, "\n"], ""), converged: false }
-        SparkMaterializeUnpinned { host: _ } => SparkBuildHostWork { receipt: join([r, "REFUSED: the snapshot carries no pinned revision\n"], ""), converged: false }
-        SparkMaterialized { host: _, outcome: o } =>
-          if !acquisition_converged(o: o) {
-            SparkBuildHostWork { receipt: join([r, transfer_restarts_line(ctx: ctx, snapshot: snapshot), acquisition_outcome_line(o: o)], ""), converged: false }
-          } else {
-            match checkpoint_landed_on_host(ctx: ctx, m: m, snapshot: snapshot) {
-              Present { value: why } => SparkBuildHostWork { receipt: join([r, acquisition_outcome_line(o: o), "REFUSED: ", why, "\n"], ""), converged: false }
-              Absent => SparkBuildHostWork { receipt: join([r, transfer_restarts_line(ctx: ctx, snapshot: snapshot), acquisition_outcome_line(o: o)], ""), converged: true }
-            }
-          }
-      }
-  }
-}
-
-// THE ENTRY. SPARK_CONVERGE_TARGET names the host, which must be one the group's serving subject holds;
-// unset refuses rather than fanning out, because this writes up to hundreds of gigabytes to the host.
-fn checkpoint_materialize_wet(m: CheckpointMaterialization, receipt_path: String) -> ProcessExit
-{
-  let now = clock_now_probed_at()
-  match spark_converge_target_selection(execute_apply: true) {
-    SparkConvergeTargetRefused { reason: why } => exit_failure(reason: why)
-    SparkConvergeTargetAllObserveOnly =>
-      exit_failure(reason: "SPARK_CONVERGE_TARGET is unset: materializing a checkpoint writes hundreds of gigabytes to the host it names, so it refuses rather than choosing one")
-    SparkConvergeTargetSingle { host: host } =>
-      match admit_host_held_by_subject(raw: host, subject: PairServingUnitOn { group: m.group }) {
-        Present { value: why } => exit_failure(reason: why)
-        Absent =>
-          match with_spark_build_host(
-            host: host,
-            attempt_raw: "checkpoint-materialize",
-            identity_file_name: "gunbc-checkpoint-materialize-admin-password" as NonEmptyStr,
-            use: fn(target, context, ctx) { checkpoint_materialize_work(m: m, ctx: ctx) },
-          ) {
-            SparkBuildHostRefused { cause: c } => exit_failure(reason: c)
-            SparkBuildHostRan { work: work, endpoint: endpoint, executor: executor, trust_receipt: trust_receipt } => {
-              let body = join([
-                join([m.title as String, " probed_at=", probed_at_word(reading: now) as String, " host=", host as String, " endpoint=", endpoint as String, " executor=", executor, " checkpoint=", serving_checkpoint_wire(c: m.checkpoint) as String, "\n"], ""),
-                trust_receipt,
-                work.receipt,
-              ], "")
-              let w = Filesystem.Write(path: receipt_path, content: body)
-              if !w.success {
-                exit_failure(reason: join([m.title as String, " receipt write failed: ", w.error], ""))
-              } else if work.converged {
-                ExitSuccess
-              } else {
-                exit_failure(reason: join([m.title as String, " did not converge:\n", body], ""))
-              }
-            }
-          }
-      }
-  }
-}
diff --git a/dag/gunbc/spark/group_image_produce.dag b/dag/gunbc/spark/group_image_produce.dag
deleted file mode 100644
index 38d80c9f25a..00000000000
--- a/dag/gunbc/spark/group_image_produce.dag
+++ /dev/null
@@ -1,263 +0,0 @@
-module gunbc.spark.group_image_produce
-
-import std.types { String, NonEmptyStr }
-import std.measure { Second, second }
-import product.host_identity { HostIdentity, host_identity_eq }
-import extdeps.container.oci.digest { render_oci_content_digest_wire }
-import gunbc.spark.host_effect_quiescence { HostEffectResidueSpec }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import std.optional { Present, Absent }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext, SshTarget }
-import gunbc.fleet_multi_principal_probe { spark_converge_target_selection, SparkConvergeTargetSingle, SparkConvergeTargetAllObserveOnly, SparkConvergeTargetRefused }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_hosts }
-import gunbc.spark.serving_subject { PairServingUnitOn }
-import gunbc.spark.host_occupancy_admission { admit_spark_host_unoccupied, spark_ctx_argv_run }
-import gunbc.spark.host_commitment { HostEffectClaimLanded, HostEffectClaimNotLanded, admit_host_held_by_subject, claim_host_effect_live, release_host_effect_live }
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext }
-import gunbc.spark.vllm_runtime_image_build { SparkBuildHostWork, with_spark_build_host, SparkBuildHostRefused, SparkBuildHostRan, VllmImageDistributionSubject, distribute_vllm_image, vllm_image_distribution_wire, vllm_image_distribution_succeeded, vllm_image_transfer_tar_path, vllm_build_host_effect_term, vllm_build_host_purpose, vllm_build_host_residue, vllm_build_host_memory_need, vllm_image_read_held, VllmImageHeldAs, VllmImageNotHeld, VllmImageHeldUnread }
-
-// ── ONE ENTRY FOR PRODUCING A RUNTIME IMAGE ON A FABRIC GROUP'S HOST (deforking cut 8c) ─────────
-//
-// gunbc.spark.v41_runtime_image_converge v41_runtime_image_produce_ci_wet was this body with V4.1's build
-// inlined, and the GLM kvplan image needs exactly the same entry: the session host named by
-// SPARK_CONVERGE_TARGET (unset refuses -- a build occupies one host for hours), admitted because the
-// group's serving subject HOLDS it (gunbc.spark.host_commitment admit_host_held_by_subject; the unplaced
-// relation refuses every Group A host by design), the host-effect claim of a source build so two builds
-// never share a box, the occupancy admission, the privileged session, and the receipt. What differs
-// between images is only the work done inside the session, so that is the one parameter.
-type GroupImageProduction {
-  title: NonEmptyStr
-  group: FabricGroup
-  attempt_raw: String
-  identity_file_name: NonEmptyStr
-  produce: fn(SshTarget, FleetSshExecutionContext, SparkMaterializeContext) -> SparkBuildHostWork
-}
-
-fn group_image_produce_wet(p: GroupImageProduction, receipt_path: String) -> ProcessExit
-{
-  let now = clock_now_probed_at()
-  match spark_converge_target_selection(execute_apply: true) {
-    SparkConvergeTargetRefused { reason: why } => exit_failure(reason: why)
-    SparkConvergeTargetAllObserveOnly =>
-      exit_failure(reason: "SPARK_CONVERGE_TARGET is unset: producing an image occupies one host for hours, so it refuses rather than choosing one")
-    SparkConvergeTargetSingle { host: build_host } =>
-      match admit_host_held_by_subject(raw: build_host, subject: PairServingUnitOn { group: p.group }) {
-        Present { value: why } => exit_failure(reason: why)
-        Absent =>
-          match claim_host_effect_live(host: build_host, term: vllm_build_host_effect_term, purpose: vllm_build_host_purpose, residue: vllm_build_host_residue()) {
-            HostEffectClaimNotLanded { cause: why } => exit_failure(reason: why as String)
-            HostEffectClaimLanded { handle: handle } =>
-              release_host_effect_live(handle: Present { value: handle }, exit: {
-                match with_spark_build_host(
-                  host: build_host,
-                  attempt_raw: p.attempt_raw,
-                  identity_file_name: p.identity_file_name,
-                  use: fn(target, context, ctx) {
-                    match admit_spark_host_unoccupied(run: spark_ctx_argv_run(ctx: ctx), host: build_host, purpose: vllm_build_host_purpose, need: vllm_build_host_memory_need) {
-                      Present { value: why } => SparkBuildHostWork { receipt: join(["refused-before-run: ", why, "\n"], ""), converged: false }
-                      Absent => p.produce(target, context, ctx)
-                    }
-                  },
-                ) {
-                  SparkBuildHostRefused { cause: c } => exit_failure(reason: c)
-                  SparkBuildHostRan { work: work, endpoint: endpoint, executor: executor, trust_receipt: trust_receipt } => {
-                    let body = join([
-                      join([p.title as String, " probed_at=", probed_at_word(reading: now) as String, " host=", build_host as String, " endpoint=", endpoint as String, " executor=", executor, "\n"], ""),
-                      trust_receipt,
-                      work.receipt,
-                    ], "")
-                    let w = Filesystem.Write(path: receipt_path, content: body)
-                    if !w.success {
-                      exit_failure(reason: join([p.title as String, " receipt write failed: ", w.error], ""))
-                    } else if work.converged {
-                      ExitSuccess
-                    } else {
-                      exit_failure(reason: join([p.title as String, " was not produced:\n", body], ""))
-                    }
-                  }
-                }})
-          }
-      }
-  }
-}
-
-// ── ONE ENTRY FOR DISTRIBUTING A PRODUCED IMAGE TO ANOTHER HOST OF ITS GROUP (deforking cut 8c) ──────
-//
-// gunbc.spark.v41_runtime_image_converge v41_runtime_image_distribute_ci_wet with V4.1's row inlined;
-// generalized because every produced image moves the same way: the subject is the PRODUCTION RECEIPT
-// (tag and configuration digest, the host that answered, the run that produced it), never a tag
-// typed at dispatch; SPARK_CONVERGE_TARGET names the target; both hosts are admitted because the
-// group's subject holds them and both are claimed, because both carry the effect; the transport is
-// gunbc.spark.vllm_runtime_image_build distribute_vllm_image (save, rail pull, load, readback by
-// digest).
-type ProducedImageHeld {
-  title: NonEmptyStr
-  group: FabricGroup
-  subject: VllmImageDistributionSubject
-  held_on: HostIdentity
-  receipt_run: NonEmptyStr
-}
-
-data image_distribution_host_purpose: NonEmptyStr = "a runtime image distribution, which saves or loads the produced image through a digest-named staging tar" as NonEmptyStr
-data image_distribution_host_effect_term: Second = second(count: 7200)
-
-fn image_distribution_residue(h: ProducedImageHeld) -> HostEffectResidueSpec {
-  HostEffectResidueSpec { process_pattern: vllm_image_transfer_tar_path(config: h.subject.config), container: none }
-}
-
-fn with_image_distribution_claim(host: HostIdentity, h: ProducedImageHeld, run: fn() -> ProcessExit) -> ProcessExit {
-  match claim_host_effect_live(host: host, term: image_distribution_host_effect_term, purpose: image_distribution_host_purpose, residue: image_distribution_residue(h: h)) {
-    HostEffectClaimNotLanded { cause: why } => exit_failure(reason: why as String)
-    HostEffectClaimLanded { handle: handle } => release_host_effect_live(handle: Present { value: handle }, exit: run())
-  }
-}
-
-// ── THE SOURCE IS ANY GROUP HOST WHOSE READBACK OF THE DIGEST MATCHES (ruling of valiant-crab-775,
-// 2026-10-03) ─────────────────────────────────────────────────────────────────────────────────────────
-//
-// The production host is where the image was BUILT (h.held_on, the receipt), not the only place it can
-// be moved from: a host the distribution already delivered to holds the same configuration digest, read
-// back by the same inspect. So a host is an admissible source exactly when its image under the tag reads
-// back as the subject's digest. The production host is asked first, then the group's other hosts in roster
-// order, never the target; the first that reads back the digest is the source. A host that is unreachable,
-// holds nothing, or holds another image is not a source, and each such reading is kept: when no host
-// qualifies the distribution refuses with every candidate's cause, never moving a tag-matched stranger.
-type DistributionSource
-  = DistributionSourceAdmitted { host: HostIdentity, reading: String }
-  | NoAdmissibleDistributionSource { causes: List<String> }
-
-fn distribution_source_candidates(h: ProducedImageHeld, target: HostIdentity) -> List<HostIdentity> {
-  concat([h.held_on], filter(fabric_group_hosts(g: h.group), x => !host_identity_eq(a: x, b: h.held_on) && !host_identity_eq(a: x, b: target)))
-}
-
-fn distribution_source_reading(h: ProducedImageHeld, candidate: HostIdentity) -> DistributionSource {
-  let want = render_oci_content_digest_wire(d: h.subject.config)
-  match with_spark_build_host(
-    host: candidate,
-    attempt_raw: "runtime-image-source-readback",
-    identity_file_name: "gunbc-runtime-image-distribute-admin-password" as NonEmptyStr,
-    use: fn(target, context, ctx) {
-      match vllm_image_read_held(ctx: ctx, step: "distribute-source-readback" as NonEmptyStr, tag: h.subject.tag) {
-        VllmImageHeldUnread { step: _, cause: why } => SparkBuildHostWork { receipt: join(["unread: ", why], ""), converged: false }
-        VllmImageNotHeld => SparkBuildHostWork { receipt: join(["holds no image under ", h.subject.tag as String], ""), converged: false }
-        VllmImageHeldAs { id: id, size: _ } =>
-          if (id as String) == want { SparkBuildHostWork { receipt: join(["holds ", want], ""), converged: true } }
-          else { SparkBuildHostWork { receipt: join(["holds ", id as String, ", not ", want], ""), converged: false } }
-      }
-    },
-  ) {
-    SparkBuildHostRefused { cause: c } => NoAdmissibleDistributionSource { causes: [join([candidate as String, ": ", c], "")] }
-    SparkBuildHostRan { work: w, endpoint: _, executor: _, trust_receipt: _ } =>
-      if w.converged { DistributionSourceAdmitted { host: candidate, reading: w.receipt } }
-      else { NoAdmissibleDistributionSource { causes: [join([candidate as String, ": ", w.receipt], "")] } }
-  }
-}
-
-// EVERY CANDIDATE WHOSE READBACK MATCHES, in order, with the causes of those that did not.
-type DistributionSources {
-  admitted: List<HostIdentity>
-  causes: List<String>
-}
-
-fn distribution_sources_for(h: ProducedImageHeld, target: HostIdentity) -> DistributionSources {
-  fold(distribution_source_candidates(h: h, target: target), init: DistributionSources { admitted: [] as List<HostIdentity>, causes: [] as List<String> }, f: (acc, c) =>
-    match distribution_source_reading(h: h, candidate: c) {
-      DistributionSourceAdmitted { host: s, reading: _ } => DistributionSources { admitted: concat(acc.admitted, [s]), causes: acc.causes }
-      NoAdmissibleDistributionSource { causes: now } => DistributionSources { admitted: acc.admitted, causes: concat(acc.causes, now) }
-    })
-}
-
-// THE RECEIPT NAMES THE SOURCE USED AND WHY EACH EARLIER CANDIDATE WAS SKIPPED (operator ruling, 2026-10-03:
-// no silent degradation): the readback causes of hosts that did not hold the digest, and the claim causes of
-// matching hosts held by another effect, each on its own line; with none admissible the run refuses with all.
-// A SOURCE MUST ALSO BE CLAIMABLE. Its save into the blob root is a host effect, so the source is used only
-// when its host-effect claim lands; a source still held by another live effect (a stale claim that has not
-// been read quiescent, for instance) is passed over for the next matching host, and its cause is kept.
-type DistributionAttempt
-  = DistributionNotYet { causes: List<String> }
-  | DistributionRan { exit: ProcessExit }
-
-fn distribute_from_claimed_source(h: ProducedImageHeld, source: HostIdentity, target_host: HostIdentity, receipt_path: String, skipped: List<String>) -> ProcessExit {
-  if host_identity_eq(a: target_host, b: source) {
-    produced_image_distribute_to(source: source, target_host: target_host, h: h, receipt_path: receipt_path, skipped: skipped)
-  } else {
-    with_image_distribution_claim(host: target_host, h: h, run: fn() { produced_image_distribute_to(source: source, target_host: target_host, h: h, receipt_path: receipt_path, skipped: skipped) })
-  }
-}
-
-fn distribute_from_first_claimable(h: ProducedImageHeld, target_host: HostIdentity, sources: List<HostIdentity>, receipt_path: String, unread: List<String>) -> DistributionAttempt {
-  fold(sources, init: DistributionNotYet { causes: unread }, f: (acc, source) =>
-    match acc {
-      DistributionRan { exit: _ } => acc
-      DistributionNotYet { causes: before } =>
-        match admit_host_held_by_subject(raw: source, subject: PairServingUnitOn { group: h.group }) {
-          Present { value: why } => DistributionNotYet { causes: concat(before, [join([source as String, ": ", why], "")]) }
-          Absent =>
-            match claim_host_effect_live(host: source, term: image_distribution_host_effect_term, purpose: image_distribution_host_purpose, residue: image_distribution_residue(h: h)) {
-              HostEffectClaimNotLanded { cause: why } => DistributionNotYet { causes: concat(before, [join([source as String, ": ", why as String], "")]) }
-              HostEffectClaimLanded { handle: handle } =>
-                DistributionRan { exit: release_host_effect_live(handle: Present { value: handle }, exit: distribute_from_claimed_source(h: h, source: source, target_host: target_host, receipt_path: receipt_path, skipped: before)) }
-            }
-        }
-    })
-}
-
-fn produced_image_distribute_to(source: HostIdentity, target_host: HostIdentity, h: ProducedImageHeld, receipt_path: String, skipped: List<String>) -> ProcessExit {
-  let now = clock_now_probed_at()
-  match with_spark_build_host(
-    host: source,
-    attempt_raw: "runtime-image-distribute",
-    identity_file_name: "gunbc-runtime-image-distribute-admin-password" as NonEmptyStr,
-    use: fn(target, context, ctx) {
-      let dist = distribute_vllm_image(source_ctx: ctx, image: h.subject, targets: [target_host])
-      SparkBuildHostWork { receipt: vllm_image_distribution_wire(dist: dist), converged: vllm_image_distribution_succeeded(dist: dist) }
-    },
-  ) {
-    SparkBuildHostRefused { cause: c } => exit_failure(reason: c)
-    SparkBuildHostRan { work: work, endpoint: endpoint, executor: executor, trust_receipt: trust_receipt } => {
-      let body = join([
-        join([h.title as String, " distribute probed_at=", probed_at_word(reading: now) as String, " source=", source as String, " produced_on=", h.held_on as String, " endpoint=", endpoint as String, " target=", target_host as String, " executor=", executor, "\n"], ""),
-        join(map(skipped, x => join(["  source candidate skipped: ", x, "\n"], "")), ""),
-        trust_receipt,
-        join(["image tag=", h.subject.tag as String, " config_digest=", render_oci_content_digest_wire(d: h.subject.config), " receipt_run=", h.receipt_run as String, "\n"], ""),
-        work.receipt,
-      ], "")
-      let w = Filesystem.Write(path: receipt_path, content: body)
-      if !w.success {
-        exit_failure(reason: join([h.title as String, " distribute receipt write failed: ", w.error], ""))
-      } else if work.converged {
-        ExitSuccess
-      } else {
-        exit_failure(reason: join([h.title as String, " was not verified on the target:\n", body], ""))
-      }
-    }
-  }
-}
-
-fn produced_image_distribute_wet(h: ProducedImageHeld, receipt_path: String) -> ProcessExit
-{
-  match spark_converge_target_selection(execute_apply: true) {
-    SparkConvergeTargetRefused { reason: why } => exit_failure(reason: why)
-    SparkConvergeTargetAllObserveOnly =>
-      exit_failure(reason: "SPARK_CONVERGE_TARGET is unset: distributing an image writes tens of gigabytes to the host it names, so it refuses rather than choosing one")
-    SparkConvergeTargetSingle { host: target_host } =>
-      match admit_host_held_by_subject(raw: target_host, subject: PairServingUnitOn { group: h.group }) {
-        Present { value: why } => exit_failure(reason: why)
-        Absent => {
-              let found = distribution_sources_for(h: h, target: target_host)
-              let srcs = found.admitted
-              let rc = found.causes
-              if length(srcs) == 0 {
-                exit_failure(reason: join(["no group host reads back ", render_oci_content_digest_wire(d: h.subject.config), " under ", h.subject.tag as String, ", so nothing is a source:\n  ", join(rc, "\n  ")], ""))
-              } else {
-                match distribute_from_first_claimable(h: h, target_host: target_host, sources: srcs, receipt_path: receipt_path, unread: rc) {
-                  DistributionRan { exit: e } => e
-                  DistributionNotYet { causes: cc } => exit_failure(reason: join(["every host that reads back the digest is held by another effect, so none could be claimed as the source:\n  ", join(cc, "\n  ")], ""))
-                }
-              }
-          }
-      }
-  }
-}
diff --git a/dag/gunbc/spark/host_commitment.dag b/dag/gunbc/spark/host_commitment.dag
index 1ef26ac5557..f5d3ac333a7 100644
--- a/dag/gunbc/spark/host_commitment.dag
+++ b/dag/gunbc/spark/host_commitment.dag
@@ -16,7 +16,7 @@ import gunbc.spark.cell_role {
   spark_cell_role_in,
   spark_cell_role_assignments,
 }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB, fabric_group_hosts, fabric_group_wire, fabric_group_of_host }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_hosts, fabric_group_wire, fabric_group_of_host }
 import gunbc.spark.pair_serving_authority { PairServingGroupAuthority, spark_pair_serving_authorities, pair_serving_commits_hosts, pair_serving_authority_group, pair_serving_committed_hosts, pair_serving_authority_for }
 import gunbc.spark.pair_serving_authority_log {
   CurrentAuthority, CurrentAuthorityRead, CurrentAuthorityUnread, current_pair_serving_authorities, current_pair_serving_authority,
@@ -41,7 +41,6 @@ import std.measure { Second, second_count }
 import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
 import gunbc.spark.fabric_reach { ExecutorReachKnown, ExecutorReachUnknown, observe_executor_reach }
 import gunbc.fabric_event_log_host { now_epoch_seconds }
-import gunbc.spark.llama_cpp_rpc_observed { llama_cpp_rpc_undischarged_peer_reservation_hosts }
 import gunbc.spark.serving_arm_placement { ServingArmHostClaim, spark_serving_arm_host_claims }
 import gunbc.spark.dgx_procurement { dgx_spark_reserved_identities }
 import gunbc.spark.serving_subject {
@@ -195,7 +194,6 @@ type SparkHostAuthorityCommitment
   = CommittedToCellRole { role: SparkCellRole }
   | MemberOfClaimedServingGroup { group: FabricGroup }
   | OccupiedByServingArm { claim: ServingArmHostClaim }
-  | HoldsUndischargedRpcReservation
   | OccupiedByHostEffect { purpose: NonEmptyStr, executor: NonEmptyStr }
   | CellRoleUndecidable { assignments: List<SparkCellRoleAssignment> }
 
@@ -238,7 +236,6 @@ fn spark_host_commitments_in(
   assignments: List<SparkCellRoleAssignment>,
   claimed_group_members: List<ClaimedServingGroupMember>,
   arm_claims: List<ServingArmHostClaim>,
-  held_reservation_hosts: List<HostIdentity>,
   serving_reservations: List<SparkServingReservation>,
   host_effects: List<HostEffectRecord>,
   host: HostIdentity,
@@ -257,16 +254,10 @@ fn spark_host_commitments_in(
       init: ruled,
       f: fn(acc, r) { Cons { head: AuthorityHeldCommitment { cause: OccupiedByHostEffect { purpose: r.purpose, executor: r.executor } }, tail: acc } },
     )
-  let reserved =
-    if any(held_reservation_hosts, h => host_identity_eq(a: h, b: host)) {
-      Cons { head: AuthorityHeldCommitment { cause: HoldsUndischargedRpcReservation }, tail: effected }
-    } else {
-      effected
-    }
   let armed =
     fold(
       filter(arm_claims, c => host_identity_eq(a: c.host, b: host)),
-      init: reserved,
+      init: effected,
       f: fn(acc, c) { Cons { head: AuthorityHeldCommitment { cause: OccupiedByServingArm { claim: c } }, tail: acc } },
     )
   let serving =
@@ -324,7 +315,6 @@ fn spark_host_standings_in(
   assignments: List<SparkCellRoleAssignment>,
   claimed_group_members: List<ClaimedServingGroupMember>,
   arm_claims: List<ServingArmHostClaim>,
-  held_reservation_hosts: List<HostIdentity>,
   serving_reservations: List<SparkServingReservation>,
   host_effects: List<HostEffectRecord>,
 ) -> List<SparkHostStanding> {
@@ -332,7 +322,6 @@ fn spark_host_standings_in(
     assignments: assignments,
     claimed_group_members: claimed_group_members,
     arm_claims: arm_claims,
-    held_reservation_hosts: held_reservation_hosts,
     serving_reservations: serving_reservations,
     host_effects: host_effects,
     host: h,
@@ -351,7 +340,6 @@ fn spark_host_standing_in(
   assignments: List<SparkCellRoleAssignment>,
   claimed_group_members: List<ClaimedServingGroupMember>,
   arm_claims: List<ServingArmHostClaim>,
-  held_reservation_hosts: List<HostIdentity>,
   serving_reservations: List<SparkServingReservation>,
   host_effects: List<HostEffectRecord>,
   host: HostIdentity,
@@ -362,7 +350,6 @@ fn spark_host_standing_in(
       assignments: assignments,
       claimed_group_members: claimed_group_members,
       arm_claims: arm_claims,
-      held_reservation_hosts: held_reservation_hosts,
       serving_reservations: serving_reservations,
       host_effects: host_effects,
     ),
@@ -449,7 +436,6 @@ fn serving_subject_claims_host(subject: ServingSubject, siblings: FreeSemigroup<
         MemberOfClaimedServingGroup { group: g } => serving_subject_eq(a: subject, b: PairServingUnitOn { group: g })
         OccupiedByServingArm { claim: cl } => serving_subject_eq(a: subject, b: PlacedServingArm { arm: cl.arm })
         CommittedToCellRole { role: _ } => false
-        HoldsUndischargedRpcReservation => false
         OccupiedByHostEffect { purpose: _, executor: _ } => false
         CellRoleUndecidable { assignments: _ } => false
       }
@@ -471,7 +457,6 @@ fn spark_commitment_held_by(c: SparkHostCommitment, siblings: FreeSemigroup<Spar
           }
         MemberOfClaimedServingGroup { group: g } => serving_subject_eq(a: subject, b: PairServingUnitOn { group: g })
         OccupiedByServingArm { claim: cl } => serving_subject_eq(a: subject, b: PlacedServingArm { arm: cl.arm })
-        HoldsUndischargedRpcReservation => false
         OccupiedByHostEffect { purpose: _, executor: _ } => false
         CellRoleUndecidable { assignments: _ } => false
       }
@@ -553,10 +538,6 @@ fn spark_claimed_serving_group_members() -> List<ClaimedServingGroupMember> {
   spark_claimed_members_under(authorities: spark_pair_serving_authorities)
 }
 
-fn spark_claimed_serving_group_hosts() -> List<HostIdentity> {
-  map(spark_claimed_serving_group_members(), m => m.host)
-}
-
 // THE STANDINGS OVER SUPPLIED AUTHORITIES. The resting projection below hands in the source rows
 // (pure, the population every pure consumer reads); the effectful admission seams hand in the
 // CURRENT authorities read from the event log (spark_host_standings_current), so an effect that
@@ -567,7 +548,6 @@ fn spark_host_standings_under(authorities: List<PairServingGroupAuthority>, host
     assignments: spark_cell_role_assignments,
     claimed_group_members: spark_claimed_members_under(authorities: authorities),
     arm_claims: spark_serving_arm_host_claims,
-    held_reservation_hosts: llama_cpp_rpc_undischarged_peer_reservation_hosts(),
     serving_reservations: spark_serving_reservations,
     host_effects: host_effects,
   )
@@ -636,7 +616,7 @@ fn group_standing_over(group: FabricGroup, partition: GroupPartitionRead, placem
 // re-reads of a live store that could disagree with each other.
 fn spark_host_standings_over(store: FabricStorageBinding, at: EpochSecs) -> CurrentStandings {
   let placement = placement_fold_read(store: store)
-  let groups = map([FabricGroupA, FabricGroupB], g => GroupSnapshot { group: g, partition: read_group_partition(store: store, group: g) })
+  let groups = map([FabricGroupB {}], g => GroupSnapshot { group: g, partition: read_group_partition(store: store, group: g) })
   let standings = map(groups, gs => group_standing_over(group: gs.group, partition: gs.partition, placement: placement, at: at))
   let unread = flat_map(standings, st => match st { GroupStandingUnread { cause: c } => [c]  GroupStandingEstablished { current: _ } => [] as List<String>  GroupStandingUnclaimed => [] as List<String> })
   if length(unread) != 0 {
@@ -769,7 +749,6 @@ fn spark_authority_commitment_wire(c: SparkHostAuthorityCommitment) -> NonEmptyS
     CommittedToCellRole { role: _ } => "committed to a Spark cell role" as NonEmptyStr
     MemberOfClaimedServingGroup { group: g } => join(["a member of a serving group this repository claims (", fabric_group_wire(g: g) as String, ")"], "") as NonEmptyStr
     OccupiedByServingArm { claim: c2 } => join(["a serving arm is placed on it (", declaration_ref_display_key(ref: c2.arm), ")"], "") as NonEmptyStr
-    HoldsUndischargedRpcReservation => "holding an undischarged llama.cpp RPC peer reservation" as NonEmptyStr
     OccupiedByHostEffect { purpose: p, executor: x } => join(["held by a live host effect (", p as String, " by ", x as String, ") until it is released"], "") as NonEmptyStr
     CellRoleUndecidable { assignments: _ } => "carrying more than one cell role row, so its commitment cannot be decided" as NonEmptyStr
   }
diff --git a/dag/gunbc/spark/llama_cpp_rpc_observed.dag b/dag/gunbc/spark/llama_cpp_rpc_observed.dag
deleted file mode 100644
index 328d59cb81e..00000000000
--- a/dag/gunbc/spark/llama_cpp_rpc_observed.dag
+++ /dev/null
@@ -1,1208 +0,0 @@
-module gunbc.spark.llama_cpp_rpc_observed
-
-import std.types { String, Bool, List, Int, NonEmptyStr, Port }
-import std.measure {
-  TokenCount, token_count, token_count_value,
-  ByteSize, byte_size,
-  PositiveSlotCount, positive_slot_count, positive_slot_count_value,
-  PositiveMeasureCount, positive_measure_count, positive_measure_count_value,
-  TokensPerSecond, tokens_per_second, tokens_per_second_count,
-  PositiveShardCount, positive_shard_count, positive_shard_count_value,
-}
-import std.content_hash { Sha256Digest, sha256_hex_digest }
-import product.host_identity { HostIdentity, host_identity_eq }
-import extdeps.network.ipv4 { Ipv4Address, ipv4_address, render_ipv4_address, ipv4_address_eq }
-import gunbc.fleet_host_identity { operator_host_srv7, operator_host_srv8 }
-import gunbc.spark.model_snapshot_acquisition { spark_models_root }
-
-// A SERVING DEPLOYMENT THAT SPANS TWO HOSTS, WHICH THIS CORPUS HAD NO WAY TO SAY.
-//
-// Every serving structure in gunbc.spark is keyed on ONE HostIdentity: a release, an occurrence, a
-// launch profile, a readiness probe, all per host. That shape carries an assumption it never states
-// -- that a host is a llama.cpp RPC deployment -- and the assumption is FALSE for the deployment the operator
-// specified. Two Sparks hold one model split by layer, and the operator's first sentence is the
-// whole modeling problem: "the two hosts are ONE SERVING UNIT, not two endpoints."
-//
-// WHAT THIS MODULE IS AND IS NOT. It is an OBSERVATION. The specification's own provenance section
-// classifies the running deployment as "an observed running deployment on the experimentation pair,
-// input to convergence, NOT published desired state", and this module holds it at exactly that
-// standing. Nothing here is projected into gunbc.spark.serving_desired, so nothing here can be
-// actuated back onto .232/.233. Promoting it is a separate, declared act.
-//
-// WHAT IS NOT VERIFIED, carried because the spec carries it: reboot survival. Both units are
-// `enabled` and were started through systemd, but neither host has been power-cycled. That is
-// recorded as unobserved rather than assumed either way -- the fabric on the other pair was lost to
-// exactly one power cycle, which is why gunbc.spark.fabric_link_desired exists.
-
-// THE TWO ROLES ARE TWO TYPES, NOT ONE TYPE WITH A ROLE FIELD.
-//
-// A role enum beside a member makes "a deployment with two front doors" and "a deployment whose
-// weights peer is marked front door" both writable, leaving a validator to catch them. Distinct
-// types make them unconstructable: the deployment names one of each, so the invalid shapes have no
-// constructor rather than a check. This is DESIGN's construction-over-validation at the cheapest
-// place to buy it -- the moment the carrier is first authored.
-//
-// THE FRONT DOOR IS THE ONLY ADDRESSABLE END. It serves the OpenAI and Anthropic surfaces, owns the
-// KV cache and the slot scheduler, and drives the weights peer.
-//
-// THE FIELD IS THE CONNECT ADDRESS, NOT THE LISTEN ADDRESS, AND THE DISTINCTION IS A MEANING FORK
-// THIS MODULE ALREADY PAID FOR ONCE. The measured llama-server binds 0.0.0.0; 192.168.1.232 is the
-// address a client dials. This carrier first named the field `bind_address` while
-// llama_cpp_rpc_client_endpoint handed that same value to clients -- operationally correct, and the
-// name asserted the wrong fact, which is exactly the listen-versus-connect fork the ollama path
-// learned earlier. A listen address is a fact about the process's socket and belongs with the
-// runtime realization if it is ever needed; what a llama.cpp RPC deployment owes a caller is where to dial.
-//
-// It is an Ipv4Address rather than a NonEmptyStr because the fourth constructor condition below has
-// to be able to ASK whether two endpoints are the same address, and a string cannot answer that
-// without a second parser.
-type LlamaCppRpcFrontDoor sole_constructor {
-  host: HostIdentity
-  client_address: Ipv4Address
-  port: Port
-}
-
-// THE WEIGHTS PEER HAS NO API AND MUST NEVER RECEIVE CLIENT TRAFFIC, and on this pair that is not a
-// style rule -- it is constraint C1, whose violation is a host loss.
-//
-// MEASURED 2026-09-02, not taken from the handoff: the peer's host answers HTTP 200 on
-// :11434/api/tags and OFFERS TWO MODELS, both about 86.7 GB. One of them is
-// deepseek-v4-gguf:no-h3-stop -- WHICH IS EXACTLY THE MODEL THE SINGLE-HOST SERVING ROSTER SELECTS
-// AS ITS DESIRED STATE. So the collision is not hypothetical and not merely "some load could arrive
-// here": adding this host to that roster would plan a pull-and-load of an 86.7 GB model onto a
-// machine with roughly 16 GiB free, and the two rosters would each be individually correct.
-//
-// The peer's host ALSO runs an unrelated ollama on :11434 which WILL accept work. With roughly 105
-// of 121 GiB already committed to weights and swap DISABLED, a model load accepted there is an
-// immediate OOM kill that takes the front door down with it, because the front door cannot serve
-// without the layers this host holds. So the failure is not "a request went to the wrong port"; it
-// is the loss of the whole llama.cpp RPC deployment.
-//
-// The peer is addressed on the FABRIC, never on the LAN, and the constructor below enforces it.
-type LlamaCppRpcWeightsPeer sole_constructor {
-  host: HostIdentity
-  fabric_address: Ipv4Address
-  port: Port
-}
-
-fn llama_cpp_rpc_front_door(host: HostIdentity, client_address: Ipv4Address, port: Port) -> LlamaCppRpcFrontDoor {
-  LlamaCppRpcFrontDoor { host: host, client_address: client_address, port: port }
-}
-
-fn llama_cpp_rpc_weights_peer(host: HostIdentity, fabric_address: Ipv4Address, port: Port) -> LlamaCppRpcWeightsPeer {
-  LlamaCppRpcWeightsPeer { host: host, fabric_address: fabric_address, port: port }
-}
-
-fn llama_cpp_rpc_slot_plan(per_slot_context: TokenCount, slots: PositiveSlotCount) -> LlamaCppRpcSlotPlan {
-  LlamaCppRpcSlotPlan { per_slot_context: per_slot_context, slots: slots }
-}
-
-// PER-SLOT CONTEXT IS THE AUTHORED FACT AND THE TOTAL BUDGET IS DERIVED, WHICH IS THE WHOLE REPAIR
-// FOR THE `-c` TRAP.
-//
-// llama.cpp's `-c` is the TOTAL KV budget across all slots and is divided by `--parallel`. The
-// operator's table records what that costs when the two are authored independently:
-//
-//     -c 10485760  --parallel 10  ->  1,048,576 per slot   (intended)
-//     -c 10485760  --parallel 16  ->    655,360 per slot   (silent shrink)
-//     -c  6291456  --parallel 16  ->      2,048 per slot   (this bit us once)
-//
-// Every one of those is a WRITABLE state when `-c` and `--parallel` are two authored numbers, and
-// nothing announces the shrink -- the server starts, serves, and answers with a context two orders
-// of magnitude smaller than intended. Authoring the per-slot window instead and DERIVING `-c` makes
-// all three unwritable: there is no pair to disagree, because there is no second number.
-//
-// THIS IS ALSO WHY THE ENGINE IS NAMED IN THIS MODULE'S TYPE AND NOT ASSUMED. gunbc.spark.
-// serving_desired carries a measured note that slot count MULTIPLIES memory and does NOT divide
-// context. That is true, and it is true OF OLLAMA, where the context length is a per-slot server
-// default. The same sentence is false here. One row spanning both engines is a meaning fork whose
-// realization is precisely the 2,048-per-slot line above.
-type LlamaCppRpcSlotPlan sole_constructor {
-  per_slot_context: TokenCount
-  slots: PositiveSlotCount
-}
-
-// The `-c` word the unit actually carries, derived from the pair above rather than authored beside
-// them. A convergence check must NOT assert on this value: `/props` reports
-// `default_generation_settings.n_ctx` as the ALREADY-DIVIDED per-slot figure, so the unit file's
-// number and the served reality are different quantities, and comparing the wrong one is how the
-// silent shrink stays invisible. This exists to RENDER the unit, and llama_cpp_rpc_slot_plan_per_slot below
-// is what a readback is compared against.
-fn llama_cpp_rpc_slot_plan_total_kv(plan: LlamaCppRpcSlotPlan) -> TokenCount {
-  token_count(
-    count: token_count_value(t: plan.per_slot_context) * positive_slot_count_value(slots: plan.slots))
-}
-
-fn llama_cpp_rpc_slot_plan_per_slot(plan: LlamaCppRpcSlotPlan) -> TokenCount {
-  plan.per_slot_context
-}
-
-// ONE SERVING UNIT, and the constructor is where "two hosts" stops being two of anything.
-//
-// Four conditions decide it, and each is a way the specified deployment could be described wrongly
-// while every part looked individually fine:
-//
-//   - the two ends must be DIFFERENT HOSTS. A split across one machine is not a split; it is one
-//     process talking to itself over a network address, and it would report healthy.
-//   - the peer must be addressed ON THE FABRIC LINK the deployment names. This is the condition
-//     with a measured price: the same deployment ran at 4.2 GB/min over the LAN and 144 GB/min over
-//     RoCE -- 34x -- and NOTHING IN THE SERVED BEHAVIOUR DISTINGUISHES THEM except latency. A peer
-//     addressed on the LAN is a working deployment that is silently thirty-four times slower, which
-//     is the class of defect that gets diagnosed as "the model is slow".
-//   - the fabric link must actually TOUCH BOTH HOSTS. A link between two other machines is not the
-//     path these two speak over, and naming it would make the check above pass against the wrong
-//     subject.
-//   - the front door and the peer must not be the same PORT ON THE SAME ADDRESS, which is the
-//     copy-paste of the endpoint block. This condition was CLAIMED here before it was enforced --
-//     the annotation said four and the constructor implemented three -- which is the decoration
-//     case: a stated invariant nothing checks reads as coverage. It is now decidable because the
-//     front door carries an Ipv4Address rather than a string, and it has its own discriminating RED.
-//
-// A deployment that fails any of them has no constructor. It is not reported later.
-// THE RAIL THE 2026-09-02 DEPLOYMENT USED, FROZEN HERE AS ITS OWN DATED VALUE. This module used to
-// cite the desired direct-cable row and derive the peer address from it; that row was retired when
-// the fabric moved to the switch on 2026-09-05, which is exactly the case the module's own rule
-// named: the historical side stops deriving and carries its snapshot. Interface, prefix and MTU are
-// carried because the constructor conditions were checked against them.
-type LlamaCppRpcFabricEndpointObserved sole_constructor {
-  host: HostIdentity
-  address: Ipv4Address
-  interface: NonEmptyStr
-  prefix: Int
-  mtu: ByteSize
-}
-
-type LlamaCppRpcFabricObserved sole_constructor {
-  endpoints: List<LlamaCppRpcFabricEndpointObserved>
-}
-
-fn llama_cpp_rpc_fabric_endpoint_on(fabric: LlamaCppRpcFabricObserved, host: HostIdentity) -> LlamaCppRpcFabricEndpointObserved? {
-  first(filter(fabric.endpoints, e => host_identity_eq(a: e.host, b: host)))
-}
-
-data llama_cpp_rpc_observed_fabric: LlamaCppRpcFabricObserved = LlamaCppRpcFabricObserved {
-  endpoints: [
-    LlamaCppRpcFabricEndpointObserved { host: operator_host_srv7, address: ipv4_address(octet1: 192, octet2: 168, octet3: 100, octet4: 10), interface: "enp1s0f0np0" as NonEmptyStr, prefix: 24, mtu: byte_size(count: 9000) },
-    LlamaCppRpcFabricEndpointObserved { host: operator_host_srv8, address: ipv4_address(octet1: 192, octet2: 168, octet3: 100, octet4: 11), interface: "enp1s0f0np0" as NonEmptyStr, prefix: 24, mtu: byte_size(count: 9000) },
-  ],
-}
-
-type LlamaCppRpcDeployment sole_constructor {
-  alias: NonEmptyStr
-  front_door: LlamaCppRpcFrontDoor
-  weights_peer: LlamaCppRpcWeightsPeer
-  fabric: LlamaCppRpcFabricObserved
-  slot_plan: LlamaCppRpcSlotPlan
-}
-
-fn llama_cpp_rpc_construct(
-  served_alias: NonEmptyStr,
-  front_door: LlamaCppRpcFrontDoor,
-  weights_peer: LlamaCppRpcWeightsPeer,
-  fabric: LlamaCppRpcFabricObserved,
-  slot_plan: LlamaCppRpcSlotPlan,
-) -> LlamaCppRpcDeployment? {
-  if host_identity_eq(a: front_door.host, b: weights_peer.host) {
-    none
-  } else if ipv4_address_eq(a: front_door.client_address, b: weights_peer.fabric_address)
-    && front_door.port == weights_peer.port {
-    none
-  } else {
-    match llama_cpp_rpc_fabric_endpoint_on(fabric: fabric, host: weights_peer.host) {
-      Absent => none
-      Present { value: peer_end } =>
-        match llama_cpp_rpc_fabric_endpoint_on(fabric: fabric, host: front_door.host) {
-          Absent => none
-          Present { value: _ } =>
-            if !ipv4_address_eq(a: peer_end.address, b: weights_peer.fabric_address) {
-              none
-            } else {
-              Present { value: LlamaCppRpcDeployment {
-                alias: served_alias,
-                front_door: front_door,
-                weights_peer: weights_peer,
-                fabric: fabric,
-                slot_plan: slot_plan,
-              } }
-            }
-        }
-    }
-  }
-}
-
-// THE ONE ADDRESS A CLIENT MAY HOLD. There is deliberately no sibling returning the weights peer as
-// an endpoint: C1 is enforced by there being nothing to call, rather than by a rule saying not to.
-fn llama_cpp_rpc_client_endpoint(d: LlamaCppRpcDeployment) -> String {
-  join(["http://", render_ipv4_address(addr: d.front_door.client_address), ":",
-    to_string(d.front_door.port)], "")
-}
-
-fn llama_cpp_rpc_peer_wire(d: LlamaCppRpcDeployment) -> String {
-  join([render_ipv4_address(addr: d.weights_peer.fabric_address), ":", to_string(d.weights_peer.port)], "")
-}
-
-// A HOST THAT HOLDS WEIGHTS IS NOT A SERVING ENDPOINT, asked as a question a roster can answer.
-//
-// This is the checkable half of C1. The constructor above makes the peer unaddressable WITHIN a
-// deployment; it cannot see a SEPARATE roster that also names that host as a single-host serving
-// cell. That is the actual hazard on .233, which runs an unrelated ollama on :11434 alongside its
-// weights role, and it is how the host would come to accept a load: not through this deployment,
-// but through another one that never knew this one existed.
-fn llama_cpp_rpc_weights_peer_hosts(deployments: List<LlamaCppRpcDeployment>) -> List<HostIdentity> {
-  map(deployments, d => d.weights_peer.host)
-}
-
-fn llama_cpp_rpc_host_is_weights_peer(
-  deployments: List<LlamaCppRpcDeployment>,
-  host: HostIdentity,
-) -> Bool {
-  any(llama_cpp_rpc_weights_peer_hosts(deployments: deployments), h => host_identity_eq(a: h, b: host))
-}
-
-// ================= THE RESERVATION, WHICH IS A STATE MACHINE AND NOT A CENSUS =================
-//
-// A HOST OBSERVED HOLDING ANOTHER DEPLOYMENT'S LAYERS DOES NOT BECOME FREE BY NOT BEING LOOKED AT
-// AGAIN. This is the distinction that makes the interlock below honest, and getting it wrong in
-// either direction is how the hazard ships.
-//
-// The dangerous reading is "we did not re-observe the peer, therefore the host is available" --
-// absence of observation read as evidence of release, which is the failure that has dominated this
-// module's own history. The opposite overclaim is just as wrong and was written here first: asserting
-// the host IS CURRENTLY the weights peer, which no observation in this module establishes. The
-// current process topology of that host is UNOBSERVED, and this module says so.
-//
-// So the carrier is a RESERVATION with a dated origin, and its lifecycle has exactly one shape:
-//
-//   a positive observation MINTS the reservation
-//   the reservation REMAINS ACTIVE by default
-//   only a positive RELEASE RECEIPT clears it
-//
-// WHAT MAY NOT DISCHARGE IT, because each of these is an absence wearing a release's clothes: not
-// re-observing the host; the front door becoming unreachable; the dated observation growing old. The
-// front-door case is the subtle one and is worth naming -- conditioning the hold on the front door
-// still serving would be FAIL-OPEN, because a transient outage would dissolve the reservation while
-// the peer's process, its boot-enabled unit, its memory commitment and its restart path all survive
-// the outage untouched.
-//
-// WHAT DOES DISCHARGE IT is a fresh host-level receipt that positively excludes the host from the
-// current internal-participant population -- process and argv of the front door, the current
-// distributed participant set, the host's own supervisor, process and socket state, the old
-// llama.cpp and ggml-RPC unit enablement, and its current memory state.
-//
-// AND THAT RELEASE IS NOT ITSELF AN ADMISSION. Two gates stand in series and fusing them is its own
-// hazard: "no longer an internal participant" is a topology fact, while "safe to load an 86 GB model
-// here" is a fit question for the unit-grain admission authority. The first does not answer the
-// second.
-// THE ORIGIN IS THE DEPLOYMENT ITSELF, NOT A SENTENCE ABOUT IT. This field was first authored as a
-// NonEmptyStr reading "dated deployment observation 2026-09-02", which is prose in a data slot: no
-// Accepted program can check it, nothing joins it back to the observation it names, and it would go
-// stale silently the moment the observation moved. Carrying the deployment gives the reservation a
-// real referent -- a reader can ask which front door and which peer minted this hold, and the answer
-// is the value rather than a description of one.
-//
-// THE MINT IS THEREFORE TOTAL AND HAS NO FAILURE ARM: a reservation cannot be conjured for a host
-// that no observed deployment names, because the only way to build one is to hand it a deployment.
-type LlamaCppRpcInternalParticipantReservation sole_constructor {
-  host: HostIdentity
-  origin: LlamaCppRpcDeployment
-}
-
-fn llama_cpp_rpc_internal_participant_reservation(
-  origin: LlamaCppRpcDeployment,
-) -> LlamaCppRpcInternalParticipantReservation {
-  LlamaCppRpcInternalParticipantReservation { host: origin.weights_peer.host, origin: origin }
-}
-
-// The reservations no release receipt has cleared. Every internal participant of a positively
-// observed deployment mints one; nothing in this module can clear one, because a release requires
-// evidence this module does not hold.
-// THE RELEASE RECEIPT. A reservation clears only against a host-level observation that positively
-// excludes the host from the current internal-participant population, and this is that record:
-// per host, the front-door and RPC process population, the supervisor units present, the listeners,
-// and the memory state, each named as read. It is not an admission that the host may load anything;
-// it says only that the llama.cpp deployment no longer has this host.
-type LlamaCppRpcReleaseReceipt {
-  host: HostIdentity
-  observed_on: NonEmptyStr
-  observed_by: NonEmptyStr
-  front_door_processes: NonEmptyStr
-  rpc_server_processes: NonEmptyStr
-  supervisor_units: NonEmptyStr
-  listeners: NonEmptyStr
-  memory_state: NonEmptyStr
-}
-
-// 2026-09-05, read over the administrator session after the direct pair cables came out: neither
-// srv7 nor srv8 runs llama-server or rpc-server; the only supervisors are the hand-authored
-// spark-vllm.service (srv7) and spark-ray-worker.service (srv8) of the later vLLM pair, whose Ray
-// session is retrying against the dead 192.168.100.x rail; nothing listens on 30000 or 50052; each
-// host sits at 4 GB used of 121, so no weights are resident on either.
-data llama_cpp_rpc_release_receipts: List<LlamaCppRpcReleaseReceipt> = [
-  LlamaCppRpcReleaseReceipt {
-    host: operator_host_srv8,
-    observed_on: "2026-09-05" as NonEmptyStr,
-    observed_by: "ps/ss/systemctl/free over the administrator session from srv2" as NonEmptyStr,
-    front_door_processes: "none (no llama-server; ray start --address=192.168.100.10:6379 retrying under spark-ray-worker.service)" as NonEmptyStr,
-    rpc_server_processes: "none" as NonEmptyStr,
-    supervisor_units: "spark-ray-worker.service only; no llama or ggml-rpc unit" as NonEmptyStr,
-    listeners: "none on 30000 or 50052" as NonEmptyStr,
-    memory_state: "4 GB used of 121 GB, 116 GB free" as NonEmptyStr,
-  },
-  LlamaCppRpcReleaseReceipt {
-    host: operator_host_srv7,
-    observed_on: "2026-09-05" as NonEmptyStr,
-    observed_by: "ps/ss/systemctl/free over the administrator session from srv2" as NonEmptyStr,
-    front_door_processes: "none (no llama-server; ray start --head on the dead 192.168.100.10 under spark-vllm.service, gcs_server defunct every cycle)" as NonEmptyStr,
-    rpc_server_processes: "none" as NonEmptyStr,
-    supervisor_units: "spark-vllm.service only; no llama or ggml-rpc unit" as NonEmptyStr,
-    listeners: "6379 only (Ray GCS); none on 30000 or 50052" as NonEmptyStr,
-    memory_state: "4 GB used of 121 GB, 116 GB free" as NonEmptyStr,
-  },
-]
-
-fn llama_cpp_rpc_host_has_release_receipt(host: HostIdentity) -> Bool {
-  any(llama_cpp_rpc_release_receipts, r => host_identity_eq(a: r.host, b: host))
-}
-
-// The reservations no release receipt has cleared: every internal participant of a positively
-// observed deployment mints one, and only a receipt above clears it.
-fn llama_cpp_rpc_undischarged_peer_reservations() -> List<LlamaCppRpcInternalParticipantReservation> {
-  filter(
-    map(llama_cpp_rpc_observed_units(), d => llama_cpp_rpc_internal_participant_reservation(origin: d)),
-    r => !llama_cpp_rpc_host_has_release_receipt(host: r.host),
-  )
-}
-
-fn llama_cpp_rpc_minted_peer_reservations() -> List<LlamaCppRpcInternalParticipantReservation> {
-  map(llama_cpp_rpc_observed_units(), d => llama_cpp_rpc_internal_participant_reservation(origin: d))
-}
-
-fn llama_cpp_rpc_undischarged_peer_reservation_hosts() -> List<HostIdentity> {
-  map(llama_cpp_rpc_undischarged_peer_reservations(), r => r.host)
-}
-
-fn llama_cpp_rpc_host_holds_undischarged_reservation(host: HostIdentity) -> Bool {
-  any(llama_cpp_rpc_undischarged_peer_reservation_hosts(), h => host_identity_eq(a: h, b: host))
-}
-
-// ================= THE OBSERVED DEPLOYMENT, 2026-09-02 18:23 UTC =================
-//
-// Read from the operator's handoff specification, which records what was measured live rather than
-// what was intended: slots, per-slot context, route status codes and both hosts' memory at 18:23
-// UTC, throughput between 18:11 and 18:19 UTC on an idle deployment.
-//
-// THE FABRIC IS THE DATED SNAPSHOT ABOVE (llama_cpp_rpc_observed_fabric): the 192.168.100.0/24
-// direct-cable rail between srv7 and srv8 as read back from both hosts' netplan on 2026-09-02, the
-// same link the specification's topology section names. The desired fabric has since moved to the
-// switch, so this history derives from nothing current and cannot be rewritten by an edit elsewhere.
-data llama_cpp_rpc_observed_alias: NonEmptyStr = "deepseek-v4-flash:iq3s-split" as NonEmptyStr
-
-// THE FRONT DOOR'S LAN ADDRESS IS CARRIED HERE AS AN OBSERVATION, AND DELIBERATELY NOT CITED FROM
-// gunbc.fleet_intent_network, WHICH WOULD BE THE OBVIOUS §3 MOVE AND WOULD BE WRONG.
-//
-// That module holds .232/.233 in PROSE only -- there is no typed address row to cite, so nothing is
-// being duplicated here. The reason there is no row is the part that matters: the module states that
-// membership in its `endpoints` IS ENROLLMENT, so authoring an address row there PERFORMS the
-// enrollment rather than describing it. srv7/srv8 are deliberately unenrolled, and enrolling a pair
-// as a side effect of needing somewhere tidy to put an address is exactly the act-fusion that the
-// admission of this pair is supposed to keep separable.
-//
-// So this field is an observation of where a measured front door answered, at a host that is not a
-// fleet member. It confers no membership and must not be read as any.
-//
-// THE FABRIC IS THE OPPOSITE CASE AND IS HANDLED THE OPPOSITE WAY. Its addresses, interface names
-// and MTU ARE owned -- by gunbc.spark.fabric_link_desired, merged -- so this module references that
-// link BY IDENTITY and derives the peer's address from it. No fabric field is restated here.
-data llama_cpp_rpc_observed_front_door: LlamaCppRpcFrontDoor = LlamaCppRpcFrontDoor {
-  host: operator_host_srv7,
-  client_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 232),
-  port: 30000,
-}
-
-// THIS ROW IS CURRENTLY CORROBORATED BY A LIVE READBACK, WHICH IS NOT THE SAME AS BEING EXECUTED
-// EVIDENCE. On 2026-09-03 the running front door reported total_slots 10 with per-slot n_ctx
-// 1048576 on all ten slots -- the values below, re-observed against the service rather than against
-// the handoff that first supplied them. That is the first row here confirmed by the subject itself.
-//
-// THE WITNESS BELOW STILL EVALUATES THESE MODELLED VALUES AND DOES NOT EXECUTE /props OR /slots, so
-// the corroboration is a fact about 2026-09-03 and not a repository guarantee. Promoting it needs
-// the readback to become a typed instrument receipt the claim consumes; until then the honest
-// standing is "corroborated on that date", and a plan-time readback must re-read these endpoints
-// immediately before freezing anything, because today's observation is not indefinitely fresh.
-data llama_cpp_rpc_observed_slot_plan: LlamaCppRpcSlotPlan = LlamaCppRpcSlotPlan {
-  per_slot_context: token_count(count: 1048576),
-  slots: positive_slot_count(count: positive_measure_count(predecessor: 9)),
-}
-
-fn llama_cpp_rpc_observed_weights_peer() -> LlamaCppRpcWeightsPeer? {
-  match llama_cpp_rpc_fabric_endpoint_on(fabric: llama_cpp_rpc_observed_fabric, host: operator_host_srv8) {
-    Absent => none
-    Present { value: e } =>
-      Present { value: LlamaCppRpcWeightsPeer {
-        host: operator_host_srv8,
-        fabric_address: e.address,
-        port: 50052,
-      } }
-  }
-}
-
-// The observed deployment, or Absent when any condition that makes it ONE llama.cpp RPC deployment fails to
-// hold. An Absent here is not a deployment with a problem to report later -- it never existed, so
-// nothing downstream can plan from it.
-fn llama_cpp_rpc_observed() -> LlamaCppRpcDeployment? {
-  match llama_cpp_rpc_observed_weights_peer() {
-    Absent => none
-    Present { value: peer } =>
-      llama_cpp_rpc_construct(
-        served_alias: llama_cpp_rpc_observed_alias,
-        front_door: llama_cpp_rpc_observed_front_door,
-        weights_peer: peer,
-        fabric: llama_cpp_rpc_observed_fabric,
-        slot_plan: llama_cpp_rpc_observed_slot_plan,
-      )
-  }
-}
-
-fn llama_cpp_rpc_observed_units() -> List<LlamaCppRpcDeployment> {
-  match llama_cpp_rpc_observed() {
-    Present { value: d } => [d]
-    Absent => []
-  }
-}
-
-// ================= WHAT THE UNIT WAS MEASURED TO DELIVER =================
-//
-// THE 50.9-58.8 "AGGREGATE" IS RETRACTED, AND THIS PARAGRAPH IS ITS RETRACTION RATHER THAN ITS
-// RESTATEMENT. This section used to open by presenting that pair as the measured delivery, and the
-// carrier below does NOT hold it -- it holds decode and prefill rates and no aggregate at all.
-// Leaving the old opening in place made the prose describe values the value does not contain, which
-// is worse than either the old figure or the new one: a reader would take the section's first
-// sentence as the fact.
-//
-// It is retracted on its own merits and not for tidiness. No aggregate was ever measured AS an
-// aggregate; the figure was a prefill rate read as a decode rate, which the correction below sets
-// out in full. Nothing here is a floor, a capacity, or a delivery guarantee.
-//
-// WHY THE UNIT IS NOT CONFIGURED AT ITS MEMORY CEILING, which is the fact that stops "more slots"
-// from reading as "more throughput". Twelve slots FIT, and left the peer at 9 GiB free instead of
-// 16, so the slot count is not a capacity limit waiting to be filled.
-//
-// WHAT THE MEASUREMENTS DO NOT ESTABLISH IS THAT TEN IS FASTER THAN TWELVE, and this row previously
-// said they did. The twelve-slot run reported 57.3, which lies INSIDE the ten-slot spread of
-// 50.9-58.8 recorded in the paragraph above. Reading "twelve is slower" out of 57.3 against 58.8
-// compares one arm of a two-sample spread against the better arm of another -- the censored
-// estimator this section opens by refusing, committed two paragraphs later against the same numbers.
-// Ten is therefore OPERATOR-SELECTED and preserves more memory headroom; a throughput ordering
-// between ten and twelve needs repeated interleaved trials at both, which do not exist. Raising the
-// count without that instrument is still unjustified -- but so is the claim that lowering it helped.
-//
-// A PER-SESSION RATE AND A WHOLE-SERVER RATE ARE DIFFERENT QUANTITIES, which is why they are
-// separate fields below and why a reader who takes one for the other will size sessions wrongly.
-// This used to say "slots buy concurrency, NOT speed". That is a claim about what added slots do to
-// per-session rate, and the only experiment bearing on it is the concurrency sweep whose own rows do
-// not reconcile -- so it is withdrawn as unestablished rather than kept as intuition. The
-// distinction between the two quantities does not depend on it.
-//
-// THE ROW ABOVE ONCE READ "single-stream decode is memory-bandwidth-bound at roughly 13-16 tok/s,
-// 13.3 at one and 5.9 at ten". EVERY PART OF THAT WAS WRONG, AND THE WAY IT WAS WRONG IS THIS
-// MODULE'S OWN SUBJECT. Asked directly, the server's `timings` report predicted_per_second 2.78 --
-// 359 ms per token -- against prompt_per_second 14.45. The 13-16 band was the PREFILL rate read as
-// the DECODE rate. Two different quantities, one number, exactly the shape of the `-c` trap this
-// module exists to close, committed in the same file that closes it.
-//
-// It is not a stale reading either: the front-door process has run since 14:19:26 UTC on 2026-09-02
-// and the handoff measurement was 18:11-18:19, so both readings observe ONE INCARNATION and no
-// restart explains the gap. The instrument reported faithfully; its output answered a question
-// nobody asked.
-//
-// THE MECHANISM IN THAT SENTENCE IS ALSO NOT ESTABLISHED, AND SAYING SO COSTS LESS THAN THE
-// ALTERNATIVE. An earlier revision replaced "memory-bandwidth-bound" with a confident denial -- 359
-// ms per token "is not memory bandwidth on this hardware" -- and a positive cause, that the two
-// GPUs alternate BECAUSE the layer split serializes them. Neither is measured. A rate does not name
-// its own bottleneck in either direction, and that was the whole lesson of the figure it replaced.
-//
-// WHAT IS STRUCTURAL, and all that is: one token has a SERIAL DEPENDENCY across the two layer
-// partitions, including a cross-host activation transfer. That follows from the topology and needs
-// no instrument.
-//
-// WHAT IS OBSERVED BESIDE IT, carried as observation and not as its explanation: sampled utilization
-// means of roughly 28% on the front door and 42% on the peer, with repeated 0% samples on both. A
-// utilization sample is the fraction of an interval in which at least one kernel ran -- it is not
-// occupancy, achieved FLOPs, or idle capacity -- so those numbers are consistent with serialization
-// and equally with sampling aliasing, communication waits or scheduling, and they do not decide
-// between them. How much the serial dependency contributes to the measured token interval is
-// UNRESOLVED: retained KV, kernel efficiency, memory behaviour, synchronization and transport
-// latency all remain live contributors.
-//
-// WHAT THE SWEEP DID AND DID NOT SHOW, stated narrowly because the wide version was wrong. Within
-// one concurrency sweep, completed-probe rates did not decline monotonically as probes were added.
-// That is the whole finding. It does NOT establish that an additional active stream is cheap: the
-// sweep never observed how many probes were SIMULTANEOUSLY ACTIVE against ten slots, never observed
-// queue waiting, and never measured the six existing sessions before and during. With --parallel 10
-// and six sessions already decoding, at most four probes could be active at once, and an
-// eight-probe row reporting 3.29 per stream against a 12.8 aggregate reconciles as four active and
-// four queued rather than eight concurrent -- the two figures do not share a denominator.
-//
-// THREE CLAIMS ARE THEREFORE REFUSED HERE RATHER THAN RECORDED: that this box runs at roughly a
-// third of its aggregate capacity, that more concurrent sessions are close to free, and that a
-// restart doubles throughput or occupancy halves it. The observations ORDER future measurements;
-// they do not establish a capacity policy, and a desired state must not be sized from them.
-//
-// WHAT REMAINS TRUE AND LOAD-BEARING is the structural half only: an RPC layer split imposes a
-// serial cross-host dependency per token, and tensor parallelism is a CANDIDATE that changes that
-// dependency. It does not follow that per-session speed cannot improve without removing it -- that
-// sentence stood here and is withdrawn, because the dependency's share of the token interval is
-// unresolved and the other contributors above could move on their own. Nor does it follow that
-// tensor parallelism is faster here: it trades a serialization for per-layer collectives over the
-// fabric, which is a different cost, not an absent one. The trade needs its own instrument.
-//
-// HONEST LIMIT ON ALL OF IT: measured on short completions against a near-empty context. Real
-// sessions at 90k+ decode slower, so these figures bound an idle deployment and are not a service
-// level. Re-derive rather than quote: the producer is the operator's handoff measurement between
-// 18:11 and 18:19 UTC on 2026-09-02, and a claim about delivered throughput needs its own
-// instrument rather than this row.
-// PREFILL AND DECODE ARE SEPARATE FIELDS BECAUSE THEY ARE SEPARATE QUANTITIES. Collapsing them to
-// one "throughput" number is what produced the retracted 13-16 figure, and a carrier that cannot
-// hold both invites the same collapse from the next author.
-// THE TWO READINGS ARE THE FACT; THE ENVELOPE IS DERIVED FROM THEM. This was the other way round
-// and the inversion lost data. The carrier held only slots, a decode low and high, and ONE prefill
-// -- so the first reading's prefill of 14.45 tok/s was not merely rounded, it was DISCARDED, and
-// neither surviving rate stayed attached to the state it was measured in. A consumer received 2..7
-// and 12 and could not recover which rate came from which unit state, or that two process
-// incarnations were involved at all. That is precisely the transport loss this module exists to
-// prevent: the association lived in prose, where no Accepted program can read it.
-//
-// THE REGIME IS A CLOSED COPRODUCT BECAUSE THE TWO STATES ARE NOT POINTS ON A SCALE. One unit had
-// served six long-context sessions for eight hours with slots holding 65k and 157k; the other was
-// sixteen minutes past a restart with slots nearly empty. There is no measured quantity ordering
-// them -- "occupancy" is the name for what differed, not a number anyone recorded -- so an enum of
-// the two observed states is honest where a numeric field would invite interpolation between
-// readings that were never taken.
-type LlamaCppRpcTimingRegime
-  = LongLivedWithRetainedSessions
-  | NearlyEmptyAfterRestart
-
-// A RATE IS CARRIED AS AN INTERVAL BECAUSE THE INSTRUMENT REPORTED FRACTIONS AND THIS CORPUS COUNTS
-// IN WHOLE TOKENS. 2.78 becomes [2, 3] and 14.45 becomes [14, 15]: the interval CONTAINS the
-// reading, so no consumer can recover a precision the measurement did not have, and none can be
-// misled by a rounding direction chosen for them. The alternative -- a scaled rate authority -- is a
-// larger change to std.measure than this observation justifies, and the interval is the conservative
-// reading either way.
-type LlamaCppRpcTimingSample sole_constructor {
-  regime: LlamaCppRpcTimingRegime
-  decode_low: TokensPerSecond
-  decode_high: TokensPerSecond
-  prefill_low: TokensPerSecond
-  prefill_high: TokensPerSecond
-}
-
-// THE PAIR CARRIES THE RESTART BOUNDARY, WHICH IS THE ONLY RELATION BETWEEN THEM ANYONE OBSERVED.
-// Not a PID, not a process digest, not a start timestamp -- none of those were measured, and
-// inventing one to look rigorous would be the fabrication this module refuses elsewhere. What WAS
-// observed is that a restart separates the two readings, so the pair asserts exactly that and
-// nothing finer: these are different incarnations, in this order.
-//
-// THE RELATION IS STRUCTURAL AND SO CARRIES NO FIELD. A one-arm `DifferentIncarnations` marker was
-// authored here and removed: the field names are `before_restart` and `after_restart`, the
-// constructor accepts only a LongLivedWithRetainedSessions sample followed by a
-// NearlyEmptyAfterRestart one, and that second arm NAMES the restart. A field asserting "different
-// incarnations" beside those would be a second representation of what the regimes already say, and
-// the kind that can drift from them. Two incarnations is the only shape this type can hold.
-type LlamaCppRpcTimingPair sole_constructor {
-  before_restart: LlamaCppRpcTimingSample
-  after_restart: LlamaCppRpcTimingSample
-}
-
-type LlamaCppRpcDecodeEnvelope sole_constructor {
-  slots: PositiveSlotCount
-  decode_low: TokensPerSecond
-  decode_high: TokensPerSecond
-  prefill: TokensPerSecond
-}
-
-fn llama_cpp_rpc_timing_sample(
-  regime: LlamaCppRpcTimingRegime,
-  decode_low: TokensPerSecond,
-  decode_high: TokensPerSecond,
-  prefill_low: TokensPerSecond,
-  prefill_high: TokensPerSecond,
-) -> LlamaCppRpcTimingSample? {
-  if tokens_per_second_count(r: decode_low) > tokens_per_second_count(r: decode_high) {
-    none
-  } else if tokens_per_second_count(r: prefill_low) > tokens_per_second_count(r: prefill_high) {
-    none
-  } else {
-    Present { value: LlamaCppRpcTimingSample {
-      regime: regime,
-      decode_low: decode_low,
-      decode_high: decode_high,
-      prefill_low: prefill_low,
-      prefill_high: prefill_high,
-    } }
-  }
-}
-
-// THE PAIR REFUSES TWO SAMPLES IN THE SAME REGIME. Two readings from one state are not a
-// before-and-after across a restart; they are a repeat, and the boundary this type asserts would be
-// a fiction over them.
-fn llama_cpp_rpc_timing_pair(
-  before_restart: LlamaCppRpcTimingSample,
-  after_restart: LlamaCppRpcTimingSample,
-) -> LlamaCppRpcTimingPair? {
-  match before_restart.regime {
-    LongLivedWithRetainedSessions =>
-      match after_restart.regime {
-        NearlyEmptyAfterRestart => Present { value: LlamaCppRpcTimingPair {
-          before_restart: before_restart,
-          after_restart: after_restart,
-        } }
-        LongLivedWithRetainedSessions => none
-      }
-    NearlyEmptyAfterRestart => none
-  }
-}
-
-// THE ENVELOPE IS A PROJECTION OF THE PAIR, NOT A SECOND AUTHORITY. It spans the decode intervals of
-// both samples -- lowest low, highest high -- so it cannot disagree with them, and a reader who
-// wants the association still has it one field away. Prefill is deliberately NOT collapsed here:
-// the two prefill intervals sit either side of each other and a single "the prefill rate" is the
-// exact fiction that produced the retracted 13-16 figure.
-fn llama_cpp_rpc_envelope_of(
-  pair: LlamaCppRpcTimingPair,
-  slots: PositiveSlotCount,
-  prefill: TokensPerSecond,
-) -> LlamaCppRpcDecodeEnvelope? {
-  llama_cpp_rpc_throughput_band(
-    slots: slots,
-    decode_low: min_tokens_per_second(
-      a: pair.before_restart.decode_low, b: pair.after_restart.decode_low),
-    decode_high: max_tokens_per_second(
-      a: pair.before_restart.decode_high, b: pair.after_restart.decode_high),
-    prefill: prefill,
-  )
-}
-
-fn min_tokens_per_second(a: TokensPerSecond, b: TokensPerSecond) -> TokensPerSecond {
-  if tokens_per_second_count(r: a) <= tokens_per_second_count(r: b) { a } else { b }
-}
-
-fn max_tokens_per_second(a: TokensPerSecond, b: TokensPerSecond) -> TokensPerSecond {
-  if tokens_per_second_count(r: a) >= tokens_per_second_count(r: b) { a } else { b }
-}
-
-fn llama_cpp_rpc_throughput_band(
-  slots: PositiveSlotCount,
-  decode_low: TokensPerSecond,
-  decode_high: TokensPerSecond,
-  prefill: TokensPerSecond,
-) -> LlamaCppRpcDecodeEnvelope? {
-  if tokens_per_second_count(r: decode_low) > tokens_per_second_count(r: decode_high) {
-    none
-  } else {
-    Present { value: LlamaCppRpcDecodeEnvelope {
-      slots: slots,
-      decode_low: decode_low,
-      decode_high: decode_high,
-      prefill: prefill,
-    } }
-  }
-}
-
-// THE BAND AS MEASURED, AND THE INSTRUMENT IS THE SERVER'S OWN TIMINGS RATHER THAN A STOPWATCH.
-// Two readings, both single completions on short prompts with cache_n 0: predicted_per_second 2.78
-// with prompt_per_second 14.45 on a unit that had served six long-context sessions for eight hours,
-// and predicted_per_second 6.38 with prompt_per_second 12.18 sixteen minutes after that unit was
-// restarted. Reported in whole tok/s because a decimal would carry precision the spread does not
-// have.
-//
-// THE 2.3x IS REAL AND ITS CAUSE IS NOT ESTABLISHED, and those are two separate statements this
-// annotation previously ran together. It said "the only variable is resident KV". That does not
-// follow. Equal launch argv establishes equal DECLARED LAUNCH CONFIGURATION, and the two readings
-// straddle a RESTART, which changes process incarnation by construction -- and with it worker state,
-// memory placement, caches, clock and scheduler state, RPC connections, concurrent traffic, and the
-// exact bytes mapped. This module's own on-disk-versus-executed-artifact section says neither
-// incarnation is bound to the measured shard bytes, so it cannot then claim the two incarnations
-// differed in one axis only.
-//
-// What the pair supports is narrower and still useful: OCCUPANCY AND PROCESS STATE ARE A LOAD-BEARING
-// AXIS that any future throughput instrument must carry, because a 2.3x sits across it. The slow
-// reading came from a unit whose ten slots held sessions at 65k and 157k and the fast one from a unit
-// whose slots were nearly empty; that association is recorded, not promoted to cause. Separating the
-// two needs matched fresh-then-occupied readings WITHIN one identified incarnation, or repeated such
-// pairs across several -- an experiment nobody has run, and one that does NOT require resurrecting
-// the old process to run later.
-//
-// AND THE "OPERATIONAL CONSEQUENCE" THAT USED TO CLOSE THIS PARAGRAPH IS WITHDRAWN TOO, because it
-// smuggled the retracted cause back in one sentence after the retraction. It said a fresh-only
-// report overstates a loaded unit by roughly DOUBLE and a loaded-only report understates a fresh one
-// by as much -- which asserts the direction, the magnitude, and that both generalize to samples
-// nobody has taken. None of that is established by two differently-situated readings.
-//
-// What survives is the weaker and still actionable form: a sample taken in ONE process state may
-// differ materially from the same configuration in another, and these two observations do not
-// establish the direction or the population magnitude of that difference. That is enough to require
-// a future instrument to carry its state; it is not enough to predict what it will find.
-//
-// A CONCURRENCY SWEEP RUN ON TOP OF AN ALREADY-LOADED UNIT CANNOT SEE THIS AXIS, and the precise
-// reason matters because the loose version of it is also an overclaim. The sweep did not
-// independently VARY or MEASURE the retained-context population -- it is not that total occupancy
-// was held constant, since the added requests themselves change active work and memory state, which
-// is exactly what nobody observed. So the sweep carries no information about the axis it never
-// varied, and a flat per-stream rate across added probes cannot be read as "occupancy is free".
-//
-// THE ROUNDING IS DIRECTIONAL, and what it does and does not buy is now the whole point. The low end
-// rounds DOWN and the high end UP, so the recorded pair is a SUPERSET of the measured one and no
-// reader can recover a tighter figure than was observed.
-//
-// THAT IS NOT A LOWER BOUND ON SERVICE, and the predicate that used to read this end has been deleted
-// for assuming it was. Rounding down is conservative WITHIN THE TWO SAMPLES TAKEN; the population of
-// workloads this unit may meet is unsampled, and a deeper retained context could sit below the low
-// end without contradicting anything here. So the ends bound the OBSERVATIONS, not the service, and
-// nothing in this module is authorised to admit a target against them.
-//
-// WHAT IS DELIBERATELY NOT RECORDED IS AN AGGREGATE. The retracted row carried one, and no aggregate
-// was ever measured as an aggregate -- the figure was a prefill rate. A peer session's concurrency
-// sweep reports probe aggregates, but those exclude the six live sessions' own output and its own
-// rows do not reconcile (eight streams at 3.29 per stream is 26, reported as 12.8), so transcribing
-// them would import an unexplained inconsistency as a modeled fact. An aggregate claim needs its own
-// instrument, and until one exists the honest state is that this module does not carry one.
-// THE TWO SAMPLES AS MEASURED, EACH KEEPING THE STATE IT WAS TAKEN IN.
-//
-// Sample A: predicted_per_second 2.78, prompt_per_second 14.45, on a unit that had served six
-// long-context sessions for eight hours with slots holding 65k and 157k.
-// Sample B: predicted_per_second 6.38, prompt_per_second 12.18, sixteen minutes after that unit was
-// restarted, slots nearly empty.
-//
-// Both are single completions on short prompts with cache_n 0, taken from the server's own `timings`
-// rather than a stopwatch. Sample A's prefill was previously dropped on the floor; it is here.
-fn llama_cpp_rpc_sample_before_restart() -> LlamaCppRpcTimingSample? {
-  llama_cpp_rpc_timing_sample(
-    regime: LongLivedWithRetainedSessions,
-    decode_low: tokens_per_second(count: 2),
-    decode_high: tokens_per_second(count: 3),
-    prefill_low: tokens_per_second(count: 14),
-    prefill_high: tokens_per_second(count: 15),
-  )
-}
-
-fn llama_cpp_rpc_sample_after_restart() -> LlamaCppRpcTimingSample? {
-  llama_cpp_rpc_timing_sample(
-    regime: NearlyEmptyAfterRestart,
-    decode_low: tokens_per_second(count: 6),
-    decode_high: tokens_per_second(count: 7),
-    prefill_low: tokens_per_second(count: 12),
-    prefill_high: tokens_per_second(count: 13),
-  )
-}
-
-fn llama_cpp_rpc_observed_timing_pair() -> LlamaCppRpcTimingPair? {
-  match llama_cpp_rpc_sample_before_restart() {
-    Absent => none
-    Present { value: before } =>
-      match llama_cpp_rpc_sample_after_restart() {
-        Absent => none
-        Present { value: after } =>
-          llama_cpp_rpc_timing_pair(before_restart: before, after_restart: after)
-      }
-  }
-}
-
-// THE ENVELOPE IS NOW DERIVED RATHER THAN AUTHORED, so it cannot drift from the samples it summarises.
-// Its prefill argument is the AFTER-RESTART interval's low end, carried explicitly because the pair
-// holds two prefill intervals and no single figure is "the" prefill rate -- picking one is a lossy
-// projection and is marked as such by having to be passed in.
-fn llama_cpp_rpc_observed_throughput() -> LlamaCppRpcDecodeEnvelope? {
-  match llama_cpp_rpc_observed_timing_pair() {
-    Absent => none
-    Present { value: pair } =>
-      llama_cpp_rpc_envelope_of(
-        pair: pair,
-        slots: llama_cpp_rpc_observed_slot_plan.slots,
-        prefill: pair.after_restart.prefill_low,
-      )
-  }
-}
-
-// ================= THE ARTIFACT ON DISK AT THE PATHS THE UNIT NAMES =================
-//
-// ITS ON-DISK IDENTITY IS BOUND BY AN IN-PLACE MEASUREMENT OF THE BYTES.
-//
-// AND ON-DISK IDENTITY IS NOT EXECUTED-ARTIFACT IDENTITY. This section was first written as "the
-// artifact the unit actually loaded", and that sentence does not follow from the measurement that
-// backs it. Hashing four files establishes THESE PATHS CONTAIN THESE BYTES AT THE TIME OF THE READ.
-// It does not establish that the llama-server process whose throughput and API surface were recorded
-// loaded those bytes: the files can be replaced after a process has mapped them, the service can
-// restart between the two readings, and nothing here observes an incarnation boundary that would
-// rule either out. The two observations may straddle one.
-//
-// This is the same over-claim as the observation mixer removed below, in its other direction, so it
-// gets the same treatment rather than a note asking readers to be careful. The join field is named
-// `on_disk_artifact`, so no consumer can read it as the executed artifact without reading that it is
-// not. WHAT WOULD CLOSE IT is an incarnation identity -- a process start or restart witness the
-// artifact read and the performance read are both keyed to -- and that is the trigger. It cannot be
-// had from the serving surface today: GET /v1/models returns this model with `"digest": ""`, an
-// empty string rather than an absent field, so no probe against the API binds identity however it is
-// written.
-//
-// This carrier first shipped with the identity UNOBSERVED, and that was honest at the time: the
-// serving surface carries no digest -- GET /v1/models returns this model with `"digest": ""`, an
-// empty string rather than an absent field, so no probe against the API can bind identity however it
-// is written -- and the shard files were outside the convergence principal's reach. The operator
-// then granted access, and the gap closed with a MEASUREMENT rather than a promotion of the prose.
-//
-// WHAT ESTABLISHES IT. The four shards were hashed in place on the front-door host with sha256sum,
-// which is an observation of the bytes AT THOSE PATHS, and that measurement alone is what the chain
-// below carries.
-//
-// AN EARLIER VERSION OF THIS NOTE CLAIMED TWO INDEPENDENT CORROBORATING SOURCES, and the model does
-// not carry that. The registration payload written when the model was created does record its own
-// four digests, and they do agree -- but agreement is a RELATION between two observations, and this
-// module stores one canonical chain with no second reading and no relation to compare. Prose that
-// claims evidence the structure cannot distinguish is exactly the inflation §4b names, so the
-// sentence is withdrawn rather than left standing on a corroboration nothing here can check. The
-// direct measurement is sufficient to bind these bytes; modelling the corroboration is a separate
-// act, and it is not performed here.
-//
-// FOUR SHARDS, AND THE FIRST IS NOT THE MODEL. The front door reports shard 00001 as its model_path
-// and that file is about five megabytes -- the index that names the rest. A reader who bound
-// identity to "the model_path" would therefore have pinned the index and left roughly 108 GiB of
-// weights unnamed, which is why identity here is the WHOLE ORDERED CLOSURE and not one path.
-//
-// UPSTREAM PROVENANCE, RECORDED BUT NOT VERIFIED HERE. The shards were fetched from the unsloth
-// DeepSeek-V4-Flash-0731-GGUF repository on huggingface. That is where they CAME FROM; this module
-// does not claim the upstream still serves these bytes, because that would be a fact about a remote
-// registry nobody re-read. What is established is what this host holds.
-// A DIGEST IS A TYPED CONTENT HASH AND ITS POSITION IN THE CHAIN IS PART OF IT.
-//
-// The bound arm first carried List<NonEmptyStr>, and at that width `["banana"]` bound a four-shard
-// artifact: one string, wrong cardinality, no hash family, and no association with any particular
-// shard -- while the predicate below is what a publication step consults. The name claimed exact
-// identity and the carrier could not deliver it.
-//
-// Both halves are closed here. The digest is std.content_hash's Sha256Digest, so a value that is not
-// 64 lower-hex characters has no constructor rather than being caught later; and the ordinal binds
-// each digest to the shard it was read from, because a GGUF shard set is an ordered chain the loader
-// follows from the index and the same four digests in a different order name a different artifact.
-type LlamaCppRpcShardDigest sole_constructor {
-  ordinal: PositiveMeasureCount
-  digest: Sha256Digest
-}
-
-fn llama_cpp_rpc_shard_digest(ordinal: PositiveMeasureCount, hex: String) -> LlamaCppRpcShardDigest? {
-  match sha256_hex_digest(hex: hex) {
-    Absent => none
-    Present { value: d } =>
-      Present { value: LlamaCppRpcShardDigest { ordinal: ordinal, digest: d } }
-  }
-}
-
-// EXACTNESS IS ESTABLISHED WHERE THE VALUE IS MINTED, NOT CHECKED AFTERWARDS.
-//
-// The bound arm previously carried a bare shard list and a SEPARATE predicate decided whether that
-// list was exact. That leaves the inexact value writable and makes correctness depend on every
-// consumer remembering to run the second rule -- validation standing exactly where construction was
-// available. A one-shard closure for a four-shard artifact, and a 1,1,2,3 chain, must fail while the
-// Bound value is being made, so that no inexact Bound value exists to be asked about.
-type LlamaCppRpcBoundArtifactIdentity sole_constructor {
-  shards: List<LlamaCppRpcShardDigest>
-  shard_count: PositiveShardCount
-}
-
-// The only way to mint one. It refuses unless the chain is exactly 1..N in order at the declared
-// count -- length alone is not enough, since 1,1,2,3 has the right cardinality and names a shard set
-// that does not exist. The fold walks the expected ordinal forward and sinks to 0 on the first
-// disagreement; 0 matches no ordinal, because an ordinal is a PositiveMeasureCount and cannot be
-// zero, so the sink is absorbing and a later coincidence cannot restore it.
-fn llama_cpp_rpc_bound_artifact_identity(
-  shards: List<LlamaCppRpcShardDigest>,
-  shard_count: PositiveShardCount,
-) -> LlamaCppRpcBoundArtifactIdentity? {
-  if length(shards) != positive_shard_count_value(shards: shard_count) {
-    none
-  } else if fold(shards, init: 1, f: fn(next, s) {
-      if positive_measure_count_value(count: s.ordinal) == next { next + 1 } else { 0 }
-    }) != positive_shard_count_value(shards: shard_count) + 1 {
-    none
-  } else {
-    Present { value: LlamaCppRpcBoundArtifactIdentity {
-      shards: shards, shard_count: shard_count } }
-  }
-}
-
-type LlamaCppRpcArtifactIdentity
-  = ArtifactIdentityBound { identity: LlamaCppRpcBoundArtifactIdentity }
-  | ArtifactIdentityUnobserved { cause: NonEmptyStr }
-
-type LlamaCppRpcOnDiskArtifact sole_constructor {
-  primary_shard_path: NonEmptyStr
-  shard_count: PositiveShardCount
-  identity: LlamaCppRpcArtifactIdentity
-}
-
-// THE ORDER IS PART OF THE FACT. These are shards 00001 through 00004 in sequence, because a GGUF
-// shard set is an ordered chain the loader follows from the index; a closure holding the right four
-// digests in the wrong order names a different artifact than the one that loaded.
-// AND THE ARTIFACT REFUSES A COUNT ITS OWN IDENTITY CONTRADICTS. The bound identity was validated
-// against a shard count; if the artifact then declares a different one, the record carries two
-// answers to one question and the identity's guarantee is silently void. There is exactly one place
-// that could happen, so it refuses here rather than being asked about later.
-fn llama_cpp_rpc_artifact(
-  primary_shard_path: NonEmptyStr,
-  shard_count: PositiveShardCount,
-  identity: LlamaCppRpcArtifactIdentity,
-) -> LlamaCppRpcOnDiskArtifact? {
-  match identity {
-    ArtifactIdentityUnobserved { cause: _ } =>
-      Present { value: LlamaCppRpcOnDiskArtifact {
-        primary_shard_path: primary_shard_path,
-        shard_count: shard_count,
-        identity: identity,
-      } }
-    ArtifactIdentityBound { identity: bound } =>
-      if positive_shard_count_value(shards: bound.shard_count)
-        != positive_shard_count_value(shards: shard_count) {
-        none
-      } else {
-        Present { value: LlamaCppRpcOnDiskArtifact {
-          primary_shard_path: primary_shard_path,
-          shard_count: shard_count,
-          identity: identity,
-        } }
-      }
-  }
-}
-
-// Shards 00001 through 00004, hashed in place on the front-door host. A hex string that does not
-// parse yields no ShardDigest, so the identity below refuses rather than binding a short chain.
-fn llama_cpp_rpc_observed_shard_digests() -> List<LlamaCppRpcShardDigest> {
-  flat_map(
-    [ llama_cpp_rpc_shard_digest(
-        ordinal: positive_measure_count(predecessor: 0),
-        hex: "2baab0767d2630cb1633495ff6ccf10bdc5b83de7d66a0d3728a1a0f38e96220"),
-      llama_cpp_rpc_shard_digest(
-        ordinal: positive_measure_count(predecessor: 1),
-        hex: "3495d0e8218c5a526d66a4901114a7ee4c5e25f84fe1f4bc632b5cbfdac57ac7"),
-      llama_cpp_rpc_shard_digest(
-        ordinal: positive_measure_count(predecessor: 2),
-        hex: "57ad22e505204245020644de9143accfe3be91951efaa809bf59fa640ec278ea"),
-      llama_cpp_rpc_shard_digest(
-        ordinal: positive_measure_count(predecessor: 3),
-        hex: "87b2e7956b08954dd0d9ba71801f623fdcd1762f252ea3d18018798a1718bfc9") ],
-    o => match o {
-      Present { value: v } => [v]
-      Absent => []
-    })
-}
-
-data llama_cpp_rpc_observed_shard_count: PositiveShardCount = positive_shard_count(count: positive_measure_count(predecessor: 3))
-
-// THIS ROW GOES THROUGH THE CONSTRUCTOR RATHER THAN AROUND IT. A direct record literal is writable
-// inside the defining module, and using one here would have bypassed both refusals above in the one
-// place that actually mints production's artifact -- the constructor would then guard only fixtures.
-fn llama_cpp_rpc_observed_artifact() -> LlamaCppRpcOnDiskArtifact? {
-  match llama_cpp_rpc_bound_artifact_identity(
-    shards: llama_cpp_rpc_observed_shard_digests(),
-    shard_count: llama_cpp_rpc_observed_shard_count) {
-    Absent => none
-    Present { value: bound } =>
-      llama_cpp_rpc_artifact(
-        primary_shard_path: join([spark_models_root as String, "/dsv4-iq3s/DeepSeek-V4-Flash-0731-UD-IQ3_S-00001-of-00004.gguf"], "") as NonEmptyStr,
-        shard_count: llama_cpp_rpc_observed_shard_count,
-        identity: ArtifactIdentityBound { identity: bound })
-  }
-}
-
-// A UNIT WHOSE ARTIFACT IDENTITY IS UNBOUND MAY BE OBSERVED AND MAY NOT BE CONVERGED, and that is
-// the whole reason to type the distinction. Convergence actuates bytes; a plan that cannot name
-// which bytes it is asserting is asserting a path and hoping. This is the predicate a publication
-// step consults, and it is now a TRIVIAL ELIMINATOR: every exactness condition was moved into
-// llama_cpp_rpc_bound_artifact_identity, so a Bound value is exact by construction and there is no
-// second rule for a consumer to forget. It answers true for the observed artifact.
-//
-// READ WHAT IT SAYS AND NOT MORE: true here means THE PATHS HELD THESE BYTES WHEN THEY WERE READ. A
-// converge step that needs "the process now serving loaded exactly these bytes" does not get that
-// fact from this predicate, and there is no arm here that would supply it -- see the incarnation
-// boundary above.
-//
-// DISPOSITION ON ELIMINATING THIS COPRODUCT BY MATCH RATHER THAN THROUGH A DERIVED PROJECTION.
-// Review asked for this to consume a canonical fold or query surface instead of matching the two
-// variants directly. Considered and declined, for three reasons that are checkable rather than
-// stylistic.
-//
-// The precedent it invokes is gunbc.spark.cell_role, where a hand-rolled predicate matched a
-// coproduct against ITSELF for equality while a canonical wire projection of the same variants
-// already existed beside it. Deriving equality from that projection REMOVED a second enumeration.
-// Here there is no such projection: LlamaCppRpcArtifactIdentity has no canonical surface anywhere in
-// the corpus, so routing through one means MINTING one -- creating a construct in order to satisfy a
-// rule about not creating constructs, which is the re-invention §2 warns closes nothing.
-//
-// The two production matches on this type ask DIFFERENT questions, not one question twice.
-// llama_cpp_rpc_artifact asks the bound arm for its shard count in order to refuse a contradiction;
-// this function asks which arm is present. Neither restates the other, so §5's "a check that
-// re-states a constraint the model already carries" does not describe them.
-//
-// And the drift hazard the rule exists to prevent cannot occur here: `Match` over a closed variant
-// set is one of the substrate's six behaviors, and exhaustive elimination of closed variants is part
-// of the ordinary compiler floor DESIGN names. A third arm added to this type fails to compile at
-// BOTH sites rather than silently defaulting at either, so there is nothing silent for a canonical
-// surface to protect.
-//
-// The shape is also the corpus's ordinary one rather than a local shortcut, which is checkable by
-// naming instances rather than asserting a convention: gunbc.oomd_install `unit_is_active` eliminates
-// a six-variant SystemdUnitActiveState to Bool, and `unit_is_enabled` a ten-variant UnitFileState,
-// both on main and both load-bearing. A rule that condemns this two-arm eliminator condemns those,
-// and the fix for them would be the same minting. If that vocabulary is genuinely wanted it is a
-// corpus-wide replacement migration with its own root, not a condition on this module.
-fn llama_cpp_rpc_artifact_is_bound(a: LlamaCppRpcOnDiskArtifact) -> Bool {
-  match a.identity {
-    ArtifactIdentityBound { identity: _ } => true
-    ArtifactIdentityUnobserved { cause: _ } => false
-  }
-}
-
-// ================= WHAT THE FRONT DOOR ACTUALLY ANSWERS =================
-//
-// THIS IS NOT AN OLLAMA, AND A PROBE THAT ASSUMES IT IS READS A HEALTHY UNIT AS DEAD.
-//
-// Measured directly against the front door rather than taken from the handoff: /props answers with
-// total_slots 10 and default_generation_settings.n_ctx 1048576, /v1/models answers with the split
-// alias, and /api/tags answers 404. gunbc.spark.serving_terminal_health and
-// gunbc.spark.serving_readback_parse both read ollama routes, so pointing today's readback at this
-// unit would report every route missing and conclude the host is not serving.
-//
-// THE CONTEXT AUTHORITY IS /props AND THE FIGURE IT REPORTS IS ALREADY DIVIDED. That is what makes
-// it the right thing to compare against and the unit file's `-c` the wrong thing: the two are
-// different quantities, and the silent-shrink failure is invisible to anything that checks the
-// second one.
-//
-// THERE IS NO OLLAMA ARM, AND ITS REMOVAL IS THE POINT OF THIS SECTION. The carrier here used to be
-// `OpenAiCompatibleSurface | OllamaSurface`, with public functions projecting /api/show and
-// /api/tags out of the second arm. Nothing in this observation could ever establish that arm -- the
-// measured front door is not an Ollama, this module says so two paragraphs up, and no witness
-// discriminated it. It was vocabulary inherited from the generic carrier, published as though the
-// dated observation had two possible engines when it observed exactly one, so a consumer could
-// select a route mapping this module never measured. A cross-runtime surface vocabulary is real
-// work for the neutral authority to do AFTER it holds two observed realizations; doing it here from
-// one is inventing the second.
-//
-// SO THE ROUTES ARE THE EXACT ONES MEASURED, carried as fields rather than derived from an engine
-// choice. Read back from the running front door on 2026-09-03: /v1/models and /props and /health all
-// answer 200, and /version answers 404 -- which is what distinguishes this from a vLLM surface, and
-// is recorded because the distinguishing NEGATIVE is what a probe needs in order to refuse rather
-// than to guess.
-type LlamaCppRpcObservedApiSurface sole_constructor {
-  context_authority_route: NonEmptyStr
-  model_listing_route: NonEmptyStr
-  health_route: NonEmptyStr
-}
-
-data llama_cpp_rpc_observed_api_surface: LlamaCppRpcObservedApiSurface = LlamaCppRpcObservedApiSurface {
-  context_authority_route: "/props" as NonEmptyStr,
-  model_listing_route: "/v1/models" as NonEmptyStr,
-  health_route: "/health" as NonEmptyStr,
-}
-
-fn llama_cpp_rpc_context_authority_route(surface: LlamaCppRpcObservedApiSurface) -> NonEmptyStr {
-  surface.context_authority_route
-}
-
-fn llama_cpp_rpc_model_listing_route(surface: LlamaCppRpcObservedApiSurface) -> NonEmptyStr {
-  surface.model_listing_route
-}
-
-// ================= ONE CONSTRUCTOR FOR ONE OBSERVED REALIZATION =================
-//
-// UNTIL THIS TYPE EXISTED, THE OBSERVATIONS WERE ADJACENCY RATHER THAN A JOINED FACT. The unit, its
-// artifact, its API surface and its throughput band sat as four separate module-scope values, and
-// with exactly one of each nothing went wrong -- which is the whole problem, because nothing
-// structural said they described the same executed realization either.
-//
-// THERE IS DELIBERATELY NO GENERAL MIXER, AND THAT IS THE HONEST RUNG RATHER THAN THE TIDY ONE. A
-// public llama_cpp_rpc_observation(unit, artifact, api_surface, throughput) was written first and
-// removed: whatever condition it checked, it still ADMITTED `unit A + artifact B + surface D +
-// throughput C` drawn from different realizations, which is precisely the failure this type claims
-// to close. A slot-count agreement does not fix that -- a band measured at ten slots on a DIFFERENT
-// ENGINE satisfies it -- and a constructor that admits the state it names is worse than no
-// constructor, because it will be cited as having closed the class.
-//
-// WHAT WOULD ACTUALLY CLOSE IT is a shared realization identity that the artifact, the API surface
-// and the throughput band are each keyed to, so that joining observations of two realizations has
-// no constructor. That is not authorable from one observation: with a single realization the
-// identity has nothing to discriminate, so its RED would be unwritable and the key would be
-// decoration. THE TRIGGER IS THEREFORE THE SECOND REALIZATION -- a re-measurement or a second unit
-// -- at which point the identity becomes both constructible and mandatory.
-//
-// Until then only the module's own 2026-09-02 observation can be built, below, and no caller can
-// assemble a different one. That is a narrower capability than a join, and it is the one the
-// evidence supports.
-//
-// THE TRIGGER HAS FIRED (2026-09-03), AND SAYING SO IS THE ONLY EDIT IT LICENSES HERE. A second
-// realization is now running and observed first-hand rather than reported: the front door on the
-// other pair answers /v1/models with owned_by "vllm" and /version with a vLLM build string, over the
-// official DeepSeek-V4-Flash checkpoint. So the paragraph above no longer describes a waiting state
-// -- the shared realization identity it names is now both constructible and mandatory, because there
-// are two realizations for it to discriminate between.
-//
-// IT DOES NOT FOLLOW THAT THIS MODULE GROWS THE SHARED CARRIER, and the distinction is the whole
-// reason this note is a status correction rather than a design change. Deriving the neutral subject
-// INSIDE the module named for one engine is the same induced-from-a-single-engine move the paragraph
-// above refuses, merely performed later and with more material: whatever shape emerged would still
-// be authored in llama.cpp's vocabulary, in a file whose every neighbouring row assumes a ggml-rpc
-// weights peer and a per-slot context. The successor owns the shared realization and evidence
-// carrier; this module stays what its name says it is, a historical observation of one engine, and
-// its fields do not widen. What changes today is that its trigger is no longer pending.
-//
-// THIS PARAGRAPH USED TO CLAIM THE OPPOSITE, AND WITHDRAWING IT IS WHAT THE RENAME IS FOR. It said
-// the deployment type stays IMPLEMENTATION-NEUTRAL -- "no llama.cpp, no IQ3_S, no engine anywhere"
-// -- and treated it as the stable structural subject with the observation as one realization of it.
-// That was false about its own fields. LlamaCppRpcDeployment names exactly ONE ggml-rpc weights peer
-// with an RPC port, and its slot plan derives llama.cpp's TOTAL `-c` from a per-slot context. A
-// four-worker tensor-parallel deployment does not inhabit that shape at all, so the type was an
-// engine-specific record wearing a neutral name -- which is the meaning fork this module was recut
-// to close, not a property it can still claim.
-//
-// THE NEUTRAL SUBJECT IS A LATER, SEPARATE CONSTRUCTION, and it is deliberately not attempted here:
-// it must be derived from two ACTUALLY OBSERVED realizations rather than generalized from this one,
-// because a neutral shape induced from a single engine reproduces that engine's assumptions under a
-// wider name. What survives as the genuinely cross-realization invariant is a rule rather than a
-// record: an internal participant of an active deployment must not simultaneously be published as
-// an independent client endpoint.
-// THE ARTIFACT FIELD IS NAMED FOR WHAT IT IS. `on_disk_artifact` rather than `artifact`, because
-// this record otherwise reads as four facts about one running process and one of them is a fact
-// about a filesystem. The name is the only thing that travels to every consumer.
-type LlamaCppRpcObservedDeployment sole_constructor {
-  unit: LlamaCppRpcDeployment
-  on_disk_artifact: LlamaCppRpcOnDiskArtifact
-  api_surface: LlamaCppRpcObservedApiSurface
-  timing: LlamaCppRpcTimingPair
-  throughput: LlamaCppRpcDecodeEnvelope
-}
-
-// The observation of 2026-09-02, or Absent when any part of it failed to construct. There is no arm
-// that reports a partial observation: a join missing one of its arms is not a weaker observation of
-// the same realization, it is a claim about a realization nobody fully measured.
-fn llama_cpp_rpc_observed_observation() -> LlamaCppRpcObservedDeployment? {
-  match llama_cpp_rpc_observed() {
-    Absent => none
-    Present { value: u } =>
-      match llama_cpp_rpc_observed_throughput() {
-        Absent => none
-        Present { value: band } =>
-          match llama_cpp_rpc_observed_timing_pair() {
-            Absent => none
-            Present { value: pair } =>
-              match llama_cpp_rpc_observed_artifact() {
-                Absent => none
-                Present { value: art } =>
-                  Present { value: LlamaCppRpcObservedDeployment {
-                    unit: u,
-                    on_disk_artifact: art,
-                    api_surface: llama_cpp_rpc_observed_api_surface,
-                    timing: pair,
-                    throughput: band,
-                  } }
-              }
-          }
-      }
-  }
-}
diff --git a/dag/gunbc/spark/pair_incumbent_identity.dag b/dag/gunbc/spark/pair_incumbent_identity.dag
deleted file mode 100644
index e17cae639d3..00000000000
--- a/dag/gunbc/spark/pair_incumbent_identity.dag
+++ /dev/null
@@ -1,484 +0,0 @@
-module gunbc.spark.pair_incumbent_identity
-
-import std.types { String, Bool, NonEmptyStr, List }
-import std.optional { Present, Absent }
-import std.content_hash {
-  ContentHash, Fnv1a64Structural,
-  content_hash_atom, content_hash_combine_structural, content_hash_tagged, serialize_content_hash,
-}
-import product.host_identity { HostIdentity, host_identity_eq }
-import product.fabric.demand { ObservationReceiptRef }
-import gunbc.host_effect { FleetSsh }
-import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext }
-import gunbc.fleet_ssh_locus { fleet_locus_ssh_target }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_wire }
-import gunbc.spark.vllm_endpoint_process_launch { VllmEndpointProcessLaunch }
-import gunbc.spark.vllm_serving_launch {
-  EndpointIncarnationObservation, LaunchedFromDeclaredUnit, LaunchedFromDifferentUnit, LaunchUnitDigestsIncomparable,
-  launch_unit_provenance, DigestsAgree, DigestsDiffer, DigestsIncomparable, digests_agree,
-}
-import gunbc.spark.serving_incarnation_observe {
-  ServingIncarnationRefusal, IncarnationObserved, IncarnationRefused,
-  serving_incarnation_refusal_text, observe_endpoint_incarnation,
-  UnitIdentityObserved, UnitIdentityRefused, read_unit_identity,
-}
-import gunbc.spark.pair_serving_desired { SparkPairServingUnitReady, SparkPairServingUnitRefused, spark_pair_serving_unit }
-import gunbc.spark.pair_serving_realization {
-  SparkPairRealization, SparkPairRealized, SparkPairRealizationRefused, SparkPairHostRealization,
-  RenderedUnitDigested, RenderedUnitDigestUnavailable, spark_pair_rendered_unit_digest,
-  spark_pair_realizations, spark_pair_worker_unit_name,
-}
-
-// ── WHAT WE INTEND V4 TO BE, WHAT IS RUNNING, AND WHETHER THEY AGREE ARE THREE FACTS ───────────
-//
-// gunbc.spark.pair_serving_authority carries Group A as PairServingActive with an UNESTABLISHED
-// exact realization, and its obligation says why: the only identity the corpus held for the
-// incumbent was gunbc.spark.first_party_serving spark_realization_identity, a readback comparison
-// of one configured model path, which is configuration agreement and not a content-addressed key.
-// The Cut D transaction (docs/plans/dsv41-cut-d-redesign.md, D0) needs to prove that what it
-// suspends is what it would restore, and one hash cannot do that, because it would have to stand
-// for two different subjects at once:
-//
-//   DeclaredPairRealization    what the repository intends the pair to be -- derived from the
-//                              rendered unit bytes of every rank, which already carry the image
-//                              reference, the model path, the engine argv and the container
-//                              environment, so nothing is listed twice beside them
-//   ObservedPairRealization    what is running on the group right now -- the head's answering
-//                              incarnation (gunbc.spark.serving_incarnation_observe) joined with
-//                              the unit identity of every worker rank
-//   PairRealizationAgreement   whether the second realizes the first, host by host
-//
-// A declaration-derived key inhabits the first. It may never stand for the second: two launches of
-// one unit are two incarnations (vllm_serving_launch says why), and a unit that was edited on the
-// host after our render is a different realization under our name. The key is EXPECTED identity,
-// and only the agreement fold, holding an observation, says whether the expectation is met.
-//
-// THE KEY POPULATION IS V4'S, NOT THE SUCCESSOR'S. The four Engram rank-store identities and the
-// produced V4.1 image belong to the successor's authorization scope (Cut D §D1), not to the
-// identity of the incumbent being suspended; listing them here would key the incumbent on facts
-// about a different candidate.
-//
-// WHAT THE OBSERVED SIDE CARRIES THAT THE DECLARED SIDE CANNOT COMPARE. The head's incarnation
-// carries the running container's image id. The pair runtime image is built on the host from
-// gunbc_spark_pair_runtime_dockerfile and its id is minted by that build, so the corpus declares an
-// image REFERENCE (inside the unit text) and no image id to compare against. That axis is therefore
-// carried as observed-and-uncompared with the obligation that would ground it, never folded into
-// the agreement as if it had been checked (DESIGN §4d: a bet is typed as a bet).
-
-// ── DECLARED ───────────────────────────────────────────────────────────────────────────────────
-
-type DeclaredRankUnit {
-  host: HostIdentity
-  unit_name: NonEmptyStr
-  digest: ContentHash
-}
-
-type DeclaredPairRealization sole_constructor {
-  group: FabricGroup
-  head: DeclaredRankUnit
-  workers: List<DeclaredRankUnit>
-  key: ContentHash
-}
-
-type DeclaredPairRealizationStanding
-  = DeclaredPairRealizationKeyed { declared: DeclaredPairRealization }
-  | DeclaredPairRealizationUnavailable { group: FabricGroup, obligation: NonEmptyStr }
-
-data declared_pair_realization_key_tag: NonEmptyStr = "gunbc.spark.pair_incumbent_identity/declared-pair-realization/v1" as NonEmptyStr
-
-// One rank's contribution to the key: the host, the unit it carries and what that unit's rendered
-// bytes digest to. The host is part of it because the same unit bytes on a different machine is a
-// different pair.
-fn declared_rank_atom(u: DeclaredRankUnit) -> Fnv1a64Structural {
-  content_hash_atom(value: join([u.host as String, "=", u.unit_name as String, "=", serialize_content_hash(hash: u.digest) as String], "") as NonEmptyStr)
-}
-
-// THE KEY IS A FOLD OVER THE RANKS IN DECLARED ORDER -- head first, then workers as the desired unit
-// lists them -- so it is a function of the declaration alone and two renders of one declaration key
-// identically. Any rank's bytes changing changes it.
-fn declared_pair_key(group: FabricGroup, head: DeclaredRankUnit, workers: List<DeclaredRankUnit>) -> ContentHash {
-  let seed = content_hash_atom(value: fabric_group_wire(g: group))
-  let folded = fold(concat([head], workers), init: seed, f: (acc, u) => content_hash_combine_structural(left: acc, right: declared_rank_atom(u: u)))
-  content_hash_tagged(tag: declared_pair_realization_key_tag, payload: folded)
-}
-
-// THE CONSTRUCTOR, and the only way a DeclaredPairRealization gets its key: the key is derived from
-// the ranks handed in, never supplied beside them, so a value cannot carry a key that disagrees
-// with its own ranks. Production reaches it through declared_pair_realization; witnesses hand in
-// fixture ranks.
-fn declared_pair_realization_of(group: FabricGroup, head: DeclaredRankUnit, workers: List<DeclaredRankUnit>) -> DeclaredPairRealization {
-  DeclaredPairRealization { group: group, head: head, workers: workers, key: declared_pair_key(group: group, head: head, workers: workers) }
-}
-
-type RankUnavailable {
-  host: HostIdentity
-  obligation: NonEmptyStr
-}
-
-type DeclaredRankUnitRead
-  = DeclaredRankUnitRead { unit: DeclaredRankUnit }
-  | DeclaredRankUnitUnavailable { unavailable: RankUnavailable }
-
-fn declared_rank_unit(real: SparkPairHostRealization) -> DeclaredRankUnitRead {
-  match spark_pair_rendered_unit_digest(render: real.unit) {
-    RenderedUnitDigestUnavailable { obligation: o } => DeclaredRankUnitUnavailable { unavailable: RankUnavailable { host: real.host, obligation: o } }
-    RenderedUnitDigested { unit_name: n, digest: d } => DeclaredRankUnitRead { unit: DeclaredRankUnit { host: real.host, unit_name: n, digest: d } }
-  }
-}
-
-fn declared_rank_unavailable(r: DeclaredRankUnitRead) -> List<RankUnavailable> {
-  match r {
-    DeclaredRankUnitUnavailable { unavailable: u } => [u]
-    DeclaredRankUnitRead { unit: _ } => [] as List<RankUnavailable>
-  }
-}
-
-fn declared_rank_units(r: DeclaredRankUnitRead) -> List<DeclaredRankUnit> {
-  match r {
-    DeclaredRankUnitRead { unit: u } => [u]
-    DeclaredRankUnitUnavailable { unavailable: _ } => [] as List<DeclaredRankUnit>
-  }
-}
-
-fn rank_unavailable_text(role: String, u: RankUnavailable) -> NonEmptyStr {
-  join([role, " ", u.host as String, ": ", u.obligation as String], "") as NonEmptyStr
-}
-
-fn declared_pair_of_realization(r: SparkPairRealization) -> DeclaredPairRealizationStanding {
-  match r {
-    SparkPairRealizationRefused { group: g, cause: c } => DeclaredPairRealizationUnavailable { group: g, obligation: c }
-    SparkPairRealized { group: g, head: h, workers: ws } => {
-      let head_read = declared_rank_unit(real: h)
-      let worker_reads = map(ws, w => declared_rank_unit(real: w))
-      match first(declared_rank_unavailable(r: head_read)) {
-        Present { value: u } => DeclaredPairRealizationUnavailable { group: g, obligation: rank_unavailable_text(role: "head", u: u) }
-        Absent =>
-          match first(flat_map(worker_reads, wr => declared_rank_unavailable(r: wr))) {
-            Present { value: u } => DeclaredPairRealizationUnavailable { group: g, obligation: rank_unavailable_text(role: "worker", u: u) }
-            Absent => {
-              let head_units = declared_rank_units(r: head_read)
-              let worker_units = flat_map(worker_reads, wr => declared_rank_units(r: wr))
-              match first(head_units) {
-                Absent => DeclaredPairRealizationUnavailable { group: g, obligation: "the head rank read neither a unit nor a refusal" as NonEmptyStr }
-                Present { value: head_unit } =>
-                  DeclaredPairRealizationKeyed { declared: declared_pair_realization_of(group: g, head: head_unit, workers: worker_units) }
-              }
-            }
-          }
-      }
-    }
-  }
-}
-
-fn realization_names_group(r: SparkPairRealization, group: FabricGroup) -> Bool {
-  match r {
-    SparkPairRealizationRefused { group: g, cause: _ } => (fabric_group_wire(g: g) as String) == (fabric_group_wire(g: group) as String)
-    SparkPairRealized { group: g, head: _, workers: _ } => (fabric_group_wire(g: g) as String) == (fabric_group_wire(g: group) as String)
-  }
-}
-
-// THE DECLARED SIDE, FROM THE PRODUCTION DECLARATION. Renders every rank of the group's pair
-// realization once and digests each once; callers hold the standing for their transaction.
-fn declared_pair_realization(group: FabricGroup) -> DeclaredPairRealizationStanding {
-  match first(filter(spark_pair_realizations(), r => realization_names_group(r: r, group: group))) {
-    Absent => DeclaredPairRealizationUnavailable { group: group, obligation: "no pair realization names this fabric group, so there are no rendered unit bytes to key" as NonEmptyStr }
-    Present { value: r } => declared_pair_of_realization(r: r)
-  }
-}
-
-// ── OBSERVED ───────────────────────────────────────────────────────────────────────────────────
-
-type ObservedRankUnit {
-  host: HostIdentity
-  unit_name: NonEmptyStr
-  systemd_invocation: NonEmptyStr
-  unit_digest: ContentHash
-}
-
-// The whole four-rank realization as observed: the head's answering incarnation -- endpoint bound
-// to engine launch, container id, image id, unit digest, invocation -- and each worker's unit
-// identity. SOLE-CONSTRUCTED: production reaches it only through observe_pair_realization.
-type ObservedPairRealization sole_constructor {
-  group: FabricGroup
-  head: EndpointIncarnationObservation
-  workers: List<ObservedRankUnit>
-  receipt: ObservationReceiptRef
-}
-
-// The first three are minted by the caller that reaches for the observation -- a route with no
-// endpoint, an endpoint whose launch could not be read, a fleet session that could not be prepared
-// -- because they are refusals to observe at all, and the observation's caller is where they occur.
-// The constructor: production reaches it through observe_pair_realization, witnesses through this
-// with fixture evidence, the idiom gunbc.spark.vllm_serving_launch sets for its own sole-constructed
-// observation.
-fn observed_pair_realization_of(group: FabricGroup, head: EndpointIncarnationObservation, workers: List<ObservedRankUnit>, receipt: ObservationReceiptRef) -> ObservedPairRealization {
-  ObservedPairRealization { group: group, head: head, workers: workers, receipt: receipt }
-}
-
-type PairObservationRefusal
-  = PairRouteUnresolved { group: FabricGroup, obligation: NonEmptyStr }
-  | PairLaunchUnobserved { group: FabricGroup, obligation: NonEmptyStr }
-  | PairFleetAccessRefused { group: FabricGroup, cause: NonEmptyStr }
-  | PairGroupNotDesired { group: FabricGroup, cause: NonEmptyStr }
-  | PairHeadIncarnationRefused { host: HostIdentity, refusal: ServingIncarnationRefusal }
-  | PairWorkerUnitRefused { host: HostIdentity, refusal: ServingIncarnationRefusal }
-
-type ObservedPairRealizationReading
-  = ObservedPairRealizationRead { observed: ObservedPairRealization }
-  | ObservedPairRealizationRefused { refusal: PairObservationRefusal }
-
-data pair_realization_observation_receipt: ObservationReceiptRef = "gunbc.spark.pair_incumbent_identity" as ObservationReceiptRef
-
-fn pair_observation_refusal_text(r: PairObservationRefusal) -> String {
-  match r {
-    PairRouteUnresolved { group: g, obligation: o } => join([fabric_group_wire(g: g) as String, " has no resolved serving route: ", o as String], "")
-    PairLaunchUnobserved { group: g, obligation: o } => join([fabric_group_wire(g: g) as String, " answered no launch: ", o as String], "")
-    PairFleetAccessRefused { group: g, cause: c } => join([fabric_group_wire(g: g) as String, " could not be reached over the fleet session: ", c as String], "")
-    PairGroupNotDesired { group: g, cause: c } => join([fabric_group_wire(g: g) as String, " has no desired pair unit: ", c as String], "")
-    PairHeadIncarnationRefused { host: h, refusal: r } => join(["head ", h as String, ": ", serving_incarnation_refusal_text(r: r)], "")
-    PairWorkerUnitRefused { host: h, refusal: r } => join(["worker ", h as String, ": ", serving_incarnation_refusal_text(r: r)], "")
-  }
-}
-
-type RankRefused {
-  host: HostIdentity
-  refusal: ServingIncarnationRefusal
-}
-
-type ObservedRankUnitRead
-  = ObservedRankUnitRead { unit: ObservedRankUnit }
-  | ObservedRankUnitRefused { refused: RankRefused }
-
-// ONE WORKER RANK: the same three unprivileged reads the head's incarnation begins with, over the
-// worker unit, and nothing more -- a worker exports no endpoint, so there is no process to bind.
-fn observe_worker_unit(context: FleetSshExecutionContext, host: HostIdentity) -> ObservedRankUnitRead {
-  let transport = FleetSsh { target: fleet_locus_ssh_target(host: host), context: context }
-  match read_unit_identity(transport: transport, unit: spark_pair_worker_unit_name) {
-    UnitIdentityRefused { refusal: r } => ObservedRankUnitRefused { refused: RankRefused { host: host, refusal: r } }
-    UnitIdentityObserved { invocation: i, unit_digest: d } =>
-      ObservedRankUnitRead { unit: ObservedRankUnit { host: host, unit_name: spark_pair_worker_unit_name, systemd_invocation: i, unit_digest: d } }
-  }
-}
-
-fn observed_rank_refused(r: ObservedRankUnitRead) -> List<RankRefused> {
-  match r {
-    ObservedRankUnitRefused { refused: x } => [x]
-    ObservedRankUnitRead { unit: _ } => [] as List<RankRefused>
-  }
-}
-
-fn observed_rank_units(r: ObservedRankUnitRead) -> List<ObservedRankUnit> {
-  match r {
-    ObservedRankUnitRead { unit: u } => [u]
-    ObservedRankUnitRefused { refused: _ } => [] as List<ObservedRankUnit>
-  }
-}
-
-// THE OBSERVATION. The rank population it reads is the DESIRED unit's -- the hosts the declaration
-// names as head and workers -- because that is the only roster that says which machines to ask; a
-// host outside it running our worker unit is not observable here and is not claimed to be absent.
-// Every rank is read; the first refusal is the reading's refusal, because a pair with one unread
-// rank has no identity rather than three quarters of one.
-fn observe_pair_realization(
-  context: FleetSshExecutionContext,
-  group: FabricGroup,
-  endpoint: VllmEndpointProcessLaunch,
-) -> ObservedPairRealizationReading {
-  match spark_pair_serving_unit(group: group) {
-    SparkPairServingUnitRefused { group: g, cause: c } => ObservedPairRealizationRefused { refusal: PairGroupNotDesired { group: g, cause: c } }
-    SparkPairServingUnitReady { group: g, engine: _, head: h, workers: ws } =>
-      match observe_endpoint_incarnation(context: context, group: g, head: h.host, endpoint: endpoint) {
-        IncarnationRefused { refusal: r } => ObservedPairRealizationRefused { refusal: PairHeadIncarnationRefused { host: h.host, refusal: r } }
-        IncarnationObserved { observation: head_obs } => {
-          let worker_reads = map(ws, w => observe_worker_unit(context: context, host: w.host))
-          match first(flat_map(worker_reads, wr => observed_rank_refused(r: wr))) {
-            Present { value: x } => ObservedPairRealizationRefused { refusal: PairWorkerUnitRefused { host: x.host, refusal: x.refusal } }
-            Absent =>
-              ObservedPairRealizationRead {
-                observed: observed_pair_realization_of(group: g, head: head_obs, workers: flat_map(worker_reads, wr => observed_rank_units(r: wr)), receipt: pair_realization_observation_receipt),
-              }
-          }
-        }
-      }
-  }
-}
-
-// ── AGREEMENT ──────────────────────────────────────────────────────────────────────────────────
-
-type PairRankDrift {
-  host: HostIdentity
-  unit_name: NonEmptyStr
-  declared: ContentHash
-  observed: ContentHash
-}
-
-// The head's image id is observed and has nothing declared to be compared against; see the header.
-type ObservedImageStanding
-  = ImageObservedUncompared { observed: ContentHash, obligation: NonEmptyStr }
-
-data pair_declared_image_digest_obligation: NonEmptyStr = "the pair runtime image is built on the host from gunbc_spark_pair_runtime_dockerfile and the corpus declares its reference, not its id; comparing the observed image id needs a produced-image receipt from that build materialization (gunbc.spark.vllm_runtime_image_build is the shape) carried on the declared realization" as NonEmptyStr
-
-type PairRealizationAgreement
-  = PairRealizationEstablished { key: ContentHash, declared: DeclaredPairRealization, observed: ObservedPairRealization, image: ObservedImageStanding }
-  | PairRealizationDrifted { key: ContentHash, drifted: List<PairRankDrift> }
-  | PairRealizationRankPopulationDiffers { key: ContentHash, declared_hosts: List<HostIdentity>, observed_hosts: List<HostIdentity> }
-  | PairRealizationConflict { key: ContentHash, host: HostIdentity, cause: NonEmptyStr }
-  | PairRealizationDeclarationUnavailable { group: FabricGroup, obligation: NonEmptyStr }
-  | PairRealizationUnread { key: ContentHash, refusal: PairObservationRefusal }
-
-type RankAgreementRow
-  = RankAgrees
-  | RankDrifted { drift: PairRankDrift }
-  | RankIncomparable { host: HostIdentity }
-  | RankUnobserved { host: HostIdentity }
-
-fn head_row(declared: DeclaredRankUnit, observed: ObservedPairRealization) -> RankAgreementRow {
-  match launch_unit_provenance(launch: observed.head.launch, declared: declared.digest) {
-    LaunchedFromDeclaredUnit { declared: _ } => RankAgrees
-    LaunchedFromDifferentUnit { observed: o, declared: d } => RankDrifted { drift: PairRankDrift { host: declared.host, unit_name: declared.unit_name, declared: d, observed: o } }
-    LaunchUnitDigestsIncomparable => RankIncomparable { host: declared.host }
-  }
-}
-
-fn worker_row(declared: DeclaredRankUnit, observed: List<ObservedRankUnit>) -> RankAgreementRow {
-  match first(filter(observed, o => host_identity_eq(a: o.host, b: declared.host))) {
-    Absent => RankUnobserved { host: declared.host }
-    Present { value: o } =>
-      match digests_agree(left: o.unit_digest, right: declared.digest) {
-        DigestsAgree => RankAgrees
-        DigestsDiffer => RankDrifted { drift: PairRankDrift { host: declared.host, unit_name: declared.unit_name, declared: declared.digest, observed: o.unit_digest } }
-        DigestsIncomparable => RankIncomparable { host: declared.host }
-      }
-  }
-}
-
-fn row_drifts(r: RankAgreementRow) -> List<PairRankDrift> {
-  match r {
-    RankDrifted { drift: d } => [d]
-    RankAgrees => [] as List<PairRankDrift>
-    RankIncomparable { host: _ } => [] as List<PairRankDrift>
-    RankUnobserved { host: _ } => [] as List<PairRankDrift>
-  }
-}
-
-fn row_incomparable(r: RankAgreementRow) -> List<HostIdentity> {
-  match r {
-    RankIncomparable { host: h } => [h]
-    RankAgrees => [] as List<HostIdentity>
-    RankDrifted { drift: _ } => [] as List<HostIdentity>
-    RankUnobserved { host: _ } => [] as List<HostIdentity>
-  }
-}
-
-fn row_unobserved(r: RankAgreementRow) -> Bool {
-  match r {
-    RankUnobserved { host: _ } => true
-    RankAgrees => false
-    RankDrifted { drift: _ } => false
-    RankIncomparable { host: _ } => false
-  }
-}
-
-fn drifts_of(rows: List<RankAgreementRow>) -> List<PairRankDrift> {
-  flat_map(rows, r => row_drifts(r: r))
-}
-
-fn first_incomparable(rows: List<RankAgreementRow>) -> HostIdentity? {
-  first(flat_map(rows, r => row_incomparable(r: r)))
-}
-
-fn any_unobserved(rows: List<RankAgreementRow>) -> Bool {
-  any(rows, r => row_unobserved(r: r))
-}
-
-fn declared_hosts(d: DeclaredPairRealization) -> List<HostIdentity> {
-  concat([d.head.host], map(d.workers, w => w.host))
-}
-
-fn observed_hosts(o: ObservedPairRealization) -> List<HostIdentity> {
-  concat([o.head.launch.head], map(o.workers, w => w.host))
-}
-
-// THE AGREEMENT, HOST BY HOST. The precedence is refusal-first: a declaration that could not be
-// keyed has nothing to agree with; an unread observation is unread; a population mismatch means the
-// two sides are not even about the same machines; an incomparable digest pair is an observer
-// contradiction (vllm_serving_launch: "cannot compare" is never "differs"); and only then is a
-// non-empty drift list a drift. Established is what remains, and it carries both sides so a
-// consumer can cite exactly what agreed.
-fn pair_realization_agreement(declared: DeclaredPairRealizationStanding, observed: ObservedPairRealizationReading) -> PairRealizationAgreement {
-  match declared {
-    DeclaredPairRealizationUnavailable { group: g, obligation: o } => PairRealizationDeclarationUnavailable { group: g, obligation: o }
-    DeclaredPairRealizationKeyed { declared: d } =>
-      match observed {
-        ObservedPairRealizationRefused { refusal: r } => PairRealizationUnread { key: d.key, refusal: r }
-        ObservedPairRealizationRead { observed: o } => {
-          let head_agrees_host = host_identity_eq(a: o.head.launch.head, b: d.head.host)
-          let rows = concat([head_row(declared: d.head, observed: o)], map(d.workers, w => worker_row(declared: w, observed: o.workers)))
-          if !head_agrees_host || any_unobserved(rows: rows) || length(o.workers) != length(d.workers) {
-            PairRealizationRankPopulationDiffers { key: d.key, declared_hosts: declared_hosts(d: d), observed_hosts: observed_hosts(o: o) }
-          } else {
-            match first_incomparable(rows: rows) {
-              Present { value: h } => PairRealizationConflict { key: d.key, host: h, cause: "the declared and observed unit digests are of different hash families, so the two cannot be compared" as NonEmptyStr }
-              Absent => {
-                let drifted = drifts_of(rows: rows)
-                if length(drifted) != 0 {
-                  PairRealizationDrifted { key: d.key, drifted: drifted }
-                } else {
-                  PairRealizationEstablished {
-                    key: d.key, declared: d, observed: o,
-                    image: ImageObservedUncompared { observed: o.head.launch.executable_digest, obligation: pair_declared_image_digest_obligation },
-                  }
-                }
-              }
-            }
-          }
-        }
-      }
-  }
-}
-
-fn pair_realization_is_established(a: PairRealizationAgreement) -> Bool {
-  match a {
-    PairRealizationEstablished { key: _, declared: _, observed: _, image: _ } => true
-    PairRealizationDrifted { key: _, drifted: _ } => false
-    PairRealizationRankPopulationDiffers { key: _, declared_hosts: _, observed_hosts: _ } => false
-    PairRealizationConflict { key: _, host: _, cause: _ } => false
-    PairRealizationDeclarationUnavailable { group: _, obligation: _ } => false
-    PairRealizationUnread { key: _, refusal: _ } => false
-  }
-}
-
-fn drift_line(d: PairRankDrift) -> String {
-  join(["  ", d.host as String, " ", d.unit_name as String, ": declared ", serialize_content_hash(hash: d.declared) as String, " observed ", serialize_content_hash(hash: d.observed) as String], "")
-}
-
-fn hosts_wire(hs: List<HostIdentity>) -> String {
-  join(map(hs, h => h as String), ",")
-}
-
-// The agreement as receipt lines: one verdict line naming the key, then whatever locates the verdict.
-fn pair_realization_agreement_lines(a: PairRealizationAgreement) -> List<String> {
-  match a {
-    PairRealizationEstablished { key: k, declared: d, observed: o, image: ImageObservedUncompared { observed: img, obligation: ob } } =>
-      concat(
-        [
-          join(["established key=", serialize_content_hash(hash: k) as String, " group=", fabric_group_wire(g: d.group) as String], ""),
-          join(["  head ", o.head.launch.head as String, " invocation=", o.head.launch.systemd_invocation as String, " container=", o.head.launch.container_id as String, " unit=", serialize_content_hash(hash: o.head.launch.unit_digest) as String], ""),
-        ],
-        concat(
-          map(o.workers, w => join(["  worker ", w.host as String, " invocation=", w.systemd_invocation as String, " unit=", serialize_content_hash(hash: w.unit_digest) as String], "")),
-          [join(["  image-uncompared observed=", serialize_content_hash(hash: img) as String, " -- ", ob as String], "")],
-        ),
-      )
-    PairRealizationDrifted { key: k, drifted: ds } =>
-      concat([join(["drifted key=", serialize_content_hash(hash: k) as String], "")], map(ds, d => drift_line(d: d)))
-    PairRealizationRankPopulationDiffers { key: k, declared_hosts: dh, observed_hosts: oh } =>
-      [join(["rank-population-differs key=", serialize_content_hash(hash: k) as String, " declared=", hosts_wire(hs: dh), " observed=", hosts_wire(hs: oh)], "")]
-    PairRealizationConflict { key: k, host: h, cause: c } =>
-      [join(["conflict key=", serialize_content_hash(hash: k) as String, " host=", h as String, ": ", c as String], "")]
-    PairRealizationDeclarationUnavailable { group: g, obligation: o } =>
-      [join(["declaration-unavailable group=", fabric_group_wire(g: g) as String, ": ", o as String], "")]
-    PairRealizationUnread { key: k, refusal: r } =>
-      [join(["unread key=", serialize_content_hash(hash: k) as String, ": ", pair_observation_refusal_text(r: r)], "")]
-  }
-}
diff --git a/dag/gunbc/spark/pair_serving_apply.dag b/dag/gunbc/spark/pair_serving_apply.dag
index e30097d9ead..c40d167cae8 100644
--- a/dag/gunbc/spark/pair_serving_apply.dag
+++ b/dag/gunbc/spark/pair_serving_apply.dag
@@ -17,7 +17,7 @@ import gunbc.fleet_bootstrap_principal_session {
   FleetPrincipalLegRefused,
 }
 import extdeps.docker.images.sparkrun_vllm_ds4_gb10 { gunbc_spark_pair_runtime_dockerfile }
-import gunbc.spark.fabric_switch_observed { FabricGroup }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 import gunbc.spark.pair_serving_authority { PairServingGroupAuthority, pair_serving_apply_admits }
 import gunbc.spark.pair_serving_authority_log {
   CurrentAuthority, CurrentAuthorityRead, CurrentAuthorityUnread, current_pair_serving_authorities, current_authority_for, current_authority_wire,
diff --git a/dag/gunbc/spark/pair_serving_authority.dag b/dag/gunbc/spark/pair_serving_authority.dag
index 1780d623aad..7c2547f94cb 100644
--- a/dag/gunbc/spark/pair_serving_authority.dag
+++ b/dag/gunbc/spark/pair_serving_authority.dag
@@ -4,7 +4,7 @@ import std.types { Bool, NonEmptyStr, List }
 import std.content_hash { ContentHash }
 import std.temporal_effect { HeldLease, HeldLeaseObservedState, held_lease_observed_verdict }
 import std.upsert_decision { ObservationVerdict, Converged, Absent, Drifted, Conflict, Inaccessible, UnknownRefused }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, fabric_group_wire, fabric_group_hosts }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire, fabric_group_hosts }
 import product.host_identity { HostIdentity }
 import gunbc.spark.released_baseline { ReleasedBaselineSpec }
 
@@ -239,9 +239,10 @@ fn pair_serving_may_finish(a: PairServingGroupAuthority) -> Bool {
   }
 }
 
-// THE LIVE ROW. One authority per claimed group, and today Group A is actively serving the declared
-// pair realization -- so this row is PairServingActive and the transaction states are unreachable from
-// production until a replacement actually begins. That is the correct resting state and not a reason to
+// THE LIVE ROW. One authority per claimed group, and today no group is claimed: Group A, the only one this
+// roster ever held (PairServingActive over the declared pair realization), was decommissioned and sold
+// on 2026-10-07, so the roster is empty and every transaction state is unreachable from production
+// until a group is claimed again. That is the correct resting state and not a reason to
 // omit the other arms: they are what the apply seam and the capacity instrument consume to answer
 // correctly WHEN a transaction starts, and a coproduct missing them cannot express the state machine
 // the Cut D transaction declares total.
@@ -261,12 +262,9 @@ fn pair_serving_may_finish(a: PairServingGroupAuthority) -> Bool {
 // is now a projection of this population: a row for an unclaimed group cannot exist because this row IS
 // the claim, and a claimed group with no authority cannot exist for the same reason. The agreement
 // witness dissolved with the climb rather than being kept as reassurance.
-data spark_pair_serving_authorities: List<PairServingGroupAuthority> = [
-  PairServingActive {
-    group: FabricGroupA,
-    exact_realization: PairRealizationUnestablished { obligation: pair_realization_key_obligation },
-  },
-]
+// Group A was the only group this roster claimed, and it was decommissioned on 2026-10-07 (operator; the
+// units were sold), so no group is claimed by pair serving now. A claim for another group is a new row.
+data spark_pair_serving_authorities: List<PairServingGroupAuthority> = [] as List<PairServingGroupAuthority>
 
 // ABSENCE IS NOT PERMISSION. A claimed group with no authority row is a missing fact, and the honest
 // answer is no authority at all rather than a default Active -- defaulting would mean a group could be
@@ -275,21 +273,3 @@ fn pair_serving_authority_for(group: FabricGroup) -> PairServingGroupAuthority?
   first(filter(spark_pair_serving_authorities, a =>
     (fabric_group_wire(g: pair_serving_authority_group(a: a)) as String) == (fabric_group_wire(g: group) as String)))
 }
-
-// THE OBLIGATION THIS ROW CARRIES IS THE IMAGE AXIS, AND D0 DOES NOT DISCHARGE IT. The producers
-// that were missing have landed: gunbc.spark.pair_incumbent_identity keys the DECLARED pair
-// realization from every rank's rendered unit bytes, observes the LIVE four-rank incarnation, and
-// folds the two into a PairRealizationAgreement; gunbc.spark.pair_serving_d0 takes that reading
-// inside its held claim. What no producer has is a declared IMAGE identity to compare the running
-// container's image id against -- the pair runtime image is built on the host and the corpus
-// declares its reference, not its id -- so PairRealizationEstablished is rank-and-unit agreement
-// with the image carried observed-and-uncompared, and it may NOT mint an exact incumbent key: a
-// rebuilt image under the same reference with unchanged unit bytes passes it. D0 therefore restores
-// a live declared incumbent to the Active state it held, unchanged. The only Keyed realization D0
-// writes is the authorized SUCCESSOR's, on the suspended authority. TRIGGER: a produced-image
-// receipt for the pair runtime image (the build materialization gunbc.spark.vllm_runtime_image_build
-// is the shape) is carried on the declared realization and compared in the agreement, so
-// Established means the image too. SUFFICIENT FOR: the incumbent's exact realization can be minted
-// from an Established agreement, and a successor transition is discriminated by realization rather
-// than by a serving subject V4 and V4.1 deliberately share.
-data pair_realization_key_obligation: NonEmptyStr = "the live V4 pair realization is keyed by gunbc.spark.pair_incumbent_identity declared_pair_realization and read by pair_realization_agreement inside D0's held claim, but that agreement carries the running image observed and uncompared (no produced-image digest exists to compare it against), so it may not mint an exact incumbent key; the Keyed arm for the incumbent waits on a produced-image receipt compared in the agreement, and D0 restores a live declared incumbent to its Active state unchanged. SUFFICIENT FOR: PairServingActive can name the incumbent exactly, so a successor transition is discriminated by realization rather than by a serving subject V4 and V4.1 deliberately share" as NonEmptyStr
diff --git a/dag/gunbc/spark/pair_serving_authority_log.dag b/dag/gunbc/spark/pair_serving_authority_log.dag
index 76c5f80c069..958012dfe34 100644
--- a/dag/gunbc/spark/pair_serving_authority_log.dag
+++ b/dag/gunbc/spark/pair_serving_authority_log.dag
@@ -26,7 +26,7 @@ import gunbc.fabric_storage_client { FabricStorageBinding }
 import gunbc.fabric_event_log_host { HostStoreResolved, HostStoreRefused, event_log_store_for_host, now_epoch_seconds }
 import std.process { ProcessExit, ExitSuccess, exit_failure }
 import gunbc.spark.fabric_reach { ExecutorReachKnown, ExecutorReachUnknown, observe_executor_reach }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB, fabric_group_wire, parse_fabric_group, fabric_group_of_host }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire, parse_fabric_group, fabric_group_of_host }
 import product.host_identity { HostIdentity, host_identity_eq }
 import gunbc.spark.released_baseline { ReleasedBaselineSpec, released_baseline_wire, parse_released_baseline }
 import gunbc.spark.pair_serving_authority {
@@ -137,7 +137,7 @@ type PairAuthorityEvent
     }
   | PlacementPrepared {
       operation: NonEmptyStr
-      group: FabricGroup
+      group: RecordedFabricGroup
       previous_hosts: List<HostIdentity>
       next_hosts: List<HostIdentity>
     }
@@ -204,7 +204,7 @@ data host_placement_partition: PartitionId = "host-placement" as PartitionId
 // of documents refuse on either chain.
 type PlacementPreparationRef {
   id: EventId
-  group: FabricGroup
+  group: RecordedFabricGroup
   previous_hosts: List<HostIdentity>
   next_hosts: List<HostIdentity>
   operation: NonEmptyStr
@@ -241,7 +241,7 @@ type PreparationState
 type PlacementPreparationRecord {
   id: EventId
   operation: NonEmptyStr
-  group: FabricGroup
+  group: RecordedFabricGroup
   previous_hosts: List<HostIdentity>
   next_hosts: List<HostIdentity>
   recorded_at: EpochSecs
@@ -306,6 +306,103 @@ fn same_group(a: FabricGroup, b: FabricGroup) -> Bool {
   (fabric_group_wire(g: a) as String) == (fabric_group_wire(g: b) as String)
 }
 
+// ── A RECORDED GROUP IS A LIVE GROUP OR THE RETIRED GROUP A (operator decommission, 2026-10-07) ───────────
+//
+// The host-placement partition is append-only and SHARED by every group, and D0's Group A release left
+// Group A preparations, claims and finalizations in it. A reader that could not decode them would refuse
+// the WHOLE partition, so every Group B placement read, host-effect claim and authority write would fail.
+// So the durable codec keeps Group A as a RETIRED arm of the records the partition carries -- and only
+// there: the live FabricGroup has no Group A constructor, every writer takes a FabricGroup and records it
+// as RecordedLiveGroup, so no new Group A preparation, claim or authority write can be composed. The fold
+// keeps a retired record as history: it never matches a live group's query, fences no live host, and a
+// path that would act on one (consumption, cancellation) refuses naming it.
+type RecordedFabricGroup
+  = RecordedLiveGroup { group: FabricGroup }
+  | RecordedRetiredGroupA
+
+data recorded_retired_group_a_wire: String = "group-a"
+
+fn recorded_group(g: FabricGroup) -> RecordedFabricGroup {
+  RecordedLiveGroup { group: g }
+}
+
+fn recorded_group_wire(r: RecordedFabricGroup) -> String {
+  match r {
+    RecordedLiveGroup { group: g } => fabric_group_wire(g: g) as String
+    RecordedRetiredGroupA => recorded_retired_group_a_wire
+  }
+}
+
+fn parse_recorded_group(wire: String) -> RecordedFabricGroup? {
+  if wire == recorded_retired_group_a_wire { Present { value: RecordedRetiredGroupA } }
+  else {
+    match parse_fabric_group(wire: wire) {
+      Absent => none
+      Present { value: g } => Present { value: RecordedLiveGroup { group: g } }
+    }
+  }
+}
+
+fn recorded_is(r: RecordedFabricGroup, g: FabricGroup) -> Bool {
+  match r {
+    RecordedLiveGroup { group: x } => same_group(a: x, b: g)
+    RecordedRetiredGroupA => false
+  }
+}
+
+fn same_recorded(a: RecordedFabricGroup, b: RecordedFabricGroup) -> Bool {
+  recorded_group_wire(r: a) == recorded_group_wire(r: b)
+}
+
+// THE SAME RETIREMENT ONE LEVEL DOWN: an authority-write intent carries the authority states it moves
+// between, and a Group A intent (D0's release saga claimed its append on this partition) carries Group A
+// states. So an intent's previous and next are RecordedAuthority: a live writer mints only
+// RecordedLiveAuthority; a retired Group A state keeps its state word as history and nothing else, so it
+// has no hosts to fence, no realization to launch and no shape any live API accepts.
+type RecordedAuthority
+  = RecordedLiveAuthority { authority: PairServingGroupAuthority }
+  | RecordedRetiredGroupAAuthority { state: NonEmptyStr }
+
+fn recorded_authority_eq(a: RecordedAuthority, b: RecordedAuthority) -> Bool {
+  match a {
+    RecordedLiveAuthority { authority: x } => match b { RecordedLiveAuthority { authority: y } => authority_eq(a: x, b: y)  RecordedRetiredGroupAAuthority { state: _ } => false }
+    RecordedRetiredGroupAAuthority { state: s1 } => match b { RecordedLiveAuthority { authority: _ } => false  RecordedRetiredGroupAAuthority { state: s2 } => (s1 as String) == (s2 as String) }
+  }
+}
+
+fn optional_recorded_authority_eq(a: RecordedAuthority?, b: RecordedAuthority?) -> Bool {
+  match a {
+    Absent => match b { Absent => true  Present { value: _ } => false }
+    Present { value: x } => match b { Absent => false  Present { value: y } => recorded_authority_eq(a: x, b: y) }
+  }
+}
+
+fn recorded_authority_members(prefix: String, r: RecordedAuthority) -> List<JsonKeyValue> {
+  match r {
+    RecordedLiveAuthority { authority: a } => authority_members(prefix: prefix, a: a)
+    RecordedRetiredGroupAAuthority { state: st } =>
+      [kv(prefix: prefix, key: "state", value: st as String), kv(prefix: prefix, key: "group", value: recorded_retired_group_a_wire)]
+  }
+}
+
+fn recorded_authority_decode(doc: JsonValue, prefix: String) -> RecordedAuthority? {
+  match member_string(doc: doc, key: join([prefix, "group"], "")) {
+    Absent => none
+    Present { value: gw } =>
+      if gw == recorded_retired_group_a_wire {
+        match member_nonempty(doc: doc, key: join([prefix, "state"], "")) {
+          Absent => none
+          Present { value: st } => Present { value: RecordedRetiredGroupAAuthority { state: st } }
+        }
+      } else {
+        match authority_decode(doc: doc, prefix: prefix) {
+          Absent => none
+          Present { value: a } => Present { value: RecordedLiveAuthority { authority: a } }
+        }
+      }
+  }
+}
+
 fn hosts_union(a: List<HostIdentity>, b: List<HostIdentity>) -> List<HostIdentity> {
   concat(a, filter(b, h => !any(a, x => host_identity_eq(a: x, b: h))))
 }
@@ -323,7 +420,7 @@ fn preparation_ref_of(r: PlacementPreparationRecord) -> PlacementPreparationRef
 }
 
 fn preparation_ref_eq(a: PlacementPreparationRef, b: PlacementPreparationRef) -> Bool {
-  (a.id as String) == (b.id as String) && same_group(a: a.group, b: b.group) && same_host_set(a: a.previous_hosts, b: b.previous_hosts) && same_host_set(a: a.next_hosts, b: b.next_hosts) && (a.operation as String) == (b.operation as String)
+  (a.id as String) == (b.id as String) && same_recorded(a: a.group, b: b.group) && same_host_set(a: a.previous_hosts, b: b.previous_hosts) && same_host_set(a: a.next_hosts, b: b.next_hosts) && (a.operation as String) == (b.operation as String)
 }
 
 // THE AUTHORITY-WRITE INTENT: everything one authority write is, as a typed value -- the
@@ -336,11 +433,11 @@ fn preparation_ref_eq(a: PlacementPreparationRef, b: PlacementPreparationRef) ->
 // comparison: a structural fingerprint has collisions and this is the one cross-log proof that
 // the event which consumed a claim is the exact write the claim was for.
 type AuthorityWriteIntent {
-  group: FabricGroup
+  group: RecordedFabricGroup
   expected_head: HeadExpectation
   actor: NonEmptyStr
-  previous: PairServingGroupAuthority?
-  next: PairServingGroupAuthority
+  previous: RecordedAuthority?
+  next: RecordedAuthority
   operation: NonEmptyStr
   lifecycle: ContentHash?
   grant: LeaseGrant?
@@ -348,7 +445,7 @@ type AuthorityWriteIntent {
 }
 
 fn authority_write_intent(group: FabricGroup, head: HeadExpectation, actor: NonEmptyStr, previous: PairServingGroupAuthority?, next: PairServingGroupAuthority, operation: NonEmptyStr, lifecycle: ContentHash?, grant: LeaseGrant?, entry_state: ContentHash?) -> AuthorityWriteIntent {
-  AuthorityWriteIntent { group: group, expected_head: head, actor: actor, previous: previous, next: next, operation: operation, lifecycle: lifecycle, grant: grant, entry_state: entry_state }
+  AuthorityWriteIntent { group: recorded_group(g: group), expected_head: head, actor: actor, previous: match previous { Absent => none  Present { value: p } => Present { value: RecordedLiveAuthority { authority: p } } }, next: RecordedLiveAuthority { authority: next }, operation: operation, lifecycle: lifecycle, grant: grant, entry_state: entry_state }
 }
 
 // The intent an authority event proves, derived from the event: its parent is the head, its
@@ -365,23 +462,16 @@ fn optional_hash_eq(a: ContentHash?, b: ContentHash?) -> Bool {
   }
 }
 
-fn optional_authority_eq(a: PairServingGroupAuthority?, b: PairServingGroupAuthority?) -> Bool {
-  match a {
-    Absent => (match b { Absent => true  Present { value: _ } => false })
-    Present { value: x } => (match b { Absent => false  Present { value: y } => authority_eq(a: x, b: y) })
-  }
-}
-
 fn grant_wire(g: LeaseGrant?) -> String {
   serialize_json(v: json_object(members: grant_members(g: g)))
 }
 
 fn write_intent_eq(a: AuthorityWriteIntent, b: AuthorityWriteIntent) -> Bool {
-  same_group(a: a.group, b: b.group)
+  same_recorded(a: a.group, b: b.group)
     && head_expectation_eq(a: a.expected_head, b: b.expected_head)
     && (a.actor as String) == (b.actor as String)
-    && optional_authority_eq(a: a.previous, b: b.previous)
-    && authority_eq(a: a.next, b: b.next)
+    && optional_recorded_authority_eq(a: a.previous, b: b.previous)
+    && recorded_authority_eq(a: a.next, b: b.next)
     && (a.operation as String) == (b.operation as String)
     && optional_hash_eq(a: a.lifecycle, b: b.lifecycle)
     && grant_wire(g: a.grant) == grant_wire(g: b.grant)
@@ -394,27 +484,27 @@ fn write_intent_eq(a: AuthorityWriteIntent, b: AuthorityWriteIntent) -> Bool {
 fn write_intent_members(i: AuthorityWriteIntent) -> List<JsonKeyValue> {
   concat(
     [
-      kv(prefix: "intent_", key: "group", value: fabric_group_wire(g: i.group) as String),
+      kv(prefix: "intent_", key: "group", value: recorded_group_wire(r: i.group)),
       kv(prefix: "intent_", key: "head", value: match i.expected_head { HeadAbsent => ""  HeadAt { id: h } => h as String }),
       kv(prefix: "intent_", key: "actor", value: i.actor as String),
       kv(prefix: "intent_", key: "operation", value: i.operation as String),
     ],
     concat(
-      match i.previous { Absent => [] as List<JsonKeyValue>  Present { value: p } => authority_members(prefix: "intent_prev_", a: p) },
-      concat(authority_members(prefix: "intent_next_", a: i.next), concat(lifecycle_members(l: i.lifecycle), concat(grant_members(g: i.grant), entry_state_members(d: i.entry_state)))),
+      match i.previous { Absent => [] as List<JsonKeyValue>  Present { value: p } => recorded_authority_members(prefix: "intent_prev_", r: p) },
+      concat(recorded_authority_members(prefix: "intent_next_", r: i.next), concat(lifecycle_members(l: i.lifecycle), concat(grant_members(g: i.grant), entry_state_members(d: i.entry_state)))),
     ),
   )
 }
 
 // The preparation an authority write over `previous` → `next` under `operation` must carry.
 fn preparation_ref_expected(id: EventId, group: FabricGroup, previous: List<HostIdentity>, next: List<HostIdentity>, operation: NonEmptyStr) -> PlacementPreparationRef {
-  PlacementPreparationRef { id: id, group: group, previous_hosts: previous, next_hosts: next, operation: operation }
+  PlacementPreparationRef { id: id, group: recorded_group(g: group), previous_hosts: previous, next_hosts: next, operation: operation }
 }
 
 // THE GROUP'S LIVE COMMITMENT: the next population of its newest finalized preparation (none
 // before the first finalization).
 fn group_live_commitment(preps: List<PlacementPreparationRecord>, group: FabricGroup) -> List<HostIdentity> {
-  match last(filter(preps, r => same_group(a: r.group, b: group) && (match r.state { Finalized { authority_event: _, finalized_by: _, intent: _ } => true  Prepared => false  AppendClaimed { claimant: _, expected_head: _, intent: _ } => false  Aborted => false }))) {
+  match last(filter(preps, r => recorded_is(r: r.group, g: group) && (match r.state { Finalized { authority_event: _, finalized_by: _, intent: _ } => true  Prepared => false  AppendClaimed { claimant: _, expected_head: _, intent: _ } => false  Aborted => false }))) {
     Absent => [] as List<HostIdentity>
     Present { value: r } => r.next_hosts
   }
@@ -423,16 +513,16 @@ fn group_live_commitment(preps: List<PlacementPreparationRecord>, group: FabricG
 // EVERYTHING A GROUP FENCES: its live commitment plus the union of both populations of every
 // pending preparation of its own.
 fn group_fenced_hosts(preps: List<PlacementPreparationRecord>, group: FabricGroup) -> List<HostIdentity> {
-  fold(filter(preps, r => same_group(a: r.group, b: group) && preparation_is_pending(r: r)), init: group_live_commitment(preps: preps, group: group), f: (acc, r) => hosts_union(a: acc, b: hosts_union(a: r.previous_hosts, b: r.next_hosts)))
+  fold(filter(preps, r => recorded_is(r: r.group, g: group) && preparation_is_pending(r: r)), init: group_live_commitment(preps: preps, group: group), f: (acc, r) => hosts_union(a: acc, b: hosts_union(a: r.previous_hosts, b: r.next_hosts)))
 }
 
 // The groups that fence a host.
 fn groups_fencing(preps: List<PlacementPreparationRecord>, host: HostIdentity) -> List<FabricGroup> {
-  filter([FabricGroupA, FabricGroupB], g => any(group_fenced_hosts(preps: preps, group: g), h => host_identity_eq(a: h, b: host)))
+  filter([FabricGroupB {}], g => any(group_fenced_hosts(preps: preps, group: g), h => host_identity_eq(a: h, b: host)))
 }
 
 fn preparation_line(r: PlacementPreparationRecord) -> String {
-  join([fabric_group_wire(g: r.group) as String, " ", r.operation as String, " (preparation ", r.id as String, ": ", join(map(r.previous_hosts, h => h as String), ","), " -> ", join(map(r.next_hosts, h => h as String), ","), ")"], "")
+  join([recorded_group_wire(r: r.group), " ", r.operation as String, " (preparation ", r.id as String, ": ", join(map(r.previous_hosts, h => h as String), ","), " -> ", join(map(r.next_hosts, h => h as String), ","), ")"], "")
 }
 
 fn preparation_with_state(r: PlacementPreparationRecord, state: PreparationState) -> PlacementPreparationRecord {
@@ -557,7 +647,7 @@ fn hosts_decode_allowing_empty(doc: JsonValue, prefix: String) -> List<HostIdent
 }
 
 fn preparation_ref_members(r: PlacementPreparationRef) -> List<JsonKeyValue> {
-  [kv(prefix: "", key: "prep_id", value: r.id as String), kv(prefix: "", key: "prep_group", value: fabric_group_wire(g: r.group) as String), hosts_member(prefix: "prep_previous_", hs: r.previous_hosts), hosts_member(prefix: "prep_next_", hs: r.next_hosts), kv(prefix: "", key: "prep_operation", value: r.operation as String)]
+  [kv(prefix: "", key: "prep_id", value: r.id as String), kv(prefix: "", key: "prep_group", value: recorded_group_wire(r: r.group)), hosts_member(prefix: "prep_previous_", hs: r.previous_hosts), hosts_member(prefix: "prep_next_", hs: r.next_hosts), kv(prefix: "", key: "prep_operation", value: r.operation as String)]
 }
 
 fn preparation_ref_decode(doc: JsonValue) -> PlacementPreparationRef? {
@@ -567,7 +657,7 @@ fn preparation_ref_decode(doc: JsonValue) -> PlacementPreparationRef? {
       match member_string(doc: doc, key: "prep_group") {
         Absent => none
         Present { value: gw } =>
-          match parse_fabric_group(wire: gw) {
+          match parse_recorded_group(wire: gw) {
             Absent => none
             Present { value: g } =>
               match hosts_decode_allowing_empty(doc: doc, prefix: "prep_previous_") {
@@ -651,7 +741,7 @@ fn pair_authority_event_members(e: PairAuthorityEvent) -> List<JsonKeyValue> {
     HostEffectReleased { admitted_by: a, evidence: ev, provenance: pv } =>
       concat([kv(prefix: "", key: "admitted_by", value: a as String)], concat(quiescence_evidence_members(e: ev), release_provenance_members(p: pv)))
     PlacementPrepared { operation: o, group: g, previous_hosts: ph, next_hosts: nh } =>
-      [kv(prefix: "", key: "operation", value: o as String), kv(prefix: "", key: "group", value: fabric_group_wire(g: g) as String), hosts_member(prefix: "previous_", hs: ph), hosts_member(prefix: "next_", hs: nh)]
+      [kv(prefix: "", key: "operation", value: o as String), kv(prefix: "", key: "group", value: recorded_group_wire(r: g)), hosts_member(prefix: "previous_", hs: ph), hosts_member(prefix: "next_", hs: nh)]
     PlacementAppendClaimed { preparation: pr, intent: i } =>
       concat([kv(prefix: "", key: "preparation", value: pr as String)], write_intent_members(i: i))
     PlacementFinalized { preparation: pr, authority_event: ae } =>
@@ -861,7 +951,7 @@ fn optional_hash_member(doc: JsonValue, key: String) -> OptionalHashMember {
 // nor its group present is "no previous state"; either present without a whole authority is
 // incoherent.
 type PreviousAuthorityMember
-  = PreviousAuthorityDecoded { previous: PairServingGroupAuthority? }
+  = PreviousAuthorityDecoded { previous: RecordedAuthority? }
   | PreviousAuthorityIncoherent
 
 fn previous_authority_member(doc: JsonValue) -> PreviousAuthorityMember {
@@ -870,7 +960,7 @@ fn previous_authority_member(doc: JsonValue) -> PreviousAuthorityMember {
   if !named {
     PreviousAuthorityDecoded { previous: none }
   } else {
-    match authority_decode(doc: doc, prefix: "intent_prev_") {
+    match recorded_authority_decode(doc: doc, prefix: "intent_prev_") {
       Absent => PreviousAuthorityIncoherent
       Present { value: p } => PreviousAuthorityDecoded { previous: Present { value: p } }
     }
@@ -881,7 +971,7 @@ fn write_intent_decode(doc: JsonValue) -> AuthorityWriteIntent? {
   match member_string(doc: doc, key: "intent_group") {
     Absent => none
     Present { value: gw } =>
-      match parse_fabric_group(wire: gw) {
+      match parse_recorded_group(wire: gw) {
         Absent => none
         Present { value: g } =>
           match member_string(doc: doc, key: "intent_head") {
@@ -896,7 +986,7 @@ fn write_intent_decode(doc: JsonValue) -> AuthorityWriteIntent? {
                       match previous_authority_member(doc: doc) {
                         PreviousAuthorityIncoherent => none
                         PreviousAuthorityDecoded { previous: p } =>
-                          match authority_decode(doc: doc, prefix: "intent_next_") {
+                          match recorded_authority_decode(doc: doc, prefix: "intent_next_") {
                             Absent => none
                             Present { value: n } =>
                               match optional_hash_member(doc: doc, key: "lifecycle") {
@@ -929,7 +1019,7 @@ fn pair_authority_kind_decode(doc: JsonValue, word: String) -> PairAuthorityEven
         match member_string(doc: doc, key: "group") {
           Absent => none
           Present { value: gw } =>
-            match parse_fabric_group(wire: gw) {
+            match parse_recorded_group(wire: gw) {
               Absent => none
               Present { value: g } =>
                 match hosts_decode_allowing_empty(doc: doc, prefix: "previous_") {
@@ -1227,9 +1317,48 @@ fn establishment_operation(group: FabricGroup) -> NonEmptyStr {
 
 // The authority event's copy of its preparation must be THIS partition's group, over exactly the
 // populations the event leaves and enters, under this event's operation.
+// A RETIRED RECORD IS HISTORY, NOT A PROPOSAL: its admission was judged when it was written, and the
+// live-group checks (pending in the same group, the group's live commitment) have no live group to
+// read. So the fold keeps a retired preparation or claim as written and requires only that a claim's
+// intent and its preparation name the same retired group.
+fn recorded_preparation_ref_refusal(carried: PlacementPreparationRef, group: RecordedFabricGroup, previous: List<HostIdentity>, next: List<HostIdentity>, operation: NonEmptyStr) -> String? {
+  match group {
+    RecordedLiveGroup { group: g } => preparation_ref_refusal(carried: carried, group: g, previous: previous, next: next, operation: operation)
+    RecordedRetiredGroupA =>
+      if same_recorded(a: carried.group, b: group) { none }
+      else { Present { value: join(["the claim's intent is for the retired group-a but preparation ", carried.id as String, " belongs to ", recorded_group_wire(r: carried.group)], "") } }
+  }
+}
+
+// A CLAIM'S INTENT AGAINST ITS PREPARATION, over recorded groups and recorded states. A retired intent is
+// history of a retired preparation; a live intent must carry live states (a live group naming a retired
+// state is incoherent and refuses) and is checked exactly as before.
+fn recorded_intent_ref_refusal(carried: PlacementPreparationRef, i: AuthorityWriteIntent) -> String? {
+  match i.group {
+    RecordedRetiredGroupA => recorded_preparation_ref_refusal(carried: carried, group: RecordedRetiredGroupA, previous: [] as List<HostIdentity>, next: [] as List<HostIdentity>, operation: i.operation)
+    RecordedLiveGroup { group: g } =>
+      match i.next {
+        RecordedRetiredGroupAAuthority { state: _ } => Present { value: "a live group's intent names a retired group-a state" }
+        RecordedLiveAuthority { authority: n } =>
+          match i.previous {
+            Absent => preparation_ref_refusal(carried: carried, group: g, previous: [] as List<HostIdentity>, next: committed_population(a: n), operation: i.operation)
+            Present { value: RecordedRetiredGroupAAuthority { state: _ } } => Present { value: "a live group's intent names a retired group-a previous state" }
+            Present { value: RecordedLiveAuthority { authority: p } } => preparation_ref_refusal(carried: carried, group: g, previous: committed_population(a: p), next: committed_population(a: n), operation: i.operation)
+          }
+      }
+  }
+}
+
+fn recorded_preparation_refusal(effects: List<HostEffectRecord>, preps: List<PlacementPreparationRecord>, group: RecordedFabricGroup, previous_hosts: List<HostIdentity>, next_hosts: List<HostIdentity>, at: EpochSecs) -> String? {
+  match group {
+    RecordedLiveGroup { group: g } => preparation_refusal(effects: effects, preps: preps, group: g, previous_hosts: previous_hosts, next_hosts: next_hosts, at: at)
+    RecordedRetiredGroupA => none
+  }
+}
+
 fn preparation_ref_refusal(carried: PlacementPreparationRef, group: FabricGroup, previous: List<HostIdentity>, next: List<HostIdentity>, operation: NonEmptyStr) -> String? {
-  if !same_group(a: carried.group, b: group) {
-    Present { value: join(["the event's preparation ", carried.id as String, " belongs to ", fabric_group_wire(g: carried.group) as String, ", not this partition's group"], "") }
+  if !recorded_is(r: carried.group, g: group) {
+    Present { value: join(["the event's preparation ", carried.id as String, " belongs to ", recorded_group_wire(r: carried.group), ", not this partition's group"], "") }
   } else if !same_host_set(a: carried.previous_hosts, b: previous) {
     Present { value: join(["the event's preparation ", carried.id as String, " leaves a population that is not the state's: ", join(map(carried.previous_hosts, h => h as String), ","), " vs ", join(map(previous, h => h as String), ",")], "") }
   } else if !same_host_set(a: carried.next_hosts, b: next) {
@@ -1381,7 +1510,7 @@ fn placement_fold_step(acc: PlacementFold, env: ChainEnvelope<PairAuthorityEvent
             other => PlacementFoldRefused { at_event: env.id, reason: join(["a host effect release is refused: ", release_refusal_reason(a: other, claim: a)], "") }
           }
         PlacementPrepared { operation: o, group: g, previous_hosts: ph, next_hosts: nh } =>
-          match preparation_refusal(effects: effs, preps: preps, group: g, previous_hosts: ph, next_hosts: nh, at: env.event.recorded_at) {
+          match recorded_preparation_refusal(effects: effs, preps: preps, group: g, previous_hosts: ph, next_hosts: nh, at: env.event.recorded_at) {
             Present { value: why } => PlacementFoldRefused { at_event: env.id, reason: join(["a preparation is refused: ", why], "") }
             Absent => PlacementFolded { effects: effs, preparations: concat(preps, [PlacementPreparationRecord { id: env.id, operation: o, group: g, previous_hosts: ph, next_hosts: nh, recorded_at: env.event.recorded_at, prepared_by: env.event.actor, state: Prepared }]) }
           }
@@ -1395,7 +1524,7 @@ fn placement_fold_step(acc: PlacementFold, env: ChainEnvelope<PairAuthorityEvent
               match r {
                 Absent => PlacementFoldRefused { at_event: env.id, reason: join(["an append claim names no Prepared preparation ", pr as String], "") }
                 Present { value: record } =>
-                  match preparation_ref_refusal(carried: preparation_ref_of(r: record), group: i.group, previous: intent_previous_population(i: i), next: committed_population(a: i.next), operation: i.operation) {
+                  match recorded_intent_ref_refusal(carried: preparation_ref_of(r: record), i: i) {
                     Present { value: why } => PlacementFoldRefused { at_event: env.id, reason: join(["an append claim's intent is not the write its preparation is for: ", why], "") }
                     Absent => PlacementFolded { effects: effs, preparations: map(preps, x => if (x.id as String) == (pr as String) { preparation_with_state(r: x, state: AppendClaimed { claimant: i.actor, expected_head: i.expected_head, intent: i }) } else { x }) }
                   }
@@ -1447,7 +1576,7 @@ fn placement_fold_step(acc: PlacementFold, env: ChainEnvelope<PairAuthorityEvent
 fn preparation_refusal(effects: List<HostEffectRecord>, preps: List<PlacementPreparationRecord>, group: FabricGroup, previous_hosts: List<HostIdentity>, next_hosts: List<HostIdentity>, at: EpochSecs) -> String? {
   let union = hosts_union(a: previous_hosts, b: next_hosts)
   let fenced = live_host_effects_on(records: effects, hosts: union, at: at)
-  let pending = filter(preps, r => same_group(a: r.group, b: group) && preparation_is_pending(r: r))
+  let pending = filter(preps, r => recorded_is(r: r.group, g: group) && preparation_is_pending(r: r))
   if length(pending) != 0 {
     Present { value: join([fabric_group_wire(g: group) as String, " has a pending preparation; one saga at a time: ", join(map(pending, r => preparation_line(r: r)), "; ")], "") }
   } else if !same_host_set(a: previous_hosts, b: group_live_commitment(preps: preps, group: group)) {
@@ -1616,7 +1745,7 @@ type PlacementRead
 // event looked up on its group's chain -- it must exist and carry the record's copy. A
 // finalization naming an event that is not there, or one carrying another copy, is unread.
 fn placement_read(store: FabricStorageBinding) -> PlacementRead {
-  placement_read_over(placement: placement_fold_read(store: store), groups: map([FabricGroupA, FabricGroupB], g => GroupSnapshot { group: g, partition: read_group_partition(store: store, group: g) }))
+  placement_read_over(placement: placement_fold_read(store: store), groups: map([FabricGroupB {}], g => GroupSnapshot { group: g, partition: read_group_partition(store: store, group: g) }))
 }
 
 // ONE READ PER PARTITION, THEN PURE JOINS. A consumer that needs the authority of every group AND
@@ -1643,7 +1772,7 @@ fn placement_read_over(placement: PlacementRead, groups: List<GroupSnapshot>) ->
 // the fold's word, never a raw event's presence: an event the fold refuses (a cancelled or
 // twice-consumed preparation, a wrong previous state, a bad grant) discharges nothing.
 fn finalization_gaps(group: FabricGroup, partition: GroupPartitionRead, preps: List<PlacementPreparationRecord>) -> List<String> {
-  let finalized = filter(preps, r => same_group(a: r.group, b: group) && (match r.state { Finalized { authority_event: _, finalized_by: _, intent: _ } => true  Prepared => false  AppendClaimed { claimant: _, expected_head: _, intent: _ } => false  Aborted => false }))
+  let finalized = filter(preps, r => recorded_is(r: r.group, g: group) && (match r.state { Finalized { authority_event: _, finalized_by: _, intent: _ } => true  Prepared => false  AppendClaimed { claimant: _, expected_head: _, intent: _ } => false  Aborted => false }))
   if length(finalized) == 0 { [] as List<String> } else {
     match partition {
       GroupPartitionUnread { step: st, reason: why } => [join([fabric_group_wire(g: group) as String, "'s chain could not be read at ", st, ": ", why], "")]
@@ -1732,7 +1861,7 @@ fn placement_prepare_at(store: FabricStorageBinding, read: PlacementRead, group:
       match preparation_refusal(effects: effs, preps: preps, group: group, previous_hosts: previous_hosts, next_hosts: next_hosts, at: at) {
         Present { value: why } => PlacementPreparationRefused { step: "host-effects", reason: why }
         Absent =>
-          match placement_append(store: store, head: head, payload: PlacementPrepared { operation: operation, group: group, previous_hosts: previous_hosts, next_hosts: next_hosts }, actor: actor, at: at) {
+          match placement_append(store: store, head: head, payload: PlacementPrepared { operation: operation, group: recorded_group(g: group), previous_hosts: previous_hosts, next_hosts: next_hosts }, actor: actor, at: at) {
             EventAppended { id: h } => PlacementPreparedAt { id: h }
             EventAppendStale { expected: _, observed: _ } => PlacementPreparationStale
             EventAppendRefused { cause: c } => PlacementPreparationRefused { step: "store", reason: event_log_refusal_wire(cause: c) }
@@ -1753,10 +1882,6 @@ type PlacementAppendClaim
   | PlacementAppendClaimRefused { step: String, reason: String }
 
 // The population an intent leaves: none before the establishment.
-fn intent_previous_population(i: AuthorityWriteIntent) -> List<HostIdentity> {
-  match i.previous { Absent => [] as List<HostIdentity>  Present { value: p } => committed_population(a: p) }
-}
-
 // THE CLAIM IS ITS INTENT: the claimant is the intent's actor (the event is written by it) and the
 // head it will CAS against is the intent's; the fold keeps them on the record as the intent says.
 fn placement_claim_append(store: FabricStorageBinding, preparation: EventId, intent: AuthorityWriteIntent, at: EpochSecs) -> PlacementAppendClaim {
@@ -1799,11 +1924,14 @@ fn preparation_consumption(store: FabricStorageBinding, preparation: EventId) ->
         Absent => PreparationAbsent
         Present { value: r } => {
           let ref = preparation_ref_of(r: r)
-          match read_group_partition(store: store, group: r.group) {
+          match r.group {
+            RecordedRetiredGroupA => PreparationConsumptionUnread { step: "retired", reason: join(["preparation ", preparation as String, " belongs to the retired group-a: its partition is history, and no consumption is read for it"], "") }
+            RecordedLiveGroup { group: lg } =>
+            match read_group_partition(store: store, group: lg) {
             GroupPartitionUnread { step: st, reason: why } => PreparationConsumptionUnread { step: st, reason: why }
             GroupPartitionAt { head: ghead, fold: f } =>
               match f {
-                AuthorityFoldRefused { at_event: e, reason: why } => PreparationConsumptionUnread { step: "fold", reason: join([fabric_group_wire(g: r.group) as String, ": ", fold_refusal_text(at_event: e, reason: why)], "") }
+                AuthorityFoldRefused { at_event: e, reason: why } => PreparationConsumptionUnread { step: "fold", reason: join([recorded_group_wire(r: r.group), ": ", fold_refusal_text(at_event: e, reason: why)], "") }
                 AuthorityUnestablished { cancelled: xs } => PreparationNotConsumed { record: r, group_head: ghead, cancelled: any(xs, c => (c.preparation as String) == (preparation as String)) }
                 AuthorityFolded { preparations_consumed: pcs, cancelled: xs } =>
                   match first(filter(pcs, c => (c.preparation.id as String) == (preparation as String))) {
@@ -1821,6 +1949,7 @@ fn preparation_consumption(store: FabricStorageBinding, preparation: EventId) ->
                   }
               }
           }
+          }
         }
       }
   }
@@ -1885,11 +2014,15 @@ fn placement_abort_attempt(store: FabricStorageBinding, read: PlacementRead, pre
             if attempts_left <= 0 {
               PlacementCleanupStillFencing { preparation: preparation, cause: "the group head kept moving while the claimed append was being cancelled; re-decide from a fresh read" }
             } else {
-              match cancel_claimed_append(store: store, group: rec.group, head: ghead, preparation: preparation, provenance: provenance, actor: actor, at: at) {
+              match rec.group {
+                RecordedRetiredGroupA => PlacementCleanupStillFencing { preparation: preparation, cause: "the preparation belongs to the retired group-a; its group partition is history and no cancellation is written to it" }
+                RecordedLiveGroup { group: lg } =>
+                match cancel_claimed_append(store: store, group: lg, head: ghead, preparation: preparation, provenance: provenance, actor: actor, at: at) {
                 CancellationRefused { cause: c } => PlacementCleanupStillFencing { preparation: preparation, cause: c }
                 CancellationLanded { id: _ } => placement_abort_attempt(store: store, read: read, preparation: preparation, reason: reason, provenance: provenance, actor: actor, at: at, attempts_left: attempts_left - 1)
                 CancellationStale => placement_abort_attempt(store: store, read: read, preparation: preparation, reason: reason, provenance: provenance, actor: actor, at: at, attempts_left: attempts_left - 1)
               }
+              }
             }
           } else {
             placement_abort_append(store: store, read: read, preparation: preparation, reason: reason, provenance: provenance, actor: actor, at: at)
@@ -1955,30 +2088,6 @@ fn placement_abort(store: FabricStorageBinding, preparation: EventId, reason: St
   placement_abort_at(store: store, read: placement_read(store: store), preparation: preparation, reason: reason, provenance: provenance, actor: actor, at: at)
 }
 
-// A GROUP'S PENDING PREPARATION, REPAIRED WHERE THE JOIN ALLOWS: none pending is nothing to do;
-// a pending one an authority event consumed is finalized (a saga that died after its group
-// append); a pending one no authority event consumed is left for the operator's abort -- this
-// caller cannot know the claimant's standing -- and reported as still fencing. A transaction
-// that resumes on a group calls this before its own saga, because one saga is pending at a time.
-fn placement_repair_pending(store: FabricStorageBinding, group: FabricGroup, actor: NonEmptyStr, at: EpochSecs) -> PlacementCleanup? {
-  match placement_fold_read(store: store) {
-    PlacementUnread { step: st, reason: why } => Present { value: PlacementCleanupUnread { cause: join(["the placement partition could not be read at ", st, ": ", why], "") } }
-    PlacementReadAt { head: _, effects: _, preparations: preps } =>
-      match first(filter(preps, r => same_group(a: r.group, b: group) && preparation_is_pending(r: r))) {
-        Absent => none
-        Present { value: r } => {
-          let consumed = preparation_consumption(store: store, preparation: r.id)
-          match consumed {
-            PreparationConsumedBy { preparation: _, authority_event: _, state: _ } => Present { value: placement_finalize(store: store, consumed: consumed, actor: actor, at: at) }
-            PreparationNotConsumed { record: _, group_head: _, cancelled: _ } => Present { value: PlacementCleanupStillFencing { preparation: r.id, cause: join(["preparation ", r.id as String, " (", preparation_line(r: r), ") is pending and no authority event consumed it; an operator aborts it with host_placement_abort_wet"], "") } }
-            PreparationAbsent => Present { value: PlacementCleanupStillFencing { preparation: r.id, cause: "the pending preparation vanished between two reads" } }
-            PreparationConsumptionUnread { step: st, reason: why } => Present { value: PlacementCleanupStillFencing { preparation: r.id, cause: join(["the join could not be read at ", st, ": ", why], "") } }
-          }
-        }
-      }
-  }
-}
-
 fn placement_cleanup_line(c: PlacementCleanup) -> String {
   match c {
     PlacementFinalizedAt { preparation: p, id: _ } => join(["placement finalized (preparation ", p as String, ")"], "")
@@ -2281,34 +2390,6 @@ fn authority_transition_append(store: FabricStorageBinding, group: FabricGroup,
   event_log_append_with(store: store, partition: pair_authority_partition(group: group), event: event, expected: head, encode: fn(e) { pair_authority_event_wire_text(event: e) })
 }
 
-// RECORD THE ENTRY STATE: the receipt's bytes appended as their own event, against the head the
-// caller observed, so a concurrent writer is a stale refusal and never a receipt attributed to
-// the wrong state. The id returned is the store's content address of the bytes; the settling
-// transition names it, and a reader fetches the bytes by it from the store.
-type EntryStateRecord
-  = EntryStateRecordedAt { id: EventId }
-  | EntryStateRecordStale { observed: HeadExpectation }
-  | EntryStateRecordRefused { step: String, reason: String }
-
-fn pair_serving_authority_record_entry_state(store: FabricStorageBinding, group: FabricGroup, expected_head: HeadExpectation, transaction: NonEmptyStr, body: String, actor: NonEmptyStr, at: EpochSecs) -> EntryStateRecord {
-  let parent = match expected_head {
-    HeadAbsent => none
-    HeadAt { id: h } => Present { value: h }
-  }
-  let event = ChainEvent {
-    partition: pair_authority_partition(group: group),
-    parent: parent,
-    recorded_at: at,
-    actor: actor,
-    payload: EntryStateRecorded { transaction: transaction, body: body },
-  }
-  match event_log_append_with(store: store, partition: pair_authority_partition(group: group), event: event, expected: expected_head, encode: fn(e) { pair_authority_event_wire_text(event: e) }) {
-    EventAppended { id: h } => EntryStateRecordedAt { id: h }
-    EventAppendStale { expected: _, observed: o } => EntryStateRecordStale { observed: o }
-    EventAppendRefused { cause: c } => EntryStateRecordRefused { step: "store", reason: event_log_refusal_wire(cause: c) }
-  }
-}
-
 data current_authority_unread_marker: String = " authority unread at "
 
 fn current_authority_wire(c: CurrentAuthority) -> String {
diff --git a/dag/gunbc/spark/pair_serving_capacity_floor.dag b/dag/gunbc/spark/pair_serving_capacity_floor.dag
deleted file mode 100644
index a954e7e3449..00000000000
--- a/dag/gunbc/spark/pair_serving_capacity_floor.dag
+++ /dev/null
@@ -1,225 +0,0 @@
-module gunbc.spark.pair_serving_capacity_floor
-
-import std.types { Bool, String, Int, NonEmptyStr, List }
-import std.optional { Present, Absent }
-import std.nat { Nat }
-import std.measure { TokenCount, token_count, AllocatorBlockCount, allocator_block_count, allocator_block_count_value }
-import gunbc.spark.vllm_serving_launch { VllmServingLaunch, launch_wire }
-import gunbc.spark.vllm_kv_layout_observe {
-  VllmKvLayoutReceipt, KvLayoutObserved, KvLayoutUnreadable, KvLayoutInconsistent,
-}
-import gunbc.spark.pair_serving_launch_receipt {
-  ServingStanding, ServingOnFirstAttempt, ServingRecoveredAfterFailures, NotServing, ServingStandingUnobserved,
-}
-import extdeps.vllm.kv_layout {
-  ResolvedKvLayout, AdmissionCost, AdmissionCostBlocks, AdmissionCostUnestablished, cold_admission_blocks,
-}
-import gunbc.spark.serving_capacity_intent {
-  ServingCapacityIntentAdmission, uniform_cold_seats,
-}
-import std.dissolution { DissolutionCondition, unbound_dissolution }
-import gunbc.harness.harness_seat { harness_interactive_quality_seats }
-
-// ── THE FLOOR IS DECLARED IN THE UNIT THE OPERATOR ACTUALLY WANTS ──────────────────────────────
-//
-// WHAT NOT TO DECLARE. "54 GiB of KV" and "three concurrent sessions" are the same requirement said
-// twice, and once both are written down they drift: a change to the sequence budget moves the second
-// and leaves the first standing, and nothing detects that the pair no longer describes one intent.
-// So exactly one is declared -- the operational one, because it is the one anybody can argue about --
-// and the blocks are DERIVED from it against the engine's own layout.
-//
-// AND THE SESSION COUNT IS NOT A SECOND NUMBER EITHER. It is the same policy constant the harness
-// hands out seats against (gunbc.harness.harness_seat harness_interactive_quality_seats). A fabric
-// whose floor said four while the harness seated one would be holding capacity nobody could use,
-// and one whose floor said two would be admitting a seat the fabric never promised. They are one
-// fact, so they are read from one place; when that constant's drop retires and the count becomes
-// derived, the floor follows without an edit here.
-type MinimumColdSessions {
-  maximum_sequence_tokens: TokenCount
-  sessions: Nat
-}
-
-// COLD, meaning no prefix-cache credit. A prospective cache hit is not capacity: it belongs to a
-// prefix whose blocks another request may release at any moment, and reserving against it would be
-// spending a discount that has not been granted.
-data spark_pair_serving_minimum_cold_sessions: MinimumColdSessions = MinimumColdSessions {
-  maximum_sequence_tokens: token_count(count: 500000),
-  sessions: harness_interactive_quality_seats,
-}
-
-// THE FLOOR'S UNIFORM SHAPE IS THE NATIVE INTENT'S SEAT POPULATION, and the projection lives here
-// because direction matters: this module already sits below the harness seat authority, and the
-// intent module cannot import upward through it without closing a cycle through the serving
-// enrollment chain back to the launch planner. The batched ceiling is a parameter because the
-// floor's block-grain question never asked for one; a caller deriving a native-arm intent from a
-// floor row supplies the batching policy its launch profile carries.
-fn minimum_cold_sessions_intent(
-  floor: MinimumColdSessions,
-  max_batched_tokens: TokenCount,
-) -> ServingCapacityIntentAdmission {
-  uniform_cold_seats(each: floor.maximum_sequence_tokens, seats: floor.sessions, max_batched_tokens: max_batched_tokens)
-}
-
-// ── CAPACITY IS A READINESS PROPERTY OF ONE INCARNATION ────────────────────────────────────────
-//
-// The blocks the floor requires are the per-request cost at the declared budget, times the declared
-// session count. Both come from the receipt's own layout, so a floor assessment is a statement about
-// THE ENGINE THE RECEIPT DESCRIBES and nothing else.
-type CapacityFloorStanding
-  = MeetsFloor { required_blocks: AllocatorBlockCount, available_blocks: AllocatorBlockCount }
-  | BelowFloor { required_blocks: AllocatorBlockCount, available_blocks: AllocatorBlockCount }
-  | FloorUnestablished { cause: NonEmptyStr }
-
-fn capacity_floor_standing(receipt: VllmKvLayoutReceipt, floor: MinimumColdSessions) -> CapacityFloorStanding {
-  match receipt {
-    KvLayoutUnreadable { launch: _, cause: c } =>
-      FloorUnestablished { cause: join(["the layout capture was unreadable: ", c as String], "") as NonEmptyStr }
-    KvLayoutInconsistent { launch: _, cause: c } =>
-      FloorUnestablished { cause: join(["the layout is inconsistent: ", c as String], "") as NonEmptyStr }
-    KvLayoutObserved { launch: _, layout: layout, reported: _, blocks_per_max_request: _, source_capture_digest: _ } =>
-      match cold_admission_blocks(layout: layout, sequence_budget: floor.maximum_sequence_tokens) {
-        AdmissionCostUnestablished { cause: c } => FloorUnestablished { cause: c }
-        AdmissionCostBlocks { blocks: per_request } => {
-          let required = allocator_block_count(count: allocator_block_count_value(c: per_request) * floor.sessions)
-          let available = layout.allocator_blocks
-          if allocator_block_count_value(c: required) > allocator_block_count_value(c: available) {
-            BelowFloor { required_blocks: required, available_blocks: available }
-          } else {
-            MeetsFloor { required_blocks: required, available_blocks: available }
-          }
-        }
-      }
-  }
-}
-
-// ── WITHDRAWAL IS THE FIRST MOVE, AND IT IS NOT A RESTART ──────────────────────────────────────
-//
-// "Below floor, therefore restart" is one step where there are two decisions, and collapsing them is
-// how a convergence run bounces a busy engine. Free memory on a unified-memory host is a moving
-// target: a restart taken because the pool came up small can come up smaller, and a loop that
-// restarts on every unfavourable reading will keep restarting while requests are in flight.
-//
-// So the first move is always the same and is always safe: STOP SENDING NEW WORK. Withdrawal costs
-// nothing, is instantly reversible, and is correct under every failing standing including the ones
-// where the capacity is merely unknown. Whether to then restart is a separate question with its own
-// preconditions, asked below.
-type AdmissionPosture
-  = Admitting { available_blocks: AllocatorBlockCount }
-  | Withdrawn { cause: NonEmptyStr }
-
-fn admission_posture(standing: CapacityFloorStanding) -> AdmissionPosture {
-  match standing {
-    MeetsFloor { required_blocks: _, available_blocks: a } => Admitting { available_blocks: a }
-    BelowFloor { required_blocks: r, available_blocks: a } =>
-      Withdrawn { cause: join(["the engine is below the declared floor: ", to_string(allocator_block_count_value(c: r)), " blocks required, ", to_string(allocator_block_count_value(c: a)), " available"], "") as NonEmptyStr }
-    FloorUnestablished { cause: c } =>
-      Withdrawn { cause: join(["the engine's capacity is unestablished, so it is withdrawn rather than assumed adequate: ", c as String], "") as NonEmptyStr }
-  }
-}
-
-// ── DRAIN ──────────────────────────────────────────────────────────────────────────────────────
-//
-// Withdrawal stops new work; it does not end the work already running. A restart taken over live
-// grants destroys them, and under the harness's quiescence release law the fabric cannot even tell
-// afterwards which seats were freed. Quiescence is therefore OBSERVED, never assumed from elapsed
-// time -- a deadline that passed says the lease may be reclaimed, not that the request stopped.
-type DrainStanding
-  = Quiesced
-  | GrantsOutstanding { count: Nat }
-  | DrainUnobserved { cause: NonEmptyStr }
-
-// ── RESTART IS ADMITTED, NOT TRIGGERED ─────────────────────────────────────────────────────────
-//
-// Five preconditions, and the fold names the FIRST unmet one so an operator reading a refusal learns
-// what to change rather than a list. Four of the five are decidable from facts this repository
-// already models. The fifth is not, and it refuses.
-//
-// THE UNIFIED-MEMORY ADMISSION IS THE MISSING ONE, and it is not an oversight. On a GB10 the KV pool
-// is a residual of a supply the host shares with the OS page cache, the model weights, the NCCL and
-// CUDA contexts and this deployment's own Ray object store; restarting without a plan over that
-// supply is what produced 23.6 GiB once and 54.01 GiB later from one unit text. Admitting a restart
-// while that plan is unmodelled would be promising an outcome nothing here can predict, so the
-// admission refuses and names the capability. That is the M4/M6 slice; when it lands, this arm is
-// replaced by a real precondition rather than deleted.
-type RestartPreconditionGap
-  = EngineStillAdmitting
-  | GrantsStillHeld { count: Nat }
-  | QuiescenceUnobserved { cause: NonEmptyStr }
-  | RetryAllowanceExhausted { used: Nat, allowance: Nat }
-  | UnifiedMemoryPlanUnmodelled
-
-fn restart_precondition_wire(g: RestartPreconditionGap) -> String {
-  match g {
-    EngineStillAdmitting => "the engine has not been withdrawn from new admission"
-    GrantsStillHeld { count: n } => join([to_string(n), " grant(s) are still outstanding against this incarnation"], "")
-    QuiescenceUnobserved { cause: c } => join(["quiescence was not observed: ", c as String], "")
-    RetryAllowanceExhausted { used: u, allowance: a } =>
-      join(["the bounded retry allowance is spent: ", to_string(u), " of ", to_string(a), " attempts used"], "")
-    UnifiedMemoryPlanUnmodelled =>
-      "no admitted unified-memory plan exists for this host, so the pool the restart would come up with is unpredictable; restarting on an unfavourable reading without one is what produced 23.6 GiB and 54.01 GiB from one unit text"
-  }
-}
-
-type RestartAdmission
-  = RestartAdmitted { next_attempt_number: Nat }
-  | RestartRefused { gap: RestartPreconditionGap }
-
-// The retry allowance is per CONVERGENCE RUN against one desired digest, not per unit lifetime: a
-// unit that is restarted once a week forever is healthy, and one restarted eight times in six
-// minutes is not, and only a run-scoped counter tells them apart.
-type RetryAllowance {
-  attempts_used: Nat
-  allowance: Nat
-}
-
-fn restart_admission(
-  posture: AdmissionPosture,
-  drain: DrainStanding,
-  retries: RetryAllowance,
-) -> RestartAdmission {
-  match posture {
-    Admitting { available_blocks: _ } => RestartRefused { gap: EngineStillAdmitting }
-    Withdrawn { cause: _ } =>
-      match drain {
-        GrantsOutstanding { count: n } => RestartRefused { gap: GrantsStillHeld { count: n } }
-        DrainUnobserved { cause: c } => RestartRefused { gap: QuiescenceUnobserved { cause: c } }
-        Quiesced =>
-          if retries.attempts_used >= retries.allowance {
-            RestartRefused { gap: RetryAllowanceExhausted { used: retries.attempts_used, allowance: retries.allowance } }
-          } else {
-            RestartRefused { gap: UnifiedMemoryPlanUnmodelled }
-          }
-      }
-  }
-}
-
-// ── RE-ADMISSION IS EARNED BY A FRESH RECEIPT, NOT BY THE RESTART HAVING HAPPENED ──────────────
-//
-// The loop closes here. A restart that completed proves a process started; it proves nothing about
-// the pool it came up with, and on this hardware that is exactly the thing that varies. So the new
-// incarnation is re-admitted only against a receipt of its OWN, assessed against the same floor --
-// and a receipt describing the incarnation that was just replaced does not count, which is why the
-// fresh receipt is joined rather than assumed.
-type ReAdmission
-  = ReAdmitted { launch: VllmServingLaunch, available_blocks: AllocatorBlockCount }
-  | ReAdmissionRefused { cause: NonEmptyStr }
-
-fn re_admit(fresh: VllmKvLayoutReceipt, floor: MinimumColdSessions) -> ReAdmission {
-  match capacity_floor_standing(receipt: fresh, floor: floor) {
-    MeetsFloor { required_blocks: _, available_blocks: a } =>
-      match fresh {
-        KvLayoutObserved { launch: i, layout: _, reported: _, blocks_per_max_request: _, source_capture_digest: _ } =>
-          ReAdmitted { launch: i, available_blocks: a }
-        KvLayoutUnreadable { launch: _, cause: c } => ReAdmissionRefused { cause: c }
-        KvLayoutInconsistent { launch: _, cause: c } => ReAdmissionRefused { cause: c }
-      }
-    BelowFloor { required_blocks: r, available_blocks: a } =>
-      ReAdmissionRefused {
-        cause: join(["the restarted engine is still below the floor: ", to_string(allocator_block_count_value(c: r)), " blocks required, ", to_string(allocator_block_count_value(c: a)), " available"], "") as NonEmptyStr,
-      }
-    FloorUnestablished { cause: c } =>
-      ReAdmissionRefused { cause: join(["the restarted engine's capacity is unestablished, so it is not re-admitted: ", c as String], "") as NonEmptyStr }
-  }
-}
-
-data restart_admission_apply_frontier: DissolutionCondition = unbound_dissolution(description: "TRIGGER: pair_serving_apply (or the convergence fold that replaces it) constructs DrainStanding from the seat-partition head and RetryAllowance from the run, then calls restart_admission before any restart argv. SUFFICIENT FOR: a restart is unreachable unless restart_admission returned RestartAdmitted, which today has no constructor from the fold because UnifiedMemoryPlanUnmodelled is still the last arm — M4/M6 replaces that arm, it does not delete this frontier." as NonEmptyStr)
diff --git a/dag/gunbc/spark/pair_serving_d0.dag b/dag/gunbc/spark/pair_serving_d0.dag
deleted file mode 100644
index dac6c25a0ff..00000000000
--- a/dag/gunbc/spark/pair_serving_d0.dag
+++ /dev/null
@@ -1,2113 +0,0 @@
-module gunbc.spark.pair_serving_d0
-
-import gunbc.auth.standing_operator_grant { StandingOperatorGrant, group_a_dev_standing_grant, standing_grant_covers, StandingD0ReleaseToFleet, StandingGrantFabricGroup }
-import std.types { String, Bool, Int, NonEmptyStr, List, EpochSecs, Port, Timestamp }
-import std.nat { Nat }
-import std.measure { Second, second, second_count }
-import std.optional { Present, Absent }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import std.resources { Network }
-import std.list { list_cover }
-import std.content_hash { ContentHash, content_hash_of_value, serialize_content_hash, content_hash_equal, parse_content_hash }
-import std.temporal_effect { HeldLease, LeaseEpoch, held_lease, LeaseRunningExpected }
-import std.scoped_authorization {
-  OperatorGrant, ScopedAuthorization, AuthorizationGranted, AuthorizationPending, AuthorizationDenied, AuthorizationRequest, AuthorizationScope, AttemptIdentity, AuthorizedAction,
-  AuthorizationPermitted, AuthorizationRefused, AuthorizationRefusalCause, AuthorizationEscalationMismatch, authorize, authorization_scopes_render, authorization_refusal_reason,
-  intent_frame_head, parse_intent_scopes, authorization_scope_eq,
-  AuthorizationClaimState, Unclaimed, ClaimedBy, CompletedBy, AbortedBy, claim_authorization, claim_transition_claimed, claim_transition_completed, claim_transition_aborted,
-  AuthorizationClaimOutcome, ClaimHeld, ClaimLost, ClaimUndecided, authorization_claim_outcome, authorization_claim_key, parse_authorization_claim_state,
-}
-import std.durable_compare_and_set {
-  CasGeneration, ExpectSlotAbsent, ExpectSlotGeneration, CasCommitted, CasPreconditionFailed, CasStoreRefused,
-  CasObservedReadable, CasObservedUnreadable, CasReadableAbsent, CasReadablePresent, cas_generation_count, cas_unreadable_slot_detail,
-}
-import gunbc.durable_cas_file_store {
-  CasAttemptAdmitted, CasAttemptDigestMismatch, CasAttemptDigestIncomparable, CasAttemptKeyNotSlotAddressable, admit_cas_attempt,
-  admit_cas_attempt_for_derived_payload, DerivedPayloadAdmitted, DerivedPayloadKeyNotSlotAddressable,
-}
-import gunbc.durable_cas_fabric_storage { fabric_storage_compare_and_set, fabric_storage_observe_cas_slot }
-import extdeps.tools.sha256sum { Sha256FileDigest, Sha256FileDigestUnavailable, sha256sum_stdin_digest_via_shell }
-import extdeps.crypto.hash { sha256_digest_content_hash }
-import std.effect_grant { Write, NamespacePosition, CodeNameTree }
-import product.capacity.lease { LeaseGrant, LeasePolicy, ReleaseLaw, QuiescenceRequired, lease_grant, lease_fence_of }
-import product.capacity.event_chain { EventId, HeadExpectation, HeadAbsent, HeadAt }
-import product.host_identity { HostIdentity, host_identity_eq }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fabric_event_log_host { HostStoreResolved, HostStoreRefused, event_log_store_for_host, now_epoch_seconds }
-import gunbc.fabric_storage_client { FabricStorageBinding }
-import std.fabric_storage { FabricStoreRefused, fabric_storage_fault_wire }
-import gunbc.host_effect { FleetSsh }
-import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext }
-import gunbc.rung_drop { Standing, Retired, Superseded, TypedDeclaration, AuthoredProse, RungDropStanding }
-import gunbc.rung_drop.fabric_storage_append_principal_unrefused { fabric_storage_append_principal_unrefused }
-import gunbc.rung_drop.d0_store_walls_single_lifecycle { d0_store_walls_single_lifecycle }
-import gunbc.fleet_ssh_locus { fleet_locus_ssh_target, FleetSshContextReady, FleetSshContextRefused, prepare_fleet_ssh_agent_context }
-import gunbc.spark.fabric_reach { ExecutorReachKnown, ExecutorReachUnknown, observe_executor_reach }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB, fabric_group_wire, parse_fabric_group, fabric_group_hosts }
-import gunbc.serving.serving_enrollment { ServingRouteEndpoint, ServingRouteResolved, ServingRouteUnresolved, serving_route }
-import gunbc.harness.harness_backend { harness_bounded_get, harness_bounded_presence, HarnessResponded, HarnessConnectFailed, HarnessDeadline, HarnessTransportUnread, harness_metrics_url, harness_models_url, harness_launch_from_body }
-import gunbc.serving.serving_enrollment { serving_route_endpoint_wire }
-import gunbc.spark.vllm_endpoint_process_launch { LaunchObserved, LaunchUnobserved }
-import gunbc.spark.serving_incarnation_observe {
-  UnitOccupancy, UnitInstalled, UnitNotInstalled, UnitOccupancyUnread, IncarnationUnitPropertyUnread, read_unit_occupancy, serving_incarnation_refusal_text,
-  EndpointListenerReading, EndpointNoListener, EndpointListening, EndpointListenerUnread, read_endpoint_listener,
-  EngineProcessScan, EngineScanLegDidNotRun, EngineScanClassified, scan_engine_processes,
-}
-import extdeps.procps.pgrep { PgrepMatched, PgrepNoMatch, PgrepScanFailed }
-import extdeps.docker.images.sparkrun_vllm_ds4_gb10 { sparkrun_vllm_ds4_gb10_vllm_binary }
-import extdeps.linux.proc_net_tcp { TcpSocketRow }
-import std.algebra { trim }
-import gunbc.spark.vllm_serving_launch { DigestsAgree, DigestsDiffer, DigestsIncomparable, digests_agree }
-import gunbc.spark.pair_serving_desired { SparkPairServingUnitReady, SparkPairServingUnitRefused, spark_pair_serving_unit }
-import gunbc.spark.pair_serving_realization { spark_pair_head_unit_name, spark_pair_worker_unit_name }
-import gunbc.compute.host_occupancy { HostOccupancyReading, HostOccupancyRead, HostOccupancyUnread, read_host_occupancy, host_occupant_wire }
-import gunbc.spark.host_commitment { fleet_argv_run }
-import gunbc.spark.pair_incumbent_identity {
-  DeclaredPairRealization, DeclaredRankUnit, DeclaredPairRealizationStanding, DeclaredPairRealizationKeyed, DeclaredPairRealizationUnavailable, declared_pair_realization,
-  observe_pair_realization, PairRealizationAgreement, PairRealizationEstablished, PairRealizationDrifted, PairRealizationRankPopulationDiffers, PairRealizationConflict, PairRealizationDeclarationUnavailable, PairRealizationUnread, pair_realization_agreement, pair_realization_agreement_lines,
-}
-import gunbc.spark.released_baseline { ReleasedBaselineSpec, QuiescentReservedBaseline, released_baseline_wire, parse_released_baseline }
-import gunbc.spark.pair_serving_authority {
-  PairServingGroupAuthority, PairServingActive, SuspensionPendingReconciliation, SuspendedForAuthorizedSuccessor, FencedRefusal, ReleasedToFleet,
-  PairRealizationKeyed, PairRealizationIdentity,
-}
-import gunbc.spark.pair_serving_authority_log {
-  CurrentAuthority, CurrentAuthorityRead, CurrentAuthorityUnread, current_pair_serving_authority, authority_wire, same_group,
-  AuthorityTransitionRecord, transitions_by,
-  AuthorityTransition, AuthorityTransitionAppended, AuthorityTransitionStale, AuthorityTransitionRefused, pair_serving_authority_transition, pair_serving_authority_transition_at,
-  PlacementCleanup, PlacementFinalizedAt, PlacementAbortedAt, PlacementCleanupStillFencing, placement_cleanup_line, placement_repair_pending,
-  preparation_consumption, placement_finalize,
-  EntryStateRecord, EntryStateRecordedAt, EntryStateRecordStale, EntryStateRecordRefused, pair_serving_authority_record_entry_state,
-}
-
-// ── D0: TAKE THE CLAIM, RECONCILE THE OCCUPANCY, RECORD THE ENTRY STATE ─────────────────────────
-//
-// docs/plans/dsv41-cut-d-redesign.md §D0. The transfer is ATOMIC and lands in an intermediate
-// state that the readings happen INSIDE: PairServingActive moves to
-// SuspensionPendingReconciliation by one compare-and-set on the authority log
-// (gunbc.spark.pair_serving_authority_log), which disables the incumbent's apply and the
-// successor's launch at once; only then is the fleet read; and the answer moves the authority
-// again, to exactly one of SuspendedForAuthorizedSuccessor, PairServingActive or FencedRefusal.
-// An earlier draft observed first and transferred after, which left an interval in which the
-// observation could go stale and two lanes could each believe they held the hosts.
-//
-// THE QUESTIONS ARE ORDERED. First: is a serving incumbent ANSWERING on the enrolled front door?
-// If it is, this transaction is not the drain-and-preserve path and does not pretend to be: when
-// the answering realization agrees with the declared one on every rank
-// (gunbc.spark.pair_incumbent_identity PairRealizationEstablished) restoration is shown safe and
-// the authority returns to EXACTLY the Active state it held -- unchanged, and in particular NOT
-// upgraded to PairRealizationKeyed, because that agreement carries the running image as observed
-// and uncompared; the incumbent's key stays minted nowhere until the image axis is compared --
-// and when the answer is anything else the group is fenced for an operator. The only Keyed
-// realization D0 writes is the SUCCESSOR's, on the suspended authority, from the admitted grant's
-// keyed candidate. Second, with nothing answering and the head host quiet: does the unit
-// population on the four ranks reconcile with the declared realization? The head's declared unit
-// is read first -- ACTIVE is OccupancyNotQuiet, a listener the route did not reach, and it fences
-// as unidentified -- and with the head inactive, DeclaredOccupantDrifted (our units, not all
-// running or not all our bytes -- THE EXPECTED ANSWER on the readings the redesign records, and
-// the only reconciled answer, since the head was just read inactive) is eligible, the drift
-// recorded and never a restoration target; OccupancyUnread fences. There is no "observed
-// converged" answer here: a running declared occupant is the incumbent question's answer.
-//
-// WHAT THIS TRANSACTION READS AND WHAT IT DOES NOT, stated because the redesign's fourth answer is
-// not produced here. ForeignOccupantObserved -- a container, process or device allocation we do
-// not declare -- needs a reading of the ranks BEYOND our unit, and this transaction reads only
-// the declared unit's fragment, bytes and activity. So a rank with no pair unit installed cannot
-// be told apart from a rank held by something foreign, and it is reported OccupancyUnread with
-// exactly that cause -- which fences, the disposition foreign occupancy would have reached. Nothing
-// is fabricated; the frontier is the container and device reading, and it is named on the arm.
-//
-// THE ENTRY STATE IS EVIDENCE, NOT A TARGET. The receipt records what was read per rank -- the
-// route's answer, each rank's unit occupancy -- and is total: an unread rank carries its cause
-// rather than forcing a fabricated field. Memory used and free, absence of a serving process
-// beyond the unit, and free disk are named by the redesign and are NOT read here; the receipt
-// says what it holds and a later reader may not infer the rest.
-//
-// THE RECEIPT IS RECORDED ON THE LOG BEFORE THE SETTLING WRITE, AND THE WRITE NAMES IT. The
-// entry-state receipt is rendered and appended to the authority partition as its own event before
-// the second compare-and-set, and that set carries the event's content address -- so a receipt
-// that cannot be recorded refuses BEFORE the authority moves, and a later reader of the suspended
-// authority fetches the exact four-rank reading it was settled from by that id, from the store.
-// A local copy under target/ is a convenience derived from the id, and its failure changes nothing.
-//
-// THE TRANSACTION IS TOTAL OVER ITS CRASH POINTS. Consent is consumed by a claim on the fleet
-// event log BEFORE the first authority write, and the claim and the authority are two durable
-// facts a process can die between. A rerun therefore starts from a JOIN of the two histories
-// (d0_recovery): no claim means a fresh start; a claim held by this transaction with no transition
-// by it means the first write never landed and is performed now (or the claim aborted when the
-// authority is no longer Active); a pending state under this transaction resumes from the
-// readings; a settling transition by this transaction means only the claim's terminal is owed,
-// which is written with no authority write; and a claim held by another attempt, or spent, refuses.
-// A rerun naming another transaction is refused at the pending state -- it is that transaction's.
-//
-// THE ENTRY IS NON-ADMITTING UNTIL THE AUTHORIZATION EXISTS, BY CONSTRUCTION. The dispatch
-// requires an exact, time-bounded operator authorization over the candidate key, this group's
-// EXACT HOST POPULATION, the cleanup baseline and the lease term (std.scoped_authorization
-// OperatorGrant over D0Subject), and a successor that is KEYED (Cut 0). The producer that joins an
-// escalation to such a grant is gunbc.spark.pair_serving_d0_authorization (the request over the
-// keyed successor, the frozen filing re-derived on a rerun, the recorded approval joined to this
-// transaction's held claim) consumed through gunbc.auth.approval_gate by the wet door
-// gunbc.spark.pair_serving_d0_door, which files, waits and dispatches; while the candidate is
-// unkeyed the request has no subject and the door refuses before its first write. The transaction
-// itself takes the grant as a value, which is how its real-execution witness drives the whole
-// two-write route with a fixture grant.
-//
-// TERMINAL: the authority is in exactly one of the three states, the receipt exists at the path
-// the event names, and no host state was altered. This transaction starts and stops nothing.
-
-// ── THE AUTHORIZATION ──────────────────────────────────────────────────────────────────────────
-//
-// What an operator authorizes D0 over: the group AND ITS EXACT HOSTS, the KEYED successor, the
-// cleanup baseline the hosts are owed afterwards, and the lease TERM the successor may start
-// under. The group word alone is not a subject: FabricGroupA's membership is derived from the
-// current lane observations and a later source change can move a host in or out while the wire
-// still says `group-a` -- so a grant over the word would act on a host the operator never saw.
-// The hosts are compared to the group's current population before the claim and before the
-// first write (d0_population), and a difference refuses.
-// The release law is NOT the operator's to choose: a pair-serving rank is a process resource with
-// no generation fence on its touches, so an expired holder's running engine is not rejected by
-// anything -- expiry removes the right to START, and capacity is free only once stale use is
-// observed quiescent. That is product.capacity.lease QuiescenceRequired, derived for every D0 grant.
-// ── WHAT THE OPERATOR AUTHORIZES THE TRANSACTION TO DO, AS ONE OF TWO OPERATIONS ─────────────────
-//
-// SUSPEND FOR A KEYED SUCCESSOR is the transaction as it was first built: the successor, the cleanup
-// baseline and the lease term. RELEASE TO THE FLEET (operator-approved 2026-10-03, relayed by
-// valiant-crab-775) is the second: the group's pair-serving authority leaves its commitment, so its
-// hosts are no longer fenced for host effects (gunbc.spark.pair_serving_authority
-// pair_serving_committed_hosts answers [] only for ReleasedToFleet) -- and it is settled through the
-// SAME claim, pending state, readings and saga as a suspension, landing on ReleasedToFleet instead of
-// SuspendedForAuthorizedSuccessor, and only when the readings show every host quiescent. A release
-// names its cause and the operator approval it rests on; both are part of the subject, so they are in
-// the intent the operator approves and in the frozen filing.
-type D0Operation
-  = D0SuspendForSuccessor { successor: ContentHash, cleanup: ReleasedBaselineSpec, term: Second }
-  | D0ReleaseToFleet { cause: NonEmptyStr, approval: NonEmptyStr }
-
-type D0Subject {
-  group: FabricGroup
-  hosts: List<HostIdentity>
-  operation: D0Operation
-}
-
-// The successor a subject names, when it is a suspension's; a release names none.
-fn d0_subject_successor(s: D0Subject) -> ContentHash? {
-  match s.operation {
-    D0SuspendForSuccessor { successor: succ, cleanup: _, term: _ } => Present { value: succ }
-    D0ReleaseToFleet { cause: _, approval: _ } => none
-  }
-}
-
-data pair_serving_release_law: ReleaseLaw = QuiescenceRequired
-
-fn d0_lease_policy(term: Second) -> LeasePolicy {
-  LeasePolicy { maximum_duration_seconds: second_count(s: term), release_law: pair_serving_release_law }
-}
-
-// THE POPULATION IS AN IDENTITY JOIN IN BOTH DIRECTIONS: every granted host is a current member
-// and every current member was granted, with no duplicate on either side. A count would let a
-// swap pass.
-type D0Population
-  = D0PopulationAgrees
-  | D0PopulationDiffers { granted: List<HostIdentity>, current: List<HostIdentity> }
-
-// `current` is SUPPLIED -- the entry passes fabric_group_hosts(group) -- so the join is one
-// interface over two host lists and its controls can drive a roster the source does not carry.
-fn d0_population(subject: D0Subject, current: List<HostIdentity>) -> D0Population {
-  if length(current) == length(subject.hosts)
-    && list_cover(held: current, expected: subject.hosts, eq: fn(a, b) { host_identity_eq(a: a, b: b) })
-    && list_cover(held: subject.hosts, expected: current, eq: fn(a, b) { host_identity_eq(a: a, b: b) }) {
-    D0PopulationAgrees
-  } else {
-    D0PopulationDiffers { granted: subject.hosts, current: current }
-  }
-}
-
-fn hosts_wire(hs: List<HostIdentity>) -> String {
-  join(sort_by(map(hs, h => h as String), fn(s) { s }), ",")
-}
-
-// THE OPERATION THE GRANT MUST COVER: a write over the pair-serving authority, action "suspend".
-// The scope is the enforcing fact (std.scoped_authorization): a grant over the same subject with
-// a read scope, or another action, does not authorize this transaction.
-data d0_authorized_action: AuthorizedAction = "suspend-pair-serving-authority" as AuthorizedAction
-
-fn d0_required_scope() -> AuthorizationScope {
-  AuthorizationScope { verb: Write, resource: NamespacePosition { tree: CodeNameTree, path: ["gunbc", "spark", "pair_serving_authority"] }, action: d0_authorized_action }
-}
-
-// THE RELEASE IS ITS OWN ACTION, so a grant for a suspension never authorizes a release, nor the
-// reverse: the scope is the enforcing fact.
-data d0_release_action: AuthorizedAction = "release-pair-serving-authority" as AuthorizedAction
-
-fn d0_release_scope() -> AuthorizationScope {
-  AuthorizationScope { verb: Write, resource: NamespacePosition { tree: CodeNameTree, path: ["gunbc", "spark", "pair_serving_authority"] }, action: d0_release_action }
-}
-
-fn d0_scope_of(op: D0Operation) -> AuthorizationScope {
-  match op {
-    D0SuspendForSuccessor { successor: _, cleanup: _, term: _ } => d0_required_scope()
-    D0ReleaseToFleet { cause: _, approval: _ } => d0_release_scope()
-  }
-}
-
-// THE SUSPENSION'S WIRE IS UNCHANGED BY THE SECOND OPERATION, byte for byte, so a filing frozen before
-// the release existed still round-trips. A release's free-text cause and approval reference sit on
-// their own lines after the subject line, since the subject line is split on spaces.
-fn d0_subject_wire(subject: D0Subject) -> String {
-  match subject.operation {
-    D0SuspendForSuccessor { successor: succ, cleanup: cl, term: t } =>
-      join([
-        "group=", fabric_group_wire(g: subject.group) as String,
-        " hosts=", hosts_wire(hs: subject.hosts),
-        " successor=", serialize_content_hash(hash: succ) as String,
-        " cleanup=", released_baseline_wire(s: cl) as String,
-        " term=", to_string(second_count(s: t)), "s",
-      ], "")
-    D0ReleaseToFleet { cause: c, approval: a } =>
-      join([
-        "group=", fabric_group_wire(g: subject.group) as String,
-        " hosts=", hosts_wire(hs: subject.hosts),
-        " operation=release-to-fleet",
-        "\ncause=", c as String,
-        "\napproval=", a as String,
-      ], "")
-  }
-}
-
-// THE INTENT IS THE EXACT OPERATION, AS A CRYPTOGRAPHIC IDENTITY OVER ONE CANONICAL ENCODING:
-// the required scope, the group, the hosts (sorted, so order is not identity), the keyed
-// successor, the cleanup, the term and the transaction. A grant whose intent was minted over
-// anything else does not authorize this run. SHA-256 rather than the structural fingerprint
-// content_hash_of_value mints (FNV-1a 64): the intent is the consent binding itself, and a
-// collision class there is the same defect the pending-state binding was moved off it for.
-// The digest is taken through the sha256sum realization, so it is an effect and can be
-// unavailable -- which is a refusal, never a substituted structural hash.
-data d0_intent_schema: String = "pair-serving-d0-intent/v2"
-
-// THE HEAD IS THE std.scoped_authorization INTENT FRAME: the schema line and the scope written by
-// the one scope codec, so a verifier holding this text and the approved revision reads the approved
-// scope with parse_intent_scopes and no knowledge of D0 (the fabric store door does exactly that).
-// A scope the codec cannot write has no frame, and then there is NO intent: the refusal is here, at
-// the filer, before anything is hashed or filed -- never an empty head standing in for one (review
-// 72009). d0_required_scope has a wire, so the refusing arm is unreachable today; it stays typed.
-fn d0_intent_text(subject: D0Subject, group: FabricGroup, transaction: NonEmptyStr) -> String? {
-  match intent_frame_head(schema: d0_intent_schema as NonEmptyStr, scopes: [d0_scope_of(op: subject.operation)]) {
-    Absent => none
-    Present { value: head } => Present { value: d0_intent_body(head: head, subject: subject, group: group, transaction: transaction) }
-  }
-}
-
-fn d0_intent_body(head: String, subject: D0Subject, group: FabricGroup, transaction: NonEmptyStr) -> String {
-  join([
-    head,
-    "\ntarget=", fabric_group_wire(g: group) as String,
-    "\nattempt=", transaction as String,
-    "\n", d0_subject_wire(subject: subject),
-    "\n",
-  ], "")
-}
-
-fn d0_intent_hash(subject: D0Subject, group: FabricGroup, transaction: NonEmptyStr) -> ContentHash? {
-  match d0_intent_text(subject: subject, group: group, transaction: transaction) {
-    Absent => none
-    Present { value: text } => sha256_of_text(text: text)
-  }
-}
-
-fn sha256_of_text(text: String) -> ContentHash? {
-  match sha256sum_stdin_digest_via_shell(content: text) {
-    Sha256FileDigestUnavailable { path: _, reason: _ } => none
-    Sha256FileDigest { digest: d } => sha256_digest_content_hash(digest: d)
-  }
-}
-
-// WHAT THE OPERATOR READS IS RENDERED FROM WHAT THE STORE CHECKS. The approval notification shows
-// the filed purpose, not the intent text, and a constant sentence here let the operator approve an
-// operation whose scope and subject they never saw. The purpose is therefore rendered from the same
-// typed scope the intent frame carries and the same subject wire the intent text carries.
-fn d0_purpose(subject: D0Subject, transaction: NonEmptyStr) -> NonEmptyStr {
-  join([
-    "Cut D D0 (transaction ", transaction as String, "): ",
-    match subject.operation {
-      D0SuspendForSuccessor { successor: _, cleanup: _, term: _ } => "suspend the pair-serving authority for a bounded successor"
-      D0ReleaseToFleet { cause: _, approval: _ } => "RELEASE the pair-serving authority to the fleet, removing the group's host commitment, only if every host reads quiescent"
-    },
-    ". Scope: ",
-    authorization_scopes_render(scopes: [d0_scope_of(op: subject.operation)]),
-    ". Over: ", d0_subject_wire(subject: subject), ".",
-  ], "") as NonEmptyStr
-}
-
-// The request D0 makes of a grant: the escalation the caller names, the required scope, the
-// grant's own subject (what is being checked is that the grant agrees with itself and with this
-// run), the transaction as the attempt, and the intent over the exact operation. Destructive.
-fn d0_request(escalation_id: NonEmptyStr, subject: D0Subject, transaction: NonEmptyStr, intent: ContentHash) -> AuthorizationRequest<D0Subject> {
-  AuthorizationRequest {
-    escalation_id: escalation_id,
-    scopes: [d0_scope_of(op: subject.operation)],
-    subject: subject,
-    purpose: d0_purpose(subject: subject, transaction: transaction),
-    attempt: (transaction as String) as AttemptIdentity,
-    intent_hash: intent,
-    destructive: true,
-  }
-}
-
-// ── THE FILING: THE REQUEST AS IT WAS ASKED, FROZEN BEFORE IT IS ASKED ─────────────────────────
-//
-// The operator decides over ONE request revision, and the transaction that revision authorizes may
-// outlive the run that filed it: a rerun after a crash must finish the lifecycle under the request
-// the operator saw, not under a request rebuilt from today's source (a candidate re-keyed, a host
-// population edited, a term changed) -- that rebuild would either be refused as another intent or,
-// worse, be admitted over facts nobody consented to. The approval broker keeps the decision, not
-// the domain subject. So the request's canonical intent text -- the exact bytes the intent hash is
-// taken over, which carry the scope, the group, the attempt and the whole subject -- is frozen on
-// the fabric event log under the escalation before the request is filed, at generation 1 with
-// ExpectSlotAbsent. A rerun reads it back, re-derives the identical request (same text, same
-// hash, same revision) and never files again; a first run that finds the slot already held is a
-// rerun that did not know it.
-data d0_filing_key_scope: String = "pair-serving-d0-filing-"
-
-fn d0_filing_key(escalation_id: NonEmptyStr) -> NonEmptyStr {
-  join([d0_filing_key_scope, escalation_id as String], "") as NonEmptyStr
-}
-
-type D0IntentParsed {
-  group: FabricGroup
-  transaction: NonEmptyStr
-  subject: D0Subject
-}
-
-fn intent_field(line: String, key: String) -> String? {
-  let prefix = join([key, "="], "")
-  if starts_with(s: line, prefix: prefix) { Present { value: substring(s: line, start: length(prefix), end: length(line)) } } else { none }
-}
-
-fn subject_field(words: List<String>, key: String) -> String? {
-  match first(filter(words, w => starts_with(s: w, prefix: join([key, "="], "")))) {
-    Present { value: w } => intent_field(line: w, key: key)
-    Absent => none
-  }
-}
-
-fn parse_d0_hosts(wire: String) -> List<HostIdentity> {
-  if wire == "" { [] as List<HostIdentity> } else { map(split(wire, separator: ","), h => h as HostIdentity) }
-}
-
-fn parse_d0_term(wire: String) -> Second? {
-  if ends_with(s: wire, suffix: "s") {
-    match parse_int(s: substring(s: wire, start: 0, end: length(wire) - 1)) {
-      Present { value: n } => if n >= 0 { Present { value: second(count: n) } } else { none }
-      Absent => none
-    }
-  } else { none }
-}
-
-// The inverse of d0_intent_text, refusing anything that is not one intent under this schema with
-// this scope. It is a parse, not a validation: a text that round-trips is by construction the text
-// the hash was taken over, so the request it yields carries the filed revision.
-fn intent_lines(text: String) -> List<String> {
-  split(text, separator: "\n")
-}
-
-fn intent_words(line: String) -> List<String> {
-  split(line, separator: " ")
-}
-
-fn line_at(lines: List<String>, i: Int) -> String {
-  match first(lines |> skip(n: i)) { Present { value: l } => l  Absent => "" }
-}
-
-// WHICH OPERATION A FRAMED INTENT IS, from its one scope: the suspension's or the release's.
-type D0FramedOperation = D0FramedSuspend | D0FramedRelease | D0FramedNeither
-
-fn d0_framed_operation(text: String) -> D0FramedOperation {
-  match parse_intent_scopes(text: text) {
-    Absent => D0FramedNeither
-    Present { value: f } =>
-      if (f.schema as String) != d0_intent_schema || count(f.scopes) != 1 { D0FramedNeither }
-      else if all(f.scopes, sc => authorization_scope_eq(a: sc, b: d0_required_scope())) { D0FramedSuspend }
-      else if all(f.scopes, sc => authorization_scope_eq(a: sc, b: d0_release_scope())) { D0FramedRelease }
-      else { D0FramedNeither }
-  }
-}
-
-// A PARSED SUBJECT IS ADMITTED ONLY WHEN IT RE-RENDERS TO THE EXACT TEXT, so the request it yields
-// carries the filed revision by construction.
-fn d0_round_trip(text: String, group: FabricGroup, attempt: String, subject: D0Subject) -> D0IntentParsed? {
-  if (match d0_intent_text(subject: subject, group: group, transaction: attempt as NonEmptyStr) { Present { value: t } => t == text  Absent => false }) {
-    Present { value: D0IntentParsed { group: group, transaction: attempt as NonEmptyStr, subject: subject } }
-  } else { none }
-}
-
-fn parse_d0_suspend_subject(words: List<String>, subject_group: FabricGroup) -> D0Subject? {
-  match subject_field(words: words, key: "successor") {
-    Absent => none
-    Present { value: succ } =>
-      match parse_content_hash(wire: succ) {
-        Absent => none
-        Present { value: successor } =>
-          match subject_field(words: words, key: "cleanup") {
-            Absent => none
-            Present { value: cl } =>
-              match parse_released_baseline(wire: cl) {
-                Absent => none
-                Present { value: cleanup } =>
-                  match subject_field(words: words, key: "term") {
-                    Absent => none
-                    Present { value: tw } =>
-                      match parse_d0_term(wire: tw) {
-                        Absent => none
-                        Present { value: term } =>
-                          match subject_field(words: words, key: "hosts") {
-                            Absent => none
-                            Present { value: hw } => Present { value: D0Subject { group: subject_group, hosts: parse_d0_hosts(wire: hw), operation: D0SuspendForSuccessor { successor: successor, cleanup: cleanup, term: term } } }
-                          }
-                      }
-                  }
-              }
-          }
-      }
-  }
-}
-
-fn parse_d0_release_subject(lines: List<String>, words: List<String>, subject_group: FabricGroup) -> D0Subject? {
-  match subject_field(words: words, key: "operation") {
-    Absent => none
-    Present { value: op } =>
-      if op != "release-to-fleet" { none } else {
-        match subject_field(words: words, key: "hosts") {
-          Absent => none
-          Present { value: hw } =>
-            match intent_field(line: line_at(lines: lines, i: 5), key: "cause") {
-              Absent => none
-              Present { value: cause } =>
-                match intent_field(line: line_at(lines: lines, i: 6), key: "approval") {
-                  Absent => none
-                  Present { value: approval } =>
-                    if cause == "" || approval == "" { none } else {
-                      Present { value: D0Subject { group: subject_group, hosts: parse_d0_hosts(wire: hw), operation: D0ReleaseToFleet { cause: cause as NonEmptyStr, approval: approval as NonEmptyStr } } }
-                    }
-                }
-            }
-        }
-      }
-  }
-}
-
-fn parse_d0_intent_text(text: String) -> D0IntentParsed? {
-  let lines = intent_lines(text: text)
-  let framed = d0_framed_operation(text: text)
-  match framed {
-    D0FramedNeither => none
-    D0FramedSuspend => parse_d0_intent_over(text: text, lines: lines, framed: framed)
-    D0FramedRelease => parse_d0_intent_over(text: text, lines: lines, framed: framed)
-  }
-}
-
-fn parse_d0_intent_over(text: String, lines: List<String>, framed: D0FramedOperation) -> D0IntentParsed? {
-  match intent_field(line: line_at(lines: lines, i: 2), key: "target") {
-    Absent => none
-    Present { value: target } =>
-      match parse_fabric_group(wire: target) {
-        Absent => none
-        Present { value: group } =>
-          match intent_field(line: line_at(lines: lines, i: 3), key: "attempt") {
-            Absent => none
-            Present { value: attempt } =>
-              if attempt == "" { none } else {
-                let words = intent_words(line: line_at(lines: lines, i: 4))
-                match subject_field(words: words, key: "group") {
-                  Absent => none
-                  Present { value: sg } =>
-                    match parse_fabric_group(wire: sg) {
-                      Absent => none
-                      Present { value: subject_group } =>
-                        match (match framed {
-                          D0FramedSuspend => parse_d0_suspend_subject(words: words, subject_group: subject_group)
-                          D0FramedRelease => parse_d0_release_subject(lines: lines, words: words, subject_group: subject_group)
-                          D0FramedNeither => none
-                        }) {
-                          Absent => none
-                          Present { value: subject } => d0_round_trip(text: text, group: group, attempt: attempt, subject: subject)
-                        }
-                    }
-                }
-              }
-          }
-      }
-  }
-}
-
-// THE FROZEN FILING IS THE INTENT AND THE EXECUTABLE THAT FILED IT. A stable consent proves
-// lifecycle identity; it does not prove implementation continuity -- a rerun under a later
-// revision would resume the lifecycle under semantics the operator never saw. So the execution
-// revision is frozen beside the intent, as the last line, and a rerun must execute it or refuse
-// (the door compares). A modeled recovery migration may later supersede that; "latest main is
-// compatible with every pending lifecycle" is not an implicit fallback.
-data d0_frozen_revision_field: String = "execution_revision"
-
-// THE APPROVED GRANT ROW, FROZEN WITH THE FILING (side-chat review of #13102). Whether the operator merged
-// the standing grant is a FRESH-START admission fact: the first run reads the grant row it executes against
-// origin/main and, when they are byte-identical and the request is one the grant covers, freezes the row's
-// digest as one more line of the filing. A rerun of that lifecycle resumes from this frozen proof -- its own
-// executed row must still digest to it -- and never consults current main, so a later edit to the row on main
-// cannot strand a lifecycle that has claimed, written pending, or released. A filing with no proof is
-// byte-identical to before (the broker path's filings are unchanged).
-type D0GrantRowProof
-  = D0GrantRowUnproven
-  | D0GrantRowApproved { row_digest: NonEmptyStr }
-
-data d0_frozen_grant_row_field: String = "standing_grant_row_digest"
-
-type D0FrozenFiling {
-  intent_text: String
-  execution_revision: NonEmptyStr
-  grant_proof: D0GrantRowProof
-}
-
-fn d0_frozen_filing_text(intent_text: String, execution_revision: NonEmptyStr) -> String {
-  d0_frozen_filing_text_with(intent_text: intent_text, execution_revision: execution_revision, proof: D0GrantRowUnproven)
-}
-
-fn d0_frozen_filing_text_with(intent_text: String, execution_revision: NonEmptyStr, proof: D0GrantRowProof) -> String {
-  join([intent_text, d0_frozen_revision_field, "=", execution_revision as String, "\n", d0_frozen_grant_line(proof: proof)], "")
-}
-
-fn d0_frozen_grant_line(proof: D0GrantRowProof) -> String {
-  match proof {
-    D0GrantRowUnproven => ""
-    D0GrantRowApproved { row_digest: d } => join([d0_frozen_grant_row_field, "=", d as String, "\n"], "")
-  }
-}
-
-fn d0_frozen_filing_of(text: String, intent_lines_count: Int, rev: String, proof: D0GrantRowProof, lines: List<String>) -> D0FrozenFiling? {
-  if rev == "" { none } else {
-    let intent = join(lines |> take(n: intent_lines_count), "\n")
-    let intent_text = join([intent, "\n"], "")
-    if d0_frozen_filing_text_with(intent_text: intent_text, execution_revision: rev as NonEmptyStr, proof: proof) == text {
-      Present { value: D0FrozenFiling { intent_text: intent_text, execution_revision: rev as NonEmptyStr, grant_proof: proof } }
-    } else { none }
-  }
-}
-
-fn parse_d0_frozen_filing(text: String) -> D0FrozenFiling? {
-  let lines = intent_lines(text: text)
-  let n = length(lines)
-  if n < 2 { none } else if line_at(lines: lines, i: n - 1) != "" { none } else {
-    match intent_field(line: line_at(lines: lines, i: n - 2), key: d0_frozen_grant_row_field) {
-      Present { value: digest } =>
-        if digest == "" || n < 3 { none } else {
-          match intent_field(line: line_at(lines: lines, i: n - 3), key: d0_frozen_revision_field) {
-            Absent => none
-            Present { value: rev } => d0_frozen_filing_of(text: text, intent_lines_count: n - 3, rev: rev, proof: D0GrantRowApproved { row_digest: digest as NonEmptyStr }, lines: lines)
-          }
-        }
-      Absent =>
-        match intent_field(line: line_at(lines: lines, i: n - 2), key: d0_frozen_revision_field) {
-          Absent => none
-          Present { value: rev } => d0_frozen_filing_of(text: text, intent_lines_count: n - 2, rev: rev, proof: D0GrantRowUnproven, lines: lines)
-        }
-    }
-  }
-}
-
-type D0FilingFreeze
-  = D0FilingFrozen
-  | D0FilingAlreadyHeld { text: String }
-  | D0FilingFreezeRefused { reason: NonEmptyStr }
-
-fn d0_freeze_filing(store: FabricStorageBinding, escalation_id: NonEmptyStr, intent_text: String, execution_revision: NonEmptyStr) -> D0FilingFreeze {
-  d0_freeze_filing_with(store: store, escalation_id: escalation_id, intent_text: intent_text, execution_revision: execution_revision, proof: D0GrantRowUnproven)
-}
-
-fn d0_freeze_filing_with(store: FabricStorageBinding, escalation_id: NonEmptyStr, intent_text: String, execution_revision: NonEmptyStr, proof: D0GrantRowProof) -> D0FilingFreeze {
-  match admit_cas_attempt_for_derived_payload(key: d0_filing_key(escalation_id: escalation_id), expected: ExpectSlotAbsent, proposed: d0_frozen_filing_text_with(intent_text: intent_text, execution_revision: execution_revision, proof: proof) as NonEmptyStr) {
-    DerivedPayloadKeyNotSlotAddressable { key: k } => D0FilingFreezeRefused { reason: join(["filing key is not slot-addressable: ", k as String], "") as NonEmptyStr }
-    DerivedPayloadAdmitted { verified: v } =>
-      match fabric_storage_compare_and_set(store: store, verified: v) {
-        CasCommitted { committed: _ } => D0FilingFrozen
-        CasPreconditionFailed { expected: _, observed: _ } =>
-          match d0_read_filing(store: store, escalation_id: escalation_id) {
-            D0FilingAt { text: t } => D0FilingAlreadyHeld { text: t }
-            D0FilingAbsent => D0FilingFreezeRefused { reason: "the filing slot moved and then read absent" as NonEmptyStr }
-            D0FilingUnreadable { reason: r } => D0FilingFreezeRefused { reason: r }
-          }
-        CasStoreRefused { cause: c } => D0FilingFreezeRefused { reason: join(["the filing could not be frozen: ", fabric_storage_fault_wire(fault: FabricStoreRefused { cause: c })], "") as NonEmptyStr }
-      }
-  }
-}
-
-type D0FilingReading
-  = D0FilingAbsent
-  | D0FilingAt { text: String }
-  | D0FilingUnreadable { reason: NonEmptyStr }
-
-fn d0_read_filing(store: FabricStorageBinding, escalation_id: NonEmptyStr) -> D0FilingReading {
-  match fabric_storage_observe_cas_slot(store: store, key: d0_filing_key(escalation_id: escalation_id)) {
-    CasObservedUnreadable { cause: c } => D0FilingUnreadable { reason: join(["filing slot unreadable: ", cas_unreadable_slot_detail(cause: c)], "") as NonEmptyStr }
-    CasObservedReadable { readable: CasReadableAbsent } => D0FilingAbsent
-    CasObservedReadable { readable: CasReadablePresent { version: v } } => D0FilingAt { text: v.value as String }
-  }
-}
-
-// ── THE CLAIM: CONSENT IS CONSUMED ONCE, FLEET-WIDE, BEFORE THE FIRST WRITE ────────────────────
-//
-// std.scoped_authorization decides whether a grant PERMITS an operation; it models single use as
-// a compare-and-set TRANSITION of the grant's claim slot, never as a check at the reader, because
-// two readers can both see "unclaimed". THE SLOT IS ON THE FABRIC EVENT LOG
-// (gunbc.durable_cas_fabric_storage), not on a host-local file store: D0 may run from any executor
-// that resolves a store, and two executors' local roots exclude nothing from each other -- each
-// would see the grant unclaimed and both would consume the same consent. The log's one placed
-// remote is the linearization point the authority already relies on, so the claim shares it, and
-// exactly one ClaimedBy exists for a grant however many executors race for it.
-//
-// The pending state carries the claim's generation inside its binding; a resume needs the slot
-// held by THIS attempt and does not re-run the permission decision (expiry removes the right to
-// START -- the right to finish or clean up survives it, exactly as the successor's lease does);
-// and the transaction's terminal marks the claim CompletedBy, or AbortedBy when it refused before
-// its first write.
-
-type D0ClaimStanding
-  = D0ClaimHeld { generation: CasGeneration }
-  | D0ClaimLost { holder: NonEmptyStr }
-  | D0ClaimUndecided { reason: NonEmptyStr }
-
-fn d0_claim_grant(store: FabricStorageBinding, escalation_id: NonEmptyStr, transaction: NonEmptyStr, now: Timestamp) -> D0ClaimStanding {
-  let proposed = claim_transition_claimed(attempt: (transaction as String) as AttemptIdentity, at: now)
-  match admit_cas_attempt(attempt: claim_authorization(escalation_id: escalation_id, expected: ExpectSlotAbsent, proposed: proposed)) {
-    CasAttemptAdmitted { verified: v } =>
-      match authorization_claim_outcome(proposed: proposed, outcome: fabric_storage_compare_and_set(store: store, verified: v)) {
-        ClaimHeld { state: _, generation: g } => D0ClaimHeld { generation: g }
-        ClaimLost { holder: h } => D0ClaimLost { holder: h }
-        ClaimUndecided { reason: r } => D0ClaimUndecided { reason: r }
-      }
-    CasAttemptDigestMismatch { claimed: _, actual: _ } => D0ClaimUndecided { reason: "claim payload and its digest disagree" as NonEmptyStr }
-    CasAttemptDigestIncomparable { claimed: _, actual: _ } => D0ClaimUndecided { reason: "claim digest families are incomparable" as NonEmptyStr }
-    CasAttemptKeyNotSlotAddressable { key: _ } => D0ClaimUndecided { reason: "authorization claim key is not slot-addressable" as NonEmptyStr }
-  }
-}
-
-// THE SLOT AS A RERUN FINDS IT: decoded into the claim's own closed state, with the generation
-// the terminal must name. An unreadable store, or bytes that inhabit no claim state, is Unreadable
-// -- a rerun that proceeded on an unread slot would be the absorbing fallback on the one
-// operation whose purpose is exclusion.
-type D0ClaimReading
-  = D0ClaimAbsent
-  | D0ClaimAt { state: AuthorizationClaimState, generation: CasGeneration }
-  | D0ClaimUnreadable { reason: NonEmptyStr }
-
-fn d0_read_claim(store: FabricStorageBinding, escalation_id: NonEmptyStr) -> D0ClaimReading {
-  match fabric_storage_observe_cas_slot(store: store, key: authorization_claim_key(escalation_id: escalation_id)) {
-    CasObservedUnreadable { cause: c } => D0ClaimUnreadable { reason: join(["authorization claim slot unreadable: ", cas_unreadable_slot_detail(cause: c)], "") as NonEmptyStr }
-    CasObservedReadable { readable: CasReadableAbsent } => D0ClaimAbsent
-    CasObservedReadable { readable: CasReadablePresent { version: v } } =>
-      match parse_authorization_claim_state(payload: v.value) {
-        Absent => D0ClaimUnreadable { reason: join(["the claim slot holds bytes that are no claim state: ", v.value as String], "") as NonEmptyStr }
-        Present { value: s } => D0ClaimAt { state: s, generation: v.generation }
-      }
-  }
-}
-
-// The slot as this attempt must find it on resume: held by this transaction. Any other holder,
-// a spent grant, an absent slot, or an unreadable store refuses.
-fn d0_resume_claim(store: FabricStorageBinding, escalation_id: NonEmptyStr, transaction: NonEmptyStr) -> D0ClaimStanding {
-  match d0_read_claim(store: store, escalation_id: escalation_id) {
-    D0ClaimUnreadable { reason: r } => D0ClaimUndecided { reason: r }
-    D0ClaimAbsent => D0ClaimLost { holder: "no attempt holds the grant, so there is no claimed transaction to resume" as NonEmptyStr }
-    D0ClaimAt { state: s, generation: g } =>
-      match s {
-        ClaimedBy { attempt: who, claimed_at: _ } =>
-          if (who as String) == (transaction as String) { D0ClaimHeld { generation: g } } else { D0ClaimLost { holder: join(["claimed by attempt ", who as String], "") as NonEmptyStr } }
-        Unclaimed => D0ClaimLost { holder: "the slot records the grant unclaimed" as NonEmptyStr }
-        CompletedBy { attempt: who, completed_at: _ } => D0ClaimLost { holder: join(["completed by attempt ", who as String], "") as NonEmptyStr }
-        AbortedBy { attempt: who, aborted_at: _, cause: _ } => D0ClaimLost { holder: join(["aborted by attempt ", who as String], "") as NonEmptyStr }
-      }
-  }
-}
-
-// THE TERMINAL: the claim moves to CompletedBy when the transaction settled (any of its three
-// terminals) and to AbortedBy when it refused before its first write. A terminal that does not
-// land is reported, never hidden: the authority already moved, and a bare success would leave an
-// operator unaware that a slot inspection is owed.
-type D0ClaimTerminal
-  = D0ClaimTerminated
-  | D0ClaimNotAttempted { still_held_by: NonEmptyStr }
-  | D0ClaimUnterminated { detail: String }
-
-fn d0_terminate_claim(store: FabricStorageBinding, escalation_id: NonEmptyStr, transaction: NonEmptyStr, held: CasGeneration, completed: Bool, cause: String, now: Timestamp) -> D0ClaimTerminal {
-  let attempt = (transaction as String) as AttemptIdentity
-  let terminal = if completed { claim_transition_completed(attempt: attempt, at: now) } else { claim_transition_aborted(attempt: attempt, at: now, cause: cause as NonEmptyStr) }
-  match admit_cas_attempt(attempt: claim_authorization(escalation_id: escalation_id, expected: ExpectSlotGeneration { generation: held }, proposed: terminal)) {
-    CasAttemptAdmitted { verified: v } =>
-      match fabric_storage_compare_and_set(store: store, verified: v) {
-        CasCommitted { committed: _ } => D0ClaimTerminated
-        CasPreconditionFailed { expected: _, observed: _ } => D0ClaimUnterminated { detail: "claim slot moved under us" }
-        CasStoreRefused { cause: _ } => D0ClaimUnterminated { detail: "claim store refused the terminal write" }
-      }
-    CasAttemptDigestMismatch { claimed: _, actual: _ } => D0ClaimUnterminated { detail: "terminal payload and its digest disagree" }
-    CasAttemptDigestIncomparable { claimed: _, actual: _ } => D0ClaimUnterminated { detail: "terminal digest families are incomparable" }
-    CasAttemptKeyNotSlotAddressable { key: _ } => D0ClaimUnterminated { detail: "authorization claim key is not slot-addressable" }
-  }
-}
-
-// ── THE ADMITTED GRANT, AND THE BINDING THE PENDING STATE CARRIES ──────────────────────────────
-//
-// Sole-constructed: the only ways to hold one are admit_d0_grant (start: permission decided,
-// claim taken) and resume_d0_grant (resume: claim found held by this attempt). The binding is a
-// SHA-256 over one canonical encoding of everything a resume must agree on -- escalation,
-// attempt, the cryptographic intent, subject, expiry, and the claim's generation on the fleet
-// log -- so a pending state written under one authorization cannot be settled under another,
-// including a re-issued grant with a later expiry. THE EXECUTOR IS NOT IN IT: the binding is the
-// AUTHORIZATION lifecycle, stable across whichever executor runs a rerun, so any executor reads
-// the same history for it (and may complete a settled claim, which mutates no host). WHO may
-// finish a pending transaction is a separate fact, the lease's owner fingerprint on the pending
-// state, checked by the recovery join.
-type AdmittedD0Grant sole_constructor {
-  grant: OperatorGrant<D0Subject>
-  claim_generation: CasGeneration
-  binding: ContentHash
-}
-
-// A STANDING OPERATOR GRANT ANSWERS FOR EXACTLY THE REQUESTS IT COVERS (gunbc.auth.standing_operator_grant):
-// a release-to-fleet of the grant's group whose subject hosts are all the grant's. For such a request the
-// door admits the grant minted over that exact request, in place of filing with the broker and polling --
-// on a first run and on a rerun alike, since the ruling, unlike a broker decision, is not consumed by the
-// lifecycle that first used it; the durable claim still decides whether a rerun may continue. Every other
-// request -- a suspension, another group, a host outside the grant -- files and polls as before.
-data d0_standing_grants: List<StandingOperatorGrant> = [group_a_dev_standing_grant]
-
-fn d0_standing_grant_for(request: AuthorizationRequest<D0Subject>) -> StandingOperatorGrant? {
-  d0_standing_grant_for_subject(subject: request.subject)
-}
-
-fn d0_standing_grant_for_subject(subject: D0Subject) -> StandingOperatorGrant? {
-  match subject.operation {
-    D0SuspendForSuccessor { successor: _, cleanup: _, term: _ } => none
-    D0ReleaseToFleet { cause: _, approval: _ } =>
-      first(filter(d0_standing_grants, g => standing_grant_covers(g: g, scope: StandingGrantFabricGroup { group: subject.group, hosts: subject.hosts }, effect: StandingD0ReleaseToFleet)))
-  }
-}
-
-// THE LIFECYCLE TERM OF THE BINDING (side-chat review of #13067). A broker grant's lifecycle is its one
-// decided window, so its expiry is in the binding and a re-issued grant with a later expiry is another
-// lifecycle. A STANDING grant is minted per run with that run's live window, so its expiry would make every
-// rerun a new lifecycle: a crash after the pending write (or after ReleasedToFleet, before the claim
-// completes) could never be resumed. Its lifecycle is the grant's identity, which every run of the
-// request derives the same way. The run's window still bounds the run (authorize checks it); it is only
-// kept out of the identity. A broker grant's binding text is byte-identical to before.
-// THE TERM FOLLOWS THE AUTHORIZATION'S PROVENANCE, NOT THE SUBJECT'S COVERAGE (side-chat review of #13102).
-// A covered release the BROKER approved (the row was not on main at its fresh start) keeps broker lifecycle
-// identity and expiry; only an authorization actually ISSUED from the standing grant carries the grant's
-// identity. The door states which it issued, and every run of one lifecycle states the same: a fresh start
-// issues from the grant exactly when it froze the grant proof, and a rerun issues from it exactly when that
-// frozen proof is present.
-type D0AuthorizationBasis
-  = D0BasisBroker
-  | D0BasisStandingGrant { identity: NonEmptyStr }
-
-fn d0_binding_lifecycle_term(grant: OperatorGrant<D0Subject>, basis: D0AuthorizationBasis) -> String {
-  match basis {
-    D0BasisStandingGrant { identity: id } => join(["\nstanding_grant=", id as String], "")
-    D0BasisBroker => join(["\nexpires_at=", grant.expires_at], "")
-  }
-}
-
-fn d0_binding_text(grant: OperatorGrant<D0Subject>, claim_generation: CasGeneration) -> String {
-  d0_binding_text_with(grant: grant, claim_generation: claim_generation, basis: D0BasisBroker)
-}
-
-fn d0_binding_text_with(grant: OperatorGrant<D0Subject>, claim_generation: CasGeneration, basis: D0AuthorizationBasis) -> String {
-  join([
-    "escalation=", grant.escalation_id as String,
-    "\nattempt=", grant.attempt as String,
-    "\nintent=", serialize_content_hash(hash: grant.intent_hash) as String,
-    "\n", d0_subject_wire(subject: grant.subject),
-    d0_binding_lifecycle_term(grant: grant, basis: basis),
-    "\nclaim_generation=", to_string(cas_generation_count(g: claim_generation)),
-    "\n",
-  ], "")
-}
-
-type D0GrantAdmission
-  = D0GrantAdmitted { admitted: AdmittedD0Grant }
-  | D0GrantForAnotherGroup { granted: FabricGroup }
-  | D0GrantForAnotherPopulation { granted: List<HostIdentity>, current: List<HostIdentity> }
-  | D0GrantIntentUnavailable
-  | D0GrantRefused { cause: AuthorizationRefusalCause }
-  | D0GrantClaimLost { holder: NonEmptyStr }
-  | D0GrantClaimUndecided { reason: NonEmptyStr }
-  | D0GrantBindingUnavailable { claim: D0ClaimTerminal }
-
-fn admitted_with_binding(grant: OperatorGrant<D0Subject>, generation: CasGeneration, basis: D0AuthorizationBasis) -> AdmittedD0Grant? {
-  match sha256_of_text(text: d0_binding_text_with(grant: grant, claim_generation: generation, basis: basis)) {
-    Absent => none
-    Present { value: b } => Present { value: AdmittedD0Grant { grant: grant, claim_generation: generation, binding: b } }
-  }
-}
-
-// THE CHECKS THAT NEED NO STORE, before any claim is taken: the grant names this group, and its
-// host population is the group's current one.
-type D0SubjectStanding
-  = D0SubjectAgrees { grant: OperatorGrant<D0Subject> }
-  | D0SubjectDisagrees { admission: D0GrantAdmission }
-  | D0SubjectNotGranted
-
-// THE POPULATION IS CHECKED AT THE START AND NOT ON A RESUME. Before any claim or write, the
-// operator's hosts must be the group's current hosts. Once the claim is held the check moves to
-// the dispatcher (d0_dispatch), where its consequence depends on how far the lifecycle got: no
-// authority write yet means the claim is aborted; a pending state already written means the
-// transaction must still reach a terminal under the population it was authorized for -- a source
-// edit may not revoke the right to finish -- so the drift is carried into the readings and fences.
-type D0PopulationCheck
-  = PopulationAgainst { current: List<HostIdentity> }
-  | PopulationNotChecked
-
-fn d0_subject_standing(authorization: ScopedAuthorization<D0Subject>, group: FabricGroup, check_population: D0PopulationCheck) -> D0SubjectStanding {
-  match authorization {
-    AuthorizationGranted { grant: g, claim: _ } =>
-      if !same_group(a: g.subject.group, b: group) {
-        D0SubjectDisagrees { admission: D0GrantForAnotherGroup { granted: g.subject.group } }
-      } else {
-        match check_population {
-          PopulationNotChecked => D0SubjectAgrees { grant: g }
-          PopulationAgainst { current: current } =>
-        match d0_population(subject: g.subject, current: current) {
-          D0PopulationDiffers { granted: gr, current: cur } => D0SubjectDisagrees { admission: D0GrantForAnotherPopulation { granted: gr, current: cur } }
-          D0PopulationAgrees => D0SubjectAgrees { grant: g }
-        }
-        }
-      }
-    AuthorizationPending { request: _ } => D0SubjectNotGranted
-    AuthorizationDenied { escalation_id: _, denied_by: _, denied_at: _, reason: _ } => D0SubjectNotGranted
-  }
-}
-
-// START: the subject checks, the intent, the permission decision, then the claim; a binding that
-// cannot be digested AFTER the claim landed aborts the claim rather than stranding it.
-fn admit_d0_grant(store: FabricStorageBinding, authorization: ScopedAuthorization<D0Subject>, escalation_id: NonEmptyStr, group: FabricGroup, current_hosts: List<HostIdentity>, transaction: NonEmptyStr, executor: NonEmptyStr, at: EpochSecs, now: Timestamp) -> D0GrantAdmission {
-  admit_d0_grant_with(store: store, authorization: authorization, escalation_id: escalation_id, group: group, current_hosts: current_hosts, transaction: transaction, executor: executor, at: at, now: now, basis: D0BasisBroker)
-}
-
-fn admit_d0_grant_with(store: FabricStorageBinding, authorization: ScopedAuthorization<D0Subject>, escalation_id: NonEmptyStr, group: FabricGroup, current_hosts: List<HostIdentity>, transaction: NonEmptyStr, executor: NonEmptyStr, at: EpochSecs, now: Timestamp, basis: D0AuthorizationBasis) -> D0GrantAdmission {
-  match d0_subject_standing(authorization: authorization, group: group, check_population: PopulationAgainst { current: current_hosts }) {
-    D0SubjectNotGranted => D0GrantRefused { cause: d0_not_granted_cause(authorization: authorization, escalation_id: escalation_id, group: group) }
-    D0SubjectDisagrees { admission: a } => a
-    D0SubjectAgrees { grant: g } =>
-      match d0_intent_hash(subject: g.subject, group: group, transaction: transaction) {
-        Absent => D0GrantIntentUnavailable
-        Present { value: intent } =>
-          match authorize(authorization: authorization, request: d0_request(escalation_id: escalation_id, subject: g.subject, transaction: transaction, intent: intent), observed_at: now) {
-            AuthorizationRefused { cause: c } => D0GrantRefused { cause: c }
-            AuthorizationPermitted { grant: permitted } =>
-              match d0_claim_grant(store: store, escalation_id: escalation_id, transaction: transaction, now: now) {
-                D0ClaimLost { holder: h } => D0GrantClaimLost { holder: h }
-                D0ClaimUndecided { reason: r } => D0GrantClaimUndecided { reason: r }
-                D0ClaimHeld { generation: gen } =>
-                  match admitted_with_binding(grant: permitted, generation: gen, basis: basis) {
-                    Present { value: admitted } => D0GrantAdmitted { admitted: admitted }
-                    Absent => D0GrantBindingUnavailable { claim: d0_terminate_claim(store: store, escalation_id: escalation_id, transaction: transaction, held: gen, completed: false, cause: "the authorization binding could not be digested after the claim landed", now: now) }
-                  }
-              }
-          }
-      }
-  }
-}
-
-// A pending or denied authorization has no subject to check; std.scoped_authorization's own
-// decision names the cause. The request handed to it carries no intent (the subject is not the
-// grant's), which is fine: the decision refuses before comparing intents.
-fn d0_not_granted_cause(authorization: ScopedAuthorization<D0Subject>, escalation_id: NonEmptyStr, group: FabricGroup) -> AuthorizationRefusalCause {
-  let placeholder = D0Subject { group: group, hosts: [] as List<HostIdentity>, operation: D0SuspendForSuccessor { successor: content_hash_of_value(value: "unauthorized" as NonEmptyStr), cleanup: QuiescentReservedBaseline, term: second(count: 0) } }
-  match authorize(authorization: authorization, request: d0_request(escalation_id: escalation_id, subject: placeholder, transaction: "unauthorized" as NonEmptyStr, intent: content_hash_of_value(value: "unauthorized" as NonEmptyStr)), observed_at: "") {
-    AuthorizationRefused { cause: c } => c
-    AuthorizationPermitted { grant: g } => AuthorizationEscalationMismatch { requested: escalation_id, granted: g.escalation_id }
-  }
-}
-
-// RESUME: the subject checks, then the claim must already be this attempt's; permission is not
-// re-decided, so an expired grant can still finish what it started. The binding is recomputed and
-// compared to the pending state's by the transaction.
-fn resume_d0_grant(store: FabricStorageBinding, authorization: ScopedAuthorization<D0Subject>, escalation_id: NonEmptyStr, group: FabricGroup, transaction: NonEmptyStr, executor: NonEmptyStr) -> D0GrantAdmission {
-  resume_d0_grant_with(store: store, authorization: authorization, escalation_id: escalation_id, group: group, transaction: transaction, executor: executor, basis: D0BasisBroker)
-}
-
-fn resume_d0_grant_with(store: FabricStorageBinding, authorization: ScopedAuthorization<D0Subject>, escalation_id: NonEmptyStr, group: FabricGroup, transaction: NonEmptyStr, executor: NonEmptyStr, basis: D0AuthorizationBasis) -> D0GrantAdmission {
-  match d0_subject_standing(authorization: authorization, group: group, check_population: PopulationNotChecked) {
-    D0SubjectNotGranted => D0GrantClaimLost { holder: "the authorization is not granted, so no claim of it can be resumed" as NonEmptyStr }
-    D0SubjectDisagrees { admission: a } => a
-    D0SubjectAgrees { grant: g } =>
-      match d0_resume_claim(store: store, escalation_id: escalation_id, transaction: transaction) {
-        D0ClaimLost { holder: h } => D0GrantClaimLost { holder: h }
-        D0ClaimUndecided { reason: r } => D0GrantClaimUndecided { reason: r }
-        D0ClaimHeld { generation: gen } =>
-          match admitted_with_binding(grant: g, generation: gen, basis: basis) {
-            Present { value: admitted } => D0GrantAdmitted { admitted: admitted }
-            Absent => D0GrantBindingUnavailable { claim: D0ClaimUnterminated { detail: "the claim stays held: a resume that cannot digest its binding leaves the transaction to a later rerun" } }
-          }
-      }
-  }
-}
-
-// THE AUTHORIZATION IS PRODUCED AT THE DOOR: gunbc.spark.pair_serving_d0_authorization builds the
-// request over the keyed successor and turns the operator's approval decision into the
-// ScopedAuthorization<D0Subject> that gunbc.spark.pair_serving_d0_door hands to d0_dispatch.
-
-// The lease as the authority carries it. The epoch names the transaction, the group as the
-// resource and the executor as the owner; the generation is the authority-log generation the
-// pending state lands at, so a stale holder presents a generation the fence rejects.
-fn d0_held_lease(group: FabricGroup, transaction: NonEmptyStr, executor: NonEmptyStr, generation: Nat) -> HeldLease {
-  held_lease(
-    epoch: LeaseEpoch {
-      lease_key: transaction,
-      resource_fingerprint: content_hash_of_value(value: fabric_group_wire(g: group)),
-      owner_fingerprint: content_hash_of_value(value: executor),
-      generation: generation,
-    },
-    observed: LeaseRunningExpected,
-  )
-}
-
-// ── THE READINGS ───────────────────────────────────────────────────────────────────────────────
-
-type RankOccupancyReading {
-  host: HostIdentity
-  unit_name: NonEmptyStr
-  occupancy: UnitOccupancy
-}
-
-// FOUR ARMS, BECAUSE "NO LAUNCH OBSERVED" IS SEVERAL FACTS. A failed connect within the bound is
-// the only reading under which absence can still be established -- and the decision establishes
-// it on the head host (reconcile_occupancy: the head's unit first), never from the transport; the door
-// answering with any HTTP status, or the metrics naming no launch, is an incumbent that IS there
-// and could not be identified, and it fences; a deadline, or a transport that could not be read,
-// says nothing about the door and is RouteUnread, which fences too. An earlier shape folded every
-// failure into "silent" and would have suspended a group whose engine stalled.
-// WHAT THE HEAD HOST SAYS ABOUT ITS OWN FRONT DOOR, read only when the door could not be connected:
-// the kernel's socket tables for a LISTEN on the enrolled port (any owner), and the engine-process
-// scan. Absence is established only by Quiet -- no listener on the port AND no engine process --
-// and the decision then still requires the declared unit inactive. A listener, an engine process,
-// or an unread table is a possible incumbent the route did not reach, and fences.
-type HeadEndpointReading
-  = HeadEndpointQuiet
-  | HeadEndpointListening { port: Port, rows: List<TcpSocketRow> }
-  | HeadEndpointEngineProcess { listing: String }
-  | HeadEndpointUnread { cause: NonEmptyStr }
-
-type IncumbentReading
-  = IncumbentAnswered { agreement: PairRealizationAgreement }
-  | IncumbentAnsweredUnread { cause: NonEmptyStr }
-  | IncumbentDidNotAnswer { receipt: NonEmptyStr, head: HeadEndpointReading }
-  | IncumbentRouteUnread { cause: NonEmptyStr }
-
-// EVERY HOST'S OWN OCCUPANCY, read beside the declared units: the pair units by name and every GPU
-// compute process (gunbc.compute.host_occupancy read_host_occupancy). The declared-unit reading cannot
-// tell an empty rank from a foreign occupant; this one can, and a release decides on it. A suspension
-// carries it in its receipt as evidence and decides as before.
-type RankVacancyReading {
-  host: HostIdentity
-  reading: HostOccupancyReading
-}
-
-type D0Observation {
-  group: FabricGroup
-  incumbent: IncumbentReading
-  ranks: List<RankOccupancyReading>
-  vacancy: List<RankVacancyReading>
-}
-
-// ── THE RECONCILIATION ─────────────────────────────────────────────────────────────────────────
-
-type OccupancyReconciliation
-  = DeclaredOccupantDrifted { drifted: List<HostIdentity> }
-  | OccupancyNotQuiet { live: List<HostIdentity> }
-  | OccupancyUnread { hosts: List<HostIdentity>, cause: NonEmptyStr }
-
-type RankVerdict
-  = RankLive { host: HostIdentity }
-  | RankDrifted { host: HostIdentity }
-  | RankUnread { host: HostIdentity, cause: NonEmptyStr }
-
-fn rank_verdict(declared: DeclaredRankUnit, ranks: List<RankOccupancyReading>) -> RankVerdict {
-  match first(filter(ranks, r => host_identity_eq(a: r.host, b: declared.host))) {
-    Absent => RankUnread { host: declared.host, cause: "no occupancy reading was taken for this declared rank" as NonEmptyStr }
-    Present { value: r } =>
-      match r.occupancy {
-        UnitOccupancyUnread { refusal: why } => RankUnread { host: declared.host, cause: serving_incarnation_refusal_text(r: why) as NonEmptyStr }
-        UnitNotInstalled =>
-          RankUnread { host: declared.host, cause: "no pair unit is installed on this rank; occupancy beyond the declared unit (containers, device allocations) is not read by this transaction, so an empty rank cannot be told apart from a foreign occupant" as NonEmptyStr }
-        UnitInstalled { active: active, unit_digest: d } =>
-          match digests_agree(left: d, right: declared.digest) {
-            DigestsIncomparable => RankUnread { host: declared.host, cause: "the installed unit's digest and the declared digest are of different hash families" as NonEmptyStr }
-            DigestsDiffer => RankDrifted { host: declared.host }
-            DigestsAgree => if active { RankLive { host: declared.host } } else { RankDrifted { host: declared.host } }
-          }
-      }
-  }
-}
-
-fn verdict_unread(v: RankVerdict) -> List<RankVerdict> {
-  match v {
-    RankUnread { host: _, cause: _ } => [v]
-    RankLive { host: _ } => [] as List<RankVerdict>
-    RankDrifted { host: _ } => [] as List<RankVerdict>
-  }
-}
-
-fn verdict_drifted_host(v: RankVerdict) -> List<HostIdentity> {
-  match v {
-    RankDrifted { host: h } => [h]
-    RankLive { host: _ } => [] as List<HostIdentity>
-    RankUnread { host: _, cause: _ } => [] as List<HostIdentity>
-  }
-}
-
-fn live_host(v: RankVerdict) -> List<HostIdentity> {
-  match v {
-    RankLive { host: h } => [h]
-    RankDrifted { host: _ } => [] as List<HostIdentity>
-    RankUnread { host: _, cause: _ } => [] as List<HostIdentity>
-  }
-}
-
-fn unread_host(v: RankVerdict) -> List<HostIdentity> {
-  match v {
-    RankUnread { host: h, cause: _ } => [h]
-    RankLive { host: _ } => [] as List<HostIdentity>
-    RankDrifted { host: _ } => [] as List<HostIdentity>
-  }
-}
-
-fn unread_cause(v: RankVerdict) -> List<String> {
-  match v {
-    RankUnread { host: h, cause: c } => [join([h as String, ": ", c as String], "")]
-    RankLive { host: _ } => [] as List<String>
-    RankDrifted { host: _ } => [] as List<String>
-  }
-}
-
-// THE HEAD FIRST, THEN EVERY RANK. Reconciliation is asked when the front door could not be
-// connected and the head host's socket table and process scan were quiet; what it establishes on
-// top of that is the declared UNIT on the head: readable and not active (inactive or not
-// installed) corroborates absence, ACTIVE is a listener the route did not reach (OccupancyNotQuiet
-// -- an unidentified incumbent, never a reconciled answer), unread fences. With the head quiet,
-// every declared rank is read against its unit: one unread rank makes the whole occupancy unread
-// -- a pair three-quarters reconciled is not reconciled -- and A LIVE RANK ANYWHERE IS NOT QUIET:
-// a worker whose declared unit is installed, byte-identical and active is a running occupant, so
-// the answer is OccupancyNotQuiet naming every live rank, never a drifted population with the
-// running rank dropped (that was the widen review 69399 found). Only with every rank read and
-// none live is the drift decided; because the head was just read inactive, the head rank is
-// drifted (declared bytes, not running) or unread (not installed), so the reconciled answer this
-// route reaches is DeclaredOccupantDrifted: the declared occupant, observed not running, which
-// is exactly the population the suspension records and D1 cleans.
-fn reconcile_occupancy(declared: DeclaredPairRealization, ranks: List<RankOccupancyReading>) -> OccupancyReconciliation {
-  match first(filter(ranks, r => host_identity_eq(a: r.host, b: declared.head.host))) {
-    Absent => OccupancyUnread { hosts: [declared.head.host], cause: "no occupancy reading was taken for the head rank" as NonEmptyStr }
-    Present { value: r } =>
-      match r.occupancy {
-        UnitOccupancyUnread { refusal: why } => OccupancyUnread { hosts: [declared.head.host], cause: serving_incarnation_refusal_text(r: why) as NonEmptyStr }
-        UnitInstalled { active: true, unit_digest: _ } => OccupancyNotQuiet { live: [declared.head.host] }
-        UnitInstalled { active: false, unit_digest: _ } => reconcile_all_ranks(declared: declared, ranks: ranks)
-        UnitNotInstalled => reconcile_all_ranks(declared: declared, ranks: ranks)
-      }
-  }
-}
-
-// The head is not live: every declared rank is reconciled, head first.
-fn reconcile_all_ranks(declared: DeclaredPairRealization, ranks: List<RankOccupancyReading>) -> OccupancyReconciliation {
-  let verdicts = map(concat([declared.head], declared.workers), d => rank_verdict(declared: d, ranks: ranks))
-  let unread = flat_map(verdicts, v => verdict_unread(v: v))
-  let live = flat_map(verdicts, v => live_host(v: v))
-  if length(unread) != 0 {
-    OccupancyUnread { hosts: flat_map(unread, v => unread_host(v: v)), cause: join(flat_map(unread, v => unread_cause(v: v)), "; ") as NonEmptyStr }
-  } else if length(live) != 0 {
-    OccupancyNotQuiet { live: live }
-  } else {
-    DeclaredOccupantDrifted { drifted: flat_map(verdicts, v => verdict_drifted_host(v: v)) }
-  }
-}
-
-// ── THE DECISION ───────────────────────────────────────────────────────────────────────────────
-
-type D0Cause
-  = D0IncumbentLive { standing: String }
-  | D0IncumbentUnidentified { cause: NonEmptyStr }
-  | D0OccupancyUnread { cause: NonEmptyStr }
-  | D0DeclarationUnavailable { obligation: NonEmptyStr }
-  | D0HostNotQuiescent { cause: NonEmptyStr }
-
-// What the second transition writes, decided from the readings alone.
-type D0Decision
-  = D0DecidedSuspend { next: PairServingGroupAuthority, reconciliation: OccupancyReconciliation }
-  | D0DecidedRestore { next: PairServingGroupAuthority, key: ContentHash }
-  | D0DecidedFence { next: PairServingGroupAuthority, cause: D0Cause }
-  | D0DecidedRelease { group: FabricGroup, hosts: List<HostIdentity> }
-
-data d0_disposition_authority: NonEmptyStr = "operator" as NonEmptyStr
-
-fn fence(group: FabricGroup, hosts: List<HostIdentity>, cause: D0Cause) -> D0Decision {
-  let text = match cause {
-    D0IncumbentLive { standing: s } => join(["a serving incumbent answers on the enrolled route and is not the declared realization: ", s], "")
-    D0IncumbentUnidentified { cause: c } => join(["the enrolled route answered but the answering launch could not be identified, so an incumbent may be live: ", c as String], "")
-    D0OccupancyUnread { cause: c } => join(["occupancy could not be reconciled: ", c as String], "")
-    D0DeclarationUnavailable { obligation: o } => join(["the declared pair realization could not be keyed: ", o as String], "")
-    D0HostNotQuiescent { cause: c } => join(["a release is admitted only on quiescent hosts, and one is not: ", c as String], "")
-  }
-  D0DecidedFence { next: FencedRefusal { group: group, hosts: hosts, cause: text as NonEmptyStr, disposition_authority: d0_disposition_authority }, cause: cause }
-}
-
-// THE PURE DECISION over supplied readings. The successor's lease is the one the pending state
-// holds, re-read so its observed state is the read's; the candidate realization is what the
-// caller was authorized for, Unestablished until Cut 0 keys it.
-// THE RESTORE DOES NOT MINT A KEY. When the answering incumbent is the declared realization on
-// every rank, restoration is shown safe -- but gunbc.spark.pair_incumbent_identity carries the
-// running IMAGE as observed-and-uncompared (no produced-image digest exists to compare it to), so
-// "established" there is rank-and-unit agreement, not an exact realization. A rebuilt image under
-// the same reference with unchanged unit bytes passes it. So the authority returns to the exact
-// state it was in, unchanged; PairRealizationKeyed is minted only once the image axis is compared
-// (the produced-image receipt names that trigger on the agreement's own arm).
-fn d0_decide(
-  declared: DeclaredPairRealizationStanding,
-  observation: D0Observation,
-  active: PairServingGroupAuthority,
-  lease: HeldLease,
-  grant: OperatorGrant<D0Subject>,
-) -> D0Decision {
-  let hosts = grant.subject.hosts
-  let group = observation.group
-  match grant.subject.operation {
-    D0ReleaseToFleet { cause: _, approval: _ } => d0_decide_release(observation: observation, hosts: hosts)
-    D0SuspendForSuccessor { successor: successor, cleanup: cleanup, term: _ } =>
-      d0_decide_suspend(declared: declared, observation: observation, active: active, lease: lease, authorization: grant.escalation_id, candidate: PairRealizationKeyed { key: successor }, cleanup: cleanup, hosts: hosts)
-  }
-}
-
-fn d0_decide_suspend(
-  declared: DeclaredPairRealizationStanding,
-  observation: D0Observation,
-  active: PairServingGroupAuthority,
-  lease: HeldLease,
-  authorization: NonEmptyStr,
-  candidate: PairRealizationIdentity,
-  cleanup: ReleasedBaselineSpec,
-  hosts: List<HostIdentity>,
-) -> D0Decision {
-  let group = observation.group
-  match declared {
-    DeclaredPairRealizationUnavailable { group: _, obligation: o } => fence(group: group, hosts: hosts, cause: D0DeclarationUnavailable { obligation: o })
-    DeclaredPairRealizationKeyed { declared: d } =>
-      match observation.incumbent {
-        IncumbentRouteUnread { cause: c } => fence(group: group, hosts: hosts, cause: D0OccupancyUnread { cause: c })
-        IncumbentAnsweredUnread { cause: c } => fence(group: group, hosts: hosts, cause: D0IncumbentUnidentified { cause: c })
-        IncumbentAnswered { agreement: a } =>
-          match a {
-            PairRealizationEstablished { key: k, declared: _, observed: _, image: _ } =>
-              D0DecidedRestore { next: active, key: k }
-            PairRealizationDrifted { key: _, drifted: _ } => fence(group: group, hosts: hosts, cause: D0IncumbentLive { standing: join(pair_realization_agreement_lines(a: a), "; ") })
-            PairRealizationRankPopulationDiffers { key: _, declared_hosts: _, observed_hosts: _ } => fence(group: group, hosts: hosts, cause: D0IncumbentLive { standing: join(pair_realization_agreement_lines(a: a), "; ") })
-            PairRealizationConflict { key: _, host: _, cause: _ } => fence(group: group, hosts: hosts, cause: D0IncumbentLive { standing: join(pair_realization_agreement_lines(a: a), "; ") })
-            PairRealizationDeclarationUnavailable { group: _, obligation: _ } => fence(group: group, hosts: hosts, cause: D0IncumbentLive { standing: join(pair_realization_agreement_lines(a: a), "; ") })
-            PairRealizationUnread { key: _, refusal: _ } => fence(group: group, hosts: hosts, cause: D0IncumbentLive { standing: join(pair_realization_agreement_lines(a: a), "; ") })
-          }
-        IncumbentDidNotAnswer { receipt: rc, head: head } =>
-          match head {
-            HeadEndpointListening { port: pt, rows: rows } => fence(group: group, hosts: hosts, cause: D0IncumbentUnidentified { cause: join([rc as String, "; and ", to_string(length(rows)), " socket(s) LISTEN on port ", to_string(pt), " on the head, so a listener the route did not reach may be the incumbent"], "") as NonEmptyStr })
-            HeadEndpointEngineProcess { listing: l } => fence(group: group, hosts: hosts, cause: D0IncumbentUnidentified { cause: join([rc as String, "; and an engine process is running on the head: ", trim(s: l)], "") as NonEmptyStr })
-            HeadEndpointUnread { cause: c } => fence(group: group, hosts: hosts, cause: D0OccupancyUnread { cause: join([rc as String, "; and the head's socket table or process scan could not be read: ", c as String], "") as NonEmptyStr })
-            HeadEndpointQuiet =>
-          match reconcile_occupancy(declared: d, ranks: observation.ranks) {
-            OccupancyUnread { hosts: _, cause: c } => fence(group: group, hosts: hosts, cause: D0OccupancyUnread { cause: join([rc as String, "; and ", c as String], "") as NonEmptyStr })
-            OccupancyNotQuiet { live: lv } => fence(group: group, hosts: hosts, cause: D0IncumbentUnidentified { cause: join([rc as String, "; and the declared serving unit is ACTIVE on [", hosts_wire(hs: lv), "], so an occupant is running behind the failed connect"], "") as NonEmptyStr })
-            DeclaredOccupantDrifted { drifted: ds } =>
-              D0DecidedSuspend {
-                next: SuspendedForAuthorizedSuccessor { group: group, hosts: hosts, authorization: authorization, exact_candidate_realization: candidate, lease: lease, cleanup: cleanup },
-                reconciliation: DeclaredOccupantDrifted { drifted: ds },
-              }
-          }
-          }
-      }
-  }
-}
-
-// ── THE RELEASE DECISION: EVERY READING QUIESCENT, OR A FENCE NAMING THE ONE THAT IS NOT ──────────
-//
-// The front door must not answer at all (an answering incumbent, identified or not, is something
-// serving), the head must be quiet (no listener on the enrolled port, no engine process), and EVERY
-// granted host's own occupancy must read with no occupant -- no pair unit running and no GPU compute
-// process. An unread host, or a host the observation has no reading for, is not quiescent: absence is
-// not vacancy. Any of these fences for an operator, exactly as the suspension's refusals do; nothing
-// is stopped and nothing is released.
-fn vacancy_cause(host: HostIdentity, vacancy: List<RankVacancyReading>) -> String? {
-  match first(filter(vacancy, v => host_identity_eq(a: v.host, b: host))) {
-    Absent => Present { value: join([host as String, ": no occupancy reading was taken"], "") }
-    Present { value: v } =>
-      match v.reading {
-        HostOccupancyUnread { cause: c } => Present { value: join([host as String, ": occupancy unread: ", c], "") }
-        HostOccupancyRead { occupants: occ, available: _ } =>
-          if length(occ) == 0 { none } else { Present { value: join([host as String, " is occupied: ", join(map(occ, o => host_occupant_wire(o: o)), "; ")], "") } }
-      }
-  }
-}
-
-fn release_not_quiet(group: FabricGroup, hosts: List<HostIdentity>, cause: String) -> D0Decision {
-  fence(group: group, hosts: hosts, cause: D0HostNotQuiescent { cause: cause as NonEmptyStr })
-}
-
-fn d0_decide_release(observation: D0Observation, hosts: List<HostIdentity>) -> D0Decision {
-  let group = observation.group
-  match observation.incumbent {
-    IncumbentRouteUnread { cause: c } => fence(group: group, hosts: hosts, cause: D0OccupancyUnread { cause: c })
-    IncumbentAnsweredUnread { cause: c } => release_not_quiet(group: group, hosts: hosts, cause: join(["the front door answered: ", c as String], ""))
-    IncumbentAnswered { agreement: a } => release_not_quiet(group: group, hosts: hosts, cause: join(["the front door answered and serves: ", join(pair_realization_agreement_lines(a: a), "; ")], ""))
-    IncumbentDidNotAnswer { receipt: rc, head: head } =>
-      match head {
-        HeadEndpointListening { port: pt, rows: rows } => release_not_quiet(group: group, hosts: hosts, cause: join([rc as String, "; and ", to_string(length(rows)), " socket(s) LISTEN on port ", to_string(pt), " on the head"], ""))
-        HeadEndpointEngineProcess { listing: l } => release_not_quiet(group: group, hosts: hosts, cause: join([rc as String, "; and an engine process is running on the head: ", trim(s: l)], ""))
-        HeadEndpointUnread { cause: c } => fence(group: group, hosts: hosts, cause: D0OccupancyUnread { cause: join([rc as String, "; and the head's socket table or process scan could not be read: ", c as String], "") as NonEmptyStr })
-        HeadEndpointQuiet => {
-          let causes = flat_map(hosts, h => match vacancy_cause(host: h, vacancy: observation.vacancy) { Present { value: c } => [c]  Absent => [] as List<String> })
-          if length(hosts) == 0 { release_not_quiet(group: group, hosts: hosts, cause: "the grant names no host, so no host was read quiescent") }
-          else if length(causes) != 0 { release_not_quiet(group: group, hosts: hosts, cause: join(causes, "; ")) }
-          else { D0DecidedRelease { group: group, hosts: hosts } }
-        }
-      }
-  }
-}
-
-// THE NEXT AUTHORITY, WITH THE ENTRY-STATE RECEIPT'S IDENTITY: a release names the recorded receipt it
-// was decided from as its release_receipt, which exists only once the receipt is on the log -- so the
-// next state is built after the receipt is recorded, never before.
-fn d0_decision_next(d: D0Decision, entry_state: ContentHash) -> PairServingGroupAuthority {
-  match d {
-    D0DecidedSuspend { next: n, reconciliation: _ } => n
-    D0DecidedRestore { next: n, key: _ } => n
-    D0DecidedFence { next: n, cause: _ } => n
-    D0DecidedRelease { group: g, hosts: _ } => ReleasedToFleet { group: g, release_receipt: entry_state }
-  }
-}
-
-fn d0_decision_is_eligible(d: D0Decision) -> Bool {
-  match d {
-    D0DecidedSuspend { next: _, reconciliation: _ } => true
-    D0DecidedRestore { next: _, key: _ } => false
-    D0DecidedFence { next: _, cause: _ } => false
-    D0DecidedRelease { group: _, hosts: _ } => true
-  }
-}
-
-// ── THE ENTRY-STATE RECEIPT ────────────────────────────────────────────────────────────────────
-
-type EntryStateReceipt {
-  group: FabricGroup
-  transaction: NonEmptyStr
-  at: String
-  observation: D0Observation
-  decision: D0Decision
-}
-
-// THE RECEIPT'S IDENTITY IS THE STORE'S CONTENT ADDRESS OF ITS BYTES: the id of the
-// EntryStateRecorded event the log appended (the fabric DB's object ref, a content-hash wire over
-// the object's preimage), carried on the settling transition as a ContentHash so a reader fetches
-// the bytes by it from the one placed store. A local convenience copy is derived from that id,
-// never from the transaction's text: a NonEmptyStr admits path-significant characters and is not
-// a path segment.
-fn entry_state_identity(id: EventId) -> ContentHash? {
-  parse_content_hash(wire: id as String)
-}
-
-fn entry_state_receipt_path(id: EventId) -> String {
-  join(["target/pair-serving-d0-entry-", id as String, ".txt"], "")
-}
-
-fn occupancy_line(r: RankOccupancyReading) -> String {
-  let o = match r.occupancy {
-    UnitInstalled { active: a, unit_digest: d } => join(["installed active=", if a { "true" } else { "false" }, " unit=", serialize_content_hash(hash: d) as String], "")
-    UnitNotInstalled => "not-installed"
-    UnitOccupancyUnread { refusal: why } => join(["unread: ", serving_incarnation_refusal_text(r: why)], "")
-  }
-  join(["  rank ", r.host as String, " ", r.unit_name as String, ": ", o], "")
-}
-
-fn vacancy_line(v: RankVacancyReading) -> String {
-  join(["  host ", v.host as String, " occupancy: ", match v.reading {
-    HostOccupancyUnread { cause: c } => join(["unread: ", c], "")
-    HostOccupancyRead { occupants: occ, available: _ } => if length(occ) == 0 { "no occupant" } else { join(map(occ, o => host_occupant_wire(o: o)), "; ") }
-  }], "")
-}
-
-fn incumbent_lines(i: IncumbentReading) -> List<String> {
-  match i {
-    IncumbentAnswered { agreement: a } => concat(["  incumbent answered:"], map(pair_realization_agreement_lines(a: a), l => join(["  ", l], "")))
-    IncumbentAnsweredUnread { cause: c } => [join(["  incumbent answered but unidentified: ", c as String], "")]
-    IncumbentDidNotAnswer { receipt: r, head: h } => [join(["  incumbent did not answer: ", r as String, "; head endpoint: ", head_endpoint_line(h: h)], "")]
-    IncumbentRouteUnread { cause: c } => [join(["  incumbent route unread: ", c as String], "")]
-  }
-}
-
-fn head_endpoint_line(h: HeadEndpointReading) -> String {
-  match h {
-    HeadEndpointQuiet => "quiet (no listener on the enrolled port, no engine process)"
-    HeadEndpointListening { port: p, rows: rs } => join([to_string(length(rs)), " LISTEN socket(s) on port ", to_string(p)], "")
-    HeadEndpointEngineProcess { listing: l } => join(["engine process present: ", trim(s: l)], "")
-    HeadEndpointUnread { cause: c } => join(["unread: ", c as String], "")
-  }
-}
-
-fn reconciliation_line(r: OccupancyReconciliation) -> String {
-  match r {
-    OccupancyNotQuiet { live: lv } => join(["  reconciliation: occupancy-not-quiet, active on [", hosts_wire(hs: lv), "]"], "")
-    DeclaredOccupantDrifted { drifted: ds } => join(["  reconciliation: declared-occupant-drifted ", join(map(ds, h => h as String), ",")], "")
-    OccupancyUnread { hosts: hs, cause: c } => join(["  reconciliation: occupancy-unread ", join(map(hs, h => h as String), ","), ": ", c as String], "")
-  }
-}
-
-fn decision_lines(d: D0Decision) -> List<String> {
-  match d {
-    D0DecidedSuspend { next: n, reconciliation: r } => ["verdict: d0-eligible", reconciliation_line(r: r), join(["  authority: ", authority_wire(a: n)], "")]
-    D0DecidedRestore { next: n, key: k } => ["verdict: d0-refused incumbent-live-restored", join(["  key: ", serialize_content_hash(hash: k) as String], ""), join(["  authority: ", authority_wire(a: n)], "")]
-    D0DecidedFence { next: n, cause: _ } => ["verdict: d0-refused fenced", join(["  authority: ", authority_wire(a: n)], "")]
-    D0DecidedRelease { group: g, hosts: hs } => ["verdict: d0-release-eligible", join(["  every host quiescent: [", hosts_wire(hs: hs), "]; the group's authority is released to the fleet under this receipt"], "")]
-  }
-}
-
-fn entry_state_receipt_body(r: EntryStateReceipt) -> String {
-  join(concat(
-    [join(["pair serving d0 entry state at ", r.at, " transaction=", r.transaction as String, " group=", fabric_group_wire(g: r.group) as String], "")],
-    concat(incumbent_lines(i: r.observation.incumbent), concat(map(r.observation.ranks, o => occupancy_line(r: o)), concat(map(r.observation.vacancy, v => vacancy_line(v: v)), decision_lines(d: r.decision)))),
-  ), "\n")
-}
-
-data pair_serving_d0_attempt_raw: String = "pair-serving-d0"
-
-// ── THE OBSERVATION, OVER THE FLEET ────────────────────────────────────────────────────────────
-
-// A REFUSED UNIT DECLARATION IS CARRIED AS EACH DECLARED RANK'S CAUSE, not dropped: the receipt is
-// evidence, and "no reading was taken" is not what happened when the desired unit could not be
-// derived. Every declared rank reads Unread with the declaration's own refusal.
-fn observe_ranks(context: FleetSshExecutionContext, group: FabricGroup, declared: DeclaredPairRealizationStanding) -> List<RankOccupancyReading> {
-  match spark_pair_serving_unit(group: group) {
-    SparkPairServingUnitRefused { group: _, cause: c } =>
-      match declared {
-        DeclaredPairRealizationUnavailable { group: _, obligation: _ } => [] as List<RankOccupancyReading>
-        DeclaredPairRealizationKeyed { declared: d } =>
-          map(concat([d.head], d.workers), r => RankOccupancyReading { host: r.host, unit_name: r.unit_name, occupancy: UnitOccupancyUnread { refusal: IncarnationUnitPropertyUnread { unit: r.unit_name, property: "desired-unit" as NonEmptyStr, cause: join(["the desired pair serving unit could not be derived: ", c as String], "") } } })
-      }
-    SparkPairServingUnitReady { group: _, engine: _, head: h, workers: ws } =>
-      concat(
-        [RankOccupancyReading { host: h.host, unit_name: spark_pair_head_unit_name, occupancy: read_unit_occupancy(transport: FleetSsh { target: fleet_locus_ssh_target(host: h.host), context: context }, unit: spark_pair_head_unit_name) }],
-        map(ws, w => RankOccupancyReading { host: w.host, unit_name: spark_pair_worker_unit_name, occupancy: read_unit_occupancy(transport: FleetSsh { target: fleet_locus_ssh_target(host: w.host), context: context }, unit: spark_pair_worker_unit_name) }),
-      )
-  }
-}
-
-// THE FRONT DOOR DECIDES PRESENCE; METRICS ONLY IDENTIFIES. A live incumbent can serve /v1/models
-// and requests while /metrics is disabled, proxied elsewhere or malformed, so a failed metrics
-// read establishes nothing about presence. The enrolled serving front door is asked for its
-// STATUS within the bound (harness_bounded_presence, which does not fail on 4xx/5xx): only NO
-// HTTP response is absence; a 401 or a 500 is an incumbent that answered and could not be read,
-// which fences. A 2xx lets metrics name the incarnation -- and when they cannot, the incumbent is
-// answering and unidentified, which fences too.
-//
-// The front-door reading is its own fn over the ENDPOINT so its transport can be executed against
-// a local listener that answers a chosen status: the distinction between "answered 500" and "no
-// response" lives in http.Client.StatusWithin's argv, and a control over a supplied reading cannot
-// notice that argv regaining -f.
-// "NO HTTP RESPONSE" IS NOT ABSENCE. A failed connect (curl 7) is the only failure under which
-// absence can still be ESTABLISHED, and not by the transport: the reading is NoStatus and the
-// decision corroborates it against the head rank's own unit occupancy (a readable, inactive or
-// uninstalled declared unit on the head host); a deadline is a listener that may have accepted
-// and did not answer -- a stalled engine is an incumbent -- and a transport that could not be read
-// establishes nothing. Those two are Unread and fence. An earlier shape read every failure as
-// silence, and a group whose engine hung would have been suspended out from under it.
-type FrontDoorReading
-  = FrontDoorNoStatus { receipt: NonEmptyStr }
-  | FrontDoorAnsweredUnread { cause: NonEmptyStr }
-  | FrontDoorUnread { cause: NonEmptyStr }
-  | FrontDoorAnswered
-
-fn observe_front_door(endpoint: ServingRouteEndpoint) -> FrontDoorReading {
-  let front_door = harness_models_url(endpoint: endpoint)
-  match harness_bounded_presence(url: front_door) {
-    HarnessConnectFailed { url: u, curl_exit: code } =>
-      FrontDoorNoStatus { receipt: join(["the serving front door at ", u, " could not be connected within the front-door bound (curl exit ", to_string(code), "); absence is established only by the head rank's unit occupancy"], "") as NonEmptyStr }
-    HarnessDeadline { url: u } =>
-      FrontDoorUnread { cause: join(["the serving front door at ", u, " did not answer within the front-door bound: a listener may have accepted, and its state is unread"], "") as NonEmptyStr }
-    HarnessTransportUnread { url: u, curl_exit: code } =>
-      FrontDoorUnread { cause: join(["the serving front door at ", u, " could not be read (curl exit ", to_string(code), "), so nothing is established about the incumbent"], "") as NonEmptyStr }
-    HarnessResponded { status: status } =>
-      if starts_with(s: status, prefix: "2") {
-        FrontDoorAnswered
-      } else {
-        FrontDoorAnsweredUnread { cause: join(["the front door at ", front_door, " answered with HTTP ", status, ": an incumbent is there and its service could not be read"], "") as NonEmptyStr }
-      }
-  }
-}
-
-// The incumbent reading a front-door answer decides on its own: Absent only when the door
-// answered 2xx and identification must follow.
-// The incumbent reading a front-door answer decides on its own, with the head's endpoint reading
-// SUPPLIED for the no-status arm (the observer takes it only then); Absent only when the door
-// answered 2xx and identification must follow.
-fn front_door_as_incumbent(r: FrontDoorReading, head: fn() -> HeadEndpointReading) -> IncumbentReading? {
-  match r {
-    FrontDoorNoStatus { receipt: rc } => Present { value: IncumbentDidNotAnswer { receipt: rc, head: head() } }
-    FrontDoorAnsweredUnread { cause: c } => Present { value: IncumbentAnsweredUnread { cause: c } }
-    FrontDoorUnread { cause: c } => Present { value: IncumbentRouteUnread { cause: c } }
-    FrontDoorAnswered => none
-  }
-}
-
-fn identify_incumbent(context: FleetSshExecutionContext, group: FabricGroup, declared: DeclaredPairRealizationStanding, endpoint: ServingRouteEndpoint) -> IncumbentReading {
-  let front_door = harness_models_url(endpoint: endpoint)
-  let url = harness_metrics_url(endpoint: endpoint)
-  let read = harness_bounded_get(url: url)
-  if !read.success {
-    IncumbentAnsweredUnread { cause: join(["the front door at ", front_door, " answered but the metrics endpoint at ", url, " did not, so the answering launch cannot be named"], "") as NonEmptyStr }
-  } else {
-    match harness_launch_from_body(group: group, address: serving_route_endpoint_wire(e: endpoint) as String, body: read.body) {
-      LaunchUnobserved { group: _, obligation: o } => IncumbentAnsweredUnread { cause: o }
-      LaunchObserved { launch: launch, receipt: _ } =>
-        IncumbentAnswered { agreement: pair_realization_agreement(declared: declared, observed: observe_pair_realization(context: context, group: group, endpoint: launch)) }
-    }
-  }
-}
-
-// THE HEAD'S OWN FRONT DOOR: the socket tables for a LISTEN on the enrolled port, then the engine
-// process scan; taken over the fleet transport to the declared head host.
-fn observe_head_endpoint(context: FleetSshExecutionContext, declared: DeclaredPairRealizationStanding, port: Port) -> HeadEndpointReading {
-  match declared {
-    DeclaredPairRealizationUnavailable { group: _, obligation: o } => HeadEndpointUnread { cause: join(["no declared head to read: ", o as String], "") as NonEmptyStr }
-    DeclaredPairRealizationKeyed { declared: d } => {
-      let target = fleet_locus_ssh_target(host: d.head.host)
-      match read_endpoint_listener(transport: FleetSsh { target: target, context: context }, port: port) {
-        EndpointListenerUnread { port: _, cause: c } => HeadEndpointUnread { cause: c as NonEmptyStr }
-        EndpointListening { port: p, rows: rs } => HeadEndpointListening { port: p, rows: rs }
-        EndpointNoListener { port: _ } =>
-          match scan_engine_processes(target: target, context: context, pattern: sparkrun_vllm_ds4_gb10_vllm_binary) {
-            EngineScanLegDidNotRun { cause: c } => HeadEndpointUnread { cause: join(["the engine process scan did not run: ", c], "") as NonEmptyStr }
-            EngineScanClassified { outcome: PgrepScanFailed { exit_code: code, stderr: err } } => HeadEndpointUnread { cause: join(["the engine process scan failed (exit ", to_string(code), "): ", err], "") as NonEmptyStr }
-            EngineScanClassified { outcome: PgrepMatched { listing: l } } => HeadEndpointEngineProcess { listing: l }
-            EngineScanClassified { outcome: PgrepNoMatch } => HeadEndpointQuiet
-          }
-      }
-    }
-  }
-}
-
-fn observe_incumbent(context: FleetSshExecutionContext, group: FabricGroup, declared: DeclaredPairRealizationStanding) -> IncumbentReading {
-  match serving_route(group: group) {
-    ServingRouteUnresolved { group: _, obligation: o } => IncumbentRouteUnread { cause: o }
-    ServingRouteResolved { endpoint: endpoint, ceiling: _ } =>
-      match front_door_as_incumbent(r: observe_front_door(endpoint: endpoint), head: fn() { observe_head_endpoint(context: context, declared: declared, port: endpoint.port) }) {
-        Present { value: decided } => decided
-        Absent => identify_incumbent(context: context, group: group, declared: declared, endpoint: endpoint)
-      }
-  }
-}
-
-fn observe_vacancy(context: FleetSshExecutionContext, group: FabricGroup) -> List<RankVacancyReading> {
-  map(fabric_group_hosts(g: group), h => RankVacancyReading {
-    host: h,
-    reading: read_host_occupancy(run: fn(argv) { fleet_argv_run(context: context, host: h, argv: argv) }, units: [spark_pair_head_unit_name, spark_pair_worker_unit_name]),
-  })
-}
-
-fn observe_d0(context: FleetSshExecutionContext, group: FabricGroup, declared: DeclaredPairRealizationStanding) -> D0Observation {
-  D0Observation { group: group, incumbent: observe_incumbent(context: context, group: group, declared: declared), ranks: observe_ranks(context: context, group: group, declared: declared), vacancy: observe_vacancy(context: context, group: group) }
-}
-
-// ── THE TRANSACTION ────────────────────────────────────────────────────────────────────────────
-
-fn refuse(reason: String) -> ProcessExit {
-  exit_failure(reason: join(["pair_serving_d0: ", reason], ""))
-}
-
-// THE AUTHORITY MOVED BUT ITS PLACEMENT DID NOT FINALIZE is its own terminal: the group's saga is
-// still pending (fencing its hosts, refusing every later saga), so the consent is NOT complete --
-// the claim stays held, and a rerun finalizes the placement from the join before it completes.
-type D0Outcome
-  = D0Settled { decision: D0Decision, generation: Nat, receipt_path: String, entry_state: ContentHash }
-  | D0PlacementStillFencing { decision: D0Decision?, generation: Nat, entry_state: ContentHash?, preparation: EventId?, cause: String }
-  | D0Refused { cause: String }
-
-
-fn d0_outcome_is_eligible(o: D0Outcome) -> Bool {
-  match o {
-    D0Settled { decision: d, generation: _, receipt_path: _, entry_state: _ } => d0_decision_is_eligible(d: d)
-    D0PlacementStillFencing { decision: _, generation: _, entry_state: _, preparation: _, cause: _ } => false
-    D0Refused { cause: _ } => false
-  }
-}
-
-fn d0_outcome_text(o: D0Outcome) -> String {
-  match o {
-    D0Settled { decision: d, generation: g, receipt_path: p, entry_state: es } =>
-      join(concat(decision_lines(d: d), [join(["  settled at generation ", to_string(g), " entry-state ", serialize_content_hash(hash: es) as String, " receipt ", p], "")]), "\n")
-    D0PlacementStillFencing { decision: d, generation: g, entry_state: es, preparation: pr, cause: c } =>
-      join(concat(match d { Absent => ["  (the transfer into suspension landed; nothing was read yet)"]  Present { value: dd } => decision_lines(d: dd) }, [join(["  the authority moved at generation ", to_string(g), match es { Absent => ""  Present { value: h } => join([" entry-state ", serialize_content_hash(hash: h) as String], "") }, " but its placement preparation ", (match pr { Absent => "(could not be named)"  Present { value: id } => id as String }), " did not finalize: ", c, "; the consent is not complete -- a rerun under this transaction finalizes it from the join"], "")]), "
-")
-    D0Refused { cause: c } => join(["pair_serving_d0 refused: ", c], "")
-  }
-}
-
-fn transition_text(t: AuthorityTransition) -> String {
-  match t {
-    AuthorityTransitionAppended { id: i, generation: g, next: _, placement: pl } => join(["appended ", i as String, " at generation ", to_string(g), "; ", placement_cleanup_line(c: pl)], "")
-    AuthorityTransitionStale { expected: e, current: c, placement: pl } => join(["stale: expected ", authority_wire(a: e), " but the authority is ", authority_wire(a: c), match pl { Absent => ""  Present { value: x } => join(["; ", placement_cleanup_line(c: x)], "") }], "")
-    AuthorityTransitionRefused { group: _, step: st, reason: why, placement: pl } => join(["refused at ", st, ": ", why, match pl { Absent => ""  Present { value: x } => join(["; ", placement_cleanup_line(c: x)], "") }], "")
-  }
-}
-
-// THE SETTLE: readings taken under the pending state, decided, the receipt written and digested,
-// then ONE compare-and-set naming the receipt. The exit is decided from the transition ARM, never
-// from its rendered text.
-//
-// THE GRANT RIDES ONLY INTO THE LEASED TERMINAL. A restore to Active and a fence hold no lease,
-// and the log refuses a grant carried into a state with none -- so those two terminals write the
-// transition without one, and only the suspension carries the term minted from the admitting
-// write. An earlier shape carried it on every arm and could reach neither.
-fn d0_settle(store: FabricStorageBinding, pending: PairServingGroupAuthority, head: HeadExpectation, active: PairServingGroupAuthority, lease: HeldLease, admitted: AdmittedD0Grant, admitting: EventId, pending_generation: Nat, transaction: NonEmptyStr, executor: NonEmptyStr, at: EpochSecs, now: Timestamp, declared: DeclaredPairRealizationStanding, observation: D0Observation) -> D0Outcome {
-  let group = observation.group
-  let decision = d0_decide(declared: declared, observation: observation, active: active, lease: lease, grant: admitted.grant)
-  let receipt = EntryStateReceipt { group: group, transaction: transaction, at: now, observation: observation, decision: decision }
-  let body = entry_state_receipt_body(r: receipt)
-  match pair_serving_authority_record_entry_state(store: store, group: group, expected_head: head, transaction: transaction, body: body, actor: executor, at: at) {
-    EntryStateRecordRefused { step: st, reason: why } =>
-      D0Refused { cause: join(["the entry-state receipt could not be recorded on the log before settling, so the authority was not moved: ", st, ": ", why], "") }
-    EntryStateRecordStale { observed: _ } =>
-      D0Refused { cause: "another writer moved the partition while the entry-state receipt was being recorded, so the authority was not moved by this run" }
-    EntryStateRecordedAt { id: record } =>
-      match entry_state_identity(id: record) {
-        Absent => D0Refused { cause: join(["the recorded receipt's id ", record as String, " is not a content hash, so the settling write cannot name it"], "") }
-        Present { value: digest } => {
-          let path = entry_state_receipt_path(id: record)
-          let wr = Filesystem.Write(path: path, content: body)
-          let term = match decision {
-            D0DecidedSuspend { next: _, reconciliation: _ } =>
-              match admitted.grant.subject.operation {
-                D0SuspendForSuccessor { successor: _, cleanup: _, term: t } => Present { value: lease_grant(reference: transaction, fence: lease_fence_of(admitting_event: admitting, generation: pending_generation), granted_at: at, policy: d0_lease_policy(term: t)) }
-                D0ReleaseToFleet { cause: _, approval: _ } => none
-              }
-            D0DecidedRestore { next: _, key: _ } => none
-            D0DecidedFence { next: _, cause: _ } => none
-            D0DecidedRelease { group: _, hosts: _ } => none
-          }
-          match pair_serving_authority_transition(store: store, group: group, expected: pending, next: d0_decision_next(d: decision, entry_state: digest), transaction: transaction, lifecycle: Present { value: admitted.binding }, grant: term, entry_state: Present { value: digest }, actor: executor, at: at) {
-            AuthorityTransitionAppended { id: _, generation: g, next: _, placement: PlacementFinalizedAt { preparation: _, id: _ } } =>
-              D0Settled { decision: decision, generation: g, receipt_path: if wr.success { path } else { join(["(local copy not written: ", wr.error, ")"], "") }, entry_state: digest }
-            AuthorityTransitionAppended { id: _, generation: g, next: _, placement: PlacementCleanupStillFencing { preparation: pr, cause: c } } =>
-              D0PlacementStillFencing { decision: Present { value: decision }, generation: g, entry_state: Present { value: digest }, preparation: Present { value: pr }, cause: c }
-            AuthorityTransitionAppended { id: _, generation: g, next: _, placement: PlacementCleanupUnread { cause: c } } =>
-              D0PlacementStillFencing { decision: Present { value: decision }, generation: g, entry_state: Present { value: digest }, preparation: none, cause: c }
-            AuthorityTransitionAppended { id: _, generation: g, next: _, placement: PlacementAbortedAt { preparation: pr, id: _ } } =>
-              D0PlacementStillFencing { decision: Present { value: decision }, generation: g, entry_state: Present { value: digest }, preparation: Present { value: pr }, cause: "the authority landed but its preparation reads aborted -- the placement and the authority disagree; operator" }
-            AuthorityTransitionStale { expected: e, current: c, placement: pl } => D0Refused { cause: join(["the settling write did not land; the authority is as the log says: ", transition_text(t: AuthorityTransitionStale { expected: e, current: c, placement: pl })], "") }
-            AuthorityTransitionRefused { group: gr, step: st, reason: why, placement: pl } => D0Refused { cause: join(["the settling write did not land: ", transition_text(t: AuthorityTransitionRefused { group: gr, step: st, reason: why, placement: pl })], "") }
-          }
-        }
-      }
-  }
-}
-
-// THE TRANSACTION OVER A SUPPLIED OBSERVER. Takes the admitted grant and a function that reads
-// the fleet under the pending state; the wet entry supplies the fleet observer, its real-execution
-// witness supplies a fixture. Active takes the first write -- after re-checking that the grant's
-// host population is still the group's, since this is the last point before the authority moves;
-// pending under the SAME transaction AND the same authorization binding resumes from the readings
-// and restores, if it restores, the EXACT Active state the first write left (the log's `previous`
-// for the pending state -- never the resting row, which may not be what was suspended); anything
-// else refuses without a write. THE LEASE EPOCH IS MINTED FOR THE GENERATION THE READ SAW, and the
-// first write is a transition AT THAT READ'S HEAD (pair_serving_authority_transition_at): a state
-// that left and came back is the same value at another generation, and a value-only compare-and-set
-// would land a pending state whose lease epoch is not the generation that landed -- a grant fence
-// the genealogy then refuses, stranding the group. Head-exact, the landed generation is gen + 1.
-fn d0_transaction(store: FabricStorageBinding, group: FabricGroup, current_hosts: List<HostIdentity>, admitted: AdmittedD0Grant, transaction: NonEmptyStr, executor: NonEmptyStr, at: EpochSecs, now: Timestamp, observe: fn(FabricGroup) -> D0Observation) -> D0Outcome {
-  match current_pair_serving_authority(store: store, group: group, at: at) {
-    CurrentAuthorityUnread { group: _, step: st, reason: why } => D0Refused { cause: join(["authority unread at ", st, ": ", why], "") }
-    CurrentAuthorityRead { authority: cur, head: head, generation: gen, grant: _, entry_state: _, previous: previous, admitted_by: admitted_by, transitions: _ } =>
-      match cur {
-        PairServingActive { group: _, exact_realization: _ } =>
-          match d0_population(subject: admitted.grant.subject, current: current_hosts) {
-            D0PopulationDiffers { granted: gr, current: cu } =>
-              D0Refused { cause: join(["the grant's host population [", hosts_wire(hs: gr), "] is not the group's current population [", hosts_wire(hs: cu), "], so nothing is moved"], "") }
-            D0PopulationAgrees => {
-              let lease = d0_held_lease(group: group, transaction: transaction, executor: executor, generation: gen + 1)
-              let pending = SuspensionPendingReconciliation { group: group, hosts: admitted.grant.subject.hosts, transaction: transaction, authorization_binding: admitted.binding, lease: lease }
-              match pair_serving_authority_transition_at(store: store, group: group, expected: cur, expected_head: Present { value: head }, next: pending, transaction: transaction, lifecycle: Present { value: admitted.binding }, grant: none, entry_state: none, actor: executor, at: at) {
-                AuthorityTransitionAppended { id: admitting, generation: pending_generation, next: _, placement: PlacementFinalizedAt { preparation: _, id: _ } } =>
-                  d0_settle(store: store, pending: pending, head: HeadAt { id: admitting }, active: cur, lease: lease, admitted: admitted, admitting: admitting, pending_generation: pending_generation, transaction: transaction, executor: executor, at: at, now: now, declared: declared_pair_realization(group: group), observation: observe(group))
-                AuthorityTransitionAppended { id: _, generation: pending_generation, next: _, placement: PlacementCleanupStillFencing { preparation: pr, cause: c } } =>
-                  D0PlacementStillFencing { decision: none, generation: pending_generation, entry_state: none, preparation: Present { value: pr }, cause: c }
-                AuthorityTransitionAppended { id: _, generation: pending_generation, next: _, placement: PlacementCleanupUnread { cause: c } } =>
-                  D0PlacementStillFencing { decision: none, generation: pending_generation, entry_state: none, preparation: none, cause: c }
-                AuthorityTransitionAppended { id: _, generation: pending_generation, next: _, placement: PlacementAbortedAt { preparation: pr, id: _ } } =>
-                  D0PlacementStillFencing { decision: none, generation: pending_generation, entry_state: none, preparation: Present { value: pr }, cause: "the placement and the authority disagree; operator" }
-                AuthorityTransitionStale { expected: e, current: c, placement: pl } => D0Refused { cause: join(["the transfer into suspension did not land: ", transition_text(t: AuthorityTransitionStale { expected: e, current: c, placement: pl })], "") }
-                AuthorityTransitionRefused { group: gr, step: st, reason: why, placement: pl } => D0Refused { cause: join(["the transfer into suspension did not land: ", transition_text(t: AuthorityTransitionRefused { group: gr, step: st, reason: why, placement: pl })], "") }
-              }
-            }
-          }
-        SuspensionPendingReconciliation { group: _, transaction: pending_tx, authorization_binding: pending_binding, lease: lease } =>
-          if (pending_tx as String) != (transaction as String) {
-            D0Refused { cause: join(["the group is pending under transaction ", pending_tx as String, ", which only that transaction may settle"], "") }
-          } else if !content_hash_equal(left: pending_binding, right: admitted.binding) {
-            D0Refused { cause: "the group is pending under this transaction but under a different authorization (escalation, attempt, intent, subject or executor differ), so this run may not settle it" }
-          } else {
-            match admitted_by {
-              Absent => D0Refused { cause: "the group is pending but no transition admitted that state, so the admitting event cannot be named" }
-              Present { value: admitting } =>
-                match previous {
-                  Absent => D0Refused { cause: "the group is pending but the log carries no previous state for it, so the exact Active state it suspended cannot be restored" }
-                  Present { value: left } =>
-                    match left {
-                      PairServingActive { group: _, exact_realization: _ } =>
-                        d0_settle(store: store, pending: cur, head: head, active: left, lease: lease, admitted: admitted, admitting: admitting, pending_generation: gen, transaction: transaction, executor: executor, at: at, now: now, declared: declared_pair_realization(group: group), observation: observe(group))
-                      SuspensionPendingReconciliation { group: _, hosts: _, transaction: _, authorization_binding: _, lease: _ } => D0Refused { cause: join(["the pending state was not entered from an Active authority (it left ", authority_wire(a: left), "), so this transaction cannot settle it"], "") }
-                      SuspendedForAuthorizedSuccessor { group: _, hosts: _, authorization: _, exact_candidate_realization: _, lease: _, cleanup: _ } => D0Refused { cause: join(["the pending state was not entered from an Active authority (it left ", authority_wire(a: left), "), so this transaction cannot settle it"], "") }
-                      FencedRefusal { group: _, hosts: _, cause: _, disposition_authority: _ } => D0Refused { cause: join(["the pending state was not entered from an Active authority (it left ", authority_wire(a: left), "), so this transaction cannot settle it"], "") }
-                      ReleasedToFleet { group: _, release_receipt: _ } => D0Refused { cause: join(["the pending state was not entered from an Active authority (it left ", authority_wire(a: left), "), so this transaction cannot settle it"], "") }
-                    }
-                }
-            }
-          }
-        SuspendedForAuthorizedSuccessor { group: _, hosts: _, authorization: _, exact_candidate_realization: _, lease: _, cleanup: _ } => D0Refused { cause: join(["the authority is neither active nor pending under this transaction, so there is nothing to suspend or settle: ", authority_wire(a: cur)], "") }
-        FencedRefusal { group: _, hosts: _, cause: _, disposition_authority: _ } => D0Refused { cause: join(["the authority is neither active nor pending under this transaction, so there is nothing to suspend or settle: ", authority_wire(a: cur)], "") }
-        ReleasedToFleet { group: _, release_receipt: _ } => D0Refused { cause: join(["the authority is neither active nor pending under this transaction, so there is nothing to suspend or settle: ", authority_wire(a: cur)], "") }
-      }
-  }
-}
-
-// ── THE RECOVERY: ONE JOIN OVER THE CLAIM AND THE AUTHORITY HISTORY ────────────────────────────
-//
-// The claim and the authority are two durable facts; a run is a path through both and can die at
-// any point on it. So a rerun does not ask "is the authority pending?" and infer the rest: it
-// reads both and decides from the JOIN, pure over supplied readings, so every crash point has
-// exactly one disposition and the witness drives each one.
-//
-//   claim absent                                              → start (decide, claim, first write)
-//   ClaimedBy(T), no transition by T, authority Active        → first write never landed: perform it
-//   ClaimedBy(T), no transition by T, authority not Active    → nothing to do under this consent: abort the claim
-//   ClaimedBy(T), authority Pending(T)                        → resume the readings and settle
-//   ClaimedBy(T), T's last transition landed a non-pending    → settled; only the claim's terminal is owed
-//   ClaimedBy(T), T's last transition landed pending but the
-//     authority is not that pending state                     → another writer moved a pending state
-//                                                               only T may move: fenced for an operator
-//   ClaimedBy(T), no transition by THIS lifecycle, authority
-//     pending under T's word                                  → another authorization lifecycle of the same
-//                                                               word wrote it → refuse; nothing is written.
-//   ClaimedBy(T), Pending(T) under this lifecycle, lease owned
-//     by another executor                                     → refuse; the executor that wrote it resumes.
-//                                                               D0 is same-executor-only for a PENDING
-//                                                               lifecycle (no handoff is modeled); any
-//                                                               executor may complete or abort a claim
-//                                                               whose authority is not pending, since that
-//                                                               mutates no host.
-//   ClaimedBy(other), CompletedBy, AbortedBy, unreadable      → refuse; the consent is not this run's
-//
-// "No transition by T" is decided from the log's own record of every admitted transition, never
-// from the current state: a completed T followed by another transaction's writes would otherwise
-// read as "T never ran" and be started again on a spent consent. AND THE RECORD IS SELECTED BY
-// THE LIFECYCLE, NOT THE TRANSACTION WORD: the word is a branded string nothing allocates
-// uniquely, so a later escalation may reuse it, and a join by the word alone would complete the
-// new consent from the old transaction's terminal. The lifecycle is the authorization binding
-// (escalation, attempt, intent, subject, executor, expiry, claim generation), carried on every
-// D0 transition; the dispatcher digests it from the held claim before asking the join.
-type D0Recovery
-  = D0RecoverStart
-  | D0RecoverFirstWrite { claim_generation: CasGeneration }
-  | D0RecoverResume { claim_generation: CasGeneration }
-  | D0RecoverComplete { claim_generation: CasGeneration, settled: AuthorityTransitionRecord }
-  | D0RecoverAbort { claim_generation: CasGeneration, cause: String }
-  | D0RecoveryRefused { cause: String }
-
-fn d0_unwritten_claim_abort(g: CasGeneration, current: PairServingGroupAuthority) -> D0Recovery {
-  D0RecoverAbort { claim_generation: g, cause: join(["the claim is held but no write landed and the authority is not Active (", authority_wire(a: current), "), so there is nothing this consent can do"], "") }
-}
-
-fn d0_pending_moved_refusal(current: PairServingGroupAuthority) -> D0Recovery {
-  D0RecoveryRefused { cause: join(["this transaction's pending state was moved by another writer (the authority is ", authority_wire(a: current), "); the group needs an operator's disposition"], "") }
-}
-
-fn d0_recovery(claim: D0ClaimReading, transaction: NonEmptyStr, lifecycle: ContentHash?, executor: NonEmptyStr, current: PairServingGroupAuthority, transitions: List<AuthorityTransitionRecord>) -> D0Recovery {
-  match claim {
-    D0ClaimUnreadable { reason: r } => D0RecoveryRefused { cause: r as String }
-    D0ClaimAbsent => D0RecoverStart
-    D0ClaimAt { state: s, generation: g } =>
-      match s {
-        Unclaimed => D0RecoveryRefused { cause: "the claim slot records the grant unclaimed, which no transition writes; the slot needs an operator's inspection" }
-        CompletedBy { attempt: who, completed_at: when } => D0RecoveryRefused { cause: join(["the grant was completed by attempt ", who as String, " at ", when, "; consent is spent"], "") }
-        AbortedBy { attempt: who, aborted_at: _, cause: c } => D0RecoveryRefused { cause: join(["the grant was aborted by attempt ", who as String, ": ", c as String, "; a new decision needs a new escalation"], "") }
-        ClaimedBy { attempt: who, claimed_at: _ } =>
-          if (who as String) != (transaction as String) {
-            D0RecoveryRefused { cause: join(["the grant is held by attempt ", who as String, ", not this transaction"], "") }
-          } else {
-            match lifecycle {
-              Absent => D0RecoveryRefused { cause: "the grant is held by this transaction but no admitted authorization binding was supplied, so its history on the log cannot be identified" }
-              Present { value: binding } =>
-            match last(transitions_by(records: transitions, transaction: transaction, lifecycle: binding)) {
-              Absent =>
-                match current {
-                  PairServingActive { group: _, exact_realization: _ } => D0RecoverFirstWrite { claim_generation: g }
-                  SuspensionPendingReconciliation { group: _, transaction: pt, authorization_binding: _, lease: l } =>
-                    if (pt as String) == (transaction as String) {
-                      D0RecoveryRefused { cause: join(["the authority is pending under this transaction's word but under another authorization lifecycle (lease owner ", serialize_content_hash(hash: l.epoch.owner_fingerprint) as String, "); only that lifecycle may settle it, and this run neither aborts the claim nor moves the authority"], "") }
-                    } else {
-                      D0RecoverAbort { claim_generation: g, cause: join(["the claim is held but no write landed and the authority is pending under another transaction (", pt as String, "), so there is nothing this consent can do"], "") }
-                    }
-                  SuspendedForAuthorizedSuccessor { group: _, authorization: _, exact_candidate_realization: _, lease: _, cleanup: _ } => d0_unwritten_claim_abort(g: g, current: current)
-                  FencedRefusal { group: _, cause: _, disposition_authority: _ } => d0_unwritten_claim_abort(g: g, current: current)
-                  ReleasedToFleet { group: _, release_receipt: _ } => d0_unwritten_claim_abort(g: g, current: current)
-                }
-              Present { value: mine } =>
-                match mine.next {
-                  SuspensionPendingReconciliation { group: _, transaction: _, authorization_binding: _, lease: _ } =>
-                    match current {
-                      SuspensionPendingReconciliation { group: _, transaction: pt, authorization_binding: pb, lease: l } =>
-                        if (pt as String) != (transaction as String) {
-                          D0RecoveryRefused { cause: join(["the authority is pending under ", pt as String, ", not this transaction"], "") }
-                        } else if !content_hash_equal(left: pb, right: binding) {
-                          D0RecoveryRefused { cause: "the authority is pending under this transaction's word but another authorization's binding; only that lifecycle may settle it" }
-                        } else if !content_hash_equal(left: l.epoch.owner_fingerprint, right: content_hash_of_value(value: executor)) {
-                          D0RecoveryRefused { cause: join(["the pending transaction is owned by another executor (lease owner ", serialize_content_hash(hash: l.epoch.owner_fingerprint) as String, "); a resume runs there, and no handoff is modeled -- the claim and the authority are left as they are"], "") }
-                        } else {
-                          D0RecoverResume { claim_generation: g }
-                        }
-                      PairServingActive { group: _, exact_realization: _ } => d0_pending_moved_refusal(current: current)
-                      SuspendedForAuthorizedSuccessor { group: _, authorization: _, exact_candidate_realization: _, lease: _, cleanup: _ } => d0_pending_moved_refusal(current: current)
-                      FencedRefusal { group: _, cause: _, disposition_authority: _ } => d0_pending_moved_refusal(current: current)
-                      ReleasedToFleet { group: _, release_receipt: _ } => d0_pending_moved_refusal(current: current)
-                    }
-                  PairServingActive { group: _, exact_realization: _ } => D0RecoverComplete { claim_generation: g, settled: mine }
-                  SuspendedForAuthorizedSuccessor { group: _, authorization: _, exact_candidate_realization: _, lease: _, cleanup: _ } => D0RecoverComplete { claim_generation: g, settled: mine }
-                  FencedRefusal { group: _, cause: _, disposition_authority: _ } => D0RecoverComplete { claim_generation: g, settled: mine }
-                  ReleasedToFleet { group: _, release_receipt: _ } => D0RecoverComplete { claim_generation: g, settled: mine }
-                }
-            }
-            }
-          }
-      }
-  }
-}
-
-fn d0_recovery_text(r: D0Recovery) -> String {
-  match r {
-    D0RecoverStart => "start"
-    D0RecoverFirstWrite { claim_generation: _ } => "recover: the claim is held and the first write never landed; performing it"
-    D0RecoverResume { claim_generation: _ } => "resume: the group is pending under this transaction"
-    D0RecoverComplete { claim_generation: _, settled: s } => join(["recover: this transaction already settled at ", s.id as String, " (", authority_wire(a: s.next), "); completing the claim"], "")
-    D0RecoverAbort { claim_generation: _, cause: c } => join(["recover: aborting the claim: ", c], "")
-    D0RecoveryRefused { cause: c } => join(["refused: ", c], "")
-  }
-}
-
-// THE ENTRY IS THE DOOR, gunbc.spark.pair_serving_d0_door pair_serving_d0_wet: it files the
-// consent over the keyed successor, waits for the operator's decision, and dispatches here under
-// the admitted grant. Exit 0 only on D0Eligible settled.
-// THE RUN AS ONE AUTHORIZATION LIFECYCLE, dispatched by d0_recovery over the claim and the
-// authority as read: a start decides permission, claims and writes; a recovery under a held claim
-// resumes (claim found held, no re-decision) and writes what is still owed; the claim is completed
-// on any settled terminal and aborted when the run refused before its first write. A grant
-// admission failure at the start takes no claim, so there is nothing to abort; a settle that did
-// not land leaves the claim held for the next rerun, which the join dispatches again.
-fn d0_admission_text(a: D0GrantAdmission, group: String) -> String {
-  match a {
-    D0GrantAdmitted { admitted: _ } => "admitted"
-    D0GrantForAnotherGroup { granted: og } => join(["the grant authorizes ", fabric_group_wire(g: og) as String, ", not ", group], "")
-    D0GrantForAnotherPopulation { granted: gr, current: cu } => join(["the grant authorizes hosts [", hosts_wire(hs: gr), "] but ", group, " is currently [", hosts_wire(hs: cu), "]; the operator did not see this population"], "")
-    D0GrantIntentUnavailable => "the intent over the exact operation could not be stated and digested (sha256sum unavailable, or the scope has no wire), so the grant cannot be compared to it"
-    D0GrantRefused { cause: c } => join(["the authorization does not permit this operation: ", authorization_refusal_reason(cause: c)], "")
-    D0GrantClaimLost { holder: h } => join(["the grant is held by another attempt: ", h as String], "")
-    D0GrantClaimUndecided { reason: r } => join(["the grant's claim could not be decided: ", r as String], "")
-    D0GrantBindingUnavailable { claim: t } => join(["the authorization binding could not be digested", claim_terminal_text(t: t)], "")
-  }
-}
-
-// A DRIFTED POPULATION ON A RESUME IS CARRIED INTO THE READINGS, NOT REFUSED AT THE DOOR: the
-// pending state must reach a terminal under its original authorization, and the honest terminal
-// when the hosts are no longer the ones the operator saw is a fence naming both populations.
-fn d0_drift_observation(group: FabricGroup, granted: List<HostIdentity>, current: List<HostIdentity>) -> D0Observation {
-  D0Observation {
-    group: group,
-    incumbent: IncumbentRouteUnread { cause: join(["the group's host population changed after this transaction was authorized: authorized [", hosts_wire(hs: granted), "], current [", hosts_wire(hs: current), "]; the pending transaction is settled by fencing rather than read against hosts the operator never saw"], "") as NonEmptyStr },
-    ranks: [] as List<RankOccupancyReading>,
-    vacancy: [] as List<RankVacancyReading>,
-  }
-}
-
-fn d0_run_admitted(store: FabricStorageBinding, g: FabricGroup, current_hosts: List<HostIdentity>, admitted: AdmittedD0Grant, transaction: NonEmptyStr, executor: NonEmptyStr, escalation_id: NonEmptyStr, at: EpochSecs, now: Timestamp, claimed_here: Bool) -> ProcessExit {
-  match d0_population(subject: admitted.grant.subject, current: current_hosts) {
-    D0PopulationDiffers { granted: gr, current: cu } =>
-      d0_settle_admitted(store: store, g: g, current_hosts: current_hosts, admitted: admitted, transaction: transaction, executor: executor, escalation_id: escalation_id, at: at, now: now, observe: fn(og) { d0_drift_observation(group: og, granted: gr, current: cu) })
-    D0PopulationAgrees =>
-      match prepare_fleet_ssh_agent_context(attempt_raw: pair_serving_d0_attempt_raw) {
-        FleetSshContextRefused { cause: c } => {
-          let terminal = if claimed_here { d0_terminate_claim(store: store, escalation_id: escalation_id, transaction: transaction, held: admitted.claim_generation, completed: false, cause: "no fleet ssh context before the first write", now: now) } else { D0ClaimNotAttempted { still_held_by: transaction } }
-          refuse(reason: join(["no fleet ssh context, so nothing is read and nothing is moved: ", c, claim_terminal_text(t: terminal)], ""))
-        }
-        FleetSshContextReady { context: context, receipt: _ } =>
-          d0_settle_admitted(store: store, g: g, current_hosts: current_hosts, admitted: admitted, transaction: transaction, executor: executor, escalation_id: escalation_id, at: at, now: now, observe: fn(og) { observe_d0(context: context, group: og, declared: declared_pair_realization(group: og)) })
-      }
-  }
-}
-
-fn d0_settle_admitted(store: FabricStorageBinding, g: FabricGroup, current_hosts: List<HostIdentity>, admitted: AdmittedD0Grant, transaction: NonEmptyStr, executor: NonEmptyStr, escalation_id: NonEmptyStr, at: EpochSecs, now: Timestamp, observe: fn(FabricGroup) -> D0Observation) -> ProcessExit {
-  match placement_repair_pending(store: store, group: g, actor: executor, at: at) {
-    Present { value: PlacementAbortedAt { preparation: pr, id: _ } } => exit_failure(reason: join(["the group's pending placement preparation ", pr as String, " was aborted by the repair, which no run of this transaction does: an operator's disposition, so this run does not proceed on it"], ""))
-    Present { value: PlacementCleanupStillFencing { preparation: pr, cause: c } } => exit_failure(reason: join(["the group's pending placement preparation ", pr as String, " cannot be repaired by this run: ", c, "\n  the authorization claim stays held"], ""))
-    Present { value: PlacementCleanupUnread { cause: c } } => exit_failure(reason: join(["the group's pending placement could not be read, so this run does not proceed: ", c], ""))
-    Absent => d0_settle_admitted_over(store: store, g: g, current_hosts: current_hosts, admitted: admitted, transaction: transaction, executor: executor, escalation_id: escalation_id, at: at, now: now, observe: observe)
-    Present { value: PlacementFinalizedAt { preparation: _, id: _ } } => d0_settle_admitted_over(store: store, g: g, current_hosts: current_hosts, admitted: admitted, transaction: transaction, executor: executor, escalation_id: escalation_id, at: at, now: now, observe: observe)
-  }
-}
-
-// THE SAGA'S PENDING PREPARATION IS REPAIRED BEFORE THE TRANSACTION RUNS: a previous run of this
-// transaction that died after its group append left a consumed, unfinalized preparation, which
-// the join finalizes here; one no authority event consumed is the operator's, and the run refuses
-// rather than sitting on it.
-fn d0_settle_admitted_over(store: FabricStorageBinding, g: FabricGroup, current_hosts: List<HostIdentity>, admitted: AdmittedD0Grant, transaction: NonEmptyStr, executor: NonEmptyStr, escalation_id: NonEmptyStr, at: EpochSecs, now: Timestamp, observe: fn(FabricGroup) -> D0Observation) -> ProcessExit {
-  let outcome = d0_transaction(store: store, group: g, current_hosts: current_hosts, admitted: admitted, transaction: transaction, executor: executor, at: at, now: now, observe: observe)
-  match outcome {
-    D0Settled { decision: _, generation: _, receipt_path: _, entry_state: _ } => {
-      let terminal = d0_terminate_claim(store: store, escalation_id: escalation_id, transaction: transaction, held: admitted.claim_generation, completed: true, cause: "", now: now)
-      if d0_outcome_is_eligible(o: outcome) {
-        match terminal {
-          D0ClaimTerminated => ExitSuccess
-          D0ClaimNotAttempted { still_held_by: _ } => exit_failure(reason: join([d0_outcome_text(o: outcome), "\n  settled, but the claim's terminal did not land:", claim_terminal_text(t: terminal)], ""))
-          D0ClaimUnterminated { detail: _ } => exit_failure(reason: join([d0_outcome_text(o: outcome), "\n  settled, but the claim's terminal did not land:", claim_terminal_text(t: terminal)], ""))
-        }
-      } else {
-        exit_failure(reason: join([d0_outcome_text(o: outcome), claim_terminal_text(t: terminal)], ""))
-      }
-    }
-    D0PlacementStillFencing { decision: _, generation: _, entry_state: _, preparation: _, cause: _ } => exit_failure(reason: join([d0_outcome_text(o: outcome), "\n  the authorization claim stays held; a rerun under this transaction finalizes the placement from the join and then completes"], ""))
-    D0Refused { cause: _ } => exit_failure(reason: join([d0_outcome_text(o: outcome), "\n  the authorization claim stays held; a rerun under this transaction recovers from the claim and the log"], ""))
-  }
-}
-
-fn claim_terminal_text(t: D0ClaimTerminal) -> String {
-  match t {
-    D0ClaimTerminated => ""
-    D0ClaimNotAttempted { still_held_by: who } => join(["\n  the authorization claim stays held by ", who as String, "; a rerun under it recovers from the claim and the log"], "")
-    D0ClaimUnterminated { detail: d } => join(["\n  the authorization claim was left unterminated: ", d], "")
-  }
-}
-
-// A RESUME WHOSE GRANT IS NOT ADMITTED REFUSES WITH THE ADMISSION'S OWN CAUSE -- another
-// population, another group, a scoped-authorization refusal, an undecidable claim -- before the
-// recovery join, which would otherwise only see "no lifecycle" and report a digest that was never
-// the problem.
-// THE DISPATCH. The claim is read first; when it is held by this transaction the grant is resumed
-// (no re-decision) so the lifecycle binding exists BEFORE the join is asked -- the join selects
-// this lifecycle's history by it. Then each recovery arm has one consequence:
-//   Start       → decide, claim, write (admit_d0_grant, then the transaction)
-//   FirstWrite  → the population is re-checked against the current group: drift ABORTS the claim
-//                 (nothing was written under it); agreement performs the first write
-//   Resume      → the pending transaction finishes under its original authorization; drift is
-//                 carried into the readings and fences rather than stranding the group
-//   Complete    → the claim's terminal only; the authority is not touched
-//   Abort       → the claim's terminal only
-fn d0_dispatch(store: FabricStorageBinding, g: FabricGroup, group: String, current_hosts: List<HostIdentity>, scoped: ScopedAuthorization<D0Subject>, tx: NonEmptyStr, esc: NonEmptyStr, executor: NonEmptyStr, at: EpochSecs, now: Timestamp, current: CurrentAuthority) -> ProcessExit {
-  d0_dispatch_with(store: store, g: g, group: group, current_hosts: current_hosts, scoped: scoped, tx: tx, esc: esc, executor: executor, at: at, now: now, current: current, basis: D0BasisBroker)
-}
-
-// THE TWO QUESTIONS THE DISPATCH ASKS, EACH ANSWERED EXHAUSTIVELY ONCE: is this admission admitted, and is
-// the consent claimed by this transaction. A new arm of either type is a compile error here, never a
-// silent "no".
-fn d0_admitted_of(a: D0GrantAdmission) -> AdmittedD0Grant? {
-  match a {
-    D0GrantAdmitted { admitted: x } => Present { value: x }
-    D0GrantForAnotherGroup { granted: _ } => none
-    D0GrantForAnotherPopulation { granted: _, current: _ } => none
-    D0GrantIntentUnavailable => none
-    D0GrantRefused { cause: _ } => none
-    D0GrantClaimLost { holder: _ } => none
-    D0GrantClaimUndecided { reason: _ } => none
-    D0GrantBindingUnavailable { claim: _ } => none
-  }
-}
-
-fn d0_claim_held_by(claim: D0ClaimReading, transaction: NonEmptyStr) -> Bool {
-  match claim {
-    D0ClaimAbsent => false
-    D0ClaimUnreadable { reason: _ } => false
-    D0ClaimAt { state: st, generation: _ } =>
-      match st {
-        ClaimedBy { attempt: who, claimed_at: _ } => (who as String) == (transaction as String)
-        Unclaimed => false
-        CompletedBy { attempt: _, completed_at: _ } => false
-        AbortedBy { attempt: _, aborted_at: _, cause: _ } => false
-      }
-  }
-}
-
-fn d0_not_moved_by_this_run(recovery: D0Recovery) -> ProcessExit {
-  exit_failure(reason: join([d0_recovery_text(r: recovery), "; the claim is completed and the authority was not moved by this run"], ""))
-}
-
-fn d0_dispatch_with(store: FabricStorageBinding, g: FabricGroup, group: String, current_hosts: List<HostIdentity>, scoped: ScopedAuthorization<D0Subject>, tx: NonEmptyStr, esc: NonEmptyStr, executor: NonEmptyStr, at: EpochSecs, now: Timestamp, current: CurrentAuthority, basis: D0AuthorizationBasis) -> ProcessExit {
-  match current {
-    CurrentAuthorityUnread { group: _, step: st, reason: why } => refuse(reason: join(["authority unread at ", st, ": ", why], ""))
-    CurrentAuthorityRead { authority: cur, head: _, generation: _, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: recs } => {
-      let claim = d0_read_claim(store: store, escalation_id: esc)
-      let held_here = d0_claim_held_by(claim: claim, transaction: tx)
-      let resumed = if held_here { resume_d0_grant_with(basis: basis, store: store, authorization: scoped, escalation_id: esc, group: g, transaction: tx, executor: executor) } else { D0GrantClaimLost { holder: "no claim held by this transaction" as NonEmptyStr } }
-      let lifecycle = match d0_admitted_of(a: resumed) {
-        Present { value: a } => Present { value: a.binding }
-        Absent => none
-      }
-      let resume_refusal = if held_here { (match d0_admitted_of(a: resumed) { Present { value: _ } => none  Absent => Present { value: d0_admission_text(a: resumed, group: group) } }) } else { none }
-      match resume_refusal {
-        Present { value: why } => refuse(reason: join(["the claim is held by this transaction but its grant is not admitted on this resume: ", why], ""))
-        Absent => {
-      let recovery = d0_recovery(claim: claim, transaction: tx, lifecycle: lifecycle, executor: executor, current: cur, transitions: recs)
-      match recovery {
-        D0RecoveryRefused { cause: c } => refuse(reason: c)
-        D0RecoverStart => {
-          let admission = admit_d0_grant_with(basis: basis, store: store, authorization: scoped, escalation_id: esc, group: g, current_hosts: current_hosts, transaction: tx, executor: executor, at: at, now: now)
-          match d0_admitted_of(a: admission) {
-            Present { value: admitted } => d0_run_admitted(store: store, g: g, current_hosts: current_hosts, admitted: admitted, transaction: tx, executor: executor, escalation_id: esc, at: at, now: now, claimed_here: true)
-            Absent => refuse(reason: d0_admission_text(a: admission, group: group))
-          }
-        }
-        D0RecoverFirstWrite { claim_generation: cg } =>
-          match d0_admitted_of(a: resumed) {
-            Present { value: admitted } =>
-              match d0_population(subject: admitted.grant.subject, current: current_hosts) {
-                D0PopulationAgrees => d0_run_admitted(store: store, g: g, current_hosts: current_hosts, admitted: admitted, transaction: tx, executor: executor, escalation_id: esc, at: at, now: now, claimed_here: false)
-                D0PopulationDiffers { granted: gr, current: cu } => {
-                  let cause = join(["the group's host population changed after the claim and before any write: authorized [", hosts_wire(hs: gr), "], current [", hosts_wire(hs: cu), "]"], "")
-                  match d0_terminate_claim(store: store, escalation_id: esc, transaction: tx, held: cg, completed: false, cause: cause, now: now) {
-                    D0ClaimTerminated => refuse(reason: join([cause, "; the claim is aborted and the authority was not moved"], ""))
-                    D0ClaimNotAttempted { still_held_by: h } => refuse(reason: join([cause, claim_terminal_text(t: D0ClaimNotAttempted { still_held_by: h })], ""))
-                    D0ClaimUnterminated { detail: d } => refuse(reason: join([cause, claim_terminal_text(t: D0ClaimUnterminated { detail: d })], ""))
-                  }
-                }
-              }
-            Absent => refuse(reason: join([d0_recovery_text(r: recovery), "; ", d0_admission_text(a: resumed, group: group)], ""))
-          }
-        D0RecoverResume { claim_generation: _ } =>
-          match d0_admitted_of(a: resumed) {
-            Present { value: admitted } => d0_run_admitted(store: store, g: g, current_hosts: current_hosts, admitted: admitted, transaction: tx, executor: executor, escalation_id: esc, at: at, now: now, claimed_here: false)
-            Absent => refuse(reason: join([d0_recovery_text(r: recovery), "; ", d0_admission_text(a: resumed, group: group)], ""))
-          }
-        D0RecoverComplete { claim_generation: cg, settled: st } =>
-          match placement_finalize(store: store, consumed: preparation_consumption(store: store, preparation: st.placement.id), actor: executor, at: at) {
-            PlacementCleanupStillFencing { preparation: pr, cause: c } => exit_failure(reason: join([d0_recovery_text(r: recovery), "; the settling write's placement preparation ", pr as String, " is not finalized: ", c, "; the claim stays held until it is"], ""))
-            PlacementCleanupUnread { cause: c } => exit_failure(reason: join([d0_recovery_text(r: recovery), "; the settling write's placement preparation ", st.placement.id as String, " could not be read: ", c, "; the claim is left held for a rerun"], ""))
-            PlacementAbortedAt { preparation: pr, id: _ } => exit_failure(reason: join([d0_recovery_text(r: recovery), "; the settling write's placement preparation ", pr as String, " reads aborted -- the placement and the authority disagree; operator"], ""))
-            PlacementFinalizedAt { preparation: _, id: _ } =>
-          match d0_terminate_claim(store: store, escalation_id: esc, transaction: tx, held: cg, completed: true, cause: "", now: now) {
-            D0ClaimTerminated =>
-              match st.next {
-                SuspendedForAuthorizedSuccessor { group: _, hosts: _, authorization: _, exact_candidate_realization: _, lease: _, cleanup: _ } => ExitSuccess
-                ReleasedToFleet { group: _, release_receipt: _ } => ExitSuccess
-                PairServingActive { group: _, exact_realization: _ } => d0_not_moved_by_this_run(recovery: recovery)
-                SuspensionPendingReconciliation { group: _, hosts: _, transaction: _, authorization_binding: _, lease: _ } => d0_not_moved_by_this_run(recovery: recovery)
-                FencedRefusal { group: _, hosts: _, cause: _, disposition_authority: _ } => d0_not_moved_by_this_run(recovery: recovery)
-              }
-            D0ClaimNotAttempted { still_held_by: h } => exit_failure(reason: join([d0_recovery_text(r: recovery), claim_terminal_text(t: D0ClaimNotAttempted { still_held_by: h })], ""))
-            D0ClaimUnterminated { detail: d } => exit_failure(reason: join([d0_recovery_text(r: recovery), claim_terminal_text(t: D0ClaimUnterminated { detail: d })], ""))
-          }
-          }
-        D0RecoverAbort { claim_generation: cg, cause: c } =>
-          match d0_terminate_claim(store: store, escalation_id: esc, transaction: tx, held: cg, completed: false, cause: c, now: now) {
-            D0ClaimTerminated => refuse(reason: join([d0_recovery_text(r: recovery), "; the claim is aborted"], ""))
-            D0ClaimNotAttempted { still_held_by: h } => refuse(reason: join([d0_recovery_text(r: recovery), claim_terminal_text(t: D0ClaimNotAttempted { still_held_by: h })], ""))
-            D0ClaimUnterminated { detail: d } => refuse(reason: join([d0_recovery_text(r: recovery), claim_terminal_text(t: D0ClaimUnterminated { detail: d })], ""))
-          }
-      }
-      }
-      }
-    }
-  }
-}
-
-// THE STORE'S WRITE WALL IS AN INPUT TO THIS DOOR. Every fact D0 writes -- the group's authority,
-// host placement, the operator-consent slot -- lives behind the fabric DB's write door, and while
-// gunbc.rung_drop fabric_storage_append_principal_unrefused stands that door admits any tailnet member,
-// so a writer that never passed this door could move the same facts. The door therefore reads the
-// drop's standing and refuses while it stands: Cut 0 and the escalation -> authorization producer
-// cannot make D0 executable before the wall is restored, by construction rather than by sequence.
-//
-// TWO WALLS, NOT ONE. Retiring that drop restores OUTSIDER exclusion (a roster of fleet-writer
-// principals); it does not make the store refuse a rostered writer that holds no D0 authorization
-// for the operation, because the served door carries no partition, action, subject or grant. That
-// second wall never existed under the git realization either, so it is not a rung drop but a
-// missing construction, declared here on the door that needs it: the door refuses while EITHER
-// stands, and the second is retired only by editing this row when the store admits writes per
-// operation (the wall's trigger).
-type StoreOperationWall
-  = StoreOperationWallMissing { trigger: String }
-  | StoreOperationWallRestored { by: String }
-
-data d0_store_operation_wall: StoreOperationWall = StoreOperationWallMissing {
-  trigger: "the fabric DB's served door admits a put/advance on a pair-serving-authority partition, host-placement or a D0 consent slot only with a D0 authorization the store verifies for that operation (subject, grant, attempt) -- SUFFICIENT FOR a rostered fleet writer without that authorization to be refused at the store",
-}
-
-// THE ONE LIFECYCLE ADMITTED WHILE THE WALLS ARE UNFINISHED (gunbc.rung_drop
-// d0_store_walls_single_lifecycle, operator-ruled 2026-09-30): FabricGroupA under this escalation id.
-// The escalation id is what the door's authorization= names and what the frozen filing is keyed by, so
-// a rerun of the same lifecycle carries it and a new consent does not.
-data d0_single_lifecycle_escalation_id: NonEmptyStr = "d0-group-a-ds41-2026-09-30" as NonEmptyStr
-
-fn d0_single_lifecycle_admits(group: FabricGroup, escalation_id: NonEmptyStr) -> Bool {
-  d0_single_lifecycle_admits_under(standing: d0_store_walls_single_lifecycle.standing, group: group, escalation_id: escalation_id)
-}
-
-// The admission over a supplied standing of the drop row, so its RED with the row retired is
-// witnessed without retiring the real row.
-// AND EXACTLY ONE MORE (operator-ruled 2026-10-03, relayed by valiant-crab-775, dashboard message
-// msg_eb268a0a): the Group A release-to-fleet, whose escalation is the release row's
-// (gunbc.spark.pair_serving_d0_authorization d0_release_requests). Same terms: Group A only, that one
-// lifecycle and its reruns, refused once the row retires.
-// THE ID MOVED ONCE, AND WHY: the first lifecycle under "d0-group-a-release-glm53-2026-10-03" froze its
-// filing at revision 593e333 and then could not reach the approval broker on srv1 (fleet-converge run
-// 37096004282: no claim taken, no authority write). A frozen filing refuses every other revision, so that
-// lifecycle can never finish once the door changes; it is inert, and the release runs as a new lifecycle
-// under this id, admitted by the operator's standing Group A ruling (gunbc.auth.standing_operator_grant
-// group_a_dev_standing_grant, 2026-10-03) on the same single-lifecycle terms.
-data d0_release_lifecycle_escalation_id: NonEmptyStr = "d0-group-a-release-glm53-standing-2026-10-03" as NonEmptyStr
-
-fn d0_single_lifecycle_admits_under(standing: RungDropStanding, group: FabricGroup, escalation_id: NonEmptyStr) -> Bool {
-  match standing {
-    Retired { trigger_fired: _ } => false
-    Superseded { ruling: _, decision_record: _, loss_holder: _ } => false
-    Standing =>
-      (match group { FabricGroupA => true  FabricGroupB => false })
-        && ((escalation_id as String) == (d0_single_lifecycle_escalation_id as String)
-          || (escalation_id as String) == (d0_release_lifecycle_escalation_id as String))
-  }
-}
-
-// Whether the store walls let THIS lifecycle run: both walls finished admits every lifecycle; while
-// either stands unfinished, only the single declared lifecycle is admitted, and every other one refuses
-// with the wall that stands.
-fn d0_store_write_wall_standing(group: FabricGroup, escalation_id: NonEmptyStr) -> String? {
-  match d0_store_walls_refusal() {
-    Absent => none
-    Present { value: why } =>
-      if d0_single_lifecycle_admits(group: group, escalation_id: escalation_id) { none }
-      else { Present { value: why } }
-  }
-}
-
-fn d0_store_walls_refusal() -> String? {
-  match fabric_storage_append_principal_unrefused.standing {
-    Superseded { ruling: _, decision_record: _, loss_holder: h } => Present { value: join(["the fabric DB write-door drop fabric_storage_append_principal_unrefused was superseded rather than retired by its trigger, so the wall it tracked is not shown restored (its loss is held by ", h as String, "); D0 does not run on a supersession"], "") }
-    Standing => Present { value: join(["the fabric DB's write door admits any tailnet member (gunbc.rung_drop fabric_storage_append_principal_unrefused stands; its trigger: ", fabric_storage_append_principal_unrefused_trigger(), "), so a writer that never passed this door could move the facts this transaction writes; D0 does not run until that drop is retired"], "") }
-    Retired { trigger_fired: _ } =>
-      match d0_store_operation_wall {
-        StoreOperationWallRestored { by: _ } => none
-        StoreOperationWallMissing { trigger: t } => Present { value: join(["the fabric DB's write door admits any rostered fleet writer on every head without a D0 authorization for the operation (d0_store_operation_wall is missing; its trigger: ", t, "); D0 does not run until that wall is restored, except the single lifecycle gunbc.rung_drop d0_store_walls_single_lifecycle admits (FabricGroupA under escalation ", d0_single_lifecycle_escalation_id as String, ")"], "") }
-      }
-  }
-}
-
-fn fabric_storage_append_principal_unrefused_trigger() -> String {
-  match fabric_storage_append_principal_unrefused.declaration {
-    TypedDeclaration { previous: _, temporary: _, reason: _, population: _, restoration_trigger: t } => t
-    AuthoredProse { legacy: _, authored: _ } => "(see the drop's declaration)"
-  }
-}
-
diff --git a/dag/gunbc/spark/pair_serving_d0_authorization.dag b/dag/gunbc/spark/pair_serving_d0_authorization.dag
deleted file mode 100644
index 653d861d42d..00000000000
--- a/dag/gunbc/spark/pair_serving_d0_authorization.dag
+++ /dev/null
@@ -1,183 +0,0 @@
-module gunbc.spark.pair_serving_d0_authorization
-
-import std.types { String, Bool, Int, NonEmptyStr, List, Timestamp }
-import std.measure { Second, second, second_count }
-import std.optional { Present, Absent }
-import std.content_hash { ContentHash }
-import std.scoped_authorization { AuthorizationRequest, ScopedAuthorization, ClaimedBy }
-import gunbc.auth.approval_gate { ApprovalGateRefusal, ApprovalRecorded, ApprovalNotRecorded, approval_recorded_from_poll }
-import gunbc.auth.approval_request_client { ApprovalPollStanding }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, fabric_group_wire, fabric_group_hosts }
-import gunbc.spark.released_baseline { ReleasedBaselineSpec, QuiescentReservedBaseline }
-import gunbc.spark.v41_runtime_candidate { v41_candidate, V41CandidateStanding, V41DerivationEvidence, v41_derivation_obligations, V41CandidateKeyed, V41CandidateUnestablished, V41CandidateRefused }
-import gunbc.spark.pair_serving_d0 { d0_release_lifecycle_escalation_id, D0Subject, D0SuspendForSuccessor, D0ReleaseToFleet, d0_request, d0_intent_hash, d0_intent_text, parse_d0_intent_text, parse_d0_frozen_filing, D0ClaimReading, D0ClaimAt, D0ClaimAbsent, D0ClaimUnreadable }
-
-// ── THE ESCALATION → AUTHORIZATION PRODUCER FOR D0 (Cut D, the gate Cut 0 opens) ─────────────
-//
-// An operator's consent to D0 is an approval decision over ONE exact request: the group, its
-// current host population, the KEYED successor candidate, the cleanup baseline, the lease term
-// and the transaction word, digested into the intent the decision's revision names. This module
-// produces that request from the live authorities -- and, for a rerun, re-derives the SAME request
-// from the intent text the door froze when it filed (gunbc.spark.pair_serving_d0 d0_freeze_filing),
-// so a lifecycle finishes under the request the operator saw rather than one rebuilt from moved
-// source. Turning the broker's poll into a ScopedAuthorization<D0Subject> is not D0's to own: that
-// is gunbc.auth.approval_gate, generic over the subject, which the door binds to this request
-// exactly as the Mt. Collins boot binds it to its own. This module is pure over supplied readings.
-
-// THE SUCCESSOR IS THE KEYED CANDIDATE, OR THERE IS NO SUBJECT. Identity is not permission, but
-// a consent over an unkeyed successor would authorize whatever bytes turned up: the subject
-// refuses to exist until gunbc.spark.v41_runtime_candidate keys the candidate (Cut 0).
-// A DEFECT IS NOT AN OBLIGATION here either: a candidate the source authority refuses (a malformed
-// published population) is a correction owed to the source, and no reading discharges it; an
-// unestablished one names what is still to be read. The door renders them apart.
-type D0SubjectStanding
-  = D0SubjectFor { subject: D0Subject }
-  | D0SubjectUnestablished { obligations: List<NonEmptyStr> }
-  | D0SubjectRefused { defects: List<NonEmptyStr> }
-
-// The lease term the consent is asked for: the bounded window in which D0 reads the fleet and
-// settles. Declared here as the one term every D0 consent names.
-data d0_consent_term: Second = second(count: 3600)
-
-// A KEYED CANDIDATE WHOSE DERIVATION EVIDENCE STILL OWES SOMETHING HAS NO SUBJECT (proud-deer-538,
-// 2026-09-24): the derivation is an input here, not a field a caller may forget to read, so a consent can
-// never be asked over stores that were not read back at their seams. The obligation is the evidence's own.
-fn d0_subject_of_candidate(group: FabricGroup, standing: V41CandidateStanding, derivation: V41DerivationEvidence) -> D0SubjectStanding {
-  match standing {
-    V41CandidateKeyed { runtime_artifact: _, model_source: _, engram_realization: _, execution_profile: _, candidate: c, authorization_obligation: _ } =>
-      if length(v41_derivation_obligations(d: derivation)) != 0 { D0SubjectUnestablished { obligations: v41_derivation_obligations(d: derivation) } } else {
-      D0SubjectFor { subject: D0Subject { group: group, hosts: fabric_group_hosts(g: group), operation: D0SuspendForSuccessor { successor: c, cleanup: QuiescentReservedBaseline, term: d0_consent_term } } }
-      }
-    V41CandidateUnestablished { obligations: o } => D0SubjectUnestablished { obligations: o }
-    V41CandidateRefused { defects: d } => D0SubjectRefused { defects: d }
-  }
-}
-
-fn d0_live_subject(group: FabricGroup) -> D0SubjectStanding {
-  let v = v41_candidate()
-  d0_subject_of_candidate(group: group, standing: v.standing, derivation: v.derivation)
-}
-
-// ── THE RELEASES AN OPERATOR HAS APPROVED, AS ROWS (gunbc.spark.pair_serving_d0 D0ReleaseToFleet) ─────
-//
-// A RELEASE IS REQUESTED BY ITS ESCALATION, NEVER BY A WORD TYPED AT DISPATCH: the door builds a
-// release subject only for an escalation this list names, with the cause and the approval reference
-// written here and therefore in the intent the operator approves and the filing that freezes it. Every
-// other escalation is a suspension for the keyed successor, as before. A row here is what is asked,
-// never the answer. The answer comes from one of two places: the operator deciding the filed request in
-// the approvals app, or, for a release whose group and every host a committed standing grant covers,
-// that grant (gunbc.spark.pair_serving_d0_door d0_standing_grant_for, classified by the census row
-// gunbc.auth.privileged_effect_census for that site). A covered request is never filed.
-type D0ReleaseRequestRow {
-  escalation_id: NonEmptyStr
-  group: FabricGroup
-  cause: NonEmptyStr
-  approval: NonEmptyStr
-}
-
-data d0_release_requests: List<D0ReleaseRequestRow> = [
-  D0ReleaseRequestRow {
-    escalation_id: d0_release_lifecycle_escalation_id,
-    group: FabricGroupA,
-    cause: "Group A's pair-serving commitment fences srv5-srv8 for every host effect, and the GLM-5.3-Flash Group A staircase (deforking cut 8) needs its image build, distribution and checkpoint materialization there; Group A was read vacant (no running container and no GPU process on any host) by fleet-converge run 37087495838" as NonEmptyStr,
-    approval: "operator approval 2026-10-03 to remove Group A's placement commitment for the staircase's host effects, relayed by valiant-crab-775 (dashboard messages msg_8ea29451 and msg_e26c0173)" as NonEmptyStr,
-  },
-]
-
-fn d0_release_row_for(group: FabricGroup, escalation_id: NonEmptyStr) -> D0ReleaseRequestRow? {
-  first(filter(d0_release_requests, r => (r.escalation_id as String) == (escalation_id as String) && (fabric_group_wire(g: r.group) as String) == (fabric_group_wire(g: group) as String)))
-}
-
-// THE SUBJECT A FIRST RUN ASKS FOR: the approved release this escalation names, or the suspension for
-// the keyed successor.
-fn d0_live_subject_for(group: FabricGroup, escalation_id: NonEmptyStr) -> D0SubjectStanding {
-  match d0_release_row_for(group: group, escalation_id: escalation_id) {
-    Present { value: r } => D0SubjectFor { subject: D0Subject { group: group, hosts: fabric_group_hosts(g: group), operation: D0ReleaseToFleet { cause: r.cause, approval: r.approval } } }
-    Absent => d0_live_subject(group: group)
-  }
-}
-
-// THE REQUEST, with the intent over the exact operation (sha256 through the realization; an
-// unavailable digest is no request, never a structural substitute).
-type D0RequestStanding
-  = D0RequestFor { request: AuthorizationRequest<D0Subject> }
-  | D0RequestUnestablished { obligations: List<NonEmptyStr> }
-  | D0RequestRefused { defects: List<NonEmptyStr> }
-
-fn d0_authorization_request(group: FabricGroup, escalation_id: NonEmptyStr, transaction: NonEmptyStr) -> D0RequestStanding {
-  match d0_live_subject_for(group: group, escalation_id: escalation_id) {
-    D0SubjectUnestablished { obligations: o } => D0RequestUnestablished { obligations: o }
-    D0SubjectRefused { defects: d } => D0RequestRefused { defects: d }
-    D0SubjectFor { subject: s } =>
-      match d0_intent_hash(subject: s, group: group, transaction: transaction) {
-        Absent => D0RequestUnestablished { obligations: ["the intent over the exact operation could not be stated and digested (sha256sum unavailable, or the scope has no wire)" as NonEmptyStr] }
-        Present { value: i } => D0RequestFor { request: d0_request(escalation_id: escalation_id, subject: s, transaction: transaction, intent: i) }
-      }
-  }
-}
-
-// THE REQUEST AS IT WAS FILED, from the frozen intent text. The text is parsed, not trusted: it
-// must round-trip through d0_intent_text, name the group and transaction this run was dispatched
-// for, and digest -- so the request it yields carries the filed revision by construction, and a
-// slot holding another transaction's filing under this escalation is a refusal, not a resume.
-type D0FiledRequestStanding
-  = D0FiledRequestFor { request: AuthorizationRequest<D0Subject>, intent_text: String }
-  | D0FiledRequestRefused { reason: NonEmptyStr }
-
-fn d0_filed_request(text: String, group: FabricGroup, escalation_id: NonEmptyStr, transaction: NonEmptyStr, execution_revision: NonEmptyStr) -> D0FiledRequestStanding {
-  match parse_d0_frozen_filing(text: text) {
-    Absent => D0FiledRequestRefused { reason: "the frozen filing under this escalation is not one D0 intent with its execution revision" as NonEmptyStr }
-    Present { value: frozen } =>
-      if (frozen.execution_revision as String) != (execution_revision as String) {
-        D0FiledRequestRefused { reason: join(["the consent was filed by revision ", frozen.execution_revision as String, " and this run executes ", execution_revision as String, "; a lifecycle finishes under the executable that began it, or under a modeled migration -- neither is this run"], "") as NonEmptyStr }
-      } else {
-  match parse_d0_intent_text(text: frozen.intent_text) {
-    Absent => D0FiledRequestRefused { reason: "the frozen filing under this escalation is not one D0 intent" as NonEmptyStr }
-    Present { value: parsed } =>
-      if (fabric_group_wire(g: parsed.group) as String) != (fabric_group_wire(g: group) as String) {
-        D0FiledRequestRefused { reason: join(["the frozen filing under this escalation is over group ", fabric_group_wire(g: parsed.group) as String, ", not ", fabric_group_wire(g: group) as String], "") as NonEmptyStr }
-      } else if (parsed.transaction as String) != (transaction as String) {
-        D0FiledRequestRefused { reason: join(["the frozen filing under this escalation is transaction ", parsed.transaction as String, ", not ", transaction as String], "") as NonEmptyStr }
-      } else {
-        match d0_intent_hash(subject: parsed.subject, group: group, transaction: transaction) {
-          Absent => D0FiledRequestRefused { reason: "the frozen intent could not be stated and digested (sha256sum unavailable, or the scope has no wire)" as NonEmptyStr }
-          Present { value: i } => D0FiledRequestFor { request: d0_request(escalation_id: escalation_id, subject: parsed.subject, transaction: transaction, intent: i), intent_text: frozen.intent_text }
-        }
-      }
-  }
-      }
-  }
-}
-
-// The intent text a live request is frozen as: the same bytes its intent hash was taken over.
-fn d0_request_intent_text(request: AuthorizationRequest<D0Subject>, group: FabricGroup, transaction: NonEmptyStr) -> String? {
-  d0_intent_text(subject: request.subject, group: group, transaction: transaction)
-}
-
-// A RECORDED APPROVAL BECOMES A RESUMABLE AUTHORIZATION ONLY AGAINST THE DURABLE CLAIM. The right
-// to finish what an approval began belongs to the lifecycle that claimed it: the claim slot must
-// read ClaimedBy THIS transaction. Any other reading -- absent (nothing began; a start is a live
-// admission and must pass the live gate), held by another attempt, completed, aborted, or
-// unreadable -- refuses here, so "historically approved" never reaches d0_dispatch as an
-// authorization without the proof that distinguishes a resume from a start.
-type D0ResumableAuthorization
-  = D0Resumable { authorization: ScopedAuthorization<D0Subject> }
-  | D0NotRecorded { cause: ApprovalGateRefusal }
-  | D0NotClaimedHere { reason: NonEmptyStr }
-
-fn d0_resumable_authorization(claim: D0ClaimReading, transaction: NonEmptyStr, poll: ApprovalPollStanding, request: AuthorizationRequest<D0Subject>) -> D0ResumableAuthorization {
-  match claim {
-    D0ClaimAt { state: ClaimedBy { attempt: who, claimed_at: _ }, generation: _ } =>
-      if (who as String) == (transaction as String) {
-        match approval_recorded_from_poll(poll: poll, request: request) {
-          ApprovalRecorded { authorization: a } => D0Resumable { authorization: a }
-          ApprovalNotRecorded { cause: c } => D0NotRecorded { cause: c }
-        }
-      } else {
-        D0NotClaimedHere { reason: join(["the consent is claimed by attempt ", who as String, ", not ", transaction as String], "") as NonEmptyStr }
-      }
-    D0ClaimAt { state: _, generation: _ } => D0NotClaimedHere { reason: "the consent's claim is not held: unclaimed, completed or aborted" as NonEmptyStr }
-    D0ClaimAbsent => D0NotClaimedHere { reason: "no claim of the consent exists; this run is a start" as NonEmptyStr }
-    D0ClaimUnreadable { reason: r } => D0NotClaimedHere { reason: r }
-  }
-}
diff --git a/dag/gunbc/spark/pair_serving_d0_door.dag b/dag/gunbc/spark/pair_serving_d0_door.dag
deleted file mode 100644
index 3dc39eb2e69..00000000000
--- a/dag/gunbc/spark/pair_serving_d0_door.dag
+++ /dev/null
@@ -1,538 +0,0 @@
-module gunbc.spark.pair_serving_d0_door
-
-import std.content_hash { serialize_content_hash }
-import gunbc.auth.standing_operator_grant { standing_grant_authorization, StandingOperatorGrant }
-import extdeps.git
-import gunbc.output_policy { ExpectSuccess }
-
-import std.types { String, Bool, Int, NonEmptyStr, List, Timestamp, EpochSecs, GitRef, FilePath }
-import std.algebra { trim }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import std.measure { Second, second, second_count, Minute, minute }
-import std.optional { Present, Absent }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import std.scoped_authorization { AuthorizationRequest, ScopedAuthorization }
-import gunbc.auth.approval_gate {
-  ApprovalGate, GateAdmitted, GateRefused, ApprovalStoreUnreadable, approval_gate_from_poll, approval_gate_from_outcome, approval_refusal_text,
-  approval_instant_now, approval_expires_at, approval_standing_read, approval_poll_ticks, ApprovalStandingRead, StandingReadAt, StandingClockUnreadable,
-  approval_file_stored_request, ApprovalFiled, ApprovalFilingRefused,
-}
-import gunbc.auth.approval_request_client { PollStillPending, PollNotFiled, stored_request_from_authorization }
-import gunbc.fabric_storage_client { FabricStorageBinding }
-import gunbc.actions_run_binding { actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent, actions_variable_trimmed, fleet_converge_expected_host_env_name, read_expected_revision, ExpectedRevisionPresent, ExpectedRevisionAbsent }
-import gunbc.fleet_host_identity { operator_host_srv1 }
-import extdeps.git
-import extdeps.git.inspect
-import extdeps.git.plumbing
-import gunbc.output_policy { ExpectSuccess }
-import gunbc.fabric_event_log_host { HostStoreResolved, HostStoreRefused, event_log_store_for_host, now_epoch_seconds }
-import gunbc.spark.fabric_reach { ExecutorReachKnown, ExecutorReachUnknown, observe_executor_reach }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, parse_fabric_group, fabric_group_hosts, fabric_group_wire }
-import gunbc.spark.pair_serving_authority_log { current_pair_serving_authority }
-import gunbc.spark.pair_serving_d0 {
-  d0_standing_grant_for, D0AuthorizationBasis, D0BasisBroker, D0BasisStandingGrant, d0_dispatch_with, D0GrantRowProof, D0GrantRowUnproven, D0GrantRowApproved, d0_freeze_filing_with, parse_d0_frozen_filing, sha256_of_text,
-  D0Subject, D0SuspendForSuccessor, D0ReleaseToFleet, d0_dispatch, d0_store_write_wall_standing,
-  d0_read_filing, D0FilingAbsent, D0FilingAt, D0FilingUnreadable,
-  d0_freeze_filing, D0FilingFrozen, D0FilingAlreadyHeld, D0FilingFreezeRefused,
-  d0_read_claim, D0ClaimReading, D0ClaimAbsent, D0ClaimAt, D0ClaimUnreadable,
-}
-import gunbc.spark.pair_serving_d0_authorization {
-  D0RequestFor, D0RequestUnestablished, D0RequestRefused, d0_authorization_request, d0_request_intent_text,
-  D0FiledRequestFor, D0FiledRequestRefused, d0_filed_request,
-  d0_resumable_authorization, D0Resumable, D0NotRecorded, D0NotClaimedHere,
-}
-
-// ── THE WET DOOR OF D0: file the consent, wait for the operator, then run the transaction ─────
-//
-//   gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/spark/pair_serving_d0_door.dag
-//     --function pair_serving_d0_wet --arg group=group-a --arg transaction=<consent> --arg authorization=<consent>
-//     --arg execution_revision=<the 40-hex revision this tree is checked out at>
-//   (the fleet-converge mode pair_serving_d0 is the authoritative route; it derives every argument
-//   from its admission and this direct form exists for the same arguments by hand)
-//
-// THE ORDER IS THE SAFETY. Nothing on the fleet moves before, in this order: the store's two write
-// walls stand (gunbc.spark.pair_serving_d0 d0_store_write_wall_standing); the store this executor
-// reaches is resolved; the FILING under the named escalation is read from it, which decides
-// whether this run is the first or a rerun; the request over the exact operation is either
-// re-derived from the frozen filing (rerun) or built from the live authorities -- the V4.1
-// candidate keyed (Cut 0), the group's hosts read -- frozen, and FILED with the approval broker,
-// signed with the submission key (gunbc.auth.approval_keyring_pins); the operator's decision is
-// polled for a bounded window; and only then is the transaction dispatched
-// (gunbc.spark.pair_serving_d0 d0_dispatch), which reads the durable claim and the authority
-// history and decides start, resume, complete or abort. Every other poll outcome is a typed
-// refusal naming what the operator or the run must do. The broker route is gunbc.auth.approval_gate,
-// the same one gunbc.machine_intake_mtcollins1_boot_run binds to the Mt. Collins boot.
-//
-// A RERUN IS DECIDED BY THE STORE, NOT BY THE CLOCK OR THE SOURCE. The lifecycle #11555 made
-// recoverable can outlive the grant's window, the candidate's key and the group's host roster:
-// once the claim is held and the pending state is written, the transaction must reach a terminal
-// under the request the operator consented to. So a rerun never rebuilds the subject from live
-// source and never re-files -- it reads the frozen intent, re-derives the identical request, reads
-// the broker's decision AS RECORDED (an approval past its execute_by is still the approval that
-// started this lifecycle), and hands the grant to the dispatcher, which alone decides whether a
-// fresh start is still permitted (it re-authorizes at a fresh instant before claiming) or the
-// held lifecycle simply continues (no permission re-decided). A first run that finds the filing
-// already frozen is a rerun that did not know it, and proceeds as one.
-//
-// THE CLAIM IS TIMESTAMPED WHERE IT IS MADE. The instant that authorizes and stamps the claim is
-// probed after the poll returns, immediately before dispatch: a grant that expired between the
-// admitting poll and the claim refuses, a claim never predates the operator's decision, and an
-// unreadable clock there refuses rather than handing a rendering to the authorization boundary.
-//
-// WHERE IT RUNS. The broker is reached on its loopback origin (approval_loopback_origin), so the
-// door runs on the broker's host, from a fleet-converge workflow mode that supplies the
-// submission key path and a scratch directory -- the same environment the boot run consumes. A
-// door run without them refuses before filing anything.
-
-data d0_poll_cadence: Second = second(count: 15)
-data d0_poll_tick_budget: Int = 120
-data d0_submit_timeout: Second = second(count: 30)
-data d0_submit_body_file_name: String = "pair-serving-d0-approval-submit.json"
-
-fn d0_approval_window() -> Second {
-  second(count: d0_poll_tick_budget * (second_count(s: d0_poll_cadence) as Int))
-}
-
-// The mode's step timeout, rounded up to whole minutes: the approval window (constructed: ticks x
-// cadence), plus two OPERATOR-SELECTED outer allowances -- the transaction's, over its bounded
-// fabric reads, host reads and log writes (not derived from those bounds), and the prelude's, which
-// must exceed the Secret Manager transport's own connect and total bounds (gunbc.ci_spec
-// gunbc_ci_sm_connect_timeout, gunbc_ci_sm_max_time).
-data d0_transaction_allowance: Second = second(count: 900)
-data d0_prelude_allowance: Second = second(count: 120)
-
-fn pair_serving_d0_step_timeout_minutes() -> Minute {
-  let secs = (second_count(s: d0_approval_window()) as Int) + (second_count(s: d0_transaction_allowance) as Int) + (second_count(s: d0_prelude_allowance) as Int)
-  minute(count: (secs + 59) / 60)
-}
-
-fn refuse(reason: String) -> ProcessExit {
-  exit_failure(reason: join(["pair_serving_d0: ", reason], ""))
-}
-
-// WHICH RUN THIS IS, from the filing slot: the frozen intent (rerun) or none yet (first run).
-type D0RunKind
-  = D0FirstRun { request: AuthorizationRequest<D0Subject> }
-  | D0Rerun { request: AuthorizationRequest<D0Subject> }
-  | D0RunRefused { reason: String }
-
-fn d0_run_kind(store: FabricStorageBinding, g: FabricGroup, escalation_id: NonEmptyStr, transaction: NonEmptyStr, execution_revision: NonEmptyStr) -> D0RunKind {
-  d0_run_kind_with(store: store, g: g, escalation_id: escalation_id, transaction: transaction, execution_revision: execution_revision, fresh_proof: D0GrantRowUnproven)
-}
-
-// A FRESH START FREEZES THE GRANT-ROW PROOF it was admitted with, and only for a request the grant covers;
-// every other filing is frozen exactly as before.
-fn d0_fresh_proof_for(request: AuthorizationRequest<D0Subject>, fresh_proof: D0GrantRowProof) -> D0GrantRowProof {
-  match d0_standing_grant_for(request: request) {
-    Absent => D0GrantRowUnproven
-    Present { value: _ } => fresh_proof
-  }
-}
-
-fn d0_run_kind_with(store: FabricStorageBinding, g: FabricGroup, escalation_id: NonEmptyStr, transaction: NonEmptyStr, execution_revision: NonEmptyStr, fresh_proof: D0GrantRowProof) -> D0RunKind {
-  match d0_read_filing(store: store, escalation_id: escalation_id) {
-    D0FilingUnreadable { reason: r } => D0RunRefused { reason: join(["the filing under this escalation could not be read: ", r as String], "") }
-    D0FilingAt { text: t } =>
-      match d0_filed_request(text: t, group: g, escalation_id: escalation_id, transaction: transaction, execution_revision: execution_revision) {
-        D0FiledRequestRefused { reason: r } => D0RunRefused { reason: r as String }
-        D0FiledRequestFor { request: request, intent_text: _ } => D0Rerun { request: request }
-      }
-    D0FilingAbsent =>
-      match d0_authorization_request(group: g, escalation_id: escalation_id, transaction: transaction) {
-        D0RequestUnestablished { obligations: o } => D0RunRefused { reason: join(["the consent has no subject to be asked over yet; still to be established: ", join(map(o, x => x as String), "; ")], "") }
-        D0RequestRefused { defects: d } => D0RunRefused { reason: join(["the consent has no subject to be asked over: the candidate's source is refused and must be corrected, not read further: ", join(map(d, x => x as String), "; ")], "") }
-        D0RequestFor { request: request } =>
-          match d0_request_intent_text(request: request, group: g, transaction: transaction) {
-            Absent => D0RunRefused { reason: "the consent's scope has no wire, so no intent can be stated over it (std.scoped_authorization intent_frame_head refused)" }
-            Present { value: intent_text } =>
-          match d0_freeze_filing_with(store: store, escalation_id: escalation_id, intent_text: intent_text, execution_revision: execution_revision, proof: d0_fresh_proof_for(request: request, fresh_proof: fresh_proof)) {
-            D0FilingFreezeRefused { reason: r } => D0RunRefused { reason: r as String }
-            D0FilingFrozen => D0FirstRun { request: request }
-            D0FilingAlreadyHeld { text: t } =>
-              match d0_filed_request(text: t, group: g, escalation_id: escalation_id, transaction: transaction, execution_revision: execution_revision) {
-                D0FiledRequestRefused { reason: r } => D0RunRefused { reason: r as String }
-                D0FiledRequestFor { request: filed, intent_text: _ } => D0Rerun { request: filed }
-              }
-          }
-          }
-      }
-  }
-}
-
-// THE GATE FOR THIS RUN. A first run files and polls live. A rerun reads the durable claim: held
-// by this transaction, the decision is read AS RECORDED and joined to that proof
-// (d0_resumable_authorization) -- the lifecycle finishes under the consent that began it, expired
-// or not; absent, nothing began, so the standing is polled and admitted LIVE exactly as a first
-// run's (still pending: wait; not filed: the intent was frozen but the broker never reached, so the
-// frozen request is filed now); any other holder or state refuses.
-type D0DoorGate
-  = D0DoorAdmitted { authorization: ScopedAuthorization<D0Subject>, basis: D0AuthorizationBasis }
-  | D0DoorRefused { reason: String }
-
-fn d0_door_gate_of(gate: ApprovalGate<D0Subject>) -> D0DoorGate {
-  match gate {
-    GateAdmitted { authorization: scoped } => D0DoorAdmitted { authorization: scoped, basis: D0BasisBroker }
-    GateRefused { cause: c } => D0DoorRefused { reason: join(["the consent was not admitted: ", approval_refusal_text(cause: c)], "") }
-  }
-}
-
-// THE STEP FOR A FROZEN FILING WITH NO CLAIM, pure over the read: nothing began, so the standing
-// is a first run's -- not filed: file the frozen request; pending: enter the bounded poll; decided:
-// the live gate at the instant of the read; unreadable clock: refuse before anything is dispatched.
-type D0AbsentClaimStep
-  = D0AbsentClaimClockUnreadable
-  | D0AbsentClaimFileFrozen
-  | D0AbsentClaimEnterPoll
-  | D0AbsentClaimDecided { gate: ApprovalGate<D0Subject> }
-
-fn d0_absent_claim_step(read: ApprovalStandingRead, request: AuthorizationRequest<D0Subject>) -> D0AbsentClaimStep {
-  match read {
-    StandingClockUnreadable => D0AbsentClaimClockUnreadable
-    StandingReadAt { standing: standing, observed_at: observed } =>
-      match standing {
-        PollNotFiled => D0AbsentClaimFileFrozen
-        PollStillPending => D0AbsentClaimEnterPoll
-        decided => D0AbsentClaimDecided { gate: approval_gate_from_poll(poll: decided, request: request, observed_at: observed) }
-      }
-  }
-}
-
-// THE STANDING-GRANT ROSTER AND ITS COVERAGE LIVE IN gunbc.spark.pair_serving_d0 (d0_standing_grants,
-// d0_standing_grant_for), because the authorization binding there must name the grant's lifecycle.
-
-// THE STANDING GRANT IS HONORED ONLY AS THE OPERATOR MERGED IT (review 74677; rulings of valiant-crab-775,
-// 2026-10-03). DESIGN §5: approval is external to the diff, and the external act is the operator's merge of
-// the grant row to main. That is a FRESH-START admission fact (side-chat review of #13102): the first run reads
-// the grant's carrier file it executes and `git show origin/main:` of the same path, and only when they are
-// byte-identical does it freeze the row's digest into the filing (D0GrantRowApproved). Before main has the
-// row, or when a branch has edited it, or when either read fails, nothing is frozen and the request takes the
-// broker path, which refuses unless the broker answers.
-// A RERUN NEVER CONSULTS CURRENT MAIN. It resumes from the frozen proof: the grant is honored only when the
-// row this run executes digests to the frozen digest. So a later change to the row on main -- even an
-// unrelated edit -- cannot strand a lifecycle that has claimed, written its pending state, or released; and a
-// rerun whose branch edited the row after the approval is refused the grant.
-// THE ACCEPTED RESIDUAL RISK, stated plainly: branch code still INTERPRETS the approved row (the coverage
-// fold and this gate run from the dispatched revision). In this dev environment, under the operator's blanket
-// Group A permission, that is accepted; the row's content is what the operator approved.
-type StandingGrantRowStanding
-  = StandingGrantRowOnMain
-  | StandingGrantRowNotOnMain { cause: String }
-
-data standing_grant_row_path: String = "dag/gunbc/auth/standing_operator_grant.dag"
-data standing_grant_main_ref: String = "origin/main"
-
-fn standing_grant_row_judged(executed: String, executed_read: Bool, on_main: String, main_read: Bool, main_stderr: String) -> StandingGrantRowStanding {
-  if !executed_read {
-    StandingGrantRowNotOnMain { cause: join(["the grant row this run executes could not be read at ", standing_grant_row_path], "") }
-  } else if !main_read {
-    StandingGrantRowNotOnMain { cause: join([standing_grant_main_ref, " holds no ", standing_grant_row_path, " (", main_stderr, "): the operator has not merged the grant, so it is not honored"], "") }
-  } else if executed != on_main {
-    StandingGrantRowNotOnMain { cause: join(["the grant row this run executes differs from ", standing_grant_main_ref, "'s: only the operator-merged row is honored"], "") }
-  } else {
-    StandingGrantRowOnMain
-  }
-}
-
-// THE ROW THIS RUN EXECUTES, read once and digested once: the fresh proof and the rerun's check both use it.
-type ExecutedGrantRow
-  = ExecutedGrantRowRead { content: String, digest: NonEmptyStr }
-  | ExecutedGrantRowUnread { cause: String }
-
-fn executed_grant_row() -> ExecutedGrantRow {
-  let mine = Filesystem.Read(path: standing_grant_row_path)
-  if !mine.success {
-    ExecutedGrantRowUnread { cause: join(["the grant row this run executes could not be read at ", standing_grant_row_path, ": ", mine.error], "") }
-  } else {
-    match sha256_of_text(text: mine.content) {
-      Absent => ExecutedGrantRowUnread { cause: "the grant row this run executes could not be digested" }
-      Present { value: h } => ExecutedGrantRowRead { content: mine.content, digest: serialize_content_hash(hash: h) as NonEmptyStr }
-    }
-  }
-}
-
-// THE ROW'S STANDING, judged over the ROW THIS RUN CAPTURED (ExecutedGrantRow), never a second read of
-// the path. The comparison is of git blob ids (fp8-8 launch run 37161565980: comparing captured `git show`
-// text normalized the trailing newline and refused an identical row): the id of the CAPTURED bytes, hashed
-// from the caller-held value with git.Plumbing HashObjectStdinNoWrite, against `git rev-parse
-// origin/main:<path>`. One authorization fact, one read: the digest the proof freezes and the blob
-// admitted against main describe the same bytes, whatever happens to the working file afterwards
-// (side-chat rejection of #13176 at c58fce17: the earlier shape hashed the working file again).
-fn grant_row_blob(target: String) -> GrantRowBlob {
-  let r = git.Core.RevParseInRepo(repo: "." as FilePath, target: join([target, ":", standing_grant_row_path], "") as GitRef)
-  if r.exit_code != 0 { GrantRowBlobUnread { cause: join(["git rev-parse ", target, ":", standing_grant_row_path, " exited ", to_string(r.exit_code), ": ", trim(s: r.stderr)], "") } }
-  else { GrantRowBlobRead { blob: trim(s: r.revision) } }
-}
-
-type GrantRowBlob
-  = GrantRowBlobRead { blob: String }
-  | GrantRowBlobUnread { cause: String }
-
-fn captured_grant_row_blob(content: String) -> GrantRowBlob {
-  let r = git.Plumbing.HashObjectStdinNoWrite(content: content)
-  if r.exit_code != 0 { GrantRowBlobUnread { cause: join(["git hash-object --stdin over the captured row exited ", to_string(r.exit_code), ": ", trim(s: r.stderr)], "") } }
-  else { GrantRowBlobRead { blob: trim(s: r.oid) } }
-}
-
-// THE JUDGMENT, with the two blob producers supplied: production passes captured_grant_row_blob and
-// grant_row_blob(origin/main); a witness supplies both and drives the captured-row route directly.
-fn grant_row_standing_over(executed: ExecutedGrantRow, blob_of: fn(String) -> GrantRowBlob, on_main: GrantRowBlob) -> StandingGrantRowStanding {
-  match executed {
-    ExecutedGrantRowUnread { cause: c } => StandingGrantRowNotOnMain { cause: c }
-    ExecutedGrantRowRead { content: content, digest: _ } =>
-      match blob_of(content) {
-        GrantRowBlobUnread { cause: c } => StandingGrantRowNotOnMain { cause: join(["the grant row this run executes could not be identified: ", c], "") }
-        GrantRowBlobRead { blob: mine } =>
-          match on_main {
-            GrantRowBlobUnread { cause: c } => standing_grant_row_judged(executed: mine, executed_read: true, on_main: "", main_read: false, main_stderr: c)
-            GrantRowBlobRead { blob: theirs } => standing_grant_row_judged(executed: mine, executed_read: true, on_main: theirs, main_read: true, main_stderr: "")
-          }
-      }
-  }
-}
-
-fn fresh_grant_row_standing(executed: ExecutedGrantRow) -> StandingGrantRowStanding {
-  grant_row_standing_over(executed: executed, blob_of: fn(c) { captured_grant_row_blob(content: c) }, on_main: grant_row_blob(target: standing_grant_main_ref))
-}
-
-// THE FRESH-START PROOF over a supplied judgment of the SAME captured row: the frozen digest is that
-// row's digest, admitted only when that row's blob is main's.
-fn grant_row_proof_over(executed: ExecutedGrantRow, standing: StandingGrantRowStanding) -> D0GrantRowProof {
-  match executed {
-    ExecutedGrantRowUnread { cause: _ } => D0GrantRowUnproven
-    ExecutedGrantRowRead { content: _, digest: d } =>
-      match standing {
-        StandingGrantRowNotOnMain { cause: _ } => D0GrantRowUnproven
-        StandingGrantRowOnMain => D0GrantRowApproved { row_digest: d }
-      }
-  }
-}
-
-fn fresh_grant_row_proof(executed: ExecutedGrantRow) -> D0GrantRowProof {
-  grant_row_proof_over(executed: executed, standing: fresh_grant_row_standing(executed: executed))
-}
-
-// THE PROOF THE LIFECYCLE WAS FROZEN WITH, read back from its filing.
-fn d0_filed_grant_proof(store: FabricStorageBinding, escalation_id: NonEmptyStr) -> D0GrantRowProof {
-  match d0_read_filing(store: store, escalation_id: escalation_id) {
-    D0FilingAt { text: t } =>
-      match parse_d0_frozen_filing(text: t) {
-        Present { value: f } => f.grant_proof
-        Absent => D0GrantRowUnproven
-      }
-    D0FilingAbsent => D0GrantRowUnproven
-    D0FilingUnreadable { reason: _ } => D0GrantRowUnproven
-  }
-}
-
-// HONORED EXACTLY WHEN the lifecycle's frozen proof names a digest and the row this run executes has that
-// digest, and the grant covers the request. Current main is not an input.
-fn d0_honored_standing_grant(request: AuthorizationRequest<D0Subject>, frozen: D0GrantRowProof, executed: ExecutedGrantRow) -> StandingOperatorGrant? {
-  match frozen {
-    D0GrantRowUnproven => none
-    D0GrantRowApproved { row_digest: d } =>
-      match executed {
-        ExecutedGrantRowUnread { cause: _ } => none
-        ExecutedGrantRowRead { content: _, digest: mine } =>
-          if (mine as String) == (d as String) { d0_standing_grant_for(request: request) } else { none }
-      }
-  }
-}
-
-fn d0_gate(store: FabricStorageBinding, kind: D0RunKind, transaction: NonEmptyStr, expires: Timestamp, issued: Timestamp, frozen: D0GrantRowProof, executed: ExecutedGrantRow) -> D0DoorGate
-{
-  match kind {
-    D0RunRefused { reason: r } => D0DoorRefused { reason: r }
-    D0FirstRun { request: request } =>
-      match d0_honored_standing_grant(request: request, frozen: frozen, executed: executed) {
-        Present { value: g } => D0DoorAdmitted { authorization: standing_grant_authorization(g: g, request: request, issued: issued, expires: expires), basis: D0BasisStandingGrant { identity: g.identity } }
-        Absent => d0_file_and_poll(request: request, issued: issued, expires: expires)
-      }
-    D0Rerun { request: request } =>
-      match d0_honored_standing_grant(request: request, frozen: frozen, executed: executed) {
-        Present { value: g } => D0DoorAdmitted { authorization: standing_grant_authorization(g: g, request: request, issued: issued, expires: expires), basis: D0BasisStandingGrant { identity: g.identity } }
-        Absent => d0_gate_rerun_by_broker(store: store, request: request, transaction: transaction, expires: expires, issued: issued)
-      }
-  }
-}
-
-fn d0_gate_rerun_by_broker(store: FabricStorageBinding, request: AuthorizationRequest<D0Subject>, transaction: NonEmptyStr, expires: Timestamp, issued: Timestamp) -> D0DoorGate
-{
-      let claim = d0_read_claim(store: store, escalation_id: request.escalation_id)
-      match claim {
-        D0ClaimAbsent =>
-          match d0_absent_claim_step(read: approval_standing_read(escalation_id: request.escalation_id, expires_at: expires), request: request) {
-            D0AbsentClaimClockUnreadable => D0DoorRefused { reason: "clock unreadable; refusing to judge expiry against a fabricated instant" }
-            D0AbsentClaimFileFrozen => d0_file_and_poll(request: request, issued: issued, expires: expires)
-            D0AbsentClaimEnterPoll => d0_poll(request: request, expires: expires)
-            D0AbsentClaimDecided { gate: g } => d0_door_gate_of(gate: g)
-          }
-        D0ClaimAt { state: _, generation: _ } => d0_resume_claimed(claim: claim, transaction: transaction, expires: expires, request: request)
-        D0ClaimUnreadable { reason: _ } => d0_resume_claimed(claim: claim, transaction: transaction, expires: expires, request: request)
-      }
-}
-
-// A claim that was read (at a state, or unreadable) resumes only through the recorded decision.
-fn d0_resume_claimed(claim: D0ClaimReading, transaction: NonEmptyStr, expires: Timestamp, request: AuthorizationRequest<D0Subject>) -> D0DoorGate
-{
-  match approval_standing_read(escalation_id: request.escalation_id, expires_at: expires) {
-    StandingClockUnreadable => D0DoorRefused { reason: "clock unreadable; refusing to judge expiry against a fabricated instant" }
-    StandingReadAt { standing: standing, observed_at: _ } =>
-      match d0_resumable_authorization(claim: claim, transaction: transaction, poll: standing, request: request) {
-        D0Resumable { authorization: a } => D0DoorAdmitted { authorization: a, basis: D0BasisBroker }
-        D0NotRecorded { cause: c } => D0DoorRefused { reason: join(["the consent's recorded decision does not resume this run: ", approval_refusal_text(cause: c)], "") }
-        D0NotClaimedHere { reason: r } => D0DoorRefused { reason: join(["the consent cannot be resumed by this run: ", r as String], "") }
-      }
-  }
-}
-
-fn d0_poll(request: AuthorizationRequest<D0Subject>, expires: Timestamp) -> D0DoorGate
-{
-  d0_door_gate_of(gate: approval_gate_from_outcome(outcome: approval_poll_ticks(remaining: d0_poll_tick_budget, cadence: d0_poll_cadence, escalation_id: request.escalation_id, expires_at: expires), request: request))
-}
-
-fn d0_file_and_poll(request: AuthorizationRequest<D0Subject>, issued: Timestamp, expires: Timestamp) -> D0DoorGate
-{
-  match approval_file_stored_request(stored: stored_request_from_authorization(request: request, issued_at: issued, expires_at: expires), body_file_name: d0_submit_body_file_name, submit_timeout: d0_submit_timeout) {
-    ApprovalFilingRefused { reason: r } => D0DoorRefused { reason: r }
-    ApprovalFiled => d0_poll(request: request, expires: expires)
-  }
-}
-
-fn pair_serving_d0_wet(group: String, transaction: String, authorization: String, execution_revision: String) -> ProcessExit
-{
-  match parse_fabric_group(wire: group) {
-    Absent => refuse(reason: join(["`", group, "` names no fabric group"], ""))
-    Present { value: g } =>
-      if transaction == "" {
-        refuse(reason: "a transaction must be named")
-      } else if authorization == "" {
-        refuse(reason: "an authorization (escalation id) must be named")
-      } else if execution_revision == "" {
-        refuse(reason: "the execution revision must be named; it is frozen with the filing and a rerun must execute it")
-      } else {
-      match d0_store_write_wall_standing(group: g, escalation_id: authorization as NonEmptyStr) {
-        Present { value: wall } => refuse(reason: wall)
-        Absent =>
-      match observe_executor_reach() {
-        ExecutorReachUnknown { cause: c } => refuse(reason: c)
-        ExecutorReachKnown { short_hostname: executor, path: _ } =>
-      match event_log_store_for_host(short_hostname: executor) {
-        HostStoreRefused { detail: d } => refuse(reason: d)
-        HostStoreResolved { store: store, executor: _ } =>
-      match approval_instant_now() {
-        Absent => refuse(reason: "clock unreadable; cannot mint an approval window")
-        Present { value: issued } => {
-          let executed_row = executed_grant_row()
-          let run_kind = d0_run_kind_with(store: store, g: g, escalation_id: authorization as NonEmptyStr, transaction: transaction as NonEmptyStr, execution_revision: execution_revision as NonEmptyStr, fresh_proof: fresh_grant_row_proof(executed: executed_row))
-          match d0_gate(store: store, kind: run_kind, transaction: transaction as NonEmptyStr, expires: approval_expires_at(issued: issued, window: d0_approval_window()), issued: issued, frozen: d0_filed_grant_proof(store: store, escalation_id: authorization as NonEmptyStr), executed: executed_row) {
-            D0DoorRefused { reason: r } => refuse(reason: r)
-            D0DoorAdmitted { authorization: scoped, basis: basis } =>
-              match approval_instant_now() {
-                Absent => refuse(reason: "clock unreadable at the claim; the consent is admitted but no instant can authorize or stamp the claim")
-                Present { value: now } =>
-                  match now_epoch_seconds() {
-                    Absent => refuse(reason: "the clock could not be read as epoch seconds")
-                    Present { value: at } =>
-                      d0_dispatch_with(basis: basis, store: store, g: g, group: group, current_hosts: fabric_group_hosts(g: g), scoped: scoped, tx: transaction as NonEmptyStr, esc: authorization as NonEmptyStr, executor: executor as NonEmptyStr, at: at, now: now, current: current_pair_serving_authority(store: store, group: g, at: at))
-                  }
-              }
-          }
-        }
-      }
-      }
-      }
-      }
-      }
-  }
-}
-
-// ── THE FLEET-CONVERGE MODE: pair_serving_d0 on the broker host ──────────────────────────────
-//
-// THE MODE IS CUT D, AND CUT D IS GROUP A. The lower door is generic over the fabric group; this
-// mode is not: it passes FabricGroupA and takes no group input, because the program's subject is
-// a bounded replacement on Group A and consuming Group B is a stated non-goal -- an exact approval
-// over a Group B subject would make an out-of-program subject exactly authorized, not repair it.
-//
-// THE CONSENT NAMES THE TRANSACTION: one escalation id is one consent is one lifecycle, and a rerun
-// after a crash names the SAME consent so it finds its frozen filing and its held claim -- which is
-// why the id is an operator-supplied input and never derived from the run id. THE EXECUTION
-// REVISION is the workflow's expected_revision (the ref the job checked out), frozen with the first
-// filing; a rerun that executes another revision refuses before polling or mutating anything.
-//
-// THE EXECUTOR IS srv1, PROVED TWICE AND BEFORE ANY CREDENTIAL: the broker is loopback on the host
-// that serves the dashboard. The dispatch's host input (the runner label the job was scheduled on)
-// and the kernel's own hostname must both be srv1, and pair_serving_d0_admit_executor runs that
-// admission as a credential-free step BEFORE the job acquires its WIF token, loads the fleet ssh key
-// or materializes the submission MAC key -- so a dispatch to another host refuses with no secret on
-// that host. The door's own entry re-runs the same admission after the credentials, from the same
-// pure fold, so neither seam can drift from the other. THE REVISION NAMES THE EXECUTING SOURCE: the
-// admission reads the checked-out tree's HEAD and requires it to equal expected_revision, so the
-// frozen sha is the source this binary was built from and runs (the workflow checks out that ref
-// and builds the release bins from it), never a dispatch-supplied value standing alone.
-data pair_serving_d0_consent_env: NonEmptyStr = "GUNBC_D0_CONSENT" as NonEmptyStr
-
-type D0ModeAdmission
-  = D0ModeAdmitted { group: FabricGroup, transaction: NonEmptyStr, authorization: NonEmptyStr, execution_revision: NonEmptyStr }
-  | D0ModeRefused { reason: String }
-
-fn pair_serving_d0_mode_admission(declared_host: String, kernel_host: String, consent: String, execution_revision: String, checked_out_revision: String) -> D0ModeAdmission {
-  if declared_host != (operator_host_srv1 as String) {
-    D0ModeRefused { reason: join(["the dispatch names host ", declared_host, ": POST/GET /approvals is loopback on the machine that serves the dashboard, which is ", operator_host_srv1 as String], "") }
-  } else if kernel_host != (operator_host_srv1 as String) {
-    D0ModeRefused { reason: join(["the dispatch names ", operator_host_srv1 as String, " but this job runs on ", kernel_host, "; the broker is loopback on ", operator_host_srv1 as String], "") }
-  } else if consent == "" {
-    D0ModeRefused { reason: join([pair_serving_d0_consent_env as String, " is unset; the mode names no consent (escalation id), and a run must name the same one on every rerun"], "") }
-  } else if execution_revision == "" {
-    D0ModeRefused { reason: "no expected_revision; the consent is frozen with the executable that files it and a rerun must execute the same one" }
-  } else if checked_out_revision != execution_revision {
-    D0ModeRefused { reason: join(["expected_revision ", execution_revision, " is not the tree this job runs from (HEAD ", checked_out_revision, "); the frozen revision must name the executing source, not a dispatch-supplied value"], "") }
-  } else {
-    D0ModeAdmitted { group: FabricGroupA, transaction: consent as NonEmptyStr, authorization: consent as NonEmptyStr, execution_revision: execution_revision as NonEmptyStr }
-  }
-}
-
-fn pair_serving_d0_declared_host() -> String {
-  match actions_variable_read(name: fleet_converge_expected_host_env_name) {
-    ActionsVariablePresent { value: v } => v
-    ActionsVariableAbsent { variable: _, detail: _ } => ""
-  }
-}
-
-fn pair_serving_d0_execution_revision() -> String {
-  match read_expected_revision() {
-    ExpectedRevisionPresent { revision: r } => r
-    ExpectedRevisionAbsent { variable: _, detail: _ } => ""
-  }
-}
-
-fn pair_serving_d0_checked_out_revision() -> String {
-  let head = git.Inspect.HeadCommit(expect: ExpectSuccess)
-  if !head.success { "" } else { head.sha as String }
-}
-
-fn pair_serving_d0_kernel_host() -> String
-{
-  match observe_executor_reach() {
-    ExecutorReachKnown { short_hostname: h, path: _ } => h
-    ExecutorReachUnknown { cause: _ } => ""
-  }
-}
-
-// The credential-free admission step: refuses, or prints the admitted arguments, before the job
-// holds any secret.
-fn pair_serving_d0_admit_executor() -> ProcessExit
-{
-  match pair_serving_d0_mode_admission(declared_host: pair_serving_d0_declared_host(), kernel_host: pair_serving_d0_kernel_host(), consent: actions_variable_trimmed(name: pair_serving_d0_consent_env), execution_revision: pair_serving_d0_execution_revision(), checked_out_revision: pair_serving_d0_checked_out_revision()) {
-    D0ModeRefused { reason: r } => refuse(reason: r)
-    D0ModeAdmitted { group: _, transaction: _, authorization: _, execution_revision: _ } => ExitSuccess
-  }
-}
-
-fn pair_serving_d0_ci_wet() -> ProcessExit
-{
-  match pair_serving_d0_mode_admission(declared_host: pair_serving_d0_declared_host(), kernel_host: pair_serving_d0_kernel_host(), consent: actions_variable_trimmed(name: pair_serving_d0_consent_env), execution_revision: pair_serving_d0_execution_revision(), checked_out_revision: pair_serving_d0_checked_out_revision()) {
-    D0ModeRefused { reason: r } => refuse(reason: r)
-    D0ModeAdmitted { group: g, transaction: tx, authorization: auth, execution_revision: rev } =>
-      pair_serving_d0_wet(group: fabric_group_wire(g: g) as String, transaction: tx as String, authorization: auth as String, execution_revision: rev as String)
-  }
-}
diff --git a/dag/gunbc/spark/pair_serving_desired.dag b/dag/gunbc/spark/pair_serving_desired.dag
index 5d40cd51c00..59adedce803 100644
--- a/dag/gunbc/spark/pair_serving_desired.dag
+++ b/dag/gunbc/spark/pair_serving_desired.dag
@@ -22,13 +22,10 @@ import gunbc.spark.serving_engine {
 }
 import gunbc.fleet_host_identity { operator_host_srv9 }
 import gunbc.spark.fabric_switch_observed {
-  FabricGroup, FabricGroupA, FabricGroupB, fabric_group_hosts, fabric_group_wire,
-  FabricLaneObserved, fabric_lane_for_host,
+  FabricGroup, FabricGroupB, fabric_group_hosts, fabric_group_wire, FabricLaneObserved, fabric_lane_for_host,
 }
 import gunbc.spark.pair_serving_authority { spark_pair_serving_authorities, pair_serving_authority_group }
 import gunbc.spark.fabric_rail_desired { fabric_rail_address_of }
-import gunbc.spark.llama_cpp_rpc_observed { llama_cpp_rpc_host_holds_undischarged_reservation }
-import gunbc.spark.pair_serving_observed { first_pair_observed_head }
 
 // SPARK-BATCH-3 (operator, 2026-09-05): THE SERVING UNIT IS A FABRIC GROUP, NOT A HOST. DeepSeek V4
 // Flash does not fit one Spark's unified pool, so the desired serving state is one vLLM engine
@@ -211,8 +208,9 @@ data spark_pair_serving_declared_enforcers: List<MemoryEnforcerKind> = [KernelOo
 //
 // AND EMPTYING THIS ROW IS NOT SILENT TODAY, which is worth knowing before you assume you are the only
 // guard. Two enrolled witnesses go RED rather than vacuous:
-// test.claim.spark.spark_pair_serving_desired_witness asserts length(spark_pair_serving_groups) == 1, so
-// emptying it fails that claim directly, and
+// test.claim.spark.spark_pair_serving_desired_witness asserted length(spark_pair_serving_groups) == 1 until
+// the row WAS emptied (Group A decommissioned, 2026-10-07); it now asserts == 0 and that Group B is not in
+// the roster, so the empty state is a claim rather than a vacuum, and
 // test.claim.spark.serving_deployment_selection_witness_test reaches the roster through `any`, which is FALSE on
 // an empty list rather than true. So a lane that empties this row meets a red floor, not silence -- the
 // hazard above is what happens if someone answers that red by relaxing the claims instead of by asking
@@ -272,13 +270,11 @@ data spark_pair_serving_declared_enforcers: List<MemoryEnforcerKind> = [KernelOo
 // sitting in front of them in the same declaration.
 data spark_pair_serving_groups: List<FabricGroup> = map(spark_pair_serving_authorities, a => pair_serving_authority_group(a: a))
 
-// WHICH HOST IS THE HEAD IS AN ATTRIBUTABLE ROW. Group A: srv6, the observed head of the first pair
-// (serve process, unit and Ray node address were all there). Group B: srv9 (spark-0c75), the unit the
+// WHICH HOST IS THE HEAD IS AN ATTRIBUTABLE ROW. Group B: srv9 (spark-0c75), the unit the
 // operator named first of that batch; an arbitrary choice among identical units, written down.
 fn spark_pair_serving_head(group: FabricGroup) -> HostIdentity {
   match group {
-    FabricGroupA => first_pair_observed_head
-    FabricGroupB => operator_host_srv9
+    FabricGroupB {} => operator_host_srv9
   }
 }
 
@@ -424,17 +420,8 @@ fn spark_pair_serving_workers(group: FabricGroup, hosts: List<HostIdentity>) ->
 
 fn spark_pair_serving_unit_with(group: FabricGroup, capacity: SparkPairServingSeqCapacity) -> SparkPairServingUnit {
   let hosts = fabric_group_hosts(g: group)
-  let reserved = filter(hosts, h => llama_cpp_rpc_host_holds_undischarged_reservation(host: h))
   if length(hosts) < 2 {
     SparkPairServingUnitRefused { group: group, cause: "a serving group needs at least two hosts on the fabric" as NonEmptyStr }
-  } else if length(reserved) > 0 {
-    SparkPairServingUnitRefused {
-      group: group,
-      cause: join([
-        "group member(s) still hold an undischarged llama.cpp RPC peer reservation, and no release receipt exists: ",
-        join(map(reserved, h => h as String), ", "),
-      ], "") as NonEmptyStr,
-    }
   } else {
     match capacity {
       SeqCapacityUnmeasured =>
@@ -485,13 +472,6 @@ fn spark_pair_serving_unit(group: FabricGroup) -> SparkPairServingUnit {
 
 data spark_pair_serving_desired: List<SparkPairServingUnit> = map(spark_pair_serving_groups, g => spark_pair_serving_unit(group: g))
 
-fn spark_pair_serving_unit_hosts(u: SparkPairServingUnit) -> List<HostIdentity> {
-  match u {
-    SparkPairServingUnitReady { group: _, engine: _, head: h, workers: ws } => concat([h.host], map(ws, w => w.host))
-    SparkPairServingUnitRefused { group: _, cause: _ } => [] as List<HostIdentity>
-  }
-}
-
 // THE HEAD OF A GROUP'S DESIRED UNIT, for a reader that must ask the host whose engine exports the
 // group's endpoint. A refused unit has no head, and a group not on the roster has none either;
 // both are Absent rather than a fabricated host.
@@ -508,10 +488,6 @@ fn spark_pair_group_head_host(group: FabricGroup) -> HostIdentity? {
     })
 }
 
-fn spark_pair_serving_desired_hosts() -> List<HostIdentity> {
-  flat_map(spark_pair_serving_desired, u => spark_pair_serving_unit_hosts(u: u))
-}
-
 fn participant_wire(p: SparkPairServingParticipant) -> String {
   join([p.host as String, "@", render_ipv4_address(addr: p.host_ip) as String], "")
 }
diff --git a/dag/gunbc/spark/pair_serving_observed.dag b/dag/gunbc/spark/pair_serving_observed.dag
index bb573c766e2..260e737457c 100644
--- a/dag/gunbc/spark/pair_serving_observed.dag
+++ b/dag/gunbc/spark/pair_serving_observed.dag
@@ -6,8 +6,7 @@ import std.measure { Millisecond, millisecond, TokenCount, token_count, ByteSize
 import std.interval { IntervalConstruction, OrderedClosedInterval, closed_interval, interval_high }
 import product.host_identity { HostIdentity }
 import extdeps.network.ipv4 { Ipv4Address, ipv4_address }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6 }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 
 // THE FIRST PAIR AS IT ACTUALLY RUNS, READ ON 2026-09-05 FROM THE HOSTS, NOT FROM THE DESIRED ROW.
 // Head 192.168.1.225 (srv6, spark-3bd5) serves DeepSeek V4 Flash at tensor-parallel 2 with worker
@@ -204,24 +203,6 @@ data first_pair_collective_env_live: CollectiveTransportEnvObserved = Collective
 data first_pair_script_tp_socket_ifname: NonEmptyStr = "enp1s0f0np0" as NonEmptyStr
 data first_pair_container_baked_node_ip: NonEmptyStr = "192.168.50.58 (foreign to every fleet segment)" as NonEmptyStr
 
-// Units on each host and their observed activity. The head's unit is a boot-time bring-up that is
-// inactive while the container it started 36 hours earlier keeps running; the engine itself was
-// launched by nohup from launch_prod_pair.sh with stdout captured inside the container.
-type UnitObserved {
-  host: HostIdentity
-  unit: NonEmptyStr
-  scope: NonEmptyStr
-  active_state: NonEmptyStr
-  role: NonEmptyStr
-}
-
-data first_pair_units: List<UnitObserved> = [
-  UnitObserved { host: operator_host_srv6, unit: "spark-vllm.service" as NonEmptyStr, scope: "system" as NonEmptyStr, active_state: "inactive (dead)" as NonEmptyStr, role: "boot-time bring-up of the head container; the container outlived it" as NonEmptyStr },
-  UnitObserved { host: operator_host_srv5, unit: "spark-ray-worker.service" as NonEmptyStr, scope: "system" as NonEmptyStr, active_state: "active (running)" as NonEmptyStr, role: "runs /usr/local/bin/spark-ray-worker.sh: ray worker only, no vllm serve" as NonEmptyStr },
-  UnitObserved { host: operator_host_srv5, unit: "gunbc-vllm.service" as NonEmptyStr, scope: "system" as NonEmptyStr, active_state: "inactive (dead)" as NonEmptyStr, role: "leftover of the abandoned earlier gunbc deployment; loaded with no unit file on disk, not in any wants directory" as NonEmptyStr },
-  UnitObserved { host: operator_host_srv5, unit: "gunbc-vllm-verify.service" as NonEmptyStr, scope: "system" as NonEmptyStr, active_state: "failed" as NonEmptyStr, role: "leftover of the abandoned earlier gunbc deployment; loaded with no unit file on disk, not in any wants directory" as NonEmptyStr },
-]
-
 data first_pair_stdout_capture: NonEmptyStr = "/root/prod_a.log inside container dsv4 on 192.168.1.225 (nohup $LAUNCH > $LOG 2>&1)" as NonEmptyStr
 
 // THE POOL, FROM THE ENGINE'S OWN STARTUP LINE. The earlier figure derived from num_gpu_blocks x
@@ -256,14 +237,7 @@ type GroupKvPoolObserved {
 
 data group_kv_pools_observed: List<GroupKvPoolObserved> = [
   GroupKvPoolObserved {
-    group: FabricGroupA,
-    pool_tokens: 11767856,
-    max_concurrency_at_max_model_len_wire: "11.22x for 1,048,576 tokens per request" as NonEmptyStr,
-    probed_at: "2026-09-05T20:44Z" as NonEmptyStr,
-    source_line: "[kv_cache_utils.py:1733] GPU KV cache size: 11,767,856 tokens" as NonEmptyStr,
-  },
-  GroupKvPoolObserved {
-    group: FabricGroupB,
+    group: FabricGroupB {},
     pool_tokens: 11952124,
     max_concurrency_at_max_model_len_wire: "11.40x for 1,048,576 tokens per request" as NonEmptyStr,
     probed_at: "2026-09-05T21:20:37Z" as NonEmptyStr,
@@ -273,8 +247,7 @@ data group_kv_pools_observed: List<GroupKvPoolObserved> = [
 
 fn fabric_group_same(a: FabricGroup, b: FabricGroup) -> Bool {
   match a {
-    FabricGroupA => match b { FabricGroupA => true  FabricGroupB => false }
-    FabricGroupB => match b { FabricGroupA => false  FabricGroupB => true }
+    FabricGroupB {} => match b { FabricGroupB {} => true }
   }
 }
 
@@ -353,16 +326,11 @@ type GroupRankFreeMemoryObserved {
   precision_caveat: NonEmptyStr
 }
 
-data group_rank_free_memory_observed: List<GroupRankFreeMemoryObserved> = [
-  GroupRankFreeMemoryObserved {
-    group: FabricGroupA,
-    reported_free_wire: "116.9 GiB free per rank with the engine idle" as NonEmptyStr,
-    free: gib_hundredths_interval(low_hundredths: 11685, high_hundredths: 11695),
-    probed_at: "2026-09-12" as NonEmptyStr,
-    instrument: "the serving runtime's own memory-profiling line on an idle Group A rank during the V4.1 Flash rollout, read from the head's captured stdout; NVML refuses this query on unified memory and must not be substituted for it" as NonEmptyStr,
-    precision_caveat: "the runtime reports one decimal of GiB, so the true free value lies within about 0.05 GiB of this figure; a verdict drawn against this bound must exceed that uncertainty to be established rather than borderline" as NonEmptyStr,
-  },
-]
+// THE ONE READING THERE WAS IS GONE WITH ITS HOSTS: it was an idle Group A rank (2026-09-12), and Group A was
+// decommissioned on 2026-10-07 (operator; sold). No Group B rank has an idle-engine reading of the same kind
+// -- gunbc.spark.arm_memory_experiment_observed reads free memory at boot, before any engine is loaded,
+// which is a different quantity -- so every consumer answers unestablished until one is taken.
+data group_rank_free_memory_observed: List<GroupRankFreeMemoryObserved> = [] as List<GroupRankFreeMemoryObserved>
 
 // ONE TENTH OF A GIBIBYTE IS NOT A BYTE COUNT ANYONE SHOULD TYPE. The reported figure is tenths of
 // GiB, so the byte value is a std.measure scaling of a Gibibyte measure and not a hand-multiplied
@@ -411,10 +379,6 @@ fn group_rank_free_memory(group: FabricGroup) -> GroupRankFreeMemoryObserved? {
   first(filter(group_rank_free_memory_observed, r => fabric_group_same(a: r.group, b: group)))
 }
 
-// The head host of the first pair as observed: the unit and the serve process are on srv6, and the
-// Ray node address is srv6's rail-0 endpoint.
-data first_pair_observed_head: HostIdentity = operator_host_srv6
-
 // DRIFT THE OBSERVATION SURFACED. Each row is a disagreement between two sources for one fact; the
 // render slice must resolve each explicitly rather than pick a side by accident.
 type PairServingObservedDrift {
diff --git a/dag/gunbc/spark/pair_serving_realization.dag b/dag/gunbc/spark/pair_serving_realization.dag
index cab75d2db0d..7d0e94fd23b 100644
--- a/dag/gunbc/spark/pair_serving_realization.dag
+++ b/dag/gunbc/spark/pair_serving_realization.dag
@@ -43,7 +43,7 @@ import extdeps.systemd.unit_file {
   serialize_systemd_unit_file,
 }
 import gunbc.spark.serving_engine { ServingEngine, VllmServing, OllamaServing }
-import gunbc.spark.fabric_switch_observed { FabricLaneObserved, FabricGroup, FabricGroupA, FabricGroupB, fabric_group_wire }
+import gunbc.spark.fabric_switch_observed { FabricLaneObserved, FabricGroup, FabricGroupB, fabric_group_wire }
 import gunbc.spark.native_serving_realization {
   GlmNativeUnitRender, GlmNativeUnitRendered, GlmNativeUnitRenderRefused, glm_native_head_unit_render,
 }
@@ -649,31 +649,6 @@ fn spark_pair_realizations() -> List<SparkPairRealization> {
   map(spark_pair_serving_desired, u => spark_pair_realization(unit: u))
 }
 
-data spark_pair_no_realization_names_group_obligation: NonEmptyStr = "no pair realization names this fabric group, so there are no rendered head-unit bytes to digest" as NonEmptyStr
-
-// THE GROUP-LEVEL PRODUCER: render the head unit for this group once, digest it once. Callers hold
-// the resulting standing for the lifetime of their transaction rather than calling this again --
-// harness_bind_seat is the least common ancestor of every consumer and calls it once per bind.
-fn spark_pair_head_unit_render_for_group(group: FabricGroup) -> SparkPairUnitRender {
-  match first(filter(spark_pair_realizations(), r =>
-    match r {
-      SparkPairRealizationRefused { group: g, cause: _ } => (fabric_group_wire(g: g) as String) == (fabric_group_wire(g: group) as String)
-      SparkPairRealized { group: g, head: _, workers: _ } => (fabric_group_wire(g: g) as String) == (fabric_group_wire(g: group) as String)
-    })) {
-    Absent =>
-      SparkPairUnitRenderRefused {
-        unit_name: spark_pair_head_unit_name,
-        cause: spark_pair_no_realization_names_group_obligation,
-      }
-    Present { value: r } =>
-      match r {
-        SparkPairRealizationRefused { group: _, cause: c } =>
-          SparkPairUnitRenderRefused { unit_name: spark_pair_head_unit_name, cause: c }
-        SparkPairRealized { group: _, head: h, workers: _ } => h.unit
-      }
-  }
-}
-
 // THE GROUP'S DECLARED HEAD UNIT IS ITS OWN ARM'S. Group A is served by the pair realization and its
 // head unit is rendered here; group B is served by the native four-rank arm, whose head unit
 // gunbc.spark.native_serving_realization glm_native_head_unit_render renders from the arm's own
@@ -682,8 +657,7 @@ fn spark_pair_head_unit_render_for_group(group: FabricGroup) -> SparkPairUnitRen
 // below still takes only a group, and a caller still cannot reach past it to choose bytes.
 fn declared_head_unit_render_for_group(group: FabricGroup) -> SparkPairUnitRender {
   match group {
-    FabricGroupA => spark_pair_head_unit_render_for_group(group: group)
-    FabricGroupB =>
+    FabricGroupB {} =>
       match glm_native_head_unit_render() {
         GlmNativeUnitRenderRefused { unit_name: n, cause: c } => SparkPairUnitRenderRefused { unit_name: n, cause: c }
         GlmNativeUnitRendered { unit_name: n, text: t } => SparkPairUnitRendered { unit_name: n, text: t }
diff --git a/dag/gunbc/spark/runtime_architecture_registry_reading.dag b/dag/gunbc/spark/runtime_architecture_registry_reading.dag
index 85dae6c09a1..42494ee0b37 100644
--- a/dag/gunbc/spark/runtime_architecture_registry_reading.dag
+++ b/dag/gunbc/spark/runtime_architecture_registry_reading.dag
@@ -43,30 +43,6 @@ type ArchitectureRegistryReading {
   architectures: List<NonEmptyStr>
 }
 
-// A READING APPLIES TO A DESIRED IMAGE ONLY IF IT WAS TAKEN INSIDE THAT EXACT DIGEST. There is no
-// near-match arm and no repository-level fallback: two digests of one repository are two different
-// images, and the whole reason this fleet pins by digest is that they answer differently.
-// THE REGISTRY DUMP'S TWO LINE KINDS, read the same way by every probe that prints one: a
-// `REGISTRY_COUNT <n>` line and one `REGISTERED <architecture>` line per architecture
-// (gunbc.spark.v41_runtime_image_probe and gunbc.spark.glm53_kvplan_image both print this shape). A
-// reading is minted from a dump only when the two agree; that check is the caller's, because the
-// caller also owns which digest the dump was taken inside.
-fn registry_dump_architectures(stdout: String) -> List<NonEmptyStr> {
-  flat_map(split(stdout, "\n"), l => {
-    let t = trim(s: l)
-    if starts_with(s: t, prefix: "REGISTERED ") && length(t) > 11 { [substring(s: t, start: 11, end: length(t)) as NonEmptyStr] } else { [] as List<NonEmptyStr> }
-  })
-}
-
-fn registry_dump_count(stdout: String) -> Int? {
-  first(flat_map(split(stdout, "\n"), l => {
-    let t = trim(s: l)
-    if starts_with(s: t, prefix: "REGISTRY_COUNT ") {
-      match parse_int(s: substring(s: t, start: 15, end: length(t))) { Present { value: n } => [n]  Absent => [] as List<Int> }
-    } else { [] as List<Int> }
-  }))
-}
-
 fn reading_applies_to(r: ArchitectureRegistryReading, desired_reference: NonEmptyStr) -> Bool {
   let observed = r.image_reference as String
   let desired = desired_reference as String
@@ -2374,398 +2350,6 @@ data glm53_derived_registry_reading: ArchitectureRegistryReading = ArchitectureR
   ],
 }
 
-// THE GROUP A PRODUCTION OF THE KVPLAN-V2 BUILD, READ INSIDE ITS OWN CONTENT ID. Unlike the Group B layer
-// above (built per host, so keyed by tag), this image was produced once on srv7 by fleet-converge run
-// 37100656092 and is moved between Group A hosts by its configuration digest, so the reading is keyed by
-// that digest. The probe ran inside it in the same run (gunbc.spark.glm53_kvplan_image) and printed these
-// names verbatim.
-data glm53_kvplan_v2_group_a_registry_reading: ArchitectureRegistryReading = ArchitectureRegistryReading {
-  image_reference: "sha256:6ef84cd49a68dbefd957bfca36f0ec458ed80f8194def41642e7b37b34ae76fb" as NonEmptyStr,
-  host: "srv7" as NonEmptyStr,
-  observed_at: "2026-10-03T08:29:41Z" as NonEmptyStr,
-  instrument: "the gunbc.spark.glm53_kvplan_image probe: docker run inside the produced configuration digest, sorted vllm.model_executor.models.registry.ModelRegistry.get_supported_archs(), verbatim stdout of fleet-converge run 37100656092, 378 names" as NonEmptyStr,
-  architectures: [
-  "AXK1ForCausalLM" as NonEmptyStr,
-  "AfmoeForCausalLM" as NonEmptyStr,
-  "ApertusForCausalLM" as NonEmptyStr,
-  "ArceeForCausalLM" as NonEmptyStr,
-  "AriaForConditionalGeneration" as NonEmptyStr,
-  "AudioFlamingo3ForConditionalGeneration" as NonEmptyStr,
-  "BagelForConditionalGeneration" as NonEmptyStr,
-  "BailingMoeForCausalLM" as NonEmptyStr,
-  "BailingMoeV25MTPModel" as NonEmptyStr,
-  "BailingMoeV2ForCausalLM" as NonEmptyStr,
-  "BailingMoeV2_5ForCausalLM" as NonEmptyStr,
-  "BailingMoeV3ForCausalLM" as NonEmptyStr,
-  "BailingMoeV3MTPModel" as NonEmptyStr,
-  "BeeForConditionalGeneration" as NonEmptyStr,
-  "BertForMaskedLM" as NonEmptyStr,
-  "BertForSequenceClassification" as NonEmptyStr,
-  "BertForTokenClassification" as NonEmptyStr,
-  "BertModel" as NonEmptyStr,
-  "BertSpladeSparseEmbeddingModel" as NonEmptyStr,
-  "BgeM3EmbeddingModel" as NonEmptyStr,
-  "Blip2ForConditionalGeneration" as NonEmptyStr,
-  "BloomForCausalLM" as NonEmptyStr,
-  "CLIPModel" as NonEmptyStr,
-  "ChatGLMForConditionalGeneration" as NonEmptyStr,
-  "ChatGLMModel" as NonEmptyStr,
-  "Cohere2ForCausalLM" as NonEmptyStr,
-  "Cohere2MoeForCausalLM" as NonEmptyStr,
-  "Cohere2VisionForConditionalGeneration" as NonEmptyStr,
-  "CohereAsrForConditionalGeneration" as NonEmptyStr,
-  "CohereForCausalLM" as NonEmptyStr,
-  "ColBERTJinaRobertaModel" as NonEmptyStr,
-  "ColBERTLfm2Model" as NonEmptyStr,
-  "ColBERTModernBertModel" as NonEmptyStr,
-  "ColModernVBertForRetrieval" as NonEmptyStr,
-  "ColPaliForRetrieval" as NonEmptyStr,
-  "ColQwen3" as NonEmptyStr,
-  "ColQwen3_5" as NonEmptyStr,
-  "Cosmos3EdgeForConditionalGeneration" as NonEmptyStr,
-  "Cosmos3ForConditionalGeneration" as NonEmptyStr,
-  "CwmForCausalLM" as NonEmptyStr,
-  "DFlash2DraftModel" as NonEmptyStr,
-  "DFlashDraftModel" as NonEmptyStr,
-  "DFlashLagunaForCausalLM" as NonEmptyStr,
-  "DFlashMuseGlimmerAssistantModel" as NonEmptyStr,
-  "DSparkDraftModel" as NonEmptyStr,
-  "DbrxForCausalLM" as NonEmptyStr,
-  "DeciLMForCausalLM" as NonEmptyStr,
-  "DeepSeekMTPModel" as NonEmptyStr,
-  "DeepSeekV4MTPModel" as NonEmptyStr,
-  "DeepseekForCausalLM" as NonEmptyStr,
-  "DeepseekOCR2ForCausalLM" as NonEmptyStr,
-  "DeepseekOCRForCausalLM" as NonEmptyStr,
-  "DeepseekV2ForCausalLM" as NonEmptyStr,
-  "DeepseekV32ForCausalLM" as NonEmptyStr,
-  "DeepseekV32MTPModel" as NonEmptyStr,
-  "DeepseekV3BidirectionalModel" as NonEmptyStr,
-  "DeepseekV3ForCausalLM" as NonEmptyStr,
-  "DeepseekV4ForCausalLM" as NonEmptyStr,
-  "DeepseekV4ForConditionalGeneration" as NonEmptyStr,
-  "DeepseekVLV2ForCausalLM" as NonEmptyStr,
-  "DiffusionGemmaForBlockDiffusion" as NonEmptyStr,
-  "Dots3NoteForCausalLM" as NonEmptyStr,
-  "Dots3NoteMTPModel" as NonEmptyStr,
-  "DotsOCRForCausalLM" as NonEmptyStr,
-  "Eagle2_5_VLForConditionalGeneration" as NonEmptyStr,
-  "Eagle3DeepseekV2ForCausalLM" as NonEmptyStr,
-  "Eagle3DeepseekV3ForCausalLM" as NonEmptyStr,
-  "Eagle3LlamaForCausalLM" as NonEmptyStr,
-  "Eagle3MiniMaxM2ForCausalLM" as NonEmptyStr,
-  "Eagle3Qwen2_5vlForCausalLM" as NonEmptyStr,
-  "Eagle3Qwen3ForCausalLM" as NonEmptyStr,
-  "Eagle3Qwen3vlForCausalLM" as NonEmptyStr,
-  "EagleCohereForCausalLM" as NonEmptyStr,
-  "EagleDeepSeekMTPModel" as NonEmptyStr,
-  "EagleLlama4ForCausalLM" as NonEmptyStr,
-  "EagleLlamaForCausalLM" as NonEmptyStr,
-  "EagleMiniCPMForCausalLM" as NonEmptyStr,
-  "EagleMistralForCausalLM" as NonEmptyStr,
-  "EagleMistralLarge3ForCausalLM" as NonEmptyStr,
-  "Emu3ForConditionalGeneration" as NonEmptyStr,
-  "Ernie4_5ForCausalLM" as NonEmptyStr,
-  "Ernie4_5_MoeForCausalLM" as NonEmptyStr,
-  "Ernie4_5_VLMoeForConditionalGeneration" as NonEmptyStr,
-  "ErnieMTPModel" as NonEmptyStr,
-  "Exaone4ForCausalLM" as NonEmptyStr,
-  "Exaone4_5_ForConditionalGeneration" as NonEmptyStr,
-  "Exaone4_5_MTP" as NonEmptyStr,
-  "ExaoneForCausalLM" as NonEmptyStr,
-  "ExaoneMoeForCausalLM" as NonEmptyStr,
-  "ExaoneMoeMTP" as NonEmptyStr,
-  "ExtractHiddenStatesModel" as NonEmptyStr,
-  "FalconForCausalLM" as NonEmptyStr,
-  "FalconH1ForCausalLM" as NonEmptyStr,
-  "FalconMambaForCausalLM" as NonEmptyStr,
-  "FireRedASR2ForConditionalGeneration" as NonEmptyStr,
-  "FlexOlmoForCausalLM" as NonEmptyStr,
-  "FunASRForConditionalGeneration" as NonEmptyStr,
-  "FunAudioChatForConditionalGeneration" as NonEmptyStr,
-  "GLM4VForCausalLM" as NonEmptyStr,
-  "GPT2ForSequenceClassification" as NonEmptyStr,
-  "GPT2LMHeadModel" as NonEmptyStr,
-  "GPTBigCodeForCausalLM" as NonEmptyStr,
-  "GPTJForCausalLM" as NonEmptyStr,
-  "GPTNeoXForCausalLM" as NonEmptyStr,
-  "Gemma2ForCausalLM" as NonEmptyStr,
-  "Gemma2Model" as NonEmptyStr,
-  "Gemma3ForCausalLM" as NonEmptyStr,
-  "Gemma3ForConditionalGeneration" as NonEmptyStr,
-  "Gemma3TextModel" as NonEmptyStr,
-  "Gemma3nForCausalLM" as NonEmptyStr,
-  "Gemma3nForConditionalGeneration" as NonEmptyStr,
-  "Gemma4DSparkModel" as NonEmptyStr,
-  "Gemma4ForCausalLM" as NonEmptyStr,
-  "Gemma4ForConditionalGeneration" as NonEmptyStr,
-  "Gemma4MTPModel" as NonEmptyStr,
-  "Gemma4UnifiedForConditionalGeneration" as NonEmptyStr,
-  "GemmaForCausalLM" as NonEmptyStr,
-  "Glm4ForCausalLM" as NonEmptyStr,
-  "Glm4MoeForCausalLM" as NonEmptyStr,
-  "Glm4MoeLiteForCausalLM" as NonEmptyStr,
-  "Glm4MoeLiteMTPModel" as NonEmptyStr,
-  "Glm4MoeMTPModel" as NonEmptyStr,
-  "Glm4vForConditionalGeneration" as NonEmptyStr,
-  "Glm4vMoeForConditionalGeneration" as NonEmptyStr,
-  "Glm5NextForCausalLM" as NonEmptyStr,
-  "Glm5NextForConditionalGeneration" as NonEmptyStr,
-  "Glm5NextMTPModel" as NonEmptyStr,
-  "GlmAsrForConditionalGeneration" as NonEmptyStr,
-  "GlmForCausalLM" as NonEmptyStr,
-  "GlmMoeDsaForCausalLM" as NonEmptyStr,
-  "GlmOcrForConditionalGeneration" as NonEmptyStr,
-  "GlmOcrMTPModel" as NonEmptyStr,
-  "GptOssForCausalLM" as NonEmptyStr,
-  "Granite4VisionForConditionalGeneration" as NonEmptyStr,
-  "GraniteForCausalLM" as NonEmptyStr,
-  "GraniteMoeForCausalLM" as NonEmptyStr,
-  "GraniteMoeHybridForCausalLM" as NonEmptyStr,
-  "GraniteMoeSWAForCausalLM" as NonEmptyStr,
-  "GraniteMoeSharedForCausalLM" as NonEmptyStr,
-  "GraniteSWAForCausalLM" as NonEmptyStr,
-  "GraniteSpeechForConditionalGeneration" as NonEmptyStr,
-  "GraniteSpeechPlusForConditionalGeneration" as NonEmptyStr,
-  "GteModel" as NonEmptyStr,
-  "GteNewForSequenceClassification" as NonEmptyStr,
-  "GteNewModel" as NonEmptyStr,
-  "H2OVLChatModel" as NonEmptyStr,
-  "HCXVisionV2ForCausalLM" as NonEmptyStr,
-  "HF_ColBERT" as NonEmptyStr,
-  "HYV3ForCausalLM" as NonEmptyStr,
-  "HYV3MTPModel" as NonEmptyStr,
-  "HYV4ForCausalLM" as NonEmptyStr,
-  "HYV4MTPModel" as NonEmptyStr,
-  "HfMoondream" as NonEmptyStr,
-  "HrmTextForCausalLM" as NonEmptyStr,
-  "HunYuanDenseV1ForCausalLM" as NonEmptyStr,
-  "HunYuanMoEV1ForCausalLM" as NonEmptyStr,
-  "HunYuanVLForConditionalGeneration" as NonEmptyStr,
-  "HyperCLOVAXForCausalLM" as NonEmptyStr,
-  "IQuestCoderForCausalLM" as NonEmptyStr,
-  "IQuestLoopCoderForCausalLM" as NonEmptyStr,
-  "Idefics3ForConditionalGeneration" as NonEmptyStr,
-  "InklingForCausalLM" as NonEmptyStr,
-  "InklingForConditionalGeneration" as NonEmptyStr,
-  "InklingMTPModel" as NonEmptyStr,
-  "InternLM2ForCausalLM" as NonEmptyStr,
-  "InternLM2ForRewardModel" as NonEmptyStr,
-  "InternLM3ForCausalLM" as NonEmptyStr,
-  "InternS1ForConditionalGeneration" as NonEmptyStr,
-  "InternS1ProForConditionalGeneration" as NonEmptyStr,
-  "InternS2MobiusForConditionalGeneration" as NonEmptyStr,
-  "InternS2MobiusMTP" as NonEmptyStr,
-  "InternS2PreviewForConditionalGeneration" as NonEmptyStr,
-  "InternVLChatModel" as NonEmptyStr,
-  "InternVLForConditionalGeneration" as NonEmptyStr,
-  "IsaacForConditionalGeneration" as NonEmptyStr,
-  "Jais2ForCausalLM" as NonEmptyStr,
-  "JambaForCausalLM" as NonEmptyStr,
-  "JambaForSequenceClassification" as NonEmptyStr,
-  "JinaEmbeddingsV5Model" as NonEmptyStr,
-  "JinaForRanking" as NonEmptyStr,
-  "JinaVLForRanking" as NonEmptyStr,
-  "K2HorizonForCausalLM" as NonEmptyStr,
-  "K3DSparkModel" as NonEmptyStr,
-  "KananaVForConditionalGeneration" as NonEmptyStr,
-  "KeyeForConditionalGeneration" as NonEmptyStr,
-  "KeyeVL1_5ForConditionalGeneration" as NonEmptyStr,
-  "KimiK25ForConditionalGeneration" as NonEmptyStr,
-  "KimiK3ForConditionalGeneration" as NonEmptyStr,
-  "KimiK3MTPModel" as NonEmptyStr,
-  "KimiLinearForCausalLM" as NonEmptyStr,
-  "KimiVLForConditionalGeneration" as NonEmptyStr,
-  "LLaMAForCausalLM" as NonEmptyStr,
-  "LagunaForCausalLM" as NonEmptyStr,
-  "Lfm2ForCausalLM" as NonEmptyStr,
-  "Lfm2MoeForCausalLM" as NonEmptyStr,
-  "Lfm2VlForConditionalGeneration" as NonEmptyStr,
-  "LightOnOCRForConditionalGeneration" as NonEmptyStr,
-  "Llama4ForCausalLM" as NonEmptyStr,
-  "Llama4ForConditionalGeneration" as NonEmptyStr,
-  "LlamaBidirectionalForSequenceClassification" as NonEmptyStr,
-  "LlamaBidirectionalModel" as NonEmptyStr,
-  "LlamaForCausalLM" as NonEmptyStr,
-  "LlamaForCausalLMEagle3" as NonEmptyStr,
-  "LlamaModel" as NonEmptyStr,
-  "LlamaNemotronVLForSequenceClassification" as NonEmptyStr,
-  "LlamaNemotronVLModel" as NonEmptyStr,
-  "Llama_Nemotron_Nano_VL" as NonEmptyStr,
-  "LlavaForConditionalGeneration" as NonEmptyStr,
-  "LlavaNextForConditionalGeneration" as NonEmptyStr,
-  "LlavaNextVideoForConditionalGeneration" as NonEmptyStr,
-  "LlavaOnevision2ForConditionalGeneration" as NonEmptyStr,
-  "LlavaOnevisionForConditionalGeneration" as NonEmptyStr,
-  "LongCatFlashMTPModel" as NonEmptyStr,
-  "LongcatFlashForCausalLM" as NonEmptyStr,
-  "LongcatFlashNgramForCausalLM" as NonEmptyStr,
-  "Mamba2ForCausalLM" as NonEmptyStr,
-  "MambaForCausalLM" as NonEmptyStr,
-  "MedusaModel" as NonEmptyStr,
-  "MellumForCausalLM" as NonEmptyStr,
-  "MiDashengLMModel" as NonEmptyStr,
-  "MiMoForCausalLM" as NonEmptyStr,
-  "MiMoMTPModel" as NonEmptyStr,
-  "MiMoV2FlashForCausalLM" as NonEmptyStr,
-  "MiMoV2ForCausalLM" as NonEmptyStr,
-  "MiMoV2MTPModel" as NonEmptyStr,
-  "MiMoV2OmniForCausalLM" as NonEmptyStr,
-  "MiMoV2OmniMTPModel" as NonEmptyStr,
-  "MiniCPM3ForCausalLM" as NonEmptyStr,
-  "MiniCPMForCausalLM" as NonEmptyStr,
-  "MiniCPMO" as NonEmptyStr,
-  "MiniCPMV" as NonEmptyStr,
-  "MiniCPMV4_6ForConditionalGeneration" as NonEmptyStr,
-  "MiniMaxM2ForCausalLM" as NonEmptyStr,
-  "MiniMaxM3MTP" as NonEmptyStr,
-  "MiniMaxM3SparseForCausalLM" as NonEmptyStr,
-  "MiniMaxM3SparseForConditionalGeneration" as NonEmptyStr,
-  "Ministral3ForCausalLM" as NonEmptyStr,
-  "Mistral3ForConditionalGeneration" as NonEmptyStr,
-  "MistralForCausalLM" as NonEmptyStr,
-  "MistralLarge3ForCausalLM" as NonEmptyStr,
-  "MistralModel" as NonEmptyStr,
-  "MixtralForCausalLM" as NonEmptyStr,
-  "ModernBertForSequenceClassification" as NonEmptyStr,
-  "ModernBertForTokenClassification" as NonEmptyStr,
-  "ModernBertModel" as NonEmptyStr,
-  "Molmo2ForConditionalGeneration" as NonEmptyStr,
-  "MolmoForCausalLM" as NonEmptyStr,
-  "Moondream3ForCausalLM" as NonEmptyStr,
-  "MoonshotKimiaForCausalLM" as NonEmptyStr,
-  "MossAudioModel" as NonEmptyStr,
-  "MossTranscribeDiarizeForConditionalGeneration" as NonEmptyStr,
-  "MuseGlimmerAssistantModel" as NonEmptyStr,
-  "MuseGlimmerForCausalLM" as NonEmptyStr,
-  "MuseGlimmerForConditionalGeneration" as NonEmptyStr,
-  "NVLM_D" as NonEmptyStr,
-  "NemotronForCausalLM" as NonEmptyStr,
-  "NemotronHForCausalLM" as NonEmptyStr,
-  "NemotronHMTPModel" as NonEmptyStr,
-  "NemotronHPuzzleForCausalLM" as NonEmptyStr,
-  "NemotronH_Nano_VL_V2" as NonEmptyStr,
-  "NemotronParseForConditionalGeneration" as NonEmptyStr,
-  "NomicBertModel" as NonEmptyStr,
-  "OPTForCausalLM" as NonEmptyStr,
-  "Olmo2ForCausalLM" as NonEmptyStr,
-  "Olmo3ForCausalLM" as NonEmptyStr,
-  "OlmoForCausalLM" as NonEmptyStr,
-  "OlmoHybridForCausalLM" as NonEmptyStr,
-  "OlmoeForCausalLM" as NonEmptyStr,
-  "OpenAIPrivacyFilterForTokenClassification" as NonEmptyStr,
-  "OpenCUAForConditionalGeneration" as NonEmptyStr,
-  "OpenPanguMTPModel" as NonEmptyStr,
-  "OpenPanguVLForConditionalGeneration" as NonEmptyStr,
-  "OpenVLAForActionPrediction" as NonEmptyStr,
-  "OpsColQwen3Model" as NonEmptyStr,
-  "OrionForCausalLM" as NonEmptyStr,
-  "Ovis" as NonEmptyStr,
-  "Ovis2_5" as NonEmptyStr,
-  "Ovis2_6ForCausalLM" as NonEmptyStr,
-  "Ovis2_6_MoeForCausalLM" as NonEmptyStr,
-  "PEagleDraftModel" as NonEmptyStr,
-  "PaddleOCRVLForConditionalGeneration" as NonEmptyStr,
-  "PaliGemmaForConditionalGeneration" as NonEmptyStr,
-  "PanguEmbeddedForCausalLM" as NonEmptyStr,
-  "PanguProMoEV2ForCausalLM" as NonEmptyStr,
-  "PanguUltraMoEForCausalLM" as NonEmptyStr,
-  "Param2MoEForCausalLM" as NonEmptyStr,
-  "PeagleLlamaForCausalLM" as NonEmptyStr,
-  "PeagleQwen3ForCausalLM" as NonEmptyStr,
-  "Phi3ForCausalLM" as NonEmptyStr,
-  "Phi3VForCausalLM" as NonEmptyStr,
-  "Phi4ForCausalLMV" as NonEmptyStr,
-  "Phi4MMForCausalLM" as NonEmptyStr,
-  "PhiForCausalLM" as NonEmptyStr,
-  "PhiMoEForCausalLM" as NonEmptyStr,
-  "PixtralForConditionalGeneration" as NonEmptyStr,
-  "Plamo3ForCausalLM" as NonEmptyStr,
-  "QianfanOCRForConditionalGeneration" as NonEmptyStr,
-  "Qwen2AudioForConditionalGeneration" as NonEmptyStr,
-  "Qwen2ForCausalLM" as NonEmptyStr,
-  "Qwen2ForProcessRewardModel" as NonEmptyStr,
-  "Qwen2ForRewardModel" as NonEmptyStr,
-  "Qwen2Model" as NonEmptyStr,
-  "Qwen2MoeForCausalLM" as NonEmptyStr,
-  "Qwen2VLForConditionalGeneration" as NonEmptyStr,
-  "Qwen2_5OmniForConditionalGeneration" as NonEmptyStr,
-  "Qwen2_5OmniModel" as NonEmptyStr,
-  "Qwen2_5_VLForConditionalGeneration" as NonEmptyStr,
-  "Qwen3ASRForConditionalGeneration" as NonEmptyStr,
-  "Qwen3ASRForcedAlignerForTokenClassification" as NonEmptyStr,
-  "Qwen3ASRRealtimeGeneration" as NonEmptyStr,
-  "Qwen3DSparkModel" as NonEmptyStr,
-  "Qwen3ForCausalLM" as NonEmptyStr,
-  "Qwen3MoeForCausalLM" as NonEmptyStr,
-  "Qwen3NextForCausalLM" as NonEmptyStr,
-  "Qwen3NextMTP" as NonEmptyStr,
-  "Qwen3OmniDSparkModel" as NonEmptyStr,
-  "Qwen3OmniMoeForConditionalGeneration" as NonEmptyStr,
-  "Qwen3VLForConditionalGeneration" as NonEmptyStr,
-  "Qwen3VLMoeForConditionalGeneration" as NonEmptyStr,
-  "Qwen3VLNemotronEmbedModel" as NonEmptyStr,
-  "Qwen3_5ForCausalLM" as NonEmptyStr,
-  "Qwen3_5ForConditionalGeneration" as NonEmptyStr,
-  "Qwen3_5MTP" as NonEmptyStr,
-  "Qwen3_5MoeForCausalLM" as NonEmptyStr,
-  "Qwen3_5MoeForConditionalGeneration" as NonEmptyStr,
-  "Qwen3_5MoeMTP" as NonEmptyStr,
-  "Qwen4ExpForCausalLM" as NonEmptyStr,
-  "Qwen4ExpForConditionalGeneration" as NonEmptyStr,
-  "Qwen4ExpMTP" as NonEmptyStr,
-  "RForConditionalGeneration" as NonEmptyStr,
-  "Rnj1ForCausalLM" as NonEmptyStr,
-  "RobertaForMaskedLM" as NonEmptyStr,
-  "RobertaForSequenceClassification" as NonEmptyStr,
-  "RobertaForTokenClassification" as NonEmptyStr,
-  "RobertaModel" as NonEmptyStr,
-  "SarvamMLAForCausalLM" as NonEmptyStr,
-  "SarvamMoEForCausalLM" as NonEmptyStr,
-  "SeedOssForCausalLM" as NonEmptyStr,
-  "SiglipModel" as NonEmptyStr,
-  "SkyworkR1VChatModel" as NonEmptyStr,
-  "SmolLM3ForCausalLM" as NonEmptyStr,
-  "SmolVLMForConditionalGeneration" as NonEmptyStr,
-  "SolarForCausalLM" as NonEmptyStr,
-  "StableLmForCausalLM" as NonEmptyStr,
-  "Starcoder2ForCausalLM" as NonEmptyStr,
-  "Step1ForCausalLM" as NonEmptyStr,
-  "Step3TextForCausalLM" as NonEmptyStr,
-  "Step3VLForConditionalGeneration" as NonEmptyStr,
-  "Step3p5ForCausalLM" as NonEmptyStr,
-  "Step3p5MTP" as NonEmptyStr,
-  "Step3p7ForConditionalGeneration" as NonEmptyStr,
-  "StepVLForConditionalGeneration" as NonEmptyStr,
-  "TeleChat2ForCausalLM" as NonEmptyStr,
-  "TeleChat3ForCausalLM" as NonEmptyStr,
-  "TeleFLMForCausalLM" as NonEmptyStr,
-  "Terratorch" as NonEmptyStr,
-  "TransformersEmbeddingModel" as NonEmptyStr,
-  "TransformersForCausalLM" as NonEmptyStr,
-  "TransformersForSequenceClassification" as NonEmptyStr,
-  "TransformersMoEEmbeddingModel" as NonEmptyStr,
-  "TransformersMoEForCausalLM" as NonEmptyStr,
-  "TransformersMoEForSequenceClassification" as NonEmptyStr,
-  "TransformersMultiModalEmbeddingModel" as NonEmptyStr,
-  "TransformersMultiModalForCausalLM" as NonEmptyStr,
-  "TransformersMultiModalForSequenceClassification" as NonEmptyStr,
-  "TransformersMultiModalMoEForCausalLM" as NonEmptyStr,
-  "UltravoxModel" as NonEmptyStr,
-  "UnlimitedOCRForCausalLM" as NonEmptyStr,
-  "VaultGemmaForCausalLM" as NonEmptyStr,
-  "VibeVoiceAsrForConditionalGeneration" as NonEmptyStr,
-  "VoxtralForConditionalGeneration" as NonEmptyStr,
-  "VoxtralRealtimeGeneration" as NonEmptyStr,
-  "VoyageQwen3BidirectionalEmbedModel" as NonEmptyStr,
-  "WhisperForConditionalGeneration" as NonEmptyStr,
-  "XLMRobertaForSequenceClassification" as NonEmptyStr,
-  "XLMRobertaForTokenClassification" as NonEmptyStr,
-  "XLMRobertaModel" as NonEmptyStr,
-  "Zamba2ForCausalLM" as NonEmptyStr,
-  ],
-}
-
 // THE KV ALLOCATION-PLAN v2 LAYER, READ INSIDE ITS OWN TAG. The layer is a file-copy over the base
 // content id above, built per Group B host, so there is no single content id and the reading is keyed by
 // the tag every host resolves locally (the runtime row's pin). Taken on the head; the dump is the same
@@ -3167,7 +2751,6 @@ data spark_architecture_observations: List<ArchitectureObservation> = [
   v41_published_arm64_architecture_asked,
   RegistryDump { reading: glm53_derived_registry_reading },
   RegistryDump { reading: glm53_derived_kvplan_v2_registry_reading },
-  RegistryDump { reading: glm53_kvplan_v2_group_a_registry_reading },
 ]
 
 fn architecture_observation_exists(image_reference: NonEmptyStr) -> Bool {
diff --git a/dag/gunbc/spark/runtime_image_produce_dispatch.dag b/dag/gunbc/spark/runtime_image_produce_dispatch.dag
deleted file mode 100644
index 63ca8321891..00000000000
--- a/dag/gunbc/spark/runtime_image_produce_dispatch.dag
+++ /dev/null
@@ -1,75 +0,0 @@
-module gunbc.spark.runtime_image_produce_dispatch
-
-import std.types { String, List, NonEmptyStr }
-import std.process { ProcessExit, exit_failure }
-import gunbc.fleet_multi_principal_probe { env_var_nonempty }
-import std.optional { Present, Absent }
-import gunbc.spark.group_image_produce { GroupImageProduction, group_image_produce_wet, ProducedImageHeld, produced_image_distribute_wet }
-import gunbc.spark.v41_runtime_image_converge { v41_runtime_image_production, v41_produced_image_held }
-import gunbc.spark.glm53_kvplan_image { glm53_kvplan_production, glm53_kvplan_produced_image_held }
-
-// ── WHICH IMAGE THE PRODUCE MODE BUILDS, FROM ONE CLOSED WORKFLOW INPUT (deforking cut 8c) ──────────
-//
-// The roster of producible images lives here and only here, peripheral to the one produce entry
-// (gunbc.spark.group_image_produce) and to each image's own module (DESIGN §3: the dispatch that
-// selects a realization is itself realization). The mode spark_runtime_image_produce reads the dispatch
-// input `runtime_image`, whose options are this roster's words; an unknown word refuses.
-type RuntimeImageChoice = RuntimeImageV41Dsv41Gb10 | RuntimeImageGlm53KvplanV2Gb10
-
-data runtime_image_choices: List<RuntimeImageChoice> = [RuntimeImageV41Dsv41Gb10, RuntimeImageGlm53KvplanV2Gb10]
-
-fn runtime_image_choice_wire(c: RuntimeImageChoice) -> NonEmptyStr {
-  match c {
-    RuntimeImageV41Dsv41Gb10 => "v41-dsv41-gb10" as NonEmptyStr
-    RuntimeImageGlm53KvplanV2Gb10 => "glm53-kvplan-v2-gb10" as NonEmptyStr
-  }
-}
-
-fn runtime_image_options() -> List<String> {
-  map(runtime_image_choices, c => runtime_image_choice_wire(c: c) as String)
-}
-
-fn runtime_image_choice_of_wire(word: String) -> RuntimeImageChoice? {
-  first(filter(runtime_image_choices, c => (runtime_image_choice_wire(c: c) as String) == word))
-}
-
-fn runtime_image_production_of(c: RuntimeImageChoice) -> GroupImageProduction {
-  match c {
-    RuntimeImageV41Dsv41Gb10 => v41_runtime_image_production()
-    RuntimeImageGlm53KvplanV2Gb10 => glm53_kvplan_production()
-  }
-}
-
-data runtime_image_env: NonEmptyStr = "GUNBC_RUNTIME_IMAGE" as NonEmptyStr
-data runtime_image_produce_receipt_path: String = "target/runtime-image-produce-receipt.txt"
-
-fn runtime_image_produce_ci_wet() -> ProcessExit {
-  let word = match env_var_nonempty(name: runtime_image_env) { Present { value: v } => v  Absent => "" }
-  match runtime_image_choice_of_wire(word: word) {
-    Absent => exit_failure(reason: join([runtime_image_env as String, "=`", word, "` is not a producible image; the images are ", join(runtime_image_options(), ", ")], ""))
-    Present { value: c } => group_image_produce_wet(p: runtime_image_production_of(c: c), receipt_path: runtime_image_produce_receipt_path)
-  }
-}
-
-// THE PRODUCED IMAGE EACH CHOICE DISTRIBUTES: its production receipt as a held-image row, or Absent
-// while no production of it has been recorded -- a distribution of an image nobody produced refuses.
-fn runtime_image_held_of(c: RuntimeImageChoice) -> ProducedImageHeld? {
-  match c {
-    RuntimeImageV41Dsv41Gb10 => Present { value: v41_produced_image_held() }
-    RuntimeImageGlm53KvplanV2Gb10 => glm53_kvplan_produced_image_held()
-  }
-}
-
-data runtime_image_distribute_receipt_path: String = "target/runtime-image-distribute-receipt.txt"
-
-fn runtime_image_distribute_ci_wet() -> ProcessExit {
-  let word = match env_var_nonempty(name: runtime_image_env) { Present { value: v } => v  Absent => "" }
-  match runtime_image_choice_of_wire(word: word) {
-    Absent => exit_failure(reason: join([runtime_image_env as String, "=`", word, "` is not a producible image; the images are ", join(runtime_image_options(), ", ")], ""))
-    Present { value: c } =>
-      match runtime_image_held_of(c: c) {
-        Absent => exit_failure(reason: join(["no production of ", runtime_image_choice_wire(c: c) as String, " is recorded, so there is no held image to distribute; produce it first (mode spark_runtime_image_produce)"], ""))
-        Present { value: h } => produced_image_distribute_wet(h: h, receipt_path: runtime_image_distribute_receipt_path)
-      }
-  }
-}
diff --git a/dag/gunbc/spark/serving_arm.dag b/dag/gunbc/spark/serving_arm.dag
index 13d5d106840..049f7295382 100644
--- a/dag/gunbc/spark/serving_arm.dag
+++ b/dag/gunbc/spark/serving_arm.dag
@@ -42,9 +42,7 @@ import extdeps.docker.images.gitcommit90_glm_53_one_spark {
   gitcommit90_glm_53_one_spark_pinned_reference, gitcommit90_glm_53_one_spark_vllm_version,
 }
 import gunbc.spark.runtime_architecture_registry_reading {
-  ArchitectureRegistryReading, registry_reading_contains, reading_applies_to,
-  sparkrun_vllm_ds4_gb10_registry_reading, gitcommit90_glm_53_one_spark_registry_reading,
-  glm53_nope_derived_registry_reading, glm53_derived_registry_reading, glm53_derived_kvplan_v2_registry_reading, glm53_kvplan_v2_group_a_registry_reading,
+  ArchitectureRegistryReading, registry_reading_contains, reading_applies_to, sparkrun_vllm_ds4_gb10_registry_reading, gitcommit90_glm_53_one_spark_registry_reading, glm53_nope_derived_registry_reading, glm53_derived_registry_reading, glm53_derived_kvplan_v2_registry_reading,
 }
 import gunbc.spark.model_snapshot_acquisition {
   SnapshotPlacement, HubCachePlacement, LocalDirectoryPlacement, spark_hub_cache_root, spark_models_root,
@@ -105,7 +103,6 @@ type ServingRuntime
   | GunbcGlm53NopeDerivedGb10
   | GunbcGlm53DerivedGb10
   | GunbcGlm53DerivedKvplanV2Gb10
-  | GunbcGlm53KvplanV2GroupAProduced
   | GunbcDeepseekV41EngramProduced { artifact: RuntimeArtifactIdentity, registry_reading: ArchitectureRegistryReading? }
 
 // THE EIGHT-RANK TOPOLOGY IS A CANDIDATE SHAPE, NOT A DEPLOYED ONE, AND ONLY A RANK COUNT. It exists
@@ -180,7 +177,6 @@ fn serving_runtime_wire(r: ServingRuntime) -> NonEmptyStr {
     GunbcGlm53NopeDerivedGb10 => "gunbc-glm53-nope-derived-gb10" as NonEmptyStr
     GunbcGlm53DerivedGb10 => "gunbc-glm53-derived-gb10" as NonEmptyStr
     GunbcGlm53DerivedKvplanV2Gb10 => "gunbc-glm53-derived-kvplan-v2-gb10" as NonEmptyStr
-    GunbcGlm53KvplanV2GroupAProduced => "gunbc-glm53-kvplan-v2-group-a-produced" as NonEmptyStr
     GunbcDeepseekV41EngramProduced { artifact: _, registry_reading: _ } => "gunbc-deepseek-v41-engram-produced" as NonEmptyStr
   }
 }
@@ -409,9 +405,9 @@ data deepseek_v41_flash_row: ServingCheckpointRow = ServingCheckpointRow {
   },
   resident_beyond_weights: PageCacheFromNonKvHeadroom {
     reason: "the file-backed Engram row stores are served through the page cache, which on a GB10 is the same unified pool as the weights; the side-chat stress model puts the resident working set at about 19 to 46 GiB per rank from x2 to x16 concurrency, and the launch deliberately leaves its non-KV headroom for it rather than charging it as zero or as the whole table" as NonEmptyStr,
-    confirmed_by: "gunbc.spark.v41_capacity_measurement v41_engram_resident_bets, judged against v41_after_requests_resident: each rank's mincore residency over its Engram files after requests at each staircase concurrency" as NonEmptyStr,
+    confirmed_by: "UNCONFIRMED: the staircase that would have measured each rank's mincore residency over its Engram files (gunbc.spark.v41_capacity_measurement) was deleted with Group A on 2026-10-07 before it ran; no other producer exists" as NonEmptyStr,
   },
-  provenance: "repo, revision, architecture class, quantization and the weight byte population are extdeps.deepseek.deepseek_v4_1_flash, read from the Hub at that revision; the placement is the directory gunbc.spark.v41_checkpoint_materialize installs and verifies on srv5..srv8. NOT launched on this fleet: no engine has loaded this checkpoint here" as NonEmptyStr,
+  provenance: "repo, revision, architecture class, quantization and the weight byte population are extdeps.deepseek.deepseek_v4_1_flash, read from the Hub at that revision; the placement is the pinned Hub-cache snapshot directory; the materialization that installed and verified it on Group A (gunbc.spark.v41_checkpoint_materialize) was deleted with Group A on 2026-10-07, and no retained host holds it. NOT launched on this fleet: no engine has loaded this checkpoint here" as NonEmptyStr,
 }
 
 fn serving_checkpoint_row(c: ServingCheckpoint) -> ServingCheckpointRow? {
@@ -762,7 +758,6 @@ fn serving_runtime_row(r: ServingRuntime) -> ServingRuntimeRow? {
     GunbcGlm53NopeDerivedGb10 => Present { value: glm53_nope_derived_row }
     GunbcGlm53DerivedGb10 => Present { value: glm53_derived_row }
     GunbcGlm53DerivedKvplanV2Gb10 => Present { value: glm53_derived_kvplan_v2_row }
-    GunbcGlm53KvplanV2GroupAProduced => Present { value: glm53_kvplan_v2_group_a_row }
   }
 }
 
@@ -1349,41 +1344,6 @@ data glm53_native_kv_auto_launch_policy: ModelLaunchPolicy = ModelLaunchPolicy {
   modality: ModalityOmitted,
 }
 
-// ── THE V4.1 LAUNCH POLICY: WHAT THE MODEL DECIDES, OVER WHAT THE ENVELOPE DECIDES ─────────────
-//
-// THIS WAS A MINT THAT BUILT A WHOLE PROFILE (deepseek_v41_measurement_profile), deleted with the
-// deforking: its model half is this row, and its capacity half is the V4.1 cold intent and envelope
-// (gunbc.spark.v41_group_a_launch v41_group_a_profile) through the one profile derivation every model
-// uses. Half its fields belonged to another authority, which is why it could not stay a row of its own. The capacity
-// measurement (gunbc.spark.v41_capacity_measurement) owns the window, the admitted sequences, the
-// scheduler budget, the memory fraction and the prefix-caching request: they are the axes it measures
-// at, and a row here would be a second copy of each. What this mint fixes is what the V4.1 launch
-// itself decides, and nothing a caller may override:
-//   - the KV cache is requested as fp8_ds_mla, the layout the measurement's startup receipt requires
-//     to resolve (ResolvedFp8DsMla) before it admits a rank;
-//   - the Engram tables are served through the prefetch path -- cpu_offload true, dp_shared_memory
-//     false -- which is what the file-backed overlay requires and refuses at model init without;
-//   - THE LAUNCH SERVES TEXT ONLY, AND THE VISION CAPABILITY IS DROPPED ON PURPOSE. The checkpoint is
-//     the vision variant (vision_n_layers > 0), and at the pinned revision that widens every prefill
-//     sliding-window row from sliding_window (128) to sliding_window + vision_max_n_token (1152) for
-//     bidirectional image spans (vllm/v1/attention/backends/mla/sparse_swa.py prefill_index_width,
-//     vllm/models/deepseek_v4_1/attention.py max_image_tokens). FlashInfer's SM120 DSv4 kernel has no
-//     specialization at 1152, and every call with 64 or fewer query tokens must take one, so attempt
-//     13 died in CUDA-graph capture on all four ranks. --language-model-only stubs the tower and
-//     admits no image; overriding vision_n_layers to 0 is what returns the width to 128, because
-//     max_image_tokens is read off the config and not off the modality limit. A launch that wants
-//     images back needs an SM120 kernel at the widened width first; it is a different product, not
-//     this one with a flag flipped.
-// The route's port and served name are the caller's because they belong to the route this launch
-// answers, not to the model.
-data deepseek_v41_launch_policy: ModelLaunchPolicy = ModelLaunchPolicy {
-  checkpoint: DeepseekV41FlashDba1be0a,
-  kv_cache_dtype: KvFp8DsMla,
-  indexer_kv_dtype: IndexerKvDtypeOmitted,
-  engram: EngramConfigExplicit { cpu_offload: true, dp_shared_memory: false },
-  modality: LanguageModelOnly { hf_overrides: [vllm_hf_override(key: "vision_n_layers" as NonEmptyStr, json_value: "0" as NonEmptyStr)] },
-}
-
 // THE NVFP4 CHECKPOINT'S POLICY: its KV request is its own row's; the rest is the base model's (no
 // Engram, text by omission, indexer at its default).
 data glm53_flash_nvidia_nvfp4_launch_policy: ModelLaunchPolicy = ModelLaunchPolicy {
@@ -1593,33 +1553,3 @@ data glm53_derived_kvplan_v2_row: ServingRuntimeRow = ServingRuntimeRow {
   provenance: "the engine inside this tag self-reported vllm 0.1.dev1+g8d09804c8 and printed its v2 KV allocation plan at the 2026-09-26 bounded experiment on the four Group B ranks; its architecture registry was read inside the tag on 2026-10-01 (glm53_derived_kvplan_v2_registry_reading). NOT read inside this tag: the hub CLI path and the reasoning projection" as NonEmptyStr,
   claimed_defaults_revision: Present { value: Vllm8d09804 },
 }
-
-// THE SAME KVPLAN-V2 BUILD, PRODUCED ONCE FOR GROUP A (deforking cut 8c, image option A). It is a distinct
-// runtime from the Group B row above because it is a distinct artifact: one content id built on srv7 by
-// fleet-converge run 37100656092 from the pinned recipe (gunbc.spark.vllm_runtime_image_build
-// converge_glm53_kvplan_image) and moved by digest, where Group B's is a per-host layer under a shared
-// tag. So a receipt taken on Group A is about THIS identity and does not promote Group B's.
-data glm53_kvplan_v2_group_a_row: ServingRuntimeRow = ServingRuntimeRow {
-  runtime: GunbcGlm53KvplanV2GroupAProduced,
-  artifact: runtime_artifact_identity(
-    pin: PinnedByDigest { reference: "sha256:6ef84cd49a68dbefd957bfca36f0ec458ed80f8194def41642e7b37b34ae76fb" as NonEmptyStr },
-    source: PackageVersionClaimsRevision {
-      revision: (defaults_source_revision(r: Vllm8d09804)).full_revision,
-      package_version: glm53_nope_derived_vllm_version,
-      build_provenance: "built from source revision 8d09804c877c48165c6ba69bc9dc02d09bae0b83 by fleet-converge run 37100656092 (base and FlashInfer stage build key c99be081f219d123, kvplan layer build key 50ba9aad263fea47); the probe inside the produced digest read vllm 0.1.dev1+g8d09804c8 and the kvplan marker present" as NonEmptyStr,
-    },
-    patch_set: [
-      "flashinfer_python-0.7.0.dev20260910-py3-none-any.whl" as NonEmptyStr,
-      "flashinfer_cubin-0.7.0.dev20260910-py3-none-any.whl" as NonEmptyStr,
-      "flashinfer_jit_cache-0.7.0.dev20260910+cu130-cp39-abi3-manylinux_2_28_aarch64.whl" as NonEmptyStr,
-      "kv-allocation-plan-emission-v2-8d09804c8.patch" as NonEmptyStr,
-    ],
-    provenance: "produced on srv7 by fleet-converge run 37100656092 under tag gunbc-vllm-glm53-gb10:kvplan-v2-50ba9aad263fea47, configuration digest read back inside the image by that run's probe" as NonEmptyStr,
-  ),
-  hub_cli_path: Present { value: "/usr/local/bin/hf" as NonEmptyStr },
-  vllm_version: Present { value: glm53_nope_derived_vllm_version },
-  registry_reading: Present { value: glm53_kvplan_v2_group_a_registry_reading },
-  reasoning_projection: none,
-  provenance: "every field of this row except the patch roster was read inside the produced digest by fleet-converge run 37100656092 (version, package dir, kvplan marker, hub CLI path, 378-name registry); the patch roster is the recipe's" as NonEmptyStr,
-  claimed_defaults_revision: Present { value: Vllm8d09804 },
-}
diff --git a/dag/gunbc/spark/serving_arm_launch.dag b/dag/gunbc/spark/serving_arm_launch.dag
index 780c6376462..4632aad3936 100644
--- a/dag/gunbc/spark/serving_arm_launch.dag
+++ b/dag/gunbc/spark/serving_arm_launch.dag
@@ -7,12 +7,7 @@ import extdeps.network.ipv4 { Ipv4Address, render_ipv4_address }
 import extdeps.huggingface.hub { hub_repo_cache_directory_name }
 import extdeps.vllm.usage_stats { vllm_usage_stats_no_usage_stats_term }
 import gunbc.spark.fabric_switch_observed {
-  FabricGroup,
-  FabricGroupA,
-  FabricGroupB,
-  fabric_group_hosts,
-  FabricLaneObserved,
-  fabric_lane_for_host,
+  FabricGroup, FabricGroupB, fabric_group_hosts, FabricLaneObserved, fabric_lane_for_host,
 }
 import extdeps.docker.cli {
   DockerCreateSpec,
@@ -292,7 +287,6 @@ data glm_native_container_name: NonEmptyStr = "glm-native-tp4" as NonEmptyStr
 
 data glm53_staircase_container_name: NonEmptyStr = "gunbc-glm53-stair-tp4" as NonEmptyStr
 
-data glm53_staircase_head_log_path: NonEmptyStr = "/var/log/gunbc/glm53-stair-head.log" as NonEmptyStr
 data glm_native_master_port: Port = 29501
 
 data glm_native_weights_container_dir: NonEmptyStr = "/weights" as NonEmptyStr
@@ -594,8 +588,7 @@ fn plan_arm_launch(checkpoint: ServingCheckpoint, runtime: ServingRuntime, topol
 // here instead of a receipt that quietly claims the wrong silicon.
 fn fabric_group_accelerator(g: FabricGroup) -> NonEmptyStr {
   match g {
-    FabricGroupA => spark_gb10_accelerator
-    FabricGroupB => spark_gb10_accelerator
+    FabricGroupB {} => spark_gb10_accelerator
   }
 }
 
diff --git a/dag/gunbc/spark/serving_deployment_selection.dag b/dag/gunbc/spark/serving_deployment_selection.dag
index c9676d3814e..74dc9440134 100644
--- a/dag/gunbc/spark/serving_deployment_selection.dag
+++ b/dag/gunbc/spark/serving_deployment_selection.dag
@@ -55,11 +55,11 @@ import gunbc.spark.runtime_architecture_registry_reading {
   gunbc_vllm_dsv41_gb10_registry_reading,
 }
 import extdeps.deepseek.deepspec { SpeculativeDraftAlgorithm, DSpark, speculative_draft_algorithm_wire }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import gunbc.spark.pair_serving_observed {
   GroupRankFreeMemoryObserved, group_rank_free_memory, group_rank_free_memory_region,
   group_rank_free_memory_upper,
 }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
 import gunbc.fabric.engram_materialization {
   ComponentRouteStanding, ComponentRouteNotThisSubject, ComponentRouteSubjectHasNoAuthority, ComponentRouteDecided,
   ComponentResidentShare, ComponentResidentObserved, ComponentResidentBoundedAbove,
@@ -816,8 +816,8 @@ fn v4_1_selection_frontier_fact(decl_name: NonEmptyStr) -> DeclarationRef {
 data v4_1_selection_frontier: List<FrontierRow> = [
   frontier_row_decl(
     ref: v4_1_selection_frontier_fact(decl_name: "candidate_component_budget" as NonEmptyStr),
-    reason: "the idle-free reading was taken on a Group A rank and this closure has no candidate-to-fabric-group binding to key it by",
-    dissolution: unbound_dissolution(description: "The per-rank budget consumes one observed idle-free figure for every candidate, because nothing in this closure says which fabric group a candidate lands on. THE FALSIFICATION CONDITION, which is what makes this limit checkable rather than merely regrettable: this screen produces a WRONG answer as soon as the candidates it screens span hosts whose free-memory figures differ -- a second fabric group, a co-tenanted rank, or one host of the same group in a different state. The comparison that used to defend the limit is gone: spark_fleet_snapshot applied one single-host reading fleet-wide, and #11308 replaced it with spark_fleet_snapshot_for, whose snapshot carries the subject's admissible host IDENTITIES, so this reading is now the only place a single host's figure is generalised and the limit is WIDER than when it was admitted. AND THE IDENTITIES DO NOT CLOSE IT, for a reason that is not cost: gunbc.spark.pair_serving_observed group_rank_free_memory_observed is ONE row keyed by FabricGroup, read on one idle Group A rank, and GroupRankFreeMemoryObserved carries no host field at all -- so the identities the snapshot now supplies are keys with nothing to look up, and the generalisation lives in the OBSERVATION population rather than in this fold. NOR IS THE READING KNOWN TO BE RIGHT IN FACT: whether the other admissible hosts carry the same figure is UNOBSERVED rather than established, because one rank was read, and a uniform group is an inference about the world and not a reading of it. TRIGGER, AND IT HAS TWO PARTS BECAUSE THE GAP DOES: (1) a free-memory observation population keyed at HOST grain rather than at FabricGroup grain, so a figure exists per admissible identity; and (2) a candidate carrying the hosts it lands on, so the lookup has a key. Part 1 is an observation obligation on separately admitted resources and part 2 is a modelling one, and satisfying either alone leaves the screen generalising. SUFFICIENT FOR: candidate_component_budget selects the reading for the hosts that candidate actually runs on and reports an obligation when no reading exists for one of them, rather than reaching for a single Group A rank's figure." as NonEmptyStr),
+    reason: "no idle-engine free-memory reading exists: the one there was (a Group A rank) went with Group A on 2026-10-07, so the budget answers ComponentBudgetUnestablished; and this closure has no candidate-to-fabric-group binding to key a future reading by",
+    dissolution: unbound_dissolution(description: "The per-rank budget consumes one observed idle-free figure for every candidate, and today that population is EMPTY (the Group A reading was removed with Group A on 2026-10-07), so every candidate's budget is unestablished. Dissolves when an idle-engine free-memory reading is taken on a rank of the group a candidate is bound to, keyed by a candidate-to-fabric-group binding this closure carries" as NonEmptyStr),
   ),
   frontier_row_decl(
     ref: v4_1_selection_frontier_fact(decl_name: "fleet_admitted_topologies" as NonEmptyStr),
@@ -1268,7 +1268,7 @@ fn candidate_component_budget(
   p: ServingDecisionParameters,
 ) -> ComponentMemoryBudget {
   let ctx = candidate_route_context(c: c, p: p)
-  match group_rank_free_memory(group: FabricGroupA) {
+  match group_rank_free_memory(group: FabricGroupB {}) {
     Absent => ComponentBudgetUnestablished {
       subject: ctx,
       obligation: "no idle free-memory reading exists for a rank of this fleet, so the bytes available to a routed component are unknown; total device memory is a hardware property and the requested utilisation fraction is a launch parameter, and neither is a reading of what a rank actually has free" as NonEmptyStr,
@@ -3103,58 +3103,6 @@ data deepseek_quality_requirement: QualityRequirement = quality_requirement(
   rationale: "the deployed checkpoint is the subject, and a requantisation is a different artifact rather than a cheaper way to serve this one. gunbc.spark.tensor_parallel_comparison measured 2238 millinats between tensor-parallel degrees on these weights against a bit-identical within-topology envelope, so a per-topology assessment is required and no degree inherits another's standing" as NonEmptyStr,
 )
 
-// ── ONE SERVING SUBJECT, TWO ARTIFACT VERSIONS, ONE DATED TRANSITION ──────────────────────────
-//
-// THE QUESTION THIS SETTLES: does "V4.1 takes over group A" need a successor EDGE between two
-// subjects, or is it ONE subject with versioned incarnations across a declared transition? The
-// evidence decided for the latter, and the shapes checked are named so the check is repeatable:
-//   - product.training.attempt_graph `lineage_predecessor<P>` relates execution ATTEMPTS of one
-//     training run (retry, escalation) by a prior-attempt identity and a cause receipt -- the wrong
-//     grain for a deployment changing what it serves, and its payload is a FabricIdentity of an
-//     attempt key this subject does not have;
-//   - gunbc.deploy_transition_bootstrap `transition_step_successor` is a closed protocol step order
-//     (lease held, quiesced, release installed ...), not a relation between two subjects;
-//   - the only modelled rollback, gunbc.spark.glm_canary_converge `CanaryCutover`, records the
-//     replaced launch line of the SAME arm -- a prior incarnation of one subject, which is this shape.
-// Neither of the first two is inhabitable, no ServingIncarnationProvenance exists anywhere, and an
-// incarnation identity would therefore be AUTHORED rather than inhabited. The pair deployment on
-// group A has no identity distinct from its group (gunbc.spark.serving_subject), so the subject is
-// `PairServingUnitOn { group: FabricGroupA }` before and after, and DESIGN section 3 sanctions the
-// same spelling across a declared version transition as legitimate reuse.
-//
-// WHAT KEEPS THE ROLLBACK TARGET ADDRESSABLE WITHOUT AN EDGE. The V4 Flash incarnation is intact on
-// the hosts -- image f869281d in gunbc.spark.runtime_architecture_registry_reading, weight snapshot
-// 60d8d707 in gunbc.spark.pair_serving_observed -- and it stays addressable as the FROM side of this
-// row: `deepseek_decision_input` still describes it over the same subject's admissible set, so a
-// rollback is the same subject's prior version, not a second subject. No-redundancy (operator,
-// 2026-09-11) means V4 Flash is not served BESIDE V4.1: the two fields share one subject and one set
-// precisely because at most one of them is running on it.
-//
-// THE ROW IS CONSUMED, NOT DECORATIVE: both DeepSeek domains take their artifact from it and both
-// take their fleet from its subject, so the transition is the only route by which the V4.1 field
-// reaches group A's hosts.
-type ServedArtifactTransition {
-  subject: ServingSubject
-  from: ModelArtifact
-  to: ModelArtifact
-  ruling: ServingRulingCitation
-}
-
-data group_a_served_artifact_transition: ServedArtifactTransition = ServedArtifactTransition {
-  subject: PairServingUnitOn { group: FabricGroupA },
-  from: artifact_deepseek_v4_flash_native,
-  to: artifact_deepseek_v4_1_flash_native,
-  ruling: serving_ruling_2026_09_12_v4_1_takes_over_the_deepseek_deployment,
-}
-
-// ── THE FLEET, PER SUBJECT, DERIVED FROM THE COMMITMENT CENSUS ───────────────────────────────
-//
-// Two production snapshots, one per serving subject the corpus carries. The pair unit on group A is
-// admitted its own four hosts and nothing else; group B's subject -- whatever arm is assigned to group
-// B -- is admitted group B, which the operator's ruling reserves for GLM. Each is the identity set a fit is read against and a domain is
-// enumerated over, and each carries its subject so the evidence identity moves with it.
-data pair_unit_a_fleet_snapshot: FleetSnapshot = spark_fleet_snapshot_for(subject: group_a_served_artifact_transition.subject)
-
 data glm_group_b_fleet_snapshot: FleetSnapshot = spark_fleet_snapshot_for(subject: glm_group_b_serving_subject)
 
 // NO QUALITY ASSESSMENTS AND NO RUNTIME RECEIPTS. The empty lists are the honest state, and they are
@@ -3170,11 +3118,6 @@ fn serving_evidence_over(fleet: FleetSnapshot, fleet_receipt: DeclarationRef) ->
   )
 }
 
-data pair_unit_a_evidence_current: ServingDeploymentEvidenceSnapshot = serving_evidence_over(
-  fleet: pair_unit_a_fleet_snapshot,
-  fleet_receipt: decl_ref(module_path: "gunbc.spark.serving_deployment_selection", decl_name: "pair_unit_a_fleet_snapshot"),
-)
-
 data glm_group_b_evidence_current: ServingDeploymentEvidenceSnapshot = serving_evidence_over(
   fleet: glm_group_b_fleet_snapshot,
   fleet_receipt: decl_ref(module_path: "gunbc.spark.serving_deployment_selection", decl_name: "glm_group_b_fleet_snapshot"),
@@ -3227,101 +3170,3 @@ data glm_decision_input: ServingDeploymentDecisionInput = serving_decision_input
   axes: serving_selection_axes,
 )
 
-
-// ── THE DEEPSEEK ARM ──────────────────────────────────────────────────────────────────────────
-//
-// The convergence serving today authors its replica shape as literals: 82 percent, a context ceiling
-// equal to the model's own limit, and a tensor-parallel degree taken from `length(hosts)` -- which is
-// not a choice at all but an accident of how many hosts landed in a group.
-//
-// AN EARLIER VERSION OF THIS MODULE ANSWERED THIS QUESTION AND THE ANSWER WAS NOT EARNED. It selected
-// four two-rank replicas over the deployed two four-rank replicas, on a field whose only
-// discriminating axes were replica count and the capacity share one replica loss removes -- so the
-// shape with the most replicas won both, by construction. It could not have concluded otherwise.
-// Worse, it admitted quality on weight identity alone while this repository's own measurement shows
-// the same weights at TP=2 and TP=4 are 2238 millinats apart on a deterministic forward pass.
-// Recommending a topology change on a quality gate blind to topology is exactly backwards, and the
-// recommendation is withdrawn rather than restated more carefully.
-data deepseek_domain: ServingDeploymentChoiceDomain = serving_deployment_domain(
-  artifacts: [group_a_served_artifact_transition.from],
-  topologies: covering_topologies_over(fleet: pair_unit_a_fleet_snapshot),
-  parameters: serving_parameters_current,
-)
-
-data deepseek_candidate_field: ServingDeploymentCandidateField = serving_candidate_field(
-  identity: decl_ref(module_path: "gunbc.spark.serving_deployment_selection", decl_name: "deepseek_candidate_field"),
-  domain: deepseek_domain,
-  candidates: derived_candidates_for(stem: "deepseek", domain: deepseek_domain),
-)
-
-data deepseek_decision_input: ServingDeploymentDecisionInput = serving_decision_input(
-  field: deepseek_candidate_field,
-  evidence: pair_unit_a_evidence_current,
-  quality_requirement: deepseek_quality_requirement,
-  selection_policy: decl_ref(module_path: "gunbc.spark.serving_deployment_selection", decl_name: "deepseek_v4_flash_selection_policy"),
-  constraints: serving_selection_constraints,
-  constraint_authority: id_constraint_authority,
-  axes: serving_selection_axes,
-)
-
-// ── V4.1 FLASH: NATIVE CANDIDATES, CONSTRAINTS AGAINST FACTS, WIDTH DERIVED ────────────────
-//
-// Operator 2026-09-11: native quality always; no redundancy right now; four Sparks are a function
-// of the modeling decisions; those two are constraints against the fact. Production serving stays
-// deepseek-v4-flash:iq3s-split; cutover is a later operator decision. Host binding (srv7/srv8
-// llama.cpp RPC reservation) is fabric work downstream of a selected shape -- named, not done here.
-//
-// THE FIELD IS EVERY SHAPE THE SUBJECT'S ADMISSIBLE SET ADMITS, CROSSED WITH THE DECLARED RUNTIME
-// DOMAIN. The subject is the pair unit on group A, reached through group_a_served_artifact_transition
-// -- the ruling's second half -- so the set is srv5-srv8 and a five-to-eight-rank shape is never
-// enumerated; planted, it is refused by the host fit by name.
-// Completeness is an identity join over artifact × topology × profile. Narrowing to the existing
-// fleet image would drop the GB10 vLLM lead; llama.cpp is conversion-only and is not a candidate;
-// SGLang preview images target larger accelerators only. Engram offload is zero pool gain on GB10.
-// DSV41-0's payload total_size is FootprintReportedExternally until a fleet read; this module does
-// not author a TP width.
-data deepseek_v4_1_quality_requirement: QualityRequirement = quality_requirement(
-  identity: decl_ref(module_path: "gunbc.spark.serving_deployment_selection", decl_name: "deepseek_v4_1_quality_requirement"),
-  required_artifact: DeclarationRef { module_path: "gunbc.spark.serving_deployment_selection", decl_name: "artifact_deepseek_v4_1_flash_native", field: WholeDeclaration },
-  max_divergence_millinats: 0,
-  min_task_score_delta_hundredths: 0,
-  rationale: "operator policy 2026-09-11: native quality always. Only the published V4.1 Flash checkpoint is admissible; a requantised or quality-degrading substitute is other weights and is excluded by constraint_native_quality before dominance, not ranked" as NonEmptyStr,
-)
-
-fn v4_1_candidate_field_from_sm12(wire: NonEmptyStr, admitted: List<NonEmptyStr>) -> ServingDeploymentCandidateField {
-  let standings = v4_1_profile_standings_from(standing: sm12_kv_layout_standing(wire: wire, admitted: admitted))
-  let domain = serving_deployment_domain_over_standings(
-    artifacts: [group_a_served_artifact_transition.to],
-    topologies: fleet_admitted_topologies(fleet: pair_unit_a_fleet_snapshot),
-    standings: standings,
-  )
-  serving_candidate_field(
-    identity: decl_ref(module_path: "gunbc.spark.serving_deployment_selection", decl_name: "deepseek_v4_1_candidate_field"),
-    domain: domain,
-    candidates: derived_candidates_for(stem: "deepseek_v4_1", domain: domain),
-  )
-}
-
-fn v4_1_decision_input_from_sm12(wire: NonEmptyStr, admitted: List<NonEmptyStr>) -> ServingDeploymentDecisionInput {
-  serving_decision_input(
-    field: v4_1_candidate_field_from_sm12(wire: wire, admitted: admitted),
-    evidence: pair_unit_a_evidence_current,
-    quality_requirement: deepseek_v4_1_quality_requirement,
-    selection_policy: deepseek_v4_1_selection_policy,
-    constraints: v4_1_selection_constraints,
-    constraint_authority: id_v4_1_constraint_authority,
-    axes: v4_1_selection_axes,
-  )
-}
-
-data deepseek_v4_1_candidate_field: ServingDeploymentCandidateField = v4_1_candidate_field_from_sm12(
-  wire: v41_sm12_kv_layout,
-  admitted: v41_sm12_admitted_kv_cache_dtypes,
-)
-
-data deepseek_v4_1_domain: ServingDeploymentChoiceDomain = deepseek_v4_1_candidate_field.domain
-
-data deepseek_v4_1_decision_input: ServingDeploymentDecisionInput = v4_1_decision_input_from_sm12(
-  wire: v41_sm12_kv_layout,
-  admitted: v41_sm12_admitted_kv_cache_dtypes,
-)
diff --git a/dag/gunbc/spark/serving_group_launch.dag b/dag/gunbc/spark/serving_group_launch.dag
index b8667c4b40c..14c235cd721 100644
--- a/dag/gunbc/spark/serving_group_launch.dag
+++ b/dag/gunbc/spark/serving_group_launch.dag
@@ -3,7 +3,7 @@ module gunbc.spark.serving_group_launch
 import std.types { String, NonEmptyStr, List }
 import std.optional { Present, Absent }
 import product.host_identity { HostIdentity }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 import gunbc.spark.pair_serving_realization {
   spark_pair_head_unit_name, spark_pair_container_name, spark_pair_model_path_in_container,
   spark_pair_desired_snapshot,
@@ -39,13 +39,7 @@ type ServingGroupLaunch {
 
 fn serving_group_launch(group: FabricGroup) -> ServingGroupLaunch {
   match group {
-    FabricGroupA => ServingGroupLaunch {
-      head_unit_name: spark_pair_head_unit_name,
-      container_name: spark_pair_container_name,
-      engine_binary: sparkrun_vllm_ds4_gb10_vllm_binary,
-      declared_model_path: spark_pair_model_path_in_container(snapshot: spark_pair_desired_snapshot),
-    }
-    FabricGroupB => ServingGroupLaunch {
+    FabricGroupB {} => ServingGroupLaunch {
       head_unit_name: glm_native_head_unit_name,
       container_name: glm_native_container_name,
       engine_binary: glm_native_engine_binary,
@@ -67,8 +61,7 @@ type GroupRendezvous sole_constructor {
 
 fn serving_group_rendezvous(group: FabricGroup) -> GroupRendezvous? {
   match group {
-    FabricGroupA => none
-    FabricGroupB =>
+    FabricGroupB {} =>
       match glm_native_master_endpoint() {
         Absent => none
         Present { value: endpoint } =>
diff --git a/dag/gunbc/spark/serving_incarnation_observe.dag b/dag/gunbc/spark/serving_incarnation_observe.dag
index 6bcfff5dcda..f5cfddfb24c 100644
--- a/dag/gunbc/spark/serving_incarnation_observe.dag
+++ b/dag/gunbc/spark/serving_incarnation_observe.dag
@@ -8,7 +8,7 @@ import std.measure { Hertz, hertz, hertz_count }
 import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest }
 import product.host_identity { HostIdentity }
 import product.fabric.demand { ObservationReceiptRef }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_wire }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire }
 import gunbc.spark.vllm_endpoint_process_launch { VllmEndpointProcessLaunch, vllm_endpoint_process_launch_key }
 import gunbc.spark.vllm_serving_launch {
   VllmServingLaunch, vllm_serving_launch,
diff --git a/dag/gunbc/spark/serving_load_runner.dag b/dag/gunbc/spark/serving_load_runner.dag
index ca730dd161c..602351f9745 100644
--- a/dag/gunbc/spark/serving_load_runner.dag
+++ b/dag/gunbc/spark/serving_load_runner.dag
@@ -22,7 +22,7 @@ import gunbc.spark.serving_rank_observe {
   observed_rank_incarnation, ObservedRankIncarnation,
 }
 import gunbc.harness.harness_backend { harness_launch_from_body, harness_queue_from_body }
-import gunbc.spark.fabric_switch_observed { FabricGroup }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 import extdeps.vllm.kv_layout { AdmissionCost }
 import gunbc.spark.serving_performance_subject { ServingPerformanceSubjectStanding }
 import gunbc.spark.serving_load_probe {
diff --git a/dag/gunbc/spark/serving_offer.dag b/dag/gunbc/spark/serving_offer.dag
index b24b55e2305..7109cf74517 100644
--- a/dag/gunbc/spark/serving_offer.dag
+++ b/dag/gunbc/spark/serving_offer.dag
@@ -11,7 +11,7 @@ import product.fabric.provider_route { ProviderRoute }
 import std.measure { Second, second, MoneyRate, money_amount_micro, hardware_thread_count }
 import extdeps.currency.currency { Usd }
 import product.host_identity { HostIdentity }
-import gunbc.spark.fabric_switch_observed { fabric_group_wire, FabricGroup, FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { fabric_group_wire, FabricGroup, FabricGroupB }
 import gunbc.spark.managed_access_bootstrap { SparkManagedGrant, InspectServingContainer }
 import gunbc.spark.serving_arm_launch { glm_native_container_name }
 import gunbc.spark.dgx_procurement { OperatorAllocation }
@@ -366,8 +366,7 @@ data spark_serving_incarnation_unobserved_obligation: NonEmptyStr = "gunbc.spark
 // install side. Keyed by fabric group because the arm determines the container.
 fn spark_serving_offer_required_grants(group: FabricGroup) -> List<SparkManagedGrant> {
   match group {
-    FabricGroupA => [InspectServingContainer { container: spark_pair_container_name }]
-    FabricGroupB => [InspectServingContainer { container: glm_native_container_name }]
+    FabricGroupB {} => [InspectServingContainer { container: glm_native_container_name }]
   }
 }
 
diff --git a/dag/gunbc/spark/serving_subject.dag b/dag/gunbc/spark/serving_subject.dag
index 7f7873ecbf0..f8151a57dcc 100644
--- a/dag/gunbc/spark/serving_subject.dag
+++ b/dag/gunbc/spark/serving_subject.dag
@@ -136,7 +136,7 @@ type SparkServingReservation {
 
 data glm_group_b_serving_reservation: SparkServingReservation = SparkServingReservation {
   subject: glm_group_b_serving_subject,
-  hosts: fabric_group_hosts(g: FabricGroupB),
+  hosts: fabric_group_hosts(g: FabricGroupB {}),
   basis: serving_ruling_2026_09_12_group_b_is_glm,
 }
 
diff --git a/dag/gunbc/spark/standing_host_effect_recover.dag b/dag/gunbc/spark/standing_host_effect_recover.dag
deleted file mode 100644
index ff174f20e18..00000000000
--- a/dag/gunbc/spark/standing_host_effect_recover.dag
+++ /dev/null
@@ -1,173 +0,0 @@
-module gunbc.spark.standing_host_effect_recover
-
-import std.types { String, Bool, List, NonEmptyStr, EpochSecs }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import std.optional { Present, Absent }
-import product.host_identity { HostIdentity, host_identity_eq }
-import product.capacity.event_chain { EventId }
-import gunbc.auth.standing_operator_grant { StandingOperatorGrant, standing_grant_covers, StandingHostEffectRecover, StandingGrantFabricGroup }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, fabric_group_of_host, fabric_group_wire }
-import gunbc.spark.pair_serving_d0 { d0_standing_grants }
-import gunbc.spark.pair_serving_d0_door { StandingGrantRowStanding, StandingGrantRowOnMain, StandingGrantRowNotOnMain, fresh_grant_row_standing, executed_grant_row }
-import gunbc.spark.pair_serving_authority_log { HostEffectRecord, placement_read, PlacementReadAt, PlacementUnread, live_claim_on, LiveClaimFound, LiveClaimAbsent, LiveClaimUnread }
-import gunbc.spark.host_effect_quiescence { ClaimantStanding, RecoveryAuthorized, claimant_standing_wire }
-import gunbc.spark.host_commitment { HostEffectHandle, settle_host_effect_over, HostEffectSettled, HostEffectStillHeld }
-import gunbc.fabric_storage_client { FabricStorageBinding }
-import gunbc.spark.host_effect_quiescence { ArgvRun, parse_claimant_standing }
-import gunbc.spark.host_commitment { fleet_argv_run }
-import gunbc.fleet_ssh_locus { prepare_fleet_ssh_agent_context, FleetSshContextReady, FleetSshContextRefused }
-import gunbc.fabric_event_log_host { HostStoreResolved, HostStoreRefused, event_log_store_for_host, now_epoch_seconds }
-import gunbc.spark.fabric_reach { ExecutorReachKnown, ExecutorReachUnknown, observe_executor_reach }
-import gunbc.fleet_multi_principal_probe { spark_converge_target_selection, SparkConvergeTargetSingle, SparkConvergeTargetAllObserveOnly, SparkConvergeTargetRefused, env_var_nonempty }
-import std.measure { second_count }
-
-// ── RECOVERING A DEAD LANE'S HOST-EFFECT CLAIM UNDER THE STANDING GRANT (rulings of valiant-crab-775 and the
-// #13102 side chat, 2026-10-03) ──────────────────────────────────────────────────────────────────────────
-//
-// The operator-run recovery (gunbc.spark.host_commitment host_effect_recover_wet) takes the exact claim, a
-// typed claimant disposition and a receipt from its operator. This is the same release, admitted instead by
-// the committed standing grant, and every fact the operator supplied there is derived or carried here:
-//   (1) AUTHORITY: the grant row the run executes is byte-identical to origin/main's, read fresh, and a grant
-//       on it covers StandingHostEffectRecover for this host -- a scope a branch added to the row is not on
-//       main, so it cannot authorize itself;
-//   (2) ROSTER: coverage is the grant's identity join, so a host outside the grant's roster (Group B, or
-//       any host the grant does not name) is not covered;
-//   (3) THE CLAIM is derived from one live read of the host-placement partition: exactly ONE unreleased
-//       claim on the host is recovered; none, an unread partition, or several refuse, and several are listed;
-//   (4) the release binds that exact claim and its recorded residue (the handle is built from the record);
-//   (5) the claimant's disposition is a TYPED input (terminated or abandoned), carried into the release's
-//       provenance -- a quiet host is not an abandoned claimant, and the two stay separate facts;
-//   (6) quiescence is measured FRESH, after the claim was selected, against that claim's residue
-//       (settle_host_effect_over observes, then releases only a quiet host), and the release is read back:
-//       success only when the same read finds the claim no longer live.
-
-type RecoverClaimSelection
-  = RecoverClaimSelected { record: HostEffectRecord }
-  | RecoverNoClaim
-  | RecoverAmbiguous { claims: List<String> }
-
-fn recover_claim_selection(host: HostIdentity, effects: List<HostEffectRecord>) -> RecoverClaimSelection {
-  let live = filter(effects, r => !r.released && host_identity_eq(a: r.host, b: host))
-  if length(live) == 0 { RecoverNoClaim }
-  else if length(live) == 1 {
-    match first(live) {
-      Present { value: r } => RecoverClaimSelected { record: r }
-      Absent => RecoverNoClaim
-    }
-  } else {
-    RecoverAmbiguous { claims: map(live, r => join([r.id as String, " (", r.purpose as String, ", by ", r.executor as String, ")"], "")) }
-  }
-}
-
-// THE COVERING GRANT ITSELF, not a yes/no: its identity is what the release records as its authority, so the
-// provenance is read from the grant that covered rather than restated (review 74852).
-fn recover_covering_grant(host: HostIdentity, host_group: FabricGroup) -> StandingOperatorGrant? {
-  first(filter(d0_standing_grants, standing => standing_grant_covers(g: standing, scope: StandingGrantFabricGroup { group: host_group, hosts: [host] }, effect: StandingHostEffectRecover)))
-}
-
-type RecoverAuthority
-  = RecoverAuthorizedBy { grant: StandingOperatorGrant }
-  | RecoverUnauthorized { cause: String }
-
-fn recover_authority(host: HostIdentity, row: StandingGrantRowStanding) -> RecoverAuthority {
-  match row {
-    StandingGrantRowNotOnMain { cause: c } => RecoverUnauthorized { cause: join(["the standing grant is not honored: ", c], "") }
-    StandingGrantRowOnMain =>
-      match fabric_group_of_host(host: host) {
-        Absent => RecoverUnauthorized { cause: join([host as String, " is in no fabric group, so no grant can cover it"], "") }
-        Present { value: host_group } =>
-          match recover_covering_grant(host: host, host_group: host_group) {
-            Present { value: covering } => RecoverAuthorizedBy { grant: covering }
-            Absent => RecoverUnauthorized { cause: join(["no standing grant covers recovering a host-effect claim on ", host as String, " (", fabric_group_wire(g: host_group) as String, ")"], "") }
-          }
-      }
-  }
-}
-
-fn recover_authority_causes(host: HostIdentity, row: StandingGrantRowStanding) -> List<String> {
-  match recover_authority(host: host, row: row) {
-    RecoverAuthorizedBy { grant: _ } => [] as List<String>
-    RecoverUnauthorized { cause: c } => [c]
-  }
-}
-
-fn recover_receipt(r: HostEffectRecord, run_id: NonEmptyStr, standing: ClaimantStanding) -> NonEmptyStr {
-  join(["fleet-converge run ", run_id as String, " under the covering standing grant: claim ", r.id as String, " (", r.purpose as String, ") recorded by ", r.executor as String, " at ", to_string(r.recorded_at), " for a ", to_string(second_count(s: r.term)), " term; claimant declared ", claimant_standing_wire(c: standing)], "") as NonEmptyStr
-}
-
-fn standing_host_effect_recover_over(host: HostIdentity, standing: ClaimantStanding, run_id: NonEmptyStr, row: StandingGrantRowStanding, run: fn(List<String>) -> ArgvRun, store: FabricStorageBinding, executor: NonEmptyStr, at: EpochSecs) -> ProcessExit {
-  match recover_authority(host: host, row: row) {
-    RecoverUnauthorized { cause: c } => exit_failure(reason: c)
-    RecoverAuthorizedBy { grant: covering } =>
-    match placement_read(store: store) {
-      PlacementUnread { step: st, reason: why } => exit_failure(reason: join(["the host-placement partition could not be read at ", st, ", so no claim is selected: ", why], ""))
-      PlacementReadAt { head: _, effects: effs, preparations: _ } =>
-        match recover_claim_selection(host: host, effects: effs) {
-          RecoverNoClaim => exit_failure(reason: join(["no unreleased host-effect claim on ", host as String, "; nothing to recover"], ""))
-          RecoverAmbiguous { claims: cs } => exit_failure(reason: join([host as String, " carries ", to_string(length(cs)), " unreleased claims, so none is recovered by derivation: ", join(cs, "; ")], ""))
-          RecoverClaimSelected { record: r } =>
-            match settle_host_effect_over(
-              handle: HostEffectHandle { host: host, residue: r.residue, claim: r.id },
-              provenance: RecoveryAuthorized { claim: r.id, claimant: standing, authorized_by: covering.identity, receipt: recover_receipt(r: r, run_id: run_id, standing: standing) },
-              run: run, store: store, executor: executor, at: at,
-            ) {
-              HostEffectStillHeld { cause: c } => exit_failure(reason: c)
-              HostEffectSettled =>
-                match live_claim_on(store: store, host: host, claim: r.id) {
-                  LiveClaimAbsent => ExitSuccess
-                  LiveClaimFound { record: _ } => exit_failure(reason: join(["the release of ", r.id as String, " reported settled but the claim still reads live"], ""))
-                  LiveClaimUnread { step: st, reason: why } => exit_failure(reason: join(["the release of ", r.id as String, " could not be read back at ", st, ": ", why], ""))
-                }
-            }
-        }
-    }
-  }
-}
-
-// THE DISPATCHED ENTRY. DECLARED FRONTIER (review 74852, DESIGN §3c): its caller is the fleet-converge
-// mode `spark_host_effect_recover` (gunbc.fleet.fleet_converge_workflow), added in gunbc#13040, which is
-// stacked on this change; this PR lands the authority and the witnessed fold the mode will dispatch.
-// TRIGGER: #13040 merging this change and adding that mode; until then nothing invokes it. SPARK_CONVERGE_TARGET names the host (one, never all); the claimant's disposition
-// is the closed input GUNBC_HOST_EFFECT_CLAIMANT (terminated | abandoned); the run's own id is the receipt's
-// anchor. The executor is the host-placement store's host, as for the operator-run recovery.
-data standing_recover_claimant_env: NonEmptyStr = "GUNBC_HOST_EFFECT_CLAIMANT" as NonEmptyStr
-
-fn claimant_wire() -> String {
-  match env_var_nonempty(name: standing_recover_claimant_env) {
-    Present { value: w } => w
-    Absent => ""
-  }
-}
-
-fn standing_host_effect_recover_ci_wet() -> ProcessExit {
-  match spark_converge_target_selection(execute_apply: true) {
-    SparkConvergeTargetRefused { reason: why } => exit_failure(reason: why)
-    SparkConvergeTargetAllObserveOnly => exit_failure(reason: "SPARK_CONVERGE_TARGET is unset: a recovery releases one host's claim, so it names that host")
-    SparkConvergeTargetSingle { host: host } =>
-      match parse_claimant_standing(wire: claimant_wire()) {
-        Absent => exit_failure(reason: join([standing_recover_claimant_env as String, " must be terminated or abandoned: the claimant's disposition is a separate fact from the host's quiescence, and it is never inferred from it"], ""))
-        Present { value: standing } =>
-          match env_var_nonempty(name: "GITHUB_RUN_ID" as NonEmptyStr) {
-            Absent => exit_failure(reason: "GITHUB_RUN_ID is unset, so the recovery's receipt has no run to name")
-            Present { value: run_id } =>
-              match observe_executor_reach() {
-                ExecutorReachUnknown { cause: c } => exit_failure(reason: c)
-                ExecutorReachKnown { short_hostname: executor, path: _ } =>
-                  match event_log_store_for_host(short_hostname: executor) {
-                    HostStoreRefused { detail: d } => exit_failure(reason: d)
-                    HostStoreResolved { store: store, executor: _ } =>
-                      match now_epoch_seconds() {
-                        Absent => exit_failure(reason: "the clock could not be read as epoch seconds")
-                        Present { value: at } =>
-                          match prepare_fleet_ssh_agent_context(attempt_raw: "host-effect-standing-recover") {
-                            FleetSshContextRefused { cause: c } => exit_failure(reason: c)
-                            FleetSshContextReady { context: context, receipt: _ } =>
-                              standing_host_effect_recover_over(host: host, standing: standing, run_id: run_id as NonEmptyStr, row: fresh_grant_row_standing(executed: executed_grant_row()), run: fn(argv) { fleet_argv_run(context: context, host: host, argv: argv) }, store: store, executor: executor as NonEmptyStr, at: at)
-                          }
-                      }
-                  }
-              }
-          }
-      }
-  }
-}
diff --git a/dag/gunbc/spark/training_ready.dag b/dag/gunbc/spark/training_ready.dag
index 744054f086c..184b219d698 100644
--- a/dag/gunbc/spark/training_ready.dag
+++ b/dag/gunbc/spark/training_ready.dag
@@ -8,7 +8,9 @@ import gunbc.spark.cell_role {
   SparkCellRole,
   SparkServingCell,
   SparkTrainingCell,
-  spark_cell_role_of,
+  SparkCellRoleAssignment,
+  spark_cell_role_assignments,
+  spark_cell_role_in,
   spark_cell_role_eq,
   SparkCellRoleLookup,
   SparkCellRoleAbsent,
@@ -432,6 +434,10 @@ fn spark_serving_retirement_refusals(retirement: SparkServingRetirementObservati
   )
 }
 
+// THE ROSTER IS AN INPUT (review 77708): the gate decides readiness for the roster it is handed -- the
+// production roster (gunbc.spark.cell_role spark_cell_role_assignments) or a supplied one -- so its
+// claims discriminate whatever machines are assigned today.
+//
 // THE GATE READS ONE VALUE, BECAUSE THE PAIRING WAS A THIRD THING TO GET WRONG.
 //
 // This took the retirement and the pool as two arguments and checked that they agreed. They cannot
@@ -442,10 +448,23 @@ fn spark_serving_retirement_refusals(retirement: SparkServingRetirementObservati
 // bypassed. Its discriminating RED did not retire with it; it moved to the producer's claims, which
 // is where the refusal now lives.
 fn spark_training_readiness(
+  assignments: List<SparkCellRoleAssignment>,
+  pool: SparkUnifiedPoolObservation,
+) -> SparkTrainingReadiness {
+  spark_training_readiness_in(pool: pool, assignments: spark_cell_role_assignments)
+}
+
+// THE ROSTER IS A PARAMETER, FOR THE REASON gunbc.spark.cell_role spark_cell_role_in GIVES: a
+// capability's evidence must not depend on which machines are currently assigned what. Reading the
+// production roster here left the training arm with no subject once the 2026-09-02 operator decision
+// (#10009) made srv6 a serving cell -- the positive control went red, and every refusal claim over
+// srv6 passed on role alone instead of on the axis it exists to discriminate.
+fn spark_training_readiness_in(
   pool: SparkUnifiedPoolObservation,
+  assignments: List<SparkCellRoleAssignment>,
 ) -> SparkTrainingReadiness {
   let retirement = pool.after
-  match spark_cell_role_of(host: retirement.host) {
+  match spark_cell_role_in(assignments: assignments, host: retirement.host) {
     SparkCellRoleAbsent =>
       SparkTrainingNotReady {
         cause: "spark_training_ready: the host holds no Spark cell role, so nothing assigned it to training" as NonEmptyStr,
diff --git a/dag/gunbc/spark/v41_capacity_measurement.dag b/dag/gunbc/spark/v41_capacity_measurement.dag
deleted file mode 100644
index 5ce693d9fb8..00000000000
--- a/dag/gunbc/spark/v41_capacity_measurement.dag
+++ /dev/null
@@ -1,993 +0,0 @@
-module gunbc.spark.v41_capacity_measurement
-
-import v2.std.algebra { filter }
-import gunbc.spark.serving_promotion { WorkloadCalibrationReceipt }
-import gunbc.spark.serving_performance_subject { ServingSubjectKey }
-import v2.std.collection { list_at_optional }
-import std.types { Bool, Int, List, NonEmptyStr, String }
-import std.nat { Nat, nat_min, nat_max }
-import std.measure {
-  ByteSize, byte_size, byte_size_count, TokenCount, token_count, token_count_value,
-  Millisecond, millisecond, millisecond_count, Microsecond, microsecond, microsecond_count,
-  BasisPoint, basis_point, basis_point_count, concurrent_request_hundredths_count,
-  Gibibyte, gibibyte, gibibyte_to_byte_size,
-}
-import std.content_hash { Sha256Digest, Sha256DigestHex, ContentHash }
-import std.dissolution { DissolutionCondition, unbound_dissolution }
-import std.optional { Present, Absent }
-import std.staircase { StepVerdict, StepStops, StepContinues, StaircaseOutcome, StaircaseStopped, StaircaseCompleted, StaircaseRefused, StaircasePlanEmpty, StaircasePlanLevelDuplicated, run_staircase }
-import extdeps.external_authority { CitedFigureStanding, TranscribedUncited }
-import extdeps.vllm.server { VllmSourceRevision }
-import extdeps.vllm.engine_args { VllmPrefixCachingRequest, PrefixCachingExplicit, PrefixCachingOmitted }
-import extdeps.vllm.kv_cache { VllmObservedKvPool, VllmResolvedKvFormat, ResolvedFp8DsMla, ResolvedUnobserved }
-import extdeps.vllm.kv_layout { VllmReportedCapacity, observed_revisions_agree }
-import extdeps.linux.psi { PsiReading, PsiStallInterval, PsiStallMeasured, PsiStallUnmeasurable, psi_full_stall_interval }
-import extdeps.linux.diskstats { DiskstatsReading, DiskReadInterval, DiskReadMeasured, DiskReadUnmeasurable, disk_read_interval }
-import extdeps.linux.mincore { MincoreFileResidency, mincore_resident_bytes }
-import extdeps.linux.cgroup_v2_memory { CgroupMemoryStat }
-import extdeps.container.oci.digest { OciContentDigest, OciSha256Digest, render_oci_content_digest_wire }
-import gunbc.floor_memory_demand { CgroupMemoryEvents }
-import gunbc.spark.v41_runtime_realized { V41OciImageDigest }
-import gunbc.spark.v41_runtime_image_converge { V41ProducedImageHeld, v41_arm_a_produced_image, v41_production_produced_image }
-import gunbc.spark.serving_load_probe { ClientBenchLatency, ClientBenchLatencyUnread, ClientBenchLatencyReported }
-
-// ══ V4.1 CAPACITY MEASUREMENT ═══════════════════════════════════════════════════════════════════
-//
-// THE FIRST SERVING ACTION FOR V4.1 FLASH on Group A (srv5-8, one TP4 replica, fp8_ds_mla on SM12,
-// Engram file-backed) is a MEASUREMENT, not production traffic (operator approval, 2026-09-25).
-// This module holds its plan, its receipt carriers, and the three capacities it reports. It
-// computes every answer from readings and refuses, typed and naming the missing reading, whenever
-// a reading is absent. It never interpolates: a capacity is one of the concurrencies the staircase
-// or the probe actually ran (extdeps.vllm.kv_cache VllmCapPoolObservation carries the same rule for
-// the context cap / pool relation).
-//
-// THE SERVE THAT MEASURES IS ITS OWN ADMITTED REALIZATION. The production gate at the bottom refuses
-// V4.1 production admission until a capacity report is admitted; it does not gate the measurement
-// serve, which must be up to be measured. The two are distinct variants so the gate can tell them
-// apart (ruling from proud-deer-538, 2026-09-25).
-
-// ── THE PLAN ────────────────────────────────────────────────────────────────────────────────────
-
-// The TP4 ranks, by their rank index.
-data v41_measurement_ranks: List<Nat> = [0, 1, 2, 3]
-
-data v41_measurement_rank_count: Nat = length(v41_measurement_ranks)
-
-data v41_measurement_max_model_len: TokenCount = token_count(count: 262144)
-
-// The staircase concurrencies, in order. A capacity is always one of these, never a value between two.
-data v41_staircase_concurrencies: List<Nat> = [1, 2, 4, 6, 8, 12, 16]
-
-// ── THE MEASUREMENT SERVE'S LAUNCH SHAPE ─────────────────────────────────────────────────────────
-//
-// ONE SERVE FOR THE WHOLE STAIRCASE. The load generator raises concurrency; the serve is not relaunched
-// per step, because a relaunch resets the page cache, the refault and fault baselines and the KV pool
-// the stop rules and the Engram-resident capacity read across steps, and every step shares one run id
-// and one startup receipt. The launch (the V4.1 Group A realization) takes its shape from here.
-//
-// max_num_seqs is the largest staircase concurrency, derived from the plan. The other two are AXES OF
-// THE MEASUREMENT, not production policy and not measured facts: no V4.1 figure exists to ground them
-// (V4's were measured on V4 and are not borrowed), so they are declared here, recorded in every rank's
-// startup receipt as resolved, and every capacity this plan reports is a capacity AT them -- the same
-// rule extdeps.vllm.kv_cache applies to cap and pool (measured pairs at a stated utilization, no curve).
-//   gpu memory utilization 8000 bp: vLLM's pool is a fraction of the ~121 GiB unified memory; the
-//     remaining ~20% is left for the OS and the file-backed Engram page cache, whose residency is one of
-//     the three capacities measured. A different utilization is a different measurement.
-//   max_num_batched_tokens 8192: the prefill chunk per scheduler step; it also sizes the file-backed
-//     lookup's pinned staging (max_num_batched_tokens x local heads x record).
-//   prefix caching explicitly OFF: every request pays its own KV and its own Engram lookups, so the
-//     pool, residency and refault readings are not flattered by shared prefixes, and the probe cells'
-//     "prefix caching defeated" holds by the launch rather than by prompt construction alone. Left
-//     omitted, the V4.1 image would resolve it from the model config, so the engine and not this plan
-//     would decide what is measured.
-type V41MeasurementLaunchShape sole_constructor {
-  max_model_len: TokenCount
-  max_num_seqs: Nat
-  max_num_batched_tokens: TokenCount
-  gpu_memory_utilization: BasisPoint
-  prefix_caching: VllmPrefixCachingRequest
-}
-
-data v41_measurement_gpu_memory_utilization: BasisPoint = basis_point(count: 8000)
-data v41_measurement_max_num_batched_tokens: TokenCount = token_count(count: 8192)
-
-// CONSUMER: A DECLARED FRONTIER. The V4.1 TP4 Group A launch realization (zesty-ant-800's lane, the mp
-// arm route across srv5-8) reads its max_model_len, max_num_seqs, max_num_batched_tokens,
-// gpu-memory-utilization and prefix caching from this function; until it lands its dry run refuses
-// with this obligation named.
-data v41_measurement_launch_shape_frontier: DissolutionCondition = unbound_dissolution(description: "TRIGGER: the V4.1 TP4 Group A launch realization (the mp arm route across srv5-8) takes max_model_len, max_num_seqs, max_num_batched_tokens, gpu memory utilization and prefix caching from gunbc.spark.v41_capacity_measurement v41_measurement_launch_shape and renders them into the launch. SUFFICIENT FOR: the measurement serve runs at exactly the shape the plan declares, and every rank's startup receipt can be checked against it." as NonEmptyStr)
-
-fn v41_measurement_launch_shape() -> V41MeasurementLaunchShape {
-  V41MeasurementLaunchShape {
-    max_model_len: v41_measurement_max_model_len,
-    max_num_seqs: fold(v41_staircase_concurrencies, init: nat_min(a: 0, b: 0), f: (acc, c) => nat_max(a: acc, b: c)),
-    max_num_batched_tokens: v41_measurement_max_num_batched_tokens,
-    gpu_memory_utilization: v41_measurement_gpu_memory_utilization,
-    prefix_caching: PrefixCachingExplicit { enabled: false },
-  }
-}
-
-type V41ProbeCell { context: TokenCount, concurrency: Nat }
-
-data v41_probe_cells: List<V41ProbeCell> = [
-  V41ProbeCell { context: token_count(count: 32768), concurrency: 1 },
-  V41ProbeCell { context: token_count(count: 262144), concurrency: 1 },
-  V41ProbeCell { context: token_count(count: 262144), concurrency: 2 },
-  V41ProbeCell { context: token_count(count: 262144), concurrency: 4 },
-  V41ProbeCell { context: token_count(count: 262144), concurrency: 6 },
-]
-
-// THE ENGRAM STARTUP ARMS ARE IMAGES, NOT A RUNTIME FLAG, and they are named for the storage the image
-// actually SERVES. Arm A is upstream pinned: ParallelEngramEmbedding._allocate_weights constructs
-// DPSharedEngramStorage, which holds the whole table in /dev/shm and registers it with the device.
-// Every image built before the _allocate_weights cutover serves this, whatever file-backed code it
-// merely carries (the release in #12304 runs only inside FileBackedEngramStorage, which such an image
-// never constructs). Arm B is file-backed released: the first image built after the cutover, where
-// each rank opens its row store through allocate_file_backed and the page cache is released after
-// the checksum. A file-backed arm that keeps the cache is not built: the release is unconditional
-// and a switch to keep it is the escape hatch #12304 refused. The arm is read off the image by a
-// binding keyed on the image's CONFIG DIGEST, the same digest every rank's startup receipt carries,
-// and an image no binding names (or two bindings name) has no arm and refuses. The build run that
-// produced the image is carried beside the digest as its provenance: a binding names the image's
-// receipt row (gunbc.spark.v41_runtime_image_converge V41ProducedImageHeld), never a copy of its digest.
-type V41EngramStartupArm = EngramUpstreamPinned | EngramFileBackedReleased
-
-type V41EngramArmBinding { arm: V41EngramStartupArm, image: V41ProducedImageHeld }
-
-// Arm B: fleet-converge run 36327364664 (tag gunbc-vllm-dsv41-gb10:3cedb66f0ec0869e), the production
-// V4.1 image built on srv8 with the design-B cutover's patch set (#12359), so it serves Engram
-// file-backed with the page cache released. Both arms are now bound, so the binding frontier is gone.
-// Arm A: fleet-converge spark_v41_runtime_image_build run 36207135528 (tag
-// gunbc-vllm-dsv41-gb10:d73e307009a5d716), reported by proud-deer-538 2026-09-26. Built before the
-// _allocate_weights cutover, so it serves upstream pinned storage.
-data v41_engram_arm_bindings: List<V41EngramArmBinding> = [
-  V41EngramArmBinding { arm: EngramUpstreamPinned, image: v41_arm_a_produced_image },
-  V41EngramArmBinding { arm: EngramFileBackedReleased, image: v41_production_produced_image },
-]
-
-fn v41_engram_arm_of(image: V41OciImageDigest, bindings: List<V41EngramArmBinding>) -> V41EngramStartupArm? {
-  let wire = render_oci_content_digest_wire(d: image.config)
-  let matching = filter(bindings, b => render_oci_content_digest_wire(d: b.image.config) == wire)
-  if length(matching) != 1 {
-    none
-  } else {
-    match list_at_optional(xs: matching, index: 0) {
-      Present { value: b } => Present { value: b.arm }
-      Absent => none
-    }
-  }
-}
-
-fn v41_arm_wire(a: V41EngramStartupArm) -> String {
-  match a {
-    EngramUpstreamPinned => "A-upstream-pinned"
-    EngramFileBackedReleased => "B-file-backed-released"
-  }
-}
-
-// ── BETS TO FALSIFY ─────────────────────────────────────────────────────────────────────────────
-//
-// These figures come from a side-chat derivation. They are carried as bets (DESIGN 4d): each has
-// its standing and the reading that would settle it, and each gets a verdict against the reading.
-// No capacity is ever computed from a bet.
-type V41ByteRangeBet {
-  key: NonEmptyStr
-  low: ByteSize
-  high: ByteSize
-  standing: CitedFigureStanding
-}
-
-type V41EngramResidentBet {
-  concurrency: Nat
-  resident: Gibibyte
-  standing: CitedFigureStanding
-}
-
-data v41_kv_bytes_per_token_bet: V41ByteRangeBet = V41ByteRangeBet {
-  key: "kv bytes per logical token per rank (MLA replicated under TP4, DCP=1): 1,790 B content = (584 main + 132 indexer) x 2.5 states from compress ratios [2,2,2,1] on kv_source_layers [2,8,14,20], plus block alignment" as NonEmptyStr,
-  low: byte_size(count: 1800),
-  high: byte_size(count: 1940),
-  standing: TranscribedUncited { read_obligation: "the min rank's available KV bytes divided by its GPU KV cache size tokens, from the startup receipt (v41_min_rank_bytes_per_token)" as NonEmptyStr },
-}
-
-data v41_engram_resident_bets: List<V41EngramResidentBet> = [
-  V41EngramResidentBet { concurrency: 2, resident: gibibyte(count: 19), standing: TranscribedUncited { read_obligation: "mincore resident bytes over the rank's Engram files after requests at 262k x2, disjoint prompts" as NonEmptyStr } },
-  V41EngramResidentBet { concurrency: 4, resident: gibibyte(count: 30), standing: TranscribedUncited { read_obligation: "mincore resident bytes over the rank's Engram files after requests at 262k x4, disjoint prompts" as NonEmptyStr } },
-  V41EngramResidentBet { concurrency: 6, resident: gibibyte(count: 37), standing: TranscribedUncited { read_obligation: "mincore resident bytes over the rank's Engram files after requests at 262k x6, disjoint prompts" as NonEmptyStr } },
-  V41EngramResidentBet { concurrency: 16, resident: gibibyte(count: 46), standing: TranscribedUncited { read_obligation: "mincore resident bytes over the rank's Engram files after requests at 262k x16, disjoint prompts" as NonEmptyStr } },
-]
-
-type V41BetVerdict
-  = BetConfirmed { key: NonEmptyStr, observed: ByteSize }
-  | BetFalsified { key: NonEmptyStr, observed: ByteSize }
-  | BetUnreadable { key: NonEmptyStr, cause: NonEmptyStr }
-
-fn v41_judge_byte_range_bet(bet: V41ByteRangeBet, observed: ByteSize?) -> V41BetVerdict {
-  match observed {
-    Absent => BetUnreadable { key: bet.key, cause: "the reading the bet names was not taken" as NonEmptyStr }
-    Present { value: o } =>
-      if byte_size_count(b: o) >= byte_size_count(b: bet.low) && byte_size_count(b: o) <= byte_size_count(b: bet.high) {
-        BetConfirmed { key: bet.key, observed: o }
-      } else {
-        BetFalsified { key: bet.key, observed: o }
-      }
-  }
-}
-
-// THE ENGRAM FIGURES ARE POINT BETS ("about 19 GiB") WITH NO STATED TOLERANCE, so no band exists to
-// confirm or falsify them against, and inventing one here would be a heuristic. Their verdict pairs
-// the observation with the bet, both in bytes, and a reader decides with both in view. A reading
-// that is missing is Unreadable, exactly as for the ranged bet.
-type V41PointBetVerdict
-  = PointBetObserved { concurrency: Nat, bet: ByteSize, observed: ByteSize }
-  | PointBetUnreadable { concurrency: Nat, cause: NonEmptyStr }
-
-fn v41_judge_engram_resident_bet(bet: V41EngramResidentBet, observed: ByteSize?) -> V41PointBetVerdict {
-  match observed {
-    Absent => PointBetUnreadable { concurrency: bet.concurrency, cause: "no after-requests mincore residency was read at this concurrency" as NonEmptyStr }
-    Present { value: o } => PointBetObserved { concurrency: bet.concurrency, bet: gibibyte_to_byte_size(g: bet.resident), observed: o }
-  }
-}
-
-// The observed figure the Engram bets name: a rank's mincore residency after requests, from the
-// admitted timeline. It is read per rank; the bet is per rank.
-fn v41_after_requests_resident(t: V41ResidencyTimeline, rank: Nat) -> ByteSize? {
-  match t {
-    ResidencyTimelineRefused { causes: _ } => none
-    ResidencyTimelineAdmitted { run_id: _, arm: _, cells: cs } =>
-      match list_at_optional(xs: filter(cs, c => c.rank == rank && v41_phase_wire(p: c.phase) == v41_phase_wire(p: AfterRequests)), index: 0) {
-        Present { value: c } => Present { value: v41_cell_engram_resident_bytes(c: c) }
-        Absent => none
-      }
-  }
-}
-
-// ── MEASUREMENT 1: THE STARTUP MEMORY RECEIPT, FROM EVERY RANK ─────────────────────────────────
-//
-// A READING carries every field as optional, because the wet reader takes them from log lines and
-// endpoints that may not print. ADMISSION requires every field and names each missing one. A rank
-// that is missing anything refuses the whole receipt: the replica is judged by its MINIMUM rank, and
-// a missing rank could be that minimum.
-type V41RankParallelism { tp: Nat, dcp: Nat, pp: Nat, dp: Nat }
-
-type V41RankMemoryBreakdown {
-  free: ByteSize
-  total: ByteSize
-  weights: ByteSize
-  non_torch: ByteSize
-  activation_peak: ByteSize
-  cuda_graph: ByteSize
-  available_kv: ByteSize
-}
-
-// AN IMAGE CAPABILITY FACT, READ FROM THE RANK'S STARTUP LOG. The V4.1 indexer top-k kernel ships as
-// the DeepSelect extension (vllm._deepselect_C). When its import fails vLLM may take a slower
-// fallback, which could dominate TTFT at 262k, so the receipt carries which one the rank ran. A
-// failed import is a recorded fact, not a refusal; a rank whose log was not read for it refuses,
-// like every other missing reading.
-type V41ImageExtensionStanding
-  = ExtensionLoaded
-  | ExtensionImportFailed { logged: NonEmptyStr }
-  | ExtensionUnobserved
-
-type V41RankStartupReading {
-  run_id: NonEmptyStr
-  rank: Nat
-  host: NonEmptyStr
-  image: V41OciImageDigest?
-  vllm_revision: VllmSourceRevision?
-  parallelism: V41RankParallelism?
-  kv_format: VllmResolvedKvFormat
-  block_size: Nat?
-  max_model_len: TokenCount?
-  max_num_seqs: Nat?
-  max_num_batched_tokens: Nat?
-  spec_decode_config: NonEmptyStr?
-  memory: V41RankMemoryBreakdown?
-  reported: VllmReportedCapacity?
-  num_gpu_blocks: Nat?
-  kv_cache_groups: Nat?
-  deepselect: V41ImageExtensionStanding
-}
-
-type V41RankStartupReceipt sole_constructor {
-  run_id: NonEmptyStr
-  rank: Nat
-  host: NonEmptyStr
-  image: V41OciImageDigest
-  vllm_revision: VllmSourceRevision
-  parallelism: V41RankParallelism
-  block_size: Nat
-  max_model_len: TokenCount
-  max_num_seqs: Nat
-  max_num_batched_tokens: Nat
-  spec_decode_config: NonEmptyStr
-  memory: V41RankMemoryBreakdown
-  reported: VllmReportedCapacity
-  num_gpu_blocks: Nat
-  kv_cache_groups: Nat
-  deepselect: V41ImageExtensionStanding
-}
-
-fn v41_missing_if<T>(v: T?, name: String) -> List<String> {
-  match v {
-    Present { value: _ } => [] as List<String>
-    Absent => [name]
-  }
-}
-
-fn v41_rank_reading_missing(r: V41RankStartupReading) -> List<String> {
-  concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(
-    v41_missing_if(v: r.image, name: "image digest"),
-    v41_missing_if(v: r.vllm_revision, name: "vLLM commit")),
-    v41_missing_if(v: r.parallelism, name: "TP/DCP/PP/DP")),
-    match r.kv_format { ResolvedFp8DsMla => [] as List<String>  ResolvedUnobserved => ["resolved kv dtype"] }),
-    v41_missing_if(v: r.block_size, name: "resolved block size")),
-    v41_missing_if(v: r.max_model_len, name: "max_model_len")),
-    v41_missing_if(v: r.max_num_seqs, name: "max_num_seqs")),
-    v41_missing_if(v: r.max_num_batched_tokens, name: "max_num_batched_tokens")),
-    v41_missing_if(v: r.spec_decode_config, name: "spec-decode config")),
-    v41_missing_if(v: r.memory, name: "memory breakdown (free/total, weights, non-torch, activation peak, CUDA graphs, available KV)")),
-    v41_missing_if(v: r.reported, name: "GPU KV cache size tokens and max concurrency")),
-    v41_missing_if(v: r.num_gpu_blocks, name: "num_gpu_blocks")),
-    v41_missing_if(v: r.kv_cache_groups, name: "KV cache groups")),
-    match r.deepselect { ExtensionUnobserved => ["DeepSelect extension import (vllm._deepselect_C)"]  ExtensionLoaded => [] as List<String>  ExtensionImportFailed { logged: _ } => [] as List<String> })
-}
-
-type V41RankStartupAdmission
-  = RankStartupAdmitted { receipt: V41RankStartupReceipt }
-  | RankStartupRefused { rank: Nat, missing: List<String> }
-
-fn v41_admit_rank_startup(r: V41RankStartupReading) -> V41RankStartupAdmission {
-  match r.image { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: image } => match r.vllm_revision { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: rev } => match r.parallelism { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: par } => match r.block_size { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: block } => match r.max_model_len { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: mml } => match r.max_num_seqs { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: seqs } => match r.max_num_batched_tokens { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: batched } => match r.spec_decode_config { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: spec } => match r.memory { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: mem } => match r.reported { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: rep } => match r.num_gpu_blocks { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: blocks } => match r.kv_cache_groups { Absent => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-  Present { value: groups } => match r.deepselect {
-    ExtensionUnobserved => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-    ExtensionLoaded => v41_admit_rank_resolved(r: r, image: image, rev: rev, par: par, block: block, mml: mml, seqs: seqs, batched: batched, spec: spec, mem: mem, rep: rep, blocks: blocks, groups: groups)
-    ExtensionImportFailed { logged: _ } => v41_admit_rank_resolved(r: r, image: image, rev: rev, par: par, block: block, mml: mml, seqs: seqs, batched: batched, spec: spec, mem: mem, rep: rep, blocks: blocks, groups: groups)
-  } } } } } } } } } } } } }
-}
-
-fn v41_admit_rank_resolved(
-  r: V41RankStartupReading, image: V41OciImageDigest, rev: VllmSourceRevision, par: V41RankParallelism,
-  block: Nat, mml: TokenCount, seqs: Nat, batched: Nat, spec: NonEmptyStr, mem: V41RankMemoryBreakdown,
-  rep: VllmReportedCapacity, blocks: Nat, groups: Nat,
-) -> V41RankStartupAdmission {
-  match r.kv_format {
-    ResolvedUnobserved => RankStartupRefused { rank: r.rank, missing: v41_rank_reading_missing(r: r) }
-    ResolvedFp8DsMla => RankStartupAdmitted { receipt: V41RankStartupReceipt {
-      run_id: r.run_id, rank: r.rank, host: r.host, image: image, vllm_revision: rev,
-      parallelism: par, block_size: block, max_model_len: mml, max_num_seqs: seqs,
-      max_num_batched_tokens: batched, spec_decode_config: spec, memory: mem, reported: rep,
-      num_gpu_blocks: blocks, kv_cache_groups: groups, deepselect: r.deepselect,
-    } }
-  }
-}
-
-// EFFECTIVE BYTES PER TOKEN IS AVAILABLE KV BYTES OVER THE ENGINE'S OWN TOKEN FIGURE. Blocks times
-// block size is not a substitute: under MLA with the DeepSeek fp8 layout it is a different quantity
-// (extdeps.vllm.kv_cache records that reconstruction as a refusal subject).
-fn v41_rank_bytes_per_token(r: V41RankStartupReceipt) -> ByteSize? {
-  let tokens = token_count_value(t: r.reported.pool.tokens)
-  if tokens == 0 { none } else { Present { value: byte_size(count: byte_size_count(b: r.memory.available_kv) / tokens) } }
-}
-
-type V41StartupReceipt sole_constructor {
-  run_id: NonEmptyStr
-  ranks: List<V41RankStartupReceipt>
-  min_rank: V41RankStartupReceipt
-}
-
-type V41StartupAdmission
-  = StartupAdmitted { receipt: V41StartupReceipt }
-  | StartupRefused { causes: List<String> }
-
-fn v41_image_wire(i: V41OciImageDigest) -> String {
-  join([render_oci_content_digest_wire(d: i.manifest) as String, "/", render_oci_content_digest_wire(d: i.config) as String], "")
-}
-
-// The min rank is the one with the fewest GPU KV cache tokens: that pool bounds the replica.
-fn v41_min_rank(first: V41RankStartupReceipt, rest: List<V41RankStartupReceipt>) -> V41RankStartupReceipt {
-  fold(rest, init: first, f: (acc, r) =>
-    if token_count_value(t: r.reported.pool.tokens) < token_count_value(t: acc.reported.pool.tokens) { r } else { acc })
-}
-
-fn v41_admit_startup(readings: List<V41RankStartupReading>) -> V41StartupAdmission {
-  let admissions = map(readings, r => v41_admit_rank_startup(r: r))
-  let refusals = flat_map(admissions, a => match a {
-    RankStartupAdmitted { receipt: _ } => [] as List<String>
-    RankStartupRefused { rank: k, missing: m } => [join(["rank ", to_string(k), " missing: ", join(m, ", ")], "")]
-  })
-  let receipts = flat_map(admissions, a => match a {
-    RankStartupAdmitted { receipt: x } => [x]
-    RankStartupRefused { rank: _, missing: _ } => [] as List<V41RankStartupReceipt>
-  })
-  let absent_ranks = flat_map(v41_measurement_ranks, k =>
-    if length(filter(readings, r => r.rank == k)) == 0 { [join(["rank ", to_string(k), " has no reading"], "")] } else { [] as List<String> })
-  let duplicate_ranks = flat_map(v41_measurement_ranks, k =>
-    if length(filter(readings, r => r.rank == k)) > 1 { [join(["rank ", to_string(k), " has more than one reading"], "")] } else { [] as List<String> })
-  let foreign_ranks = flat_map(readings, r =>
-    if r.rank >= v41_measurement_rank_count { [join(["rank ", to_string(r.rank), " is outside TP4"], "")] } else { [] as List<String> })
-  let shape = concat(concat(concat(refusals, absent_ranks), duplicate_ranks), foreign_ranks)
-  if length(shape) != 0 {
-    StartupRefused { causes: shape }
-  } else {
-    match list_at_optional(xs: receipts, index: 0) {
-      Absent => StartupRefused { causes: ["no rank reading was supplied"] }
-      Present { value: first } => {
-        let disagreements = flat_map(receipts, r => concat(concat(
-          if r.run_id != first.run_id { [join(["rank ", to_string(r.rank), " is from another run"], "")] } else { [] as List<String> },
-          if v41_image_wire(i: r.image) != v41_image_wire(i: first.image) { [join(["rank ", to_string(r.rank), " ran another image"], "")] } else { [] as List<String> }),
-          if !observed_revisions_agree(a: r.vllm_revision, b: first.vllm_revision) { [join(["rank ", to_string(r.rank), " ran another vLLM commit"], "")] } else { [] as List<String> }))
-        if length(disagreements) != 0 {
-          StartupRefused { causes: disagreements }
-        } else {
-          StartupAdmitted { receipt: V41StartupReceipt {
-            run_id: first.run_id,
-            ranks: receipts,
-            min_rank: v41_min_rank(first: first, rest: receipts),
-          } }
-        }
-      }
-    }
-  }
-}
-
-fn v41_min_rank_bytes_per_token(s: V41StartupAdmission) -> ByteSize? {
-  match s {
-    StartupAdmitted { receipt: r } => v41_rank_bytes_per_token(r: r.min_rank)
-    StartupRefused { causes: _ } => none
-  }
-}
-
-// THE TOKEN THRESHOLDS ARE CONCURRENCY TIMES THE CONTEXT CAP, not three authored numbers: x6 at 262k
-// is 1,572,864 tokens and x16 is 4,194,304. The production x16 row adds a headroom margin, which is
-// operator policy (V41CapacityPolicy.production_pool_margin) and not derived here.
-fn v41_pool_tokens_needed(concurrency: Nat) -> Nat {
-  concurrency * token_count_value(t: v41_measurement_max_model_len)
-}
-
-// ── MEASUREMENT 2: THE ENGRAM RESIDENCY TIMELINE ────────────────────────────────────────────────
-type V41ResidencyPhase = BeforeStart | AfterChecksum | AfterKvAllocation | AfterRequests
-
-data v41_residency_phases: List<V41ResidencyPhase> = [BeforeStart, AfterChecksum, AfterKvAllocation, AfterRequests]
-
-fn v41_phase_wire(p: V41ResidencyPhase) -> String {
-  match p {
-    BeforeStart => "before-start"
-    AfterChecksum => "after-checksum"
-    AfterKvAllocation => "after-kv-allocation"
-    AfterRequests => "after-requests"
-  }
-}
-
-type V41TorchMemory { free: ByteSize, reserved: ByteSize, allocated: ByteSize }
-
-// ONE CELL: one rank at one phase under one image arm. mincore residency is RESIDENCY, never touches.
-type V41ResidencyCell {
-  run_id: NonEmptyStr
-  arm: V41EngramStartupArm
-  phase: V41ResidencyPhase
-  rank: Nat
-  engram_files: List<MincoreFileResidency>
-  memory_current: ByteSize
-  memory_stat: CgroupMemoryStat
-  memory_events: CgroupMemoryEvents
-  memory_pressure: PsiReading
-  io_pressure: PsiReading
-  nvme: DiskstatsReading
-  torch: V41TorchMemory?
-}
-
-type V41ResidencyTimeline
-  = ResidencyTimelineAdmitted { run_id: NonEmptyStr, arm: V41EngramStartupArm, cells: List<V41ResidencyCell> }
-  | ResidencyTimelineRefused { causes: List<String> }
-
-// BeforeStart has no process, so it has no torch reading; every later phase owes one.
-fn v41_cell_owes_torch(p: V41ResidencyPhase) -> Bool {
-  match p {
-    BeforeStart => false
-    AfterChecksum => true
-    AfterKvAllocation => true
-    AfterRequests => true
-  }
-}
-
-// THE TIMELINE IS AN IDENTITY JOIN over (phase x rank). A missing cell is named, a duplicate is
-// named, and a count that happens to match is not accepted in place of the join.
-fn v41_admit_residency_timeline(run_id: NonEmptyStr, arm: V41EngramStartupArm, cells: List<V41ResidencyCell>) -> V41ResidencyTimeline {
-  let owed = flat_map(v41_residency_phases, p => map(v41_measurement_ranks, k => V41ResidencyKey { phase: p, rank: k }))
-  let join_causes = flat_map(owed, key => {
-    let matching = filter(cells, c => v41_phase_wire(p: c.phase) == v41_phase_wire(p: key.phase) && c.rank == key.rank)
-    if length(matching) == 0 {
-      [join(["no cell for ", v41_phase_wire(p: key.phase), " rank ", to_string(key.rank)], "")]
-    } else if length(matching) > 1 {
-      [join(["more than one cell for ", v41_phase_wire(p: key.phase), " rank ", to_string(key.rank)], "")]
-    } else { [] as List<String> }
-  })
-  let cell_causes = flat_map(cells, c => concat(concat(concat(
-    if c.run_id != run_id { [join(["a ", v41_phase_wire(p: c.phase), " cell is from another run"], "")] } else { [] as List<String> },
-    if v41_arm_wire(a: c.arm) != v41_arm_wire(a: arm) { [join(["a ", v41_phase_wire(p: c.phase), " cell is from the other image arm"], "")] } else { [] as List<String> }),
-    if c.rank >= v41_measurement_rank_count { [join(["a cell names rank ", to_string(c.rank), ", outside TP4"], "")] } else { [] as List<String> }),
-    if v41_cell_owes_torch(p: c.phase) && v41_torch_absent(t: c.torch) { [join(["no torch memory reading at ", v41_phase_wire(p: c.phase), " rank ", to_string(c.rank)], "")] } else { [] as List<String> }))
-  let causes = concat(join_causes, cell_causes)
-  if length(causes) != 0 { ResidencyTimelineRefused { causes: causes } } else { ResidencyTimelineAdmitted { run_id: run_id, arm: arm, cells: cells } }
-}
-
-type V41ResidencyKey { phase: V41ResidencyPhase, rank: Nat }
-
-fn v41_torch_absent(t: V41TorchMemory?) -> Bool {
-  match t {
-    Present { value: _ } => false
-    Absent => true
-  }
-}
-
-fn v41_cell_engram_resident_bytes(c: V41ResidencyCell) -> ByteSize {
-  byte_size(count: fold(c.engram_files, init: 0, f: (acc, f) => acc + byte_size_count(b: mincore_resident_bytes(r: f))))
-}
-
-// ── MEASUREMENT 3: THE COLD/WARM ENGRAM PROBE AND THE STAIRCASE ────────────────────────────────
-//
-// DISTINCT TOUCHES ARE NOT RESIDENCY. The per-rank distinct-page counter and the fetch_rows timing
-// have to come from inside the fetch_rows path. That path is being rewritten by the Engram
-// page-release lane, and the counter is a follow-up lane dispatched once that change lands (ruling,
-// proud-deer-538, 2026-09-25). Until the counter exists, every touch reading is
-// TouchCounterUnavailable, and the Engram-resident capacity refuses on it. mincore residency is
-// still recorded, as its own reading.
-type V41EngramLookupObservable
-  = TouchCounterUnavailable { frontier: DissolutionCondition }
-  | EngramLookupObserved { distinct_pages_touched: Nat, fetch_rows_calls: Nat, fetch_rows_time: Microsecond }
-
-data v41_touch_counter_frontier: DissolutionCondition = unbound_dissolution(description: "TRIGGER: the follow-up lane after the Engram page-release / batched fetch_rows change exposes, per rank, a distinct-page count (bitmap or sketch, no row contents) and fetch_rows call count and time, readable at an epoch boundary. SUFFICIENT FOR: each probe cell carries EngramLookupObserved, and the Engram-resident capacity is computed from touches rather than refused." as NonEmptyStr)
-
-type V41ProbeTemperature = ProbeCold | ProbeWarm
-
-type V41ProbeRankReading {
-  rank: Nat
-  lookup: V41EngramLookupObservable
-  residency_before: List<MincoreFileResidency>
-  residency_after: List<MincoreFileResidency>
-  stat_before: CgroupMemoryStat
-  stat_after: CgroupMemoryStat
-  nvme_before: DiskstatsReading
-  nvme_after: DiskstatsReading
-}
-
-type V41ProbeReading {
-  run_id: NonEmptyStr
-  cell: V41ProbeCell
-  temperature: V41ProbeTemperature
-  prompts_disjoint: Bool
-  prefix_caching_defeated: Bool
-  latency: ClientBenchLatency
-  ranks: List<V41ProbeRankReading>
-}
-
-// A WARM PASS WITH NO MAJOR FAULTS ON ANY RANK means the cell's Engram working set was resident. A
-// cold pass is the contrast, not the criterion.
-type V41ProbeVerdict
-  = ProbeWorkingSetResident { cell: V41ProbeCell }
-  | ProbeWorkingSetFaulted { cell: V41ProbeCell, major_faults: Nat }
-  | ProbeRefused { cell: V41ProbeCell, causes: List<String> }
-
-fn v41_probe_rank_major_faults(r: V41ProbeRankReading) -> Nat? {
-  if r.stat_after.pgmajfault < r.stat_before.pgmajfault { none } else { Present { value: r.stat_after.pgmajfault - r.stat_before.pgmajfault } }
-}
-
-fn v41_judge_probe(p: V41ProbeReading) -> V41ProbeVerdict {
-  let causes = concat(concat(concat(concat(
-    if !p.prompts_disjoint { ["prompts were not disjoint"] } else { [] as List<String> },
-    if !p.prefix_caching_defeated { ["prefix caching was not defeated"] } else { [] as List<String> }),
-    match p.temperature { ProbeWarm => [] as List<String>  ProbeCold => ["a cold pass is the contrast; the verdict is read on the warm pass"] }),
-    flat_map(v41_measurement_ranks, k => if length(filter(p.ranks, r => r.rank == k)) == 1 { [] as List<String> } else { [join(["rank ", to_string(k), " has no single probe reading"], "")] })),
-    flat_map(p.ranks, r => match r.lookup {
-      TouchCounterUnavailable { frontier: _ } => [join(["rank ", to_string(r.rank), ": the distinct-touch counter is unavailable"], "")]
-      EngramLookupObserved { distinct_pages_touched: _, fetch_rows_calls: _, fetch_rows_time: _ } => [] as List<String>
-    }))
-  if length(causes) != 0 {
-    ProbeRefused { cell: p.cell, causes: causes }
-  } else {
-    let faults = map(p.ranks, r => v41_probe_rank_major_faults(r: r))
-    if length(filter(faults, f => match f { Present { value: _ } => false  Absent => true })) != 0 {
-      ProbeRefused { cell: p.cell, causes: ["a pgmajfault counter went backwards between readings"] }
-    } else {
-      let total = fold(faults, init: 0, f: (acc, f) => match f { Present { value: n } => acc + n  Absent => acc })
-      if total == 0 { ProbeWorkingSetResident { cell: p.cell } } else { ProbeWorkingSetFaulted { cell: p.cell, major_faults: total } }
-    }
-  }
-}
-
-// ── THE STAIRCASE AND ITS STOP RULES ────────────────────────────────────────────────────────────
-//
-// THE THRESHOLDS ARE OPERATOR POLICY. No SLO or sustained-window threshold exists in the corpus: TTFT
-// is only a selection axis, and the load probe measures TTFT and TPOT without bounds. So the policy
-// row is carried with its standing. While it is Proposed, the staircase refuses; it does not run
-// against a proposal (ruling, proud-deer-538, 2026-09-25).
-//
-// TTFT IS A STOP ONLY WHERE A PREFILL IS SHORT ENOUGH FOR IT TO MEAN SERVICE. A ceiling that holds at
-// 32k would stop a 262k staircase at x1 on prefill time alone and hide the KV and Engram limits the
-// staircase exists to find. So the gate names the largest context it applies to: at or below it, a
-// TTFT above the ceiling stops the step; above it, TTFT is recorded in the step's latency reading and
-// the stop is decided by preemption, refault growth, PSI, NVMe latency and TPOT.
-type V41TtftGate { context: TokenCount, ceiling: Millisecond }
-
-fn v41_ttft_gates_staircase(g: V41TtftGate) -> Bool {
-  token_count_value(t: v41_measurement_max_model_len) <= token_count_value(t: g.context)
-}
-
-type V41CapacityPolicy {
-  ttft_gate: V41TtftGate
-  tpot_ceiling: Millisecond
-  psi_full_ceiling: BasisPoint
-  psi_window: Microsecond
-  nvme_read_await_ceiling: Microsecond
-  refault_growth_ceiling: BasisPoint
-  production_pool_margin: BasisPoint
-}
-
-type V41PolicyStanding
-  = PolicyProposed { proposal: V41CapacityPolicy, reasons: NonEmptyStr }
-  | PolicyOperatorSigned { policy: V41CapacityPolicy, ruling: NonEmptyStr }
-
-data v41_capacity_policy: V41PolicyStanding = PolicyOperatorSigned {
-  policy: V41CapacityPolicy {
-    ttft_gate: V41TtftGate { context: token_count(count: 32768), ceiling: millisecond(count: 30000) },
-    tpot_ceiling: millisecond(count: 100),
-    psi_full_ceiling: basis_point(count: 1000),
-    psi_window: microsecond(count: 60000000),
-    nvme_read_await_ceiling: microsecond(count: 5000),
-    refault_growth_ceiling: basis_point(count: 15000),
-    production_pool_margin: basis_point(count: 1000),
-  },
-  ruling: "operator, 2026-09-26, direct reply to proud-deer-538: 'you can take your recs - staircase thresholds are fine'. Values as proposed by clever-gull-48 (TPOT 100 ms; PSI memory full above 10% over 60 s; NVMe read await 5 ms; refault growth above 1.5x per concurrency unit between adjacent steps; 10% production pool margin), with TTFT scaled by context per proud-deer-538's recommendation: the 30 s ceiling gates contexts up to 32k, and at 262k TTFT is recorded and does not stop the staircase." as NonEmptyStr,
-}
-
-type V41StaircaseStepReading {
-  run_id: NonEmptyStr
-  concurrency: Nat
-  preemptions: Nat?
-  refault_file_before: Nat
-  refault_file_after: Nat
-  memory_pressure_before: PsiReading
-  memory_pressure_after: PsiReading
-  nvme_before: DiskstatsReading
-  nvme_after: DiskstatsReading
-  latency: ClientBenchLatency
-}
-
-type V41StaircaseStop
-  = StopKvPreemption { concurrency: Nat, preemptions: Nat }
-  | StopSuperlinearRefault { concurrency: Nat, per_request: Nat, previous_per_request: Nat }
-  | StopPsiFullSustained { concurrency: Nat, stalled: Microsecond, window: Microsecond }
-  | StopNvmeLatency { concurrency: Nat, mean_read_await: Microsecond }
-  | StopSloBreach { concurrency: Nat, which: NonEmptyStr, observed: Millisecond }
-  | StopReadingMissing { concurrency: Nat, cause: NonEmptyStr }
-
-// THE UNSIGNED-POLICY REFUSAL IS V4.1'S OWN ARM. std.staircase has no policy gate by design (the
-// thresholds' sign-off is this module's V41PolicyStanding), so the gate is applied here, before the
-// generic staircase runs, and its refusal is a V4.1 fact beside the generic outcome rather than in it.
-type V41StaircaseRun
-  = V41StaircasePolicyUnsigned { cause: NonEmptyStr }
-  | V41StaircaseRan { outcome: StaircaseOutcome<Nat, V41StaircaseStop> }
-
-fn v41_step_stop(policy: V41CapacityPolicy, step: V41StaircaseStepReading, previous_per_request: Nat?) -> V41StaircaseStop? {
-  let c = step.concurrency
-  match step.preemptions {
-    Absent => Present { value: StopReadingMissing { concurrency: c, cause: "the preemption counter was not read" as NonEmptyStr } }
-    Present { value: pre } =>
-      if pre > 0 { Present { value: StopKvPreemption { concurrency: c, preemptions: pre } } }
-      else if step.refault_file_after < step.refault_file_before {
-        Present { value: StopReadingMissing { concurrency: c, cause: "workingset_refault_file went backwards" as NonEmptyStr } }
-      } else {
-        let per_request = (step.refault_file_after - step.refault_file_before) / c
-        let superlinear = match previous_per_request {
-          Absent => false
-          Present { value: prev } => prev > 0 && per_request * 10000 > prev * basis_point_count(bp: policy.refault_growth_ceiling)
-        }
-        if superlinear {
-          Present { value: StopSuperlinearRefault { concurrency: c, per_request: per_request, previous_per_request: match previous_per_request { Present { value: p } => p  Absent => 0 } } }
-        } else {
-          match psi_full_stall_interval(before: step.memory_pressure_before, after: step.memory_pressure_after, window: policy.psi_window) {
-            PsiStallUnmeasurable { cause: why } => Present { value: StopReadingMissing { concurrency: c, cause: why } }
-            PsiStallMeasured { stalled: s, window: w } =>
-              if microsecond_count(m: s) * 10000 > microsecond_count(m: w) * basis_point_count(bp: policy.psi_full_ceiling) {
-                Present { value: StopPsiFullSustained { concurrency: c, stalled: s, window: w } }
-              } else {
-                match disk_read_interval(before: step.nvme_before, after: step.nvme_after) {
-                  DiskReadUnmeasurable { cause: why } => Present { value: StopReadingMissing { concurrency: c, cause: why } }
-                  DiskReadMeasured { read_bytes: _, reads: _, mean_read_await: aw } =>
-                    match aw {
-                      Present { value: a } =>
-                        if microsecond_count(m: a) > microsecond_count(m: policy.nvme_read_await_ceiling) {
-                          Present { value: StopNvmeLatency { concurrency: c, mean_read_await: a } }
-                        } else { v41_slo_stop(policy: policy, c: c, latency: step.latency) }
-                      Absent => v41_slo_stop(policy: policy, c: c, latency: step.latency)
-                    }
-                }
-              }
-          }
-        }
-      }
-  }
-}
-
-fn v41_slo_stop(policy: V41CapacityPolicy, c: Nat, latency: ClientBenchLatency) -> V41StaircaseStop? {
-  match latency {
-    ClientBenchLatencyUnread { cause: why } => Present { value: StopReadingMissing { concurrency: c, cause: why } }
-    ClientBenchLatencyReported { output_throughput: _, tpot_milli: tpot, itl_milli: _, ttft_milli: ttft, window: _ } =>
-      if v41_ttft_gates_staircase(g: policy.ttft_gate) && millisecond_count(m: ttft) > millisecond_count(m: policy.ttft_gate.ceiling) {
-        Present { value: StopSloBreach { concurrency: c, which: "ttft" as NonEmptyStr, observed: ttft } }
-      } else if millisecond_count(m: tpot) > millisecond_count(m: policy.tpot_ceiling) {
-        Present { value: StopSloBreach { concurrency: c, which: "tpot" as NonEmptyStr, observed: tpot } }
-      } else { none }
-  }
-}
-
-// THE STAIRCASE RUNS IN PLAN ORDER AND STOPS AT THE FIRST STOP RULE, through std.staircase
-// run_staircase: a step reading missing or duplicated at a planned concurrency is a StopReadingMissing,
-// never a skipped step, so nothing is claimed above a hole. Readings are joined to this run BEFORE the
-// staircase sees them, so a reading from another run is a hole here, never data. The accumulator is the
-// previous step's per-request refault, which the superlinear-refault rule compares against.
-type V41StairCarry { previous_per_request: Nat? }
-
-fn v41_step_verdict(p: V41CapacityPolicy, carry: V41StairCarry, step: V41StaircaseStepReading) -> StepVerdict<V41StaircaseStop, V41StairCarry> {
-  match v41_step_stop(policy: p, step: step, previous_per_request: carry.previous_per_request) {
-    Present { value: stop } => StepStops { stop: stop }
-    Absent => StepContinues { acc: V41StairCarry { previous_per_request: Present { value: (step.refault_file_after - step.refault_file_before) / step.concurrency } } }
-  }
-}
-
-fn v41_run_staircase(policy: V41PolicyStanding, run_id: NonEmptyStr, steps: List<V41StaircaseStepReading>) -> V41StaircaseRun {
-  match policy {
-    PolicyProposed { proposal: _, reasons: _ } =>
-      V41StaircasePolicyUnsigned { cause: "the staircase thresholds are an unsigned proposal; operator sign-off is required before any stop rule is applied" as NonEmptyStr }
-    PolicyOperatorSigned { policy: p, ruling: _ } =>
-      V41StaircaseRan {
-        outcome: run_staircase(
-          plan: v41_staircase_concurrencies,
-          readings: filter(steps, s => s.run_id == run_id),
-          level_key: c => to_string(c),
-          reading_level: s => s.concurrency,
-          init: V41StairCarry { previous_per_request: none },
-          stop_of: (carry, c, step) => v41_step_verdict(p: p, carry: carry, step: step),
-          missing: (c, cause) => StopReadingMissing { concurrency: c, cause: cause },
-        ),
-      }
-  }
-}
-
-// ── THE THREE CAPACITIES, REPORTED SEPARATELY ──────────────────────────────────────────────────
-type V41Capacity
-  = CapacityAt { concurrency: Nat }
-  | CapacityBelowFirstStep
-  | CapacityRefused { cause: NonEmptyStr }
-
-type V41CapacityReport {
-  run_id: NonEmptyStr
-  kv_admission: V41Capacity
-  engram_resident: V41Capacity
-  sla_sustainable: V41Capacity
-  indexer_kernel: V41ImageExtensionStanding
-}
-
-// WHICH INDEXER TOP-K KERNEL THE CAPACITIES WERE MEASURED ON. A report's SLA and TTFT figures belong to
-// the kernel the ranks ran, so the report carries it: if any rank's DeepSelect import failed, the
-// report says so with that rank's logged line. A refused startup receipt leaves it unobserved.
-fn v41_report_indexer_kernel(s: V41StartupAdmission) -> V41ImageExtensionStanding {
-  match s {
-    StartupRefused { causes: _ } => ExtensionUnobserved
-    StartupAdmitted { receipt: r } => {
-      let failed = flat_map(r.ranks, k => match k.deepselect {
-        ExtensionImportFailed { logged: l } => [l]
-        ExtensionLoaded => [] as List<NonEmptyStr>
-        ExtensionUnobserved => [] as List<NonEmptyStr>
-      })
-      match list_at_optional(xs: failed, index: 0) {
-        Present { value: l } => ExtensionImportFailed { logged: l }
-        Absent => ExtensionLoaded
-      }
-    }
-  }
-}
-
-// KV ADMISSION: the largest planned concurrency whose max_model_len requests fit the MIN rank's pool.
-fn v41_kv_admission_capacity(s: V41StartupAdmission) -> V41Capacity {
-  match s {
-    StartupRefused { causes: cs } => CapacityRefused { cause: join(["the startup receipt refused: ", join(cs, "; ")], "") as NonEmptyStr }
-    StartupAdmitted { receipt: r } => {
-      let pool = token_count_value(t: r.min_rank.reported.pool.tokens)
-      let fits = filter(v41_staircase_concurrencies, c => v41_pool_tokens_needed(concurrency: c) <= pool)
-      match list_at_optional(xs: reverse(fits), index: 0) {
-        Present { value: c } => CapacityAt { concurrency: c }
-        Absent => CapacityBelowFirstStep
-      }
-    }
-  }
-}
-
-// ENGRAM RESIDENT: the largest 262k probe concurrency whose warm pass faulted nothing, over a prefix
-// of the probe plan with no hole. It refuses on any refused probe, which today means on the absent
-// touch counter.
-fn v41_engram_resident_capacity(verdicts: List<V41ProbeVerdict>) -> V41Capacity {
-  let refused = flat_map(verdicts, v => match v {
-    ProbeRefused { cell: c, causes: cs } => [join(["probe ", to_string(token_count_value(t: c.context)), " x", to_string(c.concurrency), ": ", join(cs, "; ")], "")]
-    ProbeWorkingSetResident { cell: _ } => [] as List<String>
-    ProbeWorkingSetFaulted { cell: _, major_faults: _ } => [] as List<String>
-  })
-  let missing = flat_map(v41_probe_cells, cell =>
-    if length(filter(verdicts, v => v41_probe_verdict_cell_is(v: v, cell: cell))) == 1 { [] as List<String> } else { [join(["probe ", to_string(token_count_value(t: cell.context)), " x", to_string(cell.concurrency), " has no single verdict"], "")] })
-  let causes = concat(refused, missing)
-  if length(causes) != 0 {
-    CapacityRefused { cause: join(causes, "; ") as NonEmptyStr }
-  } else {
-    let long = filter(v41_probe_cells, cell => token_count_value(t: cell.context) == token_count_value(t: v41_measurement_max_model_len))
-    let scan = fold(long, init: V41ResidentScan { broken: false, best: none }, f: (acc, cell) =>
-      if acc.broken { acc } else {
-        if length(filter(verdicts, v => match v { ProbeWorkingSetResident { cell: x } => v41_same_cell(a: x, b: cell)  ProbeWorkingSetFaulted { cell: _, major_faults: _ } => false  ProbeRefused { cell: _, causes: _ } => false })) == 1 {
-          V41ResidentScan { broken: false, best: Present { value: cell.concurrency } }
-        } else { V41ResidentScan { broken: true, best: acc.best } }
-      })
-    match scan.best {
-      Present { value: c } => CapacityAt { concurrency: c }
-      Absent => CapacityBelowFirstStep
-    }
-  }
-}
-
-type V41ResidentScan { broken: Bool, best: Nat? }
-
-fn v41_same_cell(a: V41ProbeCell, b: V41ProbeCell) -> Bool {
-  token_count_value(t: a.context) == token_count_value(t: b.context) && a.concurrency == b.concurrency
-}
-
-fn v41_probe_verdict_cell_is(v: V41ProbeVerdict, cell: V41ProbeCell) -> Bool {
-  match v {
-    ProbeWorkingSetResident { cell: c } => v41_same_cell(a: c, b: cell)
-    ProbeWorkingSetFaulted { cell: c, major_faults: _ } => v41_same_cell(a: c, b: cell)
-    ProbeRefused { cell: c, causes: _ } => v41_same_cell(a: c, b: cell)
-  }
-}
-
-// SLA SUSTAINABLE: the last staircase step before the first stop.
-fn v41_sla_capacity(o: V41StaircaseRun) -> V41Capacity {
-  match o {
-    V41StaircasePolicyUnsigned { cause: c } => CapacityRefused { cause: c }
-    V41StaircaseRan { outcome: r } => match r {
-      StaircaseRefused { refusal: StaircasePlanEmpty } => CapacityRefused { cause: "the staircase plan is empty" as NonEmptyStr }
-      StaircaseRefused { refusal: StaircasePlanLevelDuplicated { level: c } } => CapacityRefused { cause: join(["the staircase plan names x", to_string(c), " twice"], "") as NonEmptyStr }
-      StaircaseCompleted { last_sustained: l } => CapacityAt { concurrency: l }
-      StaircaseStopped { last_sustained: l, stop: s } => match s {
-        StopReadingMissing { concurrency: c, cause: why } => CapacityRefused { cause: join(["a reading is missing at x", to_string(c), ": ", why as String], "") as NonEmptyStr }
-        StopKvPreemption { concurrency: _, preemptions: _ } => v41_last_or_below(l: l)
-        StopSuperlinearRefault { concurrency: _, per_request: _, previous_per_request: _ } => v41_last_or_below(l: l)
-        StopPsiFullSustained { concurrency: _, stalled: _, window: _ } => v41_last_or_below(l: l)
-        StopNvmeLatency { concurrency: _, mean_read_await: _ } => v41_last_or_below(l: l)
-        StopSloBreach { concurrency: _, which: _, observed: _ } => v41_last_or_below(l: l)
-      }
-    }
-  }
-}
-
-fn v41_last_or_below(l: Nat?) -> V41Capacity {
-  match l {
-    Present { value: c } => CapacityAt { concurrency: c }
-    Absent => CapacityBelowFirstStep
-  }
-}
-
-fn v41_capacity_report(
-  run_id: NonEmptyStr,
-  startup: V41StartupAdmission,
-  probes: List<V41ProbeReading>,
-  staircase: V41StaircaseRun,
-) -> V41CapacityReport {
-  V41CapacityReport {
-    run_id: run_id,
-    kv_admission: v41_kv_admission_capacity(s: startup),
-    engram_resident: v41_engram_resident_capacity(verdicts: map(probes, p => v41_judge_probe(p: p))),
-    sla_sustainable: v41_sla_capacity(o: staircase),
-    indexer_kernel: v41_report_indexer_kernel(s: startup),
-  }
-}
-
-fn v41_capacity_wire(c: V41Capacity) -> String {
-  match c {
-    CapacityAt { concurrency: n } => join(["x", to_string(n)], "")
-    CapacityBelowFirstStep => "below-x1"
-    CapacityRefused { cause: why } => join(["refused: ", why as String], "")
-  }
-}
-
-// ── THE REPORT IS V4.1'S WORKLOAD CALIBRATION, NOT ITS OWN PRODUCTION GATE ────────────────────
-//
-// V4.1's production admission was a fold of its own here (v41_serving_admission), consumed by nothing
-// but its witnesses, and it asked no quality question and bound its report to no subject. It is
-// deleted (deforking cut 5): production admission for every model is gunbc.spark.serving_promotion
-// serving_promotion_standing, and this report enters it as the shared WorkloadCalibrationReceipt.
-// The projection keeps the old fold's law -- all three capacities must be CapacityAt, and the
-// sustained concurrency is their MINIMUM -- and states what the report does not observe: accepted
-// turns and their observation window, preemptions, restarts and OOM events are absent, so the promotion fold names them
-// missing rather than reading the report as a clean run. The measurement serve itself is not gated on
-// the report (that would be circular); it runs as a bounded experiment. Its route into a launch's
-// promotion receipts is a declared frontier, not yet a call: gunbc.spark.serving_promotion
-// serving_promotion_calibration_producer_frontier names the trigger.
-fn v41_capacity_at(c: V41Capacity) -> Nat? {
-  match c {
-    CapacityAt { concurrency: n } => Present { value: n }
-    CapacityBelowFirstStep => none
-    CapacityRefused { cause: _ } => none
-  }
-}
-
-type V41CalibrationProjection
-  = V41CalibrationProjected { receipt: WorkloadCalibrationReceipt }
-  | V41CalibrationRefused { cause: NonEmptyStr }
-
-fn v41_calibration_receipt(report: V41CapacityReport, subject_key: ServingSubjectKey, trace_digest: ContentHash) -> V41CalibrationProjection {
-  match v41_capacity_at(c: report.kv_admission) {
-    Absent => V41CalibrationRefused { cause: join(["KV admission: ", v41_capacity_wire(c: report.kv_admission)], "") as NonEmptyStr }
-    Present { value: kv } => match v41_capacity_at(c: report.engram_resident) {
-      Absent => V41CalibrationRefused { cause: join(["Engram resident: ", v41_capacity_wire(c: report.engram_resident)], "") as NonEmptyStr }
-      Present { value: en } => match v41_capacity_at(c: report.sla_sustainable) {
-        Absent => V41CalibrationRefused { cause: join(["SLA sustainable: ", v41_capacity_wire(c: report.sla_sustainable)], "") as NonEmptyStr }
-        Present { value: sla } => V41CalibrationProjected { receipt: WorkloadCalibrationReceipt {
-          subject_key: subject_key,
-          trace_digest: trace_digest,
-          run_id: report.run_id,
-          accepted_turns: none,
-          observation_window: none,
-          sustained_concurrency: nat_min(a: nat_min(a: kv, b: en), b: sla),
-          realized_transport: none,
-          preemptions: none,
-          engine_restarts: none,
-          out_of_memory_events: none,
-          stalls_or_lost_requests: none,
-          evidence: join(["V4.1 capacity report, run ", report.run_id as String, ": the minimum of KV admission, Engram residency and SLA-sustainable concurrency"], "") as NonEmptyStr,
-        } }
-      }
-    }
-  }
-}
-
-// ── THE DRY RUN ────────────────────────────────────────────────────────────────────────────────
-//
-// The plan the wet runner will execute, rendered without touching a host: the startup receipt from
-// every rank, the residency timeline for each bound image arm, the probe cells, the staircase, and
-// the standing of every precondition that is not met yet. The wet runner is a fleet mode that lands
-// by the Group A fleet mode (v41_wet_runner_frontier), and it consumes this same plan.
-data v41_wet_runner_frontier: DissolutionCondition = unbound_dissolution(description: "TRIGGER: a Group A fleet mode (a gunbc.ci.ci_spec GunbcRunStepTarget) brings up the measurement serve and reads the startup log lines, cgroup files, PSI, diskstats, mincore residency, torch memory, and vLLM metrics on every rank, producing the readings this module admits, and reads each rank's Engram arm off the config digest its startup receipt carries through v41_engram_arm_of over v41_engram_arm_bindings. SUFFICIENT FOR: v41_capacity_report is computed from readings taken on srv5-8 under one run id, with each rank's arm read from its own image rather than asserted." as NonEmptyStr)
-
-fn v41_capacity_measurement_plan_text() -> String {
-  let arms = if length(v41_engram_arm_bindings) == 0 {
-    "engram arms: unbound (no image config digest bound yet)"
-  } else {
-    join(["engram arms: ", join(map(v41_engram_arm_bindings, b => v41_arm_wire(a: b.arm)), ", ")], "")
-  }
-  let policy = match v41_capacity_policy {
-    PolicyProposed { proposal: _, reasons: _ } => "staircase policy: PROPOSED, awaiting operator sign-off; the staircase refuses"
-    PolicyOperatorSigned { policy: _, ruling: r } => join(["staircase policy: signed (", r as String, ")"], "")
-  }
-  join([
-    join(["V4.1 capacity measurement: Group A TP4 x1, ", to_string(v41_measurement_rank_count), " ranks, max_model_len ", to_string(token_count_value(t: v41_measurement_max_model_len))], ""),
-    "measurement 1: startup memory receipt from every rank, judged by the min rank",
-    join(["  thresholds: x6 needs ", to_string(v41_pool_tokens_needed(concurrency: 6)), " tokens, x16 needs ", to_string(v41_pool_tokens_needed(concurrency: 16))], ""),
-    join(["measurement 2: residency timeline at ", join(map(v41_residency_phases, p => v41_phase_wire(p: p)), ", ")], ""),
-    join(["  ", arms], ""),
-    join(["measurement 3: probe cells ", join(map(v41_probe_cells, c => join([to_string(token_count_value(t: c.context)), "x", to_string(c.concurrency)], "")), ", ")], ""),
-    "  distinct touches: TouchCounterUnavailable until the follow-up counter lane lands; Engram-resident refuses",
-    join(["  staircase: ", join(map(v41_staircase_concurrencies, c => join(["x", to_string(c)], "")), " -> ")], ""),
-    join(["  ", policy], ""),
-    "production admission: refused until a capacity report is admitted; the measurement serve is admitted on its own",
-  ], "\n")
-}
diff --git a/dag/gunbc/spark/v41_checkpoint_materialize.dag b/dag/gunbc/spark/v41_checkpoint_materialize.dag
deleted file mode 100644
index 2d8cbd7a401..00000000000
--- a/dag/gunbc/spark/v41_checkpoint_materialize.dag
+++ /dev/null
@@ -1,752 +0,0 @@
-module gunbc.spark.v41_checkpoint_materialize
-
-import std.types { String, Bool, Int, List, NonEmptyStr, Secret }
-import std.nat { Nat }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import std.algebra { trim }
-import std.measure { ByteSize, byte_size, byte_size_count }
-import std.content_hash { Sha256Digest, sha256_hex_digest }
-import std.optional { Present, Absent }
-import extdeps.filesystem.filesystem_io {
-  Filesystem, FilesystemListingObservation, filesystem_listing_observation, filesystem_read_outcome, filesystem_file_observation,
-  FilesystemFileObservation, FilesystemFileAbsent, FilesystemFileRead, FilesystemFileIndeterminate, FilesystemFileObservationsDisagree, FilesystemFileSubjectRefused,
-}
-import extdeps.crypto.hash { sha256sum_argv, sha256sum_line_digest }
-import gunbc.sha256sum_byte_span { sha256sum_byte_span_argv }
-import extdeps.tools.findutils { find_regular_file_sizes_argv }
-import gunbc.host_disk_observation { host_disk_free_space_argv, host_disk_observation_of_df, HostDiskObservation, DiskObserved, DiskObservationRefused, DiskUnobserved }
-import extdeps.huggingface.hub { hub_resolve_url, hub_repo_cache_directory_name }
-import extdeps.deepseek.deepseek_v4_1_flash {
-  DeepseekV41PublishedFile,
-  deepseek_v4_1_flash_hub_repo, deepseek_v4_1_flash_revision,
-  deepseek_v4_1_flash_weight_manifest_standing, WeightManifestAdmitted, WeightManifestRefused,
-  deepseek_v4_1_flash_tokenizer_standing, TokenizerPopulationAdmitted, TokenizerPopulationRefused,
-  deepseek_v4_1_flash_engram_sharded_entries, deepseek_v4_1_flash_engram_shard_files,
-}
-import gunbc.artifact_acquisition {
-  AcquisitionSubject, AcquisitionSource, SourceArgv, SourceUrl, ContentDigestSha256, UpstreamRevision,
-  AcquisitionObservation, AcquisitionAbsent, AcquisitionVerified, AcquisitionDigestMismatch, AcquisitionProbeFailed,
-  AcquisitionOutcome, AcquisitionAlreadyPresent, AcquisitionFetched, AcquisitionRefused,
-  AcquisitionAttempt, AttemptTerminal, AttemptFailedKey, AttemptRejected, AttemptUnreachable,
-  VerifyMechanismFailed, PublishFailed,
-  AcquisitionHandler, acquire_artifact, acquisition_refusal_text, acquisition_succeeded,
-}
-import gunbc.spark.model_snapshot_materialize {
-  SparkMaterializeContext, SparkRemoteRun, RemoteRan, RemoteUnreachable, spark_remote_run, HostCli,
-}
-import gunbc.spark.spark_file_blob {
-  SparkFileBlobPolicy, spark_file_blob_attempt, spark_file_blob_observe, spark_file_blob_ensure_parent,
-  spark_read_file_digest, SparkFileDigestRead, SparkFileDigestUnread,
-}
-import gunbc.spark.model_snapshot_acquisition { spark_hub_cache_root, spark_local_checkpoint_repo_directory, spark_local_checkpoint_directory }
-import gunbc.spark.v41_engram_row_store {
-  V41PublishedSpan, V41PublishedSpanPlan, V41PublishedSpansPlanned, V41PublishedSpansUnplannable,
-  V41PublishedSpanDigest, v41_published_span_plan,
-}
-import gunbc.spark.v41_runtime_candidate { v41_candidate_partition }
-import extdeps.linux.cgroup_v2 { cgroup_v2_mount_point }
-import extdeps.linux.cgroup_v2_memory {
-  CgroupMemoryLevel, CgroupMemoryLevelRead, CgroupMemoryLevelWithoutFiles, CgroupMemoryLevelUnread,
-  CgroupMemoryLimitValue, CgroupMemoryLimited, CgroupMemoryUnlimited, CgroupMemoryLimitUnparseable, parse_cgroup_memory_limit,
-  CgroupHardLimitBinds, CgroupNoHardLimit, cgroup_tightest_hard_memory_limit, cgroup_v2_bounding_dirs,
-}
-import extdeps.linux.proc_self_cgroup { read_unified_cgroup_membership, CurrentCgroupObserved, MembershipMissing, MembershipAmbiguous, MembershipMalformed }
-import gunbc.spark.v41_index_engram_selection { V41IndexParse, V41IndexParsed, V41IndexParseRefused, v41_select_index_document, v41_index_engram_selector }
-import extdeps.deepseek.deepseek_v4_1_flash { deepseek_v4_1_flash_safetensors_index_path }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
-import gunbc.spark.serving_subject { PairServingUnitOn }
-import gunbc.spark.host_commitment { admit_host_held_by_subject }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fleet_known_hosts_anchor {
-  fleet_ssh_attempt_identity, materialize_fleet_known_hosts_anchor, known_hosts_materialization_receipt,
-  fleet_openssh_trust_policy_of,
-}
-import gunbc.spark.grant_privileged_operation {
-  read_bootstrap_credential, BootstrapCredentialReady, BootstrapCredentialNotMaterialized,
-}
-import gunbc.auth.materialized_secret {
-  with_materialized_ssh_key_file, MaterializedSshKeyFileBracketCompleted, MaterializedSshKeyFileBracketRefused,
-}
-import gunbc.fleet_multi_principal_probe {
-  SparkConvergeTargetSelection, SparkConvergeTargetSingle, SparkConvergeTargetAllObserveOnly,
-  SparkConvergeTargetRefused, spark_converge_target_selection,
-}
-import gunbc.spark.fabric_reach { ExecutorReachKnown, ExecutorReachUnknown, observe_executor_reach }
-
-// ── THE PUBLISHED V4.1 CHECKPOINT, MATERIALIZED ON ONE GROUP A SPARK ───────────────────────────
-//
-// WHAT THIS MODE DOES. It brings the ADMITTED population of the published DeepSeek V4.1 Flash
-// checkpoint -- the 48 weight shards, the safetensors index and the three tokenizer files, each with
-// the publisher's sha256 at the pinned revision -- into one directory on the selected Spark, and then
-// reads the sha256 of the storage-backed Engram spans out of the two Engram shards it just verified.
-// Every file is one gunbc.artifact_acquisition subject keyed ContentDigestSha256, so the four states
-// that module separates hold per file: a present file with the right digest is a noop, a present file
-// with the wrong digest REFUSES and is left in place for an operator, an absent file is fetched to a
-// staging path and published only after its digest matches, and a probe that cannot tell refuses.
-//
-// WHAT IT WRITES, AND WHAT IT DOES NOT. Bytes at rest under v41_checkpoint_directory, and nothing
-// else: no process beyond the transfer's own transient unit, no container, no seat, no serving offer,
-// no live device allocation. That is why it may run on Group A's hosts while they are committed to the
-// pair-serving subject (operator, 2026-09-17: stage onto group A; proud-deer-538 ruling 2026-09-21).
-//
-// THE ADMISSION IT TAKES AND THE STRONGER ONE IT DOES NOT. A host is admitted when the Group A pair
-// subject (PairServingUnitOn FabricGroupA) holds it, read through gunbc.spark.host_commitment
-// admit_host_held_by_subject, and any other host refuses. Concurrency is Group A's arm domain in
-// gunbc.fleet_converge_workflow, so this mode serializes with D0 and the pair-serving apply. It lands NO
-// host-effect claim: host_commitment has no claim a committed host can carry on its owner's behalf, and
-// modeling one there (a committed-host staging claim) is the stronger construction. It is not taken
-// here, by ruling; the next reader should see that it was a choice.
-//
-// IT OBSERVES, IT DOES NOT ASSUME. Nobody knows whether srv5..srv8 hold this checkpoint already. So
-// every file is digested where it would be, and a host that already holds a verified copy in its Hub
-// cache is offered to the fold as the first source (a local copy) before the network.
-
-// THE DIRECTORY IS DERIVED FROM THE REPO AND THE PIN, so a revision bump lands in a new directory rather
-// than on top of the old one.
-fn v41_checkpoint_repo_directory() -> String {
-  spark_local_checkpoint_repo_directory(repo: deepseek_v4_1_flash_hub_repo) as String
-}
-
-data v41_checkpoint_directory: NonEmptyStr = spark_local_checkpoint_directory(repo: deepseek_v4_1_flash_hub_repo, revision: deepseek_v4_1_flash_revision)
-data v41_checkpoint_staging_directory: NonEmptyStr = join([v41_checkpoint_repo_directory(), "/.gunbc-staging"], "") as NonEmptyStr
-
-// ── THE POPULATION IS THE ADMITTED ONE, NEVER THE RAW ROWS ───────────────────────────────────
-//
-// The weight manifest and the tokenizer population are admitted by extdeps.deepseek.deepseek_v4_1_flash
-// (exact shard cover reconciled against the index, role cover); a refused standing is a refused mode.
-type V41CheckpointPopulation
-  = V41CheckpointPopulationAdmitted { files: List<DeepseekV41PublishedFile> }
-  | V41CheckpointPopulationRefused { defects: List<NonEmptyStr> }
-
-fn v41_checkpoint_population() -> V41CheckpointPopulation {
-  match deepseek_v4_1_flash_weight_manifest_standing() {
-    WeightManifestRefused { defects: d } => V41CheckpointPopulationRefused { defects: map(d, x => join(["weight manifest: ", x as String], "") as NonEmptyStr) }
-    WeightManifestAdmitted { files: weights, index: index, canonical_text: _ } =>
-      match deepseek_v4_1_flash_tokenizer_standing() {
-        TokenizerPopulationRefused { defects: d } => V41CheckpointPopulationRefused { defects: map(d, x => join(["tokenizer population: ", x as String], "") as NonEmptyStr) }
-        TokenizerPopulationAdmitted { files: tokenizer, canonical_text: _ } =>
-          V41CheckpointPopulationAdmitted { files: concat(concat(weights, [index]), tokenizer) }
-      }
-  }
-}
-
-fn v41_checkpoint_bytes(files: List<DeepseekV41PublishedFile>) -> ByteSize {
-  byte_size(count: fold(files, init: 0, f: (acc, r) => acc + byte_size_count(b: r.file_bytes)))
-}
-
-// ── ONE ACQUISITION SUBJECT PER PUBLISHED FILE ─────────────────────────────────────────────────
-
-fn v41_install_path(path: NonEmptyStr) -> NonEmptyStr {
-  join([v41_checkpoint_directory as String, "/", path as String], "") as NonEmptyStr
-}
-
-// THE STAGING NAME FLATTENS THE REPO PATH, so every staged file sits in one directory and a nested
-// member (encoding/encoding.py) needs no staging tree of its own.
-fn v41_staging_path(path: NonEmptyStr) -> NonEmptyStr {
-  join([v41_checkpoint_staging_directory as String, "/", join(split(s: path as String, delimiter: "/"), "__"), ".partial"], "") as NonEmptyStr
-}
-
-fn v41_parent_directory(path: NonEmptyStr) -> NonEmptyStr {
-  let parts = split(s: path as String, delimiter: "/")
-  if length(parts) < 2 { v41_checkpoint_directory } else {
-    join([v41_checkpoint_directory as String, "/", join(map(filter(enumerate(parts), p => p.first + 1 < length(parts)), p => p.second), "/")], "") as NonEmptyStr
-  }
-}
-
-fn v41_hub_cache_copy_path(path: NonEmptyStr) -> NonEmptyStr {
-  join([
-    spark_hub_cache_root as String, "/", hub_repo_cache_directory_name(repo: deepseek_v4_1_flash_hub_repo) as String,
-    "/snapshots/", deepseek_v4_1_flash_revision as String, "/", path as String,
-  ], "") as NonEmptyStr
-}
-
-data v41_hub_cache_source_identity: NonEmptyStr = "spark-hub-cache-copy" as NonEmptyStr
-data v41_hub_resolve_source_identity: NonEmptyStr = "huggingface-resolve" as NonEmptyStr
-
-// TWO SOURCES, BOTH WRITING THE STAGING PATH. The Hub cache copy is a local copy of the same revision
-// if one is there; the resolve URL at the pinned revision is the network route. Neither is trusted:
-// the fold digests the staged bytes against the manifest row before anything is published.
-fn v41_checkpoint_sources(file: DeepseekV41PublishedFile) -> List<AcquisitionSource> {
-  [
-    AcquisitionSource {
-      identity: v41_hub_cache_source_identity,
-      locator: SourceArgv { argv: ["cp", "--reflink=auto", "--", v41_hub_cache_copy_path(path: file.path) as String, v41_staging_path(path: file.path) as String] },
-    },
-    AcquisitionSource {
-      identity: v41_hub_resolve_source_identity,
-      locator: SourceArgv { argv: [
-        "curl", "--fail", "--location", "--silent", "--show-error", "--retry", "5",
-        "--output", v41_staging_path(path: file.path) as String,
-        hub_resolve_url(repo: deepseek_v4_1_flash_hub_repo, revision: deepseek_v4_1_flash_revision, path_in_repo: file.path) as String,
-      ] },
-    },
-  ]
-}
-
-fn v41_checkpoint_subject(file: DeepseekV41PublishedFile) -> AcquisitionSubject {
-  AcquisitionSubject {
-    identity: file.path,
-    key: ContentDigestSha256 { hex: file.sha256.hex as NonEmptyStr },
-    install_path: v41_install_path(path: file.path),
-    staging_path: Present { value: v41_staging_path(path: file.path) },
-    parent_directory: v41_parent_directory(path: file.path),
-    sources: v41_checkpoint_sources(file: file),
-  }
-}
-
-// ── ONE SOURCE'S ATTEMPT IS gunbc.spark.spark_file_blob's ─────────────────────────────────────
-//
-// Every step after the source list -- the presence and digest probe, the detached supervised unit,
-// the staged digest, the publish by rename -- is the generic sha256-keyed file handler; nothing in it
-// is V4.1's. What stays here is the one V4.1 fact about a source: the Hub cache copy is offered only
-// when that copy exists on the host, so a host without one moves on to the network instead of running
-// a `cp` that cannot succeed.
-//
-// ONE RUN DOES NOT WAIT OUT A DOWNLOAD. The fleet-converge job carries one spark step at its tier's
-// timeout, far short of half a terabyte, so a run supervises each transfer for a few polls and moves
-// on: every absent file's transfer is STARTED in the first run and keeps running detached, and a later
-// run reattaches, verifies what finished and publishes it.
-data v41_checkpoint_blob_policy: SparkFileBlobPolicy = SparkFileBlobPolicy {
-  staging_directory: v41_checkpoint_staging_directory,
-  supervision_polls: 3,
-}
-
-fn v41_attempt(ctx: SparkMaterializeContext, subject: AcquisitionSubject, origin: AcquisitionSource) -> AcquisitionAttempt {
-  if (origin.identity as String) == (v41_hub_cache_source_identity as String) {
-    match spark_remote_run(ctx: ctx, argv: ["test", "-f", v41_hub_cache_copy_path(path: subject.identity) as String]) {
-      RemoteUnreachable { cause: _, reach: _ } => AttemptUnreachable
-      RemoteRan { exit_code: e, stdout: _, stderr: _ } =>
-        if e != 0 { AttemptUnreachable } else { spark_file_blob_attempt(ctx: ctx, policy: v41_checkpoint_blob_policy, subject: subject, origin: origin) }
-    }
-  } else {
-    spark_file_blob_attempt(ctx: ctx, policy: v41_checkpoint_blob_policy, subject: subject, origin: origin)
-  }
-}
-
-fn v41_checkpoint_handler(ctx: SparkMaterializeContext) -> AcquisitionHandler {
-  AcquisitionHandler {
-    observe: fn(subject) { spark_file_blob_observe(ctx: ctx, subject: subject) },
-    ensure_parent: fn(subject) { spark_file_blob_ensure_parent(ctx: ctx, policy: v41_checkpoint_blob_policy, subject: subject) },
-    attempt: fn(subject, origin) { v41_attempt(ctx: ctx, subject: subject, origin: origin) },
-  }
-}
-
-// ── THE DISK REQUIREMENT, STATED AND CHECKED BEFORE ANY FETCH ──────────────────────────────────
-//
-// The requirement is the bytes of every admitted file NOT already at its install path at its declared
-// size -- the population's own sizes, never a transcribed figure. A file present at the right size
-// already occupies its space; if its digest is wrong the fold refuses it, it does not re-fetch over it.
-// Staging and install share one filesystem, so a publish is a rename and needs no second copy. The
-// available bytes are df's answer for the filesystem that will hold the directory.
-type V41DiskReading
-  = V41DiskRead { required: ByteSize, available: ByteSize, population: ByteSize }
-  | V41DiskUnread { cause: NonEmptyStr }
-
-// ONE LISTING LINE, PARSED ONCE: `<size> <path>` as find_regular_file_sizes_argv prints it. A line of
-// any other shape is not a reading of a file and is dropped here, so a present file it describes
-// counts as missing rather than as present at some size.
-type V41ListedFile {
-  size_text: String
-  path: String
-}
-
-fn v41_listed_files(listing: List<String>) -> List<V41ListedFile> {
-  flat_map(listing, l => {
-    let parts = split(s: l, delimiter: " ")
-    if length(parts) != 2 { [] as List<V41ListedFile> } else {
-      match get(xs: parts, index: 0) {
-        Absent => [] as List<V41ListedFile>
-        Present { value: sz } => match get(xs: parts, index: 1) {
-          Absent => [] as List<V41ListedFile>
-          Present { value: pth } => [V41ListedFile { size_text: sz, path: pth }]
-        }
-      }
-    }
-  })
-}
-
-// THE REQUIREMENT IS THE BYTES NOT ALREADY THERE AT THEIR DECLARED SIZE. The listing is parsed once
-// and each file looks its row up in the parsed form (DESIGN section 6, bare minimum cost: the split
-// per file per line was a quadratic fold over the same lines).
-fn v41_required_bytes(files: List<DeepseekV41PublishedFile>, listing: List<String>) -> ByteSize {
-  let listed = v41_listed_files(listing: listing)
-  v41_checkpoint_bytes(files: filter(files, f => match first(filter(listed, r => r.path == (f.path as String))) {
-    Present { value: r } => r.size_text != to_string(byte_size_count(b: f.file_bytes))
-    Absent => true
-  }))
-}
-
-
-// THREE PLAIN LEGS. The directory is probed first, because an absent directory holds nothing and find
-// over it would exit non-zero; listing is extdeps.tools.findutils find_regular_file_sizes_argv. The
-// directory is then created -- an empty directory, the only write before the refusal, and one the
-// fold's ensure_parent makes anyway -- so df answers for the filesystem that will hold the files
-// rather than for a parent this module would otherwise have to walk to.
-
-fn v41_read_disk(ctx: SparkMaterializeContext, files: List<DeepseekV41PublishedFile>) -> V41DiskReading {
-  let dir = v41_checkpoint_directory as String
-  match spark_remote_run(ctx: ctx, argv: ["test", "-d", dir]) {
-    RemoteUnreachable { cause: c, reach: _ } => V41DiskUnread { cause: join(["the directory probe did not run: ", c], "") as NonEmptyStr }
-    RemoteRan { exit_code: present, stdout: _, stderr: _ } =>
-      if present != 0 && present != 1 { V41DiskUnread { cause: join(["the directory probe exited ", to_string(present)], "") as NonEmptyStr } } else {
-        match v41_list_directory(ctx: ctx, present: present == 0) {
-          Absent => V41DiskUnread { cause: "the directory listing did not answer" as NonEmptyStr }
-          Present { value: listing } =>
-            match spark_remote_run(ctx: ctx, argv: ["mkdir", "-p", dir]) {
-              RemoteUnreachable { cause: c, reach: _ } => V41DiskUnread { cause: join(["the directory could not be created for the free-space read: ", c], "") as NonEmptyStr }
-              RemoteRan { exit_code: m, stdout: _, stderr: merr } =>
-                if m != 0 { V41DiskUnread { cause: join(["mkdir exited ", to_string(m), ": ", trim(s: merr)], "") as NonEmptyStr } } else {
-                  match spark_remote_run(ctx: ctx, argv: host_disk_free_space_argv(path: dir)) {
-                    RemoteUnreachable { cause: c, reach: _ } => V41DiskUnread { cause: join(["the free-space read did not run: ", c], "") as NonEmptyStr }
-                    RemoteRan { exit_code: e2, stdout: avail, stderr: err2 } =>
-                      match host_disk_observation_of_df(exit_code: e2, stdout: avail, stderr: err2, observed_on: "spark_v41_checkpoint_materialize" as NonEmptyStr) {
-                        DiskObservationRefused { detail: d } => V41DiskUnread { cause: d }
-                        DiskUnobserved { reason: r } => V41DiskUnread { cause: r as NonEmptyStr }
-                        DiskObserved { free_bytes: free, observed_on: _ } => V41DiskRead {
-                          required: v41_required_bytes(files: files, listing: split(s: listing, delimiter: "\n")),
-                          available: free,
-                          population: v41_checkpoint_bytes(files: files),
-                        }
-                      }
-                  }
-                }
-            }
-        }
-      }
-  }
-}
-
-fn v41_list_directory(ctx: SparkMaterializeContext, present: Bool) -> String? {
-  if !present { Present { value: "" } } else {
-    match spark_remote_run(ctx: ctx, argv: find_regular_file_sizes_argv(root: v41_checkpoint_directory as String)) {
-      RemoteUnreachable { cause: _, reach: _ } => none
-      RemoteRan { exit_code: e, stdout: out, stderr: _ } => if e != 0 { none } else { Present { value: out } }
-    }
-  }
-}
-
-fn v41_disk_line(d: V41DiskReading) -> String {
-  match d {
-    V41DiskUnread { cause: c } => join(["disk unread: ", c as String, "\n"], "")
-    V41DiskRead { required: r, available: a, population: p } =>
-      join(["disk required_bytes=", to_string(byte_size_count(b: r)), " available_bytes=", to_string(byte_size_count(b: a)), " population_bytes=", to_string(byte_size_count(b: p)), " directory=", v41_checkpoint_directory as String, "\n"], "")
-  }
-}
-
-// ── THE STORAGE-BACKED SPANS, READ FROM THE VERIFIED SHARDS ───────────────────────────────────
-//
-// The plan is gunbc.spark.v41_engram_row_store v41_published_span_plan over the candidate's partition,
-// the same derivation the key admits the readings against; the read is extdeps.tools.sha256sum
-// sha256sum_byte_span_argv over exactly the span.
-fn v41_span_read_argv(sp: V41PublishedSpan) -> List<String> {
-  sha256sum_byte_span_argv(path: v41_install_path(path: sp.shard) as String, offset: to_string(byte_size_count(b: sp.file_offset)), length: to_string(byte_size_count(b: sp.length)))
-}
-
-type V41SpanReadOutcome
-  = V41SpanRead { reading: V41PublishedSpanDigest }
-  | V41SpanUnread { span: V41PublishedSpan, cause: NonEmptyStr }
-  | V41SpanPlanRefused { defects: List<NonEmptyStr> }
-
-fn v41_read_span(ctx: SparkMaterializeContext, sp: V41PublishedSpan) -> V41SpanReadOutcome {
-  match spark_remote_run(ctx: ctx, argv: v41_span_read_argv(sp: sp)) {
-    RemoteUnreachable { cause: c, reach: _ } => V41SpanUnread { span: sp, cause: c as NonEmptyStr }
-    RemoteRan { exit_code: code, stdout: out, stderr: err } =>
-      if code != 0 { V41SpanUnread { span: sp, cause: join(["the span read exited ", to_string(code), ": ", trim(s: err)], "") as NonEmptyStr } } else {
-        match sha256sum_line_digest(line: out) {
-          Absent => V41SpanUnread { span: sp, cause: join(["sha256sum answered no digest: ", out], "") as NonEmptyStr }
-          Present { value: d } => match sha256_hex_digest(hex: d.hex as String) {
-            Absent => V41SpanUnread { span: sp, cause: "sha256sum answered a digest that is not lowercase sha256 hex" as NonEmptyStr }
-            Present { value: h } => V41SpanRead { reading: V41PublishedSpanDigest { span: sp, sha256: h } }
-          }
-        }
-      }
-  }
-}
-
-// THE RECEIPT LINE IS THE TRANSCRIPTION SOURCE for gunbc.spark.v41_engram_row_store
-// v41_published_span_readings: every field the reading row carries, in its order.
-fn v41_span_line(o: V41SpanReadOutcome) -> String {
-  match o {
-    V41SpanRead { reading: r } => join(["span ", r.span.tensor as String, " ", r.span.shard as String, " ", to_string(byte_size_count(b: r.span.file_offset)), " ", to_string(byte_size_count(b: r.span.length)), " sha256=", r.sha256.hex as String, "\n"], "")
-    V41SpanUnread { span: sp, cause: c } => join(["span-unread ", sp.tensor as String, " ", sp.shard as String, ": ", c as String, "\n"], "")
-    V41SpanPlanRefused { defects: d } => join(["span-plan-refused: ", join(map(d, x => x as String), "; "), "\n"], "")
-  }
-}
-
-fn v41_span_is_read(o: V41SpanReadOutcome) -> Bool {
-  match o {
-    V41SpanRead { reading: _ } => true
-    V41SpanUnread { span: _, cause: _ } => false
-    V41SpanPlanRefused { defects: _ } => false
-  }
-}
-
-// ── ONE RUN ────────────────────────────────────────────────────────────────────────────────────
-
-type V41FileReceipt sole_constructor {
-  path: NonEmptyStr
-  outcome: AcquisitionOutcome
-}
-
-fn v41_file_line(r: V41FileReceipt) -> String {
-  match r.outcome {
-    AcquisitionAlreadyPresent { identity: _, install_path: p } => join(["file ", r.path as String, " already-present ", p as String, "\n"], "")
-    AcquisitionFetched { identity: _, install_path: p, source: s } => join(["file ", r.path as String, " fetched ", p as String, " source=", s.identity as String, "\n"], "")
-    AcquisitionRefused { cause: c } => join(["file ", r.path as String, " refused: ", acquisition_refusal_text(cause: c), "\n"], "")
-  }
-}
-
-type V41MaterializeRun
-  = V41MaterializeRefusedBeforeFetch { cause: NonEmptyStr, disk: V41DiskReading }
-  | V41MaterializeRan { disk: V41DiskReading, files: List<V41FileReceipt>, spans: List<V41SpanReadOutcome> }
-
-fn v41_materialize_checkpoint(ctx: SparkMaterializeContext) -> V41MaterializeRun {
-  match v41_checkpoint_population() {
-    V41CheckpointPopulationRefused { defects: d } =>
-      V41MaterializeRefusedBeforeFetch { cause: join(["the published population is not admitted: ", join(map(d, x => x as String), "; ")], "") as NonEmptyStr, disk: V41DiskUnread { cause: "not read: the population refused first" as NonEmptyStr } }
-    V41CheckpointPopulationAdmitted { files: files } => {
-      let disk = v41_read_disk(ctx: ctx, files: files)
-      match disk {
-        V41DiskUnread { cause: c } => V41MaterializeRefusedBeforeFetch { cause: join(["the disk requirement could not be checked, so nothing was fetched: ", c as String], "") as NonEmptyStr, disk: disk }
-        V41DiskRead { required: r, available: a, population: _ } =>
-          if byte_size_count(b: a) < byte_size_count(b: r) {
-            V41MaterializeRefusedBeforeFetch { cause: join(["the checkpoint needs ", to_string(byte_size_count(b: r)), " more bytes under ", v41_checkpoint_directory as String, " and the filesystem has ", to_string(byte_size_count(b: a)), " available, so nothing was fetched"], "") as NonEmptyStr, disk: disk }
-          } else {
-            let receipts = map(files, f => V41FileReceipt { path: f.path, outcome: acquire_artifact(subject: v41_checkpoint_subject(file: f), handler: v41_checkpoint_handler(ctx: ctx)) })
-            V41MaterializeRan { disk: disk, files: receipts, spans: v41_spans_after(ctx: ctx, receipts: receipts) }
-          }
-      }
-    }
-  }
-}
-
-// THE SPANS ARE READ ONLY FROM SHARDS THIS RUN VERIFIED. A span read from a shard that refused would
-// be a digest of bytes nobody vouched for.
-fn v41_spans_after(ctx: SparkMaterializeContext, receipts: List<V41FileReceipt>) -> List<V41SpanReadOutcome> {
-  match v41_published_span_plan(partition: v41_candidate_partition, sharded: deepseek_v4_1_flash_engram_sharded_entries, shards: deepseek_v4_1_flash_engram_shard_files) {
-    V41PublishedSpansUnplannable { defects: d } => [V41SpanPlanRefused { defects: d }]
-    V41PublishedSpansPlanned { spans: plan } =>
-      map(plan, sp =>
-        if any(receipts, r => (r.path as String) == (sp.shard as String) && acquisition_succeeded(outcome: r.outcome)) {
-          v41_read_span(ctx: ctx, sp: sp)
-        } else {
-          V41SpanUnread { span: sp, cause: join(["shard ", sp.shard as String, " was not verified by this run, so its span is not read"], "") as NonEmptyStr }
-        })
-  }
-}
-
-// THE .engram. SELECTION OVER THE PINNED INDEX (gunbc.spark.v41_index_engram_selection), READ IN ITS OWN
-// PROCESS. The index is first checked against its manifest row through the same observe the acquisition
-// uses, so only a file that verifies is read; its digest and size are read back on the host, its bytes are
-// fetched, and parse_json_document runs over them here. The `index-selection` lines are what
-// v41_index_engram_selection_reading is transcribed from.
-//
-// WHY A SEPARATE ENTRY AND NOT A TAIL OF THE MATERIALIZE RUN. The parse's working set is large and was not
-// measured to fit anywhere yet; the run that fetches half a terabyte must not lose its per-file receipts
-// because a parse after it was stopped. So the read is v41_index_selection_ci_wet, a second step of the
-// same fleet-converge mode. What bounds its memory on the executor is the runner slot's own grant
-// (gunbc.runner_slot_allocation); gunbc.memory_cgroup_binding cannot nest a tighter bound under a hard
-// limit that already binds the process, by design.
-type V41IndexSelectionOutcome
-  = V41IndexSelectionRead { sha256_hex: String, bytes: ByteSize, parse: V41IndexParse }
-  | V41IndexSelectionUnread { cause: NonEmptyStr }
-
-fn v41_index_selection_read(ctx: SparkMaterializeContext) -> V41IndexSelectionOutcome {
-  match v41_checkpoint_population() {
-    V41CheckpointPopulationRefused { defects: _ } => V41IndexSelectionUnread { cause: "the published population is not admitted, so the index row is not either" as NonEmptyStr }
-    V41CheckpointPopulationAdmitted { files: files } =>
-      match first(filter(files, f => (f.path as String) == (deepseek_v4_1_flash_safetensors_index_path as String))) {
-        Absent => V41IndexSelectionUnread { cause: "the admitted population carries no index row" as NonEmptyStr }
-        Present { value: row } => {
-          match spark_file_blob_observe(ctx: ctx, subject: v41_checkpoint_subject(file: row)) {
-            AcquisitionAbsent => V41IndexSelectionUnread { cause: "the index is not on the host; run the materialize step first" as NonEmptyStr }
-            AcquisitionDigestMismatch => V41IndexSelectionUnread { cause: "the index on the host does not match its manifest row, so it is not read" as NonEmptyStr }
-            AcquisitionProbeFailed { reason: r } => V41IndexSelectionUnread { cause: join(["the index could not be checked against its manifest row: ", r as String], "") as NonEmptyStr }
-            AcquisitionVerified => v41_index_selection_of_verified(ctx: ctx, path: v41_install_path(path: deepseek_v4_1_flash_safetensors_index_path))
-          }
-        }
-      }
-  }
-}
-
-fn v41_index_selection_of_verified(ctx: SparkMaterializeContext, path: NonEmptyStr) -> V41IndexSelectionOutcome {
-  match spark_read_file_digest(ctx: ctx, path: path) {
-    SparkFileDigestUnread { cause: c } => V41IndexSelectionUnread { cause: c }
-    SparkFileDigestRead { hex: h } =>
-      match spark_remote_run(ctx: ctx, argv: ["wc", "--bytes", path as String]) {
-        RemoteUnreachable { cause: c, reach: _ } => V41IndexSelectionUnread { cause: join(["the size read did not run: ", c], "") as NonEmptyStr }
-        RemoteRan { exit_code: e, stdout: out, stderr: _ } =>
-          if e != 0 { V41IndexSelectionUnread { cause: join(["wc exited ", to_string(e)], "") as NonEmptyStr } } else {
-            match v41_wc_bytes(out: out) {
-              Absent => V41IndexSelectionUnread { cause: join(["wc answered no byte count: ", out], "") as NonEmptyStr }
-              Present { value: b } =>
-                match spark_remote_run(ctx: ctx, argv: ["cat", "--", path as String]) {
-                  RemoteUnreachable { cause: c, reach: _ } => V41IndexSelectionUnread { cause: join(["the index read did not run: ", c], "") as NonEmptyStr }
-                  RemoteRan { exit_code: e2, stdout: text, stderr: _ } =>
-                    if e2 != 0 { V41IndexSelectionUnread { cause: join(["cat exited ", to_string(e2)], "") as NonEmptyStr } } else {
-                      V41IndexSelectionRead { sha256_hex: h, bytes: b, parse: v41_select_index_document(text: text, selector: v41_index_engram_selector) }
-                    }
-                }
-            }
-          }
-      }
-  }
-}
-
-// wc --bytes prints `<count> <path>`; anything else is no size, never an empty one.
-fn v41_wc_bytes(out: String) -> ByteSize? {
-  match first(split(s: trim(s: out), delimiter: " ")) {
-    Absent => none
-    Present { value: w } => match parse_int(s: w) {
-      Absent => none
-      Present { value: n } => if n < 0 { none } else {
-        match checked_int_magnitude(a: n) {
-          CheckedNatOverflow { cause: _ } => none
-          CheckedNatReady { value: v } => Present { value: byte_size(count: v) }
-        }
-      }
-    }
-  }
-}
-
-fn v41_index_selection_is_read(o: V41IndexSelectionOutcome) -> Bool {
-  match o {
-    V41IndexSelectionRead { sha256_hex: _, bytes: _, parse: pr } => match pr { V41IndexParsed { name_count: _, members: _ } => true  V41IndexParseRefused { cause: _ } => false }
-    V41IndexSelectionUnread { cause: _ } => false
-  }
-}
-
-fn v41_index_selection_lines(o: V41IndexSelectionOutcome) -> String {
-  match o {
-    V41IndexSelectionUnread { cause: c } => join(["index-selection unread: ", c as String, "\n"], "")
-    V41IndexSelectionRead { sha256_hex: h, bytes: b, parse: pr } => match pr {
-      V41IndexParseRefused { cause: c } => join(["index-selection refused sha256=", h, ": ", c as String, "\n"], "")
-      V41IndexParsed { name_count: n, members: ms } =>
-        join(concat([join(["index-selection sha256=", h, " bytes=", to_string(byte_size_count(b: b)), " names=", to_string(n), " selector=", v41_index_engram_selector as String, "\n"], "")],
-          map(ms, m => join(["index-selection member ", m.name as String, " ", m.shard as String, "\n"], ""))), "")
-    }
-  }
-}
-
-fn v41_run_succeeded(run: V41MaterializeRun) -> Bool {
-  match run {
-    V41MaterializeRefusedBeforeFetch { cause: _, disk: _ } => false
-    V41MaterializeRan { disk: _, files: fs, spans: sps } =>
-      all(fs, r => acquisition_succeeded(outcome: r.outcome)) && length(sps) > 0 && all(sps, s => v41_span_is_read(o: s))
-  }
-}
-
-fn v41_run_body(run: V41MaterializeRun) -> String {
-  match run {
-    V41MaterializeRefusedBeforeFetch { cause: c, disk: d } => join([v41_disk_line(d: d), "refused-before-fetch: ", c as String, "\n"], "")
-    V41MaterializeRan { disk: d, files: fs, spans: sps } =>
-      join(concat(concat([v41_disk_line(d: d)], map(fs, r => v41_file_line(r: r))), map(sps, s => v41_span_line(o: s))), "")
-  }
-}
-
-// ── THE ENTRY, RUN AS THE spark_v41_checkpoint_materialize FLEET-CONVERGE MODE ────────────────
-//
-// The host comes from SPARK_CONVERGE_TARGET and must be one the Group A pair subject holds; an unset
-// target refuses rather than sweeping, because this writes half a terabyte to one host.
-data v41_checkpoint_ci_attempt_raw: String = "v41-checkpoint-materialize-ci"
-data v41_checkpoint_ci_receipt_path: String = "target/v41-checkpoint-materialize-receipt.txt"
-
-// ONE BRACKET FOR BOTH STEPS OF THE MODE. Target selection, Group A admission, the executor's reach,
-// the administrator credential, known-hosts trust and the ssh key file are the same for the fetch and for
-// the index read, so they are established here once and each step supplies only its work and its receipt.
-type V41CiReport {
-  body: String
-  succeeded: Bool
-}
-
-fn v41_group_a_ci_run(attempt_raw: String, identity_file_name: NonEmptyStr, receipt_path: String, title: String, work: fn(SparkMaterializeContext) -> V41CiReport) -> ProcessExit
-{
-  let now = clock_now_probed_at()
-  match spark_converge_target_selection(execute_apply: true) {
-    SparkConvergeTargetRefused { reason: why } => exit_failure(reason: why)
-    SparkConvergeTargetAllObserveOnly =>
-      exit_failure(reason: join(["SPARK_CONVERGE_TARGET is unset: ", title, " acts on ONE host, so it refuses rather than choosing one"], ""))
-    SparkConvergeTargetSingle { host: target_host } =>
-      match admit_host_held_by_subject(raw: target_host, subject: PairServingUnitOn { group: FabricGroupA }) {
-        Present { value: why } => exit_failure(reason: why)
-        Absent =>
-          match observe_executor_reach() {
-            ExecutorReachUnknown { cause: c } => exit_failure(reason: join([title, ": ", c], ""))
-            ExecutorReachKnown { short_hostname: executor, path: path } =>
-              match read_bootstrap_credential() {
-                BootstrapCredentialNotMaterialized { cause: c } => exit_failure(reason: c as String)
-                BootstrapCredentialReady { secret: administrator } =>
-                  match fleet_ssh_attempt_identity(raw: attempt_raw) {
-                    Absent => exit_failure(reason: "attempt identity is not a safe path segment")
-                    Present { value: attempt } => {
-                      let materialization = materialize_fleet_known_hosts_anchor(attempt: attempt)
-                      match fleet_openssh_trust_policy_of(outcome: materialization) {
-                        Absent => exit_failure(reason: join(["trust could not be established, so no leg ran: ", known_hosts_materialization_receipt(outcome: materialization)], ""))
-                        Present { value: trust } =>
-                          match with_materialized_ssh_key_file(
-                            identity_file_name: identity_file_name,
-                            secret_bytes: administrator as Secret,
-                            use: fn(file) {
-                              work(SparkMaterializeContext {
-                                host: target_host,
-                                trust: trust,
-                                path: path,
-                                admin_credential: administrator as Secret,
-                                admin_credential_file: file,
-                                executor: HostCli,
-                              })
-                            },
-                          ) {
-                            MaterializedSshKeyFileBracketRefused { cause: c } => exit_failure(reason: c as String)
-                            MaterializedSshKeyFileBracketCompleted { value: report } => {
-                              let body = join([
-                                join([title, " probed_at=", probed_at_word(reading: now) as String, " host=", target_host as String, " revision=", deepseek_v4_1_flash_revision as String, "\n"], ""),
-                                report.body,
-                                join(["executor=", executor, "\n"], ""),
-                                known_hosts_materialization_receipt(outcome: materialization),
-                              ], "")
-                              let w = Filesystem.Write(path: receipt_path, content: body)
-                              if !w.success {
-                                exit_failure(reason: join([title, " receipt write failed: ", w.error], ""))
-                              } else if report.succeeded {
-                                ExitSuccess
-                              } else {
-                                exit_failure(reason: join([title, " did not complete on ", target_host as String, ":\n", body], ""))
-                              }
-                            }
-                          }
-                      }
-                    }
-                  }
-              }
-          }
-      }
-  }
-}
-
-fn v41_checkpoint_materialize_ci_wet() -> ProcessExit
-{
-  v41_group_a_ci_run(
-    attempt_raw: v41_checkpoint_ci_attempt_raw,
-    identity_file_name: "gunbc-v41-checkpoint-materialize-admin-password" as NonEmptyStr,
-    receipt_path: v41_checkpoint_ci_receipt_path,
-    title: "v41 checkpoint materialize",
-    work: fn(ctx) {
-      let run = v41_materialize_checkpoint(ctx: ctx)
-      V41CiReport { body: v41_run_body(run: run), succeeded: v41_run_succeeded(run: run) }
-    },
-  )
-}
-
-// THE PARSE RUNS ONLY INSIDE A HARD MEMORY FENCE. The executor shares its host with other tenants, and the
-// parse's working set is unmeasured, so before the index is read this process reads what bounds it: its
-// own cgroup and every ancestor (extdeps.linux.cgroup_v2_memory cgroup_tightest_hard_memory_limit), the
-// tightest memory.max among them, with the directory it came from. A process under memory.high alone is
-// throttled, not fenced -- an allocation may cross it and reach the host -- so that is a refusal, located
-// at the levels it read. gunbc.memory_cgroup_binding cannot nest a tighter bound under an existing hard
-// limit, by design; that is a separate change (see the PR that introduced this read).
-type V41MemoryFence
-  = V41MemoryFenced { dir: NonEmptyStr, bytes: ByteSize, levels: List<CgroupMemoryLevel> }
-  | V41MemoryUnfenced { cause: NonEmptyStr, levels: List<CgroupMemoryLevel> }
-
-fn v41_file_observed(dir: String, name: String, listing: FilesystemListingObservation) -> FilesystemFileObservation {
-  let path = join([dir, "/", name], "")
-  let read = Filesystem.Read(path: path)
-  filesystem_file_observation(listing: listing, name: name, path: path, read: filesystem_read_outcome(content: read.content, success: read.success, error: read.error))
-}
-
-fn v41_cgroup_level(dir: NonEmptyStr) -> CgroupMemoryLevel {
-  let l = Filesystem.List(path: dir as String)
-  let listing = filesystem_listing_observation(directory: dir as String, success: l.success, entries: l.entries, error: l.error)
-  match v41_file_observed(dir: dir as String, name: "memory.max", listing: listing) {
-    FilesystemFileAbsent(_) => CgroupMemoryLevelWithoutFiles { dir: dir }
-    FilesystemFileIndeterminate { cause: c } => CgroupMemoryLevelUnread { dir: dir, cause: c }
-    FilesystemFileObservationsDisagree { path: _, cause: c } => CgroupMemoryLevelUnread { dir: dir, cause: c }
-    FilesystemFileSubjectRefused { directory: _, name: _, cause: c } => CgroupMemoryLevelUnread { dir: dir, cause: c }
-    FilesystemFileRead { path: _, content: max_body } =>
-      match v41_file_observed(dir: dir as String, name: "memory.high", listing: listing) {
-        FilesystemFileRead { path: _, content: high_body } =>
-          CgroupMemoryLevelRead { dir: dir, max: parse_cgroup_memory_limit(body: max_body), high: parse_cgroup_memory_limit(body: high_body) }
-        FilesystemFileAbsent(_) => CgroupMemoryLevelUnread { dir: dir, cause: "memory.max is present and memory.high is not" }
-        FilesystemFileIndeterminate { cause: c } => CgroupMemoryLevelUnread { dir: dir, cause: c }
-        FilesystemFileObservationsDisagree { path: _, cause: c } => CgroupMemoryLevelUnread { dir: dir, cause: c }
-        FilesystemFileSubjectRefused { directory: _, name: _, cause: c } => CgroupMemoryLevelUnread { dir: dir, cause: c }
-      }
-  }
-}
-
-fn v41_limit_word(v: CgroupMemoryLimitValue) -> String {
-  match v {
-    CgroupMemoryLimited { bytes: b } => to_string(byte_size_count(b: b))
-    CgroupMemoryUnlimited => "max"
-    CgroupMemoryLimitUnparseable { body: body } => join(["unparseable(", trim(s: body), ")"], "")
-  }
-}
-
-fn v41_level_word(level: CgroupMemoryLevel) -> String {
-  match level {
-    CgroupMemoryLevelRead { dir: d, max: m, high: h } => join([d as String, " memory.max=", v41_limit_word(v: m), " memory.high=", v41_limit_word(v: h)], "")
-    CgroupMemoryLevelWithoutFiles { dir: d } => join([d as String, " no memory files"], "")
-    CgroupMemoryLevelUnread { dir: d, cause: c } => join([d as String, " unread: ", c], "")
-  }
-}
-
-fn v41_memory_fence() -> V41MemoryFence {
-  let membership = Filesystem.Read(path: "/proc/self/cgroup")
-  if !membership.success {
-    V41MemoryUnfenced { cause: join(["/proc/self/cgroup could not be read: ", membership.error], "") as NonEmptyStr, levels: [] as List<CgroupMemoryLevel> }
-  } else {
-    match read_unified_cgroup_membership(content: membership.content) {
-      MembershipMissing => V41MemoryUnfenced { cause: "/proc/self/cgroup names no unified-hierarchy cgroup" as NonEmptyStr, levels: [] as List<CgroupMemoryLevel> }
-      MembershipAmbiguous { first: a, second: b } => V41MemoryUnfenced { cause: join(["/proc/self/cgroup names two unified-hierarchy cgroups: ", a as String, " and ", b as String], "") as NonEmptyStr, levels: [] as List<CgroupMemoryLevel> }
-      MembershipMalformed { cause: _ } => V41MemoryUnfenced { cause: "/proc/self/cgroup carries a malformed line" as NonEmptyStr, levels: [] as List<CgroupMemoryLevel> }
-      CurrentCgroupObserved { relative_path: rel } => {
-        let levels = map(cgroup_v2_bounding_dirs(mount_point: cgroup_v2_mount_point, relative_path: rel), d => v41_cgroup_level(dir: d))
-        match cgroup_tightest_hard_memory_limit(levels: levels) {
-          CgroupHardLimitBinds { dir: d, bytes: b } => V41MemoryFenced { dir: d, bytes: b, levels: levels }
-          CgroupNoHardLimit => V41MemoryUnfenced {
-            cause: join(["no hard memory.max binds this process (cgroup ", rel as String, "); memory.high is a throttle an allocation may cross, not a fence, so the index is not parsed here"], "") as NonEmptyStr,
-            levels: levels,
-          }
-        }
-      }
-    }
-  }
-}
-
-fn v41_memory_fence_lines(f: V41MemoryFence) -> String {
-  match f {
-    V41MemoryFenced { dir: d, bytes: b, levels: ls } =>
-      join(concat([join(["memory-fence hard memory.max=", to_string(byte_size_count(b: b)), " at ", d as String, "\n"], "")], map(ls, l => join(["memory-fence level ", v41_level_word(level: l), "\n"], ""))), "")
-    V41MemoryUnfenced { cause: c, levels: ls } =>
-      join(concat([join(["memory-fence refused: ", c as String, "\n"], "")], map(ls, l => join(["memory-fence level ", v41_level_word(level: l), "\n"], ""))), "")
-  }
-}
-
-fn v41_index_selection_report(ctx: SparkMaterializeContext) -> V41CiReport {
-  let fence = v41_memory_fence()
-  match fence {
-    V41MemoryUnfenced { cause: c, levels: _ } =>
-      V41CiReport { body: join([v41_memory_fence_lines(f: fence), v41_index_selection_lines(o: V41IndexSelectionUnread { cause: c })], ""), succeeded: false }
-    V41MemoryFenced { dir: _, bytes: _, levels: _ } => {
-      let o = v41_index_selection_read(ctx: ctx)
-      V41CiReport { body: join([v41_memory_fence_lines(f: fence), v41_index_selection_lines(o: o)], ""), succeeded: v41_index_selection_is_read(o: o) }
-    }
-  }
-}
-
-// THE INDEX READ, THE MODE'S SECOND STEP (see V41IndexSelectionOutcome for why it is its own process).
-
-data v41_index_selection_ci_attempt_raw: String = "v41-index-selection-ci"
-data v41_index_selection_ci_receipt_path: String = "target/v41-index-selection-receipt.txt"
-
-fn v41_index_selection_ci_wet() -> ProcessExit
-{
-  v41_group_a_ci_run(
-    attempt_raw: v41_index_selection_ci_attempt_raw,
-    identity_file_name: "gunbc-v41-index-selection-admin-password" as NonEmptyStr,
-    receipt_path: v41_index_selection_ci_receipt_path,
-    title: "v41 index selection",
-    work: fn(ctx) { v41_index_selection_report(ctx: ctx) },
-  )
-}
diff --git a/dag/gunbc/spark/v41_engram_differential_run.dag b/dag/gunbc/spark/v41_engram_differential_run.dag
deleted file mode 100644
index f7e241394b4..00000000000
--- a/dag/gunbc/spark/v41_engram_differential_run.dag
+++ /dev/null
@@ -1,409 +0,0 @@
-module gunbc.spark.v41_engram_differential_run
-
-import std.types { String, Bool, Int, List, NonEmptyStr, Secret }
-import std.nat { Nat }
-import std.checked_arithmetic { nat_magnitude }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import std.algebra { trim }
-import std.measure { ByteSize, byte_size, byte_size_count, Second, second, second_count, kibibyte, kibibyte_to_byte_size }
-import std.optional { Present, Absent }
-import v2.std.algebra { filter }
-import v2.std.collection { list_at_optional }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import extdeps.exec.command { argv_words }
-import extdeps.docker { BindMount }
-import extdeps.docker.cli {
-  docker_run_ephemeral_command, docker_image_inspect_command, DockerPsByLabel, DockerLabel,
-  docker_ps_running_command, docker_remove_force_command,
-  docker_image_inspect_id_from_stdout, DockerImageInspectId, DockerImageInspectIdUnreadable,
-  docker_image_inspect_names_no_such_image,
-}
-import extdeps.deepseek.deepseek_v4_1_flash { deepseek_v4_1_flash_engram, deepseek_v4_1_flash_engram_sharded_entries }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fleet_known_hosts_anchor {
-  fleet_ssh_attempt_identity, materialize_fleet_known_hosts_anchor, known_hosts_materialization_receipt,
-  fleet_openssh_trust_policy_of,
-}
-import gunbc.spark.model_snapshot_materialize {
-  SparkMaterializeContext, RemoteRan, RemoteUnreachable, spark_remote_run, spark_remote_argv_run, HostCli,
-}
-import gunbc.spark.grant_privileged_operation {
-  read_bootstrap_credential, BootstrapCredentialReady, BootstrapCredentialNotMaterialized,
-}
-import gunbc.auth.materialized_secret {
-  with_materialized_ssh_key_file, MaterializedSshKeyFileBracketCompleted, MaterializedSshKeyFileBracketRefused,
-}
-import gunbc.fleet_multi_principal_probe {
-  SparkConvergeTargetSingle, SparkConvergeTargetAllObserveOnly, SparkConvergeTargetRefused, spark_converge_target_selection,
-}
-import gunbc.spark.fabric_reach { ExecutorReachKnown, ExecutorReachUnknown, observe_executor_reach }
-import gunbc.spark.host_commitment { HostEffectClaimLanded, HostEffectClaimNotLanded, admit_host_held_by_subject, claim_host_effect_live, release_host_effect_live_over }
-import gunbc.spark.host_effect_quiescence { HostEffectResidueSpec }
-import gunbc.spark.serving_subject { PairServingUnitOn }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
-import gunbc.spark.v41_engram_row_store { v41_row_store_spec, v41_live_head_sizes, V41RowStoreSpecAdmitted, V41RowStoreSpecRefused, v41_published_store_readings }
-import gunbc.spark.v41_row_store_encode { v41_row_store_output_directory }
-import gunbc.spark.v41_runtime_image_converge { V41ProducedImageHeld, v41_production_produced_image }
-import extdeps.container.oci.digest { render_oci_content_digest_wire }
-import gunbc.spark.v41_runtime_candidate { v41_candidate_partition }
-import gunbc.spark.v41_engram_store_manifest { V41EngramStoreManifest, V41StoreManifestDerived, V41StoreManifestRefused, v41_engram_store_manifest }
-import product.host_identity { HostIdentity }
-
-// ══ THE DESIGN-B RED: A BYTE-IDENTICAL DIFFERENTIAL ON THE REAL ROW STORES ════════════════════════
-//
-// The design-B cutover (patches/d2d649e6: FileBackedParallelEngramEmbedding and FileBackedLookup,
-// decision evidence fleet-converge run 36247421840) replaces upstream's pinned-table lookup with a CPU
-// gather from each rank's row store. Its RED is equality with upstream: for every (layer, rank) store
-// the launch manifest names, sampled real records are placed in a compact upstream-layout table, and
-// upstream _engram_lookup_kernel and FileBackedLookup run over the same hash ids -- owned, below the
-// rank's range, above it, and on absent heads -- and must agree in every bit (torch.equal over the
-// bf16 bit patterns). The overlay program is
-// the image's own copy of the overlay (it runs as a module there), so what runs is what the image build
-// applied; its `--differential` entry does the comparing.
-//
-// WHERE AND UNDER WHAT BOUNDS. srv5 holds the stores; the run mounts their directory read-only at its
-// own path so the manifest's paths resolve, labels its container for this lane, caps it at 16 GiB with
-// no swap, and bounds the program in the container and the client on the host. Before claiming, it
-// reads occupancy over the privileged leg and refuses, typed, if any GPU compute process is running
-// or the host reports under 32 GiB available -- srv8 was once held by an unseen V4 pair worker, and a
-// run that thrashes a host is worse than one that refuses. Occupancy admission moves to the fabric's
-// own reading when that lands (still-seal-656). The mode never writes a store or the served model.
-
-// THE IMAGE MUST CARRY THIS OVERLAY: the differential runs the overlay's own `--differential` entry as a
-// module inside the image (python3 -m), against upstream's kernel from the same image, so an image built
-// before this overlay cannot answer and no program is shipped in beside it. The binding is the image's
-// config digest, taken from the build receipt of an image whose patch population includes this overlay;
-// until such an image is built (the production V4.1 image built from main after the cutover lands), the
-// binding is unbuilt and the mode refuses with ImageLacksEngramOverlay rather than running anything.
-// The design-B RED's evidence of record meanwhile is fleet-converge run 36254702828 (srv5, all eight
-// stores equal), taken before this form existed.
-type V41DifferentialImage
-  = DifferentialImageBuilt { image: V41ProducedImageHeld }
-  | ImageLacksEngramOverlay { trigger: NonEmptyStr }
-
-// The production V4.1 image, built with this overlay, named by its receipt row.
-data v41_differential_image: V41DifferentialImage = DifferentialImageBuilt { image: v41_production_produced_image }
-
-data v41_differential_overlay_module: String = "vllm.models.deepseek_v4_1.nvidia.engram_file_backed"
-
-data v41_differential_lane_label: DockerLabel = DockerLabel { key: "gunbc.lane" as NonEmptyStr, value: "engram-differential" as NonEmptyStr }
-data v41_differential_process_pattern: NonEmptyStr = "engram_file_backed --differential" as NonEmptyStr
-data v41_differential_memory_cap: ByteSize = byte_size(count: 17179869184)
-data v41_differential_min_available: ByteSize = byte_size(count: 34359738368)
-data v41_differential_time_bound: Second = second(count: 1500)
-data v41_differential_client_bound: Second = second(count: 1620)
-data v41_differential_kill_grace: Second = second(count: 30)
-data v41_differential_rows: Nat = 4096
-data v41_differential_tokens: Nat = 2048
-
-fn v41_differential_argv(image: NonEmptyStr, claim: NonEmptyStr, manifest: String) -> List<String> {
-  concat(
-    ["timeout", "-k", to_string(second_count(s: v41_differential_kill_grace)), to_string(second_count(s: v41_differential_client_bound))],
-    argv_words(command: docker_run_ephemeral_command(
-      image: image,
-      gpus_all: true,
-      mounts: [BindMount { host_path: v41_row_store_output_directory(), container_path: v41_row_store_output_directory(), readonly: true }],
-      labels: [v41_differential_lane_label, DockerLabel { key: "gunbc.claim" as NonEmptyStr, value: claim }],
-      memory_limit: Present { value: v41_differential_memory_cap },
-      entrypoint: "timeout" as NonEmptyStr,
-      argv: ["-k", to_string(second_count(s: v41_differential_kill_grace)), to_string(second_count(s: v41_differential_time_bound)), "python3", "-u", "-m", v41_differential_overlay_module, "--differential", "-", "--manifest-json", manifest, "--rows", to_string(v41_differential_rows), "--tokens", to_string(v41_differential_tokens)],
-    )),
-  )
-}
-
-// ── THE READING ─────────────────────────────────────────────────────────────────────────────────
-
-type V41DifferentialStore sole_constructor {
-  layer: Nat
-  rank: Nat
-  rows_sampled: Nat
-  owned: Nat
-  unowned_below: Nat
-  out_of_range: Nat
-  absent_heads: Nat
-  equal: Bool
-}
-
-type V41DifferentialOutcome
-  = V41DifferentialRead { image_config: NonEmptyStr, stores: List<V41DifferentialStore> }
-  | V41DifferentialRefused { step: NonEmptyStr, cause: NonEmptyStr }
-
-fn v41_words(line: String) -> List<String> {
-  filter(split(s: trim(s: line), delimiter: " "), w => w != "")
-}
-
-fn v41_nat_at(ws: List<String>, index: Nat) -> Nat? {
-  match list_at_optional(xs: ws, index: index) {
-    Absent => none
-    Present { value: w } => match parse_int(s: w) {
-      Absent => none
-      Present { value: n } => if n < 0 { none } else { Present { value: nat_magnitude(a: n) } }
-    }
-  }
-}
-
-// DIFFERENTIAL <layer> <rank> rows_sampled <n> owned <n> unowned_below <n> out_of_range <n> absent_heads <n> equal|DIFFERS
-fn v41_differential_store_of(line: String) -> V41DifferentialStore? {
-  let ws = v41_words(line: line)
-  match list_at_optional(xs: ws, index: 0) {
-    Absent => none
-    Present { value: k } => if k != "DIFFERENTIAL" { none } else {
-      match v41_nat_at(ws: ws, index: 1) { Absent => none  Present { value: layer } =>
-      match v41_nat_at(ws: ws, index: 2) { Absent => none  Present { value: rank } =>
-      match v41_nat_at(ws: ws, index: 4) { Absent => none  Present { value: rows } =>
-      match v41_nat_at(ws: ws, index: 6) { Absent => none  Present { value: owned } =>
-      match v41_nat_at(ws: ws, index: 8) { Absent => none  Present { value: below } =>
-      match v41_nat_at(ws: ws, index: 10) { Absent => none  Present { value: out } =>
-      match v41_nat_at(ws: ws, index: 12) { Absent => none  Present { value: absent } =>
-      match list_at_optional(xs: ws, index: 13) { Absent => none  Present { value: verdict } =>
-        if verdict == "equal" || verdict == "DIFFERS" {
-          Present { value: V41DifferentialStore { layer: layer, rank: rank, rows_sampled: rows, owned: owned, unowned_below: below, out_of_range: out, absent_heads: absent, equal: verdict == "equal" } }
-        } else { none }
-      } } } } } } } }
-    }
-  }
-}
-
-type V41StoreKey { layer: Nat, rank: Nat }
-
-// ADMITTED ONLY WHOLE: exactly one reading per owed store, every reading equal, each exercising owned
-// and unowned rows, and the program's own DONE line reporting zero failures. A store that differs is
-// the RED firing, and refuses naming it.
-fn v41_admit_differential(image_config: NonEmptyStr, owed: List<V41StoreKey>, stdout: String) -> V41DifferentialOutcome {
-  let stores = flat_map(split(s: stdout, delimiter: "\n"), l => match v41_differential_store_of(line: l) { Present { value: d } => [d]  Absent => [] as List<V41DifferentialStore> })
-  let join_causes = flat_map(owed, k => {
-    let n = length(filter(stores, d => d.layer == k.layer && d.rank == k.rank))
-    if n == 1 { [] as List<String> } else { [join(["layer ", to_string(k.layer), " rank ", to_string(k.rank), " has ", to_string(n), " differential readings"], "")] }
-  })
-  let differs = flat_map(stores, d => if d.equal { [] as List<String> } else { [join(["layer ", to_string(d.layer), " rank ", to_string(d.rank), " DIFFERS from upstream"], "")] })
-  let thin = flat_map(stores, d => if d.owned == 0 || d.unowned_below + d.out_of_range == 0 { [join(["layer ", to_string(d.layer), " rank ", to_string(d.rank), " did not exercise both owned and unowned rows"], "")] } else { [] as List<String> })
-  let done = length(filter(split(s: stdout, delimiter: "\n"), l => trim(s: l) == "DIFFERENTIAL_DONE failures 0")) == 1
-  let causes = concat(concat(concat(join_causes, differs), thin), if done { [] as List<String> } else { ["the program did not report DIFFERENTIAL_DONE failures 0"] })
-  if length(causes) != 0 {
-    V41DifferentialRefused { step: "differential-admission" as NonEmptyStr, cause: join(causes, "; ") as NonEmptyStr }
-  } else {
-    V41DifferentialRead { image_config: image_config, stores: stores }
-  }
-}
-
-fn v41_differential_body(o: V41DifferentialOutcome) -> String {
-  match o {
-    V41DifferentialRefused { step: s, cause: c } => join(["REFUSED step=", s as String, " cause=", c as String, "\n"], "")
-    V41DifferentialRead { image_config: i, stores: ds } =>
-      join([
-        join(["image_config=", i as String, "\n"], ""),
-        join(map(ds, d => join(["  layer ", to_string(d.layer), " rank ", to_string(d.rank), " rows_sampled=", to_string(d.rows_sampled), " owned=", to_string(d.owned), " unowned_below=", to_string(d.unowned_below), " out_of_range=", to_string(d.out_of_range), " absent_heads=", to_string(d.absent_heads), " ", if d.equal { "equal" } else { "DIFFERS" }, "\n"], "")), ""),
-      ], "")
-  }
-}
-
-// ── OCCUPANCY: REFUSE BEFORE CLAIMING A HOST SOMETHING ELSE IS USING ────────────────────────────
-type V41HostOccupancy
-  = V41HostFree { available: ByteSize }
-  | V41HostOccupied { cause: NonEmptyStr }
-
-// /proc/meminfo reports kB meaning KiB (proc_meminfo(5)); the reading converts through std.measure.
-fn v41_meminfo_available(meminfo: String) -> ByteSize? {
-  match list_at_optional(xs: filter(split(s: meminfo, delimiter: "\n"), l => starts_with(s: l, prefix: "MemAvailable:")), index: 0) {
-    Absent => none
-    Present { value: l } => match v41_nat_at(ws: v41_words(line: l), index: 1) {
-      Absent => none
-      Present { value: kib } => Present { value: kibibyte_to_byte_size(k: kibibyte(count: kib)) }
-    }
-  }
-}
-
-// nvidia-smi --query-compute-apps prints a csv header and one line per compute process.
-fn v41_compute_apps(csv: String) -> List<String> {
-  filter(filter(split(s: csv, delimiter: "\n"), l => trim(s: l) != ""), l => !starts_with(s: trim(s: l), prefix: "pid"))
-}
-
-fn v41_judge_occupancy(meminfo: String, compute_csv: String) -> V41HostOccupancy {
-  let apps = v41_compute_apps(csv: compute_csv)
-  if length(apps) != 0 {
-    V41HostOccupied { cause: join(["GPU compute processes are running: ", join(apps, "; ")], "") as NonEmptyStr }
-  } else {
-    match v41_meminfo_available(meminfo: meminfo) {
-      Absent => V41HostOccupied { cause: "MemAvailable could not be read, so occupancy is not established" as NonEmptyStr }
-      Present { value: avail } =>
-        if byte_size_count(b: avail) < byte_size_count(b: v41_differential_min_available) {
-          V41HostOccupied { cause: join(["the host reports ", to_string(byte_size_count(b: avail)), " bytes available, under the ", to_string(byte_size_count(b: v41_differential_min_available)), " bytes this run requires"], "") as NonEmptyStr }
-        } else { V41HostFree { available: avail } }
-    }
-  }
-}
-
-fn v41_read_occupancy(ctx: SparkMaterializeContext) -> V41HostOccupancy {
-  match spark_remote_run(ctx: ctx, argv: ["cat", "/proc/meminfo"]) {
-    RemoteUnreachable { cause: why, reach: _ } => V41HostOccupied { cause: join(["/proc/meminfo could not be read: ", why as String], "") as NonEmptyStr }
-    RemoteRan { exit_code: c, stdout: mem, stderr: e } =>
-      if c != 0 { V41HostOccupied { cause: join(["/proc/meminfo exited ", to_string(c), ": ", trim(s: e)], "") as NonEmptyStr } } else {
-        match spark_remote_run(ctx: ctx, argv: ["nvidia-smi", "--query-compute-apps=pid,process_name,used_memory", "--format=csv"]) {
-          RemoteUnreachable { cause: why, reach: _ } => V41HostOccupied { cause: join(["nvidia-smi could not run: ", why as String], "") as NonEmptyStr }
-          RemoteRan { exit_code: c2, stdout: apps, stderr: e2 } =>
-            if c2 != 0 { V41HostOccupied { cause: join(["nvidia-smi exited ", to_string(c2), ": ", trim(s: e2)], "") as NonEmptyStr } } else { v41_judge_occupancy(meminfo: mem, compute_csv: apps) }
-        }
-      }
-  }
-}
-
-// ── ASKING IT ───────────────────────────────────────────────────────────────────────────────────
-fn v41_differential_remove_containers(ctx: SparkMaterializeContext) -> String? {
-  match spark_remote_run(ctx: ctx, argv: argv_words(command: docker_ps_running_command(filter: DockerPsByLabel { label: v41_differential_lane_label }))) {
-    RemoteUnreachable { cause: why, reach: _ } => Present { value: join(["docker ps did not run: ", why as String], "") }
-    RemoteRan { exit_code: c, stdout: out, stderr: e } =>
-      if c != 0 { Present { value: join(["docker ps exited ", to_string(c), ": ", trim(s: e)], "") } } else {
-        let failures = flat_map(filter(split(s: out, delimiter: "\n"), w => trim(s: w) != ""), id =>
-          match spark_remote_run(ctx: ctx, argv: argv_words(command: docker_remove_force_command(name: trim(s: id) as NonEmptyStr))) {
-            RemoteUnreachable { cause: why, reach: _ } => [join(["docker rm -f ", trim(s: id), " did not run: ", why as String], "")]
-            RemoteRan { exit_code: rc, stdout: _, stderr: re } => if rc == 0 { [] as List<String> } else { [join(["docker rm -f ", trim(s: id), " exited ", to_string(rc), ": ", trim(s: re)], "")] }
-          })
-        if length(failures) != 0 { Present { value: join(failures, "; ") } } else { none }
-      }
-  }
-}
-
-fn v41_differential_on(ctx: SparkMaterializeContext, claim: NonEmptyStr, image: NonEmptyStr, manifest: String, owed: List<V41StoreKey>) -> V41DifferentialOutcome {
-  match spark_remote_run(ctx: ctx, argv: argv_words(command: docker_image_inspect_command(image: image))) {
-    RemoteUnreachable { cause: why, reach: _ } => V41DifferentialRefused { step: "image-config-id" as NonEmptyStr, cause: why }
-    RemoteRan { exit_code: code, stdout: inspect_stdout, stderr: err } =>
-      if code != 0 {
-        if docker_image_inspect_names_no_such_image(stderr: err) {
-          V41DifferentialRefused { step: "image-config-id" as NonEmptyStr, cause: "the target's docker daemon does not hold the differential image" as NonEmptyStr }
-        } else {
-          V41DifferentialRefused { step: "image-config-id" as NonEmptyStr, cause: join(["exit=", to_string(code), " stderr=", trim(s: err)], "") as NonEmptyStr }
-        }
-      } else {
-        match docker_image_inspect_id_from_stdout(stdout: inspect_stdout) {
-          DockerImageInspectIdUnreadable { cause: why } => V41DifferentialRefused { step: "image-config-id" as NonEmptyStr, cause: why }
-          DockerImageInspectId { id: config_id } => {
-            let outcome = match spark_remote_run(ctx: ctx, argv: v41_differential_argv(image: config_id, claim: claim, manifest: manifest)) {
-              RemoteUnreachable { cause: why, reach: _ } => V41DifferentialRefused { step: "differential-run" as NonEmptyStr, cause: why }
-              RemoteRan { exit_code: c, stdout: out, stderr: e } =>
-                if c == 0 || c == 1 {
-                  v41_admit_differential(image_config: config_id, owed: owed, stdout: out)
-                } else {
-                  V41DifferentialRefused { step: "differential-run" as NonEmptyStr, cause: join(["exit=", to_string(c), " stderr=", trim(s: e)], "") as NonEmptyStr }
-                }
-            }
-            match v41_differential_remove_containers(ctx: ctx) {
-              Absent => outcome
-              Present { value: why } => V41DifferentialRefused { step: "container-removal" as NonEmptyStr, cause: join(["the differential's container could not be removed, so the release will find residue: ", why], "") as NonEmptyStr }
-            }
-          }
-        }
-      }
-  }
-}
-
-// ── THE FLEET-CONVERGE ENTRY ────────────────────────────────────────────────────────────────────
-data v41_differential_attempt_raw: String = "v41-engram-differential-ci"
-data v41_differential_receipt_path: String = "target/v41-engram-differential-receipt.txt"
-data v41_differential_host_purpose: NonEmptyStr = "the design-B Engram differential, which starts one GPU container that reads sampled rows of the row stores read-only" as NonEmptyStr
-data v41_differential_host_effect_term: Second = second(count: 3600)
-
-fn v41_differential_residue() -> HostEffectResidueSpec {
-  HostEffectResidueSpec { process_pattern: v41_differential_process_pattern, container: Present { value: DockerPsByLabel { label: v41_differential_lane_label } } }
-}
-
-fn v41_differential_receipt_exit(at: String, host: HostIdentity, executor: String, anchor_receipt: String, outcome: V41DifferentialOutcome) -> ProcessExit {
-  let body = join([
-    join(["v41 engram differential probed_at=", at, " host=", host as String, "\n"], ""),
-    v41_differential_body(o: outcome),
-    join(["executor=", executor, "\n"], ""),
-    anchor_receipt,
-  ], "")
-  let w = Filesystem.Write(path: v41_differential_receipt_path, content: body)
-  if !w.success {
-    exit_failure(reason: join(["v41 engram differential receipt write failed: ", w.error], ""))
-  } else {
-    match outcome {
-      V41DifferentialRead { image_config: _, stores: _ } => ExitSuccess
-      V41DifferentialRefused { step: _, cause: _ } => exit_failure(reason: join(["the engram differential refused:\n", body], ""))
-    }
-  }
-}
-
-// THE INPUTS ARE DERIVED BEFORE ANY HOST IS TOUCHED: the image from its binding (refusing while none carries the overlay), the
-// manifest from the row-store model; either refusing stops the run with nothing claimed.
-fn v41_engram_differential_ci_wet() -> ProcessExit
-{
-  let now = clock_now_probed_at()
-  match v41_differential_image {
-    ImageLacksEngramOverlay { trigger: t } => exit_failure(reason: join(["ImageLacksEngramOverlay: no image carrying the file-backed Engram overlay is bound, so the differential cannot run its module; nothing was claimed or run. Waiting on: ", t as String], ""))
-    DifferentialImageBuilt { image: produced } => {
-      let image = render_oci_content_digest_wire(d: produced.config) as NonEmptyStr
-      match v41_row_store_spec(population: map(deepseek_v4_1_flash_engram_sharded_entries, e => e.entry), partition: v41_candidate_partition, tables: deepseek_v4_1_flash_engram, head_sizes: v41_live_head_sizes(tables: deepseek_v4_1_flash_engram)) {
-        V41RowStoreSpecRefused { defects: d } => exit_failure(reason: join(["the row-store spec refused: ", join(map(d, x => x as String), "; ")], ""))
-        V41RowStoreSpecAdmitted { spec: spec } =>
-          match v41_engram_store_manifest(spec: spec, readings: v41_published_store_readings) {
-            V41StoreManifestRefused { causes: cs } => exit_failure(reason: join(["the store manifest refused: ", join(cs, "; ")], ""))
-            V41StoreManifestDerived { text: manifest, stores: _ } => {
-              let owed = flat_map(spec.layers, t => map(t.ranks, r => V41StoreKey { layer: t.layer, rank: r.rank }))
-              v41_differential_on_target(now_word: probed_at_word(reading: now) as String, image: image, manifest: manifest, owed: owed)
-            }
-          }
-      }
-    }
-  }
-}
-
-fn v41_differential_on_target(now_word: String, image: NonEmptyStr, manifest: String, owed: List<V41StoreKey>) -> ProcessExit {
-  match spark_converge_target_selection(execute_apply: true) {
-    SparkConvergeTargetRefused { reason: why } => exit_failure(reason: why)
-    SparkConvergeTargetAllObserveOnly =>
-      exit_failure(reason: "SPARK_CONVERGE_TARGET is unset: this mode starts a GPU container on ONE host, so it refuses rather than choosing one")
-    SparkConvergeTargetSingle { host: target_host } =>
-      match admit_host_held_by_subject(raw: target_host, subject: PairServingUnitOn { group: FabricGroupA }) {
-        Present { value: why } => exit_failure(reason: why)
-        Absent =>
-          match observe_executor_reach() {
-            ExecutorReachUnknown { cause: c } => exit_failure(reason: join(["v41_engram_differential_ci: ", c], ""))
-            ExecutorReachKnown { short_hostname: executor, path: path } =>
-              match read_bootstrap_credential() {
-                BootstrapCredentialNotMaterialized { cause: c } => exit_failure(reason: c as String)
-                BootstrapCredentialReady { secret: administrator } =>
-                  match fleet_ssh_attempt_identity(raw: v41_differential_attempt_raw) {
-                    Absent => exit_failure(reason: "attempt identity is not a safe path segment")
-                    Present { value: attempt } => {
-                      let materialization = materialize_fleet_known_hosts_anchor(attempt: attempt)
-                      match fleet_openssh_trust_policy_of(outcome: materialization) {
-                        Absent => exit_failure(reason: join(["trust could not be established, so no leg ran: ", known_hosts_materialization_receipt(outcome: materialization)], ""))
-                        Present { value: trust } =>
-                          match with_materialized_ssh_key_file(
-                            identity_file_name: "gunbc-v41-engram-differential-admin-password" as NonEmptyStr,
-                            secret_bytes: administrator as Secret,
-                            use: fn(file) {
-                              let ctx = SparkMaterializeContext { host: target_host, trust: trust, path: path, admin_credential: administrator as Secret, admin_credential_file: file, executor: HostCli }
-                              match v41_read_occupancy(ctx: ctx) {
-                                V41HostOccupied { cause: why } => exit_failure(reason: join([target_host as String, " is occupied, so nothing was claimed or run: ", why as String], ""))
-                                V41HostFree { available: _ } =>
-                                  match claim_host_effect_live(host: target_host, purpose: v41_differential_host_purpose, term: v41_differential_host_effect_term, residue: v41_differential_residue()) {
-                                    HostEffectClaimNotLanded { cause: why } => exit_failure(reason: why as String)
-                                    HostEffectClaimLanded { handle: handle } =>
-                                      release_host_effect_live_over(
-                                        handle: Present { value: handle },
-                                        run: fn(argv) { spark_remote_argv_run(ctx: ctx, argv: argv) },
-                                        exit: v41_differential_receipt_exit(
-                                          at: now_word,
-                                          host: target_host,
-                                          executor: executor,
-                                          anchor_receipt: known_hosts_materialization_receipt(outcome: materialization),
-                                          outcome: v41_differential_on(ctx: ctx, claim: handle.claim as NonEmptyStr, image: image, manifest: manifest, owed: owed),
-                                        ),
-                                      )
-                                  }
-                              }
-                            },
-                          ) {
-                            MaterializedSshKeyFileBracketRefused { cause: c } => exit_failure(reason: c as String)
-                            MaterializedSshKeyFileBracketCompleted { value: exit } => exit
-                          }
-                      }
-                    }
-                  }
-              }
-          }
-      }
-  }
-}
diff --git a/dag/gunbc/spark/v41_engram_file_backed.dag b/dag/gunbc/spark/v41_engram_file_backed.dag
deleted file mode 100644
index 2f3ea5a744d..00000000000
--- a/dag/gunbc/spark/v41_engram_file_backed.dag
+++ /dev/null
@@ -1,164 +0,0 @@
-module gunbc.spark.v41_engram_file_backed
-
-import std.types { String, Bool, List, NonEmptyStr }
-import std.nat { Nat }
-import std.integer { UInt8 }
-import std.measure { ByteSize, byte_size_count, Microsecond, microsecond, microsecond_count }
-import std.optional { Present, Absent }
-import v2.std.algebra { filter, length, skip }
-import std.list { distinct_by_key }
-import gunbc.spark.v41_engram_row_store {
-  V41RowStoreEncodingSpec, V41CompleteStore,
-  v41_row_bytes, v41_row_store_magic_size,
-}
-
-// ── THE FILE-BACKED OVERLAY'S OPEN AND GATHER CONTRACTS ─────────────────────────────────────────
-//
-// dag/gunbc/spark/patches/d2d649e6/engram_file_backed.py.patch FileBackedEngramStorage realizes
-// what this module declares; the patch is the realization and these are its facts.
-//
-// OPEN. Whole-file SHA-256 verification stays, and it stays fail-closed. What goes is its residue:
-// on a DGX Spark the CPU and GPU share one LPDDR5x pool, so the page cache the sequential verify
-// read leaves behind is ordinary memory taken from weights and KV. After verifying, open releases
-// the verified range (POSIX_FADV_DONTNEED) and reads its residency back (mincore). The receipt
-// carries both readings, and open is admitted only when the readback is zero over the whole file.
-//
-// GATHER. fetch_rows is one batched gather: every requested offset must be a record boundary of
-// this store (magic, then k whole records, with the record inside the file), and the rows come back
-// in request order, each exactly the record v41_place_row put at that address. A shifted offset
-// would read the tail of one record and the head of the next, a plausible row of the wrong bytes,
-// so it refuses rather than being read.
-//
-// THE REALIZATION MIRRORS THIS, BRANCH FOR BRANCH. FileBackedEngramStorage._verify_and_release raises
-// on exactly the two refusals of v41_open_residency_verdict (verified != fstat size; any residue after
-// release), and EngramStoreOpenReceipt carries V41StoreOpenReceipt's four fields. _record_index raises
-// on exactly the non-record offsets v41_is_record_offset rejects. The Python refuses at runtime because
-// a Spark rank cannot call this fold; the fold is the declaration those raises realize.
-//
-// CONSUMER: A DECLARED FRONTIER. The wiring has landed: FileBackedParallelEngramEmbedding opens each
-// (layer, rank) store through allocate_file_backed, whose open refuses as this verdict does. What
-// remains is the read-back: each rank's EngramStoreOpenReceipt, taken from the measurement serve's
-// worker log (the V4.1 capacity measurement's wet runner), is read into
-// gunbc.spark.v41_runtime_candidate beside v41_published_store_readback_readings and folded through this
-// verdict, so a rank that verified but stayed resident refuses the candidate, not only its own open.
-// v41_gather_rows' consumer is the same change's differential over boundary rows of a published store.
-// Until then both are exercised by test.claim.spark.v41_engram_file_backed_witness over supplied
-// receipts and fixture stores. The patch's measure_fetch_rows / __main__ is the named instrument for
-// fetch_rows time; its readings are not transcribed here.
-
-type V41StoreOpenReceipt sole_constructor {
-  store_bytes: ByteSize
-  verified_bytes: ByteSize
-  resident_after_verify: ByteSize
-  resident_after_release: ByteSize
-}
-
-fn v41_store_open_receipt(store_bytes: ByteSize, verified_bytes: ByteSize, resident_after_verify: ByteSize, resident_after_release: ByteSize) -> V41StoreOpenReceipt {
-  V41StoreOpenReceipt { store_bytes: store_bytes, verified_bytes: verified_bytes, resident_after_verify: resident_after_verify, resident_after_release: resident_after_release }
-}
-
-type V41OpenResidency
-  = V41OpenReleased { receipt: V41StoreOpenReceipt }
-  | V41OpenResidueRefused { defect: NonEmptyStr }
-
-fn v41_open_residency_verdict(r: V41StoreOpenReceipt) -> V41OpenResidency {
-  if byte_size_count(b: r.verified_bytes) != byte_size_count(b: r.store_bytes) {
-    V41OpenResidueRefused { defect: join(["verified ", to_string(byte_size_count(b: r.verified_bytes)), " of ", to_string(byte_size_count(b: r.store_bytes)), " store bytes; verification is over the whole file"], "") as NonEmptyStr }
-  } else if byte_size_count(b: r.resident_after_release) != 0 {
-    V41OpenResidueRefused { defect: join([to_string(byte_size_count(b: r.resident_after_release)), " verified bytes remain page-cache resident after release (", to_string(byte_size_count(b: r.resident_after_verify)), " after verify)"], "") as NonEmptyStr }
-  } else {
-    V41OpenReleased { receipt: r }
-  }
-}
-
-type V41Gather
-  = V41Gathered { rows: List<List<UInt8>> }
-  | V41GatherRefused { defect: NonEmptyStr }
-
-fn v41_is_record_offset(spec: V41RowStoreEncodingSpec, store_len: Nat, offset: ByteSize) -> Bool {
-  let magic = byte_size_count(b: v41_row_store_magic_size())
-  let record = byte_size_count(b: v41_row_bytes(g: spec.geometry))
-  let o = byte_size_count(b: offset)
-  o >= magic && (o - magic) % record == 0 && o + record <= store_len
-}
-
-fn v41_gather_rows(store: V41CompleteStore, spec: V41RowStoreEncodingSpec, offsets: List<ByteSize>) -> V41Gather {
-  let record = byte_size_count(b: v41_row_bytes(g: spec.geometry))
-  let n = length(store.bytes)
-  let misaligned = filter(offsets, o => !v41_is_record_offset(spec: spec, store_len: n, offset: o))
-  match first(misaligned) {
-    Present { value: o } => V41GatherRefused { defect: join(["offset ", to_string(byte_size_count(b: o)), " is not magic + k * ", to_string(record), " inside a ", to_string(n), "-byte store"], "") as NonEmptyStr }
-    Absent => V41Gathered { rows: map(offsets, o => store.bytes |> skip(n: byte_size_count(b: o)) |> take(n: record)) }
-  }
-}
-
-// ── THE TOUCH COUNTER: DISTINCT (FILE, PAGE) PAIRS A GATHER READ ────────────────────────────────
-//
-// A row at offset o reads bytes [o, o + record), so it touches every page from o / page to
-// (o + record - 1) / page: a row straddling a page boundary touches both pages, and a repeated
-// offset touches nothing new. The count is over page indices only; no row content is observed.
-// FileBackedEngramStorage._note_touches realizes this fold as a bit-packed bitmap over the file's
-// page count (one bit per page, ~1.5 MiB for a 47 GiB file at 4 KiB pages), vectorized over the
-// batch with no per-row Python loop, and after the gather so it cannot change the returned bytes.
-// Distinct pages are per file; (file, page) pairs across a rank's files are the sum of per-file
-// counts, because pages of different files are different pairs.
-//
-// V41FetchTouchReceipt is EngramFetchTouchObservation's fields: the cumulative reading since open
-// or the last reset. snapshot_touches(reset) takes it atomically with the reset, so one staircase
-// step is one snapshot-and-reset; write_touch_receipt writes a rank's per-file readings as one
-// JSON receipt by temp + rename.
-//
-// CONSUMER: A DECLARED FRONTIER. gunbc.spark.v41_capacity_measurement V41EngramLookupObservable's
-// EngramLookupObserved arm (owner of that module: the capacity-measurement lane) reads a rank's
-// receipts through v41_rank_touches, which dissolves TouchCounterUnavailable there. The rank side has
-// landed: a worker serving file-backed writes rank<r>.json on SIGUSR2 (register_touch_storage), or
-// rank<r>.unavailable when it cannot install the handler; the wet runner signals each rank at a step
-// boundary and reads the receipts. Until then, test.claim.spark.v41_engram_file_backed_witness exercises
-// the fold and the rank sum over supplied offsets and receipts.
-
-type V41FetchTouchReceipt sole_constructor {
-  page_bytes: ByteSize
-  page_count: Nat
-  distinct_pages_touched: Nat
-  fetch_rows_calls: Nat
-  rows_fetched: Nat
-  fetch_rows_time: Microsecond
-}
-
-fn v41_fetch_touch_receipt(page_bytes: ByteSize, page_count: Nat, distinct_pages_touched: Nat, fetch_rows_calls: Nat, rows_fetched: Nat, fetch_rows_time: Microsecond) -> V41FetchTouchReceipt {
-  V41FetchTouchReceipt { page_bytes: page_bytes, page_count: page_count, distinct_pages_touched: distinct_pages_touched, fetch_rows_calls: fetch_rows_calls, rows_fetched: rows_fetched, fetch_rows_time: fetch_rows_time }
-}
-
-fn v41_row_pages(acc: List<Nat>, page: Nat, remaining: Int) -> List<Nat> {
-  if remaining <= 0 { acc } else { v41_row_pages(acc: acc |> list_push(page), page: page + 1, remaining: remaining - 1) }
-}
-
-// The distinct pages a batch of offsets touches, in first-touch order: every covered page is
-// collected once per row, then deduplicated in one keyed pass (std.list distinct_by_key), so the
-// fold is linear in the pages covered, never a membership scan per page. record and page are >= 1.
-fn v41_touched_pages(offsets: List<ByteSize>, record: ByteSize, page: ByteSize) -> List<Nat> {
-  let r = byte_size_count(b: record)
-  let p = byte_size_count(b: page)
-  let covered = fold(offsets, init: [] as List<Nat>, f: (acc, o) => {
-    let first = byte_size_count(b: o) / p
-    let last = (byte_size_count(b: o) + r - 1) / p
-    v41_row_pages(acc: acc, page: first, remaining: last - first + 1)
-  })
-  distinct_by_key(covered, n => to_string(n))
-}
-
-type V41RankTouches {
-  distinct_pages_touched: Nat
-  fetch_rows_calls: Nat
-  rows_fetched: Nat
-  fetch_rows_time: Microsecond
-}
-
-fn v41_rank_touches(files: List<V41FetchTouchReceipt>) -> V41RankTouches {
-  V41RankTouches {
-    distinct_pages_touched: fold(files, init: 0, f: (acc, r) => acc + r.distinct_pages_touched),
-    fetch_rows_calls: fold(files, init: 0, f: (acc, r) => acc + r.fetch_rows_calls),
-    rows_fetched: fold(files, init: 0, f: (acc, r) => acc + r.rows_fetched),
-    fetch_rows_time: microsecond(count: fold(files, init: 0, f: (acc, r) => acc + microsecond_count(m: r.fetch_rows_time))),
-  }
-}
diff --git a/dag/gunbc/spark/v41_engram_row_store.dag b/dag/gunbc/spark/v41_engram_row_store.dag
deleted file mode 100644
index a3280782eaa..00000000000
--- a/dag/gunbc/spark/v41_engram_row_store.dag
+++ /dev/null
@@ -1,1264 +0,0 @@
-module gunbc.spark.v41_engram_row_store
-
-import std.types { String, Bool, List, NonEmptyStr, Int, Map }
-import std.nat { Nat }
-import std.integer { UInt8, qualified_octet_members }
-import extdeps.numeric.base16 { base16_decode_lower }
-import std.bytes { bytes_octets, utf8_encode_bytes }
-import std.decl_ref { DeclarationRef, declaration_ref_display_key }
-import std.content_hash { ContentHash, Sha256Hash, Sha256Digest, Sha256DigestHex, sha256_hex_digest, serialize_content_hash }
-import std.artifact_store { ArtifactRealizationInput, artifact_realization_digest }
-import std.measure { ByteSize, byte_size, byte_size_count, measure_add }
-import std.optional { Present, Absent }
-import extdeps.safetensors.format {
-  SafetensorsEntry, SafetensorsDtype,
-  safetensors_dtype_byte_width, safetensors_dtype_token,
-  SafetensorsShardedEntry, SafetensorsShardFile, safetensors_entry_span, safetensors_shard_declared_overhead,
-  ShardBoundsResolved, ShardBoundsDuplicated, ShardBoundsAbsent, safetensors_shard_bounds_resolution,
-}
-import extdeps.toolchain.architecture_profile { Endianness, LittleEndian, endianness_token }
-import extdeps.vllm.engram_layout { VllmEngramRankRows, vllm_engram_head_sizes, vllm_engram_rank_rows, vllm_engram_sum, vllm_engram_every_rank_has_heads, vllm_engram_count_up }
-import extdeps.deepseek.deepseek_v4_1_flash { DeepseekV41EngramTables, deepseek_v4_1_flash_engram }
-import gunbc.spark.v41_identity_input { V41EngramResidencyPartition, v41_input }
-import gunbc.fabric.engram_materialization { engram_component_identity }
-
-// ── A RANK-LOCAL ENGRAM ROW STORE, AS ITS CONSUMER READS IT ────────────────────────────────────
-//
-// THE CONSUMER CONTRACT, and every choice below answers to it rather than to taste:
-//
-//   dag/gunbc/spark/patches/d2d649e6/engram_file_backed.py.patch  FileBackedEngramStorage
-//     - opens ONE path per instance, checks the SHA-256 OF THE WHOLE FILE against rank_digest_hex,
-//       then checks the file begins with expected.magic;
-//     - fetch_rows(offsets, nbytes) copies nbytes contiguous bytes from each offset into one staging
-//       row, so a row's weight and scale are ONE contiguous record.
-//   vllm d2d649e6 vllm/models/deepseek_v4_1/nvidia/engram.py   Engram._create_embedding
-//     - one ParallelEngramEmbedding per Engram LAYER, so a store is per (layer, rank).
-//   vllm d2d649e6 vllm/models/deepseek_v4_1/common/engram.py   BaseParallelEngramEmbedding
-//     - rank k holds the CONTIGUOUS bucket rows [vocab_start, vocab_end) of its hash heads, and the
-//       lookup indexes local = row - vocab_start (extdeps.vllm.engram_layout derives the ranges).
-//
-// So a store is: v41_row_store_magic, then for local row 0, 1, 2, ... of that rank's range the
-// record weight_row || scale_row, packed with no padding. Its identity is the SHA-256 of exactly
-// those bytes -- the check open() performs -- carried as std.content_hash Sha256Hash.
-//
-// WHAT THIS REPLACED (2026-09-22). The first model interleaved rows by global_row % rank_count,
-// placed each TENSOR's row as its own record at the full record stride, put both layers in one
-// store, carried payloads as strings and keyed a rank by an FNV-1a structural hash of that string.
-// Every one of those disagreed with the consumer above: a row-%-4 store serves the wrong rows at
-// token time, a per-tensor record is not what fetch_rows reads, and no file's SHA-256 can equal an
-// FNV of a string. The FNV rank digest is deleted, not kept beside the new one.
-//
-// THE PATH EACH STORE IS OPENED AT is decided by its consumer, not here: this module keys stores by
-// (layer, rank), and gunbc.spark.v41_engram_store_manifest derives the launch manifest the file-backed
-// overlay reads -- each store's path from gunbc.spark.v41_row_store_encode v41_store_out_path and its
-// digest from v41_published_store_readings.
-data v41_row_store_format_revision: Nat = 2
-data v41_row_store_endianness: Endianness = LittleEndian
-data v41_row_store_rank_count: Nat = 4
-data v41_row_store_magic: NonEmptyStr = "ENGR1\n" as NonEmptyStr
-
-// THE PARTITION RULE IS THE PLACER, and it is upstream's. The reserved arms keep the scheme a closed
-// type that placement and the key both match on; they place nothing and are refused by name.
-type V41RowStorePartition
-  = ContiguousHeadBuckets
-  | RankMapReservedUninhabited
-
-type V41RowStoreOrder
-  = LocalAscendingWithinRankRange
-  | RowOrderReservedUninhabited
-
-data v41_row_store_partition: V41RowStorePartition = ContiguousHeadBuckets
-data v41_row_store_order: V41RowStoreOrder = LocalAscendingWithinRankRange
-
-fn v41_partition_token(p: V41RowStorePartition) -> NonEmptyStr {
-  match p {
-    ContiguousHeadBuckets => "contiguous-head-buckets" as NonEmptyStr
-    RankMapReservedUninhabited => "rank-map-reserved-uninhabited" as NonEmptyStr
-  }
-}
-
-fn v41_order_token(o: V41RowStoreOrder) -> NonEmptyStr {
-  match o {
-    LocalAscendingWithinRankRange => "local-ascending-within-rank-range" as NonEmptyStr
-    RowOrderReservedUninhabited => "row-order-reserved-uninhabited" as NonEmptyStr
-  }
-}
-
-fn v41_uninhabited_scheme_defects(spec: V41RowStoreEncodingSpec) -> List<NonEmptyStr> {
-  concat(
-    match spec.rank_map {
-      ContiguousHeadBuckets => [] as List<NonEmptyStr>
-      RankMapReservedUninhabited => ["rank map ReservedUninhabited is not a placement rule; a rank is refused rather than fabricated" as NonEmptyStr]
-    },
-    match spec.row_order {
-      LocalAscendingWithinRankRange => [] as List<NonEmptyStr>
-      RowOrderReservedUninhabited => ["row order ReservedUninhabited is not a concatenation rule; a store is refused rather than emptied" as NonEmptyStr]
-    })
-}
-
-// ── THE RECORD, DERIVED FROM THE TENSOR SHAPES ─────────────────────────────────────────────────
-
-type V41RowGeometry sole_constructor {
-  weight_dtype: SafetensorsDtype
-  scale_dtype: SafetensorsDtype
-  weight_width: Nat
-  scale_width: Nat
-}
-
-fn v41_row_geometry_of(weight_dtype: SafetensorsDtype, scale_dtype: SafetensorsDtype, weight_width: Nat, scale_width: Nat) -> V41RowGeometry {
-  V41RowGeometry { weight_dtype: weight_dtype, scale_dtype: scale_dtype, weight_width: weight_width, scale_width: scale_width }
-}
-
-fn weight_bytes(g: V41RowGeometry) -> ByteSize {
-  byte_size(count: g.weight_width * byte_size_count(b: safetensors_dtype_byte_width(d: g.weight_dtype)))
-}
-
-fn scale_bytes(g: V41RowGeometry) -> ByteSize {
-  byte_size(count: g.scale_width * byte_size_count(b: safetensors_dtype_byte_width(d: g.scale_dtype)))
-}
-
-fn v41_row_bytes(g: V41RowGeometry) -> ByteSize {
-  byte_size(count: byte_size_count(b: weight_bytes(g: g)) + byte_size_count(b: scale_bytes(g: g)))
-}
-
-fn v41_geometry_eq(a: V41RowGeometry, b: V41RowGeometry) -> Bool {
-  (safetensors_dtype_token(d: a.weight_dtype) as String) == (safetensors_dtype_token(d: b.weight_dtype) as String)
-    && (safetensors_dtype_token(d: a.scale_dtype) as String) == (safetensors_dtype_token(d: b.scale_dtype) as String)
-    && a.weight_width == b.weight_width && a.scale_width == b.scale_width
-}
-
-// ── ONE LAYER'S TABLE AND ITS RANK RANGES ──────────────────────────────────────────────────────
-
-type V41LayerTable sole_constructor {
-  layer: Nat
-  weight: NonEmptyStr
-  scale: NonEmptyStr
-  rows: Nat
-  ranks: List<VllmEngramRankRows>
-}
-
-fn v41_layer_table(layer: Nat, weight: NonEmptyStr, scale: NonEmptyStr, rows: Nat, ranks: List<VllmEngramRankRows>) -> V41LayerTable {
-  V41LayerTable { layer: layer, weight: weight, scale: scale, rows: rows, ranks: ranks }
-}
-
-fn v41_layer_index_from_tensor_name(name: NonEmptyStr) -> Nat? {
-  let parts = split(s: name as String, delimiter: ".")
-  match get(xs: parts, index: 0) {
-    Absent => none
-    Present { value: head } =>
-      if head != "layers" || length(parts) < 3 {
-        none
-      } else {
-        match get(xs: parts, index: 1) {
-          Absent => none
-          Present { value: idx } => match parse_int(s: idx) {
-            Absent => none
-            Present { value: n } => if n < 0 { none } else { Present { value: n } }
-          }
-        }
-      }
-  }
-}
-
-fn v41_dim(e: SafetensorsEntry, index: Nat) -> Nat? {
-  get(xs: e.shape, index: index)
-}
-
-fn v41_entry_in_layer(e: SafetensorsEntry, layer: Nat) -> Bool {
-  match v41_layer_index_from_tensor_name(name: e.name) {
-    Present { value: l } => l == layer
-    Absent => false
-  }
-}
-
-fn v41_dim_is(e: SafetensorsEntry, index: Nat, n: Nat) -> Bool {
-  match v41_dim(e: e, index: index) {
-    Present { value: d } => d == n
-    Absent => false
-  }
-}
-
-fn v41_is_scale_name(name: NonEmptyStr) -> Bool {
-  (name as String).ends_with(suffix: ".scale")
-}
-
-// ── THE ENCODING SPEC ──────────────────────────────────────────────────────────────────────────
-
-type V41RowStoreEncodingSpec sole_constructor {
-  component: DeclarationRef
-  partition: V41EngramResidencyPartition
-  layers: List<V41LayerTable>
-  geometry: V41RowGeometry
-  rank_count: Nat
-  format_revision: Nat
-  endianness: Endianness
-  row_order: V41RowStoreOrder
-  rank_map: V41RowStorePartition
-}
-
-fn v41_encoding_spec_of_layers(partition: V41EngramResidencyPartition, layers: List<V41LayerTable>, geometry: V41RowGeometry) -> V41RowStoreEncodingSpec {
-  V41RowStoreEncodingSpec {
-    component: engram_component_identity,
-    partition: partition,
-    layers: layers,
-    geometry: geometry,
-    rank_count: v41_row_store_rank_count,
-    format_revision: v41_row_store_format_revision,
-    endianness: v41_row_store_endianness,
-    row_order: v41_row_store_order,
-    rank_map: v41_row_store_partition,
-  }
-}
-
-fn v41_encoding_spec_override_endianness(spec: V41RowStoreEncodingSpec, endianness: Endianness) -> V41RowStoreEncodingSpec {
-  V41RowStoreEncodingSpec { component: spec.component, partition: spec.partition, layers: spec.layers, geometry: spec.geometry, rank_count: spec.rank_count, format_revision: spec.format_revision, endianness: endianness, row_order: spec.row_order, rank_map: spec.rank_map }
-}
-
-fn v41_encoding_spec_override_rank_map(spec: V41RowStoreEncodingSpec, rank_map: V41RowStorePartition) -> V41RowStoreEncodingSpec {
-  V41RowStoreEncodingSpec { component: spec.component, partition: spec.partition, layers: spec.layers, geometry: spec.geometry, rank_count: spec.rank_count, format_revision: spec.format_revision, endianness: spec.endianness, row_order: spec.row_order, rank_map: rank_map }
-}
-
-fn v41_encoding_spec_override_row_order(spec: V41RowStoreEncodingSpec, row_order: V41RowStoreOrder) -> V41RowStoreEncodingSpec {
-  V41RowStoreEncodingSpec { component: spec.component, partition: spec.partition, layers: spec.layers, geometry: spec.geometry, rank_count: spec.rank_count, format_revision: spec.format_revision, endianness: spec.endianness, row_order: row_order, rank_map: spec.rank_map }
-}
-
-type V41RowStoreSpecStanding
-  = V41RowStoreSpecAdmitted { spec: V41RowStoreEncodingSpec }
-  | V41RowStoreSpecRefused { defects: List<NonEmptyStr> }
-
-// THE LIVE SPEC, DERIVED. A layer with no storage-backed tensor has no store; the bucket layout is
-// still drawn over EVERY configured layer, because upstream's primes are never reused across layers.
-// The storage-backed names select a weight and a scale entry per layer; the
-// record geometry is read off their dtypes and second dimensions; the rank ranges are vLLM's layout
-// recomputed from the config facts. The derived bucket rows must equal each layer's published row
-// count -- the two come from different authorities, so a disagreement refuses rather than choosing one.
-// THE SELECTION DEFECTS, which need no bucket layout: a storage-backed name the population lacks, a
-// name that is not layers.<index>.*, or a layer the Engram config does not declare. Split out so a
-// consumer can refuse on them before it pays for the layout.
-fn v41_row_store_selection_defects(population: List<SafetensorsEntry>, partition: V41EngramResidencyPartition, tables: DeepseekV41EngramTables) -> List<NonEmptyStr> {
-  let selected = v41_selected_entries(population: population, partition: partition)
-  let missing = map(
-    filter(partition.storage_backed, n => !any(population, e => (e.name as String) == (n as String))),
-    n => join(["storage-backed tensor ", n as String, " is not in the supplied population; a missing member is not an empty store"], "") as NonEmptyStr)
-  let unnamed = map(filter(selected, e => match v41_layer_index_from_tensor_name(name: e.name) { Present { value: _ } => false  Absent => true }),
-    e => join(["tensor ", e.name as String, " does not decompose as layers.<index>.*; an unrecognized name is not a default layer"], "") as NonEmptyStr)
-  let unconfigured = map(filter(selected, e => match v41_layer_index_from_tensor_name(name: e.name) {
-      Present { value: l } => !any(tables.layer_ids, x => x == l)
-      Absent => false
-    }),
-    e => join(["tensor ", e.name as String, " names a layer the Engram config does not declare; it has no bucket layout and is refused rather than dropped"], "") as NonEmptyStr)
-  concat(concat(missing, unnamed), unconfigured)
-}
-
-fn v41_selected_entries(population: List<SafetensorsEntry>, partition: V41EngramResidencyPartition) -> List<SafetensorsEntry> {
-  filter(population, e => any(partition.storage_backed, n => (n as String) == (e.name as String)))
-}
-
-// THE LIVE BUCKET LAYOUT: vLLM's draw over the Engram config's own facts. It is the expensive half of
-// the spec (a Miller-Rabin search), so the spec takes the head sizes as an input and the live callers
-// pass this; a witness about the spec supplies them and test.claim.vllm.vllm_engram_layout_witness
-// runs the draw itself.
-fn v41_live_head_sizes(tables: DeepseekV41EngramTables) -> List<List<Int>> {
-  vllm_engram_head_sizes(layer_count: length(tables.layer_ids), max_ngram_size: tables.max_ngram_size, n_heads: tables.n_heads, vocab_size: tables.vocab_size)
-}
-
-fn v41_row_store_spec(population: List<SafetensorsEntry>, partition: V41EngramResidencyPartition, tables: DeepseekV41EngramTables, head_sizes: List<List<Int>>) -> V41RowStoreSpecStanding {
-  let selection = v41_row_store_selection_defects(population: population, partition: partition, tables: tables)
-  if length(selection) != 0 {
-    V41RowStoreSpecRefused { defects: selection }
-  } else {
-    let selected = v41_selected_entries(population: population, partition: partition)
-    let per_layer = map(filter(enumerate(tables.layer_ids), p => any(selected, e => v41_entry_in_layer(e: e, layer: p.second))), p => v41_layer_from_entries(layer: p.second, entries: filter(selected, e => v41_entry_in_layer(e: e, layer: p.second)), head_sizes: get(xs: head_sizes, index: p.first)))
-    let defects = flat_map(per_layer, r => r.defects)
-    if length(defects) != 0 {
-      V41RowStoreSpecRefused { defects: defects }
-    } else {
-      let layers = flat_map(per_layer, r => r.layer)
-      let geometries = flat_map(per_layer, r => r.geometry)
-      match first(geometries) {
-        Absent => V41RowStoreSpecRefused { defects: ["no storage-backed layer was selected; an empty row store is not a store" as NonEmptyStr] }
-        Present { value: g } =>
-          if !all(geometries, x => v41_geometry_eq(a: x, b: g)) {
-            V41RowStoreSpecRefused { defects: ["the storage-backed layers disagree on record geometry; one record stride cannot serve both" as NonEmptyStr] }
-          } else {
-            V41RowStoreSpecAdmitted { spec: v41_encoding_spec_of_layers(partition: partition, layers: layers, geometry: g) }
-          }
-      }
-    }
-  }
-}
-
-type V41LayerDerivation sole_constructor {
-  layer: List<V41LayerTable>
-  geometry: List<V41RowGeometry>
-  defects: List<NonEmptyStr>
-}
-
-fn v41_layer_refused(defect: String) -> V41LayerDerivation {
-  V41LayerDerivation { layer: [] as List<V41LayerTable>, geometry: [] as List<V41RowGeometry>, defects: [defect as NonEmptyStr] }
-}
-
-fn v41_layer_from_entries(layer: Nat, entries: List<SafetensorsEntry>, head_sizes: List<Int>?) -> V41LayerDerivation {
-  let scales = filter(entries, e => v41_is_scale_name(name: e.name))
-  let weights = filter(entries, e => !v41_is_scale_name(name: e.name))
-  if length(scales) != 1 || length(weights) != 1 {
-    v41_layer_refused(defect: join(["layer ", to_string(layer), " selects ", to_string(length(weights)), " weight and ", to_string(length(scales)), " scale tensors; a record needs exactly one of each"], ""))
-  } else {
-    match first(weights) {
-      Absent => v41_layer_refused(defect: "unreachable: one weight was counted")
-      Present { value: w } => match first(scales) {
-        Absent => v41_layer_refused(defect: "unreachable: one scale was counted")
-        Present { value: s } =>
-          match v41_dim(e: w, index: 0) {
-            Absent => v41_layer_refused(defect: join(["tensor ", w.name as String, " has no row extent; a missing extent is not zero rows"], ""))
-            Present { value: rows } => match v41_dim(e: w, index: 1) {
-              Absent => v41_layer_refused(defect: join(["tensor ", w.name as String, " has no row width"], ""))
-              Present { value: ww } => match v41_dim(e: s, index: 1) {
-                Absent => v41_layer_refused(defect: join(["tensor ", s.name as String, " has no row width"], ""))
-                Present { value: sw } =>
-                  if !v41_dim_is(e: s, index: 0, n: rows) {
-                    v41_layer_refused(defect: join(["layer ", to_string(layer), " weight and scale disagree on row count; a record pairs row i of each"], ""))
-                  } else {
-                    match head_sizes {
-                      Absent => v41_layer_refused(defect: join(["layer ", to_string(layer), " has no derived bucket layout"], ""))
-                      Present { value: hs } =>
-                        if vllm_engram_sum(xs: hs) != rows {
-                          v41_layer_refused(defect: join(["layer ", to_string(layer), ": vLLM's derived bucket layout sums to ", to_string(vllm_engram_sum(xs: hs)), " rows and the published table has ", to_string(rows), "; the rank ranges are not grounded"], ""))
-                        } else if !vllm_engram_every_rank_has_heads(n_hash_cols: length(hs), tp_size: v41_row_store_rank_count) {
-                          v41_layer_refused(defect: join(["layer ", to_string(layer), ": ", to_string(length(hs)), " hash heads leave a rank empty at tp ", to_string(v41_row_store_rank_count)], ""))
-                        } else {
-                          V41LayerDerivation {
-                            layer: [v41_layer_table(layer: layer, weight: w.name, scale: s.name, rows: rows, ranks: vllm_engram_rank_rows(head_sizes: hs, tp_size: v41_row_store_rank_count))],
-                            geometry: [v41_row_geometry_of(weight_dtype: w.dtype, scale_dtype: s.dtype, weight_width: ww, scale_width: sw)],
-                            defects: [] as List<NonEmptyStr>,
-                          }
-                        }
-                    }
-                  }
-              }
-            }
-          }
-      }
-    }
-  }
-}
-
-fn v41_layer_inputs(t: V41LayerTable) -> List<ArtifactRealizationInput> {
-  concat(
-    [
-      v41_input(identity: join(["layer.", to_string(t.layer), ".weight"], ""), value: t.weight as String),
-      v41_input(identity: join(["layer.", to_string(t.layer), ".scale"], ""), value: t.scale as String),
-      v41_input(identity: join(["layer.", to_string(t.layer), ".rows"], ""), value: to_string(t.rows)),
-    ],
-    map(t.ranks, r => v41_input(identity: join(["layer.", to_string(t.layer), ".rank.", to_string(r.rank), ".rows"], ""), value: join([to_string(r.start), "..", to_string(r.end)], ""))))
-}
-
-fn v41_encoding_spec_inputs(spec: V41RowStoreEncodingSpec) -> List<ArtifactRealizationInput> {
-  concat(concat([
-    v41_input(identity: "component", value: declaration_ref_display_key(ref: spec.component) as String),
-    v41_input(identity: "format_revision", value: to_string(spec.format_revision)),
-    v41_input(identity: "magic", value: v41_row_store_magic as String),
-    v41_input(identity: "endianness", value: endianness_token(e: spec.endianness) as String),
-    v41_input(identity: "row_order", value: v41_order_token(o: spec.row_order) as String),
-    v41_input(identity: "rank_map", value: v41_partition_token(p: spec.rank_map) as String),
-    v41_input(identity: "rank_count", value: to_string(spec.rank_count)),
-    v41_input(identity: "weight_dtype", value: safetensors_dtype_token(d: spec.geometry.weight_dtype) as String),
-    v41_input(identity: "scale_dtype", value: safetensors_dtype_token(d: spec.geometry.scale_dtype) as String),
-    v41_input(identity: "weight_width", value: to_string(spec.geometry.weight_width)),
-    v41_input(identity: "scale_width", value: to_string(spec.geometry.scale_width)),
-  ], flat_map(spec.partition.storage_backed.sort_by(n => n as String), n => [v41_input(identity: join(["storage.", n as String], ""), value: "storage-backed")])),
-    flat_map(spec.layers.sort_by(t => t.layer), t => v41_layer_inputs(t: t)))
-}
-
-fn v41_encoding_spec_key(spec: V41RowStoreEncodingSpec) -> ContentHash {
-  artifact_realization_digest(inputs: v41_encoding_spec_inputs(spec: spec))
-}
-
-// ── A STORE'S IDENTITY: (LAYER, RANK, SHA-256 OF THE FILE) ─────────────────────────────────────
-
-// THE DIGEST IS A SHA-256 BY TYPE, because the consumer compares the file's SHA-256 and nothing else;
-// a digest of another family is not writable here rather than refused later.
-type V41RankStoreIdentity sole_constructor {
-  layer: Nat
-  rank: Nat
-  digest: Sha256Digest
-}
-
-fn v41_rank_store_identity(layer: Nat, rank: Nat, digest: Sha256Digest) -> V41RankStoreIdentity {
-  V41RankStoreIdentity { layer: layer, rank: rank, digest: digest }
-}
-
-type V41RowStoreEncoding
-  = V41RowStoreEncodingIdentified {
-      spec: V41RowStoreEncodingSpec
-      spec_key: ContentHash
-      rank_stores: List<V41RankStoreIdentity>
-      content_digest: ContentHash
-    }
-  | V41RowStoreEncodingUnestablished { obligation: NonEmptyStr }
-  | V41RowStoreEncodingRefused { defects: List<NonEmptyStr> }
-
-fn v41_store_key(layer: Nat, rank: Nat) -> String {
-  join(["layer.", to_string(layer), ".rank.", to_string(rank)], "")
-}
-
-fn v41_ordered_stores(stores: List<V41RankStoreIdentity>) -> List<V41RankStoreIdentity> {
-  stores.sort_by(s => s.rank).sort_by(s => s.layer)
-}
-
-fn v41_rank_store_inputs(stores: List<V41RankStoreIdentity>) -> List<ArtifactRealizationInput> {
-  map(v41_ordered_stores(stores: stores), s => v41_input(identity: join([v41_store_key(layer: s.layer, rank: s.rank), ".sha256"], ""), value: serialize_content_hash(hash: Sha256Hash(s.digest)) as String))
-}
-
-// THE DECLARED STORE POPULATION: one (layer, rank) per spec layer per rank, as keys.
-fn v41_declared_store_keys(spec: V41RowStoreEncodingSpec) -> List<String> {
-  flat_map(spec.layers, t => map(vllm_engram_count_up(n: spec.rank_count), k => v41_store_key(layer: t.layer, rank: k)))
-}
-
-// HOW MANY TIMES EACH KEY OCCURS, as one pass into a map, so every membership and multiplicity test
-// below is a lookup rather than a scan of the other list.
-fn v41_key_counts(keys: List<String>) -> Map<String, Int> {
-  fold(keys, init: empty_map(), f: (acc, k) => map_insert(acc, k, v41_key_count(index: acc, key: k) + 1))
-}
-
-fn v41_key_count(index: Map<String, Int>, key: String) -> Int {
-  match map_get(index, key) {
-    Present { value: n } => n
-    Absent => 0
-  }
-}
-
-// IDENTIFIED ONLY OVER THE EXACT DECLARED POPULATION. A missing store, a duplicated one, or a store the
-// spec does not declare refuses; that each digest is a SHA-256 is the identity's type.
-fn v41_identify_row_store(spec: V41RowStoreEncodingSpec, rank_stores: List<V41RankStoreIdentity>) -> V41RowStoreEncoding {
-  let scheme = v41_uninhabited_scheme_defects(spec: spec)
-  let declared = v41_declared_store_keys(spec: spec)
-  let supplied = map(rank_stores, s => v41_store_key(layer: s.layer, rank: s.rank))
-  let declared_index = v41_key_counts(keys: declared)
-  let supplied_index = v41_key_counts(keys: supplied)
-  let missing = map(filter(declared, k => v41_key_count(index: supplied_index, key: k) == 0), k => join(["declared store ", k, " carries no digest; a missing store is not a store"], "") as NonEmptyStr)
-  let foreign = map(filter(supplied, s => v41_key_count(index: declared_index, key: s) == 0), s => join(["store ", s, " is not declared by the encoding spec"], "") as NonEmptyStr)
-  let duplicated = map(filter(declared, k => v41_key_count(index: supplied_index, key: k) > 1), k => join(["store ", k, " carries more than one digest"], "") as NonEmptyStr)
-  let defects = concat(concat(concat(scheme, missing), foreign), duplicated)
-  if length(defects) != 0 {
-    V41RowStoreEncodingRefused { defects: defects }
-  } else {
-    let spec_key = v41_encoding_spec_key(spec: spec)
-    V41RowStoreEncodingIdentified {
-      spec: spec,
-      spec_key: spec_key,
-      rank_stores: v41_ordered_stores(stores: rank_stores),
-      content_digest: artifact_realization_digest(inputs: concat(
-        [v41_input(identity: "spec", value: serialize_content_hash(hash: spec_key) as String)],
-        v41_rank_store_inputs(stores: rank_stores))),
-    }
-  }
-}
-
-// ── PLACEMENT: ONE PUBLISHED ROW TO ONE RECORD AT ONE OFFSET OF ONE STORE ──────────────────────
-
-// A SOURCE ROW IS BYTES: row `global_row` of a layer's weight table and of its scale table.
-type V41SourceRow sole_constructor {
-  layer: Nat
-  global_row: Nat
-  weight: List<UInt8>
-  scale: List<UInt8>
-}
-
-fn v41_source_row(layer: Nat, global_row: Nat, weight: List<UInt8>, scale: List<UInt8>) -> V41SourceRow {
-  V41SourceRow { layer: layer, global_row: global_row, weight: weight, scale: scale }
-}
-
-type V41PlacedRow sole_constructor {
-  layer: Nat
-  global_row: Nat
-  rank: Nat
-  local_row: Nat
-  offset: ByteSize
-  record: List<UInt8>
-}
-
-fn v41_placed_row_with_record(p: V41PlacedRow, record: List<UInt8>) -> V41PlacedRow {
-  V41PlacedRow { layer: p.layer, global_row: p.global_row, rank: p.rank, local_row: p.local_row, offset: p.offset, record: record }
-}
-
-type V41Placement
-  = V41Placed { row: V41PlacedRow }
-  | V41PlacementRefused { defect: NonEmptyStr }
-
-fn v41_magic_octets() -> List<UInt8> {
-  bytes_octets(b: utf8_encode_bytes(s: v41_row_store_magic as String))
-}
-
-fn v41_row_store_magic_size() -> ByteSize {
-  byte_size(count: length(v41_magic_octets()))
-}
-
-fn v41_layer_of(spec: V41RowStoreEncodingSpec, layer: Nat) -> V41LayerTable? {
-  first(filter(spec.layers, t => t.layer == layer))
-}
-
-// WHERE A ROW LIVES, without its bytes: the rank whose contiguous range holds it, its local row and
-// its byte offset in that store. The host realization reads at exactly this offset.
-type V41RowAddress sole_constructor {
-  layer: Nat
-  global_row: Nat
-  rank: Nat
-  local_row: Nat
-  offset: ByteSize
-}
-
-fn v41_row_address(spec: V41RowStoreEncodingSpec, layer: Nat, global_row: Nat) -> V41RowAddress? {
-  match spec.rank_map {
-    RankMapReservedUninhabited => none
-    ContiguousHeadBuckets => match v41_layer_of(spec: spec, layer: layer) {
-      Absent => none
-      Present { value: t } => match first(filter(t.ranks, r => r.start <= global_row && global_row < r.end)) {
-        Absent => none
-        Present { value: r } => {
-          let local = global_row - r.start
-          Present { value: V41RowAddress {
-            layer: layer, global_row: global_row, rank: r.rank, local_row: local,
-            offset: byte_size(count: byte_size_count(b: v41_row_store_magic_size()) + local * byte_size_count(b: v41_row_bytes(g: spec.geometry))),
-          } }
-        }
-      }
-    }
-  }
-}
-
-fn v41_place_row(row: V41SourceRow, spec: V41RowStoreEncodingSpec) -> V41Placement {
-  if length(row.weight) != byte_size_count(b: weight_bytes(g: spec.geometry)) {
-    V41PlacementRefused { defect: join(["row ", to_string(row.global_row), " of layer ", to_string(row.layer), " carries ", to_string(length(row.weight)), " weight bytes; the geometry declares ", to_string(byte_size_count(b: weight_bytes(g: spec.geometry)))], "") as NonEmptyStr }
-  } else if length(row.scale) != byte_size_count(b: scale_bytes(g: spec.geometry)) {
-    V41PlacementRefused { defect: join(["row ", to_string(row.global_row), " of layer ", to_string(row.layer), " carries ", to_string(length(row.scale)), " scale bytes; the geometry declares ", to_string(byte_size_count(b: scale_bytes(g: spec.geometry)))], "") as NonEmptyStr }
-  } else {
-    match v41_row_address(spec: spec, layer: row.layer, global_row: row.global_row) {
-      Absent => V41PlacementRefused { defect: join(["row ", to_string(row.global_row), " of layer ", to_string(row.layer), " is in no declared rank range"], "") as NonEmptyStr }
-      Present { value: a } => V41Placed { row: V41PlacedRow {
-        layer: a.layer, global_row: a.global_row, rank: a.rank, local_row: a.local_row, offset: a.offset,
-        record: concat(row.weight, row.scale),
-      } }
-    }
-  }
-}
-
-// ── A COMPLETE STORE'S BYTES ────────────────────────────────────────────────────────────────────
-//
-// THE DIGEST IS NOT TAKEN HERE. A store's identity is the SHA-256 of these bytes, the check open()
-// performs, and it is read where the bytes exist: sha256sum on the host that holds the store, supplied
-// to v41_identify_row_store as a Sha256Hash. This module owns the bytes exactly; the hash function is
-// extdeps.crypto.sha2's and sha256sum's, and is witnessed there.
-//
-// Defined only over a COMPLETE store: every local row of the rank's range placed exactly once. The
-// published stores are hundreds of millions of rows and are never built here; this is the definition
-// a host realization is differentially checked against, exercised in full over small spec fixtures.
-
-type V41CompleteStore sole_constructor {
-  layer: Nat
-  rank: Nat
-  bytes: List<UInt8>
-}
-
-type V41StoreBytes
-  = V41StoreComplete { store: V41CompleteStore }
-  | V41StoreIncomplete { defect: NonEmptyStr }
-
-fn v41_store_bytes(placed: List<V41PlacedRow>, spec: V41RowStoreEncodingSpec, layer: Nat, rank: Nat) -> V41StoreBytes {
-  match spec.row_order {
-    RowOrderReservedUninhabited => V41StoreIncomplete { defect: "row order ReservedUninhabited has no concatenation" as NonEmptyStr }
-    LocalAscendingWithinRankRange => match v41_layer_of(spec: spec, layer: layer) {
-      Absent => V41StoreIncomplete { defect: join(["layer ", to_string(layer), " is not declared"], "") as NonEmptyStr }
-      Present { value: t } => match first(filter(t.ranks, r => r.rank == rank)) {
-        Absent => V41StoreIncomplete { defect: join(["rank ", to_string(rank), " has no range in layer ", to_string(layer)], "") as NonEmptyStr }
-        Present { value: r } => {
-          let mine = filter(placed, p => p.layer == layer && p.rank == rank).sort_by(p => p.local_row)
-          let expected = r.end - r.start
-          if length(mine) != expected || !all(enumerate(mine), p => p.second.local_row == p.first) {
-            V41StoreIncomplete { defect: join(["store ", v41_store_key(layer: layer, rank: rank), " holds ", to_string(length(mine)), " placed rows of its ", to_string(expected), "-row range, not each local row exactly once"], "") as NonEmptyStr }
-          } else {
-            V41StoreComplete { store: V41CompleteStore { layer: layer, rank: rank, bytes: concat(v41_magic_octets(), flat_map(mine, p => p.record)) } }
-          }
-        }
-      }
-    }
-  }
-}
-
-// ── THE FIXTURE TRANSFORM: EVERY SUPPLIED ROW PLACED, EVERY STORE COMPLETE, EVERY DIGEST SHA-256 ─
-
-type V41TransformSubject
-  = V41FixtureRows { row_count: Nat, how: NonEmptyStr }
-  | V41PublishedEngramShards
-
-type V41TransformResult
-  = V41FixtureCorrespondenceHolds {
-      subject: V41FixtureRows
-      placed: List<V41PlacedRow>
-      stores: List<V41CompleteStore>
-    }
-  | V41PublishedTransformUnestablished { obligation: NonEmptyStr }
-  | V41TransformUnfaithful { defects: List<NonEmptyStr> }
-
-fn v41_place_all(rows: List<V41SourceRow>, spec: V41RowStoreEncodingSpec) -> List<V41Placement> {
-  map(rows, r => v41_place_row(row: r, spec: spec))
-}
-
-fn v41_placed_rows(placements: List<V41Placement>) -> List<V41PlacedRow> {
-  flat_map(placements, p => match p { V41Placed { row: r } => [r]  V41PlacementRefused { defect: _ } => [] as List<V41PlacedRow> })
-}
-
-fn v41_placement_defects(placements: List<V41Placement>) -> List<NonEmptyStr> {
-  flat_map(placements, p => match p { V41Placed { row: _ } => [] as List<NonEmptyStr>  V41PlacementRefused { defect: d } => [d] })
-}
-
-// A SOURCE ROW'S IMAGE: the placed record at its address must be exactly weight || scale. Placed rows
-// are indexed once by (layer, global_row) with their multiplicity, so each source row is one lookup.
-type V41PlacedIndexEntry sole_constructor {
-  count: Int
-  record: List<UInt8>
-}
-
-fn v41_row_key(layer: Nat, global_row: Nat) -> String {
-  join([to_string(layer), "#", to_string(global_row)], "")
-}
-
-fn v41_placed_index(placed: List<V41PlacedRow>) -> Map<String, V41PlacedIndexEntry> {
-  fold(placed, init: empty_map(), f: (acc, p) => {
-    let k = v41_row_key(layer: p.layer, global_row: p.global_row)
-    map_insert(acc, k, V41PlacedIndexEntry { count: v41_placed_count(index: acc, key: k) + 1, record: p.record })
-  })
-}
-
-fn v41_placed_count(index: Map<String, V41PlacedIndexEntry>, key: String) -> Int {
-  match map_get(index, key) {
-    Present { value: e } => e.count
-    Absent => 0
-  }
-}
-
-fn v41_lost_image_defects(source: List<V41SourceRow>, placed: List<V41PlacedRow>) -> List<NonEmptyStr> {
-  let index = v41_placed_index(placed: placed)
-  flat_map(source, s => {
-    let exact = match map_get(index, v41_row_key(layer: s.layer, global_row: s.global_row)) {
-      Present { value: e } => e.count == 1 && e.record == concat(s.weight, s.scale)
-      Absent => false
-    }
-    if exact {
-      [] as List<NonEmptyStr>
-    } else {
-      [join(["source row ", to_string(s.layer), "#", to_string(s.global_row), " has no exact placed image"], "") as NonEmptyStr]
-    }
-  })
-}
-
-fn v41_assess_placed(source: List<V41SourceRow>, spec: V41RowStoreEncodingSpec, placed: List<V41PlacedRow>) -> V41TransformResult {
-  let scheme = v41_uninhabited_scheme_defects(spec: spec)
-  let lost = v41_lost_image_defects(source: source, placed: placed)
-  let count = if length(source) == length(placed) { [] as List<NonEmptyStr> } else { [join(["placed ", to_string(length(placed)), " rows from ", to_string(length(source)), " source rows"], "") as NonEmptyStr] }
-  let early = concat(concat(scheme, lost), count)
-  if length(early) != 0 {
-    V41TransformUnfaithful { defects: early }
-  } else {
-    let stores = flat_map(spec.layers, t => map(vllm_engram_count_up(n: spec.rank_count), k => v41_store_bytes(placed: placed, spec: spec, layer: t.layer, rank: k)))
-    let incomplete = flat_map(stores, s => match s { V41StoreIncomplete { defect: d } => [d]  V41StoreComplete { store: _ } => [] as List<NonEmptyStr> })
-    if length(incomplete) != 0 {
-      V41TransformUnfaithful { defects: incomplete }
-    } else {
-      V41FixtureCorrespondenceHolds {
-        subject: V41FixtureRows { row_count: length(source), how: "supplied fixture rows over a fixture spec; not the published Engram tables" as NonEmptyStr },
-        placed: placed,
-        stores: flat_map(stores, s => match s { V41StoreComplete { store: c } => [c]  V41StoreIncomplete { defect: _ } => [] as List<V41CompleteStore> }),
-      }
-    }
-  }
-}
-
-fn v41_transform_fixture(source: List<V41SourceRow>, spec: V41RowStoreEncodingSpec) -> V41TransformResult {
-  let placements = v41_place_all(rows: source, spec: spec)
-  let refused = v41_placement_defects(placements: placements)
-  if length(refused) != 0 {
-    V41TransformUnfaithful { defects: refused }
-  } else {
-    v41_assess_placed(source: source, spec: spec, placed: v41_placed_rows(placements: placements))
-  }
-}
-
-fn v41_tampered_record_is_unfaithful(source: List<V41SourceRow>, spec: V41RowStoreEncodingSpec, tamper: List<UInt8>) -> Bool {
-  let placed = v41_placed_rows(placements: v41_place_all(rows: source, spec: spec))
-  match v41_assess_placed(source: source, spec: spec, placed: map(placed, p => if p.global_row == 0 { v41_placed_row_with_record(p: p, record: tamper) } else { p })) {
-    V41TransformUnfaithful { defects: d } => any(d, x => (x as String).contains("no exact placed image"))
-    V41FixtureCorrespondenceHolds { subject: _, placed: _, stores: _ } => false
-    V41PublishedTransformUnestablished { obligation: _ } => false
-  }
-}
-
-fn v41_dropped_source_row_is_unfaithful(source: List<V41SourceRow>, spec: V41RowStoreEncodingSpec) -> Bool {
-  match v41_assess_placed(source: source, spec: spec, placed: filter(v41_placed_rows(placements: v41_place_all(rows: source, spec: spec)), p => p.global_row != 0)) {
-    V41TransformUnfaithful { defects: d } => any(d, x => (x as String).contains("no exact placed image"))
-    V41FixtureCorrespondenceHolds { subject: _, placed: _, stores: _ } => false
-    V41PublishedTransformUnestablished { obligation: _ } => false
-  }
-}
-
-// THE PUBLISHED TABLES HAVE NO CONSTRUCTOR HERE, AND THE RUNG THAT COSTS IS DECLARED. Their stores are
-// built on the host from the materialized shards by the program gunbc.spark.v41_row_store_encode drives,
-// a realization of v41_place_row / v41_store_bytes that receives every layout fact from this spec. Its
-// output is admitted by DIFFERENTIAL agreement with this fold over a real published sample
-// (test.claim.spark.v41_row_store_encode_witness), which is weaker than the fold producing the bytes
-// itself: gunbc.rung_drop v41_row_store_host_realized_by_sample records the drop and its trigger (the
-// emitted .dag encoder encoding all eight stores). Identified is then minted by v41_identify_row_store
-// from the host's per-store sha256 (v41_published_store_readings, beside the row-store encoding key).
-fn v41_published_transform_standing() -> V41TransformResult {
-  V41PublishedTransformUnestablished {
-    obligation: "the published Engram stores (layers 1 and 14, four ranks each) have not been produced: a host realization of v41_place_row over the materialized shards, admitted by a differential claim over real published rows, is the only producer this module admits" as NonEmptyStr,
-  }
-}
-
-// ── READS ──────────────────────────────────────────────────────────────────────────────────────
-
-fn v41_encoding_digest_of(e: V41RowStoreEncoding) -> ContentHash? {
-  match e {
-    V41RowStoreEncodingIdentified { spec: _, spec_key: _, rank_stores: _, content_digest: d } => Present { value: d }
-    V41RowStoreEncodingUnestablished { obligation: _ } => none
-    V41RowStoreEncodingRefused { defects: _ } => none
-  }
-}
-
-fn v41_encoding_spec_of(e: V41RowStoreEncoding) -> V41RowStoreEncodingSpec? {
-  match e {
-    V41RowStoreEncodingIdentified { spec: s, spec_key: _, rank_stores: _, content_digest: _ } => Present { value: s }
-    V41RowStoreEncodingUnestablished { obligation: _ } => none
-    V41RowStoreEncodingRefused { defects: _ } => none
-  }
-}
-
-fn v41_encoding_spec_key_of(e: V41RowStoreEncoding) -> ContentHash? {
-  match e {
-    V41RowStoreEncodingIdentified { spec: _, spec_key: k, rank_stores: _, content_digest: _ } => Present { value: k }
-    V41RowStoreEncodingUnestablished { obligation: _ } => none
-    V41RowStoreEncodingRefused { defects: _ } => none
-  }
-}
-
-fn v41_rank_stores_of(e: V41RowStoreEncoding) -> List<V41RankStoreIdentity> {
-  match e {
-    V41RowStoreEncodingIdentified { spec: _, spec_key: _, rank_stores: rs, content_digest: _ } => rs
-    V41RowStoreEncodingUnestablished { obligation: _ } => [] as List<V41RankStoreIdentity>
-    V41RowStoreEncodingRefused { defects: _ } => [] as List<V41RankStoreIdentity>
-  }
-}
-
-fn v41_rank_digest_of(e: V41RowStoreEncoding, layer: Nat, rank: Nat) -> ContentHash? {
-  match first(filter(v41_rank_stores_of(e: e), r => r.layer == layer && r.rank == rank)) {
-    Present { value: row } => Present { value: Sha256Hash(row.digest) }
-    Absent => none
-  }
-}
-
-// ── THE PUBLISHED ROW-STORE ENCODING KEY: THE TRANSFORM'S INPUT, READ, PLUS ITS SPEC ──────────
-//
-// WHAT THE CANDIDATE'S row_store_encoding AXIS IS KEYED BY (ruling, proud-deer-538, 2026-09-21). The
-// encoding is a deterministic function of two things: the bytes of the storage-backed tensors in the
-// published shards, and this module's encoding spec. So the key is sha256 over one canonical text
-// naming the spec key and, for each storage-backed tensor, the shard, the file span and the sha256 of
-// exactly those bytes, read on a Spark from the materialized shard. A different table set changes both
-// the spec key and the set of spans, and a reading over any other region refuses, so the key names
-// this realization and nothing near it.
-//
-// THIS IS NOT THE FOUR ROW-STORE IDENTITIES, and the two must not be read as one fact. The rank files
-// are the encoder's PRODUCED artifacts. They are digested by whole-file sha256, which is what the
-// file-backed patch checks on open, and D1 authorizes over them as a readback of the encoder's output.
-// This key is the keyed side of that split, the same keyed-versus-produced split the runtime lane
-// keeps for the image digest. No encoder over the published shards exists yet, and this key does not
-// stand in for one.
-
-// WHERE EACH STORAGE-BACKED TENSOR'S BYTES ARE, DERIVED FROM THE PUBLISHER'S HEADER ROWS. A span's file
-// offset is the 8-byte length prefix plus the shard's JSON header plus the entry's payload-relative
-// begin; its length is the entry's span. The mode that reads the host consumes this same plan, so the
-// region read and the region admitted come from one derivation.
-type V41PublishedSpan {
-  tensor: NonEmptyStr
-  shard: NonEmptyStr
-  file_offset: ByteSize
-  length: ByteSize
-}
-
-type V41PublishedSpanPlan
-  = V41PublishedSpansPlanned { spans: List<V41PublishedSpan> }
-  | V41PublishedSpansUnplannable { defects: List<NonEmptyStr> }
-
-// ONE ENTRY'S SPAN, OR WHY IT HAS NONE. The shard-bounds relation is extdeps.safetensors.format's
-// (safetensors_shard_bounds_resolution), and its three arms are kept apart here: a duplicated bound row
-// is a contradiction in the supplied shard files, an absent one is a thing not yet read. Rendering
-// both as one sentence would erase a distinction the upstream model carries.
-type V41SpanResolution
-  = V41SpanResolved { span: V41PublishedSpan }
-  | V41SpanUnresolved { defect: NonEmptyStr }
-
-fn v41_published_span_of(e: SafetensorsShardedEntry, shards: List<SafetensorsShardFile>) -> V41SpanResolution {
-  match safetensors_shard_bounds_resolution(shards: shards, shard: e.shard) {
-    ShardBoundsResolved { shard: _, file: f } => V41SpanResolved { span: V41PublishedSpan {
-      tensor: e.entry.name,
-      shard: e.shard,
-      file_offset: measure_add(a: safetensors_shard_declared_overhead(header_bytes: f.header_bytes), b: byte_size(count: e.entry.begin_offset)),
-      length: safetensors_entry_span(e: e.entry),
-    } }
-    ShardBoundsDuplicated { shard: sd, rows: n } => V41SpanUnresolved { defect: join([
-      "shard ", sd as String, " of ", e.entry.name as String, " has ", to_string(n),
-      " shard file rows, so it carries that many header lengths and the span's file offset is contradicted",
-    ], "") as NonEmptyStr }
-    ShardBoundsAbsent { shard: sd } => V41SpanUnresolved { defect: join([
-      "shard ", sd as String, " of ", e.entry.name as String,
-      " has no shard file row, so its header length and the span's file offset are unread",
-    ], "") as NonEmptyStr }
-  }
-}
-
-// EACH SELECTED ENTRY IS RESOLVED ONCE, and that one list of outcomes is folded into both the defects
-// and the spans (DESIGN section 2: the shared ancestor carries the value rather than re-deriving it).
-fn v41_published_span_plan(partition: V41EngramResidencyPartition, sharded: List<SafetensorsShardedEntry>, shards: List<SafetensorsShardFile>) -> V41PublishedSpanPlan {
-  let missing = map(
-    filter(partition.storage_backed, n => length(filter(sharded, e => (e.entry.name as String) == (n as String))) != 1),
-    n => join(["storage-backed tensor ", n as String, " is not exactly one header row in the published population, so there is no span to read"], "") as NonEmptyStr)
-  let selected = filter(sharded, e => any(partition.storage_backed, n => (n as String) == (e.entry.name as String)))
-  let resolved = map(selected, e => v41_published_span_of(e: e, shards: shards))
-  let unbound = flat_map(resolved, r => match r {
-    V41SpanResolved { span: _ } => [] as List<NonEmptyStr>
-    V41SpanUnresolved { defect: d } => [d]
-  })
-  let defects = concat(missing, unbound)
-  if length(defects) != 0 { V41PublishedSpansUnplannable { defects: defects } } else {
-    V41PublishedSpansPlanned { spans: flat_map(resolved, r => match r {
-      V41SpanResolved { span: sp } => [sp]
-      V41SpanUnresolved { defect: _ } => [] as List<V41PublishedSpan>
-    }).sort_by(sp => sp.tensor as String) }
-  }
-}
-
-// ONE SPAN'S READING: the region that was read and the sha256 of exactly its bytes.
-type V41PublishedSpanDigest {
-  span: V41PublishedSpan
-  sha256: Sha256Digest
-}
-
-// THE RECEIPT OF A HOST READ. Unread is the standing until a dispatched read's receipt is transcribed
-// here from gunbc.spark.v41_checkpoint_materialize's receipt file, with the host and time it names.
-type V41PublishedSpanReadings
-  = V41PublishedSpansRead { host: NonEmptyStr, observed_at: NonEmptyStr, spans: List<V41PublishedSpanDigest> }
-  | V41PublishedSpansUnread { obligation: NonEmptyStr }
-
-type V41PublishedRowStoreKey
-  = V41PublishedRowStoreKeyed { digest: ContentHash }
-  | V41PublishedRowStoreUnestablished { obligation: NonEmptyStr }
-  | V41PublishedRowStoreRefused { defects: List<NonEmptyStr> }
-
-fn v41_span_eq(a: V41PublishedSpan, b: V41PublishedSpan) -> Bool {
-  (a.tensor as String) == (b.tensor as String) && (a.shard as String) == (b.shard as String) && byte_size_count(b: a.file_offset) == byte_size_count(b: b.file_offset) && byte_size_count(b: a.length) == byte_size_count(b: b.length)
-}
-
-// THE READINGS ARE JOINED TO THE PLAN BY IDENTITY, NOT COUNTED. Every planned span must be read
-// exactly once, over exactly its region; a reading of a tensor the plan does not name, or of the right
-// tensor over another region, refuses. That is the RED the brief names: a digest over a different table
-// set cannot key.
-// HOW MANY READINGS A PLANNED SPAN HAS. Counted once per plan row; the unread and twice arms read the count.
-type V41SpanReadCount {
-  span: V41PublishedSpan
-  readings: Nat
-}
-
-fn v41_span_reading_defects(plan: List<V41PublishedSpan>, read: List<V41PublishedSpanDigest>) -> List<NonEmptyStr> {
-  let counted = map(plan, sp => V41SpanReadCount { span: sp, readings: length(filter(read, r => v41_span_eq(a: r.span, b: sp))) })
-  let unread = map(filter(counted, c => c.readings == 0),
-    c => join(["the planned span of ", c.span.tensor as String, " (", c.span.shard as String, " at ", to_string(byte_size_count(b: c.span.file_offset)), " for ", to_string(byte_size_count(b: c.span.length)), " bytes) was not read"], "") as NonEmptyStr)
-  let twice = map(filter(counted, c => c.readings > 1),
-    c => join(["the span of ", c.span.tensor as String, " was read more than once, so which digest is its reading is undecided"], "") as NonEmptyStr)
-  let foreign = map(filter(read, r => !any(plan, sp => v41_span_eq(a: r.span, b: sp))),
-    r => join(["a reading of ", r.span.tensor as String, " (", r.span.shard as String, " at ", to_string(byte_size_count(b: r.span.file_offset)), " for ", to_string(byte_size_count(b: r.span.length)), " bytes) is not a span this partition stores"], "") as NonEmptyStr)
-  concat(concat(unread, twice), foreign)
-}
-
-// ── THE ROW-STORE ENCODING KEY: THE EIGHT ENCODED STORES, WITH THEIR INPUT JOINED ────────────
-//
-// WHAT KEYS THE CANDIDATE'S row_store_encoding AXIS (ruling, proud-deer-538, 2026-09-23): the ENCODED
-// stores, one per (layer, rank), each the SHA-256 the consumer checks on open. The key IS
-// v41_identify_row_store's content_digest -- the one derivation over the spec key and the ordered store
-// digests -- and not a second serialization of the same facts (review 70467). The source spans are the
-// encoder's INPUT identity, not the key: they must be read and joined to v41_published_span_plan by
-// identity (every planned span exactly once, over exactly its region) before a key is minted, so "the
-// stores were encoded from exactly these spans" is a join rather than an assumption, but their bytes do
-// not enter the key text. This replaces a key over the span digests alone (#12010), which keyed the
-// transform's input and not its output; the name changed with the meaning.
-
-// ONE STORE AS READ ON THE HOST: its identity (layer, rank, sha256) and the size of the file. The size is
-// the cheap cross-check that the encoder obeyed the derived layout: a store whose size is not
-// magic + rows x record bytes would be keyed by a digest over a file FileBackedEngramStorage cannot
-// open (proud-deer-538, 2026-09-24), so the key refuses it before identifying.
-type V41ObservedRankStore {
-  identity: V41RankStoreIdentity
-  size: ByteSize
-}
-
-// THE SIZE OF A STORE OF `rows` RECORDS: the magic, then one record per row. The one formula; the key's
-// check below and the encode plan's expected size (gunbc.spark.v41_row_store_encode) both call it.
-fn v41_store_size(spec: V41RowStoreEncodingSpec, rows: Nat) -> ByteSize {
-  byte_size(count: byte_size_count(b: v41_row_store_magic_size()) + rows * byte_size_count(b: v41_row_bytes(g: spec.geometry)))
-}
-
-// THE SIZE A (layer, rank) STORE MUST HAVE, from the spec: v41_store_size over the rank's range.
-fn v41_store_derived_size(spec: V41RowStoreEncodingSpec, layer: Nat, rank: Nat) -> ByteSize? {
-  match v41_layer_of(spec: spec, layer: layer) {
-    Absent => none
-    Present { value: t } => match first(filter(t.ranks, r => r.rank == rank)) {
-      Absent => none
-      Present { value: r } => Present { value: v41_store_size(spec: spec, rows: r.end - r.start) }
-    }
-  }
-}
-
-fn v41_store_size_defects(spec: V41RowStoreEncodingSpec, stores: List<V41ObservedRankStore>) -> List<NonEmptyStr> {
-  flat_map(stores, o => match v41_store_derived_size(spec: spec, layer: o.identity.layer, rank: o.identity.rank) {
-    Absent => [join(["store ", v41_store_key(layer: o.identity.layer, rank: o.identity.rank), " has no derived size: the spec declares no such store"], "") as NonEmptyStr]
-    Present { value: d } =>
-      if byte_size_count(b: d) == byte_size_count(b: o.size) { [] as List<NonEmptyStr> } else {
-        [join(["store ", v41_store_key(layer: o.identity.layer, rank: o.identity.rank), " is ", to_string(byte_size_count(b: o.size)), " bytes and the layout derives ", to_string(byte_size_count(b: d)), "; its digest is not keyed"], "") as NonEmptyStr]
-      }
-  })
-}
-
-type V41PublishedStoreReadings
-  = V41PublishedStoresRead { host: NonEmptyStr, observed_at: NonEmptyStr, stores: List<V41ObservedRankStore> }
-  | V41PublishedStoresUnread { obligation: NonEmptyStr }
-
-// THE HEAD SIZES ARRIVE AS A DEFERRED VALUE, computed only once both readings exist: an unread axis
-// costs no bucket-layout search, and the selection defects are still refused before any obligation.
-fn v41_row_store_encoding_key(partition: V41EngramResidencyPartition, sharded: List<SafetensorsShardedEntry>, shards: List<SafetensorsShardFile>, spans: V41PublishedSpanReadings, stores: V41PublishedStoreReadings, head_sizes: fn() -> List<List<Int>>) -> V41PublishedRowStoreKey {
-  let selection = v41_row_store_selection_defects(population: map(sharded, e => e.entry), partition: partition, tables: deepseek_v4_1_flash_engram)
-  if length(selection) != 0 { V41PublishedRowStoreRefused { defects: selection } } else {
-    match v41_published_span_plan(partition: partition, sharded: sharded, shards: shards) {
-      V41PublishedSpansUnplannable { defects: d } => V41PublishedRowStoreRefused { defects: d }
-      V41PublishedSpansPlanned { spans: plan } =>
-        match spans {
-          V41PublishedSpansUnread { obligation: o } => V41PublishedRowStoreUnestablished { obligation: match stores {
-            V41PublishedStoresUnread { obligation: so } => join([so as String, "; and ", o as String], "") as NonEmptyStr
-            V41PublishedStoresRead { host: _, observed_at: _, stores: _ } => o
-          } }
-          V41PublishedSpansRead { host: _, observed_at: _, spans: read } => {
-            let span_defects = v41_span_reading_defects(plan: plan, read: read)
-            if length(span_defects) != 0 { V41PublishedRowStoreRefused { defects: span_defects } } else {
-              match stores {
-                V41PublishedStoresUnread { obligation: o } => V41PublishedRowStoreUnestablished { obligation: o }
-                V41PublishedStoresRead { host: _, observed_at: _, stores: st } =>
-                  match v41_row_store_spec(population: map(sharded, e => e.entry), partition: partition, tables: deepseek_v4_1_flash_engram, head_sizes: head_sizes()) {
-                    V41RowStoreSpecRefused { defects: sd } => V41PublishedRowStoreRefused { defects: sd }
-                    V41RowStoreSpecAdmitted { spec: spec } => {
-                      let size_defects = v41_store_size_defects(spec: spec, stores: st)
-                      if length(size_defects) != 0 { V41PublishedRowStoreRefused { defects: size_defects } } else {
-                        match v41_identify_row_store(spec: spec, rank_stores: map(st, o => o.identity)) {
-                          V41RowStoreEncodingRefused { defects: d } => V41PublishedRowStoreRefused { defects: d }
-                          V41RowStoreEncodingUnestablished { obligation: o } => V41PublishedRowStoreUnestablished { obligation: o }
-                          V41RowStoreEncodingIdentified { spec: _, spec_key: _, rank_stores: _, content_digest: d } => V41PublishedRowStoreKeyed { digest: d }
-                        }
-                      }
-                    }
-                  }
-              }
-            }
-          }
-        }
-    }
-  }
-}
-
-// THE LIVE READINGS. The spans are read by spark_v41_checkpoint_materialize after the shards verify; the
-// stores by the encode run over them. Each stays Unread until its run's receipt is transcribed, and the
-// candidate's row_store_encoding axis stays Unestablished on whichever is still unread.
-// srv5's storage-backed spans, read by spark_v41_checkpoint_materialize after every shard verified against
-// its manifest row (fleet-converge run 35840493821, main eb6bf6c, reported by sleek-bee-348 2026-09-23).
-data v41_published_span_readings: V41PublishedSpanReadings = V41PublishedSpansRead {
-  host: "srv5" as NonEmptyStr,
-  observed_at: "fleet-converge run 35840493821" as NonEmptyStr,
-  spans: [
-    V41PublishedSpanDigest { span: V41PublishedSpan { tensor: "layers.1.engram.embed.weight" as NonEmptyStr, shard: "model-00047-of-00048.safetensors" as NonEmptyStr, file_offset: byte_size(count: 664), length: byte_size(count: 98305579008) }, sha256: Sha256Digest { hex: "ada3f1b35065e3088b6cc8d45cde49320f25a1b884287d55c428618321310329" as Sha256DigestHex } },
-    V41PublishedSpanDigest { span: V41PublishedSpan { tensor: "layers.1.engram.embed.scale" as NonEmptyStr, shard: "model-00047-of-00048.safetensors" as NonEmptyStr, file_offset: byte_size(count: 98305579672), length: byte_size(count: 3072049344) }, sha256: Sha256Digest { hex: "75a1a0818a4e512dc1e298027fc70637d92df02c0534de9c3c311c87da2e392d" as Sha256DigestHex } },
-    V41PublishedSpanDigest { span: V41PublishedSpan { tensor: "layers.14.engram.embed.weight" as NonEmptyStr, shard: "model-00048-of-00048.safetensors" as NonEmptyStr, file_offset: byte_size(count: 672), length: byte_size(count: 98308270592) }, sha256: Sha256Digest { hex: "7b386ab53a08afb08a72907e4ab28456dece22f71d63ab4c9382c88896fda768" as Sha256DigestHex } },
-    V41PublishedSpanDigest { span: V41PublishedSpan { tensor: "layers.14.engram.embed.scale" as NonEmptyStr, shard: "model-00048-of-00048.safetensors" as NonEmptyStr, file_offset: byte_size(count: 98308271264), length: byte_size(count: 3072133456) }, sha256: Sha256Digest { hex: "5d5ed18e6bf6f87254bd0e02c8131446b0c44144c465cd2e48d5b3bbba70b47b" as Sha256DigestHex } },
-  ],
-}
-
-// THE STORE READINGS' INSTRUMENT: the spark_v41_row_store_encode fleet-converge mode
-// (gunbc.spark.v41_row_store_encode_run v41_row_store_encode_ci_wet). Its receipt, printed into that step's
-// log, carries one `store layer.L.rank.K sha256=... size_bytes=...` line per store, each already checked
-// against the derived size. A Read row is transcribed from one run's log, names that run (observed_at)
-// and the host it read, and carries every store's size, which the key checks again.
-// The eight stores as read on srv5 by spark_v41_row_store_encode (fleet-converge run 36023830860, main
-// 86659c7, 2026-09-24): every store present, every size_bytes equal to its derived size. The digests
-// repeat run 35998756420's (the first encode) exactly.
-data v41_published_store_readings: V41PublishedStoreReadings = V41PublishedStoresRead {
-  host: "srv5" as NonEmptyStr,
-  observed_at: "fleet-converge run 36023830860" as NonEmptyStr,
-  stores: [
-    V41ObservedRankStore { identity: v41_rank_store_identity(layer: 1, rank: 0, digest: Sha256Digest { hex: "408fc45afaab71f7ae79af76636e031ca453f8d3a26c416a18baee6c0275de23" as Sha256DigestHex }), size: byte_size(count: 25344148902) },
-    V41ObservedRankStore { identity: v41_rank_store_identity(layer: 1, rank: 1, digest: Sha256Digest { hex: "ca2b254506628fa5e292022f184ebae50de62875e96dc3d73008724905201a3f" as Sha256DigestHex }), size: byte_size(count: 25344310470) },
-    V41ObservedRankStore { identity: v41_rank_store_identity(layer: 1, rank: 2, digest: Sha256Digest { hex: "15461f3def1f5ef66c6335756135be45a896be50735224a3c6246d6fc69a79e8" as Sha256DigestHex }), size: byte_size(count: 25344505302) },
-    V41ObservedRankStore { identity: v41_rank_store_identity(layer: 1, rank: 3, digest: Sha256Digest { hex: "b4ddf62c433427c0f6ad5d5ef053656a0ccf6bbb823d5d7cb5e3f9b4870a7f71" as Sha256DigestHex }), size: byte_size(count: 25344663702) },
-    V41ObservedRankStore { identity: v41_rank_store_identity(layer: 14, rank: 0, digest: Sha256Digest { hex: "b8227f2105cbd74195fbf1b1066b812456b8808c60e603d067821c688e181657" as Sha256DigestHex }), size: byte_size(count: 25344806262) },
-    V41ObservedRankStore { identity: v41_rank_store_identity(layer: 14, rank: 1, digest: Sha256Digest { hex: "f59d2f01751827ce5dd74400b4904ec8fccda0bb17fa1fcbc527ec6be564030b" as Sha256DigestHex }), size: byte_size(count: 25345045974) },
-    V41ObservedRankStore { identity: v41_rank_store_identity(layer: 14, rank: 2, digest: Sha256Digest { hex: "20da211045f113916088fede485cd1fa4058a9efe6fc21b9ba58bbb99a5dde91" as Sha256DigestHex }), size: byte_size(count: 25345200678) },
-    V41ObservedRankStore { identity: v41_rank_store_identity(layer: 14, rank: 3, digest: Sha256Digest { hex: "02450652d87576ab116348f1b3182540dc43d0eb1c1134d7d629eb287e378fb9" as Sha256DigestHex }), size: byte_size(count: 25345351158) },
-  ],
-}
-
-// ── THE BOUNDARY-STRATIFIED READBACK: THE REAL STORES' BYTES AT EVERY SEAM, AGAINST v41_place_row ──
-//
-// The digests above say WHICH bytes the eight stores hold; they do not say those bytes are the model's.
-// The differential that admitted the host program (#12122) ran over two adjacent layer-1 rows, which
-// cannot see a wiring error: a wrong first or last row for one rank, an off-by-one rank boundary, layer
-// 14 handed layer 1's offsets, one rank's plan handed to another, a wrong termination
-// (proud-deer-538, 2026-09-24). So the produced stores are read back at exactly the rows where those
-// errors live -- each store's magic, its first and its last record -- and the published source rows at
-// the same global rows (which, rank by rank, are row 0, the last row, and both sides of every rank
-// boundary), and each store record must equal what v41_place_row makes of its source row, at the rank
-// and local row the spec assigns. Termination is the size check the key already makes (v41_store_size).
-// The sample is DERIVED from the admitted spec, never authored: a spec whose ranges move moves it.
-//
-// A SHIFT THAT CANNOT BE SEEN MUST REFUSE, NOT PASS: where the source rows on both sides of a boundary are
-// byte-identical, a store shifted by one row there would read back equal, so the readback refuses as
-// undiscriminating rather than calling it verified.
-
-type V41ReadbackSample
-  = V41SampleMagic { layer: Nat, rank: Nat }
-  | V41SampleStoreRecord { layer: Nat, rank: Nat, local_row: Nat }
-  | V41SampleSourceWeight { layer: Nat, global_row: Nat }
-  | V41SampleSourceScale { layer: Nat, global_row: Nat }
-
-fn v41_readback_sample_key(s: V41ReadbackSample) -> String {
-  match s {
-    V41SampleMagic { layer: l, rank: r } => join(["magic ", v41_store_key(layer: l, rank: r)], "")
-    V41SampleStoreRecord { layer: l, rank: r, local_row: k } => join(["record ", v41_store_key(layer: l, rank: r), " row ", to_string(k)], "")
-    V41SampleSourceWeight { layer: l, global_row: g } => join(["weight layer.", to_string(l), " row ", to_string(g)], "")
-    V41SampleSourceScale { layer: l, global_row: g } => join(["scale layer.", to_string(l), " row ", to_string(g)], "")
-  }
-}
-
-// WHERE A SAMPLE LIVES: a byte region of one store, or of one layer's weight or scale table (the offset is
-// from the table's start; the host run adds the published span's file offset).
-type V41ReadbackRegion
-  = V41RegionInStore { layer: Nat, rank: Nat, offset: ByteSize, length: ByteSize }
-  | V41RegionInWeight { layer: Nat, offset: ByteSize, length: ByteSize }
-  | V41RegionInScale { layer: Nat, offset: ByteSize, length: ByteSize }
-
-fn v41_readback_region(spec: V41RowStoreEncodingSpec, s: V41ReadbackSample) -> V41ReadbackRegion {
-  let record = v41_row_bytes(g: spec.geometry)
-  match s {
-    V41SampleMagic { layer: l, rank: r } => V41RegionInStore { layer: l, rank: r, offset: byte_size(count: 0), length: v41_row_store_magic_size() }
-    V41SampleStoreRecord { layer: l, rank: r, local_row: k } => V41RegionInStore { layer: l, rank: r, offset: byte_size(count: byte_size_count(b: v41_row_store_magic_size()) + k * byte_size_count(b: record)), length: record }
-    V41SampleSourceWeight { layer: l, global_row: g } => V41RegionInWeight { layer: l, offset: byte_size(count: g * byte_size_count(b: weight_bytes(g: spec.geometry))), length: weight_bytes(g: spec.geometry) }
-    V41SampleSourceScale { layer: l, global_row: g } => V41RegionInScale { layer: l, offset: byte_size(count: g * byte_size_count(b: scale_bytes(g: spec.geometry))), length: scale_bytes(g: spec.geometry) }
-  }
-}
-
-fn v41_region_length(r: V41ReadbackRegion) -> ByteSize {
-  match r {
-    V41RegionInStore { layer: _, rank: _, offset: _, length: n } => n
-    V41RegionInWeight { layer: _, offset: _, length: n } => n
-    V41RegionInScale { layer: _, offset: _, length: n } => n
-  }
-}
-
-// THE GLOBAL ROWS A RANK'S STORE IS SAMPLED AT: its first and its last (one, when the range is one row).
-fn v41_rank_edge_rows(r: VllmEngramRankRows) -> List<Int> {
-  if r.end - r.start == 1 { [r.start] } else { [r.start, r.end - 1] }
-}
-
-fn v41_rank_samples(layer: Nat, r: VllmEngramRankRows) -> List<V41ReadbackSample> {
-  concat([V41SampleMagic { layer: layer, rank: r.rank } as V41ReadbackSample],
-    flat_map(v41_rank_edge_rows(r: r), g => [
-      V41SampleStoreRecord { layer: layer, rank: r.rank, local_row: g - r.start } as V41ReadbackSample,
-      V41SampleSourceWeight { layer: layer, global_row: g } as V41ReadbackSample,
-      V41SampleSourceScale { layer: layer, global_row: g } as V41ReadbackSample,
-    ]))
-}
-
-// EVERY SAMPLE THE SPEC OWES, in spec order. A rank with no rows owes none (its store is magic only, and
-// the spec admits no such rank: vllm_engram_every_rank_has_heads).
-fn v41_readback_samples(spec: V41RowStoreEncodingSpec) -> List<V41ReadbackSample> {
-  flat_map(spec.layers, t => flat_map(filter(t.ranks, r => r.end > r.start), r => v41_rank_samples(layer: t.layer, r: r)))
-}
-
-type V41ReadbackReading {
-  sample: V41ReadbackSample
-  hex: String
-}
-
-type V41StoreReadbackReadings
-  = V41StoreReadbackRead { host: NonEmptyStr, observed_at: NonEmptyStr, readings: List<V41ReadbackReading> }
-  | V41StoreReadbackReadingsUnread { obligation: NonEmptyStr }
-
-type V41StoreReadback
-  = V41StoreReadbackVerified { host: NonEmptyStr, observed_at: NonEmptyStr, samples: Nat }
-  | V41StoreReadbackUnread { obligation: NonEmptyStr }
-  | V41StoreReadbackRefused { defects: List<NonEmptyStr> }
-
-fn v41_readback_octets(hex: String) -> List<UInt8>? {
-  match base16_decode_lower(hex: hex) {
-    Absent => none
-    Present { value: q } => Present { value: qualified_octet_members(q: q) }
-  }
-}
-
-// THE READINGS, JOINED TO THE SAMPLE BY IDENTITY: every owed sample exactly once, nothing foreign, every
-// reading exactly its region's length. A reading that is not lowercase hex decodes to no bytes, which
-// v41_place_row and the magic check then refuse: each reading is decoded once, where it is compared.
-fn v41_readback_join_defects(spec: V41RowStoreEncodingSpec, owed: List<V41ReadbackSample>, readings: List<V41ReadbackReading>) -> List<NonEmptyStr> {
-  let owed_index = v41_key_counts(keys: map(owed, s => v41_readback_sample_key(s: s)))
-  let read_index = v41_key_counts(keys: map(readings, r => v41_readback_sample_key(s: r.sample)))
-  let missing = map(filter(owed, s => v41_key_count(index: read_index, key: v41_readback_sample_key(s: s)) == 0), s => join(["the readback owes ", v41_readback_sample_key(s: s), " and it was not read"], "") as NonEmptyStr)
-  let twice = map(filter(owed, s => v41_key_count(index: read_index, key: v41_readback_sample_key(s: s)) > 1), s => join(["", v41_readback_sample_key(s: s), " was read more than once"], "") as NonEmptyStr)
-  let foreign = map(filter(readings, r => v41_key_count(index: owed_index, key: v41_readback_sample_key(s: r.sample)) == 0), r => join(["a reading of ", v41_readback_sample_key(s: r.sample), " is not a sample the spec owes"], "") as NonEmptyStr)
-  let malformed = map(filter(readings, r => string_length(r.hex) != 2 * byte_size_count(b: v41_region_length(r: v41_readback_region(spec: spec, s: r.sample)))),
-    r => join(["the reading of ", v41_readback_sample_key(s: r.sample), " is not ", to_string(2 * byte_size_count(b: v41_region_length(r: v41_readback_region(spec: spec, s: r.sample)))), " hex digits (", to_string(byte_size_count(b: v41_region_length(r: v41_readback_region(spec: spec, s: r.sample)))), " bytes)"], "") as NonEmptyStr)
-  concat(concat(concat(missing, twice), foreign), malformed)
-}
-
-fn v41_reading_hex(index: Map<String, String>, s: V41ReadbackSample) -> String {
-  match map_get(index, v41_readback_sample_key(s: s)) {
-    Present { value: h } => h
-    Absent => ""
-  }
-}
-
-fn v41_reading_octets(index: Map<String, String>, s: V41ReadbackSample) -> List<UInt8> {
-  match v41_readback_octets(hex: v41_reading_hex(index: index, s: s)) {
-    Present { value: o } => o
-    Absent => [] as List<UInt8>
-  }
-}
-
-// ONE STORE RECORD AGAINST v41_place_row OF ITS SOURCE ROW: the placement must land at this rank and
-// local row, and its record must be the store's bytes there.
-fn v41_record_defects(spec: V41RowStoreEncodingSpec, index: Map<String, String>, layer: Nat, r: VllmEngramRankRows, g: Int) -> List<NonEmptyStr> {
-  let at = join([v41_store_key(layer: layer, rank: r.rank), " row ", to_string(g - r.start), " (global row ", to_string(g), ")"], "")
-  let row = v41_source_row(layer: layer, global_row: g,
-    weight: v41_reading_octets(index: index, s: V41SampleSourceWeight { layer: layer, global_row: g }),
-    scale: v41_reading_octets(index: index, s: V41SampleSourceScale { layer: layer, global_row: g }))
-  match v41_place_row(row: row, spec: spec) {
-    V41PlacementRefused { defect: d } => [join(["store ", at, ": v41_place_row refused its source row: ", d as String], "") as NonEmptyStr]
-    V41Placed { row: p } =>
-      if p.rank != r.rank || p.local_row != g - r.start {
-        [join(["store ", at, ": v41_place_row places this row at ", v41_store_key(layer: layer, rank: p.rank), " row ", to_string(p.local_row)], "") as NonEmptyStr]
-      } else if p.record != v41_reading_octets(index: index, s: V41SampleStoreRecord { layer: layer, rank: r.rank, local_row: g - r.start }) {
-        [join(["store ", at, ": the stored record is not v41_place_row of the published source row"], "") as NonEmptyStr]
-      } else { [] as List<NonEmptyStr> }
-  }
-}
-
-fn v41_magic_defects(index: Map<String, String>, layer: Nat, r: VllmEngramRankRows) -> List<NonEmptyStr> {
-  if v41_reading_octets(index: index, s: V41SampleMagic { layer: layer, rank: r.rank }) == v41_magic_octets() { [] as List<NonEmptyStr> } else {
-    [join(["store ", v41_store_key(layer: layer, rank: r.rank), ": the header is not the row-store magic"], "") as NonEmptyStr]
-  }
-}
-
-// A BOUNDARY WHOSE TWO SOURCE ROWS ARE BYTE-IDENTICAL CANNOT SEE A SHIFT ACROSS IT.
-fn v41_undiscriminated_boundaries(index: Map<String, String>, t: V41LayerTable) -> List<NonEmptyStr> {
-  map(filter(filter(t.ranks, r => r.start > 0 && r.end > r.start), r =>
-      v41_reading_hex(index: index, s: V41SampleSourceWeight { layer: t.layer, global_row: r.start - 1 }) == v41_reading_hex(index: index, s: V41SampleSourceWeight { layer: t.layer, global_row: r.start })
-        && v41_reading_hex(index: index, s: V41SampleSourceScale { layer: t.layer, global_row: r.start - 1 }) == v41_reading_hex(index: index, s: V41SampleSourceScale { layer: t.layer, global_row: r.start })),
-    r => join(["layer ", to_string(t.layer), " rows ", to_string(r.start - 1), " and ", to_string(r.start), " (the rank ", to_string(r.rank), " boundary) are byte-identical, so a shift across it cannot be seen; the readback is undiscriminating there"], "") as NonEmptyStr)
-}
-
-fn v41_readback_content_defects(spec: V41RowStoreEncodingSpec, index: Map<String, String>) -> List<NonEmptyStr> {
-  flat_map(spec.layers, t => concat(
-    v41_undiscriminated_boundaries(index: index, t: t),
-    flat_map(filter(t.ranks, r => r.end > r.start), r => concat(
-      v41_magic_defects(index: index, layer: t.layer, r: r),
-      flat_map(v41_rank_edge_rows(r: r), g => v41_record_defects(spec: spec, index: index, layer: t.layer, r: r, g: g))))))
-}
-
-// THE VERDICT: Unread until a readback run's receipt is transcribed; any join or content defect refuses.
-fn v41_store_readback(spec: V41RowStoreEncodingSpec, readings: V41StoreReadbackReadings) -> V41StoreReadback {
-  match readings {
-    V41StoreReadbackReadingsUnread { obligation: o } => V41StoreReadbackUnread { obligation: o }
-    V41StoreReadbackRead { host: h, observed_at: at, readings: rs } => {
-      let owed = v41_readback_samples(spec: spec)
-      let join_defects = v41_readback_join_defects(spec: spec, owed: owed, readings: rs)
-      if length(join_defects) != 0 { V41StoreReadbackRefused { defects: join_defects } } else {
-        let index = fold(rs, init: empty_map(), f: (acc, r) => map_insert(acc, v41_readback_sample_key(s: r.sample), r.hex))
-        let content = v41_readback_content_defects(spec: spec, index: index)
-        if length(content) != 0 { V41StoreReadbackRefused { defects: content } } else {
-          V41StoreReadbackVerified { host: h, observed_at: at, samples: length(owed) }
-        }
-      }
-    }
-  }
-}
-
-// THE LIVE READBACK. Its instrument is the spark_v41_row_store_readback fleet-converge mode
-// (gunbc.spark.v41_row_store_readback_run v41_row_store_readback_ci_wet), which reads every owed sample on
-// the host holding the stores and prints one `sample <key> hex=<bytes>` line each; a Read row is
-// transcribed from one run's log, naming that run and host. While it is Unread the candidate carries that
-// obligation in its derivation evidence, and no deployment authorization can be minted over it.
-// srv5's eight stores read back at every seam by spark_v41_row_store_readback (fleet-converge run
-// 36126002186, main 6136fcf, 2026-09-25): 56 samples, every one read.
-data v41_published_store_readback_readings: V41StoreReadbackReadings = V41StoreReadbackRead {
-  host: "srv5" as NonEmptyStr,
-  observed_at: "fleet-converge run 36126002186" as NonEmptyStr,
-  readings: [
-    V41ReadbackReading { sample: V41SampleMagic { layer: 1, rank: 0 }, hex: "454e4752310a" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 1, rank: 0, local_row: 0 }, hex: "e36aed4fc6d9f5e8e0f6f2715af1cde27b44f949e4d1f0ee745b6370dcd7edbbf07470d9ec71e4f477716b57f8625bebeef0f8d8f8ef7478df5a6cdfdf75686a67717964705f58726c61fb7974ef73e3e57bdc78d7f371eb7571f7ecf07549435be7e26363f4eae86ceb6ce26d71f654e7526a576fee76ece87377fae974ea666d7669f3f26775ebefd5e5f8edddf071e077ef4b6860da6edff16af1f6e54b78cf6b75e873e7eaf5725dece5e958f8ec5bebf1e8646852666871ec7276f165f4f15ad55268e970f5726955f46edd62ec6ade6768e6f070725dd876eadef9e95e6962d075e3f6f0da51ed4ddaf172ecf2f4f770eed86bee6de2eb69627061f5547878777878787878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 1, global_row: 0 }, hex: "e36aed4fc6d9f5e8e0f6f2715af1cde27b44f949e4d1f0ee745b6370dcd7edbbf07470d9ec71e4f477716b57f8625bebeef0f8d8f8ef7478df5a6cdfdf75686a67717964705f58726c61fb7974ef73e3e57bdc78d7f371eb7571f7ecf07549435be7e26363f4eae86ceb6ce26d71f654e7526a576fee76ece87377fae974ea666d7669f3f26775ebefd5e5f8edddf071e077ef4b6860da6edff16af1f6e54b78cf6b75e873e7eaf5725dece5e958f8ec5bebf1e8646852666871ec7276f165f4f15ad55268e970f5726955f46edd62ec6ade6768e6f070725dd876eadef9e95e6962d075e3f6f0da51ed4ddaf172ecf2f4f770eed86bee6de2eb69627061f554" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 1, global_row: 0 }, hex: "7878777878787878" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 1, rank: 0, local_row: 96000563 }, hex: "5b71726d69725c6567cfea6ae069776871e87873eaf254f26a7458ebf2f7736c75f2eef17048f1ec63c356eef2646e51ecf5de6072ececf2737361e56ee349f979d8e2f96edd6c61f063dfefe96c6ff3f0f572d17afa5eec6b66dce47767f0fadcf7eb57cb7074696ae36dd46761f16e666072e0e46b69dbf362ec6ef4e17cf576ebe3dde9f0f17775e84ae3ccdad0f16b746c4d735ee75076ede2e96df1f7f4f0f67af2ddea67d7edda6ee9e871755cf6ebf660ede966f36eecf064636a66645b71f6637366dc60f0e6f27af7726c706ef971ae72de6bc8f473ecdbe2e75de0737566ec6b6be9d9f4da6f5376696f6ce761c4eeeb5d61eff8f44a766b7a6a607878787878787878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 1, global_row: 96000563 }, hex: "5b71726d69725c6567cfea6ae069776871e87873eaf254f26a7458ebf2f7736c75f2eef17048f1ec63c356eef2646e51ecf5de6072ececf2737361e56ee349f979d8e2f96edd6c61f063dfefe96c6ff3f0f572d17afa5eec6b66dce47767f0fadcf7eb57cb7074696ae36dd46761f16e666072e0e46b69dbf362ec6ef4e17cf576ebe3dde9f0f17775e84ae3ccdad0f16b746c4d735ee75076ede2e96df1f7f4f0f67af2ddea67d7edda6ee9e871755cf6ebf660ede966f36eecf064636a66645b71f6637366dc60f0e6f27af7726c706ef971ae72de6bc8f473ecdbe2e75de0737566ec6b6be9d9f4da6f5376696f6ce761c4eeeb5d61eff8f44a766b7a6a60" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 1, global_row: 96000563 }, hex: "7878787878787878" },
-    V41ReadbackReading { sample: V41SampleMagic { layer: 1, rank: 1 }, hex: "454e4752310a" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 1, rank: 1, local_row: 0 }, hex: "e9f6f3e17de9685271f57bf1f7fdfb71e679ea76f9fbfdeed2f67174fa78f17bc162eb5578f3f8696d66626f6def35f375f069e16072f5c0f1746a346ee969ddd0eb57f1f5f26f68ecf8e65c70f1e865dcddfbdb586cfad479f8f1f27bedf67662625ce2696de3ef70ebec72fcd366e9edd3e15aee61e9eadb7072f3e66b5b6c5cf0707262ed644877666869e664eee06071c760eae5d36c6a7560dcfb6a63eb79c178756af1687c45eb63f4f0f3f0f1e9f6555df4f8f1f16c6d6ff1e37d72efe35d71d2605cf26de1ebf3f469f96bf1d36ff768ef5ff270eced6c53e6de6ef4d9e96cebeb4c6eecefed7261e4ecbe73456d70ed635cf95972dfd1e8e0eaf0707778777878777878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 1, global_row: 96000564 }, hex: "e9f6f3e17de9685271f57bf1f7fdfb71e679ea76f9fbfdeed2f67174fa78f17bc162eb5578f3f8696d66626f6def35f375f069e16072f5c0f1746a346ee969ddd0eb57f1f5f26f68ecf8e65c70f1e865dcddfbdb586cfad479f8f1f27bedf67662625ce2696de3ef70ebec72fcd366e9edd3e15aee61e9eadb7072f3e66b5b6c5cf0707262ed644877666869e664eee06071c760eae5d36c6a7560dcfb6a63eb79c178756af1687c45eb63f4f0f3f0f1e9f6555df4f8f1f16c6d6ff1e37d72efe35d71d2605cf26de1ebf3f469f96bf1d36ff768ef5ff270eced6c53e6de6ef4d9e96cebeb4c6eecefed7261e4ecbe73456d70ed635cf95972dfd1e8e0eaf070" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 1, global_row: 96000564 }, hex: "7778777878777878" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 1, rank: 1, local_row: 96001175 }, hex: "ecda6a6f76eaea6ad1e8a6eff1d7fa6ee1e958e464f2e96d727371eae3d9f36865dae8d8f1ea6c6c69e9f061f3e7e3e0f7ec52f16062ee6bebeb5ad3dbefd3eb5cf1f3796eef59fbf5696b66f4faf168d2f67373f27668f563ecdbe97976d2e278e878eb6e736a73f6eae96bf3fe75786b77f566f0e274e8fbf8776c7aeb617c6be7f4da6ddf6f68f0eae55fe7f1f1f8e96aebe2f1d965ea736ddf61e0ecd36cf2eeed6a6ff9f5f9f6dadcda737869f4e1f27aebf2e97661f8d3725c6c73fdfcd955d9794ced71e9e8f0f66461f1ecd6f3ec4a5e4ce3ef73eaf069736f695c6e74d66dee726969eaebe9f9745efbecf37278f963586a73f94ff873dd444ceb6e7878777778777877" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 1, global_row: 192001739 }, hex: "ecda6a6f76eaea6ad1e8a6eff1d7fa6ee1e958e464f2e96d727371eae3d9f36865dae8d8f1ea6c6c69e9f061f3e7e3e0f7ec52f16062ee6bebeb5ad3dbefd3eb5cf1f3796eef59fbf5696b66f4faf168d2f67373f27668f563ecdbe97976d2e278e878eb6e736a73f6eae96bf3fe75786b77f566f0e274e8fbf8776c7aeb617c6be7f4da6ddf6f68f0eae55fe7f1f1f8e96aebe2f1d965ea736ddf61e0ecd36cf2eeed6a6ff9f5f9f6dadcda737869f4e1f27aebf2e97661f8d3725c6c73fdfcd955d9794ced71e9e8f0f66461f1ecd6f3ec4a5e4ce3ef73eaf069736f695c6e74d66dee726969eaebe9f9745efbecf37278f963586a73f94ff873dd444ceb6e" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 1, global_row: 192001739 }, hex: "7878777778777877" },
-    V41ReadbackReading { sample: V41SampleMagic { layer: 1, rank: 2 }, hex: "454e4752310a" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 1, rank: 2, local_row: 0 }, hex: "69e2ef6a61f159d15bf4e8567876586df0f1f2c471eef1eed4f386726b42f1f1f2edc7646bdde1ebc55af24c6e5b6d5f73db6471674cd665f9e160e86de3666ada4d64f0e3dc69716bf469e9ea746e64d9e4e577cb53e96ae862f078f2eb67e7615c75ec797063f3e6ef7875f574f648eaea4176f077786570f772f5e0f069ef5df6f0f166426bc57749f16c6cf1def1664e6e69f660ebf36a7672f3f0d9e8e1f3ed6ae86af170e4e97769e2d1dfe8e2e0e9f2e7e171ede7e965ce6360e9ebe1736df3e874e5666eef63734abe6be96f7669694c44ee76605d68b864e6eae9e2e062f0eee9e05b776ceb4fd96f6c6c43e170ebf0eaddea625072ef6457efe9587878787778787878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 1, global_row: 192001740 }, hex: "69e2ef6a61f159d15bf4e8567876586df0f1f2c471eef1eed4f386726b42f1f1f2edc7646bdde1ebc55af24c6e5b6d5f73db6471674cd665f9e160e86de3666ada4d64f0e3dc69716bf469e9ea746e64d9e4e577cb53e96ae862f078f2eb67e7615c75ec797063f3e6ef7875f574f648eaea4176f077786570f772f5e0f069ef5df6f0f166426bc57749f16c6cf1def1664e6e69f660ebf36a7672f3f0d9e8e1f3ed6ae86af170e4e97769e2d1dfe8e2e0e9f2e7e171ede7e965ce6360e9ebe1736df3e874e5666eef63734abe6be96f7669694c44ee76605d68b864e6eae9e2e062f0eee9e05b776ceb4fd96f6c6c43e170ebf0eaddea625072ef6457efe958" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 1, global_row: 192001740 }, hex: "7878787778787878" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 1, rank: 2, local_row: 96001913 }, hex: "73f3fb745b7268f94fef737b705efc6f74eceedd60ece871f2fbe476e4fbf27c6fe9f55769daf1f3e57072d4ecebeff86b6fd467d36bd957ed65e4ea746c6ccfea7972d1716367f7f7fd5ee6c2e177e26174536e63edf275f57d6ce3f27bea70e1e7e2f16a67b36b63726e59e56f7071e0f070286bf666ecf568df6eecdae6f3e17051f5baf475e776fc79f1fcfee1f6686f59ebe159f2fbf873f3f06ef5e36b786ff1fc6cea6770e8f170f3f07b6f69d9f1eefc5be5e2cc6e7063e1e2ec7e65e4f9547160ea6b5fe5ddf0eaf06c72d2dbe4e762eceadc72ed6be35550e6e769e46a51eef05ce4736956f2d7e4e46befe2dbdaf7edf1d6da676860da5fdf676a7778777877777878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 1, global_row: 288003653 }, hex: "73f3fb745b7268f94fef737b705efc6f74eceedd60ece871f2fbe476e4fbf27c6fe9f55769daf1f3e57072d4ecebeff86b6fd467d36bd957ed65e4ea746c6ccfea7972d1716367f7f7fd5ee6c2e177e26174536e63edf275f57d6ce3f27bea70e1e7e2f16a67b36b63726e59e56f7071e0f070286bf666ecf568df6eecdae6f3e17051f5baf475e776fc79f1fcfee1f6686f59ebe159f2fbf873f3f06ef5e36b786ff1fc6cea6770e8f170f3f07b6f69d9f1eefc5be5e2cc6e7063e1e2ec7e65e4f9547160ea6b5fe5ddf0eaf06c72d2dbe4e762eceadc72ed6be35550e6e769e46a51eef05ce4736956f2d7e4e46befe2dbdaf7edf1d6da676860da5fdf676a" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 1, global_row: 288003653 }, hex: "7778777877777878" },
-    V41ReadbackReading { sample: V41SampleMagic { layer: 1, rank: 3 }, hex: "454e4752310a" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 1, rank: 3, local_row: 0 }, hex: "e46474ea60eee57653ebe366784e6062cfea307276e6edf5eef26bdde1ce5966f378f8f870f6d37aeff2f1757779f9f14ceeed587369fa4aeff75967f5e9f1f8ee52d5eff1655a72f0f760e35bf1f1e7eb4568686b53ed75e753ee455d6774eb79e6e95672feecf07273ea766778fb78fae1ccf5f7eb726ef1f2eb7170e572e7eb63f3f7f1f6f0e171f252f8ea7579687277f8f1766270f57d7bf3e8f365e06ddad9516156d66960d3e4ede974e17068e86f736f66ef79e8e964715bf26fe440ea6dd5e7e16e5ed4766dd16c626f5e60776ac464f4e562d458f6d9e56fe2faf5f1e767ddf0ed6be5dbf2ec6ddccce87456e7647668e16d6adb4befd5e4615b637877787777787878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 1, global_row: 288003654 }, hex: "e46474ea60eee57653ebe366784e6062cfea307276e6edf5eef26bdde1ce5966f378f8f870f6d37aeff2f1757779f9f14ceeed587369fa4aeff75967f5e9f1f8ee52d5eff1655a72f0f760e35bf1f1e7eb4568686b53ed75e753ee455d6774eb79e6e95672feecf07273ea766778fb78fae1ccf5f7eb726ef1f2eb7170e572e7eb63f3f7f1f6f0e171f252f8ea7579687277f8f1766270f57d7bf3e8f365e06ddad9516156d66960d3e4ede974e17068e86f736f66ef79e8e964715bf26fe440ea6dd5e7e16e5ed4766dd16c626f5e60776ac464f4e562d458f6d9e56fe2faf5f1e767ddf0ed6be5dbf2ec6ddccce87456e7647668e16d6adb4befd5e4615b63" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 1, global_row: 288003654 }, hex: "7877787777787878" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 1, rank: 3, local_row: 96002513 }, hex: "d7f26f726270e1e9687674776dec61f0d0c3e76e55e86edf6862ebe3e4e66174eaf55b60f678eafc79eb777b75fa5e7977d47769796f6fe5fd6853795f7bf773edeaede8e064f26e5d6a686275eff2d4eaec72f1e25d60f1f5e8785b4e5949e3f6e7e3faf67d7afa74f8fbf1f2fd7af8787efddf76f9f66676f9e078ebf0e1f7f369a5ec3b4f6361d1ecf170edf17a696e62735765f4596d68e96268f1e0ede7d0edd86c72eae8e9e865e96d78f268d36c6ef275e9f1665d6966f1e0eaee7674f168ed68e560626ce97872dce9ef72f0f6ee757eeb7c63e8506bf3706ef5f36977726f5461e8e1655df26470e5e0e972756368edf3455c71e8f2e3f265cc71e17877787778787778" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 1, global_row: 384006167 }, hex: "d7f26f726270e1e9687674776dec61f0d0c3e76e55e86edf6862ebe3e4e66174eaf55b60f678eafc79eb777b75fa5e7977d47769796f6fe5fd6853795f7bf773edeaede8e064f26e5d6a686275eff2d4eaec72f1e25d60f1f5e8785b4e5949e3f6e7e3faf67d7afa74f8fbf1f2fd7af8787efddf76f9f66676f9e078ebf0e1f7f369a5ec3b4f6361d1ecf170edf17a696e62735765f4596d68e96268f1e0ede7d0edd86c72eae8e9e865e96d78f268d36c6ef275e9f1665d6966f1e0eaee7674f168ed68e560626ce97872dce9ef72f0f6ee757eeb7c63e8506bf3706ef5f36977726f5461e8e1655df26470e5e0e972756368edf3455c71e8f2e3f265cc71e1" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 1, global_row: 384006167 }, hex: "7877787778787778" },
-    V41ReadbackReading { sample: V41SampleMagic { layer: 14, rank: 0 }, hex: "454e4752310a" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 14, rank: 0, local_row: 0 }, hex: "69c0efe0686373e1ebf876f3d7706b7070b365d47bf7dc6de061e2f57463e0eee6f167625ddbe86fe5697675f4f9604859ea6ee8d06aef58696c7279f2f66d77f6effaec5d63b5ece9676668f2f3756de8e86772ec6deaf17267e47159dcf4ea5eddf171f16cee646b6f73e6e3e7ecce6963adc070e0efe9e2ea72e972ec77f86be74f7874bd6a5a28e96c6c707161f4707066606f686d76f6f6e268db5e63756b66e367f2d9dc5d49ebd870d5ee7070e4ea67df76f764ee77e4e9d36e74f56e6b7272e26579586465ebebf1f3f0ebf371ec5bf161e77957765d72cfdee4ed70f5dc65f06967ce6ee2e94ceef3eeec72d9e862dce1d7d2d7e1ef74ed57f85ce97878787878787878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 14, global_row: 0 }, hex: "69c0efe0686373e1ebf876f3d7706b7070b365d47bf7dc6de061e2f57463e0eee6f167625ddbe86fe5697675f4f9604859ea6ee8d06aef58696c7279f2f66d77f6effaec5d63b5ece9676668f2f3756de8e86772ec6deaf17267e47159dcf4ea5eddf171f16cee646b6f73e6e3e7ecce6963adc070e0efe9e2ea72e972ec77f86be74f7874bd6a5a28e96c6c707161f4707066606f686d76f6f6e268db5e63756b66e367f2d9dc5d49ebd870d5ee7070e4ea67df76f764ee77e4e9d36e74f56e6b7272e26579586465ebebf1f3f0ebf371ec5bf161e77957765d72cfdee4ed70f5dc65f06967ce6ee2e94ceef3eeec72d9e862dce1d7d2d7e1ef74ed57f85ce9" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 14, global_row: 0 }, hex: "7878787878787878" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 14, rank: 0, local_row: 96003053 }, hex: "6a5f71e07361ea60ebc162e7cb51e2e6e44ecedbda64ee5f72e6ed61e4786158546f6056e8e85ceed5ef62ecea734e6e5feef065f9ebec4e6470e6766d746ed3e0eae0f25fd66be977765c5ddce26fd549706c70f2e06bf65f5453f96cb37069f1def96df364c36ee863e74fec70ef6f596268d9ef6bf3606152f0e362ed66f674e5fa61efe27474edec76bb527971f271716b4c736ff2f8f2eaf4d879f27472f0f8e060f8fe69f9f6fa76e8795a7051e3f3f1f0f974ec7c7952f379f8e6756c71646d6de571786969f4ea6640f5687362f1dfe4e26cde67e5dc69f1f26d63686cd173d8ede85c6bd8e760e8e0e8da30c867efde68e774f8e1776af37066d9dc7878787877777878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 14, global_row: 96003053 }, hex: "6a5f71e07361ea60ebc162e7cb51e2e6e44ecedbda64ee5f72e6ed61e4786158546f6056e8e85ceed5ef62ecea734e6e5feef065f9ebec4e6470e6766d746ed3e0eae0f25fd66be977765c5ddce26fd549706c70f2e06bf65f5453f96cb37069f1def96df364c36ee863e74fec70ef6f596268d9ef6bf3606152f0e362ed66f674e5fa61efe27474edec76bb527971f271716b4c736ff2f8f2eaf4d879f27472f0f8e060f8fe69f9f6fa76e8795a7051e3f3f1f0f974ec7c7952f379f8e6756c71646d6de571786969f4ea6640f5687362f1dfe4e26cde67e5dc69f1f26d63686cd173d8ede85c6bd8e760e8e0e8da30c867efde68e774f8e1776af37066d9dc" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 14, global_row: 96003053 }, hex: "7878787877777878" },
-    V41ReadbackReading { sample: V41SampleMagic { layer: 14, rank: 1 }, hex: "454e4752310a" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 14, rank: 1, local_row: 0 }, hex: "ef3ce5ea6270eb676077dc68d4eee9e86a4d58f1e673f378eef16f7468eb7a55797237e0dae2ea6b73e276dce8df7965dc5c7370f5e1f5f266e04a7658dddb7172ea73ea6b62f0bee0ec696ce8406d65c3e9f3f4ede461e6ec65fcf371725a6e65dd7568d352dd6570e7f5d86765fa6a7469eeefd2ebf3e55b68cfdc6974e9d8e3ee49606464dcf87a6c66f260e1f45cdd605fe16760e26fefe870f3f1726c62faf350b5f0e67073eae9537365e5725ef3eff565e8f16aea61656ff2e46471e66df7f1f54bf46459eff35070e4dc6e695fd169ea6aeb66e8f0f47969736370d6edeaf0eb5f6c59e466f9f36a4bf2e771d1e54cf16df2e7e66573736bdac168d17878787878787878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 14, global_row: 96003054 }, hex: "ef3ce5ea6270eb676077dc68d4eee9e86a4d58f1e673f378eef16f7468eb7a55797237e0dae2ea6b73e276dce8df7965dc5c7370f5e1f5f266e04a7658dddb7172ea73ea6b62f0bee0ec696ce8406d65c3e9f3f4ede461e6ec65fcf371725a6e65dd7568d352dd6570e7f5d86765fa6a7469eeefd2ebf3e55b68cfdc6974e9d8e3ee49606464dcf87a6c66f260e1f45cdd605fe16760e26fefe870f3f1726c62faf350b5f0e67073eae9537365e5725ef3eff565e8f16aea61656ff2e46471e66df7f1f54bf46459eff35070e4dc6e695fd169ea6aeb66e8f0f47969736370d6edeaf0eb5f6c59e466f9f36a4bf2e771d1e54cf16df2e7e66573736bdac168d1" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 14, global_row: 96003054 }, hex: "7878787878787878" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 14, rank: 1, local_row: 96003961 }, hex: "7679ef68e176ec74e974f068754efb776ef06af0d5f4e1ec7168e5eee969ebd171f9cce36474735d70e66f525971efdaebe3e859e6db66ede56969ead24fe468eef0e960eaf668e56df5e965e3ca6c6c687661f9ebeaea5ad16be2d46d68edf36d766854f67756e26d6af16e59e461ea6d6a625d5f487070e56af65c12717359e16f686ed3ef68ebee606fccf0ca60635e595a6d5ff7eb6c59f076e0e8e56569e2677470e4f67069dc686cebf66a5d5b69e1d8725a6e6ee2c86be9da74f66873d4ea65624a66f3dbdfe3d26aecee6b7ce8e4efe96f7032eff2ed6ae0e3f9f7e9f15177f3bff4b562f6e96fe16f6f63db56dbe7724b6ee4ef64f4ef43ec7578707778787878787878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 14, global_row: 192007015 }, hex: "7679ef68e176ec74e974f068754efb776ef06af0d5f4e1ec7168e5eee969ebd171f9cce36474735d70e66f525971efdaebe3e859e6db66ede56969ead24fe468eef0e960eaf668e56df5e965e3ca6c6c687661f9ebeaea5ad16be2d46d68edf36d766854f67756e26d6af16e59e461ea6d6a625d5f487070e56af65c12717359e16f686ed3ef68ebee606fccf0ca60635e595a6d5ff7eb6c59f076e0e8e56569e2677470e4f67069dc686cebf66a5d5b69e1d8725a6e6ee2c86be9da74f66873d4ea65624a66f3dbdfe3d26aecee6b7ce8e4efe96f7032eff2ed6ae0e3f9f7e9f15177f3bff4b562f6e96fe16f6f63db56dbe7724b6ee4ef64f4ef43ec757870" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 14, global_row: 192007015 }, hex: "7778787878787878" },
-    V41ReadbackReading { sample: V41SampleMagic { layer: 14, rank: 2 }, hex: "454e4752310a" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 14, rank: 2, local_row: 0 }, hex: "fae9e86ed17776ecf5ddd766f370ee64e774f87260f5b4683ae7716156699c47686becf4ebee7158fcec705aebea64d552706ad561edf2e3685fe3e6656350e76b696550ed61ea59e86bf355715ad966f879e8eef5d57669e871eaeef1eded655dea59faf4f2ed6cf379656f70f4f16a7369ede96860e9e9d561daea736572eef2e976fc656cf9f3f5787879f7fae66d79f5536360f6f1f272ded979ee767d7267e1e4e9e656d7eee0695b5ee1e36a7871ef717151796a65d6ddee716d6ad9d3b8dfebec7a73e45c6ce0f4515e77e0766163eb6a685dea636170406bedde4b7562745470fcf477716a7ef97774fadae6f2fbe966fcf178d8f9f252ed797c67fe7878787877787877" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 14, global_row: 192007016 }, hex: "fae9e86ed17776ecf5ddd766f370ee64e774f87260f5b4683ae7716156699c47686becf4ebee7158fcec705aebea64d552706ad561edf2e3685fe3e6656350e76b696550ed61ea59e86bf355715ad966f879e8eef5d57669e871eaeef1eded655dea59faf4f2ed6cf379656f70f4f16a7369ede96860e9e9d561daea736572eef2e976fc656cf9f3f5787879f7fae66d79f5536360f6f1f272ded979ee767d7267e1e4e9e656d7eee0695b5ee1e36a7871ef717151796a65d6ddee716d6ad9d3b8dfebec7a73e45c6ce0f4515e77e0766163eb6a685dea636170406bedde4b7562745470fcf477716a7ef97774fadae6f2fbe966fcf178d8f9f252ed797c67fe" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 14, global_row: 192007016 }, hex: "7878787877787877" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 14, rank: 2, local_row: 96004547 }, hex: "3472e9e3e8e85cf9de60d7eeecf368d16aea5bdcf72ce86b6c44ee6aeaeb735fd8ec71f16be96b51f15671e65c76e95fe1eaedd75e6c5a6b62f97be361e1e4f1f6db70705e596464d56f5bc365f7dc3c46f5736bf25ddbe4d76ce65ce3f6e36b5b756cee5f5862d372e564e1f2e46a6bfb56eaf2e3e8756f60e96954e4ef696671e16473f3e964eef6ef78fa77f176ed72f2f27273dbfcbc7ae75670ebe0776b646ced706accd3e5daf1e9f8f05e54eaf673ed60626f70e9eedc605f656269de7c7777f0ebca736261667bd17cfefbe3f47865736e79f256e1e966faedf179e0dcf85f58d969dff267f2e2e9f34065dbeafb7355f26eeeebf177e4f1f2f4edf17878787877787778" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 14, global_row: 288011563 }, hex: "3472e9e3e8e85cf9de60d7eeecf368d16aea5bdcf72ce86b6c44ee6aeaeb735fd8ec71f16be96b51f15671e65c76e95fe1eaedd75e6c5a6b62f97be361e1e4f1f6db70705e596464d56f5bc365f7dc3c46f5736bf25ddbe4d76ce65ce3f6e36b5b756cee5f5862d372e564e1f2e46a6bfb56eaf2e3e8756f60e96954e4ef696671e16473f3e964eef6ef78fa77f176ed72f2f27273dbfcbc7ae75670ebe0776b646ced706accd3e5daf1e9f8f05e54eaf673ed60626f70e9eedc605f656269de7c7777f0ebca736261667bd17cfefbe3f47865736e79f256e1e966faedf179e0dcf85f58d969dff267f2e2e9f34065dbeafb7355f26eeeebf177e4f1f2f4edf1" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 14, global_row: 288011563 }, hex: "7878787877787778" },
-    V41ReadbackReading { sample: V41SampleMagic { layer: 14, rank: 3 }, hex: "454e4752310a" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 14, rank: 3, local_row: 0 }, hex: "63f27361edeadeed6ef9716d6d636cfa69f8e5656170716a6bedf2e5ee716663547169e3636066425762695575eee54a674f726871e9586bf167df3de0f8ebf45b6766e069686e5d6b5d6d54f753dd73556de9db77656eec6c4e5d71f365e8dff2e0e6f0f05f6d61e96ceeda6557e8e86d65777071f7e3e772ecd26cf57057736d676a60706aed69e1e970cd72695ed4ec66eae5716ef76be36e50e5d74de374ee53e275686c5def6d704b7277efe1eff2e9ee665bf4def2e6d2f57367556a7b6e5a68e1e4f86f6cecf16bede374ebecf36a6a5fe4d4756d72625ee8f271e1e973656e67e1f0ed6571f6c2cffbdcd3fcebdcea6af6e9f075e2f968e871d8686f7878787878787878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 14, global_row: 288011564 }, hex: "63f27361edeadeed6ef9716d6d636cfa69f8e5656170716a6bedf2e5ee716663547169e3636066425762695575eee54a674f726871e9586bf167df3de0f8ebf45b6766e069686e5d6b5d6d54f753dd73556de9db77656eec6c4e5d71f365e8dff2e0e6f0f05f6d61e96ceeda6557e8e86d65777071f7e3e772ecd26cf57057736d676a60706aed69e1e970cd72695ed4ec66eae5716ef76be36e50e5d74de374ee53e275686c5def6d704b7277efe1eff2e9ee665bf4def2e6d2f57367556a7b6e5a68e1e4f86f6cecf16bede374ebecf36a6a5fe4d4756d72625ee8f271e1e973656e67e1f0ed6571f6c2cffbdcd3fcebdcea6af6e9f075e2f968e871d8686f" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 14, global_row: 288011564 }, hex: "7878787878787878" },
-    V41ReadbackReading { sample: V41SampleStoreRecord { layer: 14, rank: 3, local_row: 96005117 }, hex: "6d5150d1646968eedbd86b6f6cf179e2586a6e6aef6659da62e561f2ebe1f367ec7a6972f9d5fbf2f9f37df9f8f1dc74c1697eea6ed2f2f56379f172eb4ae2f4e74be267e7e9ce78f6f5eef2777ced777a757569bb7c79f0f3f2f9f2706de2eaf2e6e4e9694dedeb6e6ee3f5ec6b556df2e9be5aef6e625f79d565dbe3e86e6e6ce7f1eb6f6ddbe6f1d7e9d3e07b6cddf3ee6b62e26769da74546df04af2e16f646cb4e8f37ed2ee5af56ce97d5cfce760dade67706bf0f1e9ef7571e35369b4ed6d6af368ebe9e1ef586df4c9da6964dcd56cd372f1516df26c78c8dd65f06a596567e25bf4f8bbf2e86cf5eb5966f1645adce9dee3655cd766ee593f56d9dd7877777878787878" },
-    V41ReadbackReading { sample: V41SampleSourceWeight { layer: 14, global_row: 384016681 }, hex: "6d5150d1646968eedbd86b6f6cf179e2586a6e6aef6659da62e561f2ebe1f367ec7a6972f9d5fbf2f9f37df9f8f1dc74c1697eea6ed2f2f56379f172eb4ae2f4e74be267e7e9ce78f6f5eef2777ced777a757569bb7c79f0f3f2f9f2706de2eaf2e6e4e9694dedeb6e6ee3f5ec6b556df2e9be5aef6e625f79d565dbe3e86e6e6ce7f1eb6f6ddbe6f1d7e9d3e07b6cddf3ee6b62e26769da74546df04af2e16f646cb4e8f37ed2ee5af56ce97d5cfce760dade67706bf0f1e9ef7571e35369b4ed6d6af368ebe9e1ef586df4c9da6964dcd56cd372f1516df26c78c8dd65f06a596567e25bf4f8bbf2e86cf5eb5966f1645adce9dee3655cd766ee593f56d9dd" },
-    V41ReadbackReading { sample: V41SampleSourceScale { layer: 14, global_row: 384016681 }, hex: "7877777878787878" },
-  ],
-}
diff --git a/dag/gunbc/spark/v41_engram_staging.dag b/dag/gunbc/spark/v41_engram_staging.dag
deleted file mode 100644
index 5bfa538520d..00000000000
--- a/dag/gunbc/spark/v41_engram_staging.dag
+++ /dev/null
@@ -1,163 +0,0 @@
-module gunbc.spark.v41_engram_staging
-
-import std.types { String, Bool, List, NonEmptyStr }
-import std.nat { Nat }
-import std.content_hash { ContentHash, Sha256Hash, serialize_content_hash }
-import std.artifact_store { artifact_realization_digest }
-import std.decl_ref { DeclarationRef }
-import std.optional { Present, Absent }
-import gunbc.spark.v41_identity_input { v41_input }
-import gunbc.spark.v41_engram_row_store {
-  V41RowStoreEncoding, V41RowStoreEncodingIdentified, V41RowStoreEncodingUnestablished, V41RowStoreEncodingRefused,
-  V41RankStoreIdentity, v41_store_key,
-}
-import gunbc.spark.v41_runtime_realized { V41OciImageDigest }
-import extdeps.container.oci.digest { OciContentDigest, render_oci_content_digest_wire }
-import gunbc.spark.serving_deployment_selection { id_component_budget_authority }
-import gunbc.spark.vllm_runtime_image_build { VllmImageProvenance, BuiltByThisRun, AdoptedUnderExpectedTag }
-
-// ── CUT C: ARTIFACT STAGING, NOT SERVICE MUTATION ──────────────────────────────────────────────
-//
-// This module may create verified content-addressed files in a bounded staging area. It may not
-// start or stop processes, consume GPU memory, alter units, withdraw an incumbent, or claim seats.
-// Fabric/storage selection decides which provider holds the bytes; this
-// request names exact image X and exact rank-local stores R0..R3 and does not pick the copy source.
-//
-// THE INCUMBENT ON GROUP A IS AN OBSERVATION, NOT THIS MODULE'S ASSUMPTION. Operator ruling
-// (proud-deer-538, 2026-09-17): group A is unused — "no one ever uses it". Stage onto it. Do not
-// tear the pair cluster down; Cut D is that transaction. Do not launch a serving process on a
-// first-party image. authorized_v4_1_runtime_holds still admits only v41_published_arm64_reference;
-// this module must not widen that wall.
-//
-// WHY ENGRAM GOES TO DISK AT ALL is not a transcribed GiB figure. Route A at TP4 is excluded
-// by gunbc.spark.serving_deployment_selection candidate_component_budget, reading
-// gunbc.spark.pair_serving_observed group_rank_free_memory_observed: a measured shortfall on the
-// Engram term after the artifact's other components, not a near miss against device total. Cut B
-// exists because moving Engram off the resident budget is the only change that term feels.
-//
-// Prefer route D when admitted: durable origin -> fill each rank's local NVMe. Route B may become
-// equivalent once the local artifact exists. A missing local store still refuses at token time
-// (gunbc.spark.v41_runtime_realized v41_token_time); staging never records an NFS token-time path.
-type V41StagedRankStore sole_constructor {
-  layer: Nat
-  rank: Nat
-  identity: ContentHash
-  readback: ContentHash
-}
-
-fn v41_staged_rank_store(layer: Nat, rank: Nat, identity: ContentHash, readback: ContentHash) -> V41StagedRankStore {
-  V41StagedRankStore { layer: layer, rank: rank, identity: identity, readback: readback }
-}
-
-fn v41_staged_matching(encoding: V41RowStoreEncoding) -> List<V41StagedRankStore> {
-  match encoding {
-    V41RowStoreEncodingIdentified { spec: _, spec_key: _, rank_stores: rs, content_digest: _ } =>
-      map(rs, r => v41_staged_rank_store(layer: r.layer, rank: r.rank, identity: Sha256Hash(r.digest), readback: Sha256Hash(r.digest)))
-    V41RowStoreEncodingUnestablished { obligation: _ } => [] as List<V41StagedRankStore>
-    V41RowStoreEncodingRefused { defects: _ } => [] as List<V41StagedRankStore>
-  }
-}
-
-fn v41_staged_with_readback(encoding: V41RowStoreEncoding, readback: ContentHash) -> List<V41StagedRankStore> {
-  match encoding {
-    V41RowStoreEncodingIdentified { spec: _, spec_key: _, rank_stores: rs, content_digest: _ } =>
-      map(rs, r => v41_staged_rank_store(layer: r.layer, rank: r.rank, identity: Sha256Hash(r.digest), readback: readback))
-    V41RowStoreEncodingUnestablished { obligation: _ } => [] as List<V41StagedRankStore>
-    V41RowStoreEncodingRefused { defects: _ } => [] as List<V41StagedRankStore>
-  }
-}
-
-type V41StagingRequest sole_constructor {
-  image: V41OciImageDigest
-  ranks: List<V41RankStoreIdentity>
-}
-
-fn v41_staging_request(image: V41OciImageDigest, encoding: V41RowStoreEncoding) -> V41StagingRequest? {
-  match encoding {
-    V41RowStoreEncodingIdentified { spec: _, spec_key: _, rank_stores: rs, content_digest: _ } =>
-      Present { value: V41StagingRequest { image: image, ranks: rs } }
-    V41RowStoreEncodingUnestablished { obligation: _ } => none
-    V41RowStoreEncodingRefused { defects: _ } => none
-  }
-}
-
-type V41StagingReceipt
-  = V41StagingVerified {
-      request_key: ContentHash
-      image_readback: OciContentDigest
-      ranks: List<V41StagedRankStore>
-    }
-  | V41RankStoresVerified { ranks: List<V41StagedRankStore> }
-  | V41StagingUnestablished { obligation: NonEmptyStr }
-  | V41StagingRefused { defects: List<NonEmptyStr> }
-
-// EVERY DESIRED (LAYER, RANK) STORE IS READ BACK AS ITSELF: same key, same identity, and a readback
-// equal to that identity. Matching by position would let two stores swap and still pass.
-fn v41_rank_readbacks_match(desired: List<V41RankStoreIdentity>, rank_readbacks: List<V41StagedRankStore>) -> Bool {
-  length(rank_readbacks) == length(desired)
-    && all(desired, d => any(rank_readbacks, s =>
-      s.layer == d.layer && s.rank == d.rank
-        && (serialize_content_hash(hash: s.identity) as String) == (serialize_content_hash(hash: Sha256Hash(d.digest)) as String)
-        && (serialize_content_hash(hash: s.readback) as String) == (serialize_content_hash(hash: s.identity) as String)))
-}
-
-// AUTHORIZED CUT C DOOR: rank-store bytes on disk, identity and readback. Does not claim an image
-// was produced or a serving process ran. V41StagingVerified stays behind BuiltByThisRun image
-// readback, which is the operator decision this module must not take.
-fn v41_stage_rank_stores(encoding: V41RowStoreEncoding, rank_readbacks: List<V41StagedRankStore>) -> V41StagingReceipt {
-  match encoding {
-    V41RowStoreEncodingUnestablished { obligation: o } => V41StagingUnestablished { obligation: o }
-    V41RowStoreEncodingRefused { defects: d } => V41StagingRefused { defects: d }
-    V41RowStoreEncodingIdentified { spec: _, spec_key: _, rank_stores: rs, content_digest: _ } =>
-      if v41_rank_readbacks_match(desired: rs, rank_readbacks: rank_readbacks) {
-        V41RankStoresVerified { ranks: rank_readbacks }
-      } else {
-        V41StagingRefused { defects: ["rank-local readback does not match the requested row-store identities" as NonEmptyStr] }
-      }
-  }
-}
-
-// NOT THE CUT C DOOR. Minting V41StagingVerified requires a produced image digest (BuiltByThisRun).
-// That is running the first-party candidate. Do not call this to route around authorized_v4_1_runtime_holds.
-fn v41_stage(
-  request: V41StagingRequest,
-  image_readback: OciContentDigest,
-  rank_readbacks: List<V41StagedRankStore>,
-  provenance: VllmImageProvenance,
-) -> V41StagingReceipt {
-  match provenance {
-    AdoptedUnderExpectedTag => V41StagingRefused {
-      defects: ["staging a tag-only image is refused; the receipt must carry the produced digest" as NonEmptyStr],
-    }
-    BuiltByThisRun => {
-      let image_ok = render_oci_content_digest_wire(d: image_readback) == render_oci_content_digest_wire(d: request.image.manifest)
-      if !image_ok {
-        V41StagingRefused { defects: ["image readback does not match the requested manifest digest" as NonEmptyStr] }
-      } else if !v41_rank_readbacks_match(desired: request.ranks, rank_readbacks: rank_readbacks) {
-        V41StagingRefused { defects: ["rank-local readback does not match the requested row-store identities" as NonEmptyStr] }
-      } else {
-        V41StagingVerified {
-          request_key: artifact_realization_digest(inputs: concat(
-            [
-              v41_input(identity: "image.manifest", value: render_oci_content_digest_wire(d: request.image.manifest)),
-              v41_input(identity: "image.config", value: render_oci_content_digest_wire(d: request.image.config)),
-            ],
-            map(request.ranks, r => v41_input(identity: v41_store_key(layer: r.layer, rank: r.rank), value: serialize_content_hash(hash: Sha256Hash(r.digest)) as String)))),
-          image_readback: image_readback,
-          ranks: rank_readbacks,
-        }
-      }
-    }
-  }
-}
-
-// THE LIVE GROUP-A FILL IS AN OBLIGATION UNTIL THE ORIGIN BYTES ARE TRANSFORMED. This cut models the
-// request and the receipt shape. Minting a verified receipt without a readback would be
-// specification-without-execution.
-fn v41_engram_goes_to_disk_because() -> DeclarationRef {
-  id_component_budget_authority
-}
-
-data v41_group_a_staging_standing: V41StagingReceipt = V41StagingUnestablished {
-  obligation: "Operator 2026-09-17: group A is unused; stage onto it; do not tear down the pair occupant; do not launch a first-party serving process. Rank fill waits on operator acquisition of the V4.1 checkpoint plus the Engram transform (hundreds of GB); there is no transform source to point v41_published_transform_standing at. Empty /home/briansrls/v41-engram-staging on spark-a3ee/3bd5/c2b1/ac79 is not a receipt. Receive fill through v41_stage_rank_stores. V41StagingVerified waits on a produced image digest the operator has not authorized. Disk justification is candidate_component_budget (id_component_budget_authority). GB10 is one unified pool (engram_pool_relief); staging must not be planned as a second pool." as NonEmptyStr,
-}
diff --git a/dag/gunbc/spark/v41_engram_store_manifest.dag b/dag/gunbc/spark/v41_engram_store_manifest.dag
deleted file mode 100644
index cc0a0f4c2dc..00000000000
--- a/dag/gunbc/spark/v41_engram_store_manifest.dag
+++ /dev/null
@@ -1,72 +0,0 @@
-module gunbc.spark.v41_engram_store_manifest
-
-import std.types { Bool, Int, List, NonEmptyStr, String }
-import std.nat { Nat }
-import std.measure { byte_size_count }
-import std.optional { Present, Absent }
-import v2.std.algebra { filter }
-import extdeps.languages.json.emit { JsonValue, json_object, json_kv, json_string, json_int, json_array, serialize_json }
-import gunbc.spark.v41_engram_row_store {
-  V41RowStoreEncodingSpec, V41PublishedStoreReadings, V41PublishedStoresRead, V41PublishedStoresUnread,
-  V41ObservedRankStore, v41_row_bytes, weight_bytes, v41_published_store_readings,
-}
-import gunbc.spark.v41_row_store_encode { v41_magic_hex, v41_store_out_path }
-
-// ══ THE LAUNCH'S ENGRAM ROW-STORE MANIFEST ═══════════════════════════════════════════════════════
-//
-// The file-backed Engram overlay (patches/d2d649e6, engram_file_backed.py load_manifest) serves every
-// Engram layer from the row stores a launch names in GUNBC_ENGRAM_ROW_STORE_MANIFEST, and refuses at
-// model init if a (layer, rank) it needs is not named, if a store is missing, or if its bytes are not
-// the digest named here. This module DERIVES that document; nothing in it is authored beside the
-// row-store model:
-//   magic and record geometry  -- the encoding spec the stores were written from (v41_row_bytes,
-//                                 weight_bytes, gunbc.spark.v41_row_store_encode v41_magic_hex);
-//   each store's path          -- v41_store_out_path, the path the encode wrote it to;
-//   each store's sha256        -- the published store readings (the encode run's receipt).
-// A manifest is derived only when every (layer, rank) the spec owes has exactly one read store; any
-// gap refuses, because a manifest that omits a store is a launch that refuses on that rank anyway,
-// later and on a Spark.
-//
-// CONSUMERS: gunbc.spark.v41_engram_differential_run (the byte-identical differential, which runs the
-// overlay against upstream's kernel on these stores), and the V4.1 capacity measurement serve's
-// launch, which lands with the wet runner (gunbc.spark.v41_capacity_measurement v41_wet_runner_frontier).
-
-type V41EngramStoreManifest
-  = V41StoreManifestDerived { text: String, stores: Nat }
-  | V41StoreManifestRefused { causes: List<String> }
-
-fn v41_manifest_store_json(o: V41ObservedRankStore) -> JsonValue {
-  json_object(members: [
-    json_kv(key: "layer", value: json_int(n: o.identity.layer)),
-    json_kv(key: "rank", value: json_int(n: o.identity.rank)),
-    json_kv(key: "path", value: json_string(s: v41_store_out_path(layer: o.identity.layer, rank: o.identity.rank) as String)),
-    json_kv(key: "sha256", value: json_string(s: o.identity.digest.hex as String)),
-  ])
-}
-
-fn v41_engram_store_manifest(spec: V41RowStoreEncodingSpec, readings: V41PublishedStoreReadings) -> V41EngramStoreManifest {
-  match readings {
-    V41PublishedStoresUnread { obligation: why } => V41StoreManifestRefused { causes: [join(["the published stores are unread: ", why as String], "")] }
-    V41PublishedStoresRead { host: _, observed_at: _, stores: stores } => {
-      let gaps = flat_map(spec.layers, t => flat_map(t.ranks, r => {
-        let n = length(filter(stores, o => o.identity.layer == t.layer && o.identity.rank == r.rank))
-        if n == 1 { [] as List<String> } else { [join(["layer ", to_string(t.layer), " rank ", to_string(r.rank), " has ", to_string(n), " read stores"], "")] }
-      }))
-      let extra = filter(stores, o => length(filter(spec.layers, t => t.layer == o.identity.layer && length(filter(t.ranks, r => r.rank == o.identity.rank)) == 1)) == 0)
-      let causes = concat(gaps, map(extra, o => join(["a read store for layer ", to_string(o.identity.layer), " rank ", to_string(o.identity.rank), " is not owed by the spec"], "")))
-      if length(causes) != 0 {
-        V41StoreManifestRefused { causes: causes }
-      } else {
-        V41StoreManifestDerived {
-          text: serialize_json(v: json_object(members: [
-            json_kv(key: "magic_hex", value: json_string(s: v41_magic_hex())),
-            json_kv(key: "record_bytes", value: json_int(n: byte_size_count(b: v41_row_bytes(g: spec.geometry)))),
-            json_kv(key: "weight_bytes", value: json_int(n: byte_size_count(b: weight_bytes(g: spec.geometry)))),
-            json_kv(key: "stores", value: json_array(elements: map(stores, o => v41_manifest_store_json(o: o)))),
-          ])),
-          stores: length(stores),
-        }
-      }
-    }
-  }
-}
diff --git a/dag/gunbc/spark/v41_group_a_launch.dag b/dag/gunbc/spark/v41_group_a_launch.dag
deleted file mode 100644
index adc1b2bc694..00000000000
--- a/dag/gunbc/spark/v41_group_a_launch.dag
+++ /dev/null
@@ -1,813 +0,0 @@
-module gunbc.spark.v41_group_a_launch
-
-import gunbc.spark.pair_serving_d0_door { StandingGrantRowNotOnMain }
-import std.types { String, Bool, Int, List, NonEmptyStr, Port, FilePath }
-import std.algebra { trim }
-import std.optional { Present, Absent }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import std.measure { byte_size, Kibibyte }
-import std.content_hash { ContentHash, content_hash_equal, serialize_content_hash }
-import product.host_identity { HostIdentity }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import extdeps.exec.command { argv_words }
-import extdeps.tools.mkdir { mkdir_parents_command_at, mkdir_path_resolved_program }
-import gunbc.file_access { FileTreeScope }
-import gunbc.remote_operation { PlannedRemoteStep, RemoteArgv, RemoteFileBytes, remote_operation_label }
-import gunbc.typed_remote_file_write { typed_remote_file_write_seal, TypedRemoteFileWriteAdmitted, TypedRemoteFileWriteAdmissionRefused, RemoteFileModeOwnerReadWriteWorldRead }
-import extdeps.docker.cli { DockerEnvAssignment, BindMount }
-import extdeps.vllm.source_build { VllmContainerBuildRecipe }
-import extdeps.container.oci.digest { render_oci_content_digest_wire }
-import gunbc.spark.fabric_reach { ReachManagementLan, spark_reach_endpoint }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, fabric_group_hosts }
-import gunbc.spark.serving_subject { PairServingUnitOn }
-import gunbc.spark.host_commitment { admit_host_held_by_subject }
-import gunbc.spark.runtime_architecture_registry_reading { ArchitectureRegistryReading }
-import gunbc.spark.serving_arm { ServingRuntime, GunbcDeepseekV41EngramProduced, DeepseekV41FlashDba1be0a, FourSparkTp4, ArmIntent, ArmBoundedExperiment, ServingLaunchProfile, deepseek_v41_launch_policy, runtime_artifact_identity, PinnedByDigest, SourceRevisionEstablished }
-import gunbc.spark.serving_arm_launch { ArmContainerIdentity, ArmNodeLaunch }
-import gunbc.spark.native_serving_realization { ArmUnitIdentity, GlmNativeUnitRender }
-import gunbc.spark.native_serving_apply { SparkNativeArmSteps, SparkNativeHostStep }
-import gunbc.spark.pair_serving_realization { spark_pair_serve_port }
-import gunbc.spark.pair_serving_authority { PairServingGroupAuthority }
-import gunbc.spark.v41_runtime_candidate { V41CandidateStanding, V41CandidateKeyed, V41CandidateUnestablished, V41CandidateRefused, v41_candidate, v41_candidate_recipe, V41IdentityStanding, V41IdentityKeyed, V41IdentityUnestablished, V41IdentityRefused, v41_runtime_artifact_key, v41_candidate_inputs, v41_candidate_partition }
-import gunbc.spark.v41_runtime_image_converge { V41ProducedImageHeld, v41_production_produced_image, v41_produced_image_subject, V41ProbeJoinedToProducedImage, V41ProbeDescribesAnotherImage, V41ProbeIdentityUnreadable, V41ProbeIdentityNotRead, v41_probe_identity_join, v41_probe_identity_line }
-import gunbc.spark.v41_runtime_image_probe { V41ProbeOutcome, V41ProbeRead, V41ProbeRefused, v41_probe_image_in_place }
-import gunbc.spark.vllm_runtime_image_build { VllmImageDistributionSubject, VllmImageTargetRead, VllmImageTargetHolds, VllmImageTargetNeeds, VllmImageTargetRefused, vllm_image_target_read, vllm_image_target_ctx, with_spark_build_host, SparkBuildHostWork, SparkBuildHostRefused, SparkBuildHostRan }
-import gunbc.spark.runtime_architecture_registry_reading { vllm_registry_instrument, registry_dump_architectures, registry_dump_count }
-import gunbc.spark.v41_engram_row_store { v41_row_store_spec, v41_live_head_sizes, V41RowStoreSpecAdmitted, V41RowStoreSpecRefused, v41_published_store_readings }
-import gunbc.spark.v41_engram_store_manifest { V41EngramStoreManifest, V41StoreManifestDerived, V41StoreManifestRefused, v41_engram_store_manifest }
-import extdeps.deepseek.deepseek_v4_1_flash { deepseek_v4_1_flash_engram, deepseek_v4_1_flash_engram_sharded_entries }
-import gunbc.spark.remote_step_sequence { run_remote_step_sequence, remote_step_sequence_failed, remote_step_sequence_wire }
-import gunbc.host_effect { FleetSsh }
-import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext, SshTarget }
-import gunbc.spark.managed_access_bootstrap { spark_managed_executor_login }
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext, RemoteRan, RemoteUnreachable, spark_remote_run }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fleet_multi_principal_probe { spark_converge_target_selection, SparkConvergeTargetSingle, SparkConvergeTargetAllObserveOnly, SparkConvergeTargetRefused }
-import gunbc.spark.v41_capacity_measurement { V41MeasurementLaunchShape, v41_measurement_launch_shape }
-import gunbc.spark.serving_capacity_intent { uniform_cold_seats, envelope_at_cold_floor, profile_for_envelope, ServingCapacityIntentAdmitted, ServingCapacityIntentRefused }
-import gunbc.spark.v41_row_store_encode { v41_row_store_output_directory }
-import gunbc.spark.group_arm_launch { GroupArmLaunchInputs, GroupArmLaunchPlan, GroupArmLaunchPlanned, GroupArmLaunchRefused, GroupArmLaunchAdmission, GroupArmLaunchAdmittedForAdoptionOnly, GroupArmLaunchAdmitted, GroupArmLaunchAdmissionRefused, GroupArmHostOccupancy, ArmSuccessorStanding, ArmSuccessorKeyed, ArmSuccessorUnkeyed, NoIncumbentDeclared, ArmPreApply, ArmPreApplyPassed, ArmPreApplyStopped, ArmPreApplyWire, group_arm_launch_plan, group_arm_unit_renders, group_arm_steps, group_arm_launch_admission, group_arm_launch_admission_live, group_arm_dry_run_occupancy, group_arm_dry_run_report, group_arm_memory_need, group_arm_read_occupancy, group_arm_apply_admitted }
-import gunbc.spark.fabric_serving_assignment { fabric_serving_assignment_for_launch }
-// ── THE V4.1 FOUR-RANK LAUNCH ON GROUP A, AS ONE MORE CALL SITE OF THE ARM LAUNCHER ─────────────
-//
-// SINCE DEFORKING CUT 8a THIS MODULE IS THE V4.1 ARM'S INPUTS AND NOTHING ELSE. The plan, the units,
-// the steps, the admission's shared conjuncts, the dry-run report, the wet entry and the transaction
-// are gunbc.spark.group_arm_launch's -- the one launch path every arm on a fabric group takes. What
-// stays here is V4.1's: the held production image and its registry reading, the Engram manifest, mounts,
-// environment and staging, the SM120 self-test, the candidate's successor key and the one conjunct only
-// V4.1 has (the produced image's specification key must be its candidate's).
-//
-// WHY THIS IS NOT A SECOND LAUNCHER. Group A's incumbent realization is the Ray pair
-// (gunbc.spark.pair_serving_realization), and V4.1 cannot run on it: the V4.1 image is upstream vLLM
-// d2d649e6's vllm-openai target, and neither that revision's requirements nor its Dockerfile installs
-// Ray, so `ray start` has nothing to run. The launcher that fits already exists -- the mp-backend
-// multi-node arm (gunbc.spark.serving_arm_launch plan_arm_launch_for: --nnodes, --node-rank,
-// --master-addr over the fabric rail, headless followers), its unit renderer
-// (gunbc.spark.native_serving_realization) and its transactional apply
-// (gunbc.spark.native_serving_apply: preflight, preserve, head-first apply, per-rank readback, commit or
-// rollback). This module names V4.1's tuple once, the way gunbc.spark.glm_group_b_launch names Group B's,
-// and every V4.1 rendering projects from it. Ruled by proud-deer-538 on 2026-09-26 (DS4.1).
-//
-// WHAT IT RENDERS AND WHAT IT RUNS. The dry run plans, renders every host's unit and container line,
-// the Engram staging and the apply's preflight and apply scripts for all four hosts, and reaches no host
-// except the read of the authority log. The wet entry (the fleet mode spark_arm_group_launch with arm
-// v41-group-a, gunbc.spark.arm_group_launch_dispatch) reads the held image, its registry and every host's occupancy, and only on
-// v41_group_a_launch_admission stages the Engram manifest and runs the arm transaction. It is one serve
-// at the capacity measurement's shape; the staircase that loads it is that measurement's wet runner
-// (gunbc.spark.v41_capacity_measurement v41_wet_runner_frontier).
-
-// ── WHAT THIS DEPLOYMENT IS CALLED, DISTINCT FROM EVERY OTHER ────────────────────────────────
-//
-// THE NAMES ARE NEW ON PURPOSE. Host occupancy is read by unit and container name, and Group A's hosts
-// may still carry the V4 pair's gunbc-spark-pair container and units. Reusing any of those names would
-// let a V4 unit still running read as this arm already installed -- the one mistake the admission below
-// must never make, since a running V4 unit is occupancy to refuse on, never something to stop.
-data v41_group_a_container_name: NonEmptyStr = "gunbc-v41-tp4" as NonEmptyStr
-
-data v41_group_a_units: ArmUnitIdentity = ArmUnitIdentity {
-  head_unit_name: "gunbc-v41-tp4-head.service" as NonEmptyStr,
-  rank_unit_name: "gunbc-v41-tp4-rank.service" as NonEmptyStr,
-  head_log_path: "/var/log/gunbc/v41-tp4-head.log" as NonEmptyStr,
-  rank_log_path: "/var/log/gunbc/v41-tp4-rank.log" as NonEmptyStr,
-  description: "gunbc DeepSeek V4.1 four-rank arm" as NonEmptyStr,
-}
-
-// THE SERVED NAME IS THIS LAUNCH'S, and the port is the route's: V4.1 succeeds V4 on the same serving
-// subject (gunbc.spark.serving_subject PairServingUnitOn on Group A), and gunbc.serving.serving_enrollment
-// reads Group A's port from gunbc.spark.pair_serving_realization spark_pair_serve_port. Serving on any
-// other port would leave the enrolled route asking a door this launch never opens.
-data v41_group_a_served_alias: NonEmptyStr = "deepseek-v4.1-flash" as NonEmptyStr
-
-// THE RENDEZVOUS PORT IS torch.distributed's DEFAULT, 29500, chosen rather than inherited. Group A's
-// incumbent rendezvous is Ray's GCS on 6379 (gunbc.spark.pair_serving_observed first_pair_ray_head), so
-// the two do not collide on a host that still carries the pair.
-//
-// THE SHARED-MEMORY SIZE IS DOCKER'S OWN DEFAULT (64 MiB). With --ipc host the container's /dev/shm is
-// the host's, so the figure is nearly inert, but a spec may not carry a number nobody chose: this one
-// is the daemon's default rather than a figure borrowed from another arm's inspect.
-data v41_group_a_master_port: Port = 29500
-
-// ── THE ENGRAM FILE-BACKED PATH: TWO VARIABLES AND THREE MOUNTS ───────────────────────────────
-//
-// THE VARIABLE NAMES ARE THE OVERLAY'S. The file-backed Engram overlay (patches/d2d649e6,
-// engram_file_backed.py, its MANIFEST_ENV and TOUCH_RECEIPT_DIR_ENV constants, landing with #12359)
-// reads the row-store manifest from the FILE the first names -- load_manifest opens that path -- and
-// writes one touch receipt per rank into the directory the second names when the staircase runner sends
-// SIGUSR2 at a step boundary.
-data v41_engram_manifest_env_name: NonEmptyStr = "GUNBC_ENGRAM_ROW_STORE_MANIFEST" as NonEmptyStr
-data v41_engram_touch_receipt_env_name: NonEmptyStr = "GUNBC_ENGRAM_TOUCH_RECEIPT_DIR" as NonEmptyStr
-
-// THE MANIFEST AND THE RECEIPTS EACH GET THEIR OWN HOST DIRECTORY, mounted at the same path inside, so
-// a path the manifest names and a path the engine opens are one string. The manifest is read-only to
-// the engine; the receipt directory is the one place it writes. The row stores are mounted read-only
-// at their own path for the same reason: the manifest names them by the path the encode wrote them to.
-data v41_engram_manifest_dir: NonEmptyStr = "/var/lib/gunbc/v41-engram-manifest" as NonEmptyStr
-data v41_engram_touch_receipt_dir: NonEmptyStr = "/var/lib/gunbc/v41-engram-touch" as NonEmptyStr
-
-fn v41_engram_manifest_path() -> NonEmptyStr {
-  join([v41_engram_manifest_dir as String, "/row-store-manifest.json"], "") as NonEmptyStr
-}
-
-data v41_group_a_arm_container: ArmContainerIdentity = ArmContainerIdentity {
-  container_name: v41_group_a_container_name,
-  master_port: v41_group_a_master_port,
-  shm_size: byte_size(count: 67108864),
-  extra_mounts: [
-    BindMount { host_path: v41_row_store_output_directory(), container_path: v41_row_store_output_directory(), readonly: true },
-    BindMount { host_path: v41_engram_manifest_dir, container_path: v41_engram_manifest_dir, readonly: true },
-    BindMount { host_path: v41_engram_touch_receipt_dir, container_path: v41_engram_touch_receipt_dir, readonly: false },
-  ],
-}
-
-fn v41_group_a_deployment_env() -> List<DockerEnvAssignment> {
-  [
-    DockerEnvAssignment { name: v41_engram_manifest_env_name, value: v41_engram_manifest_path() as String },
-    DockerEnvAssignment { name: v41_engram_touch_receipt_env_name, value: v41_engram_touch_receipt_dir as String },
-  ]
-}
-
-// ── THE LAUNCH SHAPE IS THE MEASUREMENT'S ─────────────────────────────────────────────────────
-//
-// ONE SERVE FOR THE WHOLE STAIRCASE (clever-gull-48, 2026-09-26): a relaunch between steps would reset
-// the page cache, the refault baselines and the KV pool the stop rules read across steps. So every
-// engine figure this launch serves at -- the window, the admitted sequences (the staircase's largest
-// step), the scheduler budget, the memory fraction and the prefix-caching request -- is read from the
-// measurement's own authority, gunbc.spark.v41_capacity_measurement v41_measurement_launch_shape, and
-// none is spelled here. The last three are that authority's declared measurement axes; the startup
-// receipt records what the engine actually resolved, so a step the pool cannot hold refuses there.
-
-// ── THE INPUTS A PLAN IS MADE OF, SUPPLIED RATHER THAN READ INSIDE ────────────────────────────
-//
-// EVERY INPUT THAT IS NOT A DECLARATION ON MAIN ARRIVES AS A VALUE: the image as it is HELD on the
-// launch's hosts, its registry reading (both read at run time by the wet entry below) and the derived
-// Engram row-store manifest. A witness supplies them; the live bindings read what exists and name what
-// does not.
-type V41GroupALaunchInputs {
-  held: V41HeldRuntimeStanding
-  registry_reading: ArchitectureRegistryReading?
-  manifest: V41EngramStoreManifest
-}
-
-type V41GroupALaunchPlan
-  = V41GroupALaunchPlanned {
-      lines: List<ArmNodeLaunch>
-      profile: ServingLaunchProfile
-      specification_runtime_key: ContentHash
-      manifest_text: String
-      master_endpoint: NonEmptyStr
-    }
-  | V41GroupALaunchUnestablished { obligations: List<String> }
-  | V41GroupALaunchRefused { causes: List<String> }
-
-// ── THE IMAGE A LAUNCH RUNS IS HELD, NOT PRODUCED ─────────────────────────────────────────────
-//
-// A DIFFERENT STANDING FROM THE BUILD'S, ON PURPOSE. gunbc.spark.v41_runtime_realized
-// V41RuntimeProduced is minted only by the build leg that produced the bytes (V41ProducedRuntimeImage
-// is sole_constructor, and an image found under a tag refuses as AdoptedUnderExpectedTag), so a launch
-// running hours later on four other hosts cannot hold one and must not fake one. What it CAN
-// establish is the join of two facts: the production receipt row (gunbc.spark.v41_runtime_image_converge
-// v41_production_produced_image -- the digest, the tree the build observed, the run that produced it)
-// and a readback on EVERY launch host that the image's tag names exactly that digest there. The tag is
-// derived from the receipt's observed tree by the same fold the distribution uses
-// (v41_produced_image_subject), so a host holds the subject only if the distribution put it there.
-// Three further checks are the admission's own: the receipt's tree is the candidate recipe's revision;
-// the candidate's runtime artifact keys (v41_runtime_artifact_key, computed by the caller and handed
-// in, since it reads the kernel wheels), which is the specification key the admission compares with
-// the candidate below; and no host holds another image under the tag. A host
-// that holds nothing under the tag is an OBLIGATION naming the distribution mode, not a refusal: the fix
-// is to deliver, and nothing is wrong with the image.
-type V41HeldRuntimeStanding
-  = V41RuntimeHeldOnHosts { specification_runtime_key: ContentHash, image: V41ProducedImageHeld, subject: VllmImageDistributionSubject }
-  | V41RuntimeHeldUnestablished { obligations: List<String> }
-  | V41RuntimeHeldRefused { defects: List<String> }
-
-fn v41_host_image_read(host: HostIdentity, reads: List<VllmImageTargetRead>) -> VllmImageTargetRead? {
-  first(filter(reads, r => (r.host as String) == (host as String)))
-}
-
-fn v41_held_obligations(hosts: List<HostIdentity>, reads: List<VllmImageTargetRead>, subject: VllmImageDistributionSubject) -> List<String> {
-  flat_map(hosts, h => match v41_host_image_read(host: h, reads: reads) {
-    Absent => [join(["no image readback was taken on ", h as String, ", so whether it holds ", subject.tag as String, " is unknown"], "")]
-    Present { value: r } => match r.state {
-      VllmImageTargetHolds => [] as List<String>
-      VllmImageTargetNeeds => [join([h as String, " holds nothing under ", subject.tag as String, "; deliver it with the distribution mode spark_runtime_image_distribute, runtime_image v41-dsv41-gb10 (gunbc.spark.runtime_image_produce_dispatch runtime_image_distribute_ci_wet)"], "")]
-      VllmImageTargetRefused { step: _, cause: _ } => [] as List<String>
-    }
-  })
-}
-
-fn v41_held_defects(hosts: List<HostIdentity>, reads: List<VllmImageTargetRead>) -> List<String> {
-  flat_map(hosts, h => match v41_host_image_read(host: h, reads: reads) {
-    Absent => [] as List<String>
-    Present { value: r } => match r.state {
-      VllmImageTargetHolds => [] as List<String>
-      VllmImageTargetNeeds => [] as List<String>
-      VllmImageTargetRefused { step: st, cause: why } => [join([h as String, " refused the image readback at ", st as String, ": ", why], "")]
-    }
-  })
-}
-
-fn v41_admit_held_runtime(
-  recipe: VllmContainerBuildRecipe,
-  artifact: V41IdentityStanding,
-  image: V41ProducedImageHeld,
-  hosts: List<HostIdentity>,
-  reads: List<VllmImageTargetRead>,
-) -> V41HeldRuntimeStanding {
-  let subject = v41_produced_image_subject(p: image)
-  let defects = concat(
-    if (image.observed.revision_head as String) == (recipe.source.full_revision as String) { [] as List<String> } else {
-      [join(["the production receipt's image was built from a tree at ", image.observed.revision_head as String, ", and this candidate's recipe names ", recipe.source.full_revision as String], "")]
-    },
-    v41_held_defects(hosts: hosts, reads: reads))
-  let obligations = v41_held_obligations(hosts: hosts, reads: reads, subject: subject)
-  match artifact {
-    V41IdentityRefused { defects: d } => V41RuntimeHeldRefused { defects: concat(map(d, x => x as String), defects) }
-    V41IdentityUnestablished { obligations: o } =>
-      if length(defects) != 0 { V41RuntimeHeldRefused { defects: defects } } else { V41RuntimeHeldUnestablished { obligations: concat(map(o, x => x as String), obligations) } }
-    V41IdentityKeyed { key: spec } =>
-      if length(defects) != 0 {
-        V41RuntimeHeldRefused { defects: defects }
-      } else if length(obligations) != 0 {
-        V41RuntimeHeldUnestablished { obligations: obligations }
-      } else {
-        V41RuntimeHeldOnHosts { specification_runtime_key: spec, image: image, subject: subject }
-      }
-  }
-}
-
-// THE RUNTIME VARIANT IS THE HELD IMAGE'S IDENTITY: its configuration digest (the only id a
-// never-pushed image has, and the one the distribution moves and the hosts read back), the source tree
-// the build observed, and that tree's worktree diff -- the patch set as it was applied.
-fn v41_serving_runtime(held: V41HeldRuntimeStanding, registry_reading: ArchitectureRegistryReading?) -> ServingRuntime? {
-  match held {
-    V41RuntimeHeldUnestablished { obligations: _ } => none
-    V41RuntimeHeldRefused { defects: _ } => none
-    V41RuntimeHeldOnHosts { specification_runtime_key: k, image: i, subject: sub } =>
-      Present { value: GunbcDeepseekV41EngramProduced {
-        artifact: runtime_artifact_identity(
-          pin: PinnedByDigest { reference: render_oci_content_digest_wire(d: i.config) as NonEmptyStr },
-          source: SourceRevisionEstablished { revision: i.observed.revision_head },
-          patch_set: [join(["worktree-diff-sha256:", i.observed.worktree_diff_sha256.hex as String], "") as NonEmptyStr],
-          provenance: join(["produced by fleet-converge run ", i.receipt_run as String, " on ", i.held_on as String, " under tag ", sub.tag as String, ", read back under that tag at this digest on every launch host, and admitted against the candidate's specification runtime key ", serialize_content_hash(hash: k) as String], "") as NonEmptyStr,
-        ),
-        registry_reading: registry_reading,
-      } }
-  }
-}
-
-fn v41_held_obligations_of(h: V41HeldRuntimeStanding) -> List<String> {
-  match h {
-    V41RuntimeHeldOnHosts { specification_runtime_key: _, image: _, subject: _ } => [] as List<String>
-    V41RuntimeHeldUnestablished { obligations: o } => map(o, x => join(["the V4.1 image: ", x], ""))
-    V41RuntimeHeldRefused { defects: _ } => [] as List<String>
-  }
-}
-
-fn v41_held_defects_of(h: V41HeldRuntimeStanding) -> List<String> {
-  match h {
-    V41RuntimeHeldRefused { defects: d } => map(d, x => join(["the V4.1 image was refused: ", x], ""))
-    V41RuntimeHeldOnHosts { specification_runtime_key: _, image: _, subject: _ } => [] as List<String>
-    V41RuntimeHeldUnestablished { obligations: _ } => [] as List<String>
-  }
-}
-
-// ── THE MANIFEST THE LAUNCH STAGES IS DERIVED, AS THE DIFFERENTIAL'S IS ──────────────────────
-//
-// The same derivation gunbc.spark.v41_engram_differential_run hands its overlay: the row-store spec
-// over the live Engram population, then gunbc.spark.v41_engram_store_manifest over the published store
-// readings. A refusal at either names its causes, and the plan carries them as refusals.
-fn v41_group_a_manifest() -> V41EngramStoreManifest {
-  match v41_row_store_spec(population: map(deepseek_v4_1_flash_engram_sharded_entries, e => e.entry), partition: v41_candidate_partition, tables: deepseek_v4_1_flash_engram, head_sizes: v41_live_head_sizes(tables: deepseek_v4_1_flash_engram)) {
-    V41RowStoreSpecRefused { defects: d } => V41StoreManifestRefused { causes: map(d, x => join(["the row-store spec refused: ", x as String], "")) }
-    V41RowStoreSpecAdmitted { spec: spec } => v41_engram_store_manifest(spec: spec, readings: v41_published_store_readings)
-  }
-}
-
-fn v41_manifest_defects(m: V41EngramStoreManifest) -> List<String> {
-  match m {
-    V41StoreManifestDerived { text: _, stores: _ } => [] as List<String>
-    V41StoreManifestRefused { causes: c } => map(c, x => join(["the Engram row-store manifest refused: ", x], ""))
-  }
-}
-
-// THE INTENT IS ONE ROW, READ BY THE PLAN AND BY THE UNIT RENDER. V4.1 runs on Group A only as a bounded
-// experiment; the plan is admitted under this intent and the units render under it -- one attempt, no
-// restart, RuntimeMaxSec at the bound the wall derives from this launch -- so the engine that runs is
-// the experiment the wall admitted, never a persistent service planned as one.
-data v41_group_a_intent: ArmIntent = ArmBoundedExperiment
-
-// THE LAUNCH PASSES THE SAME MEMORY WALL AS EVERY ARM (deforking cut 4): plan_arm_launch_under_memory_fit,
-// not plan_arm_launch_for. The fit verdict is Unestablished for V4.1 today (its per-rank terms are open),
-// so the bounded experiment is admitted only behind a typed experiment plan with a stop contract and a
-// runtime bound derived from THIS launch's environment -- upstream's 600-second ready default, since the
-// deployment sets none -- and its own sequence ceiling. Normal serving stays refused until the fit proves.
-//
-// THE PROFILE IS DERIVED THE WAY EVERY MODEL'S IS (deforking cut 3): the measurement shape's window,
-// sequence population and batch become a cold intent; the envelope sits AT THE FLOOR, so the engine's
-// ceiling equals the measured seat population exactly as before; the model's own choices are
-// gunbc.spark.serving_arm deepseek_v41_launch_policy. Absent means the intent refused (a zero-seat or
-// zero-batch shape), and the launch plan refuses with it rather than inventing a profile.
-fn v41_group_a_profile(shape: V41MeasurementLaunchShape) -> ServingLaunchProfile? {
-  match uniform_cold_seats(each: shape.max_model_len, seats: shape.max_num_seqs, max_batched_tokens: shape.max_num_batched_tokens) {
-    ServingCapacityIntentRefused { cause: _ } => none
-    ServingCapacityIntentAdmitted { intent: intent } => Present { value: profile_for_envelope(
-      envelope: envelope_at_cold_floor(cold: intent),
-      policy: deepseek_v41_launch_policy,
-      decided_gpu_memory_basis_points: shape.gpu_memory_utilization,
-      serve_port: spark_pair_serve_port,
-      served_alias: v41_group_a_served_alias,
-      prefix_caching: shape.prefix_caching,
-    ) }
-  }
-}
-
-// THE V4.1 ARM'S INPUTS TO THE ONE LAUNCH PATH (gunbc.spark.group_arm_launch, deforking cut 8a): its
-// assignment on Group A with the held runtime, the measurement's profile, the Engram environment and
-// mounts, and its own names. Everything else -- the memory wall, the units, the steps, the admission's
-// shared conjuncts and the transaction -- is that module's.
-data v41_group_a_purpose: NonEmptyStr = "the V4.1 Group A four-rank launch" as NonEmptyStr
-
-fn v41_group_a_arm_inputs(runtime: ServingRuntime, launch_profile: ServingLaunchProfile) -> GroupArmLaunchInputs {
-  GroupArmLaunchInputs {
-    assignment: fabric_serving_assignment_for_launch(group: FabricGroupA, checkpoint: DeepseekV41FlashDba1be0a, runtime: runtime, topology: FourSparkTp4),
-    profile: launch_profile,
-    intent: v41_group_a_intent,
-    deployment_env: v41_group_a_deployment_env(),
-    container: v41_group_a_arm_container,
-    units: v41_group_a_units,
-    purpose: v41_group_a_purpose,
-  }
-}
-
-// THE PLAN. A defect in any input refuses; otherwise every missing input is named at once, so one run
-// reports the whole distance to a launchable plan rather than the first gap. Only a complete set of
-// inputs reaches the one launch path, and its walls -- the arm admission (registry reading, fit), the
-// compatibility roster and the bounded-experiment intent -- still decide. The V4.1 plan carries the two
-// facts that are V4.1's beside the generic plan's: the specification runtime key the held image was
-// admitted against, and the Engram manifest the pre-apply stages.
-fn v41_group_a_launch_plan(inputs: V41GroupALaunchInputs) -> V41GroupALaunchPlan {
-  let defects = concat(v41_held_defects_of(h: inputs.held), v41_manifest_defects(m: inputs.manifest))
-  let obligations = v41_held_obligations_of(h: inputs.held)
-  if length(defects) != 0 {
-    V41GroupALaunchRefused { causes: defects }
-  } else if length(obligations) != 0 {
-    V41GroupALaunchUnestablished { obligations: obligations }
-  } else {
-    match inputs.held {
-      V41RuntimeHeldUnestablished { obligations: _ } => V41GroupALaunchUnestablished { obligations: obligations }
-      V41RuntimeHeldRefused { defects: _ } => V41GroupALaunchRefused { causes: defects }
-      V41RuntimeHeldOnHosts { specification_runtime_key: key, image: _, subject: _ } =>
-        match v41_serving_runtime(held: inputs.held, registry_reading: inputs.registry_reading) {
-          Absent => V41GroupALaunchRefused { causes: ["unreachable: a held image always has a runtime identity"] }
-          Present { value: runtime } =>
-            match inputs.manifest {
-              V41StoreManifestRefused { causes: c } => V41GroupALaunchRefused { causes: c }
-              V41StoreManifestDerived { text: manifest, stores: _ } =>
-                match v41_group_a_profile(shape: v41_measurement_launch_shape()) {
-                  Absent => V41GroupALaunchRefused { causes: ["the V4.1 measurement shape's cold intent refused (zero seats or zero batched tokens), so no launch profile derives"] }
-                  Present { value: launch_profile } =>
-                    match group_arm_launch_plan(inputs: v41_group_a_arm_inputs(runtime: runtime, launch_profile: launch_profile)) {
-                      GroupArmLaunchRefused { causes: c } => V41GroupALaunchRefused { causes: c }
-                      GroupArmLaunchPlanned { lines: ls, profile: prof, master_endpoint: e } =>
-                        V41GroupALaunchPlanned { lines: ls, profile: prof, specification_runtime_key: key, manifest_text: manifest, master_endpoint: e }
-                    }
-                }
-            }
-        }
-    }
-  }
-}
-
-// THE V4.1 PLAN AS THE ONE PATH'S PLAN: the same lines, profile and rendezvous, less the two V4.1 facts.
-// An unestablished V4.1 plan is a refusal there, naming what it waits on.
-fn v41_arm_plan(p: V41GroupALaunchPlan) -> GroupArmLaunchPlan {
-  match p {
-    V41GroupALaunchPlanned { lines: ls, profile: prof, specification_runtime_key: _, manifest_text: _, master_endpoint: e } =>
-      GroupArmLaunchPlanned { lines: ls, profile: prof, master_endpoint: e }
-    V41GroupALaunchUnestablished { obligations: o } => GroupArmLaunchRefused { causes: map(o, x => join(["the plan is not established: ", x], "")) }
-    V41GroupALaunchRefused { causes: c } => GroupArmLaunchRefused { causes: c }
-  }
-}
-
-// ── THE UNITS AND STEPS ARE THE ONE PATH'S, UNDER V4.1'S INTENT AND NAMES ───────────────────────
-
-fn v41_group_a_unit_renders(p: V41GroupALaunchPlan) -> List<GlmNativeUnitRender> {
-  group_arm_unit_renders(intent: v41_group_a_intent, units: v41_group_a_units, p: v41_arm_plan(p: p))
-}
-
-fn v41_group_a_steps(p: V41GroupALaunchPlan) -> SparkNativeArmSteps {
-  group_arm_steps(intent: v41_group_a_intent, units: v41_group_a_units, p: v41_arm_plan(p: p))
-}
-
-// THE ENGRAM STAGING RUNS BEFORE THE APPLY'S PREFLIGHT, because the preflight refuses a container whose
-// mount sources are missing (gunbc.spark.native_serving_apply spark_native_mount_source_checks), and the
-// manifest and receipt directories exist only once this has run.
-//
-// IT IS MODELLED REMOTE STEPS, NOT A SHELL BODY (review 71644). Each step is a gunbc.remote_operation
-// PlannedRemoteStep: the two directories are the mkdir argv extdeps.tools.mkdir renders, and the manifest
-// is a gunbc.typed_remote_file_write sealed to the manifest directory, so it lands as readback-verified
-// bytes rather than as text a printf wrote. Nothing is cleared from the receipt directory: the overlay
-// writes each rank's receipt by temp file and rename (write_touch_receipt), so a receipt is always a whole
-// document from one SIGUSR2, and the row stores' presence is already the preflight's mount-source check.
-fn v41_engram_manifest_scope() -> FileTreeScope {
-  FileTreeScope { root_path: v41_engram_manifest_dir }
-}
-
-fn v41_engram_staging_steps(manifest_text: String) -> List<PlannedRemoteStep>? {
-  match typed_remote_file_write_seal(
-    path: v41_engram_manifest_path() as FilePath,
-    content: manifest_text,
-    allowed_scope: v41_engram_manifest_scope(),
-  ) {
-    TypedRemoteFileWriteAdmissionRefused { cause: _ } => none
-    TypedRemoteFileWriteAdmitted { write: manifest } => Present {
-      value: [
-        PlannedRemoteStep {
-          identity: "v41-engram-manifest-dir" as NonEmptyStr,
-          operation: RemoteArgv { argv: argv_words(command: mkdir_parents_command_at(mkdir_binary: mkdir_path_resolved_program, path: v41_engram_manifest_dir as String)) },
-        },
-        PlannedRemoteStep {
-          identity: "v41-engram-touch-receipt-dir" as NonEmptyStr,
-          operation: RemoteArgv { argv: argv_words(command: mkdir_parents_command_at(mkdir_binary: mkdir_path_resolved_program, path: v41_engram_touch_receipt_dir as String)) },
-        },
-        PlannedRemoteStep {
-          identity: "v41-engram-manifest" as NonEmptyStr,
-          operation: RemoteFileBytes { write: manifest, mode: RemoteFileModeOwnerReadWriteWorldRead },
-        },
-      ],
-    }
-  }
-}
-
-fn v41_engram_staging_wire(manifest_text: String) -> String {
-  match v41_engram_staging_steps(manifest_text: manifest_text) {
-    Absent => "REFUSED: the manifest write could not be sealed to its directory"
-    Present { value: steps } => join(map(steps, st => join([st.identity as String, ": ", remote_operation_label(operation: st.operation)], "")), "\n")
-  }
-}
-
-// ── ADMISSION: THE ONE PATH'S CONJUNCTS, WITH V4.1'S SUCCESSOR AND ITS OWN ───────────────────
-//
-// gunbc.spark.group_arm_launch group_arm_launch_admission judges the authority, the successor, the
-// subject's hold and every host's occupancy. What V4.1 supplies:
-//   - ITS SUCCESSOR is its candidate's key (gunbc.spark.v41_runtime_candidate V41CandidateKeyed
-//     candidate), which is what D0's grant names; an unkeyed or refused candidate has no successor.
-//   - ONE CONJUNCT OF ITS OWN: the produced image was admitted against a specification runtime key, and
-//     that key must be the candidate's runtime_artifact key -- so an image built from another tree
-//     cannot ride an authorization granted to this one.
-//   - NO DECLARED INCUMBENT. A V4 pair unit still running, any GPU compute process at all, or too little
-//     available memory refuses -- and is never stopped by this launch.
-fn v41_successor(candidate: V41CandidateStanding) -> ArmSuccessorStanding {
-  match candidate {
-    V41CandidateUnestablished { obligations: o } => ArmSuccessorUnkeyed { causes: map(o, x => join(["the V4.1 candidate is not keyed: ", x as String], "")) }
-    V41CandidateRefused { defects: d } => ArmSuccessorUnkeyed { causes: map(d, x => join(["the V4.1 candidate is refused: ", x as String], "")) }
-    V41CandidateKeyed { runtime_artifact: _, model_source: _, engram_realization: _, execution_profile: _, candidate: c, authorization_obligation: _ } => ArmSuccessorKeyed { key: c }
-  }
-}
-
-fn v41_runtime_key_causes(plan: V41GroupALaunchPlan, candidate: V41CandidateStanding) -> List<String> {
-  match plan {
-    V41GroupALaunchPlanned { lines: _, profile: _, specification_runtime_key: spec, manifest_text: _, master_endpoint: _ } =>
-      match candidate {
-        V41CandidateKeyed { runtime_artifact: runtime_key, model_source: _, engram_realization: _, execution_profile: _, candidate: _, authorization_obligation: _ } =>
-          if content_hash_equal(left: spec, right: runtime_key) { [] as List<String> } else {
-            [join(["the produced image was admitted against runtime key ", serialize_content_hash(hash: spec) as String, ", not the candidate's ", serialize_content_hash(hash: runtime_key) as String], "")]
-          }
-        V41CandidateUnestablished { obligations: _ } => [] as List<String>
-        V41CandidateRefused { defects: _ } => [] as List<String>
-      }
-    V41GroupALaunchUnestablished { obligations: _ } => [] as List<String>
-    V41GroupALaunchRefused { causes: _ } => [] as List<String>
-  }
-}
-
-fn v41_group_a_launch_admission(
-  plan: V41GroupALaunchPlan,
-  authority: PairServingGroupAuthority?,
-  candidate: V41CandidateStanding,
-  held: List<HostIdentity>,
-  occupancy: List<GroupArmHostOccupancy>,
-) -> GroupArmLaunchAdmission {
-  group_arm_launch_admission(
-    group: FabricGroupA, purpose: v41_group_a_purpose, plan: v41_arm_plan(p: plan),
-    authority: authority, successor: v41_successor(candidate: candidate),
-    arm_causes: v41_runtime_key_causes(plan: plan, candidate: candidate),
-    held: held, occupancy: occupancy, incumbent: NoIncumbentDeclared,
-    grant_row: StandingGrantRowNotOnMain { cause: "V4.1 launches only under a D0 suspension for its candidate, never under the standing grant" })
-}
-
-// THE ADMISSION AGAINST THE LIVE AUTHORITY LOG, read-only, shared by the dry run and the wet entry.
-fn v41_group_a_launch_admission_live(plan: V41GroupALaunchPlan, occupancy: List<GroupArmHostOccupancy>) -> GroupArmLaunchAdmission {
-  let candidate = v41_candidate().standing
-  group_arm_launch_admission_live(
-    group: FabricGroupA, purpose: v41_group_a_purpose, plan: v41_arm_plan(p: plan),
-    successor: v41_successor(candidate: candidate),
-    arm_causes: v41_runtime_key_causes(plan: plan, candidate: candidate),
-    occupancy: occupancy, incumbent: NoIncumbentDeclared)
-}
-
-// ── THE DRY RUN ──────────────────────────────────────────────────────────────────────────────
-//
-// THE ONE PATH'S REPORT, WITH V4.1'S PRE-APPLY WORK PER HOST: its Engram staging. A plan that cannot be
-// made reports every obligation it is waiting on.
-fn v41_group_a_dry_run_report(plan: V41GroupALaunchPlan, admission: GroupArmLaunchAdmission) -> String {
-  let pre = match plan {
-    V41GroupALaunchPlanned { lines: _, profile: _, specification_runtime_key: _, manifest_text: manifest, master_endpoint: _ } =>
-      [ArmPreApplyWire { label: "engram staging" as NonEmptyStr, text: v41_engram_staging_wire(manifest_text: manifest) }]
-    V41GroupALaunchUnestablished { obligations: _ } => [] as List<ArmPreApplyWire>
-    V41GroupALaunchRefused { causes: _ } => [] as List<ArmPreApplyWire>
-  }
-  group_arm_dry_run_report(title: "V4.1 Group A TP4 launch", intent: v41_group_a_intent, units: v41_group_a_units, plan: v41_arm_plan(p: plan), pre_apply: pre, incumbent: NoIncumbentDeclared, admission: admission)
-}
-
-// THE DRY RUN'S INPUTS. The manifest is handed in (the entry derives it with v41_group_a_manifest, as
-// the wet entry does). The held image and its registry reading are read on the hosts, and the dry run
-// reaches no host, so it names both as obligations rather than transcribing either.
-fn v41_group_a_live_inputs(manifest: V41EngramStoreManifest) -> V41GroupALaunchInputs {
-  V41GroupALaunchInputs {
-    held: V41RuntimeHeldUnestablished { obligations: ["the image is read back on every Group A host only by the wet launch (gunbc.spark.arm_group_launch_dispatch arm_group_launch_ci_wet, arm v41-group-a); the dry run reaches no host"] },
-    registry_reading: none,
-    manifest: manifest,
-  }
-}
-
-// THE DRY PLAN: the authority log read (read-only), every host rendered, the admission verdict. The
-// held image and its registry reading are obligations here (v41_group_a_live_inputs), so the report
-// names the whole distance to a launch.
-fn v41_group_a_dry_plan() -> ArmDryPlan {
-  let plan = v41_group_a_launch_plan(inputs: v41_group_a_live_inputs(manifest: v41_group_a_manifest()))
-  let admission = v41_group_a_launch_admission_live(plan: plan, occupancy: group_arm_dry_run_occupancy(group: FabricGroupA))
-  ArmDryPlan { report: v41_group_a_dry_run_report(plan: plan, admission: admission), admission: admission }
-}
-
-// ── THE WET LAUNCH ───────────────────────────────────────────────────────────────────────────
-//
-// THE REGISTRY READING IS TAKEN INSIDE THE HELD DIGEST, BY THE PROBE THE BUILD USES. The arm wall
-// (gunbc.spark.serving_arm serving_arm_admits_under) admits a runtime only on a registry reading taken
-// inside its own digest, and the production image has none on main. The build's capability probe
-// (gunbc.spark.v41_runtime_image_probe v41_probe_image_in_place) already prints the whole registry
-// (REGISTRY_COUNT, then one REGISTERED line per architecture) from inside the digest it is handed, so
-// the wet entry runs that probe on a launch host and folds its output into the reading. The fold is
-// complete or nothing: the probe's identity must join the receipt's digest
-// (gunbc.spark.v41_runtime_image_converge v41_probe_identity_join), the count line must be present and
-// positive, and the REGISTERED lines must number exactly that count; anything else is no reading, and
-// the arm wall then refuses with its own cause.
-fn v41_registry_reading_of(probe: V41ProbeOutcome, image: V41ProducedImageHeld, host: HostIdentity, observed_at: String) -> ArchitectureRegistryReading? {
-  match v41_probe_identity_join(produced: image.config, o: probe) {
-    V41ProbeDescribesAnotherImage { produced: _, observed: _ } => none
-    V41ProbeIdentityUnreadable { observed: _ } => none
-    V41ProbeIdentityNotRead { step: _, cause: _ } => none
-    V41ProbeJoinedToProducedImage { digest: d } =>
-      match probe {
-        V41ProbeRefused { step: _, cause: _ } => none
-        V41ProbeRead { reference: _, observed_config_id: _, stdout: out, readings: _ } => {
-          let archs = registry_dump_architectures(stdout: out)
-          match registry_dump_count(stdout: out) {
-            Absent => none
-            Present { value: n } =>
-              if n <= 0 || length(archs) != n {
-                none
-              } else {
-                Present { value: ArchitectureRegistryReading {
-                  image_reference: d,
-                  host: host as NonEmptyStr,
-                  observed_at: observed_at as NonEmptyStr,
-                  instrument: vllm_registry_instrument,
-                  architectures: archs,
-                } }
-              }
-          }
-        }
-      }
-  }
-}
-
-fn v41_registry_line(probe: V41ProbeOutcome, image: V41ProducedImageHeld, reading: ArchitectureRegistryReading?) -> String {
-  join([
-    v41_probe_identity_line(j: v41_probe_identity_join(produced: image.config, o: probe)),
-    match reading {
-      Present { value: r } => join(["registry reading: ", to_string(length(r.architectures)), " architectures inside ", r.image_reference as String, " on ", r.host as String, "\n"], "")
-      Absent => "registry reading: NONE (the probe did not join the receipt's digest, or its REGISTRY_COUNT and REGISTERED lines did not agree)\n"
-    },
-  ], "")
-}
-
-// THE OCCUPANCY NEED IS THE ONE PATH'S: the measurement's gpu-memory-utilization share of a GB10's
-// unified pool (gunbc.spark.group_arm_launch group_arm_memory_need). A host with less available than that
-// cannot start the rank; the Engram page cache lives in the share the engine leaves, which the arm wall
-// already charges.
-fn v41_group_a_memory_need() -> Kibibyte {
-  group_arm_memory_need(gpu_memory_utilization: v41_measurement_launch_shape().gpu_memory_utilization)
-}
-
-fn v41_host_image_read_line(r: VllmImageTargetRead) -> String {
-  join(["image readback host=", r.host as String, " ", match r.state {
-    VllmImageTargetHolds => "HOLDS the receipt's digest under its tag"
-    VllmImageTargetNeeds => "holds NOTHING under the tag"
-    VllmImageTargetRefused { step: st, cause: why } => join(["REFUSED at ", st as String, ": ", why], "")
-  }, "\n"], "")
-}
-
-fn v41_host_ssh_target(host: HostIdentity) -> SshTarget? {
-  match spark_reach_endpoint(host: host, path: ReachManagementLan) {
-    Absent => none
-    Present { value: e } => Present { value: SshTarget { endpoint: e as NonEmptyStr, principal: spark_managed_executor_login as NonEmptyStr } }
-  }
-}
-
-// THE ENGRAM STAGING ON EVERY HOST, IN ORDER, HALTING AT THE FIRST HOST THAT FAILS. It runs before the
-// apply because the apply's preflight refuses a container whose mount sources are missing; a failed
-// staging therefore stops the launch with no serving unit touched.
-type V41StagingOutcome
-  = V41StagedEverywhere { receipt: String }
-  | V41StagingStopped { receipt: String }
-
-fn v41_stage_engram_on(hosts: List<HostIdentity>, manifest_text: String, context: FleetSshExecutionContext) -> V41StagingOutcome {
-  match v41_engram_staging_steps(manifest_text: manifest_text) {
-    Absent => V41StagingStopped { receipt: "engram staging REFUSED: the manifest write could not be sealed to its directory; no host was staged\n" }
-    Present { value: steps } =>
-      fold(hosts, init: V41StagedEverywhere { receipt: "" }, f: fn(acc, h) {
-        match acc {
-          V41StagingStopped { receipt: _ } => acc
-          V41StagedEverywhere { receipt: so_far } =>
-            match v41_host_ssh_target(host: h) {
-              Absent => V41StagingStopped { receipt: join([so_far, "engram staging host=", h as String, " REFUSED: no management-LAN endpoint\n"], "") }
-              Present { value: target } => {
-                let standings = run_remote_step_sequence(steps: steps, transport: FleetSsh { target: target, context: context })
-                let line = join(["engram staging host=", h as String, "\n", remote_step_sequence_wire(standings: standings)], "")
-                if remote_step_sequence_failed(standings: standings) {
-                  V41StagingStopped { receipt: join([so_far, line], "") }
-                } else {
-                  V41StagedEverywhere { receipt: join([so_far, line], "") }
-                }
-              }
-            }
-        }
-      })
-  }
-}
-
-// THE SESSION: everything the launch reads, then -- only on admission -- the staging and the arm
-// transaction (gunbc.spark.native_serving_apply spark_native_apply_transaction, the same preflight,
-// preserve, head-first apply, readback and commit-or-rollback Group B's relaunch runs). Every read is
-// in the receipt whatever the verdict, so a refused run reports the whole distance to a launch.
-// ── THE SM120 DECODE-SHAPE GATE: THE KERNEL IS ASKED BEFORE A 1.5-HOUR LAUNCH IS ─────────────────
-//
-// Attempt 13 loaded a 328 GB arm for over an hour and then died in CUDA-graph capture on every rank,
-// because FlashInfer's SM120 DSv4 decode kernel had no specialization for the shapes the launch put
-// through it. Whether it has one is decidable in seconds, from the image and the rank's own arguments,
-// before anything is staged. So each rank's host runs the image's
-// vllm.models.deepseek_v4_1.nvidia.sm120_decode_shape_selftest (the overlay member
-// gunbc.spark.v41_runtime_candidate v41_sm120_decode_selftest_patch_path) over EXACTLY that rank's
-// engine argv -- the words its container will hand `vllm serve`, parsed by vLLM's own serve parser --
-// with the checkpoint mounted where that argv names it. The self-test calls the kernel at every shape
-// with 64 or fewer query tokens a rank of that launch reaches. Any refusal, unreachable host, or a run
-// that does not end in SELFTEST PASS stops the launch before the Engram staging, with the self-test's
-// own lines in the receipt. It mutates nothing: a --rm container, the checkpoint read-only.
-data v41_sm120_selftest_module: String = "vllm.models.deepseek_v4_1.nvidia.sm120_decode_shape_selftest"
-
-type V41Sm120HostGate {
-  passed: Bool
-  receipt: String
-}
-
-fn v41_sm120_selftest_argv(l: ArmNodeLaunch, model_path: String) -> List<String> {
-  concat([
-    "docker", "run", "--rm", "--gpus", "all", "--entrypoint", "python3",
-    "-v", join([l.host_model_path as String, ":", model_path, ":ro"], ""),
-    l.image_reference as String, "-m", v41_sm120_selftest_module,
-  ], l.engine_argv)
-}
-
-// THE MODEL PATH IS THE ENGINE ARGV'S FIRST WORD, as `vllm serve` takes it (model_tag), and the gate
-// mounts the checkpoint there so the self-test reads the config the rank will.
-fn v41_engine_model_path(l: ArmNodeLaunch) -> String? {
-  let firsts = map(filter(enumerate(l.engine_argv), p => p.first == 0), p => p.second)
-  if length(firsts) == 1 { Present { value: join(firsts, "") } } else { none }
-}
-
-fn v41_sm120_host_gate(ctx: SparkMaterializeContext, l: ArmNodeLaunch) -> V41Sm120HostGate {
-  let host = l.node.host as String
-  match v41_engine_model_path(l: l) {
-    Absent => V41Sm120HostGate { passed: false, receipt: join(["sm120 self-test ", host, ": REFUSED the rank's engine argv is empty, so it names no model path to run against\n"], "") }
-    Present { value: model_path } =>
-      match spark_remote_run(ctx: vllm_image_target_ctx(source_ctx: ctx, host: l.node.host), argv: v41_sm120_selftest_argv(l: l, model_path: model_path)) {
-        RemoteUnreachable { cause: c, reach: _ } => V41Sm120HostGate { passed: false, receipt: join(["sm120 self-test ", host, ": DID NOT RUN ", c, "\n"], "") }
-        RemoteRan { exit_code: code, stdout: out, stderr: err } => {
-          let passed = code == 0 && trim(s: out).ends_with(suffix: "SELFTEST PASS")
-          V41Sm120HostGate {
-            passed: passed,
-            receipt: join([
-              "sm120 self-test ", host, ": exit=", to_string(code), if passed { " PASS" } else { " FAIL" }, "\n",
-              out, if passed { "" } else { join(["stderr: ", trim(s: err), "\n"], "") },
-            ], ""),
-          }
-        }
-      }
-  }
-}
-
-fn v41_sm120_gate(ctx: SparkMaterializeContext, p: V41GroupALaunchPlan) -> V41Sm120HostGate {
-  match p {
-    V41GroupALaunchPlanned { lines: ls, profile: _, specification_runtime_key: _, manifest_text: _, master_endpoint: _ } => {
-      let gates = map(ls, l => v41_sm120_host_gate(ctx: ctx, l: l))
-      V41Sm120HostGate {
-        passed: length(ls) != 0 && all(gates, g => g.passed),
-        receipt: join(map(gates, g => g.receipt), ""),
-      }
-    }
-    V41GroupALaunchUnestablished { obligations: _ } => V41Sm120HostGate { passed: false, receipt: "sm120 self-test: not run, the plan is unestablished\n" }
-    V41GroupALaunchRefused { causes: _ } => V41Sm120HostGate { passed: false, receipt: "sm120 self-test: not run, the plan was refused\n" }
-  }
-}
-
-fn v41_group_a_launch_session(now_word: String, context: FleetSshExecutionContext, ctx: SparkMaterializeContext) -> SparkBuildHostWork {
-  let hosts = fabric_group_hosts(g: FabricGroupA)
-  let image = v41_production_produced_image
-  let subject = v41_produced_image_subject(p: image)
-  let reads = map(hosts, h => vllm_image_target_read(source_ctx: ctx, host: h, image: subject))
-  let held = v41_admit_held_runtime(recipe: v41_candidate_recipe(), artifact: v41_runtime_artifact_key(i: v41_candidate_inputs.runtime, partition: v41_candidate_partition), image: image, hosts: hosts, reads: reads)
-  let probe = match held {
-    V41RuntimeHeldOnHosts { specification_runtime_key: _, image: _, subject: _ } =>
-      v41_probe_image_in_place(ctx: ctx, reference: render_oci_content_digest_wire(d: image.config) as NonEmptyStr)
-    V41RuntimeHeldUnestablished { obligations: _ } => V41ProbeRefused { step: "registry-probe" as NonEmptyStr, cause: "the image is not established on every launch host, so it was not probed" }
-    V41RuntimeHeldRefused { defects: _ } => V41ProbeRefused { step: "registry-probe" as NonEmptyStr, cause: "the held image was refused, so it was not probed" }
-  }
-  let registry = v41_registry_reading_of(probe: probe, image: image, host: ctx.host, observed_at: now_word)
-  let plan = v41_group_a_launch_plan(inputs: V41GroupALaunchInputs { held: held, registry_reading: registry, manifest: v41_group_a_manifest() })
-  let occupancy = group_arm_read_occupancy(ctx: ctx, hosts: hosts, units: v41_group_a_units, incumbent: NoIncumbentDeclared, need: v41_group_a_memory_need())
-  let admission = v41_group_a_launch_admission_live(plan: plan, occupancy: occupancy)
-  let reads_receipt = join([
-    join(["image receipt run=", image.receipt_run as String, " tag=", subject.tag as String, " config_digest=", render_oci_content_digest_wire(d: image.config), "\n"], ""),
-    join(map(reads, r => v41_host_image_read_line(r: r)), ""),
-    v41_registry_line(probe: probe, image: image, reading: registry),
-    v41_group_a_dry_run_report(plan: plan, admission: admission),
-  ], "")
-  match admission {
-    GroupArmLaunchAdmissionRefused { causes: _ } => SparkBuildHostWork { receipt: join([reads_receipt, "NOT LAUNCHED: admission refused; no host was staged and no serving unit was touched\n"], ""), converged: false }
-    GroupArmLaunchAdmittedForAdoptionOnly { hosts: _ } => SparkBuildHostWork { receipt: join([reads_receipt, "NOT LAUNCHED: V4.1 declares no incumbent, so a dangling-transaction admission cannot arise here and is refused\n"], ""), converged: false }
-    GroupArmLaunchAdmitted => {
-      let work = group_arm_apply_admitted(
-        intent: v41_group_a_intent, units: v41_group_a_units, plan: v41_arm_plan(p: plan), incumbent: NoIncumbentDeclared,
-        context: context, ctx: ctx, now_word: now_word,
-        pre_apply: fn(steps) { v41_pre_apply(ctx: ctx, context: context, plan: plan, steps: steps) })
-      SparkBuildHostWork { receipt: join([reads_receipt, work.receipt], ""), converged: work.converged }
-    }
-  }
-}
-
-// V4.1'S PRE-APPLY, IN ITS ORDER: the SM120 decode-shape self-test on every rank's host, then the Engram
-// staging on every host. Either stopping leaves every host exactly as it was -- no serving unit is
-// touched before both pass.
-fn v41_pre_apply(ctx: SparkMaterializeContext, context: FleetSshExecutionContext, plan: V41GroupALaunchPlan, steps: List<SparkNativeHostStep>) -> ArmPreApply {
-  match plan {
-    V41GroupALaunchUnestablished { obligations: _ } => ArmPreApplyStopped { receipt: "NOT LAUNCHED: unreachable, an admitted plan is planned\n" }
-    V41GroupALaunchRefused { causes: _ } => ArmPreApplyStopped { receipt: "NOT LAUNCHED: unreachable, an admitted plan is planned\n" }
-    V41GroupALaunchPlanned { lines: _, profile: _, specification_runtime_key: _, manifest_text: manifest, master_endpoint: _ } => {
-      let gate = v41_sm120_gate(ctx: ctx, p: plan)
-      if !gate.passed {
-        ArmPreApplyStopped { receipt: join([gate.receipt, "the SM120 decode-shape self-test did not pass on every rank's host; no host was staged\n"], "") }
-      } else {
-        match v41_stage_engram_on(hosts: map(steps, st => st.host), manifest_text: manifest, context: context) {
-          V41StagingStopped { receipt: r } => ArmPreApplyStopped { receipt: join([gate.receipt, r, "the Engram staging stopped\n"], "") }
-          V41StagedEverywhere { receipt: r } => ArmPreApplyPassed { receipt: join([gate.receipt, r], "") }
-        }
-      }
-    }
-  }
-}
-
-data v41_group_a_launch_attempt_raw: String = "v41-group-a-launch"
-// THE V4.1 ARM AS A WET SESSION OF THE ONE ENTRY (gunbc.spark.group_arm_launch group_arm_launch_wet).
-// The hosts are Group A's, the image is the production receipt's and the shape is the measurement's, so
-// nothing an operator types changes what it launches.
-fn v41_group_a_wet_session() -> ArmWetSession {
-  ArmWetSession {
-    title: "v41 group A launch" as NonEmptyStr,
-    group: FabricGroupA,
-    attempt_raw: v41_group_a_launch_attempt_raw,
-    identity_file_name: "gunbc-v41-group-a-launch-admin-password" as NonEmptyStr,
-    session: fn(now_word, context, ctx) { v41_group_a_launch_session(now_word: now_word, context: context, ctx: ctx) },
-  }
-}
diff --git a/dag/gunbc/spark/v41_identity_input.dag b/dag/gunbc/spark/v41_identity_input.dag
deleted file mode 100644
index 7452602024b..00000000000
--- a/dag/gunbc/spark/v41_identity_input.dag
+++ /dev/null
@@ -1,24 +0,0 @@
-module gunbc.spark.v41_identity_input
-
-import std.types { String, List, NonEmptyStr }
-import std.content_hash { content_hash_atom }
-import std.artifact_store { ArtifactRealizationInput }
-
-// ── THE TWO FACTS EVERY V4.1 IDENTITY MODULE SHARES, BELOW ALL OF THEM ─────────────────────────
-//
-// gunbc.spark.v41_runtime_candidate keys the candidate and gunbc.spark.v41_engram_row_store keys
-// the row-store encoding. The candidate's Engram axis is keyed BY the row-store encoding, so the
-// candidate imports the row store; both need the residency partition and the named-input
-// constructor, and while those lived in the candidate the row store imported the candidate back.
-// They are facts about neither module in particular, so they sit here and the graph stays acyclic.
-
-// WHICH OF THE TWELVE ENGRAM TENSORS ARE READ FROM STORAGE AND WHICH STAY RESIDENT. Admitted against
-// the cited population by gunbc.spark.v41_runtime_candidate v41_admit_partition.
-type V41EngramResidencyPartition {
-  storage_backed: List<NonEmptyStr>
-  resident: List<NonEmptyStr>
-}
-
-fn v41_input(identity: String, value: String) -> ArtifactRealizationInput {
-  ArtifactRealizationInput { identity: identity as NonEmptyStr, content_digest: content_hash_atom(value: value as NonEmptyStr) }
-}
diff --git a/dag/gunbc/spark/v41_index_engram_selection.dag b/dag/gunbc/spark/v41_index_engram_selection.dag
deleted file mode 100644
index 5e09e3da1c5..00000000000
--- a/dag/gunbc/spark/v41_index_engram_selection.dag
+++ /dev/null
@@ -1,186 +0,0 @@
-module gunbc.spark.v41_index_engram_selection
-
-import std.types { String, Bool, List, NonEmptyStr }
-import std.nat { Nat }
-import std.measure { ByteSize, byte_size }
-import std.content_hash { Sha256DigestHex }
-import extdeps.languages.json.parse {
-  parse_json_document, JsonDocumentParsed, JsonDocumentUnreadable, json_document_gap_text,
-  json_object_unique_member, JsonMemberFound, JsonMemberAbsent, JsonMemberDuplicated, JsonMemberNotAnObject,
-}
-import extdeps.languages.json.emit { JsonValue, JsonKeyValue, JsonNull, JsonBool, JsonNumber, JsonString, JsonArray, JsonObject }
-import extdeps.safetensors.format {
-  SafetensorsIndexMember, safetensors_index_member,
-  SafetensorsPopulationStanding, safetensors_population_standing,
-}
-import extdeps.deepseek.deepseek_v4_1_flash {
-  deepseek_v4_1_flash_published_file_row, deepseek_v4_1_flash_safetensors_index_path,
-  deepseek_v4_1_flash_index_engram_selection_of, deepseek_v4_1_flash_engram_membership_closure_of,
-  deepseek_v4_1_flash_safetensors_index_file, deepseek_v4_1_flash_index_tensor_count,
-  deepseek_v4_1_flash_engram_shard_files, deepseek_v4_1_flash_engram_population_reading,
-  deepseek_v4_1_flash_engram_population,
-}
-
-// ── THE .engram. SELECTION OVER THE PINNED V4.1 INDEX, AS THIS REPOSITORY'S OBSERVATION ────────
-//
-// WHY THIS IS HERE AND NOT IN extdeps. A selection someone ran over a file is an observation, and an
-// observation is a receipt in the observing layer (DESIGN section 3), never a fact the upstream owns.
-// extdeps.deepseek.deepseek_v4_1_flash owns the pin (the index file's sha256 and size, its name count)
-// and the fold that decides whether a selection closes membership; this module owns the reading and
-// the instrument that produces it.
-//
-// THE READER IS extdeps.languages.json parse_json_document, THE JSON AUTHORITY, AND NOTHING BESIDE IT. An
-// earlier revision read the index with a token scan, a stated divergence taken because the parser did not
-// read a document of this size in the interpreter; that scan and the probe that watched for its
-// dissolution are deleted, not kept as a fallback. The selection is a fold over the parsed value: the
-// document's one `weight_map` member must be an object, every value in it a `.safetensors` shard name, and
-// the members whose name carries the selector are kept. The parse's working set is not small, so the one
-// production caller (gunbc.spark.v41_checkpoint_materialize v41_index_selection_ci_wet) runs it in its own
-// process, so a parse stopped for memory stops that read and not the fetch before it.
-//
-// WHERE THE READING COMES FROM. The index is not in this repository, so a data row cannot read it at
-// evaluation; the reading is the receipt of the enrolled route that reads it on a Spark (below). Its
-// values are COMPARED against the pin by the extdeps fold, so a reading of any other file, or over
-// fewer names, does not close membership.
-
-data v41_index_engram_selector: NonEmptyStr = ".engram." as NonEmptyStr
-
-type V41IndexParse
-  = V41IndexParsed { name_count: Nat, members: List<SafetensorsIndexMember> }
-  | V41IndexParseRefused { cause: NonEmptyStr }
-
-
-// THE FOLD OVER THE PARSED weight_map. One pass with constant state beyond the SELECTED members: a name
-// count, a count of values that are not a `.safetensors` shard string, and the members kept.
-type V41WeightMapFold {
-  names: Nat
-  not_shards: Nat
-  members: List<SafetensorsIndexMember>
-}
-
-fn v41_weight_map_step(acc: V41WeightMapFold, kv: JsonKeyValue, selector: NonEmptyStr) -> V41WeightMapFold {
-  match kv.value {
-    JsonString { value: shard } =>
-      if !shard.ends_with(".safetensors") || shard == "" || kv.key == "" {
-        V41WeightMapFold { names: acc.names + 1, not_shards: acc.not_shards + 1, members: acc.members }
-      } else {
-        V41WeightMapFold {
-          names: acc.names + 1,
-          not_shards: acc.not_shards,
-          members: if kv.key.contains(selector as String) { acc.members |> list_push(safetensors_index_member(name: kv.key as NonEmptyStr, shard: shard as NonEmptyStr)) } else { acc.members },
-        }
-      }
-    JsonNull => V41WeightMapFold { names: acc.names + 1, not_shards: acc.not_shards + 1, members: acc.members }
-    JsonBool { value: _ } => V41WeightMapFold { names: acc.names + 1, not_shards: acc.not_shards + 1, members: acc.members }
-    JsonNumber { lexeme: _ } => V41WeightMapFold { names: acc.names + 1, not_shards: acc.not_shards + 1, members: acc.members }
-    JsonArray { elements: _ } => V41WeightMapFold { names: acc.names + 1, not_shards: acc.not_shards + 1, members: acc.members }
-    JsonObject { members: _ } => V41WeightMapFold { names: acc.names + 1, not_shards: acc.not_shards + 1, members: acc.members }
-  }
-}
-
-fn v41_select_weight_map(weight_map: JsonValue, selector: NonEmptyStr) -> V41IndexParse {
-  match weight_map {
-    JsonObject { members: kvs } => {
-      let f = fold(kvs, init: V41WeightMapFold { names: 0, not_shards: 0, members: [] as List<SafetensorsIndexMember> }, f: (acc, kv) => v41_weight_map_step(acc: acc, kv: kv, selector: selector))
-      if f.names == 0 {
-        V41IndexParseRefused { cause: "the index's weight_map is empty" as NonEmptyStr }
-      } else if f.not_shards != 0 {
-        V41IndexParseRefused { cause: join(["the index's weight_map carries ", to_string(f.not_shards), " entries whose value is not a .safetensors shard name"], "") as NonEmptyStr }
-      } else {
-        V41IndexParsed { name_count: f.names, members: f.members }
-      }
-    }
-    JsonNull => V41IndexParseRefused { cause: "the index's weight_map is not an object" as NonEmptyStr }
-    JsonBool { value: _ } => V41IndexParseRefused { cause: "the index's weight_map is not an object" as NonEmptyStr }
-    JsonNumber { lexeme: _ } => V41IndexParseRefused { cause: "the index's weight_map is not an object" as NonEmptyStr }
-    JsonString { value: _ } => V41IndexParseRefused { cause: "the index's weight_map is not an object" as NonEmptyStr }
-    JsonArray { elements: _ } => V41IndexParseRefused { cause: "the index's weight_map is not an object" as NonEmptyStr }
-  }
-}
-
-fn v41_select_index_document(text: String, selector: NonEmptyStr) -> V41IndexParse {
-  match parse_json_document(s: text) {
-    JsonDocumentUnreadable { gap: g } => V41IndexParseRefused { cause: join(["the index is not a JSON document: ", json_document_gap_text(gap: g)], "") as NonEmptyStr }
-    JsonDocumentParsed { value: v } =>
-      match json_object_unique_member(v: v, key: "weight_map") {
-        JsonMemberFound { value: wm } => v41_select_weight_map(weight_map: wm, selector: selector)
-        JsonMemberAbsent => V41IndexParseRefused { cause: "the index has no weight_map member" as NonEmptyStr }
-        JsonMemberDuplicated { count: n } => V41IndexParseRefused { cause: join(["the index has ", to_string(n), " weight_map members"], "") as NonEmptyStr }
-        JsonMemberNotAnObject => V41IndexParseRefused { cause: "the index is not a JSON object" as NonEmptyStr }
-      }
-  }
-}
-
-// ── THE READING ────────────────────────────────────────────────────────────────────────────────
-//
-// A READING IS A RECEIPT OF AN ENROLLED ROUTE, AND ONLY THAT. The route is the fleet-converge mode
-// spark_v41_checkpoint_materialize: after the index verifies against its manifest row on the Spark, the
-// mode reads the file back, digests it and runs v41_select_index_document over its bytes, and its receipt
-// carries the `index-selection` lines this row is transcribed from, with the host and run it names --
-// the same standing as gunbc.spark.v41_engram_row_store v41_published_span_readings. A run of the scan
-// anywhere else is a diagnostic and does not land here. Until a dispatched run's receipt is transcribed
-// the reading is Unread, the observed population is the extdeps one scoped to the rows read, and the
-// candidate's Engram axis stays unestablished.
-type V41IndexEngramSelectionReading
-  = V41IndexEngramSelectionRead {
-      index_sha256_hex: Sha256DigestHex
-      index_bytes: ByteSize
-      name_count: Nat
-      members: List<SafetensorsIndexMember>
-      observed: NonEmptyStr
-    }
-  | V41IndexEngramSelectionUnread { obligation: NonEmptyStr }
-
-// THE LIVE READING, TRANSCRIBED FROM AN ENROLLED ROUTE'S RECEIPT. Its `index-selection` lines are the
-// spark_v41_index_selection step of fleet-converge run 35877813088 (mode spark_v41_checkpoint_materialize,
-// target srv8, main a0a4819), which verified the index against its manifest row on the host, read it back,
-// and parsed it with parse_json_document under a hard memory.max of 27917287424 bytes (the runner slot's,
-// its receipt's memory-fence lines). The values are the receipt's; the pin they are compared against is
-// extdeps.deepseek.deepseek_v4_1_flash's, so this row cannot close membership by restating it.
-data v41_index_engram_selection_reading: V41IndexEngramSelectionReading = V41IndexEngramSelectionRead {
-  index_sha256_hex: "74b0686a3d2891980d5e303251b075a3bccae2c2ff650747db2620a649b98fa8" as Sha256DigestHex,
-  index_bytes: byte_size(count: 7470294),
-  name_count: 96085,
-  members: [
-    safetensors_index_member(name: "layers.14.engram.embed.weight" as NonEmptyStr, shard: "model-00048-of-00048.safetensors" as NonEmptyStr),
-    safetensors_index_member(name: "layers.14.engram.embed.scale" as NonEmptyStr, shard: "model-00048-of-00048.safetensors" as NonEmptyStr),
-    safetensors_index_member(name: "layers.14.engram.q_weight" as NonEmptyStr, shard: "model-00048-of-00048.safetensors" as NonEmptyStr),
-    safetensors_index_member(name: "layers.14.engram.k_weight" as NonEmptyStr, shard: "model-00048-of-00048.safetensors" as NonEmptyStr),
-    safetensors_index_member(name: "layers.14.engram.wkv.weight" as NonEmptyStr, shard: "model-00048-of-00048.safetensors" as NonEmptyStr),
-    safetensors_index_member(name: "layers.14.engram.wkv.scale" as NonEmptyStr, shard: "model-00048-of-00048.safetensors" as NonEmptyStr),
-    safetensors_index_member(name: "layers.1.engram.embed.weight" as NonEmptyStr, shard: "model-00047-of-00048.safetensors" as NonEmptyStr),
-    safetensors_index_member(name: "layers.1.engram.embed.scale" as NonEmptyStr, shard: "model-00047-of-00048.safetensors" as NonEmptyStr),
-    safetensors_index_member(name: "layers.1.engram.q_weight" as NonEmptyStr, shard: "model-00047-of-00048.safetensors" as NonEmptyStr),
-    safetensors_index_member(name: "layers.1.engram.k_weight" as NonEmptyStr, shard: "model-00047-of-00048.safetensors" as NonEmptyStr),
-    safetensors_index_member(name: "layers.1.engram.wkv.weight" as NonEmptyStr, shard: "model-00047-of-00048.safetensors" as NonEmptyStr),
-    safetensors_index_member(name: "layers.1.engram.wkv.scale" as NonEmptyStr, shard: "model-00047-of-00048.safetensors" as NonEmptyStr),
-  ],
-  observed: "fleet-converge run 35877813088, spark_v41_index_selection on srv8 at main a0a4819, 2026-09-23" as NonEmptyStr,
-}
-
-// THE ENGRAM POPULATION THIS REPOSITORY HAS OBSERVED. With no reading it is the extdeps population,
-// scoped to the rows read; with one, the members are the reading's and the closure is the extdeps fold
-// over the reading against the pin -- so a thirteenth selected name has no header entry and refuses.
-fn v41_engram_population_observed_of(reading: V41IndexEngramSelectionReading) -> SafetensorsPopulationStanding {
-  match reading {
-    V41IndexEngramSelectionUnread { obligation: _ } => deepseek_v4_1_flash_engram_population
-    V41IndexEngramSelectionRead { index_sha256_hex: h, index_bytes: b, name_count: n, members: ms, observed: _ } => {
-      let selection = deepseek_v4_1_flash_index_engram_selection_of(
-        index: deepseek_v4_1_flash_published_file_row(path: deepseek_v4_1_flash_safetensors_index_path, file_bytes: b, sha256_hex: h),
-        name_count: n,
-        selector: v41_index_engram_selector,
-        members: ms,
-      )
-      safetensors_population_standing(
-        members: ms,
-        shards: deepseek_v4_1_flash_engram_shard_files,
-        closure: deepseek_v4_1_flash_engram_membership_closure_of(selection: selection, index: deepseek_v4_1_flash_safetensors_index_file, index_count: deepseek_v4_1_flash_index_tensor_count),
-        reading: deepseek_v4_1_flash_engram_population_reading,
-      )
-    }
-  }
-}
-
-fn v41_engram_population_observed() -> SafetensorsPopulationStanding {
-  v41_engram_population_observed_of(reading: v41_index_engram_selection_reading)
-}
diff --git a/dag/gunbc/spark/v41_row_store_encode.dag b/dag/gunbc/spark/v41_row_store_encode.dag
deleted file mode 100644
index d851a1b165d..00000000000
--- a/dag/gunbc/spark/v41_row_store_encode.dag
+++ /dev/null
@@ -1,229 +0,0 @@
-module gunbc.spark.v41_row_store_encode
-
-import std.types { String, Bool, List, NonEmptyStr, Int }
-import std.nat { Nat }
-import std.content_hash { Sha256Digest }
-import std.decl_ref { DeclarationRef, decl_ref }
-import std.dissolution { DissolutionCondition, unbound_dissolution }
-import std.measure { ByteSize, byte_size_count }
-import gunbc.spark.v41_checkpoint_materialize { v41_checkpoint_repo_directory }
-import std.optional { Present, Absent }
-import extdeps.numeric.base16 { byte_hex_lower }
-import extdeps.deepseek.deepseek_v4_1_flash {
-  deepseek_v4_1_flash_engram, deepseek_v4_1_flash_engram_sharded_entries, deepseek_v4_1_flash_engram_shard_files,
-}
-import gunbc.spark.v41_identity_input { V41EngramResidencyPartition }
-import gunbc.spark.v41_engram_row_store {
-  V41RowStoreEncodingSpec, V41LayerTable, V41RankStoreIdentity,
-  V41RowStoreEncoding, V41RowStoreEncodingUnestablished, V41RowStoreEncodingRefused,
-  V41RowStoreSpecAdmitted, V41RowStoreSpecRefused,
-  V41PublishedSpan, V41PublishedSpansPlanned, V41PublishedSpansUnplannable,
-  v41_row_store_spec, v41_published_span_plan, v41_identify_row_store, v41_live_head_sizes,
-  v41_magic_octets, weight_bytes, scale_bytes, v41_store_key, v41_store_size,
-}
-
-// ── THE HOST REALIZATION OF v41_place_row: WHAT THE ENCODER IS TOLD, DERIVED ───────────────────
-//
-// The published stores are hundreds of millions of rows, so they are not built by the .dag fold; they
-// are built on the host that holds the materialized shards by v41_row_store_encoder_program below, and
-// this module is the whole of what that program knows. For one
-// (layer, rank) store it derives, from the row-store spec and the published span plan:
-//   - the shard and the file offsets of the layer's weight and scale tables (the span plan, which is
-//     the publisher's header arithmetic -- the same plan the span-key read uses);
-//   - the rank's contiguous row range (the spec's layer table, vLLM's bucket layout);
-//   - the record widths (the spec's geometry, read off the published shapes);
-//   - the magic (v41_row_store_magic, as hex).
-// The program adds only the interleave. It is therefore a realization of v41_place_row /
-// v41_store_bytes and not a second encoder, and what licenses reading its output as the model's bytes
-// is test.claim.spark.v41_row_store_encode_witness: its output over real published rows is
-// byte-identical to v41_store_bytes, and a perturbed placement is not. That is differential evidence
-// over a sample, not a derivation -- gunbc.rung_drop v41_row_store_host_realized_by_sample says so and
-// names what restores the structural rung.
-
-// ── THE PROGRAM, AS DATA OWNED HERE, AND IT KNOWS NOTHING ABOUT V4.1 ────────────────────────
-//
-// A generic byte copier: write PREFIX, then for i in [FIRST, FIRST + COUNT) the A-WIDTH bytes at
-// A-OFFSET + i * A-WIDTH followed by the B-WIDTH bytes at B-OFFSET + i * B-WIDTH, all from SRC. It names
-// no table, no layer, no rank, and holds no offset, stride, bound, head size or magic: every value is an
-// operand v41_store_encode_argv renders from v41_store_encode_plan, i.e. from the row-store spec and the
-// published span plan. It is a DECLARED SCAFFOLD, admitted outside this diff (review 70425 held that a
-// hand-written copier beside v41_place_row needs operator admission, DESIGN section 5):
-// SCAFFOLD ADMISSION OF RECORD (2026-09-23): the operator's EXPLICIT ruling, a direct reply in the
-// proud-deer-538 (DS4.1) session ('follow your rec' = admit), recorded on #12122 at
-// https://github.com/gunb-ai/gunbc/pull/12122#issuecomment-5797563990 .
-// Scope: the host program text is layout-free (every V4.1 fact is an operand rendered from the .dag
-// plan), and the admission ends when the emitted .dag encoder encodes all eight stores. It supersedes
-// escalation msg_4de9efa4-51fb-4dbc-ab71-9ccf45f378e7, which was approved only by the dashboard's
-// 15-minute default and which reviews 70433 and 70470 rightly held was not an operator admission.
-// The debt and its end are gunbc.rung_drop v41_row_store_host_realized_by_sample. It is run as
-// `python3 -c` (the shape of gunbc.sha256sum_byte_span sha256sum_byte_span_program's `bash -c`), writes
-// OUT.part and renames only when complete, and prints nothing on success.
-data v41_row_store_encoder_program_lines: List<String> = [
-  "import argparse",
-  "import os",
-  "import sys",
-  "",
-  "def main():",
-  "    p = argparse.ArgumentParser()",
-  "    for name in ['--src', '--prefix-hex', '--out']:",
-  "        p.add_argument(name, required=True)",
-  "    for name in ['--a-offset', '--a-width', '--b-offset', '--b-width', '--first', '--count', '--chunk']:",
-  "        p.add_argument(name, type=int, required=True)",
-  "    a = p.parse_args()",
-  "    if a.count <= 0 or a.a_width <= 0 or a.b_width <= 0 or a.chunk <= 0 or a.first < 0:",
-  "        print('interleave: count, widths and chunk must be positive and first non-negative', file=sys.stderr)",
-  "        return 2",
-  "    aw = a.a_width",
-  "    bw = a.b_width",
-  "    a0 = a.a_offset + a.first * aw",
-  "    b0 = a.b_offset + a.first * bw",
-  "    part = a.out + '.part'",
-  "    with open(a.src, 'rb') as src, open(part, 'wb') as dst:",
-  "        dst.write(bytes.fromhex(a.prefix_hex))",
-  "        done = 0",
-  "        while done < a.count:",
-  "            n = min(a.chunk, a.count - done)",
-  "            src.seek(a0 + done * aw)",
-  "            x = src.read(n * aw)",
-  "            src.seek(b0 + done * bw)",
-  "            y = src.read(n * bw)",
-  "            if len(x) != n * aw or len(y) != n * bw:",
-  "                print('interleave: short read from the source', file=sys.stderr)",
-  "                return 3",
-  "            dst.write(b''.join(x[i * aw:(i + 1) * aw] + y[i * bw:(i + 1) * bw] for i in range(n)))",
-  "            done += n",
-  "    os.replace(part, a.out)",
-  "    return 0",
-  "",
-  "sys.exit(main())",
-]
-
-data v41_row_store_encoder_program: String = concat(join(v41_row_store_encoder_program_lines, "\n"), "\n")
-
-data v41_row_store_encoder_program_dissolution_trigger: DissolutionCondition = unbound_dissolution(description: "dissolve-on: gunbc.spark.v41_row_store_encode v41_row_store_encoder_program -- a hand-authored two-stream interleaver kept as program text and run with python3 -c (medium-as-string), beside the modeled v41_place_row / v41_store_bytes. DISSOLVES WHEN an emitted .dag encoder runs on the host with (1) a ranged binary read (Filesystem read of an offset and length), (2) a streaming binary append with rename-to-publish, (3) a bounded-memory chunked driver over v41_place_row, and (4) an emitted arm64 tool entry taking argv -- and encodes all eight published stores. This row, this program and gunbc.rung_drop v41_row_store_host_realized_by_sample delete together.")
-
-// The rows per read. Not a layout fact: any positive value yields the same bytes.
-data v41_row_store_encoder_chunk_rows: Nat = 65536
-
-// THIS PROGRAM DECLARES WHAT IT REALIZES AND THE RUNG THAT COSTS.
-type V41HostRealization sole_constructor {
-  realizes: DeclarationRef
-  program: String
-  rung_drop: DeclarationRef
-  dissolution: DissolutionCondition
-}
-
-data v41_row_store_host_realization: V41HostRealization = V41HostRealization {
-  realizes: decl_ref(module_path: "gunbc.spark.v41_engram_row_store", decl_name: "v41_place_row"),
-  program: v41_row_store_encoder_program,
-  rung_drop: decl_ref(module_path: "gunbc.rung_drop.v41_row_store_host_realized_by_sample", decl_name: "v41_row_store_host_realized_by_sample"),
-  dissolution: v41_row_store_encoder_program_dissolution_trigger,
-}
-
-
-// THE DIRECTORY ON THE HOST: beside the materialized checkpoint, under the fleet's one models root
-// (gunbc.spark.v41_checkpoint_materialize v41_checkpoint_repo_directory, from
-// gunbc.spark.model_snapshot_acquisition spark_models_root). Which path the runtime OPENS a store at is
-// the wiring patch's decision (gunbc.spark.v41_engram_row_store states that frontier); this is where
-// the encoder writes.
-fn v41_row_store_output_directory() -> NonEmptyStr {
-  join([v41_checkpoint_repo_directory(), "/engram-row-stores"], "") as NonEmptyStr
-}
-
-// THE PUBLISHED STORES' IDENTITIES are not here: they live with the row-store model
-// (gunbc.spark.v41_engram_row_store v41_published_store_readings, v41_row_store_encoding_key), where the
-// dispatched encode run's receipt is transcribed. This module owns only what the host program is told.
-type V41StoreEncodeArgs {
-  layer: Nat
-  rank: Nat
-  shard: NonEmptyStr
-  weight_offset: ByteSize
-  scale_offset: ByteSize
-  start: Int
-  rows: Int
-  weight_bytes: ByteSize
-  scale_bytes: ByteSize
-  magic_hex: String
-  out: NonEmptyStr
-  expected_size: ByteSize
-}
-
-type V41StoreEncodePlan
-  = V41StoreEncodePlanned { stores: List<V41StoreEncodeArgs> }
-  | V41StoreEncodeUnplannable { defects: List<NonEmptyStr> }
-
-fn v41_magic_hex() -> String {
-  join(map(v41_magic_octets(), o => byte_hex_lower(v: o)), "")
-}
-
-fn v41_span_named(spans: List<V41PublishedSpan>, name: NonEmptyStr) -> V41PublishedSpan? {
-  first(filter(spans, s => (s.tensor as String) == (name as String)))
-}
-
-fn v41_store_out_path(layer: Nat, rank: Nat) -> NonEmptyStr {
-  join([v41_row_store_output_directory() as String, "/", v41_store_key(layer: layer, rank: rank), ".engram"], "") as NonEmptyStr
-}
-
-fn v41_layer_store_args(t: V41LayerTable, spec: V41RowStoreEncodingSpec, spans: List<V41PublishedSpan>) -> List<V41StoreEncodeArgs> {
-  match v41_span_named(spans: spans, name: t.weight) {
-    Absent => [] as List<V41StoreEncodeArgs>
-    Present { value: w } => match v41_span_named(spans: spans, name: t.scale) {
-      Absent => [] as List<V41StoreEncodeArgs>
-      Present { value: s } => map(t.ranks, r => V41StoreEncodeArgs {
-        layer: t.layer,
-        rank: r.rank,
-        shard: w.shard,
-        weight_offset: w.file_offset,
-        scale_offset: s.file_offset,
-        start: r.start,
-        rows: r.end - r.start,
-        weight_bytes: weight_bytes(g: spec.geometry),
-        scale_bytes: scale_bytes(g: spec.geometry),
-        magic_hex: v41_magic_hex(),
-        out: v41_store_out_path(layer: t.layer, rank: r.rank),
-        expected_size: v41_store_size(spec: spec, rows: r.end - r.start),
-      })
-    }
-  }
-}
-
-// EVERY STORE THE SPEC DECLARES, OR WHY NOT. A layer whose weight or scale has no span, or whose weight
-// and scale live in different shards, refuses by name: the encoder reads one shard per store.
-fn v41_store_encode_plan(spec: V41RowStoreEncodingSpec, spans: List<V41PublishedSpan>) -> V41StoreEncodePlan {
-  let unspanned = flat_map(spec.layers, t => concat(
-    match v41_span_named(spans: spans, name: t.weight) { Present { value: _ } => [] as List<NonEmptyStr>  Absent => [join(["layer ", to_string(t.layer), " weight ", t.weight as String, " has no published span"], "") as NonEmptyStr] },
-    match v41_span_named(spans: spans, name: t.scale) { Present { value: _ } => [] as List<NonEmptyStr>  Absent => [join(["layer ", to_string(t.layer), " scale ", t.scale as String, " has no published span"], "") as NonEmptyStr] }))
-  let split = flat_map(spec.layers, t => match v41_span_named(spans: spans, name: t.weight) {
-    Absent => [] as List<NonEmptyStr>
-    Present { value: w } => match v41_span_named(spans: spans, name: t.scale) {
-      Absent => [] as List<NonEmptyStr>
-      Present { value: s } => if (w.shard as String) == (s.shard as String) { [] as List<NonEmptyStr> } else { [join(["layer ", to_string(t.layer), " weight and scale live in different shards; one store reads one shard"], "") as NonEmptyStr] }
-    }
-  })
-  let defects = concat(unspanned, split)
-  if length(defects) != 0 {
-    V41StoreEncodeUnplannable { defects: defects }
-  } else {
-    V41StoreEncodePlanned { stores: flat_map(spec.layers, t => v41_layer_store_args(t: t, spec: spec, spans: spans)) }
-  }
-}
-
-// THE ARGV, rendered for a shard directory on the host: the program text inline, every value an operand. DECLARED FRONTIER: its executing consumer is the
-// dispatched spark_v41_row_store_encode mode (the next change in this lane), which runs it per rank on
-// the host that holds that rank's shards and transcribes sha256sum of each output into
-// v41_published_store_readings; it lands once Group A's shards are materialized (#12109).
-fn v41_store_encode_argv(shard_directory: NonEmptyStr, a: V41StoreEncodeArgs) -> List<String> {
-  [
-    "python3", "-c", v41_row_store_host_realization.program,
-    "--src", join([shard_directory as String, "/", a.shard as String], ""),
-    "--a-offset", to_string(byte_size_count(b: a.weight_offset)),
-    "--a-width", to_string(byte_size_count(b: a.weight_bytes)),
-    "--b-offset", to_string(byte_size_count(b: a.scale_offset)),
-    "--b-width", to_string(byte_size_count(b: a.scale_bytes)),
-    "--first", to_string(a.start),
-    "--count", to_string(a.rows),
-    "--prefix-hex", a.magic_hex,
-    "--out", a.out as String,
-    "--chunk", to_string(v41_row_store_encoder_chunk_rows),
-  ]
-}
diff --git a/dag/gunbc/spark/v41_row_store_encode_run.dag b/dag/gunbc/spark/v41_row_store_encode_run.dag
deleted file mode 100644
index b62a9bdaa1d..00000000000
--- a/dag/gunbc/spark/v41_row_store_encode_run.dag
+++ /dev/null
@@ -1,347 +0,0 @@
-module gunbc.spark.v41_row_store_encode_run
-
-import gunbc.spark.remote_leg_began { remote_stdout_as_one_word }
-import std.types { String, Bool, Int, List, NonEmptyStr, Secret }
-import std.nat { Nat }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import std.resources { Network }
-import std.algebra { trim }
-import std.content_hash { Sha256Digest, sha256_hex_digest }
-import std.measure { ByteSize, byte_size, byte_size_count, Kibibyte, kibibyte }
-import std.optional { Present, Absent }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import extdeps.crypto.hash { sha256sum_argv, sha256sum_line_digest }
-import extdeps.deepseek.deepseek_v4_1_flash {
-  deepseek_v4_1_flash_engram, deepseek_v4_1_flash_revision,
-  deepseek_v4_1_flash_engram_sharded_entries, deepseek_v4_1_flash_engram_shard_files,
-}
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext, RemoteRan, RemoteUnreachable, spark_remote_run, HostCli }
-import gunbc.spark.v41_engram_row_store {
-  V41RowStoreSpecAdmitted, V41RowStoreSpecRefused, V41PublishedSpansPlanned, V41PublishedSpansUnplannable,
-  v41_row_store_spec, v41_published_span_plan, v41_live_head_sizes, v41_store_key, v41_key_counts, v41_key_count,
-}
-import gunbc.spark.v41_row_store_encode {
-  V41StoreEncodeArgs, V41StoreEncodePlanned, V41StoreEncodeUnplannable,
-  v41_store_encode_plan, v41_store_encode_argv, v41_row_store_output_directory,
-}
-import gunbc.spark.v41_checkpoint_materialize { v41_checkpoint_directory }
-import gunbc.spark.v41_runtime_candidate { v41_candidate_partition }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
-import gunbc.spark.serving_subject { PairServingUnitOn }
-import gunbc.spark.host_occupancy_admission { admit_spark_host_unoccupied, spark_ctx_argv_run }
-import gunbc.spark.host_commitment { admit_host_held_by_subject }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fleet_known_hosts_anchor {
-  fleet_ssh_attempt_identity, materialize_fleet_known_hosts_anchor, known_hosts_materialization_receipt,
-  fleet_openssh_trust_policy_of,
-}
-import gunbc.spark.grant_privileged_operation {
-  read_bootstrap_credential, BootstrapCredentialReady, BootstrapCredentialNotMaterialized,
-}
-import gunbc.auth.materialized_secret {
-  with_materialized_ssh_key_file, MaterializedSshKeyFileBracketCompleted, MaterializedSshKeyFileBracketRefused,
-}
-import gunbc.fleet_multi_principal_probe {
-  SparkConvergeTargetSingle, SparkConvergeTargetAllObserveOnly, SparkConvergeTargetRefused,
-  spark_converge_target_selection,
-}
-import gunbc.spark.fabric_reach { ExecutorReachKnown, ExecutorReachUnknown, observe_executor_reach }
-
-// ── THE ENCODE RUN: THE EIGHT STORES ON ONE MATERIALIZED SPARK, AND THEIR DIGESTS ─────────────
-//
-// The dispatched realization gunbc.spark.v41_row_store_encode declared as its frontier. On ONE Group A
-// host that holds the verified shards (gunbc.spark.v41_checkpoint_materialize put them at
-// v41_checkpoint_directory), for every store v41_store_encode_plan derives from the live spec:
-//   - an OUT already present is a COMPLETE store (the program renames OUT.part to OUT only when done),
-//     so it is not re-encoded;
-//   - otherwise the admitted host program is run over the shard with the plan's operands;
-//   - then sha256sum reads OUT, and the receipt carries one line per (layer, rank).
-// THIS DOOR IS THE INSTRUMENT of gunbc.spark.v41_engram_row_store v41_published_store_readings: its
-// receipt (v41_encode_run_receipt_path) is printed into the spark_v41_row_store_encode fleet-converge
-// step's log on success, and on failure its body reaches the log through exit_failure; a Read row is
-// transcribed from that run's log, citing the run id. It is not uploaded as an artifact; v41_identify_row_store then admits exactly the declared eight. All eight
-// are encoded on the one host because the digests are host-independent; placing each rank's pair on
-// its own host is staging, a later step (gunbc.spark.v41_engram_staging).
-
-data v41_encode_run_attempt_raw: String = "v41-row-store-encode"
-data v41_encode_run_receipt_path: String = "target/v41-row-store-encode-receipt.txt"
-
-// ONE STORE'S OUTCOME, AS A CLOSED SUM (review 70572): present-and-read, encoded-and-read, encoded but
-// the digest read failed, or the encode itself failed. No arm carries a digest it did not read.
-type V41StoreRun
-  = V41StorePresent { store: V41StoreEncodeArgs, digest: Sha256Digest, size: ByteSize }
-  | V41StoreEncoded { store: V41StoreEncodeArgs, digest: Sha256Digest, size: ByteSize }
-  | V41StoreSizeMismatch { store: V41StoreEncodeArgs, digest: Sha256Digest, observed: ByteSize, derived: ByteSize }
-  | V41StoreSizeUnread { store: V41StoreEncodeArgs, digest: Sha256Digest, cause: NonEmptyStr }
-  | V41StoreDigestUnread { store: V41StoreEncodeArgs, encoded: Bool, cause: NonEmptyStr }
-  | V41StoreEncodeFailed { store: V41StoreEncodeArgs, cause: NonEmptyStr }
-  | V41StorePresenceFailed { store: V41StoreEncodeArgs, cause: NonEmptyStr }
-
-fn v41_store_of(r: V41StoreRun) -> V41StoreEncodeArgs {
-  match r {
-    V41StorePresent { store: a, digest: _, size: _ } => a
-    V41StoreEncoded { store: a, digest: _, size: _ } => a
-    V41StoreSizeMismatch { store: a, digest: _, observed: _, derived: _ } => a
-    V41StoreSizeUnread { store: a, digest: _, cause: _ } => a
-    V41StoreDigestUnread { store: a, encoded: _, cause: _ } => a
-    V41StoreEncodeFailed { store: a, cause: _ } => a
-    V41StorePresenceFailed { store: a, cause: _ } => a
-  }
-}
-
-// ONLY A STORE WHOSE DIGEST WAS READ AND WHOSE SIZE MATCHES THE LAYOUT counts as digested.
-fn v41_store_run_digest(r: V41StoreRun) -> Sha256Digest? {
-  match r {
-    V41StorePresent { store: _, digest: d, size: _ } => Present { value: d }
-    V41StoreEncoded { store: _, digest: d, size: _ } => Present { value: d }
-    V41StoreSizeMismatch { store: _, digest: _, observed: _, derived: _ } => none
-    V41StoreSizeUnread { store: _, digest: _, cause: _ } => none
-    V41StoreDigestUnread { store: _, encoded: _, cause: _ } => none
-    V41StoreEncodeFailed { store: _, cause: _ } => none
-    V41StorePresenceFailed { store: _, cause: _ } => none
-  }
-}
-
-type V41DigestRead
-  = V41DigestReadOk { digest: Sha256Digest }
-  | V41DigestReadFailed { cause: NonEmptyStr }
-
-fn v41_store_digest(ctx: SparkMaterializeContext, out: NonEmptyStr) -> V41DigestRead {
-  match spark_remote_run(ctx: ctx, argv: sha256sum_argv(path: out as String)) {
-    RemoteUnreachable { cause: c, reach: _ } => V41DigestReadFailed { cause: join(["the sha256sum leg did not run: ", c], "") as NonEmptyStr }
-    RemoteRan { exit_code: code, stdout: s, stderr: err } =>
-      if code != 0 { V41DigestReadFailed { cause: join(["sha256sum exited ", to_string(code), ": ", trim(s: err)], "") as NonEmptyStr } } else {
-        match sha256sum_line_digest(line: s) {
-          Absent => V41DigestReadFailed { cause: join(["sha256sum answered no digest: ", s], "") as NonEmptyStr }
-          Present { value: d } => match sha256_hex_digest(hex: d.hex as String) {
-            Absent => V41DigestReadFailed { cause: "sha256sum answered a digest that is not lowercase sha256 hex" as NonEmptyStr }
-            Present { value: h } => V41DigestReadOk { digest: h }
-          }
-        }
-      }
-  }
-}
-
-// PRESENCE IS THREE-VALUED (review 70586): `test -f` exits 0 for a regular file and 1 for none; any other
-// exit, or a leg that did not run, is a check that FAILED -- never read as absent, because absent sends
-// the store to be encoded and a failed check would then re-encode a complete store and misreport it.
-type V41StorePresence
-  = V41StoreFound
-  | V41StoreAbsent
-  | V41StorePresenceUnread { cause: NonEmptyStr }
-
-fn v41_store_presence_of(exit_code: Int, stderr: String) -> V41StorePresence {
-  if exit_code == 0 { V41StoreFound } else if exit_code == 1 { V41StoreAbsent } else {
-    V41StorePresenceUnread { cause: join(["test -f exited ", to_string(exit_code), ": ", trim(s: stderr)], "") as NonEmptyStr }
-  }
-}
-
-fn v41_store_present(ctx: SparkMaterializeContext, out: NonEmptyStr) -> V41StorePresence {
-  match spark_remote_run(ctx: ctx, argv: ["test", "-f", out as String]) {
-    RemoteUnreachable { cause: c, reach: _ } => V41StorePresenceUnread { cause: join(["the presence check did not run: ", c], "") as NonEmptyStr }
-    RemoteRan { exit_code: code, stdout: _, stderr: err } => v41_store_presence_of(exit_code: code, stderr: err)
-  }
-}
-
-// ONE STORE: encode if absent, then digest. A failed encode is its own arm and is not digested.
-// THE SIZE A STORE MUST HAVE is the encode plan's (V41StoreEncodeArgs.expected_size, from
-// gunbc.spark.v41_engram_row_store v41_store_size): the same formula the key checks, never re-derived here.
-fn v41_store_expected_size(a: V41StoreEncodeArgs) -> ByteSize {
-  a.expected_size
-}
-
-type V41SizeRead
-  = V41SizeReadOk { size: ByteSize }
-  | V41SizeReadFailed { cause: NonEmptyStr }
-
-fn v41_store_size(ctx: SparkMaterializeContext, out: NonEmptyStr) -> V41SizeRead {
-  match spark_remote_run(ctx: ctx, argv: ["stat", "-c", "%s", "--", out as String]) {
-    RemoteUnreachable { cause: c, reach: _ } => V41SizeReadFailed { cause: join(["the stat leg did not run: ", c], "") as NonEmptyStr }
-    RemoteRan { exit_code: code, stdout: o, stderr: err } =>
-      if code != 0 { V41SizeReadFailed { cause: join(["stat exited ", to_string(code), ": ", trim(s: err)], "") as NonEmptyStr } } else {
-        match parse_int(s: remote_stdout_as_one_word(stdout: o)) {
-          Absent => V41SizeReadFailed { cause: join(["stat answered a size that is not a number: ", o], "") as NonEmptyStr }
-          Present { value: n } => if n < 0 { V41SizeReadFailed { cause: "stat answered a negative size" as NonEmptyStr } } else { V41SizeReadOk { size: byte_size(count: n) } }
-        }
-      }
-  }
-}
-
-// DIGEST, THEN SIZE, THEN THE LAYOUT CHECK (proud-deer-538, 2026-09-24): a store whose size is not the
-// derived size is refused with both figures, never reported as digested.
-fn v41_sized(a: V41StoreEncodeArgs, encoded: Bool, d: Sha256Digest, size: V41SizeRead) -> V41StoreRun {
-  match size {
-    V41SizeReadFailed { cause: c } => V41StoreSizeUnread { store: a, digest: d, cause: c }
-    V41SizeReadOk { size: n } =>
-      if byte_size_count(b: n) != byte_size_count(b: v41_store_expected_size(a: a)) {
-        V41StoreSizeMismatch { store: a, digest: d, observed: n, derived: v41_store_expected_size(a: a) }
-      } else if encoded { V41StoreEncoded { store: a, digest: d, size: n } } else { V41StorePresent { store: a, digest: d, size: n } }
-  }
-}
-
-fn v41_digested(ctx: SparkMaterializeContext, a: V41StoreEncodeArgs, encoded: Bool, read: V41DigestRead) -> V41StoreRun {
-  match read {
-    V41DigestReadFailed { cause: c } => V41StoreDigestUnread { store: a, encoded: encoded, cause: c }
-    V41DigestReadOk { digest: d } => v41_sized(a: a, encoded: encoded, d: d, size: v41_store_size(ctx: ctx, out: a.out))
-  }
-}
-
-fn v41_run_store(ctx: SparkMaterializeContext, a: V41StoreEncodeArgs) -> V41StoreRun {
-  match v41_store_present(ctx: ctx, out: a.out) {
-    V41StorePresenceUnread { cause: c } => V41StorePresenceFailed { store: a, cause: c }
-    V41StoreFound => v41_digested(ctx: ctx, a: a, encoded: false, read: v41_store_digest(ctx: ctx, out: a.out))
-    V41StoreAbsent =>
-      match spark_remote_run(ctx: ctx, argv: v41_store_encode_argv(shard_directory: v41_checkpoint_directory, a: a)) {
-        RemoteUnreachable { cause: c, reach: _ } => V41StoreEncodeFailed { store: a, cause: join(["the encode leg did not run: ", c], "") as NonEmptyStr }
-        RemoteRan { exit_code: code, stdout: _, stderr: err } =>
-          if code != 0 {
-            V41StoreEncodeFailed { store: a, cause: join(["the host program exited ", to_string(code), ": ", trim(s: err)], "") as NonEmptyStr }
-          } else {
-            v41_digested(ctx: ctx, a: a, encoded: true, read: v41_store_digest(ctx: ctx, out: a.out))
-          }
-      }
-  }
-}
-
-fn v41_store_line(r: V41StoreRun) -> String {
-  let a = v41_store_of(r: r)
-  let head = join(["store ", v41_store_key(layer: a.layer, rank: a.rank)], "")
-  let tail = join([" path=", a.out as String, "\n"], "")
-  match r {
-    V41StorePresent { store: _, digest: d, size: n } => join([head, " sha256=", d.hex as String, " size_bytes=", to_string(byte_size_count(b: n)), " present", tail], "")
-    V41StoreEncoded { store: _, digest: d, size: n } => join([head, " sha256=", d.hex as String, " size_bytes=", to_string(byte_size_count(b: n)), " encoded", tail], "")
-    V41StoreSizeMismatch { store: _, digest: d, observed: n, derived: e } => join([head, " SIZE-MISMATCH sha256=", d.hex as String, " size_bytes=", to_string(byte_size_count(b: n)), " derived_bytes=", to_string(byte_size_count(b: e)), " not keyed", tail], "")
-    V41StoreSizeUnread { store: _, digest: d, cause: c } => join([head, " UNREAD size sha256=", d.hex as String, " the size read failed: ", c as String, tail], "")
-    V41StoreDigestUnread { store: _, encoded: e, cause: c } => join([head, " UNREAD ", if e { "encoded" } else { "present" }, " but the digest read failed: ", c as String, tail], "")
-    V41StoreEncodeFailed { store: _, cause: c } => join([head, " UNREAD encode failed: ", c as String, tail], "")
-    V41StorePresenceFailed { store: _, cause: c } => join([head, " UNREAD presence check failed, nothing encoded: ", c as String, tail], "")
-  }
-}
-
-// WHAT THE ENCODE IS, FOR ITS OCCUPANCY REFUSAL, AND THE MEMORY IT DECLARES. The need is a DECLARED BET:
-// the encoder streams its shards in bounded chunks, and 16 GiB has no measurement behind it yet.
-// READ OBLIGATION: the peak memory of an executed encode on a GB10.
-data v41_row_store_encode_purpose: NonEmptyStr = "the V4.1 row-store encode, which reads every published shard" as NonEmptyStr
-data v41_row_store_encode_memory_need: Kibibyte = kibibyte(count: 16777216)
-
-type V41EncodeRun
-  = V41EncodeRefusedBeforeRun { cause: NonEmptyStr }
-  | V41EncodeRan { planned: List<V41StoreEncodeArgs>, stores: List<V41StoreRun> }
-
-fn v41_encode_all(ctx: SparkMaterializeContext) -> V41EncodeRun {
-  match v41_row_store_spec(population: map(deepseek_v4_1_flash_engram_sharded_entries, e => e.entry), partition: v41_candidate_partition, tables: deepseek_v4_1_flash_engram, head_sizes: v41_live_head_sizes(tables: deepseek_v4_1_flash_engram)) {
-    V41RowStoreSpecRefused { defects: d } => V41EncodeRefusedBeforeRun { cause: join(["the row-store spec refused: ", join(map(d, x => x as String), "; ")], "") as NonEmptyStr }
-    V41RowStoreSpecAdmitted { spec: spec } =>
-      match v41_published_span_plan(partition: v41_candidate_partition, sharded: deepseek_v4_1_flash_engram_sharded_entries, shards: deepseek_v4_1_flash_engram_shard_files) {
-        V41PublishedSpansUnplannable { defects: d } => V41EncodeRefusedBeforeRun { cause: join(["the span plan refused: ", join(map(d, x => x as String), "; ")], "") as NonEmptyStr }
-        V41PublishedSpansPlanned { spans: spans } =>
-          match v41_store_encode_plan(spec: spec, spans: spans) {
-            V41StoreEncodeUnplannable { defects: d } => V41EncodeRefusedBeforeRun { cause: join(["the encode plan refused: ", join(map(d, x => x as String), "; ")], "") as NonEmptyStr }
-            V41StoreEncodePlanned { stores: st } =>
-              match spark_remote_run(ctx: ctx, argv: ["mkdir", "-p", v41_row_store_output_directory() as String]) {
-                RemoteUnreachable { cause: c, reach: _ } => V41EncodeRefusedBeforeRun { cause: join(["the output directory could not be made: ", c], "") as NonEmptyStr }
-                RemoteRan { exit_code: code, stdout: _, stderr: err } =>
-                  if code != 0 { V41EncodeRefusedBeforeRun { cause: join(["mkdir of the output directory exited ", to_string(code), ": ", trim(s: err)], "") as NonEmptyStr } } else {
-                    V41EncodeRan { planned: st, stores: map(st, a => v41_run_store(ctx: ctx, a: a)) }
-                  }
-              }
-          }
-      }
-  }
-}
-
-// SUCCESS IS AN IDENTITY JOIN, NOT A COUNT (review 70572): every PLANNED (layer, rank) store has exactly
-// one digested outcome, and no outcome names a store the plan does not.
-fn v41_encode_succeeded(run: V41EncodeRun) -> Bool {
-  match run {
-    V41EncodeRefusedBeforeRun { cause: _ } => false
-    V41EncodeRan { planned: p, stores: st } => {
-      let digested = map(filter(st, r => match v41_store_run_digest(r: r) { Present { value: _ } => true  Absent => false }), r => v41_store_key(layer: v41_store_of(r: r).layer, rank: v41_store_of(r: r).rank))
-      let planned = map(p, a => v41_store_key(layer: a.layer, rank: a.rank))
-      let digested_index = v41_key_counts(keys: digested)
-      let planned_index = v41_key_counts(keys: planned)
-      length(planned) != 0
-        && all(planned, k => v41_key_count(index: digested_index, key: k) == 1)
-        && all(digested, d => v41_key_count(index: planned_index, key: d) == 1)
-    }
-  }
-}
-
-fn v41_encode_body(run: V41EncodeRun) -> String {
-  match run {
-    V41EncodeRefusedBeforeRun { cause: c } => join(["refused-before-run: ", c as String, "\n"], "")
-    V41EncodeRan { planned: _, stores: st } => join(map(st, r => v41_store_line(r: r)), "")
-  }
-}
-
-// THE FLEET-CONVERGE DOOR: `spark_v41_row_store_encode` with `target` naming ONE Group A Spark that holds
-// the verified shards; the same admission as spark_v41_checkpoint_materialize.
-fn v41_row_store_encode_ci_wet() -> ProcessExit
-  uses net: Network
-{
-  let now = clock_now_probed_at()
-  match spark_converge_target_selection(execute_apply: true) {
-    SparkConvergeTargetRefused { reason: why } => exit_failure(reason: why)
-    SparkConvergeTargetAllObserveOnly =>
-      exit_failure(reason: "SPARK_CONVERGE_TARGET is unset: this mode encodes the V4.1 row stores on ONE host, so it refuses rather than choosing one")
-    SparkConvergeTargetSingle { host: target_host } =>
-      match admit_host_held_by_subject(raw: target_host, subject: PairServingUnitOn { group: FabricGroupA }) {
-        Present { value: why } => exit_failure(reason: why)
-        Absent =>
-          match observe_executor_reach() {
-            ExecutorReachUnknown { cause: c } => exit_failure(reason: join(["v41_row_store_encode_ci: ", c], ""))
-            ExecutorReachKnown { short_hostname: executor, path: path } =>
-              match read_bootstrap_credential() {
-                BootstrapCredentialNotMaterialized { cause: c } => exit_failure(reason: c as String)
-                BootstrapCredentialReady { secret: administrator } =>
-                  match fleet_ssh_attempt_identity(raw: v41_encode_run_attempt_raw) {
-                    Absent => exit_failure(reason: "attempt identity is not a safe path segment")
-                    Present { value: attempt } => {
-                      let materialization = materialize_fleet_known_hosts_anchor(attempt: attempt)
-                      match fleet_openssh_trust_policy_of(outcome: materialization) {
-                        Absent => exit_failure(reason: join(["trust could not be established, so no leg ran: ", known_hosts_materialization_receipt(outcome: materialization)], ""))
-                        Present { value: trust } =>
-                          match with_materialized_ssh_key_file(
-                            identity_file_name: "gunbc-v41-row-store-encode-admin-password" as NonEmptyStr,
-                            secret_bytes: administrator as Secret,
-                            use: fn(file) {
-                              let ctx = SparkMaterializeContext {
-                                host: target_host,
-                                trust: trust,
-                                path: path,
-                                admin_credential: administrator as Secret,
-                                admin_credential_file: file,
-                                executor: HostCli,
-                              }
-                              match admit_spark_host_unoccupied(run: spark_ctx_argv_run(ctx: ctx), host: target_host, purpose: v41_row_store_encode_purpose, need: v41_row_store_encode_memory_need) {
-                                Present { value: why } => V41EncodeRefusedBeforeRun { cause: why as NonEmptyStr }
-                                Absent => v41_encode_all(ctx: ctx)
-                              }
-                            },
-                          ) {
-                            MaterializedSshKeyFileBracketRefused { cause: c } => exit_failure(reason: c as String)
-                            MaterializedSshKeyFileBracketCompleted { value: run } => {
-                              let body = join([
-                                join(["v41 row store encode probed_at=", probed_at_word(reading: now) as String, " host=", target_host as String, " revision=", deepseek_v4_1_flash_revision as String, "\n"], ""),
-                                v41_encode_body(run: run),
-                                join(["executor=", executor, "\n"], ""),
-                                known_hosts_materialization_receipt(outcome: materialization),
-                              ], "")
-                              let w = Filesystem.Write(path: v41_encode_run_receipt_path, content: body)
-                              if !w.success {
-                                exit_failure(reason: join(["v41 row store encode receipt write failed: ", w.error], ""))
-                              } else if v41_encode_succeeded(run: run) {
-                                ExitSuccess
-                              } else {
-                                exit_failure(reason: join(["not all eight row stores were encoded and read on ", target_host as String, ":\n", body], ""))
-                              }
-                            }
-                          }
-                      }
-                    }
-                  }
-              }
-          }
-      }
-  }
-}
diff --git a/dag/gunbc/spark/v41_row_store_readback_run.dag b/dag/gunbc/spark/v41_row_store_readback_run.dag
deleted file mode 100644
index 6b17ebc9433..00000000000
--- a/dag/gunbc/spark/v41_row_store_readback_run.dag
+++ /dev/null
@@ -1,235 +0,0 @@
-module gunbc.spark.v41_row_store_readback_run
-
-import std.types { String, Bool, Int, List, NonEmptyStr, Secret }
-import std.nat { Nat }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import std.resources { Network }
-import std.algebra { trim }
-import std.measure { ByteSize, byte_size_count }
-import std.optional { Present, Absent }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import extdeps.exec.command { argv_words }
-import extdeps.tools.gnu_coreutils { od_hex_span_command }
-import extdeps.deepseek.deepseek_v4_1_flash {
-  deepseek_v4_1_flash_engram, deepseek_v4_1_flash_revision,
-  deepseek_v4_1_flash_engram_sharded_entries, deepseek_v4_1_flash_engram_shard_files,
-}
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext, RemoteRan, RemoteUnreachable, spark_remote_run, HostCli }
-import gunbc.spark.v41_engram_row_store {
-  V41RowStoreSpecAdmitted, V41RowStoreSpecRefused, V41PublishedSpansPlanned, V41PublishedSpansUnplannable,
-  V41RowStoreEncodingSpec, V41ReadbackSample, V41ReadbackRegion, V41RegionInStore, V41RegionInWeight, V41RegionInScale,
-  v41_row_store_spec, v41_published_span_plan, v41_live_head_sizes,
-  v41_readback_samples, v41_readback_region, v41_readback_sample_key,
-}
-import gunbc.spark.v41_row_store_encode {
-  V41StoreEncodeArgs, V41StoreEncodePlanned, V41StoreEncodeUnplannable, v41_store_encode_plan,
-}
-import gunbc.spark.v41_checkpoint_materialize { v41_checkpoint_directory }
-import gunbc.spark.v41_runtime_candidate { v41_candidate_partition }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
-import gunbc.spark.serving_subject { PairServingUnitOn }
-import gunbc.spark.host_commitment { admit_host_held_by_subject }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fleet_known_hosts_anchor {
-  fleet_ssh_attempt_identity, materialize_fleet_known_hosts_anchor, known_hosts_materialization_receipt,
-  fleet_openssh_trust_policy_of,
-}
-import gunbc.spark.grant_privileged_operation {
-  read_bootstrap_credential, BootstrapCredentialReady, BootstrapCredentialNotMaterialized,
-}
-import gunbc.auth.materialized_secret {
-  with_materialized_ssh_key_file, MaterializedSshKeyFileBracketCompleted, MaterializedSshKeyFileBracketRefused,
-}
-import gunbc.fleet_multi_principal_probe {
-  SparkConvergeTargetSingle, SparkConvergeTargetAllObserveOnly, SparkConvergeTargetRefused,
-  spark_converge_target_selection,
-}
-import gunbc.spark.fabric_reach { ExecutorReachKnown, ExecutorReachUnknown, observe_executor_reach }
-
-// ── THE READBACK RUN: THE PRODUCED STORES' BYTES AT EVERY SEAM, READ WHERE THEY ARE ─────────────
-//
-// The instrument of gunbc.spark.v41_engram_row_store v41_published_store_readback_readings. On ONE Group
-// A host that holds both the verified shards and the eight stores the encode run produced, it reads every
-// sample v41_readback_samples owes -- each store's magic, first and last record, and the published source
-// rows at the same global rows -- at the byte region v41_readback_region names: a store region at that
-// offset of the store's file (v41_store_encode_plan's out path), a source region at that offset past its
-// table's published span (the plan's shard and span offsets). It READS ONLY: od(1) over each region, and
-// nothing is written on the host. The receipt, printed into the step's log, carries one
-// `sample <key> hex=<bytes>` line per sample; the verdict is not taken here but by v41_store_readback over
-// the transcribed readings, where each record is compared against v41_place_row.
-
-data v41_readback_run_attempt_raw: String = "v41-row-store-readback"
-data v41_readback_run_receipt_path: String = "target/v41-row-store-readback-receipt.txt"
-
-// WHERE ONE SAMPLE IS ON THE HOST: a file and an absolute byte offset, with the region's length.
-type V41HostRegion {
-  sample: V41ReadbackSample
-  path: String
-  offset: Int
-  length: Int
-}
-
-fn v41_layer_args(plan: List<V41StoreEncodeArgs>, layer: Nat) -> V41StoreEncodeArgs? {
-  first(filter(plan, a => a.layer == layer))
-}
-
-fn v41_rank_args(plan: List<V41StoreEncodeArgs>, layer: Nat, rank: Nat) -> V41StoreEncodeArgs? {
-  first(filter(plan, a => a.layer == layer && a.rank == rank))
-}
-
-fn v41_shard_path(a: V41StoreEncodeArgs) -> String {
-  join([v41_checkpoint_directory as String, "/", a.shard as String], "")
-}
-
-fn v41_host_region(spec: V41RowStoreEncodingSpec, plan: List<V41StoreEncodeArgs>, s: V41ReadbackSample) -> V41HostRegion? {
-  match v41_readback_region(spec: spec, s: s) {
-    V41RegionInStore { layer: l, rank: r, offset: o, length: n } => match v41_rank_args(plan: plan, layer: l, rank: r) {
-      Absent => none
-      Present { value: a } => Present { value: V41HostRegion { sample: s, path: a.out as String, offset: byte_size_count(b: o), length: byte_size_count(b: n) } }
-    }
-    V41RegionInWeight { layer: l, offset: o, length: n } => match v41_layer_args(plan: plan, layer: l) {
-      Absent => none
-      Present { value: a } => Present { value: V41HostRegion { sample: s, path: v41_shard_path(a: a), offset: byte_size_count(b: a.weight_offset) + byte_size_count(b: o), length: byte_size_count(b: n) } }
-    }
-    V41RegionInScale { layer: l, offset: o, length: n } => match v41_layer_args(plan: plan, layer: l) {
-      Absent => none
-      Present { value: a } => Present { value: V41HostRegion { sample: s, path: v41_shard_path(a: a), offset: byte_size_count(b: a.scale_offset) + byte_size_count(b: o), length: byte_size_count(b: n) } }
-    }
-  }
-}
-
-type V41SampleRead
-  = V41SampleReadOk { region: V41HostRegion, hex: String }
-  | V41SampleReadFailed { region: V41HostRegion, cause: NonEmptyStr }
-
-// od prints the bytes as whitespace-separated two-digit hex over several lines; the reading is their
-// concatenation. A short read is not repaired here: the fold's length check refuses it.
-fn v41_od_hex(stdout: String) -> String {
-  replace(s: replace(s: replace(s: stdout, from: "\n", to: ""), from: " ", to: ""), from: "\t", to: "")
-}
-
-fn v41_read_sample(ctx: SparkMaterializeContext, r: V41HostRegion) -> V41SampleRead {
-  match spark_remote_run(ctx: ctx, argv: argv_words(command: od_hex_span_command(path: r.path, offset: r.offset, length: r.length))) {
-    RemoteUnreachable { cause: c, reach: _ } => V41SampleReadFailed { region: r, cause: join(["the od leg did not run: ", c], "") as NonEmptyStr }
-    RemoteRan { exit_code: code, stdout: o, stderr: err } =>
-      if code != 0 { V41SampleReadFailed { region: r, cause: join(["od exited ", to_string(code), ": ", trim(s: err)], "") as NonEmptyStr } } else {
-        V41SampleReadOk { region: r, hex: v41_od_hex(stdout: o) }
-      }
-  }
-}
-
-fn v41_sample_line(r: V41SampleRead) -> String {
-  match r {
-    V41SampleReadOk { region: g, hex: h } => join(["sample ", v41_readback_sample_key(s: g.sample), " hex=", h, "\n"], "")
-    V41SampleReadFailed { region: g, cause: c } => join(["sample ", v41_readback_sample_key(s: g.sample), " UNREAD ", c as String, " path=", g.path, " offset=", to_string(g.offset), " length=", to_string(g.length), "\n"], "")
-  }
-}
-
-type V41ReadbackRun
-  = V41ReadbackRefusedBeforeRun { cause: NonEmptyStr }
-  | V41ReadbackRan { owed: Nat, reads: List<V41SampleRead> }
-
-fn v41_readback_all(ctx: SparkMaterializeContext) -> V41ReadbackRun {
-  match v41_row_store_spec(population: map(deepseek_v4_1_flash_engram_sharded_entries, e => e.entry), partition: v41_candidate_partition, tables: deepseek_v4_1_flash_engram, head_sizes: v41_live_head_sizes(tables: deepseek_v4_1_flash_engram)) {
-    V41RowStoreSpecRefused { defects: d } => V41ReadbackRefusedBeforeRun { cause: join(["the row-store spec refused: ", join(map(d, x => x as String), "; ")], "") as NonEmptyStr }
-    V41RowStoreSpecAdmitted { spec: spec } =>
-      match v41_published_span_plan(partition: v41_candidate_partition, sharded: deepseek_v4_1_flash_engram_sharded_entries, shards: deepseek_v4_1_flash_engram_shard_files) {
-        V41PublishedSpansUnplannable { defects: d } => V41ReadbackRefusedBeforeRun { cause: join(["the span plan refused: ", join(map(d, x => x as String), "; ")], "") as NonEmptyStr }
-        V41PublishedSpansPlanned { spans: spans } =>
-          match v41_store_encode_plan(spec: spec, spans: spans) {
-            V41StoreEncodeUnplannable { defects: d } => V41ReadbackRefusedBeforeRun { cause: join(["the encode plan refused: ", join(map(d, x => x as String), "; ")], "") as NonEmptyStr }
-            V41StoreEncodePlanned { stores: plan } => {
-              let owed = v41_readback_samples(spec: spec)
-              let located = flat_map(owed, s => match v41_host_region(spec: spec, plan: plan, s: s) { Present { value: r } => [r]  Absent => [] as List<V41HostRegion> })
-              if length(located) != length(owed) {
-                V41ReadbackRefusedBeforeRun { cause: "a sample the spec owes names a store or table the encode plan does not, so it has no place on the host" as NonEmptyStr }
-              } else {
-                V41ReadbackRan { owed: length(owed), reads: map(located, r => v41_read_sample(ctx: ctx, r: r)) }
-              }
-            }
-          }
-      }
-  }
-}
-
-fn v41_readback_succeeded(run: V41ReadbackRun) -> Bool {
-  match run {
-    V41ReadbackRefusedBeforeRun { cause: _ } => false
-    V41ReadbackRan { owed: n, reads: rs } => n != 0 && length(rs) == n && all(rs, r => match r { V41SampleReadOk { region: _, hex: _ } => true  V41SampleReadFailed { region: _, cause: _ } => false })
-  }
-}
-
-fn v41_readback_body(run: V41ReadbackRun) -> String {
-  match run {
-    V41ReadbackRefusedBeforeRun { cause: c } => join(["refused-before-run: ", c as String, "\n"], "")
-    V41ReadbackRan { owed: _, reads: rs } => join(map(rs, r => v41_sample_line(r: r)), "")
-  }
-}
-
-// THE FLEET-CONVERGE DOOR: `spark_v41_row_store_readback` with `target` naming ONE Group A Spark that holds
-// the stores; the same admission as spark_v41_row_store_encode, and nothing on the host is written.
-fn v41_row_store_readback_ci_wet() -> ProcessExit
-  uses net: Network
-{
-  let now = clock_now_probed_at()
-  match spark_converge_target_selection(execute_apply: true) {
-    SparkConvergeTargetRefused { reason: why } => exit_failure(reason: why)
-    SparkConvergeTargetAllObserveOnly =>
-      exit_failure(reason: "SPARK_CONVERGE_TARGET is unset: this mode reads back the V4.1 row stores on ONE host, so it refuses rather than choosing one")
-    SparkConvergeTargetSingle { host: target_host } =>
-      match admit_host_held_by_subject(raw: target_host, subject: PairServingUnitOn { group: FabricGroupA }) {
-        Present { value: why } => exit_failure(reason: why)
-        Absent =>
-          match observe_executor_reach() {
-            ExecutorReachUnknown { cause: c } => exit_failure(reason: join(["v41_row_store_readback_ci: ", c], ""))
-            ExecutorReachKnown { short_hostname: executor, path: path } =>
-              match read_bootstrap_credential() {
-                BootstrapCredentialNotMaterialized { cause: c } => exit_failure(reason: c as String)
-                BootstrapCredentialReady { secret: administrator } =>
-                  match fleet_ssh_attempt_identity(raw: v41_readback_run_attempt_raw) {
-                    Absent => exit_failure(reason: "attempt identity is not a safe path segment")
-                    Present { value: attempt } => {
-                      let materialization = materialize_fleet_known_hosts_anchor(attempt: attempt)
-                      match fleet_openssh_trust_policy_of(outcome: materialization) {
-                        Absent => exit_failure(reason: join(["trust could not be established, so no leg ran: ", known_hosts_materialization_receipt(outcome: materialization)], ""))
-                        Present { value: trust } =>
-                          match with_materialized_ssh_key_file(
-                            identity_file_name: "gunbc-v41-row-store-readback-admin-password" as NonEmptyStr,
-                            secret_bytes: administrator as Secret,
-                            use: fn(file) {
-                              v41_readback_all(ctx: SparkMaterializeContext {
-                                host: target_host,
-                                trust: trust,
-                                path: path,
-                                admin_credential: administrator as Secret,
-                                admin_credential_file: file,
-                                executor: HostCli,
-                              })
-                            },
-                          ) {
-                            MaterializedSshKeyFileBracketRefused { cause: c } => exit_failure(reason: c as String)
-                            MaterializedSshKeyFileBracketCompleted { value: run } => {
-                              let body = join([
-                                join(["v41 row store readback probed_at=", probed_at_word(reading: now) as String, " host=", target_host as String, " revision=", deepseek_v4_1_flash_revision as String, "\n"], ""),
-                                v41_readback_body(run: run),
-                                join(["executor=", executor, "\n"], ""),
-                                known_hosts_materialization_receipt(outcome: materialization),
-                              ], "")
-                              let w = Filesystem.Write(path: v41_readback_run_receipt_path, content: body)
-                              if !w.success {
-                                exit_failure(reason: join(["v41 row store readback receipt write failed: ", w.error], ""))
-                              } else if v41_readback_succeeded(run: run) {
-                                ExitSuccess
-                              } else {
-                                exit_failure(reason: join(["not every owed sample was read on ", target_host as String, ":\n", body], ""))
-                              }
-                            }
-                          }
-                      }
-                    }
-                  }
-              }
-          }
-      }
-  }
-}
diff --git a/dag/gunbc/spark/v41_runtime_candidate.dag b/dag/gunbc/spark/v41_runtime_candidate.dag
deleted file mode 100644
index d686520a8bd..00000000000
--- a/dag/gunbc/spark/v41_runtime_candidate.dag
+++ /dev/null
@@ -1,1013 +0,0 @@
-module gunbc.spark.v41_runtime_candidate
-
-import std.types { String, Bool, Int, List, NonEmptyStr }
-import std.nat { Nat }
-import std.decl_ref { DeclarationRef, DeclField, WholeDeclaration, NamedField, declaration_ref_eq, TypeParameter }
-import std.content_hash { ContentHash, Sha256Digest, content_hash_atom, serialize_content_hash, sha256_hex_digest }
-import std.artifact_store { ArtifactRealizationInput, artifact_realization_digest }
-import std.measure { hardware_thread_count_value, byte_size_count }
-import std.optional { Present, Absent }
-import extdeps.gpu.types {
-  GpuComputeCapability, GpuCapabilityLabelOk, GpuCapabilityLabelRejected, gpu_compute_capability_sm_label,
-}
-import extdeps.vllm.server { VllmSourceRevision }
-import extdeps.vllm.source_build {
-  VllmContainerBuildRecipe, vllm_d2d649e6_aarch64_release_recipe, vllm_recipe_targeting, vllm_recipe_with_flashinfer, vllm_d2d649e6_revision,
-}
-import extdeps.flashinfer.flashinfer {
-  FlashInferAcquisition, FlashInferWheel, flashinfer_acquisition_key, flashinfer_published_version,
-  flashinfer_0_7_1rc1, flashinfer_0_7_1rc1_wheels, flashinfer_0_7_1rc1_version,
-  FlashInferWheelAdmission, FlashInferWheelAdmitted, FlashInferWheelRefused, admit_flashinfer_wheel,
-  FlashInferWheelFilenameFields, flashinfer_wheel_filename_fields,
-}
-import extdeps.safetensors.format {
-  SafetensorsEntry, SafetensorsPopulationStanding, safetensors_entry_span,
-  safetensors_population_entries, safetensors_population_closure_obligations,
-}
-import extdeps.deepseek.deepseek_v4_1_flash {
-  deepseek_v4_1_flash_revision, deepseek_v4_1_flash_engram_population,
-  deepseek_v4_1_flash_engram_sharded_entries, deepseek_v4_1_flash_engram_shard_files,
-  DeepseekV41EngramTables, deepseek_v4_1_flash_engram,
-  deepseek_v4_1_flash_weight_manifest_standing, WeightManifestAdmitted, WeightManifestRefused,
-  deepseek_v4_1_flash_tokenizer_standing, TokenizerPopulationAdmitted, TokenizerPopulationRefused,
-}
-import gunbc.spark.vllm_runtime_image_build {
-  v41_gb10_torch_cuda_arch_list, v41_build_max_jobs, v41_build_nvcc_threads,
-}
-import gunbc.spark.vllm_image_identity {
-  vllm_image_build_key_inputs,
-}
-import gunbc.spark.serving_runtime_capability_probe { gb10_observed_compute_capability }
-import gunbc.spark.serving_deployment_selection { TopologyShape, topology_shape }
-import gunbc.spark.v41_identity_input { V41EngramResidencyPartition, v41_input }
-import gunbc.spark.v41_engram_row_store {
-  V41PublishedRowStoreKey, V41PublishedRowStoreKeyed, V41PublishedRowStoreUnestablished, V41PublishedRowStoreRefused,
-  v41_row_store_encoding_key, v41_published_span_readings, v41_published_store_readings, v41_live_head_sizes,
-  V41StoreReadback, V41StoreReadbackVerified, V41StoreReadbackUnread, V41StoreReadbackRefused,
-  V41StoreReadbackReadingsUnread, V41StoreReadbackRead, V41RowStoreSpecAdmitted, V41RowStoreSpecRefused,
-  v41_store_readback, v41_row_store_spec, v41_published_store_readback_readings,
-}
-import gunbc.spark.v41_index_engram_selection { v41_engram_population_observed }
-import gunbc.fabric.engram_materialization { engram_route_b_identity, engram_route_d_identity }
-import extdeps.tools.sha256sum { Sha256FileDigest, Sha256FileDigestUnavailable, sha256sum_file_digest_via_shell, sha256sum_stdin_digest_via_shell }
-
-// ── ONE EXACT DeepSeek V4.1 RUNTIME CANDIDATE, AS IDENTITY ONLY ──────────────────────────────────
-//
-// WHAT THIS MODULE IS FOR. The published V4.1 image has no storage-backed Engram path and its source
-// is unrecoverable, so the only four-Spark route left is a first-party build whose Engram embedding
-// tables are read from storage (gunbc.fabric.engram_materialization routes B or D). Before anything
-// is built, this module fixes WHAT that candidate is, so that no evidence gathered later -- a build
-// receipt, a probe, a launch -- can be attributed to a different set of bytes than the one it ran.
-// Nothing here builds, pulls, or touches a host.
-//
-// FIVE IDENTITIES, NOT ONE HASH, because they are different grains and conflating them lets evidence
-// transfer where it must not, or refuses to transfer where it should:
-//   - the RUNTIME ARTIFACT: the vLLM source and build recipe, the kernel wheels, the patch population;
-//   - the MODEL SOURCE: the checkpoint revision, the weight manifest, the tokenizer manifest;
-//   - the ENGRAM REALIZATION: which tensors are storage-backed, how the row store is encoded, route B or D;
-//   - the EXECUTION PROFILE: runtime artifact + model source + topology + device;
-//   - the CANDIDATE: execution profile + Engram realization.
-// Route B versus D does not change a byte of the image, so it is not in the runtime key; the same
-// image can run under either. The checkpoint and TP4 are not properties of the runtime either.
-//
-// NO KEY IS MINTED FOR AN UNESTABLISHED AXIS. An identity with a hole in it would be a hash of
-// "whatever we have not decided yet", which two different future candidates would share.
-
-// ── THE RUNTIME ARTIFACT ────────────────────────────────────────────────────────────────────────
-
-// A PATCH IS ITS BYTES. The path says where it applies and the purpose says why; the digest is the
-// identity, and the revision it applies to is carried so a patch written against one tree cannot be
-// silently applied to another.
-type V41EnginePatch sole_constructor {
-  path: NonEmptyStr
-  applies_to: VllmSourceRevision
-  sha256: Sha256Digest
-  purpose: NonEmptyStr
-}
-
-fn v41_engine_patch(path: NonEmptyStr, applies_to: VllmSourceRevision, sha256_hex: String, purpose: NonEmptyStr) -> V41EnginePatch? {
-  match sha256_hex_digest(hex: sha256_hex) {
-    Absent => none
-    Present { value: d } => Present { value: V41EnginePatch { path: path, applies_to: applies_to, sha256: d, purpose: purpose } }
-  }
-}
-
-// WHO DECIDES WHICH ENGRAM TENSORS ARE STORAGE-BACKED. If the patch hard-codes the split, the split is
-// part of the runtime's bytes and belongs in the runtime key; if the runtime takes it as validated
-// configuration, it belongs in the Engram realization instead. The patch author decides which, so the
-// answer is carried with the observed patch population rather than assumed here.
-type V41EngramPartitionAuthority
-  = PartitionFixedByPatch
-  | PartitionByLaunchConfiguration
-
-// ABSENT-BY-OBSERVATION AND UNESTABLISHED ARE DIFFERENT. The first is a known empty population (an
-// unpatched upstream build) and has an identity; the second is "not written yet" and has none.
-type V41PatchPopulation
-  = V41PatchesObserved { patches: List<V41EnginePatch>, partition: V41EngramPartitionAuthority }
-  | V41PatchesAbsentByObservation
-  | V41PatchesUnestablished { obligation: NonEmptyStr }
-
-type V41RuntimeArtifactInputs {
-  recipe: VllmContainerBuildRecipe
-  kernel_acquisition: FlashInferAcquisition
-  kernel_wheels: List<FlashInferWheel>
-  patches: V41PatchPopulation
-}
-
-type V41IdentityStanding
-  = V41IdentityKeyed { key: ContentHash }
-  | V41IdentityUnestablished { obligations: List<NonEmptyStr> }
-  | V41IdentityRefused { defects: List<NonEmptyStr> }
-
-// THE KERNELS THE KEY NAMES MUST BE THE KERNELS THE RECIPE INSTALLS. main already carries one defect
-// of this shape -- a flashinfer version keyed and never passed to the build -- so a candidate whose
-// acquisition names a version other than the recipe's refuses rather than keying a pin nothing honours.
-// THE KERNEL CLOSURE THIS RUNTIME INSTALLS, BY PACKAGE. Upstream's Dockerfile installs all three at the
-// pinned version; a wheel population missing the cubin, or carrying two variants of one package, is not
-// the closure however many rows it has, so the population is compared as an exact bag rather than
-// counted.
-data v41_jit_cache_package: NonEmptyStr = "flashinfer-jit-cache" as NonEmptyStr
-
-// FROM 0.7.x THE JIT-CACHE IS A SHIM PLUS ONE PROVIDER PER ARCHITECTURE: the 0.7.1rc1 shim wheel's own
-// METADATA (extdeps.flashinfer.flashinfer flashinfer_0_7_1rc1_wheels) Requires-Dist names these eight at
-// the shim's version, so `flashinfer-jit-cache==<version>` installs all nine and the closure carries all
-// nine. Every one of them is platform-specific, so the build-target gate below covers the family.
-data v41_required_kernel_packages: List<NonEmptyStr> = [
-  "flashinfer-python" as NonEmptyStr,
-  "flashinfer-cubin" as NonEmptyStr,
-  v41_jit_cache_package,
-  "flashinfer-jit-cache-sm80" as NonEmptyStr,
-  "flashinfer-jit-cache-sm89" as NonEmptyStr,
-  "flashinfer-jit-cache-sm90a" as NonEmptyStr,
-  "flashinfer-jit-cache-sm100a" as NonEmptyStr,
-  "flashinfer-jit-cache-sm103a" as NonEmptyStr,
-  "flashinfer-jit-cache-sm110a" as NonEmptyStr,
-  "flashinfer-jit-cache-sm120f" as NonEmptyStr,
-  "flashinfer-jit-cache-sm121a" as NonEmptyStr,
-]
-
-// THE JIT-CACHE WHEEL IS THE ONE PLATFORM-SPECIFIC MEMBER OF THIS CLOSURE, and its package name plus the
-// release version does not identify it. FlashInfer publishes flashinfer_jit_cache at one version across
-// several CUDA local labels and platforms, and admit_flashinfer_wheel admits every one of them, because a
-// local label is a legitimate suffix of the release version -- exactly what that check exists to allow. So
-// a row naming the cu129 build, or the x86_64 one, re-admits cleanly against this acquisition and would key
-// a runtime whose image installs kernels it cannot load. The other two members are `py3-none-any` and carry
-// no such choice, so the assertion is on this package alone rather than on the population.
-//
-// WHY THESE FOUR VALUES ARE ASSERTED AND NOT DERIVED. The CUDA local label is how FlashInfer's index spells
-// a CUDA 13.0 build (`cu130`) and the platform is the manylinux aarch64 tag the recipe's
-// manylinuxaarch64-builder produces; both are upstream spelling conventions rather than functions of the
-// recipe's `13.0.2` this repository can compute, and inventing that mapping here would mint an authority for
-// a naming scheme FlashInfer owns. The wheel's filename and digest are already in the runtime key, so this
-// is a refusal gate over an axis the key already carries, not a second identity.
-type V41KernelBuildTarget sole_constructor {
-  version: NonEmptyStr
-  python: NonEmptyStr
-  abi: NonEmptyStr
-  platform: NonEmptyStr
-}
-
-data v41_jit_cache_build_target: V41KernelBuildTarget = V41KernelBuildTarget {
-  version: "0.7.1rc1+cu130" as NonEmptyStr,
-  python: "cp39" as NonEmptyStr,
-  abi: "abi3" as NonEmptyStr,
-  platform: "manylinux_2_28_aarch64" as NonEmptyStr,
-}
-
-fn v41_kernel_field_defect(field: String, actual: String, expected: NonEmptyStr, filename: NonEmptyStr) -> List<NonEmptyStr> {
-  if actual == (expected as String) { [] as List<NonEmptyStr> } else {
-    [join(["the jit-cache wheel ", filename as String, " carries ", field, " ", actual, ", but this runtime installs ", expected as String], "") as NonEmptyStr]
-  }
-}
-
-fn v41_jit_cache_target_defects(wheels: List<FlashInferWheel>, target: V41KernelBuildTarget) -> List<NonEmptyStr> {
-  flat_map(filter(wheels, w => starts_with(s: w.package as String, prefix: v41_jit_cache_package as String)), w =>
-    match flashinfer_wheel_filename_fields(filename: w.filename as String) {
-      Absent => [join(["the jit-cache wheel ", w.filename as String, " does not parse as a wheel filename, so the build target it installs is unknown"], "") as NonEmptyStr]
-      Present { value: f } =>
-        concat(concat(concat(
-          v41_kernel_field_defect(field: "version", actual: f.version, expected: target.version, filename: w.filename),
-          v41_kernel_field_defect(field: "python tag", actual: f.python, expected: target.python, filename: w.filename)),
-          v41_kernel_field_defect(field: "abi tag", actual: f.abi, expected: target.abi, filename: w.filename)),
-          v41_kernel_field_defect(field: "platform tag", actual: f.platform, expected: target.platform, filename: w.filename))
-    })
-}
-
-fn v41_wheels_named(wheels: List<FlashInferWheel>, package: NonEmptyStr) -> List<FlashInferWheel> {
-  filter(wheels, w => (w.package as String) == (package as String))
-}
-
-// EVERY WHEEL MUST RE-ADMIT AGAINST THE ACQUISITION THIS RUNTIME DECLARES. Comparing the acquisition's
-// version to the recipe's and then counting packages leaves the rows themselves unchecked: three rows with
-// the right package names, taken from a neighbouring release, would key a runtime whose recipe installs
-// something else. The authority that decides whether a row belongs to a release is
-// extdeps.flashinfer.flashinfer admit_flashinfer_wheel, so each row is offered back to it.
-fn v41_kernel_admission_defects(acquisition: FlashInferAcquisition, wheels: List<FlashInferWheel>) -> List<NonEmptyStr> {
-  flat_map(wheels, w => match admit_flashinfer_wheel(acquisition: acquisition, package: w.package, filename: w.filename, sha256_hex: w.sha256.hex as String) {
-    FlashInferWheelAdmitted { wheel: _ } => [] as List<NonEmptyStr>
-    FlashInferWheelRefused { refusal: _ } =>
-      [join(["the wheel ", w.filename as String, " does not re-admit against this runtime's kernel acquisition"], "") as NonEmptyStr]
-  })
-}
-
-fn v41_kernel_population_defects(wheels: List<FlashInferWheel>) -> List<NonEmptyStr> {
-  let missing = map(filter(v41_required_kernel_packages, p => length(v41_wheels_named(wheels: wheels, package: p)) == 0), p => join(["the kernel population carries no ", p as String, " wheel"], "") as NonEmptyStr)
-  let duplicated = map(filter(v41_required_kernel_packages, p => length(v41_wheels_named(wheels: wheels, package: p)) > 1), p => join(["the kernel population carries more than one ", p as String, " wheel, so which variant this runtime installs is undecided"], "") as NonEmptyStr)
-  let foreign = map(filter(wheels, w => !any(v41_required_kernel_packages, p => (p as String) == (w.package as String))), w => join(["the kernel population carries ", w.package as String, ", which is not part of this runtime's kernel closure"], "") as NonEmptyStr)
-  concat(concat(missing, duplicated), foreign)
-}
-
-fn v41_kernel_defects(i: V41RuntimeArtifactInputs) -> List<NonEmptyStr> {
-  match flashinfer_published_version(a: i.kernel_acquisition) {
-    Absent => ["the kernel acquisition is a source revision with no published wheels, so no wheel digest can pin it" as NonEmptyStr]
-    Present { value: v } =>
-      if (v as String) != (i.recipe.flashinfer_version as String) {
-        [join(["the kernel acquisition pins flashinfer ", v as String, " but the recipe installs ", i.recipe.flashinfer_version as String], "") as NonEmptyStr]
-      } else {
-        concat(concat(v41_kernel_population_defects(wheels: i.kernel_wheels), v41_kernel_admission_defects(acquisition: i.kernel_acquisition, wheels: i.kernel_wheels)), v41_jit_cache_target_defects(wheels: i.kernel_wheels, target: v41_jit_cache_build_target))
-      }
-  }
-}
-
-// A PATCH WRITTEN AGAINST ANOTHER TREE IS NOT THIS RUNTIME'S PATCH. Carrying applies_to into the key
-// records which revision it was authored for; it does not make applying it to a different one sound, so a
-// population naming any other revision refuses rather than keying.
-fn v41_patch_applicability_defects(patches: List<V41EnginePatch>, source: VllmSourceRevision) -> List<NonEmptyStr> {
-  map(
-    filter(patches, p => (p.applies_to.full_revision as String) != (source.full_revision as String) || (p.applies_to.repository as String) != (source.repository as String)),
-    p => join(["patch ", p.path as String, " applies to ", p.applies_to.repository as String, "@", p.applies_to.full_revision as String, ", not the recipe's ", source.repository as String, "@", source.full_revision as String], "") as NonEmptyStr,
-  )
-}
-
-// ORDER IS SEMANTIC HERE AND ONLY HERE: patches apply in sequence, so the ordinal is part of each input's
-// name. Every other field travels as its own named input rather than inside one delimited string, so no
-// path containing an `@` or a `#` can spell another patch's identity.
-fn v41_patch_inputs(patches: List<V41EnginePatch>) -> List<ArtifactRealizationInput> {
-  flat_map(enumerate(patches), p => [
-    v41_input(identity: join(["patch.", to_string(p.first), ".path"], ""), value: p.second.path as String),
-    v41_input(identity: join(["patch.", to_string(p.first), ".repository"], ""), value: p.second.applies_to.repository as String),
-    v41_input(identity: join(["patch.", to_string(p.first), ".revision"], ""), value: p.second.applies_to.full_revision as String),
-    v41_input(identity: join(["patch.", to_string(p.first), ".sha256"], ""), value: p.second.sha256.hex as String),
-  ])
-}
-
-fn v41_partition_authority_wire(a: V41EngramPartitionAuthority) -> String {
-  match a {
-    PartitionFixedByPatch => "fixed-by-patch"
-    PartitionByLaunchConfiguration => "launch-configuration"
-  }
-}
-
-// THE RUNTIME ARTIFACT KEY. The recipe contributes exactly the inputs vllm_image_build_key already
-// keys (so parallelism stays out, by the same law), then the kernel acquisition and every wheel digest,
-// then the patches in application order, then -- only when the patch fixes it -- the Engram partition.
-// ONE REPRESENTATION OF "OBSERVED, AND THERE WERE NONE". V41PatchesAbsentByObservation and
-// V41PatchesObserved with an empty list carry the same observed bytes -- none -- and minted DIFFERENT
-// runtime keys, so one unpatched runtime had two identities depending on which arm the author reached for.
-// The empty observed list is refused rather than normalised into the absent arm, because the two are not
-// the same statement: the absent arm says an observation was made and found nothing, and an empty list
-// beside a partition authority is more likely an unfinished record than that claim.
-//
-// AND AN EMPTY POPULATION CANNOT CLAIM THE PARTITION IS FIXED BY THE PATCH. PartitionFixedByPatch asserts
-// that the storage/resident split lives in the patched bytes, which is what pulls the partition INTO the
-// runtime key. With no patch there are no bytes to hold it, so the claim is unsatisfiable by construction
-// and the key it produces covers a split nothing implements.
-fn v41_empty_observation_defects(patches: List<V41EnginePatch>, authority: V41EngramPartitionAuthority) -> List<NonEmptyStr> {
-  if length(patches) != 0 { [] as List<NonEmptyStr> } else {
-    concat(
-      ["an observed patch population with no patches in it is not the same claim as V41PatchesAbsentByObservation, which says an observation was made and found none; one unpatched runtime must not have two identities" as NonEmptyStr],
-      match authority {
-        PartitionByLaunchConfiguration => [] as List<NonEmptyStr>
-        PartitionFixedByPatch => ["this population claims the Engram partition is fixed by the patch while carrying no patch, so there are no bytes for it to be fixed in" as NonEmptyStr]
-      })
-  }
-}
-
-// PATCH IDENTITY IS NOT PATCH REALIZATION. The runtime key can name an ordered population. Nothing in
-// converge_vllm_source applies those bytes: a clean checkout at applies_to is the only admitted tree,
-// and a dirty tree is refused. Hand-applying on the builder would produce bytes no declaration owns.
-// Until a modeled apply step exists, an observed nonempty population cannot mint a patched-source
-// identity. Absent-by-observation is the vanilla tree, which is what an unpatched baseline image is.
-type V41PatchApplicationStanding
-  = V41VanillaSourceAtRevision { revision: VllmSourceRevision }
-  | V41PatchApplicationUnestablished { obligation: NonEmptyStr }
-  | V41PatchApplicationRefused { defects: List<NonEmptyStr> }
-
-fn v41_patch_application_standing(source: VllmSourceRevision, patches: V41PatchPopulation) -> V41PatchApplicationStanding {
-  match patches {
-    V41PatchesUnestablished { obligation: o } => V41PatchApplicationUnestablished { obligation: o }
-    V41PatchesAbsentByObservation => V41VanillaSourceAtRevision { revision: source }
-    V41PatchesObserved { patches: ps, partition: authority } => {
-      let defects = concat(v41_patch_applicability_defects(patches: ps, source: source), v41_empty_observation_defects(patches: ps, authority: authority))
-      if length(defects) != 0 {
-        V41PatchApplicationRefused { defects: defects }
-      } else {
-        V41PatchApplicationUnestablished {
-          obligation: "a patched source tree is minted only by converge_vllm_source growing desired state with caller-supplied P, DigestFile of each member, std.upsert_decision Noop|Apply|Refuse, git apply --index so create-file members are in the index, and a readback of the tree (git diff --binary HEAD) that grounds the image key; this fold does not choose P and does not treat the intended patch list as the consumed identity" as NonEmptyStr,
-        }
-      }
-    }
-  }
-}
-
-fn v41_runtime_artifact_key(i: V41RuntimeArtifactInputs, partition: V41EngramResidencyPartition) -> V41IdentityStanding {
-  let kernel_defects = v41_kernel_defects(i: i)
-  if length(kernel_defects) != 0 {
-    V41IdentityRefused { defects: kernel_defects }
-  } else {
-    let base = concat(concat(
-      vllm_image_build_key_inputs(r: i.recipe),
-      [v41_input(identity: "kernel_acquisition", value: flashinfer_acquisition_key(a: i.kernel_acquisition))],
-    ), flat_map(i.kernel_wheels.sort_by(w => w.package as String), w => [
-      v41_input(identity: join(["kernel_wheel.", w.package as String, ".filename"], ""), value: w.filename as String),
-      v41_input(identity: join(["kernel_wheel.", w.package as String, ".sha256"], ""), value: w.sha256.hex as String),
-    ]))
-    match i.patches {
-      V41PatchesUnestablished { obligation: o } => V41IdentityUnestablished { obligations: [o] }
-      V41PatchesAbsentByObservation =>
-        V41IdentityKeyed { key: artifact_realization_digest(inputs: concat(base, [v41_input(identity: "patches", value: "none-by-observation")])) }
-      V41PatchesObserved { patches: ps, partition: authority } => {
-        let applicability = concat(
-          v41_patch_applicability_defects(patches: ps, source: i.recipe.source),
-          v41_empty_observation_defects(patches: ps, authority: authority))
-        if length(applicability) != 0 { V41IdentityRefused { defects: applicability } } else {
-        let with_patches = concat(concat(base, v41_patch_inputs(patches: ps)), [v41_input(identity: "partition_authority", value: v41_partition_authority_wire(a: authority))])
-        match authority {
-          PartitionByLaunchConfiguration => V41IdentityKeyed { key: artifact_realization_digest(inputs: with_patches) }
-          PartitionFixedByPatch => V41IdentityKeyed { key: artifact_realization_digest(inputs: concat(with_patches, v41_partition_inputs(p: partition))) }
-        } }
-      }
-    }
-  }
-}
-
-// ── THE ENGRAM RESIDENCY PARTITION ──────────────────────────────────────────────────────────────
-
-// WHICH OF THE TWELVE ENGRAM TENSORS ARE READ FROM STORAGE AND WHICH STAY RESIDENT
-// (gunbc.spark.v41_identity_input V41EngramResidencyPartition). Admitted against the cited population
-// in extdeps.deepseek.deepseek_v4_1_flash: the two sets must be disjoint and together name every tensor
-// exactly once, and nothing outside the population. The storage-backed byte total is DERIVED from the
-// cited spans, never written down.
-
-type V41PartitionAdmission
-  = V41PartitionAdmitted { partition: V41EngramResidencyPartition }
-  | V41PartitionRefused { defects: List<NonEmptyStr> }
-
-// THE POPULATION IS READ THROUGH ITS STANDING, NEVER AROUND IT. Concatenating the two layers' entry
-// lists reaches the same twelve rows while stepping past the carrier that says what those rows are
-// CLOSED AGAINST, and extdeps.safetensors.format says exactly what that carrier is for: "A consumer
-// that establishes a subject over this reads the obligation and carries it onto its own evidence axis,
-// so an unenumerated index shows up as an open question in the decision rather than as a sentence in
-// this file." This module is such a consumer.
-fn v41_engram_population_of(standing: SafetensorsPopulationStanding) -> List<SafetensorsEntry> {
-  safetensors_population_entries(s: standing)
-}
-
-fn v41_count_named(names: List<NonEmptyStr>, name: NonEmptyStr) -> Int {
-  length(filter(names, n => (n as String) == (name as String)))
-}
-
-// WHICH TENSORS ARE THE TABLES, DECIDED BY THE PUBLISHER'S OWN CONFIG RATHER THAN BY THEIR NAMES. An
-// earlier form of this wall compared the two sides' byte totals and admitted any partition where storage
-// held the majority. That is strictly weaker than the invariant it claimed, and the counterexample is
-// constructible from the cited spans: put layer 1's embed pair AND every q/k/wkv operator on storage and
-// leave layer 14's embed pair resident, and storage leads by 312268144 bytes while a complete ~101 GB
-// table sits in memory and every small operator has moved to disk -- the exact inversion, admitted.
-//
-// THE ROLE IS A JOIN, NOT A NAME MATCH. config.json's Engram block declares unpadded_embeddings, and the
-// two embedding tensors of each layer carry that count as their first dimension: 384006168 for layer 1,
-// 384016682 for layer 14. The operators' first dimensions are 4, 25600 and 800. So membership in the
-// publisher's own declared embedding extents decides the role, and extdeps.deepseek.deepseek_v4_1_flash
-// stays the single authority for it -- no `.engram.` infix constant, no role enum minted here, and nothing
-// that a rename of a tensor could silently flip.
-fn v41_is_embedding_table(e: SafetensorsEntry, tables: DeepseekV41EngramTables) -> Bool {
-  match get(xs: e.shape, index: 0) {
-    Absent => false
-    Present { value: rows } => any(tables.unpadded_embeddings, n => n == rows)
-  }
-}
-
-// THE BYTE FIGURE IS WHAT MAKES THE DEFECT LEGIBLE, so it is reported rather than compared: "this tensor
-// is on the wrong side" is a fact a reader must look up, and "a 101377628352-byte table is being kept
-// resident" is one they can act on.
-fn v41_role_defects(population: List<SafetensorsEntry>, p: V41EngramResidencyPartition) -> List<NonEmptyStr> {
-  concat(
-    map(filter(population, e => v41_is_embedding_table(e: e, tables: deepseek_v4_1_flash_engram) && v41_count_named(names: p.resident, name: e.name) == 1),
-      e => join(["the embedding table ", e.name as String, " is ", to_string(byte_size_count(b: safetensors_entry_span(e: e))),
-        " bytes and this partition keeps it resident; this candidate exists because those tables do not fit"], "") as NonEmptyStr),
-    map(filter(population, e => !v41_is_embedding_table(e: e, tables: deepseek_v4_1_flash_engram) && v41_count_named(names: p.storage_backed, name: e.name) == 1),
-      e => join(["the operator ", e.name as String, " is ", to_string(byte_size_count(b: safetensors_entry_span(e: e))),
-        " bytes and this partition reads it from storage; the small operators stay resident"], "") as NonEmptyStr),
-  )
-}
-
-fn v41_admit_partition(p: V41EngramResidencyPartition, standing: SafetensorsPopulationStanding) -> V41PartitionAdmission {
-  let population = v41_engram_population_of(standing: standing)
-  let assigned = concat(p.storage_backed, p.resident)
-  let unassigned = map(filter(population, e => v41_count_named(names: assigned, name: e.name) == 0), e => join(["tensor ", e.name as String, " is neither storage-backed nor resident"], "") as NonEmptyStr)
-  let twice = map(filter(population, e => v41_count_named(names: assigned, name: e.name) > 1), e => join(["tensor ", e.name as String, " is assigned more than once"], "") as NonEmptyStr)
-  let foreign = map(filter(assigned, n => length(filter(population, e => (e.name as String) == (n as String))) == 0), n => join(["tensor ", n as String, " is not in the cited Engram population"], "") as NonEmptyStr)
-  let shape = concat(concat(unassigned, twice), foreign)
-  if length(shape) != 0 {
-    V41PartitionRefused { defects: shape }
-  } else {
-    let misplaced = v41_role_defects(population: population, p: p)
-    if length(misplaced) != 0 {
-      V41PartitionRefused { defects: misplaced }
-    } else {
-      V41PartitionAdmitted { partition: p }
-    }
-  }
-}
-
-// THE TWO SIDES ARE SETS, NOT SEQUENCES: which tensors are storage-backed is the fact, and the order they
-// were written in is not. artifact_realization_digest folds its inputs in order, so each side is
-// canonicalized by tensor name and each member is named by its own identity rather than by position --
-// otherwise reordering one list would mint a different candidate for the same realization.
-fn v41_partition_inputs(p: V41EngramResidencyPartition) -> List<ArtifactRealizationInput> {
-  concat(
-    map(p.storage_backed.sort_by(n => n as String), n => v41_input(identity: join(["storage_backed.", n as String], ""), value: "storage-backed")),
-    map(p.resident.sort_by(n => n as String), n => v41_input(identity: join(["resident.", n as String], ""), value: "resident")),
-  )
-}
-
-// ── THE MODEL SOURCE ────────────────────────────────────────────────────────────────────────────
-
-// A MANIFEST IS OBSERVED AS ONE DIGEST OVER ITS FILE POPULATION, OR IT IS NOT YET AN IDENTITY. The
-// checkpoint revision alone is an upstream name, not bytes this repository has read.
-// AN OBLIGATION IS NOT A DEFECT. Unestablished names something still to be read or written (a
-// digest not yet taken); refused names a population the authority admits is WRONG (a duplicated
-// shard, a role with two carriers), which no reading discharges. The candidate carries them apart
-// so a defect never reads as pending work.
-type V41ManifestStanding
-  = V41ManifestObserved { digest: Sha256Digest }
-  | V41ManifestUnestablished { obligation: NonEmptyStr }
-  | V41ManifestRefused { first: NonEmptyStr, rest: List<NonEmptyStr> }
-
-type V41ModelSourceInputs {
-  checkpoint_revision: NonEmptyStr
-  weights: V41ManifestStanding
-  tokenizer: V41ManifestStanding
-}
-
-fn v41_manifest_obligations(m: V41ManifestStanding) -> List<NonEmptyStr> {
-  match m {
-    V41ManifestObserved { digest: _ } => [] as List<NonEmptyStr>
-    V41ManifestUnestablished { obligation: o } => [o]
-    V41ManifestRefused { first: _, rest: _ } => [] as List<NonEmptyStr>
-  }
-}
-
-// A refusal carries at least one defect BY CONSTRUCTION (first, rest), so an empty refusal that
-// would fall through to keying is not writable.
-fn v41_manifest_defects(m: V41ManifestStanding) -> List<NonEmptyStr> {
-  match m {
-    V41ManifestObserved { digest: _ } => [] as List<NonEmptyStr>
-    V41ManifestUnestablished { obligation: _ } => [] as List<NonEmptyStr>
-    V41ManifestRefused { first: f, rest: r } => concat([f], r)
-  }
-}
-
-fn v41_manifest_refused(defects: List<NonEmptyStr>, subject: String) -> V41ManifestStanding {
-  match first(defects) {
-    Present { value: f } => V41ManifestRefused { first: f, rest: defects |> skip(n: 1) }
-    Absent => V41ManifestRefused { first: join([subject, ": refused with no defect named -- the admission's refusal carried an empty population"], "") as NonEmptyStr, rest: [] as List<NonEmptyStr> }
-  }
-}
-
-fn v41_manifest_value(m: V41ManifestStanding) -> String {
-  match m {
-    V41ManifestObserved { digest: d } => d.hex as String
-    V41ManifestUnestablished { obligation: _ } => ""
-    V41ManifestRefused { first: _, rest: _ } => ""
-  }
-}
-
-fn v41_model_source_key(s: V41ModelSourceInputs) -> V41IdentityStanding {
-  let defects = concat(v41_manifest_defects(m: s.weights), v41_manifest_defects(m: s.tokenizer))
-  let obligations = concat(v41_manifest_obligations(m: s.weights), v41_manifest_obligations(m: s.tokenizer))
-  if length(defects) != 0 {
-    V41IdentityRefused { defects: defects }
-  } else if length(obligations) != 0 {
-    V41IdentityUnestablished { obligations: obligations }
-  } else {
-    V41IdentityKeyed { key: artifact_realization_digest(inputs: [
-      v41_input(identity: "checkpoint_revision", value: s.checkpoint_revision as String),
-      v41_input(identity: "weight_manifest", value: v41_manifest_value(m: s.weights)),
-      v41_input(identity: "tokenizer_manifest", value: v41_manifest_value(m: s.tokenizer)),
-    ]) }
-  }
-}
-
-// ── THE ENGRAM REALIZATION ──────────────────────────────────────────────────────────────────────
-
-// THE POPULATION STANDING IS AN INPUT, not a constant this module reaches for, because its membership
-// closure is the thing that decides whether this axis can key at all. A caller supplies which reading of
-// the checkpoint's Engram tensors the candidate is being built over, and the live row supplies the real
-// one; a fixture that wants a keyed candidate must supply a standing closed against a full index, which
-// is the honest way to say "if the index were enumerated".
-type V41EngramRealizationInputs {
-  partition: V41EngramResidencyPartition
-  population: SafetensorsPopulationStanding
-  row_store_encoding: V41PublishedRowStoreKey
-  route: DeclarationRef
-}
-
-// ONLY THE TWO ROUTES WHOSE TOKEN-TIME READ STAYS ON THE HOST. Route A is resident (the shape this
-// candidate exists to avoid) and route C reads NFS on every gather; both are refused here by name.
-fn v41_route_admitted(route: DeclarationRef) -> Bool {
-  declaration_ref_eq(a: route, b: engram_route_b_identity) || declaration_ref_eq(a: route, b: engram_route_d_identity)
-}
-
-// A REFERENCE IS ITS MODULE, ITS DECLARATION AND ITS FIELD. Serializing two of the three would let a
-// field reference and its whole declaration key the same, which is the same conflation comparing only
-// decl_name made in the admission above.
-fn v41_decl_field_wire(f: DeclField) -> String {
-  match f {
-    WholeDeclaration => "*"
-    NamedField { field_name: n } => n as String
-    TypeParameter { name: t } => concat("<", concat(t as String, ">"))
-  }
-}
-
-// AN UNESTABLISHED AXIS REPORTS EVERY OPEN OBLIGATION ON IT, NOT THE FIRST ONE FOUND. Returning on the
-// membership residual alone hid the row-store encoding's obligation, so a reader of the live candidate saw
-// one missing axis where there were two -- a partial answer that looks complete, which is worse than the
-// silence it replaced because it would be read as the full list.
-fn v41_row_store_obligations(k: V41PublishedRowStoreKey) -> List<NonEmptyStr> {
-  match k {
-    V41PublishedRowStoreUnestablished { obligation: o } => [o]
-    V41PublishedRowStoreKeyed { digest: _ } => [] as List<NonEmptyStr>
-    V41PublishedRowStoreRefused { defects: _ } => [] as List<NonEmptyStr>
-  }
-}
-
-// A REFUSED ROW STORE WITH NO DEFECT NAMED STILL REFUSES, naming that, rather than falling through.
-fn v41_row_store_key_defects(k: V41PublishedRowStoreKey) -> List<NonEmptyStr> {
-  match k {
-    V41PublishedRowStoreRefused { defects: d } => if length(d) != 0 { d } else { ["the row-store encoding refused with no defect named" as NonEmptyStr] }
-    V41PublishedRowStoreKeyed { digest: _ } => [] as List<NonEmptyStr>
-    V41PublishedRowStoreUnestablished { obligation: _ } => [] as List<NonEmptyStr>
-  }
-}
-
-// AN UNRECONCILED MEMBERSHIP IS AN UNESTABLISHED AXIS, NOT A KEYABLE ONE. This module's own law is that
-// no key is minted for an axis with a hole in it. A population closed only against the rows that were
-// READ, rather than against the revision's full index, would let a thirteenth Engram tensor pass
-// neither reconciled nor refused -- and a partition can be total and disjoint over the twelve while
-// missing it entirely. (The live population is gunbc.spark.v41_index_engram_selection v41_engram_population_observed:
-// closed only once a reading of the pinned index is transcribed; a scoped closure lands here.) Keying here would hash "the Engram tensors we
-// happen to have read" and call it the Engram realization, and two different future candidates over
-// different readings of the same checkpoint would share it. So the residual the population carries is
-// folded onto this axis as an obligation, and it is the only one of the three standings that can be
-// discharged by reading the index rather than by writing something.
-fn v41_engram_realization_key(e: V41EngramRealizationInputs) -> V41IdentityStanding {
-  let membership = safetensors_population_closure_obligations(s: e.population)
-  let row_store_defects = v41_row_store_key_defects(k: e.row_store_encoding)
-  if length(row_store_defects) != 0 {
-    V41IdentityRefused { defects: row_store_defects }
-  } else if length(membership) != 0 {
-    V41IdentityUnestablished { obligations: concat(membership, v41_row_store_obligations(k: e.row_store_encoding)) }
-  } else {
-  match v41_admit_partition(p: e.partition, standing: e.population) {
-    V41PartitionRefused { defects: d } => V41IdentityRefused { defects: d }
-    V41PartitionAdmitted { partition: p } =>
-      if !v41_route_admitted(route: e.route) {
-        V41IdentityRefused { defects: [join(["route ", e.route.decl_name as String, " is not a storage-backed token-time route this candidate admits (B or D)"], "") as NonEmptyStr] }
-      } else {
-        match e.row_store_encoding {
-          V41PublishedRowStoreUnestablished { obligation: o } => V41IdentityUnestablished { obligations: [o] }
-          V41PublishedRowStoreRefused { defects: d } => V41IdentityRefused { defects: d }
-          V41PublishedRowStoreKeyed { digest: d } =>
-            V41IdentityKeyed { key: artifact_realization_digest(inputs: concat(v41_partition_inputs(p: p), [
-              v41_input(identity: "row_store_encoding", value: serialize_content_hash(hash: d) as String),
-              v41_input(identity: "route.module_path", value: e.route.module_path as String),
-              v41_input(identity: "route.decl_name", value: e.route.decl_name as String),
-              v41_input(identity: "route.field", value: v41_decl_field_wire(f: e.route.field)),
-            ])) }
-        }
-      }
-  }
-  }
-}
-
-// ── THE EXECUTION PROFILE AND THE CANDIDATE ─────────────────────────────────────────────────────
-
-type V41CandidateInputs {
-  runtime: V41RuntimeArtifactInputs
-  model_source: V41ModelSourceInputs
-  engram: V41EngramRealizationInputs
-  topology: TopologyShape
-  device: GpuComputeCapability
-}
-
-// THE CANDIDATE VERDICT, SEALED. V41CandidateStanding is a coproduct a caller can write, so the keyed arm
-// with arbitrary hashes in it is writable too -- which would defeat the whole module: the point is that a
-// key exists only when every axis was established. Consumers therefore take this record, which only
-// v41_candidate_standing mints. The input records stay constructible; they are what a caller supplies.
-// THE DERIVATION EVIDENCE RIDES BESIDE THE STANDING AND OUTSIDE EVERY KEY (proud-deer-538, 2026-09-24):
-// the boundary-stratified readback of the produced row stores says the stores were DERIVED correctly,
-// which is evidence about the key's referent and not a coordinate of it, so it enters none of the five
-// ContentHashes. A readback that REFUSED refuses the candidate (a store proven wrong is not a candidate);
-// one still UNREAD leaves a keyed candidate keyed and is an obligation deployment authorization must
-// consume (gunbc.spark.pair_serving_d0_authorization d0_subject_of_candidate refuses over it).
-type V41CandidateVerdict sole_constructor {
-  standing: V41CandidateStanding
-  derivation: V41DerivationEvidence
-}
-
-type V41DerivationEvidence {
-  row_store_readback: V41StoreReadback
-}
-
-// WHAT THE DERIVATION EVIDENCE STILL OWES before anything may be authorized to run the candidate. A
-// refused readback owes nothing here: it has already refused the standing.
-fn v41_derivation_obligations(d: V41DerivationEvidence) -> List<NonEmptyStr> {
-  match d.row_store_readback {
-    V41StoreReadbackUnread { obligation: o } => [o]
-    V41StoreReadbackVerified { host: _, observed_at: _, samples: _ } => [] as List<NonEmptyStr>
-    V41StoreReadbackRefused { defects: _ } => [] as List<NonEmptyStr>
-  }
-}
-
-type V41CandidateStanding
-  = V41CandidateKeyed {
-      runtime_artifact: ContentHash
-      model_source: ContentHash
-      engram_realization: ContentHash
-      execution_profile: ContentHash
-      candidate: ContentHash
-      authorization_obligation: NonEmptyStr
-    }
-  | V41CandidateUnestablished { obligations: List<NonEmptyStr> }
-  | V41CandidateRefused { defects: List<NonEmptyStr> }
-
-// A KEYED CANDIDATE IS STILL NOT AUTHORIZED TO RUN. gunbc.spark.serving_deployment_selection
-// authorized_v4_1_runtime_holds admits exactly the published arm64 digest, so every first-party artifact
-// fails that constraint by construction. This module records the conflict and does not widen the
-// comparison: running a candidate needs an exact, bounded experiment authorization for its key.
-data v41_first_party_authorization_obligation: NonEmptyStr = "gunbc.spark.serving_deployment_selection authorized_v4_1_runtime_holds admits only the published arm64 digest; a first-party candidate needs an exact, time-bounded experiment authorization for its candidate key before any host runs it" as NonEmptyStr
-
-// A CAPABILITY IS A VENDOR AND TWO NUMBERS. Comparing only the numbers admits an AMD part reporting 12.1
-// through a gate written for a GB10, and keying only "12.1" gives it the same execution-profile identity --
-// two different machines, one key. extdeps.gpu.types already owns the rendering that separates them, and it
-// is the same authority the sm_/gfx label distinction lives in, so the key consumes it rather than
-// concatenating fields here. The rejected arm cannot be reached from an admitted candidate, and it is still
-// rendered with the vendor's own name so that two unrecognised vendors cannot collide either.
-fn v41_device_wire(cap: GpuComputeCapability) -> String {
-  match gpu_compute_capability_sm_label(cap: cap) {
-    GpuCapabilityLabelOk { label: l } => l
-    GpuCapabilityLabelRejected { reason: r } => join(["unsubstantiated:", r.vendor.legal_name as String, ":", to_string(cap.major), ".", to_string(cap.minor)], "")
-  }
-}
-
-fn v41_shape_defects(c: V41CandidateInputs) -> List<NonEmptyStr> {
-  concat(
-    if c.topology.tensor_parallel_degree == 4 && c.topology.replica_count == 1 { [] as List<NonEmptyStr> } else {
-      [join(["topology tp", to_string(c.topology.tensor_parallel_degree), " x ", to_string(c.topology.replica_count), " is not the four-Spark TP4 single replica this candidate is for"], "") as NonEmptyStr]
-    },
-    if c.device == gb10_observed_compute_capability { [] as List<NonEmptyStr> } else {
-      [join(["device capability ", to_string(c.device.major), ".", to_string(c.device.minor), " is not the GB10's 12.1"], "") as NonEmptyStr]
-    },
-  )
-}
-
-fn v41_standing_defects(s: V41IdentityStanding) -> List<NonEmptyStr> {
-  match s {
-    V41IdentityRefused { defects: d } => d
-    V41IdentityKeyed { key: _ } => [] as List<NonEmptyStr>
-    V41IdentityUnestablished { obligations: _ } => [] as List<NonEmptyStr>
-  }
-}
-
-fn v41_standing_obligations(s: V41IdentityStanding) -> List<NonEmptyStr> {
-  match s {
-    V41IdentityUnestablished { obligations: o } => o
-    V41IdentityKeyed { key: _ } => [] as List<NonEmptyStr>
-    V41IdentityRefused { defects: _ } => [] as List<NonEmptyStr>
-  }
-}
-
-// REFUSALS DOMINATE OBLIGATIONS. A candidate that is both malformed and incomplete reports what is
-// wrong, because finishing it would not make it right.
-fn v41_candidate_standing(c: V41CandidateInputs, readback: V41StoreReadback) -> V41CandidateVerdict {
-  let standing = v41_candidate_standing_of(c: c)
-  V41CandidateVerdict {
-    standing: match readback {
-      V41StoreReadbackRefused { defects: rd } => match standing {
-        V41CandidateRefused { defects: d } => V41CandidateRefused { defects: concat(d, rd) }
-        V41CandidateKeyed { runtime_artifact: _, model_source: _, engram_realization: _, execution_profile: _, candidate: _, authorization_obligation: _ } => V41CandidateRefused { defects: rd }
-        V41CandidateUnestablished { obligations: _ } => V41CandidateRefused { defects: rd }
-      }
-      V41StoreReadbackVerified { host: _, observed_at: _, samples: _ } => standing
-      V41StoreReadbackUnread { obligation: _ } => standing
-    },
-    derivation: V41DerivationEvidence { row_store_readback: readback },
-  }
-}
-
-fn v41_candidate_standing_of(c: V41CandidateInputs) -> V41CandidateStanding {
-  let runtime = v41_runtime_artifact_key(i: c.runtime, partition: c.engram.partition)
-  let source = v41_model_source_key(s: c.model_source)
-  let engram = v41_engram_realization_key(e: c.engram)
-  let defects = concat(concat(concat(v41_shape_defects(c: c), v41_standing_defects(s: runtime)), v41_standing_defects(s: source)), v41_standing_defects(s: engram))
-  let obligations = concat(concat(v41_standing_obligations(s: runtime), v41_standing_obligations(s: source)), v41_standing_obligations(s: engram))
-  if length(defects) != 0 {
-    V41CandidateRefused { defects: defects }
-  } else if length(obligations) != 0 {
-    V41CandidateUnestablished { obligations: obligations }
-  } else {
-    match runtime {
-      V41IdentityKeyed { key: rk } => match source {
-        V41IdentityKeyed { key: sk } => match engram {
-          V41IdentityKeyed { key: ek } => {
-            let execution = artifact_realization_digest(inputs: [
-              v41_input(identity: "runtime_artifact", value: serialize_content_hash(hash: rk) as String),
-              v41_input(identity: "model_source", value: serialize_content_hash(hash: sk) as String),
-              v41_input(identity: "topology", value: join(["tp", to_string(c.topology.tensor_parallel_degree), "x", to_string(c.topology.replica_count)], "")),
-              v41_input(identity: "device", value: v41_device_wire(cap: c.device)),
-            ])
-            V41CandidateKeyed {
-              runtime_artifact: rk,
-              model_source: sk,
-              engram_realization: ek,
-              execution_profile: execution,
-              candidate: artifact_realization_digest(inputs: [
-                v41_input(identity: "execution_profile", value: serialize_content_hash(hash: execution) as String),
-                v41_input(identity: "engram_realization", value: serialize_content_hash(hash: ek) as String),
-              ]),
-              authorization_obligation: v41_first_party_authorization_obligation,
-            }
-          }
-          V41IdentityUnestablished { obligations: o } => V41CandidateUnestablished { obligations: o }
-          V41IdentityRefused { defects: d } => V41CandidateRefused { defects: d }
-        }
-        V41IdentityUnestablished { obligations: o } => V41CandidateUnestablished { obligations: o }
-        V41IdentityRefused { defects: d } => V41CandidateRefused { defects: d }
-      }
-      V41IdentityUnestablished { obligations: o } => V41CandidateUnestablished { obligations: o }
-      V41IdentityRefused { defects: d } => V41CandidateRefused { defects: d }
-    }
-  }
-}
-
-// ── THE CANDIDATE AS IT STANDS TODAY ────────────────────────────────────────────────────────────
-
-// UPSTREAM'S aarch64 RELEASE RECIPE AT d2d649e6 WITH THE FLEET'S DECLARED ARCH OVERRIDE (12.1).
-// Parallelism on a dedicated builder is upstream's own max_jobs (16), not the Spark-sharing cap of 6.
-// THE KERNEL RELEASE IS THE CANDIDATE'S, NOT THE BASE'S. d2d649e6 pins FlashInfer 0.6.18.post1, whose
-// SM120 sparse-MLA decode exists only at 64-token pages; with the 64-token kernel page the V4.1 indexer
-// needs on SM12x (member sm120_64_token_kernel_pages), a ratio-2 layer's extra pages are 32 tokens, which
-// only 0.7.1rc1 serves (extdeps.flashinfer.flashinfer flashinfer_0_7_1rc1_version). The build argument
-// FLASHINFER_VERSION carries it to the jit-cache install; the requirements member carries it to
-// flashinfer-python and flashinfer-cubin, so the image holds one FlashInfer release, not two.
-fn v41_candidate_recipe() -> VllmContainerBuildRecipe {
-  vllm_recipe_with_flashinfer(
-    base: vllm_recipe_targeting(
-      base: vllm_d2d649e6_aarch64_release_recipe,
-      torch_cuda_arch_list: v41_gb10_torch_cuda_arch_list,
-      install_kv_connectors: vllm_d2d649e6_aarch64_release_recipe.install_kv_connectors,
-      max_jobs: vllm_d2d649e6_aarch64_release_recipe.max_jobs,
-      nvcc_threads: hardware_thread_count_value(t: v41_build_nvcc_threads),
-    ),
-    flashinfer_version: flashinfer_0_7_1rc1_version,
-  )
-}
-
-// THE SPLIT THE FOUR-SPARK ARITHMETIC NEEDS: the two sparse embedding tables per Engram layer (weight and
-// its ue8m0 scale) from storage, the attention projections resident.
-data v41_candidate_partition: V41EngramResidencyPartition = V41EngramResidencyPartition {
-  storage_backed: [
-    "layers.1.engram.embed.weight" as NonEmptyStr, "layers.1.engram.embed.scale" as NonEmptyStr,
-    "layers.14.engram.embed.weight" as NonEmptyStr, "layers.14.engram.embed.scale" as NonEmptyStr,
-  ],
-  resident: [
-    "layers.1.engram.q_weight" as NonEmptyStr, "layers.1.engram.k_weight" as NonEmptyStr,
-    "layers.1.engram.wkv.weight" as NonEmptyStr, "layers.1.engram.wkv.scale" as NonEmptyStr,
-    "layers.14.engram.q_weight" as NonEmptyStr, "layers.14.engram.k_weight" as NonEmptyStr,
-    "layers.14.engram.wkv.weight" as NonEmptyStr, "layers.14.engram.wkv.scale" as NonEmptyStr,
-  ],
-}
-
-data v41_candidate_inputs: V41CandidateInputs = V41CandidateInputs {
-  runtime: V41RuntimeArtifactInputs {
-    recipe: v41_candidate_recipe(),
-    kernel_acquisition: flashinfer_0_7_1rc1,
-    kernel_wheels: flashinfer_0_7_1rc1_wheels,
-    patches: v41_storage_backed_patch_population(),
-  },
-  model_source: V41ModelSourceInputs {
-    checkpoint_revision: deepseek_v4_1_flash_revision,
-    weights: v41_weight_manifest_standing(),
-    tokenizer: v41_tokenizer_standing(),
-  },
-  engram: V41EngramRealizationInputs {
-    partition: v41_candidate_partition,
-    population: v41_engram_population_observed(),
-    row_store_encoding: v41_row_store_encoding_standing(),
-    route: engram_route_b_identity,
-  },
-  topology: topology_shape(tensor_parallel_degree: 4, replica_count: 1),
-  device: gb10_observed_compute_capability,
-}
-
-// A MANIFEST AXIS IS KEYED BY THE DIGEST OF AN ADMITTED POPULATION'S CANONICAL TEXT. The rows are
-// the publisher's declared digests at the pinned revision (extdeps.deepseek.deepseek_v4_1_flash
-// carries them with their provenance); the candidate never digests the raw row list -- it consumes
-// the module's admission (exact shard cover, index reconciliation, role cover), so a defective
-// population is a REFUSED model source naming its defects -- not an obligation and never a
-// differently keyed one.
-// The canonical text is order-free (sorted by path), so a shard digest, a file size or a path
-// that changes changes the key and a reordering does not. The digest is taken through the
-// sha256sum realization; unavailable is a typed obligation, never a structural fallback.
-fn v41_weight_manifest_standing() -> V41ManifestStanding {
-  match deepseek_v4_1_flash_weight_manifest_standing() {
-    WeightManifestRefused { defects: d } => v41_manifest_refused(defects: map(d, x => join(["weight manifest: ", x as String], "") as NonEmptyStr), subject: "the weight manifest")
-    WeightManifestAdmitted { files: _, index: _, canonical_text: t } => v41_manifest_digest(text: t, subject: "the admitted weight manifest (48 shards at dba1be0a)")
-  }
-}
-
-fn v41_tokenizer_standing() -> V41ManifestStanding {
-  match deepseek_v4_1_flash_tokenizer_standing() {
-    TokenizerPopulationRefused { defects: d } => v41_manifest_refused(defects: map(d, x => join(["tokenizer population: ", x as String], "") as NonEmptyStr), subject: "the tokenizer population")
-    TokenizerPopulationAdmitted { files: _, canonical_text: t } => v41_manifest_digest(text: t, subject: "the admitted tokenizer population at dba1be0a")
-  }
-}
-
-fn v41_manifest_digest(text: String, subject: String) -> V41ManifestStanding {
-  match sha256sum_stdin_digest_via_shell(content: text) {
-    Sha256FileDigestUnavailable { path: _, reason: r } => V41ManifestUnestablished { obligation: join([subject, " could not be digested: ", r], "") as NonEmptyStr }
-    Sha256FileDigest { digest: d } =>
-      match sha256_hex_digest(hex: d.hex as String) {
-        Absent => V41ManifestUnestablished { obligation: join([subject, ": sha256sum did not answer a sha256 digest"], "") as NonEmptyStr }
-        Present { value: h } => V41ManifestObserved { digest: h }
-      }
-  }
-}
-
-// THE ROW-STORE ENCODING AXIS, KEYED BY THE ENCODED STORES (gunbc.spark.v41_engram_row_store
-// v41_row_store_encoding_key): the spec key and the sha256 of each of the eight (layer, rank) stores the
-// encoder produced -- the whole-file digests the file-backed patch checks on open, which are D1's
-// "row-store identities" -- admitted by v41_identify_row_store. The published spans are the encoder's
-// input and are joined to the span plan before a key is minted, but they do not key the axis.
-fn v41_row_store_encoding_standing() -> V41PublishedRowStoreKey {
-  v41_row_store_encoding_key(
-    partition: v41_candidate_partition,
-    sharded: deepseek_v4_1_flash_engram_sharded_entries,
-    shards: deepseek_v4_1_flash_engram_shard_files,
-    spans: v41_published_span_readings,
-    stores: v41_published_store_readings,
-    head_sizes: fn() { v41_live_head_sizes(tables: deepseek_v4_1_flash_engram) },
-  )
-}
-
-// THE LIVE READBACK over the live spec. An unread readback costs no bucket-layout search.
-fn v41_live_store_readback() -> V41StoreReadback {
-  match v41_published_store_readback_readings {
-    V41StoreReadbackReadingsUnread { obligation: o } => V41StoreReadbackUnread { obligation: o }
-    V41StoreReadbackRead { host: _, observed_at: _, readings: _ } =>
-      match v41_row_store_spec(population: map(deepseek_v4_1_flash_engram_sharded_entries, e => e.entry), partition: v41_candidate_partition, tables: deepseek_v4_1_flash_engram, head_sizes: v41_live_head_sizes(tables: deepseek_v4_1_flash_engram)) {
-        V41RowStoreSpecRefused { defects: d } => V41StoreReadbackRefused { defects: d }
-        V41RowStoreSpecAdmitted { spec: spec } => v41_store_readback(spec: spec, readings: v41_published_store_readback_readings)
-      }
-  }
-}
-
-fn v41_candidate() -> V41CandidateVerdict {
-  v41_candidate_standing(c: v41_candidate_inputs, readback: v41_live_store_readback())
-}
-
-data v41_engram_file_backed_overlay_path: NonEmptyStr = "dag/gunbc/spark/patches/d2d649e6/engram_file_backed.py.patch" as NonEmptyStr
-data v41_engram_storage_hook_path: NonEmptyStr = "dag/gunbc/spark/patches/d2d649e6/engram_storage_backed.patch" as NonEmptyStr
-
-fn v41_digest_declared_patch(path: NonEmptyStr) -> Sha256Digest? {
-  match sha256sum_file_digest_via_shell(path: path) {
-    Sha256FileDigestUnavailable { path: _, reason: _ } => none
-    Sha256FileDigest { digest: d } => sha256_hex_digest(hex: d.hex as String)
-  }
-}
-
-// V41PatchesObserved HERE MEANS THE PATCH FILES WERE DIGESTED, not that a launch serves Engram
-// file-backed. The overlay adds FileBackedEngramStorage and the design-B FileBackedLookup. The second
-// member binds them in engram.py: Engram._create_embedding builds FileBackedParallelEngramEmbedding
-// for every layer when the launch names a row-store manifest (GUNBC_ENGRAM_ROW_STORE_MANIFEST, derived
-// by gunbc.spark.v41_engram_store_manifest), with no pinned or DPShared table reachable; without a
-// manifest the image serves upstream's pinned storage.
-fn v41_storage_backed_patch_population() -> V41PatchPopulation {
-  match v41_digest_declared_patch(path: v41_engram_file_backed_overlay_path) {
-    Absent => V41PatchesUnestablished { obligation: "DigestFile could not read the file-backed overlay patch at dag/gunbc/spark/patches/d2d649e6/engram_file_backed.py.patch" as NonEmptyStr }
-    Present { value: overlay_digest } =>
-      match v41_engine_patch(path: v41_engram_file_backed_overlay_path, applies_to: vllm_d2d649e6_revision, sha256_hex: overlay_digest.hex as String, purpose: "file-backed Engram row-store overlay" as NonEmptyStr) {
-        Absent => V41PatchesUnestablished { obligation: "DigestFile of the overlay patch was not a sha256 digest" as NonEmptyStr }
-        Present { value: overlay } =>
-          match v41_digest_declared_patch(path: v41_engram_storage_hook_path) {
-            Absent => V41PatchesUnestablished { obligation: "DigestFile could not read the engram.py import member at dag/gunbc/spark/patches/d2d649e6/engram_storage_backed.patch" as NonEmptyStr }
-            Present { value: hook_digest } =>
-              match v41_engine_patch(path: v41_engram_storage_hook_path, applies_to: vllm_d2d649e6_revision, sha256_hex: hook_digest.hex as String, purpose: "binding of the file-backed overlay in engram.py: FileBackedParallelEngramEmbedding for every Engram layer when the launch names a row-store manifest" as NonEmptyStr) {
-                Absent => V41PatchesUnestablished { obligation: "DigestFile of the engram.py import member was not a sha256 digest" as NonEmptyStr }
-                Present { value: hook } => v41_with_sm120_members(engram: [overlay, hook])
-              }
-          }
-      }
-  }
-}
-
-// THE SM120 MEMBERS. The population is the image's whole patch list, applied in order, and these two
-// follow the Engram pair; neither touches a file the Engram members touch.
-//   1. The SWA cache's page size. vllm/models/deepseek_v4_1/attention.py constructs DeepseekV4SWACache
-//      with the literal block_size=32 (V4 passes the SWA cache's own default, 64). FlashInfer's SM120 DSv4
-//      decode kernel is instantiated for 64-token pages only (flashinfer.mla._sparse_mla_sm120
-//      _DECODE_DSV4_PAGE_BLOCK_SIZE) and every call with 64 or fewer query tokens must take it, with the
-//      SWA cache as its primary pool -- so on this tree every decode step is refused, whatever its topk.
-//      No engine argument reaches that literal. The member lifts it to a class attribute,
-//      swa_block_size, default 32, and DeepseekV4FlashInferSM120Attention sets 64: the other platform
-//      classes keep the page they had.
-//   2. The control. It creates vllm.models.deepseek_v4_1.nvidia.sm120_decode_shape_selftest, which takes a
-//      rank's own engine argv, builds the ModelConfig vLLM's serve parser derives from it, and calls
-//      FlashInfer's DSv4 entry point at every shape with 64 or fewer query tokens that rank reaches, every
-//      deciding figure read off the installed tree. Its consumer is the launch's pre-staging gate,
-//      gunbc.spark.v41_group_a_launch v41_sm120_gate, which runs it on each rank's host in the image
-//      over that rank's argv and stops the launch on anything short of SELFTEST PASS. The member applies
-//      alone to the unpatched tree, which is how its RED was taken (fleet-converge 36857198484: refused
-//      unpatched; refused at 1152 without the text-only request; passed with both).
-data v41_sm120_swa_page_patch_path: NonEmptyStr = "dag/gunbc/spark/patches/d2d649e6/sm120_swa_page_block_size.patch" as NonEmptyStr
-data v41_sm120_decode_selftest_patch_path: NonEmptyStr = "dag/gunbc/spark/patches/d2d649e6/sm120_decode_shape_selftest.patch" as NonEmptyStr
-
-fn v41_with_sm120_members(engram: List<V41EnginePatch>) -> V41PatchPopulation {
-  match v41_digest_declared_patch(path: v41_sm120_swa_page_patch_path) {
-    Absent => V41PatchesUnestablished { obligation: "DigestFile could not read the SM120 SWA page member at dag/gunbc/spark/patches/d2d649e6/sm120_swa_page_block_size.patch" as NonEmptyStr }
-    Present { value: page_digest } =>
-      match v41_engine_patch(path: v41_sm120_swa_page_patch_path, applies_to: vllm_d2d649e6_revision, sha256_hex: page_digest.hex as String, purpose: "SM120 SWA cache page of 64 tokens: DeepseekV4FlashInferSM120Attention.swa_block_size, the only page FlashInfer's SM120 DSv4 decode kernel takes" as NonEmptyStr) {
-        Absent => V41PatchesUnestablished { obligation: "DigestFile of the SM120 SWA page member was not a sha256 digest" as NonEmptyStr }
-        Present { value: page } =>
-          match v41_digest_declared_patch(path: v41_sm120_decode_selftest_patch_path) {
-            Absent => V41PatchesUnestablished { obligation: "DigestFile could not read the SM120 decode-shape self-test member at dag/gunbc/spark/patches/d2d649e6/sm120_decode_shape_selftest.patch" as NonEmptyStr }
-            Present { value: test_digest } =>
-              match v41_engine_patch(path: v41_sm120_decode_selftest_patch_path, applies_to: vllm_d2d649e6_revision, sha256_hex: test_digest.hex as String, purpose: "SM120 decode-shape self-test: FlashInfer's DSv4 entry point at the TP4 launch's decode and short-prefill shapes" as NonEmptyStr) {
-                Absent => V41PatchesUnestablished { obligation: "DigestFile of the SM120 self-test member was not a sha256 digest" as NonEmptyStr }
-                Present { value: control } => v41_with_sm120_kernel_page_members(applied: concat(engram, [page, control]))
-              }
-          }
-      }
-  }
-}
-
-// THE TWO MEMBERS THE GB10 INDEXER NEEDS, after the SM120 pair (neither touches a file those touch
-// except flashinfer_sparse.py, whose hunk sits apart from the SWA member's):
-//   3. 64-token kernel pages on SM12x for the V4.1 sparse-MLA, FlashInfer sparse-MLA and indexer
-//      backends -- vllm-project/vllm#57292 adapted to this tree. Without it the cache page is 128 tokens,
-//      a ratio-1 indexer page holds 128 states, and DeepGEMM's SM120 paged-MQA metadata asserts
-//      `block_kv == 32 or block_kv == 64` (fleet-converge run 36921450575, on every rank, in
-//      DeepseekV32IndexerMetadataBuilder.build during CUDA-graph capture). With it a ratio-1 page holds
-//      64 states and a ratio-2 page 32 -- and the ratio-2 layer's 32-token extra page needs:
-//   4. FlashInfer 0.7.1rc1 for flashinfer-python and flashinfer-cubin in requirements/cuda.txt, the
-//      release carrying flashinfer-ai/flashinfer#5197 (runtime SM120 page sizes).
-data v41_sm120_kernel_page_patch_path: NonEmptyStr = "dag/gunbc/spark/patches/d2d649e6/sm120_64_token_kernel_pages.patch" as NonEmptyStr
-data v41_flashinfer_requirements_patch_path: NonEmptyStr = "dag/gunbc/spark/patches/d2d649e6/flashinfer_0_7_1rc1_requirements.patch" as NonEmptyStr
-
-fn v41_with_sm120_kernel_page_members(applied: List<V41EnginePatch>) -> V41PatchPopulation {
-  match v41_digest_declared_patch(path: v41_sm120_kernel_page_patch_path) {
-    Absent => V41PatchesUnestablished { obligation: "DigestFile could not read the SM120 kernel-page member at dag/gunbc/spark/patches/d2d649e6/sm120_64_token_kernel_pages.patch" as NonEmptyStr }
-    Present { value: kp_digest } =>
-      match v41_engine_patch(path: v41_sm120_kernel_page_patch_path, applies_to: vllm_d2d649e6_revision, sha256_hex: kp_digest.hex as String, purpose: "SM12x 64-token kernel pages for the V4.1 sparse-MLA, FlashInfer sparse-MLA and indexer backends (vllm-project/vllm#57292), so a ratio-1 indexer page holds 64 states and DeepGEMM's SM120 paged-MQA admits it" as NonEmptyStr) {
-        Absent => V41PatchesUnestablished { obligation: "DigestFile of the SM120 kernel-page member was not a sha256 digest" as NonEmptyStr }
-        Present { value: kernel_pages } =>
-          match v41_digest_declared_patch(path: v41_flashinfer_requirements_patch_path) {
-            Absent => V41PatchesUnestablished { obligation: "DigestFile could not read the FlashInfer requirements member at dag/gunbc/spark/patches/d2d649e6/flashinfer_0_7_1rc1_requirements.patch" as NonEmptyStr }
-            Present { value: rq_digest } =>
-              match v41_engine_patch(path: v41_flashinfer_requirements_patch_path, applies_to: vllm_d2d649e6_revision, sha256_hex: rq_digest.hex as String, purpose: "FlashInfer 0.7.1rc1 for flashinfer-python and flashinfer-cubin (flashinfer-ai/flashinfer#5197: runtime SM120 sparse-MLA page sizes, including the 32-token pages of V4.1 ratio-2 layers)" as NonEmptyStr) {
-                Absent => V41PatchesUnestablished { obligation: "DigestFile of the FlashInfer requirements member was not a sha256 digest" as NonEmptyStr }
-                Present { value: requirements } => v41_with_deepgemm_page32_member(applied: concat(applied, [kernel_pages, requirements]))
-              }
-          }
-      }
-  }
-}
-
-//   5. DeepGEMM's SM120 FP8 paged-MQA logits at 32-state pages. With 64-token kernel pages a ratio-2
-//      indexer page holds 32 states, and the image's DeepGEMM (deepseek-ai/DeepGEMM nv_dev 8b1392b, the
-//      d2d649e6 pin) admits only 64 for an FP8 cache on SM12x: fleet-converge run 36945738911 asserted
-//      `(arch_major == 12 and ((is_fp4 and (block_kv == 32 or block_kv == 64)) or (not is_fp4 and
-//      block_kv == 64)))` in fp8_fp4_paged_mqa_logits on every rank, after the metadata call member 3
-//      fixed had passed. vllm-project/DeepGEMM#14 (merged 2026-09-22, 17ca18f73e) relaxes exactly that
-//      host check and the launcher's, keeping the device kernel; this pin's kernel is templated on
-//      BLOCK_KV with FP8_MMA_M = 16, so 32 rows is 2 warps x 4 groups = SPLIT_KV 128. The fork's newer
-//      pin (vllm#59385, 6901431) is diverged from 8b1392b (17 ahead, 95 behind), so the member carries
-//      #14's two host hunks ported to 8b1392b and has deepgemm.cmake apply them after FetchContent --
-//      idempotent, and a tree it cannot apply to stops the build.
-data v41_deepgemm_page32_patch_path: NonEmptyStr = "dag/gunbc/spark/patches/d2d649e6/deepgemm_sm120_fp8_page32.patch" as NonEmptyStr
-
-fn v41_with_deepgemm_page32_member(applied: List<V41EnginePatch>) -> V41PatchPopulation {
-  match v41_digest_declared_patch(path: v41_deepgemm_page32_patch_path) {
-    Absent => V41PatchesUnestablished { obligation: "DigestFile could not read the DeepGEMM page32 member at dag/gunbc/spark/patches/d2d649e6/deepgemm_sm120_fp8_page32.patch" as NonEmptyStr }
-    Present { value: dg_digest } =>
-      match v41_engine_patch(path: v41_deepgemm_page32_patch_path, applies_to: vllm_d2d649e6_revision, sha256_hex: dg_digest.hex as String, purpose: "DeepGEMM SM120 FP8 paged-MQA logits at 32-state pages (vllm-project/DeepGEMM#14 host changes ported to 8b1392b), applied by deepgemm.cmake after fetch" as NonEmptyStr) {
-        Absent => V41PatchesUnestablished { obligation: "DigestFile of the DeepGEMM page32 member was not a sha256 digest" as NonEmptyStr }
-        Present { value: deepgemm } => V41PatchesObserved { patches: concat(applied, [deepgemm]), partition: PartitionByLaunchConfiguration }
-      }
-  }
-}
-
-fn v41_storage_patch_application_standing() -> V41PatchApplicationStanding {
-  v41_patch_application_standing(source: v41_candidate_recipe().source, patches: v41_storage_backed_patch_population())
-}
diff --git a/dag/gunbc/spark/v41_runtime_image_converge.dag b/dag/gunbc/spark/v41_runtime_image_converge.dag
deleted file mode 100644
index 0975fb2fd13..00000000000
--- a/dag/gunbc/spark/v41_runtime_image_converge.dag
+++ /dev/null
@@ -1,502 +0,0 @@
-module gunbc.spark.v41_runtime_image_converge
-
-import extdeps.crypto.hash { digest_shell_verify_line, sha256_digest }
-import std.types { String, Bool, List, NonEmptyStr, FilePath }
-
-import std.optional { Present, Absent }
-
-import extdeps.container.oci.digest { OciContentDigest, OciSha256Digest, parse_oci_content_digest_wire, render_oci_content_digest_wire }
-import std.content_hash { Sha256Digest, Sha256DigestHex }
-import std.measure { Second, second }
-import product.host_identity { HostIdentity, host_identity_eq }
-import gunbc.spark.host_effect_quiescence { HostEffectResidueSpec }
-import extdeps.exec.command { argv_words }
-import extdeps.flashinfer.flashinfer { FlashInferWheel, flashinfer_0_7_1rc1_wheel_url }
-import extdeps.posix.sh_invocation { posix_sh_script_command }
-import extdeps.tools.mkdir { mkdir_parents_command_at, mkdir_path_resolved_program }
-
-import gunbc.file_access { FileTreeScope }
-import gunbc.host_effect { FleetSsh }
-import gunbc.remote_operation { RemoteArgv, RemoteFileBytes, PlannedRemoteStep }
-import gunbc.typed_remote_file_write { typed_remote_file_write_seal, TypedRemoteFileWriteAdmitted, TypedRemoteFileWriteAdmissionRefused, RemoteFileModeOwnerReadWrite }
-import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext, SshTarget }
-
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
-
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext }
-import gunbc.spark.group_image_produce { GroupImageProduction, ProducedImageHeld }
-import gunbc.spark.remote_step_sequence { run_remote_step_sequence, remote_step_sequence_failed, remote_step_failure_causes_wire }
-import gunbc.spark.vllm_runtime_image_build { VllmImageBuild, VllmImageBuilt, VllmImageBuildRefused, SparkBuildHostWork, vllm_build_root, vllm_image_receipt_line, VllmImageDistributionSubject }
-import gunbc.spark.vllm_image_identity { vllm_image_tag_for_key }
-import gunbc.spark.v41_source_patch_converge { V41PatchedImageBuilt, V41PatchedImageRefused, converge_vllm_runtime_image_with_patches, V41ObservedSourceIdentity, v41_observed_source_identity_of, v41_patched_image_build_key }
-import gunbc.spark.v41_runtime_candidate { V41PatchesObserved, V41PatchesAbsentByObservation, V41PatchesUnestablished, v41_candidate_inputs, v41_candidate_recipe, v41_candidate_partition, v41_storage_backed_patch_population }
-import gunbc.spark.v41_runtime_realized { V41ProducedRuntimeStanding, v41_produced_runtime_image, v41_admit_produced_runtime, v41_produced_runtime_line, v41_runtime_was_produced }
-import gunbc.spark.v41_runtime_image_probe { V41ProbeOutcome, V41ProbeRead, V41ProbeRefused, v41_probe_image_in_place, v41_probe_body, v41_probe_all_present }
-
-// ── PRODUCING THE V4.1 IMAGE, AND WHY THAT IS A DIFFERENT ROOT FROM KEYING IT ──────────────────
-//
-// WHAT THIS MODULE IS FOR. gunbc.spark.v41_runtime_candidate fixes WHAT the DeepSeek V4.1 runtime
-// is -- a vLLM recipe at d2d649e6 with the fleet's 12.1 arch list, three digest-pinned FlashInfer
-// wheels, and the two storage-backed Engram patches -- and nothing in the corpus has ever turned
-// that specification into bytes. docs/plans/dsv41-cut-d-redesign.md D1 states the consequence
-// precisely: the authorization for an experiment names "the PRODUCED runtime image digest", and
-// candidate identity is not authorization. This module is the production, and the produced digest
-// it reads back is admitted against the candidate's own recipe rather than trusted.
-//
-// IT IS A FLEET-CONVERGE MODE AND NOT A CLI ENTRY, for the reason the probe beside it is one:
-// docker's socket on a Spark is root-owned and the managed executor is in no docker group, so the
-// only modeled route to that daemon is the Spark administrator credential, which is materialized
-// inside the fleet job's boundary and cannot be held by an authoring session. That is also why this
-// is not a shell somebody runs: DESIGN section 6 names a hand-authored deployment script as
-// out-of-band actuation, and a fleet mutation here is a dispatch of a modeled mode.
-//
-// FOUR LEGS, IN THIS ORDER, AND EACH ONE IS A PRECONDITION OF THE NEXT:
-//   1. verify the three kernel wheels against the digests the candidate keys;
-//   2. converge the patched source tree and build from it (gunbc.spark.v41_source_patch_converge
-//      owns both -- this module chooses neither the revision nor the patch population);
-//   3. read the produced image's capabilities back from INSIDE its own digest, through the probe
-//      route, because a build that exits zero has reported on itself;
-//   4. admit the produced digest against the candidate as a PRODUCED runtime artifact.
-// A refusal at any leg stops the line and names the leg. Nothing widens.
-
-// ── LEG 1: THE WHEELS THE KEY NAMES ARE THE WHEELS UPSTREAM PUBLISHES ─────────────────────────
-//
-// WHAT THIS ESTABLISHES, STATED AT ITS REAL STRENGTH RATHER THAN AT THE STRENGTH ITS NAME SUGGESTS.
-// Each of the three wheels is fetched from the release the acquisition cites and compared to the
-// sha256 gunbc.spark.v41_runtime_candidate folds into the runtime key. What that discriminates is
-// UPSTREAM DRIFT: a wheel re-published at a different digest, a release asset replaced, a filename
-// that now resolves to other bytes. It runs before the build because the answer changes whether the
-// build should start at all, and a seventy-five-minute compile is an expensive place to learn it.
-//
-// WHAT IT DOES NOT ESTABLISH, AND THIS IS NOT A HEDGE. Upstream's own Dockerfile pip-installs
-// flashinfer from the project index during the build, so these verified files are not, by this
-// leg alone, the bytes the image ends up carrying. Calling this "the image installs the keyed
-// wheels" would be exactly the fabricated-plausible-output failure DESIGN section 5 forbids -- a
-// green check standing for a claim it cannot make.
-//
-// DECLARED FRONTIER -- the binding leg. What closes it is reading the installed distributions back
-// from inside the produced image and comparing them to this population, which is a capability the
-// probe route already has the shape for (it runs python3 inside the image's own digest) and does
-// not yet ask for. Its trigger is that readback existing and refusing, not this file changing.
-fn v41_kernel_wheels() -> List<FlashInferWheel> {
-  v41_candidate_inputs.runtime.kernel_wheels
-}
-
-fn v41_wheel_verify_dir() -> NonEmptyStr {
-  join([vllm_build_root() as String, "/declared-wheels"], "") as NonEmptyStr
-}
-
-// feature:remote-shell-body-emission -- dissolve-on: the same bounded-remote-operation-sequence
-// capability named at gunbc.spark.vllm_runtime_image_build glm53_derived_prepare_script and at
-// gunbc.spark.native_serving_apply's stage scripts. A per-member fetch, a pipe into `sha256sum -c -`
-// and `set -e` as the failure discipline have no carrier to be projected from, in any of the three.
-// This is one class under one trigger, not a fourth debt: modelling it here alone would fork the
-// others on how a remote step is expressed.
-//
-// THE SCRIPT IS FILE CONTENT, NOT AN ARGV WORD, for the reason the GLM prepare script records: the
-// portable-word wall at gunbc.fleet_known_hosts_anchor refuses a word carrying pipes, and the
-// jit-cache wheel's filename alone carries a `+` the allowlist does not admit. It travels as a
-// typed_remote_file_write payload and the only argv is `sh <path>`.
-fn v41_wheel_verify_script(wheels: List<FlashInferWheel>) -> String {
-  let dir = v41_wheel_verify_dir() as String
-  join([
-    "set -e\n",
-    fold(wheels, init: "", f: (acc, w) => join([
-      acc,
-      "curl -fsSL -o ", dir, "/", w.filename as String, " ", flashinfer_0_7_1rc1_wheel_url(w: w) as String, "\n",
-      digest_shell_verify_line(digest: sha256_digest(hex: w.sha256.hex as String as NonEmptyStr), file_path: join([dir, "/", w.filename as String], "") as NonEmptyStr), "\n",
-    ], "")),
-  ], "")
-}
-
-fn v41_wheel_verify_script_path() -> NonEmptyStr {
-  join([v41_wheel_verify_dir() as String, "/verify-wheels.sh"], "") as NonEmptyStr
-}
-
-fn v41_wheel_verify_steps() -> List<PlannedRemoteStep>? {
-  match typed_remote_file_write_seal(
-    path: v41_wheel_verify_script_path() as FilePath,
-    content: v41_wheel_verify_script(wheels: v41_kernel_wheels()),
-    allowed_scope: FileTreeScope { root_path: v41_wheel_verify_dir() },
-  ) {
-    TypedRemoteFileWriteAdmissionRefused { cause: _ } => none
-    TypedRemoteFileWriteAdmitted { write: script } => Present {
-      value: [
-        PlannedRemoteStep {
-          identity: "declared-wheels-dir" as NonEmptyStr,
-          operation: RemoteArgv {
-            argv: argv_words(command: mkdir_parents_command_at(
-              mkdir_binary: mkdir_path_resolved_program,
-              path: v41_wheel_verify_dir() as String,
-            )),
-          },
-        },
-        PlannedRemoteStep {
-          identity: "declared-wheels-script" as NonEmptyStr,
-          operation: RemoteFileBytes { write: script, mode: RemoteFileModeOwnerReadWrite },
-        },
-        PlannedRemoteStep {
-          identity: "declared-wheels-verify" as NonEmptyStr,
-          operation: RemoteArgv { argv: argv_words(command: posix_sh_script_command(path: v41_wheel_verify_script_path())) },
-        },
-      ],
-    }
-  }
-}
-
-// AN EMPTY POPULATION IS ITS OWN ARM, because a fold over zero wheels reports "every wheel verified"
-// with no evidence behind it -- the widening DESIGN section 5 names, in the one place it would be
-// invisible. The candidate refuses an incomplete kernel closure at keying time, so this arm should be
-// unreachable from the live row; it refuses rather than relying on that.
-type V41KernelWheelVerification
-  = V41KernelWheelsVerified { verified: Int }
-  | V41KernelWheelVerificationRefused { step: NonEmptyStr, cause: String }
-
-fn verify_v41_kernel_wheels(target: SshTarget, context: FleetSshExecutionContext) -> V41KernelWheelVerification
-{
-  if length(v41_kernel_wheels()) == 0 {
-    V41KernelWheelVerificationRefused {
-      step: "declared-wheels-population" as NonEmptyStr,
-      cause: "the candidate names no kernel wheels, so verifying them establishes nothing",
-    }
-  } else {
-    match v41_wheel_verify_steps() {
-      Absent => V41KernelWheelVerificationRefused {
-        step: "declared-wheels-seal" as NonEmptyStr,
-        cause: "the wheel verification payload did not seal against the declared-wheels scope",
-      }
-      Present { value: steps } => {
-        let standings = run_remote_step_sequence(steps: steps, transport: FleetSsh { target: target, context: context })
-        if remote_step_sequence_failed(standings: standings) {
-          V41KernelWheelVerificationRefused {
-            step: "declared-wheels-verify" as NonEmptyStr,
-            cause: remote_step_failure_causes_wire(standings: standings),
-          }
-        } else {
-          V41KernelWheelsVerified { verified: length(v41_kernel_wheels()) }
-        }
-      }
-    }
-  }
-}
-
-fn v41_wheel_verification_line(v: V41KernelWheelVerification) -> String {
-  match v {
-    V41KernelWheelsVerified { verified: n } =>
-      join(["kernel wheels verified=", to_string(n), " against the digests this candidate keys\n"], "")
-    V41KernelWheelVerificationRefused { step: st, cause: why } =>
-      join(["kernel wheels REFUSED step=", st as String, " cause=", why, "\n"], "")
-  }
-}
-
-// ── THE WHOLE PRODUCTION, AS ONE FOLD ─────────────────────────────────────────────────────────
-//
-// THE PROBE IS NOT DECORATION AND IT IS NOT THE ADMISSION EITHER. A build that exits zero has
-// reported on itself; the probe asks the produced bytes, from inside their own configuration digest,
-// whether they register DeepseekV41ForCausalLM on sm_121 and admit the layouts this candidate needs.
-// A produced image that does not is a produced image, honestly keyed, that cannot serve -- so the
-// standing is minted either way and the ENTRY's exit is what the capability reading decides. Folding
-// the capability verdict into the produced standing would make "was this built from the candidate's
-// inputs" and "does it work" one answer, and they are two.
-// ── THE PROBE MUST DESCRIBE THE IMAGE THE STANDING KEYS ───────────────────────────────────────
-//
-// THE IDENTITY BREAK THIS CLOSES. The produced-runtime standing keys ONE image by its configuration
-// digest. The capability probe used to be handed `identity.tag`, and a tag is a MUTABLE POINTER: a
-// concurrent build, a pull, or a retag between the build leg and the probe leg re-resolves that tag
-// to different bytes. The two halves of the receipt would then be about different images -- the
-// standing keying the digest this build produced, the capability readings describing whatever the
-// tag pointed at when the probe ran -- and the entry would exit ZERO on the conjunction of them,
-// because each half is individually true. That is the fabricated-plausible-output failure DESIGN
-// section 5 forbids, assembled from two honest readings.
-//
-// TWO MOVES, AND THEY ARE NOT THE SAME MOVE. First, CONSTRUCTION: the probe is handed the produced
-// configuration digest rather than the tag, so there is no mutable pointer left in the route and a
-// tag that moves cannot redirect the readback at all. Second, the OBSERVATION JOIN below, which is
-// not redundant with it: what the daemon answers for `.Id` is external reality (DESIGN section 4b's
-// outside-the-modeled-guarantee column), read at a declared boundary, so the identity it reports
-// back is compared to the digest we asked about and a disagreement REFUSES rather than being
-// assumed away. The comparison is over CANONICAL RENDERINGS of parsed digests, not raw strings, so
-// a differently-spelled but equal digest is equal and an unparseable one is its own refusal.
-type V41ProbeIdentityJoin
-  = V41ProbeJoinedToProducedImage { digest: NonEmptyStr }
-  | V41ProbeDescribesAnotherImage { produced: NonEmptyStr, observed: NonEmptyStr }
-  | V41ProbeIdentityUnreadable { observed: NonEmptyStr }
-  | V41ProbeIdentityNotRead { step: NonEmptyStr, cause: String }
-
-fn v41_probe_identity_join(produced: OciContentDigest, o: V41ProbeOutcome) -> V41ProbeIdentityJoin {
-  match o {
-    V41ProbeRefused { step: st, cause: why } => V41ProbeIdentityNotRead { step: st, cause: why }
-    V41ProbeRead { reference: _, observed_config_id: observed, stdout: _, readings: _ } =>
-      match parse_oci_content_digest_wire(raw: observed as String) {
-        Absent => V41ProbeIdentityUnreadable { observed: observed }
-        Present { value: seen } =>
-          if render_oci_content_digest_wire(d: seen) == render_oci_content_digest_wire(d: produced) {
-            V41ProbeJoinedToProducedImage { digest: render_oci_content_digest_wire(d: produced) as NonEmptyStr }
-          } else {
-            V41ProbeDescribesAnotherImage {
-              produced: render_oci_content_digest_wire(d: produced) as NonEmptyStr,
-              observed: render_oci_content_digest_wire(d: seen) as NonEmptyStr,
-            }
-          }
-      }
-  }
-}
-
-fn v41_probe_identity_holds(j: V41ProbeIdentityJoin) -> Bool {
-  match j {
-    V41ProbeJoinedToProducedImage { digest: _ } => true
-    V41ProbeDescribesAnotherImage { produced: _, observed: _ } => false
-    V41ProbeIdentityUnreadable { observed: _ } => false
-    V41ProbeIdentityNotRead { step: _, cause: _ } => false
-  }
-}
-
-fn v41_probe_identity_line(j: V41ProbeIdentityJoin) -> String {
-  match j {
-    V41ProbeJoinedToProducedImage { digest: d } =>
-      join(["probe identity JOINED to the produced image ", d as String, "\n"], "")
-    V41ProbeDescribesAnotherImage { produced: p, observed: obs } =>
-      join(["probe identity BROKEN: this build produced ", p as String, " but the probe read ", obs as String, "; the capability readings describe a different image than the standing keys\n"], "")
-    V41ProbeIdentityUnreadable { observed: obs } =>
-      join(["probe identity UNREADABLE: the daemon answered ", obs as String, " for the probed image, which is not an OCI content digest\n"], "")
-    V41ProbeIdentityNotRead { step: st, cause: why } =>
-      join(["probe identity NOT READ: the probe refused at ", st as String, " (", why, "), so nothing joins the readings to the produced image\n"], "")
-  }
-}
-
-type V41ProducedRuntime
-  = V41RuntimeProductionComplete {
-      standing: V41ProducedRuntimeStanding
-      probe: V41ProbeOutcome
-      identity: V41ProbeIdentityJoin
-      wheels: V41KernelWheelVerification
-      build: VllmImageBuild
-    }
-  | V41RuntimeProductionStopped { step: NonEmptyStr, cause: String, wheels: V41KernelWheelVerification }
-
-// THE PROBE IS HANDED THE PRODUCED DIGEST, NOT THE TAG (converge_v41_produced_runtime_image): no
-// mutable pointer survives in the readback route, so a tag that moves between the build and the probe
-// cannot redirect what gets described. The V41ProbeIdentityJoin then checks the daemon's own answer,
-// which is the part construction cannot reach.
-fn converge_v41_produced_runtime_image(
-  target: SshTarget,
-  context: FleetSshExecutionContext,
-  ctx: SparkMaterializeContext,
-) -> V41ProducedRuntime
-{
-  match v41_storage_backed_patch_population() {
-    V41PatchesAbsentByObservation => V41RuntimeProductionStopped {
-      step: "patch-population" as NonEmptyStr,
-      cause: "the storage-backed patch population reads as absent by observation, which is the vanilla tree and not this candidate's runtime",
-      wheels: V41KernelWheelVerificationRefused { step: "not-reached" as NonEmptyStr, cause: "the patch population did not resolve, so no wheel was fetched" },
-    }
-    V41PatchesUnestablished { obligation: o } => V41RuntimeProductionStopped {
-      step: "patch-population" as NonEmptyStr,
-      cause: o as String,
-      wheels: V41KernelWheelVerificationRefused { step: "not-reached" as NonEmptyStr, cause: "the patch population did not resolve, so no wheel was fetched" },
-    }
-    V41PatchesObserved { patches: ps, partition: _ } => {
-      let wheels = verify_v41_kernel_wheels(target: target, context: context)
-      match wheels {
-        V41KernelWheelVerificationRefused { step: st, cause: why } =>
-          V41RuntimeProductionStopped { step: st, cause: why, wheels: wheels }
-        V41KernelWheelsVerified { verified: _ } =>
-          match converge_vllm_runtime_image_with_patches(target: target, context: context, ctx: ctx, r: v41_candidate_recipe(), patches: ps) {
-            V41PatchedImageRefused { step: st, cause: why } =>
-              V41RuntimeProductionStopped { step: st, cause: why, wheels: wheels }
-            V41PatchedImageBuilt { build: build, observed: observed } =>
-              match build {
-                VllmImageBuildRefused { step: st, cause: why } =>
-                  V41RuntimeProductionStopped { step: st, cause: why, wheels: wheels }
-                VllmImageBuilt { identity: identity, already_present: _ } =>
-                  match parse_oci_content_digest_wire(raw: identity.local_config_digest as String) {
-                    Absent => V41RuntimeProductionStopped {
-                      step: "image-readback" as NonEmptyStr,
-                      cause: join(["the daemon answered ", identity.local_config_digest as String, " for the produced image, which is not an OCI content digest"], ""),
-                      wheels: wheels,
-                    }
-                    Present { value: config_digest } => {
-                      let probe = v41_probe_image_in_place(ctx: ctx, reference: identity.local_config_digest)
-                      V41RuntimeProductionComplete {
-                        standing: v41_admit_produced_runtime(
-                          inputs: v41_candidate_inputs.runtime,
-                          partition: v41_candidate_partition,
-                          image: v41_produced_runtime_image(
-                            tag: identity.tag,
-                            local_config_digest: config_digest,
-                            build_key: identity.build_key,
-                            observed: observed,
-                            provenance: identity.provenance,
-                          ),
-                        ),
-                        probe: probe,
-                        identity: v41_probe_identity_join(produced: config_digest, o: probe),
-                        wheels: wheels,
-                        build: build,
-                      }
-                    }
-                  }
-              }
-          }
-      }
-    }
-  }
-}
-
-fn v41_production_receipt(p: V41ProducedRuntime) -> String {
-  match p {
-    V41RuntimeProductionStopped { step: st, cause: why, wheels: w } =>
-      join([v41_wheel_verification_line(v: w), "production STOPPED step=", st as String, " cause=", why, "\n"], "")
-    V41RuntimeProductionComplete { standing: s, probe: probe, identity: j, wheels: w, build: build } =>
-      join([
-        v41_wheel_verification_line(v: w),
-        vllm_image_receipt_line(b: build),
-        v41_produced_runtime_line(s: s),
-        v41_probe_identity_line(j: j),
-        v41_probe_body(o: probe),
-      ], "")
-  }
-}
-
-// THE FOUR THINGS THAT MUST ALL HOLD, and they are conjoined here rather than at the exit so the
-// receipt and the verdict cannot disagree: the wheels verified, the produced digest was admitted
-// against the candidate, THE PROBE DESCRIBED THE IMAGE THE STANDING KEYS, and the produced bytes
-// carry every capability the probe asks for.
-//
-// THE THIRD CONJUNCT IS THE ONE THAT WAS MISSING, and its absence is why the other three could all
-// be true of a run that established nothing: capability readings taken from a tag that moved are
-// honest readings of the wrong image, and conjoining them with a standing that keys the right one
-// produces a green over two facts about two different images.
-fn v41_production_succeeded(p: V41ProducedRuntime) -> Bool {
-  match p {
-    V41RuntimeProductionStopped { step: _, cause: _, wheels: _ } => false
-    V41RuntimeProductionComplete { standing: s, probe: probe, identity: j, wheels: _, build: _ } =>
-      v41_runtime_was_produced(s: s) && v41_probe_identity_holds(j: j) && v41_probe_all_present(o: probe)
-  }
-}
-
-// ── THE MODE ENTRY ────────────────────────────────────────────────────────────────────────────
-//
-// OBSERVE-ONLY IS A REFUSAL HERE, the same as for the probe and the vanilla build: an unset target
-// means "every enrolled Spark", and this mode occupies ONE host for hours. It refuses rather than
-// choosing one.
-//
-// THE HOST CLAIM IS THE BUILD'S, NOT THE PROBE'S. The term, the purpose and the residue come from
-// gunbc.spark.vllm_runtime_image_build, because what this mode does to a host is a vLLM source build
-// -- three hours before an unreleased claim reads OVERDUE, and the source directory on the command
-// line of every leg as the residue a crashed lane leaves.
-//
-// THE ADMISSION IS THE GROUP A PAIR SUBJECT HOLDING THE HOST, NOT THE UNPLACED RELATION, and that
-// is a correction to what #12008 landed. `admit_unplaced_host_live` answers "is this host spoken
-// for by nobody"; `spark_unplaced_hosts` is EMPTY and srv5-srv8 are members of FabricGroupA, which
-// gunbc.spark.pair_serving_desired claims -- so the unplaced seam REFUSES every host this mode can
-// legitimately run on, and that refusal is not an obstacle to route around: it is the authority
-// relation docs/plans/dsv41-cut-d-redesign.md protects, and a build admitted through it would have
-// asserted that a committed Group A host is unclaimed. What this mode actually needs is the weaker
-// and true relation -- the host is one the Group A pair subject HOLDS -- which is
-// gunbc.spark.host_commitment `admit_host_held_by_subject`, the same seam
-// gunbc.spark.v41_checkpoint_materialize admits by (proud-deer-538 ruling, 2026-09-21). A source
-// build is bytes at rest plus a compiler; the plan admits that on Group A before displacement.
-//
-// AND IT STILL CLAIMS THE HOST, WHICH THE CHECKPOINT MODE DOES NOT. A three-hour source build must
-// not run concurrently with another three-hour source build on the same box, so the host-effect
-// claim is not optional here the way it is for a file transfer. That is why `claim_host_effect_live`
-// exists beside the admission rather than fused into it: this mode admits by one relation and
-// claims by the seam that only claims. Concurrency at the workflow layer is Group A's arm domain in
-// gunbc.fleet_converge_workflow, so a dispatch also queues behind D0 and the pair-serving apply.
-data v41_production_attempt_raw: String = "v41-runtime-image-produce"
-
-// THE V4.1 IMAGE AS ONE PRODUCTION OF THE ONE ENTRY (gunbc.spark.group_image_produce, deforking cut 8c).
-fn v41_runtime_image_production() -> GroupImageProduction {
-  GroupImageProduction {
-    title: "v41 runtime image produce" as NonEmptyStr,
-    group: FabricGroupA,
-    attempt_raw: v41_production_attempt_raw,
-    identity_file_name: "gunbc-v41-runtime-image-produce-admin-password" as NonEmptyStr,
-    produce: fn(target, context, ctx) {
-      let produced = converge_v41_produced_runtime_image(target: target, context: context, ctx: ctx)
-      SparkBuildHostWork { receipt: v41_production_receipt(p: produced), converged: v41_production_succeeded(p: produced) }
-    },
-  }
-}
-
-// ── DISTRIBUTION: THE PRODUCED IMAGE ON ANOTHER GROUP A HOST ──────────────────────────────────
-//
-// WHY A SECOND HOST NEEDS THESE BYTES AND NOT A SECOND BUILD. The produced image is one content
-// address; a rebuild on another host is a new build whose digest nobody has admitted, and V4.1
-// serving and the Engram differential both have to run in THE image the production admitted. The
-// row stores the differential reads live on srv5, the image was produced on srv8, and serving
-// later needs it on all four Group A hosts -- so the image moves, by the one transport the fleet
-// models for images (gunbc.spark.vllm_runtime_image_build distribute_vllm_image: save into the
-// source's fabric blob root, pull over the fabric rail, load, readback), and this entry supplies what that fold needs and nothing else.
-//
-// THE SUBJECT IS THE PRODUCTION RECEIPT, NOT A TAG. What the production run established is a
-// configuration digest on a host, and that is the whole identity this row carries: the observed
-// source tree the build read (from which the canonical tag is DERIVED here, through the same key
-// fold the build used, rather than transcribed -- so a row whose tree does not re-derive the tag
-// the build printed cannot exist silently), the digest the daemon answered, and the host that
-// answered it. Transcribed from fleet-converge run 36207135528 (spark_v41_runtime_image_build on
-// srv8, 2026-09-26), whose receipt reads: produced runtime tag=gunbc-vllm-dsv41-gb10:d73e307009a5d716
-// config_digest=sha256:ea39410ed01d396caad86339d877c1adb181a983baadffd22c722069109ea664
-// source_head=d2d649e674c75425d2d6975c87eb89fd4d55fff8
-// worktree_diff_sha256=79ee43471662502d1ae0ddff9723b5d17599b036725d17b45fc5909679b7ece7, and
-// "probe identity JOINED to the produced image" at the same digest.
-//
-// A HELD RECEIPT IS NOT A PRODUCED STANDING. gunbc.spark.v41_runtime_realized V41ProducedRuntimeImage
-// is sole_constructor so only a real build leg mints one, and this row does not pretend to: it
-// names bytes to move, and the source's readback -- not this row -- is what establishes the bytes
-// are still there under that digest when the move runs.
-type V41ProducedImageHeld {
-  observed: V41ObservedSourceIdentity
-  config: OciContentDigest
-  held_on: HostIdentity
-  receipt_run: NonEmptyStr
-}
-
-data v41_arm_a_produced_image: V41ProducedImageHeld = V41ProducedImageHeld {
-  observed: v41_observed_source_identity_of(
-    revision_head: "d2d649e674c75425d2d6975c87eb89fd4d55fff8" as NonEmptyStr,
-    worktree_diff_sha256: Sha256Digest { hex: "79ee43471662502d1ae0ddff9723b5d17599b036725d17b45fc5909679b7ece7" as Sha256DigestHex },
-  ),
-  config: OciSha256Digest(Sha256Digest { hex: "ea39410ed01d396caad86339d877c1adb181a983baadffd22c722069109ea664" as Sha256DigestHex }),
-  held_on: "srv8" as HostIdentity,
-  receipt_run: "36207135528" as NonEmptyStr,
-}
-
-// THE PRODUCTION V4.1 IMAGE: fleet-converge run 36327364664 (spark_v41_runtime_image_build on srv8,
-// from main with the design-B cutover's patch set, #12359), whose receipt reads: produced runtime
-// tag=gunbc-vllm-dsv41-gb10:3cedb66f0ec0869e
-// config_digest=sha256:5de3c35577e5c8f3026c143d3d5b2d66cc527119281369f4651d969f581829d3
-// build_key=3cedb66f0ec0869e source_head=d2d649e674c75425d2d6975c87eb89fd4d55fff8
-// worktree_diff_sha256=e967c37917e4e8b5c13834df8f319a653094a9b6679b1325b3ed7c77a40f57f0, and "probe
-// identity JOINED to the produced image" at the same digest. This is the image the distribution mode
-// moves to srv5-8; arm A's row above stays as the upstream-pinned image's receipt.
-data v41_production_produced_image: V41ProducedImageHeld = V41ProducedImageHeld {
-  observed: v41_observed_source_identity_of(
-    revision_head: "d2d649e674c75425d2d6975c87eb89fd4d55fff8" as NonEmptyStr,
-    worktree_diff_sha256: Sha256Digest { hex: "e967c37917e4e8b5c13834df8f319a653094a9b6679b1325b3ed7c77a40f57f0" as Sha256DigestHex },
-  ),
-  config: OciSha256Digest(Sha256Digest { hex: "5de3c35577e5c8f3026c143d3d5b2d66cc527119281369f4651d969f581829d3" as Sha256DigestHex }),
-  held_on: "srv8" as HostIdentity,
-  receipt_run: "36327364664" as NonEmptyStr,
-}
-
-fn v41_produced_image_subject(p: V41ProducedImageHeld) -> VllmImageDistributionSubject {
-  VllmImageDistributionSubject {
-    tag: vllm_image_tag_for_key(r: v41_candidate_recipe(), key: v41_patched_image_build_key(r: v41_candidate_recipe(), observed: p.observed)),
-    config: p.config,
-  }
-}
-
-// THE V4.1 PRODUCTION ROW AS THE ONE DISTRIBUTION ENTRY'S SUBJECT (gunbc.spark.group_image_produce
-// produced_image_distribute_wet, deforking cut 8c). SPARK_CONVERGE_TARGET names the target; the source
-// is the receipt's host, a fact the production run established and not an operator's choice.
-fn v41_produced_image_held() -> ProducedImageHeld {
-  ProducedImageHeld {
-    title: "v41 runtime image" as NonEmptyStr,
-    group: FabricGroupA,
-    subject: v41_produced_image_subject(p: v41_production_produced_image),
-    held_on: v41_production_produced_image.held_on,
-    receipt_run: v41_production_produced_image.receipt_run,
-  }
-}
diff --git a/dag/gunbc/spark/v41_runtime_realized.dag b/dag/gunbc/spark/v41_runtime_realized.dag
deleted file mode 100644
index c6cf91957c6..00000000000
--- a/dag/gunbc/spark/v41_runtime_realized.dag
+++ /dev/null
@@ -1,496 +0,0 @@
-module gunbc.spark.v41_runtime_realized
-
-import std.types { String, Bool, List, NonEmptyStr }
-import std.nat { Nat }
-import std.content_hash { ContentHash, serialize_content_hash }
-import std.artifact_store {
-  ArtifactStore, ArtifactRow, StorePutAdmitted, StorePutDidNotFit,
-  store_put, store_bytes_used, artifact_realization_digest,
-}
-import std.measure { ByteSize, byte_size, byte_size_count }
-import std.realization { Placement, LocalFilesystem, RemoteNetwork, LocalInProcess, LocalAccelerator }
-import std.optional { Present, Absent }
-import gunbc.spark.v41_runtime_candidate { v41_derivation_obligations,
-  V41CandidateVerdict, V41CandidateKeyed, V41CandidateUnestablished, V41CandidateRefused,
-  V41RuntimeArtifactInputs,
-  V41IdentityKeyed, V41IdentityUnestablished, V41IdentityRefused, v41_runtime_artifact_key,
-}
-import gunbc.spark.v41_identity_input { V41EngramResidencyPartition, v41_input }
-import gunbc.spark.v41_source_patch_converge { V41ObservedSourceIdentity, v41_patched_image_build_key }
-import extdeps.container.oci.digest { OciContentDigest, render_oci_content_digest_wire }
-import gunbc.spark.vllm_runtime_image_build { VllmImageProvenance, BuiltByThisRun, AdoptedUnderExpectedTag }
-import gunbc.spark.vllm_image_identity { vllm_image_tag_for_key }
-import gunbc.spark.v41_engram_row_store {
-  V41RowStoreEncoding, V41RowStoreEncodingIdentified, V41RowStoreEncodingUnestablished, V41RowStoreEncodingRefused,
-  v41_rank_digest_of,
-}
-
-// ── SPECIFICATION IS NOT A RUNTIME ─────────────────────────────────────────────────────────────
-//
-// Cut A's V41CandidateKeyed is a RECIPE: source, manifests, patch digests, row-store encoding
-// identity. No image exists and no rank file exists in that verdict. Wiring that key into
-// serving_deployment_selection runtime_revision_key would let a recipe stand for bytes that were
-// never built. V41PatchesAbsentByObservation is deliberately keyable, and Engram independently
-// admits route B or D, so an unpatched runtime plus route B can reach Keyed today. That is a valid
-// identity for an infeasible specification. It is not a compatible runtime.
-//
-// ONLY the realized arm may be selected or authorized. A keyed specification remains readable as
-// what would be built; it cannot be read as executable.
-//
-// AN UNPATCHED BASELINE IMAGE IS NOT THE STORAGE-BACKED RUNTIME. BuiltByThisRun of a clean
-// d2d649e6 checkout establishes a content-addressed vanilla image. V41PatchesConsumedByImage is
-// only honest after a modeled apply of the declared population. Until then the patch axis stays
-// Unestablished (v41_patch_application_standing); do not mint Realized from a baseline digest plus
-// transcribed patch hex.
-type V41OciImageDigest sole_constructor {
-  manifest: OciContentDigest
-  config: OciContentDigest
-}
-
-fn v41_oci_image_digest(manifest: OciContentDigest, config: OciContentDigest) -> V41OciImageDigest {
-  V41OciImageDigest { manifest: manifest, config: config }
-}
-
-type V41PatchConsumptionEvidence
-  = V41PatchesConsumedByImage { observed: V41ObservedSourceIdentity }
-  | V41PatchesAbsentFromImage { obligation: NonEmptyStr }
-
-type V41RealizedRuntime
-  = V41RuntimeRealized {
-      specification_runtime_key: ContentHash
-      image: V41OciImageDigest
-      consumed_patches: V41PatchConsumptionEvidence
-      realized_runtime_key: ContentHash
-    }
-  | V41RuntimeRealizationUnestablished { obligations: List<NonEmptyStr> }
-  | V41RuntimeRealizationRefused { defects: List<NonEmptyStr> }
-
-fn v41_realized_runtime(
-  spec_runtime: ContentHash,
-  image: V41OciImageDigest,
-  provenance: VllmImageProvenance,
-  consumed: V41PatchConsumptionEvidence,
-) -> V41RealizedRuntime {
-  match provenance {
-    AdoptedUnderExpectedTag => V41RuntimeRealizationRefused {
-      defects: ["an image found under a tag is not the consumed bytes; realized identity requires a content digest produced by the modeled build, not a name" as NonEmptyStr],
-    }
-    BuiltByThisRun => match consumed {
-      V41PatchesAbsentFromImage { obligation: o } => V41RuntimeRealizationUnestablished { obligations: [o] }
-      V41PatchesConsumedByImage { observed: obs } =>
-        V41RuntimeRealized {
-          specification_runtime_key: spec_runtime,
-          image: image,
-          consumed_patches: consumed,
-          realized_runtime_key: artifact_realization_digest(inputs: [
-            v41_input(identity: "specification_runtime", value: serialize_content_hash(hash: spec_runtime) as String),
-            v41_input(identity: "oci.manifest", value: render_oci_content_digest_wire(d: image.manifest)),
-            v41_input(identity: "oci.config", value: render_oci_content_digest_wire(d: image.config)),
-            v41_input(identity: "source_head", value: obs.revision_head as String),
-            v41_input(identity: "worktree_diff_sha256", value: obs.worktree_diff_sha256.hex as String),
-          ]),
-        }
-    }
-  }
-}
-
-// ── PRODUCED IS A THIRD GRAIN, AND COLLAPSING IT INTO EITHER NEIGHBOUR LOSES A DISTINCTION ─────
-//
-// THREE QUESTIONS, THREE ANSWERS, AND THIS MODULE NOW CARRIES THE MIDDLE ONE.
-//
-//   KEYED     gunbc.spark.v41_runtime_candidate v41_candidate -- what WOULD be built: a recipe, a
-//             wheel population, a patch population. No bytes exist. Keyable today.
-//   PRODUCED  this section -- bytes that EXIST on a host, whose build key recomputes from the
-//             candidate's own recipe and the tree the build actually observed. Identified by the
-//             image's local configuration digest, which is what a daemon holding an unpushed image
-//             can answer; a manifest digest is a publication, and no publication happened.
-//   REALIZED  v41_realized_runtime above -- the full Cut-D realization: an OCI-identified image
-//             joined to a rank-local row store. Strictly more than produced, and it stays that way.
-//
-// WHY PRODUCED MAY NOT JUST MINT REALIZED. V41RuntimeRealized takes a V41OciImageDigest carrying BOTH
-// a manifest and a configuration digest, and a locally built image has no manifest digest to give --
-// `docker image inspect` answers the config digest and nothing else for an image that was never
-// pushed. Filling the manifest field with the config digest would be the fabricated-plausible-output
-// failure in its purest form: two different content addresses under one name, indistinguishable
-// downstream. So produced does not mint realized, and the frontier is stated rather than papered
-// over: DECLARED FRONTIER -- when the produced image is pushed and a registry answers with its
-// manifest digest, that publication is what joins this standing to v41_realized_runtime.
-//
-// AND PRODUCED MINTS NO KEY OF ITS OWN. The whole content of this standing is a CORRESPONDENCE: the
-// specification's runtime key on one side, an image's configuration digest on the other, and the
-// recomputation that says the second was built from the inputs that mint the first. A fresh
-// `produced_runtime_key` beside those would be a third identity for a fact neither side needs
-// hashed, and DESIGN section 3 calls that what it is.
-type V41ProducedRuntimeImage sole_constructor {
-  tag: NonEmptyStr
-  local_config_digest: OciContentDigest
-  build_key: ContentHash
-  observed: V41ObservedSourceIdentity
-  provenance: VllmImageProvenance
-}
-
-fn v41_produced_runtime_image(
-  tag: NonEmptyStr,
-  local_config_digest: OciContentDigest,
-  build_key: ContentHash,
-  observed: V41ObservedSourceIdentity,
-  provenance: VllmImageProvenance,
-) -> V41ProducedRuntimeImage {
-  V41ProducedRuntimeImage {
-    tag: tag,
-    local_config_digest: local_config_digest,
-    build_key: build_key,
-    observed: observed,
-    provenance: provenance,
-  }
-}
-
-type V41ProducedRuntimeStanding
-  = V41RuntimeProduced { specification_runtime_key: ContentHash, image: V41ProducedRuntimeImage }
-  | V41RuntimeProductionUnestablished { obligations: List<NonEmptyStr> }
-  | V41RuntimeProductionRefused { defects: List<NonEmptyStr> }
-
-// THE DISCRIMINATOR, AND IT IS A RECOMPUTATION RATHER THAN A COMPARISON OF TWO TRANSCRIBED HASHES.
-// The caller hands over what the build read back -- a tag, a configuration digest, the key the build
-// was run under, and the source tree the build observed. This fold takes the CANDIDATE's recipe,
-// re-derives the key that tree would have to produce, and requires the build's key and tag to be
-// exactly those. An image built from another revision, another arch list, another patch set or
-// another worktree therefore refuses by arithmetic rather than by anyone remembering to check, and
-// the failure names which of the three it was.
-fn v41_produced_key_defects(inputs: V41RuntimeArtifactInputs, image: V41ProducedRuntimeImage) -> List<NonEmptyStr> {
-  let expected_key = v41_patched_image_build_key(r: inputs.recipe, observed: image.observed)
-  let expected_tag = vllm_image_tag_for_key(r: inputs.recipe, key: expected_key)
-  concat(concat(
-    if (image.observed.revision_head as String) == (inputs.recipe.source.full_revision as String) { [] as List<NonEmptyStr> } else {
-      [join(["the produced image was built from a tree at ", image.observed.revision_head as String, ", and this candidate's recipe names ", inputs.recipe.source.full_revision as String], "") as NonEmptyStr]
-    },
-    if (serialize_content_hash(hash: image.build_key) as String) == (serialize_content_hash(hash: expected_key) as String) { [] as List<NonEmptyStr> } else {
-      [join(["the produced image carries build key ", serialize_content_hash(hash: image.build_key) as String,
-        ", and this candidate's recipe over the observed tree mints ", serialize_content_hash(hash: expected_key) as String,
-        "; a digest that does not recompute from the recipe and the patched tree is not this candidate's runtime"], "") as NonEmptyStr]
-    }),
-    if (image.tag as String) == (expected_tag as String) { [] as List<NonEmptyStr> } else {
-      [join(["the produced image wears the tag ", image.tag as String, ", and this candidate's key derives ", expected_tag as String], "") as NonEmptyStr]
-    })
-}
-
-// A NAME IS NOT PRODUCTION, and the same refusal the realized fold makes applies one grain earlier:
-// an image found already carrying the expected tag has a real digest and an UNESTABLISHED relation to
-// the recipe beside it, so it may not stand as bytes this build produced. The produced standing is
-// the one place that distinction is cheap to enforce, because the build hands its own provenance over.
-fn v41_admit_produced_runtime(
-  inputs: V41RuntimeArtifactInputs,
-  partition: V41EngramResidencyPartition,
-  image: V41ProducedRuntimeImage,
-) -> V41ProducedRuntimeStanding {
-  let provenance_defects = match image.provenance {
-    BuiltByThisRun => [] as List<NonEmptyStr>
-    AdoptedUnderExpectedTag =>
-      ["an image found under the expected tag is not bytes this run produced; its source equality is unestablished and a produced standing may not be minted from a name" as NonEmptyStr]
-  }
-  let defects = concat(provenance_defects, v41_produced_key_defects(inputs: inputs, image: image))
-  match v41_runtime_artifact_key(i: inputs, partition: partition) {
-    V41IdentityRefused { defects: d } => V41RuntimeProductionRefused { defects: concat(d, defects) }
-    V41IdentityUnestablished { obligations: o } =>
-      if length(defects) != 0 { V41RuntimeProductionRefused { defects: defects } } else { V41RuntimeProductionUnestablished { obligations: o } }
-    V41IdentityKeyed { key: spec } =>
-      if length(defects) != 0 {
-        V41RuntimeProductionRefused { defects: defects }
-      } else {
-        V41RuntimeProduced { specification_runtime_key: spec, image: image }
-      }
-  }
-}
-
-fn v41_produced_runtime_line(s: V41ProducedRuntimeStanding) -> String {
-  match s {
-    V41RuntimeProduced { specification_runtime_key: spec, image: i } =>
-      join([
-        "produced runtime tag=", i.tag as String,
-        " config_digest=", render_oci_content_digest_wire(d: i.local_config_digest),
-        " build_key=", serialize_content_hash(hash: i.build_key) as String,
-        " specification_runtime_key=", serialize_content_hash(hash: spec) as String,
-        " source_head=", i.observed.revision_head as String,
-        " worktree_diff_sha256=", i.observed.worktree_diff_sha256.hex as String,
-        "\n",
-      ], "")
-    V41RuntimeProductionUnestablished { obligations: o } =>
-      join(["produced runtime UNESTABLISHED: ", join(map(o, x => x as String), "; "), "\n"], "")
-    V41RuntimeProductionRefused { defects: d } =>
-      join(["produced runtime REFUSED: ", join(map(d, x => x as String), "; "), "\n"], "")
-  }
-}
-
-fn v41_runtime_was_produced(s: V41ProducedRuntimeStanding) -> Bool {
-  match s {
-    V41RuntimeProduced { specification_runtime_key: _, image: _ } => true
-    V41RuntimeProductionUnestablished { obligations: _ } => false
-    V41RuntimeProductionRefused { defects: _ } => false
-  }
-}
-
-type V41RealizedCandidate
-  = V41CandidateRealized {
-      realized_runtime: ContentHash
-      row_store: ContentHash
-      execution_profile: ContentHash
-      candidate: ContentHash
-      authorization_obligation: NonEmptyStr
-    }
-  | V41CandidateRealizationUnestablished { obligations: List<NonEmptyStr> }
-  | V41CandidateRealizationRefused { defects: List<NonEmptyStr> }
-
-// A REALIZED CANDIDATE IS SELECTABLE, so it may not be minted while the specification's derivation
-// evidence still owes a readback (gunbc.spark.v41_runtime_candidate V41DerivationEvidence).
-fn v41_realized_candidate(
-  runtime: V41RealizedRuntime,
-  row_store: V41RowStoreEncoding,
-  spec: V41CandidateVerdict,
-) -> V41RealizedCandidate {
-  match spec.standing {
-    V41CandidateUnestablished { obligations: o } => V41CandidateRealizationUnestablished { obligations: o }
-    V41CandidateRefused { defects: d } => V41CandidateRealizationRefused { defects: d }
-    V41CandidateKeyed { runtime_artifact: _, model_source: _, engram_realization: _, execution_profile: exec, candidate: _, authorization_obligation: auth } =>
-      if length(v41_derivation_obligations(d: spec.derivation)) != 0 { V41CandidateRealizationUnestablished { obligations: v41_derivation_obligations(d: spec.derivation) } } else {
-      match runtime {
-        V41RuntimeRealizationUnestablished { obligations: o } => V41CandidateRealizationUnestablished { obligations: o }
-        V41RuntimeRealizationRefused { defects: d } => V41CandidateRealizationRefused { defects: d }
-        V41RuntimeRealized { specification_runtime_key: _, image: _, consumed_patches: _, realized_runtime_key: rk } =>
-          match row_store {
-            V41RowStoreEncodingUnestablished { obligation: o } => V41CandidateRealizationUnestablished { obligations: [o] }
-            V41RowStoreEncodingRefused { defects: d } => V41CandidateRealizationRefused { defects: d }
-            V41RowStoreEncodingIdentified { spec: _, spec_key: _, rank_stores: _, content_digest: rd } =>
-              V41CandidateRealized {
-                realized_runtime: rk,
-                row_store: rd,
-                execution_profile: exec,
-                candidate: artifact_realization_digest(inputs: [
-                  v41_input(identity: "realized_runtime", value: serialize_content_hash(hash: rk) as String),
-                  v41_input(identity: "row_store", value: serialize_content_hash(hash: rd) as String),
-                  v41_input(identity: "execution_profile", value: serialize_content_hash(hash: exec) as String),
-                ]),
-                authorization_obligation: auth,
-              }
-          }
-      }
-      }
-  }
-}
-
-type V41SelectableRuntime
-  = V41Selectable { candidate: V41RealizedCandidate }
-  | V41NotSelectable { reason: NonEmptyStr }
-
-fn v41_selectable(realized: V41RealizedCandidate) -> V41SelectableRuntime {
-  match realized {
-    V41CandidateRealized { realized_runtime: _, row_store: _, execution_profile: _, candidate: _, authorization_obligation: _ } =>
-      V41Selectable { candidate: realized }
-    V41CandidateRealizationUnestablished { obligations: o } =>
-      V41NotSelectable { reason: join(["specification or bytes unestablished: ", join(map(o, x => x as String), "; ")], "") as NonEmptyStr }
-    V41CandidateRealizationRefused { defects: d } =>
-      V41NotSelectable { reason: join(["realization refused: ", join(map(d, x => x as String), "; ")], "") as NonEmptyStr }
-  }
-}
-
-fn v41_specification_is_not_selectable(spec: V41CandidateVerdict) -> Bool {
-  match spec.standing {
-    V41CandidateKeyed { runtime_artifact: _, model_source: _, engram_realization: _, execution_profile: _, candidate: _, authorization_obligation: _ } =>
-      match v41_selectable(realized: v41_realized_candidate(
-        runtime: V41RuntimeRealizationUnestablished { obligations: ["no image digest has been produced" as NonEmptyStr] },
-        row_store: V41RowStoreEncodingUnestablished { obligation: "no rank-local store has been produced" as NonEmptyStr },
-        spec: spec,
-      )) {
-        V41NotSelectable { reason: _ } => true
-        V41Selectable { candidate: _ } => false
-      }
-    V41CandidateUnestablished { obligations: _ } => true
-    V41CandidateRefused { defects: _ } => true
-  }
-}
-
-// ── THE RUNTIME OPENS A PATH AGAINST AN EXPECTED IDENTITY ──────────────────────────────────────
-type V41OpenedStore
-  = V41StoreHandle { path: NonEmptyStr, expected: ContentHash, observed: ContentHash, layer: Nat, rank: Nat }
-  | V41StoreOpenRefused { defects: List<NonEmptyStr> }
-
-fn v41_open_rank_store(path: NonEmptyStr, expected: ContentHash, observed: ContentHash, layer: Nat, rank: Nat) -> V41OpenedStore {
-  if (path as String) == "" {
-    V41StoreOpenRefused { defects: ["a path is not identity; an empty path cannot be a row store" as NonEmptyStr] }
-  } else if (serialize_content_hash(hash: expected) as String) != (serialize_content_hash(hash: observed) as String) {
-    V41StoreOpenRefused { defects: ["the file that was opened does not match the expected rank-store identity; a preflight that is not this comparison can go stale" as NonEmptyStr] }
-  } else {
-    V41StoreHandle { path: path, expected: expected, observed: observed, layer: layer, rank: rank }
-  }
-}
-
-fn v41_distributed_launch(opened: List<V41OpenedStore>, encoding: V41RowStoreEncoding) -> V41OpenedStore {
-  let refused = filter(opened, o => match o { V41StoreOpenRefused { defects: _ } => true V41StoreHandle { path: _, expected: _, observed: _, layer: _, rank: _ } => false })
-  if length(refused) != 0 {
-    match refused.first() {
-      Present { value: r } => r
-      Absent => V41StoreOpenRefused { defects: ["distributed launch refused" as NonEmptyStr] }
-    }
-  } else {
-    match encoding {
-      V41RowStoreEncodingIdentified { spec: spec, spec_key: _, rank_stores: _, content_digest: _ } => {
-        let wrong = filter(opened, o => match o {
-          V41StoreHandle { path: _, expected: e, observed: _, layer: l, rank: k } =>
-            match v41_rank_digest_of(e: encoding, layer: l, rank: k) {
-              Absent => true
-              Present { value: want } => (serialize_content_hash(hash: e) as String) != (serialize_content_hash(hash: want) as String)
-            }
-          V41StoreOpenRefused { defects: _ } => true
-        })
-        if length(wrong) != 0 {
-          V41StoreOpenRefused { defects: ["one (layer, rank) store opened an identity that is not the encoding's digest for that store; distributed launch refuses" as NonEmptyStr] }
-        } else if length(opened) != length(spec.layers) * spec.rank_count {
-          V41StoreOpenRefused { defects: ["distributed launch requires every declared (layer, rank) store" as NonEmptyStr] }
-        } else {
-          match opened.first() {
-            Present { value: h } => h
-            Absent => V41StoreOpenRefused { defects: ["no ranks" as NonEmptyStr] }
-          }
-        }
-      }
-      V41RowStoreEncodingUnestablished { obligation: o } => V41StoreOpenRefused { defects: [o] }
-      V41RowStoreEncodingRefused { defects: d } => V41StoreOpenRefused { defects: d }
-    }
-  }
-}
-
-// ── TOKEN-TIME ACCESS: LOCAL OR REFUSE. NEVER NFS. ─────────────────────────────────────────────
-type V41TokenTimeAccess
-  = V41TokenTimeLocal { placement: Placement }
-  | V41TokenTimeRefused { defects: List<NonEmptyStr> }
-
-fn v41_token_time(placement: Placement, local_present: Bool) -> V41TokenTimeAccess {
-  match placement {
-    RemoteNetwork => V41TokenTimeRefused {
-      defects: ["a missing local row store cannot silently use NFS at token time; that would change the selected realization while preserving the launch identity" as NonEmptyStr],
-    }
-    LocalFilesystem =>
-      if local_present {
-        V41TokenTimeLocal { placement: placement }
-      } else {
-        V41TokenTimeRefused {
-          defects: ["rank-local row store missing; refusing rather than falling back to a remote path" as NonEmptyStr],
-        }
-      }
-    LocalInProcess => V41TokenTimeRefused { defects: ["token-time Engram reads are a local filesystem placement, not in-process residency" as NonEmptyStr] }
-    LocalAccelerator => V41TokenTimeRefused { defects: ["token-time Engram reads are a local filesystem placement, not an accelerator-resident table" as NonEmptyStr] }
-  }
-}
-
-// ── BOUNDED RESIDENCY UNDER AN ADVERSARIAL TRACE ───────────────────────────────────────────────
-//
-// The bound is part of candidate compatibility. Recording steady resident bytes after init is too
-// late and too observational: an access population larger than cache capacity must evict, occupancy
-// must stay inside the declared limit, and exceeding it refuses the candidate.
-type V41ResidencyLimits sole_constructor {
-  configured_cache: ByteSize
-  effective_cache: ByteSize
-  configured_staging: ByteSize
-  effective_staging: ByteSize
-  configured_inflight_io: ByteSize
-  effective_inflight_io: ByteSize
-}
-
-fn v41_residency_limits(
-  configured_cache: ByteSize,
-  effective_cache: ByteSize,
-  configured_staging: ByteSize,
-  effective_staging: ByteSize,
-  configured_inflight_io: ByteSize,
-  effective_inflight_io: ByteSize,
-) -> V41ResidencyLimits {
-  V41ResidencyLimits {
-    configured_cache: configured_cache,
-    effective_cache: effective_cache,
-    configured_staging: configured_staging,
-    effective_staging: effective_staging,
-    configured_inflight_io: configured_inflight_io,
-    effective_inflight_io: effective_inflight_io,
-  }
-}
-
-type V41ResidencyVerdict
-  = V41ResidencyWithinBound {
-      limits: V41ResidencyLimits
-      occupancy: ByteSize
-      evicted: Nat
-    }
-  | V41ResidencyExceeded { defects: List<NonEmptyStr> }
-
-fn v41_limit_defects(l: V41ResidencyLimits) -> List<NonEmptyStr> {
-  concat(concat(
-    if byte_size_count(b: l.effective_cache) > byte_size_count(b: l.configured_cache) {
-      ["effective cache exceeds the configured hard limit" as NonEmptyStr]
-    } else { [] as List<NonEmptyStr> },
-    if byte_size_count(b: l.effective_staging) > byte_size_count(b: l.configured_staging) {
-      ["effective pinned staging exceeds the configured hard limit" as NonEmptyStr]
-    } else { [] as List<NonEmptyStr> }),
-    if byte_size_count(b: l.effective_inflight_io) > byte_size_count(b: l.configured_inflight_io) {
-      ["effective in-flight I/O exceeds the configured hard limit" as NonEmptyStr]
-    } else { [] as List<NonEmptyStr> })
-}
-
-fn v41_residency_under_trace(limits: V41ResidencyLimits, keys: List<ContentHash>, row_bytes: ByteSize) -> V41ResidencyVerdict {
-  let shape = v41_limit_defects(l: limits)
-  if length(shape) != 0 {
-    V41ResidencyExceeded { defects: shape }
-  } else {
-    let store = ArtifactStore { budget: limits.effective_cache, next_ordinal: 1, rows: [] as List<ArtifactRow> }
-    let final_put = fold(keys, init: StorePutAdmitted { store: store, evicted: [] as List<ContentHash> }, f: (acc, k) => match acc {
-      StorePutDidNotFit { artifact_bytes: a, budget: b } => StorePutDidNotFit { artifact_bytes: a, budget: b }
-      StorePutAdmitted { store: s, evicted: prev } => match store_put(store: s, key: k, artifact_bytes: row_bytes) {
-        StorePutDidNotFit { artifact_bytes: a, budget: b } => StorePutDidNotFit { artifact_bytes: a, budget: b }
-        StorePutAdmitted { store: n, evicted: e } => StorePutAdmitted { store: n, evicted: concat(prev, e) }
-      }
-    })
-    match final_put {
-      StorePutDidNotFit { artifact_bytes: _, budget: _ } =>
-        V41ResidencyExceeded { defects: ["an Engram row does not fit the declared cache; the candidate refuses" as NonEmptyStr] }
-      StorePutAdmitted { store: s, evicted: e } => {
-        let used = store_bytes_used(store: s)
-        if used > byte_size_count(b: limits.effective_cache) {
-          V41ResidencyExceeded { defects: ["observed occupancy exceeds the admitted cache bound" as NonEmptyStr] }
-        } else if length(e) == 0 && (length(keys) * byte_size_count(b: row_bytes)) > byte_size_count(b: limits.effective_cache) {
-          V41ResidencyExceeded { defects: ["eviction did not occur under a trace larger than cache capacity; the candidate refuses" as NonEmptyStr] }
-        } else {
-          V41ResidencyWithinBound {
-            limits: limits,
-            occupancy: byte_size(count: used),
-            evicted: length(e),
-          }
-        }
-      }
-    }
-  }
-}
-
-type V41PinnedAllocation
-  = V41PinnedWithinStaging { pinned_bytes: ByteSize, table_bytes: ByteSize }
-  | V41FullEngramPinned { pinned_bytes: ByteSize, table_bytes: ByteSize }
-
-fn v41_observe_pinned(pinned_bytes: ByteSize, table_bytes: ByteSize) -> V41PinnedAllocation {
-  if byte_size_count(b: pinned_bytes) >= byte_size_count(b: table_bytes) {
-    V41FullEngramPinned { pinned_bytes: pinned_bytes, table_bytes: table_bytes }
-  } else {
-    V41PinnedWithinStaging { pinned_bytes: pinned_bytes, table_bytes: table_bytes }
-  }
-}
-
-fn v41_refuse_full_pin(obs: V41PinnedAllocation) -> Bool {
-  match obs {
-    V41FullEngramPinned { pinned_bytes: _, table_bytes: _ } => true
-    V41PinnedWithinStaging { pinned_bytes: _, table_bytes: _ } => false
-  }
-}
-
-fn v41_candidate_refuses_full_pin(obs: V41PinnedAllocation) -> V41CandidateRealizationRefused? {
-  if v41_refuse_full_pin(obs: obs) {
-    Present { value: V41CandidateRealizationRefused { defects: ["full Engram pinned allocation detected; the storage-backed runtime candidate refuses" as NonEmptyStr] } }
-  } else {
-    none
-  }
-}
diff --git a/dag/gunbc/spark/v41_serving_load.dag b/dag/gunbc/spark/v41_serving_load.dag
deleted file mode 100644
index 218943fac00..00000000000
--- a/dag/gunbc/spark/v41_serving_load.dag
+++ /dev/null
@@ -1,451 +0,0 @@
-module gunbc.spark.v41_serving_load
-
-import std.types { Bool, List, NonEmptyStr, String }
-import std.nat { Nat }
-import std.algebra { trim }
-import std.measure { token_count, microsecond_count }
-import std.optional { Present, Absent }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import product.host_identity { HostIdentity }
-import extdeps.filesystem.filesystem_io { Filesystem }
-
-import extdeps.vllm.bench_serve { VllmBenchServeRequest, SendAllImmediately, RandomDatasetSpec, OpenaiChat, vllm_bench_serve_request }
-import extdeps.vllm.kv_layout { AdmissionCostUnestablished }
-import extdeps.linux.psi { PsiReading, PsiRead, PsiUnparseable }
-import extdeps.linux.diskstats { DiskstatsReading, DiskReadMeasured, DiskReadUnmeasurable, parse_diskstats, disk_read_interval }
-
-import extdeps.container.oci.digest { render_oci_content_digest_wire }
-import gunbc.fleet_intent_network { srv6_host_lan_endpoint }
-import gunbc.fleet_host_identity { operator_host_srv6 }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fleet_multi_principal_probe { spark_converge_target_selection, SparkConvergeTargetSingle, SparkConvergeTargetAllObserveOnly, SparkConvergeTargetRefused }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, fabric_group_hosts }
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext }
-import gunbc.spark.vllm_runtime_image_build { with_spark_build_host, SparkBuildHostWork, SparkBuildHostRefused, SparkBuildHostRan }
-import gunbc.spark.serving_arm { FourSparkTp4, GunbcDeepseekV41EngramProduced, deepseek_v41_flash_row, runtime_artifact_identity, PinnedByDigest, SourceRevisionEstablished }
-import gunbc.spark.serving_arm_launch { arm_mount_plan }
-import gunbc.spark.pair_serving_realization { spark_pair_serve_port }
-import gunbc.spark.v41_group_a_launch { v41_group_a_container_name, v41_group_a_served_alias, v41_group_a_profile, v41_group_a_deployment_env }
-import gunbc.spark.v41_row_store_encode { v41_row_store_output_directory }
-import gunbc.spark.v41_runtime_image_converge { v41_production_produced_image }
-import gunbc.spark.serving_performance_subject { ServingPerformanceSubject, serving_subject_for_launch, serving_subject_standing, ServingPerformanceSubjectStanding }
-import gunbc.spark.serving_load_probe { ClientRateQualificationFrontier, client_rate_qualification_frontier, preemption_count, bench_serve_latency, ClientBenchLatency }
-import gunbc.spark.group_arm_serving_load { read_rank_container_pressure, RankContainerPressureObserved, RankContainerPressureUnread, remote_text, RemoteTextRead, RemoteTextRefused, rank_context }
-import gunbc.spark.serving_load_runner { ServingLoadSubject, ServingLoadStepRecord, serving_load_records, serving_load_receipt_body, ServingLoadRunObserved, ServingLoadRunRefused }
-import gunbc.spark.v41_capacity_measurement { v41_staircase_concurrencies, v41_measurement_launch_shape, v41_capacity_policy, V41StaircaseStepReading, v41_run_staircase, v41_sla_capacity, v41_capacity_wire }
-//
-// V4.1's binding of the shared serving-load runner (gunbc.spark.serving_load_runner): its subject on
-// Group A, one load step per staircase concurrency, and a host-pressure reading on every rank around
-// each step, projected into gunbc.spark.v41_capacity_measurement V41StaircaseStepReading and run
-// through v41_run_staircase. Only the numbers below are V4.1's; the engineering is the runner's.
-//
-//   fleet-converge mode spark_v41_serving_load (SPARK_CONVERGE_TARGET must be the head, srv6), or
-//   gunbc run --source-root dag --source-root src/v2 \
-//     --entry dag/gunbc/spark/v41_serving_load.dag --function v41_serving_load_ci_wet
-
-// ── THE PROTOCOL (operator ruling 2026-10-01, via proud-deer-538) ─────────────────────────────────
-//
-// THIS IS A COPY OF GLM's SHAPE, NOT A V4.1 PROTOCOL: the same random dataset shape as
-// gunbc.spark.glm_serving_load glm_native_sweep_dataset (256 in / 128 out / prefix 0), declared here as
-// V4.1's own row so a GLM change never moves V4.1's measurement. It stands until a V4.1-specific
-// protocol is ruled. At 256 input tokens it DOES NOT EXERCISE the 262k-context TTFT gate in
-// v41_capacity_policy, so a staircase run on it says nothing about that gate (v41_ttft_gate_frontier).
-data v41_serving_load_dataset: RandomDatasetSpec = RandomDatasetSpec {
-  input_len: token_count(count: 256),
-  output_len: token_count(count: 128),
-  prefix_len: token_count(count: 0),
-}
-
-data v41_serving_load_seed: Nat = 20261001
-
-// Prompts per step are twice the step's concurrency (GLM's smoke is c=2 with 4 prompts; the staircase
-// scales it per step).
-data v41_serving_load_prompts_per_concurrency: Nat = 2
-
-data v41_ttft_gate_frontier: String = "the 262k-context TTFT gate is NOT exercised: the protocol is GLM's 256-in/128-out shape, so TTFT here is a short-prefill reading and the gate's reading is a frontier until a V4.1-specific long-context protocol is ruled"
-
-// The head the bench client and the metrics scrape address (brief, 2026-09-30: head srv6, port 30000).
-data v41_serving_load_head: HostIdentity = operator_host_srv6
-
-fn v41_serve_base_url() -> NonEmptyStr {
-  join(["http://127.0.0.1:", to_string(spark_pair_serve_port)], "") as NonEmptyStr
-}
-
-fn v41_serving_load_step(concurrency: Nat) -> VllmBenchServeRequest {
-  vllm_bench_serve_request(
-    backend: OpenaiChat,
-    base_url: v41_serve_base_url(),
-    model: v41_group_a_served_alias,
-    tokenizer: arm_mount_plan(row: deepseek_v41_flash_row).model_path,
-    dataset: v41_serving_load_dataset,
-    num_prompts: concurrency * v41_serving_load_prompts_per_concurrency,
-    arrival: SendAllImmediately,
-    max_concurrency: Present { value: concurrency },
-    ignore_eos: true,
-    seed: v41_serving_load_seed,
-  )
-}
-
-fn v41_serving_load_steps() -> List<VllmBenchServeRequest> {
-  map(v41_staircase_concurrencies, c => v41_serving_load_step(concurrency: c))
-}
-
-// ── THE SUBJECT ──────────────────────────────────────────────────────────────────────────────────
-
-data v41_serving_load_receipt_path: String = "target/v41-serving-load-receipt.txt"
-data v41_serving_load_attempt_raw: String = "v41-serving-load"
-
-data v41_serving_load_qualification_frontier: ClientRateQualificationFrontier = client_rate_qualification_frontier(
-  request_start_events: "per-request start events so ArrivalSkewObserved can be minted; SendAllImmediately stays ArrivalSkewUnread until that producer exists" as NonEmptyStr,
-  reserved_window: "subject-bound LeaseGrant and ExclusionEstablished over the V4.1 measurement serve; the measurement serve is admitted with a no-production-traffic contract (v41_capacity_measurement V41MeasurementServe), which is not yet an exclusion receipt" as NonEmptyStr,
-  interval_occupancy: "occupancy as a time-series over the client interval; BoundaryOccupancyReceipt is two scrapes and cannot count positively" as NonEmptyStr,
-  serve_py_digest: "bind vllm_bench_serve_source_standing to the serve.py digest inside the V4.1 production image, or an explicit policy that admits TranscribedUncited" as NonEmptyStr,
-)
-
-// The runtime is the production image the Group A launch applies (v41_production_produced_image); this
-// probe does not read the running container's image back, so the subject is believed, not established.
-// THE LAUNCH AXES ARE THE PROFILE'S, DERIVED through gunbc.spark.serving_performance_subject
-// serving_subject_for_launch from the profile the Group A launch renders (v41_group_a_launch
-// v41_group_a_profile), the same constructor the GLM subject uses; the kv dtype is therefore the
-// fp8_ds_mla the launch requests rather than unread.
-fn v41_serving_load_live_subject() -> ServingPerformanceSubject? {
-  let shape = v41_measurement_launch_shape()
-  let image = v41_production_produced_image
-  match v41_group_a_profile(shape: shape) {
-   Absent => none
-   Present { value: launch_profile } => Present { value: serving_subject_for_launch(
-    checkpoint_revision: Present { value: deepseek_v41_flash_row.revision },
-    runtime: GunbcDeepseekV41EngramProduced {
-      artifact: runtime_artifact_identity(
-        pin: PinnedByDigest { reference: render_oci_content_digest_wire(d: image.config) as NonEmptyStr },
-        source: SourceRevisionEstablished { revision: image.observed.revision_head },
-        patch_set: [join(["worktree-diff-sha256:", image.observed.worktree_diff_sha256.hex as String], "") as NonEmptyStr],
-        provenance: join(["the V4.1 production image produced by fleet-converge run ", image.receipt_run as String, " on ", image.held_on as String], "") as NonEmptyStr,
-      ),
-      registry_reading: none,
-    },
-    runtime_image_reference: render_oci_content_digest_wire(d: image.config) as NonEmptyStr,
-    topology: FourSparkTp4,
-    profile: launch_profile,
-    deployment_env: v41_group_a_deployment_env(),
-    collective_transport: none,
-  ) }
-  }
-}
-
-fn v41_serving_load_subject_standing() -> ServingPerformanceSubjectStanding? {
-  match v41_serving_load_live_subject() {
-    Absent => none
-    Present { value: subject } => Present { value: serving_subject_standing(
-      subject: subject,
-      believed: "the running Group A arm is believed to be the production image at the profile the launch derives; collective transport is unread; speculation is off (the launch renders none)" as NonEmptyStr,
-      would_settle: "read the head container's image Id and launch argv on this incarnation, and the NCCL transport announcement on every rank" as NonEmptyStr,
-    ) }
-  }
-}
-
-fn v41_serving_load_subject() -> ServingLoadSubject? {
-  match v41_serving_load_subject_standing() {
-   Absent => none
-   Present { value: standing } => Present { value: ServingLoadSubject {
-    host: v41_serving_load_head,
-    host_address: srv6_host_lan_endpoint.address,
-    group: FabricGroupA,
-    container: v41_group_a_container_name,
-    base_url: v41_serve_base_url(),
-    served_alias: v41_group_a_served_alias,
-    standing: standing,
-    admission: AdmissionCostUnestablished {
-      cause: "V4.1's per-request KV cost is unread: no cache-group roster is observed for the measurement serve, so cold_admission_blocks cannot establish it; the startup receipt's pool is the capacity measurement's KV-admission axis, not a per-request cost" as NonEmptyStr,
-    },
-    qualification_frontier: v41_serving_load_qualification_frontier,
-    principal: "group-A administrator" as NonEmptyStr,
-    receipt_heading: "v41 serving-load staircase" as NonEmptyStr,
-    receipt_path: v41_serving_load_receipt_path,
-  } }
-  }
-}
-
-// ── THE RANK PRESSURE READING (operator ruling 2026-10-01: every rank, the step takes the worst) ──
-//
-// THE CONTAINER-SCOPED HALF IS THE ONE LOAD PATH'S (gunbc.spark.group_arm_serving_load
-// read_rank_container_pressure, deforking cut 8b): the rank container's cgroup memory.stat, its
-// memory.events and the host's PSI, under the same stated cgroup-driver bet. What is V4.1's own is the
-// diskstats row of the device holding the Engram row stores (found by findmnt on that directory, never
-// named by guess), composed on top of it here.
-type V41RankPressure {
-  host: HostIdentity
-  refault_file: Nat
-  psi: PsiReading
-  nvme: DiskstatsReading
-}
-
-type V41RankPressureRead
-  = V41RankPressureObserved { pressure: V41RankPressure }
-  | V41RankPressureUnread { host: HostIdentity, cause: String }
-
-type V41StepPressure { ranks: List<V41RankPressureRead> }
-
-// findmnt prints the SOURCE as /dev/<name>; /proc/diskstats names the device without the prefix.
-fn v41_device_of_findmnt(stdout: String) -> NonEmptyStr? {
-  let source = trim(s: stdout)
-  let prefix = "/dev/"
-  let n = string_length(source)
-  let p = string_length(prefix)
-  if n > p && substring(s: source, start: 0, end: p) == prefix {
-    Present { value: substring(s: source, start: p, end: n) as NonEmptyStr }
-  } else {
-    none
-  }
-}
-
-fn v41_read_rank_pressure(ctx: SparkMaterializeContext) -> V41RankPressureRead {
-  let host = ctx.host
-  match read_rank_container_pressure(ctx: ctx, container: v41_group_a_container_name) {
-    RankContainerPressureUnread { host: _, cause: c } => V41RankPressureUnread { host: host, cause: c }
-    RankContainerPressureObserved { pressure: p } =>
-      match remote_text(ctx: ctx, what: "findmnt row-store device", argv: ["findmnt", "--noheadings", "--output", "SOURCE", "--target", v41_row_store_output_directory() as String]) {
-        RemoteTextRefused { cause: c } => V41RankPressureUnread { host: host, cause: c }
-        RemoteTextRead { stdout: mnt } => match v41_device_of_findmnt(stdout: mnt) {
-          Absent => V41RankPressureUnread { host: host, cause: join(["findmnt named no /dev source for the row-store directory: ", mnt], "") }
-          Present { value: device } =>
-            match remote_text(ctx: ctx, what: "cat /proc/diskstats", argv: ["cat", "/proc/diskstats"]) {
-              RemoteTextRefused { cause: c } => V41RankPressureUnread { host: host, cause: c }
-              RemoteTextRead { stdout: disk } =>
-                V41RankPressureObserved { pressure: V41RankPressure {
-                  host: host,
-                  refault_file: p.memory.workingset_refault_file,
-                  psi: p.psi,
-                  nvme: parse_diskstats(body: disk, device: device),
-                } }
-            }
-        }
-      }
-  }
-}
-
-// The runner's host-reading bracket for V4.1: every Group A rank, read from the head's session.
-fn v41_read_step_pressure(ctx: SparkMaterializeContext) -> V41StepPressure {
-  V41StepPressure { ranks: map(fabric_group_hosts(g: FabricGroupA), h => v41_read_rank_pressure(ctx: rank_context(ctx: ctx, host: h))) }
-}
-
-// ── THE WORST-RANK PROJECTION INTO THE STAIRCASE STEP READING ────────────────────────────────────
-//
-// A rank is a pair (its before and after reading). For each stop rule's field the step takes the
-// rank that rule would judge worst; a rank whose interval is unmeasurable is worst of all, so the
-// stop rule reports it as a missing reading rather than another rank's clean interval hiding it.
-type V41RankPair { before: V41RankPressure, after: V41RankPressure }
-
-type V41StepProjection
-  = V41StepProjected { reading: V41StaircaseStepReading }
-  | V41StepUnprojected { concurrency: Nat, causes: List<String> }
-  | V41StepConcurrencyUnbound { cause: String }
-
-fn v41_observed_ranks(p: V41StepPressure) -> List<V41RankPressure> {
-  flat_map(p.ranks, r => match r {
-    V41RankPressureObserved { pressure: x } => [x]
-    V41RankPressureUnread { host: _, cause: _ } => [] as List<V41RankPressure>
-  })
-}
-
-fn v41_unread_causes(p: V41StepPressure, phase: String) -> List<String> {
-  flat_map(p.ranks, r => match r {
-    V41RankPressureObserved { pressure: _ } => [] as List<String>
-    V41RankPressureUnread { host: h, cause: c } => [join([phase, " ", h as String, ": ", c], "")]
-  })
-}
-
-// Pairs by host; a host read on one side only is a cause, never a pair.
-fn v41_rank_pairs(before: V41StepPressure, after: V41StepPressure) -> List<V41RankPair> {
-  flat_map(v41_observed_ranks(p: before), b => flat_map(filter(v41_observed_ranks(p: after), a => a.host == b.host), a => [V41RankPair { before: b, after: a }]))
-}
-
-// Larger is worse; an unmeasurable interval ranks above every measured one.
-type V41Severity = SeverityUnmeasurable | SeverityMeasured { amount: Nat }
-
-fn v41_severity_above(a: V41Severity, b: V41Severity) -> Bool {
-  match a {
-    SeverityUnmeasurable => match b { SeverityUnmeasurable => false  SeverityMeasured { amount: _ } => true }
-    SeverityMeasured { amount: x } => match b { SeverityUnmeasurable => false  SeverityMeasured { amount: y } => x > y }
-  }
-}
-
-fn v41_worst(pairs: List<V41RankPair>, severity: fn(V41RankPair) -> V41Severity) -> V41RankPair? {
-  fold(pairs, init: none, f: (acc, p) => match acc {
-    Absent => Present { value: p }
-    Present { value: q } => if v41_severity_above(a: severity(p), b: severity(q)) { Present { value: p } } else { acc }
-  })
-}
-
-fn v41_refault_severity(p: V41RankPair) -> V41Severity {
-  if p.after.refault_file < p.before.refault_file { SeverityUnmeasurable } else { SeverityMeasured { amount: p.after.refault_file - p.before.refault_file } }
-}
-
-fn v41_psi_full(r: PsiReading) -> Nat? {
-  match r {
-    PsiUnparseable { body: _, cause: _ } => none
-    PsiRead { some_total: _, full_total: f } => match f {
-      Absent => none
-      Present { value: m } => Present { value: microsecond_count(m: m) }
-    }
-  }
-}
-
-fn v41_psi_severity(p: V41RankPair) -> V41Severity {
-  match v41_psi_full(r: p.before.psi) {
-    Absent => SeverityUnmeasurable
-    Present { value: b } => match v41_psi_full(r: p.after.psi) {
-      Absent => SeverityUnmeasurable
-      Present { value: a } => if a < b { SeverityUnmeasurable } else { SeverityMeasured { amount: a - b } }
-    }
-  }
-}
-
-fn v41_nvme_severity(p: V41RankPair) -> V41Severity {
-  match disk_read_interval(before: p.before.nvme, after: p.after.nvme) {
-    DiskReadUnmeasurable { cause: _ } => SeverityUnmeasurable
-    DiskReadMeasured { read_bytes: _, reads: _, mean_read_await: aw } => match aw {
-      Absent => SeverityMeasured { amount: 0 }
-      Present { value: m } => SeverityMeasured { amount: microsecond_count(m: m) }
-    }
-  }
-}
-
-fn v41_preemption_delta(before_body: String, after_body: String) -> Nat? {
-  match preemption_count(body: before_body) {
-    Absent => none
-    Present { value: b } => match preemption_count(body: after_body) {
-      Absent => none
-      Present { value: a } => if a < b { none } else { Present { value: a - b } }
-    }
-  }
-}
-
-// Every rank must be read on both sides; a missing rank is a cause and the step is not projected, so
-// run_staircase reports a missing reading at that concurrency instead of judging three ranks as four.
-fn v41_project_step(run_id: NonEmptyStr, concurrency: Nat, before: V41StepPressure, after: V41StepPressure, before_body: String, after_body: String, latency: ClientBenchLatency) -> V41StepProjection {
-  let pairs = v41_rank_pairs(before: before, after: after)
-  let causes = concat(v41_unread_causes(p: before, phase: "before"), v41_unread_causes(p: after, phase: "after"))
-  let expected = length(fabric_group_hosts(g: FabricGroupA))
-  if length(causes) != 0 || length(pairs) != expected {
-    V41StepUnprojected { concurrency: concurrency, causes: if length(causes) != 0 { causes } else { [join(["read ", to_string(length(pairs)), " of ", to_string(expected), " ranks on both sides"], "")] } }
-  } else {
-    match v41_worst(pairs: pairs, severity: v41_refault_severity) {
-      Absent => V41StepUnprojected { concurrency: concurrency, causes: ["no rank was read"] }
-      Present { value: rf } => match v41_worst(pairs: pairs, severity: v41_psi_severity) {
-        Absent => V41StepUnprojected { concurrency: concurrency, causes: ["no rank was read"] }
-        Present { value: ps } => match v41_worst(pairs: pairs, severity: v41_nvme_severity) {
-          Absent => V41StepUnprojected { concurrency: concurrency, causes: ["no rank was read"] }
-          Present { value: nv } => V41StepProjected { reading: V41StaircaseStepReading {
-            run_id: run_id,
-            concurrency: concurrency,
-            preemptions: v41_preemption_delta(before_body: before_body, after_body: after_body),
-            refault_file_before: rf.before.refault_file,
-            refault_file_after: rf.after.refault_file,
-            memory_pressure_before: ps.before.psi,
-            memory_pressure_after: ps.after.psi,
-            nvme_before: nv.before.nvme,
-            nvme_after: nv.after.nvme,
-            latency: latency,
-          } }
-        }
-      }
-    }
-  }
-}
-
-// The step's staircase level is the concurrency its own request carries; a request with none names
-// no level and refuses rather than being judged at a made-up one.
-fn v41_project_for_request(run_id: NonEmptyStr, req: VllmBenchServeRequest, before: V41StepPressure, after: V41StepPressure, before_body: String, after_body: String, latency: ClientBenchLatency) -> V41StepProjection {
-  match req.max_concurrency {
-    Absent => V41StepConcurrencyUnbound { cause: "the step's request carried no max_concurrency, so it names no staircase level and is judged at none" }
-    Present { value: c } => v41_project_step(
-      run_id: run_id, concurrency: c, before: before, after: after,
-      before_body: before_body, after_body: after_body, latency: latency,
-    )
-  }
-}
-
-fn v41_project_record(run_id: NonEmptyStr, r: ServingLoadStepRecord<V41StepPressure>) -> V41StepProjection {
-  v41_project_for_request(
-    run_id: run_id, req: r.request, before: r.host_before, after: r.host_after,
-    before_body: r.before_body, after_body: r.after_body,
-    latency: bench_serve_latency(e: r.bench, window: r.observation.window),
-  )
-}
-
-fn v41_projection_text(p: V41StepProjection) -> String {
-  match p {
-    V41StepProjected { reading: r } => join(["x", to_string(r.concurrency), ": step reading formed (worst rank per stop rule)"], "")
-    V41StepUnprojected { concurrency: c, causes: cs } => join(["x", to_string(c), ": NO step reading (run_staircase reports it missing): ", join(cs, "; ")], "")
-    V41StepConcurrencyUnbound { cause: why } => join(["a step with no staircase level: NO step reading: ", why], "")
-  }
-}
-
-fn v41_projected_readings(ps: List<V41StepProjection>) -> List<V41StaircaseStepReading> {
-  flat_map(ps, p => match p {
-    V41StepProjected { reading: r } => [r]
-    V41StepUnprojected { concurrency: _, causes: _ } => [] as List<V41StaircaseStepReading>
-    V41StepConcurrencyUnbound { cause: _ } => [] as List<V41StaircaseStepReading>
-  })
-}
-
-// ── THE WET ENTRY (fleet-converge mode spark_v41_serving_load) ──────────────────────────────────
-//
-// The session host is the dispatch's target and must be the head; any other host refuses, because
-// the bench and the scrape address 127.0.0.1 on the session host. Exit zero means every step was
-// observed and the staircase ran; its verdict (a capacity or a stop) is in the receipt, not the exit.
-fn v41_serving_load_session(run_id: NonEmptyStr, ctx: SparkMaterializeContext) -> SparkBuildHostWork {
-  match v41_serving_load_subject() {
-   Absent => SparkBuildHostWork { receipt: "v41 serving-load refused: the V4.1 measurement shape's cold intent refused, so no launched profile exists to measure\n", converged: false }
-   Present { value: subject } =>
-  match serving_load_records(ctx: ctx, subject: subject, steps: v41_serving_load_steps(), host_read: v41_read_step_pressure) {
-    ServingLoadRunRefused { reason: r } => SparkBuildHostWork { receipt: join(["v41 serving-load refused: ", r, "\n"], ""), converged: false }
-    ServingLoadRunObserved { records: rs } => {
-      let projections = map(rs, r => v41_project_record(run_id: run_id, r: r))
-      let staircase = v41_run_staircase(policy: v41_capacity_policy, run_id: run_id, steps: v41_projected_readings(ps: projections))
-      let extra = join([
-        "run_id: ", run_id as String, "\n",
-        join(map(projections, p => join([v41_projection_text(p: p), "\n"], "")), ""),
-        "sla_sustainable: ", v41_capacity_wire(c: v41_sla_capacity(o: staircase)), "\n",
-        "ttft gate: ", v41_ttft_gate_frontier, "\n",
-      ], "")
-      SparkBuildHostWork { receipt: serving_load_receipt_body(subject: subject, records: rs, extra: extra), converged: true }
-    }
-  }
-  }
-}
-
-fn v41_serving_load_ci_wet() -> ProcessExit
-{
-  let now_word = probed_at_word(reading: clock_now_probed_at()) as String
-  let run_id = join(["v41-serving-load-", now_word], "") as NonEmptyStr
-  match spark_converge_target_selection(execute_apply: true) {
-    SparkConvergeTargetRefused { reason: why } => exit_failure(reason: why)
-    SparkConvergeTargetAllObserveOnly =>
-      exit_failure(reason: "SPARK_CONVERGE_TARGET is unset: the serving-load run opens its session on the V4.1 head, and it refuses rather than choosing one")
-    SparkConvergeTargetSingle { host: session_host } =>
-      if (session_host as String) != (v41_serving_load_head as String) {
-        exit_failure(reason: join(["SPARK_CONVERGE_TARGET ", session_host as String, " is not the V4.1 head ", v41_serving_load_head as String, "; the bench and the scrape address the head's loopback"], ""))
-      } else {
-        match with_spark_build_host(
-          host: v41_serving_load_head,
-          attempt_raw: v41_serving_load_attempt_raw,
-          identity_file_name: "gunbc-v41-serving-load-admin-password" as NonEmptyStr,
-          use: fn(target, context, ctx) { v41_serving_load_session(run_id: run_id, ctx: ctx) },
-        ) {
-          SparkBuildHostRefused { cause: c } => exit_failure(reason: c)
-          SparkBuildHostRan { work: work, endpoint: _, executor: _, trust_receipt: _ } => {
-            let w = Filesystem.Write(path: v41_serving_load_receipt_path, content: work.receipt)
-            if !w.success {
-              exit_failure(reason: join(["v41 serving-load receipt write failed: ", w.error, "\n", work.receipt], ""))
-            } else if work.converged {
-              ExitSuccess
-            } else {
-              exit_failure(reason: work.receipt)
-            }
-          }
-        }
-      }
-  }
-}
diff --git a/dag/gunbc/spark/v41_source_patch_converge.dag b/dag/gunbc/spark/v41_source_patch_converge.dag
deleted file mode 100644
index 6d5d491b0f7..00000000000
--- a/dag/gunbc/spark/v41_source_patch_converge.dag
+++ /dev/null
@@ -1,785 +0,0 @@
-module gunbc.spark.v41_source_patch_converge
-
-import std.algebra { trim }
-import std.types { String, Bool, List, NonEmptyStr, FilePath, GitRef }
-import std.content_hash { ContentHash, Sha256Digest, sha256_hex_digest }
-import std.artifact_store { ArtifactRealizationInput }
-import std.optional { Present, Absent }
-import std.upsert_decision { UpsertDecision, Noop, Apply, Refuse }
-import std.realization_reconcile {
-  ReconciledEffect, Application, Applied, NotApplied,
-  ReadObserved, Grounding, Grounds, DoesNotGround,
-  reconcile_effect, classify_reconciled, EffectConverged, EffectNotConverged,
-}
-import extdeps.vllm.server { VllmSourceRevision }
-import extdeps.vllm.source_build { VllmContainerBuildRecipe }
-import extdeps.crypto.hash { sha256sum_line_digest, sha256sum_file_command }
-import extdeps.tools.sha256sum { Sha256FileDigest, Sha256FileDigestUnavailable, sha256sum_stdin_digest_via_shell }
-import extdeps.filesystem.filesystem_io { Filesystem, filesystem_read_outcome, FilesystemReadSucceeded, FilesystemReadRefused }
-import extdeps.git {
-  git_apply_check_command, git_apply_reverse_check_command, git_apply_command, git_diff_binary_head_command,
-  git_status_porcelain_command, git_reset_hard_command,
-  git_worktree_add_detached_command, git_worktree_remove_force_command, git_worktree_prune_command,
-}
-import extdeps.git
-import extdeps.shell
-import extdeps.tools.gnu_coreutils { cat_command }
-import extdeps.tools.mkdir { mkdir_parents_command_at, mkdir_path_resolved_program }
-import gunbc.file_access { FileTreeScope }
-import gunbc.typed_remote_file_write {
-  typed_remote_file_write_seal, TypedRemoteFileWriteAdmitted, TypedRemoteFileWriteAdmissionRefused,
-  converge_typed_remote_file, TypedRemoteFileConverged, TypedRemoteFileConvergenceRefused,
-  RemoteFileModeOwnerReadWrite, RemoteFileAsSessionPrincipal,
-}
-import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext, SshTarget }
-import gunbc.spark.v41_runtime_candidate { V41EnginePatch, v41_patch_applicability_defects }
-import gunbc.spark.v41_identity_input { v41_input }
-import gunbc.spark.vllm_runtime_image_build {
-  VllmSourceState, VllmSourceAtRevision, VllmSourceRefused, VllmImageBuild, VllmImageBuildRefused,
-  ImageLegRan, ImageLegFailed, ImageUncheckedRan, ImageUncheckedFailed,
-  VllmWorkingTreeMayBeDirty,
-  vllm_source_dir, vllm_build_root, vllm_source_head, vllm_source_is_clean,
-  vllm_image_leg, vllm_image_leg_unchecked, vllm_image_build_key_with_observed_tree, converge_vllm_image_keyed,
-  converge_vllm_source_to_revision,
-}
-import gunbc.spark.model_snapshot_materialize { SparkMaterializeContext }
-
-// SOURCE CONVERGE'S SECOND DESIRED COMPONENT. converge_vllm_source already converges a checkout
-// onto revision R. This is that desired state grown by caller-supplied ordered population P — not
-// a second decision algebra. std.upsert_decision already has Noop | Apply | Refuse;
-// std.realization_reconcile consumes it. Selection of which patches stays in the candidate model;
-// this fold never chooses P.
-
-// reset_to_revision_first: the tree carries exactly the tree THIS fold last converged (its diff
-// digest equals the recorded one) and that tree is not the desired P -- a patch-set change. Only
-// then may the fold reset tracked changes to the pin before applying; a dirty tree it cannot
-// identify as its own still refuses.
-type V41SourcePatchPlan sole_constructor {
-  patches: List<V41EnginePatch>
-  reset_to_revision_first: Bool
-}
-
-fn v41_source_patch_plan(patches: List<V41EnginePatch>) -> V41SourcePatchPlan {
-  V41SourcePatchPlan { patches: patches, reset_to_revision_first: false }
-}
-
-type V41ObservedSourceIdentity sole_constructor {
-  revision_head: NonEmptyStr
-  worktree_diff_sha256: Sha256Digest
-}
-
-fn v41_observed_source_identity_of(revision_head: NonEmptyStr, worktree_diff_sha256: Sha256Digest) -> V41ObservedSourceIdentity {
-  V41ObservedSourceIdentity { revision_head: revision_head, worktree_diff_sha256: worktree_diff_sha256 }
-}
-
-type V41PatchMemberRead sole_constructor {
-  path: NonEmptyStr
-  observed_sha256: Sha256Digest
-  reverse_applicable: Bool
-  forward_applicable: Bool
-}
-
-fn v41_patch_member_read(path: NonEmptyStr, observed_sha256: Sha256Digest, reverse_applicable: Bool, forward_applicable: Bool) -> V41PatchMemberRead {
-  V41PatchMemberRead { path: path, observed_sha256: observed_sha256, reverse_applicable: reverse_applicable, forward_applicable: forward_applicable }
-}
-
-// OWNERSHIP OF A DIRTY TREE IS PROVEN BY CONTENT. A dirty tree is this fold's to reset only when
-// its diff digest equals the diff digest of a tree this fold can derive:
-// - recorded_converged_diff_sha256: the digest recorded at the last successful converge (a fast
-//   path; Absent when no record exists, e.g. a tree converged before the record existed);
-// - known_set_diff_sha256s: the digests of pin + P' for every patch set P' this repository has
-//   declared (each revision in the history of the declared patch files), each derived by applying
-//   P' in a disposable worktree at the pin. Empty when not derived.
-// Anything else -- a foreign edit, an unknown set -- matches neither and refuses.
-type V41SourceTreeRead sole_constructor {
-  head: NonEmptyStr
-  porcelain: String
-  worktree_diff_sha256: Sha256Digest
-  members: List<V41PatchMemberRead>
-  recorded_converged_diff_sha256: Sha256Digest?
-  known_set_diff_sha256s: List<Sha256Digest>
-}
-
-fn v41_source_tree_read(head: NonEmptyStr, porcelain: String, worktree_diff_sha256: Sha256Digest, members: List<V41PatchMemberRead>, recorded_converged_diff_sha256: Sha256Digest?, known_set_diff_sha256s: List<Sha256Digest>) -> V41SourceTreeRead {
-  V41SourceTreeRead { head: head, porcelain: porcelain, worktree_diff_sha256: worktree_diff_sha256, members: members, recorded_converged_diff_sha256: recorded_converged_diff_sha256, known_set_diff_sha256s: known_set_diff_sha256s }
-}
-
-fn v41_tree_matches_record(read: V41SourceTreeRead) -> Bool {
-  match read.recorded_converged_diff_sha256 {
-    Absent => false
-    Present { value: rec } => v41_sha256_hex_eq(a: rec, b: read.worktree_diff_sha256)
-  }
-}
-
-fn v41_tree_is_ours(read: V41SourceTreeRead) -> Bool {
-  v41_tree_matches_record(read: read)
-    || any(read.known_set_diff_sha256s, d => v41_sha256_hex_eq(a: d, b: read.worktree_diff_sha256))
-}
-
-fn v41_with_known_set_digests(read: V41SourceTreeRead, digests: List<Sha256Digest>) -> V41SourceTreeRead {
-  V41SourceTreeRead { head: read.head, porcelain: read.porcelain, worktree_diff_sha256: read.worktree_diff_sha256, members: read.members, recorded_converged_diff_sha256: read.recorded_converged_diff_sha256, known_set_diff_sha256s: digests }
-}
-
-fn v41_sha256_hex_eq(a: Sha256Digest, b: Sha256Digest) -> Bool {
-  (a.hex as String) == (b.hex as String)
-}
-
-fn v41_member_named(members: List<V41PatchMemberRead>, path: NonEmptyStr) -> V41PatchMemberRead? {
-  match filter(members, m => (m.path as String) == (path as String)).first() {
-    Absent => none
-    Present { value: m } => Present { value: m }
-  }
-}
-
-fn v41_porcelain_has_untracked(porcelain: String) -> Bool {
-  any(split(s: porcelain, delimiter: "\n"), line => {
-    let t = trim(s: line)
-    t.starts_with(prefix: "??") || t.starts_with(prefix: "!!")
-  })
-}
-
-fn v41_sha256_of_bytes(content: String) -> Sha256Digest? {
-  match sha256sum_stdin_digest_via_shell(content: content) {
-    Sha256FileDigestUnavailable { path: _, reason: _ } => none
-    Sha256FileDigest { digest: d } => sha256_hex_digest(hex: d.hex as String)
-  }
-}
-
-fn v41_observed_source_identity(read: V41SourceTreeRead) -> V41ObservedSourceIdentity {
-  V41ObservedSourceIdentity { revision_head: read.head, worktree_diff_sha256: read.worktree_diff_sha256 }
-}
-
-fn v41_source_patch_decision(
-  desired_revision: VllmSourceRevision,
-  desired_patches: List<V41EnginePatch>,
-  read: V41SourceTreeRead,
-) -> UpsertDecision<V41SourcePatchPlan> {
-  if (read.head as String) != (desired_revision.full_revision as String) {
-    Refuse { reason: join(["wrong revision: HEAD reads ", read.head as String, " and desired is ", desired_revision.full_revision as String], "") as NonEmptyStr }
-  } else {
-    let applicability = v41_patch_applicability_defects(patches: desired_patches, source: desired_revision)
-    if length(applicability) != 0 {
-      Refuse { reason: join(map(applicability, d => d as String), "; ") as NonEmptyStr }
-    } else {
-      let missing = filter(desired_patches, p => match v41_member_named(members: read.members, path: p.path) {
-        Absent => true
-        Present { value: _ } => false
-      })
-      if length(missing) != 0 {
-        Refuse { reason: join(["digest observation missing for ", join(map(missing, p => p.path as String), ", ")], "") as NonEmptyStr }
-      } else {
-        let digest_mismatches = filter(desired_patches, p => match v41_member_named(members: read.members, path: p.path) {
-          Absent => true
-          Present { value: m } => !v41_sha256_hex_eq(a: m.observed_sha256, b: p.sha256)
-        })
-        if length(digest_mismatches) != 0 {
-          Refuse { reason: join(["digest mismatch: ", join(map(digest_mismatches, p => p.path as String), ", ")], "") as NonEmptyStr }
-        } else if v41_porcelain_has_untracked(porcelain: read.porcelain) {
-          Refuse { reason: "untracked paths are not in git diff --binary HEAD, so a tree identity hashed from that diff would omit them" as NonEmptyStr }
-        } else if length(desired_patches) == 0 {
-          if vllm_source_is_clean(stdout: read.porcelain) {
-            Noop
-          } else if v41_tree_is_ours(read: read) {
-            Apply { plan: V41SourcePatchPlan { patches: desired_patches, reset_to_revision_first: true } }
-          } else {
-            Refuse { reason: "vanilla desired state requires a clean tree at the revision; a dirty tree is not an unpatched checkout" as NonEmptyStr }
-          }
-        } else {
-          let reverse_ok = filter(desired_patches, p => match v41_member_named(members: read.members, path: p.path) {
-            Absent => false
-            Present { value: m } => m.reverse_applicable
-          })
-          let forward_ok = filter(desired_patches, p => match v41_member_named(members: read.members, path: p.path) {
-            Absent => false
-            Present { value: m } => m.forward_applicable
-          })
-          let n = length(desired_patches)
-          if length(reverse_ok) == n {
-            if length(forward_ok) == 0 {
-              Noop
-            } else {
-              Refuse { reason: "partial application: every patch reverses but at least one still applies forward, so the tree is not a completed P and not a clean R" as NonEmptyStr }
-            }
-          } else if length(forward_ok) == n && vllm_source_is_clean(stdout: read.porcelain) {
-            Apply { plan: V41SourcePatchPlan { patches: desired_patches, reset_to_revision_first: false } }
-          } else if v41_tree_is_ours(read: read) {
-            Apply { plan: V41SourcePatchPlan { patches: desired_patches, reset_to_revision_first: true } }
-          } else if length(reverse_ok) != 0 || length(forward_ok) != 0 {
-            Refuse { reason: "partial application: some patches in P are present and some are not, and the tree's diff digest matches neither the converge record nor any declared patch set at the pin, so it is not ours to reset" as NonEmptyStr }
-          } else {
-            Refuse { reason: "patches are neither applicable to a clean tree nor already present in reverse order, and the tree's diff digest matches neither the converge record nor any declared patch set at the pin, so it is not ours to reset" as NonEmptyStr }
-          }
-        }
-      }
-    }
-  }
-}
-
-fn v41_source_patch_after_grounds(
-  desired_revision: VllmSourceRevision,
-  desired_patches: List<V41EnginePatch>,
-  after: V41SourceTreeRead,
-) -> Grounding<V41ObservedSourceIdentity> {
-  match v41_source_patch_decision(desired_revision: desired_revision, desired_patches: desired_patches, read: after) {
-    Noop => Grounds { evidence: v41_observed_source_identity(read: after) }
-    Apply { plan: _ } => DoesNotGround { reason: "after-read still wants Apply; the tree does not yet carry P" }
-    Refuse { reason: why } => DoesNotGround { reason: why as String }
-  }
-}
-
-fn v41_source_patch_reconcile(
-  decision: UpsertDecision<V41SourcePatchPlan>,
-  application: Application,
-  desired_revision: VllmSourceRevision,
-  desired_patches: List<V41EnginePatch>,
-  after: V41SourceTreeRead,
-) -> ReconciledEffect<V41SourcePatchPlan, V41ObservedSourceIdentity> {
-  reconcile_effect(
-    decision: decision,
-    application: application,
-    show_read: ReadObserved { value: after },
-    grounding: v41_source_patch_after_grounds(desired_revision: desired_revision, desired_patches: desired_patches, after: after),
-  )
-}
-
-fn v41_patch_basename(path: NonEmptyStr) -> String {
-  let parts = split(s: path as String, delimiter: "/")
-  match get(xs: parts, index: length(parts) - 1) {
-    Absent => path as String
-    Present { value: leaf } => leaf
-  }
-}
-
-fn v41_remote_declared_patch_path(path: NonEmptyStr) -> NonEmptyStr {
-  join([vllm_build_root() as String, "/declared-patches/", v41_patch_basename(path: path)], "") as NonEmptyStr
-}
-
-fn v41_place_bytes(target: SshTarget, context: FleetSshExecutionContext, remote_path: NonEmptyStr, bytes: String) -> String?
-{
-  let admission = typed_remote_file_write_seal(
-    path: remote_path as FilePath,
-    content: bytes,
-    allowed_scope: FileTreeScope { root_path: vllm_build_root() },
-  )
-  match admission {
-    TypedRemoteFileWriteAdmissionRefused { cause: why } => Present { value: why as String }
-    TypedRemoteFileWriteAdmitted { write: _ } =>
-      match converge_typed_remote_file(
-        target: target,
-        context: context,
-        admission: admission,
-        mode: RemoteFileModeOwnerReadWrite,
-        privilege: RemoteFileAsSessionPrincipal,
-      ) {
-        TypedRemoteFileConvergenceRefused { step: st, reason: why } => Present { value: join(["placing ", remote_path as String, " failed at ", st, ": ", why], "") }
-        TypedRemoteFileConverged { converged: _ } => none
-      }
-  }
-}
-
-fn v41_place_declared_patch(target: SshTarget, context: FleetSshExecutionContext, patch: V41EnginePatch) -> String?
-{
-  let local = Filesystem.Read(path: patch.path as String)
-  match filesystem_read_outcome(content: local.content, success: local.success, error: local.error) {
-    FilesystemReadRefused { error: why } => Present { value: join(["could not read declared patch ", patch.path as String, ": ", why], "") }
-    FilesystemReadSucceeded { content: bytes } => v41_place_bytes(target: target, context: context, remote_path: v41_remote_declared_patch_path(path: patch.path), bytes: bytes)
-  }
-}
-
-fn v41_check_applicable(target: SshTarget, context: FleetSshExecutionContext, reverse: Bool, patch: V41EnginePatch) -> Bool?
-{
-  let remote = v41_remote_declared_patch_path(path: patch.path) as String
-  let cmd = if reverse {
-    git_apply_reverse_check_command(repository_dir: vllm_source_dir() as String, patch_path: remote)
-  } else {
-    git_apply_check_command(repository_dir: vllm_source_dir() as String, patch_path: remote)
-  }
-  let step = (if reverse { "patch-reverse-check" } else { "patch-forward-check" }) as NonEmptyStr
-  match vllm_image_leg_unchecked(target: target, context: context, step: step, command: cmd) {
-    ImageUncheckedFailed { step: _, cause: _ } => none
-    ImageUncheckedRan { exit_code: code, stdout: _, stderr: _ } =>
-      if code == 0 {
-        Present { value: true }
-      } else if code == 1 {
-        Present { value: false }
-      } else {
-        none
-      }
-  }
-}
-
-fn v41_observe_member(target: SshTarget, context: FleetSshExecutionContext, patch: V41EnginePatch) -> V41PatchMemberRead?
-{
-  match v41_place_declared_patch(target: target, context: context, patch: patch) {
-    Present { value: _ } => none
-    Absent =>
-      match vllm_image_leg(
-        target: target,
-        context: context,
-        step: "declared-patch-digest" as NonEmptyStr,
-        command: sha256sum_file_command(path: v41_remote_declared_patch_path(path: patch.path) as String),
-      ) {
-        ImageLegFailed { step: _, cause: _ } => none
-        ImageLegRan { stdout: line } =>
-          match sha256sum_line_digest(line: line) {
-            Absent => none
-            Present { value: d } =>
-              match sha256_hex_digest(hex: d.hex as String) {
-                Absent => none
-                Present { value: observed } =>
-                  match v41_check_applicable(target: target, context: context, reverse: true, patch: patch) {
-                    Absent => none
-                    Present { value: rev } =>
-                      match v41_check_applicable(target: target, context: context, reverse: false, patch: patch) {
-                        Absent => none
-                        Present { value: fwd } => Present { value: V41PatchMemberRead {
-                          path: patch.path,
-                          observed_sha256: observed,
-                          reverse_applicable: rev,
-                          forward_applicable: fwd,
-                        } }
-                      }
-                  }
-              }
-          }
-      }
-  }
-}
-
-fn v41_observe_members(target: SshTarget, context: FleetSshExecutionContext, patches: List<V41EnginePatch>) -> List<V41PatchMemberRead>?
-{
-  let rows = map(patches, p => v41_observe_member(target: target, context: context, patch: p))
-  if any(rows, r => match r { Absent => true Present { value: _ } => false }) {
-    none
-  } else {
-    Present { value: flat_map(rows, r => match r { Absent => [] as List<V41PatchMemberRead> Present { value: m } => [m] }) }
-  }
-}
-
-fn v41_converge_record_path() -> NonEmptyStr {
-  join([vllm_build_root() as String, "/declared-patches/converged-tree.sha256"], "") as NonEmptyStr
-}
-
-type V41ConvergeRecordRead
-  = V41ConvergeRecordObserved { recorded: Sha256Digest? }
-  | V41ConvergeRecordUnreadable
-
-// cat(1) exits 1 on a missing file: that is the no-record observation. Any other failure, or a
-// record whose bytes are not a sha256 hex, is unreadable -- never read as "no record".
-fn v41_read_converge_record(target: SshTarget, context: FleetSshExecutionContext) -> V41ConvergeRecordRead
-{
-  match vllm_image_leg_unchecked(target: target, context: context, step: "converge-record-read" as NonEmptyStr, command: cat_command(path: v41_converge_record_path() as String)) {
-    ImageUncheckedFailed { step: _, cause: _ } => V41ConvergeRecordUnreadable
-    ImageUncheckedRan { exit_code: code, stdout: out, stderr: _ } =>
-      if code == 1 {
-        V41ConvergeRecordObserved { recorded: none }
-      } else if code != 0 {
-        V41ConvergeRecordUnreadable
-      } else {
-        match sha256_hex_digest(hex: trim(s: out)) {
-          Absent => V41ConvergeRecordUnreadable
-          Present { value: d } => V41ConvergeRecordObserved { recorded: Present { value: d } }
-        }
-      }
-  }
-}
-
-fn v41_write_converge_record(target: SshTarget, context: FleetSshExecutionContext, observed: V41ObservedSourceIdentity) -> String?
-{
-  v41_place_bytes(target: target, context: context, remote_path: v41_converge_record_path(), bytes: join([observed.worktree_diff_sha256.hex as String, "\n"], ""))
-}
-
-// THE DECLARED PATCH SETS, FROM THIS REPOSITORY'S HISTORY. P' at revision C is the desired
-// population's member paths, in the desired order, at their bytes in C. A revision where some
-// member path is absent declares no set over these members and contributes none. Enumerating
-// needs history (fleet-converge checks out with fetch-depth 0); a shallow clone answers fewer
-// sets, which can only refuse more, never reset more.
-type V41KnownPatchSet sole_constructor {
-  revision: String
-  members: List<V41KnownPatchMember>
-}
-
-type V41KnownPatchMember sole_constructor {
-  basename: String
-  bytes: String
-}
-
-fn v41_known_patch_set_revisions(patches: List<V41EnginePatch>) -> List<String> {
-  fold(flat_map(patches, p => map(git.Core.LogPathCommits(path: p.path as FilePath).commits, c => c as String)), init: [] as List<String>, f: (acc, c) =>
-    if any(acc, a => a == c) { acc } else { concat(acc, [c]) })
-}
-
-// P' IS READ BYTE-EXACTLY. git.Core.Show carries the blob through the shell stdout channel, whose
-// retained text is trailing-whitespace trimmed; a patch ending in blank context lines (" \n \n")
-// comes back short, git apply refuses it as corrupt, and the set silently contributes no digest --
-// which is how srv8's arm A tree (pin + the 034aef01 set, the set main 77193e6a carried; diff
-// digest 0f979787...) was refused as not ours. Each member is instead restored to a scratch work
-// tree (index untouched) and read with Filesystem.Read, the same read the declared patch takes.
-fn v41_known_patch_member_at(revision: String, path: NonEmptyStr, work_tree: String) -> V41KnownPatchMember? {
-  let restored = git.Core.RestoreBlobTo(ref: revision as GitRef, path: path as FilePath, work_tree: work_tree as FilePath)
-  if !restored.success {
-    none
-  } else {
-    let read = Filesystem.Read(path: join([work_tree, "/", path as String], ""))
-    match filesystem_read_outcome(content: read.content, success: read.success, error: read.error) {
-      FilesystemReadRefused { error: _ } => none
-      FilesystemReadSucceeded { content: bytes } => Present { value: V41KnownPatchMember { basename: v41_patch_basename(path: path), bytes: bytes } }
-    }
-  }
-}
-
-fn v41_known_patch_set_at(revision: String, patches: List<V41EnginePatch>, work_tree: String) -> V41KnownPatchSet? {
-  let shown = map(patches, p => v41_known_patch_member_at(revision: revision, path: p.path, work_tree: work_tree))
-  if length(patches) == 0 || any(shown, m => match m { Absent => true Present { value: _ } => false }) {
-    none
-  } else {
-    Present { value: V41KnownPatchSet {
-      revision: revision,
-      members: flat_map(shown, m => match m { Absent => [] as List<V41KnownPatchMember> Present { value: v } => [v] }),
-    } }
-  }
-}
-
-// A scratch work tree that cannot be made derives no set: fewer sets can only refuse more.
-fn v41_known_patch_sets(patches: List<V41EnginePatch>) -> List<V41KnownPatchSet> {
-  let scratch = shell.Mktemp.Dir()
-  if !scratch.success {
-    [] as List<V41KnownPatchSet>
-  } else {
-    let sets = flat_map(v41_known_patch_set_revisions(patches: patches), c => match v41_known_patch_set_at(revision: c, patches: patches, work_tree: scratch.path as String) {
-      Absent => [] as List<V41KnownPatchSet>
-      Present { value: k } => [k]
-    })
-    let _cleaned = shell.Remove.RecursiveForce(path: scratch.path)
-    sets
-  }
-}
-
-fn v41_known_set_scratch_dir() -> String {
-  join([vllm_build_root() as String, "/known-set-scratch"], "")
-}
-
-fn v41_known_set_patch_path(k: V41KnownPatchSet, m: V41KnownPatchMember) -> NonEmptyStr {
-  join([vllm_build_root() as String, "/known-patches/", k.revision, "/", m.basename], "") as NonEmptyStr
-}
-
-// pin + P' IN A DISPOSABLE WORKTREE, hashed exactly as the primary tree is (git diff --binary
-// HEAD after git apply --index), so the two digests are the same function of the same content.
-// The primary tree is never touched. A set that cannot be derived is not evidence: none.
-fn v41_known_set_diff_digest(target: SshTarget, context: FleetSshExecutionContext, desired_revision: VllmSourceRevision, k: V41KnownPatchSet) -> Sha256Digest?
-{
-  let placed = map(k.members, m => v41_place_bytes(target: target, context: context, remote_path: v41_known_set_patch_path(k: k, m: m), bytes: m.bytes))
-  if any(placed, e => match e { Absent => false Present { value: _ } => true }) {
-    none
-  } else {
-    let repo = vllm_source_dir() as String
-    let scratch = v41_known_set_scratch_dir()
-    let _cleared = vllm_image_leg_unchecked(target: target, context: context, step: "known-set-scratch-clear" as NonEmptyStr, command: git_worktree_remove_force_command(repository_dir: repo, path: scratch))
-    let _pruned = vllm_image_leg_unchecked(target: target, context: context, step: "known-set-scratch-prune" as NonEmptyStr, command: git_worktree_prune_command(repository_dir: repo))
-    let digest = match vllm_image_leg(target: target, context: context, step: "known-set-scratch-add" as NonEmptyStr, command: git_worktree_add_detached_command(repository_dir: repo, path: scratch, revision: desired_revision.full_revision as String)) {
-      ImageLegFailed { step: _, cause: _ } => none
-      ImageLegRan { stdout: _ } => {
-        let applied = fold(k.members, init: true, f: (ok, m) =>
-          ok && match vllm_image_leg(target: target, context: context, step: "known-set-apply" as NonEmptyStr, command: git_apply_command(repository_dir: scratch, patch_path: v41_known_set_patch_path(k: k, m: m) as String)) {
-            ImageLegRan { stdout: _ } => true
-            ImageLegFailed { step: _, cause: _ } => false
-          })
-        if !applied {
-          none
-        } else {
-          match vllm_image_leg(target: target, context: context, step: "known-set-diff" as NonEmptyStr, command: git_diff_binary_head_command(repository_dir: scratch)) {
-            ImageLegFailed { step: _, cause: _ } => none
-            ImageLegRan { stdout: diff } => v41_sha256_of_bytes(content: diff)
-          }
-        }
-      }
-    }
-    let _removed = vllm_image_leg_unchecked(target: target, context: context, step: "known-set-scratch-remove" as NonEmptyStr, command: git_worktree_remove_force_command(repository_dir: repo, path: scratch))
-    digest
-  }
-}
-
-fn v41_known_set_diff_digests(target: SshTarget, context: FleetSshExecutionContext, desired_revision: VllmSourceRevision, patches: List<V41EnginePatch>) -> List<Sha256Digest>
-{
-  flat_map(v41_known_patch_sets(patches: patches), k => match v41_known_set_diff_digest(target: target, context: context, desired_revision: desired_revision, k: k) {
-    Absent => [] as List<Sha256Digest>
-    Present { value: d } => [d]
-  })
-}
-
-// Derive the known-set digests only where ownership is the one fact the decision still lacks:
-// the read is not yet proven ours, and the SAME decision over the same read with ownership granted
-// would reset. Asked of the decision's structure (its Apply arm), never of its refusal wording.
-fn v41_needs_content_ownership(desired_revision: VllmSourceRevision, desired_patches: List<V41EnginePatch>, read: V41SourceTreeRead) -> Bool {
-  if v41_tree_is_ours(read: read) {
-    false
-  } else {
-    match v41_source_patch_decision(desired_revision: desired_revision, desired_patches: desired_patches, read: v41_with_known_set_digests(read: read, digests: [read.worktree_diff_sha256])) {
-      Apply { plan: p } => p.reset_to_revision_first
-      Noop => false
-      Refuse { reason: _ } => false
-    }
-  }
-}
-
-fn v41_observe_tree(target: SshTarget, context: FleetSshExecutionContext, desired_patches: List<V41EnginePatch>) -> V41SourceTreeRead?
-{
-  match vllm_source_head(target: target, context: context) {
-    Absent => none
-    Present { value: head } =>
-      match vllm_image_leg(target: target, context: context, step: "source-porcelain" as NonEmptyStr, command: git_status_porcelain_command(repository_dir: vllm_source_dir() as String)) {
-        ImageLegFailed { step: _, cause: _ } => none
-        ImageLegRan { stdout: porcelain } =>
-          match vllm_image_leg(target: target, context: context, step: "source-diff" as NonEmptyStr, command: git_diff_binary_head_command(repository_dir: vllm_source_dir() as String)) {
-            ImageLegFailed { step: _, cause: _ } => none
-            ImageLegRan { stdout: diff } =>
-              match v41_sha256_of_bytes(content: diff) {
-                Absent => none
-                Present { value: diff_sha } =>
-                  match v41_observe_members(target: target, context: context, patches: desired_patches) {
-                    Absent => none
-                    Present { value: members } =>
-                      match v41_read_converge_record(target: target, context: context) {
-                        V41ConvergeRecordUnreadable => none
-                        V41ConvergeRecordObserved { recorded: rec } => Present { value: V41SourceTreeRead {
-                          head: head as NonEmptyStr,
-                          porcelain: porcelain,
-                          worktree_diff_sha256: diff_sha,
-                          members: members,
-                          recorded_converged_diff_sha256: rec,
-                          known_set_diff_sha256s: [] as List<Sha256Digest>,
-                        } }
-                      }
-                  }
-              }
-          }
-      }
-  }
-}
-
-fn v41_apply_plan(target: SshTarget, context: FleetSshExecutionContext, plan: V41SourcePatchPlan) -> String?
-{
-  fold(plan.patches, init: none, f: (acc, p) => match acc {
-    Present { value: _ } => acc
-    Absent =>
-      match vllm_image_leg(
-        target: target,
-        context: context,
-        step: "patch-apply" as NonEmptyStr,
-        command: git_apply_command(repository_dir: vllm_source_dir() as String, patch_path: v41_remote_declared_patch_path(path: p.path) as String),
-      ) {
-        ImageLegRan { stdout: _ } => none
-        ImageLegFailed { step: _, cause: why } => Present { value: join(["git apply refused for ", p.path as String, ": ", why], "") }
-      }
-  })
-}
-
-type V41PatchedSourceConverge
-  = V41PatchedSourceConverged { patches_already_on_tree: Bool, observed: V41ObservedSourceIdentity }
-  | V41PatchedSourceRefused { step: NonEmptyStr, cause: String }
-
-fn v41_patched_source_receipt_line(c: V41PatchedSourceConverge) -> String {
-  match c {
-    V41PatchedSourceConverged { patches_already_on_tree: p, observed: obs } =>
-      join([
-        "patched source revision=", obs.revision_head as String,
-        " patches_already_on_tree=", if p { "true" } else { "false" },
-        " worktree_diff_sha256=", obs.worktree_diff_sha256.hex as String,
-        "\n",
-      ], "")
-    V41PatchedSourceRefused { step: st, cause: why } =>
-      join(["patched source REFUSED step=", st as String, " cause=", why, "\n"], "")
-  }
-}
-
-fn v41_patched_source_converged(c: V41PatchedSourceConverge) -> Bool {
-  match c {
-    V41PatchedSourceConverged { patches_already_on_tree: _, observed: _ } => true
-    V41PatchedSourceRefused { step: _, cause: _ } => false
-  }
-}
-
-fn converge_vllm_source_with_patches(
-  target: SshTarget,
-  context: FleetSshExecutionContext,
-  r: VllmContainerBuildRecipe,
-  patches: List<V41EnginePatch>,
-) -> V41PatchedSourceConverge
-{
-  match converge_vllm_source_to_revision(target: target, context: context, r: r, working_tree: VllmWorkingTreeMayBeDirty) {
-    VllmSourceRefused { step: st, cause: why } => V41PatchedSourceRefused { step: st, cause: why }
-    VllmSourceAtRevision { revision: _, already_present: _ } =>
-      match vllm_image_leg(target: target, context: context, step: "declared-patches-dir" as NonEmptyStr, command: mkdir_parents_command_at(mkdir_binary: mkdir_path_resolved_program, path: join([vllm_build_root() as String, "/declared-patches"], ""))) {
-        ImageLegFailed { step: st, cause: why } => V41PatchedSourceRefused { step: st, cause: why }
-        ImageLegRan { stdout: _ } =>
-          match v41_observe_tree(target: target, context: context, desired_patches: patches) {
-            Absent => V41PatchedSourceRefused { step: "patch-observe" as NonEmptyStr, cause: "the tree or declared patch files could not be read back" }
-            Present { value: observed } => {
-              let before = if v41_needs_content_ownership(desired_revision: r.source, desired_patches: patches, read: observed) {
-                v41_with_known_set_digests(read: observed, digests: v41_known_set_diff_digests(target: target, context: context, desired_revision: r.source, patches: patches))
-              } else {
-                observed
-              }
-              v41_converge_from_read(target: target, context: context, r: r, patches: patches, before: before)
-            }
-          }
-      }
-  }
-}
-
-fn v41_record_converged(target: SshTarget, context: FleetSshExecutionContext, already: Bool, observed: V41ObservedSourceIdentity) -> V41PatchedSourceConverge
-{
-  match v41_write_converge_record(target: target, context: context, observed: observed) {
-    Present { value: why } => V41PatchedSourceRefused { step: "converge-record-write" as NonEmptyStr, cause: why }
-    Absent => V41PatchedSourceConverged { patches_already_on_tree: already, observed: observed }
-  }
-}
-
-// ONE DECISION OVER ONE READ. A reset plan resets tracked changes to the pin, re-observes, and
-// decides again over the fresh read through v41_converge_after_reset, which admits no second
-// reset, so a tree that still is not the desired P after one reset refuses rather than looping.
-fn v41_noop_read_back(
-  target: SshTarget,
-  context: FleetSshExecutionContext,
-  r: VllmContainerBuildRecipe,
-  patches: List<V41EnginePatch>,
-  before: V41SourceTreeRead,
-  already: Bool,
-) -> V41PatchedSourceConverge
-{
-  match classify_reconciled(r: v41_source_patch_reconcile(
-    decision: Noop, application: NotApplied, desired_revision: r.source, desired_patches: patches, after: before,
-  )) {
-    EffectNotConverged { reason: why, attempt: _ } => V41PatchedSourceRefused { step: "patch-readback" as NonEmptyStr, cause: why }
-    EffectConverged { converged: c } => v41_record_converged(target: target, context: context, already: already, observed: c.evidence)
-  }
-}
-
-fn v41_apply_and_read_back(
-  target: SshTarget,
-  context: FleetSshExecutionContext,
-  r: VllmContainerBuildRecipe,
-  patches: List<V41EnginePatch>,
-  decision: UpsertDecision<V41SourcePatchPlan>,
-  plan: V41SourcePatchPlan,
-) -> V41PatchedSourceConverge
-{
-  match v41_apply_plan(target: target, context: context, plan: plan) {
-    Present { value: why } => V41PatchedSourceRefused { step: "patch-apply" as NonEmptyStr, cause: why }
-    Absent =>
-      match v41_observe_tree(target: target, context: context, desired_patches: patches) {
-        Absent => V41PatchedSourceRefused { step: "patch-readback" as NonEmptyStr, cause: "apply reported success and the tree could not be read back" }
-        Present { value: after } =>
-          match classify_reconciled(r: v41_source_patch_reconcile(
-            decision: decision, application: Applied, desired_revision: r.source, desired_patches: patches, after: after,
-          )) {
-            EffectNotConverged { reason: why, attempt: _ } => V41PatchedSourceRefused { step: "patch-readback" as NonEmptyStr, cause: why }
-            EffectConverged { converged: c } => v41_record_converged(target: target, context: context, already: false, observed: c.evidence)
-          }
-      }
-  }
-}
-
-fn v41_converge_after_reset(
-  target: SshTarget,
-  context: FleetSshExecutionContext,
-  r: VllmContainerBuildRecipe,
-  patches: List<V41EnginePatch>,
-  before: V41SourceTreeRead,
-) -> V41PatchedSourceConverge
-{
-  let decision = v41_source_patch_decision(desired_revision: r.source, desired_patches: patches, read: before)
-  match decision {
-    Refuse { reason: why } => V41PatchedSourceRefused { step: "patch-decision" as NonEmptyStr, cause: why as String }
-    Noop => v41_noop_read_back(target: target, context: context, r: r, patches: patches, before: before, already: false)
-    Apply { plan: plan } =>
-      if plan.reset_to_revision_first {
-        V41PatchedSourceRefused { step: "patch-reset" as NonEmptyStr, cause: "the tree still asks for a reset after one reset to the pin" }
-      } else {
-        v41_apply_and_read_back(target: target, context: context, r: r, patches: patches, decision: decision, plan: plan)
-      }
-  }
-}
-
-fn v41_converge_from_read(
-  target: SshTarget,
-  context: FleetSshExecutionContext,
-  r: VllmContainerBuildRecipe,
-  patches: List<V41EnginePatch>,
-  before: V41SourceTreeRead,
-) -> V41PatchedSourceConverge
-{
-  let decision = v41_source_patch_decision(desired_revision: r.source, desired_patches: patches, read: before)
-  match decision {
-    Refuse { reason: why } => V41PatchedSourceRefused { step: "patch-decision" as NonEmptyStr, cause: why as String }
-    Noop => v41_noop_read_back(target: target, context: context, r: r, patches: patches, before: before, already: true)
-    Apply { plan: plan } =>
-      if plan.reset_to_revision_first {
-        match vllm_image_leg(
-            target: target,
-            context: context,
-            step: "patch-reset" as NonEmptyStr,
-            command: git_reset_hard_command(repository_dir: vllm_source_dir() as String, revision: r.source.full_revision as String),
-          ) {
-            ImageLegFailed { step: st, cause: why } => V41PatchedSourceRefused { step: st, cause: why }
-            ImageLegRan { stdout: _ } =>
-              match v41_observe_tree(target: target, context: context, desired_patches: patches) {
-                Absent => V41PatchedSourceRefused { step: "patch-reset-readback" as NonEmptyStr, cause: "reset reported success and the tree could not be read back" }
-                Present { value: fresh } => v41_converge_after_reset(target: target, context: context, r: r, patches: patches, before: fresh)
-              }
-          }
-      } else {
-        v41_apply_and_read_back(target: target, context: context, r: r, patches: patches, decision: decision, plan: plan)
-      }
-  }
-}
-
-// THE PATCHED IMAGE CARRIES THE TREE IT WAS BUILT FROM, because a caller that must decide whether
-// the produced bytes ARE the candidate's runtime cannot do it from the image alone. VllmImageBuild
-// answers "did an image land under this tag with this key"; what the produced-runtime admission
-// (gunbc.spark.v41_runtime_realized v41_admit_produced_runtime) additionally needs is the observed
-// source identity the key was minted over, so it can recompute that key from the CANDIDATE's own
-// recipe and refuse an image whose key came from somewhere else. Returning the build alone would
-// have made that recomputation impossible and left the join to a transcribed hash.
-//
-// §3c CONSUMER, LANDED. This fold's executing consumer is
-// gunbc.spark.v41_runtime_image_converge converge_v41_produced_runtime_image, reached from the
-// fleet-converge mode spark_v41_runtime_image_build -- the patched sibling of
-// vllm_runtime_image_build_ci_wet the earlier frontier row named. That vanilla entry still calls
-// converge_vllm_runtime_image (clean checkout, recipe key) and does not grow P.
-type V41PatchedImageBuild
-  = V41PatchedImageBuilt { build: VllmImageBuild, observed: V41ObservedSourceIdentity }
-  | V41PatchedImageRefused { step: NonEmptyStr, cause: String }
-
-fn converge_vllm_runtime_image_with_patches(
-  target: SshTarget,
-  context: FleetSshExecutionContext,
-  ctx: SparkMaterializeContext,
-  r: VllmContainerBuildRecipe,
-  patches: List<V41EnginePatch>,
-) -> V41PatchedImageBuild
-{
-  match converge_vllm_source_with_patches(target: target, context: context, r: r, patches: patches) {
-    V41PatchedSourceRefused { step: st, cause: why } => V41PatchedImageRefused { step: st, cause: why }
-    V41PatchedSourceConverged { patches_already_on_tree: _, observed: obs } =>
-      V41PatchedImageBuilt {
-        build: converge_vllm_image_keyed(
-          ctx: ctx,
-          r: r,
-          key: v41_patched_image_build_key(r: r, observed: obs),
-        ),
-        observed: obs,
-      }
-  }
-}
-
-// THE KEY THE PATCHED IMAGE IS BUILT UNDER, AS ONE FUNCTION RATHER THAN AN INLINE EXPRESSION. The
-// produced-runtime admission recomputes it from the candidate's recipe and the observed tree; if the
-// two sides spelled the extras independently, a rename on one side would make every produced image
-// refuse and the refusal would read as a build defect. One authority, two callers.
-fn v41_patched_image_build_key(r: VllmContainerBuildRecipe, observed: V41ObservedSourceIdentity) -> ContentHash {
-  vllm_image_build_key_with_observed_tree(r: r, extras: [
-    v41_input(identity: "source_head", value: observed.revision_head as String),
-    v41_input(identity: "worktree_diff_sha256", value: observed.worktree_diff_sha256.hex as String),
-  ])
-}
diff --git a/dag/gunbc/spark/v41_source_patch_converge_wet.dag b/dag/gunbc/spark/v41_source_patch_converge_wet.dag
deleted file mode 100644
index a885db3b67d..00000000000
--- a/dag/gunbc/spark/v41_source_patch_converge_wet.dag
+++ /dev/null
@@ -1,101 +0,0 @@
-module gunbc.spark.v41_source_patch_converge_wet
-
-import std.types { String, NonEmptyStr }
-import std.process { ProcessExit, ExitSuccess, exit_failure }
-import std.optional { Present, Absent }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import extdeps.vllm.source_build { vllm_clone_url }
-import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.fleet_known_hosts_anchor {
-  FleetSshExecutionContext, SshTarget,
-  fleet_ssh_attempt_identity,
-  materialize_fleet_known_hosts_anchor, known_hosts_materialization_receipt,
-  fleet_ssh_execution_context_of,
-}
-import gunbc.fleet_ssh_credential_verify {
-  FleetSshCredentialVerified, FleetSshCredentialIdentityMismatch, FleetSshCredentialDerivationRefused,
-  fleet_ssh_credential_verification_refusal_reason,
-}
-import gunbc.fleet_multi_principal_probe { probe_agent_credential_verification }
-import gunbc.spark.host_commitment { SparkHostAdmitted, SparkHostRefused, admit_unplaced_host_live, release_host_effect_live }
-import gunbc.spark.managed_access_bootstrap { spark_managed_executor_login }
-import gunbc.spark.fabric_reach { ReachManagementLan, spark_reach_endpoint, spark_reach_path_wire }
-import gunbc.spark.v41_runtime_candidate {
-  V41PatchesObserved, V41PatchesAbsentByObservation, V41PatchesUnestablished,
-  v41_storage_backed_patch_population, v41_candidate_recipe,
-}
-import gunbc.spark.vllm_runtime_image_build {
-  vllm_build_host_purpose, vllm_source_dir, vllm_build_root, vllm_build_host_residue,
-}
-import gunbc.spark.v41_source_patch_converge {
-  converge_vllm_source_with_patches,
-  v41_patched_source_receipt_line, v41_patched_source_converged,
-}
-
-// OPERATOR CLI DOOR FOR THE APPLY SEAM. Vanilla vllm_source_acquire_wet still converges an
-// unpatched checkout at the fallback recipe. This entry supplies the candidate's DigestFile'd P
-// into converge_vllm_source_with_patches — the fold does not choose P. Same invocation shape as
-// vllm_source_acquire_wet: gunbc run --entry this file --function v41_patched_source_acquire_wet
-// --arg host=<identity>. Do not hand-apply on srv1.
-//
-// converge_vllm_runtime_image_with_patches is NOT this door. Its consumer is a declared frontier
-// on that fold (patched sibling of vllm_runtime_image_build_ci_wet). Wiring it here would put a
-// hours-long docker build behind a source-acquire that exists to exercise git apply.
-
-data v41_patched_source_acquire_attempt_raw: String = "v41-patched-source-acquire"
-data v41_patched_source_acquire_receipt_path: String = "target/v41-patched-source-acquire-receipt.txt"
-
-fn v41_patched_source_acquire_wet(host: String) -> ProcessExit
-{
-  match v41_storage_backed_patch_population() {
-    V41PatchesAbsentByObservation => exit_failure(reason: "the storage-backed patch population is absent by observation")
-    V41PatchesUnestablished { obligation: o } => exit_failure(reason: o as String)
-    V41PatchesObserved { patches: ps, partition: _ } => {
-      let now = clock_now_probed_at()
-      match admit_unplaced_host_live(term: vllm_build_host_effect_term, raw: host, purpose: vllm_build_host_purpose, residue: vllm_build_host_residue()) {
-        SparkHostRefused { cause: why } => exit_failure(reason: why as String)
-        SparkHostAdmitted { host: build_host, claim: claim } =>
-          release_host_effect_live(handle: claim, exit: {
-          match fleet_ssh_attempt_identity(raw: v41_patched_source_acquire_attempt_raw) {
-            Absent => exit_failure(reason: "attempt identity is not a safe path segment")
-            Present { value: attempt } =>
-              match probe_agent_credential_verification(attempt: attempt) {
-                FleetSshCredentialIdentityMismatch { expected_line: expected, observed_line: observed } =>
-                  exit_failure(reason: fleet_ssh_credential_verification_refusal_reason(verification: FleetSshCredentialIdentityMismatch { expected_line: expected, observed_line: observed }))
-                FleetSshCredentialDerivationRefused { cause: cause } =>
-                  exit_failure(reason: fleet_ssh_credential_verification_refusal_reason(verification: FleetSshCredentialDerivationRefused { cause: cause }))
-                FleetSshCredentialVerified { binding: binding } => {
-                  let materialization = materialize_fleet_known_hosts_anchor(attempt: attempt)
-                  match fleet_ssh_execution_context_of(outcome: materialization, credential: binding) {
-                    Absent => exit_failure(reason: join(["trust could not be established, so no leg ran: ", known_hosts_materialization_receipt(outcome: materialization)], ""))
-                    Present { value: context } =>
-                      match spark_reach_endpoint(host: build_host, path: ReachManagementLan) {
-                        Absent => exit_failure(reason: join(["no ", spark_reach_path_wire(p: ReachManagementLan), " endpoint for ", build_host as String], ""))
-                        Present { value: endpoint } => {
-                          let target = SshTarget { endpoint: endpoint as NonEmptyStr, principal: spark_managed_executor_login as NonEmptyStr }
-                          let r = v41_candidate_recipe()
-                          let converged = converge_vllm_source_with_patches(target: target, context: context, r: r, patches: ps)
-                          let body = join([
-                            join(["v41 patched source acquire probed_at=", probed_at_word(reading: now) as String, " host=", build_host as String, " endpoint=", endpoint, " principal=", spark_managed_executor_login, "\n"], ""),
-                            join(["root=", vllm_build_root() as String, " source=", vllm_source_dir() as String, " clone_url=", vllm_clone_url(source: r.source), "\n"], ""),
-                            known_hosts_materialization_receipt(outcome: materialization),
-                            v41_patched_source_receipt_line(c: converged),
-                          ], "")
-                          let w = Filesystem.Write(path: v41_patched_source_acquire_receipt_path, content: body)
-                          if !w.success {
-                            exit_failure(reason: join(["v41 patched source acquire receipt write failed: ", w.error], ""))
-                          } else if v41_patched_source_converged(c: converged) {
-                            ExitSuccess
-                          } else {
-                            exit_failure(reason: join(["the patched source did not converge:\n", body], ""))
-                          }
-                        }
-                      }
-                  }
-                }
-              }
-          }})
-      }
-    }
-  }
-}
diff --git a/dag/gunbc/spark/vllm_endpoint_process_launch.dag b/dag/gunbc/spark/vllm_endpoint_process_launch.dag
index fb70483bc9d..1ac277584f8 100644
--- a/dag/gunbc/spark/vllm_endpoint_process_launch.dag
+++ b/dag/gunbc/spark/vllm_endpoint_process_launch.dag
@@ -2,7 +2,7 @@ module gunbc.spark.vllm_endpoint_process_launch
 
 import std.types { Bool, String, NonEmptyStr }
 import product.fabric.demand { ObservationReceiptRef }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_wire }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire }
 
 // ── ONE ENDPOINT PROCESS IS ONE SUBJECT, AND THE GROUP IS NOT IT ──────────────────────────────
 //
diff --git a/dag/gunbc/spark/vllm_observed.dag b/dag/gunbc/spark/vllm_observed.dag
index 812b9f9c69c..5b1e691dcdc 100644
--- a/dag/gunbc/spark/vllm_observed.dag
+++ b/dag/gunbc/spark/vllm_observed.dag
@@ -13,7 +13,6 @@ import extdeps.languages.json.number {
 }
 import product.host_identity { HostIdentity }
 import std.measure { TokenCount, token_count, token_count_value, BasisPoint, basis_point, basis_point_count, basis_point_unity_count }
-import gunbc.fleet_host_identity { operator_host_srv6 }
 import extdeps.vllm.server {
   VllmRoute,
   VllmRoutePopulation,
@@ -337,8 +336,10 @@ fn vllm_tp_realization_refusal_cause(refusal: VllmTpRealizationRefusal) -> Strin
 data vllm_version_route_2026_09_03: VllmVersionRouteReadback = vllm_version_route_readback(
   server_version: "0.21.1rc1.dev339+g1967a5627bc3" as NonEmptyStr)
 
+// A DATED RECEIPT OF A HOST NO LONGER IN THE FLEET: srv6 was decommissioned with Group A on 2026-10-07, so
+// its identity is recorded as the receipt read it rather than through the deleted fleet identity row.
 data vllm_front_door_scope_2026_09_03: VllmHistoricalFrontDoorScope = vllm_historical_front_door_scope(
-  front_door_host: operator_host_srv6,
+  front_door_host: "srv6" as HostIdentity,
   observed_on: "2026-09-03" as NonEmptyStr)
 
 // WHAT IS RETURNED NOW IS NOT THIS ROW'S QUESTION. vllm_models_route_standing reads the live
diff --git a/dag/gunbc/spark/vllm_serving_launch.dag b/dag/gunbc/spark/vllm_serving_launch.dag
index ff94d2ae037..26e5ce9d15c 100644
--- a/dag/gunbc/spark/vllm_serving_launch.dag
+++ b/dag/gunbc/spark/vllm_serving_launch.dag
@@ -5,7 +5,7 @@ import std.dissolution { DissolutionCondition, unbound_dissolution }
 import std.optional { Present, Absent }
 import std.content_hash { ContentHash, compare_content_hash, ContentHashComparison, ContentHashEqual, ContentHashDifferent, ContentHashCrossFamilyIncomparable }
 import product.host_identity { HostIdentity }
-import gunbc.spark.fabric_switch_observed { FabricGroup, fabric_group_wire }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_wire }
 import gunbc.spark.vllm_endpoint_process_launch { VllmEndpointProcessLaunch }
 import product.fabric.demand { ObservationReceiptRef }
 
diff --git a/dag/gunbc/srv3/srv3_seeded_install_media_artifact.dag b/dag/gunbc/srv3/srv3_seeded_install_media_artifact.dag
index 6e9667cbf86..97529566c50 100644
--- a/dag/gunbc/srv3/srv3_seeded_install_media_artifact.dag
+++ b/dag/gunbc/srv3/srv3_seeded_install_media_artifact.dag
@@ -51,6 +51,7 @@ fn srv3_seeded_install_media_input_for(user_data_body: NonEmptyStr) -> UbuntuSee
     nocloud_dir_on_iso: srv3_seeded_nocloud_dir_on_iso,
     user_data_body: user_data_body,
     seed_files: [],
+    seed_artifacts: [],
     grub_kernel_cmdline: srv3_seeded_grub_kernel_cmdline,
     volume_id: "UBUNTU_SEEDED",
     pinned_dates: seeded_install_media_pinned_dates,
diff --git a/dag/gunbc/stage0/stage0_crate_partition_emit.dag b/dag/gunbc/stage0/stage0_crate_partition_emit.dag
index e892e19de56..293520ab4d9 100644
--- a/dag/gunbc/stage0/stage0_crate_partition_emit.dag
+++ b/dag/gunbc/stage0/stage0_crate_partition_emit.dag
@@ -1,13 +1,9 @@
 module gunbc.stage0_crate_partition_emit
 
+import gunbc.crate_partition { Stage0EmitCoreCrate, Stage0FoundationCrate, Stage0LayeredCoreCrate, Stage0PartitionCrateRow }
+
 import std.types { List }
-import v2.workflow.rust_crate_partition {
-  Stage0EmitCoreCrate,
-  Stage0FoundationCrate,
-  Stage0LayeredCoreCrate,
-  Stage0PartitionCrateRow,
-  stage0_partition_crate_rows
-}
+import v2.workflow.rust_crate_partition { stage0_partition_crate_rows }
 import v2.std.algebra { fold_list }
 import v2.std.text { String }
 
@@ -72,7 +68,8 @@ fn expected_stage0_crate_partition_generated_dag() -> String {
     "type GeneratedPartitionCrateKind\n",
     "  = GeneratedFoundationCrate\n",
     "  | GeneratedLayeredCoreCrate\n",
-    "  | GeneratedEmitCoreCrate\n\n",
+    "  | GeneratedEmitCoreCrate\n",
+    "  | GeneratedFacadeCrate\n\n",
     "type GeneratedPartitionCrateRow {\n",
     "  package_name: String\n",
     "  crate_dir: String\n",
diff --git a/dag/gunbc/stage0/stage0_crate_partition_generated.dag b/dag/gunbc/stage0/stage0_crate_partition_generated.dag
index f35f14fba70..7c56b611643 100644
--- a/dag/gunbc/stage0/stage0_crate_partition_generated.dag
+++ b/dag/gunbc/stage0/stage0_crate_partition_generated.dag
@@ -6,6 +6,7 @@ type GeneratedPartitionCrateKind
   = GeneratedFoundationCrate
   | GeneratedLayeredCoreCrate
   | GeneratedEmitCoreCrate
+  | GeneratedFacadeCrate
 
 type GeneratedPartitionCrateRow {
   package_name: String
@@ -79,7 +80,8 @@ data generated_partition_crate_rows: List<GeneratedPartitionCrateRow> = [
         "std_operator_realization",
         "std_import",
         "v1_std_core",
-        "gunbc_rust_emitted_edge"
+        "gunbc_rust_emitted_edge",
+        "gunbc_rust_emitted_crate"
       ],
       reexport_packages: [
         "v1-stage0-runtime"
@@ -191,6 +193,7 @@ data generated_partition_crate_rows: List<GeneratedPartitionCrateRow> = [
       crate_dir: "src/v1/stage0_emit_core",
       kind: GeneratedEmitCoreCrate,
       modules: [
+        "gunbc_rust_emitted_crate",
         "gunbc_rust_emitted_edge",
         "v1_compiler_artifact",
         "v1_compiler_infer_env",
diff --git a/dag/gunbc/stage0/stage0_emitted_edge_admission.dag b/dag/gunbc/stage0/stage0_emitted_edge_admission.dag
index 992a0ae731e..23907698a1a 100644
--- a/dag/gunbc/stage0/stage0_emitted_edge_admission.dag
+++ b/dag/gunbc/stage0/stage0_emitted_edge_admission.dag
@@ -8,7 +8,10 @@ import gunbc.rust_emitted_edge {
   EmittedCrateRootTarget,
   RuntimePrelude,
   ReexportFacade,
-  SemanticSourceReference
+  SemanticSourceReference,
+  DeclaredImport,
+  InlinePathReference,
+  ServiceRuntimeSurface
 }
 import gunbc.stage0_crate_partition_generated { GeneratedPartitionCrateRow }
 import gunbc.stage0_partition_package_graph {
@@ -194,6 +197,9 @@ fn stage0_emitted_edge_provenance_name(provenance: EmittedEdgeProvenance) -> Str
     RuntimePrelude => "runtime-prelude"
     ReexportFacade => "reexport-facade"
     SemanticSourceReference => "semantic-source-reference"
+    DeclaredImport => "declared-import"
+    InlinePathReference => "inline-path-reference"
+    ServiceRuntimeSurface => "service-runtime-surface"
   }
 }
 
diff --git a/dag/gunbc/stage0/stage0_executable_assembly_emit.dag b/dag/gunbc/stage0/stage0_executable_assembly_emit.dag
index 922c9a666c4..d0ae1fc0cc6 100644
--- a/dag/gunbc/stage0/stage0_executable_assembly_emit.dag
+++ b/dag/gunbc/stage0/stage0_executable_assembly_emit.dag
@@ -1,5 +1,7 @@
 module gunbc.stage0_executable_assembly_emit
 
+import gunbc.crate_partition { Stage0PartitionCrateRow }
+
 import std.types { List }
 import v2.compiler.self_host.stage0_executable_assembly {
   stage0_host_shell_package_name,
@@ -8,7 +10,7 @@ import v2.compiler.self_host.stage0_executable_assembly {
 }
 import v2.std.algebra { fold_list, list_map, filter, any, length }
 import v2.std.text { String }
-import v2.workflow.rust_crate_partition { Stage0PartitionCrateRow, stage0_partition_crate_rows }
+import v2.workflow.rust_crate_partition { stage0_partition_crate_rows }
 
 // THE BRIDGE, AND WHY THERE HAS TO BE ONE. v2.compiler.self_host.stage0_executable_assembly is
 // the authority for which package assembles the next-pass executable and which partition packages
diff --git a/dag/gunbc/stage0/stage0_partition_package_graph.dag b/dag/gunbc/stage0/stage0_partition_package_graph.dag
index e09aa06ee22..cd5858d4f6a 100644
--- a/dag/gunbc/stage0/stage0_partition_package_graph.dag
+++ b/dag/gunbc/stage0/stage0_partition_package_graph.dag
@@ -8,6 +8,7 @@ import gunbc.stage0_executable_assembly_generated {
 }
 import gunbc.stage0_crate_partition_generated {
   GeneratedEmitCoreCrate,
+  GeneratedFacadeCrate,
   GeneratedFoundationCrate,
   GeneratedLayeredCoreCrate,
   GeneratedPartitionCrateRow,
@@ -40,6 +41,7 @@ import gunbc.stage0_crate_partition_generated {
 fn stage0_partition_row_is_module_bearing_package(row: GeneratedPartitionCrateRow) -> Bool {
   match row.kind {
     GeneratedEmitCoreCrate => false
+    GeneratedFacadeCrate => false
     GeneratedFoundationCrate => true
     GeneratedLayeredCoreCrate => true
   }
@@ -54,7 +56,7 @@ fn stage0_partition_package_dependency_names(row: GeneratedPartitionCrateRow) ->
 }
 
 // The same edges over ANY row set of this shape: the committed stage0 rows above, or rows a
-// derivation produced (v2.workflow.emitted_crate_workspace). The emit shell's edges are a property
+// derivation produced (gunbc.emitted_crate_workspace). The emit shell's edges are a property
 // of the set it sits in, so the set is a parameter rather than read from the committed one.
 fn partition_module_bearing_package_names_over(rows: List<GeneratedPartitionCrateRow>) -> List<String> {
   rows
@@ -67,6 +69,7 @@ fn partition_package_dependency_names_over(row: GeneratedPartitionCrateRow, rows
     GeneratedFoundationCrate => []
     GeneratedLayeredCoreCrate => row.reexport_packages
     GeneratedEmitCoreCrate => partition_module_bearing_package_names_over(rows: rows)
+    GeneratedFacadeCrate => partition_module_bearing_package_names_over(rows: rows)
   }
 }
 
diff --git a/dag/gunbc/stderr_capture_gap_exclusion.dag b/dag/gunbc/stderr_capture_gap_exclusion.dag
deleted file mode 100644
index 55cda509ef8..00000000000
--- a/dag/gunbc/stderr_capture_gap_exclusion.dag
+++ /dev/null
@@ -1,23 +0,0 @@
-module gunbc.stderr_capture_gap_exclusion
-
-// THE FIXTURE-CLOSURE UNION'S EXCLUDED OPERATION, as one record the seed compiles and evaluates.
-// gunbc.rung_drop.fixture_closure_union_unmodeled_stderr_capture consumes this row. Authored names
-// are the compiler's declaration identity for extdeps.gunbc / WitnessBin / Run (RungDrop.population
-// stays List<String> for every other drop; this carrier is the typed field that row cannot grow
-// without migrating the ledger).
-
-type StderrCaptureGapExclusion {
-  drop_identity: String
-  declaring_module: String
-  service: String
-  operation_qualified: String
-  operation_bare: String
-}
-
-data exclusion: StderrCaptureGapExclusion = StderrCaptureGapExclusion {
-  drop_identity: "gunbc.rung_drop.fixture_closure_union_unmodeled_stderr_capture",
-  declaring_module: "extdeps.gunbc",
-  service: "gunbc.WitnessBin",
-  operation_qualified: "gunbc.WitnessBin.Run",
-  operation_bare: "Run",
-}
diff --git a/dag/gunbc/structural_realization_bindings.dag b/dag/gunbc/structural_realization_bindings.dag
index 8af28a134fc..db26931b7be 100644
--- a/dag/gunbc/structural_realization_bindings.dag
+++ b/dag/gunbc/structural_realization_bindings.dag
@@ -110,8 +110,13 @@ data structural_ordering_rows: List<StructuralOrderingBinding> = [
 //
 // A ROW MAY ONLY STATE A REALIZATION THAT IS ALREADY TRUE OF THE CARRIER ON EVERY ROUTE, under the
 // same discipline as the rows above: it is never added to make a failing site compile.
+//
+// std.nat Nat's row declares its RANGE, the naturals' non-negativity: a kernel literal at Nat is its own
+// value (DirectLiteral) exactly when std.types range admits it (min 0, no max). v2 infer reads this row to
+// elaborate a literal at Nat and derives `-1`'s refusal from the range -- Nat has no literal homomorphism
+// row, so the two rosters still partition (std.literal_elaboration, "a declaration is never both").
 data kernel_grounding_rows: List<KernelGrounding> = [
-  KernelGrounding { source_kind: KernelIntLiteral, carrier: decl_ref(module_path: "std.nat", decl_name: "Nat") }
+  KernelGrounding { source_kind: KernelIntLiteral, carrier: decl_ref(module_path: "std.nat", decl_name: "Nat"), min: Present { value: 0 }, max: Absent }
 ]
 
 // WHICH KERNEL MINTS STAND FOR A CORPUS DECLARATION (std.literal_elaboration
diff --git a/dag/gunbc/systemd_property_directive_overlap.dag b/dag/gunbc/systemd_property_directive_overlap.dag
index eb29901ff4e..2296d527f08 100644
--- a/dag/gunbc/systemd_property_directive_overlap.dag
+++ b/dag/gunbc/systemd_property_directive_overlap.dag
@@ -139,6 +139,7 @@ fn systemd_property_writability(property: SystemdUnitProperty) -> SystemdPropert
     Result => ObservationOnly
     ExecMainStatus => ObservationOnly
     ExecStartProperty => SettableDirective
+    ExecStopPostProperty => SettableDirective
     User => SettableDirective
     WorkingDirectoryProperty => SettableDirective
     RuntimeDirectoryProperty => SettableDirective
@@ -157,6 +158,8 @@ fn systemd_property_writability(property: SystemdUnitProperty) -> SystemdPropert
     PrivateTmpProperty => SettableDirective
     ReadWritePathsProperty => SettableDirective
     RemainAfterExitProperty => SettableDirective
+    RuntimeMaxSecProperty => SettableDirective
+    CollectModeProperty => SettableDirective
     EnvironmentProperty => SettableDirective
     EnvironmentFilesProperty => ObservationOnly
     PassEnvironmentProperty => SettableDirective
@@ -198,11 +201,11 @@ fn systemd_property_is_settable(property: SystemdUnitProperty) -> Bool {
 data systemd_unit_property_members: List<SystemdUnitProperty> = [
   MemoryMax, MemorySwapMax, MemoryHigh, CPUWeight, CPUQuota, CPUQuotaPerSecUSec, TasksMax,
   MemoryCurrent, MemoryPeak, TasksCurrent, ControlGroup, SliceProperty, ActiveEnterTimestampMonotonic, ActiveState, MainPID,
-  LoadState, UnitFileState, SubState, Result, ExecMainStatus, ExecStartProperty,
+  LoadState, UnitFileState, SubState, Result, ExecMainStatus, ExecStartProperty, ExecStopPostProperty,
   User, WorkingDirectoryProperty, RuntimeDirectoryProperty, Unit, NextElapseUSecMonotonic, AccuracyUSec, TimersMonotonic, NeedDaemonReload,
   IdProperty, KillModeProperty, ExitTypeProperty,
   StandardOutputProperty, StandardErrorProperty, ProtectSystemProperty, ProtectHomeProperty,
-  PrivateTmpProperty, ReadWritePathsProperty, RemainAfterExitProperty,
+  PrivateTmpProperty, ReadWritePathsProperty, RemainAfterExitProperty, RuntimeMaxSecProperty, CollectModeProperty,
   EnvironmentProperty, EnvironmentFilesProperty, PassEnvironmentProperty, AfterProperty, WantsProperty,
   InvocationIDProperty, FragmentPathProperty, JobProperty,
 ]
diff --git a/dag/gunbc/tailscale_acl_phase2_credential.dag b/dag/gunbc/tailscale_acl_phase2_credential.dag
index 59a8b679a8a..9e6626225c3 100644
--- a/dag/gunbc/tailscale_acl_phase2_credential.dag
+++ b/dag/gunbc/tailscale_acl_phase2_credential.dag
@@ -117,11 +117,15 @@ fn operator_bindings_admit_bmc_assimilator_sa(bindings: List<SecretAccessBinding
 
 fn operator_bindings_are_user_principal_accessor_only(bindings: List<SecretAccessBinding>) -> Bool {
   (length(bindings) == 1)
-    && bindings.first().member == operator_principal_member()
-    && bindings.first().role == role_secretmanager_secret_accessor
-    && bindings.first().project == bmc_secrets_project_id
-    && bindings.first().secret == (tailscale_acl_ephemeral_token_secret_id as String)
-    && starts_with(s: bindings.first().member, prefix: "user:")
+    && match bindings.first() {
+      Present { value: b } =>
+        b.member == operator_principal_member()
+          && b.role == role_secretmanager_secret_accessor
+          && b.project == bmc_secrets_project_id
+          && b.secret == (tailscale_acl_ephemeral_token_secret_id as String)
+          && starts_with(s: b.member, prefix: "user:")
+      Absent => false
+    }
 }
 
 type TailscaleAclOperatorEphemeralCredentialOutcome
diff --git a/dag/gunbc/target_binding.dag b/dag/gunbc/target_binding.dag
index c29d21d1f0d..b2a4b38b901 100644
--- a/dag/gunbc/target_binding.dag
+++ b/dag/gunbc/target_binding.dag
@@ -60,12 +60,13 @@ type TargetProducer
 // WHICH READING OF THE NATIVE CENSUS FAMILY A ROW TAKES. One producer spawns the emitted v2
 // compiler's census verbs; the reading names the verb and the reader that decides its standing, so a
 // further census over the same walk is a variant here and a row there, never another producer.
-//   ResolveRefusalReading: `census-resolve`, the resolve-refusal report (gunbc#13026).
+//   RefusalCensusReading: `census-infer`, the front-end/resolve/infer refusal report (gunbc#13026,
+//     census part 2). Its exit status is the type census's and is not read as this report's standing.
 //   TypeDeclarationUseReading: `census-infer` with the type-declaration census's fixture and
 //     unindexed controls (the nominal-type plan's M0), read by
 //     gunbc.instruments.type_declaration_use_census_reading.
 type V2NativeCensusReading
-  = ResolveRefusalReading
+  = RefusalCensusReading
   | TypeDeclarationUseReading
 
 type TargetBinding {
diff --git a/dag/gunbc/tools/bmc_onboard.dag b/dag/gunbc/tools/bmc_onboard.dag
index ec1d151a0a8..bf91eb0148a 100644
--- a/dag/gunbc/tools/bmc_onboard.dag
+++ b/dag/gunbc/tools/bmc_onboard.dag
@@ -38,12 +38,14 @@ import gunbc.auth.netrc_binding {
   NetrcPlacement, NetrcBindingPlaced, NetrcBindingRefused, NetrcBindingRefusedResidueRemains,
   place_netrc_binding,
 }
+import extdeps.bmc.redfish { redfish_password_change_verdict, RedfishPasswordChangeRequired, RedfishPasswordChangeNotIndicated }
 import gunbc.bmc_onboarding {
   BmcOnboardingPlan,
   srv1_onboarding_plan,
   srv2_onboarding_plan,
   srv3_onboarding_plan,
   srv4_onboarding_plan,
+  srv13_onboarding_plan,
   BmcCredentialProbeResult,
   FactoryCredentialActive,
   RotatedCredentialActive,
@@ -441,7 +443,7 @@ fn bmc_assimilate_credential(plan: BmcOnboardingPlan, token_source: AccessTokenS
     bmc_host: host,
     netrc_file: bmc_onboard_netrc_path as NonEmptyStr
   )
-  if acq.success == false {
+  if factory_login_accepted(succeeded: acq.success, body: acq.body) == false {
     return exit_failure(reason: concat("acquire: factory login failed: ", acq.body))
   }
 
@@ -456,6 +458,18 @@ fn bmc_assimilate_credential(plan: BmcOnboardingPlan, token_source: AccessTokenS
 
 
 
+// THE PUBLISHED CREDENTIAL IS ACTIVE WHEN THE BMC ACCEPTS IT, including when the firmware
+// accepts it only to demand a password change (Redfish Base PasswordChangeRequired, OpenBMC
+// 3.22.00 on the ALTRAD8UD-1L2T). That state admits exactly the PATCH bmc_rotate_credential
+// performs, so it is the factory phase, not an unknown one: reading it as a failure stopped
+// onboarding at its first step on a freshly flashed BMC.
+fn factory_login_accepted(succeeded: Bool, body: String) -> Bool {
+  succeeded || (match redfish_password_change_verdict(body: body) {
+    RedfishPasswordChangeRequired => true
+    RedfishPasswordChangeNotIndicated => false
+  })
+}
+
 fn bmc_probe_credential_phase(plan: BmcOnboardingPlan, token_source: AccessTokenSource) -> BmcCredentialProbeResult
 {
   let host = plan.bmc.host
@@ -469,7 +483,7 @@ fn bmc_probe_credential_phase(plan: BmcOnboardingPlan, token_source: AccessToken
     bmc_host: host,
     netrc_file: bmc_onboard_netrc_path as NonEmptyStr
   )
-  if factory_check.success {
+  if factory_login_accepted(succeeded: factory_check.success, body: factory_check.body) {
     return FactoryCredentialActive
   }
 
@@ -541,6 +555,13 @@ fn srv4_converge_credential() -> ProcessExit
   bmc_converge_credential(plan: srv4_onboarding_plan, token_source: GcloudPrintToken)
 }
 
+// srv13 arrives on OpenBMC 3.22.00, whose published credential is accepted only to demand a
+// password change; the factory probe reads that as the factory phase and rotates from it.
+fn srv13_converge_credential() -> ProcessExit
+{
+  bmc_converge_credential_selected(plan: srv13_onboarding_plan)
+}
+
 // srv1 AND srv2 TAKE WHATEVER CREDENTIAL THE RUN HAS -- the Workload Identity token in a federated
 // workflow, or an operator token file in a session -- through the one selection authority, rather
 // than the gcloud CLI the older srv3/srv4 entries hard-code.
diff --git a/dag/gunbc/tools/card_intake.dag b/dag/gunbc/tools/card_intake.dag
index 2fd9be20a60..10492a66d1f 100644
--- a/dag/gunbc/tools/card_intake.dag
+++ b/dag/gunbc/tools/card_intake.dag
@@ -9,6 +9,7 @@ import extdeps.tcgplayer.pricing
 import extdeps.tcgplayer.store
 import extdeps.tcgplayer.tcgplayer
 import std.credentials { CredentialSource }
+import std.integer { int_to_decimal_string }
 
 data tcgplayer_client_id_source: CredentialSource = std.credentials.EnvVar { name: "TCGPLAYER_CLIENT_ID" }
 
@@ -174,7 +175,7 @@ fn intake_binder_photo(
         RestAnswered { answer: search } =>
           match tcgplayer.Pricing.GetProductPrices(
             bearer_token: bearer_token,
-            product_ids: "{search.first_product_id}"
+            product_ids: int_to_decimal_string(value: search.first_product_id)
           ) {
             RestRefused { refusal } =>
               return BinderPhotoIntakeRefused { step: CardIntakeReadProductPrices, refusal: refusal }
diff --git a/dag/gunbc/tools/review.dag b/dag/gunbc/tools/review.dag
index ac4c705ec68..42aec1b9119 100644
--- a/dag/gunbc/tools/review.dag
+++ b/dag/gunbc/tools/review.dag
@@ -5,6 +5,7 @@ import extdeps.git
 import std.types { GitRef, FilePath, Seconds }
 import extdeps.transports.rest { RestResult, RestAnswered, RestRefused, RestRefusal, RestStatusRefused, RestTransportRefused, RestBodyUndecodable }
 import extdeps.cron.schedule_model { CronSchedule, Wildcard, render_cron_schedule }
+import std.integer { int_to_decimal_string }
 
 data default_model: String = "claude-sonnet-4-6-20250929"
 
@@ -84,7 +85,7 @@ fn build_user_message(
   base_ref: String,
   diff: String
 ) -> String {
-  "PR #{pr_number}: {pr_title}\nBranch: {branch} -> {base_ref}\n\n--- Diff ---\n{diff}"
+  "PR #{int_to_decimal_string(value: pr_number)}: {pr_title}\nBranch: {branch} -> {base_ref}\n\n--- Diff ---\n{diff}"
 }
 
 // A REST REFUSAL TAKES THE SAME EXIT AS A REFUSED CONTEXT READ: reviewed is false and comment_url
diff --git a/dag/gunbc/v1/v1_interpreter_dispatch_emit.dag b/dag/gunbc/v1/v1_interpreter_dispatch_emit.dag
index 6e6f2c37185..33053f35b56 100644
--- a/dag/gunbc/v1/v1_interpreter_dispatch_emit.dag
+++ b/dag/gunbc/v1/v1_interpreter_dispatch_emit.dag
@@ -107,7 +107,6 @@ fn dispatch_emit_site_key(site: InterpreterDispatchEmitSite) -> String {
     EvalCallBridgeFamilySite { module } => concat("eval_call_bridge::", qualified_name_to_dotted_string(qn: module))
     EvalCallNativeInterceptSite => "eval_call_native_intercept"
     TryV2StdCollectionMapPrimitiveGroundingSite => "try_v2_std_collection_map_primitive_grounding"
-    TryParseTableMemoDispatchSite => "try_parse_table_memo_dispatch"
     EvalMethodCallShortCircuitSite => "eval_method_call_short_circuit"
     EvalServiceCallCarveOutSite => "eval_service_call_carve_out"
   }
@@ -228,7 +227,6 @@ fn site_enum_name(site: InterpreterDispatchEmitSite) -> String {
     EvalCallBridgeFamilySite { module } => concat("EvalCallBridge", concat(module_pascal_after_domain_prefix(module: module), "Arm"))
     EvalCallNativeInterceptSite => "EvalCallNativeInterceptArm"
     TryV2StdCollectionMapPrimitiveGroundingSite => "TryV2StdCollectionMapPrimitiveGroundingArm"
-    TryParseTableMemoDispatchSite => "TryParseTableMemoDispatchArm"
     EvalMethodCallShortCircuitSite => "EvalMethodCallShortCircuitArm"
     EvalServiceCallCarveOutSite => "EvalServiceCallCarveOutArm"
   }
@@ -241,7 +239,6 @@ fn site_lookup_name(site: InterpreterDispatchEmitSite) -> String {
     EvalCallBridgeFamilySite { module } => concat("lookup_eval_call_bridge_", module_slug_after_domain_prefix(module: module))
     EvalCallNativeInterceptSite => "lookup_eval_call_native_intercept"
     TryV2StdCollectionMapPrimitiveGroundingSite => "lookup_try_v2_std_collection_map_primitive_grounding"
-    TryParseTableMemoDispatchSite => "lookup_try_parse_table_memo_dispatch"
     EvalMethodCallShortCircuitSite => "lookup_eval_method_call_short_circuit"
     EvalServiceCallCarveOutSite => "lookup_eval_service_call_carve_out"
   }
@@ -390,7 +387,6 @@ fn row_has_invalid_bridge_family_domain_prefix(row: InterpreterPrimitiveDispatch
     EvalAlgebraMethodInnerSite => false
     EvalCallNativeInterceptSite => false
     TryV2StdCollectionMapPrimitiveGroundingSite => false
-    TryParseTableMemoDispatchSite => false
     EvalMethodCallShortCircuitSite => false
     EvalServiceCallCarveOutSite => false
   }
diff --git a/dag/gunbc/v1/v1_interpreter_primitive_surface.dag b/dag/gunbc/v1/v1_interpreter_primitive_surface.dag
index 7120ded7fd9..794b9242a72 100644
--- a/dag/gunbc/v1/v1_interpreter_primitive_surface.dag
+++ b/dag/gunbc/v1/v1_interpreter_primitive_surface.dag
@@ -27,7 +27,6 @@ type InterpreterDispatchEmitSite
   | EvalCallBridgeFamilySite { module: QualifiedName }
   | EvalCallNativeInterceptSite
   | TryV2StdCollectionMapPrimitiveGroundingSite
-  | TryParseTableMemoDispatchSite
   | EvalMethodCallShortCircuitSite
   | EvalServiceCallCarveOutSite
 
@@ -228,7 +227,7 @@ fn v1_interpreter_cross_form_spellings() -> List<String> {
 // eval_builtin_inner; eval_algebra_method_inner; eval_call, which carries TWO separate mechanisms
 // -- guard-predicated v4 std bridge families AND a native fold intercept -- both running BEFORE the
 // free-call dispatch, which is why fold_list and the bridge names never reach the builtin registry;
-// try_v2_std_collection_map_primitive_grounding; try_parse_table_memo_dispatch; a lookup
+// try_v2_std_collection_map_primitive_grounding; a lookup
 // short-circuit inside eval_method_call; and the Filesystem.Read hermetic carve-out in
 // eval_service_call. dispatch_site_count() derives the site count from the roster rather than
 // restating it in prose. AN EARLIER REVISION UNDERCOUNTED eval_call by modelling it as the fold
@@ -242,8 +241,7 @@ fn v1_interpreter_cross_form_spellings() -> List<String> {
 // gunbc.generated_artifact V1InterpreterDispatchGeneratedRsArtifact). Handler macros in
 // v1_interpreter.rs consult the generated lookup before matching bodies on the generated enum.
 // Exhaustiveness is site-scoped: on single-family sites (eval_builtin_inner,
-// eval_algebra_method_inner, try_v2_std_collection_map_primitive_grounding,
-// try_parse_table_memo_dispatch) a roster row without a handler body fails cargo build via a
+// eval_algebra_method_inner, try_v2_std_collection_map_primitive_grounding) a roster row without a handler body fails cargo build via a
 // non-exhaustive inner match on the generated enum; on eval_call_bridge and
 // eval_call_native_intercept — shared enums with per-family macro subsets — the same mismatch
 // degrades to runtime unreachable! until per-family enum split lands (named follow-up). A handler
@@ -2189,24 +2187,6 @@ fn v1_interpreter_authored_roster_arms() -> List<InterpreterPrimitiveDispatchArm
       dispatch_emit_site: EvalCallNativeInterceptSite,
       enumeration: AuthoredInRoster,
     },
-    InterpreterPrimitiveDispatchArm {
-      arm: InterpreterPrimitiveArmId { identity: "parse_table_memo.parse_table_lookup" },
-      form: NativeSpecial,
-      authored_spelling: "parse_table_lookup",
-      realization_module: "v1_interpreter",
-      dispatch_symbol: "try_parse_table_memo_dispatch",
-      dispatch_emit_site: TryParseTableMemoDispatchSite,
-      enumeration: AuthoredInRoster,
-    },
-    InterpreterPrimitiveDispatchArm {
-      arm: InterpreterPrimitiveArmId { identity: "parse_table_memo.parse_table_insert" },
-      form: NativeSpecial,
-      authored_spelling: "parse_table_insert",
-      realization_module: "v1_interpreter",
-      dispatch_symbol: "try_parse_table_memo_dispatch",
-      dispatch_emit_site: TryParseTableMemoDispatchSite,
-      enumeration: AuthoredInRoster,
-    },
   ]
 }
 
@@ -2232,7 +2212,7 @@ type SeedScaffoldDisposition {
 // SO R1 CLOSES THE DUAL-AUTHORITY DEFECT the prior scaffold carried: roster edits without
 // regenerating lookup tables now fail the generated-artifact fixed point instead of silently
 // falling through at eval_call_native_intercept. The hand-Rust census does not shrink yet —
-// v1_interpreter_roster_seed_scaffold still carries six macro_rules authorities until emit
+// v1_interpreter_roster_seed_scaffold still carries five macro_rules authorities (the sixth, v1_parse_table_arms, was deleted with the parse memo) until emit
 // generates flat match arms, with net_added_lines 0 against the pre-R1 scaffold baseline. What it
 // buys is one roster authority, generated routing, and drift enforcement rather than a second
 // manually synced lookup table.
@@ -2247,7 +2227,6 @@ fn v1_interpreter_roster_seed_scaffold() -> SeedScaffoldDisposition {
       "v1_bridge_family_arms",
       "v1_native_intercept_arms",
       "v1_map_grounding_arms",
-      "v1_parse_table_arms",
     ],
     net_added_lines: 0,
     target_roadmap_node: "v1-interpreter-primitive-dispatch-authority",
diff --git a/dag/gunbc/witness/compiler_gate_workflow.dag b/dag/gunbc/witness/compiler_gate_workflow.dag
index 92c28cdff30..4f3f725e3e6 100644
--- a/dag/gunbc/witness/compiler_gate_workflow.dag
+++ b/dag/gunbc/witness/compiler_gate_workflow.dag
@@ -1,94 +1,80 @@
 module gunbc.compiler_gate_workflow
 
+// THE REQUIRED CONTEXT IS ONE JOB (operator ruling 2026-10-09, the v1 withdrawal): "v1 is
+// effectively bankrupt due to memory instability - i want to go back to pure v2 native compiler
+// development - that means deleting most of our current CI jobs", and, on the first cut of this
+// change, "collapse emit-build plus the aggregate into one required job named witnesses, and make
+// the job's regeneration claim true: this version requires fresh emission/build of both retained
+// products and refuses a restored final-product hit. Ordinary Cargo reuse may remain."
+//
+// This module emits .github/workflows/witnesses.yml. Until that ruling a `witnesses` aggregate read
+// five lanes, and four of them judged through the v1 interpreter or judged v1's own Rust: `floor`
+// (the interpreter folding the rostered witnesses), `generated` (the stage0 mirrors, the registry
+// drift discriminator with its repair chain, and the lint), `rust-unit-tests`, and `seed` (the
+// compiler pair built once for those three). They are DELETED here rather than retuned, because a
+// lane made survivable is investment in the implementation the ruling retires. What they held is the
+// declared drop gunbc.rung_drop v1_required_lanes_withdrawn, and its trigger names the native
+// compiler judging that population, never the return of these lanes.
+//
+// WHAT REMAINS IS ONE JOB, `witnesses` -- the id the repository ruleset requires, so the job's own
+// check IS the required context and no aggregate reads it: the seed emits the two retained v2
+// closures, cargo builds the emitted crates, and the built binaries are started
+// (gunbc.emitted_subject_build_gate states the subject). Every run emits and builds both products
+// FRESH: the native product store's restore and save steps left this job, and each subject step
+// passes native_product_reuse_env_name=fresh, under which the runner refuses a restored hit rather
+// than serving it. That is the one use the ruling leaves the seed. A verdict this gate gains from
+// here is a row of emitted_subject_build_rows judged by a binary built from that emission, not a
+// lane that hands the corpus to the v1 interpreter.
+//
+// ONE JOB MEANS NO LANE ROSTER. The derived aggregate -- lane rows, standings, the env block and
+// shell conditionals folded from them -- existed so that several lanes could block through one
+// required context without a hand-written `needs` edge; with one job there is nothing to join, and
+// keeping the fold over a one-row roster would be a second representation of the job list (DESIGN
+// section 2). A second required job is a roster growth the operator must sign off (the design
+// document's CI row); the job that lands it brings the fold back with it.
+//
+// FORK PULL REQUESTS CARRY NO REQUIRED CONTEXT. The job keeps the fleet guard
+// (compiler_gate_fleet_job_condition): fork code does not run on the fleet, so on a fork pull
+// request the job is skipped and the `witnesses` check is never produced -- the head is UNOBSERVED
+// and cannot merge until a same-repository branch carries it. The deleted aggregate excused that
+// skip with a notice and a green context; a green over no verdict is the fail-open DESIGN section
+// 5 refuses, and nothing in this repository lands from a fork.
+//
+// THE NAME `witnesses` NOW CARRIES A DIFFERENT CONTRACT, AND THE EPOCH SAYS SO. The ruleset requires a
+// context of that name and it lives outside the repository, so the job keeps the id; what a
+// success entitles a consumer to conclude changed materially, which is the case
+// gunbc.required_ci_contract_epoch says to bump for. The epoch moved in the change that made this
+// cut, so gunbc.fleet_revision_acceptance cannot admit a revision judged under the old contract as
+// though it were judged under this one, nor the reverse.
+//
+// THE REQUIRED JOB RUNS ON THE FLEET (operator ruling 2026-09-28: no lane the required context
+// reads runs on a hosted runner), and compiler_gate_merge_path_runs_on_the_fleet refuses emission
+// of a workflow in which it runs hosted. The ruling's receipts were merge-queue runs 36478070174 and
+// 36464765845, where every hosted job waited minutes for a slot in a pool this repository does not
+// control.
+//
+// SUPERSESSION CANCELS A FLEET JOB. The concurrency policy cancels a running pull-request run on the
+// next push. gunbc.compile_permit_scope fleet_compile_cancellation_standing still reads NotSafe
+// (producer absent), so a cancelled fleet compile may leak its ctrl-jobserver permits; this module
+// does not resolve that. merge_group and heal revalidation keep their immutable groups
+// (witness_floor_concurrency_group), so a later push never cancels them.
 
-// NO LANE THE REQUIRED CONTEXT READS RUNS ON A HOSTED RUNNER (operator ruling 2026-09-28). The
-// lanes the `witnesses` aggregate reads -- `seed`, `rust-unit-tests`, `emit-build`, `floor` and `generated` --
-// run on the fleet, and so does the aggregate.
-//
-// THE HOSTED UNIT-TEST LANE WAS DELETED (operator ruling 2026-09-29). `rust-unit-tests` ran
-// `cargo test --release -p v1-compiler --lib` on every pull request and merge_group as a
-// non-blocking measurement, and its step's continue_on_error rendered every run green while the
-// population was red on main -- a verdict nobody could read, bought with about a third of the
-// hosted pool. That ruling said the tests return as a BLOCKING fleet lane once the population is
-// green, never as a hosted measurement again, and on 2026-09-30 they did: `rust-unit-tests` is a
-// blocking fleet lane read by the aggregate (see the unit-test section below).
-//
-// WHY THE HOSTED LANES LEFT THE MERGE PATH. The history below put them there because the fleet was
-// the bottleneck. On 2026-09-28 the bottleneck was the hosted pool: it held at 20 running jobs with
-// 66 waiting (GitHub Free's concurrency limit for hosted runners; the organization is on that
-// plan), every pull-request run and every queued landing asked it for four jobs, and a landing's
-// required context waited on that pool rather than on its own lanes. Receipts, re-read from the
-// jobs API's created_at and started_at rather than trusted here: merge-queue runs 36478070174 and
-// 36464765845, where every hosted job waited minutes for a slot -- the aggregate, whose one step
-// runs in seconds, waited 9 and 21 -- while the fleet lanes of the same runs started within
-// seconds. So `compiler` is deleted: its one step built `gunbc`, which the `seed` job now builds or restores once
-// for `floor` and `generated` (`emit-build` still builds its own, see the seed section) (DESIGN section 2). The lint became a
-// step on `generated` (compiler_gate_lint_step), and the aggregate moved to the fleet.
-// compiler_gate_merge_path_runs_on_the_fleet refuses emission of a workflow in which a blocking
-// lane or the aggregate runs hosted.
-//
-// `emit-build` BLOCKS, ON THE FLEET (operator sign-off 2026-10-02, given to the N7 manager as step
-// 10 of the advisory program). It stayed hosted and announced while its only obstacle was the fleet
-// claim its two compilations make on every pull request and merge_group; the operator agreed that
-// cost, so its lane row is LaneBlocks and the job runs on the fleet runner with the fleet lanes'
-// fork guard and skippable-on-fork arm. The roster did not grow: the job already existed, and only
-// its standing and runner changed. It runs BESIDE `floor` rather than after it, so on the hosted
-// runs before this change (whose emit-build wall was below the floor's) it adds no wall to a
-// landing; the fleet wall is read from this lane's own runs, not restated here.
-//
-// SUPERSESSION CANCELS FLEET JOBS, AND THIS RULING DID NOT START THAT. The concurrency policy
-// cancels a running pull-request run on the next push, and the history below justified that by the
-// hosted runner. `floor` (2026-09-19) and `generated` (2026-09-27) joined this workflow on the fleet
-// under the same policy, so the justification stopped covering the merge path when they did:
-// gunbc.compile_permit_scope fleet_compile_cancellation_standing still reads NotSafe (producer
-// absent), so a cancelled fleet compile may leak its ctrl-jobserver permits. This ruling moves one
-// more cargo invocation, the lint, into that exposure and does not resolve it.
-//
-// HISTORY (2026-09-19), kept because its reasoning still prices the roster: THE REQUIRED CHECK WAS,
-// FOR A TIME, "THE COMPILER BUILDS" -- AND NOTHING ELSE.
-//
-// This module emits .github/workflows/witnesses.yml in place of gunbc.witness_floor_workflow.
-// The fold that workflow ran cost ~100 runner-minutes per PR push across two self-hosted jobs
-// (build lane ~30 min, floor ~47 min) plus the heal job (~26 min), on a ~45-runner fleet that
-// every session pushes to. Measured on run 35462055101: the floor's 4,185 claims executed in
-// 53 seconds; the other ~42 minutes were corpus preparation (14.3 min strict-preparation of
-// 3,197 modules), reach probes (11 min), parse/admission (~7 min) and receipt bookkeeping.
-// The fleet queued for up to 49 minutes and the merge queue stalled behind it.
-//
-// The operator ruled that the required gate shrinks to building the compiler until the fold's
-// preparation cost is fixed. So this workflow is one job, `witnesses` (the name the ruleset's
-// required status check reads), that builds the `gunbc` binary and stops.
-//
-// IT RUNS ON A GITHUB-HOSTED RUNNER, which is what makes supersession lawful here. The fold keeps
-// cancel-in-progress false because a killed job on a self-hosted host leaks its ctrl-jobserver
-// permits (gunbc.compile_permit_scope, fleet_compile_cancellation_standing is NotSafe). A hosted
-// runner joins no host jobserver, so a cancelled build leaks nothing, and a PR's superseded run is
-// cancelled instead of holding a runner. merge_group and heal revalidation keep their immutable
-// groups (witness_floor_concurrency_group), so they are never cancelled by a later push.
-//
-// DISSOLVE-ON: the fold's preparation cost is cut (resolved-module and reach-probe results
-// reused across runs, or preparation scoped to a diff's closure) and its runtime fits the fleet;
-// then witnesses.yml is emitted by gunbc.witness_floor_workflow again and this module is deleted.
-
-import std.measure { Minute, minute, minute_count }
 import std.types { Bool, Int, List, String }
-import std.optional { Present, Absent }
-import v2.std.algebra { list_map, filter, length }
 import std.algebra { list_append }
-import extdeps.languages.yaml.types { YamlKeyValue, yaml_string, yaml_int, yaml_bool, kv }
+import std.optional { Present }
+import v2.std.algebra { list_map, filter }
+import extdeps.languages.yaml.types { yaml_string, yaml_int, yaml_bool, kv }
 import extdeps.languages.yaml.emit { emit_yaml, EmittedYaml, YamlEmitRefused, yaml_emit_refusal_text }
 import extdeps.languages.yaml.gha_workflow { project_workflow_to_yaml }
 import extdeps.github.actions {
-  Workflow, Job, Step, UsesStep, RunStep,
-  WorkflowPermissions, PermRead, PermWrite,
-  RunnerSpec, HostedRunner, SelfHosted, RunsOnExpression,
-  github_event_name_pull_request,
-  github_event_name_merge_group
+  Workflow, Job, Step, UsesStep, RunStep, WorkflowPermissions, PermRead, RunnerSpec, HostedRunner,
+  SelfHosted, RunsOnExpression, github_event_name_pull_request
 }
 import gunbc.action_use_admission {
-  admit_workflow_checkout_refs, checkout_ref_entry, WorkflowCheckoutRefsAdmitted, WorkflowCheckoutRefsRefused, workflow_checkout_refs_refusal_reason,
-  checkout_action, upload_artifact_action,
-  admit_workflow_action_uses, WorkflowActionUsesAdmitted, WorkflowActionUsesRefused, workflow_action_uses_refusal_reason
+  admit_workflow_checkout_refs, checkout_ref_entry, WorkflowCheckoutRefsAdmitted,
+  WorkflowCheckoutRefsRefused, workflow_checkout_refs_refusal_reason, checkout_action,
+  admit_workflow_action_uses, WorkflowActionUsesAdmitted, WorkflowActionUsesRefused,
+  workflow_action_uses_refusal_reason
 }
 import gunbc.roadmap_execution_contract { CargoCapability, RustcCapability, RustfmtCapability, RustupCapability }
 import gunbc.workflow_capability_closure {
@@ -99,76 +85,22 @@ import gunbc.toolchain_home_standing {
   admit_workflow_toolchain_homes, WorkflowToolchainHomesAdmitted, WorkflowToolchainHomeRefused, toolchain_home_refusal_reason
 }
 import gunbc.toolchain_workflow_steps { toolchain_home_isolation_step, toolchain_pin_rustup_default_step }
-import std.dissolution { DissolutionCondition, dissolution_description, unbound_dissolution }
 import gunbc.witness_floor_workflow {
-  witness_floor_workflow_name,
-  witness_floor_triggers,
-  witness_floor_concurrency_group,
-  concurrency_of_policy,
-  WitnessFloorConcurrencyPolicy, ReplaceExistingPending, SupersedeRunningForEvent,
-  witness_floor_toolchain_step,
-  witness_floor_build_step,
-  witness_floor_required_bins,
-  witness_floor_run_script,
-  build_lane_run_script,
-  witness_floor_precondition,
-  witness_toolchain_homes_isolated_guard_step,
-  witness_step_status_guard,
-  witness_step_status_guard_expression,
-  malloc_arena_max_env_key, malloc_arena_max_value,
-  expected_red_roster_join_path,
-  required_floor_disposition_path,
-  long_home_storage_agreement_path,
-  required_floor_claim_cost_path,
-  required_floor_cross_claim_demand_path,
-  required_ci_measurement_bound_steps,
-  required_floor_claim_cost_upload_bound_step,
-  required_floor_disposition_upload_bound_step,
-  required_ci_measurement_scripts_are_renderable,
+  witness_floor_workflow_name, witness_floor_triggers, witness_floor_concurrency_group,
+  concurrency_of_policy, WitnessFloorConcurrencyPolicy, ReplaceExistingPending,
+  SupersedeRunningForEvent, witness_floor_toolchain_step, witness_floor_build_step,
+  witness_toolchain_homes_isolated_guard_step, malloc_arena_max_env_key, malloc_arena_max_value,
   WitnessFloorGenerationOutcome, WitnessFloorGenerated, WitnessFloorGenerationRefused
 }
 import gunbc.ci_runner_target { gunbc_ci_selected_runner_spec }
+import gunbc.fleet_workflow_steps { ci_cache_cargo_step_under }
 import gunbc.ci_failure_class { wrap_command_with_floor_attempt_receipt, wrap_command_is_renderable }
-import gunbc.ci_spec {
-  gunbc_ci_generated_artifact_verify_invoke,
-  gunbc_ci_generated_artifact_regen_verified_invoke,
-  gunbc_ci_heal_repair_declaration_invoke,
-  gunbc_ci_heal_candidate_invoke
-}
-import gunbc.heal_candidate {
-  heal_candidate_directory,
-  heal_candidate_repository_env,
-  heal_candidate_pull_number_env,
-  heal_candidate_head_ref_env,
-  heal_candidate_base_ref_env,
-  heal_candidate_run_id_env
-}
-import gunbc.heal_publication_boundary { heal_repair_candidate_artifact_name }
-// The fork clauses are heal's authorship; the fleet lane inherited the work they guarded.
-import gunbc.heal_workflow { heal_same_repository_clause, heal_not_dependabot_clause }
-import gunbc.fleet_workflow_steps {
-  ci_cache_cargo_step, ci_release_bins_lookup_step, ci_release_bins_cache_step,
-  ci_release_bins_upload_step, ci_release_bins_download_step, gunbc_ci_aux_step_timeout_minutes,
-  ci_wif_auth_step_with_id,
-}
-import gunbc.native_product_federation {
-  native_product_read_service_account, native_product_write_service_account, native_product_write_provider_resource,
-}
-import gunbc.auth.github_gcp_federation { github_wif_provider_resource }
-import gunbc.gunbc_cli_command { gunbc_run_command }
+// The fork clause is heal's authorship; the required job inherited the work it guarded.
+import gunbc.heal_workflow { heal_same_repository_clause }
 import extdeps.exec.command { shell_command_render }
-import gunbc.fleet_release_bins_key {
-  release_bins_outcome_script_for, release_bins_consumer_key_check_script_for,
-  release_bins_key_expression, release_bins_key_step_id, release_bins_outcome_step_id,
-  release_bins_lookup_standing_expression, release_bins_lookup_entry_expression, release_bins_cache_hit_expression,
-  release_bins_key_job_output, release_bins_build_condition,
-  compiler_pair_release_product, release_bins_key_script_for, release_bins_pack_manifest_script_for,
-  release_bins_pack_object_script, release_bins_pack_object_path_expression,
-  compiler_pair_candidate_artifact_name, compiler_pair_candidate_retention_whole_days,
-}
-import gunbc.repo_self_build { repo_self_build_command, repo_self_clippy_command, repo_self_test_command }
+import gunbc.repo_self_build { repo_self_build_command }
 import extdeps.exec.command { shell_command_render }
-import extdeps.github.expressions { interpolate, ContextAccess, Needs, Github, Expression, default_expression_spellings }
+import extdeps.github.expressions { ContextAccess, Github, Expression }
 import extdeps.github.log_annotations { emit_line_shell }
 import gunbc.emitted_subject_build_gate {
   EmittedSubjectBuildRow,
@@ -178,8 +110,13 @@ import gunbc.emitted_subject_build_gate {
   emitted_subject_build_step_name,
   native_fault_experiment_env_name,
   native_fault_experiment_skip_value,
-  native_fault_experiment_run_value
+  native_fault_experiment_run_value,
+  native_product_reuse_env_name,
+  native_product_reuse_fresh_value,
+  native_step_memory_inputs,
+  emit_build_memory_envelope_lines
 }
+import gunbc.runner_slot_desired { gunbc_runner_slot_job_cgroup_ownership }
 // THE EPOCH TRAVELS IN THESE BYTES. gunbc.required_ci_epoch_observation parses
 // GUNBC_REQUIRED_CI_CONTRACT_EPOCH structurally out of .github/workflows/witnesses.yml AT THE
 // TRIGGERING COMMIT -- the bytes GitHub executed -- so the judging side does not author what it
@@ -189,10 +126,9 @@ import gunbc.emitted_subject_build_gate {
 // greens before it.
 import gunbc.required_ci_contract_epoch { required_ci_contract_epoch, required_ci_contract_epoch_env_key }
 
-// THE HOSTED BUILD PRELUDE. It was the `compiler` lane's whole job until the 2026-09-28 ruling deleted
-// that lane (see the header); gunbc.instrument_dispatch_workflow still builds `gunbc` on a hosted
-// runner through it, so the prelude outlived the lane that named it. emit-build left it on
-// 2026-10-02 for the fleet prelude over the same bins.
+// THE HOSTED BUILD PRELUDE. No job of this workflow uses it: gunbc.instrument_dispatch_workflow builds
+// `gunbc` on a hosted runner through it. It was the whole job of the `compiler` lane the 2026-09-28
+// ruling deleted, and emit-build left it on 2026-10-02 for the fleet head over the same bins.
 data compiler_gate_required_bins: List<String> = ["gunbc"]
 data compiler_gate_build_step_name: String = "Build the compiler"
 
@@ -248,123 +184,61 @@ fn compiler_gate_hosted_build_prelude_bound_steps() -> List<CompilerGateBoundSte
   ]
 }
 
-// THE LINT IS A STEP ON `generated`, NOT A JOB OF ITS OWN (operator ruling 2026-09-28).
-//
-// It ran as rust_clippy_all_targets_step inside required-witnesses-build, then -- once that job was
-// gone and nothing had inherited the step, leaving lint over every target ungated while
-// gunbc.contributor_onboarding_path told a contributor it is "a merge is blocked on" -- as a hosted
-// `clippy` job, because a wall that no step executes is a decoration (DESIGN 4b). The claim is
-// unchanged: the workspace is lint-clean over every target, and `cargo clippy --all-targets` is the
-// only command that compiles the integration-test and example targets, so a red there is invisible
-// to every other step.
-//
-// WHAT THE SEPARATE JOB BOUGHT, AND WHAT KEEPS IT NOW. The job kept "the workspace compiles" and "the
-// workspace is lint-clean" apart, so a reader saw which failed and one red could not hide the
-// other. On `generated` the lint keeps its own step, name and id, and its condition is the status
-// guard alone: a red build step cannot skip it and a red lint cannot skip the steps after it, so both
-// reds still reach the log under their own names. What the job cost was a checkout, a toolchain
-// install and a wait for a hosted slot on every run, to run a step that finishes in about a minute
-// (the `Lint every target` step timings of merge-queue runs 36478070174 and 36464765845). It sits
-// on `generated` rather than `floor` because `generated` is the shorter fleet lane, so the step
-// lands off the run's critical path.
-data compiler_gate_clippy_step_name: String = "Lint every target"
-data compiler_gate_lint_step_id: String = "lint_all_targets"
-
-fn compiler_gate_lint_step() -> Step {
-  RunStep {
-    name: Present { value: compiler_gate_clippy_step_name },
-    id: Present { value: compiler_gate_lint_step_id },
-    run: concat(wrap_command_with_floor_attempt_receipt(command: repo_self_clippy_command()), "\n"),
-    shell: none,
-    env: none,
-    working_directory: none,
-    if_condition: Present { value: witness_step_status_guard_expression() },
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-// THE v1 UNIT TESTS ARE A BLOCKING FLEET LANE. The history: a non-required step on the hosted
-// `clippy` job (2026-09-27), its own non-blocking hosted lane (2026-09-28), deleted because
-// continue_on_error made its red unreadable (2026-09-29), returned on the fleet without
-// continue_on_error and read by the aggregate (2026-09-30, retiring gunbc.rung_drop
-// rust_unit_tests_off_the_merge_path). After gunbc#12951 its step overran its cap on every head, so
-// it was reported but not read under gunbc.rung_drop rust_unit_tests_over_their_cap (2026-10-05)
-// until gunbc#13452 brought the suite under its cap by deleting tests. The aggregate reads the
-// lane again, so a unit-test red refuses the required context; the drop is superseded by the
-// #13452 deletion ruling (not retired by its trigger), and the deleted tests' loss is gunbc.rung_drop v1_integration_tests_deleted_from_the_unit_lane.
-//
-// THE FLEET COST IS THE PRICE THE OLDER REASONING DECLINED, AND IT IS NOW PAID DELIBERATELY. The
-// 2026-09-28 reasoning kept the step off the fleet because a fleet slot would pay its wall on every
-// push for a verdict nothing required. The verdict is required, so the wall buys a gate; and the
-// lane runs BESIDE `floor` and `generated` (needs: []), so it adds slot-minutes but no critical-path
-// minutes unless it is the longest lane.
-//
-// THE BOUND IS REAL, NOT DECLARED, AND ON THE FLEET IT IS THE SLOT'S OWN. The regeneration-host tests
-// read their budget through gunbc.host_budget_source and refuse HostBudgetUnreadable where no cgroup
-// binds the process. GUNBC_MEMORY_BUDGET_BYTES would be the escape hatch that refusal exists to
-// refuse. On the hosted runner the step bound itself with sudo (gunbc.ci_spec
-// hosted_runner_memory_cgroup_bind_commands); on a fleet host that bind is unsound, because the slots
-// share one cgroup tree and a sudo write to the root subtree_control reaches every slot. It is also
-// unneeded: every fleet slot is a systemd unit whose MemoryMax is gunbc.fleet_host_budget
-// gunbc_per_runner_memory_cap, the runner starts the step inside that unit's cgroup, and the v1
-// governor's leaf-to-root walk (memory_governor binding_cap_cgroup_dir) reads it. So the step runs the
-// test command bare, and a slot that lost its MemoryMax turns the regeneration-host tests red with a
-// typed refusal rather than passing on a fabricated budget.
-data compiler_gate_unit_test_step_name: String = "Run the v1 unit tests"
-data compiler_gate_unit_test_step_id: String = "rust_unit_tests"
-// THE UNIT STEP CARRIES ITS OWN CAP, AND THE JOB CAP IS DERIVED FROM IT, SO THE STEP ENDS INSIDE THE
-// JOB BY CONSTRUCTION. THE RULE, stated so the literal can be re-derived rather than trusted: the step
-// cap is the largest observed step wall on the fleet runner class, times 1.5, rounded up to the next
-// 5 minutes. Headroom is multiplicative because the wall scales with the test population and with
-// slot contention, and a required lane whose cap is hit reads as a red that says nothing about the
-// diff. The observed walls are those of the rust_unit_tests step in this lane's own fleet runs after
-// gunbc#13452 (merged 2026-10-06T01:02Z), which deleted the v1 tests that each took over 100ms and
-// so changed the population; walls from before it measure a different suite. The current maximum is
-// witnesses run 37459768899 (457s), over every completed step of the witnesses runs created after
-// that merge (gh run list --workflow witnesses.yml, then each run's rust-unit-tests job step times):
-// 457s x 1.5 rounds up to 15. Re-read them there and re-derive when a fleet wall exceeds two thirds
-// of the cap.
-fn compiler_gate_unit_test_timeout() -> Minute {
-  minute(count: 15)
-}
-
-// Checkout, toolchain-home isolation and the toolchain install run before the unit step; the step
-// itself compiles the test binary, so this reserve covers only the prelude.
-fn compiler_gate_unit_test_pre_step_reserve() -> Minute {
-  minute(count: 10)
-}
-
-fn compiler_gate_unit_test_job_timeout() -> Minute {
-  minute(count: minute_count(compiler_gate_unit_test_timeout()) + minute_count(compiler_gate_unit_test_pre_step_reserve()))
+data compiler_gate_permissions: WorkflowPermissions = WorkflowPermissions {
+  contents: Present { value: PermRead },
+  pull_requests: none,
+  issues: none,
+  actions: none,
+  id_token: none
 }
 
-fn compiler_gate_unit_test_command() -> String {
-  repo_self_test_command()
+// THE REQUIRED STATUS IS THE JOB'S OWN CHECK. The repository ruleset requires ONE status,
+// `witnesses`, and a job's check is named by its id, so the job carries that id and nothing reads
+// its result on its behalf. A job that did not conclude success produces no success, and a job the
+// fleet guard skips produces no check at all: both leave the head unmergeable, which is the
+// fail-closed arm. The ruleset is not the place to add a second status: it lives outside the
+// repository, so a merge-blocking fact there is one the model cannot see or regenerate.
+
+// FORK CODE DOES NOT RUN ON THE FLEET. The clause is heal's authorship (gunbc.heal_workflow
+// heal_same_repository_clause), and the checkout below is an attacker-authored head sha on a runner
+// that persists between jobs. The guard is scoped to pull_request events: merge_group and
+// workflow_dispatch carry no pull_request context, so an unscoped clause would read null and SKIP the
+// lane -- and a skipped required lane never reports, which stalls the merge queue for good. The
+// repository's Actions policy already requires approval for all external contributors; this is the
+// second wall.
+fn compiler_gate_fleet_job_condition() -> String {
+  join(["github.event_name != 'pull_request' || ", heal_same_repository_clause], "")
 }
 
-fn compiler_gate_unit_test_step() -> Step {
-  RunStep {
-    name: Present { value: compiler_gate_unit_test_step_name },
-    id: Present { value: compiler_gate_unit_test_step_id },
-    run: concat(wrap_command_with_floor_attempt_receipt(command: compiler_gate_unit_test_command()), "\n"),
-    shell: none,
+// A pull-request run judges the pull request HEAD, not GitHub's merge result; the composed revision
+// is the merge_group run's subject. On merge_group and dispatch the expression is empty and checkout
+// falls back to the triggering ref.
+fn compiler_gate_fleet_checkout_step() -> Step {
+  UsesStep {
+    name: Present { value: "Checkout the commit this lane judges" },
+    id: none,
+    uses: checkout_action,
+    with: Present {
+      value: [
+        kv(key: "fetch-depth", value: yaml_int(n: 0)),
+        checkout_ref_entry(ref_expression: compiler_gate_checkout_ref),
+        kv(key: "persist-credentials", value: yaml_bool(b: false))
+      ]
+    },
     env: none,
-    working_directory: none,
     if_condition: none,
     continue_on_error: none,
-    timeout_minutes: Present { value: minute_count(compiler_gate_unit_test_timeout()) }
+    timeout_minutes: none
   }
 }
 
-data compiler_gate_unit_test_job_id: String = "rust-unit-tests"
-
-fn compiler_gate_unit_test_bound_steps() -> List<CompilerGateBoundStep> {
+// THE HEAD OF EVERY FLEET JOB: the judged checkout, an isolated toolchain home and a pinned default.
+fn compiler_gate_fleet_head_bound_steps() -> List<CompilerGateBoundStep> {
   [
     CompilerGateBoundStep {
-      step: compiler_gate_checkout_step(),
+      step: compiler_gate_fleet_checkout_step(),
       role: capability_neutral,
-      step_name: "Checkout",
+      step_name: "Checkout the commit this lane judges",
     },
     CompilerGateBoundStep {
       step: toolchain_home_isolation_step(),
@@ -381,937 +255,203 @@ fn compiler_gate_unit_test_bound_steps() -> List<CompilerGateBoundStep> {
       role: consumes_only(capabilities: [RustupCapability, CargoCapability]),
       step_name: "Pin rustup default (isolated RUSTUP_HOME has no default toolchain)",
     },
-    CompilerGateBoundStep {
-      step: compiler_gate_unit_test_step(),
-      role: consumes_only(capabilities: [CargoCapability]),
-      step_name: compiler_gate_unit_test_step_name,
-    },
   ]
 }
 
-fn compiler_gate_unit_test_capability_closure_holds() -> Bool {
-  capability_closure_is_closed(
-    v: workflow_job_capability_closure(
-      steps: list_map(
-        xs: compiler_gate_unit_test_bound_steps(),
-        f: fn(b) { CapabilityAnnotatedStep { step_name: b.step_name, role: b.role } },
-      )
-    ),
-  )
-}
-
-// THE UNIT LANE RUNS ON merge_group AND workflow_dispatch ONLY (operator 2026-10-06, CI short-term
-// relief), declared as gunbc.rung_drop rust_unit_tests_off_pull_requests: a failing unit test is
-// caught at the queue's composed revision, not on the pull request. The aggregate excuses the skip
-// only on a pull_request event (GateArmSkippedOnPullRequest). Fork pull requests are excluded by the
-// same clause.
-fn compiler_gate_unit_test_job_condition() -> String {
-  join(["github.event_name != '", github_event_name_pull_request, "'"], "")
-}
-
-fn compiler_gate_unit_test_job() -> Job {
-  Job {
-    id: compiler_gate_unit_test_job_id,
-    name: none,
-    runner: gunbc_ci_selected_runner_spec(),
-    environment: none,
-    steps: list_map(xs: compiler_gate_unit_test_bound_steps(), f: fn(b) { b.step }),
-    needs: [],
-    env: none,
-    outputs: none,
-    if_condition: Present { value: compiler_gate_unit_test_job_condition() },
-    timeout_minutes: Present { value: minute_count(compiler_gate_unit_test_job_timeout()) },
-    continue_on_error: none,
-    concurrency: none,
-    permissions: Present { value: compiler_gate_permissions }
-  }
-}
-
-data compiler_gate_permissions: WorkflowPermissions = WorkflowPermissions {
-  contents: Present { value: PermRead },
-  pull_requests: none,
-  issues: none,
-  actions: none,
-  id_token: none
-}
-
-// THE EMIT-BUILD JOB ALONE MAY MINT AN OIDC TOKEN: the shared native product store's credentialed
-// restore (pull requests) and save (merge queue) federate through it. Every other job keeps
-// id_token unset, so the grant is the narrowest that serves the store.
-data compiler_gate_native_permissions: WorkflowPermissions = WorkflowPermissions {
-  contents: Present { value: PermRead },
-  pull_requests: none,
-  issues: none,
-  actions: none,
-  id_token: Present { value: PermWrite }
-}
-
-// THE REQUIRED STATUS MUST READ EVERY LANE, OR A LANE IS MERELY WAITED ON.
-//
-// The repository ruleset requires ONE status, `witnesses`. A lane that publishes its own status
-// beside it is not a gate: when the compiler lane is green and clippy is red, the required status
-// is still green and the pull request still merges. The first cut of the clippy job did exactly
-// that -- it restored an executing step and left the wall unbuilt, which is the decoration DESIGN
-// section 4b names, arriving one level up from the missing check.
-//
-// So `witnesses` is the AGGREGATOR and the lanes run beneath it. It needs both, runs always() so a
-// failed lane cannot skip the verdict, and reads each lane's own result rather than inferring one
-// from its own success. This is the shape the workflow carried before #11742 collapsed it to a
-// single job, and the reason is unchanged: the aggregating job carries the required context and
-// reads BOTH lane results -- that last is what makes a lane block rather than merely be waited on.
-//
-// The ruleset is not the place to fix this. It lives outside the repository, so requiring a second
-// status there would put a merge-blocking fact where the model cannot see it or regenerate it.
-//
-// A lane that did not conclude success is a refusal, including skipped and cancelled, and the
-// verdict distinguishes a RED lane from one that produced NO CONCLUSION: those are different facts
-// and only the first is a statement about the diff.
-
-// ═══════════════════════════════════════════════════════════════════════════
-// THE FLEET LANE. The hosted lane above runs the unit tests, which a 16 GB runner can do; the work
-// below cannot run there at all. Measured 2026-09-19: the witnesses fold peaks at 20.2 GiB and the
-// generated-artifact pass at 12.9 GiB, against 16 GB on a standard hosted runner, and the fold's
-// memory barely moves with the roster because discovery reads the whole corpus (6,182 sources,
-// 21,240 rows) whatever the roster selects. So this lane runs on the fleet, where a slot carries
-// 26 GiB.
+// THE REQUIRED JOB. Its subject and the discriminating red it buys are
+// `gunbc.emitted_subject_build_gate`'s to state; read that module before this one. What is decided
+// HERE is only its realization as a job: which runner, which prelude, and that its own check is the
+// required context (header).
 //
-// WHAT IT IS FOR, stated because a build-only gate already cost this repository three things in one
-// night: witnesses.yml lost the contract epoch and fleet-desired refused eight pushes; two typecheck
-// errors landed that regeneration refuses; and three generated artifacts drifted unobserved. A gate
-// that builds and lints cannot see any of them. This lane restores the two verdicts that can: the
-// claims, and whether the committed generated artifacts match their authorities.
-//
-// THE DRIFT GATE IS THE MERGE BLOCKER, and the repair runs only where it refused, so an ordinary
-// push pays the gate once (6.3 min) and skips the repair's three invocations (16 min) entirely --
-// where heal paid all four on every push.
-data compiler_gate_floor_job_id: String = "floor"
-data compiler_gate_floor_timeout_minutes: Int = 90
-data compiler_gate_floor_build_step_name: String = "Build the compiler and the witness executor"
-data compiler_gate_drift_step_id: String = "generated_artifact_gate"
-data compiler_gate_repair_declaration_step_id: String = "repair_declaration"
-data compiler_gate_repair_regen_step_id: String = "repair_regen"
-data compiler_gate_candidate_step_id: String = "repair_candidate"
-data compiler_gate_candidate_retention_days: Int = 3
-
-// FORK CODE DOES NOT RUN ON THE FLEET. heal carried these clauses and this lane took heal's work,
-// and the checkout below is an attacker-authored head sha on a runner that persists between jobs.
-// The guard is scoped to pull_request events: merge_group and workflow_dispatch carry no
-// pull_request context, so unscoped clauses would read null and SKIP this lane -- and a skipped
-// required lane never reports, which stalls the merge queue for good. The repository's Actions
-// policy already requires approval for all external contributors; this is the second wall.
-fn compiler_gate_floor_job_condition() -> String {
-  join(["github.event_name != 'pull_request' || ", heal_same_repository_clause], "")
-}
+// THE FLEET RUNNER, because the required job may not run hosted
+// (compiler_gate_merge_path_runs_on_the_fleet). That makes it a standing claim on the fleet for
+// every pull request and merge_group, which the operator signed off on 2026-10-02 for the emit-build
+// steps it carries. It carries the exposure the header names: a superseded pull-request run is
+// cancelled, and fleet_compile_cancellation_standing still reads NotSafe. THE WALL IS MEASURED ON
+// THIS RUNNER CLASS BY THIS JOB'S OWN RUNS and is not restated here (DESIGN section 6: name the
+// instrument, never transcribe its output) -- the producer is the `witnesses` job of any run of this
+// workflow, and the two instrument steps carry one label each so the split between the two
+// compilations is readable from the step timings rather than inferred.
+data compiler_gate_required_job_id: String = "witnesses"
 
-// DEPENDABOT IS DECLINED BY THE REPAIR, NOT BY THE LANE, and the distinction is a deadlock this
-// nearly shipped with. heal excluded dependabot because heal PUSHES to the head branch, which is
-// dependabot's to manage; the FOLD and the drift gate push nothing, and a dependabot pull request
-// that merges without them is exactly the unobserved head this lane exists to prevent. Skipping the
-// whole lane would also have hung those pull requests forever: dependabot's head repository IS this
-// repository, so the aggregator's fork carve-out below does not cover it and it would reach the
-// error branch on a lane that never ran.
-fn compiler_gate_repair_actor_clause() -> String {
-  concat(" && ", heal_not_dependabot_clause)
-}
-
-// The candidate must describe the pull request head, not the merge result, or a repair would carry
-// main's content into the branch. On merge_group and dispatch the expression is empty and checkout
-// falls back to the triggering ref.
-fn compiler_gate_floor_checkout_step() -> Step {
-  UsesStep {
-    name: Present { value: "Checkout the commit this lane judges" },
-    id: none,
-    uses: checkout_action,
-    with: Present {
-      value: [
-        kv(key: "fetch-depth", value: yaml_int(n: 0)),
-        checkout_ref_entry(ref_expression: compiler_gate_checkout_ref),
-        kv(key: "persist-credentials", value: yaml_bool(b: false))
-      ]
-    },
-    env: none,
-    if_condition: none,
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
+// THE TIMEOUT IS A BOUND, NOT A BUDGET, and it is deliberately well above the measured wall: a
+// timeout that trims a slow-but-honest run converts a subject verdict into silence on the required
+// context, which is the failure `required_lanes_aggregate_job_condition` spends its whole comment
+// on one module over.
+data compiler_gate_emit_build_timeout_minutes: Int = 90
 
-// THIS STEP DOES NOT REFUSE THE LANE, AND THE SENTENCE THAT SAID IT DID WAS FALSE. Its run is
-// witness_floor_run_script, which passes --measurement-receipt; under that flag claim_executor
-// writes every blocker into the receipt and returns success (a completed measurement carrying
-// blockers is a fact to adjudicate, not a process failure -- that is what keeps a refused floor
-// and a killed runner distinct). The verdict is the D0-ADJUDICATE step bound after it, exactly as
-// gunbc.witness_floor_workflow binds it. Measured before that step was bound here (PR #11821, run
-// 35497139573): the log read 'floor refused ... phases_run=2 phases_failed=2', no claim ran, and
-// the lane concluded success -- a required gate green over a refusal, DESIGN section 5's hard-reject
-// arm. Every floor success between #11742 and the landing of the bundle below is unverified.
-fn compiler_gate_floor_run_step() -> Step {
+// ONE STEP PER SUBJECT, EACH WITH ITS OWN ID. `witness_floor_build_step` cannot be reused: it binds
+// the fixed step id `build_witness_fold`, and two steps in one job may not share an id. The
+// failure-class wrapper is kept -- this is exactly where a runner hiccup must read as `infra`
+// rather than as a defect in the diff. EVERY SUBJECT STEP PASSES THE FRESH-PRODUCT INPUT
+// (gunbc.emitted_subject_build_gate native_product_reuse_env_name), so the runner consults no
+// native product store and refuses one if bound: the job's claim is that THIS run emitted and
+// built the product, and a restored hit would make that claim false while the step stayed green.
+// AND THE MEMORY ENVELOPE INPUTS (gunbc.emitted_subject_build_gate native_step_memory_inputs,
+// decided by the fleet fact gunbc.runner_slot_desired gunbc_runner_slot_job_cgroup_ownership): every
+// step REQUIRES the fleet slot's envelope -- gunbc test refuses a run that no cgroup with a numeric
+// memory.max binds, prints the peak-and-swap receipt at exit and refuses a run that was OOM-killed
+// or charged swap -- and asks for the per-step bind at the trip only where a job owns a bounded
+// cgroup. The slot's own MemoryMax and MemorySwapMax=0 (gunbc.runner_slot_desired) are the fixed
+// hard maximum.
+fn compiler_gate_emit_build_step(row: EmittedSubjectBuildRow) -> Step {
   RunStep {
-    name: Present { value: "Nominal witnesses (one prepared subject, one fold)" },
-    id: Present { value: "required_ci_measure" },
-    run: concat(wrap_command_with_floor_attempt_receipt(command: witness_floor_run_script()), "\n"),
+    name: Present { value: emitted_subject_build_step_name(row: row) },
+    id: Present { value: row.step_id },
+    run: concat(
+      wrap_command_with_floor_attempt_receipt(
+        command: shell_command_render(command: emitted_subject_build_command(row: row))
+      ),
+      "\n"
+    ),
     shell: none,
-    env: none,
+    env: Present {
+      value: list_append(
+        left: [
+        kv(
+          key: native_fault_experiment_env_name,
+          value: yaml_string(s: join(["${{ github.event_name == 'pull_request' && '", native_fault_experiment_skip_value, "' || '", native_fault_experiment_run_value, "' }}"], ""))
+        ),
+        kv(key: native_product_reuse_env_name, value: yaml_string(s: native_product_reuse_fresh_value))
+        ],
+        right: list_map(
+          xs: native_step_memory_inputs(ownership: gunbc_runner_slot_job_cgroup_ownership),
+          f: fn(env_input) { kv(key: env_input.env_name, value: yaml_string(s: env_input.env_value)) }
+        )
+      )
+    },
     working_directory: none,
-    if_condition: Present { value: witness_floor_precondition() },
+    if_condition: none,
     continue_on_error: none,
     timeout_minutes: none
   }
 }
 
-// THE STEP NAME STATES ITS POPULATION, AND THE POPULATION IS NARROWER THAN "GENERATED ARTIFACTS".
-// generated_artifact_gate main reads gunbc.generated_artifact_registry committed_generated_artifacts only. The
-// ~157 stage0 mirrors (src/v1/stage0/src/std_measure.rs and the rest of the compile_stage0 emitted
-// population) are adjudicated by claim_executor's GeneratedArtifact phase, which routes to
-// --required-lane build, and no job has invoked that lane since #11742. The earlier name,
-// "Generated artifacts match their authorities", stayed GREEN over that gap and read as a statement
-// about stage0; std_measure.rs drifted on main under it (gunbc#12067). Declared drop:
-// gunbc.rung_drop.witness_floor_off_the_required_gate. Row:
-// gunbc.recurring_failure_mode.generated_population_split_across_two_unjoined_rosters.
+// THE NOTICE STEP RUNS ON FAILURE AND ONLY ON FAILURE, because that is the one moment a stranger
+// is looking at this job. It is the LAST step, so it appears directly beneath the diagnostic a
+// reader is trying to interpret rather than scrolled away above it.
+//
+// `if: failure()` rather than `always()`: a notice printed on a green run is noise on every
+// passing PR in the repository, and the reassurance has no subject when there is nothing to
+// reassure anyone about.
 //
-// WHERE THE STAGE0 PHASES MAY RUN, measured rather than assumed: the floor process peaks AT its
-// slot's memory.high (run 35716368507: peak 26847006720 against high 26843545600, high events
-// 1109), and the generated-artifact pass peaks near 12.9 GiB. They never share one process, and
-// since the 2026-09-27 ruling they do not share one slot either: this step and the stage0 step run
-// on compiler_gate_generated_job, beside the floor rather than after it.
+// THE QUOTING IS `extdeps.github.log_annotations` `emit_line_shell` AND NOT A SECOND SPELLING OF
+// IT. That module already owns printf-one-line-shell-quoted for exactly this purpose, and a
+// hand-rolled `echo '...'` here would be the section 3 fork -- with the usual downgrade attached,
+// since a line containing an apostrophe would terminate its own quote.
 //
-// A DISCRIMINATOR FOR THE REPAIR, NOT A SECOND VERDICT (operator ruling 2026-09-28). The build lane's
-// GeneratedArtifact phase adjudicates this step's population -- the same gunbc.generated_artifact
-// registry (committed_generated_artifacts, read through the seed's boundary host) -- beside the
-// stage0 mirrors, which is why this step was already kept off the merge queue: there it would be a
-// second verdict on one population at one revision (DESIGN section 2). Since the 2026-09-28 ruling
-// the lane runs on every event (compiler_gate_stage0_regen_condition), so the same argument reaches
-// pull_request and workflow_dispatch. What keeps this step alive is its one consumer: the repair
-// chain is bound to it, because a repair candidate describes a pull request head and regenerates the
-// registry population only, so it must know whether THAT population drifted -- which the lane's
-// refusal does not say. So the step runs only after the lane refused, and a green lane pays nothing
-// for it. It follows the lane in the job for that reason; on the merge queue it still never runs,
-// because no repair is produced there.
-fn compiler_gate_drift_condition() -> String {
-  join([
-    witness_step_status_guard(),
-    "github.event_name != '", github_event_name_merge_group, "' && ",
-    "steps.build_witness_fold.outcome == 'success' && ",
-    "steps.", compiler_gate_stage0_regen_step_id, ".outcome == 'failure'"
-  ], "")
+// IT ECHOES RATHER THAN ANNOTATES. A `::error::` would add a second red to a job that already has
+// one, and a `::notice::` on a failed job is rendered where nobody looking at the failure will
+// read it. Plain stdout at the end of the step list is where the eye already is.
+// THE LIVE NOTICE: the standing row composed with the fact that this job IS the required context,
+// so the non-blocking reassurance arm of emit_build_standing_notice_for is unreachable from here.
+fn compiler_gate_emit_build_notice_lines() -> List<String> {
+  list_append(
+    left: emit_build_standing_notice_for(standing: emit_build_standing, lane_blocks: true),
+    right: emit_build_memory_envelope_lines(ownership: gunbc_runner_slot_job_cgroup_ownership)
+  )
 }
 
-data compiler_gate_drift_step_name: String = "Registry-rostered generated artifacts (gunbc.generated_artifact): which drifted, run only after the build lane refused, to decide whether the repair applies"
-
-fn compiler_gate_drift_step() -> Step {
+fn compiler_gate_emit_build_notice_step() -> Step {
   RunStep {
-    name: Present { value: compiler_gate_drift_step_name },
-    id: Present { value: compiler_gate_drift_step_id },
-    run: concat(gunbc_ci_generated_artifact_verify_invoke(), "\n"),
+    name: Present { value: "Why this lane is red, and what would be a real finding" },
+    id: none,
+    run: join(list_map(xs: compiler_gate_emit_build_notice_lines(), f: emit_line_shell), "\n"),
     shell: none,
     env: none,
     working_directory: none,
-    if_condition: Present { value: compiler_gate_drift_condition() },
+    if_condition: Present { value: "failure()" },
     continue_on_error: none,
     timeout_minutes: none
   }
 }
 
-// THE STAGE0 MIRRORS ARE CHECKED ON EVERY EVENT, ONE GENERATION DEEP. Operator decision
-// msg_6e36a6a2 (2026-09-23) put this step on the merge queue at two generations, superseding
-// msg_4a9045fc's generation-1-only ruling; operator ruling 2026-09-28 widened its events (below);
-// operator ruling 2026-10-04 ("we don't need to run multiple times - we are not that particular
-// about determinism in v1 anymore") cut it back to one generation.
-//
-// WHAT THE STEP ASSERTS, in one sentence: the committed mirrors equal ONE emission of the current
-// .dag sources by the seed built from those committed mirrors. The ruling waives DETERMINISM, which
-// is all the deleted second generation could see -- it re-emitted with the same binary. It does
-// not waive CONVERGENCE, and the one-generation assertion still holds it: the seed this lane runs
-// is built from the committed mirrors, so mirrors emitted by a binary that predates a change to the
-// emitter's own closure (infer, emit_rust) do not equal what this seed emits, and the step refuses.
-// An author changing that closure therefore still owes a second ROUND (rebuild from the installed
-// mirrors, emit again) before the step admits; an author changing anything else owes one.
-// The drift step above reads gunbc.generated_artifact alone; the ~158 compile_stage0 mirrors are
-// adjudicated by claim_executor's build lane -- the GeneratedArtifact phase -- and no job had run
-// that lane since #11742, so std_measure.rs drifted onto main under a green required run
-// (gunbc#12067) and more mirrors had drifted by the time this step first executed.
-//
-// THE LANE'S OWN COMMAND, so which phases run is still decided by the binary's exhaustive
-// partition (gunbc.witness_floor_workflow build_lane_run_script over gunbc.fabric_witness_run
-// build_lane_run_command), never by this YAML. Measured on the fleet (run 35890770775, after
-// #12100 removed the field-name re-export leak that had inflated generation 1 to 30 min): the
-// whole lane, then two generations deep, took 22.5 min, and the floor job ~58 min against
-// compiler_gate_floor_timeout_minutes.
-//
-// A STEP ON ITS OWN JOB, BESIDE THE FLOOR -- operator ruling 2026-09-27, which supersedes the
-// earlier "a step on this job, not a new job" placement. That placement saved one checkout and
-// build per queued landing and paid for it in latency: the lane ran after the witnesses fold and
-// the drift gate, so a landing waited for the SUM of three independent verdicts (see
-// compiler_gate_generated_job). The measured memory constraint -- the floor process peaks at its
-// slot's memory.high (run 35716368507) and the stage0 pass near 12.9 GiB, so the two never fit
-// additively -- is met by a separate slot as fully as by a later step.
-//
-// ON EVERY EVENT, BECAUSE A PULL REQUEST THAT FAILS IT STILL ENTERS THE QUEUE (operator ruling
-// 2026-09-28). The merge_group-only placement reasoned that a pull request does not land, so the
-// queue's run -- which judges the sha that becomes main -- is the one that must hold, and priced the
-// cost as "an author learns of drift at queue time". Everyone else paid that price: under the
-// ALLGREEN queue a failing entry fails every group built on top of it, and the queue learns of the
-// red only when the required context concludes. #12412 and #12539 each passed their pull-request
-// runs and then failed this step in the queue (merge-queue runs 36478072318 and 36492169928), and
-// every group stacked on #12412 failed the same phase until it was ejected --
-// gunbc.recurring_failure_mode required_verdict_placed_only_on_the_merge_queue. The step also runs on
-// workflow_dispatch, whose remaining callers are manual runs judging a head, for the same reason.
-// `!cancelled()` rather than the default success(): an earlier red step, such as the lint, must not
-// disarm this check (see witness_floor_workflow's measured correction).
-//
-// gunbc.rung_drop.floor_cut_regen_second_generation_agreement STANDS, and since 2026-10-04 no
-// required phase compares a second generation for any population.
-data compiler_gate_stage0_regen_step_name: String = "Stage0 mirrors match one emission by this seed: required CI build lane"
-data compiler_gate_stage0_regen_step_id: String = "stage0_regen"
-
-// NO EVENT CLAUSE, which is the ruling rather than an omission: the step runs wherever the job does,
-// under the same precondition the floor's run step carries (the status guard and a built seed).
-fn compiler_gate_stage0_regen_condition() -> String {
-  witness_floor_precondition()
+fn compiler_gate_emit_build_subject_bound_steps() -> List<CompilerGateBoundStep> {
+  list_map(xs: emitted_subject_build_rows(), f: fn(row) {
+    CompilerGateBoundStep {
+      step: compiler_gate_emit_build_step(row: row),
+      role: consumes_only(capabilities: [CargoCapability]),
+      step_name: emitted_subject_build_step_name(row: row),
+    }
+  })
 }
 
-fn compiler_gate_stage0_regen_step() -> Step {
-  RunStep {
-    name: Present { value: compiler_gate_stage0_regen_step_name },
-    id: Present { value: compiler_gate_stage0_regen_step_id },
-    run: concat(wrap_command_with_floor_attempt_receipt(command: build_lane_run_script()), "\n"),
-    shell: none,
-    env: none,
-    working_directory: none,
-    if_condition: Present { value: compiler_gate_stage0_regen_condition() },
-    continue_on_error: none,
-    timeout_minutes: none
-  }
+// THE PRELUDE IS THE FLEET HEAD PLUS THE SEED BUILD, because the subject steps need exactly that on
+// the fleet: the judged checkout, an isolated toolchain home (and the guard requiring it), a pinned
+// default, and the `gunbc` binary the instruments are invoked through. NO NATIVE PRODUCT STORE STEP:
+// the job-private store root, the read and write federations and the save left with the 2026-10-09
+// ruling (header), because a job that may serve a restored final product cannot claim to have
+// emitted and built it.
+//
+// THE CARGO CACHE IS ORDINARY CARGO REUSE, which the same ruling leaves in place: the isolation step
+// wipes the job's CARGO_HOME on every run, so without it the seed build downloads the registry and
+// compiles every dependency cold (measured on run 37976254311: 3m38s for `Build the compiler`).
+// gunbc.fleet_workflow_steps ci_cache_cargo_step_under restores exactly the isolated home's
+// registry index, crate cache and git db plus the workspace `target/`, keyed by the lockfile hash
+// (gunbc.ci_workflow_expressions ci_cache_key_template), and saves them at job end. It caches the
+// SEED's build and its dependencies; the two emitted products are built in a private probe root
+// the cache never sees. The condition is Absent: this job builds the seed on every run.
+// THE LANE BUILDS `gunbc` IN ITS OWN CHECKOUT. `gunbc test` refuses a binary whose cargo dep-info it
+// cannot read inside this checkout (BinaryFreshnessUndecided, #13007), so a binary restored from
+// anywhere else is one the freshness guard rightly cannot judge.
+fn compiler_gate_emit_build_prelude_bound_steps() -> List<CompilerGateBoundStep> {
+  concat(compiler_gate_fleet_head_bound_steps(), [
+    CompilerGateBoundStep {
+      step: ci_cache_cargo_step_under(condition: none),
+      role: capability_neutral,
+      step_name: "Cache Cargo",
+    },
+    CompilerGateBoundStep {
+      step: witness_floor_build_step(
+        step_name: compiler_gate_build_step_name,
+        build_script: repo_self_build_command(bins: compiler_gate_required_bins),
+      ),
+      role: consumes_only(capabilities: [CargoCapability]),
+      step_name: compiler_gate_build_step_name,
+    },
+    CompilerGateBoundStep {
+      step: witness_toolchain_homes_isolated_guard_step(),
+      role: capability_neutral,
+      step_name: "Require isolated toolchain homes",
+    },
+  ])
 }
 
-fn compiler_gate_repair_condition() -> String {
+fn compiler_gate_emit_build_bound_steps() -> List<CompilerGateBoundStep> {
   concat(
-    concat("failure() && steps.", concat(compiler_gate_drift_step_id, ".outcome == 'failure'")),
-    compiler_gate_repair_actor_clause()
+    concat(compiler_gate_emit_build_prelude_bound_steps(), compiler_gate_emit_build_subject_bound_steps()),
+    [CompilerGateBoundStep {
+      step: compiler_gate_emit_build_notice_step(),
+      role: capability_neutral,
+      step_name: "Why this lane is red, and what would be a real finding",
+    }]
   )
 }
 
-fn compiler_gate_step_succeeded_clause(step_id: String) -> String {
-  concat(" && steps.", concat(step_id, ".outcome == 'success'"))
-}
-
-// EVERY REPAIR LINK REQUIRES ITS PREDECESSOR. main_wet writes artifact by artifact, so a
-// regeneration that refuses partway leaves a partially rewritten tree, and a declaration that
-// refused leaves the candidate's ledger trailers unwritten. Either sealed and pushed is a repair
-// nothing judged, and the publisher admits a failed producing run by design.
-fn compiler_gate_regen_condition() -> String {
-  concat(compiler_gate_repair_condition(),
-    compiler_gate_step_succeeded_clause(step_id: compiler_gate_repair_declaration_step_id))
-}
-
-fn compiler_gate_seal_condition() -> String {
-  concat(compiler_gate_regen_condition(),
-    compiler_gate_step_succeeded_clause(step_id: compiler_gate_repair_regen_step_id))
-}
-
-fn compiler_gate_upload_condition() -> String {
-  concat(compiler_gate_seal_condition(),
-    compiler_gate_step_succeeded_clause(step_id: compiler_gate_candidate_step_id))
+fn compiler_gate_emit_build_capability_closure_holds() -> Bool {
+  capability_closure_is_closed(
+    v: workflow_job_capability_closure(
+      steps: list_map(
+        xs: compiler_gate_emit_build_bound_steps(),
+        f: fn(b) { CapabilityAnnotatedStep { step_name: b.step_name, role: b.role } },
+      )
+    ),
+  )
 }
 
-fn compiler_gate_repair_declaration_step() -> Step {
-  RunStep {
-    name: Present { value: "Declare which ledger rows this repair covers" },
-    id: Present { value: compiler_gate_repair_declaration_step_id },
-    run: gunbc_ci_heal_repair_declaration_invoke(),
-    shell: none,
-    env: none,
-    working_directory: none,
-    if_condition: Present { value: compiler_gate_repair_condition() },
-    continue_on_error: none,
-    timeout_minutes: none
-  }
+// A WRAPPED COMMAND THAT CANNOT BE SERIALIZED RENDERS A REFUSAL MARKER WHERE ITS SCRIPT BELONGS
+// (gunbc.ci_failure_class wrap_command_with_floor_attempt_receipt), and a marker written into the
+// workflow is a step that runs nothing under a name that says it ran. So the lane's wrapped commands
+// -- the seed build and one `gunbc test` per subject -- are an emission conjunct.
+fn compiler_gate_emit_build_scripts_are_renderable() -> Bool {
+  wrap_command_is_renderable(command: repo_self_build_command(bins: compiler_gate_required_bins))
+    && all(emitted_subject_build_rows(), row =>
+      wrap_command_is_renderable(command: shell_command_render(command: emitted_subject_build_command(row: row))))
 }
 
-fn compiler_gate_regen_step() -> Step {
-  RunStep {
-    name: Present { value: "Regenerate every registry-rostered generated artifact (not the stage0 mirrors), then verify the tree it wrote" },
-    id: Present { value: compiler_gate_repair_regen_step_id },
-    run: concat(gunbc_ci_generated_artifact_regen_verified_invoke(), "\n"),
-    shell: none,
-    env: none,
-    working_directory: none,
-    if_condition: Present { value: compiler_gate_regen_condition() },
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-fn compiler_gate_candidate_step() -> Step {
-  RunStep {
-    name: Present { value: "Produce the sealed repair candidate" },
-    id: Present { value: compiler_gate_candidate_step_id },
-    run: gunbc_ci_heal_candidate_invoke(),
-    shell: none,
-    env: Present {
-      value: [
-        kv(key: heal_candidate_repository_env as String, value: yaml_string(s: "${{ github.repository }}")),
-        kv(key: heal_candidate_pull_number_env as String, value: yaml_string(s: "${{ github.event.pull_request.number }}")),
-        kv(key: heal_candidate_head_ref_env as String, value: yaml_string(s: "${{ github.event.pull_request.head.ref }}")),
-        kv(key: heal_candidate_base_ref_env as String, value: yaml_string(s: "${{ github.event.pull_request.base.ref }}")),
-        kv(key: heal_candidate_run_id_env as String, value: yaml_string(s: "${{ github.run_id }}"))
-      ]
-    },
-    working_directory: none,
-    if_condition: Present { value: compiler_gate_seal_condition() },
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-fn compiler_gate_candidate_upload_step() -> Step {
-  UsesStep {
-    name: Present { value: "Upload the sealed repair candidate" },
-    id: none,
-    uses: upload_artifact_action,
-    with: Present {
-      value: [
-        kv(key: "name", value: yaml_string(s: heal_repair_candidate_artifact_name as String)),
-        kv(key: "path", value: yaml_string(s: heal_candidate_directory)),
-        kv(key: "if-no-files-found", value: yaml_string(s: "error")),
-        kv(key: "retention-days", value: yaml_int(n: compiler_gate_candidate_retention_days))
-      ]
-    },
-    env: none,
-    if_condition: Present { value: compiler_gate_upload_condition() },
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-fn compiler_gate_floor_bound_steps() -> List<CompilerGateBoundStep> {
-  concat(compiler_gate_fleet_prelude_bound_steps(), concat([
-    CompilerGateBoundStep {
-      step: compiler_gate_floor_run_step(),
-      role: consumes_only(capabilities: [RustfmtCapability]),
-      step_name: "Nominal witnesses (one prepared subject, one fold)",
-    },
-  ], compiler_gate_floor_measurement_bound_steps()))
-}
-
-// THE HEAD OF EVERY FLEET JOB: the judged checkout, an isolated toolchain home and a pinned default.
-fn compiler_gate_fleet_head_bound_steps() -> List<CompilerGateBoundStep> {
-  [
-    CompilerGateBoundStep {
-      step: compiler_gate_floor_checkout_step(),
-      role: capability_neutral,
-      step_name: "Checkout the commit this lane judges",
-    },
-    CompilerGateBoundStep {
-      step: toolchain_home_isolation_step(),
-      role: capability_neutral,
-      step_name: "Isolate toolchain homes",
-    },
-    CompilerGateBoundStep {
-      step: witness_floor_toolchain_step(),
-      role: provides_only(capabilities: [CargoCapability, RustcCapability, RustfmtCapability, RustupCapability]),
-      step_name: "Install Rust toolchain",
-    },
-    CompilerGateBoundStep {
-      step: toolchain_pin_rustup_default_step(),
-      role: consumes_only(capabilities: [RustupCapability, CargoCapability]),
-      step_name: "Pin rustup default (isolated RUSTUP_HOME has no default toolchain)",
-    },
-  ]
-}
-
-// THE PRELUDE EVERY CONSUMER LANE NEEDS: the head, then the compiler pair the `seed` job built or
-// restored ONCE for the run, verified against the seed's key and promoted into this job's OWN
-// checkout (target/release is private to the job, so a native probe still runs against a writable
-// directory nobody else shares). The restore step keeps the id build_witness_fold because every
-// downstream condition in each job reads that id: `success` there now means "the pair was verified
-// and promoted", which is the precondition those conditions always stood for.
-fn compiler_gate_fleet_prelude_bound_steps() -> List<CompilerGateBoundStep> {
-  concat(compiler_gate_fleet_head_bound_steps(), [
-    CompilerGateBoundStep {
-      step: ci_release_bins_download_step(),
-      role: capability_neutral,
-      step_name: "Download release-bins artifact",
-    },
-    CompilerGateBoundStep {
-      step: compiler_gate_pair_restore_step(),
-      role: consumes_only(capabilities: [CargoCapability]),
-      step_name: compiler_gate_pair_restore_step_name,
-    },
-    CompilerGateBoundStep {
-      step: witness_toolchain_homes_isolated_guard_step(),
-      role: capability_neutral,
-      step_name: "Require isolated toolchain homes",
-    },
-  ])
-}
-
-// ORDER: the lint first (the cheapest verdict, over the Rust the prelude just built), then the build
-// lane, then the drift discriminator that reads the lane's outcome, then the repair chain that reads
-// the discriminator's.
-fn compiler_gate_generated_bound_steps() -> List<CompilerGateBoundStep> {
-  concat(compiler_gate_fleet_prelude_bound_steps(), [
-    CompilerGateBoundStep {
-      step: compiler_gate_lint_step(),
-      role: consumes_only(capabilities: [CargoCapability]),
-      step_name: compiler_gate_clippy_step_name,
-    },
-    CompilerGateBoundStep {
-      step: compiler_gate_stage0_regen_step(),
-      role: consumes_only(capabilities: [RustfmtCapability]),
-      step_name: compiler_gate_stage0_regen_step_name,
-    },
-    CompilerGateBoundStep {
-      step: compiler_gate_drift_step(),
-      role: capability_neutral,
-      step_name: compiler_gate_drift_step_name,
-    },
-    CompilerGateBoundStep {
-      step: compiler_gate_repair_declaration_step(),
-      role: capability_neutral,
-      step_name: "Declare which ledger rows this repair covers",
-    },
-    CompilerGateBoundStep {
-      step: compiler_gate_regen_step(),
-      role: capability_neutral,
-      step_name: "Regenerate every registry-rostered generated artifact (not the stage0 mirrors), then verify the tree it wrote",
-    },
-    CompilerGateBoundStep {
-      step: compiler_gate_candidate_step(),
-      role: capability_neutral,
-      step_name: "Produce the sealed repair candidate",
-    },
-    CompilerGateBoundStep {
-      step: compiler_gate_candidate_upload_step(),
-      role: capability_neutral,
-      step_name: "Upload the sealed repair candidate",
-    },
-  ])
-}
-
-// THE RECEIPT'S THREE CONSUMERS, TAKEN FROM THE ONE AUTHORITY THAT DECLARES THEM. D0-MEASURE seals
-// an unreached receipt when the instrument never returned one, D0-PUBLISH uploads it, and
-// D0-ADJUDICATE reads it back and exits 1 on any blocker -- the step whose absence let a refused
-// floor conclude success. Bound here by re-binding gunbc.witness_floor_workflow's rows rather than
-// re-declaring them, so this lane and the floor workflow cannot carry two refusal mechanisms for
-// one receipt (DESIGN section 3). The rows already bind their env to steps.build_witness_fold,
-// which is the id witness_floor_build_step gives this job's build step too.
-//
-// THE PER-CLAIM COST RECEIPT IS UPLOADED AFTER THEM, re-bound the same way
-// (gunbc.witness_floor_workflow required_floor_claim_cost_upload_bound_step). Its condition is the
-// floor's precondition, which holds through a red adjudication, so a refused floor still publishes
-// the cost of what it executed.
-fn compiler_gate_floor_measurement_bound_steps() -> List<CompilerGateBoundStep> {
-  list_map(
-    xs: concat(required_ci_measurement_bound_steps(), [required_floor_claim_cost_upload_bound_step(), required_floor_disposition_upload_bound_step()]),
-    f: fn(b) { CompilerGateBoundStep { step: b.step, role: b.role, step_name: b.step_name } },
-  )
-}
-
-fn compiler_gate_floor_capability_closure_holds() -> Bool {
-  capability_closure_is_closed(
-    v: workflow_job_capability_closure(
-      steps: list_map(
-        xs: compiler_gate_floor_bound_steps(),
-        f: fn(b) { CapabilityAnnotatedStep { step_name: b.step_name, role: b.role } },
-      )
-    ),
-  )
-}
-
-fn compiler_gate_floor_scripts_are_renderable() -> Bool {
-  wrap_command_is_renderable(command: witness_floor_run_script())
-    && wrap_command_is_renderable(command: build_lane_run_script())
-    && wrap_command_is_renderable(command: repo_self_clippy_command())
-    && wrap_command_is_renderable(command: repo_self_build_command(bins: witness_floor_required_bins))
-    && required_ci_measurement_scripts_are_renderable()
-}
-
-// ── THE MERGE QUEUE PRODUCES THE COMPILER PAIR CANDIDATE ────────────────────────────────────────
-//
-// The `seed` job builds or restores claim_executor and gunbc for the tree that will land. On a
-// merge group (the composed revision that becomes main) it also packs the two binaries with the build
-// log into one object and uploads it as a short-lived workflow artifact; the key was derived by
-// gunbc.fleet_release_bins_key compiler_pair_release_product BEFORE any build, so the pack is stamped
-// with the materialized tree, as the preimage says. The seed holds no cache credential: it produces
-// a CANDIDATE, and fleet-desired, after the revision lands, verifies it and is the only canonical
-// publisher. A pull-request run produces no candidate (nothing would consume it). A refusal here is
-// the seed's: an environment the product's preimage cannot honestly describe stops the line rather
-// than yielding an unprovenanced candidate.
-fn compiler_gate_candidate_condition() -> String {
-  "github.event_name == 'merge_group'"
-}
-
-fn compiler_gate_floor_job() -> Job {
-  Job {
-    id: compiler_gate_floor_job_id,
-    name: none,
-    runner: gunbc_ci_selected_runner_spec(),
-    environment: none,
-    steps: list_map(xs: compiler_gate_floor_bound_steps(), f: fn(b) { b.step }),
-    needs: [compiler_gate_seed_job_id],
-    env: Present {
-      value: [
-        kv(key: malloc_arena_max_env_key, value: yaml_string(s: malloc_arena_max_value)),
-        kv(key: "GUNBC_EXPECTED_RED_ROSTER_JOIN", value: yaml_string(s: expected_red_roster_join_path)),
-        kv(key: "GUNBC_REQUIRED_FLOOR_DISPOSITION", value: yaml_string(s: required_floor_disposition_path)),
-        kv(key: "GUNBC_LONG_HOME_STORAGE_AGREEMENT", value: yaml_string(s: long_home_storage_agreement_path)),
-        kv(key: "GUNBC_REQUIRED_FLOOR_CLAIM_COST", value: yaml_string(s: required_floor_claim_cost_path)),
-        kv(key: "GUNBC_REQUIRED_FLOOR_CROSS_CLAIM_DEMAND", value: yaml_string(s: required_floor_cross_claim_demand_path))
-      ]
-    },
-    outputs: none,
-    if_condition: Present { value: compiler_gate_floor_job_condition() },
-    timeout_minutes: Present { value: compiler_gate_floor_timeout_minutes },
-    continue_on_error: none,
-    concurrency: none,
-    permissions: Present { value: compiler_gate_permissions }
-  }
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// THE GENERATED-ARTIFACT LANE: A JOB BESIDE THE FLOOR, NOT STEPS AFTER IT.
-//
-// OPERATOR RULING 2026-09-27, which grows the closed roster by exactly this one job. Its steps used
-// to run on the floor job after the witnesses fold exited, so a run waited for the SUM of three
-// verdicts that do not read one another -- the witnesses fold, the registry drift gate and, on the
-// merge queue, the stage0 build lane. Merge-queue run 36339106604 is the receipt: those three steps
-// took 46, 9 and 29 minutes in series, and the job 87. On its own slot the lane runs concurrently
-// with the floor, the memory constraint that kept the passes apart is met by placement (each
-// process has a slot to itself), and a run waits for the longer lane instead of the total.
-//
-// THE PRICE IS ONE MORE CHECKOUT AND SEED BUILD PER RUN, on the fleet, which is why the roster
-// needed a ruling rather than an edit. The total work is otherwise the same steps; the merge-queue
-// drift step is removed rather than moved (compiler_gate_drift_condition), so a queued landing runs
-// one generated-artifact adjudication instead of two.
-//
-// FORK CODE DOES NOT RUN HERE EITHER, and the guard is the floor's own condition, not a second
-// spelling of it: both jobs check out the judged head on a persistent self-hosted runner.
-data compiler_gate_generated_job_id: String = "generated"
-
-fn compiler_gate_generated_capability_closure_holds() -> Bool {
-  capability_closure_is_closed(
-    v: workflow_job_capability_closure(
-      steps: list_map(
-        xs: compiler_gate_generated_bound_steps(),
-        f: fn(b) { CapabilityAnnotatedStep { step_name: b.step_name, role: b.role } },
-      )
-    ),
-  )
-}
-
-// THE TIMEOUT IS THE FLOOR'S BOUND, one authority for how long a fleet lane may hold a slot, not a
-// second literal: this lane's measured wall is well under it on both events.
-fn compiler_gate_generated_job() -> Job {
-  Job {
-    id: compiler_gate_generated_job_id,
-    name: none,
-    runner: gunbc_ci_selected_runner_spec(),
-    environment: none,
-    steps: list_map(xs: compiler_gate_generated_bound_steps(), f: fn(b) { b.step }),
-    needs: [compiler_gate_seed_job_id],
-    env: Present {
-      value: [
-        kv(key: malloc_arena_max_env_key, value: yaml_string(s: malloc_arena_max_value))
-      ]
-    },
-    outputs: none,
-    if_condition: Present { value: compiler_gate_floor_job_condition() },
-    timeout_minutes: Present { value: compiler_gate_floor_timeout_minutes },
-    continue_on_error: none,
-    concurrency: none,
-    permissions: Present { value: compiler_gate_permissions }
-  }
-}
-
-// THE EMIT-AND-BUILD LANE. Its subject, and the discriminating red it buys that no other required
-// lane carries, are `gunbc.emitted_subject_build_gate`'s to state; read that module before this
-// one. What is decided HERE is only its realization as a job: which runner, which prelude, and how
-// its verdict reaches the required context.
-//
-// A JOB AND NOT A STEP ON A LANE THAT ALREADY BUILDS THIS TREE, weighed against the roster header's
-// own question. The seed build is established by the fleet lanes' prelude (the `compiler` lane that
-// first carried it was deleted on 2026-09-28), and this lane establishes something else: that the
-// seed can EMIT two v2 closures and that the EMITTED crates compile. The two fail for different
-// causes and a reader must see which. As its own job it runs BESIDE the floor, so its wall overlaps
-// the floor's instead of adding to it; on `floor` or `generated` it would add in series. The
-// prelude is paid once more per run and that is the price.
-//
-// THE FLEET RUNNER, because the lane blocks (compiler_gate_lane_rows) and a blocking lane may not
-// run hosted (compiler_gate_merge_path_runs_on_the_fleet). That makes it a standing claim on the
-// fleet for every pull request and merge_group, which the operator signed off on 2026-10-02. It
-// inherits the fleet lanes' exposure the header names: a superseded pull-request run is cancelled,
-// and fleet_compile_cancellation_standing still reads NotSafe. THE WALL IS MEASURED ON THIS RUNNER CLASS BY THIS LANE'S OWN RUNS and is
-// not restated here (DESIGN section 6: name the instrument, never transcribe its output) -- the
-// producer is the `emit-build` job of any run of this workflow, and the two instrument steps carry
-// one label each so the split between the two compilations is readable from the step timings
-// rather than inferred.
-data compiler_gate_emit_build_job_id: String = "emit-build"
-
-// THE TIMEOUT IS A BOUND, NOT A BUDGET, and it is deliberately well above the measured wall: a
-// timeout that trims a slow-but-honest run converts a subject verdict into silence on the required
-// context, which is the failure `required_lanes_aggregate_job_condition` spends its whole comment
-// on one module over.
-data compiler_gate_emit_build_timeout_minutes: Int = 90
-
-// ONE STEP PER SUBJECT, EACH WITH ITS OWN ID. `witness_floor_build_step` cannot be reused: it binds
-// the fixed step id `build_witness_fold`, and two steps in one job may not share an id. The
-// failure-class wrapper is kept -- a new lane is exactly where a runner hiccup must read as `infra`
-// rather than as a defect in the diff.
-fn compiler_gate_emit_build_step(row: EmittedSubjectBuildRow) -> Step {
-  RunStep {
-    name: Present { value: emitted_subject_build_step_name(row: row) },
-    id: Present { value: row.step_id },
-    run: concat(
-      wrap_command_with_floor_attempt_receipt(
-        command: shell_command_render(command: emitted_subject_build_command(row: row))
-      ),
-      "\n"
-    ),
-    shell: none,
-    env: Present {
-      value: [
-        kv(
-          key: native_fault_experiment_env_name,
-          value: yaml_string(s: join(["${{ github.event_name == 'pull_request' && '", native_fault_experiment_skip_value, "' || '", native_fault_experiment_run_value, "' }}"], ""))
-        ),
-        kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: join(["${{ steps.", compiler_gate_native_read_wif_id, ".outputs.access_token }}"], ""))),
-        kv(key: "GUNBC_PULL_REQUEST_HEAD_REPOSITORY", value: yaml_string(s: "${{ github.event.pull_request.head.repo.full_name }}"))
-      ]
-    },
-    working_directory: none,
-    if_condition: none,
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-// THE NOTICE STEP RUNS ON FAILURE AND ONLY ON FAILURE, because that is the one moment a stranger
-// is looking at this job. It is the LAST step, so it appears directly beneath the diagnostic a
-// reader is trying to interpret rather than scrolled away above it.
-//
-// `if: failure()` rather than `always()`: a notice printed on a green run is noise on every
-// passing PR in the repository, and the reassurance has no subject when there is nothing to
-// reassure anyone about.
-//
-// THE QUOTING IS `extdeps.github.log_annotations` `emit_line_shell` AND NOT A SECOND SPELLING OF
-// IT. That module already owns printf-one-line-shell-quoted for exactly this purpose, and a
-// hand-rolled `echo '...'` here would be the section 3 fork -- with the usual downgrade attached,
-// since a line containing an apostrophe would terminate its own quote.
-//
-// IT ECHOES RATHER THAN ANNOTATES. A `::error::` would add a second red to a job that already has
-// one, and a `::notice::` on a failed job is rendered where nobody looking at the failure will
-// read it. Plain stdout at the end of the step list is where the eye already is.
-// THE LIVE NOTICE: the standing row composed with THIS lane row's blocking status, so "does NOT
-// block your merge" is printed only while `compiler_gate_lane_rows` says so, and the one-word flip
-// to `LaneBlocks` changes the notice in the same edit.
-fn compiler_gate_emit_build_notice_lines() -> List<String> {
-  emit_build_standing_notice_for(
-    standing: emit_build_standing,
-    lane_blocks: length(xs: filter(xs: compiler_gate_blocking_rows(), predicate: fn(row) {
-      row.job_id == compiler_gate_emit_build_job_id
-    })) > 0
-  )
-}
-
-fn compiler_gate_emit_build_notice_step() -> Step {
-  RunStep {
-    name: Present { value: "Why this lane is red, and what would be a real finding" },
-    id: none,
-    run: join(list_map(xs: compiler_gate_emit_build_notice_lines(), f: emit_line_shell), "\n"),
-    shell: none,
-    env: none,
-    working_directory: none,
-    if_condition: Present { value: "failure()" },
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-fn compiler_gate_emit_build_subject_bound_steps() -> List<CompilerGateBoundStep> {
-  list_map(xs: emitted_subject_build_rows(), f: fn(row) {
-    CompilerGateBoundStep {
-      step: compiler_gate_emit_build_step(row: row),
-      role: consumes_only(capabilities: [CargoCapability]),
-      step_name: emitted_subject_build_step_name(row: row),
-    }
-  })
-}
-
-// THE PRELUDE IS THE FLEET PRELUDE over `gunbc` alone, because the subject steps need exactly what it
-// provides on the fleet: the judged checkout, an isolated toolchain home (and the guard requiring
-// it), a pinned default, and the `gunbc` binary the instruments are invoked through.
-// THE NATIVE PRODUCT STORE'S ROOT IS JOB-PRIVATE (`$RUNNER_TEMP/gunbc-native-products`), NEVER A SHARED
-// HOST DIRECTORY. `$RUNNER_TOOL_CACHE` is shared by every job on a self-hosted host, so a pull
-// request's job could plant a self-consistent entry (verify-on-read checks an entry against its own
-// manifest, which its writer controls) that a later job would serve as a HIT. A private directory is
-// empty at job start, so the only filler is the credentialed shared-store restore, whose writer is the
-// merge_group-only federation (`gunbc.native_product_shared_store`); until the federations are provisioned the
-// store is empty and every run builds cold. The product key carries the toolchain axis, so the root
-// needs no toolchain segment.
-// THE ROOT IS BOUND ON PULL REQUESTS AND ON THE MERGE QUEUE: both restore into it through the read
-// federation, the queue's seed publishes into it after a completed red on a miss, and the save step
-// uploads that. A restore that cannot run is a typed, counted MISS in the seed's log
-// (NativeProductRestoreUnavailable, with its cause), never a silent slow build.
-fn compiler_gate_native_cache_condition() -> String {
-  join(["github.event_name == '", github_event_name_pull_request, "' || github.event_name == '", github_event_name_merge_group, "'"], "")
-}
-
-// THE READ CREDENTIAL IS GIVEN TO SAME-REPOSITORY PULL REQUESTS AND TO THE MERGE QUEUE. The queue runs
-// reviewed, composed code and the store is writable only by the queue's own write federation, so a
-// restored product there is one a queue run published; the key still names every input of the product.
-// A fork pull request is issued no id-token, so it has no credential and builds cold.
-fn compiler_gate_native_read_condition() -> String {
-  join(["(github.event_name == '", github_event_name_pull_request, "' && github.event.pull_request.head.repo.full_name == github.repository) || github.event_name == '", github_event_name_merge_group, "'"], "")
-}
-
-fn compiler_gate_native_write_condition() -> String {
-  join(["github.event_name == '", github_event_name_merge_group, "'"], "")
-}
-
-data compiler_gate_native_read_wif_id: String = "native_read_wif"
-
-data compiler_gate_native_write_wif_id: String = "native_write_wif"
-
-data compiler_gate_native_read_auth_step_name: String = "WIF auth (OIDC -> native-product-read, pull requests)"
-
-data compiler_gate_native_write_auth_step_name: String = "WIF auth (OIDC -> native-product-write, merge queue)"
-
-data compiler_gate_native_save_step_name: String = "Save admitted native products to the shared store"
-
-fn compiler_gate_native_wif_step(name: String, id: String, provider_resource: String, service_account: String, condition: String) -> Step {
-  match ci_wif_auth_step_with_id(name: name, id: id, provider_resource: provider_resource, service_account: service_account) {
-    UsesStep { name: n, id: i, uses: u, with: w, env: e, if_condition: _, continue_on_error: _, timeout_minutes: t } =>
-      UsesStep { name: n, id: i, uses: u, with: w, env: e, if_condition: Present { value: condition }, continue_on_error: Present { value: true }, timeout_minutes: t }
-    other => other
-  }
-}
-
-fn compiler_gate_native_read_auth_step() -> Step {
-  compiler_gate_native_wif_step(
-    name: compiler_gate_native_read_auth_step_name,
-    id: compiler_gate_native_read_wif_id,
-    provider_resource: github_wif_provider_resource(),
-    service_account: native_product_read_service_account as String,
-    condition: compiler_gate_native_read_condition(),
-  )
-}
-
-fn compiler_gate_native_write_auth_step() -> Step {
-  compiler_gate_native_wif_step(
-    name: compiler_gate_native_write_auth_step_name,
-    id: compiler_gate_native_write_wif_id,
-    provider_resource: native_product_write_provider_resource(),
-    service_account: native_product_write_service_account as String,
-    condition: compiler_gate_native_write_condition(),
-  )
-}
-
-// THE SAVE IS THE ENTRY'S OWN `gunbc run`, DERIVED AS ARGV rather than spelled: it uploads every
-// admitted entry of the job-private store (only a merge_group run with a completed red publishes one)
-// create-only, and runs only on the queue, after the instruments, with the write federation's token.
-fn compiler_gate_native_save_command() -> String {
-  shell_command_render(command: gunbc_run_command(
-    entry: "dag/gunbc/native_product_shared_transfer.dag",
-    functions: ["native_product_save_wet"],
-  ))
-}
-
-fn compiler_gate_native_save_step() -> Step {
-  RunStep {
-    name: Present { value: compiler_gate_native_save_step_name },
-    id: none,
-    run: concat(compiler_gate_native_save_command(), "\n"),
-    shell: none,
-    env: Present { value: [kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: join(["${{ steps.", compiler_gate_native_write_wif_id, ".outputs.access_token }}"], "")))] },
-    working_directory: none,
-    if_condition: Present { value: join(["success() && ", compiler_gate_native_write_condition()], "") },
-    continue_on_error: Present { value: true },
-    timeout_minutes: Present { value: 10 }
-  }
-}
-
-data compiler_gate_native_cache_root_step_name: String = "Bind job-private native product store root"
-
-data compiler_gate_native_cache_root_shell_emit_dissolution_trigger: DissolutionCondition = unbound_dissolution(description: "🟡 dissolve-on: compiler_gate_native_cache_root_script — hand-authored two-line shell binding the job-private native product store root under RUNNER_TEMP. DISSOLVES WHEN the restore of the shared native product store is an emitted intent that names its job-private directory (a typed host-effect realization through v2.workflow.bash_emit bash_emit_program), so the mkdir and the GITHUB_ENV append are derived from that intent rather than spelled here.")
-
-data compiler_gate_native_cache_root_script: String = concat("# ", concat(dissolution_description(condition: compiler_gate_native_cache_root_shell_emit_dissolution_trigger), concat("\n", "mkdir -p \"$RUNNER_TEMP/gunbc-native-products\"\necho \"GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TEMP/gunbc-native-products\" >> \"$GITHUB_ENV\"")))
-
-fn compiler_gate_native_cache_root_step_for_pull_requests() -> Step {
-  RunStep {
-    name: Present { value: compiler_gate_native_cache_root_step_name },
-    id: none,
-    run: compiler_gate_native_cache_root_script,
-    shell: none,
-    env: none,
-    working_directory: none,
-    if_condition: Present { value: compiler_gate_native_cache_condition() },
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-fn compiler_gate_emit_build_native_cache_root_bound_step() -> CompilerGateBoundStep {
-  CompilerGateBoundStep {
-    step: compiler_gate_native_cache_root_step_for_pull_requests(),
-    role: consumes_only(capabilities: [RustcCapability]),
-    step_name: compiler_gate_native_cache_root_step_name,
-  }
-}
-
-// EMIT-BUILD BUILDS ITS OWN `gunbc` AND DOES NOT RESTORE THE SEED PAIR. `gunbc test` refuses a binary
-// whose cargo dep-info it cannot read inside this checkout (BinaryFreshnessUndecided, #13007): a
-// restored pair carries no dep-info for this worktree, so the freshness guard rightly cannot judge
-// it. Until that guard can judge a restored binary, this lane keeps the one build it always paid.
-fn compiler_gate_emit_build_prelude_bound_steps() -> List<CompilerGateBoundStep> {
-  concat(compiler_gate_fleet_head_bound_steps(), [
-    compiler_gate_emit_build_native_cache_root_bound_step(),
-    CompilerGateBoundStep { step: compiler_gate_native_read_auth_step(), role: capability_neutral, step_name: compiler_gate_native_read_auth_step_name },
-    CompilerGateBoundStep { step: compiler_gate_native_write_auth_step(), role: capability_neutral, step_name: compiler_gate_native_write_auth_step_name },
-    CompilerGateBoundStep {
-      step: witness_floor_build_step(
-        step_name: compiler_gate_build_step_name,
-        build_script: repo_self_build_command(bins: compiler_gate_required_bins),
-      ),
-      role: consumes_only(capabilities: [CargoCapability]),
-      step_name: compiler_gate_build_step_name,
-    },
-    CompilerGateBoundStep {
-      step: witness_toolchain_homes_isolated_guard_step(),
-      role: capability_neutral,
-      step_name: "Require isolated toolchain homes",
-    },
-  ])
-}
-
-fn compiler_gate_emit_build_bound_steps() -> List<CompilerGateBoundStep> {
-  concat(
-    concat(
-      concat(compiler_gate_emit_build_prelude_bound_steps(), compiler_gate_emit_build_subject_bound_steps()),
-      [CompilerGateBoundStep { step: compiler_gate_native_save_step(), role: consumes_only(capabilities: [CargoCapability]), step_name: compiler_gate_native_save_step_name }],
-    ),
-    [CompilerGateBoundStep {
-      step: compiler_gate_emit_build_notice_step(),
-      role: capability_neutral,
-      step_name: "Why this lane is red, and what would be a real finding",
-    }]
-  )
-}
-
-fn compiler_gate_emit_build_capability_closure_holds() -> Bool {
-  capability_closure_is_closed(
-    v: workflow_job_capability_closure(
-      steps: list_map(
-        xs: compiler_gate_emit_build_bound_steps(),
-        f: fn(b) { CapabilityAnnotatedStep { step_name: b.step_name, role: b.role } },
-      )
-    ),
-  )
-}
-
-fn compiler_gate_emit_build_job() -> Job {
+fn compiler_gate_required_job() -> Job {
   Job {
-    id: compiler_gate_emit_build_job_id,
+    id: compiler_gate_required_job_id,
     name: none,
     runner: gunbc_ci_selected_runner_spec(),
     environment: none,
@@ -1323,660 +463,19 @@ fn compiler_gate_emit_build_job() -> Job {
       ]
     },
     outputs: none,
-    if_condition: Present { value: compiler_gate_floor_job_condition() },
+    if_condition: Present { value: compiler_gate_fleet_job_condition() },
     timeout_minutes: Present { value: compiler_gate_emit_build_timeout_minutes },
     continue_on_error: none,
     concurrency: none,
-    permissions: Present { value: compiler_gate_native_permissions }
-  }
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// THE SEED LANE: THE COMPILER PAIR IS BUILT OR RESTORED ONCE PER RUN.
-//
-// OPERATOR DIRECTION 2026-10-06 (CI programme item 1, rows R1/R2; operator authorized changing the required job roster for this programme):
-// the three fleet lanes each built the same two binaries from the same tree, so a run paid the
-// release build three times on three runners. The pair is one product keyed by
-// gunbc.fleet_release_bins_key compiler_pair_release_product -- the same keyed materialization
-// fleet-converge's build job uses, so the cache lookup, the restore into staging, the complete
-// verification before any restored binary runs and the build-log member are that module's, not
-// re-derived here. This job derives the key, looks it up (admitted refs only), builds ONLY on a miss
-// (release_bins_build_condition), packs on a build and hands the pack to the three consumers as a
-// workflow artifact. A consumer verifies the pack against this job's key and promotes it into its
-// OWN checkout's target/release, so every consumer still runs the binaries from a private writable
-// directory; nothing is shared by path.
-//
-// A MISS IS THE FULL BUILD, NOT A LOSS OF COVERAGE: the build line is the product's own build_line,
-// the very text the key names. A lookup that cannot answer is not absence (the lookup step says so),
-// and a pack that does not verify refuses. The job is a roster growth the operator authorized for
-// this programme; it replaces two of three builds per run.
-data compiler_gate_seed_job_id: String = "seed"
-
-data compiler_gate_seed_build_step_name: String = "Build the compiler pair (keyed miss only)"
-data compiler_gate_pair_restore_step_name: String = "Verify the seed's compiler pair against its key and promote it into this checkout"
-
-fn compiler_gate_seed_run_step(name: String, id: String?, script: String, env: List<YamlKeyValue>, condition: String?, timeout: Int?) -> Step {
-  RunStep {
-    name: Present { value: name },
-    id: id,
-    run: script,
-    shell: none,
-    env: if length(xs: env) == 0 { none } else { Present { value: env } },
-    working_directory: none,
-    if_condition: condition,
-    continue_on_error: none,
-    timeout_minutes: timeout
-  }
-}
-
-fn compiler_gate_seed_key_expression() -> String {
-  join(["$", "{{ needs.", compiler_gate_seed_job_id, ".outputs.", release_bins_key_job_output, " }}"], "")
-}
-
-fn compiler_gate_pair_restore_step() -> Step {
-  compiler_gate_seed_run_step(
-    name: compiler_gate_pair_restore_step_name,
-    id: Present { value: "build_witness_fold" },
-    script: release_bins_consumer_key_check_script_for(product: compiler_pair_release_product()),
-    env: [kv(key: "RELEASE_BINS_KEY", value: yaml_string(s: compiler_gate_seed_key_expression()))],
-    condition: none,
-    timeout: Present { value: gunbc_ci_aux_step_timeout_minutes },
-  )
-}
-
-fn compiler_gate_seed_bound_steps() -> List<CompilerGateBoundStep> {
-  concat(compiler_gate_fleet_head_bound_steps(), [
-    CompilerGateBoundStep {
-      step: compiler_gate_seed_run_step(
-        name: "Key the compiler pair (stamps the build with the materialized tree)",
-        id: Present { value: release_bins_key_step_id },
-        script: release_bins_key_script_for(product: compiler_pair_release_product()),
-        env: [],
-        condition: none,
-        timeout: Present { value: gunbc_ci_aux_step_timeout_minutes },
-      ),
-      role: consumes_only(capabilities: [CargoCapability, RustcCapability]),
-      step_name: "Key the compiler pair (stamps the build with the materialized tree)",
-    },
-    CompilerGateBoundStep {
-      step: ci_release_bins_lookup_step(),
-      role: capability_neutral,
-      step_name: "Look up the compiler pair by exact key",
-    },
-    CompilerGateBoundStep {
-      step: ci_release_bins_cache_step(),
-      role: capability_neutral,
-      step_name: "Restore the compiler pair into isolated staging",
-    },
-    CompilerGateBoundStep {
-      step: compiler_gate_seed_run_step(
-        name: "Decide the compiler pair outcome; verify a stored pack completely before any restored binary runs",
-        id: Present { value: release_bins_outcome_step_id },
-        script: release_bins_outcome_script_for(product: compiler_pair_release_product()),
-        env: [
-          kv(key: "RELEASE_BINS_KEY", value: yaml_string(s: release_bins_key_expression())),
-          kv(key: "LOOKUP_STANDING", value: yaml_string(s: release_bins_lookup_standing_expression())),
-          kv(key: "LOOKUP_ENTRY", value: yaml_string(s: release_bins_lookup_entry_expression())),
-          kv(key: "CACHE_HIT", value: yaml_string(s: release_bins_cache_hit_expression())),
-        ],
-        condition: none,
-        timeout: Present { value: gunbc_ci_aux_step_timeout_minutes },
-      ),
-      role: consumes_only(capabilities: [CargoCapability]),
-      step_name: "Decide the compiler pair outcome",
-    },
-    CompilerGateBoundStep {
-      step: ci_cache_cargo_step(),
-      role: capability_neutral,
-      step_name: "Cache Cargo",
-    },
-    CompilerGateBoundStep {
-      step: compiler_gate_seed_run_step(
-        name: compiler_gate_seed_build_step_name,
-        id: Present { value: "build_witness_fold" },
-        script: concat(wrap_command_with_floor_attempt_receipt(command: compiler_pair_release_product().build_line), "\n"),
-        env: [],
-        condition: Present { value: release_bins_build_condition() },
-        timeout: none,
-      ),
-      role: consumes_only(capabilities: [CargoCapability]),
-      step_name: compiler_gate_seed_build_step_name,
-    },
-    CompilerGateBoundStep {
-      step: compiler_gate_seed_run_step(
-        name: "Pack the compiler pair with its build log (build outcomes only)",
-        id: none,
-        script: release_bins_pack_manifest_script_for(product: compiler_pair_release_product()),
-        env: [kv(key: "RELEASE_BINS_KEY", value: yaml_string(s: release_bins_key_expression()))],
-        condition: Present { value: release_bins_build_condition() },
-        timeout: Present { value: gunbc_ci_aux_step_timeout_minutes },
-      ),
-      role: capability_neutral,
-      step_name: "Pack the compiler pair with its build log (build outcomes only)",
-    },
-    CompilerGateBoundStep {
-      step: ci_release_bins_upload_step(),
-      role: capability_neutral,
-      step_name: "Upload release-bins artifact",
-    },
-    CompilerGateBoundStep {
-      step: compiler_gate_seed_run_step(
-        name: "Wrap the compiler pair as the merge-group candidate object",
-        id: none,
-        script: release_bins_pack_object_script(),
-        env: [],
-        condition: Present { value: compiler_gate_candidate_condition() },
-        timeout: Present { value: gunbc_ci_aux_step_timeout_minutes },
-      ),
-      role: capability_neutral,
-      step_name: "Wrap the compiler pair as the merge-group candidate object",
-    },
-    CompilerGateBoundStep {
-      step: UsesStep {
-        name: Present { value: "Upload the compiler pair candidate" },
-        id: none,
-        uses: upload_artifact_action,
-        with: Present {
-          value: [
-            kv(key: "name", value: yaml_string(s: compiler_pair_candidate_artifact_name)),
-            kv(key: "path", value: yaml_string(s: release_bins_pack_object_path_expression())),
-            kv(key: "if-no-files-found", value: yaml_string(s: "error")),
-            kv(key: "retention-days", value: yaml_int(n: compiler_pair_candidate_retention_whole_days())),
-            kv(key: "compression-level", value: yaml_int(n: 0))
-          ]
-        },
-        env: none,
-        if_condition: Present { value: compiler_gate_candidate_condition() },
-        continue_on_error: none,
-        timeout_minutes: none
-      },
-      role: capability_neutral,
-      step_name: "Upload the compiler pair candidate",
-    },
-    CompilerGateBoundStep {
-      step: witness_toolchain_homes_isolated_guard_step(),
-      role: capability_neutral,
-      step_name: "Require isolated toolchain homes",
-    },
-  ])
-}
-
-fn compiler_gate_seed_capability_closure_holds() -> Bool {
-  capability_closure_is_closed(
-    v: workflow_job_capability_closure(
-      steps: list_map(
-        xs: compiler_gate_seed_bound_steps(),
-        f: fn(b) { CapabilityAnnotatedStep { step_name: b.step_name, role: b.role } },
-      )
-    ),
-  )
-}
-
-fn compiler_gate_seed_job() -> Job {
-  Job {
-    id: compiler_gate_seed_job_id,
-    name: none,
-    runner: gunbc_ci_selected_runner_spec(),
-    environment: none,
-    steps: list_map(xs: compiler_gate_seed_bound_steps(), f: fn(b) { b.step }),
-    needs: [],
-    env: Present {
-      value: [
-        kv(key: malloc_arena_max_env_key, value: yaml_string(s: malloc_arena_max_value))
-      ]
-    },
-    outputs: Present {
-      value: [kv(key: release_bins_key_job_output, value: yaml_string(s: release_bins_key_expression()))]
-    },
-    if_condition: Present { value: compiler_gate_floor_job_condition() },
-    timeout_minutes: Present { value: compiler_gate_floor_timeout_minutes },
-    continue_on_error: none,
-    concurrency: none,
-    permissions: Present {
-      value: WorkflowPermissions {
-        contents: Present { value: PermRead },
-        pull_requests: none,
-        issues: none,
-        actions: Present { value: PermRead },
-        id_token: none,
-      }
-    }
-  }
-}
-
-// A LANE RESULT IS AN EXPRESSION, NOT SHELL TEXT, AND THE JOB ID IS NOT ALWAYS DOT-SAFE.
-//
-// `-` is the SUBTRACTION OPERATOR in the Actions expression language, so `needs.emit-build.result`
-// does not dereference a job: it parses as arithmetic over three undefined operands and renders
-// EMPTY. Downstream that compares unequal to `success` on every run, including all-green ones -- a
-// gate whose only reachable state is red, which carries exactly as much information as one that
-// can never go red. gunbc#6f358d269b found that on the previous workflow's hyphenated lane ids and
-// taught `extdeps.github.expressions` to choose index form (`needs['emit-build'].result`) from the
-// segment; this module was then written with THREE dot-safe job ids and hand-spelled its
-// interpolations as string literals, which agreed with the authority by coincidence and stopped
-// agreeing the moment a lane id carried a hyphen.
-//
-// So every lane result now renders through that authority, the dot-safe ones included: their bytes
-// are unchanged, which is the point -- the four call sites become one rule instead of three
-// literals that happen to be right and one that is not.
-fn compiler_gate_lane_result_expression(job_id: String) -> String {
-  interpolate(expression: ContextAccess { context: Needs, path: [job_id, "result"] })
-}
-
-// The ruleset requires a check named `witnesses`, and a job's check is named by its id.
-data compiler_gate_aggregate_job_id: String = "witnesses"
-
-// ═══════════════════════════════════════════════════════════════════════════════════════════
-// THE GATE IS DERIVED FROM THE ROSTER -- ALL OF IT, NOT THE `needs` EDGE ALONE
-// ═══════════════════════════════════════════════════════════════════════════════════════════
-//
-// THE DEFECT THIS CLOSES, AND IT WAS IN THE FIRST CUT OF THIS ROSTER (review 69973). `needs` is
-// NOT what makes a lane block. This job is `if: always()`, so a `needs` edge only orders it; the
-// verdict is computed entirely from the env bindings and the shell conditionals below. A roster
-// joined against `needs` alone therefore moved the silent absence from the `needs` list to the
-// ENV list rather than removing it -- and it did so while ASSERTING that the two representations
-// agree, which is worse than the state it replaced, because an inflated claim never ranks for
-// climbing (DESIGN section 4b(1)).
-//
-// The scenario the row itself scheduled: the follow-up that flips `emit-build` to `LaneBlocks`
-// adds the row word and gains the `needs` edge, forgets the script clause, and gets a green
-// `compiler_gate_lane_standings_hold`, a green emission, and a lane that still cannot block.
-//
-// SO THE REMEDY IS CONSTRUCTION, NOT A WIDER CHECK (DESIGN section 5). The env block, every
-// conditional and the echo line are FOLDED FROM `compiler_gate_lane_rows`, so a blocking lane
-// without a variable, or a variable no clause reads, has no constructor. The only join left is
-// jobs-list against roster, because the workflow's job list is the one surface this module does
-// not derive from the roster.
-//
-// THE VARIABLE NAME IS A ROW FIELD rather than a transformation of the job id, for the reason
-// the step id is: a shell variable name and a job id are different namespaces with different
-// alphabets -- `emit-build` is not a variable name -- so deriving one from the other means
-// authoring a mangling rule whose only consumer is this list.
-
-fn compiler_gate_var_read(row: CompilerGateLaneRow) -> String {
-  join(["\"$", row.var_name, "\""], "")
-}
-
-fn compiler_gate_var_report(row: CompilerGateLaneRow) -> String {
-  join([row.job_id, "=$", row.var_name], "")
-}
-
-fn compiler_gate_blocking_rows() -> List<CompilerGateLaneRow> {
-  compiler_gate_blocking_rows_of(rows: compiler_gate_lane_rows())
-}
-
-// THE AGGREGATE IS A FUNCTION OF A SUPPLIED ROSTER, and the live gate is that function applied to
-// `compiler_gate_lane_rows`. The roster is the one input every surface below derives from, so
-// taking it as a parameter lets a witness state a LAW over any roster -- an announced lane binds no
-// variable, a blocking lane is read by every arm -- over a supplied row, while the live claims
-// assert which lanes block today (DESIGN section 3: a witness discriminates at one interface).
-fn compiler_gate_blocking_rows_of(rows: List<CompilerGateLaneRow>) -> List<CompilerGateLaneRow> {
-  filter(xs: rows, predicate: compiler_gate_lane_blocks)
-}
-
-fn compiler_gate_strict_rows_of(rows: List<CompilerGateLaneRow>) -> List<CompilerGateLaneRow> {
-  filter(xs: compiler_gate_blocking_rows_of(rows: rows), predicate: fn(row) {
-    match row.arm {
-      GateArmStrict => true
-      GateArmSkippableOnFork { notice: _, unobserved_error: _ } => false
-      GateArmSkippedOnPullRequest { notice: _, unobserved_error: _ } => false
-    }
-  })
-}
-
-fn compiler_gate_fork_rows_of(rows: List<CompilerGateLaneRow>) -> List<CompilerGateLaneRow> {
-  filter(xs: compiler_gate_blocking_rows_of(rows: rows), predicate: fn(row) {
-    match row.arm {
-      GateArmStrict => false
-      GateArmSkippableOnFork { notice: _, unobserved_error: _ } => true
-      GateArmSkippedOnPullRequest { notice: _, unobserved_error: _ } => true
-    }
-  })
-}
-
-fn compiler_gate_report_text(rows: List<CompilerGateLaneRow>) -> String {
-  join(list_map(xs: rows, f: compiler_gate_var_report), " ")
-}
-
-// THE COMPARISON IS `!= success` AND NOT A LIST OF BAD STATES, carried over from the roster this
-// module displaced and still a measured fact rather than a preference: run 32883390033 read
-// `FLOOR="abandoned"`, a `needs.*.result` value nobody knew was reachable, and an enumerated
-// guard would have admitted it and reported the required context GREEN over two lanes that never
-// ran. The strict inequality admits exactly one state and refuses every other, including ones the
-// author has never heard of.
-fn compiler_gate_is_failure_clause(row: CompilerGateLaneRow) -> String {
-  join(["[ ", compiler_gate_var_read(row: row), " = failure ]"], "")
-}
-
-fn compiler_gate_not_success_clause(row: CompilerGateLaneRow) -> String {
-  join(["[ ", compiler_gate_var_read(row: row), " != success ]"], "")
-}
-
-fn compiler_gate_echo_line(rows: List<CompilerGateLaneRow>) -> String {
-  join([
-    "echo \"required lanes: ",
-    compiler_gate_report_text(rows: compiler_gate_blocking_rows_of(rows: rows)),
-    " (same_repo=$SAME_REPO)\""
-  ], "")
-}
-
-fn compiler_gate_failure_line(rows: List<CompilerGateLaneRow>) -> String {
-  join([
-    "if ",
-    join(list_map(xs: compiler_gate_blocking_rows_of(rows: rows), f: compiler_gate_is_failure_clause), " || "),
-    "; then echo \"::error::a required lane concluded failure (",
-    compiler_gate_report_text(rows: compiler_gate_blocking_rows_of(rows: rows)),
-    ") - open that job's log\" >&2; exit 1; fi"
-  ], "")
-}
-
-// THE SECOND ARM SAYS SOMETHING THE FIRST DOES NOT, and keeping them apart is the whole reason
-// there are two: a lane that FAILED is a verdict about the diff, and a lane that produced no
-// conclusion of its own leaves the head UNOBSERVED. Both block; they send a reader to different
-// places.
-fn compiler_gate_unobserved_line(rows: List<CompilerGateLaneRow>) -> String {
-  join([
-    "if ",
-    join(list_map(xs: compiler_gate_strict_rows_of(rows: rows), f: compiler_gate_not_success_clause), " || "),
-    "; then echo \"::error::a required lane produced no conclusion of its own, so this head is unobserved rather than failed (",
-    compiler_gate_report_text(rows: compiler_gate_strict_rows_of(rows: rows)),
-    ")\" >&2; exit 1; fi"
-  ], "")
-}
-
-fn compiler_gate_fork_line(row: CompilerGateLaneRow) -> String {
-  match row.arm {
-    GateArmStrict => ""
-    GateArmSkippedOnPullRequest { notice: n, unobserved_error: e } =>
-      join([
-        "if ", compiler_gate_not_success_clause(row: row),
-        "; then if [ \"$GITHUB_EVENT_NAME\" = pull_request ] && [ ", compiler_gate_var_read(row: row), " = skipped ]",
-        "; then echo \"::notice::", n, "\"",
-        "; else echo \"::error::", e, " (", compiler_gate_var_report(row: row),
-        "), so this head carries no verdict from that lane\"; exit 1; fi; fi"
-      ], "")
-    GateArmSkippableOnFork { notice: n, unobserved_error: e } =>
-      join([
-        "if ", compiler_gate_not_success_clause(row: row),
-        "; then if [ \"$SAME_REPO\" = false ] && [ ", compiler_gate_var_read(row: row), " = skipped ]",
-        "; then echo \"::notice::", n, "\"",
-        "; else echo \"::error::", e, " (", compiler_gate_var_report(row: row),
-        "), so this head carries no verdict from that lane\"; exit 1; fi; fi"
-      ], "")
-  }
-}
-
-// THE STRICT ARM IS A LINE ONLY WHILE A STRICT LANE BLOCKS. Since the 2026-09-28 ruling every
-// blocking lane runs on the fleet and is skippable on a fork, so no blocking row is strict, and the
-// unobserved line over zero rows would render `if ; then` -- a shell syntax error that reds the
-// required context on every run, a gate whose only reachable state is red. The fork lines already
-// refuse `!= success` for every fleet lane, so omitting the empty line loses no refusal.
-fn compiler_gate_unobserved_lines(rows: List<CompilerGateLaneRow>) -> List<String> {
-  if length(xs: compiler_gate_strict_rows_of(rows: rows)) == 0 { [] } else { [compiler_gate_unobserved_line(rows: rows)] }
-}
-
-fn compiler_gate_aggregate_script_lines() -> List<String> {
-  compiler_gate_aggregate_script_lines_for(rows: compiler_gate_lane_rows())
-}
-
-fn compiler_gate_aggregate_script_lines_for(rows: List<CompilerGateLaneRow>) -> List<String> {
-  list_append(
-    left: list_append(left: [compiler_gate_echo_line(rows: rows), compiler_gate_failure_line(rows: rows)], right: compiler_gate_unobserved_lines(rows: rows)),
-    right: list_map(xs: compiler_gate_fork_rows_of(rows: rows), f: compiler_gate_fork_line)
-  )
-}
-
-// THE FORK PREDICATE HAS ONE AUTHORITY AND THIS IS NOT IT (review 69999). The first cut of the
-// derived gate promoted the inline `${{ ... }}` literal to a `data` row, which looked like
-// consolidation and was the opposite: a verbatim re-spelling of the predicate
-// `compiler_gate_floor_job_condition` already derives one screen up from
-// `gunbc.heal_workflow` `heal_same_repository_clause`, which this module already imports.
-//
-// THE COUPLING IS LOAD-BEARING, NOT COSMETIC, which is why a second spelling is a defect rather
-// than untidiness: the floor lane SKIPS exactly when that condition is false, and the gate's fork
-// carve-out EXCUSES that skip exactly when `$SAME_REPO` is false. Two sources for one predicate
-// and the two failure modes are opposite and both silent -- the fleet lane skips while the gate
-// refuses (a merge-queue stall on every fork PR), or the gate excuses a skip that was not
-// fork-driven (an unobserved head admitted). One authority makes both unwritable.
-//
-// ONLY THE INTERPOLATION DELIMITERS ARE ADDED HERE, and they are read from the expression
-// writer's own spellings rather than typed, for the same reason the lane results are: a job `if`
-// takes a bare expression and a step `env` value takes an interpolated one, which is a difference
-// of TRANSPORT, not of predicate.
-fn compiler_gate_same_repo_expression() -> String {
-  join([
-    default_expression_spellings.interp_open,
-    compiler_gate_floor_job_condition(),
-    default_expression_spellings.interp_close
-  ], "")
-}
-
-fn compiler_gate_aggregate_step_env() -> List<YamlKeyValue> {
-  compiler_gate_aggregate_step_env_for(rows: compiler_gate_lane_rows())
-}
-
-fn compiler_gate_aggregate_step_env_for(rows: List<CompilerGateLaneRow>) -> List<YamlKeyValue> {
-  list_append(
-    left: list_map(xs: compiler_gate_blocking_rows_of(rows: rows), f: fn(row) {
-      kv(key: row.var_name, value: yaml_string(s: compiler_gate_lane_result_expression(job_id: row.job_id)))
-    }),
-    right: [kv(key: "SAME_REPO", value: yaml_string(s: compiler_gate_same_repo_expression()))]
-  )
-}
-
-fn compiler_gate_aggregate_step() -> Step {
-  RunStep {
-    name: Present { value: "Every required lane must have succeeded" },
-    id: none,
-    run: join(compiler_gate_aggregate_script_lines(), "\n"),
-    shell: none,
-    env: Present { value: compiler_gate_aggregate_step_env() },
-    working_directory: none,
-    if_condition: none,
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-// ON THE FLEET, AND WITH NO FORK GUARD (operator ruling 2026-09-28). The job checks nothing out,
-// installs no toolchain and runs one short script over its lanes' results, so it runs no pull-request
-// code of its own and holds a slot for seconds -- where on the hosted pool it waited minutes for one
-// (the header's receipts). It carries no `if` beyond always() because a skipped job's check is not
-// a refusal: the required context must be produced on every run, and the fork carve-out lives in the
-// lane rows the script reads.
-fn compiler_gate_aggregate_job() -> Job {
-  Job {
-    id: compiler_gate_aggregate_job_id,
-    name: none,
-    runner: gunbc_ci_selected_runner_spec(),
-    environment: none,
-    steps: [compiler_gate_aggregate_step()],
-    needs: compiler_gate_blocking_job_ids(),
-    env: none,
-    outputs: none,
-    if_condition: Present { value: "always()" },
-    timeout_minutes: Present { value: 5 },
-    continue_on_error: none,
-    concurrency: none,
     permissions: Present { value: compiler_gate_permissions }
   }
 }
 
-// EVERY JOB THAT IS NOT THE AGGREGATE DECLARES WHETHER IT BLOCKS, AND THE TWO STATES ARE
-// DERIVED FROM ONE ROSTER RATHER THAN FROM THE ABSENCE OF AN EDGE.
-//
-// THE FAIL-OPEN THIS CLOSES. A job present in the workflow but absent from the aggregate's
-// `needs` RUNS AND CANNOT BLOCK: it publishes its own check, which no ruleset requires, while the
-// one required context concludes success over a lane it never read. Before this roster the jobs
-// list and the `needs` list were two spellings of one fact, and that state was reachable by
-// forgetting an edge -- silently, with a green gate.
-//
-// WHY THE ANSWER IS NOT "EVERY JOB MUST BE NEEDED". A lane that runs and does not block is a
-// LEGITIMATE INTERIM: `emit-build` stood in it from 2026-09-22 (operator ruling, v2 foundation
-// manager: land it PRESENT and NOT BLOCKING while main could not self-host) until 2026-10-02, when
-// the operator signed off its fleet claim and its row became LaneBlocks. No lane stands in it today;
-// the arm is kept because the next lane to land may need it. The defect is not that such a lane exists; it is that its non-blocking standing was
-// INFERRABLE FROM AN ABSENCE, where a forgotten edge and a deliberate interim are the same bytes.
-//
-// So the standing is DECLARED and it carries the trigger that retires it -- and, since review
-// 69973, EVERY GATING SURFACE IS FOLDED FROM THIS ROSTER rather than joined against it. The first
-// cut joined the roster against the aggregate's `needs` and claimed the representations agreed;
-// they did not, because this job is `if: always()` and a `needs` edge only orders it. The verdict
-// is computed from the env bindings and the shell conditionals, so joining `needs` moved the
-// silent absence one surface along while asserting it had been removed. `needs`, the env block,
-// the echo line and every conditional now derive from these rows, so a blocking lane without a
-// variable, or a variable no clause reads, has no constructor (DESIGN section 5: construction
-// over validation). Flipping `emit-build` to required is one word on one row plus the job's move
-// onto the fleet, which compiler_gate_merge_path_runs_on_the_fleet refuses to let anyone forget; and
-// forgetting to flip it leaves a row whose trigger anyone reading the roster can see -- not an edge,
-// and not a variable, that nobody can see is missing.
-type CompilerGateLaneStanding
-  = LaneBlocks
-  | LaneAnnouncedNotBlocking { flip_trigger: String }
-
-// THE GATE ARM IS A PROPERTY OF THE LANE, NOT A SPECIAL CASE IN THE SCRIPT. Two lanes differ in
-// what a non-success MEANS. For a strict lane -- one that runs on every pull request, forks included,
-// as the deleted hosted compiler and lint lanes did -- any non-success is a head this gate cannot
-// vouch for. A fleet lane legitimately SKIPS on a fork pull request -- there is no witnesses fold and
-// no generated-artifact verdict for that head, and saying so is a notice rather than a refusal.
-// Carrying that as a row field is what lets the whole script be derived; carrying it as a
-// hand-written fourth line is what let the script drift from the roster. Since the 2026-09-28 ruling
-// every blocking lane is a fleet lane, so today no live row carries GateArmStrict (emit-build left it when it moved),
-// and a hosted lane cannot turn blocking without moving (compiler_gate_merge_path_runs_on_the_fleet).
-// GateArmSkippedOnPullRequest is a lane that does not run on pull_request at all (operator 2026-10-06,
-// gunbc.rung_drop rust_unit_tests_off_pull_requests): a skip is excused only when the event IS
-// pull_request, and it blocks on merge_group and workflow_dispatch like any blocking lane.
-type CompilerGateArm
-  = GateArmStrict
-  | GateArmSkippableOnFork { notice: String, unobserved_error: String }
-  | GateArmSkippedOnPullRequest { notice: String, unobserved_error: String }
-
-type CompilerGateLaneRow {
-  job_id: String
-  var_name: String
-  standing: CompilerGateLaneStanding
-  arm: CompilerGateArm
-}
-
-// THE UNIT-TEST ROW BLOCKS AGAIN. It was LaneAnnouncedNotBlocking under gunbc.rung_drop
-// rust_unit_tests_over_their_cap from 2026-10-05, when the step overran its cap on every head after
-// gunbc#12951; it blocks again with a cap derived after gunbc#13452 (see compiler_gate_unit_test_timeout).
-// That drop is superseded by the #13452 deletion ruling, not retired by its trigger.
-fn compiler_gate_lane_rows() -> List<CompilerGateLaneRow> {
-  [
-    CompilerGateLaneRow {
-      job_id: compiler_gate_unit_test_job_id,
-      var_name: "RUST_UNIT_TESTS",
-      arm: GateArmSkippedOnPullRequest {
-        notice: "the v1 unit-test lane does not run on pull_request: it runs on merge_group and workflow_dispatch on the fleet",
-        unobserved_error: "the v1 unit-test lane produced no success"
-      },
-      standing: LaneBlocks,
-    },
-    CompilerGateLaneRow {
-      job_id: compiler_gate_seed_job_id,
-      var_name: "SEED",
-      standing: LaneBlocks,
-      arm: GateArmSkippableOnFork {
-        notice: "the seed lane is skipped for a fork pull request: no compiler pair was built or restored for this head",
-        unobserved_error: "the seed lane produced no success"
-      }
-    },
-    CompilerGateLaneRow {
-      job_id: compiler_gate_emit_build_job_id,
-      var_name: "EMIT_BUILD",
-      standing: LaneBlocks,
-      arm: GateArmSkippableOnFork {
-        notice: "the emit-build lane is skipped for a fork pull request: no self-host or native-CLI emission verdict for this head",
-        unobserved_error: "the emit-build lane produced no success"
-      }
-    },
-    CompilerGateLaneRow {
-      job_id: compiler_gate_floor_job_id,
-      var_name: "FLOOR",
-      standing: LaneBlocks,
-      arm: GateArmSkippableOnFork {
-        notice: "the fleet lane is skipped for a fork pull request: no witnesses fold and no generated-artifact verdict for this head",
-        unobserved_error: "the fleet lane produced no success"
-      }
-    },
-    CompilerGateLaneRow {
-      job_id: compiler_gate_generated_job_id,
-      var_name: "GENERATED",
-      standing: LaneBlocks,
-      arm: GateArmSkippableOnFork {
-        notice: "the generated-artifact lane is skipped for a fork pull request: no generated-artifact verdict for this head",
-        unobserved_error: "the generated-artifact lane produced no success"
-      }
-    },
-  ]
-}
-
-fn compiler_gate_lane_blocks(row: CompilerGateLaneRow) -> Bool {
-  match row.standing {
-    LaneBlocks => true
-    LaneAnnouncedNotBlocking { flip_trigger: _ } => false
-  }
-}
-
-fn compiler_gate_blocking_job_ids() -> List<String> {
-  list_map(xs: compiler_gate_blocking_rows(), f: fn(row) { row.job_id })
-}
-
-// THE ONE JOIN THAT REMAINS, AND IT IS AN EMISSION CONJUNCT RATHER THAN A WITNESS because the
-// remedy is refusal, not a report: a workflow whose gate does not match its declared standings
-// must not be emitted at all, and `expected_compiler_gate_yml` already refuses to produce yaml
-// when a capability closure fails. The drift gate then reds on the refusal marker rather than on
-// a workflow that would have run.
-//
-// IT IS PARAMETERIZED ON ALL THREE SIDES so the RED is authorable at the fixture boundary, which
-// is the boundary that decides whether a top-rung check carries information (DESIGN section 4b):
-// a witness hands it disagreeing sets and reads the refusal, rather than waiting for a future
-// author to supply the only counterexample.
-//
-// WHY IT STILL TAKES `blocking` AND `needs` WHEN BOTH ARE NOW DERIVED FROM THE SAME ROSTER. Those
-// two arms are trivially true today and are kept because they are cheap and because the property
-// they state -- the gate reads exactly the lanes declared to block -- is the one a future author
-// would break by reintroducing a hand-written `needs` list. What they do NOT establish is that the
-// env and script agree, and that is not a gap: those are folded, so the claims over them live in
-// the witness as readings of a derived value rather than as a join between two authorities.
-fn compiler_gate_standings_agree(
-  job_ids: List<String>,
-  rostered: List<String>,
-  blocking: List<String>,
-  needs: List<String>
-) -> Bool {
-  let every_job_rostered = all(job_ids, id => any(rostered, r => r == id))
-  let no_phantom_row = all(rostered, r => any(job_ids, id => id == r))
-  let every_blocker_needed = all(blocking, b => any(needs, n => n == b))
-  let no_unblocking_need = all(needs, n => any(blocking, b => b == n))
-  every_job_rostered && no_phantom_row && every_blocker_needed && no_unblocking_need
-}
-
-fn compiler_gate_non_aggregate_job_ids() -> List<String> {
-  list_map(
-    xs: filter(
-      xs: compiler_gate_workflow.jobs,
-      predicate: fn(j) { j.id != compiler_gate_aggregate_job_id }
-    ),
-    f: fn(j) { j.id }
-  )
-}
-
-fn compiler_gate_lane_standings_hold() -> Bool {
-  compiler_gate_standings_agree(
-    job_ids: compiler_gate_non_aggregate_job_ids(),
-    rostered: list_map(xs: compiler_gate_lane_rows(), f: fn(row) { row.job_id }),
-    blocking: compiler_gate_blocking_job_ids(),
-    needs: compiler_gate_aggregate_job().needs
-  )
-}
-
 // ═══════════════════════════════════════════════════════════════════════════════════════════
 // THE MERGE PATH RUNS ON THE FLEET -- AN EMISSION CONJUNCT, NOT A CONVENTION (operator ruling 2026-09-28)
 // ═══════════════════════════════════════════════════════════════════════════════════════════
 //
-// The merge path is every lane the required context reads plus the aggregate that reads them. A
+// The merge path is the required job. A
 // hosted job on it makes every landing wait for a slot in a pool this repository does not control,
 // which is the stall the header records. A workflow that puts one there must not be emitted at all,
 // for the reason compiler_gate_standings_agree gives for being a conjunct: the remedy is refusal.
@@ -2010,7 +509,7 @@ fn compiler_gate_hosted_job_ids() -> List<String> {
 }
 
 fn compiler_gate_merge_path_job_ids() -> List<String> {
-  list_append(left: compiler_gate_blocking_job_ids(), right: [compiler_gate_aggregate_job_id])
+  [compiler_gate_required_job_id]
 }
 
 fn compiler_gate_merge_path_runs_on_the_fleet() -> Bool {
@@ -2041,10 +540,10 @@ data compiler_gate_workflow: Workflow = Workflow {
     kv(key: (required_ci_contract_epoch_env_key as String), value: yaml_string(s: (required_ci_contract_epoch as String)))
   ] },
   permissions: Present { value: compiler_gate_permissions },
-  jobs: [compiler_gate_unit_test_job(), compiler_gate_seed_job(), compiler_gate_emit_build_job(), compiler_gate_floor_job(), compiler_gate_generated_job(), compiler_gate_aggregate_job()]
+  jobs: [compiler_gate_required_job()]
 }
 
-data compiler_gate_capability_refusal_reason: String = "REFUSED gunbc.compiler_gate_workflow: a job's capability closure does not hold, a floor script is not renderable, the workflow runs a job that compiler_gate_lane_rows does not roster, or a blocking lane or the aggregate runs on a hosted runner (compiler_gate_merge_path_runs_on_the_fleet, operator ruling 2026-09-28). No workflow yaml was emitted. Fix the step roles in the lane's bound steps, add the job's row, or put the merge-path job on gunbc_ci_selected_runner_spec. The gate's needs, env bindings and every conditional are FOLDED from that roster, so they cannot disagree with it and this refusal has nothing to say about them."
+data compiler_gate_capability_refusal_reason: String = "REFUSED gunbc.compiler_gate_workflow: the required job's capability closure does not hold, a subject step's script is not renderable, or the required job runs on a hosted runner (compiler_gate_merge_path_runs_on_the_fleet, operator ruling 2026-09-28). No workflow yaml was emitted. Fix the step roles in the job's bound steps, or put the job on gunbc_ci_selected_runner_spec."
 
 fn expected_compiler_gate_yml() -> WitnessFloorGenerationOutcome {
   match admit_workflow_action_uses(workflow: compiler_gate_workflow) {
@@ -2059,7 +558,7 @@ fn expected_compiler_gate_yml() -> WitnessFloorGenerationOutcome {
         WorkflowToolchainHomeRefused { job_id: j, refusal: r } =>
           WitnessFloorGenerationRefused { reason: toolchain_home_refusal_reason(job_id: j, refusal: r) }
         WorkflowToolchainHomesAdmitted =>
-          if compiler_gate_unit_test_capability_closure_holds() && compiler_gate_emit_build_capability_closure_holds() && compiler_gate_seed_capability_closure_holds() && compiler_gate_floor_capability_closure_holds() && compiler_gate_generated_capability_closure_holds() && compiler_gate_floor_scripts_are_renderable() && compiler_gate_lane_standings_hold() && compiler_gate_merge_path_runs_on_the_fleet() {
+          if compiler_gate_emit_build_capability_closure_holds() && compiler_gate_emit_build_scripts_are_renderable() && compiler_gate_merge_path_runs_on_the_fleet() {
             match emit_yaml(v: project_workflow_to_yaml(workflow: compiler_gate_workflow)) {
               EmittedYaml { text: t } => WitnessFloorGenerated { content: t }
               YamlEmitRefused { path: p, reason: r } => WitnessFloorGenerationRefused { reason: yaml_emit_refusal_text(module_path: "gunbc.compiler_gate_workflow", path: p, reason: r) }
diff --git a/dag/gunbc/witness/witness_deferral_freeze.dag b/dag/gunbc/witness/witness_deferral_freeze.dag
index 202f3ee736d..33f0dd70e62 100644
--- a/dag/gunbc/witness/witness_deferral_freeze.dag
+++ b/dag/gunbc/witness/witness_deferral_freeze.dag
@@ -69,6 +69,13 @@ THE RATCHET, and why it is a freeze rather than a sweep. Classifying every histo
 // Re-adding any one falsifier cadence would restore one door; it would not restore
 // the refusal, which needs a required run to enter the discovery path. Both halves
 // are in the restoration trigger for that reason.
+// SHRINK LOG. 2026-10-05 — src/v2/test/claim/long/cwc_resolution_probe_test.dag [whole],
+// 9 identities, RETIRED because a consumer now executes them, not exempted: gunbc#13333 enrolled
+// cwc_malformed_nary_coproduct_normalize_rejects in v2.workflow.floor_expected_red, and the floor
+// refused the pair as ExpectedRedFreezeIntersection. A claim cannot be both never-executed and
+// known-red. The row deletes, so the required floor runs the file. The same change deleted
+// cwc_malformed_nary_coproduct_fail_open_control (the negation of its sibling) and repaired the
+// resolve door that cwc_cwc_module_resolve_accepts reads.
 // SHRINK LOG. 2026-10-06 — accumulator_copy lean/bash/swift/glob freeze identities deleted, not
 // renamed: their test-fn bodies were a weaker contract than zero_suspects_within_ratchet (typed
 // Filesystem.Read existence). The priced-out file_gate walks live as ordinary fns consumed by
@@ -897,16 +904,6 @@ data frozen_path_deferrals: List<FrozenPathDeferral> = [
       "cross_tree_real_ingest_dag_to_v2_denied_holds"
     ]
   },
-  FrozenPathDeferral {
-    entry: "src/v2/test/claim/long/cwc_resolution_probe_test.dag",
-    functions: [
-      "cwc_norm_two_variant_accepts", "cwc_norm_three_variant_accepts",
-      "cwc_non_coproduct_rhs_passes_through", "cwc_malformed_nary_coproduct_normalize_rejects",
-      "cwc_malformed_nary_coproduct_fail_open_control", "cwc_norm_review_event_accepts",
-      "cwc_cwc_module_resolve_accepts", "cwc_review_normalized_has_disj",
-      "cwc_review_disj_has_four_arms"
-    ]
-  },
   FrozenPathDeferral {
     entry: "src/v2/test/claim/long/dag_caret_symbol_lex_test.dag",
     functions: [
@@ -1044,23 +1041,6 @@ data frozen_path_deferrals: List<FrozenPathDeferral> = [
       "native_routing_green_control_bound_entry_reaches_subject"
     ]
   },
-  FrozenPathDeferral {
-    entry: "src/v2/test/claim/long/parse_table_memo_amortization_test.dag",
-    functions: [
-      "memo_amort_parse_one_file_holds", "memo_amort_parse_two_files_twice_holds",
-      "parse_table_grammar_memo_multi_file_ingest_parses",
-      "parse_table_memo_hit_path_content_hash_stable_holds",
-      "empty_ingest_assembles_to_empty_roots_without_prepare"
-    ]
-  },
-  FrozenPathDeferral {
-    entry: "src/v2/test/claim/long/parse_table_memo_counter_witness_test.dag",
-    functions: [
-      "parse_memo_counter_lookup_calls_recorded_holds",
-      "parse_memo_counter_counters_consistent_holds", "parse_memo_counter_misses_recorded_holds"
-    ]
-  },
-  FrozenPathDeferral { entry: "src/v2/test/claim/long/parse_table_memo_governed_witness_test.dag", functions: ["parse_table_memo_warm_equals_cold_content_hash"] },
   FrozenPathDeferral {
     entry: "src/v2/test/claim/long/parser_completeness_frontier_test.dag",
     functions: [
diff --git a/dag/gunbc/witness/witness_row_cost_basis.tsv b/dag/gunbc/witness/witness_row_cost_basis.tsv
index 4bc66ca9dd6..8b467edbe7d 100644
--- a/dag/gunbc/witness/witness_row_cost_basis.tsv
+++ b/dag/gunbc/witness/witness_row_cost_basis.tsv
@@ -670,7 +670,6 @@ src/v2/test/claim/compilation_unit_witness_test.dag	witness_fold_deps_match_boun
 src/v2/test/claim/compilation_unit_witness_test.dag	witness_fold_deps_match_boundary_edges_two_unit	4	30550328673	srv_fleet_arm64	wall
 src/v2/test/claim/compiler/compile_eval_thesis_proof_test.dag	compile_eval_bool_reaches_node_value_holds	2	30550328673	srv_fleet_arm64	wall
 src/v2/test/claim/compiler/compile_eval_thesis_proof_test.dag	compile_eval_bool_via_compile_entry_holds	1	30550328673	srv_fleet_arm64	wall
-src/v2/test/claim/compiler_materialization_witness_test.dag	parse_table_memo_plural_reds_without_provider	1	30550328673	srv_fleet_arm64	wall
 src/v2/test/claim/complexity_gate/budget_roster_completeness_test.dag	complexity_budget_roster_family_gate_holds	5	30550328673	srv_fleet_arm64	wall
 src/v2/test/claim/complexity_gate/source_bridged_add_budget_test.dag	table_fixture_add_budget_claim_holds	1	30550328673	srv_fleet_arm64	wall
 src/v2/test/claim/complexity_gate/source_bridged_bind_budget_test.dag	table_fixture_bind_budget_claim_holds	1	30550328673	srv_fleet_arm64	wall
@@ -945,7 +944,6 @@ src/v2/test/claim/manual/match_bool_emit_test.dag	match_bool_emit_holds	41	30550
 src/v2/test/claim/manual/match_bool_emit_test.dag	match_bool_emit_swapped_arms_discriminates	4	30550328673	srv_fleet_arm64	wall
 src/v2/test/claim/manual/match_infer_fail_open_audit_test.dag	classical_not_int_match_arrow_real_infer_holds	11	30550328673	srv_fleet_arm64	wall
 src/v2/test/claim/manual/match_infer_fail_open_audit_test.dag	classical_not_int_match_non_octet_arm_rejects_holds	6	30550328673	srv_fleet_arm64	wall
-src/v2/test/claim/manual/match_infer_fail_open_audit_test.dag	complement_arrow_real_infer_refuses_unsupported_pattern_holds	7	30550328673	srv_fleet_arm64	wall
 src/v2/test/claim/manual/match_infer_fail_open_audit_test.dag	match_infer_fail_open_audit_extra_arm_rejects_holds	3	30550328673	srv_fleet_arm64	wall
 src/v2/test/claim/manual/match_infer_fail_open_audit_test.dag	match_infer_fail_open_audit_non_exhaustive_rejects_holds	1	30550328673	srv_fleet_arm64	wall
 src/v2/test/claim/manual/match_infer_fail_open_audit_test.dag	match_infer_fail_open_audit_rejects_holds	1	30550328673	srv_fleet_arm64	wall
diff --git a/dag/gunbc/worker_turn_standing.dag b/dag/gunbc/worker_turn_standing.dag
new file mode 100644
index 00000000000..9b14549380a
--- /dev/null
+++ b/dag/gunbc/worker_turn_standing.dag
@@ -0,0 +1,172 @@
+module gunbc.worker_turn_standing
+
+import std.types { String, NonEmptyStr, List, FilePath, Int }
+import std.claim_evidence { RecordedFactId }
+import std.optional { Present, Absent }
+import extdeps.shell
+import extdeps.shell.exec
+import extdeps.exec.command { LocalExec }
+import extdeps.posix.sh_invocation {
+  posix_sh_export_from_file_then_exec_command,
+  PosixShExportExecReady,
+  PosixShExportExecEmitRefused,
+  PosixShKeepFile,
+  posix_sh_export_from_file_unreadable_exit,
+}
+import extdeps.posix.shell_command_language { admit_posix_shell_name, PosixShellNameAdmitted, PosixShellNameRefused }
+import extdeps.llm.cursor_cli { cursor_cli_program, cursor_api_key_env_var }
+import gunbc.command_runner { run_shell_command_observe }
+import extdeps.llm.cli_lifecycle { ProviderInstance }
+import gunbc.provider_standing {
+  ProviderStanding,
+  ProviderStandingUnobserved,
+  ProviderInstallationStanding,
+  InstallationReady,
+  InstallationStandingUnobserved,
+  ToolEnvironmentReady,
+  provider_standing_from_observed_bundle,
+}
+import gunbc.provider_standing_probe_bridge { provider_standing_bundle_from_codex_account_evidence }
+import gunbc.codex_app_server_press {
+  AmbientCodexCredentialContext,
+  codex_press_account_trip_request_lines,
+  codex_press_account_trip_program,
+  codex_press_account_trip_invocation,
+  CodexTripLock,
+  parse_account_trip_session,
+  AccountTripDigestStructural,
+}
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_provider_executable }
+import gunbc.codex_harness_credential {
+  codex_worker_turn_custody_host,
+  codex_worker_turn_codex_home,
+  codex_harness_turn_lock_path,
+  codex_harness_turn_busy_exit,
+  codex_harness_credential_context,
+}
+import gunbc.cursor_harness_credential {
+  cursor_status_reading,
+  CursorStatusReading,
+  CursorStatusAuthenticated,
+  CursorStatusUnauthenticated,
+  CursorStatusUnreadable,
+}
+
+// THE CODEX AND CURSOR OFFERS ARE JUDGED ON THE CREDENTIAL THE SPAWN BINDS, the way the Claude draw
+// is (gunbc.roadmap_dispatch_actuator claude_observed_standing_for_instance). Before this, both offers
+// carried the declared inventory's unobserved standing, so creating the secrets and converging their
+// custody could not change selection: a declared row admits no draw. Each observation here runs on
+// the custody host against the custody credential and nothing ambient, so a login someone made by hand
+// on the host cannot change the verdict. They run only on an operator's explicit executor request.
+
+data codex_harness_standing_trip_fact_id: RecordedFactId = "codex-harness-standing-trip" as RecordedFactId
+
+// THE CODEX STANDING TRIP is the existing app-server account trip (initialize, account/read,
+// account/rateLimits/read; gunbc.codex_app_server_press codex_press_account_trip_invocation) with
+// CODEX_HOME set to the custody directory and run under the same flock as a turn, because account/read may refresh the token and a refresh
+// rotates it: a trip racing a turn would present one refresh token twice. A trip that finds the lock
+// held reports the credential busy rather than a codex failure. Exhausted rate-limit buckets and a
+// dead login reach selection through provider_standing_bundle_from_codex_account_evidence, the same
+// projection the press receipt uses, and refuse there before any spawn.
+fn codex_harness_trip_lock() -> CodexTripLock {
+  CodexTripLock { lock_path: codex_harness_turn_lock_path, conflict_exit_code: codex_harness_turn_busy_exit }
+}
+
+fn codex_observed_standing_for_instance(instance: HostDashboardInstance, provider: ProviderInstance) -> ProviderStanding {
+  if (instance.host_identity as String) != (codex_worker_turn_custody_host as String) {
+    ProviderStandingUnobserved {
+      reason: join(["the codex worker-turn credential is held only on ", codex_worker_turn_custody_host as String, "; this instance runs on ", instance.host_identity as String], "") as NonEmptyStr,
+    }
+  } else {
+    match dashboard_instance_provider_executable(instance: instance) {
+      Absent => ProviderStandingUnobserved { reason: "no codex executable is placed for this instance" as NonEmptyStr }
+      Present { value: executable } => {
+        let run = shell.Exec.RunArgvStdin(
+          program: codex_press_account_trip_program(lock: Present { value: codex_harness_trip_lock() }),
+          arguments: codex_press_account_trip_invocation(
+            executable: executable,
+            codex_home: codex_worker_turn_codex_home as FilePath,
+            lock: Present { value: codex_harness_trip_lock() },
+          ),
+          stdin_payload: codex_press_account_trip_request_lines(),
+        )
+        if run.exit_code == codex_harness_turn_busy_exit {
+          ProviderStandingUnobserved { reason: "the codex worker-turn credential is in use by another turn" as NonEmptyStr }
+        } else {
+          provider_standing_from_observed_bundle(
+            fact_id: codex_harness_standing_trip_fact_id,
+            provider: provider,
+            bundle: provider_standing_bundle_from_codex_account_evidence(
+              evidence: parse_account_trip_session(
+                stdout: run.stdout,
+                stderr: run.stderr,
+                evidence_root: instance.instance_root,
+                mode: AccountTripDigestStructural,
+              ),
+              credential: codex_harness_credential_context(),
+              installation: codex_trip_installation(exit_code: run.exit_code, stderr: run.stderr),
+              tool_environment: ToolEnvironmentReady,
+            ),
+          )
+        }
+      }
+    }
+  }
+}
+
+fn codex_trip_installation(exit_code: Int, stderr: String) -> ProviderInstallationStanding {
+  if exit_code == 0 {
+    InstallationReady
+  } else {
+    InstallationStandingUnobserved {
+      reason: join(["the codex app-server trip exited ", to_string(value: exit_code), ": ", stderr], "") as NonEmptyStr,
+    }
+  }
+}
+
+// THE CURSOR STANDING. cursor-agent status runs under the custody key, exported inside the child as
+// the spawn does it, and answers only whether Cursor accepts the key. A rejected key refuses here. An
+// accepted key still does not make the offer selectable: entitlement and quota are observed by a
+// one-word turn (operator ruling D2, 2026-10-05), whose result shape is modeled from its first live
+// call, so until then the standing is unobserved and the draw refuses -- never a fabricated
+// "available".
+data cursor_entitlement_trip_pending_reason: NonEmptyStr = "cursor accepts the custody key, but entitlement and quota are read by a one-word turn whose result shape is modeled from its first live call (operator ruling D2, 2026-10-05); until then the cursor draw refuses" as NonEmptyStr
+
+fn cursor_standing_from_status(reading: CursorStatusReading) -> ProviderStanding {
+  match reading {
+    CursorStatusAuthenticated => ProviderStandingUnobserved { reason: cursor_entitlement_trip_pending_reason }
+    CursorStatusUnauthenticated { status } =>
+      ProviderStandingUnobserved { reason: join(["cursor rejects the custody key (status ", status, ")"], "") as NonEmptyStr }
+    CursorStatusUnreadable { detail } =>
+      ProviderStandingUnobserved { reason: join(["cursor-agent status output unreadable: ", detail], "") as NonEmptyStr }
+  }
+}
+
+// The status probe reads the attempt's credential snapshot and keeps it for the spawn
+// (PosixShKeepFile); the snapshot is taken by the caller (gunbc.roadmap_dispatch_actuator).
+fn cursor_observed_standing_from_snapshot(snapshot: NonEmptyStr) -> ProviderStanding {
+  match admit_posix_shell_name(spelling: cursor_api_key_env_var as String) {
+    PosixShellNameRefused { spelling } =>
+      ProviderStandingUnobserved { reason: join(["the cursor credential variable name ", spelling, " is not a POSIX shell name"], "") as NonEmptyStr }
+    PosixShellNameAdmitted { name } =>
+      match posix_sh_export_from_file_then_exec_command(
+        name: name,
+        path: snapshot,
+        command: [cursor_cli_program, "status", "--format", "json"],
+        disposition: PosixShKeepFile,
+      ) {
+        PosixShExportExecEmitRefused { name: n } =>
+          ProviderStandingUnobserved { reason: join(["the sh emitter refused the export-and-exec program for ", n as String], "") as NonEmptyStr }
+        PosixShExportExecReady { command } => {
+          let run = run_shell_command_observe(command: command, transport: LocalExec)
+          if run.exit_code == posix_sh_export_from_file_unreadable_exit {
+            ProviderStandingUnobserved {
+              reason: join(["the cursor credential snapshot ", snapshot as String, " is unreadable: ", run.stderr], "") as NonEmptyStr,
+            }
+          } else {
+            cursor_standing_from_status(reading: cursor_status_reading(stdout: run.stdout))
+          }
+        }
+      }
+  }
+}
diff --git a/dag/gunbc/workspace_allocation_admission.dag b/dag/gunbc/workspace_allocation_admission.dag
index 4494592c293..54162670c1e 100644
--- a/dag/gunbc/workspace_allocation_admission.dag
+++ b/dag/gunbc/workspace_allocation_admission.dag
@@ -9,6 +9,7 @@ import extdeps.http.server { RequestSecurityContext }
 import gunbc.principal_projection { PrincipalRef, principal_ref_eq, principal_ref_label }
 import std.list { distinct_by_key }
 import extdeps.ssh { SshPublicKey, Ed25519, ssh_ed25519_key_identity }
+import gunbc.workspace_ssh_access { WorkspaceSshAccess, WorkspaceSshFromHost, WorkspaceSshThroughGateway }
 import gunbc.roadmap_allocation_location { allocation_page_path }
 import gunbc.auth.request_authentication { RequestAccessPath,
   RequestAuthenticationEvidence, GoogleOidcSession, FabricServiceEvidence, SessionStandingInvalid, AuthAbsent, DeploymentAccessPolicy,
@@ -21,7 +22,7 @@ import gunbc.auth.request_authentication { RequestAccessPath,
 // it. The roster and catalog are administrator-authored and unadmitted; only workspace_policy_admit
 // mints the policy every consumer reads, so a request names no key, path or OpenSSH option and a
 // shared, duplicated or dangling enrollment cannot reach any consumer.
-type WorkspaceOwnerEnrollment { principal: PrincipalRef, public_key_ref: NonEmptyStr }
+type WorkspaceOwnerEnrollment { principal: PrincipalRef, public_key_ref: NonEmptyStr, ssh_access: WorkspaceSshAccess }
 type WorkspaceEnrollmentRoster { enrollments: List<WorkspaceOwnerEnrollment> }
 type WorkspacePublicKeyCatalogRow { reference: NonEmptyStr, key: SshPublicKey }
 type WorkspaceAuthorizationPolicy sole_constructor { enrollments: List<WorkspaceOwnerEnrollment>, catalog: List<WorkspacePublicKeyCatalogRow> }
@@ -54,6 +55,12 @@ fn workspace_policy_admit(roster: WorkspaceEnrollmentRoster, catalog: List<Works
     WorkspacePolicyRefused { reason: "a workspace catalog key comment contains a record separator" }
   } else if count(distinct_by_key(catalog, r => r.key.material as String)) != count(catalog) {
     WorkspacePolicyRefused { reason: "two workspace key references carry the same key material" }
+  } else if any(roster.enrollments, e => match e.ssh_access {
+    WorkspaceSshThroughGateway => false
+    WorkspaceSshFromHost { identity_file } => !starts_with(s: identity_file as String, prefix: "/")
+      || string_contains(s: identity_file as String, pattern: "\n") || string_contains(s: identity_file as String, pattern: "\r")
+  }) {
+    WorkspacePolicyRefused { reason: "host-local SSH requires an absolute single-line identity-file path" }
   } else {
     WorkspacePolicyAdmitted { policy: WorkspaceAuthorizationPolicy { enrollments: roster.enrollments, catalog: catalog } }
   }
diff --git a/dag/gunbc/workspace_allocation_dispatch.dag b/dag/gunbc/workspace_allocation_dispatch.dag
new file mode 100644
index 00000000000..ee90460625c
--- /dev/null
+++ b/dag/gunbc/workspace_allocation_dispatch.dag
@@ -0,0 +1,132 @@
+module gunbc.workspace_allocation_dispatch
+
+import std.types { String, NonEmptyStr }
+import std.algebra { trim }
+import std.process { ExitSuccess, exit_failure }
+import extdeps.shell
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.languages.json.emit { serialize_json }
+import gunbc.cli_run_workspace_root_scaffold { gunbc_workspace_root_env_name }
+import gunbc.cli_wire { CliWireResponse, CliWirePrintable }
+import gunbc.clock_read { clock_now_probed_at }
+import product.placement_supply { HostIdentity }
+import gunbc.principal_projection { PrincipalRef }
+import gunbc.fabric_storage_binding { fabric_state_storage_binding }
+import gunbc.workspace_allocation_convergence { WorkspaceConvergenceObservation, workspace_convergence_observe, WorkspaceConvergenceObserved, WorkspaceConvergenceUnobserved }
+import gunbc.workspace_allocation_launch_directive { workspace_launch_directive, workspace_launch_directive_text, workspace_launch_directive_from_text, WorkspaceLaunchDirectiveReady, WorkspaceLaunchDirectiveRefused }
+import gunbc.workspace_reconcile_once { workspace_reconcile_prepare }
+import gunbc.workspace_allocation_store { WorkspaceAllocation, workspace_allocation_json, workspace_record_preparation_wait, WorkspaceStoreWritten, WorkspaceStoreConflict, WorkspaceStoreWriteRefused }
+import gunbc.workspace_request_consumer { workspace_consumer_reconcile_enrolled, WorkspaceConsumerIdle, WorkspaceConsumerRefused, WorkspaceConsumerRetire, WorkspaceConsumerPrepare, WorkspaceConsumerRoute, WorkspaceConsumerSettled, WorkspaceConsumerRetry }
+import gunbc.workspace_allocation_policy { workspace_installed_policy }
+import gunbc.workspace_allocation_admission { workspace_owner_enrollment, workspace_enrolled_owners, WorkspacePolicyAdmitted, WorkspacePolicyRefused }
+import gunbc.workspace_operator_request { workspace_operator_on_candidate_host }
+
+// Discover the outstanding request from protected state rather than requiring an HTTP process
+// to remember or forward its identity. Retirement runs before installed-artifact or offer reads.
+fn workspace_allocation_prepare(host: NonEmptyStr, release_dir: NonEmptyStr) -> WorkspaceConvergenceObservation {
+  match clock_now_probed_at() {
+    Absent => WorkspaceConvergenceUnobserved { reason: "workspace consumer clock is unavailable" }
+    Present { value: now } => match workspace_installed_policy() {
+    WorkspacePolicyRefused { reason: detail } => WorkspaceConvergenceUnobserved { reason: detail }
+    WorkspacePolicyAdmitted { policy } => match workspace_consumer_reconcile_enrolled(store: fabric_state_storage_binding(),
+      owners: workspace_enrolled_owners(policy: policy), observed_at: now as String) {
+      WorkspaceConsumerIdle => WorkspaceConvergenceUnobserved { reason: "no outstanding workspace request" }
+      WorkspaceConsumerRefused { reason: detail } => WorkspaceConvergenceUnobserved { reason: detail }
+      WorkspaceConsumerRetry => WorkspaceConvergenceUnobserved { reason: "workspace owner changed concurrently; reconcile again" }
+      WorkspaceConsumerRetire { allocation: _ } => WorkspaceConvergenceUnobserved { reason: "workspace retirement remains outstanding" }
+      WorkspaceConsumerSettled { allocation: _ } => WorkspaceConvergenceUnobserved { reason: "unplanned workspace retirement settled; no host apply required" }
+      WorkspaceConsumerPrepare { allocation: allocation } => match workspace_reconcile_prepare(
+        store: fabric_state_storage_binding(), allocation: allocation,
+        local_host: host as HostIdentity, release_dir: release_dir) {
+        WorkspaceConvergenceUnobserved { reason: detail } => workspace_publish_preparation_wait(allocation: allocation, reason: detail)
+        WorkspaceConvergenceObserved { basis: planned } => if (planned.host as String) != (host as String) {
+          WorkspaceConvergenceUnobserved { reason: concat("workspace plan selected another host: ", planned.host as String) }
+        } else { workspace_allocation_selected(owner: allocation.request.owner,
+          request_key: allocation.request.idempotency_key, host: host, release_dir: release_dir) }
+      }
+      WorkspaceConsumerRoute { allocation: allocation } => workspace_allocation_selected(
+        owner: allocation.request.owner, request_key: allocation.request.idempotency_key, host: host, release_dir: release_dir)
+    }
+    }
+  }
+}
+
+// A preparation that could not select publishes its located reason for the owner's view and stops.
+fn workspace_publish_preparation_wait(allocation: WorkspaceAllocation, reason: String) -> WorkspaceConvergenceObservation {
+  match workspace_record_preparation_wait(store: fabric_state_storage_binding(), request: allocation.request, reason: reason) {
+    WorkspaceStoreWritten { allocation: _ } => WorkspaceConvergenceUnobserved { reason: reason }
+    WorkspaceStoreConflict => WorkspaceConvergenceUnobserved { reason: "workspace changed while publishing preparation wait; reconcile again" }
+    WorkspaceStoreWriteRefused { reason: detail } => WorkspaceConvergenceUnobserved { reason: detail }
+  }
+}
+
+// Local authorities are read only after the existing selected-host check. Apply still obtains
+// its identity and installed artifact from the hash-admitted plan. Planning binds the locus to
+// its admitted run revision, not an independent caller-selected environment path.
+fn workspace_allocation_selected(owner: PrincipalRef, request_key: NonEmptyStr, host: NonEmptyStr, release_dir: NonEmptyStr) -> WorkspaceConvergenceObservation {
+  match workspace_convergence_observe(store: fabric_state_storage_binding(),
+    owner: owner, idempotency_key: request_key) {
+    WorkspaceConvergenceUnobserved { reason: detail } => WorkspaceConvergenceUnobserved { reason: detail }
+    WorkspaceConvergenceObserved { basis: selected } => if selected.host != host {
+      WorkspaceConvergenceUnobserved { reason: "workspace plan request is executing on a different host" }
+    } else { WorkspaceConvergenceObserved { basis: selected } }
+  }
+}
+
+// These entries can only be granted at an exact installed release. Its workspace-root binding is
+// part of sudo's exact argv, so stdin cannot select code or an installed image from another tree.
+fn workspace_allocation_dispatch_root() -> String {
+  match shell.Env.Get(name: gunbc_workspace_root_env_name as NonEmptyStr).value {
+    Present { value } => value
+    Absent => ""
+  }
+}
+
+fn workspace_allocation_dispatch_refused(reason: String) -> CliWireResponse {
+  CliWirePrintable { bytes: "", exit: exit_failure(reason: reason) }
+}
+
+fn workspace_allocation_prepare_cli() -> CliWireResponse {
+  let input = Filesystem.Read(path: "/dev/stdin")
+  let fields = split(input.content, separator: "\n")
+  if !input.success || count(fields) != 2 || !workspace_operator_on_candidate_host() {
+    workspace_allocation_dispatch_refused(reason: "workspace allocation subject or host is invalid")
+  } else { match fields.first() {
+    Absent => workspace_allocation_dispatch_refused(reason: "workspace installed release is absent")
+    Present { value: installed } => if installed == "" || installed != workspace_allocation_dispatch_root() {
+      workspace_allocation_dispatch_refused(reason: "workspace allocation release differs from this installed helper")
+    } else { match fields.last() {
+      Absent => workspace_allocation_dispatch_refused(reason: "workspace host is absent")
+      Present { value: host } => match workspace_allocation_prepare(host: host as NonEmptyStr, release_dir: installed as NonEmptyStr) {
+        WorkspaceConvergenceUnobserved { reason } => workspace_allocation_dispatch_refused(reason: reason)
+        WorkspaceConvergenceObserved { basis } => CliWirePrintable {
+          bytes: workspace_launch_directive_text(directive: workspace_launch_directive(basis: basis, release_dir: installed as NonEmptyStr)), exit: ExitSuccess,
+        }
+      }
+    } }
+  } }
+}
+
+// Apply re-reads only the exact request from the reviewed directive. It never runs preparation or
+// chooses a newer request. The controller independently repeats this generation fence at launch.
+fn workspace_allocation_readback_cli() -> CliWireResponse {
+  let input = Filesystem.Read(path: "/dev/stdin")
+  if !input.success || !workspace_operator_on_candidate_host() {
+    workspace_allocation_dispatch_refused(reason: "workspace readback input or host is invalid")
+  } else { match workspace_launch_directive_from_text(text: input.content) {
+    WorkspaceLaunchDirectiveRefused { reason } => workspace_allocation_dispatch_refused(reason: reason)
+    WorkspaceLaunchDirectiveReady { directive: planned } => if (planned.release_dir as String) != workspace_allocation_dispatch_root()
+      || !(match workspace_installed_policy() {
+        WorkspacePolicyAdmitted { policy } => match workspace_owner_enrollment(policy: policy, owner: planned.allocation.request.owner) { Present { value: _ } => true Absent => false }
+        WorkspacePolicyRefused { reason: _ } => false
+      }) {
+      workspace_allocation_dispatch_refused(reason: "workspace readback release or owner is not admitted")
+    } else { match workspace_convergence_observe(store: fabric_state_storage_binding(),
+      owner: planned.allocation.request.owner, idempotency_key: planned.allocation.request.idempotency_key) {
+      WorkspaceConvergenceUnobserved { reason } => workspace_allocation_dispatch_refused(reason: reason)
+      WorkspaceConvergenceObserved { basis: current } => CliWirePrintable {
+        bytes: workspace_launch_directive_text(directive: workspace_launch_directive(basis: current, release_dir: planned.release_dir)), exit: ExitSuccess,
+      }
+    } }
+  } }
+}
diff --git a/dag/gunbc/workspace_allocation_dispatch_transport.dag b/dag/gunbc/workspace_allocation_dispatch_transport.dag
new file mode 100644
index 00000000000..39170ad2123
--- /dev/null
+++ b/dag/gunbc/workspace_allocation_dispatch_transport.dag
@@ -0,0 +1,51 @@
+module gunbc.workspace_allocation_dispatch_transport
+
+import std.types { String, NonEmptyStr }
+import std.algebra { trim }
+import std.durable_compare_and_set { ExpectSlotGeneration }
+import extdeps.exec.command { LocalExec }
+import extdeps.languages.bash.invocation { bash_program_command }
+import extdeps.posix.shell_command_language { posix_single_quote }
+import extdeps.shell.exec { ProcessOutputPresent, ProcessOutputAbsent, ProcessRefused }
+import gunbc.command_runner { run_shell_command_capture }
+import gunbc.executor_privileged_operation { executor_privileged_operation_shell_command }
+import gunbc.workspace_commissioning_dispatch_operations { workspace_dispatch_operation }
+import gunbc.workspace_allocation_store { WorkspaceOwnerSnapshot }
+import gunbc.workspace_allocation_convergence { WorkspaceConvergenceObservation, WorkspaceConvergenceUnobserved, workspace_convergence_basis }
+import gunbc.workspace_allocation_launch_directive { WorkspaceLaunchDirective, workspace_launch_directive_text, workspace_launch_directive_from_text, WorkspaceLaunchDirectiveReady, WorkspaceLaunchDirectiveRefused }
+
+fn workspace_allocation_dispatch_command(release_dir: NonEmptyStr, function: NonEmptyStr, payload: String) -> String {
+  join(["set -o pipefail; printf '%s' ", posix_single_quote(spelling: payload), " | ",
+    executor_privileged_operation_shell_command(op: workspace_dispatch_operation(release_dir: release_dir, function: function))], "")
+}
+
+fn workspace_allocation_dispatch_result(text: String, host: NonEmptyStr, release_dir: NonEmptyStr) -> WorkspaceConvergenceObservation {
+  match workspace_launch_directive_from_text(text: trim(s: text)) {
+    WorkspaceLaunchDirectiveRefused { reason } => WorkspaceConvergenceUnobserved { reason: reason }
+    WorkspaceLaunchDirectiveReady { directive } => if directive.release_dir != release_dir {
+      WorkspaceConvergenceUnobserved { reason: "privileged workspace observation returned another installed release" }
+    } else { workspace_convergence_basis(snapshot: WorkspaceOwnerSnapshot {
+      owner: directive.allocation.request.owner, expected: ExpectSlotGeneration { generation: directive.owner_generation },
+      allocations: [directive.allocation],
+    }, idempotency_key: directive.allocation.request.idempotency_key, host: host) }
+  }
+}
+
+fn workspace_allocation_dispatch_call(host: NonEmptyStr, release_dir: NonEmptyStr, function: NonEmptyStr, payload: String) -> WorkspaceConvergenceObservation {
+  match run_shell_command_capture(command: bash_program_command(script: workspace_allocation_dispatch_command(
+    release_dir: release_dir, function: function, payload: payload)), transport: LocalExec) {
+    ProcessOutputPresent { text } => workspace_allocation_dispatch_result(text: text, host: host, release_dir: release_dir)
+    ProcessOutputAbsent => WorkspaceConvergenceUnobserved { reason: "installed workspace observer returned no receipt" }
+    ProcessRefused { exit_code: _, stderr } => WorkspaceConvergenceUnobserved { reason: concat("installed workspace observer refused: ", stderr) }
+  }
+}
+
+fn workspace_allocation_dispatch_prepare(host: NonEmptyStr, release_dir: NonEmptyStr) -> WorkspaceConvergenceObservation {
+  workspace_allocation_dispatch_call(host: host, release_dir: release_dir, function: "workspace_dispatch_allocation_plan_cli",
+    payload: join([release_dir as String, host as String], "\n"))
+}
+
+fn workspace_allocation_dispatch_readback(host: NonEmptyStr, planned: WorkspaceLaunchDirective) -> WorkspaceConvergenceObservation {
+  workspace_allocation_dispatch_call(host: host, release_dir: planned.release_dir, function: "workspace_dispatch_allocation_readback_cli",
+    payload: workspace_launch_directive_text(directive: planned))
+}
diff --git a/dag/gunbc/workspace_allocation_policy.dag b/dag/gunbc/workspace_allocation_policy.dag
index 17148695f92..55bbf46a9b7 100644
--- a/dag/gunbc/workspace_allocation_policy.dag
+++ b/dag/gunbc/workspace_allocation_policy.dag
@@ -1,9 +1,11 @@
 module gunbc.workspace_allocation_policy
 
-import std.types { NonEmptyStr, List }
-import gunbc.fleet_ssh_access { operator_ssh_principal }
+import std.types { String, NonEmptyStr, List }
+import extdeps.ssh { SshPublicKey, Ed25519 }
+import gunbc.fleet_posix_accounts { fleet_posix_home_directory, fleet_posix_operator_user }
+import gunbc.workspace_ssh_access { WorkspaceSshAccess, WorkspaceSshFromHost }
 import gunbc.principal_projection { PrincipalRef }
-import gunbc.workspace_allocation_admission { WorkspaceEnrollmentRoster, WorkspaceOwnerEnrollment, WorkspacePublicKeyCatalogRow, WorkspacePolicyAdmission, workspace_policy_admit }
+import gunbc.workspace_allocation_admission { WorkspaceEnrollmentRoster, WorkspaceOwnerEnrollment, WorkspacePublicKeyCatalogRow, WorkspacePolicyAdmission, workspace_policy_admit, workspace_owner_enrollment, WorkspacePolicyAdmitted, WorkspacePolicyRefused }
 
 // Enrollment is administrator-authored and lands as a reviewed row; the installed release is the
 // root-owned authority the controller reads, so no request, browser or guest can add a row.
@@ -17,22 +19,35 @@ fn workspace_operator_principal() -> PrincipalRef {
   }
 }
 
-data workspace_operator_public_key_ref: NonEmptyStr = "gunbc.fleet_ssh_access.operator_ssh_principal"
+data workspace_operator_public_key_ref: NonEmptyStr = "gunbc.workspace_allocation_policy.workspace_operator_guest_key"
+
+// Generated on srv1 for this workspace only, at the operator's request. The private key remains
+// in the operator's 0600 file there; it is not installed into host authorized_keys or workflow jobs.
+data workspace_operator_guest_key: SshPublicKey = SshPublicKey {
+  algorithm: Ed25519,
+  material: "AAAAC3NzaC1lZDI1NTE5AAAAIMqh2/pEx3PptwZqnFneipNltQcry0TBF2Emi7g/BjUY",
+  comment: "gunbc-workspace-srv1-13",
+}
+
+fn workspace_operator_guest_identity_file() -> NonEmptyStr {
+  concat(fleet_posix_home_directory(login: fleet_posix_operator_user.name) as String,
+    "/.ssh/gunbc-workspace-srv1-13") as NonEmptyStr
+}
 
 fn workspace_enrollment_roster() -> WorkspaceEnrollmentRoster {
   WorkspaceEnrollmentRoster { enrollments: [
-    WorkspaceOwnerEnrollment { principal: workspace_operator_principal(), public_key_ref: workspace_operator_public_key_ref },
+    WorkspaceOwnerEnrollment { principal: workspace_operator_principal(), public_key_ref: workspace_operator_public_key_ref,
+      ssh_access: WorkspaceSshFromHost { identity_file: workspace_operator_guest_identity_file() } },
   ] }
 }
 
-// Each reference names exactly one enrolled ed25519 key, carried in the extdeps.ssh key model. The operator's guest key reuses the
-// existing fleet SSH principal's public key; a customer's row carries that customer's own key,
-// and a reference is never shared between owners.
+// Each reference names exactly one enrolled ed25519 key, carried in the extdeps.ssh key model.
+// Guest enrollment is independent of the credentials used to log into a fleet host.
 fn workspace_public_key_catalog() -> List<WorkspacePublicKeyCatalogRow> {
   [
     WorkspacePublicKeyCatalogRow {
       reference: workspace_operator_public_key_ref,
-      key: operator_ssh_principal.public_key,
+      key: workspace_operator_guest_key,
     },
   ]
 }
@@ -42,3 +57,13 @@ fn workspace_public_key_catalog() -> List<WorkspacePublicKeyCatalogRow> {
 fn workspace_installed_policy() -> WorkspacePolicyAdmission {
   workspace_policy_admit(roster: workspace_enrollment_roster(), catalog: workspace_public_key_catalog())
 }
+
+fn workspace_enrolled_ssh_access(owner: PrincipalRef) -> WorkspaceSshAccess? {
+  match workspace_installed_policy() {
+    WorkspacePolicyRefused { reason: _ } => none
+    WorkspacePolicyAdmitted { policy } => match workspace_owner_enrollment(policy: policy, owner: owner) {
+      Absent => none
+      Present { value: enrollment } => Present { value: enrollment.ssh_access }
+    }
+  }
+}
diff --git a/dag/gunbc/workspace_allocation_supply.dag b/dag/gunbc/workspace_allocation_supply.dag
index 0a197a47db1..13a9c5d95d2 100644
--- a/dag/gunbc/workspace_allocation_supply.dag
+++ b/dag/gunbc/workspace_allocation_supply.dag
@@ -10,6 +10,9 @@ import std.decl_ref { DeclarationRef }
 import std.durable_compare_and_set { cas_generation_count, cas_generation_successor, CasSuccessorGeneration, CasSuccessorExhausted }
 import std.durable_exclusive_hold { HoldSlotAbsent, HoldSlotFree, HoldObservationUnavailable, HoldSlotHeld, HoldSlotUndecodable }
 import product.host_identity { HostIdentity }
+import gunbc.hostname_allocation { canonical_hostname_for_fleet_slot }
+import gunbc.fleet_enrollment { enrollment_for_host }
+import gunbc.provider_guest_adoption { provider_microvm_refusal, microvm_execution_refusal_text }
 import product.fabric.identity { fabric_identity_eq }
 import product.fabric.provider_route { CompliancePostureRevision }
 import product.fabric.provider_admission { RouteScopeSanction, ProviderUseScope }
@@ -52,11 +55,41 @@ type WorkspaceHostSupplyRead
 
 // Readiness and hold paths are host-local authorities. Refuse another host before probing any
 // supply or reading readiness; remote orchestration must execute this observer on that host.
+// A HOST WHOSE PROVIDER FORBIDS THE MICROVM PATH HAS NO MICROVM SUPPLY, and says why before any cell
+// is probed: an enrolled provider guest is refused on its offer's cited nested-virtualization fact
+// (gunbc.provider_guest_adoption provider_microvm_refusal), so a fabric reader sees the cause rather
+// than an empty cell list it would have to interpret.
+fn workspace_host_supply_refusal(host: HostIdentity) -> NonEmptyStr? {
+  match enrollment_for_host(host: host) {
+    Absent => none
+    Present { value: e } => match provider_microvm_refusal(backing: e.backing) {
+      Absent => none
+      Present { value: r } => Present { value: microvm_execution_refusal_text(cause: r) as NonEmptyStr }
+    }
+  }
+}
+
+// The local kernel hostname is joined to the requested identity through the hostname the naming
+// authority allocated to it, never by assuming the spellings agree.
+fn workspace_local_host_is(host: HostIdentity, kernel_hostname: String) -> Bool {
+  match canonical_hostname_for_fleet_slot(fleet_slot: host) {
+    Present { value: h } => kernel_hostname != "" && (h as String) == kernel_hostname
+    Absent => false
+  }
+}
+
 fn workspace_observe_host_supply(host: HostIdentity) -> WorkspaceHostSupplyRead {
+  match workspace_host_supply_refusal(host: host) {
+    Present { value: reason } => WorkspaceHostSupplyUnavailable { reason: reason }
+    Absent => workspace_observe_local_host_supply(host: host)
+  }
+}
+
+fn workspace_observe_local_host_supply(host: HostIdentity) -> WorkspaceHostSupplyRead {
   match run_shell_command_capture(command: hostname_short_read_command(), transport: LocalExec) {
     ProcessOutputAbsent => WorkspaceHostSupplyUnavailable { reason: "local host identity is absent" }
     ProcessRefused { exit_code: _, stderr: _ } => WorkspaceHostSupplyUnavailable { reason: "local host identity is unreadable" }
-    ProcessOutputPresent { text: hostname } => if trim(s: hostname) == "" || trim(s: hostname) != (host as String) {
+    ProcessOutputPresent { text: hostname } => if !workspace_local_host_is(host: host, kernel_hostname: trim(s: hostname)) {
       WorkspaceHostSupplyUnavailable { reason: "workspace supply must be observed on the requested host" }
     } else {
       WorkspaceHostSupplyObserved { observation: WorkspaceHostSupplyObservation {
diff --git a/dag/gunbc/workspace_artifact_policy.dag b/dag/gunbc/workspace_artifact_policy.dag
index 1fa621e2c33..d8a9f000d6d 100644
--- a/dag/gunbc/workspace_artifact_policy.dag
+++ b/dag/gunbc/workspace_artifact_policy.dag
@@ -5,5 +5,5 @@ import std.types { NonEmptyStr }
 // The pinned workspace guest image the commissioning fleet path installs and admits. It is the
 // output digest of the pinned-base workspace image builder (gunbc.workspace_guest_image).
 fn workspace_demo_image_identity() -> NonEmptyStr {
-  "97859b4f8e206e3398f02dc4070fad14cb5b7a7ec29e305a8895405750044305"
+  "d15a55780a707ec832a09e3599306254b8d7c428ff25ff621b427b826eeb0b27"
 }
diff --git a/dag/gunbc/workspace_commissioning.dag b/dag/gunbc/workspace_commissioning.dag
index b15aede4789..3d82c237719 100644
--- a/dag/gunbc/workspace_commissioning.dag
+++ b/dag/gunbc/workspace_commissioning.dag
@@ -9,7 +9,7 @@ import gunbc.runner_slot_allocation { gunbc_microvm_shakedown_slot_memory_max, g
 import gunbc.runner_slot_desired { CpuQuotaResolved, SlotCpuQuotaUnbounded }
 import gunbc.build_cache_instance { RunnerSlotIdentity, runner_slot_instance_name }
 import gunbc.fleet_host_budget { HostAllocationVerdict, HostAllocationConserves, HostAllocationOversubscribed, HostAllocationUnchargeable }
-import product.fabric.sanitation { CellId, CellReady, CellQuarantined, SanitationObservation, SlotScopedNetwork, cell_readiness_from_observations }
+import product.fabric.sanitation { CellId, CellReady, CellQuarantined, SanitationObservation, SlotScopedNetwork, cell_readiness_from_observations, cell_readiness_line }
 
 // This is administrator commissioning intent bound to an existing convergence artifact. It is
 // not inferred from a missing directory or a failed unit. No current observation mints authorization; the effect may select WIF or app approval.
@@ -69,8 +69,12 @@ fn workspace_commissioning_admit(
           WorkspaceObligationHistoryUnreadable { reason: detail } => WorkspaceCommissioningRefused { reason: detail }
           WorkspaceNoPriorObligations { settled_generation: generation } => if generation != 0 {
             WorkspaceCommissioningRefused { reason: "initial commissioning requires an observed never-recorded slot; nonzero history must be recovered" }
-          } else { match cell_readiness_from_observations(cell: runner_slot_instance_name(slot: slot) as CellId, network_scope: SlotScopedNetwork, observations: sanitation) {
-            CellQuarantined { cell: _, unproven: _ } => WorkspaceCommissioningRefused { reason: "initial cell sanitation is incomplete; no initial readiness may be published" }
+          } else {
+            let readiness = cell_readiness_from_observations(cell: runner_slot_instance_name(slot: slot) as CellId, network_scope: SlotScopedNetwork, observations: sanitation)
+            match readiness {
+            CellQuarantined { cell: _, unproven: _ } => WorkspaceCommissioningRefused {
+              reason: concat("initial cell sanitation is incomplete; no initial readiness may be published: ", cell_readiness_line(readiness: readiness)),
+            }
             CellReady { cell: _ } => WorkspaceCommissioningReady { commissioned: WorkspaceCommissionedSlot {
               slot: slot, cpu_budget: cpu_budget, attempt_envelope: attempt_envelope,
               commissioning_plan_hash: approved_plan, settled_generation: generation,
diff --git a/dag/gunbc/workspace_commissioning_dispatch.dag b/dag/gunbc/workspace_commissioning_dispatch.dag
index 1caf0234efe..ad903fd1d8e 100644
--- a/dag/gunbc/workspace_commissioning_dispatch.dag
+++ b/dag/gunbc/workspace_commissioning_dispatch.dag
@@ -1,5 +1,7 @@
 module gunbc.workspace_commissioning_dispatch
 
+import gunbc.workspace_allocation_dispatch { workspace_allocation_prepare_cli, workspace_allocation_readback_cli }
+
 import std.types { String, NonEmptyStr, Bool, CommitSha }
 import std.decl_ref { decl_ref }
 import std.algebra { trim }
@@ -19,7 +21,8 @@ import gunbc.workspace_commissioning_executor_input { workspace_executor_input_f
 import gunbc.workspace_commissioning_executor_unit { workspace_executor_unit_instance_name }
 import gunbc.workspace_commissioning_executor_store { workspace_executor_journal_observe, WorkspaceExecutorJournalObserved, WorkspaceExecutorJournalUnreadable }
 import gunbc.workspace_commissioning_executor_journal { ExecutorGenerationCommitted }
-import gunbc.workspace_commissioning_fleet { workspace_commissioning_basis_observe, workspace_commissioning_candidate, workspace_commissioning_basis_rows, WorkspaceCommissioningFleetObserved, WorkspaceCommissioningFleetRefused }
+import gunbc.host_kernel_dependency_wire { host_kernel_dependency_row }
+import gunbc.workspace_commissioning_fleet { workspace_commissioning_basis_observe, workspace_commissioning_candidate, workspace_commissioning_basis_rows, WorkspaceCommissioningFleetObserved, WorkspaceCommissioningFleetDependencyObserved, WorkspaceCommissioningFleetRefused }
 import gunbc.workspace_commissioning_start_observe { workspace_commissioning_start_observe, WorkspaceCommissioningStartObserved, WorkspaceCommissioningStartSnapshot, workspace_commissioning_start_quiescent, WorkspaceCommissioningStartUnreadable }
 import gunbc.build_cache_instance { runner_slot_instance_name }
 import gunbc.fleet_generation_execution { fleet_generation_publication_as_owner }
@@ -63,6 +66,7 @@ fn workspace_dispatch_stage(bytes: WorkspaceCommissioningInputBytes) -> CliWireR
           WorkspaceCommissioningInputPresent { bytes: stored, plan: _ } => stored == bytes
           WorkspaceCommissioningInputAbsent => match workspace_commissioning_basis_observe(provenance: plan.provenance) {
             WorkspaceCommissioningFleetObserved { basis } => !basis.already_committed && basis.prestate == plan.prestate
+            WorkspaceCommissioningFleetDependencyObserved { plan: _ } => false
             WorkspaceCommissioningFleetRefused { reason: _ } => false
           }
           WorkspaceCommissioningInputRefused { reason: _ } => false
@@ -178,7 +182,8 @@ fn workspace_dispatch_plan_cli() -> CliWireResponse {
       workspace_dispatch_refused(reason: "plan revision is malformed")
     } else { match workspace_commissioning_candidate(host: host as NonEmptyStr, revision: revision as CommitSha) {
       WorkspaceCommissioningFleetObserved { basis } => CliWirePrintable { bytes: workspace_commissioning_basis_rows(basis: basis), exit: ExitSuccess }
-      WorkspaceCommissioningFleetRefused { reason: _ } => workspace_dispatch_refused(reason: "privileged commissioning observation refused")
+      WorkspaceCommissioningFleetDependencyObserved { plan } => CliWirePrintable { bytes: host_kernel_dependency_row(plan: plan), exit: ExitSuccess }
+      WorkspaceCommissioningFleetRefused { reason } => workspace_dispatch_refused(reason: concat("privileged commissioning observation refused: ", reason))
     } }
   }
 }
@@ -199,3 +204,7 @@ fn workspace_dispatch_offer_cli() -> CliWireResponse {
     }
   } }
 }
+
+// Reconcile only already-admitted owner intent; these entries cannot create or release a request.
+fn workspace_dispatch_allocation_plan_cli() -> CliWireResponse { workspace_allocation_prepare_cli() }
+fn workspace_dispatch_allocation_readback_cli() -> CliWireResponse { workspace_allocation_readback_cli() }
diff --git a/dag/gunbc/workspace_commissioning_dispatch_operations.dag b/dag/gunbc/workspace_commissioning_dispatch_operations.dag
index d343b81566c..1db6d1dda21 100644
--- a/dag/gunbc/workspace_commissioning_dispatch_operations.dag
+++ b/dag/gunbc/workspace_commissioning_dispatch_operations.dag
@@ -1,7 +1,7 @@
 module gunbc.workspace_commissioning_dispatch_operations
 
 import std.types { String, NonEmptyStr, List }
-import gunbc.executor_privileged_operation { ExecutorPrivilegedOperation, RunGunbcEntryAs, executor_privileged_operation_sudoers_line }
+import gunbc.executor_privileged_operation { ExecutorPrivilegedOperation, RunGunbcEntryAs, ReadFileSha256, executor_privileged_operation_sudoers_line }
 import gunbc.runner_microvm_slot_unit { microvm_controller_gunbc_binary, microvm_controller_owner }
 import gunbc.fleet_generation_execution { fleet_generation_writer }
 import gunbc.fleet_posix_accounts { fleet_posix_operator_user }
@@ -14,10 +14,17 @@ fn workspace_dispatch_operation(release_dir: NonEmptyStr, function: NonEmptyStr)
 }
 
 data workspace_dispatch_grant_path: String = "/etc/sudoers.d/gunbc-workspace-commissioning"
-data workspace_dispatch_functions: List<NonEmptyStr> = ["workspace_dispatch_plan_cli", "workspace_dispatch_stage_cli", "workspace_dispatch_complete_cli", "workspace_dispatch_offer_cli"]
+data workspace_dispatch_functions: List<NonEmptyStr> = ["workspace_dispatch_plan_cli", "workspace_dispatch_stage_cli", "workspace_dispatch_complete_cli", "workspace_dispatch_offer_cli", "workspace_dispatch_allocation_plan_cli", "workspace_dispatch_allocation_readback_cli"]
+
+// The grant file remains root:root 0440. Readers may digest this exact policy, never
+// another file; the command and its sudoers row are projections of this single operation.
+fn workspace_dispatch_grant_read_operation() -> ExecutorPrivilegedOperation {
+  ReadFileSha256 { path: workspace_dispatch_grant_path as NonEmptyStr }
+}
 
 fn workspace_dispatch_grant_content(release_dir: NonEmptyStr) -> String {
   join(flat_map([fleet_generation_writer(), fleet_posix_operator_user.name], grantee =>
     map(workspace_dispatch_functions, function => executor_privileged_operation_sudoers_line(grantee: grantee,
-      op: workspace_dispatch_operation(release_dir: release_dir, function: function)) as String)), "\n")
+      op: workspace_dispatch_operation(release_dir: release_dir, function: function)) as String)
+      + [executor_privileged_operation_sudoers_line(grantee: grantee, op: workspace_dispatch_grant_read_operation()) as String]), "\n")
 }
diff --git a/dag/gunbc/workspace_commissioning_executor.dag b/dag/gunbc/workspace_commissioning_executor.dag
index 8d538bab8bf..67ede96538e 100644
--- a/dag/gunbc/workspace_commissioning_executor.dag
+++ b/dag/gunbc/workspace_commissioning_executor.dag
@@ -12,7 +12,10 @@ import v2.workflow.orchestration_bash_emit_support { orch_bash_do, orch_bash_emi
 // settle/complete are permitted only from recorded post-readback obligations; they skip the
 // old controller wait because the slot may already have been legitimately reused. The helper
 // must verify the durable release/generation receipts, not reconstruct them from live guest state.
-// bind persists the actual slot invocation. finish owns strong readback, credential removal,
+// The controller claims its invocation in the journal before any commissioning effect. After
+// it exits, bind confirms that invocation (or records a controller that failed before claiming).
+// This ordering keeps the controller and bind interpreter out of the same bounded slice at once.
+// finish owns strong readback, credential removal,
 // mutation settlement and generation publication (including recovery after publication).
 // None of these helpers is called in the waiting loop. The systemd-owned executor retains the
 // existing fleet flock even when the workflow disconnects. Failure NEVER releases the durable
@@ -88,7 +91,6 @@ data workspace_executor_submit_once: String = join([
   "  executor_observe || exit 66",
   "  [[ $executor_seen =~ ^[a-f0-9]\{32}$ && $executor_seen != \"$executor_expected\" ]] || exit 67",
   "  executor_expected=$executor_seen",
-  "  timeout --kill-after=5s \"$\{executor_polls}s\" \"$executor_helper\" bind \"$INVOCATION_ID\" \"$executor_expected\"",
   "fi",
 ], "\n")
 
@@ -120,6 +122,15 @@ data workspace_executor_settle: String = join([
   "printf '%s\\n' \"$executor_terminal\"",
 ], "\n")
 
+// The bounded wait already proved this exact invocation quiescent. bind independently rereads
+// systemd and the held mutation, so replacement between the wait and this helper still refuses.
+// A disconnected submitter retains the same unbound-submission fence/drain recovery obligation.
+data workspace_executor_bind_completed_invocation: String = join([
+  "if [[ $executor_action == start ]]; then",
+  "  timeout --kill-after=5s \"$\{executor_polls}s\" \"$executor_helper\" bind \"$INVOCATION_ID\" \"$executor_expected\"",
+  "fi",
+], "\n")
+
 // The interpreter emits the transport once when building the reviewed artifact, not while
 // waiting on a host. Foreign command leaves contain transport mechanics only; no readiness,
 // reservation, provenance or fleet-generation policy is implemented in these Bash commands.
@@ -131,6 +142,7 @@ fn workspace_commissioning_executor_script() -> String {
       orch_bash_do(command: workspace_executor_drain_submission),
       orch_bash_do(command: workspace_executor_submit_once),
       orch_bash_do(command: workspace_executor_await_invocation),
+      orch_bash_do(command: workspace_executor_bind_completed_invocation),
       orch_bash_do(command: workspace_executor_settle),
     ],
     on_failure: FailFast,
diff --git a/dag/gunbc/workspace_commissioning_executor_input.dag b/dag/gunbc/workspace_commissioning_executor_input.dag
index 368b8ac28f5..a7d6ea592bc 100644
--- a/dag/gunbc/workspace_commissioning_executor_input.dag
+++ b/dag/gunbc/workspace_commissioning_executor_input.dag
@@ -2,7 +2,15 @@ module gunbc.workspace_commissioning_executor_input
 
 import gunbc.workspace_commissioning_input_store { workspace_commissioning_input_read, WorkspaceCommissioningInputPresent, WorkspaceCommissioningInputRefused }
 
-import gunbc.workspace_commissioning_dispatch_operations { workspace_dispatch_grant_path, workspace_dispatch_grant_content }
+import gunbc.workspace_commissioning_dispatch_operations { workspace_dispatch_grant_path, workspace_dispatch_grant_content, workspace_dispatch_grant_read_operation }
+
+import gunbc.executor_privileged_operation { executor_privileged_operation_elevated_command }
+import gunbc.command_runner { run_shell_command_capture }
+import extdeps.exec.command { LocalExec }
+import extdeps.shell.exec { ProcessOutcome, ProcessOutputPresent, ProcessOutputAbsent, ProcessRefused }
+
+import extdeps.crypto.hash { Digest, sha256sum_line_digest }
+import extdeps.tools.sha256sum { sha256sum_stdin_digest_via_shell, Sha256FileDigest, Sha256FileDigestUnavailable }
 
 import std.types { String, NonEmptyStr, CommitSha, Bool }
 import std.algebra { trim }
@@ -89,6 +97,32 @@ fn workspace_executor_owned_text_equals(path: String, expected: String) -> Bool
   }
 }
 
+// Captured command text trims trailing whitespace. Digest the file under its exact grant,
+// and the expected bytes through stdin, so a missing or added final newline still refuses.
+fn workspace_executor_grant_digest_matches(expected: Digest, observed: ProcessOutcome) -> Bool {
+  match observed {
+    ProcessOutputPresent { text } => match sha256sum_line_digest(line: text) {
+      Present { value: actual } => actual == expected
+      Absent => false
+    }
+    ProcessOutputAbsent => false
+    ProcessRefused { exit_code: _, stderr: _ } => false
+  }
+}
+
+fn workspace_executor_grant_matches(expected: String) -> Bool {
+  match read_store_ownership(path: workspace_dispatch_grant_path) {
+    OwnershipRead { ownership: StoreRootOwned } => match sha256sum_stdin_digest_via_shell(content: expected) {
+      Sha256FileDigest { digest } => workspace_executor_grant_digest_matches(expected: digest,
+        observed: run_shell_command_capture(command: executor_privileged_operation_elevated_command(
+          op: workspace_dispatch_grant_read_operation()), transport: LocalExec))
+      Sha256FileDigestUnavailable { path: _, reason: _ } => false
+    }
+    OwnershipRead { ownership: StoreNotRootOwned { owner_uid: _, mode: _ } } => false
+    OwnershipUnread { reason: _ } => false
+  }
+}
+
 fn workspace_executor_installed_adapter_matches(release_dir: String, slot: NonEmptyStr) -> Bool {
   let unit = workspace_executor_unit_instance_name(slot: slot)
   let fragment = systemd.Systemctl.ShowProperty(unit: unit, property: "FragmentPath")
@@ -97,7 +131,7 @@ fn workspace_executor_installed_adapter_matches(release_dir: String, slot: NonEm
   fragment.success && trim(s: fragment.value) == (workspace_executor_unit_path() as String)
     && dropins.success && trim(s: dropins.value) == ""
     && reload.success && trim(s: reload.value) == "no"
-    && workspace_executor_owned_text_equals(path: workspace_dispatch_grant_path, expected: concat(workspace_dispatch_grant_content(release_dir: release_dir as NonEmptyStr), "\n"))
+    && workspace_executor_grant_matches(expected: concat(workspace_dispatch_grant_content(release_dir: release_dir as NonEmptyStr), "\n"))
     && workspace_executor_owned_text_equals(path: workspace_executor_unit_path() as String,
       expected: workspace_executor_unit_text(release_dir: release_dir, fleet_lock: fleet_generation_lock, wait_bound: workspace_executor_wait_bound))
     && workspace_executor_owned_text_equals(path: join([release_dir, "/", workspace_executor_script_name], ""), expected: workspace_commissioning_executor_script())
diff --git a/dag/gunbc/workspace_commissioning_executor_submission.dag b/dag/gunbc/workspace_commissioning_executor_submission.dag
index ecb46d8ab9b..0e06b5d6e53 100644
--- a/dag/gunbc/workspace_commissioning_executor_submission.dag
+++ b/dag/gunbc/workspace_commissioning_executor_submission.dag
@@ -44,7 +44,7 @@ import gunbc.command_runner { run_shell_command_capture }
 import extdeps.exec.command { LocalExec }
 import extdeps.shell.exec { ProcessOutputPresent, ProcessOutputAbsent, ProcessRefused }
 import std.algebra { trim }
-import gunbc.workspace_commissioning_fleet { workspace_commissioning_basis_observe, WorkspaceCommissioningFleetObserved, WorkspaceCommissioningFleetRefused }
+import gunbc.workspace_commissioning_fleet { workspace_commissioning_basis_observe, WorkspaceCommissioningFleetObserved, WorkspaceCommissioningFleetDependencyObserved, WorkspaceCommissioningFleetRefused }
 
 type WorkspaceExecutorPreparation
   = WorkspaceExecutorPrepared { directive: String }
@@ -203,6 +203,7 @@ fn workspace_executor_prepare(slot: NonEmptyStr, executor: NonEmptyStr) -> Works
               Present { value: generation } => workspace_executor_arm(input: input, executor: executor, snapshot: snapshot, generation: generation)
               Absent => WorkspaceExecutorPreparationRefused { reason: "initial mutation generation is unavailable" }
             } }
+            WorkspaceCommissioningFleetDependencyObserved { plan: _ } => WorkspaceExecutorPreparationRefused { reason: "commissioning dependency is unresolved" }
             WorkspaceCommissioningFleetRefused { reason: _ } => WorkspaceExecutorPreparationRefused { reason: "reviewed commissioning prestate is not established" }
           } }
           ProcessOutputAbsent => WorkspaceExecutorPreparationRefused { reason: "fleet generation does not admit the reviewed submission" }
diff --git a/dag/gunbc/workspace_commissioning_fleet.dag b/dag/gunbc/workspace_commissioning_fleet.dag
index 14839d08417..7c513d5985b 100644
--- a/dag/gunbc/workspace_commissioning_fleet.dag
+++ b/dag/gunbc/workspace_commissioning_fleet.dag
@@ -12,7 +12,7 @@ import gunbc.build_cache_instance { RunnerSlotIdentity, runner_slot_instance_nam
 import gunbc.runner_slot_allocation { workspace_execution_slot_identities, gunbc_runner_slot_desired_for, gunbc_microvm_shakedown_slot_memory_max }
 import gunbc.runner_slot_desired { CpuQuotaResolved, SlotCpuQuotaUnbounded }
 import gunbc.runner_microvm_host_ready { MicrovmHostBound, MicrovmHostBindingRefused }
-import gunbc.runner_microvm_slot_controller { bind_slot_host, resolve_network_subject, NetworkSubjectResolved, NetworkSubjectRefused }
+import gunbc.runner_microvm_slot_controller { bind_slot_host, resolve_network_subject, NetworkSubjectResolved, NetworkSubjectRefused, refusal_text }
 import gunbc.runner_microvm_slot_unit { microvm_controller_root, microvm_controller_gunbc_binary, microvm_slot_unit_instance_name }
 import gunbc.live_deploy.release_locus { approval_broker_release_dir, approval_broker_tree_receipt_path_for, RevisionBoundAtEmission }
 import gunbc.auth.approval_broker_cutover { observe_broker_tree_receipt, TreeReceiptObserved, TreeReceiptMalformed, TreeReceiptUnreadable }
@@ -41,6 +41,11 @@ import gunbc.runner_microvm_cell_readiness_store { read_cell_readiness_store }
 import gunbc.workspace_commissioning_apply_readback { workspace_commissioning_initial_ready, workspace_commissioning_credential_absent }
 import gunbc.workspace_commissioning_start_identity { workspace_commissioning_submitter_path }
 import gunbc.runner_microvm_slot_unit { workspace_launch_credential_source_path }
+import product.host_identity { HostIdentity }
+import gunbc.runner_microvm_network_sanitation_observe { slot_network_tun_queue_requirement }
+import gunbc.host_kernel_dependency { HostKernelDependencyPlan, HostKernelCapabilitySatisfied, HostKernelDependencyPlanned, HostKernelDependencyRefused }
+import gunbc.host_kernel_dependency_observe { host_tun_kernel_dependency_observe }
+import gunbc.host_kernel_dependency_wire { host_kernel_dependency_row_prefix, host_kernel_dependency_from_text }
 
 // This is a read-only fleet subject, never a readiness permit or supply offer. The constructor
 // is available only here, after actual host and protected-store observations, not fixture input.
@@ -53,6 +58,7 @@ type WorkspaceCommissioningFleetBasis sole_constructor {
 
 type WorkspaceCommissioningFleetObservation
   = WorkspaceCommissioningFleetObserved { basis: WorkspaceCommissioningFleetBasis }
+  | WorkspaceCommissioningFleetDependencyObserved { plan: HostKernelDependencyPlan }
   | WorkspaceCommissioningFleetRefused { reason: String }
 
 fn workspace_commissioning_basis_rows(basis: WorkspaceCommissioningFleetBasis) -> String {
@@ -74,6 +80,25 @@ fn workspace_commissioning_candidate(host: NonEmptyStr, revision: CommitSha) ->
 }
 
 fn workspace_commissioning_candidate_slot(slot: RunnerSlotIdentity, revision: CommitSha) -> WorkspaceCommissioningFleetObservation {
+  match host_tun_kernel_dependency_observe(host: slot.host as HostIdentity, revision: revision,
+    requirement: slot_network_tun_queue_requirement(slot: slot)) {
+    HostKernelCapabilitySatisfied => workspace_commissioning_capable_candidate_slot(slot: slot, revision: revision)
+    HostKernelDependencyRefused { reason } => WorkspaceCommissioningFleetRefused { reason: reason }
+    HostKernelDependencyPlanned { plan } => {
+      let tree = Filesystem.Read(path: approval_broker_tree_receipt_path_for(root: microvm_controller_root,
+        revision: RevisionBoundAtEmission { revision: revision }))
+      match observe_broker_tree_receipt(success: tree.success, body: tree.content, error: tree.error as NonEmptyStr) {
+        TreeReceiptObserved { revision: actual, installed_digest: _ } => if actual == revision {
+          WorkspaceCommissioningFleetDependencyObserved { plan: plan }
+        } else { WorkspaceCommissioningFleetRefused { reason: "installed tree revision differs from dependency plan revision" } }
+        TreeReceiptUnreadable { detail: _ } => WorkspaceCommissioningFleetRefused { reason: "dependency observer installed tree receipt is unreadable" }
+        TreeReceiptMalformed { detail: _ } => WorkspaceCommissioningFleetRefused { reason: "dependency observer installed tree receipt is malformed" }
+      }
+    }
+  }
+}
+
+fn workspace_commissioning_capable_candidate_slot(slot: RunnerSlotIdentity, revision: CommitSha) -> WorkspaceCommissioningFleetObservation {
   let installed = approval_broker_release_dir(root: microvm_controller_root, revision: RevisionBoundAtEmission { revision: revision })
   match bind_slot_host(slot: slot) {
     MicrovmHostBound { spec: _, host: _ } => match resolve_network_subject(slot: slot) {
@@ -106,9 +131,9 @@ fn workspace_commissioning_candidate_slot(slot: RunnerSlotIdentity, revision: Co
             TreeReceiptMalformed { detail: _ } => WorkspaceCommissioningFleetRefused { reason: "installed tree receipt is unreadable" }
           }
         }
-        WorkspaceInitialSanitationUnavailable { reason: _ } => WorkspaceCommissioningFleetRefused { reason: "slot sanitation is unreadable" }
+        WorkspaceInitialSanitationUnavailable { reason } => WorkspaceCommissioningFleetRefused { reason: concat("slot sanitation is unreadable: ", reason) }
       }
-      NetworkSubjectRefused { refusal: _ } => WorkspaceCommissioningFleetRefused { reason: "slot network subject is unavailable" }
+      NetworkSubjectRefused { refusal } => WorkspaceCommissioningFleetRefused { reason: concat("slot network subject is unavailable: ", refusal_text(r: refusal)) }
     }
     MicrovmHostBindingRefused { cause: _ } => WorkspaceCommissioningFleetRefused { reason: "commissioning candidate is not on its host" }
   }
@@ -170,27 +195,30 @@ fn workspace_commissioning_basis_observe(provenance: WorkspaceCommissioningProve
                     } else if !committed && (match workspace_initial_controller_history_refusal(slot: slot) { Present { value: _ } => true Absent => false }) {
                       WorkspaceCommissioningFleetRefused { reason: "prior controller history requires recovery" }
                     } else {
-                      let admitted = committed || (match workspace_commissioning_admit(slot: slot,
+                      let admission_refusal = if committed { none } else { match workspace_commissioning_admit(slot: slot,
                       authority: WorkspaceCommissioningAuthorizedPlan { slot: slot, plan_hash: provenance.plan_hash },
                       budget: HostAllocationConserves, cpu_budget: provenance.cpu_budget, attempt_envelope: provenance.attempt_envelope,
                       prior_purpose: WorkspacePriorPurposeWithdrawn,
                       obligations: workspace_observe_commissioning_obligations(root: fabric_control_plane_store_root(), slot: slot), sanitation: observation.observations) {
-                      WorkspaceCommissioningReady { commissioned: _ } => true
-                      WorkspaceCommissioningRefused { reason: _ } => false
-                    })
-                    if admitted { WorkspaceCommissioningFleetObserved { basis: WorkspaceCommissioningFleetBasis {
+                      WorkspaceCommissioningReady { commissioned: _ } => none
+                      WorkspaceCommissioningRefused { reason } => Present { value: reason }
+                    } }
+                    match admission_refusal {
+                      Absent => WorkspaceCommissioningFleetObserved { basis: WorkspaceCommissioningFleetBasis {
                         provenance: provenance, release_dir: installed, already_committed: committed,
                         prestate: serialize_content_hash(hash: content_hash_of_value(value: to_string([
                           to_string(snapshot.expected), to_string(snapshot.reading), to_string(execution.expected),
                           to_string(readiness), if initial { to_string(HoldSlotAbsent) } else { to_string(mutation) }, to_string(controller), observation.observation_identity as String,
                         ]) as NonEmptyStr)) as NonEmptyStr,
-                      } } } else { WorkspaceCommissioningFleetRefused { reason: "initial commissioning obligations are not admitted" } }
+                      } }
+                      Present { value: reason } => WorkspaceCommissioningFleetRefused { reason: reason }
+                    }
                     }
                     WorkspaceCommissioningStartUnreadable { reason: _ } => WorkspaceCommissioningFleetRefused { reason: "controller prestate is unreadable" }
                   } }
-                  WorkspaceInitialSanitationUnavailable { reason: _ } => WorkspaceCommissioningFleetRefused { reason: "fresh sanitation is unreadable" }
+                  WorkspaceInitialSanitationUnavailable { reason } => WorkspaceCommissioningFleetRefused { reason: concat("fresh sanitation is unreadable: ", reason) }
                 }
-                NetworkSubjectRefused { refusal: _ } => WorkspaceCommissioningFleetRefused { reason: "network subject is unreadable" }
+                NetworkSubjectRefused { refusal } => WorkspaceCommissioningFleetRefused { reason: concat("network subject is unreadable: ", refusal_text(r: refusal)) }
               } }
             }
             WorkspaceExecutorJournalUnreadable { reason: _ } => WorkspaceCommissioningFleetRefused { reason: "executor journal is unreadable" }
@@ -208,7 +236,19 @@ fn workspace_commissioning_basis_observe(provenance: WorkspaceCommissioningProve
 fn workspace_commissioning_basis_from_privileged(text: String, host: NonEmptyStr, revision: CommitSha) -> WorkspaceCommissioningFleetObservation
   admit_callers: [decl_ref(module_path: "gunbc.workspace_commissioning_dispatch_transport", decl_name: "workspace_dispatch_observe")]
 {
-  match workspace_executor_plan_credential(plan_body: text) {
+  if starts_with(s: text, prefix: host_kernel_dependency_row_prefix) {
+    let slots = filter(workspace_execution_slot_identities(), slot => slot.host == host)
+    if slots.count() != 1 { WorkspaceCommissioningFleetRefused { reason: "dependency response has no unique designated slot" } }
+    else { match slots.first() {
+      Absent => WorkspaceCommissioningFleetRefused { reason: "dependency response slot is absent" }
+      Present { value: slot } => match host_kernel_dependency_from_text(
+        text: substring(s: text, start: length(host_kernel_dependency_row_prefix), end: length(text)),
+        host: host as HostIdentity, revision: revision, requirement: slot_network_tun_queue_requirement(slot: slot)) {
+        Present { value: plan } => WorkspaceCommissioningFleetDependencyObserved { plan: plan }
+        Absent => WorkspaceCommissioningFleetRefused { reason: "privileged kernel dependency response changed subject or is noncanonical" }
+      }
+    } }
+  } else { match workspace_executor_plan_credential(plan_body: text) {
     Present { value: credential } => match workspace_commissioning_directive_from_text(text: credential) {
       WorkspaceCommissioningDirectiveReady { provenance } => match workspace_executor_plan_prestate(plan_body: text) {
         Present { value: prestate } => {
@@ -225,5 +265,5 @@ fn workspace_commissioning_basis_from_privileged(text: String, host: NonEmptyStr
       WorkspaceCommissioningDirectiveRefused { reason: _ } => WorkspaceCommissioningFleetRefused { reason: "privileged commissioning provenance unreadable" }
     }
     Absent => WorkspaceCommissioningFleetRefused { reason: "privileged commissioning response lacks its unique credential" }
-  }
+  } }
 }
diff --git a/dag/gunbc/workspace_host_offer_observe.dag b/dag/gunbc/workspace_host_offer_observe.dag
index 96467524f43..68645ffe87e 100644
--- a/dag/gunbc/workspace_host_offer_observe.dag
+++ b/dag/gunbc/workspace_host_offer_observe.dag
@@ -23,6 +23,8 @@ import gunbc.workspace_tool_observer { workspace_observe_tools, WorkspaceToolsRe
 import gunbc.workspace_allocation_supply { workspace_observe_host_supply, WorkspaceHostSupplyObserved, WorkspaceHostSupplyUnavailable }
 import gunbc.workspace_gateway_store { workspace_read_gateway_evidence, WorkspaceGatewayEvidenceRead, WorkspaceGatewayEvidenceUnavailable }
 import gunbc.workspace_offer_producer { WorkspaceHostOfferRead, WorkspaceHostOfferUnmet, workspace_host_offer_admit }
+import gunbc.workspace_allocation_policy { workspace_enrolled_ssh_access }
+import gunbc.workspace_ssh_access { WorkspaceSshFromHost, WorkspaceSshThroughGateway, WorkspaceHostAccessObserved, WorkspaceGatewayAccessObserved }
 
 // RUNS ON THE CANDIDATE HOST, inside its installed controller release, and only reads. Every
 // existing host-local observer is reused unchanged; this fold composes them per designated slot.
@@ -55,12 +57,24 @@ fn workspace_observe_slot_offer(request: WorkspaceRequest, host: HostIdentity, s
             WorkspaceToolsUnobserved { reason } => WorkspaceHostOfferUnmet { host: host, reason: reason }
             WorkspaceToolsReady { observation: tools } => match workspace_observe_host_supply(host: host) {
               WorkspaceHostSupplyUnavailable { reason } => WorkspaceHostOfferUnmet { host: host, reason: reason }
-              WorkspaceHostSupplyObserved { observation: supply } => match workspace_read_gateway_evidence(store: fabric_state_storage_binding(), slot: slot) {
-                WorkspaceGatewayEvidenceUnavailable { reason } => WorkspaceHostOfferUnmet { host: host, reason: reason }
-                WorkspaceGatewayEvidenceRead { evidence: gateway } => match clock_now_probed_at() {
-                  Absent => WorkspaceHostOfferUnmet { host: host, reason: "host offer clock is unavailable" }
-                  Present { value: now } => workspace_host_offer_admit(root: fabric_control_plane_store_root(), request: request,
-                    commissioned: committed, image: image, host: supply, tools: tools, gateway: gateway, now: now as String)
+              WorkspaceHostSupplyObserved { observation: supply } => match workspace_enrolled_ssh_access(owner: request.owner) {
+                Absent => WorkspaceHostOfferUnmet { host: host, reason: "workspace owner has no admitted SSH access policy" }
+                Present { value: access } => match access {
+                  WorkspaceSshFromHost { identity_file: _ } => match clock_now_probed_at() {
+                    Absent => WorkspaceHostOfferUnmet { host: host, reason: "host offer clock is unavailable" }
+                    Present { value: now } => workspace_host_offer_admit(root: fabric_control_plane_store_root(), request: request,
+                      commissioned: committed, image: image, host: supply, tools: tools,
+                      access: WorkspaceHostAccessObserved { host: host, observed_at: supply.observed_at }, now: now as String)
+                  }
+                  WorkspaceSshThroughGateway => match workspace_read_gateway_evidence(store: fabric_state_storage_binding(), slot: slot) {
+                    WorkspaceGatewayEvidenceUnavailable { reason } => WorkspaceHostOfferUnmet { host: host, reason: reason }
+                    WorkspaceGatewayEvidenceRead { evidence: gateway } => match clock_now_probed_at() {
+                      Absent => WorkspaceHostOfferUnmet { host: host, reason: "host offer clock is unavailable" }
+                      Present { value: now } => workspace_host_offer_admit(root: fabric_control_plane_store_root(), request: request,
+                        commissioned: committed, image: image, host: supply, tools: tools,
+                        access: WorkspaceGatewayAccessObserved { evidence: gateway }, now: now as String)
+                    }
+                  }
                 }
               }
             }
diff --git a/dag/gunbc/workspace_image_delivery.dag b/dag/gunbc/workspace_image_delivery.dag
new file mode 100644
index 00000000000..3f8dba50d46
--- /dev/null
+++ b/dag/gunbc/workspace_image_delivery.dag
@@ -0,0 +1,59 @@
+module gunbc.workspace_image_delivery
+
+import std.types { String, NonEmptyStr }
+import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.tools.mkdir { mkdir_parents_command }
+import extdeps.tools.curl { curl_download_command }
+import extdeps.tools.sha256sum { sha256sum_file_digest_via_shell, Sha256FileDigest, Sha256FileDigestUnavailable }
+import gunbc.command_runner { run_shell_commands, LocalExec }
+import gunbc.microvm_guest_artifacts {
+  runner_guest_kernel_artifact, runner_guest_base_rootfs_artifact, runner_guest_base_dir,
+  runner_guest_base_artifact_path, guest_artifact_verdict, ArtifactMatchesPin,
+  ArtifactUnpinnedFirstContact, ArtifactBuildReceipt, ArtifactContradictsPin, ArtifactNotMeasured,
+}
+import gunbc.workspace_guest_image { workspace_image_build, workspace_image_path }
+
+// Transport is not admission. The administrator installs these exact files, then checks the
+// installed kernel and rootfs against the reviewed pins before commissioning can expose supply.
+data workspace_image_staging_root: String = "target/workspace-image-artifact"
+data workspace_image_artifact_name: String = "workspace-guest-image"
+data workspace_image_build_receipt: String = "target/workspace-image-artifact/build-receipt.txt"
+
+fn workspace_image_artifact_paths() -> String {
+  join([workspace_image_path(root: workspace_image_staging_root),
+    runner_guest_base_artifact_path(root: workspace_image_staging_root, artifact: runner_guest_kernel_artifact),
+    workspace_image_build_receipt], "\n")
+}
+
+// Run the whole entry under fakeroot, so ownership survives extraction and mke2fs -d.
+// The digest is a receipt of one build, never a promise that mke2fs output is reproducible.
+fn workspace_image_build_wet() -> ProcessExit {
+  let root = workspace_image_staging_root
+  match run_shell_commands(commands: [
+    mkdir_parents_command(path: runner_guest_base_dir(root: root)),
+    curl_download_command(url: runner_guest_kernel_artifact.url as String,
+      destination: runner_guest_base_artifact_path(root: root, artifact: runner_guest_kernel_artifact)),
+    curl_download_command(url: runner_guest_base_rootfs_artifact.url as String,
+      destination: runner_guest_base_artifact_path(root: root, artifact: runner_guest_base_rootfs_artifact)),
+  ], transport: LocalExec) {
+    ExitFailure { code, reason } => ExitFailure { code: code, reason: reason }
+    ExitSuccess => match guest_artifact_verdict(artifact: runner_guest_kernel_artifact,
+      observed: sha256sum_file_digest_via_shell(path: runner_guest_base_artifact_path(root: root, artifact: runner_guest_kernel_artifact) as NonEmptyStr)) {
+      ArtifactMatchesPin => if !workspace_image_build(root: root) {
+        exit_failure(reason: "WorkspaceImageBuildRefused: pinned base, SSH tools, ownership or image assembly failed")
+      } else { match sha256sum_file_digest_via_shell(path: workspace_image_path(root: root) as NonEmptyStr) {
+        Sha256FileDigestUnavailable { path: _, reason } => exit_failure(reason: reason)
+        Sha256FileDigest { digest } => {
+          let receipt = Filesystem.Write(path: workspace_image_build_receipt,
+            content: join(["workspace-image-sha256=", digest.hex as String, "\n"], ""))
+          if receipt.success { ExitSuccess } else { exit_failure(reason: receipt.error) }
+        }
+      } }
+      ArtifactUnpinnedFirstContact { digest_hex: _ } => exit_failure(reason: "WorkspaceImageBuildRefused: kernel is unpinned")
+      ArtifactBuildReceipt { digest_hex: _ } => exit_failure(reason: "WorkspaceImageBuildRefused: kernel is not a pinned input")
+      ArtifactContradictsPin { expected_hex: _, observed_hex: _ } => exit_failure(reason: "WorkspaceImageBuildRefused: kernel contradicts pin")
+      ArtifactNotMeasured { reason } => exit_failure(reason: reason)
+    }
+  }
+}
diff --git a/dag/gunbc/workspace_initial_sanitation.dag b/dag/gunbc/workspace_initial_sanitation.dag
index 8d4876faeea..448daa2280e 100644
--- a/dag/gunbc/workspace_initial_sanitation.dag
+++ b/dag/gunbc/workspace_initial_sanitation.dag
@@ -20,7 +20,7 @@ import gunbc.runner_microvm_lifecycle {
 }
 import gunbc.runner_microvm_lifecycle_realize { observe_cgroup_subtree, mount_point_is_within }
 import gunbc.runner_microvm_network { SlotNetworkSanitationSubject, SlotNetworkReadback, slot_network_verdict }
-import gunbc.runner_microvm_network_observe { observe_slot_network_readings }
+import gunbc.runner_microvm_network_sanitation_observe { observe_slot_network_readings }
 import product.fabric.sanitation { SanitationObservation, MountsRemoved, WritableLayersDeleted, SecretsRemoved }
 
 // Observation identity is content-addressed; observed_at separately carries freshness. A clean
diff --git a/dag/gunbc/workspace_offer_producer.dag b/dag/gunbc/workspace_offer_producer.dag
index 4cdfcd83da1..b3b8b8f32fd 100644
--- a/dag/gunbc/workspace_offer_producer.dag
+++ b/dag/gunbc/workspace_offer_producer.dag
@@ -16,7 +16,8 @@ import gunbc.runner_microvm { gunbc_runner_microvm_declared_realization_allowanc
 import gunbc.workspace_tool_observer { WorkspaceToolsObserved, workspace_tools_refusal }
 import gunbc.workspace_allocation { WorkspaceRequest, workspace_execution_requirements, workspace_profile_vcpus, workspace_profile_memory }
 import gunbc.workspace_allocation_supply { WorkspaceHostSupplyObservation, workspace_slot_observation_refusal }
-import gunbc.workspace_gateway_admission { WorkspaceGatewayEvidence, workspace_gateway_refusal }
+import gunbc.workspace_ssh_access { WorkspaceAccessEvidence, workspace_access_refusal, workspace_access_receipt }
+import gunbc.workspace_allocation_policy { workspace_enrolled_ssh_access }
 import gunbc.fabric_control_plane { fabric_cell_allocation_key }
 import product.placement_supply { HostIdentity }
 import std.algebra { trim }
@@ -48,7 +49,7 @@ type WorkspaceHostOfferAdmission sole_constructor {
   slot: RunnerSlotIdentity
   observed_at: Timestamp
   commissioning_plan_hash: NonEmptyStr
-  gateway_receipt: NonEmptyStr
+  access_receipt: NonEmptyStr
   image: NonEmptyStr
   request_key: NonEmptyStr
 }
@@ -59,26 +60,31 @@ type WorkspaceHostOfferRead
 fn workspace_host_offer_admit(root: NonEmptyStr, request: WorkspaceRequest,
   commissioned: WorkspaceCommittedCommissioning, image: VerifiedWorkspaceImage,
   host: WorkspaceHostSupplyObservation, tools: WorkspaceToolsObserved,
-  gateway: WorkspaceGatewayEvidence, now: Timestamp) -> WorkspaceHostOfferRead {
-  let guest_bytes = byte_size_count(b: workspace_profile_memory(profile: request.profile))
-  let realization_bytes = byte_size_count(b: gibibyte_to_byte_size(g: gunbc_runner_microvm_declared_realization_allowance))
-  if image.identity != request.image { WorkspaceHostOfferUnmet { host: host.host, reason: "installed image does not match admitted request" } }
-  else if hardware_thread_count_value(t: commissioned.admitted.cpu_budget) < workspace_profile_vcpus(profile: request.profile)
-    || byte_size_count(b: commissioned.admitted.attempt_envelope) < guest_bytes + realization_bytes {
-    WorkspaceHostOfferUnmet { host: host.host, reason: "commissioned exclusive slot budget cannot contain the selected guest and realization reserve" }
-  } else if (match workspace_tools_refusal(observation: tools, slot: commissioned.admitted.slot, now: now) { Present { value: _ } => true Absent => false }) {
-    WorkspaceHostOfferUnmet { host: host.host, reason: "controller tools are stale, unobserved, or belong to another host" }
-  } else { match workspace_slot_observation_refusal(root: root, slot: commissioned.admitted.slot, observation: host, now: now) {
-    Present { value: detail } => WorkspaceHostOfferUnmet { host: host.host, reason: detail }
-    Absent => match workspace_gateway_refusal(slot: commissioned.admitted.slot, evidence: gateway, now: now) {
-      Present { value: detail } => WorkspaceHostOfferUnmet { host: host.host, reason: detail }
-      Absent => WorkspaceHostOfferAdmitted { admission: WorkspaceHostOfferAdmission {
-        host: host.host, slot: commissioned.admitted.slot, observed_at: host.observed_at,
-        commissioning_plan_hash: commissioned.admitted.commissioning_plan_hash as NonEmptyStr,
-        gateway_receipt: gateway.receipt, image: image.identity, request_key: request.idempotency_key,
+  access: WorkspaceAccessEvidence, now: Timestamp) -> WorkspaceHostOfferRead {
+  match workspace_enrolled_ssh_access(owner: request.owner) {
+    Absent => WorkspaceHostOfferUnmet { host: host.host, reason: "workspace owner has no admitted SSH access policy" }
+    Present { value: required_access } => {
+      let guest_bytes = byte_size_count(b: workspace_profile_memory(profile: request.profile))
+      let realization_bytes = byte_size_count(b: gibibyte_to_byte_size(g: gunbc_runner_microvm_declared_realization_allowance))
+      if image.identity != request.image { WorkspaceHostOfferUnmet { host: host.host, reason: "installed image does not match admitted request" } }
+      else if hardware_thread_count_value(t: commissioned.admitted.cpu_budget) < workspace_profile_vcpus(profile: request.profile)
+        || byte_size_count(b: commissioned.admitted.attempt_envelope) < guest_bytes + realization_bytes {
+        WorkspaceHostOfferUnmet { host: host.host, reason: "commissioned exclusive slot budget cannot contain the selected guest and realization reserve" }
+      } else if (match workspace_tools_refusal(observation: tools, slot: commissioned.admitted.slot, now: now) { Present { value: _ } => true Absent => false }) {
+        WorkspaceHostOfferUnmet { host: host.host, reason: "controller tools are stale, unobserved, or belong to another host" }
+      } else { match workspace_slot_observation_refusal(root: root, slot: commissioned.admitted.slot, observation: host, now: now) {
+        Present { value: detail } => WorkspaceHostOfferUnmet { host: host.host, reason: detail }
+        Absent => match workspace_access_refusal(access: required_access, slot: commissioned.admitted.slot, evidence: access, now: now) {
+          Present { value: detail } => WorkspaceHostOfferUnmet { host: host.host, reason: detail }
+          Absent => WorkspaceHostOfferAdmitted { admission: WorkspaceHostOfferAdmission {
+            host: host.host, slot: commissioned.admitted.slot, observed_at: host.observed_at,
+            commissioning_plan_hash: commissioned.admitted.commissioning_plan_hash as NonEmptyStr,
+            access_receipt: workspace_access_receipt(evidence: access), image: image.identity, request_key: request.idempotency_key,
+          } }
+        }
       } }
     }
-  } }
+  }
 }
 
 fn workspace_host_offer_json(read: WorkspaceHostOfferRead) -> JsonValue {
@@ -89,7 +95,7 @@ fn workspace_host_offer_json(read: WorkspaceHostOfferRead) -> JsonValue {
       json_kv(key: "slot_index", value: json_int(n: a.slot.slot_index)),
       json_kv(key: "observed_at", value: json_string(s: a.observed_at)),
       json_kv(key: "commissioning_plan_hash", value: json_string(s: a.commissioning_plan_hash as String)),
-      json_kv(key: "gateway_receipt", value: json_string(s: a.gateway_receipt as String)),
+      json_kv(key: "access_receipt", value: json_string(s: a.access_receipt as String)),
       json_kv(key: "image", value: json_string(s: a.image as String)),
       json_kv(key: "request_key", value: json_string(s: a.request_key as String)),
     ])
@@ -101,7 +107,7 @@ fn workspace_host_offer_json(read: WorkspaceHostOfferRead) -> JsonValue {
   }
 }
 
-data workspace_host_offer_schema: String = "workspace-host-offer/v1"
+data workspace_host_offer_schema: String = "workspace-host-offer/v2"
 
 fn workspace_host_offer_text(read: WorkspaceHostOfferRead) -> String { serialize_json(v: workspace_host_offer_json(read: read)) }
 
@@ -132,14 +138,14 @@ fn workspace_host_offer_decode(text: String, expected_host: HostIdentity) -> Wor
         let slot = RunnerSlotIdentity { host: expected_host, slot_index: index }
         if !identity_is_workspace_execution_member(identity: slot) { WorkspaceHostOfferUndecodable { host: expected_host, reason: "host offer names a slot outside the workspace roster" } }
         else if workspace_host_offer_field(doc: doc, field: "observed_at") == "" || workspace_host_offer_field(doc: doc, field: "commissioning_plan_hash") == ""
-          || workspace_host_offer_field(doc: doc, field: "gateway_receipt") == "" || workspace_host_offer_field(doc: doc, field: "image") == ""
+          || workspace_host_offer_field(doc: doc, field: "access_receipt") == "" || workspace_host_offer_field(doc: doc, field: "image") == ""
           || workspace_host_offer_field(doc: doc, field: "request_key") == "" {
           WorkspaceHostOfferUndecodable { host: expected_host, reason: "host offer is missing a required field" }
         } else {
           let candidate = WorkspaceHostOfferAdmitted { admission: WorkspaceHostOfferAdmission {
             host: expected_host, slot: slot, observed_at: workspace_host_offer_field(doc: doc, field: "observed_at"),
             commissioning_plan_hash: workspace_host_offer_field(doc: doc, field: "commissioning_plan_hash") as NonEmptyStr,
-            gateway_receipt: workspace_host_offer_field(doc: doc, field: "gateway_receipt") as NonEmptyStr,
+            access_receipt: workspace_host_offer_field(doc: doc, field: "access_receipt") as NonEmptyStr,
             image: workspace_host_offer_field(doc: doc, field: "image") as NonEmptyStr,
             request_key: workspace_host_offer_field(doc: doc, field: "request_key") as NonEmptyStr,
           } }
@@ -185,5 +191,5 @@ fn workspace_observed_offer_identity(admission: WorkspaceHostOfferAdmission, req
   supplier: NonEmptyStr) -> FabricIdentity<NonEmptyStr, OfferKey> {
   FabricIdentity { principal: supplier, key: serialize_content_hash(hash: content_hash_of_value(value: concat(
     admission.commissioning_plan_hash as String, fabric_cell_allocation_key(slot: admission.slot) as String,
-    request.image as String, to_string(request.profile), admission.gateway_receipt as String, admission.observed_at))) as OfferKey }
+    request.image as String, to_string(request.profile), admission.access_receipt as String, admission.observed_at))) as OfferKey }
 }
diff --git a/dag/gunbc/workspace_operator_request.dag b/dag/gunbc/workspace_operator_request.dag
index 80cfbb14cdb..0fc643cd1bc 100644
--- a/dag/gunbc/workspace_operator_request.dag
+++ b/dag/gunbc/workspace_operator_request.dag
@@ -1,8 +1,14 @@
 module gunbc.workspace_operator_request
 
-import std.types { String, NonEmptyStr, Timestamp }
+import std.types { String, NonEmptyStr, Timestamp, Int, Bool }
 import std.process { ProcessExit, ExitSuccess, exit_failure }
 import extdeps.shell
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.languages.json.emit { serialize_json }
+import gunbc.command_runner { run_shell_command_capture, LocalExec }
+import extdeps.tools.hostname { hostname_short_read_command }
+import extdeps.shell.exec { ProcessOutputPresent, ProcessOutputAbsent, ProcessRefused }
+import gunbc.runner_slot_allocation { workspace_execution_slot_identities }
 import gunbc.clock_read { clock_now_probed_at }
 import gunbc.fabric_storage_binding { fabric_state_storage_binding }
 import gunbc.fabric_storage_client { FabricStorageBinding }
@@ -12,7 +18,7 @@ import gunbc.workspace_allocation_admission { WorkspaceRequestAdmission, workspa
 import gunbc.workspace_allocation_policy { workspace_operator_principal, workspace_installed_policy }
 import gunbc.workspace_allocation_admission { workspace_owner_enrollment, WorkspacePolicyAdmitted, WorkspacePolicyRefused }
 import gunbc.workspace_artifact_policy { workspace_demo_image_identity }
-import gunbc.workspace_allocation_store { workspace_record_request_at, WorkspaceStoreWritten, WorkspaceStoreConflict, WorkspaceStoreWriteRefused }
+import gunbc.workspace_allocation_store { workspace_record_request_at, WorkspaceStoreWritten, WorkspaceStoreConflict, WorkspaceStoreWriteRefused, WorkspaceAllocation, workspace_allocation_json, workspace_read_owner, WorkspaceStoreReadOk, WorkspaceStoreUnreadable, workspace_request_release_at }
 
 // OPERATOR-ONLY FIRST REVISION. The owner is the single enrolled operator principal, not a
 // caller-supplied identity: this producer exists so a first request can be recorded while the
@@ -42,7 +48,7 @@ fn workspace_operator_request_record(store: FabricStorageBinding, observed_at: T
     WorkspaceRequestPolicyRefused { reason: detail } => exit_failure(reason: concat("WorkspaceOperatorRequestRefused: ", detail as String))
     WorkspaceRequestAdmissionRefused { decision: _ } => exit_failure(reason: "WorkspaceOperatorRequestRefused: operator admission refused")
     WorkspaceRequestAdmitted { request: admitted } => match workspace_record_request_at(store: store, request: admitted, observed_at: observed_at) {
-      WorkspaceStoreWritten { allocation: _ } => ExitSuccess
+      WorkspaceStoreWritten { allocation } => workspace_operator_receipt(allocation: allocation)
       WorkspaceStoreConflict => exit_failure(reason: "WorkspaceOperatorRequestConflict: owner ledger changed concurrently; resubmit the same key")
       WorkspaceStoreWriteRefused { reason: detail } => exit_failure(reason: concat("WorkspaceOperatorRequestRefused: ", detail))
     }
@@ -55,12 +61,77 @@ fn workspace_operator_request_env(name: NonEmptyStr) -> String {
 
 // Typed entry: key, profile and lease end are the only operator inputs.
 fn workspace_operator_request_wet() -> ProcessExit {
-  match clock_now_probed_at() {
+  if !workspace_operator_on_candidate_host() { exit_failure(reason: "WorkspaceOperatorRequestRefused: executor is not a workspace host") }
+  else { match clock_now_probed_at() {
     Absent => exit_failure(reason: "WorkspaceOperatorRequestRefused: request clock is unavailable")
     Present { value: now } => workspace_operator_request_record(store: fabric_state_storage_binding(),
       observed_at: now as Timestamp,
       key: workspace_operator_request_env(name: "GUNBC_WORKSPACE_REQUEST_KEY"),
       profile_wire: workspace_operator_request_env(name: "GUNBC_WORKSPACE_REQUEST_PROFILE"),
       expires_at: workspace_operator_request_env(name: "GUNBC_WORKSPACE_REQUEST_EXPIRES_AT") as Timestamp)
+  } }
+}
+
+// These entries only publish intent to the protected owner ledger. The existing reconciler owns
+// reservation, VM effects and cleanup; a successful intent write never claims a usable VM.
+data workspace_operator_receipt_path: String = "target/workspace-operation.json"
+
+fn workspace_operator_on_candidate_host() -> Bool {
+  match run_shell_command_capture(command: hostname_short_read_command(), transport: LocalExec) {
+    ProcessOutputPresent { text } => any(workspace_execution_slot_identities(), slot => (slot.host as String) == trim(s: text))
+    ProcessOutputAbsent => false
+    ProcessRefused { exit_code: _, stderr: _ } => false
+  }
+}
+
+fn workspace_operator_receipt(allocation: WorkspaceAllocation) -> ProcessExit {
+  let written = Filesystem.Write(path: workspace_operator_receipt_path,
+    content: concat(serialize_json(v: workspace_allocation_json(allocation: allocation)), "\n"))
+  if written.success { ExitSuccess } else { exit_failure(reason: written.error) }
+}
+
+fn workspace_operator_release_wet() -> ProcessExit {
+  let key = workspace_operator_request_env(name: "GUNBC_WORKSPACE_REQUEST_KEY")
+  let generation = workspace_operator_request_env(name: "GUNBC_WORKSPACE_RELEASE_GENERATION")
+  if !workspace_operator_on_candidate_host() { exit_failure(reason: "WorkspaceOperatorReleaseRefused: executor is not a workspace host") }
+  else if !workspace_operator_is_enrolled() { exit_failure(reason: "WorkspaceOperatorReleaseRefused: operator is not enrolled") }
+  else { match workspace_allocation_id_of(raw: key) {
+    Absent => exit_failure(reason: "WorkspaceOperatorReleaseRefused: invalid request key")
+    Present { value: id } => match parse_int(s: generation) {
+      Absent => exit_failure(reason: "WorkspaceOperatorReleaseRefused: canonical reservation generation required")
+      Present { value: expected } => if expected < 0 || to_string(expected) != generation {
+        exit_failure(reason: "WorkspaceOperatorReleaseRefused: canonical nonnegative generation required")
+      } else { match clock_now_probed_at() {
+        Absent => exit_failure(reason: "WorkspaceOperatorReleaseRefused: clock unavailable")
+        Present { value: now } => match workspace_request_release_at(store: fabric_state_storage_binding(),
+          owner: workspace_operator_principal(), idempotency_key: id, expected_generation: expected as Int,
+          observed_at: now as Timestamp) {
+          WorkspaceStoreWritten { allocation } => workspace_operator_receipt(allocation: allocation)
+          WorkspaceStoreConflict => exit_failure(reason: "WorkspaceOperatorReleaseConflict: retry the same request and generation")
+          WorkspaceStoreWriteRefused { reason } => exit_failure(reason: reason)
+        }
+      } }
+    }
+  } }
+}
+
+fn workspace_operator_observe_wet() -> ProcessExit {
+  let key = workspace_operator_request_env(name: "GUNBC_WORKSPACE_REQUEST_KEY")
+  match workspace_read_owner(store: fabric_state_storage_binding(), owner: workspace_operator_principal()) {
+    WorkspaceStoreUnreadable { reason } => exit_failure(reason: reason)
+    WorkspaceStoreReadOk { snapshot } => match filter(snapshot.allocations, a => (a.request.idempotency_key as String) == key).first() {
+      Absent => exit_failure(reason: "WorkspaceOperatorObserveRefused: request absent for operator")
+      Present { value: allocation } => workspace_operator_receipt(allocation: allocation)
+    }
+  }
+}
+
+fn workspace_operator_is_enrolled() -> Bool {
+  match workspace_installed_policy() {
+    WorkspacePolicyRefused { reason: _ } => false
+    WorkspacePolicyAdmitted { policy } => match workspace_owner_enrollment(policy: policy, owner: workspace_operator_principal()) {
+      Absent => false
+      Present { value: _ } => true
+    }
   }
 }
diff --git a/dag/gunbc/workspace_ssh_access.dag b/dag/gunbc/workspace_ssh_access.dag
new file mode 100644
index 00000000000..b0ec47225f7
--- /dev/null
+++ b/dag/gunbc/workspace_ssh_access.dag
@@ -0,0 +1,65 @@
+module gunbc.workspace_ssh_access
+
+import std.types { String, NonEmptyStr, Timestamp }
+import std.content_hash { content_hash_of_value, serialize_content_hash }
+import product.host_identity { HostIdentity }
+import gunbc.build_cache_instance { RunnerSlotIdentity, runner_slot_identity_equal }
+import gunbc.workspace_gateway { WorkspaceGateway }
+import gunbc.workspace_gateway_admission { WorkspaceGatewayEvidence, workspace_gateway_refusal }
+import gunbc.auth.approval_capability { utc_instant_is_canonical, utc_instant_seconds_after }
+
+// Administrator-owned enrollment chooses where the SSH client runs. A host-local client needs
+// no forwarding permission or agent on a relay. Its identity file is local to that selected host;
+// only the matching PUBLIC key is carried by the guest enrollment.
+type WorkspaceSshAccess
+  = WorkspaceSshFromHost { identity_file: NonEmptyStr }
+  | WorkspaceSshThroughGateway
+
+type WorkspaceAccessEvidence
+  = WorkspaceHostAccessObserved { host: HostIdentity, observed_at: Timestamp }
+  | WorkspaceGatewayAccessObserved { evidence: WorkspaceGatewayEvidence }
+
+fn workspace_access_refusal(access: WorkspaceSshAccess, slot: RunnerSlotIdentity,
+  evidence: WorkspaceAccessEvidence, now: Timestamp) -> NonEmptyStr? {
+  match access {
+    WorkspaceSshFromHost { identity_file: _ } => match evidence {
+      WorkspaceGatewayAccessObserved { evidence: _ } => Present { value: "host-local access requires an observation on the selected host" }
+      WorkspaceHostAccessObserved { host, observed_at } =>
+        if host != slot.host { Present { value: "host-local access was observed on another host" } }
+        else if !utc_instant_is_canonical(t: now) || !utc_instant_is_canonical(t: observed_at)
+          || utc_instant_seconds_after(later: now, earlier: observed_at) < 0
+          || utc_instant_seconds_after(later: now, earlier: observed_at) > 60 {
+          Present { value: "host-local access observation is stale or in the future" }
+        } else { none }
+    }
+    WorkspaceSshThroughGateway => match evidence {
+      WorkspaceHostAccessObserved { host: _, observed_at: _ } => Present { value: "host-local access cannot prove SSH forwarding" }
+      WorkspaceGatewayAccessObserved { evidence: gateway } => workspace_gateway_refusal(slot: slot, evidence: gateway, now: now)
+    }
+  }
+}
+
+fn workspace_access_receipt(evidence: WorkspaceAccessEvidence) -> NonEmptyStr {
+  serialize_content_hash(hash: content_hash_of_value(value: to_string(evidence) as NonEmptyStr)) as NonEmptyStr
+}
+
+// The connection carries the route it actually verified, so a host-local observation cannot
+// accidentally be rendered as a ProxyJump instruction.
+type WorkspaceConnectionRoute
+  = WorkspaceDirectSsh { slot: RunnerSlotIdentity, identity_file: NonEmptyStr }
+  | WorkspaceGatewaySsh { gateway: WorkspaceGateway, known_host: NonEmptyStr }
+
+fn workspace_connection_route_refusal(slot: RunnerSlotIdentity, route: WorkspaceConnectionRoute) -> NonEmptyStr? {
+  match route {
+    WorkspaceDirectSsh { slot: selected, identity_file: _ } =>
+      if runner_slot_identity_equal(a: slot, b: selected) { none }
+      else { Present { value: "direct SSH route names another host or slot" } }
+    WorkspaceGatewaySsh { gateway, known_host } =>
+      if !runner_slot_identity_equal(a: slot, b: gateway.slot) {
+        Present { value: "gateway does not name this allocation's selected host and slot" }
+      } else if !starts_with(s: known_host as String, prefix: concat(gateway.tailnet_name as String, " "))
+        || string_contains(s: known_host as String, pattern: "\n") || string_contains(s: known_host as String, pattern: "\r") {
+        Present { value: "enrolled gateway key does not name this selected host" }
+      } else { none }
+  }
+}
diff --git a/dag/gunbc/workspace_tool_observer.dag b/dag/gunbc/workspace_tool_observer.dag
index 6a61603441d..44f912060fe 100644
--- a/dag/gunbc/workspace_tool_observer.dag
+++ b/dag/gunbc/workspace_tool_observer.dag
@@ -10,6 +10,8 @@ import gunbc.clock_read { clock_now_probed_at }
 import gunbc.auth.approval_capability { utc_instant_is_canonical, utc_instant_seconds_after }
 import gunbc.runner_microvm_host_ready { FirecrackerHostStanding, observe_firecracker_host_standing_at_binary_wet, firecracker_host_ready_in_this_process }
 import gunbc.runner_microvm_slot_unit { microvm_controller_vmm_binary, microvm_controller_jailer_binary }
+import gunbc.hostname_allocation { canonical_hostname_for_fleet_slot }
+import product.host_identity { HostIdentity }
 import gunbc.build_cache_instance { RunnerSlotIdentity }
 
 type WorkspaceToolsObserved sole_constructor { host: NonEmptyStr, observed_at: Timestamp, release_dir: NonEmptyStr, standing: FirecrackerHostStanding }
@@ -35,8 +37,19 @@ fn workspace_observe_tools(release_dir: NonEmptyStr, login: NonEmptyStr) -> Work
   }
 }
 
+// The observation carries the controller's KERNEL hostname, and the slot carries a stable identity;
+// they are joined through the hostname the naming authority allocated to that identity, never by
+// assuming the two spellings agree. A slot host with no allocated hostname cannot be matched, so the
+// observation is refused as belonging elsewhere rather than accepted on a coincidence.
+fn workspace_observation_is_slot_host(observed: NonEmptyStr, slot_host: HostIdentity) -> Bool {
+  match canonical_hostname_for_fleet_slot(fleet_slot: slot_host) {
+    Present { value: h } => (h as String) == (observed as String)
+    Absent => false
+  }
+}
+
 fn workspace_tools_refusal(observation: WorkspaceToolsObserved, slot: RunnerSlotIdentity, now: Timestamp) -> NonEmptyStr? {
-  if (observation.host as String) != (slot.host as String) { Present { value: "tool observation belongs to another host" } }
+  if !workspace_observation_is_slot_host(observed: observation.host, slot_host: slot.host) { Present { value: "tool observation belongs to another host" } }
   else if !utc_instant_is_canonical(t: now) || !utc_instant_is_canonical(t: observation.observed_at)
     || utc_instant_seconds_after(later: now, earlier: observation.observed_at) < 0
     || utc_instant_seconds_after(later: now, earlier: observation.observed_at) > 60 { Present { value: "controller tool observation is stale or unclocked" } }
diff --git a/dag/std/algebra.dag b/dag/std/algebra.dag
index bb4afc403d5..3fc5bd2c0a3 100644
--- a/dag/std/algebra.dag
+++ b/dag/std/algebra.dag
@@ -429,6 +429,14 @@ fn collection_concat_shape() -> AlgebraFieldTemplate {
   { name: "concat", param_types: [ReceiverSelf, ReceiverSelf], return_type: ReceiverSelf, size_effect: none, cost_shape: Present { value: ShapeLinearScan }, callback_element_position: none }
 }
 
+// THE FREE MONOID'S SIZE, NAMED so a v2 call head binds to it (v2.compiler.fold_lowering collection_roster_rows,
+// a RosterFreeMonoidPrimitiveCall row typed by this row). ITS RESULT IS A STATED Int, A DECLARED DEPARTURE from
+// the Nat the other size rows carry -- the declared drop gunbc.rung_drop
+// collection_count_result_stated_int_until_declared_results_are_judged, which carries its restoration trigger.
+fn collection_count_shape() -> AlgebraFieldTemplate {
+  { name: "count", param_types: [ReceiverSelf], return_type: NamedTemplate { name: "Int" }, size_effect: none, cost_shape: Present { value: ShapeLinearScan }, callback_element_position: none }
+}
+
 fn collection_sort_by_shape() -> AlgebraFieldTemplate {
   { name: "sort_by", param_types: [ReceiverSelf, CallableOf { params: [ReceiverElement], return_type: AlgebraTypeVariable { id: "SortKey" } }], return_type: ReceiverSelf, size_effect: Present { value: IdentityEffect }, cost_shape: Present { value: ShapeSortBody }, callback_element_position: Present { value: 0 } }
 }
@@ -990,8 +998,11 @@ fn boolean_algebra_templates() -> List<AlgebraFieldTemplate> {
   ]
 }
 
-// A CARDINALITY IS A NATURAL, AND IT NAMES ITS DECLARER. count and length (here and in the
-// free-monoid and function profiles below) return std.nat.Nat, qualified rather than spelled
+// A CARDINALITY IS A NATURAL, AND IT NAMES ITS DECLARER. count and length (here, in the function
+// profile, and length in the free-monoid profile below) return std.nat.Nat -- EXCEPT the free monoid's
+// count, collection_count_shape, which states Int: a declared departure whose authority is
+// gunbc.rung_drop collection_count_result_stated_int_until_declared_results_are_judged. Nat is
+// qualified rather than spelled
 // "Nat": a bare template name resolves at the CALL SITE, and a src/v2 module resolves it to
 // v2.std.nat.Nat, a Peano Zero | Succ coproduct whose Rust carrier is Rc<Nat>, not the i64 that
 // len() produces. The spelling then decided the emission -- `count(xs) >= 1` lowered to
@@ -1020,6 +1031,9 @@ fn pointwise_power_collection_templates() -> List<AlgebraFieldTemplate> {
   ]
 }
 
+// The size spellings also disagree on TYPE: collection_count_shape states Int, the other count/length rows state Nat,
+// and v2.std.algebra length declares Int. That departure is the declared drop gunbc.rung_drop
+// collection_count_result_stated_int_until_declared_results_are_judged, which carries its rungs, population and trigger.
 data algebra_count_length_name_fork_note: String = "count and length sit on the same template rows as the SAME operation, and that is a section 3 nicknaming fork being RECORDED rather than introduced (review 45499 raised it, correctly, as a smell). The fork's authority is the interpreter, which dispatches length, count and size to one native arm -- three names, one concept, and that arm predates this change. What was inconsistent was the declared surface: the templates listed only length, so a String receiver piped into count resolved at runtime while having no declared row, which the method-existence wall exposed the moment it began proving absence from the template roster. Reconciling the declaration to the runtime is the honest direction, because the runtime is what programs actually meet; inventing a distinct meaning for count to justify two rows would be the fabrication, and dropping the row would have left a working call refused. So the row is added and the fork is named here rather than silently propagated. Dissolve-on: feature:collection-size-single-spelling -- one name for this operation across the interpreter arm, the templates, and the corpus, a corpus-wide rename touching every call site, which belongs on its own lane rather than inside a P0 live-system fix. THE TRIGGER IS NAMED RATHER THAN DESCRIBED because a deferral whose condition is only prose cannot be looked up, counted, or closed by anyone but its author -- the asymmetry review 45759 caught beside unresolved_method_frontier, which cites feature:primitive-realization-single-authority and is therefore findable. The closing condition is decidable and stated: the interpreter's length/count/size arm dispatches one spelling, these two template rows carry that spelling only, and no other spelling resolves. Until then the count is the measure: three accepted spellings in the interpreter arm, two on these rows, one concept."
 
 fn free_monoid_scalar_templates() -> List<AlgebraFieldTemplate> {
@@ -1054,7 +1068,7 @@ fn free_monoid_collection_templates() -> List<AlgebraFieldTemplate> {
     collection_fold_shape(),
     collection_any_shape(),
     collection_all_shape(),
-    { name: "count", param_types: [ReceiverSelf], return_type: NamedTemplate { name: "std.nat.Nat" }, size_effect: none, cost_shape: Present { value: ShapeLinearScan }, callback_element_position: none },
+    collection_count_shape(),
     { name: "first", param_types: [ReceiverSelf], return_type: OptionalOf { inner: ReceiverElement }, size_effect: Present { value: ProjectionEffect }, cost_shape: Present { value: ShapeLinearScan }, callback_element_position: none },
     { name: "last", param_types: [ReceiverSelf], return_type: OptionalOf { inner: ReceiverElement }, size_effect: Present { value: ProjectionEffect }, cost_shape: Present { value: ShapeLinearScan }, callback_element_position: none },
     { name: "get", param_types: [ReceiverSelf, NamedTemplate { name: "Int" }], return_type: OptionalOf { inner: ReceiverElement }, size_effect: Present { value: ProjectionEffect }, cost_shape: Present { value: ShapeLinearScan }, callback_element_position: none },
diff --git a/dag/std/cache_identity.dag b/dag/std/cache_identity.dag
index f1a658dd6b3..781069aa13a 100644
--- a/dag/std/cache_identity.dag
+++ b/dag/std/cache_identity.dag
@@ -22,8 +22,6 @@ fn execution_receipt_digest_of_value(value: NonEmptyStr) -> ExecutionReceiptDige
 
 data resolved_graph_artifact_kind: ArtifactKindId = "resolved_graph"
 
-data parse_table_artifact_kind: ArtifactKindId = "parse_table"
-
 data parse_source_artifact_kind: ArtifactKindId = "parse_source"
 
 data typed_module_artifact_kind: ArtifactKindId = "typed_module"
@@ -36,6 +34,8 @@ data native_test_universe_artifact_kind: ArtifactKindId = "native_test_universe"
 
 data native_module_verdict_bundle_artifact_kind: ArtifactKindId = "native_module_verdict_bundle"
 
+data compute_work_artifact_kind: ArtifactKindId = "compute_work"
+
 data native_module_resolve_artifact_kind: ArtifactKindId = "native_module_resolve"
 
 data native_module_infer_artifact_kind: ArtifactKindId = "native_module_infer"
diff --git a/dag/std/cache_interface.dag b/dag/std/cache_interface.dag
index 36e0fd4b875..4e56d6b67f3 100644
--- a/dag/std/cache_interface.dag
+++ b/dag/std/cache_interface.dag
@@ -20,7 +20,7 @@ import std.realization_schedule {
   CostTimeAxis,
   cost_time_axis_established,
 }
-import std.cache_identity { CacheInterfaceId, ArtifactKindId, ExecutionReceiptDigest, resolved_graph_artifact_kind, parse_table_artifact_kind }
+import std.cache_identity { CacheInterfaceId, ArtifactKindId, ExecutionReceiptDigest, resolved_graph_artifact_kind }
 
 type StorageSurface = NonEmptyStr where brand("StorageSurface")
 
diff --git a/dag/std/change.dag b/dag/std/change.dag
index e50844c2881..af97b871f5c 100644
--- a/dag/std/change.dag
+++ b/dag/std/change.dag
@@ -3,6 +3,8 @@ module std.change
 import std.types { List, Bool, list_length }
 import std.algebra { Monoid, Cons }
 import std.keyed_row { KeyedRow, keyed_row_find }
+import std.optional { Present, Absent }
+import v2.std.algebra { any }
 
 type KeyedDiffHunk<K, V>
   = KeyedDiffAddedHunk { hunk_key: K, to: V }
diff --git a/dag/std/compiler_entry.dag b/dag/std/compiler_entry.dag
index 9adb877d01b..3eeb9f2885a 100644
--- a/dag/std/compiler_entry.dag
+++ b/dag/std/compiler_entry.dag
@@ -1,5 +1,6 @@
 module std.compiler_entry
 
+import std.decl_ref { DeclarationRef, decl_ref }
 import std.measure {
   Nanosecond,
   nanosecond,
@@ -91,12 +92,12 @@ import std.measure {
 // NativeClaimReport`, which computes every case, renders one row per case identity and decides the
 // terminal;
 // the rendered main performs only the operations no fold can -- writing stdout and setting the
-// status -- and reads no argv. Its DECLARED RESOURCE SET is {Filesystem}: a report that reaches no
+// status -- and reads no argv. Its DECLARED RESOURCE SET is native_claim_route_denominator below: a report that reaches no
 // effect gets a synchronous main that binds nothing, and a report whose only demand is the
 // Filesystem service gets that service bound to the existing extdeps.filesystem.filesystem_io
 // handler, the binding NativeCliDriver's main already performs, with a transport error reported as
 // no observation. Any other demand is refused at emission in place of a main
-// (v1.compiler.emit_rust native_claim_report_effect_demand), so a claim cannot reach an effect this
+// (native_claim_route_denominator below, read by v1.compiler.emit NativeEffectRealizationAdmission), so a claim cannot reach an effect this
 // driver has not declared. It exists because a claim that must EXECUTE natively has
 // no other door: the required-v2-native lane runs v2.test.* claims inside the emitted compiler's own
 // evaluator, which interprets the claim's closure rather than emitting it, and NativeCliDriver's main
@@ -146,6 +147,66 @@ type CompilerEntryDriver
   | NativeClaimDriver
   | NativeServeDriver
 
+// WHICH EFFECTS EACH NATIVE ENTRY ROUTE ADMITS: one denominator per native driver, owned here beside
+// the drivers and read by v1.compiler.emit NativeEffectRealizationAdmission. An effect is named by
+// what it IS, never by a spelling: a declaration identity (a service or resource declaration), or
+// NativeOutgoingHttp -- any service whose operations bind the REST transport, which is what makes a
+// service an outgoing-HTTP (Network) effect whatever it is called. Each denominator cites the ruling
+// that set it as a declaration reference, so the refusal names its authority rather than restating it.
+type NativeEffectClass
+  = NativeEffectDeclaration { declaration: DeclarationRef }
+  | NativeOutgoingHttp
+
+type NativeEffectScope
+  = NativeAdmitAllExcept { excluded: List<NativeEffectClass> }
+  | NativeAdmitOnly { admitted: List<NativeEffectClass> }
+
+type NativeEffectDenominator {
+  route: CompilerEntryDriver
+  ruling: DeclarationRef
+  scope: NativeEffectScope
+}
+
+fn native_effect_declared(module_path: String, decl_name: String) -> NativeEffectClass {
+  NativeEffectDeclaration { declaration: decl_ref(module_path: module_path, decl_name: decl_name) }
+}
+
+// The compiler route keeps the operator's 2026-09-16 ruling (demand-engine-program D11) whole: no
+// clock, no outgoing HTTP, no entropy, no auth context.
+data native_compiler_route_denominator: NativeEffectDenominator = NativeEffectDenominator {
+  route: NativeCliDriver,
+  ruling: decl_ref(module_path: "gunbc.plans.demand_engine_program", decl_name: "demand_engine_program_plan"),
+  scope: NativeAdmitAllExcept { excluded: [
+    native_effect_declared(module_path: "std.resources", decl_name: "Clock"),
+    native_effect_declared(module_path: "std.resources", decl_name: "Network"),
+    native_effect_declared(module_path: "std.resources", decl_name: "Entropy"),
+    native_effect_declared(module_path: "std.resources", decl_name: "AuthContext"),
+    native_effect_declared(module_path: "extdeps.clock", decl_name: "Clock"),
+    NativeOutgoingHttp
+  ] }
+}
+
+// The service route is that ruling's declared extension (gentle-dove-36, 2026-10-04, recorded on the
+// same D11 row): the clock and outgoing HTTP come back in; entropy and auth context stay out.
+data native_service_route_denominator: NativeEffectDenominator = NativeEffectDenominator {
+  route: NativeServeDriver,
+  ruling: decl_ref(module_path: "gunbc.plans.demand_engine_program", decl_name: "demand_engine_program_plan"),
+  scope: NativeAdmitAllExcept { excluded: [
+    native_effect_declared(module_path: "std.resources", decl_name: "Entropy"),
+    native_effect_declared(module_path: "std.resources", decl_name: "AuthContext")
+  ] }
+}
+
+// The claim route DECLARES its set rather than excluding from an open one: a claim report may demand
+// the extdeps.filesystem.filesystem_io Filesystem service and nothing else.
+data native_claim_route_denominator: NativeEffectDenominator = NativeEffectDenominator {
+  route: NativeClaimDriver,
+  ruling: decl_ref(module_path: "std.compiler_entry", decl_name: "NativeClaimDriver"),
+  scope: NativeAdmitOnly { admitted: [
+    native_effect_declared(module_path: "extdeps.filesystem.filesystem_io", decl_name: "Filesystem")
+  ] }
+}
+
 // MODULE RELEASE IS ITS OWN ROW BECAUSE RELEASE IS NOT FREE AND WAS NOT ATTRIBUTED. The per-module
 // loop closed its prepare span and then let the module's resolved tree fall out of scope at the end
 // of the iteration, so freeing it was paid inside parent_span and covered by no row.
diff --git a/dag/std/durable_compare_and_set.dag b/dag/std/durable_compare_and_set.dag
index 04e02b7ca70..ddf8da11619 100644
--- a/dag/std/durable_compare_and_set.dag
+++ b/dag/std/durable_compare_and_set.dag
@@ -129,10 +129,12 @@ type CasSlotObservation<T>
 //
 // THE PLACEMENT WAS PUT TO REVIEW AND RULED ON, and the ruling also corrected the NAME, which is the
 // part worth keeping. The arm stays here: an interface outcome need not be producible by every
-// realization, it needs a real producer and a stable caller-visible meaning, and a realization that
-// must discover its head under a budget supplies both (gunbc.fabric.durable_cas_fabric_storage does; the
-// file store no longer does, because its head search is total over the generation line). Moving it into the realization would either erase the typed remedy or force the whole
-// store-failure carrier to become realization-specific.
+// realization, it needs a real producer and a stable caller-visible meaning. Two producers supply
+// both: gunbc.fabric.durable_cas_fabric_storage (generation-gallop budget) and
+// gunbc.durable_cas_file_store cas_observe_window (windowed list-and-verify attempt roster). A
+// named-generation verify that finds G+1 present is not this arm -- that is a moved head, not an
+// exhausted observation budget. Moving BoundExceeded into a realization would either erase the
+// typed remedy or force the whole store-failure carrier to become realization-specific.
 //
 // But the first spelling was `CasUnreadableBeyondProbeBound`, and PROBE IS THE FILE REALIZATION'S
 // DISCOVERY METHOD while EXHAUSTED OBSERVATION CAPACITY IS THE INTERFACE FACT. Naming the interface
@@ -140,6 +142,10 @@ type CasSlotObservation<T>
 // as an instruction to every other realization to describe itself in terms of scanning. What is NOT
 // claimed is that every CAS realization can produce this: most cannot, and one that never has to
 // discover a head should never construct it.
+// `bound` is the exhausted observation-attempt budget (pass count), never a
+// generation. A windowed list that ran eight verifies against a live head at
+// generation 1500 reports bound 8. Rendering it as a generation is a meaning
+// fork of the field and a fabricated diagnostic.
 type CasUnreadableSlot
   = CasUnreadableMalformed { detail: NonEmptyStr }
   | CasUnreadableContentMissing { referenced: ContentHash }
@@ -155,7 +161,7 @@ fn cas_unreadable_slot_detail(cause: CasUnreadableSlot) -> String {
     CasUnreadableMalformed { detail: d } => concat("malformed: ", d as String)
     CasUnreadableContentMissing { referenced: h } => concat("content missing: ", serialize_content_hash(hash: h))
     CasUnreadableReadRefused { detail: d } => concat("read refused: ", d as String)
-    CasUnreadableObservationBoundExceeded { bound: b } => concat("observation bound exceeded at generation ", to_string(b))
+    CasUnreadableObservationBoundExceeded { bound: b } => concat("observation bound exceeded: ", to_string(b))
   }
 }
 
diff --git a/dag/std/integer.dag b/dag/std/integer.dag
index f1c24692518..d2cfe44cda4 100644
--- a/dag/std/integer.dag
+++ b/dag/std/integer.dag
@@ -2,11 +2,11 @@ module std.integer
 import std.optional { Absent, Present }
 
 import std.algebra { AbelianGroup, GroupCompletion }
-import std.nat { Nat }
+import std.nat { Nat, DecimalDigit, D0, D1, D2, D3, D4, D5, D6, D7, D8, D9, decimal_digit_value, decimal_digit_glyph, decimal_digit_successor, DecimalDigitNext, DecimalDigitCarry }
 import std.machine_constraints { Compose, MachineWidth, PointerWidth }
 import std.measure { bit_width, bit_width_count, bits_per_byte }
 import std.induction { int_pow_bounded }
-import std.types { gt_zero, List }
+import std.types { gt_zero, List, String }
 
 type Int8 = Compose<Int, MachineWidth<8>>
 type Int16 = Compose<Int, MachineWidth<16>>
@@ -237,3 +237,61 @@ fn uint8_channel_inclusive_max_value_derived() -> Int? {
     Absent => none
   }
 }
+
+// THE UNITS DIGIT OF A MACHINE INTEGER'S MAGNITUDE, for EVERY Int. A value of ten or more steps
+// down by ten and a value below minus nine steps up by ten (neither step changes the units digit of
+// the magnitude), so the walk below receives only -9..9.
+// The digit is CONSTRUCTED, never looked up: zero is D0 and each unit above it advances the digit
+// through the one successor table in std.nat (a carry out of D9 wraps to D0, which IS the units
+// digit of ten), and a value in -9..-1 is its own negation's digit (no overflow: its magnitude is
+// at most nine). No Int-to-digit selection exists to be out of range and no default arm exists to
+// answer one (DESIGN section 5: a failure arm must refuse, never widen; section 4b: construction
+// over validation) -- -1 is D1, 9 is D9, 10 is D0, 99 is D9, each by derivation.
+fn decimal_digit_of_units(value: Int) -> DecimalDigit {
+  if value >= 10 {
+    decimal_digit_of_units(value: value - 10)
+  } else if value < -9 {
+    decimal_digit_of_units(value: value + 10)
+  } else if value < 0 {
+    decimal_digit_of_units(value: 0 - value)
+  } else if value == 0 {
+    D0
+  } else {
+    decimal_digit_advance(d: decimal_digit_of_units(value: value - 1))
+  }
+}
+
+fn decimal_digit_advance(d: DecimalDigit) -> DecimalDigit {
+  match decimal_digit_successor(d: d) {
+    DecimalDigitNext { digit: next } => next
+    DecimalDigitCarry => D0
+  }
+}
+
+// MACHINE INTEGER TO DECIMAL TEXT. Int realizes as the host integer, so host division and
+// remainder are its declared operations (std.operator_realization HostOperator); the digit glyph
+// comes from the one table in std.nat. It moved here from v2.std.integer so a seed-emitted dag
+// module can name it (DESIGN section 3: a fact's home is its layer).
+// EXACT AND LOSSLESS: the canonical decimal spelling (a leading "-" only for negatives, no leading
+// zeros) is injective over Int, so this is the declared conversion an interpolation hole over an
+// Int names (DESIGN section 4: no implicit stringify).
+fn int_to_decimal_string(value: Int) -> String {
+  if value < 0 {
+    concat("-", int_digits_to_decimal_string(value: value))
+  } else {
+    int_digits_to_decimal_string(value: value)
+  }
+}
+
+// The digits of an Int's magnitude WITHOUT negating it: the minimum host integer has no
+// representable negation, so the recursion divides the signed value by ten and reads each units
+// digit through decimal_digit_of_units, which answers for either sign of remainder.
+fn int_digits_to_decimal_string(value: Int) -> String {
+  let rest = value / 10
+  let digit = decimal_digit_glyph(d: decimal_digit_of_units(value: value - (rest * 10)))
+  if rest == 0 {
+    digit
+  } else {
+    concat(int_digits_to_decimal_string(value: rest), digit)
+  }
+}
diff --git a/dag/std/judgment_contract.dag b/dag/std/judgment_contract.dag
index 87465ee8bb1..038e86148d7 100644
--- a/dag/std/judgment_contract.dag
+++ b/dag/std/judgment_contract.dag
@@ -108,6 +108,12 @@ data output_module_test_verdicts: ArtifactOutputId = "module_test_verdicts"
 
 data output_module_preparation_diagnostics: ArtifactOutputId = "module_preparation_diagnostics"
 
+data output_compute_work_outcome: ArtifactOutputId = "compute_work_outcome"
+
+data output_compute_work_log: ArtifactOutputId = "compute_work_log"
+
+data output_compute_work_outputs: ArtifactOutputId = "compute_work_outputs"
+
 
 type DeclaredInput {
   ref: NonEmptyStr
diff --git a/dag/std/literal_elaboration.dag b/dag/std/literal_elaboration.dag
index 2fc0bb199f3..b329d77fdf9 100644
--- a/dag/std/literal_elaboration.dag
+++ b/dag/std/literal_elaboration.dag
@@ -1,7 +1,7 @@
 module std.literal_elaboration
 
-import std.types { List, String, Bool, Int, NonEmptyStr }
-import std.decl_ref { DeclarationRef, decl_ref, declaration_ref_eq }
+import std.types { List, String, Bool, Int, NonEmptyStr, range }
+import std.decl_ref { DeclarationRef, declaration_ref_eq }
 import std.syntax { LiteralValue, LitStr, LitInt, LitFloat, LitBool, LitNull, LitSymbol }
 
 // THE EXPECTED-TYPE-DIRECTED LITERAL INTRODUCTION JUDGMENT, as a model (DESIGN section 4: one
@@ -204,7 +204,9 @@ fn elaborate_literal_at(
 // tree. The declaration stays the accepted inductive definition -- exhaustiveness, descent and
 // inhabitance are all judged on it -- and no realizer ever builds the unary tower.
 //
-// THE ROW NAMES THE CARRIER AND NOTHING ELSE. Which constructor is zero and which is successor is
+// THE ROW IS THE CARRIER'S ONLY ELABORATION-DISCOVERY AUTHORITY, AND ITS RANGE IS THE DECLARED
+// ADMISSION BOUND. It names the carrier and the kernel values the carrier admits (min and max,
+// below); it names no constructor. Which constructor is zero and which is successor is
 // read from the carrier's own declaration by the consumer (one nullary constructor, and one
 // constructor with exactly one field of the carrier's own type), so a row cannot disagree with
 // the declaration it is about, and a bound declaration that is NOT that shape is a refusal at the
@@ -214,9 +216,22 @@ fn elaborate_literal_at(
 // A DECLARATION IS NEVER BOTH. A carrier with a KernelGrounding row realizes as the kernel value,
 // so a kernel literal at its boundary is already its own value (DirectLiteral) and it must carry
 // no LiteralHomomorphism row; the two rosters partition the declarations they name.
+//
+// THE ROW DECLARES ITS RANGE: the kernel values that ARE values of the carrier, in std.types range's own
+// vocabulary (an absent bound constrains nothing). A kernel value outside it denotes no value of the carrier
+// -- std.nat Nat's row declares min 0, so `-1` is no natural -- and a consumer refuses it, derived from the
+// row (kernel_grounding_admits), never from a check of its own.
 type KernelGrounding {
   source_kind: LiteralSourceKind
   carrier: DeclarationRef
+  min: Int?
+  max: Int?
+}
+
+// Whether a kernel integer is a value of a grounded carrier: the ONE range authority, std.types range,
+// over the bounds the row declares.
+fn kernel_grounding_admits(row: KernelGrounding, value: Int) -> Bool {
+  range(value: value, min: row.min, max: row.max)
 }
 
 type KernelGroundingLookup
diff --git a/dag/std/materialization_provider.dag b/dag/std/materialization_provider.dag
index 210df05ae0b..367dd8c6ff6 100644
--- a/dag/std/materialization_provider.dag
+++ b/dag/std/materialization_provider.dag
@@ -33,7 +33,8 @@ import std.cache_identity {
   resolved_graph_artifact_kind,
   native_compiler_artifact_kind,
   native_test_universe_artifact_kind,
-  native_module_verdict_bundle_artifact_kind
+  native_module_verdict_bundle_artifact_kind,
+  compute_work_artifact_kind
 }
 import std.computation_identity {
   ComputationIdentity, StructurallyIdentical, IdentityUnknown,
@@ -72,6 +73,9 @@ import std.judgment_contract {
   length_prefixed_encode,
   output_compile_clean_diagnostic_union,
   output_module_preparation_diagnostics,
+  output_compute_work_outcome,
+  output_compute_work_log,
+  output_compute_work_outputs,
   output_module_test_verdicts,
   output_native_compiler_build_diagnostics,
   output_native_compiler_executable,
@@ -90,7 +94,16 @@ import std.decl_ref { DeclarationRef, WholeDeclaration }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
 import std.disposition { Disposition, Terminal }
 import std.measure { ByteSize, byte_size }
-import std.materialization_ladder { DemandNature, PureComputation, IdempotentEffect }
+import std.materialization_ladder { DemandNature, PureComputation, IdempotentEffect, FreshEffect }
+// THE SECOND STATED IMPORT DEPARTURE, for the same reason as the generation edge below: the compute
+// work vocabulary (the exact tree, the operation, the observed execution identity) has ONE home,
+// gunbc.compute.work_request, and restating it here would fork it. That module imports nothing that
+// reaches this one, so the edge is acyclic, which is the import graph's only law (DESIGN section 3).
+import gunbc.compute.work_request {
+  WorkSubject, ExactTree, WorkOperation, BuildGunbcBinaries, CompileEntry, RunClaims, WorkToolchainIdentity,
+  CargoRelease, CargoDebug,
+}
+import extdeps.git.object_store { git_object_id_wire_hex }
 
 // The typed materialization-provider CONTRACT (parent mandate 6B, model-only, 2026-07-28): the one
 // interface cli_run's ad-hoc caches consume when they flip — consumers ask for an ARTIFACT by typed
@@ -139,6 +152,7 @@ type ArtifactRequest
   | NativeCompilerArtifactRequest { generation: PreMaterializationIdentity }
   | UniverseArtifactRequest { tested_tree_identity: Fnv1a64Structural, route_binary: DeclaredInput }
   | NativeModuleVerdictBundleRequest(NativeModuleVerdictBundleSubject)
+  | ComputeWorkRequest { subject: WorkSubject, operation: WorkOperation, toolchain: WorkToolchainIdentity }
 
 // THE NATIVE ROUTE'S THREE REQUEST FAMILIES (operator rulings 2026-09-11: the replacement native CI
 // job is a materialization). Each is a VARIANT for the reason the header gives: kind, declared
@@ -204,6 +218,35 @@ type ArtifactRequest
 // gunbc.witness.v2_native_route's operator-invoked instrument), which lands in a later lane.
 // TRIGGER: the emitted native route constructs these requests from its own receipt identities and
 // serves or commits them through the local store instead of re-preparing every module per run.
+// ComputeWorkRequest: one host-run unit of compute work (gunbc.compute.work_provider_local) -- a cargo
+// build, a compile, or a claim run over ONE EXACT TREE. It carries the work vocabulary itself, never a
+// digest of it, so its key is derived here and nowhere else: gunbc.compute.work_request used to mint
+// a private tagged hash (work_identity) beside this contract's request_key, which is two keys for one
+// computation, and it is deleted. The subject is the git TREE (two commits with one tree are one
+// work); the operation's structural encoding and every execution-identity reading are declared
+// inputs, so a change in any of them keys apart. The execution identity (target triple, the executing rustc and cargo,
+// sccache, the provider's own source revision) is a RUNNER-READ input: observed by the provider, never
+// spelled by a caller. Its construction wall is the seed's sole_constructor/admit_callers today; on the
+// native route both are standing rung drops, so that wall is not yet structural there (see
+// gunbc.compute.work_request WorkToolchainIdentity).
+//
+// demand_nature IS DERIVED FROM THE OPERATION, which is what keeps the ladder honest about
+// recurrence: a build, a compile and a HERMETIC claim run repeat their answer over the same tree and
+// toolchain (IdempotentEffect, cache-admissible), while a WET claim run reads and touches the world,
+// so its demand is FreshEffect and the ladder exempts it from serving a prior commit. A caller cannot
+// declare a wet run shareable; the operation says what it is.
+//
+// Required outputs: the outcome document (the ending and its identity), the run log (a build whose
+// log was dropped is not the build that ran), and the declared-outputs part: the MANIFEST of what
+// the operation declared (each declared path with its blob identity), empty for the checking
+// operations. The built bytes are NOT a part of this artifact. Per the materialization authority's
+// ruling (royal-moth-86, 2026-10-03), host-local binaries realize in the bounded per-host store under
+// this family's OWN byte budget, so they cannot evict other families' entries, and cross-host binaries
+// travel through std.fabric_blob, never the local store. Both are realizations of the manifest's blob
+// identities, and nothing in this key depends on which one serves them. DECLARED FRONTIER (DESIGN section 3c): the cutover that serves and commits
+// this family through extdeps.realization.materialization_store_local and deletes the provider's
+// private ComputeLayout store lands on the BOUNDED store (quick-gull-60's C1), never on the unbounded
+// one; until then the family's executing consumer is the provider's identity, which IS this key.
 type NativeModuleVerdictBundleSubject {
   route_binary_identity: Fnv1a64Structural
   module_identity: Fnv1a64Structural
@@ -350,7 +393,8 @@ fn request_evaluation_bucket(identity: EvaluationIdentity, req: ArtifactRequest)
     resolve_closure: (cd, c) => evaluation_identity_fnv_bucket(evaluation: identity),
     native_compiler: g => evaluation_identity_fnv_bucket(evaluation: identity),
     universe: (tt, rb) => evaluation_identity_fnv_bucket(evaluation: identity),
-    module_verdict_bundle: s => evaluation_identity_fnv_bucket(evaluation: identity)
+    module_verdict_bundle: s => evaluation_identity_fnv_bucket(evaluation: identity),
+    compute_work: (sj, op, tc) => evaluation_identity_fnv_bucket(evaluation: identity)
   )
 }
 
@@ -613,6 +657,83 @@ fn module_verdict_bundle_judgment_contract(subject: NativeModuleVerdictBundleSub
   }
 }
 
+fn compute_work_subject_digest(subject: WorkSubject) -> Fnv1a64Structural {
+  match subject {
+    ExactTree { tree } =>
+      content_hash_tagged_structural(
+        tag: "materialization_provider.compute_work.tree",
+        payload: content_hash_atom(value: git_object_id_wire_hex(oid: tree) as NonEmptyStr)
+      )
+  }
+}
+
+// THE OPERATION'S KEY PREIMAGE IS STRUCTURAL, NOT ITS DISPLAY TEXT (ruling on gunbc#13072, item 1).
+// gunbc.compute.work_request work_operation_canonical joins fields with ':' and ',', so ["a,b"] and ["a", "b"] -- two builds with
+// different commands and outputs -- printed the same; an entry or a function containing ':' collided
+// the same way. Here every field is length-prefixed (std.judgment_contract length_prefixed_encode)
+// under the variant's own tag, and a list carries its count, so the encoding is injective over the
+// typed operation. The display text stays for documents and never reaches a key.
+fn compute_work_operation_preimage(operation: WorkOperation) -> NonEmptyStr {
+  match operation {
+    BuildGunbcBinaries { profile, bins } =>
+      join(concat(
+        [length_prefixed_encode(s: "build"), length_prefixed_encode(s: match profile { CargoRelease => "release"  CargoDebug => "debug" }), length_prefixed_encode(s: to_string(value: count(bins)))],
+        bins |> map(b => length_prefixed_encode(s: b as String))
+      ), "") as NonEmptyStr
+    CompileEntry { entry } =>
+      join([length_prefixed_encode(s: "compile"), length_prefixed_encode(s: entry as String)], "") as NonEmptyStr
+    RunClaims { entry, functions, hermetic } =>
+      join([
+        length_prefixed_encode(s: "claims"), length_prefixed_encode(s: entry as String),
+        length_prefixed_encode(s: functions as String), length_prefixed_encode(s: if hermetic { "hermetic" } else { "wet" }),
+      ], "") as NonEmptyStr
+  }
+}
+
+fn compute_work_demand_nature(operation: WorkOperation) -> DemandNature {
+  match operation {
+    BuildGunbcBinaries { profile: _, bins: _ } => IdempotentEffect
+    CompileEntry { entry: _ } => IdempotentEffect
+    RunClaims { entry: _, functions: _, hermetic } => if hermetic { IdempotentEffect } else { FreshEffect }
+  }
+}
+
+fn compute_work_judgment_contract(
+  subject: WorkSubject,
+  operation: WorkOperation,
+  toolchain: WorkToolchainIdentity
+) -> JudgmentContract {
+  JudgmentContract {
+    demand_identity: DemandIdentity {
+      kind: compute_work_artifact_kind,
+      subject: compute_work_subject_digest(subject: subject),
+      declared_inputs: [
+        DeclaredInput {
+          ref: "compute_work.operation",
+          digest: content_hash_atom(value: compute_work_operation_preimage(operation: operation))
+        },
+        DeclaredInput { ref: "compute_work.execution.rustc_verbose", digest: content_hash_atom(value: toolchain.rustc_verbose) },
+        DeclaredInput { ref: "compute_work.execution.target_triple", digest: content_hash_atom(value: toolchain.target_triple) },
+        DeclaredInput { ref: "compute_work.execution.cargo_version", digest: content_hash_atom(value: toolchain.cargo_version) },
+        DeclaredInput { ref: "compute_work.execution.cache_release", digest: content_hash_atom(value: toolchain.cache_release) },
+        DeclaredInput { ref: "compute_work.execution.provider_revision", digest: content_hash_atom(value: toolchain.provider_revision) }
+      ]
+    },
+    result: ResultContract {
+      carries_semantic_value: true,
+      ordered_diagnostics: true,
+      carries_effect_requests_receipts: false,
+      carries_refusal_arm: true,
+      required_persisted_outputs: [
+        persisted_output(id: output_compute_work_outcome, occurrence_contract: SemanticOnly),
+        persisted_output(id: output_compute_work_log, occurrence_contract: SemanticOnly),
+        persisted_output(id: output_compute_work_outputs, occurrence_contract: SemanticOnly)
+      ]
+    },
+    demand_nature: compute_work_demand_nature(operation: operation)
+  }
+}
+
 fn request_judgment_contract(req: ArtifactRequest) -> JudgmentContract {
   request_fold(
     req: req,
@@ -621,7 +742,8 @@ fn request_judgment_contract(req: ArtifactRequest) -> JudgmentContract {
     resolve_closure: resolve_closure_judgment_contract,
     native_compiler: native_compiler_judgment_contract,
     universe: universe_judgment_contract,
-    module_verdict_bundle: module_verdict_bundle_judgment_contract
+    module_verdict_bundle: module_verdict_bundle_judgment_contract,
+    compute_work: compute_work_judgment_contract
   )
 }
 
@@ -632,7 +754,8 @@ fn request_fold<T>(
   resolve_closure: fn(Fnv1a64Structural, DeclaredInput) -> T,
   native_compiler: fn(PreMaterializationIdentity) -> T,
   universe: fn(Fnv1a64Structural, DeclaredInput) -> T,
-  module_verdict_bundle: fn(NativeModuleVerdictBundleSubject) -> T
+  module_verdict_bundle: fn(NativeModuleVerdictBundleSubject) -> T,
+  compute_work: fn(WorkSubject, WorkOperation, WorkToolchainIdentity) -> T
 ) -> T {
   match req {
     ParseModuleRequest { source_digest: sd, compiler: c } => parse_module(sd, c)
@@ -642,6 +765,7 @@ fn request_fold<T>(
     NativeCompilerArtifactRequest { generation: g } => native_compiler(g)
     UniverseArtifactRequest { tested_tree_identity: tt, route_binary: rb } => universe(tt, rb)
     NativeModuleVerdictBundleRequest(subject) => module_verdict_bundle(subject)
+    ComputeWorkRequest { subject: sj, operation: op, toolchain: tc } => compute_work(sj, op, tc)
   }
 }
 
@@ -846,6 +970,12 @@ type MaterializedArtifact
       test_verdicts: ArtifactPart,
       preparation_diagnostics: ArtifactPart
     }
+  | ComputeWorkArtifact {
+      request_key: ContentHash,
+      outcome: ArtifactPart,
+      log: ArtifactPart,
+      outputs: ArtifactPart
+    }
   | LegacyIncompleteArtifact {
       kind: ArtifactKindId,
       request_key: ContentHash,
@@ -860,6 +990,7 @@ fn artifact_fold<T>(
   native_compiler: fn(ContentHash, ArtifactPart, ArtifactPart) -> T,
   universe: fn(ContentHash, ArtifactPart, ArtifactPart) -> T,
   module_verdict_bundle: fn(ContentHash, ArtifactPart, ArtifactPart) -> T,
+  compute_work: fn(ContentHash, ArtifactPart, ArtifactPart, ArtifactPart) -> T,
   legacy_incomplete: fn(ArtifactKindId, ContentHash, List<CarriedOutput>) -> T
 ) -> T {
   match artifact {
@@ -878,6 +1009,7 @@ fn artifact_fold<T>(
       universe(k, p, c)
     ModuleVerdictBundleArtifact { request_key: k, test_verdicts: v, preparation_diagnostics: d } =>
       module_verdict_bundle(k, v, d)
+    ComputeWorkArtifact { request_key: k, outcome: o, log: l, outputs: x } => compute_work(k, o, l, x)
     LegacyIncompleteArtifact { kind: kd, request_key: k, carried_outputs: cs } =>
       legacy_incomplete(kd, k, cs)
   }
@@ -892,6 +1024,7 @@ fn artifact_kind(artifact: MaterializedArtifact) -> ArtifactKindId {
     native_compiler: (k, e, d) => native_compiler_artifact_kind,
     universe: (k, p, c) => native_test_universe_artifact_kind,
     module_verdict_bundle: (k, v, d) => native_module_verdict_bundle_artifact_kind,
+    compute_work: (k, o, l, x) => compute_work_artifact_kind,
     legacy_incomplete: (kd, k, cs) => kd
   )
 }
@@ -905,6 +1038,7 @@ fn artifact_request_key(artifact: MaterializedArtifact) -> ContentHash {
     native_compiler: (k, e, d) => k,
     universe: (k, p, c) => k,
     module_verdict_bundle: (k, v, d) => k,
+    compute_work: (k, o, l, x) => k,
     legacy_incomplete: (kd, k, cs) => k
   )
 }
@@ -937,6 +1071,11 @@ fn artifact_carried_outputs(artifact: MaterializedArtifact) -> List<CarriedOutpu
       positioned_part(id: output_module_test_verdicts, part: v),
       positioned_part(id: output_module_preparation_diagnostics, part: d)
     ],
+    compute_work: (k, o, l, x) => [
+      positioned_part(id: output_compute_work_outcome, part: o),
+      positioned_part(id: output_compute_work_log, part: l),
+      positioned_part(id: output_compute_work_outputs, part: x)
+    ],
     legacy_incomplete: (kd, k, cs) => cs
   )
 }
@@ -1084,6 +1223,9 @@ fn artifact_from_manifest(m: ArtifactManifest) -> ManifestDecode {
   } else if m.kind == native_module_verdict_bundle_artifact_kind {
     manifest_two_part(m: m, first: output_module_test_verdicts, second: output_module_preparation_diagnostics,
       build: (a, b) => ModuleVerdictBundleArtifact { request_key: k, test_verdicts: a, preparation_diagnostics: b })
+  } else if m.kind == compute_work_artifact_kind {
+    manifest_three_part(m: m, first: output_compute_work_outcome, second: output_compute_work_log, third: output_compute_work_outputs,
+      build: (a, b, c) => ComputeWorkArtifact { request_key: k, outcome: a, log: b, outputs: c })
   } else {
     ManifestKindUndeclared { kind: m.kind }
   }
@@ -1256,7 +1398,7 @@ data resolved_graph_disk_format_unqualified_frontier: DissolutionCondition = unb
 )
 
 data in_process_fnv_producer_observation_frontier: DissolutionCondition = unbound_dissolution(
-  description: "A production producer must mint InProcessMaterialization at the seam that holds both the executed ArtifactRequest and the constructed artifact. Until that seam exists, in-process FNV sharing is not an admitted production route: only inhabitance claims and floor-preparation witnesses may call in_process_materialization, and a consumer must not derive the observed identity from the lookup request."
+  description: "A production producer must mint InProcessMaterialization at the seam that holds both the executed ArtifactRequest and the constructed artifact. Until that seam exists, in-process FNV sharing is not an admitted production route: only inhabitance claims may call in_process_materialization, and a consumer must not derive the observed identity from the lookup request."
 )
 
 fn in_process_materialization(
@@ -1264,9 +1406,7 @@ fn in_process_materialization(
   artifact: MaterializedArtifact,
   observed_digest: ContentHash
 ) -> ProviderProbe admit_callers: [
-  decl_ref(module_path: "test.claim.materialization_provider_witness", decl_name: "minted_in_process"),
-  decl_ref(module_path: "test.claim.floor_preparation_witness", decl_name: "probe_for"),
-  decl_ref(module_path: "test.claim.floor_preparation_witness", decl_name: "wrong_artifact_key_refuses")
+  decl_ref(module_path: "test.claim.materialization_provider_witness", decl_name: "minted_in_process")
 ] {
   InProcessProbe {
     observation: InProcessMaterialization {
diff --git a/dag/std/nat.dag b/dag/std/nat.dag
index a30d59fac1f..d38d865c2d6 100644
--- a/dag/std/nat.dag
+++ b/dag/std/nat.dag
@@ -1,7 +1,7 @@
 module std.nat
 import std.optional { Present }
 
-import std.types { List, Bool }
+import std.types { List, Bool, Int, String }
 import std.algebra { CommutativeMonoid, CommutativeSemiring, Ordering, Less, Equal, Greater }
 
 // THE NATURALS, DECLARED AS WHAT THEY ARE (operator ruling A, 2026-09-30). The carrier is the
@@ -159,3 +159,139 @@ fn nat_range_accumulate(lo: Nat, hi: Nat, acc: List<Nat>) -> List<Nat> {
     nat_range_accumulate(lo: lo + 1, hi: hi, acc: concat(acc, [lo]))
   }
 }
+
+// THE DECIMAL DIGITS OF A NATURAL, AND ITS DECIMAL TEXT. These lived in v2.std.integer, where a
+// dag module compiled into the seed could not reach them (the seed's closure does not contain
+// src/v2), so a seed-emitted module had no declared route from a Nat to its text and an
+// interpolation hole over one fell back to v1's implicit stringify (DESIGN section 4, the coercion
+// law). A natural's decimal spelling is a fact about the naturals, so it lives beside Nat, at the
+// lowest layer that needs it (DESIGN section 3: a fact's home is its layer); v2.std.integer
+// imports the digit coproduct and its tables from here rather than declaring a second copy.
+type DecimalDigit
+  = D0
+  | D1
+  | D2
+  | D3
+  | D4
+  | D5
+  | D6
+  | D7
+  | D8
+  | D9
+
+fn decimal_digit_value(d: DecimalDigit) -> Int {
+  match d {
+    D0 => 0
+    D1 => 1
+    D2 => 2
+    D3 => 3
+    D4 => 4
+    D5 => 5
+    D6 => 6
+    D7 => 7
+    D8 => 8
+    D9 => 9
+  }
+}
+
+// The Peano value of each decimal digit. Every arm is a kernel integer literal at a
+// Nat return boundary: the literal elaborates through the declared homomorphism
+// (gunbc.structural_realization_bindings literal_homomorphism_rows) to its Zero/Succ image --
+// this function is the return-position exemplar of std.literal_elaboration.
+fn decimal_digit_nat(d: DecimalDigit) -> Nat {
+  match d {
+    D0 => 0
+    D1 => 1
+    D2 => 2
+    D3 => 3
+    D4 => 4
+    D5 => 5
+    D6 => 6
+    D7 => 7
+    D8 => 8
+    D9 => 9
+  }
+}
+
+// ONE GLYPH TABLE for the ten decimal digits, keyed on the DecimalDigit coproduct; the Peano
+// rendering below and the machine-integer rendering in std.integer reach it through their own
+// digit selection rather than each carrying a second copy of the ten glyphs.
+fn decimal_digit_glyph(d: DecimalDigit) -> String {
+  match d {
+    D0 => "0"
+    D1 => "1"
+    D2 => "2"
+    D3 => "3"
+    D4 => "4"
+    D5 => "5"
+    D6 => "6"
+    D7 => "7"
+    D8 => "8"
+    D9 => "9"
+  }
+}
+
+// ONE DECIMAL STEP: the successor of a digit is the next digit, or a carry out of D9. The ten arms
+// are the whole coproduct, so no input exists that this table does not answer.
+type DecimalDigitSuccessor
+  = DecimalDigitNext { digit: DecimalDigit }
+  | DecimalDigitCarry
+
+fn decimal_digit_successor(d: DecimalDigit) -> DecimalDigitSuccessor {
+  match d {
+    D0 => DecimalDigitNext { digit: D1 }
+    D1 => DecimalDigitNext { digit: D2 }
+    D2 => DecimalDigitNext { digit: D3 }
+    D3 => DecimalDigitNext { digit: D4 }
+    D4 => DecimalDigitNext { digit: D5 }
+    D5 => DecimalDigitNext { digit: D6 }
+    D6 => DecimalDigitNext { digit: D7 }
+    D7 => DecimalDigitNext { digit: D8 }
+    D8 => DecimalDigitNext { digit: D9 }
+    D9 => DecimalDigitCarry
+  }
+}
+
+// THE UNITS DIGIT OF A NATURAL, by structural descent: Zero is D0, and Succ advances the digit,
+// carrying out of D9. The digit is a DecimalDigit by CONSTRUCTION, so no Nat-to-digit lookup exists
+// to be out of range and no default arm exists to answer it (DESIGN section 5: a failure arm must
+// refuse, never widen). The walk is linear in its argument, so it is applied only to a remainder
+// by ten (at most nine steps); nat_to_decimal_string divides by the declared operation first.
+type NatDecimalSplit {
+  quotient: Nat
+  units: DecimalDigit
+}
+
+fn nat_decimal_split(value: Nat) -> NatDecimalSplit {
+  match value {
+    Zero => NatDecimalSplit { quotient: Zero, units: D0 }
+    Succ { prev: p } =>
+      nat_decimal_split_advance(s: nat_decimal_split(value: p))
+  }
+}
+
+fn nat_decimal_split_advance(s: NatDecimalSplit) -> NatDecimalSplit {
+  match decimal_digit_successor(d: s.units) {
+    DecimalDigitNext { digit: d } => NatDecimalSplit { quotient: s.quotient, units: d }
+    DecimalDigitCarry => NatDecimalSplit { quotient: Succ { prev: s.quotient }, units: D0 }
+  }
+}
+
+// A NATURAL TO ITS DECIMAL TEXT in O(digits): division by ten is the declared
+// nat_div_rem_by_succ with divisor predecessor nine (the divisor Succ { prev: 9 } is nonzero by
+// construction, so no zero-divisor arm exists to be handled), the recursion descends on the
+// quotient, and each remainder's digit comes from nat_decimal_split, which walks at most nine steps
+// because the remainder is below ten. No host operator is applied to a Nat here: an earlier body
+// spelled `value == 0`, `value < 10`, `value / 10` and `value - (rest * 10)` on Rc<Nat>, which
+// rustc refused (E0308 x10, E0369) and which the operator realization authority now refuses at
+// emission by typed diagnostic.
+// EXACT AND LOSSLESS: the canonical decimal spelling (no leading zeros, no sign) is injective over
+// the naturals, so this is the declared conversion an interpolation hole over a Nat names.
+fn nat_to_decimal_string(value: Nat) -> String {
+  let q = nat_div_rem_by_succ(a: value, divisor_prev: 9)
+  let digit = decimal_digit_glyph(d: nat_decimal_split(value: q.remainder).units)
+  match q.quotient {
+    Zero => digit
+    Succ { prev: _ } => concat(nat_to_decimal_string(value: q.quotient), digit)
+  }
+}
diff --git a/dag/std/primitive_identity.dag b/dag/std/primitive_identity.dag
index bce53dc0e7d..ee30222642c 100644
--- a/dag/std/primitive_identity.dag
+++ b/dag/std/primitive_identity.dag
@@ -104,10 +104,10 @@ data primitive_d0_parallel_roster_surface_authority_count: Int = 2
 // primitive_d0_derived_surface_drift_audit_note. Counted: open_surface_authority_count=0. Derived
 // does not mean complete; parallel roster does not mean single-authority.
 
-// Interpreter dispatch is seven dispatch symbols in v1_interpreter
+// Interpreter dispatch is six dispatch symbols in v1_interpreter
 // (gunbc.v1_interpreter_primitive_surface): eval_builtin_inner; eval_algebra_method_inner;
 // eval_call (bridge families plus native fold intercept);
-// try_v2_std_collection_map_primitive_grounding; try_parse_table_memo_dispatch; eval_method_call
+// try_v2_std_collection_map_primitive_grounding; eval_method_call
 // lookup short-circuit; eval_service_call Filesystem.Read carve-out. Row/arm-identity/spelling
 // denominators are v1_interpreter_row_count, distinct_arm_identity_count, authored_spelling_count
 // on the roster authority — not duplicated here. primitive_interpreter_surface_rows derives from
diff --git a/dag/std/primitive_projection.dag b/dag/std/primitive_projection.dag
index 0738544fed7..dfdfb981780 100644
--- a/dag/std/primitive_projection.dag
+++ b/dag/std/primitive_projection.dag
@@ -134,7 +134,7 @@ fn primitive_projection_roster() -> List<PrimitiveProjection> {
     primitive_projection_row(primitive: primitive_lookup, module_path: "v2.std.collection", decl_name: "map_lookup", fidelity: ModeledProjection),
     primitive_projection_row(primitive: primitive_get, module_path: "v2.std.collection", decl_name: "list_at_optional", fidelity: ModeledProjection),
     primitive_projection_row(primitive: primitive_empty_map, module_path: "v2.std.collection", decl_name: "empty_map", fidelity: ModeledProjection),
-    primitive_projection_row(primitive: primitive_map_get, module_path: "v2.std.collection", decl_name: "map_get", fidelity: DivergentProjection { divergence: "declared return Outcome<Optional<V>> against the primitive's Optional<V>" as NonEmptyStr }),
+    primitive_projection_row(primitive: primitive_map_get, module_path: "v2.std.collection", decl_name: "map_get_checked", fidelity: DivergentProjection { divergence: "declared return Outcome<Optional<V>> against the primitive's Optional<V>" as NonEmptyStr }),
   ]
 }
 
diff --git a/dag/std/primitives.dag b/dag/std/primitives.dag
index 70d251b14aa..e0c5cb86ca9 100644
--- a/dag/std/primitives.dag
+++ b/dag/std/primitives.dag
@@ -409,12 +409,31 @@ data append_contract: PrimitiveContract = {
   carrier_cost: CarrierSensitive { ephemeral_work: "n + m", persistent_work: "log(n + m)" }
 }
 
+// SKIP AND TAKE ARE THE SLICE, AND ON THE PERSISTENT CARRIER THEY SHARE THE RECEIVER'S TREE. A walk
+// that reads a code-point or octet list by offset slices it as `xs |> skip(n: a) |> take(n: b - a)`;
+// when either half copied its result, each slice paid the remainder and the walk was quadratic in
+// the list (DESIGN section 6, bare minimum cost). Both realizations hold the list as an RRB vector
+// (the interpreter's Value::List, v1_rt's im::Vector), whose split is logarithmic, so the slice
+// costs log len to form and only its own length to read. That removes the quadratic remainder
+// copying; it does not make an offset walk linear, since every member read is get_contract's
+// log n on this carrier, so a walk that reads each offset is O(n log n).
+//
+// THE COUNT IS CLAMPED, AND A NEGATIVE COUNT IS THE WHOLE LIST. Both realizations take
+// k = if n < 0 then len else min(n, len): skip keeps len - k members and take keeps k.
 data skip_contract: PrimitiveContract = {
   name: "skip",
-  work: "n",
-  output_size: "max(0, len - n)",
+  work: "log len",
+  output_size: "len - k where k = if n < 0 then len else min(n, len)",
   certainty: Proven,
-  carrier_cost: CarrierInsensitive
+  carrier_cost: CarrierSensitive { ephemeral_work: "len - k where k = if n < 0 then len else min(n, len)", persistent_work: "log len" }
+}
+
+data take_contract: PrimitiveContract = {
+  name: "take",
+  work: "log len",
+  output_size: "k where k = if n < 0 then len else min(n, len)",
+  certainty: Proven,
+  carrier_cost: CarrierSensitive { ephemeral_work: "k where k = if n < 0 then len else min(n, len)", persistent_work: "log len" }
 }
 
 data zip_contract: PrimitiveContract = {
@@ -791,6 +810,7 @@ fn primitive_contract_roster() -> List<PrimitiveContract> {
     list_push_contract,
     append_contract,
     skip_contract,
+    take_contract,
     zip_contract,
     enumerate_contract,
     empty_map_contract,
diff --git a/dag/test/claim/action_use_admission_witness_test.dag b/dag/test/claim/action_use_admission_witness_test.dag
index efbd8dd6285..f7b6df44285 100644
--- a/dag/test/claim/action_use_admission_witness_test.dag
+++ b/dag/test/claim/action_use_admission_witness_test.dag
@@ -280,7 +280,7 @@ fn census_holds(c: RealizedCensus) -> Bool {
 // eval-step budget. This join is what makes the per-file claims the census: a workflow added without
 // a claim, or a claim naming a file that is gone, refuses here, by name.
 data realized_workflow_files: List<String> = [
-  "fleet-converge.yml", "fleet-desired.yml", "heal-publish.yml", "heal.yml", "instrument-dispatch.yml", "microvm-shakedown.yml", "mtcollins-canary.yml", "witnesses.yml"
+  "fleet-converge.yml", "fleet-desired.yml", "heal.yml", "instrument-dispatch.yml", "microvm-shakedown.yml", "mtcollins-canary.yml", "witnesses.yml"
 ]
 
 fn listed_workflow_files() -> List<String> {
@@ -334,10 +334,6 @@ test fn census_fleet_desired_uses_are_modeled_and_executed_exactly() -> Bool {
   census_holds(c: census_file(name: "fleet-desired.yml"))
 }
 
-test fn census_heal_publish_uses_are_modeled_and_executed_exactly() -> Bool {
-  census_holds(c: census_file(name: "heal-publish.yml"))
-}
-
 // The heal workflow carries the upload-artifact step the floor's receipts are published through.
 test fn census_heal_uses_are_modeled_and_executed_exactly() -> Bool {
   let c = census_file(name: "heal.yml")
@@ -457,7 +453,7 @@ test fn quoted_escaped_and_spaced_uses_keys_are_read_and_script_text_is_not() ->
 // exactly; refusing them would be the wrong-meaning reader this module replaced. Asserting the
 // original population also rules out the rewrite having been missed: every spelling is checked to
 // have changed the file.
-data route_rewrite_subject: String = "heal-publish.yml"
+data route_rewrite_subject: String = "heal.yml"
 
 fn route_rewrite_source() -> String {
   filesystem_read(path: join([realized_workflow_directory, "/", route_rewrite_subject], "")).content
diff --git a/dag/test/claim/actions_run_binding_witness_test.dag b/dag/test/claim/actions_run_binding_witness_test.dag
new file mode 100644
index 00000000000..687f0272280
--- /dev/null
+++ b/dag/test/claim/actions_run_binding_witness_test.dag
@@ -0,0 +1,58 @@
+module test.claim.actions_run_binding_witness
+
+import std.types { Bool, String }
+import gunbc.actions_run_binding {
+  ActionsRunBinding,
+  ExpectedRevisionPresent,
+  ExpectedRevisionAbsent,
+  ExpectedRevisionMalformed,
+  RunRevisionAdmitted,
+  RunRevisionRefused,
+  admit_optional_expected_revision_given,
+}
+
+data expected_revision_fixture_sha: String = "0123456789abcdef0123456789abcdef01234567"
+data expected_revision_other_sha: String = "89abcdef0123456789abcdef0123456789abcdef"
+
+fn expected_revision_fixture_binding() -> ActionsRunBinding {
+  ActionsRunBinding {
+    repository: "gunb-ai/gunbc",
+    workflow_ref: "gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/heads/main",
+    run_id: "1",
+    run_revision: expected_revision_fixture_sha,
+  }
+}
+
+test fn optional_expected_revision_has_three_arms() -> Bool {
+  let b = expected_revision_fixture_binding()
+  (match admit_optional_expected_revision_given(
+    read: ExpectedRevisionAbsent { variable: "RLM_EXPECTED_REVISION", detail: "unset" },
+    binding: b,
+  ) {
+    RunRevisionAdmitted { revision: r } => r == expected_revision_fixture_sha
+    RunRevisionRefused { expected: _, observed: _ } => false
+  })
+    && (match admit_optional_expected_revision_given(
+      read: ExpectedRevisionPresent { revision: expected_revision_fixture_sha },
+      binding: b,
+    ) {
+      RunRevisionAdmitted { revision: r } => r == expected_revision_fixture_sha
+      RunRevisionRefused { expected: _, observed: _ } => false
+    })
+    && (match admit_optional_expected_revision_given(
+      read: ExpectedRevisionPresent { revision: expected_revision_other_sha },
+      binding: b,
+    ) {
+      RunRevisionAdmitted { revision: _ } => false
+      RunRevisionRefused { expected: e, observed: o } =>
+        e == expected_revision_other_sha && o == expected_revision_fixture_sha
+    })
+    && (match admit_optional_expected_revision_given(
+      read: ExpectedRevisionMalformed { variable: "RLM_EXPECTED_REVISION", value: "not-a-sha" },
+      binding: b,
+    ) {
+      RunRevisionAdmitted { revision: _ } => false
+      RunRevisionRefused { expected: e, observed: o } =>
+        e == "not-a-sha" && o == expected_revision_fixture_sha
+    })
+}
diff --git a/dag/test/claim/altra_placement_witness_test.dag b/dag/test/claim/altra_placement_witness_test.dag
index 27e5a56072c..04f92e36e76 100644
--- a/dag/test/claim/altra_placement_witness_test.dag
+++ b/dag/test/claim/altra_placement_witness_test.dag
@@ -1,7 +1,7 @@
 module test.claim.altra_placement_witness
 
 import std.types { Bool, String, NonEmptyStr, List, list_length }
-import std.integer { Int }
+import std.integer { Int, int_to_decimal_string }
 import std.decl_ref { DeclarationRef, declaration_ref_eq, decl_ref }
 import std.measure { micrometer_count }
 import std.affine_space { point2 }
@@ -498,7 +498,7 @@ fn every_role_established(template: BoardPlacementPlan) -> BoardPlacementPlan {
     IndexedComponents {
       index: acc.index + 1,
       out: concat(acc.out, [PlannedComponent {
-        identity: "grid_part_{acc.index}",
+        identity: "grid_part_{int_to_decimal_string(value: acc.index)}",
         role: r,
         envelope: board_control_envelope,
         origin: point2(frame: altra_board_frame(), x: 10000 + (col * 30000), y: 10000 + (row * 30000)),
diff --git a/dag/test/claim/altra_platform_and_mt_mitchell_authority_witness_test.dag b/dag/test/claim/altra_platform_and_mt_mitchell_authority_witness_test.dag
index 3732d175cc5..b2685cf90db 100644
--- a/dag/test/claim/altra_platform_and_mt_mitchell_authority_witness_test.dag
+++ b/dag/test/claim/altra_platform_and_mt_mitchell_authority_witness_test.dag
@@ -275,13 +275,19 @@ test fn w_a_public_layout_document_would_read_as_reachable() -> Bool {
 // --- OCP Mt. Mitchell motherboard specification, revision 0.80 ---
 
 test fn w_mt_mitchell_revision_table_ends_at_the_modelled_revision() -> Bool {
-  let latest = mt_mitchell_revision_table.last()
   list_length(items: mt_mitchell_revision_table) == 3
-    && latest.revision == "0.80"
-    && latest.publication_date.year == 2022
-    && latest.publication_date.month == 9
-    && latest.publication_date.day == 9
-    && mt_mitchell_revision_table.first().revision == "0.50"
+    && match mt_mitchell_revision_table.last() {
+      Present { value: latest } =>
+        latest.revision == "0.80"
+          && latest.publication_date.year == 2022
+          && latest.publication_date.month == 9
+          && latest.publication_date.day == 9
+      Absent => false
+    }
+    && match mt_mitchell_revision_table.first() {
+      Present { value: earliest } => earliest.revision == "0.50"
+      Absent => false
+    }
 }
 
 test fn w_mt_mitchell_architecture_options_divide_into_whole_dimms_per_channel() -> Bool {
diff --git a/dag/test/claim/anonymous_record_head_use_line_witness_test.dag b/dag/test/claim/anonymous_record_head_use_line_witness_test.dag
index 73d767f874e..6b20f261bd9 100644
--- a/dag/test/claim/anonymous_record_head_use_line_witness_test.dag
+++ b/dag/test/claim/anonymous_record_head_use_line_witness_test.dag
@@ -6,7 +6,7 @@ module test.claim.anonymous_record_head_use_line_witness_test
 // never does. The authored-source attestation gate (reference_derived_candidate_authored) refused
 // exactly that candidate, no use-line was synthesized, and rustc reported E0422/E0433 on the head
 // the emitter itself wrote (live specimens: extdeps.realization.compile_stage_memo /
-// parse_table_memo `retention: {...}` rendering `ProviderRetention { .. }` with no import). This
+// parse_table_memo, since deleted with the parse memo carrier, `retention: {...}` rendering `ProviderRetention { .. }` with no import). This
 // witness reproduces the mechanism through the real emit pipeline against the minimal provider
 // fixture test.fixture.anonhead_provider (the first landing imported the real std.cache_interface
 // and paid its whole import closure, 61.7s CPU against the 1552ms floor budget, BUDGET-REFUSED on
diff --git a/dag/test/claim/auth/branch_run_grant_broker_workflow_witness_test.dag b/dag/test/claim/auth/branch_run_grant_broker_workflow_witness_test.dag
new file mode 100644
index 00000000000..abfb7f9dc66
--- /dev/null
+++ b/dag/test/claim/auth/branch_run_grant_broker_workflow_witness_test.dag
@@ -0,0 +1,48 @@
+module test.claim.branch_run_grant_broker_workflow_witness
+
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import std.types { Bool, String }
+import std.optional { Present, Absent }
+import extdeps.github.actions { PermRead, PermWrite }
+import gunbc.branch_run_grant_broker_workflow {
+  BranchRunGrantBrokerWorkflowGenerated, BranchRunGrantBrokerWorkflowGenerationRefused,
+  expected_branch_run_grant_broker_workflow_yml, branch_run_grant_broker_job, branch_run_grant_broker_job_condition,
+}
+import gunbc.fleet_converge_workflow { fleet_converge_job }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+fn broker_yml() -> String {
+  match expected_branch_run_grant_broker_workflow_yml() {
+    BranchRunGrantBrokerWorkflowGenerated { content: c } => c
+    BranchRunGrantBrokerWorkflowGenerationRefused { reason: _ } => ""
+  }
+}
+
+// THE BROKER IS MAIN'S: a workflow_run workflow, triggered when a fleet-converge run is requested, on a
+// GitHub-hosted runner, filtered to dispatched runs of this repository whose title names a run-scoped mode.
+test fn the_broker_is_triggered_by_a_requested_fleet_converge_run() -> Bool {
+  let y = broker_yml()
+  y.contains("workflow_run:")
+    && y.contains("workflows: [fleet-converge]")
+    && y.contains("types: [requested]")
+    && y.contains("runs-on: ubuntu-24.04-arm")
+    && branch_run_grant_broker_job_condition().contains("github.event.workflow_run.event == 'workflow_dispatch'")
+    && branch_run_grant_broker_job_condition().contains("contains(github.event.workflow_run.display_title, ' hetzner_cloud_server_read ')")
+    && y.contains("${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}")
+}
+
+// THE DISPATCH CREDENTIAL IS THE BROKER'S ALONE: its job writes actions and mints no OIDC token, and
+// fleet-converge's shared job -- which runs a branch's code -- only reads actions.
+test fn only_the_broker_holds_actions_write() -> Bool {
+  (match branch_run_grant_broker_job().permissions {
+    Present { value: p } =>
+      match p.actions { Present { value: PermWrite } => true  _ => false }
+        && match p.id_token { Present { value: _ } => false  Absent => true }
+    Absent => false
+  })
+    && match fleet_converge_job().permissions {
+      Present { value: p } => match p.actions { Present { value: PermRead } => true  _ => false }
+      Absent => false
+    }
+}
diff --git a/dag/test/claim/auth/branch_run_grant_witness_test.dag b/dag/test/claim/auth/branch_run_grant_witness_test.dag
new file mode 100644
index 00000000000..0c864a06d42
--- /dev/null
+++ b/dag/test/claim/auth/branch_run_grant_witness_test.dag
@@ -0,0 +1,195 @@
+module test.claim.branch_run_grant_witness
+
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import std.types { Bool, Int, List, String, Timestamp, CommitSha }
+import std.optional { Present, Absent }
+import extdeps.cloud.gcp.iam { GcpPolicy, GcpBinding, GcpIamBindingCell, IamCondition, gcp_policy_cells, gcp_cell_in }
+import extdeps.cloud.hetzner_cloud_api { HetznerTokenRead }
+import extdeps.github.github { GitHubUser, User }
+import extdeps.github.workflow_runs { WorkflowRun, WorkflowRunStatus, InProgress, Completed }
+import gunbc.auth.heal_publisher_provision { FederationClassified, impersonation_cells, standing_principal_set }
+import gunbc.auth.gcp_iam_converge {
+  AddPolicyCells, CreateServiceAccount, ServiceAccountPolicy, SecretPolicy, GcpIamApply,
+  PolicyObserved, PolicyResourceAbsent, GrantPolicyReading, plan_dedicated_federation, gcp_iam_converge_targets,
+}
+import gunbc.hetzner_cloud_acquisition { hetzner_cloud_default_read_token, hetzner_cloud_api_grants }
+import gunbc.auth.branch_dispatch_federation {
+  hetzner_cloud_control_federation, branch_dispatch_attribute_condition, branch_dispatch_attribute_mapping,
+  branch_run_impersonation_cell, branch_run_principal_set, parse_branch_run_key, mode_of_run_title, run_scoped_mode_named,
+}
+import gunbc.auth.branch_run_grant {
+  BranchRunFacts, BranchRunAdmitted, BranchRunRefused, BranchRunGrantPlanned, BranchRunGrantHeld, BranchRunGrantRefused,
+  judge_branch_run, plan_branch_run_grant, approved_grant_policy, branch_run_grant_purpose, run_scoped_federation_named,
+}
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+data fleet_converge_path: String = ".github/workflows/fleet-converge.yml"
+
+data title: String = "fleet-converge hetzner_cloud_server_read srv1 nonce="
+
+fn run_status(done: Bool) -> WorkflowRunStatus {
+  if done { Completed } else { InProgress }
+}
+
+fn a_run(id: Int, attempt: Int, path: String, event: String, done: Bool) -> WorkflowRun {
+  WorkflowRun {
+    id: id, name: Present { value: "fleet-converge" }, display_title: Present { value: title }, path: Present { value: path },
+    head_sha: "0123456789abcdef0123456789abcdef01234567" as CommitSha, head_branch: Present { value: "work/cax-onboard" },
+    event: event, status: run_status(done: done), conclusion: none,
+    workflow_id: 15, run_number: 900, run_attempt: attempt,
+    actor: none, triggering_actor: Present { value: GitHubUser { login: "operator", id: 1, type: User } },
+    html_url: "https://github.com/gunb-ai/gunbc/actions/runs/7", created_at: "2026-10-09T04:00:00Z",
+    updated_at: "2026-10-09T04:00:00Z", pull_requests: [],
+  }
+}
+
+fn facts(attempt: Int, created_at: Timestamp) -> BranchRunFacts {
+  BranchRunFacts {
+    run_id: 7, run_attempt: attempt, mode: "hetzner_cloud_server_read", branch: "work/cax-onboard",
+    head_sha: "0123456789abcdef0123456789abcdef01234567" as CommitSha, dispatched_by: "operator", created_at: created_at,
+  }
+}
+
+fn policy(cells: List<GcpIamBindingCell>, etag: String) -> GcpPolicy {
+  GcpPolicy { bindings: map(cells, c => GcpBinding { role: c.role, members: [c.member], condition: c.condition }), etag: etag, version: 3 }
+}
+
+// THE RUN-SCOPED ACCOUNT HOLDS NO STANDING WAY IN, its pool does not pin a ref, and the provider maps
+// the run AND its attempt: the facts that make one approval reach one attempt and nothing else.
+test fn the_account_has_no_standing_way_in_and_the_pool_maps_the_attempt() -> Bool {
+  let f = hetzner_cloud_control_federation()
+  impersonation_cells(f: f).length() == 0
+    && match standing_principal_set(f: f) { Present { value: _ } => false  Absent => true }
+    && !branch_dispatch_attribute_condition().contains("assertion.ref")
+    && !branch_dispatch_attribute_condition().contains("workflow_ref")
+    && branch_dispatch_attribute_condition().contains("assertion.event_name == 'workflow_dispatch'")
+    && match map_lookup(branch_dispatch_attribute_mapping, "attribute.run") { Present { value: v } => v == "assertion.run_id + '-' + assertion.run_attempt"  Absent => false }
+    && any(gcp_iam_converge_targets, t => (t.service_account as String) == (f.service_account as String))
+}
+
+// THE ACCOUNT REACHES THE READ TOKEN AND ONLY IT: a branch run's approval can never release a token
+// that writes.
+test fn the_account_holds_only_the_read_only_hetzner_token() -> Bool {
+  (match hetzner_cloud_default_read_token.permission { HetznerTokenRead => true  _ => false })
+    && hetzner_cloud_api_grants().length() == 1
+    && all(hetzner_cloud_api_grants(), g => (g.target.secret as String) == "hetzner-cloud-default-read-api-key")
+}
+
+// THE CONVERGE CREATES THE ACCOUNT AND GRANTS THE READ TOKEN, AND WRITES NOTHING ON THE ACCOUNT'S OWN
+// POLICY: no empty add, no standing cell.
+test fn the_converge_provisions_the_account_without_touching_its_policy() -> Bool {
+  let f = hetzner_cloud_control_federation()
+  match plan_dedicated_federation(
+    f: f,
+    classification: FederationClassified { create_pool: true, create_provider: true, create_account: true },
+    account_policy: PolicyResourceAbsent,
+    secret_policies: map(f.secret_grants, g => GrantPolicyReading { grant: g, reading: PolicyObserved { policy: GcpPolicy { bindings: [], etag: "s0", version: 1 } } }),
+  ) {
+    GcpIamApply { diff: d } =>
+      !any(d.effects, e => match e { AddPolicyCells { subject: ServiceAccountPolicy { email: _ }, observed_etag: _, cells: _ } => true  _ => false })
+        && any(d.effects, e => match e { AddPolicyCells { subject: SecretPolicy { secret: s }, observed_etag: _, cells: _ } => (s as String) == "hetzner-cloud-default-read-api-key"  _ => false })
+        && any(d.effects, e => match e { CreateServiceAccount { account_id: a, display_name: _ } => (a as String) == "hetzner-cloud-control"  _ => false })
+    _ => false
+  }
+}
+
+// THE CELL NAMES ONE RUN ATTEMPT AND EXPIRES; attempt 2 of the same run is a different principal.
+test fn the_cell_names_one_attempt_and_expires() -> Bool {
+  let c = branch_run_impersonation_cell(run_id: 37879231670, run_attempt: 1, expires_at: "2026-10-09T05:00:00Z")
+  c.member == branch_run_principal_set(run_id: 37879231670, run_attempt: 1)
+    && c.member.ends_with("/workloadIdentityPools/github-fleet-converge-dispatch/attribute.run/37879231670-1")
+    && c.member != branch_run_principal_set(run_id: 37879231670, run_attempt: 2)
+    && match c.condition { Present { value: k } => k.expression == "request.time < timestamp('2026-10-09T05:00:00Z')" && k.title == "gunbc-branch-run-37879231670-1"  Absent => false }
+}
+
+// ONLY A LIVE DISPATCH OF fleet-converge, AT THE ATTEMPT ASKED ABOUT, IS ADMITTED; its facts are GitHub's.
+test fn only_a_live_fleet_converge_dispatch_at_the_asked_attempt_is_admitted() -> Bool {
+  match judge_branch_run(run_id: 7, run_attempt: 1, run: a_run(id: 7, attempt: 1, path: fleet_converge_path, event: "workflow_dispatch", done: false)) {
+    BranchRunAdmitted { facts: r } => r.branch == "work/cax-onboard" && r.dispatched_by == "operator" && r.mode == "hetzner_cloud_server_read" && r.run_attempt == 1
+    BranchRunRefused { reason: _ } => false
+  }
+}
+
+fn refused(run_attempt: Int, r: WorkflowRun) -> Bool {
+  match judge_branch_run(run_id: 7, run_attempt: run_attempt, run: r) {
+    BranchRunRefused { reason: _ } => true
+    BranchRunAdmitted { facts: _ } => false
+  }
+}
+
+// RED: ANOTHER WORKFLOW, ANOTHER EVENT, A FINISHED RUN, ANOTHER ID, OR A RUN GITHUB HAS SINCE RE-RUN.
+test fn anything_but_the_live_asked_attempt_is_refused() -> Bool {
+  refused(run_attempt: 1, r: a_run(id: 7, attempt: 1, path: ".github/workflows/witnesses.yml", event: "workflow_dispatch", done: false))
+    && refused(run_attempt: 1, r: a_run(id: 7, attempt: 1, path: fleet_converge_path, event: "push", done: false))
+    && refused(run_attempt: 1, r: a_run(id: 7, attempt: 1, path: fleet_converge_path, event: "workflow_dispatch", done: true))
+    && refused(run_attempt: 1, r: a_run(id: 8, attempt: 1, path: fleet_converge_path, event: "workflow_dispatch", done: false))
+    && refused(run_attempt: 1, r: a_run(id: 7, attempt: 2, path: fleet_converge_path, event: "workflow_dispatch", done: false))
+}
+
+// RED: ATTEMPT 2 CANNOT CONSUME ATTEMPT 1'S APPROVAL. With attempt 1's cell live on the account, a
+// grant for attempt 2 is not held: it plans its own add, which needs its own approval.
+test fn a_rerun_attempt_needs_its_own_grant() -> Bool {
+  let f = hetzner_cloud_control_federation()
+  let first = branch_run_impersonation_cell(run_id: 7, run_attempt: 1, expires_at: "2026-10-09T05:00:00Z")
+  match plan_branch_run_grant(f: f, run: facts(attempt: 2, created_at: "2026-10-09T04:10:00Z"), expires_at: "2026-10-09T05:10:00Z", reading: PolicyObserved { policy: policy(cells: [first], etag: "e1") }) {
+    BranchRunGrantPlanned { grant: g } => g.cell.member != first.member && g.pruned.length() == 0
+    _ => false
+  }
+}
+
+// THE GRANT ADDS ONE CELL, REMOVES THE LAPSED ONES, KEEPS THE LIVE ONES AND EVERY FOREIGN BINDING, and
+// the apply writes exactly that against the approved etag.
+test fn the_grant_prunes_lapsed_cells_and_preserves_the_rest() -> Bool {
+  let f = hetzner_cloud_control_federation()
+  let lapsed = branch_run_impersonation_cell(run_id: 5, run_attempt: 1, expires_at: "2026-10-09T03:00:00Z")
+  let live = branch_run_impersonation_cell(run_id: 6, run_attempt: 1, expires_at: "2026-10-09T04:30:00Z")
+  let foreign = GcpIamBindingCell { role: "roles/iam.serviceAccountTokenCreator", member: "user:operator@example.com", condition: none }
+  let observed = policy(cells: [lapsed, live, foreign], etag: "e1")
+  match plan_branch_run_grant(f: f, run: facts(attempt: 1, created_at: "2026-10-09T04:00:00Z"), expires_at: "2026-10-09T05:00:00Z", reading: PolicyObserved { policy: observed }) {
+    BranchRunGrantPlanned { grant: g } =>
+      g.observed_etag == "e1" && g.pruned.length() == 1 && gcp_cell_in(c: lapsed, xs: g.pruned)
+        && (branch_run_grant_purpose(g: g) as String).contains("attempt 1 of fleet-converge (mode hetzner_cloud_server_read) on work/cax-onboard")
+        && match approved_grant_policy(g: g, reading: PolicyObserved { policy: observed }) {
+          Present { value: next } => {
+            let cells = gcp_policy_cells(p: next)
+            gcp_cell_in(c: g.cell, xs: cells) && gcp_cell_in(c: live, xs: cells) && gcp_cell_in(c: foreign, xs: cells) && !gcp_cell_in(c: lapsed, xs: cells)
+          }
+          Absent => false
+        }
+        && match approved_grant_policy(g: g, reading: PolicyObserved { policy: policy(cells: [lapsed, live, foreign], etag: "e2") }) { Present { value: _ } => false  Absent => true }
+    _ => false
+  }
+}
+
+// THE RUN'S CELL ALREADY PRESENT HOLDS; AN OWNED CELL WHOSE EXPIRY THIS MODULE DID NOT WRITE REFUSES.
+test fn a_present_cell_holds_and_an_unjudgeable_owned_cell_refuses() -> Bool {
+  let f = hetzner_cloud_control_federation()
+  let mine = branch_run_impersonation_cell(run_id: 7, run_attempt: 1, expires_at: "2026-10-09T05:00:00Z")
+  let odd = GcpIamBindingCell { role: mine.role, member: "principalSet://x", condition: Present { value: IamCondition { title: "gunbc-branch-run-9-1", description: none, expression: "true" } } }
+  (match plan_branch_run_grant(f: f, run: facts(attempt: 1, created_at: "2026-10-09T04:00:00Z"), expires_at: "2026-10-09T05:00:00Z", reading: PolicyObserved { policy: policy(cells: [mine], etag: "e1") }) {
+    BranchRunGrantHeld { run: _ } => true
+    _ => false
+  })
+    && match plan_branch_run_grant(f: f, run: facts(attempt: 1, created_at: "2026-10-09T04:00:00Z"), expires_at: "2026-10-09T05:00:00Z", reading: PolicyObserved { policy: policy(cells: [odd], etag: "e1") }) {
+      BranchRunGrantRefused { reason: _ } => true
+      _ => false
+    }
+}
+
+// MAIN'S TABLE DECIDES THE ACCOUNT: the read mode maps to hetzner-cloud-control, anything else to nothing.
+test fn only_a_declared_mode_reaches_a_declared_account() -> Bool {
+  mode_of_run_title(title: title) == "hetzner_cloud_server_read"
+    && match run_scoped_mode_named(mode: "hetzner_cloud_server_read") { Present { value: m } => (m.account_id as String) == "hetzner-cloud-control"  Absent => false }
+    && match run_scoped_mode_named(mode: "apply") { Present { value: _ } => false  Absent => true }
+    && match run_scoped_federation_named(account_id: "fleet-cloud-convergence") { Present { value: _ } => false  Absent => true }
+}
+
+// THE KEY IS EXACTLY <run id>-<run attempt>, both positive.
+test fn the_run_key_parses_only_its_own_shape() -> Bool {
+  match parse_branch_run_key(key: "37879231670-2") { Present { value: k } => k.run_id == 37879231670 && k.run_attempt == 2  Absent => false }
+    && match parse_branch_run_key(key: "37879231670") { Present { value: _ } => false  Absent => true }
+    && match parse_branch_run_key(key: "a-1") { Present { value: _ } => false  Absent => true }
+    && match parse_branch_run_key(key: "7-0") { Present { value: _ } => false  Absent => true }
+    && match parse_branch_run_key(key: "7-1-2") { Present { value: _ } => false  Absent => true }
+}
diff --git a/dag/test/claim/auth/github_deployment_environment_witness_test.dag b/dag/test/claim/auth/github_deployment_environment_witness_test.dag
new file mode 100644
index 00000000000..22968280d83
--- /dev/null
+++ b/dag/test/claim/auth/github_deployment_environment_witness_test.dag
@@ -0,0 +1,47 @@
+module test.claim.auth.github_deployment_environment_witness
+
+import std.types { Bool, String }
+import extdeps.github.deployment_environments {
+  GitHubEnvironmentProtectionSettings, SelectedBranchesAndTags, DeploymentBranchPolicyRule, PolicyRefBranch, PolicyRefTag, RequiredReviewers,
+}
+import gunbc.auth.github_deployment_environment {
+  srv1_production_required_protection_is_the_boundary,
+  environment_protection_restricts_to_main,
+  srv1_production_protection_standing,
+  EnvironmentProtectionUnobserved,
+  EnvironmentProtectionHolds,
+  EnvironmentProtectionDiverges,
+}
+
+test fn srv1_production_required_protection_names_main_and_reviewers() -> Bool {
+  srv1_production_required_protection_is_the_boundary()
+}
+
+test fn srv1_production_protection_is_unobserved_until_read_back() -> Bool {
+  match srv1_production_protection_standing {
+    EnvironmentProtectionUnobserved { required: _, read_obligation: r } =>
+      string_contains(s: r, pattern: "environments/srv1-production")
+    EnvironmentProtectionHolds { required: _ } => false
+    EnvironmentProtectionDiverges { required: _, detail: _ } => false
+  }
+}
+
+// CONTROL over a supplied setting: a TAG rule named main is not the main-branch boundary, and two
+// rules are not "main only"; the real row above is the inhabitance of the accepting shape.
+test fn a_tag_rule_or_a_second_rule_is_not_the_main_branch_boundary() -> Bool {
+  !environment_protection_restricts_to_main(settings: GitHubEnvironmentProtectionSettings {
+      name: "srv1-production",
+      deployment_branch_policy: SelectedBranchesAndTags { rules: [DeploymentBranchPolicyRule { name: "main", ref_type: PolicyRefTag }] },
+      reviewer_requirement: RequiredReviewers,
+    })
+    && !environment_protection_restricts_to_main(settings: GitHubEnvironmentProtectionSettings {
+      name: "srv1-production",
+      deployment_branch_policy: SelectedBranchesAndTags { rules: [DeploymentBranchPolicyRule { name: "main", ref_type: PolicyRefBranch }, DeploymentBranchPolicyRule { name: "release", ref_type: PolicyRefBranch }] },
+      reviewer_requirement: RequiredReviewers,
+    })
+    && environment_protection_restricts_to_main(settings: GitHubEnvironmentProtectionSettings {
+      name: "srv1-production",
+      deployment_branch_policy: SelectedBranchesAndTags { rules: [DeploymentBranchPolicyRule { name: "main", ref_type: PolicyRefBranch }] },
+      reviewer_requirement: RequiredReviewers,
+    })
+}
diff --git a/dag/test/claim/auth/managed_host_boot_federation_witness_test.dag b/dag/test/claim/auth/managed_host_boot_federation_witness_test.dag
index 80a0252d3ed..79514249cd2 100644
--- a/dag/test/claim/auth/managed_host_boot_federation_witness_test.dag
+++ b/dag/test/claim/auth/managed_host_boot_federation_witness_test.dag
@@ -1,14 +1,15 @@
 module test.claim.managed_host_boot_federation_witness
 
-import std.types { Bool, List, NonEmptyStr, String }
+import std.types { Bool, String }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import std.optional { Present, Absent }
 import gunbc.fleet_host_identity { operator_host_mtcollins1, operator_host_srv1 }
 import gunbc.managed_host { managed_host_fixture, managed_hosts }
-import gunbc.auth.oidc_claim_pins { OidcClaimPin }
+import gunbc.auth.oidc_claim_pins { presented_from_pins, with_presented_value, without_presented_claim }
 import gunbc.auth.gcp_secret_access { SecretAccessGrant }
 import gunbc.auth.managed_host_boot_federation {
-  ManagedHostBootFederation, ManagedHostBootFederationStanding, BootFederationProvisioned, BootFederationUnprovisioned,
+  ManagedHostBootFederation, ManagedHostBootFederationStanding, BootFederationProvisioned,
+  BootFederationProvisionedUnderDeclaredDrop, BootFederationUnprovisioned,
   BootFederationHostNotManaged, BootFederationHostUnbound, BootFederationNoPolicy,
   admit_boot_federation, boot_federation_for, provisioned_boot_federations,
   boot_federation_claims_admitted, boot_federation_attribute_condition, boot_federation_principal_set,
@@ -21,6 +22,8 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 fn admitted(s: ManagedHostBootFederationStanding) -> ManagedHostBootFederation? {
   match s {
     BootFederationProvisioned { federation: f } => Present { value: f }
+    BootFederationProvisionedUnderDeclaredDrop { federation: f, drop: _, standing_subject: _, current_subject: _ } =>
+      Present { value: f }
     BootFederationUnprovisioned { host: _, cause: _ } => none
   }
 }
@@ -49,30 +52,25 @@ test fn w_mtcollins1_is_the_one_provisioned_pair_under_its_live_names() -> Bool
     }
 }
 
-// ── The federation: only this workflow, at main, dispatched, in the boot environment ───────────
-fn with_claim(claims: List<OidcClaimPin>, claim: NonEmptyStr, value: String) -> List<OidcClaimPin> {
-  concat(filter(claims, c => (c.claim as String) != (claim as String)), [OidcClaimPin { claim: claim, value: value }])
-}
-
-fn without_claim(claims: List<OidcClaimPin>, claim: NonEmptyStr) -> List<OidcClaimPin> {
-  filter(claims, c => (c.claim as String) != (claim as String))
-}
+// ── The federation: only this workflow, at reviewed main, dispatched, in the boot environment ────
 
-// THE CONTROL: the boot job's own token is admitted. THE REDS: another workflow file, another ref,
-// a pull_request event, another environment, and a job with no environment (every other job in
-// fleet-converge.yml) are each refused -- one claim changed at a time, so each red is attributable.
+// THE CONTROL: the boot job's own token at reviewed main is admitted. THE REDS: a session-branch
+// dispatch, another workflow file, a tag ref, a pull_request event, another environment, and a job
+// with no environment (every other job in fleet-converge.yml) are each refused -- one claim changed
+// at a time, so each red is attributable.
 test fn only_the_boot_jobs_oidc_subject_is_admitted_to_the_dedicated_pool() -> Bool {
   match mtcollins1_federation() {
     Absent => false
     Present { value: f } => {
-    let c = f.claim_pins
+    let c = presented_from_pins(pins: f.claim_pins)
     boot_federation_claims_admitted(f: f, claims: c)
-      && !boot_federation_claims_admitted(f: f, claims: with_claim(claims: c, claim: "workflow_ref", value: "gunb-ai/gunbc/.github/workflows/witnesses.yml@refs/heads/main"))
-      && !boot_federation_claims_admitted(f: f, claims: with_claim(claims: c, claim: "ref", value: "refs/heads/feature"))
-      && !boot_federation_claims_admitted(f: f, claims: with_claim(claims: c, claim: "workflow_ref", value: "gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/heads/feature"))
-      && !boot_federation_claims_admitted(f: f, claims: with_claim(claims: c, claim: "event_name", value: "pull_request"))
-      && !boot_federation_claims_admitted(f: f, claims: with_claim(claims: c, claim: "environment", value: "production"))
-      && !boot_federation_claims_admitted(f: f, claims: without_claim(claims: c, claim: "environment"))
+      && !boot_federation_claims_admitted(f: f, claims: with_presented_value(claims: c, claim: "workflow_ref", value: "gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/heads/feature"))
+      && !boot_federation_claims_admitted(f: f, claims: with_presented_value(claims: c, claim: "ref", value: "refs/heads/feature"))
+      && !boot_federation_claims_admitted(f: f, claims: with_presented_value(claims: c, claim: "workflow_ref", value: "gunb-ai/gunbc/.github/workflows/witnesses.yml@refs/heads/main"))
+      && !boot_federation_claims_admitted(f: f, claims: with_presented_value(claims: c, claim: "workflow_ref", value: "gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/tags/x"))
+      && !boot_federation_claims_admitted(f: f, claims: with_presented_value(claims: c, claim: "event_name", value: "pull_request"))
+      && !boot_federation_claims_admitted(f: f, claims: with_presented_value(claims: c, claim: "environment", value: "production"))
+      && !boot_federation_claims_admitted(f: f, claims: without_presented_claim(claims: c, claim: "environment"))
   }
   }
 }
@@ -84,8 +82,10 @@ test fn the_provider_condition_carries_every_pin() -> Bool {
     Absent => false
     Present { value: f } => {
     let cond = boot_federation_attribute_condition(f: f)
-    all(f.claim_pins, p => string_contains(s: cond, pattern: join(["assertion.", p.claim as String, " == '", p.value, "'"], "")))
+    all(f.claim_pins, p => string_contains(s: cond, pattern: join(["assertion.", p.claim as String], "")))
       && string_contains(s: cond, pattern: "fleet-converge.yml@refs/heads/main")
+      && string_contains(s: cond, pattern: "assertion.workflow_ref == '")
+      && !string_contains(s: cond, pattern: ".startsWith('")
       && string_contains(s: cond, pattern: "assertion.environment == 'mtcollins1-boot'")
   }
   }
@@ -138,6 +138,7 @@ test fn w_a_bound_host_with_no_boot_policy_is_unprovisioned() -> Bool {
         BootFederationHostUnbound { standing: _ } => false
       }
       BootFederationProvisioned { federation: _ } => false
+      BootFederationProvisionedUnderDeclaredDrop { federation: _, drop: _, standing_subject: _, current_subject: _ } => false
     }
   }) && (managed_hosts() |> count) == 1
 }
@@ -152,5 +153,6 @@ test fn w_a_host_that_is_not_managed_is_unprovisioned() -> Bool {
       BootFederationHostUnbound { standing: _ } => false
     }
     BootFederationProvisioned { federation: _ } => false
+    BootFederationProvisionedUnderDeclaredDrop { federation: _, drop: _, standing_subject: _, current_subject: _ } => false
   }
 }
diff --git a/dag/test/claim/auth/standing_operator_grant_mtjade1_witness_test.dag b/dag/test/claim/auth/standing_operator_grant_mtjade1_witness_test.dag
index e826abf47a3..e381605a947 100644
--- a/dag/test/claim/auth/standing_operator_grant_mtjade1_witness_test.dag
+++ b/dag/test/claim/auth/standing_operator_grant_mtjade1_witness_test.dag
@@ -6,14 +6,16 @@ import std.optional { Present, Absent }
 import product.host_identity { HostIdentity, host_identity_eq }
 import gunbc.fleet_host_identity {
   operator_host_mtcollins1, operator_host_mtjade1,
-  operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8,
+  operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12,
 }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB, fabric_group_hosts }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB, fabric_group_hosts }
 import gunbc.auth.standing_operator_grant {
-  group_a_dev_standing_grant, mtjade1_live_standing_grant,
+  StandingOperatorGrant, mtjade1_live_standing_grant,
   standing_grant_covers, standing_grant_scope_matches, standing_grant_hosts,
   StandingGrantFabricGroup, StandingGrantHost,
   StandingD0ReleaseToFleet, StandingArmLaunch, StandingHostEffectRecover,
+  StandingJadeArrivalArchive, StandingJadeFirmwareQualification, StandingBmcSecureAccountWrite,
+  standing_grant_arm_interlock,
 }
 import gunbc.auth.authorization_pattern_selection {
   PrivilegedEffect, ApiSurface,
@@ -22,7 +24,7 @@ import gunbc.auth.authorization_pattern_selection {
   IrreversibleEffect,
   NoBillingConsequence,
   WitnessDischarge, NoWitnessDischarge, StandingRulingUnderInterlock, StandingDestructiveAuthorization,
-  InterlockPending, UnconditionalStanding, InterlockedBy,
+  InterlockPending, InterlockedBy,
   FederatedScopedGrant, OperatorApprovedCapability,
   PatternSelected, NoAdmissiblePattern,
   AuthorizationPatternSelection,
@@ -34,8 +36,26 @@ import gunbc.auth.privileged_effect_census {
 import std.decl_ref { decl_ref }
 import std.human_intervention { DeviceOnce, EveryProvision }
 
-fn group_a_hosts() -> List<HostIdentity> {
-  [operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8]
+fn group_b_hosts() -> List<HostIdentity> {
+  [operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12]
+}
+
+// A FABRIC-GROUP GRANT, SUPPLIED. The production Group A grant was deleted with the group (2026-10-07), and
+// no other fabric-group grant exists; the scope arm is exercised over this fixture so the group branch of
+// standing_grant_covers keeps its discriminating red beside the host branch the mtjade1 grant exercises.
+fn w_fabric_group_grant() -> StandingOperatorGrant {
+  StandingOperatorGrant {
+    identity: "w-fabric-group-grant" as NonEmptyStr,
+    principal: "operator" as NonEmptyStr,
+    ruled_at: "2026-10-07T00:00:00Z",
+    ruling: StandingDestructiveAuthorization {
+      ruling_text: "fixture" as NonEmptyStr,
+      effect_subject: "fixture fabric-group effects" as NonEmptyStr,
+      interlock: InterlockPending { obligation: "fixture" as NonEmptyStr },
+    },
+    scope: StandingGrantFabricGroup { group: FabricGroupB {}, hosts: group_b_hosts() },
+    effects: [StandingD0ReleaseToFleet, StandingArmLaunch, StandingHostEffectRecover],
+  }
 }
 
 fn selected_federated(s: AuthorizationPatternSelection) -> Bool {
@@ -104,25 +124,30 @@ fn mtjade1_megarac_qualification_effect(discharge: WitnessDischarge) -> Privileg
 
 data mtjade1_discharge: WitnessDischarge = StandingRulingUnderInterlock { ruling: mtjade1_live_standing_grant.ruling }
 
-test fn w_group_a_coverage_is_unchanged() -> Bool {
-  standing_grant_scope_matches(g: group_a_dev_standing_grant, scope: StandingGrantFabricGroup { group: FabricGroupA, hosts: group_a_hosts() })
-    && standing_grant_covers(g: group_a_dev_standing_grant, scope: StandingGrantFabricGroup { group: FabricGroupA, hosts: group_a_hosts() }, effect: StandingD0ReleaseToFleet)
-    && standing_grant_covers(g: group_a_dev_standing_grant, scope: StandingGrantFabricGroup { group: FabricGroupA, hosts: group_a_hosts() }, effect: StandingArmLaunch)
-    && standing_grant_covers(g: group_a_dev_standing_grant, scope: StandingGrantFabricGroup { group: FabricGroupA, hosts: [operator_host_srv7] }, effect: StandingHostEffectRecover)
-    && !standing_grant_covers(g: group_a_dev_standing_grant, scope: StandingGrantFabricGroup { group: FabricGroupA, hosts: [] as List<HostIdentity> }, effect: StandingArmLaunch)
-    && !standing_grant_covers(g: group_a_dev_standing_grant, scope: StandingGrantFabricGroup { group: FabricGroupB, hosts: fabric_group_hosts(g: FabricGroupB) }, effect: StandingD0ReleaseToFleet)
-    && !standing_grant_covers(g: group_a_dev_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingD0ReleaseToFleet)
-    && !standing_grant_scope_matches(g: group_a_dev_standing_grant, scope: StandingGrantHost { host: operator_host_srv5 })
+test fn w_a_fabric_group_grant_covers_exactly_its_hosts_and_effects() -> Bool {
+  let g = w_fabric_group_grant()
+  standing_grant_scope_matches(g: g, scope: StandingGrantFabricGroup { group: FabricGroupB {}, hosts: group_b_hosts() })
+    && standing_grant_covers(g: g, scope: StandingGrantFabricGroup { group: FabricGroupB {}, hosts: group_b_hosts() }, effect: StandingD0ReleaseToFleet)
+    && standing_grant_covers(g: g, scope: StandingGrantFabricGroup { group: FabricGroupB {}, hosts: group_b_hosts() }, effect: StandingArmLaunch)
+    && standing_grant_covers(g: g, scope: StandingGrantFabricGroup { group: FabricGroupB {}, hosts: [operator_host_srv11] }, effect: StandingHostEffectRecover)
+    && !standing_grant_covers(g: g, scope: StandingGrantFabricGroup { group: FabricGroupB {}, hosts: [] as List<HostIdentity> }, effect: StandingArmLaunch)
+    && !standing_grant_covers(g: g, scope: StandingGrantFabricGroup { group: FabricGroupB {}, hosts: [operator_host_mtjade1] }, effect: StandingArmLaunch)
+    && !standing_grant_covers(g: g, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingD0ReleaseToFleet)
+    && !standing_grant_scope_matches(g: g, scope: StandingGrantHost { host: operator_host_srv9 })
 }
 
 test fn w_mtcollins1_is_not_covered() -> Bool {
   !standing_grant_scope_matches(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtcollins1 })
     && !standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtcollins1 }, effect: StandingD0ReleaseToFleet)
-    && !standing_grant_scope_matches(g: group_a_dev_standing_grant, scope: StandingGrantHost { host: operator_host_mtcollins1 })
+    && !standing_grant_scope_matches(g: w_fabric_group_grant(), scope: StandingGrantHost { host: operator_host_mtcollins1 })
 }
 
 test fn w_an_effect_outside_the_mtjade1_arms_is_not_covered() -> Bool {
   standing_grant_scope_matches(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 })
+    && standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingJadeArrivalArchive)
+    && standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingJadeFirmwareQualification)
+    && standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingBmcSecureAccountWrite)
+    && !standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtcollins1 }, effect: StandingBmcSecureAccountWrite)
     && !standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingD0ReleaseToFleet)
     && !standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingArmLaunch)
     && !standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingHostEffectRecover)
@@ -139,9 +164,18 @@ test fn w_the_ruling_text_is_the_operator_quote() -> Bool {
     && match mtjade1_live_standing_grant.ruling.interlock {
       InterlockPending { obligation: _ } => true
       InterlockedBy { hold: _ } => false
-      UnconditionalStanding { reason: _ } => false
     }
     && !standing_ruling_discharges_irreversibility(r: mtjade1_live_standing_grant.ruling)
+    && match standing_grant_arm_interlock(g: mtjade1_live_standing_grant, e: StandingBmcSecureAccountWrite) {
+      InterlockedBy { hold: h } =>
+        (h.module_path as String) == "gunbc.machine_intake_bmc_rotation_route"
+          && (h.decl_name as String) == "admit_rotation_apply"
+      InterlockPending { obligation: _ } => false
+    }
+    && match standing_grant_arm_interlock(g: mtjade1_live_standing_grant, e: StandingJadeFirmwareQualification) {
+      InterlockPending { obligation: _ } => true
+      InterlockedBy { hold: _ } => false
+    }
 }
 
 test fn w_the_selection_fold_over_true_mtjade1_session_attributes() -> Bool {
@@ -162,6 +196,12 @@ test fn w_the_selection_fold_over_true_mtjade1_session_attributes() -> Bool {
     && !selected_federated(s: fw_ruled)
 }
 
+test fn w_operator_ssh_bmc_write_still_selects_operator_approved_capability() -> Bool {
+  selected_approved(s: select_authorization_pattern(e: mtjade1_credential_write_effect(discharge: mtjade1_discharge)))
+    && selected_approved(s: select_authorization_pattern(e: mtjade1_credential_write_effect(discharge: NoWitnessDischarge)))
+    && !selected_federated(s: select_authorization_pattern(e: mtjade1_credential_write_effect(discharge: mtjade1_discharge)))
+}
+
 fn mtjade1_bindable_identity() -> WorkloadIdentityStanding {
   WorkloadIdentityBindable { member: "ghrunner on srv1, the dispatched fleet-converge run's host principal on the placed fabric DB host" as NonEmptyStr }
 }
@@ -179,16 +219,24 @@ fn mtjade1_bindable_boot_effect(discharge: WitnessDischarge) -> PrivilegedEffect
   }
 }
 
+fn mtjade1_pending_ruling() -> StandingDestructiveAuthorization {
+  StandingDestructiveAuthorization {
+    ruling_text: mtjade1_live_standing_grant.ruling.ruling_text,
+    effect_subject: mtjade1_live_standing_grant.ruling.effect_subject,
+    interlock: InterlockPending { obligation: "hold not named" as NonEmptyStr },
+  }
+}
+
 fn mtjade1_interlocked_ruling() -> StandingDestructiveAuthorization {
   StandingDestructiveAuthorization {
     ruling_text: mtjade1_live_standing_grant.ruling.ruling_text,
     effect_subject: mtjade1_live_standing_grant.ruling.effect_subject,
-    interlock: InterlockedBy { hold: decl_ref(module_path: "gunbc.spark.pair_serving_d0", decl_name: "d0_claim_grant") },
+    interlock: InterlockedBy { hold: decl_ref(module_path: "gunbc.managed_host_unit_hold", decl_name: "UnitHoldProof") },
   }
 }
 
 test fn w_bindable_boot_pending_interlock_refuses() -> Bool {
-  let pending = select_authorization_pattern(e: mtjade1_bindable_boot_effect(discharge: mtjade1_discharge))
+  let pending = select_authorization_pattern(e: mtjade1_bindable_boot_effect(discharge: StandingRulingUnderInterlock { ruling: mtjade1_pending_ruling() }))
   no_admissible(s: pending) && !selected_federated(s: pending)
 }
 
@@ -197,7 +245,7 @@ test fn w_bindable_boot_interlocked_selects_federation() -> Bool {
 }
 
 test fn w_census_pending_interlock_is_a_defect() -> Bool {
-  match ruling_discharge_interlock_defect(site_ref: decl_ref(module_path: "gunbc.auth.standing_operator_grant", decl_name: "mtjade1_live_standing_grant"), ruling: mtjade1_live_standing_grant.ruling) {
+  match ruling_discharge_interlock_defect(site_ref: decl_ref(module_path: "gunbc.auth.standing_operator_grant", decl_name: "mtjade1_live_standing_grant"), ruling: mtjade1_pending_ruling()) {
     Present { value: _ } => true
     Absent => false
   }
diff --git a/dag/test/claim/authorization_pattern_selection_witness_test.dag b/dag/test/claim/authorization_pattern_selection_witness_test.dag
index 6697a259935..e3dfcff942c 100644
--- a/dag/test/claim/authorization_pattern_selection_witness_test.dag
+++ b/dag/test/claim/authorization_pattern_selection_witness_test.dag
@@ -10,11 +10,12 @@ import gunbc.auth.authorization_pattern_selection {
   MintsNoCredential, MintsResourceScopedCredential, MintsAccountWideCredential,
   ReversibleByReapply, IrreversibleEffect,
   BillsExternally, NoBillingConsequence,
-  NoWitnessDischarge,
-  FederatedScopedGrant, OperatorApprovedCapability, HumanOnlyStep, OperatorOwnSession, PastedOperatorToken,
+  NoWitnessDischarge, StandingRulingUnderInterlock, WitnessDischarge,
+  FederatedScopedGrant, OperatorApprovedCapability, HumanOnlyStep, OperatorOwnSession,
   PatternSelected, ManualStepRequired, NoAdmissiblePattern,
   PatternSelectionNeedsEvidence, PatternSelectionNeedsPolicy, PatternSelectionRefused,
   AuthorizationPatternSelection,
+  InterlockPending, InterlockedBy,
   select_authorization_pattern, witness_required,
 }
 import gunbc.auth.privileged_effect_census {
@@ -22,15 +23,17 @@ import gunbc.auth.privileged_effect_census {
   unrostered_unreasoned_divergences, rostered_but_not_diverging, follow_up_sites,
   reasoned_divergences, reasoned_divergences_with_fired_triggers,
   site_verdict, Conforms, DivergesWithReason, Diverges, SiteNotDecidable,
-  mtcollins1_boot_effect, privileged_effect_interlocks, interlocked_sites_missing_from_census, rulings_without_a_rostered_interlock,
+  mtcollins1_boot_effect, privileged_effect_interlocks, privileged_effect_interlock_hold, interlocked_sites_missing_from_census, rulings_without_a_rostered_interlock,
   ruling_roots_missing_from_census, census_sites_outside_ruling_roots,
+  runner_lifecycle_scope_ruling, runner_lifecycle_operator_ruling, OperatorScopeRuling, ruling_discharge_for,
+  mtcollins1_operator_ruling,
   RealizedFederatedGrant, RealizedRunSelected, RealizedApprovalCapability, RealizedHumanStep, RealizedOperatorSession, RealizedUnauthorized,
 }
 import std.human_intervention {
   HumanIntervention, HumanInterventionIdentity, FleetOnce, DeviceOnce, EveryProvision, BreakGlassOnly,
   NoDischargeSiteModeled,
 }
-import std.decl_ref { declaration_ref_eq, declaration_ref_display_key }
+import std.decl_ref { decl_ref, declaration_ref_eq, declaration_ref_display_key }
 import std.types { NonEmptyStr, String, Int, List }
 import std.logic { Bool }
 
@@ -136,8 +139,8 @@ test fn an_irreversible_one_off_is_operator_approved_not_federated() -> Bool {
   selected_approved(s: s) && !selected_federated(s: s)
 }
 
-// (b) A one-off grant the workload may not perform is approved -- this is what replaces the
-// operator's pasted token for the accessor-cell converges.
+// (b) A one-off grant the workload may not perform is approved -- the accessor-cell converges
+// select this over the operator's own token.
 test fn an_unbindable_one_off_grant_is_operator_approved() -> Bool {
   selected_approved(s: select_authorization_pattern(e: one_off_grant_unbindable()))
 }
@@ -150,13 +153,12 @@ test fn a_dashboard_only_effect_names_its_manual_step() -> Bool {
   }
 }
 
-// THE PASTED TOKEN IS NEVER SELECTED, and neither is the operator's own session: across every
-// fixture the selected pattern is one of the three admissible ones.
+// THE OPERATOR'S OWN SESSION IS NEVER SELECTED: it is always dominated, so across every fixture
+// the selected pattern is one of the three others.
 fn selection_is_admissible(s: AuthorizationPatternSelection) -> Bool {
   match s {
     PatternSelected { pattern: p, receipt: _ } =>
       match p {
-        PastedOperatorToken => false
         OperatorOwnSession => false
         FederatedScopedGrant => true
         OperatorApprovedCapability => true
@@ -170,7 +172,7 @@ fn selection_is_admissible(s: AuthorizationPatternSelection) -> Bool {
   }
 }
 
-test fn no_fixture_selects_a_pasted_token_or_an_operator_session() -> Bool {
+test fn no_fixture_selects_an_operator_session() -> Bool {
   all([recurring_read(), one_off_irreversible_mint(), one_off_grant_unbindable(), dashboard_only(), recurring_but_witnessed()],
     e => selection_is_admissible(s: select_authorization_pattern(e: e)))
 }
@@ -222,25 +224,6 @@ fn fabric_writer_verdict(key: String, want_approval: Bool) -> Bool {
       })
 }
 
-test fn the_d0_door_selects_operator_approval_and_states_the_unverified_store() -> Bool {
-  fabric_writer_verdict(key: "gunbc.spark.pair_serving_d0_door::pair_serving_d0_ci_wet", want_approval: true)
-}
-
-// THE D0 RELEASE UNDER THE GROUP A STANDING GRANT IS CLASSIFIED BY THE SELECTION, NOT ASSERTED (review
-// 74624): with the ruling as its witness discharge the one-off irreversible release selects the run's
-// scoped identity, and it diverges with the fabric store's stated reason like every writer of that
-// store. The mutation is the ruling: strip it and the same effect does NOT select federation.
-test fn the_d0_release_under_the_standing_grant_is_classified_by_the_selection() -> Bool {
-  fabric_writer_verdict(key: "gunbc.spark.pair_serving_d0_door::d0_standing_grant_for", want_approval: false)
-    && any(privileged_effect_census, row =>
-      declaration_ref_display_key(ref: row.site) == "gunbc.spark.pair_serving_d0_door::d0_standing_grant_for"
-        && !selected_federated(s: select_authorization_pattern(e: PrivilegedEffect {
-          subject: row.effect.subject, frequency: row.effect.frequency, reversibility: row.effect.reversibility,
-          surface: row.effect.surface, workload_identity: row.effect.workload_identity,
-          minted_reach: row.effect.minted_reach, billing: row.effect.billing, witness_discharge: NoWitnessDischarge,
-        })))
-}
-
 test fn the_host_effect_lanes_select_workload_identity_and_state_the_unverified_store() -> Bool {
   fabric_writer_verdict(key: "gunbc.spark.host_commitment::claim_host_effect_live", want_approval: false)
     && fabric_writer_verdict(key: "gunbc.spark.host_commitment::settle_host_effect_live_over", want_approval: false)
@@ -363,7 +346,23 @@ test fn a_standing_ruling_does_not_discharge_a_wide_credential() -> Bool {
 
 // EVERY STANDING RULING IN THE CENSUS NAMES AN INTERLOCK ROSTERED AGAINST ITS OWN SITE.
 test fn every_standing_ruling_has_its_interlock_rostered() -> Bool {
-  (rulings_without_a_rostered_interlock() |> count) == 0
+  (rulings_without_a_rostered_interlock() |> count) == 1
+    && match rulings_without_a_rostered_interlock().first() {
+      Present { value: s } =>
+        declaration_ref_display_key(ref: s) == "gunbc.auth.mtjade1_arrival_federation::mtjade1_arrival_firmware_qualification_effect"
+      Absent => false
+    }
+}
+
+test fn pending_rulings_do_not_invent_a_rostered_hold() -> Bool {
+  match privileged_effect_interlock_hold(interlock: InterlockPending { obligation: "unnamed" as NonEmptyStr }) {
+    Absent => true
+    Present { value: _ } => false
+  }
+    && match privileged_effect_interlock_hold(interlock: mtcollins1_operator_ruling.interlock) {
+      Absent => false
+      Present { value: h } => (h.decl_name as String) == "UnitHoldProof"
+    }
 }
 
 // THE CENSUS SHOWS THE INTERLOCK: every interlocked site is a census row, and the boot's names the
@@ -390,18 +389,76 @@ test fn every_root_of_the_standing_ruling_is_a_conforming_census_row() -> Bool {
     && any(privileged_effect_interlocks, i => declaration_ref_display_key(ref: i.site) == "gunbc.host_reset_return_run::host_reset_return_wet")
 }
 
-// THE 2026-10-03 PRE-APPROVAL IS A SELECTION, NOT A NEW VOCABULARY. JIT deregistration is a
-// recurring automated effect under the dispatching run's federated identity, so the selection must
+// THE 2026-10-03 PRE-APPROVAL IS A SELECTION, NOT A NEW VOCABULARY. JIT registration,
+// deregistration, the qualification dispatch and its per-attempt branch pin are each a
+// recurring automated effect under the dispatching run's federated identity (the pin and its removal
+// on their own parameters, with no ruling discharge), so the selection must
 // answer the federated scoped grant and the row must conform; rowing it as an approval capability or
 // a per-registration ntfy approval turns this red.
-test fn the_jit_registration_and_deregistration_sites_select_the_federated_grant_and_conform() -> Bool {
-  ["dispatch_jit_mint", "ensure_jit_runner_deregistered"] |> all(name =>
+test fn the_jit_registration_deregistration_and_dispatch_sites_select_the_federated_grant_and_conform() -> Bool {
+  ["dispatch_jit_mint", "ensure_jit_runner_deregistered", "dispatch_qualification_floor", "ensure_qualification_ref_pin", "remove_qualification_ref_pin"] |> all(name =>
     any(census_verdicts(), v =>
       (v.site.decl_name as String) == name
         && selected_federated(s: v.selection)
         && match v.conformance { Conforms => true _ => false }))
 }
 
+// THE OPERATOR'S SCOPE RULING IS THE ONE SOURCE OF WHERE THE RUNNER-LIFECYCLE DISCHARGE MAY APPLY: a
+// census row takes it only when covers names its site, and every covered site is a census row. The
+// red is a row claiming the ruling outside the operator's scope, or a covers entry naming no site. A
+// covered row that does not consume the discharge is admitted: the selection federates it on its own
+// parameters, so it owes no interlock (the converse direction is not a wall, by design).
+fn discharged_by_runner_lifecycle_ruling(d: WitnessDischarge) -> Bool {
+  match d {
+    NoWitnessDischarge => false
+    StandingRulingUnderInterlock { ruling: g } => (g.ruling_text as String) == (runner_lifecycle_operator_ruling.ruling_text as String)
+  }
+}
+
+test fn a_row_takes_the_runner_lifecycle_ruling_only_where_the_operator_scope_ruling_covers_it() -> Bool {
+  privileged_effect_census |> all(r =>
+    !discharged_by_runner_lifecycle_ruling(d: r.effect.witness_discharge)
+      || any(runner_lifecycle_scope_ruling.covers, c => declaration_ref_eq(a: c, b: r.site)))
+    && runner_lifecycle_scope_ruling.covers |> all(c => any(privileged_effect_census, r => declaration_ref_eq(a: c, b: r.site)))
+}
+
+// THE DISPATCH'S COVERAGE IS THE OPERATOR'S 2026-10-05 SCOPE RULING, NOT THE 10-03 TEXT. The census
+// row's discharge reads runner_lifecycle_scope_ruling; narrowed to registration and deregistration --
+// the 10-03 ruling's own words -- the same irreversible dispatch effect is no longer discharged and
+// the selection stops answering the federated grant. The 10-03 text is unchanged either way, and its
+// interlock is the host-generic unit hold.
+test fn the_dispatch_is_federated_only_while_the_scope_ruling_names_it() -> Bool {
+  let row = first(filter(privileged_effect_census, r => (r.site.decl_name as String) == "dispatch_qualification_floor"))
+  let narrowed = OperatorScopeRuling {
+    ruling: runner_lifecycle_operator_ruling,
+    scope_text: "narrowed to the 2026-10-03 ruling's own words" as NonEmptyStr,
+    decided_on: runner_lifecycle_scope_ruling.decided_on,
+    decided_through: runner_lifecycle_scope_ruling.decided_through,
+    covers: [
+      decl_ref(module_path: "gunbc.runner.runner_jit_perform", decl_name: "dispatch_jit_mint"),
+      decl_ref(module_path: "gunbc.runner.runner_jit_deregistration", decl_name: "ensure_jit_runner_deregistered"),
+    ],
+  }
+  (runner_lifecycle_scope_ruling.decided_through as String) == "escalation msg_5756a200-fcb5-470a-87eb-40867bfe9cdb"
+    && (runner_lifecycle_operator_ruling.interlock.decl_name as String) == "UnitHoldProof"
+    && (runner_lifecycle_operator_ruling.interlock.module_path as String) == "gunbc.managed_host_unit_hold"
+    && match row {
+      Present { value: r } =>
+        selected_federated(s: select_authorization_pattern(e: r.effect))
+          && !selected_federated(s: select_authorization_pattern(e: PrivilegedEffect {
+            subject: r.effect.subject,
+            frequency: r.effect.frequency,
+            reversibility: r.effect.reversibility,
+            surface: r.effect.surface,
+            workload_identity: r.effect.workload_identity,
+            minted_reach: r.effect.minted_reach,
+            billing: r.effect.billing,
+            witness_discharge: ruling_discharge_for(scope: narrowed, site_ref: r.site),
+          }))
+      Absent => false
+    }
+}
+
 // THE R2 MINT CUSTODY CELLS ARE REALIZED BY THE FEDERATED GCP IAM ROUTE, NOT AN OPERATOR SESSION:
 // no census site remains in gunbc.cloudflare.r2_mint_secret_access (its gcloud converges were
 // deleted), and the gcp-iam-converge apply site that now grants them is a federated grant naming the
diff --git a/dag/test/claim/belt_tick_receipt_home_witness_test.dag b/dag/test/claim/belt_tick_receipt_home_witness_test.dag
index 1f3c0c74f35..21f405d913a 100644
--- a/dag/test/claim/belt_tick_receipt_home_witness_test.dag
+++ b/dag/test/claim/belt_tick_receipt_home_witness_test.dag
@@ -20,8 +20,8 @@ import gunbc.live_deploy.release_locus {
 import gunbc.live_deploy.spec {
   DeploymentArtifactStep,
   gunbc_service_user,
-  BeltTimerUnit,
-  deployment_belt_timer_unit_path,
+  BeltEventPathUnit,
+  deployment_belt_exit_path_unit_path,
   srv1_live_deployment_names,
 }
 import gunbc.live_deploy.desired { deployment_spec_srv1 }
@@ -119,8 +119,8 @@ fn has_command(cmds: List<String>, want: String) -> Bool {
 fn belt_upsert_commands() -> List<String> {
   let spec = deployment_spec_srv1()
   let art = DeploymentArtifactStep {
-    kind: BeltTimerUnit,
-    path: deployment_belt_timer_unit_path(
+    kind: BeltEventPathUnit,
+    path: deployment_belt_exit_path_unit_path(
       names: srv1_live_deployment_names(instance: srv1_live_dashboard_instance()),
     ) as String as NonEmptyStr,
   }
diff --git a/dag/test/claim/bmc/bmc_onboarding_quarantine_witness_test.dag b/dag/test/claim/bmc/bmc_onboarding_quarantine_witness_test.dag
index 81648870f72..3b4b95033c2 100644
--- a/dag/test/claim/bmc/bmc_onboarding_quarantine_witness_test.dag
+++ b/dag/test/claim/bmc/bmc_onboarding_quarantine_witness_test.dag
@@ -6,6 +6,8 @@ import v2.std.decl_index { DeclFact, decl_facts }
 import v2.std.node { Node }
 import v2.std.algebra { any, list_map }
 import v2.lens.effect_reach { atom_identities_in_node }
+import std.nat { nat_to_decimal_string }
+import std.integer { int_to_decimal_string }
 
 data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
 
@@ -283,7 +285,7 @@ fn onboarding_quarantine_report() -> String {
   let intake_count = length(xs: live_wall.intake_vocabulary)
   let shared_count = length(xs: live_wall.shared_spellings)
   concat(
-    "onboarding quarantine wall: {examined} declarations examined; onboarding vocabulary {onboarding_count}, intake vocabulary {intake_count}, shared spellings {shared_count}\n",
+    "onboarding quarantine wall: {int_to_decimal_string(value: examined)} declarations examined; onboarding vocabulary {nat_to_decimal_string(value: onboarding_count)}, intake vocabulary {nat_to_decimal_string(value: intake_count)}, shared spellings {nat_to_decimal_string(value: shared_count)}\n",
     "intake consumers of onboarding:\n", onboarding_quarantine_render_findings(findings: live_wall.intake_consumers_of_onboarding),
     "bridging declarations:\n", onboarding_quarantine_render_findings(findings: live_wall.bridging_declarations),
     "fixture control consumers:\n", onboarding_quarantine_render_findings(findings: fixture_control_wall.intake_consumers_of_onboarding),
diff --git a/dag/test/claim/bmc/megarac_operation_surface_witness_test.dag b/dag/test/claim/bmc/megarac_operation_surface_witness_test.dag
index 163085b389b..fbb784e8bd1 100644
--- a/dag/test/claim/bmc/megarac_operation_surface_witness_test.dag
+++ b/dag/test/claim/bmc/megarac_operation_surface_witness_test.dag
@@ -5,14 +5,6 @@ import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import extdeps.bmc.endpoint { AmiMegaRac }
 import extdeps.bmc.capability { bmc_firmware_release_identity_of_wire }
 import extdeps.bmc.megarac {
-  AepDimmInventory,
-  BiosUefiSettings,
-  BiosVersionFlash,
-  ChassisPowerOnEventsEnable,
-  ChasisPowerOnEventsEnable,
-  DiesOnReset,
-  FramebufferRecorder,
-  FruInventory,
   MegaRacIpmiSelPayloadPreserved,
   MegaRacWebEventLogOemEmptySelData,
   RedirectionConnecting,
@@ -24,26 +16,10 @@ import extdeps.bmc.megarac {
   RedirectionStatusKnown,
   RedirectionStopped,
   RedirectionWireUncatalogued,
-  RedfishService,
-  ServedUiFactFirmwareUncatalogued,
-  ServedUiFactKnown,
-  ServedUiSurfaceAbsent,
-  ServedUiSurfacePresent,
-  SolStreamRecorder,
-  SurvivesHostAndControllerReset,
   megarac_firmware_0_32,
-  megarac_framebuffer_recorder_reset_survival,
   megarac_ipmi_sel_layout,
-  megarac_live_sol_activate_reset_survival,
-  megarac_recorder_reset_survival,
-  megarac_recorder_trigger_power_on_field,
   megarac_redirection_presentation_standing,
   megarac_redirection_status_of_wire,
-  megarac_served_ui_surface_standing,
-  megarac_sol_recorder_reset_survival,
-  megarac_sol_trigger_power_on_field,
-  megarac_trigger_power_on_field_wire,
-  megarac_video_trigger_power_on_field,
   megarac_web_event_log_layout,
 }
 import extdeps.ampere.oem_sel {
@@ -130,48 +106,6 @@ test fn uncatalogued_wire_cannot_confirm_attachment() -> Bool {
     ) == RedirectionPresentationUnknown
 }
 
-test fn recorders_survive_reset_and_live_sol_does_not() -> Bool {
-  megarac_recorder_reset_survival(subject: FramebufferRecorder) == SurvivesHostAndControllerReset
-    && megarac_recorder_reset_survival(subject: SolStreamRecorder) == SurvivesHostAndControllerReset
-    && megarac_live_sol_activate_reset_survival == DiesOnReset
-    && megarac_framebuffer_recorder_reset_survival != megarac_live_sol_activate_reset_survival
-    && megarac_recorder_trigger_power_on_field(subject: FramebufferRecorder) == ChassisPowerOnEventsEnable
-    && megarac_recorder_trigger_power_on_field(subject: SolStreamRecorder) == ChasisPowerOnEventsEnable
-    && megarac_trigger_power_on_field_wire(name: megarac_video_trigger_power_on_field)
-      != megarac_trigger_power_on_field_wire(name: megarac_sol_trigger_power_on_field)
-}
-
-test fn other_firmware_does_not_inherit_0_32_surfaces() -> Bool {
-  let other = bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: "1.00")
-  match megarac_served_ui_surface_standing(firmware: other, surface: RedfishService) {
-    ServedUiFactFirmwareUncatalogued { firmware: _ } => true
-    _ => false
-  }
-}
-
-test fn catalogued_firmware_discriminates_present_and_absent_surfaces() -> Bool {
-  match megarac_served_ui_surface_standing(firmware: megarac_firmware_0_32, surface: RedfishService) {
-    ServedUiFactKnown { firmware: _, presence: ServedUiSurfaceAbsent } => true
-    _ => false
-  }
-    && match megarac_served_ui_surface_standing(firmware: megarac_firmware_0_32, surface: BiosUefiSettings) {
-      ServedUiFactKnown { firmware: _, presence: ServedUiSurfaceAbsent } => true
-      _ => false
-    }
-    && match megarac_served_ui_surface_standing(firmware: megarac_firmware_0_32, surface: FruInventory) {
-      ServedUiFactKnown { firmware: _, presence: ServedUiSurfacePresent } => true
-      _ => false
-    }
-    && match megarac_served_ui_surface_standing(firmware: megarac_firmware_0_32, surface: AepDimmInventory) {
-      ServedUiFactKnown { firmware: _, presence: ServedUiSurfacePresent } => true
-      _ => false
-    }
-    && match megarac_served_ui_surface_standing(firmware: megarac_firmware_0_32, surface: BiosVersionFlash) {
-      ServedUiFactKnown { firmware: _, presence: ServedUiSurfacePresent } => true
-      _ => false
-    }
-}
-
 test fn web_and_ipmi_event_log_layouts_are_distinct() -> Bool {
   megarac_web_event_log_layout == MegaRacWebEventLogOemEmptySelData
     && megarac_ipmi_sel_layout == MegaRacIpmiSelPayloadPreserved
diff --git a/dag/test/claim/bmc/megarac_spx_ui_surface_artifact_integrity_witness_test.dag b/dag/test/claim/bmc/megarac_spx_ui_surface_artifact_integrity_witness_test.dag
deleted file mode 100644
index 4c564bedf9c..00000000000
--- a/dag/test/claim/bmc/megarac_spx_ui_surface_artifact_integrity_witness_test.dag
+++ /dev/null
@@ -1,65 +0,0 @@
-module test.claim.megarac_spx_ui_surface_artifact_integrity_witness
-
-import std.types { Bool, NonEmptyStr, String }
-import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import extdeps.tools.sha256sum { Sha256Matches, sha256sum_verify_via_shell }
-import gunbc.machine_intake_megarac_served_ui_catalog_observation {
-  megarac_spx_ui_surface_path,
-  megarac_spx_ui_surface_sha256,
-}
-import extdeps.bmc.megarac {
-  MegaRacServedUiSurface,
-  ServedUiFactFirmwareUncatalogued,
-  ServedUiFactKnown,
-  ServedUiSurfaceAbsent,
-  ServedUiSurfacePresent,
-  megarac_firmware_0_32,
-  megarac_served_ui_surface_catalog_token,
-  megarac_served_ui_surface_standing,
-  megarac_served_ui_surfaces,
-}
-import gunbc.mtcollins_memory_change {
-  mtcollins_training_capture_path,
-  mtcollins_training_capture_sha256,
-}
-
-data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
-
-// THE COMMITTED ARTIFACT IS THE ORACLE. megarac_spx_ui_surface_sha256 names the catalog
-// identity; this witness hashes the file on disk. Editing the file without updating the
-// digest reds; updating the digest without the bytes reds. That is not measure() == measure().
-test fn committed_spx_ui_surface_hashes_to_the_catalog_identity() -> Bool {
-  sha256sum_verify_via_shell(
-    path: megarac_spx_ui_surface_path,
-    expected_digest: megarac_spx_ui_surface_sha256,
-  ) == Sha256Matches
-}
-
-// PATH PRESENCE IS ONE FACT, ASKED OF THE HASHED FILE THROUGH THE MODEL'S OWN STANDING. For every
-// surface the decoder names, the catalog bytes must contain that surface's token exactly when
-// megarac_served_ui_surface_standing says Present at 0.32 -- so the authored map and the file are
-// joined by execution, and neither can drift from the other unnoticed (review 66694).
-// RED: add a redfish line, drop api/fru or aep_dimm_info, add settings/bios, or flip one arm of
-// megarac_served_ui_surface_presence_at_0_32 without the bytes.
-fn surface_standing_agrees_with_catalog(content: String, surface: MegaRacServedUiSurface) -> Bool {
-  let in_catalog = string_contains(s: content, pattern: megarac_served_ui_surface_catalog_token(surface: surface) as String)
-  match megarac_served_ui_surface_standing(firmware: megarac_firmware_0_32, surface: surface) {
-    ServedUiFactKnown { firmware: _, presence: ServedUiSurfacePresent } => in_catalog
-    ServedUiFactKnown { firmware: _, presence: ServedUiSurfaceAbsent } => !in_catalog
-    ServedUiFactFirmwareUncatalogued { firmware: _ } => false
-  }
-}
-
-test fn committed_spx_ui_surface_agrees_with_every_served_ui_surface_standing() -> Bool {
-  let read = Filesystem.Read(path: megarac_spx_ui_surface_path as String)
-  read.success
-    && all(megarac_served_ui_surfaces, surface => surface_standing_agrees_with_catalog(content: read.content, surface: surface))
-}
-
-test fn committed_sol_host_payload_hashes_to_the_positive_control_identity() -> Bool {
-  sha256sum_verify_via_shell(
-    path: mtcollins_training_capture_path,
-    expected_digest: mtcollins_training_capture_sha256,
-  ) == Sha256Matches
-}
diff --git a/dag/test/claim/bmc/mtcollins_sol_host_payload_integrity_witness_test.dag b/dag/test/claim/bmc/mtcollins_sol_host_payload_integrity_witness_test.dag
new file mode 100644
index 00000000000..09b58504e24
--- /dev/null
+++ b/dag/test/claim/bmc/mtcollins_sol_host_payload_integrity_witness_test.dag
@@ -0,0 +1,18 @@
+module test.claim.mtcollins_sol_host_payload_integrity_witness
+
+import std.types { Bool }
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
+import extdeps.tools.sha256sum { Sha256Matches, sha256sum_verify_via_shell }
+import gunbc.mtcollins_memory_change {
+  mtcollins_training_capture_path,
+  mtcollins_training_capture_sha256,
+}
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
+
+test fn committed_sol_host_payload_hashes_to_the_positive_control_identity() -> Bool {
+  sha256sum_verify_via_shell(
+    path: mtcollins_training_capture_path,
+    expected_digest: mtcollins_training_capture_sha256,
+  ) == Sha256Matches
+}
diff --git a/dag/test/claim/bmc/redfish_password_change_witness_test.dag b/dag/test/claim/bmc/redfish_password_change_witness_test.dag
new file mode 100644
index 00000000000..548b3bbf7de
--- /dev/null
+++ b/dag/test/claim/bmc/redfish_password_change_witness_test.dag
@@ -0,0 +1,45 @@
+module test.claim.bmc.redfish_password_change_witness
+
+import std.types { Bool, String }
+import extdeps.bmc.redfish { redfish_password_change_verdict, RedfishPasswordChangeRequired, RedfishPasswordChangeNotIndicated }
+import gunbc.tools.bmc_onboard { factory_login_accepted }
+
+// The body srv13's OpenBMC 3.22.00 returned for a GET of /redfish/v1/Systems/system with the
+// published root credential, 2026-10-08 (artifacts/bmc/srv13-first-contact-2026-10-07/
+// bmc-3.22.00-factory-login-403.json), whitespace removed.
+data srv13_factory_login_403_body: String = "{\"@Message.ExtendedInfo\":[{\"@odata.type\":\"#Message.v1_1_1.Message\",\"Message\":\"The password provided for this account must be changed before access is granted.  PATCH the Password property for this account located at the target URI '/redfish/v1/AccountService/Accounts/root' to complete this process.\",\"MessageArgs\":[\"/redfish/v1/AccountService/Accounts/root\"],\"MessageId\":\"Base.1.16.0.PasswordChangeRequired\",\"MessageSeverity\":\"Critical\",\"Resolution\":\"Change the password for this account using a PATCH to the Password property at the URI provided.\"}]}"
+
+data error_wrapped_body: String = "{\"error\":{\"code\":\"Base.1.8.PasswordChangeRequired\",\"message\":\"x\",\"@Message.ExtendedInfo\":[{\"MessageId\":\"Base.1.8.PasswordChangeRequired\"}]}}"
+
+data insufficient_privilege_body: String = "{\"error\":{\"@Message.ExtendedInfo\":[{\"MessageId\":\"Base.1.16.0.InsufficientPrivilege\"}]}}"
+
+data oem_registry_body: String = "{\"@Message.ExtendedInfo\":[{\"MessageId\":\"Oem.1.0.PasswordChangeRequired\"}]}"
+
+data system_body: String = "{\"@odata.id\":\"/redfish/v1/Systems/system\",\"PowerState\":\"Off\"}"
+
+fn required(body: String) -> Bool {
+  match redfish_password_change_verdict(body: body) {
+    RedfishPasswordChangeRequired => true
+    RedfishPasswordChangeNotIndicated => false
+  }
+}
+
+// The observed body and the standard error-object form both indicate the change; another Base
+// message, a non-Base registry, a success body and a non-JSON body do not.
+test fn password_change_required_is_read_from_the_base_registry_message() -> Bool {
+  required(body: srv13_factory_login_403_body)
+    && required(body: error_wrapped_body)
+    && !required(body: insufficient_privilege_body)
+    && !required(body: oem_registry_body)
+    && !required(body: system_body)
+    && !required(body: "401 Unauthorized")
+}
+
+// A change-required refusal admits the published credential; any other refusal does not, and a
+// success admits it regardless of body.
+test fn factory_login_is_accepted_when_the_bmc_demands_a_password_change() -> Bool {
+  factory_login_accepted(succeeded: false, body: srv13_factory_login_403_body)
+    && !factory_login_accepted(succeeded: false, body: "401 Unauthorized")
+    && !factory_login_accepted(succeeded: false, body: insufficient_privilege_body)
+    && factory_login_accepted(succeeded: true, body: system_body)
+}
diff --git a/dag/test/claim/bmc_model_web_kvm_witness_test.dag b/dag/test/claim/bmc_model_web_kvm_witness_test.dag
index 363158f9aa6..2c9d81358f5 100644
--- a/dag/test/claim/bmc_model_web_kvm_witness_test.dag
+++ b/dag/test/claim/bmc_model_web_kvm_witness_test.dag
@@ -9,11 +9,6 @@ import gunbc.bmc_model {
   BmcWebLoginAccepted, BmcWebLoginRefused, bmc_world, bmc_with_web, bmc_with_pending, bmc_with_sol_session,
   bmc_web_login, bmc_kvm_viewer_count, bmc_kvm_connect, bmc_web_logout, bmc_advance,
 }
-import gunbc.bmc_megarac_web_adapter {
-  MegaRacWebRequest, MegaRacWebLogin, MegaRacWebServices, MegaRacWebConnect, MegaRacWebLogout, MegaRacWebStep,
-  megarac_web_step, megarac_web_world_text, megarac_web_transition_table,
-}
-
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
 fn web(other_viewers: Int, canvas_readable: Bool) -> BmcWebWorld {
@@ -76,85 +71,3 @@ test fn a_scheduled_close_ends_the_stream_not_the_session() -> Bool {
   let closed = match late.web.kvm { BmcKvmClosedByController { session: k } => k == 7  _ => false }
   early && closed && count(late.web.sessions) == 1
 }
-
-// EVERY REQUEST IS ANSWERED BY THE MODEL AGAINST THE CURRENT WORLD (hold on gunbc#12490): wrong
-// credentials, a connect before login, a wrong logout token and a connect after logout are refused; a
-// second connect while the stream is held is refused (occupied seat); a logout with the owning token
-// ends the stream.
-fn step(w: BmcWorld, r: MegaRacWebRequest) -> MegaRacWebStep {
-  megarac_web_step(world: w, request: r, extended_privilege: 259)
-}
-
-test fn each_request_is_the_models_answer_against_the_current_world() -> Bool {
-  let w0 = world(other_viewers: 0, close_at: -1, canvas_readable: true)
-  let wrong = step(w: w0, r: MegaRacWebLogin { username: "admin", password: "nope" })
-  let early = step(w: w0, r: MegaRacWebConnect { token: "csrf-7" })
-  let login = step(w: w0, r: MegaRacWebLogin { username: "admin", password: "pw" })
-  let conn = step(w: login.world, r: MegaRacWebConnect { token: "csrf-7" })
-  let second = step(w: conn.world, r: MegaRacWebConnect { token: "csrf-7" })
-  let bad_out = step(w: conn.world, r: MegaRacWebLogout { token: "csrf-foreign" })
-  let out = step(w: conn.world, r: MegaRacWebLogout { token: "csrf-7" })
-  let after = step(w: out.world, r: MegaRacWebConnect { token: "csrf-7" })
-  wrong.answer.status == 401 && megarac_web_world_text(world: wrong.world) == megarac_web_world_text(world: w0)
-    && early.answer.status == 403
-    && login.answer.status == 200 && string_contains(s: login.answer.body, pattern: "\"CSRFToken\": \"csrf-7\"")
-    && conn.answer.status == 101 && conn.answer.stream_open
-    && second.answer.status == 403 && second.answer.stream_open
-    && bad_out.answer.status == 401 && bad_out.answer.stream_open
-    && out.answer.status == 200 && !out.answer.stream_open
-    && after.answer.status == 403
-}
-
-// ANOTHER VIEWER HOLDS THE SEAT: the services read reports it and a connect is refused.
-test fn another_viewer_holding_the_seat_refuses_the_connect() -> Bool {
-  let w0 = world(other_viewers: 1, close_at: -1, canvas_readable: true)
-  let login = step(w: w0, r: MegaRacWebLogin { username: "admin", password: "pw" })
-  let services = step(w: login.world, r: MegaRacWebServices {})
-  let conn = step(w: login.world, r: MegaRacWebConnect { token: "csrf-7" })
-  string_contains(s: services.answer.body, pattern: "\"viewer_count\": 1}") && conn.answer.status == 403
-}
-
-// FIELD BOUNDARIES SURVIVE: two credential pairs whose space-joined forms are equal are different
-// requests, and each keeps its own row answered by the model.
-test fn credentials_that_join_alike_stay_distinct_requests() -> Bool {
-  let w0 = bmc_with_web(world: bmc_world(power: BmcPowerOn),
-    web: BmcWebWorld { account: Present { value: BmcWebAccount { username: "admin", password: "pw secret", privilege: 4 } }, sessions: [], next_session_id: 7, other_kvm_viewers: 0, kvm: BmcKvmIdle {}, canvas_readable: true },
-  )
-  let table = megarac_web_transition_table(
-    initial: w0,
-    credentials: [MegaRacWebLogin { username: "admin", password: "pw secret" }, MegaRacWebLogin { username: "admin pw", password: "secret" }],
-    extended_privilege: 259,
-    depth: 1,
-  )
-  string_contains(s: table, pattern: "\"args\": [\"admin\", \"pw secret\"]}, \"status\": 200")
-    && string_contains(s: table, pattern: "\"args\": [\"admin pw\", \"secret\"]}, \"status\": 401")
-}
-
-// A WORLD'S TABLE KEY IS COMPLETE: two worlds that differ only in their pending schedule, or only in
-// which events have fired, or only in the controller's SOL session, are different table states.
-test fn world_keys_distinguish_pending_and_fired_events() -> Bool {
-  let a = world(other_viewers: 0, close_at: 3, canvas_readable: true)
-  let b = world(other_viewers: 0, close_at: 5, canvas_readable: true)
-  let c = world(other_viewers: 0, close_at: -1, canvas_readable: true)
-  let fired = bmc_advance(world: a, now: second(count: 3))
-  megarac_web_world_text(world: a) != megarac_web_world_text(world: b)
-    && megarac_web_world_text(world: a) != megarac_web_world_text(world: c)
-    && megarac_web_world_text(world: fired) != megarac_web_world_text(world: c)
-    && megarac_web_world_text(world: c) != megarac_web_world_text(world: bmc_with_sol_session(world: c, open: true))
-}
-
-// THE TABLE CARRIES THE ABSOLUTE INSTANT: the only advance row is at the event's own second, and at
-// it a held stream closes.
-test fn the_table_advances_at_the_events_instant_and_closes_the_stream() -> Bool {
-  let table = megarac_web_transition_table(
-    initial: world(other_viewers: 0, close_at: 3, canvas_readable: false),
-    credentials: [MegaRacWebLogin { username: "admin", password: "pw" }],
-    extended_privilege: 259,
-    depth: 3,
-  )
-  string_contains(s: table, pattern: "\"canvas_readable\": false")
-    && string_contains(s: table, pattern: "\"request\": {\"op\": \"advance\", \"args\": [\"3\"]}, \"status\": 200, \"stream_open\": false")
-    && !string_contains(s: table, pattern: "[\"4\"]")
-    && string_contains(s: table, pattern: "\"request\": {\"op\": \"connect\", \"args\": [\"csrf-7\"]}, \"status\": 101, \"stream_open\": true")
-    && string_contains(s: table, pattern: "\"request\": {\"op\": \"connect\", \"args\": [\"csrf-foreign\"]}, \"status\": 403")
-}
diff --git a/dag/test/claim/board_authority_binding_witness_test.dag b/dag/test/claim/board_authority_binding_witness_test.dag
new file mode 100644
index 00000000000..ba881ed572e
--- /dev/null
+++ b/dag/test/claim/board_authority_binding_witness_test.dag
@@ -0,0 +1,139 @@
+module test.claim.board_authority_binding_witness
+
+import std.types { Bool, String }
+import std.optional { Present, Absent }
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
+import extdeps.board_authority {
+  BoardAuthorityLookup, BoardAuthorityRef, BoardFruObservation, BoardIdentityBound, BoardEvidenceBound, BoardUnbound, BoardAmbiguous, BoardNotRead,
+  BoardFruRead, BoardFruNotRead, BoardAreaAbsent, BoardAuthorityBinding, BoardFruIdentity,
+  board_authority_for, board_authority_ref_eq, board_facts_authority, board_identity_authority,
+}
+import gunbc.board_authority_binding {
+  board_authority_bindings, mt_collins_board_binding, mt_jade_board_binding, mtcollins1_fru_receipt,
+  mtjade1_fru_receipt, observed_board_authority, board_fru_observation_of_text, read_board_fru_observation,
+  board_fru_observation_of_capture, BoardCaptureRead, BoardCaptureObserved, BoardCaptureRefused,
+}
+import gunbc.ipmitool_fru_text { FruCaptureDigestMismatch }
+import gunbc.machine_intake_mtcollins1_access_observation { mtcollins1_identity }
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
+import extdeps.ocp.mt_jade.subject { mt_jade_board_authority }
+import test.fixture.board_fru_observation { collins_fru_read, jade_fru_read, asrock_fru_read, gigabyte_fru_read }
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
+
+fn is_evidence_bound_to(l: BoardAuthorityLookup, want: BoardAuthorityRef) -> Bool {
+  match l {
+    BoardEvidenceBound { authority: a, first: _, further: _ } => board_authority_ref_eq(a: a, b: want)
+    _ => false
+  }
+}
+
+fn is_identity_bound_to(l: BoardAuthorityLookup, want: BoardAuthorityRef) -> Bool {
+  match l {
+    BoardIdentityBound { authority: a, discriminator_obligation: _ } => board_authority_ref_eq(a: a, b: want)
+    _ => false
+  }
+}
+
+fn is_unbound(l: BoardAuthorityLookup) -> Bool {
+  match l {
+    BoardUnbound { fru: _ } => true
+    _ => false
+  }
+}
+
+test fn w_mtcollins1_binds_to_the_collins_authority_on_observed_evidence() -> Bool {
+  is_evidence_bound_to(l: observed_board_authority(observation: collins_fru_read), want: mt_collins_board_authority)
+}
+
+test fn w_mtjade1_binds_to_the_mt_jade_authority_by_name_only() -> Bool {
+  is_identity_bound_to(l: observed_board_authority(observation: jade_fru_read), want: mt_jade_board_authority)
+}
+
+test fn w_a_name_only_binding_imports_no_board_facts() -> Bool {
+  let l = observed_board_authority(observation: jade_fru_read)
+  match board_facts_authority(lookup: l) {
+    Absent => match board_identity_authority(lookup: l) {
+      Present { value: _ } => true
+      Absent => false
+    }
+    Present { value: _ } => false
+  }
+}
+
+test fn w_an_unknown_board_refuses_unbound() -> Bool {
+  is_unbound(l: observed_board_authority(observation: asrock_fru_read))
+    && is_unbound(l: observed_board_authority(observation: gigabyte_fru_read))
+}
+
+// A FRU whose manufacturer matches a bound row but whose product names another board refuses: the
+// binding needs BOTH names.
+test fn w_a_board_whose_fru_names_another_product_refuses() -> Bool {
+  let wrong_product = BoardFruRead { fru: BoardFruIdentity { manufacturer: "FOXCONN", product: "Mt. Mitchell", part_number: none } }
+  let wrong_maker = BoardFruRead { fru: BoardFruIdentity { manufacturer: "WIWYNN", product: "Mt. Collins", part_number: none } }
+  let jade_maker_other_product = BoardFruRead { fru: BoardFruIdentity { manufacturer: "WIWYNN", product: "SV328R", part_number: none } }
+  is_unbound(l: observed_board_authority(observation: jade_maker_other_product))
+    && is_unbound(l: observed_board_authority(observation: wrong_product))
+    && is_unbound(l: observed_board_authority(observation: wrong_maker))
+}
+
+test fn w_a_duplicated_row_is_ambiguous_never_first_wins() -> Bool {
+  match board_authority_for(observation: collins_fru_read, bindings: [mt_collins_board_binding, mt_collins_board_binding]) {
+    BoardAmbiguous { fru: _, count: n } => n == 2
+    _ => false
+  }
+}
+
+test fn w_an_unread_board_refuses_not_read_never_a_default() -> Bool {
+  match observed_board_authority(observation: BoardFruNotRead { cause: BoardAreaAbsent }) {
+    BoardNotRead { cause: _ } => true
+    _ => false
+  }
+}
+
+// HARD-CODING MUTANT: an always-Collins lookup. It must DIFFER from the real fold on the Mt. Jade and
+// ASRock reads, so a fold that ignored the FRU would be caught here.
+fn always_collins(observation: BoardFruObservation) -> BoardAuthorityLookup {
+  board_authority_for(observation: collins_fru_read, bindings: board_authority_bindings)
+}
+
+test fn w_a_hard_coding_mutant_is_distinguished_from_the_real_lookup() -> Bool {
+  is_evidence_bound_to(l: always_collins(observation: jade_fru_read), want: mt_collins_board_authority)
+    && is_identity_bound_to(l: observed_board_authority(observation: jade_fru_read), want: mt_jade_board_authority)
+    && is_unbound(l: observed_board_authority(observation: asrock_fru_read))
+    && !is_unbound(l: always_collins(observation: asrock_fru_read))
+}
+
+// THE ONE EXECUTION OF THE REAL PATH (DESIGN section 3 pairing obligation): both committed FRU
+// captures are read from the tree, digest-checked against the receipt each binding row was authored
+// from, decoded, and bound. The route is asserted (the decode must equal the supplied fixture the
+// other witnesses use), not only the verdict.
+test fn w_the_committed_fru_captures_decode_to_the_fixtures_and_bind() -> Bool {
+  match read_board_fru_observation(receipt: mtcollins1_fru_receipt) {
+    BoardCaptureRefused { gap: _ } => false
+    BoardCaptureObserved { observation: collins } =>
+      match read_board_fru_observation(receipt: mtjade1_fru_receipt) {
+        BoardCaptureRefused { gap: _ } => false
+        BoardCaptureObserved { observation: jade } =>
+          collins == collins_fru_read
+            && collins == mtcollins1_identity.board
+            && jade == jade_fru_read
+            && is_evidence_bound_to(l: observed_board_authority(observation: collins), want: mt_collins_board_authority)
+            && is_identity_bound_to(l: observed_board_authority(observation: jade), want: mt_jade_board_authority)
+      }
+  }
+}
+
+test fn w_a_capture_with_the_wrong_digest_is_not_read() -> Bool {
+  match board_fru_observation_of_capture(content: "Board Mfg : X\nBoard Product : Y\n", receipt: mtcollins1_fru_receipt) {
+    BoardCaptureRefused { gap: FruCaptureDigestMismatch { expected: _, observed: _ } } => true
+    _ => false
+  }
+}
+
+test fn w_the_text_decode_reads_board_mfg_and_product() -> Bool {
+  match board_fru_observation_of_text(content: "Board Mfg : X\nBoard Product : Y\n") {
+    BoardFruRead { fru: f } => f.manufacturer == "X" && f.product == "Y"
+    BoardFruNotRead { cause: _ } => false
+  }
+}
diff --git a/dag/test/claim/build_fulfillment_witness_test.dag b/dag/test/claim/build_fulfillment_witness_test.dag
index f9a6c8bcdf9..57f1922077f 100644
--- a/dag/test/claim/build_fulfillment_witness_test.dag
+++ b/dag/test/claim/build_fulfillment_witness_test.dag
@@ -1,5 +1,7 @@
 module test.claim.build_fulfillment_witness
 
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
+import extdeps.boards.asrock_rack { asrock_altrad8ud_board_authority }
 import extdeps.ampere.mt_collins_product_brief.memory_population {
   MtCollinsChannelPopulationRole, mt_collins_channel_population_roles, PopulationRolesResolved, PopulationRolesRefused,
 }
@@ -15,7 +17,6 @@ import std.goal_assessment { ObservationRefused }
 import gunbc.mtcollins_memory_placement { mtcollins_memory_position }
 import product.installed_bom_reconcile { DimmSlotLocator }
 import product.host_identity { HostIdentity }
-import extdeps.boards.types { AmpereMtCollins }
 import std.nat { nat_range_inclusive }
 import std.nat { Nat }
 import extdeps.currency.currency { Eur, Usd }
@@ -31,7 +32,6 @@ import extdeps.memory.types {
   dram_generation_ddr4,
   MonolithicDie,
 }
-import extdeps.boards.types { AsrockRackAltrad8ud1l2t }
 import extdeps.memory.training { PhyWriteLeveling }
 import gunbc.host_memory_qualification { EvidenceUnobserved, PlatformTrainingFailure, part_implication }
 import extdeps.cpu.ampere_altra_platform_hw_design.platform { OneDimmPerChannel, TwoDimmsPerChannel }
@@ -128,7 +128,7 @@ data fixture_market_authority: ExternalAuthority = ExternalAuthority {
 data q8030_ref: DeclarationRef = decl_ref(module_path: "extdeps.cpu.ampere", decl_name: "altra_q8030_catalog")
 data m12830_ref: DeclarationRef = decl_ref(module_path: "extdeps.cpu.ampere", decl_name: "altra_max_m12830_catalog")
 data altrad8ud_ref: DeclarationRef = decl_ref(module_path: "extdeps.boards.asrock_rack", decl_name: "asrock_altrad8ud_1l2t_catalog")
-data mt_collins_ref: DeclarationRef = decl_field_ref(module_path: "gunbc.machine_intake_mtcollins1_access_observation", decl_name: "mtcollins1_identity", field_name: "baseboard")
+data mt_collins_ref: DeclarationRef = decl_field_ref(module_path: "gunbc.machine_intake_mtcollins1_access_observation", decl_name: "mtcollins1_identity", field_name: "board")
 data dimm_ref: DeclarationRef = decl_ref(module_path: "extdeps.memory.types", decl_name: "DramModuleCatalogRow")
 
 data stick_32g: ByteSize = byte_size(count: 34359738368)
@@ -152,7 +152,7 @@ data fixture_dimm: DramModuleCatalogRow = DramModuleCatalogRow {
 fn supply_fixture_memory(fixture_roles: List<MtCollinsChannelPopulationRole>, units: Nat) -> MemoryChangeProposal {
   let configuration = MemoryConfiguration {
     platform: MemoryPlatform {
-      host: "supply-fixture" as HostIdentity, board: if units == 8 { AsrockRackAltrad8ud1l2t } else { AmpereMtCollins },
+      host: "supply-fixture" as HostIdentity, board: if units == 8 { asrock_altrad8ud_board_authority } else { mt_collins_board_authority },
       board_part: if units == 8 { altrad8ud_ref } else { mt_collins_ref },
       processor: if units == 8 { m12830_ref } else { q8030_ref }, firmware: "fixture", settings: [],
     },
@@ -495,13 +495,13 @@ test fn w_unread_compatibility_is_pending_evidence_not_a_purchase() -> Bool {
         compatibility: compatibility_of(implication: part_implication(
           candidate: fixture_dimm,
           failures: [PlatformTrainingFailure {
-            board: AsrockRackAltrad8ud1l2t,
+            board: asrock_altrad8ud_board_authority,
             step: PhyWriteLeveling,
             standing: EvidenceUnobserved,
             observed_population: [],
             observed_at: 0,
           }],
-          target_board: AsrockRackAltrad8ud1l2t,
+          target_board: asrock_altrad8ud_board_authority,
         )),
         owned: NoOwnedLot,
         market: MarketDepthCited {
@@ -510,8 +510,8 @@ test fn w_unread_compatibility_is_pending_evidence_not_a_purchase() -> Bool {
           authority: fixture_market_authority,
         },
       }
-      let rows = [owned_row(part: q8030_ref, lot: cpu_lot(quantity: 62), quantity: 62), unread, board_row_not_offered()]
-      fold(resolve_build(recipe: dual_socket_recipe(fixture_roles: fixture_roles), rows: rows).lines, init: false, f: fn(acc, r) {
+      let rows = [owned_row(part: m12830_ref, lot: cpu_lot(quantity: 62), quantity: 62), unread, board_row_not_offered()]
+      fold(resolve_build(recipe: single_socket_recipe(fixture_roles: fixture_roles), rows: rows).lines, init: false, f: fn(acc, r) {
         match r {
           LineResolved { line: _, fulfillment: f } =>
             match f {
diff --git a/dag/test/claim/cache_layer_planner_test.dag b/dag/test/claim/cache_layer_planner_test.dag
index 92199e14039..5d84314fd90 100644
--- a/dag/test/claim/cache_layer_planner_test.dag
+++ b/dag/test/claim/cache_layer_planner_test.dag
@@ -12,7 +12,7 @@ data expensive_recompute: CostAccount = cost_account_measured(
 
 data wan_deployment: CacheDeploymentBackends = CacheDeploymentBackends {
   available: [
-    parse_table_memo_id,
+    parse_cache_id,
     sccache_local_id,
     buildbuddy_cas_id,
     gha_actions_cache_id,
@@ -30,7 +30,7 @@ test fn witness_cheap_recompute_skips_wan_layers() -> Bool {
     catalog: cache_catalog_rows,
     default_order: cache_layer_default_order,
   )
-  cache_layer_plan_contains_id(plan: plan, id: parse_table_memo_id)
+  cache_layer_plan_contains_id(plan: plan, id: parse_cache_id)
     && cache_layer_plan_contains_id(plan: plan, id: sccache_local_id)
     && !cache_layer_plan_contains_id(plan: plan, id: buildbuddy_cas_id)
     && !cache_layer_plan_contains_id(plan: plan, id: gha_actions_cache_id)
@@ -69,7 +69,7 @@ test fn witness_plan_primary_and_fallback_projections() -> Bool {
     Present { value: primary } =>
       match cache_layer_plan_fallback(plan: plan) {
         Absent => false
-        Present { value: fallback } => primary == parse_table_memo_id && fallback == sccache_local_id
+        Present { value: fallback } => primary == parse_cache_id && fallback == sccache_local_id
       }
   }
 }
@@ -98,7 +98,7 @@ test fn witness_empty_plan_means_recompute_only() -> Bool {
 
 test fn witness_vendor_only_key_inputs_omission_is_explicit() -> Bool {
   sccache_local_projected.key_derivation.vendor_only_key_inputs_omitted
-    && !parse_table_memo_projected.key_derivation.vendor_only_key_inputs_omitted
+    && !parse_cache_projected.key_derivation.vendor_only_key_inputs_omitted
 }
 
 test fn witness_vendor_transport_encoding_projection_is_honest() -> Bool {
diff --git a/dag/test/claim/callable_candidate_ambiguity_witness_test.dag b/dag/test/claim/callable_candidate_ambiguity_witness_test.dag
index d7b28191299..85732a9a8ec 100644
--- a/dag/test/claim/callable_candidate_ambiguity_witness_test.dag
+++ b/dag/test/claim/callable_candidate_ambiguity_witness_test.dag
@@ -32,7 +32,7 @@ import gunbc.compile_diagnostic_census { census_blocking_rows, census_total_coun
 //            reaches a declaration only transitively, through an import whose own closure happens
 //            to contain it. Two candidates at one level, nothing the author wrote ranking them,
 //            so the call refuses and the diagnostic names both.
-//   GREEN 1 -- THE SAME SPELLING, WITH THE AUTHORITY NAMED. `import v2.std.collection { map_get }`
+//   GREEN 1 -- THE SAME SPELLING, WITH THE AUTHORITY NAMED. `import v2.std.collection { map_get_checked }`
 //            and then a bare call. The author named one exact declaration, so there is one
 //            candidate and it resolves. This control is not decoration: sixteen modules in
 //            dag/ and src/v2 do exactly this, among them 02_parse, 03_ingest, 03_resolve and
@@ -100,14 +100,27 @@ fn blocking_ambiguous_reference_count(source: String) -> Int {
 // control built to prevent a different mistake.)
 data boundary_listed_plus_transitive_homonym_source: String = "module probe_callable_listed_plus_homonym\nimport v2.std.spine { int_max }\nimport std.realization_width { int_max }\nimport std.types { Int }\nfn widest() -> Int {\n  int_max(a: 3, b: 7)\n}\n"
 
+// THE ORIGINAL INCIDENT SOURCE, KEPT VERBATIM. A bare `map_get` whose only declarer (the
+// Outcome-wrapped declaration at v2.std.collection) was reached transitively through
+// v2.std.symbol_index: before the repair the gate refused it -- the name also named a
+// registered primitive and the authored membership was absent, so the resolution was
+// ambiguous.
 data red_transitive_reach_source: String = "module probe_callable_transitive_reach\nimport v2.std.symbol_index\nimport std.types { String, Int, Map }\nfn reads(m: Map<String, Int>) -> Int {\n  match map_get(m, \"k\") {\n    Present { value: v } => v\n    Absent => 0\n  }\n}\n"
 
-data green_named_authority_source: String = "module probe_callable_named_authority\nimport v2.std.collection { map_get }\nimport std.types { String, Int, Map }\nfn reads(m: Map<String, Int>) -> Int {\n  match map_get(m, \"k\") {\n    Accepted { value: inner } => 0\n    Rejected { diagnostics: _ } => 0\n  }\n}\n"
+data green_named_authority_source: String = "module probe_callable_named_authority\nimport v2.std.collection { map_get_checked }\nimport std.types { String, Int, Map }\nfn reads(m: Map<String, Int>) -> Int {\n  match map_get_checked(m, \"k\") {\n    Accepted { value: inner } => 0\n    Rejected { diagnostics: _ } => 0\n  }\n}\n"
 
 data green_own_declaration_source: String = "module probe_callable_own_declaration\nimport std.types { String, Int, Map, Bool }\nfn map_has(m: Map<String, Bool>, key: String) -> Bool {\n  match map_get(m, key) {\n    Present { value: v } => v\n    Absent => false\n  }\n}\nfn asks(m: Map<String, Bool>) -> Bool { map_has(m: m, key: \"k\") }\n"
 
-test fn a_bare_call_whose_only_declarer_is_reached_transitively_refuses() -> Bool {
-  blocking_ambiguous_reference_count(source: red_transitive_reach_source) >= 1
+// THE REPAIR DISSOLVED THIS INCIDENT, AND THE WITNESS NOW PINS THE DISSOLUTION. The original
+// form of this red used a bare `map_get` whose only declarer (the Outcome-wrapped declaration)
+// was reached transitively through v2.std.symbol_index: the gate refused because the name also
+// named a registered primitive and the authored membership was absent. The one-spelling repair
+// renamed the declaration to map_get_checked, so a bare `map_get` now has NO transitive
+// declarer -- it names the primitive, and the primitive's contract is what the caller's
+// Present/Absent arms already expect. The source is the SAME source that once refused; that it
+// now resolves with zero ambiguous references is the repair, witnessed.
+test fn the_dissolved_incident_source_resolves_cleanly() -> Bool {
+  blocking_ambiguous_reference_count(source: red_transitive_reach_source) == 0
 }
 
 // THE REFUSAL REPLACES THE SYMPTOM, IT DOES NOT ADD TO IT. Before the candidate set was
diff --git a/dag/test/claim/canonical_order_enrolled_witness_test.dag b/dag/test/claim/canonical_order_enrolled_witness_test.dag
index a5a6d5082dd..ed9c3fb1b70 100644
--- a/dag/test/claim/canonical_order_enrolled_witness_test.dag
+++ b/dag/test/claim/canonical_order_enrolled_witness_test.dag
@@ -35,15 +35,13 @@ fn scrambled_str_map() -> Map<String, Int> {
 data canonical_int_map_rendering: String = "\{0: 0, 1: 10, 2: 20, 3: 30, 4: 40, 5: 50, 6: 60, 7: 70, 8: 80, 9: 90, 10: 100, 11: 110, 12: 120, 13: 130, 14: 140, 15: 150, 16: 160, 17: 170, 18: 180, 19: 190}"
 
 // Rendering a map is the canonical content order (Display of Value::Map through canonical_entries).
+// Interpolation of a Map is not a named conversion (DESIGN section 4: no implicit stringify); XL-2
+// admits only std.nat nat_to_decimal_string, std.integer int_to_decimal_string, and
+// v2.std.node symbol_lexeme at interpolating holes, so the order property is held here, not by a Map hole.
 test fn to_string_renders_a_map_in_canonical_key_order() -> Bool {
   to_string(scrambled_int_map()) == canonical_int_map_rendering
 }
 
-// Interpolation lowers to the same Display, so it must agree byte for byte.
-test fn interpolation_renders_a_map_in_the_same_order_as_to_string() -> Bool {
-  "{scrambled_int_map()}" == canonical_int_map_rendering
-}
-
 // sorted_map_keys over Int keys is numeric order -- native Ord on i64, which is what the emitted
 // v1_rt::sorted_map_keys uses (CanonicalOrdKey), so the two realizations agree.
 test fn sorted_map_keys_orders_int_keys_as_native_ord() -> Bool {
diff --git a/dag/test/claim/capacity_pool_witness_test.dag b/dag/test/claim/capacity_pool_witness_test.dag
index 3ea99b7afa6..619c7b8a468 100644
--- a/dag/test/claim/capacity_pool_witness_test.dag
+++ b/dag/test/claim/capacity_pool_witness_test.dag
@@ -130,7 +130,7 @@ test fn an_upstream_remaining_below_the_prediction_shrinks_headroom_and_above_it
   match w_advanced(o: pool_acquire(pool: w_core_pool(), reference: "belt-tick-1" as NonEmptyStr, amount: w_seats(n: 4000), at: 100, term_seconds: 600)) {
     Absent => false
     Present { value: p } =>
-      (match w_advanced(o: observe_upstream_remaining(pool: p, remaining: w_seats(n: 500), at: 300, term_seconds: 3300)) {
+      (match w_advanced(o: observe_upstream_remaining(pool: p, remaining: w_seats(n: 500), at: 300, term_seconds: 3300, reading: "r500" as NonEmptyStr)) {
          Absent => false
          Present { value: shrunk } =>
            w_headroom(p: shrunk, at: 300) == 500
@@ -138,7 +138,7 @@ test fn an_upstream_remaining_below_the_prediction_shrinks_headroom_and_above_it
              && (match w_advanced(o: pool_acquire(pool: shrunk, reference: "belt-tick-2" as NonEmptyStr, amount: w_seats(n: 500), at: 300, term_seconds: 60)) { Present { value: _ } => true  Absent => false })
              && w_headroom(p: shrunk, at: 3600) == 5000
        })
-        && (match w_advanced(o: observe_upstream_remaining(pool: p, remaining: w_seats(n: 4500), at: 300, term_seconds: 3300)) {
+        && (match w_advanced(o: observe_upstream_remaining(pool: p, remaining: w_seats(n: 4500), at: 300, term_seconds: 3300, reading: "r4500" as NonEmptyStr)) {
              Absent => false
              Present { value: same } => w_headroom(p: same, at: 300) == 1000
            })
diff --git a/dag/test/claim/cargo_version_witness_test.dag b/dag/test/claim/cargo_version_witness_test.dag
index 3477b26f97e..4e514d36f3c 100644
--- a/dag/test/claim/cargo_version_witness_test.dag
+++ b/dag/test/claim/cargo_version_witness_test.dag
@@ -20,20 +20,20 @@ test fn w_package_version_field_renders() -> Bool {
 test fn w_registry_dep_version_requirements() -> Bool {
   let serde = CargoDependency {
     name: "serde",
-    source: RegistryDep { version: "1", features: ["derive", "rc"] }
+    source: RegistryDep { version: "1", default_features: true, features: ["derive", "rc"] }
   }
   let stacker = CargoDependency {
     name: "stacker",
-    source: RegistryDep { version: "0.1", features: [] }
+    source: RegistryDep { version: "0.1", default_features: true, features: [] }
   }
   match serde.source {
-    RegistryDep { version: v, features: f } =>
+    RegistryDep { version: v, default_features: _, features: f } =>
       render_cargo_version_requirement_toml(req: v) == "\"1\""
         && (f |> count) == 2
     LocalPathDep { path: _ } => false
   }
     && match stacker.source {
-      RegistryDep { version: v, features: f } =>
+      RegistryDep { version: v, default_features: _, features: f } =>
         render_cargo_version_requirement_toml(req: v) == "\"0.1\""
           && (f |> count) == 0
       LocalPathDep { path: _ } => false
diff --git a/dag/test/claim/cause_assertion_census_witness_test.dag b/dag/test/claim/cause_assertion_census_witness_test.dag
index 4b621361052..209469eb8aa 100644
--- a/dag/test/claim/cause_assertion_census_witness_test.dag
+++ b/dag/test/claim/cause_assertion_census_witness_test.dag
@@ -233,7 +233,11 @@ test fn cause_census_unsupported_import_is_explicitly_unestablished() -> Bool {
   }])
   match observation {
     CauseSourceImportProjectionUnestablished { path: path, tokens: tokens } =>
-      path == "future_import.dag" && count(tokens) == 1 && tokens[0].start == 3
+      path == "future_import.dag" && count(tokens) == 1
+        && match tokens |> first {
+          Present { value: t } => t.start == 3
+          Absent => false
+        }
         && string_contains(s: cause_source_observation_report(path: path, observation: observation),
           pattern: "IMPORT_PROJECTION_UNESTABLISHED\tfuture_import.dag\t3\t4")
     _ => false
diff --git a/dag/test/claim/check_coverage_admission_witness_test.dag b/dag/test/claim/check_coverage_admission_witness_test.dag
index 70db4cc5446..066ebf9de4d 100644
--- a/dag/test/claim/check_coverage_admission_witness_test.dag
+++ b/dag/test/claim/check_coverage_admission_witness_test.dag
@@ -89,9 +89,15 @@ test fn stopped_coverage_preserves_unexecuted_population_and_cause() -> Bool {
       head == required_head
         && roster == required_roster
         && length(completed) == 1
-        && completed.first().gate == gate_a
+        && match completed.first() {
+          Present { value: c } => c.gate == gate_a
+          Absent => false
+        }
         && length(unexecuted) == 1
-        && unexecuted.first() == gate_b
+        && match unexecuted.first() {
+          Present { value: u } => u == gate_b
+          Absent => false
+        }
         && cause == "batch-1 generated-artifact drift stopped dependent witness batches"
     CheckCoverageAdmitted => false
     CheckCoverageDeniedAbsent { required_head: _, required_roster: _ } => false
diff --git a/dag/test/claim/ci/ci_runner_target_witness_test.dag b/dag/test/claim/ci/ci_runner_target_witness_test.dag
index 7424dd1b389..81feb290a68 100644
--- a/dag/test/claim/ci/ci_runner_target_witness_test.dag
+++ b/dag/test/claim/ci/ci_runner_target_witness_test.dag
@@ -15,7 +15,11 @@ test fn witness_selected_target_projects_fleet() -> Bool {
 
 test fn witness_ubicloud_target_projects_catalog_label() -> Bool {
   match ci_runner_target_spec(target: UbicloudRunner { row: ubicloud_standard_16_arm_catalog }) {
-    SelfHosted { labels: ls } => ls.length() == 1 && ls.first() == "ubicloud-standard-16-arm"
+    SelfHosted { labels: ls } => ls.length() == 1
+      && match ls.first() {
+        Present { value: l } => l == "ubicloud-standard-16-arm"
+        Absent => false
+      }
     _ => false
   }
 }
diff --git a/dag/test/claim/ci/deploy_sudoers_host_union_witness_test.dag b/dag/test/claim/ci/deploy_sudoers_host_union_witness_test.dag
new file mode 100644
index 00000000000..a955a78bbeb
--- /dev/null
+++ b/dag/test/claim/ci/deploy_sudoers_host_union_witness_test.dag
@@ -0,0 +1,39 @@
+module test.claim.ci.deploy_sudoers_host_union_witness_test
+
+import std.types { Bool, String, List }
+import gunbc.ci_deploy_access {
+  DeployAccess,
+  ci_deploy_srv1_access,
+  ci_deploy_srv1_operator_access,
+  ci_deploy_srv1_operator_local_access,
+  deploy_accesses_on_host,
+}
+import gunbc.ci_deploy_sudoers { deploy_sudoers_dropin_body, deploy_sudoers_dropin_body_for }
+
+// /etc/sudoers.d/gunbc-deploy IS HOST-SHARED (gunbc.ci_deploy_sudoers deploy_sudoers_dropin_body).
+// The drop-in body is a function of the access alone -- no deployment row reaches it -- so the
+// lab row and the production row render it identically by construction; what these claims pin is
+// that every srv1 access renders the SAME bytes and that those bytes keep the CI runner's grants.
+data ghrunner_systemctl_line: String = "ghrunner ALL=(ALL) NOPASSWD: /usr/bin/systemctl"
+
+test fn every_srv1_access_renders_the_same_dropin_and_it_keeps_the_ci_runner_grants() -> Bool {
+  let local = deploy_sudoers_dropin_body(access: ci_deploy_srv1_operator_local_access)
+  local == deploy_sudoers_dropin_body(access: ci_deploy_srv1_access)
+    && local == deploy_sudoers_dropin_body(access: ci_deploy_srv1_operator_access)
+    && string_contains(s: local, pattern: ghrunner_systemctl_line)
+    && string_contains(s: local, pattern: "briansrls ALL=(ALL) NOPASSWD: /usr/bin/hostnamectl")
+}
+
+fn is_ci_runner_access(a: DeployAccess) -> Bool {
+  (a.principal.posix.name as String) == (ci_deploy_srv1_access.principal.posix.name as String)
+}
+
+// THE DISCRIMINATOR: the same body over the host roster with the CI principal removed loses the
+// runner's lines. This is the drop-in the operator-local apply used to install.
+test fn removing_the_ci_principal_from_the_union_drops_its_grants() -> Bool {
+  let without_ci = filter(
+    xs: deploy_accesses_on_host(host: ci_deploy_srv1_access.host),
+    predicate: a => !is_ci_runner_access(a: a),
+  )
+  !string_contains(s: deploy_sudoers_dropin_body_for(accesses: without_ci), pattern: ghrunner_systemctl_line)
+}
diff --git a/dag/test/claim/ci_workflow_source_read_witness_test.dag b/dag/test/claim/ci_workflow_source_read_witness_test.dag
index 5a40f6b8d24..5e2c48a002f 100644
--- a/dag/test/claim/ci_workflow_source_read_witness_test.dag
+++ b/dag/test/claim/ci_workflow_source_read_witness_test.dag
@@ -46,9 +46,13 @@ test fn a_code_search_page_binds_the_hermetic_fixture_hit() -> Bool {
     CodeSearchPageComplete { page, hits_read } =>
       hits_read == 1
         && count(page.items) == 1
-        && first(page.items).sha == hermetic_code_search_blob_sha
-        && first(page.items).path == hermetic_code_search_path
-        && first(page.items).repository.full_name == hermetic_code_search_repository.full_name
+        && match first(page.items) {
+          Present { value: hit } =>
+            hit.sha == hermetic_code_search_blob_sha
+              && hit.path == hermetic_code_search_path
+              && hit.repository.full_name == hermetic_code_search_repository.full_name
+          Absent => false
+        }
     CodeSearchPageTruncated { page, hits_read, cause } => false
     CodeSearchPageRefused { performance } => false
   }
diff --git a/dag/test/claim/claude_code_dispatch_witness_test.dag b/dag/test/claim/claude_code_dispatch_witness_test.dag
index 77b9d605a4d..e7b780b0886 100644
--- a/dag/test/claim/claude_code_dispatch_witness_test.dag
+++ b/dag/test/claim/claude_code_dispatch_witness_test.dag
@@ -92,7 +92,9 @@ import gunbc.roadmap_dispatch_actuator {
   GunbcHarnessProvider,
   DispatchProviderInnerArgvReady,
   CodexProviderExecutableAbsent,
-  CursorProviderSpawnUnwired,
+  CursorProviderOffCustodyHost,
+  CursorProviderCredentialUnbound,
+  CodexProviderOffCustodyHost,
   GunbcHarnessSpawnNeedsInstance,
   ClaudeProviderCredentialUnbound,
   RecordedAttemptFingerprint,
@@ -404,7 +406,9 @@ test fn the_setup_token_credential_binds_through_the_env_wrapper_never_argv() ->
         && !any(argv, a => starts_with(s: a, prefix: "CLAUDE_CODE_OAUTH_TOKEN=") && !string_contains(s: a, pattern: "\"$0\""))
     ClaudeProviderCredentialUnbound { reason: _ } => false
     CodexProviderExecutableAbsent { reason: _ } => false
-    CursorProviderSpawnUnwired { reason: _ } => false
+    CursorProviderOffCustodyHost { reason: _ } => false
+    CursorProviderCredentialUnbound { reason: _ } => false
+    CodexProviderOffCustodyHost { reason: _ } => false
     GunbcHarnessSpawnNeedsInstance { reason: _ } => false
   }
 }
@@ -418,7 +422,9 @@ test fn an_ambient_profile_tree_is_not_a_bindable_credential() -> Bool {
     ClaudeProviderCredentialUnbound { reason: _ } => true
     DispatchProviderInnerArgvReady { argv: _ } => false
     CodexProviderExecutableAbsent { reason: _ } => false
-    CursorProviderSpawnUnwired { reason: _ } => false
+    CursorProviderOffCustodyHost { reason: _ } => false
+    CursorProviderCredentialUnbound { reason: _ } => false
+    CodexProviderOffCustodyHost { reason: _ } => false
     GunbcHarnessSpawnNeedsInstance { reason: _ } => false
   }
 }
@@ -464,7 +470,9 @@ test fn a_snapshot_that_cannot_be_removed_refuses_the_launch() -> Bool {
       any(argv, a => string_contains(s: a, pattern: "'rm' '-f' '--' \"$0\" || exit 79"))
     ClaudeProviderCredentialUnbound { reason: _ } => false
     CodexProviderExecutableAbsent { reason: _ } => false
-    CursorProviderSpawnUnwired { reason: _ } => false
+    CursorProviderOffCustodyHost { reason: _ } => false
+    CursorProviderCredentialUnbound { reason: _ } => false
+    CodexProviderOffCustodyHost { reason: _ } => false
     GunbcHarnessSpawnNeedsInstance { reason: _ } => false
   }
 }
@@ -630,7 +638,9 @@ test fn the_captured_trip_reaches_a_credential_bound_claude_spawn_on_srv1() -> B
             && any(argv, a => a == "claude")
         ClaudeProviderCredentialUnbound { reason: _ } => false
         CodexProviderExecutableAbsent { reason: _ } => false
-        CursorProviderSpawnUnwired { reason: _ } => false
+        CursorProviderOffCustodyHost { reason: _ } => false
+        CursorProviderCredentialUnbound { reason: _ } => false
+        CodexProviderOffCustodyHost { reason: _ } => false
         GunbcHarnessSpawnNeedsInstance { reason: _ } => false
       }
   }
diff --git a/dag/test/claim/closing/ci_executed_coverage_receipt_closing_contract_witness_test.dag b/dag/test/claim/closing/ci_executed_coverage_receipt_closing_contract_witness_test.dag
index 243b38adadf..e170e5ab8c6 100644
--- a/dag/test/claim/closing/ci_executed_coverage_receipt_closing_contract_witness_test.dag
+++ b/dag/test/claim/closing/ci_executed_coverage_receipt_closing_contract_witness_test.dag
@@ -143,9 +143,15 @@ test fn a_failure_ahead_of_the_corpus_is_a_different_outcome_from_a_corpus_disag
   match stopped {
     CheckCoverageDeniedStopped { completed, unexecuted, cause } =>
       length(unexecuted) == 1
-        && unexecuted.first() == gate_corpus
+        && match unexecuted.first() {
+          Present { value: u } => u == gate_corpus
+          Absent => false
+        }
         && length(completed) == 1
-        && completed.first().gate == gate_witnesses
+        && match completed.first() {
+          Present { value: c } => c.gate == gate_witnesses
+          Absent => false
+        }
         && cause == "the build ahead of the corpus failed and stopped the run"
     CheckCoverageAdmitted => false
     CheckCoverageDeniedAbsent { required_head: _, required_roster: _ } => false
diff --git a/dag/test/claim/cloudflare_r2_token_witness_test.dag b/dag/test/claim/cloudflare_r2_token_witness_test.dag
index d9ab495d953..fdad4e0d700 100644
--- a/dag/test/claim/cloudflare_r2_token_witness_test.dag
+++ b/dag/test/claim/cloudflare_r2_token_witness_test.dag
@@ -204,13 +204,13 @@ test fn r2_object_read_create_request_cites_the_documented_permission_group_id()
     bucket_name: "my-bucket"
   )
   (policy.permission_groups |> count) == 1
-    && (policy.resources |> get(
+    && (match policy.resources |> get(
       r2_bucket_resource_name(
         account_id: "4793d734c0b8e484dfc37ec392b5fa8a",
         jurisdiction: R2JurisdictionDefault,
         bucket_name: "my-bucket"
       )
-    )) == "*"
+    ) { Present { value: v } => v == "*"  Absent => false })
     && all(
       policy.permission_groups,
       g => g.id == workers_r2_storage_bucket_item_read_permission_group_id
diff --git a/dag/test/claim/code_point_slice_witness_test.dag b/dag/test/claim/code_point_slice_witness_test.dag
new file mode 100644
index 00000000000..eebf6e63af8
--- /dev/null
+++ b/dag/test/claim/code_point_slice_witness_test.dag
@@ -0,0 +1,94 @@
+module test.claim.code_point_slice_witness
+
+import std.algebra { Cons }
+import std.coercion { unicode_scalar_unfold, unicode_scalar_fold }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// A BODY READ BY OFFSET, THROUGH THE CODE-POINT SLICE. The text is unfolded to its code points
+// once; every later read is one member (`get`), the length (`count`) or a bounded slice
+// (`skip` then `take`) folded back to host text. std.primitives get_contract, count_contract,
+// skip_contract and take_contract price each of those at log len or better on the persistent
+// carrier, so the walk is O(n log n) in the body on every input -- the remainder copying that made
+// it quadratic is gone. Host-text char_at / substring are O(offset) per read on non-ASCII text in
+// the interpreter and on all text in emitted Rust, which is the quadratic this surface avoids.
+// The bodies here are non-ASCII on purpose: that is the input the host-text walk is quadratic on.
+//
+// The wire shape is the length-prefixed field `<decimal count>:<that many code points>`, repeated.
+type CodePointField {
+  value: String
+  next: Int
+}
+
+fn cps_find(cps: List<Int>, at: Int, stop: Int) -> Int? {
+  match get(xs: cps, index: at) {
+    Absent => none
+    Present { value: c } => if c == stop { Present { value: at } } else { cps_find(cps: cps, at: at + 1, stop: stop) }
+  }
+}
+
+fn cps_slice_text(cps: List<Int>, start: Int, end: Int) -> String {
+  unicode_scalar_fold(xs: cps |> skip(n: start) |> take(n: end - start))
+}
+
+fn cps_field(cps: List<Int>, at: Int) -> CodePointField? {
+  match cps_find(cps: cps, at: at, stop: code_point(c: ":")) {
+    Absent => none
+    Present { value: colon } =>
+      match parse_int(s: cps_slice_text(cps: cps, start: at, end: colon)) {
+        Absent => none
+        Present { value: n } =>
+          if n < 0 || colon + 1 + n > count(cps) {
+            none
+          } else {
+            Present { value: CodePointField { value: cps_slice_text(cps: cps, start: colon + 1, end: colon + 1 + n), next: colon + 1 + n } }
+          }
+      }
+  }
+}
+
+fn cps_fields(cps: List<Int>, at: Int, acc: List<String>) -> List<String>? {
+  if at == count(cps) {
+    Present { value: reverse(acc) }
+  } else {
+    match cps_field(cps: cps, at: at) {
+      Absent => none
+      Present { value: f } => cps_fields(cps: cps, at: f.next, acc: Cons { head: f.value, tail: acc })
+    }
+  }
+}
+
+fn decode_fields(body: String) -> List<String>? {
+  cps_fields(cps: unicode_scalar_unfold(s: body), at: 0, acc: [])
+}
+
+// The body doubled `times` times: linear to build, so the measured walk is the only quadratic
+// candidate in the claim.
+fn doubled(s: String, times: Int) -> String {
+  if times <= 0 { s } else { doubled(s: concat(s, s), times: times - 1) }
+}
+
+// POSITIVE CONTROL: the slice reads the right code points, including astral ones (one code point,
+// four UTF-8 bytes) and a field whose length prefix is two digits.
+test fn code_point_slice_decodes_non_ascii_fields() -> Bool {
+  decode_fields(body: "2:\u{e9}\u{4e2d}3:\u{1f600}ab0:12:\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}") == Present { value: ["\u{e9}\u{4e2d}", "\u{1f600}ab", "", "\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}"] }
+}
+
+// A length prefix that runs past the body is refused, not truncated.
+test fn code_point_slice_refuses_an_overlong_field() -> Bool {
+  decode_fields(body: "4:\u{e9}\u{4e2d}") == none
+}
+
+// THE WALK OVER MANY FIELDS: 512 non-ASCII fields, 3,072 code points, sized under the floor's
+// new-witness eval-step budget (v2.workflow.required_floor). This claim's subject is that the
+// decode stays correct field after field; the COST of the walk is not measured here, because eval
+// steps cannot see a host-level copy. The cost controls that can, RED on the copying forms and
+// GREEN on the sharing ones, are gunbc.repo_self_build repo_self_slice_cost_control_command, run on
+// the merge path by the generated job's slice cost step.
+test fn code_point_slice_walk_is_correct_at_scale() -> Bool {
+  match decode_fields(body: doubled(s: "3:\u{e9}\u{4e2d}\u{1f600}", times: 9)) {
+    Absent => false
+    Present { value: fs } => count(fs) == 512 && fs |> all(f => f == "\u{e9}\u{4e2d}\u{1f600}")
+  }
+}
diff --git a/dag/test/claim/codex_app_server_press_witness_test.dag b/dag/test/claim/codex_app_server_press_witness_test.dag
index 4d0ca454833..0089646a317 100644
--- a/dag/test/claim/codex_app_server_press_witness_test.dag
+++ b/dag/test/claim/codex_app_server_press_witness_test.dag
@@ -709,6 +709,7 @@ fn codex_account_trip_transport_surface_text() -> String {
   let invocation = codex_press_account_trip_invocation(
     executable: "/usr/local/bin/codex" as FilePath,
     codex_home: "/home/witness/.codex" as FilePath,
+    lock: none,
   )
   let argument_words: List<String> = list_flat_map(
     xs: cli_surface_arguments(surface: process_argv_expansion_surface(expansion: invocation)),
@@ -743,6 +744,7 @@ test fn codex_account_trip_typed_invocation_preserves_trip_semantics() -> Bool {
   let invocation = codex_press_account_trip_invocation(
     executable: "/usr/local/bin/codex" as FilePath,
     codex_home: "/home/witness/.codex" as FilePath,
+    lock: none,
   )
   let words: List<String> = list_flat_map(
     xs: cli_surface_arguments(surface: process_argv_expansion_surface(expansion: invocation)),
diff --git a/dag/test/claim/codex_harness_credential_witness_test.dag b/dag/test/claim/codex_harness_credential_witness_test.dag
new file mode 100644
index 00000000000..22ac87667c3
--- /dev/null
+++ b/dag/test/claim/codex_harness_credential_witness_test.dag
@@ -0,0 +1,149 @@
+module test.claim.codex_harness_credential
+
+import std.types { String, Bool, NonEmptyStr, Secret }
+import extdeps.filesystem.filesystem_io { FilesystemFileRead, FilesystemFileIndeterminate }
+import gunbc.codex_harness_credential {
+  CodexHarnessAuthIdentity,
+  CodexHarnessAuthAdmitted,
+  CodexHarnessAuthRefused,
+  CodexHarnessAuthModeNotChatgpt,
+  CodexHarnessAuthModeAbsent,
+  CodexHarnessAuthMemberMissing,
+  CodexHarnessAuthFileUnparseable,
+  CodexHarnessWriteBackNotOwed,
+  CodexHarnessWriteBackOwed,
+  CodexHarnessWriteBackRefused,
+  CodexHarnessReadBackAccountChanged,
+  CodexHarnessReadBackUnobservable,
+  CodexHarnessReadBackRefused,
+  codex_harness_auth_read,
+  codex_harness_write_back_decision,
+}
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// Supplied auth.json documents in the layout extdeps.llm.codex_auth records (keys only; the token
+// values are inert placeholders, never a real credential).
+data chatgpt_auth_v1: String = "{\"auth_mode\":\"chatgpt\",\"OPENAI_API_KEY\":null,\"tokens\":{\"id_token\":\"h.p.s\",\"access_token\":\"h.p.s\",\"refresh_token\":\"rt-one\",\"account_id\":\"acct-a\"},\"last_refresh\":\"2026-10-05T00:00:00Z\"}"
+data chatgpt_auth_rotated: String = "{\"auth_mode\":\"chatgpt\",\"OPENAI_API_KEY\":null,\"tokens\":{\"id_token\":\"h.p.s\",\"access_token\":\"h.p.t\",\"refresh_token\":\"rt-two\",\"account_id\":\"acct-a\"},\"last_refresh\":\"2026-10-05T01:00:00Z\"}"
+data chatgpt_auth_other_account: String = "{\"auth_mode\":\"chatgpt\",\"tokens\":{\"id_token\":\"h.p.s\",\"access_token\":\"h.p.s\",\"refresh_token\":\"rt-three\",\"account_id\":\"acct-b\"}}"
+data apikey_auth: String = "{\"auth_mode\":\"apikey\",\"OPENAI_API_KEY\":\"sk-placeholder\"}"
+data chatgpt_auth_no_refresh: String = "{\"auth_mode\":\"chatgpt\",\"tokens\":{\"id_token\":\"h.p.s\",\"access_token\":\"h.p.s\",\"account_id\":\"acct-a\"}}"
+data chatgpt_auth_no_mode: String = "{\"tokens\":{\"refresh_token\":\"rt-one\",\"account_id\":\"acct-a\"}}"
+
+fn materialized_v1() -> CodexHarnessAuthIdentity {
+  CodexHarnessAuthIdentity { account_id: "acct-a" as NonEmptyStr, refresh_token: "rt-one" as Secret }
+}
+
+fn read_back(content: String) -> extdeps.filesystem.filesystem_io.FilesystemFileObservation {
+  FilesystemFileRead { path: "/private/codex-home/auth.json", content: content }
+}
+
+// The payload the operator uploads is admitted, and the two facts the write-back needs are the
+// ones the file carries.
+test fn witness_chatgpt_payload_admitted_with_account_and_refresh_token() -> Bool {
+  match codex_harness_auth_read(content: chatgpt_auth_v1) {
+    CodexHarnessAuthAdmitted { identity } =>
+      (identity.account_id as String) == "acct-a" && (identity.refresh_token as String) == "rt-one"
+    CodexHarnessAuthRefused { cause: _ } => false
+  }
+}
+
+// An API-key auth.json is the other billing mode; the operator ruled subscription mode, so it
+// refuses with the mode it found rather than running codex against it.
+test fn witness_apikey_payload_refused_naming_mode() -> Bool {
+  match codex_harness_auth_read(content: apikey_auth) {
+    CodexHarnessAuthRefused { cause } =>
+      match cause {
+        CodexHarnessAuthModeNotChatgpt { observed } => observed == "apikey"
+        _ => false
+      }
+    CodexHarnessAuthAdmitted { identity: _ } => false
+  }
+}
+
+test fn witness_payload_without_refresh_token_refused_naming_member() -> Bool {
+  match codex_harness_auth_read(content: chatgpt_auth_no_refresh) {
+    CodexHarnessAuthRefused { cause } =>
+      match cause {
+        CodexHarnessAuthMemberMissing { member } => (member as String) == "refresh_token"
+        _ => false
+      }
+    CodexHarnessAuthAdmitted { identity: _ } => false
+  }
+}
+
+test fn witness_payload_without_mode_and_non_json_refused_distinctly() -> Bool {
+  let no_mode = match codex_harness_auth_read(content: chatgpt_auth_no_mode) {
+    CodexHarnessAuthRefused { cause } =>
+      match cause {
+        CodexHarnessAuthModeAbsent => true
+        _ => false
+      }
+    CodexHarnessAuthAdmitted { identity: _ } => false
+  }
+  let not_json = match codex_harness_auth_read(content: "not json") {
+    CodexHarnessAuthRefused { cause } =>
+      match cause {
+        CodexHarnessAuthFileUnparseable => true
+        _ => false
+      }
+    CodexHarnessAuthAdmitted { identity: _ } => false
+  }
+  no_mode && not_json
+}
+
+// THE DISCRIMINATING PAIR. Codex rotated the refresh token during the turn: a new version is owed and
+// it carries the WHOLE file codex wrote. Codex did not refresh: nothing is owed. If the decision
+// compared anything other than the refresh token, one of these two would flip.
+test fn witness_rotated_refresh_token_owes_whole_file() -> Bool {
+  match codex_harness_write_back_decision(materialized: materialized_v1(), read_back: read_back(content: chatgpt_auth_rotated)) {
+    CodexHarnessWriteBackOwed { payload } => (payload as String) == chatgpt_auth_rotated
+    _ => false
+  }
+}
+
+test fn witness_unrotated_refresh_token_owes_nothing() -> Bool {
+  match codex_harness_write_back_decision(materialized: materialized_v1(), read_back: read_back(content: chatgpt_auth_v1)) {
+    CodexHarnessWriteBackNotOwed => true
+    _ => false
+  }
+}
+
+// A file that now names another account is not written back over the operator's credential, even
+// though its refresh token differs: the rotation check alone would have owed a write here.
+test fn witness_account_change_withholds_write_back() -> Bool {
+  match codex_harness_write_back_decision(materialized: materialized_v1(), read_back: read_back(content: chatgpt_auth_other_account)) {
+    CodexHarnessWriteBackRefused { cause } =>
+      match cause {
+        CodexHarnessReadBackAccountChanged { materialized, read_back } =>
+          (materialized as String) == "acct-a" && (read_back as String) == "acct-b"
+        _ => false
+      }
+    _ => false
+  }
+}
+
+test fn witness_unreadable_read_back_withholds_write_back() -> Bool {
+  let indeterminate = match codex_harness_write_back_decision(
+    materialized: materialized_v1(),
+    read_back: FilesystemFileIndeterminate { cause: "listing failed" },
+  ) {
+    CodexHarnessWriteBackRefused { cause } =>
+      match cause {
+        CodexHarnessReadBackUnobservable { detail } => detail == "listing failed"
+        _ => false
+      }
+    _ => false
+  }
+  let corrupted = match codex_harness_write_back_decision(materialized: materialized_v1(), read_back: read_back(content: apikey_auth)) {
+    CodexHarnessWriteBackRefused { cause } =>
+      match cause {
+        CodexHarnessReadBackRefused { cause: _ } => true
+        _ => false
+      }
+    _ => false
+  }
+  indeterminate && corrupted
+}
diff --git a/dag/test/claim/compiler_gate_emit_build_lane_witness_test.dag b/dag/test/claim/compiler_gate_emit_build_lane_witness_test.dag
index 1ca9e719e15..61f7d45b0b8 100644
--- a/dag/test/claim/compiler_gate_emit_build_lane_witness_test.dag
+++ b/dag/test/claim/compiler_gate_emit_build_lane_witness_test.dag
@@ -1,28 +1,18 @@
 module test.claim.compiler_gate_emit_build_lane_witness_test
 
 import std.types { Bool, List, String }
+import std.optional { Present, Absent }
+import extdeps.github.actions { Step, RunStep, UsesStep, WorkflowPermissions }
+import extdeps.languages.yaml.types { YamlString }
 import gunbc.compiler_gate_workflow {
-  compiler_gate_standings_agree,
-  compiler_gate_non_aggregate_job_ids,
-  compiler_gate_lane_standings_hold,
-  compiler_gate_lane_rows, compiler_gate_lane_blocks,
-  compiler_gate_blocking_job_ids,
-  CompilerGateLaneRow, LaneBlocks, LaneAnnouncedNotBlocking,
-  compiler_gate_aggregate_job,
-  compiler_gate_emit_build_job_id, compiler_gate_unit_test_job_id,
-  compiler_gate_floor_job_id, compiler_gate_generated_job_id,
+  compiler_gate_workflow,
+  compiler_gate_required_job, compiler_gate_required_job_id,
+  compiler_gate_fleet_job_condition,
   compiler_gate_emit_build_bound_steps,
   compiler_gate_emit_build_capability_closure_holds,
-  compiler_gate_lane_result_expression,
-  compiler_gate_aggregate_step_env,
-  compiler_gate_aggregate_script_lines,
-  compiler_gate_aggregate_script_lines_for, compiler_gate_aggregate_step_env_for,
-  compiler_gate_blocking_rows_of, CompilerGateLaneStanding, GateArmStrict,
-  compiler_gate_blocking_rows, compiler_gate_lane_rows,
-  compiler_gate_same_repo_expression, compiler_gate_floor_job_condition,
   compiler_gate_emit_build_notice_step,
   compiler_gate_emit_build_notice_lines,
-  compiler_gate_emit_build_step, compiler_gate_unit_test_job_condition
+  compiler_gate_emit_build_step
 }
 import gunbc.emitted_subject_build_gate {
   NativeEmitBuildStanding, EmitBuildExpectedGreen, EmitBuildExpectedRed, EmittedBuildSignature,
@@ -30,149 +20,106 @@ import gunbc.emitted_subject_build_gate {
   emitted_subject_build_rows,
   emitted_subject_build_label_text,
   emitted_subject_build_command,
-  native_fault_experiment_env_name, native_fault_experiment_skip_value
+  emitted_subject_build_step_name,
+  native_fault_experiment_env_name, native_fault_experiment_skip_value,
+  native_product_reuse_env_name, native_product_reuse_fresh_value,
+  native_step_memory_bind_env_name, native_step_memory_trip_text, native_step_memory_trip,
+  native_step_memory_envelope_env_name, native_step_memory_envelope_slot_value,
+  NativeStepMemoryInput, native_step_memory_inputs,
+  emit_build_memory_envelope_lines
+}
+import std.measure { byte_size_count }
+import gunbc.runner_slot_desired {
+  gunbc_runner_slot_desired,
+  JobOwnsNoBoundedCgroup, JobOwnsBoundedCgroup, gunbc_runner_slot_job_cgroup_ownership
 }
 import extdeps.exec.command { shell_command_render }
 import v2.std.algebra { length, filter }
 import extdeps.filesystem.filesystem_io
 import gunbc.instrument_targets { self_host_entry, v2_native_cli_entry }
 
-// WHAT THIS FILE DISCRIMINATES. Three facts, and each has a red that is authorable HERE rather
-// than only by a future edit to the workflow: the aggregate-enrollment predicate refuses a lane
-// that runs without being needed and refuses a `needs` entry naming no job; the emit-build lane is
-// actually enrolled in the live workflow; and the lane's steps invoke the two declared instrument
-// labels rather than a spelling of them.
+// WHAT THIS FILE DISCRIMINATES, after the operator ruling of 2026-10-09 collapsed the emit-build
+// lane and the aggregate that read it into ONE required job named `witnesses`: that the workflow
+// runs exactly that job and nothing beside it; that the job's steps invoke the two declared
+// instrument labels rather than a spelling of them, one step per subject; that every subject step
+// asks for a FRESH product and the job binds no native product store, so a restored final product
+// cannot stand in for the emission and build the job claims; that the job is fleet-guarded; and
+// that the failure notice a stranger reads is rendered blocking, discriminating and owner-free.
+//
+// THE CLAIMS OVER THE DERIVED AGGREGATE LEFT WITH IT -- lane rows, standings, the env block and the
+// shell conditionals folded from them. With one job there is no roster to join, and a claim that
+// the job list equals a one-row roster would be a count of one standing where the job list is.
 //
 // THE INHABITANCE HALF IS THE LIVE WORKFLOW ITSELF (DESIGN section 3, the pairing obligation):
-// every claim below that supplies a job set or a needs list is paired with one that reads
-// `compiler_gate_lane_standings_hold` and `compiler_gate_emit_build_job` on the real value,
-// so deleting the enrollment from the workflow reddens this file even though the parameterized
-// claims would still pass.
-
-data fixture_jobs: List<String> = ["compiler", "clippy", "emit-build", "floor"]
-data fixture_all_blocking: List<String> = ["compiler", "clippy", "emit-build", "floor"]
-
-test fn standings_agree_when_every_blocker_is_needed_and_nothing_else_is() -> Bool {
-  compiler_gate_standings_agree(
-    job_ids: fixture_jobs,
-    rostered: fixture_jobs,
-    blocking: fixture_all_blocking,
-    needs: fixture_all_blocking
-  )
+// every claim below reads `compiler_gate_workflow` or `compiler_gate_required_job` on the real
+// value, so a change to the emitted workflow reddens this file.
+
+fn step_run_text(step: Step) -> String {
+  match step {
+    RunStep { name: _, id: _, run: run, shell: _, env: _, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => run
+    UsesStep { name: _, id: _, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => ""
+  }
 }
 
-// A DECLARED NON-BLOCKING LANE IS ADMITTED, which is the state this change lands in. It is in the
-// workflow and in the roster and deliberately NOT in `needs`.
-test fn a_declared_non_blocking_lane_is_admitted() -> Bool {
-  compiler_gate_standings_agree(
-    job_ids: fixture_jobs,
-    rostered: fixture_jobs,
-    blocking: ["compiler", "clippy", "floor"],
-    needs: ["compiler", "clippy", "floor"]
-  )
+fn step_name_text(step: Step) -> String {
+  match step {
+    RunStep { name: n, id: _, run: _, shell: _, env: _, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
+      match n { Present { value: v } => v  Absent => "" }
+    UsesStep { name: n, id: _, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
+      match n { Present { value: v } => v  Absent => "" }
+  }
 }
 
-// THE FAIL-OPEN. A job in the workflow that no row accounts for -- its non-blocking standing
-// inferrable from an absence, where a forgotten edge and a deliberate interim are the same bytes.
-test fn w_RED_a_job_with_no_standing_row_refuses() -> Bool {
-  compiler_gate_standings_agree(
-    job_ids: fixture_jobs,
-    rostered: ["compiler", "clippy", "floor"],
-    blocking: ["compiler", "clippy", "floor"],
-    needs: ["compiler", "clippy", "floor"]
-  ) == false
-}
-
-// A LANE DECLARED BLOCKING THAT THE GATE DOES NOT READ. This is the original fail-open: the row
-// says it blocks, the aggregate never asked, and the required context greens over it.
-test fn w_RED_a_blocking_lane_absent_from_needs_refuses() -> Bool {
-  compiler_gate_standings_agree(
-    job_ids: fixture_jobs,
-    rostered: fixture_jobs,
-    blocking: fixture_all_blocking,
-    needs: ["compiler", "clippy", "floor"]
-  ) == false
-}
-
-// THE OTHER DIRECTION, WHICH FAILS DIFFERENTLY AND SILENTLY: an unknown `needs` context renders
-// as the empty string, which is not `success`, so a stale name refuses every run and reads as a
-// broken lane rather than a broken reference.
-test fn w_RED_a_needs_entry_that_no_row_declares_blocking_refuses() -> Bool {
-  compiler_gate_standings_agree(
-    job_ids: fixture_jobs,
-    rostered: fixture_jobs,
-    blocking: ["compiler", "clippy", "floor"],
-    needs: ["compiler", "clippy", "floor", "required-v2-native"]
-  ) == false
-}
-
-// A ROW FOR A JOB THE WORKFLOW DOES NOT RUN. Bookkeeping about nothing, and the shape a roster
-// takes as it rots.
-test fn w_RED_a_standing_row_for_a_job_that_does_not_exist_refuses() -> Bool {
-  compiler_gate_standings_agree(
-    job_ids: ["compiler", "clippy", "floor"],
-    rostered: fixture_jobs,
-    blocking: ["compiler", "clippy", "floor"],
-    needs: ["compiler", "clippy", "floor"]
-  ) == false
-}
-
-// INHABITANCE: the predicate is not merely true of fixtures, it is true of the workflow this
-// module emits -- and emission refuses if it is not.
-test fn the_live_workflow_standings_agree_with_its_gate() -> Bool {
-  compiler_gate_lane_standings_hold()
-}
-
-// INHABITANCE: the emit-build lane is a job in the live workflow and carries a row.
-test fn the_emit_build_lane_is_a_job_and_is_rostered() -> Bool {
-  any(compiler_gate_non_aggregate_job_ids(), id => id == compiler_gate_emit_build_job_id)
-    && any(
-      compiler_gate_lane_rows() |> map(r => r.job_id),
-      id => id == compiler_gate_emit_build_job_id
-    )
+fn step_env_has(step: Step, key: String, value: String) -> Bool {
+  match step {
+    RunStep { name: _, id: _, run: _, shell: _, env: e, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
+      match e {
+        Present { value: kvs } => any(kvs, k =>
+          k.key == key && (match k.value { YamlString { value: v } => v == value  _ => false }))
+        Absent => false
+      }
+    UsesStep { name: _, id: _, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => false
+  }
 }
 
-// AND IT BLOCKS. The E0573 standing is retired and the operator signed off the fleet claim on
-// 2026-10-02, so the row is LaneBlocks. Reads the LIVE roster and aggregate, so a revert of the
-// row, or a flip that forgets the fleet move (refused by compiler_gate_merge_path_runs_on_the_fleet),
-// is seen here.
-test fn the_emit_build_lane_blocks_and_is_read_by_the_gate() -> Bool {
-  any(compiler_gate_blocking_job_ids(), id => id == compiler_gate_emit_build_job_id)
-    && any(compiler_gate_aggregate_job().needs, n => n == compiler_gate_emit_build_job_id)
-}
-
-// THE ESTABLISHED LANES STILL BLOCK, NAMED RATHER THAN COUNTED. Without this, the claim above would
-// be satisfied by a gate that reads nothing at all. It joins at identity grain in both directions
-// (DESIGN section 5: completeness is an identity join, not a count equality), so dropping a lane,
-// or adding one that blocks without being named here, reds it -- where the earlier `== 3` would
-// have let a swapped lane through. The generated-artifact lane joined the set by the 2026-09-27
-// ruling that moved it beside the floor; the hosted compiler and clippy lanes left it by the
-// 2026-09-28 ruling that put the merge path on the fleet (the seed build is the fleet prelude's, and
-// the lint is a step on `generated`); emit-build joined it on the 2026-10-02 sign-off; the v1 unit-test lane rejoined it when
-// the lane blocked again after gunbc#13452 (gunbc.rung_drop rust_unit_tests_over_their_cap superseded, not retired by its trigger).
-test fn the_established_lanes_still_block() -> Bool {
-  let blocking = compiler_gate_blocking_job_ids()
-  let established = [compiler_gate_unit_test_job_id, compiler_gate_emit_build_job_id, compiler_gate_floor_job_id, compiler_gate_generated_job_id]
-  all(established, id => any(blocking, b => b == id))
-    && all(blocking, b => any(established, id => id == b))
-    && all(blocking, id => any(compiler_gate_aggregate_job().needs, n => n == id))
-}
-
-// A NON-BLOCKING STANDING CARRIES ITS FLIP TRIGGER. A standing with no trigger is an indefinite
-// exemption wearing an interim's clothes (DESIGN section 4b(2): a class below its ceiling must
-// name its next-rung trigger), and an empty string would satisfy a presence-only check.
-test fn every_non_blocking_lane_names_what_would_flip_it() -> Bool {
-  all(compiler_gate_lane_rows(), row =>
-    match row.standing {
-      LaneBlocks => true
-      LaneAnnouncedNotBlocking { flip_trigger: t } => string_contains(s: t, pattern: "Sufficient for:")
-    }
-  )
+// ═══ ONE JOB, AND IT CARRIES THE RULESET'S CONTEXT ═══
+
+// THE WORKFLOW RUNS EXACTLY THE REQUIRED JOB. Read at identity grain in both directions: a second
+// job (an aggregate regrown, a lane returned) reds this, and so does a workflow that lost the job.
+test fn the_workflow_runs_exactly_the_required_job() -> Bool {
+  let ids = compiler_gate_workflow.jobs |> map(j => j.id)
+  compiler_gate_required_job_id == "witnesses"
+    && any(ids, id => id == compiler_gate_required_job_id)
+    && all(ids, id => id == compiler_gate_required_job_id)
 }
 
+// THE FOUR WITHDRAWN LANES ARE NOT JOBS (operator ruling 2026-10-09, gunbc.rung_drop
+// v1_required_lanes_withdrawn). Each id is named, because a workflow carrying one of them again is
+// exactly the state a partial revert of the cut would leave; the claim above is the positive half.
+data withdrawn_lane_job_ids: List<String> = ["rust-unit-tests", "seed", "floor", "generated", "emit-build"]
+
+test fn w_RED_the_withdrawn_lanes_are_not_jobs() -> Bool {
+  let ids = compiler_gate_workflow.jobs |> map(j => j.id)
+  all(withdrawn_lane_job_ids, w => any(ids, id => id == w) == false)
+}
+
+// THE JOB IS FLEET-GUARDED: fork code does not run on the fleet, so a fork pull request produces no
+// `witnesses` check (unobserved, never excused). The guard is the one authority
+// (compiler_gate_fleet_job_condition) rather than a second spelling of it.
+test fn the_required_job_is_fleet_guarded() -> Bool {
+  match compiler_gate_required_job().if_condition {
+    Present { value: c } =>
+      c == compiler_gate_fleet_job_condition() && string_contains(s: c, pattern: "github.repository")
+    Absent => false
+  }
+}
+
+// ═══ THE SUBJECTS ═══
+
 // THE SUBJECTS ARE THE TWO RETAINED NATIVE COMPILATIONS, BY LABEL. A green here that named one
-// subject would be the coverage claim without the coverage.
-test fn the_lane_runs_both_retained_emit_build_subjects() -> Bool {
+// subject would be the coverage claim without the coverage; a third row is the growth the operator
+// vetoed on 2026-10-09 (the roster "remains the two compiler products").
+test fn the_job_runs_both_retained_emit_build_subjects() -> Bool {
   (emitted_subject_build_rows() |> map(r => emitted_subject_build_label_text(row: r))) == [
     "//gunbc/instruments:self-host",
     "//gunbc/instruments:v2-native-cli"
@@ -190,153 +137,154 @@ test fn each_subject_is_invoked_through_gunbc_test() -> Bool {
   )
 }
 
-// ONE STEP PER SUBJECT ON TOP OF THE SHARED PRELUDE, and the prelude is the fleet prelude's six
-// steps (checkout, home isolation, toolchain, pin, build, isolated-homes guard). A lane that grew a subject without growing a step would run one compilation and report on
-// two.
-// SIX PRELUDE STEPS, ONE PER SUBJECT, AND ONE STANDING-NOTICE STEP AT THE END. The `+ 1` was
-// added by the change that introduced the notice, and this claim FAILED until it was -- which is
-// the count doing its job rather than a number kept in step by hand.
-test fn the_lane_binds_one_step_per_subject_above_the_prelude() -> Bool {
-  length(xs: compiler_gate_emit_build_bound_steps())
-    == 6 + length(xs: emitted_subject_build_rows()) + 1
+// ONE STEP PER SUBJECT, JOINED AT IDENTITY RATHER THAN COUNTED. A job that grew a subject without
+// growing a step would run one compilation and report on two; a job that kept a step for a subject
+// no row declares would report on a compilation nobody rostered. Both directions are read by step
+// NAME, which gunbc.emitted_subject_build_gate derives from the row's label.
+test fn the_job_binds_one_step_per_subject() -> Bool {
+  let names = compiler_gate_emit_build_bound_steps() |> map(b => b.step_name)
+  let subject_names = emitted_subject_build_rows() |> map(r => emitted_subject_build_step_name(row: r))
+  all(subject_names, s => length(xs: filter(xs: names, predicate: fn(n) { n == s })) == 1)
+    && length(xs: filter(xs: names, predicate: fn(n) { string_contains(s: n, pattern: "emit and build ") }))
+      == length(xs: subject_names)
 }
 
-// THE CARGO CONSUMER HAS A PROVIDER ORDERED BEFORE IT. This is the same closure check every other
-// lane in the workflow carries, asked of the lane this change adds.
-test fn the_lane_capability_closure_holds() -> Bool {
+// THE CARGO CONSUMER HAS A PROVIDER ORDERED BEFORE IT.
+test fn the_job_capability_closure_holds() -> Bool {
   compiler_gate_emit_build_capability_closure_holds()
 }
 
-// THE HYPHEN TRAP, ASKED OF THE LANE THIS CHANGE ADDS. `-` is subtraction in the Actions
-// expression language, so `needs.emit-build.result` renders EMPTY on every run -- including
-// all-green ones -- and the aggregate would compare empty against `success` and refuse forever: a
-// gate whose only reachable state is red. The claim asserts the INDEX FORM IS PRESENT and the
-// DOTTED FORM IS ABSENT, because a renderer that emitted both would satisfy a presence-only check
-// while still carrying the arithmetic.
-test fn a_hyphenated_lane_result_renders_as_an_index() -> Bool {
-  let rendered = compiler_gate_lane_result_expression(job_id: compiler_gate_emit_build_job_id)
-  string_contains(s: rendered, pattern: "needs['emit-build'].result")
-    && (string_contains(s: rendered, pattern: "needs.emit-build") == false)
+// ═══ FRESH PRODUCTS, NO STORE (operator ruling 2026-10-09, second correction) ═══
+
+// EVERY SUBJECT STEP ASKS FOR A FRESH PRODUCT, BY VALUE. The runner under this input consults no
+// native product store and refuses one if bound (native_lane_runner PRODUCT_REUSE_ENV), so the
+// step's green means THIS run emitted and built the product. A step lacking the input, or carrying
+// a different value, would let a restored hit satisfy the step.
+test fn every_subject_step_requires_a_fresh_product() -> Bool {
+  all(emitted_subject_build_rows(), row =>
+    step_env_has(step: compiler_gate_emit_build_step(row: row), key: native_product_reuse_env_name, value: native_product_reuse_fresh_value))
 }
 
-// AND THE DOT-SAFE LANES ARE UNCHANGED BY ROUTING THEM THROUGH THE SAME AUTHORITY, which is the
-// claim that makes the consolidation safe rather than merely tidy.
-test fn a_dot_safe_lane_result_still_renders_as_a_dereference() -> Bool {
-  compiler_gate_lane_result_expression(job_id: compiler_gate_floor_job_id) == "${{ needs.floor.result }}"
+// EVERY SUBJECT STEP REQUIRES THE SLOT'S ENVELOPE, BY VALUE, WHATEVER THE DROP'S STANDING: the
+// input gunbc test reads as "refuse unless a cgroup memory.max binds this step, and refuse an OOM
+// kill or swap inside it". A step without it would run unreceipted inside the slot.
+test fn every_subject_step_requires_the_slot_envelope() -> Bool {
+  all(emitted_subject_build_rows(), row =>
+    step_env_has(step: compiler_gate_emit_build_step(row: row), key: native_step_memory_envelope_env_name, value: native_step_memory_envelope_slot_value))
 }
 
-// ═══ THE GATE IS DERIVED, WHICH IS WHAT `needs` ALONE COULD NOT ESTABLISH (review 69973) ═══
-//
-// This job is `if: always()`, so a `needs` edge only ORDERS it: the verdict is computed from the
-// env bindings and the shell conditionals. A roster joined against `needs` alone therefore moved
-// the silent absence from the `needs` list to the ENV list rather than removing it. These claims
-// are over the surfaces that actually decide.
-
-// EVERY BLOCKING LANE BINDS A VARIABLE AND NOTHING ELSE DOES. The `+ 1` is SAME_REPO, which is
-// not a lane result; asserting the exact count is what refuses a stray binding as well as a
-// missing one.
-test fn the_env_block_binds_exactly_the_blocking_lanes_and_same_repo() -> Bool {
-  let env = compiler_gate_aggregate_step_env()
-  length(xs: env) == length(xs: compiler_gate_blocking_rows()) + 1
-    && all(compiler_gate_blocking_rows(), row =>
-      any(env, e => e.key == row.var_name))
-}
-
-// EVERY BLOCKING LANE IS READ BY A CONDITIONAL. A variable bound and never read is the same
-// fail-open one surface further in: the gate would carry the lane's result and never consult it.
-test fn every_blocking_lane_is_read_by_a_conditional() -> Bool {
-  let script = join(compiler_gate_aggregate_script_lines(), "\n")
-  all(compiler_gate_blocking_rows(), row =>
-    string_contains(s: script, pattern: join(["\"$", row.var_name, "\" = failure"], "")))
-}
-
-// AN ANNOUNCED LANE REACHES NO SURFACE OF THE GATE -- a LAW over any roster, so it is stated over a
-// SUPPLIED LaneAnnouncedNotBlocking row rather than over a live lane, which today has none. Were an
-// announced lane bound, its variable would render EMPTY, compare unequal to `success`, and refuse
-// every run. The positive half renders the SAME row as LaneBlocks and requires it to reach every
-// surface, so the claim cannot pass by the builders emitting nothing for that row.
-fn announced_probe_row(standing: CompilerGateLaneStanding) -> CompilerGateLaneRow {
-  CompilerGateLaneRow { job_id: "probe-lane", var_name: "PROBE_LANE", standing: standing, arm: GateArmStrict }
-}
-
-test fn w_RED_an_announced_lane_binds_no_variable_and_is_read_by_no_clause() -> Bool {
-  let announced = [announced_probe_row(standing: LaneAnnouncedNotBlocking { flip_trigger: "Sufficient for: probe" })]
-  let blocking = [announced_probe_row(standing: LaneBlocks)]
-  let announced_script = join(compiler_gate_aggregate_script_lines_for(rows: announced), "\n")
-  let blocking_script = join(compiler_gate_aggregate_script_lines_for(rows: blocking), "\n")
-  (any(compiler_gate_aggregate_step_env_for(rows: announced), e => e.key == "PROBE_LANE") == false)
-    && (string_contains(s: announced_script, pattern: "PROBE_LANE") == false)
-    && (length(xs: compiler_gate_blocking_rows_of(rows: announced)) == 0)
-    && any(compiler_gate_aggregate_step_env_for(rows: blocking), e => e.key == "PROBE_LANE")
-    && string_contains(s: blocking_script, pattern: "[ \"$PROBE_LANE\" = failure ]")
-    && string_contains(s: blocking_script, pattern: "[ \"$PROBE_LANE\" != success ]")
-}
-
-// AND THE DELETED UNIT-TEST LANE REACHES NEITHER SURFACE. Without this the gate could read a lane
-// that no longer runs -- whose variable would render EMPTY, compare unequal to `success`, and refuse
-// every run. emit-build left this claim on the 2026-10-02 sign-off: it now BLOCKS, and
-// the_emit_build_lane_blocks_and_is_read_by_the_gate asserts the opposite of what this claim
-// asserted about it. No live lane is announced today, so the announced-lane mechanism itself is held by
-// the supplied-row claim w_RED_an_announced_lane_binds_no_variable_and_is_read_by_no_clause.
-test fn w_RED_the_deleted_unit_test_lane_reaches_neither_surface() -> Bool {
-  let script = join(compiler_gate_aggregate_script_lines(), "\n")
-  let env = compiler_gate_aggregate_step_env()
-  (any(env, e => e.key == "RUST_UNIT_TESTS") == false)
-    && (string_contains(s: script, pattern: "RUST_UNIT_TESTS") == false)
-}
-
-// THE FORK CARVE-OUT IS A ROW FIELD, SO IT TRAVELS WITH ITS LANE. A fleet lane legitimately skips
-// on a fork pull request, and since the 2026-09-28 ruling every blocking lane is a fleet lane, so
-// each carries its own carve-out clause -- read per lane, because a script that excused one lane's
-// skip under another lane's variable would admit an unobserved head.
-test fn every_blocking_fleet_lane_carries_its_own_skip_notice() -> Bool {
-  let script = join(compiler_gate_aggregate_script_lines(), "\n")
-  string_contains(s: script, pattern: "$SAME_REPO\" = false ] && [ \"$FLOOR\" = skipped")
-    && string_contains(s: script, pattern: "$SAME_REPO\" = false ] && [ \"$GENERATED\" = skipped")
-}
-
-// THE COMPARISON IS `!= success`, NOT AN ENUMERATION OF BAD STATES. Run 32883390033 read
-// FLOOR="abandoned", a needs-result value nobody knew was reachable; an enumerated guard would
-// have greened over two lanes that never ran. Derivation must not have quietly widened it.
-test fn the_unobserved_arm_refuses_every_state_but_success() -> Bool {
-  let script = join(compiler_gate_aggregate_script_lines(), "\n")
-  string_contains(s: script, pattern: "\"$FLOOR\" != success")
-    && string_contains(s: script, pattern: "\"$GENERATED\" != success")
-    && (string_contains(s: script, pattern: "= cancelled") == false)
-    && (string_contains(s: script, pattern: "= abandoned") == false)
-}
-
-// NO CONDITIONAL OVER ZERO LANES. With no strict lane left blocking, the strict arm's line would
-// render `if ; then` -- a shell syntax error that reds the required context on every run. The
-// strict arm is omitted instead (compiler_gate_unobserved_lines); rendering it anyway reds this.
-test fn w_RED_the_gate_script_renders_no_empty_conditional() -> Bool {
-  let script = join(compiler_gate_aggregate_script_lines(), "\n")
-  (string_contains(s: script, pattern: "if ; then") == false)
-    && (string_contains(s: script, pattern: "if  || ") == false)
-}
-
-// THE FORK PREDICATE IS ONE PREDICATE IN TWO TRANSPORTS (review 69999). The floor lane's job `if`
-// takes it bare; the gate's step env takes it interpolated. If those ever became two spellings,
-// the two failure modes are opposite and both silent: the fleet lane skips while the gate refuses
-// (a merge-queue stall on every fork PR), or the gate excuses a skip that was not fork-driven (an
-// unobserved head admitted). The claim asserts CONTAINMENT rather than equality, because the
-// transports legitimately differ by exactly the delimiters.
-test fn the_fork_predicate_has_one_authority_across_both_transports() -> Bool {
-  string_contains(
-    s: compiler_gate_same_repo_expression(),
-    pattern: compiler_gate_floor_job_condition()
-  )
-    && string_contains(s: compiler_gate_same_repo_expression(), pattern: "${{ ")
-    && string_contains(s: compiler_gate_floor_job_condition(), pattern: "github.repository")
+fn inputs_carry(inputs: List<NativeStepMemoryInput>, name: String, value: String) -> Bool {
+  all(inputs, i => i.env_name != name || i.env_value != value) == false
+}
+
+// THE BIND INPUT FOLLOWS THE FLEET FACT, BY SUPPLIED VALUE: a job that owns no bounded cgroup is
+// handed the slot requirement alone; a job that does is handed the requirement and the bind at the
+// derived trip. RED if an arm hands the fleet a bind it cannot honour, or keeps withholding one it
+// can.
+test fn the_bind_input_follows_the_fleet_fact() -> Bool {
+  let without = native_step_memory_inputs(ownership: JobOwnsNoBoundedCgroup { why: "a job runs deprivileged under a root unit" })
+  let with = native_step_memory_inputs(ownership: JobOwnsBoundedCgroup { staged_by: "the root JIT wrapper, before setpriv" })
+  length(without) == 1
+    && inputs_carry(inputs: without, name: native_step_memory_envelope_env_name, value: native_step_memory_envelope_slot_value)
+    && length(with) == 2
+    && inputs_carry(inputs: with, name: native_step_memory_envelope_env_name, value: native_step_memory_envelope_slot_value)
+    && inputs_carry(inputs: with, name: native_step_memory_bind_env_name, value: native_step_memory_trip_text())
+}
+
+fn step_env_has_key(step: Step, key: String) -> Bool {
+  match step {
+    RunStep { name: _, id: _, run: _, shell: _, env: e, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
+      match e {
+        Present { value: kvs } => all(kvs, k => k.key != key) == false
+        Absent => false
+      }
+    UsesStep { name: _, id: _, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => false
+  }
+}
+
+// AND THE LIVE WORKFLOW CARRIES WHAT THE LIVE FACT DECIDES (the inhabitance half): while a job owns
+// no bounded cgroup no subject step carries the bind KEY at all -- a bind under any other value
+// would refuse on the fleet just the same; the day the fact flips, every step carries it at the
+// trip.
+test fn the_live_steps_carry_the_bind_iff_a_job_owns_a_bounded_cgroup() -> Bool {
+  let carries = all(emitted_subject_build_rows(), row =>
+    step_env_has(step: compiler_gate_emit_build_step(row: row), key: native_step_memory_bind_env_name, value: native_step_memory_trip_text()))
+  let withholds = all(emitted_subject_build_rows(), row =>
+    step_env_has_key(step: compiler_gate_emit_build_step(row: row), key: native_step_memory_bind_env_name) == false)
+  match gunbc_runner_slot_job_cgroup_ownership {
+    JobOwnsNoBoundedCgroup { why: _ } => withholds
+    JobOwnsBoundedCgroup { staged_by: _ } => carries
+  }
+}
+
+// AND THE FAILURE NOTICE EXPLAINS THE ENVELOPE, BY SUPPLIED FACT AND LIVE: which grain bounded the
+// step and the input that required it, the trip and why it is or is not asked for, the exit code
+// the kernel leaves, and that nothing retries bigger. A reader of an exit-137 step would otherwise
+// read it as a crash.
+fn envelope_lines_say(lines: List<String>, pattern: String) -> Bool {
+  string_contains(s: join(lines, "\n"), pattern: pattern)
+}
+
+test fn the_notice_names_the_envelope_and_refuses_a_bigger_retry() -> Bool {
+  let live = compiler_gate_emit_build_notice_lines()
+  let without = emit_build_memory_envelope_lines(ownership: JobOwnsNoBoundedCgroup { why: "a job runs deprivileged under a root unit" })
+  let with = emit_build_memory_envelope_lines(ownership: JobOwnsBoundedCgroup { staged_by: "the root JIT wrapper, before setpriv" })
+  envelope_lines_say(lines: live, pattern: join([native_step_memory_envelope_env_name, "=", native_step_memory_envelope_slot_value], ""))
+    && envelope_lines_say(lines: live, pattern: native_step_memory_trip_text())
+    && envelope_lines_say(lines: live, pattern: "exit of 137")
+    && envelope_lines_say(lines: live, pattern: "no larger runner and no retry")
+    && envelope_lines_say(lines: live, pattern: "MEMORY RECEIPT")
+    && envelope_lines_say(lines: without, pattern: "is not asked for: a job runs deprivileged under a root unit")
+    && envelope_lines_say(lines: without, pattern: "native_step_trip_awaits_fleet_job_cgroup_stall")
+    && envelope_lines_say(lines: without, pattern: "asked the kernel for its own bound at") == false
+    && envelope_lines_say(lines: with, pattern: "asked the kernel for its own bound at")
+    && envelope_lines_say(lines: with, pattern: "the root JIT wrapper, before setpriv")
+    && envelope_lines_say(lines: with, pattern: "is not asked for") == false
+    && match gunbc_runner_slot_job_cgroup_ownership {
+      JobOwnsNoBoundedCgroup { why: _ } => envelope_lines_say(lines: live, pattern: "is not asked for") && envelope_lines_say(lines: live, pattern: "asked the kernel for its own bound at") == false
+      JobOwnsBoundedCgroup { staged_by: _ } => envelope_lines_say(lines: live, pattern: "asked the kernel for its own bound at") && envelope_lines_say(lines: live, pattern: "is not asked for") == false
+    }
+}
+
+// THE JOB BINDS NO NATIVE PRODUCT STORE: no step names the store root variable, no step is a store
+// federation or save, and the job mints no id-token (the store's federations were its only
+// consumer). A store step returning beside the fresh input would make the two contradict, which
+// the runner refuses -- but the contradiction is caught here first, at the authority.
+data native_product_store_step_markers: List<String> = ["GUNBC_NATIVE_CACHE_ROOT", "native-product-read", "native-product-write", "native_product_save_wet"]
+
+test fn w_RED_the_job_binds_no_native_product_store() -> Bool {
+  let steps = compiler_gate_required_job().steps
+  let no_store_text = all(steps, s =>
+    all(native_product_store_step_markers, m =>
+      (string_contains(s: step_run_text(step: s), pattern: m) == false)
+        && (string_contains(s: step_name_text(step: s), pattern: m) == false)))
+  let no_id_token = match compiler_gate_required_job().permissions {
+    Present { value: p } => match p.id_token { Absent => true  Present { value: _ } => false }
+    Absent => true
+  }
+  no_store_text && no_id_token
+}
+
+// THE PER-PR RELIEF IS A MODELED INPUT ON EVERY SUBJECT STEP (gunbc.rung_drop
+// native_fault_experiment_off_pull_requests): each step passes the env var, whose expression skips
+// on pull_request and runs otherwise. A step lacking it would run the fault experiment on PRs.
+test fn every_subject_step_passes_the_fault_experiment_input() -> Bool {
+  all(emitted_subject_build_rows(), row => match compiler_gate_emit_build_step(row: row) {
+    RunStep { name: _, id: _, run: _, shell: _, env: e, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
+      match e {
+        Present { value: kvs } => any(kvs, k => k.key == native_fault_experiment_env_name)
+        Absent => false
+      }
+    UsesStep { name: _, id: _, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => false
+  })
 }
 
 // ═══ THE STANDING NOTICE: WHAT A STRANGER READS WHEN THEY CLICK THE RED X ═══
 //
-// THE LIVE STANDING IS GREEN (both instruments exit zero on main 5bfe79be45c; hosted emit-build
-// green on main c39426540c, run 36580079634), so the red arm is
-// reachable only over a SUPPLIED standing. These claims render it through this probe, so the
-// discriminator, the no-owner rule and the retirement condition stay exercised while no red is
-// declared; the live claim below asserts the green, blocking notice.
+// THE LIVE STANDING IS GREEN, so the red arm is reachable only over a SUPPLIED standing. These
+// claims render it through this probe, so the discriminator, the no-owner rule and the retirement
+// condition stay exercised while no red is declared; the live claim asserts the green, blocking
+// notice -- blocking because the job IS the required context, not because a row says so.
 fn advisory_red_probe_notice() -> String {
   join(emit_build_standing_notice_for(standing: EmitBuildExpectedRed {
     known_signature: EmittedBuildSignature { error_code: "E9999", symbol: "Probe", emitted_path: "src/probe.rs" }
@@ -353,28 +301,19 @@ test fn the_live_notice_is_green_and_blocking() -> Bool {
 }
 
 // THE REASSURANCE ALONE WOULD BE WORSE THAN NOTHING: a standing red teaches every lane to ignore
-// this lane, which is how a detector dies without anyone deciding to kill it. So the notice must
+// this job, which is how a detector dies without anyone deciding to kill it. So the notice must
 // carry the DISCRIMINATOR -- what would be a genuinely new finding -- and not only the comfort.
 test fn the_notice_carries_the_discriminator_and_not_only_the_reassurance() -> Bool {
   let text = join(compiler_gate_emit_build_notice_lines(), "\n")
-  let probe = join(emit_build_standing_notice_for(standing: EmitBuildExpectedRed {
-    known_signature: EmittedBuildSignature { error_code: "E9999", symbol: "Probe", emitted_path: "src/probe.rs" }
-  }, lane_blocks: false), "\n")
+  let probe = advisory_red_probe_notice()
   string_contains(s: probe, pattern: "does NOT block your merge")
     && string_contains(s: probe, pattern: "E9999 Probe at src/probe.rs")
     && string_contains(s: probe, pattern: "DIFFERENT error code")
     && string_contains(s: text, pattern: "REAL FINDING")
 }
 
-// THE NOTICE NAMES NO OWNING PULL REQUEST, and this claim exists because the first cut DID.
-// `owned_by: "gunbc#12070"` was false within the hour -- that repair was measured insufficient for
-// this site, and ownership moved twice in one evening. The typed standing makes the REASSURANCE
-// unprintable once it stops being true and does nothing at all for a volatile fact in a field
-// beside it: a `String` naming a PR rots exactly as fast inside a well-typed row as in a comment.
-//
-// So the guard is a claim rather than a resolution to remember. Any `#` followed by a digit in the
-// rendered notice is a pointer to something that moves, on a surface a stranger reads as
-// authoritative because they have no other source.
+// THE NOTICE NAMES NO OWNING PULL REQUEST, and this claim exists because the first cut DID: a
+// `String` naming a PR rots exactly as fast inside a well-typed row as in a comment.
 test fn w_RED_the_notice_names_no_owning_pull_request() -> Bool {
   let text = join(compiler_gate_emit_build_notice_lines(), "\n")
   (string_contains(s: text, pattern: "#1") == false)
@@ -384,23 +323,16 @@ test fn w_RED_the_notice_names_no_owning_pull_request() -> Bool {
     && (string_contains(s: advisory_red_probe_notice(), pattern: "#1") == false)
 }
 
-// AND IT TELLS A READER WHY THE CAUSE LINE CANNOT BE THE DISCRIMINATOR, because that is the trap:
-// every break at this step shares `cause=EmittedCompilerBuildFailed`, so a reader comparing cause
-// lines concludes "known break" for a defect that is new.
+// AND IT TELLS A READER WHY THE CAUSE LINE CANNOT BE THE DISCRIMINATOR.
 test fn the_notice_says_the_cause_line_does_not_discriminate() -> Bool {
   string_contains(s: advisory_red_probe_notice(), pattern: "cause=EmittedCompilerBuildFailed")
 }
 
-// THE REASSURANCE IS UNPRINTABLE ONCE THE STANDING FLIPS. This renders the Green arm over a
-// SUPPLIED standing, because in production that arm is reachable only by editing the data row --
-// so pasting the reassurance into the Green arm reds here today rather than on the day main
-// self-hosts. The positive half: the same rendering over the Red arm DOES print it, so the claim
-// cannot pass by the renderer printing nothing.
+// THE REASSURANCE IS UNPRINTABLE ONCE THE STANDING FLIPS, rendered over a SUPPLIED standing because
+// in production the Green arm is reachable only by editing the data row.
 test fn w_RED_the_green_standing_cannot_print_the_expected_red_reassurance() -> Bool {
   let green = join(emit_build_standing_notice_for(standing: EmitBuildExpectedGreen, lane_blocks: false), "\n")
-  let red = join(emit_build_standing_notice_for(standing: EmitBuildExpectedRed {
-    known_signature: EmittedBuildSignature { error_code: "E9999", symbol: "Probe", emitted_path: "src/probe.rs" }
-  }, lane_blocks: false), "\n")
+  let red = advisory_red_probe_notice()
   (string_contains(s: green, pattern: "CURRENTLY EXPECTED") == false)
     && (string_contains(s: green, pattern: "E9999") == false)
     && string_contains(s: green, pattern: "REAL FINDING")
@@ -408,10 +340,7 @@ test fn w_RED_the_green_standing_cannot_print_the_expected_red_reassurance() ->
     && string_contains(s: red, pattern: "E9999 Probe at src/probe.rs")
 }
 
-// THE RETIREMENT CONDITION IS CONSUMED BY THE NOTICE, AND NAMES A CAPABILITY. A reader who can see
-// main self-host again is told the notice is stale and which row to flip. Nothing flips the row
-// automatically when the condition holds -- that stays review diligence, and this claim does not
-// pretend otherwise; it establishes only that the condition reaches the surface a reader sees.
+// THE RETIREMENT CONDITION IS CONSUMED BY THE NOTICE, AND NAMES A CAPABILITY.
 test fn the_live_notice_prints_its_retirement_capability() -> Bool {
   let text = advisory_red_probe_notice()
   string_contains(s: text, pattern: "THIS STANDING RETIRES WHEN: ")
@@ -420,11 +349,10 @@ test fn the_live_notice_prints_its_retirement_capability() -> Bool {
     && string_contains(s: text, pattern: "all exit zero")
 }
 
-// WHETHER THE LANE BLOCKS IS READ FROM THE LANE ROW, NOT WRITTEN INTO THE NOTICE. Rendered with the
-// status supplied both ways: a blocking lane never prints the non-blocking reassurance, and a
-// blocking lane with a still-Red standing prints the contradiction rather than "nothing for you to
-// fix". The live half: today's row is `LaneBlocks`, so the live notice says so.
-test fn w_RED_a_blocking_lane_never_prints_the_non_blocking_reassurance() -> Bool {
+// A BLOCKING RENDERING NEVER PRINTS THE NON-BLOCKING REASSURANCE, and a blocking rendering with a
+// still-Red standing prints the contradiction rather than "nothing for you to fix". The live job is
+// always rendered blocking, so the advisory arm is exercised only through the probe.
+test fn w_RED_a_blocking_rendering_never_prints_the_non_blocking_reassurance() -> Bool {
   let probe = EmitBuildExpectedRed {
     known_signature: EmittedBuildSignature { error_code: "E9999", symbol: "Probe", emitted_path: "src/probe.rs" }
   }
@@ -439,16 +367,7 @@ test fn w_RED_a_blocking_lane_never_prints_the_non_blocking_reassurance() -> Boo
     && string_contains(s: advisory_red, pattern: "does NOT block")
 }
 
-test fn the_live_notice_agrees_with_the_live_lane_row() -> Bool {
-  let text = join(compiler_gate_emit_build_notice_lines(), "\n")
-  let blocks = length(xs: filter(xs: compiler_gate_blocking_rows(), predicate: fn(row) {
-    row.job_id == compiler_gate_emit_build_job_id
-  })) > 0
-  string_contains(s: text, pattern: "does NOT block") == (blocks == false)
-}
-
-// THE NOTICE RUNS ONLY ON FAILURE. On every passing PR in the repository it must print nothing --
-// a reassurance with no subject is noise charged to every other lane.
+// THE NOTICE RUNS ONLY ON FAILURE. On every passing PR in the repository it must print nothing.
 test fn the_notice_step_runs_only_on_failure() -> Bool {
   match compiler_gate_emit_build_notice_step() {
     RunStep { name: _, id: _, run: r, shell: _, env: _, working_directory: _, if_condition: c, continue_on_error: _, timeout_minutes: _ } =>
@@ -461,9 +380,8 @@ test fn the_notice_step_runs_only_on_failure() -> Bool {
 }
 
 // AND IT IS THE LAST STEP, so it appears directly beneath the diagnostic a reader is trying to
-// interpret rather than scrolled away above it. Asserted by POSITION rather than by count, because
-// the count is already the claim above and a second copy of it would establish nothing new.
-test fn the_notice_is_the_last_step_in_the_lane() -> Bool {
+// interpret rather than scrolled away above it. Asserted by POSITION rather than by count.
+test fn the_notice_is_the_last_step_in_the_job() -> Bool {
   fold(
     compiler_gate_emit_build_bound_steps(),
     init: "",
@@ -471,12 +389,13 @@ test fn the_notice_is_the_last_step_in_the_lane() -> Bool {
   ) == "Why this lane is red, and what would be a real finding"
 }
 
-// THE SEED'S TWO LANE ENTRIES AGREE WITH THE INSTRUMENT ROWS. The emit-build lane's census subject is
-// read from gunbc.instrument_targets, while the producer that actually emits is the seed's native
-// lane runner, whose entries are Rust constants that cannot read a .dag row yet. This joins them, so
-// moving either entry on one side alone reds here rather than leaving the census reporting a closure
-// the lane no longer compiles. Each constant is matched as its whole declaration line, so the join
-// pins the NAME to the VALUE, not two substrings that could come from different lines.
+// ═══ THE SEED'S CONSTANTS ARE PINNED TO THE .dag ROWS ═══
+//
+// The producer that emits is the seed's native lane runner, whose entries and inputs are Rust
+// constants that cannot read a .dag row yet. These joins hold them equal to the rows, so moving
+// either side alone reds here rather than leaving the runner silently ignoring the workflow's
+// input or the census reporting a closure the job no longer compiles. Each constant is matched as
+// its whole declaration line, so the join pins the NAME to the VALUE.
 data native_lane_runner_source_path: String = "src/v1/stage0/src/cli_run/native_lane_runner.rs"
 
 fn rust_str_const_line(name: String, value: String) -> String {
@@ -489,31 +408,37 @@ test fn the_seed_lane_entries_are_the_instrument_rows() -> Bool {
     && string_contains(s: runner, pattern: rust_str_const_line(name: "V2_NATIVE_CLI_ENTRY", value: v2_native_cli_entry()))
 }
 
-// THE PER-PR RELIEF IS A MODELED INPUT ON EVERY EMIT-BUILD SUBJECT STEP (gunbc.rung_drop
-// native_fault_experiment_off_pull_requests): each step passes the env var, whose expression skips
-// on pull_request and runs otherwise. A step lacking it would run the fault experiment on PRs.
-test fn every_emit_build_subject_step_passes_the_fault_experiment_input() -> Bool {
-  all(emitted_subject_build_rows(), row => match compiler_gate_emit_build_step(row: row) {
-    RunStep { name: _, id: _, run: _, shell: _, env: e, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
-      match e {
-        Present { value: kvs } => any(kvs, k => k.key == native_fault_experiment_env_name)
-        Absent => false
-      }
-    UsesStep { name: _, id: _, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => false
-  })
+test fn the_seed_fault_experiment_input_is_the_dag_rows() -> Bool {
+  let runner = Filesystem.Read(path: native_lane_runner_source_path, expect: ExpectSuccess).content
+  string_contains(s: runner, pattern: rust_str_const_line(name: "FAULT_EXPERIMENT_ENV", value: native_fault_experiment_env_name))
+    && string_contains(s: runner, pattern: rust_str_const_line(name: "FAULT_EXPERIMENT_SKIP_VALUE", value: native_fault_experiment_skip_value))
 }
 
-// THE UNIT LANE DOES NOT RUN ON pull_request: its condition excludes the event and so admits
-// merge_group and workflow_dispatch.
-test fn w_RED_the_unit_test_lane_condition_excludes_pull_request() -> Bool {
-  compiler_gate_unit_test_job_condition() == "github.event_name != 'pull_request'"
+// THE MEMORY BIND INPUT IS THE GOVERNOR'S OWN CONSTANT (memory_governor BIND_MEMORY_CGROUP_ENV),
+// the variable claim_executor and claim_batch already read; the row and the constant are joined
+// here so the workflow cannot ask for a bind in words the seed does not read.
+data memory_governor_source_path: String = "src/v1/stage0/src/memory_governor.rs"
+
+test fn the_seed_memory_bind_input_is_the_dag_row() -> Bool {
+  let governor = Filesystem.Read(path: memory_governor_source_path, expect: ExpectSuccess).content
+  string_contains(s: governor, pattern: rust_str_const_line(name: "BIND_MEMORY_CGROUP_ENV", value: native_step_memory_bind_env_name))
 }
 
-// THE RUNNER'S COPY OF THE SKIP CONTRACT IS PINNED TO THE .dag ROWS (review 77571): renaming the env
-// var or the skip value on one side alone reds here instead of leaving the runner silently ignoring
-// the workflow's input.
-test fn the_seed_fault_experiment_input_is_the_dag_rows() -> Bool {
+data target_invocation_host_source_path: String = "src/v1/stage0/src/target_invocation_host.rs"
+
+// THE ENVELOPE REQUIREMENT INPUTS ARE THE .dag ROWS, pinned in the seed's source the same way the
+// fault-experiment inputs are: the name gunbc test reads and the one grain it knows.
+test fn the_seed_envelope_requirement_inputs_are_the_dag_rows() -> Bool {
+  let host = Filesystem.Read(path: target_invocation_host_source_path, expect: ExpectSuccess).content
+  string_contains(s: host, pattern: rust_str_const_line(name: "MEMORY_ENVELOPE_REQUIRED_ENV", value: native_step_memory_envelope_env_name))
+    && string_contains(s: host, pattern: rust_str_const_line(name: "MEMORY_ENVELOPE_SLOT_VALUE", value: native_step_memory_envelope_slot_value))
+}
+
+// THE FRESH-PRODUCT INPUT IS PINNED THE SAME WAY: the workflow passes the row's name and value, and
+// the runner reads the constants; a rename on one side alone would leave the required job asking
+// for a fresh product in words the runner does not read, and the store would serve a hit again.
+test fn the_seed_product_reuse_input_is_the_dag_rows() -> Bool {
   let runner = Filesystem.Read(path: native_lane_runner_source_path, expect: ExpectSuccess).content
-  string_contains(s: runner, pattern: rust_str_const_line(name: "FAULT_EXPERIMENT_ENV", value: native_fault_experiment_env_name))
-    && string_contains(s: runner, pattern: rust_str_const_line(name: "FAULT_EXPERIMENT_SKIP_VALUE", value: native_fault_experiment_skip_value))
+  string_contains(s: runner, pattern: rust_str_const_line(name: "PRODUCT_REUSE_ENV", value: native_product_reuse_env_name))
+    && string_contains(s: runner, pattern: rust_str_const_line(name: "PRODUCT_REUSE_FRESH_VALUE", value: native_product_reuse_fresh_value))
 }
diff --git a/dag/test/claim/compiler_gate_workflow_witness_test.dag b/dag/test/claim/compiler_gate_workflow_witness_test.dag
index 769877e41dd..e5c1f714390 100644
--- a/dag/test/claim/compiler_gate_workflow_witness_test.dag
+++ b/dag/test/claim/compiler_gate_workflow_witness_test.dag
@@ -1,202 +1,41 @@
 module test.claim.compiler_gate_workflow_witness_test
 
-import std.types { Bool, Int, String }
-import std.optional { Present, Absent }
-import v2.std.algebra { fold_list }
-import extdeps.github.actions { Step, RunStep, UsesStep, Job, SelfHosted, RunsOnExpression }
+import std.types { Bool, String }
+import extdeps.github.actions { SelfHosted, RunsOnExpression }
 import gunbc.compiler_gate_workflow {
-  compiler_gate_emit_build_native_cache_root_bound_step, compiler_gate_native_cache_condition,
-  compiler_gate_native_cache_root_script, compiler_gate_native_read_condition, compiler_gate_native_write_condition, compiler_gate_native_save_command,
-  compiler_gate_floor_job, compiler_gate_generated_job, compiler_gate_drift_step_id,
-  compiler_gate_stage0_regen_step_id, compiler_gate_lint_step_id,
   compiler_gate_no_merge_path_job_is_hosted, compiler_gate_runner_is_hosted,
   compiler_gate_merge_path_runs_on_the_fleet, compiler_gate_merge_path_job_ids,
-  compiler_gate_floor_job_id, compiler_gate_generated_job_id, compiler_gate_aggregate_job_id
+  compiler_gate_required_job_id
 }
 
-// ── THE RECEIPT'S PRODUCER IS BOUND WITH ITS CONSUMER, IN THAT ORDER ─────────────────────────
-//
-// The floor's run step passes --measurement-receipt, and under that flag claim_executor returns
-// success for a completed measurement CARRYING BLOCKERS: the blockers go into the receipt, and the
-// verdict is whoever reads the receipt back. A producer bound without that reader is a required
-// lane that cannot go red -- measured on PR #11821 run 35497139573, where the step log read
-// 'floor refused ... phases_run=2 phases_failed=2', no claim ran, and the lane concluded success.
-//
-// So this claim is over POSITIONS in the emitted job, not over the presence of a string: the step
-// whose run carries --adjudicate-measurement-receipt must exist, and it must come AFTER the step
-// whose run carries --measurement-receipt. Removing the adjudicator, or binding it ahead of the
-// producer it reads, reds this; a run step that stopped passing --measurement-receipt (the
-// alternative repair, refused because it fuses a refused floor with a killed runner) reds the
-// producer half.
-//
-// The RED was authorable and was the state of main when this file was written: the gate's floor
-// job bound the producer and nothing else.
-//
-// WHY THERE IS NO SECOND CLAIM OVER THE EMITTED YML, and it was written and then deleted rather
-// than never considered. Asserting the same fact on the committed bytes re-renders the whole
-// workflow to read two substrings out of it: measured at 97132 eval steps against the 72300 the
-// new-witness budget allows, while this claim over the job costs 55109. The overrun is the tell,
-// not the rule broken -- the cheap way to keep it was a 4b(3) drop, and buying reach with a debt
-// row is what DESIGN section 3 forbids. It is also redundant (section 2): the drift gate already
-// establishes that the committed yml IS the projection of this authority, and this claim
-// establishes that the authority carries the adjudicator after its producer, so the bytes carry
-// it by composition. Two facts, each with one home, rather than one fact asserted twice.
-
-type StepPositions {
-  next: Int
-  producer: Int
-  adjudicator: Int
-}
-
-fn step_run_text(step: Step) -> String {
-  match step {
-    RunStep { name: _, id: _, run: run, shell: _, env: _, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => run
-    UsesStep { name: _, id: _, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => ""
-  }
-}
-
-fn floor_step_positions(job: Job) -> StepPositions {
-  fold_list(
-    xs: job.steps,
-    empty: StepPositions { next: 0, producer: -1, adjudicator: -1 },
-    cons: fn(acc, step) {
-      let run = step_run_text(step: step)
-      let is_adjudicator = string_contains(s: run, pattern: "--adjudicate-measurement-receipt")
-      let is_producer = !is_adjudicator && string_contains(s: run, pattern: "--measurement-receipt")
-      StepPositions {
-        next: acc.next + 1,
-        producer: if is_producer && acc.producer < 0 { acc.next } else { acc.producer },
-        adjudicator: if is_adjudicator && acc.adjudicator < 0 { acc.next } else { acc.adjudicator },
-      }
-    }
-  )
-}
-
-test fn w_RED_the_gate_floor_job_adjudicates_the_receipt_it_produces() -> Bool {
-  let p = floor_step_positions(job: compiler_gate_floor_job())
-  p.producer >= 0 && p.adjudicator >= 0 && p.producer < p.adjudicator
-}
-
-// ── THE STAGE0 MIRRORS ARE ADJUDICATED ON EVERY EVENT, BESIDE THE FLOOR ──────────────────────
-//
-// operator decision msg_6e36a6a2 (2026-09-23, superseding msg_4a9045fc and msg_f1ade7cf) put the
-// build lane over the compile_stage0 mirrors, both generations, on merge_group; operator ruling
-// 2026-09-27 moved it off the floor job onto the generated-artifact job beside it; operator ruling
-// 2026-09-28 runs it on every event, because a pull request that failed it still entered the queue
-// and failed every group stacked on it (#12412, #12539). This claim reads the generated job: exactly
-// one step runs `--required-lane` with no measurement receipt (the build lane's command; the
-// witnesses lane is the one carrying a receipt), its condition carries the status function and
-// names NO event, and the drift step -- now the repair's discriminator -- stays off the queue, reads
-// the lane's failure, and comes after it. Deleting the lane step, re-gating it to one event (the
-// queue-only placement the ruling retired), binding it twice, letting the drift step run on the
-// queue, or binding the drift step before the lane whose outcome it reads (where that outcome is
-// empty, so the repair chain can never fire) reds this. Whether the lane's own refusal discriminates
-// is not this claim's subject: that is the binary's, and the planted-drift control on the PR that
-// added the step is its execution receipt.
-type GeneratedLanePlacement {
-  next: Int
-  stage0_steps: Int
-  stage0_position: Int
-  stage0_ungated: Bool
-  drift_position: Int
-  drift_reads_the_lane: Bool
-}
-
-fn step_if_text(step: Step) -> String {
-  match step {
-    RunStep { name: _, id: _, run: _, shell: _, env: _, working_directory: _, if_condition: c, continue_on_error: _, timeout_minutes: _ } => match c {
-      Present { value: v } => v
-      Absent => ""
-    }
-    UsesStep { name: _, id: _, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => ""
-  }
-}
-
-fn step_id_text(step: Step) -> String {
-  match step {
-    RunStep { name: _, id: i, run: _, shell: _, env: _, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => match i {
-      Present { value: v } => v
-      Absent => ""
-    }
-    UsesStep { name: _, id: i, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => match i {
-      Present { value: v } => v
-      Absent => ""
-    }
-  }
-}
-
-test fn w_RED_the_stage0_mirrors_are_adjudicated_on_every_event_beside_the_floor() -> Bool {
-  let p = fold_list(
-    xs: compiler_gate_generated_job().steps,
-    empty: GeneratedLanePlacement { next: 0, stage0_steps: 0, stage0_position: -1, stage0_ungated: true, drift_position: -1, drift_reads_the_lane: false },
-    cons: fn(acc, step) {
-      let run = step_run_text(step: step)
-      let cond = step_if_text(step: step)
-      let is_stage0 = string_contains(s: run, pattern: "--required-lane")
-        && !string_contains(s: run, pattern: "--measurement-receipt")
-      let is_drift = step_id_text(step: step) == compiler_gate_drift_step_id
-      GeneratedLanePlacement {
-        next: acc.next + 1,
-        stage0_steps: if is_stage0 { acc.stage0_steps + 1 } else { acc.stage0_steps },
-        stage0_position: if is_stage0 && acc.stage0_position < 0 { acc.next } else { acc.stage0_position },
-        stage0_ungated: if is_stage0 {
-          acc.stage0_ungated
-            && string_contains(s: cond, pattern: "!cancelled()")
-            && !string_contains(s: cond, pattern: "github.event_name")
-        } else { acc.stage0_ungated },
-        drift_position: if is_drift { acc.next } else { acc.drift_position },
-        drift_reads_the_lane: if is_drift {
-          string_contains(s: cond, pattern: "github.event_name != 'merge_group'")
-            && string_contains(s: cond, pattern: join(["steps.", compiler_gate_stage0_regen_step_id, ".outcome == 'failure'"], ""))
-        } else { acc.drift_reads_the_lane },
-      }
-    }
-  )
-  p.stage0_steps == 1 && p.stage0_ungated && p.drift_reads_the_lane
-    && p.stage0_position >= 0 && p.stage0_position < p.drift_position
-}
-
-// ── THE LINT IS A STEP ON THE GENERATED LANE, UNDER THE STATUS GUARD ALONE ──────────────────────
-//
-// operator ruling 2026-09-28 deleted the hosted `clippy` job and made the lint a step on `generated`.
-// What the separate job bought was that one red could not hide the other; the step keeps that only
-// if its condition is `!cancelled()` and nothing more -- a default success() would let a red build
-// step skip the lint, and a condition naming the build outcome would do the same. So this reads the
-// generated job for the step by id, and asserts it runs the clippy command under exactly that
-// guard. Deleting the step, moving it off the job, or narrowing its condition reds this.
-test fn w_RED_the_lint_runs_on_the_generated_lane_under_the_status_guard_alone() -> Bool {
-  fold_list(
-    xs: compiler_gate_generated_job().steps,
-    empty: false,
-    cons: fn(found, step) {
-      found || (
-        step_id_text(step: step) == compiler_gate_lint_step_id
-          && string_contains(s: step_run_text(step: step), pattern: "cargo clippy --all-targets")
-          && step_if_text(step: step) == "!cancelled()"
-      )
-    }
-  )
-}
+// THE CLAIMS OVER THE `floor` AND `generated` JOBS LEFT WITH THOSE JOBS (operator ruling 2026-10-09,
+// the v1 withdrawal; gunbc.rung_drop v1_required_lanes_withdrawn): the receipt adjudicator bound after
+// its producer, the stage0 mirrors adjudicated on every event, and the lint under the status guard
+// alone were facts about lanes this workflow no longer runs. The claims over the native product
+// store's steps left with the same ruling's second correction: the required job emits and builds
+// both products fresh and binds no store (test.claim.compiler_gate_emit_build_lane_witness_test
+// holds the absence).
 
 // ── THE MERGE PATH RUNS ON THE FLEET ──────────────────────────────────────────────────────────
 //
-// operator ruling 2026-09-28: no lane the required context reads, and not the aggregate, runs on a
-// hosted runner. compiler_gate_merge_path_runs_on_the_fleet is an emission conjunct, so a workflow
-// that breaks the ruling is refused rather than emitted; these claims establish that the predicate
-// discriminates (a supplied merge path that meets the hosted set refuses, one that does not is
-// admitted), that a runner decided at dispatch counts as hosted, and that the live merge path both
-// holds and is not vacuous -- it names the two fleet lanes and the aggregate.
+// operator ruling 2026-09-28: no lane the required context reads runs on a hosted runner.
+// compiler_gate_merge_path_runs_on_the_fleet is an emission conjunct, so a workflow that breaks the
+// ruling is refused rather than emitted; these claims establish that the predicate discriminates (a
+// supplied merge path that meets the hosted set refuses, one that does not is admitted), that a
+// runner decided at dispatch counts as hosted, and that the live merge path both holds and is not
+// vacuous -- it names the one required job. The supplied sets below are designed values, not the
+// live roster.
 test fn w_RED_a_hosted_job_on_the_merge_path_refuses() -> Bool {
   compiler_gate_no_merge_path_job_is_hosted(
-    merge_path: ["floor", "generated", "witnesses"],
-    hosted: ["rust-unit-tests", "emit-build", "witnesses"]
+    merge_path: ["lane-a", "lane-b", "witnesses"],
+    hosted: ["lane-c", "lane-d", "witnesses"]
   ) == false
 }
 
 test fn a_merge_path_disjoint_from_the_hosted_jobs_is_admitted() -> Bool {
   compiler_gate_no_merge_path_job_is_hosted(
-    merge_path: ["floor", "generated", "witnesses"],
-    hosted: ["rust-unit-tests", "emit-build"]
+    merge_path: ["lane-a", "lane-b", "witnesses"],
+    hosted: ["lane-c", "lane-d"]
   )
 }
 
@@ -205,41 +44,12 @@ test fn w_RED_a_runner_decided_at_dispatch_counts_as_hosted() -> Bool {
     && (compiler_gate_runner_is_hosted(runner: SelfHosted { labels: ["self-hosted", "linux", "arm64"] }) == false)
 }
 
-test fn the_live_merge_path_runs_on_the_fleet_and_names_its_lanes() -> Bool {
+// THE LIVE MERGE PATH IS EXACTLY THE REQUIRED JOB, at identity grain in both directions: a path that
+// grew a second job without the operator sign-off the design document's CI row requires reds here,
+// and so does a path that lost the required job.
+test fn the_live_merge_path_runs_on_the_fleet_and_is_the_required_job() -> Bool {
   let path = compiler_gate_merge_path_job_ids()
   compiler_gate_merge_path_runs_on_the_fleet()
-    && any(path, id => id == compiler_gate_floor_job_id)
-    && any(path, id => id == compiler_gate_generated_job_id)
-    && any(path, id => id == compiler_gate_aggregate_job_id)
-}
-
-// THE NATIVE PRODUCT STORE IS BOUND ON PULL REQUESTS AND THE MERGE QUEUE, NEVER ELSEWHERE: the root is
-// job-private (under RUNNER_TEMP, empty at job start), so a pull request's job cannot seed the compiler
-// the queue judges; the queue also restores from the shared store and publishes only admitted entries.
-// Narrowing the condition off merge_group, or widening it to other events, makes this refuse.
-test fn the_native_cache_root_step_runs_on_pull_requests_and_the_merge_queue_only() -> Bool {
-  let condition = step_if_text(step: compiler_gate_emit_build_native_cache_root_bound_step().step)
-  condition == compiler_gate_native_cache_condition()
-    && string_contains(s: condition, pattern: "pull_request")
-    && string_contains(s: condition, pattern: "merge_group")
-}
-
-// THE STORE ROOT IS JOB-PRIVATE: a shared host directory (RUNNER_TOOL_CACHE) is writable by any job's
-// code, so an entry planted there would be served as a HIT. Restoring the shared-tool-cache root makes
-// this refuse.
-test fn the_native_cache_root_is_job_private_and_never_the_shared_tool_cache() -> Bool {
-  string_contains(s: compiler_gate_native_cache_root_script, pattern: "$RUNNER_TEMP/")
-    && !string_contains(s: compiler_gate_native_cache_root_script, pattern: "RUNNER_TOOL_CACHE")
-}
-
-// The credentialed store transfer is wired: the read identity is gated to same-repository pull
-// requests (a fork is issued no token), the write identity and the save to the merge queue alone, and
-// only the emit-build job may mint an id-token.
-test fn the_native_store_transfer_is_wired_by_event() -> Bool {
-  string_contains(s: compiler_gate_native_read_condition(), pattern: "head.repo.full_name == github.repository")
-    && string_contains(s: compiler_gate_native_read_condition(), pattern: "github.event_name == 'merge_group'")
-    && !string_contains(s: compiler_gate_native_write_condition(), pattern: "pull_request")
-    && compiler_gate_native_write_condition() == "github.event_name == 'merge_group'"
-    && string_contains(s: compiler_gate_native_save_command(), pattern: "native_product_save_wet")
-    && !string_contains(s: compiler_gate_native_save_command(), pattern: "pull_request")
+    && any(path, id => id == compiler_gate_required_job_id)
+    && all(path, id => id == compiler_gate_required_job_id)
 }
diff --git a/dag/test/claim/compute/host_capacity_wet_witness_test.dag b/dag/test/claim/compute/host_capacity_wet_witness_test.dag
index 138ad4396b7..637579aab52 100644
--- a/dag/test/claim/compute/host_capacity_wet_witness_test.dag
+++ b/dag/test/claim/compute/host_capacity_wet_witness_test.dag
@@ -5,10 +5,10 @@ import std.types { Bool, Int, NonEmptyStr, String }
 import std.measure { Kibibyte, kibibyte, kibibyte_count }
 import std.algebra { trim }
 import product.capacity.event_chain { PartitionId }
-import gunbc.roadmap_dashboard_instance { srv1_live_dashboard_instance, srv1_lab_dashboard_instance, dashboard_instance_compute_root }
+import gunbc.roadmap_dashboard_instance { srv1_live_dashboard_instance, srv1_lab_dashboard_instance }
 import gunbc.compute.host_capacity {
   ComputeCapacitySubject, ComputeSubjectResolution, ComputeSubjectResolved, ComputeSubjectHostUnresolved,
-  compute_capacity_subject, compute_capacity_root, compute_memory_partition, compute_memory_ceiling,
+  compute_capacity_subject, compute_capacity_root, compute_root, compute_memory_partition, compute_memory_ceiling,
   HostMemoryObservation, HostMemoryObserved, HostMemoryUnobserved, observe_host_memory,
   ComputeReservation, ComputeReserved, ComputeCapacityFull, ComputeHostBelowFloor, ComputeReservationRefused,
   compute_reserve_on, compute_reserve_against, compute_release, ComputeRelease, ComputeNothingToRelease, ComputeReleased, ComputeReleaseRefused,
@@ -211,7 +211,7 @@ test fn two_instances_on_one_host_resolve_to_one_pool_at_one_root() -> Bool {
             && (a.root as String) == (b.root as String)
             && string_contains(s: a.partition as String, pattern: live.host_identity as String)
             && !string_contains(s: a.partition as String, pattern: lab.instance_id as String)
-            && (a.root as String) == join([dashboard_instance_compute_root(instance: live) as String, "/capacity"], "")
+            && (a.root as String) == join([compute_root(instance: live) as String, "/capacity"], "")
             && kibibyte_count(k: a.appropriation) == kibibyte_count(k: a.request) * 2
             && kibibyte_count(k: a.request) > 0
       }
diff --git a/dag/test/claim/compute/work_request_witness_test.dag b/dag/test/claim/compute/work_request_witness_test.dag
index 4f8f1e00b7f..37bafa4287b 100644
--- a/dag/test/claim/compute/work_request_witness_test.dag
+++ b/dag/test/claim/compute/work_request_witness_test.dag
@@ -27,9 +27,23 @@ import std.measure { kibibyte }
 import extdeps.systemd { systemd_unit_property_wire }
 import extdeps.systemd.systemd_run { SystemdRunProperty }
 import gunbc.roadmap_dashboard_instance { srv1_live_dashboard_instance }
+import std.content_hash { serialize_content_hash, content_hash_atom }
+import std.cache_identity { compute_work_artifact_kind }
+import std.judgment_contract { output_compute_work_outcome, output_compute_work_log, output_compute_work_outputs }
+import std.materialization_ladder { DemandNature, IdempotentEffect, FreshEffect, PureComputation, WorldRead }
+import std.materialization_provider {
+  ArtifactRequest, ComputeWorkRequest, request_key, request_kind, request_required_outputs, request_judgment_contract,
+  ArtifactManifest, ArtifactPart, ComputeWorkArtifact, artifact_manifest, artifact_from_manifest, artifact_request_key,
+  ManifestDecoded, ManifestKindUndeclared, ManifestPartUndeclared, ManifestPartRepeated, LegacyIncompleteArtifact,
+}
+import std.measure { byte_size }
+import gunbc.compute.work_provider_local {
+  compute_work_identity, compute_operation_admission, compute_toolchain_decide, ToolchainObserved, ToolchainObservationRefused,
+  ComputeExecOk, ComputeExecFailed,
+}
 import gunbc.compute.work_request {
   WorkSubject, ExactTree, WorkOperation, BuildGunbcBinaries, CompileEntry, RunClaims, CargoRelease, CargoDebug,
-  WorkToolchainIdentity, work_identity, work_identity_hex, work_default_build, work_declared_outputs,
+  WorkToolchainIdentity, work_toolchain_observed, work_default_build, work_declared_outputs,
   DeclaredOutput, WorkOutputRoot, CheckoutRoot, TargetRoot,
   WorkOutput, WorkOutcome, WorkSucceeded, WorkFailed, WorkRefusedByInfrastructure, HostComputeCapacityFull,
   work_outcome_wire, stored_outcome_decode, StoredOutcomeFound, StoredOutcomeUnreadable, stored_outcome_is_success,
@@ -42,8 +56,24 @@ fn tree(hex: String) -> WorkSubject {
   }
 }
 
-fn tc(rustc: String) -> WorkToolchainIdentity {
-  WorkToolchainIdentity { rustc_version: rustc as NonEmptyStr, cache_release: "sccache 0.15.0" as NonEmptyStr }
+// The one fixture mint, admitted by name. Every axis is a parameter so each can be varied alone.
+fn tc_axes(rustc: String, triple: String, cargo: String, cache: String, provider: String) -> WorkToolchainIdentity {
+  tc(rustc: rustc, triple: triple, cargo: cargo, cache: cache, provider: provider)
+}
+
+fn tc(rustc: String, triple: String, cargo: String, cache: String, provider: String) -> WorkToolchainIdentity {
+  work_toolchain_observed(
+    rustc_verbose: rustc as NonEmptyStr, target_triple: triple as NonEmptyStr, cargo_version: cargo as NonEmptyStr,
+    cache_release: cache as NonEmptyStr, provider_revision: provider as NonEmptyStr,
+  )
+}
+
+fn tc_default(rustc: String) -> WorkToolchainIdentity {
+  tc(rustc: rustc, triple: "aarch64-unknown-linux-gnu", cargo: "cargo 1.90.0", cache: "sccache 0.15.0", provider: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
+}
+
+fn key_with(subject: WorkSubject, op: WorkOperation, toolchain: WorkToolchainIdentity) -> String {
+  serialize_content_hash(hash: request_key(req: ComputeWorkRequest { subject: subject, operation: op, toolchain: toolchain })) as String
 }
 
 data tree_a: String = "1111111111111111111111111111111111111111"
@@ -53,22 +83,135 @@ data tree_b: String = "2222222222222222222222222222222222222222"
 // identity; a difference anywhere -- tree, operation, entry, functions, hermeticity, profile,
 // toolchain -- does not collapse, each proven separately.
 test fn identical_requests_share_an_identity_and_every_difference_separates_them() -> Bool {
-  let base = work_identity_hex(id: work_identity(subject: tree(hex: tree_a), op: work_default_build(), toolchain: tc(rustc: "rustc 1.90.0")))
-  let same = work_identity_hex(id: work_identity(subject: tree(hex: tree_a), op: work_default_build(), toolchain: tc(rustc: "rustc 1.90.0")))
-  let other_tree = work_identity_hex(id: work_identity(subject: tree(hex: tree_b), op: work_default_build(), toolchain: tc(rustc: "rustc 1.90.0")))
-  let other_toolchain = work_identity_hex(id: work_identity(subject: tree(hex: tree_a), op: work_default_build(), toolchain: tc(rustc: "rustc 1.91.0")))
-  let debug = work_identity_hex(id: work_identity(subject: tree(hex: tree_a), op: BuildGunbcBinaries { profile: CargoDebug, bins: ["gunbc" as NonEmptyStr] }, toolchain: tc(rustc: "rustc 1.90.0")))
-  let compile_x = work_identity_hex(id: work_identity(subject: tree(hex: tree_a), op: CompileEntry { entry: "dag/x.dag" as FilePath }, toolchain: tc(rustc: "rustc 1.90.0")))
-  let compile_y = work_identity_hex(id: work_identity(subject: tree(hex: tree_a), op: CompileEntry { entry: "dag/y.dag" as FilePath }, toolchain: tc(rustc: "rustc 1.90.0")))
-  let claims_h = work_identity_hex(id: work_identity(subject: tree(hex: tree_a), op: RunClaims { entry: "dag/t.dag" as FilePath, functions: "a,b" as NonEmptyStr, hermetic: true }, toolchain: tc(rustc: "rustc 1.90.0")))
-  let claims_w = work_identity_hex(id: work_identity(subject: tree(hex: tree_a), op: RunClaims { entry: "dag/t.dag" as FilePath, functions: "a,b" as NonEmptyStr, hermetic: false }, toolchain: tc(rustc: "rustc 1.90.0")))
-  let claims_f = work_identity_hex(id: work_identity(subject: tree(hex: tree_a), op: RunClaims { entry: "dag/t.dag" as FilePath, functions: "a" as NonEmptyStr, hermetic: true }, toolchain: tc(rustc: "rustc 1.90.0")))
+  let base = key(subject: tree(hex: tree_a), op: work_default_build(), rustc: "rustc 1.90.0")
+  let same = key(subject: tree(hex: tree_a), op: work_default_build(), rustc: "rustc 1.90.0")
+  let other_tree = key(subject: tree(hex: tree_b), op: work_default_build(), rustc: "rustc 1.90.0")
+  let other_toolchain = key(subject: tree(hex: tree_a), op: work_default_build(), rustc: "rustc 1.91.0")
+  let debug = key(subject: tree(hex: tree_a), op: BuildGunbcBinaries { profile: CargoDebug, bins: ["gunbc" as NonEmptyStr] }, rustc: "rustc 1.90.0")
+  let compile_x = key(subject: tree(hex: tree_a), op: CompileEntry { entry: "dag/x.dag" as FilePath }, rustc: "rustc 1.90.0")
+  let compile_y = key(subject: tree(hex: tree_a), op: CompileEntry { entry: "dag/y.dag" as FilePath }, rustc: "rustc 1.90.0")
+  let claims_h = key(subject: tree(hex: tree_a), op: RunClaims { entry: "dag/t.dag" as FilePath, functions: "a,b" as NonEmptyStr, hermetic: true }, rustc: "rustc 1.90.0")
+  let claims_w = key(subject: tree(hex: tree_a), op: RunClaims { entry: "dag/t.dag" as FilePath, functions: "a,b" as NonEmptyStr, hermetic: false }, rustc: "rustc 1.90.0")
+  let claims_f = key(subject: tree(hex: tree_a), op: RunClaims { entry: "dag/t.dag" as FilePath, functions: "a" as NonEmptyStr, hermetic: true }, rustc: "rustc 1.90.0")
   base == same
     && base != other_tree && base != other_toolchain && base != debug && base != compile_x
     && compile_x != compile_y && claims_h != claims_w && claims_h != claims_f && compile_x != claims_h
     && base.length() == 16
 }
 
+// THE KEY IS INJECTIVE OVER THE TYPED OPERATION AND COVERS EVERY EXECUTION AXIS (ruling on
+// gunbc#13072, items 1 and 4). Each pair below is two different computations that a delimiter-joined
+// preimage, or a key missing an axis, collapsed into one -- and one request then received the other's
+// result. Each must key apart on its own.
+test fn colliding_display_text_and_every_execution_axis_key_apart() -> Bool {
+  let subject = tree(hex: tree_a)
+  let t = tc_default(rustc: "rustc 1.90.0")
+  let one_bin = BuildGunbcBinaries { profile: CargoRelease, bins: ["a,b" as NonEmptyStr] }
+  let two_bins = BuildGunbcBinaries { profile: CargoRelease, bins: ["a" as NonEmptyStr, "b" as NonEmptyStr] }
+  let colon_entry = RunClaims { entry: "a:b" as FilePath, functions: "c" as NonEmptyStr, hermetic: true }
+  let colon_functions = RunClaims { entry: "a" as FilePath, functions: "b:c" as NonEmptyStr, hermetic: true }
+  let base = key_with(subject: subject, op: work_default_build(), toolchain: t)
+  key_with(subject: subject, op: one_bin, toolchain: t) != key_with(subject: subject, op: two_bins, toolchain: t)
+    && key_with(subject: subject, op: colon_entry, toolchain: t) != key_with(subject: subject, op: colon_functions, toolchain: t)
+    && base != key_with(subject: subject, op: work_default_build(), toolchain: tc_axes(rustc: "rustc 1.90.0", triple: "aarch64-unknown-linux-gnu", cargo: "cargo 1.90.0", cache: "sccache 0.16.0", provider: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"))
+    && base != key_with(subject: subject, op: work_default_build(), toolchain: tc_axes(rustc: "rustc 1.90.0", triple: "x86_64-unknown-linux-gnu", cargo: "cargo 1.90.0", cache: "sccache 0.15.0", provider: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"))
+    && base != key_with(subject: subject, op: work_default_build(), toolchain: tc_axes(rustc: "rustc 1.90.0", triple: "aarch64-unknown-linux-gnu", cargo: "cargo 1.91.0", cache: "sccache 0.15.0", provider: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"))
+    && base != key_with(subject: subject, op: work_default_build(), toolchain: tc_axes(rustc: "rustc 1.90.0", triple: "aarch64-unknown-linux-gnu", cargo: "cargo 1.90.0", cache: "sccache 0.15.0", provider: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"))
+}
+
+// A WET CLAIM RUN IS REFUSED BEFORE ANYTHING IS OBSERVED OR RUN (ruling item 2). RED against a provider
+// that serves it under the request key, where a repeat would attach to the first run's outcome.
+test fn a_wet_claim_run_is_refused_and_a_hermetic_one_is_admitted() -> Bool {
+  (match compute_operation_admission(op: RunClaims { entry: "dag/t.dag" as FilePath, functions: "a" as NonEmptyStr, hermetic: false }) { Present { value: _ } => true  Absent => false })
+    && (match compute_operation_admission(op: RunClaims { entry: "dag/t.dag" as FilePath, functions: "a" as NonEmptyStr, hermetic: true }) { Present { value: _ } => false  Absent => true })
+    && (match compute_operation_admission(op: work_default_build()) { Present { value: _ } => false  Absent => true })
+}
+
+// THE EXECUTION IDENTITY IS READ, NEVER DEFAULTED. The triple comes from rustc's own `host:` line, and
+// a report without one refuses rather than keying the work on an unobserved platform.
+test fn the_execution_identity_reads_the_host_triple_and_refuses_without_one() -> Bool {
+  let verbose = "rustc 1.90.0 (abc 2025-01-01)\nbinary: rustc\nhost: aarch64-unknown-linux-gnu\nrelease: 1.90.0\n"
+  let ok = ComputeExecOk { stdout: "x", stderr: "" }
+  (match compute_toolchain_decide(rustc: ComputeExecOk { stdout: verbose, stderr: "" }, cargo: ok, cache: ok, provider: ok) {
+    ToolchainObserved { toolchain } => (toolchain.target_triple as String) == "aarch64-unknown-linux-gnu"
+    ToolchainObservationRefused { detail: _ } => false
+  })
+    && (match compute_toolchain_decide(rustc: ComputeExecOk { stdout: "rustc 1.90.0\n", stderr: "" }, cargo: ok, cache: ok, provider: ok) {
+      ToolchainObserved { toolchain: _ } => false
+      ToolchainObservationRefused { detail } => string_contains(s: detail, pattern: "host")
+    })
+    && (match compute_toolchain_decide(rustc: ComputeExecOk { stdout: verbose, stderr: "" }, cargo: ok, cache: ok, provider: ComputeExecFailed { exit_code: 128, stdout: "", stderr: "no such path" }) {
+      ToolchainObserved { toolchain: _ } => false
+      ToolchainObservationRefused { detail } => string_contains(s: detail, pattern: "provider")
+    })
+}
+
+fn req(subject: WorkSubject, op: WorkOperation, rustc: String) -> ArtifactRequest {
+  ComputeWorkRequest { subject: subject, operation: op, toolchain: tc_default(rustc: rustc) }
+}
+
+fn key(subject: WorkSubject, op: WorkOperation, rustc: String) -> String {
+  serialize_content_hash(hash: request_key(req: req(subject: subject, op: op, rustc: rustc))) as String
+}
+
+// THE PROVIDER FILES WORK UNDER THE MATERIALIZATION KEY AND UNDER NOTHING ELSE. RED against a
+// provider that keeps (or regrows) a private hash beside request_key: the two would disagree here.
+test fn the_provider_identity_is_the_materialization_request_key() -> Bool {
+  let subject = tree(hex: tree_a)
+  let claims = RunClaims { entry: "dag/t.dag" as FilePath, functions: "a" as NonEmptyStr, hermetic: true }
+  compute_work_identity(subject: subject, op: work_default_build(), toolchain: tc_default(rustc: "rustc 1.90.0"))
+      == key(subject: subject, op: work_default_build(), rustc: "rustc 1.90.0")
+    && compute_work_identity(subject: subject, op: claims, toolchain: tc_default(rustc: "rustc 1.90.0"))
+      == key(subject: subject, op: claims, rustc: "rustc 1.90.0")
+}
+
+fn demand_is_fresh(d: DemandNature) -> Bool {
+  match d {
+    FreshEffect => true
+    IdempotentEffect => false
+    PureComputation => false
+    WorldRead { staleness_envelope_declared: _ } => false
+  }
+}
+
+// KIND, OUTPUT ROSTER AND DEMAND NATURE ARE DERIVED FROM THE OPERATION, never declared by a caller.
+// The discriminating cell is the wet claim run: it is the one operation whose answer is not a
+// repeat of a prior one, so it must reach the ladder as FreshEffect (never served from a store),
+// while its hermetic twin over the same entry and functions is IdempotentEffect.
+test fn the_compute_family_derives_kind_outputs_and_demand_nature() -> Bool {
+  let subject = tree(hex: tree_a)
+  let wet = req(subject: subject, op: RunClaims { entry: "dag/t.dag" as FilePath, functions: "a" as NonEmptyStr, hermetic: false }, rustc: "rustc 1.90.0")
+  let hermetic = req(subject: subject, op: RunClaims { entry: "dag/t.dag" as FilePath, functions: "a" as NonEmptyStr, hermetic: true }, rustc: "rustc 1.90.0")
+  let build = req(subject: subject, op: work_default_build(), rustc: "rustc 1.90.0")
+  request_kind(req: build) == compute_work_artifact_kind
+    && request_required_outputs(req: build) == [output_compute_work_outcome, output_compute_work_log, output_compute_work_outputs]
+    && demand_is_fresh(d: request_judgment_contract(req: wet).demand_nature)
+    && !demand_is_fresh(d: request_judgment_contract(req: hermetic).demand_nature)
+    && !demand_is_fresh(d: request_judgment_contract(req: build).demand_nature)
+}
+
+fn part(text: String) -> ArtifactPart {
+  ArtifactPart { digest: content_hash_atom(value: text as NonEmptyStr), bytes: byte_size(count: 1) }
+}
+
+// THE COMPUTE ARTIFACT READS BACK THROUGH THE ONE MANIFEST DECODE, and a stored claim missing its
+// log is the named incompleteness, not a decoded artifact (RED against a decode that let the
+// family's roster drop a part).
+test fn the_compute_artifact_round_trips_its_manifest_and_a_missing_log_is_incomplete() -> Bool {
+  let k = request_key(req: req(subject: tree(hex: tree_a), op: work_default_build(), rustc: "rustc 1.90.0"))
+  let artifact = ComputeWorkArtifact { request_key: k, outcome: part(text: "o"), log: part(text: "l"), outputs: part(text: "x") }
+  let m = artifact_manifest(artifact: artifact)
+  let dropped = ArtifactManifest { kind: m.kind, request_key: m.request_key, parts: m.parts |> filter(p => p.id != output_compute_work_log) }
+  (match artifact_from_manifest(m: m) {
+    ManifestDecoded { artifact: a } => match a { ComputeWorkArtifact { request_key: rk, outcome: _, log: _, outputs: _ } => rk == k  _ => false }
+    _ => false
+  })
+    && (match artifact_from_manifest(m: dropped) {
+      ManifestDecoded { artifact: a } => match a { LegacyIncompleteArtifact { kind: kd, request_key: _, carried_outputs: _ } => kd == compute_work_artifact_kind  _ => false }
+      _ => false
+    })
+}
+
 // Declared outputs follow the operation: a build names its binaries under the profile directory of
 // the TARGET root (the shared per-host CARGO_TARGET_DIR, not the checkout -- the first wet run
 // declared the checkout and mismatched a build that had succeeded); checking operations declare
diff --git a/dag/test/claim/contract_identity/required_ci_epoch_real_execution_witness_test.dag b/dag/test/claim/contract_identity/required_ci_epoch_real_execution_witness_test.dag
index 249e6775464..3f8c051a5ad 100644
--- a/dag/test/claim/contract_identity/required_ci_epoch_real_execution_witness_test.dag
+++ b/dag/test/claim/contract_identity/required_ci_epoch_real_execution_witness_test.dag
@@ -146,7 +146,7 @@ fn fixture_push_at(head_sha: String) -> PushRefUpdate {
 }
 
 fn fixture_merge_group_runs_at(head_sha: String) -> WorkflowRunList {
-  let r = WorkflowRun {
+  let r = WorkflowRun { display_title: none,
     id: 1,
     name: Present { value: witness_floor_workflow_name },
     path: Present { value: artifact_path(a: WitnessFloorYamlArtifact) },
diff --git a/dag/test/claim/cooling_qualification_witness_test.dag b/dag/test/claim/cooling_qualification_witness_test.dag
index 8fa49de1ec0..3af8ac45561 100644
--- a/dag/test/claim/cooling_qualification_witness_test.dag
+++ b/dag/test/claim/cooling_qualification_witness_test.dag
@@ -1,5 +1,7 @@
 module test.claim.cooling_qualification_witness
 
+import extdeps.board_authority { BoardAuthorityRef }
+import extdeps.boards.asrock_rack { asrock_altrad8ud_board_authority }
 import extdeps.vendor.ampere { ampere_vendor }
 import extdeps.vendor.amd { amd }
 import std.types { Bool, List, String }
@@ -21,7 +23,6 @@ import extdeps.cpu.types {
   cooling_mount_eq,
   cpu_socket_eq,
 }
-import extdeps.boards.types { AsrockRackAltrad8ud1l2t }
 import gunbc.fleet_physical_inventory {
   cooler_srv3,
   installed_cooling_realizations,
@@ -49,7 +50,7 @@ data srv3_installed_cooling: InstalledCoolingRealization = InstalledCoolingReali
   cooler_asset: cooler_srv3,
   cooler: dynatron_w1_catalog,
   processor: altra_max_m12830_catalog,
-  baseboard_model: AsrockRackAltrad8ud1l2t,
+  baseboard_model: asrock_altrad8ud_board_authority,
 }
 
 // GREEN: the fleet's actual srv3 pairing is catalog-compatible. W1 socket LGA4926 matches the
@@ -108,7 +109,7 @@ test fn cooler_with_a_different_retention_is_a_discriminating_refusal() -> Bool
 
 // Control 3: emptying the supported-board population refuses. This is the control that would
 // have passed vacuously while supported_motherboards was a bare string list compared against a
-// differently-spelled label — grounding it on BaseboardModel is what makes the check real.
+// differently-spelled label — grounding it on BoardAuthorityRef is what makes the check real.
 test fn baseboard_absent_from_supported_population_is_refused() -> Bool {
   let unsupported_cooler: CpuCoolerCatalogRow = CpuCoolerCatalogRow {
     model: dynatron_w1_catalog.model,
@@ -280,7 +281,7 @@ data duplicate_cooling_ab: List<InstalledCoolingRealization> = [
     cooler_asset: cooler_srv3,
     cooler: dynatron_w1_catalog,
     processor: altra_max_m12830_catalog,
-    baseboard_model: AsrockRackAltrad8ud1l2t,
+    baseboard_model: asrock_altrad8ud_board_authority,
   },
 ]
 
@@ -290,7 +291,7 @@ data duplicate_cooling_ba: List<InstalledCoolingRealization> = [
     cooler_asset: cooler_srv3,
     cooler: dynatron_w1_catalog,
     processor: altra_max_m12830_catalog,
-    baseboard_model: AsrockRackAltrad8ud1l2t,
+    baseboard_model: asrock_altrad8ud_board_authority,
   },
   srv3_installed_cooling,
 ]
diff --git a/dag/test/claim/cpu_l1_cache_geometry_witness_test.dag b/dag/test/claim/cpu_l1_cache_geometry_witness_test.dag
index d32084d1d53..af6b381540f 100644
--- a/dag/test/claim/cpu_l1_cache_geometry_witness_test.dag
+++ b/dag/test/claim/cpu_l1_cache_geometry_witness_test.dag
@@ -32,6 +32,9 @@ test fn w_ampere_catalog_rows_share_cited_l1_geometry() -> Bool {
 test fn w_ampere_l1_citations_cover_all_fields() -> Bool {
   let citations = altra_max_m12830_catalog.l1_cache_citations
   list_length(items: citations) == 3
-    && citations.first().authority == ampere_altra_max_rev_a1_datasheet_authority
+    && match citations.first() {
+         Present { value: e } => e.authority == ampere_altra_max_rev_a1_datasheet_authority
+         Absent => false
+       }
 }
 
diff --git a/dag/test/claim/cpu_l2_l3_cache_geometry_witness_test.dag b/dag/test/claim/cpu_l2_l3_cache_geometry_witness_test.dag
index 15d4aa58025..56d0d901752 100644
--- a/dag/test/claim/cpu_l2_l3_cache_geometry_witness_test.dag
+++ b/dag/test/claim/cpu_l2_l3_cache_geometry_witness_test.dag
@@ -38,7 +38,10 @@ test fn w_ampere_catalog_rows_share_cited_l2_geometry() -> Bool {
 test fn w_ampere_l2_citations_cover_all_fields() -> Bool {
   let citations = ampere_altra_l2_cache_citations
   list_length(items: citations) == 2
-    && citations.first().authority == ampere_altra_max_rev_a1_datasheet_authority
+    && match citations.first() {
+         Present { value: e } => e.authority == ampere_altra_max_rev_a1_datasheet_authority
+         Absent => false
+       }
 }
 
 test fn w_ampere_l3_geometry_diverges_by_sku() -> Bool {
@@ -53,7 +56,13 @@ test fn w_ampere_l3_geometry_diverges_by_sku() -> Bool {
 test fn w_ampere_l3_citations_diverge_by_family_datasheet() -> Bool {
   list_length(items: altra_max_m12830_catalog.l3_cache_citations) == 2
     && list_length(items: altra_q6430_catalog.l3_cache_citations) == 2
-    && altra_max_m12830_catalog.l3_cache_citations.first().authority == ampere_altra_max_rev_a1_datasheet_authority
-    && altra_q6430_catalog.l3_cache_citations.first().authority == ampere_altra_classic_rev_a1_datasheet_authority
+    && match altra_max_m12830_catalog.l3_cache_citations.first() {
+         Present { value: e } => e.authority == ampere_altra_max_rev_a1_datasheet_authority
+         Absent => false
+       }
+    && match altra_q6430_catalog.l3_cache_citations.first() {
+         Present { value: e } => e.authority == ampere_altra_classic_rev_a1_datasheet_authority
+         Absent => false
+       }
 }
 
diff --git a/dag/test/claim/cron_schedule_render_witness_test.dag b/dag/test/claim/cron_schedule_render_witness_test.dag
new file mode 100644
index 00000000000..c94773fa8b4
--- /dev/null
+++ b/dag/test/claim/cron_schedule_render_witness_test.dag
@@ -0,0 +1,38 @@
+module test.claim.cron_schedule_render_witness_test
+
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import extdeps.cron.schedule_model { CronSchedule, Wildcard, Exact, Listed, Ranged, Step, render_cron_field, render_cron_schedule }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE CRON FIELD RENDERS AS CRONTAB TEXT, NEVER AS ARITHMETIC OVER ITS BOUNDS (gunbc.recurring_failure_mode
+// adjacent_interpolation_holes_fused_into_one_operator_hole). Before gunbc#13436 v1 parsed the
+// two-hole templates of the Ranged and offset-Step arms as one hole holding s - e and st / sp, so a
+// range 1..5 rendered as the difference of its bounds and an offset step 5 every 15 as their
+// quotient. Each input below is chosen so the arithmetic reading DISAGREES with the text: 1 - 5 and
+// 5 / 15 are not the strings 1-5 and 5/15 under any rendering of a number.
+test fn a_cron_range_renders_as_start_dash_end() -> Bool {
+  render_cron_field(f: Ranged { start: 1, end: 5 }) == "1-5"
+}
+
+test fn an_offset_cron_step_renders_as_start_slash_step() -> Bool {
+  render_cron_field(f: Step { start: 5, step: 15 }) == "5/15"
+}
+
+// The one-hole arms beside them, so a regression in the shared renderer is not read as a
+// separator defect: an exact value, a list, and a step from zero.
+test fn the_one_hole_cron_arms_render_their_values() -> Bool {
+  render_cron_field(f: Exact { value: 7 }) == "7"
+    && render_cron_field(f: Listed { values: [1, 15, 30] }) == "1,15,30"
+    && render_cron_field(f: Step { start: 0, step: 10 }) == "*/10"
+}
+
+test fn a_cron_schedule_with_a_range_renders_five_fields() -> Bool {
+  render_cron_schedule(s: CronSchedule {
+    minute: Step { start: 0, step: 10 },
+    hour: Ranged { start: 9, end: 17 },
+    day_of_month: Wildcard,
+    month: Wildcard,
+    day_of_week: Ranged { start: 1, end: 5 }
+  }) == "*/10 9-17 * * 1-5"
+}
diff --git a/dag/test/claim/cursor_cli_invocation_witness_test.dag b/dag/test/claim/cursor_cli_invocation_witness_test.dag
index 06291dd82f5..3b15aed9e38 100644
--- a/dag/test/claim/cursor_cli_invocation_witness_test.dag
+++ b/dag/test/claim/cursor_cli_invocation_witness_test.dag
@@ -6,6 +6,7 @@ import extdeps.llm.cursor_cli {
   CursorApiKeyArgument,
   CursorApiKeyEnvironment,
   CursorInvocation,
+  CursorRunShape,
   CursorProcessInvocation,
   CursorEnvBinding,
   CursorModelId,
@@ -35,14 +36,16 @@ data witness_key: NonEmptyStr = "synthetic-not-a-real-key" as NonEmptyStr
 fn witness_invocation(auth: CursorAuth) -> CursorInvocation {
   CursorInvocation {
     auth: auth,
-    model: cursor_model_auto,
-    mode: CursorDefaultEditMode,
-    sandbox: CursorSandboxEnabled,
-    output_format: CursorStreamJson,
-    force: false,
-    trust_workspace: true,
-    workspace: "/srv/attempt" as FilePath,
-    prompt: "do the work" as NonEmptyStr,
+    run: CursorRunShape {
+      model: cursor_model_auto,
+      mode: CursorDefaultEditMode,
+      sandbox: CursorSandboxEnabled,
+      output_format: CursorStreamJson,
+      force: false,
+      trust_workspace: true,
+      workspace: "/srv/attempt" as FilePath,
+      prompt: "do the work" as NonEmptyStr,
+    },
   }
 }
 
diff --git a/dag/test/claim/cursor_harness_credential_witness_test.dag b/dag/test/claim/cursor_harness_credential_witness_test.dag
new file mode 100644
index 00000000000..cbb45c9df0f
--- /dev/null
+++ b/dag/test/claim/cursor_harness_credential_witness_test.dag
@@ -0,0 +1,172 @@
+module test.claim.cursor_harness_credential
+
+import std.types { String, Bool, Int }
+import extdeps.cloud.gcp.secret_manager { SmEnabled, SmDisabled }
+import gunbc.auth.materialized_secret {
+  MaterializedSecret,
+  MaterializationCompleted,
+  MaterializationRefused,
+  SecretNotLive,
+  SecretVersionUnusable,
+  LivenessProbeNotIndependent,
+  EnvVar,
+  SshKeyFile,
+  StdinPassword,
+}
+import gunbc.host_phase_status { observation_verdict_eq }
+import gunbc.cursor_harness_credential {
+  CursorStatusAuthenticated,
+  CursorStatusUnauthenticated,
+  CursorStatusUnreadable,
+  cursor_status_reading,
+  with_cursor_harness_api_key,
+  cursor_api_key_harness_secret_ref,
+}
+import gunbc.dispatch_selection {
+  CursorApiKeySecretRef,
+  CursorLocalLoginRef,
+  OfferCodex,
+  OfferClaude,
+  OfferCursor,
+  declared_provider_inventory_for_instance,
+}
+import gunbc.roadmap_dashboard_instance { srv2_lab_dashboard_instance }
+import extdeps.llm.cursor_sdk { CursorSdkApiKeyFromSecretRef, CursorSdkApiKeyFromEnvironment }
+import gunbc.cursor_sdk_local_binding {
+  cursor_sdk_local_credential_from_dispatch,
+  CursorSdkLocalCredentialAdmitted,
+  CursorSdkLocalCredentialRefused,
+}
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// The rejected-key output, verbatim from cursor-agent 2026.10.01-e373342 run with an invalid key.
+data observed_unauthenticated_status: String = "{\n  \"status\": \"unauthenticated\",\n  \"isAuthenticated\": false,\n  \"hasAccessToken\": false,\n  \"hasRefreshToken\": false,\n  \"message\": \"Not logged in\"\n}"
+
+// The accepted-key shape is the same document with the flag true. It is SUPPLIED, not observed: the
+// live probe against cursor-api-key-harness is the inhabitance step once the operator creates it.
+data supplied_authenticated_status: String = "{\"status\":\"authenticated\",\"isAuthenticated\":true}"
+
+fn binding_marker(m: MaterializedSecret) -> Int {
+  match m.binding {
+    EnvVar { name } => if (name as String) == "CURSOR_API_KEY" { 1 } else { 2 }
+    SshKeyFile => 3
+    StdinPassword => 4
+    BearerHeaderFile => 5
+  }
+}
+
+test fn witness_observed_rejected_key_reads_unauthenticated() -> Bool {
+  match cursor_status_reading(stdout: observed_unauthenticated_status) {
+    CursorStatusUnauthenticated { status } => status == "unauthenticated"
+    _ => false
+  }
+}
+
+// THE DISCRIMINATING PAIR THROUGH THE REAL BRACKET. Same store state, same probe; only the status
+// output differs. Accepted key: the use runs with CURSOR_API_KEY as the binding. Rejected key: the
+// bracket refuses with SecretNotLive, and the use never runs.
+test fn witness_accepted_key_materializes_as_cursor_api_key_env() -> Bool {
+  match with_cursor_harness_api_key(
+    existence: SmEnabled,
+    status_stdout: Present { value: supplied_authenticated_status },
+    use: fn(m) { binding_marker(m: m) },
+  ) {
+    MaterializationCompleted { value } => value == 1
+    MaterializationRefused { cause: _ } => false
+  }
+}
+
+test fn witness_rejected_key_refuses_secret_not_live() -> Bool {
+  match with_cursor_harness_api_key(
+    existence: SmEnabled,
+    status_stdout: Present { value: observed_unauthenticated_status },
+    use: fn(m) { binding_marker(m: m) },
+  ) {
+    MaterializationRefused { cause } =>
+      match cause {
+        SecretNotLive { verdict } => observation_verdict_eq(a: verdict, b: std.upsert_decision.Drifted)
+        _ => false
+      }
+    MaterializationCompleted { value: _ } => false
+  }
+}
+
+// No probe ran: refused as unknown, never materialized on the store's word alone.
+test fn witness_unprobed_key_refuses_unknown() -> Bool {
+  match with_cursor_harness_api_key(existence: SmEnabled, status_stdout: none, use: fn(m) { binding_marker(m: m) }) {
+    MaterializationRefused { cause } =>
+      match cause {
+        SecretNotLive { verdict } => observation_verdict_eq(a: verdict, b: std.upsert_decision.UnknownRefused)
+        _ => false
+      }
+    MaterializationCompleted { value: _ } => false
+  }
+}
+
+test fn witness_disabled_version_refuses_on_store_axis_before_probe() -> Bool {
+  match with_cursor_harness_api_key(
+    existence: SmDisabled,
+    status_stdout: Present { value: supplied_authenticated_status },
+    use: fn(m) { binding_marker(m: m) },
+  ) {
+    MaterializationRefused { cause } =>
+      match cause {
+        SecretVersionUnusable { state: _ } => true
+        _ => false
+      }
+    MaterializationCompleted { value: _ } => false
+  }
+}
+
+test fn witness_unreadable_status_reads_unreadable() -> Bool {
+  match cursor_status_reading(stdout: "Warning: The provided API key is invalid.") {
+    CursorStatusUnreadable { detail: _ } => true
+    _ => false
+  }
+}
+
+// The harness credential is the dispatch arm the existing SDK-local binding already admits: exact
+// version, CursorApiKeySecretRef.
+test fn witness_harness_credential_admitted_by_existing_cursor_binding() -> Bool {
+  match cursor_sdk_local_credential_from_dispatch(
+    credential: CursorApiKeySecretRef { secret_ref: cursor_api_key_harness_secret_ref },
+  ) {
+    CursorSdkLocalCredentialAdmitted { credential: _, materialization: _ } => true
+    CursorSdkLocalCredentialRefused { reason: _ } => false
+  }
+}
+
+// THE ROUTE, not a supplied credential: the Cursor offer the srv2 lab instance actually declares is
+// handed to the existing SDK-local binding, and what comes out is a materialization of exactly
+// cursor-api-key-harness at its pinned version. Before this change the declared offer carried
+// CursorLocalLoginRef and this binding refused it, so no declared Cursor offer could be admitted.
+test fn witness_declared_srv2_cursor_offer_materializes_harness_secret() -> Bool {
+  let inventory = declared_provider_inventory_for_instance(instance: srv2_lab_dashboard_instance())
+  let admitted = map(inventory.offers, o => match o {
+    OfferCursor { offer } =>
+      match cursor_sdk_local_credential_from_dispatch(credential: offer.credential) {
+        CursorSdkLocalCredentialAdmitted { credential: _, materialization } =>
+          match materialization {
+            CursorSdkApiKeyFromSecretRef { secret_ref } =>
+              (secret_ref.secret as String) == "cursor-api-key-harness"
+                && (secret_ref.version as String) == "1"
+                && (secret_ref.project as String) == "gunbai-secrets"
+            CursorSdkApiKeyFromEnvironment { env_var: _ } => false
+          }
+        CursorSdkLocalCredentialRefused { reason: _ } => false
+      }
+    OfferCodex { offer: _ } => false
+    OfferClaude { offer: _ } => false
+  })
+  any(admitted, b => b)
+}
+
+// The control the route witness is measured against: the arm the offer used to carry still refuses.
+test fn witness_local_login_credential_still_refused() -> Bool {
+  match cursor_sdk_local_credential_from_dispatch(credential: CursorLocalLoginRef) {
+    CursorSdkLocalCredentialRefused { reason: _ } => true
+    CursorSdkLocalCredentialAdmitted { credential: _, materialization: _ } => false
+  }
+}
diff --git a/dag/test/claim/cursor_sdk_argv_projection_witness_test.dag b/dag/test/claim/cursor_sdk_argv_projection_witness_test.dag
index e76864c026f..63fd71500d8 100644
--- a/dag/test/claim/cursor_sdk_argv_projection_witness_test.dag
+++ b/dag/test/claim/cursor_sdk_argv_projection_witness_test.dag
@@ -13,6 +13,7 @@ import extdeps.llm.cursor_cli {
   CursorAuth,
   CursorApiKeyArgument,
   CursorInvocation,
+  CursorRunShape,
   CursorDefaultEditMode,
   CursorSandboxEnabled,
   CursorStreamJson,
@@ -27,14 +28,16 @@ data witness_key: NonEmptyStr = "synthetic-not-a-real-key" as NonEmptyStr
 fn witness_invocation(auth: CursorAuth) -> CursorInvocation {
   CursorInvocation {
     auth: auth,
-    model: cursor_model_auto,
-    mode: CursorDefaultEditMode,
-    sandbox: CursorSandboxEnabled,
-    output_format: CursorStreamJson,
-    force: false,
-    trust_workspace: true,
-    workspace: "/srv/attempt" as FilePath,
-    prompt: "do the work" as NonEmptyStr,
+    run: CursorRunShape {
+      model: cursor_model_auto,
+      mode: CursorDefaultEditMode,
+      sandbox: CursorSandboxEnabled,
+      output_format: CursorStreamJson,
+      force: false,
+      trust_workspace: true,
+      workspace: "/srv/attempt" as FilePath,
+      prompt: "do the work" as NonEmptyStr,
+    },
   }
 }
 
diff --git a/dag/test/claim/deploy_transition_bootstrap_witness_test.dag b/dag/test/claim/deploy_transition_bootstrap_witness_test.dag
index 23b649cf4c2..442c1c18a19 100644
--- a/dag/test/claim/deploy_transition_bootstrap_witness_test.dag
+++ b/dag/test/claim/deploy_transition_bootstrap_witness_test.dag
@@ -5,8 +5,11 @@ import gunbc.roadmap_dashboard_instance { srv1_live_dashboard_instance }
 import gunbc.live_deploy.spec {
   DeploymentNames,
   srv1_live_deployment_names,
-  deployment_belt_timer_unit_name,
+  deployment_belt_exit_path_unit_name,
+  deployment_belt_answer_path_unit_name,
   deployment_belt_service_unit_name,
+  deployment_belt_exit_drain_service_unit_name,
+  deployment_belt_discovery_service_unit_name,
 }
 import gunbc.deploy_transition_bootstrap {
   ReleaseMarkerAwareness,
@@ -121,14 +124,16 @@ test fn an_unobserved_release_refuses_rather_than_widening_to_bootstrap() -> Boo
   )) == "undecidable"
 }
 
-// EVERY UNIT THAT CAN ACTUATE A RELEASE IS QUIESCED, not the timer alone. Disabling only the timer
-// leaves the one-shot belt service startable and leaves the HTTP dispatcher inside the serve unit
-// running -- which is the same defect one layer out, and the deploy-convergence design record
-// already records it as the reason the seam is the shared admission and not either ingress.
-test fn the_quiesced_set_covers_the_timer_the_service_and_the_serve_unit() -> Bool {
+// EVERY UNIT THAT CAN ACTUATE A RELEASE IS QUIESCED: the belt's two event path units (there is no belt
+// timer since dogfood intervention #4), the belt service that queues the launch, and the serve unit
+// with the HTTP dispatcher -- leaving any one of them armed is the same defect one layer out.
+test fn the_quiesced_set_covers_the_event_paths_the_service_and_the_serve_unit() -> Bool {
   let units = bootstrap_quiesced_units(names: names())
-  units.length() == 3
-    && any(units, u => u == deployment_belt_timer_unit_name(names: names()))
+  units.length() == 6
+    && any(units, u => u == deployment_belt_exit_drain_service_unit_name(names: names()))
+    && any(units, u => u == deployment_belt_discovery_service_unit_name(names: names()))
+    && any(units, u => u == deployment_belt_exit_path_unit_name(names: names()))
+    && any(units, u => u == deployment_belt_answer_path_unit_name(names: names()))
     && any(units, u => u == deployment_belt_service_unit_name(names: names()))
     && any(units, u => u == names().unit_name)
 }
@@ -147,7 +152,7 @@ test fn the_quiesced_set_covers_the_timer_the_service_and_the_serve_unit() -> Bo
 // inversion of what it claims. Refusing "unmask" and "disable" is what makes this discriminating.
 test fn quiescence_masks_and_does_not_merely_stop_or_disable() -> Bool {
   let cmds = bootstrap_quiesce_commands(names: names(), privileged: true)
-  cmds.length() == 3
+  cmds.length() == bootstrap_quiesced_units(names: names()).length()
     && all(cmds, c => string_contains(s: c, pattern: "mask"))
     && all(cmds, c => string_contains(s: c, pattern: "--now"))
     && all(cmds, c => !string_contains(s: c, pattern: "unmask"))
@@ -162,7 +167,7 @@ test fn quiescence_masks_and_does_not_merely_stop_or_disable() -> Bool {
 // prior state exactly as found, so the correct restore is strictly smaller than the one it replaces.
 test fn restoration_unmasks_every_unit_and_asserts_nothing_about_prior_state() -> Bool {
   let cmds = bootstrap_restore_commands(names: names(), privileged: true)
-  cmds.length() == 3
+  cmds.length() == bootstrap_quiesced_units(names: names()).length()
     && all(cmds, c => string_contains(s: c, pattern: "unmask"))
     && all(cmds, c => !string_contains(s: c, pattern: "enable"))
     && all(cmds, c => !string_contains(s: c, pattern: "start"))
diff --git a/dag/test/claim/deployed_tree_remote_witness_test.dag b/dag/test/claim/deployed_tree_remote_witness_test.dag
index 4e6040a7cf2..23902203f82 100644
--- a/dag/test/claim/deployed_tree_remote_witness_test.dag
+++ b/dag/test/claim/deployed_tree_remote_witness_test.dag
@@ -24,10 +24,8 @@ import gunbc.live_deploy.spec {
   TailnetDoorServeUnit,
   GunbcSourceTree,
   ServeBinary,
-  DispatchWorktreeRoot,
-  AttemptStateRoot, ComputeRoot,
   SystemdUnit,
-  BeltTimerUnit,
+  BeltEventPathUnit,
   FleetConvergeTimerUnit,
   TailscaleServeMapping,
   DeployedTreeRemoteUnit,
@@ -241,11 +239,8 @@ fn ordering_tag(kind: OwnedArtifactKind) -> String {
     FabricStorageServeMapping => ""
     ApprovalBrokerFrontDoor => ""
     TailnetDoorServeUnit => ""
-    BeltTimerUnit => "belt"
+    BeltEventPathUnit => "belt"
     TailscaleServeMapping => "route"
-    DispatchWorktreeRoot => ""
-    AttemptStateRoot => ""
-    ComputeRoot => ""
     SystemdUnit => ""
     FleetConvergeTimerUnit => ""
   }
diff --git a/dag/test/claim/devboot_subject_identity_witness_test.dag b/dag/test/claim/devboot_subject_identity_witness_test.dag
index 57b9f9a2948..93e61295187 100644
--- a/dag/test/claim/devboot_subject_identity_witness_test.dag
+++ b/dag/test/claim/devboot_subject_identity_witness_test.dag
@@ -1,5 +1,6 @@
 module test.claim.devboot_subject_identity_witness
 
+import gunbc.roadmap_dashboard_instance { srv1_live_dashboard_instance }
 import std.types { Bool, Int, List, NonEmptyStr, String }
 import std.measure { byte_size }
 import std.content_hash {
@@ -19,8 +20,6 @@ import gunbc.live_deploy.spec {
   Dependency,
   ArtifactStep,
   DeploymentDependencyStep,
-  EnsuredHostDirectory,
-  EnsuredManagedHostDirectory,
   EnsuredPackage,
   ensured_subject_identity,
   deployment_ensured_steps,
@@ -30,8 +29,11 @@ import gunbc.live_deploy.spec {
   TeardownActs,
   TeardownOutsideOwnership,
   deployment_srv1_target,
+  deployment_srv1_host_directories,
+  deployment_directory_demands,
 }
 import gunbc.live_deploy.desired { deployment_spec_srv1 }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_path }
 import extdeps.toolchain.types {
   TargetTriple,
   ToolchainRequirement,
@@ -714,67 +716,34 @@ test fn an_interrupted_build_is_not_settled() -> Bool {
   !execution_is_settled(execution: ExecutionInterrupted { detail: "producer died" })
 }
 
-// THE STORE ROOT IS ENSURED, AND THESE ROWS SAY WHAT THAT BUYS. It projects the gunbc.host_layout
-// authority rather than respelling the path; it reaches the apply order, so a deploy converges it;
-// and its teardown REFUSES, so no retract can remove it.\n\nThe third row is the one the incident
-// earned. Wiring this root into the OWNED roster made a lab twin's retract remove the production
-// artifact store -- caught by the twin disjointness claims, which is why those claims were left
-// exactly as they were. A hazard caught once by a claim about something else deserves a control of
-// its own, so the refusal is asserted directly here rather than left to depend on two tests that
-// are really about twins.
-
-fn devboot_ensured_step_projects_layout(acc: Int, step: DeploymentDependencyStep) -> Int {
-  match step.subject {
-    EnsuredHostDirectory { path, owner } =>
-      if (path as String) == (srv1_devboot_artifact_store_root as String) { acc + 1 } else { acc }
-    EnsuredPackage { package } => acc
-    EnsuredManagedHostDirectory { admission: _ } => acc
-  }
+// THE STORE ROOT IS A HOST DIRECTORY DEMAND, AND THESE ROWS SAY WHAT THAT BUYS. It projects the
+// gunbc.host_layout authority rather than respelling the path; it reaches the deployment's directory
+// list, so a deploy creates and reads it back through the owned-directory provider; and no retract can
+// remove it, because a retract tears down only owned steps and no step names it.\n\nThe third row is
+// the one the incident earned: wiring this root into the OWNED roster once made a lab twin's retract
+// remove the production artifact store, so the refusal is asserted directly here.
+
+fn devboot_root_count(ts: List<OwnedDirectoryTarget>) -> Int {
+  count(filter(xs: ts, predicate: t => (owned_directory_path(t: t) as String) == (srv1_devboot_artifact_store_root as String)))
 }
 
-test fn the_devboot_store_root_is_an_ensured_host_resource_projecting_the_layout_row() -> Bool {
-  fold(
-    deployment_ensured_steps(target: deployment_srv1_target()),
-    init: 0,
-    f: (acc, step) => devboot_ensured_step_projects_layout(acc: acc, step: step),
-  ) == 1
+test fn the_devboot_store_root_is_a_host_directory_demand_projecting_the_layout_row() -> Bool {
+  devboot_root_count(ts: deployment_srv1_host_directories()) == 1
 }
 
-fn same_path(a: String, b: String) -> Bool { a == b }
+test fn the_devboot_store_root_reaches_the_deploy_apply_path() -> Bool {
+  devboot_root_count(ts: deployment_directory_demands(spec: deployment_spec_srv1())) == 1
+}
 
 fn step_is_devboot_root(step: DeploymentStep) -> Bool {
   match step {
-    Dependency { step: dep } =>
-      same_path(a: ensured_subject_identity(subject: dep.subject) as String, b: srv1_devboot_artifact_store_root as String)
-    ArtifactStep { step: art } => false
+    ArtifactStep { step: art } => (art.path as String) == (srv1_devboot_artifact_store_root as String)
+    Dependency { step: _ } => false
   }
 }
 
-test fn the_devboot_store_root_reaches_the_deploy_apply_path() -> Bool {
-  let spec = deployment_spec_srv1()
-  fold(spec.steps, init: false, f: (acc, step) => acc || step_is_devboot_root(step: step))
-}
-
-// THE CONTROL FOR THE HAZARD THAT WAS ACTUALLY HIT. A retract must not be able to remove the
-// artifact store, and this asserts it at the step level: the devboot root's teardown disposition
-// refuses with TeardownOutsideOwnership. If someone moves this root back into the owned roster,
-// TeardownActs replaces the refusal and this row goes red -- which is exactly the edit that, last
-// time, would have let a lab twin's retract delete production's artifacts.
-
+// THE CONTROL FOR THE HAZARD THAT WAS ACTUALLY HIT: no owned step -- the only thing a retract removes --
+// names the artifact store. Moving the root back into the owned roster reds this row.
 test fn no_retract_can_remove_the_devboot_store_root() -> Bool {
-  let spec = deployment_spec_srv1()
-  fold(
-    spec.steps,
-    init: false,
-    f: (acc, step) =>
-      if step_is_devboot_root(step: step) {
-        match deployment_step_teardown_disposition(step: step) {
-          TeardownRefuses { cause } => true
-          TeardownActs => false
-        }
-      } else {
-        acc
-      },
-  )
+  !any(deployment_spec_srv1().steps, step => step_is_devboot_root(step: step))
 }
-
diff --git a/dag/test/claim/dgx_spark_witness_test.dag b/dag/test/claim/dgx_spark_witness_test.dag
index d4ebed71d80..c3a05419d34 100644
--- a/dag/test/claim/dgx_spark_witness_test.dag
+++ b/dag/test/claim/dgx_spark_witness_test.dag
@@ -57,61 +57,9 @@ import gunbc.fleet_lifecycle_observation {
 import extdeps.dhcp.v4 { MacAddress, StaticDhcpReservation, Active }
 import extdeps.network.ipv4 { Ipv4Address, ipv4_address }
 import extdeps.router.verizon_cr1000a { Cr1000aDhcpLeaseRow }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv3, operator_host_srv7, operator_host_srv8, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
+import gunbc.fleet_host_identity { operator_host_srv3, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
 import gunbc.spark.dgx_procurement {
-  dgx_spark_procurement_intent,
-  dgx_spark_router_bindings,
-  dgx_spark_reserved_identities,
-  srv5_router_binding,
-  srv6_router_binding,
-  spark_a3ee_reservation,
-  spark_3bd5_reservation,
-  spark_c2b1_reservation,
-  spark_ac79_reservation,
-  spark_0c75_reservation,
-  spark_3336_reservation,
-  spark_b66c_reservation,
-  spark_2196_reservation,
-  observed_dgx_spark_router_reservations,
-  DgxSparkRouterBinding,
-  SlotAssigned,
-  SlotUnassigned,
-  router_binding_identity,
-  OperatorAllocation,
-  dgx_spark_router_binding_operator_allocation,
-  dgx_spark_arrival_standing,
-  AllOrderedUnitsObservedOnLan,
-  OrderedUnitsOutstanding,
-  admit_dgx_spark_deployment,
-  DgxSparkAdmissionOutcome,
-  DgxSparkDeploymentAdmitted,
-  DgxSparkDeploymentRefused,
-  DgxSparkAdmissionRefusalReason,
-  DeploymentAdmissionNoEvidence,
-  DeploymentAdmissionAmbiguousEvidence,
-  DeploymentAdmissionSubjectMismatch,
-  DeploymentAdmissionEndpointBindingMismatch,
-  DeploymentAdmissionExecutionEvidenceDisagrees,
-  admit_dgx_spark_pair,
-  admit_dgx_spark_pair_deployments,
-  DgxSparkPairAdmitted,
-  DgxSparkPairRefused,
-  PairUnitNotAdmitted,
-  PairSubjectsNotDistinct,
-  PairHardwareIdentityUnobserved,
-  PairHardwareIdentityNotDistinct,
-  PairHardwareIdentityIncomparable,
-  DeploymentAdmissionWrongTool,
-  DeploymentAdmissionObservationNotOk,
-  DeploymentAdmissionIdentityNotReserved,
-  DeploymentAdmissionRouterBindingMismatch,
-  DeploymentAdmissionRouterBindingPending,
-  converge_dgx_spark_procurement,
-  dgx_spark_procurement_convergence,
-  DgxSparkProcurementConverged,
-  DgxSparkProcurementPending,
-  DgxSparkUnitDeployed,
-  DgxSparkUnitPending,
+  dgx_spark_procurement_intent, DgxSparkDisposedUnit, DgxSparkAssetSold, dgx_spark_disposed_units, dgx_spark_router_bindings, dgx_spark_reserved_identities, observed_dgx_spark_router_reservations, DgxSparkRouterBinding, SlotAssigned, SlotUnassigned, router_binding_identity, OperatorAllocation, dgx_spark_arrival_standing, AllOrderedUnitsAccounted, OrderedUnitsOutstanding, admit_dgx_spark_deployment, DgxSparkAdmissionOutcome, DgxSparkDeploymentAdmitted, DgxSparkDeploymentRefused, DgxSparkAdmissionRefusalReason, DeploymentAdmissionNoEvidence, DeploymentAdmissionAmbiguousEvidence, DeploymentAdmissionSubjectMismatch, DeploymentAdmissionEndpointBindingMismatch, DeploymentAdmissionExecutionEvidenceDisagrees, admit_dgx_spark_pair, admit_dgx_spark_pair_deployments, DgxSparkPairAdmitted, DgxSparkPairRefused, PairUnitNotAdmitted, PairSubjectsNotDistinct, PairHardwareIdentityUnobserved, PairHardwareIdentityNotDistinct, PairHardwareIdentityIncomparable, DeploymentAdmissionWrongTool, DeploymentAdmissionObservationNotOk, DeploymentAdmissionIdentityNotReserved, DeploymentAdmissionRouterBindingMismatch, DeploymentAdmissionRouterBindingPending, converge_dgx_spark_procurement, dgx_spark_procurement_convergence, DgxSparkProcurementConverged, DgxSparkProcurementPending, DgxSparkUnitDeployed, DgxSparkUnitPending,
 }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
@@ -154,58 +102,27 @@ test fn w_tool_names_match_the_cited_page() -> Bool {
 }
 
 
-data all_spark_identities: List<HostIdentity> = [
-  operator_host_srv5, operator_host_srv6,
-  operator_host_srv7,
-  operator_host_srv8,
-  operator_host_srv9,
-  operator_host_srv10,
-  operator_host_srv11,
-  operator_host_srv12,
-]
+data all_spark_identities: List<HostIdentity> = []
 
-test fn w_procurement_intent_reserves_seven_identities() -> Bool {
+test fn w_procurement_intent_reserves_the_bound_identities() -> Bool {
   dgx_spark_procurement_intent.unit_count == 8
     && dgx_spark_procurement_intent.reserved_identities == all_spark_identities
     && dgx_spark_reserved_identities() == all_spark_identities
 }
 
 test fn w_reserved_identities_derive_from_the_router_binding_roster() -> Bool {
-  count(dgx_spark_router_bindings) == 8
+  count(dgx_spark_router_bindings) == 0
     && dgx_spark_reserved_identities() == map(dgx_spark_router_bindings, b => router_binding_identity(binding: b))
-    && router_binding_identity(binding: srv5_router_binding) == operator_host_srv5
-    && router_binding_identity(binding: srv6_router_binding) == operator_host_srv6
 }
 
-// The live state: both units arrived and each holds a Static, Active CR1000A reservation, and each
-// slot is now ASSIGNED to one of them. This witness pins the assignment as an OperatorAllocation
-// receipt rather than a measurement: it asserts the addresses AND that every binding carries an
-// attributable allocation, so an assignment authored with no named authority reds here. Basis is
-// ascending address order -- srv5 to the lower reserved address -- an arbitrary tie-break between
-// two identical units, which is exactly why it must be recorded as a choice someone made.
+// The live state: each unit holds a Static, Active CR1000A reservation, and each slot is ASSIGNED to
+// one of them. This witness pins the assignment as an OperatorAllocation receipt rather than a
+// measurement: it asserts the addresses AND that every binding carries an attributable allocation,
+// so an assignment authored with no named authority reds here. Basis is ascending address order --
+// an arbitrary tie-break between identical units, which is exactly why it must be recorded as a
+// choice someone made.
 test fn w_slots_are_assigned_by_an_attributable_operator_allocation() -> Bool {
-  count(observed_dgx_spark_router_reservations) == 8
-    && spark_a3ee_reservation.ipv4_address == ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 226)
-    && spark_3bd5_reservation.ipv4_address == ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 225)
-    && spark_c2b1_reservation.ipv4_address == ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 232)
-    && spark_ac79_reservation.ipv4_address == ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 233)
-    && spark_0c75_reservation.ipv4_address == ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 236)
-    && spark_3336_reservation.ipv4_address == ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 237)
-    && spark_b66c_reservation.ipv4_address == ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 238)
-    && spark_2196_reservation.ipv4_address == ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 239)
-    && match srv5_router_binding {
-      SlotAssigned { identity: _, reservation: r, allocation: a } =>
-        r.ipv4_address == spark_a3ee_reservation.ipv4_address
-          && r.mac_address == spark_a3ee_reservation.mac_address
-          && a.decided_on == dgx_spark_router_binding_operator_allocation.decided_on
-      SlotUnassigned { identity: _ } => false
-    }
-    && match srv6_router_binding {
-      SlotAssigned { identity: _, reservation: r, allocation: _ } =>
-        r.ipv4_address == spark_3bd5_reservation.ipv4_address
-          && r.mac_address == spark_3bd5_reservation.mac_address
-      SlotUnassigned { identity: _ } => false
-    }
+  count(observed_dgx_spark_router_reservations) == 0
     && fold(
       dgx_spark_router_bindings,
       init: true,
@@ -220,11 +137,32 @@ test fn w_slots_are_assigned_by_an_attributable_operator_allocation() -> Bool {
 // Arrival is DERIVED from the observed reservation rows against the ordered unit count, never
 // stored beside them. The stored-flag version is what let this module claim the units had not
 // arrived while they sat on the LAN: prose cannot be kept in step with facts by discipline alone.
+// Asserted against the derivation's own inputs, so either arm is checked for agreeing with the rows.
 test fn w_arrival_standing_derives_from_the_observed_reservation_rows() -> Bool {
-  match dgx_spark_arrival_standing() {
-    AllOrderedUnitsObservedOnLan { observed_count: n } => n == 8
-    OrderedUnitsOutstanding { ordered_count: _, observed_count: _ } => false
-  }
+  count(observed_dgx_spark_router_reservations) == 0
+    && match dgx_spark_arrival_standing() {
+      AllOrderedUnitsAccounted { on_lan: l, disposed: d } => l == 0 && d == 8 && l + d == dgx_spark_procurement_intent.unit_count
+      OrderedUnitsOutstanding { ordered_count: _, observed_count: _ } => false
+    }
+}
+
+fn w_sold_on(u: DgxSparkDisposedUnit, date: String) -> Bool {
+  match u.disposition { DgxSparkAssetSold { decision: d } => (d.decided_on as String) == date }
+}
+
+// EIGHT PROCURED AND RECEIVED, FOUR DISPOSED, FOUR RETAINED -- AND ONLY THE RETAINED ENTER A FLEET ROSTER.
+// The disposed units are typed sales under one attributable decision; the reserved identities (the
+// roster fleet, convergence, reservations and admission derive from) are exactly the retained bindings,
+// and no disposed unit's former slot is among them.
+test fn w_eight_procured_eight_sold_and_none_is_rostered() -> Bool {
+  dgx_spark_procurement_intent.unit_count == 8
+    && count(dgx_spark_disposed_units) == 8
+    && count(filter(dgx_spark_disposed_units, u => w_sold_on(u: u, date: "2026-10-07"))) == 4
+    && count(filter(dgx_spark_disposed_units, u => w_sold_on(u: u, date: "2026-10-10"))) == 4
+    && count(dgx_spark_reserved_identities()) == 0
+    && count(dgx_spark_reserved_identities()) + count(dgx_spark_disposed_units) == dgx_spark_procurement_intent.unit_count
+    && !any(dgx_spark_disposed_units, u => any(dgx_spark_reserved_identities(), h => (h as String) == (u.former_slot as String)))
+    && map(dgx_spark_disposed_units, u => u.router_label as String) == ["spark-a3ee", "spark-3bd5", "spark-c2b1", "spark-ac79", "spark-0c75", "spark-3336", "spark-b66c", "spark-2196"]
 }
 
 fn synthetic_envelope_for(host: NonEmptyStr) -> FleetLifecycleEnvelope {
@@ -280,32 +218,32 @@ fn synthetic_observation(
   }
 }
 
-fn srv5_good_observation() -> FleetLifecycleObservation {
-  synthetic_observation(subject_host: "srv5", envelope_host: "srv5", last_octet: 222, attempt_label: "attempt-1")
+fn srv9_good_observation() -> FleetLifecycleObservation {
+  synthetic_observation(subject_host: "srv9", envelope_host: "srv9", last_octet: 222, attempt_label: "attempt-1")
 }
 
 test fn w_admission_with_real_evidence_succeeds() -> Bool {
   match admit_dgx_spark_deployment(
-    identity: operator_host_srv5,
+    identity: operator_host_srv9,
     catalog: nvidia_dgx_spark_4tb_catalog,
-    selection: ObservationUnique { observation: srv5_good_observation() },
-    router_binding: synthetic_bound_binding_for(identity_host: "srv5", last_octet: 222),
+    selection: ObservationUnique { observation: srv9_good_observation() },
+    router_binding: synthetic_bound_binding_for(identity_host: "srv9", last_octet: 222),
   ) {
     DgxSparkDeploymentAdmitted { deployment: d } =>
-      d.identity == operator_host_srv5 && d.observation.subject == operator_host_srv5
+      d.identity == operator_host_srv9 && d.observation.subject == operator_host_srv9
     DgxSparkDeploymentRefused { reason: _ } => false
   }
 }
 
 test fn w_red_admission_without_evidence_refuses() -> Bool {
   match admit_dgx_spark_deployment(
-    identity: operator_host_srv5,
+    identity: operator_host_srv9,
     catalog: nvidia_dgx_spark_4tb_catalog,
-    selection: ObservationMissing { subject: operator_host_srv5 },
-    router_binding: synthetic_bound_binding_for(identity_host: "srv5", last_octet: 222),
+    selection: ObservationMissing { subject: operator_host_srv9 },
+    router_binding: synthetic_bound_binding_for(identity_host: "srv9", last_octet: 222),
   ) {
     DgxSparkDeploymentRefused { reason: DeploymentAdmissionNoEvidence { requested_identity: i } } =>
-      i == operator_host_srv5
+      i == operator_host_srv9
     DgxSparkDeploymentRefused { reason: _ } => false
     DgxSparkDeploymentAdmitted { deployment: _ } => false
   }
@@ -313,7 +251,7 @@ test fn w_red_admission_without_evidence_refuses() -> Bool {
 
 test fn w_red_admission_with_wrong_tool_evidence_refuses() -> Bool {
   let o = FleetLifecycleObservation {
-    subject: operator_host_srv5,
+    subject: operator_host_srv9,
     endpoint_binding: EndpointBindingIdentity {
       address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 222),
     },
@@ -323,7 +261,7 @@ test fn w_red_admission_with_wrong_tool_evidence_refuses() -> Bool {
     envelope: FleetLifecycleEnvelope {
       tool: "spark_updatectl.py",
       ts: "2026-08-07T00:00:00Z",
-      host: "srv5",
+      host: "srv9",
       status: StatusOk,
       rc: 0,
       duration_ms: 42,
@@ -333,10 +271,10 @@ test fn w_red_admission_with_wrong_tool_evidence_refuses() -> Bool {
     },
   }
   match admit_dgx_spark_deployment(
-    identity: operator_host_srv5,
+    identity: operator_host_srv9,
     catalog: nvidia_dgx_spark_4tb_catalog,
     selection: ObservationUnique { observation: o },
-    router_binding: synthetic_bound_binding_for(identity_host: "srv5", last_octet: 222),
+    router_binding: synthetic_bound_binding_for(identity_host: "srv9", last_octet: 222),
   ) {
     DgxSparkDeploymentRefused { reason: DeploymentAdmissionWrongTool { observed_tool: t } } => t == "spark_updatectl.py"
     DgxSparkDeploymentRefused { reason: _ } => false
@@ -344,41 +282,41 @@ test fn w_red_admission_with_wrong_tool_evidence_refuses() -> Bool {
   }
 }
 
-// DEFECT 1 control, dispatch half: an observation DISPATCHED against srv5 must not admit a deployment for srv6, and the refusal names the dispatched subject -- the authority fact -- rather than anything the envelope printed.
+// DEFECT 1 control, dispatch half: an observation DISPATCHED against srv9 must not admit a deployment for srv10, and the refusal names the dispatched subject -- the authority fact -- rather than anything the envelope printed.
 test fn w_red_admission_with_mismatched_dispatch_subject_refuses() -> Bool {
   match admit_dgx_spark_deployment(
-    identity: operator_host_srv6,
+    identity: operator_host_srv10,
     catalog: nvidia_dgx_spark_4tb_catalog,
-    selection: ObservationUnique { observation: srv5_good_observation() },
-    router_binding: synthetic_bound_binding_for(identity_host: "srv6", last_octet: 223),
+    selection: ObservationUnique { observation: srv9_good_observation() },
+    router_binding: synthetic_bound_binding_for(identity_host: "srv10", last_octet: 223),
   ) {
     DgxSparkDeploymentRefused {
       reason: DeploymentAdmissionSubjectMismatch { dispatched_subject: s, requested_identity: i }
-    } => s == operator_host_srv5 && i == operator_host_srv6
+    } => s == operator_host_srv9 && i == operator_host_srv10
     DgxSparkDeploymentRefused { reason: _ } => false
     DgxSparkDeploymentAdmitted { deployment: _ } => false
   }
 }
 
-// SPARK-ALLOC-LAND-0 control: the observation is dispatched against srv6 with correct binding and
-// endpoint, but the unit PRINTED "srv5". Admission must still succeed; the disagreement is recorded
+// SPARK-ALLOC-LAND-0 control: the observation is dispatched against srv10 with correct binding and
+// endpoint, but the unit PRINTED "srv9". Admission must still succeed; the disagreement is recorded
 // as diagnostic evidence on the deployment, never as a refusal.
 test fn w_admission_when_envelope_host_disagrees_records_diagnostic_evidence() -> Bool {
-  let o = synthetic_observation(subject_host: "srv6", envelope_host: "srv5", last_octet: 223, attempt_label: "attempt-disagreeing-host")
+  let o = synthetic_observation(subject_host: "srv10", envelope_host: "srv9", last_octet: 223, attempt_label: "attempt-disagreeing-host")
   match admit_dgx_spark_deployment(
-    identity: operator_host_srv6,
+    identity: operator_host_srv10,
     catalog: nvidia_dgx_spark_4tb_catalog,
     selection: ObservationUnique { observation: o },
-    router_binding: synthetic_bound_binding_for(identity_host: "srv6", last_octet: 223),
+    router_binding: synthetic_bound_binding_for(identity_host: "srv10", last_octet: 223),
   ) {
     DgxSparkDeploymentAdmitted { deployment: d } =>
-      d.identity == operator_host_srv6
+      d.identity == operator_host_srv10
         && match d.envelope_host_presentation {
           EnvelopeHostDisagreesWithSubject {
             subject: s,
             observed_host: h,
             expected_presentation: _,
-          } => s == operator_host_srv6 && h == "srv5"
+          } => s == operator_host_srv10 && h == "srv9"
           EnvelopeHostAgreesWithSubject => false
         }
     DgxSparkDeploymentRefused { reason: _ } => false
@@ -387,7 +325,7 @@ test fn w_admission_when_envelope_host_disagrees_records_diagnostic_evidence() -
 
 test fn w_red_admission_with_failed_observation_refuses() -> Bool {
   let o = FleetLifecycleObservation {
-    subject: operator_host_srv5,
+    subject: operator_host_srv9,
     endpoint_binding: EndpointBindingIdentity {
       address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 222),
     },
@@ -397,20 +335,20 @@ test fn w_red_admission_with_failed_observation_refuses() -> Bool {
     envelope: FleetLifecycleEnvelope {
       tool: "device_identity.py",
       ts: "2026-08-07T00:00:00Z",
-      host: "srv5",
+      host: "srv9",
       status: StatusError,
       rc: 1,
       duration_ms: 42,
-      summary: "synthetic FAILED device_identity.py run: the tool was invoked against srv5 and did not succeed",
+      summary: "synthetic FAILED device_identity.py run: the tool was invoked against srv9 and did not succeed",
       warnings: [],
       artifacts: [],
     },
   }
   match admit_dgx_spark_deployment(
-    identity: operator_host_srv5,
+    identity: operator_host_srv9,
     catalog: nvidia_dgx_spark_4tb_catalog,
     selection: ObservationUnique { observation: o },
-    router_binding: synthetic_bound_binding_for(identity_host: "srv5", last_octet: 222),
+    router_binding: synthetic_bound_binding_for(identity_host: "srv9", last_octet: 222),
   ) {
     DgxSparkDeploymentRefused {
       reason: DeploymentAdmissionObservationNotOk { observed_status: StatusError, observed_rc: rc }
@@ -440,30 +378,30 @@ test fn w_red_admission_of_unreserved_identity_refuses() -> Bool {
 // An UNASSIGNED binding: everything else about this call is valid, so this isolates the assignment requirement as the sole reason for refusal. Both live slots are now decided; this uses a synthetic unassigned binding so the wall stays proven for the next unit that arrives before anyone has decided where it goes.
 test fn w_red_admission_with_pending_router_binding_refuses() -> Bool {
   match admit_dgx_spark_deployment(
-    identity: operator_host_srv5,
+    identity: operator_host_srv9,
     catalog: nvidia_dgx_spark_4tb_catalog,
-    selection: ObservationUnique { observation: srv5_good_observation() },
-    router_binding: SlotUnassigned { identity: operator_host_srv5 },
+    selection: ObservationUnique { observation: srv9_good_observation() },
+    router_binding: SlotUnassigned { identity: operator_host_srv9 },
   ) {
     DgxSparkDeploymentRefused {
       reason: DeploymentAdmissionRouterBindingPending { requested_identity: i }
-    } => i == operator_host_srv5
+    } => i == operator_host_srv9
     DgxSparkDeploymentRefused { reason: _ } => false
     DgxSparkDeploymentAdmitted { deployment: _ } => false
   }
 }
 
 test fn w_red_admission_with_mismatched_router_binding_refuses() -> Bool {
-  let o = synthetic_observation(subject_host: "srv6", envelope_host: "srv6", last_octet: 223, attempt_label: "attempt-srv6")
+  let o = synthetic_observation(subject_host: "srv10", envelope_host: "srv10", last_octet: 223, attempt_label: "attempt-srv10")
   match admit_dgx_spark_deployment(
-    identity: operator_host_srv6,
+    identity: operator_host_srv10,
     catalog: nvidia_dgx_spark_4tb_catalog,
     selection: ObservationUnique { observation: o },
-    router_binding: synthetic_bound_binding_for(identity_host: "srv5", last_octet: 222),
+    router_binding: synthetic_bound_binding_for(identity_host: "srv9", last_octet: 222),
   ) {
     DgxSparkDeploymentRefused {
       reason: DeploymentAdmissionRouterBindingMismatch { binding_identity: b, requested_identity: i }
-    } => b == operator_host_srv5 && i == operator_host_srv6
+    } => b == operator_host_srv9 && i == operator_host_srv10
     DgxSparkDeploymentRefused { reason: _ } => false
     DgxSparkDeploymentAdmitted { deployment: _ } => false
   }
@@ -471,27 +409,27 @@ test fn w_red_admission_with_mismatched_router_binding_refuses() -> Bool {
 
 // Evidence must arrive from the RESERVED endpoint. The subject, the binding and the envelope all agree here; only the address the collector actually reached differs from the one reserved for that subject, which is the case where a machine answered on an address nobody reserved for it.
 test fn w_red_admission_from_unreserved_endpoint_refuses() -> Bool {
-  let o = synthetic_observation(subject_host: "srv5", envelope_host: "srv5", last_octet: 231, attempt_label: "attempt-wrong-endpoint")
+  let o = synthetic_observation(subject_host: "srv9", envelope_host: "srv9", last_octet: 231, attempt_label: "attempt-wrong-endpoint")
   match admit_dgx_spark_deployment(
-    identity: operator_host_srv5,
+    identity: operator_host_srv9,
     catalog: nvidia_dgx_spark_4tb_catalog,
     selection: ObservationUnique { observation: o },
-    router_binding: synthetic_bound_binding_for(identity_host: "srv5", last_octet: 222),
+    router_binding: synthetic_bound_binding_for(identity_host: "srv9", last_octet: 222),
   ) {
     DgxSparkDeploymentRefused {
       reason: DeploymentAdmissionEndpointBindingMismatch { requested_identity: i }
-    } => i == operator_host_srv5
+    } => i == operator_host_srv9
     DgxSparkDeploymentRefused { reason: _ } => false
     DgxSparkDeploymentAdmitted { deployment: _ } => false
   }
 }
 
 // DEFECT 2 control, the one the old first-wins fold silently passed. Two collector attempts against ONE subject, disagreeing (the second reports failure). Selection must report Ambiguous with the candidate count rather than returning whichever the list ordered first, and the wall must refuse on it. Under the previous shape this input admitted a deployment built from attempt-1 while attempt-2's failure was dropped without a trace.
-fn two_conflicting_srv5_observations() -> List<FleetLifecycleObservation> {
+fn two_conflicting_srv9_observations() -> List<FleetLifecycleObservation> {
   [
-    srv5_good_observation(),
+    srv9_good_observation(),
     FleetLifecycleObservation {
-      subject: operator_host_srv5,
+      subject: operator_host_srv9,
       endpoint_binding: EndpointBindingIdentity {
         address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 222),
       },
@@ -501,7 +439,7 @@ fn two_conflicting_srv5_observations() -> List<FleetLifecycleObservation> {
       envelope: FleetLifecycleEnvelope {
         tool: "device_identity.py",
         ts: "2026-08-07T00:05:00Z",
-        host: "srv5",
+        host: "srv9",
         status: StatusError,
         rc: 1,
         duration_ms: 42,
@@ -515,10 +453,10 @@ fn two_conflicting_srv5_observations() -> List<FleetLifecycleObservation> {
 
 test fn w_red_two_attempts_for_one_subject_select_ambiguous() -> Bool {
   match select_observation_for_subject(
-    subject: operator_host_srv5,
-    observations: two_conflicting_srv5_observations(),
+    subject: operator_host_srv9,
+    observations: two_conflicting_srv9_observations(),
   ) {
-    ObservationAmbiguous { subject: s, candidate_count: n } => s == operator_host_srv5 && n == 2
+    ObservationAmbiguous { subject: s, candidate_count: n } => s == operator_host_srv9 && n == 2
     ObservationUnique { observation: _ } => false
     ObservationMissing { subject: _ } => false
   }
@@ -526,17 +464,17 @@ test fn w_red_two_attempts_for_one_subject_select_ambiguous() -> Bool {
 
 test fn w_red_admission_on_ambiguous_evidence_refuses() -> Bool {
   match admit_dgx_spark_deployment(
-    identity: operator_host_srv5,
+    identity: operator_host_srv9,
     catalog: nvidia_dgx_spark_4tb_catalog,
     selection: select_observation_for_subject(
-      subject: operator_host_srv5,
-      observations: two_conflicting_srv5_observations(),
+      subject: operator_host_srv9,
+      observations: two_conflicting_srv9_observations(),
     ),
-    router_binding: synthetic_bound_binding_for(identity_host: "srv5", last_octet: 222),
+    router_binding: synthetic_bound_binding_for(identity_host: "srv9", last_octet: 222),
   ) {
     DgxSparkDeploymentRefused {
       reason: DeploymentAdmissionAmbiguousEvidence { requested_identity: i, candidate_count: n }
-    } => i == operator_host_srv5 && n == 2
+    } => i == operator_host_srv9 && n == 2
     DgxSparkDeploymentRefused { reason: _ } => false
     DgxSparkDeploymentAdmitted { deployment: _ } => false
   }
@@ -544,23 +482,23 @@ test fn w_red_admission_on_ambiguous_evidence_refuses() -> Bool {
 
 // The three arms of selection are all reachable and distinct: zero candidates, exactly one, and the attempt-exact disambiguation that resolves the ambiguous case above to a unique pick. Naming the attempt is the ONLY way to narrow it -- list position never is.
 test fn w_selection_is_zero_one_many_and_attempt_disambiguates() -> Bool {
-  match select_observation_for_subject(subject: operator_host_srv5, observations: []) {
-    ObservationMissing { subject: s } => s == operator_host_srv5
+  match select_observation_for_subject(subject: operator_host_srv9, observations: []) {
+    ObservationMissing { subject: s } => s == operator_host_srv9
     ObservationUnique { observation: _ } => false
     ObservationAmbiguous { subject: _, candidate_count: _ } => false
   }
     && match select_observation_for_subject(
-      subject: operator_host_srv5,
-      observations: [srv5_good_observation()],
+      subject: operator_host_srv9,
+      observations: [srv9_good_observation()],
     ) {
-      ObservationUnique { observation: o } => o.subject == operator_host_srv5
+      ObservationUnique { observation: o } => o.subject == operator_host_srv9
       ObservationMissing { subject: _ } => false
       ObservationAmbiguous { subject: _, candidate_count: _ } => false
     }
     && match select_observation_by_attempt(
-      subject: operator_host_srv5,
+      subject: operator_host_srv9,
       attempt: process_receipt(label: "attempt-2", exit_status: 1),
-      observations: two_conflicting_srv5_observations(),
+      observations: two_conflicting_srv9_observations(),
     ) {
       ObservationUnique { observation: o } => o.envelope.rc == 1
       ObservationMissing { subject: _ } => false
@@ -568,11 +506,11 @@ test fn w_selection_is_zero_one_many_and_attempt_disambiguates() -> Bool {
     }
 }
 
-// Selection keys on the DISPATCH subject, not on what the envelope printed: an observation dispatched against srv6 whose envelope says "srv5" must not be selectable as srv5's evidence. This is the selection-side half of DEFECT 1 -- the old fold matched on envelope.host, so this row WAS srv5's evidence.
+// Selection keys on the DISPATCH subject, not on what the envelope printed: an observation dispatched against srv10 whose envelope says "srv9" must not be selectable as srv9's evidence. This is the selection-side half of DEFECT 1 -- the old fold matched on envelope.host, so this row WAS srv9's evidence.
 test fn w_red_selection_ignores_envelope_host() -> Bool {
-  let o = synthetic_observation(subject_host: "srv6", envelope_host: "srv5", last_octet: 223, attempt_label: "attempt-mislabeled")
-  match select_observation_for_subject(subject: operator_host_srv5, observations: [o]) {
-    ObservationMissing { subject: s } => s == operator_host_srv5
+  let o = synthetic_observation(subject_host: "srv10", envelope_host: "srv9", last_octet: 223, attempt_label: "attempt-mislabeled")
+  match select_observation_for_subject(subject: operator_host_srv9, observations: [o]) {
+    ObservationMissing { subject: s } => s == operator_host_srv9
     ObservationUnique { observation: _ } => false
     ObservationAmbiguous { subject: _, candidate_count: _ } => false
   }
@@ -600,17 +538,17 @@ test fn w_live_procurement_convergence_is_pending_for_both_units() -> Bool {
 test fn w_procurement_converges_when_both_units_are_bound_and_observed() -> Bool {
   match converge_dgx_spark_procurement(
     bindings: [
-      synthetic_bound_binding_for(identity_host: "srv5", last_octet: 222),
-      synthetic_bound_binding_for(identity_host: "srv6", last_octet: 223),
+      synthetic_bound_binding_for(identity_host: "srv9", last_octet: 222),
+      synthetic_bound_binding_for(identity_host: "srv10", last_octet: 223),
     ],
     observations: [
-      srv5_good_observation(),
-      synthetic_observation(subject_host: "srv6", envelope_host: "srv6", last_octet: 223, attempt_label: "attempt-srv6"),
+      srv9_good_observation(),
+      synthetic_observation(subject_host: "srv10", envelope_host: "srv10", last_octet: 223, attempt_label: "attempt-srv10"),
     ],
   ) {
     DgxSparkProcurementConverged { deployments: ds } =>
       count(ds) == 2
-        && map(ds, d => d.identity) == [operator_host_srv5, operator_host_srv6]
+        && map(ds, d => d.identity) == [operator_host_srv9, operator_host_srv10]
     DgxSparkProcurementPending { pending: _ } => false
   }
 }
@@ -619,12 +557,12 @@ test fn w_procurement_converges_when_both_units_are_bound_and_observed() -> Bool
 test fn w_red_partial_arrival_does_not_converge() -> Bool {
   match converge_dgx_spark_procurement(
     bindings: [
-      synthetic_bound_binding_for(identity_host: "srv5", last_octet: 222),
-      SlotUnassigned { identity: operator_host_srv6 },
+      synthetic_bound_binding_for(identity_host: "srv9", last_octet: 222),
+      SlotUnassigned { identity: operator_host_srv10 },
     ],
     observations: [
-      srv5_good_observation(),
-      synthetic_observation(subject_host: "srv6", envelope_host: "srv6", last_octet: 223, attempt_label: "attempt-srv6"),
+      srv9_good_observation(),
+      synthetic_observation(subject_host: "srv10", envelope_host: "srv10", last_octet: 223, attempt_label: "attempt-srv10"),
     ],
   ) {
     DgxSparkProcurementPending { pending: p } =>
@@ -637,7 +575,7 @@ test fn w_red_partial_arrival_does_not_converge() -> Bool {
               DgxSparkUnitPending {
                 identity: i,
                 reason: DeploymentAdmissionRouterBindingPending { requested_identity: _ },
-              } => i == operator_host_srv6
+              } => i == operator_host_srv10
               DgxSparkUnitPending { identity: _, reason: _ } => false
               DgxSparkUnitDeployed { deployment: _ } => false
             }
@@ -649,20 +587,20 @@ test fn w_red_partial_arrival_does_not_converge() -> Bool {
 // The dispatcher's own record of the process and the tool's self-reported rc are two independent facts about one execution. A tool that reports success in its payload while the process exited nonzero is precisely the case a single self-reported field cannot express, and it must refuse rather than trusting either side alone.
 test fn w_red_admission_when_execution_receipt_disagrees_with_reported_rc_refuses() -> Bool {
   let o = FleetLifecycleObservation {
-    subject: operator_host_srv5,
+    subject: operator_host_srv9,
     endpoint_binding: EndpointBindingIdentity {
       address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 222),
     },
     execution_receipt: process_receipt(label: "attempt-disagreeing-exit", exit_status: 1),
-    envelope: synthetic_envelope_for(host: "srv5"),
+    envelope: synthetic_envelope_for(host: "srv9"),
     raw_evidence_identity: content_hash_of_value(value: "attempt-disagreeing-exit"),
     device_hardware_identity: none,
   }
   match admit_dgx_spark_deployment(
-    identity: operator_host_srv5,
+    identity: operator_host_srv9,
     catalog: nvidia_dgx_spark_4tb_catalog,
     selection: ObservationUnique { observation: o },
-    router_binding: synthetic_bound_binding_for(identity_host: "srv5", last_octet: 222),
+    router_binding: synthetic_bound_binding_for(identity_host: "srv9", last_octet: 222),
   ) {
     DgxSparkDeploymentRefused {
       reason: DeploymentAdmissionExecutionEvidenceDisagrees { receipt: rec, reported_rc: r }
@@ -715,16 +653,16 @@ fn pair_outcome_for(
   first_hw: DeviceHardwareIdentity,
   second_hw: DeviceHardwareIdentity,
 ) -> DgxSparkPairAdmissionOutcome {
-  match deployment_with_hardware(subject_host: "srv5", last_octet: 222, attempt_label: "pair-a", hardware: first_hw) {
+  match deployment_with_hardware(subject_host: "srv9", last_octet: 222, attempt_label: "pair-a", hardware: first_hw) {
     DgxSparkDeploymentAdmitted { deployment: a } =>
-      match deployment_with_hardware(subject_host: "srv6", last_octet: 223, attempt_label: "pair-b", hardware: second_hw) {
+      match deployment_with_hardware(subject_host: "srv10", last_octet: 223, attempt_label: "pair-b", hardware: second_hw) {
         DgxSparkDeploymentAdmitted { deployment: b } =>
           admit_dgx_spark_pair_deployments(first: a, second: b)
         DgxSparkDeploymentRefused { reason: r } =>
-          DgxSparkPairRefused { reason: PairUnitNotAdmitted { identity: operator_host_srv6, reason: r } }
+          DgxSparkPairRefused { reason: PairUnitNotAdmitted { identity: operator_host_srv10, reason: r } }
       }
     DgxSparkDeploymentRefused { reason: r } =>
-      DgxSparkPairRefused { reason: PairUnitNotAdmitted { identity: operator_host_srv5, reason: r } }
+      DgxSparkPairRefused { reason: PairUnitNotAdmitted { identity: operator_host_srv9, reason: r } }
   }
 }
 
@@ -739,7 +677,7 @@ test fn w_pair_admits_when_hardware_identities_are_distinct() -> Bool {
     second_hw: DeviceSerial { serial: serial_b },
   ) {
     DgxSparkPairAdmitted { first: a, second: b } =>
-      a.identity == operator_host_srv5 && b.identity == operator_host_srv6
+      a.identity == operator_host_srv9 && b.identity == operator_host_srv10
     DgxSparkPairRefused { reason: _ } => false
   }
 }
@@ -752,7 +690,7 @@ test fn w_red_pair_refuses_when_both_observations_share_one_machine() -> Bool {
   ) {
     DgxSparkPairRefused {
       reason: PairHardwareIdentityNotDistinct { first: f, second: s }
-    } => f == operator_host_srv5 && s == operator_host_srv6
+    } => f == operator_host_srv9 && s == operator_host_srv10
     DgxSparkPairRefused { reason: _ } => false
     DgxSparkPairAdmitted { first: _, second: _ } => false
   }
@@ -766,7 +704,7 @@ test fn w_red_pair_refuses_on_incomparable_identity_kinds() -> Bool {
   ) {
     DgxSparkPairRefused {
       reason: PairHardwareIdentityIncomparable { first: f, second: s }
-    } => f == operator_host_srv5 && s == operator_host_srv6
+    } => f == operator_host_srv9 && s == operator_host_srv10
     DgxSparkPairRefused { reason: _ } => false
     DgxSparkPairAdmitted { first: _, second: _ } => false
   }
@@ -775,11 +713,11 @@ test fn w_red_pair_refuses_on_incomparable_identity_kinds() -> Bool {
 // Unobserved hardware identity is not "probably distinct". This is the arm the live population reaches today: no read transport is bound and the per-tool device_identity.py payload is unmodeled, so nothing can supply this field yet, and the pair therefore refuses rather than admitting on the strength of two individually-valid observations.
 test fn w_red_pair_refuses_when_hardware_identity_is_unobserved() -> Bool {
   match admit_dgx_spark_pair_deployments(
-    first: unobserved_hw_deployment(subject_host: "srv5", last_octet: 222),
-    second: unobserved_hw_deployment(subject_host: "srv6", last_octet: 223),
+    first: unobserved_hw_deployment(subject_host: "srv9", last_octet: 222),
+    second: unobserved_hw_deployment(subject_host: "srv10", last_octet: 223),
   ) {
     DgxSparkPairRefused { reason: PairHardwareIdentityUnobserved { identity: i } } =>
-      i == operator_host_srv5
+      i == operator_host_srv9
     DgxSparkPairRefused { reason: _ } => false
     DgxSparkPairAdmitted { first: _, second: _ } => false
   }
@@ -811,10 +749,10 @@ fn unobserved_hw_deployment(subject_host: NonEmptyStr, last_octet: Int) -> DgxSp
 // One subject cannot be its own pair.
 test fn w_red_pair_refuses_when_subjects_are_not_distinct() -> Bool {
   match admit_dgx_spark_pair_deployments(
-    first: unobserved_hw_deployment(subject_host: "srv5", last_octet: 222),
-    second: unobserved_hw_deployment(subject_host: "srv5", last_octet: 222),
+    first: unobserved_hw_deployment(subject_host: "srv9", last_octet: 222),
+    second: unobserved_hw_deployment(subject_host: "srv9", last_octet: 222),
   ) {
-    DgxSparkPairRefused { reason: PairSubjectsNotDistinct { identity: i } } => i == operator_host_srv5
+    DgxSparkPairRefused { reason: PairSubjectsNotDistinct { identity: i } } => i == operator_host_srv9
     DgxSparkPairRefused { reason: _ } => false
     DgxSparkPairAdmitted { first: _, second: _ } => false
   }
@@ -853,7 +791,7 @@ test fn w_live_pair_admission_refuses_with_the_units_own_cause() -> Bool {
   match admit_dgx_spark_pair(convergence: dgx_spark_procurement_convergence()) {
     DgxSparkPairRefused {
       reason: PairUnitNotAdmitted { identity: i, reason: DeploymentAdmissionNoEvidence { requested_identity: _ } }
-    } => i == operator_host_srv5
+    } => i == operator_host_srv9
     DgxSparkPairRefused { reason: _ } => false
     DgxSparkPairAdmitted { first: _, second: _ } => false
   }
diff --git a/dag/test/claim/documentary_refs_witness_test.dag b/dag/test/claim/documentary_refs_witness_test.dag
index 72b304b0b35..1068023961d 100644
--- a/dag/test/claim/documentary_refs_witness_test.dag
+++ b/dag/test/claim/documentary_refs_witness_test.dag
@@ -10,7 +10,7 @@ import gunbc.documentary_refs {
   documentary_ref_symbol_text,
   generated_document_declaration_refs,
   v1_maintenance_standing_ref,
-  required_gate_prefixes_ref,
+  required_gate_subjects_ref,
 }
 import gunbc.design_document { expected_design_md }
 
@@ -28,7 +28,7 @@ fn fixture_modules() -> List<ModuleDeclarationFact> {
     ModuleDeclarationFact { module: "v2.compiler.resolve", path: "src/v2/compiler/03_resolve.dag" },
     ModuleDeclarationFact { module: "gunbc.roadmap_authority", path: "dag/gunbc/roadmap/roadmap_authority.dag" },
     ModuleDeclarationFact { module: "gunbc.v1_maintenance_standing", path: "dag/gunbc/v1/v1_maintenance_standing.dag" },
-    ModuleDeclarationFact { module: "v2.workflow.required_floor", path: "src/v2/workflow/required_floor.dag" },
+    ModuleDeclarationFact { module: "gunbc.emitted_subject_build_gate", path: "dag/gunbc/emitted_subject_build_gate.dag" },
   ]
 }
 
@@ -46,14 +46,6 @@ fn fixture_fact(qualified_name: String, name: String, path: String) -> DeclFact
 // generated_document_declaration_refs(). This is the
 // control that proves the refusals below are caused by the perturbation rather than by a fixture
 // that never resolved anything.
-//
-// THE `v2.` PREFIX IS ABSENT FROM THE required_gate_prefixes FACT ON PURPOSE AND IS NOT A TYPO. A
-// DeclFact carries the LOGICAL qualified name: v2.std.decl_index logical_qualified_name_from_module
-// strips a leading `v2.` when it builds the name the resolver matches on, while
-// module_path_declared compares the module row against the FULL path. So fixture_modules() says
-// `v2.workflow.required_floor` and the fact says `workflow.required_floor.required_gate_prefixes`,
-// and both are correct. The asymmetry was invisible until that row, because the only other fact
-// here names a `gunbc.` module with nothing to strip.
 fn intact_facts() -> List<DeclFact> {
   [
     fixture_fact(
@@ -62,9 +54,9 @@ fn intact_facts() -> List<DeclFact> {
       path: "dag/gunbc/v1/v1_maintenance_standing.dag",
     ),
     fixture_fact(
-      qualified_name: "workflow.required_floor.required_gate_prefixes",
-      name: "required_gate_prefixes",
-      path: "src/v2/workflow/required_floor.dag",
+      qualified_name: "gunbc.emitted_subject_build_gate.emitted_subject_build_rows",
+      name: "emitted_subject_build_rows",
+      path: "dag/gunbc/emitted_subject_build_gate.dag",
     ),
   ]
 }
@@ -132,6 +124,6 @@ test fn documentary_refs_ambiguous_system_refuses() -> Bool {
 test fn documentary_refs_generated_document_renders_the_rows() -> Bool {
   let md = expected_design_md()
   string_contains(s: md, pattern: documentary_ref_symbol_text(reference: v1_maintenance_standing_ref))
-    && string_contains(s: md, pattern: documentary_ref_symbol_text(reference: required_gate_prefixes_ref))
+    && string_contains(s: md, pattern: documentary_ref_symbol_text(reference: required_gate_subjects_ref))
 }
 
diff --git a/dag/test/claim/durable_cas_file_store_wet_witness_test.dag b/dag/test/claim/durable_cas_file_store_wet_witness_test.dag
index b0e73e9924d..3a8ca38f843 100644
--- a/dag/test/claim/durable_cas_file_store_wet_witness_test.dag
+++ b/dag/test/claim/durable_cas_file_store_wet_witness_test.dag
@@ -9,6 +9,7 @@ import std.durable_compare_and_set {
   CasOutcome, CasCommitted, CasPreconditionFailed, CasStoreRefused,
   CasReadableAbsent, CasReadablePresent, CasObservedReadable, CasObservedUnreadable,
   CasGenerationPublicationRefused,
+  CasGeneration,
   cas_generation_count,
 }
 import std.checked_arithmetic { int_inclusive_max }
@@ -17,7 +18,8 @@ import gunbc.durable_cas_file_store {
   admit_cas_attempt, file_compare_and_set, DefaultAccessCreateOnly, observe_cas_slot_state, cas_file_slot_path,
   file_compare_and_set_windowed, observe_cas_slot_state_windowed, CasGenerationWindow,
   cas_generation_window, CasGenerationWindowAdmitted, CasGenerationWindowTooNarrow,
-  CasSlotProbe, ProbedHead, cas_probe_gallop,
+  CasSlotProbe, ProbedHead, cas_probe_gallop, cas_reclaim_below,
+  CasReclaimed, CasReclamationIncomplete, CasReclamationUnlisted, CasReclamationNotDeclared, CasReclamationNotCommitted,
 }
 
 // Wet controls for the file-backed CAS provider. Hermetic mint and classification
@@ -291,6 +293,66 @@ test fn a_racing_writer_under_a_window_retries_and_loses_no_commit_by_real_execu
     && removed.success
 }
 
+fn plant_generation(root: NonEmptyStr, key: NonEmptyStr, generation: CasGeneration, payload: String) -> Bool {
+  Filesystem.WriteCreateNew(path: cas_file_slot_path(root: root, key: key, generation: generation), content: payload).success
+}
+
+// TERMINATION REGRESSION, NOT THE HANG'S RED. Measured against main's recursive
+// cas_observe_window this two-file plant is GREEN (listed max 1501, successor 1502 absent, retry
+// arm never runs): BuildBuddy invocation 492a33d7-ff9a-4fcf-8007-4fd7029aa139. It does not
+// reproduce the production hang at hold-typed_module.1507/.1508. It asserts that a fold over eight
+// cas_observe_window_once passes cannot fail to return. Persistent List-omits-true-max is a
+// frontier measured by gunbc#13482 after this lands; ProbedWindowHeadUnsettled there is a counted
+// store Unavailable, not a kill.
+test fn a_window_observation_at_generation_1500_terminates_by_real_execution() -> Bool {
+  let root_path = fresh_root()
+  let root = root_path as NonEmptyStr
+  let w = window_of(k: 2)
+  let planted = plant_generation(root: root, key: "hold-typed_module", generation: 1500, payload: "g1500")
+    && plant_generation(root: root, key: "hold-typed_module", generation: 1501, payload: "g1501")
+  let observed = match w {
+    Absent => false
+    Present { value: win } => match observe_cas_slot_state_windowed(root: root, key: "hold-typed_module", window: win) {
+      CasObservedReadable { readable: r } => match r {
+        CasReadablePresent { version: v } => v.value == "g1501" && cas_generation_count(g: v.generation) == 1501
+        CasReadableAbsent => false
+      }
+      CasObservedUnreadable { cause: _ } => true
+    }
+  }
+  let removed = shell.Remove.RecursiveForce(path: root_path)
+  planted && observed && removed.success
+}
+
+// A DELETE THAT FAILS MUST NOT PUNCH A HOLE. Independent reclaim of every generation at or below
+// the floor could remove G+1 while G stayed, so named window verify would report G as head. This
+// plants G as a nonempty directory (unlink refuses) and G+1 as a file, then reclaims at head 4
+// with k=2. The later eligible generation must still read present.
+test fn reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution() -> Bool {
+  let root_path = fresh_root()
+  let root = root_path as NonEmptyStr
+  let key = "hold-typed_module" as NonEmptyStr
+  let path1 = cas_file_slot_path(root: root, key: key, generation: 1)
+  let planted = shell.Mkdir.NewOwnerOnly(path: path1).success
+    && Filesystem.WriteCreateNew(path: concat(path1, "/stuck"), content: "x").success
+    && plant_generation(root: root, key: key, generation: 2, payload: "g2")
+    && plant_generation(root: root, key: key, generation: 3, payload: "g3")
+    && plant_generation(root: root, key: key, generation: 4, payload: "g4")
+  let reclaimed = match window_of(k: 2) {
+    Absent => false
+    Present { value: w } => match cas_reclaim_below(root: root, key: key, window: w, head: 4) {
+      CasReclamationIncomplete { removed: _, failed: f } => count(f) == 1
+      CasReclaimed { removed: _ } => false
+      CasReclamationUnlisted { cause: _ } => false
+      CasReclamationNotDeclared => false
+      CasReclamationNotCommitted => false
+    }
+  }
+  let successor_still_there = Filesystem.Read(path: cas_file_slot_path(root: root, key: key, generation: 2)).success
+  let removed = shell.Remove.RecursiveForce(path: root_path)
+  planted && reclaimed && successor_still_there && removed.success
+}
+
 // The window's floor is construction: k < 2 has no admitted window.
 test fn a_window_narrower_than_two_is_not_admitted() -> Bool {
   match cas_generation_window(k: 1) {
diff --git a/dag/test/claim/durable_compare_and_set_witness_test.dag b/dag/test/claim/durable_compare_and_set_witness_test.dag
index 60709fa44d5..03178a6dba7 100644
--- a/dag/test/claim/durable_compare_and_set_witness_test.dag
+++ b/dag/test/claim/durable_compare_and_set_witness_test.dag
@@ -161,6 +161,8 @@ test fn an_unreadable_slot_is_a_store_refusal_not_a_lost_race() -> Bool {
     && is_store_refusal(outcome: missing)
     && is_store_refusal(outcome: refused)
     && is_store_refusal(outcome: beyond)
+    && cas_unreadable_slot_detail(cause: CasUnreadableObservationBoundExceeded { bound: 8 })
+      == "observation bound exceeded: 8"
 }
 
 fn is_store_refusal(outcome: CasOutcome<NonEmptyStr>) -> Bool {
diff --git a/dag/test/claim/durable_exclusive_hold_file_store_wet_witness_test.dag b/dag/test/claim/durable_exclusive_hold_file_store_wet_witness_test.dag
index 3172ed2d2e3..f3ce2f196b6 100644
--- a/dag/test/claim/durable_exclusive_hold_file_store_wet_witness_test.dag
+++ b/dag/test/claim/durable_exclusive_hold_file_store_wet_witness_test.dag
@@ -11,6 +11,12 @@ import std.durable_exclusive_hold {
   HoldReleaseAgainstAnotherGeneration, HoldReleaseSlotUndecodable, HoldReleaseObservationUnavailable,
 }
 import gunbc.durable_cas_file_store { cas_file_slot_path }
+import std.process { ProcessExit, ExitSuccess, ExitFailure }
+import gunbc.machine_intake_arrival_subject { admit_arrival_subject, ArrivalSubjectInPopulation }
+import gunbc.machine_intake_arrival_interlock {
+  arrival_after_acquire, arrival_archive_slot_acquire, arrival_archive_slot_release,
+  ArrivalArchiveSlotAcquired, ArrivalArchiveSlotAcquireRefused, ArrivalArchiveSlotReleaseRefused,
+}
 import gunbc.durable_exclusive_hold_file_store {
   FileHoldAcquireOutcome, FileHoldAcquired, FileHoldOccupied, FileHoldAcquireLost,
   FileHoldAcquireStoreUnavailable, FileHoldSlotUndecodable, FileHoldKeyNotSlotAddressable,
@@ -353,3 +359,70 @@ test fn a_release_committed_after_the_slot_moved_is_lost_not_successful_by_real_
     && no_third
     && removed.success
 }
+
+test fn w_after_acquire_invokes_the_real_slot_release() -> Bool {
+  let root_path = wh_fresh_root()
+  let root = root_path as NonEmptyStr
+  match admit_arrival_subject(wire: "mtjade1") {
+    ArrivalSubjectInPopulation { subject: s } =>
+      match arrival_after_acquire(
+        outcome: arrival_archive_slot_acquire(
+          root: root,
+          subject: s,
+          owner: "arrival-release-inhabitance" as DurableHoldOwnerRef,
+        ),
+        body: fn() { ExitSuccess },
+        release_fn: fn(h) { arrival_archive_slot_release(root: root, held: h) },
+      ) {
+        ExitFailure { code: _, reason: _ } =>
+          shell.Remove.RecursiveForce(path: root_path).success && false
+        ExitSuccess =>
+          match arrival_archive_slot_acquire(
+            root: root,
+            subject: s,
+            owner: "arrival-release-inhabitance-2" as DurableHoldOwnerRef,
+          ) {
+            ArrivalArchiveSlotAcquireRefused { cause: _ } =>
+              shell.Remove.RecursiveForce(path: root_path).success && false
+            ArrivalArchiveSlotAcquired { held: _ } =>
+              shell.Remove.RecursiveForce(path: root_path).success
+          }
+      }
+    _ => shell.Remove.RecursiveForce(path: root_path).success && false
+  }
+}
+
+fn arrival_body_writes_marker(marker: String) -> ProcessExit {
+  if Filesystem.WriteCreateNew(path: marker, content: "BODY").success {
+    ExitSuccess
+  } else {
+    ExitFailure { code: 1, reason: "marker write failed" }
+  }
+}
+
+test fn w_failed_acquire_runs_no_body() -> Bool {
+  let root_path = wh_fresh_root()
+  let marker = concat(root_path, "/body-ran")
+  match arrival_after_acquire(
+    outcome: ArrivalArchiveSlotAcquireRefused { cause: "slot occupied" as NonEmptyStr },
+    body: fn() { arrival_body_writes_marker(marker: marker) },
+    release_fn: fn(h) {
+      ArrivalArchiveSlotReleaseRefused { cause: "release must not run on refused acquire" as NonEmptyStr }
+    },
+  ) {
+    ExitSuccess => shell.Remove.RecursiveForce(path: root_path).success && false
+    ExitFailure { code: _, reason: _ } =>
+      !Filesystem.Read(path: marker).success && shell.Remove.RecursiveForce(path: root_path).success
+  }
+}
+
+test fn w_refused_acquire_body_writes_a_marker_when_called_directly() -> Bool {
+  let root_path = wh_fresh_root()
+  let marker = concat(root_path, "/body-ran")
+  match arrival_body_writes_marker(marker: marker) {
+    ExitFailure { code: _, reason: _ } =>
+      shell.Remove.RecursiveForce(path: root_path).success && false
+    ExitSuccess =>
+      Filesystem.Read(path: marker).success && shell.Remove.RecursiveForce(path: root_path).success
+  }
+}
diff --git a/dag/test/claim/durable_exclusive_hold_witness_test.dag b/dag/test/claim/durable_exclusive_hold_witness_test.dag
index fc2efbd5b7f..58463c7747c 100644
--- a/dag/test/claim/durable_exclusive_hold_witness_test.dag
+++ b/dag/test/claim/durable_exclusive_hold_witness_test.dag
@@ -30,7 +30,11 @@ import std.durable_exclusive_hold {
 import gunbc.durable_exclusive_hold_file_store {
   HoldPayloadDecode, HoldPayloadDecoded, HoldPayloadUndecodable,
   hold_slot_payload, decode_hold_slot_payload, hold_observation_of_cas,
+  windowed_hold_release_from_verify, windowed_hold_recovery_from_verify,
+  WindowedHoldReleaseNamedHeadMoved, WindowedHoldReleaseProtocol,
+  WindowedHoldRecoveryNamedHeadMoved, WindowedHoldRecoveryProtocol,
 }
+import gunbc.durable_cas_file_store { NamedWindowHeadMoved }
 
 // THE PURE HALF OF THE HOLD PROTOCOL AND ITS CODEC. Every row here decides
 // from a supplied observation over the PURE assessments; nothing reaches a
@@ -367,3 +371,26 @@ test fn a_dead_verdict_recovers_only_the_hold_it_was_taken_of() -> Bool {
       _ => false
     })
 }
+
+test fn named_window_head_moved_release_does_not_claim_an_observed_current_generation() -> Bool {
+  match windowed_hold_release_from_verify(
+    verify: NamedWindowHeadMoved { named_generation: 3 },
+    owner: eh_owner(text: "demand-7|offer-1"),
+    acquired_generation: 3,
+  ) {
+    WindowedHoldReleaseNamedHeadMoved { named: n } =>
+      cas_generation_count(g: n) == 3
+    WindowedHoldReleaseProtocol { assessment: _ } => false
+    _ => false
+  }
+}
+
+test fn named_window_head_moved_recovery_does_not_claim_an_observed_current_generation() -> Bool {
+  let dead = eh_report(holder: "mtcollins1-boot:4242", generation: 3, dead: 1)
+  match windowed_hold_recovery_from_verify(verify: NamedWindowHeadMoved { named_generation: 3 }, report: dead) {
+    WindowedHoldRecoveryNamedHeadMoved { named: n } =>
+      cas_generation_count(g: n) == 3
+    WindowedHoldRecoveryProtocol { assessment: _ } => false
+    _ => false
+  }
+}
diff --git a/dag/test/claim/emitted_manifest_runtime_features_witness_test.dag b/dag/test/claim/emitted_manifest_runtime_features_witness_test.dag
index cee5eda7241..a5d739f6163 100644
--- a/dag/test/claim/emitted_manifest_runtime_features_witness_test.dag
+++ b/dag/test/claim/emitted_manifest_runtime_features_witness_test.dag
@@ -11,18 +11,11 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // and refused under CI. The two facts are now one authority: v1.compiler.runtime_rust
 // rust_runtime_cargo_features supplies both the cfg spelling the runtime writes and
 // the rows every manifest writer renders. These two claims are the executing pair --
-// the cfg arm is present in the emitted runtime, and the feature is declared in the
-// emitted manifest -- so a fork between them reds here rather than in a CI job whose
-// subject is something else.
-test fn emitted_manifest_declares_the_runtime_gated_feature() -> Bool {
-  compile_dag_rust_emit_check(
-    "module emittedmanifestfeaturefix\n\nfn one() -> Int {\n  1\n}\n",
-    "Cargo.toml",
-    ["[features]", "text_lookup_work_counter = []"],
-    []
-  )
-}
-
+// the cfg arm is present in the emitted runtime (here), and the feature is declared in
+// the manifest of the crate that owns the runtime (the partition renderer's, asserted by
+// the seed unit test cli_run::emitted_crate_workspace_host::tests
+// the_runtime_crate_manifest_declares_the_runtime_gated_feature) -- so a fork between them
+// reds rather than surfacing in a CI job whose subject is something else.
 test fn emitted_runtime_gates_on_the_declared_feature() -> Bool {
   compile_dag_rust_emit_check(
     "module emittedruntimecfgfix\n\nfn one() -> Int {\n  1\n}\n",
diff --git a/dag/test/claim/empty_list_element_fabrication_witness_test.dag b/dag/test/claim/empty_list_element_fabrication_witness_test.dag
index 58314f3eea4..fb3ff421f65 100644
--- a/dag/test/claim/empty_list_element_fabrication_witness_test.dag
+++ b/dag/test/claim/empty_list_element_fabrication_witness_test.dag
@@ -41,3 +41,25 @@ test fn an_empty_list_in_both_branches_does_not_fabricate_a_unit_element() -> Bo
 test fn a_typed_branch_beside_an_empty_one_still_resolves() -> Bool {
   compiles_with_no_blocking_diagnostic(source: green_one_branch_typed_source)
 }
+
+// EVAL CONTROL for gunbc.recurring_failure_mode empty_list_evaluates_to_unit.
+// Discriminates the silent-wrongness class: concat from [] as List<T> must yield a T
+// record, not Unit. Reading .path would TypeError with "cannot access field 'path' on
+// Unit" if the empty init (or concat) fabricated Unit as an element — the generated-lane
+// specimen. This claim does not assert which eval_expr_inner arm ran (ExprListLit vs
+// NoExprData TypeError); a TypeError RED for the new refusal is not authorable as an
+// Accepted value claim without injecting typed IR (review 77955).
+type EmptyListEvalFile { path: String }
+
+data empty_list_eval_seed: List<EmptyListEvalFile> = [EmptyListEvalFile { path: "a" }]
+
+fn empty_list_eval_concat_from_empty() -> List<EmptyListEvalFile> {
+  fold(empty_list_eval_seed, init: [] as List<EmptyListEvalFile>, f: (acc, f) => concat(acc, [f]))
+}
+
+test fn empty_list_concat_element_is_not_unit_at_eval() -> Bool {
+  match empty_list_eval_concat_from_empty() |> first {
+    Present { value: f } => f.path == "a"
+    Absent => false
+  }
+}
diff --git a/dag/test/claim/env_freshness_witness.dag b/dag/test/claim/env_freshness_witness.dag
index 01b51f267c8..9eb6c06c589 100644
--- a/dag/test/claim/env_freshness_witness.dag
+++ b/dag/test/claim/env_freshness_witness.dag
@@ -5,7 +5,10 @@ data path_env_name: NonEmptyStr = "PATH"
 
 fn witness_env_get_path() -> Bool {
   let r = shell.Env.Get(name: path_env_name)
-  return r.value != null && (r.value != "")
+  return match r.value {
+    Present { value: v } => v != ""
+    Absent => false
+  }
 }
 
 fn env_freshness_keystone_holds() -> Bool {
diff --git a/dag/test/claim/extdeps_git_diff_name_status_witness_test.dag b/dag/test/claim/extdeps_git_diff_name_status_witness_test.dag
index 6116838e4be..c86fa72150f 100644
--- a/dag/test/claim/extdeps_git_diff_name_status_witness_test.dag
+++ b/dag/test/claim/extdeps_git_diff_name_status_witness_test.dag
@@ -32,7 +32,10 @@ test fn w_modified_single_entry() -> Bool {
   let raw = join_name_status_tokens(["M", "file.txt"])
   let entries = well_formed_entries(raw: raw)
   entries.length() == 1
-    && entries.first().path == "file.txt"
+    && match entries.first() {
+         Present { value: e } => e.path == "file.txt"
+         Absent => false
+       }
     && match entries.first().old_path {
       Absent => true
       Present { value: _ } => false
@@ -57,7 +60,10 @@ test fn w_deleted_entry() -> Bool {
   let raw = join_name_status_tokens(["D", "gone.txt"])
   let entries = well_formed_entries(raw: raw)
   entries.length() == 1
-    && entries.first().path == "gone.txt"
+    && match entries.first() {
+         Present { value: e } => e.path == "gone.txt"
+         Absent => false
+       }
     && match entries.first().status {
       DiffDeletedStatus => true
       _ => false
@@ -68,7 +74,10 @@ test fn w_renamed_entry_carries_similarity_and_old_path() -> Bool {
   let raw = join_name_status_tokens(["R100", "old_name.txt", "new_name.txt"])
   let entries = well_formed_entries(raw: raw)
   entries.length() == 1
-    && entries.first().path == "new_name.txt"
+    && match entries.first() {
+         Present { value: e } => e.path == "new_name.txt"
+         Absent => false
+       }
     && match entries.first().old_path {
       Present { value: old } => old == "old_name.txt"
       Absent => false
@@ -83,7 +92,10 @@ test fn w_copied_entry_carries_similarity_and_old_path() -> Bool {
   let raw = join_name_status_tokens(["C87", "source.txt", "copy.txt"])
   let entries = well_formed_entries(raw: raw)
   entries.length() == 1
-    && entries.first().path == "copy.txt"
+    && match entries.first() {
+         Present { value: e } => e.path == "copy.txt"
+         Absent => false
+       }
     && match entries.first().old_path {
       Present { value: old } => old == "source.txt"
       Absent => false
@@ -103,10 +115,22 @@ test fn w_mixed_multi_entry_blob_preserves_order_and_arity() -> Bool {
   ])
   let entries = well_formed_entries(raw: raw)
   entries.length() == 4
-    && entries.first().path == "a.txt"
-    && entries.skip(n: 1).first().path == "b.txt"
-    && entries.skip(n: 2).first().path == "c.txt"
-    && entries.skip(n: 3).first().path == "new_d.txt"
+    && match entries.first() {
+         Present { value: e } => e.path == "a.txt"
+         Absent => false
+       }
+    && match entries.skip(n: 1).first() {
+         Present { value: e } => e.path == "b.txt"
+         Absent => false
+       }
+    && match entries.skip(n: 2).first() {
+         Present { value: e } => e.path == "c.txt"
+         Absent => false
+       }
+    && match entries.skip(n: 3).first() {
+         Present { value: e } => e.path == "new_d.txt"
+         Absent => false
+       }
     && match entries.skip(n: 3).first().old_path {
       Present { value: old } => old == "old_d.txt"
       Absent => false
diff --git a/dag/test/claim/extdeps_git_versioning_witness_test.dag b/dag/test/claim/extdeps_git_versioning_witness_test.dag
index 883bb809bbd..90ceca5cc97 100644
--- a/dag/test/claim/extdeps_git_versioning_witness_test.dag
+++ b/dag/test/claim/extdeps_git_versioning_witness_test.dag
@@ -2,69 +2,104 @@ module test.claim.extdeps_git_versioning_witness
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
+// THE ANCHOR IS PINNED AGAINST ITS PARSED FORM, so the code-point representation is proved,
+// not assumed: a field holding control characters instead of digits fails here. The anchor is
+// an Optional (review 77150: the parse result itself, no fabricated fallback), so every
+// consumer unwraps it and a refused label shows up as a failed witness, not a wrong version.
 test fn w_git_2_0_anchor() -> Bool {
-  git_2_0_release.major == 2
-    && git_2_0_release.minor == 0
-    && git_2_0_release.patch == 0
+  match git_2_0_release {
+    Absent => false
+    Present { value: anchor } =>
+      git_release_version_label(v: anchor) == "2.0.0"
+        && git_release_version_compare(a: anchor, b: anchor) == Equal
+  }
 }
 
 test fn w_release_version_compare_major_minor_patch() -> Bool {
-  let older = GitReleaseVersion { major: 2, minor: 43, patch: 0 }
-  let newer = GitReleaseVersion { major: 2, minor: 44, patch: 0 }
-  let same = GitReleaseVersion { major: 2, minor: 43, patch: 1 }
-  match git_release_version_compare(a: older, b: newer) {
-    Less =>
-      match git_release_version_compare(a: newer, b: older) {
-        Greater =>
-          match git_release_version_compare(a: older, b: same) {
+  match git_release_version_from_text(text: "2.43.0") {
+    Present { value: older } => match git_release_version_from_text(text: "2.44.0") {
+      Present { value: newer } => match git_release_version_from_text(text: "2.43.1") {
+        Present { value: same } =>
+          match git_release_version_compare(a: older, b: newer) {
             Less =>
-              match git_release_version_compare(a: older, b: older) {
-                Equal => true
+              match git_release_version_compare(a: newer, b: older) {
+                Greater =>
+                  match git_release_version_compare(a: older, b: same) {
+                    Less =>
+                      match git_release_version_compare(a: older, b: older) {
+                        Equal => true
+                        _ => false
+                      }
+                    _ => false
+                  }
                 _ => false
               }
             _ => false
           }
         _ => false
       }
+      _ => false
+    }
     _ => false
   }
 }
 
 test fn w_major_breaking_release_orders_above_prior_minor_series() -> Bool {
-  let git_1_9 = GitReleaseVersion { major: 1, minor: 9, patch: 5 }
-  match git_release_version_compare(a: git_1_9, b: git_2_0_release) {
-    Less => true
+  match git_release_version_from_text(text: "1.9.5") {
+    Present { value: git_1_9 } =>
+      match git_2_0_release {
+        Present { value: anchor } =>
+          match git_release_version_compare(a: git_1_9, b: anchor) {
+            Less => true
+            _ => false
+          }
+        Absent => false
+      }
     _ => false
   }
 }
 
-test fn w_platform_suffix_is_structural_not_stringly() -> Bool {
+fn suffix_pair_differ(anchor: GitReleaseVersion) -> Bool {
   let plain = GitCliReportedVersion {
-    git_release: git_2_0_release,
+    git_release: anchor,
     suffix: GitVersionPlain
   }
   let windows = GitCliReportedVersion {
-    git_release: git_2_0_release,
+    git_release: anchor,
     suffix: GitVersionWindows { build: 1 }
   }
   plain.suffix != windows.suffix
 }
 
+test fn w_platform_suffix_is_structural_not_stringly() -> Bool {
+  match git_2_0_release {
+    Absent => false
+    Present { value: anchor } => suffix_pair_differ(anchor)
+  }
+}
+
 test fn w_spec_citation_points_at_breaking_changes_doc() -> Bool {
   string_contains(s: git_release_versioning_spec_url, pattern: "BreakingChanges.html")
 }
 
 test fn w_git_release_to_version_identity() -> Bool {
-  git_release_to_version_identity(v: git_2_0_release) == "2.0.0"
+  match git_2_0_release {
+    Absent => false
+    Present { value: anchor } => git_release_to_version_identity(v: anchor) == "2.0.0"
+  }
 }
 
 test fn w_git_release_version_scheme_equal() -> Bool {
-  match git_release_version_scheme.compare(
-    a: git_release_to_version_identity(v: git_2_0_release),
-    b: "2.0.0"
-  ) {
-    Equal => true
-    _ => false
+  match git_2_0_release {
+    Absent => false
+    Present { value: anchor } =>
+      match git_release_version_scheme.compare(
+        a: git_release_to_version_identity(v: anchor),
+        b: "2.0.0"
+      ) {
+        VersionCompared { ordering: v } => v == std.algebra.Equal
+        VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+      }
   }
 }
 
@@ -72,3 +107,22 @@ test fn w_min_git_version_grounded() -> Bool {
   min_git_version == ">= 2.0.0"
 }
 
+
+// The scheme routes identity comparison through git_release_version_compare — the ONE
+// implementation of the cited numeric rule — so unequal labels get the real numeric order,
+// not a placeholder answer.
+test fn w_git_release_version_scheme_orders_minor_numerically() -> Bool {
+  match git_release_version_scheme.compare(a: "2.0.0", b: "2.1.0") {
+    VersionCompared { ordering: v } => v == std.algebra.Less
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
+}
+
+// A label outside the bare MAJOR.MINOR.PATCH grammar is a located refusal: the carrier names
+// the failing side, the label, and the cause — never a fabricated order.
+test fn w_git_release_version_scheme_refuses_out_of_grammar_label() -> Bool {
+  match git_release_version_scheme.compare(a: "not-a-version", b: "2.0.0") {
+    VersionComparisonRefused { side: side, identity: i, cause: _ } => side == LeftOperand && i == "not-a-version"
+    VersionCompared { ordering: _ } => false
+  }
+}
diff --git a/dag/test/claim/extdeps_version_semver_witness_test.dag b/dag/test/claim/extdeps_version_semver_witness_test.dag
index 552b7c4fa46..41b4dd13037 100644
--- a/dag/test/claim/extdeps_version_semver_witness_test.dag
+++ b/dag/test/claim/extdeps_version_semver_witness_test.dag
@@ -7,54 +7,30 @@ fn semver_constraint_caret() -> SemVerConstraint { "^1.2" }
 fn semver_identity_1_0_0() -> SemVerIdentity { "1.0.0" }
 fn semver_constraint_one() -> SemVerConstraint { "1" }
 
-fn semver_1_0_0() -> SemVerVersion {
-  SemVerVersion {
-    major: 1,
-    minor: 0,
-    patch: 0,
-    pre_release: [],
-    build: []
-  }
+// Every version VALUE in this file arrives through the parser — the module's one admission
+// path (review 77150): no witness builds a SemVerVersion record by hand, and the one
+// identifier field a witness holds comes out of the confined semver_numeric_field
+// constructor (side chat review 5429823519). A helper whose label fails to parse yields
+// Absent, and every consumer turns Absent into a failed witness rather than a fabricated
+// order.
+fn semver_1_0_0() -> SemVerVersion? {
+  semver_version_parse(cps: chars(s: "1.0.0" as String))
 }
 
-fn semver_1_0_0_alpha() -> SemVerVersion {
-  SemVerVersion {
-    major: 1,
-    minor: 0,
-    patch: 0,
-    pre_release: [SemVerAlphanumericIdentifier { label: "alpha" }],
-    build: []
-  }
+fn semver_1_0_0_alpha() -> SemVerVersion? {
+  semver_version_parse(cps: chars(s: "1.0.0-alpha" as String))
 }
 
-fn semver_1_0_0_alpha_1() -> SemVerVersion {
-  SemVerVersion {
-    major: 1,
-    minor: 0,
-    patch: 0,
-    pre_release: [SemVerAlphanumericIdentifier { label: "alpha" }, SemVerNumericIdentifier { value: 1 }],
-    build: []
-  }
+fn semver_1_0_0_alpha_1() -> SemVerVersion? {
+  semver_version_parse(cps: chars(s: "1.0.0-alpha.1" as String))
 }
 
-fn semver_1_0_0_alpha_0() -> SemVerVersion {
-  SemVerVersion {
-    major: 1,
-    minor: 0,
-    patch: 0,
-    pre_release: [SemVerNumericIdentifier { value: 0 }, SemVerAlphanumericIdentifier { label: "alpha" }, SemVerNumericIdentifier { value: 1 }],
-    build: []
-  }
+fn semver_1_0_0_alpha_0() -> SemVerVersion? {
+  semver_version_parse(cps: chars(s: "1.0.0-0.alpha.1" as String))
 }
 
-fn semver_1_0_0_build_1() -> SemVerVersion {
-  SemVerVersion {
-    major: 1,
-    minor: 0,
-    patch: 0,
-    pre_release: [],
-    build: [SemVerNumericIdentifier { value: 1 }]
-  }
+fn semver_1_0_0_build_1() -> SemVerVersion? {
+  semver_version_parse(cps: chars(s: "1.0.0+1" as String))
 }
 
 test fn w_semver_identity_inhabits_version_identity() -> Bool {
@@ -70,68 +46,351 @@ test fn w_identity_distinct_from_constraint() -> Bool {
 }
 
 test fn w_semver_scheme_equality_compare() -> Bool {
-  semver_scheme.compare("1.0.0", "1.0.0") == std.algebra.Equal
+  match semver_scheme.compare("1.0.0", "1.0.0") {
+    VersionCompared { ordering: v } => v == std.algebra.Equal
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
 }
 
 test fn w_semver_scheme_wire_label_ordering() -> Bool {
-  semver_scheme.compare("1.0.0", "2.0.0") == std.algebra.Less
+  match semver_scheme.compare("1.0.0", "2.0.0") {
+    VersionCompared { ordering: v } => v == std.algebra.Less
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
 }
 
+// The identifier field arrives through the confined constructor: semver_numeric_field admits
+// "1" or refuses, and the admitted record is what the direct comparator consumes.
 test fn w_semver_compare_identifier_numeric_less_than_alphanumeric() -> Bool {
-  match semver_compare_identifier(
-    a: SemVerNumericIdentifier { value: 1 },
-    b: SemVerAlphanumericIdentifier { label: "alpha" }
-  ) {
-    Less => true
-    _ => false
+  match semver_numeric_field(cps: chars(s: "1" as String)) {
+    Absent => false
+    Present { value: digits } =>
+      match semver_compare_identifier(
+        a: SemVerNumericIdentifier { digits: digits },
+        b: SemVerAlphanumericIdentifier { label: "alpha" }
+      ) {
+        Less => true
+        _ => false
+      }
   }
 }
 
 test fn w_semver_version_label_core() -> Bool {
-  semver_version_label(v: semver_1_0_0()) == "1.0.0"
+  match semver_1_0_0() {
+    Absent => false
+    Present { value: v } => semver_version_label(v: v) == "1.0.0"
+  }
 }
 
 test fn w_semver_version_label_pre_release() -> Bool {
-  semver_version_label(v: semver_1_0_0_alpha_0()) == "1.0.0-0.alpha.1"
+  match semver_1_0_0_alpha_0() {
+    Absent => false
+    Present { value: v } => semver_version_label(v: v) == "1.0.0-0.alpha.1"
+  }
 }
 
 test fn w_semver_version_label_build_ignored_in_compare() -> Bool {
-  semver_version_label(v: semver_1_0_0_build_1()) == "1.0.0+1"
-    && semver_compare(a: semver_1_0_0(), b: semver_1_0_0_build_1()) == std.algebra.Equal
+  match semver_1_0_0() {
+    Absent => false
+    Present { value: left } =>
+      match semver_1_0_0_build_1() {
+        Absent => false
+        Present { value: right } =>
+          semver_version_label(v: right) == "1.0.0+1"
+            && semver_compare(a: left, b: right) == std.algebra.Equal
+      }
+  }
 }
 
 test fn w_semver_compare_pre_release_less_than_release() -> Bool {
-  match semver_compare(a: semver_1_0_0_alpha_1(), b: semver_1_0_0()) {
-    Less => true
-    _ => false
+  match semver_1_0_0_alpha_1() {
+    Absent => false
+    Present { value: pre } =>
+      match semver_1_0_0() {
+        Absent => false
+        Present { value: rel } =>
+          match semver_compare(a: pre, b: rel) {
+            Less => true
+            _ => false
+          }
+      }
   }
 }
 
 test fn w_semver_compare_pre_release_longer_set_greater() -> Bool {
-  match semver_compare(a: semver_1_0_0_alpha(), b: semver_1_0_0_alpha_1()) {
-    Less =>
-      match semver_compare(a: semver_1_0_0_alpha_1(), b: semver_1_0_0_alpha()) {
-        Greater => true
-        _ => false
+  match semver_1_0_0_alpha() {
+    Absent => false
+    Present { value: shorter } =>
+      match semver_1_0_0_alpha_1() {
+        Absent => false
+        Present { value: longer } =>
+          match semver_compare(a: shorter, b: longer) {
+            Less =>
+              match semver_compare(a: longer, b: shorter) {
+                Greater => true
+                _ => false
+              }
+            _ => false
+          }
       }
-    _ => false
   }
 }
 
 test fn w_semver_compare_major_minor_patch() -> Bool {
-  let older = SemVerVersion { major: 1, minor: 2, patch: 3, pre_release: [], build: [] }
-  let newer = SemVerVersion { major: 1, minor: 2, patch: 4, pre_release: [], build: [] }
-  match semver_compare(a: older, b: newer) {
-    Less =>
-      match semver_compare(a: newer, b: older) {
-        Greater => true
-        _ => false
+  match semver_version_parse(cps: chars(s: "1.2.3" as String)) {
+    Absent => false
+    Present { value: older } =>
+      match semver_version_parse(cps: chars(s: "1.2.4" as String)) {
+        Absent => false
+        Present { value: newer } =>
+          match semver_compare(a: older, b: newer) {
+            Less =>
+              match semver_compare(a: newer, b: older) {
+                Greater => true
+                _ => false
+              }
+            _ => false
+          }
       }
-    _ => false
   }
 }
 
 test fn w_semver_to_version_identity() -> Bool {
-  semver_to_version_identity(v: semver_1_0_0()) == "1.0.0"
+  match semver_1_0_0() {
+    Absent => false
+    Present { value: v } => semver_to_version_identity(v: v) == "1.0.0"
+  }
 }
 
+// ---------------------------------------------------------------------------
+// SCHEME-LEVEL SEMVER PRECEDENCE — SemVer 2.0.0 §11
+// (https://semver.org/#spec-item-11, the rule the module's
+// extdeps_external_authority_anchor attests). These pin `semver_scheme.compare`
+// — the wire surface a VersionScheme consumer calls — against the cited rule:
+// precedence is decided by major, then minor, then patch NUMERICALLY; a
+// pre-release version has LOWER precedence than the release; pre-release
+// identifiers compare numeric < alphanumeric, numerics numerically, alphanumeric
+// lexically in ASCII sort order, and a larger identifier set ranks higher when
+// the shared prefix is equal; build metadata is ignored.
+// ---------------------------------------------------------------------------
+test fn w_semver_scheme_minor_numeric_not_lexical() -> Bool {
+  match semver_scheme.compare("1.10.0", "1.9.0") {
+    VersionCompared { ordering: v } => v == std.algebra.Greater
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
+}
+
+test fn w_semver_scheme_release_above_pre_release() -> Bool {
+  match semver_scheme.compare("1.0.0", "1.0.0-alpha") {
+    VersionCompared { ordering: v } => v == std.algebra.Greater
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
+}
+
+test fn w_semver_scheme_numeric_identifier_lower_than_alphanumeric() -> Bool {
+  match semver_scheme.compare("1.0.0-9", "1.0.0-2x") {
+    VersionCompared { ordering: v } => v == std.algebra.Less
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
+}
+
+test fn w_semver_scheme_numeric_identifiers_compare_numerically() -> Bool {
+  match semver_scheme.compare("2.0.0-rc.10", "2.0.0-rc.2") {
+    VersionCompared { ordering: v } => v == std.algebra.Greater
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
+}
+
+test fn w_semver_scheme_numeric_identifiers_compare_numerically_wide() -> Bool {
+  match semver_scheme.compare("1.0.0-2", "1.0.0-10") {
+    VersionCompared { ordering: v } => v == std.algebra.Less
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
+}
+
+test fn w_semver_scheme_build_metadata_ignored() -> Bool {
+  match semver_scheme.compare("1.0.0+a", "1.0.0+b") {
+    VersionCompared { ordering: v } => v == std.algebra.Equal
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
+}
+
+test fn w_semver_scheme_larger_pre_release_set_greater() -> Bool {
+  match semver_scheme.compare("1.0.0-alpha.1", "1.0.0-alpha") {
+    VersionCompared { ordering: v } => v == std.algebra.Greater
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
+}
+
+// A label produced by the typed model's own serializer must order the way the typed compare
+// orders the version it labels.
+test fn w_semver_scheme_identity_round_trip_label() -> Bool {
+  match semver_1_0_0_alpha_1() {
+    Absent => false
+    Present { value: pre } =>
+      match semver_1_0_0() {
+        Absent => false
+        Present { value: rel } =>
+          match semver_compare(a: pre, b: rel) {
+            Less =>
+              match semver_scheme.compare(
+                semver_to_version_identity(v: pre),
+                semver_to_version_identity(v: rel)
+              ) {
+                VersionCompared { ordering: v } => v == std.algebra.Less
+                VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+              }
+            _ => false
+          }
+      }
+  }
+}
+
+// §11 defines precedence over VALID versions, so a label outside the §2 grammar is a LOCATED
+// refusal: the carrier names the failing side, the label, and the cause. The refusal itself is
+// pinned: the scheme must not fabricate an order for a pair the grammar does not cover.
+test fn w_semver_scheme_out_of_grammar_label_refuses_precedence() -> Bool {
+  match semver_scheme.compare("1.02.3", "1.2.3") {
+    VersionComparisonRefused { side: side, identity: i, cause: _ } => side == LeftOperand && i == "1.02.3"
+    VersionCompared { ordering: _ } => false
+  }
+}
+
+
+// §9: "Numeric identifiers MUST NOT include leading zeroes." An all-digit pre-release identifier
+// with a leading zero is neither numeric (§9) nor alphanumeric (the §2 grammar requires an
+// alphanumeric identifier to contain a non-digit), so the LABEL is out of grammar: it must refuse,
+// never rank lexically under the numeric-identifier-vs-alphanumeric rule of §11.
+test fn w_semver_pre_release_leading_zero_numeric_label_refuses() -> Bool {
+  match semver_scheme.compare("1.0.0-01", "1.0.0-1") {
+    VersionComparisonRefused { side: side, identity: i, cause: _ } => side == LeftOperand && i == "1.0.0-01"
+    VersionCompared { ordering: _ } => false
+  }
+}
+
+// The refusal's cause is HONEST: it names the grammar, not a specific defect the label may not
+// have ("1.02.3" fails on the core minor field, not on a pre-release identifier — a cause
+// claiming a leading-zero pre-release identifier would be fabricated).
+test fn w_semver_refusal_cause_names_the_grammar_not_a_specific_defect() -> Bool {
+  match semver_scheme.compare("1.02.3", "1.2.3") {
+    VersionComparisonRefused { side: _, identity: _, cause: c } =>
+      c == "label does not satisfy the SemVer 2.0.0 version grammar, so section 11 precedence is undefined for it"
+    VersionCompared { ordering: _ } => false
+  }
+}
+
+// §10 permits leading zeroes in build metadata ("1.0.0+0130"), so the permissive arm must keep
+// parsing them; the pre-release refusal must not leak into build identifiers. Build is ignored
+// by §11, so the pair is Equal.
+test fn w_semver_build_leading_zero_identifier_still_parses() -> Bool {
+  match semver_scheme.compare("1.0.0+0130", "1.0.0") {
+    VersionCompared { ordering: v } => v == Equal
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
+}
+
+// §2 is X.Y.Z with no trailing delimiter: "1.2.3." must refuse, never lose the dot and rank.
+// The old last-field handling split on the dot first and recursed onto the empty suffix, so
+// the dot vanished and the label ranked as 1.2.3 — a fabricated order for an out-of-grammar
+// label (review 76945). The repair makes the last field consume the whole remainder, so the
+// leftover delimiter fails the numeric run.
+test fn w_semver_core_refuses_trailing_delimiter_label() -> Bool {
+  match semver_scheme.compare("1.2.3.", "1.2.3") {
+    VersionComparisonRefused { side: side, identity: i, cause: _ } =>
+      side == LeftOperand && i == "1.2.3."
+    VersionCompared { ordering: _ } => false
+  }
+}
+
+// A numeric component has NO size limit in section 2 or 9, so a 20-nines field is a valid
+// label, not an out-of-grammar or out-of-range one: it must compare by its digits, at any
+// width (side chat review 5427723272). The field arrives constructor-confined —
+// semver_numeric_field admits it or refuses — and precedence projects .digits: run length is
+// the magnitude, then ASCII digit order, so no machine-integer conversion can refuse or wrap
+// it (the old unchecked accumulation wrapped 20 nines into a small positive Int that minted a
+// wrong precedence — review 76945).
+test fn w_semver_core_wide_numeric_field_compares_numerically() -> Bool {
+  match semver_scheme.compare("1.99999999999999999999.0", "1.2.0") {
+    VersionCompared { ordering: Greater } => true
+    _ => false
+  }
+}
+
+// The same no-limit rule for numeric pre-release identifiers: 99999999999999999999 is a valid
+// numeric identifier and must rank above 1.0.0-2.
+test fn w_pre_release_wide_numeric_identifier_compares_numerically() -> Bool {
+  match semver_scheme.compare("1.0.0-99999999999999999999", "1.0.0-2") {
+    VersionCompared { ordering: Greater } => true
+    _ => false
+  }
+}
+
+// Build metadata is validated text with no numeric conversion on any path: a 20-nines build
+// identifier parses, and since section 10 is ignored by the precedence, the label compares
+// Equal to the bare version.
+test fn w_build_wide_numeric_identifier_is_valid_and_ignored() -> Bool {
+  match semver_scheme.compare("1.0.0+99999999999999999999", "1.0.0") {
+    VersionCompared { ordering: Equal } => true
+    _ => false
+  }
+}
+
+// THE CONFINEMENT'S NEGATIVE CONTROLS, plus an honest statement of their rung. The confined
+// type is lowered to an alias by the emitter, so runtime typing alone cannot block a forged
+// list; the rung this file holds is BY-SOURCE confinement: semver_numeric_field is the only
+// producer of field values, and every consumer in this file and in the live modules derives
+// through it or through the parser (grep has no other SemVerVersion field literal). The
+// controls pin the constructor's own contract: an empty sequence, anything outside ASCII
+// digits 48..57, and a leading zero (unless the single digit 0) are refused.
+test fn w_numeric_field_constructor_refuses_forged_sequences() -> Bool {
+  match semver_numeric_field(cps: []) {
+    Absent => match semver_numeric_field(cps: chars(s: "A")) {
+      Absent => match semver_numeric_field(cps: chars(s: "01")) {
+        Absent => match semver_numeric_field(cps: chars(s: "0")) {
+          Present { value: _ } => true
+          Absent => false
+        }
+        Present { value: _ } => false
+      }
+      Present { value: _ } => false
+    }
+    Present { value: _ } => false
+  }
+}
+
+// THE SEAL'S OUTSIDE-MODULE PROBE (side chat review 5435818773): `sole_constructor` makes the
+// record constructible only inside extdeps.version.semver, so a module OUTSIDE it writing one
+// of the three forged literals — a leading-zero run, a non-digit code point, an empty run —
+// must meet the SoleConstructorViolation refusal at compile time, and a module that goes
+// through the checking constructor must compile with no such refusal. The .dag route is what
+// this probe executes; the native route's modifier-parse gap is a separate known defect
+// (g0_type_decl_modifier_parse_without_sealing_property), cited not restated.
+fn sole_constructor_refusals(source: String) -> Int {
+  match compile_dag_diagnostic_census(source) {
+    CensusObserved { rows: rows } =>
+      census_total_count(rows: census_rows_of_class(rows: rows, wanted: "SoleConstructorViolation"))
+    CensusNotRunnable { cause: _ } => 0 - 1
+  }
+}
+
+data forged_leading_zero_field_source: String = "module probe_forged_leading_zero_field\nimport extdeps.version.semver { SemVerNumericField }\nfn forged() -> SemVerNumericField { SemVerNumericField { digits: [48, 49] } }\n"
+
+data forged_non_digit_field_source: String = "module probe_forged_non_digit_field\nimport extdeps.version.semver { SemVerNumericField }\nfn forged() -> SemVerNumericField { SemVerNumericField { digits: [65] } }\n"
+
+data forged_empty_field_source: String = "module probe_forged_empty_field\nimport extdeps.version.semver { SemVerNumericField }\nfn forged() -> SemVerNumericField { SemVerNumericField { digits: [] } }\n"
+
+test fn w_semver_numeric_field_construction_is_sealed_outside_its_module() -> Bool {
+  sole_constructor_refusals(source: forged_leading_zero_field_source) >= 1
+    && sole_constructor_refusals(source: forged_non_digit_field_source) >= 1
+    && sole_constructor_refusals(source: forged_empty_field_source) >= 1
+}
+
+data admitted_field_source: String = "module probe_admitted_field\nimport extdeps.version.semver { SemVerNumericField, semver_numeric_field }\nfn admitted() -> SemVerNumericField? { semver_numeric_field(cps: [50]) }\n"
+
+test fn w_semver_numeric_field_admission_has_no_sole_constructor_refusal() -> Bool {
+  match compile_dag_diagnostic_census(source: admitted_field_source) {
+    CensusObserved { rows: rows } =>
+      census_total_count(rows: census_rows_of_class(rows: rows, wanted: "SoleConstructorViolation")) == 0
+    CensusNotRunnable { cause: _ } => false
+  }
+}
diff --git a/dag/test/claim/fabric/fabric_cell_acquire_witness_test.dag b/dag/test/claim/fabric/fabric_cell_acquire_witness_test.dag
index 76a916b0159..47d134f75cc 100644
--- a/dag/test/claim/fabric/fabric_cell_acquire_witness_test.dag
+++ b/dag/test/claim/fabric/fabric_cell_acquire_witness_test.dag
@@ -4,8 +4,8 @@ import std.types { Bool, String, List, NonEmptyStr, list_length }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import gunbc.build_cache_instance { RunnerSlotIdentity, runner_slot_instance_name }
 import gunbc.fleet_host_identity { operator_host_srv3 }
-import gunbc.runner_slot_desired { gunbc_runner_slot_desired }
-import std.measure { byte_size_count }
+import gunbc.runner_slot_desired { gunbc_runner_slot_desired, RunnerSlotCpuQuota, CpuQuotaResolved, SlotCpuQuotaUnbounded }
+import std.measure { byte_size_count, hardware_thread_count, hardware_thread_count_value }
 import gunbc.fabric_cell_converge {
   FabricCellRootAddress,
   FabricCellAttemptRootAddress,
@@ -16,6 +16,7 @@ import gunbc.fabric_cell_converge {
   fabric_cell_slice_name,
   fabric_cell_boundary_state_digest_of,
   fabric_cell_boundary_address_digest_of,
+  fabric_cell_desired_cpu_quota_identity,
 }
 import extdeps.systemd { MemoryMax, TasksMax }
 import gunbc.fabric_cell_observe {
@@ -447,18 +448,21 @@ fn kind_is_unknown_word(k: StatFileKind, word: String) -> Bool {
   }
 }
 
-fn converged_boundary_values() -> FabricCellBoundaryReading {
-  let desired = gunbc_runner_slot_desired()
-  BoundaryValuesRead {
-    memory_max: to_string(byte_size_count(b: desired.memory_max)),
-    memory_high: to_string(byte_size_count(b: desired.memory_high)),
-    memory_swap_max: to_string(byte_size_count(b: desired.memory_swap_max)),
-    tasks_max: to_string(desired.tasks_max),
-    cpu_weight: to_string(desired.cpu_weight),
-    cpu_quota_per_sec: "6s",
+// THE QUOTA A CONVERGED HOST PRINTS FOLLOWS THE DESIRED ROW, NOT A LITERAL. This was "6s" while the
+// fleet row resolved six threads; #11716 (cores_per_slot = 1) made the row SlotCpuQuotaUnbounded,
+// which a converged host prints as `infinity`, and the literal went stale. A resolved row prints its
+// thread count as whole CPU-seconds, the spelling the six-second row below reads.
+fn converged_quota_raw(quota: RunnerSlotCpuQuota) -> String {
+  match quota {
+    CpuQuotaResolved { threads: t } => join([to_string(hardware_thread_count_value(t: t)), "s"], "")
+    SlotCpuQuotaUnbounded => "infinity"
   }
 }
 
+fn converged_boundary_values() -> FabricCellBoundaryReading {
+  boundary_values_with_quota_raw(raw: converged_quota_raw(quota: gunbc_runner_slot_desired().cpu_quota))
+}
+
 fn boundary_values_with_quota_raw(raw: String) -> FabricCellBoundaryReading {
   let desired = gunbc_runner_slot_desired()
   BoundaryValuesRead {
@@ -583,13 +587,30 @@ test fn witness_acquire_drifted_quota_is_a_different_digest() -> Bool {
   }
 }
 
+// A HOST PRINTING `6s` AGREES WITH A DESIRED SIX-THREAD QUOTA. The desired side is composed from
+// the same spelling authority with a resolved six-thread quota rather than read off the slot row:
+// since #11716 the fleet row is SlotCpuQuotaUnbounded, so the slot digest no longer carries a
+// thread count and the span-versus-threads agreement this row exists for must name its own.
 test fn witness_acquire_observed_six_second_quota_matches_desired_threads() -> Bool {
+  let desired = gunbc_runner_slot_desired()
   address_probe_is_read_as(
     p: fabric_cell_boundary_address_probe(
       slot: witness_slot(),
       reading: boundary_values_with_quota_raw(raw: "6s"),
     ),
-    digest: fabric_cell_desired_state_digest(slot: witness_slot(), address: FabricCellResourceBoundaryAddress),
+    digest: fabric_cell_boundary_address_digest_of(
+      slice_name: fabric_cell_slice_name(slot: witness_slot()),
+      state: fabric_cell_boundary_state_digest_of(
+        memory_max: to_string(byte_size_count(b: desired.memory_max)),
+        memory_high: to_string(byte_size_count(b: desired.memory_high)),
+        memory_swap_max: to_string(byte_size_count(b: desired.memory_swap_max)),
+        tasks_max: to_string(desired.tasks_max),
+        cpu_weight: to_string(desired.cpu_weight),
+        cpu_quota_per_sec: fabric_cell_desired_cpu_quota_identity(
+          quota: CpuQuotaResolved { threads: hardware_thread_count(count: 6) },
+        ),
+      ),
+    ),
   )
 }
 
diff --git a/dag/test/claim/fabric/fabric_cell_effect_witness_test.dag b/dag/test/claim/fabric/fabric_cell_effect_witness_test.dag
index 2253801b435..4d76a15a342 100644
--- a/dag/test/claim/fabric/fabric_cell_effect_witness_test.dag
+++ b/dag/test/claim/fabric/fabric_cell_effect_witness_test.dag
@@ -3,6 +3,7 @@ module test.claim.fabric_cell_effect_witness
 import std.types { Bool, String, NonEmptyStr, Int, List, list_length }
 import gunbc.fleet_host_identity { operator_host_srv3 }
 import gunbc.build_cache_instance { RunnerSlotIdentity }
+import gunbc.runner_slot_allocation { srv1_microvm_shakedown_slot }
 import gunbc.membership_reconcile {
   MemberAction, MemberAdded, MemberChanged, MemberRemoved, MemberRemovalRefused,
   MemberNotOwned,
@@ -39,7 +40,8 @@ import gunbc.fabric_cell_effect {
   fabric_cell_realization,
   fabric_cell_realization_refusal_count,
   fabric_cell_plan_effects,
-  fabric_cell_boundary_add_realization,
+  fabric_cell_slice_desired_directives_for_slot,
+  fabric_cell_address_realization,
   AddressRefused,
   AddressRealizable,
 }
@@ -273,13 +275,59 @@ fn has_line(lines: List<String>, line: String) -> Bool {
 }
 
 fn boundary_add_directive_lines(quota: RunnerSlotCpuQuota) -> List<String> {
-  match fabric_cell_boundary_add_realization(slot: srv3_fabric_slot(), quota: quota) {
-    AddressRefused { refusal: _ } => [] as List<String>
-    AddressRealizable { effect: e } =>
-      match e {
-        FabricCellSliceEnsure { slice_unit: _, directives: ds } =>
-          map(ds, d => systemd_slice_directive_line(directive: d))
-        FabricCellDirectoryEnsure { path: _, owner: _ } => [] as List<String>
-      }
+  map(fabric_cell_slice_desired_directives_for_slot(slot: srv3_fabric_slot(), quota: quota),
+    d => systemd_slice_directive_line(directive: d))
+}
+
+fn workspace_boundary_member(digest: NonEmptyStr) -> FabricCellMember {
+  FabricCellMember { slot: srv1_microvm_shakedown_slot(), address: FabricCellResourceBoundaryAddress, state_digest: digest }
+}
+
+fn workspace_desired_boundary() -> FabricCellMember {
+  workspace_boundary_member(digest: fabric_cell_desired_state_digest(slot: srv1_microvm_shakedown_slot(), address: FabricCellResourceBoundaryAddress))
+}
+
+// Independent live read, 2026-10-09: the add path persisted all five other limits but unlimited CPU.
+data workspace_unlimited_boundary: NonEmptyStr = "fabric-cell-srv1-13.slice;memory_max=30064771072;memory_high=30064771072;memory_swap_max=0;tasks_max=16384;cpu_weight=100;cpu_quota_per_sec=infinity"
+
+test fn workspace_boundary_add_uses_its_own_cpu_quota() -> Bool {
+  let member = workspace_desired_boundary()
+  match fabric_cell_address_realization(action: MemberAdded { at: fabric_cell_member_key(member: member), to: member }) {
+    AddressRealizable { effect: FabricCellSliceEnsure { slice_unit, directives } } => slice_unit == "fabric-cell-srv1-13.slice"
+      && directives.count() == 6
+      && has_line(lines: map(directives, d => systemd_slice_directive_line(directive: d)), line: "CPUQuota=400%")
+      && !has_line(lines: map(directives, d => systemd_slice_directive_line(directive: d)), line: "CPUQuota=")
+    other => false
+  }
+}
+
+test fn workspace_unlimited_predecessor_repairs_only_the_cpu_directive() -> Bool {
+  let target = workspace_desired_boundary()
+  let change = MemberChanged { at: fabric_cell_member_key(member: target),
+    from: workspace_boundary_member(digest: workspace_unlimited_boundary), to: target }
+  match fabric_cell_address_realization(action: change) {
+    AddressRealizable { effect: FabricCellSliceEnsure { slice_unit, directives } } => slice_unit == "fabric-cell-srv1-13.slice"
+      && map(directives, d => systemd_slice_directive_line(directive: d)) == ["CPUQuota=400%"]
+    other => false
   }
 }
+
+test fn workspace_quota_repair_refuses_other_drift_or_an_unreviewed_target() -> Bool {
+  let target = workspace_desired_boundary()
+  let old = workspace_boundary_member(digest: workspace_unlimited_boundary)
+  let key = fabric_cell_member_key(member: target)
+  let wrong_memory = workspace_boundary_member(digest: join(split(s: workspace_unlimited_boundary as String,
+    delimiter: "memory_max=30064771072"), "memory_max=4294967296") as NonEmptyStr)
+  let finite_prior = workspace_boundary_member(digest: join(split(s: workspace_unlimited_boundary as String,
+    delimiter: "cpu_quota_per_sec=infinity"), "cpu_quota_per_sec=2000000") as NonEmptyStr)
+  all([
+    MemberChanged { at: key, from: wrong_memory, to: target },
+    MemberChanged { at: key, from: finite_prior, to: target },
+    MemberChanged { at: key, from: target, to: old },
+    MemberChanged { at: "another-address", from: old, to: target },
+    MemberChanged { at: key, from: old, to: member_at(address: FabricCellResourceBoundaryAddress) },
+  ], action => match fabric_cell_address_realization(action: action) {
+    AddressRefused { refusal: CellChangeNotYetRealizable { address_wire: _ } } => true
+    other => false
+  })
+}
diff --git a/dag/test/claim/fabric/fabric_cell_evidence_algebra_witness_test.dag b/dag/test/claim/fabric/fabric_cell_evidence_algebra_witness_test.dag
index 1361f886974..cba87a8a072 100644
--- a/dag/test/claim/fabric/fabric_cell_evidence_algebra_witness_test.dag
+++ b/dag/test/claim/fabric/fabric_cell_evidence_algebra_witness_test.dag
@@ -196,28 +196,13 @@ test fn evidence_domain_laws_hold() -> Bool {
     && class_of(observations: [refused, a, b, absent]) == "refused"
 }
 
-// AND THE ONE THAT IS RED TODAY, ASSERTING THE PROPERTY WE WANT RATHER THAN THE ONE WE HAVE. The
-// class projection above is order-independent; the FULL semantic value is not, because the fold
-// keeps the FIRST refusal cause it saw. Two refusals differing only in cause text are semantically
-// identical and textually distinct, so `[c1, c2]` and `[c2, c1]` reach the same arm carrying
-// different payloads.
-//
-// THIS ROW ASSERTS EQUALITY AND IS ENROLLED AS EXPECTED-RED, and the direction is the whole point
-// (codex review 55693). An earlier cut asserted the INEQUALITY -- that reversed refusals must stay
-// unequal -- and it passed, making the defect part of the green contract: whoever canonicalized
-// the join would meet a red row whose obvious repair is to DELETE the row protecting the property.
-// That is a witness pinning a defect and thereby acquiring a defender, the exact class this lane
-// named one PR earlier and then re-committed here. Asserted this way round the row goes GREEN when
-// the join is fixed, and the floor's known-red-now-passing arm tells the fixer to retire the
-// enrolment.
-//
-// WHY IT IS NOT FIXED IN THIS PR: canonicalizing the refusal changes `EvidenceRefused`'s payload
-// and therefore `AddressUnreadable.cause` and every consumer of it, in a file #9167 is already
-// restructuring. It is a production change belonging in its own diff with its own mutation
-// receipt, not a rider on a witness-only PR. It is NOT harmless: the plan identity consumes the
-// CLASS, so the wording does not move the member-set fingerprint today, but it sits one consumer
-// away -- whoever routes on `cause` or renders it into anything content-addressed reopens the CAS
-// defect this family already fixed once.
+// AND THE FULL SEMANTIC VALUE, NOT ONLY ITS CLASS, IS ORDER-INDEPENDENT. Two refusals differing only
+// in cause text once reached the same arm carrying different payloads, because the fold kept the
+// FIRST cause it saw; the join now keeps the least cause, so `[c1, c2]` and `[c2, c1]` agree. This
+// row was enrolled expected-red (asserting the property wanted rather than the one held, codex
+// review 55693) and is retired from floor_expected_red with the join fix. The cause reaches
+// AddressUnreadable.cause, one consumer away from anything content-addressed, which is why the
+// payload and not only the class has to be canonical.
 test fn evidence_full_value_is_order_independent() -> Bool {
   full_of(observations: [atom_refused(cause: "transport reset"), atom_refused(cause: "permission denied")])
     == full_of(observations: [atom_refused(cause: "permission denied"), atom_refused(cause: "transport reset")])
diff --git a/dag/test/claim/fabric/fabric_cell_observe_witness_test.dag b/dag/test/claim/fabric/fabric_cell_observe_witness_test.dag
index 1ef5dbad34e..f8ff7318eae 100644
--- a/dag/test/claim/fabric/fabric_cell_observe_witness_test.dag
+++ b/dag/test/claim/fabric/fabric_cell_observe_witness_test.dag
@@ -3,7 +3,7 @@ module test.claim.fabric_cell_observe_witness
 import std.types { Bool, String, List, Int, NonEmptyStr, list_length }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import gunbc.build_cache_instance { RunnerSlotIdentity, runner_slot_instance_name }
-import gunbc.fleet_host_identity { operator_host_srv3, operator_host_srv4 }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv3, operator_host_srv4 }
 import product.host_identity { HostIdentity }
 import gunbc.fabric_cell_converge {
   FabricCellResourceAddress,
@@ -12,6 +12,7 @@ import gunbc.fabric_cell_converge {
   FabricCellResourceBoundaryAddress,
   fabric_cell_resource_addresses,
   fabric_cell_slice_name,
+  fabric_cell_expected_slots,
   fabric_cell_desired_state_digest,
   FabricCellAddressObservation,
   AddressObserved,
@@ -62,6 +63,7 @@ import gunbc.fabric_cell_observe {
   DiscoveryRefused,
   FabricCellDiscoveredSubject,
   DiscoveredExpectedCell,
+  DiscoveredCellSliceAncestor,
   DiscoveredUnexpectedCommittedSlot,
   DiscoveredForeignArtifact,
   DiscoveredHostWidthUnresolved,
@@ -481,15 +483,48 @@ fn discovery_wire_set(d: FabricCellDiscovery) -> String {
 // LAW 15 -- THE OBSERVER'S OUTPUT IS WHAT THE CLASSIFICATION KERNEL CONSUMES, AND A CONVERGED HOST
 // CLASSIFIES AS SATISFIED THROUGH IT. The end-to-end join: the two halves were built a PR apart and
 // this is the row that fails if the observer's vocabulary drifts from the kernel's.
+//
+// THE HOST IS CONVERGED ONLY WHEN EVERY EXPECTED SLOT IS, so the probe and the expected roster are
+// both the slot authority's population, not one fixture slot. #11625 gave srv3 a second fabric
+// member (srv3-07); a one-slot probe then left srv3-07's readback unobserved and outside a
+// one-slot expected roster, so this row went red on the unexpected readback rather than on drift.
 test fn witness_observer_converged_probe_classifies_as_satisfied() -> Bool {
-  let readback = fabric_cell_observe_host(probe: converged_probe())
+  let expected = fabric_cell_expected_slots(host: operator_host_srv3)
+  let readback = fabric_cell_observe_host(probe: converged_host_probe(slots: expected))
   let classified = classify_fabric_cell_host(
-    expected_slots: [observe_slot()],
+    expected_slots: expected,
     readback: readback,
   )
-  list_length(items: classified.unexpected) == 0
+  list_length(items: expected) > 0
+    && list_length(items: classified.unexpected) == 0
     && fold(classified.standings, init: true, f: (acc, s) => acc && standing_is_satisfied(s: s))
-    && list_length(items: classified.standings) == list_length(items: fabric_cell_resource_addresses())
+    && list_length(items: classified.standings)
+      == list_length(items: expected) * list_length(items: fabric_cell_resource_addresses())
+}
+
+// EVERY GIVEN SLOT FULLY PROVISIONED: the converged_probe shape, quantified over a slot list.
+fn converged_host_probe(slots: List<RunnerSlotIdentity>) -> FabricCellHostProbe {
+  FabricCellHostProbe {
+    host: operator_host_srv3,
+    namespaces: concat(
+      [
+        enumerated(ns: FabricCellsRootNamespace, entries: map(slots, s => runner_slot_instance_name(slot: s))),
+        enumerated(ns: FabricCellSliceNamespace, entries: map(slots, s => fabric_cell_slice_name(slot: s))),
+      ],
+      map(slots, s => enumerated(ns: FabricCellChildNamespace { slot: s }, entries: ["attempts"])),
+    ),
+    addresses: fold(slots, init: [], f: (acc, s) => concat(
+      acc,
+      map(
+        fabric_cell_resource_addresses(),
+        a => FabricCellAddressProbeEntry {
+          slot: s,
+          address: a,
+          probe: AddressStateRead { state_digest: fabric_cell_desired_state_digest(slot: s, address: a) },
+        }
+      ),
+    )),
+  }
 }
 
 // LAW 16 -- A DRIFTED STATE READ REACHES THE KERNEL AS DRIFT, NOT AS ABSENCE. The defect this
@@ -661,6 +696,7 @@ test fn witness_observer_other_hosts_committed_name_is_not_this_hosts_expected_c
 fn discovered_is_expected(s: FabricCellDiscoveredSubject) -> Bool {
   match s {
     DiscoveredExpectedCell { slot: _ } => true
+    DiscoveredCellSliceAncestor { observed_name: _, host: _ } => false
     DiscoveredUnexpectedCommittedSlot { slot: _ } => false
     DiscoveredCrossHostNamedArtifact { observed_name: _, named_slot: _, observed_on: _ } => false
     DiscoveredForeignArtifact { observed_name: _, location: _ } => false
@@ -671,6 +707,7 @@ fn discovered_is_expected(s: FabricCellDiscoveredSubject) -> Bool {
 fn discovered_is_cross_host(s: FabricCellDiscoveredSubject) -> Bool {
   match s {
     DiscoveredCrossHostNamedArtifact { observed_name: _, named_slot: _, observed_on: _ } => true
+    DiscoveredCellSliceAncestor { observed_name: _, host: _ } => false
     DiscoveredExpectedCell { slot: _ } => false
     DiscoveredUnexpectedCommittedSlot { slot: _ } => false
     DiscoveredForeignArtifact { observed_name: _, location: _ } => false
@@ -801,8 +838,12 @@ fn population_is_refused(p: FabricCellObservationDecision) -> Bool {
 // the pairs the authority expects, so a state read for an undeclared slot, or a child namespace for
 // a cell nobody asked about, had no output position and vanished. The observer was conserving what
 // it PRODUCED while silently dropping part of what it was GIVEN.
+//
+// THE STRAY SLOTS (srv3-08, srv3-09 here and below) ARE COMMITTED-RANGE INDICES OUTSIDE
+// gunbc.runner_slot_allocation fabric_execution_slot_identities. They were srv3-07 until #11625
+// made srv3-07 the second fabric member, which turned the "stray" into an expected slot.
 test fn witness_observer_unconsumed_probe_entries_refuse_rather_than_vanishing() -> Bool {
-  let stray = RunnerSlotIdentity { host: operator_host_srv3, slot_index: 7 }
+  let stray = RunnerSlotIdentity { host: operator_host_srv3, slot_index: 99 }
   let refusals = fabric_cell_unconsumed_probe_refusals(probe: FabricCellHostProbe {
     host: operator_host_srv3,
     namespaces: concat(
@@ -832,7 +873,7 @@ test fn witness_observer_matching_probe_leaves_nothing_unconsumed() -> Bool {
 // the projection carries it, and fabric_cell_projection_refusals is the only way to get the
 // discovery half, so a caller cannot take one and skip the other.
 test fn witness_observer_unconsumed_probe_refuses_the_population() -> Bool {
-  let stray = RunnerSlotIdentity { host: operator_host_srv3, slot_index: 7 }
+  let stray = RunnerSlotIdentity { host: operator_host_srv3, slot_index: 99 }
   population_is_refused(p: admit_fabric_cell_probe(probe: FabricCellHostProbe {
     host: operator_host_srv3,
     namespaces: converged_probe().namespaces,
@@ -994,8 +1035,8 @@ fn refusal_identities(host: HostIdentity, entries: List<String>) -> List<String>
 // the plan body. Two probes describing the same host in a different sequence must not produce two
 // plan identities.
 test fn witness_observer_unconsumed_refusals_are_order_independent() -> Bool {
-  let a = RunnerSlotIdentity { host: operator_host_srv3, slot_index: 7 }
-  let b = RunnerSlotIdentity { host: operator_host_srv3, slot_index: 8 }
+  let a = RunnerSlotIdentity { host: operator_host_srv3, slot_index: 99 }
+  let b = RunnerSlotIdentity { host: operator_host_srv3, slot_index: 100 }
   let forward = stray_probe_identities(first: a, second: b)
   let reverse = stray_probe_identities(first: b, second: a)
   list_length(items: forward) == 2 && identity_lists_equal(a: forward, b: reverse)
@@ -1004,7 +1045,7 @@ test fn witness_observer_unconsumed_refusals_are_order_independent() -> Bool {
 // AND DUPLICATES OF ONE SUBJECT ARE ONE REFUSAL, which is the same population question asked the
 // other way: an order that is stable but double-counts is no better than one that reorders.
 test fn witness_observer_duplicate_unconsumed_probes_are_one_refusal() -> Bool {
-  let a = RunnerSlotIdentity { host: operator_host_srv3, slot_index: 7 }
+  let a = RunnerSlotIdentity { host: operator_host_srv3, slot_index: 99 }
   list_length(items: stray_probe_identities(first: a, second: a)) == 1
 }
 
@@ -1087,3 +1128,97 @@ test fn witness_observer_refused_slice_enumeration_refuses_discovery() -> Bool {
     DiscoveryEnumerated { host: _, subjects: _ } => false
   }
 }
+
+// The real srv1 census contains both units after provisioning slot 13. Keep the parent in
+// discovery without inventing another cell, and pass the same probe through production admission.
+fn srv1_cell_probe(slice_entries: List<String>, root_entries: List<String>) -> FabricCellHostProbe {
+  let slot = RunnerSlotIdentity { host: operator_host_srv1, slot_index: 13 }
+  FabricCellHostProbe {
+    host: operator_host_srv1,
+    namespaces: [
+      enumerated(ns: FabricCellsRootNamespace, entries: root_entries),
+      enumerated(ns: FabricCellChildNamespace { slot: slot }, entries: ["attempts"]),
+      enumerated(ns: FabricCellSliceNamespace, entries: slice_entries),
+    ],
+    addresses: map(fabric_cell_resource_addresses(), address => FabricCellAddressProbeEntry {
+      slot: slot,
+      address: address,
+      probe: AddressStateRead { state_digest: fabric_cell_desired_state_digest(slot: slot, address: address) },
+    }),
+  }
+}
+
+test fn witness_observer_live_srv1_slice_ancestor_is_retained_and_admitted() -> Bool {
+  let probe = srv1_cell_probe(
+    slice_entries: ["fabric-cell-srv1-13.slice", "fabric-cell-srv1.slice"],
+    root_entries: ["srv1-13"],
+  )
+  match fabric_cell_discovered_subjects(probe: probe) {
+    DiscoveryRefused { host: _, cause: _ } => false
+    DiscoveryEnumerated { host: _, subjects: ss } =>
+      join(map(ss, s => fabric_cell_discovered_subject_wire(s: s)), "\n")
+        == "cell-slice-ancestor:srv1:fabric-cell-srv1.slice\nexpected:srv1-13"
+        && !population_is_refused(p: admit_fabric_cell_probe(probe: probe))
+  }
+}
+
+test fn witness_observer_slice_ancestor_does_not_hide_unknown_siblings() -> Bool {
+  population_is_refused(p: admit_fabric_cell_probe(probe: srv1_cell_probe(
+    slice_entries: ["fabric-cell-srv1-13.slice", "fabric-cell-srv1.slice", "fabric-cell-zp444.slice"],
+    root_entries: ["srv1-13"],
+  )))
+}
+
+test fn witness_observer_another_hosts_slice_ancestor_remains_foreign() -> Bool {
+  let projection = fabric_cell_observe(probe: srv1_cell_probe(
+    slice_entries: ["fabric-cell-srv1-13.slice", "fabric-cell-srv3.slice"],
+    root_entries: ["srv1-13"],
+  ))
+  match projection.discovery {
+    DiscoveryRefused { host: _, cause: _ } => false
+    DiscoveryEnumerated { host: _, subjects: ss } =>
+      fold(ss, init: false, f: (seen, s) => seen || fabric_cell_discovered_subject_wire(s: s)
+        == "foreign:fabric-slices:fabric-cell-srv3.slice")
+        && list_length(items: fabric_cell_projection_refusals(projection: projection)) == 1
+  }
+}
+
+test fn witness_observer_slice_ancestor_spelling_in_filesystem_still_refuses() -> Bool {
+  population_is_refused(p: admit_fabric_cell_probe(probe: srv1_cell_probe(
+    slice_entries: ["fabric-cell-srv1-13.slice", "fabric-cell-srv1.slice"],
+    root_entries: ["srv1-13", "fabric-cell-srv1.slice"],
+  )))
+}
+
+test fn witness_observer_slice_ancestor_cannot_satisfy_the_cell_boundary() -> Bool {
+  let slot = RunnerSlotIdentity { host: operator_host_srv1, slot_index: 13 }
+  observation_is_absent(o: fabric_cell_observe_address(
+    probe: FabricCellHostProbe {
+      host: operator_host_srv1,
+      namespaces: [enumerated(ns: FabricCellSliceNamespace, entries: ["fabric-cell-srv1.slice"])],
+      addresses: [],
+    },
+    slot: slot,
+    address: FabricCellResourceBoundaryAddress,
+  ))
+}
+
+test fn witness_observer_slice_ancestors_are_order_independent_and_deduplicated() -> Bool {
+  let a = fabric_cell_discovered_subjects(probe: srv1_cell_probe(
+    slice_entries: ["fabric-cell-srv1-13.slice", "fabric-cell-srv1.slice"], root_entries: ["srv1-13"],
+  ))
+  let b = fabric_cell_discovered_subjects(probe: srv1_cell_probe(
+    slice_entries: ["fabric-cell-srv1.slice", "fabric-cell-srv1-13.slice", "fabric-cell-srv1.slice"], root_entries: ["srv1-13"],
+  ))
+  match a {
+    DiscoveryRefused { host: _, cause: _ } => false
+    DiscoveryEnumerated { host: _, subjects: left } => match b {
+      DiscoveryRefused { host: _, cause: _ } => false
+      DiscoveryEnumerated { host: _, subjects: right } =>
+        list_length(items: left) == 2 && identity_lists_equal(
+          a: map(left, s => fabric_cell_discovered_subject_wire(s: s)),
+          b: map(right, s => fabric_cell_discovered_subject_wire(s: s)),
+        )
+    }
+  }
+}
diff --git a/dag/test/claim/fabric/fabric_store_operation_admission_witness_test.dag b/dag/test/claim/fabric/fabric_store_operation_admission_witness_test.dag
index f0a3bd52f95..5b989874475 100644
--- a/dag/test/claim/fabric/fabric_store_operation_admission_witness_test.dag
+++ b/dag/test/claim/fabric/fabric_store_operation_admission_witness_test.dag
@@ -10,10 +10,9 @@ import extdeps.crypto.mac { MacKey, HmacSha256 }
 import gunbc.auth.approval_decision_store { StoredApprovalRequest, ApprovalKeyLoaded, ApprovalKeyringRefused, ApprovalKeyFileAbsent, approval_mac_key_id }
 import gunbc.auth.approval_store_receipt { approval_store_receipt_mac_key_id, approval_store_receipt_mac_key_path, store_receipt_claims }
 import gunbc.auth.approval_capability { ApprovalCapability }
-import gunbc.spark.pair_serving_d0 { d0_required_scope }
 import gunbc.fabric_store_operation_admission {
   protected_head_of, ConsentClaimSlotHead, ConsentFilingSlotHead, AuthorityPartitionHead,
-  admit_store_operation, StoreOperationAdmitted, StoreOperationRefused, StoreOperationCredential, StoreOperationAdmission,
+  admit_store_operation, approved_operation, ClaimConsent, NoApprovalFlowForOperation, StoreOperationAdmitted, StoreOperationRefused, StoreOperationCredential, StoreOperationAdmission,
   NoOperationCredential, PresentedApproval,
   ApprovalAbsent, IntentNotTheApprovedRevision, IntentScopeNotAdmissible, OperationUnclassifiable, ReceiptKeyUnavailable,
 }
@@ -32,6 +31,15 @@ fn fw_receipt_key() -> MacKey {
   MacKey { id: approval_store_receipt_mac_key_id, suite: HmacSha256, material: fw_receipt_key_hex as Secret }
 }
 
+// THE SCOPE D0 STATED, KEPT BYTE-FOR-BYTE AS A SUPPLIED VALUE: the pinned receipts below are digests and
+// tags over intent text that frames exactly this scope. D0 itself was deleted with Group A (2026-10-07), so
+// the store now admits no scope for a consent write (gunbc.fabric_store_operation_admission
+// operation_requirement); the receipt check is exercised at its own interface, approved_operation, with
+// this scope supplied as the admissible one.
+fn fw_d0_scope() -> AuthorizationScope {
+  AuthorizationScope { verb: Write, resource: NamespacePosition { tree: CodeNameTree, path: ["gunbc", "spark", "pair_serving_authority"] }, action: ("suspend-pair-serving-authority" as NonEmptyStr) as AuthorizedAction }
+}
+
 fn fw_other_scope() -> AuthorizationScope {
   AuthorizationScope { verb: Write, resource: NamespacePosition { tree: CodeNameTree, path: ["gunbc", "spark", "something_else"] }, action: ("other-operation" as NonEmptyStr) as AuthorizedAction }
 }
@@ -64,7 +72,7 @@ fn fw_pinned_receipt(intent: String, revision: NonEmptyStr, tag: NonEmptyStr) ->
 }
 
 fn fw_receipt_d0() -> StoreOperationCredentialOrNone {
-  fw_pinned_receipt(intent: fw_intent(scope: d0_required_scope()), revision: "sha256:c9bd53d25b2756f52cbffe878e28dfb8e121ec0177e8da265adcb1e5221af1ca" as NonEmptyStr, tag: "KadxLVqCx5DF7rP9FT1ENLSKl7rLJhiMAyXDil5SOyQ=" as NonEmptyStr)
+  fw_pinned_receipt(intent: fw_intent(scope: fw_d0_scope()), revision: "sha256:c9bd53d25b2756f52cbffe878e28dfb8e121ec0177e8da265adcb1e5221af1ca" as NonEmptyStr, tag: "KadxLVqCx5DF7rP9FT1ENLSKl7rLJhiMAyXDil5SOyQ=" as NonEmptyStr)
 }
 
 fn fw_receipt_other_scope() -> StoreOperationCredentialOrNone {
@@ -76,14 +84,26 @@ type StoreOperationCredentialOrNone
   | NoReceipt
 
 fn fw_admit(credential: StoreOperationCredential) -> StoreOperationAdmission {
-  admit_store_operation(
-    head: ConsentClaimSlotHead, target_text: "", credential: credential,
-    principal_grants: [] as List<Grant>,
+  approved_operation(
+    op: ClaimConsent, admissible: [fw_d0_scope()], credential: credential,
     receipt_keyring: ApprovalKeyLoaded { key: fw_receipt_key() },
     observed_at: "2026-09-28T00:20:00Z",
   )
 }
 
+// THE STORE DOOR ITSELF NOW REFUSES THE CONSENT WRITE THAT D0'S RECEIPT ONCE ADMITTED: with no approval
+// flow admitted for the operation, the door refuses before it reads the receipt.
+test fn the_store_refuses_a_consent_write_now_that_no_flow_is_admitted() -> Bool {
+  match fw_receipt_d0() {
+    NoReceipt => false
+    HaveReceipt { credential: c } =>
+      match admit_store_operation(head: ConsentClaimSlotHead, target_text: "", credential: c, principal_grants: [] as List<Grant>, receipt_keyring: ApprovalKeyLoaded { key: fw_receipt_key() }, observed_at: "2026-09-28T00:20:00Z") {
+        StoreOperationRefused { operation: _, refusal: NoApprovalFlowForOperation } => true
+        _ => false
+      }
+  }
+}
+
 // THE POSITIVE CONTROL: a receipt the broker minted over an approved intent that states D0's scope
 // admits a D0 consent-slot write at the store.
 test fn a_receipt_over_an_intent_stating_the_d0_scope_admits_a_consent_write() -> Bool {
@@ -136,7 +156,7 @@ test fn a_store_without_the_receipt_key_refuses() -> Bool {
   match fw_receipt_d0() {
     NoReceipt => false
     HaveReceipt { credential: c } =>
-      match admit_store_operation(head: ConsentClaimSlotHead, target_text: "", credential: c, principal_grants: [] as List<Grant>, receipt_keyring: ApprovalKeyringRefused { cause: ApprovalKeyFileAbsent { path: approval_store_receipt_mac_key_path } }, observed_at: "2026-09-28T00:20:00Z") {
+      match approved_operation(op: ClaimConsent, admissible: [fw_d0_scope()], credential: c, receipt_keyring: ApprovalKeyringRefused { cause: ApprovalKeyFileAbsent { path: approval_store_receipt_mac_key_path } }, observed_at: "2026-09-28T00:20:00Z") {
         StoreOperationRefused { operation: _, refusal: ReceiptKeyUnavailable } => true
         _ => false
       }
diff --git a/dag/test/claim/fabric/workspace_host_supply_refusal_witness_test.dag b/dag/test/claim/fabric/workspace_host_supply_refusal_witness_test.dag
new file mode 100644
index 00000000000..6fc435b68b2
--- /dev/null
+++ b/dag/test/claim/fabric/workspace_host_supply_refusal_witness_test.dag
@@ -0,0 +1,57 @@
+module test.claim.workspace_host_supply_refusal_witness
+
+import std.types { Bool }
+import gunbc.fleet_host_identity { operator_host_183527, operator_host_3dde7f, operator_host_srv1 }
+import gunbc.workspace_allocation_supply { workspace_host_supply_refusal, workspace_local_host_is }
+import gunbc.fleet_enrollment { CiRunnerParticipation, hosts_enrolled_for, runner_executor_hosts }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE ENROLLED CAX GUESTS HAVE NO MICROVM SUPPLY, AND THE FABRIC PATH SAYS WHY. Read off the
+// production enrollment rows, so removing the guests' backing or the provider fact makes this red: the
+// refusal names the cited offer whose nested-virtualization fact forbids the path.
+test fn provider_guests_refuse_microvm_supply_on_the_cited_offer() -> Bool {
+  let damien = match workspace_host_supply_refusal(host: operator_host_183527) {
+    Present { value: r } => string_contains(s: r as String, pattern: "extdeps.cloud.hetzner.cax41_catalog")
+    Absent => false
+  }
+  let gus = match workspace_host_supply_refusal(host: operator_host_3dde7f) {
+    Present { value: r } => string_contains(s: r as String, pattern: "nested virtualization")
+    Absent => false
+  }
+  damien && gus
+}
+
+// The control: an owned host is not refused here; its supply is decided by observation as before.
+test fn owned_host_is_not_refused_by_provider_fact() -> Bool {
+  match workspace_host_supply_refusal(host: operator_host_srv1) {
+    Present { value: _ } => false
+    Absent => true
+  }
+}
+
+// The local host is joined through the allocated hostname: srv1 answers to "srv1"; the CAX guest
+// answers to its drawn name, NOT to its identity's spelling or the provider's display name.
+test fn local_host_join_reads_the_allocated_hostname() -> Bool {
+  workspace_local_host_is(host: operator_host_srv1, kernel_hostname: "srv1")
+    && workspace_local_host_is(host: operator_host_183527, kernel_hostname: "damien")
+    && !workspace_local_host_is(host: operator_host_183527, kernel_hostname: "host-183527")
+    && !workspace_local_host_is(host: operator_host_183527, kernel_hostname: "ubuntu-32gb-nbg1-1")
+    && !workspace_local_host_is(host: operator_host_srv1, kernel_hostname: "")
+}
+
+// ENROLLED FOR CI, NOT A RUNNER EXECUTOR. The CAX guests are members of the CI enrollment -- so their
+// refusal is visible wherever that population is walked -- and are excluded from the executor set a
+// pinned runner, the converge workflow's host choice and the slot census read, while every owned CI
+// host stays in both.
+test fn provider_guests_are_ci_enrolled_but_not_runner_executors() -> Bool {
+  let ci = hosts_enrolled_for(wanted: CiRunnerParticipation)
+  let executors = runner_executor_hosts()
+  let in_ci = fn(h) { any(ci, x => (x as String) == (h as String)) }
+  let in_exec = fn(h) { any(executors, x => (x as String) == (h as String)) }
+  in_ci(operator_host_183527) && !in_exec(operator_host_183527)
+    && in_ci(operator_host_3dde7f) && !in_exec(operator_host_3dde7f)
+    && in_ci(operator_host_srv1) && in_exec(operator_host_srv1)
+    && executors.length() == ci.length() - 2
+}
diff --git a/dag/test/claim/firmware_prerequisite_evidence_witness_test.dag b/dag/test/claim/firmware_prerequisite_evidence_witness_test.dag
index c61abe9c53e..c2af9618d38 100644
--- a/dag/test/claim/firmware_prerequisite_evidence_witness_test.dag
+++ b/dag/test/claim/firmware_prerequisite_evidence_witness_test.dag
@@ -2,7 +2,6 @@ module test.claim.firmware_prerequisite_evidence_witness_test
 
 import std.types { Bool, List }
 import std.optional { Present, Absent }
-import extdeps.boards.types { AsrockRackAltrad8ud1l2t }
 import extdeps.firmware.types {
   BmcController,
   FirmwarePrerequisiteObservation,
@@ -20,12 +19,7 @@ import extdeps.firmware.types {
   firmware_semantic_version,
   prerequisite_evidence_verdict,
 }
-import extdeps.boards.asrock_rack {
-  asrock_altrad8ud_bios_3_10_openbmc_release,
-  asrock_altrad8ud_bios_310_push_accepted_at_bmc_322,
-  asrock_altrad8ud_bios_310_push_refused_at_bmc_207,
-  asrock_altrad8ud_bios_openbmc_prerequisite_evidence,
-}
+import extdeps.boards.asrock_rack { asrock_altrad8ud_bios_3_10_openbmc_release, asrock_altrad8ud_bios_310_push_accepted_at_bmc_322, asrock_altrad8ud_bios_310_push_refused_at_bmc_207, asrock_altrad8ud_bios_openbmc_prerequisite_evidence, asrock_altrad8ud_board_authority }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
@@ -36,7 +30,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // answer, so a two-element list cannot distinguish them however it is
 // ordered. Only a second refusal forces the fold to choose.
 data synthetic_lower_refusal: FirmwarePrerequisiteObservation = FirmwarePrerequisiteObservation {
-  board: AsrockRackAltrad8ud1l2t,
+  board: asrock_altrad8ud_board_authority,
   subject: HostBios,
   image_kind: OpenBmcWebUiTar,
   gating_target: BmcController,
diff --git a/dag/test/claim/fleet/altra_firmware_library_witness_test.dag b/dag/test/claim/fleet/altra_firmware_library_witness_test.dag
index 9b0c6d0a832..713de31b798 100644
--- a/dag/test/claim/fleet/altra_firmware_library_witness_test.dag
+++ b/dag/test/claim/fleet/altra_firmware_library_witness_test.dag
@@ -1,7 +1,10 @@
 module test.claim.fleet.altra_firmware_library_witness
 
-import std.types { Bool }
-import gunbc.altra_firmware_library { beta_bmc_version_comparisons, reference_report }
+import std.types { Bool, Int, List, String }
+import gunbc.altra_firmware_library {
+  beta_bmc_version_comparisons, reference_report,
+  AltraLibraryArchive, AltraLibraryMember, SsifKernelPatchBundle, OpenBmcManifestVersion,
+}
 import gunbc.fleet_bmc_observation {
   srv3_bmc_firmware_2_07_00_observation,
   srv3_bmc_firmware_3_22_00_observation,
@@ -31,3 +34,38 @@ test fn reference_report_reads_fleet_bmc_observations() -> Bool {
   map(report.bmc_version_comparisons, row => row.observation)
     == [srv3_bmc_firmware_observation, srv4_bmc_firmware_observation]
 }
+
+fn is_firmware_archive(a: AltraLibraryArchive) -> Bool {
+  match a.subject {
+    SsifKernelPatchBundle => false
+    _ => true
+  }
+}
+
+fn members_named(members: List<AltraLibraryMember>, name: String) -> Int {
+  length(filter(members, m => (m.archive_name as String) == name))
+}
+
+// Completeness is an identity join: every firmware archive the report lists has
+// exactly one member row under its own name, and no member row names an archive
+// the report does not list. A dropped or duplicated row fails one direction.
+test fn every_firmware_archive_has_exactly_one_member() -> Bool {
+  let report = reference_report()
+  let archives = filter(report.drive_archives, a => is_firmware_archive(a: a))
+  fold(archives, init: true, f: fn(ok, a) { ok && members_named(members: report.archive_members, name: a.archive_name as String) == 1 })
+    && fold(report.archive_members, init: true, f: fn(ok, m) {
+      ok && length(filter(archives, a => (a.archive_name as String) == (m.archive_name as String))) == 1
+    })
+}
+
+// The SCP archive is named by its 2.10.20260210 build, but its OpenBMC push member
+// declares version 4.01: a read-back of that push must be compared with 4.01.
+test fn scp_push_member_declares_the_bios_version() -> Bool {
+  let report = reference_report()
+  fold(filter(report.archive_members, m => (m.archive_name as String) == "ALTRAD8UD-1L2T(2.10.20260210)SCP.zip"), init: false, f: fn(ok, m) {
+    match m.manifest {
+      OpenBmcManifestVersion { version: v } => (v as String) == "4.01"
+      _ => ok
+    }
+  })
+}
diff --git a/dag/test/claim/fleet/fleet_converge_checkout_pin_witness_test.dag b/dag/test/claim/fleet/fleet_converge_checkout_pin_witness_test.dag
index 089dee715b0..6757933fefd 100644
--- a/dag/test/claim/fleet/fleet_converge_checkout_pin_witness_test.dag
+++ b/dag/test/claim/fleet/fleet_converge_checkout_pin_witness_test.dag
@@ -62,8 +62,7 @@ test fn commit_valued_checkout_refs_are_admitted() -> Bool {
 // THE RENDERING: the fleet-converge ref renders to the bytes the regenerated fleet-converge.yml
 // carries, with the mode disjunction grouped under the && (extdeps.github.expressions precedence).
 test fn the_fleet_converge_ref_renders_to_the_emitted_bytes() -> Bool {
-  interpolate(expression: fleet_converge_checkout_ref)
-    == "${{ (github.event.inputs.mode == 'mtcollins1_boot' || github.event.inputs.mode == 'gcp_iam_converge' || github.event.inputs.mode == 'namecheap_observe') && github.sha || github.event.inputs.expected_revision || github.sha }}"
+  interpolate(expression: fleet_converge_checkout_ref) == "${{ github.sha }}"
 }
 
 fn one_step_workflow(uses_checkout: Bool, ref_text: String) -> Workflow {
diff --git a/dag/test/claim/fleet/fleet_converge_cli_witness_test.dag b/dag/test/claim/fleet/fleet_converge_cli_witness_test.dag
index 6a06e2fd3d3..f2854d03507 100644
--- a/dag/test/claim/fleet/fleet_converge_cli_witness_test.dag
+++ b/dag/test/claim/fleet/fleet_converge_cli_witness_test.dag
@@ -90,6 +90,8 @@ test fn witness_converge_cli_run_srv2_is_enrolled_but_deployment_refused() -> Bo
           PolicyUnsound { reason: _ } => false
           UnknownHost { host: _ } => false
           SparkPreEnrollment { host: _ } => false
+          ProviderGuestNotAdopted { host: _, cause: _ } => false
+          ProviderGuestExecutionRefused { host: _, cause: _ } => false
           SparkManagedAccessUnmeasured { host: _, dissolves_on: _ } => false
           ComputeInventoryAbsent { host: _ } => false
           ConvergeTargetMissingForDerivedHost { host: _ } => false
@@ -108,6 +110,8 @@ test fn witness_converge_cli_run_srv2_is_enrolled_but_deployment_refused() -> Bo
           PolicyUnsound { reason: _ } => false
           UnknownHost { host: _ } => false
           SparkPreEnrollment { host: _ } => false
+          ProviderGuestNotAdopted { host: _, cause: _ } => false
+          ProviderGuestExecutionRefused { host: _, cause: _ } => false
           SparkManagedAccessUnmeasured { host: _, dissolves_on: _ } => false
           ComputeInventoryAbsent { host: _ } => false
           ConvergeTargetMissingForDerivedHost { host: _ } => false
@@ -131,6 +135,8 @@ test fn witness_converge_cli_run_unknown_host_refuses() -> Bool {
           PolicyUnsound { reason: _ } => false
           KnobFrontier { reason: _ } => false
           SparkPreEnrollment { host: _ } => false
+          ProviderGuestNotAdopted { host: _, cause: _ } => false
+          ProviderGuestExecutionRefused { host: _, cause: _ } => false
           SparkManagedAccessUnmeasured { host: _, dissolves_on: _ } => false
           ComputeInventoryAbsent { host: _ } => false
           ConvergeTargetMissingForDerivedHost { host: _ } => false
@@ -153,6 +159,8 @@ test fn witness_converge_cli_unknown_host_and_compute_inventory_absent_are_disti
         PolicyUnsound { reason: _ } => false
         KnobFrontier { reason: _ } => false
         SparkPreEnrollment { host: _ } => false
+        ProviderGuestNotAdopted { host: _, cause: _ } => false
+        ProviderGuestExecutionRefused { host: _, cause: _ } => false
         SparkManagedAccessUnmeasured { host: _, dissolves_on: _ } => false
       }
     ComputeInventoryAbsent { host: _ } => false
@@ -161,6 +169,8 @@ test fn witness_converge_cli_unknown_host_and_compute_inventory_absent_are_disti
     PolicyUnsound { reason: _ } => false
     KnobFrontier { reason: _ } => false
     SparkPreEnrollment { host: _ } => false
+    ProviderGuestNotAdopted { host: _, cause: _ } => false
+    ProviderGuestExecutionRefused { host: _, cause: _ } => false
     SparkManagedAccessUnmeasured { host: _, dissolves_on: _ } => false
   }
     && converge_cli_refusal_message(cause: unknown) != converge_cli_refusal_message(cause: inventory_absent)
@@ -186,6 +196,8 @@ test fn witness_converge_cli_refusal_causes_discriminate() -> Bool {
                 PolicyUnsound { reason: _ } => false
                 KnobFrontier { reason: _ } => false
                 SparkPreEnrollment { host: _ } => false
+                ProviderGuestNotAdopted { host: _, cause: _ } => false
+                ProviderGuestExecutionRefused { host: _, cause: _ } => false
                 SparkManagedAccessUnmeasured { host: _, dissolves_on: _ } => false
                 ComputeInventoryAbsent { host: _ } => false
                 ConvergeTargetMissingForDerivedHost { host: _ } => false
@@ -194,6 +206,8 @@ test fn witness_converge_cli_refusal_causes_discriminate() -> Bool {
             PolicyUnsound { reason: _ } => false
             UnknownHost { host: _ } => false
             SparkPreEnrollment { host: _ } => false
+            ProviderGuestNotAdopted { host: _, cause: _ } => false
+            ProviderGuestExecutionRefused { host: _, cause: _ } => false
             SparkManagedAccessUnmeasured { host: _, dissolves_on: _ } => false
             ComputeInventoryAbsent { host: _ } => false
             KnobFrontier { reason: _ } => false
@@ -327,6 +341,8 @@ test fn witness_spark_managed_access_unmeasured_is_typed_and_distinct_from_unkno
           SparkManagedAccessUnmeasured { host: h, dissolves_on: trigger } =>
             h == "srv5" && string_contains(s: trigger, pattern: "fleet_multi_principal_probe_wet")
           SparkPreEnrollment { host: _ } => false
+          ProviderGuestNotAdopted { host: _, cause: _ } => false
+          ProviderGuestExecutionRefused { host: _, cause: _ } => false
           _ => false
         }
       _ => false
@@ -360,3 +376,33 @@ test fn witness_converge_cli_fleet_compute_hosts_include_srv1_through_srv4() ->
     && converge_cli_is_fleet_compute_host(host: "srv4")
     && !converge_cli_is_fleet_compute_host(host: "srv5")
 }
+
+// A SELECTOR RESOLVES TO THE STABLE IDENTITY BEFORE ANYTHING ROUTES. The drawn name "damien" and the
+// opaque identity both resolve to host-183527, the legacy srv1 still resolves to itself, and an
+// unallocated selector is returned unchanged so the applicability refuses it by name.
+test fn converge_cli_selector_resolves_through_the_naming_authority() -> Bool {
+  converge_cli_resolve_self(host: "damien") == "host-183527"
+    && converge_cli_resolve_self(host: "host-183527") == "host-183527"
+    && converge_cli_resolve_self(host: "srv1") == "srv1"
+    && converge_cli_resolve_self(host: "nobody-here") == "nobody-here"
+}
+
+// THE PROVIDER GUEST TAKES ITS OWN ROUTE, carrying its enrollment, and an owned host keeps the route
+// it had -- the guest route is selected by backing, not by a host-name arm.
+test fn converge_cli_routes_a_provider_guest_to_adoption() -> Bool {
+  let guest = match fleet_converge_applicability(host: "host-183527") {
+    ConvergeProviderGuestRoute { intent: e } => (e.host as String) == "host-183527"
+    ConvergeSlice1Route => false
+    ConvergeKnobFrontier => false
+    ConvergeSparkRoute { access: _ } => false
+    ConvergeOutsideFleet => false
+  }
+  let owned = match fleet_converge_applicability(host: "srv1") {
+    ConvergeSlice1Route => true
+    ConvergeProviderGuestRoute { intent: _ } => false
+    ConvergeKnobFrontier => false
+    ConvergeSparkRoute { access: _ } => false
+    ConvergeOutsideFleet => false
+  }
+  guest && owned
+}
diff --git a/dag/test/claim/fleet/fleet_converge_plan_witness_test.dag b/dag/test/claim/fleet/fleet_converge_plan_witness_test.dag
index 0baa56630a6..b8e82eaadd4 100644
--- a/dag/test/claim/fleet/fleet_converge_plan_witness_test.dag
+++ b/dag/test/claim/fleet/fleet_converge_plan_witness_test.dag
@@ -1589,7 +1589,7 @@ test fn witness_fabric_cell_drifted_address_plans_change_and_never_add() -> Bool
   list_length(items: lines) == 2
     && fabric_cell_line_occurrences(
         lines: lines,
-        target: "REFUSED-REALIZATION fabric-cell resource-boundary change realization undeclared: no staged intermediates (gunbc.change_realization)",
+        target: "REFUSED-REALIZATION fabric-cell resource-boundary change has no admitted resource transition (gunbc.change_realization)",
       ) == 1
     && fabric_cell_line_occurrences(
         lines: lines,
@@ -1618,7 +1618,7 @@ test fn witness_fabric_cell_absent_address_plans_add_and_never_change() -> Bool
       ) == 1
     && fabric_cell_line_occurrences(
         lines: lines,
-        target: "REFUSED-REALIZATION fabric-cell resource-boundary change realization undeclared: no staged intermediates (gunbc.change_realization)",
+        target: "REFUSED-REALIZATION fabric-cell resource-boundary change has no admitted resource transition (gunbc.change_realization)",
       ) == 0
 }
 
@@ -2353,14 +2353,15 @@ test fn locked_apply_runs_the_guard_as_the_lease_owner_for_any_invoker() -> Bool
 }
 
 
-// THE DEPLOY BRANCH POLICY IS A COMPARISON, NOT A TRUST. An empty requirement refuses even when it
-// would trivially match, because that is the "any branch" policy the mode must never default to.
-test fn deploy_branch_policy_compares_and_never_admits_any_branch() -> Bool {
+// Operator 2026-10-09: empty requirement admits the observed branch. A named requirement still
+// has to match. An empty checkout never admits.
+test fn deploy_branch_policy_admits_any_observed_branch_when_unconstrained() -> Bool {
   fleet_converge_deploy_branch_admits(observed: "main", required: "main")
     && fleet_converge_deploy_branch_admits(observed: " main\n", required: "main")
+    && fleet_converge_deploy_branch_admits(observed: "session/x", required: "")
     && !fleet_converge_deploy_branch_admits(observed: "worktree-fleet-converge-status", required: "main")
-    && !fleet_converge_deploy_branch_admits(observed: "main", required: "")
     && !fleet_converge_deploy_branch_admits(observed: "", required: "")
+    && !fleet_converge_deploy_branch_admits(observed: "", required: "main")
 }
 
 
diff --git a/dag/test/claim/fleet/fleet_convergence_verdict_witness_test.dag b/dag/test/claim/fleet/fleet_convergence_verdict_witness_test.dag
index 5c5e6ff115c..f54e802d03b 100644
--- a/dag/test/claim/fleet/fleet_convergence_verdict_witness_test.dag
+++ b/dag/test/claim/fleet/fleet_convergence_verdict_witness_test.dag
@@ -5,8 +5,8 @@ import gunbc.srv3_os_install_diagnostic { srv3_install_hang_no_router_lease_ms }
 import std.types { Bool, String, NonEmptyStr, List, Int }
 import product.host_identity { HostIdentity }
 import gunbc.fleet_host_identity { operator_host_srv1 }
-import gunbc.host_phase_status { fleet_subsumption_enrollments }
-import gunbc.host_assimilation_program { HostEnrollmentIntent }
+import gunbc.fleet_enrollment { fleet_enrollments }
+import gunbc.fleet_enrollment { HostEnrollmentIntent }
 import gunbc.fleet_converge_cli { ConvergeCliReceipt, ConvergeCliRefusalCause, KnobFrontier }
 import gunbc.host_converge { VerdictConverged, VerdictAbsent, Drifted }
 import gunbc.fleet_convergence_verdict {
@@ -45,7 +45,7 @@ fn converged_receipt(host: String) -> ConvergeCliReceipt {
 // green, and the unobserved count is a positive number (the arc's honest progress
 // denominator). This witness is the named current defect made executable.
 test fn live_fleet_is_not_converged_and_unobserved_cells_are_counted() -> Bool {
-  match fleet_convergence_verdict(enrollments: fleet_subsumption_enrollments, receipts: no_receipts()) {
+  match fleet_convergence_verdict(enrollments: fleet_enrollments, receipts: no_receipts()) {
     FleetNotConverged { standings: ss } => fleet_unobserved_cell_count(standings: ss) > 0
     FleetConverged { host_count: _ } => false
   }
@@ -55,8 +55,8 @@ test fn live_fleet_is_not_converged_and_unobserved_cells_are_counted() -> Bool {
 // CONVERGED knob receipt, the unobserved lifecycle cells still prevent fleet
 // convergence — knob green never outvotes an unobserved required cell.
 test fn knob_receipts_alone_cannot_converge_the_fleet() -> Bool {
-  let receipts = map(fleet_subsumption_enrollments, e => converged_receipt(host: e.host as String))
-  match fleet_convergence_verdict(enrollments: fleet_subsumption_enrollments, receipts: receipts) {
+  let receipts = map(fleet_enrollments, e => converged_receipt(host: e.host as String))
+  match fleet_convergence_verdict(enrollments: fleet_enrollments, receipts: receipts) {
     FleetNotConverged { standings: _ } => true
     FleetConverged { host_count: _ } => false
   }
diff --git a/dag/test/claim/fleet/fleet_desired_admission_witness_test.dag b/dag/test/claim/fleet/fleet_desired_admission_witness_test.dag
index d2b02989f39..19cf1a575fb 100644
--- a/dag/test/claim/fleet/fleet_desired_admission_witness_test.dag
+++ b/dag/test/claim/fleet/fleet_desired_admission_witness_test.dag
@@ -73,7 +73,7 @@ fn admitting_push() -> PushRefUpdate {
 }
 
 fn admitting_runs() -> WorkflowRunList {
-  let r = WorkflowRun {
+  let r = WorkflowRun { display_title: none,
     id: 1,
     name: Present { value: witness_floor_workflow_name },
     path: Present { value: ".github/workflows/witnesses.yml" },
diff --git a/dag/test/claim/fleet/fleet_desired_merge_queue_admission_witness_test.dag b/dag/test/claim/fleet/fleet_desired_merge_queue_admission_witness_test.dag
index 9f6848fba1c..30eb7e0bf8a 100644
--- a/dag/test/claim/fleet/fleet_desired_merge_queue_admission_witness_test.dag
+++ b/dag/test/claim/fleet/fleet_desired_merge_queue_admission_witness_test.dag
@@ -53,7 +53,7 @@ fn main_push(after: String) -> PushRefUpdate {
 }
 
 fn run(id: Int, event: String, head_sha: String, status: WorkflowRunStatus, conclusion: WorkflowRunConclusion?) -> WorkflowRun {
-  WorkflowRun {
+  WorkflowRun { display_title: none,
     id: id,
     name: Present { value: "witnesses" },
     path: Present { value: artifact_path(a: WitnessFloorYamlArtifact) },
@@ -177,7 +177,7 @@ test fn a_qualifying_success_beside_a_push_run_refuses_as_an_unscoped_read() ->
 
 fn mg_attempt(id: Int, attempt: Int, conclusion: WorkflowRunConclusion) -> WorkflowRun {
   let r = mg(id: id, conclusion: conclusion)
-  WorkflowRun {
+  WorkflowRun { display_title: none,
     id: r.id, name: r.name, path: r.path, head_sha: r.head_sha, head_branch: r.head_branch,
     event: r.event, status: r.status, conclusion: r.conclusion, workflow_id: r.workflow_id,
     run_number: r.run_number, run_attempt: attempt, actor: r.actor, triggering_actor: r.triggering_actor,
@@ -212,7 +212,7 @@ test fn a_merge_group_success_on_another_revision_does_not_admit_this_push() ->
 }
 
 test fn a_run_of_another_workflow_is_not_the_floor() -> Bool {
-  let other = WorkflowRun {
+  let other = WorkflowRun { display_title: none,
     id: 15, name: Present { value: "fleet-converge" }, path: Present { value: ".github/workflows/fleet-converge.yml" },
     head_sha: sha_r as CommitSha, head_branch: none, event: "merge_group", status: Completed,
     conclusion: Present { value: Success }, workflow_id: 1, run_number: 1, run_attempt: 1, actor: none,
diff --git a/dag/test/claim/fleet/fleet_intent_network_witness_test.dag b/dag/test/claim/fleet/fleet_intent_network_witness_test.dag
index 0eaaa2e38c1..780337bd620 100644
--- a/dag/test/claim/fleet/fleet_intent_network_witness_test.dag
+++ b/dag/test/claim/fleet/fleet_intent_network_witness_test.dag
@@ -5,39 +5,10 @@ import extdeps.dhcp.v4 { Active }
 import extdeps.network.ipv4 { ipv4_address }
 import gunbc.fleet_asset_identity { printer_01, printer_02 }
 import gunbc.fleet_host_identity {
-  operator_host_srv10,
-  operator_host_srv11,
-  operator_host_srv5,
-  operator_host_srv6,
-  operator_host_srv7,
-  operator_host_srv8,
-  operator_host_srv9,
+  operator_host_srv10, operator_host_srv11, operator_host_srv9,
 }
 import gunbc.fleet_intent_network {
-  fleet_intent_network,
-  operator_lan_gateway_endpoint,
-  printer_01_lan_endpoint,
-  printer_01_lan_reservation,
-  printer_02_lan_endpoint,
-  printer_02_lan_reservation,
-  srv10_host_lan_endpoint,
-  srv11_host_lan_endpoint,
-  srv12_host_lan_endpoint,
-  srv1_bmc_endpoint,
-  srv1_host_lan_endpoint,
-  srv1_tailscale_endpoint,
-  srv2_bmc_endpoint,
-  srv2_host_lan_endpoint,
-  srv2_tailscale_endpoint,
-  srv3_bmc_endpoint,
-  srv3_host_lan_endpoint,
-  srv4_bmc_endpoint,
-  srv4_host_lan_endpoint,
-  srv5_host_lan_endpoint,
-  srv6_host_lan_endpoint,
-  srv7_host_lan_endpoint,
-  srv8_host_lan_endpoint,
-  srv9_host_lan_endpoint,
+  fleet_intent_network, operator_lan_gateway_endpoint, printer_01_lan_endpoint, printer_01_lan_reservation, printer_02_lan_endpoint, printer_02_lan_reservation, srv10_host_lan_endpoint, srv11_host_lan_endpoint, srv12_host_lan_endpoint, srv1_bmc_endpoint, srv1_host_lan_endpoint, srv1_tailscale_endpoint, srv2_bmc_endpoint, srv2_host_lan_endpoint, srv2_tailscale_endpoint, srv3_bmc_endpoint, srv3_host_lan_endpoint, srv4_bmc_endpoint, srv4_host_lan_endpoint, srv9_host_lan_endpoint,
 }
 import product.network_topology {
   BmcManagement,
@@ -71,7 +42,7 @@ test fn fleet_intent_network_container_to_host_lan_denied() -> Bool {
 // oracle, and automating the literal's update collapses the assertion to `measure() == measure()`.
 // A count also cannot distinguish "every expected endpoint is present" from "some other endpoint
 // answered instead": it stays green under any substitution of one row for another, which is exactly
-// the fabrication the srv5/srv6 row below was originally written to catch and which the count could
+// the fabrication the per-host address rows below were originally written to catch and which the count could
 // not see.
 //
 // So completeness is asserted as an IDENTITY JOIN over the endpoint labels, in both directions and
@@ -111,14 +82,6 @@ data declared_topology_endpoints: List<NetworkEndpoint> = [
   srv2_host_lan_endpoint,
   srv3_host_lan_endpoint,
   srv4_host_lan_endpoint,
-  srv5_host_lan_endpoint,
-  srv6_host_lan_endpoint,
-  srv7_host_lan_endpoint,
-  srv8_host_lan_endpoint,
-  srv9_host_lan_endpoint,
-  srv10_host_lan_endpoint,
-  srv11_host_lan_endpoint,
-  srv12_host_lan_endpoint,
   srv1_bmc_endpoint,
   srv2_bmc_endpoint,
   srv3_bmc_endpoint,
@@ -159,38 +122,15 @@ test fn fleet_intent_network_srv3_addresses_holds() -> Bool {
     && srv3_bmc_endpoint.role == BmcOutOfBand
 }
 
-// DCH-0 (2026-09-02). THIS ROW IS THE INVERSE OF THE ONE IT REPLACES, and the replacement is the
-// honest shape rather than a deletion. The prior row asserted that srv5/srv6 were NAMED as
-// HostIdentity slots and bound to NO endpoint in the topology -- naming is not enrollment -- and it
-// was written to red the moment someone authored an address for a machine that had not arrived.
-// Enrollment has now been taken as a decision by the DCH-0 roadmap node, so that assertion is false
-// by intent and cannot simply be retired: retiring it would leave the addresses themselves
-// unwitnessed, which is precisely the fabrication half the old row was defending.
-//
-// So the guard is inverted and kept discriminating, mirroring the srv3 row above: both slots are
-// enrolled, each bound to its own identity, at the address its CR1000A static reservation carries in
-// gunbc.spark.dgx_procurement (srv5 -> spark_a3ee_reservation 192.168.1.226, srv6 ->
-// spark_3bd5_reservation 192.168.1.225, joined by the attributable
-// dgx_spark_router_binding_operator_allocation), with the role split asserted so a model that
-// collapses a Spark's host OS onto some other attachment role reds rather than shifting a count.
-// Swapping the two addresses -- the live risk, since the ascending-order tie-break no longer
-// describes them after the wifi re-key -- reds here.
-//
-// WHAT THIS ROW DOES NOT ASSERT, and must not be read as asserting: that either address was observed
-// from a host. It pins the corpus against the transcribed reservation authority, which is a §3
-// citation check, not a readback. The live observed-vs-desired reconciliation of the rendered
-// serving unit on both hosts is outstanding and is reported by
-// gunbc.spark.serving_observation_scope `spark_observation_coverage`, which answers
-// SparkObservationIncomplete with srv5 and srv6 in `missing` until a probe transaction supplies them.
-
-test fn fleet_intent_network_srv7_to_srv11_enrolled_at_their_reserved_addresses() -> Bool {
-  srv7_host_lan_endpoint.address == "192.168.1.232"
-    && srv7_host_lan_endpoint.role == HostOperatingSystem
-    && srv7_host_lan_endpoint.subject == EndpointHost { host: operator_host_srv7 }
-    && srv8_host_lan_endpoint.address == "192.168.1.233"
-    && srv8_host_lan_endpoint.role == HostOperatingSystem
-    && srv8_host_lan_endpoint.subject == EndpointHost { host: operator_host_srv8 }
-    && srv9_host_lan_endpoint.address == "192.168.1.236"
+// The sold Group B slots are no longer in the topology (rung drop serving_fixtures_name_sold_group_b_hosts), but their
+// endpoint rows stay as fixtures for serving; this pins them against the transcribed reservation values. The Spark host slots were enrolled, each bound to its own identity, at the address its CR1000A
+// static reservation carries in gunbc.spark.dgx_procurement, with the role split asserted so a model
+// that collapses a Spark's host OS onto some other attachment role reds rather than shifting a count.
+// It pins the corpus against the transcribed reservation authority -- a citation check, not a
+// readback from the host.
+
+test fn fleet_intent_network_srv9_to_srv11_enrolled_at_their_reserved_addresses() -> Bool {
+  srv9_host_lan_endpoint.address == "192.168.1.236"
     && srv9_host_lan_endpoint.role == HostOperatingSystem
     && srv9_host_lan_endpoint.subject == EndpointHost { host: operator_host_srv9 }
     && srv10_host_lan_endpoint.address == "192.168.1.237"
@@ -202,17 +142,6 @@ test fn fleet_intent_network_srv7_to_srv11_enrolled_at_their_reserved_addresses(
     && operator_host_srv9 == "srv9" && operator_host_srv10 == "srv10" && operator_host_srv11 == "srv11"
 }
 
-test fn fleet_intent_network_srv5_srv6_enrolled_at_their_reserved_addresses() -> Bool {
-  srv5_host_lan_endpoint.address == "192.168.1.226"
-    && srv5_host_lan_endpoint.role == HostOperatingSystem
-    && srv5_host_lan_endpoint.subject == EndpointHost { host: operator_host_srv5 }
-    && srv6_host_lan_endpoint.address == "192.168.1.225"
-    && srv6_host_lan_endpoint.role == HostOperatingSystem
-    && srv6_host_lan_endpoint.subject == EndpointHost { host: operator_host_srv6 }
-    && operator_host_srv5 == "srv5"
-    && operator_host_srv6 == "srv6"
-}
-
 // THE BINDING review 59815 REQUIRED, MADE EXECUTABLE. Before the repair the printer endpoint and the
 // printer asset were joined only by the label string "printer-01-lan", so the two could drift with
 // nothing failing. This asserts the endpoint names printer_01 STRUCTURALLY -- it goes red if the
diff --git a/dag/test/claim/fleet/fleet_receipt_collector_witness_test.dag b/dag/test/claim/fleet/fleet_receipt_collector_witness_test.dag
index 21000190f33..b27f9dafb81 100644
--- a/dag/test/claim/fleet/fleet_receipt_collector_witness_test.dag
+++ b/dag/test/claim/fleet/fleet_receipt_collector_witness_test.dag
@@ -1,5 +1,6 @@
 module test.claim.fleet_receipt_collector_witness
 
+import gunbc.fleet_enrollment { fleet_enrollments }
 import v2.std.live_tree { LiveTreeDisposition }
 import gunbc.srv3_os_install_diagnostic { srv3_install_hang_no_router_lease_ms }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
@@ -127,7 +128,7 @@ test fn witness_partial_collection_never_yields_fleet_converged() -> Bool {
       receipt: ConvergeCliReceipt { host: "srv1", applied: 1, drifted: 0, verdict: VerdictConverged, reason: none },
     },
   ])
-  match fleet_convergence_verdict(enrollments: fleet_subsumption_enrollments, receipts: rows) {
+  match fleet_convergence_verdict(enrollments: fleet_enrollments, receipts: rows) {
     FleetConverged { host_count: _ } => false
     FleetNotConverged { standings: s } => length(s) > 0
   }
diff --git a/dag/test/claim/fleet/fleet_site_locale_witness_test.dag b/dag/test/claim/fleet/fleet_site_locale_witness_test.dag
index 338cde01832..25a7a310e66 100644
--- a/dag/test/claim/fleet/fleet_site_locale_witness_test.dag
+++ b/dag/test/claim/fleet/fleet_site_locale_witness_test.dag
@@ -31,7 +31,7 @@ import gunbc.fleet.fleet_site_locale {
 }
 import product.placement_supply { SiteIdentity }
 import product.host_identity { HostIdentity }
-import gunbc.fleet_host_identity { operator_host_srv4, operator_host_srv5, operator_host_srv6 }
+import gunbc.fleet_host_identity { operator_host_srv4, operator_host_srv9, operator_host_srv10 }
 import std.types { Int }
 import gunbc.fleet.fleet_site_locale {
   HostZoneConverged,
@@ -115,18 +115,18 @@ test fn w_fleet_policy_follows_the_site_civil_zone() -> Bool {
 // below names a zone for a host, so moving the site's civil zone moves every verdict.
 
 // The population check, kept SEPARATE from the identity check below because a total and an
-// identity answer different questions. Under the ruling, srv4 and srv5 run Etc/UTC against a
-// New York civil zone and srv6 already matches.
+// identity answer different questions. Under the ruling, srv4 runs Etc/UTC against a New York
+// civil zone, and no observed host already matches.
 test fn w_census_counts_the_three_dispositions_apart() -> Bool {
-  host_zone_census(site: operator_premises_civil_time, policy: fleet_host_zone_policy).divergent == 2
-    && host_zone_census(site: operator_premises_civil_time, policy: fleet_host_zone_policy).converged == 1
+  host_zone_census(site: operator_premises_civil_time, policy: fleet_host_zone_policy).divergent == 1
+    && host_zone_census(site: operator_premises_civil_time, policy: fleet_host_zone_policy).converged == 0
     && host_zone_census(site: operator_premises_civil_time, policy: fleet_host_zone_policy).undecidable == 0
 }
 
 // An unruled policy must not be counted as divergence. The previous revision folded the two
 // together behind a function named for one of them, so this arm had no reader at all.
 test fn w_unruled_policy_is_counted_as_undecidable_not_divergent() -> Bool {
-  host_zone_census(site: operator_premises_civil_time, policy: HostZonePolicyUnruled).undecidable == 3
+  host_zone_census(site: operator_premises_civil_time, policy: HostZonePolicyUnruled).undecidable == 1
     && host_zone_census(site: operator_premises_civil_time, policy: HostZonePolicyUnruled).divergent == 0
     && host_zone_census(site: operator_premises_civil_time, policy: HostZonePolicyUnruled).converged == 0
 }
@@ -137,9 +137,9 @@ test fn w_unruled_policy_is_counted_as_undecidable_not_divergent() -> Bool {
 // diverge while preserving cardinality, both left it green. A count defends a population size and
 // says nothing about which members occupy which state.
 //
-// This names each host and asserts its disposition FLIPS. Under a New York civil zone the two
-// UTC machines are divergent and srv6 is converged; move the site to UTC and every one of those
-// three verdicts inverts, with the same observations underneath.
+// This names the host and asserts its disposition FLIPS. Under a New York civil zone the UTC
+// machine is divergent; move the site to UTC and that verdict inverts, with the same observation
+// underneath.
 // THE RELOCATION PROBE KEEPS THE SAME SITE IDENTITY, and the earlier version did not -- it
 // invented "relocated-probe", which under the host-to-site join is now a MISMATCH rather than a
 // move. That distinction is the point of the join: relocating the operator's premises changes the
@@ -167,7 +167,7 @@ fn foreign_site_facts() -> SiteCivilTimeFacts {
 }
 
 test fn w_facts_from_another_site_are_refused_not_adjudicated() -> Bool {
-  host_zone_census(site: foreign_site_facts(), policy: fleet_host_zone_policy).site_refused == 3
+  host_zone_census(site: foreign_site_facts(), policy: fleet_host_zone_policy).site_refused == 1
     && host_zone_census(site: foreign_site_facts(), policy: fleet_host_zone_policy).converged == 0
     && host_zone_census(site: foreign_site_facts(), policy: fleet_host_zone_policy).divergent == 0
 }
@@ -235,16 +235,17 @@ test fn w_unassigned_host_is_missing_not_mismatched() -> Bool {
   }
 }
 
-// The reach label is DERIVED from the procurement allocation, never restated here. Re-authoring
-// the pair would put a private second copy of an owned relation in this module.
+// The reach label is DERIVED from the procurement allocation, never restated here. srv9 and srv10 were
+// sold with Group B (2026-10-10), their bindings are gone, so the derivation answers Unmodeled rather
+// than a restated label.
 test fn w_reach_labels_come_from_the_procurement_binding() -> Bool {
-  match reach_label_of(host: operator_host_srv5) {
-    ReachLabelFromReservation { label: l } => l == ("spark-a3ee" as NonEmptyStr)
-    ReachLabelUnmodeled => false
+  match reach_label_of(host: operator_host_srv9) {
+    ReachLabelFromReservation { label: _ } => false
+    ReachLabelUnmodeled => true
   }
-    && match reach_label_of(host: operator_host_srv6) {
-      ReachLabelFromReservation { label: l } => l == ("spark-3bd5" as NonEmptyStr)
-      ReachLabelUnmodeled => false
+    && match reach_label_of(host: operator_host_srv10) {
+      ReachLabelFromReservation { label: _ } => false
+      ReachLabelUnmodeled => true
     }
 }
 
@@ -282,23 +283,15 @@ fn converged_reading() -> HostZoneReading {
 test fn w_moving_the_site_inverts_each_named_hosts_disposition() -> Bool {
   host_zone_disposition_of(host: operator_host_srv4, site: operator_premises_civil_time, policy: fleet_host_zone_policy)
       == divergent_reading(observed: zone_etc_utc, desired: zone_america_new_york)
-    && host_zone_disposition_of(host: operator_host_srv5, site: operator_premises_civil_time, policy: fleet_host_zone_policy)
-      == divergent_reading(observed: zone_etc_utc, desired: zone_america_new_york)
-    && host_zone_disposition_of(host: operator_host_srv6, site: operator_premises_civil_time, policy: fleet_host_zone_policy)
-      == converged_reading()
     && host_zone_disposition_of(host: operator_host_srv4, site: relocated_probe_site(), policy: fleet_host_zone_policy)
       == converged_reading()
-    && host_zone_disposition_of(host: operator_host_srv5, site: relocated_probe_site(), policy: fleet_host_zone_policy)
-      == converged_reading()
-    && host_zone_disposition_of(host: operator_host_srv6, site: relocated_probe_site(), policy: fleet_host_zone_policy)
-      == divergent_reading(observed: zone_america_new_york, desired: zone_etc_utc)
 }
 
 // The counts move too, and asymmetrically -- which is itself evidence the site is being read,
 // since a derivation ignoring it would report the same totals on both sides.
 test fn w_relocation_changes_the_census_totals() -> Bool {
-  host_zone_census(site: operator_premises_civil_time, policy: fleet_host_zone_policy).divergent == 2
-    && host_zone_census(site: relocated_probe_site(), policy: fleet_host_zone_policy).divergent == 1
+  host_zone_census(site: operator_premises_civil_time, policy: fleet_host_zone_policy).divergent == 1
+    && host_zone_census(site: relocated_probe_site(), policy: fleet_host_zone_policy).divergent == 0
 }
 
 // AN OBSERVATION KEYED ON A LABEL RATHER THAN AN IDENTITY IS THE DEFECT THIS GUARDS, and the
@@ -308,7 +301,7 @@ test fn w_relocation_changes_the_census_totals() -> Bool {
 // rows. The reach label and the identity coincide sometimes and diverge sometimes; neither is
 // the property. The property is that the HOST FIELD CARRIES A CANONICAL FLEET IDENTITY.
 fn is_canonical_fleet_host(h: HostIdentity) -> Bool {
-  h == operator_host_srv4 || h == operator_host_srv5 || h == operator_host_srv6
+  h == operator_host_srv4
 }
 
 test fn w_every_observation_keys_on_a_canonical_fleet_host() -> Bool {
diff --git a/dag/test/claim/fleet/fleet_wireless_link_witness_test.dag b/dag/test/claim/fleet/fleet_wireless_link_witness_test.dag
index 2a4d92d24d2..d07e587cf32 100644
--- a/dag/test/claim/fleet/fleet_wireless_link_witness_test.dag
+++ b/dag/test/claim/fleet/fleet_wireless_link_witness_test.dag
@@ -19,7 +19,7 @@ import extdeps.networkmanager.nmcli {
 }
 import extdeps.netplan.netplan { PassthroughValue, PassthroughKeyAbsent, netplan_passthrough_value }
 import gunbc.spark.host_effect_quiescence { ArgvRun, ArgvRan, ArgvLegDidNotRun }
-import gunbc.fleet_host_identity { operator_host_srv7, operator_host_srv12 }
+import gunbc.fleet_host_identity { operator_host_srv11, operator_host_srv12 }
 import gunbc.fleet_wireless_link {
   WirelessLinkDesired, WirelessLinkObservation, WirelessLinkPlan,
   DisconnectCountRead, kernel_disconnect_line_count,
@@ -31,7 +31,7 @@ import gunbc.fleet_wireless_link {
   PersistedAuthorityRead, AuthorityNetplanMerged, AuthorityKeyfileUnmodeled, AuthorityRuntimeOnly, AuthorityUnreadable,
 }
 
-fn srv7_desired() -> WirelessLinkDesired { spark_wireless_link_desired(host: operator_host_srv7) }
+fn srv11_desired() -> WirelessLinkDesired { spark_wireless_link_desired(host: operator_host_srv11) }
 
 // ── upstream parses ──────────────────────────────────────────────────────────
 
@@ -70,14 +70,14 @@ test fn witness_iw_link_not_connected_and_missing_signal_is_unreadable() -> Bool
 }
 
 test fn witness_disconnect_count_matches_only_the_interface() -> Bool {
-  let log = "1.0 srv7 kernel: wlP9s9: disconnect from AP ac:91:9b:c4:4d:b6 for new auth\n1.1 srv7 kernel: wlP9s9: authenticate with ac:91:9b:c4:4d:b6\n2.0 srv7 kernel: wlP9s9: disconnect from AP ac:91:9b:c4:4d:b6 for new auth\n3.0 srv7 kernel: wlan1: disconnect from AP 00:00:00:00:00:01 for new auth\n"
+  let log = "1.0 srv11 kernel: wlP9s9: disconnect from AP ac:91:9b:c4:4d:b6 for new auth\n1.1 srv11 kernel: wlP9s9: authenticate with ac:91:9b:c4:4d:b6\n2.0 srv11 kernel: wlP9s9: disconnect from AP ac:91:9b:c4:4d:b6 for new auth\n3.0 srv11 kernel: wlan1: disconnect from AP 00:00:00:00:00:01 for new auth\n"
   kernel_disconnect_line_count(interface: "wlP9s9" as NonEmptyStr, kernel_log: log) == 2
 }
 
 // ── desired roster ───────────────────────────────────────────────────────────
 
 test fn witness_spark_rows_present_including_srv12() -> Bool {
-  let srv7 = match wireless_link_desired_for(host: operator_host_srv7) {
+  let srv11 = match wireless_link_desired_for(host: operator_host_srv11) {
     Present { value: d } => d.interface as String == "wlP9s9" && d.connection as String == "Verizon_39TTYV"
     Absent => false
   }
@@ -85,7 +85,7 @@ test fn witness_spark_rows_present_including_srv12() -> Bool {
     Present { value: d } => d.interface as String == "wlP9s9" && d.connection as String == "Verizon_39TTYV"
     Absent => false
   }
-  srv7 && srv12
+  srv11 && srv12
 }
 
 // THE COVERAGE JOIN: every procured Spark identity has a wireless row. Removing srv12's row (the
@@ -114,7 +114,7 @@ test fn witness_auth_retries_modify_argv_is_zero_for_indefinitely() -> Bool {
 
 // spark-2196 read 2026-10-04: auth-retries -1 (global default, 3 attempts, the last one prompts).
 test fn witness_default_auth_retries_is_drift_planned_to_zero() -> Bool {
-  match wireless_link_decide(desired: srv7_desired(), observed: obs_retries(auth: "-1", autoconnect: "0")) {
+  match wireless_link_decide(desired: srv11_desired(), observed: obs_retries(auth: "-1", autoconnect: "0")) {
     Apply { plan: p } =>
       (match p.auth_retries { Present { value: NmRetryIndefinitely } => true  _ => false })
       && (match p.autoconnect_retries { Absent => true  Present { value: _ } => false })
@@ -127,7 +127,7 @@ test fn witness_default_auth_retries_is_drift_planned_to_zero() -> Bool {
 // spark-2196 read 2026-10-04: autoconnect-retries -1 (global default, 4 tries then blocked). Still
 // at the upstream default is drift, planned to 0 on the governing profile.
 test fn witness_default_autoconnect_retries_is_drift_planned_to_zero() -> Bool {
-  match wireless_link_decide(desired: srv7_desired(), observed: obs_retries(auth: "0", autoconnect: "-1")) {
+  match wireless_link_decide(desired: srv11_desired(), observed: obs_retries(auth: "0", autoconnect: "-1")) {
     Apply { plan: p } =>
       (match p.autoconnect_retries { Present { value: NmRetryIndefinitely } => true  _ => false })
       && (match p.auth_retries { Absent => true  Present { value: _ } => false })
@@ -156,25 +156,25 @@ test fn witness_active_parser_picks_the_interface_row_and_unescapes_the_name() -
 
 test fn witness_a_different_active_profile_refuses() -> Bool {
   let o = obs_with_active(active: "44444444-0000-0000-0000-000000000000:wlP9s9:Neighbour")
-  match wireless_link_decide(desired: srv7_desired(), observed: o) { Refuse { reason: r } => (r as String).contains("Neighbour")  _ => false }
+  match wireless_link_decide(desired: srv11_desired(), observed: o) { Refuse { reason: r } => (r as String).contains("Neighbour")  _ => false }
 }
 
 test fn witness_no_active_profile_refuses() -> Bool {
-  match wireless_link_decide(desired: srv7_desired(), observed: obs_with_active(active: "")) { Refuse { reason: _ } => true  _ => false }
+  match wireless_link_decide(desired: srv11_desired(), observed: obs_with_active(active: "")) { Refuse { reason: _ } => true  _ => false }
 }
 
 // THE RED THE REVIEW OF gunbc#13199 ASKED FOR: the desired profile, looked up by NAME, is correct
 // (disable), while the profile actually active on wlP9s9, looked up by UUID, is drifting (enable).
 // An observe that reads by name reports converged; this one reads the governing profile.
 test fn witness_desired_profile_correct_active_profile_drifting_is_drift() -> Bool {
-  match wireless_link_converge(desired: srv7_desired(), run: fake_run_split(name_persisted: "disable", uuid_persisted: "enable")) {
+  match wireless_link_converge(desired: srv11_desired(), run: fake_run_split(name_persisted: "disable", uuid_persisted: "enable")) {
     WirelessLinkAlreadyConverged { observed: _ } => false
     WirelessLinkApplied { before: _, plan: _, after: _ } => false
     WirelessLinkRefused { stage: s, cause: _ } => s as String == "readback"
   }
 }
 
-data nm_no_secrets_journal: String = "1759470000.0 srv8 NetworkManager[1022]: <warn>  [1759470000.0] device (wlP9s9): no secrets: No agents were available for this request.\n1759470001.0 srv8 NetworkManager[1022]: <info>  [1759470001.0] device (wlP9s9): state change: need-auth -> failed\n"
+data nm_no_secrets_journal: String = "1759470000.0 srv10 NetworkManager[1022]: <warn>  [1759470000.0] device (wlP9s9): no secrets: No agents were available for this request.\n1759470001.0 srv10 NetworkManager[1022]: <info>  [1759470001.0] device (wlP9s9): state change: need-auth -> failed\n"
 
 test fn witness_disconnected_with_no_secrets_is_named() -> Bool {
   let o = obs_full(runtime: "Power save: off", persisted: "disable", auth: "0", device: "30 (disconnected)", journal: nm_no_secrets_journal)
@@ -240,14 +240,14 @@ fn obs(runtime: String, persisted: String) -> WirelessLinkObservation {
 }
 
 test fn witness_both_off_is_noop() -> Bool {
-  match wireless_link_decide(desired: srv7_desired(), observed: obs(runtime: "Power save: off", persisted: "disable")) {
+  match wireless_link_decide(desired: srv11_desired(), observed: obs(runtime: "Power save: off", persisted: "disable")) {
     Noop => true
     _ => false
   }
 }
 
 test fn witness_persisted_enable_is_drift_runtime_untouched() -> Bool {
-  match wireless_link_decide(desired: srv7_desired(), observed: obs(runtime: "Power save: off", persisted: "enable")) {
+  match wireless_link_decide(desired: srv11_desired(), observed: obs(runtime: "Power save: off", persisted: "enable")) {
     Apply { plan: p } =>
       (match p.persisted { Present { value: NmPowersaveDisable } => true  _ => false })
       && (match p.runtime { Absent => true  Present { value: _ } => false })
@@ -256,22 +256,22 @@ test fn witness_persisted_enable_is_drift_runtime_untouched() -> Bool {
 }
 
 test fn witness_persisted_default_is_drift_not_converged() -> Bool {
-  match wireless_link_decide(desired: srv7_desired(), observed: obs(runtime: "Power save: off", persisted: "default")) {
+  match wireless_link_decide(desired: srv11_desired(), observed: obs(runtime: "Power save: off", persisted: "default")) {
     Apply { plan: _ } => true
     _ => false
   }
 }
 
 test fn witness_runtime_on_is_drift() -> Bool {
-  match wireless_link_decide(desired: srv7_desired(), observed: obs(runtime: "Power save: on", persisted: "disable")) {
+  match wireless_link_decide(desired: srv11_desired(), observed: obs(runtime: "Power save: on", persisted: "disable")) {
     Apply { plan: p } => match p.runtime { Present { value: IwPowerSaveOff } => true  _ => false }
     _ => false
   }
 }
 
 test fn witness_unreadable_is_refusal_not_absence() -> Bool {
-  let rt = match wireless_link_decide(desired: srv7_desired(), observed: obs(runtime: "", persisted: "disable")) { Refuse { reason: _ } => true  _ => false }
-  let ps = match wireless_link_decide(desired: srv7_desired(), observed: obs(runtime: "Power save: off", persisted: "")) { Refuse { reason: _ } => true  _ => false }
+  let rt = match wireless_link_decide(desired: srv11_desired(), observed: obs(runtime: "", persisted: "disable")) { Refuse { reason: _ } => true  _ => false }
+  let ps = match wireless_link_decide(desired: srv11_desired(), observed: obs(runtime: "Power save: off", persisted: "")) { Refuse { reason: _ } => true  _ => false }
   rt && ps
 }
 
@@ -318,28 +318,28 @@ fn fake_run_split(name_persisted: String, uuid_persisted: String) -> fn(List<Str
 }
 
 test fn witness_converge_already_off_is_noop() -> Bool {
-  match wireless_link_converge(desired: srv7_desired(), run: fake_run(runtime: "Power save: off", persisted: "disable", modify_exit: 0)) {
+  match wireless_link_converge(desired: srv11_desired(), run: fake_run(runtime: "Power save: off", persisted: "disable", modify_exit: 0)) {
     WirelessLinkAlreadyConverged { observed: o } => match o.link { IwLinkConnected { bssid: _, freq_mhz: f, signal_dbm: _ } => f == 5180  _ => false }
     _ => false
   }
 }
 
 test fn witness_converge_readback_still_drifted_refuses() -> Bool {
-  match wireless_link_converge(desired: srv7_desired(), run: fake_run(runtime: "Power save: on", persisted: "enable", modify_exit: 0)) {
+  match wireless_link_converge(desired: srv11_desired(), run: fake_run(runtime: "Power save: on", persisted: "enable", modify_exit: 0)) {
     WirelessLinkRefused { stage: s, cause: _ } => s as String == "readback"
     _ => false
   }
 }
 
 test fn witness_converge_failed_modify_refuses_at_apply() -> Bool {
-  match wireless_link_converge(desired: srv7_desired(), run: fake_run(runtime: "Power save: off", persisted: "enable", modify_exit: 1)) {
+  match wireless_link_converge(desired: srv11_desired(), run: fake_run(runtime: "Power save: off", persisted: "enable", modify_exit: 1)) {
     WirelessLinkRefused { stage: s, cause: _ } => s as String == "apply"
     _ => false
   }
 }
 
 test fn witness_converge_unreadable_refuses_at_observe() -> Bool {
-  match wireless_link_converge(desired: srv7_desired(), run: fake_run(runtime: "garbage", persisted: "disable", modify_exit: 0)) {
+  match wireless_link_converge(desired: srv11_desired(), run: fake_run(runtime: "garbage", persisted: "disable", modify_exit: 0)) {
     WirelessLinkRefused { stage: s, cause: _ } => s as String == "observe"
     _ => false
   }
@@ -380,7 +380,7 @@ test fn witness_passthrough_reads_either_quote_and_absence() -> Bool {
 // 99-override.yaml sets 3, so the merge -- what the next generate renders -- says 3. Drift, planned
 // to the persisted setter. Reading only the 90-NM file would have returned Noop here.
 test fn witness_a_later_layer_overriding_the_profile_file_is_drift() -> Bool {
-  match wireless_link_decide(desired: srv7_desired(), observed: obs_with_authority(authority: merged(passthrough: merged_passthrough_with(powersave: "wifi.powersave: '3'\n")))) {
+  match wireless_link_decide(desired: srv11_desired(), observed: obs_with_authority(authority: merged(passthrough: merged_passthrough_with(powersave: "wifi.powersave: '3'\n")))) {
     Apply { plan: p } => match p.persisted { Present { value: NmPowersaveDisable } => true  _ => false }
     _ => false
   }
@@ -389,7 +389,7 @@ test fn witness_a_later_layer_overriding_the_profile_file_is_drift() -> Bool {
 // THE KEY ABSENT FROM 90-NM BUT SUPPLIED BY ANOTHER LAYER: the merge carries it, so the profile file's
 // omission is not read as the default.
 test fn witness_a_key_supplied_by_another_layer_is_read_from_the_merge() -> Bool {
-  match wireless_link_decide(desired: srv7_desired(), observed: obs_with_authority(authority: authority_converged)) {
+  match wireless_link_decide(desired: srv11_desired(), observed: obs_with_authority(authority: authority_converged)) {
     Noop => true
     _ => false
   }
@@ -398,14 +398,14 @@ test fn witness_a_key_supplied_by_another_layer_is_read_from_the_merge() -> Bool
 // No layer supplies the key: the merge omits it, the generated keyfile omits it, NetworkManager uses
 // its default, which is not 'disable'.
 test fn witness_a_key_no_layer_supplies_is_the_default_and_drift() -> Bool {
-  match wireless_link_decide(desired: srv7_desired(), observed: obs_with_authority(authority: merged(passthrough: merged_passthrough_with(powersave: "")))) {
+  match wireless_link_decide(desired: srv11_desired(), observed: obs_with_authority(authority: merged(passthrough: merged_passthrough_with(powersave: "")))) {
     Apply { plan: p } => match p.persisted { Present { value: NmPowersaveDisable } => true  _ => false }
     _ => false
   }
 }
 
 test fn witness_merged_retry_drift_is_planned_even_when_nmcli_reads_zero() -> Bool {
-  match wireless_link_decide(desired: srv7_desired(), observed: obs_with_authority(authority: merged(passthrough: "wifi.powersave: \"2\"\n"))) {
+  match wireless_link_decide(desired: srv11_desired(), observed: obs_with_authority(authority: merged(passthrough: "wifi.powersave: \"2\"\n"))) {
     Apply { plan: p } =>
       (match p.auth_retries { Present { value: NmRetryIndefinitely } => true  _ => false })
       && (match p.persisted { Absent => true  Present { value: _ } => false })
@@ -416,9 +416,9 @@ test fn witness_merged_retry_drift_is_planned_even_when_nmcli_reads_zero() -> Bo
 // THE ACTIVE PROFILE AGREEING WHILE ITS KEYFILE ON DISK MAY NOT: that backend's file is not read, so
 // agreement is not minted from the in-memory profile; it refuses, like a runtime-only or unread one.
 test fn witness_keyfile_runtime_only_or_unread_persistence_refuses() -> Bool {
-  let keyfile = match wireless_link_decide(desired: srv7_desired(), observed: obs_with_authority(authority: AuthorityKeyfileUnmodeled { path: "/etc/NetworkManager/system-connections/W.nmconnection" as NonEmptyStr })) { Refuse { reason: _ } => true  _ => false }
-  let volatile = match wireless_link_decide(desired: srv7_desired(), observed: obs_with_authority(authority: AuthorityRuntimeOnly { path: "/run/NetworkManager/system-connections/W.nmconnection" as NonEmptyStr })) { Refuse { reason: _ } => true  _ => false }
-  let unread = match wireless_link_decide(desired: srv7_desired(), observed: obs_with_authority(authority: AuthorityUnreadable { cause: "x" })) { Refuse { reason: _ } => true  _ => false }
+  let keyfile = match wireless_link_decide(desired: srv11_desired(), observed: obs_with_authority(authority: AuthorityKeyfileUnmodeled { path: "/etc/NetworkManager/system-connections/W.nmconnection" as NonEmptyStr })) { Refuse { reason: _ } => true  _ => false }
+  let volatile = match wireless_link_decide(desired: srv11_desired(), observed: obs_with_authority(authority: AuthorityRuntimeOnly { path: "/run/NetworkManager/system-connections/W.nmconnection" as NonEmptyStr })) { Refuse { reason: _ } => true  _ => false }
+  let unread = match wireless_link_decide(desired: srv11_desired(), observed: obs_with_authority(authority: AuthorityUnreadable { cause: "x" })) { Refuse { reason: _ } => true  _ => false }
   keyfile && volatile && unread
 }
 
@@ -426,7 +426,7 @@ test fn witness_keyfile_runtime_only_or_unread_persistence_refuses() -> Bool {
 // netplan for the merged passthrough of NM-<uuid>, and decides on it. An override in the merge reds a
 // converge that would otherwise be Noop; deleting the merged read reds both claims.
 test fn witness_observe_reads_the_merged_netplan_value_by_uuid() -> Bool {
-  match wireless_link_converge(desired: srv7_desired(), run: fake_run(runtime: "Power save: off", persisted: "disable", modify_exit: 0)) {
+  match wireless_link_converge(desired: srv11_desired(), run: fake_run(runtime: "Power save: off", persisted: "disable", modify_exit: 0)) {
     WirelessLinkAlreadyConverged { observed: o } => match o.persistence {
       AuthorityNetplanMerged { provenance: y, definition: d, passthrough: _ } =>
         y as String == join(["/etc/netplan/90-NM-", spark_2196_profile_uuid, ".yaml"], "") && d as String == join(["NM-", spark_2196_profile_uuid], "")
@@ -438,7 +438,7 @@ test fn witness_observe_reads_the_merged_netplan_value_by_uuid() -> Bool {
 
 test fn witness_converge_over_a_merged_override_does_not_report_converged() -> Bool {
   let run = fake_run_merged(runtime: "Power save: off", name_persisted: "disable", uuid_persisted: "disable", modify_exit: 0, merged_answer: merged_passthrough_with(powersave: "wifi.powersave: \"3\"\n"))
-  match wireless_link_converge(desired: srv7_desired(), run: run) {
+  match wireless_link_converge(desired: srv11_desired(), run: run) {
     WirelessLinkRefused { stage: s, cause: _ } => s as String == "readback"
     _ => false
   }
@@ -446,7 +446,7 @@ test fn witness_converge_over_a_merged_override_does_not_report_converged() -> B
 
 test fn witness_an_empty_merge_answer_refuses() -> Bool {
   let run = fake_run_merged(runtime: "Power save: off", name_persisted: "disable", uuid_persisted: "disable", modify_exit: 0, merged_answer: "")
-  match wireless_link_converge(desired: srv7_desired(), run: run) {
+  match wireless_link_converge(desired: srv11_desired(), run: run) {
     WirelessLinkRefused { stage: s, cause: _ } => s as String == "observe"
     _ => false
   }
@@ -457,7 +457,7 @@ test fn witness_an_empty_merge_answer_refuses() -> Bool {
 // plan a set against a map nobody read.
 test fn witness_a_null_passthrough_answer_refuses_not_defaults() -> Bool {
   let run = fake_run_merged(runtime: "Power save: off", name_persisted: "disable", uuid_persisted: "disable", modify_exit: 0, merged_answer: "null\n")
-  match wireless_link_converge(desired: srv7_desired(), run: run) {
+  match wireless_link_converge(desired: srv11_desired(), run: run) {
     WirelessLinkRefused { stage: s, cause: c } => s as String == "observe" && string_contains(s: c, pattern: "unread")
     _ => false
   }
@@ -466,7 +466,7 @@ test fn witness_a_null_passthrough_answer_refuses_not_defaults() -> Bool {
 // The real srv12 answer shape, verbatim keys: the decision reads it as converged.
 test fn witness_the_srv12_passthrough_answer_is_converged() -> Bool {
   let srv12 = "connection.auth-retries: \"0\"\nconnection.autoconnect-retries: \"0\"\nconnection.timestamp: \"1791043398\"\nwifi.powersave: \"2\"\nwifi-security.auth-alg: \"open\"\nipv6.addr-gen-mode: \"default\"\nipv6.ip6-privacy: \"-1\"\nproxy._: \"\"\n"
-  match wireless_link_decide(desired: srv7_desired(), observed: obs_with_authority(authority: merged(passthrough: srv12))) {
+  match wireless_link_decide(desired: srv11_desired(), observed: obs_with_authority(authority: merged(passthrough: srv12))) {
     Noop => true
     _ => false
   }
diff --git a/dag/test/claim/floor/floor_demand_witness_test.dag b/dag/test/claim/floor/floor_demand_witness_test.dag
index 4d259265d91..74d9ee42418 100644
--- a/dag/test/claim/floor/floor_demand_witness_test.dag
+++ b/dag/test/claim/floor/floor_demand_witness_test.dag
@@ -5,34 +5,33 @@ import std.measure { byte_size, byte_size_count, gibibyte, gibibyte_to_byte_size
 import std.checked_arithmetic { int_inclusive_max, CheckedIntReady, CheckedIntOverflow }
 import extdeps.toolchain.types { Aarch64, X86_64 }
 import gunbc.floor_demand {
-  floor_execution_requirements,
-  FloorRunCgroupPeakReceipt, FloorRunCgroupPeakMeasured, FloorRunCgroupPeakUnmeasured,
-  floor_peak_reading_kind, UncensoredPeak, ThrottlePin, PeakUnmeasured,
-  floor_cgroup_charge_ceiling, gunbc_floor_cgroup_charge_ceiling,
-  FloorHeldSetStanding, HeldSetUnmeasured, HeldSetMeasured, FloorHeldSetReceipt, FloorMemoryStatBeat,
-  beat_held_set, beat_reclaimable_cache, receipt_peak_beat, receipt_last_unstalled_beat, receipt_held_set_peak,
-  floor_memory_requirement_of, gunbc_floor_held_set_standing, gunbc_floor_memory_stat_receipt_2026_09_19,
+  floor_execution_requirements, FloorRunCgroupPeakReceipt, FloorRunCgroupPeakMeasured,
+  FloorRunCgroupPeakUnmeasured, floor_peak_reading_kind, UncensoredPeak, ThrottlePin,
+  PeakUnmeasured, floor_cgroup_charge_ceiling, gunbc_floor_cgroup_charge_ceiling,
+  FloorHeldSetStanding, HeldSetUnmeasured, HeldSetMeasured, FloorHeldSetReceipt,
+  FloorMemoryStatBeat, beat_held_set, beat_reclaimable_cache, receipt_peak_beat,
+  receipt_last_unstalled_beat, receipt_held_set_peak, floor_memory_requirement_of,
+  gunbc_floor_held_set_standing, gunbc_floor_memory_stat_receipt_2026_09_19,
   gunbc_floor_uncensored_demand_receipt, gunbc_floor_throttle_pin_receipt_2026_09_19,
   gunbc_floor_measured_peak_observation, gunbc_floor_measured_peak_is_uncensored,
   floor_storage_demand, StorageDemandStated, StorageDemandUnrepresentable, held_set_standing_of,
-  HeldSetPeakAt, HeldSetPeakNoBeats, HeldSetPeakUnrepresentable,
-  HeldSetReceiptUnrepresentable,
+  HeldSetPeakAt, HeldSetPeakNoBeats, HeldSetPeakUnrepresentable, HeldSetReceiptUnrepresentable,
   StorageComponentReceipt, storage_components_total, round_up_to_gibibyte_grain,
-  gunbc_floor_storage_components, gunbc_floor_job_wall_receipt_2026_09_19,
-  FloorSeam, SeamStrictPreparation, SeamClaimEvaluationFold, SeamPublication, SeamNotYetEntered, SeamUnrecorded,
-  receipt_peak_seam, PeakAttributedTo, PeakSeamUnattributable,
-  PeakUnattributableCause, PeakBeatSampledBeforeAnySeam, PeakBeatSeamUnrecorded, ReceiptHasNoBeats, ReceiptTorn,
-  gunbc_floor_memory_stat_receipt_2026_09_21, gunbc_floor_memory_stat_receipt_2026_09_23, peak_standing_from_swap_policy,
-  receipt_peak_reading_standing, PeakReadingStanding,
-  PeakIsUncensoredSampledMaximum, PeakIsLowerBound, PeakUnreadable, PeakLowerBoundCause, RunDidNotComplete,
-  PeakBeatWasStalling, SwapCouldAbsorbAnonymousPages, SwapPolicyIsRead, SwapHeldPagesAtPeak, SwapRead, SwapUnread, BeatSwap,
-  RunSwapPolicy, SwapMaxRead, SwapMaxDeclaredUnread, SwapDisabled,
-  BeatStall, StallRead, StallUnread, SeamUnreadable, PeakBeatStallUnread, PeakBeatSeamUnreadable,
-  SeamMovedDuringSample, PeakBeatSeamMovedDuringSample,
-  beat_stall_is_zero, beat_stall_is_positive,
-  SeamArmSetPlanning, SeamInterfaceConsumerPlanning, floor_seam_of_token,
-}
-import gunbc.runner_slot_desired { gunbc_runner_slot_desired }
+  gunbc_floor_storage_components, gunbc_floor_job_wall_receipt_2026_09_19, FloorSeam,
+  SeamStrictPreparation, SeamClaimEvaluationFold, SeamPublication, SeamNotYetEntered,
+  SeamUnrecorded, receipt_peak_seam, PeakAttributedTo, PeakSeamUnattributable,
+  PeakUnattributableCause, PeakBeatSampledBeforeAnySeam, PeakBeatSeamUnrecorded, ReceiptHasNoBeats,
+  ReceiptTorn, gunbc_floor_memory_stat_receipt_2026_09_21,
+  gunbc_floor_memory_stat_receipt_2026_09_23, peak_standing_from_swap_policy,
+  receipt_peak_reading_standing, PeakReadingStanding, PeakIsUncensoredSampledMaximum,
+  PeakIsLowerBound, PeakUnreadable, PeakLowerBoundCause, RunDidNotComplete, PeakBeatWasStalling,
+  SwapCouldAbsorbAnonymousPages, SwapPolicyIsRead, SwapHeldPagesAtPeak, SwapRead, SwapUnread,
+  BeatSwap, RunSwapPolicy, SwapMaxRead, SwapMaxDeclaredUnread, SwapDisabled, BeatStall, StallRead,
+  StallUnread, SeamUnreadable, PeakBeatStallUnread, PeakBeatSeamUnreadable, SeamMovedDuringSample,
+  PeakBeatSeamMovedDuringSample, beat_stall_is_zero, beat_stall_is_positive, SeamArmSetPlanning,
+  SeamInterfaceConsumerPlanning, floor_seam_of_token, gunbc_floor_pinned_memory_max,
+  gunbc_floor_pinned_memory_high
+}
 import v2.std.algebra { any }
 
 fn receipt(peak: Int, high: Int) -> FloorRunCgroupPeakReceipt {
@@ -266,7 +265,7 @@ test fn the_production_receipt_joins_its_typed_beats_to_the_cited_producer_readi
         && stall_rate_is(b: p, n: 6)
         && byte_size_count(b: p.file) * 100 < byte_size_count(b: p.charge)
         && byte_size_count(b: held) <= byte_size_count(b: p.charge)
-        && byte_size_count(b: held) <= byte_size_count(b: gunbc_runner_slot_desired().memory_max)
+        && byte_size_count(b: held) <= byte_size_count(b: gunbc_floor_pinned_memory_max)
   }
   let thrash_beat_ok = any(r.beats, b => b.beat == 15 && stall_rate_is(b: b, n: 66940))
   let unstalled_ok = match receipt_last_unstalled_beat(r: r) {
@@ -276,12 +275,14 @@ test fn the_production_receipt_joins_its_typed_beats_to_the_cited_producer_readi
   !r.run_completed && r.beats_sampled > 0 && count(r.beats) == 4 && peak_ok && thrash_beat_ok && unstalled_ok
 }
 
-// THE PIN WAS TAKEN UNDER THE CURRENT ROW, which is what makes it a finding about the row rather
-// than about a line that no longer exists.
+// THE PIN WAS TAKEN UNDER THE ROW OF ITS DAY, which gunbc.floor_demand now carries as its own
+// envelope rows: the live gunbc.runner_slot_desired moved on 2026-10-09 with the v1 withdrawal, and
+// the floor no longer runs in any slot, so joining its receipts to the live row would assert a
+// relation between a dead instrument and a slot it never inhabited.
 test fn the_pin_receipt_was_armed_at_the_declared_throttle_line() -> Bool {
   match gunbc_floor_throttle_pin_receipt_2026_09_19 {
     FloorRunCgroupPeakMeasured { run_id: _, runner_unit: _, cgroup_peak: _, armed_memory_high: h, floor_outcome: _ } =>
-      byte_size_count(b: h) == byte_size_count(b: gunbc_runner_slot_desired().memory_high)
+      byte_size_count(b: h) == byte_size_count(b: gunbc_floor_pinned_memory_high)
     FloorRunCgroupPeakUnmeasured => false
   }
 }
diff --git a/dag/test/claim/floor/floor_preparation_witness_test.dag b/dag/test/claim/floor/floor_preparation_witness_test.dag
deleted file mode 100644
index 490f3ddd14b..00000000000
--- a/dag/test/claim/floor/floor_preparation_witness_test.dag
+++ /dev/null
@@ -1,269 +0,0 @@
-module test.claim.floor_preparation_witness
-
-import std.types { Bool, List, String }
-import std.content_hash { Fnv1a64Structural, Sha1Digest, content_hash_atom }
-import std.execution_mode { Hermetic }
-import std.measure { byte_size }
-import extdeps.git.object_store { GitObjectId, GitSha1ObjectId }
-import std.realization_schedule {
-  ScheduleWitnessEntry,
-  CorpusWitnessKind,
-  ExecutionWitnessKind,
-}
-import std.materialization_provider {
-  ArtifactPart,
-  MaterializedArtifact,
-  ResolvedGraphArtifact,
-  ProviderProbe,
-  ProbeAbsent,
-  ProviderMiss,
-  ProviderRefusedWrongArtifact,
-  artifact_content_digest,
-  request_key,
-  in_process_materialization,
-}
-import v2.workflow.floor_discovery {
-  FloorDiscoverySubject,
-  FloorDiscoveryRequest,
-  floor_discovery_commit_id,
-  floor_discovery_tree_id,
-}
-import v2.workflow.floor_preparation {
-  ResolveSelectedClosuresV1,
-  PreparedFloorEntryRequest,
-  PreparedFloorSubjectRequest,
-  PreparedFloorEntryProbe,
-  PreparedFloorSubjectReady,
-  PreparedFloorSubjectRefused,
-  PreparedFloorDuplicateSelectedIdentities,
-  PreparedFloorDuplicateProbeIdentities,
-  PreparedFloorMissingProbeIdentities,
-  PreparedFloorUnexpectedProbeIdentities,
-  PreparedFloorProviderRefused,
-  prepared_floor_entry_artifact_request,
-  prepared_claim_subject_identity,
-  prepared_floor_subject_serve,
-}
-
-data tested_commit: GitObjectId = GitSha1ObjectId {
-  digest: Sha1Digest { hex: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }
-}
-
-data tested_tree: GitObjectId = GitSha1ObjectId {
-  digest: Sha1Digest { hex: "1111111111111111111111111111111111111111" }
-}
-
-fn discovery_request() -> FloorDiscoveryRequest {
-  FloorDiscoveryRequest {
-    subject: FloorDiscoverySubject {
-      tested_commit: floor_discovery_commit_id(object_id: tested_commit),
-      tested_tree: floor_discovery_tree_id(object_id: tested_tree),
-      source_roots: ["dag", "src/v2"],
-      execution_authority_source_roots: ["dag", "src/v2"],
-      naming_authority_identity: content_hash_atom(value: "floor-preparation-naming-fixture"),
-      tool_identity: content_hash_atom(value: "floor-preparation-tool-fixture"),
-    },
-    scan_dirs: ["dag/test/claim"],
-    exclude_substrings: [],
-    discovery_scope_dirs: ["dag/test/claim"],
-    execution_mode: Hermetic,
-  }
-}
-
-fn witness_a() -> ScheduleWitnessEntry {
-  ScheduleWitnessEntry {
-    entry: "dag/test/claim/a_test.dag",
-    function: "a",
-    kind: CorpusWitnessKind,
-  }
-}
-
-fn witness_b() -> ScheduleWitnessEntry {
-  ScheduleWitnessEntry {
-    entry: "dag/test/claim/b_test.dag",
-    function: "b",
-    kind: ExecutionWitnessKind,
-  }
-}
-
-fn witness_extra() -> ScheduleWitnessEntry {
-  ScheduleWitnessEntry {
-    entry: "dag/test/claim/extra_test.dag",
-    function: "extra",
-    kind: CorpusWitnessKind,
-  }
-}
-
-fn entry_request(witness: ScheduleWitnessEntry, closure: String) -> PreparedFloorEntryRequest {
-  PreparedFloorEntryRequest {
-    witness: witness,
-    closure_digest: content_hash_atom(value: closure),
-  }
-}
-
-fn entry_a() -> PreparedFloorEntryRequest {
-  entry_request(witness: witness_a(), closure: "closure-a")
-}
-
-fn entry_b() -> PreparedFloorEntryRequest {
-  entry_request(witness: witness_b(), closure: "closure-b")
-}
-
-fn request_with(selected: List<PreparedFloorEntryRequest>) -> PreparedFloorSubjectRequest {
-  PreparedFloorSubjectRequest {
-    discovery: discovery_request(),
-    selected: selected,
-    policy: ResolveSelectedClosuresV1 {},
-  }
-}
-
-fn canonical_request() -> PreparedFloorSubjectRequest {
-  request_with(selected: [entry_a(), entry_b()])
-}
-
-fn artifact_part(label: String) -> ArtifactPart {
-  ArtifactPart {
-    digest: content_hash_atom(value: label),
-    bytes: byte_size(count: 1),
-  }
-}
-
-fn artifact_for(entry: PreparedFloorEntryRequest) -> MaterializedArtifact {
-  ResolvedGraphArtifact {
-    request_key: request_key(
-      req: prepared_floor_entry_artifact_request(
-        discovery: discovery_request(),
-        entry: entry,
-      )
-    ),
-    resolved_graph: artifact_part(label: concat(entry.witness.entry, ".graph")),
-    source_indices: artifact_part(label: concat(entry.witness.entry, ".indices")),
-    compile_clean_diagnostic_union: artifact_part(label: concat(entry.witness.entry, ".union")),
-  }
-}
-
-fn probe_for(entry: PreparedFloorEntryRequest) -> PreparedFloorEntryProbe {
-  let artifact = artifact_for(entry: entry)
-  let req = prepared_floor_entry_artifact_request(discovery: discovery_request(), entry: entry)
-  PreparedFloorEntryProbe {
-    witness: entry.witness,
-    probe: in_process_materialization(
-      req: req,
-      artifact: artifact,
-      observed_digest: artifact_content_digest(artifact: artifact)
-    )
-  }
-}
-
-test fn exact_prepared_artifact_set_serves() -> Bool {
-  let request = canonical_request()
-  match prepared_floor_subject_serve(
-    request: request,
-    probes: [probe_for(entry: entry_a()), probe_for(entry: entry_b())],
-  ) {
-    PreparedFloorSubjectReady { identity: identity, entries: entries } =>
-      identity == prepared_claim_subject_identity(request: request)
-        && entries.count() == 2
-        && entries.first().witness.entry == witness_a().entry
-    PreparedFloorSubjectRefused { cause: _ } => false
-  }
-}
-
-test fn missing_prepared_identity_refuses() -> Bool {
-  match prepared_floor_subject_serve(
-    request: canonical_request(),
-    probes: [probe_for(entry: entry_a())],
-  ) {
-    PreparedFloorSubjectRefused {
-      cause: PreparedFloorMissingProbeIdentities { missing: missing }
-    } => missing.count() == 1 && missing.first().entry == witness_b().entry
-    _ => false
-  }
-}
-
-test fn absent_artifact_is_typed_miss_without_cold_fallback() -> Bool {
-  match prepared_floor_subject_serve(
-    request: request_with(selected: [entry_a()]),
-    probes: [PreparedFloorEntryProbe { witness: witness_a(), probe: ProbeAbsent }],
-  ) {
-    PreparedFloorSubjectRefused {
-      cause: PreparedFloorProviderRefused {
-        witness: witness,
-        lookup: ProviderMiss { key: _ },
-      }
-    } => witness.entry == witness_a().entry
-    _ => false
-  }
-}
-
-test fn wrong_artifact_key_refuses() -> Bool {
-  let wrong = artifact_for(entry: entry_b())
-  match prepared_floor_subject_serve(
-    request: request_with(selected: [entry_a()]),
-    probes: [PreparedFloorEntryProbe {
-      witness: witness_a(),
-      probe: in_process_materialization(
-        req: prepared_floor_entry_artifact_request(discovery: discovery_request(), entry: entry_a()),
-        artifact: wrong,
-        observed_digest: artifact_content_digest(artifact: wrong)
-      )
-    }],
-  ) {
-    PreparedFloorSubjectRefused {
-      cause: PreparedFloorProviderRefused {
-        witness: _,
-        lookup: ProviderRefusedWrongArtifact { key: _, found_key: _ },
-      }
-    } => true
-    _ => false
-  }
-}
-
-test fn duplicate_selected_identity_refuses() -> Bool {
-  match prepared_floor_subject_serve(
-    request: request_with(selected: [entry_a(), entry_a()]),
-    probes: [probe_for(entry: entry_a())],
-  ) {
-    PreparedFloorSubjectRefused {
-      cause: PreparedFloorDuplicateSelectedIdentities { duplicates: duplicates }
-    } => duplicates.count() == 2
-    _ => false
-  }
-}
-
-test fn duplicate_probe_identity_refuses() -> Bool {
-  match prepared_floor_subject_serve(
-    request: request_with(selected: [entry_a()]),
-    probes: [probe_for(entry: entry_a()), probe_for(entry: entry_a())],
-  ) {
-    PreparedFloorSubjectRefused {
-      cause: PreparedFloorDuplicateProbeIdentities { duplicates: duplicates }
-    } => duplicates.count() == 2
-    _ => false
-  }
-}
-
-test fn unexpected_probe_identity_refuses() -> Bool {
-  let extra = entry_request(witness: witness_extra(), closure: "closure-extra")
-  match prepared_floor_subject_serve(
-    request: request_with(selected: [entry_a()]),
-    probes: [probe_for(entry: entry_a()), probe_for(entry: extra)],
-  ) {
-    PreparedFloorSubjectRefused {
-      cause: PreparedFloorUnexpectedProbeIdentities { unexpected: unexpected }
-    } => unexpected.count() == 1 && unexpected.first().entry == witness_extra().entry
-    _ => false
-  }
-}
-
-test fn changed_closure_changes_prepared_artifact_set_identity() -> Bool {
-  let canonical = prepared_claim_subject_identity(
-    request: request_with(selected: [entry_a()])
-  )
-  let changed = prepared_claim_subject_identity(
-    request: request_with(
-      selected: [entry_request(witness: witness_a(), closure: "changed-closure-a")]
-    )
-  )
-  canonical.artifact_set_identity.digest != changed.artifact_set_identity.digest
-}
diff --git a/dag/test/claim/gcp_estate_convergence_binding_witness_test.dag b/dag/test/claim/gcp_estate_convergence_binding_witness_test.dag
index 5df2b289de8..5a1983d50ae 100644
--- a/dag/test/claim/gcp_estate_convergence_binding_witness_test.dag
+++ b/dag/test/claim/gcp_estate_convergence_binding_witness_test.dag
@@ -1,7 +1,12 @@
 module test.claim.gcp_estate_convergence_binding
 
+import gunbc.auth.heal_publisher_provision { DedicatedFederation, standing_principal_set }
+import std.optional { Present, Absent }
 import std.types { Bool, List }
-import gunbc.auth.oidc_claim_pins { OidcClaimPin, claim_pins_admit }
+import gunbc.auth.oidc_claim_pins {
+  OidcPresentedClaim, claim_pins_admit, presented_from_pins, with_presented_value,
+  fleet_converge_development_workflow_claim_pins,
+}
 import gunbc.auth.github_gcp_federation { github_wif_principal_set }
 import gunbc.auth.gcp_iam_converge { gcp_iam_converge_targets }
 import gunbc.auth.fleet_convergence_federation {
@@ -11,38 +16,58 @@ import gunbc.auth.fleet_convergence_federation {
 import gunbc.fleet_host_key_enrollment { probe_identity_secret_access_requirement }
 import gunbc.gcp_estate_adoption { gcp_estate_desired_convergence_binding }
 
-fn dispatch_claims() -> List<OidcClaimPin> {
-  map(fleet_convergence_claim_pins(), p => p)
+fn dispatch_claims() -> List<OidcPresentedClaim> {
+  presented_from_pins(pins: fleet_convergence_claim_pins())
 }
 
-fn with_claim(claim: String, value: String) -> List<OidcClaimPin> {
-  map(fleet_convergence_claim_pins(), p => if (p.claim as String) == claim { OidcClaimPin { claim: p.claim, value: value } } else { p })
+fn with_claim(claim: String, value: String) -> List<OidcPresentedClaim> {
+  with_presented_value(claims: dispatch_claims(), claim: claim, value: value)
 }
 
-// Accepting control: the fleet-converge workflow dispatched at main is admitted.
+// Accepting control: the fleet-converge workflow dispatched on reviewed main is admitted to the
+// privileged account. A session-branch dispatch is refused there and admitted only on the
+// development pin list (not bound to this account).
 test fn the_fleet_converge_dispatch_at_main_is_admitted() -> Bool {
   claim_pins_admit(pins: fleet_convergence_claim_pins(), claims: dispatch_claims())
 }
 
-// Refusing controls: a pull request, the merge queue, a main-ref job of another workflow (heal-publish,
-// witnesses), a branch dispatch and another repository each fail a pin.
+test fn a_session_branch_dispatch_is_refused_by_the_privileged_account() -> Bool {
+  !claim_pins_admit(pins: fleet_convergence_claim_pins(), claims: with_claim("workflow_ref", "gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/heads/session/x"))
+}
+
+fn with_development_claim(claim: String, value: String) -> List<OidcPresentedClaim> {
+  with_presented_value(claims: presented_from_pins(pins: fleet_converge_development_workflow_claim_pins()), claim: claim, value: value)
+}
+
+test fn a_session_branch_dispatch_is_admitted_only_on_the_development_pins() -> Bool {
+  claim_pins_admit(pins: fleet_converge_development_workflow_claim_pins(), claims: with_development_claim("workflow_ref", "gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/heads/session/x"))
+    && !claim_pins_admit(pins: fleet_converge_development_workflow_claim_pins(), claims: with_development_claim("workflow_ref", "gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/tags/x"))
+}
+
+// Refusing controls: a pull request, the merge queue, another workflow, a tag dispatch and another
+// repository each fail a pin.
 test fn no_other_run_is_admitted() -> Bool {
   let pins = fleet_convergence_claim_pins()
   !claim_pins_admit(pins: pins, claims: with_claim("event_name", "pull_request"))
     && !claim_pins_admit(pins: pins, claims: with_claim("event_name", "merge_group"))
     && !claim_pins_admit(pins: pins, claims: with_claim("event_name", "workflow_run"))
     && !claim_pins_admit(pins: pins, claims: with_claim("workflow_ref", "gunb-ai/gunbc/.github/workflows/witnesses.yml@refs/heads/main"))
-    && !claim_pins_admit(pins: pins, claims: with_claim("workflow_ref", "gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/heads/session/x"))
-    && !claim_pins_admit(pins: pins, claims: with_claim("ref", "refs/pull/13509/merge"))
+    && !claim_pins_admit(pins: pins, claims: with_claim("workflow_ref", "gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/tags/x"))
+    && !claim_pins_admit(pins: pins, claims: with_claim("workflow_ref", "gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/pull/13509/merge"))
+    && !claim_pins_admit(pins: pins, claims: with_claim("ref", "refs/heads/feature"))
     && !claim_pins_admit(pins: pins, claims: with_claim("repository_id", "1"))
 }
 
-test fn the_condition_names_the_workflow_and_the_dispatch() -> Bool {
+test fn the_condition_names_the_reviewed_main_file_and_the_dispatch() -> Bool {
   let c = fleet_convergence_attribute_condition()
-  c.contains("assertion.workflow_ref == ") && c.contains("fleet-converge.yml@refs/heads/main") && c.contains("assertion.event_name == 'workflow_dispatch'")
+  c.contains("assertion.workflow_ref == '") && c.contains("fleet-converge.yml@refs/heads/main") && c.contains("assertion.event_name == 'workflow_dispatch'") && c.contains("assertion.ref == 'refs/heads/main'") && !c.contains("assertion.workflow_ref.startsWith(")
 }
 
 // The estate binding, the consumers' provider and the converge target all name the pinned federation,
+fn standing_set_is(f: DedicatedFederation, ps: String) -> Bool {
+  match standing_principal_set(f: f) { Present { value: v } => v == ps  Absent => false }
+}
+
 // and the repository-wide principal set is nowhere among them: no PR-reachable principal can impersonate it.
 test fn the_account_is_reached_only_through_the_pinned_pool() -> Bool {
   let b = gcp_estate_desired_convergence_binding()
@@ -51,8 +76,8 @@ test fn the_account_is_reached_only_through_the_pinned_pool() -> Bool {
     && b.member != github_wif_principal_set()
     && probe_identity_secret_access_requirement.wif_principal_set == fleet_convergence_principal_set()
     && probe_identity_secret_access_requirement.wif_provider_resource == fleet_convergence_provider_resource()
-    && f.principal_set == fleet_convergence_principal_set()
+    && standing_set_is(f: f, ps: fleet_convergence_principal_set())
     && f.attribute_condition == fleet_convergence_attribute_condition()
-    && gcp_iam_converge_targets.any(t => t.principal_set == fleet_convergence_principal_set() && t.service_account == b.account)
-    && gcp_iam_converge_targets.all(t => t.service_account != b.account || t.principal_set != github_wif_principal_set())
+    && gcp_iam_converge_targets.any(t => standing_set_is(f: t, ps: fleet_convergence_principal_set()) && t.service_account == b.account)
+    && gcp_iam_converge_targets.all(t => t.service_account != b.account || !standing_set_is(f: t, ps: github_wif_principal_set()))
 }
diff --git a/dag/test/claim/gcp_iam_converge_witness_test.dag b/dag/test/claim/gcp_iam_converge_witness_test.dag
index f6d3f3a8146..ce66bfc87d2 100644
--- a/dag/test/claim/gcp_iam_converge_witness_test.dag
+++ b/dag/test/claim/gcp_iam_converge_witness_test.dag
@@ -7,7 +7,7 @@ import std.content_hash { Sha256Digest }
 import std.optional { Present, Absent }
 import extdeps.cloud.gcp.iam { GcpPolicy, GcpBinding, GcpIamBindingCell }
 import gunbc.auth.approval_decision_store { request_revision_of }
-import gunbc.auth.heal_publisher_provision { DedicatedFederation, FederationClassification, FederationClassified, FederationUnclassified, heal_publisher_dedicated_federation, impersonation_cell }
+import gunbc.auth.heal_publisher_provision { DedicatedFederation, FederationClassification, FederationClassified, FederationUnclassified, heal_publisher_dedicated_federation, impersonation_cells, heal_publisher_impersonation_cell }
 import gunbc.auth.gcp_secret_access { SecretAccessGrant, secret_access_desired_cells }
 import extdeps.cloud.gcp.secret_ref { SecretRef }
 import extdeps.cloud.gcp.gcp { GcpProjectId }
@@ -39,7 +39,7 @@ import gunbc.auth.privileged_effect_census {
 import gunbc.auth.authorization_pattern_selection { PatternSelected, OperatorApprovedCapability }
 import gunbc.fleet_converge_workflow {
   fleet_converge_gcp_iam_request_step, fleet_converge_gcp_iam_actuate_auth_step, fleet_converge_gcp_iam_apply_step,
-  fleet_converge_gcp_iam_approved_if,
+  fleet_converge_gcp_iam_approved_if, fleet_converge_gcp_iam_converge_approved_if,
 }
 import gunbc.auth.gcp_iam_converge_run { iam_converge_token_env, gcp_iam_converge_admission }
 import gunbc.auth.approval_request_client { ApprovalPollStanding, PollApproved }
@@ -125,7 +125,7 @@ test fn a_converged_federation_plans_noop() -> Bool {
   match plan_dedicated_federation(
     f: heal,
     classification: nothing_to_create,
-    account_policy: PolicyObserved { policy: policy_of(cells: [impersonation_cell(f: heal)], etag: "a1") },
+    account_policy: PolicyObserved { policy: policy_of(cells: impersonation_cells(f: heal), etag: "a1") },
     secret_policies: heal_converged_secret_readings(),
   ) {
     GcpIamNoop { target: _ } => true
@@ -139,7 +139,7 @@ test fn an_absent_secret_refuses_the_plan() -> Bool {
   match plan_dedicated_federation(
     f: heal,
     classification: nothing_to_create,
-    account_policy: PolicyObserved { policy: policy_of(cells: [impersonation_cell(f: heal)], etag: "a1") },
+    account_policy: PolicyObserved { policy: policy_of(cells: impersonation_cells(f: heal), etag: "a1") },
     secret_policies: heal_secret_readings(reading: PolicyResourceAbsent),
   ) {
     GcpIamRefused { target: _, reasons: rs } => rs.length() > 0
@@ -188,7 +188,7 @@ fn one_effect_estate(etag: String) -> GcpIamEstateDiff {
 fn heal_account_diff(etag: String) -> GcpIamDiff {
   GcpIamDiff {
     target: "heal publisher provision",
-    effects: [AddPolicyCells { subject: ServiceAccountPolicy { email: heal.service_account }, observed_etag: etag, cells: [impersonation_cell(f: heal)] }],
+    effects: [AddPolicyCells { subject: ServiceAccountPolicy { email: heal.service_account }, observed_etag: etag, cells: impersonation_cells(f: heal) }],
   }
 }
 
@@ -241,8 +241,8 @@ fn step_env_keys(st: Step) -> List<String> {
 // auth step gated only on the mode, which would federate as iam-converge before anyone tapped.
 test fn iam_converge_is_impersonated_only_after_a_recorded_approval() -> Bool {
   step_if(st: fleet_converge_gcp_iam_actuate_auth_step()) == fleet_converge_gcp_iam_approved_if
-    && step_if(st: fleet_converge_gcp_iam_apply_step()) == fleet_converge_gcp_iam_approved_if
-    && string_contains(s: fleet_converge_gcp_iam_approved_if, pattern: "steps.gcp_iam_request.outputs.approved == 'true'")
+    && step_if(st: fleet_converge_gcp_iam_apply_step()) == fleet_converge_gcp_iam_converge_approved_if
+    && string_contains(s: fleet_converge_gcp_iam_converge_approved_if, pattern: "steps.gcp_iam_request.outputs.approved == 'true'")
     && !any(step_env_keys(st: fleet_converge_gcp_iam_request_step()), k => k == (iam_converge_token_env as String))
     && any(step_env_keys(st: fleet_converge_gcp_iam_apply_step()), k => k == (iam_converge_token_env as String))
 }
@@ -318,7 +318,7 @@ test fn the_deny_list_covers_payload_reads_and_token_minting_and_no_role_grants_
 
 data other_cell: GcpIamBindingCell = GcpIamBindingCell { role: "roles/secretmanager.secretAccessor", member: "serviceAccount:someone-else@gunbai-secrets.iam.gserviceaccount.com", condition: none }
 
-fn approved_cell() -> GcpIamBindingCell { impersonation_cell(f: heal) }
+fn approved_cell() -> GcpIamBindingCell { heal_publisher_impersonation_cell() }
 
 fn write_of(w: ApprovedPolicyWrite) -> GcpPolicy? {
   match w { WriteApprovedCells { policy: p } => Present { value: p }  ApprovedCellsRefused { reason: _ } => none }
@@ -423,13 +423,13 @@ fn in_project(g: SecretAccessGrant, project: String) -> SecretAccessGrant {
 test fn a_grant_outside_the_fleet_project_refuses_the_plan() -> Bool {
   let moved = DedicatedFederation {
     label: heal.label, pool_id: heal.pool_id, pool_display_name: heal.pool_display_name, provider_id: heal.provider_id,
-    attribute_mapping: heal.attribute_mapping, attribute_condition: heal.attribute_condition, principal_set: heal.principal_set,
+    attribute_mapping: heal.attribute_mapping, attribute_condition: heal.attribute_condition, impersonation: heal.impersonation,
     service_account: heal.service_account, service_account_id: heal.service_account_id, service_account_display_name: heal.service_account_display_name,
     service_account_member: heal.service_account_member,
     secret_grants: map(heal.secret_grants, g => in_project(g: g, project: "another-project")),
   }
   let readings = map(moved.secret_grants, g => GrantPolicyReading { grant: g, reading: PolicyObserved { policy: empty_policy(etag: "s0") } })
-  match plan_dedicated_federation(f: moved, classification: nothing_to_create, account_policy: PolicyObserved { policy: policy_of(cells: [impersonation_cell(f: heal)], etag: "a1") }, secret_policies: readings) {
+  match plan_dedicated_federation(f: moved, classification: nothing_to_create, account_policy: PolicyObserved { policy: policy_of(cells: impersonation_cells(f: heal), etag: "a1") }, secret_policies: readings) {
     GcpIamRefused { target: _, reasons: rs } => any(rs, r => string_contains(s: r, pattern: "outside the fleet project"))
     _ => false
   }
diff --git a/dag/test/claim/gcp_secret_access_witness_test.dag b/dag/test/claim/gcp_secret_access_witness_test.dag
index 2dc8f43f8f3..920821f13f5 100644
--- a/dag/test/claim/gcp_secret_access_witness_test.dag
+++ b/dag/test/claim/gcp_secret_access_witness_test.dag
@@ -28,6 +28,9 @@ import gunbc.auth.fleet_secret_accessor_roster {
   claude_code_oauth_harness_accessor_row,
   approval_capability_mac_key_accessor_row, approval_submission_mac_key_accessor_row, approval_store_receipt_mac_key_accessor_row,
   approval_ntfy_publisher_token_accessor_row,
+  cursor_api_key_harness_accessor_row, codex_auth_harness_accessor_row,
+  codex_auth_harness_version_adder_row, fleet_secret_grants, fabric_state_key_accessor_row,
+  openrouter_free_tier_key_accessor_row,
 }
 import gunbc.spark.secret_access_ensure { spark_secret_access_grant }
 import std.types { String, List }
@@ -479,7 +482,12 @@ fn roster_has_secret(row: FleetAccessorGrantRow) -> Bool {
 data named_accessor_rows: List<FleetAccessorGrantRow> = [
   spark_accessor_row, mtcollins1_bmc_accessor_row,
   approval_capability_mac_key_accessor_row, approval_submission_mac_key_accessor_row, approval_store_receipt_mac_key_accessor_row,
-  approval_ntfy_publisher_token_accessor_row, fabric_state_key_accessor_row, oracle_oci_api_signing_key_accessor_row, claude_code_oauth_harness_accessor_row,
+  approval_ntfy_publisher_token_accessor_row,
+  cursor_api_key_harness_accessor_row, codex_auth_harness_accessor_row,
+  fabric_state_key_accessor_row,
+  oracle_oci_api_signing_key_accessor_row,
+  claude_code_oauth_harness_accessor_row,
+  openrouter_free_tier_key_accessor_row,
 ]
 test fn the_roster_is_the_single_authority_for_the_spark_and_mtcollins1_grants() -> Bool {
   let bmc_cells = secret_access_desired_cells(member: convergence_member, grant: fleet_accessor_grant(row: mtcollins1_bmc_accessor_row))
@@ -617,3 +625,15 @@ test fn only_the_convergence_arms_project_to_a_successful_exit() -> Bool {
     && !exits_successfully(r: SecretAccessConvergenceClaimUnseen { observed: policy_without_grant() })
     && !exits_successfully(r: SecretAccessRefused { cause: "x" })
 }
+
+// THE CODEX WRITE-BACK GRANT IS secretVersionAdder ON codex-auth-harness AND NOTHING WIDER, and it is
+// in the list the converge folds. If the version-adder row were folded through the accessor
+// constructor, the role check below would read secretAccessor and the write-back would 403 live.
+test fn codex_write_back_grant_is_version_adder_on_its_secret_and_converged() -> Bool {
+  let adder = filter(fleet_secret_grants(), g => g.role == "roles/secretmanager.secretVersionAdder")
+  count(adder) == 1
+    && all(adder, g => (g.target.secret as String) == "codex-auth-harness")
+    && codex_auth_harness_version_adder_row.target.secret == codex_auth_harness_accessor_row.target.secret
+    && any(fleet_secret_grants(), g => g.role == "roles/secretmanager.secretAccessor" && (g.target.secret as String) == "cursor-api-key-harness")
+    && any(fleet_secret_grants(), g => g.role == "roles/secretmanager.secretAccessor" && (g.target.secret as String) == "codex-auth-harness")
+}
diff --git a/dag/test/claim/github_app_registry_witness_test.dag b/dag/test/claim/github_app_registry_witness_test.dag
index 2c6568c0a91..05114bfb083 100644
--- a/dag/test/claim/github_app_registry_witness_test.dag
+++ b/dag/test/claim/github_app_registry_witness_test.dag
@@ -34,11 +34,15 @@ import gunbc.runner.runner_jit_admission {
   jit_admission_axis_standing, AttemptBindingAxis, AxisDeferred,
 }
 import gunbc.runner_jit_mint {
-  JitSlotBinding, MicroVmSlotBinding, MicroVmJitSlot, HostUnitSlotBinding, HostUnitJitSlot, JitMintRefusedHostUnitSlot, JitMintRefusedRunnerGroupForAnotherWorkflow,
-  JitMintPlan, JitMintAuthorized, JitMintRefusedCellNotOwned, JitMintRefusedCredential,
+  JitMintRefusedSubject, JitMintRefusedRunnerGroupForAnotherWorkflow,
+  JitMintPlan, JitMintAuthorized, JitMintRefusedCredential,
   JitMintRefusedAttemptUnbound, JitMintRefusedRunnerGroupUnrestricted,
   plan_jit_mint,
 }
+import gunbc.runner.jit_registration_subject {
+  JitRegistrationSubject, JitRegistrationSubjectStanding, SubjectCellNotOwned, SubjectHostUnitSlotRefused,
+  microvm_registration_subject, host_unit_registration_subject, microvm_registration_subject_of,
+}
 import gunbc.fleet.org_actions_inspection { runner_groups_of_rest_read }
 import extdeps.transports.rest { RestResult, RestAnswered }
 import extdeps.github.org_actions { OrgRunnerGroupWire, OrgRunnerGroupListWire }
@@ -49,7 +53,7 @@ import gunbc.runner_group_restriction_observation {
 }
 import gunbc.runner.runner_jit_perform {
   JitMintDispatch, JitMintDispatchAuthorized, JitMintDispatchRefused,
-  JitDispatchRefusal, DispatchRefusedCellNotOwned, DispatchRefusedCredential,
+  JitDispatchRefusal, DispatchRefusedSubject, DispatchRefusedCredential,
   DispatchRefusedAttemptUnbound,
   JitCredentialDelivery, JitCredentialBoundToAttempt, JitCredentialNotDispatched,
   JitCredentialMintNotCreated,
@@ -66,8 +70,9 @@ import gunbc.runner_slot_desired { gunbc_runner_slot_desired }
 import extdeps.systemd.systemd_run { SystemdRunCommandReady, SystemdRunCommandRefused }
 import gunbc.runner_throughput_qualification_route { ephemeral_slot_unit, ephemeral_slot_labels, ephemeral_slot_command }
 import gunbc.runner.runner_jit_deregistration { JitRegistration, jit_registration_of, readback_subject_refusal, DeregistrationReadbackForAnotherSubject }
+import gunbc.host_control_route { bmc_controlled_host, BmcRouteNotBound }
 import gunbc.runner.runner_host_unit_slot {
-  HostUnitSlotStanding, HostUnitSlotRefused, HostUnitSlotHostNotBound, host_unit_slot_for, host_unit_slot_listener_argv,
+  HostUnitSlotStanding, HostUnitSlotBound, HostUnitSlotRefused, HostUnitSlotHostNotControlled, host_unit_slot_for, host_unit_slot_listener_argv,
 }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
@@ -1018,8 +1023,8 @@ data jit_test_slot: RunnerSlotIdentity = RunnerSlotIdentity {
 // attempt to bind, so it answers with the binding's own refusal, carrying a cause that does NOT say
 // "not owned". If this fixture's id ever stopped being an acceptable segment, the positive control
 // goes RED rather than the fixture quietly becoming a refusal the negative arms would still accept.
-fn jit_binding(owned: Bool) -> JitSlotBinding {
-  MicroVmSlotBinding {
+fn jit_binding(owned: Bool) -> JitRegistrationSubjectStanding {
+  microvm_registration_subject(
     binding: match microvm_attempt(slot: jit_test_slot, attempt_id: "w-11") {
       MicroVmAttemptAccepted { attempt: a } => bind_owned_attempt(attempt: a, owned: owned)
       MicroVmAttemptRefused { refusal: _ } =>
@@ -1027,6 +1032,17 @@ fn jit_binding(owned: Bool) -> JitSlotBinding {
           cause: "the witness fixture's attempt id was refused, so this binding is not the subject under test",
         }
     },
+  )
+}
+
+// THE SUBJECT IS THE FIXTURE ATTEMPT'S OWN: its name is the attempt's unit name, and the launch's
+// binding comparison accepts it. A refused fixture attempt answers false, never a vacuous pass.
+fn is_fixture_attempt_subject(subject: JitRegistrationSubject) -> Bool {
+  match microvm_attempt(slot: jit_test_slot, attempt_id: "w-11") {
+    MicroVmAttemptAccepted { attempt: a } =>
+      subject == microvm_registration_subject_of(attempt: a)
+        && (subject.name.value as String) == (runner_microvm_attempt_unit_name(attempt: a) as String)
+    MicroVmAttemptRefused { refusal: _ } => false
   }
 }
 
@@ -1053,7 +1069,7 @@ fn restricted_group_1() -> MicrovmRunnerGroupStanding {
 
 fn planned(owned: Bool, perms: List<GitHubAppPermission>) -> JitMintPlan {
   plan_jit_mint(
-    binding: jit_binding(owned: owned),
+    subject: jit_binding(owned: owned),
     authority: app_credential,
     control_plane: observed_grant(perms: perms),
     organization: gunbai_org_ref,
@@ -1068,7 +1084,7 @@ fn planned(owned: Bool, perms: List<GitHubAppPermission>) -> JitMintPlan {
 // runner identity for a cell this host does not own. The refusal must come from the cell.
 test fn witness_jit_mint_refuses_an_unowned_cell_even_with_a_sufficient_credential() -> Bool {
   match planned(owned: false, perms: runner_grant) {
-    JitMintRefusedCellNotOwned { cause: c } => string_contains(s: c, pattern: "not owned")
+    JitMintRefusedSubject { refusal: SubjectCellNotOwned { cause: c } } => string_contains(s: c, pattern: "not owned")
     _ => false
   }
 }
@@ -1089,13 +1105,14 @@ test fn witness_jit_mint_refuses_a_credential_missing_the_runner_permission() ->
 test fn witness_jit_mint_authorizes_an_owned_cell_with_the_runner_permission() -> Bool {
   match planned(owned: true, perms: runner_grant) {
     JitMintAuthorized {
-      slot: MicroVmJitSlot { attempt: a },
+      subject: sub,
       request: req,
     } =>
-      (req.name.value as String) == (runner_microvm_attempt_unit_name(attempt: a) as String)
+      is_fixture_attempt_subject(subject: sub)
+        && req.name == sub.name
         && runner_label_sets_equal(
              a: map(req.labels, l => l.value as String),
-             b: ["self-hosted", runner_microvm_attempt_unit_name(attempt: a) as String],
+             b: ["self-hosted", sub.name.value as String],
            )
     _ => false
   }
@@ -1108,7 +1125,7 @@ test fn witness_jit_mint_authorizes_an_owned_cell_with_the_runner_permission() -
 // only non-provenance label is the attempt's own name.
 test fn witness_jit_mint_carries_no_host_production_label() -> Bool {
   match planned(owned: true, perms: runner_grant) {
-    JitMintAuthorized { slot: _, request: req } =>
+    JitMintAuthorized { subject: _, request: req } =>
       let wire = map(req.labels, l => l.value as String)
       count(filter(wire, w => w == "srv2" || w == "gunbc-heavy" || w == "linux" || w == "arm64")) == 0
         && count(wire) == 2
@@ -1124,7 +1141,7 @@ test fn witness_jit_mint_carries_no_host_production_label() -> Bool {
 // the restricted arm.
 test fn witness_jit_mint_refuses_a_runner_group_not_observed_restricted() -> Bool {
   match plan_jit_mint(
-    binding: jit_binding(owned: true),
+    subject: jit_binding(owned: true),
     authority: app_credential,
     control_plane: observed_grant(perms: runner_grant),
     organization: gunbai_org_ref,
@@ -1138,7 +1155,7 @@ test fn witness_jit_mint_refuses_a_runner_group_not_observed_restricted() -> Boo
 
 test fn witness_jit_mint_refuses_when_attempt_binding_is_deferred() -> Bool {
   match plan_jit_mint(
-    binding: jit_binding(owned: true),
+    subject: jit_binding(owned: true),
     authority: app_credential,
     control_plane: observed_grant(perms: runner_grant),
     organization: gunbai_org_ref,
@@ -1176,7 +1193,7 @@ fn dispatched(owned: Bool, perms: List<GitHubAppPermission>) -> JitMintDispatch
   decl_ref(module_path: "test.claim.github_effect_perform_witness", decl_name: "witness_a_refused_dispatch_performs_no_mint"),
 ] {
   dispatch_jit_mint(
-    binding: jit_binding(owned: owned),
+    subject: jit_binding(owned: owned),
     authority: app_credential,
     control_plane: observed_grant(perms: perms),
     organization: gunbai_org_ref,
@@ -1208,7 +1225,7 @@ data conflicting_outcome: JitConfigMintOutcome = jit_config_mint_outcome(
 // resources. The refusal must come from the cell, and it must carry the cell's own cause.
 test fn witness_jit_dispatch_refuses_an_unowned_cell_before_naming_a_token_url() -> Bool {
   match dispatched(owned: false, perms: runner_grant) {
-    JitMintDispatchRefused { refusal: DispatchRefusedCellNotOwned { cause: c } } =>
+    JitMintDispatchRefused { refusal: DispatchRefusedSubject { refusal: SubjectCellNotOwned { cause: c } } } =>
       string_contains(s: c, pattern: "not owned")
     _ => false
   }
@@ -1232,7 +1249,7 @@ test fn witness_jit_dispatch_refuses_a_credential_missing_the_runner_permission(
 // and credential are both good here, so nothing else can produce this arm.
 test fn witness_jit_dispatch_refuses_when_the_attempt_binding_is_deferred() -> Bool {
   match dispatch_jit_mint(
-    binding: jit_binding(owned: true),
+    subject: jit_binding(owned: true),
     authority: app_credential,
     control_plane: observed_grant(perms: runner_grant),
     organization: gunbai_org_ref,
@@ -1256,10 +1273,8 @@ test fn witness_jit_dispatch_authorizes_and_names_both_steps_of_the_app_path() -
       d.installation.value == 999
         && d.app == gunbai_bot_declared
         && (d.organization.login as String) == "gunb-ai"
-        && match d.slot {
-          MicroVmJitSlot { attempt: a } => (d.request.name.value as String) == (runner_microvm_attempt_unit_name(attempt: a) as String)
-          _ => false
-        }
+        && is_fixture_attempt_subject(subject: d.subject)
+        && d.request.name == d.subject.name
     _ => false
   }
 }
@@ -1277,7 +1292,7 @@ test fn witness_a_refused_dispatch_delivers_nothing_even_from_a_minted_credentia
   )
   !jit_credential_delivered(delivery: delivery)
     && match delivery {
-      JitCredentialNotDispatched { refusal: DispatchRefusedCellNotOwned { cause: _ } } => true
+      JitCredentialNotDispatched { refusal: DispatchRefusedSubject { refusal: SubjectCellNotOwned { cause: _ } } } => true
       _ => false
     }
 }
@@ -1308,24 +1323,20 @@ test fn witness_a_minted_credential_is_bound_to_the_dispatched_attempt() -> Bool
   )
   jit_credential_delivered(delivery: delivery)
     && match delivery {
-      JitCredentialBoundToAttempt {
-        slot: a,
-        credential: c,
-        runner_id: id,
-      } =>
+      JitCredentialBoundToAttempt { bound: b } =>
         match dispatched(owned: true, perms: runner_grant) {
-          JitMintDispatchAuthorized { dispatch: d } => a == d.slot
+          JitMintDispatchAuthorized { dispatch: d } => b.dispatch.subject == d.subject && b.dispatch == d
           _ => false
         }
-          && (c.encoded as String) == "ZmFrZS1qaXQtY29uZmln"
-          && id == 4242
+          && (b.credential.encoded as String) == "ZmFrZS1qaXQtY29uZmln"
+          && b.runner_id == 4242
       _ => false
     }
 }
 
 // ── THE HOST-UNIT ARM OF THE SAME MINT ────────────────────────────────────────────────────────
 //
-// One plan over the slot sum (gunbc.runner_jit_mint JitSlotBinding), so these claims reuse the
+// One plan over the registration subject (gunbc.runner.jit_registration_subject), so these claims reuse the
 // microVM claims' credential and control-plane fixtures unchanged: a fork of the mint per binding
 // would need fixtures of its own, and that is what these claims would stop compiling on.
 data qualification_workflow: NonEmptyStr = "gunb-ai/gunbc/.github/workflows/runner-qualification.yml@refs/heads/main"
@@ -1351,12 +1362,12 @@ fn group_restricted_to(workflow: NonEmptyStr) -> MicrovmRunnerGroupStanding {
 }
 
 fn host_unit_slot(h: ManagedHost) -> HostUnitSlotStanding {
-  host_unit_slot_for(host: managed_host_binding(host: h), attempt: "q-1", workflow: qualification_workflow)
+  host_unit_slot_for(host: bmc_controlled_host(standing: managed_host_binding(host: h)), attempt: "q-1", workflow: qualification_workflow)
 }
 
 fn host_unit_planned(standing: HostUnitSlotStanding, perms: List<GitHubAppPermission>, group: MicrovmRunnerGroupStanding) -> JitMintPlan {
   plan_jit_mint(
-    binding: HostUnitSlotBinding { standing: standing },
+    subject: host_unit_registration_subject(standing: standing),
     authority: app_credential,
     control_plane: observed_grant(perms: perms),
     organization: gunbai_org_ref,
@@ -1373,15 +1384,19 @@ test fn witness_jit_mint_authorizes_a_managed_host_unit_slot_under_the_routes_ow
   let hosts = managed_hosts()
   count(hosts) > 0 && hosts |> all(h =>
     match host_unit_planned(standing: host_unit_slot(h: h), perms: runner_grant, group: group_restricted_to(workflow: qualification_workflow)) {
-      JitMintAuthorized { slot: HostUnitJitSlot { slot: u }, request: req } =>
+      JitMintAuthorized { subject: _, request: req } =>
         (req.name.value as String) == (ephemeral_slot_unit(host: h.host, attempt: "q-1") as String)
           && req.runner_group_id.value == 3
           && runner_label_sets_equal(a: map(req.labels, l => l.value as String), b: ephemeral_slot_labels(host: h.host, attempt: "q-1"))
-          && match ephemeral_slot_command(unit: u.unit, desired: gunbc_runner_slot_desired(), command_argv: host_unit_slot_listener_argv()) {
-               SystemdRunCommandReady { command: c } => u.argv == c
-               SystemdRunCommandRefused { cause: _ } => false
-             }
-          && match u.runner.arch { ActionsRunnerLinuxArm64 => true _ => false }
+          && match host_unit_slot(h: h) {
+            HostUnitSlotBound { slot: u } =>
+              match ephemeral_slot_command(unit: u.unit, desired: gunbc_runner_slot_desired(), command_argv: host_unit_slot_listener_argv()) {
+                SystemdRunCommandReady { command: c } => u.argv == c
+                SystemdRunCommandRefused { cause: _ } => false
+              }
+                && match u.runner.arch { ActionsRunnerLinuxArm64 => true _ => false }
+            HostUnitSlotRefused { refusal: _ } => false
+          }
       _ => false
     })
 }
@@ -1398,7 +1413,7 @@ test fn witness_jit_mint_refuses_a_group_restricted_to_another_workflow() -> Boo
       _ => false
     })
   let microvm_into_qualification_refused = match plan_jit_mint(
-    binding: jit_binding(owned: true),
+    subject: jit_binding(owned: true),
     authority: app_credential,
     control_plane: observed_grant(perms: runner_grant),
     organization: gunbai_org_ref,
@@ -1416,11 +1431,11 @@ test fn witness_jit_mint_refuses_a_group_restricted_to_another_workflow() -> Boo
 test fn witness_jit_mint_refuses_a_host_the_managed_host_seam_does_not_bind() -> Bool {
   let unbound = ManagedHostAccessUnobserved { endpoint: BmcControllerEndpoint { host: "fixture-bmc" } }
   match host_unit_planned(
-    standing: host_unit_slot_for(host: unbound, attempt: "q-1", workflow: qualification_workflow),
+    standing: host_unit_slot_for(host: bmc_controlled_host(standing: unbound), attempt: "q-1", workflow: qualification_workflow),
     perms: runner_grant,
     group: group_restricted_to(workflow: qualification_workflow),
   ) {
-    JitMintRefusedHostUnitSlot { refusal: HostUnitSlotHostNotBound { standing: ManagedHostAccessUnobserved { endpoint: e } } } =>
+    JitMintRefusedSubject { refusal: SubjectHostUnitSlotRefused { refusal: HostUnitSlotHostNotControlled { refusal: BmcRouteNotBound { standing: ManagedHostAccessUnobserved { endpoint: e } } } } } =>
       (e.host as String) == "fixture-bmc"
     _ => false
   }
diff --git a/dag/test/claim/github_effect_perform_witness_test.dag b/dag/test/claim/github_effect_perform_witness_test.dag
index b03664687eb..e175d7871a6 100644
--- a/dag/test/claim/github_effect_perform_witness_test.dag
+++ b/dag/test/claim/github_effect_perform_witness_test.dag
@@ -102,8 +102,8 @@ data created_body: JitConfigCreatedBody = JitConfigCreatedBody {
 test fn witness_generate_step_delivers_refuses_or_reports_ambiguity_by_what_github_answered() -> Bool {
   let d = dispatched(owned: true, perms: runner_grant)
   let delivered = match jit_mint_performance_of_generate(dispatch: d, outcome: RestAnswered { answer: created_body }) {
-    JitMintReceived { delivery: JitCredentialBoundToAttempt { slot: _, credential: c, runner_id: id } } =>
-      (c.encoded as String) == "ZmFrZS1qaXQtY29uZmln" && id == 4242
+    JitMintReceived { delivery: JitCredentialBoundToAttempt { bound: b } } =>
+      (b.credential.encoded as String) == "ZmFrZS1qaXQtY29uZmln" && b.runner_id == 4242
     _ => false
   }
   let conflicted = match jit_mint_performance_of_generate(
diff --git a/dag/test/claim/github_workflow_runs_witness_test.dag b/dag/test/claim/github_workflow_runs_witness_test.dag
index 59bba1448d2..2aa5203edd3 100644
--- a/dag/test/claim/github_workflow_runs_witness_test.dag
+++ b/dag/test/claim/github_workflow_runs_witness_test.dag
@@ -9,7 +9,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // optional fields gunbc#10966 added -- head_branch, actor, triggering_actor -- are omitted here
 // exactly as `path` already is, because this witness asks only about status and conclusion wire
 // labels and an invented login would be a fabricated observation rather than an absent one.
-data sample_run: WorkflowRun = WorkflowRun {
+data sample_run: WorkflowRun = WorkflowRun { display_title: none,
   id: 12345678
   name: "CI"
   head_sha: "abc123def456abc123def456abc123def456abc123"
diff --git a/dag/test/claim/go_module_versioning_witness_test.dag b/dag/test/claim/go_module_versioning_witness_test.dag
index e5bb25d58bb..28bf3764d57 100644
--- a/dag/test/claim/go_module_versioning_witness_test.dag
+++ b/dag/test/claim/go_module_versioning_witness_test.dag
@@ -10,8 +10,8 @@ import extdeps.languages.go.module {
   emit_host_bootstrap_toolchain,
   emit_host_min_go_language_version,
   go_major_suffix_str,
+  go_module_version_scheme,
   go_mvs_properties,
-  go_semver_compare,
   go_semver_label,
   go_semver_to_version_identity,
 }
@@ -98,47 +98,41 @@ test fn w_go_semver_to_version_identity() -> Bool {
   }) == "v1.2.3"
 }
 
-test fn w_go_semver_compare_major_less() -> Bool {
-  match go_semver_compare(
-    a: GoSemVer { major: 1, minor: 0, patch: 0, prerelease: none, build: none },
-    b: GoSemVer { major: 2, minor: 0, patch: 0, prerelease: none, build: none }
-  ) {
-    Less => true
-    Equal => false
-    Greater => false
+test fn w_go_module_version_scheme_major_less() -> Bool {
+  match go_module_version_scheme.compare(a: "v1.0.0", b: "v2.0.0") {
+    VersionCompared { ordering: o } => o == std.algebra.Less
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
   }
 }
 
-test fn w_go_semver_compare_patch_greater() -> Bool {
-  match go_semver_compare(
-    a: GoSemVer { major: 1, minor: 0, patch: 5, prerelease: none, build: none },
-    b: GoSemVer { major: 1, minor: 0, patch: 2, prerelease: none, build: none }
-  ) {
-    Less => false
-    Equal => false
-    Greater => true
+test fn w_go_module_version_scheme_patch_greater() -> Bool {
+  match go_module_version_scheme.compare(a: "v1.0.5", b: "v1.0.2") {
+    VersionCompared { ordering: o } => o == std.algebra.Greater
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
   }
 }
 
-test fn w_go_semver_compare_equal() -> Bool {
-  match go_semver_compare(
-    a: GoSemVer { major: 1, minor: 2, patch: 3, prerelease: none, build: none },
-    b: GoSemVer { major: 1, minor: 2, patch: 3, prerelease: none, build: none }
-  ) {
-    Less => false
-    Equal => true
-    Greater => false
+test fn w_go_module_version_scheme_equal() -> Bool {
+  match go_module_version_scheme.compare(a: "v1.2.3", b: "v1.2.3") {
+    VersionCompared { ordering: o } => o == std.algebra.Equal
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
   }
 }
 
-test fn w_go_semver_compare_no_pre_beats_pre() -> Bool {
-  match go_semver_compare(
-    a: GoSemVer { major: 1, minor: 0, patch: 0, prerelease: none, build: none },
-    b: GoSemVer { major: 1, minor: 0, patch: 0, prerelease: Present { value: "alpha.1" }, build: none }
-  ) {
-    Less => false
-    Equal => false
-    Greater => true
+test fn w_go_module_version_scheme_no_pre_beats_pre() -> Bool {
+  match go_module_version_scheme.compare(a: "v1.0.0", b: "v1.0.0-rc.1") {
+    VersionCompared { ordering: o } => o == std.algebra.Greater
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
+}
+
+// §11: pre-release identifiers with the same leading fields rank by their identifier sets —
+// alpha ranks BELOW beta. The deleted go-local comparator ranked ANY two pre-release versions
+// Equal; this witness failed for that documented reason before the rework.
+test fn w_go_module_version_scheme_orders_pre_release_identifiers() -> Bool {
+  match go_module_version_scheme.compare(a: "v1.0.0-alpha", b: "v1.0.0-beta") {
+    VersionCompared { ordering: o } => o == std.algebra.Less
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
   }
 }
 
@@ -150,3 +144,40 @@ test fn w_emit_host_bootstrap_toolchain() -> Bool {
   emit_host_bootstrap_toolchain == "go1.22.5"
 }
 
+
+// The scheme strips the go "v" prefix and routes through the SemVer grammar and semver_compare —
+// the ONE implementation of the cited rule — so unequal labels get the real numeric order.
+test fn w_go_module_version_scheme_orders_patch_numerically() -> Bool {
+  match go_module_version_scheme.compare(a: "v1.2.4", b: "v1.2.3") {
+    VersionCompared { ordering: o } => o == std.algebra.Greater
+    VersionComparisonRefused { side: _, identity: _, cause: _ } => false
+  }
+}
+
+// A label outside the go module grammar (no "v" prefix, or a non-SemVer remainder) is a located
+// refusal: the carrier names the failing side, the label, and the cause — never a fabricated
+// order.
+test fn w_go_module_version_scheme_refuses_unparsable_label() -> Bool {
+  match go_module_version_scheme.compare(a: "not-a-go-version", b: "v1.2.3") {
+    VersionComparisonRefused { side: side, identity: i, cause: _ } => side == LeftOperand && i == "not-a-go-version"
+    VersionCompared { ordering: _ } => false
+  }
+}
+
+// The go prefix rule is the scheme's own acceptance rule: a label WITHOUT the leading "v" is
+// outside the grammar even when the remainder is a valid SemVer version.
+test fn w_go_module_version_scheme_refuses_label_without_v_prefix() -> Bool {
+  match go_module_version_scheme.compare(a: "1.0.0", b: "v1.0.0") {
+    VersionComparisonRefused { side: side, identity: i, cause: _ } => side == LeftOperand && i == "1.0.0"
+    VersionCompared { ordering: _ } => false
+  }
+}
+
+// The go grammar is "v" + SemVer 2.0.0, so SemVer's §9 refusal carries over: a leading-zero
+// all-digit pre-release identifier refuses instead of ranking.
+test fn w_go_module_version_scheme_refuses_leading_zero_pre_release() -> Bool {
+  match go_module_version_scheme.compare(a: "v1.0.0-01", b: "v1.0.0-1") {
+    VersionComparisonRefused { side: side, identity: i, cause: _ } => side == LeftOperand && i == "v1.0.0-01"
+    VersionCompared { ordering: _ } => false
+  }
+}
diff --git a/dag/test/claim/gpu_interconnect_and_sm_cache_witness_test.dag b/dag/test/claim/gpu_interconnect_and_sm_cache_witness_test.dag
index 843859cc7e9..088f81698d8 100644
--- a/dag/test/claim/gpu_interconnect_and_sm_cache_witness_test.dag
+++ b/dag/test/claim/gpu_interconnect_and_sm_cache_witness_test.dag
@@ -45,7 +45,10 @@ test fn w_rtx_5090_sm_cache_geometry_matches_cuda_docs() -> Bool {
 test fn w_rtx_5090_sm_cache_citations_cover_both_fields() -> Bool {
   let citations = rtx_5090_sm_cache_citations
   list_length(items: citations) == 2
-    && citations.first().authority == cuda_compute_capabilities_authority
+    && match citations.first() {
+         Present { value: e } => e.authority == cuda_compute_capabilities_authority
+         Absent => false
+       }
 }
 
 test fn w_apple_m5_gpu_leaves_unified_soc_facts_unfabricated() -> Bool {
diff --git a/dag/test/claim/grounded_principal_witness_test.dag b/dag/test/claim/grounded_principal_witness_test.dag
index 05e9cfae4df..edbf30ac13c 100644
--- a/dag/test/claim/grounded_principal_witness_test.dag
+++ b/dag/test/claim/grounded_principal_witness_test.dag
@@ -57,10 +57,19 @@ test fn witness_ci_runner_sudo_grants_derive_privileged_commands() -> Bool {
   let principal = fleet_posix_ci_runner_principal()
   let grounded = grounded_principal_privileged_commands(p: principal)
   let composed = srv1_live_deploy_privileged_commands()
-  length(grounded) == 6
-    && length(composed) == 6
+  all(ci_runner_sudo_binaries, b => any(xs: grounded, predicate: fn(c) {
+    c.grant.command_path == ci_runner_sudo_binary_path(b: b)
+  }))
+    && all(grounded, c => any(xs: ci_runner_sudo_binaries, predicate: fn(b) {
+      c.grant.command_path == ci_runner_sudo_binary_path(b: b)
+    }))
+    && length(grounded) == list_length(items: ci_runner_sudo_binaries)
+    && length(composed) == length(grounded)
     && composed == grounded
-    && grounded.first().grant.command_path == deploy_access_apt_get_binary_path
+    && match grounded.first() {
+      Present { value: c } => c.grant.command_path == deploy_access_apt_get_binary_path
+      Absent => false
+    }
     && !any(grounded, c => c.grant.command_path == "/usr/bin/bash")
     && any(
       grounded,
@@ -87,7 +96,10 @@ test fn witness_gha_runner_context_is_not_os_account() -> Bool {
 }
 
 test fn witness_operator_secret_binding_uses_fleet_gcp_member() -> Bool {
-  operator_tailscale_acl_secret_bindings.first().member == fleet_operator_gcp_iam_member()
+  match operator_tailscale_acl_secret_bindings.first() {
+    Present { value: b } => b.member == fleet_operator_gcp_iam_member()
+    Absent => false
+  }
     && operator_principal_member() == fleet_operator_gcp_iam_member()
 }
 
@@ -127,17 +139,20 @@ test fn witness_operator_grounded_access_gate_permits() -> Bool {
 test fn witness_deploy_authorization_query_grounds_expected_principal() -> Bool {
   let query = deploy_access_authorization_query(access: ci_deploy_srv1_access)
   query.expected_principal == "ghrunner"
-    && query.envelope.grants.count() == 6
+    && query.envelope.grants.count() == list_length(items: ci_runner_sudo_binaries)
 }
 
 test fn witness_deploy_preflight_plan_has_whoami_plus_privileged_probes() -> Bool {
   let plan = deploy_access_preflight_plan(access: ci_deploy_srv1_access)
-  plan.steps.count() == 7
+  plan.steps.count() == 1 + list_length(items: ci_runner_sudo_binaries)
 }
 
 test fn witness_deploy_preflight_plan_first_step_reads_principal() -> Bool {
   let first = deploy_access_preflight_plan(access: ci_deploy_srv1_access).steps.first()
-  first == deploy_access_principal_probe_step()
+  match first {
+    Present { value: step } => step == deploy_access_principal_probe_step()
+    Absent => false
+  }
 }
 
 test fn witness_deploy_grant_admits_apt_get_probe() -> Bool {
diff --git a/dag/test/claim/harness_seat_witness_test.dag b/dag/test/claim/harness_seat_witness_test.dag
index 1d66928d5a6..384e6d570cb 100644
--- a/dag/test/claim/harness_seat_witness_test.dag
+++ b/dag/test/claim/harness_seat_witness_test.dag
@@ -2,7 +2,7 @@ module test.claim.harness_seat_witness
 
 import std.types { Bool, String, Int, NonEmptyStr }
 import std.measure { second_count }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 import gunbc.spark.pair_serving_desired {
   spark_pair_serving_unit, SparkPairServingUnitReady, SparkPairServingUnitRefused,
 }
@@ -58,8 +58,7 @@ fn w_engine_max_num_seqs(group: FabricGroup) -> Int {
 }
 
 test fn each_group_has_its_own_partition() -> Bool {
-  (harness_seat_partition(group: FabricGroupA, class: InteractiveQualitySensitive, ceiling: harness_interactive_quality_seats) as String) == "group-group-a-quality-seat-v1"
-    && (harness_seat_partition(group: FabricGroupB, class: InteractiveQualitySensitive, ceiling: harness_interactive_quality_seats) as String) == "group-group-b-quality-seat-v1"
+  (harness_seat_partition(group: FabricGroupB {}, class: InteractiveQualitySensitive, ceiling: harness_interactive_quality_seats) as String) == "group-group-b-quality-seat-v1"
 }
 
 // THE DISCRIMINATING ROW: THE SEAT CEILING IS NOT THE ENGINE'S SEQUENCE LIMIT.
@@ -74,23 +73,20 @@ test fn each_group_has_its_own_partition() -> Bool {
 // the engine and happened to set max_num_seqs to one. Requiring them to disagree makes any
 // re-derivation red while the engine keeps its own limit.
 test fn the_seat_ceiling_is_a_quality_policy_and_never_the_engines_sequence_limit() -> Bool {
-  w_engine_max_num_seqs(group: FabricGroupA) == 32
-    && w_engine_max_num_seqs(group: FabricGroupB) == 32
+  w_engine_max_num_seqs(group: FabricGroupB {}) == 32
     && harness_interactive_quality_seats == 1
-    && w_ceiling(group: FabricGroupA) == harness_interactive_quality_seats
-    && w_ceiling(group: FabricGroupB) == harness_interactive_quality_seats
-    && w_ceiling(group: FabricGroupA) != w_engine_max_num_seqs(group: FabricGroupA)
-    && w_ceiling(group: FabricGroupB) != w_engine_max_num_seqs(group: FabricGroupB)
+    && w_ceiling(group: FabricGroupB {}) == harness_interactive_quality_seats
+    && w_ceiling(group: FabricGroupB {}) != w_engine_max_num_seqs(group: FabricGroupB {})
 }
 
 // The interim arm SAYS declared policy in its own constructor, so no consumer can read a derived
 // capacity out of it, and the unestablished arm exists and is reachable by name.
 test fn the_interim_ceiling_names_itself_declared_policy_and_the_refusal_arm_exists() -> Bool {
-  (match harness_seat_capacity(group: FabricGroupA, class: InteractiveQualitySensitive) {
+  (match harness_seat_capacity(group: FabricGroupB {}, class: InteractiveQualitySensitive) {
      SeatCeilingByDeclaredPolicy { class: _, pool: _, seats: n } => n == harness_interactive_quality_seats
      AdmissionCeilingUnestablished { group: _, cause: _ } => false
    })
-    && (match AdmissionCeilingUnestablished { group: FabricGroupA, cause: "probe" as NonEmptyStr } {
+    && (match AdmissionCeilingUnestablished { group: FabricGroupB {}, cause: "probe" as NonEmptyStr } {
           AdmissionCeilingUnestablished { group: _, cause: c } => (c as String) == "probe"
           SeatCeilingByDeclaredPolicy { class: _, pool: _, seats: _ } => false
         })
@@ -117,10 +113,9 @@ test fn the_seat_policy_is_declared_from_the_request_deadline_and_requires_quies
 // re-read the ceiling off the engine.
 test fn the_quality_ceiling_is_one_and_is_not_a_capacity_claim() -> Bool {
   harness_interactive_quality_seats == 1
-    && w_ceiling(group: FabricGroupA) == 1
-    && w_ceiling(group: FabricGroupB) == 1
-    && w_engine_max_num_seqs(group: FabricGroupA) == 32
-    && w_ceiling(group: FabricGroupA) != w_engine_max_num_seqs(group: FabricGroupA)
+    && w_ceiling(group: FabricGroupB {}) == 1
+    && w_engine_max_num_seqs(group: FabricGroupB {}) == 32
+    && w_ceiling(group: FabricGroupB {}) != w_engine_max_num_seqs(group: FabricGroupB {})
 }
 
 // ── THE TOLERANT POOL IS A SECOND POOL, AND IT IS NOT THE ENGINE'S LIMIT EITHER ───────────────
@@ -132,7 +127,7 @@ test fn the_quality_ceiling_is_one_and_is_not_a_capacity_claim() -> Bool {
 // that quietly re-derived it from that row goes red here.
 //
 // THE TOLERANT NUMBERS ARE READ FROM THE ROW THAT OWNS THEM, NOT TRANSCRIBED. This claim used to
-// spell 4 and 1 for groups A and B; gunbc.serving.serving_enrollment serving_group_b_route_turn_ceiling
+// spelled the route ceilings per group; gunbc.serving.serving_enrollment serving_group_b_route_turn_ceiling
 // was then superseded 1 -> 4 (#11617, 2026-09-18) and the copy here went red against a legitimate
 // change while asserting nothing the copy was needed for. What the claim discriminates is the ROUTE
 // of the number: the harness pool's ceiling is the route's declared allocation (serving_route_ceiling),
@@ -141,12 +136,10 @@ test fn the_quality_ceiling_is_one_and_is_not_a_capacity_claim() -> Bool {
 // tolerant-differs-from-quality conjunct; the row moving no longer fails anything, which is the
 // point of not copying it.
 test fn the_tolerant_pool_is_a_separate_pool_whose_ceiling_is_not_the_engines_sequence_limit() -> Bool {
-  w_tolerant_ceiling(group: FabricGroupA) == w_route_ceiling(group: FabricGroupA)
-    && w_tolerant_ceiling(group: FabricGroupB) == w_route_ceiling(group: FabricGroupB)
-    && w_tolerant_ceiling(group: FabricGroupA) != w_ceiling(group: FabricGroupA)
-    && w_ceiling(group: FabricGroupA) == 1
-    && w_ceiling(group: FabricGroupB) == 1
-    && w_tolerant_ceiling(group: FabricGroupA) != w_engine_max_num_seqs(group: FabricGroupA)
+  w_tolerant_ceiling(group: FabricGroupB {}) == w_route_ceiling(group: FabricGroupB {})
+    && w_tolerant_ceiling(group: FabricGroupB {}) != w_ceiling(group: FabricGroupB {})
+    && w_ceiling(group: FabricGroupB {}) == 1
+    && w_tolerant_ceiling(group: FabricGroupB {}) != w_engine_max_num_seqs(group: FabricGroupB {})
 }
 
 // ── AN ACQUISITION REFERENCE IS UNIQUE FOR THE LIFE OF THE PARTITION ──────────────────────────
diff --git a/dag/test/claim/harness_turn_admission_witness_test.dag b/dag/test/claim/harness_turn_admission_witness_test.dag
index 0409edfcfeb..2c4d560c52b 100644
--- a/dag/test/claim/harness_turn_admission_witness_test.dag
+++ b/dag/test/claim/harness_turn_admission_witness_test.dag
@@ -4,13 +4,13 @@ import std.types { Bool, NonEmptyStr, String }
 import std.decl_ref { decl_ref }
 import std.measure { token_count, second_count }
 import std.optional { Present, Absent }
+import gunbc.fleet_host_identity { operator_host_srv9, operator_host_srv10 }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import product.fabric.provider_route { ProviderRoute }
 import product.fabric.isolation { IsolationProfile }
 import product.fabric.work { TrustDomainRef, OfferedService, MaterializedProgram }
 import product.fabric.demand { ObservationReceiptRef }
 import product.fabric.provider_admission { ProviderUseAdmitted, ProviderUseDenied, refusal_reason }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6 }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
 import gunbc.serving.serving_enrollment { ServingRouteEndpoint }
 import gunbc.serving.serving_availability { ServingFrontDoorAvailabilityVerdict, FrontDoorAnswered, serving_availability_bracketing_read }
 import gunbc.serving.turn_demand { serving_turn_work }
@@ -49,11 +49,11 @@ import product.fabric.supply { ExactGrantDuration, EstimatedGrantDuration, Unobs
 // offered launch, a matching declared unit and an observed incarnation then reach the admitted arm.
 
 fn t_launch() -> VllmEndpointProcessLaunch {
-  vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "http://10.0.0.1:8000" as NonEmptyStr, process_start_field: "1" as NonEmptyStr)
+  vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "http://10.0.0.1:8000" as NonEmptyStr, process_start_field: "1" as NonEmptyStr)
 }
 
 fn t_endpoint() -> ServingRouteEndpoint {
-  ServingRouteEndpoint { group: FabricGroupA, address: "10.0.0.1" as NonEmptyStr, port: 8000 }
+  ServingRouteEndpoint { group: FabricGroupB {}, address: "10.0.0.1" as NonEmptyStr, port: 8000 }
 }
 
 fn t_ready() -> ServingFrontDoorAvailabilityVerdict {
@@ -72,7 +72,7 @@ fn t_route() -> ProviderRoute {
   ProviderRoute {
     provider: decl_ref(module_path: "test.claim.harness_turn_admission_witness", decl_name: "t_route"),
     service: decl_ref(module_path: "gunbc.spark.serving_offer", decl_name: "spark_serving_quote"),
-    region: decl_ref(module_path: "gunbc.spark.fabric_switch_observed", decl_name: "FabricGroupA"),
+    region: decl_ref(module_path: "gunbc.spark.fabric_switch_observed", decl_name: "FabricGroupB"),
   }
 }
 
@@ -99,7 +99,7 @@ fn t_declared_path() -> String {
 
 fn t_realization() -> SparkServingRealization {
   SparkServingRealization {
-    hosts: [operator_host_srv5, operator_host_srv6],
+    hosts: [operator_host_srv9, operator_host_srv10],
     readback: ModelsRouteRead {
       readback: vllm_models_route_readback(
         served_model_id: "deepseek-v4-flash:iq3s-split" as NonEmptyStr,
@@ -130,7 +130,7 @@ fn t_empty() -> HarnessCandidates {
 test fn a_bound_offer_reaches_admission_through_bind_candidate() -> Bool {
   let subject = t_subject(prompt: "p", attempt: "a-1")
   let placed = harness_bind_candidate(
-    acc: t_empty(), group: FabricGroupA, endpoint: t_endpoint(), launch: t_launch(), availability: t_ready(),
+    acc: t_empty(), group: FabricGroupB {}, endpoint: t_endpoint(), launch: t_launch(), availability: t_ready(),
     readback: t_realization().readback, incarnation: t_realization().incarnation, route: ServingRouteObserved { route: t_route() }, subject: subject,
     model: "deepseek-v4-flash:iq3s-split" as NonEmptyStr, unit: DeepseekV4FlashOnVllm, seats: 1,
   )
@@ -138,7 +138,7 @@ test fn a_bound_offer_reaches_admission_through_bind_candidate() -> Bool {
     SparkOfferBindingRefused { group_wire: _, cause: _ } => false
     SparkOfferBound { bound: projection } =>
       match spark_first_party_admission(
-        realization: harness_serving_realization(group: FabricGroupA, launch: t_launch(), readback: t_realization().readback, incarnation: t_realization().incarnation),
+        realization: harness_serving_realization(group: FabricGroupB {}, launch: t_launch(), readback: t_realization().readback, incarnation: t_realization().incarnation),
         scope: spark_first_party_use_scope(demand: subject.demand, work: subject.work.id),
         offer: projection.offer.id,
       ) {
@@ -160,7 +160,7 @@ test fn a_bound_offer_refused_by_admission_is_not_a_candidate_and_carries_the_ca
     SparkOfferBindingRefused { group_wire: _, cause: _ } => false
     SparkOfferBound { bound: projection } => {
       let placed = harness_admit_bound_offer(
-        acc: t_empty(), group: FabricGroupA, endpoint: t_endpoint(), launch: t_launch(),
+        acc: t_empty(), group: FabricGroupB {}, endpoint: t_endpoint(), launch: t_launch(),
         realization: t_realization(), projection: projection, subject: subject,
         unit: DeepseekV4FlashOnVllm, seats: 1,
       )
diff --git a/dag/test/claim/heal_publication_workflow_witness_test.dag b/dag/test/claim/heal_publication_workflow_witness_test.dag
deleted file mode 100644
index 760ab0192fb..00000000000
--- a/dag/test/claim/heal_publication_workflow_witness_test.dag
+++ /dev/null
@@ -1,200 +0,0 @@
-module test.claim.heal_publication_workflow_witness
-
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import std.optional { Present, Absent }
-import std.types { String, NonEmptyStr, Bool, List, Int }
-import extdeps.languages.yaml.types { YamlValue, YamlKeyValue, YamlString, YamlNull, YamlBool, YamlInt, YamlFloat, YamlSequence, YamlMapping, yaml_string, yaml_bool, kv }
-import extdeps.github.actions {
-  Step, UsesStep, RunStep,
-  WorkflowPermissions, PermRead, PermWrite
-}
-import gunbc.action_use_admission { checkout_action }
-import gunbc.heal_workflow { job_permissions_carry_write }
-import gunbc.heal_publisher_workflow { checkout_step_names_another_subject, heal_publisher_only_when_repair_owed, heal_publisher_candidate_has_entries_condition }
-
-// ── WHAT THIS MODULE DELIBERATELY DOES NOT CLAIM ────────────────────────────────────────────
-
-// EVERY CLAIM ABOVE SUPPLIES ITS OWN INPUT, AND NONE OF THEM PROJECTS THE REAL WORKFLOW. That is a
-// departure from the pairing obligation in DESIGN section 3, so it is stated here rather than left
-// for a reader to notice.
-//
-// WHAT WAS TRIED. Eight claims each projected the real publisher job to read one field -- the exact
-// shape section 3 names, a claim dominated by ONE call whose result shape is all it inspects. The
-// required floor refused all eight at enrolment: 103,093 and 92,218 eval steps against a 72,300
-// budget, measured in the same run where this module's supplied-fixture claims came in at 0-15ms, so
-// the cost was the reach and not the runner. Consolidating them into ONE claim that projects once and
-// asserts every binding together made it WORSE, not better: 1,011,136 eval steps and 2,185ms, because
-// the projection is re-evaluated per traversal rather than shared across them. There is no
-// arrangement of these assertions over the real job that fits the budget.
-//
-// WHY THAT IS TOLERABLE HERE, AND IT IS A PROPERTY OF THIS SUBJECT RATHER THAN A GENERAL EXCUSE. Both
-// facts those claims asserted are walled at EMISSION, one rung above a witness: gunbc.heal_workflow
-// refuses to emit a candidate job that holds a publication credential, and
-// gunbc.heal_publisher_workflow refuses to emit at all unless heal_publication_phases_isolated()
-// holds. Those refusals execute on every regeneration, and the generated-artifact drift gate makes
-// the committed yaml equal to what the model emits. A violating workflow is therefore not merely
-// caught -- it cannot be produced. The predicates those gates consult are witnessed for
-// DISCRIMINATION, cheaply and over supplied values, in test.claim.heal_publication_boundary_witness
-// (witness_isolated_phases_are_admitted and the two violation claims beside it).
-//
-// THE RESIDUAL, NAMED HONESTLY: nothing here fails if someone DELETES the isolation check from the
-// emission gate. The predicates would still discriminate, the fixtures would still pass, and the
-// wall would be gone. That is the half of the pairing obligation this module does not discharge, and
-// no cheap claim discharges it -- the only witness that would costs an order of magnitude more than
-// the budget allows. It is recorded rather than papered over, and it is not retired by moving this
-// file or by a debt row.
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-// THE SUBJECT IS THE PREDICATE, NOT THE JOB. Each claim below hands a constructed permissions record
-// or checkout step to the predicate that classifies it, so what is established is that the predicate
-// DISCRIMINATES -- a write grant is a credential, a read grant is not, an absent grant is not a
-// restriction. Projecting the real job to read one field is what the earlier revision did and what
-// the floor refused; the closing note records why nothing here does it any more.
-
-// ── what a publication credential is, over supplied grants ──────────────────────────────────
-
-
-fn a_write_grant() -> WorkflowPermissions {
-  WorkflowPermissions {
-    contents: Present { value: PermWrite },
-    pull_requests: none,
-    issues: none,
-    actions: none,
-    id_token: none
-  }
-}
-
-fn a_read_grant() -> WorkflowPermissions {
-  WorkflowPermissions {
-    contents: Present { value: PermRead },
-    pull_requests: none,
-    issues: none,
-    actions: none,
-    id_token: none
-  }
-}
-
-fn checkout_with(rows: List<YamlKeyValue>) -> Step {
-  UsesStep {
-    name: Present { value: "Checkout" },
-    id: none,
-    uses: checkout_action,
-    with: Present { value: rows },
-    env: none,
-    if_condition: none,
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-fn step_name_of(s: Step) -> String {
-  match s {
-    RunStep { name: n, id: _, run: _, shell: _, env: _, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
-      match n { Present { value: v } => v  Absent => "" }
-    UsesStep { name: n, id: _, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
-      match n { Present { value: v } => v  Absent => "" }
-  }
-}
-
-fn yaml_scalar_text(v: YamlValue) -> String {
-  match v {
-    YamlString { value: s } => s
-    YamlNull => ""
-    YamlBool { value: _ } => ""
-    YamlInt { lexeme: _ } => ""
-    YamlFloat { lexeme: _ } => ""
-    YamlSequence { elements: _ } => ""
-    YamlMapping { entries: _ } => ""
-  }
-}
-
-fn step_with_value(step: Step, key: String) -> String {
-  match step {
-    RunStep { name: _, id: _, run: _, shell: _, env: _, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => ""
-    UsesStep { name: _, id: _, uses: _, with: w, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
-      match w {
-        Absent => ""
-        Present { value: rows } =>
-          fold(rows, init: "", f: fn(acc, row) {
-            if (row.key as String) == key { yaml_scalar_text(v: row.value) } else { acc }
-          })
-      }
-  }
-}
-
-fn step_if_condition(s: Step) -> String {
-  match s {
-    RunStep { name: _, id: _, run: _, shell: _, env: _, working_directory: _, if_condition: c, continue_on_error: _, timeout_minutes: _ } =>
-      match c { Present { value: v } => v  Absent => "" }
-    UsesStep { name: _, id: _, uses: _, with: _, env: _, if_condition: c, continue_on_error: _, timeout_minutes: _ } =>
-      match c { Present { value: v } => v  Absent => "" }
-  }
-}
-
-// THE RED FOR THE CREDENTIAL HALF. If this ever answered false, the candidate-phase check above
-// would be satisfied by a predicate that admits a write grant.
-test fn witness_a_write_grant_is_a_publication_credential() -> Bool {
-  job_permissions_carry_write(permissions: Present { value: a_write_grant() })
-    && !job_permissions_carry_write(permissions: Present { value: a_read_grant() })
-}
-
-// AN ID-TOKEN GRANT IS ALSO ONE, because it is the capability to federate to a cloud identity that
-// holds the key -- which is exactly how gunbc#10887 reached the App private key from a PR job.
-test fn witness_an_id_token_grant_is_a_publication_credential() -> Bool {
-  job_permissions_carry_write(permissions: Present { value: WorkflowPermissions {
-    contents: Present { value: PermRead },
-    pull_requests: none,
-    issues: none,
-    actions: none,
-    id_token: Present { value: PermWrite }
-  } })
-}
-
-// AN ABSENT GRANT IS TREATED AS WRITE-CAPABLE, not as none: a job that declares no permissions
-// inherits the workflow's, so silence is not a restriction.
-test fn witness_an_undeclared_grant_is_not_read_only() -> Bool {
-  job_permissions_carry_write(permissions: none)
-}
-
-// THE RED FOR THE EXECUTION HALF. A checkout naming a ref is fetching something other than this
-// workflow's own commit, and for the publisher the only thing it could name is the branch under
-// review; the control beside it is the checkout the publisher actually emits.
-test fn witness_a_checkout_naming_a_ref_is_another_subject() -> Bool {
-  checkout_step_names_another_subject(step: checkout_with(rows: [
-    kv(key: "ref", value: yaml_string(s: "${{ github.event.workflow_run.head_sha }}"))
-  ]))
-    && checkout_step_names_another_subject(step: checkout_with(rows: [
-      kv(key: "repository", value: yaml_string(s: "someone/fork"))
-    ]))
-    && !checkout_step_names_another_subject(step: checkout_with(rows: [
-      kv(key: "persist-credentials", value: yaml_bool(b: false))
-    ]))
-}
-
-// THE BUILD GATE, OVER SUPPLIED STEPS. An unconditional step gains exactly the consumers' condition,
-// and a step that already carries one keeps it AND gains the gate -- the red is an overwrite, which
-// would silently drop a guard some shared step constructor later adds.
-fn a_bare_run_step(cond: String?) -> Step {
-  RunStep {
-    name: Present { value: "build" },
-    id: none,
-    run: "cargo build",
-    shell: none,
-    env: none,
-    working_directory: none,
-    if_condition: cond,
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-test fn witness_the_publisher_build_runs_only_when_a_repair_is_owed() -> Bool {
-  let owed = heal_publisher_candidate_has_entries_condition()
-  step_if_condition(s: heal_publisher_only_when_repair_owed(step: a_bare_run_step(cond: none))) == owed
-}
-
-test fn witness_the_build_gate_composes_rather_than_overwrites() -> Bool {
-  let owed = heal_publisher_candidate_has_entries_condition()
-  let gated = step_if_condition(s: heal_publisher_only_when_repair_owed(step: a_bare_run_step(cond: Present { value: "always()" })))
-  gated == join(["(always()) && (", owed, ")"], "") && gated != owed
-}
diff --git a/dag/test/claim/heal_publisher_provision_witness_test.dag b/dag/test/claim/heal_publisher_provision_witness_test.dag
index 59b28163ca3..d4d31870ce8 100644
--- a/dag/test/claim/heal_publisher_provision_witness_test.dag
+++ b/dag/test/claim/heal_publisher_provision_witness_test.dag
@@ -281,7 +281,7 @@ test fn the_live_provider_list_decodes_its_camel_case_fields() -> Bool {
         (match p.oidc { Present { value: o } => o.issuer_uri == (github_wif_issuer_uri as String)  Absent => false })
           && (live_boot_federations() |> count) == 1
           && all(live_boot_federations(), f =>
-            (match p.attribute_condition { Present { value: c } => c == f.attribute_condition  Absent => false })
+            (match p.attribute_condition { Present { value: c } => c.contains("workflow_ref == ") && c.contains("assertion.ref == 'refs/heads/main'") && c == f.attribute_condition  Absent => false })
               && (match p.attribute_mapping { Present { value: m } => m == f.attribute_mapping  Absent => false }))
       Absent => false
     }
@@ -296,14 +296,12 @@ test fn the_live_pool_decodes_its_display_name() -> Bool {
   }
 }
 
-// THE ROUTE THE RERUN TAKES: the created pool and provider, read back off the wire, classify as
-// present and matching, so the operator's rerun adopts them and proceeds to the bindings.
-test fn the_live_mtcollins1_federation_read_back_from_the_wire_is_fully_present() -> Bool {
+// THE LIVE PROVIDER MATCHES THE DECLARED REVIEWED-MAIN PIN (operator 2026-10-10 recut).
+test fn the_live_mtcollins1_provider_matches_the_declared_main_pin() -> Bool {
   (live_boot_federations() |> count) == 1
-    && all(live_boot_federations(), f => {
-      let c = classify_dedicated_federation(f: f, pool: decoded_pool(), providers: decoded_providers(), account: AccountObserved { email: f.service_account as String })
-      classified(c: c) && federation_fully_present(c: c)
-    })
+    && all(live_boot_federations(), f => federation_fully_present(
+      c: classify_dedicated_federation(f: f, pool: decoded_pool(), providers: decoded_providers(), account: AccountObserved { email: f.service_account as String })
+    ))
 }
 
 // ── the authored name of a renamed field is RESERVED, not a second wire spelling ──────────────
diff --git a/dag/test/claim/host/controlled_host_forged_probe_witness_test.dag b/dag/test/claim/host/controlled_host_forged_probe_witness_test.dag
new file mode 100644
index 00000000000..daa228680f5
--- /dev/null
+++ b/dag/test/claim/host/controlled_host_forged_probe_witness_test.dag
@@ -0,0 +1,43 @@
+module test.claim.controlled_host_forged_probe_witness
+
+import std.types { String, Bool, Int, List }
+import extdeps.filesystem.filesystem_io
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
+import gunbc.compile_diagnostic_census {
+  CompileDiagnosticCensus, CompileDiagnosticCensusRow, CensusObserved, CensusNotRunnable,
+}
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
+
+// THE FORGED CONTROL CLAIM, ENROLLED AS AN EXECUTED RED (DESIGN §4b). test.probe.controlled_host_forged_probe
+// writes a ControlledHost outside gunbc.host_control_route; it must refuse at ControlledHost, and a
+// control source that only NAMES the module must refuse at nothing, so the refusal is attributable to
+// the forgery rather than to importing the module.
+
+fn census_of(source: String) -> CompileDiagnosticCensus {
+  compile_dag_diagnostic_census(source)
+}
+
+fn blocking(c: CompileDiagnosticCensus, wanted: String, subject: String) -> Int {
+  match c {
+    CensusNotRunnable { cause: _ } => -1
+    CensusObserved { rows: rows } =>
+      rows
+        |> filter(r => (r.diagnostic_class as String) == wanted && r.subject_name == subject && r.blocking)
+        |> fold(init: 0, f: (acc, r) => acc + r.count)
+  }
+}
+
+data control_source: String = "module probe_controlled_host_harness_control\nimport std.types { Bool }\nimport gunbc.host_control_route { HostControlStanding, HostControlled }\nfn controlled(s: HostControlStanding) -> Bool { match s { HostControlled { controlled: _ } => true _ => false } }\n"
+
+test fn a_source_that_only_names_the_module_forges_nothing() -> Bool {
+  blocking(c: census_of(source: control_source), wanted: "SoleConstructorViolation", subject: "ControlledHost") == 0
+}
+
+test fn a_forged_control_claim_refuses_at_controlled_host() -> Bool {
+  blocking(
+    c: census_of(source: filesystem_read(path: "dag/test/probe/controlled_host_forged_probe.dag").content),
+    wanted: "SoleConstructorViolation",
+    subject: "ControlledHost",
+  ) >= 1
+}
diff --git a/dag/test/claim/host/host_axis_caps_witness_test.dag b/dag/test/claim/host/host_axis_caps_witness_test.dag
index b26a4571d08..227dad89db4 100644
--- a/dag/test/claim/host/host_axis_caps_witness_test.dag
+++ b/dag/test/claim/host/host_axis_caps_witness_test.dag
@@ -1,5 +1,6 @@
 module test.claim.host_axis_caps
 
+import extdeps.systemd.systemctl { systemctl_revert_memory_caps_argv }
 import std.logic { Bool }
 import std.types { NonEmptyStr, String, List, list_length }
 import gunbc.host_axis_caps {
@@ -261,3 +262,12 @@ test fn witness_cap_upsert_script_carries_no_hand_spelled_printf_quoting() -> Bo
   !string_contains(s: cap_upsert_script(m: apostrophe_cap_member), pattern: "printf '%s' '")
     && !string_contains(s: deploy_runner_memory_cap_author_script(), pattern: "printf '%s' '")
 }
+
+// `systemctl revert` TAKES UNIT NAMES ONLY (extdeps.systemd.systemctl
+// systemctl_revert_memory_caps_argv). The earlier argv appended "MemoryMax" "MemoryHigh", which
+// systemctl read as two more units and reverted silently with exit 0 (observed, systemd 255). Every
+// token after the verb must be the unit itself.
+test fn the_revert_argv_names_only_the_unit() -> Bool {
+  join(systemctl_revert_memory_caps_argv(unit: "actions-runner@srv1-01.service"), " ")
+    == "systemctl revert actions-runner@srv1-01.service"
+}
diff --git a/dag/test/claim/host/host_control_route_witness_test.dag b/dag/test/claim/host/host_control_route_witness_test.dag
new file mode 100644
index 00000000000..8ecc6e16cb2
--- /dev/null
+++ b/dag/test/claim/host/host_control_route_witness_test.dag
@@ -0,0 +1,116 @@
+module test.claim.host_control_route_witness
+
+import std.types { Bool, Int, List, String, NonEmptyStr }
+import extdeps.cloud.hetzner_cloud_api { HetznerServerResponse, HetznerServerObserved }
+import gunbc.provider_acquisition { ProviderResourceAcquisition }
+import gunbc.hetzner_cloud_acquisition { hetzner_cax41_nbg1_1_acquisition, hetzner_cax41_hel1_1_acquisition }
+import gunbc.hetzner_cloud_server_reading { AcquiredServerRead, judge_acquired_server_read }
+import product.host_identity { HostIdentity }
+import product.supplier.hetzner { hetzner_helsinki_route }
+import extdeps.cloud.hetzner { cax41_catalog }
+import std.decl_ref { decl_ref }
+import gunbc.fleet_host_identity { operator_host_183527, operator_host_3dde7f, operator_host_srv1 }
+import gunbc.fleet_host_backing { ProviderGuest, ProviderResourceAwaited }
+import gunbc.hetzner_cloud_guest { hetzner_cloud_guest_entitlement }
+import gunbc.fleet_enrollment { HostEnrollmentIntent, enrollment_for_host, ci_runner_enrollment_participation }
+import gunbc.host_control_route {
+  HostControlStanding, HostControlled, HostControlRefused, ProviderApiControlRoute, BmcControlRoute,
+  BmcHostNotManaged, NoOutOfBandRoute, ProviderResourceNotAcquired, ProviderControlUnobserved, enrolled_host_control,
+}
+
+// THE PROVIDER'S ANSWER IS SUPPLIED AT THE API BOUNDARY and judged by the production judge
+// (gunbc.hetzner_cloud_server_reading judge_acquired_server_read), so the route below is the real one
+// from the GET's decoded body onward.
+fn read_of(acquisition: ProviderResourceAcquisition, answered_id: Int) -> AcquiredServerRead {
+  judge_acquired_server_read(
+    acquisition: acquisition,
+    id: match parse_int(s: acquisition.resource_id as String) { Present { value: i } => i  Absent => 0 },
+    read: HetznerServerObserved { server: HetznerServerResponse { id: answered_id, name: "ubuntu-32gb", status: "running" } },
+  )
+}
+
+data both_read: List<AcquiredServerRead> = [
+  read_of(acquisition: hetzner_cax41_nbg1_1_acquisition, answered_id: 169308819),
+  read_of(acquisition: hetzner_cax41_hel1_1_acquisition, answered_id: 169308796),
+]
+
+fn control_of_with(host: HostIdentity, reads: List<AcquiredServerRead>) -> HostControlStanding? {
+  match enrollment_for_host(host: host) {
+    Absent => none
+    Present { value: e } => Present { value: enrolled_host_control(intent: e, provider_reads: reads) }
+  }
+}
+
+fn control_of(host: HostIdentity) -> HostControlStanding? {
+  control_of_with(host: host, reads: both_read)
+}
+
+// INHABITANCE, ASSERTING THE ROUTE: each enrolled CAX guest, read off the production roster, is
+// controlled through the provider API under the account its acquisition names, with that account's
+// own Secret Manager credential and the guest's own server id -- so a guest can never be driven with
+// another account's token or another server's id.
+fn guest_controlled_as(host: HostIdentity, resource_id: String) -> Bool {
+  match control_of(host: host) {
+    Present { value: HostControlled { controlled: c } } =>
+      (c.host as String) == (host as String) && match c.route {
+        ProviderApiControlRoute { route: _, acquisition: a, observed: s } =>
+          (a.resource_id as String) == resource_id
+            && to_string(s.id) == resource_id
+            && (a.account.account as String) == "default"
+            && (a.account.api_credential.secret as String) == "hetzner-cloud-default-api-key"
+            && (a.account.api_credential.project as String) == "gunbai-secrets"
+        BmcControlRoute { binding: _ } => false
+      }
+    _ => false
+  }
+}
+
+test fn both_cax_guests_are_controlled_through_the_hetzner_project_account() -> Bool {
+  guest_controlled_as(host: operator_host_183527, resource_id: "169308819")
+    && guest_controlled_as(host: operator_host_3dde7f, resource_id: "169308796")
+}
+
+// RED: AN OWNED BOARD THAT gunbc.managed_host DOES NOT BIND HAS NO CONTROL ROUTE, even though it is
+// installed over its BMC. srv1 is enrolled and BMC-installed, and no managed-host row binds it today,
+// so claiming control of it would be claiming a route nobody secured.
+test fn an_owned_board_with_no_managed_host_row_is_not_controlled() -> Bool {
+  match control_of(host: operator_host_srv1) {
+    Present { value: HostControlRefused { refusal: BmcHostNotManaged { host: h } } } => (h as String) == (operator_host_srv1 as String)
+    _ => false
+  }
+}
+
+// RED: A GUEST WHOSE ACQUISITION IS NOT RECORDED IS NOT CONTROLLED, carrying its read obligation.
+test fn a_guest_without_a_recorded_acquisition_is_not_controlled() -> Bool {
+  let intent = HostEnrollmentIntent {
+    host: operator_host_3dde7f,
+    participation: ci_runner_enrollment_participation,
+    backing: ProviderGuest {
+      route: hetzner_helsinki_route(),
+      entitlement: hetzner_cloud_guest_entitlement(row: cax41_catalog, offer: decl_ref(module_path: "extdeps.cloud.hetzner", decl_name: "cax41_catalog")),
+      resource: ProviderResourceAwaited { read_obligation: "record the acquisition of ubuntu-32gb-hel1-1" },
+    },
+  }
+  match enrolled_host_control(intent: intent, provider_reads: both_read) {
+    HostControlRefused { refusal: ProviderResourceNotAcquired { host: _, read_obligation: o } } =>
+      (o as String) == "record the acquisition of ubuntu-32gb-hel1-1"
+    _ => false
+  }
+}
+
+// RED: AN ACQUISITION RECORD WITH NO PROVIDER READ IS NOT CONTROL. The acquisition says the server was
+// bought; only a read through the account's token says the route still reaches it.
+test fn a_guest_with_no_provider_read_is_not_controlled() -> Bool {
+  match control_of_with(host: operator_host_183527, reads: []) {
+    Present { value: HostControlRefused { refusal: ProviderControlUnobserved { host: _, resource_id: r, cause: _ } } } => (r as String) == "169308819"
+    _ => false
+  }
+}
+
+// RED: A READ THAT ANSWERED ABOUT ANOTHER SERVER CONTROLS NOTHING.
+test fn a_read_answering_about_another_server_is_not_control() -> Bool {
+  match control_of_with(host: operator_host_183527, reads: [read_of(acquisition: hetzner_cax41_nbg1_1_acquisition, answered_id: 169308796)]) {
+    Present { value: HostControlRefused { refusal: ProviderControlUnobserved { host: _, resource_id: _, cause: c } } } => c.contains("answered about server 169308796")
+    _ => false
+  }
+}
diff --git a/dag/test/claim/host/host_converge_slice1_witness_test.dag b/dag/test/claim/host/host_converge_slice1_witness_test.dag
index 17cc49144c5..93f8a111df5 100644
--- a/dag/test/claim/host/host_converge_slice1_witness_test.dag
+++ b/dag/test/claim/host/host_converge_slice1_witness_test.dag
@@ -149,8 +149,8 @@ test fn witness_enumerate_units_uses_typed_list_units_op() -> Bool {
   match systemctl_list_units_active_services(instance_glob: "actions-runner@srv3-*.service" as NonEmptyStr) {
     Present { value: units } =>
       length(units) == 2
-        && units.first() == "actions-runner@srv3-01.service" as NonEmptyStr
-        && units.skip(n: 1).first() == "actions-runner@srv3-02.service" as NonEmptyStr
+        && (match units.first() { Present { value: u } => u == "actions-runner@srv3-01.service" as NonEmptyStr  Absent => false })
+        && (match units.skip(n: 1).first() { Present { value: u } => u == "actions-runner@srv3-02.service" as NonEmptyStr  Absent => false })
     Absent => false
   }
 }
diff --git a/dag/test/claim/host/host_memory_qualification_witness_test.dag b/dag/test/claim/host/host_memory_qualification_witness_test.dag
index 41bf61794e3..2e7870b6340 100644
--- a/dag/test/claim/host/host_memory_qualification_witness_test.dag
+++ b/dag/test/claim/host/host_memory_qualification_witness_test.dag
@@ -1,15 +1,9 @@
 module test.claim.host_memory_qualification_witness_test
 
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
 import std.types { Bool, List, NonEmptyStr }
-import extdeps.boards.types {
-  AsrockRackAltrad8ud1l2t,
-  AmpereMtCollins,
-  DimmPopulation,
-  PopulationSupported,
-  PopulationUnsupported,
-  admit_population,
-}
-import extdeps.boards.asrock_rack { asrock_altrad8ud_documented_dimm_populations }
+import extdeps.boards.types { DimmPopulation, PopulationSupported, PopulationUnsupported, admit_population }
+import extdeps.boards.asrock_rack { asrock_altrad8ud_documented_dimm_populations, asrock_altrad8ud_board_authority }
 import extdeps.vendor.samsung { samsung }
 import extdeps.memory.types {
   DramModuleCatalogRow,
@@ -201,7 +195,7 @@ test fn a_duplicated_candidate_slot_is_refused() -> Bool {
 // is exactly why the defect was latent and why the guard must not depend on
 // that staying true.
 data duplicated_documented_population: DimmPopulation = DimmPopulation {
-  board: AsrockRackAltrad8ud1l2t,
+  board: asrock_altrad8ud_board_authority,
   slots: ["A1", "A1"],
   authority: ampere_altra_avl_authority,
 }
@@ -289,7 +283,7 @@ data observed_failures: List<PlatformTrainingFailure> = [altrad8ud_mrep_failure_
 // The same failure at DECODED standing. Only the evidence differs, which is
 // what makes the severity comparison below discriminating.
 data decoded_failure: PlatformTrainingFailure = PlatformTrainingFailure {
-  board: AsrockRackAltrad8ud1l2t,
+  board: asrock_altrad8ud_board_authority,
   step: LrdimmDataBufferMrep,
   standing: DecodedFromPlatformSyndrome { register: "B5" },
   observed_population: ["A1"],
@@ -298,7 +292,7 @@ data decoded_failure: PlatformTrainingFailure = PlatformTrainingFailure {
 
 // The same failure with NO evidence behind it.
 data unobserved_failure: PlatformTrainingFailure = PlatformTrainingFailure {
-  board: AsrockRackAltrad8ud1l2t,
+  board: asrock_altrad8ud_board_authority,
   step: LrdimmDataBufferMrep,
   standing: EvidenceUnobserved,
   observed_population: ["A1"],
@@ -315,7 +309,7 @@ test fn an_association_requires_a_sample_rather_than_refusing() -> Bool {
   match part_implication(
     candidate: lrdimm_32g,
     failures: observed_failures,
-    target_board: AsrockRackAltrad8ud1l2t,
+    target_board: asrock_altrad8ud_board_authority,
   ) {
     PartSampleQualificationRequired { step: _, standing: _ } => true
     PartImplicatedByFailingStep { step: _, standing: _ } => false
@@ -331,7 +325,7 @@ test fn a_decoded_syndrome_does_refuse() -> Bool {
   match part_implication(
     candidate: lrdimm_32g,
     failures: [decoded_failure],
-    target_board: AsrockRackAltrad8ud1l2t,
+    target_board: asrock_altrad8ud_board_authority,
   ) {
     PartImplicatedByFailingStep { step: _, standing: _ } => true
     _ => false
@@ -343,7 +337,7 @@ test fn an_unobserved_standing_names_the_missing_step() -> Bool {
   match part_implication(
     candidate: lrdimm_32g,
     failures: [unobserved_failure],
-    target_board: AsrockRackAltrad8ud1l2t,
+    target_board: asrock_altrad8ud_board_authority,
   ) {
     PartEvidenceUnresolved { step: s } => s == LrdimmDataBufferMrep
     _ => false
@@ -356,7 +350,7 @@ test fn registered_module_is_untouched_even_by_a_decoded_failure() -> Bool {
   match part_implication(
     candidate: rdimm_32g,
     failures: [decoded_failure],
-    target_board: AsrockRackAltrad8ud1l2t,
+    target_board: asrock_altrad8ud_board_authority,
   ) {
     PartNotImplicated => true
     _ => false
@@ -374,7 +368,7 @@ test fn unobserved_evidence_never_establishes_purchasing_compatibility() -> Bool
   match compatibility_of(implication: part_implication(
     candidate: lrdimm_32g,
     failures: [unobserved_failure],
-    target_board: AsrockRackAltrad8ud1l2t,
+    target_board: asrock_altrad8ud_board_authority,
   )) {
     CompatibilityEstablished => false
     _ => true
@@ -385,7 +379,7 @@ test fn unobserved_evidence_names_a_purchasing_obligation() -> Bool {
   match compatibility_of(implication: part_implication(
     candidate: lrdimm_32g,
     failures: [unobserved_failure],
-    target_board: AsrockRackAltrad8ud1l2t,
+    target_board: asrock_altrad8ud_board_authority,
   )) {
     CompatibilityEvidenceUnread { obligation: o } =>
       o == "observe platform training evidence for LRDIMM data-buffer read-phase calibration (MREP)"
@@ -397,7 +391,7 @@ test fn empty_failure_screen_does_not_establish_compatibility() -> Bool {
   match compatibility_of(implication: part_implication(
     candidate: lrdimm_32g,
     failures: [],
-    target_board: AsrockRackAltrad8ud1l2t,
+    target_board: asrock_altrad8ud_board_authority,
   )) {
     CompatibilityEvidenceUnread { obligation: _ } => true
     _ => false
@@ -408,7 +402,7 @@ test fn inapplicable_unobserved_step_does_not_establish_compatibility() -> Bool
   match compatibility_of(implication: part_implication(
     candidate: rdimm_32g,
     failures: [unobserved_failure],
-    target_board: AsrockRackAltrad8ud1l2t,
+    target_board: asrock_altrad8ud_board_authority,
   )) {
     CompatibilityEvidenceUnread { obligation: _ } => true
     _ => false
@@ -419,12 +413,12 @@ test fn unresolved_evidence_does_not_hide_a_counterexample_in_either_order() ->
   let before = compatibility_of(implication: part_implication(
     candidate: lrdimm_32g,
     failures: [unobserved_failure, decoded_failure],
-    target_board: AsrockRackAltrad8ud1l2t,
+    target_board: asrock_altrad8ud_board_authority,
   ))
   let after = compatibility_of(implication: part_implication(
     candidate: lrdimm_32g,
     failures: [decoded_failure, unobserved_failure],
-    target_board: AsrockRackAltrad8ud1l2t,
+    target_board: asrock_altrad8ud_board_authority,
   ))
   match before {
     CompatibilityRefutedForPlatform { reason: r } => match after {
@@ -437,7 +431,7 @@ test fn unresolved_evidence_does_not_hide_a_counterexample_in_either_order() ->
 
 test fn an_unrelated_failure_cannot_erase_the_missing_step() -> Bool {
   let unrelated = PlatformTrainingFailure {
-    board: AmpereMtCollins,
+    board: mt_collins_board_authority,
     step: LrdimmDataBufferMrep,
     standing: DecodedFromPlatformSyndrome { register: "B5" },
     observed_population: ["A1"],
@@ -446,7 +440,7 @@ test fn an_unrelated_failure_cannot_erase_the_missing_step() -> Bool {
   match part_implication(
     candidate: lrdimm_32g,
     failures: [unobserved_failure, unrelated],
-    target_board: AsrockRackAltrad8ud1l2t,
+    target_board: asrock_altrad8ud_board_authority,
   ) {
     PartEvidenceUnresolved { step: s } => s == LrdimmDataBufferMrep
     _ => false
diff --git a/dag/test/claim/host/host_phase_status_witness_test.dag b/dag/test/claim/host/host_phase_status_witness_test.dag
index 18aa31375da..8f8b26fd2ea 100644
--- a/dag/test/claim/host/host_phase_status_witness_test.dag
+++ b/dag/test/claim/host/host_phase_status_witness_test.dag
@@ -2,25 +2,33 @@ module test.claim.host_phase_status
 
 import gunbc.host_standup { PhaseDisposition }
 import v2.std.live_tree { LiveTreeDisposition }
-import gunbc.host_assimilation_program { HostEnrollmentIntent }
 import std.upsert_decision { Conflict, Inaccessible, UnknownRefused }
 import gunbc.srv3_os_install_diagnostic { srv3_install_hang_no_router_lease_ms }
 import gunbc.fleet_reach_endpoint { fleet_reach_probe_targets }
 import gunbc.host_assimilation_program {
+  assimilation_program_for,
+  fleet_participation_canonical_roster,
+  fleet_participation_in_canonical_roster,
+  program_step_count,
+  step_in_program,
+  step_serves_participation,
+}
+import gunbc.fleet_host_backing { OwnedMachine, BmcVirtualMediaInstall, ApplianceFirstBoot }
+import gunbc.fleet_host_identity { operator_host_183527 }
+import gunbc.fleet_enrollment {
+  enrollment_for_host,
+  fleet_enrollments,
   CiRunnerParticipation,
   HostEnrollmentIntent,
   InferenceServingParticipation,
-  assimilation_program_for,
+  ci_runner_and_session_enrollment_participation,
   ci_runner_enrollment_participation,
-  fleet_participation_in_canonical_roster,
   inference_serving_enrollment_participation,
-  program_step_count,
-  step_serves_participation,
 }
+import gunbc.host_reach_identity_probe { host_reach_identity_probe_receipt_for }
 import gunbc.host_phase_status {
   HostPhaseCell,
   HostPhaseCellStatus,
-  fleet_subsumption_enrollments,
   fleet_subsumption_hosts,
   host_fleet_phase_matrix,
   host_phase_cell_has_live_producer,
@@ -38,6 +46,7 @@ import gunbc.host_phase_status {
   host_phase_verdict_gate_accepts,
   observation_verdict_eq,
 }
+import gunbc.fleet_enrollment { fleet_enrollments }
 import gunbc.host_standup {
   DeclaredGap,
   ModeledCompose,
@@ -246,31 +255,42 @@ test fn witness_reconcile_covers_upsert_teardown_and_noop() -> Bool {
 // equality over a rectangle: it could not distinguish a correct matrix from one that gave every
 // host every step, and DESIGN.md §5 rules that completeness is an identity join, not a count.
 test fn witness_matrix_is_exact_join_over_participation_programs() -> Bool {
-  let matrix = host_fleet_phase_matrix(enrollments: fleet_subsumption_enrollments)
+  let matrix = host_fleet_phase_matrix(enrollments: fleet_enrollments)
   let matched = filter(
-    fleet_subsumption_enrollments,
+    fleet_enrollments,
     e => {
       let owed = program_step_count(program: assimilation_program_for(intent: e))
       let got = filter(matrix, c => c.cell.host == e.host).length()
       got == owed
     },
   )
-  matched.length() == fleet_subsumption_enrollments.length()
+  matched.length() == fleet_enrollments.length()
 }
 
 // Re-derived DELIBERATELY on the join-4 flip (run 31300640122): the executed fleet reach
 // probe landed a receipt row for all six targets, and each row feeds BOTH P0 deduction
 // cells — so the frontier is the authored srv3 cell plus 2 cells per probed host,
 // DERIVED from the probe target roster rather than pinned as a tree-copied literal.
+// The probed targets are the roster members a committed probe receipt exists for: an enrolled host
+// that has never been probed -- the CAX guests at enrollment -- is a target with no receipt, and its
+// P0 cells are honestly uncovered rather than counted.
+fn probed_target_count() -> Int {
+  filter(fleet_reach_probe_targets, t => match host_reach_identity_probe_receipt_for(host: t as HostIdentity) {
+    Present { value: _ } => true
+    Absent => false
+  }).length()
+}
+
 test fn witness_live_observation_frontier_is_one_cell() -> Bool {
-  host_phase_observation_coverage_count(enrollments: fleet_subsumption_enrollments) == 1 + 2 * fleet_reach_probe_targets.length()
+  host_phase_observation_coverage_count(enrollments: fleet_enrollments) == 1 + 2 * probed_target_count()
+    && probed_target_count() < fleet_reach_probe_targets.length()
 }
 
 // Cross-check between two independent producers over the same cells rather than a rectangle: the
 // counter walks the enrollments, the join filters the derived matrix by disposition. A rectangle
 // assertion here would go green even if the gap steps landed on the wrong hosts.
 test fn witness_unmodeled_cells_track_spine_gaps() -> Bool {
-  let matrix = host_fleet_phase_matrix(enrollments: fleet_subsumption_enrollments)
+  let matrix = host_fleet_phase_matrix(enrollments: fleet_enrollments)
   let gap_cells = filter(
     matrix,
     c => match c.disposition {
@@ -278,7 +298,7 @@ test fn witness_unmodeled_cells_track_spine_gaps() -> Bool {
       ModeledCompose { authorities: _ } => false
     },
   )
-  host_phase_unmodeled_count(enrollments: fleet_subsumption_enrollments) == gap_cells.length()
+  host_phase_unmodeled_count(enrollments: fleet_enrollments) == gap_cells.length()
 }
 
 // Remaining work is the reconcile's own upsert count, and it must equal every cell that is not
@@ -288,9 +308,9 @@ test fn witness_unmodeled_cells_track_spine_gaps() -> Bool {
 // count and the lane would look one item closer to done than it is.
 
 test fn witness_remaining_work_counts_every_unfinished_cell() -> Bool {
-  let remaining = host_phase_remaining_work_count(enrollments: fleet_subsumption_enrollments)
-  let total = host_fleet_phase_matrix(enrollments: fleet_subsumption_enrollments).length()
-  let finished = host_phase_finished_cell_count(enrollments: fleet_subsumption_enrollments)
+  let remaining = host_phase_remaining_work_count(enrollments: fleet_enrollments)
+  let total = host_fleet_phase_matrix(enrollments: fleet_enrollments).length()
+  let finished = host_phase_finished_cell_count(enrollments: fleet_enrollments)
   remaining == total - finished
 }
 
@@ -304,11 +324,13 @@ test fn witness_remaining_work_counts_every_unfinished_cell() -> Bool {
 data synthetic_inference_enrollment: HostEnrollmentIntent = HostEnrollmentIntent {
   host: operator_host_srv3,
   participation: inference_serving_enrollment_participation,
+  backing: OwnedMachine { provisioning: ApplianceFirstBoot },
 }
 
 data synthetic_ci_enrollment: HostEnrollmentIntent = HostEnrollmentIntent {
   host: operator_host_srv3,
   participation: ci_runner_enrollment_participation,
+  backing: OwnedMachine { provisioning: BmcVirtualMediaInstall },
 }
 
 fn cell_label_is_runner_only(c: HostPhaseCellStatus) -> Bool {
@@ -321,9 +343,33 @@ fn cell_label_is_shared(c: HostPhaseCellStatus) -> Bool {
   l == "P0:host-identity-converge" || l == "P0:reach-secrets-network" || l == "P2:compute-fabric-enroll" || l == "P5:assimilation-complete-gate"
 }
 
+// Every step but the provider-guest adoption: what an owned, BMC-installed host owes when it carries
+// every participation an Altra runner has. Derived from the spine rather than counted, so adding a
+// phase moves it without editing the claims below.
+fn step_is_guest_adoption(s: HostStandupStep) -> Bool {
+  match s.phase {
+    Prefix { phase: ProviderGuestAdopted } => true
+    Prefix { phase: _ } => false
+    Assimilation { phase: _ } => false
+  }
+}
+
+fn owned_bmc_full_program_length() -> Int {
+  filter(host_standup_spine, s => !step_is_guest_adoption(s: s)).length()
+}
+
+// The whole provisioning-plus-roles program is owed by a host that both runs CI and hosts interactive sessions -- srv1-srv4's
+// enrollment -- and a CI-ONLY host owes exactly one step fewer: session placement, which belongs to
+// the session participation since sessions stopped being assumed of every CI host.
 test fn witness_ci_program_selects_the_whole_spine() -> Bool {
-  let selected = program_step_count(program: assimilation_program_for(intent: synthetic_ci_enrollment))
-  selected == host_standup_spine.length()
+  let both = HostEnrollmentIntent {
+    host: synthetic_ci_enrollment.host,
+    participation: ci_runner_and_session_enrollment_participation,
+    backing: OwnedMachine { provisioning: BmcVirtualMediaInstall },
+  }
+  let ci_only = program_step_count(program: assimilation_program_for(intent: synthetic_ci_enrollment))
+  program_step_count(program: assimilation_program_for(intent: both)) == owned_bmc_full_program_length()
+    && ci_only == owned_bmc_full_program_length() - 1
 }
 
 test fn witness_inference_program_is_strictly_smaller_than_the_spine() -> Bool {
@@ -334,16 +380,19 @@ test fn witness_inference_program_is_strictly_smaller_than_the_spine() -> Bool {
 data synthetic_reordered_enrollment: HostEnrollmentIntent = HostEnrollmentIntent {
   host: operator_host_srv3,
   participation: [InferenceServingParticipation, CiRunnerParticipation],
+  backing: OwnedMachine { provisioning: BmcVirtualMediaInstall },
 }
 
 data synthetic_forward_order_enrollment: HostEnrollmentIntent = HostEnrollmentIntent {
   host: operator_host_srv3,
   participation: [CiRunnerParticipation, InferenceServingParticipation],
+  backing: OwnedMachine { provisioning: BmcVirtualMediaInstall },
 }
 
 data synthetic_duplicated_enrollment: HostEnrollmentIntent = HostEnrollmentIntent {
   host: operator_host_srv3,
   participation: [CiRunnerParticipation, CiRunnerParticipation, InferenceServingParticipation],
+  backing: OwnedMachine { provisioning: BmcVirtualMediaInstall },
 }
 
 // Participation is a set wearing a list's carrier, so the three enrollments below must be one
@@ -419,32 +468,55 @@ test fn witness_inference_enrollment_keeps_the_shared_obligations() -> Bool {
 }
 
 test fn witness_every_spine_step_is_claimed_by_some_participation() -> Bool {
-  let unclaimed = filter(host_standup_spine, s => !step_serves_participation(step: s, wanted: CiRunnerParticipation) && !step_serves_participation(step: s, wanted: InferenceServingParticipation))
+  let unclaimed = filter(host_standup_spine, s => !any(fleet_enrollments, e => step_in_program(step: s, intent: e)))
   unclaimed.length() == 0
 }
 
+// A RENTED GUEST OWES ITS ADOPTION AND ITS ROLES, AND NO BMC OR INSTALL STEP. The CAX guest's program
+// is exactly the adoption prefix plus the assimilation steps its CI participation selects; that it
+// contains no BMC or virtual-media step is the false-obligation defect this refactor removes, read
+// off the real production enrollment rather than a fixture.
+test fn witness_provider_guest_owes_adoption_not_bmc_provisioning() -> Bool {
+  match enrollment_for_host(host: operator_host_183527) {
+    Absent => false
+    Present { value: e } => {
+      let steps = assimilation_program_for(intent: e).steps
+      let prefix = filter(steps, s => match s.phase {
+        Prefix { phase: _ } => true
+        Assimilation { phase: _ } => false
+      })
+      let ci_roles = filter(host_standup_spine, s => match s.phase {
+        Prefix { phase: _ } => false
+        Assimilation { phase: _ } => step_serves_participation(step: s, wanted: CiRunnerParticipation)
+      })
+      prefix.length() == 1
+        && any(prefix, s => step_is_guest_adoption(s: s))
+        && steps.length() == 1 + ci_roles.length()
+    }
+  }
+}
 // The runner control the scope requires: enrolling the Sparks must not change what a CI-runner
 // enrollment owes. Each runner enrollment still contributes exactly its own program, and that
 // program is still the whole spine — asserted per enrollment, so it stays true no matter how many
 // non-runner hosts join the roster.
 test fn witness_program_scoping_preserves_the_runner_fleet_matrix() -> Bool {
-  let matrix = host_fleet_phase_matrix(enrollments: fleet_subsumption_enrollments)
+  let matrix = host_fleet_phase_matrix(enrollments: fleet_enrollments)
   let runners = filter(
-    fleet_subsumption_enrollments,
+    fleet_enrollments,
     e => {
       let owed = program_step_count(program: assimilation_program_for(intent: e))
-      owed == host_standup_spine.length()
+      owed == owned_bmc_full_program_length()
     },
   )
   let intact = filter(
     runners,
-    e => filter(matrix, c => c.cell.host == e.host).length() == host_standup_spine.length(),
+    e => filter(matrix, c => c.cell.host == e.host).length() == owned_bmc_full_program_length(),
   )
   runners.length() == 4 && intact.length() == runners.length()
 }
 
 test fn witness_fleet_matrix_has_no_duplicated_cells() -> Bool {
-  let matrix = host_fleet_phase_matrix(enrollments: fleet_subsumption_enrollments)
+  let matrix = host_fleet_phase_matrix(enrollments: fleet_enrollments)
   let duplicated = filter(
     matrix,
     c => filter(matrix, d => host_phase_cell_key(c: d) == host_phase_cell_key(c: c)).length() > 1,
@@ -453,7 +525,7 @@ test fn witness_fleet_matrix_has_no_duplicated_cells() -> Bool {
 }
 
 test fn witness_matrix_hosts_are_exactly_the_enrolled_roster() -> Bool {
-  let matrix = host_fleet_phase_matrix(enrollments: fleet_subsumption_enrollments)
+  let matrix = host_fleet_phase_matrix(enrollments: fleet_enrollments)
   let covered = filter(
     fleet_subsumption_hosts,
     h => filter(matrix, c => c.cell.host == h).length() > 0,
@@ -465,70 +537,12 @@ test fn witness_matrix_hosts_are_exactly_the_enrolled_roster() -> Bool {
   covered.length() == fleet_subsumption_hosts.length() && stray.length() == 0
 }
 
-// The Spark enrollment itself, stated at the grain it is actually known: srv5 and srv6 are
-// ENROLLED as InferenceServingParticipation, which selects exactly four shared obligations and no
-// runner-only one. Enrolled is not converged — every one of these eight cells is honestly
-// unobserved, and nothing here claims identity convergence, reach, compute enrolment, or serving.
-test fn witness_enrolled_sparks_carry_exactly_the_shared_obligations() -> Bool {
-  let matrix = host_fleet_phase_matrix(enrollments: fleet_subsumption_enrollments)
-  let sparks = filter(
-    matrix,
-    c => c.cell.host == operator_host_srv5 || c.cell.host == operator_host_srv6,
-  )
-  let shared = filter(sparks, c => cell_label_is_shared(c: c))
-  let runner_only = filter(sparks, c => cell_label_is_runner_only(c: c))
-  sparks.length() == 8 && shared.length() == 8 && runner_only.length() == 0
-}
-
-// The unobserved half of the same claim, kept separate so a future producer landing on a Spark
-// cell reds this witness instead of silently upgrading the sentence above.
-// Re-derived on the join-4 flip: the executed probe observed BOTH P0 cells on each
-// Spark at the modeled endpoint (ProbeHostKeyUnenrolled -> Inaccessible — observed,
-// NOT satisfied), and every non-P0 Spark cell stays unobserved. The witness now pins
-// that exact split so a producer landing on any further Spark cell still reds here.
-test fn witness_enrolled_spark_cells_are_all_unobserved() -> Bool {
-  let matrix = host_fleet_phase_matrix(enrollments: fleet_subsumption_enrollments)
-  let sparks = filter(
-    matrix,
-    c => c.cell.host == operator_host_srv5 || c.cell.host == operator_host_srv6,
-  )
-  let observed = filter(
-    sparks,
-    c => match c.observation {
-      Present { value: _ } => true
-      Absent => false
-    },
-  )
-  let observed_p0 = filter(
-    observed,
-    c => (c.cell.phase_label == "P0:reach-secrets-network" || c.cell.phase_label == "P0:host-identity-converge")
-      && match c.observation {
-        Present { value: v } => v == Inaccessible
-        Absent => false
-      },
-  )
-  observed.length() == 4 && observed_p0.length() == 4
-}
-
 // Non-vacuity guard for the gap join above: if the spine carried no DeclaredGap step at all, that
 // witness would compare zero against zero and pass while proving nothing.
 test fn witness_spine_actually_carries_gap_phases() -> Bool {
   host_standup_gap_phase_count() > 0
 }
 
-// Positive control for the Spark witness above: cell_label_is_runner_only must actually match
-// something, or "the Sparks carry no runner-only obligation" is satisfied by a predicate that
-// matches nothing. The runner hosts are where those obligations live.
-test fn witness_runner_only_obligations_exist_on_runner_hosts() -> Bool {
-  let matrix = host_fleet_phase_matrix(enrollments: fleet_subsumption_enrollments)
-  let runner_only = filter(matrix, c => cell_label_is_runner_only(c: c))
-  let on_sparks = filter(
-    runner_only,
-    c => c.cell.host == operator_host_srv5 || c.cell.host == operator_host_srv6,
-  )
-  runner_only.length() > 0 && on_sparks.length() == 0
-}
-
 // THE SIBLING OF THE NOTE ABOVE, and the one the frontier does not yet catch. That note forbids
 // evidence manufactured by the ACT OF LOOKING; this pair catches evidence manufactured by
 // AUTHORING. host_phase_observation_coverage_count is designated by the frontier note as the number
@@ -543,7 +557,7 @@ test fn witness_runner_only_obligations_exist_on_runner_hosts() -> Bool {
 // verdict by execution' -- which is why the defect is worth an executing control rather than a
 // correction in prose: the rule was already written down and was not enforceable, and no lens or
 // witness would have reddened if a second host were wired in the same way. That is the exact move
-// Spark collector-fact enrollment would have made for srv5 and srv6, which is how this was found.
+// Spark collector-fact enrollment would have made for the Spark hosts, which is how this was found.
 
 // THE DISCRIMINATING CONTROL. Both lease tables are authored data constants, and the verdict is a
 // pure function of WHICH ONE is wired into the frontier: the pre-install table (BMC row only)
@@ -586,7 +600,7 @@ test fn witness_covered_cell_verdict_is_selected_by_authorship_alone() -> Bool {
 // -- including when a genuinely executed producer is wired, which is the outcome this lane wants.
 test fn witness_every_covered_cell_today_is_the_authored_one() -> Bool {
   let covered = filter(
-    host_fleet_phase_matrix(enrollments: fleet_subsumption_enrollments),
+    host_fleet_phase_matrix(enrollments: fleet_enrollments),
     c => host_phase_cell_has_live_producer(c: c),
   )
   let authored = filter(
@@ -597,9 +611,9 @@ test fn witness_every_covered_cell_today_is_the_authored_one() -> Bool {
     covered,
     c => c.cell.phase_label == "P0:reach-secrets-network" || c.cell.phase_label == "P0:host-identity-converge",
   )
-  let metric = host_phase_observation_coverage_count(enrollments: fleet_subsumption_enrollments)
+  let metric = host_phase_observation_coverage_count(enrollments: fleet_enrollments)
   metric == covered.length()
     && covered.length() == authored.length() + probe_deduced.length()
     && authored.length() == 1
-    && probe_deduced.length() == 2 * fleet_reach_probe_targets.length()
+    && probe_deduced.length() == 2 * probed_target_count()
 }
diff --git a/dag/test/claim/host/host_reach_identity_probe_witness_test.dag b/dag/test/claim/host/host_reach_identity_probe_witness_test.dag
index 0fb2db896e5..4e5dcc37207 100644
--- a/dag/test/claim/host/host_reach_identity_probe_witness_test.dag
+++ b/dag/test/claim/host/host_reach_identity_probe_witness_test.dag
@@ -2,16 +2,16 @@ module test.claim.host_reach_identity_probe_witness
 
 import gunbc.network_identity_subsumption { srv3_post_install_lease_table_fixture }
 import gunbc.srv3_os_install_diagnostic { srv3_install_hang_no_router_lease_ms }
+import extdeps.tools.id { id_user_name_argv }
+import extdeps.tools.hostname { hostname_read_argv }
 import std.types { Bool, String, NonEmptyStr, List }
 import std.upsert_decision { ObservationVerdict, Converged, Drifted, Conflict, Inaccessible, UnknownRefused }
 import product.host_identity { HostIdentity }
-import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv3, operator_host_srv5 }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv3, operator_host_srv9, operator_host_183527 }
 import gunbc.fleet_reach_endpoint { fleet_probe_endpoint_for, spark_endpoint_for_binding }
 import gunbc.spark.dgx_procurement {
   DgxSparkRouterBinding,
   SlotUnassigned,
-  srv5_router_binding,
-  srv6_router_binding,
 }
 import gunbc.host_reach_identity_probe {
   ReachProbeOutcome,
@@ -33,16 +33,16 @@ import gunbc.host_reach_identity_probe {
 }
 import gunbc.host_phase_status {
   observe_host_phase,
-  fleet_subsumption_enrollments,
   host_phase_observation_coverage_count,
 }
-import gunbc.host_assimilation_program { HostEnrollmentIntent }
+import gunbc.fleet_enrollment { fleet_enrollments }
+import gunbc.fleet_enrollment { HostEnrollmentIntent }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
 fn fixture_subject() -> HostEnrollmentIntent? {
-  fleet_subsumption_enrollments.first()
+  fleet_enrollments.first()
 }
 
 // The four wire classes land in four distinct outcome arms, fail-closed: an
@@ -93,7 +93,7 @@ test fn reach_projection_covers_all_arms() -> Bool {
 // say (Inaccessible); a host-key mismatch is Conflict — the machine answering may not be
 // the enrolled host, so its hostname must never launder into an identity observation.
 test fn identity_projection_discriminates_match_drift_and_wrong_machine() -> Bool {
-  let desired = host_identity_desired_short_hostname(host: operator_host_srv1)
+  let desired = "srv1"
   identity_verdict_from_outcome(host: operator_host_srv1, requested_principal: "gunbc-fleet", o: ProbeReachable { observed_short_hostname: desired, observed_principal: "gunbc-fleet" }) == Converged
     && identity_verdict_from_outcome(host: operator_host_srv1, requested_principal: "gunbc-fleet", o: ProbeReachable { observed_short_hostname: "altrad8ud-1l2t-1", observed_principal: "gunbc-fleet" }) == std.upsert_decision.Drifted
     && identity_verdict_from_outcome(host: operator_host_srv1, requested_principal: "gunbc-fleet", o: ProbeReachable { observed_short_hostname: desired, observed_principal: "root" }) == std.upsert_decision.Drifted
@@ -133,7 +133,7 @@ test fn committed_probe_receipts_feed_producers_and_grow_coverage() -> Bool {
           Present { value: _ } => false
           _ => true
         }
-        && host_phase_observation_coverage_count(enrollments: fleet_subsumption_enrollments) > 1
+        && host_phase_observation_coverage_count(enrollments: fleet_enrollments) > 1
     }
   }
 }
@@ -172,7 +172,7 @@ test fn one_receipt_feeds_both_cells() -> Bool {
     host: operator_host_srv1,
     probed_at: "witness-fixture" as NonEmptyStr,
     requested_principal: "gunbc-fleet",
-    outcome: ProbeReachable { observed_short_hostname: host_identity_desired_short_hostname(host: operator_host_srv1), observed_principal: "gunbc-fleet" },
+    outcome: ProbeReachable { observed_short_hostname: "srv1", observed_principal: "gunbc-fleet" },
   }
   reach_verdict_from_outcome(o: r.outcome) == Converged
     && identity_verdict_from_outcome(host: r.host, requested_principal: r.requested_principal, o: r.outcome) == Converged
@@ -198,18 +198,18 @@ test fn mismatch_expectation_threads_without_fabrication() -> Bool {
       ProbeHostKeyUnenrolled { transport_diagnostic: _ } => true
       _ => false
     }
-    && match classify_reach_probe_wire_with_expectation(success: true, stdout: "srv5\n", stderr: "", expected_fingerprint: Present { value: "SHA256:abc" }) {
-      ProbeReachable { observed_short_hostname: h, observed_principal: _ } => h == "srv5"
+    && match classify_reach_probe_wire_with_expectation(success: true, stdout: "srv9\n", stderr: "", expected_fingerprint: Present { value: "SHA256:abc" }) {
+      ProbeReachable { observed_short_hostname: h, observed_principal: _ } => h == "srv9"
       _ => false
     }
 }
 
 // Endpoint resolution (msg_1c4e0bce): the Sparks' probe target is the MODELED
-// reservation address — 'srv5'/'srv6' are not published names anywhere — while
+// reservation address — 'srv9'/'srv10' are not published names anywhere — while
 // name-resolvable hosts pass through unchanged. Identity stays the receipt key.
 test fn spark_probe_targets_are_modeled_addresses_not_names() -> Bool {
-  fleet_probe_endpoint_for(host: "srv5") == "192.168.1.226"
-    && fleet_probe_endpoint_for(host: "srv6") == "192.168.1.225"
+  fleet_probe_endpoint_for(host: "srv9") == "srv9"
+    && fleet_probe_endpoint_for(host: "srv10") == "srv10"
     && fleet_probe_endpoint_for(host: "srv1") == "srv1"
 }
 
@@ -218,7 +218,7 @@ test fn spark_probe_targets_are_modeled_addresses_not_names() -> Bool {
 // guard being quiet — SlotUnassigned is a constructible variant a third unit lands in before its
 // allocation is decided, and it is reachable from this projection's denominator, which is any
 // binding at all.
-data fixture_undecided_spark_slot: DgxSparkRouterBinding = SlotUnassigned { identity: operator_host_srv5 }
+data fixture_undecided_spark_slot: DgxSparkRouterBinding = SlotUnassigned { identity: operator_host_srv9 }
 
 fn spark_endpoint_or_empty(binding: DgxSparkRouterBinding) -> String {
   match spark_endpoint_for_binding(binding: binding) {
@@ -248,6 +248,36 @@ test fn undecided_spark_slot_projects_no_endpoint() -> Bool {
 // the executing evidence that the two entry points have not forked again (§4b meta-obligation 4 —
 // a climb deletes the redundant production machinery, never the evidence).
 test fn probe_endpoint_agrees_with_the_projection_it_consumes() -> Bool {
-  fleet_probe_endpoint_for(host: "srv5") == spark_endpoint_or_empty(binding: srv5_router_binding)
-    && fleet_probe_endpoint_for(host: "srv6") == spark_endpoint_or_empty(binding: srv6_router_binding)
+  fleet_probe_endpoint_for(host: "srv9") == "srv9"
+    && fleet_probe_endpoint_for(host: "srv10") == "srv10"
+}
+
+// IDENTITY, ALLOCATED NAME AND KERNEL HOSTNAME ALL DIFFER, and the verdict reads the allocation.
+// host-183527 was allocated "damien"; the guest boots answering to the provider's display name. That
+// observation is Drifted -- the thing hostname convergence corrects -- and "damien" is Converged,
+// while the identity's own spelling is NOT what the host is expected to answer to.
+test fn identity_verdict_reads_the_allocated_name_not_the_identity_spelling() -> Bool {
+  let as_provider_named = identity_verdict_from_outcome(host: operator_host_183527, requested_principal: "gunbc-fleet", o: ProbeReachable { observed_short_hostname: "ubuntu-32gb-nbg1-1", observed_principal: "gunbc-fleet" })
+  let as_allocated = identity_verdict_from_outcome(host: operator_host_183527, requested_principal: "gunbc-fleet", o: ProbeReachable { observed_short_hostname: "damien", observed_principal: "gunbc-fleet" })
+  let as_identity = identity_verdict_from_outcome(host: operator_host_183527, requested_principal: "gunbc-fleet", o: ProbeReachable { observed_short_hostname: "host-183527", observed_principal: "gunbc-fleet" })
+  as_provider_named == std.upsert_decision.Drifted && as_allocated == Converged && as_identity == std.upsert_decision.Drifted
+}
+
+// A slot with no allocated hostname cannot be judged on a hostname at all.
+test fn unallocated_host_identity_verdict_refuses() -> Bool {
+  identity_verdict_from_outcome(host: "srv9" as HostIdentity, requested_principal: "gunbc-fleet", o: ProbeReachable { observed_short_hostname: "srv9", observed_principal: "gunbc-fleet" }) == UnknownRefused
+}
+
+// THE HANDBACK CONTROL FOR THE HAND-ARGV DISSOLUTION (roadmap shell-dag-host-reach-identity-probe).
+// probe_ready_target_once and probe_reachable_with_principal no longer spell their argv by hand:
+// they call hostname_read_argv() and id_user_name_argv() respectively, so the probe's argv IS the
+// builder's argv. This test pins each builder's MATERIALIZED argv to the exact words the probe has
+// always executed, so the flags cannot drift out from under the builder: a mutant that swaps
+// id_user_name_argv to ["id","-u"] (the numeric uid), drops -n, or hands hostname_read_argv a -s
+// (first label) instead of the full configured name typechecks and reds here. The -s decision the
+// row's first_slice names resolves to the BARE read: the probe compares its output for exact
+// equality against the enrolled short slot label, and -s would re-derive a label the probe must
+// instead read as the host reports it.
+test fn the_probe_argv_is_spelled_by_its_tool_module_builders() -> Bool {
+  id_user_name_argv() == ["id", "-un"] && hostname_read_argv() == ["hostname"]
 }
diff --git a/dag/test/claim/host/host_standup_spine_witness_test.dag b/dag/test/claim/host/host_standup_spine_witness_test.dag
index 10016eb1911..dc2c0527272 100644
--- a/dag/test/claim/host/host_standup_spine_witness_test.dag
+++ b/dag/test/claim/host/host_standup_spine_witness_test.dag
@@ -7,10 +7,12 @@ import gunbc.bmc_onboarding { FactoryCredentialActive, RotatedCredentialActive }
 import gunbc.ci_fleet { fleet_intent_offers, srv3_offer }
 import gunbc.host_assimilation_program {
   assimilation_completion_inputs_for,
-  both_participation_enrollment_participation,
-  ci_runner_enrollment_participation,
   host_standup_default_assimilation_gate_unsatisfied,
   host_standup_p3_fail_closed_blocks_complete,
+}
+import gunbc.fleet_enrollment {
+  both_participation_enrollment_participation,
+  ci_runner_enrollment_participation,
   inference_serving_enrollment_participation,
 }
 import gunbc.host_converge { ConvergePolicyDerived, ConvergePolicyUnsound }
@@ -54,6 +56,7 @@ import gunbc.host_standup {
   srv3_host_standup_target,
   srv3_install_mechanism_refuses_rather_than_falling_back,
 }
+import gunbc.host_standup { ProviderGuestAdopted }
 import gunbc.host_standup_assimilation_deduction { srv3_post_install_actuation_verdict }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 
@@ -65,16 +68,17 @@ fn spine_step_tag(step: HostStandupStep) -> Int {
     Prefix { phase: BmcCredentialConverge } => 0
     Prefix { phase: OsInstallMechanismResolved } => 1
     Prefix { phase: OsInstallActuated } => 2
-    Prefix { phase: HostConvergePolicyDerived } => 3
-    Assimilation { phase: HostIdentityConverge } => 4
-    Assimilation { phase: ReachSecretsNetwork } => 5
-    Assimilation { phase: RunnerDeploySlot } => 6
-    Assimilation { phase: BuildCacheProvision } => 7
-    Assimilation { phase: CodexRuntimeProvision } => 8
-    Assimilation { phase: ComputeFabricEnroll } => 9
-    Assimilation { phase: GreenPlaceReadiness } => 10
-    Assimilation { phase: SessionPlacementEnrollment } => 11
-    Assimilation { phase: StandupAssimilationComplete } => 12
+    Prefix { phase: ProviderGuestAdopted } => 3
+    Prefix { phase: HostConvergePolicyDerived } => 4
+    Assimilation { phase: HostIdentityConverge } => 5
+    Assimilation { phase: ReachSecretsNetwork } => 6
+    Assimilation { phase: RunnerDeploySlot } => 7
+    Assimilation { phase: BuildCacheProvision } => 8
+    Assimilation { phase: CodexRuntimeProvision } => 9
+    Assimilation { phase: ComputeFabricEnroll } => 10
+    Assimilation { phase: GreenPlaceReadiness } => 11
+    Assimilation { phase: SessionPlacementEnrollment } => 12
+    Assimilation { phase: StandupAssimilationComplete } => 13
   }
 }
 
@@ -94,10 +98,10 @@ fn spine_tags_are_linear() -> Bool {
   ).ok
 }
 
-test fn host_standup_spine_is_thirteen_step_linear_prefix_then_p0_p5() -> Bool {
-  host_standup_spine_length() == 13
+test fn host_standup_spine_is_fourteen_step_linear_prefix_then_p0_p5() -> Bool {
+  host_standup_spine_length() == 14
     && spine_tags_are_linear()
-    && host_standup_gap_ledger.length() == 13
+    && host_standup_gap_ledger.length() == 14
 }
 
 test fn p1c_codex_runtime_provision_spine_row_landed() -> Bool {
diff --git a/dag/test/claim/host/managed_host_admission_forged_probe_witness_test.dag b/dag/test/claim/host/managed_host_admission_forged_probe_witness_test.dag
new file mode 100644
index 00000000000..e1b985b8e24
--- /dev/null
+++ b/dag/test/claim/host/managed_host_admission_forged_probe_witness_test.dag
@@ -0,0 +1,52 @@
+module test.claim.managed_host_admission_forged_probe_witness
+
+import v2.std.algebra { filter }
+import std.types { String, Bool, Int, List }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import gunbc.compile_diagnostic_census { CompileDiagnosticCensus, CensusObserved, CensusNotRunnable }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+data forged_probe_source: String = "module probe_managed_host_admission_forged\n\nimport std.types { NonEmptyStr }\nimport gunbc.fleet_host_identity { operator_host_mtcollins1 }\nimport gunbc.managed_host {\n  AdmissionHoldMissing, ManagedHostAdmission, ManagedHostAdmissionReceipt, ManagedHostMembership,\n  OrdinaryMember, managed_host_admission, managed_host_admission_receipt, ordinary_member, member_under_declared_drop,\n}\nimport gunbc.machine_intake_mtcollins1_access_observation { mtcollins1_access_standing, mtcollins1_capability_row }\nimport gunbc.machine_intake_mtcollins1_bmc_secure_observation { mtcollins1_bmc_secure_standing, mtcollins1_intake_subject }\nimport gunbc.machine_intake_mtcollins1_smpro_observation { mtcollins1_smpro_site }\nimport std.decl_ref { decl_ref }\n\nfn forged_receipt() -> ManagedHostAdmissionReceipt {\n  ManagedHostAdmissionReceipt { host: operator_host_mtcollins1, access_host: \"x\" as NonEmptyStr, secure_attempt: \"a\" as gunbc.machine_intake_subject.IntakeAttemptId }\n}\n\nfn forged_receipt_through_mint() -> ManagedHostAdmissionReceipt {\n  managed_host_admission_receipt(host: operator_host_mtcollins1, access_host: \"x\" as NonEmptyStr, secure_attempt: \"a\" as gunbc.machine_intake_subject.IntakeAttemptId)\n}\n\nfn forged_admission() -> ManagedHostAdmission {\n  match mtcollins1_bmc_secure_standing() {\n    Absent => forged_admission()\n    Present { value: secure } =>\n      match mtcollins1_intake_subject() {\n        Absent => forged_admission()\n        Present { value: subject } =>\n          ManagedHostAdmission {\n            host: operator_host_mtcollins1,\n            subject: subject,\n            access: mtcollins1_access_standing,\n            capability_row: mtcollins1_capability_row,\n            secure: secure,\n            hold: AdmissionHoldMissing,\n            smpro: mtcollins1_smpro_site(),\n            receipt: forged_receipt(),\n            current_subject: none,\n            covering_drop: none,\n          }\n      }\n  }\n}\n\nfn forged_admission_through_mint() -> ManagedHostAdmission {\n  match mtcollins1_bmc_secure_standing() {\n    Absent => forged_admission_through_mint()\n    Present { value: secure } =>\n      match mtcollins1_intake_subject() {\n        Absent => forged_admission_through_mint()\n        Present { value: subject } =>\n          managed_host_admission(\n            host: operator_host_mtcollins1,\n            subject: subject,\n            access: mtcollins1_access_standing,\n            capability_row: mtcollins1_capability_row,\n            secure: secure,\n            hold: AdmissionHoldMissing,\n            smpro: mtcollins1_smpro_site(),\n            receipt: forged_receipt_through_mint(),\n            current_subject: none,\n            covering_drop: none,\n          )\n      }\n  }\n}\n"
+
+data harness_control_source: String = "module probe_managed_host_admission_harness_control\nimport std.types { List }\nimport gunbc.managed_host { ManagedHost, managed_hosts }\nfn rows() -> List<ManagedHost> { managed_hosts() }\n"
+
+fn probe() -> CompileDiagnosticCensus {
+  compile_dag_diagnostic_census(forged_probe_source)
+}
+
+fn blocking_count_for_class_and_subject(c: CompileDiagnosticCensus, wanted: String, subject: String) -> Int {
+  match c {
+    CensusNotRunnable { cause: _ } => -1
+    CensusObserved { rows: rows } =>
+      rows
+        |> filter(r => (r.diagnostic_class as String) == wanted && r.subject_name == subject && r.blocking)
+        |> fold(init: 0, f: (acc, r) => acc + r.count)
+  }
+}
+
+fn blocking_count_for_class(c: CompileDiagnosticCensus, wanted: String) -> Int {
+  match c {
+    CensusNotRunnable { cause: _ } => -1
+    CensusObserved { rows: rows } =>
+      rows |> filter(r => (r.diagnostic_class as String) == wanted && r.blocking) |> fold(init: 0, f: (acc, r) => acc + r.count)
+  }
+}
+
+test fn the_harness_runs_and_a_clean_source_emits_neither_wall_class() -> Bool {
+  let c = compile_dag_diagnostic_census(harness_control_source)
+  blocking_count_for_class(c: c, wanted: "SoleConstructorViolation") == 0
+    && blocking_count_for_class(c: c, wanted: "ConstructorCallAdmissionRefused") == 0
+}
+
+test fn each_forged_admission_carrier_is_refused_at_its_literal() -> Bool {
+  let c = probe()
+  blocking_count_for_class_and_subject(c: c, wanted: "SoleConstructorViolation", subject: "ManagedHostAdmission") >= 1
+    && blocking_count_for_class_and_subject(c: c, wanted: "SoleConstructorViolation", subject: "ManagedHostAdmissionReceipt") >= 1
+}
+
+test fn the_admission_mints_refuse_an_outside_caller() -> Bool {
+  let c = probe()
+  blocking_count_for_class_and_subject(c: c, wanted: "ConstructorCallAdmissionRefused", subject: "managed_host_admission") >= 1
+    && blocking_count_for_class_and_subject(c: c, wanted: "ConstructorCallAdmissionRefused", subject: "managed_host_admission_receipt") >= 1
+}
diff --git a/dag/test/claim/host/managed_host_admission_witness_test.dag b/dag/test/claim/host/managed_host_admission_witness_test.dag
new file mode 100644
index 00000000000..2b2d3523332
--- /dev/null
+++ b/dag/test/claim/host/managed_host_admission_witness_test.dag
@@ -0,0 +1,281 @@
+module test.claim.managed_host_admission_witness
+
+import std.types { Bool, List, NonEmptyStr, String }
+import std.content_hash { content_hash_equal }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import gunbc.fleet_host_identity { operator_host_mtcollins1, operator_host_srv1 }
+import gunbc.hostname_allocation { gunbc_fleet_hostname_allocations }
+import gunbc.rung_drop {
+  AuthoredProse,
+  RungDrop,
+  Standing,
+  TypedDeclaration,
+}
+import gunbc.rung_drop.mtcollins1_bmc_secure_standing_predates_reflash {
+  mtcollins1_bmc_secure_standing_predates_reflash,
+}
+import gunbc.managed_host {
+  AdmissionHoldDecided,
+  AdmissionHoldMissing,
+  MemberUnderDeclaredDrop,
+  OrdinaryMember,
+  drop_is_standing_citation,
+  managed_host_admission,
+  managed_host_admission_receipt,
+  managed_host_binding_for,
+  managed_host_memberships,
+  managed_hosts,
+  managed_hosts_projected,
+  managed_membership_for,
+  mtcollins1_bmc_secure_standing_drop_ref,
+  mtcollins1_managed_host_admission,
+  project_managed_host_admission,
+  ManagedHostNotManaged,
+  ManagedHostFound,
+  ManagedHostFoundUnderDeclaredDrop,
+}
+import gunbc.machine_intake_mtcollins1_managed_host_admission { mtcollins1_current_intake_subject }
+import gunbc.host_reset_subject_roster {
+  ResetRosterHostUnderDeclaredDrop, OrdinaryResetRosterHost, reset_subject_roster, reset_subject_roster_of,
+}
+import gunbc.auth.managed_host_boot_federation {
+  boot_federation_for, BootFederationProvisioned, BootFederationProvisionedUnderDeclaredDrop, BootFederationUnprovisioned,
+}
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+test fn w_mtcollins1_membership_is_under_the_declared_drop() -> Bool {
+  let rows = managed_host_memberships()
+  count(rows) == 1
+    && rows |> all(m => match m {
+      OrdinaryMember { host: _ } => false
+      MemberUnderDeclaredDrop { drop: d, standing_subject: standing, current_subject: current, host: h } =>
+        (d.decl_name as String) == (mtcollins1_bmc_secure_standing_drop_ref.decl_name as String)
+          && (h.host as String) == (operator_host_mtcollins1 as String)
+          && (standing.subject.unit_key as NonEmptyStr) == (current.subject.unit_key as NonEmptyStr)
+          && content_hash_equal(left: standing.subject.firmware_manifest_digest, right: current.subject.firmware_manifest_digest) == false
+    })
+    && count(managed_hosts()) == 1
+}
+
+test fn w_reset_roster_and_boot_federation_match_the_declared_drop_arm() -> Bool {
+  match managed_membership_for(host: operator_host_mtcollins1) {
+    Absent => false
+    Present { value: m } =>
+      match m {
+        OrdinaryMember { host: _ } => false
+        MemberUnderDeclaredDrop { drop: d, standing_subject: _, current_subject: _, host: h } =>
+          (d.decl_name as String) == (mtcollins1_bmc_secure_standing_drop_ref.decl_name as String)
+            && (h.host as String) == (operator_host_mtcollins1 as String)
+            && count(reset_subject_roster()) == 1
+            && reset_subject_roster() |> all(e => match e {
+              OrdinaryResetRosterHost { host: _ } => false
+              ResetRosterHostUnderDeclaredDrop { host: rh, drop: rd } =>
+                (rh as String) == (operator_host_mtcollins1 as String)
+                  && (rd.decl_name as String) == (d.decl_name as String)
+            })
+            && match boot_federation_for(host: h.host) {
+              BootFederationProvisioned { federation: _ } => false
+              BootFederationProvisionedUnderDeclaredDrop { federation: _, drop: fd, standing_subject: _, current_subject: _ } =>
+                (fd.decl_name as String) == (d.decl_name as String)
+              BootFederationUnprovisioned { host: _, cause: _ } => false
+            }
+      }
+  }
+}
+
+test fn w_a_record_whose_subject_is_current_is_an_ordinary_member() -> Bool {
+  match mtcollins1_managed_host_admission() {
+    Absent => false
+    Present { value: r } =>
+      match project_managed_host_admission(
+        record: r,
+        current_subject: Present { value: r.subject },
+        drops: [mtcollins1_bmc_secure_standing_predates_reflash],
+        allocations: gunbc_fleet_hostname_allocations,
+      ) {
+        Absent => false
+        Present { value: m } => match m {
+          OrdinaryMember { host: h } => (h.host as String) == (operator_host_mtcollins1 as String)
+          MemberUnderDeclaredDrop { drop: _, standing_subject: _, current_subject: _, host: _ } => false
+        }
+      }
+  }
+}
+
+test fn w_a_superseded_subject_with_no_declared_drop_is_absent() -> Bool {
+  match mtcollins1_managed_host_admission() {
+    Absent => false
+    Present { value: r } =>
+      match project_managed_host_admission(
+        record: r,
+        current_subject: mtcollins1_current_intake_subject(),
+        drops: [],
+        allocations: gunbc_fleet_hostname_allocations,
+      ) {
+        Absent => true
+        Present { value: _ } => false
+      }
+  }
+}
+
+test fn w_without_the_drop_mtcollins1_is_absent_and_reset_roster_empties() -> Bool {
+  match mtcollins1_managed_host_admission() {
+    Absent => false
+    Present { value: r } => {
+      let hosts = managed_hosts_projected(
+        records: [r],
+        drops: [],
+        allocations: gunbc_fleet_hostname_allocations,
+      )
+      count(hosts) == 0 && count(reset_subject_roster_of(hosts: hosts)) == 0
+    }
+  }
+}
+
+test fn w_a_missing_hold_decision_is_absent() -> Bool {
+  match mtcollins1_managed_host_admission() {
+    Absent => false
+    Present { value: r } =>
+      match project_managed_host_admission(
+        record: managed_host_admission(
+          host: r.host,
+          subject: r.subject,
+          access: r.access,
+          capability_row: r.capability_row,
+          secure: r.secure,
+          hold: AdmissionHoldMissing,
+          smpro: r.smpro,
+          receipt: r.receipt,
+          current_subject: r.current_subject,
+          covering_drop: r.covering_drop,
+        ),
+        current_subject: Present { value: r.subject },
+        drops: [mtcollins1_bmc_secure_standing_predates_reflash],
+        allocations: gunbc_fleet_hostname_allocations,
+      ) {
+        Absent => true
+        Present { value: _ } => false
+      }
+  }
+}
+
+test fn w_a_missing_host_allocation_is_absent() -> Bool {
+  match mtcollins1_managed_host_admission() {
+    Absent => false
+    Present { value: r } =>
+      match project_managed_host_admission(
+        record: r,
+        current_subject: Present { value: r.subject },
+        drops: [mtcollins1_bmc_secure_standing_predates_reflash],
+        allocations: [],
+      ) {
+        Absent => true
+        Present { value: _ } => false
+      }
+  }
+}
+
+test fn w_a_receipt_for_another_host_is_absent() -> Bool {
+  match mtcollins1_managed_host_admission() {
+    Absent => false
+    Present { value: r } =>
+      match project_managed_host_admission(
+        record: managed_host_admission(
+          host: r.host,
+          subject: r.subject,
+          access: r.access,
+          capability_row: r.capability_row,
+          secure: r.secure,
+          hold: r.hold,
+          smpro: r.smpro,
+          receipt: managed_host_admission_receipt(
+            host: operator_host_srv1,
+            access_host: r.receipt.access_host,
+            secure_attempt: r.receipt.secure_attempt,
+          ),
+          current_subject: r.current_subject,
+          covering_drop: r.covering_drop,
+        ),
+        current_subject: Present { value: r.subject },
+        drops: [mtcollins1_bmc_secure_standing_predates_reflash],
+        allocations: gunbc_fleet_hostname_allocations,
+      ) {
+        Absent => true
+        Present { value: _ } => false
+      }
+  }
+}
+
+test fn w_mtjade1_has_no_record_and_is_not_managed() -> Bool {
+  match managed_host_binding_for(host: "mtjade1" as NonEmptyStr) {
+    ManagedHostNotManaged { host: h } => (h as String) == "mtjade1" && count(managed_hosts()) == 1
+    ManagedHostFound { standing: _ } => false
+    ManagedHostFoundUnderDeclaredDrop { standing: _, drop: _, standing_subject: _, current_subject: _ } => false
+  }
+}
+
+fn drop_with_identity_and_population(identity: NonEmptyStr, population: List<String>) -> RungDrop {
+  let base = mtcollins1_bmc_secure_standing_predates_reflash
+  match base.declaration {
+    AuthoredProse { legacy: _, authored: _ } => base
+    TypedDeclaration { previous: p, temporary: t, reason: r, population: _, restoration_trigger: rt } =>
+      RungDrop {
+        identity: identity,
+        subject: base.subject,
+        declared: base.declared,
+        standing: Standing,
+        declaration: TypedDeclaration {
+          previous: p,
+          temporary: t,
+          reason: r,
+          population: population,
+          restoration_trigger: rt,
+        },
+      }
+  }
+}
+
+test fn w_covering_is_cited_drop_identity_not_population_prose() -> Bool {
+  drop_is_standing_citation(drop: mtcollins1_bmc_secure_standing_predates_reflash, cited: mtcollins1_bmc_secure_standing_drop_ref)
+    && drop_is_standing_citation(
+      drop: drop_with_identity_and_population(
+        identity: mtcollins1_bmc_secure_standing_predates_reflash.identity,
+        population: ["no host token in this sentence"],
+      ),
+      cited: mtcollins1_bmc_secure_standing_drop_ref,
+    )
+    && drop_is_standing_citation(
+      drop: drop_with_identity_and_population(
+        identity: "some_other_drop" as NonEmptyStr,
+        population: ["mtcollins1 is named here so a substring search would have matched"],
+      ),
+      cited: mtcollins1_bmc_secure_standing_drop_ref,
+    ) == false
+}
+
+test fn w_a_matching_drop_whose_population_does_not_name_the_host_still_admits_mtcollins1() -> Bool {
+  match mtcollins1_managed_host_admission() {
+    Absent => false
+    Present { value: r } =>
+      match project_managed_host_admission(
+        record: r,
+        current_subject: mtcollins1_current_intake_subject(),
+        drops: [
+          drop_with_identity_and_population(
+            identity: mtcollins1_bmc_secure_standing_predates_reflash.identity,
+            population: ["unrelated bounded population with no unit name"],
+          ),
+        ],
+        allocations: gunbc_fleet_hostname_allocations,
+      ) {
+        Absent => false
+        Present { value: m } => match m {
+          OrdinaryMember { host: _ } => false
+          MemberUnderDeclaredDrop { drop: d, standing_subject: _, current_subject: _, host: h } =>
+            (d.decl_name as String) == (mtcollins1_bmc_secure_standing_drop_ref.decl_name as String)
+              && (h.host as String) == (operator_host_mtcollins1 as String)
+        }
+      }
+  }
+}
diff --git a/dag/test/claim/host/managed_host_witness_test.dag b/dag/test/claim/host/managed_host_witness_test.dag
index e50d8638d50..fc2b914e2ea 100644
--- a/dag/test/claim/host/managed_host_witness_test.dag
+++ b/dag/test/claim/host/managed_host_witness_test.dag
@@ -23,6 +23,8 @@ import gunbc.machine_intake_ampere_smpro_observation {
   SmproPassSubjectBound, SmproPassSiteRefused, SmproPassEndpointMismatch,
 }
 import gunbc.host_reset_subject_roster {
+  OrdinaryResetRosterHost,
+  ResetRosterHostUnderDeclaredDrop,
   ResetSubjectAdmitted,
   ResetSubjectControllerNotAdmitted,
   ResetSubjectNoSelection,
@@ -61,7 +63,10 @@ test fn w_reset_roster_is_exactly_mtcollins1_through_the_binding_and_admission()
           ResetNoUnitHold => false
         })
     && count(roster) == 1
-    && roster |> all(r => (r as String) == (operator_host_mtcollins1 as String))
+    && roster |> all(r => match r {
+      OrdinaryResetRosterHost { host: _ } => false
+      ResetRosterHostUnderDeclaredDrop { host: h, drop: _ } => (h as String) == (operator_host_mtcollins1 as String)
+    })
 }
 
 fn observation_at(o: BmcAccessObservation, host: String) -> BmcAccessObservation {
diff --git a/dag/test/claim/host/megarac_managed_host_forged_probe_witness_test.dag b/dag/test/claim/host/megarac_managed_host_forged_probe_witness_test.dag
index a9be8c37432..7997581ad4a 100644
--- a/dag/test/claim/host/megarac_managed_host_forged_probe_witness_test.dag
+++ b/dag/test/claim/host/megarac_managed_host_forged_probe_witness_test.dag
@@ -15,7 +15,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // callers. This witness hands that source to the compiler through the diagnostic-census harness and
 // requires the refusal CLASS at each SUBJECT by name. It is an identity join, so a probe refusing for
 // any other reason measures another wall, and the harness control shows the census ran.
-data forged_probe_source: String = "module probe_megarac_managed_host_forged\n\nimport std.types { NonEmptyStr, String }\nimport extdeps.bmc.megarac { megarac_firmware_0_32 }\nimport extdeps.bmc.ipmi_chassis_control { ChassisPowerObservation, ChassisUnreadable }\nimport gunbc.managed_host { ManagedHostBinding }\nimport gunbc.managed_host_unit_hold { UnitHoldProof }\nimport gunbc.megarac_managed_host { AdmittedMegaRacHost }\nimport gunbc.megarac_operation_standing { MegaRacVirtualMediaAttach }\nimport gunbc.machine_intake_megarac_sensor_observation { MegaRacSdrSocketNamingRule }\nimport gunbc.machine_intake_megarac_media_attach { MegaRacShareBinding }\nimport gunbc.machine_intake_megarac_boot_media_attach {\n  MegaRacIpmiReadBound, megarac_attach_boot_image, megarac_observe_boot_presentation, megarac_boot_media_chassis_power,\n  megarac_stale_power_off, megarac_stale_power_off_poll, megarac_power_after_stale_power_off,\n}\nimport gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle { MtCollins1MediaAttachRecord, StaleMediumPowerOff }\nimport gunbc.machine_intake_megarac_media_attach { MegaRacAttachResult }\nimport std.types { EpochMs }\nimport extdeps.bmc.endpoint { BmcControllerEndpoint }\nimport extdeps.bmc.access_profile { BmcObservedIdentity }\nimport gunbc.machine_intake_receipt { EvidenceRef }\nimport gunbc.runner_browser_toolchain { RunnerBrowserToolchainLocation }\nimport gunbc.megarac_operation_standing { MegaRacOperationStanding, MegaRacBuildReading, MegaRacOperationReceipt, MegaRacFirmwareTransition, MegaRacOperationGrounding, MegaRacKvmCanvasStill }\nimport gunbc.machine_intake_megarac_kvm_still { KvmObserverStart, kvm_observer_launch, kvm_observer_launch_in, kvm_observer_protocol_launch }\nimport gunbc.megarac_managed_host { MegaRacHostAdmission, GroundedByExecutionOnly, megarac_grounded_admission }\nimport gunbc.megarac_operation_standing { MegaRacOperationEvidence, megarac_operation_evidence_of }\nimport gunbc.machine_intake_megarac_operation_evidence { mtcollins1_megarac_operation_evidence }\n\nfn forged_host(b: ManagedHostBinding) -> AdmittedMegaRacHost {\n  AdmittedMegaRacHost { binding: b, operation: MegaRacVirtualMediaAttach, firmware: megarac_firmware_0_32 }\n}\n\nfn forged_naming(b: ManagedHostBinding) -> MegaRacSdrSocketNamingRule {\n  MegaRacSdrSocketNamingRule { host: b.host.host, firmware: megarac_firmware_0_32, prefix: \"CPU\" }\n}\n\nfn attach_from_outside_the_boot(p: UnitHoldProof, share: MegaRacShareBinding, bound: MegaRacIpmiReadBound) -> MtCollins1MediaAttachRecord {\n  megarac_attach_boot_image(proof: p, image_name: \"x.iso\", image_sha256: \"00\", share: share, replaceable_seeded_stem: \"x\", bound: bound, password_file: \"/tmp/pw\", attempt: \"forged\")\n}\n\nfn observe_from_outside_the_boot(p: UnitHoldProof, share: MegaRacShareBinding) -> MegaRacAttachResult {\n  megarac_observe_boot_presentation(proof: p, image_name: \"x.iso\", share: share, password_file: \"/tmp/pw\", attempt: \"forged\", look: \"outside\")\n}\n\nfn read_chassis_with_a_carrier_in_hand(h: AdmittedMegaRacHost, bound: MegaRacIpmiReadBound) -> ChassisPowerObservation {\n  megarac_boot_media_chassis_power(host: h, password_file: \"/tmp/pw\", bound: bound)\n}\n\nfn power_off_with_a_carrier_in_hand(h: AdmittedMegaRacHost, share: MegaRacShareBinding, bound: MegaRacIpmiReadBound) -> StaleMediumPowerOff {\n  megarac_stale_power_off(host: h, before: ChassisUnreadable, password_file: \"/tmp/pw\", attempt: \"forged\", image_name: \"x.iso\", share: share, replaceable_seeded_stem: \"x\", bound: bound)\n}\n\nfn poll_with_a_carrier_in_hand(h: AdmittedMegaRacHost, bound: MegaRacIpmiReadBound) -> ChassisPowerObservation {\n  megarac_stale_power_off_poll(host: h, password_file: \"/tmp/pw\", bound: bound, remaining: 1)\n}\n\nfn fresh_read_with_a_carrier_in_hand(h: AdmittedMegaRacHost, off: StaleMediumPowerOff, bound: MegaRacIpmiReadBound) -> ChassisPowerObservation {\n  megarac_power_after_stale_power_off(host: h, before: ChassisUnreadable, off: off, password_file: \"/tmp/pw\", bound: bound)\n}\n\n\nfn forged_standing(i: BmcObservedIdentity, g: MegaRacOperationGrounding) -> MegaRacOperationStanding {\n  MegaRacOperationStanding { operation: MegaRacKvmCanvasStill, identity: i, grounding: g }\n}\n\nfn forged_reading(e: BmcControllerEndpoint, i: BmcObservedIdentity, v: EvidenceRef) -> MegaRacBuildReading {\n  MegaRacBuildReading { endpoint: e, identity: i, evidence: v, observed_at: 1 }\n}\n\nfn forged_receipt(e: BmcControllerEndpoint, v: EvidenceRef) -> MegaRacOperationReceipt {\n  MegaRacOperationReceipt { operation: MegaRacKvmCanvasStill, endpoint: e, receipt: v, executed_at: 1 }\n}\n\nfn launch_with_raw_values(t: RunnerBrowserToolchainLocation) -> KvmObserverStart {\n  kvm_observer_launch(dir: \"d\", base_url: \"https://192.0.2.1\", host: \"192.0.2.1\", username: \"admin\", password_file: \"/tmp/pw\", toolchain: t, attempt: \"forged\", features_json: \"\")\n}\n\nfn launch_in_with_raw_values(t: RunnerBrowserToolchainLocation) -> KvmObserverStart {\n  kvm_observer_launch_in(dir_given: \"d\", base_url: \"https://192.0.2.1\", host: \"192.0.2.1\", username: \"admin\", password_file: \"/tmp/pw\", toolchain: t, attempt: \"forged\", features_json: \"\")\n}\n\nfn protocol_launch_from_production(t: RunnerBrowserToolchainLocation) -> KvmObserverStart {\n  kvm_observer_protocol_launch(dir_given: \"d\", base_url: \"https://192.0.2.1\", host: \"192.0.2.1\", username: \"admin\", password_file: \"/tmp/pw\", toolchain: t, attempt: \"forged\", features_json: \"\")\n}\n\nfn admit_through_the_mint_helper(b: ManagedHostBinding, i: BmcObservedIdentity) -> MegaRacHostAdmission {\n  megarac_grounded_admission(evidence: mtcollins1_megarac_operation_evidence(), binding: b, operation: MegaRacVirtualMediaAttach, identity: i, requirement: GroundedByExecutionOnly)\n}\n\nfn drop_the_reflash_by_literal(e: MegaRacOperationEvidence) -> MegaRacOperationEvidence {\n  MegaRacOperationEvidence { readings: e.readings, receipts: e.receipts, transitions: [], recoveries: e.recoveries }\n}\n\nfn drop_the_reflash_through_the_mint(e: MegaRacOperationEvidence) -> MegaRacOperationEvidence {\n  megarac_operation_evidence_of(readings: e.readings, receipts: e.receipts, transitions: [], recoveries: e.recoveries)\n}\n"
+data forged_probe_source: String = "module probe_megarac_managed_host_forged\n\nimport std.types { NonEmptyStr, String }\nimport extdeps.bmc.megarac { megarac_firmware_0_32 }\nimport extdeps.bmc.ipmi_chassis_control { ChassisPowerObservation, ChassisUnreadable }\nimport gunbc.managed_host { ManagedHostBinding }\nimport gunbc.managed_host_unit_hold { UnitHoldProof }\nimport gunbc.megarac_managed_host { AdmittedMegaRacHost }\nimport gunbc.megarac_operation_standing { MegaRacVirtualMediaAttach }\nimport gunbc.machine_intake_megarac_sensor_observation { MegaRacSdrSocketNamingRule }\nimport gunbc.machine_intake_megarac_media_attach { MegaRacShareBinding }\nimport gunbc.machine_intake_megarac_boot_media_attach {\n  MegaRacIpmiReadBound, megarac_attach_boot_image, megarac_observe_boot_presentation, megarac_boot_media_chassis_power,\n  megarac_stale_power_off, megarac_stale_power_off_poll, megarac_power_after_stale_power_off,\n}\nimport gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle { MtCollins1MediaAttachRecord, StaleMediumPowerOff }\nimport gunbc.machine_intake_megarac_media_attach { MegaRacAttachResult }\nimport std.types { EpochMs }\nimport extdeps.bmc.endpoint { BmcControllerEndpoint }\nimport extdeps.bmc.access_profile { BmcObservedIdentity }\nimport gunbc.machine_intake_receipt { EvidenceRef }\nimport gunbc.megarac_operation_standing { MegaRacOperationStanding, MegaRacBuildReading, MegaRacOperationReceipt, MegaRacFirmwareTransition, MegaRacOperationGrounding, MegaRacKvmCanvasStill }\nimport gunbc.megarac_managed_host { MegaRacHostAdmission, megarac_grounded_admission }\nimport gunbc.megarac_operation_standing { MegaRacOperationEvidence, megarac_operation_evidence_of }\nimport gunbc.machine_intake_megarac_operation_evidence { mtcollins1_megarac_operation_evidence }\n\nfn forged_host(b: ManagedHostBinding) -> AdmittedMegaRacHost {\n  AdmittedMegaRacHost { binding: b, operation: MegaRacVirtualMediaAttach, firmware: megarac_firmware_0_32 }\n}\n\nfn forged_naming(b: ManagedHostBinding) -> MegaRacSdrSocketNamingRule {\n  MegaRacSdrSocketNamingRule { host: b.host.host, firmware: megarac_firmware_0_32, prefix: \"CPU\" }\n}\n\nfn attach_from_outside_the_boot(p: UnitHoldProof, share: MegaRacShareBinding, bound: MegaRacIpmiReadBound) -> MtCollins1MediaAttachRecord {\n  megarac_attach_boot_image(proof: p, image_name: \"x.iso\", image_sha256: \"00\", share: share, replaceable_seeded_stem: \"x\", bound: bound, password_file: \"/tmp/pw\", attempt: \"forged\")\n}\n\nfn observe_from_outside_the_boot(p: UnitHoldProof, share: MegaRacShareBinding) -> MegaRacAttachResult {\n  megarac_observe_boot_presentation(proof: p, image_name: \"x.iso\", share: share, password_file: \"/tmp/pw\", attempt: \"forged\", look: \"outside\")\n}\n\nfn read_chassis_with_a_carrier_in_hand(h: AdmittedMegaRacHost, bound: MegaRacIpmiReadBound) -> ChassisPowerObservation {\n  megarac_boot_media_chassis_power(host: h, password_file: \"/tmp/pw\", bound: bound)\n}\n\nfn power_off_with_a_carrier_in_hand(h: AdmittedMegaRacHost, share: MegaRacShareBinding, bound: MegaRacIpmiReadBound) -> StaleMediumPowerOff {\n  megarac_stale_power_off(host: h, before: ChassisUnreadable, password_file: \"/tmp/pw\", attempt: \"forged\", image_name: \"x.iso\", share: share, replaceable_seeded_stem: \"x\", bound: bound)\n}\n\nfn poll_with_a_carrier_in_hand(h: AdmittedMegaRacHost, bound: MegaRacIpmiReadBound) -> ChassisPowerObservation {\n  megarac_stale_power_off_poll(host: h, password_file: \"/tmp/pw\", bound: bound, remaining: 1)\n}\n\nfn fresh_read_with_a_carrier_in_hand(h: AdmittedMegaRacHost, off: StaleMediumPowerOff, bound: MegaRacIpmiReadBound) -> ChassisPowerObservation {\n  megarac_power_after_stale_power_off(host: h, before: ChassisUnreadable, off: off, password_file: \"/tmp/pw\", bound: bound)\n}\n\n\nfn forged_standing(i: BmcObservedIdentity, g: MegaRacOperationGrounding) -> MegaRacOperationStanding {\n  MegaRacOperationStanding { operation: MegaRacKvmCanvasStill, identity: i, grounding: g }\n}\n\nfn forged_reading(e: BmcControllerEndpoint, i: BmcObservedIdentity, v: EvidenceRef) -> MegaRacBuildReading {\n  MegaRacBuildReading { endpoint: e, identity: i, evidence: v, observed_at: 1 }\n}\n\nfn forged_receipt(e: BmcControllerEndpoint, v: EvidenceRef) -> MegaRacOperationReceipt {\n  MegaRacOperationReceipt { operation: MegaRacKvmCanvasStill, endpoint: e, receipt: v, executed_at: 1 }\n}\n\nfn admit_through_the_mint_helper(b: ManagedHostBinding, i: BmcObservedIdentity) -> MegaRacHostAdmission {\n  megarac_grounded_admission(evidence: mtcollins1_megarac_operation_evidence(), binding: b, operation: MegaRacVirtualMediaAttach, identity: i)\n}\n\nfn drop_the_reflash_by_literal(e: MegaRacOperationEvidence) -> MegaRacOperationEvidence {\n  MegaRacOperationEvidence { readings: e.readings, receipts: e.receipts, transitions: [] }\n}\n\nfn drop_the_reflash_through_the_mint(e: MegaRacOperationEvidence) -> MegaRacOperationEvidence {\n  megarac_operation_evidence_of(readings: e.readings, receipts: e.receipts, transitions: [])\n}\n"
 
 fn probe() -> CompileDiagnosticCensus {
   compile_dag_diagnostic_census(forged_probe_source)
@@ -79,16 +79,6 @@ test fn each_forged_operation_evidence_carrier_is_refused_at_its_literal() -> Bo
     && blocking_count_for_class_and_subject(c: c, wanted: "SoleConstructorViolation", subject: "MegaRacOperationReceipt") >= 1
 }
 
-// NO OUTSIDE CALLER REACHES THE KVM VIEWER WITH A RAW HOST AND ACCOUNT: the production launcher is sealed
-// to megarac_kvm_observer_start, the directory-resolving launcher to it and to the test facade, and the
-// facade to the protocol witness functions by name.
-test fn the_kvm_launchers_refuse_a_caller_holding_raw_host_and_account_values() -> Bool {
-  let c = probe()
-  blocking_count_for_class_and_subject(c: c, wanted: "ConstructorCallAdmissionRefused", subject: "kvm_observer_launch") >= 1
-    && blocking_count_for_class_and_subject(c: c, wanted: "ConstructorCallAdmissionRefused", subject: "kvm_observer_launch_in") >= 1
-    && blocking_count_for_class_and_subject(c: c, wanted: "ConstructorCallAdmissionRefused", subject: "kvm_observer_protocol_launch") >= 1
-}
-
 // NO CALLER OUTSIDE THE TWO ADMISSIONS MINTS THE CARRIER THROUGH THE HELPER THAT CONSTRUCTS IT: given a
 // real binding and the committed evidence, an outside call to megarac_grounded_admission is refused at
 // admission, so the family, grounding and current-build steps cannot be stepped around.
diff --git a/dag/test/claim/host/megarac_managed_host_witness_test.dag b/dag/test/claim/host/megarac_managed_host_witness_test.dag
index 756a513c1bd..20018f0cbe9 100644
--- a/dag/test/claim/host/megarac_managed_host_witness_test.dag
+++ b/dag/test/claim/host/megarac_managed_host_witness_test.dag
@@ -1,5 +1,6 @@
 module test.claim.megarac_managed_host_witness
 
+import test.fixture.board_fru_observation { jade_fru_read }
 import std.types { Bool, List, NonEmptyStr, String }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import extdeps.bmc.endpoint { BmcControllerEndpoint, BmcFirmwareFamily, AmiMegaRac, OpenBmc }
@@ -10,7 +11,6 @@ import gunbc.managed_host {
   ManagedHost, managed_host_fixture, managed_hosts, ManagedHostAccessUnobserved, ManagedHostEndpointMismatch,
   ManagedHostFound, managed_host_binding, managed_host_binding_for, managed_host_account_driving,
 }
-import extdeps.boards.types { BaseboardModel, GigabyteMp72Hb0 }
 import std.types { EpochMs }
 import std.content_hash { Sha256Digest, Sha256Hash }
 import std.decl_ref { decl_ref }
@@ -24,8 +24,13 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
 data megarac_operations: List<MegaRacOperation> = [MegaRacVirtualMediaAttach, MegaRacKvmCanvasStill, MegaRacSdrSocketNaming]
 
+// The operations with an executed standing at the committed 0.32 build. The KVM canvas still has none: the only
+// KVM receipt sits across the reflash, so production admission refuses it.
+data megarac_operations_executed_at_0_32: List<MegaRacOperation> = [MegaRacVirtualMediaAttach, MegaRacSdrSocketNaming]
+
 // THE INHABITANCE CLAIM, AND IT ASSERTS THE ROUTE. The one managed row, mtcollins1, is admitted for every
-// MegaRAC operation the boot drives, and each carrier's endpoint, account and firmware are its binding's
+// MegaRAC operation with an executed standing at its build (the KVM canvas still has none and is refused),
+// and each carrier's endpoint, account and firmware are its binding's
 // own: the endpoint the binding observed, the account the binding carries, and the firmware that
 // observation read. Its observed family turning OpenBMC, its build changing, or its secure standing
 // going Absent turns this red.
@@ -33,7 +38,8 @@ test fn w_the_real_row_is_admitted_for_each_megarac_operation_through_its_bindin
   let hosts = managed_hosts()
   count(hosts) == 1
     && hosts |> all(h => (h.host as String) == (operator_host_mtcollins1 as String)
-      && megarac_operations |> all(op => match admit_megarac_host(host: h, operation: op) {
+      && match admit_megarac_host(host: h, operation: MegaRacKvmCanvasStill) { MegaRacHostRefused { cause: _ } => true  MegaRacHostAdmitted { host: _ } => false }
+      && megarac_operations_executed_at_0_32 |> all(op => match admit_megarac_host(host: h, operation: op) {
         MegaRacHostAdmitted { host: a } =>
           (a.binding.host.host as String) == (operator_host_mtcollins1 as String)
             && a.firmware.family == AmiMegaRac
@@ -45,7 +51,7 @@ test fn w_the_real_row_is_admitted_for_each_megarac_operation_through_its_bindin
 }
 
 fn identity_with(o: BmcAccessObservation, firmware: BmcFirmwareReleaseIdentity) -> BmcObservedIdentity {
-  BmcObservedIdentity { baseboard: o.identity.baseboard, chassis_part_number: o.identity.chassis_part_number, firmware: firmware }
+  BmcObservedIdentity { board: o.identity.board, chassis_part_number: o.identity.chassis_part_number, firmware: firmware }
 }
 
 fn observation_with(o: BmcAccessObservation, host: String, firmware: BmcFirmwareReleaseIdentity) -> BmcAccessObservation {
@@ -143,16 +149,16 @@ test fn w_a_host_that_is_not_managed_is_refused_for_every_operation() -> Bool {
 }
 
 // RED: ANOTHER PRODUCT LINE REPORTING THE SAME BUILD. The real row's binding is kept and its observed
-// baseboard becomes a Gigabyte MP72-HB0 at MegaRAC 0.32: family and raw version match the Mt. Collins
+// baseboard becomes the Mt. Jade board (a different bound authority) at MegaRAC 0.32: family and raw version match the Mt. Collins
 // controller exactly, and every operation still refuses, because none was grounded on that baseboard.
 test fn w_another_baseboard_at_the_same_megarac_build_is_refused_for_every_operation() -> Bool {
   managed_hosts() |> all(h => match h.access {
     BmcAccessUnobserved { endpoint: _ } => false
     BmcAccessObserved { observation: o } => {
-      let other = managed_host_fixture(host: h.host, access: BmcAccessObserved { observation: observation_on(o: o, host: o.endpoint.host as String, identity: BmcObservedIdentity { baseboard: GigabyteMp72Hb0, chassis_part_number: none, firmware: o.identity.firmware }) }, capability_row: h.capability_row, secure: h.secure, unit_hold: h.unit_hold, smpro: h.smpro)
+      let other = managed_host_fixture(host: h.host, access: BmcAccessObserved { observation: observation_on(o: o, host: o.endpoint.host as String, identity: BmcObservedIdentity { board: jade_fru_read, chassis_part_number: none, firmware: o.identity.firmware }) }, capability_row: h.capability_row, secure: h.secure, unit_hold: h.unit_hold, smpro: h.smpro)
       (o.identity.firmware.raw_version as String) == "0.32"
         && refused_for_every_operation(h: other, refused: a => match a {
-          MegaRacHostRefused { cause: MegaRacOperationNotGrounded { operation: _, identity: i } } => i.baseboard == GigabyteMp72Hb0
+          MegaRacHostRefused { cause: MegaRacOperationNotGrounded { operation: _, identity: i } } => i.board == jade_fru_read
           _ => false
         })
     }
@@ -175,7 +181,6 @@ test fn w_a_historical_observation_beside_a_known_later_build_mints_no_carrier()
         readings: [megarac_build_reading(endpoint: o.endpoint, identity: o.identity, evidence: fixture_evidence(label: "historical reading"), observed_at: 1000)],
         receipts: [],
         transitions: [megarac_firmware_transition(endpoint: o.endpoint, from: o.identity.firmware, to: bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: "0.45.3"), not_before: 2000, not_after: 3000, record: decl_ref(module_path: "fixture", decl_name: "reflash"))],
-        recoveries: [],
       )
       megarac_operations |> all(op => match admit_megarac_host_at_current_build(evidence: ev, host: h, operation: op) {
         MegaRacHostRefused { cause: MegaRacObservationNotCurrent { observed: ob, current: c } } => (ob.raw_version as String) == "0.32" && (c.raw_version as String) == "0.45.3"
@@ -195,7 +200,6 @@ test fn w_a_current_read_build_with_executed_evidence_is_admitted_by_the_shadow_
         readings: [megarac_build_reading(endpoint: o.endpoint, identity: o.identity, evidence: fixture_evidence(label: "current reading"), observed_at: 5000)],
         receipts: [megarac_operation_receipt(operation: MegaRacVirtualMediaAttach, endpoint: o.endpoint, receipt: fixture_evidence(label: "run"), executed_at: 6000)],
         transitions: [],
-        recoveries: [],
       )
       (match admit_megarac_host_at_current_build(evidence: ev, host: h, operation: MegaRacVirtualMediaAttach) { MegaRacHostAdmitted { host: _ } => true  MegaRacHostRefused { cause: _ } => false })
         && (match admit_megarac_host_at_current_build(evidence: ev, host: h, operation: MegaRacKvmCanvasStill) { MegaRacHostRefused { cause: MegaRacOperationNotGrounded { operation: _, identity: _ } } => true  _ => false })
diff --git a/dag/test/claim/host/megarac_operation_standing_witness_test.dag b/dag/test/claim/host/megarac_operation_standing_witness_test.dag
index a681bdefbc8..2205a26f227 100644
--- a/dag/test/claim/host/megarac_operation_standing_witness_test.dag
+++ b/dag/test/claim/host/megarac_operation_standing_witness_test.dag
@@ -1,20 +1,20 @@
 module test.claim.megarac_operation_standing_witness
 
+import test.fixture.board_fru_observation { collins_fru_read }
 import std.types { Bool, EpochMs, List, NonEmptyStr, String }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.algebra { any, filter }
 import std.content_hash { Sha256Digest, Sha256Hash }
 import std.decl_ref { decl_ref }
-import extdeps.boards.types { AmpereMtCollins }
 import extdeps.bmc.endpoint { AmiMegaRac, BmcControllerEndpoint }
 import extdeps.bmc.capability { bmc_firmware_release_identity_of_wire }
 import extdeps.bmc.access_profile { BmcObservedIdentity }
 import gunbc.machine_intake_receipt { EvidenceRef }
 import gunbc.megarac_operation_standing {
   MegaRacOperation, MegaRacOperationStanding, megarac_operation_eq, MegaRacOperationEvidence, megarac_operation_evidence_of, MegaRacVirtualMediaAttach, MegaRacKvmCanvasStill, MegaRacSdrSocketNaming,
-  OperationExecutedAtBuild, OperationRecoveredFromServedArtifact,
+  OperationExecutedAtBuild,
   megarac_build_reading, megarac_operation_receipt, megarac_firmware_transition,
-  megarac_operation_standings, megarac_operation_grounded_at, megarac_operation_executed_at, megarac_identity_eq,
+  megarac_operation_standings, megarac_operation_executed_at, megarac_identity_eq,
 }
 import gunbc.machine_intake_megarac_operation_evidence { mtcollins1_megarac_operation_evidence }
 import gunbc.machine_intake_mtcollins1_access_observation { mtcollins1_identity }
@@ -24,7 +24,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 data controller: BmcControllerEndpoint = BmcControllerEndpoint { host: "fixture-bmc" }
 
 fn identity_at(wire: String) -> BmcObservedIdentity {
-  BmcObservedIdentity { baseboard: AmpereMtCollins, chassis_part_number: none, firmware: bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: wire as NonEmptyStr) }
+  BmcObservedIdentity { board: collins_fru_read, chassis_part_number: none, firmware: bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: wire as NonEmptyStr) }
 }
 
 fn evidence(label: String) -> EvidenceRef {
@@ -38,11 +38,10 @@ test fn w_a_receipt_beside_a_reading_of_its_build_is_grounded_there() -> Bool {
     readings: [megarac_build_reading(endpoint: controller, identity: identity_at(wire: "0.32"), evidence: evidence(label: "reading"), observed_at: 1000)],
     receipts: [megarac_operation_receipt(operation: MegaRacVirtualMediaAttach, endpoint: controller, receipt: evidence(label: "run"), executed_at: 2000)],
     transitions: [],
-    recoveries: [],
   )
-  megarac_operation_grounded_at(evidence: ev, operation: MegaRacVirtualMediaAttach, identity: identity_at(wire: "0.32"))
-    && !megarac_operation_grounded_at(evidence: ev, operation: MegaRacVirtualMediaAttach, identity: identity_at(wire: "0.45.3"))
-    && !megarac_operation_grounded_at(evidence: ev, operation: MegaRacKvmCanvasStill, identity: identity_at(wire: "0.32"))
+  megarac_operation_executed_at(evidence: ev, operation: MegaRacVirtualMediaAttach, identity: identity_at(wire: "0.32"))
+    && !megarac_operation_executed_at(evidence: ev, operation: MegaRacVirtualMediaAttach, identity: identity_at(wire: "0.45.3"))
+    && !megarac_operation_executed_at(evidence: ev, operation: MegaRacKvmCanvasStill, identity: identity_at(wire: "0.32"))
 }
 
 // RED: THE SAME RECEIPT WITH A REFLASH RECORDED BETWEEN IT AND THE ONLY READING grounds nothing: the
@@ -52,20 +51,18 @@ test fn w_a_receipt_across_a_reflash_grounds_no_build() -> Bool {
     readings: [megarac_build_reading(endpoint: controller, identity: identity_at(wire: "0.32"), evidence: evidence(label: "reading"), observed_at: 1000)],
     receipts: [megarac_operation_receipt(operation: MegaRacVirtualMediaAttach, endpoint: controller, receipt: evidence(label: "run"), executed_at: 3000)],
     transitions: [megarac_firmware_transition(endpoint: controller, from: identity_at(wire: "0.32").firmware, to: identity_at(wire: "0.45.3").firmware, not_before: 1500, not_after: 2500, record: decl_ref(module_path: "fixture", decl_name: "reflash"))],
-    recoveries: [],
   )
   count(megarac_operation_standings(evidence: ev)) == 0
 }
 
 // THE INHABITANCE CLAIM OVER THE COMMITTED ROWS, AND IT ASSERTS THE ROUTE. mtcollins1 at its 0.32 intake
 // identity: virtual media and SDR naming are grounded by EXECUTION (the diskless boot, the 32-DIMM SDR
-// read), the KVM still by RECOVERY from the served bundle. Nothing is grounded at 0.45.3, because no
+// read); the KVM still has no standing. Nothing is grounded at 0.45.3, because no
 // reading of that build is committed and the 2026-10-03 run's receipts sit across the 2026-10-02 reflash
 // from the only reading there is.
 fn standing_is(s: MegaRacOperationStanding, operation: MegaRacOperation, executed: Bool) -> Bool {
   megarac_identity_eq(a: s.identity, b: mtcollins1_identity) && megarac_operation_eq(a: s.operation, b: operation) && match s.grounding {
     OperationExecutedAtBuild { receipt: _, build: _ } => executed
-    OperationRecoveredFromServedArtifact { recovery: _ } => !executed
   }
 }
 
@@ -76,22 +73,20 @@ fn grounded_by(standings: List<MegaRacOperationStanding>, operation: MegaRacOper
 test fn w_the_committed_rows_ground_0_32_by_route_and_nothing_at_0_45_3() -> Bool {
   let ev = mtcollins1_megarac_operation_evidence()
   let standings = megarac_operation_standings(evidence: ev)
-  let later = BmcObservedIdentity { baseboard: mtcollins1_identity.baseboard, chassis_part_number: mtcollins1_identity.chassis_part_number, firmware: bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: "0.45.3") }
+  let later = BmcObservedIdentity { board: mtcollins1_identity.board, chassis_part_number: mtcollins1_identity.chassis_part_number, firmware: bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: "0.45.3") }
   grounded_by(standings: standings, operation: MegaRacVirtualMediaAttach, executed: true)
     && grounded_by(standings: standings, operation: MegaRacSdrSocketNaming, executed: true)
-    && grounded_by(standings: standings, operation: MegaRacKvmCanvasStill, executed: false)
-    && count(standings) == 3
-    && !megarac_operation_grounded_at(evidence: ev, operation: MegaRacVirtualMediaAttach, identity: later)
-    && !megarac_operation_grounded_at(evidence: ev, operation: MegaRacKvmCanvasStill, identity: later)
-    && !megarac_operation_grounded_at(evidence: ev, operation: MegaRacSdrSocketNaming, identity: later)
+    && !grounded_by(standings: standings, operation: MegaRacKvmCanvasStill, executed: true)
+    && count(standings) == 2
+    && !megarac_operation_executed_at(evidence: ev, operation: MegaRacVirtualMediaAttach, identity: later)
+    && !megarac_operation_executed_at(evidence: ev, operation: MegaRacKvmCanvasStill, identity: later)
+    && !megarac_operation_executed_at(evidence: ev, operation: MegaRacSdrSocketNaming, identity: later)
 }
 
-// WHAT A ROUTE RECOVERED FROM A SERVED ARTIFACT DOES NOT ESTABLISH. The KVM still is grounded at
-// mtcollins1's 0.32 identity -- by the bundle that build served -- and is NOT executed there; virtual
-// media, which ran, is both. Anything that needs an executed standing refuses on the recovered arm.
-test fn w_a_route_recovered_from_a_served_artifact_is_grounded_but_not_executed() -> Bool {
+// THE KVM STILL HAS NO STANDING AT 0.32: no committed still exists from that build, and the only KVM
+// receipt sits across the reflash. Virtual media, which ran, is executed there.
+test fn w_the_kvm_still_is_not_grounded_at_0_32_and_virtual_media_is_executed() -> Bool {
   let ev = mtcollins1_megarac_operation_evidence()
-  megarac_operation_grounded_at(evidence: ev, operation: MegaRacKvmCanvasStill, identity: mtcollins1_identity)
-    && !megarac_operation_executed_at(evidence: ev, operation: MegaRacKvmCanvasStill, identity: mtcollins1_identity)
+  !megarac_operation_executed_at(evidence: ev, operation: MegaRacKvmCanvasStill, identity: mtcollins1_identity)
     && megarac_operation_executed_at(evidence: ev, operation: MegaRacVirtualMediaAttach, identity: mtcollins1_identity)
 }
diff --git a/dag/test/claim/host/memory_envelope_witness_test.dag b/dag/test/claim/host/memory_envelope_witness_test.dag
new file mode 100644
index 00000000000..7d57261c430
--- /dev/null
+++ b/dag/test/claim/host/memory_envelope_witness_test.dag
@@ -0,0 +1,143 @@
+module test.claim.memory_envelope_witness_test
+
+import std.types { Bool, Int, NonEmptyStr, String }
+import std.optional { Present, Absent }
+import std.measure { byte_size }
+import gunbc.host_budget_source { BudgetSourceCgroupMemoryMax }
+import gunbc.memory_cgroup_binding {
+  CgroupBindDecision,
+  BindNotRequested,
+  BindUnnecessaryLimitAlreadyBinds,
+  BindApplicable,
+  BindRefused,
+  CgroupTreeNotWritable,
+}
+import gunbc.memory_envelope {
+  MemoryEnvelopeRequirement, EnvelopeNotRequested, EnvelopeSlotRequired, EnvelopeRequirementUnreadable,
+  memory_envelope_slot_requirement_value, memory_envelope_requirement_from_text,
+  MemoryEnvelopeGrain, EnvelopeLeaf, EnvelopeExisting, EnvelopeSlot, memory_envelope_grain_label,
+  MemoryEnvelopeRefusalCause, EnvelopeGrainUnknown, EnvelopeAbsent,
+  MemoryEnvelopeDecision, EnvelopeNotRequired, EnvelopeBounded, EnvelopeRefused,
+  memory_envelope_decision,
+  memory_envelope_verdict, memory_envelope_verdict_violates,
+}
+
+// EVERY INPUT IS SUPPLIED, so every arm is reachable here -- including the one the inline first
+// version could not reach from any claim: a slot requirement over a process no numeric memory.max
+// binds, which must REFUSE and not be receipted as bounded (DESIGN section 5: the absorbing arm).
+
+fn decided_bounded_at(d: MemoryEnvelopeDecision, grain: MemoryEnvelopeGrain) -> Bool {
+  match d {
+    EnvelopeBounded { grain: g } => memory_envelope_grain_label(g: g) == memory_envelope_grain_label(g: grain)
+    EnvelopeNotRequired => false
+    EnvelopeRefused { cause: _ } => false
+  }
+}
+
+fn decided_absent_at(d: MemoryEnvelopeDecision, grain: MemoryEnvelopeGrain) -> Bool {
+  match d {
+    EnvelopeRefused { cause: c } =>
+      match c {
+        EnvelopeAbsent { grain: g } => memory_envelope_grain_label(g: g) == memory_envelope_grain_label(g: grain)
+        EnvelopeGrainUnknown { raw: _ } => false
+      }
+    EnvelopeNotRequired => false
+    EnvelopeBounded { grain: _ } => false
+  }
+}
+
+fn decided_grain_unknown(d: MemoryEnvelopeDecision, raw: String) -> Bool {
+  match d {
+    EnvelopeRefused { cause: c } =>
+      match c {
+        EnvelopeGrainUnknown { raw: r } => r == raw
+        EnvelopeAbsent { grain: _ } => false
+      }
+    EnvelopeNotRequired => false
+    EnvelopeBounded { grain: _ } => false
+  }
+}
+
+fn decided_not_required(d: MemoryEnvelopeDecision) -> Bool {
+  match d {
+    EnvelopeNotRequired => true
+    EnvelopeBounded { grain: _ } => false
+    EnvelopeRefused { cause: _ } => false
+  }
+}
+
+fn an_existing_bind() -> CgroupBindDecision {
+  BindUnnecessaryLimitAlreadyBinds { source: BudgetSourceCgroupMemoryMax { cgroup_dir: "/sys/fs/cgroup/system.slice/actions-runner@srv4-15.service" as NonEmptyStr } }
+}
+
+test fn the_requirement_reads_absent_slot_and_anything_else_as_three_answers() -> Bool {
+  match memory_envelope_requirement_from_text(raw: Absent) { EnvelopeNotRequested => true  EnvelopeSlotRequired => false  EnvelopeRequirementUnreadable { raw: _ } => false }
+    && match memory_envelope_requirement_from_text(raw: Present { value: memory_envelope_slot_requirement_value() }) { EnvelopeSlotRequired => true  EnvelopeNotRequested => false  EnvelopeRequirementUnreadable { raw: _ } => false }
+    && match memory_envelope_requirement_from_text(raw: Present { value: "leaf" }) { EnvelopeRequirementUnreadable { raw: r } => r == "leaf"  EnvelopeNotRequested => false  EnvelopeSlotRequired => false }
+}
+
+// THE SLOT REQUIREMENT BOUNDS A RUN ONLY WHERE A NUMERIC memory.max BINDS IT.
+test fn a_slot_requirement_under_a_numeric_max_is_bounded_at_the_slot() -> Bool {
+  decided_bounded_at(d: memory_envelope_decision(bind: BindNotRequested, requirement: EnvelopeSlotRequired, numeric_max_binds: true), grain: EnvelopeSlot)
+}
+
+// THE RED THE FIRST VERSION COULD NOT GO: no numeric memory.max anywhere above the process (every
+// level `max`, or an unconverged slot) must REFUSE as absent, never run as bounded.
+test fn RED_a_slot_requirement_with_no_numeric_max_refuses_as_absent() -> Bool {
+  let d = memory_envelope_decision(bind: BindNotRequested, requirement: EnvelopeSlotRequired, numeric_max_binds: false)
+  decided_absent_at(d: d, grain: EnvelopeSlot) && decided_bounded_at(d: d, grain: EnvelopeSlot) == false
+}
+
+test fn no_requirement_and_no_bind_is_not_required() -> Bool {
+  decided_not_required(d: memory_envelope_decision(bind: BindNotRequested, requirement: EnvelopeNotRequested, numeric_max_binds: true))
+    && decided_not_required(d: memory_envelope_decision(bind: BindNotRequested, requirement: EnvelopeNotRequested, numeric_max_binds: false))
+}
+
+test fn an_applied_bind_is_bounded_at_the_leaf_with_or_without_the_requirement() -> Bool {
+  decided_bounded_at(d: memory_envelope_decision(bind: BindApplicable { bound: byte_size(count: 21474836480) }, requirement: EnvelopeSlotRequired, numeric_max_binds: true), grain: EnvelopeLeaf)
+    && decided_bounded_at(d: memory_envelope_decision(bind: BindApplicable { bound: byte_size(count: 21474836480) }, requirement: EnvelopeNotRequested, numeric_max_binds: true), grain: EnvelopeLeaf)
+}
+
+test fn an_existing_limit_is_bounded_at_the_existing_grain() -> Bool {
+  decided_bounded_at(d: memory_envelope_decision(bind: an_existing_bind(), requirement: EnvelopeSlotRequired, numeric_max_binds: true), grain: EnvelopeExisting)
+}
+
+// A BIND THAT WAS ASKED AND REFUSED REACHES NO ENVELOPE: the decision refuses too, it never invents
+// a slot bound for a run whose own bound was refused.
+test fn RED_a_refused_bind_reaches_no_envelope() -> Bool {
+  decided_absent_at(d: memory_envelope_decision(bind: BindRefused { cause: CgroupTreeNotWritable }, requirement: EnvelopeSlotRequired, numeric_max_binds: true), grain: EnvelopeLeaf)
+    && decided_absent_at(d: memory_envelope_decision(bind: BindRefused { cause: CgroupTreeNotWritable }, requirement: EnvelopeNotRequested, numeric_max_binds: true), grain: EnvelopeLeaf)
+}
+
+test fn RED_an_unknown_requirement_value_refuses_before_anything_else() -> Bool {
+  decided_grain_unknown(d: memory_envelope_decision(bind: BindApplicable { bound: byte_size(count: 1) }, requirement: EnvelopeRequirementUnreadable { raw: "leaf" }, numeric_max_binds: true), raw: "leaf")
+}
+
+// THE VERDICT: held only when nothing was killed, no swap is resident, the swap gauge was readable,
+// and the swap peak did not rise -- or could not be observed under a zero swap limit.
+test fn the_verdict_holds_only_on_a_clean_pair_of_readings() -> Bool {
+  memory_envelope_verdict_violates(v: memory_envelope_verdict(oom_kills_delta: 0, swap_current: Present { value: 0 }, swap_peak_rose: Present { value: false }, swap_max_zero: false)) == false
+    && memory_envelope_verdict_violates(v: memory_envelope_verdict(oom_kills_delta: 0, swap_current: Present { value: 0 }, swap_peak_rose: Absent, swap_max_zero: true)) == false
+}
+
+test fn RED_each_violation_refuses_on_its_own() -> Bool {
+  memory_envelope_verdict_violates(v: memory_envelope_verdict(oom_kills_delta: 1, swap_current: Present { value: 0 }, swap_peak_rose: Present { value: false }, swap_max_zero: false))
+    && memory_envelope_verdict_violates(v: memory_envelope_verdict(oom_kills_delta: 0, swap_current: Present { value: 1 }, swap_peak_rose: Present { value: false }, swap_max_zero: false))
+    && memory_envelope_verdict_violates(v: memory_envelope_verdict(oom_kills_delta: 0, swap_current: Absent, swap_peak_rose: Present { value: false }, swap_max_zero: false))
+    && memory_envelope_verdict_violates(v: memory_envelope_verdict(oom_kills_delta: 0, swap_current: Present { value: 0 }, swap_peak_rose: Present { value: true }, swap_max_zero: false))
+}
+
+// AN UNOBSERVABLE SWAP PEAK IS NOT "DID NOT RISE": under a slot that still permits swap it refuses;
+// only a zero swap limit makes the missing counter moot.
+test fn RED_an_unobservable_swap_peak_refuses_unless_the_swap_limit_is_zero() -> Bool {
+  memory_envelope_verdict_violates(v: memory_envelope_verdict(oom_kills_delta: 0, swap_current: Present { value: 0 }, swap_peak_rose: Absent, swap_max_zero: false))
+    && memory_envelope_verdict_violates(v: memory_envelope_verdict(oom_kills_delta: 0, swap_current: Present { value: 0 }, swap_peak_rose: Absent, swap_max_zero: true)) == false
+}
+
+// THE SHARED HELPER IS DISCRIMINATED AT EVERY GRAIN, not only the slot's: a bind the governor took
+// over a walk that finds no numeric maximum is a contradiction and refuses as absent at that grain.
+test fn RED_an_applied_or_existing_bind_over_no_numeric_max_refuses_at_its_grain() -> Bool {
+  decided_absent_at(d: memory_envelope_decision(bind: BindApplicable { bound: byte_size(count: 1) }, requirement: EnvelopeNotRequested, numeric_max_binds: false), grain: EnvelopeLeaf)
+    && decided_absent_at(d: memory_envelope_decision(bind: an_existing_bind(), requirement: EnvelopeNotRequested, numeric_max_binds: false), grain: EnvelopeExisting)
+    && decided_bounded_at(d: memory_envelope_decision(bind: an_existing_bind(), requirement: EnvelopeNotRequested, numeric_max_binds: true), grain: EnvelopeExisting)
+}
diff --git a/dag/test/claim/host/provider_guest_adoption_witness_test.dag b/dag/test/claim/host/provider_guest_adoption_witness_test.dag
new file mode 100644
index 00000000000..60a1b1f8ce4
--- /dev/null
+++ b/dag/test/claim/host/provider_guest_adoption_witness_test.dag
@@ -0,0 +1,242 @@
+module test.claim.provider_guest_adoption_witness
+
+import gunbc.secret_provision { fleet_secret_ref }
+import gunbc.provider_acquisition { ProviderApiAccount, ProviderResourceAcquisition, OperatorPerformed }
+import std.types { Bool, Int, NonEmptyStr, String }
+import std.decl_ref { decl_ref }
+import std.measure { kibibyte }
+import extdeps.toolchain.types { Aarch64, X86_64 }
+import extdeps.cloud.hetzner { cax41_catalog }
+import product.supplier.hetzner { hetzner_nuremberg_route }
+import gunbc.fleet_host_identity { operator_host_183527, operator_host_3dde7f, operator_host_srv1 }
+import gunbc.fleet_host_backing {
+  GuestEntitlement,
+  OwnedMachine,
+  BmcVirtualMediaInstall,
+  ProviderGuest,
+  ProviderResourceAwaited,
+  ProviderResourceAcquired,
+}
+import gunbc.hetzner_cloud_guest { hetzner_cloud_guest_entitlement }
+import gunbc.fleet_enrollment { HostEnrollmentIntent, ci_runner_enrollment_participation, enrollment_for_host }
+import gunbc.provider_guest_adoption {
+  GuestObservation,
+  GuestObservationRead,
+  GuestObserved,
+  GuestObservationRefused,
+  GuestAdopted,
+  GuestAdoptionRefused,
+  HostIsNotAProviderGuest,
+  ProviderResourceUnread,
+  GuestUnobserved,
+  GuestArchitectureDiverges,
+  GuestCpusExceedEntitlement,
+  GuestMemoryExceedsEntitlement,
+  GuestIsAnotherResource,
+  MicroVmExecutionAdmissible,
+  MicroVmExecutionRefused,
+  ProviderForbidsNestedVirtualization,
+  KvmDeviceAbsentOnGuest,
+  adopt_provider_guest,
+}
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+fn cax41_entitlement() -> GuestEntitlement {
+  hetzner_cloud_guest_entitlement(
+    row: cax41_catalog,
+    offer: decl_ref(module_path: "extdeps.cloud.hetzner", decl_name: "cax41_catalog"),
+  )
+}
+
+fn bound_guest(entitlement: GuestEntitlement) -> HostEnrollmentIntent {
+  HostEnrollmentIntent {
+    host: operator_host_183527,
+    participation: ci_runner_enrollment_participation,
+    backing: ProviderGuest {
+      route: hetzner_nuremberg_route(),
+      entitlement: entitlement,
+      resource: ProviderResourceAcquired { acquisition: ProviderResourceAcquisition {
+        resource_id: "60000001",
+        account: ProviderApiAccount { account: "fixture-project", api_credential: fleet_secret_ref(secret_id: "fixture-provider-api-key") },
+        account_established: OperatorPerformed { performed_on: "2026-10-08", relayed: "fixture" },
+        login_key_registered: OperatorPerformed { performed_on: "2026-10-08", relayed: "fixture" },
+        resource_acquired: OperatorPerformed { performed_on: "2026-10-08", relayed: "fixture" },
+      } },
+    },
+  }
+}
+
+// A CAX41 guest as a real one reads: 16 vCPUs, MemTotal a little under the 32 GiB offer because the
+// kernel reserves memory, no /dev/kvm.
+fn cax41_observed(resource: String, arch_is_arm: Bool, cpus: Int, mem_kib: Int, kvm: Bool) -> GuestObservationRead {
+  GuestObserved {
+    observation: GuestObservation {
+      provider_resource_id: resource,
+      kernel_hostname: "ubuntu-32gb-nbg1-1",
+      architecture: if arch_is_arm { Aarch64 } else { X86_64 },
+      online_cpus: cpus,
+      mem_total: kibibyte(count: mem_kib),
+      kvm_device_present: kvm,
+    },
+  }
+}
+
+// AN UNREAD RESOURCE REFUSES before any observation can be attributed to it, naming its obligation.
+test fn guest_refuses_until_its_resource_is_read() -> Bool {
+  let unread = HostEnrollmentIntent {
+    host: operator_host_3dde7f,
+    participation: ci_runner_enrollment_participation,
+    backing: ProviderGuest {
+      route: hetzner_nuremberg_route(),
+      entitlement: cax41_entitlement(),
+      resource: ProviderResourceAwaited { read_obligation: "read the server id of 'ubuntu-32gb-hel1-1'" },
+    },
+  }
+  match adopt_provider_guest(intent: unread, read: cax41_observed(resource: "60000001", arch_is_arm: true, cpus: 16, mem_kib: 32011268, kvm: false)) {
+    GuestAdoptionRefused { host: _, cause: ProviderResourceUnread { read_obligation: o } } =>
+      string_contains(s: o as String, pattern: "ubuntu-32gb-hel1-1")
+    GuestAdoptionRefused { host: _, cause: _ } => false
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+  }
+}
+
+// ADOPTED, AND REFUSED FOR MICROVM EXECUTION ON THE PROVIDER'S CITED FACT. The two answers are
+// separate: the guest is the machine we pay for, and the Firecracker path cannot run on it.
+test fn bound_cax_guest_is_adopted_with_microvm_execution_refused_by_the_provider() -> Bool {
+  match adopt_provider_guest(intent: bound_guest(entitlement: cax41_entitlement()), read: cax41_observed(resource: "60000001", arch_is_arm: true, cpus: 16, mem_kib: 32500000, kvm: false)) {
+    GuestAdopted { host: h, resource_id: id, observation: _, execution: MicroVmExecutionRefused { cause: ProviderForbidsNestedVirtualization { offer: o } } } =>
+      (h as String) == "host-183527" && (id as String) == "60000001" && (o.decl_name as String) == "cax41_catalog"
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+    GuestAdoptionRefused { host: _, cause: _ } => false
+  }
+}
+
+// THE PROVIDER DECIDES BEFORE THE OBSERVATION: a device node appearing on a guest whose offer forbids
+// nested virtualization does not admit the path.
+test fn provider_refusal_holds_even_if_a_kvm_node_is_observed() -> Bool {
+  match adopt_provider_guest(intent: bound_guest(entitlement: cax41_entitlement()), read: cax41_observed(resource: "60000001", arch_is_arm: true, cpus: 16, mem_kib: 32500000, kvm: true)) {
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: MicroVmExecutionRefused { cause: ProviderForbidsNestedVirtualization { offer: _ } } } => true
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+    GuestAdoptionRefused { host: _, cause: _ } => false
+  }
+}
+
+fn nested_capable(e: GuestEntitlement) -> GuestEntitlement {
+  GuestEntitlement {
+    offer: e.offer,
+    architecture: e.architecture,
+    vcpus: e.vcpus,
+    memory: e.memory,
+    disk: e.disk,
+    nested_virtualization: true,
+    self_identity_url: e.self_identity_url,
+  }
+}
+
+// WHERE THE PROVIDER PERMITS IT, THE OBSERVATION DECIDES -- both routes, so the KVM arm is exercised
+// rather than shadowed by the provider arm above.
+test fn kvm_observation_decides_when_the_provider_permits_nesting() -> Bool {
+  let present = match adopt_provider_guest(intent: bound_guest(entitlement: nested_capable(e: cax41_entitlement())), read: cax41_observed(resource: "60000001", arch_is_arm: true, cpus: 16, mem_kib: 32500000, kvm: true)) {
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: MicroVmExecutionAdmissible } => true
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+    GuestAdoptionRefused { host: _, cause: _ } => false
+  }
+  let absent = match adopt_provider_guest(intent: bound_guest(entitlement: nested_capable(e: cax41_entitlement())), read: cax41_observed(resource: "60000001", arch_is_arm: true, cpus: 16, mem_kib: 32500000, kvm: false)) {
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: MicroVmExecutionRefused { cause: KvmDeviceAbsentOnGuest { device: d } } } => d == "/dev/kvm"
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+    GuestAdoptionRefused { host: _, cause: _ } => false
+  }
+  present && absent
+}
+
+test fn more_vcpus_than_the_offer_refuses_as_a_different_resource() -> Bool {
+  match adopt_provider_guest(intent: bound_guest(entitlement: cax41_entitlement()), read: cax41_observed(resource: "60000001", arch_is_arm: true, cpus: 32, mem_kib: 32500000, kvm: false)) {
+    GuestAdoptionRefused { host: _, cause: GuestCpusExceedEntitlement { entitled: e, observed: o } } => e == 16 && o == 32
+    GuestAdoptionRefused { host: _, cause: _ } => false
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+  }
+}
+
+test fn more_memory_than_the_offer_refuses() -> Bool {
+  match adopt_provider_guest(intent: bound_guest(entitlement: cax41_entitlement()), read: cax41_observed(resource: "60000001", arch_is_arm: true, cpus: 16, mem_kib: 67108864, kvm: false)) {
+    GuestAdoptionRefused { host: _, cause: GuestMemoryExceedsEntitlement { entitled_bytes: _, observed_bytes: _ } } => true
+    GuestAdoptionRefused { host: _, cause: _ } => false
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+  }
+}
+
+test fn wrong_architecture_refuses() -> Bool {
+  match adopt_provider_guest(intent: bound_guest(entitlement: cax41_entitlement()), read: cax41_observed(resource: "60000001", arch_is_arm: false, cpus: 16, mem_kib: 32500000, kvm: false)) {
+    GuestAdoptionRefused { host: _, cause: GuestArchitectureDiverges { entitled: _, observed: _ } } => true
+    GuestAdoptionRefused { host: _, cause: _ } => false
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+  }
+}
+
+test fn unobserved_guest_refuses_with_the_reading_that_failed() -> Bool {
+  match adopt_provider_guest(intent: bound_guest(entitlement: cax41_entitlement()), read: GuestObservationRefused { reading: "uname -m", cause: "ssh: connect timed out" }) {
+    GuestAdoptionRefused { host: _, cause: GuestUnobserved { reading: r, cause: _ } } => (r as String) == "uname -m"
+    GuestAdoptionRefused { host: _, cause: _ } => false
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+  }
+}
+
+test fn owned_machine_is_not_adopted_as_a_guest() -> Bool {
+  let owned = HostEnrollmentIntent {
+    host: operator_host_srv1,
+    participation: ci_runner_enrollment_participation,
+    backing: OwnedMachine { provisioning: BmcVirtualMediaInstall },
+  }
+  match adopt_provider_guest(intent: owned, read: cax41_observed(resource: "60000001", arch_is_arm: true, cpus: 16, mem_kib: 32500000, kvm: false)) {
+    GuestAdoptionRefused { host: _, cause: HostIsNotAProviderGuest } => true
+    GuestAdoptionRefused { host: _, cause: _ } => false
+    GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+  }
+}
+
+// THE BOUND PRODUCTION ROW: the Nuremberg guest's server id is bound, so the same observation that
+// 2026-10-08's read returned (16 CPUs, MemTotal 32011264 kB, aarch64, no /dev/kvm) adopts it -- and
+// its microVM path is refused on the cited offer.
+test fn production_nuremberg_guest_adopts_with_its_bound_server_id() -> Bool {
+  match enrollment_for_host(host: operator_host_183527) {
+    Absent => false
+    Present { value: e } => match adopt_provider_guest(intent: e, read: cax41_observed(resource: "169308819", arch_is_arm: true, cpus: 16, mem_kib: 32011264, kvm: false)) {
+      GuestAdopted { host: _, resource_id: id, observation: _, execution: MicroVmExecutionRefused { cause: ProviderForbidsNestedVirtualization { offer: _ } } } =>
+        (id as String) == "169308819"
+      GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+      GuestAdoptionRefused { host: _, cause: _ } => false
+    }
+  }
+}
+
+test fn production_helsinki_guest_adopts_with_its_bound_server_id() -> Bool {
+  match enrollment_for_host(host: operator_host_3dde7f) {
+    Absent => false
+    Present { value: e } => match adopt_provider_guest(intent: e, read: cax41_observed(resource: "169308796", arch_is_arm: true, cpus: 16, mem_kib: 32011268, kvm: false)) {
+      GuestAdopted { host: _, resource_id: id, observation: _, execution: MicroVmExecutionRefused { cause: ProviderForbidsNestedVirtualization { offer: _ } } } =>
+        (id as String) == "169308796"
+      GuestAdopted { host: _, resource_id: _, observation: _, execution: _ } => false
+      GuestAdoptionRefused { host: _, cause: _ } => false
+    }
+  }
+}
+
+// RED: A GUEST OF THE SAME SHAPE THAT IS ANOTHER RESOURCE IS NOT ADOPTED. Two CAX41s present the same
+// architecture, vCPUs and memory, so only the provider's own answer to "which resource am I" tells
+// them apart: the Helsinki guest's metadata id offered for the Nuremberg enrollment refuses, naming both.
+test fn a_same_shaped_guest_reporting_another_resource_is_refused() -> Bool {
+  match enrollment_for_host(host: operator_host_183527) {
+    Absent => false
+    Present { value: e } => match adopt_provider_guest(intent: e, read: cax41_observed(resource: "169308796", arch_is_arm: true, cpus: 16, mem_kib: 32011264, kvm: false)) {
+      GuestAdoptionRefused { host: _, cause: GuestIsAnotherResource { enrolled: en, observed: ob } } => (en as String) == "169308819" && ob == "169308796"
+      _ => false
+    }
+  }
+}
+
+// THE IDENTITY READ IS THE PROVIDER'S METADATA SERVICE, from the entitlement the production roster binds.
+test fn the_cax_entitlement_reads_identity_from_hetzner_metadata() -> Bool {
+  cax41_entitlement().self_identity_url == "http://169.254.169.254/hetzner/v1/metadata/instance-id"
+}
diff --git a/dag/test/claim/host_credential_custody_converge_witness_test.dag b/dag/test/claim/host_credential_custody_converge_witness_test.dag
index d37b966d81f..1caf040825b 100644
--- a/dag/test/claim/host_credential_custody_converge_witness_test.dag
+++ b/dag/test/claim/host_credential_custody_converge_witness_test.dag
@@ -77,6 +77,23 @@ import gunbc.host_credential_custody_converge {
   admit_staging_cleanup,
   StagingCleanupAuthorized,
   StagingCleanupWithheld,
+  CursorWorkerTurnApiKey,
+  CodexWorkerTurnAuth,
+  CustodyAnyRunnerHost,
+  CustodyOnlyOnHost,
+  CustodyHostAuthoritativeNotSingleHost,
+  CustodyWriteBackToStore,
+  CustodyRepairMetadataInPlace,
+  CustodyCreateOnly,
+  host_authoritative_custody_action,
+}
+import std.types { Secret }
+import gunbc.codex_harness_credential {
+  CodexHarnessWriteBackNotOwed,
+  CodexHarnessWriteBackOwed,
+  CodexHarnessWriteBackRefused,
+  CodexHarnessReadBackAccountChanged,
+  codex_worker_turn_custody_host,
 }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
@@ -481,3 +498,138 @@ test fn protected_state_key_has_operator_group_custody_outside_job_trees() -> Bo
     && (d.ownership.user as String) == "root" && (d.ownership.group as String) == "briansrls"
     && placed(row: row)
 }
+
+// ── worker-turn credentials (node adhoc-932f2935-e8e) ───────────────────────────────────────────
+
+// THE CODEX ROW CANNOT BE SPREAD. The same row with its scope widened to any runner host is refused
+// at placement, so a second host can never receive the store's lagging copy of a token codex rotated.
+// The control is the row as declared, which places.
+test fn a_host_authoritative_row_on_any_runner_host_is_refused_at_placement() -> Bool {
+  let row = host_credential_custody_row(c: CodexWorkerTurnAuth)
+  let widened = HostCredentialCustodyRow {
+    credential: row.credential, secret: row.secret, path: row.path,
+    host_scope: CustodyAnyRunnerHost,
+    file_ownership: row.file_ownership, file_mode: row.file_mode,
+    dir_ownership: row.dir_ownership, dir_mode: row.dir_mode,
+  }
+  let refused = match custody_row_placement(row: widened) {
+    CustodyPlacementRefused { cause } =>
+      match cause {
+        CustodyHostAuthoritativeNotSingleHost { path: _ } => true
+        _ => false
+      }
+    CustodyPlaced { row: _, key_dir: _, upper_ancestors: _ } => false
+  }
+  let declared_places = match custody_row_placement(row: row) {
+    CustodyPlaced { row: _, key_dir: kd, upper_ancestors: _ } => (kd as String) == "/etc/gunbc-codex-harness"
+    CustodyPlacementRefused { cause: _ } => false
+  }
+  refused && declared_places
+}
+
+// A store-authoritative row widened the same way still places: the refusal is about authority, not
+// about the worker-turn rows.
+test fn a_store_authoritative_row_on_any_runner_host_still_places() -> Bool {
+  let row = host_credential_custody_row(c: CursorWorkerTurnApiKey)
+  let widened = HostCredentialCustodyRow {
+    credential: row.credential, secret: row.secret, path: row.path,
+    host_scope: CustodyAnyRunnerHost,
+    file_ownership: row.file_ownership, file_mode: row.file_mode,
+    dir_ownership: row.dir_ownership, dir_mode: row.dir_mode,
+  }
+  match custody_row_placement(row: widened) {
+    CustodyPlaced { row: _, key_dir: _, upper_ancestors: _ } => true
+    CustodyPlacementRefused { cause: _ } => false
+  }
+}
+
+test fn the_codex_row_is_delivered_only_to_its_custody_host() -> Bool {
+  let row = host_credential_custody_row(c: CodexWorkerTurnAuth)
+  let other = match custody_host_admission(row: row, host: "srv1" as HostIdentity) {
+    CustodyHostRefused { cause: _ } => true
+    CustodyHostAdmitted => false
+  }
+  let own = match custody_host_admission(row: row, host: codex_worker_turn_custody_host) {
+    CustodyHostAdmitted => true
+    CustodyHostRefused { cause: _ } => false
+  }
+  other && own && (codex_worker_turn_custody_host as String) == (operator_host_srv2 as String)
+}
+
+// THE DISCRIMINATING PAIR FOR A DIFFERING HOST FILE. The store-authoritative decision for differing
+// bytes is CustodyWrite, which would put a spent token back. Host-authoritative: a file whose refresh
+// token did not move is LEFT (it is only fresher in short-lived tokens), and one whose refresh token
+// moved is written BACK to the store, never overwritten.
+test fn a_differing_host_file_is_left_or_written_back_never_overwritten() -> Bool {
+  let base = custody_action(dir: CustodyPathAsDeclared, upper_ancestors: PathsRootOnly, content: HostFileDiffers, file: CustodyPathAsDeclared)
+  let base_writes = match base {
+    CustodyWrite => true
+    _ => false
+  }
+  let left = match host_authoritative_custody_action(base: base, content: HostFileDiffers, decision: Present { value: CodexHarnessWriteBackNotOwed }) {
+    CustodyLeaveInPlace => true
+    _ => false
+  }
+  let written_back = match host_authoritative_custody_action(
+    base: base, content: HostFileDiffers,
+    decision: Present { value: CodexHarnessWriteBackOwed { payload: "{\"auth_mode\":\"chatgpt\"}" as Secret } },
+  ) {
+    CustodyWriteBackToStore { payload: _ } => true
+    _ => false
+  }
+  base_writes && left && written_back
+}
+
+test fn a_host_file_naming_another_account_refuses() -> Bool {
+  let base = custody_action(dir: CustodyPathAsDeclared, upper_ancestors: PathsRootOnly, content: HostFileDiffers, file: CustodyPathAsDeclared)
+  match host_authoritative_custody_action(
+    base: base, content: HostFileDiffers,
+    decision: Present { value: CodexHarnessWriteBackRefused { cause: CodexHarnessReadBackAccountChanged { materialized: "acct-a" as NonEmptyStr, read_back: "acct-b" as NonEmptyStr } } },
+  ) {
+    CustodyActionRefused { reason: _ } => true
+    _ => false
+  }
+}
+
+// An absent host file is placed from the store CREATE-ONLY (first placement), and a directory that is not as
+// declared still refuses before anything: the host-authoritative layer only changes the differing arm.
+test fn absent_host_file_is_placed_and_a_bad_directory_still_refuses() -> Bool {
+  let absent_base = custody_action(dir: CustodyPathAsDeclared, upper_ancestors: PathsRootOnly, content: gunbc.runner_host_file_converge.HostFileAbsent, file: CustodyPathAbsent)
+  let placed = match host_authoritative_custody_action(base: absent_base, content: gunbc.runner_host_file_converge.HostFileAbsent, decision: none) {
+    CustodyCreateOnly => true
+    _ => false
+  }
+  let bad_dir = custody_action(dir: CustodyPathForbiddenBits, upper_ancestors: PathsRootOnly, content: HostFileDiffers, file: CustodyPathAsDeclared)
+  let still_refused = match host_authoritative_custody_action(base: bad_dir, content: HostFileDiffers, decision: Present { value: CodexHarnessWriteBackNotOwed }) {
+    CustodyActionRefused { reason: _ } => true
+    _ => false
+  }
+  placed && still_refused
+}
+
+// THE METADATA-REPAIR ROUTE (side-chat P2). Identical bytes with a wrong owner or mode make the
+// ordinary decision CustodyWrite, whose store-to-host content write renames the STORE bytes over the
+// live file outside the codex turn lock and would lose a refresh that landed in between. A
+// host-authoritative row must repair the metadata in place instead, and a store-authoritative row
+// keeps the ordinary rewrite.
+test fn a_host_authoritative_file_with_wrong_metadata_is_repaired_in_place_never_rewritten() -> Bool {
+  let base = custody_action(dir: CustodyPathAsDeclared, upper_ancestors: PathsRootOnly, content: HostFileIdentical, file: CustodyPathForbiddenBits)
+  let ordinary_rewrites = match base {
+    CustodyWrite => true
+    _ => false
+  }
+  let repaired = match host_authoritative_custody_action(base: base, content: HostFileIdentical, decision: none) {
+    CustodyRepairMetadataInPlace => true
+    _ => false
+  }
+  ordinary_rewrites && repaired
+}
+
+// A file that is already declared is untouched, host-authoritative or not.
+test fn a_declared_host_authoritative_file_is_left_in_place() -> Bool {
+  let base = custody_action(dir: CustodyPathAsDeclared, upper_ancestors: PathsRootOnly, content: HostFileIdentical, file: CustodyPathAsDeclared)
+  match host_authoritative_custody_action(base: base, content: HostFileIdentical, decision: none) {
+    CustodyLeaveInPlace => true
+    _ => false
+  }
+}
diff --git a/dag/test/claim/host_kernel_boot_selection_witness_test.dag b/dag/test/claim/host_kernel_boot_selection_witness_test.dag
new file mode 100644
index 00000000000..8cb100ec301
--- /dev/null
+++ b/dag/test/claim/host_kernel_boot_selection_witness_test.dag
@@ -0,0 +1,16 @@
+module test.claim.host_kernel_boot_selection_witness_test
+
+import std.types { Bool, String }
+import gunbc.host_kernel_boot_selection { kernel_maintenance_grub_selects }
+
+test fn activation_requires_exact_boot_images_and_no_pending_override() -> Bool {
+  let next_entry_reference = "$\{next_entry}"
+  let config = join(["if [ \"", next_entry_reference, "\" ] ; then\n set default=\"", next_entry_reference,
+    "\"\nelse\n set default=\"0\"\nfi\nmenuentry 'Ubuntu' {\n\tlinux\t/vmlinuz-7.0.0-38-generic root=UUID=fixture ro\n\tinitrd\t/initrd.img-7.0.0-38-generic\n}\n"], "")
+  kernel_maintenance_grub_selects(config: config, environment: "# GRUB Environment Block\n", target: "7.0.0-38-generic")
+    && !kernel_maintenance_grub_selects(config: config, environment: "next_entry=old-kernel\n", target: "7.0.0-38-generic")
+    && !kernel_maintenance_grub_selects(config: config, environment: "initrdfail=1\nprev_entry=old\n", target: "7.0.0-38-generic")
+    && !kernel_maintenance_grub_selects(config: config, environment: "", target: "6.8.0-138-generic")
+    && !kernel_maintenance_grub_selects(config: concat(config, "set default=\"2\"\n"), environment: "", target: "7.0.0-38-generic")
+    && !kernel_maintenance_grub_selects(config: "", environment: "", target: "7.0.0-38-generic")
+}
diff --git a/dag/test/claim/host_kernel_dependency_witness_test.dag b/dag/test/claim/host_kernel_dependency_witness_test.dag
new file mode 100644
index 00000000000..6d97224ddb5
--- /dev/null
+++ b/dag/test/claim/host_kernel_dependency_witness_test.dag
@@ -0,0 +1,145 @@
+module test.claim.host_kernel_dependency_witness_test
+
+import std.types { Bool, String, NonEmptyStr, CommitSha }
+import std.content_hash { serialize_content_hash }
+import std.upsert_decision { Noop, Apply, Refuse }
+import extdeps.linux.kernel { LinuxKernelRelease }
+import extdeps.linux.tun_fdinfo { TunQueuesAttached, TunQueuesRefused, TunCensusQueueCountUnsupported, TunCensusQueueCountUnreadable, TunCensusReaderNotRoot, TunCensusMultiQueue, tun_attached_queue_requirement }
+import extdeps.shell.exec { ProcessObservation }
+import gunbc.fleet_host_identity { operator_host_srv1 }
+import gunbc.runner_slot_allocation { workspace_execution_slot_identities }
+import gunbc.runner_microvm_network_sanitation_observe { slot_network_tun_queue_requirement }
+import gunbc.host_kernel_dependency {
+  UbuntuTunKernelProvider, HostKernelDependencyPlan, InstallKernelAndActivate, ActivateInstalledKernel,
+  HostKernelDependencyPlanned, HostKernelDependencyRefused,
+  KernelPackageExact, KernelPackageNeedsInstall, KernelPackageReadRefused,
+  tun_kernel_provider_for_host, tun_kernel_capability_decision, kernel_package_reading,
+  kernel_package_readings_join, host_kernel_dependency_plan, host_kernel_maintenance_capability,
+}
+import gunbc.host_kernel_dependency_observe { kernel_provider_platform_admits, kernel_provider_candidate_admits }
+import gunbc.host_kernel_dependency_wire { host_kernel_dependency_text, host_kernel_dependency_from_text }
+import gunbc.fleet_converge_plan {
+  WorkspaceCommissioningDependencyConverge, fleet_converge_plan_artifact_of_request,
+  fleet_converge_apply_artifact_admits, ApplyAwaitingCapability,
+}
+import gunbc.fleet_converge_terminal { AwaitingCapability }
+import gunbc.workspace_commissioning_executor_plan { workspace_executor_scope_wire }
+
+// SUPPLIED AT THE BOUNDARY: observations below are adversarial inputs to the production
+// dependency fold, not evidence about this machine. Actual ioctl execution has its own wet
+// witness, and the installed privileged commissioning entry is exercised on srv1.
+fn kernel_fixture_provider() -> UbuntuTunKernelProvider {
+  UbuntuTunKernelProvider { package: "linux-generic-hwe-24.04", version: "7.0.0-38.38~24.04.4",
+    architecture: "arm64", kernel_release: "7.0.0-38-generic" as LinuxKernelRelease }
+}
+
+fn kernel_fixture_plan() -> HostKernelDependencyPlan {
+  HostKernelDependencyPlan { host: operator_host_srv1,
+    source_revision: "0123456789abcdef0123456789abcdef01234567" as CommitSha,
+    requirement: tun_attached_queue_requirement(name: "gunbc-tap13"),
+    running_release: "6.8.0-138-generic" as LinuxKernelRelease, boot_id: "old-boot",
+    provider: kernel_fixture_provider(), remedy: InstallKernelAndActivate,
+    package_simulation: "Inst linux-generic-hwe-24.04 (7.0.0-38.38~24.04.4 Ubuntu:24.04/noble-updates [arm64])\n" }
+}
+
+test fn a_supported_query_never_demands_a_kernel_even_when_the_tap_is_held() -> Bool {
+  all([0, 1, 8], count => match tun_kernel_capability_decision(
+    requirement: tun_attached_queue_requirement(name: "gunbc-tap13"), reading: TunQueuesAttached { count: count }) {
+    Noop => true other => false
+  })
+}
+
+test fn only_unsupported_demands_the_selected_sanitation_operation() -> Bool {
+  let requirement = tun_attached_queue_requirement(name: "gunbc-tap13")
+  (match tun_kernel_capability_decision(requirement: requirement, reading: TunQueuesRefused { cause: TunCensusQueueCountUnsupported }) {
+    Apply { plan } => plan == requirement other => false
+  }) && all([TunCensusQueueCountUnreadable { cause: "permission denied" }, TunCensusReaderNotRoot { euid: 1000 }, TunCensusMultiQueue], cause =>
+    match tun_kernel_capability_decision(requirement: requirement, reading: TunQueuesRefused { cause: cause }) {
+      Refuse { reason: _ } => true other => false
+    })
+}
+
+test fn installed_packages_select_activation_and_absent_packages_select_installation() -> Bool {
+  let p = kernel_fixture_plan()
+  (match host_kernel_dependency_plan(host: p.host, revision: p.source_revision, requirement: p.requirement,
+    running_release: p.running_release, boot_id: p.boot_id, provider: p.provider, packages: KernelPackageExact, simulation: "") {
+    HostKernelDependencyPlanned { plan } => plan.remedy == ActivateInstalledKernel other => false
+  }) && (match host_kernel_dependency_plan(host: p.host, revision: p.source_revision, requirement: p.requirement,
+    running_release: p.running_release, boot_id: p.boot_id, provider: p.provider, packages: KernelPackageNeedsInstall, simulation: p.package_simulation) {
+    HostKernelDependencyPlanned { plan } => plan.remedy == InstallKernelAndActivate other => false
+  }) && (match host_kernel_dependency_plan(host: p.host, revision: p.source_revision, requirement: p.requirement,
+    running_release: p.provider.kernel_release, boot_id: p.boot_id, provider: p.provider, packages: KernelPackageExact, simulation: "") {
+    HostKernelDependencyRefused { reason: _ } => true other => false
+  })
+}
+
+fn kernel_fixture_package_record() -> String {
+  "Package: linux-generic-hwe-24.04\nStatus: install ok installed\nArchitecture: arm64\nVersion: 7.0.0-38.38~24.04.4\n"
+}
+
+test fn package_identity_and_read_failures_cannot_become_absence() -> Bool {
+  let p = kernel_fixture_provider()
+  (match kernel_package_reading(package: p.package, provider: p,
+    reading: ProcessObservation { exit_code: 0, stdout: kernel_fixture_package_record(), stderr: "" }) {
+    KernelPackageExact => true other => false
+  }) && (match kernel_package_reading(package: p.package, provider: p,
+    reading: ProcessObservation { exit_code: 1, stdout: "", stderr: "dpkg-query: no information is available about package linux-generic-hwe-24.04" }) {
+    KernelPackageNeedsInstall => true other => false
+  }) && all([
+    "", "Status: hold ok not-installed\n",
+    "Package: linux-generic-hwe-24.04\nStatus: install ok installed\nArchitecture: amd64\nVersion: 7.0.0-38.38~24.04.4\n",
+    "Package: linux-generic-hwe-24.04\nStatus: install ok installed\nArchitecture: arm64\nVersion: 7.1.0\n",
+    concat(kernel_fixture_package_record(), "Version: 7.0.0-38.38~24.04.4\n"),
+  ], record => match kernel_package_reading(package: p.package, provider: p,
+    reading: ProcessObservation { exit_code: 0, stdout: record, stderr: "" }) {
+    KernelPackageReadRefused { reason: _ } => true other => false
+  }) && (match kernel_package_reading(package: p.package, provider: p,
+    reading: ProcessObservation { exit_code: 1, stdout: "", stderr: "permission denied" }) {
+    KernelPackageReadRefused { reason: _ } => true other => false
+  }) && (match kernel_package_readings_join(provider: p, readings: [KernelPackageExact, KernelPackageExact]) {
+    KernelPackageReadRefused { reason: _ } => true other => false
+  }) && (match kernel_package_readings_join(provider: p, readings: [KernelPackageNeedsInstall, KernelPackageReadRefused { reason: "denied" }, KernelPackageExact]) {
+    KernelPackageReadRefused { reason: _ } => true other => false
+  })
+}
+
+test fn kernel_provider_is_bound_to_platform_and_exact_package_metadata() -> Bool {
+  let p = kernel_fixture_provider()
+  tun_kernel_provider_for_host(host: operator_host_srv1) == Present { value: p }
+    && kernel_provider_platform_admits(os_release: "ID=ubuntu\nVERSION_ID=\"24.04\"\n", machine: "aarch64", provider: p)
+    && !kernel_provider_platform_admits(os_release: "ID=ubuntu\nVERSION_ID=24.04\n", machine: "x86_64", provider: p)
+    && !kernel_provider_platform_admits(os_release: "ID=debian\nVERSION_ID=24.04\n", machine: "aarch64", provider: p)
+    && !kernel_provider_platform_admits(os_release: "ID=ubuntu\nID=ubuntu\nVERSION_ID=24.04\n", machine: "aarch64", provider: p)
+    && kernel_provider_candidate_admits(provider: p, record: kernel_fixture_package_record())
+    && !kernel_provider_candidate_admits(provider: p, record: concat(kernel_fixture_package_record(), "Architecture: arm64\n"))
+}
+
+test fn dependency_response_is_bound_to_host_source_and_actual_operation() -> Bool {
+  let p = kernel_fixture_plan()
+  let wire = host_kernel_dependency_text(plan: p)
+  host_kernel_dependency_from_text(text: wire, host: p.host, revision: p.source_revision, requirement: p.requirement) == Present { value: p }
+    && host_kernel_dependency_from_text(text: concat(wire, "\n"), host: p.host, revision: p.source_revision, requirement: p.requirement) == none
+    && host_kernel_dependency_from_text(text: wire, host: p.host, revision: "1123456789abcdef0123456789abcdef01234567" as CommitSha, requirement: p.requirement) == none
+    && host_kernel_dependency_from_text(text: wire, host: p.host, revision: p.source_revision, requirement: tun_attached_queue_requirement(name: "gunbc-tap12")) == none
+}
+
+// Production fleet artifact and admission, not a second renderer. Pending host work cannot
+// produce a commissioning credential, an admitted apply, or a successful apply terminal.
+test fn commissioning_plan_exposes_the_dependency_without_publishing_readiness() -> Bool {
+  let request = WorkspaceCommissioningDependencyConverge { plan: kernel_fixture_plan() }
+  let artifact = fleet_converge_plan_artifact_of_request(request: request, prior_generation: 20)
+  (match artifact.apply_terminal { AwaitingCapability { capability } => capability == host_kernel_maintenance_capability other => false })
+    && string_contains(s: artifact.plan_body, pattern: "install-package:linux-generic-hwe-24.04=7.0.0-38.38~24.04.4")
+    && string_contains(s: artifact.plan_body, pattern: "activate-kernel:7.0.0-38-generic")
+    && !string_contains(s: artifact.plan_body, pattern: "commissioning-credential:")
+    && !string_contains(s: artifact.apply_shell, pattern: "apt-get")
+    && !string_contains(s: artifact.apply_shell, pattern: "systemctl reboot")
+    && (match fleet_converge_apply_artifact_admits(planned_host_text: "srv1", planned_scope_wire: workspace_executor_scope_wire,
+      planned_fingerprint_text: serialize_content_hash(hash: artifact.subject.member_set_fingerprint), observed: request) {
+      ApplyAwaitingCapability { capability } => capability == host_kernel_maintenance_capability other => false
+    })
+    && (match filter(workspace_execution_slot_identities(), slot => slot.host == "srv1").first() {
+      Present { value: slot } => slot_network_tun_queue_requirement(slot: slot) == kernel_fixture_plan().requirement
+      Absent => false
+    })
+}
diff --git a/dag/test/claim/host_kernel_maintenance_witness_test.dag b/dag/test/claim/host_kernel_maintenance_witness_test.dag
new file mode 100644
index 00000000000..0097d667180
--- /dev/null
+++ b/dag/test/claim/host_kernel_maintenance_witness_test.dag
@@ -0,0 +1,81 @@
+module test.claim.host_kernel_maintenance_witness_test
+
+import std.types { Bool, String, NonEmptyStr, CommitSha }
+import extdeps.linux.kernel { LinuxKernelRelease }
+import extdeps.linux.tun_fdinfo { tun_attached_queue_requirement }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2 }
+import gunbc.host_kernel_dependency { HostKernelDependencyPlan, UbuntuTunKernelProvider, InstallKernelAndActivate, ActivateInstalledKernel }
+import gunbc.host_kernel_dependency_wire { host_kernel_dependency_text }
+import gunbc.host_kernel_dependency_apply {
+  kernel_maintenance_plan_continues, kernel_maintenance_plan_read, kernel_maintenance_runner_units,
+  kernel_maintenance_unit_readback_admits, KernelDrain, KernelInstall, KernelActivate,
+}
+import gunbc.runner_slot_retirement { CgroupAbsent, CgroupObservedEmpty, CgroupObservedPopulated, CgroupUnobserved }
+
+fn maintenance_fixture() -> HostKernelDependencyPlan {
+  HostKernelDependencyPlan { host: operator_host_srv1,
+    source_revision: "0123456789abcdef0123456789abcdef01234567" as CommitSha,
+    requirement: tun_attached_queue_requirement(name: "gunbc-tap13"),
+    running_release: "6.8.0-138-generic" as LinuxKernelRelease, boot_id: "old-boot",
+    provider: UbuntuTunKernelProvider { package: "linux-generic-hwe-24.04", version: "7.0.0-38.38~24.04.4",
+      architecture: "arm64", kernel_release: "7.0.0-38-generic" as LinuxKernelRelease },
+    remedy: InstallKernelAndActivate, package_simulation: "reviewed exact package transaction" }
+}
+
+fn maintenance_with_state(plan: HostKernelDependencyPlan, boot: String, installed: Bool, simulation: String) -> HostKernelDependencyPlan {
+  HostKernelDependencyPlan { host: plan.host, source_revision: plan.source_revision,
+    requirement: plan.requirement, running_release: plan.running_release, boot_id: boot as NonEmptyStr,
+    provider: plan.provider, remedy: if installed { ActivateInstalledKernel } else { InstallKernelAndActivate },
+    package_simulation: simulation }
+}
+
+test fn installed_readback_can_continue_the_reviewed_plan_without_reinstalling() -> Bool {
+  let plan = maintenance_fixture()
+  let after = maintenance_with_state(plan: plan, boot: "old-boot", installed: true, simulation: "")
+  kernel_maintenance_plan_continues(reviewed: plan, current: after, action: KernelInstall)
+    && kernel_maintenance_plan_continues(reviewed: plan, current: after, action: KernelActivate)
+    && !kernel_maintenance_plan_continues(reviewed: plan, current: after, action: KernelDrain)
+}
+
+test fn a_different_boot_or_changed_package_transaction_refuses() -> Bool {
+  let plan = maintenance_fixture()
+  !kernel_maintenance_plan_continues(reviewed: plan,
+    current: maintenance_with_state(plan: plan, boot: "another-boot", installed: true, simulation: ""), action: KernelActivate)
+    && !kernel_maintenance_plan_continues(reviewed: plan,
+      current: maintenance_with_state(plan: plan, boot: "old-boot", installed: false, simulation: "different package transaction"), action: KernelInstall)
+}
+
+test fn maintenance_reads_the_real_canonical_dependency_and_refuses_unknown_fields() -> Bool {
+  let text = host_kernel_dependency_text(plan: maintenance_fixture())
+  (match kernel_maintenance_plan_read(text: text) { Present { value: plan } => plan == maintenance_fixture() Absent => false })
+    && (match kernel_maintenance_plan_read(text: concat(text, "\n")) { Present { value: _ } => false Absent => true })
+    && (match kernel_maintenance_plan_read(text: "{}") { Present { value: _ } => false Absent => true })
+}
+
+test fn runner_census_includes_loaded_historical_slots_not_only_desired_width() -> Bool {
+  match kernel_maintenance_runner_units(host: operator_host_srv1,
+    text: "actions-runner@srv1-01.service loaded active running Runner\nactions-runner@srv1-21.service masked inactive dead Runner\n") {
+    Present { value: units } => units == ["actions-runner@srv1-01.service", "actions-runner@srv1-21.service"]
+    Absent => false
+  }
+}
+
+test fn runner_census_refuses_foreign_empty_duplicate_and_malformed_populations() -> Bool {
+  all(["", "actions-runner@srv2-01.service loaded active running Runner\n",
+    "actions.runner.foreign.service loaded active running Runner\n",
+    "actions-runner@srv1-01.service loaded active running Runner\nactions-runner@srv1-01.service loaded active running Runner\n",
+    "unreadable\n"], text => match kernel_maintenance_runner_units(host: operator_host_srv1, text: text) {
+      Present { value: _ } => false Absent => true
+    })
+}
+
+test fn drain_requires_inhibition_stopped_service_no_job_and_empty_subtree() -> Bool {
+  all([CgroupAbsent, CgroupObservedEmpty], occupancy => kernel_maintenance_unit_readback_admits(
+    state: "inactive", mask: "masked-runtime", job: "", require_mask: true, occupancy: occupancy))
+    && all([CgroupObservedPopulated, CgroupUnobserved { cause: "permission denied" }], occupancy =>
+      !kernel_maintenance_unit_readback_admits(state: "inactive", mask: "masked-runtime", job: "", require_mask: true, occupancy: occupancy))
+    && all(["active", "activating", "deactivating", "reloading", "unknown", ""], state =>
+      !kernel_maintenance_unit_readback_admits(state: state, mask: "masked-runtime", job: "", require_mask: true, occupancy: CgroupAbsent))
+    && !kernel_maintenance_unit_readback_admits(state: "inactive", mask: "enabled", job: "", require_mask: true, occupancy: CgroupAbsent)
+    && !kernel_maintenance_unit_readback_admits(state: "inactive", mask: "masked", job: "123", require_mask: true, occupancy: CgroupAbsent)
+}
diff --git a/dag/test/claim/hostname_allocation_witness_test.dag b/dag/test/claim/hostname_allocation_witness_test.dag
index e8e231ae053..2ac00c8358c 100644
--- a/dag/test/claim/hostname_allocation_witness_test.dag
+++ b/dag/test/claim/hostname_allocation_witness_test.dag
@@ -5,7 +5,34 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 fn allocation_fixture(slot: String, hostname: String) -> HostnameAllocation {
   HostnameAllocation {
     fleet_slot: slot as HostIdentity,
-    canonical_hostname: hostname as DnsLabel,
+    name: LegacyHostname { label: hostname as DnsLabel },
+  }
+}
+
+fn drawn_fixture(slot: String, name: HumanName, entropy: Int) -> HostnameAllocation {
+  HostnameAllocation {
+    fleet_slot: slot as HostIdentity,
+    name: DrawnHumanName { name: name, draw: HumanNameDraw { entropy: entropy } },
+  }
+}
+
+fn human_name_eq(a: HumanName, b: HumanName) -> Bool {
+  (human_name_canonical_hostname(name: a) as String) == (human_name_canonical_hostname(name: b) as String)
+}
+
+type RecordedDrawCheck {
+  prior: List<HostnameAllocation>
+  reproduced: Bool
+}
+
+fn recorded_draw_reproduces(row: HostnameAllocation, prior: List<HostnameAllocation>) -> Bool {
+  match row.name {
+    LegacyHostname { label: _ } => true
+    DrawnHumanName { name: recorded, draw: d } => match draw_human_name(draw: d, existing: prior) {
+      HumanNameDrawn { name: drawn } => human_name_eq(a: drawn, b: recorded)
+      HumanNameDrawExhausted { entropy: _, taken_forms: _ } => false
+      HumanNameDrawRefused { reason: _ } => false
+    }
   }
 }
 
@@ -101,3 +128,109 @@ test fn witness_lookup_of_unallocated_slot_is_absent_not_reconstructed() -> Bool
     Present { value: _ } => false
   }
 }
+
+// THE RECORDED NAMES ARE THE ALLOCATOR'S, NOT HAND-PICKED. Every drawn row in the production roster
+// is re-drawn by the real allocator against the rows allocated before it, and must yield exactly the
+// recorded name; at least one drawn row must exist, so an empty set cannot pass vacuously.
+test fn witness_every_recorded_draw_is_what_the_allocator_yields() -> Bool {
+  let drawn = filter(gunbc_fleet_hostname_allocations, r => match r.name {
+    DrawnHumanName { name: _, draw: _ } => true
+    LegacyHostname { label: _ } => false
+  })
+  let check = fold_list(
+    xs: gunbc_fleet_hostname_allocations,
+    empty: RecordedDrawCheck { prior: [], reproduced: true },
+    cons: fn(acc, r) {
+      RecordedDrawCheck {
+        prior: append(acc.prior, [r]),
+        reproduced: acc.reproduced && recorded_draw_reproduces(row: r, prior: acc.prior),
+      }
+    }
+  )
+  drawn.length() >= 2 && check.reproduced
+}
+
+// A collision lengthens the SAME name. 707054856316 draws damien / energy / risotto; with "damien"
+// already answered to, the allocator must yield damien-energy, and with that taken too,
+// damien-risotto-energy -- never a different first name.
+test fn witness_collision_lengthens_the_drawn_name() -> Bool {
+  let d = HumanNameDraw { entropy: 707054856316 }
+  let taken_first = [allocation_fixture(slot: "a", hostname: "damien")]
+  let taken_two = append(taken_first, [allocation_fixture(slot: "b", hostname: "damien-energy")])
+  let one = match draw_human_name(draw: d, existing: []) {
+    HumanNameDrawn { name: n } => (human_name_canonical_hostname(name: n) as String) == "damien"
+    HumanNameDrawExhausted { entropy: _, taken_forms: _ } => false
+    HumanNameDrawRefused { reason: _ } => false
+  }
+  let two = match draw_human_name(draw: d, existing: taken_first) {
+    HumanNameDrawn { name: n } => (human_name_canonical_hostname(name: n) as String) == "damien-energy"
+    HumanNameDrawExhausted { entropy: _, taken_forms: _ } => false
+    HumanNameDrawRefused { reason: _ } => false
+  }
+  let three = match draw_human_name(draw: d, existing: taken_two) {
+    HumanNameDrawn { name: n } => (human_name_canonical_hostname(name: n) as String) == "damien-risotto-energy"
+    HumanNameDrawExhausted { entropy: _, taken_forms: _ } => false
+    HumanNameDrawRefused { reason: _ } => false
+  }
+  one && two && three
+}
+
+test fn witness_exhausted_draw_refuses_rather_than_suffixing() -> Bool {
+  let taken = [
+    allocation_fixture(slot: "a", hostname: "damien"),
+    allocation_fixture(slot: "b", hostname: "damien-energy"),
+    allocation_fixture(slot: "c", hostname: "damien-risotto-energy"),
+  ]
+  match draw_human_name(draw: HumanNameDraw { entropy: 707054856316 }, existing: taken) {
+    HumanNameDrawExhausted { entropy: e, taken_forms: forms } => e == 707054856316 && forms.length() == 3
+    HumanNameDrawn { name: _ } => false
+    HumanNameDrawRefused { reason: _ } => false
+  }
+}
+
+// Stable identity, drawn name and (legacy) hostname all differ, and each resolves to the same host.
+test fn witness_identity_and_name_resolve_to_one_host() -> Bool {
+  let by_name = match resolve_host_selector(selector: "damien") {
+    HostSelectorResolved { host: h } => (h as String) == (operator_host_183527 as String)
+    HostSelectorAmbiguous { selector: _, candidates: _ } => false
+    HostSelectorUnknown { selector: _ } => false
+  }
+  let by_identity = match resolve_host_selector(selector: "host-183527") {
+    HostSelectorResolved { host: h } => (h as String) == (operator_host_183527 as String)
+    HostSelectorAmbiguous { selector: _, candidates: _ } => false
+    HostSelectorUnknown { selector: _ } => false
+  }
+  let legacy = match resolve_host_selector(selector: "srv3") {
+    HostSelectorResolved { host: h } => (h as String) == (operator_host_srv3 as String)
+    HostSelectorAmbiguous { selector: _, candidates: _ } => false
+    HostSelectorUnknown { selector: _ } => false
+  }
+  by_name && by_identity && legacy
+}
+
+test fn witness_ambiguous_short_name_selects_nothing() -> Bool {
+  let roster = [
+    drawn_fixture(slot: "x1", name: FirstLast { first: "ada" as DnsLabel, last: "smith" as DnsLabel }, entropy: 1),
+    drawn_fixture(slot: "x2", name: FirstLast { first: "ada" as DnsLabel, last: "jones" as DnsLabel }, entropy: 2),
+  ]
+  let short = match resolve_host_selector_in(allocations: roster, selector: "ada") {
+    HostSelectorAmbiguous { selector: _, candidates: c } =>
+      c.length() == 2 && any(c, x => (x as String) == "ada-smith") && any(c, x => (x as String) == "ada-jones")
+    HostSelectorResolved { host: _ } => false
+    HostSelectorUnknown { selector: _ } => false
+  }
+  let full = match resolve_host_selector_in(allocations: roster, selector: "ada-jones") {
+    HostSelectorResolved { host: h } => (h as String) == "x2"
+    HostSelectorAmbiguous { selector: _, candidates: _ } => false
+    HostSelectorUnknown { selector: _ } => false
+  }
+  short && full
+}
+
+test fn witness_unknown_selector_is_unknown() -> Bool {
+  match resolve_host_selector(selector: "nobody-here") {
+    HostSelectorUnknown { selector: s } => s == "nobody-here"
+    HostSelectorResolved { host: _ } => false
+    HostSelectorAmbiguous { selector: _, candidates: _ } => false
+  }
+}
diff --git a/dag/test/claim/ilm4926_designation_witness_test.dag b/dag/test/claim/ilm4926_designation_witness_test.dag
index 31acc329976..0db87a8e77d 100644
--- a/dag/test/claim/ilm4926_designation_witness_test.dag
+++ b/dag/test/claim/ilm4926_designation_witness_test.dag
@@ -90,8 +90,14 @@ test fn w_each_attestation_carries_its_own_authority_and_wording() -> Bool {
   list_length(items: ampere_max) == 1
     && list_length(items: ampere_classic) == 1
     && list_length(items: ocp) == 1
-    && ampere_max.first().wording == "device seated in ILM4926 socket"
-    && ocp.first().wording == "ILM4926"
+    && match ampere_max.first() {
+         Present { value: e } => e.wording == "device seated in ILM4926 socket"
+         Absent => false
+       }
+    && match ocp.first() {
+         Present { value: e } => e.wording == "ILM4926"
+         Absent => false
+       }
 }
 
 // THE OPEN QUESTION IS MODELLED, NOT ASSUMED AWAY. No cited document expands
diff --git a/dag/test/claim/infer_algebra_length_homonym_witness_test.dag b/dag/test/claim/infer_algebra_length_homonym_witness_test.dag
new file mode 100644
index 00000000000..eab9bc8d9e5
--- /dev/null
+++ b/dag/test/claim/infer_algebra_length_homonym_witness_test.dag
@@ -0,0 +1,52 @@
+module test.claim.infer_algebra_length_homonym_witness
+
+import extdeps.filesystem.filesystem_io
+import std.types { Bool, String }
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
+
+// THE SAME-LEAF CONTROL THE ACCEPTED CORPUS CANNOT CARRY. A second `fn length` under dag/ or
+// src/v2 makes every bare `length` an unimported two-declarer (floor). The specimen is therefore
+// a fixture outside those roots, compiled here through compile_dag_rust_emit_check — the same
+// isolated nested-compile shape #13459 used for a kernel-name collision that must not be
+// ingestible. The file is the authority; this module reads it.
+//
+// WHAT WOULD GO RED UNDER THE OLD LEAF PREDICATE. That predicate rewrote any host-String call
+// whose callee *leaf* was `length` to `v1_rt::string_length`. This fixture's `probe` calls a
+// `length` whose decl_name is `length` and whose owner is `algebra_length_homonym_probe`. The
+// identity gate leaves the constant body; the leaf predicate would emit `v1_rt::string_length`
+// and this exclude-list would fail.
+
+data algebra_length_homonym_probe_path: String = "fixtures/algebra_length_homonym/probe.dag"
+
+fn algebra_length_homonym_probe_source() -> String {
+  filesystem_read(path: algebra_length_homonym_probe_path).content
+}
+
+test fn a_user_length_on_host_string_is_not_emitted_as_string_length() -> Bool {
+  compile_dag_rust_emit_check(
+    algebra_length_homonym_probe_source(),
+    "src/algebra_length_homonym_probe.rs",
+    ["99"],
+    ["v1_rt::string_length"]
+  )
+}
+
+test fn algebra_length_on_host_string_still_lowers_to_string_length() -> Bool {
+  compile_dag_rust_emit_check(
+    "module algebra_length_host_probe\nimport std.types { String, Int }\nimport v2.std.algebra { length }\nfn probe(s: String) -> Int { length(xs: s) }\n",
+    "src/algebra_length_host_probe.rs",
+    ["v1_rt::string_length(&"],
+    ["v2_std_algebra::length("]
+  )
+}
+
+test fn host_text_receiver_length_lowers_to_string_length() -> Bool {
+  compile_dag_rust_emit_check(
+    "module host_text_length_method_probe\nimport std.types { String, Int }\nfn probe(s: String) -> Int { s.length() }\n",
+    "src/host_text_length_method_probe.rs",
+    ["string_length"],
+    []
+  )
+}
diff --git a/dag/test/claim/infer_program_identity_admission_witness_test.dag b/dag/test/claim/infer_program_identity_admission_witness_test.dag
index db2dfaaa978..01a905787e7 100644
--- a/dag/test/claim/infer_program_identity_admission_witness_test.dag
+++ b/dag/test/claim/infer_program_identity_admission_witness_test.dag
@@ -30,9 +30,11 @@ data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
 // neither diagnostic. Without it, a wall that refused every use of the leaf would score identically
 // on the reds.
 //
-// PATH SCOPE (DESIGN 4b): source -> .dag acceptance on the seed route only. admit_callers is
-// parsed and discarded on the native route (gunbc.rung_drop admit_callers_discarded_on_the_native_route),
-// so this wall does not hold there, and nothing here claims it does. It also holds only over what a
+// PATH SCOPE (DESIGN 4b): source -> .dag acceptance on the seed route only. The native route's
+// caller admission is judged by v2.compiler.infer infer_caller_admission_diags (restored); this
+// wall grades a different admission -- violation-mint leaves over a compile's diagnostics census,
+// a fact the native route does not judge -- so it does not hold there, and nothing here claims it
+// does. It also holds only over what a
 // run compiles: a new uncataloged mint in a module no required closure reaches is refused whenever
 // that module is next compiled, not on the pull request that adds it.
 
diff --git a/dag/test/claim/live_deploy/candidate_checkout_witness_test.dag b/dag/test/claim/live_deploy/candidate_checkout_witness_test.dag
index 4479a4b9490..c05b8703daa 100644
--- a/dag/test/claim/live_deploy/candidate_checkout_witness_test.dag
+++ b/dag/test/claim/live_deploy/candidate_checkout_witness_test.dag
@@ -338,10 +338,18 @@ test fn the_appended_dotted_prefixes_still_match_segments_not_character_runs() -
     && path_is_deployed(path: "target-codexish/x")
 }
 
-// THE COMPILER-DERIVED ROSTER IS NOT SHIPPED AND ITS SIBLING ROWS ARE: the exclusion is the exact
-// derived path, so the authored row files beside it stay in the deployed tree.
-test fn the_derived_failure_mode_roster_is_excluded_as_a_file_not_a_prefix() -> Bool {
-  !path_is_deployed(path: "dag/gunbc/recurring_failure_mode/roster.dag")
+// NO DERIVED ROSTER IS EXEMPT FROM ADMISSION. Source acquisition derives both ledger rosters in
+// memory and writes nothing, so a gunbc run cannot dirty the checkout it admits; a physical roster
+// file is a legacy artifact of an older binary, and admission refuses it like any other ignored or
+// untracked path rather than exempting it.
+test fn a_legacy_roster_file_is_not_exempt_from_candidate_admission() -> Bool {
+  path_is_deployed(path: "dag/gunbc/recurring_failure_mode/roster.dag")
+    && path_is_deployed(path: "dag/gunbc/rung_drop/roster.dag")
     && path_is_deployed(path: "dag/gunbc/recurring_failure_mode/empty_capture_read_as_clean_result.dag")
-    && path_is_deployed(path: "dag/gunbc/recurring_failure_mode/roster.dag.bak")
+}
+
+test fn the_derived_rung_drop_roster_is_excluded_as_a_file_not_a_prefix() -> Bool {
+  !path_is_deployed(path: "dag/gunbc/rung_drop/roster.dag")
+    && path_is_deployed(path: "dag/gunbc/rung_drop/self_host_emit_derisk_claim_unobserved.dag")
+    && path_is_deployed(path: "dag/gunbc/rung_drop/roster.dag.bak")
 }
diff --git a/dag/test/claim/live_deploy/deploy_release_fixture.dag b/dag/test/claim/live_deploy/deploy_release_fixture.dag
index 59f9b701d98..80a7e94dac7 100644
--- a/dag/test/claim/live_deploy/deploy_release_fixture.dag
+++ b/dag/test/claim/live_deploy/deploy_release_fixture.dag
@@ -2,7 +2,8 @@ module test.claim.live_deploy.deploy_release_fixture
 
 import std.types { CommitSha, String, NonEmptyStr }
 import extdeps.crypto.hash { Digest, sha256_digest }
-import gunbc.live_deploy.spec { DeploymentSpec }
+import gunbc.live_deploy.spec { DeploymentSpec, DeploymentHostTarget }
+import gunbc.owned_directory { owned_directory_path }
 import gunbc.live_deploy.member_identity { ReleaseEffectPlan, ReleaseTarget, full_install_plan }
 import gunbc.live_deploy.member_observe { deployment_member_roster }
 
@@ -50,3 +51,26 @@ data deploy_witness_other_release_revision: CommitSha = "89abcdef0123456789abcde
 // held.
 
 data deploy_witness_third_release_revision: CommitSha = "fedcba9876543210fedcba9876543210fedcba98"
+
+// THE SPEC NARROWED TO ONE DEMANDED DIRECTORY, so a claim can run the transaction's real directory
+// emitter (gunbc.live_deploy.emit owned_directory_apply_steps) over the one demand it is about rather
+// than paying every demand's install: the demand is the production spec's own, filtered by path.
+fn deploy_witness_spec_with_only_directory(spec: DeploymentSpec, path: String) -> DeploymentSpec {
+  DeploymentSpec {
+    target: DeploymentHostTarget {
+      host: spec.target.host,
+      ssh_host: spec.target.ssh_host,
+      tailscale_endpoint: spec.target.tailscale_endpoint,
+      tailnet_domain: spec.target.tailnet_domain,
+      os_package_manager: spec.target.os_package_manager,
+      tailscale_client: spec.target.tailscale_client,
+      host_directories: filter(xs: spec.target.host_directories, predicate: t => (owned_directory_path(t: t) as String) == path),
+    },
+    steps: spec.steps,
+    service: spec.service,
+    approval_broker: spec.approval_broker,
+    names: spec.names,
+    instance_id: spec.instance_id,
+    directories: filter(xs: spec.directories, predicate: t => (owned_directory_path(t: t) as String) == path),
+  }
+}
diff --git a/dag/test/claim/live_deploy/desired_apply_selection_witness_test.dag b/dag/test/claim/live_deploy/desired_apply_selection_witness_test.dag
new file mode 100644
index 00000000000..d9a9897bc8b
--- /dev/null
+++ b/dag/test/claim/live_deploy/desired_apply_selection_witness_test.dag
@@ -0,0 +1,96 @@
+module test.claim.live_deploy.desired_apply_selection_witness_test
+
+import std.types { Bool, String, Int }
+import gunbc.live_deploy.apply {
+  live_deploy_desired_apply_selection,
+  srv1_production_instance_id,
+  DesiredApplySelected,
+  DesiredApplyRefused,
+}
+import gunbc.live_deploy.desired { deployment_spec_srv1, selected_deployment_spec, srv1_lab_desired_deployment }
+import gunbc.live_deploy.spec { DeploymentSpec, deployment_directory_demands }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_member }
+import gunbc.fabric_storage_placement { fabric_storage_store_directories }
+import gunbc.ci_deploy_access { ci_deploy_srv1_operator_local_access }
+import gunbc.roadmap_dashboard_instance { srv1_dashboard_lab_id, srv2_deploy_dashboard_id }
+
+// THE ONE APPLY ROUTE SELECTS BY INSTANCE ID (gunbc.live_deploy.apply
+// live_deploy_desired_apply_selection). This claim's subject is the SELECTION: the lab id yields
+// the lab roster row's spec, never production's. What that spec emits -- its own unit, port,
+// slice and repo, disjoint from production -- is witnessed at the emitter's interface by
+// test.claim.live_deploy.desired_roster_witness_test selecting_lab_changes_emitted_unit_bytes and
+// same_host_production_and_lab_do_not_share_port_unit_or_handler, over the same
+// selected_deployment_spec(srv1_lab_desired_deployment()) value this asserts was chosen; rendering
+// the apply program here would re-pay that emission (~1.3M eval steps measured) per claim.
+test fn the_lab_instance_id_selects_the_lab_spec_and_never_the_production_unit() -> Bool {
+  match live_deploy_desired_apply_selection(
+    instance_id: srv1_dashboard_lab_id as String,
+    access: ci_deploy_srv1_operator_local_access,
+  ) {
+    DesiredApplyRefused { reason: _ } => false
+    DesiredApplySelected { spec } => lab_spec_selected(spec: spec)
+  }
+}
+
+fn lab_spec_selected(spec: DeploymentSpec) -> Bool {
+  let lab = selected_deployment_spec(row: srv1_lab_desired_deployment())
+  (spec.instance_id as String) == (srv1_dashboard_lab_id as String)
+    && (spec.service.unit_name as String) == (lab.service.unit_name as String)
+    && (spec.service.repo_root as String) == (lab.service.repo_root as String)
+    && (spec.service.unit_name as String) != (deployment_spec_srv1().service.unit_name as String)
+    && (spec.service.unit_name as String) != "gunbc-roadmap.service"
+}
+
+// Positive control for the production entries, which now route through the same selection:
+// production's id must yield exactly deployment_spec_srv1, so the byte oracles over that spec
+// keep describing what the production entry applies.
+test fn the_production_instance_id_selects_deployment_spec_srv1() -> Bool {
+  match live_deploy_desired_apply_selection(
+    instance_id: srv1_production_instance_id(),
+    access: ci_deploy_srv1_operator_local_access,
+  ) {
+    DesiredApplyRefused { reason: _ } => false
+    DesiredApplySelected { spec } =>
+      (spec.instance_id as String) == (deployment_spec_srv1().instance_id as String)
+        && (spec.service.unit_name as String) == (deployment_spec_srv1().service.unit_name as String)
+        && (spec.service.repo_root as String) == (deployment_spec_srv1().service.repo_root as String)
+  }
+}
+
+test fn an_unknown_instance_id_refuses_with_its_typed_cause() -> Bool {
+  match live_deploy_desired_apply_selection(
+    instance_id: "no-such-dashboard-instance",
+    access: ci_deploy_srv1_operator_local_access,
+  ) {
+    DesiredApplySelected { spec: _ } => false
+    DesiredApplyRefused { reason } => string_contains(s: reason, pattern: "DesiredDeploymentUnknownInstanceId")
+  }
+}
+
+// A rostered row on ANOTHER host refuses under srv1's access rather than mutating srv1 with it.
+test fn a_row_on_another_host_refuses_under_srv1_access() -> Bool {
+  match live_deploy_desired_apply_selection(
+    instance_id: srv2_deploy_dashboard_id as String,
+    access: ci_deploy_srv1_operator_local_access,
+  ) {
+    DesiredApplySelected { spec: _ } => false
+    DesiredApplyRefused { reason } => string_contains(s: reason, pattern: "DesiredApplyHostMismatch")
+  }
+}
+
+// THE FABRIC STORE IS THE PLACED INSTANCE'S (gunbc.fabric_storage_placement fabric_storage_directory_demands).
+// Directories are owned-directory demands (gunbc.live_deploy.spec deployment_directory_demands), not
+// step kinds: the lab row demands none of the fabric store's directories; production's does.
+fn is_fabric_store_demand(t: OwnedDirectoryTarget) -> Bool {
+  let m = owned_directory_member(t: t)
+  count(filter(xs: fabric_storage_store_directories(), predicate: d => d.member == m)) > 0
+}
+
+fn fabric_store_step_count(spec: DeploymentSpec) -> Int {
+  count(filter(xs: deployment_directory_demands(spec: spec), predicate: t => is_fabric_store_demand(t: t)))
+}
+
+test fn the_lab_row_does_not_converge_the_fabric_store_and_production_does() -> Bool {
+  fabric_store_step_count(spec: selected_deployment_spec(row: srv1_lab_desired_deployment())) == 0
+    && fabric_store_step_count(spec: deployment_spec_srv1()) > 0
+}
diff --git a/dag/test/claim/live_deploy/desired_roster_witness_test.dag b/dag/test/claim/live_deploy/desired_roster_witness_test.dag
index 6b259bab512..8ee1a464dcb 100644
--- a/dag/test/claim/live_deploy/desired_roster_witness_test.dag
+++ b/dag/test/claim/live_deploy/desired_roster_witness_test.dag
@@ -225,9 +225,9 @@ test fn production_and_lab_receipt_paths_and_instance_ids_differ() -> Bool {
       != live_deploy_apply_receipt_artifact_path_for(instance_id: lab_id)
 }
 
-test fn srv2_target_states_empty_ensured_directories() -> Bool {
-  srv2_deploy_desired_deployment().target.ensured_directories == []
-    && count(srv1_production_desired_deployment().target.ensured_directories) > 0
+test fn srv2_target_states_empty_host_directories() -> Bool {
+  srv2_deploy_desired_deployment().target.host_directories == []
+    && count(srv1_production_desired_deployment().target.host_directories) > 0
 }
 
 test fn each_roster_row_carries_its_own_selected_identity() -> Bool {
diff --git a/dag/test/claim/live_deploy/emit_test.dag b/dag/test/claim/live_deploy/emit_test.dag
index d5693258c52..374e4158da6 100644
--- a/dag/test/claim/live_deploy/emit_test.dag
+++ b/dag/test/claim/live_deploy/emit_test.dag
@@ -6,11 +6,12 @@ import gunbc.live_deploy.member_identity {
   ConvergedMember, TreePublication, Executable, UnitFile, UnitManager, ServiceProcess, DirectoryRoot,
 }
 import gunbc.live_deploy.member_observe { deployment_member_roster }
+import gunbc.owned_directory { owned_directory_path, owned_directory_demand_at }
 import test.claim.live_deploy.apply_emission_projection { pipeline_steps_text, apply_emitted_steps_text, apply_empty_host_effects }
-import test.claim.live_deploy.deploy_release_fixture { deploy_witness_executable_digest, deploy_witness_release_revision, deploy_witness_other_release_revision, deploy_witness_full_install_plan, deploy_witness_release_target }
+import test.claim.live_deploy.deploy_release_fixture { deploy_witness_executable_digest, deploy_witness_release_revision, deploy_witness_other_release_revision, deploy_witness_full_install_plan, deploy_witness_release_target, deploy_witness_spec_with_only_directory }
 import std.types { Bool, String, List, NonEmptyStr, Int }
 import std.os.types { Apt }
-import gunbc.fabric_storage_placement { fabric_storage_door_socket, fabric_storage_door_directory_path, fabric_storage_https_port, fabric_storage_entry_mode, FabricStorageEntryModeDerived, FabricStorageEntryModeRefused }
+import gunbc.fabric_storage_placement { fabric_storage_door_socket, fabric_storage_door_directory_path, fabric_storage_store_root, fabric_storage_https_port, fabric_storage_entry_mode, FabricStorageEntryModeDerived, FabricStorageEntryModeRefused }
 import extdeps.access.posix { file_mode_octal }
 import gunbc.fabric_storage_file_store { fabric_storage_file_root }
 import extdeps.systemd.unit_file { serialize_systemd_unit_file }
@@ -28,7 +29,6 @@ import gunbc.live_deploy.spec {
   deployment_approval_broker_front_door_steps,
   deployment_fabric_storage_serve_endpoint,
   EnsuredPackage,
-  EnsuredManagedHostDirectory,
   TailscalePackage,
   TmuxPackage,
   deployment_plan_host_identity,
@@ -49,7 +49,6 @@ import gunbc.live_deploy.spec {
   ServeBinary,
   OwnedArtifactKind,
   GunbcSourceTree,
-  AttemptStateRoot,
   SystemdUnit,
   FleetConvergeTimerUnit,
   TailscaleServeMapping,
@@ -72,9 +71,8 @@ import gunbc.roadmap_dashboard_instance {
   HostDashboardInstance,
   srv1_lab_dashboard_instance,
   srv1_live_dashboard_instance,
-  dashboard_instance_fabric_storage_root,
 }
-import extdeps.version.semver { SemVerVersion }
+import extdeps.version.semver { semver_version_parse }
 import extdeps.tailscale.serve {
   tailscale_serve_route_member_path,
   ScopedRemovalUnobserved,
@@ -113,12 +111,12 @@ import extdeps.systemd.unit_file {
 }
 import gunbc.auth.approval_broker_endpoint { approval_broker_listen_host }
 import gunbc.host_layout { srv1_gunbc_approval_broker_root, srv1_gunbc_repo_root }
-import gunbc.live_deploy.spec { approval_broker_serve_binary_is_per_release_poison }
+import gunbc.live_deploy.spec { approval_broker_serve_binary_is_per_release_poison, deployment_directory_demands }
 import gunbc.live_deploy.emit {
   emit_artifact_upsert,
   approval_broker_tree_copy_steps,
-  ensure_managed_directory_command,
-  managed_directory_entry_repair_commands,
+  owned_directory_install_steps,
+  owned_directory_apply_steps,
   approval_broker_dark_install_script,
   apply_approval_broker_unit_write_steps,
   approval_broker_lifecycle_steps,
@@ -408,6 +406,7 @@ test fn witness_apply_pipeline_carries_the_preamble_after_its_frame() -> Bool {
     approval_broker: real.approval_broker,
     names: real.names,
     instance_id: real.instance_id,
+    directories: real.directories,
   }
   match ci_deploy_srv1_access_or_refusal() {
     DeployAccessReady { access: a } =>
@@ -511,7 +510,7 @@ test fn witness_apply_script_contains_systemd_and_tailscale() -> Bool {
     && string_contains(s: sh, pattern: deploy_stage_install_command(stage_name: "gunbc-tree-sync.service", mode: "0644", dest: "/etc/systemd/system/gunbc-tree-sync.service"))
     && string_contains(s: sh, pattern: deploy_effect_command(inv: systemctl_restart_effect(unit: spec.names.tree_sync_unit_name)))
     && string_contains(s: sh, pattern: install_file_owned_command(mode: "0755", owner: gunbc_service_user, group: gunbc_service_user, source: "target/release/gunbc", dest: "/opt/gunbc/bin/gunbc"))
-    && string_contains(s: sh, pattern: install_directory_owned_command(mode: "0755", owner: gunbc_service_user, group: gunbc_service_user, path: "/opt/gunbc/dispatch-worktrees"))
+    && string_contains(s: pipeline_steps_text(steps: owned_directory_apply_steps(spec: deploy_witness_spec_with_only_directory(spec: spec, path: "/opt/gunbc/dispatch-worktrees"), plan: deploy_witness_full_install_plan(spec: spec))), pattern: install_directory_owned_command(mode: "0755", owner: gunbc_service_user, group: gunbc_service_user, path: "/opt/gunbc/dispatch-worktrees"))
     && string_contains(s: sh, pattern: "[Service]")
     && string_contains(s: sh, pattern: deploy_effect_command(inv: systemctl_restart_effect(unit: gunbc_roadmap_unit_name)))
     && !string_contains(s: sh, pattern: tailscale_enable_command(endpoint: spec.names.tailscale_serve_endpoint))
@@ -1104,22 +1103,26 @@ fn unmeasured_client_target() -> DeploymentHostTarget {
     tailnet_domain: t.tailnet_domain,
     os_package_manager: t.os_package_manager,
     tailscale_client: ScopedRemovalUnobserved { reason: "host never probed for a tailscale client version" },
-    ensured_directories: t.ensured_directories,
+    host_directories: t.host_directories,
   }
 }
 
+// The fixture's client version arrives through the parser like every other SemVerVersion
+// (review 77150): no hand-built record with raw fields.
 fn preserve_removal_client_target() -> DeploymentHostTarget {
   let t = deployment_srv1_target()
+  let client = match semver_version_parse(cps: chars(s: "1.40.0" as String)) {
+    Absent => ScopedRemovalUnobserved { reason: "the fixture client version label failed to parse — a defect in the fixture, not an observation gap" }
+    Present { value: observed } => tailscale_scoped_removal_capability(observed: observed)
+  }
   DeploymentHostTarget {
     host: t.host,
     ssh_host: t.ssh_host,
     tailscale_endpoint: t.tailscale_endpoint,
     tailnet_domain: t.tailnet_domain,
     os_package_manager: t.os_package_manager,
-    tailscale_client: tailscale_scoped_removal_capability(
-      observed: SemVerVersion { major: 1, minor: 40, patch: 0, pre_release: [], build: [] },
-    ),
-    ensured_directories: t.ensured_directories,
+    tailscale_client: client,
+    host_directories: t.host_directories,
   }
 }
 
@@ -1229,9 +1232,9 @@ fn preamble_step_command(step: PipelineStep) -> String {
 // authority as the operation it guards (gunbc.executor_privileged_operation), so the login arrives
 // single-quoted -- equivalent shell, one fewer place that decides quoting. What the witness owes is
 // that the check runs and short-circuits the useradd, which is what it now asserts.
-// THE COUNT IS 3 RATHER THAN 2 BECAUSE C7 ADDED A THIRD PREAMBLE STEP: the provider-state root's
-// ensure (gunbc.live_deploy.emit provider_state_ensure_steps), derived from the spec so that no
-// deploy can omit it. The conjunct is kept at an exact count rather than relaxed to `>= 2`: it
+// THE COUNT IS 2: the sudoers install and the publication principal. The provider-state root the
+// preamble once carried is an owned-directory demand emitted by owned_directory_apply_steps. The
+// conjunct is kept at an exact count rather than relaxed to `>= 2`: it
 // exists so that a step creeping into the preamble is noticed here, and a bound that admits any
 // number of new steps would stop noticing. This claim's own subject -- that the publication
 // principal is ensured as a nologin system account -- is unchanged and still asserted below.
@@ -1249,7 +1252,7 @@ test fn the_preamble_ensures_the_publication_principal_as_a_nologin_system_accou
     && string_contains(s: ensure, pattern: "--system")
     && string_contains(s: ensure, pattern: "--no-create-home")
     && string_contains(s: ensure, pattern: "/usr/sbin/nologin")
-    && count(preamble) == 3
+    && count(preamble) == 2
     && any(preamble, step => preamble_step_command(step: step) == ensure)
 }
 
@@ -1375,58 +1378,48 @@ test fn the_full_plan_lands_its_members_in_the_deployments_order() -> Bool {
   let steps = spec.steps
   three_markers_in_order(text: executable, first: verify_source, second: "target/release/gunbc' '", third: verify_dest)
     && owned_step_index(steps: steps, kind: ServeBinary) < owned_step_index(steps: steps, kind: GunbcSourceTree)
-    && owned_step_index(steps: steps, kind: GunbcSourceTree) < owned_step_index(steps: steps, kind: AttemptStateRoot)
-    && owned_step_index(steps: steps, kind: AttemptStateRoot) < owned_step_index(steps: steps, kind: SystemdUnit)
+    && owned_step_index(steps: steps, kind: GunbcSourceTree) < owned_step_index(steps: steps, kind: SystemdUnit)
     && member_fragment_text(member: ServiceProcess, plan: full) == ""
 }
 
-fn step_is_fabric_storage_store(step: DeploymentStep) -> Bool {
-  match step {
-    Dependency { step: dep } => (ensured_subject_identity(subject: dep.subject) as String) == (dashboard_instance_fabric_storage_root(instance: srv1_live_dashboard_instance()) as String)
-    ArtifactStep { step: _ } => false
-  }
+fn srv1_demands_directory(path: String) -> Bool {
+  any(deployment_directory_demands(spec: deployment_spec_srv1()), t => (owned_directory_path(t: t) as String) == path)
 }
 
-// The fabric DB's store is created on the placement host's apply path, as an ensured directory.
+// The fabric DB's store is created on the placement host's apply path, as an owned-directory demand.
 test fn the_fabric_storage_store_root_reaches_the_srv1_apply_path() -> Bool {
-  any(deployment_spec_srv1().steps, st => step_is_fabric_storage_store(step: st))
-}
-
-fn srv1_ensures_directory(path: String) -> Bool {
-  any(deployment_spec_srv1().steps, st => match st {
-    Dependency { step: dep } => (ensured_subject_identity(subject: dep.subject) as String) == path
-    ArtifactStep { step: _ } => false
-  })
+  srv1_demands_directory(path: fabric_storage_store_root() as String)
 }
 
-// THE AREAS THE STORE WRITES INTO ARE ENSURED, NOT ONLY THE ROOT. The paths are read from the file
+// THE AREAS THE STORE WRITES INTO ARE DEMANDED, NOT ONLY THE ROOT. The paths are read from the file
 // store's own root function -- the one the put and the head CAS write under -- so this goes red when
 // the deployment ensures the root alone, which is the state that refused fleet-converge run
 // 35818578751's host-effect claim with `object publication refused: not_found`.
 test fn the_fabric_storage_store_areas_reach_the_srv1_apply_path() -> Bool {
-  let files = fabric_storage_file_root(root: dashboard_instance_fabric_storage_root(instance: srv1_live_dashboard_instance()) as String as NonEmptyStr)
-  srv1_ensures_directory(path: files.objects as String) && srv1_ensures_directory(path: files.heads as String)
+  let files = fabric_storage_file_root(root: fabric_storage_store_root())
+  srv1_demands_directory(path: files.objects as String) && srv1_demands_directory(path: files.heads as String)
+}
+
+// THE AREAS ARE THE SERVICE'S ALONE AND THE DOOR IS THE CI PRINCIPAL'S WAY IN, READ OFF THE INSTALL THE
+// SRV1 TRANSACTION LOWERS FOR EACH DEMAND (gunbc.live_deploy.emit owned_directory_install_steps). The
+// store areas are briansrls:briansrls 0700: no other account writes the files
+// (gunbc.fabric_storage_placement fabric_storage_directory). The door directory is owned by the service
+// with group ghrunner and group traverse only (2710), so the CI job reaches the socket and nothing
+// else. Red if an area admits the CI principal again, or the door stops admitting it, or either
+// refuses.
+fn srv1_fabric_area_install_steps(path: String) -> List<PipelineStep> {
+  match owned_directory_demand_at(ts: deployment_directory_demands(spec: deployment_spec_srv1()), path: path) {
+    Present { value: t } => owned_directory_install_steps(t: t)
+    Absent => []
+  }
 }
 
-// THE AREAS ARE THE SERVICE'S ALONE AND THE DOOR IS THE CI PRINCIPAL'S WAY IN, READ OFF THE ENSURE THE
-// SRV1 SPEC ACTUALLY LOWERS. The store areas are briansrls:briansrls 0700: no other account writes
-// the files (gunbc.fabric_storage_placement fabric_storage_directory). The door directory is owned
-// by the service with group ghrunner and group traverse only (2710), so the CI job reaches the
-// socket and nothing else. Red if an area admits the CI principal again, or the door stops admitting
-// it, or either admission refuses.
 fn srv1_fabric_area_ensure(path: String) -> String {
-  fold(deployment_spec_srv1().steps, init: "", f: (acc, st) => match st {
-    Dependency { step: dep } => match dep.subject {
-      EnsuredManagedHostDirectory { admission } =>
-        if (ensured_subject_identity(subject: dep.subject) as String) == path { ensure_managed_directory_command(admission: admission) } else { acc }
-      _ => acc
-    }
-    ArtifactStep { step: _ } => acc
-  })
+  pipeline_steps_text(steps: srv1_fabric_area_install_steps(path: path))
 }
 
 test fn the_fabric_storage_areas_are_the_services_and_the_door_admits_the_claim_principal() -> Bool {
-  let files = fabric_storage_file_root(root: dashboard_instance_fabric_storage_root(instance: srv1_live_dashboard_instance()) as String as NonEmptyStr)
+  let files = fabric_storage_file_root(root: fabric_storage_store_root())
   let objects = srv1_fabric_area_ensure(path: files.objects as String)
   let heads = srv1_fabric_area_ensure(path: files.heads as String)
   let door = srv1_fabric_area_ensure(path: fabric_storage_door_directory_path() as String)
@@ -1435,23 +1428,13 @@ test fn the_fabric_storage_areas_are_the_services_and_the_door_admits_the_claim_
     && string_contains(s: door, pattern: "2710") && string_contains(s: door, pattern: "ghrunner") && !string_contains(s: door, pattern: "REFUSED")
 }
 
-// THE ENSURE NO LONGER REPAIRS THE AREAS' ENTRIES, read off the command the srv1 spec lowers: the
-// service is the only writer and publishes at the declared mode itself. Red if a repair reappears,
-// which would mean some other principal is again expected to write the store's files.
-fn srv1_fabric_area_repair(path: String) -> String {
-  fold(deployment_spec_srv1().steps, init: "", f: (acc, st) => match st {
-    Dependency { step: dep } => match dep.subject {
-      EnsuredManagedHostDirectory { admission } =>
-        if (ensured_subject_identity(subject: dep.subject) as String) == path { join(managed_directory_entry_repair_commands(admission: admission), "\n") } else { acc }
-      _ => acc
-    }
-    ArtifactStep { step: _ } => acc
-  })
-}
-
+// THE ENSURE NO LONGER REPAIRS THE AREAS' ENTRIES, read off the steps the srv1 transaction lowers: the
+// install alone, no repair. Red if a repair reappears, which would mean some other principal is again
+// expected to write the store's files.
 test fn the_fabric_storage_area_ensure_leaves_the_services_own_entries_alone() -> Bool {
-  let files = fabric_storage_file_root(root: dashboard_instance_fabric_storage_root(instance: srv1_live_dashboard_instance()) as String as NonEmptyStr)
-  srv1_fabric_area_repair(path: files.objects as String) == "" && srv1_fabric_area_repair(path: files.heads as String) == ""
+  let files = fabric_storage_file_root(root: fabric_storage_store_root())
+  count(srv1_fabric_area_install_steps(path: files.objects as String)) == 1
+    && count(srv1_fabric_area_install_steps(path: files.heads as String)) == 1
 }
 
 // THE PLACEMENT'S DERIVED ENTRY MODE, from the real store directories: 0400, since the service
@@ -1467,11 +1450,13 @@ test fn the_placed_fabric_store_derives_entry_mode_0400() -> Bool {
 
 // THE LOG IS NOT DEPLOYMENT STATE: no retract may remove the store. Moving this root back into the
 // owned roster (where the event-log mirror root sat, torn down with rm -rf) turns this red.
+// A retract tears down owned steps only, so the store is safe exactly when it is demanded and no owned
+// step names it.
 test fn no_retract_can_remove_the_fabric_storage_store() -> Bool {
-  any(deployment_spec_srv1().steps, st =>
-    step_is_fabric_storage_store(step: st) && match deployment_step_teardown_disposition(step: st) {
-      TeardownRefuses { cause: _ } => true
-      TeardownActs => false
+  srv1_demands_directory(path: fabric_storage_store_root() as String)
+    && !any(deployment_spec_srv1().steps, st => match st {
+      ArtifactStep { step: art } => (art.path as String) == (fabric_storage_store_root() as String)
+      Dependency { step: _ } => false
     })
 }
 
diff --git a/dag/test/claim/live_deploy/fleet_request_witness_test.dag b/dag/test/claim/live_deploy/fleet_request_witness_test.dag
index 6d86d4497eb..b564902f953 100644
--- a/dag/test/claim/live_deploy/fleet_request_witness_test.dag
+++ b/dag/test/claim/live_deploy/fleet_request_witness_test.dag
@@ -20,7 +20,7 @@ import gunbc.live_deploy.member_identity {
   ServiceProcess,
   TreePublicationIdentity, UnitFileIdentity, ManagerLoadedCurrent,
   ProcessRunningRelease,
-  DirectoryRootIdentity,
+  DirectoryRootIdentity, DirectoryRootStanding, RootConverged, RootModeRepairable,
   MemberIdentity, TreeIdentity, ExecutableIdentity, UnitFileAt, UnitManagerAt, ProcessAt,
   RootAt,
   ObservedMember, MemberObserved, MemberAbsentOnHost, MemberUnobservable,
@@ -429,12 +429,12 @@ fn fingerprints_differ(left: List<ObservedMember>, right: List<ObservedMember>)
   }
 }
 
-fn root_obs(owner: NonEmptyStr) -> ObservedMember {
+fn root_obs(standing: DirectoryRootStanding) -> ObservedMember {
   MemberObserved {
     identity: RootAt {
       root: DirectoryRootIdentity {
         path: "/srv/gunbc" as NonEmptyStr,
-        owner: owner,
+        standing: standing,
       },
     },
   }
@@ -497,10 +497,10 @@ test fn live_deploy_fingerprint_moves_when_running_release_moves() -> Bool {
   )
 }
 
-test fn live_deploy_fingerprint_moves_when_root_owner_moves() -> Bool {
+test fn live_deploy_fingerprint_moves_when_root_standing_moves() -> Bool {
   fingerprints_differ(
-    left: concat(matching_obs_for(unit: unit_name()), [root_obs(owner: "gunbc" as NonEmptyStr)]),
-    right: concat(matching_obs_for(unit: unit_name()), [root_obs(owner: "root" as NonEmptyStr)]),
+    left: concat(matching_obs_for(unit: unit_name()), [root_obs(standing: RootConverged)]),
+    right: concat(matching_obs_for(unit: unit_name()), [root_obs(standing: RootModeRepairable { observed_mode: "755" as NonEmptyStr })]),
   )
 }
 
diff --git a/dag/test/claim/live_deploy/owned_directory_route_witness_test.dag b/dag/test/claim/live_deploy/owned_directory_route_witness_test.dag
new file mode 100644
index 00000000000..803b1af8da7
--- /dev/null
+++ b/dag/test/claim/live_deploy/owned_directory_route_witness_test.dag
@@ -0,0 +1,215 @@
+module test.claim.live_deploy.owned_directory_route_witness_test
+
+import std.types { Bool, String, NonEmptyStr, FilePath, List }
+import gunbc.live_deploy.desired { deployment_spec_srv1 }
+import gunbc.live_deploy.spec { DeploymentSpec, deployment_directory_demands }
+import gunbc.live_deploy.emit { owned_directory_apply_steps }
+import gunbc.live_deploy.member_identity {
+  DirectoryRoot, converged_member_eq, converged_effect_plan, derive_member_plan, RootAt, DirectoryRootIdentity, RootConverged,
+  directory_root_standing_wire, ObservedMember, MemberObserved, MemberUnobservable, EffectsDerived, EffectsRefused, plan_mutation_count,
+}
+import gunbc.live_deploy.member_observe { deployment_member_roster, owned_directory_member_of_decision }
+import gunbc.fabric_storage_placement { fabric_storage_directory_demands }
+import gunbc.runner_host_grants { runner_host_privileged_operations }
+import gunbc.runner_host_deploy { runner_host_deploy_for, RunnerHostDeployFound }
+import gunbc.fleet_host_identity { operator_host_srv1 }
+import gunbc.executor_privileged_operation { ReadDirectoryIdentity, ListDirectoryEntries }
+import extdeps.access.posix { file_mode_octal }
+import std.optional { Present, Absent }
+import gunbc.owned_directory {
+  OwnedDirectoryTarget, owned_directory_path, owned_directory_mode, owned_directory_owner, OwnedDirectoryModeResolved, OwnedDirectoryModeRefused,
+  owned_directory_observe, owned_directory_parent, owned_directory_basename, ObserverRead, ObserverReadOut, ObserverReadFailed, ObserverExited,
+}
+import gunbc.roadmap_dashboard_instance { srv1_live_dashboard_instance, srv1_lab_dashboard_instance }
+import gunbc.roadmap.roadmap_event_carrier { roadmap_event_carrier_layout_for_instance }
+import gunbc.roadmap.roadmap_event_carrier_directory { roadmap_event_carrier_directory }
+import gunbc.auth.login_transaction_store { login_transaction_store_layout_for_instance, login_transaction_store_directory }
+import test.claim.live_deploy.apply_emission_projection { pipeline_steps_text }
+import test.claim.live_deploy.deploy_release_fixture { deploy_witness_release_target, deploy_witness_spec_with_only_directory }
+
+// THE ROUTE, NOT ONLY THE ANSWER. For a consumer the production route used to leave without a creator,
+// each claim joins four facts on srv1_live: the path the consumer WRITES (its runtime layout) is its
+// declared demand's path; that demand is in the live_deploy srv1 transaction's directory list; the
+// transaction's emitter RENDERS the provider's install text for it (owned_directory_apply_steps over
+// a plan that makes no claim about it); and it is ENROLLED in the roster the post-apply readback
+// re-derives over. Enrolment is membership, not an execution of the readback; the protected-tree
+// claims below execute the observation projection and the plan derivation. RED CONTROL: deleting the
+// consumer's row from
+// gunbc.roadmap.dashboard_instance_directories dashboard_instance_directory_demands removes the path
+// from deployment_directory_demands, so the membership, the roster member and the emitted install all
+// go false through the live_deploy route; pointing the layout anywhere but the demand reds the first
+// equality. The keep plan emitting nothing is the inhabited negative: emission follows the decision.
+
+fn demands_contain(spec: DeploymentSpec, path: String) -> Bool {
+  any(deployment_directory_demands(spec: spec), t => (owned_directory_path(t: t) as String) == path)
+}
+
+fn roster_enrols_it_for_readback(spec: DeploymentSpec, path: String) -> Bool {
+  any(deployment_member_roster(spec: spec), m => converged_member_eq(a: m, b: DirectoryRoot { path: path as NonEmptyStr }))
+}
+
+fn emitter_renders_its_install_text(spec: DeploymentSpec, path: String) -> Bool {
+  string_contains(
+    s: pipeline_steps_text(steps: owned_directory_apply_steps(spec: deploy_witness_spec_with_only_directory(spec: spec, path: path), plan: converged_effect_plan(roster: [], target: deploy_witness_release_target(spec: spec)))),
+    pattern: path,
+  )
+}
+
+fn routed(spec: DeploymentSpec, written: String, demanded: String) -> Bool {
+  written == demanded
+    && demands_contain(spec: spec, path: demanded)
+    && roster_enrols_it_for_readback(spec: spec, path: demanded)
+    && emitter_renders_its_install_text(spec: spec, path: demanded)
+}
+
+test fn the_event_carrier_worktree_is_demanded_enrolled_and_rendered_by_the_srv1_transaction() -> Bool {
+  let live = srv1_live_dashboard_instance()
+  routed(
+    spec: deployment_spec_srv1(),
+    written: roadmap_event_carrier_layout_for_instance(instance: live).worktree as String,
+    demanded: owned_directory_path(t: roadmap_event_carrier_directory(instance: live)) as String,
+  )
+}
+
+test fn the_login_transaction_store_is_demanded_enrolled_and_rendered_by_the_srv1_transaction() -> Bool {
+  let live = srv1_live_dashboard_instance()
+  routed(
+    spec: deployment_spec_srv1(),
+    written: login_transaction_store_layout_for_instance(instance: live).root as String,
+    demanded: owned_directory_path(t: login_transaction_store_directory(instance: live)) as String,
+  )
+}
+
+// THE DEMAND IS THE INSTANCE'S: the lab's carrier worktree is not in production's transaction.
+test fn another_instances_demand_is_not_in_the_srv1_transaction() -> Bool {
+  !demands_contain(
+    spec: deployment_spec_srv1(),
+    path: owned_directory_path(t: roadmap_event_carrier_directory(instance: srv1_lab_dashboard_instance())) as String,
+  )
+}
+
+// A CONVERGED PLAN INSTALLS NO DIRECTORY: the emission is the decision's, not unconditional.
+test fn a_converged_plan_emits_no_directory_install() -> Bool {
+  let spec = deployment_spec_srv1()
+  pipeline_steps_text(steps: owned_directory_apply_steps(
+    spec: spec,
+    plan: converged_effect_plan(roster: deployment_member_roster(spec: spec), target: deploy_witness_release_target(spec: spec)),
+  )) == ""
+}
+
+// ── P1 CONTROL: A PROTECTED FABRIC TREE IS CONVERGED THROUGH THE DEPLOY PRINCIPAL'S PINNED READS ─────
+//
+// The fabric store's root admits only its owner, so its children are invisible to the job user's own
+// listing and stat. The deploy observes through two pinned read-only grants per bound directory
+// (gunbc.executor_privileged_operation ListDirectoryEntries, ReadDirectoryIdentity), which see the tree
+// as it is. These claims supply exactly those reads -- each parent listing naming its child, and the
+// line stat prints for each directory at its REAL derived owner, group and mode -- to the production
+// observation contract (gunbc.owned_directory owned_directory_observe), the production projection
+// (owned_directory_member_of_decision) and the production plan derivation, and require: every member
+// converged, a plan that keeps them all, and a second deployment that emits no install. RED: the same
+// child read the way the unprivileged job user reads it (its parent's listing refused) is unobservable.
+fn derived_stat_line(t: OwnedDirectoryTarget) -> String {
+  match owned_directory_mode(t: t) {
+    OwnedDirectoryModeRefused { reason: _ } => ""
+    OwnedDirectoryModeResolved { mode } =>
+      join(["directory|", owned_directory_owner(t: t).user as String, "|", owned_directory_owner(t: t).group as String, "|", file_mode_octal(mode: mode)], "")
+  }
+}
+
+fn fabric_tree() -> List<OwnedDirectoryTarget> {
+  fabric_storage_directory_demands(instance: srv1_live_dashboard_instance())
+}
+
+// The privileged reads of a host holding exactly the fabric tree at its derived identities: a listing
+// of a directory names the tree's children of it; a stat of a tree member prints its identity line.
+fn privileged_listing_of_the_tree(dir: FilePath) -> ObserverRead {
+  ObserverReadOut {
+    stdout: join(map(filter(xs: fabric_tree(), predicate: t => (owned_directory_parent(path: owned_directory_path(t: t)) as String) == (dir as String)), t => owned_directory_basename(path: owned_directory_path(t: t))), "\n"),
+  }
+}
+
+fn privileged_stat_of_the_tree(path: FilePath) -> ObserverRead {
+  match first(filter(xs: fabric_tree(), predicate: t => (owned_directory_path(t: t) as String) == (path as String))) {
+    Present { value: t } => ObserverReadOut { stdout: derived_stat_line(t: t) }
+    Absent => ObserverReadFailed { origin: ObserverExited { exit_code: 1, stderr: "not in the tree" } }
+  }
+}
+
+fn fabric_member_as_privileged_reads_see_it(t: OwnedDirectoryTarget) -> ObservedMember {
+  let path = owned_directory_path(t: t) as String as NonEmptyStr
+  owned_directory_member_of_decision(
+    member: DirectoryRoot { path: path },
+    path: path,
+    target: t,
+    observation: owned_directory_observe(path: owned_directory_path(t: t), list: d => privileged_listing_of_the_tree(dir: d), stat: p => privileged_stat_of_the_tree(path: p)),
+  )
+}
+
+test fn a_protected_fabric_tree_is_converged_and_a_second_deployment_installs_nothing() -> Bool {
+  let spec = deployment_spec_srv1()
+  let tree = fabric_tree()
+  let roster = map(tree, t => DirectoryRoot { path: owned_directory_path(t: t) as String as NonEmptyStr })
+  let protected_root = any(tree, t => match owned_directory_mode(t: t) {
+    OwnedDirectoryModeResolved { mode } => !mode.other.execute && !mode.group.read
+    OwnedDirectoryModeRefused { reason: _ } => false
+  })
+  let derivation = derive_member_plan(
+    roster: roster,
+    desired: m => match m { DirectoryRoot { path } => RootAt { root: DirectoryRootIdentity { path: path, standing: RootConverged } }  _ => RootAt { root: DirectoryRootIdentity { path: "/" as NonEmptyStr, standing: RootConverged } } },
+    observed: m => match first(filter(xs: tree, predicate: t => converged_member_eq(a: DirectoryRoot { path: owned_directory_path(t: t) as String as NonEmptyStr }, b: m))) {
+      Present { value: t } => fabric_member_as_privileged_reads_see_it(t: t)
+      Absent => MemberUnobservable { member: m, cause: "not a fabric demand" }
+    },
+    target: deploy_witness_release_target(spec: spec),
+  )
+  count(tree) > 0 && protected_root
+    && all(tree, t => match fabric_member_as_privileged_reads_see_it(t: t) {
+      MemberObserved { identity } => match identity { RootAt { root } => directory_root_standing_wire(s: root.standing) == "converged"  _ => false }
+      _ => false
+    })
+    && match derivation {
+      EffectsRefused { refusals: _ } => false
+      EffectsDerived { plan } =>
+        plan_mutation_count(plan: plan) == 0
+          && all(tree, t => pipeline_steps_text(steps: owned_directory_apply_steps(spec: deploy_witness_spec_with_only_directory(spec: spec, path: owned_directory_path(t: t) as String), plan: plan)) == "")
+    }
+}
+
+// RED: the child read as the unprivileged job user reads it -- the owner-only parent's listing refused
+// -- is unobservable, so planning refuses rather than installing over it.
+test fn an_unprivileged_read_of_a_protected_child_refuses_the_derivation() -> Bool {
+  match first(filter(xs: fabric_tree(), predicate: t => string_contains(s: owned_directory_path(t: t) as String, pattern: "/objects"))) {
+    Absent => false
+    Present { value: t } => {
+      let path = owned_directory_path(t: t) as String as NonEmptyStr
+      match owned_directory_member_of_decision(
+        member: DirectoryRoot { path: path },
+        path: path,
+        target: t,
+        observation: owned_directory_observe(
+          path: owned_directory_path(t: t),
+          list: d => ObserverReadFailed { origin: ObserverExited { exit_code: 2, stderr: "" } },
+          stat: p => ObserverReadFailed { origin: ObserverExited { exit_code: 1, stderr: "" } },
+        ),
+      ) {
+        MemberUnobservable { member: _, cause: _ } => true
+        _ => false
+      }
+    }
+  }
+}
+
+// THE PRINCIPAL HOLDS EXACTLY THE READS THE PLAN SPENDS: srv1's runner-host sudoers grants the job
+// user a pinned stat of every demanded directory and a pinned listing of each demanded directory's
+// parent -- read-only operations on named paths, no path-unrestricted grant.
+test fn the_deploy_principal_is_granted_the_pinned_reads_the_plan_observes_through() -> Bool {
+  match runner_host_deploy_for(host: operator_host_srv1) {
+    RunnerHostDeployFound { deploy } => {
+      let ops = runner_host_privileged_operations(deploy: deploy)
+      all(deployment_directory_demands(spec: deployment_spec_srv1()), t =>
+        any(ops, op => match op { ReadDirectoryIdentity { path } => (path as String) == (owned_directory_path(t: t) as String)  _ => false })
+          && any(ops, op => match op { ListDirectoryEntries { path } => (path as String) == (owned_directory_parent(path: owned_directory_path(t: t)) as String)  _ => false }))
+    }
+    _ => false
+  }
+}
\ No newline at end of file
diff --git a/dag/test/claim/live_deploy/provider_state_member_witness_test.dag b/dag/test/claim/live_deploy/provider_state_member_witness_test.dag
index 7f4fddd1686..e246e84b58e 100644
--- a/dag/test/claim/live_deploy/provider_state_member_witness_test.dag
+++ b/dag/test/claim/live_deploy/provider_state_member_witness_test.dag
@@ -1,71 +1,40 @@
 module test.claim.live_deploy.provider_state_member_witness_test
 
-import std.types { Bool, String }
-import gunbc.live_deploy.spec { gunbc_service_user, deployment_provider_state_path }
+import std.types { Bool, String, NonEmptyStr }
+import gunbc.live_deploy.spec { deployment_directory_demands }
 import gunbc.live_deploy.desired { deployment_spec_srv1, spec_owned_identities }
-import gunbc.live_deploy.emit {
-  install_d_owned_for_user, provider_state_ensure_steps, deploy_apply_preamble_steps,
-}
-import gunbc.ci_deploy_access { ci_deploy_srv1_access_or_refusal, DeployAccessReady, DeployAccessJobPrincipalRefused }
-import gunbc.live_deploy.member_identity { DirectoryRoot }
+import gunbc.live_deploy.emit { owned_directory_apply_steps }
+import gunbc.live_deploy.member_identity { DirectoryRoot, converged_effect_plan }
 import gunbc.live_deploy.member_observe { deployment_member_roster }
-import gunbc.roadmap_dashboard_instance { srv1_live_dashboard_instance, dashboard_instance_provider_state_root }
+import gunbc.owned_directory { owned_directory_path }
+import gunbc.roadmap_dashboard_instance { srv1_live_dashboard_instance, dashboard_instance_provider_state_root, dashboard_instance_provider_state_directory }
 import test.claim.live_deploy.apply_emission_projection { pipeline_steps_text }
+import test.claim.live_deploy.deploy_release_fixture { deploy_witness_release_target, deploy_witness_spec_with_only_directory }
 
-// THE PROVIDER-STATE ROOT IS CREATED ON THE PRODUCTION ROUTE AND READ BACK AS A MEMBER
-// (CONVERGENCE-ONE C7). The expected path and owner come from the model -- the instance's own
-// provider-state projection and the service principal -- so these claims follow the model rather
-// than pinning a spelling.
-//
-// WHAT IS NOT CLAIMED HERE, AND WHY. An earlier revision carried two refusal claims: an apply whose
-// spec omitted the member, and one that carried it twice. Both states are now unwritable --
-// gunbc.live_deploy.spec deployment_provider_state_step is a function of the spec, so no spec can
-// omit the member, duplicate it, give it an owner other than the service principal, or name a
-// package instead of a directory. A claim over a state with no constructor is permanently green by
-// construction and would stand as false coverage (DESIGN 4b). What replaces those reds is
-// structural: deleting the ensure from the preamble, or the member from the roster, reds the claims
-// below, and nothing else creates that directory.
+// THE PROVIDER-STATE ROOT IS CREATED ON THE PRODUCTION ROUTE AND READ BACK AS A MEMBER (CONVERGENCE-ONE
+// C7), now as one owned-directory demand among the instance's (gunbc.roadmap_dashboard_instance
+// dashboard_instance_provider_state_directory) rather than an ensured dependency of its own. The
+// expected path comes from the instance's own projection, which is what the provider preflight reads.
 
 fn srv1_provider_state_root() -> String {
   dashboard_instance_provider_state_root(instance: srv1_live_dashboard_instance()) as String
 }
 
-fn expected_install_command() -> String {
-  install_d_owned_for_user(user: gunbc_service_user, path: srv1_provider_state_root())
-}
-
-// THE PATH THE SPEC DERIVES IS THE INSTANCE'S OWN PROJECTION, not a value the deployment invented.
-// This is the join between the two authorities: if DeploymentServiceConfig were populated from
-// anything but dashboard_instance_provider_state_root, the deploy would create a directory the
-// provider preflight does not read.
-test fn the_spec_derives_the_instance_provider_state_path() -> Bool {
-  (deployment_provider_state_path(spec: deployment_spec_srv1()) as String) == srv1_provider_state_root()
+// THE DEMAND'S PATH IS THE PATH THE PROVIDER READS: the join between the two authorities.
+test fn the_provider_state_demand_is_the_instance_provider_state_path() -> Bool {
+  (owned_directory_path(t: dashboard_instance_provider_state_directory(instance: srv1_live_dashboard_instance())) as String) == srv1_provider_state_root()
+    && any(deployment_directory_demands(spec: deployment_spec_srv1()), t => (owned_directory_path(t: t) as String) == srv1_provider_state_root())
 }
 
-// PRESENCE IN THE EMITTED SET, at the producer: the ensure lowers to the owned install command for
-// the model's path and owner.
-test fn the_provider_state_ensure_emits_the_owned_install() -> Bool {
+// THE PRODUCTION APPLY EMITS ITS INSTALL when the plan makes no claim about it.
+test fn the_production_apply_emits_the_provider_state_install() -> Bool {
+  let spec = deployment_spec_srv1()
   string_contains(
-    s: pipeline_steps_text(steps: provider_state_ensure_steps(spec: deployment_spec_srv1())),
-    pattern: expected_install_command(),
+    s: pipeline_steps_text(steps: owned_directory_apply_steps(spec: deploy_witness_spec_with_only_directory(spec: spec, path: srv1_provider_state_root()), plan: converged_effect_plan(roster: [], target: deploy_witness_release_target(spec: spec)))),
+    pattern: srv1_provider_state_root(),
   )
 }
 
-// INHABITANCE: that producer is reached by the production apply. The preamble is what every apply
-// emits before any member effect, so this asserts the ROUTE and not only the command text --
-// deleting the call from deploy_apply_preamble_steps reds this while the claim above stays green.
-test fn the_production_apply_preamble_carries_the_provider_state_ensure() -> Bool {
-  let spec = deployment_spec_srv1()
-  match ci_deploy_srv1_access_or_refusal() {
-    DeployAccessReady { access: access } =>
-      string_contains(
-        s: pipeline_steps_text(steps: deploy_apply_preamble_steps(access: access, spec: spec)),
-        pattern: expected_install_command(),
-      )
-    DeployAccessJobPrincipalRefused { refusal: _ } => false
-  }
-}
-
 // The same directory is read back as a member, so a host whose provider login has nowhere to write
 // reports a member to create rather than a converged host.
 test fn the_provider_state_root_is_a_read_back_directory_member() -> Bool {
@@ -75,7 +44,7 @@ test fn the_provider_state_root_is_a_read_back_directory_member() -> Bool {
   })
 }
 
-// Ensured, not owned: retract never tears down the provider login.
+// Retract never tears down the provider login: no owned step names it.
 test fn retract_never_owns_the_provider_state_root() -> Bool {
   !any(spec_owned_identities(spec: deployment_spec_srv1()), id => string_contains(s: id, pattern: srv1_provider_state_root()))
 }
diff --git a/dag/test/claim/live_deploy/unit_standing_witness_test.dag b/dag/test/claim/live_deploy/unit_standing_witness_test.dag
index b94eb2d2f88..c5a09022921 100644
--- a/dag/test/claim/live_deploy/unit_standing_witness_test.dag
+++ b/dag/test/claim/live_deploy/unit_standing_witness_test.dag
@@ -2,12 +2,11 @@ module test.claim.live_deploy.unit_standing_witness
 
 import gunbc.live_deploy.desired { deployment_spec_srv1 }
 import extdeps.systemd { systemd_duration_usec }
-import gunbc.live_deploy.emit { live_deploy_belt_service_unit_file, live_deploy_belt_timer_unit_file }
+import gunbc.live_deploy.emit { live_deploy_belt_service_unit_file, live_deploy_belt_exit_path_unit_file }
+import gunbc.live_deploy.spec { deployment_belt_exit_drain_service_unit_name }
 import gunbc.live_deploy.unit_standing {
   BeltOneshotConverged,
   BeltOneshotRefused,
-  BeltTimerConverged,
-  BeltTimerRefused,
   DashboardServiceConverged,
   DashboardServiceRefused,
   ExecStartArgv,
@@ -16,21 +15,16 @@ import gunbc.live_deploy.unit_standing {
   ServiceExpectationUnderivable,
   ServiceUnitExpectation,
   ServiceUnitObserved,
-  TimerExpectationDerived,
-  TimerExpectationUnderivable,
-  TimerUnitExpectation,
-  TimerUnitObserved,
   exec_start_argv_of_show_value,
   judge_belt_oneshot,
-  judge_belt_timer,
   judge_dashboard_service,
   service_unit_expectation_of,
-  timer_unit_expectation_of,
+  path_unit_target_of,
 }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
-data unit_fixture_exec: String = "/opt/gunbc/bin/gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/roadmap/roadmap_belt_tick_cli.dag --function belt_run_once_cli"
+data unit_fixture_exec: String = "/opt/gunbc/bin/gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/roadmap/roadmap_belt_tick_cli.dag --function belt_launch_enqueue_cli"
 
 fn fixture_service_expectation() -> ServiceUnitExpectation {
   ServiceUnitExpectation { exec_start: unit_fixture_exec, user: "briansrls", working_directory: "/opt/gunbc/gunbc" }
@@ -54,25 +48,8 @@ fn fixture_oneshot_observed(unit_file_state: String, active_state: String, resul
   }
 }
 
-fn fixture_timer_expectation() -> TimerUnitExpectation {
-  TimerUnitExpectation { target_unit: "gunbc-belt.service", on_boot_usec: microsecond(count: 120000000), on_unit_inactive_usec: microsecond(count: 60000000), accuracy_usec: microsecond(count: 5000000) }
-}
 
-fn fixture_timer_observed(unit_file_state: String, active_state: String, target: String) -> TimerUnitObserved {
-  fixture_timer_observed_with_cadence(unit_file_state: unit_file_state, active_state: active_state, target: target, on_unit_inactive: "1min")
-}
 
-fn fixture_timer_observed_with_cadence(unit_file_state: String, active_state: String, target: String, on_unit_inactive: String) -> TimerUnitObserved {
-  TimerUnitObserved {
-    load_state: "loaded",
-    unit_file_state: unit_file_state,
-    active_state: active_state,
-    sub_state: if active_state == "active" { "waiting" } else { "dead" },
-    unit: target,
-    timers_monotonic: join(["{ OnBootUSec=2min ; next_elapse=1min 30s }, { OnUnitInactiveUSec=", on_unit_inactive, " ; next_elapse=5min 2s }"], ""),
-    accuracy_usec_value: "5s",
-  }
-}
 
 // (1) systemctl show's ExecStart rendering yields the exact argv text.
 test fn witness_exec_start_argv_is_read_from_the_show_rendering() -> Bool {
@@ -113,28 +90,8 @@ test fn witness_oneshot_under_wrong_user_refuses() -> Bool {
   }
 }
 
-// (5) RED: a DISABLED timer refuses on UnitFileState even when everything else reads clean --
-// this is the control the ruling names beside a fresh, manually fabricated tick.
-test fn witness_disabled_timer_refuses() -> Bool {
-  match judge_belt_timer(unit: "gunbc-belt.timer", expect: fixture_timer_expectation(), o: fixture_timer_observed(unit_file_state: "disabled", active_state: "active", target: "gunbc-belt.service")) {
-    BeltTimerConverged { unit: _ } => false
-    BeltTimerRefused { unit: _, property: p, expected: e, observed: o } => p == "UnitFileState" && e == "enabled" && o == "disabled"
-  }
-}
 
-test fn witness_enabled_waiting_timer_on_the_exact_service_is_converged() -> Bool {
-  match judge_belt_timer(unit: "gunbc-belt.timer", expect: fixture_timer_expectation(), o: fixture_timer_observed(unit_file_state: "enabled", active_state: "active", target: "gunbc-belt.service")) {
-    BeltTimerConverged { unit: u } => u == "gunbc-belt.timer"
-    BeltTimerRefused { unit: _, property: _, expected: _, observed: _ } => false
-  }
-}
 
-test fn witness_timer_targeting_another_service_refuses() -> Bool {
-  match judge_belt_timer(unit: "gunbc-belt.timer", expect: fixture_timer_expectation(), o: fixture_timer_observed(unit_file_state: "enabled", active_state: "active", target: "gunbc-belt-lab.service")) {
-    BeltTimerConverged { unit: _ } => false
-    BeltTimerRefused { unit: _, property: p, expected: _, observed: _ } => p == "Unit"
-  }
-}
 
 // (6) The dashboard service must be enabled AND active; ExecStart is compared exactly.
 test fn witness_dashboard_service_with_drifted_exec_start_refuses() -> Bool {
@@ -153,18 +110,18 @@ test fn witness_dashboard_service_with_drifted_exec_start_refuses() -> Bool {
 test fn witness_expectations_derive_from_the_emitted_srv1_units() -> Bool {
   let spec = deployment_spec_srv1()
   let belt = match service_unit_expectation_of(file: live_deploy_belt_service_unit_file(spec: spec)) {
-    ServiceExpectationDerived { expectation: e } => e.user == (spec.service.service_user as String) && string_contains(s: e.exec_start, pattern: "belt_run_once_cli")
+    ServiceExpectationDerived { expectation: e } => e.user == (spec.service.service_user as String) && string_contains(s: e.exec_start, pattern: "belt_launch_enqueue_cli")
     ServiceExpectationUnderivable { detail: _ } => false
   }
-  let timer = match timer_unit_expectation_of(file: live_deploy_belt_timer_unit_file(spec: spec)) {
-    TimerExpectationDerived { expectation: e } => e.target_unit == (deployment_belt_service_unit_name(names: spec.names) as String)
-    TimerExpectationUnderivable { detail: _ } => false
+  let exit_path = match path_unit_target_of(file: live_deploy_belt_exit_path_unit_file(spec: spec)) {
+    Present { value: t } => t == (deployment_belt_exit_drain_service_unit_name(names: spec.names) as String)
+    Absent => false
   }
-  let mismatched = match timer_unit_expectation_of(file: live_deploy_belt_service_unit_file(spec: spec)) {
-    TimerExpectationDerived { expectation: _ } => false
-    TimerExpectationUnderivable { detail: _ } => true
+  let mismatched = match path_unit_target_of(file: live_deploy_belt_service_unit_file(spec: spec)) {
+    Present { value: _ } => false
+    Absent => true
   }
-  belt && timer && mismatched
+  belt && exit_path && mismatched
 }
 
 // (8) systemd.time(7) normalization: "60s" == "1min" is decidable equality; unknown units, empty
@@ -181,19 +138,4 @@ test fn witness_systemd_duration_normalizes_equal_spellings() -> Bool {
     && (match systemd_duration_usec(text: "min") { Present { value: _ } => false  Absent => true })
 }
 
-// (9) RED (review 5061891290 P1-3): a timer whose EFFECTIVE cadence is not R's emitted value
-// refuses on the value, even though both directive names are present and everything else is clean.
-test fn witness_timer_with_wrong_cadence_value_refuses() -> Bool {
-  match judge_belt_timer(unit: "gunbc-belt.timer", expect: fixture_timer_expectation(), o: fixture_timer_observed_with_cadence(unit_file_state: "enabled", active_state: "active", target: "gunbc-belt.service", on_unit_inactive: "5min")) {
-    BeltTimerConverged { unit: _ } => false
-    BeltTimerRefused { unit: _, property: p, expected: e, observed: o } => p == "OnUnitInactiveUSec" && e == "60000000" && o == "300000000"
-  }
-}
 
-// (10) The derived expectation carries R's cadence VALUES from the emitted unit, one authority.
-test fn witness_derived_timer_expectation_carries_the_emitted_cadence() -> Bool {
-  match timer_unit_expectation_of(file: live_deploy_belt_timer_unit_file(spec: deployment_spec_srv1())) {
-    TimerExpectationDerived { expectation: e } => microsecond_count(e.on_unit_inactive_usec) == 60000000 && microsecond_count(e.on_boot_usec) == 120000000 && microsecond_count(e.accuracy_usec) == 5000000
-    TimerExpectationUnderivable { detail: _ } => false
-  }
-}
diff --git a/dag/test/claim/live_deploy_unit_emission_oracle_witness_test.dag b/dag/test/claim/live_deploy_unit_emission_oracle_witness_test.dag
index 7739658cc4c..4935ecd3194 100644
--- a/dag/test/claim/live_deploy_unit_emission_oracle_witness_test.dag
+++ b/dag/test/claim/live_deploy_unit_emission_oracle_witness_test.dag
@@ -22,19 +22,18 @@ import gunbc.live_deploy.slice_bounds {
 // oracle in a file that cannot resolve is evidence of nothing, and it failed silently because the
 // only thing that would have caught it is the resolve this import makes possible.
 import test.claim.live_deploy.deploy_release_fixture { deploy_witness_release_revision }
+import gunbc.live_deploy.belt_cadence { belt_tick_run_bound }
 import gunbc.live_deploy.emit {
   emit_slice_unit_doc,
   live_deploy_protocol,
   emit_belt_service_unit_doc,
-  emit_belt_timer_unit_doc,
   emit_systemd_unit_doc,
   live_deploy_belt_service_unit_file,
-  live_deploy_belt_timer_unit_file,
+  live_deploy_belt_exit_path_unit_file, live_deploy_belt_answer_path_unit_file,
+  live_deploy_belt_exit_drain_service_unit_file, live_deploy_belt_discovery_service_unit_file,
   live_deploy_serve_unit_file,
   live_deploy_slice_unit_file,
   user_manager_environment_directives,
-  belt_tick_cadence,
-  belt_tick_run_bound,
   eval_budget_flag_text,
   emit_approval_broker_slice_unit_doc,
   emit_approval_broker_unit_doc,
@@ -52,6 +51,7 @@ import gunbc.live_deploy.spec {
   DeploymentServiceConfig,
   deployment_slice_unit_name,
   deployment_belt_service_unit_name,
+  deployment_belt_exit_drain_service_unit_name, deployment_belt_exit_drain_service_unit_path, deployment_belt_unit_install_target, deployment_belt_discovery_service_unit_name,
   gunbc_approval_broker_slice_unit_name,
   gunbc_repository_convergence_slice_unit_name,
   gunbc_approval_broker_unit_name,
@@ -59,10 +59,11 @@ import gunbc.live_deploy.spec {
 import gunbc.auth.approval_broker_endpoint { approval_broker_listen_port }
 import gunbc.live_deploy.desired { deployment_spec_srv1 }
 import gunbc.live_deploy.repository_convergence_placement { convergence_unit_doc }
-import extdeps.systemd { MemoryMax, MemoryHigh, MemorySwapMax }
+import extdeps.systemd { MemoryMax, MemoryHigh, MemorySwapMax, systemd_time_span_of_seconds }
 import extdeps.http.server { HttpServerListenConfig }
 import v2.std.algebra { any, for_all }
 import extdeps.systemd.unit_file {
+  systemd_unit_file_lines,
   SystemdUnitFile,
   ServiceUnitFile,
   TimerUnitFile,
@@ -95,7 +96,7 @@ import extdeps.systemd.unit_file {
   SystemdSliceDirective,
   DirectiveByteCount,
 }
-import gunbc.host_layout { belt_spawn_workdir_env_var }
+import gunbc.host_layout { belt_spawn_workdir_env_var, attempt_exit_inbox_dir, publication_answer_dir }
 
 // A DATED, INDEPENDENTLY TRANSCRIBED REALIZATION FIXTURE — NOT LIVE DRIFT DETECTION.
 //
@@ -137,8 +138,8 @@ import gunbc.host_layout { belt_spawn_workdir_env_var }
 //                                       assertion beside it (watch the Decision, not the bytes)
 //                                       pins the watchdog decision itself.
 //
-// So per row, as of this writing: the_belt_timer_unit_matches_the_deployed_bytes still holds its
-// 2026-08-19 transcription and is the only row carrying an external referent. belt-service, serve
+// So per row, as of this writing: the belt timer row that held the 2026-08-19 transcription is gone
+// with the timer (dogfood intervention #4), so NO row carries an external referent. belt-service, serve
 // and tree-sync have each been edited to follow the emitter and are now EMITTER-REGRESSION PINS —
 // they still refuse an unintended emission change, which is worth keeping, but they are no longer
 // evidence that the emitter agrees with anything outside this tree. The slice row never had a
@@ -217,7 +218,7 @@ fn live_revision() -> ReleaseRevisionBinding {
 // when this unit is next applied.
 test fn the_belt_service_unit_matches_the_deployed_bytes() -> Bool {
   let emitted = render(doc: emit_belt_service_unit_doc(spec: live_spec()), proto: live_deploy_protocol)
-  emitted == "[Unit]\nDescription=gunbc roadmap belt tick (one reconcile pass over the ready frontier)\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=oneshot\nTimeoutStartSec=45min\nUser=briansrls\nGroup=briansrls\nSlice=gunbc-roadmap.slice\nWorkingDirectory=/opt/gunbc/gunbc\nEnvironment=GUNBC_BELT_SPAWN_WORKDIR=/opt/gunbc/gunbc\nEnvironment=XDG_RUNTIME_DIR=/run/user/1000\nEnvironment=DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus\nExecStart=/opt/gunbc/bin/gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/roadmap/roadmap_belt_tick_cli.dag --function belt_run_once_cli\n"
+  emitted == "[Unit]\nDescription=gunbc roadmap belt launch (queues the one launch obligation: admission, spawn, teardown, discovery)\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=oneshot\nTimeoutStartSec=2700s\nUser=briansrls\nGroup=briansrls\nSlice=gunbc-roadmap.slice\nWorkingDirectory=/opt/gunbc/gunbc\nEnvironment=GUNBC_BELT_SPAWN_WORKDIR=/opt/gunbc/gunbc\nEnvironment=XDG_RUNTIME_DIR=/run/user/1000\nEnvironment=DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus\nExecStart=/opt/gunbc/bin/gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/roadmap/roadmap_belt_tick_cli.dag --function belt_launch_enqueue_cli\n"
 }
 
 // THE WATCHDOG DECISION, PINNED AT DIRECTIVE LEVEL, because the byte row above is an
@@ -231,15 +232,10 @@ test fn the_belt_service_unit_matches_the_deployed_bytes() -> Bool {
 test fn the_belt_service_unit_carries_the_per_tick_watchdog_bound() -> Bool {
   service_has(
     file: live_deploy_belt_service_unit_file(spec: live_spec()),
-    target: TimeoutStartSec { duration: belt_tick_run_bound as NonEmptyStr },
+    target: TimeoutStartSec { duration: systemd_time_span_of_seconds(d: belt_tick_run_bound) },
   )
 }
 
-// gunbc-roadmap-belt.timer, as deployed on srv1 2026-08-19.
-test fn the_belt_timer_unit_matches_the_deployed_bytes() -> Bool {
-  let emitted = render(doc: emit_belt_timer_unit_doc(spec: live_spec()), proto: live_deploy_protocol)
-  emitted == "[Unit]\nDescription=gunbc roadmap belt tick cadence\n\n[Timer]\nUnit=gunbc-roadmap-belt.service\nOnBootSec=2min\nOnUnitInactiveSec=60s\nAccuracySec=5s\n\n[Install]\nWantedBy=timers.target\n"
-}
 
 // gunbc-roadmap.service, as deployed on srv1. LIKE THE BELT ROW ABOVE, this briefly carried an
 // EnvironmentFile line and no longer does, for the same reason: POST /publish/NODE_ID reaches the
@@ -414,7 +410,7 @@ test fn the_convergence_slice_carries_its_own_bounds() -> Bool {
 //   - the belt runs inside the deployment's cgroup slice
 //   - the belt works in the deployment's service repository tree
 //   - the belt carries a user-manager bus environment for the principal's uid
-//   - the belt tick entrypoint is belt_run_once_cli
+//   - the belt service entrypoint is belt_launch_enqueue_cli (it queues the launch obligation)
 //   - the belt spawn workdir environment variable names the repo root
 
 fn belt_service_file() -> SystemdUnitFile {
@@ -449,6 +445,7 @@ fn unit_has(file: SystemdUnitFile, target: SystemdUnitDirective) -> Bool {
     ServiceUnitFile { unit: u, service: _, install: _ } => has_directive_unit(dirs: u, target: target)
     TimerUnitFile { unit: u, timer: _, install: _ } => has_directive_unit(dirs: u, target: target)
     SliceUnitFile { unit: u, slice: _, install: _ } => has_directive_unit(dirs: u, target: target)
+    PathUnitFile { unit: u, path: _, install: _ } => has_directive_unit(dirs: u, target: target)
   }
 }
 
@@ -534,7 +531,7 @@ test fn belt_service_execstart_is_belt_tick_cli() -> Bool {
   service_has(file: belt_service_file(), target: ExecStart { command: join([
     svc.serve_binary as String,
     " run --source-root dag --source-root src/v2",
-    " --entry dag/gunbc/roadmap/roadmap_belt_tick_cli.dag --function belt_run_once_cli",
+    " --entry dag/gunbc/roadmap/roadmap_belt_tick_cli.dag --function belt_launch_enqueue_cli",
   ], "") as NonEmptyStr })
 }
 
@@ -546,7 +543,7 @@ test fn belt_service_type_is_oneshot() -> Bool {
 // DECISION: the belt unit has a Description, After=network-online.target, and Wants=network-online.target.
 test fn belt_service_has_unit_directives() -> Bool {
   let f = belt_service_file()
-  unit_has(file: f, target: Description { text: "gunbc roadmap belt tick (one reconcile pass over the ready frontier)" as NonEmptyStr })
+  unit_has(file: f, target: Description { text: "gunbc roadmap belt launch (queues the one launch obligation: admission, spawn, teardown, discovery)" as NonEmptyStr })
     && unit_has(file: f, target: After { target: "network-online.target" as NonEmptyStr })
     && unit_has(file: f, target: Wants { target: "network-online.target" as NonEmptyStr })
 }
@@ -560,48 +557,55 @@ test fn belt_service_is_not_installable() -> Bool {
 }
 
 // ══════════════════════════════════════════════════════════════════════════════════════════════════
-// BELT TIMER UNIT — directive-level assertions through the typed model
+// BELT EVENT PATH UNITS — directive-level assertions through the typed model
 // ══════════════════════════════════════════════════════════════════════════════════════════════════
 //
-// DECISIONS ASSERTED:
-//   - the timer targets the belt service unit
-//   - the timer cadence is the declared policy values (OnBootSec=2min, OnUnitInactiveSec=60s, AccuracySec=5s)
-//   - the timer is installable as WantedBy=timers.target
+// DECISIONS ASSERTED (dogfood intervention #4: there is no belt timer):
+//   - the exit path activates the exit drain and watches the instance's exit inbox as a LEVEL
+//   - the publication-answer path activates discovery and watches the answer directory as an EDGE
+//   - both are installable under paths.target, and both services run as the belt service does
 
-fn belt_timer_file() -> SystemdUnitFile {
-  live_deploy_belt_timer_unit_file(spec: live_spec())
+fn path_has_line(file: SystemdUnitFile, line: String) -> Bool {
+  any(systemd_unit_file_lines(file: file), l => l == line)
 }
 
-// DECISION: the timer targets the belt service unit, consuming the canonical name.
-test fn belt_timer_targets_belt_service() -> Bool {
+test fn the_exit_path_wakes_the_drain_on_a_non_empty_inbox() -> Bool {
   let spec = live_spec()
-  timer_has(file: belt_timer_file(), target: TimerUnit { target: deployment_belt_service_unit_name(names: spec.names) })
+  let f = live_deploy_belt_exit_path_unit_file(spec: spec)
+  path_has_line(file: f, line: join(["Unit=", deployment_belt_exit_drain_service_unit_name(names: spec.names) as String], ""))
+    && path_has_line(file: f, line: join(["DirectoryNotEmpty=", attempt_exit_inbox_dir(instance_root: spec.service.instance_root as String)], ""))
+    && path_has_line(file: f, line: "WantedBy=paths.target")
 }
 
-// DECISION: the timer cadence is the declared policy values.
-// OnUnitInactiveSec derives from belt_tick_cadence ("60s") in emit.dag.
-// OnBootSec and AccuracySec are transcribed from the same source the emitter uses
-// and are additionally pinned by the_belt_timer_unit_matches_the_deployed_bytes below.
-test fn belt_timer_has_declared_cadence() -> Bool {
-  timer_has(file: belt_timer_file(), target: OnBootSec { duration: "2min" as NonEmptyStr })
-    && timer_has(file: belt_timer_file(), target: OnUnitInactiveSec { duration: belt_tick_cadence as NonEmptyStr })
-    && timer_has(file: belt_timer_file(), target: AccuracySec { duration: "5s" as NonEmptyStr })
+// THE BOOT RECONCILE'S TARGET MATCHES THE MANAGER THE DRAIN IS INSTALLED INTO: a unit under the system unit
+// directory is wanted by multi-user.target (the system manager), and the derived target is what the
+// emitted drain unit carries -- not a literal. A user-manager install would need default.target.
+test fn the_drain_is_wanted_by_the_boot_target_of_the_manager_it_is_installed_into() -> Bool {
+  let spec = live_spec()
+  let f = live_deploy_belt_exit_drain_service_unit_file(spec: spec)
+  let dest = deployment_belt_exit_drain_service_unit_path(names: spec.names) as String
+  let target = deployment_belt_unit_install_target(names: spec.names) as String
+  path_has_line(file: f, line: join(["WantedBy=", target], ""))
+    && starts_with(s: dest, prefix: "/etc/systemd/system/") && target == "multi-user.target"
 }
 
-// DECISION: the timer has a Description.
-test fn belt_timer_has_description() -> Bool {
-  unit_has(file: belt_timer_file(), target: Description {
-    text: "gunbc roadmap belt tick cadence" as NonEmptyStr,
-  })
+test fn the_answer_path_wakes_discovery_on_a_changed_answer_directory() -> Bool {
+  let spec = live_spec()
+  let f = live_deploy_belt_answer_path_unit_file(spec: spec)
+  path_has_line(file: f, line: join(["Unit=", deployment_belt_discovery_service_unit_name(names: spec.names) as String], ""))
+    && path_has_line(file: f, line: join(["PathChanged=", publication_answer_dir(instance_root: spec.service.instance_root as String)], ""))
+    && !path_has_line(file: f, line: join(["DirectoryNotEmpty=", publication_answer_dir(instance_root: spec.service.instance_root as String)], ""))
 }
 
-// DECISION: the timer is installable as WantedBy=timers.target.
-test fn belt_timer_is_installable_as_timers_target() -> Bool {
-  match belt_timer_file() {
-    TimerUnitFile { unit: _, timer: _, install: Installable { directives: ds } } =>
-      has_directive_install(dirs: ds, target: WantedBy { target: "timers.target" as NonEmptyStr })
-    _ => false
-  }
+test fn the_event_services_run_their_entries_as_the_belt_service_does() -> Bool {
+  let spec = live_spec()
+  let drain = systemd_unit_file_lines(file: live_deploy_belt_exit_drain_service_unit_file(spec: spec))
+  let discovery = systemd_unit_file_lines(file: live_deploy_belt_discovery_service_unit_file(spec: spec))
+  let belt = systemd_unit_file_lines(file: live_deploy_belt_service_unit_file(spec: spec))
+  let shared = ["Type=oneshot", "User=briansrls", "Slice=gunbc-roadmap.slice", "Environment=GUNBC_BELT_SPAWN_WORKDIR=/opt/gunbc/gunbc"]
+  for_all(shared, predicate: fn(l) { any(drain, d => d == l) && any(discovery, d => d == l) && any(belt, d => d == l) })
+    && any(drain, l => string_contains(s: l, pattern: "--function belt_exit_drain_cli"))
+    && any(discovery, l => string_contains(s: l, pattern: "--function belt_discover_once_cli"))
 }
 
 // ══════════════════════════════════════════════════════════════════════════════════════════════════
@@ -787,7 +791,7 @@ fn spec_with_principal(wrong_user: NonEmptyStr) -> DeploymentSpec {
           instance_root: ir, repo_root: rr, service_uid: uid,
           listen: l, serve_cpu_limit: cpu, serve_wall_limit: wall } =>
           DeploymentSpec {
-            target: t, steps: s, names: n, instance_id: iid, approval_broker: ab,
+            target: t, steps: s, names: n, instance_id: iid, approval_broker: ab, directories: base.directories,
             service: DeploymentServiceConfig {
               unit_name: u, serve_binary: b, serve_entry: se, serve_function: f,
               provider_state_root: ps,
@@ -826,7 +830,7 @@ fn spec_with_repo_root(wrong_root: NonEmptyStr) -> DeploymentSpec {
           instance_root: ir, service_user: su, service_uid: uid,
           listen: l, serve_cpu_limit: cpu, serve_wall_limit: wall } =>
           DeploymentSpec {
-            target: t, steps: s, names: n, instance_id: iid, approval_broker: ab,
+            target: t, steps: s, names: n, instance_id: iid, approval_broker: ab, directories: live_spec().directories,
             service: DeploymentServiceConfig {
               unit_name: u, serve_binary: b, serve_entry: se, serve_function: f,
               provider_state_root: ps,
@@ -874,7 +878,7 @@ fn spec_with_port(wrong_port: Port) -> DeploymentSpec {
           instance_root: ir, repo_root: rr, service_user: su, service_uid: uid,
           listen: l, serve_cpu_limit: cpu, serve_wall_limit: wall } =>
           DeploymentSpec {
-            target: t, steps: s, names: n, instance_id: iid, approval_broker: ab,
+            target: t, steps: s, names: n, instance_id: iid, approval_broker: ab, directories: live_spec().directories,
             service: DeploymentServiceConfig {
               unit_name: u, serve_binary: b, serve_entry: se, serve_function: f,
               provider_state_root: ps,
diff --git a/dag/test/claim/long/namespace_graft_body_dissolution_witness_test.dag b/dag/test/claim/long/namespace_graft_body_dissolution_witness_test.dag
index deaeb83daf4..6544640ceae 100644
--- a/dag/test/claim/long/namespace_graft_body_dissolution_witness_test.dag
+++ b/dag/test/claim/long/namespace_graft_body_dissolution_witness_test.dag
@@ -24,8 +24,8 @@ fn artifact_tree(artifact: ParseArtifact) -> ParseTree {
 }
 
 // The graft rejection flows through rejected_with_pending, which PREPENDS the pending
-// accepted-carrier diagnostics (wrapper-retained bodies) to the rejection — the head-masking shape
-// the sweep's first_located_cause already skips. The assertion is therefore containment: the
+// accepted-carrier diagnostics (wrapper-retained bodies) to the rejection, so the head can be a
+// carrier rather than the cause. The assertion is therefore containment: the
 // refusal CARRIES the guard's typed reason, wherever the pending carriers put it.
 fn rejection_reasons(source: String) -> List<Symbol> {
   match lex_walk_artifact(source: chars(s: source), file: ^graft_guard_probe, rules: dag_lex_rules()) {
diff --git a/dag/test/claim/machine_intake/boot_artifact_delivery_witness_test.dag b/dag/test/claim/machine_intake/boot_artifact_delivery_witness_test.dag
index 29caab39225..0d4bf1b661c 100644
--- a/dag/test/claim/machine_intake/boot_artifact_delivery_witness_test.dag
+++ b/dag/test/claim/machine_intake/boot_artifact_delivery_witness_test.dag
@@ -1,5 +1,9 @@
 module test.claim.boot_artifact_delivery_witness_test
 
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
+import extdeps.board_authority { BoardFruObservation, BoardUnbound }
+import test.fixture.board_fru_observation { collins_fru_read, asrock_fru_read }
+import gunbc.board_authority_binding { board_authority_bindings }
 import std.types { Bool, Int, List, NonEmptyStr, String, list_length }
 import std.content_hash { ContentHash, content_hash_of_value }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
@@ -46,7 +50,6 @@ import extdeps.bmc.redfish_virtual_media {
   UnderManager,
   redfish_virtual_media_insert_action_path,
 }
-import extdeps.boards.types { AmpereMtCollins, AsrockRackAltrad8ud1l2t, BaseboardModel }
 import extdeps.bmc.access_profile {
   AccessProfileCatalogRowRefused,
   AccessProfileKnown,
@@ -96,6 +99,7 @@ import gunbc.machine_intake_access {
   AccessContextObservationForOtherAttempt,
   AccessContextProbeEvidenceMismatch,
   AccessContextProfileLookupNotRun,
+  AccessContextBoardNotFactsBound,
   AccessContextProfileUncatalogued,
   AccessContextPromotedProfileUnverified,
   AccessContextUnobserved,
@@ -309,7 +313,7 @@ data redfish_route: BmcAccessRoute = RedfishRoute {
 
 fn profile_keyed(rel: BmcFirmwareReleaseIdentity, routes: List<BmcAccessRoute>, surfaces: List<BmcAccessSurface>, row: BmcFirmwareReleaseCapabilityRow) -> BmcAccessProfile {
   BmcAccessProfile {
-    key: BmcAccessProfileKey { baseboard: AmpereMtCollins, chassis: AllChassisVariants, firmware: rel },
+    key: BmcAccessProfileKey { board: mt_collins_board_authority, chassis: AllChassisVariants, firmware: rel },
     routes: routes,
     bootstrap_credential: none,
     candidate_surfaces: surfaces,
@@ -319,7 +323,7 @@ fn profile_keyed(rel: BmcFirmwareReleaseIdentity, routes: List<BmcAccessRoute>,
 
 fn profile_of(routes: List<BmcAccessRoute>, surfaces: List<BmcAccessSurface>, row: BmcFirmwareReleaseCapabilityRow) -> BmcAccessProfile {
   BmcAccessProfile {
-    key: BmcAccessProfileKey { baseboard: AmpereMtCollins, chassis: AllChassisVariants, firmware: megarac_release },
+    key: BmcAccessProfileKey { board: mt_collins_board_authority, chassis: AllChassisVariants, firmware: megarac_release },
     routes: routes,
     bootstrap_credential: none,
     candidate_surfaces: surfaces,
@@ -371,11 +375,11 @@ data no_override_profile: BmcAccessProfile = profile_of(routes: [redfish_route],
 // ---------------------------------------------------------------------------
 data discovery_digest: ContentHash = content_hash_of_value(value: "bmc-discovery-response-fixture")
 
-fn identity_of(baseboard: BaseboardModel, firmware: BmcFirmwareReleaseIdentity) -> BmcObservedIdentity {
-  BmcObservedIdentity { baseboard: baseboard, chassis_part_number: none, firmware: firmware }
+fn identity_of(board: BoardFruObservation, firmware: BmcFirmwareReleaseIdentity) -> BmcObservedIdentity {
+  BmcObservedIdentity { board: board, chassis_part_number: none, firmware: firmware }
 }
 
-data mt_collins_identity: BmcObservedIdentity = identity_of(baseboard: AmpereMtCollins, firmware: megarac_release)
+data mt_collins_identity: BmcObservedIdentity = identity_of(board: collins_fru_read, firmware: megarac_release)
 
 data probe_https: RedfishVirtualMediaProbeReceipt = RedfishVirtualMediaProbeReceipt {
   locator: RedfishVirtualMediaLocator { parent: UnderManager { manager_id: "1" }, media_id: "CD1" },
@@ -722,8 +726,8 @@ test fn capability_row_for_another_release_refuses_the_catalog() -> Bool {
     Absent => true
     Present { value: _ } => false
   }
-  let raw_identity = identity_of(baseboard: AmpereMtCollins, firmware: mt_collins_raw_release)
-  let lookup_refused = match bmc_access_profile_for(identity: raw_identity, catalog: catalog_of(profile: raw_keyed)) {
+  let raw_identity = identity_of(board: collins_fru_read, firmware: mt_collins_raw_release)
+  let lookup_refused = match bmc_access_profile_for(identity: raw_identity, catalog: catalog_of(profile: raw_keyed), bindings: board_authority_bindings) {
     AccessProfileCatalogRowRefused { standing: s } =>
       match s {
         CatalogRowCapabilityFirmwareMismatch { key: _, row: _ } => true
@@ -744,7 +748,7 @@ test fn capability_row_for_another_release_refuses_the_catalog() -> Bool {
 // observation receipt: the context binds and the MegaRAC delivery is planned.
 // A fixture proving inhabitability, not a seeded fleet observation.
 test fn raw_release_0_32_binds_a_profile_and_plans_megarac_delivery() -> Bool {
-  let raw_identity = identity_of(baseboard: AmpereMtCollins, firmware: mt_collins_raw_release)
+  let raw_identity = identity_of(board: collins_fru_read, firmware: mt_collins_raw_release)
   let receipt = receipt_of(subject: intake_subject, standing: BmcAccessObserved { observation: observation_of(identity: raw_identity, surfaces: [SurfaceBootControl, SurfaceOemRestRemoteMedia], probe: none) }, manifest: full_manifest)
   let bound = match bind(profile: mt_collins_raw_profile, receipt: receipt) {
     AccessContextBound { context: c } => c.capability_row.firmware.raw_version == "0.32" && c.identity.firmware.raw_version == "0.32"
@@ -963,10 +967,10 @@ test fn redfish_virtual_media_absent_from_live_observation_is_not_selected() ->
 // RULING §2 CONTROL — same release, a DIFFERENT board: the lookup is
 // uncatalogued for that identity, so no context binds.
 test fn same_release_on_another_board_does_not_pair_with_the_profile() -> Bool {
-  let asrock_identity = identity_of(baseboard: AsrockRackAltrad8ud1l2t, firmware: megarac_release)
+  let asrock_identity = identity_of(board: asrock_fru_read, firmware: megarac_release)
   let receipt = receipt_of(subject: intake_subject, standing: BmcAccessObserved { observation: observation_of(identity: asrock_identity, surfaces: [SurfaceBootControl, SurfaceRedfishVirtualMedia], probe: Present { value: probe_https }) }, manifest: full_manifest)
   match bind(profile: vm_profile, receipt: receipt) {
-    AccessContextProfileUncatalogued { observed_identity: i } => i.baseboard == AsrockRackAltrad8ud1l2t
+    AccessContextBoardNotFactsBound { observed_identity: _, board: b } => match b { BoardUnbound { fru: _ } => true  _ => false }
     _ => false
   }
 }
@@ -974,7 +978,7 @@ test fn same_release_on_another_board_does_not_pair_with_the_profile() -> Bool {
 // An observation of a DIFFERENT release than the profile is uncatalogued
 // against it: the key binds the raw release string, not a nearest version.
 test fn live_observation_at_another_release_does_not_bind_the_profile() -> Bool {
-  let receipt = receipt_of(subject: intake_subject, standing: BmcAccessObserved { observation: observation_of(identity: identity_of(baseboard: AmpereMtCollins, firmware: megarac_release_other), surfaces: [SurfaceBootControl, SurfaceRedfishVirtualMedia], probe: Present { value: probe_https }) }, manifest: full_manifest)
+  let receipt = receipt_of(subject: intake_subject, standing: BmcAccessObserved { observation: observation_of(identity: identity_of(board: collins_fru_read, firmware: megarac_release_other), surfaces: [SurfaceBootControl, SurfaceRedfishVirtualMedia], probe: Present { value: probe_https }) }, manifest: full_manifest)
   match bind(profile: vm_profile, receipt: receipt) {
     AccessContextProfileUncatalogued { observed_identity: i } => i.firmware.raw_version == "1.2.4"
     _ => false
@@ -985,16 +989,17 @@ test fn live_observation_at_another_release_does_not_bind_the_profile() -> Bool
 // does not bind an identity that reported no chassis part number.
 test fn exact_chassis_profile_does_not_bind_an_unreported_chassis() -> Bool {
   let exact = BmcAccessProfile {
-    key: BmcAccessProfileKey { baseboard: AmpereMtCollins, chassis: ExactChassisPartNumber { part_number: "CH-2U-MTC" }, firmware: megarac_release },
+    key: BmcAccessProfileKey { board: mt_collins_board_authority, chassis: ExactChassisPartNumber { part_number: "CH-2U-MTC" }, firmware: megarac_release },
     routes: vm_profile.routes,
     bootstrap_credential: none,
     candidate_surfaces: vm_profile.candidate_surfaces,
     capability_row: vm_and_oem_row,
   }
-  let unreported = bmc_access_profile_for(identity: mt_collins_identity, catalog: catalog_of(profile: exact))
+  let unreported = bmc_access_profile_for(identity: mt_collins_identity, catalog: catalog_of(profile: exact), bindings: board_authority_bindings)
   let reported = bmc_access_profile_for(
-    identity: BmcObservedIdentity { baseboard: AmpereMtCollins, chassis_part_number: Present { value: "CH-2U-MTC" }, firmware: megarac_release },
+    identity: BmcObservedIdentity { board: collins_fru_read, chassis_part_number: Present { value: "CH-2U-MTC" }, firmware: megarac_release },
     catalog: catalog_of(profile: exact),
+    bindings: board_authority_bindings,
   )
   let unreported_refuses = match unreported {
     AccessProfileUncatalogued { observed_identity: _ } => true
diff --git a/dag/test/claim/machine_intake/dimm_physical_orientation_forged_probe_witness_test.dag b/dag/test/claim/machine_intake/dimm_physical_orientation_forged_probe_witness_test.dag
index 2c3232e611b..b56ec6779ab 100644
--- a/dag/test/claim/machine_intake/dimm_physical_orientation_forged_probe_witness_test.dag
+++ b/dag/test/claim/machine_intake/dimm_physical_orientation_forged_probe_witness_test.dag
@@ -14,7 +14,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // outcome the bound host's board never selected. This witness hands that source to the compiler through
 // the diagnostic-census harness and requires the refusal class at that subject by name; the harness
 // control shows the census ran and that a source reaching the real mint emits no such row.
-data forged_probe_source: String = "module probe_dimm_physical_orientation_forged\n\nimport gunbc.fleet_host_identity { operator_host_mtcollins1 }\nimport extdeps.boards.types { GigabyteMp72Hb0 }\nimport gunbc.baseboard_dimm_figure { MtCollinsGettingStartedGuideFigures }\nimport extdeps.ampere.mt_collins_getting_started_guide.subject { mt_collins_gsg_authority }\nimport gunbc.machine_intake_dimm_physical_orientation { DimmOrientedHost }\nimport gunbc.machine_intake_dimm_row_orientation { OrientationContradicted }\n\nfn forged() -> DimmOrientedHost {\n  DimmOrientedHost { host: operator_host_mtcollins1, board: GigabyteMp72Hb0, figure: MtCollinsGettingStartedGuideFigures { guide: mt_collins_gsg_authority }, outcome: OrientationContradicted }\n}\n"
+data forged_probe_source: String = "module probe_dimm_physical_orientation_forged\n\nimport gunbc.fleet_host_identity { operator_host_mtcollins1 }\n\nimport gunbc.baseboard_dimm_figure { MtCollinsGettingStartedGuideFigures }\nimport extdeps.ampere.mt_collins_getting_started_guide.subject { mt_collins_gsg_authority }\nimport extdeps.boards.gigabyte { gigabyte_mp72_hb0_board_authority }\nimport gunbc.machine_intake_dimm_physical_orientation { DimmOrientedHost }\nimport gunbc.machine_intake_dimm_row_orientation { OrientationContradicted }\n\nfn forged() -> DimmOrientedHost {\n  DimmOrientedHost { host: operator_host_mtcollins1, board: gigabyte_mp72_hb0_board_authority, figure: MtCollinsGettingStartedGuideFigures { guide: mt_collins_gsg_authority }, outcome: OrientationContradicted }\n}\n"
 
 data harness_control_source: String = "module probe_dimm_physical_orientation_harness_control\nimport std.types { List }\nimport gunbc.managed_host { ManagedHostBinding }\nimport gunbc.machine_intake_dimm_row_orientation { DimmPlacementAnchor }\nimport gunbc.machine_intake_dimm_physical_orientation { HostDimmOrientation, host_dimm_orientation }\nfn orientation(binding: ManagedHostBinding, anchors: List<DimmPlacementAnchor>) -> HostDimmOrientation { host_dimm_orientation(binding: binding, anchors: anchors) }\n"
 
diff --git a/dag/test/claim/machine_intake/dimm_physical_orientation_witness_test.dag b/dag/test/claim/machine_intake/dimm_physical_orientation_witness_test.dag
index 81182c01e4e..fdd00affb53 100644
--- a/dag/test/claim/machine_intake/dimm_physical_orientation_witness_test.dag
+++ b/dag/test/claim/machine_intake/dimm_physical_orientation_witness_test.dag
@@ -1,8 +1,12 @@
 module test.claim.machine_intake.dimm_physical_orientation_witness
 
+import extdeps.board_authority { BoardFruObservation, BoardIdentityBound, BoardUnbound }
+import extdeps.ampere.mt_collins_board { mt_collins_board_authority }
+import extdeps.ocp.mt_jade.subject { mt_jade_board_authority }
+import gunbc.board_authority_binding { observed_board_authority }
+import test.fixture.board_fru_observation { collins_fru_read, jade_fru_read, asrock_fru_read }
 import std.types { Bool, NonEmptyStr, String, List }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import extdeps.boards.types { BaseboardModel, AmpereMtCollins, GigabyteMp72Hb0, AsrockRackAltrad8ud1l2t }
 import extdeps.bmc.access_profile { BmcAccessObservation, BmcAccessObserved, BmcAccessUnobserved, BmcObservedIdentity }
 import gunbc.fleet_host_identity { operator_host_mtcollins1 }
 import gunbc.managed_host {
@@ -20,19 +24,22 @@ import gunbc.machine_intake_mtcollins1_physical_orientation { mtcollins1_placeme
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
 // THE FIGURE IS SELECTED BY BOARD AND ONLY A CITED BOARD HAS ONE. Mt. Collins resolves to its Getting
-// Started Guide figures; the Gigabyte MP72-HB0 (a candidate reference board, not Mt. Jade) and the ASRock Rack ALTRAD8UD
-// have no figure modeled in this repository, so each refuses on its own name.
+// Started Guide figures; the Mt. Jade board (bound by name only, so a figure is refused) and an ASRock Rack
+// ALTRAD8UD (unbound) have no figure modeled in this repository, so each refuses with its own lookup.
 test fn w_only_a_board_with_a_cited_figure_selects_one() -> Bool {
-  let collins = match baseboard_dimm_figure(board: AmpereMtCollins) {
-    BaseboardDimmFigureOf { board: b, figure: f } => b == AmpereMtCollins && match f { MtCollinsGettingStartedGuideFigures { guide: _ } => true }
+  let collins = match baseboard_dimm_figure(board: observed_board_authority(observation: collins_fru_read)) {
+    BaseboardDimmFigureOf { board: b, figure: f } => b == mt_collins_board_authority && match f { MtCollinsGettingStartedGuideFigures { guide: _ } => true }
     BoardFigureUnmodeled { board: _ } => false
   }
-  let jade = match baseboard_dimm_figure(board: GigabyteMp72Hb0) {
-    BoardFigureUnmodeled { board: b } => b == GigabyteMp72Hb0
+  let jade = match baseboard_dimm_figure(board: observed_board_authority(observation: jade_fru_read)) {
+    BoardFigureUnmodeled { board: l } => match l {
+      BoardIdentityBound { authority: a, discriminator_obligation: _ } => a == mt_jade_board_authority
+      _ => false
+    }
     BaseboardDimmFigureOf { board: _, figure: _ } => false
   }
-  let asrock = match baseboard_dimm_figure(board: AsrockRackAltrad8ud1l2t) {
-    BoardFigureUnmodeled { board: b } => b == AsrockRackAltrad8ud1l2t
+  let asrock = match baseboard_dimm_figure(board: observed_board_authority(observation: asrock_fru_read)) {
+    BoardFigureUnmodeled { board: l } => match l { BoardUnbound { fru: _ } => true  _ => false }
     BaseboardDimmFigureOf { board: _, figure: _ } => false
   }
   collins && jade && asrock
@@ -41,7 +48,7 @@ test fn w_only_a_board_with_a_cited_figure_selects_one() -> Bool {
 fn resolves_full_mirror(binding_host: ManagedHost, anchors: List<DimmPlacementAnchor>) -> Bool {
   match managed_host_binding(host: binding_host) {
     ManagedHostBound { binding: b } => match host_dimm_orientation(binding: b, anchors: anchors) {
-      HostDimmOriented { oriented: o } => (o.host as String) == (binding_host.host as String) && o.board == AmpereMtCollins && match o.outcome {
+      HostDimmOriented { oriented: o } => (o.host as String) == (binding_host.host as String) && o.board == mt_collins_board_authority && match o.outcome {
         OrientationResolved { hypothesis: h, order: _ } => h == FullMirror
         OrientationAmbiguous { surviving: _ } => false
         OrientationContradicted => false
@@ -57,10 +64,10 @@ fn resolves_full_mirror(binding_host: ManagedHost, anchors: List<DimmPlacementAn
   }
 }
 
-fn refused_unmodeled(binding_host: ManagedHost, anchors: List<DimmPlacementAnchor>, board: BaseboardModel) -> Bool {
+fn refused_unmodeled(binding_host: ManagedHost, anchors: List<DimmPlacementAnchor>, board: BoardFruObservation) -> Bool {
   match managed_host_binding(host: binding_host) {
     ManagedHostBound { binding: b } => match host_dimm_orientation(binding: b, anchors: anchors) {
-      HostDimmBoardUnmodeled { host: h, board: refused } => refused == board && (h as String) == (binding_host.host as String)
+      HostDimmBoardUnmodeled { host: h, board: refused } => refused == observed_board_authority(observation: board) && (h as String) == (binding_host.host as String)
       HostDimmOriented { oriented: _ } => false
     }
     ManagedHostAccessUnobserved { endpoint: _ } => false
@@ -69,10 +76,10 @@ fn refused_unmodeled(binding_host: ManagedHost, anchors: List<DimmPlacementAncho
   }
 }
 
-fn observed_as(o: BmcAccessObservation, board: BaseboardModel) -> BmcAccessObservation {
+fn observed_as(o: BmcAccessObservation, board: BoardFruObservation) -> BmcAccessObservation {
   BmcAccessObservation {
     endpoint: o.endpoint,
-    identity: BmcObservedIdentity { baseboard: board, chassis_part_number: o.identity.chassis_part_number, firmware: o.identity.firmware },
+    identity: BmcObservedIdentity { board: board, chassis_part_number: o.identity.chassis_part_number, firmware: o.identity.firmware },
     discovered_surfaces: o.discovered_surfaces,
     boot_control_routes: o.boot_control_routes,
     redfish_virtual_media_probe: o.redfish_virtual_media_probe,
@@ -84,7 +91,7 @@ fn observed_as(o: BmcAccessObservation, board: BaseboardModel) -> BmcAccessObser
 }
 
 // THE REAL ROUTE: the mtcollins1 row of gunbc.managed_host, its real binding, the board its controller
-// reported (AmpereMtCollins) and the unit's production anchors resolve the full mirror. This is the
+// reported (mt_collins_board_authority) and the unit's production anchors resolve the full mirror. This is the
 // inhabitance claim the discriminator below pairs with: the board read off the bound observation, not a
 // supplied figure, is what selects the figure.
 test fn w_the_bound_mtcollins1_host_is_oriented_on_the_board_its_controller_reported() -> Bool {
@@ -93,7 +100,7 @@ test fn w_the_bound_mtcollins1_host_is_oriented_on_the_board_its_controller_repo
 }
 
 // DISCRIMINATOR: THE BOARD ALONE IS VARIED. The same row, the same secured account, the same controller
-// and the same anchors, with only the observed baseboard changed to the Gigabyte MP72-HB0 or the ASRock
+// and the same anchors, with only the observed baseboard changed to the Mt. Jade board or the ASRock
 // Rack ALTRAD8UD: the binding still binds, and the orientation refuses BoardFigureUnmodeled naming that
 // board, before any anchor is read. The unchanged row in the same claim resolves, so the refusal is the
 // board's and nothing else's.
@@ -101,12 +108,12 @@ test fn w_the_same_anchors_on_another_reported_board_are_refused_unmodeled() ->
   managed_hosts() |> all(h => match h.access {
     BmcAccessUnobserved { endpoint: _ } => false
     BmcAccessObserved { observation: o } => {
-      let jade = managed_host_fixture(host: h.host, access: BmcAccessObserved { observation: observed_as(o: o, board: GigabyteMp72Hb0) }, capability_row: h.capability_row, secure: h.secure, unit_hold: h.unit_hold, smpro: h.smpro)
-      let asrock = managed_host_fixture(host: h.host, access: BmcAccessObserved { observation: observed_as(o: o, board: AsrockRackAltrad8ud1l2t) }, capability_row: h.capability_row, secure: h.secure, unit_hold: h.unit_hold, smpro: h.smpro)
-      o.identity.baseboard == AmpereMtCollins
+      let jade = managed_host_fixture(host: h.host, access: BmcAccessObserved { observation: observed_as(o: o, board: jade_fru_read) }, capability_row: h.capability_row, secure: h.secure, unit_hold: h.unit_hold, smpro: h.smpro)
+      let asrock = managed_host_fixture(host: h.host, access: BmcAccessObserved { observation: observed_as(o: o, board: asrock_fru_read) }, capability_row: h.capability_row, secure: h.secure, unit_hold: h.unit_hold, smpro: h.smpro)
+      o.identity.board == collins_fru_read
         && resolves_full_mirror(binding_host: h, anchors: mtcollins1_placement_anchors)
-        && refused_unmodeled(binding_host: jade, anchors: mtcollins1_placement_anchors, board: GigabyteMp72Hb0)
-        && refused_unmodeled(binding_host: asrock, anchors: mtcollins1_placement_anchors, board: AsrockRackAltrad8ud1l2t)
+        && refused_unmodeled(binding_host: jade, anchors: mtcollins1_placement_anchors, board: jade_fru_read)
+        && refused_unmodeled(binding_host: asrock, anchors: mtcollins1_placement_anchors, board: asrock_fru_read)
     }
   }) && count(managed_hosts()) == 1
 }
diff --git a/dag/test/claim/machine_intake/machine_intake_arrival_converge_forged_probe_witness_test.dag b/dag/test/claim/machine_intake/machine_intake_arrival_converge_forged_probe_witness_test.dag
index ea735d8e396..79c50ebb349 100644
--- a/dag/test/claim/machine_intake/machine_intake_arrival_converge_forged_probe_witness_test.dag
+++ b/dag/test/claim/machine_intake/machine_intake_arrival_converge_forged_probe_witness_test.dag
@@ -17,7 +17,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // outside its module; this witness hands the source to the compiler through the diagnostic-census
 // harness and requires SoleConstructorViolation at each SUBJECT by name. The class-scoped control shows
 // a clean source reading the same modules through their real producers emits none.
-data forged_probe_source: String = "module probe_arrival_converge_forged\n\nimport std.types { Int, List, NonEmptyStr, String }\nimport std.decl_ref { decl_ref }\nimport gunbc.machine_intake_phase { Arrival, AccessDiscover, IntakePhase }\nimport gunbc.machine_intake_subject { MachineIntakeSubject, BoardSerialObservation, AssemblyManifest, UnitKey }\nimport gunbc.machine_intake_bmc_rotation_route { BmcRotationRouteStanding }\nimport gunbc.machine_intake_mtjade1_factory_network { ObservedBmcNetwork }\nimport gunbc.machine_intake_mtjade1_access_observation {\n  CurrentManagerRead, RecordedManagerIdentityObservation, ControllerClockReading, current_manager_read_of,\n  FruRead, SmbiosRead, FruIdentityFields, RecordedFruObservation, RecordedSmbiosObservation, SolSessionAttribution,\n}\nimport gunbc.fleet.convergence_fold {\n  AdmittedConvergencePlan, RankedStep, StepInstanceKey, ConvergenceRunId, StepSubjectKey, ConvergenceOrderAuthority, ConvergencePlanningAuthority,\n  ConvergenceReceiptProjection, ConvergenceRunLedger, ConvergedRun, StepInstanceStanding,\n  convergence_planning_authority, convergence_receipt_projection,\n}\nimport gunbc.machine_intake_arrival_converge {\n  AccessDiscoverEstablished, IdentityBoundProvisional, ReadOnlyPhaseRemedy, AccessObservation,\n  IdentityBindInputs, ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete, BoardSerialAgreement,\n}\n\nfn forged_access(key: StepInstanceKey, access: AccessObservation, route: BmcRotationRouteStanding) -> AccessDiscoverEstablished {\n  AccessDiscoverEstablished { key: key, access: access, route: route }\n}\n\nfn forged_identity(key: StepInstanceKey, subject: MachineIntakeSubject) -> IdentityBoundProvisional {\n  IdentityBoundProvisional { key: key, consumed_access: key, subject: subject }\n}\n\nfn forged_plan(steps: List<RankedStep<IntakePhase>>, key: StepInstanceKey) -> AdmittedConvergencePlan<IntakePhase> {\n  AdmittedConvergencePlan { authority: key.step_identity, steps: steps }\n}\n\nfn forged_remedy() -> ReadOnlyPhaseRemedy {\n  ReadOnlyPhaseRemedy { phase: AccessDiscover }\n}\n\nfn any_rank(phase: IntakePhase) -> Int? {\n  Present { value: 0 }\n}\n\nfn authored_order() -> ConvergenceOrderAuthority<IntakePhase> {\n  ConvergenceOrderAuthority { authority: decl_ref(module_path: \"gunbc.machine_intake_phase\", decl_name: \"arrival_phases_all\"), rank_of: any_rank }\n}\n\nfn forged_planning_literal() -> ConvergencePlanningAuthority<IntakePhase> {\n  ConvergencePlanningAuthority { order: authored_order() }\n}\n\nfn forged_planning_via_mint() -> ConvergencePlanningAuthority<IntakePhase> {\n  convergence_planning_authority(order: authored_order())\n}\n\nfn rekey(r: ArrivalStepReceipt) -> StepInstanceKey {\n  StepInstanceKey { run: \"forged\" as ConvergenceRunId, step_identity: decl_ref(module_path: \"gunbc.machine_intake_arrival_converge\", decl_name: \"access_discover\"), subject: \"mtjade1\" as StepSubjectKey }\n}\n\nfn consumed_nothing(r: ArrivalStepReceipt) -> List<StepInstanceKey> {\n  []\n}\n\nfn forged_projection_literal() -> ConvergenceReceiptProjection<ArrivalStepReceipt> {\n  ConvergenceReceiptProjection { key_of: rekey, consumed_of: consumed_nothing }\n}\n\nfn forged_projection_via_mint() -> ConvergenceReceiptProjection<ArrivalStepReceipt> {\n  convergence_receipt_projection(key_of: rekey, consumed_of: consumed_nothing)\n}\n\nfn forged_ledger(key: StepInstanceKey, instances: List<StepInstanceStanding<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>>) -> ConvergenceRunLedger<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete> {\n  ConvergenceRunLedger { run: key.run, subject: key.subject, order_authority: key.step_identity, instances: instances }\n}\n\nfn forged_converged_run(ledger: ConvergenceRunLedger<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>) -> ConvergedRun<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete> {\n  ConvergedRun { ledger: ledger }\n}\n\nfn forged_manager_read(identity: RecordedManagerIdentityObservation, clock: ControllerClockReading) -> CurrentManagerRead {\n  CurrentManagerRead { identity: identity, controller_clock: clock }\n}\n\nfn forged_manager_read_via_mint(content: String, endpoint: ObservedBmcNetwork) -> CurrentManagerRead {\n  current_manager_read_of(content: content, expected_sha256: \"00\" as NonEmptyStr, endpoint: endpoint, link: none, capture_path: \"forged\" as NonEmptyStr)\n}\n\nfn forged_identity_inputs(fru: FruRead, smbios: SmbiosRead, units: List<UnitKey>) -> IdentityBindInputs {\n  IdentityBindInputs { fru: fru, smbios: smbios, other_units: units }\n}\n\nfn forged_fru(fields: FruIdentityFields) -> RecordedFruObservation {\n  RecordedFruObservation { subject: \"mtjade1\", capture_path: \"forged\", capture_sha256: \"00\", fields: fields }\n}\n\nfn forged_smbios(attribution: SolSessionAttribution) -> RecordedSmbiosObservation {\n  RecordedSmbiosObservation { subject: \"mtjade1\", capture_path: \"forged\", capture_sha256: \"00\", sol_session: attribution, serial: \"B810301000412080005AJ0C1\" }\n}\n\nfn forged_agreement(fru: RecordedFruObservation, smbios: RecordedSmbiosObservation) -> BoardSerialAgreement {\n  BoardSerialAgreement { fru: fru, smbios: smbios, serial: \"B810301000412080005AJ0C1\" }\n}\n"
+data forged_probe_source: String = "module probe_arrival_converge_forged\n\nimport std.types { Bool, Int, List, NonEmptyStr, String }\nimport std.decl_ref { decl_ref }\nimport gunbc.machine_intake_phase { Arrival, AccessDiscover, IntakePhase }\nimport gunbc.machine_intake_subject { MachineIntakeSubject, BoardSerialObservation, AssemblyManifest, UnitKey }\nimport gunbc.machine_intake_bmc_rotation_route { BmcRotationRouteStanding }\nimport gunbc.machine_intake_mtjade1_factory_network { ObservedBmcNetwork }\nimport gunbc.machine_intake_mtjade1_access_observation {\n  CurrentManagerRead, RecordedManagerIdentityObservation, ControllerClockReading, current_manager_read_of,\n  FruRead, SmbiosRead, FruIdentityFields, RecordedFruObservation, RecordedSmbiosObservation, SolSessionAttribution,\n}\nimport gunbc.fleet.convergence_fold {\n  AdmittedConvergencePlan, RankedStep, StepInstanceKey, ConvergenceRunId, StepSubjectKey, ConvergenceOrderAuthority, ConvergencePlanningAuthority,\n  ConvergenceReceiptProjection, ConvergenceRunLedger, ConvergedRun, StepInstanceStanding,\n  convergence_planning_authority, convergence_receipt_projection,\n}\nimport gunbc.machine_intake_arrival_converge {\n  AccessDiscoverEstablished, IdentityBoundProvisional, ReadOnlyPhaseRemedy, AccessObservation,\n  IdentityBindInputs, ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete, BoardSerialAgreement,\n}\n\nfn forged_access(key: StepInstanceKey, access: AccessObservation, route: BmcRotationRouteStanding) -> AccessDiscoverEstablished {\n  AccessDiscoverEstablished { key: key, access: access, route: route }\n}\n\nfn forged_identity(key: StepInstanceKey, subject: MachineIntakeSubject) -> IdentityBoundProvisional {\n  IdentityBoundProvisional { key: key, consumed_access: key, subject: subject }\n}\n\nfn forged_plan(steps: List<RankedStep<IntakePhase>>, key: StepInstanceKey) -> AdmittedConvergencePlan<IntakePhase> {\n  AdmittedConvergencePlan { authority: key.step_identity, steps: steps }\n}\n\nfn forged_remedy() -> ReadOnlyPhaseRemedy {\n  ReadOnlyPhaseRemedy { phase: AccessDiscover }\n}\n\nfn any_rank(phase: IntakePhase) -> Int? {\n  Present { value: 0 }\n}\n\nfn authored_order() -> ConvergenceOrderAuthority<IntakePhase> {\n  ConvergenceOrderAuthority { authority: decl_ref(module_path: \"gunbc.machine_intake_phase\", decl_name: \"arrival_phases_all\"), rank_of: any_rank }\n}\n\nfn forged_planning_literal() -> ConvergencePlanningAuthority<IntakePhase> {\n  ConvergencePlanningAuthority { order: authored_order() }\n}\n\nfn forged_planning_via_mint() -> ConvergencePlanningAuthority<IntakePhase> {\n  convergence_planning_authority(order: authored_order())\n}\n\nfn rekey(r: ArrivalStepReceipt) -> StepInstanceKey {\n  StepInstanceKey { run: \"forged\" as ConvergenceRunId, step_identity: decl_ref(module_path: \"gunbc.machine_intake_arrival_converge\", decl_name: \"access_discover\"), subject: \"mtjade1\" as StepSubjectKey }\n}\n\nfn consumed_nothing(r: ArrivalStepReceipt) -> List<StepInstanceKey> {\n  []\n}\n\nfn auth_never(r: ArrivalStepReceipt) -> Bool {\n  false\n}\n\nfn forged_projection_literal() -> ConvergenceReceiptProjection<ArrivalStepReceipt> {\n  ConvergenceReceiptProjection { key_of: rekey, consumed_of: consumed_nothing, authorization_required_of: auth_never }\n}\n\nfn forged_projection_via_mint() -> ConvergenceReceiptProjection<ArrivalStepReceipt> {\n  convergence_receipt_projection(key_of: rekey, consumed_of: consumed_nothing, authorization_required_of: auth_never)\n}\n\nfn forged_ledger(key: StepInstanceKey, instances: List<StepInstanceStanding<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>>) -> ConvergenceRunLedger<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete> {\n  ConvergenceRunLedger { run: key.run, subject: key.subject, order_authority: key.step_identity, instances: instances }\n}\n\nfn forged_converged_run(ledger: ConvergenceRunLedger<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>) -> ConvergedRun<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete> {\n  ConvergedRun { ledger: ledger }\n}\n\nfn forged_manager_read(identity: RecordedManagerIdentityObservation, clock: ControllerClockReading) -> CurrentManagerRead {\n  CurrentManagerRead { identity: identity, controller_clock: clock }\n}\n\nfn forged_manager_read_via_mint(content: String, endpoint: ObservedBmcNetwork) -> CurrentManagerRead {\n  current_manager_read_of(content: content, expected_sha256: \"00\" as NonEmptyStr, endpoint: endpoint, link: none, capture_path: \"forged\" as NonEmptyStr)\n}\n\nfn forged_identity_inputs(fru: FruRead, smbios: SmbiosRead, units: List<UnitKey>) -> IdentityBindInputs {\n  IdentityBindInputs { fru: fru, smbios: smbios, other_units: units }\n}\n\nfn forged_fru(fields: FruIdentityFields) -> RecordedFruObservation {\n  RecordedFruObservation { subject: \"mtjade1\", capture_path: \"forged\", capture_sha256: \"00\", fields: fields }\n}\n\nfn forged_smbios(attribution: SolSessionAttribution) -> RecordedSmbiosObservation {\n  RecordedSmbiosObservation { subject: \"mtjade1\", capture_path: \"forged\", capture_sha256: \"00\", sol_session: attribution, serial: \"B810301000412080005AJ0C1\" }\n}\n\nfn forged_agreement(fru: RecordedFruObservation, smbios: RecordedSmbiosObservation) -> BoardSerialAgreement {\n  BoardSerialAgreement { fru: fru, smbios: smbios, serial: \"B810301000412080005AJ0C1\" }\n}\n"
 
 data harness_control_source: String = "module probe_arrival_converge_harness_control\nimport gunbc.fleet.convergence_fold { ConvergencePlanAdmission, admit_convergence_plan }\nimport gunbc.machine_intake_phase { IntakePhase }\nimport gunbc.machine_intake_arrival_converge { arrival_planning_authority, arrival_receipt_projection, ArrivalStepReceipt }\nimport gunbc.fleet.convergence_fold { ConvergenceReceiptProjection }\nimport gunbc.machine_intake_mtjade1_access_observation { CurrentManagerRead, read_mtjade1_current_manager_read }\nfn admission() -> ConvergencePlanAdmission<IntakePhase> { admit_convergence_plan(planning: arrival_planning_authority(), steps: []) }\nfn projection() -> ConvergenceReceiptProjection<ArrivalStepReceipt> { arrival_receipt_projection() }\nfn read() -> CurrentManagerRead { read_mtjade1_current_manager_read() }\n"
 
@@ -91,3 +91,18 @@ test fn authored_arrival_inputs_are_refused() -> Bool {
     && blocking_count_for_class_and_subject(c: c, wanted: "SoleConstructorViolation", subject: "RecordedSmbiosObservation") >= 1
     && blocking_count_for_class_and_subject(c: c, wanted: "SoleConstructorViolation", subject: "BoardSerialAgreement") >= 1
 }
+
+data outside_mtjade1_bmc_reading_probe_source: String = "module probe_mtjade1_bmc_reading_outside\nimport std.types { String }\nimport test.claim.machine_intake_arrival_converge_witness { mtjade1_intake_subject, mtjade1_dry_applied_bmc, mtjade1_fetched_generation, mtjade1_bmc_goal }\nimport gunbc.machine_intake_arrival_converge { BmcSecureApplyInputs }\nimport gunbc.machine_intake_bmc_secure { ManagedCredentialGenerationFetched }\nfn leak_apply() -> BmcSecureApplyInputs? { mtjade1_dry_applied_bmc(subject: mtjade1_intake_subject()) }\nfn leak_generation() -> ManagedCredentialGenerationFetched? { mtjade1_fetched_generation(current: mtjade1_bmc_goal().managed, secret: \"bmc-lab-o1b-gunbc\", version: \"2\", bytes: \"x\") }\n"
+
+data bmc_account_state_observation_literal_probe_source: String = "module probe_bmc_account_state_observation_literal\nimport std.types { List }\nimport std.scoped_authorization { AttemptIdentity }\nimport gunbc.clock_read { ObserverClockInstant }\nimport gunbc.machine_intake_receipt { EvidenceRef }\nimport gunbc.machine_intake_subject { MachineIntakeSubject }\nimport gunbc.machine_intake_bmc_secure {\n  BmcAccountStateObservation, ManagedCredentialReference, ObservedCredentialProbe, ObservedPublishedLanProbe, ObservedPublishedAccount, ControllerClockReading,\n}\nimport extdeps.bmc.endpoint { BmcControllerEndpoint }\nimport extdeps.bmc.capability { BmcFirmwareReleaseIdentity }\nimport extdeps.bmc.ipmi_channel { IpmiUserId, IpmiControllerChannelCensus }\nfn leak(\n  subject: MachineIntakeSubject,\n  endpoint: BmcControllerEndpoint,\n  firmware: BmcFirmwareReleaseIdentity,\n  managed: ManagedCredentialReference,\n  managed_user: IpmiUserId,\n  attempt: AttemptIdentity,\n  read_floor: ObserverClockInstant,\n  managed_probe: ObservedCredentialProbe,\n  channel_census: IpmiControllerChannelCensus,\n  census_evidence: EvidenceRef,\n  census_observed_at: ObserverClockInstant,\n  published_probes: List<ObservedPublishedLanProbe>,\n  published_user: IpmiUserId,\n  published_account: ObservedPublishedAccount,\n  break_glass: ManagedCredentialReference,\n  break_glass_probe: ObservedCredentialProbe,\n  controller_clock: ControllerClockReading?,\n) -> BmcAccountStateObservation {\n  BmcAccountStateObservation {\n    subject: subject,\n    endpoint: endpoint,\n    firmware: firmware,\n    managed: managed,\n    managed_user: managed_user,\n    attempt: attempt,\n    read_floor: read_floor,\n    managed_probe: managed_probe,\n    channel_census: channel_census,\n    census_evidence: census_evidence,\n    census_observed_at: census_observed_at,\n    published_probes: published_probes,\n    published_user: published_user,\n    published_account: published_account,\n    break_glass: break_glass,\n    break_glass_probe: break_glass_probe,\n    controller_clock: controller_clock,\n  }\n}\n"
+
+test fn the_mtjade1_bmc_reading_helpers_refuse_an_outside_caller() -> Bool {
+  let c = compile_dag_diagnostic_census(outside_mtjade1_bmc_reading_probe_source)
+  blocking_count_for_class_and_subject(c: c, wanted: "ConstructorCallAdmissionRefused", subject: "mtjade1_dry_applied_bmc") >= 1
+    && blocking_count_for_class_and_subject(c: c, wanted: "ConstructorCallAdmissionRefused", subject: "mtjade1_fetched_generation") >= 1
+}
+
+test fn a_bmc_account_state_observation_literal_is_refused_outside_its_mint() -> Bool {
+  let c = compile_dag_diagnostic_census(bmc_account_state_observation_literal_probe_source)
+  blocking_count_for_class_and_subject(c: c, wanted: "SoleConstructorViolation", subject: "BmcAccountStateObservation") >= 1
+}
diff --git a/dag/test/claim/machine_intake/machine_intake_arrival_converge_witness_test.dag b/dag/test/claim/machine_intake/machine_intake_arrival_converge_witness_test.dag
index 2849178fd7f..22e510c0e60 100644
--- a/dag/test/claim/machine_intake/machine_intake_arrival_converge_witness_test.dag
+++ b/dag/test/claim/machine_intake/machine_intake_arrival_converge_witness_test.dag
@@ -1,6 +1,6 @@
 module test.claim.machine_intake_arrival_converge_witness
 
-import std.types { Bool, Int, List, NonEmptyStr, String }
+import std.types { Bool, EpochMs, Int, List, NonEmptyStr, Secret, String }
 import std.decl_ref { DeclarationRef, decl_ref, declaration_ref_eq }
 import std.scoped_authorization { AttemptIdentity }
 import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
@@ -8,11 +8,12 @@ import v2.std.algebra { filter, length }
 import extdeps.crypto.mac { MacKeyId }
 import extdeps.bmc.endpoint { AmiMegaRac, OpenBmc, BmcControllerEndpoint }
 import gunbc.auth.approval_capability { ApprovalCapabilityClaims, ProposeApprove, approval_capability_protocol }
+import product.host_identity { HostIdentity, host_identity_eq }
 import gunbc.auth.approval_broker { Redemption, RedemptionAdmitted }
-import gunbc.machine_intake_phase { Arrival, AccessDiscover, IdentityBindProvisional, PriorLifeBoundary, BmcSecure, IntakePhase }
+import gunbc.machine_intake_phase { Arrival, AccessDiscover, IdentityBindProvisional, PriorLifeBoundary, BmcSecure, BootDeliveryEstablish, IntakePhase, machine_qualification_policy }
 import gunbc.machine_intake_subject {
   AssemblyManifest, BoardSerialObservation, BmcFru, HostSmbios, ChassisComponent, ComponentIdentity, BoardSerialAbsent,
-  FirmwareEntry, FirmwareManifest, UnitKey,
+  FirmwareEntry, FirmwareManifest, UnitKey, MachineIntakeSubject, IntakeAttemptId,
   qualification_subject_of,
 }
 import gunbc.machine_intake_mtjade1_access_observation {
@@ -24,6 +25,7 @@ import gunbc.machine_intake_bmc_rotation_route {
   RedfishAccountPasswordWrite, IpmiSetUserPassword, IpmiSetUserPrivilegeLimit, ObservedSurfaceRead, PublicStandardOperation,
   RotationApplyAdmitted, RotationApplyRouteNotGrounded,
   rotation_apply_authority, rotation_route_request_identity, rotation_route_is_grounded, admit_rotation_apply,
+  rotation_route_ungrounded, rotation_route_from_citation, route_qualification_authority,
 }
 import gunbc.host_convergence_census {
   HostConvergenceCensus, CensusWellFormed, host_convergence_census_rows, host_convergence_census_standing,
@@ -40,14 +42,27 @@ import gunbc.fleet.convergence_fold {
   admit_convergence_plan, classify_convergence_plan, PlanClassifiedAdmissible, PlanClassifiedRefused,
   ConvergenceReceiptProjection, convergence_receipt_projection,
   fold_convergence_run, step_instance_key, step_outcome_receipt, step_outcome_refusal,
+  ungated_readonly_step, AuthorizationUndischarged, instance_authorization,
+  step_instance_key_eq, InstanceAuthorization,
 }
 import gunbc.machine_intake_prior_life_boundary {
   DryPriorLifeWorld, DryArchiveStore, DryArchiveStoreLosesWrites, ArchiveWrittenButNotReadBack, ArchiveWritten, LogsArchivedWithBaselineCursor,
   mt_jade_platform_ref, prior_life_receipt_archive, prior_life_receipt_application, prior_life_receipt_boundary, prior_life_receipt_realization,
   prior_life_receipt_consumed_identity, prior_life_archive_digest, baseline_cursor_archive, baseline_cursor_sel_final_record,
 }
-import std.content_hash { content_hash_equal }
+import std.content_hash { content_hash_equal, content_hash_of_value }
+import gunbc.machine_intake_receipt { EvidenceRef }
 import test.claim.machine_intake_prior_life_boundary_witness { prior_life_minimal_dry_world }
+import gunbc.auth.standing_operator_grant {
+  mtjade1_live_standing_grant, standing_grant_covers, StandingGrantHost, StandingBmcSecureAccountWrite,
+  StandingOperatorGrant,
+}
+import gunbc.auth.authorization_pattern_selection {
+  InterlockPending, InterlockedBy, StandingDestructiveAuthorization,
+  select_authorization_pattern, StandingRulingUnderInterlock, NoWitnessDischarge,
+  PatternSelected, OperatorApprovedCapability, AuthorizationPatternSelection,
+}
+import gunbc.fleet_host_identity { operator_host_mtjade1, operator_host_mtcollins1 }
 import gunbc.machine_intake_arrival_converge {
   ArrivalPrefixVerdict, ArrivalRunFolded, ArrivalPlanRefused, ArrivalPrefixUnstepped,
   ArrivalStepReceipt, AccessDiscoverReceipt, IdentityBindReceipt, PriorLifeBoundaryReceipt, ArrivalStepRefusal,
@@ -57,8 +72,38 @@ import gunbc.machine_intake_arrival_converge {
   access_discover_step_ref, identity_bind_provisional_step_ref, arrival_order_authority, arrival_planning_authority,
   arrival_prefix_through, arrival_prefix_steps, ArrivalPrefixStepped, ArrivalPrefixPhaseUnstepped,
   arrival_prefix_last, arrival_receipt_projection, access_discover, identity_bind_provisional,
-  converge_mtjade1_arrival_prefix, converge_arrival_prefix, mtjade1_identity_bind_inputs,
+  converge_mtjade1_arrival_prefix, converge_mtjade1_arrival_through_bmc_secure, converge_arrival_prefix, converge_arrival_through_bmc_secure, mtjade1_identity_bind_inputs,
+  bmc_secure_step_ref, BmcSecureReceipt,
+  BmcSecureInputs, BmcSecureApplyInputs, BmcSecureAuthorizationUndischarged, BmcSecureApplyInputsMissing,
+  BmcSecureApplicationForAnotherInstance, BmcSecureApplicationNotTheInspectedTransition,
+  grant_discharges_bmc_secure_account_write,
+  capability_discharges_bmc_secure_account_write,
+  discharge_bmc_secure_apply,
+  bound_bmc_secure_host,
+  bmc_secure_bound,
+}
+import gunbc.machine_intake_bmc_secure {
+  BmcSecureGoal, BmcAccountStateObservation, dry_read_bmc_account_state, dry_apply_bmc_account_plan, plan_bmc_account_action,
+  BmcAccountPlanned, BmcAccountPlanRefused, PublishedAccountRetired, ManagedCredentialReference,
+  BmcSecurePhaseNoop, BmcSecurePhaseApplied, ControllerClockReading,
+  observation_with_controller_clock, apply_with_diverged_controller_clock, controller_clock_reading_same,
+  admit_stored_generation, admit_fetched_generation, dry_bmc_account_instant,
+  GenerationStored, GenerationStoreRefused, GenerationFetched, GenerationFetchRefused, ManagedCredentialGenerationFetched,
 }
+import gunbc.auth.secret_ref_credential { SecretCredentialFetch, SecretCredentialReady }
+import extdeps.cloud.gcp.secret_manager { SmResolvedVersionIdentity }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { uri_https }
+import gunbc.deployment_risk { TestRisk }
+import extdeps.bmc.types { AccountRoleAdministrator }
+import extdeps.bmc.capability { BmcFirmwareReleaseIdentity, bmc_firmware_release_identity_of_wire }
+import extdeps.bmc.ipmi_channel {
+  IpmiControllerChannelCensus, IpmiMedium8023Lan, IpmiMediumSerialAsync, IpmiPrivilegeNoAccess, IpmiPrivilegeAdministrator,
+  IpmiUserId, ipmi_controller_channel_census, ipmi_lan_channel_member, ipmi_non_lan_channel_member, ipmi_user_channel_access,
+}
+import extdeps.network.ipv4 { ipv4_address }
+import extdeps.cloud.gcp.secret_ref { HashPending, SecretRef }
+import gunbc.bmc_model { BmcWorld, BmcIpmiUser, BmcPowerOn, bmc_world, bmc_with_ipmi_users, bmc_with_ipmi_user_access }
 
 data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
 
@@ -109,6 +154,7 @@ fn access_established_as_read(s: StepInstanceStanding<ArrivalStepReceipt, Arriva
               && route_is_redfish_write_candidate_on_manager_read(route: a.route)
           IdentityBindReceipt { receipt: _ } => false
           PriorLifeBoundaryReceipt { receipt: _ } => false
+          BmcSecureReceipt { receipt: _ } => false
         }
     InstanceRefused { key: _, cause: _ } => false
     InstanceIncomplete { key: _, cause: _ } => false
@@ -132,6 +178,7 @@ fn identity_bound_from_committed_captures(s: StepInstanceStanding<ArrivalStepRec
               && i.subject.subject == qualification_subject_of(unit_key: "B810301000412080005AJ0C1" as UnitKey, assembly: expected_mtjade1_assembly, firmware: expected_mtjade1_firmware)
           AccessDiscoverReceipt { receipt: _ } => false
           PriorLifeBoundaryReceipt { receipt: _ } => false
+          BmcSecureReceipt { receipt: _ } => false
         }
     InstanceRefused { key: _, cause: _ } => false
     InstanceIncomplete { key: _, cause: _ } => false
@@ -169,6 +216,7 @@ fn prior_life_archived_from_the_bound_subject(s: StepInstanceStanding<ArrivalSte
               && ((prior_life_receipt_realization(r: p) as NonEmptyStr) as String) == "gunbc.machine_intake_prior_life_boundary dry realization over gunbc.bmc_model BmcWorld and a dry archive store"
           AccessDiscoverReceipt { receipt: _ } => false
           IdentityBindReceipt { receipt: _ } => false
+          BmcSecureReceipt { receipt: _ } => false
         }
     InstanceRefused { key: _, cause: _ } => false
     InstanceIncomplete { key: _, cause: _ } => false
@@ -201,6 +249,407 @@ test fn w_mtjade1_converges_the_prefix_through_its_dry_prior_life_archive() -> B
   }
 }
 
+data mtjade1_bmc_read_at: EpochMs = 1791072000000
+data mtjade1_bmc_plan_at: EpochMs = 1791072030000
+data mtjade1_bmc_apply_at: EpochMs = 1791072040000
+data mtjade1_bmc_readback_at: EpochMs = 1791072050000
+data mtjade1_managed_ipmi_user: IpmiUserId = 3
+data mtjade1_published_ipmi_user: IpmiUserId = 2
+data mtjade1_managed_password_v2: String = "managed-generation-2!"
+data mtjade1_route_fixture_citation: ExternalAuthority = ExternalAuthority {
+  uri: uri_https(locator: "fixture-not-an-authority.invalid/test.claim.machine_intake_arrival_converge_witness/mtjade1-route" as NonEmptyStr),
+}
+
+fn mtjade1_intake_subject_for(attempt: IntakeAttemptId) -> MachineIntakeSubject {
+  MachineIntakeSubject {
+    subject: qualification_subject_of(unit_key: "B810301000412080005AJ0C1" as UnitKey, assembly: expected_mtjade1_assembly, firmware: expected_mtjade1_firmware),
+    attempt_id: attempt,
+  }
+}
+
+fn mtjade1_intake_subject() -> MachineIntakeSubject {
+  mtjade1_intake_subject_for(attempt: "o1c1-witness-run-a" as IntakeAttemptId)
+}
+
+fn mtjade1_bmc_endpoint() -> BmcControllerEndpoint {
+  BmcControllerEndpoint { host: "192.168.1.246" }
+}
+
+fn mtjade1_bmc_firmware() -> BmcFirmwareReleaseIdentity {
+  bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: "2.11.104000" as NonEmptyStr)
+}
+
+fn cited_mtjade1_managed_route() -> BmcRotationRouteStanding
+  admit_callers: [
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "mtjade1_dry_applied_bmc"),
+  ]
+{
+  rotation_route_from_citation(
+    endpoint: mtjade1_bmc_endpoint(),
+    firmware: mtjade1_bmc_firmware(),
+    request: IpmiSetUserPassword { user: mtjade1_managed_ipmi_user },
+    citation: mtjade1_route_fixture_citation,
+  )
+}
+
+fn cited_mtjade1_published_route() -> BmcRotationRouteStanding
+  admit_callers: [
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "mtjade1_dry_applied_bmc"),
+  ]
+{
+  rotation_route_from_citation(
+    endpoint: mtjade1_bmc_endpoint(),
+    firmware: mtjade1_bmc_firmware(),
+    request: IpmiSetUserPassword { user: mtjade1_published_ipmi_user },
+    citation: mtjade1_route_fixture_citation,
+  )
+}
+
+fn mtjade1_bmc_goal() -> BmcSecureGoal {
+  BmcSecureGoal {
+    managed: ManagedCredentialReference {
+      account: "gunbc",
+      role: AccountRoleAdministrator,
+      secret: SecretRef { project: "gunbai-secrets", secret: "bmc-lab-o1b-gunbc", version: "1", hash_state: HashPending },
+      credential_epoch: 1,
+    },
+    published_break_glass: ManagedCredentialReference {
+      account: "admin",
+      role: AccountRoleAdministrator,
+      secret: SecretRef { project: "gunbai-secrets", secret: "bmc-lab-o1b-admin", version: "4", hash_state: HashPending },
+      credential_epoch: 4,
+    },
+    policy: machine_qualification_policy(admits: TestRisk),
+  }
+}
+
+fn mtjade1_bmc_goal_with_break_glass_epoch(epoch: Int, version: String) -> BmcSecureGoal {
+  BmcSecureGoal {
+    managed: mtjade1_bmc_goal().managed,
+    published_break_glass: ManagedCredentialReference {
+      account: "admin",
+      role: AccountRoleAdministrator,
+      secret: SecretRef { project: "gunbai-secrets", secret: "bmc-lab-o1b-admin", version: version, hash_state: HashPending },
+      credential_epoch: epoch,
+    },
+    policy: machine_qualification_policy(admits: TestRisk),
+  }
+}
+
+fn mtjade1_grant_without_bmc_secure_effect() -> StandingOperatorGrant {
+  let g = mtjade1_live_standing_grant
+  StandingOperatorGrant {
+    identity: g.identity,
+    principal: g.principal,
+    ruled_at: g.ruled_at,
+    ruling: g.ruling,
+    scope: g.scope,
+    effects: [],
+  }
+}
+
+fn mtjade1_bmc_census(published_lan_privilege_closed: Bool) -> IpmiControllerChannelCensus {
+  let lan_privilege = if published_lan_privilege_closed { IpmiPrivilegeNoAccess } else { IpmiPrivilegeAdministrator }
+  ipmi_controller_channel_census(
+    members: [
+      ipmi_lan_channel_member(channel: 1, medium: IpmiMedium8023Lan, address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 246)),
+      ipmi_non_lan_channel_member(channel: 2, medium: IpmiMediumSerialAsync),
+      ipmi_lan_channel_member(channel: 8, medium: IpmiMedium8023Lan, address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 247)),
+    ],
+    user_access: [
+      ipmi_user_channel_access(channel: 1, user: mtjade1_published_ipmi_user, privilege: lan_privilege),
+      ipmi_user_channel_access(channel: 2, user: mtjade1_published_ipmi_user, privilege: IpmiPrivilegeNoAccess),
+      ipmi_user_channel_access(channel: 8, user: mtjade1_published_ipmi_user, privilege: lan_privilege),
+    ],
+  )
+}
+
+fn mtjade1_account_world(users: List<BmcIpmiUser>, published_lan_privilege_closed: Bool) -> BmcWorld {
+  let census_value = mtjade1_bmc_census(published_lan_privilege_closed: published_lan_privilege_closed)
+  bmc_with_ipmi_user_access(
+    world: bmc_with_ipmi_users(world: bmc_world(power: BmcPowerOn), users: users),
+    rows: census_value.user_access,
+  )
+}
+
+fn mtjade1_version_identity(secret: String, version: String) -> SmResolvedVersionIdentity {
+  join(["projects/gunbai-secrets/secrets/", secret, "/versions/", version], "") as SmResolvedVersionIdentity
+}
+
+fn mtjade1_ready(secret: String, version: String, bytes: String) -> SecretCredentialFetch {
+  SecretCredentialReady { credential: bytes as Secret, resolved_version: mtjade1_version_identity(secret: secret, version: version) }
+}
+
+fn mtjade1_fetched_generation(
+  current: ManagedCredentialReference,
+  secret: String,
+  version: String,
+  bytes: String,
+) -> ManagedCredentialGenerationFetched?
+  admit_callers: [
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "mtjade1_dry_applied_bmc"),
+  ]
+{
+  let store_at = dry_bmc_account_instant(millis: 1791072010000)
+  let fetch_at = dry_bmc_account_instant(millis: 1791072020000)
+  match admit_stored_generation(current: current, added: mtjade1_version_identity(secret: secret, version: version), stored_at: store_at) {
+    GenerationStoreRefused { cause: _ } => none
+    GenerationStored { stored: st } =>
+      match admit_fetched_generation(stored: st, fetch: mtjade1_ready(secret: secret, version: version, bytes: bytes), fetched_at: fetch_at) {
+        GenerationFetchRefused { cause: _ } => none
+        GenerationFetched { fetched: f } => Present { value: f }
+      }
+  }
+}
+
+fn mtjade1_rotation_approval(s: BmcRotationRouteStanding, user: IpmiUserId) -> Redemption {
+  RedemptionAdmitted {
+    claims: ApprovalCapabilityClaims {
+      protocol: approval_capability_protocol,
+      issuer: "gunbc-approval-broker" as NonEmptyStr,
+      audience: "srv1" as NonEmptyStr,
+      authority: rotation_apply_authority,
+      escalation_id: "o1c3b-apply-witness" as NonEmptyStr,
+      request_revision: rotation_route_request_identity(standing: s, request: IpmiSetUserPassword { user: user }),
+      decision: ProposeApprove,
+      attempt: "o1c1-witness-run-a" as AttemptIdentity,
+      issued_at: "2026-10-04T00:00:00Z",
+      expires_at: "2026-10-04T00:15:00Z",
+      key_id: "broker-2026-10" as MacKeyId,
+    },
+    decided_by: "operator" as NonEmptyStr,
+  }
+}
+
+fn mtjade1_dry_applied_bmc(subject: MachineIntakeSubject) -> BmcSecureApplyInputs?
+  admit_callers: [
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_with_the_mtjade1_standing_grant_converges_over_the_dry_world"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "bmc_secure_bound_refuses_foreign_apply"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_without_authorization_refuses_after_a_real_apply"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_uncovered_grant_falls_through_to_capability"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_uncovered_grant_refuses_a_capability_for_another_request"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_for_a_later_break_glass_generation_is_refused"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_another_channel_state_is_refused"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_a_different_present_controller_clock_is_refused"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_a_present_controller_clock_over_absent_is_refused"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_a_foreign_bound_host_key_cannot_mint_from_this_instance_controller"),
+  ]
+{
+  let census_value = mtjade1_bmc_census(published_lan_privilege_closed: true)
+  let world = mtjade1_account_world(
+    users: [BmcIpmiUser { id: 3, password: "managed-generation-1!" }, BmcIpmiUser { id: 2, password: "admin" }],
+    published_lan_privilege_closed: true,
+  )
+  let reading = dry_read_bmc_account_state(
+    world: world,
+    subject: subject,
+    endpoint: mtjade1_bmc_endpoint(),
+    firmware: mtjade1_bmc_firmware(),
+    managed: mtjade1_bmc_goal().managed,
+    managed_user: mtjade1_managed_ipmi_user,
+    managed_password: "managed-generation-1!",
+    census: census_value,
+    published_user: mtjade1_published_ipmi_user,
+    published_password: "admin",
+    published_account: PublishedAccountRetired,
+    break_glass: mtjade1_bmc_goal().published_break_glass,
+    break_glass_password: "break-glass-generation-4!",
+    attempt: (subject.attempt_id as NonEmptyStr) as AttemptIdentity,
+    read_at_millis: mtjade1_bmc_read_at,
+  )
+  match mtjade1_fetched_generation(current: mtjade1_bmc_goal().managed, secret: "bmc-lab-o1b-gunbc", version: "2", bytes: mtjade1_managed_password_v2) {
+    Absent => none
+    Present { value: mg } =>
+      match mtjade1_fetched_generation(
+        current: ManagedCredentialReference {
+          account: "admin",
+          role: AccountRoleAdministrator,
+          secret: SecretRef { project: "gunbai-secrets", secret: "bmc-lab-o1b-admin", version: "3", hash_state: HashPending },
+          credential_epoch: 3,
+        },
+        secret: "bmc-lab-o1b-admin",
+        version: "4",
+        bytes: "break-glass-generation-4!",
+      ) {
+        Absent => none
+        Present { value: bg } => {
+          let managed_route = cited_mtjade1_managed_route()
+          let published_route = cited_mtjade1_published_route()
+          match plan_bmc_account_action(
+            subject: subject,
+            goal: mtjade1_bmc_goal(),
+            reading: reading,
+            managed_user: mtjade1_managed_ipmi_user,
+            managed_route: managed_route,
+            managed_approval: mtjade1_rotation_approval(s: managed_route, user: mtjade1_managed_ipmi_user),
+            managed_generation: mg,
+            published_route: published_route,
+            published_approval: mtjade1_rotation_approval(s: published_route, user: mtjade1_published_ipmi_user),
+            published_generation: bg,
+            channel_close: none,
+            planned_at: dry_bmc_account_instant(millis: mtjade1_bmc_plan_at),
+          ) {
+            BmcAccountPlanRefused { cause: _ } => none
+            BmcAccountPlanned { plan: p } => {
+              let step = dry_apply_bmc_account_plan(
+                world: world,
+                plan: p,
+                managed_fetch: mtjade1_ready(secret: "bmc-lab-o1b-gunbc", version: "2", bytes: mtjade1_managed_password_v2),
+                published_fetch: mtjade1_ready(secret: "bmc-lab-o1b-admin", version: "4", bytes: "break-glass-generation-4!"),
+                applied_at_millis: mtjade1_bmc_apply_at,
+              )
+              let post_read = dry_read_bmc_account_state(
+                world: step.world,
+                subject: subject,
+                endpoint: mtjade1_bmc_endpoint(),
+                firmware: mtjade1_bmc_firmware(),
+                managed: p.goal.managed,
+                managed_user: mtjade1_managed_ipmi_user,
+                managed_password: mtjade1_managed_password_v2,
+                census: census_value,
+                published_user: mtjade1_published_ipmi_user,
+                published_password: "admin",
+                published_account: PublishedAccountRetired,
+                break_glass: p.goal.published_break_glass,
+                break_glass_password: "break-glass-generation-4!",
+                attempt: (subject.attempt_id as NonEmptyStr) as AttemptIdentity,
+                read_at_millis: mtjade1_bmc_readback_at,
+              )
+              Present { value: BmcSecureApplyInputs { application: step.application, post_read: post_read } }
+            }
+          }
+        }
+      }
+  }
+}
+
+fn mtjade1_bmc_inputs(reading: BmcAccountStateObservation, grant: StandingOperatorGrant?, apply: BmcSecureApplyInputs?, capability: Redemption?) -> BmcSecureInputs {
+  BmcSecureInputs {
+    goal: mtjade1_bmc_goal(),
+    reading: reading,
+    grant: grant,
+    capability: capability,
+    apply: apply,
+  }
+}
+
+fn bmc_secure_applied_established(s: StepInstanceStanding<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>) -> Bool {
+  match s {
+    InstanceConverged { key: k, receipt: r } =>
+      declaration_ref_eq(a: k.step_identity, b: bmc_secure_step_ref)
+        && match r {
+          BmcSecureReceipt { receipt: b } =>
+            match b.phase.decision {
+              BmcSecurePhaseApplied { plan: _, application: _, post_read: _ } => true
+              BmcSecurePhaseNoop { observation: _ } => false
+            }
+          AccessDiscoverReceipt { receipt: _ } => false
+          IdentityBindReceipt { receipt: _ } => false
+          PriorLifeBoundaryReceipt { receipt: _ } => false
+        }
+    _ => false
+  }
+}
+
+fn bmc_secure_noop_established(s: StepInstanceStanding<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>) -> Bool {
+  match s {
+    InstanceConverged { key: k, receipt: r } =>
+      declaration_ref_eq(a: k.step_identity, b: bmc_secure_step_ref)
+        && match r {
+          BmcSecureReceipt { receipt: b } =>
+            match b.phase.decision {
+              BmcSecurePhaseNoop { observation: _ } => true
+              BmcSecurePhaseApplied { plan: _, application: _, post_read: _ } => false
+            }
+          AccessDiscoverReceipt { receipt: _ } => false
+          IdentityBindReceipt { receipt: _ } => false
+          PriorLifeBoundaryReceipt { receipt: _ } => false
+        }
+    _ => false
+  }
+}
+
+test fn w_mtjade1_converges_through_bmc_secure_noop_on_the_real_prefix() -> Bool {
+  let census_value = mtjade1_bmc_census(published_lan_privilege_closed: true)
+  let reading = dry_read_bmc_account_state(
+    world: mtjade1_account_world(
+      users: [BmcIpmiUser { id: 3, password: "managed-generation-1!" }, BmcIpmiUser { id: 2, password: "break-glass-generation-4!" }],
+      published_lan_privilege_closed: true,
+    ),
+    subject: mtjade1_intake_subject(),
+    endpoint: mtjade1_bmc_endpoint(),
+    firmware: mtjade1_bmc_firmware(),
+    managed: mtjade1_bmc_goal().managed,
+    managed_user: mtjade1_managed_ipmi_user,
+    managed_password: "managed-generation-1!",
+    census: census_value,
+    published_user: mtjade1_published_ipmi_user,
+    published_password: "admin",
+    published_account: PublishedAccountRetired,
+    break_glass: mtjade1_bmc_goal().published_break_glass,
+    break_glass_password: "break-glass-generation-4!",
+    attempt: "o1c1-witness-run-a" as AttemptIdentity,
+    read_at_millis: mtjade1_bmc_read_at,
+  )
+  match converge_mtjade1_arrival_through_bmc_secure(run: run_a, prior_life: prior_life_minimal_dry_world(), bmc: mtjade1_bmc_inputs(reading: reading, grant: none, apply: none, capability: none)) {
+    ArrivalRunFolded { verdict: v } =>
+      match v {
+        RunConverged { run: r } =>
+          length(xs: r.ledger.instances) == 4
+            && match r.ledger.instances.first() { Present { value: s } => access_established_as_read(s: s)  Absent => false }
+            && match r.ledger.instances |> filter(s => instance_step_is(s: s, step: identity_bind_provisional_step_ref)) |> first() { Present { value: s } => identity_bound_from_committed_captures(s: s)  Absent => false }
+            && match r.ledger.instances |> filter(s => instance_step_is(s: s, step: prior_life_boundary_step_ref)) |> first() { Present { value: s } => prior_life_archived_from_the_bound_subject(s: s)  Absent => false }
+            && match r.ledger.instances.last() { Present { value: s } => bmc_secure_noop_established(s: s)  Absent => false }
+        _ => false
+      }
+    _ => false
+  }
+}
+
+test fn w_mtjade1_bmc_secure_apply_inputs_missing_refuses_on_the_real_path() -> Bool {
+  let census_value = mtjade1_bmc_census(published_lan_privilege_closed: true)
+  let reading = dry_read_bmc_account_state(
+    world: mtjade1_account_world(
+      users: [BmcIpmiUser { id: 3, password: "managed-generation-1!" }, BmcIpmiUser { id: 2, password: "admin" }],
+      published_lan_privilege_closed: true,
+    ),
+    subject: mtjade1_intake_subject(),
+    endpoint: mtjade1_bmc_endpoint(),
+    firmware: mtjade1_bmc_firmware(),
+    managed: mtjade1_bmc_goal().managed,
+    managed_user: mtjade1_managed_ipmi_user,
+    managed_password: "managed-generation-1!",
+    census: census_value,
+    published_user: mtjade1_published_ipmi_user,
+    published_password: "admin",
+    published_account: PublishedAccountRetired,
+    break_glass: mtjade1_bmc_goal().published_break_glass,
+    break_glass_password: "break-glass-generation-4!",
+    attempt: "o1c1-witness-run-a" as AttemptIdentity,
+    read_at_millis: mtjade1_bmc_read_at,
+  )
+  match converge_mtjade1_arrival_through_bmc_secure(run: run_a, prior_life: prior_life_minimal_dry_world(), bmc: mtjade1_bmc_inputs(reading: reading, grant: none, apply: none, capability: none)) {
+    ArrivalRunFolded { verdict: v } =>
+      match v {
+        RunStopped { ledger: l, at: at } =>
+          declaration_ref_eq(a: at.step_identity, b: bmc_secure_step_ref)
+            && match l.instances.last() {
+              Present { value: s } => match s {
+                InstanceRefused { key: _, cause: c } => match c {
+                  DomainRefused { cause: d } => match d { BmcSecureApplyInputsMissing => true  _ => false }
+                  AuthorizationUndischarged => false
+                  _ => false
+                }
+                _ => false
+              }
+              Absent => false
+            }
+        _ => false
+      }
+    _ => false
+  }
+}
+
 // AN ARCHIVE WRITE THE STORE LOSES LEAVES THE RUN INCOMPLETE, NOT STOPPED AND NOT CONVERGED, at the
 // PriorLifeBoundary instance, which records the write as written-but-not-read-back. Same real route,
 // the store the only difference.
@@ -315,8 +764,8 @@ test fn w_the_roster_is_the_three_phase_prefix_of_the_authority() -> Bool {
 // A phase of the prefix with no step refuses rather than being skipped: through BmcSecure the prefix
 // reaches BmcSecure itself, which has no step in this cut (O1c-3 brings it with its gate).
 test fn w_a_prefix_phase_with_no_step_refuses() -> Bool {
-  match arrival_prefix_steps(phases: arrival_prefix_through(last: BmcSecure)) {
-    ArrivalPrefixPhaseUnstepped { phase: p } => p == Arrival { phase: BmcSecure }
+  match arrival_prefix_steps(phases: arrival_prefix_through(last: BootDeliveryEstablish)) {
+    ArrivalPrefixPhaseUnstepped { phase: p } => p == Arrival { phase: BootDeliveryEstablish }
     ArrivalPrefixStepped { steps: _ } => false
   }
 }
@@ -331,11 +780,11 @@ fn real_steps() -> List<ConvergenceStep<IntakePhase>> {
 }
 
 fn access_step_bound_to(phase: IntakePhase) -> ConvergenceStep<IntakePhase> {
-  ConvergenceStep { identity: access_discover_step_ref, order_member: phase, preconditions: [] }
+  ungated_readonly_step(identity: access_discover_step_ref, order_member: phase, preconditions: [])
 }
 
 fn identity_step_with(preconditions: List<StepPrecondition>) -> ConvergenceStep<IntakePhase> {
-  ConvergenceStep { identity: identity_bind_provisional_step_ref, order_member: Arrival { phase: IdentityBindProvisional }, preconditions: preconditions }
+  ungated_readonly_step(identity: identity_bind_provisional_step_ref, order_member: Arrival { phase: IdentityBindProvisional }, preconditions: preconditions)
 }
 
 fn plan_refusal(admission: ConvergencePlanAdmission<IntakePhase>) -> ConvergencePlanRefusal<IntakePhase>? {
@@ -381,7 +830,7 @@ test fn w_an_unknown_precondition_refuses() -> Bool {
 // converge_arrival_prefix is a real declaration with no census row: as a step it refuses.
 test fn w_a_step_with_no_census_row_refuses() -> Bool {
   let uncensused = decl_ref(module_path: "gunbc.machine_intake_arrival_converge", decl_name: "converge_arrival_prefix")
-  match plan_refusal(admission: admit_convergence_plan(planning: arrival_planning_authority(), steps: [ConvergenceStep { identity: uncensused, order_member: Arrival { phase: AccessDiscover }, preconditions: [] }])) {
+  match plan_refusal(admission: admit_convergence_plan(planning: arrival_planning_authority(), steps: [ungated_readonly_step(identity: uncensused, order_member: Arrival { phase: AccessDiscover }, preconditions: [])])) {
     Present { value: c } => match c { StepMissingFromCensus { step: s } => declaration_ref_eq(a: s, b: uncensused)  _ => false }
     Absent => false
   }
@@ -409,14 +858,14 @@ fn real_access(run: ConvergenceRunId, subject: StepSubjectKey, read: CurrentMana
 
 fn established_access(o: StepOutcome<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>) -> AccessDiscoverEstablished? {
   match step_outcome_receipt(outcome: o) {
-    Present { value: r } => match r { AccessDiscoverReceipt { receipt: a } => Present { value: a }  IdentityBindReceipt { receipt: _ } => none  PriorLifeBoundaryReceipt { receipt: _ } => none }
+    Present { value: r } => match r { AccessDiscoverReceipt { receipt: a } => Present { value: a }  IdentityBindReceipt { receipt: _ } => none  PriorLifeBoundaryReceipt { receipt: _ } => none  BmcSecureReceipt { receipt: _ } => none }
     Absent => none
   }
 }
 
 fn fold_real(run: ConvergenceRunId, subject: StepSubjectKey, outcomes: List<StepOutcome<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>>) -> ConvergenceRunVerdict<ArrivalStepReceipt, ArrivalStepRefusal, ArrivalStepIncomplete>? {
   match admit_convergence_plan(planning: arrival_planning_authority(), steps: real_steps()) {
-    ConvergencePlanAdmitted { plan: p } => Present { value: fold_convergence_run(plan: p, run: run, subject: subject, outcomes: outcomes, projection: arrival_receipt_projection()) }
+    ConvergencePlanAdmitted { plan: p } => Present { value: fold_convergence_run(plan: p, run: run, subject: subject, outcomes: outcomes, projection: arrival_receipt_projection(), discharges: []) }
     ConvergencePlanRefused { cause: _ } => none
   }
 }
@@ -471,6 +920,583 @@ fn probe_consumed(r: ProbeReceipt) -> List<StepInstanceKey> {
   r.consumed
 }
 
+fn probe_auth_never(r: ProbeReceipt) -> Bool {
+  false
+}
+
+fn probe_auth_on_bmc_secure(r: ProbeReceipt) -> Bool {
+  declaration_ref_eq(a: r.key.step_identity, b: bmc_secure_step_ref)
+}
+
+fn four_steps() -> List<ConvergenceStep<IntakePhase>> {
+  match arrival_prefix_steps(phases: arrival_prefix_through(last: BmcSecure)) {
+    ArrivalPrefixStepped { steps: ss } => ss
+    ArrivalPrefixPhaseUnstepped { phase: _ } => []
+  }
+}
+
+test fn w_the_four_step_plan_through_bmc_secure_is_admitted() -> Bool {
+  match admit_convergence_plan(planning: arrival_planning_authority(), steps: four_steps()) {
+    ConvergencePlanAdmitted { plan: _ } => length(xs: four_steps()) == 4
+    ConvergencePlanRefused { cause: _ } => false
+  }
+}
+
+test fn w_bmc_secure_noop_needs_no_discharge() -> Bool {
+  let access = step_instance_key(run: run_a, step: access_discover_step_ref, subject: mtjade1_key)
+  let identity = step_instance_key(run: run_a, step: identity_bind_provisional_step_ref, subject: mtjade1_key)
+  let prior = step_instance_key(run: run_a, step: prior_life_boundary_step_ref, subject: mtjade1_key)
+  let bmc = step_instance_key(run: run_a, step: bmc_secure_step_ref, subject: mtjade1_key)
+  let outcomes: List<StepOutcome<ProbeReceipt, String, String>> = [
+    StepEstablished { receipt: ProbeReceipt { key: access, consumed: [] } },
+    StepEstablished { receipt: ProbeReceipt { key: identity, consumed: [access] } },
+    StepEstablished { receipt: ProbeReceipt { key: prior, consumed: [identity] } },
+    StepEstablished { receipt: ProbeReceipt { key: bmc, consumed: [prior] } },
+  ]
+  match admit_convergence_plan(planning: arrival_planning_authority(), steps: four_steps()) {
+    ConvergencePlanAdmitted { plan: p } =>
+      match fold_convergence_run(plan: p, run: run_a, subject: mtjade1_key, outcomes: outcomes, projection: convergence_receipt_projection(key_of: probe_key, consumed_of: probe_consumed, authorization_required_of: probe_auth_never), discharges: []) {
+        RunConverged { run: r } => length(xs: r.ledger.instances) == 4
+        _ => false
+      }
+    ConvergencePlanRefused { cause: _ } => false
+  }
+}
+
+test fn w_bmc_secure_apply_without_discharge_refuses() -> Bool {
+  let access = step_instance_key(run: run_a, step: access_discover_step_ref, subject: mtjade1_key)
+  let identity = step_instance_key(run: run_a, step: identity_bind_provisional_step_ref, subject: mtjade1_key)
+  let prior = step_instance_key(run: run_a, step: prior_life_boundary_step_ref, subject: mtjade1_key)
+  let bmc = step_instance_key(run: run_a, step: bmc_secure_step_ref, subject: mtjade1_key)
+  let outcomes: List<StepOutcome<ProbeReceipt, String, String>> = [
+    StepEstablished { receipt: ProbeReceipt { key: access, consumed: [] } },
+    StepEstablished { receipt: ProbeReceipt { key: identity, consumed: [access] } },
+    StepEstablished { receipt: ProbeReceipt { key: prior, consumed: [identity] } },
+    StepEstablished { receipt: ProbeReceipt { key: bmc, consumed: [prior] } },
+  ]
+  match admit_convergence_plan(planning: arrival_planning_authority(), steps: four_steps()) {
+    ConvergencePlanAdmitted { plan: p } =>
+      match fold_convergence_run(plan: p, run: run_a, subject: mtjade1_key, outcomes: outcomes, projection: convergence_receipt_projection(key_of: probe_key, consumed_of: probe_consumed, authorization_required_of: probe_auth_on_bmc_secure), discharges: []) {
+        RunStopped { ledger: l, at: at } =>
+          step_instance_key_eq(a: at, b: bmc)
+            && match l.instances.last() {
+              Present { value: s } => match s {
+                InstanceRefused { key: _, cause: c } => match c { AuthorizationUndischarged => true  _ => false }
+                _ => false
+              }
+              Absent => false
+            }
+        _ => false
+      }
+    ConvergencePlanRefused { cause: _ } => false
+  }
+}
+
+fn mtjade1_grant_with_interlock_pending() -> StandingOperatorGrant {
+  let g = mtjade1_live_standing_grant
+  StandingOperatorGrant {
+    identity: g.identity,
+    principal: g.principal,
+    ruled_at: g.ruled_at,
+    ruling: StandingDestructiveAuthorization {
+      ruling_text: g.ruling.ruling_text,
+      effect_subject: g.ruling.effect_subject,
+      interlock: InterlockPending { obligation: "hold not named" as NonEmptyStr },
+    },
+    scope: g.scope,
+    effects: g.effects,
+  }
+}
+
+fn mtjade1_grant_with_foreign_interlock() -> StandingOperatorGrant {
+  let g = mtjade1_live_standing_grant
+  StandingOperatorGrant {
+    identity: g.identity,
+    principal: g.principal,
+    ruled_at: g.ruled_at,
+    ruling: StandingDestructiveAuthorization {
+      ruling_text: g.ruling.ruling_text,
+      effect_subject: g.ruling.effect_subject,
+      interlock: InterlockedBy { hold: decl_ref(module_path: "gunbc.spark.pair_serving_d0", decl_name: "d0_claim_grant") },
+    },
+    scope: g.scope,
+    effects: g.effects,
+  }
+}
+
+fn apply_fold_undischarged(discharges: List<InstanceAuthorization>) -> Bool {
+  let access = step_instance_key(run: run_a, step: access_discover_step_ref, subject: mtjade1_key)
+  let identity = step_instance_key(run: run_a, step: identity_bind_provisional_step_ref, subject: mtjade1_key)
+  let prior = step_instance_key(run: run_a, step: prior_life_boundary_step_ref, subject: mtjade1_key)
+  let bmc = step_instance_key(run: run_a, step: bmc_secure_step_ref, subject: mtjade1_key)
+  let outcomes: List<StepOutcome<ProbeReceipt, String, String>> = [
+    StepEstablished { receipt: ProbeReceipt { key: access, consumed: [] } },
+    StepEstablished { receipt: ProbeReceipt { key: identity, consumed: [access] } },
+    StepEstablished { receipt: ProbeReceipt { key: prior, consumed: [identity] } },
+    StepEstablished { receipt: ProbeReceipt { key: bmc, consumed: [prior] } },
+  ]
+  match admit_convergence_plan(planning: arrival_planning_authority(), steps: four_steps()) {
+    ConvergencePlanAdmitted { plan: p } =>
+      match fold_convergence_run(plan: p, run: run_a, subject: mtjade1_key, outcomes: outcomes, projection: convergence_receipt_projection(key_of: probe_key, consumed_of: probe_consumed, authorization_required_of: probe_auth_on_bmc_secure), discharges: discharges) {
+        RunStopped { ledger: l, at: at } =>
+          step_instance_key_eq(a: at, b: bmc)
+            && match l.instances.last() {
+              Present { value: s } => match s {
+                InstanceRefused { key: _, cause: c } => match c { AuthorizationUndischarged => true  _ => false }
+                _ => false
+              }
+              Absent => false
+            }
+        _ => false
+      }
+    ConvergencePlanRefused { cause: _ } => false
+  }
+}
+
+test fn w_bmc_secure_apply_pending_interlock_refuses_at_discharge() -> Bool {
+  grant_discharges_bmc_secure_account_write(g: mtjade1_grant_with_interlock_pending(), host: operator_host_mtjade1) == false
+    && grant_discharges_bmc_secure_account_write(g: mtjade1_grant_with_foreign_interlock(), host: operator_host_mtjade1) == false
+    && grant_discharges_bmc_secure_account_write(g: mtjade1_live_standing_grant, host: operator_host_mtjade1)
+}
+
+test fn w_mtcollins1_is_not_discharged_by_the_mtjade1_grant() -> Bool {
+  grant_discharges_bmc_secure_account_write(g: mtjade1_live_standing_grant, host: operator_host_mtcollins1) == false
+}
+
+fn mtjade1_capability_standing() -> BmcRotationRouteStanding {
+  rotation_route_ungrounded(endpoint: mtjade1_bmc_endpoint(), firmware: mtjade1_bmc_firmware())
+}
+
+fn mtjade1_stale_capability_standing() -> BmcRotationRouteStanding {
+  rotation_route_ungrounded(
+    endpoint: mtjade1_bmc_endpoint(),
+    firmware: bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: "0.32" as NonEmptyStr),
+  )
+}
+
+fn mtjade1_managed_write_request() -> BmcAccountWriteRequest {
+  IpmiSetUserPassword { user: mtjade1_managed_ipmi_user }
+}
+
+fn mtjade1_published_write_request() -> BmcAccountWriteRequest {
+  IpmiSetUserPassword { user: mtjade1_published_ipmi_user }
+}
+
+fn rotation_capability_for(
+  standing: BmcRotationRouteStanding,
+  request: BmcAccountWriteRequest,
+  attempt_text: String,
+  authority: NonEmptyStr,
+) -> Redemption {
+  RedemptionAdmitted {
+    claims: ApprovalCapabilityClaims {
+      protocol: approval_capability_protocol,
+      issuer: "gunbc-approval-broker" as NonEmptyStr,
+      audience: "srv1" as NonEmptyStr,
+      authority: authority,
+      escalation_id: "o1c3b-witness" as NonEmptyStr,
+      request_revision: rotation_route_request_identity(standing: standing, request: request),
+      decision: ProposeApprove,
+      attempt: attempt_text as AttemptIdentity,
+      issued_at: "2026-10-04T00:00:00Z",
+      expires_at: "2026-10-04T00:15:00Z",
+      key_id: "broker-2026-10" as MacKeyId,
+    },
+    decided_by: "operator" as NonEmptyStr,
+  }
+}
+
+fn bmc_secure_apply_key() -> StepInstanceKey {
+  step_instance_key(run: run_a, step: bmc_secure_step_ref, subject: mtjade1_key)
+}
+
+test fn w_bmc_secure_apply_capability_for_another_authority_does_not_discharge() -> Bool {
+  capability_discharges_bmc_secure_account_write(
+    r: rotation_capability_for(standing: mtjade1_capability_standing(), request: mtjade1_managed_write_request(), attempt_text: run_a as String, authority: route_qualification_authority),
+    standing: mtjade1_capability_standing(),
+    request: mtjade1_managed_write_request(),
+    key: bmc_secure_apply_key(),
+  ) == false
+}
+
+test fn w_bmc_secure_apply_capability_for_another_request_does_not_discharge() -> Bool {
+  capability_discharges_bmc_secure_account_write(
+    r: rotation_capability_for(standing: mtjade1_capability_standing(), request: mtjade1_managed_write_request(), attempt_text: run_a as String, authority: rotation_apply_authority),
+    standing: mtjade1_capability_standing(),
+    request: mtjade1_published_write_request(),
+    key: bmc_secure_apply_key(),
+  ) == false
+}
+
+test fn w_bmc_secure_apply_capability_for_another_build_does_not_discharge() -> Bool {
+  capability_discharges_bmc_secure_account_write(
+    r: rotation_capability_for(standing: mtjade1_capability_standing(), request: mtjade1_managed_write_request(), attempt_text: run_a as String, authority: rotation_apply_authority),
+    standing: mtjade1_stale_capability_standing(),
+    request: mtjade1_managed_write_request(),
+    key: bmc_secure_apply_key(),
+  ) == false
+}
+
+test fn w_bmc_secure_apply_capability_for_another_run_does_not_discharge() -> Bool {
+  capability_discharges_bmc_secure_account_write(
+    r: rotation_capability_for(standing: mtjade1_capability_standing(), request: mtjade1_managed_write_request(), attempt_text: run_b as String, authority: rotation_apply_authority),
+    standing: mtjade1_capability_standing(),
+    request: mtjade1_managed_write_request(),
+    key: bmc_secure_apply_key(),
+  ) == false
+}
+
+test fn w_bmc_secure_apply_admitted_capability_for_the_canonical_rotation_identity_discharges() -> Bool {
+  let standing = mtjade1_capability_standing()
+  let request = mtjade1_managed_write_request()
+  (rotation_route_request_identity(standing: standing, request: request) as String) != ""
+    && capability_discharges_bmc_secure_account_write(
+      r: rotation_capability_for(standing: standing, request: request, attempt_text: run_a as String, authority: rotation_apply_authority),
+      standing: standing,
+      request: request,
+      key: bmc_secure_apply_key(),
+    )
+}
+
+test fn w_bmc_secure_apply_discharge_for_another_run_refuses() -> Bool {
+  let foreign = step_instance_key(run: run_b, step: bmc_secure_step_ref, subject: mtjade1_key)
+  apply_fold_undischarged(discharges: [instance_authorization(key: foreign, principal: mtjade1_live_standing_grant.principal)])
+}
+
+test fn w_bmc_secure_apply_discharge_for_another_unit_refuses() -> Bool {
+  let foreign = step_instance_key(run: run_a, step: bmc_secure_step_ref, subject: "mtcollins1" as StepSubjectKey)
+  apply_fold_undischarged(discharges: [instance_authorization(key: foreign, principal: mtjade1_live_standing_grant.principal)])
+}
+
+// PAIRING: the census first_consumer mints the Apply discharge list. Hard-coding discharges: []
+// there must redden this claim. Prefix captures are the production readers; this claim supplies
+// Apply+grant and runs converge_arrival_through_bmc_secure, not a probe fold beside it.
+test fn w_bmc_secure_apply_with_the_mtjade1_standing_grant_converges_over_the_dry_world() -> Bool {
+  match mtjade1_dry_applied_bmc(subject: mtjade1_intake_subject()) {
+    Absent => false
+    Present { value: apply } =>
+      match converge_arrival_through_bmc_secure(
+        run: run_a,
+        subject: mtjade1_key,
+        read: read_mtjade1_current_manager_read(),
+        inputs: mtjade1_identity_bind_inputs(),
+        prior_life: PriorLifeInputs { platform: mt_jade_platform_ref, world: prior_life_minimal_dry_world() },
+        bmc: mtjade1_bmc_inputs(
+          reading: apply.application.plan.diverged,
+          grant: Present { value: mtjade1_live_standing_grant },
+          apply: Present { value: apply },
+          capability: none,
+        ),
+      ) {
+        ArrivalRunFolded { verdict: v } =>
+          match v {
+            RunConverged { run: r } =>
+              length(xs: r.ledger.instances) == 4
+                && match r.ledger.instances.first() { Present { value: s } => access_established_as_read(s: s)  Absent => false }
+                && match r.ledger.instances |> filter(s => instance_step_is(s: s, step: identity_bind_provisional_step_ref)) |> first() { Present { value: s } => identity_bound_from_committed_captures(s: s)  Absent => false }
+                && match r.ledger.instances |> filter(s => instance_step_is(s: s, step: prior_life_boundary_step_ref)) |> first() { Present { value: s } => prior_life_archived_from_the_bound_subject(s: s)  Absent => false }
+                && match r.ledger.instances.last() { Present { value: s } => bmc_secure_applied_established(s: s)  Absent => false }
+            _ => false
+          }
+        _ => false
+      }
+  }
+}
+
+fn bmc_secure_bound_refuses_foreign_apply(foreign_subject: MachineIntakeSubject) -> Bool
+  admit_callers: [
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_another_attempt_is_refused"),
+    decl_ref(module_path: "test.claim.machine_intake_arrival_converge_witness", decl_name: "w_bmc_secure_apply_of_another_unit_is_refused"),
+  ]
+{
+  let identity = step_instance_key(run: run_a, step: identity_bind_provisional_step_ref, subject: mtjade1_key)
+  let prior = step_instance_key(run: run_a, step: prior_life_boundary_step_ref, subject: mtjade1_key)
+  let bmc_key = bmc_secure_apply_key()
+  match mtjade1_dry_applied_bmc(subject: mtjade1_intake_subject()) {
+    Absent => false
+    Present { value: own } =>
+      match mtjade1_dry_applied_bmc(subject: foreign_subject) {
+        Absent => false
+        Present { value: foreign } => {
+          let inputs = mtjade1_bmc_inputs(
+            reading: own.application.plan.diverged,
+            grant: Present { value: mtjade1_live_standing_grant },
+            apply: Present { value: foreign },
+            capability: none,
+          )
+          match bmc_secure_bound(key: bmc_key, identity_key: identity, identity_subject: mtjade1_intake_subject(), prior_key: prior, inputs: inputs) {
+            StepRefused { key: _, cause: c } => match c { BmcSecureApplicationForAnotherInstance { subject: _ } => true  _ => false }
+            _ => false
+          }
+        }
+      }
+  }
+}
+
+test fn w_bmc_secure_apply_of_another_attempt_is_refused() -> Bool {
+  bmc_secure_bound_refuses_foreign_apply(foreign_subject: mtjade1_intake_subject_for(attempt: "o1c1-witness-run-b" as IntakeAttemptId))
+}
+
+test fn w_bmc_secure_apply_of_another_unit_is_refused() -> Bool {
+  bmc_secure_bound_refuses_foreign_apply(foreign_subject: MachineIntakeSubject {
+    subject: qualification_subject_of(unit_key: "B810301000412080005AJ0C2" as UnitKey, assembly: expected_mtjade1_assembly, firmware: expected_mtjade1_firmware),
+    attempt_id: "o1c1-witness-run-a" as IntakeAttemptId,
+  })
+}
+
+test fn w_bmc_secure_apply_for_a_later_break_glass_generation_is_refused() -> Bool {
+  let identity = step_instance_key(run: run_a, step: identity_bind_provisional_step_ref, subject: mtjade1_key)
+  let prior = step_instance_key(run: run_a, step: prior_life_boundary_step_ref, subject: mtjade1_key)
+  let bmc_key = bmc_secure_apply_key()
+  let requested = mtjade1_bmc_goal_with_break_glass_epoch(epoch: 5, version: "5")
+  match mtjade1_dry_applied_bmc(subject: mtjade1_intake_subject()) {
+    Absent => false
+    Present { value: apply } =>
+      match bmc_secure_bound(
+        key: bmc_key,
+        identity_key: identity,
+        identity_subject: mtjade1_intake_subject(),
+        prior_key: prior,
+        inputs: BmcSecureInputs {
+          goal: requested,
+          reading: apply.application.plan.diverged,
+          grant: Present { value: mtjade1_live_standing_grant },
+          apply: Present { value: apply },
+          capability: none,
+        },
+      ) {
+        StepRefused { key: _, cause: c } => match c { BmcSecureApplicationNotTheInspectedTransition => true  _ => false }
+        _ => false
+      }
+  }
+}
+
+data mtjade1_controller_clock_x_millis: EpochMs = 1
+data mtjade1_controller_clock_y_millis: EpochMs = 2
+
+fn mtjade1_controller_clock(millis: EpochMs, label: String) -> ControllerClockReading {
+  ControllerClockReading {
+    reported_millis: millis,
+    evidence: EvidenceRef { label: label as NonEmptyStr, digest: content_hash_of_value(value: label) },
+  }
+}
+
+test fn w_matching_present_controller_clocks_compare_equal() -> Bool {
+  let clock = mtjade1_controller_clock(millis: mtjade1_controller_clock_x_millis, label: "controller-clock-x")
+  controller_clock_reading_same(left: Present { value: clock }, right: Present { value: clock })
+}
+
+test fn w_bmc_secure_apply_of_a_different_present_controller_clock_is_refused() -> Bool {
+  let identity = step_instance_key(run: run_a, step: identity_bind_provisional_step_ref, subject: mtjade1_key)
+  let prior = step_instance_key(run: run_a, step: prior_life_boundary_step_ref, subject: mtjade1_key)
+  let bmc_key = bmc_secure_apply_key()
+  match mtjade1_dry_applied_bmc(subject: mtjade1_intake_subject()) {
+    Absent => false
+    Present { value: apply } => {
+      let clock_x = mtjade1_controller_clock(millis: mtjade1_controller_clock_x_millis, label: "controller-clock-x")
+      let clock_y = mtjade1_controller_clock(millis: mtjade1_controller_clock_y_millis, label: "controller-clock-y")
+      let reading = observation_with_controller_clock(base: apply.application.plan.diverged, controller_clock: Present { value: clock_y })
+      let stamped = apply_with_diverged_controller_clock(application: apply.application, controller_clock: Present { value: clock_x })
+      match bmc_secure_bound(
+        key: bmc_key,
+        identity_key: identity,
+        identity_subject: mtjade1_intake_subject(),
+        prior_key: prior,
+        inputs: BmcSecureInputs {
+          goal: mtjade1_bmc_goal(),
+          reading: reading,
+          grant: Present { value: mtjade1_live_standing_grant },
+          apply: Present { value: BmcSecureApplyInputs { application: stamped, post_read: apply.post_read } },
+          capability: none,
+        },
+      ) {
+        StepRefused { key: _, cause: c } => match c { BmcSecureApplicationNotTheInspectedTransition => true  _ => false }
+        _ => false
+      }
+    }
+  }
+}
+
+test fn w_bmc_secure_apply_of_a_present_controller_clock_over_absent_is_refused() -> Bool {
+  let identity = step_instance_key(run: run_a, step: identity_bind_provisional_step_ref, subject: mtjade1_key)
+  let prior = step_instance_key(run: run_a, step: prior_life_boundary_step_ref, subject: mtjade1_key)
+  let bmc_key = bmc_secure_apply_key()
+  match mtjade1_dry_applied_bmc(subject: mtjade1_intake_subject()) {
+    Absent => false
+    Present { value: apply } => {
+      let reading = observation_with_controller_clock(
+        base: apply.application.plan.diverged,
+        controller_clock: Present { value: mtjade1_controller_clock(millis: mtjade1_controller_clock_x_millis, label: "controller-clock-x") },
+      )
+      match bmc_secure_bound(
+        key: bmc_key,
+        identity_key: identity,
+        identity_subject: mtjade1_intake_subject(),
+        prior_key: prior,
+        inputs: BmcSecureInputs {
+          goal: mtjade1_bmc_goal(),
+          reading: reading,
+          grant: Present { value: mtjade1_live_standing_grant },
+          apply: Present { value: apply },
+          capability: none,
+        },
+      ) {
+        StepRefused { key: _, cause: c } => match c { BmcSecureApplicationNotTheInspectedTransition => true  _ => false }
+        _ => false
+      }
+    }
+  }
+}
+
+test fn w_bmc_secure_apply_of_another_channel_state_is_refused() -> Bool {
+  let identity = step_instance_key(run: run_a, step: identity_bind_provisional_step_ref, subject: mtjade1_key)
+  let prior = step_instance_key(run: run_a, step: prior_life_boundary_step_ref, subject: mtjade1_key)
+  let bmc_key = bmc_secure_apply_key()
+  let reading = dry_read_bmc_account_state(
+    world: mtjade1_account_world(
+      users: [BmcIpmiUser { id: 3, password: "managed-generation-1!" }, BmcIpmiUser { id: 2, password: "admin" }],
+      published_lan_privilege_closed: false,
+    ),
+    subject: mtjade1_intake_subject(),
+    endpoint: mtjade1_bmc_endpoint(),
+    firmware: mtjade1_bmc_firmware(),
+    managed: mtjade1_bmc_goal().managed,
+    managed_user: mtjade1_managed_ipmi_user,
+    managed_password: "managed-generation-1!",
+    census: mtjade1_bmc_census(published_lan_privilege_closed: false),
+    published_user: mtjade1_published_ipmi_user,
+    published_password: "admin",
+    published_account: PublishedAccountRetired,
+    break_glass: mtjade1_bmc_goal().published_break_glass,
+    break_glass_password: "break-glass-generation-4!",
+    attempt: "o1c1-witness-run-a" as AttemptIdentity,
+    read_at_millis: mtjade1_bmc_read_at,
+  )
+  match mtjade1_dry_applied_bmc(subject: mtjade1_intake_subject()) {
+    Absent => false
+    Present { value: apply } =>
+      match bmc_secure_bound(
+        key: bmc_key,
+        identity_key: identity,
+        identity_subject: mtjade1_intake_subject(),
+        prior_key: prior,
+        inputs: BmcSecureInputs {
+          goal: mtjade1_bmc_goal(),
+          reading: reading,
+          grant: Present { value: mtjade1_live_standing_grant },
+          apply: Present { value: apply },
+          capability: none,
+        },
+      ) {
+        StepRefused { key: _, cause: c } => match c { BmcSecureApplicationNotTheInspectedTransition => true  _ => false }
+        _ => false
+      }
+  }
+}
+
+test fn w_bmc_secure_apply_without_authorization_refuses_after_a_real_apply() -> Bool {
+  let identity = step_instance_key(run: run_a, step: identity_bind_provisional_step_ref, subject: mtjade1_key)
+  let prior = step_instance_key(run: run_a, step: prior_life_boundary_step_ref, subject: mtjade1_key)
+  let bmc_key = bmc_secure_apply_key()
+  match mtjade1_dry_applied_bmc(subject: mtjade1_intake_subject()) {
+    Absent => false
+    Present { value: apply } =>
+      match bmc_secure_bound(
+        key: bmc_key,
+        identity_key: identity,
+        identity_subject: mtjade1_intake_subject(),
+        prior_key: prior,
+        inputs: mtjade1_bmc_inputs(reading: apply.application.plan.diverged, grant: none, apply: Present { value: apply }, capability: none),
+      ) {
+        StepRefused { key: _, cause: c } => match c { BmcSecureAuthorizationUndischarged => true  _ => false }
+        _ => false
+      }
+  }
+}
+
+test fn w_bmc_secure_apply_uncovered_grant_falls_through_to_capability() -> Bool {
+  match mtjade1_dry_applied_bmc(subject: mtjade1_intake_subject()) {
+    Absent => false
+    Present { value: apply } => {
+      let standing = apply.application.plan.managed_write.route
+      let request = apply.application.plan.managed_write.request
+      let key = bmc_secure_apply_key()
+      match discharge_bmc_secure_apply(
+        key: key,
+        identity_subject: mtjade1_intake_subject(),
+        inputs: mtjade1_bmc_inputs(
+          reading: apply.application.plan.diverged,
+          grant: Present { value: mtjade1_grant_without_bmc_secure_effect() },
+          apply: Present { value: apply },
+          capability: Present { value: rotation_capability_for(standing: standing, request: request, attempt_text: run_a as String, authority: rotation_apply_authority) },
+        ),
+        standing: standing,
+        request: request,
+      ) {
+        Present { value: _ } => true
+        Absent => false
+      }
+    }
+  }
+}
+
+test fn w_bmc_secure_apply_uncovered_grant_refuses_a_capability_for_another_request() -> Bool {
+  match mtjade1_dry_applied_bmc(subject: mtjade1_intake_subject()) {
+    Absent => false
+    Present { value: apply } => {
+      let standing = apply.application.plan.managed_write.route
+      let request = apply.application.plan.managed_write.request
+      let key = bmc_secure_apply_key()
+      match discharge_bmc_secure_apply(
+        key: key,
+        identity_subject: mtjade1_intake_subject(),
+        inputs: mtjade1_bmc_inputs(
+          reading: apply.application.plan.diverged,
+          grant: Present { value: mtjade1_grant_without_bmc_secure_effect() },
+          apply: Present { value: apply },
+          capability: Present { value: rotation_capability_for(standing: standing, request: mtjade1_published_write_request(), attempt_text: run_a as String, authority: rotation_apply_authority) },
+        ),
+        standing: standing,
+        request: request,
+      ) {
+        Absent => true
+        Present { value: _ } => false
+      }
+    }
+  }
+}
+
+test fn w_a_foreign_bound_host_key_cannot_mint_from_this_instance_controller() -> Bool {
+  match mtjade1_dry_applied_bmc(subject: mtjade1_intake_subject()) {
+    Absent => false
+    Present { value: apply } => {
+      let standing = apply.application.plan.managed_write.route
+      let request = apply.application.plan.managed_write.request
+      let key = step_instance_key(run: run_a, step: bmc_secure_step_ref, subject: "mtcollins1" as StepSubjectKey)
+      match bound_bmc_secure_host(key: key) {
+        Absent => false
+        Present { value: host } =>
+          host_identity_eq(a: host, b: operator_host_mtcollins1)
+            && match discharge_bmc_secure_apply(
+              key: key,
+              identity_subject: mtjade1_intake_subject(),
+              inputs: mtjade1_bmc_inputs(
+                reading: apply.application.plan.diverged,
+                grant: Present { value: mtjade1_live_standing_grant },
+                apply: Present { value: apply },
+                capability: Present { value: rotation_capability_for(standing: standing, request: request, attempt_text: run_a as String, authority: rotation_apply_authority) },
+              ),
+              standing: standing,
+              request: request,
+            ) {
+              Absent => true
+              Present { value: _ } => false
+            }
+      }
+    }
+  }
+}
+
 test fn w_a_precondition_is_not_satisfied_by_a_receipt_for_another_subject() -> Bool {
   let own_access = step_instance_key(run: run_a, step: access_discover_step_ref, subject: mtjade1_key)
   let foreign_access = step_instance_key(run: run_a, step: access_discover_step_ref, subject: "mtjade2" as StepSubjectKey)
@@ -481,7 +1507,7 @@ test fn w_a_precondition_is_not_satisfied_by_a_receipt_for_another_subject() ->
   ]
   match admit_convergence_plan(planning: arrival_planning_authority(), steps: real_steps()) {
     ConvergencePlanAdmitted { plan: p } =>
-      stopped_on_unmet_access_precondition(v: Present { value: fold_convergence_run(plan: p, run: run_a, subject: mtjade1_key, outcomes: outcomes, projection: convergence_receipt_projection(key_of: probe_key, consumed_of: probe_consumed)) })
+      stopped_on_unmet_access_precondition(v: Present { value: fold_convergence_run(plan: p, run: run_a, subject: mtjade1_key, outcomes: outcomes, projection: convergence_receipt_projection(key_of: probe_key, consumed_of: probe_consumed, authorization_required_of: probe_auth_never), discharges: []) })
     ConvergencePlanRefused { cause: _ } => false
   }
 }
@@ -497,7 +1523,7 @@ test fn w_a_precondition_is_not_satisfied_by_a_receipt_from_another_run() -> Boo
   ]
   match admit_convergence_plan(planning: arrival_planning_authority(), steps: real_steps()) {
     ConvergencePlanAdmitted { plan: p } =>
-      stopped_on_unmet_access_precondition(v: Present { value: fold_convergence_run(plan: p, run: run_a, subject: mtjade1_key, outcomes: outcomes, projection: convergence_receipt_projection(key_of: probe_key, consumed_of: probe_consumed)) })
+      stopped_on_unmet_access_precondition(v: Present { value: fold_convergence_run(plan: p, run: run_a, subject: mtjade1_key, outcomes: outcomes, projection: convergence_receipt_projection(key_of: probe_key, consumed_of: probe_consumed, authorization_required_of: probe_auth_never), discharges: []) })
     ConvergencePlanRefused { cause: _ } => false
   }
 }
@@ -518,7 +1544,7 @@ test fn w_an_incomplete_instance_satisfies_no_dependent_and_the_run_is_incomplet
   ]
   match admit_convergence_plan(planning: arrival_planning_authority(), steps: real_steps()) {
     ConvergencePlanAdmitted { plan: p } =>
-      match fold_convergence_run(plan: p, run: run_a, subject: mtjade1_key, outcomes: outcomes, projection: convergence_receipt_projection(key_of: probe_key, consumed_of: probe_consumed)) {
+      match fold_convergence_run(plan: p, run: run_a, subject: mtjade1_key, outcomes: outcomes, projection: convergence_receipt_projection(key_of: probe_key, consumed_of: probe_consumed, authorization_required_of: probe_auth_never), discharges: []) {
         RunIncomplete { ledger: l, at: at } =>
           declaration_ref_eq(a: at.step_identity, b: identity_bind_provisional_step_ref)
             && match l.instances.last() {
diff --git a/dag/test/claim/machine_intake/megarac_kvm_still_witness_test.dag b/dag/test/claim/machine_intake/megarac_kvm_still_witness_test.dag
index 635ddb0bb6c..8a6370b46d8 100644
--- a/dag/test/claim/machine_intake/megarac_kvm_still_witness_test.dag
+++ b/dag/test/claim/machine_intake/megarac_kvm_still_witness_test.dag
@@ -8,10 +8,6 @@ import std.optional { Present, Absent }
 import v2.std.algebra { any }
 import extdeps.crypto.hash { sha256_digest }
 import extdeps.tools.sha256sum { Sha256FileDigest, Sha256FileDigestUnavailable }
-import extdeps.bmc.megarac {
-  megarac_screen_capture_standing_at_0_32, KvmClientCanvasJpeg, LastBsodJpeg, TriggeredFramebufferRecording, ServerSideOnDemandStill,
-  ScreenCaptureClientSideOnly, ScreenCaptureEventRetainedOnly, ScreenCaptureAbsent,
-}
 import gunbc.runner_browser_toolchain { BrowserToolchainUnresolved }
 import gunbc.machine_intake_megarac_kvm_still {
   KvmJournalEvent, KvmJournalStill, KvmJournalAcquisitionFailed, KvmJournalConnectionLost, KvmJournalUnparsed,
@@ -27,8 +23,8 @@ import gunbc.machine_intake_megarac_kvm_still {
   KvmJournalEstablished, KvmJournalConnectionRequested, KvmJournalConnectionRefused, KvmJournalConnectionOpen, KvmJournalConnectionError,
   KvmJournalRefused, KvmJournalFailed, KvmJournalStopRequested, KvmJournalSessionRelease, KvmJournalBrowserClose, KvmJournalStopped, KvmJournalTriggerScanFailed, KvmJournalNavigated, KvmJournalPageConsole, KvmJournalPageError,
   KvmLoginRefused, KvmNoKvmService, KvmNoFrame, KvmToolchainUnavailable, KvmCredentialUnreadable, KvmRefusedOther, KvmAcquisitionOther, kvm_observer_standing, kvm_boundary_events, kvm_still_gaps, kvm_retained_still,
-  megarac_kvm_observer_start, kvm_observer_trigger,
-  KvmJournalWord, kvm_journal_event_words, kvm_journal_cause_words, megarac_kvm_observer_script,
+  megarac_kvm_observer_start,
+  KvmJournalWord, kvm_journal_event_words,
 }
 import gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle { mtcollins1_boot_retained_artifact_prefix, mtcollins1_kvm_observer_dir }
 import gunbc.fleet_host_identity { operator_host_mtcollins1 }
@@ -78,16 +74,6 @@ fn instant(iso: String) -> KvmInstant {
   KvmInstant { since_epoch: millisecond(count: 1), iso: iso }
 }
 
-// THE UPSTREAM FACT THE ROUTE STANDS ON: 0.32 serves no on-demand still; the viewer canvas is the one
-// route that yields a still at any moment.
-test fn firmware_0_32_serves_no_on_demand_still_and_the_viewer_is_client_side() -> Bool {
-  let absent = match megarac_screen_capture_standing_at_0_32(route: ServerSideOnDemandStill) { ScreenCaptureAbsent => true  _ => false }
-  let client = match megarac_screen_capture_standing_at_0_32(route: KvmClientCanvasJpeg) { ScreenCaptureClientSideOnly => true  _ => false }
-  let bsod = match megarac_screen_capture_standing_at_0_32(route: LastBsodJpeg) { ScreenCaptureEventRetainedOnly => true  _ => false }
-  let rec = match megarac_screen_capture_standing_at_0_32(route: TriggeredFramebufferRecording) { ScreenCaptureEventRetainedOnly => true  _ => false }
-  absent && client && bsod && rec
-}
-
 // ESTABLISHED ONLY FOR THE EXPECTED SUBJECT, and every still carries its capture instant and the
 // connection generation it was taken under.
 test fn established_is_bound_to_the_expected_host_and_attempt() -> Bool {
@@ -133,7 +119,8 @@ test fn acquisition_failures_keep_their_cause() -> Bool {
   changed && tainted
 }
 
-// THE HANDOFF IS ADMITTED ONLY OVER AN ESTABLISHED OBSERVER, through the selector the actuation
+// CONTROL OF THE DROP handoff_observer_is_sol_not_kvm_viewer: when a public client restores the
+// observer, this is the refusal that returns to the handoff. THE KVM ADMISSION IS ADMITTED ONLY OVER AN ESTABLISHED OBSERVER, through the selector
 // calls: not started, pending, a busy seat, a mismatch and a loss each refuse with their standing.
 test fn the_handoff_is_admitted_only_over_an_established_observer() -> Bool {
   let at = instant(iso: "t1")
@@ -226,19 +213,10 @@ fn admitted(operation: MegaRacOperation) -> AdmittedMegaRacHost? {
   }
 }
 
-test fn the_start_refuses_without_driving_when_a_precondition_is_missing() -> Bool {
-  match admitted(operation: MegaRacKvmCanvasStill) {
-    Absent => false
-    Present { value: h } => {
-      let nocred = megarac_kvm_observer_start(host: h, dir: "artifacts/mtcollins1-boot-kvm-1", password_file: "", toolchain: BrowserToolchainUnresolved { cause: "witness" }, attempt: "1")
-      let nodir = megarac_kvm_observer_start(host: h, dir: "", password_file: "/nonexistent", toolchain: BrowserToolchainUnresolved { cause: "witness" }, attempt: "1")
-      let notool = megarac_kvm_observer_start(host: h, dir: "artifacts/mtcollins1-boot-kvm-1", password_file: "/nonexistent", toolchain: BrowserToolchainUnresolved { cause: "host not in the floor pool" }, attempt: "1")
-      let b = match nocred { KvmObserverNotStarted { reason: r } => string_contains(s: r as String, pattern: "no BMC credential")  _ => false }
-      let d = match nodir { KvmObserverNotStarted { reason: r } => string_contains(s: r as String, pattern: "no observer directory")  _ => false }
-      let c = match notool { KvmObserverNotStarted { reason: r } => string_contains(s: r as String, pattern: "unresolved: host not in the floor pool")  _ => false }
-      b && d && c && !kvm_observer_trigger(start: nocred, order: 1, reason: "power-on-verified")
-    }
-  }
+// No public KVM client exists and the canvas has no standing at 0.32, so the host is refused for the
+// KVM canvas still at the admission, before any start can be asked of it.
+test fn the_kvm_canvas_still_is_refused_at_admission_so_no_viewer_start_is_reachable() -> Bool {
+  match admitted(operation: MegaRacKvmCanvasStill) { Absent => true  Present { value: _ } => false }
 }
 
 test fn a_carrier_admitted_for_virtual_media_does_not_start_the_viewer() -> Bool {
@@ -257,20 +235,14 @@ test fn the_observer_directory_is_retained_with_the_boot_artifacts() -> Bool {
   starts_with(s: mtcollins1_kvm_observer_dir(attempt: "36335369059"), prefix: mtcollins1_boot_retained_artifact_prefix)
 }
 
-// ONE VOCABULARY, READ BOTH WAYS. Every event word the module declares reaches the observer script as
-// an EV constant and parses back to its own journal variant, never to Unparsed; every cause word reaches
-// it as a CA constant. A word added to the script but not to the rows is not written (the script only
-// has EV/CA), and a row whose word the parser does not read turns this red. The control: a word the rows
-// do not declare stays Unparsed.
+// EVERY DECLARED EVENT WORD PARSES BACK to its own journal variant, never to Unparsed; a word the rows
+// do not declare stays Unparsed (the control).
 fn kvm_word_line(w: String) -> String { concat("1790000000000 2026-09-30T00:00:00.000Z ", concat(w, " detail=x")) }
 
 test fn the_journal_vocabulary_is_declared_once_and_read_back_by_the_parser() -> Bool {
-  let script = megarac_kvm_observer_script
-  let events_rendered = !any(kvm_journal_event_words, w => !(string_contains(s: script, pattern: concat(w.id, concat(":'", concat(w.word, "'"))))))
-  let causes_rendered = !any(kvm_journal_cause_words, w => !(string_contains(s: script, pattern: concat(w.id, concat(":'", concat(w.word, "'"))))))
   let parsed = !any(kvm_journal_event_words, w => !(match kvm_journal_event(line: kvm_word_line(w: w.word)) { KvmJournalUnparsed { line: _ } => false  _ => true }))
   let control = match kvm_journal_event(line: kvm_word_line(w: "undeclared-word")) { KvmJournalUnparsed { line: _ } => true  _ => false }
-  events_rendered && causes_rendered && parsed && control && string_contains(s: script, pattern: "const EV=\{") && !string_contains(s: script, pattern: "j('")
+  parsed && control
 }
 
 // ── THE JOURNAL, WRITTEN: kvm_journal_line is kvm_journal_event read the other way ─────────────────
@@ -327,8 +299,8 @@ test fn every_rendered_journal_line_parses_back_to_its_event() -> Bool {
   all(kvm_event_sample(), e => !refused(r: kvm_journal_line(event: e)) && kvm_journal_event(line: rendered(r: kvm_journal_line(event: e))) == e)
 }
 
-// FIDELITY TO THE OBSERVER: lines as the observer script writes them re-render byte for byte where the
-// script writes only keys the parser reads, and differ only by the unread keys where it writes more.
+// FIDELITY TO THE OBSERVER: lines as the committed observer journal records them re-render byte for byte where the
+// journal carries only keys the parser reads, and differ only by the unread keys where it writes more.
 test fn a_written_line_renders_as_the_observer_writes_it() -> Bool {
   let established = "1790577698700 2026-09-28T06:41:38.700Z established host=\"192.168.1.30\" session=12 attempt=4242 gen=1"
   let lost = "1790577710007 2026-09-28T06:41:50.007Z connection-lost gen=1"
diff --git a/dag/test/claim/machine_intake/megarac_media_convergence_witness_test.dag b/dag/test/claim/machine_intake/megarac_media_convergence_witness_test.dag
index 5be0007cda3..848bd35f9b9 100644
--- a/dag/test/claim/machine_intake/megarac_media_convergence_witness_test.dag
+++ b/dag/test/claim/machine_intake/megarac_media_convergence_witness_test.dag
@@ -5,7 +5,6 @@ import std.types { Bool, EpochMs, List, NonEmptyStr, String }
 import std.process { ProcessExit, ExitSuccess, ExitFailure }
 import std.content_hash { ContentHash, content_hash_of_value }
 import extdeps.bmc.megarac { megarac_firmware_0_32 }
-import gunbc.machine_intake_megarac_ui_features { megarac_rmedia_status_0_32 }
 import extdeps.bmc.capability { bmc_firmware_release_identity_of_wire }
 import extdeps.bmc.endpoint { AmiMegaRac }
 import extdeps.provisioning.ubuntu_seeded_install_media { ubuntu_seeded_install_media_image_name, ubuntu_seeded_install_media_name_digest_prefix }
@@ -94,13 +93,8 @@ import gunbc.machine_intake_megarac_media_attach {
   ReadinessMalformed,
   PresentationUnobserved,
   PresentationReadyButSessionHeld,
-  CdErrorUncatalogued,
-  CdErrorStopReason,
-  StopReasonNoFault,
-  StopReasonPresentationFailure,
-  MegaRacPresentationStopped,
-  megarac_stop_reason_class,
-  share_binding_standing,
+  CdErrorNonzero,
+    share_binding_standing,
   ShareBound,
   ShareMismatch,
   ShareUnreadable,
@@ -493,9 +487,8 @@ test fn a_general_document_missing_a_member_is_unreadable_not_bound() -> Bool {
   }
 }
 
-// THE CODE IS THE VENDOR'S LATCHED LAST-STOP REASON (operator-approved 2026-10-01; the UI bundle's
-// rmedia view, extdeps.bmc.megarac megarac_rmedia_status_0_32). 18:37Z: code 16 while the re-attached
-// image read Started, session 0 -- a healthy presentation with the reason the stale image's stop left.
+// THE CODE IS A RAW OBSERVATION; no meaning is established for it. 18:37Z (boot run 36721915217): code 16
+// while the re-attached image read Started, session 0.
 data cd_clean: CdErrorReading = CdErrorRead { code: CdErrorNone }
 data cd_16: CdErrorReading = cd_error_reading(body: mtcollins1_media_general_2026_09_27, firmware: megarac_firmware_0_32)
 
@@ -519,44 +512,42 @@ fn gate_of(outcome: MegaRacAttachOutcome) -> String {
   }
 }
 
-// ─── THE TABLE IS READ AS THE VENDOR'S, AND EVERY ROW IS CLASSIFIED ─────────────────────────────
-// An identity join over the DERIVED table: each code the 0.32 bundle names has a class, and the
-// classes are the ones the policy states. A row the policy does not name would fall to Uncatalogued.
-test fn every_stop_reason_of_the_0_32_table_is_classified() -> Bool {
-  count(megarac_rmedia_status_0_32) == 17
-    && all(megarac_rmedia_status_0_32, st => match megarac_stop_reason_class(status: st) { Present { value: _ } => true  Absent => false })
-    && all(megarac_rmedia_status_0_32, st => match megarac_stop_reason_class(status: st) {
-         Present { value: StopReasonNoFault } => st.code == 1 || st.code == 7 || st.code == 15 || st.code == 16
-         Present { value: StopReasonPresentationFailure } => st.code != 1 && st.code != 7 && st.code != 15 && st.code != 16
-         Absent => false
-       })
+// ─── EVERY NONZERO CODE IS THE RAW NUMBER ────────────────────────────────────────────────────────
+// No value is given a meaning: a nonzero code reads as itself with the firmware it came from, and the
+// attach policy admits only 16 on 0.32 (the boot run's reading), by policy rather than by decoding.
+fn nonzero_is(r: CdErrorReading, expected: Int) -> Bool {
+  match r { CdErrorRead { code: CdErrorNonzero { wire: w, firmware: _ } } => w == expected  _ => false }
 }
 
-// The 18:37Z code reads BY NAME, and a code outside the table, or any code on a build with no table,
-// stays uncatalogued.
-test fn a_code_reads_by_the_vendors_name_and_only_inside_the_table() -> Bool {
-  (match cd_16 { CdErrorRead { code: CdErrorStopReason { status: st, class: StopReasonNoFault } } => st.code == 16 && (st.name as String) == "Device Ejected"  _ => false })
-    && (match cd_error_reading(body: general_coded(code: "11"), firmware: megarac_firmware_0_32) { CdErrorRead { code: CdErrorStopReason { status: st, class: StopReasonPresentationFailure } } => (st.name as String) == "Mount Error"  _ => false })
-    && (match cd_error_reading(body: general_coded(code: "18"), firmware: megarac_firmware_0_32) { CdErrorRead { code: CdErrorUncatalogued { wire: w } } => w == 18  _ => false })
-    && (match cd_error_reading(body: general_coded(code: "16"), firmware: bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: "0.33")) { CdErrorRead { code: CdErrorUncatalogued { wire: w } } => w == 16  _ => false })
+fn cd_attach_policy_admits(r: CdErrorReading) -> Bool {
+  match r { CdErrorRead { code: c } => cd_error_attach_policy_admits(code: c)  _ => false }
+}
+
+test fn a_nonzero_code_reads_as_the_raw_number_and_only_16_on_0_32_is_admitted_by_policy() -> Bool {
+  nonzero_is(r: cd_16, expected: 16)
+    && nonzero_is(r: cd_error_reading(body: general_coded(code: "11"), firmware: megarac_firmware_0_32), expected: 11)
+    && nonzero_is(r: cd_error_reading(body: general_coded(code: "18"), firmware: megarac_firmware_0_32), expected: 18)
+    && cd_attach_policy_admits(r: cd_16)
+    && !cd_attach_policy_admits(r: cd_error_reading(body: general_coded(code: "11"), firmware: megarac_firmware_0_32))
+    && !cd_attach_policy_admits(r: cd_error_reading(body: mtcollins1_media_general_2026_09_27, firmware: bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: "0.33")))
 }
 
 // ─── STARTED: THE CODE IS RECORDED, NEVER WITHHELD ON ───────────────────────────────────────────
 test fn a_named_code_beside_a_started_presentation_is_ready_and_recorded() -> Bool {
   (match ready_after(cd_before: cd_16, general: general_coded(code: "11")) {
     MegaRacPresentationReady { route: _, evidence: e } =>
-      (match e.cd_at_ready { CdErrorRead { code: CdErrorStopReason { status: st, class: _ } } => st.code == 11  _ => false })
-        && (match e.cd_before_any_write { CdErrorRead { code: CdErrorStopReason { status: st, class: _ } } => st.code == 16  _ => false })
+      (match e.cd_at_ready { CdErrorRead { code: CdErrorNonzero { wire: w, firmware: _ } } => w == 11  _ => false })
+        && nonzero_is(r: e.cd_before_any_write, expected: 16)
     _ => false
   })
     && gate_of(outcome: ready_after(cd_before: cd_16, general: mtcollins1_media_general_2026_09_27)) == "READY"
 }
 
-// A CODE OUTSIDE THE TABLE BESIDE STARTED IS ALSO ONLY RECORDED: the vendor does not consult the code
-// while started, whatever it reads. The red for this arm is the unread code below.
+// AN UNCATALOGUED CODE BESIDE STARTED IS ALSO ONLY RECORDED: the code is never withheld on while
+// started, whatever it reads. The red for this arm is the unread code below.
 test fn a_code_outside_the_table_beside_a_started_presentation_is_ready_and_recorded() -> Bool {
   (match ready_after(cd_before: cd_clean, general: general_coded(code: "42")) {
-    MegaRacPresentationReady { route: _, evidence: e } => (match e.cd_at_ready { CdErrorRead { code: CdErrorUncatalogued { wire: w } } => w == 42  _ => false })
+    MegaRacPresentationReady { route: _, evidence: e } => (match e.cd_at_ready { CdErrorRead { code: CdErrorNonzero { wire: w, firmware: _ } } => w == 42  _ => false })
     _ => false
   })
     && gate_of(outcome: ready_after(cd_before: cd_clean, general: general_coded(code: "42"))) == "READY"
@@ -580,7 +571,7 @@ test fn a_clean_code_at_readiness_is_ready() -> Bool {
 // RECEIPT, VERBATIM (run 36721915217, artifact mtcollins1-boot-receipts, mtcollins1-boot-diagnostics.txt):
 // general settings at readiness (answered at 1790776024628) and the configurations row of the Started
 // look (session_index 0). cd_error_code read 16 before any write, after the stop and at readiness; the
-// run refused as "cannot establish the media state". Under the vendor's reading it is ready.
+// run refused as "cannot establish the media state". Under the grounded reading it is ready.
 data run_36721915217_general_at_ready: String = "{ \"id\": 1, \"local_media_support\": 0, \"remote_media_support\": 1, \"same_settings\": 0, \"cd_remote_server_address\": \"192.168.1.188\", \"cd_remote_source_path\": \"\\/srv\\/bmc\", \"cd_remote_share_type\": \"nfs\", \"cd_remote_domain_name\": \"\", \"cd_remote_user_name\": \"\", \"mount_cd\": 1, \"cd_image_name\": \"\", \"cd_error_code\": 16, \"mount_hd\": 0, \"hd_remote_server_address\": \"\", \"hd_remote_source_path\": \"\", \"hd_remote_share_type\": \"\", \"hd_remote_domain_name\": \"\", \"hd_remote_user_name\": \"\", \"hd_image_name\": \"\", \"hd_error_code\": 0, \"rmedia_retry_count\": 3, \"rmedia_retry_interval\": 15 }"
 
 data run_36721915217_configurations_at_ready: String = "[ { \"id\": 1, \"media_type\": 1, \"media_index\": 0, \"session_index\": 0, \"image_name\": \"gunbc-mtcollins1-census-ubuntu-24.04.3-arm64-161b98b9bb389a80.iso\", \"redirection_status\": 1 } ]"
@@ -594,7 +585,7 @@ test fn boot_run_36721915217_readings_now_admit() -> Bool {
   (match outcome {
     MegaRacPresentationReady { route: _, evidence: e } =>
       e.session_index == Present { value: "0" }
-        && (match e.cd_at_ready { CdErrorRead { code: CdErrorStopReason { status: st, class: StopReasonNoFault } } => st.code == 16  _ => false })
+        && nonzero_is(r: e.cd_at_ready, expected: 16)
     _ => false
   })
     && (match megarac_boot_media_gate(record: MediaAttachAttempted { attempt: "36721915217", medium_image_name: run_36721915217_image, medium_image_sha256: "161b98b9bb389a80", power: ChassisPowerRead { power_on: false }, stale_power_off: StalePowerOffNotNeeded { reason: "the host was read off" }, result: MegaRacAttachResult { outcome: outcome, session_release: SessionReleased, baseline: none } }) {
@@ -603,40 +594,30 @@ test fn boot_run_36721915217_readings_now_admit() -> Bool {
     })
 }
 
-// ─── STOPPED: REFUSED BY NAME, WITH ITS CLASS ───────────────────────────────────────────────────
-// The wait closes on a look that finds nothing presented (the row stopped, status 0) while the code
-// names a reason: the refusal is the vendor's "Stopped - <name>", not a timeout.
+// ─── STOPPED: A TIMEOUT CARRYING THE RAW CODE ───────────────────────────────────────────────────
+// The wait closes on a look that finds nothing presented (the row stopped, status 0). Whatever the code
+// reads, that is a timeout that carries the code as observed; no code turns it into a named stop.
 fn closed_stopped(general: String) -> MegaRacAttachOutcome {
   readiness_wait_outcome(wait: ReadinessWaitClosed { last: look(at: 43000, status: "0", session: "255"), deadline: 43000, looks: 16 }, image_name: desired_census, firmware: megarac_firmware_0_32, route: RouteAttached { image_list_index: "5", start: WriteAccepted { body: "{}" } }, cd_before: cd_clean, general_at_end: raw_at(body: general))
 }
 
-test fn a_stopped_presentation_with_mount_error_refuses_as_a_presentation_failure() -> Bool {
-  (match closed_stopped(general: general_coded(code: "11")) {
-    MegaRacPresentationStopped { image_name: _, route: _, look: _, looks: n, cd_before_any_write: _, stop: st, class: StopReasonPresentationFailure, general_at_refusal: _ } => n == 16 && st.code == 11 && (st.name as String) == "Mount Error"
-    _ => false
-  })
-    && string_contains(s: gate_of(outcome: closed_stopped(general: general_coded(code: "11"))), pattern: "Stopped - Mount Error")
-}
-
-test fn a_stopped_presentation_with_device_ejected_refuses_as_no_fault() -> Bool {
-  (match closed_stopped(general: mtcollins1_media_general_2026_09_27) {
-    MegaRacPresentationStopped { image_name: _, route: _, look: _, looks: _, cd_before_any_write: _, stop: st, class: StopReasonNoFault, general_at_refusal: _ } => st.code == 16
+fn timed_out_at(general: String, expected: Int) -> Bool {
+  match closed_stopped(general: general) {
+    MegaRacReadinessTimedOut { image_name: _, route: _, last: _, deadline: _, looks: n, cd_before_any_write: _, cd_at_refusal: c } => n == 16 && nonzero_is(r: c, expected: expected)
     _ => false
-  })
-    && string_contains(s: gate_of(outcome: closed_stopped(general: mtcollins1_media_general_2026_09_27)), pattern: "Stopped - Device Ejected")
+  }
 }
 
-// THE CONTROLS: a clean code, and a code outside the table, beside the same stopped look are an
-// ordinary timeout -- the name comes only from the table.
-test fn a_stopped_presentation_without_a_named_code_is_a_timeout() -> Bool {
-  (match closed_stopped(general: mtcollins1_media_general_2026_09_27_morning_as_reported) { MegaRacReadinessTimedOut { image_name: _, route: _, last: _, deadline: _, looks: _, cd_before_any_write: _, cd_at_refusal: _ } => true  _ => false })
-    && (match closed_stopped(general: general_coded(code: "42")) { MegaRacReadinessTimedOut { image_name: _, route: _, last: _, deadline: _, looks: _, cd_before_any_write: _, cd_at_refusal: CdErrorRead { code: CdErrorUncatalogued { wire: w } } } => w == 42  _ => false })
+test fn a_stopped_presentation_is_a_timeout_whatever_the_code_reads() -> Bool {
+  timed_out_at(general: mtcollins1_media_general_2026_09_27, expected: 16)
+    && timed_out_at(general: general_coded(code: "42"), expected: 42)
+    && (match closed_stopped(general: mtcollins1_media_general_2026_09_27_morning_as_reported) { MegaRacReadinessTimedOut { image_name: _, route: _, last: _, deadline: _, looks: _, cd_before_any_write: _, cd_at_refusal: CdErrorRead { code: CdErrorNone } } => true  _ => false })
 }
 
 // ─── BEFORE ANY WRITE ───────────────────────────────────────────────────────────────────────────
-// A read code is a past stop's reason: the desired image presented goes straight to the readiness fold
-// with no write, host on or off, whatever the code reads; nothing presented is attached on a named
-// code (the vendor's stopped view leaves Start enabled).
+// A read code is an observation: the desired image presented goes straight to the readiness fold
+// with no write, host on or off, whatever the code reads; nothing presented is attached under the policy
+// that admits 16 on 0.32.
 test fn a_read_code_before_any_write_never_withdraws_the_desired_presentation() -> Bool {
   (match step_with_cd(configurations: presenting(name: desired_census as String, status: "1"), detach: host_off, cd_before: cd_16) { ConvergeStepAwaitReadiness => true  _ => false })
     && (match step_with_cd(configurations: presenting(name: desired_census as String, status: "1"), detach: host_on, cd_before: cd_16) { ConvergeStepAwaitReadiness => true  _ => false })
@@ -644,18 +625,17 @@ test fn a_read_code_before_any_write_never_withdraws_the_desired_presentation()
 }
 
 test fn a_named_code_with_nothing_presented_attaches() -> Bool {
-  (match step_with_cd(configurations: "[]", detach: host_on, cd_before: cd_error_reading(body: general_coded(code: "11"), firmware: megarac_firmware_0_32)) { ConvergeStepAttachFromListing => true  _ => false })
-    && (match step_with_cd(configurations: "[]", detach: host_off, cd_before: cd_16) { ConvergeStepAttachFromListing => true  _ => false })
+  (match step_with_cd(configurations: "[]", detach: host_off, cd_before: cd_16) { ConvergeStepAttachFromListing => true  _ => false })
 }
 
-// A CODE OUTSIDE THE TABLE WITH NOTHING PRESENTED is the one pre-write knowledge refusal left: the
+// A CODE OUTSIDE THE ATTACH POLICY WITH NOTHING PRESENTED is the one pre-write knowledge refusal left: the
 // fresh-presentation admission decides, and not admitted, nothing is written.
 data cd_42: CdErrorReading = cd_error_reading(body: general_coded(code: "42"), firmware: megarac_firmware_0_32)
 
 
 test fn nothing_presented_with_a_code_outside_the_table_and_the_host_on_refuses_before_any_write() -> Bool {
   match step_with_cd(configurations: "[]", detach: host_on, cd_before: cd_42) {
-    ConvergeStepRefuse { outcome: MegaRacMediaStateUnestablishedBeforeWrite { cd_before_any_write: CdErrorRead { code: CdErrorUncatalogued { wire: w } }, reason: _ } } => w == 42
+    ConvergeStepRefuse { outcome: MegaRacMediaStateUnestablishedBeforeWrite { cd_before_any_write: CdErrorRead { code: CdErrorNonzero { wire: w, firmware: _ } }, reason: _ } } => w == 42
     _ => false
   }
 }
@@ -750,7 +730,7 @@ test fn the_recheck_withholds_when_its_own_session_was_not_released() -> Bool {
     && (match presentation_still_served(result: served_look) { PresentationStillReady => true _ => false })
 }
 
-// AT THE RECHECK: Started with any read code is still served; an unread look is unobserved; a stopped row with a named code is an affirmed loss that names the vendor's reason.
+// AT THE RECHECK: Started with any read code is still served; an unread look is unobserved; a stopped row with code 16 is an affirmed loss that does not name the code as a cause.
 test fn a_started_look_with_code_16_is_still_served_at_the_recheck() -> Bool {
   match presentation_still_served(result: observed(general: mtcollins1_media_general_2026_09_27, configurations: presenting_in(name: desired_census as String, status: "1", session: "0"))) {
     PresentationStillReady => true
@@ -772,9 +752,9 @@ test fn a_started_look_with_an_unread_code_is_unobserved_at_the_recheck() -> Boo
   }
 }
 
-test fn a_stopped_row_with_a_named_code_is_no_longer_served_by_name() -> Bool {
-  match presentation_still_served(result: observed(general: general_coded(code: "11"), configurations: presenting_in(name: desired_census as String, status: "0", session: "255"))) {
-    PresentationNoLongerReady { reason: r } => string_contains(s: r as String, pattern: "Stopped - Mount Error")
+test fn a_stopped_row_with_code_16_is_no_longer_served_and_the_reason_does_not_name_the_code() -> Bool {
+  match presentation_still_served(result: observed(general: mtcollins1_media_general_2026_09_27, configurations: presenting_in(name: desired_census as String, status: "0", session: "255"))) {
+    PresentationNoLongerReady { reason: r } => string_contains(s: r as String, pattern: "no longer Started with a bound session") && !string_contains(s: r as String, pattern: "ejected")
     _ => false
   }
 }
diff --git a/dag/test/claim/machine_intake/megarac_session_release_witness_test.dag b/dag/test/claim/machine_intake/megarac_session_release_witness_test.dag
index 59ef8f4c040..78304aaf2e8 100644
--- a/dag/test/claim/machine_intake/megarac_session_release_witness_test.dag
+++ b/dag/test/claim/machine_intake/megarac_session_release_witness_test.dag
@@ -10,6 +10,7 @@ import gunbc.machine_intake_megarac_media_attach {
   SessionReleaseRefused,
   SessionCsrfParsed,
   SessionCsrfUnreadable,
+  megarac_session_csrf,
   megarac_session_presence,
   megarac_session_release_by_reobservation,
 }
@@ -114,3 +115,29 @@ test fn a_release_with_a_sentinel_csrf_is_not_released() -> Bool {
     _ => false
   }
 }
+
+// THE SESSION DECODER, with the body supplied at its interface. The token-bearing body decodes; a
+// body with no CSRFToken member, a non-string member and a non-JSON body each read absent, which
+// megarac_attach_remote_image refuses as MegaRacSessionTokenUnreadable. The paired real-path claim
+// is the mtcollins1 boot acceptance matrix, which decodes the dry OpenSession reply end to end; that
+// the refusal then issues CloseSession is observable only on the route and is not claimed here.
+test fn a_session_body_with_a_token_decodes() -> Bool {
+  match megarac_session_csrf(session_body: "{ \"CSRFToken\": \"t-1\" }") {
+    Present { value: v } => v == "t-1"
+    Absent => false
+  }
+}
+
+test fn a_session_body_with_no_token_member_reads_absent() -> Bool {
+  match megarac_session_csrf(session_body: "{ \"other\": 1 }") {
+    Absent => true
+    Present { value: _ } => false
+  }
+}
+
+test fn a_session_body_that_is_not_json_reads_absent() -> Bool {
+  match megarac_session_csrf(session_body: "not json") {
+    Absent => true
+    Present { value: _ } => false
+  }
+}
diff --git a/dag/test/claim/machine_intake/megarac_ui_features_witness_test.dag b/dag/test/claim/machine_intake/megarac_ui_features_witness_test.dag
deleted file mode 100644
index 247f574d707..00000000000
--- a/dag/test/claim/machine_intake/megarac_ui_features_witness_test.dag
+++ /dev/null
@@ -1,136 +0,0 @@
-module test.claim.machine_intake.megarac_ui_features_witness_test
-
-import std.types { Bool, List, NonEmptyStr, String }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import std.optional { Present, Absent }
-import v2.std.algebra { any }
-import extdeps.bmc.megarac { megarac_ui_features_json, megarac_firmware_0_32 }
-import extdeps.external_authority { TranscribedUncited }
-import extdeps.bmc.capability { bmc_firmware_release_identity_of_wire }
-import extdeps.bmc.endpoint { AmiMegaRac }
-import gunbc.machine_intake_megarac_served_ui_catalog_observation { megarac_source_min_js_sha256_2026_09_27 }
-import gunbc.machine_intake_megarac_ui_features {
-  MegaRacUiFeatures, MegaRacUiFeaturesRead, MegaRacUiFeaturesUnread,
-  megarac_ui_features_of_bundle, megarac_ui_feature_name_admitted, megarac_ui_features_reading, megarac_ui_features_row_text,
-  megarac_ui_features_0_32, megarac_ui_features_0_32_receipt, megarac_ui_features,
-  MegaRacRmediaStatus, MegaRacRmediaStatusTable, MegaRacRmediaStatusTableRead, MegaRacRmediaStatusTableUnread,
-  RmediaStatusNamed, RmediaStatusOutsideTable, RmediaStatusTableUnread,
-  megarac_rmedia_status_0_32, megarac_rmedia_status_0_32_receipt, megarac_rmedia_status_of_wire,
-  megarac_rmedia_status_entries_of_bundle, megarac_rmedia_status_bound_of_bundle, megarac_rmedia_status_table_reading, megarac_rmedia_status_row_text,
-}
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-// The module as source.min.js 0.32 spells it (run 36778446928's bytes), abbreviated to three entries,
-// between the neighbouring modules so the parse is held to its own boundaries.
-data bundle_fragment: String = "o(\"x\",[],function()\{return 1}),o(\"features\",[],function()\{var e=[\{feature:\"RMEDIA_MULTI_IMAGE_SUPPORT\"},\{feature:\"KVM_SESSION_RECONNECT\"},\{feature:\"HTML5_KVM\"}];return e}),o(\"collection/project-configurations\",[\"jquery\"],function()\{var q=\{feature:\"NOT_IN_THE_MODULE\"}})"
-
-test fn the_features_module_yields_its_names_in_order_and_nothing_outside_it() -> Bool {
-  match megarac_ui_features_of_bundle(text: bundle_fragment) {
-    Present { value: names } => names == ["RMEDIA_MULTI_IMAGE_SUPPORT", "KVM_SESSION_RECONNECT", "HTML5_KVM"]
-    Absent => false
-  }
-}
-
-test fn a_bundle_without_the_module_yields_nothing() -> Bool {
-  match megarac_ui_features_of_bundle(text: "o(\"collection/project-configurations\",[],function()\{})") { Absent => true  Present { value: _ } => false }
-}
-
-// THE PIN: bytes that are not the 2026-09-27 build are not read, however well they parse.
-test fn only_the_pinned_build_is_read() -> Bool {
-  (match megarac_ui_features_reading(observed_sha256: megarac_source_min_js_sha256_2026_09_27 as String, text: bundle_fragment) { MegaRacUiFeaturesRead { names: n, source_sha256: _ } => n == ["RMEDIA_MULTI_IMAGE_SUPPORT", "KVM_SESSION_RECONNECT", "HTML5_KVM"]  _ => false })
-    && (match megarac_ui_features_reading(observed_sha256: "0000000000000000000000000000000000000000000000000000000000000000", text: bundle_fragment) { MegaRacUiFeaturesUnread { cause: c } => string_contains(s: c as String, pattern: "not the pinned")  _ => false })
-}
-
-// A NAME OUTSIDE THE VENDOR IDENTIFIER SHAPE IS REFUSED, so nothing can escape the JSON it is written into.
-test fn a_name_outside_the_identifier_shape_is_refused() -> Bool {
-  megarac_ui_feature_name_admitted(name: "HTML5_KVM")
-    && !megarac_ui_feature_name_admitted(name: "")
-    && !megarac_ui_feature_name_admitted(name: "a\"b")
-    && !megarac_ui_feature_name_admitted(name: "lower")
-    && (match megarac_ui_features_reading(observed_sha256: megarac_source_min_js_sha256_2026_09_27 as String, text: "o(\"features\",[],function()\{var e=[\{feature:\"OK_ONE\"},\{feature:\"bad name\"}];return e}") { MegaRacUiFeaturesUnread { cause: c } => string_contains(s: c as String, pattern: "bad name")  _ => false })
-}
-
-// THE EMITTED ROW IS THE FILE'S TEXT FOR THE NAMES, and the committed 0.32 row is that emission: every
-// name in the vendor shape, the names the viewer reads among them.
-test fn the_committed_row_holds_the_names_the_viewer_reads() -> Bool {
-  let names = map(megarac_ui_features_0_32, n => n as String)
-  count(names) > 0
-    && all(names, n => megarac_ui_feature_name_admitted(name: n))
-    && any(names, n => n == "KVM_SESSION_RECONNECT")
-    && any(names, n => n == "HTML5_KVM")
-    && string_contains(s: megarac_ui_features_row_text(names: ["A_B", "C"]), pattern: "data megarac_ui_features_0_32: List<NonEmptyStr> = [\n  \"A_B\",\n  \"C\",\n]")
-}
-
-// THE STORED VALUE AND ITS FIRMWARE KEY: the vendor's JSON shape -- the same value JSON.stringify
-// writes, in the canonical emitter's spacing, which the viewer's indexOf reads and any JSON reader are
-// indifferent to -- and a list only for the 0.32 build.
-test fn the_stored_value_is_the_vendor_shape_and_only_0_32_has_one() -> Bool {
-  megarac_ui_features_json(names: ["A_B" as NonEmptyStr, "C" as NonEmptyStr]) == "[\{\"feature\": \"A_B\"}, \{\"feature\": \"C\"}]"
-    && (match megarac_ui_features(firmware: megarac_firmware_0_32) { Present { value: l } => count(l) == count(megarac_ui_features_0_32)  Absent => false })
-    && (match megarac_ui_features(firmware: bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: "0.33")) { Absent => true  Present { value: _ } => false })
-}
-
-// THE ROW IS AN OBSERVATION RECEIPT, NOT A CLAIMED DERIVATION (review 73613): it names the build, the
-// pinned bundle digest and the producing run, and its standing is TranscribedUncited with the
-// re-derivation route as its read obligation -- the emitter, which refuses any other digest.
-test fn the_feature_list_is_a_receipt_with_its_read_obligation() -> Bool {
-  let r = megarac_ui_features_0_32_receipt
-  (r.bundle_sha256 as String) == (megarac_source_min_js_sha256_2026_09_27 as String)
-    && (r.producing_run as String) == "36787375313"
-    && count(r.names) == count(megarac_ui_features_0_32)
-    && (match r.standing {
-      TranscribedUncited { read_obligation: o } => string_contains(s: o as String, pattern: "megarac_ui_bundle_rows_emit") && string_contains(s: o as String, pattern: "mtcollins1_ui_bundle_observe")
-      _ => false
-    })
-}
-
-// ─── THE RMEDIA STOP-REASON TABLE ───────────────────────────────────────────────────────────────
-// The dictionaries and the range check as source.min.js 0.32 spells them (run 36787375313's bytes),
-// abbreviated to three reasons. The lmedia dictionary comes first and carries the same keys with
-// other names, so a parse that is not held to the rmedia dictionary reads the wrong table.
-fn rmedia_fragment(bound: String, third: String) -> String {
-  join([
-    "lmedia:\{home:\"Home\",halted:\"Stopped\",status_0:\"~\",status_1:\" - LOCAL ONE\",status_2:\" - LOCAL TWO\"},",
-    "rmedia:\{home:\"Home\",image_redirection:\"Image Redirection\",halted:\"Stopped\",started:\"Started\",status_0:\"~\",status_1:\" - Connection Accepted\",status_2:\" - Connection Denied\",", third, "status_100:\" Starting..\",session_index:\"Connected Server Session Index\"},",
-    "changeInSingleImages:function()\{return 0==r&&l>=1&&", bound, ">=l?(t.$(\".redirection_status\").html(a.t(\"rmedia:halted\")+a.t(\"rmedia:status_\"+l))):0}",
-  ], "")
-}
-
-data rmedia_three: String = rmedia_fragment(bound: "3", third: "status_3:\" - Login Failed\",")
-
-test fn the_rmedia_dictionary_yields_its_stop_reasons_and_nothing_else() -> Bool {
-  (match megarac_rmedia_status_entries_of_bundle(text: rmedia_three) {
-    Present { value: rows } => map(rows, r => r.code) == [1, 2, 3] && map(rows, r => r.name as String) == ["Connection Accepted", "Connection Denied", "Login Failed"]
-    Absent => false
-  })
-    && (match megarac_rmedia_status_bound_of_bundle(text: rmedia_three) { Present { value: b } => b == 3  Absent => false })
-    && (match megarac_rmedia_status_entries_of_bundle(text: "lmedia:\{home:\"Home\",status_1:\" - LOCAL ONE\"}") { Absent => true  Present { value: _ } => false })
-}
-
-test fn the_table_is_read_only_from_the_pinned_build() -> Bool {
-  (match megarac_rmedia_status_table_reading(observed_sha256: megarac_source_min_js_sha256_2026_09_27 as String, text: rmedia_three) { MegaRacRmediaStatusTableRead { rows: r, source_sha256: _ } => count(r) == 3  _ => false })
-    && (match megarac_rmedia_status_table_reading(observed_sha256: "0000000000000000000000000000000000000000000000000000000000000000", text: rmedia_three) { MegaRacRmediaStatusTableUnread { cause: c } => string_contains(s: c as String, pattern: "not the pinned")  _ => false })
-}
-
-// THE TWO READINGS MUST AGREE: a dictionary longer or shorter than the view's range check, or codes
-// that are not 1..N in order, is a build this parse does not understand.
-test fn a_dictionary_that_disagrees_with_the_range_check_is_refused() -> Bool {
-  let pinned = megarac_source_min_js_sha256_2026_09_27 as String
-  (match megarac_rmedia_status_table_reading(observed_sha256: pinned, text: rmedia_fragment(bound: "17", third: "status_3:\" - Login Failed\",")) { MegaRacRmediaStatusTableUnread { cause: c } => string_contains(s: c as String, pattern: "range check reads 1..17")  _ => false })
-    && (match megarac_rmedia_status_table_reading(observed_sha256: pinned, text: rmedia_fragment(bound: "3", third: "status_4:\" - MAX Session Reached\",")) { MegaRacRmediaStatusTableUnread { cause: c } => string_contains(s: c as String, pattern: "not codes 1..N")  _ => false })
-    && (match megarac_rmedia_status_table_reading(observed_sha256: pinned, text: "rmedia:\{home:\"Home\",status_1:\" - A\"}") { MegaRacRmediaStatusTableUnread { cause: c } => string_contains(s: c as String, pattern: "range check was not found")  _ => false })
-}
-
-// THE 0.32 RECEIPT IS THAT EMISSION, CITING THE FEATURE RECEIPT'S DIGEST AND RUN: seventeen reasons, codes 1..17, the vendor's names, keyed to
-// the 0.32 build only.
-test fn the_committed_table_is_the_vendors_and_keyed_to_0_32() -> Bool {
-  count(megarac_rmedia_status_0_32) == 17
-    && megarac_rmedia_status_0_32_receipt.bundle_sha256 == megarac_ui_features_0_32_receipt.bundle_sha256
-    && megarac_rmedia_status_0_32_receipt.producing_run == megarac_ui_features_0_32_receipt.producing_run
-    && map(megarac_rmedia_status_0_32, r => r.code) == [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17]
-    && (match megarac_rmedia_status_of_wire(firmware: megarac_firmware_0_32, wire: 11) { RmediaStatusNamed { status: st } => (st.name as String) == "Mount Error"  _ => false })
-    && (match megarac_rmedia_status_of_wire(firmware: megarac_firmware_0_32, wire: 18) { RmediaStatusOutsideTable { firmware: _, wire: w } => w == 18  _ => false })
-    && (match megarac_rmedia_status_of_wire(firmware: bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: "0.33"), wire: 11) { RmediaStatusTableUnread { firmware: _, wire: w } => w == 11  _ => false })
-    && string_contains(s: megarac_rmedia_status_row_text(rows: [MegaRacRmediaStatus { code: 1, name: "A b" }]), pattern: "data megarac_rmedia_status_0_32: List<MegaRacRmediaStatus> = [\n  MegaRacRmediaStatus \{ code: 1, name: \"A b\" },\n]")
-}
diff --git a/dag/test/claim/machine_intake/mtcollins1_boot_acceptance_matrix_test.dag b/dag/test/claim/machine_intake/mtcollins1_boot_acceptance_matrix_test.dag
index 574de21fb10..2f4b558af6b 100644
--- a/dag/test/claim/machine_intake/mtcollins1_boot_acceptance_matrix_test.dag
+++ b/dag/test/claim/machine_intake/mtcollins1_boot_acceptance_matrix_test.dag
@@ -2,6 +2,7 @@ module test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test
 
 import gunbc.build_cache_instance { ProcessIdentity }
 import std.types { Bool, Int, List, NonEmptyStr, String }
+import std.process { exit_failure }
 import std.algebra { list_snoc_item }
 import std.measure { Second, second }
 import std.materialization_ladder { Frame, SharedStateFrame }
@@ -22,7 +23,7 @@ import gunbc.megarac_media_model { MegaRacMediaWorld, MegaRacShare, MegaRacImage
 import gunbc.machine_intake_mtcollins1_boot_dry_realization {
   MtCollins1BootWorld, ModeledSshAgent, ModeledWorker, ModeledHostConsole, TimedConsoleLine,
   mtcollins1_boot_dry_realization, with_media, with_bmc, with_notice_watcher, with_fs,
-  worker_process_started, worker_process_killed, proc_stat_path, proc_stat_line, worker_process, healthy_kvm_viewer,
+  worker_process_started, worker_process_killed, proc_stat_path, proc_stat_line, worker_process,
 }
 import v2.std.operation_realization {
   OperationRealization, OperationBinding, OperationCall, OperationStep, OperationObserved, OperationWorkerKilled,
@@ -31,15 +32,16 @@ import v2.std.operation_realization {
 import gunbc.machine_intake_mtcollins1_boot_run {
   MtCollins1BootAttempt, mtcollins1_boot_on_srv1_resolving_toolchain, mtcollins1_boot_exit_reason,
   ActuationNotPoweredOn, ActuationPoweredOn, ActuationCensusEnded,
+  SolSupervision, SolHeldAt, SolLostAt, SolHandoffAdmission, SolHandoffAdmitted, SolHandoffRefused, sol_handoff_admission,
 }
 import gunbc.machine_intake_mtcollins1_census_image { mtcollins1_boot_medium, mtcollins1_census_image, Mtcollins1CensusImageDerived }
 import gunbc.machine_intake_mtcollins1_census_medium_readback { mtcollins1_census_record_path, mtcollins1_census_medium_served_path }
 import gunbc.durable_exclusive_hold_file_store { file_hold_acquire }
 import gunbc.runner_browser_toolchain {
   RunnerBrowserToolchainResolution, RunnerBrowserToolchainLocation, RunnerBrowserToolchainStanding,
-  BrowserToolchainReady, BrowserToolchainNotReady, BrowserToolchainUnresolved,
+  BrowserToolchainReady, BrowserToolchainUnresolved,
   BrowserToolchainHostAdmitted, BrowserToolchainHostRefused, runner_browser_toolchain_host_admission,
-  TreeAdmission, TreeAdmitted, TreeAbsent, VersionMatches, HostLibrariesResolved, BrowserLaunchRendered,
+  TreeAdmission, TreeAdmitted, VersionMatches, HostLibrariesResolved, BrowserLaunchRendered,
   runner_browser_toolchain_node, runner_browser_toolchain_automation, browser_toolchain_probe_title, browser_toolchain_probe_width_px,
 }
 import gunbc.managed_host_unit_hold { boot_run_owner, unit_hold_store_root }
@@ -78,7 +80,6 @@ fn matrix_grant(service: String, verb: std.effect_grant.Verb) -> Grant {
 data matrix_services: List<String> = [
   "diagnostic.ipmi.Tool", "megarac.Media", "Filesystem", "shell.Env", "sleep.Delay",
   "gunbc.machine_intake.sol_hold", "shell.Exec", "ssh.Session", "Clock", "linux.Procfs", "shell.Move", "os.Hostname", "shell.Mkdir", "shell.Path",
-  "gunbc.owned_process.launch", "sha256sum.Sha256",
 ]
 
 fn matrix_frame(world: MtCollins1BootWorld) -> WitnessEvaluationFrame<MtCollins1BootWorld> {
@@ -101,11 +102,7 @@ fn matrix_frame_over(realization: OperationRealization<MtCollins1BootWorld>) ->
 // tree against its pin, the host libraries, the versions and a launch probe -- which is a different
 // subject with its own witnesses. The matrix supplies each resolution arm the boot can meet, built from
 // the production location and probe values, and the inner entry calls it where the observer starts.
-// PAIRING (DESIGN s3): the real resolution is executed by
-// test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness
-// a_held_observer_is_admitted_and_its_triggered_still_is_hash_bound, whose rig calls
-// runner_browser_toolchain_here_wet on the floor pool and returns false on every arm but Ready, so
-// deleting that integration turns it red; it also launches the real observer over the resolved location.
+// The real resolution is a different subject, witnessed where the wet entry runs it.
 fn srv1_toolchain_location() -> RunnerBrowserToolchainLocation? {
   match runner_browser_toolchain_host_admission(host: "srv1" as NonEmptyStr) {
     BrowserToolchainHostAdmitted { deploy: _, location: loc } => Present { value: loc }
@@ -133,17 +130,6 @@ fn ready_toolchain() -> RunnerBrowserToolchainResolution {
   }
 }
 
-fn not_ready_toolchain() -> RunnerBrowserToolchainResolution {
-  match srv1_toolchain_location() {
-    Present { value: loc } => BrowserToolchainNotReady { standing: toolchain_standing(loc: loc, tree: TreeAbsent { tree: loc.root }) }
-    Absent => BrowserToolchainUnresolved { cause: "matrix: srv1 is not admitted to the browser-toolchain pool" }
-  }
-}
-
-fn unresolved_toolchain() -> RunnerBrowserToolchainResolution {
-  BrowserToolchainUnresolved { cause: "runner_browser_toolchain: hostname -s returned empty output" }
-}
-
 fn boot_with_toolchain(toolchain: RunnerBrowserToolchainResolution) -> MtCollins1BootAttempt {
   mtcollins1_boot_on_srv1_resolving_toolchain(resolve_toolchain: fn() { toolchain })
 }
@@ -217,7 +203,6 @@ fn world_with_console(lines: List<TimedConsoleLine>) -> MtCollins1BootWorld {
     worker: ModeledWorker { next_pid: 4000, processes: [], uptime_at_origin: 86400 },
     console: ModeledHostConsole { lines: lines, emitted: 0, boot: none },
     media: healthy_media(),
-    screen: healthy_kvm_viewer(),
   })
 }
 
@@ -337,41 +322,47 @@ test fn a_healthy_census_completes_and_releases_its_collector() -> Bool {
   }
 }
 
-// THE RUNNER'S BROWSER TOOLCHAIN IS NOT READY, OR CANNOT BE RESOLVED (operator-accepted ruling A: the
-// matrix supplies the resolution). The observer is REQUIRED for the handoff, so neither arm starts a
-// viewer with a toolchain it could not vouch for: no observer directory is made, no process is launched,
-// and the handoff refuses with the toolchain's own standing as its cause -- before any boot override or
-// power action.
-fn run_attempt_with_toolchain(world: MtCollins1BootWorld, toolchain: RunnerBrowserToolchainResolution) -> WitnessEvaluation<MtCollins1BootAttempt, MtCollins1BootWorld> {
-  evaluate_in_witness_frame(frame: matrix_frame(world: world), subject: fn(_scope) { boot_with_toolchain(toolchain: toolchain) })
+// THE HANDOFF REQUIRES A SOL OBSERVATION OF THIS RUN (rung drop handoff_observer_is_sol_not_kvm_viewer).
+// With no public KVM client the required observer is the SOL collector: a SOL session held elsewhere
+// leaves no SOL observation, and the attempt refuses before any media write or power action. The
+// CONTROL of the drop is the typed admission itself: SolHeldAt admits, SolLostAt refuses, and a mutant
+// that opens the gate (admits every supervision) is distinguished from the real one by the lost arm.
+fn gate_admits(a: SolHandoffAdmission) -> Bool {
+  match a {
+    SolHandoffAdmitted { held_at: _ } => true
+    SolHandoffRefused { cause: _ } => false
+  }
 }
 
-fn no_observer_and_no_power_action(route: List<DispatchRecord>) -> Bool {
-  count_named(route: route, name: "shell.Mkdir.Parents") == 0
-    && count_named(route: route, name: "gunbc.owned_process.launch.LaunchOwned") == 0
-    && reached_no_power_action(route: route)
+fn open_gate_mutant(sol: SolSupervision) -> SolHandoffAdmission {
+  SolHandoffAdmitted { held_at: "mutant" as NonEmptyStr }
 }
 
-test fn a_toolchain_that_is_not_ready_starts_no_observer_and_no_power_action() -> Bool {
-  match run_attempt_with_toolchain(world: world_with_console(lines: []), toolchain: not_ready_toolchain()) {
-    WitnessReturned { value, route } =>
-      string_contains(s: outcome_reason(a: value), pattern: "the required KVM observer was not established")
-        && string_contains(s: outcome_reason(a: value), pattern: "the runner browser toolchain is not ready")
-        && no_observer_and_no_power_action(route: route)
-    _ => false
-  }
+fn lost_sol() -> SolSupervision {
+  SolLostAt { outcome: exit_failure(reason: "no SOL observation holds") }
 }
 
-test fn an_unresolved_toolchain_starts_no_observer_and_no_power_action() -> Bool {
-  match run_attempt_with_toolchain(world: world_with_console(lines: []), toolchain: unresolved_toolchain()) {
+test fn the_handoff_refuses_when_no_sol_observation_holds() -> Bool {
+  let w = world_with_console(lines: [])
+  match run_attempt(world: with_bmc(w: w, bmc: bmc_with_sol_session(world: w.bmc, open: true))) {
     WitnessReturned { value, route } =>
-      string_contains(s: outcome_reason(a: value), pattern: "the required KVM observer was not established")
-        && string_contains(s: outcome_reason(a: value), pattern: "the runner browser toolchain is unresolved")
-        && no_observer_and_no_power_action(route: route)
+      string_contains(s: outcome_reason(a: value), pattern: "SOL collector not established")
+        && count_named(route: route, name: "megarac.Media.StartMedia") == 0
+        && reached_no_power_action(route: route)
     _ => false
   }
 }
 
+test fn the_sol_handoff_admission_refuses_a_lost_observation_and_admits_a_held_one() -> Bool {
+  let held = SolHeldAt { at: "pid 1" as NonEmptyStr }
+  gate_admits(a: sol_handoff_admission(sol: held))
+    && !gate_admits(a: sol_handoff_admission(sol: lost_sol()))
+}
+
+test fn a_gate_that_opens_for_a_lost_observation_is_distinguished_from_the_real_gate() -> Bool {
+  gate_admits(a: open_gate_mutant(sol: lost_sol())) && !gate_admits(a: sol_handoff_admission(sol: lost_sol()))
+}
+
 // THE SAME UNIT HELD BY ANOTHER RUN. Before this attempt starts, a different run's boot holds the
 // unit (acquired through the production file_hold_acquire, into the same store). This attempt is
 // refused at the hold with the controller untouched: no controller write of any kind appears in its
@@ -637,7 +628,7 @@ fn as_another_run(w: MtCollins1BootWorld, run_id: String) -> MtCollins1BootWorld
 fn as_another_run_in(w: MtCollins1BootWorld, run_id: String, pid_namespace: String) -> MtCollins1BootWorld {
   let env = map(w.environment, v => if v.name == "GITHUB_RUN_ID" { ModeledVariable { name: v.name, value: run_id } } else { v })
   let fs = worker_process_started(fs: w.fs, boot_id: worker_boot_id, pid_namespace: pid_namespace, pid: first_worker_pid + 1, start_ticks: first_worker_start + 9000)
-  MtCollins1BootWorld { bmc: w.bmc, fs: fs, environment: env, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: w.media, screen: w.screen }
+  MtCollins1BootWorld { bmc: w.bmc, fs: fs, environment: env, agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: w.media }
 }
 
 // THE NEXT ATTEMPT RECOVERS THE DEAD RUN'S HOLD (finding 2, repaired in #12555). The interrupted run
@@ -718,7 +709,7 @@ fn with_clock_jump(w: MtCollins1BootWorld, at: Second, by: Int) -> MtCollins1Boo
   MtCollins1BootWorld {
     bmc: w.bmc, fs: w.fs, environment: w.environment, agent: w.agent, remote_hosts: w.remote_hosts,
     clock: ModeledWallClock { unix_at_origin: w.clock.unix_at_origin, step: w.clock.step, jumps: list_snoc_item(xs: w.clock.jumps, item: ModeledClockStep { at: at, by: std.measure.second_displacement(count: by) }) },
-    worker: w.worker, console: w.console, media: w.media, screen: w.screen,
+    worker: w.worker, console: w.console, media: w.media,
   }
 }
 
@@ -747,7 +738,7 @@ test fn a_wall_clock_jumping_forward_during_readiness_closes_the_window() -> Boo
   match run_attempt(world: with_clock_jump(w: world_with_console(lines: []), at: second(count: 20), by: 600)) {
     WitnessReturned { value, route } =>
       string_contains(s: outcome_reason(a: value), pattern: "did not reach Started with a bound session")
-        && string_contains(s: outcome_reason(a: value), pattern: "(2 looks,")
+        && string_contains(s: outcome_reason(a: value), pattern: "(3 looks,")
         && reached_no_power_action(route: route)
     _ => false
   }
@@ -756,10 +747,7 @@ test fn a_wall_clock_jumping_forward_during_readiness_closes_the_window() -> Boo
 // ─── CD ERROR CODE ────────────────────────────────────────────────────────────────────────────────
 // cd_error_code on the general route: 16 is the value the Mt. Collins MegaRAC answered on 2026-09-27
 // with nothing presented (test.claim.machine_intake.megarac_media_convergence_witness_test
-// mtcollins1_media_general_2026_09_27). Its meaning is the vendor's: extdeps.bmc.megarac
-// megarac_rmedia_status_0_32 names it "Device Ejected", and the vendor UI reads the code only while the
-// row is stopped, so beside a Started row it is a latched last-stop reason, recorded and never
-// withheld on. Whether a stop clears it is not observed, so the stale-image cases run both arms of the
+// mtcollins1_media_general_2026_09_27). It is an observed number with no established cause, recorded beside a Started row and never withheld on. Whether a stop clears it is not observed, so the stale-image cases run both arms of the
 // model's parameter.
 fn media_errored(code: Int, clears: Bool, after_ready: Int?, cd: MegaRacCdRow) -> MegaRacMediaWorld {
   MegaRacMediaWorld {
@@ -791,79 +779,51 @@ fn presenting(image_name: String) -> MegaRacCdRow {
   MegaRacCdRow { image_name: image_name, redirection_status: 1, media_index: 0, session_index: 0, ready_at: none }
 }
 
-// CODE 16 WITH NOTHING PRESENTED AND THE HOST OFF -- the 2026-09-27 state, and boot run 36721915217's.
-// 16 is a named stop reason, so the attach proceeds with no stop; the presentation reaches Started with
-// 16 still read, which the vendor does not consult beside a Started row, so it is recorded and the
-// attempt proceeds to the boot.
-test fn cd_error_16_with_nothing_presented_attaches_and_boots_with_the_code_recorded() -> Bool {
-  match run_attempt(world: media_varied(media: media_errored(code: 16, clears: true, after_ready: no_error_after_ready(), cd: megarac_cleared_cd()))) {
-    WitnessReturned { value, route } =>
-      string_contains(s: outcome_reason(a: value), pattern: "deadline reached without a host-capture terminal")
-        && count_named(route: route, name: "megarac.Media.StopMedia") == 0
-        && first_ordinal(route: route, name: "megarac.Media.StartMedia") < first_ordinal(route: route, name: "diagnostic.ipmi.Tool.ChassisPowerControl")
-        && controller_writes_are_under_the_hold(route: route)
-    _ => false
-  }
-}
-
-// A CODE OUTSIDE THE VENDOR'S TABLE WITH THE HOST ALREADY ON. 99 names nothing in rmedia:status_1..17, so
-// it is a knowledge refusal; the fresh-presentation experiment that could settle it would stop the
-// medium the host may be running from, so it is not admitted and nothing is written at all.
-test fn an_uncatalogued_cd_error_with_the_host_on_writes_nothing() -> Bool {
-  let w = media_varied(media: media_errored(code: 99, clears: true, after_ready: no_error_after_ready(), cd: megarac_cleared_cd()))
-  match run_attempt(world: with_bmc(w: w, bmc: bmc_with_power(world: w.bmc, power: BmcPowerOn))) {
+// THE START IS ACCEPTED AND THE ROW FALLS BACK TO A STOPPED STATE with code 16 beside it. Nothing is
+// presented, so there is nothing to boot from: the attempt refuses as a readiness timeout that carries
+// the raw code, with no handoff, and no cause is attributed to the code.
+test fn a_start_that_stops_with_code_16_refuses_as_a_timeout_carrying_the_raw_code() -> Bool {
+  match run_attempt(world: media_varied(media: media_stopping(code: 16))) {
     WitnessReturned { value, route } =>
-      string_contains(s: outcome_reason(a: value), pattern: "the host is powered on; stopping the medium would withdraw what it may be running from")
-        && count(filter(route, r => is_controller_write(r: r) && r.invocation.at.service == "megarac.Media")) == 0
+      string_contains(s: outcome_reason(a: value), pattern: "did not reach Started with a bound session")
+        && string_contains(s: outcome_reason(a: value), pattern: "at refusal 16 (observed; no meaning established)")
         && reached_no_power_action(route: route)
     _ => false
   }
 }
 
-// A CODE THAT APPEARS WITH READINESS. The presentation reads Started while the general route reports
-// 16 at readiness: a Started row is ready whatever the code says, so the attempt proceeds to the boot.
-test fn cd_error_appearing_with_readiness_is_recorded_and_booted() -> Bool {
-  match run_attempt(world: media_varied(media: media_errored(code: 0, clears: true, after_ready: Present { value: 16 }, cd: megarac_cleared_cd()))) {
+// A STALE IMAGE OF THIS LANE IS PRESENTED WITH CODE 16 AND THE HOST OFF, AND THE STOP CLEARS THE CODE.
+// The attempt stops the stale image, attaches the desired one, and proceeds to the boot: stop, then
+// start, then the override, then power.
+test fn a_stale_lane_image_with_a_code_the_stop_clears_is_replaced_and_booted() -> Bool {
+  match run_attempt(world: media_varied(media: media_errored(code: 16, clears: true, after_ready: no_error_after_ready(), cd: presenting(image_name: stale_lane_image)))) {
     WitnessReturned { value, route } =>
       string_contains(s: outcome_reason(a: value), pattern: "deadline reached without a host-capture terminal")
+        && first_ordinal(route: route, name: "megarac.Media.StopMedia") < first_ordinal(route: route, name: "megarac.Media.StartMedia")
         && first_ordinal(route: route, name: "megarac.Media.StartMedia") < first_ordinal(route: route, name: "diagnostic.ipmi.Tool.ChassisPowerControl")
         && controller_writes_are_under_the_hold(route: route)
     _ => false
   }
 }
 
-// THE START IS ACCEPTED AND THE ROW FALLS BACK TO "Stopped - Mount Error". The attempt refuses by the
-// vendor's name, as a presentation failure, with no handoff.
-test fn a_start_that_stops_with_mount_error_refuses_by_name() -> Bool {
-  match run_attempt(world: media_varied(media: media_stopping(code: 11))) {
-    WitnessReturned { value, route } =>
-      string_contains(s: outcome_reason(a: value), pattern: "is Stopped - Mount Error (cd_error_code 11; a presentation failure")
-        && count_named(route: route, name: "megarac.Media.StartMedia") == 1
-        && reached_no_power_action(route: route)
-    _ => false
-  }
-}
-
-// THE START IS ACCEPTED AND THE ROW FALLS BACK TO "Stopped - Device Ejected". 16 is a no-fault stop --
-// the consumer let the medium go -- but nothing is presented, so there is nothing to boot from: the
-// attempt refuses by name, classed no-fault, with no handoff.
-test fn a_start_that_stops_with_device_ejected_refuses_by_name_as_no_fault() -> Bool {
-  match run_attempt(world: media_varied(media: media_stopping(code: 16))) {
+// CODE 16 WITH NOTHING PRESENTED. Wire 16 on firmware 0.32 is the one nonzero code the attach policy
+// admits (executed boot run 36721915217), so the attempt attaches, boots, and records the code.
+test fn cd_error_16_with_nothing_presented_attaches_and_boots_with_the_code_recorded() -> Bool {
+  match run_attempt(world: media_varied(media: media_errored(code: 16, clears: true, after_ready: no_error_after_ready(), cd: megarac_cleared_cd()))) {
     WitnessReturned { value, route } =>
-      string_contains(s: outcome_reason(a: value), pattern: "is Stopped - Device Ejected (cd_error_code 16; no fault")
-        && reached_no_power_action(route: route)
+      string_contains(s: outcome_reason(a: value), pattern: "deadline reached without a host-capture terminal")
+        && count_named(route: route, name: "megarac.Media.StopMedia") == 0
+        && first_ordinal(route: route, name: "megarac.Media.StartMedia") < first_ordinal(route: route, name: "diagnostic.ipmi.Tool.ChassisPowerControl")
+        && controller_writes_are_under_the_hold(route: route)
     _ => false
   }
 }
 
-// A STALE IMAGE OF THIS LANE IS PRESENTED WITH CODE 16 AND THE HOST OFF, AND THE STOP CLEARS THE CODE.
-// The attempt stops the stale image, attaches the desired one, and proceeds to the boot: stop, then
-// start, then the override, then power.
-test fn a_stale_lane_image_with_a_code_the_stop_clears_is_replaced_and_booted() -> Bool {
-  match run_attempt(world: media_varied(media: media_errored(code: 16, clears: true, after_ready: no_error_after_ready(), cd: presenting(image_name: stale_lane_image)))) {
+// A CODE THAT APPEARS WITH READINESS: a Started row is ready whatever the code says.
+test fn cd_error_appearing_with_readiness_is_recorded_and_booted() -> Bool {
+  match run_attempt(world: media_varied(media: media_errored(code: 0, clears: true, after_ready: Present { value: 16 }, cd: megarac_cleared_cd()))) {
     WitnessReturned { value, route } =>
       string_contains(s: outcome_reason(a: value), pattern: "deadline reached without a host-capture terminal")
-        && first_ordinal(route: route, name: "megarac.Media.StopMedia") < first_ordinal(route: route, name: "megarac.Media.StartMedia")
         && first_ordinal(route: route, name: "megarac.Media.StartMedia") < first_ordinal(route: route, name: "diagnostic.ipmi.Tool.ChassisPowerControl")
         && controller_writes_are_under_the_hold(route: route)
     _ => false
@@ -871,7 +831,7 @@ test fn a_stale_lane_image_with_a_code_the_stop_clears_is_replaced_and_booted()
 }
 
 // THE SAME STALE IMAGE, BUT THE STOP DOES NOT CLEAR THE CODE. The replacement reaches Started with the
-// code still 16, a latched reason beside a Started row, and the attempt proceeds to the boot.
+// code still 16, an observed code beside a Started row, and the attempt proceeds to the boot.
 test fn a_stale_lane_image_with_a_code_the_stop_does_not_clear_is_replaced_and_booted() -> Bool {
   match run_attempt(world: media_varied(media: media_errored(code: 16, clears: false, after_ready: no_error_after_ready(), cd: presenting(image_name: stale_lane_image)))) {
     WitnessReturned { value, route } =>
@@ -903,7 +863,7 @@ fn with_named_receipt(w: MtCollins1BootWorld, path: String, nonce: String) -> Mt
   MtCollins1BootWorld {
     bmc: w.bmc, fs: w.fs,
     environment: concat(w.environment, [ModeledVariable { name: "GUNBC_BOOT_ATTEMPT_RECEIPT", value: path }, ModeledVariable { name: "GUNBC_BOOT_ATTEMPT_NONCE", value: nonce }]),
-    agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: w.media, screen: w.screen,
+    agent: w.agent, remote_hosts: w.remote_hosts, clock: w.clock, worker: w.worker, console: w.console, media: w.media,
   }
 }
 
diff --git a/dag/test/claim/machine_intake/mtcollins1_boot_run_witness_test.dag b/dag/test/claim/machine_intake/mtcollins1_boot_run_witness_test.dag
index e696cc26c35..f08e6147151 100644
--- a/dag/test/claim/machine_intake/mtcollins1_boot_run_witness_test.dag
+++ b/dag/test/claim/machine_intake/mtcollins1_boot_run_witness_test.dag
@@ -65,7 +65,7 @@ import std.temporal_effect {
   held_lease_observed_verdict,
 }
 import std.upsert_decision { Converged, Absent, Drifted, Inaccessible }
-import gunbc.boot_medium { BootMedium, BootMediumNoTerminal, BootMediumVolumeLabel, stock_installer_boot_medium }
+import gunbc.boot_medium { BootMedium, BootMediumNoTerminal, BootMediumVolumeLabel, BootMediumRunnerHostUp, stock_installer_boot_medium }
 import extdeps.bmc.ipmi_boot_selection { IpmiBootCdrom, aarch64_uefi_once_boot_selection }
 import gunbc.machine_intake_mtcollins1_census_image { mtcollins1_census_boot_medium }
 import gunbc.managed_host_boot { AdmittedBootSubject, BootSubjectAdmitted, BootSubjectRefused, boot_subject_admission_for }
@@ -608,6 +608,7 @@ test fn the_census_medium_passes_the_gate_and_binds_the_verdict_to_its_label() -
       match medium.terminal {
         BootMediumNoTerminal { reason: _ } => false
         BootMediumVolumeLabel { label: label } => (label as String) == "GUNBC_MTC1_CENSUS_2404_3"
+        BootMediumRunnerHostUp { label: _ } => false
       }
   }
 }
@@ -717,8 +718,8 @@ test fn another_expected_revision_cannot_change_a_byte_the_boot_job_executes() -
   fleet_converge_event_sha_checkout_ref_expr == "${{ github.sha }}"
     && !string_contains(s: inputs, pattern: "expected_revision")
     && string_contains(s: inputs, pattern: "${{ github.sha }}")
-    && starts_with(s: fleet_converge_checkout_ref_expr, prefix: "${{ (github.event.inputs.mode == 'mtcollins1_boot' ")
-    && string_contains(s: fleet_converge_checkout_ref_expr, pattern: "') && github.sha || github.event.inputs.expected_revision || github.sha }}")
+    && fleet_converge_checkout_ref_expr == "${{ github.sha }}"
+    && !string_contains(s: fleet_converge_checkout_ref_expr, pattern: "expected_revision")
 }
 
 fn runner_labels(r: RunnerSpec) -> List<String> {
diff --git a/dag/test/claim/machine_intake/mtcollins1_census_image_witness_test.dag b/dag/test/claim/machine_intake/mtcollins1_census_image_witness_test.dag
index 9381257ba17..4571e227661 100644
--- a/dag/test/claim/machine_intake/mtcollins1_census_image_witness_test.dag
+++ b/dag/test/claim/machine_intake/mtcollins1_census_image_witness_test.dag
@@ -353,6 +353,7 @@ fn census_input_varying(
     nocloud_dir_on_iso: base.nocloud_dir_on_iso,
     user_data_body: base.user_data_body,
     seed_files: [NoCloudSeedFile { name: mtcollins1_census_program_file, content: program }],
+    seed_artifacts: [],
     grub_kernel_cmdline: grub_kernel_cmdline,
     volume_id: volume_id,
     pinned_dates: pinned_dates,
diff --git a/dag/test/claim/machine_intake/mtcollins1_kvm_observer_observe_witness_test.dag b/dag/test/claim/machine_intake/mtcollins1_kvm_observer_observe_witness_test.dag
index 099df7a96fe..4f01a2bb035 100644
--- a/dag/test/claim/machine_intake/mtcollins1_kvm_observer_observe_witness_test.dag
+++ b/dag/test/claim/machine_intake/mtcollins1_kvm_observer_observe_witness_test.dag
@@ -23,10 +23,8 @@ import gunbc.machine_intake_mtcollins1_kvm_observer_observe {
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
 // THE VERDICT IS READ FROM THE RECORD megarac_kvm_observer_finish RETURNS, so its inputs are SUPPLIED
-// records (DESIGN §3: a witness discriminates at one interface). The real producer runs twice elsewhere:
-// against the loopback controller in test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness,
-// which holds the same finish, stop and release to what the controller saw, and against the real BMC
-// in the fleet-converge mode this module's subject belongs to.
+// records (DESIGN §3: a witness discriminates at one interface). No public KVM client drives the
+// observer (rung drop handoff_observer_is_sol_not_kvm_viewer), so its start is a typed refusal.
 
 fn at() -> KvmInstant {
   KvmInstant { since_epoch: millisecond(count: 1790000000000), iso: "2026-09-30T20:00:00.000Z" }
diff --git a/dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag b/dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag
deleted file mode 100644
index 18f9de267dc..00000000000
--- a/dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag
+++ /dev/null
@@ -1,415 +0,0 @@
-module test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness
-
-import std.types { Bool, FilePath, Int, List, NonEmptyStr, String }
-import std.algebra { trim }
-import std.nat { Nat }
-import std.measure { second, millisecond_count }
-import std.optional { Present, Absent }
-import extdeps.shell
-import extdeps.filesystem.filesystem_io { Filesystem }
-import extdeps.tools.sleep { sleep_delay_seconds_second_carrier_projection }
-import gunbc.runner_browser_toolchain {
-  RunnerBrowserToolchainLocation, RunnerBrowserToolchainResolution, runner_browser_toolchain_here_wet, runner_browser_toolchain_standing_text,
-  BrowserToolchainReady, BrowserToolchainNotReady, BrowserToolchainUnresolved,
-}
-import gunbc.bmc_model { BmcWorld, BmcWebWorld, BmcWebAccount, BmcPowerOn, BmcScheduledEvent, BmcKvmStreamClosed, BmcKvmIdle, bmc_world, bmc_with_web, bmc_with_pending }
-import gunbc.bmc_megarac_web_adapter { MegaRacWebLogin, megarac_web_transition_table, megarac_web_exploration_depth }
-import gunbc.bmc_megarac_web_transport {
-  MegaRacWebTransportStart, TransportServing, TransportNotServing,
-  TransportPidUnpublished, TransportExitedBeforeReady, TransportReadinessForeign,
-  megarac_web_transport_serve, megarac_web_transport_stop, megarac_web_transport_readiness,
-}
-import gunbc.owned_process {
-  OwnedRelease, OwnedReleased, OwnedAlreadyGone, OwnedReleaseNotOwned, OwnedForeign, OwnedRunning, OwnedGone,
-  owned_process_release, owned_process_standing, owned_process_launch_script,
-  owned_process_exit_prefix, owned_process_unpublished_line, owned_process_unpublished_survived_line, owned_process_unpublished_unobservable_line,
-}
-import gunbc.machine_intake_megarac_kvm_still {
-  KvmObserverStart, KvmObserverStarted, KvmObserverNotStarted, KvmObserverRecord,
-  KvmObserverEstablished, KvmObserverRefused, KvmSeatBusy, KvmObserverLost,
-  KvmJournalConnectionLost, KvmJournalAcquisitionFailed, KvmNotConnected, KvmCanvasUnreadable,
-  KvmStillHashed, KvmTeardownRecorded, KvmHandoffAdmitted, KvmHandoffRefused,
-  KvmJournalEvent, KvmJournalNavigated, KvmJournalPageError, kvm_journal_events_at,
-  kvm_observer_protocol_launch, kvm_observer_trigger, kvm_handoff_admission, kvm_observer_standing_now, megarac_kvm_observer_finish,
-}
-import gunbc.machine_intake_mtcollins1_boot_run { mtcollins1_boot_screen_boundary_report }
-import extdeps.bmc.megarac { megarac_ui_features_json }
-import v2.std.algebra { any }
-
-// PROCESS-AND-PROTOCOL EVIDENCE, NOT HARDWARE EVIDENCE (eager-owl-205, 2026-09-28). Each control runs
-// the REAL held observer -- the same launcher (through kvm_observer_protocol_launch), triggers, handoff admission and
-// megarac_kvm_observer_finish the boot runs -- in headless Chromium against a loopback controller
-// (gunbc.bmc_megarac_web_transport) that ENFORCES the transition table gunbc.bmc_megarac_web_adapter
-// derives from gunbc.bmc_model against every actual request. It needs gunbc.runner_browser_toolchain
-// ready on the executing runner; without it the observer is not started and every control here is
-// RED, never skipped. The hardware half is the boot itself: its receipt carries the observer's
-// established line and first hash-bound still (REAL ROUTE UNEXECUTED until the first hold-lifted boot).
-
-fn world(other_viewers: Int, close_at: Nat?, canvas_readable: Bool) -> BmcWorld {
-  bmc_with_pending(
-    world: bmc_with_web(world: bmc_world(power: BmcPowerOn), web: BmcWebWorld {
-      account: Present { value: BmcWebAccount { username: "admin", password: "pw", privilege: 4 } },
-      sessions: [], next_session_id: 7, other_kvm_viewers: other_viewers, kvm: BmcKvmIdle {}, canvas_readable: canvas_readable,
-    }),
-    pending: match close_at { Absent => []  Present { value: t } => [BmcScheduledEvent { at: second(count: t), event: BmcKvmStreamClosed {} }] },
-    fired: [],
-  )
-}
-
-// A table the lifecycle controls never reach: their "node" exits or is blocked before it reads it.
-data empty_table: String = "\{\"initial\": \"A\", \"canvas_readable\": true, \"kvm_path\": \"/kvm\", \"rows\": []}"
-
-fn no_close() -> Nat? {
-  none
-}
-
-type Rig {
-  dir: String
-  serving: MegaRacWebTransportStart
-  start: KvmObserverStart
-}
-
-fn scratch_dir() -> String {
-  let made = shell.Mktemp.Dir()
-  if made.success { made.path as String } else { "" }
-}
-
-// WHY THE TOOLCHAIN IS NOT HERE is kept as the toolchain authority states it -- the readback standing
-// for NotReady, the cause for Unresolved -- and carried into the rig's KvmObserverNotStarted reason,
-// never collapsed into a generic "not ready".
-fn toolchain_absence(r: RunnerBrowserToolchainResolution) -> String {
-  match r {
-    BrowserToolchainReady { location: _, standing: _ } => ""
-    BrowserToolchainNotReady { standing: st } => concat("the runner browser toolchain is not ready on this host: ", runner_browser_toolchain_standing_text(s: st))
-    BrowserToolchainUnresolved { cause: c } => concat("the runner browser toolchain is unresolved on this host: ", c)
-  }
-}
-
-fn read_or_empty(path: String) -> String {
-  let x = Filesystem.Read(path: path)
-  if x.success { x.content } else { "" }
-}
-
-// Serve the model's table on loopback, write the credential, and launch the real observer at it.
-fn rig(w: BmcWorld) -> Rig {
-  rig_with(w: w, features_json: loopback_features_json())
-}
-
-// THE FEATURE LIST THE LOOPBACK VIEWER NEEDS: the vendor shape (extdeps.bmc.megarac
-// megarac_ui_features_json) over the one name the stand-in viewer reads.
-fn loopback_features_json() -> String {
-  megarac_ui_features_json(names: ["KVM_SESSION_RECONNECT" as NonEmptyStr])
-}
-
-fn rig_with(w: BmcWorld, features_json: String) -> Rig {
-  let dir = scratch_dir()
-  let pw_path = concat(dir, "/credential")
-  let _pw = Filesystem.Write(path: pw_path, content: "pw")
-  let table = megarac_web_transition_table(initial: w, credentials: [MegaRacWebLogin { username: "admin", password: "pw" }], extended_privilege: 259, depth: megarac_web_exploration_depth)
-  let resolution = runner_browser_toolchain_here_wet()
-  match resolution {
-    BrowserToolchainReady { location: loc, standing: _ } => {
-      let serving = megarac_web_transport_serve(dir: dir, table: table, node_binary: loc.node_binary as String)
-      let start = match serving {
-        TransportServing { port: port, pid: _ } => {
-          let obs = concat(dir, "/observer")
-          let _made = shell.Mkdir.Parents(path: obs as FilePath)
-          kvm_observer_protocol_launch(dir_given: obs, base_url: concat("http://127.0.0.1:", port), host: concat("127.0.0.1:", port), username: "admin", password_file: pw_path, toolchain: loc, attempt: "wet", features_json: features_json)
-        }
-        TransportNotServing { cause: _ } => KvmObserverNotStarted { reason: "the loopback transport is not serving" }
-      }
-      Rig { dir: dir, serving: serving, start: start }
-    }
-    _ => Rig { dir: dir, serving: TransportNotServing { cause: TransportPidUnpublished }, start: KvmObserverNotStarted { reason: toolchain_absence(r: resolution) as NonEmptyStr } }
-  }
-}
-
-fn close_rig(r: Rig) -> Bool {
-  let released = megarac_web_transport_stop(dir: r.dir)
-  let observed = match released { OwnedReleased { pid: _ } => true  OwnedAlreadyGone { pid: _ } => true  _ => false }
-  observed && shell.Remove.RecursiveForce(path: r.dir).success
-}
-
-fn released(rec: KvmObserverRecord) -> Bool {
-  match rec.teardown {
-    KvmTeardownRecorded { terminal: _, snapshot: _, requested_at: _, stopped_seen: st, session_release: sr, browser_close: bc, process: p } =>
-      st && string_contains(s: sr, pattern: "released") && string_contains(s: bc, pattern: "closed")
-        && match p { OwnedReleased { pid: _ } => true  OwnedAlreadyGone { pid: _ } => true  _ => false }
-    _ => false
-  }
-}
-
-fn transport_log(r: Rig) -> String { read_or_empty(path: concat(r.dir, "/transport.log")) }
-
-// THE PAGE'S ROUTE, AS THE JOURNAL RECORDS IT: every main-frame navigation's seq, the observer's phase
-// and the committed URL, in journal order. Against the loopback controller the route is exactly the one
-// navigation the observer makes -- viewer.html, and never the root -- so the journal's record of where the
-// page went is held to what happened; on the real controller the same lines record any reload the SPA
-// makes to #login under the held viewer.
-fn navigation_route(start: KvmObserverStart) -> List<String> {
-  match start {
-    KvmObserverStarted { dir: d, subject: _, standing: _, checked_at: _ } =>
-      flat_map(kvm_journal_events_at(dir: d as String), e => match e {
-        KvmJournalNavigated { at: _, seq: n, phase: p, url: u } => [join([n, p, u], " ")]
-        _ => []
-      })
-    _ => []
-  }
-}
-
-// The loopback port the observer was pointed at, read back from its established host.
-fn port_of(start: KvmObserverStart) -> String {
-  match start {
-    KvmObserverStarted { dir: _, subject: s, standing: _, checked_at: _ } =>
-      match split(s: s.host, delimiter: ":").last() { Present { value: p } => p  Absent => "" }
-    _ => ""
-  }
-}
-
-// ESTABLISHED FOR THIS SUBJECT, ADMITTED FOR THE HANDOFF, AND THE TRIGGERED STILL IS HASH-BOUND. The
-// controller saw a real login, the owning logout, and closed the stream when the model said so.
-test fn a_held_observer_is_admitted_and_its_triggered_still_is_hash_bound() -> Bool {
-  let r = rig(w: world(other_viewers: 0, close_at: no_close(), canvas_readable: true))
-  let admitted = match kvm_handoff_admission(start: r.start) { KvmHandoffAdmitted { session: s } => s == "7"  _ => false }
-  let asked = kvm_observer_trigger(start: r.start, order: 2, reason: "sol-channel-lost")
-  let _w = sleep_delay_seconds_second_carrier_projection(duration: second(count: 3))
-  let rec = megarac_kvm_observer_finish(start: r.start, attempt: "wet", terminal_order: 3)
-  let log = transport_log(r: r)
-  let loss_still = count(filter(rec.stills, s => match s { KvmStillHashed { at: a, seq: _, reason: why, path: _, digest: _ } => string_contains(s: why, pattern: "sol-channel-lost") && (millisecond_count(m: a.since_epoch) as Int) > 0  _ => false }))
-  let navigations = navigation_route(start: r.start)
-  let closed = close_rig(r: r)
-  admitted && asked && loss_still == 1 && released(rec: rec) && closed
-    && navigations == [concat("1 viewer \"http://127.0.0.1:", port_of(start: r.start), "/viewer.html\"")]
-    && string_contains(s: log, pattern: "transition request=[\"login\",\"admin\",\"pw\"] status=200")
-    && string_contains(s: log, pattern: "transition request=[\"logout\",\"csrf-7\"] status=200")
-    && string_contains(s: log, pattern: "stream closed by the model")
-}
-
-// THE LOGIN DOES NOT RUN IN A DOCUMENT THAT CAN NAVIGATE AWAY (fleet-converge run 36721915217). The
-// transport's root page replaces itself on DOMContentLoaded. The observer that loaded "/" and logged in
-// by evaluating a fetch inside it journalled "failed ... Execution context was destroyed" against this
-// transport, the hardware journal line for line, and was never established. The ROUTE is asserted, not
-// only the answer: the controller saw the login and never served its root page.
-test fn a_root_page_that_navigates_cannot_destroy_the_login() -> Bool {
-  let r = rig(w: world(other_viewers: 0, close_at: no_close(), canvas_readable: true))
-  let admitted = match kvm_handoff_admission(start: r.start) { KvmHandoffAdmitted { session: s } => s == "7"  _ => false }
-  let rec = megarac_kvm_observer_finish(start: r.start, attempt: "wet", terminal_order: 3)
-  let log = transport_log(r: r)
-  let closed = close_rig(r: r)
-  admitted && released(rec: rec) && closed
-    && string_contains(s: log, pattern: "transition request=[\"login\",\"admin\",\"pw\"] status=200")
-    && !string_contains(s: log, pattern: "spa-root served")
-}
-
-// THE VIEWER NEEDS ITS FEATURE LIST (KVM probe run 36788605665): launched WITHOUT it, the viewer's
-// unguarded sessionStorage.features.indexOf throws, the page error is journalled, /kvm is never
-// requested, and the observer refuses for want of a frame -- never established. The route is asserted:
-// the controller saw the login and no kvm connect.
-test fn a_viewer_without_its_feature_list_never_opens_kvm() -> Bool {
-  let r = rig_with(w: world(other_viewers: 0, close_at: no_close(), canvas_readable: true), features_json: "")
-  let refused = match kvm_observer_standing_now(start: r.start) { KvmObserverRefused { at: _, refusal: _ } => true  _ => false }
-  let page_error = match r.start { KvmObserverStarted { dir: d, subject: _, standing: _, checked_at: _ } => any(kvm_journal_events_at(dir: d as String), e => match e { KvmJournalPageError { at: _, phase: p, detail: x } => p == "viewer" && string_contains(s: x, pattern: "indexOf")  _ => false })  _ => false }
-  let rec = megarac_kvm_observer_finish(start: r.start, attempt: "wet", terminal_order: 3)
-  let log = transport_log(r: r)
-  let closed = close_rig(r: r)
-  refused && page_error && released(rec: rec) && closed
-    && string_contains(s: log, pattern: "transition request=[\"login\",\"admin\",\"pw\"] status=200")
-    && !string_contains(s: log, pattern: "transition request=[\"connect\"")
-}
-
-// VIEWER SLOT BUSY: the model's other viewer makes viewer_count 1; the observer refuses with that count,
-// never connects, releases its session -- and the handoff is refused with that standing.
-test fn a_busy_viewer_slot_refuses_the_observer_and_the_handoff() -> Bool {
-  let r = rig(w: world(other_viewers: 1, close_at: no_close(), canvas_readable: true))
-  let refused = match kvm_observer_standing_now(start: r.start) { KvmObserverRefused { at: _, refusal: x } => match x { KvmSeatBusy { viewer_count: n } => n == "1"  _ => false }  _ => false }
-  let handoff = match kvm_handoff_admission(start: r.start) { KvmHandoffRefused { cause: c } => string_contains(s: c, pattern: "viewer_count=1")  _ => false }
-  let rec = megarac_kvm_observer_finish(start: r.start, attempt: "wet", terminal_order: 3)
-  let log = transport_log(r: r)
-  let closed = close_rig(r: r)
-  refused && handoff && !string_contains(s: log, pattern: "kvm-open") && string_contains(s: log, pattern: "transition request=[\"logout\",\"csrf-7\"] status=200") && released(rec: rec) && closed
-}
-
-// CONNECTION LOST MID-BOOT: the model closes the stream at its scheduled instant. The browser's close
-// is journalled as connection-lost, the boot's tick report freezes it, the standing is Lost (so a
-// handoff after it is refused), and a still asked after it is not-connected.
-test fn a_connection_lost_mid_boot_is_reported_and_no_still_is_claimed_after_it() -> Bool {
-  let r = rig(w: world(other_viewers: 0, close_at: Present { value: 8 }, canvas_readable: true))
-  let _w = sleep_delay_seconds_second_carrier_projection(duration: second(count: 10))
-  let reported = mtcollins1_boot_screen_boundary_report(screen: r.start, already: [])
-  let lost = match kvm_observer_standing_now(start: r.start) { KvmObserverLost { at: _, established_at: _ } => true  _ => false }
-  let handoff = match kvm_handoff_admission(start: r.start) { KvmHandoffRefused { cause: c } => string_contains(s: c, pattern: "LOST")  _ => false }
-  let rec = megarac_kvm_observer_finish(start: r.start, attempt: "wet", terminal_order: 3)
-  let report_file = match r.start { KvmObserverStarted { dir: d, subject: _, standing: _, checked_at: _ } => read_or_empty(path: concat(d as String, "/boundary-report"))  _ => "" }
-  let closed = close_rig(r: r)
-  lost && handoff && count(rec.stills) == 0
-    && count(reported) >= 1 && string_contains(s: report_file, pattern: "CONNECTION LOST")
-    && released(rec: rec) && closed
-}
-
-// CANVAS UNREADABLE: the world's browser-side flag makes the page's canvas unexportable; the still asked
-// for is acquisition-failed canvas-unreadable with the browser's own words.
-test fn an_unreadable_canvas_is_acquisition_failed_with_the_browsers_words() -> Bool {
-  let r = rig(w: world(other_viewers: 0, close_at: no_close(), canvas_readable: false))
-  let asked = kvm_observer_trigger(start: r.start, order: 2, reason: "sol-channel-lost")
-  let _w = sleep_delay_seconds_second_carrier_projection(duration: second(count: 3))
-  let rec = megarac_kvm_observer_finish(start: r.start, attempt: "wet", terminal_order: 3)
-  let unreadable = count(filter(rec.events, e => match e {
-    KvmJournalAcquisitionFailed { at: _, seq: _, reason: _, cause: c, gen: _ } => match c { KvmCanvasUnreadable { detail: d } => string_contains(s: d, pattern: "Tainted canvases")  _ => false }
-    _ => false
-  })) >= 1
-  let closed = close_rig(r: r)
-  asked && unreadable && count(rec.stills) == 0 && released(rec: rec) && closed
-}
-
-// ── THE TRANSPORT'S OWNED LIFECYCLE ─────────────────────────────────────────────────────────────
-//
-// READINESS IS BOUND TO THE WHOLE INSTANCE: a listening line from another pid, or from the SAME pid with
-// an earlier start time, is not readiness, whatever it says. Pure over what the launch would have read.
-test fn a_stale_listening_line_from_another_pid_is_not_readiness() -> Bool {
-  let stale = "1 pid=999 listening start=50 port=4242\n1 pid=4242 listening start=99 port=4343\n"
-  let running = OwnedRunning { pid: "4242", start_time: "100" }
-  let not_yet = match megarac_web_transport_readiness(standing: running, out: "", events: stale) { Absent => true  Present { value: _ } => false }
-  let mine = match megarac_web_transport_readiness(standing: running, out: "", events: concat(stale, "2 pid=4242 listening start=100 port=5151\n")) { Present { value: s } => match s { TransportServing { port: p, pid: q } => p == "5151" && q == "4242"  _ => false }  Absent => false }
-  let unpublished = match megarac_web_transport_readiness(standing: OwnedGone { pid: "" }, out: concat(owned_process_unpublished_line, "\n"), events: "") { Present { value: s } => match s { TransportNotServing { cause: c } => match c { TransportPidUnpublished => true  _ => false }  _ => false }  Absent => false }
-  let exited = match megarac_web_transport_readiness(standing: OwnedGone { pid: "4242" }, out: concat(owned_process_exit_prefix, "1 at=2026-09-28T00:00:00Z\n"), events: "") { Present { value: s } => match s { TransportNotServing { cause: c } => match c { TransportExitedBeforeReady { exit_line: _ } => true  _ => false }  _ => false }  Absent => false }
-  not_yet && mine && unpublished && exited
-}
-
-// AN IMMEDIATE EXIT, EXECUTED: a "node" that exits at once never becomes serving. Which typed cause it
-// gets is a race the launch reports honestly: exited-before-ready when its (pid, start time) was
-// published first, pid-unpublished when it was gone before its start time could be read. Never serving.
-test fn a_transport_that_exits_at_once_is_not_serving() -> Bool {
-  let dir = scratch_dir()
-  let s = megarac_web_transport_serve(dir: dir, table: empty_table, node_binary: "false")
-  let _gone = shell.Remove.RecursiveForce(path: dir)
-  match s {
-    TransportNotServing { cause: c } => match c {
-      TransportExitedBeforeReady { exit_line: l } => string_contains(s: l, pattern: "status=1")
-      TransportPidUnpublished => true
-      _ => false
-    }
-    _ => false
-  }
-}
-
-// A FAILED PID PUBLICATION, EXECUTED: a pid path that cannot be written stops the child the launch
-// started and says so; nothing is left running.
-test fn a_launch_that_cannot_publish_its_pid_stops_its_child() -> Bool {
-  let dir = scratch_dir()
-  let _blocker = shell.Mkdir.Parents(path: concat(dir, "/transport.pid") as FilePath)
-  let s = megarac_web_transport_serve(dir: dir, table: empty_table, node_binary: "sleep")
-  let _gone = shell.Remove.RecursiveForce(path: dir)
-  match s { TransportNotServing { cause: c } => match c { TransportPidUnpublished => true  _ => false }  _ => false }
-}
-
-// A TERM-IGNORING CHILD WHOSE RECORD CANNOT BE PUBLISHED, EXECUTED THROUGH THE PRODUCTION LAUNCH SCRIPT
-// (gunbc.owned_process owned_process_launch_script, the exact bytes LaunchOwned hands to bash -c): the
-// launch escalates to KILL and writes "stopped" only after observing the child gone -- the exit record
-// shows the KILL -- and nothing it started is left running.
-// THE CHILD IGNORES TERM FROM BIRTH, inherited from a launcher that ignores it before forking, for the
-// reason given at an_unreadable_process_state_never_skips_the_kill_of_an_unpublished_child: a child
-// that installs the ignore itself can be TERMed first and exit 143, so KILL is never exercised. That
-// disposition cannot be set through the LaunchOwned operation (its launcher argv is the production
-// one), so the script is run directly; the operation itself is still executed for real by
-// a_launch_that_cannot_publish_its_pid_stops_its_child.
-test fn a_term_ignoring_child_with_an_unpublished_record_is_observed_stopped() -> Bool {
-  let dir = scratch_dir()
-  let pid_path = concat(dir, "/child.pid")
-  let _blocker = shell.Mkdir.Parents(path: pid_path as FilePath)
-  let _l = shell.Exec.RunArgv(program: "env", arguments: ["--ignore-signal=TERM", "bash", "-c", owned_process_launch_script, "owned-launch", pid_path, concat(dir, "/child.log"), owned_process_exit_prefix, owned_process_unpublished_line, owned_process_unpublished_survived_line, owned_process_unpublished_unobservable_line, "sleep", "37"])
-  let _w = sleep_delay_seconds_second_carrier_projection(duration: second(count: 6))
-  let log = read_or_empty(path: concat(dir, "/child.log"))
-  let _gone = shell.Remove.RecursiveForce(path: dir)
-  string_contains(s: log, pattern: "child stopped (observed gone)") && string_contains(s: log, pattern: concat(owned_process_exit_prefix, "137"))
-}
-
-// THE SAME LAUNCH WITH ITS PROCESS STATE UNOBSERVABLE, EXECUTED: the production launch script's exact
-// bytes (gunbc.owned_process owned_process_launch_script, the string LaunchOwned hands to bash -c) run
-// with one fixture fault -- a cat earlier on PATH that fails every /proc/<pid>/stat read and passes
-// everything else through. An unreadable stat is not a gone child, so the launch must still escalate
-// to KILL (the exit record shows status 137) and nothing the fixture started may survive. Under the
-// pre-fix launch an unreadable stat ended the TERM wait and skipped KILL, leaving the TERM-ignoring
-// child running while the log claimed it stopped. The fixture kills its own marked child afterwards,
-// whatever the verdict.
-// THE CHILD IGNORES TERM FROM BIRTH: the disposition is set on the launcher before it forks, and the
-// child inherits it across exec. A child that installs the ignore itself (`sh -c "trap '' TERM; ..."`)
-// is TERM-able until its shell runs the trap, and with publication failing at once the launch's TERM
-// can land first -- the child then exits 143 and the 137 this claim reads is never written
-// (merge-group run 37120556276, observed failed with no change touching this path).
-// Scope discovery and cleanup to this scratch directory's argv[0]. A fixed sleep duration
-// matched children from concurrent runner slots, and cleanup could kill another witness's child.
-test fn an_unreadable_process_state_never_skips_the_kill_of_an_unpublished_child() -> Bool {
-  let dir = scratch_dir()
-  let bin = concat(dir, "/bin")
-  let _b = shell.Mkdir.Parents(path: bin as FilePath)
-  let _stub = Filesystem.Write(path: concat(bin, "/cat"), content: "#!/bin/sh\ncase \"$1\" in /proc/*/stat) exit 1;; esac\nexec /bin/cat \"$@\"\n")
-  let _x = shell.Exec.RunArgv(program: "chmod", arguments: ["+x", concat(bin, "/cat")])
-  let pid_path = concat(dir, "/child.pid")
-  let _blocker = shell.Mkdir.Parents(path: pid_path as FilePath)
-  let marker = concat(dir, "/unpublished-child")
-  let literal = fold(["\\", ".", "[", "]", "(", ")", "\{", "}", "*", "+", "?", "^", "$", "|"], init: marker, f: fn(acc, c) { replace(acc, c, concat("\\", c)) })
-  let pattern = concat("^", concat(literal, " 37[.]0417$"))
-  let _l = shell.Exec.RunArgv(program: "env", arguments: ["--ignore-signal=TERM", concat("PATH=", concat(bin, ":/usr/bin:/bin")), "bash", "-c", owned_process_launch_script, "owned-launch", pid_path, concat(dir, "/child.log"), owned_process_exit_prefix, owned_process_unpublished_line, owned_process_unpublished_survived_line, owned_process_unpublished_unobservable_line, "bash", "-c", "exec -a \"$1\" sleep 37.0417", "fixture-child", marker])
-  let _w = sleep_delay_seconds_second_carrier_projection(duration: second(count: 6))
-  let log = read_or_empty(path: concat(dir, "/child.log"))
-  let survivor = shell.Exec.RunArgv(program: "pgrep", arguments: ["-f", pattern]).exit_code == 0
-  let _clean = shell.Exec.RunArgv(program: "pkill", arguments: ["-KILL", "-f", pattern])
-  let _gone = shell.Remove.RecursiveForce(path: dir)
-  string_contains(s: log, pattern: concat(owned_process_exit_prefix, "137")) && !survivor
-}
-
-// THE PRODUCTION DIRECTORY SHAPE, EXECUTED: a RELATIVE observer directory (as the boot passes
-// artifacts/mtcollins1-boot-kvm-<attempt>) is resolved once. The observer is launched through the real
-// kvm_observer_launch_in with an unreadable credential, so it refuses before loading Playwright and
-// journals that refusal; the boot reads it from the one resolved location, and no doubled
-// <dir>/<dir> journal exists.
-test fn a_relative_observer_directory_is_resolved_once() -> Bool {
-  let made = shell.Mktemp.DirWithTemplate(template: "target/gunbc_kvmrel.XXXXXX")
-  let dir = trim(s: made.path as String)
-  match runner_browser_toolchain_here_wet() {
-    BrowserToolchainReady { location: loc, standing: _ } => {
-      let start = kvm_observer_protocol_launch(dir_given: dir, base_url: "http://127.0.0.1:9", host: "127.0.0.1:9", username: "u", password_file: "/nonexistent/credential", toolchain: loc, attempt: "rel", features_json: "")
-      let refused = match start {
-        KvmObserverStarted { dir: d, subject: _, standing: st, checked_at: _ } => starts_with(s: d as String, prefix: "/") && match st { KvmObserverRefused { at: _, refusal: _ } => true  _ => false }
-        _ => false
-      }
-      let doubled = Filesystem.Read(path: concat(dir, concat("/", concat(dir, "/journal")))).success
-      let _gone = shell.Remove.RecursiveForce(path: dir)
-      refused && !doubled
-    }
-    _ => {
-      let _gone = shell.Remove.RecursiveForce(path: dir)
-      false
-    }
-  }
-}
-
-// WRONG IDENTITY, EXECUTED: a pid record whose start time does not match the live process of that pid
-// is Foreign, and the release leaves it alone.
-test fn a_record_naming_another_process_is_foreign_and_not_released() -> Bool {
-  let dir = scratch_dir()
-  let pid_path = concat(dir, "/foreign.pid")
-  let _rec = Filesystem.Write(path: pid_path, content: "1 999999999999\n")
-  let standing = owned_process_standing(pid_path: pid_path)
-  let r = owned_process_release(pid_path: pid_path)
-  let _gone = shell.Remove.RecursiveForce(path: dir)
-  let foreign = match standing { OwnedForeign { pid: p, observed_start: _ } => p == "1"  _ => false }
-  let untouched = match r { OwnedReleaseNotOwned { standing: _ } => true  _ => false }
-  foreign && untouched
-}
-
-// RELEASE, EXECUTED AND OBSERVED: an owned process is signalled and then observed gone; a second
-// release of the same record reports it already gone rather than succeeding again.
-test fn an_owned_process_is_released_and_observed_gone() -> Bool {
-  let dir = scratch_dir()
-  let pid_path = concat(dir, "/sleeper.pid")
-  let _l = gunbc.owned_process.launch.LaunchOwned(pid_path: pid_path as NonEmptyStr, log_path: concat(dir, "/sleeper.log") as NonEmptyStr, command: ["sleep", "60"])
-  let _w = sleep_delay_seconds_second_carrier_projection(duration: second(count: 1))
-  let running = match owned_process_standing(pid_path: pid_path) { OwnedRunning { pid: _, start_time: _ } => true  _ => false }
-  let first = owned_process_release(pid_path: pid_path)
-  let second_try = owned_process_release(pid_path: pid_path)
-  let _gone = shell.Remove.RecursiveForce(path: dir)
-  running
-    && match first { OwnedReleased { pid: _ } => true  _ => false }
-    && match second_try { OwnedAlreadyGone { pid: _ } => true  _ => false }
-}
diff --git a/dag/test/claim/machine_intake/mtcollins1_physical_orientation_witness_test.dag b/dag/test/claim/machine_intake/mtcollins1_physical_orientation_witness_test.dag
index 353c85a583e..c1dea6a4d85 100644
--- a/dag/test/claim/machine_intake/mtcollins1_physical_orientation_witness_test.dag
+++ b/dag/test/claim/machine_intake/mtcollins1_physical_orientation_witness_test.dag
@@ -13,7 +13,7 @@ import extdeps.ampere.mt_collins_getting_started_guide.dimm_layout {
 }
 import gunbc.fleet_host_identity { operator_host_mtcollins1 }
 import gunbc.managed_host {
-  ManagedHostFound, ManagedHostNotManaged, ManagedHostBound, ManagedHostAccessUnobserved, ManagedHostNotSecured, ManagedHostEndpointMismatch,
+  ManagedHostFound, ManagedHostFoundUnderDeclaredDrop, ManagedHostNotManaged, ManagedHostBound, ManagedHostAccessUnobserved, ManagedHostNotSecured, ManagedHostEndpointMismatch,
   managed_host_binding_for,
 }
 import gunbc.machine_intake_mtcollins1_dimm_connector_observation { mtcollins1_blue_connector_observation }
@@ -62,6 +62,15 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 fn mtcollins1_oriented(anchors: List<DimmPlacementAnchor>) -> DimmOrientedHost? {
   match managed_host_binding_for(host: operator_host_mtcollins1 as NonEmptyStr) {
     ManagedHostNotManaged { host: _ } => Absent
+    ManagedHostFoundUnderDeclaredDrop { standing: s, drop: _, standing_subject: _, current_subject: _ } => match s {
+      ManagedHostBound { binding: b } => match host_dimm_orientation(binding: b, anchors: anchors) {
+        HostDimmOriented { oriented: o } => Present { value: o }
+        HostDimmBoardUnmodeled { host: _, board: _ } => Absent
+      }
+      ManagedHostAccessUnobserved { endpoint: _ } => Absent
+      ManagedHostNotSecured { cause: _ } => Absent
+      ManagedHostEndpointMismatch { observed: _, secured: _ } => Absent
+    }
     ManagedHostFound { standing: s } => match s {
       ManagedHostBound { binding: b } => match host_dimm_orientation(binding: b, anchors: anchors) {
         HostDimmOriented { oriented: o } => Present { value: o }
@@ -124,7 +133,7 @@ fn resolves_to(anchors: List<DimmPlacementAnchor>, banks: List<MtCollinsDimmFigu
 // socket), and the firmware trained SK0 MC0 S0 and SK0 MC4 S0.
 test fn w_unmirrored_figure_order_contradicts_firmware() -> Bool {
   match anchor_verdict(anchor: mtcollins1_three_stick_anchor, hypothesis: FigureOrder, banks: dimm_figure_banks, pairs: mt_collins_channel_connector_pairs) {
-    AnchorContradicted { predicted: p } => list_length(items: p) == 1 && p.first().socket == 0 && p.first().controller == 0
+    AnchorContradicted { predicted: p } => list_length(items: p) == 1 && (match p.first() { Present { value: b } => b.socket == 0 && b.controller == 0  Absent => false })
     AnchorConsistent => false
     AnchorUnevaluable { unresolved_key: _ } => false
     AnchorFrameUnreported => false
diff --git a/dag/test/claim/machine_intake/mtcollins1_ui_bundle_observe_witness_test.dag b/dag/test/claim/machine_intake/mtcollins1_ui_bundle_observe_witness_test.dag
deleted file mode 100644
index 5c5f982713a..00000000000
--- a/dag/test/claim/machine_intake/mtcollins1_ui_bundle_observe_witness_test.dag
+++ /dev/null
@@ -1,130 +0,0 @@
-module test.claim.machine_intake.mtcollins1_ui_bundle_observe_witness_test
-
-import std.types { Bool, List, String }
-import std.optional { Present, Absent }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import gunbc.machine_intake_megarac_served_ui_catalog_observation { megarac_source_min_js_sha256_2026_09_27 }
-import gunbc.machine_intake_mtcollins1_ui_bundle_observe {
-  UiBundleDigestDrifted,
-  UiBundleDigestMatches,
-  UiBundleFirmwareDiffers,
-  UiBundleFirmwareExpected,
-  UiBundleFirmwareUnread,
-  firmware_revision_of_mc_info,
-  ServedRef, ServedRefLocal, ServedRefOtherOrigin, ServedRefEmpty, served_ref_reading,
-  served_html_references, served_js_references, served_references,
-  ServedFileRow, ServedFileBudgetReached, served_crawl, mtcollins1_ui_bundle_file_budget,
-  mtcollins1_ui_bundle_artifact_glob, mtcollins1_ui_bundle_receipt_path, mtcollins1_ui_bundle_dir, mtcollins1_ui_bundle_file_path,
-  ui_bundle_digest_comparison,
-  ui_bundle_firmware_standing,
-}
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-// `ipmitool mc info` as it prints, with the revision a parameter so the pair differs in one value.
-fn mc_info_with(revision: String) -> String {
-  join([
-    "Device ID                 : 32",
-    "Device Revision           : 1",
-    concat("Firmware Revision         : ", revision),
-    "IPMI Version              : 2.0",
-    "Manufacturer ID           : 10876",
-  ], "\n")
-}
-
-test fn the_revision_is_the_value_after_the_colon() -> Bool {
-  match firmware_revision_of_mc_info(stdout: mc_info_with(revision: "0.32")) {
-    Present { value: r } => r == "0.32"
-    Absent => false
-  }
-}
-
-// THE DISCRIMINATING PAIR: one value differs, and only 0.32 admits the fetch.
-test fn only_the_expected_revision_admits_the_fetch() -> Bool {
-  (match ui_bundle_firmware_standing(success: true, stdout: mc_info_with(revision: "0.32"), exit_code: 0, stderr: "") {
-    UiBundleFirmwareExpected { revision: r } => (r as String) == "0.32"
-    _ => false
-  })
-    && (match ui_bundle_firmware_standing(success: true, stdout: mc_info_with(revision: "0.33"), exit_code: 0, stderr: "") {
-      UiBundleFirmwareDiffers { revision: r, expected: e } => (r as String) == "0.33" && (e as String) == "0.32"
-      _ => false
-    })
-}
-
-// An unanswered read and an answer with no revision are both unread, never a revision.
-test fn an_unread_revision_never_admits_the_fetch() -> Bool {
-  (match ui_bundle_firmware_standing(success: false, stdout: "", exit_code: 124, stderr: "") {
-    UiBundleFirmwareUnread { detail: d } => string_contains(s: d, pattern: "124")
-    _ => false
-  })
-    && (match ui_bundle_firmware_standing(success: true, stdout: "Device ID : 32", exit_code: 0, stderr: "") {
-      UiBundleFirmwareUnread { detail: _ } => true
-      _ => false
-    })
-}
-
-// DRIFT IS REPORTED, AND THE CITED DIGEST RIDES WITH IT.
-test fn the_cited_digest_matches_and_any_other_drifts() -> Bool {
-  (match ui_bundle_digest_comparison(observed: megarac_source_min_js_sha256_2026_09_27 as String) { UiBundleDigestMatches => true _ => false })
-    && (match ui_bundle_digest_comparison(observed: "0000000000000000000000000000000000000000000000000000000000000000") {
-      UiBundleDigestDrifted { cited: c } => c == megarac_source_min_js_sha256_2026_09_27
-      _ => false
-    })
-}
-
-// ── THE SERVED FILES ARE DERIVED BY PARSING, NOT LISTED ──────────────────────────────────────────────
-// A viewer page's scripts: every <script> src, and require.js's data-main as the file it loads.
-test fn an_html_page_yields_its_script_sources_and_data_main() -> Bool {
-  let html = "<html><head><script src=\"libs/require.js\" data-main=\"viewer-main\"></script><script type='text/javascript' src='./js/viewer.min.js?v=12'></script><style></style></head><body><script>var x=1;</script></body></html>"
-  served_html_references(html: html) == ["libs/require.js", "viewer-main.js", "./js/viewer.min.js?v=12"]
-}
-
-// A script's KVM libraries, as the 2026-09-30 source.min.js spells them: a require-config path (a module
-// id, loaded as <id>.js) and a Worker constructed from a file name, in either quote.
-test fn a_script_yields_its_kvm_libraries_as_files() -> Bool {
-  let js = "paths:\{videosocket:\"./libs/kvm/videosocket\",decode_worker:\"./libs/kvm/ast/decode_worker.min\"},this.decodeWorker=new Worker('./libs/kvm/ast/decode_worker.js');var s=\"./libs/media/cdimage\""
-  served_js_references(js: js) == ["./libs/kvm/videosocket.js", "./libs/kvm/ast/decode_worker.min.js", "./libs/kvm/ast/decode_worker.js"]
-}
-
-// Only HTML and scripts are parsed; anything else yields no references.
-test fn only_pages_and_scripts_are_parsed_for_references() -> Bool {
-  served_references(path: "viewer.html", text: "<script src=\"a.js\"></script>") == ["a.js"]
-    && served_references(path: "libs/kvm/x.js", text: "\"./libs/kvm/y\"") == ["./libs/kvm/y.js"]
-    && served_references(path: "images/logo.png", text: "\"./libs/kvm/y\"") == []
-}
-
-// A reference becomes a path under the controller's root; another origin is kept, never fetched.
-test fn a_reference_reads_as_a_root_path_or_another_origin() -> Bool {
-  (match served_ref_reading(reference: "./js/viewer.min.js?v=12#x") { ServedRefLocal { path: p } => p == "js/viewer.min.js"  _ => false })
-    && (match served_ref_reading(reference: "/libs/require.js") { ServedRefLocal { path: p } => p == "libs/require.js"  _ => false })
-    && (match served_ref_reading(reference: "https://cdn.example/jquery.js") { ServedRefOtherOrigin { reference: r } => r == "https://cdn.example/jquery.js"  _ => false })
-    && (match served_ref_reading(reference: "//cdn.example/x.js") { ServedRefOtherOrigin { reference: _ } => true  _ => false })
-    && (match served_ref_reading(reference: "?v=1") { ServedRefEmpty => true  _ => false })
-}
-
-// THE BUDGET'S EDGE IS A ROW, NOT A SILENT CUT: with nothing left to spend, the crawl fetches nothing and
-// records every distinct unvisited path. (No GET is made on this path, so it runs without a controller.)
-test fn the_budget_edge_names_every_unvisited_path() -> Bool {
-  let queue = [
-    ServedRef { path: "viewer.html", found_by: "seed" },
-    ServedRef { path: "libs/kvm/videosocket.js", found_by: "viewer.html" },
-    ServedRef { path: "viewer.html", found_by: "libs/kvm/x.js" },
-  ]
-  match served_crawl(queue: queue, seen: [], rows: [], remaining: 0).first() {
-    Present { value: row } =>
-      match row {
-        ServedFileBudgetReached { budget: b, unvisited: u } => b == (mtcollins1_ui_bundle_file_budget as Int) && u == ["viewer.html", "libs/kvm/videosocket.js"]
-        _ => false
-      }
-    Absent => false
-  }
-}
-
-// ONE GLOB CARRIES THE RECEIPT AND EVERY KEPT FILE.
-test fn the_upload_glob_covers_the_receipt_and_every_kept_file() -> Bool {
-  let prefix = substring(s: mtcollins1_ui_bundle_artifact_glob, start: 0, end: string_length(mtcollins1_ui_bundle_artifact_glob) - 1)
-  starts_with(s: mtcollins1_ui_bundle_receipt_path, prefix: prefix)
-    && starts_with(s: mtcollins1_ui_bundle_file_path(served: "libs/kvm/ast/decode_worker.js"), prefix: concat(mtcollins1_ui_bundle_dir, "/"))
-    && starts_with(s: mtcollins1_ui_bundle_dir, prefix: prefix)
-    && mtcollins1_ui_bundle_file_path(served: "libs/kvm/ast/decode_worker.js") == concat(mtcollins1_ui_bundle_dir, "/libs__kvm__ast__decode_worker.js")
-}
diff --git a/dag/test/claim/machine_intake/mtjade1_arrival_principal_witness_test.dag b/dag/test/claim/machine_intake/mtjade1_arrival_principal_witness_test.dag
new file mode 100644
index 00000000000..bf2ddf05d3b
--- /dev/null
+++ b/dag/test/claim/machine_intake/mtjade1_arrival_principal_witness_test.dag
@@ -0,0 +1,224 @@
+module test.claim.machine_intake.mtjade1_arrival_principal_witness
+
+import std.logic { Bool }
+import std.types { List, NonEmptyStr, String }
+import std.durable_exclusive_hold { DurableHoldOwnerRef }
+import gunbc.machine_intake_arrival_subject {
+  arrival_converge_subject_options, admit_arrival_subject,
+  ArrivalSubjectInPopulation, ArrivalSubjectUnknown, ArrivalSubjectIsManagedHostExecutorConfusion,
+}
+import gunbc.machine_intake_arrival_interlock {
+  ArrivalSlotHeld, ArrivalSlotNotHeld,
+  admit_arrival_archive_interlock, admit_arrival_bmc_secure_interlock,
+  ArrivalArchiveInterlockAdmitted, ArrivalArchiveInterlockRefused,
+  ArrivalBmcSecureInterlockAdmitted, ArrivalBmcSecureInterlockRefused,
+  arrival_combine_prefix_and_release, arrival_after_acquire, arrival_archive_slot_held,
+  ArrivalArchiveSlotRelease, ArrivalArchiveSlotReleased, ArrivalArchiveSlotReleaseRefused,
+  ArrivalArchiveSlotAcquire, ArrivalArchiveSlotAcquireRefused, ArrivalArchiveSlotAcquired, ArrivalArchiveSlotHeld,
+}
+import std.process { ProcessExit, ExitSuccess, ExitFailure }
+import std.durable_compare_and_set { cas_generation_first }
+import gunbc.machine_intake_bmc_rotation_route { rotation_route_ungrounded }
+import extdeps.bmc.endpoint { AmiMegaRac, BmcControllerEndpoint }
+import extdeps.bmc.capability { bmc_firmware_release_identity_of_wire }
+import gunbc.auth.mtjade1_arrival_pair { mtjade1_arrival_principal_member, mtjade1_arrival_secret_grants }
+import gunbc.auth.mtjade1_arrival_federation {
+  mtjade1_arrival_archive_effect, mtjade1_arrival_firmware_qualification_effect,
+}
+import gunbc.auth.authorization_pattern_selection {
+  FederatedScopedGrant, OperatorApprovedCapability,
+  PatternSelected, AuthorizationPatternSelection,
+  InterlockPending, InterlockedBy,
+  select_authorization_pattern,
+}
+import gunbc.auth.privileged_effect_census {
+  rulings_without_a_rostered_interlock, privileged_effect_census,
+  RealizedUnauthorized, RealizedFederatedGrant, RealizedRunSelected,
+  RealizedApprovalCapability, RealizedHumanStep, RealizedOperatorSession,
+}
+import gunbc.machine_intake_arrival_converge { grant_discharges_bmc_secure_account_write }
+import gunbc.machine_intake_arrival_run { arrival_wet_prefix_from_unobserved_world }
+import gunbc.auth.standing_operator_grant {
+  mtjade1_live_standing_grant, standing_grant_covers, standing_grant_arm_interlock, StandingGrantHost,
+  StandingJadeArrivalArchive, StandingJadeFirmwareQualification, StandingBmcSecureAccountWrite, StandingD0ReleaseToFleet,
+}
+import std.decl_ref { declaration_ref_display_key }
+import gunbc.fleet_host_identity { operator_host_mtjade1, operator_host_mtcollins1 }
+
+fn selected_federated(s: AuthorizationPatternSelection) -> Bool {
+  match s {
+    PatternSelected { pattern: FederatedScopedGrant, receipt: _ } => true
+    _ => false
+  }
+}
+
+fn selected_approved(s: AuthorizationPatternSelection) -> Bool {
+  match s {
+    PatternSelected { pattern: OperatorApprovedCapability, receipt: _ } => true
+    _ => false
+  }
+}
+
+test fn w_arrival_options_are_the_population_projection() -> Bool {
+  arrival_converge_subject_options() == ["mtjade1"]
+}
+
+test fn w_mtjade1_is_admitted_and_mtcollins1_and_outsiders_refuse_before_effect() -> Bool {
+  match admit_arrival_subject(wire: "mtjade1") {
+    ArrivalSubjectInPopulation { subject: s } => (s.wire as String) == "mtjade1"
+    _ => false
+  }
+    && match admit_arrival_subject(wire: operator_host_mtcollins1 as String) {
+      ArrivalSubjectIsManagedHostExecutorConfusion { wire: _ } => true
+      _ => false
+    }
+    && match admit_arrival_subject(wire: "not-a-unit") {
+      ArrivalSubjectUnknown { wire: w } => w == "not-a-unit"
+      _ => false
+    }
+}
+
+test fn w_grant_covers_arrival_arms_on_mtjade1_only() -> Bool {
+  standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingJadeArrivalArchive)
+    && standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingJadeFirmwareQualification)
+    && standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingBmcSecureAccountWrite)
+    && grant_discharges_bmc_secure_account_write(g: mtjade1_live_standing_grant, host: operator_host_mtjade1)
+    && !grant_discharges_bmc_secure_account_write(g: mtjade1_live_standing_grant, host: operator_host_mtcollins1)
+    && !standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtcollins1 }, effect: StandingBmcSecureAccountWrite)
+    && !standing_grant_covers(g: mtjade1_live_standing_grant, scope: StandingGrantHost { host: operator_host_mtjade1 }, effect: StandingD0ReleaseToFleet)
+}
+
+test fn w_ungrounded_route_refuses_bmc_secure_interlock() -> Bool {
+  match admit_arrival_subject(wire: "mtjade1") {
+    ArrivalSubjectInPopulation { subject: s } =>
+      match admit_arrival_archive_interlock(subject: s, slot: ArrivalSlotNotHeld { cause: "slot free" as NonEmptyStr }) {
+        ArrivalArchiveInterlockRefused { cause: _ } =>
+          match admit_arrival_bmc_secure_interlock(
+            subject: s,
+            slot: ArrivalSlotHeld { subject: s },
+            route: rotation_route_ungrounded(
+              endpoint: BmcControllerEndpoint { host: "192.168.1.246" },
+              firmware: bmc_firmware_release_identity_of_wire(family: AmiMegaRac, wire: "2.11.104000" as NonEmptyStr),
+            ),
+          ) {
+            ArrivalBmcSecureInterlockRefused { cause: _ } => true
+            ArrivalBmcSecureInterlockAdmitted { subject: _ } => false
+          }
+        ArrivalArchiveInterlockAdmitted { subject: _ } => false
+      }
+    _ => false
+  }
+}
+
+test fn w_release_failure_after_success_is_visible() -> Bool {
+  match arrival_combine_prefix_and_release(
+    prefix: ExitSuccess,
+    slot: ArrivalArchiveSlotReleaseRefused { cause: "arrival slot release was not eligible" as NonEmptyStr },
+  ) {
+    ExitSuccess => false
+    ExitFailure { code: _, reason: r } => string_contains(s: r, pattern: "slot release refused")
+  }
+}
+
+test fn w_release_failure_after_prefix_failure_is_concatenated() -> Bool {
+  match arrival_combine_prefix_and_release(
+    prefix: ExitFailure { code: 2, reason: "prefix refused" },
+    slot: ArrivalArchiveSlotReleaseRefused { cause: "arrival slot release was not eligible" as NonEmptyStr },
+  ) {
+    ExitSuccess => false
+    ExitFailure { code: c, reason: r } =>
+      c == 2 && string_contains(s: r, pattern: "prefix refused") && string_contains(s: r, pattern: "slot release refused")
+  }
+}
+
+fn body_that_refuses() -> ProcessExit {
+  ExitFailure { code: 9, reason: "BODY_RAN" }
+}
+
+fn release_that_marks(held: ArrivalArchiveSlotHeld) -> ArrivalArchiveSlotRelease {
+  match held {
+    ArrivalArchiveSlotHeld { subject: _, slot_key: _, owner: _, generation: _ } =>
+      ArrivalArchiveSlotReleaseRefused { cause: "RELEASE_RAN" as NonEmptyStr }
+  }
+}
+
+fn fixture_acquired_slot() -> ArrivalArchiveSlotAcquire {
+  match admit_arrival_subject(wire: "mtjade1") {
+    ArrivalSubjectInPopulation { subject: s } =>
+      ArrivalArchiveSlotAcquired {
+        held: arrival_archive_slot_held(
+          subject: s,
+          slot_key: "arrival:mtjade1" as NonEmptyStr,
+          owner: "arrival-principal-witness" as DurableHoldOwnerRef,
+          generation: cas_generation_first(),
+        ),
+      }
+    _ => ArrivalArchiveSlotAcquireRefused { cause: "fixture subject was not admitted" as NonEmptyStr }
+  }
+}
+
+test fn w_acquired_runs_body_and_release_when_body_refuses() -> Bool {
+  match arrival_after_acquire(
+    outcome: fixture_acquired_slot(),
+    body: fn() { body_that_refuses() },
+    release_fn: fn(h) { release_that_marks(held: h) },
+  ) {
+    ExitSuccess => false
+    ExitFailure { code: c, reason: r } =>
+      c == 9 && string_contains(s: r, pattern: "BODY_RAN") && string_contains(s: r, pattern: "RELEASE_RAN")
+  }
+}
+
+test fn w_successful_release_keeps_the_prefix() -> Bool {
+  match arrival_combine_prefix_and_release(
+    prefix: ExitSuccess,
+    slot: ArrivalArchiveSlotReleased { generation: cas_generation_first() },
+  ) {
+    ExitSuccess => true
+    ExitFailure { code: _, reason: _ } => false
+  }
+}
+
+test fn w_bound_principal_selects_federated_scoped_grant() -> Bool {
+  selected_federated(s: select_authorization_pattern(e: mtjade1_arrival_archive_effect()))
+    && selected_approved(s: select_authorization_pattern(e: mtjade1_arrival_firmware_qualification_effect()))
+    && !selected_federated(s: select_authorization_pattern(e: mtjade1_arrival_firmware_qualification_effect()))
+    && !selected_approved(s: select_authorization_pattern(e: mtjade1_arrival_archive_effect()))
+    && mtjade1_arrival_principal_member() == "serviceAccount:mtjade1-arrival@gunbai-secrets.iam.gserviceaccount.com"
+    && mtjade1_arrival_secret_grants().length() == 1
+    && rulings_without_a_rostered_interlock().length() == 1
+    && match rulings_without_a_rostered_interlock().first() {
+      Present { value: s } =>
+        declaration_ref_display_key(ref: s) == "gunbc.auth.mtjade1_arrival_federation::mtjade1_arrival_firmware_qualification_effect"
+      Absent => false
+    }
+    && match standing_grant_arm_interlock(g: mtjade1_live_standing_grant, e: StandingJadeFirmwareQualification) {
+      InterlockPending { obligation: _ } => true
+      InterlockedBy { hold: _ } => false
+    }
+    && match standing_grant_arm_interlock(g: mtjade1_live_standing_grant, e: StandingBmcSecureAccountWrite) {
+      InterlockedBy { hold: h } => (h.decl_name as String) == "admit_rotation_apply"
+      InterlockPending { obligation: _ } => false
+    }
+}
+
+test fn w_wet_door_refuses_unobserved_prior_life_world() -> Bool {
+  match arrival_wet_prefix_from_unobserved_world() {
+    ExitSuccess => false
+    ExitFailure { code: _, reason: r } =>
+      string_contains(s: r, pattern: "unobserved PriorLifeBoundary")
+  }
+}
+
+test fn w_archive_census_does_not_claim_a_write_the_wet_door_refuses() -> Bool {
+  any(privileged_effect_census, row =>
+    (row.site.decl_name as String) == "mtjade1_arrival_archive_effect"
+      && match row.realized {
+        RealizedUnauthorized => true
+        RealizedFederatedGrant => false
+        RealizedRunSelected => false
+        RealizedApprovalCapability => false
+        RealizedHumanStep => false
+        RealizedOperatorSession { arm: _ } => false
+      })
+}
diff --git a/dag/test/claim/machine_shape_catalog_integration_witness_test.dag b/dag/test/claim/machine_shape_catalog_integration_witness_test.dag
index 79cbcbc5157..cc1a1cd4473 100644
--- a/dag/test/claim/machine_shape_catalog_integration_witness_test.dag
+++ b/dag/test/claim/machine_shape_catalog_integration_witness_test.dag
@@ -48,23 +48,20 @@ test fn w_cpu_cache_levels_integrated_into_memory_shape() -> Bool {
     Present { value: domain } => {
       let memory = domain.memory
       list_length(items: memory) == 3
-        && memory.first().id == ampere_l1_level
         && match memory.first() {
-          Present { value: level } => byte_size_count(b: level.capacity) == ampere_l1_bytes_per_core
+          Present { value: level } => level.id == ampere_l1_level && byte_size_count(b: level.capacity) == ampere_l1_bytes_per_core
           Absent => false
         }
         && match memory.first().transfer_grain {
           Present { value: grain } => byte_size_count(b: grain) == ampere_cache_line_bytes
           Absent => false
         }
-        && memory.skip(n: 1).first().id == ampere_l2_level
         && match memory.skip(n: 1).first() {
-          Present { value: level } => byte_size_count(b: level.capacity) == ampere_l2_bytes_per_core
+          Present { value: level } => level.id == ampere_l2_level && byte_size_count(b: level.capacity) == ampere_l2_bytes_per_core
           Absent => false
         }
-        && memory.skip(n: 2).first().id == ampere_l3_level
         && match memory.skip(n: 2).first() {
-          Present { value: level } => byte_size_count(b: level.capacity) == ampere_l3_bytes
+          Present { value: level } => level.id == ampere_l3_level && byte_size_count(b: level.capacity) == ampere_l3_bytes
           Absent => false
         }
     }
diff --git a/dag/test/claim/map_lookup_dual_dispatch_witness_test.dag b/dag/test/claim/map_lookup_dual_dispatch_witness_test.dag
index 6aae645207a..3febbb72a1e 100644
--- a/dag/test/claim/map_lookup_dual_dispatch_witness_test.dag
+++ b/dag/test/claim/map_lookup_dual_dispatch_witness_test.dag
@@ -4,12 +4,20 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
 test fn map_get_method_routes_through_dual_dispatch_chokepoint() -> Bool {
   let m = empty_map() |> map_insert("a", 10)
-  (m |> get("a")) == 10
+  let o = m |> get("a")
+  match o {
+    Present { value: v } => v == 10
+    Absent => false
+  }
 }
 
 test fn map_index_routes_through_dual_dispatch_chokepoint() -> Bool {
   let m = empty_map() |> map_insert("b", 42)
-  m["b"] == 42
+  let o = m["b"]
+  match o {
+    Present { value: v } => v == 42
+    Absent => false
+  }
 }
 
 test fn lookup_builtin_routes_through_dual_dispatch_chokepoint() -> Bool {
diff --git a/dag/test/claim/materialization_provider_witness_test.dag b/dag/test/claim/materialization_provider_witness_test.dag
index 0c190dcff3f..18a721ed4e8 100644
--- a/dag/test/claim/materialization_provider_witness_test.dag
+++ b/dag/test/claim/materialization_provider_witness_test.dag
@@ -709,8 +709,8 @@ test fn completeness_holds_when_all_required_outputs_are_carried() -> Bool {
   ))
 }
 
-test fn consumer_target_frontier_names_six_caches_with_typed_binds() -> Bool {
-  (materialization_provider_target_count() == 6)
+test fn consumer_target_frontier_names_four_caches_with_typed_binds() -> Bool {
+  (materialization_provider_target_count() == 4)
     && materialization_provider_targets_contain(id: typed_module_cache_id)
     && materialization_provider_targets_all_bound()
 }
diff --git a/dag/test/claim/materialization_store_local_immutable_pin_wet_witness_test.dag b/dag/test/claim/materialization_store_local_immutable_pin_wet_witness_test.dag
new file mode 100644
index 00000000000..6940a163ce4
--- /dev/null
+++ b/dag/test/claim/materialization_store_local_immutable_pin_wet_witness_test.dag
@@ -0,0 +1,158 @@
+module test.claim.materialization_store_local_immutable_pin_wet_witness
+
+import extdeps.shell
+import extdeps.filesystem.filesystem_io { Filesystem }
+import std.types { Bool, List, String, NonEmptyStr }
+import std.content_hash { Fnv1a64Structural, content_hash_atom }
+import std.materialization_provider {
+  ArtifactRequest, NativeModuleVerdictBundleRequest, NativeModuleVerdictBundleSubject,
+  evaluation_store_address, evaluation_store_admitted_address,
+  output_module_test_verdicts, output_module_preparation_diagnostics,
+}
+import std.materialization_store_grant { MaterializationStoreRoot, WitnessScratchRoot }
+import std.materialization_object {
+  ArtifactPayload,
+  StoreCommit,
+  store_object_name,
+  store_lookup_is_miss,
+  store_commit_refusal_tag,
+}
+import extdeps.realization.materialization_store_local {
+  LocalStoreCapability,
+  LocalStoreOpened, LocalStoreUnavailable,
+  LocalStoreInitialization, LocalStoreInitialized, LocalStoreInitializationRefused,
+  local_store_initialize, local_store_lookup, store_path,
+  LocalStoreFamilyBudget,
+  local_store_with_family, LocalStoreBracket, LocalStoreBracketRan, LocalStoreBracketRefused, local_store_commit_under,
+  LocalStoreHoldStale, LocalStoreHoldNamedWindowHeadMoved, LocalStoreHoldWrongFamily,
+  local_store_hold_key,
+  LocalStoreHoldRefusal, LocalStoreFamilyBusy,
+  LocalStoreHolderUnobservable, LocalStoreHoldRecoveryRefused, LocalStoreHoldContended, LocalStoreHoldStoreUnavailable,
+  LocalStoreHoldSlotUndecodable, LocalStoreHoldKeyNotAddressable, LocalStoreHoldSelfUnidentified, LocalStoreHoldWindowTooNarrow, LocalStoreHoldUnsettled,
+}
+import gunbc.durable_cas_file_store { cas_file_slot_path }
+import std.cache_identity { native_module_verdict_bundle_artifact_kind, typed_module_artifact_kind }
+import std.measure { byte_size }
+
+// PARTIAL RECLAIM MUST NOT RE-AUTHORIZE A LEAKED HOLD. Independent deletes could remove G+1 while
+// G survived, so named verify would treat leaked G as head. Pin G against unlink, run another
+// acquire/release (the reclaim that used to punch that hole), then reuse G. commit_under observes
+// the hold first: named verify must answer NamedWindowHeadMoved (G present, G+1 still there).
+//
+// DECLARED NO-CI-WET-LANE DEBT. ioctl-set IMMUTABLE needs CAP_LINUX_IMMUTABLE; no required wet
+// lane grants it. This file is BinWitnessWet in gunbc.ci_layer_roots and named in
+// gunbc.rung_drop.edited_bin_witness_wet_rows_not_executed_by_ci_population, so a changed
+// identity is DeclinedNoCiWetLane rather than PlannedAsChangedWitness without a terminal.
+// Restoration: a wet lane that grants CAP_LINUX_IMMUTABLE, or an unlink-refusal construction
+// that needs none. Floor wall for the invariant:
+// reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution.
+// Integration evidence (not CI): invocation bbdf835a-b6fa-4a51-a93b-26b140398306, FAIL then PASS
+// with reclaim-stop reverted.
+
+data witness_family_budgets: List<LocalStoreFamilyBudget> = [
+  LocalStoreFamilyBudget { family: native_module_verdict_bundle_artifact_kind, budget: byte_size(count: 4096) },
+  LocalStoreFamilyBudget { family: typed_module_artifact_kind, budget: byte_size(count: 4096) },
+]
+
+fn h(v: String) -> Fnv1a64Structural {
+  content_hash_atom(value: v as NonEmptyStr)
+}
+
+fn bundle_req(module: String) -> ArtifactRequest {
+  NativeModuleVerdictBundleRequest(NativeModuleVerdictBundleSubject {
+    route_binary_identity: h(v: "route-binary-1"),
+    module_identity: h(v: module),
+    canonical_module_import_closure_identity: h(v: "closure-1"),
+    ordered_test_identity_population: h(v: "t1,t2"),
+    eval_interpretation_identity: h(v: "eval-1")
+  })
+}
+
+fn verdicts(text: String) -> List<ArtifactPayload> {
+  [
+    ArtifactPayload { id: output_module_test_verdicts, content: text },
+    ArtifactPayload { id: output_module_preparation_diagnostics, content: "" },
+  ]
+}
+
+fn object_path(root_path: String, req: ArtifactRequest) -> String {
+  match evaluation_store_admitted_address(admission: evaluation_store_address(req: req)) {
+    Absent => ""
+    Present { value: addr } => store_path(root_path: root_path, name: store_object_name(address: addr))
+  }
+}
+
+fn commit_tag(c: StoreCommit) -> String {
+  store_commit_refusal_tag(c: c)
+}
+
+fn fresh_root_path() -> String {
+  shell.Mktemp.DirWithTemplate(template: "/tmp/gunbc_matstore.XXXXXX").path
+}
+
+fn opened(root: MaterializationStoreRoot) -> LocalStoreCapability? {
+  match local_store_initialize(root: root, instance_label: "wet-witness", budgets: witness_family_budgets) {
+    LocalStoreInitialized { opening: o } => match o {
+      LocalStoreOpened { capability: c, durability: _ } => Present { value: c }
+      LocalStoreUnavailable { root_path: _, cause: _ } => none
+    }
+    LocalStoreInitializationRefused { root_path: _, cause: _ } => none
+  }
+}
+
+fn hold_refusal_is_named_window_head_moved(r: LocalStoreHoldRefusal?) -> Bool {
+  match r {
+    Present { value: x } => match x {
+      LocalStoreHoldNamedWindowHeadMoved { named: _ } => true
+      LocalStoreHoldStale { observed: _ } => false
+      LocalStoreFamilyBusy { holder: _, evidence: _ } => false
+      LocalStoreHolderUnobservable { holder: _, cause: _ } => false
+      LocalStoreHoldRecoveryRefused { refusal: _ } => false
+      LocalStoreHoldContended => false
+      LocalStoreHoldStoreUnavailable { cause: _ } => false
+      LocalStoreHoldSlotUndecodable { detail: _ } => false
+      LocalStoreHoldKeyNotAddressable => false
+      LocalStoreHoldSelfUnidentified { cause: _ } => false
+      LocalStoreHoldWindowTooNarrow { k: _ } => false
+      LocalStoreHoldUnsettled { settlement: _ } => false
+      LocalStoreHoldWrongFamily { held: _, requested: _ } => false
+    }
+    Absent => false
+  }
+}
+
+data pin_ext2_immutable_script: String = "import fcntl, os, struct, sys\nGET = 0x80086601\nSET = 0x40086602\nIMM = 0x10\npath = sys.argv[1]\non = sys.argv[2] == \"1\"\nfd = os.open(path, os.O_RDONLY)\ncur = struct.unpack(\"I\", fcntl.ioctl(fd, GET, struct.pack(\"I\", 0)))[0]\nfcntl.ioctl(fd, SET, struct.pack(\"I\", (cur | IMM) if on else (cur & ~IMM)))\nos.close(fd)\n"
+
+fn pin_generation_unlink(path: String, on: Bool) -> Bool {
+  shell.Exec.RunArgv(program: "python3", arguments: ["-c", pin_ext2_immutable_script, path, if on { "1" } else { "0" }]).exit_code == 0
+}
+
+test fn a_leaked_hold_stays_stale_when_reclaim_cannot_remove_its_generation_by_real_execution() -> Bool {
+  let root_path = fresh_root_path()
+  let root = WitnessScratchRoot { root: root_path }
+  let rs = bundle_req(module: "s")
+  let verdict = match opened(root: root) {
+    Absent => false
+    Present { value: store } =>
+      match local_store_with_family(capability: store, of: rs, run: h => h) {
+        LocalStoreBracketRefused { refusal: _ } => false
+        LocalStoreBracketRan { value: leaked, hold_release: _ } => {
+          let pinned = cas_file_slot_path(root: root_path as NonEmptyStr, key: local_store_hold_key(family: leaked.family), generation: leaked.generation)
+          let immutable = pin_generation_unlink(path: pinned, on: true)
+          let advanced = match local_store_with_family(capability: store, of: rs, run: _ => true) {
+            LocalStoreBracketRefused { refusal: _ } => false
+            LocalStoreBracketRan { value: ok, hold_release: _ } => ok
+          }
+          let c = local_store_commit_under(held: leaked, req: rs, payloads: verdicts(text: "s pass"), parts: [])
+          let _unlock = pin_generation_unlink(path: pinned, on: false)
+          immutable && advanced
+            && commit_tag(c: c.commit) == "occupancy_unavailable"
+            && hold_refusal_is_named_window_head_moved(r: c.hold_refusal)
+            && !Filesystem.Read(path: object_path(root_path: root_path, req: rs)).success
+            && store_lookup_is_miss(l: local_store_lookup(capability: store, req: rs))
+        }
+      }
+  }
+  let removed = shell.Remove.RecursiveForce(path: root_path)
+  verdict && removed.success
+}
diff --git a/dag/test/claim/materialization_store_local_seal_witness_test.dag b/dag/test/claim/materialization_store_local_seal_witness_test.dag
index d8411bace7a..1ce58e244b0 100644
--- a/dag/test/claim/materialization_store_local_seal_witness_test.dag
+++ b/dag/test/claim/materialization_store_local_seal_witness_test.dag
@@ -142,3 +142,15 @@ test fn a_direct_raw_observe_call_is_an_admission_refusal() -> Bool {
 test fn a_direct_raw_reclaim_call_is_an_admission_refusal() -> Bool {
   admission_refusals(source: direct_raw_reclaim_source, callee: "cas_reclaim_below") == 1
 }
+
+data direct_held_session_source: String = "module probe_direct_held_session\nimport std.cache_identity { ArtifactKindId }\nimport extdeps.realization.materialization_store_local { LocalStoreCapability, LocalStoreFamilyHeld, LocalStoreBracket, local_store_held_session }\nfn direct(c: LocalStoreCapability, f: ArtifactKindId) -> LocalStoreBracket<LocalStoreFamilyHeld> {\n  local_store_held_session(capability: c, family: f, run: h => h)\n}\n"
+
+data direct_named_window_observe_source: String = "module probe_direct_named_window_observe\nimport std.types { NonEmptyStr }\nimport std.durable_compare_and_set { CasGeneration }\nimport gunbc.durable_cas_file_store { cas_verify_named_window_head, CasNamedWindowVerify }\nfn direct(r: NonEmptyStr, k: NonEmptyStr, g: CasGeneration) -> CasNamedWindowVerify {\n  cas_verify_named_window_head(root: r, key: k, generation: g)\n}\n"
+
+test fn a_direct_held_session_call_is_an_admission_refusal() -> Bool {
+  admission_refusals(source: direct_held_session_source, callee: "local_store_held_session") == 1
+}
+
+test fn a_direct_named_window_observe_call_is_an_admission_refusal() -> Bool {
+  admission_refusals(source: direct_named_window_observe_source, callee: "cas_verify_named_window_head") == 1
+}
diff --git a/dag/test/claim/materialization_store_local_wet_witness_test.dag b/dag/test/claim/materialization_store_local_wet_witness_test.dag
index 3390043414a..04c22fa8321 100644
--- a/dag/test/claim/materialization_store_local_wet_witness_test.dag
+++ b/dag/test/claim/materialization_store_local_wet_witness_test.dag
@@ -39,19 +39,21 @@ import extdeps.realization.materialization_store_local {
   local_store_record_recency, local_store_is_object_name, local_store_is_store_file_name, local_store_object_bytes, local_store_family_budget,
   LocalStoreFamilyBudget, local_store_budget_sum,
   LocalStoreRecencyHoldRefused, LocalStoreRecencyReceipt,
-  local_store_with_family, LocalStoreBracket, LocalStoreBracketRan, LocalStoreBracketRefused, local_store_commit_under, LocalStoreHoldStale, LocalStoreHoldWrongFamily,
+  local_store_with_family, LocalStoreBracket, LocalStoreBracketRan, LocalStoreBracketRefused, local_store_commit_under, local_store_held_session, LocalStoreHoldStale, LocalStoreHoldNamedWindowHeadMoved, LocalStoreHoldWrongFamily,
   local_store_hold_key, local_store_hold_owner_prefix,
   LocalStoreHoldAcquisition, LocalStoreHoldAcquired, LocalStoreHoldRefused, LocalStoreHoldRefusal, LocalStoreFamilyBusy,
   LocalStoreHolderUnobservable, LocalStoreHoldRecoveryRefused, LocalStoreHoldContended, LocalStoreHoldStoreUnavailable,
   LocalStoreHoldSlotUndecodable, LocalStoreHoldKeyNotAddressable, LocalStoreHoldSelfUnidentified, LocalStoreHoldWindowTooNarrow, LocalStoreHoldUnsettled,
   LocalStoreCatalogMismatch, LocalStoreCatalogInadmissible, LocalStoreSweepIncomplete, LocalStoreUnavailableCause,
-  local_store_index_window,
+  local_store_index_window, local_store_digits_int,
   LocalStoreRecordDeleteAttempt, LocalStoreRecordGone, LocalStoreRecordFileRefused, LocalStoreRecordPartsRefused, LocalStoreRecordPartsUnlisted, LocalStoreStagedPart, LocalStorePartsLookup, local_store_lookup_parts, local_store_part_name,
 }
 import gunbc.process_hold_identity { self_process_identity, SelfIdentified, SelfUnidentified, process_hold_text }
 import gunbc.build_cache_instance { ProcessIdentity }
 import gunbc.durable_exclusive_hold_file_store { file_hold_acquire_windowed, FileHoldAcquired, FileHoldOccupied, FileHoldAcquireLost, FileHoldAcquireStoreUnavailable, FileHoldSlotUndecodable, FileHoldKeyNotSlotAddressable }
-import std.durable_exclusive_hold { DurableHoldOwnerRef }
+import std.durable_exclusive_hold {
+  DurableHoldOwnerRef,
+}
 import std.fabric_blob { fabric_blob_reading_path }
 import std.cache_identity { native_module_verdict_bundle_artifact_kind, typed_module_artifact_kind }
 import gunbc.materialization_store_budgets {
@@ -627,6 +629,7 @@ fn hold_refusal_is_busy(r: LocalStoreHoldRefusal?) -> Bool {
       LocalStoreHoldWindowTooNarrow { k: _ } => false
       LocalStoreHoldUnsettled { settlement: _ } => false
       LocalStoreHoldStale { observed: _ } => false
+      LocalStoreHoldNamedWindowHeadMoved { named: _ } => false
       LocalStoreHoldWrongFamily { held: _, requested: _ } => false
     }
     Absent => false
@@ -661,10 +664,11 @@ test fn a_commit_while_the_family_is_held_refuses_and_writes_nothing_by_real_exe
   verdict && removed.success
 }
 
-fn hold_refusal_is_stale(r: LocalStoreHoldRefusal?) -> Bool {
+fn hold_refusal_is_named_window_head_moved(r: LocalStoreHoldRefusal?) -> Bool {
   match r {
     Present { value: x } => match x {
-      LocalStoreHoldStale { observed: _ } => true
+      LocalStoreHoldNamedWindowHeadMoved { named: _ } => true
+      LocalStoreHoldStale { observed: _ } => false
       LocalStoreFamilyBusy { holder: _, evidence: _ } => false
       LocalStoreHolderUnobservable { holder: _, cause: _ } => false
       LocalStoreHoldRecoveryRefused { refusal: _ } => false
@@ -682,8 +686,9 @@ fn hold_refusal_is_stale(r: LocalStoreHoldRefusal?) -> Bool {
 }
 
 // RELEASE-THEN-MUTATE REFUSES. A bracket body returns the held value it was given, so it outlives its
-// release. Committing under that leaked value re-observes the family's hold slot, finds it no longer
-// held at that generation by that owner, and refuses as a stale hold; nothing is written.
+// release. Committing under that leaked value named-verifies G with G+1 present (the free successor
+// the release published) and refuses as NamedWindowHeadMoved; nothing is written. The listing path
+// used to decode the new free head as LocalStoreHoldStale; named verify does not observe that head.
 test fn a_hold_leaked_out_of_its_bracket_is_refused_as_stale_by_real_execution() -> Bool {
   let root_path = fresh_root_path()
   let root = WitnessScratchRoot { root: root_path }
@@ -695,7 +700,7 @@ test fn a_hold_leaked_out_of_its_bracket_is_refused_as_stale_by_real_execution()
         LocalStoreBracketRan { value: leaked, hold_release: _ } => {
           let rs = bundle_req(module: "s")
           let c = local_store_commit_under(held: leaked, req: rs, payloads: verdicts(text: "s pass"), parts: [])
-          commit_tag(c: c.commit) == "occupancy_unavailable" && hold_refusal_is_stale(r: c.hold_refusal)
+          commit_tag(c: c.commit) == "occupancy_unavailable" && hold_refusal_is_named_window_head_moved(r: c.hold_refusal)
             && !Filesystem.Read(path: object_path(root_path: root_path, req: rs)).success
             && store_lookup_is_miss(l: local_store_lookup(capability: store, req: rs))
         }
@@ -1339,3 +1344,66 @@ test fn a_leftover_copy_that_cannot_be_removed_leaves_the_store_unwritable_by_re
   let removed = shell.Remove.RecursiveForce(path: root_path)
   verdict && removed.success
 }
+
+fn hold_slot_head_generation(root_path: String) -> Int {
+  let prefix = concat(local_store_hold_key(family: native_module_verdict_bundle_artifact_kind) as String, ".")
+  let listing = Filesystem.List(path: root_path)
+  match filesystem_listing_observation(directory: root_path, success: listing.success, entries: listing.entries, error: listing.error) {
+    FilesystemDirectoryListed(listed) =>
+      fold(filesystem_listing_entry_names(listing: listed), init: 0, f: (best, n) =>
+        if !starts_with(s: n, prefix: prefix) { best } else {
+          match local_store_digits_int(s: substring(s: n, start: string_length(s: prefix), end: string_length(s: n))) {
+            Absent => best
+            Present { value: g } => if g > best { g } else { best }
+          }
+        }
+      )
+    FilesystemDirectoryListingRefused { directory: _, error: _ } => 0
+    FilesystemDirectorySubjectRefused { directory: _, cause: _ } => 0
+  }
+}
+
+fn session_commit_ok(c: LocalStoreCommit) -> Bool {
+  commit_tag(c: c.commit) == "committed"
+}
+
+// N COMMITS UNDER ONE SESSION ACQUIRE THE HOLD ONCE. Open already takes and releases the family
+// hold (the sweep), so the discriminator is the DELTA after open: one session acquire+release
+// advances the slot by 2; N per-commit brackets advance it by 2N. If the session were secretly
+// the per-commit path, the two deltas would match and this claim would fail. Lookups run under
+// the same session. This measures hold-acquire count, not root-List count: occupancy writes still
+// list the store.
+test fn n_commits_under_one_held_session_acquire_the_hold_once_by_real_execution() -> Bool {
+  let n = 6
+  let session_root_path = fresh_root_path()
+  let bracket_root_path = fresh_root_path()
+  let session_root = WitnessScratchRoot { root: session_root_path }
+  let bracket_root = WitnessScratchRoot { root: bracket_root_path }
+  let session_ok = match opened(root: session_root) {
+    Absent => false
+    Present { value: store } => {
+      let before = hold_slot_head_generation(root_path: session_root_path)
+      match local_store_held_session(capability: store, family: native_module_verdict_bundle_artifact_kind, run: h => {
+        let writes = [1, 2, 3, 4, 5, 6] |> map(i => local_store_commit_under(held: h, req: bundle_req(module: concat("s", i as String)), payloads: verdicts(text: "s pass"), parts: []))
+        let hits = [1, 2, 3, 4, 5, 6] |> map(i => store_lookup_is_hit(l: local_store_lookup(capability: store, req: bundle_req(module: concat("s", i as String)))))
+        writes |> all(c => session_commit_ok(c: c)) && hits |> all(x => x)
+      }) {
+        LocalStoreBracketRefused { refusal: _ } => false
+        LocalStoreBracketRan { value: body_ok, hold_release: _ } =>
+          body_ok && (hold_slot_head_generation(root_path: session_root_path) - before) == 2
+      }
+    }
+  }
+  let bracket_ok = match opened(root: bracket_root) {
+    Absent => false
+    Present { value: store } => {
+      let before = hold_slot_head_generation(root_path: bracket_root_path)
+      let writes = [1, 2, 3, 4, 5, 6] |> map(i => local_store_commit(capability: store, req: bundle_req(module: concat("b", i as String)), payloads: verdicts(text: "b pass"), parts: []))
+      writes |> all(c => session_commit_ok(c: c)) && (hold_slot_head_generation(root_path: bracket_root_path) - before) == (2 * n)
+    }
+  }
+  let removed_s = shell.Remove.RecursiveForce(path: session_root_path)
+  let removed_b = shell.Remove.RecursiveForce(path: bracket_root_path)
+  session_ok && bracket_ok && removed_s.success && removed_b.success
+}
+
diff --git a/dag/test/claim/merge_admission_witness_test.dag b/dag/test/claim/merge_admission_witness_test.dag
index e19c4517a3e..65afe2d23d5 100644
--- a/dag/test/claim/merge_admission_witness_test.dag
+++ b/dag/test/claim/merge_admission_witness_test.dag
@@ -84,7 +84,10 @@ test fn gate_roster_hash_unchanged_on_surface_only_move() -> Bool {
 test fn gunbc_repo_standard_is_squash_only() -> Bool {
   gunbc_repo_standard.default_branch == "main"
     && length(gunbc_repo_standard.allowed_strategies) == 1
-    && gunbc_repo_standard.allowed_strategies.first() == SquashMerge
+    && match gunbc_repo_standard.allowed_strategies.first() {
+      Present { value: strategy } => strategy == SquashMerge
+      Absent => false
+    }
     && gunbc_repo_standard.require_up_to_date == false
 }
 
diff --git a/dag/test/claim/mt_collins_dimm_physical_identity_witness_test.dag b/dag/test/claim/mt_collins_dimm_physical_identity_witness_test.dag
index de4e63794a6..54bc5ed7652 100644
--- a/dag/test/claim/mt_collins_dimm_physical_identity_witness_test.dag
+++ b/dag/test/claim/mt_collins_dimm_physical_identity_witness_test.dag
@@ -86,7 +86,13 @@ test fn w_every_figure_connector_resolves() -> Bool {
     DimmDiagramIdentityRefused { connector: _, cause: _ } => false
   }))
   && match resolve_dimm_diagram_identity(connector: 16, banks: dimm_figure_banks, pairs: mt_collins_channel_connector_pairs) {
-    DimmDiagramIdentityResolved { identity: i } => i.diagram_label == "J16" && i.bank.connectors_left_to_right.first() == 16 && i.bank.connectors_left_to_right.last() == 9 && i.channel.memory_controller == 7 && i.legend.slot_number == 1 && i.legend.drawing_colour == "blue" && i.bank.side == RightOfProcessor
+    DimmDiagramIdentityResolved { identity: i } => i.diagram_label == "J16" && match i.bank.connectors_left_to_right.first() {
+      Present { value: c } => c == 16
+      Absent => false
+    } && match i.bank.connectors_left_to_right.last() {
+      Present { value: c } => c == 9
+      Absent => false
+    } && i.channel.memory_controller == 7 && i.legend.slot_number == 1 && i.legend.drawing_colour == "blue" && i.bank.side == RightOfProcessor
     DimmDiagramIdentityRefused { connector: _, cause: _ } => false
   }
 }
@@ -97,7 +103,14 @@ test fn w_sixteen_dimm_join_keeps_orientation_and_physical_gaps() -> Bool {
       list_length(items: slots) == p.dimm_count && p.dimm_count == 16
       && o.left_processor_socket == 0 && o.right_processor_socket == 1
       && list_length(items: gaps) == 2
-      && colours.first() == "blue" && colours.last() == "black"
+      && match colours.first() {
+        Present { value: c } => c == "blue"
+        Absent => false
+      }
+      && match colours.last() {
+        Present { value: c } => c == "black"
+        Absent => false
+      }
       && citation.figure == 19 && citation.page == 52 && mirror.standing == RecordedReadBytesAgree
       && fold(slots, init: true, f: (acc, i) => acc && i.legend.slot_number == 0 && i.legend.drawing_colour == "yellow")
     PopulationDiagramRefused { unresolved: _ } => false
@@ -120,7 +133,11 @@ test fn w_bad_population_never_returns_partial_slots() -> Bool {
     PopulationConnectorRepeated { connectors: _ } => false
   }
   let repeated = match population_diagram_identity(population: MtCollinsDimmPopulationRow { dimm_count: 2, connectors: [1, 1] }) {
-    PopulationConnectorRepeated { connectors: cs } => cs.first() == 1
+    PopulationConnectorRepeated { connectors: cs } =>
+      match cs.first() {
+        Present { value: c } => c == 1
+        Absent => false
+      }
     PopulationDiagramResolved { population: _, slots: _, orientation: _, physical_gaps: _, photographed_colours: _, user_guide_citation: _, mirror_read: _ } => false
     PopulationDiagramRefused { unresolved: _ } => false
     PopulationCountDisagrees { declared: _, listed: _ } => false
diff --git a/dag/test/claim/mt_collins_population_role_witness_test.dag b/dag/test/claim/mt_collins_population_role_witness_test.dag
index cdc0699d8dc..03686ea0956 100644
--- a/dag/test/claim/mt_collins_population_role_witness_test.dag
+++ b/dag/test/claim/mt_collins_population_role_witness_test.dag
@@ -81,10 +81,14 @@ test fn w_the_source_pairs_all_resolve() -> Bool {
   match mt_collins_channel_population_roles {
     PopulationRolesResolved { roles: rs } =>
       list_length(items: rs) == 16
-        && rs.first().connector_used_at_one_dpc == 1
-        && rs.first().additional_connector_at_two_dpc == 2
-        && rs.last().connector_used_at_one_dpc == 25
-        && rs.last().additional_connector_at_two_dpc == 26
+        && match rs.first() {
+          Present { value: r } => r.connector_used_at_one_dpc == 1 && r.additional_connector_at_two_dpc == 2
+          Absent => false
+        }
+        && match rs.last() {
+          Present { value: r } => r.connector_used_at_one_dpc == 25 && r.additional_connector_at_two_dpc == 26
+          Absent => false
+        }
         && fold(rs, init: true, f: fn(acc, r) {
           acc && (r.connector_used_at_one_dpc < r.additional_connector_at_two_dpc)
         })
diff --git a/dag/test/claim/namecheap_workflow_witness_test.dag b/dag/test/claim/namecheap_workflow_witness_test.dag
index 9a762635c29..07e5523ee81 100644
--- a/dag/test/claim/namecheap_workflow_witness_test.dag
+++ b/dag/test/claim/namecheap_workflow_witness_test.dag
@@ -35,8 +35,9 @@ test fn observer_has_no_fleet_ssh_demand() -> Bool {
   match fleet_converge_mode_fleet_ssh_key_demand(mode: NamecheapObserve) { FleetSshKeyNotConsumed => true _ => false }
 }
 test fn trusted_code_cannot_be_replaced_by_dispatch_revision() -> Bool {
-  string_contains(s: fleet_converge_checkout_ref_expr, pattern: "github.event.inputs.mode == 'namecheap_observe'")
+  fleet_converge_checkout_ref_expr == "${{ github.sha }}"
     && fleet_converge_event_sha_checkout_ref_expr == "${{ github.sha }}"
+    && !string_contains(s: fleet_converge_checkout_ref_expr, pattern: "expected_revision")
     && string_contains(s: fleet_converge_shared_job_if, pattern: "github.event.inputs.mode != 'namecheap_observe'")
 }
 test fn observer_is_a_registered_dispatch_and_run_target() -> Bool {
diff --git a/dag/test/claim/native_effect_realization_admission_witness_test.dag b/dag/test/claim/native_effect_realization_admission_witness_test.dag
new file mode 100644
index 00000000000..09bcac85a91
--- /dev/null
+++ b/dag/test/claim/native_effect_realization_admission_witness_test.dag
@@ -0,0 +1,136 @@
+module test.claim.native_effect_realization_admission_witness
+
+import std.types { String, Bool, List }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import gunbc.compile_diagnostic_census { CompileDiagnosticCensusRow }
+import tools.multi_module_compile_fixture {
+  MultiModuleCompileFixture,
+  MultiModuleCompileFixtureOutcome,
+  FixtureInstrumentRefused,
+  FixtureCompileRefused,
+  FixtureCompileCompleted,
+  FixtureSource,
+  fixture_source,
+  compile_fixture,
+  fixture_rows_of_class
+}
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE SUBJECT: v1.compiler.emit NativeEffectRealizationAdmission, computed by v1.compiler.emit_rust
+// native_entry_effects for a native entry's function. An effect it does not admit REFUSES EMISSION
+// with NativeEffectRealizationRefused, typed and naming the arm; before it, the rendered main wrote
+// its handles by hand, and an effect it did not write surfaced only as a rustc error at the handler
+// call, or for a resource trait with no implementor as a link failure. The executed half -- that
+// the handlers it admits are bound and answer -- is gunbc test //gunbc/instruments:native-serve.
+//
+// The fixtures are isolated (tools.multi_module_compile_fixture), so each declares the vocabulary
+// it needs. The denominators (std.compiler_entry native_*_route_denominator) name effects by
+// DECLARATION IDENTITY, so a fixture that means the real clock or the real Entropy declares it in the
+// module that owns it (extdeps.clock, std.resources), and the homonym case declares a Clock elsewhere
+// to show a spelling alone decides nothing.
+
+data fx_entry_driver_source: String = "module nefx.entry_driver\ntype CompilerEntryDriver = NativeServeDriver | NativeCliDriver | NativeClaimDriver\ntype ServeWireResponse { status: Int, body: String }\n"
+
+// The real clock: extdeps.clock Clock, a service on the shell transport.
+data fx_extdeps_clock_source: String = "module extdeps.clock\nservice Clock {\n  operation Now {\n    requires none\n    input {}\n    output { timestamp: String from \"stdout\" }\n    readonly\n    transport shell { argv: [\"date\", \"-u\"] }\n    exit {\n      0 => Unit\n      nonzero => String \"date failed\"\n    }\n  }\n}\n"
+
+// A HOMONYM: a service spelled Clock that is not extdeps.clock Clock.
+data fx_homonym_clock_source: String = "module nefx.other\nservice Clock {\n  operation Now {\n    requires none\n    input {}\n    output { timestamp: String from \"stdout\" }\n    readonly\n    transport shell { argv: [\"date\", \"-u\"] }\n    exit {\n      0 => Unit\n      nonzero => String \"date failed\"\n    }\n  }\n}\n"
+
+// std.resources Entropy, declared where it lives (no capability, so only the ruling can refuse it).
+data fx_std_resources_source: String = "module std.resources\nresource Entropy {\n  kind: Observation\n  mode: Read\n  acquire {}\n  release {}\n}\n"
+
+// A REST transport under an innocuous name: outgoing HTTP by what it binds, not by what it is called.
+data fx_rest_result_source: String = "module extdeps.transports.rest\ntype RestResult<Body> = RestAnswered { answer: Body } | RestRefused { refusal: String }\n"
+data fx_fetch_service_source: String = "module nefx.fetch\nimport extdeps.transports.rest { RestResult }\nservice Fetcher {\n  config {\n    endpoint: \"http://127.0.0.1\"\n  }\n  operation Get {\n    requires none\n    input {}\n    output { live: Bool from \"live\" }\n    readonly\n    transport rest { method: GET, path: \"/livez\" }\n    response {\n      200 => Bool\n    }\n  }\n}\n"
+
+// A resource with a capability renders as a trait with no implementor: Unavailable.
+data fx_serve_resource_trait_source: String = "module nefx.serve\nimport nefx.entry_driver { CompilerEntryDriver, NativeServeDriver, ServeWireResponse }\ndata compiler_pipeline_entry: CompilerEntryDriver = NativeServeDriver\nresource Clock {\n  kind: Observation\n  mode: Read\n  acquire {}\n  release {}\n  capability now {\n    input {}\n    output { timestamp: String }\n  }\n}\nfn native_serve_handle(method: String, path: String, body: String, tailscale_identity: String, release_revision: String) -> ServeWireResponse\n  uses clk: Clock\n{\n  ServeWireResponse { status: 200, body: \"\" }\n}\n"
+
+data fx_serve_entropy_source: String = "module nefx.serve\nimport nefx.entry_driver { CompilerEntryDriver, NativeServeDriver, ServeWireResponse }\nimport std.resources { Entropy }\ndata compiler_pipeline_entry: CompilerEntryDriver = NativeServeDriver\nfn native_serve_handle(method: String, path: String, body: String, tailscale_identity: String, release_revision: String) -> ServeWireResponse\n  uses rng: Entropy\n{\n  ServeWireResponse { status: 200, body: \"\" }\n}\n"
+
+data fx_cli_clock_source: String = "module nefx.cli\nimport nefx.entry_driver { CompilerEntryDriver, NativeCliDriver }\nimport extdeps.clock { Clock }\ndata compiler_pipeline_entry: CompilerEntryDriver = NativeCliDriver\nfn v2_cli_main(argv: List<String>) -> String {\n  let r = Clock.Now()\n  r.timestamp\n}\n"
+
+data fx_cli_homonym_source: String = "module nefx.cli\nimport nefx.entry_driver { CompilerEntryDriver, NativeCliDriver }\nimport nefx.other { Clock }\ndata compiler_pipeline_entry: CompilerEntryDriver = NativeCliDriver\nfn v2_cli_main(argv: List<String>) -> String {\n  let r = Clock.Now()\n  r.timestamp\n}\n"
+
+data fx_cli_fetch_source: String = "module nefx.cli\nimport nefx.entry_driver { CompilerEntryDriver, NativeCliDriver }\nimport nefx.fetch { Fetcher }\nimport extdeps.transports.rest { RestResult, RestAnswered, RestRefused }\ndata compiler_pipeline_entry: CompilerEntryDriver = NativeCliDriver\nfn v2_cli_main(argv: List<String>) -> Bool {\n  match Fetcher.Get() {\n    RestAnswered { answer } => answer\n    RestRefused { refusal } => false\n  }\n}\n"
+
+data fx_claim_clock_source: String = "module nefx.claim\nimport nefx.entry_driver { CompilerEntryDriver, NativeClaimDriver }\nimport extdeps.clock { Clock }\ndata compiler_pipeline_entry: CompilerEntryDriver = NativeClaimDriver\nfn native_claim_report() -> String {\n  let r = Clock.Now()\n  r.timestamp\n}\n"
+
+data fx_serve_clock_source: String = "module nefx.serve\nimport nefx.entry_driver { CompilerEntryDriver, NativeServeDriver, ServeWireResponse }\nimport extdeps.clock { Clock }\ndata compiler_pipeline_entry: CompilerEntryDriver = NativeServeDriver\nfn native_serve_handle(method: String, path: String, body: String, tailscale_identity: String, release_revision: String) -> ServeWireResponse {\n  let r = Clock.Now()\n  ServeWireResponse { status: 200, body: r.timestamp }\n}\n"
+
+fn fx_run(entry_path: String, entry_source: String, peers: List<FixtureSource>) -> MultiModuleCompileFixtureOutcome {
+  compile_fixture(MultiModuleCompileFixture {
+    sources: concat([fixture_source("nefx/entry_driver.dag", fx_entry_driver_source), fixture_source(entry_path, entry_source)], peers),
+    entry: entry_path
+  })
+}
+
+fn fx_extdeps_clock() -> FixtureSource { fixture_source("extdeps/clock.dag", fx_extdeps_clock_source) }
+
+fn refusal_rows(o: MultiModuleCompileFixtureOutcome) -> List<CompileDiagnosticCensusRow> {
+  match o {
+    FixtureCompileRefused { module_count: _, diagnostics: rows, source_digest: _, compiler_digest: _ } =>
+      fixture_rows_of_class(rows, "NativeEffectRealizationRefused")
+    FixtureCompileCompleted { module_count: _, emitted_files: _, resolved_rust_functions: _, diagnostics: rows, source_digest: _, compiler_digest: _ } =>
+      fixture_rows_of_class(rows, "NativeEffectRealizationRefused")
+    FixtureInstrumentRefused { cause: _ } => []
+  }
+}
+
+// Refused by the admission, on the arm named by `marker` -- not merely "something refused", which a
+// typo in the fixture would also satisfy.
+fn refused_naming(o: MultiModuleCompileFixtureOutcome, marker: String) -> Bool {
+  let rows = refusal_rows(o: o)
+  match o {
+    FixtureCompileRefused { module_count: _, diagnostics: _, source_digest: _, compiler_digest: _ } =>
+      (rows |> filter(r => r.blocking && string_contains(s: r.subject_name, pattern: marker)) |> count) == 1
+    _ => false
+  }
+}
+
+fn admitted(o: MultiModuleCompileFixtureOutcome) -> Bool {
+  match o {
+    FixtureCompileCompleted { module_count: _, emitted_files: files, resolved_rust_functions: _, diagnostics: _, source_digest: _, compiler_digest: _ } =>
+      (refusal_rows(o: o) |> count) == 0 && (files |> count) > 0
+    _ => false
+  }
+}
+
+test fn serve_entry_demanding_a_resource_trait_refuses_as_unavailable() -> Bool {
+  refused_naming(o: fx_run(entry_path: "nefx/serve.dag", entry_source: fx_serve_resource_trait_source, peers: []),
+    marker: "resource nefx.serve Clock (uses clk) has no native realization: it is a resource trait with 1 capabilities and no native implementor")
+}
+
+test fn serve_entry_demanding_entropy_refuses_as_outside_the_denominator() -> Bool {
+  refused_naming(o: fx_run(entry_path: "nefx/serve.dag", entry_source: fx_serve_entropy_source, peers: [fixture_source("std/resources.dag", fx_std_resources_source)]),
+    marker: "resource std.resources Entropy (uses rng) is outside the NativeServeDriver denominator (ruling: gunbc.plans.demand_engine_program demand_engine_program_plan)")
+}
+
+test fn cli_entry_reaching_a_clock_service_refuses_as_outside_the_compiler_route() -> Bool {
+  refused_naming(o: fx_run(entry_path: "nefx/cli.dag", entry_source: fx_cli_clock_source, peers: [fx_extdeps_clock()]),
+    marker: "service extdeps.clock Clock is outside the NativeCliDriver denominator (ruling: gunbc.plans.demand_engine_program demand_engine_program_plan)")
+}
+
+test fn cli_entry_reaching_a_rest_service_refuses_as_outgoing_http() -> Bool {
+  refused_naming(o: fx_run(entry_path: "nefx/cli.dag", entry_source: fx_cli_fetch_source, peers: [fixture_source("nefx/fetch.dag", fx_fetch_service_source), fixture_source("extdeps/transports/rest.dag", fx_rest_result_source)]),
+    marker: "service nefx.fetch Fetcher is outside the NativeCliDriver denominator")
+}
+
+test fn claim_entry_reaching_a_clock_service_refuses_as_outside_its_declared_set() -> Bool {
+  refused_naming(o: fx_run(entry_path: "nefx/claim.dag", entry_source: fx_claim_clock_source, peers: [fx_extdeps_clock()]),
+    marker: "service extdeps.clock Clock is outside the NativeClaimDriver denominator (ruling: std.compiler_entry NativeClaimDriver)")
+}
+
+// THE IDENTITY CONTROL: a service SPELLED Clock that is not extdeps.clock Clock is not excluded from
+// the compiler route. Matching by spelling would refuse it; matching by declaration does not.
+test fn cli_entry_reaching_a_homonym_clock_is_judged_by_identity() -> Bool {
+  admitted(o: fx_run(entry_path: "nefx/cli.dag", entry_source: fx_cli_homonym_source, peers: [fixture_source("nefx/other.dag", fx_homonym_clock_source)]))
+}
+
+// THE POSITIVE CONTROL. Without it every RED above is satisfied by an admission that refuses
+// everything: the real clock under a serve entry is admitted.
+test fn serve_entry_reaching_a_clock_service_is_admitted() -> Bool {
+  admitted(o: fx_run(entry_path: "nefx/serve.dag", entry_source: fx_serve_clock_source, peers: [fx_extdeps_clock()]))
+}
diff --git a/dag/test/claim/native_product_federation_witness_test.dag b/dag/test/claim/native_product_federation_witness_test.dag
index 5b667a3a299..f92654f75e8 100644
--- a/dag/test/claim/native_product_federation_witness_test.dag
+++ b/dag/test/claim/native_product_federation_witness_test.dag
@@ -1,7 +1,11 @@
 module test.claim.native_product_federation
 
+import gunbc.auth.heal_publisher_provision { standing_principal_set }
+import std.optional { Present, Absent }
 import std.types { Bool, String, List }
-import gunbc.auth.oidc_claim_pins { OidcClaimPin, claim_pins_admit }
+import gunbc.auth.oidc_claim_pins {
+  OidcPresentedClaim, claim_pins_admit, presented_from_pins, with_presented_value, without_presented_claim,
+}
 import gunbc.auth.gcp_iam_converge { gcp_iam_converge_targets }
 import gunbc.auth.github_gcp_federation { github_wif_pool_id }
 import gunbc.native_product_federation {
@@ -9,8 +13,8 @@ import gunbc.native_product_federation {
   native_product_write_attribute_condition, native_product_read_service_account, native_product_write_service_account,
 }
 
-fn queue_claims() -> List<OidcClaimPin> {
-  map(native_product_write_claim_pins(), p => p)
+fn queue_claims() -> List<OidcPresentedClaim> {
+  presented_from_pins(pins: native_product_write_claim_pins())
 }
 
 // The accepting control: the merge queue's presented claims are admitted by the write provider.
@@ -21,9 +25,10 @@ test fn the_merge_queue_run_is_admitted_to_the_write_federation() -> Bool {
 // The refusing controls: a pull_request event, another repository and a missing event are each refused.
 test fn a_pull_request_or_foreign_run_is_refused_by_the_write_federation() -> Bool {
   let pins = native_product_write_claim_pins()
-  let pr = map(pins, p => if (p.claim as String) == "event_name" { OidcClaimPin { claim: p.claim, value: "pull_request" } } else { p })
-  let foreign = map(pins, p => if (p.claim as String) == "repository_id" { OidcClaimPin { claim: p.claim, value: "1" } } else { p })
-  let no_event = filter(pins, p => (p.claim as String) != "event_name")
+  let presented = presented_from_pins(pins: pins)
+  let pr = with_presented_value(claims: presented, claim: "event_name", value: "pull_request")
+  let foreign = with_presented_value(claims: presented, claim: "repository_id", value: "1")
+  let no_event = without_presented_claim(claims: presented, claim: "event_name")
   !claim_pins_admit(pins: pins, claims: pr) && !claim_pins_admit(pins: pins, claims: foreign) && !claim_pins_admit(pins: pins, claims: no_event)
 }
 
@@ -45,7 +50,7 @@ test fn each_account_holds_exactly_one_pinned_cell_on_its_own_token() -> Bool {
 // repository-wide principal set cannot reach the write account.
 test fn the_write_account_is_not_reachable_from_the_repository_pool() -> Bool {
   let w = native_product_write_federation()
-  (w.pool_id as String) != (github_wif_pool_id as String) && !w.principal_set.contains(github_wif_pool_id as String)
+  (w.pool_id as String) != (github_wif_pool_id as String) && match standing_principal_set(f: w) { Present { value: ps } => !ps.contains(github_wif_pool_id as String)  Absent => false }
 }
 
 // Deleting the roster row must fail this: both federations are converge targets.
diff --git a/dag/test/claim/nbd_proxy_endpoint_witness_test.dag b/dag/test/claim/nbd_proxy_endpoint_witness_test.dag
index ea040d2a257..a300f279eae 100644
--- a/dag/test/claim/nbd_proxy_endpoint_witness_test.dag
+++ b/dag/test/claim/nbd_proxy_endpoint_witness_test.dag
@@ -9,5 +9,8 @@ test fn altrad8ud_nbd_proxy_primary_endpoint_is_vm_slot_index() -> Bool {
 
 test fn altrad8ud_nbd_proxy_nbd_slot_absent_on_2_07_00() -> Bool {
   list_length(items: asrock_altrad8ud_openbmc_2_07_00_nbd_proxy_absent_endpoints) == 1
-    && asrock_altrad8ud_openbmc_2_07_00_nbd_proxy_absent_endpoints.first() == NbdSlotEndpoint
+    && match asrock_altrad8ud_openbmc_2_07_00_nbd_proxy_absent_endpoints.first() {
+      Present { value: e } => e == NbdSlotEndpoint
+      Absent => false
+    }
 }
diff --git a/dag/test/claim/openrouter_hosted_route_witness_test.dag b/dag/test/claim/openrouter_hosted_route_witness_test.dag
new file mode 100644
index 00000000000..338e194efb5
--- /dev/null
+++ b/dag/test/claim/openrouter_hosted_route_witness_test.dag
@@ -0,0 +1,703 @@
+module test.claim.openrouter_hosted_route_witness_test
+
+import std.types { Bool, String, Int, List, NonEmptyStr }
+import std.nat { Nat }
+import std.optional { Present, Absent }
+import extdeps.languages.json.emit { serialize_json, json_object }
+import extdeps.openrouter.openrouter {
+  openrouter_decode_error_body, OpenRouterErrorDecoded, OpenRouterErrorUndecodable,
+  OpenRouterPaymentRequired, OpenRouterRateLimited, OpenRouterOtherError,
+  KeySpendLimit, InFlightBudgetLimit, CreditsLimit, WeightExceedsBudget,
+  openrouter_decode_key_read, OpenRouterKeyDecoded, OpenRouterKeyUndecodable,
+  KeySpendCappedAtZero, KeySpendUncapped, KeySpendCappedAbove,
+  openrouter_credits_from_daily_limit, CreditsTierObserved, CreditsTierUnrecognized,
+  CreditsPurchasedAtLeastTen, CreditsPurchasedBelowTen, openrouter_free_models_per_day, openrouter_free_models_per_minute,
+  EffortHigh, EffortMedium,
+  openrouter_decode_rate_limited, OpenRouterRateLimitRefusal, RetryAfterSeconds, RetryAfterUnparsed, RetryAfterAbsent, RetryAfterUnread,
+  openrouter_rate_limit_wire, openrouter_rate_limit_hints, HeaderDumpRead, HeaderDumpUnread,
+}
+import gunbc.harness.harness_reasoning_wire {
+  NemotronUltraFreeOnOpenRouter, ReasoningOff, ReasoningStandard, ReasoningMaximum,
+  harness_openrouter_reasoning_kwargs, harness_reasoning_kwargs_for, ReasoningKwargsAdmitted, ReasoningLevelUnsupported,
+  harness_unit_model_id, harness_unit_placement, LeasedFromHostedQuota, PlacedOnFleetSeat,
+}
+import gunbc.harness.harness_hosted_route {
+  hosted_round_decision, RoundBothLeased, RoundRefusedFull, RoundRefusedUnleasable,
+  harness_hosted_route_for, harness_hosted_level_choice, HostedLevelSelected, HostedLevelUnselected,
+  hosted_key_refusal, hosted_day_remaining, hosted_access_from_key, harness_hosted_round_charge, HostedRoundCharged, HostedRoundQuotaFull, HostedRoundUnleasable,
+}
+import product.capacity.pool_events { PoolEvent, PoolAcquired, PoolSettled, PoolReleased, PoolUpstreamObserved, pool_apply_payload, pool_fold, PoolFolded, PoolFoldRefused }
+import product.capacity.event_chain { ChainEnvelope, ChainEvent, EventId }
+import gunbc.fabric_quota {
+  quota_term_to_window_end, quota_window_start, fabric_quota_lease_for, fabric_quota_settle_at, QuotaTermToWindowEnd,
+  QuotaSettled, QuotaSettleRefused,
+}
+import gunbc.harness.harness_seat { harness_seat_pool_root, hosted_inflight_carried, hosted_inflight_release_hint, hosted_inflight_partition }
+import gunbc.harness.harness_hosted_route { HarnessHostedQuota }
+import product.capacity.event_chain { ChainWalked }
+import std.nat { nat_range_inclusive }
+import product.capacity.quota { quota_root_pool }
+import product.capacity.pool {
+  Pool, pool_acquire, pool_settle, observe_upstream_remaining, PoolOutcome, PoolAdvanced, PoolRefused,
+  LeaseCrossesLapse, LeaseAlreadyLapsed, LedgerRefusal, pool_reading_at, PoolRead, PoolReadingRefused,
+}
+import std.measure { Measure, Count, One, second_count }
+import extdeps.api_rate_limit { UpstreamRateLimit }
+import gunbc.fabric_quota { QuotaLease, QuotaLeased, QuotaFull, QuotaLeaseRefused }
+import product.capacity.lease { LeaseGrant, LeaseFence, GrantIdentity }
+import product.capacity.event_chain { PartitionId }
+import gunbc.fabric_storage_client { FabricStorageServed }
+import gunbc.harness.harness_turn { TurnHostedQuotaFull, TurnHostedRateLimited, harness_outcome_label, harness_outcome_detail }
+import gunbc.harness.harness_cli { harness_turn_exit, harness_default_max_token_count, harness_request_deadline }
+import std.process { ExitSuccess, ExitFailure }
+import std.measure { token_count }
+
+// ── THE QUOTA REFUSAL: a full pool stops the request before it is sent ──────────────────────
+//
+// Supplied lease answers at the decision's own interface (DESIGN section 3, a witness discriminates at one
+// interface): the leases are gunbc.fabric_quota's subject and are witnessed there.
+
+fn w_leased(reference: String) -> QuotaLease {
+  QuotaLeased {
+    grant: LeaseGrant {
+      reference: reference as NonEmptyStr,
+      fence: LeaseFence { grant: join(["g-", reference], "") as GrantIdentity, generation: 1 },
+      granted_at: 100,
+      maximum_duration_seconds: 60,
+      expires_at: 160,
+    },
+    partition: join(["quota-openrouter-", reference], "") as PartitionId,
+    store: FabricStorageServed { endpoint: "witness" as NonEmptyStr },
+    limit: openrouter_free_models_per_minute,
+  }
+}
+
+// RED: the day pool is full after the minute pool leased. The round refuses as FULL, and the minute
+// lease is named as owed back -- a refusal that kept it would hold a slot for a request never sent.
+test fn hosted_round_refuses_full_when_the_day_pool_is_full_and_returns_the_minute_lease() -> Bool {
+  match hosted_round_decision(minute: w_leased(reference: "m"), day: Present { value: QuotaFull { wire: "openrouter-free-models-day: 1000/1000" } }) {
+    RoundRefusedFull { wire: w, minute_to_return: Present { value: QuotaLeased { grant: g, partition: _, store: _, limit: _ } } } =>
+      w.contains("free-models-day") && (g.reference as String) == "m"
+    RoundRefusedFull { wire: _, minute_to_return: _ } => false
+    RoundBothLeased { minute: _, day: _ } => false
+    RoundRefusedUnleasable { detail: _, minute_to_return: _ } => false
+  }
+}
+
+// RED: the minute pool is full, so the day pool is never asked and nothing is owed back.
+test fn hosted_round_refuses_full_when_the_minute_pool_is_full_and_asks_nothing_else() -> Bool {
+  match hosted_round_decision(minute: QuotaFull { wire: "openrouter-free-models-minute: 20/20" }, day: none) {
+    RoundRefusedFull { wire: w, minute_to_return: Absent } => w.contains("free-models-minute")
+    RoundRefusedFull { wire: _, minute_to_return: Present { value: _ } } => false
+    RoundBothLeased { minute: _, day: _ } => false
+    RoundRefusedUnleasable { detail: _, minute_to_return: _ } => false
+  }
+}
+
+// CONTROL: both pools leased is the only arm that posts.
+test fn hosted_round_posts_only_when_both_pools_leased() -> Bool {
+  match hosted_round_decision(minute: w_leased(reference: "m"), day: Present { value: w_leased(reference: "d") }) {
+    RoundBothLeased { minute: _, day: _ } => true
+    RoundRefusedFull { wire: _, minute_to_return: _ } => false
+    RoundRefusedUnleasable { detail: _, minute_to_return: _ } => false
+  }
+}
+
+// A FULL ROUND IS A REFUSAL EXIT, NOT A COMPLETED TURN.
+test fn a_hosted_quota_full_turn_exits_as_a_refusal() -> Bool {
+  let o = TurnHostedQuotaFull { wire: "openrouter-free-models-minute: 20/20", steps_taken: 2 }
+  harness_outcome_label(outcome: o) == "hosted-quota-full"
+    && (match harness_turn_exit(outcome: o) { ExitSuccess => false  ExitFailure { code, reason: _ } => code == 1 })
+}
+
+// ── THE 402 DECODE: limit_source is a closed set and names which budget refused ─────────────
+
+test fn a_402_from_the_key_limit_decodes_to_the_key_spend_limit() -> Bool {
+  match openrouter_decode_error_body(body: "{\"error\":{\"code\":402,\"message\":\"Key limit exceeded\",\"metadata\":{\"limit_source\":\"openrouter_key_limit\",\"remedy_hint\":\"raise the key limit\"}}}") {
+    OpenRouterErrorDecoded { error: OpenRouterPaymentRequired { limit_source: KeySpendLimit, reason: Absent, message: m, remedy_hint: Present { value: _ } } } => m == "Key limit exceeded"
+    OpenRouterErrorDecoded { error: _ } => false
+    OpenRouterErrorUndecodable { cause: _ } => false
+  }
+}
+
+test fn a_402_from_the_in_flight_budget_carries_its_reason() -> Bool {
+  match openrouter_decode_error_body(body: "{\"error\":{\"code\":402,\"message\":\"busy\",\"metadata\":{\"limit_source\":\"openrouter_in_flight_budget\",\"reason\":\"weight_exceeds_budget\"}}}") {
+    OpenRouterErrorDecoded { error: OpenRouterPaymentRequired { limit_source: InFlightBudgetLimit, reason: Present { value: WeightExceedsBudget }, message: _, remedy_hint: Absent } } => true
+    OpenRouterErrorDecoded { error: _ } => false
+    OpenRouterErrorUndecodable { cause: _ } => false
+  }
+}
+
+// RED: an unpublished limit_source refuses rather than decoding as the nearest of three.
+test fn a_402_with_an_unpublished_limit_source_refuses_to_decode() -> Bool {
+  match openrouter_decode_error_body(body: "{\"error\":{\"code\":402,\"message\":\"x\",\"metadata\":{\"limit_source\":\"openrouter_mystery_budget\"}}}") {
+    OpenRouterErrorUndecodable { cause: c } => c.contains("openrouter_mystery_budget")
+    OpenRouterErrorDecoded { error: _ } => false
+  }
+}
+
+// RED: a 402 naming no budget is not decodable as a payment refusal.
+test fn a_402_without_a_limit_source_refuses_to_decode() -> Bool {
+  match openrouter_decode_error_body(body: "{\"error\":{\"code\":402,\"message\":\"x\"}}") {
+    OpenRouterErrorUndecodable { cause: c } => c.contains("limit_source")
+    OpenRouterErrorDecoded { error: _ } => false
+  }
+}
+
+test fn a_429_names_whose_limit_it_was() -> Bool {
+  match openrouter_decode_error_body(body: "{\"error\":{\"code\":429,\"message\":\"slow down\",\"metadata\":{\"error_type\":\"rate_limit_exceeded\",\"provider_code\":\"nvidia\"}}}") {
+    OpenRouterErrorDecoded { error: OpenRouterRateLimited { message: _, provider_code: Present { value: p } } } => p == "nvidia"
+    OpenRouterErrorDecoded { error: _ } => false
+    OpenRouterErrorUndecodable { cause: _ } => false
+  }
+}
+
+// ── THE REASONING LEVEL: mapped to a listed effort or refused ───────────────────────────────
+
+// RED: a listing whose supported efforts lack medium refuses the standard level instead of sending it.
+test fn a_level_mapping_to_an_unlisted_effort_is_refused() -> Bool {
+  match harness_openrouter_reasoning_kwargs(unit: NemotronUltraFreeOnOpenRouter, level: ReasoningStandard, supported: [EffortHigh], mandatory: false) {
+    ReasoningLevelUnsupported { unit: _, level: _, cause: c } => (c as String).contains("medium")
+    ReasoningKwargsAdmitted { kwargs: _ } => false
+  }
+}
+
+// RED: a listing that makes reasoning mandatory refuses the off level.
+test fn reasoning_off_is_refused_where_the_listing_makes_reasoning_mandatory() -> Bool {
+  match harness_openrouter_reasoning_kwargs(unit: NemotronUltraFreeOnOpenRouter, level: ReasoningOff, supported: [EffortHigh, EffortMedium], mandatory: true) {
+    ReasoningLevelUnsupported { unit: _, level: _, cause: _ } => true
+    ReasoningKwargsAdmitted { kwargs: _ } => false
+  }
+}
+
+// CONTROL: the same mapping against the real listing's row sends OpenRouter's reasoning object, never the
+// model's chat-template keys.
+test fn the_standard_level_sends_effort_medium_on_the_real_listing() -> Bool {
+  match harness_reasoning_kwargs_for(unit: NemotronUltraFreeOnOpenRouter, level: ReasoningStandard) {
+    ReasoningKwargsAdmitted { kwargs: k } => {
+      let wire = serialize_json(v: json_object(k))
+      wire.contains("\"effort\": \"medium\"") && !wire.contains("chat_template_kwargs")
+    }
+    ReasoningLevelUnsupported { unit: _, level: _, cause: _ } => false
+  }
+}
+
+// ── THE KEY READ: a key that can spend money is refused ─────────────────────────────────────
+
+test fn a_key_capped_at_zero_on_the_thousand_tier_decodes_both_facts() -> Bool {
+  match openrouter_decode_key_read(body: "{\"data\":{\"limit\":0,\"limit_remaining\":0,\"usage\":0,\"is_free_tier\":false,\"free_model_daily_requests\":{\"used\":3,\"limit\":1000,\"remaining\":997}}}") {
+    OpenRouterKeyDecoded { key: k } =>
+      (match k.spend_limit { KeySpendCappedAtZero => true  KeySpendUncapped => false  KeySpendCappedAbove { lexeme: _ } => false })
+        && (match openrouter_credits_from_daily_limit(daily_limit: k.free_daily_limit) {
+          CreditsTierObserved { credits: CreditsPurchasedAtLeastTen } => true
+          CreditsTierObserved { credits: CreditsPurchasedBelowTen } => false
+          CreditsTierUnrecognized { daily_limit: _ } => false
+        })
+    OpenRouterKeyUndecodable { cause: _ } => false
+  }
+}
+
+// RED: an uncapped key is refused by name.
+test fn an_uncapped_key_is_refused_as_able_to_spend() -> Bool {
+  match openrouter_decode_key_read(body: "{\"data\":{\"limit\":null,\"is_free_tier\":false,\"free_model_daily_requests\":{\"used\":0,\"limit\":1000,\"remaining\":1000}}}") {
+    OpenRouterKeyDecoded { key: k } => hosted_key_refusal(key: k).contains("no credit limit")
+    OpenRouterKeyUndecodable { cause: _ } => false
+  }
+}
+
+// THE TIER SETS THE DAY POOL'S CEILING, and an unpublished ceiling is not a tier.
+test fn the_daily_tier_selects_the_day_pool_ceiling_and_an_unpublished_one_refuses() -> Bool {
+  openrouter_free_models_per_day(credits: CreditsPurchasedAtLeastTen).requests == 1000
+    && openrouter_free_models_per_day(credits: CreditsPurchasedBelowTen).requests == 50
+    && (match openrouter_credits_from_daily_limit(daily_limit: 200) { CreditsTierUnrecognized { daily_limit: n } => n == 200  CreditsTierObserved { credits: _ } => false })
+}
+
+// ── INHABITANCE ON THE REAL PATH ─────────────────────────────────────────────────────────────
+//
+// The real unit's real route, joined from the real listing rows, reaches the real decisions: it is placed
+// by a hosted quota lease rather than a seat; its route is HTTPS and names the listing's model id; the
+// selection over the real field chooses the maximum level for the harness's real max_tokens; and that level
+// renders effort high. Deleting the hosted arm from any of harness_unit_placement, harness_hosted_route_for,
+// the selection or the reasoning seam turns this red.
+test fn the_hosted_nemotron_route_is_quota_leased_https_and_selects_effort_high() -> Bool {
+  match harness_hosted_route_for(unit: NemotronUltraFreeOnOpenRouter) {
+    Absent => false
+    Present { value: route } =>
+      (match harness_unit_placement(unit: NemotronUltraFreeOnOpenRouter) { LeasedFromHostedQuota => true  PlacedOnFleetSeat => false })
+        && (route.url as String).starts_with("https://")
+        && (harness_unit_model_id(unit: NemotronUltraFreeOnOpenRouter) as String) == "nvidia/nemotron-3-ultra-550b-a55b:free"
+        && (match harness_hosted_level_choice(route: route, max_tokens: harness_default_max_token_count) {
+          HostedLevelSelected { level: ReasoningMaximum } =>
+            (match harness_reasoning_kwargs_for(unit: NemotronUltraFreeOnOpenRouter, level: ReasoningMaximum) {
+              ReasoningKwargsAdmitted { kwargs: k } => serialize_json(v: json_object(k)).contains("\"effort\": \"high\"")
+              ReasoningLevelUnsupported { unit: _, level: _, cause: _ } => false
+            })
+          HostedLevelSelected { level: _ } => false
+          HostedLevelUnselected { cause: _ } => false
+        })
+  }
+}
+
+// RED: a max_tokens above the listing's completion ceiling leaves no admissible level, and the selection
+// refuses rather than choosing one.
+test fn a_request_above_the_completion_ceiling_selects_no_level() -> Bool {
+  match harness_hosted_route_for(unit: NemotronUltraFreeOnOpenRouter) {
+    Absent => false
+    Present { value: route } =>
+      match harness_hosted_level_choice(route: route, max_tokens: token_count(count: 70000)) {
+        HostedLevelUnselected { cause: _ } => true
+        HostedLevelSelected { level: _ } => false
+      }
+  }
+}
+
+// ── THE CHARGE FITS ITS WINDOW AT EVERY INSTANT, THROUGH THE REAL POOL ADMISSION ──────────────
+//
+// The pools are the production pools (product.capacity.quota quota_root_pool over the real OpenRouter
+// rows the hosted route carries), the term is the production derivation (gunbc.fabric_quota
+// quota_term_to_window_end), and admission is product.capacity.pool pool_acquire -- the function a
+// partition append adjudicates with. Only the clock is supplied: an instant one second into a UTC day
+// that is also one second into its minute, and instants one second before the minute and the day end.
+data w_day_start: Int = 1780531200
+
+fn w_charge_admitted(limit: UpstreamRateLimit, at: Int) -> Bool {
+  match quota_term_to_window_end(limit: limit, at: at) {
+    Absent => false
+    Present { value: term } =>
+      match pool_acquire(pool: quota_root_pool(limit: limit), reference: "charge" as NonEmptyStr, amount: Measure { count: 1 }, at: at, term_seconds: second_count(s: term)) {
+        PoolAdvanced { pool: _ } => true
+        PoolRefused { refusal: _ } => false
+      }
+  }
+}
+
+test fn a_hosted_charge_fits_both_real_pools_early_and_late_in_their_windows() -> Bool {
+  match harness_hosted_route_for(unit: NemotronUltraFreeOnOpenRouter) {
+    Absent => false
+    Present { value: route } => {
+      let day = openrouter_free_models_per_day(credits: CreditsPurchasedAtLeastTen)
+      w_charge_admitted(limit: route.per_minute, at: w_day_start + 1)
+        && w_charge_admitted(limit: route.per_minute, at: w_day_start + 59)
+        && w_charge_admitted(limit: day, at: w_day_start + 1)
+        && w_charge_admitted(limit: day, at: w_day_start + 86399)
+    }
+  }
+}
+
+// RED, THE DEFECT THIS REPLACED: a lease held for the response deadline cannot fit the minute window at
+// any instant, so the pool refuses it as crossing the lapse.
+test fn a_lease_for_the_response_deadline_crosses_the_minute_lapse() -> Bool {
+  match harness_hosted_route_for(unit: NemotronUltraFreeOnOpenRouter) {
+    Absent => false
+    Present { value: route } =>
+      match pool_acquire(pool: quota_root_pool(limit: route.per_minute), reference: "held" as NonEmptyStr, amount: Measure { count: 1 }, at: w_day_start + 1, term_seconds: second_count(s: harness_request_deadline)) {
+        PoolRefused { refusal: LeaseCrossesLapse { reference: _, expires_at: _, window_end: _ } } => true
+        PoolRefused { refusal: _ } => false
+        PoolAdvanced { pool: _ } => false
+      }
+  }
+}
+
+// ── THE DAY POOL STARTS FROM WHAT THE UPSTREAM SAYS REMAINS ────────────────────────────────────
+//
+// The remaining count is read by the production reader off a decoded key read, recorded through the
+// fold's own observe_upstream_remaining, and then asked for leases through pool_acquire.
+fn w_key_remaining(used: Int, remaining: Int) -> Nat? {
+  match openrouter_decode_key_read(body: join(["{\"data\":{\"limit\":0,\"is_free_tier\":false,\"free_model_daily_requests\":{\"used\":", to_string(used), ",\"limit\":1000,\"remaining\":", to_string(remaining), "}}}"], "")) {
+    OpenRouterKeyDecoded { key: k } =>
+      hosted_day_remaining(key: k)
+    OpenRouterKeyUndecodable { cause: _ } => none
+  }
+}
+
+fn w_observed(pool: Pool<Count, One>, remaining: Nat, at: Int) -> Pool<Count, One>? {
+  let day = openrouter_free_models_per_day(credits: CreditsPurchasedAtLeastTen)
+  match quota_term_to_window_end(limit: day, at: at) {
+    Absent => none
+    Present { value: term } =>
+      match observe_upstream_remaining(pool: pool, remaining: Measure { count: remaining }, at: at, term_seconds: second_count(s: term), reading: join(["witness@", to_string(at)], "") as NonEmptyStr) {
+        PoolAdvanced { pool: p } => Present { value: p }
+        PoolRefused { refusal: _ } => none
+      }
+  }
+}
+
+fn w_day_headroom(pool: Pool<Count, One>, at: Int) -> Int {
+  match pool_reading_at(pool: pool, at: at) {
+    PoolRead { committed: _, ceiling: _, headroom: h, over_committed: _ } => h.count as Int
+    PoolReadingRefused { at: _, anchor: _ } => -1
+  }
+}
+
+// RED: the upstream reports every free request spent (used = limit, remaining = 0) and the local ledger
+// is fresh -- the day pool admits nothing, so no request is ever sent.
+test fn an_exhausted_upstream_day_leaves_a_fresh_day_pool_no_headroom() -> Bool {
+  let day = openrouter_free_models_per_day(credits: CreditsPurchasedAtLeastTen)
+  match w_key_remaining(used: 1000, remaining: 0) {
+    Absent => false
+    Present { value: r } =>
+      match w_observed(pool: quota_root_pool(limit: day), remaining: r, at: w_day_start + 100) {
+        Absent => false
+        Present { value: p } => w_day_headroom(pool: p, at: w_day_start + 101) == 0
+      }
+  }
+}
+
+// A PARTIAL REMAINDER IS RESPECTED EXACTLY, and a later reading claiming more never gives any back.
+test fn a_partial_upstream_remainder_is_the_headroom_and_later_readings_never_replenish() -> Bool {
+  let day = openrouter_free_models_per_day(credits: CreditsPurchasedAtLeastTen)
+  match w_key_remaining(used: 997, remaining: 3) {
+    Absent => false
+    Present { value: r } =>
+      match w_observed(pool: quota_root_pool(limit: day), remaining: r, at: w_day_start + 100) {
+        Absent => false
+        Present { value: p } =>
+          w_day_headroom(pool: p, at: w_day_start + 101) == 3
+            && (match w_observed(pool: p, remaining: 1000, at: w_day_start + 102) {
+              Absent => false
+              Present { value: p2 } => w_day_headroom(pool: p2, at: w_day_start + 103) == 3
+            })
+      }
+  }
+}
+
+// ── A TRANSITION IS CHECKED AGAINST THE FOLDED POOL BEFORE IT IS WRITTEN ─────────────────────────
+//
+// gunbc.fabric_event_log fabric_pool_transition appends only what product.capacity.pool_events
+// pool_apply_payload advances on the folded pool -- the same function replay applies. These supply the
+// folded pool and ask that function, which is the decision the carrier makes before any write.
+fn w_env(id: String, at: Int, payload: PoolEvent) -> ChainEnvelope<PoolEvent> {
+  ChainEnvelope {
+    id: id as EventId,
+    event: ChainEvent { partition: "quota-openrouter-free-models-minute" as PartitionId, parent: none, recorded_at: at, actor: "witness" as NonEmptyStr, payload: payload },
+  }
+}
+
+// RED: the minute lease is taken one second before rollover (its term runs to the window end) and the
+// settlement arrives after it. The transition is refused -- so the checked carrier writes nothing and
+// reports no settlement -- and the CONTROL shows why that matters: the same settlement appended blind
+// makes the whole partition unfoldable.
+test fn a_settlement_after_rollover_is_refused_before_it_could_poison_the_partition() -> Bool {
+  let minute = openrouter_free_models_per_minute
+  let at = w_day_start + 59
+  match quota_term_to_window_end(limit: minute, at: at) {
+    Absent => false
+    Present { value: term } => {
+      let acquired = w_env(id: "e1", at: at, payload: PoolAcquired { reference: "charge" as NonEmptyStr, amount: 1, term_seconds: second_count(s: term) })
+      match pool_fold(root: quota_root_pool(limit: minute), oldest_first: [acquired]) {
+        PoolFoldRefused { at_event: _, wire: _ } => false
+        PoolFolded { pool: p, generation: _ } =>
+          (match pool_apply_payload(pool: p, payload: PoolSettled { reference: "charge" as NonEmptyStr, actual: 1 }, at: w_day_start + 60, identity: "pending:e1" as NonEmptyStr) {
+            PoolRefused { refusal: LeaseAlreadyLapsed { reference: _, lapsed_at: _, at: _ } } => true
+            PoolRefused { refusal: _ } => false
+            PoolAdvanced { pool: _ } => false
+          })
+            && (match pool_apply_payload(pool: p, payload: PoolSettled { reference: "charge" as NonEmptyStr, actual: 1 }, at: at, identity: "pending:e1" as NonEmptyStr) {
+              PoolAdvanced { pool: _ } => true
+              PoolRefused { refusal: _ } => false
+            })
+            && (match pool_fold(root: quota_root_pool(limit: minute), oldest_first: [acquired, w_env(id: "e2", at: w_day_start + 60, payload: PoolSettled { reference: "charge" as NonEmptyStr, actual: 1 })]) {
+              PoolFoldRefused { at_event: e, wire: _ } => (e as String) == "e2"
+              PoolFolded { pool: _, generation: _ } => false
+            })
+      }
+    }
+  }
+}
+
+// TWO DECREASING UPSTREAM READINGS IN ONE SECOND STAY REPLAYABLE: each hold is named by its own event,
+// so the second is not a duplicate of the first, and the pool ends at the lower reading.
+test fn two_decreasing_upstream_readings_in_one_second_fold_to_the_lower() -> Bool {
+  let day = openrouter_free_models_per_day(credits: CreditsPurchasedAtLeastTen)
+  let at = w_day_start + 100
+  match quota_term_to_window_end(limit: day, at: at) {
+    Absent => false
+    Present { value: term } =>
+      match pool_fold(root: quota_root_pool(limit: day), oldest_first: [
+        w_env(id: "o1", at: at, payload: PoolUpstreamObserved { remaining: 3, term_seconds: second_count(s: term) }),
+        w_env(id: "o2", at: at, payload: PoolUpstreamObserved { remaining: 1, term_seconds: second_count(s: term) }),
+      ]) {
+        PoolFoldRefused { at_event: _, wire: _ } => false
+        PoolFolded { pool: p, generation: g } => g == 2 && w_day_headroom(pool: p, at: at) == 1
+      }
+  }
+}
+
+// ── A SEND IN FLIGHT ACROSS THE ROLLOVER IS CHARGED IN THE WINDOW IT MAY ARRIVE IN ───────────────
+//
+// The in-flight partition is the production seat-pool shape (gunbc.harness.harness_seat
+// harness_seat_pool_root) under the production partition name; the carried count is the production
+// hosted_inflight_carried; the charge is the real minute pool's pool_acquire at the amount the round asks
+// for (its own send plus the carried ones). Only the clock and the events are supplied.
+fn w_quota() -> HarnessHostedQuota {
+  HarnessHostedQuota { short_hostname: "witness", actor: "hosted-witness" as NonEmptyStr, per_minute: openrouter_free_models_per_minute, per_day: openrouter_free_models_per_day(credits: CreditsPurchasedAtLeastTen) }
+}
+
+fn w_inflight(events: List<ChainEnvelope<PoolEvent>>) -> Pool<Count, One>? {
+  match pool_fold(root: harness_seat_pool_root(partition: hosted_inflight_partition(quota: w_quota()), ceiling: 20), oldest_first: events) {
+    PoolFolded { pool: p, generation: _ } => Present { value: p }
+    PoolFoldRefused { at_event: _, wire: _ } => none
+  }
+}
+
+// The minute after the rollover, with `n` sends already charged and settled in it.
+fn w_minute_with(n: Nat, at: Int) -> Pool<Count, One>? {
+  fold(nat_range_inclusive(lo: 1, hi: n), init: Present { value: quota_root_pool(limit: openrouter_free_models_per_minute) }, f: (acc, i) =>
+    match acc {
+      Absent => none
+      Present { value: p } => {
+        let r = join(["charged-", to_string(i)], "") as NonEmptyStr
+        match pool_acquire(pool: p, reference: r, amount: Measure { count: 1 }, at: at, term_seconds: 1) {
+          PoolRefused { refusal: _ } => none
+          PoolAdvanced { pool: q } =>
+            match pool_settle(pool: q, reference: r, actual: Measure { count: 1 }, at: at) {
+              PoolRefused { refusal: _ } => none
+              PoolAdvanced { pool: settled } => Present { value: settled }
+            }
+        }
+      }
+    })
+}
+
+fn w_round_admitted(minute: Pool<Count, One>, carried: Nat, at: Int) -> Bool {
+  match quota_term_to_window_end(limit: openrouter_free_models_per_minute, at: at) {
+    Absent => false
+    Present { value: term } =>
+      match pool_acquire(pool: minute, reference: "this-round" as NonEmptyStr, amount: Measure { count: carried + 1 }, at: at, term_seconds: second_count(s: term)) {
+        PoolAdvanced { pool: _ } => true
+        PoolRefused { refusal: _ } => false
+      }
+  }
+}
+
+// RED: a send admitted at T+58 pauses across the rollover and is still in flight at T+61. With 19 sends
+// already charged in the new minute, the next round must cover 2 -- its own and the carried one -- so it
+// refuses: no request goes out in a window whose quota the paused send may already have spent. The same
+// round with nothing carried is admitted, so the refusal is the carried send's.
+test fn a_send_paused_across_the_rollover_is_charged_in_the_next_window() -> Bool {
+  match w_inflight(events: [w_env(id: "s1", at: w_day_start + 58, payload: PoolAcquired { reference: "paused" as NonEmptyStr, amount: 1, term_seconds: 2348 })]) {
+    Absent => false
+    Present { value: inflight } =>
+      match quota_window_start(limit: openrouter_free_models_per_minute, at: w_day_start + 61) {
+        Absent => false
+        Present { value: start } =>
+          match w_minute_with(n: 19, at: w_day_start + 60) {
+            Absent => false
+            Present { value: minute } => {
+              let carried = hosted_inflight_carried(pool: inflight, window_start: start)
+              carried == 1
+                && !w_round_admitted(minute: minute, carried: carried, at: w_day_start + 61)
+                && w_round_admitted(minute: minute, carried: 0, at: w_day_start + 61)
+            }
+          }
+      }
+  }
+}
+
+// CONTROL: a send made inside its window whose answer arrives much later carries nothing into later
+// windows once its transport returns and its seat is released -- and the send is counted in its own window
+// only once, by its own charge, not by the in-flight count.
+test fn a_send_released_after_a_late_response_carries_nothing_forward() -> Bool {
+  match w_inflight(events: [
+    w_env(id: "s1", at: w_day_start + 10, payload: PoolAcquired { reference: "slow-answer" as NonEmptyStr, amount: 1, term_seconds: 2348 }),
+    w_env(id: "s2", at: w_day_start + 300, payload: PoolReleased { reference: "slow-answer" as NonEmptyStr, reason: "the transport returned" as NonEmptyStr }),
+  ]) {
+    Absent => false
+    Present { value: inflight } =>
+      hosted_inflight_carried(pool: inflight, window_start: w_day_start + 300) == 0
+        && hosted_inflight_carried(pool: inflight, window_start: w_day_start) == 0
+  }
+}
+
+// A SEAT HELD BY A HOLDER THAT DIED IS NAMED WITH ITS RELEASE, so a starved route says what to free.
+test fn a_held_inflight_seat_is_named_with_its_release_in_the_refusal_hint() -> Bool {
+  let events = [w_env(id: "s1", at: w_day_start + 58, payload: PoolAcquired { reference: "worker-7@1780531258#round3" as NonEmptyStr, amount: 1, term_seconds: 2348 })]
+  match w_inflight(events: events) {
+    Absent => false
+    Present { value: inflight } => {
+      let hint = hosted_inflight_release_hint(quota: w_quota(), pool: inflight, generation: 1, walk: ChainWalked { oldest_first: events })
+      hint.contains("worker-7@1780531258#round3") && hint.contains("grant=s1") && hint.contains("harness_release_cli")
+        && hint.contains(hosted_inflight_partition(quota: w_quota()) as String)
+    }
+  }
+}
+
+// ── A 429 FROM THE UPSTREAM IS THE TYPED BACKSTOP, AND IT IS NEVER RETRIED ───────────────────────────
+//
+// The decode is the production decode over the shapes the limits page documents: the error body, and the
+// header dump curl writes (the status line starts a block; only the last block is the answer).
+data w_429_body: String = "{\"error\":{\"code\":429,\"message\":\"Rate limit exceeded: free-models-per-min\",\"metadata\":{\"error_type\":\"rate_limit_exceeded\"}}}"
+
+data w_429_headers: String = "HTTP/2 429\r\ncontent-type: application/json\r\nretry-after: 30\r\nx-ratelimit-limit: 20\r\nx-ratelimit-remaining: 0\r\nx-ratelimit-reset: 1791265800000\r\n\r\n"
+
+test fn a_429_decodes_to_the_typed_refusal_with_the_upstreams_retry_hints() -> Bool {
+  match openrouter_decode_rate_limited(body: w_429_body, header_dump: HeaderDumpRead { text: w_429_headers }) {
+    Absent => false
+    Present { value: r } =>
+      (match r.hints.retry_after { RetryAfterSeconds { seconds: n } => second_count(s: n) == 30  RetryAfterUnparsed { text: _ } => false  RetryAfterAbsent => false  RetryAfterUnread { cause: _ } => false })
+        && (match r.hints.reset { Present { value: v } => v == "1791265800000"  Absent => false })
+        && (match r.hints.remaining { Present { value: v } => v == "0"  Absent => false })
+        && (match r.provider_code { Absent => true  Present { value: _ } => false })
+        && openrouter_rate_limit_wire(r: r).contains("Retry-After 30 s")
+        && openrouter_rate_limit_wire(r: r).contains("unit not documented")
+        && openrouter_rate_limit_wire(r: r).contains("NOT retried")
+  }
+}
+
+// A RETRY-AFTER THAT IS NOT DELTA-SECONDS IS CARRIED AS TEXT, never read as a number it is not; and a
+// refusal with no hint headers is still a typed refusal, saying so. The LAST block of a dump is the answer.
+test fn a_retry_after_that_is_not_seconds_and_a_missing_hint_are_stated_not_guessed() -> Bool {
+  (match openrouter_decode_rate_limited(body: w_429_body, header_dump: HeaderDumpRead { text: "HTTP/2 429\r\nretry-after: Wed, 21 Oct 2026 07:28:00 GMT\r\n\r\n" }) {
+    Present { value: r } => (match r.hints.retry_after { RetryAfterUnparsed { text: t } => t.contains("21 Oct 2026")  RetryAfterSeconds { seconds: _ } => false  RetryAfterAbsent => false  RetryAfterUnread { cause: _ } => false })
+    Absent => false
+  })
+    && (match openrouter_decode_rate_limited(body: w_429_body, header_dump: HeaderDumpRead { text: "HTTP/1.1 429 Too Many Requests\r\nRetry-After: 12\r\nX-RateLimit-Reset: 5\r\n\r\n" }) {
+      Present { value: r } => (match r.hints.retry_after { RetryAfterSeconds { seconds: n } => second_count(s: n) == 12  RetryAfterUnparsed { text: _ } => false  RetryAfterAbsent => false  RetryAfterUnread { cause: _ } => false })
+        && (match r.hints.reset { Present { value: v } => v == "5"  Absent => false })
+      Absent => false
+    })
+    && (match openrouter_decode_rate_limited(body: w_429_body, header_dump: HeaderDumpRead { text: "" }) {
+      Present { value: r } => (match r.hints.retry_after { RetryAfterAbsent => true  RetryAfterSeconds { seconds: _ } => false  RetryAfterUnparsed { text: _ } => false  RetryAfterUnread { cause: _ } => false }) && openrouter_rate_limit_wire(r: r).contains("no Retry-After")
+      Absent => false
+    })
+    && (match openrouter_decode_rate_limited(body: w_429_body, header_dump: HeaderDumpRead { text: "HTTP/1.1 100 Continue\r\nretry-after: 99\r\n\r\nHTTP/2 429\r\nretry-after: 7\r\n\r\n" }) {
+      Present { value: r } => (match r.hints.retry_after { RetryAfterSeconds { seconds: n } => second_count(s: n) == 7  RetryAfterUnparsed { text: _ } => false  RetryAfterAbsent => false  RetryAfterUnread { cause: _ } => false })
+      Absent => false
+    })
+}
+
+// RED: a header dump that could not be read is NOT "no Retry-After". The upstream may have sent a hint that
+// this process failed to read, so the refusal says the hint is unknown and why, and carries no reset or counters.
+test fn an_unread_header_dump_is_stated_unknown_not_reported_as_no_retry_after() -> Bool {
+  match openrouter_decode_rate_limited(body: w_429_body, header_dump: HeaderDumpUnread { cause: "the dump file is absent" }) {
+    Absent => false
+    Present { value: r } =>
+      (match r.hints.retry_after { RetryAfterUnread { cause: c } => c.contains("dump file is absent")  RetryAfterAbsent => false  RetryAfterSeconds { seconds: _ } => false  RetryAfterUnparsed { text: _ } => false })
+        && (match r.hints.reset { Absent => true  Present { value: _ } => false })
+        && openrouter_rate_limit_wire(r: r).contains("Retry-After unknown")
+        && !openrouter_rate_limit_wire(r: r).contains("no Retry-After")
+        && openrouter_rate_limit_wire(r: r).contains("NOT retried")
+  }
+}
+
+// RED: delay-seconds is 1*DIGIT, and the integer parser would accept a sign, so a signed, fractional or
+// unit-suffixed value is carried as text and never read as a number of seconds.
+fn w_retry_after_of(value: String) -> OpenRouterRetryAfter? {
+  match openrouter_decode_rate_limited(body: w_429_body, header_dump: HeaderDumpRead { text: join(["HTTP/2 429\r\nretry-after: ", value, "\r\n\r\n"], "") }) {
+    Present { value: r } => Present { value: r.hints.retry_after }
+    Absent => none
+  }
+}
+
+fn w_is_unparsed(r: OpenRouterRetryAfter?) -> Bool {
+  match r {
+    Present { value: RetryAfterUnparsed { text: _ } } => true
+    Present { value: RetryAfterSeconds { seconds: _ } } => false
+    Present { value: RetryAfterAbsent } => false
+    Present { value: RetryAfterUnread { cause: _ } } => false
+    Absent => false
+  }
+}
+
+test fn a_signed_fractional_or_suffixed_retry_after_is_not_read_as_seconds() -> Bool {
+  w_is_unparsed(r: w_retry_after_of(value: "+30"))
+    && w_is_unparsed(r: w_retry_after_of(value: "-0"))
+    && w_is_unparsed(r: w_retry_after_of(value: "-30"))
+    && w_is_unparsed(r: w_retry_after_of(value: "3.5"))
+    && w_is_unparsed(r: w_retry_after_of(value: "30s"))
+    && (match w_retry_after_of(value: "30") { Present { value: RetryAfterSeconds { seconds: n } } => second_count(s: n) == 30  Present { value: _ } => false  Absent => false })
+}
+
+// RED: a 402, or any body that is not a 429, is NOT a rate-limit refusal -- it keeps its own typed error
+// (the 402 limit_source decode above), so a paid-model refusal is never read as a wait-and-retry.
+test fn only_a_429_is_a_rate_limit_refusal() -> Bool {
+  (match openrouter_decode_rate_limited(body: "{\"error\":{\"code\":402,\"message\":\"x\",\"metadata\":{\"limit_source\":\"openrouter_key_limit\"}}}", header_dump: HeaderDumpRead { text: w_429_headers }) {
+    Absent => true
+    Present { value: _ } => false
+  })
+    && (match openrouter_decode_rate_limited(body: "not json", header_dump: HeaderDumpRead { text: w_429_headers }) { Absent => true  Present { value: _ } => false })
+}
+
+// THE TURN ENDS ON IT. It is a terminal outcome of the turn -- there is no retry arm in the loop to take --
+// and a refusal exit that says it was not retried and carries the hint into the operator's line.
+test fn a_hosted_rate_limit_ends_the_turn_as_a_refusal_naming_the_hint_and_no_retry() -> Bool {
+  match openrouter_decode_rate_limited(body: w_429_body, header_dump: HeaderDumpRead { text: w_429_headers }) {
+    Absent => false
+    Present { value: r } => {
+      let o = TurnHostedRateLimited { refusal: r, steps_taken: 3 }
+      harness_outcome_label(outcome: o) == "hosted-rate-limited"
+        && harness_outcome_detail(outcome: o).contains("Retry-After 30 s")
+        && harness_outcome_detail(outcome: o).contains("rather than retrying")
+        && (match harness_turn_exit(outcome: o) { ExitSuccess => false  ExitFailure { code, reason: _ } => code == 1 })
+    }
+  }
+}
+
+// ── THE SPENDABLE-KEY WALL, AT THE FUNCTION THAT ENFORCES IT ─────────────────────────────────────
+//
+// hosted_access_from_key is what refuses to build a binding; a witness over the rendering helper beside it
+// would stay green if the wall were removed. These decode real key reads and ask the wall itself.
+fn w_bind_from_key(limit_json: String, daily_limit: Int) -> Bool? {
+  match openrouter_decode_key_read(body: join(["{\"data\":{\"limit\":", limit_json, ",\"is_free_tier\":false,\"free_model_daily_requests\":{\"used\":0,\"limit\":", to_string(daily_limit), ",\"remaining\":", to_string(daily_limit), "}}}"], "")) {
+    OpenRouterKeyUndecodable { cause: _ } => none
+    OpenRouterKeyDecoded { key: k } =>
+      match harness_hosted_route_for(unit: NemotronUltraFreeOnOpenRouter) {
+        Absent => none
+        Present { value: route } =>
+          match hosted_access_from_key(route: route, key: k, level: ReasoningMaximum, header_dir: "/tmp/witness" as NonEmptyStr, header_file: "/tmp/witness/authorization" as NonEmptyStr, short_hostname: "witness", actor: "witness" as NonEmptyStr) {
+            Absent => Present { value: false }
+            Present { value: _ } => Present { value: true }
+          }
+      }
+  }
+}
+
+// RED: a key with no credit limit, and one with a positive limit, can spend money on a priced model, so no
+// binding is built; the zero-credit key on a published tier is the only one that is. A tier that is neither
+// published value refuses even on the safe key.
+test fn only_a_zero_credit_key_on_a_published_tier_builds_a_binding() -> Bool {
+  (match w_bind_from_key(limit_json: "null", daily_limit: 1000) { Present { value: b } => !b  Absent => false })
+    && (match w_bind_from_key(limit_json: "5", daily_limit: 1000) { Present { value: b } => !b  Absent => false })
+    && (match w_bind_from_key(limit_json: "0", daily_limit: 200) { Present { value: b } => !b  Absent => false })
+    && (match w_bind_from_key(limit_json: "0", daily_limit: 1000) { Present { value: b } => b  Absent => false })
+    && (match w_bind_from_key(limit_json: "0.0", daily_limit: 50) { Present { value: b } => b  Absent => false })
+}
+
+// ── THE REAL LEASE PRODUCER IS EXECUTED, THROUGH THE PRODUCTION CHARGE ───────────────────────────
+//
+// The constructed leases above are for the decision's own boundary. This runs the PRODUCTION charge
+// (harness_hosted_round_charge -> gunbc.fabric_quota fabric_quota_lease_for) for a host the fleet declares no
+// dashboard instance for: the real producer answers with its typed refusal, the charge turns it into
+// HostedRoundUnleasable naming the host, and nothing is leased, charged or sent. Deleting the producer, or
+// the charge's call to it, turns this red.
+//
+// WHAT THIS DOES NOT EXECUTE, STATED: the producer's success arm -- a seat acquired and settled on a real
+// event-log store -- needs a store, and the floor refuses a new real-execution witness
+// (v2.workflow.floor_changed_witness), so no claim here can stand one up. Its pieces are witnessed at their
+// own interfaces above: the term derivation and admission through the production pool_acquire, and the
+// checked settlement through the replay's own pool_apply_payload. The joined route runs in the post-merge
+// live exercise.
+fn w_unplaced_quota() -> HarnessHostedQuota {
+  HarnessHostedQuota { short_hostname: "no-such-host-witness", actor: "hosted-witness" as NonEmptyStr, per_minute: openrouter_free_models_per_minute, per_day: openrouter_free_models_per_day(credits: CreditsPurchasedAtLeastTen) }
+}
+
+test fn the_production_charge_refuses_through_the_real_lease_producer_for_an_undeclared_host() -> Bool {
+  (match harness_hosted_round_charge(quota: w_unplaced_quota(), carried_minute: 0, carried_day: 0, release_hint: "") {
+    HostedRoundUnleasable { detail: d } => d.contains("no dashboard instance is declared for host no-such-host-witness")
+    HostedRoundCharged => false
+    HostedRoundQuotaFull { wire: _ } => false
+  })
+    && (match fabric_quota_lease_for(short_hostname: "no-such-host-witness", limit: openrouter_free_models_per_minute, amount: 1, actor: "hosted-witness" as NonEmptyStr, term: QuotaTermToWindowEnd) {
+      QuotaLeaseRefused { detail: d } => d.contains("no dashboard instance is declared")
+      QuotaLeased { grant: _, partition: _, store: _, limit: _ } => false
+      QuotaFull { wire: _ } => false
+    })
+}
+
+// A SETTLEMENT OF A LEASE THAT NEVER EXISTED IS A TYPED REFUSAL, not a recorded charge.
+test fn settling_a_refused_lease_records_nothing() -> Bool {
+  match fabric_quota_settle_at(lease: QuotaLeaseRefused { detail: "no dashboard instance is declared for host x" }, actual: 1, now: w_day_start + 59) {
+    QuotaSettleRefused { detail: d } => d.contains("nothing to settle")
+    QuotaSettled { partition: _, actual: _ } => false
+  }
+}
diff --git a/dag/test/claim/owned_directory_witness_test.dag b/dag/test/claim/owned_directory_witness_test.dag
new file mode 100644
index 00000000000..5f1546fb529
--- /dev/null
+++ b/dag/test/claim/owned_directory_witness_test.dag
@@ -0,0 +1,133 @@
+module test.claim.owned_directory_witness_test
+
+import std.types { Bool, String, NonEmptyStr, FilePath }
+import extdeps.posix.identity { PosixOwnerNames }
+import gunbc.managed_directory { DirectoryOwnerOnly }
+import gunbc.ensure { EnsureMayApply, EnsureObserveOnly, EnsureObservation, EnsureObserved, EnsureAbsent, EnsureInaccessible }
+import std.upsert_decision { Noop, Apply, Refuse }
+import gunbc.owned_directory {
+  OwnedDirectoryTarget, OwnedDirectoryDeclared, OwnedDirectoryReading,
+  owned_directory_decide, owned_directory_reading_of_stat_line, owned_directory_observe,
+  ObserverRead, ObserverReadOut, ObserverReadFailed, ObserverFailure, ObserverNotSpawned, ObserverExited, ObserverTransportRefused,
+  owned_directory_ensure, OwnedDirectoryEnsured, OwnedDirectoryEnsureRefused,
+}
+
+// THE PROVIDER'S DECISION TABLE, over supplied observations (DESIGN 3: one interface, supplied values).
+// The real path -- a stat line read off a host and parsed -- is inhabited by the parse claims below and
+// by the live_deploy route claims in test.claim.live_deploy.owned_directory_route_witness_test.
+
+fn target() -> OwnedDirectoryTarget {
+  OwnedDirectoryDeclared {
+    member: "auth-sessions" as NonEmptyStr,
+    path: "/srv/instance/auth-sessions" as FilePath,
+    owner: PosixOwnerNames { user: "svc" as NonEmptyStr, group: "svc" as NonEmptyStr },
+    mode: DirectoryOwnerOnly,
+  }
+}
+
+fn observed(line: String) -> EnsureObservation<OwnedDirectoryReading> {
+  owned_directory_observe(path: "/srv/instance/auth-sessions" as FilePath, list: p => ObserverReadOut { stdout: "auth-sessions\n" }, stat: p => ObserverReadOut { stdout: line })
+}
+
+fn decision_label(o: EnsureObservation<OwnedDirectoryReading>, may_apply: Bool) -> String {
+  match owned_directory_decide(policy: if may_apply { EnsureMayApply } else { EnsureObserveOnly }, target: target(), observation: o) {
+    Noop => "noop"
+    Apply { plan: _ } => "apply"
+    Refuse { reason } => join(["refuse:", reason as String], "")
+  }
+}
+
+// The stat line parses into owner, group and mode; a malformed line is no reading at all.
+test fn the_stat_identity_line_parses_and_a_malformed_line_does_not() -> Bool {
+  let parsed = match owned_directory_reading_of_stat_line(line: "directory|svc|svc|700\n") {
+    Present { value: r } => r.is_directory && (r.owner.user as String) == "svc"
+    Absent => false
+  }
+  let malformed = match owned_directory_reading_of_stat_line(line: "directory|svc|700") {
+    Present { value: _ } => false
+    Absent => true
+  }
+  parsed && malformed
+}
+
+// CONVERGED -> NOOP: a second apply over a converged directory does nothing.
+test fn a_converged_directory_is_noop() -> Bool {
+  decision_label(o: observed(line: "directory|svc|svc|700"), may_apply: true) == "noop"
+}
+
+// FOREIGN OWNER -> REFUSE, NEVER ADOPTED, under May-apply. The red control is the same directory under
+// the demanded owner, which is Noop.
+test fn a_foreign_owner_refuses_and_is_never_adopted() -> Bool {
+  starts_with(s: decision_label(o: observed(line: "directory|root|root|700"), may_apply: true), prefix: "refuse:")
+    && string_contains(s: decision_label(o: observed(line: "directory|root|root|700"), may_apply: true), pattern: "never adopted")
+}
+
+// A NON-DIRECTORY IS NEVER REPLACED.
+test fn a_non_directory_refuses() -> Bool {
+  starts_with(s: decision_label(o: observed(line: "regular file|svc|svc|700"), may_apply: true), prefix: "refuse:")
+}
+
+// ── THE OBSERVATION CONTRACT: ABSENCE IS ESTABLISHED BY A READ, NEVER INFERRED FROM A FAILURE ────
+//
+// Routes are stubbed at the contract (DESIGN 3: supplied values at one interface): `list` and `stat`
+// return what a read of one directory returned, or the typed origin of why nothing was read.
+fn listing(stdout: String) -> ObserverRead { ObserverReadOut { stdout: stdout } }
+
+fn observe_with(list: fn(FilePath) -> ObserverRead, stat: fn(FilePath) -> ObserverRead) -> EnsureObservation<OwnedDirectoryReading> {
+  owned_directory_observe(path: "/srv/instance/auth-sessions" as FilePath, list: list, stat: stat)
+}
+
+data missing_observer: ObserverFailure = ObserverNotSpawned { cause: "No such file or directory" }
+
+// GREEN POSITIVE: the parent's listing was read and does not name the directory -> absent -> May-apply
+// installs. And a parent that is itself not listed in ITS parent makes the child absent too.
+test fn a_parent_listing_that_omits_the_directory_establishes_absence() -> Bool {
+  decision_label(o: observe_with(list: p => listing(stdout: "other\nauth-jwks\n"), stat: p => listing(stdout: "")), may_apply: true) == "apply"
+    && decision_label(o: observe_with(
+      list: p => if (p as String) == "/srv/instance" { ObserverReadFailed { origin: ObserverExited { exit_code: 2, stderr: "" } } } else { listing(stdout: "bin\n") },
+      stat: p => listing(stdout: ""),
+    ), may_apply: true) == "apply"
+}
+
+// LISTED, THEN STAT: a listed directory at the demanded identity is converged.
+test fn a_listed_directory_reads_its_identity_from_stat() -> Bool {
+  decision_label(o: observe_with(list: p => listing(stdout: "auth-sessions\n"), stat: p => listing(stdout: "directory|svc|svc|700")), may_apply: true) == "noop"
+}
+
+// A MISSING OBSERVER EXECUTABLE IS NOT AN ABSENT DIRECTORY, whatever text it carries: the listing was
+// never read, so presence is unestablished -> refuse. ZERO INSTALL CALLS: the provider is driven with a
+// `run` that would report failure; had it been called, the receipt would carry "Apply was paired with
+// NotApplied". Its GREEN POSITIVE is the same provider over an established absence, where run IS called.
+test fn a_missing_observer_executable_is_inaccessible_and_installs_nothing() -> Bool {
+  let unread = p => ObserverReadFailed { origin: missing_observer }
+  let exited = p => ObserverReadFailed { origin: ObserverExited { exit_code: 127, stderr: "env: '/usr/bin/ls': No such file or directory" } }
+  starts_with(s: decision_label(o: observe_with(list: unread, stat: unread), may_apply: true), prefix: "refuse:")
+    && starts_with(s: decision_label(o: observe_with(list: exited, stat: exited), may_apply: true), prefix: "refuse:")
+    && match owned_directory_ensure(policy: EnsureMayApply, target: target(), observe: p => observe_with(list: unread, stat: unread), run: plan => false) {
+      OwnedDirectoryEnsured { target: _, converged: _ } => false
+      OwnedDirectoryEnsureRefused { target: _, reason } => !string_contains(s: reason, pattern: "Apply was paired with NotApplied")
+    }
+    && match owned_directory_ensure(policy: EnsureMayApply, target: target(), observe: p => observe_with(list: q => listing(stdout: ""), stat: q => listing(stdout: "")), run: plan => false) {
+      OwnedDirectoryEnsured { target: _, converged: _ } => false
+      OwnedDirectoryEnsureRefused { target: _, reason } => string_contains(s: reason, pattern: "Apply was paired with NotApplied")
+    }
+}
+
+// A TRANSPORT FAILURE CARRYING THE SAME TEXT IS INACCESSIBLE, and so is a refused grant (an observer
+// that ran and exited nonzero): the origin is typed, and no failed read establishes anything.
+test fn a_transport_or_grant_failure_is_inaccessible() -> Bool {
+  starts_with(s: decision_label(o: observe_with(list: p => ObserverReadFailed { origin: ObserverTransportRefused { cause: "ssh: /srv/x: No such file or directory" } }, stat: p => listing(stdout: "")), may_apply: true), prefix: "refuse:")
+    && starts_with(s: decision_label(o: observe_with(list: p => ObserverReadFailed { origin: ObserverExited { exit_code: 1, stderr: "sudo: a password is required" } }, stat: p => listing(stdout: "")), may_apply: true), prefix: "refuse:")
+    && starts_with(s: decision_label(o: observe_with(list: p => listing(stdout: "auth-sessions\n"), stat: p => ObserverReadFailed { origin: ObserverExited { exit_code: 1, stderr: "Permission denied" } }), may_apply: true), prefix: "refuse:")
+}
+// OBSERVE-ONLY AND ABSENT -> REFUSE; May-apply on the same observation applies.
+test fn observe_only_absent_refuses() -> Bool {
+  let absent = EnsureAbsent { reason: "absent" }
+  starts_with(s: decision_label(o: absent, may_apply: false), prefix: "refuse:")
+    && decision_label(o: absent, may_apply: true) == "apply"
+}
+
+// A MODE DRIFT ON THE DEMANDED OWNER'S DIRECTORY IS REPAIRED, not refused.
+test fn a_mode_drift_on_the_owners_directory_applies() -> Bool {
+  decision_label(o: observed(line: "directory|svc|svc|755"), may_apply: true) == "apply"
+}
diff --git a/dag/test/claim/parse_test_alias_decl_carry_test.dag b/dag/test/claim/parse_test_alias_decl_carry_test.dag
new file mode 100644
index 00000000000..f00a4e11ec6
--- /dev/null
+++ b/dag/test/claim/parse_test_alias_decl_carry_test.dag
@@ -0,0 +1,173 @@
+module test.claim.parse_test_alias_decl_carry
+
+import v2.std.diagnostic { Accepted, Outcome, Rejected }
+import v2.std.node { Authored, Edge, Node, Positional, StructuralLabel, node_subtree_nodes }
+import v2.std.namespace_alias { AliasBindingRow }
+import v2.std.qualified_name { qualified_name_from_dotted_string }
+import v2.compiler.normalized_tree { NormalizedTree }
+import v2.std.symbol_index {
+  LexicalAmbiguous,
+  LexicalHit,
+  LexicalUnbound,
+  SymbolIndex,
+  symbol_index_lexical_lookup
+}
+import v2.test.parse.alias_decl_parse {
+  alias_amb_a_source,
+  alias_amb_b_source,
+  alias_amb_subject_source,
+  alias_decl_fill_parse_source,
+  alias_decl_index_of,
+  alias_decl_lookup_hits_target,
+  alias_decl_normalized,
+  alias_decl_resolve_verdict,
+  alias_decl_unresolved_source
+}
+
+// THE `alias Name = a.b.C` CARRY, CLAIMED ON THE PER-PR PATH (gunbc#13428; ruling B, the grammar
+// program). Each subject is produced ONCE from real source by a NULLARY producer below, and every
+// producer is read by at least two claims, so the required floor fills it once and nets the fill from
+// the claim that pays it (v2.workflow.floor_pure_producer_share): each claim is charged only for its
+// own assertion. Producing from source rather than supplying a built tree is deliberate -- the
+// subject IS the route (graft dissolves the declaration, normalize captures its row, the fill binds
+// it), and a supplied tree would assert a shape nothing produced (DESIGN section 3, the pairing rule).
+// The discriminating red is enrolled, not transcribed: alias_decl_graft_dissolves_the_declaration_holds
+// asserts the absence of exactly the self-binding member this class names, so it is false whenever
+// v2.compiler.namespace_graft grafts the alias as a member again.
+
+data acd_fill_module: String = "v2.test.parse.alias_decl_fill_probe"
+
+data acd_fill_target: String = "v2.test.parse.alias_decl_fill_probe.AliasTargetType"
+
+fn acd_fill_tree() -> Outcome<NormalizedTree> {
+  alias_decl_normalized(text: alias_decl_fill_parse_source, file: ^alias_decl_fill_probe)
+}
+
+fn acd_edge_names(e: Edge, name: Symbol) -> Bool {
+  match e.label {
+    Authored { name: s } => s == name
+    StructuralLabel { label: _ } => false
+    Positional => false
+  }
+}
+
+fn acd_names_a_member(root: Node, name: Symbol) -> Bool {
+  fold(node_subtree_nodes(root: root), init: false, f: fn(acc, n) {
+    acc || fold(n.children, init: false, f: fn(a, e) { a || acd_edge_names(e: e, name: name) })
+  })
+}
+
+// ROUTE, GRAFT: the declaration dissolved, so the normalized root names no member AliasBinding.
+test fn alias_decl_graft_dissolves_the_declaration_holds() -> Bool {
+  match acd_fill_tree() {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: t, diagnostics: _ } =>
+      !acd_names_a_member(root: t.root, name: ^AliasBinding)
+        && acd_names_a_member(root: t.root, name: ^AliasTargetType)
+  }
+}
+
+// ROUTE, CAPTURE: normalize carried exactly the one row, binding AliasBinding to its target.
+test fn alias_decl_normalize_captures_the_binding_row_holds() -> Bool {
+  match acd_fill_tree() {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: t, diagnostics: _ } =>
+      t.import_bindings == [
+        AliasBindingRow { binding: ^AliasBinding, target: qualified_name_from_dotted_string(dotted: acd_fill_target) }
+      ]
+  }
+}
+
+// ROUTE, BIND: the alias name's lexical hit at its module IS the target's node (the #13375 control,
+// flipped: before the interim refusal the hit was the alias's own grafted node).
+test fn alias_decl_name_resolves_to_its_target_holds() -> Bool {
+  match acd_fill_tree() {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: t, diagnostics: _ } =>
+      alias_decl_lookup_hits_target(
+        idx: alias_decl_index_of(trees: [t]),
+        position: acd_fill_module,
+        name: ^AliasBinding,
+        target: acd_fill_target
+      )
+  }
+}
+
+// AN ALIAS TO A TARGET NOTHING DECLARES: the row stays deferred at the fill's fixed point, so the name
+// is UNBOUND (never a hit on its own node), and resolution refuses the reference that wanted it,
+// located at that reference (docs/plans/namespace-resolution-design.md section 13).
+fn acd_unresolved_tree() -> Outcome<NormalizedTree> {
+  alias_decl_normalized(text: alias_decl_unresolved_source, file: ^alias_decl_unresolved_probe)
+}
+
+test fn alias_decl_to_an_undeclared_target_is_unbound_holds() -> Bool {
+  match acd_unresolved_tree() {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: t, diagnostics: _ } =>
+      match symbol_index_lexical_lookup(
+        index: alias_decl_index_of(trees: [t]),
+        position: qualified_name_from_dotted_string(dotted: "v2.test.parse.alias_decl_unresolved_probe"),
+        name: ^Missing
+      ) {
+        LexicalUnbound => true
+        LexicalHit { node: _, path: _ } => false
+        LexicalAmbiguous { candidates: _ } => false
+      }
+  }
+}
+
+test fn alias_decl_to_an_undeclared_target_refuses_at_the_reference_holds() -> Bool {
+  match acd_unresolved_tree() {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: t, diagnostics: _ } =>
+      alias_decl_resolve_verdict(t: t, module: "v2.test.parse.alias_decl_unresolved_probe")
+        == "resolve_reason_unbound_symbol@Missing"
+  }
+}
+
+// AN ALIAS DISAMBIGUATES WHAT UNIQUE-ON-CHAIN REFUSES: two imports bind X at the subject, so X is
+// Ambiguous there; `alias AX = ...alias_amb_a.X` names one of them under a name only it binds.
+fn acd_amb_index() -> Outcome<SymbolIndex> {
+  match alias_decl_normalized(text: alias_amb_a_source, file: ^alias_amb_a_probe) {
+    Rejected { diagnostics: d } => Rejected { diagnostics: d }
+    Accepted { value: a, diagnostics: _ } =>
+      match alias_decl_normalized(text: alias_amb_b_source, file: ^alias_amb_b_probe) {
+        Rejected { diagnostics: d } => Rejected { diagnostics: d }
+        Accepted { value: b, diagnostics: _ } =>
+          match alias_decl_normalized(text: alias_amb_subject_source, file: ^alias_amb_s_probe) {
+            Rejected { diagnostics: d } => Rejected { diagnostics: d }
+            Accepted { value: s, diagnostics: _ } =>
+              Accepted { value: alias_decl_index_of(trees: [a, b, s]), diagnostics: v2.std.diagnostic.None }
+          }
+      }
+  }
+}
+
+test fn two_imports_of_one_name_stay_ambiguous_beside_an_alias_holds() -> Bool {
+  match acd_amb_index() {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: idx, diagnostics: _ } =>
+      match symbol_index_lexical_lookup(
+        index: idx,
+        position: qualified_name_from_dotted_string(dotted: "v2.test.parse.alias_amb_s"),
+        name: ^X
+      ) {
+        LexicalAmbiguous { candidates: _ } => true
+        LexicalHit { node: _, path: _ } => false
+        LexicalUnbound => false
+      }
+  }
+}
+
+test fn an_alias_resolves_one_of_two_ambiguous_imports_holds() -> Bool {
+  match acd_amb_index() {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: idx, diagnostics: _ } =>
+      alias_decl_lookup_hits_target(
+        idx: idx,
+        position: "v2.test.parse.alias_amb_s",
+        name: ^AX,
+        target: "v2.test.parse.alias_amb_a.X"
+      )
+  }
+}
diff --git a/dag/test/claim/parse_test_choice_lookahead_guard_test.dag b/dag/test/claim/parse_test_choice_lookahead_guard_test.dag
index f41209c15b2..9efc6ac091c 100644
--- a/dag/test/claim/parse_test_choice_lookahead_guard_test.dag
+++ b/dag/test/claim/parse_test_choice_lookahead_guard_test.dag
@@ -17,9 +17,8 @@ import v2.std.grammar {
   node_atom_identity_optional
 }
 import v2.compiler.parse { grammar_choice_ambiguity_count, parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.diagnostic { Accepted, Outcome, Rejected, bind_outcome }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.node { Node, Symbol }
@@ -163,11 +162,11 @@ test fn guard_missing_one_word_keeps_that_row() -> Bool {
 fn clg_parse(text: String, file: Symbol) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: file, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
-          match parse_module_prepared(tokens: token_stream, prepared: prepared, validation_residue: residue) {
+          match parse_module_prepared(tokens: token_stream, prepared: prepared) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
           }
diff --git a/dag/test/claim/parse_test_fn_decl_return_clause_test.dag b/dag/test/claim/parse_test_fn_decl_return_clause_test.dag
index fad8326a214..042944078b5 100644
--- a/dag/test/claim/parse_test_fn_decl_return_clause_test.dag
+++ b/dag/test/claim/parse_test_fn_decl_return_clause_test.dag
@@ -88,7 +88,7 @@ fn nfbcp_parsed(text: String) -> Optional<Node> {
       match dag_prepared_grammar() {
         Rejected { diagnostics: _ } => Absent
         Accepted { value: prepared, diagnostics: _ } =>
-          match parse_module_prepared(tokens: ts, prepared: prepared, validation_residue: None) {
+          match parse_module_prepared(tokens: ts, prepared: prepared) {
             Rejected { diagnostics: _ } => Absent
             Accepted { value: artifact, diagnostics: _ } => Present { value: artifact.tree }
           }
diff --git a/dag/test/claim/parse_test_grammar_choice_overlap_test.dag b/dag/test/claim/parse_test_grammar_choice_overlap_test.dag
new file mode 100644
index 00000000000..c1930c45115
--- /dev/null
+++ b/dag/test/claim/parse_test_grammar_choice_overlap_test.dag
@@ -0,0 +1,89 @@
+module test.claim.parse_test_grammar_choice_overlap
+
+import std.algebra { Cons, Empty }
+import v2.compiler.parse {
+  PreparedModeled,
+  PreparedVoidGrammar,
+  grammar_choice_ambiguity_roster_from_analysis,
+  grammar_validate_for_parse
+}
+import v2.compiler.program_assembly { dag_prepared_grammar }
+import v2.std.algebra { length }
+import v2.std.diagnostic { Accepted, Rejected, declaration_locus, invariant_port_locus, locus_eq }
+import v2.std.grammar {
+  Choice,
+  GrammarProduction,
+  GrammarRoot,
+  Nonterminal,
+  StampClass,
+  Terminal,
+  grammar_atom,
+  grammar_empty_sync_tokens
+}
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE DAG GRAMMAR CARRIES NO CHOICE OVERLAP, AND THE PARSER REFUSES ONE THAT IT WOULD.
+//
+// Grammar validation (v2.compiler.parse grammar_validate_and_analyze) refuses every overlap row,
+// located at the production that owns the choice; there is no accept-with-residue arm. These two
+// claims are that wall's evidence on the merge path, which is why the module is named into the
+// admitted `test.claim.parse_test` family of v2.workflow.required_floor `required_gate_prefixes`.
+//
+// THE COUNT IS READ FROM THE ANALYSIS THE PARSER RUNS ON. dag_prepared_grammar is the warm-shared
+// producer (v2.workflow.floor_pure_producer_share), so this claim pays for one roster read, not a
+// second FIRST analysis: the roster is grammar_choice_ambiguity_roster_from_analysis over the
+// prepared grammar's own analysis, the same value grammar_choice_ambiguity_count folds. A
+// regression reds here twice over: a new overlap row makes the prepare itself refuse, and every
+// parse_test claim that consumes the prepared grammar refuses with it.
+test fn dag_grammar_choice_ambiguity_count_is_zero() -> Bool {
+  match dag_prepared_grammar() {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: prepared, diagnostics: _ } =>
+      match prepared {
+        PreparedVoidGrammar => false
+        PreparedModeled { modeled: m, materialization: _ } =>
+          length(xs: grammar_choice_ambiguity_roster_from_analysis(root: m.validated.root, analysis: m.analysis)) == 0
+      }
+  }
+}
+
+// THE DISCRIMINATING RED, SUPPLIED. One overlapping choice, owned by a production that is NOT the
+// start, so a refusal located at the start or at the stage port fails this control: only the
+// owning production is the right answer.
+data overlap_fixture_root: GrammarRoot = GrammarRoot {
+  start: ^overlap_fixture_start,
+  productions: Cons {
+    head: GrammarProduction {
+      name: ^overlap_fixture_start,
+      expression: Nonterminal { production: ^overlap_fixture_owner },
+      emitted: grammar_atom(identity: ^overlap_fixture_start)
+    },
+    tail: Cons {
+      head: GrammarProduction {
+        name: ^overlap_fixture_owner,
+        expression: Choice {
+          left: Terminal { token_class: ^overlap_fixture_tok, stamp: StampClass },
+          right: Terminal { token_class: ^overlap_fixture_tok, stamp: StampClass }
+        },
+        emitted: grammar_atom(identity: ^overlap_fixture_owner)
+      },
+      tail: Empty
+    }
+  },
+  sync_tokens: grammar_empty_sync_tokens()
+}
+
+test fn a_grammar_with_one_overlapping_choice_is_refused_at_its_production() -> Bool {
+  match grammar_validate_for_parse(
+    root: overlap_fixture_root,
+    at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^grammar_choice_overlap_fixture_contract)
+  ) {
+    Accepted { value: _, diagnostics: _ } => false
+    Rejected { diagnostics: d } =>
+      (d.head.reason == ^parse_grammar_choice_ambiguity)
+        && locus_eq(a: d.head.at, b: declaration_locus(declaration: Cons { head: ^overlap_fixture_owner, tail: Empty }))
+        && (length(xs: d.tail) == 0)
+  }
+}
diff --git a/dag/test/claim/parse_test_grammar_program_routes_test.dag b/dag/test/claim/parse_test_grammar_program_routes_test.dag
new file mode 100644
index 00000000000..1347b62851d
--- /dev/null
+++ b/dag/test/claim/parse_test_grammar_program_routes_test.dag
@@ -0,0 +1,63 @@
+module test.claim.parse_test_grammar_program_routes
+
+import v2.compiler.body_lowering_fold { body_lower_call_arg_capture_is_named, body_lower_find_captured }
+import test.claim.parse_test_declaration_choice_route { route_parse_at, route_shells }
+import v2.extdeps.languages.dag { ParseSubtreeAbsent, ParseSubtreeFound }
+import v2.std.algebra { length }
+import v2.std.diagnostic { Accepted, Rejected }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import v2.std.node { Symbol }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE ROUTE CONTROLS THE ZERO-OVERLAP GRAMMAR PROGRAM LACKED ANYWHERE. Every other production the
+// program changed (gunbc#13034, #13039, #13056, #13087, #13133) already had a route control, and
+// gunbc#13126 moved those modules into the admitted `test.claim.parse_test` family so they gate. These
+// three productions had none: each claim parses ONE supplied source at the production itself (not a
+// whole module) and asserts which alternative the parse took, read by the reader that consumes it.
+// The whole-file gap these do not close is declared at gunbc.guarantee_stall
+// grammar_change_parses_no_real_corpus_file_stall.
+
+// `arg` (gunbc#13056): the positional arm is guarded by !(name :). The route is read by
+// v2.compiler.body_lowering_fold body_lower_call_arg_capture_is_named, the reader the call lowering uses.
+fn gpr_arg_is_named(text: String) -> Symbol {
+  match route_parse_at(text: text, production: ^dag_production_arg) {
+    Rejected { diagnostics: _ } => ^gpr_refused
+    Accepted { value: tree, diagnostics: _ } =>
+      match body_lower_find_captured(root: tree, emitted: ^dag_surface_arg) {
+        ParseSubtreeAbsent => ^gpr_unfound
+        ParseSubtreeFound { captured: arg } =>
+          if body_lower_call_arg_capture_is_named(arg_capture: arg) { ^gpr_named } else { ^gpr_positional }
+      }
+  }
+}
+
+test fn a_name_colon_argument_takes_the_named_route_holds() -> Bool {
+  gpr_arg_is_named(text: "x: 1") == ^gpr_named
+}
+
+test fn a_bare_argument_takes_the_positional_route_holds() -> Bool {
+  gpr_arg_is_named(text: "x") == ^gpr_positional
+}
+
+// `match_arm` (gunbc#13056): the expression alternative was removed, so an expression arm body now
+// takes the guarded `match_arm_stmt_body` route, and never the `empty_block_body` one.
+test fn an_expression_arm_body_takes_the_statement_body_route_holds() -> Bool {
+  match route_parse_at(text: "S { node: node } => node", production: ^dag_production_match_arm) {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: tree, diagnostics: _ } =>
+      (length(xs: route_shells(n: tree, emitted: ^dag_surface_match_arm_stmt_body, acc: [])) == 1)
+        && (length(xs: route_shells(n: tree, emitted: ^dag_surface_empty_block_body, acc: [])) == 0)
+  }
+}
+
+// `if_expr` (gunbc#13056): one `if cond` head, then the then-form or the block form. The then-form
+// carries no block body, so it is told from the block form by the absence of an fn_body shell.
+test fn if_then_else_takes_the_then_form_route_holds() -> Bool {
+  match route_parse_at(text: "if c then a else b", production: ^dag_production_if_expr) {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: tree, diagnostics: _ } =>
+      (length(xs: route_shells(n: tree, emitted: ^dag_surface_if_expr, acc: [])) == 1)
+        && (length(xs: route_shells(n: tree, emitted: ^dag_surface_fn_body, acc: [])) == 0)
+  }
+}
diff --git a/dag/test/claim/parse_test_newline_dual_role_operator_mutation_test.dag b/dag/test/claim/parse_test_newline_dual_role_operator_mutation_test.dag
index 6f4c34a4c3d..800bcaf5225 100644
--- a/dag/test/claim/parse_test_newline_dual_role_operator_mutation_test.dag
+++ b/dag/test/claim/parse_test_newline_dual_role_operator_mutation_test.dag
@@ -2,8 +2,9 @@ module test.claim.parse_test_newline_dual_role_operator_mutation
 
 import v2.compiler.parse { PreparedGrammar, parse_module_prepared, prepare_grammar }
 import v2.std.diagnostic { Outcome }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_grammar, dag_lex }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
+import v2.extdeps.languages.dag { dag_grammar }
 import v2.std.algebra { fold_list }
 import v2.std.grammar {
   AfterLineBreak,
@@ -13,6 +14,7 @@ import v2.std.grammar {
   GrammarExprFold,
   GrammarProduction,
   GrammarRoot,
+  InfixTable,
   LiteralTerminal,
   ModeledGrammar,
   Nonterminal,
@@ -35,6 +37,7 @@ import v2.std.parse_refusal_reason {
   KeywordAsValueName,
   LayoutUnknownWithoutSource,
   NewlineBeforeDualRoleOperator,
+  NonAssociativeOperatorChain,
   ParseRefusalReason
 }
 import v2.std.integer { Int }
@@ -51,9 +54,9 @@ import v2.test.parse.newline_dual_role_operator_parse {
 // replaced by a terminal no token carries -- an alternative that can never match -- and asserts that
 // such arms exist. Only that reason is stripped, so the mutant differs from the live grammar in that
 // refusal and nothing else by construction, whatever other refusal rows the grammar carries (the
-// declared-path keyword refusal, v2.extdeps.languages.dag dag_grammar_declared_path_expr, is one). There is more than one arm because the additive row
-// is a helper inlined into each operand position of the comparison and equality rows; it is one
-// authored row. Under the mutant the
+// declared-path keyword refusal, v2.extdeps.languages.dag dag_grammar_declared_path_expr, is one). The
+// arm is the continuation guard of the binary operator table (v2.extdeps.languages.dag
+// dag_grammar_binary_expr_expr), one authored row. Under the mutant the
 // next-line sources parse again (the silent merge into one subtraction is back); under the live
 // grammar they refuse (the controls in v2.test.parse.newline_dual_role_operator_parse). The
 // same-line form parses under both.
@@ -83,7 +86,8 @@ fn strip_refusals(expr: GrammarExpr) -> GrammarExpr {
         }
       },
       after_line_break: fn(e) { AfterLineBreak { element: e } },
-      not_predicate: fn(e) { NotPredicate { element: e } }
+      not_predicate: fn(e) { NotPredicate { element: e } },
+      infix_table: fn(operand, guard, operators) { InfixTable { operand: operand, continuation_guard: guard, operators: operators } }
     }
   )
 }
@@ -99,6 +103,7 @@ fn is_newline_refusal(reason: ParseRefusalReason) -> Bool {
     DeclarationMarkerNotTest => false
     KeywordAsValueName => false
     TokenStartsNotIncreasing => false
+    NonAssociativeOperatorChain => false
   }
 }
 
@@ -116,7 +121,8 @@ fn newline_refusal_arm_count(expr: GrammarExpr) -> Int {
       expect: fn(e, _reason) { e },
       refuse_on_match: fn(e, reason) { if is_newline_refusal(reason: reason) { e + 1 } else { e } },
       after_line_break: fn(e) { e },
-      not_predicate: fn(e) { e }
+      not_predicate: fn(e) { e },
+      infix_table: fn(operand, guard, _operators) { operand + guard }
     }
   )
 }
@@ -164,11 +170,11 @@ fn nlm_mutant_prepared() -> Outcome<PreparedGrammar> {
 fn accepts_prepared(text: String, file: Symbol, prepared: Outcome<PreparedGrammar>) -> Bool {
   match prepared {
     Rejected { diagnostics: _ } => false
-    Accepted { value: p, diagnostics: residue } =>
+    Accepted { value: p, diagnostics: _ } =>
       match tokenize(text: text, file: file, rules: dag_lex()) {
         Rejected { diagnostics: _ } => false
         Accepted { value: stream, diagnostics: _ } =>
-          match parse_module_prepared(tokens: stream, prepared: p, validation_residue: residue) {
+          match parse_module_prepared(tokens: stream, prepared: p) {
             Accepted { value: _, diagnostics: _ } => true
             Rejected { diagnostics: _ } => false
           }
diff --git a/dag/test/claim/pcb_stackup_witness_test.dag b/dag/test/claim/pcb_stackup_witness_test.dag
index 8c0e0920c3b..b407a7d93cb 100644
--- a/dag/test/claim/pcb_stackup_witness_test.dag
+++ b/dag/test/claim/pcb_stackup_witness_test.dag
@@ -153,7 +153,11 @@ test fn w_red_a_multilayer_board_without_a_reference_plane_is_refused() -> Bool
   match admit_stackup(s: all_signal, authority: stackup_authority) {
     StackupAdmitted { admitted: _ } => false
     StackupRefused { causes: c } =>
-      count(c) == 1 && c.first() == RoutedBoardHasNoReferencePlane
+      count(c) == 1
+        && match c.first() {
+          Present { value: cause } => cause == RoutedBoardHasNoReferencePlane
+          Absent => false
+        }
   }
 }
 
@@ -192,7 +196,12 @@ test fn w_red_a_zero_thickness_dielectric_alone_is_refused() -> Bool {
   }
   match admit_stackup(s: shorted, authority: stackup_authority) {
     StackupAdmitted { admitted: _ } => false
-    StackupRefused { causes: c } => count(c) == 1 && c.first() == DielectricLayerHasNoThickness
+    StackupRefused { causes: c } =>
+      count(c) == 1
+        && match c.first() {
+          Present { value: cause } => cause == DielectricLayerHasNoThickness
+          Absent => false
+        }
   }
 }
 
diff --git a/dag/test/claim/primitive_projection_authority_witness_test.dag b/dag/test/claim/primitive_projection_authority_witness_test.dag
index 2f4723f6c6b..dbd910a9deb 100644
--- a/dag/test/claim/primitive_projection_authority_witness_test.dag
+++ b/dag/test/claim/primitive_projection_authority_witness_test.dag
@@ -3,6 +3,7 @@ module test.claim.primitive_projection_authority_witness_test
 import std.decl_ref { DeclarationRef, decl_ref }
 import std.primitive_projection {
   DeclarationPrimitiveUndisposed,
+  PrimitiveProjection,
   DeclarationProjectsNoPrimitive,
   DeclarationProjectsPrimitive,
   DivergentProjection,
@@ -20,6 +21,7 @@ import std.primitive_projection {
 }
 import std.primitive_identity {
   BuiltinRegistry,
+  primitive_projection_roster,
   DerivedFromAuthority,
   EmitHandler,
   InterpreterDispatch,
@@ -50,7 +52,7 @@ import std.types { Bool, List, String }
 
 // Executes the question a candidate collector asks of this carrier: given a DECLARATION, is it the
 // modeled surface of a PRIMITIVE, and are the two one authority or two. The discriminating control
-// is the DivergentProjection row -- v2.std.collection map_get -- which must answer NOT one
+// is the DivergentProjection row -- v2.std.collection map_get_checked -- which must answer NOT one
 // authority while the seam and modeled rows answer that they are. A carrier that collapsed the
 // three fidelities into a boolean suppress flag reds w_divergent_projection_is_not_one_authority,
 // which is the whole reason the third variant exists.
@@ -91,7 +93,7 @@ test fn w_modeled_projection_answers_with_its_fidelity() -> Bool {
 
 test fn w_divergent_projection_answers_with_its_fidelity() -> Bool {
   match primitive_projection_for_declaration(
-    declaration: projection_declaration(module_path: "v2.std.collection", decl_name: "map_get")
+    declaration: projection_declaration(module_path: "v2.std.collection", decl_name: "map_get_checked")
   ) {
     DeclarationProjectsNoPrimitive => false
     DeclarationPrimitiveUndisposed { authored_symbol: _ } => false
@@ -158,7 +160,7 @@ test fn w_undisposed_is_not_one_authority_and_so_never_suppresses() -> Bool {
 
 test fn w_divergent_projection_is_not_one_authority() -> Bool {
   !declaration_and_primitive_are_one_authority(
-    declaration: projection_declaration(module_path: "v2.std.collection", decl_name: "map_get"),
+    declaration: projection_declaration(module_path: "v2.std.collection", decl_name: "map_get_checked"),
     primitive: primitive_map_get,
   )
 }
@@ -337,3 +339,41 @@ test fn w_live_census_answers_runtime_coverage_for_a_named_symbol() -> Bool {
     RuntimeRowAbsentFromEnumeratedSurfaces => false
   }
 }
+
+// ---- the forked-spelling census (RFM one_spelling_names_a_primitive_*) ----------------------
+// A roster row whose declared function bears its primitive's OWN runtime name while carrying a
+// DIVERGENT contract is one spelling naming two meanings. The declaration must stop squatting on
+// the primitive's name: the census refuses the class. This measures the roster DATA; the
+// compiler-side census check over v1.compiler.infer_method's declaration set is the next rung and
+// is reported as a follow-up, not built here.
+fn projection_row_shares_spelling_with_divergent_contract(row: PrimitiveProjection) -> Bool {
+  match row.fidelity {
+    DivergentProjection { divergence: _ } =>
+      (row.declaration.decl_name as String) == primitive_identity_runtime_name(identity: row.primitive)
+    _ => false
+  }
+}
+
+test fn w_projection_census_declares_no_divergent_shared_spelling() -> Bool {
+  primitive_projection_roster() |> fold(init: true, f: fn(acc, row) {
+    acc && !projection_row_shares_spelling_with_divergent_contract(row: row)
+  })
+}
+
+// Positive control: the projection FACT is kept — the declared Outcome-wrapped lookup still
+// projects the primitive, under its own non-primitive spelling, with the divergence named.
+fn projection_row_is_the_outcome_lookup_projection(row: PrimitiveProjection) -> Bool {
+  match row.fidelity {
+    DivergentProjection { divergence: _ } =>
+      (row.declaration.module_path as String) == "v2.std.collection"
+        && (row.declaration.decl_name as String) == "map_get_checked"
+        && (row.primitive.slug as String) == "primitive.map_get"
+    _ => false
+  }
+}
+
+test fn w_projection_census_keeps_the_outcome_lookup_projection_under_its_own_name() -> Bool {
+  primitive_projection_roster() |> fold(init: false, f: fn(acc, row) {
+    acc || projection_row_is_the_outcome_lookup_projection(row: row)
+  })
+}
diff --git a/dag/test/claim/printer_workflow_binding_witness_test.dag b/dag/test/claim/printer_workflow_binding_witness_test.dag
index 36736ac7a18..717d37fdb06 100644
--- a/dag/test/claim/printer_workflow_binding_witness_test.dag
+++ b/dag/test/claim/printer_workflow_binding_witness_test.dag
@@ -37,8 +37,9 @@ test fn observer_has_no_fleet_ssh_demand() -> Bool {
   match fleet_converge_mode_fleet_ssh_key_demand(mode: PrinterWorkflow) { FleetSshKeyNotConsumed => true _ => false }
 }
 test fn trusted_code_cannot_be_replaced_by_dispatch_revision() -> Bool {
-  string_contains(s: fleet_converge_checkout_ref_expr, pattern: "github.event.inputs.mode == 'printer'")
+  fleet_converge_checkout_ref_expr == "${{ github.sha }}"
     && fleet_converge_event_sha_checkout_ref_expr == "${{ github.sha }}"
+    && !string_contains(s: fleet_converge_checkout_ref_expr, pattern: "expected_revision")
     && string_contains(s: fleet_converge_shared_job_if, pattern: "github.event.inputs.mode != 'printer'")
 }
 test fn observer_is_a_registered_dispatch_and_run_target() -> Bool {
diff --git a/dag/test/claim/printer_workflow_witness_test.dag b/dag/test/claim/printer_workflow_witness_test.dag
index 4cafad175c2..d5e838c91b0 100644
--- a/dag/test/claim/printer_workflow_witness_test.dag
+++ b/dag/test/claim/printer_workflow_witness_test.dag
@@ -4,7 +4,10 @@ import std.types { Bool, String }
 import extdeps.tools.mosquitto_pub { mosquitto_pub_help_supports_private_options }
 import gunbc.fleet.printer_selection { print_inputs_admitted, select_printer, PrinterSelected, PrinterSelectionRefused }
 import gunbc.fleet.printer_federation { printer_claim_pins }
-import gunbc.auth.oidc_claim_pins { claim_pins_admit, OidcClaimPin }
+import gunbc.auth.oidc_claim_pins {
+  claim_pins_admit, presented_from_pins, with_presented_value, without_presented_claim,
+  fleet_converge_workflow_ref_at_main,
+}
 
 data project_digest: String = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
 
@@ -20,12 +23,14 @@ test fn w_unknown_printer_never_selects_a_default_machine() -> Bool {
   match select_printer(name: "printer-03") { PrinterSelectionRefused => true  PrinterSelected { printer: _ } => false }
 }
 
-test fn w_printer_federation_rejects_other_workflow_branch_and_environment() -> Bool {
+test fn w_printer_federation_rejects_other_workflow_tag_and_environment() -> Bool {
   let pins = printer_claim_pins()
-  claim_pins_admit(pins: pins, claims: pins) &&
-  !claim_pins_admit(pins: pins, claims: map(pins, p => if p.claim == "ref" { OidcClaimPin { claim: p.claim, value: "refs/heads/untrusted" } } else { p })) &&
-  !claim_pins_admit(pins: pins, claims: map(pins, p => if p.claim == "environment" { OidcClaimPin { claim: p.claim, value: "namecheap-dns" } } else { p })) &&
-  !claim_pins_admit(pins: pins, claims: filter(pins, p => p.claim != "workflow_ref"))
+  let presented = presented_from_pins(pins: pins)
+  claim_pins_admit(pins: pins, claims: presented) &&
+  !claim_pins_admit(pins: pins, claims: with_presented_value(claims: presented, claim: "workflow_ref", value: concat(fleet_converge_workflow_ref_at_main(), "session/x"))) &&
+  !claim_pins_admit(pins: pins, claims: with_presented_value(claims: presented, claim: "workflow_ref", value: "gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/tags/x")) &&
+  !claim_pins_admit(pins: pins, claims: with_presented_value(claims: presented, claim: "environment", value: "namecheap-dns")) &&
+  !claim_pins_admit(pins: pins, claims: without_presented_claim(claims: presented, claim: "workflow_ref"))
 }
 
 test fn w_tool_probe_requires_mosquitto_version_two_or_newer() -> Bool {
diff --git a/dag/test/claim/provisioning/seed_artifact_fetch_forged_probe_witness_test.dag b/dag/test/claim/provisioning/seed_artifact_fetch_forged_probe_witness_test.dag
new file mode 100644
index 00000000000..d710142603d
--- /dev/null
+++ b/dag/test/claim/provisioning/seed_artifact_fetch_forged_probe_witness_test.dag
@@ -0,0 +1,58 @@
+module test.claim.seed_artifact_fetch_forged_probe_witness
+
+import std.types { String, Bool, Int, List }
+import extdeps.filesystem.filesystem_io
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
+import gunbc.compile_diagnostic_census {
+  CompileDiagnosticCensus, CompileDiagnosticCensusRow, CensusObserved, CensusNotRunnable,
+}
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
+
+// THE REBOUND-FETCH ROUTES, ENROLLED AS EXECUTED REDS (DESIGN §4b: a state unrepresentable in the
+// accepted corpus is still representable as source handed to the compiler). An AdmittedSeedArtifact
+// is admitted against one input's seed population and fetched only into that input's seed
+// directory under the remaster's work directory. test.probe.seed_artifact_fetch_forged_probe calls
+// both fetch helpers from outside the remaster with a seed directory of its own choosing, and mints
+// an admitted artifact without the admission; each must refuse at its own subject. A control source
+// that only NAMES the modules refuses at none of them, so the refusals are the forgeries'.
+
+fn census_of(source: String) -> CompileDiagnosticCensus {
+  compile_dag_diagnostic_census(source)
+}
+
+fn probe() -> CompileDiagnosticCensus {
+  census_of(source: filesystem_read(path: "dag/test/probe/seed_artifact_fetch_forged_probe.dag").content)
+}
+
+fn blocking(c: CompileDiagnosticCensus, wanted: String, subject: String) -> Int {
+  match c {
+    CensusNotRunnable { cause: _ } => -1
+    CensusObserved { rows: rows } =>
+      rows
+        |> filter(r => (r.diagnostic_class as String) == wanted && r.subject_name == subject && r.blocking)
+        |> fold(init: 0, f: (acc, r) => acc + r.count)
+  }
+}
+
+data control_source: String = "module probe_seed_artifact_fetch_harness_control\nimport std.types { Bool, String }\nimport extdeps.provisioning.ubuntu_seeded_install_media { AdmittedSeedArtifact }\nimport extdeps.provisioning.ubuntu_seeded_install_media_remaster { install_media_remaster_write_nocloud_seed }\nfn named(a: AdmittedSeedArtifact) -> String { a.basename.value as String }\n"
+
+data sealed_helpers: List<String> = ["install_media_remaster_fetch_artifact", "install_media_remaster_fetch_artifacts"]
+
+data sealed_records: List<String> = ["SeedArtifactBasename", "AdmittedSeedArtifact"]
+
+test fn a_source_that_only_names_the_remaster_rebinds_nothing() -> Bool {
+  let c = census_of(source: control_source)
+  (sealed_helpers |> all(h => blocking(c: c, wanted: "ConstructorCallAdmissionRefused", subject: h) == 0))
+    && (sealed_records |> all(r => blocking(c: c, wanted: "SoleConstructorViolation", subject: r) == 0))
+}
+
+test fn each_fetch_helper_refuses_a_caller_outside_the_checked_route() -> Bool {
+  let c = probe()
+  sealed_helpers |> all(h => blocking(c: c, wanted: "ConstructorCallAdmissionRefused", subject: h) >= 1)
+}
+
+test fn an_admitted_artifact_cannot_be_minted_without_the_admission() -> Bool {
+  let c = probe()
+  sealed_records |> all(r => blocking(c: c, wanted: "SoleConstructorViolation", subject: r) >= 1)
+}
diff --git a/dag/test/claim/public_workload_census_witness_test.dag b/dag/test/claim/public_workload_census_witness_test.dag
index f54a2b9beb4..4fe3d2b016b 100644
--- a/dag/test/claim/public_workload_census_witness_test.dag
+++ b/dag/test/claim/public_workload_census_witness_test.dag
@@ -74,6 +74,8 @@ data candidate_biome_blob_mismatch_control: WorkloadCandidate = WorkloadCandidat
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["depot-ubuntu-24.04-arm-16"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:03:32Z" },
       completed_at: Present { value: "2026-09-04T16:08:13Z" },
@@ -123,6 +125,8 @@ data candidate_biome_matrix_selector_mismatch_control: WorkloadCandidate = Workl
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["depot-ubuntu-24.04-arm-16"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:03:32Z" },
       completed_at: Present { value: "2026-09-04T16:08:13Z" },
@@ -178,6 +182,8 @@ data candidate_pdns_axis_name_mismatch_control: WorkloadCandidate = WorkloadCand
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["ubuntu-24.04-arm"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T09:57:28Z" },
       completed_at: Present { value: "2026-09-04T10:07:09Z" },
@@ -238,6 +244,8 @@ data candidate_pdns_axis_name_swap_control: WorkloadCandidate = WorkloadCandidat
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["ubuntu-24.04-arm"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T09:57:28Z" },
       completed_at: Present { value: "2026-09-04T10:07:09Z" },
@@ -291,6 +299,8 @@ data candidate_biome_job_key_mismatch_control: WorkloadCandidate = WorkloadCandi
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["depot-ubuntu-24.04-arm-16"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:03:32Z" },
       completed_at: Present { value: "2026-09-04T16:08:13Z" },
@@ -339,6 +349,8 @@ data candidate_biome_job_key_titlecase_uninspected_control: WorkloadCandidate =
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["depot-ubuntu-24.04-arm-16"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:03:32Z" },
       completed_at: Present { value: "2026-09-04T16:08:13Z" },
@@ -387,6 +399,8 @@ data candidate_biome_multi_label_control: WorkloadCandidate = WorkloadCandidate
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["self-hosted", "linux", "arm64"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:03:32Z" },
       completed_at: Present { value: "2026-09-04T16:08:13Z" },
@@ -435,6 +449,8 @@ data candidate_empty_labels_control: WorkloadCandidate = WorkloadCandidate {
       status: Completed,
       conclusion: Present { value: Success },
       labels: [],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:03:32Z" },
       completed_at: Present { value: "2026-09-04T16:08:13Z" },
@@ -483,6 +499,8 @@ data candidate_absent_conclusion_control: WorkloadCandidate = WorkloadCandidate
       status: Completed,
       conclusion: Absent,
       labels: ["depot-ubuntu-24.04-arm-16"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:03:32Z" },
       completed_at: Present { value: "2026-09-04T16:08:13Z" },
@@ -531,6 +549,8 @@ data candidate_run_attempt_zero_control: WorkloadCandidate = WorkloadCandidate {
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["depot-ubuntu-24.04-arm-16"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:03:32Z" },
       completed_at: Present { value: "2026-09-04T16:08:13Z" },
@@ -579,6 +599,8 @@ data candidate_empty_matrix_axes_control: WorkloadCandidate = WorkloadCandidate
       status: Completed,
       conclusion: Present { value: Success },
       labels: ["depot-ubuntu-24.04-arm-16"],
+      runner_id: none,
+      runner_name: none,
       created_at: Absent,
       started_at: Present { value: "2026-09-04T16:03:32Z" },
       completed_at: Present { value: "2026-09-04T16:08:13Z" },
diff --git a/dag/test/claim/repository_convergence_wet_witness_test.dag b/dag/test/claim/repository_convergence_wet_witness_test.dag
index d412f654bc1..6f061b10e45 100644
--- a/dag/test/claim/repository_convergence_wet_witness_test.dag
+++ b/dag/test/claim/repository_convergence_wet_witness_test.dag
@@ -18,7 +18,8 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // dag/test/claim/repository_convergence_wet_witness_test.dag --functions <comma-joined>:
 //   detached_primary_transition_executes_and_preserves_packed_loose_refs_and_linked_worktree,
 //   already_at_candidate_repairs_a_stale_index, cas_race_is_observed_after_fetch,
-//   reset_refusal_after_successful_cas_is_nonzero
+//   reset_refusal_after_successful_cas_is_nonzero,
+//   a_legacy_derived_roster_file_is_retired_and_read_back_absent
 // Scratch-repository WET matrix over the real git transport.
 
 // Record/replay receipt recipe (the setup invocation is stable; its recorded stdout carries the
@@ -189,3 +190,25 @@ test fn wrong_primary_standing_refuses_from_gits_roster() -> Bool {
     }
   }
 }
+
+// A LEGACY DERIVED ROSTER LEFT BY AN OLDER gunbc IS RETIRED BY CONVERGENCE AND READ BACK ABSENT.
+// The fixture plants the file the old binary wrote; convergence must remove it (the loader never
+// does) and only then report success.
+test fn a_legacy_derived_roster_file_is_retired_and_read_back_absent() -> Bool {
+  match scratch_repository(index_lock: false, already_candidate: false, racing_fetch: false) {
+    Absent => false
+    Present { value: s } => {
+      let roster = join([s.repo, "/dag/gunbc/rung_drop/roster.dag"], "")
+      let planted = mutate_scratch(s: s, body: join([
+        "set -eu",
+        join(["mkdir -p ", s.repo, "/dag/gunbc/rung_drop"], ""),
+        join(["printf legacy > ", roster], ""),
+      ], "\n"))
+      let outcome = run_scratch(s: s)
+      let absent = mutate_scratch(s: s, body: join(["test ! -e ", roster], ""))
+      let cleaned = remove_scratch(s: s)
+      let converged = match outcome { ExitSuccess => true _ => false }
+      planted && converged && absent && cleaned
+    }
+  }
+}
diff --git a/dag/test/claim/repository_convergence_witness_test.dag b/dag/test/claim/repository_convergence_witness_test.dag
index 2658d20a22b..8c2a74aba52 100644
--- a/dag/test/claim/repository_convergence_witness_test.dag
+++ b/dag/test/claim/repository_convergence_witness_test.dag
@@ -1,6 +1,7 @@
 module test.claim.repository_convergence_witness_test
 
 import std.types { String, Bool, List }
+import v2.std.algebra { any }
 import extdeps.git.enumeration {
   GitRefSetObservation, GitRefSetReadRefused, git_ref_set_observation_of,
 }
@@ -8,6 +9,8 @@ import extdeps.git.worktree_enumeration {
   GitWorktreeSetObservation, git_worktree_set_observation_of,
 }
 import gunbc.live_deploy.repository_convergence {
+  superseded_workspace_file_paths,
+  ConvergenceSupersededFileNotRetired,
   RepositoryState,
   GitTextObserved,
   RepositoryCoherenceObservation, RepositoryCoherenceObserved,
@@ -687,3 +690,20 @@ test fn a_symref_targeting_another_ref_that_moved_still_refuses() -> Bool {
   }
 }
 
+// THE RETIREMENT POPULATION IS THE FILE-GRAIN SupersededAuthority ROWS OF gunbc.repo_workspace AND
+// NOTHING ELSE: both legacy roster files are in it, and the superseded DIRECTORY rows
+// (`/gunbc-planning/`, `/scripts/fixtures/`) are not -- a directory pattern is never retired here.
+test fn superseded_file_retirement_population_is_the_two_legacy_roster_files() -> Bool {
+  let paths = superseded_workspace_file_paths()
+  length(xs: paths) == 2
+    && any(paths, p => p == "dag/gunbc/recurring_failure_mode/roster.dag")
+    && any(paths, p => p == "dag/gunbc/rung_drop/roster.dag")
+    && !any(paths, p => string_contains(s: p, pattern: "gunbc-planning"))
+}
+
+test fn an_unretired_superseded_file_is_not_converged() -> Bool {
+  !repository_convergence_converged(outcome: ConvergenceSupersededFileNotRetired {
+    path: "/opt/gunbc/gunbc/dag/gunbc/rung_drop/roster.dag",
+    detail: "delete refused: permission denied",
+  })
+}
diff --git a/dag/test/claim/resolved_call_emission_identity_witness_test.dag b/dag/test/claim/resolved_call_emission_identity_witness_test.dag
index a795d682574..d2a133d618d 100644
--- a/dag/test/claim/resolved_call_emission_identity_witness_test.dag
+++ b/dag/test/claim/resolved_call_emission_identity_witness_test.dag
@@ -63,11 +63,11 @@ test fn w_imported_generic_contains_keeps_declared_identity() -> Bool {
 // "lower to the bridge" would go red here: the row is DivergentProjection -- the declaration
 // returns Outcome<Optional<V>> and the primitive returns Optional<V> -- and the declaration is
 // what the author called.
-test fn w_divergent_map_get_keeps_declared_outcome_identity() -> Bool {
+test fn w_divergent_map_get_checked_keeps_declared_outcome_identity() -> Bool {
   compile_dag_rust_emit_check(
-    "module test.claim.declared_map_get_probe\nimport std.types { Int, String, Map }\nimport std.occurrence_identity { OccurrenceId }\nimport v2.std.collection { map_get }\nimport v2.std.diagnostic { Outcome }\nimport v2.std.optional { Optional }\nfn probe(m: Map<String, Int>) -> Outcome<Optional<Int>> { map_get(m: m, key: \"key\") }\n",
+    "module test.claim.declared_map_get_probe\nimport std.types { Int, String, Map }\nimport std.occurrence_identity { OccurrenceId }\nimport v2.std.collection { map_get_checked }\nimport v2.std.diagnostic { Outcome }\nimport std.optional { Optional }\nfn probe(m: Map<String, Int>) -> Outcome<Optional<Int>> { map_get_checked(m: m, key: \"key\") }\n",
     "src/test_claim_declared_map_get_probe.rs",
-    ["crate::v2_std_collection::map_get("],
+    ["crate::v2_std_collection::map_get_checked("],
     ["v1_rt::map_get("]
   )
 }
diff --git a/dag/test/claim/rest_transport_axes_emit_witness_test.dag b/dag/test/claim/rest_transport_axes_emit_witness_test.dag
index 224d75f3ba8..cda2c95c69e 100644
--- a/dag/test/claim/rest_transport_axes_emit_witness_test.dag
+++ b/dag/test/claim/rest_transport_axes_emit_witness_test.dag
@@ -52,15 +52,5 @@ fn w_dual_auth_refuses_at_emit() -> Bool {
 test fn rest_axes_emit_tls_insecure() -> Bool { w_tls_insecure_emits_danger_accept() }
 test fn rest_axes_emit_tls_verify_peer_control() -> Bool { w_tls_verify_peer_omits_danger_accept() }
 test fn rest_axes_emit_tls_absent_control() -> Bool { w_tls_absent_omits_danger_accept() }
-fn w_rest_crate_uses_rustls_tls() -> Bool {
-  compile_dag_rust_emit_check(
-    "module rax_cargo\n\nimport extdeps.transports.rest { RestResult }\n\nservice test.Svc {\n  config {\n    endpoint: \"https://api.example.com\"\n  }\n  operation GetItems {\n    output { items: List<String> }\n    readonly\n    transport rest { method: GET, path: \"/items\" }\n    response {\n      200 => List<String>\n    }\n    mock_response {\n      200 => [\"a\"] \"items\"\n    }\n  }\n}\n",
-    "Cargo.toml",
-    ["rustls-tls", "default-features = false"],
-    []
-  )
-}
-
 test fn rest_axes_emit_basic_auth() -> Bool { w_basic_auth_emits_basic_auth_call() }
 test fn rest_axes_emit_dual_auth_refuses() -> Bool { w_dual_auth_refuses_at_emit() }
-test fn rest_axes_emit_crate_uses_rustls_tls() -> Bool { w_rest_crate_uses_rustls_tls() }
diff --git a/dag/test/claim/roadmap/dispatch_worker_confinement_witness_test.dag b/dag/test/claim/roadmap/dispatch_worker_confinement_witness_test.dag
index 70241f2e6f0..368e2fa2376 100644
--- a/dag/test/claim/roadmap/dispatch_worker_confinement_witness_test.dag
+++ b/dag/test/claim/roadmap/dispatch_worker_confinement_witness_test.dag
@@ -1,6 +1,6 @@
 module test.claim.roadmap.dispatch_worker_confinement_witness_test
 
-import std.types { Bool, String, List }
+import std.types { Bool, String, List, NonEmptyStr }
 import gunbc.roadmap_dispatch_actuator { dispatch_worker_unit_properties, attempt_state_prepare_argv_for_instance, dispatch_attempt_verification_dir_for_instance, attempt_unit_substate_has_exited, dispatch_review_unit_properties }
 import extdeps.systemd { SystemdUnitProperty, systemd_unit_property_wire }
 import extdeps.systemd.systemd_run { SystemdRunProperty }
@@ -21,7 +21,7 @@ fn has_property(props: List<SystemdRunProperty>, needle: String) -> Bool {
 
 test fn the_worker_unit_confines_writes_to_the_instance_root() -> Bool {
   let inst = srv2_deploy_dashboard_instance()
-  let props = dispatch_worker_unit_properties(instance: inst, working_directory: "/wt", worker_log_path: "/wt/log", granted: kibibyte(count: 1048576), process_bounds: session_process_bounds)
+  let props = dispatch_worker_unit_properties(instance: inst, working_directory: "/wt", worker_log_path: "/wt/log", granted: kibibyte(count: 1048576), process_bounds: session_process_bounds, exit_hook: "mkdir -- /i/attempt-exit-spool/inbox/n+k+x" as NonEmptyStr)
   has_property(props: props, needle: "ProtectSystem=strict")
     && has_property(props: props, needle: "ProtectHome=read-only")
     && has_property(props: props, needle: "PrivateTmp=yes")
@@ -53,27 +53,39 @@ test fn the_prepare_step_creates_the_verification_directory_with_the_attempt_dir
     && string_contains(s: verification_dir, pattern: "/verification")
 }
 
-// DISCRIMINATING: a successful worker's unit must stay observable after exit, and the observer must
-// read the exit from SubState rather than ActiveState (which stays active under RemainAfterExit).
-// Before 2026-09-05 a unit that exited 0 was collected and read as never having run.
-test fn the_worker_unit_outlives_its_process_and_substate_decides_exit() -> Bool {
+// DISCRIMINATING: the worker unit no longer outlives its process (reversal of 2026-09-05, bold-bee-114
+// ruling 2026-10-06): it carries no RemainAfterExit, so it stops when the worker exits and its
+// ExecStopPost exit record is written at that moment; the record, not unit-loaded state, is the exit
+// evidence once the unit is collected. SubState still decides exit for a unit that is loaded (a failed
+// worker is retained as failed).
+test fn the_worker_unit_stops_with_its_process_and_writes_its_exit_record() -> Bool {
   let inst = srv2_deploy_dashboard_instance()
-  let props = dispatch_worker_unit_properties(instance: inst, working_directory: "/wt", worker_log_path: "/wt/log", granted: kibibyte(count: 1048576), process_bounds: session_process_bounds)
-  has_property(props: props, needle: "RemainAfterExit=yes")
+  let props = dispatch_worker_unit_properties(instance: inst, working_directory: "/wt", worker_log_path: "/wt/log", granted: kibibyte(count: 1048576), process_bounds: session_process_bounds, exit_hook: "mkdir -- /i/attempt-exit-spool/inbox/n+k+x" as NonEmptyStr)
+  !has_property(props: props, needle: "RemainAfterExit")
+    && has_property(props: props, needle: "ExecStopPost=mkdir -- /i/attempt-exit-spool/inbox/n+k+x")
     && attempt_unit_substate_has_exited(substate: "exited")
     && attempt_unit_substate_has_exited(substate: "failed")
     && !attempt_unit_substate_has_exited(substate: "running")
-    && !attempt_unit_substate_has_exited(substate: "start-pre")
+    && !attempt_unit_substate_has_exited(substate: "stop-post")
 }
 
 // DISCRIMINATING: the reviewer may write only its review directory, and it runs from the repo root
-// (the worktree as cwd made `gunbc run` refuse its own source roots, exit 101).
+// (the worktree as cwd made `gunbc run` refuse its own source roots, exit 101). With an exit hook it
+// stops with its process and records its exit (bold-bee-114 ruling 2026-10-06: the reviewer's
+// RemainAfterExit is removed); the hook is given, the inbox is NOT among its writable paths (the "+"
+// prefix lets the hook write there while the reviewer cannot). The supervisor passes no hook and
+// keeps RemainAfterExit.
 test fn the_reviewer_unit_writes_only_its_review_directory_and_runs_from_the_repo_root() -> Bool {
   let inst = srv2_deploy_dashboard_instance()
-  let props = dispatch_review_unit_properties(instance: inst, working_directory: inst.repo_root as String, log_path: "/r/log", review_dir: "/state/a/review")
+  let props = dispatch_review_unit_properties(instance: inst, working_directory: inst.repo_root as String, log_path: "/r/log", review_dir: "/state/a/review", exit_hook: Present { value: "+mkdir -- /i/attempt-exit-spool/inbox/x" as NonEmptyStr })
+  let supervisor = dispatch_review_unit_properties(instance: inst, working_directory: inst.repo_root as String, log_path: "/r/log", review_dir: "/state/a/supervisor", exit_hook: none)
   has_property(props: props, needle: "ReadWritePaths=/state/a/review")
     && !has_property(props: props, needle: "/.git/worktrees")
+    && !has_property(props: props, needle: "ReadWritePaths=/i/attempt-exit-spool")
     && has_property(props: props, needle: join(["WorkingDirectory=", inst.repo_root as String], ""))
     && has_property(props: props, needle: "ProtectHome=read-only")
-    && has_property(props: props, needle: "RemainAfterExit=yes")
+    && has_property(props: props, needle: "ExecStopPost=+mkdir -- /i/attempt-exit-spool/inbox/x")
+    && !has_property(props: props, needle: "RemainAfterExit")
+    && has_property(props: supervisor, needle: "RemainAfterExit=yes")
+    && !has_property(props: supervisor, needle: "ExecStopPost")
 }
diff --git a/dag/test/claim/roadmap/roadmap_attempt_exit_spool_witness_test.dag b/dag/test/claim/roadmap/roadmap_attempt_exit_spool_witness_test.dag
new file mode 100644
index 00000000000..6c19df8f597
--- /dev/null
+++ b/dag/test/claim/roadmap/roadmap_attempt_exit_spool_witness_test.dag
@@ -0,0 +1,117 @@
+module test.claim.roadmap.roadmap_attempt_exit_spool_witness_test
+
+import extdeps.posix.signal { linux_standard_signal_number }
+import std.types { String, List, Bool }
+import gunbc.roadmap.roadmap_attempt_exit_spool {
+  attempt_exit_hook, AttemptExitHookRendered, AttemptExitHookRefused, AttemptWorkerRole, AttemptReviewerRole,
+  attempt_exit_entry_decode, AttemptExitEntryDecoded, AttemptExitEntryMalformed,
+  AttemptProcessExitedWith, AttemptProcessSignaled,
+  AttemptWorkerRole, AttemptReviewerRole, AttemptAuditorRole,
+  attempt_exit_record_from_listings, AttemptExitStageNames, AttemptExitStageUnreadable,
+  AttemptExitRecordFound, AttemptExitRecordNone, AttemptExitRecordUnreadable,
+}
+import extdeps.systemd.service_exec { ServiceResultSuccess, ServiceResultSignal }
+
+// The hook is one typed mkdir argv whose single operand is the record's name, with the four stop
+// variables spelled as systemd expansions and no shell anywhere.
+test fn exit_hook_is_a_create_only_mkdir_of_the_record_name() -> Bool {
+  match attempt_exit_hook(instance_root: "/opt/gunbc-srv2", node_id: "shell-dag-live", attempt_key: "01feb0b65dee1377", role: AttemptWorkerRole) {
+    AttemptExitHookRendered { exec_line } =>
+      (exec_line as String) == "+mkdir -- /opt/gunbc-srv2/attempt-exit-spool/inbox/shell-dag-live+01feb0b65dee1377+worker+$\{INVOCATION_ID}+$\{SERVICE_RESULT}+$\{EXIT_CODE}+$\{EXIT_STATUS}"
+    AttemptExitHookRefused { reason: _ } => false
+  }
+}
+
+test fn exit_hook_refuses_an_instance_root_systemd_would_reinterpret() -> Bool {
+  match attempt_exit_hook(instance_root: "/opt/gunbc %n", node_id: "a", attempt_key: "b", role: AttemptWorkerRole) {
+    AttemptExitHookRefused { reason: _ } => true
+    AttemptExitHookRendered { exec_line: _ } => false
+  }
+}
+
+test fn an_exit_record_decodes_to_its_status_and_a_kill_to_its_signal() -> Bool {
+  let exited = match attempt_exit_entry_decode(entry_name: "n-1+k1+worker+0123456789abcdef0123456789abcdef+success+exited+0") {
+    AttemptExitEntryDecoded { record } =>
+      record.node_id == "n-1" && record.attempt_key == "k1"
+        && (match record.result { ServiceResultSuccess => true _ => false })
+        && (match record.end { AttemptProcessExitedWith { status } => status == 0 AttemptProcessSignaled { signal: _ } => false })
+    AttemptExitEntryMalformed { entry_name: _, reason: _ } => false
+  }
+  let killed = match attempt_exit_entry_decode(entry_name: "n-1+k1+worker+0123456789abcdef0123456789abcdef+signal+killed+TERM") {
+    AttemptExitEntryDecoded { record } =>
+      (match record.result { ServiceResultSignal => true _ => false })
+        && (match record.end { AttemptProcessSignaled { signal } => linux_standard_signal_number(signal: signal) == 15 AttemptProcessExitedWith { status: _ } => false })
+    AttemptExitEntryMalformed { entry_name: _, reason: _ } => false
+  }
+  exited && killed
+}
+
+test fn a_name_that_is_not_seven_parts_or_whose_status_contradicts_its_code_is_malformed() -> Bool {
+  let short = match attempt_exit_entry_decode(entry_name: "n+k+worker+inv+success+exited") { AttemptExitEntryMalformed { entry_name: _, reason: _ } => true AttemptExitEntryDecoded { record: _ } => false }
+  let contradiction = match attempt_exit_entry_decode(entry_name: "n+k+worker+inv+success+exited+TERM") { AttemptExitEntryMalformed { entry_name: _, reason: _ } => true AttemptExitEntryDecoded { record: _ } => false }
+  let unlisted_code = match attempt_exit_entry_decode(entry_name: "n+k+worker+inv+success+vanished+0") { AttemptExitEntryMalformed { entry_name: _, reason: _ } => true AttemptExitEntryDecoded { record: _ } => false }
+  short && contradiction && unlisted_code
+}
+
+// The observer's three arms over supplied listings: a record in any stage is found; every stage read
+// and none for this attempt is None (never "never ran"); a stage that could not be read is
+// Unreadable, never None.
+test fn record_found_in_any_stage_none_when_all_read_unreadable_when_one_is_not() -> Bool {
+  let other = "other+k9+worker+inv+success+exited+0"
+  let mine = "n-1+k1+worker+inv+exit-code+exited+3"
+  let found = match attempt_exit_record_from_listings(node_id: "n-1", attempt_key: "k1", role: AttemptWorkerRole, listings: [AttemptExitStageNames { names: [other] }, AttemptExitStageNames { names: [] }, AttemptExitStageNames { names: [mine] }]) {
+    AttemptExitRecordFound { record } => match record.end { AttemptProcessExitedWith { status } => status == 3 AttemptProcessSignaled { signal: _ } => false }
+    AttemptExitRecordNone => false
+    AttemptExitRecordUnreadable { reason: _ } => false
+  }
+  let none_found = match attempt_exit_record_from_listings(node_id: "n-1", attempt_key: "k1", role: AttemptWorkerRole, listings: [AttemptExitStageNames { names: [other] }, AttemptExitStageNames { names: [] }, AttemptExitStageNames { names: [] }]) {
+    AttemptExitRecordNone => true
+    AttemptExitRecordFound { record: _ } => false
+    AttemptExitRecordUnreadable { reason: _ } => false
+  }
+  let unreadable = match attempt_exit_record_from_listings(node_id: "n-1", attempt_key: "k1", role: AttemptWorkerRole, listings: [AttemptExitStageNames { names: [mine] }, AttemptExitStageUnreadable { reason: "EACCES" }, AttemptExitStageNames { names: [] }]) {
+    AttemptExitRecordUnreadable { reason: _ } => true
+    AttemptExitRecordFound { record: _ } => false
+    AttemptExitRecordNone => false
+  }
+  found && none_found && unreadable
+}
+
+// The role is part of the subject: a reviewer's record for the same attempt never answers for its
+// worker, and the reviewer's hook names its criterion and head.
+test fn a_records_role_is_part_of_its_subject() -> Bool {
+  let only_reviewer = match attempt_exit_record_from_listings(node_id: "n-1", attempt_key: "k1", role: AttemptWorkerRole, listings: [AttemptExitStageNames { names: ["n-1+k1+review.conformance-leasing.abc123+inv+success+exited+0"] }]) {
+    AttemptExitRecordNone => true
+    AttemptExitRecordFound { record: _ } => false
+    AttemptExitRecordUnreadable { reason: _ } => false
+  }
+  let reviewer_found = match attempt_exit_record_from_listings(node_id: "n-1", attempt_key: "k1", role: AttemptReviewerRole { criterion_key: "conformance-leasing", head_sha: "abc123" }, listings: [AttemptExitStageNames { names: ["n-1+k1+worker+inv+success+exited+0", "n-1+k1+review.conformance-leasing.abc123+inv+success+exited+0"] }]) {
+    AttemptExitRecordFound { record } => record.role == "review.conformance-leasing.abc123"
+    AttemptExitRecordNone => false
+    AttemptExitRecordUnreadable { reason: _ } => false
+  }
+  only_reviewer && reviewer_found
+}
+
+// A SIGNAL NAME OUTSIDE signal(7)'s standard set has no constructor, so the record that names one is
+// refused at decode rather than carried as text to the point of use.
+test fn an_unlisted_signal_name_is_refused_at_decode() -> Bool {
+  match attempt_exit_entry_decode(entry_name: "n-1+k1+worker+0123456789abcdef0123456789abcdef+signal+killed+RTMIN") {
+    AttemptExitEntryMalformed { entry_name: _, reason: _ } => true
+    AttemptExitEntryDecoded { record: _ } => false
+  }
+}
+
+// Review 78301: an entry that names this attempt but cannot be decoded (non-numeric status) is its end
+// UNOBSERVED, never absent -- settlement must not free on it. Another attempt's malformed entry is not this one's.
+test fn an_undecodable_entry_for_this_attempt_is_unreadable_and_another_attempts_is_not() -> Bool {
+  let mine = "n-1+k1+worker+inv+exit-code+exited+BOGUS"
+  let other = "n-2+k9+worker+inv+exit-code+exited+BOGUS"
+  (match attempt_exit_record_from_listings(node_id: "n-1", attempt_key: "k1", role: AttemptWorkerRole, listings: [AttemptExitStageNames { names: [mine] }]) {
+    AttemptExitRecordUnreadable { reason: _ } => true
+    _ => false
+  }) && (match attempt_exit_record_from_listings(node_id: "n-1", attempt_key: "k1", role: AttemptWorkerRole, listings: [AttemptExitStageNames { names: [other] }]) {
+    AttemptExitRecordNone => true
+    _ => false
+  })
+}
diff --git a/dag/test/claim/roadmap/roadmap_belt_actuate_witness_test.dag b/dag/test/claim/roadmap/roadmap_belt_actuate_witness_test.dag
index d11c8408f5d..725a79909c5 100644
--- a/dag/test/claim/roadmap/roadmap_belt_actuate_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_belt_actuate_witness_test.dag
@@ -110,7 +110,10 @@ import gunbc.roadmap_belt_actuate {
   belt_commit_outcome_receipt, belt_commit_outcome_receipt_json,
   belt_commit_outcome_is_failure, belt_commit_outcome_is_recorded,
   belt_commit_pass_outcome_from, belt_commit_outcome_json_value,
-  belt_tick_commit_poisoned_count, belt_tick_result_json_value,
+  belt_tick_result_json_value,
+  BeltDiscovered, BeltDiscoveryRefused,
+  BeltAttemptObligationReceiptPresent, BeltAttemptObligationReceiptAbsent, BeltAttemptObligationReceiptUnreadable,
+  belt_attempt_obligation_receipt_decode, belt_pass_outcome_json, BeltAttemptObligationReceiptRead, belt_attempt_obligation_run_json, BeltAttemptObligationsRan, BeltAttemptObligationsNotCurrent, BeltAttemptObligationStep,
   BeltExecOutcome, ExecOk, ExecFailed, ExecRefused,
   belt_exec,
   belt_exec_all,
@@ -1392,176 +1395,184 @@ test fn the_known_spawn_workdir_resolves_to_its_own_instance() -> Bool {
   }
 }
 
-// RED control (operator P1, 2026-08-02): a tmux-list refusal must NOT zero the verify pass. The
-// defect class was belt_tick returning empty verify_outcomes on ObserveRefused — an absorbing
-// fallback that made the whole tick look like verification never ran. The witness constructs the
-// post-fix shape synthetically: spawn_pass Refused while verify_pass is still Recorded when verify
-// outcomes exist.
-
-test fn observe_refused_spawn_does_not_zero_verify_pass() -> Bool {
+// RED control (operator P1, 2026-08-02), carried onto the demoted tick: a tmux-list refusal must NOT
+// zero the tick's other pass. The defect class was an absorbing fallback that made the whole tick look
+// like nothing ran; verification has since left the tick (dogfood intervention #6), and the pass that
+// stands beside spawn now is discovery. A spawn refused on session observation leaves discovery
+// recorded on its own evidence, and a discovery whose ledger could not be read refuses ITSELF without
+// touching spawn.
+test fn observe_refused_spawn_does_not_zero_the_discovery_pass() -> Bool {
   let result = BeltTickResult {
     wholesale: TickPassesRun,
     host_refusal: Present { value: LaunchSessionsUnobservable { reason: "belt_observe: tmux ls failed; session containers are unknowable" } },
     reconcile: belt_tick_empty_reconcile(state: ManualReady),
     spawn_outcomes: [],
     teardown_outcomes: [],
-    commit_outcomes: [],
-    verify_outcomes: [
-      VerifyRecorded {
-        node_id: "v2-emitter-producer-provenance",
-        verdict_key: "refused",
-        detail: "validation refused",
-      },
-    ],
-    publish_outcomes: [],
-    review_outcomes: [],
-    audit_outcomes: [],
-    metering_outcomes: [],
+    discovery: BeltDiscovered { owed: 1, enqueues: [BeltObligationStarted { unit: "gunbc-obligation-attempt-n-k.service" as NonEmptyStr }] },
   }
   let receipt = belt_tick_receipt_from_result(
     result: result,
     observed_at: "2026-08-02T02:00:00Z",
     execution: TickExecuted { instance_id: "srv1-live", deployed_revision: "0123456789abcdef0123456789abcdef01234567", spawn_mode: ManualReady },
   )
-  match receipt.spawn_pass {
-    BeltPassRefused { reason: _ } => true
-    _ => false
-  }
-    && match receipt.verify_pass {
-      BeltPassRecorded => true
-      _ => false
-    }
+  (match receipt.spawn_pass { BeltPassRefused { reason: _ } => true _ => false })
+    && (match receipt.discovery_pass { BeltPassRecorded => true _ => false })
 }
 
-test fn observe_refused_with_empty_verify_is_deferred_not_recorded() -> Bool {
-  let result = BeltTickResult {
-    wholesale: TickPassesRun,
-    host_refusal: Present { value: LaunchSessionsUnobservable { reason: "tmux refused" } },
-    reconcile: belt_tick_empty_reconcile(state: ManualReady),
-    spawn_outcomes: [],
-    teardown_outcomes: [],
-    commit_outcomes: [],
-    verify_outcomes: [
-      VerifyDeferred {
-        node_id: "node-a",
-        reason: "agent obligation is not satisfied",
-      },
-    ],
-    publish_outcomes: [],
-    review_outcomes: [],
-    audit_outcomes: [],
-    metering_outcomes: [],
-  }
-  match belt_tick_receipt_from_result(
-    result: result,
+test fn an_unreadable_ledger_refuses_discovery_and_a_refused_handoff_fails_it() -> Bool {
+  let refused = belt_tick_receipt_from_result(
+    result: BeltTickResult {
+      wholesale: TickPassesRun,
+      host_refusal: Absent,
+      reconcile: belt_tick_empty_reconcile(state: ManualReady),
+      spawn_outcomes: [],
+      teardown_outcomes: [],
+      discovery: BeltDiscoveryRefused { reason: "the attempts ledger is unobservable" },
+    },
     observed_at: "2026-08-02T02:00:00Z",
     execution: TickExecuted { instance_id: "srv1-live", deployed_revision: "0123456789abcdef0123456789abcdef01234567", spawn_mode: ManualReady },
-  ).verify_pass {
-    BeltPassDeferred { reason: _ } => true
-    BeltPassRecorded => false
-    BeltPassRefused { reason: _ } => false
-    BeltPassFailed { reason: _ } => false
-  }
+  )
+  let failed = belt_tick_receipt_from_result(
+    result: BeltTickResult {
+      wholesale: TickPassesRun,
+      host_refusal: Absent,
+      reconcile: belt_tick_empty_reconcile(state: ManualReady),
+      spawn_outcomes: [],
+      teardown_outcomes: [],
+      discovery: BeltDiscovered { owed: 2, enqueues: [
+        BeltObligationHeld { unit: "gunbc-obligation-attempt-a-1.service" as NonEmptyStr },
+        BeltObligationEnqueueRefused { unit: "gunbc-obligation-attempt-b-2.service" as NonEmptyStr, reason: "systemd-run exited 1" },
+      ] },
+    },
+    observed_at: "2026-08-02T02:00:00Z",
+    execution: TickExecuted { instance_id: "srv1-live", deployed_revision: "0123456789abcdef0123456789abcdef01234567", spawn_mode: ManualReady },
+  )
+  (match refused.discovery_pass { BeltPassRefused { reason } => string_contains(s: reason, pattern: "unobservable") _ => false })
+    && (match failed.discovery_pass { BeltPassFailed { reason } => string_contains(s: reason, pattern: "attempt-b-2") && !string_contains(s: reason, pattern: "attempt-a-1") _ => false })
 }
 
 // review 47210 spec-without-execution: decoupling was witnessed at the receipt layer but the
 // presentation join had no executing consumer. These rows execute
-// belt_verification_presentation_detail and the wire join against synthetic tick reads so the
-// headline strings ('Verification queued - next belt tick', 'Verification blocked · …',
-// observe-refusal vs verify-recorded at the UI layer) cannot drift without going red.
+// belt_verification_presentation_detail and the wire join against synthetic reads so the headline
+// strings cannot drift without going red. Since dogfood intervention #6 a pending verification reads
+// its OWN attempt's obligation receipt first and the tick's discovery pass only when the attempt has no
+// verify step on record.
 
-test fn verification_presentation_absent_receipt_is_queued() -> Bool {
+test fn verification_presentation_absent_receipts_are_queued() -> Bool {
   belt_verification_presentation_detail(
     progress: completed_attempt_progress(node_id: "pres-absent-node"),
     tick_read: BeltTickReceiptAbsent,
-  ) == "Verification queued - next belt tick"
+    obligation_read: BeltAttemptObligationReceiptAbsent,
+  ) == "Verification queued - awaiting its obligation"
 }
 
-test fn verification_presentation_unreadable_receipt_is_blocked() -> Bool {
-  let detail = belt_verification_presentation_detail(
+test fn verification_presentation_unreadable_receipts_are_blocked() -> Bool {
+  let tick = belt_verification_presentation_detail(
     progress: completed_attempt_progress(node_id: "pres-unreadable-node"),
     tick_read: BeltTickReceiptUnreadable { reason: "belt tick receipt schema is unknown" },
+    obligation_read: BeltAttemptObligationReceiptAbsent,
   )
-  string_contains(s: detail, pattern: "Verification blocked · belt tick receipt unreadable: ")
-    && string_contains(s: detail, pattern: "schema is unknown")
-}
-
-test fn verification_presentation_decouples_verify_from_spawn_observe_refusal() -> Bool {
-  let receipt = belt_tick_receipt_from_result(
-    result: BeltTickResult {
-      wholesale: TickPassesRun,
-      host_refusal: Present { value: LaunchSessionsUnobservable { reason: "belt_observe: tmux ls failed; session containers are unknowable" } },
-      reconcile: belt_tick_empty_reconcile(state: ManualReady),
-      spawn_outcomes: [],
-      teardown_outcomes: [],
-      commit_outcomes: [],
-      verify_outcomes: [
-        VerifyRecorded {
-          node_id: "v2-emitter-producer-provenance",
-          verdict_key: "refused",
-          detail: "validation refused",
-        },
-      ],
-      publish_outcomes: [],
-      review_outcomes: [],
-      audit_outcomes: [],
-      metering_outcomes: [],
-    },
-    observed_at: "2026-08-02T02:00:00Z",
-    execution: TickExecuted { instance_id: "srv1-live", deployed_revision: "0123456789abcdef0123456789abcdef01234567", spawn_mode: ManualReady },
-  )
-  let detail = belt_verification_presentation_detail(
-    progress: completed_attempt_progress(node_id: "pres-decouple-node"),
-    tick_read: BeltTickReceiptPresent { receipt: receipt },
+  let own = belt_verification_presentation_detail(
+    progress: completed_attempt_progress(node_id: "pres-unreadable-node"),
+    tick_read: BeltTickReceiptAbsent,
+    obligation_read: BeltAttemptObligationReceiptUnreadable { reason: "attempt obligation receipt schema is unknown" },
   )
-  !string_contains(s: detail, pattern: "tmux ls failed")
-    && string_contains(s: detail, pattern: "Verification queued")
+  string_contains(s: tick, pattern: "Verification blocked · belt tick receipt unreadable: ")
+    && string_contains(s: own, pattern: "Verification blocked · attempt obligation receipt unreadable: ")
 }
 
-test fn verification_presentation_verify_refused_is_blocked() -> Bool {
-  let receipt = BeltTickReceipt {
+// THE ATTEMPT'S OWN VERIFY STEP DECIDES, AND A REFUSED DISCOVERY ELSEWHERE DOES NOT OVERRIDE IT.
+test fn verification_presentation_reads_the_attempts_own_verify_step() -> Bool {
+  let refused_tick = BeltTickReceipt {
     observed_at: "2026-08-02T02:00:00Z",
     execution: TickExecuted { instance_id: "srv1-live", deployed_revision: "0123456789abcdef0123456789abcdef01234567", spawn_mode: ManualReady },
     launches: [],
     spawn_pass: BeltPassRecorded,
     teardown_pass: BeltPassRecorded,
-    commit_pass: BeltPassRecorded,
-    verify_pass: BeltPassRefused { reason: "validation receipt could not be read" },
-    publish_pass: BeltPassDeferred { reason: "publish waits on verify" },
-    metering_pass: BeltPassRecorded,
-  }
-  let detail = belt_verification_presentation_detail(
-    progress: completed_attempt_progress(node_id: "pres-verify-refused-node"),
-    tick_read: BeltTickReceiptPresent { receipt: receipt },
+    discovery_pass: BeltPassRefused { reason: "the attempts ledger is unobservable" },
+  }
+  let blocked = belt_verification_presentation_detail(
+    progress: completed_attempt_progress(node_id: "pres-own-node"),
+    tick_read: BeltTickReceiptPresent { receipt: refused_tick },
+    obligation_read: BeltAttemptObligationReceiptPresent { verify: Present { value: BeltPassRefused { reason: "validation receipt could not be read" } } },
+  )
+  let failed = belt_verification_presentation_detail(
+    progress: completed_attempt_progress(node_id: "pres-own-node"),
+    tick_read: BeltTickReceiptPresent { receipt: refused_tick },
+    obligation_read: BeltAttemptObligationReceiptPresent { verify: Present { value: BeltPassFailed { reason: "validation verdict failed" } } },
   )
-  detail == "Verification blocked · validation receipt could not be read"
+  let no_step_falls_to_tick = belt_verification_presentation_detail(
+    progress: completed_attempt_progress(node_id: "pres-own-node"),
+    tick_read: BeltTickReceiptPresent { receipt: refused_tick },
+    obligation_read: BeltAttemptObligationReceiptPresent { verify: none },
+  )
+  blocked == "Verification blocked · validation receipt could not be read"
+    && failed == "Verification failed · validation verdict failed"
+    && no_step_falls_to_tick == "Verification blocked · the attempts ledger is unobservable"
+}
+
+// The receipt's verify step decodes from the bytes the run writes: a ran receipt whose verify step
+// failed reads back that pass, one with no verify step reads back none, and another schema refuses.
+test fn the_attempt_obligation_receipt_round_trips_its_verify_step() -> Bool {
+  let run = BeltAttemptObligationsRan { node_id: "n", attempt_key: "k", steps: [
+    BeltAttemptObligationStep { kind: CaptureObligation, pass: BeltPassRecorded, detail: json_string(s: "captured") },
+    BeltAttemptObligationStep { kind: VerifyObligation, pass: BeltPassFailed { reason: "validation verdict failed" }, detail: json_string(s: "failed") },
+  ] }
+  let with_verify = match decode_receipt_for_n_k(raw: serialize_json(v: belt_attempt_obligation_run_json(run: run, observed_at: "2026-10-06T00:00:00Z", claimed: ["e1"]))) {
+    BeltAttemptObligationReceiptPresent { verify: Present { value: BeltPassFailed { reason } } } => reason == "validation verdict failed"
+    _ => false
+  }
+  let without = match decode_receipt_for_n_k(raw: serialize_json(v: belt_attempt_obligation_run_json(run: BeltAttemptObligationsNotCurrent { node_id: "n", attempt_key: "k", reason: "superseded" }, observed_at: "2026-10-06T00:00:00Z", claimed: ["e1"]))) {
+    BeltAttemptObligationReceiptPresent { verify: Absent } => true
+    _ => false
+  }
+  with_verify && without && receipt_unreadable(raw: "{\"schema\":\"roadmap-belt-attempt-obligations/v0\"}")
 }
 
-test fn verification_presentation_verify_failed_is_failed() -> Bool {
-  let receipt = BeltTickReceipt {
-    observed_at: "2026-08-02T02:00:00Z",
-    execution: TickExecuted { instance_id: "srv1-live", deployed_revision: "0123456789abcdef0123456789abcdef01234567", spawn_mode: ManualReady },
-    launches: [],
-    spawn_pass: BeltPassRecorded,
-    teardown_pass: BeltPassRecorded,
-    commit_pass: BeltPassRecorded,
-    verify_pass: BeltPassFailed { reason: "validation verdict failed" },
-    publish_pass: BeltPassDeferred { reason: "publish waits on verify" },
-    metering_pass: BeltPassRecorded,
-  }
-  let detail = belt_verification_presentation_detail(
-    progress: completed_attempt_progress(node_id: "pres-verify-failed-node"),
-    tick_read: BeltTickReceiptPresent { receipt: receipt },
-  )
-  detail == "Verification failed · validation verdict failed"
+fn decode_receipt_for_n_k(raw: String) -> BeltAttemptObligationReceiptRead {
+  belt_attempt_obligation_receipt_decode(raw: raw, node_id: "n", attempt_key: "k")
+}
+
+fn receipt_unreadable(raw: String) -> Bool {
+  match decode_receipt_for_n_k(raw: raw) {
+    BeltAttemptObligationReceiptUnreadable { reason: _ } => true
+    _ => false
+  }
+}
+
+fn receipt_with_steps(node: String, attempt: String, standing: String, steps: String) -> String {
+  join(["{\"schema\":\"roadmap-belt-attempt-obligations/v1\",\"observed_at\":\"2026-10-06T00:00:00Z\",\"claimed_exits\":[],\"node\":\"", node, "\",\"attempt\":\"", attempt, "\",\"standing\":\"", standing, "\",\"steps\":", steps, "}"], "")
+}
+
+// THE DECODER IS TOTAL AND SUBJECT-BOUND (bold-bee-114, 2026-10-09): a foreign node or attempt, a duplicated
+// verify, a malformed or unknown kind, a malformed non-verify step and an unknown standing are each
+// unreadable, and the well-formed receipt for the subject is the positive control.
+test fn the_attempt_obligation_receipt_decoder_is_total_and_subject_bound() -> Bool {
+  let good_pass = belt_pass_outcome_json(o: BeltPassRecorded)
+  let verify = join(["{\"kind\":\"verify\",\"pass\":", serialize_json(v: good_pass), "}"], "")
+  let capture = join(["{\"kind\":\"capture\",\"pass\":", serialize_json(v: good_pass), "}"], "")
+  let positive = match decode_receipt_for_n_k(raw: receipt_with_steps(node: "n", attempt: "k", standing: "ran", steps: join(["[", capture, ",", verify, "]"], ""))) {
+    BeltAttemptObligationReceiptPresent { verify: Present { value: BeltPassRecorded } } => true
+    _ => false
+  }
+  positive
+    && receipt_unreadable(raw: receipt_with_steps(node: "other", attempt: "k", standing: "ran", steps: join(["[", verify, "]"], "")))
+    && receipt_unreadable(raw: receipt_with_steps(node: "n", attempt: "other", standing: "ran", steps: join(["[", verify, "]"], "")))
+    && receipt_unreadable(raw: receipt_with_steps(node: "n", attempt: "k", standing: "ran", steps: join(["[", verify, ",", verify, "]"], "")))
+    && receipt_unreadable(raw: receipt_with_steps(node: "n", attempt: "k", standing: "ran", steps: "[{\"kind\":7,\"pass\":{}}]"))
+    && receipt_unreadable(raw: receipt_with_steps(node: "n", attempt: "k", standing: "ran", steps: join(["[{\"kind\":\"bogus\",\"pass\":", serialize_json(v: good_pass), "}]"], "")))
+    && receipt_unreadable(raw: receipt_with_steps(node: "n", attempt: "k", standing: "ran", steps: join(["[{\"kind\":\"capture\",\"pass\":{\"outcome\":\"???\"}},", verify, "]"], "")))
+    && receipt_unreadable(raw: "{\"schema\":\"roadmap-belt-attempt-obligations/v1\",\"observed_at\":\"2026-10-06T00:00:00Z\",\"node\":\"n\",\"attempt\":\"k\",\"standing\":\"not-current\",\"reason\":\"r\"}")
+    && receipt_unreadable(raw: receipt_with_steps(node: "n", attempt: "k", standing: "weird", steps: join(["[", verify, "]"], "")))
 }
 
 test fn verification_presentation_wire_carries_detail() -> Bool {
   let j = serialize_json(v: belt_workflow_attempt_presentation_json_with_tick_read(
     progress: completed_attempt_progress(node_id: "pres-wire-node"),
     tick_read: BeltTickReceiptAbsent,
+    obligation_read: BeltAttemptObligationReceiptAbsent,
   ))
-  string_contains(s: j, pattern: "\"verification_presentation\": \"Verification queued - next belt tick\"")
+  string_contains(s: j, pattern: "\"verification_presentation\": \"Verification queued - awaiting its obligation\"")
 }
 
 test fn malformed_pass_reason_makes_receipt_unreadable() -> Bool {
@@ -1570,9 +1581,7 @@ test fn malformed_pass_reason_makes_receipt_unreadable() -> Bool {
     "\"observed_at\":\"2026-08-02T02:00:00Z\",",
     "\"spawn_pass\":{\"outcome\":\"recorded\"},",
     "\"teardown_pass\":{\"outcome\":\"recorded\"},",
-    "\"commit_pass\":{\"outcome\":\"recorded\"},",
-    "\"verify_pass\":{\"outcome\":\"refused\"},",
-    "\"publish_pass\":{\"outcome\":\"recorded\"}}",
+    "\"discovery_pass\":{\"outcome\":\"refused\"}}",
   ], "")
   match belt_tick_receipt_decode(raw: raw) {
     BeltTickReceiptUnreadable { reason: r } =>
@@ -2346,14 +2355,13 @@ fn pass_refused_with(o: BeltPassOutcome, pattern: String) -> Bool {
   }
 }
 
-fn all_four_refused_with(receipt: BeltTickReceipt, pattern: String) -> Bool {
+fn all_passes_refused_with(receipt: BeltTickReceipt, pattern: String) -> Bool {
   pass_refused_with(o: receipt.spawn_pass, pattern: pattern)
     && pass_refused_with(o: receipt.teardown_pass, pattern: pattern)
-    && pass_refused_with(o: receipt.verify_pass, pattern: pattern)
-    && pass_refused_with(o: receipt.publish_pass, pattern: pattern)
+    && pass_refused_with(o: receipt.discovery_pass, pattern: pattern)
 }
 
-test fn transition_halted_tick_refuses_all_four_passes() -> Bool {
+test fn transition_halted_tick_refuses_every_pass() -> Bool {
   let refusal = LaunchTransitionInhibited { reason: "deployment transition in force on this host" }
   let receipt = belt_tick_receipt_from_result(
     result: BeltTickResult {
@@ -2362,20 +2370,15 @@ test fn transition_halted_tick_refuses_all_four_passes() -> Bool {
       reconcile: belt_tick_empty_reconcile(state: ManualReady),
       spawn_outcomes: [],
       teardown_outcomes: [],
-      commit_outcomes: [],
-      verify_outcomes: [],
-      publish_outcomes: [],
-      review_outcomes: [],
-      audit_outcomes: [],
-      metering_outcomes: [],
+      discovery: BeltDiscoveryRefused { reason: launch_refusal_reason(r: refusal) },
     },
     observed_at: "2026-08-30T02:00:00Z",
     execution: TickExecuted { instance_id: "srv1-live", deployed_revision: "0123456789abcdef0123456789abcdef01234567", spawn_mode: ManualReady },
   )
-  all_four_refused_with(receipt: receipt, pattern: "deployment transition in force")
+  all_passes_refused_with(receipt: receipt, pattern: "deployment transition in force")
 }
 
-test fn revision_refusal_keeps_verify_independently_recorded() -> Bool {
+test fn revision_refusal_keeps_discovery_independently_recorded() -> Bool {
   let receipt = belt_tick_receipt_from_result(
     result: BeltTickResult {
       wholesale: TickPassesRun,
@@ -2383,20 +2386,14 @@ test fn revision_refusal_keeps_verify_independently_recorded() -> Bool {
       reconcile: belt_tick_empty_reconcile(state: ManualReady),
       spawn_outcomes: [],
       teardown_outcomes: [],
-      commit_outcomes: [],
-      verify_outcomes: [ VerifyRecorded { node_id: "n", verdict_key: "pass", detail: "ok" } ],
-      publish_outcomes: [],
-      review_outcomes: [],
-      audit_outcomes: [],
-      metering_outcomes: [],
+      discovery: BeltDiscovered { owed: 0, enqueues: [] },
     },
     observed_at: "2026-08-30T02:00:00Z",
     execution: TickExecuted { instance_id: "srv1-live", deployed_revision: "0123456789abcdef0123456789abcdef01234567", spawn_mode: ManualReady },
   )
   (match receipt.spawn_pass { BeltPassRefused { reason } => string_contains(s: reason, pattern: "deployed revision could not be observed") _ => false })
     && (match receipt.teardown_pass { BeltPassRefused { reason: _ } => true _ => false })
-    && (match receipt.verify_pass { BeltPassRecorded => true _ => false })
-    && (match receipt.publish_pass { BeltPassRecorded => true _ => false })
+    && (match receipt.discovery_pass { BeltPassRecorded => true _ => false })
 }
 
 fn launch_fixture_canary_graph() -> LaunchGraphStanding {
@@ -2609,34 +2606,6 @@ test fn a_real_commit_failure_still_fails_the_pass_beside_poisoned_ones() -> Boo
   failed && deferred_honestly && recorded_over_poison
 }
 
-// A POISONED ATTEMPT IS COUNTED, NOT SILENTLY DROPPED: the number is how many attempts this tick
-// are held for repair, counted in the tick result beside the siblings' verdicts. A zero here
-// would make the poison frequency vanish by construction, the deficit this witness exists to
-// keep visible.
-test fn the_poisoned_attempt_count_counts_only_capture_poisoned_rows() -> Bool {
-  let result = BeltTickResult {
-    wholesale: TickPassesRun,
-    host_refusal: Absent,
-    reconcile: belt_tick_empty_reconcile(state: ManualReady),
-    spawn_outcomes: [],
-    teardown_outcomes: [],
-    commit_outcomes: [
-      CommitCapturePoisoned { node_id: "n1", detail: "the recorded base names zero files" },
-      CommitSkipped { node_id: "n2", reason: "worktree clean" },
-      CommitCapturePoisoned { node_id: "n3", detail: "two or more arcs depend on this node" },
-    ],
-    verify_outcomes: [],
-    publish_outcomes: [],
-    review_outcomes: [],
-    audit_outcomes: [],
-    metering_outcomes: [],
-  }
-  belt_tick_commit_poisoned_count(t: result) == 2
-    && string_contains(
-      s: serialize_json(v: belt_tick_result_json_value(t: result)),
-      pattern: "\"commit_poisoned\": 2",
-    )
-}
 
 // THE POISON IS NAMED AT BOTH DURABLE RECORDS, the tick result's outcome row and the per-attempt
 // receipt that survives the pass receipt's collapse -- the operator repairs against the attempt's
diff --git a/dag/test/claim/roadmap/roadmap_belt_base_advance_witness_test.dag b/dag/test/claim/roadmap/roadmap_belt_base_advance_witness_test.dag
index b815aaa0a74..fdbb9af6086 100644
--- a/dag/test/claim/roadmap/roadmap_belt_base_advance_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_belt_base_advance_witness_test.dag
@@ -87,7 +87,7 @@ fn advanced_population(changes: List<WorktreeChange>, texts: Map<String, String>
                 Present { value: tip } =>
                   match find_corpus_manifest_record(store: repository.store, identity: tip.root.locator) {
                     CorpusManifestFound(record) => {
-                      let folded = belt_scm_advance_fold(path: "/nonexistent/envelope.json", store: repository.store, tip_record: record, changes: changes, texts: texts)
+                      let folded = belt_scm_advance_fold(store: repository.store, tip_record: record, changes: changes, texts: texts)
                       match folded.refused {
                         Present { value: _ } => none
                         Absent => Present { value: population(entries: path_unique_entry_list(unique: folded.unique)) }
diff --git a/dag/test/claim/roadmap/roadmap_belt_exit_drain_wet_witness_test.dag b/dag/test/claim/roadmap/roadmap_belt_exit_drain_wet_witness_test.dag
new file mode 100644
index 00000000000..04407803988
--- /dev/null
+++ b/dag/test/claim/roadmap/roadmap_belt_exit_drain_wet_witness_test.dag
@@ -0,0 +1,277 @@
+module test.claim.roadmap.roadmap_belt_exit_drain_wet_witness
+
+import extdeps.shell
+import std.types { Bool, String, List, NonEmptyStr }
+import gunbc.host_layout { attempt_exit_inbox_dir, attempt_exit_queued_dir, attempt_exit_running_dir, attempt_exit_done_dir, attempt_exit_refused_dir }
+import gunbc.roadmap.roadmap_attempt_exit_spool {
+  attempt_exit_hook, AttemptExitHookRendered, AttemptExitHookRefused, AttemptObligationRole, attempt_exit_record_observe, AttemptExitRecordFound, AttemptExitRecordNone, AttemptExitRecordUnreadable, AttemptWorkerRole,
+  attempt_exit_stage_list, AttemptExitInbox, AttemptExitQueued, AttemptExitRunning, AttemptExitDone, AttemptExitRefused, AttemptExitSpoolStage,
+  AttemptExitStageNames, AttemptExitStageUnreadable,
+}
+import gunbc.roadmap.roadmap_belt_obligation { BeltObligationEnqueue, BeltObligationStarted, BeltObligationHeld, belt_attempt_obligation_unit_name, belt_instance_obligation_unit_name, LaunchObligation }
+import gunbc.roadmap_belt_actuate {
+  belt_exit_drain_at, BeltExitDrain, BeltExitDrained, BeltExitDrainRefused, BeltExitEntryHanded, BeltExitEntryRefused,
+  belt_exit_entries_settle_at, belt_exit_entries_claim_at, BeltExitClaimed, BeltExitClaimRefused, belt_exec, ExecOk, ExecFailed, ExecRefused,
+}
+import gunbc.roadmap_dispatch_actuator {
+  host_exec_argv, AttemptUnitAbsent, AttemptUnitActive, AttemptUnitObservation, AttemptUnitStartRecorded, attempt_worker_unit_observation_of, worker_process_from_attempt_unit,
+}
+import gunbc.worker_lifecycle { WorkerProcessExited }
+
+// THE EXIT DRAIN AND THE COLLECTED-WORKER READ, RUN OVER A REAL SPOOL. Each control makes a spool under
+// a fresh temp directory with the deployment's stage layout (gunbc.host_layout), writes exit records
+// the way the stop hook does -- one `mkdir` whose name is the record -- and runs the production drain
+// (belt_exit_drain_at) and the production record read (attempt_exit_record_observe). The listings, the
+// decodes and every move are the real ones; only starting a unit in a user manager is supplied, by a
+// hand-off that answers Started and names the unit it would have started. Enrolled on the required
+// floor's local-repo wet lane with the temp-directory write named in gunbc.ci.ci_layer_roots.
+
+fn fresh_spool(tag: String) -> String {
+  let root = shell.Mktemp.DirWithTemplate(template: join(["/tmp/gunbc_exit_spool_", tag, ".XXXXXX"], "")).path
+  let made = belt_exec(cmd: host_exec_argv(program: "mkdir", args: ["-p", attempt_exit_inbox_dir(instance_root: root), attempt_exit_queued_dir(instance_root: root), attempt_exit_running_dir(instance_root: root), attempt_exit_done_dir(instance_root: root), attempt_exit_refused_dir(instance_root: root)]), workdir: "/")
+  root
+}
+
+fn record(root: String, name: String) -> Bool {
+  match belt_exec(cmd: host_exec_argv(program: "mkdir", args: ["--", join([attempt_exit_inbox_dir(instance_root: root), "/", name], "")]), workdir: "/") {
+    ExecOk { stdout: _ } => true
+    ExecFailed { program: _, exit_code: _, stderr: _ } => false
+    ExecRefused { program: _, reason: _ } => false
+  }
+}
+
+fn names_in(root: String, stage_is_queued: Bool) -> List<String> {
+  match attempt_exit_stage_list(instance_root: root, stage: if stage_is_queued { AttemptExitQueued } else { AttemptExitInbox }) {
+    AttemptExitStageNames { names } => names
+    AttemptExitStageUnreadable { reason: _ } => ["<unreadable>"]
+  }
+}
+
+fn names_at(root: String, stage: AttemptExitSpoolStage) -> List<String> {
+  match attempt_exit_stage_list(instance_root: root, stage: stage) {
+    AttemptExitStageNames { names } => names
+    AttemptExitStageUnreadable { reason: _ } => ["<unreadable>"]
+  }
+}
+
+fn claimed_of(root: String) -> List<String> {
+  match belt_exit_entries_claim_at(root: root, node_id: "wet-node", attempt_key: "feedfacefeedface") {
+    BeltExitClaimed { entries } => entries
+    BeltExitClaimRefused { reason: _ } => ["<refused>"]
+  }
+}
+
+fn held(node_id: String, attempt_key: String) -> BeltObligationEnqueue {
+  BeltObligationHeld { unit: belt_attempt_obligation_unit_name(node_id: node_id, attempt_key: attempt_key) }
+}
+
+fn sweep_started_for_attempt(drained: BeltExitDrain) -> Bool {
+  match drained {
+    BeltExitDrained { entries, launch: _ } =>
+      any(entries, e => match e {
+        BeltExitEntryHanded { entry: _, enqueue: BeltObligationStarted { unit } } => (unit as String) == (belt_attempt_obligation_unit_name(node_id: "wet-node", attempt_key: "feedfacefeedface") as String)
+        _ => false
+      })
+    BeltExitDrainRefused { reason: _ } => false
+  }
+}
+
+fn gone() -> AttemptUnitObservation {
+  AttemptUnitAbsent
+}
+
+fn live() -> AttemptUnitObservation {
+  AttemptUnitActive
+}
+
+fn handed(node_id: String, attempt_key: String) -> BeltObligationEnqueue {
+  BeltObligationStarted { unit: belt_attempt_obligation_unit_name(node_id: node_id, attempt_key: attempt_key) }
+}
+
+fn launched() -> BeltObligationEnqueue {
+  BeltObligationStarted { unit: belt_instance_obligation_unit_name(instance_id: "witness", kind: LaunchObligation) }
+}
+
+data worker_exit: String = "wet-node+feedfacefeedface+worker+0123456789abcdef0123456789abcdef+success+exited+0"
+data reviewer_exit: String = "wet-node+feedfacefeedface+review.conformance-leasing.abc123+0123456789abcdef0123456789abcdef+success+exited+0"
+
+// RED FIRST, DOGFOOD #4 (the hand-off half): a recorded worker exit is handed to ITS attempt's unit,
+// leaves the inbox for queued, and queues the launch; nothing else has to run for that to happen.
+test fn a_recorded_worker_exit_is_handed_to_its_attempt_and_leaves_the_inbox() -> Bool {
+  let root = fresh_spool(tag: "worker")
+  let wrote = record(root: root, name: worker_exit)
+  let drained = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let handed_to_attempt = match drained {
+    BeltExitDrained { entries, launch } =>
+      count(entries) == 1
+        && any(entries, e => match e {
+          BeltExitEntryHanded { entry, enqueue: BeltObligationStarted { unit } } => entry == worker_exit && (unit as String) == (belt_attempt_obligation_unit_name(node_id: "wet-node", attempt_key: "feedfacefeedface") as String)
+          _ => false
+        })
+        && (match launch { Present { value: BeltObligationStarted { unit: _ } } => true _ => false })
+    BeltExitDrainRefused { reason: _ } => false
+  }
+  wrote && handed_to_attempt && count(names_in(root: root, stage_is_queued: false)) == 0 && names_in(root: root, stage_is_queued: true) == [worker_exit]
+}
+
+// A reviewer's exit is handed to its attempt the same way but frees no worker capacity, so it does
+// not queue the launch; a name that is not a record leaves the inbox for refused, not stays to re-fire
+// the path unit.
+test fn a_reviewer_exit_queues_no_launch_and_a_malformed_entry_is_refused() -> Bool {
+  let root = fresh_spool(tag: "reviewer")
+  let wrote = record(root: root, name: reviewer_exit) && record(root: root, name: "not-a-record")
+  let drained = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let shape = match drained {
+    BeltExitDrained { entries, launch } =>
+      (match launch { Absent => true _ => false })
+        && any(entries, e => match e { BeltExitEntryRefused { entry, reason: _ } => entry == "not-a-record" _ => false })
+        && any(entries, e => match e { BeltExitEntryHanded { entry, enqueue: _ } => entry == reviewer_exit _ => false })
+    BeltExitDrainRefused { reason: _ } => false
+  }
+  wrote && shape && count(names_in(root: root, stage_is_queued: false)) == 0
+}
+
+// bold-bee-114 CONDITION 3: THE UNIT IS GONE AND THE SPOOL ENTRY ALONE PRODUCES THE EXIT VERDICT. After
+// the drain has moved the record to queued and the attempt's run has settled it to done, the worker's
+// unit is supplied as collected (the manager answers not-found), and the real record read over the
+// real spool yields the worker's exit -- not "never ran", not unobserved.
+test fn a_collected_workers_exit_is_read_from_the_spool_alone() -> Bool {
+  let root = fresh_spool(tag: "collected")
+  let wrote = record(root: root, name: worker_exit)
+  let drained = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let unsettled = belt_exit_entries_settle_at(root: root, claimed: claimed_of(root: root))
+  let unit = "gunbc-attempt-wet-node-feedfacefeedface.service" as NonEmptyStr
+  let verdict = worker_process_from_attempt_unit(
+    observation: attempt_worker_unit_observation_of(
+      unit: unit,
+      loaded: AttemptUnitAbsent,
+      record: attempt_exit_record_observe(instance_root: root, node_id: "wet-node", attempt_key: "feedfacefeedface", role: AttemptWorkerRole),
+      start: AttemptUnitStartRecorded,
+    ),
+    unit: unit,
+  )
+  wrote && count(unsettled) == 0 && count(names_in(root: root, stage_is_queued: true)) == 0
+    && (match verdict { WorkerProcessExited { exit_code, last_command: _ } => exit_code == 0 _ => false })
+}
+
+// bold-bee-114 NO-LAND (2026-10-09), CUT A -- an exit that arrives AFTER THE RUN'S FINAL OBSERVATION BUT
+// BEFORE SETTLEMENT is not acknowledged by a receipt that never observed it. The first exit is claimed
+// (queued -> running) and the second arrives while the unit is held; settling the claim moves only the
+// first to done, the second stays queued, and a later run's claim is what carries it to done.
+test fn an_exit_after_the_final_observation_stays_queued_until_a_later_runs_claim_settles_it() -> Bool {
+  let root = fresh_spool(tag: "cut-a")
+  let first = record(root: root, name: worker_exit)
+  let d1 = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let claim = claimed_of(root: root)
+  let second = record(root: root, name: reviewer_exit)
+  let d2 = belt_exit_drain_at(root: root, enqueue: (n, k) => held(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => live())
+  let unsettled = belt_exit_entries_settle_at(root: root, claimed: claim)
+  let after_first_run = claim == [worker_exit]
+    && names_at(root: root, stage: AttemptExitDone) == [worker_exit]
+    && names_at(root: root, stage: AttemptExitQueued) == [reviewer_exit]
+    && count(names_at(root: root, stage: AttemptExitRunning)) == 0
+  let next_claim = claimed_of(root: root)
+  let unsettled_next = belt_exit_entries_settle_at(root: root, claimed: next_claim)
+  first && second && count(unsettled) == 0 && after_first_run && next_claim == [reviewer_exit] && count(unsettled_next) == 0
+    && count(names_at(root: root, stage: AttemptExitQueued)) == 0 && count(names_at(root: root, stage: AttemptExitDone)) == 2
+}
+
+// CUT B -- an exit that arrives AFTER SETTLEMENT BUT BEFORE THE UNIT EXITS is handed to a unit that is
+// still held (so the hand-off is a no-op and nothing ran for it). The entry stays queued: the queued
+// level starts the drain again, and once the unit is gone the drain's sweep starts a run for the
+// attempt, which claims the entry and settles it to done under its own claim.
+test fn an_exit_after_settlement_is_swept_to_a_new_run_once_the_unit_is_gone() -> Bool {
+  let root = fresh_spool(tag: "cut-b")
+  let first = record(root: root, name: worker_exit)
+  let d1 = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let unsettled = belt_exit_entries_settle_at(root: root, claimed: claimed_of(root: root))
+  let late = record(root: root, name: reviewer_exit)
+  let while_held = belt_exit_drain_at(root: root, enqueue: (n, k) => held(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let still_queued = names_at(root: root, stage: AttemptExitQueued) == [reviewer_exit] && !(names_at(root: root, stage: AttemptExitDone) == [worker_exit, reviewer_exit])
+  let unit_gone = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let new_run_claim = claimed_of(root: root)
+  let settled = belt_exit_entries_settle_at(root: root, claimed: new_run_claim)
+  first && late && count(unsettled) == 0 && still_queued && sweep_started_for_attempt(drained: unit_gone)
+    && new_run_claim == [reviewer_exit] && count(settled) == 0 && count(names_at(root: root, stage: AttemptExitQueued)) == 0
+    && count(names_at(root: root, stage: AttemptExitDone)) == 2
+}
+
+// CUT C -- THE UNIT OR THE HOST IS GONE WHILE AN ENTRY IS QUEUED. The drain runs with an EMPTY inbox, the
+// sweep alone finds the queued entry and starts its attempt's run, and that run's claim is the only thing
+// that moves it to done.
+test fn a_queued_exit_needs_no_new_event_to_reach_done_under_a_runs_claim() -> Bool {
+  let root = fresh_spool(tag: "cut-c")
+  let first = record(root: root, name: worker_exit)
+  let handed_once = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let sweep_only = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let adopted = claimed_of(root: root)
+  let settled = belt_exit_entries_settle_at(root: root, claimed: adopted)
+  first && sweep_started_for_attempt(drained: sweep_only) && adopted == [worker_exit]
+    && count(settled) == 0 && count(names_at(root: root, stage: AttemptExitQueued)) == 0 && names_at(root: root, stage: AttemptExitDone) == [worker_exit]
+}
+
+// RED (a) -- A LONE ORPHANED CLAIM, NO OTHER EVENT (bold-bee-114, 2026-10-09). The entry was queued, a run
+// claimed it into `running`, and the run died before its receipt (host or user-manager restart: no hook ran).
+// Inbox and queued are EMPTY and the unit is absent; the drain -- all a boot establishes -- must return the
+// claim to queued, start the attempt, and the new run must adopt it and settle it to done under its claim.
+test fn a_lone_orphaned_claim_is_recovered_by_the_drain_alone() -> Bool {
+  let root = fresh_spool(tag: "orphan-a")
+  let first = record(root: root, name: worker_exit)
+  let handed_once = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let dead_run_claim = claimed_of(root: root)
+  let stranded = names_at(root: root, stage: AttemptExitRunning) == [worker_exit] && count(names_at(root: root, stage: AttemptExitInbox)) == 0 && count(names_at(root: root, stage: AttemptExitQueued)) == 0
+  let boot = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let adopted = claimed_of(root: root)
+  let settled = belt_exit_entries_settle_at(root: root, claimed: adopted)
+  first && dead_run_claim == [worker_exit] && stranded && sweep_started_for_attempt(drained: boot) && adopted == [worker_exit]
+    && count(settled) == 0 && count(names_at(root: root, stage: AttemptExitRunning)) == 0 && names_at(root: root, stage: AttemptExitDone) == [worker_exit]
+}
+
+// A claim whose unit is LIVE is not an orphan: the drain leaves it in running and starts nothing.
+test fn a_claim_held_by_a_live_unit_is_not_reclaimed() -> Bool {
+  let root = fresh_spool(tag: "orphan-live")
+  let first = record(root: root, name: worker_exit)
+  let handed_once = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let claimed = claimed_of(root: root)
+  let again = belt_exit_drain_at(root: root, enqueue: (n, k) => held(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => live())
+  first && claimed == [worker_exit] && names_at(root: root, stage: AttemptExitRunning) == [worker_exit] && count(names_at(root: root, stage: AttemptExitQueued)) == 0
+}
+
+data obligation_exit: String = "wet-node+feedfacefeedface+obligation+0123456789abcdef0123456789abcdef+timeout+killed+TERM"
+
+// RED (b) -- THE CLAIMANT IS KILLED BY ITS OWN RuntimeMaxSec. The unit's stop hook (the production
+// attempt_exit_hook for AttemptObligationRole) records an `obligation` entry while the unit is still
+// stopping. A drain that finds the unit live must NOT consume it; the next drain, the unit gone, returns
+// the orphaned claim to queued, consumes the entry, starts the attempt, and the run adopts and settles.
+test fn a_claimant_killed_at_its_run_bound_is_rescued_by_its_stop_hook_entry() -> Bool {
+  let root = fresh_spool(tag: "orphan-b")
+  let hook_renders = match attempt_exit_hook(instance_root: root, node_id: "wet-node", attempt_key: "feedfacefeedface", role: AttemptObligationRole) {
+    AttemptExitHookRendered { exec_line } => string_contains(s: exec_line as String, pattern: "+obligation+") && string_contains(s: exec_line as String, pattern: attempt_exit_inbox_dir(instance_root: root))
+    AttemptExitHookRefused { reason: _ } => false
+  }
+  let first = record(root: root, name: worker_exit)
+  let handed_once = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let dead_run_claim = claimed_of(root: root)
+  let hook = record(root: root, name: obligation_exit)
+  let while_stopping = belt_exit_drain_at(root: root, enqueue: (n, k) => held(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => live())
+  let kept = names_at(root: root, stage: AttemptExitInbox) == [obligation_exit] && names_at(root: root, stage: AttemptExitRunning) == [worker_exit]
+  let after_exit = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let adopted = claimed_of(root: root)
+  let settled = belt_exit_entries_settle_at(root: root, claimed: adopted)
+  hook_renders && first && hook && dead_run_claim == [worker_exit] && kept && sweep_started_for_attempt(drained: after_exit) && adopted == [worker_exit]
+    && count(settled) == 0 && count(names_at(root: root, stage: AttemptExitInbox)) == 0 && count(names_at(root: root, stage: AttemptExitRunning)) == 0
+    && any(names_at(root: root, stage: AttemptExitDone), e => e == worker_exit) && any(names_at(root: root, stage: AttemptExitDone), e => e == obligation_exit)
+}
+
+// A SETTLED RUN'S HOOK ENTRY STARTS NOTHING (the loop guard): running is empty, so consuming the entry
+// enqueues no unit and the exits stop there.
+test fn a_settled_runs_hook_entry_is_consumed_and_starts_nothing() -> Bool {
+  let root = fresh_spool(tag: "orphan-settled")
+  let hook = record(root: root, name: obligation_exit)
+  let drained = belt_exit_drain_at(root: root, enqueue: (n, k) => handed(node_id: n, attempt_key: k), launch: fn() { launched() }, observe: (n, k) => gone())
+  let quiet = match drained {
+    BeltExitDrained { entries, launch } => count(entries) == 0 && launch == none
+    BeltExitDrainRefused { reason: _ } => false
+  }
+  hook && quiet && count(names_at(root: root, stage: AttemptExitInbox)) == 0 && names_at(root: root, stage: AttemptExitDone) == [obligation_exit]
+}
diff --git a/dag/test/claim/roadmap/roadmap_belt_obligation_witness_test.dag b/dag/test/claim/roadmap/roadmap_belt_obligation_witness_test.dag
new file mode 100644
index 00000000000..59f669896f9
--- /dev/null
+++ b/dag/test/claim/roadmap/roadmap_belt_obligation_witness_test.dag
@@ -0,0 +1,117 @@
+module test.claim.roadmap.roadmap_belt_obligation_witness_test
+
+import std.types { Bool, String, List, NonEmptyStr }
+import gunbc.roadmap_workflow_stage {
+  WorkflowSegment, WorkflowSegmentKind, WorkflowSegmentState,
+  SubmissionWorkflowSegment, VerificationWorkflowSegment, PublicationWorkflowSegment, ReviewWorkflowSegment, GoalAuditWorkflowSegment,
+  WorkflowSegmentPending, WorkflowSegmentActive, WorkflowSegmentComplete, WorkflowSegmentFailed,
+}
+import gunbc.roadmap_provider_events { ProviderExecutionState, ProviderRunning, ProviderCompleted, ProviderFailed }
+import gunbc.roadmap.roadmap_belt_obligation {
+  BeltAttemptObligationKind, CaptureObligation, VerifyObligation, ReviewObligation, AuditObligation, PublishObligation,
+  belt_attempt_outstanding, belt_attempt_next_after, belt_attempt_obligation_kind_key,
+  belt_attempt_obligation_unit_name, belt_instance_obligation_unit_name,
+  ServedObservationObligation, LaunchObligation, belt_record_moved_obligation_kinds, belt_instance_obligation_kind_key,
+}
+import gunbc.roadmap_belt_actuate {
+  belt_obligation_hold_decision, BeltObligationMayStart, BeltObligationIsHeld, BeltObligationHoldUnread,
+}
+import gunbc.roadmap_dispatch_actuator { AttemptUnitActive, AttemptUnitAbsent, AttemptUnitFinished, AttemptUnitUnreadable }
+import gunbc.live_deploy.emit { live_deploy_belt_exit_path_unit_file, live_deploy_belt_exit_drain_service_unit_file }
+import gunbc.live_deploy.spec { deployment_belt_exit_drain_service_unit_name, deployment_owned_steps, DeploymentArtifactStep }
+import gunbc.live_deploy.desired { deployment_spec_srv1 }
+import gunbc.roadmap_dashboard_instance { srv1_live_dashboard_instance }
+import gunbc.host_layout { attempt_exit_inbox_dir }
+import extdeps.systemd.unit_file { systemd_unit_file_lines }
+
+// THE OBLIGATION MODEL'S DECISIONS over supplied evidence (DESIGN section 3: a witness discriminates at
+// one interface, so the attempt's segments are supplied, not produced by running a worker). The
+// production route that consumes them -- gunbc.roadmap_belt_actuate belt_attempt_obligations_run and
+// belt_discover_for_instance -- reads the same derivation; the wet witness beside this file runs the
+// exit drain over a real spool.
+
+fn seg(kind: WorkflowSegmentKind, state: WorkflowSegmentState) -> WorkflowSegment {
+  WorkflowSegment { kind: kind, state: state, detail: "" }
+}
+
+fn keys(kinds: List<BeltAttemptObligationKind>) -> String {
+  join(kinds |> map(k => belt_attempt_obligation_kind_key(kind: k)), ",")
+}
+
+fn segments(submission: WorkflowSegmentState, verification: WorkflowSegmentState, review: WorkflowSegmentState, audit: WorkflowSegmentState, publication: WorkflowSegmentState) -> List<WorkflowSegment> {
+  [
+    seg(kind: SubmissionWorkflowSegment, state: submission),
+    seg(kind: VerificationWorkflowSegment, state: verification),
+    seg(kind: ReviewWorkflowSegment, state: review),
+    seg(kind: GoalAuditWorkflowSegment, state: audit),
+    seg(kind: PublicationWorkflowSegment, state: publication),
+  ]
+}
+
+// Each kind is owed exactly when its predecessor's evidence is complete and its own is unsettled.
+test fn each_obligation_is_owed_only_on_its_predecessors_evidence() -> Bool {
+  let running = keys(kinds: belt_attempt_outstanding(provider: ProviderRunning { activity: "turn 3" }, segments: segments(submission: WorkflowSegmentPending, verification: WorkflowSegmentPending, review: WorkflowSegmentPending, audit: WorkflowSegmentPending, publication: WorkflowSegmentPending)))
+  let exited = keys(kinds: belt_attempt_outstanding(provider: ProviderCompleted { activity: "done" }, segments: segments(submission: WorkflowSegmentPending, verification: WorkflowSegmentPending, review: WorkflowSegmentPending, audit: WorkflowSegmentPending, publication: WorkflowSegmentPending)))
+  let captured = keys(kinds: belt_attempt_outstanding(provider: ProviderCompleted { activity: "done" }, segments: segments(submission: WorkflowSegmentComplete, verification: WorkflowSegmentPending, review: WorkflowSegmentPending, audit: WorkflowSegmentPending, publication: WorkflowSegmentPending)))
+  let verified = keys(kinds: belt_attempt_outstanding(provider: ProviderCompleted { activity: "done" }, segments: segments(submission: WorkflowSegmentComplete, verification: WorkflowSegmentComplete, review: WorkflowSegmentActive, audit: WorkflowSegmentPending, publication: WorkflowSegmentPending)))
+  let reviewed = keys(kinds: belt_attempt_outstanding(provider: ProviderCompleted { activity: "done" }, segments: segments(submission: WorkflowSegmentComplete, verification: WorkflowSegmentComplete, review: WorkflowSegmentComplete, audit: WorkflowSegmentComplete, publication: WorkflowSegmentPending)))
+  let settled = keys(kinds: belt_attempt_outstanding(provider: ProviderCompleted { activity: "done" }, segments: segments(submission: WorkflowSegmentComplete, verification: WorkflowSegmentComplete, review: WorkflowSegmentComplete, audit: WorkflowSegmentComplete, publication: WorkflowSegmentComplete)))
+  running == "" && exited == "capture" && captured == "verify" && verified == "review,audit" && reviewed == "publish" && settled == ""
+}
+
+// A FAILED STAGE STOPS THE LINE FOR ITS ATTEMPT: it is not owed again, so nothing retries it without
+// the operator (2026-10-03 manual-resume ruling). A failed worker still owes its capture.
+test fn a_failed_stage_is_not_owed_and_a_failed_worker_still_owes_capture() -> Bool {
+  let failed_verify = keys(kinds: belt_attempt_outstanding(provider: ProviderCompleted { activity: "done" }, segments: segments(submission: WorkflowSegmentComplete, verification: WorkflowSegmentFailed, review: WorkflowSegmentPending, audit: WorkflowSegmentPending, publication: WorkflowSegmentPending)))
+  let failed_worker = keys(kinds: belt_attempt_outstanding(provider: ProviderFailed { activity: "turn 2", detail: "exit 1" }, segments: segments(submission: WorkflowSegmentPending, verification: WorkflowSegmentPending, review: WorkflowSegmentPending, audit: WorkflowSegmentPending, publication: WorkflowSegmentPending)))
+  failed_verify == "" && failed_worker == "capture"
+}
+
+// THE CHAIN NEVER LOOPS: after a kind runs, only what lies strictly downstream is next, so a capture
+// that left its submission unsettled is not run again by its own chain.
+test fn after_a_kind_runs_only_strictly_downstream_kinds_are_next() -> Bool {
+  let all = [CaptureObligation, VerifyObligation, ReviewObligation, AuditObligation, PublishObligation]
+  keys(kinds: belt_attempt_next_after(ran: CaptureObligation, outstanding: all)) == "verify,review,audit,publish"
+    && keys(kinds: belt_attempt_next_after(ran: ReviewObligation, outstanding: all)) == "publish"
+    && keys(kinds: belt_attempt_next_after(ran: AuditObligation, outstanding: [ReviewObligation, PublishObligation])) == "publish"
+    && keys(kinds: belt_attempt_next_after(ran: PublishObligation, outstanding: all)) == ""
+}
+
+// RED FIRST, DOGFOOD #6: A VERIFY THAT RUNS LONG DOES NOT DELAY PUBLISH OF AN UNRELATED ATTEMPT, NOR
+// THE SERVED OBSERVATION. Attempt A is mid-verify -- its unit is loaded and running for as long as the
+// verify takes. Attempt B is reviewed and owes its publish. The only thing the two could share is a
+// unit, so the claim is that they do not: B's unit and the observation's unit are different names from
+// A's, and the hold decision -- the one gate between an owed obligation and its unit starting -- holds
+// A and lets B and the observation start, reading nothing of A when it decides B. Before this change
+// the claim was false by construction: B's publish and the observation ran inside the same process as
+// A's verify, after it.
+test fn a_long_verify_does_not_delay_another_attempts_publish_or_the_observation() -> Bool {
+  let a_unit = belt_attempt_obligation_unit_name(node_id: "node-a", attempt_key: "aaaa")
+  let b_unit = belt_attempt_obligation_unit_name(node_id: "node-b", attempt_key: "bbbb")
+  let observe_unit = belt_instance_obligation_unit_name(instance_id: "srv2-deploy", kind: ServedObservationObligation)
+  let b_owes_publish = keys(kinds: belt_attempt_outstanding(provider: ProviderCompleted { activity: "done" }, segments: segments(submission: WorkflowSegmentComplete, verification: WorkflowSegmentComplete, review: WorkflowSegmentComplete, audit: WorkflowSegmentComplete, publication: WorkflowSegmentPending))) == "publish"
+  let a_mid_verify = keys(kinds: belt_attempt_outstanding(provider: ProviderCompleted { activity: "done" }, segments: segments(submission: WorkflowSegmentComplete, verification: WorkflowSegmentActive, review: WorkflowSegmentPending, audit: WorkflowSegmentPending, publication: WorkflowSegmentPending))) == "verify"
+  let a_held = match belt_obligation_hold_decision(observation: AttemptUnitActive) { BeltObligationIsHeld => true _ => false }
+  let b_starts = match belt_obligation_hold_decision(observation: AttemptUnitAbsent) { BeltObligationMayStart => true _ => false }
+  let observe_starts = match belt_obligation_hold_decision(observation: AttemptUnitFinished { exit_status: "0" }) { BeltObligationMayStart => true _ => false }
+  let unread_refuses = match belt_obligation_hold_decision(observation: AttemptUnitUnreadable { reason: "bus" }) { BeltObligationHoldUnread { reason: _ } => true _ => false }
+  (a_unit as String) != (b_unit as String) && (a_unit as String) != (observe_unit as String) && (b_unit as String) != (observe_unit as String)
+    && b_owes_publish && a_mid_verify && a_held && b_starts && observe_starts && unread_refuses
+    && any(belt_record_moved_obligation_kinds, k => belt_instance_obligation_kind_key(kind: k) == "observe")
+}
+
+// RED FIRST, DOGFOOD #4 (the deployment half): WITH NO TIMER INSTALLED, a worker exit reaches its
+// capture. The deployment installs no belt timer -- none of its owned steps is a timer member -- and
+// what it installs instead watches the instance's exit inbox and starts the drain, which hands the exit
+// to its attempt (the wet witness runs that hand-off over a real spool; the confinement witness shows
+// the worker unit writes the record).
+test fn the_deployment_wakes_the_drain_on_an_exit_and_installs_no_belt_timer() -> Bool {
+  let spec = deployment_spec_srv1()
+  let lines = systemd_unit_file_lines(file: live_deploy_belt_exit_path_unit_file(spec: spec))
+  let inbox = attempt_exit_inbox_dir(instance_root: spec.service.instance_root as String)
+  let steps = deployment_owned_steps(instance: srv1_live_dashboard_instance(), names: spec.names)
+  any(lines, l => l == join(["DirectoryNotEmpty=", inbox], ""))
+    && any(lines, l => l == join(["Unit=", deployment_belt_exit_drain_service_unit_name(names: spec.names) as String], ""))
+    && !any(steps, st => string_contains(s: st.path as String, pattern: "-belt.timer"))
+    && any(systemd_unit_file_lines(file: live_deploy_belt_exit_drain_service_unit_file(spec: spec)), l => string_contains(s: l, pattern: "--function belt_exit_drain_cli"))
+}
diff --git a/dag/test/claim/roadmap/roadmap_dashboard_instance_apply_witness_test.dag b/dag/test/claim/roadmap/roadmap_dashboard_instance_apply_witness_test.dag
index 3d169d4d871..239a646619d 100644
--- a/dag/test/claim/roadmap/roadmap_dashboard_instance_apply_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_dashboard_instance_apply_witness_test.dag
@@ -308,8 +308,8 @@ test fn dashboard_health_requires_intended_instance_identity() -> Bool {
 test fn dashboard_plan_is_end_to_end_and_production_disjoint() -> Bool {
   let lab = srv1_lab_dashboard_instance()
   let rows = dashboard_instance_provision_plan_rows(instance: lab)
-  count(rows) == 18
-    && any(rows, row => row.kind == "ensure-provider-state-root")
+  count(rows) == 9
+    && !any(rows, row => row.kind == "ensure-provider-state-root" || row.kind == "ensure-directory")
     && any(rows, row => row.kind == "ensure-serve-binary")
     && any(rows, row => row.kind == "hydrate-controller-history")
     && any(rows, row => row.kind == "prepare-git-bundle")
diff --git a/dag/test/claim/roadmap/roadmap_dashboard_instance_witness_test.dag b/dag/test/claim/roadmap/roadmap_dashboard_instance_witness_test.dag
index d2b368b2630..f494b8c7c2b 100644
--- a/dag/test/claim/roadmap/roadmap_dashboard_instance_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_dashboard_instance_witness_test.dag
@@ -1,6 +1,13 @@
 module test.claim.roadmap_dashboard_instance_witness
 
 import std.types { Bool, String, NonEmptyStr, FilePath, Port }
+import gunbc.roadmap.dashboard_instance_directories { dashboard_instance_directory_demands }
+import gunbc.owned_directory { owned_directory_path }
+import gunbc.auth.session_store { session_store_directory }
+import gunbc.auth.login_transaction_store { login_transaction_store_directory }
+import gunbc.auth.oidc_id_token_verification { jwks_cache_directory }
+import gunbc.auth.profile_projection { profile_store_directory }
+import gunbc.roadmap_view_preference_store { issue_view_store_directory }
 import extdeps.tmux { shape_tmux_ls_argv_for, DefaultTmuxServer }
 import gunbc.provider_account {
   CodexDefaultAccount,
@@ -22,7 +29,6 @@ import gunbc.host_layout {
   srv1_codex_bundled_executable,
 }
 import gunbc.deployment_risk { deployment_id }
-import gunbc.roadmap.roadmap_event_carrier { roadmap_event_carrier_layout_for_instance }
 import gunbc.roadmap_dashboard_instance {
   fleet_admitted_revision_source,
   HostDashboardInstance,
@@ -32,10 +38,6 @@ import gunbc.roadmap_dashboard_instance {
   DashboardHydrateControllerHistory,
   DashboardPrepareGitBundle,
   DashboardStageGitBundle,
-  DashboardEnsureDirectory,
-  dashboard_auth_stores,
-  dashboard_instance_auth_store_root,
-  DashboardEnsureProviderStateRoot,
   DashboardEnsureServeBinary,
   DashboardEnsureOwnershipMarker,
   DashboardEnsureLocalOrigin,
@@ -225,8 +227,8 @@ fn plan_binds_source_ref_translation(
 test fn dashboard_provision_plan_consumes_one_instance() -> Bool {
   let lab = srv1_lab_dashboard_instance()
   let plan = dashboard_instance_provision_plan(instance: lab)
-  count(plan) == 18
-    && plan_ensures_every_auth_store_root(plan: plan, instance: lab)
+  count(plan) == 9
+    && demands_cover_every_auth_store(instance: lab)
     && plan_binds_instance_paths(plan: plan, instance: lab)
     && plan_binds_source_ref_translation(plan: plan, instance: lab)
 }
@@ -254,8 +256,8 @@ fn lab_observed(
     } else {
       "source revision drift: desired=abc observed=def"
     },
-    attempts_present: true,
-    attempt_state_present: true,
+    directories_converged: true,
+    directory_refusals: [],
     provider_runtime_ready: true,
     provider_runtime_detail: "codex-cli test",
     provider_authenticated: true,
@@ -375,8 +377,8 @@ test fn dashboard_bundle_is_required_for_convergence() -> Bool {
     source_revision_observed: true,
     source_revision_current: true,
     source_revision_detail: "desired=abc observed=abc",
-    attempts_present: true,
-    attempt_state_present: true,
+    directories_converged: true,
+    directory_refusals: [],
     provider_runtime_ready: true,
     provider_runtime_detail: "codex-cli test",
     provider_authenticated: true,
@@ -412,7 +414,7 @@ test fn dashboard_source_capture_has_no_manual_await_step() -> Bool {
       anchor_ref,
     } =>
       controller_repo == srv1_dashboard_controller_repo
-        && anchor_ref == "refs/heads/session/codex-provider-feedback-v0"
+        && anchor_ref == "refs/remotes/origin/main"
     _ => false
   })
     && any(plan, op => match op {
@@ -437,8 +439,8 @@ test fn dashboard_reconcile_refuses_unmarked_existing_source() -> Bool {
     source_revision_observed: false,
     source_revision_current: false,
     source_revision_detail: "source repository unavailable",
-    attempts_present: false,
-    attempt_state_present: false,
+    directories_converged: false,
+    directory_refusals: [],
     provider_runtime_ready: false,
     provider_runtime_detail: "provider runtime unavailable",
     provider_authenticated: false,
@@ -537,8 +539,8 @@ fn witness_synthetic_instance() -> HostDashboardInstance {
 // page all read correctly — no refusal, just unintended content rendered plausibly. Unlike the host
 // facts, which produced identical values on both hosts and therefore no wrong output at all, this
 // one produces a page that looks right and is not.\n\nThe claim asserts the anchors are
-// per-instance and DIFFER, so collapsing them back to one shared literal fails whichever way it
-// collapses.
+// per-instance: the synthetic instance's own anchor fails if the constructor collapses back to one
+// shared literal. Two labs may lawfully follow the same ref (srv1 and srv2 labs both follow main).
 
 test fn source_anchor_is_per_instance_not_one_shared_literal() -> Bool {
   let synthetic = instance_anchor_ref(i: witness_synthetic_instance())
@@ -546,8 +548,7 @@ test fn source_anchor_is_per_instance_not_one_shared_literal() -> Bool {
   let srv1_lab = instance_anchor_ref(i: srv1_lab_dashboard_instance())
   synthetic == "refs/heads/witness-anchor"
     && srv2_lab == "refs/remotes/origin/main"
-    && srv1_lab == "refs/heads/session/codex-provider-feedback-v0"
-    && !(srv2_lab == srv1_lab)
+    && srv1_lab == "refs/remotes/origin/main"
 }
 
 // serve_binary MOVED OFF THE LAYOUT AND THIS CLAIM CAUGHT IT, which is the whole reason it exists.
@@ -623,36 +624,29 @@ test fn srv2_lab_owns_paths_disjoint_from_preview_and_production() -> Bool {
 test fn srv2_lab_has_a_provision_plan_bound_to_itself() -> Bool {
   let lab = srv2_lab_dashboard_instance()
   let plan = dashboard_instance_provision_plan(instance: lab)
-  count(plan) == 18
-    && plan_ensures_every_auth_store_root(plan: plan, instance: lab)
+  count(plan) == 9
+    && demands_cover_every_auth_store(instance: lab)
     && plan_binds_instance_paths(plan: plan, instance: lab)
     && plan_binds_source_ref_translation(plan: plan, instance: lab)
 }
 
-// TWO PATHS THE PLAN VERIFIED WITHOUT EVER CREATING, both found by running the thing rather than reading it. The provider state root: DashboardVerifyProviderAuth reads it, nothing made it, so the only command that can populate it failed with 'that path does not exist' before any OAuth began — an operator hitting a CLI error instead of a typed refusal. The serve binary: instances used to BORROW production's, which is why no install step existed; making each instance own its own closed a retract hazard and left the install with no owner.\n\nBoth claims are stated as containment in the plan rather than as a count, because a count says the plan has sixteen things and nothing about whether the right two are among them. Each asserts the op targets the INSTANCE's own path — a plan that ensured some other instance's binary would satisfy a count and fail here.
-// THE AUTH STORES ARE PROVISIONED, stated as containment: every store the auth modules write
-// into has an ensure step for THIS instance's root. The profile store once had none, so every
-// login's profile publication was refused and the assignee surfaces rendered the raw principal.
-fn plan_ensures_every_auth_store_root(
-  plan: List<DashboardInstanceProvisionOp>,
-  instance: HostDashboardInstance,
-) -> Bool {
-  all(dashboard_auth_stores, store => any(plan, op => match op {
-    DashboardEnsureDirectory { path } =>
-      path == dashboard_instance_auth_store_root(instance: instance, store: store)
-    _ => false
-  }))
+// TWO PATHS THE APPLY VERIFIED WITHOUT EVER CREATING, both found by running the thing rather than reading it. The provider state root: DashboardVerifyProviderAuth reads it, nothing made it, so the only command that can populate it failed with 'that path does not exist' before any OAuth began. The serve binary: instances used to BORROW production's, which is why no install step existed.\n\nThe directories are now owned-directory demands (gunbc.roadmap.dashboard_instance_directories) ensured before the plan runs, and the binary is a plan op; each claim is containment of THIS instance's own path.
+// THE AUTH STORES ARE DEMANDED, stated as containment: every store the auth modules write into has
+// a demand for THIS instance's root, read off the store's own demand function. The profile store once
+// had no creator, so every login's profile publication was refused.
+fn demands_contain_path(instance: HostDashboardInstance, path: FilePath) -> Bool {
+  any(dashboard_instance_directory_demands(instance: instance), t => owned_directory_path(t: t) == path)
 }
 
-fn plan_ensures_provider_state_root(
-  plan: List<DashboardInstanceProvisionOp>,
-  instance: HostDashboardInstance,
-) -> Bool {
-  any(plan, op => match op {
-    DashboardEnsureProviderStateRoot { path } =>
-      path == dashboard_instance_provider_state_root(instance: instance)
-    _ => false
-  })
+fn demands_cover_every_auth_store(instance: HostDashboardInstance) -> Bool {
+  all([
+    session_store_directory(instance: instance),
+    login_transaction_store_directory(instance: instance),
+    jwks_cache_directory(instance: instance),
+    profile_store_directory(instance: instance),
+    issue_view_store_directory(instance: instance),
+  ], t => demands_contain_path(instance: instance, path: owned_directory_path(t: t))
+    && dashboard_path_is_under(path: owned_directory_path(t: t), root: instance.instance_root))
 }
 
 fn plan_ensures_serve_binary(
@@ -666,45 +660,16 @@ fn plan_ensures_serve_binary(
   })
 }
 
-test fn the_plan_creates_every_path_it_later_verifies() -> Bool {
+test fn the_apply_creates_every_path_it_later_verifies() -> Bool {
   let lab = srv1_lab_dashboard_instance()
   let srv2 = srv2_lab_dashboard_instance()
-  let lab_plan = dashboard_instance_provision_plan(instance: lab)
-  let srv2_plan = dashboard_instance_provision_plan(instance: srv2)
-  plan_ensures_provider_state_root(plan: lab_plan, instance: lab)
-    && plan_ensures_serve_binary(plan: lab_plan, instance: lab)
-    && plan_ensures_provider_state_root(plan: srv2_plan, instance: srv2)
-    && plan_ensures_serve_binary(plan: srv2_plan, instance: srv2)
-    && any(lab_plan, op => match op {
-      DashboardEnsureDirectory { path } =>
-        path == dashboard_instance_dispatch_worktree_root(instance: lab)
-      _ => false
-    })
-    && any(lab_plan, op => match op {
-      DashboardEnsureDirectory { path } =>
-        path == dashboard_instance_dispatch_attempt_state_root(instance: lab)
-      _ => false
-    })
-}
-
-// THE EVENT WORKTREE IS PROVISIONED, stated against the CARRIER'S OWN layout rather than a
-// literal: the plan ensures exactly the directory gunbc.roadmap.roadmap_event_carrier checks the
-// event branch out into. srv1's instance root is root-owned, so with no ensure step the carrier's
-// `git worktree add` could not create it and every issue page answered 503. Both srv1 instances
-// are checked because the live one is the one that failed.
-fn plan_ensures_roadmap_events_worktree(instance: HostDashboardInstance) -> Bool {
-  any(dashboard_instance_provision_plan(instance: instance), op => match op {
-    DashboardEnsureDirectory { path } =>
-      path == roadmap_event_carrier_layout_for_instance(instance: instance).worktree
-    _ => false
-  })
+  demands_contain_path(instance: lab, path: dashboard_instance_provider_state_root(instance: lab))
+    && plan_ensures_serve_binary(plan: dashboard_instance_provision_plan(instance: lab), instance: lab)
+    && demands_contain_path(instance: srv2, path: dashboard_instance_provider_state_root(instance: srv2))
+    && plan_ensures_serve_binary(plan: dashboard_instance_provision_plan(instance: srv2), instance: srv2)
+    && demands_contain_path(instance: lab, path: dashboard_instance_dispatch_worktree_root(instance: lab))
+    && demands_contain_path(instance: lab, path: dashboard_instance_dispatch_attempt_state_root(instance: lab))
 }
-
-test fn the_plan_provisions_the_roadmap_event_worktree() -> Bool {
-  plan_ensures_roadmap_events_worktree(instance: srv1_live_dashboard_instance())
-    && plan_ensures_roadmap_events_worktree(instance: srv1_lab_dashboard_instance())
-}
-
 test fn each_instance_ensures_its_own_binary_not_a_shared_one() -> Bool {
   let lab = srv1_lab_dashboard_instance()
   let srv2 = srv2_lab_dashboard_instance()
@@ -736,8 +701,8 @@ fn observed_all_absent(refusals: List<String>) -> DashboardInstanceObserved {
     source_revision_observed: false,
     source_revision_current: false,
     source_revision_detail: "",
-    attempts_present: false,
-    attempt_state_present: false,
+    directories_converged: false,
+    directory_refusals: [],
     provider_runtime_ready: false,
     provider_runtime_detail: "",
     provider_authenticated: false,
@@ -806,6 +771,7 @@ fn witness_production_slot(
     admitted_revision: fleet_admitted_revision_source,
     toolchain: srv1_linux_toolchain,
     dispatch_worker_memory_max: dispatch_worker_memory_ceiling,
+    directory_owner: srv1_live_dashboard_instance().directory_owner,
   }
 }
 
@@ -1159,6 +1125,7 @@ fn outside_instance_claiming_live_id_on_live_footprint() -> HostDashboardInstanc
     admitted_revision: live.admitted_revision,
     toolchain: live.toolchain,
     dispatch_worker_memory_max: live.dispatch_worker_memory_max,
+    directory_owner: live.directory_owner,
   }
 }
 
diff --git a/dag/test/claim/roadmap/roadmap_dispatch_actuator_witness_test.dag b/dag/test/claim/roadmap/roadmap_dispatch_actuator_witness_test.dag
index dcccbf697a5..32867dd4f52 100644
--- a/dag/test/claim/roadmap/roadmap_dispatch_actuator_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_dispatch_actuator_witness_test.dag
@@ -20,12 +20,13 @@ import gunbc.roadmap_model {
   PrsMerged,
   WorkItemDispatch, NotDispatchable, Dispatchable,
   SectionElement, Group, SectionGroup,
+  NodeParent, AdmittedRoot, RoadmapNodeIdentity,
 }
-import gunbc.roadmap_status { DerivableLine, Unsigned }
+import gunbc.roadmap_status { DerivableLine, Unsigned, TicketLine, TicketFields }
+import gunbc.roadmap.roadmap_lineage { lineage_walk, lineage_is_rooted }
 import gunbc.roadmap_execution_contract { ExecutionContractUnspecified }
 import gunbc.roadmap_document { RoadmapDocument, RoadmapSection }
 import gunbc.roadmap_spawner { next_spawnable, dispatch_brief_template, node_title }
-import gunbc.roadmap_authority { declared_roadmap_nodes }
 import std.upsert_decision {
   Absent,
   Apply,
@@ -76,11 +77,14 @@ import gunbc.roadmap_dispatch_actuator {
   dispatch_provider_inner_argv,
   DispatchProviderInnerArgv,
   DispatchProviderInnerArgvReady,
-  CursorProviderSpawnUnwired,
+  CursorProviderOffCustodyHost,
+  CursorProviderCredentialUnbound,
+  CodexProviderOffCustodyHost,
   CodexProviderExecutableAbsent,
   GunbcHarnessSpawnNeedsInstance,
   ClaudeProviderCredentialUnbound,
   ClaudeCodeProvider,
+  dispatch_credential_snapshot_path_for_instance,
   CodexDispatchProvider,
   dispatch_tmux_session_name,
   dispatch_tmux_session_prefix,
@@ -175,6 +179,7 @@ import gunbc.roadmap_dashboard_instance {
   HostDashboardInstance,
   srv1_lab_dashboard_instance,
   srv1_live_dashboard_instance,
+  srv2_lab_dashboard_instance,
   dashboard_instance_provider_executable,
 }
 import gunbc.roadmap.roadmap_attempt_continuation {
@@ -182,6 +187,7 @@ import gunbc.roadmap.roadmap_attempt_continuation {
   continuation_alignment_l0_pointer, continuation_alignment_ask,
 }
 import gunbc.roadmap.roadmap_alignment {
+  alignment_chain,
   AlignmentResolution, AlignmentReady, AlignmentUnresolved,
   AlignmentChained, AlignmentChainLink, AlignmentRowUndeclared,
   AlignmentWalkUnrooted, AlignmentNestingCyclic,
@@ -456,9 +462,9 @@ fn codex_tmux_arm_shape_holds(spawn: HostExecArgv, provider_start: HostExecArgv,
 test fn witness_selected_provider_shapes_codex_tmux_command() -> Bool {
   let node = sized_derivable(id: "codex-selected", prs: [1], title: "Codex selected")
   match dispatch_spawn_commands_for_inventory(
-    instance: srv1_live_dashboard_instance(),
+    instance: srv2_lab_dashboard_instance(),
     inventory: fixture_inventory_codex_only_available(
-      instance: srv1_live_dashboard_instance(),
+      instance: srv2_lab_dashboard_instance(),
     ),
     node: node,
     session_uuid: "uuid-unused-by-codex",
@@ -477,7 +483,7 @@ test fn witness_selected_provider_shapes_codex_tmux_command() -> Bool {
       codex_tmux_command_shape_holds(
         cmds: cmds,
         codex_executable: match dashboard_instance_provider_executable(
-          instance: srv1_live_dashboard_instance(),
+          instance: srv2_lab_dashboard_instance(),
         ) {
           Present { value: executable } => executable as String
           Absent => ""
@@ -495,10 +501,6 @@ fn lab_instance_command_shape_holds(commands: DispatchSpawnCommands, lab: HostDa
 }
 
 fn lab_instance_tmux_shape_holds(commands: DispatchSpawnCommands, lab: HostDashboardInstance, spawn: HostExecArgv, event_pipe: HostExecArgv, provider_start: HostExecArgv) -> Bool {
-  match dashboard_instance_provider_executable(instance: lab) {
-    Absent => false
-    Present { value: codex_path } => {
-  let codex_executable = codex_path as String
   let git_wire = join(commands.worktree_add.args, separator: "\0")
   let state_wire = join(commands.attempt_state_prepare.args, separator: "\0")
   let pointer_wire = join(commands.attempt_current_pointer.args, separator: "\0")
@@ -534,37 +536,52 @@ fn lab_instance_tmux_shape_holds(commands: DispatchSpawnCommands, lab: HostDashb
     )
     && string_contains(
       s: provider_wire,
-      pattern: concat("\0CODEX_HOME=/home/briansrls/.codex@gunbc-roadmap\0", codex_executable),
+      pattern: dispatch_credential_snapshot_path_for_instance(
+        instance: lab,
+        node_id: "ts-dispatch-provider-events" as NonEmptyStr as RoadmapNodeId,
+        attempt_key: "feedfacefeedface",
+        provider: ClaudeCodeProvider,
+      ) as String,
     )
-    }
-  }
 }
 
-test fn witness_lab_instance_moves_repo_tmux_and_codex_state_together() -> Bool {
+// THE LAB INSTANCE MOVES ITS REPO, TMUX SERVER AND ATTEMPT STATE TOGETHER, shown with the Claude
+// spawn (its credential is held on srv1). It no longer moves a codex state root with it: codex worker
+// turns run on the one credential held on its custody host (gunbc.codex_harness_credential, operator
+// ruling 2026-10-05), so the same lab refuses a codex spawn at the custody-host step -- the control
+// that a codex turn cannot fall back to the lab's ambient codex login.
+test fn witness_lab_instance_moves_repo_tmux_and_attempt_state_together() -> Bool {
   let lab = srv1_lab_dashboard_instance()
-  match dispatch_spawn_commands_for_inventory(
+  let node = sized_derivable(id: "ts-dispatch-provider-events", prs: [], title: "Provider execution facts")
+  let claude_moves = match dispatch_spawn_commands_for_resolved_instance(
     instance: lab,
-    inventory: fixture_inventory_codex_only_available(instance: lab),
-    node: sized_derivable(
-      id: "ts-dispatch-provider-events",
-      prs: [],
-      title: "Provider execution facts",
-    ),
+    node: node,
     session_uuid: "00000000-0000-4000-8000-000000000001",
     attempt_key: "feedfacefeedface",
-    request: SelectCodex {
-      profile: ProfileAutomatic,
-      account: codex_roadmap_account_selection(),
-      model: dispatch_codex_default_model,
-      effort: ReasoningMedium,
-      operator_asserted_native_limit_bucket: Absent,
-    },
+    provider: ClaudeCodeProvider,
+    effort: ReasoningMedium,
+    model: ProviderAccountDefaultModel,
+    origin: FreshFromBase,
     resolution: fixture_ready_resolution(node_id: "ts-dispatch-provider-events", project_ids: []),
   ) {
     DispatchSpawnRefused { step: _, detail: _ } => false
-    DispatchSpawnReady { commands } =>
-      lab_instance_command_shape_holds(commands: commands, lab: lab)
+    DispatchSpawnReady { commands } => lab_instance_command_shape_holds(commands: commands, lab: lab)
   }
+  let codex_refused = match dispatch_spawn_commands_for_resolved_instance(
+    instance: lab,
+    node: node,
+    session_uuid: "00000000-0000-4000-8000-000000000001",
+    attempt_key: "feedfacefeedface",
+    provider: CodexDispatchProvider,
+    effort: ReasoningMedium,
+    model: dispatch_codex_default_model,
+    origin: FreshFromBase,
+    resolution: fixture_ready_resolution(node_id: "ts-dispatch-provider-events", project_ids: []),
+  ) {
+    DispatchSpawnRefused { step, detail: _ } => step as String == "codex-credential-custody-host"
+    DispatchSpawnReady { commands: _ } => false
+  }
+  claude_moves && codex_refused
 }
 
 test fn witness_tmux_attempt_panes_parse_alive_and_exit() -> Bool {
@@ -1110,7 +1127,9 @@ test fn witness_codex_account_default_passes_no_model_flag() -> Bool {
 fn witness_inner_argv_wire(inner: DispatchProviderInnerArgv) -> String {
   match inner {
     DispatchProviderInnerArgvReady { argv } => join(argv, separator: "\0")
-    CursorProviderSpawnUnwired { reason: r } => r as String
+    CursorProviderOffCustodyHost { reason: r } => r as String
+    CursorProviderCredentialUnbound { reason: r } => r as String
+    CodexProviderOffCustodyHost { reason: r } => r as String
     CodexProviderExecutableAbsent { reason: r } => r as String
     GunbcHarnessSpawnNeedsInstance { reason: r } => r as String
     ClaudeProviderCredentialUnbound { reason: r } => r as String
@@ -1189,6 +1208,7 @@ test fn witness_review_unit_argv_mints_per_criterion_attempt_identity() -> Bool
     brief: "brief",
     head_sha: "abc123",
     criterion_key: "conformance-external-facts",
+    exit_hook: "+mkdir -- /i/attempt-exit-spool/inbox/x" as NonEmptyStr,
   ) {
     SystemdRunCommandRefused { cause: _ } => false
     SystemdRunCommandReady { command: command } => {
@@ -1217,9 +1237,9 @@ test fn witness_continuation_origin_branches_the_worktree_from_the_prior_attempt
     node: sized_derivable(id: "ts-continuation-origin", prs: [], title: "Continuation origin wiring"),
     session_uuid: "00000000-0000-4000-8000-000000000002",
     attempt_key: "feedfacefeedface",
-    provider: CodexDispatchProvider,
+    provider: ClaudeCodeProvider,
     effort: ReasoningMedium,
-    model: dispatch_codex_default_model,
+    model: ProviderAccountDefaultModel,
     origin: ContinueFromAttempt {
       parent_attempt_key: "deadbeefdeadbeef",
       branch: "roadmap/ts-continuation-origin/deadbeefdeadbeef",
@@ -1237,37 +1257,89 @@ test fn witness_continuation_origin_branches_the_worktree_from_the_prior_attempt
   }
 }
 
-// THE AUTHORITY ROW, READ BY THE TEST ITSELF. The drift controls below require the preamble to
-// carry the arc's title AS THE AUTHORITY DECLARES IT, so the expectation is projected here rather
-// than transcribed: editing the authority row moves this expectation with it, and a hand-copied
-// preamble goes red.
-fn authority_node_opt(id: String) -> RoadmapNode? {
-  (declared_roadmap_nodes() |> filter(n => (n.node as String) == id)).first()
+// THE SUPPLIED UNROOTED SPECIMEN (§3: a witness discriminates at one interface). The claims below
+// judge the refusal an unrooted chain produces, so the unrooted node is built HERE -- a row with no
+// parent -- rather than borrowed from the live roadmap authority, whose parents change for
+// unrelated reasons (#13052 gave the former live specimen one and turned both claims red).
+fn unrooted_specimen_id() -> String { "fixture-unrooted-specimen" }
+
+fn specimen_row(parent: NodeParent?) -> RoadmapNode {
+  RoadmapNode {
+    identity: "rnfx_R2PE6DBK7RVVR2NHNQN0" as RoadmapNodeIdentity,
+    node: roadmap_dispatch_actuator_nid(s: unrooted_specimen_id()),
+    line: TicketLine {
+      done: false,
+      ticket: TicketFields {
+        headline: "Specimen headline",
+        brief: "Specimen brief",
+        displaced_cost: "none",
+        current_state: "fixture",
+        first_slice: "fixture",
+        red_control: "fixture",
+        out_of_scope: "fixture",
+        handback: "fixture",
+        updates: [],
+        authored_on: "",
+        last_verified_on: "",
+      },
+    },
+    carriers: [],
+    dispatch: Dispatchable { repo: "gunbc", acceptance: PrsMerged },
+    execution: ExecutionContractUnspecified,
+    owner: "",
+    signoff: Unsigned,
+    parent: parent,
+    centering: none,
+  }
+}
+
+fn unrooted_specimen() -> RoadmapNode { specimen_row(parent: none) }
+
+fn rooted_twin_specimen() -> RoadmapNode { specimen_row(parent: Present { value: AdmittedRoot }) }
+
+fn unrooted_specimen_resolution() -> AlignmentResolution {
+  alignment_resolve_chain(
+    chain: alignment_chain(node_id: unrooted_specimen_id(), nodes: [unrooted_specimen()]),
+    turns_elapsed: 1,
+    state: alignment_base_cadence_state(),
+  )
+}
+
+// THE DISCRIMINATOR AND THE INHABITANCE CHECK: the real lineage rule and the real chain derivation
+// refuse the parentless row and accept the same row once it declares AdmittedRoot, so the refusal
+// below is the rule's, not a fixture artifact. Not tied to any live node id.
+test fn the_real_lineage_rule_refuses_an_unrooted_row_and_roots_its_twin() -> Bool {
+  !lineage_is_rooted(w: lineage_walk(node_id: unrooted_specimen_id(), nodes: [unrooted_specimen()]))
+    && lineage_is_rooted(w: lineage_walk(node_id: unrooted_specimen_id(), nodes: [rooted_twin_specimen()]))
+    && (match alignment_resolve_chain(
+      chain: alignment_chain(node_id: unrooted_specimen_id(), nodes: [rooted_twin_specimen()]),
+      turns_elapsed: 1,
+      state: alignment_base_cadence_state(),
+    ) {
+      AlignmentReady { chain: _, due_levels: _, rendered_prompt: _ } => true
+      AlignmentUnresolved { cause: _ } => false
+    })
 }
 
 // THE ONE-AUTHORITY PREAMBLE (review finding 2026-09-26): the preamble IS the resolution's
 // rendered_prompt — gunbc.roadmap.roadmap_alignment owns the alignment answer and this lane only
-// concatenates. For the REAL node 2-scm-git-upstream-model -- an accepted history row that declares
-// no parent -- the derived chain refuses UNROOTED, so the honest preamble is the refusal marker
+// concatenates. For a SUPPLIED row that declares
+// no parent the derived chain refuses UNROOTED, so the honest preamble is the refusal marker
 // naming where the walk halted (review 5354823380), never a confident projection rendered while
 // execution proceeded.
 test fn the_preamble_names_the_derived_refusal_for_an_unrooted_node() -> Bool {
-  let resolution = alignment_resolve(
-    node_id: "2-scm-git-upstream-model",
-    turns_elapsed: 2,
-    state: alignment_base_cadence_state(),
-  )
+  let resolution = unrooted_specimen_resolution()
   let preamble = dispatch_continuation_alignment_preamble(resolution: resolution)
   match resolution {
     AlignmentUnresolved { cause } =>
       preamble.contains("Alignment UNRESOLVED")
         && (match cause {
           AlignmentWalkUnrooted { at, walked } =>
-            at == "2-scm-git-upstream-model" && count(walked) == 0
+            at == unrooted_specimen_id() && count(walked) == 0
           AlignmentRowUndeclared { node_id: _ } => false
           AlignmentNestingCyclic { node_id: _ } => false
         })
-        && string_contains(s: preamble, pattern: "2-scm-git-upstream-model")
+        && string_contains(s: preamble, pattern: unrooted_specimen_id())
     AlignmentReady { chain: _, due_levels: _, rendered_prompt: _ } => false
   }
 }
@@ -1332,38 +1404,30 @@ test fn the_alignment_preamble_is_continuation_only_and_follows_the_verdict() ->
     })
 }
 
-// NO SPAWN ON AN UNRESOLVED CHAIN — THE REAL PRODUCER, THE REAL AUTHORITY (the review finding's
-// discriminating control). The production node 2-scm-git-upstream-model's chain refuses UNROOTED
-// on the live authority (an accepted history row that declares no parent, review 5354823380); the
-// same resolution the belt derives at spawn time is handed to the real
-// spawn fold, and the fold's answer is DispatchSpawnRefused at the alignment gate — the Refused
-// arm carries no DispatchSpawnCommands, so zero spawn commands exist: no worktree add, no state
-// prepare, no session container. Execution cannot proceed on a chain the authority cannot read.
-//
-// The subject moved on 2026-09-30, when the former subject (extended-admission-cardinality) got its
-// parent: an accepted history row with no parent stays unrooted by construction of the lineage
-// rule, so it keeps this control discriminating without a row kept unrooted for the purpose.
+// NO SPAWN ON AN UNRESOLVED CHAIN — THE REAL PRODUCER, A SUPPLIED UNROOTED ROW (the review
+// finding's discriminating control). The supplied parentless row's chain refuses UNROOTED through
+// the real derivation (review 5354823380); the same resolution the belt derives at spawn time is
+// handed to the real spawn fold, and the fold's answer is DispatchSpawnRefused at the alignment
+// gate — the Refused arm carries no DispatchSpawnCommands, so zero spawn commands exist: no
+// worktree add, no state prepare, no session container. The rooted twin (see the lineage claim)
+// resolves Ready, so removing the unrooted refusal turns this control red.
 test fn an_unresolved_alignment_refuses_the_real_spawn_fold_with_zero_commands() -> Bool {
-  match authority_node_opt(id: "2-scm-git-upstream-model") {
-    Absent => false
-    Present { value: node } =>
-      match dispatch_spawn_commands_for_resolved_instance(
-        instance: srv1_lab_dashboard_instance(),
-        node: node,
-        session_uuid: "00000000-0000-4000-8000-000000000004",
-        attempt_key: "feedfacefeedface",
-        provider: CodexDispatchProvider,
-        effort: ReasoningMedium,
-        model: dispatch_codex_default_model,
-        origin: FreshFromBase,
-        resolution: alignment_resolve(node_id: "2-scm-git-upstream-model", turns_elapsed: 1, state: alignment_base_cadence_state()),
-      ) {
-        DispatchSpawnRefused { step, detail } =>
-          step as String == "alignment"
-            && string_contains(s: detail, pattern: "2-scm-git-upstream-model")
-            && string_contains(s: detail, pattern: "admitted root")
-        DispatchSpawnReady { commands: _ } => false
-      }
+  match dispatch_spawn_commands_for_resolved_instance(
+    instance: srv1_lab_dashboard_instance(),
+    node: unrooted_specimen(),
+    session_uuid: "00000000-0000-4000-8000-000000000004",
+    attempt_key: "feedfacefeedface",
+    provider: CodexDispatchProvider,
+    effort: ReasoningMedium,
+    model: dispatch_codex_default_model,
+    origin: FreshFromBase,
+    resolution: unrooted_specimen_resolution(),
+  ) {
+    DispatchSpawnRefused { step, detail } =>
+      step as String == "alignment"
+        && string_contains(s: detail, pattern: unrooted_specimen_id())
+        && string_contains(s: detail, pattern: "admitted root")
+    DispatchSpawnReady { commands: _ } => false
   }
 }
 
@@ -1419,6 +1483,7 @@ test fn witness_auditor_launch_writes_the_events_path_metering_reads() -> Bool {
     worktree_path: "/tmp/fci-witness-worktree",
     brief: "witness brief",
     head_sha: "fci1witnesssha",
+    exit_hook: "+mkdir -- /i/attempt-exit-spool/inbox/x" as NonEmptyStr,
   ) {
     SystemdRunCommandRefused { cause: _ } => false
     SystemdRunCommandReady { command: command } =>
diff --git a/dag/test/claim/roadmap/roadmap_dogfood_route_wet_witness_test.dag b/dag/test/claim/roadmap/roadmap_dogfood_route_wet_witness_test.dag
index 2ee1bc90002..f548678d81e 100644
--- a/dag/test/claim/roadmap/roadmap_dogfood_route_wet_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_dogfood_route_wet_witness_test.dag
@@ -45,7 +45,7 @@ import gunbc.roadmap_belt_actuate { WorkflowAttemptsObserved }
 // WET CONTROLS FOR THE DOGFOOD START RECEIPT'S STORE (side-chat ruling on #13077 at e7e9ca9b). Each
 // claim builds a FRESH instance layout under a temporary directory and runs the production recorder
 // against it. The store root is the instance's attempt-state root -- the path the deployment's
-// AttemptStateRoot member converges (gunbc.live_deploy.spec deployment_owned_steps derives it from
+// attempt-state demand converges (gunbc.roadmap_dashboard_instance dashboard_instance_dispatch_attempt_state_directory, whose path is
 // the same dashboard_instance_dispatch_attempt_state_root) -- so a claim either leaves it missing,
 // as an unconverged host would, or creates it as the deploy does. On the required floor's
 // local-repo wet lane (v2.workflow.local_repo_wet_terminal local_repo_wet_schedule), with the
diff --git a/dag/test/claim/roadmap/roadmap_fleet_components_witness_test.dag b/dag/test/claim/roadmap/roadmap_fleet_components_witness_test.dag
index 72582dc1cdb..d1615e761ac 100644
--- a/dag/test/claim/roadmap/roadmap_fleet_components_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_fleet_components_witness_test.dag
@@ -5,27 +5,28 @@ import gunbc.roadmap_fleet_components { fleet_component_hosts, fleet_components
 import extdeps.google.issue_tracker { browse_component_tree }
 
 test fn w_fleet_component_tree_hosts_and_arms() -> Bool {
-  count(fleet_components()) == 20
-    && count(fleet_component_hosts) == 12
+  count(fleet_components()) == 12
+    && count(fleet_component_hosts) == 8
     && (match (filter(fleet_components(), c => c.path == ["srv11", "serving", "group-b"])).first() {
       Present { value: c } => c.id == 111
       Absent => false
     })
-    && count(filter(fleet_components(), c => count(c.path) == 3)) == 8
+    && count(filter(fleet_components(), c => count(c.path) == 3)) == 4
+    && count(filter(fleet_components(), c => (match c.path.first() { Present { value: x } => x == "srv5"  Absent => false }))) == 0
 }
 
 test fn w_browse_components_derives_the_tree() -> Bool {
   let tree = browse_component_tree(components: fleet_components())
-  count(tree) == 20
+  count(tree) == 12
     && (match tree.first() {
       Present { value: e } => e.component.path == ["srv1"] && e.depth == 1
       Absent => false
     })
-    && (match tree.skip(n: 12).first() {
-      Present { value: e } => e.component.path == ["srv5", "serving", "group-a"] && e.depth == 3
+    && (match tree.skip(n: 8).first() {
+      Present { value: e } => e.component.path.skip(n: 1) == ["serving", "group-b"] && e.depth == 3
       Absent => false
     })
-    && (match tree.skip(n: 19).first() {
+    && (match tree.skip(n: 11).first() {
       Present { value: e } => e.component.path == ["srv12", "serving", "group-b"]
       Absent => false
     })
diff --git a/dag/test/claim/roadmap/roadmap_forecast_witness_test.dag b/dag/test/claim/roadmap/roadmap_forecast_witness_test.dag
index 7419857db2a..f627029e713 100644
--- a/dag/test/claim/roadmap/roadmap_forecast_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_forecast_witness_test.dag
@@ -431,7 +431,10 @@ test fn witness_empty_calibration_cell_refuses() -> Bool {
   ) {
     ScheduleForecastKnown { forecast: _ } => false
     ScheduleForecastRefused { refusals } => any(refusals, refusal => match refusal {
-      NoCalibrationSample { gaps, population_exclusions: _, assumptions: _, scenario_adjustment: _ } => count(gaps) == 1 && first(gaps).nodes == [n.node]
+      NoCalibrationSample { gaps, population_exclusions: _, assumptions: _, scenario_adjustment: _ } => count(gaps) == 1 && match first(gaps) {
+        Present { value: g } => g.nodes == [n.node]
+        Absent => false
+      }
       ForecastGraphEmpty => false
       DependencyCycle { nodes: _ } => false
       DependencyEndpointUnknown { nodes: _ } => false
diff --git a/dag/test/claim/roadmap/roadmap_launch_admission_witness_test.dag b/dag/test/claim/roadmap/roadmap_launch_admission_witness_test.dag
index f61c2f13a8b..338202d0c61 100644
--- a/dag/test/claim/roadmap/roadmap_launch_admission_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_launch_admission_witness_test.dag
@@ -793,10 +793,7 @@ test fn witness_tick_receipt_round_trips_launch_identities() -> Bool {
     launches: [id],
     spawn_pass: BeltPassRecorded,
     teardown_pass: BeltPassRecorded,
-    commit_pass: BeltPassRecorded,
-    verify_pass: BeltPassRecorded,
-    publish_pass: BeltPassRecorded,
-    metering_pass: BeltPassRecorded,
+    discovery_pass: BeltPassRecorded,
   }
   match belt_tick_receipt_decode(raw: serialize_json(v: belt_tick_receipt_json_value(receipt: receipt))) {
     BeltTickReceiptPresent { receipt: back } =>
diff --git a/dag/test/claim/roadmap/roadmap_launch_deployment_observe_witness_test.dag b/dag/test/claim/roadmap/roadmap_launch_deployment_observe_witness_test.dag
index 7a9bafb39d7..b7363e7d0e9 100644
--- a/dag/test/claim/roadmap/roadmap_launch_deployment_observe_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_launch_deployment_observe_witness_test.dag
@@ -11,10 +11,7 @@ fn fixture_v4_tick() -> BeltTickReceipt {
     launches: [],
     spawn_pass: BeltPassRecorded,
     teardown_pass: BeltPassRecorded,
-    commit_pass: BeltPassRecorded,
-    verify_pass: BeltPassRecorded,
-    publish_pass: BeltPassRecorded,
-    metering_pass: BeltPassRecorded,
+    discovery_pass: BeltPassRecorded,
   }
 }
 
@@ -33,14 +30,29 @@ test fn witness_iso8601_utc_epoch_seconds_matches_known_instants() -> Bool {
     && (match iso8601_utc_epoch_seconds(text: iso8601_utc_text(unix: 4102444799)) { Present { value: s } => second_count(s) == 4102444799  Absent => false })
 }
 
-// (2) Freshness: fresh within the cadence bound, stale beyond it, refused before the deploy, and
-// refused on an unparseable instant -- four typed arms, none of which is a default.
-test fn witness_tick_freshness_arms() -> Bool {
-  let deploy = "2026-08-30T12:00:00Z"
-  (match belt_tick_freshness(observed_at: "2026-08-30T12:01:00Z", deploy_completed_at: deploy, now: "2026-08-30T12:02:00Z") { TickFresh { age_seconds: a } => second_count(a) == 60  _ => false })
-    && (match belt_tick_freshness(observed_at: "2026-08-30T12:01:00Z", deploy_completed_at: deploy, now: "2026-08-30T12:10:00Z") { TickStale { age_seconds: a, bound_seconds: b } => second_count(a) == 540 && second_count(b) == 180  _ => false })
-    && (match belt_tick_freshness(observed_at: "2026-08-30T11:59:00Z", deploy_completed_at: deploy, now: "2026-08-30T12:00:30Z") { TickBeforeDeploy { observed_at: _, deploy_completed_at: _ } => true  _ => false })
-    && (match belt_tick_freshness(observed_at: "clock-unreadable", deploy_completed_at: deploy, now: "2026-08-30T12:00:30Z") { TickInstantUnparseable { which: w, text: _ } => string_contains(s: w, pattern: "observed_at")  _ => false })
+// (2) Event backlog, the liveness row that replaced tick freshness when the belt timer was removed:
+// entries within their stage's bound are clear and counted; an inbox entry past the drain bound and a
+// queued entry past the obligation bound each refuse with StaleBacklog naming the OLDEST stale entry;
+// a fresh queued entry older than the drain bound is not stale (the bounds are per stage).
+fn queued_bound_count() -> Nat {
+  match event_backlog_queued_bound() { Present { value: b } => second_count(s: b)  Absent => 0 }
+}
+
+test fn witness_event_backlog_arms() -> Bool {
+  let clear = match event_backlog_judge(entries: [
+    EventBacklogEntry { stage: AttemptExitInbox, entry: "a", age: second(count: 10) },
+    EventBacklogEntry { stage: AttemptExitQueued, entry: "b", age: second(count: 1200) },
+  ]) { EventBacklogClear { inbox, queued } => inbox == 1 && queued == 1  _ => false }
+  let stale_inbox = match event_backlog_judge(entries: [
+    EventBacklogEntry { stage: AttemptExitInbox, entry: "young", age: second(count: 30) },
+    EventBacklogEntry { stage: AttemptExitInbox, entry: "old", age: second(count: second_count(s: event_backlog_drain_bound) + 1) },
+  ]) { StaleBacklog { stage, entry, age: _, bound } => stage == AttemptExitInbox && entry == "old" && second_count(s: bound) == second_count(s: event_backlog_drain_bound)  _ => false }
+  let oldest_named = match event_backlog_judge(entries: [
+    EventBacklogEntry { stage: AttemptExitInbox, entry: "stale-inbox", age: second(count: second_count(s: event_backlog_drain_bound) + 5) },
+    EventBacklogEntry { stage: AttemptExitQueued, entry: "stale-queued", age: second(count: queued_bound_count() + 100) },
+  ]) { StaleBacklog { stage, entry, age: _, bound: _ } => stage == AttemptExitQueued && entry == "stale-queued"  _ => false }
+  let empty = match event_backlog_judge(entries: []) { EventBacklogClear { inbox, queued } => inbox == 0 && queued == 0  _ => false }
+  clear && stale_inbox && oldest_named && empty
 }
 
 // (3) /instance.json decodes the members the serve route writes, and refuses another schema.
@@ -159,3 +171,9 @@ test fn witness_root_tree_standing_refuses_a_mismatched_tree() -> Bool {
       }
   }
 }
+
+// THE QUEUED BOUND IS DERIVED, NOT COPIED: it is the obligation unit's RuntimeMaxSec plus the drain bound,
+// so changing belt_tick_run_bound moves it (plus the drain bound).
+test fn witness_queued_bound_is_the_run_bound_plus_the_drain_bound() -> Bool {
+  queued_bound_count() == second_count(s: belt_tick_run_bound) + second_count(s: event_backlog_drain_bound)
+}
diff --git a/dag/test/claim/roadmap/roadmap_launch_deployment_receipt_witness_test.dag b/dag/test/claim/roadmap/roadmap_launch_deployment_receipt_witness_test.dag
index 77055c1f69e..620223dc834 100644
--- a/dag/test/claim/roadmap/roadmap_launch_deployment_receipt_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_launch_deployment_receipt_witness_test.dag
@@ -49,9 +49,9 @@ import gunbc.live_deploy.release_binding {
 import gunbc.live_deploy.unit_standing {
   BeltOneshotConverged,
   BeltOneshotStanding,
-  BeltTimerConverged,
-  BeltTimerRefused,
-  BeltTimerStanding,
+  BeltEventPathConverged,
+  BeltEventPathRefused,
+  BeltEventPathStanding,
   DashboardServiceConverged,
   LaunchUnitStanding,
 }
@@ -76,8 +76,10 @@ import gunbc.roadmap_launch_deployment_cli {
   rlm1_merge_commit,
   rlm_workflow_file_path,
 }
-import gunbc.roadmap_launch_deployment_observe { TickStale, belt_tick_freshness }
+import gunbc.roadmap_launch_deployment_observe { EventBacklogFact, EventBacklogClear, StaleBacklog, EventBacklogUnobserved, event_backlog_drain_bound }
 import gunbc.roadmap_launch_deployment_receipt {
+  unit_standing_blockers,
+  event_backlog_blockers,
   ApplyReceiptFact,
   ApplyReceiptRead,
   DashboardReceiptFact,
@@ -250,21 +252,19 @@ fn rlm_tick(instance_id: String, revision: String, mode: SpawnMode, observed_at:
     launches: [],
     spawn_pass: BeltPassRecorded,
     teardown_pass: BeltPassRecorded,
-    commit_pass: BeltPassRecorded,
-    verify_pass: BeltPassRecorded,
-    publish_pass: BeltPassRecorded,
-    metering_pass: BeltPassRecorded,
+    discovery_pass: BeltPassRecorded,
   }
 }
 
 fn rlm_tick_fact(t: BeltTickReceipt) -> TickFact {
-  TickObserved { receipt: t, freshness: belt_tick_freshness(observed_at: t.observed_at, deploy_completed_at: rlm_fixture_deploy_completed_at, now: rlm_fixture_now) }
+  TickObserved { receipt: t }
 }
 
-fn rlm_units(timer: BeltTimerStanding, oneshot: BeltOneshotStanding) -> LaunchUnitStanding {
+fn rlm_units(exit_path: BeltEventPathStanding, oneshot: BeltOneshotStanding) -> LaunchUnitStanding {
   LaunchUnitStanding {
     dashboard: DashboardServiceConverged { unit: "gunbc-roadmap.service" },
-    timer: timer,
+    exit_path: exit_path,
+    answer_path: BeltEventPathConverged { unit: "gunbc-roadmap-belt-discovery.path" },
     oneshot: oneshot,
   }
 }
@@ -319,8 +319,9 @@ fn rlm_complete_facts() -> RoadmapLaunchDeploymentFacts {
     release_binding: rlm_release_binding(revision_hex: rlm_fixture_r),
     readiness: ReadinessServed { revision: rlm_fixture_r, surface: rlm_fixture_surface },
     transition: ActuationPermitted,
-    unit_standing: rlm_units(timer: BeltTimerConverged { unit: "gunbc-belt.timer" }, oneshot: BeltOneshotConverged { unit: "gunbc-belt.service", active_state: "inactive" }),
+    unit_standing: rlm_units(exit_path: BeltEventPathConverged { unit: "gunbc-roadmap-belt-exit.path" }, oneshot: BeltOneshotConverged { unit: "gunbc-belt.service", active_state: "inactive" }),
     tick_standing: rlm_tick_fact(t: tick),
+    event_backlog: EventBacklogClear { inbox: 0, queued: 0 },
     footprint: FootprintAdmitted,
     provider_preflight: ProviderPreflightOk,
     dispatch_preflight: DispatchPreflightAdmittedFact { instance_id: "srv1-live", revision_hex: rlm_fixture_r },
@@ -343,54 +344,54 @@ fn incomplete_at(facts: RoadmapLaunchDeploymentFacts, member: String) -> Bool {
 }
 
 fn with_plan(f: RoadmapLaunchDeploymentFacts, plan: PlanReceiptFact) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: plan, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: plan, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_apply(f: RoadmapLaunchDeploymentFacts, apply: ApplyReceiptFact) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: apply, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: apply, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_dashboard(f: RoadmapLaunchDeploymentFacts, d: DashboardReceiptFact) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: d, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: d, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_tree(f: RoadmapLaunchDeploymentFacts, t: DeployedRootTreeStanding) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: t, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: t, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_transition(f: RoadmapLaunchDeploymentFacts, t: ActuationStanding) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: t, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: t, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_units(f: RoadmapLaunchDeploymentFacts, u: LaunchUnitStanding) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: u, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: u, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_tick(f: RoadmapLaunchDeploymentFacts, t: TickFact) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: t, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: t, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_footprint(f: RoadmapLaunchDeploymentFacts, a: BeltFootprintAdmission) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: a, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: a, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_provider(f: RoadmapLaunchDeploymentFacts, p: BeltProviderPreflight) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: p, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: p, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_workflow(f: RoadmapLaunchDeploymentFacts, w: WorkflowEndpointFact) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: w, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: w, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_principal(f: RoadmapLaunchDeploymentFacts, p: PrincipalFact) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: p, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: p, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_host(f: RoadmapLaunchDeploymentFacts, h: HostFact) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: h, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: h, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 fn with_release_binding(f: RoadmapLaunchDeploymentFacts, b: DeployedReleaseBinding) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: b, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: b, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 
 fn with_window(f: RoadmapLaunchDeploymentFacts, w: ObservationWindowFact) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: w, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: w, run_provenance: f.run_provenance }
 }
 fn with_run_provenance(f: RoadmapLaunchDeploymentFacts, rp: RunProvenanceFact) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: rp }
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: rp }
 }
 
 fn with_desired(f: RoadmapLaunchDeploymentFacts, d: DesiredRevisionFact) -> RoadmapLaunchDeploymentFacts {
-  RoadmapLaunchDeploymentFacts { desired_revision: d, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
+  RoadmapLaunchDeploymentFacts { desired_revision: d, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: f.event_backlog, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 
 // ---------------------------------------------------------------- POSITIVE CONTROL
@@ -455,11 +456,6 @@ test fn witness_deployed_tree_mismatch_is_incomplete_at_deployed_tree() -> Bool
   incomplete_at(facts: with_tree(f: rlm_complete_facts(), t: DeployedRootTreeMismatch { candidate_hex: rlm_fixture_tree, deployed_hex: rlm_fixture_other_tree }), member: "deployed_tree")
 }
 
-// v3, stale, wrong-instance, wrong-revision, or non-ManualReady tick receipt
-test fn witness_stale_tick_is_incomplete_at_tick_standing() -> Bool {
-  incomplete_at(facts: with_tick(f: rlm_complete_facts(), t: rlm_tick_fact(t: rlm_tick(instance_id: "srv1-live", revision: rlm_fixture_r, mode: ManualReady, observed_at: "2026-08-30T11:00:00Z"))), member: "tick_standing")
-}
-
 test fn witness_wrong_instance_tick_is_incomplete_at_tick_standing() -> Bool {
   incomplete_at(facts: with_tick(f: rlm_complete_facts(), t: rlm_tick_fact(t: rlm_tick(instance_id: "srv1-lab", revision: rlm_fixture_r, mode: ManualReady, observed_at: rlm_fixture_tick_observed_at))), member: "tick_standing")
 }
@@ -484,10 +480,10 @@ test fn witness_v3_tick_on_disk_is_incomplete_at_tick_standing() -> Bool {
     && incomplete_at(facts: with_tick(f: rlm_complete_facts(), t: fact), member: "tick_standing")
 }
 
-// disabled timer beside an otherwise fresh, manually fabricated tick
-test fn witness_disabled_timer_beside_fresh_tick_is_incomplete_at_unit_standing() -> Bool {
+// a disabled exit path unit beside an otherwise complete population: the watcher is not armed
+test fn witness_disabled_exit_path_is_incomplete_at_unit_standing() -> Bool {
   incomplete_at(
-    facts: with_units(f: rlm_complete_facts(), u: rlm_units(timer: BeltTimerRefused { unit: "gunbc-belt.timer", property: "UnitFileState", expected: "enabled", observed: "disabled" }, oneshot: BeltOneshotConverged { unit: "gunbc-belt.service", active_state: "inactive" })),
+    facts: with_units(f: rlm_complete_facts(), u: rlm_units(exit_path: BeltEventPathRefused { unit: "gunbc-roadmap-belt-exit.path", property: "UnitFileState", expected: "enabled", observed: "disabled" }, oneshot: BeltOneshotConverged { unit: "gunbc-belt.service", active_state: "inactive" })),
     member: "unit_standing",
   )
 }
@@ -496,10 +492,7 @@ test fn witness_disabled_timer_beside_fresh_tick_is_incomplete_at_unit_standing(
 // exactly that (active_state "inactive") and is Complete; an ACTIVE oneshot mid-tick is equally
 // accepted.
 test fn witness_active_oneshot_mid_tick_is_still_complete() -> Bool {
-  match roadmap_launch_deployment_verdict(subject: rlm_subject(), facts: with_units(f: rlm_complete_facts(), u: rlm_units(timer: BeltTimerConverged { unit: "gunbc-belt.timer" }, oneshot: BeltOneshotConverged { unit: "gunbc-belt.service", active_state: "active" }))) {
-    DeploymentComplete { subject: _, facts: _, proof: _ } => true
-    DeploymentIncomplete { subject: _, facts: _, first_blocker: _, further_blockers: _ } => false
-  }
+  unit_standing_blockers(f: rlm_units(exit_path: BeltEventPathConverged { unit: "gunbc-roadmap-belt-exit.path" }, oneshot: BeltOneshotConverged { unit: "gunbc-belt.service", active_state: "active" })).length() == 0
 }
 
 // wrong effective principal
@@ -745,48 +738,34 @@ test fn witness_route_change_during_window_is_incomplete_at_observation_window()
   incomplete_at(facts: with_window(f: rlm_complete_facts(), w: WindowChanged { opened: rlm_snapshot(), closed: closed, changed: ["running_release_hex"] }), member: "observation_window")
 }
 
-// Review 5062738052 B3: tick freshness is a typed-arm object in the durable document -- the
-// observed age and the cadence-derived bound are recovered by JSON navigation, never from prose.
-// Two witnesses (fresh doc, stale doc) so each stays inside the floor's 500ms CPU line: one
-// document build + parse each; the single two-document form was BUDGET-REFUSED on run 33358233304.
-fn rlm_doc_freshness(doc: String) -> JsonValue? {
+// Review 5062738052 B3, carried onto the row that replaced tick freshness: the event backlog is a
+// typed-arm object in the durable document, recovered by JSON navigation, never from prose. A stale
+// backlog names its stage, its oldest entry and both numbers, and is a blocker at event_backlog --
+// the liveness half an armed .path unit cannot prove (bold-bee-114 ruling, 2026-10-06).
+fn rlm_doc_backlog(doc: String) -> JsonValue? {
   match parse_json_document(s: doc) {
     JsonDocumentUnreadable { gap: _ } => none
     JsonDocumentParsed { value: root } =>
       match rlm_doc_member(doc: root, key: "facts") {
         Absent => none
-        Present { value: facts } =>
-          match rlm_doc_member(doc: facts, key: "tick_standing") {
-            Absent => none
-            Present { value: tick } => rlm_doc_member(doc: tick, key: "freshness")
-          }
+        Present { value: facts } => rlm_doc_member(doc: facts, key: "event_backlog")
       }
   }
 }
 
-test fn witness_receipt_document_fresh_age_is_machine_readable() -> Bool {
-  let doc = roadmap_launch_deployment_receipt_document(v: roadmap_launch_deployment_verdict(subject: rlm_subject(), facts: rlm_complete_facts()))
-  match rlm_doc_freshness(doc: doc) {
-    Absent => false
-    Present { value: fr } => rlm_doc_string(doc: fr, key: "arm") == "fresh" && rlm_doc_string(doc: fr, key: "age_seconds") == "30"
-  }
+fn with_backlog(f: RoadmapLaunchDeploymentFacts, b: EventBacklogFact) -> RoadmapLaunchDeploymentFacts {
+  RoadmapLaunchDeploymentFacts { desired_revision: f.desired_revision, plan_receipt: f.plan_receipt, apply_receipt: f.apply_receipt, dashboard_receipt: f.dashboard_receipt, deployed_tree: f.deployed_tree, release_binding: f.release_binding, readiness: f.readiness, transition: f.transition, unit_standing: f.unit_standing, tick_standing: f.tick_standing, event_backlog: b, footprint: f.footprint, provider_preflight: f.provider_preflight, dispatch_preflight: f.dispatch_preflight, workflow_endpoint: f.workflow_endpoint, instance_endpoint: f.instance_endpoint, principal: f.principal, observed_host: f.observed_host, observation_window: f.observation_window, run_provenance: f.run_provenance }
 }
 
-test fn witness_receipt_document_stale_age_and_bound_are_machine_readable() -> Bool {
-  let stale_tick = rlm_tick(instance_id: "srv1-live", revision: rlm_fixture_r, mode: ManualReady, observed_at: rlm_fixture_tick_observed_at)
-  let doc = roadmap_launch_deployment_receipt_document(v: roadmap_launch_deployment_verdict(
-    subject: rlm_subject(),
-    facts: with_tick(f: rlm_complete_facts(), t: TickObserved { receipt: stale_tick, freshness: TickStale { age_seconds: second(count: 540), bound_seconds: second(count: 180) } }),
-  ))
-  match rlm_doc_freshness(doc: doc) {
-    Absent => false
-    Present { value: fr } =>
-      rlm_doc_string(doc: fr, key: "arm") == "stale"
-        && rlm_doc_string(doc: fr, key: "age_seconds") == "540"
-        && rlm_doc_string(doc: fr, key: "bound_seconds") == "180"
-  }
+test fn witness_stale_backlog_is_incomplete_and_names_its_oldest_entry() -> Bool {
+  let stale = StaleBacklog { stage: AttemptExitInbox, entry: "n+k+worker+inv+success+exited+0", age: second(count: second_count(s: event_backlog_drain_bound) + 60), bound: event_backlog_drain_bound }
+  incomplete_at(facts: with_backlog(f: rlm_complete_facts(), b: stale), member: "event_backlog")
 }
 
+test fn witness_clear_and_unobserved_backlog_decide_without_the_verdict() -> Bool {
+  event_backlog_blockers(f: EventBacklogClear { inbox: 0, queued: 0 }).length() == 0
+    && event_backlog_blockers(f: EventBacklogUnobserved { detail: "the exit inbox could not be listed" }).length() == 1
+}
 
 // ---------------------------------------------------------------------------
 // THE TRANSACTION REQUIRES THE LAUNCH-ENVIRONMENT SCOPE, AND THE SCOPE IS FIXED RATHER THAN GIVEN.
diff --git a/dag/test/claim/roadmap/roadmap_publish_witness_test.dag b/dag/test/claim/roadmap/roadmap_publish_witness_test.dag
index 5bd29bac0a4..8c192d08736 100644
--- a/dag/test/claim/roadmap/roadmap_publish_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_publish_witness_test.dag
@@ -718,7 +718,10 @@ test fn an_ambiguous_binding_round_trips_its_pull_request_numbers() -> Bool {
       match receipt.outcome {
         ReceiptBindingAmbiguous { pr_numbers } =>
           count(pr_numbers) == 2
-            && pr_numbers.first() == 11
+            && match pr_numbers.first() {
+              Present { value: n } => n == 11
+              Absent => false
+            }
         ReceiptBound { pr_number: _, url: _, draft: _ } => false
         ReceiptHeadDiverged { pr_number: _, pr_head: _, url: _ } => false
         ReceiptRemoteBranchAtHeadWithoutPullRequest { head_sha: _ } => false
diff --git a/dag/test/claim/roadmap/roadmap_result_returned_witness_test.dag b/dag/test/claim/roadmap/roadmap_result_returned_witness_test.dag
index c27b53a2bb7..f880f0fd436 100644
--- a/dag/test/claim/roadmap/roadmap_result_returned_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_result_returned_witness_test.dag
@@ -51,7 +51,7 @@ import gunbc.roadmap.roadmap_result_returned {
   ResultReturnedObservation, ResultReturnedObserved, ResultNotReturned, ResultNotOwed, ResultReturnedUnobserved,
   result_returned_observation_of,
 }
-import gunbc.roadmap_belt_tick_cli { belt_tick_result_tail_exit, belt_tick_exit_with_snapshot_closes }
+import gunbc.roadmap_belt_tick_cli { belt_tick_exit_with_snapshot_closes }
 import gunbc.roadmap.roadmap_event_carrier { SnapshotNotOpened, SnapshotClosed, SnapshotCloseFailed }
 import test.claim.roadmap_belt_actuate_witness { completed_attempt_progress }
 
@@ -698,20 +698,7 @@ test fn an_undelivered_result_fails_the_tick_and_is_named_beside_an_observation_
     ResultReturnNoRequest { node_id: "b", attempt_key: "k2", reason: "launched unclaimed" },
   ] }
   let clean = all([clean_pass, ResultReturnPassRan { outcomes: [] }, ResultReturnPassWithheld { reason: "observe-only" }], p => match result_return_pass_exit(pass: p) { ExitSuccess => true  ExitFailure { code: _, reason: _ } => false })
-  let both = match belt_tick_result_tail_exit(returned: undelivered_pass, tail: ExitFailure { code: 1, reason: "served observation write failed" }) {
-    ExitFailure { code, reason } => code == 1 && string_contains(s: reason, pattern: "served observation write failed") && string_contains(s: reason, pattern: "b attempt k2 (publication-refused)")
-    ExitSuccess => false
-  }
-  let observation_only = match belt_tick_result_tail_exit(returned: clean_pass, tail: ExitFailure { code: 1, reason: "served observation write failed" }) {
-    ExitFailure { code: _, reason } => reason == "served observation write failed"
-    ExitSuccess => false
-  }
-  let result_only = match belt_tick_result_tail_exit(returned: undelivered_pass, tail: ExitSuccess) {
-    ExitFailure { code: _, reason } => string_contains(s: reason, pattern: "b attempt k2")
-    ExitSuccess => false
-  }
-  let neither = match belt_tick_result_tail_exit(returned: clean_pass, tail: ExitSuccess) { ExitSuccess => true  ExitFailure { code: _, reason: _ } => false }
-  undelivered && unreadable && clean && both && observation_only && result_only && neither
+  undelivered && unreadable && clean
 }
 
 // A SNAPSHOT THE RESULT RETURN LEFT BEHIND FAILS THE TICK AND IS NAMED, AND REPLACES NOTHING. A
diff --git a/dag/test/claim/roadmap/roadmap_verification_receipt_witness_test.dag b/dag/test/claim/roadmap/roadmap_verification_receipt_witness_test.dag
index 9a4090f2127..b3280c0e5ac 100644
--- a/dag/test/claim/roadmap/roadmap_verification_receipt_witness_test.dag
+++ b/dag/test/claim/roadmap/roadmap_verification_receipt_witness_test.dag
@@ -1,6 +1,7 @@
 module test.claim.roadmap_verification_receipt_witness_test
 
 import std.types { Bool, String, NonEmptyStr, FilePath, CommitSha }
+import std.optional { Present }
 import std.content_hash {
   Fnv1a64Structural,
   content_hash_of_value,
@@ -106,7 +107,7 @@ test fn complete_exact_head_receipt_constructs_and_matches() -> Bool {
   ) {
     VerificationEvidenceForSubject { receipt: found } =>
       count(found.executions) == 1
-        && found.executions.first().command.args.first() == "run"
+        && match found.executions.first() { Present { value: e } => (match e.command.args.first() { Present { value: a } => (a as String) == "run"  _ => false })  _ => false }
         && verification_evidence_moves_lamp(
           evidence: VerificationEvidenceForSubject { receipt: found },
         )
diff --git a/dag/test/claim/roadmap/roadmap_worker_exit_observation_witness_test.dag b/dag/test/claim/roadmap/roadmap_worker_exit_observation_witness_test.dag
new file mode 100644
index 00000000000..d6553903218
--- /dev/null
+++ b/dag/test/claim/roadmap/roadmap_worker_exit_observation_witness_test.dag
@@ -0,0 +1,87 @@
+module test.claim.roadmap.roadmap_worker_exit_observation_witness_test
+
+import std.types { Bool, String, List, NonEmptyStr }
+import gunbc.roadmap_dispatch_actuator {
+  AttemptUnitObservation, AttemptUnitAbsent, AttemptUnitActive, AttemptUnitFinished, AttemptUnitUnreadable,
+  AttemptUnitStartRecorded, AttemptUnitNeverStarted, AttemptUnitStartUnread,
+  attempt_worker_unit_observation_of, worker_process_from_attempt_unit,
+}
+import gunbc.worker_lifecycle { WorkerProcessEvidence, WorkerProcessUnobserved, WorkerProcessAbsent, WorkerProcessRunning, WorkerProcessExited }
+import gunbc.roadmap.roadmap_attempt_exit_spool {
+  AttemptWorkerRole, AttemptReviewerRole, AttemptAuditorRole,
+  attempt_exit_record_from_listings, AttemptExitStageNames, AttemptExitStageUnreadable,
+}
+import gunbc.compute.attempt_lifecycle { UnitLifecycle, UnitTerminatedSuccess, UnitTerminatedFailure, UnitTerminatedCauseUnknown, UnitStillRunning, UnitLifecycleUnknown }
+import gunbc.roadmap_session_placement { session_worker_unit_lifecycle }
+
+// The worker unit's observation now that the unit is collected when its process ends (the
+// 2026-09-05 RemainAfterExit is reversed). Each claim supplies the manager's answer and the spool's
+// listings and runs the production decision and the production WorkerProcessEvidence projection; the
+// wet witness beside this file runs the real spool read.
+
+data unit: NonEmptyStr = "gunbc-attempt-n-1-k1.service" as NonEmptyStr
+
+fn evidence(loaded: AttemptUnitObservation, names: List<String>, start_recorded: Bool) -> WorkerProcessEvidence {
+  worker_process_from_attempt_unit(
+    observation: attempt_worker_unit_observation_of(
+      unit: unit,
+      loaded: loaded,
+      record: attempt_exit_record_from_listings(node_id: "n-1", attempt_key: "k1", role: AttemptWorkerRole, listings: [AttemptExitStageNames { names: names }, AttemptExitStageNames { names: [] }, AttemptExitStageNames { names: [] }]),
+      start: if start_recorded { AttemptUnitStartRecorded } else { AttemptUnitNeverStarted },
+    ),
+    unit: unit,
+  )
+}
+
+fn exited_with(e: WorkerProcessEvidence, code: Int) -> Bool {
+  match e { WorkerProcessExited { exit_code, last_command: _ } => exit_code == code _ => false }
+}
+
+fn unobserved(e: WorkerProcessEvidence) -> Bool {
+  match e { WorkerProcessUnobserved { reason: _ } => true _ => false }
+}
+
+fn absent(e: WorkerProcessEvidence) -> Bool {
+  match e { WorkerProcessAbsent => true _ => false }
+}
+
+// The collected worker is read from its record: a success exits 0, a failure carries its status, and
+// a SIGTERM reads 15 -- the number ExecMainStatus reported before, so no consumer's decision moves.
+test fn a_collected_worker_is_read_from_its_exit_record() -> Bool {
+  exited_with(e: evidence(loaded: AttemptUnitAbsent, names: ["n-1+k1+worker+inv+success+exited+0"], start_recorded: true), code: 0)
+    && exited_with(e: evidence(loaded: AttemptUnitAbsent, names: ["n-1+k1+worker+inv+exit-code+exited+3"], start_recorded: true), code: 3)
+    && exited_with(e: evidence(loaded: AttemptUnitAbsent, names: ["n-1+k1+worker+inv+signal+killed+TERM"], start_recorded: true), code: 15)
+}
+
+// Condition 1: a started worker whose unit is gone with NO record is indeterminate, never "never ran";
+// only an attempt with no start receipt (no placement record) answers absent.
+test fn a_gone_unit_without_a_record_is_unobserved_unless_it_never_started() -> Bool {
+  unobserved(e: evidence(loaded: AttemptUnitAbsent, names: ["other+k9+worker+inv+success+exited+0"], start_recorded: true))
+    && absent(e: evidence(loaded: AttemptUnitAbsent, names: [], start_recorded: false))
+}
+
+// A loaded unit is the manager's answer and the record is not consulted: a retained failed unit reads
+// its own ExecMainStatus, and a running one is running even if a stale record names it.
+test fn a_loaded_unit_is_read_from_the_manager() -> Bool {
+  exited_with(e: evidence(loaded: AttemptUnitFinished { exit_status: "1" }, names: ["n-1+k1+worker+inv+success+exited+0"], start_recorded: true), code: 1)
+    && (match evidence(loaded: AttemptUnitActive, names: ["n-1+k1+worker+inv+success+exited+0"], start_recorded: true) { WorkerProcessRunning { command: _ } => true _ => false })
+}
+
+// The settlement's read: a collected worker that exited 0 settles as SUCCESS (it read cause-unknown
+// before the record existed); a gone unit with no record keeps cause-unknown, the arm that still frees
+// only after the launch deadline; an unreadable spool frees nothing.
+test fn settlement_reads_the_record_and_keeps_cause_unknown_without_one() -> Bool {
+  let success = match session_worker_unit_lifecycle(unit: unit, loaded: AttemptUnitAbsent, record: attempt_exit_record_from_listings(node_id: "n-1", attempt_key: "k1", role: AttemptWorkerRole, listings: [AttemptExitStageNames { names: ["n-1+k1+worker+inv+success+exited+0"] }])) {
+    UnitTerminatedSuccess { detail: _ } => true
+    _ => false
+  }
+  let unknown = match session_worker_unit_lifecycle(unit: unit, loaded: AttemptUnitAbsent, record: attempt_exit_record_from_listings(node_id: "n-1", attempt_key: "k1", role: AttemptWorkerRole, listings: [AttemptExitStageNames { names: [] }])) {
+    UnitTerminatedCauseUnknown { detail: _ } => true
+    _ => false
+  }
+  let unreadable = match session_worker_unit_lifecycle(unit: unit, loaded: AttemptUnitAbsent, record: attempt_exit_record_from_listings(node_id: "n-1", attempt_key: "k1", role: AttemptWorkerRole, listings: [AttemptExitStageUnreadable { reason: "EACCES" }])) {
+    UnitLifecycleUnknown { detail: _ } => true
+    _ => false
+  }
+  success && unknown && unreadable
+}
diff --git a/dag/test/claim/roadmap/session_placement_witness_test.dag b/dag/test/claim/roadmap/session_placement_witness_test.dag
index 633db54e91a..0826814f81d 100644
--- a/dag/test/claim/roadmap/session_placement_witness_test.dag
+++ b/dag/test/claim/roadmap/session_placement_witness_test.dag
@@ -223,7 +223,7 @@ test fn settlement_releases_only_a_closed_window_or_an_ended_unit() -> Bool {
 // same fold, carries no process bounds.
 test fn the_worker_unit_is_capped_at_its_grant_by_the_compute_fold() -> Bool {
   let inst = srv2_deploy_dashboard_instance()
-  let props = property_words(props: dispatch_worker_unit_properties(instance: inst, working_directory: "/wt", worker_log_path: "/wt/log", granted: kibibyte(count: 1024), process_bounds: session_process_bounds))
+  let props = property_words(props: dispatch_worker_unit_properties(instance: inst, working_directory: "/wt", worker_log_path: "/wt/log", granted: kibibyte(count: 1024), process_bounds: session_process_bounds, exit_hook: "mkdir -- /i/attempt-exit-spool/inbox/n+k+x" as NonEmptyStr))
   let compute = property_words(props: compute_unit_properties(layout: compute_layout(instance: inst, identity_hex: "abc"), granted: kibibyte(count: 1024)))
   contains(props, "MemoryMax=1048576")
     && contains(props, "CPUQuota=800%")
diff --git a/dag/test/claim/runner/jit_deregistration_forged_probe_witness_test.dag b/dag/test/claim/runner/jit_deregistration_forged_probe_witness_test.dag
index cbb83654c89..975e0e9b90d 100644
--- a/dag/test/claim/runner/jit_deregistration_forged_probe_witness_test.dag
+++ b/dag/test/claim/runner/jit_deregistration_forged_probe_witness_test.dag
@@ -36,9 +36,9 @@ fn blocking(c: CompileDiagnosticCensus, wanted: String, subject: String) -> Int
   }
 }
 
-data control_source: String = "module probe_jit_deregistration_harness_control\nimport std.types { Bool }\nimport gunbc.runner.runner_jit_perform { JitMintDispatch }\nimport gunbc.runner.runner_jit_deregistration { JitDeregistration, jit_runner_deregistered }\nfn done(d: JitDeregistration) -> Bool { jit_runner_deregistered(result: d) }\n"
+data control_source: String = "module probe_jit_deregistration_harness_control\nimport std.types { Bool }\nimport gunbc.runner.runner_jit_perform { JitMintDispatch }\nimport gunbc.runner.jit_registration_subject { JitRegistrationSubject }\nimport gunbc.runner.runner_jit_deregistration { JitDeregistration, jit_runner_deregistered }\nfn done(d: JitDeregistration) -> Bool { jit_runner_deregistered(result: d) }\n"
 
-data sealed_records: List<String> = ["AuthorizedJitMintDispatch", "JitRegistration", "OrganizationRunnerListRead", "JitDeregistrationReceipt"]
+data sealed_records: List<String> = ["AuthorizedJitMintDispatch", "JitRegistration", "JitRegistrationSubject", "OrganizationRunnerListRead", "JitDeregistrationReceipt"]
 
 test fn a_source_that_only_names_the_modules_forges_nothing() -> Bool {
   let c = census_of(source: control_source)
diff --git a/dag/test/claim/runner/provider_guest_incarnation_witness_test.dag b/dag/test/claim/runner/provider_guest_incarnation_witness_test.dag
new file mode 100644
index 00000000000..fb1cf822a8a
--- /dev/null
+++ b/dag/test/claim/runner/provider_guest_incarnation_witness_test.dag
@@ -0,0 +1,54 @@
+module test.claim.provider_guest_incarnation_witness
+
+import std.types { Bool, List, String }
+import product.fabric.isolation { IsolationGuarantee, AttemptScopedSecrets, DefaultDenyEgress }
+import gunbc.fleet_host_identity { operator_host_183527, operator_host_3dde7f, operator_host_srv1 }
+import gunbc.runner.runner_isolation_admission { SandboxOffer, DedicatedKernelSandboxProvider, GeneralCiWorkload }
+import gunbc.runner.provider_guest_incarnation {
+  IncarnationAdmitted, IncarnationAdmissionRefused, admit_offer_on_host, excuse_covers,
+  provider_guest_isolation_excuses, provider_guest_egress_excuse,
+}
+import gunbc.runner.provider_guest_launch { provider_guest_launch_evidenced, provider_guest_launch_withheld }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// NO INCARNATION IS ESTABLISHED IN THIS TREE: its rebuild receipt has no producer until the reset loop
+// lands, and test.claim.provider_rebuild_receipt_forged_probe_witness is the executed red that one
+// cannot be written instead. What can be exercised is what an incarnation WOULD offer once one
+// exists, read from the launch's own guarantee lists, against the production admission.
+
+fn same_set(a: List<IsolationGuarantee>, b: List<IsolationGuarantee>) -> Bool {
+  count(a) == count(b) && (a |> all(x => (filter(b, y => y == x) |> count) == 1))
+}
+
+fn launch_offer() -> SandboxOffer {
+  SandboxOffer {
+    provider_class: DedicatedKernelSandboxProvider,
+    evidenced: provider_guest_launch_evidenced,
+    withheld: provider_guest_launch_withheld,
+    standing: "the launch offer's guarantee lists",
+  }
+}
+
+// GENERAL CI STAYS REFUSED ON A PROVIDER GUEST UNTIL THE RESET LOOP EARNS AttemptScopedSecrets. Even
+// with egress excused by its drop, a placed registration leaves AttemptScopedSecrets missing; without
+// the excuse egress is missing too, so the excuse moves exactly one guarantee and nothing else.
+test fn general_ci_is_refused_for_attempt_secrets_even_under_the_egress_excuse() -> Bool {
+  match admit_offer_on_host(host: operator_host_183527, offer: launch_offer(), work: GeneralCiWorkload, excuses: provider_guest_isolation_excuses) {
+    IncarnationAdmissionRefused { missing: m } => same_set(a: m, b: [AttemptScopedSecrets])
+    IncarnationAdmitted { excused: _ } => false
+  }
+    && match admit_offer_on_host(host: operator_host_183527, offer: launch_offer(), work: GeneralCiWorkload, excuses: []) {
+      IncarnationAdmissionRefused { missing: m } => same_set(a: m, b: [AttemptScopedSecrets, DefaultDenyEgress])
+      IncarnationAdmitted { excused: _ } => false
+    }
+}
+
+// THE EXCUSE IS SCOPED TO ITS GUARANTEE AND ITS HOSTS: not to an owned host, not to another guarantee.
+test fn the_egress_excuse_covers_only_egress_on_the_two_guests() -> Bool {
+  excuse_covers(excuse: provider_guest_egress_excuse, host: operator_host_183527, g: DefaultDenyEgress)
+    && excuse_covers(excuse: provider_guest_egress_excuse, host: operator_host_3dde7f, g: DefaultDenyEgress)
+    && !excuse_covers(excuse: provider_guest_egress_excuse, host: operator_host_srv1, g: DefaultDenyEgress)
+    && !excuse_covers(excuse: provider_guest_egress_excuse, host: operator_host_183527, g: AttemptScopedSecrets)
+}
diff --git a/dag/test/claim/runner/provider_rebuild_receipt_forged_probe_witness_test.dag b/dag/test/claim/runner/provider_rebuild_receipt_forged_probe_witness_test.dag
new file mode 100644
index 00000000000..beb3bd10bca
--- /dev/null
+++ b/dag/test/claim/runner/provider_rebuild_receipt_forged_probe_witness_test.dag
@@ -0,0 +1,44 @@
+module test.claim.provider_rebuild_receipt_forged_probe_witness
+
+import std.types { String, Bool, Int, List }
+import extdeps.filesystem.filesystem_io
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
+import gunbc.compile_diagnostic_census {
+  CompileDiagnosticCensus, CompileDiagnosticCensusRow, CensusObserved, CensusNotRunnable,
+}
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
+
+// THE FORGED REBUILD, ENROLLED AS AN EXECUTED RED (DESIGN §4b). test.probe.provider_rebuild_receipt_forged_probe
+// writes a ProviderRebuildReceipt outside gunbc.runner.provider_guest_incarnation; it must refuse at
+// ProviderRebuildReceipt, and a control source that only NAMES the module must refuse at nothing. A
+// receipt is what would make a guest's root fresh, and until the reset loop's provider exchange mints
+// one, nothing may.
+
+fn census_of(source: String) -> CompileDiagnosticCensus {
+  compile_dag_diagnostic_census(source)
+}
+
+fn blocking(c: CompileDiagnosticCensus, wanted: String, subject: String) -> Int {
+  match c {
+    CensusNotRunnable { cause: _ } => -1
+    CensusObserved { rows: rows } =>
+      rows
+        |> filter(r => (r.diagnostic_class as String) == wanted && r.subject_name == subject && r.blocking)
+        |> fold(init: 0, f: (acc, r) => acc + r.count)
+  }
+}
+
+data control_source: String = "module probe_rebuild_receipt_harness_control\nimport std.types { Bool }\nimport gunbc.runner.provider_guest_incarnation { IncarnationStanding, IncarnationEstablished }\nfn established(s: IncarnationStanding) -> Bool { match s { IncarnationEstablished { incarnation: _ } => true _ => false } }\n"
+
+test fn a_source_that_only_names_the_module_forges_nothing() -> Bool {
+  blocking(c: census_of(source: control_source), wanted: "SoleConstructorViolation", subject: "ProviderRebuildReceipt") == 0
+}
+
+test fn a_forged_rebuild_receipt_refuses_at_its_type() -> Bool {
+  blocking(
+    c: census_of(source: filesystem_read(path: "dag/test/probe/provider_rebuild_receipt_forged_probe.dag").content),
+    wanted: "SoleConstructorViolation",
+    subject: "ProviderRebuildReceipt",
+  ) >= 1
+}
diff --git a/dag/test/claim/runner/qualification_job_log_receipt_forged_probe_witness_test.dag b/dag/test/claim/runner/qualification_job_log_receipt_forged_probe_witness_test.dag
new file mode 100644
index 00000000000..f61a111ca19
--- /dev/null
+++ b/dag/test/claim/runner/qualification_job_log_receipt_forged_probe_witness_test.dag
@@ -0,0 +1,67 @@
+module test.claim.qualification_job_log_receipt_forged_probe_witness
+
+import std.types { String, Bool, Int, List }
+import extdeps.filesystem.filesystem_io
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
+import gunbc.compile_diagnostic_census {
+  CompileDiagnosticCensus, CompileDiagnosticCensusRow, CensusObserved, CensusNotRunnable,
+}
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
+
+// THE FORGED JOB-LOG RECEIPT ROUTES, ENROLLED AS EXECUTED REDS (DESIGN 4b: a state unrepresentable
+// in the accepted corpus is still representable as source handed to the compiler, and the refusal
+// is the enrollable evidence). test.probe.qualification_job_log_receipt_forged_probe writes the
+// sealed receipt from invented readings and calls its one minter from outside the collect stage;
+// each must refuse at its own subject. Counts are scoped to class AND subject, and a control source
+// that only NAMES the module and calls its open decoder must refuse at neither, so the refusals are
+// attributable to the forgeries rather than to importing the module at all. The pattern is
+// test.claim.jit_deregistration_forged_probe_witness's.
+
+fn census_of(source: String) -> CompileDiagnosticCensus {
+  compile_dag_diagnostic_census(source)
+}
+
+fn probe() -> CompileDiagnosticCensus {
+  census_of(source: filesystem_read(path: "dag/test/probe/qualification_job_log_receipt_forged_probe.dag").content)
+}
+
+fn blocking(c: CompileDiagnosticCensus, wanted: String, subject: String) -> Int {
+  match c {
+    CensusNotRunnable { cause: _ } => -1
+    CensusObserved { rows: rows } =>
+      rows
+        |> filter(r => (r.diagnostic_class as String) == wanted && r.subject_name == subject && r.blocking)
+        |> fold(init: 0, f: (acc, r) => acc + r.count)
+  }
+}
+
+data control_source: String = "module probe_qualification_receipt_harness_control\nimport std.types { String }\nimport gunbc.runner.runner_qualification_dispatch { JobLogInstrumentDecode, decode_job_log_instruments }\nfn decoded(t: String) -> JobLogInstrumentDecode { decode_job_log_instruments(log: t, slot_unit: \"x.service\") }\n"
+
+test fn a_source_that_only_names_the_module_forges_nothing() -> Bool {
+  let c = census_of(source: control_source)
+  blocking(c: c, wanted: "SoleConstructorViolation", subject: "QualificationJobLogReceipt") == 0
+    && blocking(c: c, wanted: "ConstructorCallAdmissionRefused", subject: "job_log_standing") == 0
+    && blocking(c: c, wanted: "ConstructorCallAdmissionRefused", subject: "collect_qualification_instruments_under") == 0
+    && blocking(c: c, wanted: "ConstructorCallAdmissionRefused", subject: "read_claim_cost_artifact") == 0
+}
+
+test fn a_forged_job_log_receipt_refuses_at_its_own_name() -> Bool {
+  blocking(c: probe(), wanted: "SoleConstructorViolation", subject: "QualificationJobLogReceipt") >= 1
+}
+
+test fn the_receipt_minter_refuses_a_caller_other_than_the_collect_stage() -> Bool {
+  blocking(c: probe(), wanted: "ConstructorCallAdmissionRefused", subject: "job_log_standing") >= 1
+}
+
+// THE COLLECTOR'S READS ARE REACHABLE ONLY THROUGH ITS READ PLAN. collect_qualification_instruments_under
+// takes no job or run id -- they are the sealed collection's -- and admits only the checked entry, so a
+// caller holding a genuine collection cannot read it under another installation's token.
+test fn the_reads_refuse_a_caller_other_than_the_checked_entry() -> Bool {
+  blocking(c: probe(), wanted: "ConstructorCallAdmissionRefused", subject: "collect_qualification_instruments_under") >= 1
+}
+
+// AND THE CLAIM-COST READ CANNOT BE AIMED AT ANOTHER RUN: it admits only the confined reads above.
+test fn the_claim_cost_read_refuses_a_free_token_and_run_id() -> Bool {
+  blocking(c: probe(), wanted: "ConstructorCallAdmissionRefused", subject: "read_claim_cost_artifact") >= 1
+}
diff --git a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
index 962d432e01d..83c0af9643b 100644
--- a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
+++ b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
@@ -1,5 +1,11 @@
 module test.claim.runner_attempt_launch_witness
 
+import gunbc.runner.runner_jit_perform { JitMintDispatchAuthorized, JitMintDispatchRefused, dispatch_jit_mint, receive_jit_mint }
+import gunbc.runner.jit_registration_subject { microvm_registration_subject }
+import gunbc.runner_microvm_attempt { bind_owned_attempt }
+import gunbc.runner.runner_jit_admission { jit_admission_axis_standing, AttemptBindingAxis }
+import test.claim.github_app_registry { app_credential, observed_grant, runner_grant, gunbai_org_ref, restricted_group_1 }
+import extdeps.github.actions_jit_runner { jit_config_mint_outcome }
 import gunbc.runner_attempt_launch { GitHubLaunchPayload, launch_payload_device }
 
 import std.types { String, Bool, Int, List, NonEmptyStr }
@@ -62,7 +68,7 @@ import extdeps.github.actions_jit_runner {
   EncodedJitConfig, JitConfigMinted, jit_config_mint_outcome,
 }
 import extdeps.transports.rest { RestExchangeCommitAmbiguous }
-import gunbc.runner_jit_mint { MicroVmJitSlot }
+import gunbc.runner.jit_registration_subject { microvm_registration_subject_of }
 import gunbc.runner.runner_jit_perform {
   JitCredentialBoundToAttempt, JitCredentialMintNotCreated,
 }
@@ -135,18 +141,40 @@ fn minted_credential(encoded: String) -> List<EncodedJitConfig> {
 // something that is not a whole credential, handed on as if it were.
 data short_blob: String = "ZmFrZS1qaXQtY29uZmln"
 
-fn received_for(attempt: MicroVmAttempt, encoded: String) -> JitMintPerformance {
-  match minted_credential(encoded: encoded) {
-    Cons { head: c, tail: _ } =>
+// THE DELIVERY IS MINTED, NOT HAND-BUILT, AND IT NEVER LEAVES THIS FUNCTION. A successful delivery is
+// a sealed BoundJitCredential that only receive_jit_mint constructs, carrying the authorized dispatch
+// that produced it; this fixture takes the real route for the credential's attempt -- an owned cell
+// binding, dispatch_jit_mint and receive_jit_mint over upstream's own 201 outcome fold, both of which
+// admit this function by name -- and hands back only the PLAN the planner built from it. A fixture
+// that returned the delivery would be a public proxy for the mint (an admitted call edge does not
+// confine a value the caller hands back), so a plan, which carries no delivery, is the only egress.
+// minted_for differs from attempt in the claim about a credential bound to a sibling attempt.
+fn planned_with(
+  pair: IssuedPair,
+  account: MoneyAccount,
+  attempt: MicroVmAttempt,
+  minted_for: MicroVmAttempt,
+  encoded: String,
+  ground: AttemptGround,
+) -> AttemptLaunchPlan {
+  let mint = match dispatch_jit_mint(
+      subject: microvm_registration_subject(binding: bind_owned_attempt(attempt: minted_for, owned: true)),
+      authority: app_credential,
+      control_plane: observed_grant(perms: runner_grant),
+      organization: gunbai_org_ref,
+      runner_group: restricted_group_1(),
+      attempt_binding: jit_admission_axis_standing(axis: AttemptBindingAxis),
+    ) {
+    JitMintDispatchAuthorized { dispatch: d } =>
       JitMintReceived {
-        delivery: JitCredentialBoundToAttempt { slot: MicroVmJitSlot { attempt: attempt }, credential: c, runner_id: registration_fixture_id },
+        delivery: receive_jit_mint(
+          dispatch: JitMintDispatchAuthorized { dispatch: d },
+          outcome: jit_config_mint_outcome(status: 201, encoded: encoded, runner_id: registration_fixture_id, error_body: ""),
+        ),
       }
-    Empty {} => JitMintAppJwtUnsigned { detail: "fixture: credential fixture did not mint" }
+    JitMintDispatchRefused { refusal: _ } => JitMintAppJwtUnsigned { detail: "fixture: the attempt's dispatch was refused" }
   }
-}
-
-fn live_grant(attempt: MicroVmAttempt) -> JitMintPerformance {
-  received_for(attempt: attempt, encoded: doubled(s: "A", k: 10))
+  plan_for(pair: pair, account: account, attempt: attempt, mint: mint, ground: ground)
 }
 
 fn plan_for(
@@ -209,7 +237,7 @@ test fn a_below_floor_credential_stages_no_device_and_starts_no_vmm() -> Bool {
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 1, id: "cred0") {
         Cons { head: a, tail: _ } => {
-          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: received_for(attempt: a, encoded: short_blob), ground: GroundClear)
+          let plan = planned_with(pair: pair, account: pair.account, attempt: a, minted_for: a, encoded: short_blob, ground: GroundClear)
           no_device_no_vmm(plan: plan)
             && match refusal_of(plan: plan) {
               Cons { head: JitCredentialBelowFloor { bytes: n }, tail: _ } => byte_size_count(b: n) == 20
@@ -233,7 +261,7 @@ test fn a_credential_at_the_ceiling_in_code_points_but_over_it_in_bytes_is_refus
       match accepted_attempt(i: 7, id: "multibyte") {
         Cons { head: a, tail: _ } => {
           let wide = doubled(s: "\u{00e9}", k: 16)
-          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: received_for(attempt: a, encoded: wide), ground: GroundClear)
+          let plan = planned_with(pair: pair, account: pair.account, attempt: a, minted_for: a, encoded: wide, ground: GroundClear)
           string_length(wide) == 65536
             && byte_size_count(b: jit_drive_utf8_size(text: wide)) == 131072
             && no_device_no_vmm(plan: plan)
@@ -253,7 +281,7 @@ test fn an_above_ceiling_credential_stages_no_device_and_starts_no_vmm() -> Bool
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 1, id: "credbig") {
         Cons { head: a, tail: _ } => {
-          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: received_for(attempt: a, encoded: doubled(s: "A", k: 17)), ground: GroundClear)
+          let plan = planned_with(pair: pair, account: pair.account, attempt: a, minted_for: a, encoded: doubled(s: "A", k: 17), ground: GroundClear)
           no_device_no_vmm(plan: plan)
             && match refusal_of(plan: plan) {
               Cons { head: JitCredentialAboveCeiling { bytes: _ }, tail: _ } => true
@@ -275,10 +303,10 @@ test fn a_credential_bound_to_another_attempt_stages_no_device() -> Bool {
         Cons { head: a, tail: _ } =>
           match accepted_attempt(i: 6, id: "theirs") {
             Cons { head: b, tail: _ } => {
-              let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: b), ground: GroundClear)
+              let plan = planned_with(pair: pair, account: pair.account, attempt: a, minted_for: b, encoded: doubled(s: "A", k: 10), ground: GroundClear)
               no_device_no_vmm(plan: plan)
                 && match refusal_of(plan: plan) {
-                  Cons { head: JitCredentialBoundToDifferentAttempt { bound_to: other }, tail: _ } => other == MicroVmJitSlot { attempt: b }
+                  Cons { head: JitCredentialBoundToDifferentAttempt { bound_to: other }, tail: _ } => other == microvm_registration_subject_of(attempt: b)
                   _ => false
                 }
             }
@@ -336,9 +364,9 @@ test fn an_unauthorized_grant_yields_zero_jailer_launches() -> Bool {
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 2, id: "unauth") {
         Cons { head: a, tail: _ } =>
-          match plan_for(pair: pair, account: exhausted_account, attempt: a, mint: live_grant(attempt: a), ground: GroundClear) {
+          match planned_with(pair: pair, account: exhausted_account, attempt: a, minted_for: a, encoded: doubled(s: "A", k: 10), ground: GroundClear) {
             LaunchRefusedUnauthorized { authorization: _ } =>
-              no_device_no_vmm(plan: plan_for(pair: pair, account: exhausted_account, attempt: a, mint: live_grant(attempt: a), ground: GroundClear))
+              no_device_no_vmm(plan: planned_with(pair: pair, account: exhausted_account, attempt: a, minted_for: a, encoded: doubled(s: "A", k: 10), ground: GroundClear))
             _ => false
           }
         Empty {} => false
@@ -352,9 +380,9 @@ test fn prior_resources_refuse_rather_than_reuse() -> Bool {
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 3, id: "prior") {
         Cons { head: a, tail: _ } =>
-          match plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: GroundOccupied) {
+          match planned_with(pair: pair, account: pair.account, attempt: a, minted_for: a, encoded: doubled(s: "A", k: 10), ground: GroundOccupied) {
             LaunchRefusedPriorResources =>
-              no_device_no_vmm(plan: plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: GroundOccupied))
+              no_device_no_vmm(plan: planned_with(pair: pair, account: pair.account, attempt: a, minted_for: a, encoded: doubled(s: "A", k: 10), ground: GroundOccupied))
             _ => false
           }
         Empty {} => false
@@ -378,7 +406,7 @@ test fn a_live_grant_stages_exactly_one_device_and_records_the_registration() ->
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 4, id: "ok1") {
         Cons { head: a, tail: _ } => {
-          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: GroundClear)
+          let plan = planned_with(pair: pair, account: pair.account, attempt: a, minted_for: a, encoded: doubled(s: "A", k: 10), ground: GroundClear)
           planned_jailer_launches(plan: plan) == 1
             && match plan {
               LaunchAuthorized {
@@ -550,7 +578,7 @@ fn staging_with(jit_of: Bool, obs: WorkspaceStagingObservation, ground: AttemptG
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 2, id: "ws1") {
         Cons { head: a, tail: _ } => {
-          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: ground)
+          let plan = planned_with(pair: pair, account: pair.account, attempt: a, minted_for: a, encoded: doubled(s: "A", k: 10), ground: ground)
           staging_label(v: attempt_staging_verdict(
             plan: plan,
             jail: staged_jail_material(),
@@ -600,7 +628,7 @@ fn jail_label(m: JailMaterialStaging) -> String {
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 2, id: "ws1") {
         Cons { head: a, tail: _ } => {
-          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: GroundClear)
+          let plan = planned_with(pair: pair, account: pair.account, attempt: a, minted_for: a, encoded: doubled(s: "A", k: 10), ground: GroundClear)
           staging_label(v: attempt_staging_verdict(
             plan: plan,
             jail: m,
@@ -652,7 +680,7 @@ fn admitted_receipt_names_this_attempts_paths() -> Bool {
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 2, id: "ws1") {
         Cons { head: a, tail: _ } => {
-          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: GroundClear)
+          let plan = planned_with(pair: pair, account: pair.account, attempt: a, minted_for: a, encoded: doubled(s: "A", k: 10), ground: GroundClear)
           match attempt_staging_verdict(plan: plan, jail: staged_jail_material(), jit: staged_device_of(plan: plan), workspace: good_workspace()) {
             StagingAdmitsJailer { receipt: r } =>
               r.bootstrap_device_path == concat(attempt_jail_chroot_root(attempt: a, firecracker_binary: "/bin/firecracker"), jail_jit_path as String)
diff --git a/dag/test/claim/runner/runner_host_file_converge_witness_test.dag b/dag/test/claim/runner/runner_host_file_converge_witness_test.dag
index a1ccb5a5a75..138433059cc 100644
--- a/dag/test/claim/runner/runner_host_file_converge_witness_test.dag
+++ b/dag/test/claim/runner/runner_host_file_converge_witness_test.dag
@@ -10,7 +10,7 @@ import extdeps.needrestart {
   needrestart_unit_name_prefix_regex,
 }
 import product.host_identity { HostIdentity }
-import gunbc.runner_slot_population_census { desired_unit_names_range }
+import gunbc.runner_slot_population_census { desired_unit_names_range, committed_unit_names_at }
 import gunbc.runner_slot_allocation { gunbc_runner_committed_width, RunnerWidthDerived, RunnerWidthUnresolved }
 import gunbc.runner_width_transition { transition_population_agreement, TransitionPopulationAgrees, TransitionPopulationDisagrees, TransitionPopulationUndecidable }
 import gunbc.fleet_host_identity { operator_host_srv1 }
@@ -728,22 +728,29 @@ fn srv1_width() -> Int? {
   }
 }
 
+// THE LIVE SET IS THE COMMITTED IDENTITIES, NOT 1..width. Since #12339 srv1's committed population
+// is srv1-01..(width - 1) plus the shakedown slot srv1-13 (gunbc.runner_slot_allocation
+// host_committed_identities_at), so cutting the listing at the width named a slot the width no longer
+// charges as live and masked srv1-13. The live set comes from the census authority's one derivation;
+// the retiring set is the rest of the listing.
 fn srv1_live_names() -> List<String> {
-  match srv1_width() { Absent => [] Present { value: w } => srv1_unit_names(slot: 1, limit: w) }
+  match srv1_width() { Absent => [] Present { value: w } => committed_unit_names_at(host: "srv1" as HostIdentity, committed: w) }
 }
 
 fn srv1_retiring_names(limit: Int) -> List<String> {
-  match srv1_width() { Absent => [] Present { value: w } => srv1_unit_names(slot: w + 1, limit: limit) }
+  let live = srv1_live_names()
+  match srv1_width() { Absent => [] Present { value: _ } => srv1_unit_names(slot: 1, limit: limit) |> filter(u => !any(live, l => l == u)) }
 }
 
 // The last declared-live slot: the one the REDs below mask or lose to show that retirement never
 // excuses a live slot.
 fn srv1_last_live_names() -> List<String> {
-  match srv1_width() { Absent => [] Present { value: w } => srv1_unit_names(slot: w, limit: w) }
+  fold(srv1_live_names(), init: [], f: (acc, u) => [u])
 }
 
 fn srv1_all_but_last_live_names() -> List<String> {
-  match srv1_width() { Absent => [] Present { value: w } => srv1_unit_names(slot: 1, limit: w - 1) }
+  let last = srv1_last_live_names()
+  srv1_live_names() |> filter(u => !any(last, l => l == u))
 }
 
 fn every_unit_holds(pop: RunnerSlotPopulation, units: List<String>, wire: String) -> Bool {
diff --git a/dag/test/claim/runner/runner_host_medium_witness_test.dag b/dag/test/claim/runner/runner_host_medium_witness_test.dag
new file mode 100644
index 00000000000..c3fa18b2689
--- /dev/null
+++ b/dag/test/claim/runner/runner_host_medium_witness_test.dag
@@ -0,0 +1,358 @@
+module test.claim.runner_host_medium_witness
+
+import std.types { Bool, List, NonEmptyStr, String }
+import std.measure { kibibyte_count, hardware_thread_count_value }
+import extdeps.toolchain.types { Aarch64, X86_64 }
+import extdeps.crypto.hash { sha256_digest, sha512_digest }
+import std.process { ExitSuccess }
+import extdeps.linux.proc_uptime { UptimeRefused }
+import gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle { SmproNotTaken }
+import gunbc.host_boot_attempt_admission { attempt_configuration_not_recorded }
+import std.optional { Present }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import extdeps.github.actions_runner { actions_runner_release_2_337_0 }
+import extdeps.provisioning.ubuntu_seeded_install_media_remaster { seed_artifact_readback_holds }
+import extdeps.provisioning.ubuntu_seeded_install_media {
+  NoCloudSeedArtifact, UbuntuSeededInstallMediaBuildInput, seeded_install_media_build_key,
+  seeded_install_media_seed_artifact_admission, SeedArtifactsAdmitted, SeedArtifactsRefused,
+  SeedArtifactNameNotABasename, SeedArtifactNameReserved, SeedArtifactNameCollidesWithSeedFile, SeedArtifactNameDuplicated,
+}
+import gunbc.boot_medium { BootMedium, BootMediumRunnerHostUp, BootMediumVolumeLabel, BootMediumNoTerminal }
+import gunbc.fleet_host_identity { operator_host_mtcollins1 }
+import gunbc.managed_host_boot { AdmittedBootSubject, BootSubjectAdmitted, BootSubjectRefused, boot_subject_admission_for }
+import gunbc.machine_intake_mtcollins1_census_image { mtcollins1_census_machine, mtcollins1_census_console_device, mtcollins1_census_console_arg }
+import gunbc.machine_intake_mtcollins1_boot_run {
+  MtCollins1BootTerminalVerdict, TerminalAccepted, TerminalRunnerHostAccepted, TerminalRefused, TerminalPending,
+  WatchRunnerHostAccepted, watch_tick, SolChannelLive,
+  TerminalWatch, actuation_watch_of, actuation_after_watch, actuation_with_outcome, actuation_not_powered_on, mtcollins1_boot_attempt_of, BmcAccessNotReached,
+  mtcollins1_boot_terminal_verdict, mtcollins1_boot_terminal_cause_text, mtcollins1_boot_medium_refusal,
+}
+import gunbc.runner.runner_host_medium {
+  RunnerHostMediumHost, RunnerHostMediumImage, RunnerHostMediumImageDerived, RunnerHostMediumRunnerUnpublished, RunnerHostMediumUserDataRefused,
+  RunnerHostUp, RunnerHostUpReadback, RunnerHostUpPending, RunnerHostUpRefused, RunnerHostUpObserved,
+  RunnerHostSectionFailed, RunnerHostTarballDigestDiffers, RunnerHostMachineNotAarch64, RunnerHostMachineUnrecognized, RunnerHostSectionAbsent, RunnerHostLabelAbsent,
+  runner_host_medium_image, runner_host_boot_medium, runner_host_up_readback, runner_host_medium_volume_id,
+}
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+data mtcollins1_runner_host: RunnerHostMediumHost = RunnerHostMediumHost {
+  machine: mtcollins1_census_machine,
+  console_device: mtcollins1_census_console_device,
+  console_kernel_arg: mtcollins1_census_console_arg,
+}
+
+data supplied_digest: NonEmptyStr = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+
+fn runner_subject() -> AdmittedBootSubject? {
+  subject_with(medium: runner_host_boot_medium(output_digest: supplied_digest))
+}
+
+fn subject_with(medium: BootMedium) -> AdmittedBootSubject? {
+  match boot_subject_admission_for(host: operator_host_mtcollins1, medium: medium, execution_revision: "0123456789abcdef0123456789abcdef01234567" as NonEmptyStr) {
+    BootSubjectAdmitted { subject: s } => Present { value: s }
+    BootSubjectRefused { host: _, cause: _ } => none
+  }
+}
+
+fn section(name: String, argv: String, body: String, exit_code: String) -> String {
+  concat("----SECTION ", name, "----\n----ARGV ", name, ": ", argv, "\n", body, "----EXIT ", name, ": ", exit_code, "\n")
+}
+
+data begin_line: String = "=====GUNBC-HOST-CAPTURE mtcollins1 boot-id=aaaaaaaa-0000-4000-8000-000000000001 begin 2026-10-04T00:00:00Z=====\n"
+data end_line: String = "=====GUNBC-HOST-CAPTURE mtcollins1 boot-id=aaaaaaaa-0000-4000-8000-000000000001 end 2026-10-04T00:01:00Z=====\n"
+
+data meminfo_body: String = "MemTotal:       134217728 kB\nMemFree:        130000000 kB\nMemAvailable:   131000000 kB\nBuffers:            1024 kB\nCached:          2000000 kB\nSwapTotal:             0 kB\nSwapFree:              0 kB\nHugePages_Total:       0\n"
+
+fn sections(install_exit: String, machine: String) -> String {
+  sections_with_digest(install_exit: install_exit, machine: machine, tarball_digest: actions_runner_release_2_337_0.digest_aarch64.hex as String)
+}
+
+fn sections_with_digest(install_exit: String, machine: String, tarball_digest: String) -> String {
+  concat(
+    section(name: "boot-media", argv: "ls -1 /dev/disk/by-label", body: "GUNBC_RUNNER_HOST_2404_3\nEFI\n", exit_code: "0"),
+    section(name: "runner-tarball-digest", argv: "sha256sum -- (the tarball on the medium)", body: concat(tarball_digest, "  /cdrom/gunbc-runner/actions-runner-linux-arm64-2.337.0.tar.gz\n"), exit_code: "0"),
+    section(name: "runner-clear", argv: "rm -rf /opt/actions-runner", body: "", exit_code: "0"),
+    section(name: "runner-dir", argv: "mkdir -p /opt/actions-runner", body: "", exit_code: "0"),
+    section(name: "runner-extract", argv: "(the rendered extract)", body: "", exit_code: install_exit),
+    section(name: "runner-listener", argv: "test -x /opt/actions-runner/bin/Runner.Listener", body: "", exit_code: "0"),
+    section(name: "systemd-manager", argv: "test -d /run/systemd/system", body: "", exit_code: "0"),
+    section(name: "meminfo", argv: "cat /proc/meminfo", body: meminfo_body, exit_code: "0"),
+    section(name: "nproc", argv: "nproc", body: "80\n", exit_code: "0"),
+    section(name: "uname-machine", argv: "uname -m", body: concat(machine, "\n"), exit_code: "0"),
+  )
+}
+
+fn closed(install_exit: String, machine: String) -> String {
+  concat(begin_line, sections(install_exit: install_exit, machine: machine), end_line)
+}
+
+fn readback(capture: String) -> RunnerHostUpReadback? {
+  match runner_subject() {
+    Absent => none
+    Present { value: s } => Present { value: runner_host_up_readback(capture: capture, subject: s) }
+  }
+}
+
+// THE DERIVATION INHABITS THE SEEDED-MEDIA BUILD INPUT WITH THE RUNNER PAYLOAD: the arm64 artifact of
+// the host-unit slot's release as a seed ARTIFACT under its cited arm64 digest (the boot fetches
+// nothing), a seed program that verifies it off the medium and RETURNS
+// (no power-off, nothing written to a disk), and the medium's own volume id.
+test fn the_runner_image_derives_with_the_slot_runner_and_a_program_that_never_halts() -> Bool {
+  match runner_host_medium_image(host: mtcollins1_runner_host) {
+    RunnerHostMediumImageDerived { input: input, runner: runner } => {
+      let program = fold(input.seed_files, init: "", f: (acc, f) => concat(acc, f.content as String))
+      (runner.binary_release.version as String) == (actions_runner_release_2_337_0.version as String)
+        && (input.volume_id as String) == (runner_host_medium_volume_id as String)
+        && string_contains(s: program, pattern: "sha256sum")
+        && !string_contains(s: program, pattern: "set -e")
+        && !string_contains(s: program, pattern: "curl")
+        && count(input.seed_artifacts) == 1
+        && all(input.seed_artifacts, a => (a.digest.hex as String) == (actions_runner_release_2_337_0.digest_aarch64.hex as String))
+        && string_contains(s: program, pattern: "Runner.Listener")
+        && !string_contains(s: program, pattern: "poweroff")
+        && string_contains(s: input.grub_kernel_cmdline as String, pattern: mtcollins1_census_console_arg as String)
+    }
+    RunnerHostMediumRunnerUnpublished { binary_release: _ } => false
+    RunnerHostMediumUserDataRefused { reason: _ } => false
+  }
+}
+
+// THE MEDIUM IS ADMITTED BY THE REAL BOOT SUBJECT and carries the runner-host-up terminal, so the
+// boot run's pre-controller medium gate does not refuse it as a terminal-less medium.
+test fn the_runner_medium_is_admitted_and_names_the_runner_host_up_terminal() -> Bool {
+  let medium = runner_host_boot_medium(output_digest: supplied_digest)
+  (match medium.terminal {
+    BootMediumRunnerHostUp { label: l } => (l as String) == (runner_host_medium_volume_id as String)
+    BootMediumVolumeLabel { label: _ } => false
+    BootMediumNoTerminal { reason: _ } => false
+  })
+    && (match mtcollins1_boot_medium_refusal(medium: medium) { Absent => true Present { value: _ } => false })
+    && (match runner_subject() { Present { value: _ } => true Absent => false })
+}
+
+// A CLOSED ENVELOPE WITH EVERY SECTION HELD IS THE RUNNER HOST UP, carrying the idle readings.
+test fn a_closed_envelope_with_every_section_held_reads_the_runner_host_up() -> Bool {
+  match readback(capture: closed(install_exit: "0", machine: "aarch64")) {
+    Present { value: RunnerHostUpObserved { up: up } } =>
+      kibibyte_count(k: up.mem_total) == 134217728 && kibibyte_count(k: up.mem_available) == 131000000 && hardware_thread_count_value(t: up.threads) == 80 && (match up.machine { Aarch64 => true _ => false })
+    _ => false
+  }
+}
+
+// THE REDS: a runner install whose digest check failed, and a host that is not aarch64, each refuse
+// and BOTH are named on one boot; an open envelope whose install already failed refuses before END;
+// a closed envelope missing a section refuses rather than accepting on what it has.
+test fn a_failed_install_and_a_foreign_machine_both_refuse() -> Bool {
+  match readback(capture: closed(install_exit: "1", machine: "x86_64")) {
+    Present { value: RunnerHostUpRefused { refusals: rs } } =>
+      any(rs, r => match r { RunnerHostSectionFailed { name: n, exit_code: c } => (n as String) == "runner-extract" && c == "1" _ => false })
+        && any(rs, r => match r { RunnerHostMachineNotAarch64 { observed: o } => (match o { X86_64 => true _ => false }) _ => false })
+    _ => false
+  }
+}
+
+test fn an_open_envelope_refuses_early_on_a_failed_install_and_otherwise_waits() -> Bool {
+  let failed_open = concat(begin_line, section(name: "runner-extract", argv: "(the rendered extract)", body: "tar: Unexpected EOF in archive\n", exit_code: "2"))
+  let held_open = concat(begin_line, section(name: "runner-extract", argv: "(the rendered extract)", body: "", exit_code: "0"))
+  (match readback(capture: failed_open) { Present { value: RunnerHostUpRefused { refusals: _ } } => true _ => false })
+    && (match readback(capture: held_open) { Present { value: RunnerHostUpPending { reason: _ } } => true _ => false })
+}
+
+test fn a_closed_envelope_missing_the_meminfo_section_refuses() -> Bool {
+  let missing = concat(begin_line, section(name: "nproc", argv: "nproc", body: "80\n", exit_code: "0"), end_line)
+  match readback(capture: missing) {
+    Present { value: RunnerHostUpRefused { refusals: rs } } =>
+      any(rs, r => match r { RunnerHostSectionAbsent { name: n } => (n as String) == "meminfo" _ => false })
+    _ => false
+  }
+}
+
+// THE ROUTE: the boot run's terminal verdict, given a subject admitted with the runner medium, reaches
+// runner_host_up_readback -- it accepts the held envelope and refuses the foreign machine with the
+// runner-host cause, which the census predicate (it reads no uname-machine section) could not produce.
+// And the accepted reading survives the delegation and the watch tick WHOLE: the consumer reads the
+// exact idle MemTotal, MemAvailable, thread count and machine from the one accepted boot reading.
+test fn the_boot_run_terminal_verdict_delegates_and_carries_the_whole_reading() -> Bool {
+  match runner_subject() {
+    Absent => false
+    Present { value: s } => {
+      let verdict = mtcollins1_boot_terminal_verdict(capture: closed(install_exit: "0", machine: "aarch64"), subject: s)
+      (match verdict {
+        TerminalRunnerHostAccepted { up: up } => kibibyte_count(k: up.mem_total) == 134217728 && kibibyte_count(k: up.mem_available) == 131000000 && hardware_thread_count_value(t: up.threads) == 80 && (match up.machine { Aarch64 => true _ => false })
+        _ => false
+      })
+        && (match watch_tick(verdict: verdict, channel: SolChannelLive) {
+          WatchRunnerHostAccepted { up: up } => kibibyte_count(k: up.mem_total) == 134217728 && kibibyte_count(k: up.mem_available) == 131000000 && hardware_thread_count_value(t: up.threads) == 80 && (match up.machine { Aarch64 => true _ => false })
+          _ => false
+        })
+        && (match mtcollins1_boot_terminal_verdict(capture: closed(install_exit: "0", machine: "x86_64"), subject: s) {
+          TerminalRefused { causes: cs } => any(cs, c => string_contains(s: mtcollins1_boot_terminal_cause_text(cause: c), pattern: "uname -m read back X86_64"))
+          _ => false
+        })
+    }
+  }
+}
+
+// THE LABEL IS THE ADMITTED SUBJECT'S, NOT A MODULE CONSTANT: a subject admitted with the runner
+// terminal but label OTHER is refused by a capture of this image (whose host lists
+// GUNBC_RUNNER_HOST_2404_3), while the exact-label subject accepts the same capture.
+test fn a_subject_admitted_with_another_label_is_refused_by_this_images_capture() -> Bool {
+  let base = runner_host_boot_medium(output_digest: supplied_digest)
+  let other = BootMedium { image_name: base.image_name, digest: base.digest, export: base.export, terminal: BootMediumRunnerHostUp { label: "OTHER" } }
+  let capture = closed(install_exit: "0", machine: "aarch64")
+  (match subject_with(medium: other) {
+    Present { value: s } => match runner_host_up_readback(capture: capture, subject: s) {
+      RunnerHostUpRefused { refusals: rs } => any(rs, r => match r { RunnerHostLabelAbsent { expected: e, observed: _ } => (e as String) == "OTHER" _ => false })
+      _ => false
+    }
+    Absent => false
+  })
+    && (match readback(capture: capture) { Present { value: RunnerHostUpObserved { up: _ } } => true _ => false })
+}
+
+fn with_artifacts(input: UbuntuSeededInstallMediaBuildInput, artifacts: List<NoCloudSeedArtifact>) -> UbuntuSeededInstallMediaBuildInput {
+  UbuntuSeededInstallMediaBuildInput {
+    stock_artifact: input.stock_artifact,
+    nocloud_dir_on_iso: input.nocloud_dir_on_iso,
+    user_data_body: input.user_data_body,
+    seed_files: input.seed_files,
+    seed_artifacts: artifacts,
+    grub_kernel_cmdline: input.grub_kernel_cmdline,
+    volume_id: input.volume_id,
+    pinned_dates: input.pinned_dates,
+    image_stem: input.image_stem,
+    builder_revision: input.builder_revision,
+  }
+}
+
+// THE ARTIFACT'S DIGEST IS IN THE BUILD KEY AND ITS URL IS NOT: a different tarball is a different
+// image, the same bytes from another URL are the same image. (An input with no artifact keeps its
+// pre-artifact key: the census build key claim in test.claim.mtcollins1_census_medium_readback_witness
+// pins c001ac127d718e72.)
+test fn the_seed_artifact_digest_keys_the_build_and_its_url_does_not() -> Bool {
+  match runner_host_medium_image(host: mtcollins1_runner_host) {
+    RunnerHostMediumImageDerived { input: input, runner: _ } => {
+      let moved = map(input.seed_artifacts, a => NoCloudSeedArtifact { name: a.name, source_url: "https://mirror.invalid/runner.tar.gz", digest: a.digest })
+      let other = map(input.seed_artifacts, a => NoCloudSeedArtifact { name: a.name, source_url: a.source_url, digest: actions_runner_release_2_337_0.digest_x86_64 })
+      let key = seeded_install_media_build_key(input: input) as String
+      key == (seeded_install_media_build_key(input: with_artifacts(input: input, artifacts: moved)) as String)
+        && key != (seeded_install_media_build_key(input: with_artifacts(input: input, artifacts: other)) as String)
+        && key != (seeded_install_media_build_key(input: with_artifacts(input: input, artifacts: [])) as String)
+    }
+    RunnerHostMediumRunnerUnpublished { binary_release: _ } => false
+    RunnerHostMediumUserDataRefused { reason: _ } => false
+  }
+}
+
+// THE ARTIFACT NAME IS ADMITTED BEFORE ANY FETCH (the remaster's fetch takes only an
+// AdmittedSeedArtifact; its real-execution control is test.claim.srv3_seeded_install_media_real_execution).
+// The runner image's own tarball is admitted; an escaping path, the image's own program name, a
+// NoCloud datasource name and a duplicate each refuse with their own cause.
+fn admission_refuses_with(input: UbuntuSeededInstallMediaBuildInput, extra: NoCloudSeedArtifact, cause: String) -> Bool {
+  match seeded_install_media_seed_artifact_admission(input: with_artifacts(input: input, artifacts: append(input.seed_artifacts, items: [extra]))) {
+    SeedArtifactsAdmitted { artifacts: _ } => false
+    SeedArtifactsRefused { refusals: rs } => any(rs, r => match r {
+      SeedArtifactNameNotABasename { name: _ } => cause == "basename"
+      SeedArtifactNameReserved { name: _ } => cause == "reserved"
+      SeedArtifactNameCollidesWithSeedFile { name: _ } => cause == "collides"
+      SeedArtifactNameDuplicated { name: _ } => cause == "duplicated"
+    })
+  }
+}
+
+fn artifact_named(n: String) -> NoCloudSeedArtifact {
+  NoCloudSeedArtifact { name: n as NonEmptyStr, source_url: "https://example.invalid/x", digest: sha256_digest(hex: supplied_digest) }
+}
+
+test fn seed_artifact_names_are_admitted_only_as_fresh_basenames() -> Bool {
+  match runner_host_medium_image(host: mtcollins1_runner_host) {
+    RunnerHostMediumImageDerived { input: input, runner: _ } => {
+      let own = map(input.seed_artifacts, a => a.name as String)
+      (match seeded_install_media_seed_artifact_admission(input: input) {
+        SeedArtifactsAdmitted { artifacts: admitted } => map(admitted, a => a.basename.value as String) == own
+        SeedArtifactsRefused { refusals: _ } => false
+      })
+        && admission_refuses_with(input: input, extra: artifact_named(n: "../../boot/grub/grub.cfg"), cause: "basename")
+        && admission_refuses_with(input: input, extra: artifact_named(n: ".."), cause: "basename")
+        && admission_refuses_with(input: input, extra: artifact_named(n: "runner-host-up.sh"), cause: "collides")
+        && admission_refuses_with(input: input, extra: artifact_named(n: "user-data"), cause: "reserved")
+        && admission_refuses_with(input: input, extra: artifact_named(n: "meta-data"), cause: "reserved")
+        && admission_refuses_with(input: input, extra: artifact_named(n: fold(own, init: "", f: (acc, n) => n)), cause: "duplicated")
+    }
+    RunnerHostMediumRunnerUnpublished { binary_release: _ } => false
+    RunnerHostMediumUserDataRefused { reason: _ } => false
+  }
+}
+
+fn reading_is_the_capture(up: RunnerHostUp) -> Bool {
+  kibibyte_count(k: up.mem_total) == 134217728 && kibibyte_count(k: up.mem_available) == 131000000 && hardware_thread_count_value(t: up.threads) == 80 && (match up.machine { Aarch64 => true _ => false })
+}
+
+fn through(subject: AdmittedBootSubject, reading: RunnerHostUp?) -> RunnerHostUp? {
+  let watch = TerminalWatch { outcome: ExitSuccess, census_ended: false, smpro_census: SmproNotTaken { reason: "supplied" }, screen_reported: [], runner_host: reading }
+  let aw = actuation_watch_of(watch: watch, selection: subject.selection, at_power_on: SmproNotTaken { reason: "supplied" }, smpro_read: UptimeRefused { detail: "supplied" }, terminal_read: UptimeRefused { detail: "supplied" })
+  let base = actuation_not_powered_on(outcome: aw.outcome, reason: "supplied")
+  let act = actuation_after_watch(observed: aw, media: base.media, handoff_media: base.handoff_media, end_media: base.end_media, override_before: base.override_before, override_after: base.override_after, power_after: base.power_after, outcome: aw.outcome, screen: base.screen, timing: base.timing)
+  let held = actuation_with_outcome(act: act, outcome: ExitSuccess)
+  mtcollins1_boot_attempt_of(act: held, bmc: BmcAccessNotReached { reason: "supplied" }, configuration: attempt_configuration_not_recorded(host: "mtcollins1", attempt: "supplied", reason: "supplied")).runner_host
+}
+
+// THE READING REACHES THE COMPLETED ATTEMPT, through every real post-watch projection the production
+// path calls -- actuation_watch_of, actuation_after_watch (mtcollins1_boot_actuate), actuation_with_outcome
+// (mtcollins1_boot_actuate_held) and mtcollins1_boot_attempt_of -- so dropping the reading in any of them
+// turns this red, and
+// GuestIdleMeminfoAndNproc reads all four values off MtCollins1BootAttempt. A watch that accepted no
+// runner host carries none all the way through.
+test fn the_accepted_reading_reaches_the_boot_attempt_result() -> Bool {
+  match runner_subject() {
+    Absent => false
+    Present { value: s } =>
+      match watch_tick(verdict: mtcollins1_boot_terminal_verdict(capture: closed(install_exit: "0", machine: "aarch64"), subject: s), channel: SolChannelLive) {
+        WatchRunnerHostAccepted { up: up } => {
+          (match through(subject: s, reading: Present { value: up }) { Present { value: r } => reading_is_the_capture(up: r) Absent => false })
+            && (match through(subject: s, reading: none) { Absent => true Present { value: _ } => false })
+        }
+        _ => false
+      }
+  }
+}
+
+// THE TARBALL'S DIGEST IS EVIDENCE THE PREDICATE JUDGES, NOT A SHELL GATE: a capture whose
+// runner-tarball-digest section reads another sha256 (here the x86_64 tarball's) refuses with the typed
+// cause naming both digests, even though every install section exited 0.
+test fn a_tarball_that_reads_back_another_digest_refuses_the_terminal() -> Bool {
+  let wrong = actions_runner_release_2_337_0.digest_x86_64.hex as String
+  match readback(capture: concat(begin_line, sections_with_digest(install_exit: "0", machine: "aarch64", tarball_digest: wrong), end_line)) {
+    Present { value: RunnerHostUpRefused { refusals: rs } } =>
+      any(rs, r => match r { RunnerHostTarballDigestDiffers { expected: e, observed: o } => o == wrong && (e as String) == (actions_runner_release_2_337_0.digest_aarch64.hex as String) _ => false })
+    _ => false
+  }
+}
+
+// THE MACHINE IS PARSED AT THE uname BOUNDARY: a spelling the Linux projection does not cite refuses
+// as unrecognized rather than being compared as a string.
+test fn an_unrecognized_machine_spelling_refuses_as_unrecognized() -> Bool {
+  match readback(capture: closed(install_exit: "0", machine: "arm64")) {
+    Present { value: RunnerHostUpRefused { refusals: rs } } =>
+      any(rs, r => match r { RunnerHostMachineUnrecognized { observed: o } => o == "arm64" _ => false })
+    _ => false
+  }
+}
+
+// THE PIN CARRIES ITS ALGORITHM: the same hex under Sha512 is another artifact (another build key) and
+// can never satisfy the sha256sum readback, while a Sha256 pin holds only on its own hex.
+test fn a_seed_artifact_pin_is_judged_with_its_algorithm_not_by_hex_alone() -> Bool {
+  match runner_host_medium_image(host: mtcollins1_runner_host) {
+    RunnerHostMediumImageDerived { input: input, runner: _ } => {
+      let hex = actions_runner_release_2_337_0.digest_aarch64.hex
+      let as_512 = map(input.seed_artifacts, a => NoCloudSeedArtifact { name: a.name, source_url: a.source_url, digest: sha512_digest(hex: hex) })
+      (seeded_install_media_build_key(input: input) as String) != (seeded_install_media_build_key(input: with_artifacts(input: input, artifacts: as_512)) as String)
+        && seed_artifact_readback_holds(read_back_sha256_hex: hex as String, pin: sha256_digest(hex: hex))
+        && !seed_artifact_readback_holds(read_back_sha256_hex: hex as String, pin: sha512_digest(hex: hex))
+        && !seed_artifact_readback_holds(read_back_sha256_hex: supplied_digest as String, pin: sha256_digest(hex: hex))
+    }
+    RunnerHostMediumRunnerUnpublished { binary_release: _ } => false
+    RunnerHostMediumUserDataRefused { reason: _ } => false
+  }
+}
diff --git a/dag/test/claim/runner/runner_microvm_network_apply_witness_test.dag b/dag/test/claim/runner/runner_microvm_network_apply_witness_test.dag
index 50289b2a590..4630235326a 100644
--- a/dag/test/claim/runner/runner_microvm_network_apply_witness_test.dag
+++ b/dag/test/claim/runner/runner_microvm_network_apply_witness_test.dag
@@ -6,7 +6,7 @@ import gunbc.fleet_host_identity { operator_host_srv1 }
 import gunbc.runner_microvm_network_converge { runner_microvm_staging_dir }
 import gunbc.runner_microvm_network_apply {
   MicrovmNetworkApplyAdmission, MicrovmNetworkApplyAdmitted, MicrovmNetworkApplyRefused,
-  microvm_network_apply_admission, staging_ancestor_paths,
+  microvm_network_apply_admission, microvm_network_local_admission, staging_ancestor_paths,
   path_metadata_ok,
   OperationResult, ApplyLeg, ApplyLegRan, ApplyLegRefused, operation_result_ok,
   runner_microvm_root_only_probe_argv,
@@ -148,3 +148,17 @@ test fn the_root_only_probe_is_elevated_and_keeps_its_predicate() -> Bool {
     "-maxdepth", "0", "-type", "f", "-user", "root", "-group", "root", "-not", "-perm", "/022",
   ]
 }
+
+
+test fn local_network_apply_requires_root_on_the_selected_host() -> Bool {
+  admitted(a: microvm_network_local_admission(host: "srv1", observed_host: "srv1", effective_uid: "0",
+    expected_revision: a_revision, checked_out_revision: a_revision))
+    && !admitted(a: microvm_network_local_admission(host: "srv1", observed_host: "srv2", effective_uid: "0",
+      expected_revision: a_revision, checked_out_revision: a_revision))
+    && !admitted(a: microvm_network_local_admission(host: "srv1", observed_host: "srv1", effective_uid: "999",
+      expected_revision: a_revision, checked_out_revision: a_revision))
+    && !admitted(a: microvm_network_local_admission(host: "srv1", observed_host: "srv1", effective_uid: "",
+      expected_revision: a_revision, checked_out_revision: a_revision))
+    && !admitted(a: microvm_network_local_admission(host: "srv1", observed_host: "srv1", effective_uid: "0",
+      expected_revision: a_revision, checked_out_revision: another_revision))
+}
diff --git a/dag/test/claim/runner/runner_microvm_network_converge_witness_test.dag b/dag/test/claim/runner/runner_microvm_network_converge_witness_test.dag
index b090ea28346..fd144807697 100644
--- a/dag/test/claim/runner/runner_microvm_network_converge_witness_test.dag
+++ b/dag/test/claim/runner/runner_microvm_network_converge_witness_test.dag
@@ -383,3 +383,14 @@ test fn a_probe_that_did_not_answer_refuses_under_its_own_name() -> Bool {
     && outcome_label(o: converge_outcome(slots: [unread_route], h: clean_host())) == "route-unread"
     && outcome_label(o: converge_outcome(slots: [clean_slot(i: 1)], h: host_with(fwd: IpForwardOff, digest: Present { value: converged_digest }, auto: kernel_absent()))) == "no-forwarding"
 }
+
+
+// networkd must not re-enable IPv6 after sysctl has disabled it on the TAP.
+test fn staged_tap_policy_disables_networkd_ipv6_autoconfiguration() -> Bool {
+  let files = converge_staged_files(slots: [slot(i: 13)], host: runner_microvm_shared_host_grain, tap_owner: "ghrunner")
+  any(files, file => file.path == "/var/lib/gunbc-microvm-network-stage/gunbc-tap13.network"
+    && string_contains(s: file.content, pattern: "LinkLocalAddressing=no\n")
+    && string_contains(s: file.content, pattern: "IPv6AcceptRA=no\n"))
+    && any(files, file => file.path == "/var/lib/gunbc-microvm-network-stage/gunbc-tap13-ipv6.conf"
+      && string_contains(s: file.content, pattern: "disable_ipv6 = 1"))
+}
diff --git a/dag/test/claim/runner/runner_microvm_shakedown_workflow_witness_test.dag b/dag/test/claim/runner/runner_microvm_shakedown_workflow_witness_test.dag
index 2901a28ab83..d64c5486412 100644
--- a/dag/test/claim/runner/runner_microvm_shakedown_workflow_witness_test.dag
+++ b/dag/test/claim/runner/runner_microvm_shakedown_workflow_witness_test.dag
@@ -12,7 +12,7 @@ import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
 // THE JOB ASKS FOR EXACTLY THE SHAPE THE MINT REGISTERS: the provenance label and one attempt label,
-// in that order and nothing else. gunbc.runner_jit_mint microvm_attempt_registration_labels mints
+// in that order and nothing else. gunbc.runner.jit_registration_subject microvm_attempt_registration_labels mints
 // [self-hosted, <attempt name>]; a runs-on carrying any further label (linux, arm64, a host) would
 // ask for a label the guest does not carry and queue forever, and one carrying fewer would let any
 // self-hosted runner take the job.
@@ -20,8 +20,14 @@ test fn the_shakedown_job_asks_for_the_provenance_label_and_the_attempt_alone()
   match microvm_shakedown_job(script: "").runner {
     SelfHosted { labels: ls } =>
       count(ls) == 2
-        && ls[0] == self_hosted_provenance_label
-        && ls[1] == microvm_shakedown_attempt_expression()
+        && match ls[0] {
+          Present { value: l } => l == self_hosted_provenance_label
+          Absent => false
+        }
+        && match ls[1] {
+          Present { value: l } => l == microvm_shakedown_attempt_expression()
+          Absent => false
+        }
     _ => false
   }
 }
diff --git a/dag/test/claim/runner/runner_microvm_slot_controller_witness_test.dag b/dag/test/claim/runner/runner_microvm_slot_controller_witness_test.dag
index 58a8cd86699..5e02dcb9c15 100644
--- a/dag/test/claim/runner/runner_microvm_slot_controller_witness_test.dag
+++ b/dag/test/claim/runner/runner_microvm_slot_controller_witness_test.dag
@@ -1,5 +1,11 @@
 module test.claim.runner.runner_microvm_slot_controller_witness_test
 
+import gunbc.runner.runner_jit_perform { JitMintDispatchAuthorized, JitMintDispatchRefused, dispatch_jit_mint, receive_jit_mint }
+import gunbc.runner.jit_registration_subject { microvm_registration_subject }
+import gunbc.runner_microvm_attempt { bind_owned_attempt }
+import gunbc.runner.runner_jit_admission { jit_admission_axis_standing, AttemptBindingAxis }
+import test.claim.github_app_registry { app_credential, observed_grant, runner_grant, gunbai_org_ref, restricted_group_1 }
+import extdeps.github.actions_jit_runner { jit_config_mint_outcome }
 import v2.std.algebra { any }
 import std.algebra { list_append }
 import std.types { String, NonEmptyStr, Bool, Int, List }
@@ -49,8 +55,9 @@ import gunbc.runner_microvm_slot_controller { slot_of_instance, minted_registrat
 import gunbc.fabric_required_build_cell { ReservationUnreadable, ReservationPayloadUndecodable }
 import std.durable_compare_and_set { CasUnreadableReadRefused }
 import gunbc.github_effect_perform { JitMintReceived, JitMintClockUnread }
-import gunbc.runner_jit_mint { MicroVmJitSlot }
-import gunbc.runner.runner_jit_perform { JitCredentialBoundToAttempt, JitCredentialMintNotCreated, JitCredentialNotDispatched, DispatchRefusedCellNotOwned }
+import gunbc.runner.jit_registration_subject { microvm_registration_subject_of }
+import gunbc.runner.runner_jit_perform { JitCredentialBoundToAttempt, JitCredentialMintNotCreated, JitCredentialNotDispatched, DispatchRefusedSubject }
+import gunbc.runner.jit_registration_subject { SubjectCellNotOwned }
 import extdeps.github.actions_jit_runner { jit_config_mint_outcome, JitConfigMinted }
 import gunbc.live_deploy.emit { microvm_slot_unit_file_with_workspace_root }
 import gunbc.cli_run_workspace_root_scaffold { gunbc_workspace_root_env_name }
@@ -297,8 +304,22 @@ fn delivered_mint() -> Bool {
     Absent => false
     Present { value: a } =>
       match jit_config_mint_outcome(status: 201, encoded: "ZmFrZS1qaXQtY29uZmlnLXRoYXQtaXMtbG9uZy1lbm91Z2gtdG8tcGFzcy10aGUtZmxvb3ItY2hlY2stZm9yLXRoZS13aXRuZXNz", runner_id: 4242, error_body: "") {
-        JitConfigMinted { config: c, runner_id: id } =>
-          minted_registration(mint: JitMintReceived { delivery: JitCredentialBoundToAttempt { slot: MicroVmJitSlot { attempt: a }, credential: c, runner_id: id } }) == Present { value: 4242 }
+        JitConfigMinted { config: _, runner_id: _ } =>
+          match dispatch_jit_mint(
+      subject: microvm_registration_subject(binding: bind_owned_attempt(attempt: a, owned: true)),
+      authority: app_credential,
+      control_plane: observed_grant(perms: runner_grant),
+      organization: gunbai_org_ref,
+      runner_group: restricted_group_1(),
+      attempt_binding: jit_admission_axis_standing(axis: AttemptBindingAxis),
+    ) {
+            JitMintDispatchAuthorized { dispatch: d } =>
+              minted_registration(mint: JitMintReceived { delivery: receive_jit_mint(
+                dispatch: JitMintDispatchAuthorized { dispatch: d },
+                outcome: jit_config_mint_outcome(status: 201, encoded: "ZmFrZS1qaXQtY29uZmlnLXRoYXQtaXMtbG9uZy1lbm91Z2gtdG8tcGFzcy10aGUtZmxvb3ItY2hlY2stZm9yLXRoZS13aXRuZXNz", runner_id: 4242, error_body: ""),
+              ) }) == Present { value: 4242 }
+            JitMintDispatchRefused { refusal: _ } => false
+          }
         _ => false
       }
   }
@@ -307,7 +328,7 @@ fn delivered_mint() -> Bool {
 test fn only_a_delivered_mint_carries_a_registration_into_the_controller() -> Bool {
   delivered_mint()
     && minted_registration(mint: JitMintReceived { delivery: JitCredentialMintNotCreated { outcome: jit_config_mint_outcome(status: 409, encoded: "", runner_id: 0, error_body: "taken") } }) == none
-    && minted_registration(mint: JitMintReceived { delivery: JitCredentialNotDispatched { refusal: DispatchRefusedCellNotOwned { cause: "unowned" } } }) == none
+    && minted_registration(mint: JitMintReceived { delivery: JitCredentialNotDispatched { refusal: DispatchRefusedSubject { refusal: SubjectCellNotOwned { cause: "unowned" } } } }) == none
     && minted_registration(mint: JitMintClockUnread { detail: "no clock" }) == none
 }
 
diff --git a/dag/test/claim/runner/runner_qualification_delivery_rewrap_witness_test.dag b/dag/test/claim/runner/runner_qualification_delivery_rewrap_witness_test.dag
new file mode 100644
index 00000000000..a6994244df9
--- /dev/null
+++ b/dag/test/claim/runner/runner_qualification_delivery_rewrap_witness_test.dag
@@ -0,0 +1,77 @@
+module test.claim.runner_qualification_delivery_rewrap_witness
+
+import std.types { String, Bool, Int }
+import extdeps.filesystem.filesystem_io
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
+import gunbc.compile_diagnostic_census {
+  CompileDiagnosticCensus, CompileDiagnosticCensusRow, CensusObserved, CensusNotRunnable,
+}
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
+
+// THE REWRAP ROUTE, ENROLLED AS AN EXECUTED RED (DESIGN 4b: a state unrepresentable in the accepted
+// corpus is still representable as source handed to the compiler). test.probe.qualification_delivery_
+// rewrap_probe relabels delivery B's credential and runner id as dispatch A's; it must refuse at
+// BoundJitCredential, the sealed carrier receive_jit_mint alone constructs, so no
+// QualificationDispatchSubject can ever be built over a rewrapped delivery. A control source that only
+// NAMES the same types must refuse at none of them, so the refusal is attributable to the forgery.
+
+fn census_of(source: String) -> CompileDiagnosticCensus {
+  compile_dag_diagnostic_census(source)
+}
+
+fn blocking(c: CompileDiagnosticCensus, wanted: String, subject: String) -> Int {
+  match c {
+    CensusNotRunnable { cause: _ } => -1
+    CensusObserved { rows: rows } =>
+      rows
+        |> filter(r => (r.diagnostic_class as String) == wanted && r.subject_name == subject && r.blocking)
+        |> fold(init: 0, f: (acc, r) => acc + r.count)
+  }
+}
+
+data control_source: String = "module probe_qualification_delivery_control\nimport std.types { Bool }\nimport gunbc.runner.runner_jit_perform { BoundJitCredential, JitCredentialDelivery, JitCredentialBoundToAttempt, jit_credential_delivered, receive_jit_mint }\nimport gunbc.github_effect_perform { jit_mint_performance_of_generate }\nimport gunbc.runner.runner_qualification_dispatch { CollectedQualificationRun }\nfn delivered(d: JitCredentialDelivery) -> Bool { jit_credential_delivered(delivery: d) }\n"
+
+fn blocking_class(c: CompileDiagnosticCensus, wanted: String) -> Int {
+  match c {
+    CensusNotRunnable { cause: _ } => -1
+    CensusObserved { rows: rows } =>
+      rows
+        |> filter(r => (r.diagnostic_class as String) == wanted && r.blocking)
+        |> fold(init: 0, f: (acc, r) => acc + r.count)
+  }
+}
+
+fn probe(name: String) -> CompileDiagnosticCensus {
+  census_of(source: filesystem_read(path: concat(concat("dag/test/probe/", name), ".dag")).content)
+}
+
+// ONE CONTROL FOR EVERY RED BELOW: a source that IMPORTS each sealed name -- the carriers and the two
+// admitted mints -- and calls none of them refuses at none of the walls, so each red is the call or
+// the literal, never the import.
+test fn a_source_that_only_names_the_carrier_forges_nothing() -> Bool {
+  let c = census_of(source: control_source)
+  blocking(c: c, wanted: "SoleConstructorViolation", subject: "BoundJitCredential") == 0
+    && blocking_class(c: c, wanted: "SoleConstructorViolation") == 0
+    && blocking_class(c: c, wanted: "ConstructorCallAdmissionRefused") == 0
+}
+
+// THE REWRAP WITH NO FORGED LITERAL (review 5408711178 item 1): delivery B's credential and runner id
+// handed to receive_jit_mint under dispatch A. Each probe holds ONE route, so its refusal is that
+// route's.
+test fn a_rewrap_through_receive_jit_mint_refuses_at_its_admission() -> Bool {
+  blocking_class(c: probe(name: "qualification_receive_jit_mint_rewrap_probe"), wanted: "ConstructorCallAdmissionRefused") >= 1
+}
+
+test fn a_supplied_generate_answer_refuses_outside_the_perform_function() -> Bool {
+  blocking_class(c: probe(name: "qualification_generate_answer_rewrap_probe"), wanted: "ConstructorCallAdmissionRefused") >= 1
+}
+
+// item 2: collecting outside the token join is minting a collection the join never admitted.
+test fn a_collection_minted_outside_the_token_join_refuses_at_the_sealed_carrier() -> Bool {
+  blocking(c: probe(name: "qualification_collection_relabel_probe"), wanted: "SoleConstructorViolation", subject: "CollectedQualificationRun") >= 1
+}
+
+test fn a_rewrapped_delivery_refuses_at_the_sealed_carrier() -> Bool {
+  blocking(c: census_of(source: filesystem_read(path: "dag/test/probe/qualification_delivery_rewrap_probe.dag").content), wanted: "SoleConstructorViolation", subject: "BoundJitCredential") >= 1
+}
diff --git a/dag/test/claim/runner/runner_qualification_dispatch_witness_test.dag b/dag/test/claim/runner/runner_qualification_dispatch_witness_test.dag
new file mode 100644
index 00000000000..d7eaa7c9fd6
--- /dev/null
+++ b/dag/test/claim/runner/runner_qualification_dispatch_witness_test.dag
@@ -0,0 +1,911 @@
+module test.claim.runner_qualification_dispatch_witness
+
+import std.types { Bool, Bytes, CommitSha, Int, List, NonEmptyStr, String }
+import std.bytes { utf8_encode_bytes }
+import std.algebra { Cons, Empty }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import product.placement_supply { HostIdentity }
+import extdeps.transports.rest {
+  RestResult, RestAnswered, RestRefused, RestRefusal, RestTransportRefused, RestStatusRefused, RestBodyUndecodable,
+  RestExchangeStatusRefused, RestExchangeUnreached, RestExchangeUndecodable,
+}
+import extdeps.github.workflows { WorkflowDispatchReceipt }
+import extdeps.github.git_database { GitRefWire, GitRefObjectWire }
+import extdeps.github.actions { Workflow, Job, WorkflowDispatch, RunsOnExpression, SelfHosted, RunnerSpec, Step, RunStep, UsesStep }
+import extdeps.github.effect { DispatchWorkflow, GitHubOrganizationRef }
+import extdeps.github.workflow_runs {
+  WorkflowRun, WorkflowJobRun, WorkflowJobRunList, Completed, InProgress, Success, Failure,
+}
+import gunbc.managed_host { managed_hosts, managed_host_binding }
+import gunbc.runner.runner_host_unit_slot { host_unit_slot_for, HostUnitSlot, HostUnitSlotStanding, HostUnitSlotBound, HostUnitSlotRefused }
+import gunbc.runner.jit_registration_subject { host_unit_registration_subject }
+import gunbc.runner.runner_jit_admission { jit_admission_axis_standing, AttemptBindingAxis }
+import gunbc.runner.runner_jit_perform { JitMintDispatchAuthorized, JitMintDispatchRefused, dispatch_jit_mint, receive_jit_mint }
+import gunbc.runner_throughput_qualification_route { ephemeral_slot_labels, ephemeral_slot_unit, qualification_instruments, FloorPhaseRows, FloorCgroupRows }
+import test.claim.github_app_registry {
+  app_credential, other_app_credential, other_installation_credential, a_pull_request_job_credential,
+  bot_installation_id, other_installation_id, observed_grant, runner_grant, gunbai_org_ref, group_restricted_to, minted_outcome,
+}
+import gunbc.auth.github_apps { gunbai_bot_declared, gunbai_ci_declared }
+import gunbc.runner_group_restriction_observation { MicrovmRunnerGroupStanding, observe_runner_group_restriction }
+import gunbc.fleet.org_actions_inspection { runner_groups_of_rest_read }
+import extdeps.github.org_actions { OrgRunnerGroupWire, OrgRunnerGroupListWire }
+import gunbc.runner.runner_qualification_ref_pin {
+  qualification_selected_workflow, qualification_workflow_path, qualification_branch_name, QualificationBranchNamed, QualificationBranchNameRefused,
+  qualification_ref_pin_of, QualificationRefPinned, QualificationRefPinRefused,
+}
+import gunbc.runner.runner_qualification_dispatch {
+  qualification_attempt_dispatch_input, qualification_revision_dispatch_input, qualification_dispatch_inputs, qualification_dispatch_effect,
+  qualification_floor_revision_guard_step, SubjectFloorRevisionGuardNotFirst, SubjectFloorStepRunsPastTheGuard,
+  QualificationSubjectAdmitted, QualificationSubjectRefused,
+  SubjectSlotForAnotherWorkflow, SubjectAttemptInputUndeclared, SubjectFloorJobAbsent, SubjectFloorRunsOnNotTheAttemptInput,
+  SubjectFloorNameNotUnique, SubjectDeliveryForAnotherDispatch,
+  dispatch_authority_refusal, DispatchAuthorityForAnotherInstallation, DispatchAuthorityNotAnInstallation,
+  qualification_dispatch_subject, qualification_dispatch_subject_over,
+  qualification_slot_refusal, qualification_floor_admission, QualificationFloorAdmitted, QualificationFloorRefused,
+  qualification_run_expectation, QualificationRunExpectation,
+  qualification_dispatch_standing, QualificationDispatchStanding,
+  DispatchStandingSucceeded, DispatchStandingRefused, DispatchStandingCommitAmbiguous,
+  hold_covers_slot_host, token_names_registration,
+  plan_qualification_collection, planned_collection_reads, CollectionRefusedBeforeAnyRead,
+  ReadQualificationRun, ReadQualificationAttemptJobs, RunCollectedUnderAnotherInstallation,
+  decide_qualification_run, QualificationRunVerdict, RunVerdictCollected, RunVerdictRefused,
+  RunReadUnreadable, RunSubjectMismatch, RunAdvancedPastDispatchedAttempt, RunRevisionNotPinned, RunOnAnotherBranch, RunNotCompleted,
+  RunCompletedWithoutConclusion, RunJobsUnreadable, RunJobsTruncated, RunFloorJobNotUnique,
+  RunNeverReachedAttemptRunner, RunRunnerNameDisagrees, RunRegisteredRunnerRanAnotherJob, RunFloorJobNotStarted,
+  AttemptJobLog, AttemptJobLogRead, AttemptJobLogUnreadable,
+  DesignatedJobLog, DesignatedJobLogText, DesignatedJobLogRefused, designated_job_log,
+  JobLogReadRefusal, JobLogOfAnotherJob, JobLogUnreadable, JobLogEmpty,
+  JobLogInstrumentDecode, JobLogInstrumentsDecoded, JobLogInstrumentsUndecodable, decode_job_log_instruments,
+  QualificationLogReadings, InstrumentReadRefusal, FloorPhaseRowGarbledInLog, FloorCgroupRowGarbledInLog,
+  FloorPhaseRowsAbsent, SlotCgroupLevelAbsent,
+  qualification_instrument_read_from_job_log, qualification_instrument_extraction_frontier_rows,
+  ClaimCostArtifactRead, ClaimCostArtifactAbsent, ClaimCostArtifactExpired, ClaimCostArtifactListTruncated,
+  ClaimCostArchiveUnreadable, ClaimCostArchiveNotInflatable,
+  conclude_claim_cost_listing, conclude_claim_cost_download, conclude_claim_cost_attempt,
+  collect_read_plan, collect_read_plan_reads, CollectReadsRefused, CollectReadsPlanned,
+  ClaimCostArtifactAmbiguous, ClaimCostRunAdvancedPastAttempt, ClaimCostRunUnreadable,
+}
+import gunbc.required_ci_phase_roster { FloorPhaseTimed, FloorPhaseUntimed }
+import extdeps.linux.cgroup_v2_memory { CgroupMemoryLimited }
+import std.measure { byte_size_count, millisecond_count }
+import extdeps.github.actions_artifacts { ActionsArtifact, ActionsArtifactList }
+import test.fixture.recorded_required_floor_log_excerpt {
+  recorded_required_floor_log_excerpt, recorded_floor_log_slot_unit,
+}
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+data attempt: NonEmptyStr = "q-1"
+data pin_branch: NonEmptyStr = "qualification/q-1"
+data revision: CommitSha = "1111111111111111111111111111111111111111"
+data floor_job_id: NonEmptyStr = "qualification-floor"
+data registered_runner: NonEmptyStr = "gunbc-qualification-fixture-q-1.service"
+data registered_runner_id: Int = 4242
+
+// DESIGN section 3, A WITNESS DISCRIMINATES AT ONE INTERFACE. Every claim but one supplies its
+// inputs as values at the interface it judges: the pure scope checks (qualification_slot_refusal,
+// qualification_floor_admission), the dispatch standing, the hold comparison, and the run decision
+// over a supplied QualificationRunExpectation. The pairing obligation is discharged by ONE claim that
+// runs the real path: the route's JIT mint over the real managed-host roster, the sealed subject
+// mint over a supplied floor workflow, and the expectation derived from that subject.
+
+// A group standing for the dedicated name under another id, through the same sealed observer.
+fn group_with_id(id: Int, workflow: NonEmptyStr) -> MicrovmRunnerGroupStanding {
+  observe_runner_group_restriction(
+    name: "runner-qualification",
+    selected_workflow: workflow,
+    listed: runner_groups_of_rest_read(outcome: RestAnswered { answer: OrgRunnerGroupListWire {
+      total_count: 1,
+      runner_groups: [OrgRunnerGroupWire {
+        id: id,
+        name: "runner-qualification",
+        visibility: "selected",
+        allows_public_repositories: false,
+        restricted_to_workflows: true,
+        selected_workflows: [workflow as String],
+        workflow_restrictions_read_only: false,
+      }],
+    } }),
+  )
+}
+
+fn floor_job(runs_on: RunnerSpec) -> Job {
+  floor_job_with_steps(runs_on: runs_on, steps: [qualification_floor_revision_guard_step(), floor_work_step(if_condition: none)])
+}
+
+fn floor_work_step(if_condition: String?) -> Step {
+  RunStep {
+    name: Present { value: "run the floor" }, id: none, run: "claim_executor --required-ci",
+    shell: none, env: none, working_directory: none, if_condition: if_condition, continue_on_error: none, timeout_minutes: none,
+  }
+}
+
+fn floor_job_with_steps(runs_on: RunnerSpec, steps: List<Step>) -> Job {
+  Job {
+    id: floor_job_id as String,
+    name: Present { value: "qualification floor" },
+    runner: runs_on,
+    environment: none,
+    steps: steps,
+    needs: [],
+    env: none,
+    outputs: none,
+    if_condition: none,
+    timeout_minutes: none,
+    continue_on_error: none,
+    concurrency: none,
+    permissions: none,
+  }
+}
+
+data attempt_runs_on: RunnerSpec = RunsOnExpression { expression: "${{ inputs.runner_attempt_label }}" }
+
+fn workflow_with(declares_input: Bool, runs_on: RunnerSpec) -> Workflow {
+  Workflow {
+    name: "fleet-converge",
+    run_name: none,
+    on: [WorkflowDispatch { inputs: if declares_input { [qualification_attempt_dispatch_input, qualification_revision_dispatch_input] } else { [qualification_revision_dispatch_input] } }],
+    concurrency: none,
+    jobs: [floor_job(runs_on: runs_on)],
+    env: none,
+    permissions: none,
+  }
+}
+
+// ── THE ONE REAL-PATH CLAIM ─────────────────────────────────────────────────────────────────────
+// The route's own JIT mint over the first real managed host, delivered through upstream's 201 fold;
+// the sealed subject over a floor workflow carries the slot's attempt and host, the registration's
+// minted name (ephemeral_slot_unit), and the floor job's name; the dispatch sends exactly the declared
+// input with a label the slot registered; the effect names fleet-converge.yml in gunbc_repository at
+// the pinned revision; the expectation the collection judges against is derived from that subject.
+test fn the_real_mint_admits_the_attempt_through_the_sealed_subject() -> Bool {
+  match first(managed_hosts()) {
+    Present { value: h } =>
+      match unit_slot_of(standing: host_unit_slot_for(host: managed_host_binding(host: h), attempt: attempt, workflow: qualification_selected_workflow(branch: pin_branch))) {
+      Absent => false
+      Present { value: slot } =>
+      match dispatch_jit_mint(
+        subject: host_unit_registration_subject(standing: host_unit_slot_for(host: managed_host_binding(host: h), attempt: attempt, workflow: qualification_selected_workflow(branch: pin_branch))),
+        authority: app_credential,
+        control_plane: observed_grant(perms: runner_grant),
+        organization: gunbai_org_ref,
+        runner_group: group_restricted_to(workflow: qualification_selected_workflow(branch: pin_branch)),
+        attempt_binding: jit_admission_axis_standing(axis: AttemptBindingAxis),
+      ) {
+        JitMintDispatchAuthorized { dispatch: d } => match qualification_branch_name(attempt: attempt) {
+          QualificationBranchNameRefused { attempt: _, cause: _ } => false
+          QualificationBranchNamed { name: nm } =>
+            match qualification_ref_pin_of(
+              name: nm, revision: revision, readback: RestAnswered { answer: GitRefWire { ref: "refs/heads/qualification/q-1", object: GitRefObjectWire { type: "commit", sha: revision as String } } },
+              group: group_restricted_to(workflow: qualification_selected_workflow(branch: pin_branch)),
+            ) {
+              QualificationRefPinRefused { attempt: _, refusal: _ } => false
+              QualificationRefPinned { pin: p } =>
+  {
+          let delivered = receive_jit_mint(dispatch: JitMintDispatchAuthorized { dispatch: d }, outcome: minted_outcome)
+          (match qualification_dispatch_subject_over(
+            dispatch: d, slot: slot, delivery: delivered,
+            workflow: workflow_with(declares_input: true, runs_on: attempt_runs_on), floor_job_id: floor_job_id, pin: p,
+          ) {
+            QualificationSubjectAdmitted { subject: s } => {
+              let expected = qualification_run_expectation(subject: s)
+              s.attempt == attempt
+                && s.runner_id == registered_runner_id && expected.registered_runner_id == registered_runner_id
+                && token_names_registration(token_app: s.registration.app, token_installation: s.registration.installation, subject: s)
+                && !token_names_registration(token_app: gunbai_ci_declared, token_installation: s.registration.installation, subject: s)
+                && !token_names_registration(token_app: s.registration.app, token_installation: other_installation_id, subject: s)
+                && count(collect_read_plan_reads(plan: collect_read_plan(subject: s, token_app: gunbai_ci_declared, token_installation: s.registration.installation, floor_job_id: 501, run_id: 77))) == 0
+                && count(collect_read_plan_reads(plan: collect_read_plan(subject: s, token_app: s.registration.app, token_installation: other_installation_id, floor_job_id: 501, run_id: 77))) == 0
+                && (match collect_read_plan(subject: s, token_app: gunbai_ci_declared, token_installation: s.registration.installation, floor_job_id: 501, run_id: 77) {
+                  CollectReadsRefused { token_app: _, token_installation: _ } => true
+                  CollectReadsPlanned { job_id: _, run_id: _ } => false
+                })
+                && (match collect_read_plan(subject: s, token_app: s.registration.app, token_installation: s.registration.installation, floor_job_id: 501, run_id: 77) {
+                  CollectReadsPlanned { job_id: 501, run_id: 77 } => true
+                  _ => false
+                })
+                && count(planned_collection_reads(plan: plan_qualification_collection(subject: s, run_id: 77, token_app: gunbai_ci_declared, token_installation: s.registration.installation))) == 0
+                && count(planned_collection_reads(plan: plan_qualification_collection(subject: s, run_id: 77, token_app: s.registration.app, token_installation: other_installation_id))) == 0
+                && (match plan_qualification_collection(subject: s, run_id: 77, token_app: gunbai_ci_declared, token_installation: s.registration.installation) {
+                  CollectionRefusedBeforeAnyRead { refusal: RunCollectedUnderAnotherInstallation { token_app: a, token_installation: _ } } => a == gunbai_ci_declared
+                  _ => false
+                })
+                && (match planned_collection_reads(plan: plan_qualification_collection(subject: s, run_id: 77, token_app: s.registration.app, token_installation: s.registration.installation)) {
+                  Cons { head: ReadQualificationRun { run_id: 77 }, tail: Cons { head: ReadQualificationAttemptJobs { run_id: 77, attempt: 1 }, tail: Empty {} } } => true
+                  _ => false
+                })
+                && (s.host as String) == (h.host as String)
+                && (expected.registered_runner as String) == (ephemeral_slot_unit(host: h.host, attempt: attempt) as String)
+                && (expected.floor_job_name as String) == "qualification floor"
+                && (expected.revision as String) == (revision as String)
+                && count(map_keys(qualification_dispatch_inputs(attempt: s.attempt, revision: s.pin.revision))) == 2
+                && (match map_get(qualification_dispatch_inputs(attempt: s.attempt, revision: s.pin.revision), qualification_revision_dispatch_input.name) {
+                  Present { value: v } => v == (revision as String)
+                  Absent => false
+                })
+                && (match map_get(qualification_dispatch_inputs(attempt: s.attempt, revision: s.pin.revision), qualification_attempt_dispatch_input.name) {
+                  Present { value: v } => v == (attempt as String) && (ephemeral_slot_labels(host: h.host, attempt: attempt) |> any(l => l == v))
+                  Absent => false
+                })
+                && (match qualification_dispatch_effect(subject: s) {
+                  DispatchWorkflow { repository: r, workflow: w, subject: sha } =>
+                    r.full_name == "gunb-ai/gunbc" && (w.file_name as String) == "fleet-converge.yml" && (sha as String) == (revision as String)
+                  _ => false
+                })
+            }
+            QualificationSubjectRefused { refusal: _ } => false
+          })
+        }
+            }
+        }
+        JitMintDispatchRefused { refusal: _ } => false
+      }
+      }
+    Absent => false
+  }
+}
+
+// THE PRODUCTION MINT OVER TODAY'S GENERATED WORKFLOW REFUSES, AND THE CLAIM ASSERTS THE ROUTE: the
+// real JIT mint, then qualification_dispatch_subject, which reads the real fleet-converge inputs
+// declaration first and refuses SubjectAttemptInputUndeclared naming runner_attempt_label. When the
+// boot leg lands the qualification mode, this turns red and is replaced by the admitted case.
+test fn the_production_mint_over_todays_fleet_converge_workflow_refuses_at_the_attempt_input() -> Bool {
+  match first(managed_hosts()) {
+    Present { value: h } =>
+      match unit_slot_of(standing: host_unit_slot_for(host: managed_host_binding(host: h), attempt: attempt, workflow: qualification_selected_workflow(branch: pin_branch))) {
+      Absent => false
+      Present { value: slot } =>
+      match dispatch_jit_mint(
+        subject: host_unit_registration_subject(standing: host_unit_slot_for(host: managed_host_binding(host: h), attempt: attempt, workflow: qualification_selected_workflow(branch: pin_branch))),
+        authority: app_credential,
+        control_plane: observed_grant(perms: runner_grant),
+        organization: gunbai_org_ref,
+        runner_group: group_restricted_to(workflow: qualification_selected_workflow(branch: pin_branch)),
+        attempt_binding: jit_admission_axis_standing(axis: AttemptBindingAxis),
+      ) {
+        JitMintDispatchAuthorized { dispatch: d } => match qualification_branch_name(attempt: attempt) {
+          QualificationBranchNameRefused { attempt: _, cause: _ } => false
+          QualificationBranchNamed { name: nm } =>
+            match qualification_ref_pin_of(
+              name: nm, revision: revision, readback: RestAnswered { answer: GitRefWire { ref: "refs/heads/qualification/q-1", object: GitRefObjectWire { type: "commit", sha: revision as String } } },
+              group: group_restricted_to(workflow: qualification_selected_workflow(branch: pin_branch)),
+            ) {
+              QualificationRefPinRefused { attempt: _, refusal: _ } => false
+              QualificationRefPinned { pin: p } =>
+  
+          match qualification_dispatch_subject(
+            dispatch: d, slot: slot,
+            delivery: receive_jit_mint(dispatch: JitMintDispatchAuthorized { dispatch: d }, outcome: minted_outcome),
+            floor_job_id: floor_job_id,
+            pin: p,
+          ) {
+            QualificationSubjectRefused { refusal: SubjectAttemptInputUndeclared { input: i } } => i == "runner_attempt_label"
+            _ => false
+          }
+            }
+        }
+        JitMintDispatchRefused { refusal: _ } => false
+      }
+      }
+    Absent => false
+  }
+}
+
+// ── THE RULING'S SCOPE, AT ITS PURE INTERFACES ──────────────────────────────────────────────────
+// The subject mint above composes exactly these two checks; these claims supply their inputs.
+
+fn slot_refused_as_another_workflow(slot_workflow: NonEmptyStr) -> Bool {
+  match qualification_slot_refusal(slot_workflow: slot_workflow, branch: pin_branch) {
+    Present { value: SubjectSlotForAnotherWorkflow { slot_workflow: sw, qualification_workflow: _ } } => (sw as String) == (slot_workflow as String)
+    _ => false
+  }
+}
+
+// RED: a slot for another workflow file, or for the qualification path on another branch, cannot
+// become a subject; the qualification slot at this branch passes (the positive control).
+test fn a_slot_for_another_workflow_or_branch_cannot_become_a_subject() -> Bool {
+  slot_refused_as_another_workflow(slot_workflow: "gunb-ai/gunbc/.github/workflows/witnesses.yml@refs/heads/main")
+    && slot_refused_as_another_workflow(slot_workflow: qualification_selected_workflow(branch: "feature"))
+    && (match qualification_slot_refusal(slot_workflow: qualification_selected_workflow(branch: pin_branch), branch: pin_branch) { Absent => true Present { value: _ } => false })
+}
+
+fn runs_on_refused(runs_on: RunnerSpec) -> Bool {
+  match qualification_floor_admission(workflow: workflow_with(declares_input: true, runs_on: runs_on), floor_job_id: floor_job_id) {
+    QualificationFloorRefused { refusal: SubjectFloorRunsOnNotTheAttemptInput { job_id: _, runs_on: _ } } => true
+    _ => false
+  }
+}
+
+// RED: a floor runs-on that is a literal label, another input, the attempt input composed with
+// anything, or a bare string refuses; so does an undeclared input or a missing floor job. Positive
+// control: exactly the attempt input admits the floor job by its name.
+test fn a_floor_runs_on_other_than_exactly_the_attempt_input_refuses() -> Bool {
+  runs_on_refused(runs_on: SelfHosted { labels: [attempt as String] })
+    && runs_on_refused(runs_on: RunsOnExpression { expression: "${{ inputs.runner }}" })
+    && runs_on_refused(runs_on: RunsOnExpression { expression: "${{ inputs.runner_attempt_label }}-x" })
+    && runs_on_refused(runs_on: RunsOnExpression { expression: "gunbc-qualification" })
+    && (match qualification_floor_admission(workflow: workflow_with(declares_input: false, runs_on: attempt_runs_on), floor_job_id: floor_job_id) {
+      QualificationFloorRefused { refusal: SubjectAttemptInputUndeclared { input: _ } } => true
+      _ => false
+    })
+    && (match qualification_floor_admission(workflow: workflow_with(declares_input: true, runs_on: attempt_runs_on), floor_job_id: "another-job") {
+      QualificationFloorRefused { refusal: SubjectFloorJobAbsent { job_id: _ } } => true
+      _ => false
+    })
+    && (match qualification_floor_admission(workflow: workflow_with(declares_input: true, runs_on: attempt_runs_on), floor_job_id: floor_job_id) {
+      QualificationFloorAdmitted { floor_job_name: n } => (n as String) == "qualification floor"
+      QualificationFloorRefused { refusal: _ } => false
+    })
+    && (match qualification_floor_admission(workflow: workflow_sharing_the_floor_name(), floor_job_id: floor_job_id) {
+      QualificationFloorRefused { refusal: SubjectFloorNameNotUnique { name: _, jobs_with_name: k } } => k == 2
+      _ => false
+    })
+}
+
+// A HELPER JOB WITH THE FLOOR'S DISPLAY NAME. The readback identifies the floor by the name GitHub
+// reports, so two authored jobs sharing it would let the helper stand in for the floor; the subject
+// mint refuses such a workflow before any dispatch exists.
+fn workflow_sharing_the_floor_name() -> Workflow {
+  let helper = Job {
+    id: "helper",
+    name: Present { value: "qualification floor" },
+    runner: SelfHosted { labels: ["self-hosted"] },
+    environment: none,
+    steps: [],
+    needs: [],
+    env: none,
+    outputs: none,
+    if_condition: none,
+    timeout_minutes: none,
+    continue_on_error: none,
+    concurrency: none,
+    permissions: none,
+  }
+  Workflow {
+    name: "fleet-converge",
+    run_name: none,
+    on: [WorkflowDispatch { inputs: [qualification_attempt_dispatch_input, qualification_revision_dispatch_input] }],
+    concurrency: none,
+    jobs: [floor_job(runs_on: attempt_runs_on), helper],
+    env: none,
+    permissions: none,
+  }
+}
+
+// ── THE INSTALLATION THAT PERFORMS THE REQUEST IS THE ONE WHOSE PERMISSION IS ASKED ─────────────
+// The registration and token are App gunbai-bot installation 999 (app_credential). RED: an authority
+// for another App, or for another installation of the same App, refuses before any network; an
+// Actions job credential names no installation and refuses. Positive control: the matching authority.
+test fn the_dispatch_authority_must_name_the_tokens_installation() -> Bool {
+  (match dispatch_authority_refusal(authority: app_credential, app: gunbai_bot_declared, installation: bot_installation_id) { Absent => true Present { value: _ } => false })
+    && (match dispatch_authority_refusal(authority: other_app_credential, app: gunbai_bot_declared, installation: bot_installation_id) {
+      Present { value: DispatchAuthorityForAnotherInstallation { authority_app: _, authority_installation: _ } } => true
+      _ => false
+    })
+    && (match dispatch_authority_refusal(authority: other_installation_credential, app: gunbai_bot_declared, installation: bot_installation_id) {
+      Present { value: DispatchAuthorityForAnotherInstallation { authority_app: _, authority_installation: _ } } => true
+      _ => false
+    })
+    && (match dispatch_authority_refusal(authority: a_pull_request_job_credential, app: gunbai_bot_declared, installation: bot_installation_id) {
+      Present { value: DispatchAuthorityNotAnInstallation } => true
+      _ => false
+    })
+}
+
+// A DELIVERY CARRIES THE AUTHORIZED DISPATCH THAT PRODUCED IT, SEALED, AND THE SUBJECT COMPARES THE
+// COMPLETE REQUEST. Two authorized mints for the SAME host-unit slot -- under another organization, and
+// under the same slot, App, installation, organization and runner name but another runner group --
+// produce deliveries that agree on slot, credential and runner id; the subject over dispatch A refuses
+// each rather than claiming A's registration for a credential another mint produced. (Rewrapping one
+// delivery's credential with A's dispatch is unconstructable:
+// test.claim.runner_qualification_delivery_rewrap_witness.)
+test fn a_delivery_from_another_dispatch_on_the_same_slot_refuses() -> Bool {
+  match first(managed_hosts()) {
+    Present { value: h } => {
+      let standing = host_unit_slot_for(host: managed_host_binding(host: h), attempt: attempt, workflow: qualification_selected_workflow(branch: pin_branch))
+      let group = group_restricted_to(workflow: qualification_selected_workflow(branch: pin_branch))
+      match unit_slot_of(standing: standing) {
+      Absent => false
+      Present { value: slot } =>
+      match dispatch_jit_mint(subject: host_unit_registration_subject(standing: standing), authority: app_credential, control_plane: observed_grant(perms: runner_grant), organization: gunbai_org_ref, runner_group: group, attempt_binding: jit_admission_axis_standing(axis: AttemptBindingAxis)) {
+        JitMintDispatchAuthorized { dispatch: a } => match qualification_branch_name(attempt: attempt) {
+          QualificationBranchNameRefused { attempt: _, cause: _ } => false
+          QualificationBranchNamed { name: nm } =>
+            match qualification_ref_pin_of(
+              name: nm, revision: revision, readback: RestAnswered { answer: GitRefWire { ref: "refs/heads/qualification/q-1", object: GitRefObjectWire { type: "commit", sha: revision as String } } },
+              group: group_restricted_to(workflow: qualification_selected_workflow(branch: pin_branch)),
+            ) {
+              QualificationRefPinRefused { attempt: _, refusal: _ } => false
+              QualificationRefPinned { pin: p } =>
+  
+          match dispatch_jit_mint(subject: host_unit_registration_subject(standing: standing), authority: app_credential, control_plane: observed_grant(perms: runner_grant), organization: GitHubOrganizationRef { login: "another-org" }, runner_group: group, attempt_binding: jit_admission_axis_standing(axis: AttemptBindingAxis)) {
+            JitMintDispatchAuthorized { dispatch: b } =>
+              a.subject == b.subject
+                && (match qualification_dispatch_subject_over(
+                  dispatch: a, slot: slot, delivery: receive_jit_mint(dispatch: JitMintDispatchAuthorized { dispatch: b }, outcome: minted_outcome),
+                  workflow: workflow_with(declares_input: true, runs_on: attempt_runs_on), floor_job_id: floor_job_id, pin: p,
+                ) {
+                  QualificationSubjectRefused { refusal: SubjectDeliveryForAnotherDispatch } => true
+                  _ => false
+                })
+                && (match dispatch_jit_mint(subject: host_unit_registration_subject(standing: standing), authority: app_credential, control_plane: observed_grant(perms: runner_grant), organization: gunbai_org_ref, runner_group: group_with_id(id: 4, workflow: qualification_selected_workflow(branch: pin_branch)), attempt_binding: jit_admission_axis_standing(axis: AttemptBindingAxis)) {
+                  JitMintDispatchAuthorized { dispatch: c } =>
+                    a.subject == c.subject && a.app == c.app && a.installation == c.installation && a.organization == c.organization && a.request.name == c.request.name
+                      && a.request.runner_group_id != c.request.runner_group_id
+                      && (match qualification_dispatch_subject_over(
+                        dispatch: a, slot: slot, delivery: receive_jit_mint(dispatch: JitMintDispatchAuthorized { dispatch: c }, outcome: minted_outcome),
+                        workflow: workflow_with(declares_input: true, runs_on: attempt_runs_on), floor_job_id: floor_job_id, pin: p,
+                      ) {
+                        QualificationSubjectRefused { refusal: SubjectDeliveryForAnotherDispatch } => true
+                        _ => false
+                      })
+                  JitMintDispatchRefused { refusal: _ } => false
+                })
+            JitMintDispatchRefused { refusal: _ } => false
+          }
+            }
+        }
+        JitMintDispatchRefused { refusal: _ } => false
+      }
+      }
+    }
+    Absent => false
+  }
+}
+
+// ── THE DISPATCH STANDING AND THE INTERLOCK ─────────────────────────────────────────────────────
+
+fn mutation_standing(refusal: RestRefusal) -> QualificationDispatchStanding {
+  qualification_dispatch_standing(dispatch: RestRefused { refusal: refusal })
+}
+
+data dispatch_receipt: WorkflowDispatchReceipt = WorkflowDispatchReceipt {
+  workflow_run_id: 77,
+  run_url: "https://api.github.com/repos/gunb-ai/gunbc/actions/runs/77" as NonEmptyStr,
+  html_url: "https://github.com/gunb-ai/gunbc/actions/runs/77" as NonEmptyStr,
+}
+
+fn ambiguous(s: QualificationDispatchStanding) -> Bool {
+  match s { DispatchStandingCommitAmbiguous { detail: _ } => true _ => false }
+}
+
+// THREE STANDINGS, FROM THE MUTATION CLASSIFIER: a decided 422 is refused; no response, a 503, and an
+// undecodable 200 are commit-ambiguous; only a succeeded exchange dispatches. The interlock: a hold
+// covers the slot's own host and no other.
+test fn the_dispatch_has_three_standings_and_an_interlock() -> Bool {
+  (match mutation_standing(refusal: RestStatusRefused { status: 422, body: "Unexpected inputs provided" }) { DispatchStandingRefused { status: st, body: _ } => st == 422 _ => false })
+    && ambiguous(s: mutation_standing(refusal: RestTransportRefused { cause: "fixture: connection reset after send" }))
+    && ambiguous(s: mutation_standing(refusal: RestStatusRefused { status: 503, body: "fixture" }))
+    && ambiguous(s: mutation_standing(refusal: RestBodyUndecodable { status: 200, cause: "fixture: truncated body" }))
+    && (match qualification_dispatch_standing(dispatch: RestAnswered { answer: dispatch_receipt }) { DispatchStandingSucceeded { receipt: r } => r.workflow_run_id == 77 _ => false })
+    && hold_covers_slot_host(held: "mtcollins1" as HostIdentity, slot_host: "mtcollins1" as HostIdentity)
+    && !hold_covers_slot_host(held: "srv1" as HostIdentity, slot_host: "mtcollins1" as HostIdentity)
+}
+
+// ── THE COLLECTION, OVER A SUPPLIED EXPECTATION ─────────────────────────────────────────────────
+
+data expect: QualificationRunExpectation = QualificationRunExpectation {
+  registered_runner_id: registered_runner_id,
+  registered_runner: registered_runner,
+  floor_job_name: "qualification floor",
+  revision: revision,
+  branch: pin_branch,
+}
+
+fn run(id: Int, attempt_n: Int, event: String, path: String, sha: CommitSha, completed: Bool, concluded: Bool) -> WorkflowRun {
+  run_on(id: id, attempt_n: attempt_n, event: event, path: path, sha: sha, completed: completed, concluded: concluded, on_branch: pin_branch as String)
+}
+
+fn run_on(id: Int, attempt_n: Int, event: String, path: String, sha: CommitSha, completed: Bool, concluded: Bool, on_branch: String) -> WorkflowRun {
+  WorkflowRun {
+    id: id,
+    name: none,
+    path: Present { value: path },
+    head_sha: sha,
+    head_branch: Present { value: on_branch },
+    event: event,
+    status: if completed { Completed } else { InProgress },
+    conclusion: if concluded { Present { value: Failure } } else { none },
+    workflow_id: 9,
+    run_number: 1,
+    run_attempt: attempt_n,
+    actor: none,
+    triggering_actor: none,
+    html_url: "https://github.com/gunb-ai/gunbc/actions/runs/77",
+    created_at: "2026-10-04T00:00:00Z",
+    updated_at: "2026-10-04T01:00:00Z",
+    pull_requests: [],
+  }
+}
+
+fn dispatched_run(attempt_n: Int) -> WorkflowRun {
+  run(id: 77, attempt_n: attempt_n, event: "workflow_dispatch", path: qualification_workflow_path() as String, sha: revision, completed: true, concluded: true)
+}
+
+fn job(id: Int, name: String, runner_id: Int, runner: String, started: Bool, attempt_n: Int) -> WorkflowJobRun {
+  WorkflowJobRun {
+    id: id,
+    run_id: 77,
+    run_attempt: attempt_n,
+    name: name,
+    status: Completed,
+    conclusion: Present { value: Success },
+    labels: [attempt as String],
+    runner_id: Present { value: runner_id },
+    runner_name: Present { value: runner },
+    created_at: Present { value: "2026-10-04T00:00:10Z" },
+    started_at: if started { Present { value: "2026-10-04T00:01:00Z" } } else { none },
+    completed_at: Present { value: "2026-10-04T00:50:00Z" },
+  }
+}
+
+fn floor_on(runner_id: Int) -> WorkflowJobRun {
+  job(id: 1, name: "qualification floor", runner_id: runner_id, runner: registered_runner as String, started: true, attempt_n: 1)
+}
+
+fn jobs(js: List<WorkflowJobRun>) -> WorkflowJobRunList {
+  WorkflowJobRunList { total_count: count(js), jobs: js }
+}
+
+fn decide_run(r: WorkflowRun, js: WorkflowJobRunList) -> QualificationRunVerdict {
+  decide_qualification_run(subject: expect, run_id: 77, run_read: RestAnswered { answer: r }, jobs_read: RestAnswered { answer: js })
+}
+
+fn decide_jobs(js: WorkflowJobRunList) -> QualificationRunVerdict {
+  decide_run(r: dispatched_run(attempt_n: 1), js: js)
+}
+
+fn mismatch(v: QualificationRunVerdict) -> Bool {
+  match v {
+    RunVerdictRefused { refusal: RunSubjectMismatch { observed_run_id: _, observed_event: _, observed_path: _, foreign_jobs: _ } } => true
+    _ => false
+  }
+}
+
+// THE RUNNER IS JOINED BY ITS MINTED ID, WITH THE NAME AS CORROBORATION. Positive control: the named
+// floor job on the registered runner id is collected with the run's own conclusion (a Failure is
+// still this host's run). REDs: the same runner name and labels under another runner id; the minted
+// id reported under another name; a helper job on the registered runner while the floor ran
+// elsewhere; a floor on the registered runner that never started; two jobs on the registered runner.
+test fn the_collection_joins_the_floor_job_to_the_registered_runner() -> Bool {
+  let mine = registered_runner as String
+  (match decide_jobs(js: jobs(js: [floor_on(runner_id: registered_runner_id)])) {
+    RunVerdictCollected { run: r, floor_job: f, conclusion: c } => r.id == 77 && f.id == 1 && (match c { Failure => true _ => false })
+    _ => false
+  })
+    && (match decide_jobs(js: jobs(js: [job(id: 1, name: "qualification floor", runner_id: 99, runner: mine, started: true, attempt_n: 1)])) {
+      RunVerdictRefused { refusal: RunNeverReachedAttemptRunner { registered_runner_id: rid, runner_ids_seen: seen } } => rid == registered_runner_id && count(seen) == 1
+      _ => false
+    })
+    && (match decide_jobs(js: jobs(js: [job(id: 1, name: "qualification floor", runner_id: registered_runner_id, runner: "another-name", started: true, attempt_n: 1)])) {
+      RunVerdictRefused { refusal: RunRunnerNameDisagrees { registered_runner_id: _, registered_runner: _, observed_runner_name: _ } } => true
+      _ => false
+    })
+    && (match decide_jobs(js: jobs(js: [job(id: 2, name: "helper", runner_id: registered_runner_id, runner: mine, started: true, attempt_n: 1), floor_on(runner_id: 99)])) {
+      RunVerdictRefused { refusal: RunRegisteredRunnerRanAnotherJob { registered_runner: _, job_name: n } } => n == "helper"
+      _ => false
+    })
+    && (match decide_jobs(js: jobs(js: [job(id: 1, name: "qualification floor", runner_id: registered_runner_id, runner: mine, started: false, attempt_n: 1)])) {
+      RunVerdictRefused { refusal: RunFloorJobNotStarted { job_id: id } } => id == 1
+      _ => false
+    })
+    && (match decide_jobs(js: jobs(js: [floor_on(runner_id: registered_runner_id), job(id: 2, name: "qualification floor", runner_id: registered_runner_id, runner: mine, started: true, attempt_n: 1)])) {
+      RunVerdictRefused { refusal: RunFloorJobNotUnique { floor_job_name: _, matching: m } } => m == 2
+      _ => false
+    })
+}
+
+// THE SUBJECT IS THE DISPATCHED RUN'S FIRST ATTEMPT ON THE PIN BRANCH. REDs: the run re-run to
+// attempt 2 (whose floor job carries the same labels and runner); a job of attempt 2 in the listing;
+// another run id; another event; another workflow path; a run on another branch (the default branch
+// after a move, which the pinned group would also refuse to hand our runner).
+test fn a_rerun_or_another_run_cannot_be_collected_as_the_dispatch() -> Bool {
+  let floor = jobs(js: [floor_on(runner_id: registered_runner_id)])
+  let path = qualification_workflow_path() as String
+  (match decide_run(r: dispatched_run(attempt_n: 2), js: floor) {
+    RunVerdictRefused { refusal: RunAdvancedPastDispatchedAttempt { observed_attempt: a } } => a == 2
+    _ => false
+  })
+    && mismatch(v: decide_jobs(js: jobs(js: [job(id: 1, name: "qualification floor", runner_id: registered_runner_id, runner: registered_runner as String, started: true, attempt_n: 2)])))
+    && mismatch(v: decide_run(r: run(id: 78, attempt_n: 1, event: "workflow_dispatch", path: path, sha: revision, completed: true, concluded: true), js: floor))
+    && mismatch(v: decide_run(r: run(id: 77, attempt_n: 1, event: "push", path: path, sha: revision, completed: true, concluded: true), js: floor))
+    && mismatch(v: decide_run(r: run(id: 77, attempt_n: 1, event: "workflow_dispatch", path: ".github/workflows/witnesses.yml", sha: revision, completed: true, concluded: true), js: floor))
+    && (match decide_run(r: run_on(id: 77, attempt_n: 1, event: "workflow_dispatch", path: path, sha: revision, completed: true, concluded: true, on_branch: "main"), js: floor) {
+      RunVerdictRefused { refusal: RunOnAnotherBranch { pinned: _, observed: _ } } => true
+      _ => false
+    })
+}
+
+test fn an_unfinished_unpinned_or_unreadable_run_refuses() -> Bool {
+  let floor = jobs(js: [floor_on(runner_id: registered_runner_id)])
+  let path = qualification_workflow_path() as String
+  (match decide_run(r: run(id: 77, attempt_n: 1, event: "workflow_dispatch", path: path, sha: revision, completed: false, concluded: false), js: floor) {
+    RunVerdictRefused { refusal: RunNotCompleted { status: InProgress } } => true
+    _ => false
+  })
+    && (match decide_run(r: run(id: 77, attempt_n: 1, event: "workflow_dispatch", path: path, sha: revision, completed: true, concluded: false), js: floor) {
+      RunVerdictRefused { refusal: RunCompletedWithoutConclusion } => true
+      _ => false
+    })
+    && (match decide_run(r: run(id: 77, attempt_n: 1, event: "workflow_dispatch", path: path, sha: "2222222222222222222222222222222222222222", completed: true, concluded: true), js: floor) {
+      RunVerdictRefused { refusal: RunRevisionNotPinned { pinned: _, observed: _ } } => true
+      _ => false
+    })
+    && (match decide_run(r: dispatched_run(attempt_n: 1), js: WorkflowJobRunList { total_count: 2, jobs: floor.jobs }) {
+      RunVerdictRefused { refusal: RunJobsTruncated { returned: rt, total: t } } => rt == 1 && t == 2
+      _ => false
+    })
+    && (match decide_qualification_run(subject: expect, run_id: 77, run_read: RestRefused { refusal: RestTransportRefused { cause: "fixture" } }, jobs_read: RestAnswered { answer: floor }) {
+      RunVerdictRefused { refusal: RunReadUnreadable { refusal: _ } } => true
+      _ => false
+    })
+    && (match decide_qualification_run(subject: expect, run_id: 77, run_read: RestAnswered { answer: dispatched_run(attempt_n: 1) }, jobs_read: RestRefused { refusal: RestStatusRefused { status: 404, body: "fixture" } }) {
+      RunVerdictRefused { refusal: RunJobsUnreadable { refusal: _ } } => true
+      _ => false
+    })
+}
+
+// THE FLOOR CONTRACT CHECKS OUT THE PINNED REVISION FIRST AND NOTHING RUNS PAST A REFUSAL
+// (decision: eager-gull-22, 2026-10-04). The guard is the floor job's FIRST step; on a mismatch it exits
+// nonzero, and GitHub skips every later step of a failed job unless the step opts back in -- so the
+// contract also refuses any step with an if: condition or continue-on-error, and a job with
+// continue-on-error. REDs: the revision input undeclared; no guard; the guard after another step; a
+// later step with if: always(); a later step with continue-on-error. The guard itself compares HEAD with
+// the revision input and exits 1 on a mismatch. The post-run head_sha refusal is
+// RunRevisionNotPinned (an_unfinished_unpinned_or_unreadable_run_refuses).
+fn floor_refused(workflow: Workflow) -> Bool {
+  match qualification_floor_admission(workflow: workflow, floor_job_id: floor_job_id) {
+    QualificationFloorRefused { refusal: SubjectFloorRevisionGuardNotFirst { job_id: _ } } => true
+    QualificationFloorRefused { refusal: SubjectFloorStepRunsPastTheGuard { job_id: _ } } => true
+    QualificationFloorRefused { refusal: SubjectAttemptInputUndeclared { input: i } } => i == "qualification_revision"
+    _ => false
+  }
+}
+
+fn workflow_with_floor(job: Job, inputs_declare_revision: Bool) -> Workflow {
+  Workflow {
+    name: "fleet-converge",
+    run_name: none,
+    on: [WorkflowDispatch { inputs: if inputs_declare_revision { [qualification_attempt_dispatch_input, qualification_revision_dispatch_input] } else { [qualification_attempt_dispatch_input] } }],
+    concurrency: none,
+    jobs: [job],
+    env: none,
+    permissions: none,
+  }
+}
+
+test fn the_floor_checks_out_the_pinned_revision_first_and_nothing_runs_past_a_refusal() -> Bool {
+  let guard = qualification_floor_revision_guard_step()
+  let work = floor_work_step(if_condition: none)
+  let tolerant = RunStep {
+    name: Present { value: "run the floor anyway" }, id: none, run: "claim_executor --required-ci",
+    shell: none, env: none, working_directory: none, if_condition: none, continue_on_error: Present { value: true }, timeout_minutes: none,
+  }
+  (match qualification_floor_admission(workflow: workflow_with_floor(job: floor_job_with_steps(runs_on: attempt_runs_on, steps: [guard, work]), inputs_declare_revision: true), floor_job_id: floor_job_id) {
+    QualificationFloorAdmitted { floor_job_name: _ } => true
+    QualificationFloorRefused { refusal: _ } => false
+  })
+    && floor_refused(workflow: workflow_with_floor(job: floor_job_with_steps(runs_on: attempt_runs_on, steps: [guard, work]), inputs_declare_revision: false))
+    && floor_refused(workflow: workflow_with_floor(job: floor_job_with_steps(runs_on: attempt_runs_on, steps: [work]), inputs_declare_revision: true))
+    && floor_refused(workflow: workflow_with_floor(job: floor_job_with_steps(runs_on: attempt_runs_on, steps: [work, guard]), inputs_declare_revision: true))
+    && floor_refused(workflow: workflow_with_floor(job: floor_job_with_steps(runs_on: attempt_runs_on, steps: [guard, floor_work_step(if_condition: Present { value: "always()" })]), inputs_declare_revision: true))
+    && floor_refused(workflow: workflow_with_floor(job: floor_job_with_steps(runs_on: attempt_runs_on, steps: [guard, tolerant]), inputs_declare_revision: true))
+    && (match guard {
+      RunStep { name: _, id: _, run: r, shell: _, env: e, working_directory: _, if_condition: c, continue_on_error: ce, timeout_minutes: _ } =>
+        string_contains(s: r, pattern: "git rev-parse HEAD")
+          && string_contains(s: r, pattern: "!= \"$QUALIFICATION_REVISION\"")
+          && string_contains(s: r, pattern: "exit 1")
+          && (match c { Absent => true Present { value: _ } => false })
+          && (match ce { Absent => true Present { value: _ } => false })
+          && (match e { Present { value: kvs } => kvs |> any(x => x.key == "QUALIFICATION_REVISION") Absent => false })
+      UsesStep { name: _, id: _, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } => false
+    })
+}
+
+// ── THE DESIGNATED JOB'S LOG ──────────────────────────────────────────────────────────────────
+
+// RED: a log read for any job other than the designated one is refused, whatever it says.
+test fn a_log_of_another_job_is_not_the_floor_jobs_log() -> Bool {
+  (match designated_job_log(designated_job_id: 502, log: AttemptJobLogRead { job_id: 501, log: "[floor-phase] phase=x wall_ms=1" }) {
+    DesignatedJobLogRefused { refusal: JobLogOfAnotherJob { designated_job_id: 502, read_job_id: 501 } } => true
+    _ => false
+  })
+    && (match designated_job_log(designated_job_id: 502, log: AttemptJobLogUnreadable { job_id: 502, refusal: RestExchangeStatusRefused { status: 410, body: "Gone" } }) {
+      DesignatedJobLogRefused { refusal: JobLogUnreadable { job_id: 502, refusal: _ } } => true
+      _ => false
+    })
+    && (match designated_job_log(designated_job_id: 502, log: AttemptJobLogRead { job_id: 502, log: "" }) {
+      DesignatedJobLogRefused { refusal: JobLogEmpty { job_id: 502 } } => true
+      _ => false
+    })
+}
+
+// ── THE PURE DECODER, OVER SUPPLIED TEXT ──────────────────────────────────────────────────────
+
+data slot: NonEmptyStr = "gunbc-qualification-mtcollins1-q-20261004-1.service"
+
+data phase_line: String = "2026-10-04T00:10:00.0000000Z [floor-phase] phase=gate-closure state=completed wall_ms=22194 prefixes=0"
+data started_line: String = "2026-10-04T00:09:00.0000000Z [floor-phase] phase=strict-preparation state=started"
+data slot_level_line: String = "2026-10-04T00:09:00.0000000Z [floor-cgroup] when=floor-entry level=/sys/fs/cgroup/system.slice/gunbc-qualification-mtcollins1-q-20261004-1.service max=17179869184 high=16106127360 current=8949473280 peak=10444185600 events=[low,0]"
+data slice_level_line: String = "2026-10-04T00:09:00.0000000Z [floor-cgroup] when=floor-entry level=/sys/fs/cgroup/system.slice max=max high=max current=1 peak=364675248128"
+
+fn decode(lines: List<String>) -> JobLogInstrumentDecode {
+  decode_job_log_instruments(log: join(lines, "\n"), slot_unit: slot)
+}
+
+fn undecodable_with(d: JobLogInstrumentDecode, check: fn(InstrumentReadRefusal) -> Bool) -> Bool {
+  match d {
+    JobLogInstrumentsUndecodable { refusal: r } => check(r)
+    JobLogInstrumentsDecoded { readings: _ } => false
+  }
+}
+
+test fn the_job_log_instruments_are_the_two_the_extraction_reads() -> Bool {
+  qualification_instrument_read_from_job_log(i: FloorPhaseRows)
+    && qualification_instrument_read_from_job_log(i: FloorCgroupRows)
+    && count(qualification_instruments |> filter(i => qualification_instrument_read_from_job_log(i: i))) == 2
+    && count(qualification_instrument_extraction_frontier_rows) == 4
+}
+
+// THE POSITIVE CONTROL: timed and untimed phase rows are both carried, and only the slot's own
+// level is taken -- the slice above it has a larger peak and must not be read as the slot's.
+test fn a_log_with_phase_rows_and_the_slot_level_is_decoded() -> Bool {
+  match decode(lines: ["noise before the floor", started_line, slot_level_line, slice_level_line, phase_line]) {
+    JobLogInstrumentsDecoded { readings: rd } =>
+      count(rd.floor_phase_rows) == 2
+        && count(rd.slot_cgroup_rows) == 1
+        && (rd.slot_cgroup_rows |> all(l => byte_size_count(b: l.peak) == 10444185600))
+        && (rd.floor_phase_rows |> any(p => match p { FloorPhaseTimed { phase: _, wall: w } => millisecond_count(m: w) == 22194 _ => false }))
+    JobLogInstrumentsUndecodable { refusal: _ } => false
+  }
+}
+
+test fn a_garbled_row_refuses_rather_than_being_skipped() -> Bool {
+  undecodable_with(d: decode(lines: [slot_level_line, phase_line, "[floor-phase] phase=gate-closure wall_ms=twelve"]), check: r => match r {
+    FloorPhaseRowGarbledInLog { line: _, cause: _ } => true
+    _ => false
+  })
+    && undecodable_with(d: decode(lines: [phase_line, "[floor-cgroup] when=beat-10 level=/sys/fs/cgroup/x.service high=lots peak=1"]), check: r => match r {
+      FloorCgroupRowGarbledInLog { line: _, cause: _ } => true
+      _ => false
+    })
+}
+
+// RED, THE SPLIT-ACROSS-JOBS CASE: the phase rows of one job and the slot row of another never meet,
+// because only the designated job's log is decoded -- read alone, the job carrying only phase rows
+// refuses for want of the slot level, and the one carrying only the slot level refuses for want of a
+// timed phase row.
+test fn rows_split_across_two_jobs_are_not_one_measurement() -> Bool {
+  undecodable_with(d: decode(lines: [started_line, phase_line]), check: r => match r {
+    SlotCgroupLevelAbsent { slot_unit: u, levels_seen: seen } => u == slot && count(seen) == 0
+    _ => false
+  })
+    && undecodable_with(d: decode(lines: [slot_level_line, slice_level_line]), check: r => match r {
+      FloorPhaseRowsAbsent => true
+      _ => false
+    })
+}
+
+test fn a_log_without_the_slot_level_names_the_levels_it_saw() -> Bool {
+  undecodable_with(d: decode(lines: [phase_line, slice_level_line]), check: r => match r {
+    SlotCgroupLevelAbsent { slot_unit: u, levels_seen: seen } => u == slot && count(seen) == 1
+    _ => false
+  })
+}
+
+// ── INHABITANCE: THE REAL PRODUCER'S BYTES ─────────────────────────────────────────────────────
+//
+// The supplied lines above are designed against the row shapes; this claim is what keeps them
+// readings. It hands decode_job_log_instruments the verbatim [floor-phase] and [floor-cgroup] lines
+// claim_executor printed on a recorded required-floor run (test.fixture
+// recorded_required_floor_log_excerpt), under that run's real slot unit, and asserts the ROUTE as well
+// as the answer: every one of the 79 phase rows is read (none garbled, none dropped), the timed rows
+// carry the gate-closure wall the log printed, and of the 12 level rows only the 4 at the slot's own
+// level -- floor entry and three heartbeats -- are taken, with the slot's memory.high read as a byte
+// bound and floor entry's memory.peak as printed. If the host's row encoding moves, this goes red
+// while the designed fixtures above stay green.
+test fn the_decoder_reads_a_recorded_required_floor_log() -> Bool {
+  match decode_job_log_instruments(log: recorded_required_floor_log_excerpt, slot_unit: recorded_floor_log_slot_unit as NonEmptyStr) {
+    JobLogInstrumentsDecoded { readings: rd } =>
+      count(rd.floor_phase_rows) == 79
+        && (rd.floor_phase_rows |> any(p => match p { FloorPhaseTimed { phase: ph, wall: w } => (ph as String) == "gate-closure" && millisecond_count(m: w) == 22194 _ => false }))
+        && (rd.floor_phase_rows |> any(p => match p { FloorPhaseUntimed { phase: ph } => (ph as String) == "strict-preparation" _ => false }))
+        && count(rd.slot_cgroup_rows) == 4
+        && (rd.slot_cgroup_rows |> all(l => match l.high { CgroupMemoryLimited { bytes: b } => byte_size_count(b: b) == 16106127360 _ => false }))
+        && (rd.slot_cgroup_rows |> any(l => (l.when as String) == "floor-entry" && byte_size_count(b: l.peak) == 10444185600))
+    JobLogInstrumentsUndecodable { refusal: _ } => false
+  }
+}
+
+// SUPPLIED RestResult VALUES FOR THE CLAIM-COST DECISIONS, built once so the claims below stay readable.
+fn answered_listing(l: ActionsArtifactList) -> RestResult<ActionsArtifactList> {
+  RestAnswered { answer: l }
+}
+
+fn answered_run(r: WorkflowRun) -> RestResult<WorkflowRun> {
+  RestAnswered { answer: r }
+}
+
+data unreached_run: RestResult<WorkflowRun> = RestRefused { refusal: RestTransportRefused { cause: "unreached" } }
+
+fn archive_refused(r: RestRefusal) -> RestResult<Bytes> {
+  RestRefused { refusal: r }
+}
+
+data archive_arrived: RestResult<Bytes> = RestAnswered { answer: utf8_encode_bytes(s: "PK") }
+
+// ── THE CLAIM-COST READ'S REFUSALS ─────────────────────────────────────────────────────────────
+//
+// Every way the artifact read can end today is a typed arm, and none of them is a reading: the
+// listing truncated, the artifact absent (with the names that were there), expired, the archive
+// unreadable (the RestBodyUndecodable a zip body produces), or an archive that arrived with no
+// inflate reader to open it.
+fn artifact(name: String, expired: Bool) -> ActionsArtifact {
+  ActionsArtifact { id: 9001, name: name, expired: expired }
+}
+
+test fn every_claim_cost_read_ends_in_a_typed_refusal() -> Bool {
+  let present = ActionsArtifactList { total_count: 1, artifacts: [artifact(name: "required-floor-claim-cost", expired: false)] }
+  let gone = archive_refused(r: RestStatusRefused { status: 410, body: "Gone" })
+  let undecodable = archive_refused(r: RestBodyUndecodable { status: 200, cause: "stream did not contain valid UTF-8" })
+  (match conclude_claim_cost_listing(listed: answered_listing(l: ActionsArtifactList { total_count: 1, artifacts: [artifact(name: "required-ci-measurement-receipt", expired: false)] })) {
+    Present { value: ClaimCostArtifactAbsent { names_seen: ns } } => count(ns) == 1
+    _ => false
+  })
+    && (match conclude_claim_cost_listing(listed: answered_listing(l: ActionsArtifactList { total_count: 1, artifacts: [artifact(name: "required-floor-claim-cost", expired: true)] })) {
+      Present { value: ClaimCostArtifactExpired { artifact_id: 9001 } } => true
+      _ => false
+    })
+    && (match conclude_claim_cost_listing(listed: answered_listing(l: ActionsArtifactList { total_count: 3, artifacts: [] })) {
+      Present { value: ClaimCostArtifactListTruncated { returned: 0, total: 3 } } => true
+      _ => false
+    })
+    && (match conclude_claim_cost_listing(listed: answered_listing(l: present)) { Absent => true _ => false })
+    && (match conclude_claim_cost_download(artifact_id: 9001, archive: undecodable) {
+      ClaimCostArchiveUnreadable { artifact_id: 9001, refusal: _ } => true
+      _ => false
+    })
+    && (match conclude_claim_cost_download(artifact_id: 9001, archive: gone) {
+      ClaimCostArtifactExpired { artifact_id: 9001 } => true
+      _ => false
+    })
+    && (match conclude_claim_cost_download(artifact_id: 9001, archive: archive_arrived) {
+      ClaimCostArchiveNotInflatable { artifact_id: 9001 } => true
+      _ => false
+    })
+}
+
+// TWO SAME-NAME ARTIFACTS ARE A REFUSAL, NEVER FIRST-ONE-WINS.
+fn claim_cost_artifact_with(id: Int) -> ActionsArtifact {
+  ActionsArtifact { id: id, name: "required-floor-claim-cost", expired: false }
+}
+
+test fn two_same_name_claim_cost_artifacts_refuse_as_ambiguous() -> Bool {
+  match conclude_claim_cost_listing(listed: answered_listing(l: ActionsArtifactList { total_count: 2, artifacts: [claim_cost_artifact_with(id: 1), claim_cost_artifact_with(id: 2)] })) {
+    Present { value: ClaimCostArtifactAmbiguous { artifact_ids: ids } } => count(ids) == 2
+    _ => false
+  }
+}
+
+// THE LISTING IS BOUND TO THE COLLECTED ATTEMPT: a run re-read after the listing at attempt 2 means the
+// listing may hold attempt 2's artifact, so no claim-cost read proceeds for attempt 1; at attempt 1 it
+// proceeds; an unreadable re-read refuses rather than assuming attempt 1.
+test fn a_rerun_seen_after_the_listing_refuses_the_claim_cost_read() -> Bool {
+  (match conclude_claim_cost_attempt(run: answered_run(r: dispatched_run(attempt_n: 2))) {
+    Present { value: ClaimCostRunAdvancedPastAttempt { observed_attempt: 2 } } => true
+    _ => false
+  })
+    && (match conclude_claim_cost_attempt(run: answered_run(r: dispatched_run(attempt_n: 1))) { Absent => true _ => false })
+    && (match conclude_claim_cost_attempt(run: unreached_run) {
+      Present { value: ClaimCostRunUnreadable { refusal: _ } } => true
+      _ => false
+    })
+}
+
+fn unit_slot_of(standing: HostUnitSlotStanding) -> HostUnitSlot? {
+  match standing {
+    HostUnitSlotBound { slot: s } => Present { value: s }
+    HostUnitSlotRefused { refusal: _ } => none
+  }
+}
diff --git a/dag/test/claim/runner/runner_qualification_ref_pin_witness_test.dag b/dag/test/claim/runner/runner_qualification_ref_pin_witness_test.dag
new file mode 100644
index 00000000000..3f0fe4237ef
--- /dev/null
+++ b/dag/test/claim/runner/runner_qualification_ref_pin_witness_test.dag
@@ -0,0 +1,172 @@
+module test.claim.runner_qualification_ref_pin_witness
+
+import std.types { Bool, CommitSha, Int, List, NonEmptyStr, String }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import extdeps.transports.rest { RestAnswered, RestRefused, RestStatusRefused, RestTransportRefused }
+import extdeps.github.git_database { GitRefWire, GitRefObjectWire }
+import extdeps.github.actions {
+  WorkflowTrigger, Push, PullRequest, Schedule, WorkflowDispatch, WorkflowCall, WorkflowRunCompleted, MergeGroup,
+}
+import gunbc.fleet.org_actions_inspection { RunnerGroupListDecoded, RunnerGroupIdentity }
+import gunbc.runner_group_restriction_observation { RunnerGroupRestrictionRefused, RunnerGroupAbsent }
+import gunbc.fleet_desired_admission_workflow { fleet_desired_admission_workflow }
+import test.claim.github_app_registry { group_restricted_to }
+import gunbc.runner.runner_qualification_ref_pin {
+  qualification_branch_name, QualificationBranchNamed, QualificationBranchNameRefused, branch_full_ref,
+  qualification_selected_workflow, qualification_runner_group_name,
+  qualification_group_target, QualificationGroupTargeted, QualificationGroupNotTargetable,
+  branch_create_refusal, PinBranchPreexisting, PinBranchCreateRefused, PinBranchCreateAmbiguous,
+  qualification_ref_pin_of, QualificationRefPinned, QualificationRefPinRefused, PinBranchReadbackMismatch, PinGroupReadbackRefused,
+  classify_branch_removal, QualificationBranchRemoved, QualificationBranchRemovalRefused, BranchStillPresent, BranchReadUnreadable,
+}
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// A REF AS GitHub's GET /git/ref RETURNS IT, at a supplied commit: the readback this module judges.
+fn ref_at(sha: String) -> GitRefWire {
+  GitRefWire { ref: "refs/heads/qualification/q-1", object: GitRefObjectWire { type: "commit", sha: sha } }
+}
+
+data revision: CommitSha = "1111111111111111111111111111111111111111"
+
+fn named_ok(attempt: NonEmptyStr) -> Bool {
+  match qualification_branch_name(attempt: attempt) {
+    QualificationBranchNamed { name: n } => (n.branch as String) == concat("qualification/", attempt as String) && (branch_full_ref(name: n) as String) == concat("refs/heads/qualification/", attempt as String)
+    QualificationBranchNameRefused { attempt: _, cause: _ } => false
+  }
+}
+
+fn named_refused(attempt: NonEmptyStr) -> Bool {
+  match qualification_branch_name(attempt: attempt) {
+    QualificationBranchNamed { name: _ } => false
+    QualificationBranchNameRefused { attempt: _, cause: _ } => true
+  }
+}
+
+// RED: OUT OF PREFIX. A label carrying a slash, a parent step, a ref metacharacter, a leading dot or
+// a .lock suffix cannot name refs/heads/qualification/<attempt> and refuses rather than escaping.
+// Positive control: an ordinary attempt label names exactly refs/heads/qualification/<attempt>.
+test fn a_ref_outside_refs_heads_qualification_cannot_be_named() -> Bool {
+  named_ok(attempt: "q-1")
+    && named_refused(attempt: "../main")
+    && named_refused(attempt: "q/1")
+    && named_refused(attempt: "main~1")
+    && named_refused(attempt: ".hidden")
+    && named_refused(attempt: "q-1.lock")
+    && named_refused(attempt: "q 1")
+}
+
+// RED: CREATE-ONCE. GitHub's 422 on CreateRef (the ref exists) is the pre-existing refusal, never an
+// adoption; a lost or undecodable answer is ambiguous (removal still owed); only a created ref
+// proceeds to readback.
+test fn a_preexisting_branch_refuses_and_a_lost_create_is_ambiguous() -> Bool {
+  (match branch_create_refusal(created: RestRefused { refusal: RestStatusRefused { status: 422, body: "Reference already exists" } }) {
+    Present { value: PinBranchPreexisting { observed_sha: _ } } => true
+    _ => false
+  })
+    && (match branch_create_refusal(created: RestRefused { refusal: RestStatusRefused { status: 403, body: "fixture" } }) {
+      Present { value: PinBranchCreateRefused { status: s, body: _ } } => s == 403
+      _ => false
+    })
+    && (match branch_create_refusal(created: RestRefused { refusal: RestStatusRefused { status: 502, body: "fixture: 502 after the write" } }) {
+      Present { value: PinBranchCreateAmbiguous { detail: _ } } => true
+      _ => false
+    })
+    && (match branch_create_refusal(created: RestRefused { refusal: RestTransportRefused { cause: "fixture: connection reset after send" } }) {
+      Present { value: PinBranchCreateAmbiguous { detail: _ } } => true
+      _ => false
+    })
+    && (match branch_create_refusal(created: RestAnswered { answer: ref_at(sha: revision as String) }) { Absent => true Present { value: _ } => false })
+}
+
+fn group_row(id: Int, name: NonEmptyStr) -> RunnerGroupIdentity {
+  RunnerGroupIdentity { id: id, name: name, allows_public_repositories: false, restricted_to_workflows: true, selected_workflows: [] }
+}
+
+// RED: A WRITE TO ANY OTHER GROUP. Only the dedicated qualification group can become a write target:
+// the shakedown group refuses even when it is present, as do an absent or duplicated dedicated group.
+// Positive control: the dedicated group found once.
+test fn a_restriction_write_to_any_other_group_refuses() -> Bool {
+  let listed = RunnerGroupListDecoded { groups: [group_row(id: 1, name: "microvm-shakedown"), group_row(id: 3, name: qualification_runner_group_name)] }
+  (match qualification_group_target(requested: "microvm-shakedown", listed: listed) { QualificationGroupNotTargetable { cause: _ } => true _ => false })
+    && (match qualification_group_target(requested: "Default", listed: listed) { QualificationGroupNotTargetable { cause: _ } => true _ => false })
+    && (match qualification_group_target(requested: qualification_runner_group_name, listed: RunnerGroupListDecoded { groups: [group_row(id: 1, name: "microvm-shakedown")] }) {
+      QualificationGroupNotTargetable { cause: _ } => true
+      _ => false
+    })
+    && (match qualification_group_target(requested: qualification_runner_group_name, listed: RunnerGroupListDecoded { groups: [group_row(id: 3, name: qualification_runner_group_name), group_row(id: 4, name: qualification_runner_group_name)] }) {
+      QualificationGroupNotTargetable { cause: _ } => true
+      _ => false
+    })
+    && (match qualification_group_target(requested: qualification_runner_group_name, listed: listed) {
+      QualificationGroupTargeted { target: t } => t.group_id == 3
+      QualificationGroupNotTargetable { cause: _ } => false
+    })
+}
+
+// THE PIN IS MINTED ONLY FROM A READBACK AT THE EXACT REVISION AND A GROUP OBSERVED PINNED TO THE
+// BRANCH. REDs: the branch read back at another commit; the group not observed restricted to the
+// qualification workflow at the branch. Positive control: both hold.
+test fn the_pin_is_minted_only_from_the_exact_revision_and_the_pinned_group() -> Bool {
+  match qualification_branch_name(attempt: "q-1") {
+    QualificationBranchNameRefused { attempt: _, cause: _ } => false
+    QualificationBranchNamed { name: n } => {
+      let pinned_group = group_restricted_to(workflow: qualification_selected_workflow(branch: n.branch))
+      (match qualification_ref_pin_of(name: n, revision: revision, readback: RestAnswered { answer: ref_at(sha: revision as String) }, group: pinned_group) {
+        QualificationRefPinned { pin: p } => (p.name.branch as String) == "qualification/q-1" && (p.revision as String) == (revision as String) && p.group.group.value == 3
+        QualificationRefPinRefused { attempt: _, refusal: _ } => false
+      })
+        && (match qualification_ref_pin_of(name: n, revision: revision, readback: RestAnswered { answer: ref_at(sha: "2222222222222222222222222222222222222222") }, group: pinned_group) {
+          QualificationRefPinRefused { attempt: _, refusal: PinBranchReadbackMismatch { pinned: _, observed: _ } } => true
+          _ => false
+        })
+        && (match qualification_ref_pin_of(name: n, revision: revision, readback: RestAnswered { answer: ref_at(sha: revision as String) }, group: RunnerGroupRestrictionRefused { name: qualification_runner_group_name, cause: RunnerGroupAbsent }) {
+          QualificationRefPinRefused { attempt: _, refusal: PinGroupReadbackRefused { standing: _ } } => true
+          _ => false
+        })
+    }
+  }
+}
+
+// REMOVAL IS A READBACK. A read finding the branch absent (404) is removed; a branch still present
+// after the delete refuses BranchStillPresent; an unreadable read refuses rather than reporting it gone.
+test fn the_branch_is_removed_only_when_a_read_finds_it_absent() -> Bool {
+  match qualification_branch_name(attempt: "q-1") {
+    QualificationBranchNameRefused { attempt: _, cause: _ } => false
+    QualificationBranchNamed { name: n } =>
+      (match classify_branch_removal(name: n, readback: RestRefused { refusal: RestStatusRefused { status: 404, body: "Not Found" } }, deleted: true, delete_refusal: none) {
+        QualificationBranchRemoved { name: _, deleted: d } => d
+        _ => false
+      })
+        && (match classify_branch_removal(name: n, readback: RestAnswered { answer: ref_at(sha: revision as String) }, deleted: true, delete_refusal: none) {
+          QualificationBranchRemovalRefused { name: _, cause: BranchStillPresent { observed_sha: o, delete_refusal: _ } } => o == (revision as String)
+          _ => false
+        })
+        && (match classify_branch_removal(name: n, readback: RestRefused { refusal: RestStatusRefused { status: 500, body: "fixture" } }, deleted: true, delete_refusal: none) {
+          QualificationBranchRemovalRefused { name: _, cause: BranchReadUnreadable { refusal: _ } } => true
+          _ => false
+        })
+  }
+}
+
+// CREATING A QUALIFICATION BRANCH FIRES NO WORKFLOW. WorkflowTrigger has no `create` variant, so no
+// generated workflow can trigger on branch creation by construction; the one generated workflow with a
+// push trigger is gunbc.fleet_desired_admission_workflow, whose branch filter must not admit
+// qualification/<attempt>. A filter containing any glob is read as possibly matching (refused here
+// rather than evaluated), so a widened filter turns this red.
+fn push_trigger_could_fire_on(trigger: WorkflowTrigger, branch: String) -> Bool {
+  match trigger {
+    Push { branches: bs, paths: _ } => count(bs) == 0 || (bs |> any(b => b == branch || string_contains(s: b, pattern: "*")))
+    PullRequest { branches: _, types: _ } => false
+    Schedule { cron: _ } => false
+    WorkflowDispatch { inputs: _ } => false
+    WorkflowCall { inputs: _ } => false
+    WorkflowRunCompleted { workflows: _, branches: _ } => false
+    MergeGroup => false
+  }
+}
+
+test fn creating_a_qualification_branch_fires_no_generated_push_workflow() -> Bool {
+  !(fleet_desired_admission_workflow.on |> any(t => push_trigger_could_fire_on(trigger: t, branch: "qualification/q-1")))
+    && push_trigger_could_fire_on(trigger: Push { branches: ["qualification/**"], paths: [] }, branch: "qualification/q-1")
+}
diff --git a/dag/test/claim/runner/runner_slot_allocation_witness_test.dag b/dag/test/claim/runner/runner_slot_allocation_witness_test.dag
index e61f4ca448f..81c83503203 100644
--- a/dag/test/claim/runner/runner_slot_allocation_witness_test.dag
+++ b/dag/test/claim/runner/runner_slot_allocation_witness_test.dag
@@ -107,10 +107,15 @@ test fn runner_slot_allocation_committed_hosts_cover_the_fleet_exactly_once() ->
 // raise it once already: #12328 moved the served slices from 50 to 87 GiB and took this from 12 to
 // 11. It was 15 on main and stale: main derived 14 without the served-slice term, and 14 did not
 // conserve on srv1.
+// MOVED AGAIN 2026-10-09, BY RULING RATHER THAN BY A SLICE: the operator fixed the slot at a 22 GiB
+// hard maximum (gunbc.runner_slot_desired, the v1 withdrawal's memory envelope), and a smaller slot
+// admits more of them -- srv1 11 -> 12, srv3 and srv4 17 -> 21. The numbers below are the
+// derivation's answers under that row (re-derived by the authority's own folds, read once through a
+// probe and then pinned here as the alarm this claim is), not figures chosen for the hosts.
 test fn runner_slot_allocation_memory_admissions_differ_by_host_class() -> Bool {
-  host_memory_admitted_width(host: operator_host_srv1) == 11
-    && host_memory_admitted_width(host: operator_host_srv3) == 17
-    && host_memory_admitted_width(host: operator_host_srv4) == 17
+  host_memory_admitted_width(host: operator_host_srv1) == 12
+    && host_memory_admitted_width(host: operator_host_srv3) == 21
+    && host_memory_admitted_width(host: operator_host_srv4) == 21
     && match host_memory_denominator(host: operator_host_srv2) {
       MemoryDenominatorEstablished => false
       MemoryDenominatorUnestablished { cause: _ } => true
@@ -190,8 +195,8 @@ fn committed_width_is(host: HostIdentity, expected: Int) -> Bool {
 }
 
 test fn runner_slot_allocation_committed_widths_are_the_minimum_over_axes() -> Bool {
-  committed_width_is(host: operator_host_srv3, expected: 17)
-    && committed_width_is(host: operator_host_srv4, expected: 17)
+  committed_width_is(host: operator_host_srv3, expected: 21)
+    && committed_width_is(host: operator_host_srv4, expected: 21)
     && committed_width_is(host: operator_host_srv1, expected: host_memory_admitted_width(host: operator_host_srv1))
     && committed_width_is(host: operator_host_srv3, expected: host_memory_admitted_width(host: operator_host_srv3))
     && committed_width_is(host: operator_host_srv4, expected: host_memory_admitted_width(host: operator_host_srv4))
@@ -330,20 +335,27 @@ test fn runner_slot_allocation_minimum_viable_armed_budget_is_12_gib() -> Bool {
 // against the CI floor consumer (gunbc_srv2_03_converge_floor_fit_note). No OOM outcome and no
 // floor byte figure are asserted.
 
-// RENAMED AND RE-PINNED 2026-09-12 to the row it now guards. The 16/15 pair it named was the
-// 2026-08-17 ruling's, and every reading behind that ruling was a THROTTLE PIN -- a peak landing
-// on the MemoryHigh line, which that ruling itself called a censored lower bound. The 26/25 pair
-// derives from the first UNCENSORED floor-lane measurement (`high=max`, stall 0 faults/min), so
-// this witness pins a demand rather than the last place a pin happened to land.
-test fn witness_declared_row_pins_26_25_gib_from_floor_demand_ruling() -> Bool {
-  byte_size_count(b: gunbc_runner_slot_desired().memory_max) == byte_size_count(b: byte_size(27917287424))
-    && byte_size_count(b: gunbc_runner_slot_desired().memory_high) == byte_size_count(b: byte_size(26843545600))
-}
-
-test fn witness_declared_high_clears_measured_floor_peak() -> Bool {
-  byte_size_count(b: gunbc_runner_slot_desired().memory_high)
-    >= byte_size_count(b: gunbc_floor_measured_peak_observation)
-}
+// RE-PINNED 2026-10-09 TO THE RULING THAT MOVED THE ROW, AND THE PROVENANCE IS THE POINT. The
+// 26/25 pair this guarded derived from the floor's first uncensored measurement; the operator's
+// 2026-10-09 ruling withdrew the floor from the required path (gunbc.rung_drop
+// v1_required_lanes_withdrawn) and fixed the slot that the emit-and-build steps run in at a hard
+// 22 GiB maximum, 21 GiB throttle line and NO swap ("no thrashing allowed ever"). The floor's own
+// envelope is no longer this row: it is gunbc.floor_demand gunbc_floor_pinned_memory_max/_high,
+// where the floor's receipts join (test.claim.floor.floor_demand_witness_test). A row that moves
+// again moves by a ruling cited here, never by the last place a pin landed.
+test fn witness_declared_row_pins_22_21_gib_and_no_swap_from_the_2026_10_09_ruling() -> Bool {
+  byte_size_count(b: gunbc_runner_slot_desired().memory_max) == byte_size_count(b: byte_size(23622320128))
+    && byte_size_count(b: gunbc_runner_slot_desired().memory_high) == byte_size_count(b: byte_size(22548578304))
+    && byte_size_count(b: gunbc_runner_slot_desired().memory_swap_max) == 0
+}
+
+// THE CLAIM THAT STOOD HERE -- the slot's high clears the floor's measured peak -- asserted a relation
+// between a dead tenant and the slot it no longer inhabits, and is deleted rather than re-pointed:
+// the floor's peak against the floor's own pinned line is floor_demand_witness_test's claim
+// (the_pin_receipt_was_armed_at_the_declared_throttle_line). What the slot must clear now is the
+// demand of the emit-and-build steps that run in it, which no receipt measures yet; the first cold
+// required run's MEMORY RECEIPT (peak_bytes, gunbc test) is that oracle, and a claim over it enters
+// here when it exists -- a declared frontier, not a number copied from the tree.
 
 test fn witness_floor_peak_input_is_uncensored_not_a_throttle_pin() -> Bool {
   gunbc_floor_measured_peak_is_uncensored()
@@ -549,14 +561,22 @@ test fn slot_purposes_partition_every_host_committed_width() -> Bool {
 // AUTHORS that identity rather than deriving it from a count -- the defence in
 // the_fabric_member_is_an_authored_identity_not_a_top_index_rule, observed working through a real
 // width change rather than only asserted.
+// AND THE 2026-10-09 SLOT MOVE EXERCISED EXACTLY THAT DEFENCE ON srv1: the 22 GiB slot derives a
+// width of 12, so `width + 1` IS srv1-13, the authored microVM member (#12011) -- inside, and
+// fabric. The earlier form of this claim asserted `width + 1` outside and not fabric, which was
+// true only while the width was 11; it was the index arithmetic this claim exists to refuse,
+// one layer up. The authored identity is named by its index here, and "outside" is asked of an
+// index past both the derived width and the authored member.
 test fn an_identity_outside_the_committed_population_is_refused_not_classified() -> Bool {
   derived_width_or_fail(r: gunbc_runner_committed_width(host: operator_host_srv1), k: srv1_w =>
     derived_width_or_fail(r: gunbc_runner_committed_width(host: operator_host_srv3), k: srv3_w =>
-      membership_is_outside(m: runner_slot_membership(host: operator_host_srv1, slot_index: srv1_w + 1))
+      membership_is_outside(m: runner_slot_membership(host: operator_host_srv1, slot_index: 99))
+        && membership_is_outside(m: runner_slot_membership(host: operator_host_srv1, slot_index: srv1_w + 2))
         && membership_is_outside(m: runner_slot_membership(host: operator_host_srv3, slot_index: 99))
         && membership_is_outside(m: runner_slot_membership(host: operator_host_srv3, slot_index: srv3_w + 1))
         && !membership_is_outside(m: runner_slot_membership(host: operator_host_srv3, slot_index: 6))
-        && !membership_is_fabric(m: runner_slot_membership(host: operator_host_srv1, slot_index: srv1_w + 1))))
+        && !membership_is_outside(m: runner_slot_membership(host: operator_host_srv1, slot_index: 13))
+        && membership_is_fabric(m: runner_slot_membership(host: operator_host_srv1, slot_index: 13))))
 }
 
 // THE FABRIC MEMBER IS AN EXACT IDENTITY AND DOES NOT MOVE WITH THE WIDTH. The carve is authored as
diff --git a/dag/test/claim/runner/runner_slot_retirement_witness_test.dag b/dag/test/claim/runner/runner_slot_retirement_witness_test.dag
index 4562224d2e5..b0f7262f386 100644
--- a/dag/test/claim/runner/runner_slot_retirement_witness_test.dag
+++ b/dag/test/claim/runner/runner_slot_retirement_witness_test.dag
@@ -1085,6 +1085,27 @@ test fn a_derived_target_width_yields_the_prior_minus_target_obligation() -> Boo
   }
 }
 
+// THE OBLIGATION IS PRIOR MINUS THE COMMITTED IDENTITIES, NOT `target + 1 .. prior`. On srv1 the
+// committed population at width 11 is srv1-01..10 plus the shakedown slot srv1-13 (#12339), so the
+// obligation must name srv1-11 and srv1-12 -- the fleet slots the width stopped charging for -- and
+// must NOT name srv1-13. The index-range derivation got both wrong with the same count (39), which
+// is why this asserts membership rather than length alone.
+test fn the_obligation_excludes_a_committed_member_above_the_fleet_range() -> Bool {
+  match transition_row_for_host(host: operator_host_srv1).first() {
+    Absent => false
+    Present { value: t } =>
+      match transition_required_retirees_at(t: t, target_width: RunnerWidthDerived { slots: 11 }) {
+        RetireesKnown { units: units } =>
+          list_length(items: units) == 39
+            && any(units, u => (u as String) == "actions-runner@srv1-11.service")
+            && any(units, u => (u as String) == "actions-runner@srv1-12.service")
+            && !any(units, u => (u as String) == "actions-runner@srv1-13.service")
+            && !any(units, u => (u as String) == "actions-runner@srv1-10.service")
+        RetireesUnresolved { host: _, cause: _ } => false
+      }
+  }
+}
+
 // AND THE WRAPPER REACHES THE DECISION ON THE REAL PATH, which is what keeps the two supplied-input
 // rows above from being claims about a function nothing calls: srv4's width resolves today, so the
 // production read yields the same derived obligation the decision produces for that width.
diff --git a/dag/test/claim/runner/runner_throughput_qualification_witness_test.dag b/dag/test/claim/runner/runner_throughput_qualification_witness_test.dag
index 21a65bf2872..4c7da3a0c46 100644
--- a/dag/test/claim/runner/runner_throughput_qualification_witness_test.dag
+++ b/dag/test/claim/runner/runner_throughput_qualification_witness_test.dag
@@ -741,33 +741,33 @@ test fn the_route_classifies_every_mutation_at_its_grain() -> Bool {
           match stage_effect(stage: s) { GitHubControlPlaneWrite { authority: _ } => true _ => false }
         DeregisterRunnerSlot { unit: _, deregistration: _ } =>
           match stage_effect(stage: s) { GitHubControlPlaneWrite { authority: _ } => true _ => false }
-        CollectInstruments { instruments: _ } =>
-          match stage_effect(stage: s) { ObservationOnly => true _ => false }
+        CollectInstruments { instruments: _, collection: _ } =>
+          match stage_effect(stage: s) { ObservationOnly { collection: _ } => true _ => false }
         BootHostUnderApprovalGate { host: _, boot: _, image: _ } =>
           match stage_effect(stage: s) { BmcWrite { gate: _, boot: _, image: _ } => true _ => false }
       }
     ))
 }
 
-// THE ROUTE IS NOT EXECUTABLE TODAY, AND THE CLAIM SAYS SO: the boot and dispatch legs are still
-// declared frontiers. This flips to the regression control that the bindings stay when they land.
+// THE ROUTE IS NOT EXECUTABLE TODAY, AND THE CLAIM SAYS SO: the image, boot, registration, dispatch and
+// deregistration authorities are implemented but not wired. This flips to the regression control that the bindings stay when they land.
 test fn the_route_is_not_executable_while_any_effectful_leg_is_unbound() -> Bool {
   !route_is_executable(route: route()) && !leg_is_wired(leg: qualification_run_producer_frontier)
 }
 
-// THE IMAGE LEG HAS AN IMPLEMENTED AUTHORITY AND IS NOT WIRED; THE BOOT LEG HAS NO AUTHORITY. The
-// claim tells the two apart: wiring the image leg before a production caller builds the runner
-// image, pointing it at another declaration, or binding the boot leg to the census-only boot run,
-// turns this red.
-test fn the_image_leg_is_implemented_not_wired_and_the_boot_leg_awaits_a_runner_medium() -> Bool {
-  leg_names(leg: mtcollins1_route_legs.image, module_path: "extdeps.provisioning.ubuntu_seeded_install_media", decl_name: "UbuntuSeededInstallMediaBuildInput")
+// THE IMAGE AND BOOT LEGS HAVE IMPLEMENTED RUNNER-OWNED AUTHORITIES AND ARE NOT WIRED. Wiring either
+// before a production caller boots the runner image, or pointing either at another declaration
+// (the census-only boot run among them), turns this red.
+test fn the_image_and_boot_legs_are_implemented_by_the_runner_medium_and_not_wired() -> Bool {
+  leg_names(leg: mtcollins1_route_legs.image, module_path: "gunbc.runner.runner_host_medium", decl_name: "runner_host_medium_image")
     && !leg_is_wired(leg: mtcollins1_route_legs.image)
-    && match mtcollins1_route_legs.boot { LegAwaitingAuthority { lands_with: _, sufficient_for: _ } => true _ => false }
+    && leg_names(leg: mtcollins1_route_legs.boot, module_path: "gunbc.runner.runner_host_medium", decl_name: "runner_host_up_readback")
+    && !leg_is_wired(leg: mtcollins1_route_legs.boot)
 }
 
-// REGISTRATION AND DEREGISTRATION HAVE IMPLEMENTED AUTHORITIES AND ARE NOT WIRED -- by declaration
-// identity, so pointing either leg at some other declaration, or promoting either to LegWired while
-// nothing on the route calls it, turns this red -- and the route stays unexecutable.
+// REGISTRATION, DISPATCH AND DEREGISTRATION HAVE IMPLEMENTED AUTHORITIES AND ARE NOT WIRED -- by
+// declaration identity, so pointing any leg at some other declaration, or promoting one to LegWired
+// while nothing on the route calls it, turns this red -- and the route stays unexecutable.
 fn leg_names(leg: RouteLegStanding, module_path: String, decl_name: String) -> Bool {
   match leg {
     LegAuthorityImplemented { authority: a, wiring_owed: _ } => (a.module_path as String) == module_path && (a.decl_name as String) == decl_name
@@ -775,13 +775,16 @@ fn leg_names(leg: RouteLegStanding, module_path: String, decl_name: String) -> B
   }
 }
 
-test fn the_registration_and_deregistration_legs_are_implemented_not_wired_and_the_route_is_not_executable() -> Bool {
+test fn the_registration_dispatch_and_deregistration_legs_are_implemented_not_wired_and_the_route_is_not_executable() -> Bool {
   leg_names(leg: mtcollins1_route_legs.registration, module_path: "gunbc.runner.runner_jit_perform", decl_name: "dispatch_jit_mint")
+    && leg_names(leg: mtcollins1_route_legs.dispatch, module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "dispatch_qualification_floor")
     && leg_names(leg: mtcollins1_route_legs.deregistration, module_path: "gunbc.runner.runner_jit_deregistration", decl_name: "ensure_jit_runner_deregistered")
     && !leg_is_wired(leg: mtcollins1_route_legs.registration)
     && !leg_is_wired(leg: mtcollins1_route_legs.deregistration)
     && !leg_is_wired(leg: mtcollins1_route_legs.boot)
     && !leg_is_wired(leg: mtcollins1_route_legs.dispatch)
+    && leg_names(leg: mtcollins1_route_legs.collect, module_path: "gunbc.runner.runner_qualification_dispatch", decl_name: "collect_qualification_instruments")
+    && !leg_is_wired(leg: mtcollins1_route_legs.collect)
     && !route_is_executable(route: route())
 }
 
@@ -797,7 +800,7 @@ test fn only_the_runner_stages_open_the_network_and_only_default_drop() -> Bool
       Absent =>
         match s {
           BootHostUnderApprovalGate { host: _, boot: _, image: _ } => true
-          CollectInstruments { instruments: _ } => true
+          CollectInstruments { instruments: _, collection: _ } => true
           _ => false
         }
       Present { value: policy } =>
@@ -819,7 +822,7 @@ test fn the_collect_stage_owes_a_sealed_concurrent_cohort() -> Bool {
   !leg_is_wired(leg: qualification_run_producer_frontier)
     && (route() |> any(s =>
       match s {
-        CollectInstruments { instruments: is } =>
+        CollectInstruments { instruments: is, collection: _ } =>
           is |> any(i =>
             match i {
               ConcurrentCohortSeatWindows => {
@@ -837,7 +840,7 @@ test fn the_collect_stage_owes_a_sealed_concurrent_cohort() -> Bool {
 test fn the_collect_stage_owes_the_rate_specimen_and_the_cgroup_rows() -> Bool {
   route() |> any(s =>
     match s {
-      CollectInstruments { instruments: is } =>
+      CollectInstruments { instruments: is, collection: _ } =>
         (is |> any(i =>
           match i {
             CalibrationSpecimenWitnessLine => {
diff --git a/dag/test/claim/runner/workspace_microvm_witness_test.dag b/dag/test/claim/runner/workspace_microvm_witness_test.dag
index 476ca44bc69..067cae7a63c 100644
--- a/dag/test/claim/runner/workspace_microvm_witness_test.dag
+++ b/dag/test/claim/runner/workspace_microvm_witness_test.dag
@@ -8,7 +8,8 @@ import gunbc.runner_microvm_lifecycle { AttemptIdentity, in_flight_attempt_of_id
 import gunbc.runner_microvm_cell_readiness { WorkspaceWorkload, in_flight_attempt_same }
 import gunbc.runner_microvm_cell_readiness_store { encode_attempt, decode_attempt, DecodeOk }
 import gunbc.workspace_gateway { WorkspaceGateway }
-import gunbc.workspace_microvm_access { WorkspaceConnectionReady, WorkspaceConnectionUnavailable, workspace_connection_from_observations }
+import gunbc.workspace_ssh_access { WorkspaceDirectSsh, WorkspaceGatewaySsh }
+import gunbc.workspace_microvm_access { WorkspaceConnectionReady, WorkspaceConnectionUnavailable, workspace_connection_from_observations, workspace_connection_text }
 import gunbc.runner_microvm_network { runner_slot_network }
 import extdeps.network.ipv4 { render_ipv4_address }
 import gunbc.workspace_microvm { workspace_public_key, WorkspacePublicKeyRefused, workspace_machine_config }
@@ -44,7 +45,7 @@ fn test_scan(identity: AttemptIdentity, key: String) -> String {
 test fn workspace_readiness_requires_bootstrap_and_live_ssh_key() -> Bool {
   match workspace_test_identity() {
     Absent => false
-    Present { value: id } => match workspace_connection_from_observations(identity: id, gateway: test_gateway(identity: id), systemd_invocation: "systemd-test", gateway_known_host: "srv1.test.ts.net ssh-ed25519 AAAAGATEWAY", console: test_console(bootstrap: "workspace-test"), scanned_keys: test_scan(identity: id, key: "AAAATEST")) {
+    Present { value: id } => match workspace_connection_from_observations(identity: id, route: WorkspaceGatewaySsh { gateway: test_gateway(identity: id), known_host: "srv1.test.ts.net ssh-ed25519 AAAAGATEWAY" }, systemd_invocation: "systemd-test", console: test_console(bootstrap: "workspace-test"), scanned_keys: test_scan(identity: id, key: "AAAATEST")) {
       WorkspaceConnectionReady { connection: c } => c.identity.allocation_generation == 4 && (c.host_key as String) == "ssh-ed25519 AAAATEST"
       _ => false
     }
@@ -54,7 +55,7 @@ test fn workspace_readiness_requires_bootstrap_and_live_ssh_key() -> Bool {
 test fn workspace_readiness_refuses_old_guest_at_reused_address() -> Bool {
   match workspace_test_identity() {
     Absent => false
-    Present { value: id } => match workspace_connection_from_observations(identity: id, gateway: test_gateway(identity: id), systemd_invocation: "systemd-test", gateway_known_host: "srv1.test.ts.net ssh-ed25519 AAAAGATEWAY", console: test_console(bootstrap: "workspace-test"), scanned_keys: test_scan(identity: id, key: "AAAAPREVIOUS")) {
+    Present { value: id } => match workspace_connection_from_observations(identity: id, route: WorkspaceGatewaySsh { gateway: test_gateway(identity: id), known_host: "srv1.test.ts.net ssh-ed25519 AAAAGATEWAY" }, systemd_invocation: "systemd-test", console: test_console(bootstrap: "workspace-test"), scanned_keys: test_scan(identity: id, key: "AAAAPREVIOUS")) {
       WorkspaceConnectionUnavailable { reason: _ } => true
       _ => false
     }
@@ -64,7 +65,7 @@ test fn workspace_readiness_refuses_old_guest_at_reused_address() -> Bool {
 test fn workspace_readiness_refuses_foreign_bootstrap() -> Bool {
   match workspace_test_identity() {
     Absent => false
-    Present { value: id } => match workspace_connection_from_observations(identity: id, gateway: test_gateway(identity: id), systemd_invocation: "systemd-test", gateway_known_host: "srv1.test.ts.net ssh-ed25519 AAAAGATEWAY", console: test_console(bootstrap: "previous-allocation"), scanned_keys: test_scan(identity: id, key: "AAAATEST")) {
+    Present { value: id } => match workspace_connection_from_observations(identity: id, route: WorkspaceGatewaySsh { gateway: test_gateway(identity: id), known_host: "srv1.test.ts.net ssh-ed25519 AAAAGATEWAY" }, systemd_invocation: "systemd-test", console: test_console(bootstrap: "previous-allocation"), scanned_keys: test_scan(identity: id, key: "AAAATEST")) {
       WorkspaceConnectionUnavailable { reason: _ } => true
       _ => false
     }
@@ -90,3 +91,42 @@ test fn workspace_production_machine_config_consumes_committed_grant() -> Bool {
     _ => false
   }
 }
+
+
+test fn direct_ssh_uses_the_vm_key_without_a_jump_or_agent() -> Bool {
+  match workspace_test_identity() {
+    Absent => false
+    Present { value: id } => match workspace_connection_from_observations(identity: id,
+      route: WorkspaceDirectSsh { slot: id.attempt.slot, identity_file: "/fixture/vm-key" },
+      systemd_invocation: "systemd-test", console: test_console(bootstrap: "workspace-test"), scanned_keys: test_scan(identity: id, key: "AAAATEST")) {
+      WorkspaceConnectionReady { connection } => {
+        let text = workspace_connection_text(connection: connection)
+        starts_with(s: text, prefix: "Run on srv1:")
+          && string_contains(s: text, pattern: "IdentityAgent=none")
+          && string_contains(s: text, pattern: "ForwardAgent=no")
+          && string_contains(s: text, pattern: "-i '/fixture/vm-key'")
+          && !string_contains(s: text, pattern: " -J ")
+      }
+      _ => false
+    }
+  }
+}
+
+test fn direct_ssh_refuses_a_foreign_route_or_previous_guest_key() -> Bool {
+  match workspace_test_identity() {
+    Absent => false
+    Present { value: id } => {
+      let foreign = match workspace_connection_from_observations(identity: id,
+        route: WorkspaceDirectSsh { slot: RunnerSlotIdentity { host: "srv2", slot_index: 7 }, identity_file: "/fixture/vm-key" },
+        systemd_invocation: "systemd-test", console: test_console(bootstrap: "workspace-test"), scanned_keys: test_scan(identity: id, key: "AAAATEST")) {
+        WorkspaceConnectionUnavailable { reason: _ } => true _ => false
+      }
+      let previous = match workspace_connection_from_observations(identity: id,
+        route: WorkspaceDirectSsh { slot: id.attempt.slot, identity_file: "/fixture/vm-key" },
+        systemd_invocation: "systemd-test", console: test_console(bootstrap: "workspace-test"), scanned_keys: test_scan(identity: id, key: "AAAAPREVIOUS")) {
+        WorkspaceConnectionUnavailable { reason: _ } => true _ => false
+      }
+      foreign && previous
+    }
+  }
+}
diff --git a/dag/test/claim/runner/workspace_owner_access_witness_test.dag b/dag/test/claim/runner/workspace_owner_access_witness_test.dag
index e60e6aa0035..83944090aa5 100644
--- a/dag/test/claim/runner/workspace_owner_access_witness_test.dag
+++ b/dag/test/claim/runner/workspace_owner_access_witness_test.dag
@@ -1,15 +1,16 @@
 module test.claim.runner.workspace_owner_access_witness_test
 
+import gunbc.workspace_ssh_access { WorkspaceSshThroughGateway, WorkspaceSshFromHost }
+
 import std.types { Bool, NonEmptyStr, List }
 import std.optional { Absent, Present }
 import extdeps.ssh { SshPublicKey, Ed25519, Rsa, ssh_public_key_line }
-import gunbc.fleet_ssh_access { operator_ssh_principal }
 import gunbc.principal_projection { PrincipalRef }
 import gunbc.workspace_allocation_admission {
   WorkspaceAuthorizationPolicy, WorkspaceEnrollmentRoster, WorkspaceOwnerEnrollment, WorkspacePublicKeyCatalogRow,
   WorkspacePolicyAdmitted, WorkspacePolicyRefused, workspace_policy_admit,
 }
-import gunbc.workspace_allocation_policy { workspace_installed_policy, workspace_operator_principal, workspace_operator_public_key_ref }
+import gunbc.workspace_allocation_policy { workspace_installed_policy, workspace_operator_principal, workspace_operator_public_key_ref, workspace_operator_guest_key }
 import gunbc.workspace_microvm { workspace_owner_public_key, WorkspacePublicKeyAdmitted, WorkspacePublicKeyNotAdmitted }
 
 fn alice() -> PrincipalRef { PrincipalRef { authority: "google-oidc", namespace: "accounts", subject: "alice-test" } }
@@ -33,8 +34,8 @@ fn admits(roster: List<WorkspaceOwnerEnrollment>, catalog: List<WorkspacePublicK
 
 fn two_owner_policy() -> WorkspaceAuthorizationPolicy? {
   match workspace_policy_admit(roster: WorkspaceEnrollmentRoster { enrollments: [
-    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key" },
-    WorkspaceOwnerEnrollment { principal: bob(), public_key_ref: "bob-key" },
+    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key", ssh_access: WorkspaceSshThroughGateway },
+    WorkspaceOwnerEnrollment { principal: bob(), public_key_ref: "bob-key", ssh_access: WorkspaceSshThroughGateway },
   ] }, catalog: [alice_row(), bob_row()]) {
     WorkspacePolicyAdmitted { policy } => Present { value: policy }
     WorkspacePolicyRefused { reason: _ } => none
@@ -44,7 +45,7 @@ fn two_owner_policy() -> WorkspaceAuthorizationPolicy? {
 // One enrolled owner with the shared witness reference, admitted through the production join.
 // Consumers of this helper match Absent as a failed claim, never as a permissive default.
 fn witness_single_owner_policy(owner: PrincipalRef) -> WorkspaceAuthorizationPolicy? {
-  match workspace_policy_admit(roster: WorkspaceEnrollmentRoster { enrollments: [WorkspaceOwnerEnrollment { principal: owner, public_key_ref: "witness-key" }] },
+  match workspace_policy_admit(roster: WorkspaceEnrollmentRoster { enrollments: [WorkspaceOwnerEnrollment { principal: owner, public_key_ref: "witness-key", ssh_access: WorkspaceSshThroughGateway }] },
     catalog: [key_row(reference: "witness-key", material: alice_material, comment: "witness")]) {
     WorkspacePolicyAdmitted { policy } => Present { value: policy }
     WorkspacePolicyRefused { reason: _ } => none
@@ -61,32 +62,32 @@ fn witness_empty_policy() -> WorkspaceAuthorizationPolicy? {
 // REDs at the policy join: no list order may decide which enrollment or key line wins.
 test fn an_ambiguous_enrollment_roster_is_refused_at_admission() -> Bool {
   let shared_ref = !admits(roster: [
-    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key" },
-    WorkspaceOwnerEnrollment { principal: bob(), public_key_ref: "alice-key" },
+    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key", ssh_access: WorkspaceSshThroughGateway },
+    WorkspaceOwnerEnrollment { principal: bob(), public_key_ref: "alice-key", ssh_access: WorkspaceSshThroughGateway },
   ], catalog: [alice_row()])
   let two_refs = !admits(roster: [
-    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key" },
-    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "bob-key" },
+    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key", ssh_access: WorkspaceSshThroughGateway },
+    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "bob-key", ssh_access: WorkspaceSshThroughGateway },
   ], catalog: [alice_row(), bob_row()])
   let duplicate_rows = !admits(roster: [
-    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key" },
-    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key" },
+    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key", ssh_access: WorkspaceSshThroughGateway },
+    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key", ssh_access: WorkspaceSshThroughGateway },
   ], catalog: [alice_row()])
-  let dangling_ref = !admits(roster: [WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key" }], catalog: [bob_row()])
-  let unused_line = !admits(roster: [WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key" }], catalog: [alice_row(), bob_row()])
-  let two_lines = !admits(roster: [WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key" }],
+  let dangling_ref = !admits(roster: [WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key", ssh_access: WorkspaceSshThroughGateway }], catalog: [bob_row()])
+  let unused_line = !admits(roster: [WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key", ssh_access: WorkspaceSshThroughGateway }], catalog: [alice_row(), bob_row()])
+  let two_lines = !admits(roster: [WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key", ssh_access: WorkspaceSshThroughGateway }],
     catalog: [alice_row(), key_row(reference: "alice-key", material: bob_material, comment: "other")])
   let shared_bytes = !admits(roster: [
-    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key" },
-    WorkspaceOwnerEnrollment { principal: bob(), public_key_ref: "bob-key" },
+    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key", ssh_access: WorkspaceSshThroughGateway },
+    WorkspaceOwnerEnrollment { principal: bob(), public_key_ref: "bob-key", ssh_access: WorkspaceSshThroughGateway },
   ], catalog: [alice_row(), key_row(reference: "bob-key", material: alice_material, comment: "alice")])
   shared_ref && two_refs && duplicate_rows && dangling_ref && unused_line && two_lines && shared_bytes
 }
 
 fn alice_and_bob_with(bob_key: WorkspacePublicKeyCatalogRow) -> Bool {
   admits(roster: [
-    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key" },
-    WorkspaceOwnerEnrollment { principal: bob(), public_key_ref: "bob-key" },
+    WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key", ssh_access: WorkspaceSshThroughGateway },
+    WorkspaceOwnerEnrollment { principal: bob(), public_key_ref: "bob-key", ssh_access: WorkspaceSshThroughGateway },
   ], catalog: [alice_row(), bob_key])
 }
 
@@ -150,15 +151,27 @@ test fn a_stale_or_foreign_key_reference_cannot_reach_another_owners_guest() ->
 }
 
 // Inhabitance of the installed route: the shipped roster and catalog admit, and the controller's
-// resolver gives the operator exactly the fleet operator key line written into authorized_keys.
+// resolver gives the operator exactly the dedicated guest key line written into authorized_keys.
 test fn installed_policy_resolves_the_operator_enrollment() -> Bool {
   match workspace_installed_policy() {
     WorkspacePolicyRefused { reason: _ } => false
     WorkspacePolicyAdmitted { policy } => match workspace_owner_public_key(policy: policy,
       owner: workspace_operator_principal(), reference: workspace_operator_public_key_ref) {
       WorkspacePublicKeyAdmitted { key: k } => (k.reference as String) == (workspace_operator_public_key_ref as String)
-        && (k.line as String) == (ssh_public_key_line(k: operator_ssh_principal.public_key) as String)
+        && (k.line as String) == (ssh_public_key_line(k: workspace_operator_guest_key) as String)
       WorkspacePublicKeyNotAdmitted { reason: _ } => false
     }
   }
 }
+
+fn admits_host_identity_file(path: NonEmptyStr) -> Bool {
+  admits(roster: [WorkspaceOwnerEnrollment { principal: alice(), public_key_ref: "alice-key",
+    ssh_access: WorkspaceSshFromHost { identity_file: path } }], catalog: [alice_row()])
+}
+
+test fn host_identity_file_requires_an_absolute_single_line_path() -> Bool {
+  admits_host_identity_file(path: "/fixture/vm-key")
+    && !admits_host_identity_file(path: "relative/vm-key")
+    && !admits_host_identity_file(path: "/fixture/vm-key\nsecond-line")
+    && !admits_host_identity_file(path: "/fixture/vm-key\rsecond-line")
+}
diff --git a/dag/test/claim/scm/scm_affected_set_capture_witness_test.dag b/dag/test/claim/scm/scm_affected_set_capture_witness_test.dag
index b463435ac8b..dfee5f8e135 100644
--- a/dag/test/claim/scm/scm_affected_set_capture_witness_test.dag
+++ b/dag/test/claim/scm/scm_affected_set_capture_witness_test.dag
@@ -51,6 +51,8 @@ import gunbc.scm.repository_load {
   rows_by_digest, shard_objects_agree_with_roster,
   load_repository_indexed, RepositoryLoaded, RepositoryLoadRefused, RepositoryDocumentRefused,
 }
+import gunbc.roadmap_belt_actuate { belt_scm_rebound_identities }
+import gunbc.scm.worktree_inventory { WorktreeChange, WorktreeBind }
 import gunbc.scm.write_spine {
   commit_staged, StagedCommitMinted, StagedCommitCandidateRefused, StagedCommitNothingToFreeze,
   StagedCommitAllocatorInvalid, StagedCommitSourceUnrecoverable,
@@ -599,3 +601,32 @@ fn envelope_over(indexed: RepositoryEnvelope, store: ObjectStore) -> RepositoryE
     staged: indexed.staged,
   }
 }
+
+fn rebound_changes(from: Int, to: Int) -> List<WorktreeChange> {
+  map(planted_indices(n: to, i: from, acc: []), i => WorktreeBind { path: join(["src/planted/file_", to_string(i), ".dag"], "") as NonEmptyStr })
+}
+
+fn rebound_texts(from: Int, to: Int) -> Map<String, String> {
+  fold(planted_indices(n: to, i: from, acc: []), init: empty_map(), f: fn(m, i) { map_insert(m, join(["src/planted/file_", to_string(i), ".dag"], ""), planted_text(i: i)) })
+}
+
+// THE REBIND'S SHARD DEMAND IS DERIVED FROM THE WHOLE CHANGE POPULATION, so a shard holding k of its
+// re-bound members is planned once. The srv2 recapture demanded each re-bound identity separately
+// and read the one shard k times (30x for the largest). The control is the receipt shape: the
+// population demanded together names exactly one shard, while the same identities demanded one at a
+// time name k -- the count the per-path route paid.
+test fn a_rebound_population_plans_each_shard_once() -> Bool {
+  match planted_base(n: planted_files) {
+    Absent => false
+    Present { value: whole } =>
+      match indexed_of(whole: whole) {
+        Absent => false
+        Present { value: indexed } => {
+          let ids = belt_scm_rebound_identities(store: indexed.store, changes: rebound_changes(from: 1, to: 5), texts: rebound_texts(from: 1, to: 5))
+          count(ids) == 4
+            && demand_shard_count(repo: indexed, identities: ids) == 1
+            && fold(ids, init: 0, f: fn(n, id) { n + demand_shard_count(repo: indexed, identities: [id]) }) == 4
+        }
+      }
+  }
+}
diff --git a/dag/test/claim/scm/scm_object_table_json_witness_test.dag b/dag/test/claim/scm/scm_object_table_json_witness_test.dag
index 74a21f7bb41..fc8ed0cd576 100644
--- a/dag/test/claim/scm/scm_object_table_json_witness_test.dag
+++ b/dag/test/claim/scm/scm_object_table_json_witness_test.dag
@@ -20,7 +20,7 @@ module test.claim.scm_object_table_json_witness
 // closure document's concern; what is asserted is that the TABLE preserves what it was given.
 
 import std.types { Bool, Int, String, List, list_length, NonEmptyStr }
-import v2.std.node { Node, Edge, Symbol, Authored, Conj, Atom, TypeNode, node_synthetic }
+import v2.std.node { Node, Edge, Symbol, Authored, Conj, Atom, TypeNode, node_synthetic, AdmitCallersEdge, StructuralLabel, CoreMarker }
 import extdeps.languages.json.emit { json_object, json_kv, json_array, json_string, json_null, JsonValue }
 import gunbc.scm.object_store {
   ObjectId,
@@ -62,6 +62,8 @@ import gunbc.scm.object_store {
   CorpusManifestIsAuthoredSource,
   StoreAdmission,
   store_admission_store,
+  stored_edge_label_of,
+  ScmObject,
 }
 import gunbc.scm.object_table_json {
   ObjectTableDecodeRefusal,
@@ -669,3 +671,79 @@ test fn ot_a_contained_manifest_source_at_a_manifest_stands_as_a_wrong_kind_requ
       }
   }
 }
+
+// THE WALL'S EDGE IS A CLOSED-LIST MARKER (side chat review 5439746794). The caller-admission
+// carrier AdmitCallersEdge rides core_edge_labels(), the closed list this codec decodes markers
+// through -- the same list object_table_json's decode_object_table folds when it reads a
+// "structural_core" edge's marker lexeme. A marker the list does not name is a LOUD, typed
+// refusal: the decoder answers NodeEntryUnknownLabelTag and the whole entry fails to decode --
+// a round-trip/compatibility refusal, not silent edge loss, and exactly what the wall's edge
+// would hit if AdmitCallersEdge were dropped from core_edge_labels(). So the control is here, in
+// the codec's own witness: an entry carrying the wall's marker must decode, and the marker must
+// come home as itself -- edge_is_core names it -- not merely fail to refuse.
+fn ot_admit_edge_entry(marker: String) -> JsonValue {
+  json_object(
+    members: [
+      json_kv(
+        key: "kind",
+        value: json_object(
+          members: [
+            json_kv(key: "kind", value: json_string(s: "type")),
+            json_kv(key: "connective", value: json_string(s: "conj")),
+          ]
+        ),
+      ),
+      json_kv(
+        key: "children",
+        value: json_array(
+          elements: [
+            json_object(
+              members: [
+                json_kv(key: "label", value: json_string(s: "structural_core")),
+                json_kv(key: "marker", value: json_string(s: marker)),
+                json_kv(
+                  key: "target",
+                  value: json_object(
+                    members: [
+                      json_kv(key: "uncontained", value: json_string(s: "aabbccdd00112233"))
+                    ]
+                  ),
+                ),
+              ]
+            ),
+          ]
+        ),
+      ),
+    ]
+  )
+}
+
+// THE POSITIVE: the marker is a member of the closed list, so the entry decodes and the decoded
+// edge's label is AdmitCallersEdge -- the codec hands back the wall's edge, not a stripped node.
+test fn ot_the_admit_callers_edge_marker_decodes_to_itself() -> Bool {
+  match ot_decoded(entries: [ot_admit_edge_entry(marker: "core_admit_callers_edge")]) {
+    DecodeAcc { refusal: Absent, admission } =>
+      match ot_admitted_store(admission: admission).objects {
+        Empty => false
+        Cons { head: first, tail: _ } =>
+          match first {
+            SemanticNodeObject(record) =>
+              match record.children {
+                Empty => false
+                Cons { head: edge, tail: _ } =>
+                  stored_edge_label_of(e: edge)
+                    == StructuralLabel { label: CoreMarker { marker: AdmitCallersEdge } }
+              }
+            _ => false
+          }
+      }
+    DecodeAcc { refusal: Present { value: _ }, admission: _ } => false
+  }
+}
+
+// THE NEGATIVE: a marker the closed list does not name refuses as an unknown label. This is the
+// discriminating arm -- if AdmitCallersEdge left core_edge_labels(), the positive claim above
+// would land here too.
+test fn ot_a_marker_the_closed_list_does_not_name_refuses() -> Bool {
+  ot_tag_of(entries: [ot_admit_edge_entry(marker: "core_nonsuch_edge")]) == "label"
+}
diff --git a/dag/test/claim/secret_rotation_witness_test.dag b/dag/test/claim/secret_rotation_witness_test.dag
index 4bc8e9b906b..23c49bdd304 100644
--- a/dag/test/claim/secret_rotation_witness_test.dag
+++ b/dag/test/claim/secret_rotation_witness_test.dag
@@ -552,7 +552,10 @@ test fn retirement_targets_every_enabled_version_except_the_added_one() -> Bool
     ]),
   ) {
     RetirementAuthorized { targets: t, destroy_permitted: d } =>
-      (t |> count) == 2 && !d && t.first().etag == concat("etag-", v1_name)
+      (t |> count) == 2 && !d && match t.first() {
+        Present { value: x } => x.etag == concat("etag-", v1_name)
+        Absent => false
+      }
     RetirementRefused { cause: _ } => false
   }
 }
@@ -637,7 +640,10 @@ test fn retirement_advances_when_the_prior_version_carries_an_etag() -> Bool {
     ]),
   ) {
     RetirementAuthorized { targets: t, destroy_permitted: _ } =>
-      (t |> count) == 1 && t.first().etag == concat("etag-", v2_name)
+      (t |> count) == 1 && match t.first() {
+        Present { value: x } => x.etag == concat("etag-", v2_name)
+        Absent => false
+      }
     RetirementRefused { cause: _ } => false
   }
 }
diff --git a/dag/test/claim/seeded_filler_real_execution_witness_test.dag b/dag/test/claim/seeded_filler_real_execution_witness_test.dag
new file mode 100644
index 00000000000..2e646e53c23
--- /dev/null
+++ b/dag/test/claim/seeded_filler_real_execution_witness_test.dag
@@ -0,0 +1,94 @@
+module test.claim.seeded_filler_real_execution
+
+import std.types { String, NonEmptyStr, Int, Bool, FilePath }
+import std.measure { ByteSize, byte_size, measure_count }
+import std.optional { Present, Absent }
+import extdeps.shell
+import extdeps.tools.coreutils_stat
+import extdeps.tools.coreutils_truncate
+import extdeps.tools.gzip
+import extdeps.tools.sha256sum
+import extdeps.crypto.seeded_filler { seeded_filler_write, SeededFillerWritten, SeededFillerRefused }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE SEEDED FILLER BY REAL EXECUTION: truncate and openssl enc run on the host, inside a directory
+// the witness mints and removes. Three facts the workspace pack relies on: the size is exact, one
+// seed reproduces its bytes, and two seeds give different bytes. The red control is the reason the
+// filler exists at all: a zero file of the same size -- what truncate alone would leave -- gzips to
+// almost nothing, while the filler does not shrink, so a zero or patterned stand-in would understate
+// what kopia and the chunk store pay to carry the real content.
+
+fn with_temp_dir(scenario: fn(String) -> Bool) -> Bool {
+  let dir = shell.Mktemp.Dir()
+  if dir.success == false {
+    false
+  } else {
+    let observed = scenario(dir.path as String)
+    let cleaned = shell.Remove.RecursiveForce(path: dir.path)
+    observed && cleaned.success
+  }
+}
+
+fn written_at(seed: String, size: Int, path: String) -> Bool {
+  match seeded_filler_write(seed: seed as NonEmptyStr, size: byte_size(count: size), path: path as NonEmptyStr) {
+    SeededFillerWritten { path: p, size: s } => (p as String) == path && measure_count(m: s) == size
+    SeededFillerRefused { path: _, step: _, detail: _ } => false
+  }
+}
+
+fn stat_size(path: String) -> Int {
+  let st = coreutils.Stat.PathSize(path: path as NonEmptyStr)
+  match parse_int(s: replace(st.size_text, "\n", "")) {
+    Present { value: n } => if st.success { n } else { -1 }
+    Absent => -1
+  }
+}
+
+fn digest_of(path: String) -> String {
+  let d = sha256sum.Sha256.DigestFile(path: path as NonEmptyStr)
+  if d.success { substring(s: d.line, start: 0, end: 64) } else { join(["unread:", path], "") }
+}
+
+fn gzipped_size(path: String) -> Int {
+  if gzip.Compress.BesideKeepBest(path: path as NonEmptyStr).success { stat_size(path: concat(path, ".gz")) } else { -1 }
+}
+
+test fn a_seeded_filler_is_exactly_its_size_and_reproducible_by_real_execution() -> Bool {
+  with_temp_dir(scenario: dir => {
+    let a1 = join([dir, "/a1"], "")
+    let a2 = join([dir, "/a2"], "")
+    let one = join([dir, "/one"], "")
+    let empty = join([dir, "/empty"], "")
+    written_at(seed: "home/u/.claude/projects/p/s.jsonl", size: 70001, path: a1)
+      && written_at(seed: "home/u/.claude/projects/p/s.jsonl", size: 70001, path: a2)
+      && written_at(seed: "x", size: 1, path: one)
+      && written_at(seed: "x", size: 0, path: empty)
+      && stat_size(path: a1) == 70001 && stat_size(path: one) == 1 && stat_size(path: empty) == 0
+      && digest_of(path: a1) == digest_of(path: a2)
+  })
+}
+
+test fn two_seeds_give_different_fillers_by_real_execution() -> Bool {
+  with_temp_dir(scenario: dir => {
+    let a = join([dir, "/a"], "")
+    let b = join([dir, "/b"], "")
+    written_at(seed: "home/u/.claude/history.jsonl", size: 4096, path: a)
+      && written_at(seed: "home/u/.codex/history.jsonl", size: 4096, path: b)
+      && digest_of(path: a) != digest_of(path: b)
+  })
+}
+
+// THE RED CONTROL: zeros of the same size compress to a sliver; the filler does not compress at all.
+test fn a_zero_stand_in_compresses_and_the_filler_does_not_red_control_by_real_execution() -> Bool {
+  with_temp_dir(scenario: dir => {
+    let filler = join([dir, "/filler"], "")
+    let zeros = join([dir, "/zeros"], "")
+    let size = 262144
+    written_at(seed: "home/u/.claude/projects/p/s.jsonl", size: size, path: filler)
+      && coreutils.Truncate.ToSize(size_bytes: to_string(size) as NonEmptyStr, path: zeros as NonEmptyStr).success
+      && gzipped_size(path: zeros) > 0 && gzipped_size(path: zeros) < size / 100
+      && gzipped_size(path: filler) >= size
+  })
+}
diff --git a/dag/test/claim/self_host_emitted_call_target_realization_witness_test.dag b/dag/test/claim/self_host_emitted_call_target_realization_witness_test.dag
index 882a0809198..06b093815b1 100644
--- a/dag/test/claim/self_host_emitted_call_target_realization_witness_test.dag
+++ b/dag/test/claim/self_host_emitted_call_target_realization_witness_test.dag
@@ -57,7 +57,7 @@ test fn w_map_type_position_still_uses_its_declared_host_realization() -> Bool {
 // seed fallback, instead of silently constructing the structural algebra carrier under that type.
 test fn w_host_map_record_shape_refuses_instead_of_constructing_a_second_carrier() -> Bool {
   compile_dag_rust_emit_check(
-    "module test.claim.map_record_shape_probe\nimport std.types { Int, String, Map }\nimport v2.std.optional { Present }\nfn probe(m: Map<String, Int>, key: String, value: Int) -> Map<String, Int> { Map { lookup: fn(candidate) { if candidate == key { Present { value: value } } else { m.lookup(candidate) } } } }\n",
+    "module test.claim.map_record_shape_probe\nimport std.types { Int, String, Map }\nimport std.optional { Present }\nfn probe(m: Map<String, Int>, key: String, value: Int) -> Map<String, Int> { Map { lookup: fn(candidate) { if candidate == key { Present { value: value } } else { m.lookup(candidate) } } } }\n",
     "src/test_claim_map_record_shape_probe.rs",
     ["HashMap<String, i64>", "record-shaped carrier has no realization"],
     ["FinitelySupportedFunction", "Map {\n"]
@@ -278,10 +278,10 @@ test fn w_clone_bound_forwards_transitively_over_two_call_hops() -> Bool {
 // row proves the qualified path reaches the DECLARATION and not the bridge.
 test fn w_qualified_call_emits_only_the_declaration_last_segment() -> Bool {
   compile_dag_rust_emit_check(
-    "module test.claim.qualified_call_probe\nimport std.types { Int, String, Map }\nimport std.occurrence_identity { OccurrenceId }\nimport v2.std.collection { map_get }\nimport v2.std.diagnostic { Outcome }\nimport v2.std.optional { Optional }\nfn probe(m: Map<String, Int>) -> Outcome<Optional<Int>> { v2.std.collection.map_get(m: m, key: \"key\") }\n",
+    "module test.claim.qualified_call_probe\nimport std.types { Int, String, Map }\nimport std.occurrence_identity { OccurrenceId }\nimport v2.std.collection { map_get_checked }\nimport v2.std.diagnostic { Outcome }\nimport std.optional { Optional }\nfn probe(m: Map<String, Int>) -> Outcome<Optional<Int>> { v2.std.collection.map_get_checked(m: m, key: \"key\") }\n",
     "src/test_claim_qualified_call_probe.rs",
-    ["crate::v2_std_collection::map_get("],
-    ["::v2.std.collection", "v2.std.collection.map_get("]
+    ["crate::v2_std_collection::map_get_checked("],
+    ["::v2.std.collection", "v2.std.collection.map_get_checked("]
   )
 }
 
@@ -696,7 +696,7 @@ test fn w_alias_of_a_keyed_collection_renders_the_host_map_template() -> Bool {
 // call (E0277, three sites in v2_std_collection). The bound is read from the signature.
 test fn w_generic_map_key_parameter_carries_the_host_key_bounds() -> Bool {
   compile_dag_rust_emit_check(
-    "module test.claim.map_key_bound_probe\nimport v2.std.collection { Map, map_lookup }\nimport v2.std.optional { Optional }\nfn probe<K, V>(m: Map<K, V>, key: K) -> Optional<V> {\n  map_lookup(m: m, key: key)\n}\n",
+    "module test.claim.map_key_bound_probe\nimport v2.std.collection { Map, map_lookup }\nimport std.optional { Optional }\nfn probe<K, V>(m: Map<K, V>, key: K) -> Optional<V> {\n  map_lookup(m: m, key: key)\n}\n",
     "src/test_claim_map_key_bound_probe.rs",
     ["pub fn probe<K: Clone + std::cmp::Eq + std::hash::Hash, V"],
     ["pub fn probe<K: Clone, V", "pub fn probe<K, V"]
@@ -751,7 +751,7 @@ test fn w_a_service_op_through_an_aliased_service_value_refuses_instead_of_await
 // so the fail-closed unwrap fired on an argument the callee exists to inspect.
 test fn w_optional_carrier_parameter_takes_the_optional_argument_without_an_unwrap() -> Bool {
   compile_dag_rust_emit_check(
-    "module test.claim.optional_param_probe\nimport std.types { Int }\nimport v2.std.optional { Optional }\nfn inspect(opt: Optional<Int>) -> Optional<Int> { opt }\nfn caller(x: Optional<Int>) -> Optional<Int> { inspect(opt: x) }\n",
+    "module test.claim.optional_param_probe\nimport std.types { Int }\nimport std.optional { Optional }\nfn inspect(opt: Optional<Int>) -> Optional<Int> { opt }\nfn caller(x: Optional<Int>) -> Optional<Int> { inspect(opt: x) }\n",
     "src/test_claim_optional_param_probe.rs",
     ["inspect(x.clone())"],
     [".expect(\"fail-closed: an optional value flowed into non-optional parameter"]
diff --git a/dag/test/claim/served_surface_browser_observation_witness_test.dag b/dag/test/claim/served_surface_browser_observation_witness_test.dag
index b3ae6a72a4d..6e643645789 100644
--- a/dag/test/claim/served_surface_browser_observation_witness_test.dag
+++ b/dag/test/claim/served_surface_browser_observation_witness_test.dag
@@ -125,7 +125,10 @@ test fn witness_bodied_502_retains_network_document() -> Bool {
 
 test fn witness_reload_trial_claims_sufficiency_not_necessity() -> Bool {
   let observation = playwright_chromium_151_linux_arm64_headless_navigation_run.specimens.connection_refused
-  let trial = observation.recovery_trials.first()
-  trial.action == ExplicitReload
-    && trial.outcome == HealthyResponseDocumentObserved
+  match observation.recovery_trials.first() {
+    Present { value: trial } =>
+      trial.action == ExplicitReload
+        && trial.outcome == HealthyResponseDocumentObserved
+    Absent => false
+  }
 }
diff --git a/dag/test/claim/serving/engine_progress_witness_test.dag b/dag/test/claim/serving/engine_progress_witness_test.dag
index b26d14265c9..13ec6d43634 100644
--- a/dag/test/claim/serving/engine_progress_witness_test.dag
+++ b/dag/test/claim/serving/engine_progress_witness_test.dag
@@ -1,11 +1,11 @@
 module test.claim.serving.engine_progress_witness
 
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import std.types { Bool, String, NonEmptyStr, EpochSecs }
 import std.nat { Nat }
 import std.measure { second, second_count }
 import std.optional { Present, Absent }
 import product.fabric.demand { ObservationReceiptRef }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
 import gunbc.serving.serving_enrollment { ServingRouteEndpoint }
 import gunbc.spark.vllm_endpoint_process_launch {
   VllmEndpointProcessLaunch, VllmEndpointProcessLaunchObservation, vllm_endpoint_process_launch, LaunchObserved, LaunchUnobserved,
@@ -26,10 +26,10 @@ import gunbc.serving.engine_progress {
   ServingStepBoundStanding, StepBoundMeasured, StepBoundDeclaredUnmeasured,
 }
 
-data w_endpoint: ServingRouteEndpoint = ServingRouteEndpoint { group: FabricGroupA, address: "192.168.1.225" as NonEmptyStr, port: 30000 }
+data w_endpoint: ServingRouteEndpoint = ServingRouteEndpoint { group: FabricGroupB {}, address: "192.168.1.225" as NonEmptyStr, port: 30000 }
 
 fn w_launch(field: String) -> VllmEndpointProcessLaunch {
-  vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "192.168.1.225:30000" as NonEmptyStr, process_start_field: field as NonEmptyStr)
+  vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "192.168.1.225:30000" as NonEmptyStr, process_start_field: field as NonEmptyStr)
 }
 
 fn w_seen(field: String) -> VllmEndpointProcessLaunchObservation {
@@ -142,7 +142,7 @@ test fn samples_across_a_replaced_exporter_are_unread() -> Bool {
   !w_is_not_progressing(p: p) && w_unread_cause(p: p).contains("replaced")
     && w_unread_cause(p: engine_progress_read(
       endpoint: w_endpoint,
-      before_launch: LaunchUnobserved { group: FabricGroupA, obligation: "metrics did not answer" as NonEmptyStr },
+      before_launch: LaunchUnobserved { group: FabricGroupB {}, obligation: "metrics did not answer" as NonEmptyStr },
       after_launch: w_seen(field: "1789300000.12"),
       before: none,
       after: w_sample(running: 3, counter: "4.0", at: 1789400600),
diff --git a/dag/test/claim/serving/serving_availability_bind_wet_witness_test.dag b/dag/test/claim/serving/serving_availability_bind_wet_witness_test.dag
index 456edc8f037..fe79bf40e5b 100644
--- a/dag/test/claim/serving/serving_availability_bind_wet_witness_test.dag
+++ b/dag/test/claim/serving/serving_availability_bind_wet_witness_test.dag
@@ -1,9 +1,9 @@
 module test.claim.serving.serving_availability_bind_wet_witness
 
 import std.types { Bool, String, NonEmptyStr, List }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import product.fabric.demand { ObservationReceiptRef }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
 import gunbc.serving.serving_enrollment { ServingRouteEndpoint }
 import gunbc.serving.turn_admission {
   BatchQualityTolerant, QueueDepthRead, RouteAdmittingMore, SeatStandingRead,
@@ -30,7 +30,7 @@ import gunbc.harness.harness_seat {
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
-data w_endpoint: ServingRouteEndpoint = ServingRouteEndpoint { group: FabricGroupA, address: "192.168.1.225" as NonEmptyStr, port: 30000 }
+data w_endpoint: ServingRouteEndpoint = ServingRouteEndpoint { group: FabricGroupB {}, address: "192.168.1.225" as NonEmptyStr, port: 30000 }
 
 data w_model: NonEmptyStr = "deepseek-v4-flash:iq3s-split" as NonEmptyStr
 
@@ -45,7 +45,7 @@ fn w_serving_standing() -> HarnessBackendStanding {
 }
 
 fn w_launch(field: String) -> VllmEndpointProcessLaunch {
-  vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "192.168.1.225:30000" as NonEmptyStr, process_start_field: field as NonEmptyStr)
+  vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "192.168.1.225:30000" as NonEmptyStr, process_start_field: field as NonEmptyStr)
 }
 
 fn w_seen(field: String) -> VllmEndpointProcessLaunchObservation {
@@ -85,21 +85,20 @@ fn w_place(declared_units: HarnessDeclaredUnitRoster) -> HarnessCandidates {
     now: 1789400000,
     access: FleetSshContextRefused { cause: "wet witness supplies a refused fleet context so incarnation is unobserved" },
     declared_units: declared_units,
-    participation_roster: HarnessGroupParticipationRoster { group_a: none, group_b: none },
+    participation_roster: HarnessGroupParticipationRoster { group_b: none },
   )
 }
 
-data w_withdrawn_obligation: NonEmptyStr = "fixture: a roster whose Group A standing is unavailable, so the declared unit is the refusal this fold reports" as NonEmptyStr
+data w_withdrawn_obligation: NonEmptyStr = "fixture: a roster whose Group B standing is unavailable, so the declared unit is the refusal this fold reports" as NonEmptyStr
 
 fn w_withdrawn_roster() -> HarnessDeclaredUnitRoster {
   HarnessDeclaredUnitRoster {
-    group_a: DeclaredUnitDigestUnavailable { obligation: w_withdrawn_obligation },
     group_b: DeclaredUnitDigestUnavailable { obligation: w_withdrawn_obligation },
   }
 }
 
 // THE PRODUCTION MINT REACHES THE PRODUCTION FOLD. harness_declared_unit_roster is the function
-// harness_bind_seat calls once per bind; it renders the Group A head unit and DigestStdins those
+// harness_bind_seat calls once per bind; it renders the Group B head unit and DigestStdins those
 // exact bytes, so this row executes the real producer (which is why this file is on the wet lane)
 // AND the real consumer in one claim. With a real digest in hand the fold moves PAST the
 // declared-unit gate and stops at the incarnation, which is unobserved because the fleet context
@@ -111,7 +110,7 @@ fn w_withdrawn_roster() -> HarnessDeclaredUnitRoster {
 // fold decides, this one is about the standing being real and arriving.
 test fn the_production_roster_carries_the_declared_digest_to_the_incarnation_frontier() -> Bool {
   let roster = harness_declared_unit_roster()
-  let minted = match harness_declared_unit_from_roster(roster: roster, group: FabricGroupA) {
+  let minted = match harness_declared_unit_from_roster(roster: roster, group: FabricGroupB {}) {
     DeclaredUnitDigested { evidence: _ } => true
     DeclaredUnitDigestUnavailable { obligation: _ } => false
   }
@@ -122,7 +121,7 @@ test fn the_production_roster_carries_the_declared_digest_to_the_incarnation_fro
 }
 
 // RED, AND IT IS THE DISCRIMINATOR FOR THE ROW ABOVE. The same fold, the same supplied observations,
-// a roster whose Group A standing is unavailable: now the declared unit is what refuses, and the
+// a roster whose Group B standing is unavailable: now the declared unit is what refuses, and the
 // incarnation is never consulted. Without this row the green above could not distinguish "the fold
 // consumed a real digest" from "the fold ignores its roster and always reports the incarnation".
 test fn a_withdrawn_roster_is_refused_at_the_declared_unit_not_the_incarnation() -> Bool {
@@ -148,13 +147,13 @@ test fn a_ready_route_reaches_the_existing_incarnation_frontier_in_the_product_p
   let a = harness_route_availability(endpoint: w_endpoint, before: w_seen(field: field), standing: w_serving_standing(), after: w_seen(field: field), now: w_now)
   let bound = harness_bind_candidate(
     acc: HarnessCandidates { candidates: [], notes: [], retryable: false, incarnations: [] },
-    group: FabricGroupA, endpoint: w_endpoint, launch: launch, availability: a,
+    group: FabricGroupB {}, endpoint: w_endpoint, launch: launch, availability: a,
     readback: w_readback(),
     incarnation: EndpointIncarnationUnobserved { obligation: spark_serving_incarnation_unobserved_obligation },
     route: harness_serving_route(
-      group: FabricGroupA, launch: launch, readback: w_readback(),
+      group: FabricGroupB {}, launch: launch, readback: w_readback(),
       incarnation: EndpointIncarnationUnobserved { obligation: spark_serving_incarnation_unobserved_obligation },
-      declared_unit: harness_declared_unit_from_roster(roster: harness_declared_unit_roster(), group: FabricGroupA),
+      declared_unit: harness_declared_unit_from_roster(roster: harness_declared_unit_roster(), group: FabricGroupB {}),
       participation: none,
     ),
     subject: harness_turn_subject(request: harness_turn_request(shape: OpenAiChatCompletionsShape, requirement: AnyAdmittedModel, inputs: ["witness"]), attempt: "witness-attempt" as NonEmptyStr),
diff --git a/dag/test/claim/serving/serving_availability_witness_test.dag b/dag/test/claim/serving/serving_availability_witness_test.dag
index 722ccf26456..bba69030e5c 100644
--- a/dag/test/claim/serving/serving_availability_witness_test.dag
+++ b/dag/test/claim/serving/serving_availability_witness_test.dag
@@ -1,9 +1,9 @@
 module test.claim.serving.serving_availability_witness
 
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import std.types { Bool, String, NonEmptyStr }
 import std.measure { second_count }
 import product.fabric.demand { ObservationReceiptRef }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
 import gunbc.serving.serving_enrollment { ServingRouteEndpoint }
 import gunbc.spark.vllm_endpoint_process_launch {
   VllmEndpointProcessLaunch, VllmEndpointProcessLaunchObservation, vllm_endpoint_process_launch, LaunchObserved, LaunchUnobserved,
@@ -23,11 +23,11 @@ import gunbc.serving.serving_availability {
 }
 import gunbc.spark.serving_offer { ServingObserved, ServingUnobserved, spark_serving_readiness_of, spark_serving_incarnation_unobserved_obligation }
 
-data w_endpoint: ServingRouteEndpoint = ServingRouteEndpoint { group: FabricGroupA, address: "192.168.1.225" as NonEmptyStr, port: 30000 }
+data w_endpoint: ServingRouteEndpoint = ServingRouteEndpoint { group: FabricGroupB {}, address: "192.168.1.225" as NonEmptyStr, port: 30000 }
 
 // An address from TEST-NET-1 (RFC 5737): reserved for documentation and never routed, so a live run
 // cannot reach a real engine, and the bounded probe must give up inside its bound rather than hang.
-data w_unroutable_endpoint: ServingRouteEndpoint = ServingRouteEndpoint { group: FabricGroupA, address: "192.0.2.1" as NonEmptyStr, port: 30000 }
+data w_unroutable_endpoint: ServingRouteEndpoint = ServingRouteEndpoint { group: FabricGroupB {}, address: "192.0.2.1" as NonEmptyStr, port: 30000 }
 
 data w_now: String = "1789400000"
 
@@ -40,7 +40,7 @@ fn w_serving_standing() -> HarnessBackendStanding {
 }
 
 fn w_launch(field: String) -> VllmEndpointProcessLaunch {
-  vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "192.168.1.225:30000" as NonEmptyStr, process_start_field: field as NonEmptyStr)
+  vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "192.168.1.225:30000" as NonEmptyStr, process_start_field: field as NonEmptyStr)
 }
 
 fn w_seen(field: String) -> VllmEndpointProcessLaunchObservation {
@@ -123,7 +123,7 @@ test fn the_launch_only_read_reports_continuity_and_its_three_arms() -> Bool {
   let bound = w_launch(field: "1789300000.12")
   let unchanged = serving_availability_after_launch_read(endpoint: w_endpoint, expected: bound, observation: w_seen(field: "1789300000.12"), now: w_now).reading
   let replaced = serving_availability_after_launch_read(endpoint: w_endpoint, expected: bound, observation: w_seen(field: "1789399999.50"), now: w_now).reading
-  let unread = serving_availability_after_launch_read(endpoint: w_endpoint, expected: bound, observation: LaunchUnobserved { group: FabricGroupA, obligation: "metrics did not answer" as NonEmptyStr }, now: w_now).reading
+  let unread = serving_availability_after_launch_read(endpoint: w_endpoint, expected: bound, observation: LaunchUnobserved { group: FabricGroupB {}, obligation: "metrics did not answer" as NonEmptyStr }, now: w_now).reading
   (match unchanged {
     EndpointProcessUnchanged { endpoint: _, launch: l, observed_at: _, receipt: _ } => (vllm_endpoint_process_launch_key(launch: l) as String).contains("1789300000.12")
     EndpointProcessWasReplaced { endpoint: _, expected: _, observed: _, observed_at: _, receipt: _ } => false
@@ -164,8 +164,8 @@ test fn a_front_door_that_did_not_answer_within_the_bound_is_unavailable_and_not
 test fn an_unadmitted_model_is_still_available_and_unreadable_readings_are_unread() -> Bool {
   let not_admitted = harness_route_availability(endpoint: w_endpoint, before: w_seen(field: "1789300000.12"), standing: HarnessBackendModelNotAdmitted { advertised: "tinyllama-1.1b" }, after: w_seen(field: "1789300000.12"), now: w_now)
   let unreadable = harness_route_availability(endpoint: w_endpoint, before: w_seen(field: "1789300000.12"), standing: HarnessBackendUnreadable { cause: "unexpected token" }, after: w_seen(field: "1789300000.12"), now: w_now)
-  let before_unread = harness_route_availability(endpoint: w_endpoint, before: LaunchUnobserved { group: FabricGroupA, obligation: "metrics did not answer" as NonEmptyStr }, standing: w_serving_standing(), after: w_seen(field: "1789300000.12"), now: w_now)
-  let after_unread = harness_route_availability(endpoint: w_endpoint, before: w_seen(field: "1789300000.12"), standing: w_serving_standing(), after: LaunchUnobserved { group: FabricGroupA, obligation: "metrics did not answer" as NonEmptyStr }, now: w_now)
+  let before_unread = harness_route_availability(endpoint: w_endpoint, before: LaunchUnobserved { group: FabricGroupB {}, obligation: "metrics did not answer" as NonEmptyStr }, standing: w_serving_standing(), after: w_seen(field: "1789300000.12"), now: w_now)
+  let after_unread = harness_route_availability(endpoint: w_endpoint, before: w_seen(field: "1789300000.12"), standing: w_serving_standing(), after: LaunchUnobserved { group: FabricGroupB {}, obligation: "metrics did not answer" as NonEmptyStr }, now: w_now)
   w_available_from(a: not_admitted, field: "1789300000.12")
     && w_is_unread(a: unreadable)
     && w_is_unread(a: before_unread)
diff --git a/dag/test/claim/serving/serving_front_door_witness_test.dag b/dag/test/claim/serving/serving_front_door_witness_test.dag
index 575ec452b87..1dcfa0991bf 100644
--- a/dag/test/claim/serving/serving_front_door_witness_test.dag
+++ b/dag/test/claim/serving/serving_front_door_witness_test.dag
@@ -28,7 +28,7 @@ import product.capacity.redemption {
   redemption_release_owner, redemption_recovery,
 }
 import gunbc.serving.turn_admission { ServingCoTenancyClass, InteractiveQualitySensitive, BatchQualityTolerant }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import gunbc.spark.vllm_endpoint_process_launch { VllmEndpointProcessLaunch, vllm_endpoint_process_launch, vllm_endpoint_process_launch_key }
 import gunbc.serving.serving_front_door {
   ServingSeatPermit, ServingSeatPermitClaims, FrontDoorIdentity, FrontDoorVerdict, FrontDoorForward, FrontDoorRefused,
@@ -37,7 +37,7 @@ import gunbc.serving.serving_front_door {
   DoorSeatHeldByAnotherCaller, DoorSeatLeaseExpired, DoorPermitPartitionNotThisPool, DoorPermitClassNotServed,
   DoorSeatAmountNotOneSeat, DoorSeatAcquiredMoreThanOnce, DoorSeatFenceGenerationDisagrees, DoorPermitAlreadyRedeemed,
   FrontDoorRedemption, DoorRedeemed, DoorRedemptionRefused,
-  DoorPoolConfiguredForAnotherGroup, DoorPoolConfiguredTwice, DoorPoolSelected, front_door_pool_for,
+  DoorPoolConfiguredTwice, DoorPoolSelected, front_door_pool_for,
   PlanLeaveWithHolder, PlanRelease, front_door_recovery_plan,
   SeatGrantCurrency, FrontDoorTally,
   serving_seat_permit_claims, serving_seat_permit_signing_input, issue_serving_seat_permit, serving_seat_permit_key_id,
@@ -59,9 +59,8 @@ data witness_key: MacKey = MacKey {
   material: "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f" as Secret,
 }
 
-data quality_pool: HarnessSeatPoolIdentity = harness_seat_pool_identity_at(group: FabricGroupB, class: InteractiveQualitySensitive, seats: 1)
-data tolerant_pool: HarnessSeatPoolIdentity = harness_seat_pool_identity_at(group: FabricGroupB, class: BatchQualityTolerant, seats: 2)
-data group_a_pool: HarnessSeatPoolIdentity = harness_seat_pool_identity_at(group: FabricGroupA, class: InteractiveQualitySensitive, seats: 1)
+data quality_pool: HarnessSeatPoolIdentity = harness_seat_pool_identity_at(group: FabricGroupB {}, class: InteractiveQualitySensitive, seats: 1)
+data tolerant_pool: HarnessSeatPoolIdentity = harness_seat_pool_identity_at(group: FabricGroupB {}, class: BatchQualityTolerant, seats: 2)
 data witness_partition: PartitionId = quality_pool.partition
 data witness_attempt: NonEmptyStr = "attempt-7" as NonEmptyStr
 data witness_admitting: EventId = "ev-acquire-7" as EventId
@@ -69,13 +68,10 @@ data witness_granted_at: EpochSecs = 1000
 data witness_term: EpochSecs = 600
 
 data group_b_launch: VllmEndpointProcessLaunch = vllm_endpoint_process_launch(
-  group: FabricGroupB, endpoint: "http://192.168.1.236:30000" as NonEmptyStr, process_start_field: "launch-1" as NonEmptyStr,
+  group: FabricGroupB {}, endpoint: "http://192.168.1.236:30000" as NonEmptyStr, process_start_field: "launch-1" as NonEmptyStr,
 )
 data group_b_relaunch: VllmEndpointProcessLaunch = vllm_endpoint_process_launch(
-  group: FabricGroupB, endpoint: "http://192.168.1.236:30000" as NonEmptyStr, process_start_field: "launch-2" as NonEmptyStr,
-)
-data group_a_launch: VllmEndpointProcessLaunch = vllm_endpoint_process_launch(
-  group: FabricGroupA, endpoint: "http://192.168.1.232:30000" as NonEmptyStr, process_start_field: "launch-1" as NonEmptyStr,
+  group: FabricGroupB {}, endpoint: "http://192.168.1.236:30000" as NonEmptyStr, process_start_field: "launch-2" as NonEmptyStr,
 )
 
 fn seat_for(attempt: NonEmptyStr, launch: VllmEndpointProcessLaunch) -> HarnessSeatReference {
@@ -101,7 +97,7 @@ data witness_grant: LeaseGrant = lease_grant(
   policy: LeasePolicy { maximum_duration_seconds: witness_term, release_law: QuiescenceRequired },
 )
 
-data group_b_door: FrontDoorIdentity = FrontDoorIdentity { group: FabricGroupB, launch: group_b_launch, suite: HmacSha256, pools: [quality_pool, tolerant_pool] }
+data group_b_door: FrontDoorIdentity = FrontDoorIdentity { group: FabricGroupB {}, launch: group_b_launch, suite: HmacSha256, pools: [quality_pool, tolerant_pool] }
 
 data service_caller: RequestAuthenticationEvidence = FabricServiceEvidence {
   kind: FabricServiceEvidenceSubmissionMac, authenticated_at: "2026-10-03T00:00:00Z",
@@ -216,7 +212,7 @@ test fn a_valid_caller_with_no_seat_grant_is_refused_and_the_refusal_is_counted(
 }
 
 test fn a_permit_granted_on_another_group_is_refused() -> Bool {
-  let v = door_verdict(evidence: service_caller, presented: permit_of(claims: claims_on(launch: group_a_launch, group_wire: "group-a")), at: 1100, history: held_history)
+  let v = door_verdict(evidence: service_caller, presented: permit_of(claims: claims_on(launch: group_b_launch, group_wire: "group-not-this-door")), at: 1100, history: held_history)
   match v {
     FrontDoorRefused { cause: DoorPermitForAnotherGroup { permit_group: _, door_group: _ } } => true
     _ => false
@@ -384,7 +380,7 @@ test fn a_permit_naming_a_same_group_partition_that_is_not_a_seat_pool_is_refuse
 }
 
 test fn a_permit_naming_another_groups_seat_partition_is_refused() -> Bool {
-  match door_verdict(evidence: service_caller, presented: forged(seat: witness_seat, partition: group_a_pool.partition, expires_at: 1600), at: 1100, history: held_history) {
+  match door_verdict(evidence: service_caller, presented: forged(seat: witness_seat, partition: "group-group-not-this-door-quality-seat-v1" as PartitionId, expires_at: 1600), at: 1100, history: held_history) {
     FrontDoorRefused { cause: DoorPermitPartitionNotThisPool { partition: _, pool_partition: _ } } => true
     _ => false
   }
@@ -398,7 +394,7 @@ test fn a_permit_whose_class_and_partition_disagree_is_refused() -> Bool {
 }
 
 test fn a_permit_for_a_class_the_door_serves_no_pool_for_is_refused() -> Bool {
-  let quality_only = FrontDoorIdentity { group: FabricGroupB, launch: group_b_launch, suite: HmacSha256, pools: [quality_pool] }
+  let quality_only = FrontDoorIdentity { group: FabricGroupB {}, launch: group_b_launch, suite: HmacSha256, pools: [quality_pool] }
   let presented = forged_with(seat: witness_seat, partition: tolerant_pool.partition, class: BatchQualityTolerant, generation: 1, expires_at: 1600)
   match front_door_admit(
     evidence: service_caller, presented: presented, mac_result: mac_for(presented: presented), door: quality_only, observed_at: 1100, request: request_one,
@@ -604,7 +600,7 @@ test fn a_seat_whose_use_ended_but_was_not_released_is_released_by_recovery() ->
 // ── The door's pools belong to the door's group ──────────────────────────────────────────────
 
 fn door_with(pools: List<HarnessSeatPoolIdentity>) -> FrontDoorIdentity {
-  FrontDoorIdentity { group: FabricGroupB, launch: group_b_launch, suite: HmacSha256, pools: pools }
+  FrontDoorIdentity { group: FabricGroupB {}, launch: group_b_launch, suite: HmacSha256, pools: pools }
 }
 
 fn verdict_at_door(door: FrontDoorIdentity) -> FrontDoorVerdict {
@@ -616,13 +612,6 @@ fn verdict_at_door(door: FrontDoorIdentity) -> FrontDoorVerdict {
   )
 }
 
-test fn a_door_configured_with_another_groups_pool_for_the_class_refuses() -> Bool {
-  match verdict_at_door(door: door_with(pools: [group_a_pool, tolerant_pool])) {
-    FrontDoorRefused { cause: DoorPoolConfiguredForAnotherGroup { class: _, pool_group: g } } => (g as String) == "group-a"
-    _ => false
-  }
-}
-
 test fn a_door_configured_with_two_pools_for_one_class_refuses_rather_than_choosing() -> Bool {
   match verdict_at_door(door: door_with(pools: [quality_pool, quality_pool, tolerant_pool])) {
     FrontDoorRefused { cause: DoorPoolConfiguredTwice { class: _, pools: n } } => n == 2
@@ -632,7 +621,7 @@ test fn a_door_configured_with_two_pools_for_one_class_refuses_rather_than_choos
 
 test fn the_pool_derived_for_the_doors_own_group_still_admits() -> Bool {
   let selected = match front_door_pool_for(door: group_b_door, class: InteractiveQualitySensitive) {
-    DoorPoolSelected { pool: p } => (p.partition as String) == (harness_seat_pool_identity_at(group: FabricGroupB, class: InteractiveQualitySensitive, seats: 1).partition as String)
+    DoorPoolSelected { pool: p } => (p.partition as String) == (harness_seat_pool_identity_at(group: FabricGroupB {}, class: InteractiveQualitySensitive, seats: 1).partition as String)
     _ => false
   }
   let admits = match verdict_at_door(door: group_b_door) {
diff --git a/dag/test/claim/serving/turn_admission_witness_test.dag b/dag/test/claim/serving/turn_admission_witness_test.dag
index ac4b94ae62d..4215873a15c 100644
--- a/dag/test/claim/serving/turn_admission_witness_test.dag
+++ b/dag/test/claim/serving/turn_admission_witness_test.dag
@@ -4,7 +4,7 @@ import std.types { Bool, String, NonEmptyStr }
 import std.optional { Present, Absent }
 import product.fabric.demand { ObservationReceiptRef }
 import product.fabric.selection { AvailableIndefinitely, NoTransitionRequired, NoFeasibleAlternativeUse }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import gunbc.spark.vllm_endpoint_process_launch {
   vllm_endpoint_process_launch, vllm_endpoint_process_launch_key, vllm_endpoint_process_launch_is,
   LaunchObserved, LaunchUnobserved,
@@ -145,7 +145,7 @@ test fn unreadable_admission_evidence_never_admits() -> Bool {
     && (t_disposition(a: a) != "admissible")
     && (t_disposition(a: a) != "pending-retry")
     && (t_disposition(a: a) == "refused-measure")
-    && string_contains(s: serving_admission_detail(group: FabricGroupA, admission: a), pattern: "occupancy unread, which is not idle")
+    && string_contains(s: serving_admission_detail(group: FabricGroupB {}, admission: a), pattern: "occupancy unread, which is not idle")
 }
 
 // ── AN OCCUPIED GROUP IS NOT A WORSE CANDIDATE; IT IS NOT A CANDIDATE ─────────────────────────
@@ -159,7 +159,7 @@ test fn an_occupied_group_refuses_a_fresh_cold_prefill() -> Bool {
   (match a { InadmissibleUnexplainedOccupancy { occupants: n, seated: _ } => n == 1  _ => false })
     && (t_disposition(a: a) != "admissible")
     && (t_disposition(a: a) == "pending-retry")
-    && string_contains(s: serving_admission_detail(group: FabricGroupB, admission: a), pattern: "a turn nobody seated may be one somebody is reading")
+    && string_contains(s: serving_admission_detail(group: FabricGroupB {}, admission: a), pattern: "a turn nobody seated may be one somebody is reading")
 }
 
 // A GROUP WITH WORK WAITING IS NOT IDLE EITHER. The request admitted and waiting starts the moment
@@ -208,7 +208,7 @@ test fn an_admitted_candidate_carries_no_priced_estimate() -> Bool {
 
 // ── A RESTART IS A NEW OFFER SUBJECT ──────────────────────────────────────────────────────────
 //
-// Keyed on the group, group A's first invocation and its successor are one offer, and the
+// Keyed on the group, a group's first invocation and its successor are one offer, and the
 // predecessor's readiness, queue and capacity evidence price the successor. Keyed on the launch they
 // are two, which is what lets a seat taken against one engine fail to authorize a request against
 // the engine that replaced it.
@@ -217,12 +217,10 @@ test fn an_admitted_candidate_carries_no_priced_estimate() -> Bool {
 // a field the key and the equality both ignored, which is the shape where a carrier holds a fact its
 // identity does not agree to.
 test fn a_restarted_engine_is_a_different_offer_subject() -> Bool {
-  let first = vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "192.168.1.232" as NonEmptyStr, process_start_field: "1757200000.5" as NonEmptyStr)
-  let second = vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "192.168.1.232" as NonEmptyStr, process_start_field: "1757209999.25" as NonEmptyStr)
-  let other_group = vllm_endpoint_process_launch(group: FabricGroupB, endpoint: "192.168.1.233" as NonEmptyStr, process_start_field: "1757200000.5" as NonEmptyStr)
-  let relocated = vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "192.168.1.240" as NonEmptyStr, process_start_field: "1757200000.5" as NonEmptyStr)
+  let first = vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "192.168.1.232" as NonEmptyStr, process_start_field: "1757200000.5" as NonEmptyStr)
+  let second = vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "192.168.1.232" as NonEmptyStr, process_start_field: "1757209999.25" as NonEmptyStr)
+  let relocated = vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "192.168.1.240" as NonEmptyStr, process_start_field: "1757200000.5" as NonEmptyStr)
   !vllm_endpoint_process_launch_is(launch: first, other: second)
-    && !vllm_endpoint_process_launch_is(launch: first, other: other_group)
     && vllm_endpoint_process_launch_is(launch: first, other: first)
     && ((vllm_endpoint_process_launch_key(launch: first) as String) != (vllm_endpoint_process_launch_key(launch: second) as String))
     && !vllm_endpoint_process_launch_is(launch: first, other: relocated)
@@ -235,11 +233,11 @@ test fn an_unnameable_launch_is_not_offered() -> Bool {
     "vllm:num_requests_waiting\{model_name=\"deepseek\"} 0.0\n",
     "vllm:num_requests_running\{model_name=\"deepseek\"} 0.0\n",
   ], "")
-  (match harness_launch_from_body(group: FabricGroupA, address: "192.168.1.232", body: no_process_line) {
+  (match harness_launch_from_body(group: FabricGroupB {}, address: "192.168.1.232", body: no_process_line) {
      LaunchUnobserved { group: _, obligation: o } => string_contains(s: o as String, pattern: "cannot be named")
      LaunchObserved { launch: _, receipt: _ } => false
    })
-    && (match harness_launch_from_body(group: FabricGroupA, address: "192.168.1.232", body: metrics_body(waiting: "0.0", running: "0.0", start: "1757200000.5")) {
+    && (match harness_launch_from_body(group: FabricGroupB {}, address: "192.168.1.232", body: metrics_body(waiting: "0.0", running: "0.0", start: "1757200000.5")) {
           LaunchObserved { launch: l, receipt: _ } => (l.process_start_field as String) == "1757200000.5"
           LaunchUnobserved { group: _, obligation: _ } => false
         })
diff --git a/dag/test/claim/serving_routing_witness_test.dag b/dag/test/claim/serving_routing_witness_test.dag
index d9928bb3401..e9e21fa2d69 100644
--- a/dag/test/claim/serving_routing_witness_test.dag
+++ b/dag/test/claim/serving_routing_witness_test.dag
@@ -2,7 +2,7 @@ module test.claim.serving_routing_witness
 
 import std.types { Bool, String, NonEmptyStr }
 import std.nat { Nat }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 import gunbc.serving.serving_enrollment {
   serving_enrolled_groups, serving_route, serving_route_ceiling, serving_route_endpoint_wire,
   serving_route_turn_ceiling_count, ServingRouteResolved, ServingRouteUnresolved,
@@ -13,7 +13,7 @@ import gunbc.serving.admitted_model {
   serving_admits_id, serving_admit_advertised, ServingModelAdmitted, ServingModelNotAdmitted,
 }
 import gunbc.harness.harness_reasoning_wire {
-  DeepseekV4FlashOnVllm, Glm53FlashOnVllm, harness_unit_model_id,
+  DeepseekV4FlashOnVllm, Glm53FlashOnVllm, NemotronUltraFreeOnOpenRouter, harness_unit_model_id,
   harness_unit_declared_context_ceiling,
 }
 import gunbc.harness.harness_wire { harness_context_budget_for }
@@ -42,12 +42,10 @@ import gunbc.spark.vllm_endpoint_process_launch { vllm_endpoint_process_launch,
 import std.measure { token_count_value }
 import product.fabric.demand { ObservationReceiptRef }
 
-// ── 1. BOTH GROUPS ARE ENROLLED, AND EACH ROUTE CARRIES ITS OWN FRONT DOOR ────────────────────
+// ── 1. GROUP B IS THE ENROLLED ROUTE, AND IT CARRIES ITS OWN FRONT DOOR ───────────────────────
 //
-// THE DISCRIMINATING HALF IS THE ENDPOINT, not the count. A roster of two whose routes shared one
-// endpoint row would pass a membership count and would still be a defect: each route answers on its own
-// head. Both routes now serve on port 30000, so the endpoints differ by ADDRESS -- group A's pair head
-// and group B's rank-zero head of the arm converged on it -- and each is asserted to resolve.
+// THE DISCRIMINATING HALF IS THE ENDPOINT, not the count: the route must resolve to group B's
+// rank-zero head of the arm converged on it, on port 30000.
 //
 // GROUP B'S PORT IS THE CONVERGED ARM'S. This claim used to pin ":30001", the retired exl3 canary's
 // port, so the witness certified the very value a real dispatch refused on (2026-09-18: nothing
@@ -59,20 +57,16 @@ fn w_endpoint(group: FabricGroup) -> String {
   }
 }
 
-test fn both_groups_are_enrolled_and_each_route_has_its_own_front_door() -> Bool {
-  length(serving_enrolled_groups) == 2
-    && w_endpoint(group: FabricGroupA) != "unresolved"
-    && w_endpoint(group: FabricGroupB) != "unresolved"
-    && w_endpoint(group: FabricGroupA) != w_endpoint(group: FabricGroupB)
-    && ends_with(s: w_endpoint(group: FabricGroupA), suffix: ":30000")
-    && ends_with(s: w_endpoint(group: FabricGroupB), suffix: ":30000")
+test fn group_b_is_enrolled_and_its_route_has_its_own_front_door() -> Bool {
+  length(serving_enrolled_groups) == 1
+    && w_endpoint(group: FabricGroupB {}) != "unresolved"
+    && ends_with(s: w_endpoint(group: FabricGroupB {}), suffix: ":30000")
 }
 
-// ── 2. A ROUTE'S CEILING IS A DECLARED DECISION, AND THE TWO ROUTES DISAGREE ──────────────────
+// ── 2. A ROUTE'S CEILING IS A DECLARED DECISION ───────────────────────────────────────────────
 //
-// Asserting the counts alone would go green on a single shared row, so what matters is that the two
-// routes read DIFFERENT attributed rows -- group A's allocation decided 2026-09-11 and group B's
-// route offer decided 2026-10-02 -- which no single constant can produce.
+// Asserting the count alone would go green on any constant, so the claim also reads the attributed
+// row: group B's route offer decided 2026-10-02.
 fn w_ceiling_row(group: FabricGroup) -> ServingRouteTurnCeiling? {
   match serving_route_ceiling(group: group) {
     RouteCeilingStands { ceiling: c } => Present { value: c }
@@ -88,17 +82,8 @@ fn w_ceiling(group: FabricGroup) -> Nat {
 }
 
 test fn each_route_declares_its_own_turn_ceiling_and_none_of_them_is_a_measurement() -> Bool {
-  w_ceiling(group: FabricGroupA) == 4
-    && w_ceiling(group: FabricGroupB) == 8
-    && (match w_ceiling_row(group: FabricGroupA) {
-          Present { value: row } => match row {
-            CeilingByDeclaredPolicy { count: _, decider: d, decided_on: on, basis: _ } =>
-              (d as String) != "" && (on as String) == "2026-09-11"
-            CeilingFromRouteLaunch { count: _, basis: _ } => false
-          }
-          Absent => false
-        })
-    && (match w_ceiling_row(group: FabricGroupB) {
+  w_ceiling(group: FabricGroupB {}) == 8
+    && (match w_ceiling_row(group: FabricGroupB {}) {
           Present { value: row } => match row {
             CeilingByDeclaredPolicy { count: c, decider: d, decided_on: on, basis: _ } =>
               c == 8 && (d as String) != "" && (on as String) == "2026-10-02"
@@ -126,7 +111,7 @@ fn w_unit_is_glm(id: String) -> Bool {
   match serving_admits_id(id: id) {
     ServingModelNotAdmitted { advertised: _ } => false
     ServingModelAdmitted { id: _, unit: u } =>
-      match u { Glm53FlashOnVllm => true  DeepseekV4FlashOnVllm => false }
+      match u { Glm53FlashOnVllm => true  DeepseekV4FlashOnVllm => false  NemotronUltraFreeOnOpenRouter => false }
   }
 }
 
@@ -174,7 +159,7 @@ test fn the_admitted_id_is_the_advertised_one_and_not_the_units_canonical_id() -
      ServingModelAdmitted { id: i, unit: u } =>
        (i as String) == "glm-5.3-flash"
          && (i as String) != (harness_unit_model_id(unit: Glm53FlashOnVllm) as String)
-         && (match u { Glm53FlashOnVllm => true  DeepseekV4FlashOnVllm => false })
+         && (match u { Glm53FlashOnVllm => true  DeepseekV4FlashOnVllm => false  NemotronUltraFreeOnOpenRouter => false })
      ServingModelNotAdmitted { advertised: _ } => false
    })
     && (harness_unit_model_id(unit: Glm53FlashOnVllm) as String) != "glm-5.3-flash"
@@ -187,9 +172,9 @@ test fn the_admitted_id_is_the_advertised_one_and_not_the_units_canonical_id() -
 // route advertising nothing admitted -- must be unobserved, because an offer is bound only on an
 // observed readiness.
 fn w_ready(standing: HarnessBackendStanding) -> Bool {
-  let launch = vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "192.168.1.225:30000" as NonEmptyStr, process_start_field: "1757100000.5" as NonEmptyStr)
+  let launch = vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "192.168.1.225:30000" as NonEmptyStr, process_start_field: "1757100000.5" as NonEmptyStr)
   let seen = LaunchObserved { launch: launch, receipt: "test.claim.serving-routing" as ObservationReceiptRef }
-  let availability = harness_route_availability(endpoint: ServingRouteEndpoint { group: FabricGroupA, address: "192.168.1.225" as NonEmptyStr, port: 30000 }, before: seen, standing: standing, after: seen, now: "1757200000")
+  let availability = harness_route_availability(endpoint: ServingRouteEndpoint { group: FabricGroupB {}, address: "192.168.1.225" as NonEmptyStr, port: 30000 }, before: seen, standing: standing, after: seen, now: "1757200000")
   let admitted = match standing {
     HarnessBackendServing { model: _, unit: _, readback: _ } => true
     HarnessBackendModelNotAdmitted { advertised: _ } => false
@@ -329,17 +314,16 @@ test fn an_occupant_the_seat_ledger_did_not_admit_blocks_both_classes() -> Bool
 // and the quality ceiling is still one. A branch that widened the reader's protection would fail
 // here, which is the control the ruling asked for.
 test fn each_class_holds_its_own_pool_and_the_quality_seat_is_still_one() -> Bool {
-  (harness_seat_partition(group: FabricGroupA, class: InteractiveQualitySensitive, ceiling: 1) as String) == "group-group-a-quality-seat-v1"
-    && (harness_seat_partition(group: FabricGroupB, class: InteractiveQualitySensitive, ceiling: 1) as String) == "group-group-b-quality-seat-v1"
-    && (harness_seat_partition(group: FabricGroupA, class: BatchQualityTolerant, ceiling: 4) as String) == "group-group-a-tolerant-seat-c4-v1"
-    && (harness_seat_partition(group: FabricGroupA, class: InteractiveQualitySensitive, ceiling: 1) as String) != (harness_seat_partition(group: FabricGroupA, class: BatchQualityTolerant, ceiling: 4) as String)
+  (harness_seat_partition(group: FabricGroupB {}, class: InteractiveQualitySensitive, ceiling: 1) as String) == "group-group-b-quality-seat-v1"
+    && (harness_seat_partition(group: FabricGroupB {}, class: BatchQualityTolerant, ceiling: 4) as String) == "group-group-b-tolerant-seat-c4-v1"
+    && (harness_seat_partition(group: FabricGroupB {}, class: InteractiveQualitySensitive, ceiling: 1) as String) != (harness_seat_partition(group: FabricGroupB {}, class: BatchQualityTolerant, ceiling: 4) as String)
     && harness_interactive_quality_seats == 1
 }
 
 // ── A CEILING THAT MOVES NAMES A DIFFERENT POOL, WHICH IS THE POINT OF PUTTING IT IN THE NAME ──
 //
 // THE FAILURE THIS FORBIDS. The tolerant ceiling is derived from rows in OTHER modules -- the
-// declared allocations for group A and group B -- so the author who moves one
+// declared route allocation for group B -- so the author who moves one
 // is editing a file that never mentions this partition. If the name did not carry the ceiling,
 // acquire events written under the old one would be replayed against the new root and reinterpreted
 // rather than continued, which is the module's own invariant violated by an edit made somewhere that
@@ -356,11 +340,11 @@ test fn each_class_holds_its_own_pool_and_the_quality_seat_is_still_one() -> Boo
 // the quality pool's continuity, and one that versioned nothing would reinterpret the tolerant
 // pool's history.
 test fn the_tolerant_partition_is_keyed_by_its_ceiling_and_the_quality_partition_is_not() -> Bool {
-  (harness_seat_partition(group: FabricGroupB, class: BatchQualityTolerant, ceiling: 1) as String)
-      != (harness_seat_partition(group: FabricGroupB, class: BatchQualityTolerant, ceiling: 2) as String)
-    && (harness_seat_partition(group: FabricGroupB, class: InteractiveQualitySensitive, ceiling: 1) as String)
-      == (harness_seat_partition(group: FabricGroupB, class: InteractiveQualitySensitive, ceiling: 2) as String)
-    && (harness_seat_partition(group: FabricGroupB, class: BatchQualityTolerant, ceiling: 1) as String) == "group-group-b-tolerant-seat-c1-v1"
+  (harness_seat_partition(group: FabricGroupB {}, class: BatchQualityTolerant, ceiling: 1) as String)
+      != (harness_seat_partition(group: FabricGroupB {}, class: BatchQualityTolerant, ceiling: 2) as String)
+    && (harness_seat_partition(group: FabricGroupB {}, class: InteractiveQualitySensitive, ceiling: 1) as String)
+      == (harness_seat_partition(group: FabricGroupB {}, class: InteractiveQualitySensitive, ceiling: 2) as String)
+    && (harness_seat_partition(group: FabricGroupB {}, class: BatchQualityTolerant, ceiling: 1) as String) == "group-group-b-tolerant-seat-c1-v1"
 }
 
 // ── 7. A MODEL-INDIFFERENT DEMAND AND AN EXACT ONE ARE DIFFERENT DEMANDS ──────────────────────
@@ -389,25 +373,16 @@ test fn the_context_budget_never_exceeds_the_bound_units_own_declared_ceiling()
       <= token_count_value(t: harness_unit_declared_context_ceiling(unit: Glm53FlashOnVllm))
 }
 
-// THE SERVICE-IDENTITY FACTS ARE THE GROUP'S OWN. Group A is observed through the pair-serving
-// container and unit; group B through the native arm's. A harness that still read pair-serving
-// names for group B would inspect a container that does not exist on srv9 and compare the GLM
-// engine's reported model path against the DeepSeek declaration -- both failures were measured on
-// the live end-to-end run of 2026-09-16. The declared model paths must also differ, since the two
-// groups serve different checkpoints.
-test fn each_groups_service_identity_comes_from_its_own_launch_authority() -> Bool {
-  let a = serving_group_launch(group: FabricGroupA)
-  let b = serving_group_launch(group: FabricGroupB)
-  (a.container_name as String) == "gunbc-spark-pair"
-    && (b.container_name as String) == "glm-native-tp4"
-    && (a.head_unit_name as String) == "gunbc-spark-pair-head.service"
+// THE SERVICE-IDENTITY FACTS ARE THE GROUP'S OWN. Group B is observed through the native arm's
+// container and unit. A harness that read pair-serving names for group B would inspect a container
+// that does not exist on srv9 -- measured on the live end-to-end run of 2026-09-16.
+test fn group_bs_service_identity_comes_from_its_own_launch_authority() -> Bool {
+  let b = serving_group_launch(group: FabricGroupB {})
+  (b.container_name as String) == "glm-native-tp4"
+    && (b.container_name as String) != "gunbc-spark-pair"
     && (b.head_unit_name as String) == "gunbc-glm-native-head.service"
-    && (match a.declared_model_path {
+    && (match b.declared_model_path {
          Absent => false
-         Present { value: pa } =>
-           match b.declared_model_path {
-             Absent => false
-             Present { value: pb } => pa != pb
-           }
+         Present { value: _ } => true
        })
 }
diff --git a/dag/test/claim/shell/shell_dag_codex_app_server_trip_script_witness_test.dag b/dag/test/claim/shell/shell_dag_codex_app_server_trip_script_witness_test.dag
index 1153d4b20d1..5552275c336 100644
--- a/dag/test/claim/shell/shell_dag_codex_app_server_trip_script_witness_test.dag
+++ b/dag/test/claim/shell/shell_dag_codex_app_server_trip_script_witness_test.dag
@@ -50,6 +50,7 @@ fn trip_surface(codex_home: String) -> String {
   let invocation = codex_press_account_trip_invocation(
     executable: "/usr/bin/codex" as FilePath,
     codex_home: codex_home as FilePath,
+    lock: none,
   )
   let argument_words: List<String> = list_flat_map(
     xs: cli_surface_arguments(surface: process_argv_expansion_surface(expansion: invocation)),
diff --git a/dag/test/claim/spark/arm_memory_fit_witness_test.dag b/dag/test/claim/spark/arm_memory_fit_witness_test.dag
index 3a492637090..dbd60b23f9f 100644
--- a/dag/test/claim/spark/arm_memory_fit_witness_test.dag
+++ b/dag/test/claim/spark/arm_memory_fit_witness_test.dag
@@ -32,9 +32,6 @@ import gunbc.spark.serving_capacity_intent {
   intent_max_total_resident_tokens, profile_for_envelope, envelope_at_cold_floor,
   ServingCapacityIntentAdmitted, ServingCapacityIntentRefused,
 }
-import gunbc.spark.pair_serving_capacity_floor {
-  spark_pair_serving_minimum_cold_sessions, minimum_cold_sessions_intent,
-}
 import gunbc.spark.group_b_serving_capacity { group_b_restoration_executable }
 import gunbc.spark.glm_group_b_launch { glm_group_b_deployment_env, glm_group_b_sparse_indexer_max_logits }
 import gunbc.spark.arm_memory_fit {
@@ -901,7 +898,7 @@ test fn w_the_experiment_plan_refuses_a_workload_that_does_not_join_its_policy_p
   }
 }
 
-// ── WITNESS 15: THE INTENT PROJECTIONS AND THE FLOOR'S FORWARD PROJECTION ───────────────────────
+// ── WITNESS 15: THE INTENT PROJECTIONS ───────────────────────
 test fn w_the_intent_envelope_derives_from_the_seat_population() -> Bool {
   (match serving_capacity_intent(cold_sequence_budgets: [], max_batched_tokens: token_count(count: 2048)) {
     ServingCapacityIntentRefused { cause: _ } => true
@@ -920,12 +917,6 @@ test fn w_the_intent_envelope_derives_from_the_seat_population() -> Bool {
           && token_count_value(t: intent_max_total_resident_tokens(i: i)) == 4194304
       ServingCapacityIntentRefused { cause: _ } => false
     })
-    && (match minimum_cold_sessions_intent(floor: spark_pair_serving_minimum_cold_sessions, max_batched_tokens: token_count(count: 2048)) {
-      ServingCapacityIntentAdmitted { intent: i } =>
-        intent_max_active_sequences(i: i) == spark_pair_serving_minimum_cold_sessions.sessions
-          && token_count_value(t: intent_max_single_sequence_tokens(i: i)) == 500000
-      ServingCapacityIntentRefused { cause: _ } => false
-    })
 }
 
 // ── WITNESS 16: THE KV BYTE DERIVATION ITSELF ───────────────────────────────────────────────────
diff --git a/dag/test/claim/spark/fabric_blob_peer_witness_test.dag b/dag/test/claim/spark/fabric_blob_peer_witness_test.dag
index 9574c6a52b0..cb7b2e35370 100644
--- a/dag/test/claim/spark/fabric_blob_peer_witness_test.dag
+++ b/dag/test/claim/spark/fabric_blob_peer_witness_test.dag
@@ -39,7 +39,10 @@ test fn the_daemon_exports_the_blob_root_read_only() -> Bool {
 // answers and the unit that started it owns its lifetime.
 test fn the_daemon_binds_the_rail_address_in_the_foreground() -> Bool {
   let argv = rsync_daemon_foreground_argv(address: "192.168.110.12" as NonEmptyStr, port: 873, config_path: fabric_blob_rsyncd_conf_path)
-  argv.first() == "rsync"
+  match argv.first() {
+    Present { value: a } => a == "rsync"
+    Absent => false
+  }
     && any(argv, w => w == "--daemon")
     && any(argv, w => w == "--no-detach")
     && any(argv, w => w == "--address=192.168.110.12")
@@ -59,7 +62,10 @@ test fn the_peer_source_pulls_the_digest_from_the_rail_into_staging() -> Bool {
   match src.locator {
     SourceUrl { url: _ } => false
     SourceArgv { argv: a } =>
-      a.first() == "rsync"
+      match a.first() {
+        Present { value: x } => x == "rsync"
+        Absent => false
+      }
         && any(a, w => w == "--partial")
         && any(a, w => w == join(["rsync://192.168.110.12:873/blobs/", fixture_hex as String], ""))
         && any(a, w => w == (fabric_blob_staging_path(hex: fixture_hex) as String))
diff --git a/dag/test/claim/spark/fabric_capacity_standing_witness_test.dag b/dag/test/claim/spark/fabric_capacity_standing_witness_test.dag
index 950c1875b71..03ef02ea93d 100644
--- a/dag/test/claim/spark/fabric_capacity_standing_witness_test.dag
+++ b/dag/test/claim/spark/fabric_capacity_standing_witness_test.dag
@@ -3,11 +3,10 @@ module test.claim.spark.fabric_capacity_standing_witness
 import std.types { Bool, String, NonEmptyStr, List, EpochSecs }
 import std.process { ProcessExit, ExitSuccess, ExitFailure }
 import std.optional { Present, Absent }
-import gunbc.spark.fabric_switch_observed { fabric_group_hosts }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, fabric_group_hosts, FabricGroup }
 import std.content_hash { ContentHash, Sha256Hash, Sha256Digest, Sha256DigestHex }
 import std.measure { concurrent_request_hundredths_count, token_count }
 import extdeps.vllm.server { VllmSourceRevision, vllm_source_revision, vllm_source_revision_read }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
 import gunbc.spark.pair_serving_desired { spark_pair_serving_head }
 import gunbc.spark.vllm_kv_layout_observe { KvLayoutUnreadable }
 import gunbc.instruments.fabric_capacity_standing {
@@ -27,7 +26,6 @@ import std.temporal_effect { held_lease, LeaseEpoch, LeaseRunningExpected }
 import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest }
 import gunbc.spark.pair_serving_authority {
   PairServingGroupAuthority, PairServingActive, SuspensionPendingReconciliation, ReleasedToFleet, PairRealizationUnestablished,
-  spark_pair_serving_authorities,
 }
 
 fn w_cell(name: ProbeFieldName) -> String {
@@ -105,7 +103,7 @@ test fn decode_identity_fields_are_the_launch_join_keys() -> Bool {
   match w_fields() {
     ProbeUnreadable { detail: _ } => false
     ProbeFields { fields: f } =>
-      match launch_from_fields(group: FabricGroupA, head: spark_pair_serving_head(group: FabricGroupA), f: f) {
+      match launch_from_fields(group: FabricGroupB {}, head: spark_pair_serving_head(group: FabricGroupB {}), f: f) {
         LaunchUnidentified { detail: _ } => false
         LaunchIdentified { launch: l } => (l.systemd_invocation as String) == "inv-a"
       }
@@ -172,7 +170,7 @@ test fn a_supplied_revision_is_the_one_the_readings_carry() -> Bool {
   match w_fields() {
     ProbeUnreadable { detail: _ } => false
     ProbeFields { fields: f } =>
-      match launch_from_fields(group: FabricGroupA, head: spark_pair_serving_head(group: FabricGroupA), f: f) {
+      match launch_from_fields(group: FabricGroupB {}, head: spark_pair_serving_head(group: FabricGroupB {}), f: f) {
         LaunchUnidentified { detail: _ } => false
         LaunchIdentified { launch: launch } =>
           match readings_from_fields(
@@ -299,7 +297,7 @@ test fn one_refusing_member_refuses_the_whole_standing() -> Bool {
 // THE PAIRING OBLIGATION FOR THE SUPPLIED STANDINGS. The three claims above hand
 // capacity_standing_verdict its population instead of computing it, which is what lets the empty case
 // exist at all -- but supplied inputs may never be the only thing that runs. This claim executes the
-// real route end to end: the live roster, the real group_report producer, and the binding that joins
+// real route end to end: a supplied roster, the real group_report producer, and the binding that joins
 // them, AND IT ASSERTS THE ROUTE RATHER THAN TWO MATCHING ANSWERS. That distinction is the whole
 // content of the claim: asking only whether the producer refuses AND the entry refuses is satisfied by
 // an entry that ignores the roster entirely and returns a constant refusal, so it would prove the two
@@ -312,16 +310,20 @@ test fn one_refusing_member_refuses_the_whole_standing() -> Bool {
 // the entry refuses until a modeled host-effect realizes remote inventory, so refusal IS today's
 // correct answer on the live path. When that frontier fires this claim flips, and it should -- it is
 // the control that notices, rather than a green that would have said nothing either way.
-// THE ROSTER IS SUPPLIED AT GENERATION 0 -- every claimed group's resting row, which is what the
+// THE ROSTER IS SUPPLIED AT GENERATION 0 -- one group's resting Active row, which is what the
 // authority log folds to when no transition is recorded -- so the claim stays hermetic while the
 // real group_report producer and the binding that maps it over the roster both execute. The
-// roster READ is exercised by the supplied-host claim below.
+// production roster claims no group, so the row is supplied rather than read from it.
+fn w_resting_roster() -> List<PairServingGroupAuthority> {
+  [PairServingActive { group: FabricGroupB {}, exact_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr } }]
+}
+
 fn w_resting_current() -> List<CurrentAuthority> {
-  map(spark_pair_serving_authorities, a => CurrentAuthorityRead { authority: a, head: HeadAbsent, generation: 0, grant: none, entry_state: none, previous: none, admitted_by: none, transitions: [] as List<AuthorityTransitionRecord> })
+  map(w_resting_roster(), a => CurrentAuthorityRead { authority: a, head: HeadAbsent, generation: 0, grant: none, entry_state: none, previous: none, admitted_by: none, transitions: [] as List<AuthorityTransitionRecord> })
 }
 
 test fn the_verdict_over_the_resting_roster_runs_its_real_producer_and_refuses_today() -> Bool {
-  let live = group_report(group: FabricGroupA)
+  let live = group_report(group: FabricGroupB {})
   match fabric_capacity_standing_current(current: w_resting_current()) {
     ExitSuccess => false
     ExitFailure { code: _, reason: reason } =>
@@ -330,24 +332,6 @@ test fn the_verdict_over_the_resting_roster_runs_its_real_producer_and_refuses_t
   }
 }
 
-// THE OFF-FLEET PREMISE IS SUPPLIED, NOT READ FROM THE RUNNER. The live entry differs from
-// fabric_capacity_standing_for only in taking the executor from the host's `hostname` and the
-// instant from its clock; both are supplied here, so the verdict does not depend on which runner
-// executes it (gunbc.recurring_failure_mode wet_witness_premise_read_from_the_runner_it_happens_to_land_on).
-// Everything beneath the seam is real: store resolution for a host that declares no dashboard
-// instance, the per-group CurrentAuthorityUnread, and the verdict text naming that read. Letting an
-// unreadable log fall back to the resting row turns this red.
-data witness_host_declaring_no_dashboard_instance: String = "gunbc-witness-host-without-dashboard-instance"
-data witness_instant: EpochSecs = 1000
-
-test fn the_live_entry_reads_the_authority_before_judging_and_refuses_off_fleet() -> Bool {
-  match fabric_capacity_standing_for(executor: witness_host_declaring_no_dashboard_instance, at: witness_instant) {
-    ExitSuccess => false
-    ExitFailure { code: _, reason: reason } =>
-      string_contains(s: reason, pattern: "group-a: serving authority could not be read at store: no dashboard instance is declared for host gunbc-witness-host-without-dashboard-instance")
-  }
-}
-
 // A SUSPENDED GROUP PRODUCES A STANDING THAT DOES NOT ADMIT, AND A RELEASED ONE TOO -- but neither
 // disappears, which is the property the empty-roster guard depends on. If suspension had been modeled
 // by dropping the group from the population instead, the guard would see a shorter list rather than a
@@ -367,7 +351,7 @@ fn with_capacity_hash(scenario: fn(ContentHash) -> Bool) -> Bool {
 
 fn w_suspended_authority(h: ContentHash) -> PairServingGroupAuthority {
   SuspensionPendingReconciliation {
-    group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA),
+    group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}),
     transaction: "witness-transaction" as NonEmptyStr,
     authorization_binding: h,
     lease: held_lease(
@@ -390,7 +374,7 @@ test fn a_suspended_authority_stands_without_admitting() -> Bool {
 
 test fn a_released_authority_says_the_hosts_are_not_ours() -> Bool {
   with_capacity_hash(scenario: h => {
-    let st = standing_for_authority(a: ReleasedToFleet { group: FabricGroupA, release_receipt: h })
+    let st = standing_for_authority(a: ReleasedToFleet { group: FabricGroupB {}, release_receipt: h })
     (st.admitting == false) && string_contains(s: st.text, pattern: "no longer claims these hosts")
   })
 }
@@ -399,9 +383,9 @@ test fn a_released_authority_says_the_hosts_are_not_ours() -> Bool {
 // being satisfied by a fold that refuses everything.
 test fn an_ordinary_authority_routes_to_the_live_probe() -> Bool {
   let via_authority = standing_for_authority(a: PairServingActive {
-    group: FabricGroupA,
+    group: FabricGroupB {},
     exact_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr },
   })
-  let direct = group_report(group: FabricGroupA)
+  let direct = group_report(group: FabricGroupB {})
   (via_authority.admitting == direct.admitting) && (via_authority.text == direct.text)
 }
diff --git a/dag/test/claim/spark/glm53_runtime_image_build_witness_test.dag b/dag/test/claim/spark/glm53_runtime_image_build_witness_test.dag
deleted file mode 100644
index f6df3733692..00000000000
--- a/dag/test/claim/spark/glm53_runtime_image_build_witness_test.dag
+++ /dev/null
@@ -1,198 +0,0 @@
-module test.claim.spark.glm53_runtime_image_build_witness
-
-import std.types { Bool, List, NonEmptyStr, String }
-import std.content_hash { serialize_content_hash, Sha256Digest, Sha256DigestHex }
-import extdeps.container.oci.digest { OciSha256Digest }
-import gunbc.spark.vllm_runtime_image_build {
-  vllm_recipe_arch_is_buildable, glm53_derived_dockerfile, glm53_derived_prepare_script, glm53_derived_build_spec, glm53_derived_context_dir, glm53_derived_prepare_steps, glm53_derived_prepare_script_path, glm53_derived_dockerfile_path, vllm_image_transfer_tar_path, vllm_image_distribution_targets,
-}
-import gunbc.spark.vllm_image_identity {
-  vllm_image_repository, glm53_image_repository, vllm_image_repository_for, vllm_image_tag, vllm_image_build_key, glm53_derived_key, glm53_derived_tag,
-}
-import gunbc.remote_operation { remote_operation_count, remote_operation_file_write_count, remote_operation_argv }
-import gunbc.spark.native_serving_realization { glm_native_ranked_hosts }
-import product.host_identity { host_identity_eq, HostIdentity }
-import std.optional { Present, Absent }
-import gunbc.spark.group_image_produce { distribution_source_candidates }
-import gunbc.spark.glm53_kvplan_image { glm53_kvplan_produced_image_held }
-import extdeps.docker.cli { docker_image_save_command, docker_image_load_command }
-import extdeps.ssh.openssh_client_commands { scp_download_command, scp_upload_command }
-import extdeps.vllm.source_build {
-  vllm_8d09804_sm121_recipe, vllm_glm_5_3_flash_sm121_revision, vllm_07b75534_aarch64_release_recipe,
-}
-import extdeps.flashinfer.flashinfer {
-  flashinfer_0_7_0_dev20260910_wheels, flashinfer_0_7_0_dev20260910_release_url,
-  flashinfer_0_7_0_dev20260910_wheel_url,
-}
-
-// THE RECIPE IS THE OBSERVED BASE BUILD: SM121 only, cuda 13.0.2, kv connectors off, and within
-// vLLM's supported arch set at the pinned revision.
-test fn the_glm53_recipe_targets_sm121_and_is_buildable() -> Bool {
-  vllm_8d09804_sm121_recipe.torch_cuda_arch_list == ["12.1" as NonEmptyStr]
-    && (vllm_8d09804_sm121_recipe.cuda_version as String) == "13.0.2"
-    && !vllm_8d09804_sm121_recipe.install_kv_connectors
-    && vllm_recipe_arch_is_buildable(r: vllm_8d09804_sm121_recipe)
-    && (vllm_8d09804_sm121_recipe.source.full_revision as String) == (vllm_glm_5_3_flash_sm121_revision.full_revision as String)
-}
-
-// THE REPOSITORY FOLLOWS THE RECIPE'S FAMILY: the GLM recipe tags under gunbc-vllm-glm53-gb10 and
-// the v41 recipe keeps its existing repository, so the two families never share a tag namespace.
-test fn the_repository_dispatches_on_the_recipe_family() -> Bool {
-  (vllm_image_repository_for(r: vllm_8d09804_sm121_recipe) as String) == (glm53_image_repository as String)
-    && (vllm_image_repository_for(r: vllm_07b75534_aarch64_release_recipe) as String) == (vllm_image_repository as String)
-    && string_contains(s: vllm_image_tag(r: vllm_8d09804_sm121_recipe) as String, pattern: "gunbc-vllm-glm53-gb10:")
-    && string_contains(s: vllm_image_tag(r: vllm_07b75534_aarch64_release_recipe) as String, pattern: "gunbc-vllm-dsv41-gb10:")
-}
-
-// THE DERIVED KEY IS NOT THE BASE KEY: the nightly override changes the image's identity, so a
-// fleet that has the base does not believe it has the derived image.
-test fn the_derived_stage_has_its_own_identity() -> Bool {
-  let base_key = vllm_image_build_key(r: vllm_8d09804_sm121_recipe)
-  (serialize_content_hash(hash: glm53_derived_key(base_key: base_key)) as String) != (serialize_content_hash(hash: base_key) as String)
-    && string_contains(s: glm53_derived_tag(base_key: base_key) as String, pattern: "gunbc-vllm-glm53-gb10:derived-")
-}
-
-// THE DERIVED DOCKERFILE MIRRORS THE OBSERVED HAND BUILD: FROM the base tag, the three nightly
-// wheels staged at /tmp/gunbc-wheels, one pip install --no-deps --force-reinstall over all three.
-test fn the_derived_dockerfile_replays_the_observed_layers() -> Bool {
-  let d = glm53_derived_dockerfile(base_tag: "gunbc-vllm-glm53-gb10:base-fixture" as NonEmptyStr)
-  string_contains(s: d, pattern: "FROM gunbc-vllm-glm53-gb10:base-fixture AS glm53derived")
-    && string_contains(s: d, pattern: "COPY flashinfer_python-0.7.0.dev20260910-py3-none-any.whl flashinfer_cubin-0.7.0.dev20260910-py3-none-any.whl flashinfer_jit_cache-0.7.0.dev20260910+cu130-cp39-abi3-manylinux_2_28_aarch64.whl /tmp/gunbc-wheels/")
-    && string_contains(s: d, pattern: "RUN python3 -m pip install --no-deps --force-reinstall /tmp/gunbc-wheels/flashinfer_python-0.7.0.dev20260910-py3-none-any.whl /tmp/gunbc-wheels/flashinfer_cubin-0.7.0.dev20260910-py3-none-any.whl /tmp/gunbc-wheels/flashinfer_jit_cache-0.7.0.dev20260910+cu130-cp39-abi3-manylinux_2_28_aarch64.whl")
-}
-
-// THE PREPARE SCRIPT VERIFIES BEFORE IT BUILDS: every wheel is fetched from its declared release
-// URL and checked against its declared sha256.
-test fn the_prepare_leg_fetches_and_verifies_every_wheel() -> Bool {
-  let s = glm53_derived_prepare_script()
-  string_contains(s: s, pattern: "set -e")
-    && fold(flashinfer_0_7_0_dev20260910_wheels, init: true, f: (acc, w) => acc
-      && string_contains(s: s, pattern: flashinfer_0_7_0_dev20260910_wheel_url(w: w) as String)
-      && string_contains(s: s, pattern: w.sha256.hex as String))
-    && string_contains(s: s, pattern: "sha256sum -c -")
-    && string_contains(s: s, pattern: flashinfer_0_7_0_dev20260910_release_url as String)
-}
-
-// THE PREPARE PLAN RESPECTS THE PORTABLE-WORD WALL: four ordered steps -- make the context
-// directory, land the script and the Dockerfile as readback-verified file writes, then run the
-// script as `sh <path>`. No step carries the script as an argv word, which is the shape the
-// far-side re-parse allowlist refuses.
-test fn the_prepare_plan_lands_files_then_runs_sh_path() -> Bool {
-  match glm53_derived_prepare_steps(base_tag: "gunbc-vllm-glm53-gb10:base-fixture" as NonEmptyStr) {
-    Absent => false
-    Present { value: steps } =>
-      remote_operation_count(operations: map(steps, s => s.operation)) == 4
-        && remote_operation_file_write_count(operations: map(steps, s => s.operation)) == 2
-        && steps.first().identity == "derived-context-dir" as NonEmptyStr
-        && steps.skip(n: 3).first().identity == "derived-prepare-run" as NonEmptyStr
-        && match steps.skip(n: 3).first() {
-          Absent => false
-          Present { value: run_step } =>
-        match remote_operation_argv(operation: run_step.operation) {
-          Absent => false
-          Present { value: argv } =>
-            argv.length() == 2
-              && argv.first() == "sh"
-              && argv.skip(n: 1).first() == (glm53_derived_prepare_script_path() as String)
-        }
-        }
-        && string_contains(s: glm53_derived_dockerfile_path() as String, pattern: glm53_derived_context_dir() as String)
-  }
-}
-
-// THE DERIVED BUILD SPEC: the named stage, the arm64 platform, no build args -- the override is
-// entirely in the Dockerfile and the pinned wheels.
-test fn the_derived_build_spec_selects_the_named_stage() -> Bool {
-  let spec = glm53_derived_build_spec(base_tag: "gunbc-vllm-glm53-gb10:base-fixture" as NonEmptyStr, base_key: vllm_image_build_key(r: vllm_8d09804_sm121_recipe))
-  (spec.target as String) == "glm53derived"
-    && (spec.platform as String) == "linux/arm64"
-    && spec.build_args.length() == 0
-    && string_contains(s: spec.dockerfile as String, pattern: glm53_derived_context_dir() as String)
-}
-
-// ── DISTRIBUTION ─────────────────────────────────────────────────────────────────────────────
-
-// THE TRANSFER TAR IS CONTENT-NAMED: the digest of the image it carries is in the path, so a stale
-// tar from another image cannot wear this one's name on any host it passes through, and two images
-// never share a path.
-test fn the_transfer_tar_path_is_content_named() -> Bool {
-  let a = OciSha256Digest(Sha256Digest { hex: "ea39410ed01d396caad86339d877c1adb181a983baadffd22c722069109ea664" as Sha256DigestHex })
-  let b = OciSha256Digest(Sha256Digest { hex: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" as Sha256DigestHex })
-  let p = vllm_image_transfer_tar_path(config: a)
-  string_contains(s: p as String, pattern: "ea39410ed01d396caad86339d877c1adb181a983baadffd22c722069109ea664")
-    && string_contains(s: p as String, pattern: ".tar")
-    && (p as String) != (vllm_image_transfer_tar_path(config: b) as String)
-}
-
-// THE SAVE AND LOAD ARGV ARE UPSTREAM'S OWN VERBS with the paths where upstream reads them.
-test fn the_save_and_load_argv_are_dockers_own_verbs() -> Bool {
-  let save = docker_image_save_command(image: "img:tag" as NonEmptyStr, output_path: "/tmp/x.tar" as NonEmptyStr)
-  let load = docker_image_load_command(input_path: "/tmp/x.tar" as NonEmptyStr)
-  save.arguments.length() == 4
-    && save.arguments.skip(n: 1).first() == "-o"
-    && save.arguments.skip(n: 2).first() == "/tmp/x.tar"
-    && save.arguments.skip(n: 3).first() == "img:tag"
-    && load.arguments.length() == 3
-    && load.arguments.first() == "load"
-    && load.arguments.skip(n: 1).first() == "-i"
-    && load.arguments.skip(n: 2).first() == "/tmp/x.tar"
-}
-
-// THE scp OPERANDS KEEP THEIR DIRECTION: download carries the remote operand first, upload
-// carries it last, and both put the trust words ahead of everything -- an scp with the operands
-// transposed moves bytes the wrong way, which is exactly the red this claim exists to catch.
-test fn the_scp_operand_direction_is_fixed() -> Bool {
-  let trust = ["-o", "StrictHostKeyChecking=yes"]
-  let down = scp_download_command(trust_words: trust, principal: "exec" as NonEmptyStr, endpoint: "h1" as NonEmptyStr, remote_path: "/tmp/r.tar" as NonEmptyStr, local_path: "/tmp/l.tar" as NonEmptyStr)
-  let up = scp_upload_command(trust_words: trust, principal: "exec" as NonEmptyStr, endpoint: "h1" as NonEmptyStr, local_path: "/tmp/l.tar" as NonEmptyStr, remote_path: "/tmp/r.tar" as NonEmptyStr)
-  down.arguments.length() == 4
-    && down.arguments.first() == "-o"
-    && down.arguments.skip(n: 2).first() == "exec@h1:/tmp/r.tar"
-    && down.arguments.skip(n: 3).first() == "/tmp/l.tar"
-    && up.arguments.length() == 4
-    && up.arguments.skip(n: 2).first() == "/tmp/l.tar"
-    && up.arguments.skip(n: 3).first() == "exec@h1:/tmp/r.tar"
-}
-
-// THE DISTRIBUTION ROSTER IS THE ARM MINUS THE SOURCE: delivering to the host that built the
-// image would move 33GB to no end, and dropping any other member leaves a rank unable to start.
-test fn the_distribution_roster_excludes_exactly_the_source() -> Bool {
-  let hosts = glm_native_ranked_hosts()
-  match hosts.first() {
-    Absent => false
-    Present { value: source } => {
-      let targets = vllm_image_distribution_targets(source: source)
-      targets.length() == hosts.length() - 1
-        && !any(targets, h => host_identity_eq(a: h, b: source))
-        && all(hosts, h => host_identity_eq(a: h, b: source) || any(targets, t => host_identity_eq(a: t, b: h)))
-    }
-  }
-}
-
-// THE DISTRIBUTION SOURCE IS ASKED FOR PRODUCTION HOST FIRST (ruling of valiant-crab-775, 2026-10-03):
-// the GLM image's receipt names srv7, so srv7 is asked first; then every other Group A host, never the
-// target. Whichever first reads back the digest is the source (distribution_source_for over the live
-// readings). The rest of the group follows the fabric roster's order, which this does not pin.
-fn w_names(hs: List<HostIdentity>) -> List<String> {
-  map(hs, x => x as String)
-}
-
-fn w_first_is(xs: List<String>, want: String) -> Bool {
-  match first(xs) {
-    Absent => false
-    Present { value: x } => x == want
-  }
-}
-
-test fn the_distribution_asks_the_production_host_first_then_the_group_never_the_target() -> Bool {
-  match glm53_kvplan_produced_image_held() {
-    Absent => false
-    Present { value: h } => {
-      let to5 = w_names(hs: distribution_source_candidates(h: h, target: "srv5" as HostIdentity))
-      let to7 = w_names(hs: distribution_source_candidates(h: h, target: "srv7" as HostIdentity))
-      length(to5) == 3 && w_first_is(xs: to5, want: "srv7") && !any(to5, x => x == "srv5")
-        && any(to5, x => x == "srv6") && any(to5, x => x == "srv8")
-        && length(to7) == 4 && w_first_is(xs: to7, want: "srv7") && any(to7, x => x == "srv5")
-    }
-  }
-}
diff --git a/dag/test/claim/spark/group_arm_launch_witness_test.dag b/dag/test/claim/spark/group_arm_launch_witness_test.dag
deleted file mode 100644
index 5c1f469abd0..00000000000
--- a/dag/test/claim/spark/group_arm_launch_witness_test.dag
+++ /dev/null
@@ -1,422 +0,0 @@
-module test.claim.spark.group_arm_launch_witness
-
-import std.types { Bool, String, List, NonEmptyStr }
-import std.content_hash { ContentHash, content_hash_equal }
-import std.optional { Present, Absent }
-import std.measure { token_count, kibibyte, mebibyte, basis_point, second_count }
-import extdeps.systemd { Active }
-import extdeps.vllm.engine_args { FullInputAdmissionExplicit, FullInputAdmissionOmitted, KvWatermarkExplicit, KvWatermarkOmitted, VllmSchedulerAdmissionRequest }
-import gunbc.compute.host_occupancy { HostOccupant, HostUnoccupied, HostOccupiedBy, ServingUnitActive, GpuComputeProcess }
-import extdeps.nvidia.system_management_interface { UsedMemoryReported }
-import product.host_identity { HostIdentity }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB, fabric_group_hosts }
-import gunbc.spark.serving_capacity_intent { scheduler_envelope, SchedulerEnvelopeAdmitted, SchedulerEnvelopeRefused }
-import gunbc.spark.group_arm_launch {
-  GroupArmLaunchInputs, GroupArmLaunchPlan, GroupArmLaunchPlanned, GroupArmLaunchRefused, GroupArmHostOccupancy,
-  GroupArmLaunchAdmission, GroupArmLaunchAdmitted, GroupArmLaunchAdmittedForAdoptionOnly, ArmOwnFence, ArmOwnFenceHeld, ArmOwnFenceAbsent, ArmOwnFenceUnread, ArmOwnRollbackUnresolved, GroupArmLaunchAdmissionRefused,
-  ArmDeclaredIncumbent, NoIncumbentDeclared, IncumbentDeclared, ArmIncumbentUnit,
-  ArmSuccessorKeyed, ArmSuccessorUnkeyed, group_arm_launch_admission, group_arm_read_units, group_arm_row_successor, group_arm_launch_plan,
-  group_arm_released_launch_causes,
-}
-import gunbc.spark.pair_serving_authority { PairServingGroupAuthority, ReleasedToFleet }
-import gunbc.spark.pair_serving_d0_door { StandingGrantRowOnMain, StandingGrantRowNotOnMain }
-import gunbc.spark.glm53_arm_staircase {
-  Glm53StaircaseStep, Glm53Fp8Step, Glm53Nvfp4Step, Fp8Seats8, Fp8Seats24, Nvfp4Seats8, Nvfp4Seats32,
-  SupersedePreviousStep,
-  glm53_staircase_steps, glm53_step_wire, glm53_step_of_wire, glm53_step_ceiling, glm53_step_profile, glm53_step_inputs,
-  glm53_staircase_cold_intent, glm53_staircase_scheduler_admission, glm53_staircase_units,
-  glm53_previous_step_incumbent,
-}
-import gunbc.spark.arm_group_launch_dispatch { arm_launch_step_timeout_minutes, arm_launch_step_needed, ArmLaunchStepNeedDerived, ArmLaunchStepNeedRefused,
-  arm_group_of_word, ArmGroupNamed, ArmGroupWordRefused,
-  arm_group_launch_select, ArmGroupLaunchSelection, ArmGroupLaunchSelected, ArmGroupLaunchSelectionRefused, ArmV41GroupA, ArmGlm53GroupAStep,
-}
-import gunbc.spark.v41_group_a_launch { v41_arm_plan }
-import gunbc.spark.glm53_staircase_load { glm53_step_performance_subject, glm53_autotune_standing_wire }
-import gunbc.spark.serving_performance_subject { serving_subject_key, serving_subject_key_equal }
-import extdeps.vllm.environment { vllm_environment_variable_name, VllmFlashinferAutotuneSkipOps }
-import test.claim.spark.v41_group_a_launch_witness { with_w_plan, w_suspended_for }
-
-// ── THE STAIRCASE IS A CLOSED SET, AND EVERY STEP KEEPS THE COLD FLOOR ────────────────────────────
-
-// EVERY STEP'S WIRE PARSES BACK TO THAT STEP, AND A NUMBER OFF THE STAIRCASE HAS NO SPELLING.
-test fn w_every_staircase_step_round_trips_and_an_off_staircase_word_is_no_step() -> Bool {
-  all(glm53_staircase_steps, s => match glm53_step_of_wire(word: glm53_step_wire(s: s) as String) {
-    Present { value: back } => (glm53_step_wire(s: back) as String) == (glm53_step_wire(s: s) as String)
-    Absent => false
-  })
-    && length(glm53_staircase_steps) == 11
-    && match glm53_step_of_wire(word: "fp8-10") { Present { value: _ } => false  Absent => true }
-    && match glm53_step_of_wire(word: "nvfp4-12") { Present { value: _ } => false  Absent => true }
-}
-
-// EVERY STEP DERIVES A PROFILE WHOSE COLD FLOOR IS 8 x 262144 AND WHOSE CEILING IS THE STEP'S, WITH THE
-// FULL-INPUT GATE AND THE WATERMARK STATED -- the profile the launch renders, not a second row.
-test fn w_every_step_keeps_the_cold_floor_and_carries_its_own_ceiling() -> Bool {
-  all(glm53_staircase_steps, s => match glm53_step_profile(s: s) {
-    Absent => false
-    Present { value: p } =>
-      p.guaranteed_cold_seqs == 8
-        && p.max_num_seqs == glm53_step_ceiling(s: s)
-        && p.max_model_len == token_count(count: 262144)
-        && match p.scheduler_admission.full_input_admission { FullInputAdmissionExplicit { enabled: e } => e  FullInputAdmissionOmitted => false }
-        && match p.scheduler_admission.kv_watermark { KvWatermarkExplicit { fraction: _ } => true  KvWatermarkOmitted => false }
-  })
-}
-
-// THE DISCRIMINATING RED FOR THE ENVELOPE: a ceiling below the floor refuses, and so does one above it
-// without the gate -- through the same scheduler_envelope every step derives from.
-test fn w_a_ceiling_below_the_floor_or_above_it_ungated_has_no_envelope() -> Bool {
-  match glm53_staircase_cold_intent() {
-    Absent => false
-    Present { value: cold } => {
-      let below = scheduler_envelope(cold: cold, hard_max_num_seqs: 6, admission: glm53_staircase_scheduler_admission)
-      let ungated = scheduler_envelope(cold: cold, hard_max_num_seqs: 16, admission: VllmSchedulerAdmissionRequest {
-        full_input_admission: FullInputAdmissionExplicit { enabled: false },
-        kv_watermark: KvWatermarkExplicit { fraction: basis_point(count: 0) },
-      })
-      let ok = scheduler_envelope(cold: cold, hard_max_num_seqs: 16, admission: glm53_staircase_scheduler_admission)
-      match below { SchedulerEnvelopeAdmitted { envelope: _ } => false  SchedulerEnvelopeRefused { cause: _ } => true }
-        && match ungated { SchedulerEnvelopeAdmitted { envelope: _ } => false  SchedulerEnvelopeRefused { cause: _ } => true }
-        && match ok { SchedulerEnvelopeAdmitted { envelope: _ } => true  SchedulerEnvelopeRefused { cause: _ } => false }
-    }
-  }
-}
-
-// THE STEP SELECTS ITS CHECKPOINT'S POLICY: the NVFP4 steps launch the NVIDIA checkpoint, the FP8 steps
-// the native one, and the profile carries it.
-test fn w_each_step_launches_its_own_checkpoint() -> Bool {
-  match glm53_step_inputs(s: Glm53Fp8Step { step: Fp8Seats8 }) {
-    Absent => false
-    Present { value: f } => match glm53_step_inputs(s: Glm53Nvfp4Step { step: Nvfp4Seats32 }) {
-      Absent => false
-      Present { value: n } =>
-        f.profile.checkpoint == f.assignment.checkpoint
-          && n.profile.checkpoint == n.assignment.checkpoint
-          && f.assignment.checkpoint != n.assignment.checkpoint
-          && n.profile.max_num_seqs == 32
-    }
-  }
-}
-
-// ── THE GLM STEP TAKES THE ONE PATH (the pairing obligation) ─────────────────────────────────────
-//
-// The FP8 eight-seat step's REAL inputs through the REAL planner (group_arm_launch_plan: the arm wall,
-// the memory wall under the bounded-experiment intent, the roster) -- nothing about the plan is
-// supplied. Only the authority and the occupancy are, at the admission's interface, because the live
-// log and the hosts are on the fleet. The route is asserted: four rank lines at the step's ceiling over
-// its floor, and an admission that ADMITS on Group A released to the fleet, because the committed
-// standing grant covers an arm launch on all four hosts and the produced runtime gives a keyed
-// successor. The live entry (mode spark_arm_group_launch_plan) is the same fold with the authority read.
-fn w_released(h: ContentHash) -> PairServingGroupAuthority {
-  ReleasedToFleet { group: FabricGroupA, release_receipt: h }
-}
-
-fn w_vacant_a() -> List<GroupArmHostOccupancy> {
-  map(fabric_group_hosts(g: FabricGroupA), h => GroupArmHostOccupancy { host: h, own_fence: ArmOwnFenceAbsent, admission: HostUnoccupied { available: kibibyte(count: 120000000) } })
-}
-
-test fn w_the_glm_fp8_eight_seat_step_takes_the_one_path_and_admits_on_the_released_group() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    match glm53_step_inputs(s: Glm53Fp8Step { step: Fp8Seats8 }) {
-      Absent => false
-      Present { value: i } => match group_arm_launch_plan(inputs: i) {
-        GroupArmLaunchRefused { causes: _ } => false
-        GroupArmLaunchPlanned { lines: ls, profile: prof, master_endpoint: _ } => {
-          let a = group_arm_launch_admission(
-            group: FabricGroupA, purpose: i.purpose, plan: GroupArmLaunchPlanned { lines: ls, profile: prof, master_endpoint: "witness" as NonEmptyStr },
-            authority: Present { value: w_released(h: ck) },
-            successor: group_arm_row_successor(inputs: i), arm_causes: [],
-            held: fabric_group_hosts(g: FabricGroupA), occupancy: w_vacant_a(),
-            incumbent: NoIncumbentDeclared, grant_row: StandingGrantRowOnMain)
-          let off_main = group_arm_launch_admission(
-            group: FabricGroupA, purpose: i.purpose, plan: GroupArmLaunchPlanned { lines: ls, profile: prof, master_endpoint: "witness" as NonEmptyStr },
-            authority: Present { value: w_released(h: ck) },
-            successor: group_arm_row_successor(inputs: i), arm_causes: [],
-            held: fabric_group_hosts(g: FabricGroupA), occupancy: w_vacant_a(),
-            incumbent: NoIncumbentDeclared, grant_row: StandingGrantRowNotOnMain { cause: "witness: the row differs from origin/main's" })
-          w_refused_with(a: off_main, fragment: "the standing grant is not honored")
-            && length(ls) == 4 && prof.max_num_seqs == 8 && prof.guaranteed_cold_seqs == 8
-            && (match a { GroupArmLaunchAdmitted => true  GroupArmLaunchAdmittedForAdoptionOnly { hosts: _ } => false  GroupArmLaunchAdmissionRefused { causes: _ } => false })
-        }
-      }
-    }
-  })
-}
-
-// A RELEASED GROUP REFUSES A LAUNCH THE GRANT DOES NOT COVER (ruling of valiant-crab-775, 2026-10-03):
-// one host outside the grant's roster is enough, and a group the grant does not name refuses whatever
-// its hosts. The positive control is the grant's own four hosts. Then the same refusal on the admission
-// route: the real V4.1 plan, whose hosts are Group A's, admitted under Group B's release refuses by the
-// grant cause (and by the host wall), never admits.
-test fn w_a_released_group_refuses_a_launch_the_grant_does_not_cover() -> Bool {
-  let a_hosts = fabric_group_hosts(g: FabricGroupA)
-  length(group_arm_released_launch_causes(group: FabricGroupA, hosts: a_hosts, grant_row: StandingGrantRowOnMain)) == 0
-    && length(group_arm_released_launch_causes(group: FabricGroupA, hosts: concat(a_hosts, ["srv9" as HostIdentity]), grant_row: StandingGrantRowOnMain)) == 1
-    && length(group_arm_released_launch_causes(group: FabricGroupB, hosts: fabric_group_hosts(g: FabricGroupB), grant_row: StandingGrantRowOnMain)) == 1
-    && length(group_arm_released_launch_causes(group: FabricGroupA, hosts: [] as List<HostIdentity>, grant_row: StandingGrantRowOnMain)) == 1
-    && with_w_plan(f: fn(p, rk, ck) {
-      w_refused_with(a: group_arm_launch_admission(
-          group: FabricGroupB, purpose: "witness" as NonEmptyStr, plan: v41_arm_plan(p: p),
-          authority: Present { value: ReleasedToFleet { group: FabricGroupB, release_receipt: ck } },
-          successor: ArmSuccessorKeyed { key: ck }, arm_causes: [],
-          held: fabric_group_hosts(g: FabricGroupB), occupancy: w_vacant_a(), incumbent: NoIncumbentDeclared, grant_row: StandingGrantRowOnMain),
-        fragment: "no standing grant covers an arm launch")
-    })
-}
-
-// THE STAIRCASE'S RUNTIME IS KEYED: the Group A production is pinned by its configuration digest, so
-// every step derives a successor key, and two steps on different checkpoints derive different keys.
-test fn w_the_produced_runtime_keys_every_step() -> Bool {
-  match glm53_step_inputs(s: Glm53Fp8Step { step: Fp8Seats24 }) {
-    Absent => false
-    Present { value: f } => match glm53_step_inputs(s: Glm53Nvfp4Step { step: Nvfp4Seats8 }) {
-      Absent => false
-      Present { value: n } => match group_arm_row_successor(inputs: f) {
-        ArmSuccessorUnkeyed { causes: _ } => false
-        ArmSuccessorKeyed { key: kf } => match group_arm_row_successor(inputs: n) {
-          ArmSuccessorUnkeyed { causes: _ } => false
-          ArmSuccessorKeyed { key: kn } => !content_hash_equal(left: kf, right: kn)
-        }
-      }
-    }
-  }
-}
-
-// ── THE DECLARED INCUMBENT (ruling of valiant-crab-775, 2026-10-02) ─────────────────────────────
-//
-// THE PLAN IS THE V4.1 FIXTURE'S, AS THE ONE PATH'S PLAN: four real rank lines over Group A, which is
-// all these claims need -- the incumbent conjuncts are about hosts and units, not about the arm.
-
-fn w_admit(p: GroupArmLaunchPlan, ck: ContentHash, occupancy: List<GroupArmHostOccupancy>, incumbent: ArmDeclaredIncumbent) -> GroupArmLaunchAdmission {
-  group_arm_launch_admission(
-    group: FabricGroupA, purpose: "the witness launch" as NonEmptyStr, plan: p,
-    authority: Present { value: w_suspended_for(successor: ck, stale: false) },
-    successor: ArmSuccessorKeyed { key: ck }, arm_causes: [],
-    held: fabric_group_hosts(g: FabricGroupA), occupancy: occupancy, incumbent: incumbent, grant_row: StandingGrantRowNotOnMain { cause: "witness: a suspension, so the grant is not read" })
-}
-
-data w_old_unit: NonEmptyStr = "gunbc-spark-pair-head.service" as NonEmptyStr
-
-fn w_incumbent_on(hosts: List<HostIdentity>) -> ArmDeclaredIncumbent {
-  IncumbentDeclared { units: map(hosts, h => ArmIncumbentUnit { host: h, unit_name: w_old_unit }), provenance: "witness" as NonEmptyStr }
-}
-
-fn w_running(unit: NonEmptyStr) -> List<GroupArmHostOccupancy> {
-  map(fabric_group_hosts(g: FabricGroupA), h => GroupArmHostOccupancy { host: h, own_fence: ArmOwnFenceAbsent, admission: HostOccupiedBy {
-    occupant: ServingUnitActive { unit: unit, state: Active },
-    others: [GpuComputeProcess { pid: 4242, process_name: "python3", used: UsedMemoryReported { used: mebibyte(count: 99000) } }],
-    gpu_used: mebibyte(count: 99000) } })
-}
-
-fn w_refused_with(a: GroupArmLaunchAdmission, fragment: String) -> Bool {
-  match a {
-    GroupArmLaunchAdmitted => false
-    GroupArmLaunchAdmittedForAdoptionOnly { hosts: _ } => false
-    GroupArmLaunchAdmissionRefused { causes: c } => any(c, x => string_contains(s: x, pattern: fragment))
-  }
-}
-
-// THE POSITIVE CONTROL: the declared unit read back active on every host it is declared on admits, its
-// GPU process deferred to the post-stop re-read.
-test fn w_a_declared_incumbent_read_back_active_admits() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    match w_admit(p: v41_arm_plan(p: p), ck: ck, occupancy: w_running(unit: w_old_unit), incumbent: w_incumbent_on(hosts: fabric_group_hosts(g: FabricGroupA))) {
-      GroupArmLaunchAdmitted => true
-      GroupArmLaunchAdmittedForAdoptionOnly { hosts: _ } => false
-      GroupArmLaunchAdmissionRefused { causes: _ } => false
-    }
-  })
-}
-
-// THE SAME OCCUPANCY WITH NOTHING DECLARED REFUSES EXACTLY AS BEFORE.
-test fn w_the_same_occupant_undeclared_refuses() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(a: w_admit(p: v41_arm_plan(p: p), ck: ck, occupancy: w_running(unit: w_old_unit), incumbent: NoIncumbentDeclared), fragment: "is occupied")
-  })
-}
-
-// ANY OTHER SERVING UNIT ON A HOST WITH A DECLARED INCUMBENT REFUSES: the declaration names one unit,
-// and is never a licence for whatever else runs there.
-test fn w_an_undeclared_unit_beside_the_declared_one_refuses() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(a: w_admit(p: v41_arm_plan(p: p), ck: ck, occupancy: w_running(unit: "gunbc-spark-pair-worker.service" as NonEmptyStr), incumbent: w_incumbent_on(hosts: fabric_group_hosts(g: FabricGroupA))),
-      fragment: "occupied by an undeclared serving unit")
-  })
-}
-
-// A DECLARED INCUMBENT THAT IS NOT RUNNING REFUSES: it is not the serve the launch was told it supersedes.
-test fn w_a_declared_incumbent_not_read_back_active_refuses() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(a: w_admit(p: v41_arm_plan(p: p), ck: ck,
-      occupancy: map(fabric_group_hosts(g: FabricGroupA), h => GroupArmHostOccupancy { host: h, own_fence: ArmOwnFenceAbsent, admission: HostUnoccupied { available: kibibyte(count: 120000000) } }),
-      incumbent: w_incumbent_on(hosts: fabric_group_hosts(g: FabricGroupA))),
-      fragment: "is not read back active")
-  })
-}
-
-// A DECLARATION ON A HOST THE PLAN DOES NOT LAUNCH ON REFUSES: stopping it is an effect nothing owes.
-test fn w_a_declared_incumbent_off_the_plan_refuses() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(a: w_admit(p: v41_arm_plan(p: p), ck: ck, occupancy: w_running(unit: w_old_unit),
-      incumbent: IncumbentDeclared { units: [ArmIncumbentUnit { host: "srv9" as HostIdentity, unit_name: w_old_unit }], provenance: "witness" as NonEmptyStr }),
-      fragment: "which this launch does not run on")
-  })
-}
-
-// A DECLARED UNIT IS READ: the occupancy reader asks for it by name beside the Spark units and the arm's own.
-test fn w_the_reader_asks_for_every_declared_unit_and_the_arms_own() -> Bool {
-  let names = map(group_arm_read_units(units: glm53_staircase_units, incumbent: IncumbentDeclared { units: [ArmIncumbentUnit { host: "srv5" as HostIdentity, unit_name: "glm-old.service" as NonEmptyStr }], provenance: "witness" as NonEmptyStr }), u => u as String)
-  any(names, n => n == "glm-old.service")
-    && any(names, n => n == (glm53_staircase_units.head_unit_name as String))
-    && any(names, n => n == (glm53_staircase_units.rank_unit_name as String))
-}
-
-// STEP N - 1'S UNITS ARE STEP N'S INCUMBENT: the head unit on rank zero's host, the rank unit elsewhere.
-test fn w_the_previous_step_is_this_arms_own_units() -> Bool {
-  match glm53_previous_step_incumbent(lines_hosts: fabric_group_hosts(g: FabricGroupA)) {
-    NoIncumbentDeclared => false
-    IncumbentDeclared { units: us, provenance: _ } =>
-      length(us) == length(fabric_group_hosts(g: FabricGroupA))
-        && length(filter(us, u => (u.unit_name as String) == (glm53_staircase_units.head_unit_name as String))) == 1
-  }
-}
-
-// ── THE DISPATCH: CLOSED INPUTS, AND V4.1 TAKES NONE OF THE STAIRCASE'S ───────────────────────
-
-fn w_selected_v41(s: ArmGroupLaunchSelection) -> Bool {
-  match s {
-    ArmGroupLaunchSelected { choice: c } => match c { ArmV41GroupA => true  ArmGlm53GroupAStep { step: _, incumbent: _ } => false }
-    ArmGroupLaunchSelectionRefused { cause: _ } => false
-  }
-}
-
-fn w_selected_glm_step(s: ArmGroupLaunchSelection, wire: String) -> Bool {
-  match s {
-    ArmGroupLaunchSelected { choice: c } => match c { ArmV41GroupA => false  ArmGlm53GroupAStep { step: st, incumbent: _ } => (glm53_step_wire(s: st) as String) == wire }
-    ArmGroupLaunchSelectionRefused { cause: _ } => false
-  }
-}
-
-fn w_refused(s: ArmGroupLaunchSelection) -> Bool {
-  match s {
-    ArmGroupLaunchSelected { choice: _ } => false
-    ArmGroupLaunchSelectionRefused { cause: _ } => true
-  }
-}
-
-test fn w_the_dispatch_selects_only_from_closed_vocabularies() -> Bool {
-  w_selected_v41(s: arm_group_launch_select(arm: "v41-group-a", step: "", incumbent: ""))
-    && w_refused(s: arm_group_launch_select(arm: "v41-group-a", step: "fp8-8", incumbent: ""))
-    && w_selected_glm_step(s: arm_group_launch_select(arm: "glm53-group-a", step: "fp8-12", incumbent: "previous-step"), wire: "fp8-12")
-    && w_refused(s: arm_group_launch_select(arm: "glm53-group-a", step: "fp8-13", incumbent: "previous-step"))
-    && w_refused(s: arm_group_launch_select(arm: "glm53-group-a", step: "fp8-12", incumbent: "whatever-runs"))
-    && w_refused(s: arm_group_launch_select(arm: "glm53-group-b", step: "fp8-12", incumbent: "none"))
-}
-
-// THE OBSERVE NEEDS ONLY THE ARM: a GLM observe with no step is admitted, an unknown arm is not.
-test fn w_the_observe_reads_only_the_arm_word() -> Bool {
-  match arm_group_of_word(arm: "glm53-group-a") { ArmGroupNamed { group: _ } => true  ArmGroupWordRefused { cause: _ } => false }
-    && match arm_group_of_word(arm: "glm53-group-b") { ArmGroupNamed { group: _ } => false  ArmGroupWordRefused { cause: _ } => true }
-}
-
-// ── A DANGLING TRANSACTION OF THIS ARM ADMITS TO ADOPTION ONLY ───────────────────────────────
-//
-// nvfp4-8 (runs 37190290418 / 37198685584): the head unit is dead on srv6 under this arm's own fence
-// while the other ranks still run. That is the one shape that admits, and it admits ONLY to adoption
-// (gunbc.spark.group_arm_launch group_arm_adopt_dangling, which issues no pre-apply, no incumbent stop and
-// no apply leg). The REDs: the same inactive unit with no fence of this arm, and the same with the fence
-// unread, refuse exactly as a fresh launch always did.
-fn w_dangling_on_srv6(fence: ArmOwnFence) -> List<GroupArmHostOccupancy> {
-  map(fabric_group_hosts(g: FabricGroupA), h =>
-    if (h as String) == "srv6" {
-      GroupArmHostOccupancy { host: h, own_fence: fence, admission: HostUnoccupied { available: kibibyte(count: 120000000) } }
-    } else {
-      GroupArmHostOccupancy { host: h, own_fence: fence, admission: HostOccupiedBy {
-        occupant: ServingUnitActive { unit: w_old_unit, state: Active },
-        others: [] as List<HostOccupant>,
-        gpu_used: mebibyte(count: 99000) } }
-    })
-}
-
-test fn w_a_dead_rank_under_this_arms_fence_admits_to_adoption_only() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    match w_admit(p: v41_arm_plan(p: p), ck: ck, occupancy: w_dangling_on_srv6(fence: ArmOwnFenceHeld), incumbent: w_incumbent_on(hosts: fabric_group_hosts(g: FabricGroupA))) {
-      GroupArmLaunchAdmittedForAdoptionOnly { hosts: hs } => length(hs) == 1 && all(hs, h => (h as String) == "srv6")
-      GroupArmLaunchAdmitted => false
-      GroupArmLaunchAdmissionRefused { causes: _ } => false
-    }
-  })
-}
-
-test fn w_an_inactive_incumbent_without_this_arms_fence_still_refuses() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(a: w_admit(p: v41_arm_plan(p: p), ck: ck, occupancy: w_dangling_on_srv6(fence: ArmOwnFenceAbsent), incumbent: w_incumbent_on(hosts: fabric_group_hosts(g: FabricGroupA))), fragment: "is not read back active")
-      && w_refused_with(a: w_admit(p: v41_arm_plan(p: p), ck: ck, occupancy: w_dangling_on_srv6(fence: ArmOwnFenceUnread { cause: "witness" }), incumbent: w_incumbent_on(hosts: fabric_group_hosts(g: FabricGroupA))), fragment: "is not read back active")
-  })
-}
-
-// A HOST CARRYING THIS ARM'S UNRESOLVED-ROLLBACK MARKER, its restored units running and declared, admits
-// to resolution only (the leftover stage's recovery readback), never to a fresh apply.
-test fn w_a_marker_on_a_running_restored_arm_admits_to_resolution_only() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    let occ = map(fabric_group_hosts(g: FabricGroupA), h => GroupArmHostOccupancy { host: h, own_fence: ArmOwnRollbackUnresolved, admission: HostOccupiedBy {
-      occupant: ServingUnitActive { unit: w_old_unit, state: Active }, others: [] as List<HostOccupant>, gpu_used: mebibyte(count: 99000) } })
-    match w_admit(p: v41_arm_plan(p: p), ck: ck, occupancy: occ, incumbent: w_incumbent_on(hosts: fabric_group_hosts(g: FabricGroupA))) {
-      GroupArmLaunchAdmittedForAdoptionOnly { hosts: hs } => length(hs) == 4
-      GroupArmLaunchAdmitted => false
-      GroupArmLaunchAdmissionRefused { causes: _ } => false
-    }
-  })
-}
-
-// THE LAUNCH STEP OUTLASTS EVERY ARM'S READINESS DEADLINE PLUS THE TRANSACTION'S BUDGETS: the literal the
-// workflow renders against the derivation from each arm's own VLLM_ENGINE_READY_TIMEOUT_S (the front door's
-// reader). RED: a step timeout of 60 with a 3600 s readiness deadline (nvfp4-8, fleet-converge 37190290418).
-test fn w_the_launch_step_timeout_covers_every_arms_readiness() -> Bool {
-  match arm_launch_step_needed() {
-    ArmLaunchStepNeedRefused { causes: _ } => false
-    ArmLaunchStepNeedDerived { need: n } => (arm_launch_step_timeout_minutes as Int) * 60 >= second_count(s: n) && second_count(s: n) > 3600
-  }
-}
-
-// ── THE AUTOTUNE POLICY IS PART OF LAUNCH AND PERFORMANCE IDENTITY (side-chat ruling on #13319, finding 3)
-//
-// THE RED: the same NVFP4 step with and without VLLM_FLASHINFER_AUTOTUNE_SKIP_OPS. With it, rank 0 runs
-// tuned tactics and ranks 1-3 heuristic ones, so its throughput is a lower bound; without it every rank
-// tunes. If both shared a successor key, a suspension granted to one would admit the other, and if both
-// shared a performance subject their calibration evidence would compare as one configuration. Both keys
-// must differ, and the load receipt must state the policy.
-fn w_without_skip_ops(i: GroupArmLaunchInputs) -> GroupArmLaunchInputs {
-  GroupArmLaunchInputs {
-    assignment: i.assignment, profile: i.profile, intent: i.intent,
-    deployment_env: filter(i.deployment_env, a => (a.name as String) != (vllm_environment_variable_name(v: VllmFlashinferAutotuneSkipOps) as String)),
-    container: i.container, units: i.units, purpose: i.purpose,
-  }
-}
-
-test fn w_skip_ops_present_or_absent_is_a_different_successor_and_subject() -> Bool {
-  match glm53_step_inputs(s: Glm53Nvfp4Step { step: Nvfp4Seats8 }) {
-    Absent => false
-    Present { value: skipping } => {
-      let without = w_without_skip_ops(i: skipping)
-      length(skipping.deployment_env) == length(without.deployment_env) + 1
-        && (match group_arm_row_successor(inputs: skipping) {
-          ArmSuccessorUnkeyed { causes: _ } => false
-          ArmSuccessorKeyed { key: kw } => match group_arm_row_successor(inputs: without) {
-            ArmSuccessorUnkeyed { causes: _ } => false
-            ArmSuccessorKeyed { key: ko } => !content_hash_equal(left: kw, right: ko)
-          }
-        })
-        && (match glm53_step_performance_subject(inputs: skipping) {
-          Absent => false
-          Present { value: pw } => match glm53_step_performance_subject(inputs: without) {
-            Absent => false
-            Present { value: po } => !serving_subject_key_equal(a: serving_subject_key(s: pw), b: serving_subject_key(s: po))
-          }
-        })
-        && string_contains(s: glm53_autotune_standing_wire(env: skipping.deployment_env), pattern: "LOWER BOUND")
-        && !string_contains(s: glm53_autotune_standing_wire(env: without.deployment_env), pattern: "LOWER BOUND")
-    }
-  }
-}
diff --git a/dag/test/claim/spark/group_arm_serving_load_witness_test.dag b/dag/test/claim/spark/group_arm_serving_load_witness_test.dag
deleted file mode 100644
index d1477e11f43..00000000000
--- a/dag/test/claim/spark/group_arm_serving_load_witness_test.dag
+++ /dev/null
@@ -1,97 +0,0 @@
-module test.claim.spark.group_arm_serving_load_witness
-
-import std.types { Bool, String, List, NonEmptyStr }
-import std.nat { Nat }
-import std.measure { byte_size, microsecond }
-import std.optional { Present, Absent }
-import product.host_identity { HostIdentity }
-import extdeps.linux.psi { PsiRead }
-import extdeps.linux.cgroup_v2_memory { CgroupMemoryStat }
-import gunbc.spark.serving_load_probe { LedgerClosed, LedgerIncomplete, SameExporter, ExporterChanged, ContinuityUnread }
-import gunbc.spark.group_arm_serving_load {
-  RankContainerPressure, RankContainerPressureObserved, RankContainerPressureUnread, GroupRankPressure,
-  rank_stop_reasons, ledger_stop_reasons, continuity_stop_reasons,
-  LoadStepResult, LoadStepHeld, LoadStepStopped, sustained_concurrency, floor_and_ceiling_concurrencies,
-}
-
-// ── THE STOP RULES, AT THEIR OWN INTERFACES ─────────────────────────────────────────────────────────
-//
-// Each rule is a fold over one reading, supplied here; the wet route that produces the readings is the
-// runner's (gunbc.spark.serving_load_runner) and is exercised by the load mode's own run.
-
-fn w_rank(host: String, container: String, oom: Nat) -> RankContainerPressure {
-  RankContainerPressure {
-    host: host as HostIdentity,
-    container_id: container as NonEmptyStr,
-    memory: CgroupMemoryStat { anon: byte_size(count: 0), file: byte_size(count: 0), file_mapped: byte_size(count: 0), workingset_refault_file: 0, pgmajfault: 0 },
-    oom_kill: oom,
-    psi: PsiRead { some_total: microsecond(count: 0), full_total: Present { value: microsecond(count: 0) } },
-  }
-}
-
-fn w_group(ranks: List<RankContainerPressure>) -> GroupRankPressure {
-  GroupRankPressure { ranks: map(ranks, r => RankContainerPressureObserved { pressure: r }) }
-}
-
-data w_roster: List<HostIdentity> = ["srv5" as HostIdentity, "srv6" as HostIdentity]
-
-// THE POSITIVE CONTROL: the same containers, no OOM kills -> no stop reason.
-test fn w_a_quiet_roster_gives_no_stop_reason() -> Bool {
-  length(rank_stop_reasons(roster: w_roster,
-    before: w_group(ranks: [w_rank(host: "srv5", container: "a", oom: 0), w_rank(host: "srv6", container: "b", oom: 0)]),
-    after: w_group(ranks: [w_rank(host: "srv5", container: "a", oom: 0), w_rank(host: "srv6", container: "b", oom: 0)]))) == 0
-}
-
-test fn w_an_oom_kill_on_any_rank_stops_the_step() -> Bool {
-  any(rank_stop_reasons(roster: w_roster,
-    before: w_group(ranks: [w_rank(host: "srv5", container: "a", oom: 0), w_rank(host: "srv6", container: "b", oom: 2)]),
-    after: w_group(ranks: [w_rank(host: "srv5", container: "a", oom: 0), w_rank(host: "srv6", container: "b", oom: 3)])),
-    x => string_contains(s: x, pattern: "srv6") && string_contains(s: x, pattern: "OOM killer"))
-}
-
-test fn w_a_changed_rank_container_is_a_restart() -> Bool {
-  any(rank_stop_reasons(roster: w_roster,
-    before: w_group(ranks: [w_rank(host: "srv5", container: "a", oom: 0), w_rank(host: "srv6", container: "b", oom: 0)]),
-    after: w_group(ranks: [w_rank(host: "srv5", container: "c", oom: 0), w_rank(host: "srv6", container: "b", oom: 0)])),
-    x => string_contains(s: x, pattern: "srv5") && string_contains(s: x, pattern: "engine restarted"))
-}
-
-// AN UNREAD RANK IS A STOP, NEVER A PASS.
-test fn w_an_unread_rank_stops_the_step() -> Bool {
-  any(rank_stop_reasons(roster: w_roster,
-    before: GroupRankPressure { ranks: [RankContainerPressureObserved { pressure: w_rank(host: "srv5", container: "a", oom: 0) }, RankContainerPressureUnread { host: "srv6" as HostIdentity, cause: "witness" }] },
-    after: w_group(ranks: [w_rank(host: "srv5", container: "a", oom: 0), w_rank(host: "srv6", container: "b", oom: 0)])),
-    x => string_contains(s: x, pattern: "before srv6"))
-}
-
-test fn w_a_lost_request_or_an_open_ledger_stops_the_step() -> Bool {
-  length(ledger_stop_reasons(l: LedgerClosed { offered: 16, completed: 16, failed: 0 })) == 0
-    && length(ledger_stop_reasons(l: LedgerIncomplete { because: "witness" as NonEmptyStr })) == 1
-}
-
-test fn w_a_changed_or_unread_exporter_stops_the_step() -> Bool {
-  length(continuity_stop_reasons(c: SameExporter { start_field: "1" as NonEmptyStr })) == 0
-    && length(continuity_stop_reasons(c: ExporterChanged { before: "1" as NonEmptyStr, after: "2" as NonEmptyStr })) == 1
-    && length(continuity_stop_reasons(c: ContinuityUnread { cause: "witness" as NonEmptyStr })) == 1
-}
-
-// ── THE SUSTAINED LEVEL: THE UNBROKEN HELD PREFIX ───────────────────────────────────────────────────
-
-fn w_result(c: Nat, held: Bool) -> LoadStepResult {
-  LoadStepResult {
-    concurrency: c,
-    verdict: if held { LoadStepHeld { preemptions: 0 } } else { LoadStepStopped { reasons: ["witness"], unread: false } },
-    completed: Present { value: c * 2 }, restarts: 0, oom_kills: 0, lost: 0,
-  }
-}
-
-test fn w_a_ceiling_that_held_after_the_floor_stopped_sustains_nothing() -> Bool {
-  sustained_concurrency(results: [w_result(c: 8, held: true), w_result(c: 16, held: true)]) == 16
-    && sustained_concurrency(results: [w_result(c: 8, held: true), w_result(c: 16, held: false)]) == 8
-    && sustained_concurrency(results: [w_result(c: 8, held: false), w_result(c: 16, held: true)]) == 0
-}
-
-test fn w_a_step_loads_its_floor_and_its_ceiling() -> Bool {
-  floor_and_ceiling_concurrencies(cold_floor: 8, ceiling: 24) == [8, 24]
-    && floor_and_ceiling_concurrencies(cold_floor: 8, ceiling: 8) == [8]
-}
diff --git a/dag/test/claim/spark/native_serving_resumable_apply_witness_test.dag b/dag/test/claim/spark/native_serving_resumable_apply_witness_test.dag
index 0f48003f205..20437ba8444 100644
--- a/dag/test/claim/spark/native_serving_resumable_apply_witness_test.dag
+++ b/dag/test/claim/spark/native_serving_resumable_apply_witness_test.dag
@@ -5,7 +5,7 @@ import product.host_identity { HostIdentity }
 
 import std.measure { second }
 import std.types { Bool, String, NonEmptyStr, Int }
-import gunbc.fleet_host_identity { operator_host_srv9, operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8 }
+import gunbc.fleet_host_identity { operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
 import extdeps.ssh.session { SshSessionExecResult }
 import gunbc.spark.pair_serving_apply {
   SparkPairHostApplyOutcome, SparkPairHostApplied, SparkPairHostApplyFailed, SparkPairHostUnreached,
@@ -324,12 +324,12 @@ test fn w_a_young_adoptable_fence_still_refuses_as_possibly_live() -> Bool {
 // transaction with the dead rank named, which the body rolls back by its own path with no apply leg.
 test fn w_an_adopted_transaction_with_a_dead_rank_names_it_for_rollback() -> Bool {
   match spark_native_adoption_of(decisions: [
-    LeftoversAdoptable { host: operator_host_srv6, holder: "T1", running: false },
-    LeftoversAdoptable { host: operator_host_srv5, holder: "T1", running: true },
-    LeftoversAdoptable { host: operator_host_srv8, holder: "T1", running: true },
-    LeftoversAdoptable { host: operator_host_srv7, holder: "T1", running: true },
+    LeftoversAdoptable { host: operator_host_srv10, holder: "T1", running: false },
+    LeftoversAdoptable { host: operator_host_srv9, holder: "T1", running: true },
+    LeftoversAdoptable { host: operator_host_srv12, holder: "T1", running: true },
+    LeftoversAdoptable { host: operator_host_srv11, holder: "T1", running: true },
   ]) {
-    AdoptTransaction { holder: t, dead: d } => t == "T1" && count(d) == 1 && all(d, h => (h as String) == "srv6")
+    AdoptTransaction { holder: t, dead: d } => t == "T1" && count(d) == 1 && all(d, h => (h as String) == "srv10")
     AdoptNothing => false
     RecoverRolledBack { holder: _ } => false
     AdoptRefused { cause: _ } => false
@@ -339,8 +339,8 @@ test fn w_an_adopted_transaction_with_a_dead_rank_names_it_for_rollback() -> Boo
 // THE LIVE ARM: every rank running -> adopted with no dead rank, so readback and verdict run, no apply.
 test fn w_an_adopted_transaction_with_every_rank_running_resumes_at_readback() -> Bool {
   match spark_native_adoption_of(decisions: [
-    LeftoversAdoptable { host: operator_host_srv6, holder: "T1", running: true },
-    LeftoversAdoptable { host: operator_host_srv5, holder: "T1", running: true },
+    LeftoversAdoptable { host: operator_host_srv10, holder: "T1", running: true },
+    LeftoversAdoptable { host: operator_host_srv9, holder: "T1", running: true },
   ]) {
     AdoptTransaction { holder: _, dead: d } => count(d) == 0
     AdoptNothing => false
@@ -352,14 +352,14 @@ test fn w_an_adopted_transaction_with_every_rank_running_resumes_at_readback() -
 // WHOLE OR NOT AT ALL: one host without the transaction, or two holders, refuses.
 test fn w_a_partial_or_split_adoption_refuses() -> Bool {
   let partial = spark_native_adoption_of(decisions: [
-    LeftoversAdoptable { host: operator_host_srv6, holder: "T1", running: true },
-    LeftoversNone { host: operator_host_srv5 },
+    LeftoversAdoptable { host: operator_host_srv10, holder: "T1", running: true },
+    LeftoversNone { host: operator_host_srv9 },
   ])
   let two_holders = spark_native_adoption_of(decisions: [
-    LeftoversAdoptable { host: operator_host_srv6, holder: "T1", running: true },
-    LeftoversAdoptable { host: operator_host_srv5, holder: "T2", running: true },
+    LeftoversAdoptable { host: operator_host_srv10, holder: "T1", running: true },
+    LeftoversAdoptable { host: operator_host_srv9, holder: "T2", running: true },
   ])
-  let nothing_held = spark_native_adoption_of(decisions: [LeftoversNone { host: operator_host_srv6 }])
+  let nothing_held = spark_native_adoption_of(decisions: [LeftoversNone { host: operator_host_srv10 }])
   (match partial { AdoptRefused { cause: c } => string_contains(s: c, pattern: "PARTIAL")  AdoptNothing => false  AdoptTransaction { holder: _, dead: _ } => false  RecoverRolledBack { holder: _ } => false })
     && (match two_holders { AdoptRefused { cause: c } => string_contains(s: c, pattern: "SPLIT")  AdoptNothing => false  AdoptTransaction { holder: _, dead: _ } => false  RecoverRolledBack { holder: _ } => false })
     && (match nothing_held { AdoptNothing => true  AdoptRefused { cause: _ } => false  AdoptTransaction { holder: _, dead: _ } => false  RecoverRolledBack { holder: _ } => false })
@@ -392,12 +392,12 @@ test fn w_a_marker_over_a_dead_or_unplanned_rank_still_refuses() -> Bool {
 
 test fn w_a_recovery_is_read_whole_or_refused() -> Bool {
   let whole = spark_native_adoption_of(decisions: [
-    LeftoversRecoverable { host: operator_host_srv6, holder: "T1" },
-    LeftoversRecoverable { host: operator_host_srv5, holder: "T1" },
+    LeftoversRecoverable { host: operator_host_srv10, holder: "T1" },
+    LeftoversRecoverable { host: operator_host_srv9, holder: "T1" },
   ])
   let partial = spark_native_adoption_of(decisions: [
-    LeftoversRecoverable { host: operator_host_srv6, holder: "T1" },
-    LeftoversNone { host: operator_host_srv5 },
+    LeftoversRecoverable { host: operator_host_srv10, holder: "T1" },
+    LeftoversNone { host: operator_host_srv9 },
   ])
   (match whole { RecoverRolledBack { holder: t } => t == "T1"  AdoptNothing => false  AdoptRefused { cause: _ } => false  AdoptTransaction { holder: _, dead: _ } => false })
     && (match partial { AdoptRefused { cause: c } => string_contains(s: c, pattern: "RECOVERY-PARTIAL")  AdoptNothing => false  RecoverRolledBack { holder: _ } => false  AdoptTransaction { holder: _, dead: _ } => false })
@@ -470,7 +470,7 @@ test fn w_the_readback_refuses_an_incarnation_other_than_the_awaited_one() -> Bo
   count(awaited) == 1
     && (match awaited_binding_refusal(host: operator_host_srv9, verified_id: "aaaa1111", awaited: awaited) { Absent => true  Present { value: _ } => false })
     && (match awaited_binding_refusal(host: operator_host_srv9, verified_id: "bbbb2222", awaited: awaited) { Absent => false  Present { value: why } => string_contains(s: why, pattern: "replaced between the wait and the readback") })
-    && (match awaited_binding_refusal(host: "srv5" as HostIdentity, verified_id: "aaaa1111", awaited: awaited) { Absent => false  Present { value: _ } => true })
+    && (match awaited_binding_refusal(host: "srv10" as HostIdentity, verified_id: "aaaa1111", awaited: awaited) { Absent => false  Present { value: _ } => true })
 }
 
 // THE SERVED WORDS ARE QUOTED (fleet-converge run 37304585650): the line rendered unquoted as
diff --git a/dag/test/claim/spark/native_serving_roce_transport_witness_test.dag b/dag/test/claim/spark/native_serving_roce_transport_witness_test.dag
index 41f4f34409d..63b0bb62967 100644
--- a/dag/test/claim/spark/native_serving_roce_transport_witness_test.dag
+++ b/dag/test/claim/spark/native_serving_roce_transport_witness_test.dag
@@ -56,7 +56,7 @@ import gunbc.spark.serving_arm_launch { ArmNodeLaunch, arm_rail_gid_selection, g
 
 // The rollback's script text: its prepare and finish legs, around the typed deliberate start.
 
-data w_awaited_fixture: AwaitedIncarnation = AwaitedIncarnation { host: "srv6" as HostIdentity, id: "0f3a9c1d2e4b" as NonEmptyStr, deadline_epoch: 7654321 }
+data w_awaited_fixture: AwaitedIncarnation = AwaitedIncarnation { host: "srv10" as HostIdentity, id: "0f3a9c1d2e4b" as NonEmptyStr, deadline_epoch: 7654321 }
 
 fn w_rollback_text(unit_name: NonEmptyStr, transaction_id: String, container_name: NonEmptyStr) -> String {
   join([spark_native_rollback_prepare_script(unit_name: unit_name, transaction_id: transaction_id, container_name: container_name),
@@ -180,7 +180,7 @@ test fn w_no_stage_script_parses_nccl_itself() -> Bool {
 
 // ── THE ARM'S ROSTER IS PLANNED HERE, HEAD FIRST ─────────────────────────────────────────────
 //
-// Group B left the pair roster on 2026-09-08 (spark_pair_serving_groups = [FabricGroupA]); this
+// Group B left the pair roster on 2026-09-08 (the pair roster then named only the since-decommissioned group A); this
 // apply is its authority. The head-first order is load-bearing: workers restarted before the
 // head's new rendezvous store existed were observed joining the PREVIOUS epoch's store while the
 // head crash-looped on DistStoreError (2026-09-16).
diff --git a/dag/test/claim/spark/pair_incumbent_identity_wet_witness_test.dag b/dag/test/claim/spark/pair_incumbent_identity_wet_witness_test.dag
deleted file mode 100644
index 0ba393ef2f7..00000000000
--- a/dag/test/claim/spark/pair_incumbent_identity_wet_witness_test.dag
+++ /dev/null
@@ -1,50 +0,0 @@
-module test.claim.spark.pair_incumbent_identity_wet_witness
-
-import std.logic { Bool }
-import std.types { String }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import std.content_hash { ContentHash, compare_content_hash, ContentHashEqual, ContentHashDifferent, ContentHashCrossFamilyIncomparable }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB }
-import gunbc.spark.pair_serving_realization { spark_pair_head_unit_name, spark_pair_worker_unit_name }
-import gunbc.spark.pair_incumbent_identity { DeclaredPairRealizationKeyed, DeclaredPairRealizationUnavailable, declared_pair_realization }
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-// REAL EXECUTION HERE, on the required floor's local-repo wet lane (v2.workflow.local_repo_wet_terminal
-// local_repo_wet_schedule): declared_pair_realization renders Group A's four units from the
-// production declaration and digests each through extdeps.tools.sha256sum Sha256.DigestStdin, which
-// has no mock_response, so no hermetic row can express this. The hermetic rows over supplied values
-// live in test.claim.spark.pair_incumbent_identity_witness; this file is the inhabitance half of
-// DESIGN section 3's pairing obligation for the DECLARED boundary, and the split is the same one
-// test.claim.spark.spark_pair_head_unit_digest_witness makes for the head digest alone.
-
-fn hashes_equal(l: ContentHash, r: ContentHash) -> Bool {
-  match compare_content_hash(left: l, right: r) {
-    ContentHashEqual => true
-    ContentHashDifferent => false
-    ContentHashCrossFamilyIncomparable => false
-  }
-}
-
-// This is the one claim that runs the real declared route: it renders Group A's four units from
-// gunbc.spark.pair_serving_realization and digests them. It asserts the ROUTE -- Keyed, one head,
-// three workers, and a key that is stable across two derivations -- not merely the shape. Deleting
-// the integration (say, declared_pair_realization returning Unavailable for a realized group) fails
-// it. Group B has no pair realization and must say so rather than key an empty pair.
-test fn the_production_declaration_keys_group_a_and_refuses_group_b() -> Bool {
-  match declared_pair_realization(group: FabricGroupA) {
-    DeclaredPairRealizationUnavailable { group: _, obligation: _ } => false
-    DeclaredPairRealizationKeyed { declared: d } =>
-      length(d.workers) == 3
-        && (d.head.unit_name as String) == (spark_pair_head_unit_name as String)
-        && all(d.workers, w => (w.unit_name as String) == (spark_pair_worker_unit_name as String))
-        && (match declared_pair_realization(group: FabricGroupA) {
-              DeclaredPairRealizationKeyed { declared: again } => hashes_equal(l: again.key, r: d.key)
-              DeclaredPairRealizationUnavailable { group: _, obligation: _ } => false
-            })
-        && (match declared_pair_realization(group: FabricGroupB) {
-              DeclaredPairRealizationUnavailable { group: _, obligation: _ } => true
-              DeclaredPairRealizationKeyed { declared: _ } => false
-            })
-  }
-}
diff --git a/dag/test/claim/spark/pair_incumbent_identity_witness_test.dag b/dag/test/claim/spark/pair_incumbent_identity_witness_test.dag
deleted file mode 100644
index 46602a02a81..00000000000
--- a/dag/test/claim/spark/pair_incumbent_identity_witness_test.dag
+++ /dev/null
@@ -1,249 +0,0 @@
-module test.claim.spark.pair_incumbent_identity_witness
-
-import std.logic { Bool }
-import std.types { String, NonEmptyStr, List }
-import std.optional { Present, Absent }
-import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest, compare_content_hash, ContentHashEqual, ContentHashDifferent, ContentHashCrossFamilyIncomparable }
-import product.host_identity { HostIdentity }
-import product.fabric.demand { ObservationReceiptRef }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_srv1 }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
-import gunbc.spark.vllm_endpoint_process_launch { vllm_endpoint_process_launch }
-import gunbc.spark.vllm_serving_launch { vllm_serving_launch, EndpointIncarnationObservation, endpoint_incarnation_observation }
-import gunbc.spark.serving_incarnation_observe { IncarnationUnitNotActive }
-import gunbc.spark.pair_serving_realization { spark_pair_head_unit_name, spark_pair_worker_unit_name }
-import gunbc.spark.pair_incumbent_identity {
-  DeclaredRankUnit, DeclaredPairRealization, declared_pair_realization_of,
-  DeclaredPairRealizationKeyed, DeclaredPairRealizationUnavailable,
-  ObservedRankUnit, ObservedPairRealization, observed_pair_realization_of,
-  ObservedPairRealizationReading, ObservedPairRealizationRead, ObservedPairRealizationRefused,
-  PairWorkerUnitRefused,
-  PairRealizationAgreement, PairRealizationEstablished, PairRealizationDrifted, PairRealizationRankPopulationDiffers,
-  PairRealizationConflict, PairRealizationDeclarationUnavailable, PairRealizationUnread,
-  ImageObservedUncompared, pair_realization_agreement, pair_realization_is_established, pair_realization_agreement_lines,
-}
-
-// THE CLAIMS DISCRIMINATE AT ONE INTERFACE EACH (DESIGN §3 witness rule). The agreement fold takes
-// a declared standing and an observed reading as SUPPLIED VALUES; the fixtures below construct
-// them, so no claim re-renders a unit or opens an ssh session to ask what the fold answers, and
-// every row here is hermetic. The pairing obligation is discharged at the declared boundary by
-// test.claim.spark.pair_incumbent_identity_wet_witness, which runs the PRODUCTION declared producer
-// over Group A on the local-repo wet lane (it reaches sha256sum DigestStdin, which has no mock).
-// The observed boundary's producer reads four Sparks over the fleet key session and has no CI
-// route: its inhabitance is the operator-run instrument gunbc.instruments.pair_incumbent_identity_standing
-// and the receipt it writes, the same boundary gunbc.spark.serving_incarnation_observe's witness draws.
-
-fn t_sha(hex: String) -> ContentHash? {
-  match sha256_hex_digest(hex: hex) {
-    Absent => none
-    Present { value: d } => Present { value: Sha256Hash(d) }
-  }
-}
-
-data t_hex_a: String = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-data t_hex_b: String = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
-data t_hex_c: String = "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
-data t_hex_img: String = "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
-
-// Every scenario needs the same three digests; folding them once keeps each claim a scenario over
-// supplied hashes rather than four Option matches deep.
-fn with_digests(scenario: fn(ContentHash, ContentHash, ContentHash, ContentHash) -> Bool) -> Bool {
-  match t_sha(hex: t_hex_a) {
-    Absent => false
-    Present { value: a } =>
-      match t_sha(hex: t_hex_b) {
-        Absent => false
-        Present { value: b } =>
-          match t_sha(hex: t_hex_c) {
-            Absent => false
-            Present { value: c } =>
-              match t_sha(hex: t_hex_img) {
-                Absent => false
-                Present { value: img } => scenario(a, b, c, img)
-              }
-          }
-      }
-  }
-}
-
-fn t_declared(head_digest: ContentHash, worker_digest: ContentHash) -> DeclaredPairRealization {
-  declared_pair_realization_of(
-    group: FabricGroupA,
-    head: DeclaredRankUnit { host: operator_host_srv5, unit_name: spark_pair_head_unit_name, digest: head_digest },
-    workers: [
-      DeclaredRankUnit { host: operator_host_srv6, unit_name: spark_pair_worker_unit_name, digest: worker_digest },
-      DeclaredRankUnit { host: operator_host_srv7, unit_name: spark_pair_worker_unit_name, digest: worker_digest },
-      DeclaredRankUnit { host: operator_host_srv8, unit_name: spark_pair_worker_unit_name, digest: worker_digest },
-    ],
-  )
-}
-
-fn t_head_observation(unit_digest: ContentHash, image: ContentHash) -> EndpointIncarnationObservation {
-  endpoint_incarnation_observation(
-    endpoint: vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "http://10.0.0.5:8000" as NonEmptyStr, process_start_field: "1" as NonEmptyStr),
-    launch: vllm_serving_launch(
-      group: FabricGroupA, head: operator_host_srv5,
-      systemd_invocation: "fixture-invocation-head" as NonEmptyStr, container_id: "fixture-container" as NonEmptyStr,
-      executable_digest: image, unit_digest: unit_digest, started_at: 1788907506,
-    ),
-    container_env: [],
-    receipt: "test.claim.spark.pair_incumbent_identity_witness fixture" as ObservationReceiptRef,
-  )
-}
-
-fn t_worker(host: HostIdentity, unit_digest: ContentHash) -> ObservedRankUnit {
-  ObservedRankUnit { host: host, unit_name: spark_pair_worker_unit_name, systemd_invocation: "fixture-invocation-worker" as NonEmptyStr, unit_digest: unit_digest }
-}
-
-fn t_observed(head_digest: ContentHash, image: ContentHash, workers: List<ObservedRankUnit>) -> ObservedPairRealizationReading {
-  ObservedPairRealizationRead {
-    observed: observed_pair_realization_of(
-      group: FabricGroupA, head: t_head_observation(unit_digest: head_digest, image: image), workers: workers,
-      receipt: "test.claim.spark.pair_incumbent_identity_witness fixture" as ObservationReceiptRef,
-    ),
-  }
-}
-
-fn t_three_workers(digest: ContentHash) -> List<ObservedRankUnit> {
-  [t_worker(host: operator_host_srv6, unit_digest: digest), t_worker(host: operator_host_srv7, unit_digest: digest), t_worker(host: operator_host_srv8, unit_digest: digest)]
-}
-
-fn t_agreement(declared: DeclaredPairRealization, observed: ObservedPairRealizationReading) -> PairRealizationAgreement {
-  pair_realization_agreement(declared: DeclaredPairRealizationKeyed { declared: declared }, observed: observed)
-}
-
-fn hashes_equal(l: ContentHash, r: ContentHash) -> Bool {
-  match compare_content_hash(left: l, right: r) {
-    ContentHashEqual => true
-    ContentHashDifferent => false
-    ContentHashCrossFamilyIncomparable => false
-  }
-}
-
-// ── THE KEY ────────────────────────────────────────────────────────────────────────────────────
-
-// Same ranks, same key: the key is a function of the declaration and nothing else.
-test fn the_declared_key_is_a_function_of_its_ranks() -> Bool {
-  with_digests(scenario: fn(a, b, c, img) {
-    hashes_equal(l: t_declared(head_digest: a, worker_digest: b).key, r: t_declared(head_digest: a, worker_digest: b).key)
-  })
-}
-
-// RED -- one worker's bytes change and the key changes; the head's bytes change and it changes again.
-test fn any_ranks_bytes_changing_changes_the_key() -> Bool {
-  with_digests(scenario: fn(a, b, c, img) {
-    let base = t_declared(head_digest: a, worker_digest: b)
-    !hashes_equal(l: base.key, r: t_declared(head_digest: a, worker_digest: c).key)
-      && !hashes_equal(l: base.key, r: t_declared(head_digest: c, worker_digest: b).key)
-  })
-}
-
-// ── THE AGREEMENT ──────────────────────────────────────────────────────────────────────────────
-
-// Every rank's observed unit digest equals its declared one: established, carrying both sides and
-// the head's image id as UNCOMPARED -- the observed side has an image id, the declared side has none.
-test fn a_pair_matching_every_rank_is_established_with_its_image_uncompared() -> Bool {
-  with_digests(scenario: fn(a, b, c, img) {
-    let d = t_declared(head_digest: a, worker_digest: b)
-    match t_agreement(declared: d, observed: t_observed(head_digest: a, image: img, workers: t_three_workers(digest: b))) {
-      PairRealizationEstablished { key: k, declared: _, observed: _, image: ImageObservedUncompared { observed: seen, obligation: _ } } =>
-        hashes_equal(l: k, r: d.key) && hashes_equal(l: seen, r: img)
-      _ => false
-    }
-  })
-}
-
-// RED -- ONE worker runs a unit whose bytes differ from the declared ones. The verdict is Drifted,
-// naming exactly that host, and it is not Established however many ranks agree.
-test fn one_drifted_worker_is_drifted_naming_that_host() -> Bool {
-  with_digests(scenario: fn(a, b, c, img) {
-    let workers = [t_worker(host: operator_host_srv6, unit_digest: b), t_worker(host: operator_host_srv7, unit_digest: c), t_worker(host: operator_host_srv8, unit_digest: b)]
-    let verdict = t_agreement(declared: t_declared(head_digest: a, worker_digest: b), observed: t_observed(head_digest: a, image: img, workers: workers))
-    match verdict {
-      PairRealizationDrifted { key: _, drifted: ds } =>
-        length(ds) == 1 && all(ds, x => (x.host as String) == (operator_host_srv7 as String)) && !pair_realization_is_established(a: verdict)
-      _ => false
-    }
-  })
-}
-
-// RED -- the HEAD was launched from different unit bytes: the head row drifts through the same
-// provenance comparison the offer route uses, so a head drift is a drift and not a population issue.
-test fn a_head_launched_from_other_bytes_is_drifted() -> Bool {
-  with_digests(scenario: fn(a, b, c, img) {
-    match t_agreement(declared: t_declared(head_digest: a, worker_digest: b), observed: t_observed(head_digest: c, image: img, workers: t_three_workers(digest: b))) {
-      PairRealizationDrifted { key: _, drifted: ds } => length(ds) == 1 && all(ds, x => (x.host as String) == (operator_host_srv5 as String))
-      _ => false
-    }
-  })
-}
-
-// RED -- a declared worker host with no observed rank: the two sides are not about the same
-// machines, which is reported as a population difference and never as agreement over the rest.
-test fn a_missing_worker_rank_is_a_population_difference() -> Bool {
-  with_digests(scenario: fn(a, b, c, img) {
-    let workers = [t_worker(host: operator_host_srv6, unit_digest: b), t_worker(host: operator_host_srv8, unit_digest: b)]
-    match t_agreement(declared: t_declared(head_digest: a, worker_digest: b), observed: t_observed(head_digest: a, image: img, workers: workers)) {
-      PairRealizationRankPopulationDiffers { key: _, declared_hosts: dh, observed_hosts: oh } => length(dh) == 4 && length(oh) == 3
-      _ => false
-    }
-  })
-}
-
-// RED -- the answering head is on a host the declaration does not name as head.
-test fn a_head_on_another_host_is_a_population_difference() -> Bool {
-  with_digests(scenario: fn(a, b, c, img) {
-    let head = endpoint_incarnation_observation(
-      endpoint: vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "http://10.0.0.1:8000" as NonEmptyStr, process_start_field: "1" as NonEmptyStr),
-      launch: vllm_serving_launch(
-        group: FabricGroupA, head: operator_host_srv1,
-        systemd_invocation: "fixture-invocation-head" as NonEmptyStr, container_id: "fixture-container" as NonEmptyStr,
-        executable_digest: img, unit_digest: a, started_at: 1788907506,
-      ),
-      container_env: [],
-      receipt: "test.claim.spark.pair_incumbent_identity_witness fixture" as ObservationReceiptRef,
-    )
-    let observed = ObservedPairRealizationRead {
-      observed: observed_pair_realization_of(group: FabricGroupA, head: head, workers: t_three_workers(digest: b), receipt: "test.claim.spark.pair_incumbent_identity_witness fixture" as ObservationReceiptRef),
-    }
-    match t_agreement(declared: t_declared(head_digest: a, worker_digest: b), observed: observed) {
-      PairRealizationRankPopulationDiffers { key: _, declared_hosts: _, observed_hosts: _ } => true
-      _ => false
-    }
-  })
-}
-
-// An observation that refused is UNREAD, carrying the refusal and the declared key -- never Drifted
-// (nothing was compared) and never Established.
-test fn a_refused_observation_is_unread_not_drifted() -> Bool {
-  with_digests(scenario: fn(a, b, c, img) {
-    let refused = ObservedPairRealizationRefused { refusal: PairWorkerUnitRefused { host: operator_host_srv7, refusal: IncarnationUnitNotActive { unit: spark_pair_worker_unit_name } } }
-    let d = t_declared(head_digest: a, worker_digest: b)
-    match t_agreement(declared: d, observed: refused) {
-      PairRealizationUnread { key: k, refusal: PairWorkerUnitRefused { host: h, refusal: _ } } => hashes_equal(l: k, r: d.key) && (h as String) == (operator_host_srv7 as String)
-      _ => false
-    }
-  })
-}
-
-// A declaration that could not be keyed has nothing to agree with, whatever was observed.
-test fn an_unavailable_declaration_is_reported_before_the_observation() -> Bool {
-  with_digests(scenario: fn(a, b, c, img) {
-    match pair_realization_agreement(
-      declared: DeclaredPairRealizationUnavailable { group: FabricGroupA, obligation: "witness" as NonEmptyStr },
-      observed: t_observed(head_digest: a, image: img, workers: t_three_workers(digest: b)),
-    ) {
-      PairRealizationDeclarationUnavailable { group: _, obligation: o } => (o as String) == "witness"
-      _ => false
-    }
-  })
-}
-
-// The receipt lines locate the verdict: a drift renders one line per drifted host under its verdict line.
-test fn the_receipt_renders_one_line_per_drifted_rank() -> Bool {
-  with_digests(scenario: fn(a, b, c, img) {
-    let workers = [t_worker(host: operator_host_srv6, unit_digest: c), t_worker(host: operator_host_srv7, unit_digest: c), t_worker(host: operator_host_srv8, unit_digest: b)]
-    let lines = pair_realization_agreement_lines(a: t_agreement(declared: t_declared(head_digest: a, worker_digest: b), observed: t_observed(head_digest: a, image: img, workers: workers)))
-    length(lines) == 3
-  })
-}
diff --git a/dag/test/claim/spark/pair_serving_authority_log_real_execution_witness_test.dag b/dag/test/claim/spark/pair_serving_authority_log_real_execution_witness_test.dag
index b15f519292e..d1abcca7133 100644
--- a/dag/test/claim/spark/pair_serving_authority_log_real_execution_witness_test.dag
+++ b/dag/test/claim/spark/pair_serving_authority_log_real_execution_witness_test.dag
@@ -3,7 +3,7 @@ module test.claim.spark.pair_serving_authority_log_real_execution
 import std.logic { Bool }
 import std.types { String, NonEmptyStr, FilePath, List }
 import std.optional { Present, Absent }
-import gunbc.spark.fabric_switch_observed { fabric_group_hosts }
+import gunbc.spark.fabric_switch_observed { fabric_group_hosts, FabricGroup, FabricGroupB }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import extdeps.shell
 import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest }
@@ -13,7 +13,6 @@ import gunbc.spark.released_baseline { QuiescentReservedBaseline }
 import product.capacity.event_chain { EventId, HeadAbsent, HeadAt, head_expectation_eq }
 import gunbc.fabric_storage_client { FabricStorageBinding, FabricStorageLocalFiles }
 import gunbc.fabric_storage_file_store { fabric_storage_file_root, fabric_storage_file_root_ensure, FabricStorageRootReady }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB }
 import gunbc.spark.pair_serving_authority { PairServingGroupAuthority, PairServingActive, SuspensionPendingReconciliation, SuspendedForAuthorizedSuccessor, ReleasedToFleet, PairRealizationKeyed, PairRealizationUnestablished, pair_serving_authority_for, pair_serving_successor_may_launch }
 import gunbc.spark.host_commitment {
   SparkHostAdmitted, SparkHostRefused, HostEffectHandle, admit_unplaced_host_over, release_host_effect_over,
@@ -41,11 +40,6 @@ import gunbc.spark.pair_serving_authority_log {
   authority_eq,
 }
 import std.algebra { trim }
-import std.process { ProcessExit, ExitSuccess, ExitFailure }
-import gunbc.spark.standing_host_effect_recover { standing_host_effect_recover_over }
-import gunbc.spark.pair_serving_d0_door { StandingGrantRowOnMain, StandingGrantRowNotOnMain }
-import gunbc.spark.host_effect_quiescence { ClaimantAbandoned }
-import gunbc.spark.pair_serving_authority_log { live_claim_on, LiveClaimFound, LiveClaimAbsent, LiveClaimUnread }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
@@ -67,19 +61,22 @@ fn alr_witness_layout(dir: FilePath) -> FabricStorageBinding {
   FabricStorageLocalFiles { root: fabric_storage_file_root(root: join([dir as String, "/fabric-storage"], "") as NonEmptyStr) }
 }
 
-// A ready remote has group A's source row ESTABLISHED on its partition (the durable genesis the
-// fold reads from), at 990, before any scenario event; group B stays unestablished.
-fn alr_witness_remote_ready(dir: FilePath) -> Bool {
-  (match fabric_storage_file_root_ensure(root: fabric_storage_file_root(root: join([dir as String, "/fabric-storage"], "") as NonEmptyStr)) { FabricStorageRootReady => true  _ => false })
-    && alr_established(store: alr_witness_layout(dir: dir), group: FabricGroupA)
+// THE RESTING ROW IS SUPPLIED, not read from the source roster: the roster claims no group, and
+// what these claims establish is the log's behaviour over an established Active row, which holds
+// for any group. The establishment itself still runs for real.
+fn alr_resting() -> PairServingGroupAuthority {
+  PairServingActive { group: FabricGroupB {}, exact_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr } }
 }
 
-fn alr_established(store: FabricStorageBinding, group: FabricGroup) -> Bool {
-  match pair_serving_authority_for(group: group) {
-    Absent => false
-    Present { value: desired } =>
-      match pair_serving_authority_establish(store: store, group: group, authority: desired, actor: "witness" as NonEmptyStr, at: 990) { AuthorityEstablishedAt { id: _ } => true  AuthorityEstablishmentRefused { group: _, step: _, reason: _ } => false }
-  }
+fn alr_witness_root_ready(dir: FilePath) -> Bool {
+  match fabric_storage_file_root_ensure(root: fabric_storage_file_root(root: join([dir as String, "/fabric-storage"], "") as NonEmptyStr)) { FabricStorageRootReady => true  _ => false }
+}
+
+// A ready remote has group B's supplied resting row ESTABLISHED on its partition (the durable
+// genesis the fold reads from), at 990, before any scenario event.
+fn alr_witness_remote_ready(dir: FilePath) -> Bool {
+  alr_witness_root_ready(dir: dir)
+    && (match pair_serving_authority_establish(store: alr_witness_layout(dir: dir), group: FabricGroupB {}, authority: alr_resting(), actor: "witness" as NonEmptyStr, at: 990) { AuthorityEstablishedAt { id: _ } => true  AuthorityEstablishmentRefused { group: _, step: _, reason: _ } => false })
 }
 
 fn alr_with_hash(scenario: fn(ContentHash) -> Bool) -> Bool {
@@ -91,12 +88,12 @@ fn alr_with_hash(scenario: fn(ContentHash) -> Bool) -> Bool {
 
 fn alr_w_pending(h: ContentHash) -> PairServingGroupAuthority {
   SuspensionPendingReconciliation {
-    group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-real" as NonEmptyStr, authorization_binding: h,
+    group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-real" as NonEmptyStr, authorization_binding: h,
     lease: held_lease(epoch: LeaseEpoch { lease_key: "tx-real" as NonEmptyStr, resource_fingerprint: h, owner_fingerprint: h, generation: 1 }, observed: LeaseRunningExpected),
   }
 }
 
-// THE GRANT IS MINTED FROM THE ADMITTING WRITE, as the D0 transaction mints it: reference = the
+// THE GRANT IS MINTED FROM THE ADMITTING WRITE, as a suspending transaction mints it: reference = the
 // transaction, fence = (the event that landed the pending state, the pending generation), a
 // 1000-second term from 1000 -- so a read at 1000 sees the lease running and a read at 2500
 // sees it stale. A grant whose fence names another event, or another transaction, is refused
@@ -107,7 +104,7 @@ fn alr_w_grant(admitting: EventId, reference: NonEmptyStr, generation: Int) -> L
 
 fn alr_w_suspended(h: ContentHash) -> PairServingGroupAuthority {
   SuspendedForAuthorizedSuccessor {
-    group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), authorization: "esc-real" as NonEmptyStr, exact_candidate_realization: PairRealizationKeyed { key: h },
+    group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), authorization: "esc-real" as NonEmptyStr, exact_candidate_realization: PairRealizationKeyed { key: h },
     lease: held_lease(epoch: LeaseEpoch { lease_key: "tx-real" as NonEmptyStr, resource_fingerprint: h, owner_fingerprint: h, generation: 1 }, observed: LeaseRunningExpected),
     cleanup: QuiescentReservedBaseline,
   }
@@ -136,38 +133,35 @@ test fn a_transition_is_read_back_and_a_stale_one_names_the_current_by_real_exec
   alr_with_hash(scenario: fn(h) {
     alr_with_temp_dir(scenario: fn(dir) {
       let store = alr_witness_layout(dir: dir)
-      match pair_serving_authority_for(group: FabricGroupA) {
-        Absent => false
-        Present { value: resting } =>
-          alr_witness_remote_ready(dir: dir)
-            && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1000), expected: resting, generation: 0)
-            && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: alr_w_pending(h: h), transaction: "tx-real" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) {
-                  AuthorityTransitionAppended { id: admitting, generation: g1, next: _ } =>
-                    g1 == 1
-                      && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1000), expected: alr_w_pending(h: h), generation: 1)
-                      && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: alr_w_pending(h: h), next: alr_w_suspended(h: h), transaction: "tx-real" as NonEmptyStr, lifecycle: none, grant: Present { value: alr_w_grant(admitting: "not-the-admitting-event" as EventId, reference: "tx-real" as NonEmptyStr, generation: 1) }, entry_state: none, actor: "witness" as NonEmptyStr, at: 1001) {
-                            AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "grant"
-                            _ => false
-                          })
-                      && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: alr_w_pending(h: h), next: alr_w_suspended(h: h), transaction: "tx-real" as NonEmptyStr, lifecycle: none, grant: Present { value: alr_w_grant(admitting: admitting, reference: "tx-other" as NonEmptyStr, generation: 1) }, entry_state: none, actor: "witness" as NonEmptyStr, at: 1001) {
-                            AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "grant"
-                            _ => false
-                          })
-                      && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1001), expected: alr_w_pending(h: h), generation: 1)
-                      && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: alr_w_pending(h: h), next: alr_w_suspended(h: h), transaction: "tx-real" as NonEmptyStr, lifecycle: none, grant: Present { value: alr_w_grant(admitting: admitting, reference: "tx-real" as NonEmptyStr, generation: 1) }, entry_state: none, actor: "witness" as NonEmptyStr, at: 1001) {
-                            AuthorityTransitionAppended { id: _, generation: g2, next: _ } => g2 == 2
-                            _ => false
-                          })
-                      && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1001), expected: alr_w_suspended(h: h), generation: 2)
-                      && alr_current_may_launch(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1001))
-                      && !alr_current_may_launch(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 2500))
-                      && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: alr_w_pending(h: h), transaction: "tx-late" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 2600) {
-                            AuthorityTransitionStale { expected: _, current: c } => authority_eq(a: c, b: alr_w_suspended(h: h))
-                            _ => false
-                          })
-                  _ => false
-                })
-      }
+      let resting = alr_resting()
+      alr_witness_remote_ready(dir: dir)
+        && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1000), expected: resting, generation: 0)
+        && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: resting, next: alr_w_pending(h: h), transaction: "tx-real" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) {
+              AuthorityTransitionAppended { id: admitting, generation: g1, next: _ } =>
+                g1 == 1
+                  && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1000), expected: alr_w_pending(h: h), generation: 1)
+                  && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: alr_w_pending(h: h), next: alr_w_suspended(h: h), transaction: "tx-real" as NonEmptyStr, lifecycle: none, grant: Present { value: alr_w_grant(admitting: "not-the-admitting-event" as EventId, reference: "tx-real" as NonEmptyStr, generation: 1) }, entry_state: none, actor: "witness" as NonEmptyStr, at: 1001) {
+                        AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "grant"
+                        _ => false
+                      })
+                  && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: alr_w_pending(h: h), next: alr_w_suspended(h: h), transaction: "tx-real" as NonEmptyStr, lifecycle: none, grant: Present { value: alr_w_grant(admitting: admitting, reference: "tx-other" as NonEmptyStr, generation: 1) }, entry_state: none, actor: "witness" as NonEmptyStr, at: 1001) {
+                        AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "grant"
+                        _ => false
+                      })
+                  && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1001), expected: alr_w_pending(h: h), generation: 1)
+                  && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: alr_w_pending(h: h), next: alr_w_suspended(h: h), transaction: "tx-real" as NonEmptyStr, lifecycle: none, grant: Present { value: alr_w_grant(admitting: admitting, reference: "tx-real" as NonEmptyStr, generation: 1) }, entry_state: none, actor: "witness" as NonEmptyStr, at: 1001) {
+                        AuthorityTransitionAppended { id: _, generation: g2, next: _ } => g2 == 2
+                        _ => false
+                      })
+                  && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1001), expected: alr_w_suspended(h: h), generation: 2)
+                  && alr_current_may_launch(c: current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1001))
+                  && !alr_current_may_launch(c: current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 2500))
+                  && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: resting, next: alr_w_pending(h: h), transaction: "tx-late" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 2600) {
+                        AuthorityTransitionStale { expected: _, current: c } => authority_eq(a: c, b: alr_w_suspended(h: h))
+                        _ => false
+                      })
+              _ => false
+            })
     })
   })
 }
@@ -178,12 +172,12 @@ test fn an_unclaimed_group_is_refused_at_the_claim_by_real_execution() -> Bool {
   alr_with_hash(scenario: fn(h) {
     alr_with_temp_dir(scenario: fn(dir) {
       let store = alr_witness_layout(dir: dir)
-      alr_witness_remote_ready(dir: dir)
-        && (match current_pair_serving_authority(store: store, group: FabricGroupB, at: 1000) {
+      alr_witness_root_ready(dir: dir)
+        && (match current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1000) {
               CurrentAuthorityUnread { group: _, step: s, reason: _ } => s == "claim"
               CurrentAuthorityRead { authority: _, head: _, generation: _, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } => false
             })
-        && (match pair_serving_authority_transition(store: store, group: FabricGroupB, expected: PairServingActive { group: FabricGroupB, exact_realization: PairRealizationUnestablished { obligation: "w" as NonEmptyStr } }, next: PairServingActive { group: FabricGroupB, exact_realization: PairRealizationUnestablished { obligation: "w" as NonEmptyStr } }, transaction: "tx" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) {
+        && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: PairServingActive { group: FabricGroupB {}, exact_realization: PairRealizationUnestablished { obligation: "w" as NonEmptyStr } }, next: PairServingActive { group: FabricGroupB {}, exact_realization: PairRealizationUnestablished { obligation: "w" as NonEmptyStr } }, transaction: "tx" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) {
               AuthorityTransitionRefused { group: _, step: s, reason: _ } => s == "claim"
               _ => false
             })
@@ -193,9 +187,9 @@ test fn an_unclaimed_group_is_refused_at_the_claim_by_real_execution() -> Bool {
 
 // ── THE HOST-EFFECT CLAIM IS A FENCE, BY REAL EXECUTION ────────────────────────────────────────
 //
-// Group A is released to the fleet (generation 1). The production effect admission over the
+// Group B (supplied resting row) is released to the fleet (generation 1). The production effect admission over the
 // current authority (admit_unplaced_host_over, the fold admit_unplaced_host_live runs on the
-// executor's store) admits srv5 and lands a CLAIM on the group's partition; the operator's
+// executor's store) admits one of its hosts and lands a CLAIM on the group's partition; the operator's
 // re-claim (Released → Active) is then REFUSED at the head -- the same head lease the claim
 // landed under -- until the claim is released; after the release it lands.
 fn alr_srv(s: String) -> HostIdentity {
@@ -245,7 +239,7 @@ fn alr_occupied(store: FabricStorageBinding, host: HostIdentity, at: Int) -> Boo
 
 // The witness's intent for `cur → released` under `operation` at `head`.
 fn alr_intent(head: HeadExpectation, cur: PairServingGroupAuthority, released: PairServingGroupAuthority, operation: String) -> AuthorityWriteIntent {
-  authority_write_intent(group: FabricGroupA, head: head, actor: "witness" as NonEmptyStr, previous: Present { value: cur }, next: released, operation: operation as NonEmptyStr, lifecycle: none, grant: none, entry_state: none)
+  authority_write_intent(group: FabricGroupB {}, head: head, actor: "witness" as NonEmptyStr, previous: Present { value: cur }, next: released, operation: operation as NonEmptyStr, lifecycle: none, grant: none, entry_state: none)
 }
 
 fn alr_recovery(preparation: EventId) -> ReleaseProvenance {
@@ -259,36 +253,6 @@ fn alr_release_with_quiet(handle: HostEffectHandle, store: FabricStorageBinding,
   }
 }
 
-test fn a_live_host_effect_claim_fences_the_reclaim_until_released_by_real_execution() -> Bool {
-  alr_with_hash(scenario: fn(h) {
-    alr_with_temp_dir(scenario: fn(dir) {
-      let store = alr_witness_layout(dir: dir)
-      let released = ReleasedToFleet { group: FabricGroupA, release_receipt: h }
-      let srv5 = match get(xs: fabric_group_hosts(g: FabricGroupA), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv8") }
-      match pair_serving_authority_for(group: FabricGroupA) {
-        Absent => false
-        Present { value: resting } =>
-          alr_witness_remote_ready(dir: dir)
-            && (match admit_unplaced_host_over(raw: srv5 as String, purpose: "a witness build" as NonEmptyStr, term: second(count: 100), residue: alr_residue(pattern: "/srv/build"), store: store, executor: "executor-1" as NonEmptyStr, at: 1000) { SparkHostRefused { cause: _ } => true  SparkHostAdmitted { host: _, claim: _ } => false })
-            && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: released, transaction: "tx-release" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) { AuthorityTransitionAppended { id: _, generation: g1, next: _ } => g1 == 1  _ => false })
-            && (match admit_unplaced_host_over(raw: srv5 as String, purpose: "a witness build" as NonEmptyStr, term: second(count: 100), residue: alr_residue(pattern: "/srv/build"), store: store, executor: "executor-1" as NonEmptyStr, at: 1001) {
-                  SparkHostAdmitted { host: _, claim: Present { value: handle } } =>
-                    (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1002) {
-                       AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "host-effects"
-                       _ => false
-                     })
-                      && alr_release_with_quiet(handle: handle, store: store, at: 1003)
-                      && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1004) {
-                            AuthorityTransitionAppended { id: _, generation: g2, next: _ } => g2 == 2
-                            _ => false
-                          })
-                  _ => false
-                })
-      }
-    })
-  })
-}
-
 // AN OVERDUE CLAIM STILL FENCES. A term-10 claim at 1001 refuses the re-claim at 1005 AND at 1012
 // (the claim is old, the effect is not known gone); a release with quiescence evidence lands the
 // re-claim; a claim on a host the Active state commits refuses at `committed`; a second claim on a
@@ -297,25 +261,22 @@ test fn an_overdue_host_effect_claim_fences_until_released_by_real_execution() -
   alr_with_hash(scenario: fn(h) {
     alr_with_temp_dir(scenario: fn(dir) {
       let store = alr_witness_layout(dir: dir)
-      let released = ReleasedToFleet { group: FabricGroupA, release_receipt: h }
-      let srv = match get(xs: fabric_group_hosts(g: FabricGroupA), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv8") }
-      match pair_serving_authority_for(group: FabricGroupA) {
-        Absent => false
-        Present { value: resting } =>
-          alr_witness_remote_ready(dir: dir)
-            && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: released, transaction: "tx-release" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) { AuthorityTransitionAppended { id: _, generation: _, next: _ } => true  _ => false })
-            && (match host_effect_admit(store: store, host: srv, purpose: "a crashed lane" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 10), residue: alr_residue(pattern: "/srv/build"), at: 1001) {
-                  HostEffectClaimed { id: claim } =>
-                    (match host_effect_admit(store: store, host: srv, purpose: "a second lane" as NonEmptyStr, executor: "executor-2" as NonEmptyStr, term: second(count: 10), residue: alr_residue(pattern: "/srv/build"), at: 1002) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "held"  _ => false })
-                      && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1005) { AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "host-effects"  _ => false })
-                      && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1012) { AuthorityTransitionRefused { group: _, step: st, reason: r } => st == "host-effects" && r.contains("OVERDUE")  _ => false })
-                      && (match alr_evidence_for(claim: claim, host: srv, spec: alr_residue(pattern: "/srv/other"), at: 1013) { Present { value: e } => (match host_effect_release(store: store, claim: claim, evidence: e, provenance: RecoveryAuthorized { claim: claim, claimant: ClaimantTerminated, authorized_by: "operator" as NonEmptyStr, receipt: "lane run 7 cancelled" as NonEmptyStr }, executor: "operator" as NonEmptyStr, at: 1013) { HostEffectReleaseRefused { partition: _, step: st, reason: _ } => st == "evidence"  _ => false })  Absent => false })
-                      && (match alr_evidence_for(claim: claim, host: srv, spec: alr_residue(pattern: "/srv/build"), at: 1013) { Present { value: e } => (match host_effect_release(store: store, claim: claim, evidence: e, provenance: RecoveryAuthorized { claim: claim, claimant: ClaimantTerminated, authorized_by: "operator" as NonEmptyStr, receipt: "lane run 7 cancelled" as NonEmptyStr }, executor: "operator" as NonEmptyStr, at: 1013) { HostEffectReleasedAt { id: _ } => true  _ => false })  Absent => false })
-                      && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1014) { AuthorityTransitionAppended { id: _, generation: g2, next: _ } => g2 == 2  _ => false })
-                      && (match host_effect_admit(store: store, host: srv, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 10), residue: alr_residue(pattern: "/srv/build"), at: 1015) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
-                  _ => false
-                })
-      }
+      let released = ReleasedToFleet { group: FabricGroupB {}, release_receipt: h }
+      let srv = match get(xs: fabric_group_hosts(g: FabricGroupB {}), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv10") }
+      let resting = alr_resting()
+      alr_witness_remote_ready(dir: dir)
+        && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: resting, next: released, transaction: "tx-release" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) { AuthorityTransitionAppended { id: _, generation: _, next: _ } => true  _ => false })
+        && (match host_effect_admit(store: store, host: srv, purpose: "a crashed lane" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 10), residue: alr_residue(pattern: "/srv/build"), at: 1001) {
+              HostEffectClaimed { id: claim } =>
+                (match host_effect_admit(store: store, host: srv, purpose: "a second lane" as NonEmptyStr, executor: "executor-2" as NonEmptyStr, term: second(count: 10), residue: alr_residue(pattern: "/srv/build"), at: 1002) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "held"  _ => false })
+                  && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1005) { AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "host-effects"  _ => false })
+                  && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1012) { AuthorityTransitionRefused { group: _, step: st, reason: r } => st == "host-effects" && r.contains("OVERDUE")  _ => false })
+                  && (match alr_evidence_for(claim: claim, host: srv, spec: alr_residue(pattern: "/srv/other"), at: 1013) { Present { value: e } => (match host_effect_release(store: store, claim: claim, evidence: e, provenance: RecoveryAuthorized { claim: claim, claimant: ClaimantTerminated, authorized_by: "operator" as NonEmptyStr, receipt: "lane run 7 cancelled" as NonEmptyStr }, executor: "operator" as NonEmptyStr, at: 1013) { HostEffectReleaseRefused { partition: _, step: st, reason: _ } => st == "evidence"  _ => false })  Absent => false })
+                  && (match alr_evidence_for(claim: claim, host: srv, spec: alr_residue(pattern: "/srv/build"), at: 1013) { Present { value: e } => (match host_effect_release(store: store, claim: claim, evidence: e, provenance: RecoveryAuthorized { claim: claim, claimant: ClaimantTerminated, authorized_by: "operator" as NonEmptyStr, receipt: "lane run 7 cancelled" as NonEmptyStr }, executor: "operator" as NonEmptyStr, at: 1013) { HostEffectReleasedAt { id: _ } => true  _ => false })  Absent => false })
+                  && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1014) { AuthorityTransitionAppended { id: _, generation: g2, next: _ } => g2 == 2  _ => false })
+                  && (match host_effect_admit(store: store, host: srv, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 10), residue: alr_residue(pattern: "/srv/build"), at: 1015) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
+              _ => false
+            })
     })
   })
 }
@@ -354,25 +315,25 @@ test fn a_claim_on_an_unestablished_groups_host_fences_its_establishment_by_real
   alr_with_hash(scenario: fn(h) {
   alr_with_temp_dir(scenario: fn(dir) {
     let store = alr_witness_layout(dir: dir)
-    let host = match get(xs: fabric_group_hosts(g: FabricGroupB), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv14") }
+    let host = match get(xs: fabric_group_hosts(g: FabricGroupB {}), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv14") }
     let spec = alr_residue(pattern: "/srv/build")
-    let active_b = PairServingActive { group: FabricGroupB, exact_realization: PairRealizationUnestablished { obligation: "w" as NonEmptyStr } }
-    let released_b = ReleasedToFleet { group: FabricGroupB, release_receipt: h }
-    alr_witness_remote_ready(dir: dir)
-      && (match pair_serving_authority_for(group: FabricGroupB) { Absent => true  Present { value: _ } => false })
+    let active_b = PairServingActive { group: FabricGroupB {}, exact_realization: PairRealizationUnestablished { obligation: "w" as NonEmptyStr } }
+    let released_b = ReleasedToFleet { group: FabricGroupB {}, release_receipt: h }
+    alr_witness_root_ready(dir: dir)
+      && (match pair_serving_authority_for(group: FabricGroupB {}) { Absent => true  Present { value: _ } => false })
       && !alr_occupied(store: store, host: host, at: 999)
       && (match host_effect_admit(store: store, host: host, purpose: "a witness build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1000) {
             HostEffectClaimed { id: c } =>
               alr_occupied(store: store, host: host, at: 1001)
-                && (match pair_serving_authority_establish(store: store, group: FabricGroupB, authority: active_b, actor: "operator" as NonEmptyStr, at: 1002) { AuthorityEstablishmentRefused { group: _, step: st, reason: _ } => st == "host-effects"  _ => false })
-                && (match pair_serving_authority_establish(store: store, group: FabricGroupB, authority: released_b, actor: "operator" as NonEmptyStr, at: 1003) { AuthorityEstablishedAt { id: _ } => true  _ => false })
-                && (match current_pair_serving_authority(store: store, group: FabricGroupB, at: 1004) { CurrentAuthorityRead { authority: a, generation: g } => g == 0 && authority_eq(a: a, b: released_b)  _ => false })
-                && (match pair_serving_authority_establish(store: store, group: FabricGroupB, authority: released_b, actor: "operator" as NonEmptyStr, at: 1004) { AuthorityEstablishmentRefused { group: _, step: st, reason: _ } => st == "established"  _ => false })
-                && (match pair_serving_authority_transition(store: store, group: FabricGroupB, expected: released_b, next: active_b, transaction: "tx-claim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "operator" as NonEmptyStr, at: 1005) { AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "host-effects"  _ => false })
+                && (match pair_serving_authority_establish(store: store, group: FabricGroupB {}, authority: active_b, actor: "operator" as NonEmptyStr, at: 1002) { AuthorityEstablishmentRefused { group: _, step: st, reason: _ } => st == "host-effects"  _ => false })
+                && (match pair_serving_authority_establish(store: store, group: FabricGroupB {}, authority: released_b, actor: "operator" as NonEmptyStr, at: 1003) { AuthorityEstablishedAt { id: _ } => true  _ => false })
+                && (match current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1004) { CurrentAuthorityRead { authority: a, generation: g } => g == 0 && authority_eq(a: a, b: released_b)  _ => false })
+                && (match pair_serving_authority_establish(store: store, group: FabricGroupB {}, authority: released_b, actor: "operator" as NonEmptyStr, at: 1004) { AuthorityEstablishmentRefused { group: _, step: st, reason: _ } => st == "established"  _ => false })
+                && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: released_b, next: active_b, transaction: "tx-claim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "operator" as NonEmptyStr, at: 1005) { AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "host-effects"  _ => false })
                 && alr_occupied(store: store, host: host, at: 1006)
                 && alr_release_with_quiet(handle: HostEffectHandle { host: host, residue: spec, claim: c }, store: store, at: 1007)
-                && (match pair_serving_authority_transition(store: store, group: FabricGroupB, expected: released_b, next: active_b, transaction: "tx-claim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "operator" as NonEmptyStr, at: 1008) { AuthorityTransitionAppended { id: _, generation: g1, next: _ } => g1 == 1  _ => false })
-                && (match placement_read(store: store) { PlacementReadAt { head: _, effects: _, preparations: preps } => any(group_live_commitment(preps: preps, group: FabricGroupB), x => host_identity_eq(a: x, b: host))  _ => false })
+                && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: released_b, next: active_b, transaction: "tx-claim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "operator" as NonEmptyStr, at: 1008) { AuthorityTransitionAppended { id: _, generation: g1, next: _ } => g1 == 1  _ => false })
+                && (match placement_read(store: store) { PlacementReadAt { head: _, effects: _, preparations: preps } => any(group_live_commitment(preps: preps, group: FabricGroupB {}), x => host_identity_eq(a: x, b: host))  _ => false })
                 && (match host_effect_admit(store: store, host: host, purpose: "a build under the authority" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1009) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
             _ => false
           })
@@ -391,38 +352,34 @@ test fn a_release_needs_the_host_observed_quiet_by_real_execution() -> Bool {
   alr_with_hash(scenario: fn(h) {
     alr_with_temp_dir(scenario: fn(dir) {
       let store = alr_witness_layout(dir: dir)
-      let released = ReleasedToFleet { group: FabricGroupA, release_receipt: h }
-      let srv = match get(xs: fabric_group_hosts(g: FabricGroupA), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv8") }
+      let released = ReleasedToFleet { group: FabricGroupB {}, release_receipt: h }
+      let srv = match get(xs: fabric_group_hosts(g: FabricGroupB {}), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv10") }
       let script = join([dir as String, "/sleeper.py"], "")
       let spec = alr_residue(pattern: script)
       let w = Filesystem.Write(path: script, content: alr_sleeper_fixture)
       let spawned = python.Interpreter.RunFile(workdir: dir, script_path: script as FilePath, args: ["60"])
       let pid = trim(s: spawned.stdout)
-      match pair_serving_authority_for(group: FabricGroupA) {
-        Absent => false
-        Present { value: resting } => {
-          let remote_ready = alr_witness_remote_ready(dir: dir)
-          let released_from_resting = (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: released, transaction: "tx-release" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) { AuthorityTransitionAppended { id: _, generation: _, next: _ } => true  _ => false })
-          let effect_lifecycle_holds = (match host_effect_admit(store: store, host: srv, purpose: "a witness build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1001) {
-                  HostEffectClaimed { id: c } => {
-                    let handle = HostEffectHandle { host: srv, residue: spec, claim: c }
-                    let held_while_effect_stands = (match settle_host_effect_over(handle: handle, provenance: ClaimantTerminal { claim: handle.claim, claimant_executor: "executor-1" as NonEmptyStr }, run: fn(argv) { alr_local_leg(argv: argv) }, store: store, executor: "executor-1" as NonEmptyStr, at: 1002) { HostEffectStillHeld { cause: why } => why.contains("still carries the effect")  HostEffectSettled => false })
-                    let reclaim_refused_on_host_effects = (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1003) { AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "host-effects"  _ => false })
-                    let residue_killed = shell.Exec.RunArgv(program: "kill", arguments: ["-9", pid]).exit_code == 0
-                    let settles_once_residue_is_gone = (match settle_host_effect_over(handle: handle, provenance: ClaimantTerminal { claim: handle.claim, claimant_executor: "executor-1" as NonEmptyStr }, run: fn(argv) { alr_local_leg(argv: argv) }, store: store, executor: "executor-1" as NonEmptyStr, at: 1004) { HostEffectSettled => true  HostEffectStillHeld { cause: _ } => false })
-                    let reclaim_appends_after_settlement = (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1005) { AuthorityTransitionAppended { id: _, generation: g2, next: _ } => g2 == 2  _ => false })
-                    held_while_effect_stands && reclaim_refused_on_host_effects && residue_killed && settles_once_residue_is_gone && reclaim_appends_after_settlement
-                  }
-                  _ => false
-                })
-          let observed = w.success && spawned.success && pid != ""
-            && remote_ready
-            && released_from_resting
-            && effect_lifecycle_holds
-          let cleaned = shell.Exec.RunArgv(program: "kill", arguments: ["-9", pid])
-          observed
-        }
-      }
+      let resting = alr_resting()
+      let remote_ready = alr_witness_remote_ready(dir: dir)
+      let released_from_resting = (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: resting, next: released, transaction: "tx-release" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) { AuthorityTransitionAppended { id: _, generation: _, next: _ } => true  _ => false })
+      let effect_lifecycle_holds = (match host_effect_admit(store: store, host: srv, purpose: "a witness build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1001) {
+              HostEffectClaimed { id: c } => {
+                let handle = HostEffectHandle { host: srv, residue: spec, claim: c }
+                let held_while_effect_stands = (match settle_host_effect_over(handle: handle, provenance: ClaimantTerminal { claim: handle.claim, claimant_executor: "executor-1" as NonEmptyStr }, run: fn(argv) { alr_local_leg(argv: argv) }, store: store, executor: "executor-1" as NonEmptyStr, at: 1002) { HostEffectStillHeld { cause: why } => why.contains("still carries the effect")  HostEffectSettled => false })
+                let reclaim_refused_on_host_effects = (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1003) { AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "host-effects"  _ => false })
+                let residue_killed = shell.Exec.RunArgv(program: "kill", arguments: ["-9", pid]).exit_code == 0
+                let settles_once_residue_is_gone = (match settle_host_effect_over(handle: handle, provenance: ClaimantTerminal { claim: handle.claim, claimant_executor: "executor-1" as NonEmptyStr }, run: fn(argv) { alr_local_leg(argv: argv) }, store: store, executor: "executor-1" as NonEmptyStr, at: 1004) { HostEffectSettled => true  HostEffectStillHeld { cause: _ } => false })
+                let reclaim_appends_after_settlement = (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1005) { AuthorityTransitionAppended { id: _, generation: g2, next: _ } => g2 == 2  _ => false })
+                held_while_effect_stands && reclaim_refused_on_host_effects && residue_killed && settles_once_residue_is_gone && reclaim_appends_after_settlement
+              }
+              _ => false
+            })
+      let observed = w.success && spawned.success && pid != ""
+        && remote_ready
+        && released_from_resting
+        && effect_lifecycle_holds
+      let cleaned = shell.Exec.RunArgv(program: "kill", arguments: ["-9", pid])
+      observed
     })
   })
 }
@@ -437,39 +394,36 @@ test fn a_stale_placement_read_cannot_place_or_commit_by_real_execution() -> Boo
   alr_with_hash(scenario: fn(h) {
     alr_with_temp_dir(scenario: fn(dir) {
       let store = alr_witness_layout(dir: dir)
-      let released = ReleasedToFleet { group: FabricGroupA, release_receipt: h }
-      let srv = match get(xs: fabric_group_hosts(g: FabricGroupA), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv8") }
+      let released = ReleasedToFleet { group: FabricGroupB {}, release_receipt: h }
+      let srv = match get(xs: fabric_group_hosts(g: FabricGroupB {}), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv10") }
       let spec = alr_residue(pattern: "/srv/build")
-      match pair_serving_authority_for(group: FabricGroupA) {
-        Absent => false
-        Present { value: resting } =>
-          alr_witness_remote_ready(dir: dir)
-            && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: released, transaction: "tx-release" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) { AuthorityTransitionAppended { id: _, generation: _, next: _, placement: PlacementFinalizedAt { preparation: _, id: _ } } => true  _ => false })
-            && {
-              let effect_read = placement_read(store: store)
-              (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1001) { AuthorityTransitionAppended { id: _, generation: g2, next: _ } => g2 == 2  _ => false })
-                && (match host_effect_admit_at(store: store, read: effect_read, host: srv, purpose: "a build that read quiet" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1002) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "stale"  _ => false })
-                && (match host_effect_admit(store: store, host: srv, purpose: "a build that read fresh" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1003) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
-            }
-            && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: released, transaction: "tx-release-2" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1004) { AuthorityTransitionAppended { id: _, generation: g3, next: _ } => g3 == 3  _ => false })
-            && {
-              let authority_read = placement_read(store: store)
-              match host_effect_admit(store: store, host: srv, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1005) {
-                HostEffectClaimed { id: c } =>
-                  (match placement_prepare_at(store: store, read: authority_read, group: FabricGroupA, previous_hosts: [] as List<HostIdentity>, next_hosts: [srv], operation: "tx-reclaim-2" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1006) { PlacementPreparationStale => true  _ => false })
-                    && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: released, next: resting, transaction: "tx-reclaim-2" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1007) { AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "host-effects"  _ => false })
-                    && alr_release_with_quiet(handle: HostEffectHandle { host: srv, residue: spec, claim: c }, store: store, at: 1008)
-                    && (match placement_prepare(store: store, group: FabricGroupA, previous_hosts: [] as List<HostIdentity>, next_hosts: [srv], operation: "stranded" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1009) {
-                          PlacementPreparedAt { id: prep } =>
-                            (match host_effect_admit(store: store, host: srv, purpose: "a build under a stranded preparation" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1010) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
-                              && (match placement_abort(store: store, preparation: prep, reason: "the witness's group append never happened", provenance: alr_recovery(preparation: prep), actor: "operator" as NonEmptyStr, at: 1011) { PlacementAbortedAt { preparation: _, id: _ } => true  _ => false })
-                              && (match host_effect_admit(store: store, host: srv, purpose: "a build after the abort" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1012) { HostEffectClaimed { id: _ } => true  _ => false })
-                          _ => false
-                        })
-                _ => false
-              }
-            }
-      }
+      let resting = alr_resting()
+      alr_witness_remote_ready(dir: dir)
+        && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: resting, next: released, transaction: "tx-release" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) { AuthorityTransitionAppended { id: _, generation: _, next: _, placement: PlacementFinalizedAt { preparation: _, id: _ } } => true  _ => false })
+        && {
+          let effect_read = placement_read(store: store)
+          (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: released, next: resting, transaction: "tx-reclaim" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1001) { AuthorityTransitionAppended { id: _, generation: g2, next: _ } => g2 == 2  _ => false })
+            && (match host_effect_admit_at(store: store, read: effect_read, host: srv, purpose: "a build that read quiet" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1002) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "stale"  _ => false })
+            && (match host_effect_admit(store: store, host: srv, purpose: "a build that read fresh" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1003) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
+        }
+        && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: resting, next: released, transaction: "tx-release-2" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1004) { AuthorityTransitionAppended { id: _, generation: g3, next: _ } => g3 == 3  _ => false })
+        && {
+          let authority_read = placement_read(store: store)
+          match host_effect_admit(store: store, host: srv, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1005) {
+            HostEffectClaimed { id: c } =>
+              (match placement_prepare_at(store: store, read: authority_read, group: FabricGroupB {}, previous_hosts: [] as List<HostIdentity>, next_hosts: [srv], operation: "tx-reclaim-2" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1006) { PlacementPreparationStale => true  _ => false })
+                && (match pair_serving_authority_transition(store: store, group: FabricGroupB {}, expected: released, next: resting, transaction: "tx-reclaim-2" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1007) { AuthorityTransitionRefused { group: _, step: st, reason: _ } => st == "host-effects"  _ => false })
+                && alr_release_with_quiet(handle: HostEffectHandle { host: srv, residue: spec, claim: c }, store: store, at: 1008)
+                && (match placement_prepare(store: store, group: FabricGroupB {}, previous_hosts: [] as List<HostIdentity>, next_hosts: [srv], operation: "stranded" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1009) {
+                      PlacementPreparedAt { id: prep } =>
+                        (match host_effect_admit(store: store, host: srv, purpose: "a build under a stranded preparation" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1010) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
+                          && (match placement_abort(store: store, preparation: prep, reason: "the witness's group append never happened", provenance: alr_recovery(preparation: prep), actor: "operator" as NonEmptyStr, at: 1011) { PlacementAbortedAt { preparation: _, id: _ } => true  _ => false })
+                          && (match host_effect_admit(store: store, host: srv, purpose: "a build after the abort" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1012) { HostEffectClaimed { id: _ } => true  _ => false })
+                      _ => false
+                    })
+            _ => false
+          }
+        }
     })
   })
 }
@@ -478,10 +432,10 @@ test fn a_stale_placement_read_cannot_place_or_commit_by_real_execution() -> Boo
 // while the preparation is Prepared; the GROUP head once its append is claimed -- a recovery
 // abort of a claimed preparation first lands a cancellation at the head the claim named, so the
 // claimed append can never land: driven both ways below), AND A CONSUMED PREPARATION CANNOT BE
-// ABORTED. Group A is Active over its four hosts. (1) A release (Active →
-// ReleasedToFleet) that dies after its preparation: the old hosts stay fenced -- group B cannot
-// prepare over one, an effect cannot claim one -- the authority still reads Active, a second
-// preparation for A refuses (one saga at a time), and the operator's abort (a recovery naming the
+// ABORTED. Group B is Active over its four hosts. (1) A release (Active →
+// ReleasedToFleet) that dies after its preparation: the old hosts stay fenced -- an effect cannot
+// claim one -- the authority still reads Active, a second
+// preparation for B refuses (one saga at a time), and the operator's abort (a recovery naming the
 // preparation; the group is the record's, there is no group to supply wrongly) lands and frees
 // nothing wrongly (the live commitment is still Active's). (2) The abort/append race: an abort
 // that read the preparation Prepared, then the writer's append claim landed, appends STALE --
@@ -493,101 +447,75 @@ test fn a_saga_never_frees_a_host_early_and_a_consumed_preparation_cannot_be_abo
   alr_with_hash(scenario: fn(h) {
     alr_with_temp_dir(scenario: fn(dir) {
       let store = alr_witness_layout(dir: dir)
-      let released = ReleasedToFleet { group: FabricGroupA, release_receipt: h }
-      let srv = match get(xs: fabric_group_hosts(g: FabricGroupA), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv8") }
+      let released = ReleasedToFleet { group: FabricGroupB {}, release_receipt: h }
+      let srv = match get(xs: fabric_group_hosts(g: FabricGroupB {}), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv10") }
       let spec = alr_residue(pattern: "/srv/build")
-      let a_hosts = fabric_group_hosts(g: FabricGroupA)
-      match pair_serving_authority_for(group: FabricGroupA) {
-        Absent => false
-        Present { value: resting } =>
-          alr_witness_remote_ready(dir: dir)
-            && (match placement_prepare(store: store, group: FabricGroupA, previous_hosts: a_hosts, next_hosts: [] as List<HostIdentity>, operation: "tx-release-crashed" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1000) {
-                  PlacementPreparedAt { id: prep } =>
-                    (match placement_prepare(store: store, group: FabricGroupB, previous_hosts: [] as List<HostIdentity>, next_hosts: [srv], operation: "tx-b" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1001) { PlacementPreparationRefused { step: st, reason: r } => st == "host-effects" && r.contains("another group")  _ => false })
-                      && (match placement_prepare(store: store, group: FabricGroupA, previous_hosts: a_hosts, next_hosts: [] as List<HostIdentity>, operation: "tx-release-again" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1001) { PlacementPreparationRefused { step: _, reason: r } => r.contains("one saga at a time")  _ => false })
-                      && (match host_effect_admit(store: store, host: srv, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1002) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
-                      && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1003), expected: resting, generation: 0)
-                      && (match preparation_consumption(store: store, preparation: prep) { PreparationNotConsumed { record: _ } => true  _ => false })
-                      && (match placement_abort(store: store, preparation: prep, reason: "the lane died before its group append", provenance: alr_recovery(preparation: prep), actor: "operator" as NonEmptyStr, at: 1004) { PlacementAbortedAt { preparation: _, id: _ } => true  _ => false })
-                      && (match host_effect_admit(store: store, host: srv, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1005) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
-                  _ => false
-                })
-            && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1006) {
-                  CurrentAuthorityRead { authority: cur, head: ghead } =>
-                    (match placement_prepare(store: store, group: FabricGroupA, previous_hosts: a_hosts, next_hosts: [] as List<HostIdentity>, operation: "tx-race" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1006) {
-                      PlacementPreparedAt { id: prep } => {
-                        let abort_read = placement_read(store: store)
-                        (match placement_claim_append(store: store, preparation: prep, intent: alr_intent(head: ghead, cur: cur, released: released, operation: "tx-race"), at: 1007) { PlacementAppendClaimedAt { id: _ } => true  _ => false })
-                          && (match placement_abort(store: store, preparation: prep, reason: "not mine" as String, provenance: ClaimantTerminal { claim: prep, claimant_executor: "someone-else" as NonEmptyStr }, actor: "someone-else" as NonEmptyStr, at: 1009) { PlacementCleanupStillFencing { preparation: _, cause: c } => c.contains("does not cover") && c.contains("nothing was written")  _ => false })
-                          && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1009) { CurrentAuthorityRead { authority: _, head: h2 } => head_expectation_eq(a: h2, b: ghead)  _ => false })
-                          && (match placement_abort_at(store: store, read: abort_read, preparation: prep, reason: "read it Prepared" as String, provenance: alr_recovery(preparation: prep), actor: "operator" as NonEmptyStr, at: 1008) { PlacementCleanupStillFencing { preparation: _, cause: c } => c.contains("moved")  _ => false })
-                          && (match placement_abort(store: store, preparation: prep, reason: "the writer died after its claim", provenance: alr_recovery(preparation: prep), actor: "operator" as NonEmptyStr, at: 1010) { PlacementAbortedAt { preparation: _, id: _ } => true  _ => false })
-                          && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1010) { CurrentAuthorityRead { authority: _, head: h2, generation: g0 } => g0 == 0 && !head_expectation_eq(a: h2, b: ghead)  _ => false })
-                          && (match authority_transition_append(store: store, group: FabricGroupA, head: ghead, current: cur, next: released, transaction: "tx-race" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, preparation: preparation_ref_expected(id: prep, group: FabricGroupA, previous: a_hosts, next: [] as List<HostIdentity>, operation: "tx-race" as NonEmptyStr), actor: "witness" as NonEmptyStr, at: 1010) { EventAppendStale { expected: _, observed: _ } => true  _ => false })
-                          && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1010), expected: resting, generation: 0)
-                      }
-                      _ => false
-                    })
-                  _ => false
-                })
-            && (match placement_prepare(store: store, group: FabricGroupA, previous_hosts: a_hosts, next_hosts: [] as List<HostIdentity>, operation: "tx-release" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1011) {
-                  PlacementPreparedAt { id: prep } =>
-                    (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1012) {
-                       CurrentAuthorityRead { authority: cur, head: head } =>
-                         (match placement_claim_append(store: store, preparation: prep, intent: alr_intent(head: head, cur: cur, released: released, operation: "tx-release"), at: 1011) { PlacementAppendClaimedAt { id: _ } => true  _ => false })
-                           && (match authority_transition_append(store: store, group: FabricGroupA, head: head, current: cur, next: released, transaction: "tx-release" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, preparation: preparation_ref_expected(id: prep, group: FabricGroupA, previous: a_hosts, next: [] as List<HostIdentity>, operation: "tx-release" as NonEmptyStr), actor: "witness" as NonEmptyStr, at: 1012) { EventAppended { id: _ } => true  _ => false })
-                       _ => false
-                     })
-                      && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1013), expected: released, generation: 1)
-                      && (match host_effect_admit(store: store, host: srv, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1013) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
-                      && (match placement_abort(store: store, preparation: prep, reason: "wrongly assumed stranded" as String, provenance: alr_recovery(preparation: prep), actor: "operator" as NonEmptyStr, at: 1014) { PlacementCleanupStillFencing { preparation: _, cause: c } => c.contains("consumed by authority event")  _ => false })
-                      && (match placement_finalize(store: store, consumed: preparation_consumption(store: store, preparation: prep), actor: "operator" as NonEmptyStr, at: 1015) { PlacementFinalizedAt { preparation: _, id: _ } => true  _ => false })
-                      && (match host_effect_admit(store: store, host: srv, purpose: "a build after the finalization" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1016) { HostEffectClaimed { id: _ } => true  _ => false })
+      let a_hosts = fabric_group_hosts(g: FabricGroupB {})
+      let resting = alr_resting()
+      alr_witness_remote_ready(dir: dir)
+        && (match placement_prepare(store: store, group: FabricGroupB {}, previous_hosts: a_hosts, next_hosts: [] as List<HostIdentity>, operation: "tx-release-crashed" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1000) {
+              PlacementPreparedAt { id: prep } =>
+                  (match placement_prepare(store: store, group: FabricGroupB {}, previous_hosts: a_hosts, next_hosts: [] as List<HostIdentity>, operation: "tx-release-again" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1001) { PlacementPreparationRefused { step: _, reason: r } => r.contains("one saga at a time")  _ => false })
+                  && (match host_effect_admit(store: store, host: srv, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1002) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
+                  && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1003), expected: resting, generation: 0)
+                  && (match preparation_consumption(store: store, preparation: prep) { PreparationNotConsumed { record: _ } => true  _ => false })
+                  && (match placement_abort(store: store, preparation: prep, reason: "the lane died before its group append", provenance: alr_recovery(preparation: prep), actor: "operator" as NonEmptyStr, at: 1004) { PlacementAbortedAt { preparation: _, id: _ } => true  _ => false })
+                  && (match host_effect_admit(store: store, host: srv, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1005) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
+              _ => false
+            })
+        && (match current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1006) {
+              CurrentAuthorityRead { authority: cur, head: ghead } =>
+                (match placement_prepare(store: store, group: FabricGroupB {}, previous_hosts: a_hosts, next_hosts: [] as List<HostIdentity>, operation: "tx-race" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1006) {
+                  PlacementPreparedAt { id: prep } => {
+                    let abort_read = placement_read(store: store)
+                    (match placement_claim_append(store: store, preparation: prep, intent: alr_intent(head: ghead, cur: cur, released: released, operation: "tx-race"), at: 1007) { PlacementAppendClaimedAt { id: _ } => true  _ => false })
+                      && (match placement_abort(store: store, preparation: prep, reason: "not mine" as String, provenance: ClaimantTerminal { claim: prep, claimant_executor: "someone-else" as NonEmptyStr }, actor: "someone-else" as NonEmptyStr, at: 1009) { PlacementCleanupStillFencing { preparation: _, cause: c } => c.contains("does not cover") && c.contains("nothing was written")  _ => false })
+                      && (match current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1009) { CurrentAuthorityRead { authority: _, head: h2 } => head_expectation_eq(a: h2, b: ghead)  _ => false })
+                      && (match placement_abort_at(store: store, read: abort_read, preparation: prep, reason: "read it Prepared" as String, provenance: alr_recovery(preparation: prep), actor: "operator" as NonEmptyStr, at: 1008) { PlacementCleanupStillFencing { preparation: _, cause: c } => c.contains("moved")  _ => false })
+                      && (match placement_abort(store: store, preparation: prep, reason: "the writer died after its claim", provenance: alr_recovery(preparation: prep), actor: "operator" as NonEmptyStr, at: 1010) { PlacementAbortedAt { preparation: _, id: _ } => true  _ => false })
+                      && (match current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1010) { CurrentAuthorityRead { authority: _, head: h2, generation: g0 } => g0 == 0 && !head_expectation_eq(a: h2, b: ghead)  _ => false })
+                      && (match authority_transition_append(store: store, group: FabricGroupB {}, head: ghead, current: cur, next: released, transaction: "tx-race" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, preparation: preparation_ref_expected(id: prep, group: FabricGroupB {}, previous: a_hosts, next: [] as List<HostIdentity>, operation: "tx-race" as NonEmptyStr), actor: "witness" as NonEmptyStr, at: 1010) { EventAppendStale { expected: _, observed: _ } => true  _ => false })
+                      && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1010), expected: resting, generation: 0)
+                  }
                   _ => false
                 })
-      }
+              _ => false
+            })
+        && (match placement_prepare(store: store, group: FabricGroupB {}, previous_hosts: a_hosts, next_hosts: [] as List<HostIdentity>, operation: "tx-release" as NonEmptyStr, actor: "witness" as NonEmptyStr, at: 1011) {
+              PlacementPreparedAt { id: prep } =>
+                (match current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1012) {
+                   CurrentAuthorityRead { authority: cur, head: head } =>
+                     (match placement_claim_append(store: store, preparation: prep, intent: alr_intent(head: head, cur: cur, released: released, operation: "tx-release"), at: 1011) { PlacementAppendClaimedAt { id: _ } => true  _ => false })
+                       && (match authority_transition_append(store: store, group: FabricGroupB {}, head: head, current: cur, next: released, transaction: "tx-release" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, preparation: preparation_ref_expected(id: prep, group: FabricGroupB {}, previous: a_hosts, next: [] as List<HostIdentity>, operation: "tx-release" as NonEmptyStr), actor: "witness" as NonEmptyStr, at: 1012) { EventAppended { id: _ } => true  _ => false })
+                   _ => false
+                 })
+                  && alr_current_is(c: current_pair_serving_authority(store: store, group: FabricGroupB {}, at: 1013), expected: released, generation: 1)
+                  && (match host_effect_admit(store: store, host: srv, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1013) { HostEffectClaimRefused { partition: _, step: st, reason: _ } => st == "committed"  _ => false })
+                  && (match placement_abort(store: store, preparation: prep, reason: "wrongly assumed stranded" as String, provenance: alr_recovery(preparation: prep), actor: "operator" as NonEmptyStr, at: 1014) { PlacementCleanupStillFencing { preparation: _, cause: c } => c.contains("consumed by authority event")  _ => false })
+                  && (match placement_finalize(store: store, consumed: preparation_consumption(store: store, preparation: prep), actor: "operator" as NonEmptyStr, at: 1015) { PlacementFinalizedAt { preparation: _, id: _ } => true  _ => false })
+                  && (match host_effect_admit(store: store, host: srv, purpose: "a build after the finalization" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: spec, at: 1016) { HostEffectClaimed { id: _ } => true  _ => false })
+              _ => false
+            })
     })
   })
 }
 
-// (6) THE STANDING RECOVERY ON THE REAL STORE (side-chat review of #13102): a claim lands on a released
-// Group A host; recovery with the row NOT on main refuses and touches nothing; with the row on main but the
-// claim's residue still running, the fresh quiescence read -- taken after the claim was selected, against
-// that claim's process pattern -- keeps it live; with the host quiet the claim is released, and the release
-// is read back absent. A second recovery then finds no unreleased claim.
-fn alr_residue_leg(argv: List<String>) -> ArgvRun {
-  ArgvRan { exit_code: 0, stdout: "4242 /srv/build/witness", stderr: "" }
-}
-
-fn alr_exit_ok(e: ProcessExit) -> Bool {
-  match e { ExitSuccess => true  _ => false }
-}
-
-test fn a_standing_recovery_selects_the_one_claim_quiesces_after_selection_and_reads_back_by_real_execution() -> Bool {
-  alr_with_hash(scenario: fn(h) {
-    alr_with_temp_dir(scenario: fn(dir) {
-      let store = alr_witness_layout(dir: dir)
-      let released = ReleasedToFleet { group: FabricGroupA, release_receipt: h }
-      let srv = match get(xs: fabric_group_hosts(g: FabricGroupA), index: 1) { Present { value: x } => x  Absent => alr_srv(s: "srv8") }
-      match pair_serving_authority_for(group: FabricGroupA) {
-        Absent => false
-        Present { value: resting } =>
-          alr_witness_remote_ready(dir: dir)
-            && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: released, transaction: "tx-release" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) { AuthorityTransitionAppended { id: _, generation: _, next: _ } => true  _ => false })
-            && (match admit_unplaced_host_over(raw: srv as String, purpose: "a witness build" as NonEmptyStr, term: second(count: 100), residue: alr_residue(pattern: "/srv/build"), store: store, executor: "executor-1" as NonEmptyStr, at: 1001) {
-                  SparkHostAdmitted { host: _, claim: Present { value: handle } } => {
-                    let off_main = !alr_exit_ok(e: standing_host_effect_recover_over(host: srv, standing: ClaimantAbandoned, run_id: "1" as NonEmptyStr, row: StandingGrantRowNotOnMain { cause: "witness" }, run: fn(argv) { alr_quiet_leg(argv: argv) }, store: store, executor: "executor-1" as NonEmptyStr, at: 1002))
-                    let still_live_1 = match live_claim_on(store: store, host: srv, claim: handle.claim) { LiveClaimFound { record: _ } => true  _ => false }
-                    let residue_held = !alr_exit_ok(e: standing_host_effect_recover_over(host: srv, standing: ClaimantAbandoned, run_id: "1" as NonEmptyStr, row: StandingGrantRowOnMain, run: fn(argv) { alr_residue_leg(argv: argv) }, store: store, executor: "executor-1" as NonEmptyStr, at: 1003))
-                    let still_live_2 = match live_claim_on(store: store, host: srv, claim: handle.claim) { LiveClaimFound { record: _ } => true  _ => false }
-                    let recovered = alr_exit_ok(e: standing_host_effect_recover_over(host: srv, standing: ClaimantAbandoned, run_id: "1" as NonEmptyStr, row: StandingGrantRowOnMain, run: fn(argv) { alr_quiet_leg(argv: argv) }, store: store, executor: "executor-1" as NonEmptyStr, at: 1004))
-                    let gone = match live_claim_on(store: store, host: srv, claim: handle.claim) { LiveClaimAbsent => true  _ => false }
-                    let nothing_left = !alr_exit_ok(e: standing_host_effect_recover_over(host: srv, standing: ClaimantAbandoned, run_id: "1" as NonEmptyStr, row: StandingGrantRowOnMain, run: fn(argv) { alr_quiet_leg(argv: argv) }, store: store, executor: "executor-1" as NonEmptyStr, at: 1005))
-                    off_main && still_live_1 && residue_held && still_live_2 && recovered && gone && nothing_left
-                  }
-                  _ => false
-                })
-      }
-    })
+// THE CURRENT-STATE WET ROUTE OF admit_unplaced_host_over, which the image-build entries and the V4.1
+// runtime-image probe reach through admit_unplaced_host_live: over a real temp store, a retained Group B
+// host (srv9, placed by the GLM serving arm) is refused for that real serving-arm commitment, and the
+// refusal appends nothing -- the placement partition reads back with no host-effect record. RED: an
+// admission that ignored the arm commitment would claim the host and append a host effect.
+test fn a_serving_arm_host_is_refused_by_the_real_commitment_and_nothing_is_appended_by_real_execution() -> Bool {
+  alr_with_temp_dir(scenario: fn(dir) {
+    let store = alr_witness_layout(dir: dir)
+    alr_witness_root_ready(dir: dir)
+      && (match admit_unplaced_host_over(raw: "srv9", purpose: "a witness build" as NonEmptyStr, term: second(count: 100), residue: alr_residue(pattern: "/srv/build"), store: store, executor: "executor-1" as NonEmptyStr, at: 1000) {
+        SparkHostRefused { cause: c } => string_contains(s: c as String, pattern: "a serving arm is placed on it")
+        SparkHostAdmitted { host: _, claim: _ } => false
+      })
+      && (match placement_read(store: store) {
+        PlacementReadAt { head: _, effects: effs, preparations: _ } => length(effs) == 0
+        PlacementUnread { step: _, reason: _ } => false
+      })
   })
 }
diff --git a/dag/test/claim/spark/pair_serving_authority_log_witness_test.dag b/dag/test/claim/spark/pair_serving_authority_log_witness_test.dag
index ee5314749dd..359359cd311 100644
--- a/dag/test/claim/spark/pair_serving_authority_log_witness_test.dag
+++ b/dag/test/claim/spark/pair_serving_authority_log_witness_test.dag
@@ -4,12 +4,11 @@ import std.logic { Bool }
 import std.types { String, NonEmptyStr, List }
 import std.optional { Present, Absent }
 import product.host_identity { HostIdentity }
-import gunbc.spark.fabric_switch_observed { fabric_group_hosts }
+import gunbc.spark.fabric_switch_observed { fabric_group_hosts, FabricGroup, FabricGroupB, parse_fabric_group }
 import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest, compare_content_hash, ContentHashEqual, ContentHashDifferent, ContentHashCrossFamilyIncomparable, content_hash_equal }
 import product.capacity.lease { LeaseGrant }
 import std.temporal_effect { HeldLease, held_lease, LeaseEpoch, LeaseRunningExpected, LeaseInaccessible }
 import product.capacity.event_chain { ChainEvent, ChainEnvelope, EventId, EventDecoded, EventUndecodable, HeadAbsent, HeadAt, HeadExpectation }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB }
 import gunbc.spark.released_baseline { QuiescentReservedBaseline }
 import std.measure { second, second_count, byte_size }
 import extdeps.docker.cli { DockerPsByName, DockerPsByAncestor, DockerPsByLabel, DockerLabel, docker_run_ephemeral_command }
@@ -29,6 +28,8 @@ import gunbc.spark.pair_serving_authority_log {
   pair_authority_partition, host_placement_partition,
   pair_authority_event_wire_text, pair_authority_event_decode, authority_eq, authority_wire,
   AuthorityFold, AuthorityUnestablished, AuthorityFolded, AuthorityFoldRefused, authority_fold, AuthorityTransitionRecord, transitions_by, authority_write_intent, AuthorityWriteIntent, event_write_intent, write_intent_eq, CancelledPreparation, cancellation_gap,
+  RecordedFabricGroup, RecordedLiveGroup, RecordedRetiredGroupA, parse_recorded_group, recorded_group_wire,
+  RecordedAuthority, RecordedLiveAuthority, RecordedRetiredGroupAAuthority, Finalized,
   PlacementFold, PlacementFolded, PlacementFoldRefused, placement_fold, PlacementPreparationRecord, AppendClaimed, Prepared, Aborted, group_live_commitment, group_fenced_hosts, same_host_set,
 }
 
@@ -52,26 +53,26 @@ fn alw_w_lease(h: ContentHash, inaccessible: Bool) -> HeldLease {
 }
 
 fn alw_w_active_unestablished() -> PairServingGroupAuthority {
-  PairServingActive { group: FabricGroupA, exact_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr } }
+  PairServingActive { group: FabricGroupB {}, exact_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr } }
 }
 
 fn alw_w_all_arms(h: ContentHash) -> List<PairServingGroupAuthority> {
   [
     alw_w_active_unestablished(),
-    PairServingActive { group: FabricGroupA, exact_realization: PairRealizationKeyed { key: h } },
-    SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) },
+    PairServingActive { group: FabricGroupB {}, exact_realization: PairRealizationKeyed { key: h } },
+    SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) },
     SuspendedForAuthorizedSuccessor {
-      group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), authorization: "auth-1" as NonEmptyStr, exact_candidate_realization: PairRealizationKeyed { key: h },
+      group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), authorization: "auth-1" as NonEmptyStr, exact_candidate_realization: PairRealizationKeyed { key: h },
       lease: alw_w_lease(h: h, inaccessible: true), cleanup: QuiescentReservedBaseline,
     },
-    FencedRefusal { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), cause: "foreign occupant" as NonEmptyStr, disposition_authority: "operator" as NonEmptyStr },
-    ReleasedToFleet { group: FabricGroupA, release_receipt: h },
+    FencedRefusal { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), cause: "foreign occupant" as NonEmptyStr, disposition_authority: "operator" as NonEmptyStr },
+    ReleasedToFleet { group: FabricGroupB {}, release_receipt: h },
   ]
 }
 
 fn alw_w_event(previous: PairServingGroupAuthority, next: PairServingGroupAuthority, parent: EventId?) -> ChainEvent<PairAuthorityEvent> {
   ChainEvent {
-    partition: pair_authority_partition(group: FabricGroupA),
+    partition: pair_authority_partition(group: FabricGroupB {}),
     parent: parent,
     recorded_at: 1000,
     actor: "witness" as NonEmptyStr,
@@ -87,7 +88,7 @@ fn alw_round_trips(previous: PairServingGroupAuthority, next: PairServingGroupAu
       match back.payload {
         AuthorityTransitioned { previous: p, next: n, transaction: t, lifecycle: _, grant: _, entry_state: _ } =>
           authority_eq(a: p, b: previous) && authority_eq(a: n, b: next) && (t as String) == "tx-1"
-            && back.recorded_at == 1000 && (back.partition as String) == (pair_authority_partition(group: FabricGroupA) as String)
+            && back.recorded_at == 1000 && (back.partition as String) == (pair_authority_partition(group: FabricGroupB {}) as String)
         _ => false
       }
   }
@@ -154,12 +155,11 @@ test fn the_wire_distinguishes_arms_and_fields_but_not_the_lease_observation() -
     length(arms) == 6
       && !any(arms, a => any(arms, b => (authority_wire(a: a) != authority_wire(a: b)) && authority_eq(a: a, b: b)))
       && authority_eq(
-           a: SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: live },
-           b: SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: dead })
+           a: SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: live },
+           b: SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: dead })
       && !authority_eq(
-           a: SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: live },
-           b: SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-2" as NonEmptyStr, authorization_binding: h, lease: live })
-      && !authority_eq(a: alw_w_active_unestablished(), b: PairServingActive { group: FabricGroupB, exact_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr } })
+           a: SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: live },
+           b: SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-2" as NonEmptyStr, authorization_binding: h, lease: live })
   })
 }
 
@@ -184,25 +184,25 @@ test fn a_foreign_or_incoherent_document_does_not_decode() -> Bool {
 // enters, under its operation, with an id unique to that write (a preparation is consumed once).
 // The intent of a write the witness authors at `parent`, as an append claim carries it.
 fn alw_intent(parent: EventId?, previous: PairServingGroupAuthority?, next: PairServingGroupAuthority, operation: String, lifecycle: ContentHash?, grant: LeaseGrant?, entry_state: ContentHash?) -> AuthorityWriteIntent {
-  authority_write_intent(group: FabricGroupA, head: match parent { Absent => HeadAbsent  Present { value: h } => HeadAt { id: h } }, actor: "witness" as NonEmptyStr, previous: previous, next: next, operation: operation as NonEmptyStr, lifecycle: lifecycle, grant: grant, entry_state: entry_state)
+  authority_write_intent(group: FabricGroupB {}, head: match parent { Absent => HeadAbsent  Present { value: h } => HeadAt { id: h } }, actor: "witness" as NonEmptyStr, previous: previous, next: next, operation: operation as NonEmptyStr, lifecycle: lifecycle, grant: grant, entry_state: entry_state)
 }
 
 // The intent a witness-shaped transition event proves: group A, operation tx-op, no lifecycle,
 // grant or entry state.
 fn write_intent_of_witness(env: ChainEnvelope<PairAuthorityEvent>, previous: PairServingGroupAuthority, next: PairServingGroupAuthority) -> AuthorityWriteIntent {
-  event_write_intent(env: env, group: FabricGroupA, previous: Present { value: previous }, next: next, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none)
+  event_write_intent(env: env, group: FabricGroupB {}, previous: Present { value: previous }, next: next, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none)
 }
 
 fn alw_ref(previous: PairServingGroupAuthority, next: PairServingGroupAuthority, operation: String) -> PlacementPreparationRef {
-  PlacementPreparationRef { id: (join(["p-", operation, "-", authority_wire(a: previous), ">", authority_wire(a: next)], "") as NonEmptyStr) as EventId, group: FabricGroupA, previous_hosts: committed_population(a: previous), next_hosts: committed_population(a: next), operation: operation as NonEmptyStr }
+  PlacementPreparationRef { id: (join(["p-", operation, "-", authority_wire(a: previous), ">", authority_wire(a: next)], "") as NonEmptyStr) as EventId, group: RecordedLiveGroup { group: FabricGroupB {} }, previous_hosts: committed_population(a: previous), next_hosts: committed_population(a: next), operation: operation as NonEmptyStr }
 }
 
 fn alw_establish_ref(a: PairServingGroupAuthority) -> PlacementPreparationRef {
-  PlacementPreparationRef { id: "p0" as EventId, group: FabricGroupA, previous_hosts: [] as List<HostIdentity>, next_hosts: committed_population(a: a), operation: "establish group-a" as NonEmptyStr }
+  PlacementPreparationRef { id: "p0" as EventId, group: RecordedLiveGroup { group: FabricGroupB {} }, previous_hosts: [] as List<HostIdentity>, next_hosts: committed_population(a: a), operation: "establish group-b" as NonEmptyStr }
 }
 
 fn alw_establish(a: PairServingGroupAuthority) -> ChainEvent<PairAuthorityEvent> {
-  ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 990, actor: "witness" as NonEmptyStr, payload: AuthorityEstablished { authority: a, placement: alw_establish_ref(a: a) } }
+  ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 990, actor: "witness" as NonEmptyStr, payload: AuthorityEstablished { authority: a, placement: alw_establish_ref(a: a) } }
 }
 
 fn alw_fold(resting: PairServingGroupAuthority, oldest_first: List<ChainEnvelope<PairAuthorityEvent>>) -> AuthorityFold {
@@ -217,8 +217,8 @@ fn alw_env(id: String, e: ChainEvent<PairAuthorityEvent>) -> ChainEnvelope<PairA
 test fn the_fold_walks_from_the_resting_row_through_each_transition() -> Bool {
   alw_with_hash(scenario: fn(h) {
     let resting = alw_w_active_unestablished()
-    let pending = SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
-    let fenced = FencedRefusal { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), cause: "foreign occupant" as NonEmptyStr, disposition_authority: "operator" as NonEmptyStr }
+    let pending = SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
+    let fenced = FencedRefusal { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), cause: "foreign occupant" as NonEmptyStr, disposition_authority: "operator" as NonEmptyStr }
     let chain = [alw_env(id: "e1", e: alw_w_event(previous: resting, next: pending, parent: none)), alw_env(id: "e2", e: alw_w_event(previous: pending, next: fenced, parent: Present { value: "e1" as EventId }))]
     (match alw_fold(resting: resting, oldest_first: [] as List<ChainEnvelope<PairAuthorityEvent>>) {
        AuthorityFolded { current: c, generation: g, grant: _, entry_state: _ } => g == 0 && authority_eq(a: c, b: resting)
@@ -236,8 +236,8 @@ test fn the_fold_walks_from_the_resting_row_through_each_transition() -> Bool {
 test fn a_transition_from_a_state_that_was_not_current_refuses_at_that_event() -> Bool {
   alw_with_hash(scenario: fn(h) {
     let resting = alw_w_active_unestablished()
-    let pending = SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
-    let fenced = FencedRefusal { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), cause: "foreign occupant" as NonEmptyStr, disposition_authority: "operator" as NonEmptyStr }
+    let pending = SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
+    let fenced = FencedRefusal { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), cause: "foreign occupant" as NonEmptyStr, disposition_authority: "operator" as NonEmptyStr }
     let chain = [alw_env(id: "e1", e: alw_w_event(previous: pending, next: fenced, parent: none))]
     match alw_fold(resting: resting, oldest_first: chain) {
       AuthorityFoldRefused { at_event: e, reason: _ } => (e as String) == "e1"
@@ -246,24 +246,11 @@ test fn a_transition_from_a_state_that_was_not_current_refuses_at_that_event() -
   })
 }
 
-// RED -- a transition whose next state names another group than the partition's is refused.
-test fn a_transition_to_another_groups_authority_refuses() -> Bool {
-  alw_with_hash(scenario: fn(h) {
-    let resting = alw_w_active_unestablished()
-    let elsewhere = ReleasedToFleet { group: FabricGroupB, release_receipt: h }
-    match alw_fold(resting: resting, oldest_first: [alw_env(id: "e1", e: alw_w_event(previous: resting, next: elsewhere, parent: none))]) {
-      AuthorityFoldRefused { at_event: e, reason: _ } => (e as String) == "e1"
-      _ => false
-    }
-  })
-}
-
-
 // THE LIFECYCLE RIDES THE WIRE: a transition carrying a lifecycle identity decodes to the same hash.
 fn alw_w_with_lifecycle(h: ContentHash) -> ChainEvent<PairAuthorityEvent> {
   let resting = alw_w_active_unestablished()
-  let pending = SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
-  ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: pending, transaction: "tx-1" as NonEmptyStr, lifecycle: Present { value: h }, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: pending, operation: "tx-1") } }
+  let pending = SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
+  ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: pending, transaction: "tx-1" as NonEmptyStr, lifecycle: Present { value: h }, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: pending, operation: "tx-1") } }
 }
 
 test fn the_lifecycle_identity_round_trips_through_the_wire() -> Bool {
@@ -283,7 +270,7 @@ test fn the_lifecycle_identity_round_trips_through_the_wire() -> Bool {
 test fn a_transition_without_a_lifecycle_decodes_to_none() -> Bool {
   alw_with_hash(scenario: fn(h) {
     let resting = alw_w_active_unestablished()
-    let pending = SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
+    let pending = SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
     match pair_authority_event_decode(text: pair_authority_event_wire_text(event: alw_w_event(previous: resting, next: pending, parent: none))) {
       EventDecoded { event: back } => match back.payload { AuthorityTransitioned { previous: _, next: _, transaction: _, lifecycle: Absent, grant: _, entry_state: _ } => true  _ => false }
       EventUndecodable { reason: _ } => false
@@ -303,8 +290,8 @@ test fn an_incoherent_lifecycle_member_refuses_the_document() -> Bool {
 test fn the_fold_records_each_transitions_lifecycle() -> Bool {
   alw_with_hash(scenario: fn(h) {
     let resting = alw_w_active_unestablished()
-    let pending = SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
-    let with = ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: pending, transaction: "tx-1" as NonEmptyStr, lifecycle: Present { value: h }, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: pending, operation: "tx-1") } }
+    let pending = SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
+    let with = ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: pending, transaction: "tx-1" as NonEmptyStr, lifecycle: Present { value: h }, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: pending, operation: "tx-1") } }
     match alw_fold(resting: resting, oldest_first: [alw_env(id: "e1", e: with), alw_env(id: "e2", e: alw_w_event(previous: pending, next: resting, parent: Present { value: "e1" as EventId }))]) {
       AuthorityFolded { current: _, generation: g, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: recs } =>
         g == 2 && length(transitions_by(records: recs, transaction: "tx-1" as NonEmptyStr, lifecycle: h)) == 1
@@ -321,7 +308,7 @@ test fn the_fold_records_each_transitions_lifecycle() -> Bool {
 // distinct list decodes back from: a JSON array. ["a,b","c"] and ["a","b","c"] are different
 // authorities; an element that is empty, or not a string, refuses the document.
 fn alw_fenced_over(hs: List<HostIdentity>) -> PairServingGroupAuthority {
-  FencedRefusal { group: FabricGroupA, hosts: hs, cause: "w" as NonEmptyStr, disposition_authority: "w" as NonEmptyStr }
+  FencedRefusal { group: FabricGroupB {}, hosts: hs, cause: "w" as NonEmptyStr, disposition_authority: "w" as NonEmptyStr }
 }
 
 fn alw_host(s: String) -> HostIdentity {
@@ -371,13 +358,13 @@ test fn a_hosts_wire_that_is_not_an_array_or_is_empty_refuses() -> Bool {
 fn alw_prepare(parent: EventId?, group: FabricGroup, previous: List<HostIdentity>, next: List<HostIdentity>, at: Int) -> ChainEvent<PairAuthorityEvent> {
   let ph = previous
   let nh = next
-  ChainEvent { partition: host_placement_partition, parent: parent, recorded_at: at, actor: "witness" as NonEmptyStr, payload: PlacementPrepared { operation: "tx-op" as NonEmptyStr, group: group, previous_hosts: ph, next_hosts: nh } }
+  ChainEvent { partition: host_placement_partition, parent: parent, recorded_at: at, actor: "witness" as NonEmptyStr, payload: PlacementPrepared { operation: "tx-op" as NonEmptyStr, group: RecordedLiveGroup { group: group }, previous_hosts: ph, next_hosts: nh } }
 }
 
 // A finalization of preparation `preparation` (prepared by alw_prepare over group A, previous →
 // next, operation tx-op), carrying the copy the fold checks against the record.
 fn alw_finalize_of(parent: EventId?, preparation: String, previous: List<HostIdentity>, next: List<HostIdentity>, at: Int) -> ChainEvent<PairAuthorityEvent> {
-  ChainEvent { partition: host_placement_partition, parent: parent, recorded_at: at, actor: "witness" as NonEmptyStr, payload: PlacementFinalized { preparation: PlacementPreparationRef { id: (preparation as NonEmptyStr) as EventId, group: FabricGroupA, previous_hosts: previous, next_hosts: next, operation: "tx-op" as NonEmptyStr }, authority_event: "g1" as EventId } }
+  ChainEvent { partition: host_placement_partition, parent: parent, recorded_at: at, actor: "witness" as NonEmptyStr, payload: PlacementFinalized { preparation: PlacementPreparationRef { id: (preparation as NonEmptyStr) as EventId, group: RecordedLiveGroup { group: FabricGroupB {} }, previous_hosts: previous, next_hosts: next, operation: "tx-op" as NonEmptyStr }, authority_event: "g1" as EventId } }
 }
 
 fn alw_finalize(parent: EventId?, preparation: String, at: Int) -> ChainEvent<PairAuthorityEvent> {
@@ -388,13 +375,13 @@ fn alw_finalize(parent: EventId?, preparation: String, at: Int) -> ChainEvent<Pa
 // `actor` at an absent group head, entering a fenced state over srv5 (the one arm that commits
 // exactly the hosts it names).
 fn alw_srv5_intent(actor: String) -> AuthorityWriteIntent {
-  authority_write_intent(group: FabricGroupA, head: HeadAbsent, actor: actor as NonEmptyStr, previous: none, next: alw_fenced_over(hs: [alw_host(s: "srv5")]), operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none)
+  authority_write_intent(group: FabricGroupB {}, head: HeadAbsent, actor: actor as NonEmptyStr, previous: none, next: alw_fenced_over(hs: [alw_host(s: "srv5")]), operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none)
 }
 
 // The claim for a release preparation ([srv5] -> [], tx-op): the intent leaves the fenced state
 // over srv5 for a state that commits no host.
 fn alw_release_claim(parent: EventId?, preparation: String, at: Int) -> ChainEvent<PairAuthorityEvent> {
-  ChainEvent { partition: host_placement_partition, parent: parent, recorded_at: at, actor: "witness" as NonEmptyStr, payload: PlacementAppendClaimed { preparation: (preparation as NonEmptyStr) as EventId, intent: authority_write_intent(group: FabricGroupA, head: HeadAbsent, actor: "witness" as NonEmptyStr, previous: Present { value: alw_fenced_over(hs: [alw_host(s: "srv5")]) }, next: alw_fenced_over(hs: [] as List<HostIdentity>), operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none) } }
+  ChainEvent { partition: host_placement_partition, parent: parent, recorded_at: at, actor: "witness" as NonEmptyStr, payload: PlacementAppendClaimed { preparation: (preparation as NonEmptyStr) as EventId, intent: authority_write_intent(group: FabricGroupB {}, head: HeadAbsent, actor: "witness" as NonEmptyStr, previous: Present { value: alw_fenced_over(hs: [alw_host(s: "srv5")]) }, next: alw_fenced_over(hs: [] as List<HostIdentity>), operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none) } }
 }
 
 // The writer's append claim (actor witness) and its own abort.
@@ -412,15 +399,15 @@ fn alw_abort(parent: EventId?, preparation: String, at: Int) -> ChainEvent<PairA
 
 // A prepared-and-finalized commitment of group A over srv5: events e3 (prepare) and e4 (finalize).
 fn alw_a_over_srv5(parent: EventId?, at: Int) -> List<ChainEnvelope<PairAuthorityEvent>> {
-  [alw_env(id: "e3", e: alw_prepare(parent: parent, group: FabricGroupA, previous: [] as List<HostIdentity>, next: [alw_host(s: "srv5")], at: at)), alw_env(id: "e3c", e: alw_claim(parent: Present { value: "e3" as EventId }, preparation: "e3", at: at)), alw_env(id: "e4", e: alw_finalize(parent: Present { value: "e3c" as EventId }, preparation: "e3", at: at + 1))]
+  [alw_env(id: "e3", e: alw_prepare(parent: parent, group: FabricGroupB {}, previous: [] as List<HostIdentity>, next: [alw_host(s: "srv5")], at: at)), alw_env(id: "e3c", e: alw_claim(parent: Present { value: "e3" as EventId }, preparation: "e3", at: at)), alw_env(id: "e4", e: alw_finalize(parent: Present { value: "e3c" as EventId }, preparation: "e3", at: at + 1))]
 }
 
 // Group A's live commitment after a placement fold names exactly these hosts, and it fences them.
 fn alw_a_commits(f: PlacementFold, hosts: List<String>) -> Bool {
   match f {
     PlacementFolded { effects: _, preparations: preps } => {
-      same_host_set(a: group_live_commitment(preps: preps, group: FabricGroupA), b: map(hosts, h => alw_host(s: h)))
-        && all(hosts, h => any(group_fenced_hosts(preps: preps, group: FabricGroupA), x => (x as String) == h))
+      same_host_set(a: group_live_commitment(preps: preps, group: FabricGroupB {}), b: map(hosts, h => alw_host(s: h)))
+        && all(hosts, h => any(group_fenced_hosts(preps: preps, group: FabricGroupB {}), x => (x as String) == h))
     }
     PlacementFoldRefused { at_event: _, reason: _ } => false
   }
@@ -513,10 +500,10 @@ test fn host_effect_events_round_trip_through_the_wire() -> Bool {
 // next population) is a valid record on this wire while a committing AUTHORITY with no hosts is
 // not; a mis-keyed member refuses.
 test fn placement_events_round_trip_through_the_wire() -> Bool {
-  let prepared = alw_prepare(parent: none, group: FabricGroupB, previous: [alw_host(s: "srv12")], next: [alw_host(s: "srv12"), alw_host(s: "srv13")], at: 1000)
-  let releasing = alw_prepare(parent: none, group: FabricGroupB, previous: [alw_host(s: "srv12")], next: [] as List<HostIdentity>, at: 1001)
-  (match pair_authority_event_decode(text: pair_authority_event_wire_text(event: prepared)) { EventDecoded { event: back } => match back.payload { PlacementPrepared { operation: o, group: FabricGroupB, previous_hosts: ph, next_hosts: nh } => (o as String) == "tx-op" && length(ph) == 1 && length(nh) == 2  _ => false }  EventUndecodable { reason: _ } => false })
-    && (match pair_authority_event_decode(text: pair_authority_event_wire_text(event: releasing)) { EventDecoded { event: back } => match back.payload { PlacementPrepared { operation: _, group: FabricGroupB, previous_hosts: ph, next_hosts: nh } => length(ph) == 1 && length(nh) == 0  _ => false }  EventUndecodable { reason: _ } => false })
+  let prepared = alw_prepare(parent: none, group: FabricGroupB {}, previous: [alw_host(s: "srv12")], next: [alw_host(s: "srv12"), alw_host(s: "srv13")], at: 1000)
+  let releasing = alw_prepare(parent: none, group: FabricGroupB {}, previous: [alw_host(s: "srv12")], next: [] as List<HostIdentity>, at: 1001)
+  (match pair_authority_event_decode(text: pair_authority_event_wire_text(event: prepared)) { EventDecoded { event: back } => match back.payload { PlacementPrepared { operation: o, group: RecordedLiveGroup { group: FabricGroupB {} }, previous_hosts: ph, next_hosts: nh } => (o as String) == "tx-op" && length(ph) == 1 && length(nh) == 2  _ => false }  EventUndecodable { reason: _ } => false })
+    && (match pair_authority_event_decode(text: pair_authority_event_wire_text(event: releasing)) { EventDecoded { event: back } => match back.payload { PlacementPrepared { operation: _, group: RecordedLiveGroup { group: FabricGroupB {} }, previous_hosts: ph, next_hosts: nh } => length(ph) == 1 && length(nh) == 0  _ => false }  EventUndecodable { reason: _ } => false })
     && (match pair_authority_event_decode(text: pair_authority_event_wire_text(event: prepared).replace(from: "\"group\"", to: "\"grop\"")) { EventUndecodable { reason: _ } => true  EventDecoded { event: _ } => false })
     && (match pair_authority_event_decode(text: pair_authority_event_wire_text(event: alw_finalize(parent: none, preparation: "p1", at: 1002))) { EventDecoded { event: back } => match back.payload { PlacementFinalized { preparation: pr, authority_event: ae } => (pr.id as String) == "p1" && (ae as String) == "g1" && length(pr.next_hosts) == 1  _ => false }  EventUndecodable { reason: _ } => false })
     && (match pair_authority_event_decode(text: pair_authority_event_wire_text(event: alw_abort(parent: none, preparation: "p1", at: 1002))) { EventDecoded { event: back } => match back.payload { PlacementAborted { preparation: pr, reason: r, provenance: ClaimantTerminal { claim: c, claimant_executor: _ } } => (pr as String) == "p1" && (c as String) == "p1" && r.contains("did not land")  _ => false }  EventUndecodable { reason: _ } => false })
@@ -549,7 +536,7 @@ test fn the_observer_mints_quiet_only_from_a_scan_that_found_nothing() -> Bool {
 test fn a_release_whose_evidence_is_for_another_host_or_effect_refuses_at_that_event() -> Bool {
   let srv5 = alw_host(s: "srv5")
   let claim = alw_env(id: "e2", e: alw_effect(parent: none, host: srv5, at: 1000))
-  let commit = alw_prepare(parent: Present { value: "e3" as EventId }, group: FabricGroupA, previous: [] as List<HostIdentity>, next: [srv5], at: 1050)
+  let commit = alw_prepare(parent: Present { value: "e3" as EventId }, group: FabricGroupB {}, previous: [] as List<HostIdentity>, next: [srv5], at: 1050)
   alw_refuses_at_e3(prefix: [claim], after: commit, evidence: alw_evidence(host: alw_host(s: "srv6"), spec: alw_residue(pattern: "/srv/build")))
     && alw_refuses_at_e3(prefix: [claim], after: commit, evidence: alw_evidence(host: srv5, spec: alw_residue(pattern: "/srv/other")))
     && alw_refuses_at_e3(prefix: [claim], after: commit, evidence: alw_evidence(host: srv5, spec: HostEffectResidueSpec { process_pattern: "/srv/build" as NonEmptyStr, container: Present { value: DockerPsByName { name: "x" as NonEmptyStr } } }))
@@ -580,17 +567,16 @@ fn alw_refuses_at_e3(prefix: List<ChainEnvelope<PairAuthorityEvent>>, after: Cha
 // event -- STILL after the claim's term, since liveness is quiescence-required, not timed -- and
 // after the release the same preparation folds and, finalized, is the live commitment; a claim on
 // a host a pending preparation or a live commitment fences refuses; a second claim on a held host
-// refuses; a release of a claim that is not live refuses; two groups cannot fence one host, but an
-// aborted preparation frees it; a preparation whose previous population is not the group's live
+// refuses; a release of a claim that is not live refuses; an aborted preparation frees its host; a
+// preparation whose previous population is not the group's live
 // commitment refuses; a finalization or an abort of a non-pending preparation refuses; a release
 // preparation (next = []) keeps the OLD hosts fenced until finalized; an authority event on this
 // partition refuses; a placement event on a GROUP partition refuses in the authority fold.
 test fn the_placement_fold_fences_preparations_under_a_live_host_effect() -> Bool {
   let srv5 = alw_host(s: "srv5")
   let claim = alw_env(id: "e2", e: alw_effect(parent: none, host: srv5, at: 1000))
-  let prep = alw_prepare(parent: Present { value: "e2" as EventId }, group: FabricGroupA, previous: [] as List<HostIdentity>, next: [srv5], at: 1050)
-  let prep_late = alw_prepare(parent: Present { value: "e2" as EventId }, group: FabricGroupA, previous: [] as List<HostIdentity>, next: [srv5], at: 1200)
-  let prep_b = alw_prepare(parent: none, group: FabricGroupB, previous: [] as List<HostIdentity>, next: [srv5], at: 1060)
+  let prep = alw_prepare(parent: Present { value: "e2" as EventId }, group: FabricGroupB {}, previous: [] as List<HostIdentity>, next: [srv5], at: 1050)
+  let prep_late = alw_prepare(parent: Present { value: "e2" as EventId }, group: FabricGroupB {}, previous: [] as List<HostIdentity>, next: [srv5], at: 1200)
   let committed = alw_a_over_srv5(parent: none, at: 1050)
   (match placement_fold(oldest_first: [claim, alw_env(id: "e3", e: prep)]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e3" && r.contains("live host effect")  _ => false })
     && (match placement_fold(oldest_first: [claim, alw_env(id: "e3", e: prep_late)]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e3" && r.contains("OVERDUE")  _ => false })
@@ -599,52 +585,46 @@ test fn the_placement_fold_fences_preparations_under_a_live_host_effect() -> Boo
     && (match placement_fold(oldest_first: concat(committed, [alw_env(id: "e9", e: alw_effect(parent: Present { value: "e4" as EventId }, host: srv5, at: 1052))])) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e9" && r.contains("fenced it")  _ => false })
     && (match placement_fold(oldest_first: [claim, alw_env(id: "e3", e: alw_effect(parent: Present { value: "e2" as EventId }, host: srv5, at: 1001))]) { PlacementFoldRefused { at_event: e, reason: _ } => (e as String) == "e3"  _ => false })
     && (match placement_fold(oldest_first: [alw_env(id: "e3", e: alw_release(parent: none, admitted_by: "nope", at: 1001))]) { PlacementFoldRefused { at_event: e, reason: _ } => (e as String) == "e3"  _ => false })
-    && (match placement_fold(oldest_first: [alw_env(id: "e3", e: prep), alw_env(id: "e5", e: prep_b)]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e5" && r.contains("another group")  _ => false })
-    && (match placement_fold(oldest_first: [alw_env(id: "e3", e: prep), alw_env(id: "e5", e: alw_abort(parent: Present { value: "e3" as EventId }, preparation: "e3", at: 1055)), alw_env(id: "e6", e: prep_b)]) { PlacementFolded { effects: _, preparations: preps } => length(group_fenced_hosts(preps: preps, group: FabricGroupB)) == 1 && length(group_fenced_hosts(preps: preps, group: FabricGroupA)) == 0  _ => false })
     && (match placement_fold(oldest_first: [alw_env(id: "e3", e: prep), alw_env(id: "e5", e: alw_abort(parent: Present { value: "e3" as EventId }, preparation: "e3", at: 1055)), alw_env(id: "e6", e: alw_effect(parent: Present { value: "e5" as EventId }, host: srv5, at: 1056))]) { PlacementFolded { effects: effs, preparations: _ } => length(effs) == 1  _ => false })
-    && (match placement_fold(oldest_first: [alw_env(id: "e3", e: alw_prepare(parent: none, group: FabricGroupA, previous: [srv5], next: [srv5], at: 1000))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e3" && r.contains("previous population")  _ => false })
+    && (match placement_fold(oldest_first: [alw_env(id: "e3", e: alw_prepare(parent: none, group: FabricGroupB {}, previous: [srv5], next: [srv5], at: 1000))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e3" && r.contains("previous population")  _ => false })
     && (match placement_fold(oldest_first: [alw_env(id: "e1", e: alw_abort(parent: none, preparation: "nope", at: 1055))]) { PlacementFoldRefused { at_event: e, reason: _ } => (e as String) == "e1"  _ => false })
     && (match placement_fold(oldest_first: concat(committed, [alw_env(id: "e5", e: alw_finalize(parent: Present { value: "e4" as EventId }, preparation: "e3", at: 1052))])) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e5" && r.contains("no pending preparation")  _ => false })
     && (match placement_fold(oldest_first: concat(committed, [alw_env(id: "e5", e: alw_abort(parent: Present { value: "e4" as EventId }, preparation: "e3", at: 1052))])) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e5" && r.contains("no pending preparation")  _ => false })
-    && (match placement_fold(oldest_first: concat(committed, [alw_env(id: "e5", e: alw_prepare(parent: Present { value: "e4" as EventId }, group: FabricGroupA, previous: [srv5], next: [] as List<HostIdentity>, at: 1060)), alw_env(id: "e6", e: alw_effect(parent: Present { value: "e5" as EventId }, host: srv5, at: 1061))])) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e6" && r.contains("fenced it")  _ => false })
-    && (match placement_fold(oldest_first: concat(committed, [alw_env(id: "e5", e: alw_prepare(parent: Present { value: "e4" as EventId }, group: FabricGroupA, previous: [srv5], next: [] as List<HostIdentity>, at: 1060)), alw_env(id: "e5c", e: alw_release_claim(parent: Present { value: "e5" as EventId }, preparation: "e5", at: 1060)), alw_env(id: "e6", e: alw_finalize_of(parent: Present { value: "e5c" as EventId }, preparation: "e5", previous: [srv5], next: [] as List<HostIdentity>, at: 1061)), alw_env(id: "e7", e: alw_effect(parent: Present { value: "e6" as EventId }, host: srv5, at: 1062))])) { PlacementFolded { effects: effs, preparations: preps } => length(effs) == 1 && length(group_fenced_hosts(preps: preps, group: FabricGroupA)) == 0  _ => false })
-    && (match placement_fold(oldest_first: concat(committed, [alw_env(id: "e5", e: alw_prepare(parent: Present { value: "e4" as EventId }, group: FabricGroupA, previous: [srv5], next: [] as List<HostIdentity>, at: 1060)), alw_env(id: "e5c", e: alw_release_claim(parent: Present { value: "e5" as EventId }, preparation: "e5", at: 1060)), alw_env(id: "e6", e: alw_finalize_of(parent: Present { value: "e5c" as EventId }, preparation: "e5", previous: [srv5], next: [srv5], at: 1061))])) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e6" && r.contains("not the record")  _ => false })
+    && (match placement_fold(oldest_first: concat(committed, [alw_env(id: "e5", e: alw_prepare(parent: Present { value: "e4" as EventId }, group: FabricGroupB {}, previous: [srv5], next: [] as List<HostIdentity>, at: 1060)), alw_env(id: "e6", e: alw_effect(parent: Present { value: "e5" as EventId }, host: srv5, at: 1061))])) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e6" && r.contains("fenced it")  _ => false })
+    && (match placement_fold(oldest_first: concat(committed, [alw_env(id: "e5", e: alw_prepare(parent: Present { value: "e4" as EventId }, group: FabricGroupB {}, previous: [srv5], next: [] as List<HostIdentity>, at: 1060)), alw_env(id: "e5c", e: alw_release_claim(parent: Present { value: "e5" as EventId }, preparation: "e5", at: 1060)), alw_env(id: "e6", e: alw_finalize_of(parent: Present { value: "e5c" as EventId }, preparation: "e5", previous: [srv5], next: [] as List<HostIdentity>, at: 1061)), alw_env(id: "e7", e: alw_effect(parent: Present { value: "e6" as EventId }, host: srv5, at: 1062))])) { PlacementFolded { effects: effs, preparations: preps } => length(effs) == 1 && length(group_fenced_hosts(preps: preps, group: FabricGroupB {})) == 0  _ => false })
+    && (match placement_fold(oldest_first: concat(committed, [alw_env(id: "e5", e: alw_prepare(parent: Present { value: "e4" as EventId }, group: FabricGroupB {}, previous: [srv5], next: [] as List<HostIdentity>, at: 1060)), alw_env(id: "e5c", e: alw_release_claim(parent: Present { value: "e5" as EventId }, preparation: "e5", at: 1060)), alw_env(id: "e6", e: alw_finalize_of(parent: Present { value: "e5c" as EventId }, preparation: "e5", previous: [srv5], next: [srv5], at: 1061))])) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e6" && r.contains("not the record")  _ => false })
     && (match placement_fold(oldest_first: [alw_env(id: "e3", e: prep), alw_env(id: "e4", e: alw_finalize(parent: Present { value: "e3" as EventId }, preparation: "e3", at: 1051))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e4" && r.contains("never claimed")  _ => false })
-    && (match placement_fold(oldest_first: [alw_env(id: "e3", e: prep), alw_env(id: "e4", e: alw_prepare(parent: Present { value: "e3" as EventId }, group: FabricGroupA, previous: [] as List<HostIdentity>, next: [srv5], at: 1051))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e4" && r.contains("one saga at a time")  _ => false })
+    && (match placement_fold(oldest_first: [alw_env(id: "e3", e: prep), alw_env(id: "e4", e: alw_prepare(parent: Present { value: "e3" as EventId }, group: FabricGroupB {}, previous: [] as List<HostIdentity>, next: [srv5], at: 1051))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e4" && r.contains("one saga at a time")  _ => false })
     && (match placement_fold(oldest_first: [alw_env(id: "e3", e: prep), alw_env(id: "e3c", e: alw_claim(parent: Present { value: "e3" as EventId }, preparation: "e3", at: 1050)), alw_env(id: "e4", e: alw_abort_by(parent: Present { value: "e3c" as EventId }, preparation: "e3", at: 1051, actor: "someone-else"))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e4" && r.contains("not its claimant's own")  _ => false })
-    && (match placement_fold(oldest_first: [alw_env(id: "e3", e: prep), alw_env(id: "e3c", e: alw_claim(parent: Present { value: "e3" as EventId }, preparation: "e3", at: 1050)), alw_env(id: "e4", e: alw_abort(parent: Present { value: "e3c" as EventId }, preparation: "e3", at: 1051))]) { PlacementFolded { effects: _, preparations: preps } => length(group_fenced_hosts(preps: preps, group: FabricGroupA)) == 0  _ => false })
+    && (match placement_fold(oldest_first: [alw_env(id: "e3", e: prep), alw_env(id: "e3c", e: alw_claim(parent: Present { value: "e3" as EventId }, preparation: "e3", at: 1050)), alw_env(id: "e4", e: alw_abort(parent: Present { value: "e3c" as EventId }, preparation: "e3", at: 1051))]) { PlacementFolded { effects: _, preparations: preps } => length(group_fenced_hosts(preps: preps, group: FabricGroupB {})) == 0  _ => false })
     && (match placement_fold(oldest_first: [alw_env(id: "e3", e: prep), alw_env(id: "e3c", e: alw_claim(parent: Present { value: "e3" as EventId }, preparation: "e3", at: 1050)), alw_env(id: "e4", e: alw_claim(parent: Present { value: "e3c" as EventId }, preparation: "e3", at: 1051))]) { PlacementFoldRefused { at_event: e, reason: _ } => (e as String) == "e4"  _ => false })
     && (match placement_fold(oldest_first: [alw_env(id: "e1", e: ChainEvent { partition: host_placement_partition, parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityEstablished { authority: alw_w_active_unestablished(), placement: alw_establish_ref(a: alw_w_active_unestablished()) } })]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e1" && r.contains("authority event")  _ => false })
-    && (match authority_fold(oldest_first: [alw_env(id: "e0", e: alw_establish(a: alw_w_active_unestablished())), alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: HostEffectAdmitted { host: srv5, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: alw_residue(pattern: "/srv/build") } })]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e1" && r.contains("host-placement partition only")  _ => false })
-    && (match authority_fold(oldest_first: [alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: PlacementPrepared { operation: "x" as NonEmptyStr, group: FabricGroupA, previous_hosts: [] as List<HostIdentity>, next_hosts: [srv5] } })]) { AuthorityFoldRefused { at_event: e, reason: _ } => (e as String) == "e1"  _ => false })
+    && (match authority_fold(oldest_first: [alw_env(id: "e0", e: alw_establish(a: alw_w_active_unestablished())), alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: HostEffectAdmitted { host: srv5, purpose: "a build" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, term: second(count: 100), residue: alw_residue(pattern: "/srv/build") } })]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e1" && r.contains("host-placement partition only")  _ => false })
+    && (match authority_fold(oldest_first: [alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: PlacementPrepared { operation: "x" as NonEmptyStr, group: RecordedLiveGroup { group: FabricGroupB {} }, previous_hosts: [] as List<HostIdentity>, next_hosts: [srv5] } })]) { AuthorityFoldRefused { at_event: e, reason: _ } => (e as String) == "e1"  _ => false })
 }
 
 // THE ESTABLISHMENT IS ONE EVENT FROM THE DURABLE GENESIS: an empty chain is unestablished (no
 // authority, no generation); establishing folds to generation 0 with the row as current; a second
 // establishment refuses; a transition or an entry state before any establishment refuses; a
-// leased state cannot be established; an authority naming another group than the partition's
-// refuses; the established event round-trips.
+// leased state cannot be established; the established event round-trips.
 test fn the_partition_folds_from_an_unestablished_genesis_through_the_establishment() -> Bool {
   alw_with_hash(scenario: fn(h) {
     let resting = alw_w_active_unestablished()
-    let released = ReleasedToFleet { group: FabricGroupA, release_receipt: h }
-    let pending = SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
-    let elsewhere = PairServingActive { group: FabricGroupB, exact_realization: PairRealizationUnestablished { obligation: "w" as NonEmptyStr } }
-    let to_active = ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 1050, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: released, next: resting, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: released, next: resting, operation: "tx-op") } }
+    let released = ReleasedToFleet { group: FabricGroupB {}, release_receipt: h }
+    let pending = SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
+    let to_active = ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 1050, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: released, next: resting, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: released, next: resting, operation: "tx-op") } }
     (match authority_fold(oldest_first: [] as List<ChainEnvelope<PairAuthorityEvent>>) { AuthorityUnestablished { cancelled: _ } => true  _ => false })
       && (match alw_fold(resting: resting, oldest_first: [] as List<ChainEnvelope<PairAuthorityEvent>>) { AuthorityFolded { current: c, generation: g, preparations_consumed: pcs } => g == 0 && authority_eq(a: c, b: resting) && length(pcs) == 1 && (match first(pcs) { Present { value: pp } => (pp.preparation.id as String) == "p0"  Absent => false })  _ => false })
       && (match alw_fold(resting: resting, oldest_first: [alw_env(id: "e1", e: alw_establish(a: released))]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e1" && r.contains("already established")  _ => false })
       && (match authority_fold(oldest_first: [alw_env(id: "e1", e: to_active)]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e1" && r.contains("before any authority")  _ => false })
       && (match authority_fold(oldest_first: [alw_env(id: "e0", e: alw_establish(a: pending))]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e0" && r.contains("lease")  _ => false })
-      && (match authority_fold(oldest_first: [alw_env(id: "e0", e: alw_establish(a: elsewhere))]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e0" && r.contains("not this partition's group")  _ => false })
-      && (match authority_fold(oldest_first: [alw_env(id: "e0", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 990, actor: "witness" as NonEmptyStr, payload: AuthorityEstablished { authority: resting, placement: PlacementPreparationRef { id: "p0" as EventId, group: FabricGroupB, previous_hosts: [] as List<HostIdentity>, next_hosts: committed_population(a: resting), operation: "establish group-a" as NonEmptyStr } } })]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e0" && r.contains("belongs to group-b")  _ => false })
-      && (match authority_fold(oldest_first: [alw_env(id: "e0", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 990, actor: "witness" as NonEmptyStr, payload: AuthorityEstablished { authority: resting, placement: PlacementPreparationRef { id: "p0" as EventId, group: FabricGroupA, previous_hosts: [] as List<HostIdentity>, next_hosts: [alw_host(s: "srv9")], operation: "establish group-a" as NonEmptyStr } } })]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e0" && r.contains("not the next state's")  _ => false })
-      && (match alw_fold(resting: resting, oldest_first: [alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-other") } })]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e1" && r.contains("not this event's")  _ => false })
-      && (match alw_fold(resting: resting, oldest_first: [alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: resting, operation: "tx-op") } })]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e1" && r.contains("not the next state's")
-      && (match write_intent_of_witness(env: alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 1000, actor: "someone-else" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-op") } }), previous: resting, next: released) { derived => !write_intent_eq(a: derived, b: alw_intent(parent: none, previous: Present { value: resting }, next: released, operation: "tx-op", lifecycle: none, grant: none, entry_state: none)) })
-      && (match write_intent_of_witness(env: alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: Present { value: "e0" as EventId }, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-op") } }), previous: resting, next: released) { derived => !write_intent_eq(a: derived, b: alw_intent(parent: none, previous: Present { value: resting }, next: released, operation: "tx-op", lifecycle: none, grant: none, entry_state: none)) })
-      && (match write_intent_of_witness(env: alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: resting, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: resting, operation: "tx-op") } }), previous: resting, next: resting) { derived => !write_intent_eq(a: derived, b: alw_intent(parent: none, previous: Present { value: resting }, next: released, operation: "tx-op", lifecycle: none, grant: none, entry_state: none)) })
-      && (match write_intent_of_witness(env: alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-op") } }), previous: resting, next: released) { derived => write_intent_eq(a: derived, b: alw_intent(parent: none, previous: Present { value: resting }, next: released, operation: "tx-op", lifecycle: none, grant: none, entry_state: none)) })  _ => false })
+      && (match authority_fold(oldest_first: [alw_env(id: "e0", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 990, actor: "witness" as NonEmptyStr, payload: AuthorityEstablished { authority: resting, placement: PlacementPreparationRef { id: "p0" as EventId, group: RecordedLiveGroup { group: FabricGroupB {} }, previous_hosts: [] as List<HostIdentity>, next_hosts: [alw_host(s: "srv9")], operation: "establish group-b" as NonEmptyStr } } })]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e0" && r.contains("not the next state's")  _ => false })
+      && (match alw_fold(resting: resting, oldest_first: [alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-other") } })]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e1" && r.contains("not this event's")  _ => false })
+      && (match alw_fold(resting: resting, oldest_first: [alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: resting, operation: "tx-op") } })]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e1" && r.contains("not the next state's")
+      && (match write_intent_of_witness(env: alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 1000, actor: "someone-else" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-op") } }), previous: resting, next: released) { derived => !write_intent_eq(a: derived, b: alw_intent(parent: none, previous: Present { value: resting }, next: released, operation: "tx-op", lifecycle: none, grant: none, entry_state: none)) })
+      && (match write_intent_of_witness(env: alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: Present { value: "e0" as EventId }, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-op") } }), previous: resting, next: released) { derived => !write_intent_eq(a: derived, b: alw_intent(parent: none, previous: Present { value: resting }, next: released, operation: "tx-op", lifecycle: none, grant: none, entry_state: none)) })
+      && (match write_intent_of_witness(env: alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: resting, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: resting, operation: "tx-op") } }), previous: resting, next: resting) { derived => !write_intent_eq(a: derived, b: alw_intent(parent: none, previous: Present { value: resting }, next: released, operation: "tx-op", lifecycle: none, grant: none, entry_state: none)) })
+      && (match write_intent_of_witness(env: alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: none, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-op") } }), previous: resting, next: released) { derived => write_intent_eq(a: derived, b: alw_intent(parent: none, previous: Present { value: resting }, next: released, operation: "tx-op", lifecycle: none, grant: none, entry_state: none)) })  _ => false })
       && (match pair_authority_event_decode(text: pair_authority_event_wire_text(event: alw_establish(a: resting))) { EventDecoded { event: back } => match back.payload { AuthorityEstablished { authority: a, placement: _ } => authority_eq(a: a, b: resting)  _ => false }  EventUndecodable { reason: _ } => false })
   })
 }
@@ -688,7 +668,7 @@ fn alw_recovery_for(claim: String) -> ReleaseProvenance {
 test fn a_terminal_release_by_another_executor_refuses() -> Bool {
   let srv5 = alw_host(s: "srv5")
   let claim = alw_env(id: "e2", e: alw_effect(parent: none, host: srv5, at: 1000))
-  let commit = alw_env(id: "e4", e: alw_prepare(parent: Present { value: "e3" as EventId }, group: FabricGroupA, previous: [] as List<HostIdentity>, next: [srv5], at: 1050))
+  let commit = alw_env(id: "e4", e: alw_prepare(parent: Present { value: "e3" as EventId }, group: FabricGroupB {}, previous: [] as List<HostIdentity>, next: [srv5], at: 1050))
   let claimed = alw_env(id: "e4c", e: alw_claim(parent: Present { value: "e4" as EventId }, preparation: "e4", at: 1050))
   let fin = alw_env(id: "e5", e: alw_finalize(parent: Present { value: "e4c" as EventId }, preparation: "e4", at: 1051))
   match alw_evidence_at(claim: "e2", host: srv5, spec: alw_residue(pattern: "/srv/build"), at: 1010) {
@@ -716,27 +696,26 @@ fn alw_claim_written_by(parent: EventId?, preparation: String, actor: String, cl
   ChainEvent { partition: host_placement_partition, parent: parent, recorded_at: at, actor: actor as NonEmptyStr, payload: PlacementAppendClaimed { preparation: (preparation as NonEmptyStr) as EventId, intent: alw_srv5_intent(actor: claimant) } }
 }
 
-// A claim by the witness whose intent is for another write than its preparation: another group,
-// another population, another operation.
+// A claim by the witness whose intent is for another write than its preparation: another
+// population, another operation.
 fn alw_claim_for(parent: EventId?, preparation: String, intent: AuthorityWriteIntent, at: Int) -> ChainEvent<PairAuthorityEvent> {
   ChainEvent { partition: host_placement_partition, parent: parent, recorded_at: at, actor: "witness" as NonEmptyStr, payload: PlacementAppendClaimed { preparation: (preparation as NonEmptyStr) as EventId, intent: intent } }
 }
 
 // A cancellation of `preparation` on group A's partition by an operator recovery, at `parent`.
 fn alw_cancel(parent: EventId?, preparation: String, at: Int) -> ChainEvent<PairAuthorityEvent> {
-  ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: parent, recorded_at: at, actor: "operator" as NonEmptyStr, payload: AuthorityAppendCancelled { preparation: (preparation as NonEmptyStr) as EventId, provenance: alw_recovery_for(claim: preparation) } }
+  ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: parent, recorded_at: at, actor: "operator" as NonEmptyStr, payload: AuthorityAppendCancelled { preparation: (preparation as NonEmptyStr) as EventId, provenance: alw_recovery_for(claim: preparation) } }
 }
 
 // A claim written by E2 naming E1 as claimant refuses in the placement fold; the same claim
 // written by E1 lands as AppendClaimed by E1.
 test fn an_append_claim_is_written_by_its_claimant_and_is_the_write_its_preparation_is_for() -> Bool {
   let srv5 = alw_host(s: "srv5")
-  let prep = alw_env(id: "e3", e: alw_prepare(parent: none, group: FabricGroupA, previous: [] as List<HostIdentity>, next: [srv5], at: 1000))
+  let prep = alw_env(id: "e3", e: alw_prepare(parent: none, group: FabricGroupB {}, previous: [] as List<HostIdentity>, next: [srv5], at: 1000))
   (match placement_fold(oldest_first: [prep, alw_env(id: "e3c", e: alw_claim_written_by(parent: Present { value: "e3" as EventId }, preparation: "e3", actor: "executor-2", claimant: "executor-1", at: 1001))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e3c" && r.contains("written by its claimant")  _ => false })
     && (match placement_fold(oldest_first: [prep, alw_env(id: "e3c", e: alw_claim_written_by(parent: Present { value: "e3" as EventId }, preparation: "e3", actor: "executor-1", claimant: "executor-1", at: 1001))]) { PlacementFolded { effects: _, preparations: ps } => any(ps, r => (r.id as String) == "e3" && (match r.state { AppendClaimed { claimant: c, expected_head: _, intent: _ } => (c as String) == "executor-1"  _ => false }))  _ => false })
-    && (match placement_fold(oldest_first: [prep, alw_env(id: "e3c", e: alw_claim_for(parent: Present { value: "e3" as EventId }, preparation: "e3", intent: authority_write_intent(group: FabricGroupB, head: HeadAbsent, actor: "witness" as NonEmptyStr, previous: none, next: FencedRefusal { group: FabricGroupB, hosts: [srv5], cause: "w" as NonEmptyStr, disposition_authority: "w" as NonEmptyStr }, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none), at: 1001))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e3c" && r.contains("not the write its preparation is for")  _ => false })
-    && (match placement_fold(oldest_first: [prep, alw_env(id: "e3c", e: alw_claim_for(parent: Present { value: "e3" as EventId }, preparation: "e3", intent: authority_write_intent(group: FabricGroupA, head: HeadAbsent, actor: "witness" as NonEmptyStr, previous: none, next: alw_fenced_over(hs: [alw_host(s: "srv6")]), operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none), at: 1001))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e3c" && r.contains("not the next state's")  _ => false })
-    && (match placement_fold(oldest_first: [prep, alw_env(id: "e3c", e: alw_claim_for(parent: Present { value: "e3" as EventId }, preparation: "e3", intent: authority_write_intent(group: FabricGroupA, head: HeadAbsent, actor: "witness" as NonEmptyStr, previous: none, next: alw_fenced_over(hs: [srv5]), operation: "tx-other" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none), at: 1001))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e3c" && r.contains("not this event's")  _ => false })
+    && (match placement_fold(oldest_first: [prep, alw_env(id: "e3c", e: alw_claim_for(parent: Present { value: "e3" as EventId }, preparation: "e3", intent: authority_write_intent(group: FabricGroupB {}, head: HeadAbsent, actor: "witness" as NonEmptyStr, previous: none, next: alw_fenced_over(hs: [alw_host(s: "srv6")]), operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none), at: 1001))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e3c" && r.contains("not the next state's")  _ => false })
+    && (match placement_fold(oldest_first: [prep, alw_env(id: "e3c", e: alw_claim_for(parent: Present { value: "e3" as EventId }, preparation: "e3", intent: authority_write_intent(group: FabricGroupB {}, head: HeadAbsent, actor: "witness" as NonEmptyStr, previous: none, next: alw_fenced_over(hs: [srv5]), operation: "tx-other" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none), at: 1001))]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e3c" && r.contains("not this event's")  _ => false })
 }
 
 // On the group partition, a cancellation of a preparation an accepted authority event already
@@ -745,13 +724,13 @@ test fn an_append_claim_is_written_by_its_claimant_and_is_the_write_its_preparat
 test fn a_consumed_preparation_cannot_be_cancelled_and_a_cancelled_one_cannot_be_consumed() -> Bool {
   alw_with_hash(scenario: fn(h) {
     let resting = alw_w_active_unestablished()
-    let released = ReleasedToFleet { group: FabricGroupA, release_receipt: h }
+    let released = ReleasedToFleet { group: FabricGroupB {}, release_receipt: h }
     let est = alw_env(id: "e0", e: alw_establish(a: resting))
-    let tx = alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: Present { value: "e0" as EventId }, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-op") } })
+    let tx = alw_env(id: "e1", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: Present { value: "e0" as EventId }, recorded_at: 1000, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-op") } })
     let pid = (alw_ref(previous: resting, next: released, operation: "tx-op").id as String)
     (match authority_fold(oldest_first: [est, tx, alw_env(id: "e2", e: alw_cancel(parent: Present { value: "e1" as EventId }, preparation: pid, at: 1001))]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e2" && r.contains("already consumed")  _ => false })
       && (match authority_fold(oldest_first: [est, tx]) { AuthorityFolded { generation: g } => g == 1  _ => false })
-      && (match authority_fold(oldest_first: [est, alw_env(id: "e2", e: alw_cancel(parent: Present { value: "e0" as EventId }, preparation: pid, at: 1001)), alw_env(id: "e3", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupA), parent: Present { value: "e2" as EventId }, recorded_at: 1002, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-op") } })]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e3" && r.contains("cancelled")  _ => false })
+      && (match authority_fold(oldest_first: [est, alw_env(id: "e2", e: alw_cancel(parent: Present { value: "e0" as EventId }, preparation: pid, at: 1001)), alw_env(id: "e3", e: ChainEvent { partition: pair_authority_partition(group: FabricGroupB {}), parent: Present { value: "e2" as EventId }, recorded_at: 1002, actor: "witness" as NonEmptyStr, payload: AuthorityTransitioned { previous: resting, next: released, transaction: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, placement: alw_ref(previous: resting, next: released, operation: "tx-op") } })]) { AuthorityFoldRefused { at_event: e, reason: r } => (e as String) == "e3" && r.contains("cancelled")  _ => false })
       && (match authority_fold(oldest_first: [est, alw_env(id: "e2", e: alw_cancel(parent: Present { value: "e0" as EventId }, preparation: pid, at: 1001))]) { AuthorityFolded { generation: g, cancelled: xs } => g == 0 && length(xs) == 1 && any(xs, c => (c.preparation as String) == pid && (match c.at_head { HeadAt { id: hd } => (hd as String) == "e0"  HeadAbsent => false }))  _ => false })
   })
 }
@@ -760,7 +739,7 @@ test fn a_consumed_preparation_cannot_be_cancelled_and_a_cancelled_one_cannot_be
 // appended at the head the claim named; a cancellation at another head is a gap.
 test fn a_cancellation_must_move_the_head_its_claim_named() -> Bool {
   let srv5 = alw_host(s: "srv5")
-  let claimed_at_e0 = PlacementPreparationRecord { id: "p1" as EventId, operation: "tx-op" as NonEmptyStr, group: FabricGroupA, previous_hosts: [] as List<HostIdentity>, next_hosts: [srv5], recorded_at: 1000, prepared_by: "witness" as NonEmptyStr, state: AppendClaimed { claimant: "witness" as NonEmptyStr, expected_head: HeadAt { id: "e0" as EventId }, intent: alw_intent(parent: Present { value: "e0" as EventId }, previous: none, next: alw_w_active_unestablished(), operation: "tx-op", lifecycle: none, grant: none, entry_state: none) } }
+  let claimed_at_e0 = PlacementPreparationRecord { id: "p1" as EventId, operation: "tx-op" as NonEmptyStr, group: RecordedLiveGroup { group: FabricGroupB {} }, previous_hosts: [] as List<HostIdentity>, next_hosts: [srv5], recorded_at: 1000, prepared_by: "witness" as NonEmptyStr, state: AppendClaimed { claimant: "witness" as NonEmptyStr, expected_head: HeadAt { id: "e0" as EventId }, intent: alw_intent(parent: Present { value: "e0" as EventId }, previous: none, next: alw_w_active_unestablished(), operation: "tx-op", lifecycle: none, grant: none, entry_state: none) } }
   let at_e0 = CancelledPreparation { preparation: "p1" as EventId, provenance: alw_recovery_for(claim: "p1"), actor: "operator" as NonEmptyStr, at_head: HeadAt { id: "e0" as EventId } }
   let at_e9 = CancelledPreparation { preparation: "p1" as EventId, provenance: alw_recovery_for(claim: "p1"), actor: "operator" as NonEmptyStr, at_head: HeadAt { id: "e9" as EventId } }
   let stranger = CancelledPreparation { preparation: "p1" as EventId, provenance: ClaimantTerminal { claim: "p1" as EventId, claimant_executor: "someone-else" as NonEmptyStr }, actor: "someone-else" as NonEmptyStr, at_head: HeadAt { id: "e0" as EventId } }
@@ -776,19 +755,19 @@ test fn a_cancellation_must_move_the_head_its_claim_named() -> Bool {
 test fn the_write_intent_is_compared_field_for_field_and_round_trips() -> Bool {
   alw_with_hash(scenario: fn(h) {
     let resting = alw_w_active_unestablished()
-    let released = ReleasedToFleet { group: FabricGroupA, release_receipt: h }
-    let pending = SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
-    let base = authority_write_intent(group: FabricGroupA, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none)
-    let full = authority_write_intent(group: FabricGroupA, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: pending, operation: "tx-1" as NonEmptyStr, lifecycle: Present { value: h }, grant: none, entry_state: Present { value: h })
+    let released = ReleasedToFleet { group: FabricGroupB {}, release_receipt: h }
+    let pending = SuspensionPendingReconciliation { group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}), transaction: "tx-1" as NonEmptyStr, authorization_binding: h, lease: alw_w_lease(h: h, inaccessible: false) }
+    let base = authority_write_intent(group: FabricGroupB {}, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none)
+    let full = authority_write_intent(group: FabricGroupB {}, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: pending, operation: "tx-1" as NonEmptyStr, lifecycle: Present { value: h }, grant: none, entry_state: Present { value: h })
     let claim = ChainEvent { partition: host_placement_partition, parent: none, recorded_at: 1001, actor: "witness" as NonEmptyStr, payload: PlacementAppendClaimed { preparation: "p1" as EventId, intent: full } }
     write_intent_eq(a: base, b: base)
-      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupA, head: HeadAbsent, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none))
-      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupA, head: HeadAt { id: "e0" as EventId }, actor: "someone-else" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none))
-      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupA, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: none, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none))
-      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupA, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: pending, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none))
-      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupA, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-other" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none))
-      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupA, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: Present { value: h }, grant: none, entry_state: none))
-      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupA, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: Present { value: h }))
+      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupB {}, head: HeadAbsent, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none))
+      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupB {}, head: HeadAt { id: "e0" as EventId }, actor: "someone-else" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none))
+      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupB {}, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: none, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none))
+      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupB {}, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: pending, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none))
+      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupB {}, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-other" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none))
+      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupB {}, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: Present { value: h }, grant: none, entry_state: none))
+      && !write_intent_eq(a: base, b: authority_write_intent(group: FabricGroupB {}, head: HeadAt { id: "e0" as EventId }, actor: "witness" as NonEmptyStr, previous: Present { value: resting }, next: released, operation: "tx-op" as NonEmptyStr, lifecycle: none, grant: none, entry_state: Present { value: h }))
       && (match pair_authority_event_decode(text: pair_authority_event_wire_text(event: claim)) { EventDecoded { event: back } => match back.payload { PlacementAppendClaimed { preparation: _, intent: i } => write_intent_eq(a: i, b: full) && (match i.expected_head { HeadAt { id: hd } => (hd as String) == "e0"  HeadAbsent => false })  _ => false }  EventUndecodable { reason: _ } => false })
       && (match pair_authority_event_decode(text: pair_authority_event_wire_text(event: claim).replace(from: "\"intent_prev_state\"", to: "\"intent_prev_stale\"")) { EventUndecodable { reason: _ } => true  EventDecoded { event: _ } => false })
   })
@@ -799,7 +778,7 @@ test fn the_write_intent_is_compared_field_for_field_and_round_trips() -> Bool {
 // recovery naming it lands.
 test fn a_prepared_preparation_is_aborted_only_by_its_preparer_or_a_recovery() -> Bool {
   let srv5 = alw_host(s: "srv5")
-  let prep = alw_env(id: "e3", e: alw_prepare(parent: none, group: FabricGroupA, previous: [] as List<HostIdentity>, next: [srv5], at: 1000))
+  let prep = alw_env(id: "e3", e: alw_prepare(parent: none, group: FabricGroupB {}, previous: [] as List<HostIdentity>, next: [srv5], at: 1000))
   let stranger = ChainEvent { partition: host_placement_partition, parent: Present { value: "e3" as EventId }, recorded_at: 1001, actor: "someone-else" as NonEmptyStr, payload: PlacementAborted { preparation: "e3" as EventId, reason: "not mine", provenance: ClaimantTerminal { claim: "e3" as EventId, claimant_executor: "someone-else" as NonEmptyStr } } }
   let recovery = ChainEvent { partition: host_placement_partition, parent: Present { value: "e3" as EventId }, recorded_at: 1001, actor: "operator" as NonEmptyStr, payload: PlacementAborted { preparation: "e3" as EventId, reason: "the lane died", provenance: alw_recovery_for(claim: "e3") } }
   (match placement_fold(oldest_first: [prep, alw_env(id: "e4", e: stranger)]) { PlacementFoldRefused { at_event: e, reason: r } => (e as String) == "e4" && r.contains("not its claimant's own")  _ => false })
@@ -836,3 +815,91 @@ test fn an_ephemeral_run_carries_its_labels_and_memory_cap() -> Bool {
   contains(capped, "--label gunbc.lane=a-lane --memory 1024 --memory-swap 1024 --entrypoint sh img -c true")
     && !contains(plain, "--label") && !contains(plain, "--memory")
 }
+
+// ── GROUP A'S RECORDS ARE RETIRED IN THE SHARED CHAIN, NOT UNREADABLE (side-chat review, 2026-10-08) ─────
+//
+// D0's Group A release left Group A placement records in the append-only host-placement partition, which
+// every group reads. A record recorded under the retired group round-trips through the real codec as
+// group-a; a chain carrying one followed by Group B's own events folds; Group B's fence and pending
+// preparation are exactly its own; and the live group vocabulary has no Group A to select.
+fn alw_retired_prepare(parent: EventId?, next: List<HostIdentity>, at: Int) -> ChainEvent<PairAuthorityEvent> {
+  ChainEvent { partition: host_placement_partition, parent: parent, recorded_at: at, actor: "witness" as NonEmptyStr, payload: PlacementPrepared { operation: "d0-release" as NonEmptyStr, group: RecordedRetiredGroupA, previous_hosts: [] as List<HostIdentity>, next_hosts: next } }
+}
+
+fn alw_is_retired(e: ChainEvent<PairAuthorityEvent>) -> Bool {
+  match e.payload {
+    PlacementPrepared { operation: _, group: g, previous_hosts: _, next_hosts: _ } => match g { RecordedRetiredGroupA => true  RecordedLiveGroup { group: _ } => false }
+    _ => false
+  }
+}
+
+test fn a_retired_group_a_record_round_trips_through_the_durable_codec() -> Bool {
+  let retired = alw_retired_prepare(parent: none, next: [alw_host(s: "srv5")], at: 100)
+  pair_authority_event_wire_text(event: retired).contains("group-a")
+    && (match pair_authority_event_decode(text: pair_authority_event_wire_text(event: retired)) {
+      EventDecoded { event: back } => alw_is_retired(e: back)
+      _ => false
+    })
+}
+
+test fn a_chain_with_group_a_history_then_group_b_events_folds_and_group_b_decides_alone() -> Bool {
+  let a_prep = alw_env(id: "a1", e: alw_retired_prepare(parent: none, next: [alw_host(s: "srv5"), alw_host(s: "srv6")], at: 100))
+  let b_prep = alw_env(id: "b1", e: alw_prepare(parent: Present { value: "a1" as EventId }, group: FabricGroupB {}, previous: [] as List<HostIdentity>, next: [alw_host(s: "srv9")], at: 200))
+  match placement_fold(oldest_first: [a_prep, b_prep]) {
+    PlacementFoldRefused { at_event: _, reason: _ } => false
+    PlacementFolded { effects: _, preparations: ps } =>
+      length(ps) == 2
+        && same_host_set(a: group_fenced_hosts(preps: ps, group: FabricGroupB {}), b: [alw_host(s: "srv9")])
+        && (match parse_fabric_group(wire: recorded_group_wire(r: RecordedRetiredGroupA)) { Absent => true  Present { value: _ } => false })
+        && (match parse_recorded_group(wire: "group-a") { Present { value: RecordedRetiredGroupA } => true  _ => false })
+  }
+}
+
+// A FULL RETIRED SAGA, AS D0'S GROUP A RELEASE WROTE IT, THEN A GROUP B EVENT -- every event through the
+// real codec (encoded, then decoded back) before the fold reads it. The retired intent carries retired
+// states; the chain folds; the retired preparation ends Finalized as history; Group B's fence is exactly
+// its own host.
+fn alw_through_codec(id: String, e: ChainEvent<PairAuthorityEvent>) -> ChainEnvelope<PairAuthorityEvent>? {
+  match pair_authority_event_decode(text: pair_authority_event_wire_text(event: e)) {
+    EventDecoded { event: back } => Present { value: alw_env(id: id, e: back) }
+    _ => none
+  }
+}
+
+fn alw_retired_intent() -> AuthorityWriteIntent {
+  AuthorityWriteIntent {
+    group: RecordedRetiredGroupA, expected_head: HeadAbsent, actor: "witness" as NonEmptyStr,
+    previous: none, next: RecordedRetiredGroupAAuthority { state: "released-to-fleet" as NonEmptyStr },
+    operation: "d0-release" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none,
+  }
+}
+
+fn alw_retired_ref() -> PlacementPreparationRef {
+  PlacementPreparationRef { id: "a1" as EventId, group: RecordedRetiredGroupA, previous_hosts: [] as List<HostIdentity>, next_hosts: [alw_host(s: "srv5")], operation: "d0-release" as NonEmptyStr }
+}
+
+test fn a_full_retired_group_a_saga_then_group_b_folds_through_the_real_codec() -> Bool {
+  let prep = ChainEvent { partition: host_placement_partition, parent: none, recorded_at: 100, actor: "witness" as NonEmptyStr, payload: PlacementPrepared { operation: "d0-release" as NonEmptyStr, group: RecordedRetiredGroupA, previous_hosts: [] as List<HostIdentity>, next_hosts: [alw_host(s: "srv5")] } }
+  let claim = ChainEvent { partition: host_placement_partition, parent: Present { value: "a1" as EventId }, recorded_at: 110, actor: "witness" as NonEmptyStr, payload: PlacementAppendClaimed { preparation: "a1" as EventId, intent: alw_retired_intent() } }
+  let fin = ChainEvent { partition: host_placement_partition, parent: Present { value: "a2" as EventId }, recorded_at: 120, actor: "witness" as NonEmptyStr, payload: PlacementFinalized { preparation: alw_retired_ref(), authority_event: "ga-auth-1" as EventId } }
+  let b = alw_prepare(parent: Present { value: "a3" as EventId }, group: FabricGroupB {}, previous: [] as List<HostIdentity>, next: [alw_host(s: "srv9")], at: 200)
+  match alw_through_codec(id: "a1", e: prep) {
+    Absent => false
+    Present { value: e1 } => match alw_through_codec(id: "a2", e: claim) {
+      Absent => false
+      Present { value: e2 } => match alw_through_codec(id: "a3", e: fin) {
+        Absent => false
+        Present { value: e3 } => match alw_through_codec(id: "b1", e: b) {
+          Absent => false
+          Present { value: e4 } => match placement_fold(oldest_first: [e1, e2, e3, e4]) {
+            PlacementFoldRefused { at_event: _, reason: _ } => false
+            PlacementFolded { effects: _, preparations: ps } =>
+              length(ps) == 2
+                && same_host_set(a: group_fenced_hosts(preps: ps, group: FabricGroupB {}), b: [alw_host(s: "srv9")])
+                && any(ps, r => (r.id as String) == "a1" && (match r.state { Finalized { authority_event: _, finalized_by: _, intent: _ } => true  _ => false }))
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/dag/test/claim/spark/pair_serving_authority_witness_test.dag b/dag/test/claim/spark/pair_serving_authority_witness_test.dag
index ae29af7d853..123d66e86bc 100644
--- a/dag/test/claim/spark/pair_serving_authority_witness_test.dag
+++ b/dag/test/claim/spark/pair_serving_authority_witness_test.dag
@@ -5,7 +5,7 @@ import std.types { NonEmptyStr, List, String }
 import std.optional { Present, Absent }
 import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest }
 import std.temporal_effect { HeldLease, held_lease, LeaseEpoch, LeaseRunningExpected, LeaseRunningStale, LeaseAbsent, LeasePortForeign, LeaseInaccessible }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB, fabric_group_hosts, fabric_group_wire }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, fabric_group_hosts, fabric_group_wire, FabricGroup }
 import gunbc.spark.released_baseline { QuiescentReservedBaseline }
 import gunbc.spark.pair_serving_desired { spark_pair_serving_unit }
 import gunbc.spark.pair_serving_apply { spark_pair_apply_plan_under, SparkPairApplyPlan, SparkPairApplyPlanned, SparkPairApplyRefused }
@@ -53,14 +53,14 @@ fn w_lease(h: ContentHash, observed_stale: Bool) -> HeldLease {
 
 fn w_active() -> PairServingGroupAuthority {
   PairServingActive {
-    group: FabricGroupA,
+    group: FabricGroupB {},
     exact_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr },
   }
 }
 
 fn w_pending(h: ContentHash, stale: Bool) -> PairServingGroupAuthority {
   SuspensionPendingReconciliation {
-    group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA),
+    group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}),
     transaction: "witness-transaction" as NonEmptyStr,
     authorization_binding: h,
     lease: w_lease(h: h, observed_stale: stale),
@@ -69,7 +69,7 @@ fn w_pending(h: ContentHash, stale: Bool) -> PairServingGroupAuthority {
 
 fn w_suspended(h: ContentHash, stale: Bool) -> PairServingGroupAuthority {
   SuspendedForAuthorizedSuccessor {
-    group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA),
+    group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}),
     authorization: "witness-authorization" as NonEmptyStr,
     exact_candidate_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr },
     lease: w_lease(h: h, observed_stale: stale),
@@ -79,14 +79,14 @@ fn w_suspended(h: ContentHash, stale: Bool) -> PairServingGroupAuthority {
 
 fn w_fenced() -> PairServingGroupAuthority {
   FencedRefusal {
-    group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA),
+    group: FabricGroupB {}, hosts: fabric_group_hosts(g: FabricGroupB {}),
     cause: "witness-foreign-occupant" as NonEmptyStr,
     disposition_authority: "witness-operator" as NonEmptyStr,
   }
 }
 
 fn w_released(h: ContentHash) -> PairServingGroupAuthority {
-  ReleasedToFleet { group: FabricGroupA, release_receipt: h }
+  ReleasedToFleet { group: FabricGroupB {}, release_receipt: h }
 }
 
 // APPLY ACTS ONLY WHEN ACTIVE. The four negatives are the content of this claim: an apply seam that
@@ -178,12 +178,10 @@ test fn capacity_partitions_into_three_present_subjects() -> Bool {
 // filter observable: four hosts must leave.
 test fn a_released_authority_removes_its_hosts_from_the_commitment() -> Bool {
   with_w_hash(scenario: h => {
-    let live = spark_claimed_members_under(authorities: spark_pair_serving_authorities)
     let released = spark_claimed_members_under(authorities: [w_released(h: h)])
     let suspended = spark_claimed_members_under(authorities: [w_pending(h: h, stale: false)])
-    (length(live) == length(fabric_group_hosts(g: FabricGroupA)))
-      && (length(released) == 0)
-      && (length(suspended) == length(fabric_group_hosts(g: FabricGroupA)))
+    (length(released) == 0)
+      && (length(suspended) == length(fabric_group_hosts(g: FabricGroupB {})))
   })
 }
 
@@ -199,27 +197,10 @@ fn w_plan_refused(p: SparkPairApplyPlan) -> Bool {
 
 test fn the_apply_seam_refuses_a_suspended_or_absent_authority() -> Bool {
   with_w_hash(scenario: h => {
-    let r = spark_pair_realization(unit: spark_pair_serving_unit(group: FabricGroupA))
+    let r = spark_pair_realization(unit: spark_pair_serving_unit(group: FabricGroupB {}))
     w_plan_refused(p: spark_pair_apply_plan_under(r: r, authority: Present { value: w_pending(h: h, stale: false) }))
       && w_plan_refused(p: spark_pair_apply_plan_under(r: r, authority: Present { value: w_released(h: h) }))
       && w_plan_refused(p: spark_pair_apply_plan_under(r: r, authority: Present { value: w_fenced() }))
       && w_plan_refused(p: spark_pair_apply_plan_under(r: r, authority: none))
   })
 }
-
-// THE LIVE ROUTE STILL RUNS, which is what stops the three claims above from being satisfied by a seam
-// that refuses everything. This one calls the real production folds over the live authority population.
-test fn the_live_commitment_fold_still_claims_every_group_a_host() -> Bool {
-  length(spark_claimed_serving_group_members())
-    == length(fabric_group_hosts(g: FabricGroupA))
-    && all(spark_pair_serving_authorities, a => pair_serving_commits_hosts(a: a))
-}
-
-// AN UNCLAIMED GROUP HAS NO AUTHORITY AT ALL, which is the discriminating input for the lookup: a
-// lookup that ignored its argument would answer Present here too.
-test fn an_unclaimed_group_has_no_authority_row() -> Bool {
-  match pair_serving_authority_for(group: FabricGroupB) {
-    Absent => true
-    Present { value: _ } => false
-  }
-}
diff --git a/dag/test/claim/spark/pair_serving_capacity_floor_witness_test.dag b/dag/test/claim/spark/pair_serving_capacity_floor_witness_test.dag
deleted file mode 100644
index 102322ee6b0..00000000000
--- a/dag/test/claim/spark/pair_serving_capacity_floor_witness_test.dag
+++ /dev/null
@@ -1,273 +0,0 @@
-module test.claim.spark.pair_serving_capacity_floor_witness
-
-import std.types { Bool, String, Int, NonEmptyStr, List }
-import std.optional { Present, Absent }
-import std.nat { Nat }
-import std.content_hash { ContentHash, Sha256Hash, Sha256Digest, Sha256DigestHex }
-import std.measure { TokenCount, token_count, concurrent_request_hundredths, AllocatorBlockCount, allocator_block_count, allocator_block_count_value, attention_layer_count, ByteSize, byte_size }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
-import gunbc.spark.pair_serving_desired { spark_pair_serving_head }
-import gunbc.spark.vllm_serving_launch { VllmServingLaunch, vllm_serving_launch }
-import extdeps.vllm.server { vllm_source_revision_read }
-import extdeps.vllm.log_lines { VllmStartupReading, vllm_startup_reading, GpuKvCacheSize, MaximumConcurrency }
-import extdeps.vllm.kv_cache { VllmObservedKvPool, VllmKvPoolAdmission, KvPoolAdmitted, KvPoolRefused, vllm_observed_kv_pool_from_reading }
-import extdeps.vllm.kv_layout {
-  KvGroupLayout, FullAttention, ResolvedKvLayout, resolved_kv_layout,
-  VllmReportedCapacity, ReportedCapacityAdmitted, ReportedCapacityRefused, vllm_reported_capacity,
-}
-import gunbc.spark.vllm_kv_layout_observe { VllmKvLayoutReceipt, KvLayoutObserved, KvLayoutInconsistent, admit_kv_layout }
-import gunbc.harness.harness_seat { harness_interactive_quality_seats }
-import gunbc.spark.pair_serving_capacity_floor {
-  MinimumColdSessions, spark_pair_serving_minimum_cold_sessions,
-  CapacityFloorStanding, MeetsFloor, BelowFloor, FloorUnestablished, capacity_floor_standing,
-  AdmissionPosture, Admitting, Withdrawn, admission_posture,
-  DrainStanding, Quiesced, GrantsOutstanding, DrainUnobserved,
-  RestartPreconditionGap, EngineStillAdmitting, GrantsStillHeld, QuiescenceUnobserved,
-  RetryAllowanceExhausted, UnifiedMemoryPlanUnmodelled, restart_precondition_wire,
-  RestartAdmission, RestartAdmitted, RestartRefused, RetryAllowance, restart_admission,
-  ReAdmission, ReAdmitted, ReAdmissionRefused, re_admit,
-}
-
-fn w_digest(hex: String) -> ContentHash {
-  Sha256Hash(Sha256Digest { hex: hex as Sha256DigestHex })
-}
-
-data w_hex: String = "1111111111111111111111111111111111111111111111111111111111111111"
-
-fn w_inc(invocation: String) -> VllmServingLaunch {
-  vllm_serving_launch(
-    group: FabricGroupA,
-    head: spark_pair_serving_head(group: FabricGroupA),
-    systemd_invocation: invocation as NonEmptyStr,
-    container_id: "gunbc-spark-pair" as NonEmptyStr,
-    executable_digest: w_digest(hex: w_hex),
-    unit_digest: w_digest(hex: w_hex),
-    started_at: 1788000000,
-  )
-}
-
-fn w_pool_admission(tokens: Int) -> VllmKvPoolAdmission {
-  vllm_observed_kv_pool_from_reading(
-    tokens: token_count(count: tokens),
-    reading: vllm_startup_reading(line: GpuKvCacheSize, captured_text: "GPU KV cache size: n tokens" as NonEmptyStr, observed_at_revision: vllm_source_revision_read),
-  )
-}
-
-fn w_pool(tokens: Int) -> VllmObservedKvPool? {
-  match w_pool_admission(tokens: tokens) {
-    KvPoolAdmitted { pool: p } => Present { value: p }
-    KvPoolRefused { cause: _ } => none
-  }
-}
-
-data w_page_bytes: ByteSize = byte_size(count: 65536)
-
-fn w_full(layers: Nat) -> KvGroupLayout {
-  KvGroupLayout { kind: FullAttention, layer_count: attention_layer_count(count: layers), block_size: token_count(count: 16), page_size_bytes: w_page_bytes }
-}
-
-fn w_layout(blocks: Nat, groups: List<KvGroupLayout>) -> ResolvedKvLayout {
-  resolved_kv_layout(
-    allocator_blocks: allocator_block_count(count: blocks),
-    scheduler_block_size: token_count(count: 16),
-    hash_block_size: token_count(count: 16),
-    max_model_len: token_count(count: 1048576),
-    max_num_batched_tokens: token_count(count: 8192),
-    groups: groups,
-    established_at_revision: vllm_source_revision_read,
-  )
-}
-
-fn w_concurrency_reading() -> VllmStartupReading {
-  vllm_startup_reading(
-    line: MaximumConcurrency,
-    captured_text: "Maximum concurrency for 1,048,576 tokens per request: fixture" as NonEmptyStr,
-    observed_at_revision: vllm_source_revision_read,
-  )
-}
-
-fn w_reported(pool: VllmObservedKvPool, hundredths: Nat) -> VllmReportedCapacity? {
-  match vllm_reported_capacity(pool: pool, max_concurrency: concurrent_request_hundredths(count: hundredths), reading: w_concurrency_reading()) {
-    ReportedCapacityAdmitted { capacity: c } => Present { value: c }
-    ReportedCapacityRefused { cause: _ } => none
-  }
-}
-
-fn w_receipt_from(invocation: String, blocks: Nat, pool: VllmObservedKvPool) -> VllmKvLayoutReceipt? {
-  match w_reported(pool: pool, hundredths: (blocks * 16 * 100) / 1048576) {
-    Absent => none
-    Present { value: reported } =>
-      Present {
-        value: admit_kv_layout(
-          launch: w_inc(invocation: invocation),
-          layout: w_layout(blocks: blocks, groups: [w_full(layers: 1)]),
-          reported: reported,
-          source_capture_digest: w_digest(hex: w_hex),
-        )
-      }
-  }
-}
-
-test fn the_block_requirement_is_derived_from_the_declared_session_floor() -> Bool {
-  spark_pair_serving_minimum_cold_sessions.sessions == harness_interactive_quality_seats
-    && (match w_pool(tokens: 31250 * 16) {
-          Absent => false
-          Present { value: p } =>
-            match w_receipt_from(invocation: "inv-a", blocks: 31250, pool: p) {
-              Absent => false
-              Present { value: r } =>
-                match capacity_floor_standing(receipt: r, floor: spark_pair_serving_minimum_cold_sessions) {
-                  MeetsFloor { required_blocks: req, available_blocks: a } =>
-                    allocator_block_count_value(c: req) == 31250 && allocator_block_count_value(c: a) == 31250
-                  _ => false
-                }
-            }
-        })
-    && (match w_pool(tokens: 31249 * 16) {
-          Absent => false
-          Present { value: p } =>
-            match w_receipt_from(invocation: "inv-a", blocks: 31249, pool: p) {
-              Absent => false
-              Present { value: r } =>
-                match capacity_floor_standing(receipt: r, floor: spark_pair_serving_minimum_cold_sessions) {
-                  BelowFloor { required_blocks: req, available_blocks: a } =>
-                    allocator_block_count_value(c: req) == 31250 && allocator_block_count_value(c: a) == 31249
-                  _ => false
-                }
-            }
-        })
-}
-
-test fn halving_the_declared_budget_halves_the_requirement() -> Bool {
-  let half = MinimumColdSessions { maximum_sequence_tokens: token_count(count: 250000), sessions: 3 }
-  match w_pool(tokens: 93749 * 16) {
-    Absent => false
-    Present { value: p } =>
-      match w_receipt_from(invocation: "inv-a", blocks: 93749, pool: p) {
-        Absent => false
-        Present { value: r } =>
-          match capacity_floor_standing(receipt: r, floor: half) {
-            MeetsFloor { required_blocks: req, available_blocks: _ } => allocator_block_count_value(c: req) == 46875
-            _ => false
-          }
-      }
-  }
-}
-
-test fn an_unestablished_capacity_withdraws_the_engine() -> Bool {
-  match w_pool(tokens: 11767856) {
-    Absent => false
-    Present { value: p } =>
-      match w_reported(pool: p, hundredths: 1122) {
-        Absent => false
-        Present { value: reported } => {
-          let inconsistent = admit_kv_layout(
-            launch: w_inc(invocation: "inv-a"),
-            layout: w_layout(blocks: 54475, groups: []),
-            reported: reported,
-            source_capture_digest: w_digest(hex: w_hex),
-          )
-          (match capacity_floor_standing(receipt: inconsistent, floor: spark_pair_serving_minimum_cold_sessions) {
-             FloorUnestablished { cause: _ } => true
-             _ => false
-           })
-            && (match admission_posture(standing: capacity_floor_standing(receipt: inconsistent, floor: spark_pair_serving_minimum_cold_sessions)) {
-                  Withdrawn { cause: c } => string_contains(s: c as String, pattern: "rather than assumed adequate")
-                  Admitting { available_blocks: _ } => false
-                })
-        }
-      }
-  }
-}
-
-test fn a_busy_engine_below_floor_is_withdrawn_but_not_restarted() -> Bool {
-  match w_pool(tokens: 20000 * 16) {
-    Absent => false
-    Present { value: p } =>
-      match w_receipt_from(invocation: "inv-a", blocks: 20000, pool: p) {
-        Absent => false
-        Present { value: r } => {
-          let below = capacity_floor_standing(receipt: r, floor: spark_pair_serving_minimum_cold_sessions)
-          let posture = admission_posture(standing: below)
-          let allowance = RetryAllowance { attempts_used: 0, allowance: 3 }
-          (match posture { Withdrawn { cause: _ } => true  Admitting { available_blocks: _ } => false })
-            && (match restart_admission(posture: posture, drain: GrantsOutstanding { count: 2 }, retries: allowance) {
-                  RestartRefused { gap: GrantsStillHeld { count: n } } => n == 2
-                  _ => false
-                })
-            && (match restart_admission(posture: posture, drain: DrainUnobserved { cause: "the seat partition head was unreadable" as NonEmptyStr }, retries: allowance) {
-                  RestartRefused { gap: QuiescenceUnobserved { cause: _ } } => true
-                  _ => false
-                })
-        }
-      }
-  }
-}
-
-test fn an_admitting_engine_is_never_restarted() -> Bool {
-  match w_pool(tokens: 31250 * 16) {
-    Absent => false
-    Present { value: p } =>
-      match w_receipt_from(invocation: "inv-a", blocks: 31250, pool: p) {
-        Absent => false
-        Present { value: r } => {
-          let meets = capacity_floor_standing(receipt: r, floor: spark_pair_serving_minimum_cold_sessions)
-          match restart_admission(posture: admission_posture(standing: meets), drain: Quiesced, retries: RetryAllowance { attempts_used: 0, allowance: 3 }) {
-            RestartRefused { gap: EngineStillAdmitting } => true
-            _ => false
-          }
-        }
-      }
-  }
-}
-
-test fn a_drained_withdrawn_engine_still_refuses_restart_naming_the_missing_memory_plan() -> Bool {
-  match w_pool(tokens: 20000 * 16) {
-    Absent => false
-    Present { value: p } =>
-      match w_receipt_from(invocation: "inv-a", blocks: 20000, pool: p) {
-        Absent => false
-        Present { value: r } => {
-          let below = capacity_floor_standing(receipt: r, floor: spark_pair_serving_minimum_cold_sessions)
-          let posture = admission_posture(standing: below)
-          (match restart_admission(posture: posture, drain: Quiesced, retries: RetryAllowance { attempts_used: 0, allowance: 3 }) {
-             RestartRefused { gap: UnifiedMemoryPlanUnmodelled } => true
-             _ => false
-           })
-            && (match restart_admission(posture: posture, drain: Quiesced, retries: RetryAllowance { attempts_used: 3, allowance: 3 }) {
-                  RestartRefused { gap: RetryAllowanceExhausted { used: u, allowance: a } } => u == 3 && a == 3
-                  _ => false
-                })
-            && string_contains(s: restart_precondition_wire(g: UnifiedMemoryPlanUnmodelled), pattern: "23.6 GiB")
-        }
-      }
-  }
-}
-
-test fn re_admission_is_decided_by_the_new_receipt_not_by_the_restart_having_happened() -> Bool {
-  match w_pool(tokens: 20000 * 16) {
-    Absent => false
-    Present { value: short_pool } =>
-      match w_pool(tokens: 31250 * 16) {
-        Absent => false
-        Present { value: ok_pool } =>
-          match w_receipt_from(invocation: "inv-b", blocks: 20000, pool: short_pool) {
-            Absent => false
-            Present { value: short_r } =>
-              match w_receipt_from(invocation: "inv-b", blocks: 31250, pool: ok_pool) {
-                Absent => false
-                Present { value: ok_r } =>
-                  (match re_admit(fresh: short_r, floor: spark_pair_serving_minimum_cold_sessions) {
-                     ReAdmissionRefused { cause: c } => string_contains(s: c as String, pattern: "still below the floor")
-                     ReAdmitted { launch: _, available_blocks: _ } => false
-                   })
-                    && (match re_admit(fresh: ok_r, floor: spark_pair_serving_minimum_cold_sessions) {
-                          ReAdmitted { launch: _, available_blocks: a } => allocator_block_count_value(c: a) == 31250
-                          ReAdmissionRefused { cause: _ } => false
-                        })
-              }
-          }
-      }
-  }
-}
-
diff --git a/dag/test/claim/spark/pair_serving_d0_authorization_witness_test.dag b/dag/test/claim/spark/pair_serving_d0_authorization_witness_test.dag
deleted file mode 100644
index 16380e39aac..00000000000
--- a/dag/test/claim/spark/pair_serving_d0_authorization_witness_test.dag
+++ /dev/null
@@ -1,182 +0,0 @@
-module test.claim.spark.pair_serving_d0_authorization_witness
-
-import std.logic { Bool }
-import std.types { String, NonEmptyStr, List, Timestamp }
-import std.optional { Present, Absent }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest, serialize_content_hash }
-import std.scoped_authorization { AuthorizationRequest, AuthorizationGranted }
-import gunbc.auth.approval_decision_store { request_revision_of }
-import gunbc.auth.approval_request_client { PollApproved, PollNotFiled, PollStillPending, PollDenied }
-import gunbc.auth.approval_gate { StandingReadAt, StandingClockUnreadable, ApprovalDenied }
-import gunbc.spark.pair_serving_d0_door { d0_absent_claim_step, D0AbsentClaimClockUnreadable, D0AbsentClaimFileFrozen, D0AbsentClaimEnterPoll, D0AbsentClaimDecided, pair_serving_d0_mode_admission, D0ModeAdmitted, D0ModeRefused }
-import gunbc.spark.fabric_switch_observed { fabric_group_wire }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
-import std.measure { second }
-import gunbc.spark.fabric_switch_observed { fabric_group_hosts }
-import gunbc.spark.released_baseline { QuiescentReservedBaseline }
-import gunbc.spark.pair_serving_d0 {
-  D0SuspendForSuccessor, RankVacancyReading, D0Subject, d0_request, d0_intent_text, d0_intent_hash, d0_frozen_filing_text, parse_d0_frozen_filing }
-import gunbc.spark.v41_runtime_candidate { V41CandidateStanding, V41CandidateRefused, V41CandidateUnestablished, V41CandidateKeyed, V41DerivationEvidence }
-import gunbc.spark.v41_engram_row_store { V41StoreReadbackUnread, V41StoreReadbackVerified }
-import std.content_hash { content_hash_atom, Fnv1a64 }
-import gunbc.spark.pair_serving_d0_authorization {
-  D0SubjectFor, D0SubjectUnestablished, D0SubjectRefused, d0_live_subject, d0_subject_of_candidate,
-  D0FiledRequestFor, D0FiledRequestRefused, d0_filed_request,
-  d0_resumable_authorization, D0Resumable, D0NotRecorded, D0NotClaimedHere,
-}
-import gunbc.spark.pair_serving_d0 { D0ClaimAbsent, D0ClaimAt }
-import std.scoped_authorization { ClaimedBy, CompletedBy, AttemptIdentity }
-import gunbc.auth.approval_gate { approval_gate_from_poll, approval_recorded_from_poll, ApprovalRecorded, ApprovalNotRecorded, GateAdmitted, GateRefused, ApprovalAuthorizeRefused, ApprovalIntentMismatch }
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-fn w_sha(hex: String) -> ContentHash? {
-  match sha256_hex_digest(hex: hex) { Absent => none  Present { value: d } => Present { value: Sha256Hash(d) } }
-}
-
-fn w_request(intent: ContentHash) -> AuthorizationRequest<D0Subject> {
-  d0_request(escalation_id: "d0-esc-1" as NonEmptyStr, subject: D0Subject { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), operation: D0SuspendForSuccessor { successor: intent, cleanup: QuiescentReservedBaseline, term: second(count: 1000) } }, transaction: "tx-1" as NonEmptyStr, intent: intent)
-}
-
-// THE LIVE SUBJECT FOLLOWS THE CANDIDATE AND ITS DERIVATION EVIDENCE: the candidate is keyed, and until
-// the boundary-stratified readback of the produced row stores is transcribed there is no subject and the
-// obligation is the readback's own; once it is verified the keyed candidate is the successor. The claim is
-// exhaustive over both so it flips, rather than rots, when the readback lands.
-test fn the_live_subject_exists_exactly_when_the_candidate_is_keyed_and_read_back() -> Bool {
-  let live = match d0_live_subject(group: FabricGroupA) {
-    D0SubjectUnestablished { obligations: o } => length(o) >= 1 && any(o, x => (x as String).contains("read back"))
-    D0SubjectFor { subject: s } => length(s.hosts) == 4
-    D0SubjectRefused { defects: _ } => false
-  }
-  let refused = match d0_subject_of_candidate(group: FabricGroupA, standing: V41CandidateRefused { defects: ["weight manifest: path declared more than once" as NonEmptyStr] }, derivation: w_read_back()) { D0SubjectRefused { defects: d } => length(d) == 1  _ => false }
-  let pending = match d0_subject_of_candidate(group: FabricGroupA, standing: V41CandidateUnestablished { obligations: ["row-store digest" as NonEmptyStr] }, derivation: w_read_back()) { D0SubjectUnestablished { obligations: o } => length(o) == 1  _ => false }
-  live && refused && pending
-}
-
-fn w_keyed() -> V41CandidateStanding {
-  V41CandidateKeyed {
-    runtime_artifact: Fnv1a64(content_hash_atom(value: "runtime" as NonEmptyStr)), model_source: Fnv1a64(content_hash_atom(value: "source" as NonEmptyStr)),
-    engram_realization: Fnv1a64(content_hash_atom(value: "engram" as NonEmptyStr)), execution_profile: Fnv1a64(content_hash_atom(value: "profile" as NonEmptyStr)),
-    candidate: Fnv1a64(content_hash_atom(value: "candidate" as NonEmptyStr)), authorization_obligation: "an experiment authorization" as NonEmptyStr,
-  }
-}
-
-fn w_read_back() -> V41DerivationEvidence {
-  V41DerivationEvidence { row_store_readback: V41StoreReadbackVerified { host: "srv5" as NonEmptyStr, observed_at: "fixture" as NonEmptyStr, samples: 40 } }
-}
-
-// A KEYED CANDIDATE WHOSE STORES WERE NOT READ BACK CANNOT BE AUTHORIZED (proud-deer-538, 2026-09-24): the
-// same keyed standing that is a subject once its readback is verified is no subject while it is unread, and
-// the refusal names the readback's obligation. The derivation is an input, so no caller reaches a consent
-// by forgetting to look.
-test fn a_keyed_candidate_with_an_unread_readback_cannot_be_authorized() -> Bool {
-  let unread = V41DerivationEvidence { row_store_readback: V41StoreReadbackUnread { obligation: "the stores have not been read back" as NonEmptyStr } }
-  let blocked = match d0_subject_of_candidate(group: FabricGroupA, standing: w_keyed(), derivation: unread) {
-    D0SubjectUnestablished { obligations: o } => length(o) == 1 && any(o, x => (x as String) == "the stores have not been read back")
-    _ => false
-  }
-  let admitted = match d0_subject_of_candidate(group: FabricGroupA, standing: w_keyed(), derivation: w_read_back()) {
-    D0SubjectFor { subject: s } => length(s.hosts) == 4
-    _ => false
-  }
-  blocked && admitted
-}
-
-// THE FILED REQUEST IS THE FROZEN TEXT, EXACTLY, AND THE EXECUTABLE THAT FILED IT. The intent
-// text a live request is frozen as, with the execution revision as its last line, parses back to
-// the same subject and digests to the same revision, so a rerun re-derives the request the
-// operator decided over; the same filing under another transaction, another executing revision,
-// or an intent frozen without its revision, is refused rather than resumed.
-test fn a_frozen_intent_re_derives_the_filed_request_and_refuses_another_transaction() -> Bool {
-  match w_sha(hex: "1111111111111111111111111111111111111111111111111111111111111111") {
-    Absent => false
-    Present { value: successor } => {
-      let subject = D0Subject { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), operation: D0SuspendForSuccessor { successor: successor, cleanup: QuiescentReservedBaseline, term: second(count: 1000) } }
-      let intent = (match d0_intent_text(subject: subject, group: FabricGroupA, transaction: "tx-1" as NonEmptyStr) { Present { value: intent_text_w } => intent_text_w  Absent => "d0-intent-refused" })
-      let text = d0_frozen_filing_text(intent_text: intent, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr)
-      let round_trip = match parse_d0_frozen_filing(text: text) { Present { value: f } => f.intent_text == intent && (f.execution_revision as String) == "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"  Absent => false }
-      let other_revision = match d0_filed_request(text: text, group: FabricGroupA, escalation_id: "d0-esc-1" as NonEmptyStr, transaction: "tx-1" as NonEmptyStr, execution_revision: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" as NonEmptyStr) { D0FiledRequestRefused { reason: r } => (r as String).contains("filed by revision aaaa")  _ => false }
-      let same = match d0_filed_request(text: text, group: FabricGroupA, escalation_id: "d0-esc-1" as NonEmptyStr, transaction: "tx-1" as NonEmptyStr, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) {
-        D0FiledRequestFor { request: r, intent_text: t } =>
-          t == intent
-            && (match d0_intent_hash(subject: subject, group: FabricGroupA, transaction: "tx-1" as NonEmptyStr) { Present { value: h } => (request_revision_of(request: r) as String) == (serialize_content_hash(hash: h) as String)  Absent => false })
-            && length(r.subject.hosts) == 4
-            && (r.escalation_id as String) == "d0-esc-1"
-        D0FiledRequestRefused { reason: _ } => false
-      }
-      let other_tx = match d0_filed_request(text: text, group: FabricGroupA, escalation_id: "d0-esc-1" as NonEmptyStr, transaction: "tx-2" as NonEmptyStr, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) { D0FiledRequestRefused { reason: r } => (r as String).contains("tx-1")  _ => false }
-      let garbage = match d0_filed_request(text: "not an intent", group: FabricGroupA, escalation_id: "d0-esc-1" as NonEmptyStr, transaction: "tx-1" as NonEmptyStr, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) { D0FiledRequestRefused { reason: _ } => true  _ => false }
-      let edited = match d0_filed_request(text: join([text, "x"], ""), group: FabricGroupA, escalation_id: "d0-esc-1" as NonEmptyStr, transaction: "tx-1" as NonEmptyStr, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) { D0FiledRequestRefused { reason: _ } => true  D0FiledRequestFor { request: _, intent_text: _ } => false }
-      let unfrozen = match d0_filed_request(text: intent, group: FabricGroupA, escalation_id: "d0-esc-1" as NonEmptyStr, transaction: "tx-1" as NonEmptyStr, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) { D0FiledRequestRefused { reason: _ } => true  _ => false }
-      round_trip && other_revision && same && other_tx && garbage && edited && unfrozen
-    }
-  }
-}
-
-// A RECORDED APPROVAL IS NOT AN ADMISSION: the same approved decision that the live gate refuses
-// after execute_by is handed back as recorded by its own constructor, and D0 turns it into a
-// resumable authorization ONLY against a claim held by this transaction -- an absent claim (a
-// start), another attempt's claim and a completed claim each refuse without consulting the
-// decision's window. An approval over another revision is a mismatch under either fold.
-test fn a_recorded_approval_resumes_only_under_this_transactions_held_claim() -> Bool {
-  match w_sha(hex: "1111111111111111111111111111111111111111111111111111111111111111") {
-    Absent => false
-    Present { value: intent } => {
-      let req = w_request(intent: intent)
-      let rev = request_revision_of(request: req)
-      let at = "2026-09-21T02:00:00Z" as Timestamp
-      let until = "2026-09-21T03:00:00Z" as Timestamp
-      let approved = PollApproved { revision: rev, decided_by: "operator" as NonEmptyStr, decided_at: at, execute_by: until }
-      let held = D0ClaimAt { state: ClaimedBy { attempt: "tx-1" as AttemptIdentity, claimed_at: at }, generation: 1 }
-      let other = D0ClaimAt { state: ClaimedBy { attempt: "tx-9" as AttemptIdentity, claimed_at: at }, generation: 1 }
-      let done = D0ClaimAt { state: CompletedBy { attempt: "tx-1" as AttemptIdentity, completed_at: at }, generation: 2 }
-      (match approval_gate_from_poll(poll: approved, request: req, observed_at: "2026-09-21T04:00:00Z" as Timestamp) { GateRefused { cause: ApprovalAuthorizeRefused { detail: _ } } => true  _ => false })
-        && (match approval_recorded_from_poll(poll: approved, request: req) { ApprovalRecorded { authorization: AuthorizationGranted { grant: g, claim: _ } } => (g.escalation_id as String) == "d0-esc-1"  _ => false })
-        && (match d0_resumable_authorization(claim: held, transaction: "tx-1" as NonEmptyStr, poll: approved, request: req) { D0Resumable { authorization: _ } => true  _ => false })
-        && (match d0_resumable_authorization(claim: D0ClaimAbsent, transaction: "tx-1" as NonEmptyStr, poll: approved, request: req) { D0NotClaimedHere { reason: _ } => true  _ => false })
-        && (match d0_resumable_authorization(claim: other, transaction: "tx-1" as NonEmptyStr, poll: approved, request: req) { D0NotClaimedHere { reason: r } => (r as String).contains("tx-9")  _ => false })
-        && (match d0_resumable_authorization(claim: done, transaction: "tx-1" as NonEmptyStr, poll: approved, request: req) { D0NotClaimedHere { reason: _ } => true  _ => false })
-        && (match d0_resumable_authorization(claim: held, transaction: "tx-1" as NonEmptyStr, poll: PollApproved { revision: "sha256:0000" as NonEmptyStr, decided_by: "operator" as NonEmptyStr, decided_at: at, execute_by: until }, request: req) { D0NotRecorded { cause: ApprovalIntentMismatch { requested_revision: _, decided_revision: _ } } => true  _ => false })
-    }
-  }
-}
-
-// THE DOOR'S STEP FOR A FROZEN FILING WITH NO CLAIM: not filed files the frozen request, pending
-// enters the poll, a decision goes through the live gate at the instant of the read (an approval
-// inside its window admits; a denial refuses), and an unreadable clock refuses before any of it.
-test fn a_frozen_filing_with_no_claim_files_polls_or_decides_live_by_the_read() -> Bool {
-  match w_sha(hex: "1111111111111111111111111111111111111111111111111111111111111111") {
-    Absent => false
-    Present { value: intent } => {
-      let req = w_request(intent: intent)
-      let rev = request_revision_of(request: req)
-      let at = "2026-09-21T02:00:00Z" as Timestamp
-      let until = "2026-09-21T03:00:00Z" as Timestamp
-      (match d0_absent_claim_step(read: StandingReadAt { standing: PollNotFiled, observed_at: at }, request: req) { D0AbsentClaimFileFrozen => true  _ => false })
-        && (match d0_absent_claim_step(read: StandingReadAt { standing: PollStillPending, observed_at: at }, request: req) { D0AbsentClaimEnterPoll => true  _ => false })
-        && (match d0_absent_claim_step(read: StandingReadAt { standing: PollApproved { revision: rev, decided_by: "operator" as NonEmptyStr, decided_at: at, execute_by: until }, observed_at: "2026-09-21T02:30:00Z" as Timestamp }, request: req) { D0AbsentClaimDecided { gate: GateAdmitted { authorization: _ } } => true  _ => false })
-        && (match d0_absent_claim_step(read: StandingReadAt { standing: PollApproved { revision: rev, decided_by: "operator" as NonEmptyStr, decided_at: at, execute_by: until }, observed_at: "2026-09-21T04:00:00Z" as Timestamp }, request: req) { D0AbsentClaimDecided { gate: GateRefused { cause: ApprovalAuthorizeRefused { detail: _ } } } => true  _ => false })
-        && (match d0_absent_claim_step(read: StandingReadAt { standing: PollDenied { revision: rev, decided_by: "operator" as NonEmptyStr, decided_at: at, reason: "no" as NonEmptyStr }, observed_at: at }, request: req) { D0AbsentClaimDecided { gate: GateRefused { cause: ApprovalDenied { reason: _ } } } => true  _ => false })
-        && (match d0_absent_claim_step(read: StandingClockUnreadable, request: req) { D0AbsentClaimClockUnreadable => true  _ => false })
-    }
-  }
-}
-
-// THE MODE'S ADMISSION IS PURE AND CARRIES THE LOWER DOOR'S EXACT ARGUMENTS: srv1 declared and
-// srv1 running, a consent and a revision admit Group A with transaction = authorization = the
-// consent and the revision as given; there is no way to name Group B; another declared host, a
-// kernel host that is not srv1 under a declared srv1, a blank consent, a blank revision, and a
-// revision that is not the checked-out tree's HEAD each refuse.
-test fn the_mode_admits_only_srv1_group_a_and_a_named_consent_and_revision() -> Bool {
-  let rev = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-  (match pair_serving_d0_mode_admission(declared_host: "srv1", kernel_host: "srv1", consent: "d0-esc-1", execution_revision: rev, checked_out_revision: rev) {
-    D0ModeAdmitted { group: g, transaction: tx, authorization: a, execution_revision: r } => (fabric_group_wire(g: g) as String) == "group-a" && (tx as String) == "d0-esc-1" && (a as String) == "d0-esc-1" && (r as String) == rev
-    D0ModeRefused { reason: _ } => false
-  })
-    && (match pair_serving_d0_mode_admission(declared_host: "srv2", kernel_host: "srv2", consent: "d0-esc-1", execution_revision: rev, checked_out_revision: rev) { D0ModeRefused { reason: r } => r.contains("srv2")  _ => false })
-    && (match pair_serving_d0_mode_admission(declared_host: "srv1", kernel_host: "srv2", consent: "d0-esc-1", execution_revision: rev, checked_out_revision: rev) { D0ModeRefused { reason: r } => r.contains("runs on srv2")  _ => false })
-    && (match pair_serving_d0_mode_admission(declared_host: "srv1", kernel_host: "srv1", consent: "", execution_revision: rev, checked_out_revision: rev) { D0ModeRefused { reason: r } => r.contains("GUNBC_D0_CONSENT")  _ => false })
-    && (match pair_serving_d0_mode_admission(declared_host: "srv1", kernel_host: "srv1", consent: "d0-esc-1", execution_revision: "", checked_out_revision: rev) { D0ModeRefused { reason: r } => r.contains("expected_revision")  _ => false })
-    && (match pair_serving_d0_mode_admission(declared_host: "srv1", kernel_host: "srv1", consent: "d0-esc-1", execution_revision: rev, checked_out_revision: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb") { D0ModeRefused { reason: r } => r.contains("not the tree this job runs from")  _ => false })
-}
diff --git a/dag/test/claim/spark/pair_serving_d0_front_door_real_execution_witness_test.dag b/dag/test/claim/spark/pair_serving_d0_front_door_real_execution_witness_test.dag
deleted file mode 100644
index dc34c7a2e00..00000000000
--- a/dag/test/claim/spark/pair_serving_d0_front_door_real_execution_witness_test.dag
+++ /dev/null
@@ -1,418 +0,0 @@
-module test.claim.spark.pair_serving_d0_front_door_real_execution
-
-import std.logic { Bool }
-import std.types { String, NonEmptyStr, FilePath, List, Int, Port }
-import std.optional { Present, Absent }
-import std.measure { second }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import extdeps.shell
-import extdeps.python
-import extdeps.filesystem.filesystem_io { Filesystem }
-import std.algebra { trim }
-import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest }
-
-import gunbc.fabric_storage_client { FabricStorageBinding, FabricStorageLocalFiles }
-import gunbc.fabric_storage_file_store { fabric_storage_file_root, fabric_storage_file_root_ensure, FabricStorageRootReady }
-import gunbc.serving.serving_enrollment { ServingRouteEndpoint }
-import gunbc.harness.harness_backend { HarnessBoundedPresence, HarnessResponded, HarnessConnectFailed, HarnessDeadline, HarnessTransportUnread, harness_bounded_presence, harness_models_url }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA }
-import gunbc.spark.pair_serving_authority { FencedRefusal, pair_serving_authority_for }
-import gunbc.spark.serving_incarnation_observe { UnitInstalled, EndpointListenerReading, EndpointNoListener, EndpointListening, EndpointListenerUnread, read_endpoint_listener }
-import gunbc.host_effect { LocalShell }
-import gunbc.spark.pair_incumbent_identity { DeclaredPairRealizationKeyed, DeclaredPairRealizationUnavailable, declared_pair_realization }
-import gunbc.spark.pair_serving_authority_log { CurrentAuthorityRead, CurrentAuthorityUnread, current_pair_serving_authority, AuthorityTransitionAppended, pair_serving_authority_transition, AuthorityEstablishedAt, AuthorityEstablishmentRefused, pair_serving_authority_establish }
-import gunbc.spark.pair_serving_d0 {
-  D0SuspendForSuccessor, RankVacancyReading,
-  FrontDoorReading, FrontDoorNoStatus, FrontDoorAnsweredUnread, FrontDoorUnread, FrontDoorAnswered, observe_front_door, front_door_as_incumbent,
-  IncumbentReading, IncumbentAnsweredUnread, IncumbentDidNotAnswer, IncumbentRouteUnread, D0Observation, RankOccupancyReading,
-  HeadEndpointReading, HeadEndpointQuiet, HeadEndpointListening, HeadEndpointUnread,
-  D0Outcome, D0Settled, D0Decision, D0DecidedFence, D0DecidedSuspend, D0Cause, D0IncumbentUnidentified, D0OccupancyUnread, DeclaredOccupantDrifted, d0_transaction,
-  AdmittedD0Grant, D0GrantAdmitted, admit_d0_grant, D0Subject, d0_intent_hash, d0_authorized_action,
-}
-import std.scoped_authorization { OperatorGrant, ScopedAuthorization, AuthorizationGranted, Unclaimed, AuthorizationScope, AttemptIdentity }
-import std.effect_grant { Write, NamespacePosition, CodeNameTree }
-import gunbc.spark.released_baseline { QuiescentReservedBaseline }
-import gunbc.spark.fabric_switch_observed { fabric_group_hosts }
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-// THE HTTP-STATUS DISTINCTION AT ITS PRODUCTION INTERFACE, BY REAL EXECUTION. The D0 decision has
-// hermetic controls over a SUPPLIED IncumbentAnsweredUnread; what none of them can notice is the
-// transport regaining curl's -f, or the %{http_code} binding drifting, after which a 500 would read
-// as silence again and the supplied-arm claims would stay green. So a local listener that answers
-// one chosen status is started, the real http.Client.StatusWithin is run against it through
-// harness_bounded_presence and observe_front_door, and the reading is carried through the real
-// transaction to FencedRefusal on the log. The listener is CPython's http.server, forked into the
-// background by the fixture below, which prints the port and pid; it is killed at the end of the
-// scenario and exits by itself after a bounded lifetime if the kill never comes.
-
-data d0fd_listener_fixture: String = "import http.server, os, socketserver, sys, threading, time\nstatus = int(sys.argv[1]) if sys.argv[1] != 'hang' else 0\nlifetime = float(sys.argv[2])\nclass H(http.server.BaseHTTPRequestHandler):\n    def do_GET(self):\n        if status == 0:\n            time.sleep(lifetime)\n            return\n        self.send_response(status)\n        self.send_header('Content-Length', '0')\n        self.end_headers()\n    def log_message(self, *a):\n        pass\nsocketserver.TCPServer.allow_reuse_address = True\nsrv = socketserver.TCPServer(('127.0.0.1', 0), H)\nport = srv.server_address[1]\npid = os.fork()\nif pid:\n    sys.stdout.write('%d %d\\n' % (port, pid))\n    sys.stdout.flush()\n    os._exit(0)\nos.setsid()\nnull = os.open(os.devnull, os.O_RDWR)\nos.dup2(null, 0)\nos.dup2(null, 1)\nos.dup2(null, 2)\nthreading.Thread(target=srv.serve_forever, daemon=True).start()\ntime.sleep(lifetime)\nos._exit(0)\n"
-
-data d0fd_kill_fixture: String = "import os, signal, sys\nos.kill(int(sys.argv[1]), signal.SIGTERM)\n"
-
-type D0fdListener {
-  port: Int
-  pid: Int
-}
-
-fn d0fd_with_temp_dir(scenario: fn(FilePath) -> Bool) -> Bool {
-  let dir = shell.Mktemp.Dir()
-  let observed = scenario(dir.path)
-  let cleaned = shell.Remove.RecursiveForce(path: dir.path)
-  dir.success && observed && cleaned.success
-}
-
-fn d0fd_parse_listener(out: String) -> D0fdListener? {
-  let parts = split(s: trim(s: out), delimiter: " ")
-  match get(xs: parts, index: 0) {
-    Absent => none
-    Present { value: p } =>
-      match get(xs: parts, index: 1) {
-        Absent => none
-        Present { value: q } =>
-          match parse_int(s: p) {
-            Absent => none
-            Present { value: port } =>
-              match parse_int(s: q) {
-                Absent => none
-                Present { value: pid } => Present { value: D0fdListener { port: port, pid: pid } }
-              }
-          }
-      }
-  }
-}
-
-// A listener answering `status` for the scenario, killed afterwards whatever the scenario says.
-fn d0fd_with_listener(dir: FilePath, status: String, scenario: fn(D0fdListener) -> Bool) -> Bool {
-  let script = join([dir as String, "/listener.py"], "")
-  let kill = join([dir as String, "/kill.py"], "")
-  let w1 = Filesystem.Write(path: script, content: d0fd_listener_fixture)
-  let w2 = Filesystem.Write(path: kill, content: d0fd_kill_fixture)
-  if !w1.success || !w2.success { false } else {
-    let run = python.Interpreter.RunFile(workdir: dir, script_path: script as FilePath, args: [status, "60"])
-    if !run.success { false } else {
-      match d0fd_parse_listener(out: run.stdout) {
-        Absent => false
-        Present { value: l } => {
-          let observed = scenario(l)
-          let killed = python.Interpreter.RunFile(workdir: dir, script_path: kill as FilePath, args: [to_string(l.pid)])
-          observed && killed.success
-        }
-      }
-    }
-  }
-}
-
-fn d0fd_port(n: Int) -> Port {
-  n
-}
-
-fn d0fd_endpoint(port: Int) -> ServingRouteEndpoint {
-  d0fd_endpoint_at(address: "127.0.0.1", port: port)
-}
-
-fn d0fd_endpoint_at(address: String, port: Int) -> ServingRouteEndpoint {
-  ServingRouteEndpoint { group: FabricGroupA, address: address as NonEmptyStr, port: d0fd_port(n: port) }
-}
-
-// The head's endpoint reading over the LOCAL host: the kernel's socket tables for a LISTEN on
-// the port. (The engine-process scan half runs over the fleet ssh leg and is not driven here.)
-fn d0fd_head_endpoint(port: Int) -> HeadEndpointReading {
-  match read_endpoint_listener(transport: LocalShell, port: d0fd_port(n: port)) {
-    EndpointNoListener { port: _ } => HeadEndpointQuiet
-    EndpointListening { port: p, rows: rs } => HeadEndpointListening { port: p, rows: rs }
-    EndpointListenerUnread { port: _, cause: c } => HeadEndpointUnread { cause: c as NonEmptyStr }
-  }
-}
-
-fn d0fd_status_is(p: HarnessBoundedPresence, status: String) -> Bool {
-  match p {
-    HarnessResponded { status: s } => s == status
-    _ => false
-  }
-}
-
-// 500 and 401 are ANSWERS -- the transport reports the status, the front door reads as answered
-// and unread, and the incumbent reading fences. No listener (the port just vacated) is SILENCE:
-// no HTTP response, the front door reads silent, and the incumbent reading is absence.
-test fn an_error_status_is_an_answer_and_no_listener_is_silence_by_real_execution() -> Bool {
-  d0fd_with_temp_dir(scenario: fn(dir) {
-    d0fd_with_listener(dir: dir, status: "500", scenario: fn(l) {
-      d0fd_status_is(p: harness_bounded_presence(url: harness_models_url(endpoint: d0fd_endpoint(port: l.port))), status: "500")
-        && (match observe_front_door(endpoint: d0fd_endpoint(port: l.port)) { FrontDoorAnsweredUnread { cause: c } => (c as String).contains("HTTP 500")  _ => false })
-        && (match front_door_as_incumbent(r: observe_front_door(endpoint: d0fd_endpoint(port: l.port)), head: fn() { HeadEndpointQuiet }) { Present { value: IncumbentAnsweredUnread { cause: _ } } => true  _ => false })
-    })
-      && d0fd_with_listener(dir: dir, status: "401", scenario: fn(l) {
-        d0fd_status_is(p: harness_bounded_presence(url: harness_models_url(endpoint: d0fd_endpoint(port: l.port))), status: "401")
-          && (match observe_front_door(endpoint: d0fd_endpoint(port: l.port)) { FrontDoorAnsweredUnread { cause: _ } => true  _ => false })
-      })
-      && d0fd_with_listener(dir: dir, status: "200", scenario: fn(l) {
-        d0fd_status_is(p: harness_bounded_presence(url: harness_models_url(endpoint: d0fd_endpoint(port: l.port))), status: "200")
-          && (match observe_front_door(endpoint: d0fd_endpoint(port: l.port)) { FrontDoorAnswered => true  _ => false })
-          && (match front_door_as_incumbent(r: FrontDoorAnswered, head: fn() { HeadEndpointQuiet }) { Absent => true  Present { value: _ } => false })
-      })
-  })
-}
-
-// NO STATUS IS SILENCE, AND SILENCE DEFERS TO THE HEAD. A front door that could not be connected
-// reads as an incumbent that did not answer, carrying the head reading for the transaction to
-// corroborate. The reading is SUPPLIED: a claim that manufactured it by killing a listener and
-// asserting the port vacant depended on a host premise it never observed (signal delivery is
-// asynchronous) and went red on srv4-15, merge-group run 36575660396. The real failed-connect route
-// is executed, keyed to its own subject rather than to a vacated port, by
-// a_listener_behind_a_failed_connect_is_read_on_the_host_and_fences_by_real_execution below,
-// which asserts observe_front_door reads FrontDoorNoStatus at an address where nothing accepts.
-test fn a_front_door_with_no_status_reads_as_an_incumbent_that_did_not_answer() -> Bool {
-  let receipt = "witness: the front door could not be connected" as NonEmptyStr
-  (match front_door_as_incumbent(r: FrontDoorNoStatus { receipt: receipt }, head: fn() { HeadEndpointQuiet }) { Present { value: IncumbentDidNotAnswer { receipt: _, head: HeadEndpointQuiet } } => true  _ => false })
-    && (match front_door_as_incumbent(r: FrontDoorNoStatus { receipt: receipt }, head: fn() { HeadEndpointUnread { cause: "witness: head unread" as NonEmptyStr } }) { Present { value: IncumbentDidNotAnswer { receipt: _, head: HeadEndpointUnread { cause: _ } } } => true  _ => false })
-}
-
-// A LISTENER THAT ACCEPTS AND NEVER ANSWERS IS NOT ABSENCE. The fixture in `hang` mode accepts the
-// connection and writes no status line; after the front-door bound curl exits 28, the presence
-// reading is AcceptedNoAnswer, the front door is Unread, the incumbent reading is RouteUnread --
-// and through the transaction the group is FENCED at generation 2, never suspended as absent.
-test fn a_listener_that_accepts_and_never_answers_fences_rather_than_reading_as_absent_by_real_execution() -> Bool {
-  d0fd_with_hash(scenario: fn(h) {
-    d0fd_with_temp_dir(scenario: fn(dir) {
-      let store = d0fd_witness_layout(dir: dir)
-      d0fd_witness_remote_ready(dir: dir)
-        && d0fd_with_listener(dir: dir, status: "hang", scenario: fn(l) {
-          (match harness_bounded_presence(url: harness_models_url(endpoint: d0fd_endpoint(port: l.port))) { HarnessDeadline { url: _ } => true  _ => false })
-            && (match front_door_as_incumbent(r: observe_front_door(endpoint: d0fd_endpoint(port: l.port)), head: fn() { HeadEndpointQuiet }) { Present { value: IncumbentRouteUnread { cause: _ } } => true  _ => false })
-            && (match d0fd_w_admitted(store: store, successor: h) {
-                  Absent => false
-                  Present { value: admitted } =>
-                    (match d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: admitted, transaction: "tx-front-door" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-18T00:00:00Z",
-                           observe: fn(g) {
-                             D0Observation {
-                               group: g,
-                               incumbent: match front_door_as_incumbent(r: observe_front_door(endpoint: d0fd_endpoint(port: l.port)), head: fn() { HeadEndpointQuiet }) {
-                                 Present { value: r } => r
-                                 Absent => IncumbentDidNotAnswer { receipt: "witness: the front door answered 2xx, which this fixture does not" as NonEmptyStr, head: HeadEndpointQuiet }
-                               },
-                               ranks: [] as List<RankOccupancyReading>, vacancy: [] as List<RankVacancyReading>,
-                             }
-                           }) {
-                       D0Settled { decision: D0DecidedFence { next: _, cause: D0OccupancyUnread { cause: _ } }, generation: g2, receipt_path: _, entry_state: _ } => g2 == 2
-                       _ => false
-                     })
-                })
-        })
-    })
-  })
-}
-
-// A PORT VACATED BY CONSTRUCTION. The fixture listens on 127.0.0.1:0 and closes the socket in its
-// own process before printing the port: close() on a listening socket removes it from the socket
-// tables synchronously, so the port is vacated when it is handed back. The earlier fixture sent
-// SIGTERM to a forked listener and returned the port without observing the exit; signal delivery
-// is asynchronous, and on srv4-15 (merge-group run 36575660396) the "vacated" port still answered.
-data d0fd_vacated_fixture: String = "import socket, sys\ns = socket.socket()\ns.bind(('127.0.0.1', 0))\ns.listen()\nport = s.getsockname()[1]\ns.close()\nsys.stdout.write('%d\\n' % port)\n"
-
-fn d0fd_vacated_port(dir: FilePath) -> Int? {
-  let script = join([dir as String, "/vacated.py"], "")
-  let w = Filesystem.Write(path: script, content: d0fd_vacated_fixture)
-  if !w.success { none } else {
-    let run = python.Interpreter.RunFile(workdir: dir, script_path: script as FilePath, args: [] as List<String>)
-    if !run.success { none } else { parse_int(s: trim(s: run.stdout)) }
-  }
-}
-
-// ── THROUGH THE TRANSACTION TO THE LOG ─────────────────────────────────────────────────────────
-
-fn d0fd_witness_layout(dir: FilePath) -> FabricStorageBinding {
-  FabricStorageLocalFiles { root: fabric_storage_file_root(root: join([dir as String, "/fabric-storage"], "") as NonEmptyStr) }
-}
-
-// A ready remote has group A's source row ESTABLISHED on its partition (the log's durable
-// genesis) at 990, before any scenario event.
-fn d0fd_witness_remote_ready(dir: FilePath) -> Bool {
-  (match fabric_storage_file_root_ensure(root: fabric_storage_file_root(root: join([dir as String, "/fabric-storage"], "") as NonEmptyStr)) { FabricStorageRootReady => true  _ => false })
-    && (match pair_serving_authority_for(group: FabricGroupA) {
-          Absent => false
-          Present { value: desired } =>
-            match pair_serving_authority_establish(store: d0fd_witness_layout(dir: dir), group: FabricGroupA, authority: desired, actor: "witness" as NonEmptyStr, at: 990) { AuthorityEstablishedAt { id: _ } => true  AuthorityEstablishmentRefused { group: _, step: _, reason: _ } => false }
-        })
-}
-
-fn d0fd_with_hash(scenario: fn(ContentHash) -> Bool) -> Bool {
-  match sha256_hex_digest(hex: "4444444444444444444444444444444444444444444444444444444444444444") {
-    Absent => false
-    Present { value: d } => scenario(Sha256Hash(d))
-  }
-}
-
-fn d0fd_w_admitted(store: FabricStorageBinding, successor: ContentHash) -> AdmittedD0Grant? {
-  d0fd_w_admitted_as(store: store, successor: successor, tx: "tx-front-door" as NonEmptyStr, esc: "esc-front-door" as NonEmptyStr)
-}
-
-fn d0fd_w_admitted_as(store: FabricStorageBinding, successor: ContentHash, tx: NonEmptyStr, esc: NonEmptyStr) -> AdmittedD0Grant? {
-  let subject = D0Subject { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), operation: D0SuspendForSuccessor { successor: successor, cleanup: QuiescentReservedBaseline, term: second(count: 1000) } }
-  match d0_intent_hash(subject: subject, group: FabricGroupA, transaction: tx) {
-    Absent => none
-    Present { value: intent } => {
-      let auth = AuthorizationGranted {
-        grant: OperatorGrant {
-          escalation_id: esc,
-          subject: subject,
-          scopes: [AuthorizationScope { verb: Write, resource: NamespacePosition { tree: CodeNameTree, path: ["gunbc", "spark", "pair_serving_authority"] }, action: d0_authorized_action }],
-          purpose: "witness d0 front door" as NonEmptyStr,
-          attempt: (tx as String) as AttemptIdentity,
-          intent_hash: intent,
-          granted_by: "witness" as NonEmptyStr,
-          granted_at: "2026-09-18T00:00:00Z",
-          expires_at: "2026-09-19T00:00:00Z",
-        },
-        claim: Unclaimed,
-      }
-      match admit_d0_grant(store: store, authorization: auth, escalation_id: esc, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), transaction: tx, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-18T00:00:00Z") {
-        D0GrantAdmitted { admitted: a } => Present { value: a }
-        _ => none
-      }
-    }
-  }
-}
-
-// A front door answering 500, read by the real transport INSIDE the transaction's observer (under
-// the pending state, as production reads it), reaches D0DecidedFence with the unidentified-
-// incumbent cause and FencedRefusal on the log at generation 2 -- the ranks never consulted.
-test fn a_front_door_answering_500_fences_the_group_through_the_transaction_by_real_execution() -> Bool {
-  d0fd_with_hash(scenario: fn(h) {
-    d0fd_with_temp_dir(scenario: fn(dir) {
-      let store = d0fd_witness_layout(dir: dir)
-      d0fd_witness_remote_ready(dir: dir)
-        && d0fd_with_listener(dir: dir, status: "500", scenario: fn(l) {
-          match d0fd_w_admitted(store: store, successor: h) {
-            Absent => false
-            Present { value: admitted } =>
-              (match d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: admitted, transaction: "tx-front-door" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-18T00:00:00Z",
-                     observe: fn(g) {
-                       D0Observation {
-                         group: g,
-                         incumbent: match front_door_as_incumbent(r: observe_front_door(endpoint: d0fd_endpoint(port: l.port)), head: fn() { HeadEndpointQuiet }) {
-                           Present { value: r } => r
-                           Absent => IncumbentDidNotAnswer { receipt: "witness: the front door answered 2xx, which this fixture does not" as NonEmptyStr, head: HeadEndpointQuiet }
-                         },
-                         ranks: [] as List<RankOccupancyReading>, vacancy: [] as List<RankVacancyReading>,
-                       }
-                     }) {
-                 D0Settled { decision: D0DecidedFence { next: _, cause: D0IncumbentUnidentified { cause: _ } }, generation: g2, receipt_path: _, entry_state: _ } => g2 == 2
-                 _ => false
-               })
-                && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1001) {
-                      CurrentAuthorityRead { authority: FencedRefusal { group: _, cause: c, disposition_authority: _ }, head: _, generation: g, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } => g == 2 && (c as String).contains("HTTP 500")
-                      _ => false
-                    })
-          }
-        })
-    })
-  })
-}
-
-// A FAILED CONNECT IS NOT ABSENCE BY ITSELF. The same vacated port, read inside the transaction:
-// with the head's declared unit ACTIVE the group is fenced (a listener the route did not reach);
-// with every declared unit installed and inactive, absence is corroborated on the head and the
-// group is suspended drifted-eligible.
-fn d0fd_ranks(head_active: Bool) -> List<RankOccupancyReading> {
-  match declared_pair_realization(group: FabricGroupA) {
-    DeclaredPairRealizationUnavailable { group: _, obligation: _ } => [] as List<RankOccupancyReading>
-    DeclaredPairRealizationKeyed { declared: d } =>
-      concat(
-        [RankOccupancyReading { host: d.head.host, unit_name: d.head.unit_name, occupancy: UnitInstalled { active: head_active, unit_digest: d.head.digest } }],
-        map(d.workers, w => RankOccupancyReading { host: w.host, unit_name: w.unit_name, occupancy: UnitInstalled { active: false, unit_digest: w.digest } }),
-      )
-  }
-}
-
-// The failed connect is SUPPLIED as the reading observe_front_door returns for it -- asserted on the
-// real route by a_listener_behind_a_failed_connect_is_read_on_the_host_and_fences_by_real_execution
-// -- because the subject here is the transaction's decision over that reading, not the host's port
-// state. It used to be read off a port a SIGTERM had been sent to, a premise nothing observed.
-fn d0fd_observe_failed_connect(head_active: Bool, g: FabricGroup) -> D0Observation {
-  D0Observation {
-    group: g,
-    incumbent: IncumbentDidNotAnswer { receipt: "witness: the front door could not be connected" as NonEmptyStr, head: HeadEndpointQuiet },
-    ranks: d0fd_ranks(head_active: head_active),
-    vacancy: [] as List<RankVacancyReading>,
-  }
-}
-
-test fn a_failed_connect_fences_under_an_active_head_unit_and_suspends_only_under_a_quiet_one_by_real_execution() -> Bool {
-  d0fd_with_hash(scenario: fn(h) {
-    d0fd_with_temp_dir(scenario: fn(dir) {
-      let store = d0fd_witness_layout(dir: dir)
-      d0fd_witness_remote_ready(dir: dir)
-        && (match d0fd_w_admitted(store: store, successor: h) {
-                  Absent => false
-                  Present { value: admitted } =>
-                    (match d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: admitted, transaction: "tx-front-door" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-18T00:00:00Z", observe: fn(g) { d0fd_observe_failed_connect(head_active: true, g: g) }) {
-                       D0Settled { decision: D0DecidedFence { next: _, cause: D0IncumbentUnidentified { cause: _ } }, generation: g2, receipt_path: _, entry_state: _ } => g2 == 2
-                       _ => false
-                     })
-                      && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1001) {
-                            CurrentAuthorityRead { authority: fenced, head: _, generation: _, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } =>
-                              match pair_serving_authority_for(group: FabricGroupA) {
-                                Absent => false
-                                Present { value: resting } =>
-                                  match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: fenced, next: resting, transaction: "tx-operator-restore" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1001) {
-                                    AuthorityTransitionAppended { id: _, generation: g3, next: _ } => g3 == 3
-                                    _ => false
-                                  }
-                              }
-                            _ => false
-                          })
-                      && (match d0fd_w_admitted_as(store: store, successor: h, tx: "tx-front-door-2" as NonEmptyStr, esc: "esc-front-door-2" as NonEmptyStr) {
-                            Absent => false
-                            Present { value: second } =>
-                              match d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: second, transaction: "tx-front-door-2" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1002, now: "2026-09-18T00:00:02Z", observe: fn(g) { d0fd_observe_failed_connect(head_active: false, g: g) }) {
-                                D0Settled { decision: D0DecidedSuspend { next: _, reconciliation: DeclaredOccupantDrifted { drifted: ds } }, generation: g5, receipt_path: _, entry_state: _ } => g5 == 5 && length(ds) == 4
-                                _ => false
-                              }
-                          })
-            })
-    })
-  })
-}
-
-// A LISTENER THE ROUTE DID NOT REACH. The fixture listens on 127.0.0.1:P; the door is asked at
-// 127.0.0.2:P, where nothing accepts, so curl exits 7 (a failed connect, exactly what a broken
-// route produces). The head's socket tables, read on this host through the real procfs
-// operation, show the LISTEN on P: the head endpoint reads Listening, and through the transaction
-// the group is FENCED as an unidentified incumbent -- never suspended as absent. Once the listener
-// is killed the same tables read no listener on P.
-test fn a_listener_behind_a_failed_connect_is_read_on_the_host_and_fences_by_real_execution() -> Bool {
-  d0fd_with_hash(scenario: fn(h) {
-    d0fd_with_temp_dir(scenario: fn(dir) {
-      let store = d0fd_witness_layout(dir: dir)
-      d0fd_witness_remote_ready(dir: dir)
-        && d0fd_with_listener(dir: dir, status: "200", scenario: fn(l) {
-          (match read_endpoint_listener(transport: LocalShell, port: d0fd_port(n: l.port)) { EndpointListening { port: p, rows: rs } => (p as Int) == l.port && length(rs) >= 1  _ => false })
-            && (match harness_bounded_presence(url: harness_models_url(endpoint: d0fd_endpoint_at(address: "127.0.0.2", port: l.port))) { HarnessConnectFailed { url: _, curl_exit: code } => code == 7  _ => false })
-            && (match observe_front_door(endpoint: d0fd_endpoint_at(address: "127.0.0.2", port: l.port)) { FrontDoorNoStatus { receipt: _ } => true  _ => false })
-            && (match d0fd_w_admitted(store: store, successor: h) {
-                  Absent => false
-                  Present { value: admitted } =>
-                    match d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: admitted, transaction: "tx-front-door" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-18T00:00:00Z",
-                          observe: fn(g) {
-                            D0Observation {
-                              group: g,
-                              incumbent: match front_door_as_incumbent(r: observe_front_door(endpoint: d0fd_endpoint_at(address: "127.0.0.2", port: l.port)), head: fn() { d0fd_head_endpoint(port: l.port) }) {
-                                Present { value: r } => r
-                                Absent => IncumbentAnsweredUnread { cause: "witness: 127.0.0.2 answered" as NonEmptyStr }
-                              },
-                              ranks: d0fd_ranks(head_active: false), vacancy: [] as List<RankVacancyReading>,
-                            }
-                          }) {
-                      D0Settled { decision: D0DecidedFence { next: _, cause: D0IncumbentUnidentified { cause: c } }, generation: g2, receipt_path: _, entry_state: _ } => g2 == 2 && (c as String).contains("LISTEN")
-                      _ => false
-                    }
-                })
-        })
-        && (match d0fd_vacated_port(dir: dir) {
-              Absent => false
-              Present { value: port } => match read_endpoint_listener(transport: LocalShell, port: d0fd_port(n: port)) { EndpointNoListener { port: _ } => true  _ => false }
-            })
-    })
-  })
-}
diff --git a/dag/test/claim/spark/pair_serving_d0_grant_row_wet_witness_test.dag b/dag/test/claim/spark/pair_serving_d0_grant_row_wet_witness_test.dag
deleted file mode 100644
index e92cc9c2dbc..00000000000
--- a/dag/test/claim/spark/pair_serving_d0_grant_row_wet_witness_test.dag
+++ /dev/null
@@ -1,18 +0,0 @@
-module test.claim.spark.pair_serving_d0_grant_row_wet_witness
-
-import std.types { Bool }
-import gunbc.spark.pair_serving_d0_door { captured_grant_row_blob, GrantRowBlobRead, GrantRowBlobUnread }
-
-// THE REAL PRODUCER OF THE GRANT ROW'S BLOB ID, EXECUTED. The captured bytes go to `git hash-object
-// --no-filters --stdin` as given, so the id is git's own blob id of exactly those bytes, trailing newline
-// included. The oracle is external and independent: git's published id for the blob "hello\n". This runs
-// on the required floor's local-repo wet lane (v2.workflow.local_repo_wet_terminal
-// local_repo_wet_schedule), because git.Plumbing HashObjectStdinNoWrite has no mock_response and an
-// input-blind one would fabricate the very fact this claim establishes. The hermetic control beside it
-// is test.claim.spark.pair_serving_d0_release_witness rw_admission_follows_the_captured_row_not_the_path.
-test fn the_captured_row_is_hashed_as_its_exact_bytes_by_real_execution() -> Bool {
-  match captured_grant_row_blob(content: "hello\n") {
-    GrantRowBlobRead { blob: b } => b == "ce013625030ba8dba906f756967f9e9ca394464a"
-    GrantRowBlobUnread { cause: _ } => false
-  }
-}
diff --git a/dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag b/dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag
deleted file mode 100644
index 70ee18dd6de..00000000000
--- a/dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag
+++ /dev/null
@@ -1,1058 +0,0 @@
-module test.claim.spark.pair_serving_d0_real_execution
-
-import std.logic { Bool }
-import std.types { String, NonEmptyStr, FilePath, List, Int }
-import std.optional { Present, Absent }
-import std.measure { second, measure_count, Measure }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import extdeps.shell
-import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest, compare_content_hash, ContentHashEqual, ContentHashDifferent, ContentHashCrossFamilyIncomparable, serialize_content_hash, content_hash_equal, content_hash_of_value }
-import std.scoped_authorization { OperatorGrant, ScopedAuthorization, AuthorizationGranted, Unclaimed, AuthorizationScope, AttemptIdentity }
-import std.effect_grant { Write, NamespacePosition, CodeNameTree }
-import gunbc.harness.harness_seat {
-  SeatAuthorityGate, SeatAuthorityUngoverned, SeatAuthorityAdmits, SeatAuthorityRefuses, harness_seat_authority_gate,
-  SeatAfterGrant, SeatStillAdmitted, SeatReleasedAuthorityMoved, SeatUnreleasedAuthorityMoved, harness_seat_after_grant_authority, harness_seat_pool_root,
-}
-import product.capacity.lease { LeasePolicy, QuiescenceRequired }
-import product.capacity.pool_events { SeatRequest }
-import gunbc.fabric_storage_client { FabricStorageBinding, FabricStorageLocalFiles }
-import gunbc.fabric_storage_file_store { fabric_storage_file_root, fabric_storage_file_root_ensure, FabricStorageRootReady }
-import gunbc.fabric_event_log {
-  SeatGranted, fabric_seat_acquire, SeatRoomObserved, fabric_seat_observe,
-  PartitionReadOk, event_log_read_partition_with,
-}
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB }
-import product.fabric.demand { ObservationReceiptRef }
-import gunbc.spark.serving_incarnation_observe { UnitInstalled, UnitNotInstalled }
-import gunbc.spark.vllm_endpoint_process_launch { vllm_endpoint_process_launch }
-import gunbc.spark.vllm_serving_launch { vllm_serving_launch, endpoint_incarnation_observation }
-import gunbc.spark.pair_incumbent_identity {
-  DeclaredPairRealizationKeyed, DeclaredPairRealizationUnavailable, declared_pair_realization,
-  ObservedRankUnit, observed_pair_realization_of, ObservedPairRealizationRead, pair_realization_agreement,
-}
-import gunbc.spark.released_baseline { QuiescentReservedBaseline }
-import gunbc.spark.pair_serving_authority {
-  PairServingGroupAuthority, PairServingActive, SuspensionPendingReconciliation, SuspendedForAuthorizedSuccessor, FencedRefusal, PairRealizationKeyed,
-  pair_serving_authority_for, pair_serving_successor_may_launch, pair_serving_may_finish,
-}
-import gunbc.spark.pair_serving_authority_log {
-  CurrentAuthority, CurrentAuthorityRead, CurrentAuthorityUnread, current_pair_serving_authority, HostEffectRecord,
-  AuthorityTransitionAppended, pair_serving_authority_transition, authority_eq,
-  AuthorityEstablishedAt, AuthorityEstablishmentRefused, pair_serving_authority_establish,
-  PairAuthorityEvent, EntryStateRecorded, pair_authority_partition, pair_authority_event_decode,
-}
-import product.capacity.event_chain { PartitionId, ChainWalked }
-import std.process { ProcessExit, ExitSuccess, ExitFailure }
-import gunbc.spark.pair_serving_d0 {
-  d0_dispatch, d0_subject_successor, D0SuspendForSuccessor, RankVacancyReading,
-  D0Subject, RankOccupancyReading, IncumbentDidNotAnswer, IncumbentAnswered, D0Observation, HeadEndpointQuiet,
-  D0Outcome, D0Settled, D0Refused, D0Decision, D0DecidedSuspend, D0DecidedRestore, D0DecidedFence, DeclaredOccupantDrifted, d0_transaction, d0_held_lease,
-  D0GrantAdmission,
-  AdmittedD0Grant, D0GrantAdmitted, D0GrantClaimLost, D0GrantForAnotherPopulation, admit_d0_grant, resume_d0_grant, d0_intent_hash, d0_authorized_action,
-  D0ClaimReading, D0ClaimAbsent, D0ClaimAt, D0ClaimUnreadable, d0_read_claim, d0_terminate_claim, D0ClaimTerminated,
-  D0Recovery, D0RecoverStart, D0RecoverFirstWrite, D0RecoverResume, D0RecoverComplete, D0RecoverAbort, D0RecoveryRefused, d0_recovery,
-  d0_intent_text, d0_frozen_filing_text, d0_freeze_filing, D0FilingFrozen, D0FilingAlreadyHeld, D0FilingFreezeRefused, d0_read_filing, D0FilingAt, D0FilingAbsent, D0FilingUnreadable,
-  D0GrantRefused,
-  D0ReleaseToFleet, D0GrantRowApproved, D0GrantRowUnproven, d0_freeze_filing_with, d0_claim_grant, D0ClaimHeld,
-}
-import gunbc.spark.pair_serving_d0_authorization { d0_filed_request, D0FiledRequestFor, D0FiledRequestRefused }
-import gunbc.spark.pair_serving_d0_door { d0_run_kind, d0_run_kind_with, D0FirstRun, D0Rerun, D0RunRefused, d0_filed_grant_proof, d0_honored_standing_grant, ExecutedGrantRowRead }
-import gunbc.spark.pair_serving_authority_log { AuthorityTransitionRecord }
-import test.claim.spark.pair_serving_d0_witness { d0w_rec_of, d0w_pending }
-import gunbc.spark.pair_serving_authority { ReleasedToFleet, PairRealizationUnestablished }
-import gunbc.auth.approval_decision_store { request_revision_of }
-import std.scoped_authorization { ClaimedBy, CompletedBy, AbortedBy }
-import product.host_identity { HostIdentity }
-import gunbc.fleet_host_identity { operator_host_srv1 }
-import gunbc.spark.fabric_switch_observed { fabric_group_hosts }
-import gunbc.spark.host_commitment {
-  spark_claimed_members_under, spark_host_standings_current, CurrentStandings, CurrentStandingsRead, CurrentStandingsUnread, admit_unplaced_host_in, SparkHostAdmission, SparkHostAdmitted, SparkHostRefused,
-  SparkHostStanding, SparkHostUncommitted, SparkHostCommitted, spark_standing_of, spark_authority_held_causes_of, MemberOfClaimedServingGroup,
-}
-import gunbc.fleet_host_identity { operator_host_srv10 }
-import product.host_identity { host_identity_eq }
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-// THE EXACT PRODUCTION TWO-WRITE ROUTE, BY REAL EXECUTION against a bare remote in a temporary
-// directory. The pure decision has its own witness and the generic compare-and-set its own; what
-// neither establishes is their COMPOSITION, which is where the first shape of this transaction
-// failed: it wrote the pending state without a grant, read it back with a derived observation,
-// and could never settle. So this file drives d0_transaction itself -- the same fn the wet entry
-// calls -- with a fixture grant and a supplied observer, and asserts what the redesign requires:
-//   resting Active → first write → pending read back → readings → second write
-//   → SuspendedForAuthorizedSuccessor at generation 2, naming the entry-state receipt
-//   crash after the first write → a rerun under the SAME transaction settles from pending
-//   a rerun under ANOTHER transaction is refused and moves nothing
-//   the lease expires → the successor may not start, may finish, and a cleanup transition
-//     still appends against the state as read, so the chain folds to generation 3
-//   the claim is on the same store: two executors (two bindings to the one placed store) race for one grant
-//     and exactly one holds it
-//   crash after the claim and before the first write → the join performs the first write
-//   crash after the settling write and before CompletedBy → the join completes the claim only
-//   a grant over another host population is refused before any claim or write
-
-fn d0r_with_temp_dir(scenario: fn(FilePath) -> Bool) -> Bool {
-  let dir = shell.Mktemp.Dir()
-  let observed = scenario(dir.path)
-  let cleaned = shell.Remove.RecursiveForce(path: dir.path)
-  dir.success && observed && cleaned.success
-}
-
-fn d0r_witness_layout(dir: FilePath) -> FabricStorageBinding {
-  FabricStorageLocalFiles { root: fabric_storage_file_root(root: join([dir as String, "/fabric-storage"], "") as NonEmptyStr) }
-}
-
-// A ready remote has group A's source row ESTABLISHED on its partition (the log's durable
-// genesis) at 990, before any scenario event.
-fn d0r_witness_remote_ready(dir: FilePath) -> Bool {
-  (match fabric_storage_file_root_ensure(root: fabric_storage_file_root(root: join([dir as String, "/fabric-storage"], "") as NonEmptyStr)) { FabricStorageRootReady => true  _ => false })
-    && (match pair_serving_authority_for(group: FabricGroupA) {
-          Absent => false
-          Present { value: desired } =>
-            match pair_serving_authority_establish(store: d0r_witness_layout(dir: dir), group: FabricGroupA, authority: desired, actor: "witness" as NonEmptyStr, at: 990) { AuthorityEstablishedAt { id: _ } => true  AuthorityEstablishmentRefused { group: _, step: _, reason: _ } => false }
-        })
-}
-
-// A scenario over a ready remote: the bare repository exists BEFORE the first claim, since the
-// claim is the first thing written to the log now.
-fn d0r_with_remote(scenario: fn(FilePath, FabricStorageBinding) -> Bool) -> Bool {
-  d0r_with_temp_dir(scenario: fn(dir) { d0r_witness_remote_ready(dir: dir) && scenario(dir, d0r_witness_layout(dir: dir)) })
-}
-
-// A second executor's binding to the SAME store: one placed fabric DB, reached by every executor.
-fn d0r_second_executor_layout(dir: FilePath) -> FabricStorageBinding {
-  FabricStorageLocalFiles { root: fabric_storage_file_root(root: join([dir as String, "/fabric-storage"], "") as NonEmptyStr) }
-}
-
-fn d0r_with_hash(scenario: fn(ContentHash) -> Bool) -> Bool {
-  match sha256_hex_digest(hex: "3333333333333333333333333333333333333333333333333333333333333333") {
-    Absent => false
-    Present { value: d } => scenario(Sha256Hash(d))
-  }
-}
-
-// A fixture authorization over Group A for transaction `tx`: a keyed successor, the reserved
-// baseline, a 1000-second term, the write scope over the authority, the transaction as attempt,
-// the intent over the exact operation -- everything admit_d0_grant decides on.
-fn d0r_w_authorization_over(hosts: List<HostIdentity>, successor: ContentHash, tx: NonEmptyStr, escalation: NonEmptyStr) -> ScopedAuthorization<D0Subject>? {
-  let subject = D0Subject { group: FabricGroupA, hosts: hosts, operation: D0SuspendForSuccessor { successor: successor, cleanup: QuiescentReservedBaseline, term: second(count: 1000) } }
-  match d0_intent_hash(subject: subject, group: FabricGroupA, transaction: tx) {
-    Absent => none
-    Present { value: intent } =>
-      Present { value: AuthorizationGranted {
-        grant: OperatorGrant {
-          escalation_id: escalation,
-          subject: subject,
-          scopes: [AuthorizationScope { verb: Write, resource: NamespacePosition { tree: CodeNameTree, path: ["gunbc", "spark", "pair_serving_authority"] }, action: d0_authorized_action }],
-          purpose: "witness d0" as NonEmptyStr,
-          attempt: (tx as String) as AttemptIdentity,
-          intent_hash: intent,
-          granted_by: "witness" as NonEmptyStr,
-          granted_at: "2026-09-18T00:00:00Z",
-          expires_at: "2026-09-19T00:00:00Z",
-        },
-        claim: Unclaimed,
-      } }
-  }
-}
-
-fn d0r_w_authorization(successor: ContentHash, tx: NonEmptyStr, escalation: NonEmptyStr) -> ScopedAuthorization<D0Subject>? {
-  d0r_w_authorization_over(hosts: fabric_group_hosts(g: FabricGroupA), successor: successor, tx: tx, escalation: escalation)
-}
-
-// START: permission decided and the claim TAKEN, on the scenario's event log -- the same log the
-// authority partition lives on, through the store the "executor" resolves.
-fn d0r_w_admit(store: FabricStorageBinding, successor: ContentHash, tx: NonEmptyStr, escalation: NonEmptyStr, executor: NonEmptyStr) -> D0GrantAdmission {
-  match d0r_w_authorization(successor: successor, tx: tx, escalation: escalation) {
-    Absent => D0GrantClaimLost { holder: "witness: the fixture intent could not be digested" as NonEmptyStr }
-    Present { value: auth } => admit_d0_grant(store: store, authorization: auth, escalation_id: escalation, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), transaction: tx, executor: executor, at: 1000, now: "2026-09-18T00:00:00Z")
-  }
-}
-
-fn d0r_w_admitted(store: FabricStorageBinding, successor: ContentHash, tx: NonEmptyStr, escalation: NonEmptyStr, executor: NonEmptyStr) -> AdmittedD0Grant? {
-  match d0r_w_admit(store: store, successor: successor, tx: tx, escalation: escalation, executor: executor) {
-    D0GrantAdmitted { admitted: a } => Present { value: a }
-    _ => none
-  }
-}
-
-// RESUME: the claim found held by this attempt; permission is not re-decided.
-fn d0r_w_resumed(store: FabricStorageBinding, successor: ContentHash, tx: NonEmptyStr, escalation: NonEmptyStr, executor: NonEmptyStr) -> AdmittedD0Grant? {
-  match d0r_w_authorization(successor: successor, tx: tx, escalation: escalation) {
-    Absent => none
-    Present { value: auth } =>
-      match resume_d0_grant(store: store, authorization: auth, escalation_id: escalation, group: FabricGroupA, transaction: tx, executor: executor) {
-        D0GrantAdmitted { admitted: a } => Present { value: a }
-        _ => none
-      }
-  }
-}
-
-// The claim slot as the log holds it: ClaimedBy / CompletedBy the named attempt.
-fn d0r_claim_is(store: FabricStorageBinding, escalation: NonEmptyStr, by: String, completed: Bool) -> Bool {
-  match d0_read_claim(store: store, escalation_id: escalation) {
-    D0ClaimAt { state: ClaimedBy { attempt: who, claimed_at: _ }, generation: _ } => !completed && (who as String) == by
-    D0ClaimAt { state: CompletedBy { attempt: who, completed_at: _ }, generation: _ } => completed && (who as String) == by
-    _ => false
-  }
-}
-
-fn d0r_claim_is_lost(a: D0GrantAdmission) -> Bool {
-  match a {
-    D0GrantClaimLost { holder: _ } => true
-    _ => false
-  }
-}
-
-// The expected readings: nothing answers on the route, every declared rank has our unit
-// installed and inactive -- the drifted-eligible case. Digests are the PRODUCTION declaration's,
-// so reconciliation is against what Group A really declares.
-fn d0r_w_observe(group: FabricGroup) -> D0Observation {
-  let ranks = match declared_pair_realization(group: group) {
-    DeclaredPairRealizationUnavailable { group: _, obligation: _ } => [] as List<RankOccupancyReading>
-    DeclaredPairRealizationKeyed { declared: d } =>
-      concat(
-        [RankOccupancyReading { host: d.head.host, unit_name: d.head.unit_name, occupancy: UnitInstalled { active: false, unit_digest: d.head.digest } }],
-        map(d.workers, w => RankOccupancyReading { host: w.host, unit_name: w.unit_name, occupancy: UnitInstalled { active: false, unit_digest: w.digest } }),
-      )
-  }
-  D0Observation { group: group, incumbent: IncumbentDidNotAnswer { receipt: "witness: the route did not answer" as NonEmptyStr, head: HeadEndpointQuiet }, ranks: ranks, vacancy: [] as List<RankVacancyReading> }
-}
-
-
-fn d0r_seat_gate_is(g: SeatAuthorityGate, admits: Bool) -> Bool {
-  match g {
-    SeatAuthorityAdmits => admits
-    SeatAuthorityRefuses { cause: _ } => !admits
-    SeatAuthorityUngoverned => false
-  }
-}
-
-fn d0r_read_is_suspended_at(c: CurrentAuthority, generation: Int, entry_state: ContentHash, launch: Bool) -> Bool {
-  match c {
-    CurrentAuthorityRead { authority: a, head: _, generation: g, grant: gr, entry_state: es, previous: _, admitted_by: _, transitions: _ } =>
-      g == generation
-        && (match a { SuspendedForAuthorizedSuccessor { group: _, authorization: au, exact_candidate_realization: _, lease: _, cleanup: QuiescentReservedBaseline } => (au as String) == "esc-d0-witness"  _ => false })
-        && (match gr { Present { value: _ } => true  Absent => false })
-        && (match es { Present { value: h } => content_hash_equal(left: h, right: entry_state)  Absent => false })
-        && pair_serving_successor_may_launch(a: a) == launch
-        && pair_serving_may_finish(a: a)
-    CurrentAuthorityUnread { group: _, step: _, reason: _ } => false
-  }
-}
-
-// THE RECEIPT IS ON THE LOG: the settling event names a content hash that is the id of an
-// EntryStateRecorded event on the same partition, and that event carries the receipt's bytes.
-fn d0r_entry_state_is_on_the_log(store: FabricStorageBinding, entry_state: ContentHash) -> Bool {
-  match event_log_read_partition_with(store: store, partition: pair_authority_partition(group: FabricGroupA), budget: 64, decode: fn(text) { pair_authority_event_decode(text: text) }) {
-    PartitionReadOk { head: _, walk: ChainWalked { oldest_first: envs } } =>
-      any(envs, env => (env.id as String) == (serialize_content_hash(hash: entry_state) as String)
-        && (match env.event.payload { EntryStateRecorded { transaction: t, body: b } => (t as String) == "tx-d0" && b != ""  _ => false }))
-    _ => false
-  }
-}
-
-fn d0r_settled_eligible(o: D0Outcome) -> ContentHash? {
-  match o {
-    D0Settled { decision: D0DecidedSuspend { next: _, reconciliation: DeclaredOccupantDrifted { drifted: ds } }, generation: g, receipt_path: _, entry_state: es } =>
-      if length(ds) == 4 && g == 2 { Present { value: es } } else { none }
-    _ => none
-  }
-}
-
-// THE WHOLE ROUTE, then expiry, then cleanup.
-test fn the_production_route_settles_and_the_lease_governs_launch_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      match d0r_w_admitted(store: store, successor: h, tx: "tx-d0" as NonEmptyStr, escalation: "esc-d0-witness" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-        Absent => false
-        Present { value: admitted } =>
-      d0r_seat_gate_is(g: harness_seat_authority_gate(store: store, group: FabricGroupA, now: 1000), admits: true)
-        && (match harness_seat_authority_gate(store: store, group: FabricGroupB, now: 1000) { SeatAuthorityUngoverned => true  _ => false })
-        && (match d0r_settled_eligible(o: d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: admitted, transaction: "tx-d0" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-18T00:00:00Z", observe: fn(g) { d0r_w_observe(group: g) })) {
-              Absent => false
-              Present { value: es } =>
-                d0r_read_is_suspended_at(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1000), generation: 2, entry_state: es, launch: true)
-                  && d0r_seat_gate_is(g: harness_seat_authority_gate(store: store, group: FabricGroupA, now: 1000), admits: false)
-                  && d0r_read_is_suspended_at(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 2500), generation: 2, entry_state: es, launch: false)
-                  && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 2500) {
-                        CurrentAuthorityRead { authority: expired, head: _, generation: _, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } =>
-                          match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: expired, next: FencedRefusal { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), cause: "witness cleanup" as NonEmptyStr, disposition_authority: "witness" as NonEmptyStr }, transaction: "tx-d0" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 2500) {
-                            AuthorityTransitionAppended { id: _, generation: g3, next: _ } =>
-                              g3 == 3 && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 2600) {
-                                CurrentAuthorityRead { authority: FencedRefusal { group: _, cause: _, disposition_authority: _ }, head: _, generation: g4, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } => g4 == 3
-                                _ => false
-                              })
-                            _ => false
-                          }
-                        CurrentAuthorityUnread { group: _, step: _, reason: _ } => false
-                      })
-            })
-      }
-    })
-  })
-}
-
-// CRASH AFTER THE FIRST WRITE, FROM A NON-RESTING ACTIVE. The authority is first moved to
-// Active(Keyed K) -- not the resting row -- then the pending state is written by the production
-// transition under tx-d0 and this grant's binding (exactly what d0_transaction writes first), and
-// the process is gone. Then: a rerun under tx-other is refused; a rerun under tx-d0 but ANOTHER
-// admitted grant (a different escalation, so a different binding) is refused; a second START under
-// the same escalation and transaction finds the grant already claimed (the consent was consumed
-// once); nothing moved; and a RESUME under tx-d0 -- the claim found held, permission not
-// re-decided -- finds a live declared incumbent and restores EXACTLY Active(Keyed K), not the
-// resting row.
-test fn a_rerun_resumes_its_own_pending_state_and_restores_the_exact_active_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      match pair_serving_authority_for(group: FabricGroupA) {
-        Absent => false
-        Present { value: resting } => {
-          let keyed = PairServingActive { group: FabricGroupA, exact_realization: PairRealizationKeyed { key: h } }
-          match d0r_w_admitted(store: store, successor: h, tx: "tx-d0" as NonEmptyStr, escalation: "esc-d0-witness" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-            Absent => false
-            Present { value: admitted } =>
-          match d0r_w_admitted(store: store, successor: h, tx: "tx-d0" as NonEmptyStr, escalation: "esc-another-decision" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-            Absent => false
-            Present { value: other_grant_same_tx } =>
-          match d0r_w_admitted(store: store, successor: h, tx: "tx-other" as NonEmptyStr, escalation: "esc-third-decision" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-            Absent => false
-            Present { value: other_tx } => {
-          let pending = SuspensionPendingReconciliation {
-            group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-d0" as NonEmptyStr, authorization_binding: admitted.binding,
-            lease: d0_held_lease(group: FabricGroupA, transaction: "tx-d0" as NonEmptyStr, executor: "witness" as NonEmptyStr, generation: 2),
-          }
-          (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: keyed, transaction: "tx-operator-keyed" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 999) {
-                  AuthorityTransitionAppended { id: _, generation: g1, next: _ } => g1 == 1
-                  _ => false
-                })
-            && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: keyed, next: pending, transaction: "tx-d0" as NonEmptyStr, lifecycle: Present { value: admitted.binding }, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) {
-                  AuthorityTransitionAppended { id: _, generation: g2, next: _ } => g2 == 2
-                  _ => false
-                })
-            && (match d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: other_tx, transaction: "tx-other" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1001, now: "2026-09-18T00:00:01Z", observe: fn(g) { d0r_w_observe(group: g) }) {
-                  D0Refused { cause: _ } => true
-                  _ => false
-                })
-            && (match d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: other_grant_same_tx, transaction: "tx-d0" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1001, now: "2026-09-18T00:00:01Z", observe: fn(g) { d0r_w_observe(group: g) }) {
-                  D0Refused { cause: _ } => true
-                  _ => false
-                })
-            && d0r_claim_is_lost(a: d0r_w_admit(store: store, successor: h, tx: "tx-d0" as NonEmptyStr, escalation: "esc-d0-witness" as NonEmptyStr, executor: "witness" as NonEmptyStr))
-            && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1001) {
-                  CurrentAuthorityRead { authority: SuspensionPendingReconciliation { group: _, transaction: t, authorization_binding: _, lease: _ }, head: _, generation: g1, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } => (t as String) == "tx-d0" && g1 == 2
-                  _ => false
-                })
-            && (match d0r_w_resumed(store: store, successor: h, tx: "tx-d0" as NonEmptyStr, escalation: "esc-d0-witness" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-                  Absent => false
-                  Present { value: resumed } =>
-                    (match d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: resumed, transaction: "tx-d0" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1002, now: "2026-09-18T00:00:02Z", observe: fn(g) { d0r_w_observe_live_declared(group: g) }) {
-                       D0Settled { decision: D0DecidedRestore { next: _, key: _ }, generation: g3, receipt_path: _, entry_state: _ } => g3 == 3
-                       _ => false
-                     })
-                    && d0r_read_authority_at(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1002), expected: keyed, generation: 3)
-                })
-            }
-          }
-          }
-          }
-        }
-      }
-    })
-  })
-}
-
-// THE SEAT WALL AT ITS LINEARIZATION POINT. A seat attempt reads the authority (Active: admits),
-// the D0 transaction lands its first write, and THEN the seat's compare-and-set runs on its own
-// partition and is granted -- the interleaving the pre-check cannot settle. The post-grant read
-// (harness_seat_after_grant_authority, the seam harness_fence_grant runs first) finds the
-// authority moved, releases the seat on its partition, and no binding is returned; the seat
-// partition folds back to its full room. No unaccounted seat remains.
-test fn a_seat_granted_after_the_suspension_landed_is_released_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      let partition = "witness-group-a-seat" as PartitionId
-      let ceiling = 1
-      let root = harness_seat_pool_root(partition: partition, ceiling: ceiling)
-      let policy = LeasePolicy { maximum_duration_seconds: 300, release_law: QuiescenceRequired }
-      match pair_serving_authority_for(group: FabricGroupA) {
-        Absent => false
-        Present { value: resting } =>
-      match d0r_w_admitted(store: store, successor: h, tx: "tx-d0" as NonEmptyStr, escalation: "esc-d0-witness" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-        Absent => false
-        Present { value: admitted } =>
-          d0r_seat_gate_is(g: harness_seat_authority_gate(store: store, group: FabricGroupA, now: 1000), admits: true)
-            && (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-d0" as NonEmptyStr, authorization_binding: admitted.binding, lease: d0_held_lease(group: FabricGroupA, transaction: "tx-d0" as NonEmptyStr, executor: "witness" as NonEmptyStr, generation: 1) }, transaction: "tx-d0" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) {
-                  AuthorityTransitionAppended { id: _, generation: g1, next: _ } => g1 == 1
-                  _ => false
-                })
-            && (match fabric_seat_acquire(store: store, partition: partition, root: root, actor: "witness" as NonEmptyStr, request: SeatRequest { reference: "witness-seat-1" as NonEmptyStr, amount: Measure { count: 1 }, at: 1001, term_seconds: 300 }, policy: policy, attempts: 3, budget: 64) {
-                  SeatGranted { grant: g, generation: _, attempts_used: _ } =>
-                    (match harness_seat_after_grant_authority(store: store, group: FabricGroupA, partition: partition, ceiling: ceiling, grant: g, now: 1001) {
-                       SeatReleasedAuthorityMoved { cause: _ } => true
-                       _ => false
-                     })
-                    && (match fabric_seat_observe(store: store, partition: partition, root: root, at: 1002, budget: 64) {
-                          SeatRoomObserved { headroom: room, generation: _ } => measure_count(room) == ceiling
-                          _ => false
-                        })
-                  _ => false
-                })
-      }
-      }
-    })
-  })
-}
-
-// An observation whose head rank has NO pair unit installed: unread, so the transaction fences.
-fn d0r_w_observe_uninstalled(group: FabricGroup) -> D0Observation {
-  let base = d0r_w_observe(group: group)
-  D0Observation {
-    group: group, incumbent: base.incumbent,
-    ranks: map(base.ranks, r => if (r.unit_name as String) == "gunbc-spark-pair-head.service" { RankOccupancyReading { host: r.host, unit_name: r.unit_name, occupancy: UnitNotInstalled } } else { r }),
-    vacancy: [] as List<RankVacancyReading>,
-  }
-}
-
-// An observation where the enrolled route ANSWERS with exactly the declared realization on every
-// rank: restoration is shown safe, and the authority returns to the resting Active state unchanged.
-fn d0r_w_observe_live_declared(group: FabricGroup) -> D0Observation {
-  match declared_pair_realization(group: group) {
-    DeclaredPairRealizationUnavailable { group: _, obligation: _ } => d0r_w_observe(group: group)
-    DeclaredPairRealizationKeyed { declared: d } => {
-      let head = endpoint_incarnation_observation(
-        endpoint: vllm_endpoint_process_launch(group: group, endpoint: "http://10.0.0.5:8000" as NonEmptyStr, process_start_field: "1" as NonEmptyStr),
-        launch: vllm_serving_launch(group: group, head: d.head.host, systemd_invocation: "inv" as NonEmptyStr, container_id: "c" as NonEmptyStr, executable_digest: d.head.digest, unit_digest: d.head.digest, started_at: 1),
-        container_env: [] as List<String>,
-    receipt: "test.claim.spark.pair_serving_d0_real_execution fixture" as ObservationReceiptRef,
-      )
-      let workers = map(d.workers, w => ObservedRankUnit { host: w.host, unit_name: w.unit_name, systemd_invocation: "inv" as NonEmptyStr, unit_digest: w.digest })
-      let agreement = pair_realization_agreement(
-        declared: DeclaredPairRealizationKeyed { declared: d },
-        observed: ObservedPairRealizationRead { observed: observed_pair_realization_of(group: group, head: head, workers: workers, receipt: "test.claim.spark.pair_serving_d0_real_execution fixture" as ObservationReceiptRef) },
-      )
-      D0Observation { group: group, incumbent: IncumbentAnswered { agreement: agreement }, ranks: d0r_w_observe(group: group).ranks, vacancy: [] as List<RankVacancyReading> }
-    }
-  }
-}
-
-fn d0r_read_authority_at(c: CurrentAuthority, expected: PairServingGroupAuthority, generation: Int) -> Bool {
-  match c {
-    CurrentAuthorityRead { authority: a, head: _, generation: g, grant: gr, entry_state: es, previous: _, admitted_by: _, transitions: _ } =>
-      g == generation && authority_eq(a: a, b: expected)
-        && (match gr { Absent => true  Present { value: _ } => false })
-        && (match es { Present { value: _ } => true  Absent => false })
-    CurrentAuthorityUnread { group: _, step: _, reason: _ } => false
-  }
-}
-
-// THE OTHER TWO TERMINALS ARE REACHED. Two operator decisions, one per transaction -- a claimed
-// grant is consumed by its transaction, so the restore needs its own. An unread rank fences: the authority lands on FencedRefusal
-// at generation 2 with no grant and the receipt digest on the event, and the seat gate refuses. A
-// live declared incumbent restores: the authority lands back on the resting Active state,
-// unchanged (no keyed mint), at generation 2, and the seat gate admits again.
-test fn a_fence_and_a_restore_each_reach_their_terminal_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      match pair_serving_authority_for(group: FabricGroupA) {
-        Absent => false
-        Present { value: resting } =>
-      match d0r_w_admitted(store: store, successor: h, tx: "tx-fence" as NonEmptyStr, escalation: "esc-d0-witness" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-        Absent => false
-        Present { value: fence_grant } =>
-      match d0r_w_admitted(store: store, successor: h, tx: "tx-restore" as NonEmptyStr, escalation: "esc-d0-restore" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-        Absent => false
-        Present { value: restore_grant } =>
-          (match d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: fence_grant, transaction: "tx-fence" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-18T00:00:00Z", observe: fn(g) { d0r_w_observe_uninstalled(group: g) }) {
-                  D0Settled { decision: D0DecidedFence { next: _, cause: _ }, generation: g2, receipt_path: _, entry_state: _ } => g2 == 2
-                  _ => false
-                })
-            && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1000) {
-                  CurrentAuthorityRead { authority: FencedRefusal { group: _, cause: _, disposition_authority: _ }, head: _, generation: g, grant: Absent, entry_state: Present { value: _ }, previous: _, admitted_by: _, transitions: _ } => g == 2
-                  _ => false
-                })
-            && d0r_seat_gate_is(g: harness_seat_authority_gate(store: store, group: FabricGroupA, now: 1000), admits: false)
-            && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1000) {
-                  CurrentAuthorityRead { authority: fenced, head: _, generation: _, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } =>
-                    match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: fenced, next: resting, transaction: "tx-operator-restore" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1001) {
-                      AuthorityTransitionAppended { id: _, generation: g3, next: _ } => g3 == 3
-                      _ => false
-                    }
-                  _ => false
-                })
-            && (match d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: restore_grant, transaction: "tx-restore" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1002, now: "2026-09-18T00:00:02Z", observe: fn(g) { d0r_w_observe_live_declared(group: g) }) {
-                  D0Settled { decision: D0DecidedRestore { next: _, key: _ }, generation: g5, receipt_path: _, entry_state: _ } => g5 == 5
-                  _ => false
-                })
-            && d0r_read_authority_at(c: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1002), expected: resting, generation: 5)
-            && d0r_seat_gate_is(g: harness_seat_authority_gate(store: store, group: FabricGroupA, now: 1002), admits: true)
-      }
-      }
-      }
-    })
-  })
-}
-
-// ── THE CLAIM IS FLEET-GLOBAL, AND THE RUN IS TOTAL OVER ITS CRASH POINTS ──────────────────────
-
-// The join as the dispatcher asks it: the lifecycle is the resumed grant's binding when the claim
-// is held by this transaction, Absent otherwise.
-fn d0r_recovery_of(store: FabricStorageBinding, successor: ContentHash, tx: NonEmptyStr, escalation: NonEmptyStr, at: Int) -> D0Recovery? {
-  match current_pair_serving_authority(store: store, group: FabricGroupA, at: at) {
-    CurrentAuthorityUnread { group: _, step: _, reason: _ } => none
-    CurrentAuthorityRead { authority: cur, head: _, generation: _, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: recs } => {
-      let lifecycle = match d0r_w_resumed(store: store, successor: successor, tx: tx, escalation: escalation, executor: "witness" as NonEmptyStr) {
-        Present { value: a } => Present { value: a.binding }
-        Absent => none
-      }
-      Present { value: d0_recovery(claim: d0_read_claim(store: store, escalation_id: escalation), transaction: tx, lifecycle: lifecycle, executor: "witness" as NonEmptyStr, current: cur, transitions: recs) }
-    }
-  }
-}
-
-fn d0r_generation_is(store: FabricStorageBinding, generation: Int, at: Int) -> Bool {
-  match current_pair_serving_authority(store: store, group: FabricGroupA, at: at) {
-    CurrentAuthorityRead { authority: _, head: _, generation: g, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } => g == generation
-    CurrentAuthorityUnread { group: _, step: _, reason: _ } => false
-  }
-}
-
-// TWO EXECUTORS, ONE GRANT. Each executor has its own binding to the one placed fabric DB -- the
-// shape two hosts have. The first start claims the grant; the second start, from the other
-// executor, finds it held and takes nothing; the slot read through either binding names the one
-// holder; and once the first executor completes the claim
-// the second reads it completed and a third start is refused as spent. The host-local file store
-// could not establish any of this: its two roots would each have admitted a claim.
-test fn the_same_grant_claimed_from_two_executors_is_held_once_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, e1) {
-      let e2 = d0r_second_executor_layout(dir: dir)
-      let esc = "esc-two-executors" as NonEmptyStr
-      let tx = "tx-d0" as NonEmptyStr
-      match d0r_w_admitted(store: e1, successor: h, tx: tx, escalation: esc, executor: "executor-1" as NonEmptyStr) {
-        Absent => false
-        Present { value: admitted } =>
-          d0r_claim_is_lost(a: d0r_w_admit(store: e2, successor: h, tx: tx, escalation: esc, executor: "executor-2" as NonEmptyStr))
-            && d0r_claim_is(store: e2, escalation: esc, by: "tx-d0", completed: false)
-            && d0r_claim_is(store: e1, escalation: esc, by: "tx-d0", completed: false)
-            && (match d0_terminate_claim(store: e1, escalation_id: esc, transaction: tx, held: admitted.claim_generation, completed: true, cause: "", now: "2026-09-18T00:00:01Z") { D0ClaimTerminated => true  _ => false })
-            && d0r_claim_is(store: e2, escalation: esc, by: "tx-d0", completed: true)
-            && d0r_claim_is_lost(a: d0r_w_admit(store: e2, successor: h, tx: tx, escalation: esc, executor: "executor-2" as NonEmptyStr))
-            && (match d0r_recovery_of(store: e2, successor: h, tx: tx, escalation: esc, at: 1002) { Present { value: D0RecoveryRefused { cause: _ } } => true  _ => false })
-      }
-    })
-  })
-}
-
-// CRASH AFTER THE CLAIM, BEFORE THE FIRST WRITE. The claim lands on the log and the process is
-// gone before Active moved. A rerun's join reads ClaimedBy(tx-d0), an Active authority and no
-// transition by tx-d0, and dispatches the first write: the resumed grant (no re-decision) drives
-// the whole route from Active, settling at generation 2; then the claim completes. A second
-// consent whose first write never landed against an authority that is no longer Active is
-// ABORTED by the join, not stranded.
-test fn a_crash_after_the_claim_and_before_the_first_write_is_recovered_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      let esc = "esc-d0-witness" as NonEmptyStr
-      let tx = "tx-d0" as NonEmptyStr
-      match d0r_w_admitted(store: store, successor: h, tx: tx, escalation: esc, executor: "witness" as NonEmptyStr) {
-        Absent => false
-        Present { value: _ } =>
-          d0r_generation_is(store: store, generation: 0, at: 1000)
-            && (match d0r_recovery_of(store: store, successor: h, tx: tx, escalation: esc, at: 1000) { Present { value: D0RecoverFirstWrite { claim_generation: _ } } => true  _ => false })
-            && (match d0r_w_resumed(store: store, successor: h, tx: tx, escalation: esc, executor: "witness" as NonEmptyStr) {
-                  Absent => false
-                  Present { value: resumed } =>
-                    (match d0r_settled_eligible(o: d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: resumed, transaction: tx, executor: "witness" as NonEmptyStr, at: 1001, now: "2026-09-18T00:00:01Z", observe: fn(g) { d0r_w_observe(group: g) })) { Present { value: _ } => true  Absent => false })
-                      && (match d0_terminate_claim(store: store, escalation_id: esc, transaction: tx, held: resumed.claim_generation, completed: true, cause: "", now: "2026-09-18T00:00:02Z") { D0ClaimTerminated => true  _ => false })
-                      && d0r_claim_is(store: store, escalation: esc, by: "tx-d0", completed: true)
-                })
-            && (match d0r_w_admitted(store: store, successor: h, tx: "tx-second" as NonEmptyStr, escalation: "esc-second" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-                  Absent => false
-                  Present { value: second } =>
-                    match d0r_recovery_of(store: store, successor: h, tx: "tx-second" as NonEmptyStr, escalation: "esc-second" as NonEmptyStr, at: 1003) {
-                      Present { value: D0RecoverAbort { claim_generation: cg, cause: _ } } =>
-                        cg == second.claim_generation
-                          && (match d0_terminate_claim(store: store, escalation_id: "esc-second" as NonEmptyStr, transaction: "tx-second" as NonEmptyStr, held: cg, completed: false, cause: "witness: nothing to do", now: "2026-09-18T00:00:03Z") { D0ClaimTerminated => true  _ => false })
-                          && (match d0_read_claim(store: store, escalation_id: "esc-second" as NonEmptyStr) { D0ClaimAt { state: AbortedBy { attempt: who, aborted_at: _, cause: _ }, generation: _ } => (who as String) == "tx-second"  _ => false })
-                      _ => false
-                    }
-                })
-            && d0r_generation_is(store: store, generation: 2, at: 1004)
-      }
-    })
-  })
-}
-
-// CRASH AFTER THE SETTLING WRITE, BEFORE CompletedBy. The transaction settled at generation 2 and
-// the process died with the claim still ClaimedBy(tx-d0). A rerun's join finds tx-d0's last
-// transition landed the suspended state and dispatches COMPLETE: the claim is completed and the
-// authority is not moved. The join reads the log's record, not the current state: after an
-// operator moves the group on (a later transaction fences it), the join still answers Complete
-// for tx-d0 rather than mistaking the group for one tx-d0 never touched.
-test fn a_crash_after_the_settling_write_and_before_completion_completes_the_claim_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      let esc = "esc-d0-witness" as NonEmptyStr
-      let tx = "tx-d0" as NonEmptyStr
-      match d0r_w_admitted(store: store, successor: h, tx: tx, escalation: esc, executor: "witness" as NonEmptyStr) {
-        Absent => false
-        Present { value: admitted } =>
-          (match d0r_settled_eligible(o: d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: admitted, transaction: tx, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-18T00:00:00Z", observe: fn(g) { d0r_w_observe(group: g) })) { Present { value: _ } => true  Absent => false })
-            && d0r_claim_is(store: store, escalation: esc, by: "tx-d0", completed: false)
-            && (match d0r_recovery_of(store: store, successor: h, tx: tx, escalation: esc, at: 1001) {
-                  Present { value: D0RecoverComplete { claim_generation: cg, settled: s } } =>
-                    cg == admitted.claim_generation
-                      && (match s.next { SuspendedForAuthorizedSuccessor { group: _, authorization: _, exact_candidate_realization: _, lease: _, cleanup: _ } => true  _ => false })
-                  _ => false
-                })
-            && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1001) {
-                  CurrentAuthorityRead { authority: suspended, head: _, generation: _, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } =>
-                    match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: suspended, next: FencedRefusal { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), cause: "witness operator" as NonEmptyStr, disposition_authority: "witness" as NonEmptyStr }, transaction: "tx-operator" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1002) {
-                      AuthorityTransitionAppended { id: _, generation: g3, next: _ } => g3 == 3
-                      _ => false
-                    }
-                  _ => false
-                })
-            && (match d0r_recovery_of(store: store, successor: h, tx: tx, escalation: esc, at: 1003) { Present { value: D0RecoverComplete { claim_generation: _, settled: _ } } => true  _ => false })
-            && (match d0_terminate_claim(store: store, escalation_id: esc, transaction: tx, held: admitted.claim_generation, completed: true, cause: "", now: "2026-09-18T00:00:03Z") { D0ClaimTerminated => true  _ => false })
-            && d0r_claim_is(store: store, escalation: esc, by: "tx-d0", completed: true)
-            && (match d0r_recovery_of(store: store, successor: h, tx: tx, escalation: esc, at: 1004) { Present { value: D0RecoveryRefused { cause: _ } } => true  _ => false })
-            && d0r_generation_is(store: store, generation: 3, at: 1004)
-      }
-    })
-  })
-}
-
-// GROUP A'S MEMBERSHIP IS NOT WHAT THE OPERATOR SAW. A grant over four hosts with srv1 in place
-// of one Group A member is refused at admission -- before any claim (the slot stays absent) and
-// before any write (generation 0) -- naming both populations.
-test fn a_grant_over_another_host_population_is_refused_before_any_claim_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      let esc = "esc-other-hosts" as NonEmptyStr
-      let current = fabric_group_hosts(g: FabricGroupA)
-      let swapped = concat(current.skip(n: 1), [operator_host_srv1])
-      match d0r_w_authorization_over(hosts: swapped, successor: h, tx: "tx-d0" as NonEmptyStr, escalation: esc) {
-        Absent => false
-        Present { value: auth } =>
-          (match admit_d0_grant(store: store, authorization: auth, escalation_id: esc, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-d0" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-18T00:00:00Z") {
-             D0GrantForAnotherPopulation { granted: gr, current: cu } => length(gr) == 4 && length(cu) == 4
-             _ => false
-           })
-            && (match d0_read_claim(store: store, escalation_id: esc) { D0ClaimAbsent => true  _ => false })
-            && d0r_generation_is(store: store, generation: 0, at: 1000)
-      }
-    })
-  })
-}
-
-// ── THE LIFECYCLE, NOT THE WORD; AND DRIFT AFTER THE CLAIM ────────────────────────────────────
-
-fn d0r_exit_failed(e: ProcessExit) -> Bool {
-  match e {
-    ExitSuccess => false
-    ExitFailure { code: _, reason: _ } => true
-  }
-}
-
-// E1 under word tx-d0 settles and completes; an operator restores the group; E2 -- a fresh
-// decision under the SAME word -- claims and dies before its first write. E2's join must answer
-// FirstWrite from E2's (empty) history, never Complete from E1's terminal; and driving E2 from
-// there performs E2's own first write and settles at generation 4.
-test fn a_fresh_authorization_under_a_reused_word_is_not_completed_from_the_old_history_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      let tx = "tx-d0" as NonEmptyStr
-      match d0r_w_admitted(store: store, successor: h, tx: tx, escalation: "esc-e1" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-        Absent => false
-        Present { value: e1 } =>
-          (match d0r_settled_eligible(o: d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: e1, transaction: tx, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-18T00:00:00Z", observe: fn(g) { d0r_w_observe(group: g) })) { Present { value: _ } => true  Absent => false })
-            && (match d0_terminate_claim(store: store, escalation_id: "esc-e1" as NonEmptyStr, transaction: tx, held: e1.claim_generation, completed: true, cause: "", now: "2026-09-18T00:00:01Z") { D0ClaimTerminated => true  _ => false })
-            && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1002) {
-                  CurrentAuthorityRead { authority: suspended, head: _, generation: _, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } =>
-                    match pair_serving_authority_for(group: FabricGroupA) {
-                      Absent => false
-                      Present { value: resting } =>
-                        match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: suspended, next: resting, transaction: "tx-operator-restore" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1002) {
-                          AuthorityTransitionAppended { id: _, generation: g3, next: _ } => g3 == 3
-                          _ => false
-                        }
-                    }
-                  _ => false
-                })
-            && (match d0r_w_admitted(store: store, successor: h, tx: tx, escalation: "esc-e2" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-                  Absent => false
-                  Present { value: e2 } =>
-                    (match d0r_recovery_of(store: store, successor: h, tx: tx, escalation: "esc-e2" as NonEmptyStr, at: 1003) { Present { value: D0RecoverFirstWrite { claim_generation: _ } } => true  _ => false })
-                      && (match d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: e2, transaction: tx, executor: "witness" as NonEmptyStr, at: 1003, now: "2026-09-18T00:00:03Z", observe: fn(g) { d0r_w_observe(group: g) }) {
-                            D0Settled { decision: D0DecidedSuspend { next: _, reconciliation: _ }, generation: g5, receipt_path: _, entry_state: _ } => g5 == 5
-                            _ => false
-                          })
-                      && (match d0r_recovery_of(store: store, successor: h, tx: tx, escalation: "esc-e2" as NonEmptyStr, at: 1004) { Present { value: D0RecoverComplete { claim_generation: _, settled: st } } => (match st.next { SuspendedForAuthorizedSuccessor { group: _, authorization: _, exact_candidate_realization: _, lease: _, cleanup: _ } => true  _ => false })  _ => false })
-                })
-      }
-    })
-  })
-}
-
-fn d0r_drifted_hosts() -> List<HostIdentity> {
-  concat(fabric_group_hosts(g: FabricGroupA).skip(n: 1), [operator_host_srv1])
-}
-
-fn d0r_w_scoped(successor: ContentHash, tx: NonEmptyStr, escalation: NonEmptyStr) -> ScopedAuthorization<D0Subject>? {
-  d0r_w_authorization(successor: successor, tx: tx, escalation: escalation)
-}
-
-// THE ROSTER CHANGES AFTER THE CLAIM. Two lifecycles, one supplied drifted roster (srv1 in place
-// of one member) handed to the dispatcher as the current population:
-//   claim landed, no write → the dispatcher aborts the claim (AbortedBy) and the authority stays
-//     at generation 0;
-//   pending landed → the dispatcher still drives the transaction to a terminal under the original
-//     authorization: FencedRefusal at generation 2 naming both populations, the claim completed,
-//     nothing stranded.
-test fn a_population_change_after_the_claim_aborts_before_a_write_and_fences_after_one_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      let drifted = d0r_drifted_hosts()
-      match d0r_w_scoped(successor: h, tx: "tx-a" as NonEmptyStr, escalation: "esc-a" as NonEmptyStr) {
-        Absent => false
-        Present { value: scoped_a } =>
-      match d0r_w_admitted(store: store, successor: h, tx: "tx-a" as NonEmptyStr, escalation: "esc-a" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-        Absent => false
-        Present { value: _ } =>
-          d0r_exit_failed(e: d0_dispatch(store: store, g: FabricGroupA, group: "group-a", current_hosts: drifted, scoped: scoped_a, tx: "tx-a" as NonEmptyStr, esc: "esc-a" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1001, now: "2026-09-18T00:00:01Z", current: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1001)))
-            && (match d0_read_claim(store: store, escalation_id: "esc-a" as NonEmptyStr) { D0ClaimAt { state: AbortedBy { attempt: who, aborted_at: _, cause: _ }, generation: _ } => (who as String) == "tx-a"  _ => false })
-            && d0r_generation_is(store: store, generation: 0, at: 1001)
-            && (match d0r_w_scoped(successor: h, tx: "tx-b" as NonEmptyStr, escalation: "esc-b" as NonEmptyStr) {
-                  Absent => false
-                  Present { value: scoped_b } =>
-                    match d0r_w_admitted(store: store, successor: h, tx: "tx-b" as NonEmptyStr, escalation: "esc-b" as NonEmptyStr, executor: "witness" as NonEmptyStr) {
-                      Absent => false
-                      Present { value: b } =>
-                        match pair_serving_authority_for(group: FabricGroupA) {
-                          Absent => false
-                          Present { value: resting } =>
-                            (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-b" as NonEmptyStr, authorization_binding: b.binding, lease: d0_held_lease(group: FabricGroupA, transaction: "tx-b" as NonEmptyStr, executor: "witness" as NonEmptyStr, generation: 1) }, transaction: "tx-b" as NonEmptyStr, lifecycle: Present { value: b.binding }, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1002) {
-                               AuthorityTransitionAppended { id: _, generation: g1, next: _ } => g1 == 1
-                               _ => false
-                             })
-                              && d0r_exit_failed(e: d0_dispatch(store: store, g: FabricGroupA, group: "group-a", current_hosts: drifted, scoped: scoped_b, tx: "tx-b" as NonEmptyStr, esc: "esc-b" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1003, now: "2026-09-18T00:00:03Z", current: current_pair_serving_authority(store: store, group: FabricGroupA, at: 1003)))
-                              && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1004) {
-                                    CurrentAuthorityRead { authority: FencedRefusal { group: _, cause: c, disposition_authority: _ }, head: _, generation: g, grant: _, entry_state: Present { value: _ }, previous: _, admitted_by: _, transitions: _ } => g == 2 && (c as String).contains("host population changed")
-                                    _ => false
-                                  })
-                              && d0r_claim_is(store: store, escalation: "esc-b" as NonEmptyStr, by: "tx-b", completed: true)
-                              && (match current_pair_serving_authority(store: store, group: FabricGroupA, at: 1005) {
-                                    CurrentAuthorityRead { authority: fenced, head: _, generation: _, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } => {
-                                      let committed = map(spark_claimed_members_under(authorities: [fenced]), m => m.host)
-                                      length(committed) == 4
-                                        && all(fabric_group_hosts(g: FabricGroupA), h => any(committed, c => host_identity_eq(a: c, b: h)))
-                                        && !any(committed, c => host_identity_eq(a: c, b: operator_host_srv1))
-                                    }
-                                    _ => false
-                                  })
-                        }
-                    }
-                })
-      }
-      }
-    })
-  })
-}
-
-// TWO EXECUTORS, ONE PENDING LIFECYCLE. Executor 1 claims and writes the pending state under its
-// lifecycle (the binding names the executor) and dies. Executor 2, reading the same fleet-global
-// claim and the same transaction word, computes another lifecycle, finds no history for it and a
-// pending authority: it is REFUSED -- the claim stays ClaimedBy(tx), the authority stays pending at
-// generation 1 -- and executor 1's rerun still resumes and settles. A foreign executor never
-// terminalizes a claim it did not write under.
-test fn a_second_executor_cannot_abort_a_pending_lifecycle_it_did_not_write_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      let e2 = d0r_second_executor_layout(dir: dir)
-      let tx = "tx-d0" as NonEmptyStr
-      let esc = "esc-two-lifecycles" as NonEmptyStr
-      match d0r_w_scoped(successor: h, tx: tx, escalation: esc) {
-        Absent => false
-        Present { value: scoped } =>
-      match d0r_w_admitted(store: store, successor: h, tx: tx, escalation: esc, executor: "executor-1" as NonEmptyStr) {
-        Absent => false
-        Present { value: one } =>
-          match pair_serving_authority_for(group: FabricGroupA) {
-            Absent => false
-            Present { value: resting } =>
-              (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: tx, authorization_binding: one.binding, lease: d0_held_lease(group: FabricGroupA, transaction: tx, executor: "executor-1" as NonEmptyStr, generation: 1) }, transaction: tx, lifecycle: Present { value: one.binding }, grant: none, entry_state: none, actor: "executor-1" as NonEmptyStr, at: 1000) {
-                 AuthorityTransitionAppended { id: _, generation: g1, next: _ } => g1 == 1
-                 _ => false
-               })
-                && d0r_exit_failed(e: d0_dispatch(store: e2, g: FabricGroupA, group: "group-a", current_hosts: fabric_group_hosts(g: FabricGroupA), scoped: scoped, tx: tx, esc: esc, executor: "executor-2" as NonEmptyStr, at: 1001, now: "2026-09-18T00:00:01Z", current: current_pair_serving_authority(store: e2, group: FabricGroupA, at: 1001)))
-                && d0r_claim_is(store: e2, escalation: esc, by: "tx-d0", completed: false)
-                && (match current_pair_serving_authority(store: e2, group: FabricGroupA, at: 1001) {
-                      CurrentAuthorityRead { authority: SuspensionPendingReconciliation { group: _, transaction: t, authorization_binding: _, lease: _ }, head: _, generation: g, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } => g == 1 && (t as String) == "tx-d0"
-                      _ => false
-                    })
-                && (match d0r_w_resumed(store: store, successor: h, tx: tx, escalation: esc, executor: "executor-1" as NonEmptyStr) {
-                      Absent => false
-                      Present { value: resumed } =>
-                        (match d0r_settled_eligible(o: d0_transaction(store: store, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: resumed, transaction: tx, executor: "executor-1" as NonEmptyStr, at: 1002, now: "2026-09-18T00:00:02Z", observe: fn(g) { d0r_w_observe(group: g) })) { Present { value: _ } => true  Absent => false })
-                    })
-          }
-      }
-      }
-    })
-  })
-}
-
-// ── THE LIFECYCLE IS NOT THE EXECUTOR: ANY EXECUTOR COMPLETES A SETTLED CLAIM ─────────────────
-
-// E1 settles Suspended and dies before CompletedBy. E2 (its own binding, its own executor name),
-// reading the same grant and word, computes the SAME lifecycle -- the binding carries no executor
-// -- finds E1's settling transition, and COMPLETES the claim (exit 0: the settled state is the
-// eligible one) without touching the authority. Then, after an operator restores Active and a
-// third lifecycle settles by restoring Active and dies, E2 completes that one too rather than
-// starting a second first write: the claim is CompletedBy and the generation is unchanged.
-test fn any_executor_completes_a_settled_lifecycle_and_never_restarts_it_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, e1) {
-      let e2 = d0r_second_executor_layout(dir: dir)
-      let tx = "tx-d0" as NonEmptyStr
-      match d0r_w_scoped(successor: h, tx: tx, escalation: "esc-settled" as NonEmptyStr) {
-        Absent => false
-        Present { value: scoped_a } =>
-      match d0r_w_admitted(store: e1, successor: h, tx: tx, escalation: "esc-settled" as NonEmptyStr, executor: "executor-1" as NonEmptyStr) {
-        Absent => false
-        Present { value: one } =>
-          (match d0r_settled_eligible(o: d0_transaction(store: e1, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: one, transaction: tx, executor: "executor-1" as NonEmptyStr, at: 1000, now: "2026-09-18T00:00:00Z", observe: fn(g) { d0r_w_observe(group: g) })) { Present { value: _ } => true  Absent => false })
-            && (match d0_dispatch(store: e2, g: FabricGroupA, group: "group-a", current_hosts: fabric_group_hosts(g: FabricGroupA), scoped: scoped_a, tx: tx, esc: "esc-settled" as NonEmptyStr, executor: "executor-2" as NonEmptyStr, at: 1001, now: "2026-09-18T00:00:01Z", current: current_pair_serving_authority(store: e2, group: FabricGroupA, at: 1001)) { ExitSuccess => true  ExitFailure { code: _, reason: _ } => false })
-            && d0r_claim_is(store: e2, escalation: "esc-settled" as NonEmptyStr, by: "tx-d0", completed: true)
-            && d0r_generation_is(store: e2, generation: 2, at: 1001)
-            && (match current_pair_serving_authority(store: e1, group: FabricGroupA, at: 1002) {
-                  CurrentAuthorityRead { authority: suspended, head: _, generation: _, grant: _, entry_state: _, previous: _, admitted_by: _, transitions: _ } =>
-                    match pair_serving_authority_for(group: FabricGroupA) {
-                      Absent => false
-                      Present { value: resting } =>
-                        match pair_serving_authority_transition(store: e1, group: FabricGroupA, expected: suspended, next: resting, transaction: "tx-operator-restore" as NonEmptyStr, lifecycle: none, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1002) {
-                          AuthorityTransitionAppended { id: _, generation: g3, next: _ } => g3 == 3
-                          _ => false
-                        }
-                    }
-                  _ => false
-                })
-            && (match d0r_w_scoped(successor: h, tx: "tx-restore" as NonEmptyStr, escalation: "esc-restored" as NonEmptyStr) {
-                  Absent => false
-                  Present { value: scoped_b } =>
-                    match d0r_w_admitted(store: e1, successor: h, tx: "tx-restore" as NonEmptyStr, escalation: "esc-restored" as NonEmptyStr, executor: "executor-1" as NonEmptyStr) {
-                      Absent => false
-                      Present { value: two } =>
-                        (match d0_transaction(store: e1, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), admitted: two, transaction: "tx-restore" as NonEmptyStr, executor: "executor-1" as NonEmptyStr, at: 1003, now: "2026-09-18T00:00:03Z", observe: fn(g) { d0r_w_observe_live_declared(group: g) }) {
-                           D0Settled { decision: D0DecidedRestore { next: _, key: _ }, generation: g5, receipt_path: _, entry_state: _ } => g5 == 5
-                           _ => false
-                         })
-                          && (match d0_dispatch(store: e2, g: FabricGroupA, group: "group-a", current_hosts: fabric_group_hosts(g: FabricGroupA), scoped: scoped_b, tx: "tx-restore" as NonEmptyStr, esc: "esc-restored" as NonEmptyStr, executor: "executor-2" as NonEmptyStr, at: 1004, now: "2026-09-18T00:00:04Z", current: current_pair_serving_authority(store: e2, group: FabricGroupA, at: 1004)) { ExitFailure { code: _, reason: _ } => true  ExitSuccess => false })
-                          && d0r_claim_is(store: e2, escalation: "esc-restored" as NonEmptyStr, by: "tx-restore", completed: true)
-                          && d0r_generation_is(store: e2, generation: 5, at: 1004)
-                    }
-                })
-      }
-      }
-    })
-  })
-}
-
-// ── THE FROZEN RESERVATION REACHES THE PRODUCTION ADMISSION ───────────────────────────────────
-
-// A fenced lifecycle on the log froze [srv5, srv6, srv7, srv10] (the operator's population,
-// differing from today's roster by one host). The production standings fold over the CURRENT
-// authorities -- the same fold admit_unplaced_host_live runs after reading the executor's log --
-// commits srv10 (refused for a build, as a member of the claimed serving group) and does not
-// commit the roster's fourth host AS A GROUP MEMBER (it may still carry its cell-role commitment,
-// which is another authority's), while the resting projection over the source row says the
-// opposite. The reservation is the log's, not the roster's. The reservation is the log's, not the roster's.
-test fn the_production_admission_commits_the_frozen_hosts_of_a_fenced_lifecycle_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      match pair_serving_authority_for(group: FabricGroupA) {
-        Absent => false
-        Present { value: resting } => {
-          let roster = fabric_group_hosts(g: FabricGroupA)
-          let frozen = concat(roster.take(n: 3), [operator_host_srv10])
-          let dropped = match get(xs: roster, index: 3) { Present { value: d } => d  Absent => operator_host_srv10 }
-          (match pair_serving_authority_transition(store: store, group: FabricGroupA, expected: resting, next: FencedRefusal { group: FabricGroupA, hosts: frozen, cause: "witness: a fenced lifecycle over a frozen population" as NonEmptyStr, disposition_authority: "witness" as NonEmptyStr }, transaction: "tx-frozen" as NonEmptyStr, lifecycle: Present { value: h }, grant: none, entry_state: none, actor: "witness" as NonEmptyStr, at: 1000) {
-             AuthorityTransitionAppended { id: _, generation: g1, next: _ } => g1 == 1
-             _ => false
-           })
-            && (match spark_host_standings_current(current: [current_pair_serving_authority(store: store, group: FabricGroupA, at: 1001)], host_claims: [] as List<HostEffectRecord>) {
-                  CurrentStandingsUnread { cause: _ } => false
-                  CurrentStandingsRead { standings: st } =>
-                    (match admit_unplaced_host_in(raw: "srv10", purpose: "witness build" as NonEmptyStr, standings: st) { SparkHostRefused { cause: _ } => true  SparkHostAdmitted { host: _ } => false })
-                      && d0r_committed_to_group_a(standings: st, host: operator_host_srv10)
-                      && !d0r_committed_to_group_a(standings: st, host: dropped)
-                })
-            && (match spark_host_standings_current(current: [CurrentAuthorityUnread { group: FabricGroupA, step: "witness" as String, reason: "unread on purpose" as String }], host_claims: [] as List<HostEffectRecord>) { CurrentStandingsUnread { cause: _ } => true  CurrentStandingsRead { standings: _ } => false })
-        }
-      }
-    })
-  })
-}
-
-fn d0r_committed_to_group_a(standings: List<SparkHostStanding>, host: HostIdentity) -> Bool {
-  match spark_standing_of(standings: standings, host: host) {
-    Absent => false
-    Present { value: SparkHostUncommitted { host: _ } } => false
-    Present { value: SparkHostCommitted { host: _, commitments: c } } =>
-      any(spark_authority_held_causes_of(c: c), o => match o { MemberOfClaimedServingGroup { group: FabricGroupA } => true  _ => false })
-  }
-}
-
-// THE FILING IS FROZEN ONCE AND READ BACK AS THE SAME REQUEST, on the real store: the first
-// freeze lands at generation 1; a second freeze of the same escalation is refused as already
-// held and hands back the frozen text; the text re-derives the request the operator decided over
-// (same revision) with NO live subject consulted -- a rerun after the candidate re-keys or the
-// hosts move still finds the request it filed; and a rerun naming another transaction under the
-// same escalation is refused rather than resumed.
-test fn a_filing_frozen_once_is_read_back_as_the_same_request_without_a_live_subject_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      let subject = D0Subject { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), operation: D0SuspendForSuccessor { successor: h, cleanup: QuiescentReservedBaseline, term: second(count: 1000) } }
-      let text = (match d0_intent_text(subject: subject, group: FabricGroupA, transaction: "tx-d0" as NonEmptyStr) { Present { value: intent_text_w } => intent_text_w  Absent => "d0-intent-refused" })
-      let esc = "esc-d0-filing" as NonEmptyStr
-      let absent_before = match d0_read_filing(store: store, escalation_id: esc) { D0FilingAbsent => true  _ => false }
-      let frozen_text = d0_frozen_filing_text(intent_text: text, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr)
-      let frozen = match d0_freeze_filing(store: store, escalation_id: esc, intent_text: text, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) { D0FilingFrozen => true  _ => false }
-      let held = match d0_freeze_filing(store: store, escalation_id: esc, intent_text: join([text, "tampered"], ""), execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) { D0FilingAlreadyHeld { text: t } => t == frozen_text  _ => false }
-      let read = match d0_read_filing(store: store, escalation_id: esc) { D0FilingAt { text: t } => t == frozen_text  _ => false }
-      let same_request = match d0r_w_authorization(successor: h, tx: "tx-d0" as NonEmptyStr, escalation: esc) {
-        Absent => false
-        Present { value: AuthorizationGranted { grant: g, claim: _ } } =>
-          match d0_filed_request(text: frozen_text, group: FabricGroupA, escalation_id: esc, transaction: "tx-d0" as NonEmptyStr, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) {
-            D0FiledRequestFor { request: r, intent_text: _ } => (request_revision_of(request: r) as String) == (serialize_content_hash(hash: g.intent_hash) as String) && (match d0_subject_successor(s: r.subject) { Present { value: x } => content_hash_equal(left: x, right: h)  Absent => false })
-            D0FiledRequestRefused { reason: _ } => false
-          }
-        Present { value: _ } => false
-      }
-      let other_tx = match d0_filed_request(text: frozen_text, group: FabricGroupA, escalation_id: esc, transaction: "tx-else" as NonEmptyStr, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) { D0FiledRequestRefused { reason: _ } => true  _ => false }
-      absent_before && frozen && held && read && same_request && other_tx
-    })
-  })
-}
-
-// THE CLAIM IS AUTHORIZED AT THE INSTANT IT IS MADE, and the window has both bounds: an approval
-// whose execute_by has passed by the time the claim would land is refused at admission, and so is
-// an instant BEFORE the grant (a stale or fabricated clock) -- no claim is taken on the store and
-// no authority write follows either way -- while the same grant admitted at an instant inside its
-// window claims.
-test fn a_grant_whose_window_passed_before_the_claim_takes_no_claim_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      match d0r_w_authorization(successor: h, tx: "tx-d0" as NonEmptyStr, escalation: "esc-d0-late" as NonEmptyStr) {
-        Absent => false
-        Present { value: auth } => {
-          let late = match admit_d0_grant(store: store, authorization: auth, escalation_id: "esc-d0-late" as NonEmptyStr, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-d0" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-19T00:00:01Z") {
-            D0GrantRefused { cause: _ } => true
-            _ => false
-          }
-          let early = match admit_d0_grant(store: store, authorization: auth, escalation_id: "esc-d0-late" as NonEmptyStr, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-d0" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-17T23:59:59Z") {
-            D0GrantRefused { cause: _ } => true
-            _ => false
-          }
-          let unclaimed = match d0_read_claim(store: store, escalation_id: "esc-d0-late" as NonEmptyStr) { D0ClaimAbsent => true  _ => false }
-          let in_window = match admit_d0_grant(store: store, authorization: auth, escalation_id: "esc-d0-late" as NonEmptyStr, group: FabricGroupA, current_hosts: fabric_group_hosts(g: FabricGroupA), transaction: "tx-d0" as NonEmptyStr, executor: "witness" as NonEmptyStr, at: 1000, now: "2026-09-18T23:59:59Z") {
-            D0GrantAdmitted { admitted: _ } => true
-            _ => false
-          }
-          late && early && unclaimed && in_window && d0r_claim_is(store: store, escalation: "esc-d0-late" as NonEmptyStr, by: "tx-d0", completed: false)
-        }
-      }
-    })
-  })
-}
-
-// THE DOOR DECIDES WHICH RUN THIS IS FROM THE STORE, BY REAL EXECUTION. With nothing frozen, a first
-// run either refuses before filing and freezes nothing (no live subject yet), or -- the live V4.1
-// candidate is keyed since 2026-09-24 (test.claim.spark.v41_runtime_candidate
-// the_live_candidate_is_keyed_end_to_end) -- freezes exactly the filing it asks the operator over.
-// The claim holds in both worlds rather than assuming the one it was written in: an earlier revision
-// asserted the refusal, went stale when the candidate was keyed, and was not noticed because it had
-// never executed. Whatever was frozen, the same call is then a rerun carrying the frozen request with
-// no live subject consulted; the filing under another transaction's name refuses, and so does a rerun
-// executing another revision than the one that filed.
-fn d0r_after_frozen(store: FabricStorageBinding, esc: NonEmptyStr, successor: ContentHash) -> Bool {
-  let other_revision = match d0_run_kind(store: store, g: FabricGroupA, escalation_id: esc, transaction: "tx-d0" as NonEmptyStr, execution_revision: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" as NonEmptyStr) { D0RunRefused { reason: r } => r.contains("filed by revision aaaa")  _ => false }
-  let rerun = match d0_run_kind(store: store, g: FabricGroupA, escalation_id: esc, transaction: "tx-d0" as NonEmptyStr, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) {
-    D0Rerun { request: r } => (match d0_subject_successor(s: r.subject) { Present { value: x } => content_hash_equal(left: x, right: successor)  Absent => false }) && (r.escalation_id as String) == (esc as String)
-    _ => false
-  }
-  let other = match d0_run_kind(store: store, g: FabricGroupA, escalation_id: esc, transaction: "tx-else" as NonEmptyStr, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) { D0RunRefused { reason: r } => r.contains("tx-d0")  _ => false }
-  other_revision && rerun && other
-}
-
-test fn the_door_reads_the_frozen_filing_to_decide_a_rerun_without_a_live_subject_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      let esc = "esc-d0-door" as NonEmptyStr
-      match d0_run_kind(store: store, g: FabricGroupA, escalation_id: esc, transaction: "tx-d0" as NonEmptyStr, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) {
-        D0Rerun { request: _ } => false
-        D0FirstRun { request: live } =>
-          (match d0_read_filing(store: store, escalation_id: esc) { D0FilingAt { text: _ } => true  _ => false })
-            && d0r_after_frozen(store: store, esc: esc, successor: match d0_subject_successor(s: live.subject) { Present { value: x } => x  Absent => content_hash_of_value(value: "no successor" as NonEmptyStr) })
-        D0RunRefused { reason: _ } => {
-          let nothing_frozen = match d0_read_filing(store: store, escalation_id: esc) { D0FilingAbsent => true  _ => false }
-          let subject = D0Subject { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), operation: D0SuspendForSuccessor { successor: h, cleanup: QuiescentReservedBaseline, term: second(count: 1000) } }
-          let frozen = match d0_intent_text(subject: subject, group: FabricGroupA, transaction: "tx-d0" as NonEmptyStr) {
-            Absent => false
-            Present { value: text } => match d0_freeze_filing(store: store, escalation_id: esc, intent_text: text, execution_revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr) { D0FilingFrozen => true  _ => false }
-          }
-          nothing_frozen && frozen && d0r_after_frozen(store: store, esc: esc, successor: h)
-        }
-      }
-    })
-  })
-}
-
-// ── A STANDING-GRANT LIFECYCLE RESUMES FROM ITS FROZEN APPROVAL, NOT CURRENT MAIN (side-chat review of
-// #13102), BY REAL EXECUTION ON THE STORE ────────────────────────────────────────────────────────────
-//
-// The fresh start freezes the approved row's digest into the filing. Then the row on main CHANGES, which is
-// modelled at the rerun's interface as the unproven fresh proof a run would take now -- yet the door reads the frozen proof back from the store, honors the grant because
-// the executed row still digests to it, and the recovery join reaches the original lifecycle's next step in
-// all three crash states. No broker decision is read anywhere on this path.
-fn d0r_release_subject() -> D0Subject {
-  D0Subject { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), operation: D0ReleaseToFleet { cause: "witness cause" as NonEmptyStr, approval: "witness approval" as NonEmptyStr } }
-}
-
-data d0r_row_digest: NonEmptyStr = "sha256:4444444444444444444444444444444444444444444444444444444444444444" as NonEmptyStr
-
-test fn a_standing_release_resumes_from_its_frozen_approval_after_the_main_row_changes_by_real_execution() -> Bool {
-  d0r_with_hash(scenario: fn(h) {
-    d0r_with_remote(scenario: fn(dir, store) {
-      let esc = "d0-group-a-release-glm53-standing-2026-10-03" as NonEmptyStr
-      let rev = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as NonEmptyStr
-      match d0_intent_text(subject: d0r_release_subject(), group: FabricGroupA, transaction: "tx-rel" as NonEmptyStr) {
-        Absent => false
-        Present { value: text } => {
-          let frozen = match d0_freeze_filing_with(store: store, escalation_id: esc, intent_text: text, execution_revision: rev, proof: D0GrantRowApproved { row_digest: d0r_row_digest }) { D0FilingFrozen => true  _ => false }
-          let proof_read_back = match d0_filed_grant_proof(store: store, escalation_id: esc) { D0GrantRowApproved { row_digest: d } => (d as String) == (d0r_row_digest as String)  D0GrantRowUnproven => false }
-          match d0_run_kind_with(store: store, g: FabricGroupA, escalation_id: esc, transaction: "tx-rel" as NonEmptyStr, execution_revision: rev, fresh_proof: D0GrantRowUnproven) {
-            D0Rerun { request: req } => {
-              let fp = d0_filed_grant_proof(store: store, escalation_id: esc)
-              let honored = match d0_honored_standing_grant(request: req, frozen: fp, executed: ExecutedGrantRowRead { content: "the approved row", digest: d0r_row_digest }) { Present { value: _ } => true  Absent => false }
-              let edited_refused = match d0_honored_standing_grant(request: req, frozen: fp, executed: ExecutedGrantRowRead { content: "a branch edit", digest: "sha256:5555555555555555555555555555555555555555555555555555555555555555" as NonEmptyStr }) { Present { value: _ } => false  Absent => true }
-              let claimed = match d0_claim_grant(store: store, escalation_id: esc, transaction: "tx-rel" as NonEmptyStr, now: "2026-10-03T12:00:00Z") { D0ClaimHeld { generation: _ } => true  _ => false }
-              let lc = h
-              let active = PairServingActive { group: FabricGroupA, exact_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr } }
-              let released = ReleasedToFleet { group: FabricGroupA, release_receipt: h }
-              let claim = d0_read_claim(store: store, escalation_id: esc)
-              let first_write = match d0_recovery(claim: claim, transaction: "tx-rel" as NonEmptyStr, lifecycle: Present { value: lc }, executor: "witness" as NonEmptyStr, current: active, transitions: [] as List<AuthorityTransitionRecord>) { D0RecoverFirstWrite { claim_generation: _ } => true  _ => false }
-              let resume = match d0_recovery(claim: claim, transaction: "tx-rel" as NonEmptyStr, lifecycle: Present { value: lc }, executor: "witness" as NonEmptyStr, current: d0w_pending(tx: "tx-rel", h: lc), transitions: [d0w_rec_of(id: "e1", tx: "tx-rel", lifecycle: Present { value: lc }, next: d0w_pending(tx: "tx-rel", h: lc))]) { D0RecoverResume { claim_generation: _ } => true  _ => false }
-              let complete = match d0_recovery(claim: claim, transaction: "tx-rel" as NonEmptyStr, lifecycle: Present { value: lc }, executor: "witness" as NonEmptyStr, current: released, transitions: [d0w_rec_of(id: "e2", tx: "tx-rel", lifecycle: Present { value: lc }, next: released)]) { D0RecoverComplete { claim_generation: _, settled: _ } => true  _ => false }
-              frozen && proof_read_back && honored && edited_refused && claimed && first_write && resume && complete
-            }
-            _ => false
-          }
-        }
-      }
-    })
-  })
-}
diff --git a/dag/test/claim/spark/pair_serving_d0_release_witness_test.dag b/dag/test/claim/spark/pair_serving_d0_release_witness_test.dag
deleted file mode 100644
index 3941efd630b..00000000000
--- a/dag/test/claim/spark/pair_serving_d0_release_witness_test.dag
+++ /dev/null
@@ -1,462 +0,0 @@
-module test.claim.spark.pair_serving_d0_release_witness
-
-import std.logic { Bool }
-import std.types { String, NonEmptyStr, List }
-import std.nat { Nat }
-import std.optional { Present, Absent }
-import std.measure { kibibyte, mebibyte, second }
-import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest, content_hash_equal, content_hash_of_value }
-import std.temporal_effect { HeldLease, held_lease, LeaseEpoch, LeaseRunningExpected }
-import product.host_identity { HostIdentity }
-import extdeps.systemd { Active }
-import extdeps.nvidia.system_management_interface { UsedMemoryReported }
-import extdeps.linux.proc_net_tcp { TcpSocketRow }
-import gunbc.compute.host_occupancy { HostOccupancyRead, HostOccupancyUnread, ServingUnitActive, GpuComputeProcess }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8 }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB, fabric_group_hosts }
-import gunbc.rung_drop { Standing, Retired }
-import gunbc.spark.pair_serving_realization { spark_pair_head_unit_name, spark_pair_worker_unit_name }
-import gunbc.spark.pair_incumbent_identity { DeclaredPairRealizationUnavailable }
-import gunbc.spark.released_baseline { QuiescentReservedBaseline }
-import gunbc.spark.pair_serving_authority {
-  PairServingGroupAuthority, PairServingActive, ReleasedToFleet, FencedRefusal, PairRealizationUnestablished, pair_serving_committed_hosts,
-}
-import std.scoped_authorization { OperatorGrant, AttemptIdentity, ClaimedBy, authorization_scope_eq, parse_intent_scopes, AuthorizationRequest, authorize, AuthorizationPermitted, AuthorizationRefused }
-import gunbc.spark.pair_serving_d0 { d0_standing_grant_for, d0_binding_text, d0_binding_text_with, D0AuthorizationBasis, D0BasisBroker, D0BasisStandingGrant }
-import gunbc.spark.pair_serving_d0_door { standing_grant_row_judged, d0_honored_standing_grant, StandingGrantRowOnMain, StandingGrantRowNotOnMain, ExecutedGrantRowRead, ExecutedGrantRowUnread, grant_row_standing_over, grant_row_proof_over, GrantRowBlobRead, GrantRowBlobUnread }
-import gunbc.spark.pair_serving_d0 { D0GrantRowApproved, D0GrantRowUnproven, d0_frozen_filing_text_with, parse_d0_frozen_filing }
-import gunbc.auth.standing_operator_grant { group_a_dev_standing_grant, standing_grant_covers, standing_grant_authorization, StandingArmLaunch, StandingGrantFabricGroup }
-import gunbc.spark.pair_serving_d0 {
-  D0Subject, D0SuspendForSuccessor, D0ReleaseToFleet, RankVacancyReading, RankOccupancyReading, D0Observation,
-  IncumbentReading, IncumbentDidNotAnswer, IncumbentAnsweredUnread, IncumbentRouteUnread,
-  HeadEndpointQuiet, HeadEndpointListening, HeadEndpointEngineProcess,
-  D0Decision, D0DecidedRelease, D0DecidedFence, D0DecidedSuspend, D0DecidedRestore, D0HostNotQuiescent,
-  d0_decide, d0_decision_next, d0_decision_is_eligible,
-  d0_intent_text, parse_d0_intent_text, d0_release_scope, d0_required_scope,
-  D0ClaimAt, D0Recovery, D0RecoverAbort, D0RecoverResume, D0RecoverComplete, d0_recovery,
-  d0_single_lifecycle_admits_under, d0_release_lifecycle_escalation_id,
-}
-import gunbc.spark.pair_serving_d0_authorization { d0_release_row_for, d0_live_subject_for, D0SubjectFor }
-import gunbc.spark.pair_serving_authority_log { AuthorityTransitionRecord }
-import test.claim.spark.pair_serving_d0_witness { d0w_rec_of, d0w_pending }
-
-// ── THE RELEASE DECISION, OVER SUPPLIED READINGS ────────────────────────────────────────────────────
-//
-// The release settles through the same transaction as a suspension; what is new is the decision over
-// the readings and the subject's intent. Both are pure, so every arm is driven here with a constructed
-// observation; the fleet readings themselves are D0's observer's, executed by its wet door.
-
-fn rw_sha(hex: String) -> ContentHash? {
-  match sha256_hex_digest(hex: hex) {
-    Absent => none
-    Present { value: d } => Present { value: Sha256Hash(d) }
-  }
-}
-
-fn rw_release_subject() -> D0Subject {
-  D0Subject { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), operation: D0ReleaseToFleet { cause: "witness cause" as NonEmptyStr, approval: "witness approval" as NonEmptyStr } }
-}
-
-fn rw_grant(h: ContentHash) -> OperatorGrant<D0Subject> {
-  OperatorGrant {
-    escalation_id: "rel-w" as NonEmptyStr,
-    subject: rw_release_subject(),
-    scopes: [d0_release_scope()],
-    purpose: "witness release" as NonEmptyStr,
-    attempt: "tx-rel" as AttemptIdentity,
-    intent_hash: h,
-    granted_by: "witness" as NonEmptyStr,
-    granted_at: "2026-10-03T00:00:00Z",
-    expires_at: "2026-10-04T00:00:00Z",
-  }
-}
-
-fn rw_lease(h: ContentHash) -> HeldLease {
-  held_lease(epoch: LeaseEpoch { lease_key: "tx-rel" as NonEmptyStr, resource_fingerprint: h, owner_fingerprint: h, generation: 1 }, observed: LeaseRunningExpected)
-}
-
-fn rw_active() -> PairServingGroupAuthority {
-  PairServingActive { group: FabricGroupA, exact_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr } }
-}
-
-fn rw_empty(h: HostIdentity) -> RankVacancyReading {
-  RankVacancyReading { host: h, reading: HostOccupancyRead { occupants: [], available: kibibyte(count: 120000000) } }
-}
-
-fn rw_quiet_vacancy() -> List<RankVacancyReading> {
-  map(fabric_group_hosts(g: FabricGroupA), h => rw_empty(h: h))
-}
-
-fn rw_quiet_route() -> IncumbentReading {
-  IncumbentDidNotAnswer { receipt: "the front door could not be connected" as NonEmptyStr, head: HeadEndpointQuiet }
-}
-
-fn rw_decide(h: ContentHash, incumbent: IncumbentReading, vacancy: List<RankVacancyReading>) -> D0Decision {
-  d0_decide(
-    declared: DeclaredPairRealizationUnavailable { group: FabricGroupA, obligation: "a release reads no declared realization" as NonEmptyStr },
-    observation: D0Observation { group: FabricGroupA, incumbent: incumbent, ranks: [] as List<RankOccupancyReading>, vacancy: vacancy },
-    active: rw_active(),
-    lease: rw_lease(h: h),
-    grant: rw_grant(h: h),
-  )
-}
-
-fn rw_with(scenario: fn(ContentHash) -> Bool) -> Bool {
-  match rw_sha(hex: "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd") {
-    Absent => false
-    Present { value: h } => scenario(h)
-  }
-}
-
-fn rw_not_quiescent(d: D0Decision, fragment: String) -> Bool {
-  match d {
-    D0DecidedFence { next: FencedRefusal { group: _, hosts: _, cause: c, disposition_authority: _ }, cause: D0HostNotQuiescent { cause: _ } } => string_contains(s: c as String, pattern: fragment)
-    D0DecidedFence { next: _, cause: _ } => false
-    D0DecidedRelease { group: _, hosts: _ } => false
-    D0DecidedSuspend { next: _, reconciliation: _ } => false
-    D0DecidedRestore { next: _, key: _ } => false
-  }
-}
-
-// THE POSITIVE CONTROL: a silent route, a quiet head and every host read with no occupant releases --
-// and the next authority is ReleasedToFleet naming exactly the recorded receipt, which commits no host.
-test fn rw_every_host_quiescent_releases_under_the_receipt() -> Bool {
-  rw_with(scenario: fn(h) {
-    let d = rw_decide(h: h, incumbent: rw_quiet_route(), vacancy: rw_quiet_vacancy())
-    d0_decision_is_eligible(d: d)
-      && match d0_decision_next(d: d, entry_state: h) {
-        ReleasedToFleet { group: _, release_receipt: r } => content_hash_equal(left: r, right: h)
-        _ => false
-      }
-      && length(pair_serving_committed_hosts(a: d0_decision_next(d: d, entry_state: h))) == 0
-  })
-}
-
-// ONE REFUSAL PER OCCUPANT READING KIND.
-test fn rw_an_answering_front_door_refuses_the_release() -> Bool {
-  rw_with(scenario: fn(h) { rw_not_quiescent(d: rw_decide(h: h, incumbent: IncumbentAnsweredUnread { cause: "witness 500" as NonEmptyStr }, vacancy: rw_quiet_vacancy()), fragment: "front door answered") })
-}
-
-test fn rw_a_listener_on_the_head_refuses_the_release() -> Bool {
-  rw_with(scenario: fn(h) { rw_not_quiescent(d: rw_decide(h: h, incumbent: IncumbentDidNotAnswer { receipt: "curl 7" as NonEmptyStr, head: HeadEndpointListening { port: 30000, rows: [] as List<TcpSocketRow> } }, vacancy: rw_quiet_vacancy()), fragment: "LISTEN on port 30000") })
-}
-
-test fn rw_an_engine_process_on_the_head_refuses_the_release() -> Bool {
-  rw_with(scenario: fn(h) { rw_not_quiescent(d: rw_decide(h: h, incumbent: IncumbentDidNotAnswer { receipt: "curl 7" as NonEmptyStr, head: HeadEndpointEngineProcess { listing: "4242 vllm" } }, vacancy: rw_quiet_vacancy()), fragment: "engine process") })
-}
-
-test fn rw_a_running_serving_unit_on_any_host_refuses_the_release() -> Bool {
-  rw_with(scenario: fn(h) {
-    let vacancy = concat(
-      [RankVacancyReading { host: operator_host_srv7, reading: HostOccupancyRead { occupants: [ServingUnitActive { unit: spark_pair_worker_unit_name, state: Active }], available: kibibyte(count: 1) } }],
-      map(filter(fabric_group_hosts(g: FabricGroupA), x => (x as String) != (operator_host_srv7 as String)), x => rw_empty(h: x)))
-    rw_not_quiescent(d: rw_decide(h: h, incumbent: rw_quiet_route(), vacancy: vacancy), fragment: "srv7 is occupied")
-  })
-}
-
-test fn rw_a_gpu_process_on_any_host_refuses_the_release() -> Bool {
-  rw_with(scenario: fn(h) {
-    let vacancy = concat(
-      [RankVacancyReading { host: operator_host_srv8, reading: HostOccupancyRead { occupants: [GpuComputeProcess { pid: 99, process_name: "python3", used: UsedMemoryReported { used: mebibyte(count: 1000) } }], available: kibibyte(count: 1) } }],
-      map(filter(fabric_group_hosts(g: FabricGroupA), x => (x as String) != (operator_host_srv8 as String)), x => rw_empty(h: x)))
-    rw_not_quiescent(d: rw_decide(h: h, incumbent: rw_quiet_route(), vacancy: vacancy), fragment: "srv8 is occupied")
-  })
-}
-
-// ABSENCE IS NOT VACANCY: an unread host, and a host with no reading at all, refuse.
-test fn rw_an_unread_or_missing_host_refuses_the_release() -> Bool {
-  rw_with(scenario: fn(h) {
-    let unread = concat(
-      [RankVacancyReading { host: operator_host_srv5, reading: HostOccupancyUnread { cause: "witness: nvidia-smi did not run" } }],
-      map(filter(fabric_group_hosts(g: FabricGroupA), x => (x as String) != (operator_host_srv5 as String)), x => rw_empty(h: x)))
-    let missing = map(filter(fabric_group_hosts(g: FabricGroupA), x => (x as String) != (operator_host_srv6 as String)), x => rw_empty(h: x))
-    rw_not_quiescent(d: rw_decide(h: h, incumbent: rw_quiet_route(), vacancy: unread), fragment: "occupancy unread")
-      && rw_not_quiescent(d: rw_decide(h: h, incumbent: rw_quiet_route(), vacancy: missing), fragment: "no occupancy reading was taken")
-  })
-}
-
-// AN UNREAD ROUTE FENCES as D0's other unread readings do, never releases.
-test fn rw_an_unread_route_never_releases() -> Bool {
-  rw_with(scenario: fn(h) {
-    match rw_decide(h: h, incumbent: IncumbentRouteUnread { cause: "witness" as NonEmptyStr }, vacancy: rw_quiet_vacancy()) {
-      D0DecidedRelease { group: _, hosts: _ } => false
-      D0DecidedFence { next: _, cause: _ } => true
-      D0DecidedSuspend { next: _, reconciliation: _ } => false
-      D0DecidedRestore { next: _, key: _ } => false
-    }
-  })
-}
-
-// AN ALREADY-RELEASED GROUP IS REFUSED: a held claim with no write and an authority that is not Active
-// has nothing to do under this consent, so the recovery join aborts the claim rather than writing.
-test fn rw_an_already_released_group_is_refused() -> Bool {
-  rw_with(scenario: fn(h) {
-    match d0_recovery(
-      claim: D0ClaimAt { state: ClaimedBy { attempt: "tx-rel" as AttemptIdentity, claimed_at: "2026-10-03T00:00:00Z" }, generation: 1 },
-      transaction: "tx-rel" as NonEmptyStr,
-      lifecycle: Present { value: h },
-      executor: "srv1" as NonEmptyStr,
-      current: ReleasedToFleet { group: FabricGroupA, release_receipt: h },
-      transitions: [] as List<AuthorityTransitionRecord>,
-    ) {
-      D0RecoverAbort { claim_generation: _, cause: c } => string_contains(s: c, pattern: "not Active")
-      _ => false
-    }
-  })
-}
-
-// ── THE INTENT: A RELEASE ROUND-TRIPS UNDER ITS OWN SCOPE, AND IS NOT A SUSPENSION ─────────────────
-
-test fn rw_a_release_intent_round_trips_under_the_release_scope() -> Bool {
-  match d0_intent_text(subject: rw_release_subject(), group: FabricGroupA, transaction: "tx-rel" as NonEmptyStr) {
-    Absent => false
-    Present { value: text } =>
-      (match parse_d0_intent_text(text: text) {
-        Absent => false
-        Present { value: p } => match p.subject.operation {
-          D0ReleaseToFleet { cause: c, approval: a } => (c as String) == "witness cause" && (a as String) == "witness approval"
-          D0SuspendForSuccessor { successor: _, cleanup: _, term: _ } => false
-        }
-      })
-      && (match parse_intent_scopes(text: text) {
-        Absent => false
-        Present { value: f } => all(f.scopes, sc => authorization_scope_eq(a: sc, b: d0_release_scope())) && !any(f.scopes, sc => authorization_scope_eq(a: sc, b: d0_required_scope()))
-      })
-  }
-}
-
-// THE RELEASE IS REQUESTED BY ITS ROW: the row's escalation yields a release subject for Group A, any
-// other escalation the suspension for the keyed successor.
-test fn rw_the_approved_release_row_names_group_a_and_its_escalation() -> Bool {
-  match d0_release_row_for(group: FabricGroupA, escalation_id: d0_release_lifecycle_escalation_id) {
-    Absent => false
-    Present { value: r } => string_contains(s: r.approval as String, pattern: "operator approval 2026-10-03")
-  }
-    && match d0_release_row_for(group: FabricGroupA, escalation_id: "some-other-escalation" as NonEmptyStr) { Present { value: _ } => false  Absent => true }
-}
-
-// THE STORE WALL ADMITS EXACTLY THE RULED RELEASE LIFECYCLE: its escalation on Group A while the row
-// stands; another escalation, Group B, or the row retired all refuse.
-test fn rw_the_store_wall_admits_only_the_ruled_release_lifecycle() -> Bool {
-  d0_single_lifecycle_admits_under(standing: Standing, group: FabricGroupA, escalation_id: d0_release_lifecycle_escalation_id)
-    && !d0_single_lifecycle_admits_under(standing: Standing, group: FabricGroupA, escalation_id: "d0-group-a-something-else" as NonEmptyStr)
-    && !d0_single_lifecycle_admits_under(standing: Standing, group: FabricGroupB, escalation_id: d0_release_lifecycle_escalation_id)
-    && !d0_single_lifecycle_admits_under(standing: Retired { trigger_fired: "witness" as NonEmptyStr }, group: FabricGroupA, escalation_id: d0_release_lifecycle_escalation_id)
-}
-
-// ── THE STANDING OPERATOR GRANT (gunbc.auth.standing_operator_grant) ────────────────────────────────
-
-fn rw_release_request(group: FabricGroup, hosts: List<HostIdentity>, h: ContentHash) -> AuthorizationRequest<D0Subject> {
-  AuthorizationRequest {
-    escalation_id: d0_release_lifecycle_escalation_id,
-    scopes: [d0_release_scope()],
-    subject: D0Subject { group: group, hosts: hosts, operation: D0ReleaseToFleet { cause: "witness cause" as NonEmptyStr, approval: "witness approval" as NonEmptyStr } },
-    purpose: "witness release" as NonEmptyStr,
-    attempt: "tx-rel" as AttemptIdentity,
-    intent_hash: h,
-    destructive: true,
-  }
-}
-
-// THE POSITIVE CONTROL: a Group A release over srv5-srv8 is admitted under the standing grant, and the
-// grant it mints is permitted by std.scoped_authorization authorize over that exact request.
-test fn rw_a_group_a_release_is_admitted_under_the_standing_grant() -> Bool {
-  rw_with(scenario: fn(h) {
-    let req = rw_release_request(group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), h: h)
-    match d0_standing_grant_for(request: req) {
-      Absent => false
-      Present { value: g } =>
-        match authorize(authorization: standing_grant_authorization(g: g, request: req, issued: "2026-10-03T05:10:00Z", expires: "2026-10-03T05:40:00Z"), request: req, observed_at: "2026-10-03T05:11:00Z") {
-          AuthorizationPermitted { grant: _ } => true
-          AuthorizationRefused { cause: _ } => false
-        }
-    }
-  })
-}
-
-// THE SAME REQUEST FOR GROUP B IS NOT COVERED: it goes to the broker, and refuses without it.
-test fn rw_the_same_release_for_group_b_is_not_covered() -> Bool {
-  rw_with(scenario: fn(h) {
-    match d0_standing_grant_for(request: rw_release_request(group: FabricGroupB, hosts: fabric_group_hosts(g: FabricGroupB), h: h)) {
-      Present { value: _ } => false
-      Absent => true
-    }
-  })
-}
-
-// AN EFFECT OUTSIDE THE SCOPE IS NOT COVERED: a host outside srv5-srv8, and a suspension (an effect the
-// grant does not name) both fall back to the broker.
-test fn rw_an_effect_outside_the_scope_is_not_covered() -> Bool {
-  rw_with(scenario: fn(h) {
-    let foreign_host = match d0_standing_grant_for(request: rw_release_request(group: FabricGroupA, hosts: concat(fabric_group_hosts(g: FabricGroupA), ["srv9" as HostIdentity]), h: h)) { Present { value: _ } => false  Absent => true }
-    let suspend = AuthorizationRequest {
-      escalation_id: d0_release_lifecycle_escalation_id,
-      scopes: [d0_required_scope()],
-      subject: D0Subject { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), operation: D0SuspendForSuccessor { successor: h, cleanup: QuiescentReservedBaseline, term: second(count: 1000) } },
-      purpose: "witness suspend" as NonEmptyStr,
-      attempt: "tx-rel" as AttemptIdentity,
-      intent_hash: h,
-      destructive: true,
-    }
-    foreign_host && match d0_standing_grant_for(request: suspend) { Present { value: _ } => false  Absent => true }
-      && !standing_grant_covers(g: group_a_dev_standing_grant, scope: StandingGrantFabricGroup { group: FabricGroupA, hosts: [] as List<HostIdentity> }, effect: StandingArmLaunch)
-  })
-}
-
-// ── A STANDING GRANT IS ONE LIFECYCLE ACROSS RERUNS (side-chat review of #13067) ────────────────────
-//
-// Each run mints the standing grant with ITS OWN live window, so the binding must not carry that window:
-// a crash after the pending write, or after ReleasedToFleet before the claim completed, must be finished by
-// a later rerun whose window differs. The binding text is what D0 digests (admitted_with_binding hashes
-// exactly this text), so equal texts are equal bindings. Supplied here at the recovery join's interface:
-// the lifecycle digests stand in for the SHA-256 of each run's text.
-fn rw_permitted(req: AuthorizationRequest<D0Subject>, issued: String, expires: String, at: String) -> OperatorGrant<D0Subject>? {
-  match d0_standing_grant_for(request: req) {
-    Absent => none
-    Present { value: g } =>
-      match authorize(authorization: standing_grant_authorization(g: g, request: req, issued: issued, expires: expires), request: req, observed_at: at) {
-        AuthorizationPermitted { grant: p } => Present { value: p }
-        AuthorizationRefused { cause: _ } => none
-      }
-  }
-}
-
-data rw_standing_basis: D0AuthorizationBasis = D0BasisStandingGrant { identity: group_a_dev_standing_grant.identity }
-
-fn rw_two_runs(h: ContentHash, f: fn(String, String) -> Bool) -> Bool {
-  let req = rw_release_request(group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), h: h)
-  match rw_permitted(req: req, issued: "2026-10-03T05:10:00Z", expires: "2026-10-03T05:40:00Z", at: "2026-10-03T05:11:00Z") {
-    Absent => false
-    Present { value: first } => match rw_permitted(req: req, issued: "2026-10-03T09:00:00Z", expires: "2026-10-03T09:30:00Z", at: "2026-10-03T09:01:00Z") {
-      Absent => false
-      Present { value: later } => f(d0_binding_text_with(grant: first, claim_generation: 1, basis: rw_standing_basis), d0_binding_text_with(grant: later, claim_generation: 1, basis: rw_standing_basis))
-    }
-  }
-}
-
-// THE BINDING: two runs of one standing release with different windows bind the same lifecycle and name
-// the grant; the expiry is not in it. (A broker grant keeps its expiry: d0_binding_lifecycle_term's other
-// arm, unchanged, exercised by the suspension witnesses.)
-test fn rw_a_standing_release_binds_one_lifecycle_across_windows() -> Bool {
-  rw_with(scenario: fn(h) {
-    rw_two_runs(h: h, f: fn(a, b) {
-      a == b && string_contains(s: a, pattern: join(["standing_grant=", group_a_dev_standing_grant.identity as String], "")) && !string_contains(s: a, pattern: "expires_at=")
-    })
-  })
-}
-
-// PENDING -> A LATER RERUN RESUMES: the first run wrote the pending state under its binding and died; the
-// later run, with a later window, presents its own binding and the recovery join resumes.
-test fn rw_a_pending_release_is_resumed_by_a_later_rerun() -> Bool {
-  rw_with(scenario: fn(h) {
-    rw_two_runs(h: h, f: fn(a, b) {
-      let first = content_hash_of_value(value: a as NonEmptyStr)
-      let later = content_hash_of_value(value: b as NonEmptyStr)
-      match d0_recovery(
-        claim: D0ClaimAt { state: ClaimedBy { attempt: "tx-rel" as AttemptIdentity, claimed_at: "2026-10-03T05:11:00Z" }, generation: 1 },
-        transaction: "tx-rel" as NonEmptyStr,
-        lifecycle: Present { value: later },
-        executor: "witness" as NonEmptyStr,
-        current: d0w_pending(tx: "tx-rel", h: first),
-        transitions: [d0w_rec_of(id: "e1", tx: "tx-rel", lifecycle: Present { value: first }, next: d0w_pending(tx: "tx-rel", h: first))],
-      ) {
-        D0RecoverResume { claim_generation: _ } => true
-        _ => false
-      }
-    })
-  })
-}
-
-// SETTLED RELEASE -> A LATER RERUN COMPLETES THE CLAIM: the release landed (ReleasedToFleet) and the run
-// died before completing its claim; the later run finds its own lifecycle's settling record and completes.
-test fn rw_a_settled_release_is_completed_by_a_later_rerun() -> Bool {
-  rw_with(scenario: fn(h) {
-    rw_two_runs(h: h, f: fn(a, b) {
-      let first = content_hash_of_value(value: a as NonEmptyStr)
-      let later = content_hash_of_value(value: b as NonEmptyStr)
-      let released = ReleasedToFleet { group: FabricGroupA, release_receipt: h }
-      match d0_recovery(
-        claim: D0ClaimAt { state: ClaimedBy { attempt: "tx-rel" as AttemptIdentity, claimed_at: "2026-10-03T05:11:00Z" }, generation: 1 },
-        transaction: "tx-rel" as NonEmptyStr,
-        lifecycle: Present { value: later },
-        executor: "witness" as NonEmptyStr,
-        current: released,
-        transitions: [d0w_rec_of(id: "e2", tx: "tx-rel", lifecycle: Present { value: first }, next: released)],
-      ) {
-        D0RecoverComplete { claim_generation: _, settled: _ } => true
-        _ => false
-      }
-    })
-  })
-}
-
-// ── THE GRANT IS HONORED ONLY AS THE OPERATOR MERGED IT (review 74677) ─────────────────────────────
-//
-// The judgement over the two reads, supplied at its interface: identical bytes honor; a main with no row,
-// a branch-edited row, or an unreadable executed row do not. Then the door's coverage under each standing:
-// the same covered Group A release is honored on main and NOT honored off it, so it takes the broker path.
-test fn rw_the_grant_row_is_honored_only_when_byte_identical_to_main() -> Bool {
-  (match standing_grant_row_judged(executed: "row", executed_read: true, on_main: "row", main_read: true, main_stderr: "") { StandingGrantRowOnMain => true  StandingGrantRowNotOnMain { cause: _ } => false })
-    && (match standing_grant_row_judged(executed: "row", executed_read: true, on_main: "", main_read: false, main_stderr: "fatal: path does not exist in origin/main") { StandingGrantRowOnMain => false  StandingGrantRowNotOnMain { cause: c } => string_contains(s: c, pattern: "has not merged") })
-    && (match standing_grant_row_judged(executed: "row edited", executed_read: true, on_main: "row", main_read: true, main_stderr: "") { StandingGrantRowOnMain => false  StandingGrantRowNotOnMain { cause: c } => string_contains(s: c, pattern: "differs") })
-    && (match standing_grant_row_judged(executed: "", executed_read: false, on_main: "row", main_read: true, main_stderr: "") { StandingGrantRowOnMain => false  StandingGrantRowNotOnMain { cause: _ } => true })
-}
-
-// ONE AUTHORIZATION FACT, ONE READ. The standing is judged over the CAPTURED row: the supplied blob
-// producer sees only the captured content, so a working path that changed after capture -- here back to
-// main's bytes -- cannot rescue a captured row that differs from main, and the proof's digest is always
-// the captured row's. RED: a judgment that hashed the path again would admit the changed row.
-test fn rw_admission_follows_the_captured_row_not_the_path() -> Bool {
-  let blob_of = fn(c) { GrantRowBlobRead { blob: join(["blob(", c, ")"], "") } }
-  let main = GrantRowBlobRead { blob: "blob(main row)" }
-  let captured_changed = ExecutedGrantRowRead { content: "branch-edited row", digest: "sha256:edited" as NonEmptyStr }
-  let captured_main = ExecutedGrantRowRead { content: "main row", digest: "sha256:main" as NonEmptyStr }
-  let changed_standing = grant_row_standing_over(executed: captured_changed, blob_of: blob_of, on_main: main)
-  let main_standing = grant_row_standing_over(executed: captured_main, blob_of: blob_of, on_main: main)
-  (match changed_standing { StandingGrantRowOnMain => false  StandingGrantRowNotOnMain { cause: c } => string_contains(s: c, pattern: "differs") })
-    && (match grant_row_proof_over(executed: captured_changed, standing: changed_standing) { D0GrantRowUnproven => true  D0GrantRowApproved { row_digest: _ } => false })
-    && (match main_standing { StandingGrantRowOnMain => true  StandingGrantRowNotOnMain { cause: _ } => false })
-    && (match grant_row_proof_over(executed: captured_main, standing: main_standing) { D0GrantRowUnproven => false  D0GrantRowApproved { row_digest: d } => d as String == "sha256:main" })
-    && (match grant_row_standing_over(executed: captured_main, blob_of: fn(c) { GrantRowBlobUnread { cause: "witness" } }, on_main: main) { StandingGrantRowOnMain => false  StandingGrantRowNotOnMain { cause: _ } => true })
-}
-
-test fn rw_a_covered_release_is_honored_only_under_a_matching_frozen_proof() -> Bool {
-  rw_with(scenario: fn(h) {
-    let req = rw_release_request(group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), h: h)
-    let row = ExecutedGrantRowRead { content: "row", digest: "sha256:aa" as NonEmptyStr }
-    (match d0_honored_standing_grant(request: req, frozen: D0GrantRowApproved { row_digest: "sha256:aa" as NonEmptyStr }, executed: row) { Present { value: _ } => true  Absent => false })
-      && (match d0_honored_standing_grant(request: req, frozen: D0GrantRowUnproven, executed: row) { Present { value: _ } => false  Absent => true })
-      && (match d0_honored_standing_grant(request: req, frozen: D0GrantRowApproved { row_digest: "sha256:bb" as NonEmptyStr }, executed: row) { Present { value: _ } => false  Absent => true })
-      && (match d0_honored_standing_grant(request: req, frozen: D0GrantRowApproved { row_digest: "sha256:aa" as NonEmptyStr }, executed: ExecutedGrantRowUnread { cause: "witness" }) { Present { value: _ } => false  Absent => true })
-  })
-}
-
-// THE FILING CARRIES THE PROOF AND ROUND-TRIPS; WITHOUT ONE IT IS BYTE-IDENTICAL TO BEFORE.
-test fn rw_the_frozen_filing_round_trips_its_grant_proof() -> Bool {
-  let with_proof = d0_frozen_filing_text_with(intent_text: "a=b\n", execution_revision: "aaaa" as NonEmptyStr, proof: D0GrantRowApproved { row_digest: "sha256:aa" as NonEmptyStr })
-  let without = d0_frozen_filing_text_with(intent_text: "a=b\n", execution_revision: "aaaa" as NonEmptyStr, proof: D0GrantRowUnproven)
-  without == "a=b\nexecution_revision=aaaa\n"
-    && (match parse_d0_frozen_filing(text: with_proof) { Present { value: f } => match f.grant_proof { D0GrantRowApproved { row_digest: d } => (d as String) == "sha256:aa" && (f.execution_revision as String) == "aaaa"  D0GrantRowUnproven => false }  Absent => false })
-    && (match parse_d0_frozen_filing(text: without) { Present { value: f } => match f.grant_proof { D0GrantRowUnproven => true  D0GrantRowApproved { row_digest: _ } => false }  Absent => false })
-}
-
-// PROVENANCE (side-chat review of #13102): the SAME covered release, authorized by the BROKER, keeps broker
-// lifecycle identity and expiry -- two windows are two lifecycles, and no standing-grant term appears. Only an
-// authorization issued from the grant carries the grant's identity. The grant never relabels a broker one.
-test fn rw_a_broker_authorized_covered_release_keeps_broker_identity() -> Bool {
-  rw_with(scenario: fn(h) {
-    let req = rw_release_request(group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), h: h)
-    match rw_permitted(req: req, issued: "2026-10-03T05:10:00Z", expires: "2026-10-03T05:40:00Z", at: "2026-10-03T05:11:00Z") {
-      Absent => false
-      Present { value: first } => match rw_permitted(req: req, issued: "2026-10-03T09:00:00Z", expires: "2026-10-03T09:30:00Z", at: "2026-10-03T09:01:00Z") {
-        Absent => false
-        Present { value: later } => {
-          let b1 = d0_binding_text_with(grant: first, claim_generation: 1, basis: D0BasisBroker)
-          let b2 = d0_binding_text_with(grant: later, claim_generation: 1, basis: D0BasisBroker)
-          b1 != b2 && string_contains(s: b1, pattern: "expires_at=") && !string_contains(s: b1, pattern: "standing_grant=")
-            && b1 == d0_binding_text(grant: first, claim_generation: 1)
-        }
-      }
-    }
-  })
-}
diff --git a/dag/test/claim/spark/pair_serving_d0_witness_test.dag b/dag/test/claim/spark/pair_serving_d0_witness_test.dag
deleted file mode 100644
index f92c05179f6..00000000000
--- a/dag/test/claim/spark/pair_serving_d0_witness_test.dag
+++ /dev/null
@@ -1,650 +0,0 @@
-module test.claim.spark.pair_serving_d0_witness
-
-import std.logic { Bool }
-import std.types { String, NonEmptyStr, List, Int, Port }
-import std.nat { Nat }
-import std.optional { Present, Absent }
-import std.measure { second }
-import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest, compare_content_hash, ContentHashEqual, ContentHashDifferent, ContentHashCrossFamilyIncomparable, content_hash_equal }
-import std.temporal_effect { HeldLease, held_lease, LeaseEpoch, LeaseRunningExpected }
-import product.host_identity { HostIdentity }
-import product.fabric.demand { ObservationReceiptRef }
-import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8 }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB }
-import gunbc.spark.serving_incarnation_observe { UnitOccupancy, UnitInstalled, UnitNotInstalled, UnitOccupancyUnread, IncarnationUnitNotActive }
-import gunbc.spark.vllm_endpoint_process_launch { vllm_endpoint_process_launch }
-import gunbc.spark.vllm_serving_launch { vllm_serving_launch, endpoint_incarnation_observation }
-import gunbc.spark.pair_serving_realization { spark_pair_head_unit_name, spark_pair_worker_unit_name }
-import gunbc.spark.pair_incumbent_identity {
-  DeclaredRankUnit, DeclaredPairRealization, declared_pair_realization_of, DeclaredPairRealizationKeyed, DeclaredPairRealizationUnavailable,
-  ObservedRankUnit, observed_pair_realization_of, ObservedPairRealizationRead, pair_realization_agreement,
-}
-import gunbc.spark.released_baseline { QuiescentReservedBaseline }
-import gunbc.spark.pair_serving_authority {
-  pair_serving_committed_hosts,
-  PairServingGroupAuthority, PairServingActive, SuspensionPendingReconciliation, SuspendedForAuthorizedSuccessor, FencedRefusal,
-  PairRealizationKeyed, PairRealizationUnestablished, pair_serving_apply_admits, pair_serving_successor_may_launch,
-}
-import std.scoped_authorization {
-  OperatorGrant, ScopedAuthorization, AuthorizationGranted, Unclaimed, AuthorizationScope, AttemptIdentity, AuthorizedAction,
-  AuthorizationClaimState, ClaimedBy, CompletedBy, AbortedBy,
-  parse_intent_scopes, authorization_scope_eq,
-}
-import std.effect_grant { Read, Write, NamespacePosition, CodeNameTree }
-import gunbc.rung_drop { Standing, Retired, Superseded }
-import gunbc.rung_drop.fabric_storage_append_principal_unrefused { fabric_storage_append_principal_unrefused }
-import gunbc.rung_drop.d0_store_walls_single_lifecycle { d0_store_walls_single_lifecycle }
-import gunbc.spark.pair_serving_d0 {
-  D0SuspendForSuccessor, RankVacancyReading,
-  d0_store_write_wall_standing, d0_store_operation_wall, StoreOperationWallMissing, StoreOperationWallRestored,
-  d0_single_lifecycle_escalation_id, d0_single_lifecycle_admits_under,
-  D0Subject, RankOccupancyReading, IncumbentReading, IncumbentAnswered, IncumbentAnsweredUnread, IncumbentDidNotAnswer, IncumbentRouteUnread, D0Observation,
-  HeadEndpointReading, HeadEndpointQuiet, HeadEndpointListening, HeadEndpointEngineProcess, HeadEndpointUnread, d0_held_lease,
-  OccupancyReconciliation, OccupancyNotQuiet, DeclaredOccupantDrifted, OccupancyUnread, reconcile_occupancy,
-  D0Decision, D0DecidedSuspend, D0DecidedRestore, D0DecidedFence, D0Cause, D0IncumbentLive, D0IncumbentUnidentified, D0OccupancyUnread, D0DeclarationUnavailable,
-  d0_decide, d0_decision_is_eligible, d0_authorized_action, d0_intent_text, d0_required_scope, d0_purpose,
-  D0Population, D0PopulationAgrees, D0PopulationDiffers, d0_population,
-  D0ClaimReading, D0ClaimAbsent, D0ClaimAt, D0ClaimUnreadable,
-  D0Recovery, D0RecoverStart, D0RecoverFirstWrite, D0RecoverResume, D0RecoverComplete, D0RecoverAbort, D0RecoveryRefused, d0_recovery,
-}
-import gunbc.spark.fabric_switch_observed { fabric_group_hosts }
-import gunbc.spark.pair_serving_authority_log { AuthorityTransitionRecord, PlacementPreparationRef, committed_population,
-}
-import product.capacity.event_chain { EventId }
-import extdeps.linux.proc_net_tcp { TcpSocketRow, TcpPortBound }
-
-// THE DECISION AND THE RECONCILIATION, OVER SUPPLIED READINGS. Every branch of the redesign's D0
-// table is driven here with a constructed observation; the transfer and the readings themselves
-// execute in the wet entry (pair_serving_d0_wet) against the fleet, and the compare-and-set it
-// relies on has its own real-execution witness on the authority log.
-
-fn d0w_t_sha(hex: String) -> ContentHash? {
-  match sha256_hex_digest(hex: hex) {
-    Absent => none
-    Present { value: d } => Present { value: Sha256Hash(d) }
-  }
-}
-
-fn d0w_with_digests(scenario: fn(ContentHash, ContentHash, ContentHash) -> Bool) -> Bool {
-  match d0w_t_sha(hex: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") {
-    Absent => false
-    Present { value: a } =>
-      match d0w_t_sha(hex: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb") {
-        Absent => false
-        Present { value: b } =>
-          match d0w_t_sha(hex: "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc") {
-            Absent => false
-            Present { value: c } => scenario(a, b, c)
-          }
-      }
-  }
-}
-
-fn d0w_t_declared(head: ContentHash, worker: ContentHash) -> DeclaredPairRealization {
-  declared_pair_realization_of(
-    group: FabricGroupA,
-    head: DeclaredRankUnit { host: operator_host_srv5, unit_name: spark_pair_head_unit_name, digest: head },
-    workers: [
-      DeclaredRankUnit { host: operator_host_srv6, unit_name: spark_pair_worker_unit_name, digest: worker },
-      DeclaredRankUnit { host: operator_host_srv7, unit_name: spark_pair_worker_unit_name, digest: worker },
-      DeclaredRankUnit { host: operator_host_srv8, unit_name: spark_pair_worker_unit_name, digest: worker },
-    ],
-  )
-}
-
-fn d0w_t_rank(host: HostIdentity, unit: NonEmptyStr, occupancy: UnitOccupancy) -> RankOccupancyReading {
-  RankOccupancyReading { host: host, unit_name: unit, occupancy: occupancy }
-}
-
-fn d0w_t_ranks(head: UnitOccupancy, w6: UnitOccupancy, w7: UnitOccupancy, w8: UnitOccupancy) -> List<RankOccupancyReading> {
-  [
-    d0w_t_rank(host: operator_host_srv5, unit: spark_pair_head_unit_name, occupancy: head),
-    d0w_t_rank(host: operator_host_srv6, unit: spark_pair_worker_unit_name, occupancy: w6),
-    d0w_t_rank(host: operator_host_srv7, unit: spark_pair_worker_unit_name, occupancy: w7),
-    d0w_t_rank(host: operator_host_srv8, unit: spark_pair_worker_unit_name, occupancy: w8),
-  ]
-}
-
-fn d0w_t_lease(h: ContentHash) -> HeldLease {
-  held_lease(epoch: LeaseEpoch { lease_key: "tx-w" as NonEmptyStr, resource_fingerprint: h, owner_fingerprint: h, generation: 1 }, observed: LeaseRunningExpected)
-}
-
-data d0w_t_tx: NonEmptyStr = "tx-w" as NonEmptyStr
-
-fn d0w_t_subject(successor: ContentHash) -> D0Subject {
-  D0Subject { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), operation: D0SuspendForSuccessor { successor: successor, cleanup: QuiescentReservedBaseline, term: second(count: 1000) } }
-}
-
-// A grant over the exact operation: the write scope over the authority, the transaction as the
-// attempt, and an intent hash SUPPLIED as a fixture -- the real intent is a SHA-256 taken through
-// the sha256sum realization, an effect the wet witness executes; the decision here consumes only
-// the grant's subject and escalation. The knobs let the reds vary one binding fact at a time.
-fn d0w_t_authorization(successor: ContentHash, scope_verb_write: Bool, attempt: NonEmptyStr, intent: ContentHash, expires_at: String) -> ScopedAuthorization<D0Subject> {
-  AuthorizationGranted {
-    grant: OperatorGrant {
-      escalation_id: "auth-w" as NonEmptyStr,
-      subject: d0w_t_subject(successor: successor),
-      scopes: [AuthorizationScope { verb: if scope_verb_write { Write } else { Read }, resource: NamespacePosition { tree: CodeNameTree, path: ["gunbc", "spark", "pair_serving_authority"] }, action: d0_authorized_action }],
-      purpose: "witness d0" as NonEmptyStr,
-      attempt: (attempt as String) as AttemptIdentity,
-      intent_hash: intent,
-      granted_by: "witness" as NonEmptyStr,
-      granted_at: "2026-09-18T00:00:00Z",
-      expires_at: expires_at,
-    },
-    claim: Unclaimed,
-  }
-}
-
-fn d0w_t_good_authorization(successor: ContentHash) -> ScopedAuthorization<D0Subject> {
-  d0w_t_authorization(successor: successor, scope_verb_write: true, attempt: d0w_t_tx, intent: successor, expires_at: "2026-09-19T00:00:00Z")
-}
-
-// The grant the decision is judged under: the fixture authorization's own grant. The DECISION
-// consumes the grant's fields (successor, cleanup, escalation); the TRANSACTION consumes an
-// AdmittedD0Grant, which only admit_d0_grant mints and which the real-execution witness drives.
-fn d0w_t_grant(successor: ContentHash) -> OperatorGrant<D0Subject>? {
-  match d0w_t_good_authorization(successor: successor) {
-    AuthorizationGranted { grant: g, claim: _ } => Present { value: g }
-    _ => none
-  }
-}
-
-fn d0w_t_active() -> PairServingGroupAuthority {
-  PairServingActive { group: FabricGroupA, exact_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr } }
-}
-
-fn d0w_t_decide(declared: DeclaredPairRealization, incumbent: IncumbentReading, ranks: List<RankOccupancyReading>, h: ContentHash) -> D0Decision {
-  match d0w_t_grant(successor: h) {
-    Absent => D0DecidedFence { next: FencedRefusal { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), cause: "witness: the fixture authorization carries no grant" as NonEmptyStr, disposition_authority: "witness" as NonEmptyStr }, cause: D0DeclarationUnavailable { obligation: "witness fixture" as NonEmptyStr } }
-    Present { value: grant } =>
-      d0_decide(
-        declared: DeclaredPairRealizationKeyed { declared: declared },
-        observation: D0Observation { group: FabricGroupA, incumbent: incumbent, ranks: ranks, vacancy: [] as List<RankVacancyReading> },
-        active: d0w_t_active(),
-        lease: d0w_t_lease(h: h),
-        grant: grant,
-      )
-  }
-}
-
-fn d0w_silent() -> IncumbentReading {
-  IncumbentDidNotAnswer { receipt: "the front door could not be connected within the bound" as NonEmptyStr, head: HeadEndpointQuiet }
-}
-
-
-// ── RECONCILIATION ─────────────────────────────────────────────────────────────────────────────
-
-// Our units, our bytes, all running: NOT a reconciled answer. That reading is the running declared
-// occupant, which the incumbent question owns; reconciliation is asked only after the head was
-// corroborated quiet, so it refuses as OccupancyNotQuiet naming the ranks -- and handed to the
-// decision behind a silent front door it fences as unidentified, never suspends.
-test fn all_ranks_installed_running_with_declared_bytes_is_not_quiet_and_fences() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    let ranks = d0w_t_ranks(head: UnitInstalled { active: true, unit_digest: a }, w6: UnitInstalled { active: true, unit_digest: b }, w7: UnitInstalled { active: true, unit_digest: b }, w8: UnitInstalled { active: true, unit_digest: b })
-    (match reconcile_occupancy(declared: d0w_t_declared(head: a, worker: b), ranks: ranks) {
-       OccupancyNotQuiet { live: lv } => length(lv) == 1 && any(lv, h => (h as String) == (operator_host_srv5 as String))
-       _ => false
-     })
-      && (match d0w_t_decide(declared: d0w_t_declared(head: a, worker: b), incumbent: d0w_silent(), ranks: ranks, h: c) {
-            D0DecidedFence { next: _, cause: D0IncumbentUnidentified { cause: _ } } => true
-            _ => false
-          })
-  })
-}
-
-// THE EXPECTED ANSWER: our units installed, none running. Drifted, naming every inactive rank --
-// and eligible, not refused (the redesign's correction of an earlier draft).
-test fn installed_but_inactive_ranks_are_drifted_and_eligible() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    let ranks = d0w_t_ranks(head: UnitInstalled { active: false, unit_digest: a }, w6: UnitInstalled { active: false, unit_digest: b }, w7: UnitInstalled { active: false, unit_digest: b }, w8: UnitInstalled { active: false, unit_digest: b })
-    (match reconcile_occupancy(declared: d0w_t_declared(head: a, worker: b), ranks: ranks) {
-       DeclaredOccupantDrifted { drifted: ds } => length(ds) == 4
-       _ => false
-     })
-    && (match d0w_t_decide(declared: d0w_t_declared(head: a, worker: b), incumbent: d0w_silent(), ranks: ranks, h: c) {
-          D0DecidedSuspend { next: SuspendedForAuthorizedSuccessor { group: _, authorization: au, exact_candidate_realization: PairRealizationKeyed { key: k }, lease: _, cleanup: QuiescentReservedBaseline }, reconciliation: DeclaredOccupantDrifted { drifted: ds } } =>
-            (au as String) == "auth-w" && length(ds) == 4 && content_hash_equal(left: k, right: c)
-          _ => false
-        })
-  })
-}
-
-// One rank carries other bytes while the others are inactive with the declared bytes: every
-// rank is drifted (declared bytes not running is drift, other bytes is drift) and the population
-// names all four, the head and the other-bytes rank among them. A rank ACTIVE with the declared
-// bytes is live and makes the occupancy not quiet -- the claim above -- never a drifted member.
-test fn one_rank_with_other_bytes_is_drifted_naming_it() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    match reconcile_occupancy(declared: d0w_t_declared(head: a, worker: b), ranks: d0w_t_ranks(head: UnitInstalled { active: false, unit_digest: a }, w6: UnitInstalled { active: false, unit_digest: b }, w7: UnitInstalled { active: true, unit_digest: c }, w8: UnitInstalled { active: false, unit_digest: b })) {
-      DeclaredOccupantDrifted { drifted: ds } => length(ds) == 4 && any(ds, h => (h as String) == (operator_host_srv7 as String)) && any(ds, h => (h as String) == (operator_host_srv5 as String))
-      _ => false
-    }
-  })
-}
-
-// RED -- a rank with no pair unit installed is UNREAD, not empty and not drifted: this
-// transaction cannot tell it from a foreign occupant, and says so. It fences. (The head is quiet
-// here so absence is corroborated and the worker's unread reading is what governs.)
-test fn an_uninstalled_rank_is_unread_and_fences() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    let ranks = d0w_t_ranks(head: UnitInstalled { active: false, unit_digest: a }, w6: UnitInstalled { active: true, unit_digest: b }, w7: UnitNotInstalled, w8: UnitInstalled { active: true, unit_digest: b })
-    (match reconcile_occupancy(declared: d0w_t_declared(head: a, worker: b), ranks: ranks) {
-       OccupancyUnread { hosts: hs, cause: _ } => length(hs) == 1
-       _ => false
-     })
-    && (match d0w_t_decide(declared: d0w_t_declared(head: a, worker: b), incumbent: d0w_silent(), ranks: ranks, h: c) {
-          D0DecidedFence { next: FencedRefusal { group: _, cause: _, disposition_authority: _ }, cause: D0OccupancyUnread { cause: _ } } => true
-          _ => false
-        })
-  })
-}
-
-// RED -- a rank whose read refused is unread even when every other rank converged.
-test fn one_unread_rank_makes_the_occupancy_unread() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    match reconcile_occupancy(declared: d0w_t_declared(head: a, worker: b), ranks: d0w_t_ranks(head: UnitInstalled { active: false, unit_digest: a }, w6: UnitOccupancyUnread { refusal: IncarnationUnitNotActive { unit: spark_pair_worker_unit_name } }, w7: UnitInstalled { active: true, unit_digest: b }, w8: UnitInstalled { active: true, unit_digest: b })) {
-      OccupancyUnread { hosts: hs, cause: _ } => length(hs) == 1 && all(hs, h => (h as String) == (operator_host_srv6 as String))
-      _ => false
-    }
-  })
-}
-
-// RED -- a declared rank with no reading at all is unread: a missing reading is not a reading.
-test fn a_missing_rank_reading_is_unread() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    match reconcile_occupancy(declared: d0w_t_declared(head: a, worker: b), ranks: [d0w_t_rank(host: operator_host_srv5, unit: spark_pair_head_unit_name, occupancy: UnitInstalled { active: false, unit_digest: a })]) {
-      OccupancyUnread { hosts: hs, cause: _ } => length(hs) == 3
-      _ => false
-    }
-  })
-}
-
-// ── THE INCUMBENT QUESTION COMES FIRST ─────────────────────────────────────────────────────────
-
-// An incumbent answering with head bytes `a` and worker bytes `b`, judged against a declaration
-// whose workers are `declared_worker`: equal to `b` for an established incumbent, other for drift.
-fn d0w_t_answered(a: ContentHash, b: ContentHash, declared_worker: ContentHash, img: ContentHash) -> IncumbentReading {
-  let head = endpoint_incarnation_observation(
-    endpoint: vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "http://10.0.0.5:8000" as NonEmptyStr, process_start_field: "1" as NonEmptyStr),
-    launch: vllm_serving_launch(group: FabricGroupA, head: operator_host_srv5, systemd_invocation: "inv" as NonEmptyStr, container_id: "c" as NonEmptyStr, executable_digest: img, unit_digest: a, started_at: 1),
-    container_env: [] as List<String>,
-    receipt: "test.claim.spark.pair_serving_d0_witness fixture" as ObservationReceiptRef,
-  )
-  let workers = [
-    ObservedRankUnit { host: operator_host_srv6, unit_name: spark_pair_worker_unit_name, systemd_invocation: "inv" as NonEmptyStr, unit_digest: b },
-    ObservedRankUnit { host: operator_host_srv7, unit_name: spark_pair_worker_unit_name, systemd_invocation: "inv" as NonEmptyStr, unit_digest: b },
-    ObservedRankUnit { host: operator_host_srv8, unit_name: spark_pair_worker_unit_name, systemd_invocation: "inv" as NonEmptyStr, unit_digest: b },
-  ]
-  IncumbentAnswered {
-    agreement: pair_realization_agreement(
-      declared: DeclaredPairRealizationKeyed { declared: d0w_t_declared(head: a, worker: declared_worker) },
-      observed: ObservedPairRealizationRead { observed: observed_pair_realization_of(group: FabricGroupA, head: head, workers: workers, receipt: "test.claim.spark.pair_serving_d0_witness fixture" as ObservationReceiptRef) },
-    ),
-  }
-}
-
-// An incumbent answers and IS the declared realization on every rank: restoration is shown safe,
-// the authority returns to EXACTLY the Active state it held -- unchanged, not upgraded to a keyed
-// realization, because the running image is observed and uncompared -- and D0 is refused.
-test fn a_live_declared_incumbent_restores_the_active_state_unchanged_and_refuses() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    let d = d0w_t_declared(head: a, worker: b)
-    let decision = d0w_t_decide(declared: d, incumbent: d0w_t_answered(a: a, b: b, declared_worker: b, img: c), ranks: d0w_t_ranks(head: UnitInstalled { active: true, unit_digest: a }, w6: UnitInstalled { active: true, unit_digest: b }, w7: UnitInstalled { active: true, unit_digest: b }, w8: UnitInstalled { active: true, unit_digest: b }), h: c)
-    match decision {
-      D0DecidedRestore { next: PairServingActive { group: _, exact_realization: PairRealizationUnestablished { obligation: o } }, key: k2 } =>
-        (o as String) == "witness" && content_hash_equal(left: k2, right: d.key) && !d0_decision_is_eligible(d: decision)
-      _ => false
-    }
-  })
-}
-
-// RED -- an incumbent answers but is NOT the declared realization (a worker's bytes differ): not
-// restored, not suspended -- fenced for the operator, naming the standing.
-test fn a_live_drifted_incumbent_is_fenced() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    match d0w_t_decide(declared: d0w_t_declared(head: a, worker: c), incumbent: d0w_t_answered(a: a, b: b, declared_worker: c, img: c), ranks: d0w_t_ranks(head: UnitInstalled { active: true, unit_digest: a }, w6: UnitInstalled { active: true, unit_digest: c }, w7: UnitInstalled { active: true, unit_digest: c }, w8: UnitInstalled { active: true, unit_digest: c }), h: c) {
-      D0DecidedFence { next: FencedRefusal { group: _, cause: _, disposition_authority: _ }, cause: D0IncumbentLive { standing: _ } } => true
-      _ => false
-    }
-  })
-}
-
-// RED -- the route could not be read at all: the incumbent question is unanswered, and an
-// unanswered first question fences before the ranks are consulted.
-test fn an_unread_route_fences_before_reconciling() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    match d0w_t_decide(declared: d0w_t_declared(head: a, worker: b), incumbent: IncumbentRouteUnread { cause: "no fleet ssh context" as NonEmptyStr }, ranks: d0w_t_ranks(head: UnitInstalled { active: true, unit_digest: a }, w6: UnitInstalled { active: true, unit_digest: b }, w7: UnitInstalled { active: true, unit_digest: b }, w8: UnitInstalled { active: true, unit_digest: b }), h: c) {
-      D0DecidedFence { next: _, cause: D0OccupancyUnread { cause: _ } } => true
-      _ => false
-    }
-  })
-}
-
-// RED -- the route ANSWERED but the document named no launch: an incumbent may be live and could
-// not be identified. That is not silence, and it fences before the ranks are consulted --
-// whatever the ranks would have reconciled to.
-test fn an_answering_but_unidentified_incumbent_fences() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    match d0w_t_decide(declared: d0w_t_declared(head: a, worker: b), incumbent: IncumbentAnsweredUnread { cause: "the served metrics carried no process start-time series" as NonEmptyStr }, ranks: d0w_t_ranks(head: UnitInstalled { active: false, unit_digest: a }, w6: UnitInstalled { active: false, unit_digest: b }, w7: UnitInstalled { active: false, unit_digest: b }, w8: UnitInstalled { active: false, unit_digest: b }), h: c) {
-      D0DecidedFence { next: FencedRefusal { group: _, cause: _, disposition_authority: _ }, cause: D0IncumbentUnidentified { cause: _ } } => true
-      _ => false
-    }
-  })
-}
-
-// THE ENTRY ADMITS ONLY THROUGH THE PRODUCER: the request over the exact operation exists only
-// when the successor is keyed, and the door (gunbc.spark.pair_serving_d0_door) files it and admits
-// only an approval over that request's revision -- test.claim.spark.pair_serving_d0_authorization_witness
-// drives both. What this module's wall still executes: the door refuses before any write while
-// either store wall stands (the claim below), so no authorization opens it today.
-
-fn d0w_port(n: Int) -> Port {
-  n
-}
-
-fn d0w_with_four_hosts(scenario: fn(HostIdentity, HostIdentity, HostIdentity, HostIdentity) -> Bool) -> Bool {
-  let current = fabric_group_hosts(g: FabricGroupA)
-  if length(current) != 4 { false } else {
-    match get(xs: current, index: 0) {
-      Absent => false
-      Present { value: h1 } =>
-        match get(xs: current, index: 1) {
-          Absent => false
-          Present { value: h2 } =>
-            match get(xs: current, index: 2) {
-              Absent => false
-              Present { value: h3 } =>
-                match get(xs: current, index: 3) {
-                  Absent => false
-                  Present { value: h4 } => scenario(h1, h2, h3, h4)
-                }
-            }
-        }
-    }
-  }
-}
-
-fn d0w_t_subject_over(hs: List<HostIdentity>, successor: ContentHash, term: Nat) -> D0Subject {
-  D0Subject { group: FabricGroupA, hosts: hs, operation: D0SuspendForSuccessor { successor: successor, cleanup: QuiescentReservedBaseline, term: second(count: term) } }
-}
-
-// THE SUBJECT NAMES THE EXACT HOSTS. A grant whose host list is the group's current population,
-// in any order, agrees; one with a host swapped, one dropped, or one duplicated differs -- by an
-// identity join in both directions, so a count could not have passed the swap.
-test fn the_grant_population_is_joined_to_the_current_group_by_identity() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    d0w_with_four_hosts(scenario: fn(h1, h2, h3, h4) {
-      (match d0_population(subject: d0w_t_subject_over(hs: [h4, h3, h2, h1], successor: c, term: 1000), current: [h1, h2, h3, h4]) { D0PopulationAgrees => true  _ => false })
-        && (match d0_population(subject: d0w_t_subject_over(hs: [h1, h2, h3], successor: c, term: 1000), current: [h1, h2, h3, h4]) { D0PopulationDiffers { granted: _, current: _ } => true  _ => false })
-        && (match d0_population(subject: d0w_t_subject_over(hs: [h1, h2, h3, h3], successor: c, term: 1000), current: [h1, h2, h3, h4]) { D0PopulationDiffers { granted: _, current: _ } => true  _ => false })
-        && (match d0_population(subject: d0w_t_subject_over(hs: [h1, h2, h3, operator_host_srv1], successor: c, term: 1000), current: [h1, h2, h3, h4]) { D0PopulationDiffers { granted: _, current: _ } => true  _ => false })
-    })
-  })
-}
-
-// THE INTENT'S CANONICAL TEXT is one line per fact and the hosts are sorted: two subjects that
-// list the same hosts in different orders encode identically, and any other fact moving --
-// successor, term, transaction -- changes the text.
-test fn the_intent_text_is_canonical_over_the_operation() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    d0w_with_four_hosts(scenario: fn(h1, h2, h3, h4) {
-      let one = d0w_t_subject_over(hs: [h1, h2, h3, h4], successor: c, term: 1000)
-      let t = (match d0_intent_text(subject: one, group: FabricGroupA, transaction: d0w_t_tx) { Present { value: intent_text_w } => intent_text_w  Absent => "d0-intent-refused" })
-      t == (match d0_intent_text(subject: d0w_t_subject_over(hs: [h4, h2, h1, h3], successor: c, term: 1000), group: FabricGroupA, transaction: d0w_t_tx) { Present { value: intent_text_w } => intent_text_w  Absent => "d0-intent-refused" })
-        && t != (match d0_intent_text(subject: d0w_t_subject_over(hs: [h1, h2, h3, h4], successor: c, term: 1001), group: FabricGroupA, transaction: d0w_t_tx) { Present { value: intent_text_w } => intent_text_w  Absent => "d0-intent-refused" })
-        && t != (match d0_intent_text(subject: d0w_t_subject_over(hs: [h1, h2, h3, h4], successor: a, term: 1000), group: FabricGroupA, transaction: d0w_t_tx) { Present { value: intent_text_w } => intent_text_w  Absent => "d0-intent-refused" })
-        && t != (match d0_intent_text(subject: one, group: FabricGroupA, transaction: "tx-other" as NonEmptyStr) { Present { value: intent_text_w } => intent_text_w  Absent => "d0-intent-refused" })
-        && t.contains("suspend-pair-serving-authority")
-    })
-  })
-}
-
-// THE INTENT STATES ITS SCOPE IN THE SHARED FRAME: a verifier that holds only the text reads the
-// one required scope through std.scoped_authorization parse_intent_scopes, with no D0 knowledge;
-// and the purpose the operator reads names that scope and the whole subject, so the approval is
-// over what the store will check.
-test fn the_intent_text_states_its_scope_in_the_shared_frame() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    d0w_with_four_hosts(scenario: fn(h1, h2, h3, h4) {
-      let one = d0w_t_subject_over(hs: [h1, h2, h3, h4], successor: c, term: 1000)
-      let purpose = d0_purpose(subject: one, transaction: d0w_t_tx) as String
-      (match parse_intent_scopes(text: (match d0_intent_text(subject: one, group: FabricGroupA, transaction: d0w_t_tx) { Present { value: intent_text_w } => intent_text_w  Absent => "d0-intent-refused" })) {
-        Present { value: f } => count(f.scopes) == 1 && all(f.scopes, sc => authorization_scope_eq(a: sc, b: d0_required_scope()))
-        Absent => false
-      })
-        && purpose.contains("suspend-pair-serving-authority")
-        && purpose.contains("code-name:gunbc/spark/pair_serving_authority")
-        && purpose.contains(h1 as String)
-        && purpose.contains(d0w_t_tx as String)
-    })
-  })
-}
-
-// ── RECOVERY: THE JOIN OVER THE CLAIM AND THE AUTHORITY HISTORY ────────────────────────────────
-
-fn d0w_rec_of(id: String, tx: String, lifecycle: ContentHash?, next: PairServingGroupAuthority) -> AuthorityTransitionRecord {
-  AuthorityTransitionRecord { id: (id as NonEmptyStr) as EventId, transaction: tx as NonEmptyStr, lifecycle: lifecycle, next: next, placement: PlacementPreparationRef { id: (join(["p-", id], "") as NonEmptyStr) as EventId, group: FabricGroupA, previous_hosts: [] as List<HostIdentity>, next_hosts: committed_population(a: next), operation: tx as NonEmptyStr } }
-}
-
-// A record written by THIS lifecycle (binding c, the same hash the claims pass as the lifecycle).
-fn d0w_rec(id: String, tx: String, next: PairServingGroupAuthority) -> AuthorityTransitionRecord {
-  d0w_rec_of(id: id, tx: tx, lifecycle: none, next: next)
-}
-
-fn d0w_mine(id: String, h: ContentHash, next: PairServingGroupAuthority) -> AuthorityTransitionRecord {
-  d0w_rec_of(id: id, tx: "tx-w", lifecycle: Present { value: h }, next: next)
-}
-
-// A pending state as this witness's executor ("witness") wrote it: the lease owner is that
-// executor's fingerprint, so a resume from the same executor is admitted and one from another
-// executor is refused by the owner check.
-fn d0w_pending(tx: String, h: ContentHash) -> PairServingGroupAuthority {
-  SuspensionPendingReconciliation { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), transaction: tx as NonEmptyStr, authorization_binding: h, lease: d0_held_lease(group: FabricGroupA, transaction: tx as NonEmptyStr, executor: "witness" as NonEmptyStr, generation: 1) }
-}
-
-fn d0w_claimed(by: String) -> D0ClaimReading {
-  D0ClaimAt { state: ClaimedBy { attempt: (by as NonEmptyStr) as AttemptIdentity, claimed_at: "2026-09-18T00:00:00Z" }, generation: 1 }
-}
-
-fn d0w_suspended(h: ContentHash) -> PairServingGroupAuthority {
-  SuspendedForAuthorizedSuccessor { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), authorization: "auth-w" as NonEmptyStr, exact_candidate_realization: PairRealizationKeyed { key: h }, lease: d0w_t_lease(h: h), cleanup: QuiescentReservedBaseline }
-}
-
-// EVERY CRASH POINT HAS ONE DISPOSITION. No claim starts. A claim held by this transaction with no
-// transition by it performs the first write when the authority is Active and aborts otherwise. A
-// pending state under this transaction resumes. A settling transition by this transaction means
-// only the claim's terminal is owed. A pending state written by this transaction that another
-// writer moved is refused for an operator.
-test fn the_recovery_join_dispatches_every_crash_point() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    let active = d0w_t_active()
-    (match d0_recovery(claim: D0ClaimAbsent, transaction: d0w_t_tx, lifecycle: none, executor: "witness" as NonEmptyStr, current: active, transitions: [] as List<AuthorityTransitionRecord>) { D0RecoverStart => true  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: c }, executor: "witness" as NonEmptyStr, current: active, transitions: [] as List<AuthorityTransitionRecord>) { D0RecoverFirstWrite { claim_generation: _ } => true  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: c }, executor: "witness" as NonEmptyStr, current: FencedRefusal { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), cause: "w" as NonEmptyStr, disposition_authority: "w" as NonEmptyStr }, transitions: [d0w_rec(id: "e1", tx: "tx-other", next: FencedRefusal { group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA), cause: "w" as NonEmptyStr, disposition_authority: "w" as NonEmptyStr })]) { D0RecoverAbort { claim_generation: _, cause: _ } => true  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: c }, executor: "witness" as NonEmptyStr, current: d0w_pending(tx: "tx-w", h: c), transitions: [d0w_mine(id: "e1", h: c, next: d0w_pending(tx: "tx-w", h: c))]) { D0RecoverResume { claim_generation: _ } => true  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: c }, executor: "witness" as NonEmptyStr, current: d0w_suspended(h: c), transitions: [d0w_mine(id: "e1", h: c, next: d0w_pending(tx: "tx-w", h: c)), d0w_mine(id: "e2", h: c, next: d0w_suspended(h: c))]) { D0RecoverComplete { claim_generation: _, settled: s } => (s.id as String) == "e2"  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: c }, executor: "witness" as NonEmptyStr, current: active, transitions: [d0w_mine(id: "e1", h: c, next: d0w_pending(tx: "tx-w", h: c)), d0w_mine(id: "e2", h: c, next: active), d0w_rec(id: "e3", tx: "tx-later", next: d0w_pending(tx: "tx-later", h: c)), d0w_rec(id: "e4", tx: "tx-later", next: active)]) { D0RecoverComplete { claim_generation: _, settled: s } => (s.id as String) == "e2"  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: c }, executor: "witness" as NonEmptyStr, current: active, transitions: [d0w_mine(id: "e1", h: c, next: d0w_pending(tx: "tx-w", h: c)), d0w_rec(id: "e2", tx: "tx-operator", next: active)]) { D0RecoveryRefused { cause: _ } => true  _ => false })
-  })
-}
-
-// RED: THE TRANSACTION WORD IS NOT THE LIFECYCLE. Escalation E1 under word tx-w settled (its
-// transitions carry binding a); an operator restored the group; escalation E2 under the SAME word
-// claimed (binding c) and died before its first write. E2's recovery must be FirstWrite -- never
-// Complete from E1's terminal -- and a claim whose binding could not be digested identifies no
-// history at all and is refused rather than joined by the word. AND THE LIFECYCLE IS NOT THE
-// EXECUTOR: another executor facing THIS lifecycle's pending state is refused by the lease owner
-// (no handoff), but that same executor completes a settled lifecycle -- suspended or restored to
-// Active -- rather than aborting it or starting a second first write.
-test fn a_reused_transaction_word_does_not_inherit_another_lifecycles_history() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    let active = d0w_t_active()
-    let history = [
-      d0w_rec_of(id: "e1", tx: "tx-w", lifecycle: Present { value: a }, next: d0w_pending(tx: "tx-w", h: a)),
-      d0w_rec_of(id: "e2", tx: "tx-w", lifecycle: Present { value: a }, next: d0w_suspended(h: a)),
-      d0w_rec(id: "e3", tx: "tx-operator-restore", next: active),
-    ]
-    (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: c }, executor: "witness" as NonEmptyStr, current: active, transitions: history) { D0RecoverFirstWrite { claim_generation: _ } => true  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: a }, executor: "witness" as NonEmptyStr, current: active, transitions: history) { D0RecoverComplete { claim_generation: _, settled: s } => (s.id as String) == "e2"  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: none, executor: "witness" as NonEmptyStr, current: active, transitions: history) { D0RecoveryRefused { cause: _ } => true  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: c }, executor: "witness" as NonEmptyStr, current: d0w_pending(tx: "tx-w", h: a), transitions: concat(history, [d0w_rec_of(id: "e4", tx: "tx-w", lifecycle: Present { value: c }, next: d0w_pending(tx: "tx-w", h: c))])) { D0RecoveryRefused { cause: _ } => true  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: c }, executor: "another-executor" as NonEmptyStr, current: d0w_pending(tx: "tx-w", h: c), transitions: [d0w_mine(id: "e5", h: c, next: d0w_pending(tx: "tx-w", h: c))]) { D0RecoveryRefused { cause: _ } => true  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: c }, executor: "another-executor" as NonEmptyStr, current: d0w_suspended(h: c), transitions: [d0w_mine(id: "e5", h: c, next: d0w_pending(tx: "tx-w", h: c)), d0w_mine(id: "e6", h: c, next: d0w_suspended(h: c))]) { D0RecoverComplete { claim_generation: _, settled: st } => (st.id as String) == "e6"  _ => false })
-      && (match d0_recovery(claim: d0w_claimed(by: "tx-w"), transaction: d0w_t_tx, lifecycle: Present { value: c }, executor: "another-executor" as NonEmptyStr, current: active, transitions: [d0w_mine(id: "e5", h: c, next: d0w_pending(tx: "tx-w", h: c)), d0w_mine(id: "e6", h: c, next: active)]) { D0RecoverComplete { claim_generation: _, settled: st } => (st.id as String) == "e6"  _ => false })
-  })
-}
-
-// RED: consent that is not this run's is refused whatever the authority says -- held by another
-// attempt, completed, aborted, or unreadable -- and an Active authority with a completed claim is
-// NOT a start.
-test fn a_claim_that_is_not_this_transactions_is_refused_before_any_write() -> Bool {
-  let active = d0w_t_active()
-  let none_yet = [] as List<AuthorityTransitionRecord>
-  (match d0_recovery(claim: d0w_claimed(by: "tx-other"), transaction: d0w_t_tx, lifecycle: none, executor: "witness" as NonEmptyStr, current: active, transitions: none_yet) { D0RecoveryRefused { cause: _ } => true  _ => false })
-    && (match d0_recovery(claim: D0ClaimAt { state: CompletedBy { attempt: ("tx-w" as NonEmptyStr) as AttemptIdentity, completed_at: "t" }, generation: 2 }, transaction: d0w_t_tx, lifecycle: none, executor: "witness" as NonEmptyStr, current: active, transitions: none_yet) { D0RecoveryRefused { cause: _ } => true  _ => false })
-    && (match d0_recovery(claim: D0ClaimAt { state: AbortedBy { attempt: ("tx-w" as NonEmptyStr) as AttemptIdentity, aborted_at: "t", cause: "w" as NonEmptyStr }, generation: 2 }, transaction: d0w_t_tx, lifecycle: none, executor: "witness" as NonEmptyStr, current: active, transitions: none_yet) { D0RecoveryRefused { cause: _ } => true  _ => false })
-    && (match d0_recovery(claim: D0ClaimAt { state: Unclaimed, generation: 1 }, transaction: d0w_t_tx, lifecycle: none, executor: "witness" as NonEmptyStr, current: active, transitions: none_yet) { D0RecoveryRefused { cause: _ } => true  _ => false })
-    && (match d0_recovery(claim: D0ClaimUnreadable { reason: "w" as NonEmptyStr }, transaction: d0w_t_tx, lifecycle: none, executor: "witness" as NonEmptyStr, current: active, transitions: none_yet) { D0RecoveryRefused { cause: _ } => true  _ => false })
-}
-
-// A declaration that could not be keyed fences: there is nothing to reconcile against.
-test fn an_unavailable_declaration_fences() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    match d0w_t_grant(successor: c) {
-      Absent => false
-      Present { value: grant } =>
-    match d0_decide(
-      declared: DeclaredPairRealizationUnavailable { group: FabricGroupA, obligation: "witness" as NonEmptyStr },
-      observation: D0Observation { group: FabricGroupA, incumbent: d0w_silent(), ranks: [] as List<RankOccupancyReading>, vacancy: [] as List<RankVacancyReading> },
-      active: d0w_t_active(), lease: d0w_t_lease(h: c), grant: grant,
-    ) {
-      D0DecidedFence { next: _, cause: D0DeclarationUnavailable { obligation: _ } } => true
-      _ => false
-    }
-    }
-  })
-}
-
-// The suspended authority D0 writes is what the successor's launch gate reads: with the lease
-// running it may launch, and the incumbent's apply is refused.
-test fn the_suspension_d0_writes_admits_launch_and_refuses_apply() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    match d0w_t_decide(declared: d0w_t_declared(head: a, worker: b), incumbent: d0w_silent(), ranks: d0w_t_ranks(head: UnitInstalled { active: false, unit_digest: a }, w6: UnitInstalled { active: false, unit_digest: b }, w7: UnitInstalled { active: false, unit_digest: b }, w8: UnitInstalled { active: false, unit_digest: b }), h: c) {
-      D0DecidedSuspend { next: n, reconciliation: _ } => pair_serving_successor_may_launch(a: n) && !pair_serving_apply_admits(a: n)
-      _ => false
-    }
-  })
-}
-
-// ── ABSENCE IS CORROBORATED ON THE HEAD, AND THE FENCE KEEPS THE AUTHORIZED HOSTS ──────────────
-
-// The front door gave no status (a failed connect). Absence needs the head QUIET on both readings:
-// no LISTEN on the enrolled port and no engine process (HeadEndpointQuiet), AND the declared unit
-// inactive. A listener, an engine process, or an unread table fences as an unidentified incumbent
-// (or unread); an active declared unit fences; an unread head fences; only a quiet head with an
-// inactive unit proceeds to reconciliation.
-test fn a_failed_connect_is_absence_only_when_the_head_unit_is_quiet() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    let declared = d0w_t_declared(head: a, worker: b)
-    let no_status = IncumbentDidNotAnswer { receipt: "the front door could not be connected (curl exit 7)" as NonEmptyStr, head: HeadEndpointQuiet }
-    let quiet_ranks = d0w_t_ranks(head: UnitInstalled { active: false, unit_digest: a }, w6: UnitInstalled { active: false, unit_digest: b }, w7: UnitInstalled { active: false, unit_digest: b }, w8: UnitInstalled { active: false, unit_digest: b })
-    (match reconcile_occupancy(declared: declared, ranks: d0w_t_ranks(head: UnitInstalled { active: true, unit_digest: a }, w6: UnitInstalled { active: false, unit_digest: b }, w7: UnitInstalled { active: false, unit_digest: b }, w8: UnitInstalled { active: false, unit_digest: b })) { OccupancyNotQuiet { live: lv } => length(lv) == 1  _ => false })
-      && (match reconcile_occupancy(declared: declared, ranks: [] as List<RankOccupancyReading>) { OccupancyUnread { hosts: _, cause: _ } => true  _ => false })
-      && (match reconcile_occupancy(declared: declared, ranks: d0w_t_ranks(head: UnitInstalled { active: false, unit_digest: a }, w6: UnitInstalled { active: true, unit_digest: b }, w7: UnitInstalled { active: true, unit_digest: b }, w8: UnitInstalled { active: true, unit_digest: b })) { OccupancyNotQuiet { live: lv } => length(lv) == 3 && !any(lv, h => (h as String) == (operator_host_srv5 as String))  _ => false })
-      && (match d0w_t_decide(declared: declared, incumbent: no_status, ranks: d0w_t_ranks(head: UnitInstalled { active: true, unit_digest: a }, w6: UnitInstalled { active: true, unit_digest: b }, w7: UnitInstalled { active: true, unit_digest: b }, w8: UnitInstalled { active: true, unit_digest: b }), h: c) {
-            D0DecidedFence { next: FencedRefusal { group: _, cause: _, disposition_authority: _ }, cause: D0IncumbentUnidentified { cause: _ } } => true
-            _ => false
-          })
-      && (match d0w_t_decide(declared: declared, incumbent: no_status, ranks: d0w_t_ranks(head: UnitOccupancyUnread { refusal: IncarnationUnitNotActive { unit: spark_pair_head_unit_name } }, w6: UnitInstalled { active: false, unit_digest: b }, w7: UnitInstalled { active: false, unit_digest: b }, w8: UnitInstalled { active: false, unit_digest: b }), h: c) {
-            D0DecidedFence { next: _, cause: D0OccupancyUnread { cause: _ } } => true
-            _ => false
-          })
-      && (match d0w_t_decide(declared: declared, incumbent: no_status, ranks: quiet_ranks, h: c) {
-            D0DecidedSuspend { next: _, reconciliation: DeclaredOccupantDrifted { drifted: ds } } => length(ds) == 4
-            _ => false
-          })
-      && (match d0w_t_decide(declared: declared, incumbent: IncumbentDidNotAnswer { receipt: "curl 7" as NonEmptyStr, head: HeadEndpointListening { port: d0w_port(n: 8000), rows: [TcpSocketRow { local_address: "00000000:1F40", local_port: TcpPortBound { port: 8000 }, state: "0A", uid: "0", inode: "0" }] } }, ranks: quiet_ranks, h: c) {
-            D0DecidedFence { next: _, cause: D0IncumbentUnidentified { cause: _ } } => true
-            _ => false
-          })
-      && (match d0w_t_decide(declared: declared, incumbent: IncumbentDidNotAnswer { receipt: "curl 7" as NonEmptyStr, head: HeadEndpointEngineProcess { listing: "4242 python -m vllm.entrypoints.openai.api_server" } }, ranks: quiet_ranks, h: c) {
-            D0DecidedFence { next: _, cause: D0IncumbentUnidentified { cause: _ } } => true
-            _ => false
-          })
-      && (match d0w_t_decide(declared: declared, incumbent: IncumbentDidNotAnswer { receipt: "curl 7" as NonEmptyStr, head: HeadEndpointUnread { cause: "/proc/net/tcp unread" as NonEmptyStr } }, ranks: quiet_ranks, h: c) {
-            D0DecidedFence { next: _, cause: D0OccupancyUnread { cause: _ } } => true
-            _ => false
-          })
-  })
-}
-
-fn d0w_same_order(hs: List<HostIdentity>, first: HostIdentity, last: HostIdentity) -> Bool {
-  length(hs) == 4
-    && (match get(xs: hs, index: 0) { Present { value: x } => (x as String) == (first as String)  Absent => false })
-    && (match get(xs: hs, index: 3) { Present { value: x } => (x as String) == (last as String)  Absent => false })
-}
-
-// EVERY STATE D0 WRITES CARRIES THE AUTHORIZED HOSTS, AND THE COMMITMENT READS THEM. The subject
-// names [h4, h3, h2, h1] (the group's hosts, reordered); the suspension and the fence D0 decides
-// commit exactly those, in the subject's order, whatever the roster says now -- and a resting
-// Active commits the roster.
-test fn the_states_d0_writes_commit_the_authorized_hosts_not_the_roster() -> Bool {
-  d0w_with_digests(scenario: fn(a, b, c) {
-    d0w_with_four_hosts(scenario: fn(h1, h2, h3, h4) {
-      let subject = d0w_t_subject_over(hs: [h4, h3, h2, h1], successor: c, term: 1000)
-      match d0w_t_grant(successor: c) {
-        Absent => false
-        Present { value: g0 } => {
-          let grant = OperatorGrant { escalation_id: g0.escalation_id, subject: subject, scopes: g0.scopes, purpose: g0.purpose, attempt: g0.attempt, intent_hash: g0.intent_hash, granted_by: g0.granted_by, granted_at: g0.granted_at, expires_at: g0.expires_at }
-          (match d0_decide(declared: DeclaredPairRealizationKeyed { declared: d0w_t_declared(head: a, worker: b) }, observation: D0Observation { group: FabricGroupA, incumbent: d0w_silent(), ranks: d0w_t_ranks(head: UnitInstalled { active: false, unit_digest: a }, w6: UnitInstalled { active: false, unit_digest: b }, w7: UnitInstalled { active: false, unit_digest: b }, w8: UnitInstalled { active: false, unit_digest: b }), vacancy: [] as List<RankVacancyReading> }, active: d0w_t_active(), lease: d0w_t_lease(h: c), grant: grant) {
-             D0DecidedSuspend { next: n, reconciliation: _ } => d0w_same_order(hs: pair_serving_committed_hosts(a: n), first: h4, last: h1)
-             _ => false
-           })
-            && (match d0_decide(declared: DeclaredPairRealizationKeyed { declared: d0w_t_declared(head: a, worker: b) }, observation: D0Observation { group: FabricGroupA, incumbent: IncumbentRouteUnread { cause: "w" as NonEmptyStr }, ranks: [] as List<RankOccupancyReading>, vacancy: [] as List<RankVacancyReading> }, active: d0w_t_active(), lease: d0w_t_lease(h: c), grant: grant) {
-                  D0DecidedFence { next: n, cause: _ } => d0w_same_order(hs: pair_serving_committed_hosts(a: n), first: h4, last: h1)
-                  _ => false
-                })
-            && length(pair_serving_committed_hosts(a: d0w_t_active())) == 4
-        }
-      }
-    })
-  })
-}
-
-// THE WET DOOR CONSUMES THE STORE'S WRITE-WALL DROP: while gunbc.rung_drop
-// fabric_storage_append_principal_unrefused stands the door's first gate names it and refuses; when the
-// row is retired the gate is absent. The gate is read from the row, so retiring the row is the
-// only thing that opens it. Asked for a lifecycle the single-lifecycle drop does not admit (group-b),
-// so the walls' own refusal is what answers.
-test fn the_wet_door_refuses_while_the_fabric_storage_write_wall_drop_stands() -> Bool {
-  let other = d0_store_write_wall_standing(group: FabricGroupB, escalation_id: d0_single_lifecycle_escalation_id)
-  match fabric_storage_append_principal_unrefused.standing {
-    Standing => (match other { Present { value: why } => why.contains("fabric_storage_append_principal_unrefused") && why.contains("does not run")  Absent => false })
-    Superseded { ruling: _, decision_record: _, loss_holder: _ } => (match other { Present { value: why } => why.contains("superseded") && why.contains("does not run")  Absent => false })
-    Retired { trigger_fired: _ } =>
-      match d0_store_operation_wall {
-        StoreOperationWallMissing { trigger: _ } => (match other { Present { value: why } => why.contains("d0_store_operation_wall") && why.contains("does not run")  Absent => false })
-        StoreOperationWallRestored { by: _ } => (match other { Absent => true  Present { value: _ } => false })
-      }
-  }
-}
-
-// THE SINGLE DECLARED LIFECYCLE (gunbc.rung_drop d0_store_walls_single_lifecycle, operator-ruled
-// 2026-09-30). POSITIVE CONTROL: with the drop standing, FabricGroupA under the named escalation id is
-// admitted by the walls' gate on the real row. REDS: a second consent id refuses; group-b refuses; and
-// with the drop retired even the named lifecycle refuses (the admission over a supplied standing).
-test fn the_declared_single_lifecycle_is_admitted_while_the_drop_stands() -> Bool {
-  match d0_store_walls_single_lifecycle.standing {
-    Retired { trigger_fired: _ } => true
-    Superseded { ruling: _, decision_record: _, loss_holder: _ } => true
-    Standing => (match d0_store_write_wall_standing(group: FabricGroupA, escalation_id: d0_single_lifecycle_escalation_id) { Absent => true  Present { value: _ } => false })
-  }
-}
-
-test fn a_second_consent_id_or_group_b_or_a_retired_drop_refuses_the_single_lifecycle() -> Bool {
-  !d0_single_lifecycle_admits_under(standing: Standing, group: FabricGroupA, escalation_id: "ds41-group-a-d0-20260927" as NonEmptyStr)
-    && !d0_single_lifecycle_admits_under(standing: Standing, group: FabricGroupB, escalation_id: d0_single_lifecycle_escalation_id)
-    && !d0_single_lifecycle_admits_under(standing: Retired { trigger_fired: "witness" as NonEmptyStr }, group: FabricGroupA, escalation_id: d0_single_lifecycle_escalation_id)
-    && d0_single_lifecycle_admits_under(standing: Standing, group: FabricGroupA, escalation_id: d0_single_lifecycle_escalation_id)
-}
diff --git a/dag/test/claim/spark/pair_serving_launch_receipt_witness_test.dag b/dag/test/claim/spark/pair_serving_launch_receipt_witness_test.dag
index 76b2cde757f..c484b58fa79 100644
--- a/dag/test/claim/spark/pair_serving_launch_receipt_witness_test.dag
+++ b/dag/test/claim/spark/pair_serving_launch_receipt_witness_test.dag
@@ -4,8 +4,10 @@ import std.types { Bool, String, Int, NonEmptyStr, List, EpochSecs }
 import std.optional { Present, Absent }
 import std.nat { Nat }
 import std.content_hash { ContentHash, Sha256Hash, Sha256Digest, Sha256DigestHex }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 import gunbc.spark.pair_serving_desired { spark_pair_serving_head }
+import product.host_identity { HostIdentity }
+import gunbc.fleet_host_identity { operator_host_srv10 }
 import gunbc.spark.vllm_serving_launch { VllmServingLaunch, vllm_serving_launch }
 import gunbc.spark.pair_serving_launch_receipt {
   LaunchTerminal, LaunchServing, LaunchExited, LaunchKilled, LaunchReadinessTimedOut, LaunchTerminalUnobserved,
@@ -37,7 +39,7 @@ fn w_launch_on(group: FabricGroup, invocation: String) -> VllmServingLaunch {
 }
 
 fn w_launch(invocation: String) -> VllmServingLaunch {
-  w_launch_on(group: FabricGroupA, invocation: invocation)
+  w_launch_on(group: FabricGroupB {}, invocation: invocation)
 }
 
 fn w_attempt_from(group: FabricGroup, invocation: String, n: Nat, terminal: LaunchTerminal, digest_hex: String) -> PairServingLaunchAttempt {
@@ -51,11 +53,30 @@ fn w_attempt_from(group: FabricGroup, invocation: String, n: Nat, terminal: Laun
   }
 }
 
+fn w_attempt_on_head(head: HostIdentity, invocation: String, n: Nat, terminal: LaunchTerminal, digest_hex: String) -> PairServingLaunchAttempt {
+  PairServingLaunchAttempt {
+    launch: vllm_serving_launch(
+      group: FabricGroupB {},
+      head: head,
+      systemd_invocation: invocation as NonEmptyStr,
+      container_id: "gunbc-spark-pair" as NonEmptyStr,
+      executable_digest: w_digest(hex: w_exe),
+      unit_digest: w_digest(hex: w_unit),
+      started_at: 1788000000,
+    ),
+    desired_digest: w_digest(hex: digest_hex),
+    attempt_number: n,
+    started_at: 1788000000,
+    terminal: terminal,
+    layout_receipt: none,
+  }
+}
+
 fn w_attempt(invocation: String, n: Nat, terminal: LaunchTerminal) -> PairServingLaunchAttempt {
-  w_attempt_from(group: FabricGroupA, invocation: invocation, n: n, terminal: terminal, digest_hex: w_unit)
+  w_attempt_from(group: FabricGroupB {}, invocation: invocation, n: n, terminal: terminal, digest_hex: w_unit)
 }
 
-// EXIT 137 IS A SIGKILL SHAPE. 128+n is the convention for "terminated by signal n", so the group A
+// EXIT 137 IS A SIGKILL SHAPE. 128+n is the convention for "terminated by signal n", so the group B
 // head's status=137 classifies as signal 9 and NOT as an ordinary exit status.
 test fn exit_codes_above_128_classify_as_the_signal_they_encode() -> Bool {
   (match launch_terminal_from_exit(code: 137) { LaunchKilled { signal: s } => s == 9  _ => false })
@@ -157,8 +178,8 @@ test fn no_recorded_attempts_is_unobserved_rather_than_not_serving() -> Bool {
 
 test fn a_mixed_digest_list_is_unobserved_rather_than_a_recovered_bring_up() -> Bool {
   let mixed = [
-    w_attempt_from(group: FabricGroupA, invocation: "inv-old", n: 1, terminal: launch_terminal_from_exit(code: 137), digest_hex: w_unit),
-    w_attempt_from(group: FabricGroupA, invocation: "inv-new", n: 2, terminal: LaunchServing, digest_hex: w_exe),
+    w_attempt_from(group: FabricGroupB {}, invocation: "inv-old", n: 1, terminal: launch_terminal_from_exit(code: 137), digest_hex: w_unit),
+    w_attempt_from(group: FabricGroupB {}, invocation: "inv-new", n: 2, terminal: LaunchServing, digest_hex: w_exe),
   ]
   (match serving_standing(attempts: mixed) {
      ServingStandingUnobserved { cause: c } => string_contains(s: c as String, pattern: "desired_digest")
@@ -169,8 +190,8 @@ test fn a_mixed_digest_list_is_unobserved_rather_than_a_recovered_bring_up() ->
 
 test fn a_mixed_host_list_is_unobserved_rather_than_a_recovered_bring_up() -> Bool {
   let mixed = [
-    w_attempt_from(group: FabricGroupA, invocation: "inv-a", n: 1, terminal: launch_terminal_from_exit(code: 137), digest_hex: w_unit),
-    w_attempt_from(group: FabricGroupB, invocation: "inv-b", n: 2, terminal: LaunchServing, digest_hex: w_unit),
+    w_attempt_from(group: FabricGroupB {}, invocation: "inv-a", n: 1, terminal: launch_terminal_from_exit(code: 137), digest_hex: w_unit),
+    w_attempt_on_head(head: operator_host_srv10, invocation: "inv-b", n: 2, terminal: LaunchServing, digest_hex: w_unit),
   ]
   match serving_standing(attempts: mixed) {
     ServingStandingUnobserved { cause: c } => string_contains(s: c as String, pattern: "mixes heads")
diff --git a/dag/test/claim/spark/rendezvous_participation_witness_test.dag b/dag/test/claim/spark/rendezvous_participation_witness_test.dag
index 1f8eb73bc8a..db81f76f822 100644
--- a/dag/test/claim/spark/rendezvous_participation_witness_test.dag
+++ b/dag/test/claim/spark/rendezvous_participation_witness_test.dag
@@ -21,7 +21,7 @@ import gunbc.spark.rendezvous_participation {
   declared_rank_host_is_connected, serving_group_rendezvous_reach_line,
 }
 import gunbc.spark.serving_group_launch { serving_group_rendezvous }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import extdeps.iproute2.ss { ss_established_to_peer_argv, ss_enumeration_line_count }
 
 // THE CLASS UNDER TEST IS `A SUPERVISOR'S LIVENESS READING CONSUMED AS PARTICIPATION`, and it is
@@ -155,11 +155,17 @@ test fn the_adrift_line_names_the_epoch_and_every_detached_host() -> Bool {
 test fn the_participation_query_asks_for_established_connections_to_the_exact_peer() -> Bool {
   let argv = ss_established_to_peer_argv(peer: t_peer)
   argv.length() == 8
-    && argv.first() == "/usr/bin/ss"
+    && (match argv.first() {
+        Present { value: v } => v == "/usr/bin/ss"
+        Absent => false
+      })
     && any(argv, a => a == "-H")
     && any(argv, a => a == "state")
     && any(argv, a => a == "established")
-    && argv.skip(n: 7).first() == (t_peer as String)
+    && (match argv.skip(n: 7).first() {
+        Present { value: v } => v == (t_peer as String)
+        Absent => false
+      })
 }
 
 // AN EMPTY COMPLETED ENUMERATION IS ZERO, NOT A REFUSAL. This is the boundary the head/rank pair
@@ -186,16 +192,11 @@ test fn the_native_arms_recovery_posture_is_declared_and_has_a_noticer() -> Bool
     && arm_recovery_is_noticed(posture: ConvergeRecoveredUnnoticed { obligation: "nobody" as NonEmptyStr }) == false
 }
 
-// ONLY THE ARM WITH A MODELED RENDEZVOUS CARRIES A ROSTER, and group A's `none` is UNASKED rather
-// than intact. Asserting both directions is what keeps a later edit from quietly giving group A a
-// TCPStore roster it does not have, or dropping group B's.
-test fn the_rendezvous_roster_is_group_bs_and_group_a_has_none() -> Bool {
-  (match serving_group_rendezvous(group: FabricGroupA) {
-      Absent => true
-      Present { value: _ } => false
-    })
-    && (match serving_group_rendezvous(group: FabricGroupB) {
-      Absent => false
-      Present { value: r } => r.ranked_hosts.length() == 4 && contains(r.master_endpoint as String, ":29501")
-    })
+// GROUP B'S ARM CARRIES ITS MODELED RENDEZVOUS ROSTER: four ranked hosts and the master endpoint on
+// :29501. A later edit that dropped the roster, or shrank it, goes red here.
+test fn the_rendezvous_roster_is_group_bs() -> Bool {
+  match serving_group_rendezvous(group: FabricGroupB {}) {
+    Absent => false
+    Present { value: r } => r.ranked_hosts.length() == 4 && contains(r.master_endpoint as String, ":29501")
+  }
 }
diff --git a/dag/test/claim/spark/serving_arm_launch_witness_test.dag b/dag/test/claim/spark/serving_arm_launch_witness_test.dag
index cddf8b36e46..b6f55d5c71f 100644
--- a/dag/test/claim/spark/serving_arm_launch_witness_test.dag
+++ b/dag/test/claim/spark/serving_arm_launch_witness_test.dag
@@ -48,7 +48,7 @@ fn planned_lines_for(profile: ServingLaunchProfile, f: fn(List<ArmNodeLaunch>) -
     checkpoint: Glm53NativeFp8,
     runtime: GunbcGlm53NopeDerivedGb10,
     topology: FourSparkTp4,
-    group: FabricGroupB,
+    group: FabricGroupB {},
     profile: profile,
     deployment_env: [] as List<DockerEnvAssignment>,
     container: glm_native_arm_container,
@@ -181,7 +181,7 @@ fn plan_unrun_subject(intent: ArmIntent) -> ArmLaunchPlan {
     checkpoint: Glm53NativeFp8,
     runtime: GunbcSparkrunVllmDs4Gb10,
     topology: FourSparkTp4,
-    group: FabricGroupB,
+    group: FabricGroupB {},
     intent: intent,
     profile: glm_native_initial_profile,
     deployment_env: [] as List<DockerEnvAssignment>,
@@ -220,7 +220,7 @@ fn plan_measured_subject(intent: ArmIntent) -> ArmLaunchPlan {
     checkpoint: Glm53NativeFp8,
     runtime: GunbcGlm53NopeDerivedGb10,
     topology: FourSparkTp4,
-    group: FabricGroupB,
+    group: FabricGroupB {},
     intent: intent,
     profile: glm_native_initial_profile,
     deployment_env: [] as List<DockerEnvAssignment>,
@@ -245,7 +245,7 @@ test fn w_the_measured_arm_refuses_normal_serving_at_the_memory_wall() -> Bool {
       checkpoint: Glm53NativeFp8,
       runtime: GunbcGlm53NopeDerivedGb10,
       topology: FourSparkTp4,
-      group: FabricGroupB,
+      group: FabricGroupB {},
       intent: ArmNormalServing,
       profile: glm_native_initial_profile,
       deployment_env: [] as List<DockerEnvAssignment>,
@@ -359,7 +359,7 @@ fn planned_experiment_lines(profile: ServingLaunchProfile, f: fn(List<ArmNodeLau
     checkpoint: Glm53NativeFp8,
     runtime: GunbcGlm53NopeDerivedGb10,
     topology: FourSparkTp4,
-    group: FabricGroupB,
+    group: FabricGroupB {},
     intent: ArmBoundedExperiment,
     profile: profile,
     deployment_env: [] as List<DockerEnvAssignment>,
@@ -377,7 +377,7 @@ fn planned_experiment_lines(profile: ServingLaunchProfile, f: fn(List<ArmNodeLau
 // plans; with the join deleted both would plan and this row goes red.
 fn w_plan_with_checkpoint_for_glm_profile(c: ServingCheckpoint) -> ArmLaunchPlan {
   plan_arm_launch_for(
-    checkpoint: c, runtime: GunbcGlm53NopeDerivedGb10, topology: FourSparkTp4, group: FabricGroupB,
+    checkpoint: c, runtime: GunbcGlm53NopeDerivedGb10, topology: FourSparkTp4, group: FabricGroupB {},
     intent: ArmBoundedExperiment, profile: glm_native_initial_profile,
     deployment_env: [] as List<DockerEnvAssignment>, container: glm_native_arm_container,
   )
diff --git a/dag/test/claim/spark/serving_deployment_selection_witness_test.dag b/dag/test/claim/spark/serving_deployment_selection_witness_test.dag
index c95fabb68de..30954abf3b2 100644
--- a/dag/test/claim/spark/serving_deployment_selection_witness_test.dag
+++ b/dag/test/claim/spark/serving_deployment_selection_witness_test.dag
@@ -14,7 +14,6 @@ import gunbc.spark.pair_serving_observed {
   GroupRankFreeMemoryObserved, gib_hundredths_interval, group_rank_free_memory_upper,
   group_rank_free_memory_region, group_rank_free_memory_observed,
 }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
 import std.pareto { AxisGap, AxisReading, LowerIsBetter, SelectionAxis }
 import std.decision { HardConstraint, SelectionEvidenceNeed, UnfundedAxis, CandidateStandingIncomplete, SubjectClosureIncomplete }
 import std.roster_frontier {
@@ -32,9 +31,8 @@ import gunbc.spark.runtime_architecture_registry_reading {
   gunbc_vllm_dsv41_gb10_registry_reading,
 }
 import product.host_identity { HostIdentity, host_identity_eq }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, fabric_group_wire }
-import gunbc.spark.pair_serving_desired { spark_pair_serving_groups }
+import gunbc.fleet_host_identity { operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import gunbc.spark.serving_subject {
   ServingSubject, PairServingUnitOn, PlacedServingArm, serving_subject_eq, glm_group_b_serving_subject,
 }
@@ -54,15 +52,15 @@ import gunbc.spark.serving_deployment_selection {
   per_rank_bytes_ceiling,
   FleetFit, FleetFitWithinAdmissible, FleetFitExceedsAdmissible, FleetFitDegenerate, fleet_fit_of, fleet_fit_admits,
   FleetSnapshot, spark_unified_memory_per_host, spark_unified_memory_how, covering_topologies_over,
-  ax_host_fit, ServedArtifactTransition, group_a_served_artifact_transition,
-  pair_unit_a_fleet_snapshot, glm_group_b_fleet_snapshot, pair_unit_a_evidence_current, glm_group_b_evidence_current,
+  ax_host_fit,
+  glm_group_b_fleet_snapshot, glm_group_b_evidence_current,
   serving_parameters_current, spark_runtime,
   artifact_deepseek_v4_flash_native, artifact_deepseek_v4_1_flash_native,
   artifact_glm_53_flash_native, artifact_glm_53_flash_2bit,
   fleet_admitted_topologies, native_quality_holds, no_redundancy_holds,
   topology_shape_eq,
   serving_selection_constraints, id_constraint_authority, ax_quality,
-  deepseek_v4_1_candidate_field, v4_1_declared_profiles,
+  v4_1_declared_profiles,
   TopologyShape, topology_shape,
   ServingDeploymentChoiceDomain, serving_deployment_domain,
   ServingDeploymentCandidateField, serving_candidate_field,
@@ -72,18 +70,17 @@ import gunbc.spark.serving_deployment_selection {
   ServingDeploymentSelection, ServingDeploymentSelected, ServingDeploymentNeedsEvidence,
   ServingDeploymentSelectionRefused, ServingDeploymentNeedsPolicy, NoFeasibleServingDeployment,
   select_serving_deployment,
-  v4_1_profile_standings_from, v4_1_candidate_field_from_sm12, v4_1_decision_input_from_sm12,
+  v4_1_profile_standings_from,
   v4_1_declared_profile_standings, ServingProfileReady, ServingProfileSm12JoinFailed,
   v4_1_profile_from_standing, serving_deployment_domain_over_standings, derived_candidates_for,
   id_v4_1_constraint_authority,
   ShapeAdmittedForPlacement, FabricPlacementRequired, admit_shape, compared_candidate_count,
-  glm_decision_input, deepseek_decision_input, deepseek_v4_1_decision_input,
+  glm_decision_input,
   deepseek_quality_requirement,
   deepseek_v4_1_selection_policy,
-  deepseek_v4_1_quality_requirement,
   derived_candidate_identity, v4_1_profile_at, v4_1_runtime_vllm_gb10_lead,
   ax_no_redundancy, ax_authorized_runtime, authorized_v4_1_runtime_holds,
-  glm_candidate_field, deepseek_candidate_field, glm_domain, deepseek_domain,
+  glm_candidate_field, glm_domain,
   unique_constraint_identities, constraint_native_quality, constraint_no_redundancy, constraint_authorized_runtime,
   serving_selection_axes, v4_1_selection_axes, ax_kv_bytes_per_token,
   sm12_kv_layout_standing, Sm12KvLayoutAdmitted, Sm12KvLayoutJoinFailed,
@@ -121,19 +118,6 @@ import extdeps.vllm.deepseek_v4_1_sm12 {
 }
 import extdeps.vllm.source_build { vllm_deepseek_v4_1_sm12_revision }
 
-// ── THE PRODUCTION SUBJECTS ANSWER WITH OBLIGATIONS ───────────────────────────────────────────
-//
-// Neither real subject returns a shape, and each is blocked on SEVERAL independent grounds rather
-// than one: no quality assessment for any exact profile, no runtime feasibility observation, an
-// unestablished workload demand, and ten unfunded performance dimensions. A single blocking axis
-// would mean the whole question turned on one measurement.
-test fn the_real_deepseek_subject_returns_obligations_rather_than_a_topology() -> Bool {
-  match select_serving_deployment(input: deepseek_decision_input) {
-    ServingDeploymentNeedsEvidence { needs: n, component_routes: _ } => count(n) > 0
-    _ => false
-  }
-}
-
 test fn the_real_glm_subject_returns_obligations_rather_than_a_shape() -> Bool {
   match select_serving_deployment(input: glm_decision_input) {
     ServingDeploymentNeedsEvidence { needs: n, component_routes: _ } => count(n) > 0
@@ -141,135 +125,6 @@ test fn the_real_glm_subject_returns_obligations_rather_than_a_shape() -> Bool {
   }
 }
 
-test fn live_select_is_sm12_admit_with_the_extdeps_roster() -> Bool {
-  match v4_1_gb10_kv_layout {
-    Sm12KvLayoutAdmitted { policy: k } =>
-      (w_kv_is(k: k, w: "fp8_ds_mla") && v41_sm12_kv_cache_dtype_admitted(dtype: vllm_kv_cache_dtype_wire(request: k)))
-    Sm12KvLayoutJoinFailed { wire: _, obligation: _ } => false
-  }
-    && match select_serving_deployment(input: v4_1_input_for_runtime(runtime: v4_1_runtime_published_arm64, stem: "sm12_designed")) {
-      NoFeasibleServingDeployment { causes: cs } =>
-        causes_name_axis(cs: cs, axis: ax_component_route)
-          && !causes_name_axis(cs: cs, axis: ax_host_fit)
-      _ => false
-    }
-    && decision_snapshot_key(input: deepseek_v4_1_decision_input)
-      == decision_snapshot_key(input: v4_1_decision_input_from_sm12(
-        wire: v41_sm12_kv_layout,
-        admitted: v41_sm12_admitted_kv_cache_dtypes,
-      ))
-}
-
-// THE DESIGNED NARROWING THIS REPLACES WAS FALSIFIED BY ITS OWN PREMISE EXPIRING, and the record is
-// kept here because the narrowing had been measured and reasoned about rather than guessed.
-//
-// WHAT IT WAS. The runtime is this claim's discriminator, not the field, so the field enumerated two
-// designed topologies -- tp4 x 2 replicas and tp8 x 1 -- rather than the twenty `fleet_admitted_topologies`
-// yielded over eight hosts. The cost that motivated it was real and measured: 393,216 eval_steps and 508ms
-// CPU, over the ceiling, with the cost in per-candidate route-standing production rather than in the
-// selection fold.
-//
-// WHY IT CANNOT STAND. Both designed shapes consume EIGHT ranks. #11308 made the host fit a HARD
-// CONSTRAINT over a subject-relative admissible set, and V4.1's subject holds one fabric group, so a
-// shape needing eight hosts is now excluded before Pareto on host fit. The field would have reached its
-// answer through host-fit exclusion and never through the runtime exclusion it exists to exercise -- a
-// fixture that still returns the expected verdict for a reason the claim is not about.
-//
-// SO THE FIELD IS DERIVED FROM THE ADMISSIBLE SET, which cannot be wrong about host fit by construction,
-// and the enumeration it yields is bounded by that set rather than by a hand-picked pair. The cost this
-// re-enrols is an obligation to MEASURE from `required_floor_claim_cost` rather than to predict: the host
-// set shrank at the same time, so the field is smaller than the twenty measured above, and by how much is
-// not something to arithmetic here. If it lands over the ceiling again, the narrowing gets redesigned
-// with shapes that FIT the admissible set, established by execution and not by inspection.
-// THE DESIGNED FIELD, REBUILT TO INHABIT THE ADMISSIBLE SET RATHER THAN TO IGNORE IT. Both shapes
-// consume AT MOST the four ranks the subject's admissible host set holds, so neither can be excluded
-// on host fit -- which is the failure the previous hand-picked pair had, both consuming eight.
-//
-// tp4 x 1 IS THE SHAPE CLOSEST TO FEASIBLE, and that is why it is the one kept: it is the only
-// topology whose per-rank Engram share comes within 2 GiB of the budget, so a claim over it
-// exercises the real margin and reds if the memory screen ever stops excluding. A field of
-// comfortably-infeasible shapes would be excluded by a wider margin and would say less.
-//
-// ONE TOPOLOGY, NOT TWO, AND THE SECOND ONE'S REASON DID NOT SURVIVE MEASUREMENT. A tp2 x 1 shape
-// was carried alongside so the assertion would not rest on a single candidate. That rationale is
-// sound where the FIELD is the claim's subject -- and it is not, for either consumer here: their
-// subjects are runtime admission and the extdeps roster, and the field is incidental to both. It
-// cost 14,000-odd eval steps per topology to assert nothing either claim is about, which put
-// `unauthorized_v4_1_runtime_is_excluded_before_unread_axes` 7.5% over the new-witness budget at
-// 77,755 against 72,300. Measured, not estimated: 163,305 steps over eight topologies, 77,755 over
-// two.
-//
-// WHAT THIS IS NOT: a return to hand-picked topologies. The lesson of the falsified pair was that a
-// designed narrowing must INHABIT its subject, not that narrowing is forbidden -- and inhabitance
-// here is CHECKED BY EXECUTION rather than asserted, because each consuming claim must still reach
-// its verdict through the mechanism it exists to exercise rather than through host fit. That check
-// is the `ax_host_fit` conjunct in both consumers, and it is a standing control rather than
-// something an author did once.
-data v4_1_designed_topologies: List<TopologyShape> = [
-  topology_shape(tensor_parallel_degree: 4, replica_count: 1),
-]
-
-fn v4_1_input_for_runtime(runtime: RuntimeRevision, stem: String) -> ServingDeploymentDecisionInput {
-  let standings = [v4_1_profile_from_standing(runtime: runtime, standing: v4_1_gb10_kv_layout)]
-  let domain = serving_deployment_domain_over_standings(
-    artifacts: [artifact_deepseek_v4_1_flash_native],
-    topologies: v4_1_designed_topologies,
-    standings: standings,
-  )
-  serving_decision_input(
-    field: serving_candidate_field(
-      identity: decl_ref(module_path: "test.claim.spark.serving_deployment_selection_witness_test", decl_name: stem),
-      domain: domain,
-      candidates: derived_candidates_for(stem: stem, domain: domain),
-    ),
-    evidence: pair_unit_a_evidence_current,
-    quality_requirement: deepseek_v4_1_quality_requirement,
-    selection_policy: deepseek_v4_1_selection_policy,
-    constraints: v4_1_selection_constraints,
-    constraint_authority: id_v4_1_constraint_authority,
-    axes: v4_1_selection_axes,
-  )
-}
-
-// ONE FOLD OVER EXCLUSION CAUSES, KEYED BY THE AXIS ASKED ABOUT. The previous shape hard-coded
-// ax_authorized_runtime, and the moment a second axis had to be asked about the honest move was to
-// generalise the existing fold rather than mint a parallel `causes_name_component_route` beside it.
-fn causes_name_axis(cs: List<NonEmptyStr>, axis: DeclarationRef) -> Bool {
-  any(cs, s => string_contains(s: s as String, pattern: declaration_ref_display_key(ref: axis)))
-}
-
-test fn unauthorized_v4_1_runtime_is_excluded_before_unread_axes() -> Bool {
-  match select_serving_deployment(input: v4_1_input_for_runtime(runtime: v4_1_runtime_vllm_gb10_lead, stem: "plant_gb10_lead")) {
-    NoFeasibleServingDeployment { causes: cs } => causes_name_axis(cs: cs, axis: ax_authorized_runtime)
-    _ => false
-  }
-    && match select_serving_deployment(input: v4_1_input_for_runtime(runtime: spark_runtime, stem: "plant_spark_runtime")) {
-      NoFeasibleServingDeployment { causes: cs } => causes_name_axis(cs: cs, axis: ax_authorized_runtime)
-      _ => false
-    }
-    && match select_serving_deployment(input: v4_1_input_for_runtime(runtime: v4_1_runtime_published_arm64, stem: "plant_published_arm64")) {
-      NoFeasibleServingDeployment { causes: cs } =>
-        causes_name_axis(cs: cs, axis: ax_component_route)
-          && !causes_name_axis(cs: cs, axis: ax_authorized_runtime)
-          && !causes_name_axis(cs: cs, axis: ax_host_fit)
-      _ => false
-    }
-    && match v4_1_runtime_published_arm64.vllm_source {
-      VllmSourceRevisionUnestablished { reported_version: _, obligation: _ } => true
-      VllmSourceRevisionEstablished { git: _ } => false
-    }
-}
-
-test fn matching_the_authorized_v4_1_digest_does_not_establish_source() -> Bool {
-  any(deepseek_v4_1_candidate_field.candidates, c =>
-    authorized_v4_1_runtime_holds(c: c)
-      && match c.profile.runtime.vllm_source {
-        VllmSourceRevisionUnestablished { reported_version: _, obligation: _ } => true
-        VllmSourceRevisionEstablished { git: _ } => false
-      })
-    && any(deepseek_v4_1_candidate_field.candidates, c => !authorized_v4_1_runtime_holds(c: c))
-}
-
 // ── FIXTURES ──────────────────────────────────────────────────────────────────────────────────
 data suite_ref: DeclarationRef = decl_ref(module_path: "test.claim.spark.serving_deployment_selection_witness_test", decl_name: "suite_ref")
 
@@ -289,8 +144,13 @@ fn fixture_fleet_over(hosts: List<HostIdentity>) -> FleetSnapshot {
   }
 }
 
+data fixture_host_1: HostIdentity = "fixture-host-1" as HostIdentity
+data fixture_host_2: HostIdentity = "fixture-host-2" as HostIdentity
+data fixture_host_3: HostIdentity = "fixture-host-3" as HostIdentity
+data fixture_host_4: HostIdentity = "fixture-host-4" as HostIdentity
+
 data fixture_eight_host_fleet: FleetSnapshot = fixture_fleet_over(hosts: [
-  operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8,
+  fixture_host_1, fixture_host_2, fixture_host_3, fixture_host_4,
   operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12,
 ])
 
@@ -809,7 +669,7 @@ test fn a_passing_quality_and_established_demand_still_need_the_performance_evid
 // and endpoints is the fabric's relation, and the shape carries replica ORDINALS rather than host
 // identities so it cannot pretend otherwise.
 test fn an_under_evidenced_decision_cannot_reach_placement() -> Bool {
-  match admit_shape(s: select_serving_deployment(input: deepseek_decision_input)) {
+  match admit_shape(s: select_serving_deployment(input: glm_decision_input)) {
     FabricPlacementRequired { because: _ } => true
     ShapeAdmittedForPlacement { shape: _ } => false
   }
@@ -868,119 +728,37 @@ test fn a_deployment_of_no_replicas_does_not_fit_the_fleet() -> Bool {
 
 // ── RED: A SHAPE NEEDING MORE HOSTS THAN THE SUBJECT IS ADMITTED REFUSES, NAMING THE HOSTS ─────
 //
-// THIS IS THE FAIL-OPEN THE SCALAR CARRIED. Against the production pair unit on group A, a two-replica
+// THIS IS THE FAIL-OPEN THE SCALAR CARRIED. Against group B's assigned subject, a two-replica
 // four-rank shape needs eight hosts and the subject is admitted four: the refusal carries exactly
-// srv5-srv8 by identity and a shortfall of four, and the positive control -- the one-replica shape
-// that runs there today -- is admitted over the same four identities. Before this change the same
-// call answered true against `host_count: 8`.
+// srv9-srv12 by identity and a shortfall of four, and the positive control -- the one-replica shape --
+// is admitted over the same four identities. Before the admissible set existed the same call answered
+// true against `host_count: 8`.
 test fn a_shape_wider_than_the_admissible_set_refuses_by_name() -> Bool {
-  (match fleet_fit_of(c: native_tp4_x2, fleet: pair_unit_a_fleet_snapshot) {
+  (match fleet_fit_of(c: native_tp4_x2, fleet: glm_group_b_fleet_snapshot) {
      FleetFitExceedsAdmissible { subject: s, required: r, admissible: hs, short_by: k } =>
-       serving_subject_eq(a: s, b: PairServingUnitOn { group: FabricGroupA })
+       serving_subject_eq(a: s, b: glm_group_b_serving_subject)
          && r == 8 && k == 4
-         && contains_host(hosts: hs, host: operator_host_srv5)
-         && contains_host(hosts: hs, host: operator_host_srv6)
-         && contains_host(hosts: hs, host: operator_host_srv7)
-         && contains_host(hosts: hs, host: operator_host_srv8)
-         && !contains_host(hosts: hs, host: operator_host_srv9)
-         && !contains_host(hosts: hs, host: operator_host_srv10)
-         && !contains_host(hosts: hs, host: operator_host_srv11)
-         && !contains_host(hosts: hs, host: operator_host_srv12)
+         && contains_host(hosts: hs, host: operator_host_srv9)
+         && contains_host(hosts: hs, host: operator_host_srv10)
+         && contains_host(hosts: hs, host: operator_host_srv11)
+         && contains_host(hosts: hs, host: operator_host_srv12)
      _ => false
    })
-    && (match fleet_fit_of(c: cand(name: "tp4x1_on_a", art: artifact_deepseek_v4_flash_native, t: topology_shape(tensor_parallel_degree: 4, replica_count: 1)), fleet: pair_unit_a_fleet_snapshot) {
+    && (match fleet_fit_of(c: cand(name: "tp4x1_on_b", art: artifact_deepseek_v4_flash_native, t: topology_shape(tensor_parallel_degree: 4, replica_count: 1)), fleet: glm_group_b_fleet_snapshot) {
          FleetFitWithinAdmissible { subject: _, required: r, admissible: hs } =>
-           r == 4 && contains_host(hosts: hs, host: operator_host_srv5) && !contains_host(hosts: hs, host: operator_host_srv9)
+           r == 4 && contains_host(hosts: hs, host: operator_host_srv9) && contains_host(hosts: hs, host: operator_host_srv12)
          _ => false
        })
 }
 
-// THE PRODUCTION SETS, BY IDENTITY IN BOTH DIRECTIONS. V4.1 resolves to the pair unit on group A
-// through the dated transition row and is admitted srv5-srv8 and nothing else; the GLM canary's
-// subject is admitted srv9-srv12 and nothing of group A. A set of the right size holding the wrong
-// hosts is exactly what a count could not detect, so no length appears here.
-test fn the_v4_1_subject_is_admitted_group_a_and_the_canary_subject_group_b() -> Bool {
-  let a = pair_unit_a_fleet_snapshot.admissible_hosts
+// THE PRODUCTION SET, BY IDENTITY. The GLM subject is admitted srv9-srv12, the hosts of its cage. A set
+// of the right size holding the wrong hosts is exactly what a count could not detect, so no length
+// appears here.
+test fn the_canary_subject_is_admitted_group_b() -> Bool {
   let b = glm_group_b_fleet_snapshot.admissible_hosts
-  serving_subject_eq(a: pair_unit_a_fleet_snapshot.subject, b: group_a_served_artifact_transition.subject)
-    && serving_subject_eq(a: glm_group_b_fleet_snapshot.subject, b: glm_group_b_serving_subject)
-    && contains_host(hosts: a, host: operator_host_srv5) && contains_host(hosts: a, host: operator_host_srv6)
-    && contains_host(hosts: a, host: operator_host_srv7) && contains_host(hosts: a, host: operator_host_srv8)
-    && !contains_host(hosts: a, host: operator_host_srv9) && !contains_host(hosts: a, host: operator_host_srv10)
-    && !contains_host(hosts: a, host: operator_host_srv11) && !contains_host(hosts: a, host: operator_host_srv12)
+  serving_subject_eq(a: glm_group_b_fleet_snapshot.subject, b: glm_group_b_serving_subject)
     && contains_host(hosts: b, host: operator_host_srv9) && contains_host(hosts: b, host: operator_host_srv10)
     && contains_host(hosts: b, host: operator_host_srv11) && contains_host(hosts: b, host: operator_host_srv12)
-    && !contains_host(hosts: b, host: operator_host_srv5) && !contains_host(hosts: b, host: operator_host_srv6)
-    && !contains_host(hosts: b, host: operator_host_srv7) && !contains_host(hosts: b, host: operator_host_srv8)
-}
-
-// THE TRANSITION ROW IS THE ROUTE, NOT A DECORATION: its subject's group is a group this repository
-// claims, its two sides are the two DeepSeek artifacts in the order the ruling names, both DeepSeek
-// domains take their artifact from it, and the V4.1 quality requirement is about its TO side.
-test fn the_group_a_transition_is_consumed_by_both_deepseek_fields() -> Bool {
-  (match group_a_served_artifact_transition.subject {
-     PairServingUnitOn { group: g } =>
-       any(spark_pair_serving_groups, claimed => (fabric_group_wire(g: claimed) as String) == (fabric_group_wire(g: g) as String))
-     PlacedServingArm { arm: _ } => false
-   })
-    && declaration_ref_eq(a: group_a_served_artifact_transition.from.identity, b: artifact_deepseek_v4_flash_native.identity)
-    && declaration_ref_eq(a: group_a_served_artifact_transition.to.identity, b: artifact_deepseek_v4_1_flash_native.identity)
-    && all(deepseek_domain.artifacts, a => declaration_ref_eq(a: a.identity, b: group_a_served_artifact_transition.from.identity))
-    && all(deepseek_v4_1_candidate_field.domain.artifacts, a => declaration_ref_eq(a: a.identity, b: group_a_served_artifact_transition.to.identity))
-    && declaration_ref_eq(a: deepseek_v4_1_quality_requirement.required_artifact, b: group_a_served_artifact_transition.to.identity)
-    && (group_a_served_artifact_transition.ruling.ruled_on as String) == "2026-09-12"
-    && decision_snapshot_key(input: deepseek_decision_input) != decision_snapshot_key(input: deepseek_v4_1_decision_input)
-}
-
-// A PLANTED EIGHT-RANK V4.1 SHAPE IS EXCLUDED BEFORE PARETO, NOT LEFT AS AN OBLIGATION. The production
-// V4.1 domain never enumerates it (four admissible hosts), so it is planted: a field of exactly that
-// shape over the authorized runtime answers NoFeasible under the host-fit constraint, where the same
-// field over the eight-host fixture fleet answers with evidence obligations. This is the exclusion
-// deep-crane-826's memory screen relies on host admissibility for (their #11193), and it holds even
-// though V4.1's footprint is externally reported -- the host fit is its own reading, never a gap.
-test fn a_planted_eight_rank_v4_1_shape_is_infeasible_on_group_a_and_open_on_eight_hosts() -> Bool {
-  match v4_1_profile_at(runtime: v4_1_runtime_published_arm64) {
-    ServingProfileSm12JoinFailed { runtime: _, standing: _ } => false
-    ServingProfileReady { profile: p } => {
-      let t = topology_shape(tensor_parallel_degree: 8, replica_count: 1)
-      let domain = serving_deployment_domain_over_standings(
-        artifacts: [artifact_deepseek_v4_1_flash_native],
-        topologies: [t],
-        standings: [ServingProfileReady { profile: p }],
-      )
-      let field = serving_candidate_field(
-        identity: decl_ref(module_path: "test.claim.spark.serving_deployment_selection_witness_test", decl_name: "a_planted_eight_rank_v4_1_shape_is_infeasible_on_group_a_and_open_on_eight_hosts"),
-        domain: domain,
-        candidates: derived_candidates_for(stem: "planted_tp8", domain: domain),
-      )
-      let over_a = serving_decision_input(
-        field: field,
-        evidence: pair_unit_a_evidence_current,
-        quality_requirement: deepseek_v4_1_quality_requirement,
-        selection_policy: deepseek_v4_1_selection_policy,
-        constraints: v4_1_selection_constraints,
-        constraint_authority: id_v4_1_constraint_authority,
-        axes: v4_1_selection_axes,
-      )
-      let over_eight = serving_decision_input(
-        field: field,
-        evidence: serving_evidence_snapshot(quality: [], runtime_feasibility: [], workload: unestablished_demand, fleet: fixture_eight_host_fleet, fleet_receipt: fixture_fleet_ref),
-        quality_requirement: deepseek_v4_1_quality_requirement,
-        selection_policy: deepseek_v4_1_selection_policy,
-        constraints: v4_1_selection_constraints,
-        constraint_authority: id_v4_1_constraint_authority,
-        axes: v4_1_selection_axes,
-      )
-      (match select_serving_deployment(input: over_a) {
-         NoFeasibleServingDeployment { causes: cs } => count(cs) > 0
-         _ => false
-       })
-        && (match select_serving_deployment(input: over_eight) {
-              ServingDeploymentNeedsEvidence { needs: n } => count(n) > 0
-              _ => false
-            })
-    }
-  }
 }
 
 // THE EVIDENCE IDENTITY MOVES WITH THE HOST IDENTITIES, NOT WITH THEIR NUMBER. Two fixture fleets of
@@ -999,8 +777,8 @@ fn settled_input_over(f: FleetSnapshot) -> ServingDeploymentDecisionInput {
 }
 
 test fn swapping_one_admissible_host_for_another_changes_the_decision_identity() -> Bool {
-  let left = fixture_fleet_over(hosts: [operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8])
-  let right = fixture_fleet_over(hosts: [operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv9])
+  let left = fixture_fleet_over(hosts: [fixture_host_1, fixture_host_2, fixture_host_3, fixture_host_4])
+  let right = fixture_fleet_over(hosts: [fixture_host_1, fixture_host_2, fixture_host_3, operator_host_srv9])
   decision_snapshot_key(input: settled_input_over(f: left)) != decision_snapshot_key(input: settled_input_over(f: right))
     && decision_snapshot_key(input: settled_input_over(f: left)) == decision_snapshot_key(input: settled_input_over(f: left))
 }
@@ -1027,50 +805,6 @@ fn topology_in(shapes: List<TopologyShape>, tp: Nat, replicas: Nat) -> Bool {
   any(shapes, t => topology_shape_eq(a: t, b: topology_shape(tensor_parallel_degree: tp, replica_count: replicas)))
 }
 
-// THE V4.1 DOMAIN IS EVERY SHAPE THE PAIR UNIT ON GROUP A ADMITS, AND NOTHING WIDER: the four
-// admissible identities enumerate tp1-tp4, and no five-to-eight-rank shape exists in the domain to
-// be screened. That absence is asserted by identity of shape rather than by the domain's length.
-test fn v4_1_field_is_complete_over_every_shape_the_fleet_admits() -> Bool {
-  let admitted = fleet_admitted_topologies(fleet: pair_unit_a_fleet_snapshot)
-  match establish_serving_candidate_field(field: deepseek_v4_1_candidate_field) {
-    ServingFieldEstablished =>
-      topology_in(shapes: admitted, tp: 4, replicas: 1)
-        && topology_in(shapes: admitted, tp: 2, replicas: 1)
-        && topology_in(shapes: admitted, tp: 1, replicas: 1)
-        && topology_in(shapes: admitted, tp: 2, replicas: 2)
-        && !topology_in(shapes: admitted, tp: 5, replicas: 1)
-        && !topology_in(shapes: admitted, tp: 6, replicas: 1)
-        && !topology_in(shapes: admitted, tp: 7, replicas: 1)
-        && !topology_in(shapes: admitted, tp: 8, replicas: 1)
-        && !topology_in(shapes: admitted, tp: 4, replicas: 2)
-        && all(deepseek_v4_1_candidate_field.domain.topologies, t => topology_in(shapes: admitted, tp: t.tensor_parallel_degree, replicas: t.replica_count))
-        && count(v4_1_declared_profiles) == 3
-        && (v4_1_runtime_published_arm64.image as String) == (v41_published_arm64_reference() as String)
-        && match v4_1_runtime_published_arm64.vllm_source {
-          VllmSourceRevisionUnestablished { reported_version: v, obligation: _ } =>
-            (v as String) == (v41_published_distribution_name as String)
-          VllmSourceRevisionEstablished { git: _ } => false
-        }
-        && match v41_published_stamped_identifier_lookup {
-          PublicCommitAbsent => true
-          PublicCommitPresent => false
-          PublicCommitUnasked => false
-        }
-        && match spark_runtime.vllm_source {
-          VllmSourceRevisionUnestablished { reported_version: _, obligation: _ } => true
-          VllmSourceRevisionEstablished { git: _ } => false
-        }
-        && match v4_1_runtime_vllm_gb10_lead.vllm_source {
-          VllmSourceRevisionEstablished { git: g } =>
-            (g as String) == (vllm_deepseek_v4_1_sm12_revision.full_revision as String)
-          VllmSourceRevisionUnestablished { reported_version: _, obligation: _ } => false
-        }
-        && (v4_1_runtime_vllm_gb10_lead.image as String)
-          == (gunbc_vllm_dsv41_gb10_registry_reading.image_reference as String)
-    ServingFieldUnestablished { causes: _ } => false
-  }
-}
-
 test fn v4_1_gb10_kv_layout_is_fp8_ds_mla_and_bytes_per_token_are_unestablished() -> Bool {
   token_count_value(t: serving_parameters_current.max_model_len) == 300000
     && all(v4_1_declared_profiles, p =>
@@ -1113,7 +847,16 @@ fn planted_join_is_named_failure(wire: NonEmptyStr, admitted: List<NonEmptyStr>)
 
 fn planted_field_names_join_and_keeps_profiles(wire: NonEmptyStr, admitted: List<NonEmptyStr>) -> Bool {
   let standings = v4_1_profile_standings_from(standing: sm12_kv_layout_standing(wire: wire, admitted: admitted))
-  let field = v4_1_candidate_field_from_sm12(wire: wire, admitted: admitted)
+  let domain = serving_deployment_domain_over_standings(
+    artifacts: [artifact_deepseek_v4_1_flash_native],
+    topologies: [topology_shape(tensor_parallel_degree: 4, replica_count: 1)],
+    standings: standings,
+  )
+  let field = serving_candidate_field(
+    identity: decl_ref(module_path: "test.claim.spark.serving_deployment_selection_witness_test", decl_name: "planted_field_names_join_and_keeps_profiles"),
+    domain: domain,
+    candidates: derived_candidates_for(stem: "planted_sm12", domain: domain),
+  )
   count(standings) == 3
     && all(standings, s => match s {
       ServingProfileReady { profile: p } =>
@@ -1131,38 +874,10 @@ fn planted_field_names_join_and_keeps_profiles(wire: NonEmptyStr, admitted: List
         any(cs, c => names_sm12_kv_join(s: c))
           && !any(cs, c => string_contains(s: c as String, pattern: "no serving profiles"))
     }
-    && match select_serving_deployment(input: v4_1_decision_input_from_sm12(wire: wire, admitted: admitted)) {
-      ServingDeploymentSelectionRefused { defects: ds } => any(ds, d => names_sm12_kv_join(s: d))
-      ServingDeploymentNeedsEvidence { needs: _, component_routes: _ } => false
-      ServingDeploymentSelected { selected: _ } => false
-      ServingDeploymentNeedsPolicy { survivors: _, component_routes: _ } => false
-      NoFeasibleServingDeployment { causes: _ } => false
-    }
-}
-
-test fn different_failed_sm12_wires_have_different_decision_identities() -> Bool {
-  let empty_admit: List<NonEmptyStr> = []
-  let unadmitted = vllm_kv_cache_dtype_wire(request: KvAuto)
-  let planted_admit = w_planted_nomatch_roster()
-  let nomatch_opt = (filter(planted_admit, d =>
-    match vllm_kv_cache_dtype_request_matching_wire(wire: d) {
-      Absent => true
-      Present { value: _ } => false
-    })).first()
-  match nomatch_opt {
-    Absent => false
-    Present { value: nomatch } =>
-      decision_snapshot_key(input: v4_1_decision_input_from_sm12(wire: unadmitted, admitted: planted_admit))
-        != decision_snapshot_key(input: v4_1_decision_input_from_sm12(wire: nomatch, admitted: planted_admit))
-        && decision_snapshot_key(input: v4_1_decision_input_from_sm12(wire: unadmitted, admitted: planted_admit))
-          != decision_snapshot_key(input: v4_1_decision_input_from_sm12(wire: v41_sm12_kv_layout, admitted: empty_admit))
-        && decision_snapshot_key(input: v4_1_decision_input_from_sm12(wire: nomatch, admitted: planted_admit))
-          != decision_snapshot_key(input: v4_1_decision_input_from_sm12(wire: v41_sm12_kv_layout, admitted: empty_admit))
-  }
 }
 
 // ONE WITNESS PER PLANTED WIRE, BECAUSE THREE FIELD CONSTRUCTIONS IN ONE CLAIM IS THREE CLAIMS
-// WEARING A CONJUNCTION. Each of these drives `v4_1_candidate_field_from_sm12` once, and the previous
+// WEARING A CONJUNCTION. Each of these builds a planted V4.1 field once, and the previous
 // single claim drove it three times for 110,408 eval steps against a 72,300 new-witness budget. The
 // split loses no coverage -- every conjunct survives, attached to the wire it is about -- which is the
 // difference between splitting and dropping a case. Operator ruling 2026-09-14: a witness
@@ -1219,7 +934,7 @@ test fn a_planted_nomatch_wire_keeps_a_named_join_standing() -> Bool {
 
 // AN EMPTY ADMITTED ROSTER FAILS THE JOIN FOR A WIRE THAT IS OTHERWISE THE REAL ONE, which is what
 // separates "this wire is wrong" from "there is nothing to join against". The positive controls ride
-// here because they are about the same real wire: the live field IS established, and the real wire
+// here because they are about the same real wire: the real wire
 // against the real roster IS admitted as fp8_ds_mla -- so the three negatives above are failing for
 // the planted reason rather than because this join never succeeds.
 test fn an_empty_admitted_roster_keeps_a_named_join_standing() -> Bool {
@@ -1231,33 +946,6 @@ test fn an_empty_admitted_roster_keeps_a_named_join_standing() -> Bool {
 // THE POSITIVE CONTROL FOR THE PLANTED FAMILY. The three planted claims assert that a BROKEN join is
 // named; this asserts the join SUCCEEDS for the real wire against the real roster. Without it all
 // three negatives could be passing because that join never succeeds at all.
-//
-// THE LIVE FIELD'S ESTABLISHMENT IS SUPPLIED HERE AND EXECUTED THERE, which is the strengthened
-// obligation applied rather than evaded: a boundary may be supplied in any number of claims so long as
-// SOME claim still runs it for real, and the execution that may never be removed is the product root.
-//
-// THE IMPLICATION IS EXACT AND CHECKABLE FROM TWO BODIES, not asserted. This claim used to call
-// `establish_serving_candidate_field(field: deepseek_v4_1_candidate_field)` for ~98,000 of its 108,443
-// eval steps. That function IS `establish_serving_candidate_field_over(field, routed_candidates(field))`
-// -- and `select_over_routed` makes THAT SAME CALL WITH THE SAME ARGUMENTS as its first act, returning
-// `ServingDeploymentSelectionRefused` on `ServingFieldUnestablished`. So
-// `the_live_v4_1_serving_decision_excludes_every_admissible_candidate`, which asserts
-// `NoFeasibleServingDeployment` and returns FALSE on the refused arm, cannot pass unless the live field
-// is established. The establishment was being computed twice and asserted twice.
-//
-// WHY THIS IS NOT THE MISTAKE MADE EARLIER ON THIS BRANCH. A previous decomposition supplied BOTH
-// halves -- behaviour over a designed field, inhabitance with no decision -- and left ZERO executions
-// of the live decision, which a reviewer caught. Here one execution survives BY CONSTRUCTION: the
-// product root is untouched, and if it is ever deleted this claim's supplied boundary loses its
-// warrant. That is the pairing the rule requires, and the execution that carries it is the claim
-// `the_live_v4_1_serving_decision_excludes_every_admissible_candidate` in this module.
-//
-// NAMED AS A SYMBOL RATHER THAN AS A GREP, AND THAT IS NOT PEDANTRY -- THE GREP DOES NOT WORK. Two
-// annotations in this file, including this one, discuss that call by quoting it, so a count of the
-// pattern reports THREE where one execution exists, and it would still report TWO if the product root
-// were deleted. A guard fooled by prose about the guard cannot detect the regression it exists for,
-// which is section 3's cite-the-symbol rule earning its keep: the claim's name is reachable from the
-// namespace tree and a quoted string in a comment is not.
 test fn the_real_sm12_wire_joins_as_fp8_ds_mla() -> Bool {
   match sm12_kv_layout_standing(wire: v41_sm12_kv_layout, admitted: v41_sm12_admitted_kv_cache_dtypes) {
     Sm12KvLayoutAdmitted { policy: k } =>
@@ -1330,10 +1018,6 @@ test fn kv_bytes_axis_is_v4_1_only_and_engram_is_standing_not_an_axis() -> Bool
     }
 }
 
-test fn v4_1_selection_policy_is_not_the_quality_requirement() -> Bool {
-  !declaration_ref_eq(a: deepseek_v4_1_selection_policy, b: deepseek_v4_1_quality_requirement.identity)
-}
-
 // THE EXPECTED CONSTRAINT AUTHORITIES ARE NAMED, AND THE JOIN RUNS BOTH WAYS. A first cut asserted
 // `count(v41_ids) == 4` beside three `any` checks; adding `constraint_component_route` made it five, and
 // the three named identities were all still present, so the witness failed on the assertion that said
@@ -1361,7 +1045,7 @@ fn identity_populations_agree(actual: List<DeclarationRef>, expected: List<Decla
 
 test fn assessment_dispositions_join_the_constraint_identities_on_the_input() -> Bool {
   let glm_ids = unique_constraint_identities(cs: glm_decision_input.constraints)
-  let v41_ids = unique_constraint_identities(cs: deepseek_v4_1_decision_input.constraints)
+  let v41_ids = unique_constraint_identities(cs: v4_1_selection_constraints)
   identity_populations_agree(actual: glm_ids, expected: expected_glm_constraint_authorities)
     && identity_populations_agree(actual: v41_ids, expected: expected_v4_1_constraint_authorities)
     && !any(glm_ids, id => declaration_ref_eq(a: id, b: constraint_no_redundancy))
@@ -1369,10 +1053,9 @@ test fn assessment_dispositions_join_the_constraint_identities_on_the_input() ->
 }
 
 // THE COVERING CARTESIAN IS OVER THE SUBJECT'S ADMISSIBLE SET. GLM covers the canary's four hosts,
-// so tp4 x1 is in and tp4 x2 -- eight hosts -- is not; before this change the same claim asserted
-// the reverse over a scalar eight. The DeepSeek V4 Flash field covers the pair unit's four hosts and
-// carries tp4 x1, the shape that runs on group A today, and not tp8 x1.
-test fn glm_and_deepseek_fields_are_the_derived_admitted_cartesian() -> Bool {
+// so tp4 x1 is in and tp4 x2 -- eight hosts -- is not; before the admissible set existed the same
+// claim asserted the reverse over a scalar eight.
+test fn glm_field_is_the_derived_admitted_cartesian() -> Bool {
   match establish_serving_candidate_field(field: glm_candidate_field) {
     ServingFieldEstablished =>
       count(glm_candidate_field.candidates)
@@ -1382,14 +1065,6 @@ test fn glm_and_deepseek_fields_are_the_derived_admitted_cartesian() -> Bool {
         && !topology_in(shapes: glm_domain.topologies, tp: 4, replicas: 2)
         && !topology_in(shapes: glm_domain.topologies, tp: 8, replicas: 1)
     ServingFieldUnestablished { causes: _ } => false
-  } && match establish_serving_candidate_field(field: deepseek_candidate_field) {
-    ServingFieldEstablished =>
-      count(deepseek_candidate_field.candidates)
-        == count(deepseek_domain.artifacts) * count(deepseek_domain.topologies) * count(deepseek_domain.profiles)
-        && topology_in(shapes: deepseek_domain.topologies, tp: 4, replicas: 1)
-        && !topology_in(shapes: deepseek_domain.topologies, tp: 8, replicas: 1)
-        && !topology_in(shapes: deepseek_domain.topologies, tp: 4, replicas: 2)
-    ServingFieldUnestablished { causes: _ } => false
   }
 }
 
@@ -1413,11 +1088,8 @@ test fn a_report_about_a_different_artifact_cannot_pass_this_requirement() -> Bo
 // DSV41-10: THE ENGRAM ROUTE INTEGRATION, CHECKED AT THE PRODUCT ROOT
 // ══════════════════════════════════════════════════════════════════════════════════════════════
 
-// THE CONTROL THAT REDS IF THE INTEGRATION IS REMOVED. This is not a fixture calling an unused
-// function: it is the live V4.1 serving decision -- the same `deepseek_v4_1_decision_input` the
-// product declares -- and it asserts that the evidence it reports back includes the component-route
-// axis. Delete the axis from `v4_1_selection_axes`, or stop `candidate_gaps` from carrying the
-// route standing, and this goes red rather than quietly returning the same answer for other reasons.
+// AN UNFUNDED-AXIS NEED NAMES ITS AXIS. The route oracle below is checked against this so a generic
+// missing-axis gap is shown to be a gap on the axis and still not a route-produced obligation.
 fn needs_name_axis(needs: List<SelectionEvidenceNeed>, axis: DeclarationRef) -> Bool {
   any(needs, n => match n {
     UnfundedAxis { gap: g } => declaration_ref_eq(a: g.axis, b: axis)
@@ -1455,7 +1127,7 @@ data expected_route_consumer_key: String = declaration_ref_display_key(ref: id_r
 // refuses. The exact prefixes production can emit for THIS field are derived here, once, from the same
 // two folds production uses, and the cause must carry one of them whole.
 data expected_route_prefixes: List<String> = map(
-  deepseek_v4_1_candidate_field.candidates,
+  v4_1_designed_field.candidates,
   k => route_obligation_prefix(
     component: engram_component_identity,
     context: candidate_route_context(c: k, p: k.profile)))
@@ -1576,71 +1248,8 @@ fn distinct_route_demands(routed: List<RoutedCandidate>) -> List<ComponentRouteS
     })
 }
 
-// ── THE PRODUCT ROOT: THE LIVE FIELD IS EMPTY, AND WHY ────────────────────────────────────────
-//
-// THIS CLAIM ASSERTED NEEDS-EVIDENCE UNTIL 2026-09-14 AND THE EXPECTATION MOVED BECAUSE THE FIELD
-// DID, NOT BECAUSE THE CLAIM WAS WRONG WHEN WRITTEN. It was authored while the V4.1 domain was
-// generated over an EIGHT-host scalar. #11308 replaced that with the subject's admissible host SET,
-// and V4.1's subject holds one fabric group -- so tp5 through tp8 correctly ceased to exist, and
-// with them every shape whose per-rank Engram share was small enough to fit.
-//
-// THE DISCRIMINATOR, STATED HERE BECAUSE "INFEASIBLE" INVITES EXACTLY ONE QUESTION -- would more
-// hosts help? Yes, and this is the margin:
-//
-//   ranks=8   engram needs 23.64 GiB per rank against an 81.14 GiB budget   fits, with room
-//   ranks=4   engram needs 47.28 GiB per rank against a  45.42 GiB budget   SHORT BY 1.86 GiB
-//
-// The budget is what is left of an observed 116.85 GiB idle-free rank reading after the artifact's
-// OTHER THREE components -- backbone, vision tower and aligner, and the DSpark draft model. The
-// last two are 7.89 GiB that a two-component reading of this problem omits, and they are the
-// difference between a two-component sum saying +0.113 GiB of headroom and the fold saying -1.86.
-// Corroborated by a second instrument on a different path: the Group A rollout lane, reading the
-// published checkpoint index and dividing rather than running this decision, reported 118.81 GiB
-// per rank against 116.9 free. Two derivations sharing no method, 0.1 GiB apart.
-//
-// SO THE ANSWER IS A SCOPED NEGATIVE AND THE MODEL IS RIGHT. Route A is excluded on the per-rank
-// resident lower bound; routes B, C and D are excluded on ESTABLISHED mechanism absence, because
-// the published image offers a memory-backed Engram placement only. Nothing here is an evidence
-// gap dressed as a refusal.
-//
-// WHAT THIS CLAIM LOST, SAID PLAINLY RATHER THAN QUIETLY DROPPED. It used to assert over
-// `component_routes` -- that every candidate carried a typed standing, and that some standing named
-// the Engram component under this consumer's context. `NoFeasibleServingDeployment` CARRIES CAUSES
-// AND NOTHING ELSE, so those assertions have no arm to stand on and are gone. That is the
-// `component_route_gap_over` frontier row's prediction arriving: the exclusion line carries
-// identities, not the child's reasons. The claim compensates as far as the arm allows by requiring
-// EVERY candidate identity to appear among the causes, which keeps a shrinking field from passing
-// silently -- but the typed standings are genuinely not checked on this path, and the row's trigger
-// is what restores them.
-test fn the_v4_1_aggregation_returns_no_feasible_naming_every_candidate() -> Bool {
-  let input = v4_1_input_for_runtime(runtime: v4_1_runtime_published_arm64, stem: "aggregation_behaviour")
-  match select_serving_deployment(input: input) {
-    NoFeasibleServingDeployment { causes: cs } =>
-      count(cs) > 0
-        && causes_name_axis(cs: cs, axis: ax_component_route)
-        && !causes_name_axis(cs: cs, axis: ax_host_fit)
-        && all(input.field.candidates, k => causes_name_axis(cs: cs, axis: k.identity))
-    ServingDeploymentNeedsEvidence { needs: _, component_routes: _ } => false
-    ServingDeploymentSelected { selected: _ } => false
-    ServingDeploymentNeedsPolicy { survivors: _, component_routes: _ } => false
-    ServingDeploymentSelectionRefused { defects: _ } => false
-  }
-}
-
-// THE INHABITANCE HALF, AND IT IS NOT OPTIONAL. Supplying a claim's inputs at an interface is only
-// honest while something establishes that the REAL producer emits that shape; without this the pair
-// above is a fast green suite testing a fixture, which is DESIGN section 5's
-// specification-without-execution at layer granularity rather than at function granularity.
-//
-// THE FAILURE THIS CATCHES IS ONE THIS FILE ALREADY SUFFERED. An earlier designed field carried two
-// topologies that both consumed EIGHT ranks against a four-host admissible set, so every candidate was
-// excluded on HOST FIT and the claim reached its expected verdict through a mechanism it was not about.
-// The behaviour claim could not see that; only a statement about what the live input actually contains
-// can. So: the live input's field is the live candidate field BY IDENTITY, its population is non-empty,
-// and every candidate names the real V4.1 artifact -- and NO DECISION IS RUN here, which is the whole
-// point of splitting it out.
-// WHY candidate_component_budget MAY READ GROUP A FOR EVERY CANDIDATE TODAY, DERIVED OVER THE
-// POPULATION THAT CAN ACTUALLY REACH IT RATHER THAN OVER NAMED ARTIFACTS.
+// WHY candidate_component_budget MAY READ ONE GROUP'S FIGURE FOR EVERY CANDIDATE TODAY, DERIVED OVER
+// THE POPULATION THAT CAN ACTUALLY REACH IT RATHER THAN OVER NAMED ARTIFACTS.
 //
 // THE PREVIOUS SHAPE OF THIS GUARD WAS THE CLASS THIS PR ITSELF FILES. It hand-enumerated four
 // artifact declarations and was named "only one artifact is decomposed", while what executed was
@@ -1652,21 +1261,19 @@ test fn the_v4_1_aggregation_returns_no_feasible_naming_every_candidate() -> Boo
 // was repairing.
 //
 // WHAT IS DERIVED NOW: the fold reaches an artifact ONLY through a candidate in a field, so the
-// candidates of the live fields are the population, not the artifacts. Every candidate in all three
-// live fields whose artifact carries components must be the V4.1 artifact. Add a decomposed artifact
-// to any of these fields and this reds, however it is declared and whatever it is called.
+// candidates of the live field are the population, not the artifacts. Every candidate in the live
+// GLM field whose artifact carries components must be the V4.1 artifact. Add a decomposed artifact to
+// that field and this reds, however it is declared and whatever it is called. Since the DeepSeek
+// fields were decommissioned with Group A, no live candidate is decomposed at all.
 //
-// THE RESIDUAL LIMIT, STATED RATHER THAN NAMED AWAY: this enumerates the three live FIELDS. A fourth
+// THE RESIDUAL LIMIT, STATED RATHER THAN NAMED AWAY: this enumerates the one live FIELD. A second
 // field would sit outside it. That is one level up from where the defect was and it is not derivable
 // without a field roster this module does not have -- so it is named here as the limit, and the claim
 // is named for what it executes.
 test fn every_decomposed_candidate_in_the_live_fields_is_the_v4_1_artifact() -> Bool {
-  let live = concat(
-    concat(deepseek_v4_1_candidate_field.candidates, glm_candidate_field.candidates),
-    deepseek_candidate_field.candidates)
+  let live = glm_candidate_field.candidates
   count(legacy_undecomposed_artifact) == 0
     && count(live) > 0
-    && any(live, k => count(k.artifact.components) > 0)
     && all(live, k =>
          if count(k.artifact.components) > 0 {
            declaration_ref_eq(a: k.artifact.identity, b: artifact_deepseek_v4_1_flash_native.identity)
@@ -1675,195 +1282,6 @@ test fn every_decomposed_candidate_in_the_live_fields_is_the_v4_1_artifact() ->
          })
 }
 
-// THE PRODUCT ROOT, SPLIT INTO ITS TWO JOBS -- operator ruling 2026-09-15. The single claim that
-// replaced these did TWO things in one body, and only one of them is a wall.
-//
-// JOB ONE, THE WIRING, IS STRUCTURAL AND PERMANENT: serving selection must obtain Engram route
-// standings for a real candidate through the route integration. Delete the integration and this must
-// fail. That is `a_real_v4_1_candidate_obtains_its_engram_route_standing_through_the_integration`.
-//
-// JOB TWO, TODAY'S ANSWER, IS CURRENT-STATE and correctly goes red when the fleet changes: the closest
-// shape to feasible is excluded on the per-rank resident floor. That is
-// `the_closest_v4_1_shape_is_excluded_on_the_per_rank_resident_floor`.
-//
-// WHY THIS IS LIGHTER WITHOUT BECOMING A FIXTURE. Both run on a candidate taken FROM THE LIVE FIELD --
-// the real artifact, its four real components, the real observed idle-free reading. What they do not do
-// is the 24-candidate select fold, which is where substantially all of 191,441 eval steps went. The
-// field-wide verdict is a fold over per-candidate exclusions, so asserting the exclusion on the real
-// candidate that matters is the same data path at one candidate's cost.
-//
-// WHAT COVERS THE AGGREGATION IS A DIFFERENT CLAIM, and it already exists:
-// `the_v4_1_aggregation_returns_no_feasible_naming_every_candidate` runs the real
-// `select_serving_deployment` over a designed field whose candidates are the REAL artifact with its
-// REAL components -- only the topology enumeration is narrowed, and `ax_host_fit` keeps that field
-// inhabiting the admissible set so it reds for the right mechanism. Aggregation over a designed field
-// plus exclusion over real data covers what one heavy claim covered.
-//
-// THE CONSEQUENCE I AM NOT HIDING: the non-comment count of select_serving_deployment on
-// `deepseek_v4_1_decision_input` is now ZERO, and that is the same count whose going to zero was a
-// defect last time. It is admissible here and was not then, for a reason that was PROVEN BY EXECUTION
-// rather than asserted -- #11383 requires that SOME claim fail when the integration is removed, and
-// last time none did.
-//
-// THE DELETION WAS RUN AGAINST THE PRODUCTION SEAM. `routed_candidates` -- the producer
-// `select_serving_deployment` reaches through `select_over_routed` -- rewritten to carry
-// `route_standings: []`, the program still well-formed, every other declaration untouched:
-//
-//   a_real_v4_1_candidate_obtains_its_engram_route_standing_through_the_integration   false  (true intact)
-//   the_closest_v4_1_shape_is_excluded_on_the_per_rank_resident_floor                 false  (true intact)
-//   the_v4_1_aggregation_returns_no_feasible_naming_every_candidate                   false  (true intact)
-//
-// AN EARLIER VERSION OF THIS TABLE PROVED THE WRONG THING, recorded because the error was in the TEST
-// rather than in the code and would otherwise be invisible. It severed `candidate_component_route_standings`,
-// which `select_serving_deployment` DOES NOT USE: the entry path runs `routed_candidates` ->
-// `resolved_route_demands` + `candidate_standings_from_demands`, a parallel producer that also reaches
-// `engram_route_standing`. The wall red because the wall called the thing that was severed, and the
-// serving consumer's own path was never touched. `routed_standing_of` below is the repair.
-//
-// THAT TABLE ALSO CARRIED AN UNVERIFIED CAUSAL CLAIM, which is the part worth keeping. It reported the
-// aggregation as surviving the deletion and attributed the survival to exclusion reaching
-// `ax_component_route` through `component_resident_footprint`'s unread path. The real reason was that
-// the aggregation's producer had never been severed: against the production seam the aggregation reds
-// too, third row above. A deletion proof is only as good as the identity of what it deleted, and an
-// explanation of a result is a second claim that needs its own execution.
-fn v4_1_live_candidate_at(tp: Nat, replicas: Nat) -> DeploymentCandidate? {
-  (filter(deepseek_v4_1_candidate_field.candidates,
-    k => k.topology.tensor_parallel_degree == tp && k.topology.replica_count == replicas)).first()
-}
-
-// THE STANDINGS AS THE SERVING CONSUMER OBTAINS THEM, not as a parallel helper produces them. There
-// are TWO producers that both reach `engram_route_standing`, and only one is on the entry path:
-//
-//   select_serving_deployment -> select_over_routed(routed: routed_candidates(field)) ->
-//     resolved_route_demands + candidate_standings_from_demands     <- the production seam
-//   candidate_component_route_standings -> component_route_standing_for     <- a direct helper
-//
-// A wall built on the second proves nothing about the first. This walks `routed_candidates` over a
-// one-candidate field so the claim is cheap AND traverses the same producer the consumer does.
-fn v4_1_single_candidate_probe_field(c: DeploymentCandidate) -> ServingDeploymentCandidateField {
-  serving_candidate_field(
-    identity: decl_ref(module_path: "test.claim.spark.serving_deployment_selection_witness_test",
-                       decl_name: "v4_1_single_candidate_probe_field"),
-    domain: deepseek_v4_1_candidate_field.domain,
-    candidates: [c])
-}
-
-fn routed_standing_of(c: DeploymentCandidate) -> ComponentRouteStanding? {
-  match (routed_candidates(field: v4_1_single_candidate_probe_field(c: c))).first() {
-    Absent => none
-    Present { value: rc } =>
-      (filter(rc.route_standings,
-        st => declaration_ref_eq(a: component_route_standing_component(s: st), b: engram_component_identity))).first()
-  }
-}
-
-test fn a_real_v4_1_candidate_obtains_its_engram_route_standing_through_the_integration() -> Bool {
-  match v4_1_live_candidate_at(tp: 4, replicas: 1) {
-    Absent => false
-    Present { value: c } =>
-      count(routed_candidates(field: v4_1_single_candidate_probe_field(c: c))) > 0
-        && match routed_standing_of(c: c) {
-          Absent => false
-          Present { value: st } =>
-            declaration_ref_eq(a: component_route_standing_component(s: st), b: engram_component_identity)
-              && declaration_ref_eq(a: component_route_standing_context(s: st).consumer, b: id_route_consumer)
-        }
-  }
-}
-
-test fn the_closest_v4_1_shape_is_excluded_on_the_per_rank_resident_floor() -> Bool {
-  match v4_1_live_candidate_at(tp: 4, replicas: 1) {
-    Absent => false
-    Present { value: c } =>
-      match routed_standing_of(c: c) {
-        Absent => false
-        Present { value: st } =>
-          match component_route_placement_standing(s: st) {
-            ComponentPlacementExcluded { causes: cs } =>
-              count(cs) > 0
-                && any(cs, x => string_contains(s: x as String,
-                     pattern: declaration_ref_display_key(ref: ax_route_per_rank_resident_lower_bound)))
-            _ => false
-          }
-      }
-  }
-}
-
-test fn the_live_v4_1_decision_input_inhabits_the_real_subject() -> Bool {
-  let f = deepseek_v4_1_decision_input.field
-  declaration_ref_eq(a: f.identity, b: deepseek_v4_1_candidate_field.identity)
-    && count(f.candidates) > 0
-    && count(f.candidates) == count(deepseek_v4_1_candidate_field.candidates)
-    && all(f.candidates, k =>
-         declaration_ref_eq(a: k.artifact.identity, b: artifact_deepseek_v4_1_flash_native.identity))
-    && all(f.candidates, k => k.topology.tensor_parallel_degree * k.topology.replica_count
-         <= count(pair_unit_a_fleet_snapshot.admissible_hosts))
-}
-
-// ── THE MEMORY SCREEN IS PER-CANDIDATE, AND THE DISCRIMINATING PAIR PROVES IT ──────────────────
-//
-// THIS IS THE CONTROL THE BRIEF'S "DO NOT PICK ONE GLOBAL ENGRAM ROUTE" REQUIREMENT NEEDS, and it is a
-// pair rather than a single assertion because either half alone is satisfiable by a defect. A
-// TP4 exclusion alone is satisfied by a screen that excludes unconditionally; a TP8 non-exclusion alone
-// is satisfied by a screen that never fires. Only the pair establishes that the verdict is a function of
-// the candidate.
-//
-// WHY THE TWO TOPOLOGIES DISAGREE, stated so a reader does not have to re-derive it: the component's
-// resident FLOOR is divided by the ranks that share it, while the bytes free on a rank are not. At TP4
-// the Engram floor per rank exceeds what the artifact's other components leave free on a rank, and at
-// TP8 it does not. That is the whole reason topology is part of this question, and it is why the
-// operator's TP4 Group A verdict is NOT a fact about the checkpoint in general.
-//
-// WHAT THIS PARAGRAPH USED TO SAY, AND WHY IT IS NOW FALSE. It read: the product-root witness still
-// reports an EVIDENCE NEED rather than an infeasible field, because the live domain enumerates every tp
-// from 1 to the fleet host count and candidates at TP5 and above survive the memory screen on their own
-// arithmetic -- what would exclude THEM is host admissibility, separately outstanding.
-//
-// THAT HOST-ADMISSIBILITY INTEGRATION LANDED (#11308) AND THIS BRANCH MERGED IT. The domain is now the
-// subject's ADMISSIBLE host set, which holds four hosts, so TP5 through TP8 do not exist to survive
-// anything. Every shape that remains is excluded, and the product-root witness reports
-// NoFeasibleServingDeployment rather than an evidence need. The anticipated exclusion became the actual
-// one, which is the outcome the old text predicted -- and kept asserting the prediction after it came
-// true. Review 66368 found it; it is the same expired-premise class this branch filed twice.
-fn v41_candidate_at_tp(tp: Nat, replicas: Nat, name: String) -> DeploymentCandidate {
-  cand(name: name, art: artifact_deepseek_v4_1_flash_native, t: topology_shape(tensor_parallel_degree: tp, replica_count: replicas))
-}
-
-fn engram_placements_of(c: DeploymentCandidate) -> List<ComponentRoutePlacementStanding> {
-  map(
-    filter(candidate_component_route_standings(c: c, p: c.profile),
-      st => declaration_ref_eq(a: component_route_standing_component(s: st), b: engram_component_identity)),
-    st => component_route_placement_standing(s: st))
-}
-
-fn any_placement_excluded(ps: List<ComponentRoutePlacementStanding>) -> Bool {
-  any(ps, pl => match pl {
-    ComponentPlacementExcluded { causes: _ } => true
-    ComponentPlacementOpen { remedy: _ } => false
-    ComponentPlacementSettled { selected: _, receipt: _ } => false
-    ComponentPlacementNotThisSubject => false
-  })
-}
-
-fn any_placement_open(ps: List<ComponentRoutePlacementStanding>) -> Bool {
-  any(ps, pl => match pl {
-    ComponentPlacementOpen { remedy: _ } => true
-    ComponentPlacementExcluded { causes: _ } => false
-    ComponentPlacementSettled { selected: _, receipt: _ } => false
-    ComponentPlacementNotThisSubject => false
-  })
-}
-
-test fn the_engram_memory_screen_excludes_the_tp4_candidate_and_not_the_tp8_one() -> Bool {
-  let tp4 = engram_placements_of(c: v41_candidate_at_tp(tp: 4, replicas: 2, name: "screen_tp4"))
-  let tp8 = engram_placements_of(c: v41_candidate_at_tp(tp: 8, replicas: 1, name: "screen_tp8"))
-  count(tp4) == 1
-    && count(tp8) == 1
-    && any_placement_excluded(ps: tp4)
-    && !any_placement_excluded(ps: tp8)
-    && any_placement_open(ps: tp8)
-}
-
 // THE DISCONNECTION NEGATIVE. This is what the field looks like when the route contribution is gone
 // but the axis, the constraint and the absent reading remain: the selector still reports a gap on
 // ax_component_route, and the oracle above must NOT accept it. Without this arm the positive control
@@ -2022,7 +1440,7 @@ test fn an_undecomposed_artifact_divides_exactly_what_it_divided_before() -> Boo
     FootprintObservedOnFleet { bytes: b, how: _ } => byte_size_count(b: b) == 168683720987
     FootprintReportedExternally { bytes: _, source: _ } => false
     FootprintUnread { obligation: _ } => false
-  } && match weight_fit_of(c: v4, fleet: pair_unit_a_fleet_snapshot, p: serving_parameters_current) {
+  } && match weight_fit_of(c: v4, fleet: glm_group_b_fleet_snapshot, p: serving_parameters_current) {
     WeightsNotRuledOutByLowerBound { per_rank_bytes: _, usable_bytes: _, slack_bytes: _ } => true
     WeightsImpossibleByLowerBound { per_rank_bytes: _, usable_bytes: _ } => false
     WeightFitUnderivable { because: _ } => false
@@ -2048,7 +1466,7 @@ test fn a_routed_component_leaves_the_resident_footprint_unread_rather_than_zero
     FootprintUnread { obligation: o } => count(o as String) > 0
     FootprintObservedOnFleet { bytes: _, how: _ } => false
     FootprintReportedExternally { bytes: _, source: _ } => false
-  } && match weight_fit_of(c: v41, fleet: pair_unit_a_fleet_snapshot, p: serving_parameters_current) {
+  } && match weight_fit_of(c: v41, fleet: glm_group_b_fleet_snapshot, p: serving_parameters_current) {
     WeightFitUnderivable { because: _ } => true
     WeightsNotRuledOutByLowerBound { per_rank_bytes: _, usable_bytes: _, slack_bytes: _ } => false
     WeightsImpossibleByLowerBound { per_rank_bytes: _, usable_bytes: _ } => false
@@ -2091,7 +1509,7 @@ test fn the_observed_free_memory_endpoints_are_ordered_as_authored() -> Bool {
 // stays correct if `closed_interval` ever refuses for a second cause.
 fn free_memory_row_with(free_construction_low: Nat, free_construction_high: Nat) -> GroupRankFreeMemoryObserved {
   GroupRankFreeMemoryObserved {
-    group: FabricGroupA,
+    group: FabricGroupB {},
     reported_free_wire: "a designed row whose endpoints are supplied by this claim" as NonEmptyStr,
     free: gib_hundredths_interval(low_hundredths: free_construction_low, high_hundredths: free_construction_high),
     probed_at: "2026-09-15" as NonEmptyStr,
@@ -2114,20 +1532,6 @@ test fn an_ordered_free_memory_region_offers_its_upper_endpoint() -> Bool {
   }
 }
 
-// THE MINT REFUSING IS NOT EVIDENCE THAT THE AUTHORED ROWS PASS IT. The two claims above establish what
-// `gib_hundredths_interval` does with endpoints THIS CLAIM supplies; they say nothing about the rows
-// actually in the corpus. Because the construction is stored rather than the interval, a transposed row
-// is writable and would otherwise stay silent until a consumer folded it. This is the claim that makes
-// an authored transposition red HERE instead -- it is the whole of the class's rung-two standing, and
-// deleting it drops the class to rung one.
-test fn every_authored_free_memory_row_mints_its_region() -> Bool {
-  count(group_rank_free_memory_observed) > 0
-    && all(group_rank_free_memory_observed, r => match r.free {
-      IntervalReady { interval: _ } => true
-      IntervalRefused { reason: _ } => false
-    })
-}
-
 // THE REQUEST VOCABULARY IS UPSTREAM'S AND OPEN-ENDED, so a witness that wants one request asks by its
 // canonical wire rather than enumerating every constructor -- a new upstream spelling then costs no
 // edit here.
diff --git a/dag/test/claim/spark/serving_incarnation_observe_witness_test.dag b/dag/test/claim/spark/serving_incarnation_observe_witness_test.dag
index 011d47b4e4e..09b35b7f872 100644
--- a/dag/test/claim/spark/serving_incarnation_observe_witness_test.dag
+++ b/dag/test/claim/spark/serving_incarnation_observe_witness_test.dag
@@ -265,7 +265,10 @@ test fn a_non_sha256_image_id_refuses() -> Bool {
 
 test fn the_pgrep_listing_reads_pids() -> Bool {
   match pgrep_pid_listing(stdout: "1809052\n1809081\n") {
-    PgrepPidsRead { pids: ps } => count(ps) == 2 && ps.first() == 1809052
+    PgrepPidsRead { pids: ps } => count(ps) == 2 && (match ps.first() {
+        Present { value: v } => v == 1809052
+        Absent => false
+      })
     PgrepPidLineUnparseable { line: _ } => false
   }
 }
diff --git a/dag/test/claim/spark/serving_load_probe_witness_test.dag b/dag/test/claim/spark/serving_load_probe_witness_test.dag
index a19dce8bf69..bfb28fe6a45 100644
--- a/dag/test/claim/spark/serving_load_probe_witness_test.dag
+++ b/dag/test/claim/spark/serving_load_probe_witness_test.dag
@@ -1,5 +1,6 @@
 module test.claim.spark.serving_load_probe_witness
 
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 import std.types { Bool, String, NonEmptyStr }
 import std.optional { Present, Absent }
 import std.content_hash { content_hash_of_value, serialize_content_hash }
@@ -107,7 +108,7 @@ data start_field: NonEmptyStr = "1789300000.12" as NonEmptyStr
 
 fn fx_launch() -> VllmEndpointProcessLaunchObservation {
   LaunchObserved {
-    launch: vllm_endpoint_process_launch(group: FabricGroupB, endpoint: "192.168.1.236:30000" as NonEmptyStr, process_start_field: start_field),
+    launch: vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "192.168.1.236:30000" as NonEmptyStr, process_start_field: start_field),
     receipt: "fx" as ObservationReceiptRef,
   }
 }
@@ -540,7 +541,7 @@ test fn ledger_and_rate_come_from_bench_stdout_not_exit_ok() -> Bool {
 
 test fn exporter_restart_breaks_counter_continuity() -> Bool {
   let after: VllmEndpointProcessLaunchObservation = LaunchObserved {
-    launch: vllm_endpoint_process_launch(group: FabricGroupB, endpoint: "192.168.1.236:30000" as NonEmptyStr, process_start_field: "1789300999.00" as NonEmptyStr),
+    launch: vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "192.168.1.236:30000" as NonEmptyStr, process_start_field: "1789300999.00" as NonEmptyStr),
     receipt: "fx2" as ObservationReceiptRef,
   }
   match counter_continuity(before: fx_launch(), after: after) {
diff --git a/dag/test/claim/spark/serving_load_runner_witness_test.dag b/dag/test/claim/spark/serving_load_runner_witness_test.dag
index a114bb46f3c..7cd9bf49a33 100644
--- a/dag/test/claim/spark/serving_load_runner_witness_test.dag
+++ b/dag/test/claim/spark/serving_load_runner_witness_test.dag
@@ -6,7 +6,7 @@ import gunbc.fleet_intent_network { srv9_host_lan_endpoint }
 import gunbc.fleet_host_identity { operator_host_srv9 }
 import gunbc.spark.serving_rank_observe { container_incarnation_id, ObservedRankIncarnation }
 import gunbc.spark.model_snapshot_materialize { RemoteRan }
-import gunbc.spark.fabric_switch_observed { FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import gunbc.harness.harness_backend { harness_launch_from_body }
 import extdeps.vllm.bench_serve { VllmBenchServeRequest }
 import extdeps.vllm.kv_layout { AdmissionCostUnestablished }
@@ -60,8 +60,8 @@ fn pre_runner_glm_step_text(standing: ServingPerformanceSubjectStanding) -> Stri
     subject: standing,
     window: window_from_drain(drain: DrainObservedIdle),
     continuity: counter_continuity(
-      before: harness_launch_from_body(group: FabricGroupB, address: srv9_host_lan_endpoint.address, body: fx_before),
-      after: harness_launch_from_body(group: FabricGroupB, address: srv9_host_lan_endpoint.address, body: fx_after),
+      before: harness_launch_from_body(group: FabricGroupB {}, address: srv9_host_lan_endpoint.address, body: fx_before),
+      after: harness_launch_from_body(group: FabricGroupB {}, address: srv9_host_lan_endpoint.address, body: fx_after),
     ),
     occupancy: occupancy_trace_from_endpoint_scrapes(before_body: fx_before, after_body: fx_after),
     before_body: fx_before,
diff --git a/dag/test/claim/spark/snapshot_rail_replica_witness_test.dag b/dag/test/claim/spark/snapshot_rail_replica_witness_test.dag
index 8a8e0dc1073..37caaf3a542 100644
--- a/dag/test/claim/spark/snapshot_rail_replica_witness_test.dag
+++ b/dag/test/claim/spark/snapshot_rail_replica_witness_test.dag
@@ -3,8 +3,8 @@ module test.claim.spark.snapshot_rail_replica_witness
 import std.types { Bool, String, List, NonEmptyStr }
 import std.optional { Present, Absent }
 import gunbc.spark.snapshot_rail_replica { snapshot_entry_of, is_sha256_name, first_failure, snapshot_hub_paths }
-import gunbc.spark.group_checkpoint_materialize { checkpoint_snapshot }
-import gunbc.spark.serving_arm { Glm53NativeFp8 }
+import gunbc.spark.serving_arm { ServingCheckpoint, Glm53NativeFp8, serving_checkpoint_row, serving_checkpoint_wire }
+import gunbc.spark.model_snapshot_acquisition { ModelSnapshotDesired, ModelSnapshotPinned }
 
 // ── THE SNAPSHOT MAP, AT ITS INTERFACE ───────────────────────────────────────────────────────────────
 //
@@ -31,9 +31,24 @@ test fn the_first_failure_is_the_first_nonempty_cause() -> Bool {
     && (match first_failure(causes: ["", "b", "c"]) { Present { value: x } => x == "b"  Absent => false })
 }
 
+// THE SNAPSHOT A CHECKPOINT ROW PINS, SUPPLIED AT THIS INTERFACE (the group materialization that derived it
+// was decommissioned with Group A on 2026-10-07).
+fn w_checkpoint_snapshot(c: ServingCheckpoint) -> ModelSnapshotDesired? {
+  match serving_checkpoint_row(c: c) {
+    Absent => none
+    Present { value: row } => Present { value: ModelSnapshotPinned {
+      identity: serving_checkpoint_wire(c: c),
+      repo: row.repo,
+      revision: row.revision,
+      placement: row.placement,
+      revision_provenance: row.provenance,
+    } }
+  }
+}
+
 // THE GLM FP8 CHECKPOINT IS A HUB-CACHE SNAPSHOT, SO IT HAS THE TWO PATHS THE REPLICA WORKS IN.
 test fn the_glm_fp8_checkpoint_resolves_its_hub_cache_paths() -> Bool {
-  match checkpoint_snapshot(c: Glm53NativeFp8) {
+  match w_checkpoint_snapshot(c: Glm53NativeFp8) {
     Absent => false
     Present { value: s } => match snapshot_hub_paths(snapshot: s) {
       Absent => false
diff --git a/dag/test/claim/spark/spark_bootstrap_provision_witness_test.dag b/dag/test/claim/spark/spark_bootstrap_provision_witness_test.dag
index 8019528e1e4..b7ac0a3244a 100644
--- a/dag/test/claim/spark/spark_bootstrap_provision_witness_test.dag
+++ b/dag/test/claim/spark/spark_bootstrap_provision_witness_test.dag
@@ -6,10 +6,11 @@ module test.claim.spark_bootstrap_provision_witness
 // one import turned every bare reference into "no such function".
 import v2.std.live_tree { LiveTreeDisposition }
 import std.measure { second }
+import product.host_identity { HostIdentity }
 import gunbc.spark.bootstrap_provision {
   SparkCredentialKind, FactoryHotspotCredential, AdministratorCredential,
-  SparkCredentialOccurrence, spark_srv5, spark_srv6, spark_credential_occurrence,
-  spark_credential_population, spark_occurrence_eq, spark_credential_kind_eq,
+  SparkCredentialOccurrence, spark_credential_occurrence,
+  spark_occurrence_eq, spark_credential_kind_eq,
   SparkSecretAllocation, SparkSecretAllocated, SparkSecretAllocationPending, spark_secret_allocation,
   SparkLegacyContainerStanding, ObservedLegacyUnbound, spark_legacy_containers,
   FleetCloudConvergence, FleetCloudGrantAdministrator, FleetCloudPrincipalKey,
@@ -38,7 +39,7 @@ import gunbc.spark.bootstrap_provision {
   SecretConsumer, SecretDemandStanding, SecretDemandActive, SecretDemandRetainedForRecovery,
   SecretDemandRetiredAfterOobe, SecretDemandUnobserved, secret_demand_is_active,
   HostPrivilegeObservation, ServiceInstallScope, SystemUnitScope, ContainerScope,
-  UserUnitScope, InstallScopeUnobserved, derive_install_scope, srv5_privilege_observation
+  UserUnitScope, InstallScopeUnobserved, derive_install_scope
 }
 
 import extdeps.cloud.gcp.secret_manager {
@@ -60,11 +61,6 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // set they described rather than kept: they would have continued passing while constraining code
 // that had been removed.
 
-fn spark_population_has(host: HostIdentity, kind: SparkCredentialKind) -> Bool {
-  fold(spark_credential_population(), init: false, f: (acc, o) =>
-    acc || (o.host == host && spark_credential_kind_eq(a: o.kind, b: kind)))
-}
-
 fn spark_allocation_is_pending(a: SparkSecretAllocation) -> Bool {
   match a {
     SparkSecretAllocated { occurrence: _, handle: _ } => false
@@ -72,27 +68,16 @@ fn spark_allocation_is_pending(a: SparkSecretAllocation) -> Bool {
   }
 }
 
-// CONTROL 1: the population is exactly the four host-by-kind occurrences. This is the control that
-// reds on the specific error the prior revision shipped -- two globally-named credentials standing
-// for a per-device population.
-test fn spark_population_is_four_host_scoped_occurrences() -> Bool {
-  spark_credential_population().length() == 4
-    && spark_population_has(host: spark_srv5(), kind: FactoryHotspotCredential)
-    && spark_population_has(host: spark_srv5(), kind: AdministratorCredential)
-    && spark_population_has(host: spark_srv6(), kind: FactoryHotspotCredential)
-    && spark_population_has(host: spark_srv6(), kind: AdministratorCredential)
-}
-
 // CONTROL 2: occurrences are distinguished by BOTH axes. A kind-only or host-only identity would
-// still satisfy control 1's count while fusing two real credentials, and fusing them is the exact
+// still satisfy a population count while fusing two real credentials, and fusing them is the exact
 // failure that makes one AddVersion silently become a prior version of another credential.
 test fn spark_occurrence_identity_uses_both_axes() -> Bool {
-  let a = spark_credential_occurrence(host: spark_srv5(), kind: FactoryHotspotCredential)
-  let b = spark_credential_occurrence(host: spark_srv6(), kind: FactoryHotspotCredential)
-  let c = spark_credential_occurrence(host: spark_srv5(), kind: AdministratorCredential)
+  let a = spark_credential_occurrence(host: ("srv9" as HostIdentity), kind: FactoryHotspotCredential)
+  let b = spark_credential_occurrence(host: ("srv10" as HostIdentity), kind: FactoryHotspotCredential)
+  let c = spark_credential_occurrence(host: ("srv9" as HostIdentity), kind: AdministratorCredential)
   !spark_occurrence_eq(a: a, b: b)
     && !spark_occurrence_eq(a: a, b: c)
-    && spark_occurrence_eq(a: a, b: spark_credential_occurrence(host: spark_srv5(), kind: FactoryHotspotCredential))
+    && spark_occurrence_eq(a: a, b: spark_credential_occurrence(host: ("srv9" as HostIdentity), kind: FactoryHotspotCredential))
 }
 
 // CONTROL 3: no occurrence carries an allocated external handle. Pending is the honest state while
@@ -100,7 +85,10 @@ test fn spark_occurrence_identity_uses_both_axes() -> Bool {
 // authored here rather than allocated -- the fabrication the carried-never-derived naming law
 // forbids.
 test fn spark_allocations_are_all_pending() -> Bool {
-  fold(spark_credential_population(), init: true, f: (acc, o) =>
+  fold([
+    spark_credential_occurrence(host: "srv9" as HostIdentity, kind: FactoryHotspotCredential),
+    spark_credential_occurrence(host: "srv9" as HostIdentity, kind: AdministratorCredential),
+  ], init: true, f: (acc, o) =>
     acc && spark_allocation_is_pending(a: spark_secret_allocation(occurrence: o)))
 }
 
@@ -118,24 +106,17 @@ test fn spark_legacy_containers_are_observed_unbound() -> Bool {
     && fold(spark_legacy_containers, init: true, f: (acc, c) => acc && spark_legacy_is_unbound(c: c))
 }
 
-// CONTROL 6: the legacy population is strictly smaller than the credential population. Stated as a
-// standing inequality rather than as prose, because "two containers exist" reads like progress
-// toward four and is not: neither can be the authority for a per-device hotspot credential.
-test fn spark_legacy_containers_do_not_cover_the_population() -> Bool {
-  spark_legacy_containers.length() < spark_credential_population().length()
-}
-
 // ── Container classification controls ─────────────────────────────────────────────────────
 
 fn spark_allocated_specimen() -> SparkSecretAllocation {
   SparkSecretAllocated {
-    occurrence: spark_credential_occurrence(host: spark_srv5(), kind: AdministratorCredential),
+    occurrence: spark_credential_occurrence(host: ("srv9" as HostIdentity), kind: AdministratorCredential),
     handle: "fixture-allocated-handle"
   }
 }
 
 fn spark_pending_specimen() -> SparkSecretAllocation {
-  spark_secret_allocation(occurrence: spark_credential_occurrence(host: spark_srv5(), kind: AdministratorCredential))
+  spark_secret_allocation(occurrence: spark_credential_occurrence(host: ("srv9" as HostIdentity), kind: AdministratorCredential))
 }
 
 fn spark_verdict_is_refused(v: SparkContainerVerdict) -> Bool {
@@ -307,7 +288,7 @@ test fn spark_iam_write_without_etag_refuses() -> Bool {
 
 fn spark_identity_specimen() -> SparkMaterializationIdentity {
   SparkMaterializationIdentity {
-    occurrence: spark_credential_occurrence(host: spark_srv5(), kind: AdministratorCredential),
+    occurrence: spark_credential_occurrence(host: ("srv9" as HostIdentity), kind: AdministratorCredential),
     payload_identity: "fixture-payload-identity"
   }
 }
@@ -807,25 +788,13 @@ test fn active_demand_requires_a_named_consumer() -> Bool {
       secret: "projects/p/secrets/fleet-key", consumers: [] })
 }
 
-// CONTROL 10a (POSITIVE DIRECTION): the OBSERVED srv5 facts must produce the user-scope arm.
-// sudo -n refused and the container socket refusing the admitted principal are one cause with two
-// consequences, so user scope is the derived consequence -- not a preference someone recorded.
-test fn observed_srv5_privilege_derives_user_unit_scope() -> Bool {
-  match derive_install_scope(observation: srv5_privilege_observation()) {
-    UserUnitScope { host: h, ground: _ } => (h as String) == "srv5"
-    SystemUnitScope { host: _ } => false
-    ContainerScope { host: _ } => false
-    InstallScopeUnobserved { host: _, cause: _ } => false
-  }
-}
-
 // CONTROL 10b (NEGATIVE DIRECTION): the derivation must REFUSE to claim system-unit or container
 // installability against those same facts. Without this direction the function is a name -- it
 // could return SystemUnitScope for a host with no privilege and control 10a would still pass,
 // which is the inert-mechanism class: wrong in exactly the way it exists to prevent, silently.
 test fn no_privilege_never_derives_system_or_container_scope() -> Bool {
   match derive_install_scope(observation: HostPrivilegeObservation {
-    host: "srv5", passwordless_sudo: false, container_socket_admits_principal: false }) {
+    host: "srv9", passwordless_sudo: false, container_socket_admits_principal: false }) {
     SystemUnitScope { host: _ } => false
     ContainerScope { host: _ } => false
     UserUnitScope { host: _, ground: _ } => true
diff --git a/dag/test/claim/spark/spark_cell_role_witness_test.dag b/dag/test/claim/spark/spark_cell_role_witness_test.dag
index 1a215c2c197..e7473259826 100644
--- a/dag/test/claim/spark/spark_cell_role_witness_test.dag
+++ b/dag/test/claim/spark/spark_cell_role_witness_test.dag
@@ -1,22 +1,16 @@
 module test.claim.spark.spark_cell_role_witness
 
 import std.types { Bool, List }
-import product.host_identity { host_identity_eq }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv2 }
+import gunbc.fleet_host_identity { operator_host_srv2 }
 import gunbc.spark.cell_role {
   SparkCellRole, SparkServingCell, spark_cell_role_wire, spark_cell_role_eq,
   SparkCellRoleLookup, SparkCellRoleAbsent, SparkCellRoleUnique, SparkCellRoleAmbiguous,
   spark_cell_role_of, spark_serving_cell_hosts, spark_training_cell_hosts,
 }
-import v2.std.algebra { any }
 
-// BOTH FIRST-PAIR HOSTS ARE ASSIGNED THE SERVING ROLE BY THE OPERATOR DECISION, and a host outside
-// the roster resolves to no role rather than a default one.
-test fn srv5_and_srv6_are_serving_cells_and_an_unrostered_host_has_no_role() -> Bool {
-  let serving = spark_serving_cell_hosts()
-  any(serving, h => host_identity_eq(a: h, b: operator_host_srv5))
-    && any(serving, h => host_identity_eq(a: h, b: operator_host_srv6))
-    && length(spark_training_cell_hosts()) == 0
+// A host outside the roster resolves to no role rather than a default one.
+test fn an_unrostered_host_has_no_role() -> Bool {
+  length(spark_training_cell_hosts()) == 0
     && (match spark_cell_role_of(host: operator_host_srv2) {
          SparkCellRoleAbsent => true
          SparkCellRoleUnique { role: _ } => false
diff --git a/dag/test/claim/spark/spark_credential_workflow_witness_test.dag b/dag/test/claim/spark/spark_credential_workflow_witness_test.dag
index 7aadccd8013..5aabecf8643 100644
--- a/dag/test/claim/spark/spark_credential_workflow_witness_test.dag
+++ b/dag/test/claim/spark/spark_credential_workflow_witness_test.dag
@@ -61,19 +61,19 @@ test fn every_reserved_spark_carries_exactly_one_administrator_credential_versio
 }
 
 test fn administrator_credential_version_follows_the_host() -> Bool {
-  let v1 = match spark_administrator_password_secret_ref_for(host: "srv5" as HostIdentity) {
-    SparkAdministratorCredentialRefFound { ref: r } => r.version as String == "1" && string_contains(s: secret_ref_version_resource(ref: r), pattern: "/versions/1")
-    SparkAdministratorCredentialHostNotEnrolled { host: _ } => false
+  let sold = match spark_administrator_password_secret_ref_for(host: "srv5" as HostIdentity) {
+    SparkAdministratorCredentialRefFound { ref: _ } => false
+    SparkAdministratorCredentialHostNotEnrolled { host: h } => h as String == "srv5"
   }
-  let v2 = match spark_administrator_password_secret_ref_for(host: "srv11" as HostIdentity) {
-    SparkAdministratorCredentialRefFound { ref: r } => r.version as String == "1"
-    SparkAdministratorCredentialHostNotEnrolled { host: _ } => false
+  let sold_group_b = match spark_administrator_password_secret_ref_for(host: "srv11" as HostIdentity) {
+    SparkAdministratorCredentialRefFound { ref: _ } => false
+    SparkAdministratorCredentialHostNotEnrolled { host: h } => h as String == "srv11"
   }
   let unrostered = match spark_administrator_password_secret_ref_for(host: "srv1" as HostIdentity) {
     SparkAdministratorCredentialRefFound { ref: _ } => false
     SparkAdministratorCredentialHostNotEnrolled { host: h } => h as String == "srv1"
   }
-  v1 && v2 && unrostered
+  sold && sold_group_b && unrostered
 }
 
 test fn spark_admin_password_secret_pins_versions_one_not_latest() -> Bool {
diff --git a/dag/test/claim/spark/spark_declared_unit_digest_seal_probe_test.dag b/dag/test/claim/spark/spark_declared_unit_digest_seal_probe_test.dag
index 3a69b35a98c..1834fc04320 100644
--- a/dag/test/claim/spark/spark_declared_unit_digest_seal_probe_test.dag
+++ b/dag/test/claim/spark/spark_declared_unit_digest_seal_probe_test.dag
@@ -1,5 +1,6 @@
 module test.claim.spark.spark_declared_unit_digest_seal_probe_test
 
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 import gunbc.compile_diagnostic_census {
   CompileDiagnosticCensus,
   CensusObserved,
@@ -73,7 +74,7 @@ fn probe_source(expr: String) -> String {
   join([
     "module probe_declared_unit_digest_seal\n",
     "import gunbc.spark.pair_serving_realization { DeclaredUnitDigestStanding, DeclaredUnitDigested, DeclaredUnitDigestEvidence, spark_pair_declared_head_digest }\n",
-    "import gunbc.spark.fabric_switch_observed { FabricGroupA }\n",
+    "import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }\n",
     "import std.content_hash { ContentHash }\n",
     "fn probe(h: ContentHash) -> DeclaredUnitDigestStanding {\n  ",
     expr,
@@ -82,7 +83,7 @@ fn probe_source(expr: String) -> String {
 }
 
 data forge_expr: String = "DeclaredUnitDigested { evidence: DeclaredUnitDigestEvidence { digest: h } }"
-data sanctioned_expr: String = "spark_pair_declared_head_digest(group: FabricGroupA)"
+data sanctioned_expr: String = "spark_pair_declared_head_digest(group: FabricGroupB {})"
 
 fn seal_violations(expr: String) -> Int {
   keyed_count(
diff --git a/dag/test/claim/spark/spark_fabric_rail_witness_test.dag b/dag/test/claim/spark/spark_fabric_rail_witness_test.dag
index 9a83a3622b1..47fd1156562 100644
--- a/dag/test/claim/spark/spark_fabric_rail_witness_test.dag
+++ b/dag/test/claim/spark/spark_fabric_rail_witness_test.dag
@@ -3,16 +3,16 @@ module test.claim.spark.spark_fabric_rail_witness
 import std.types { Bool, List, NonEmptyStr, String }
 import product.host_identity { host_identity_eq }
 import extdeps.network.ipv4 { render_ipv4_address, ipv4_address_eq }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv9, operator_host_srv12, operator_host_srv1 }
+import gunbc.fleet_host_identity { operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12, operator_host_srv1 }
 import gunbc.spark.fabric_rail_desired { fabric_rail_desired, fabric_rail_desired_for, fabric_rail_address, fabric_rail_link_gbps }
 import gunbc.spark.fabric_rail_apply { fabric_rail_apply_plans }
 
 // ONE ADDRESS PER FABRIC HOST, ALL DISTINCT, ALL IN THE RAIL /24, NONE FOR A HOST OFF THE FABRIC.
 test fn every_fabric_host_has_one_distinct_rail_address_and_others_have_none() -> Bool {
-  length(fabric_rail_desired) == 8
+  length(fabric_rail_desired) == 4
     && all(fabric_rail_desired, d => length(filter(fabric_rail_desired, e => ipv4_address_eq(a: e.address, b: d.address))) == 1)
     && all(fabric_rail_desired, d => starts_with(s: render_ipv4_address(addr: d.address) as String, prefix: "192.168.110."))
-    && (match fabric_rail_address(host: operator_host_srv5) { Present { value: a } => (render_ipv4_address(addr: a) as String) == "192.168.110.11"  Absent => false })
+    && (match fabric_rail_address(host: operator_host_srv10) { Present { value: a } => (render_ipv4_address(addr: a) as String) == "192.168.110.15"  Absent => false })
     && (match fabric_rail_address(host: operator_host_srv12) { Present { value: a } => (render_ipv4_address(addr: a) as String) == "192.168.110.16"  Absent => false })
     && (match fabric_rail_address(host: operator_host_srv1) { Absent => true  Present { value: _ } => false })
 }
@@ -20,11 +20,11 @@ test fn every_fabric_host_has_one_distinct_rail_address_and_others_have_none() -
 // THE NETPLAN DOCUMENT NAMES THE LEG NETDEV WITH ITS ADDRESS AND JUMBO MTU, AND THE TWIN AS
 // UNADDRESSED AND OPTIONAL, so NetworkManager configures exactly one of the two netdevs a leg raises.
 test fn the_netplan_document_addresses_the_leg_and_quiets_its_twin() -> Bool {
-  match fabric_rail_desired_for(host: operator_host_srv6) {
+  match fabric_rail_desired_for(host: operator_host_srv11) {
     Absent => false
     Present { value: d } =>
       string_contains(s: d.netplan_text, pattern: "renderer: NetworkManager\n")
-        && string_contains(s: d.netplan_text, pattern: "        name: \"enp1s0f1np1\"\n      addresses:\n      - \"192.168.110.14/24\"\n      mtu: 9000\n")
+        && string_contains(s: d.netplan_text, pattern: "        name: \"enp1s0f1np1\"\n      addresses:\n      - \"192.168.110.18/24\"\n      mtu: 9000\n")
         && string_contains(s: d.netplan_text, pattern: "gunbc-fabric-twin:\n      match:\n        name: \"enP2p1s0f1np1\"\n      dhcp4: false\n")
         && !string_contains(s: d.netplan_text, pattern: "enP2p1s0f1np1\"\n      addresses:")
   }
@@ -34,7 +34,7 @@ test fn the_netplan_document_addresses_the_leg_and_quiets_its_twin() -> Bool {
 // speed a sizer reads is the observed 50G, not a nameplate.
 test fn the_apply_writes_the_document_whole_and_reads_the_rail_speed_from_the_cable() -> Bool {
   let plans = fabric_rail_apply_plans()
-  length(plans) == 8
+  length(plans) == 4
     && all(plans, p => starts_with(s: p.script, prefix: "set -e\n") && string_contains(s: p.script, pattern: "> /etc/netplan/90-gunbc-fabric.yaml\n") && string_contains(s: p.script, pattern: "netplan generate\nnetplan apply\n"))
     && fabric_rail_link_gbps() == 50
 }
diff --git a/dag/test/claim/spark/spark_fabric_reach_witness_test.dag b/dag/test/claim/spark/spark_fabric_reach_witness_test.dag
index 5be95b1a6a7..a66972abda1 100644
--- a/dag/test/claim/spark/spark_fabric_reach_witness_test.dag
+++ b/dag/test/claim/spark/spark_fabric_reach_witness_test.dag
@@ -2,7 +2,8 @@ module test.claim.spark.spark_fabric_reach_witness
 
 import std.types { Bool, List, String }
 import product.host_identity { host_identity_eq }
-import gunbc.fleet_host_identity { operator_host_srv2, operator_host_srv9, operator_host_srv5 }
+import gunbc.fleet_host_identity { operator_host_srv2, operator_host_srv9, operator_host_srv10 }
+import gunbc.spark.fabric_switch_observed { fabric_lane_for_host }
 import gunbc.fleet_host_key_enrollment { KnownHostKeyRow, fleet_host_key_enrollments }
 import gunbc.fleet_known_hosts_anchor { fleet_known_hosts_rows, known_hosts_endpoint_conflict }
 import gunbc.spark.fabric_reach {
@@ -17,7 +18,7 @@ fn w_is_rail(p: SparkReachPath) -> Bool {
 // THE EXECUTOR'S POSITION PICKS THE PATH: a fabric host by its lane hostname takes the rail, a
 // runner or the workstation takes the LAN, and a trailing newline from `hostname -s` is not a third host.
 test fn a_fabric_host_executes_over_the_rail_and_anything_else_over_the_lan() -> Bool {
-  w_is_rail(p: spark_reach_path_for_executor(executor_short_hostname: "spark-3bd5"))
+  w_is_rail(p: spark_reach_path_for_executor(executor_short_hostname: "spark-3336"))
     && w_is_rail(p: spark_reach_path_for_executor(executor_short_hostname: "spark-0c75\n"))
     && !w_is_rail(p: spark_reach_path_for_executor(executor_short_hostname: "srv2"))
     && !w_is_rail(p: spark_reach_path_for_executor(executor_short_hostname: "runner-7"))
@@ -26,8 +27,8 @@ test fn a_fabric_host_executes_over_the_rail_and_anything_else_over_the_lan() ->
 // EACH PATH NAMES A DIFFERENT ADDRESS FOR THE SAME HOST, AND THE RAIL IS ABSENT FOR A HOST WITH NO LANE.
 test fn the_two_paths_are_two_addresses_and_the_rail_refuses_a_host_off_the_fabric() -> Bool {
   (match spark_reach_endpoint(host: operator_host_srv9, path: ReachFabricRail) { Present { value: e } => e == "192.168.110.17"  Absent => false })
-    && (match spark_reach_endpoint(host: operator_host_srv9, path: ReachManagementLan) { Present { value: e } => e == "192.168.1.236"  Absent => false })
-    && (match spark_reach_endpoint(host: operator_host_srv5, path: ReachFabricRail) { Present { value: e } => e == "192.168.110.11"  Absent => false })
+    && (match spark_reach_endpoint(host: operator_host_srv9, path: ReachManagementLan) { Present { value: e } => e == "srv9"  Absent => false })
+    && (match spark_reach_endpoint(host: operator_host_srv10, path: ReachFabricRail) { Present { value: e } => e == "192.168.110.15"  Absent => false })
     && (match spark_reach_endpoint(host: operator_host_srv2, path: ReachFabricRail) { Present { value: _ } => false  Absent => true })
     && spark_reach_path_wire(p: ReachFabricRail) == "fabric-rail"
 }
@@ -36,9 +37,9 @@ test fn the_two_paths_are_two_addresses_and_the_rail_refuses_a_host_off_the_fabr
 // fingerprint as its LAN row, and the combined anchored set has no endpoint enrolled twice.
 test fn the_rail_rows_carry_each_enrolled_fabric_hosts_key_and_the_anchored_set_has_no_conflict() -> Bool {
   let rail = fabric_rail_known_host_rows()
-  length(rail) == 8
+  length(rail) == length(filter(fleet_host_key_enrollments, k => match fabric_lane_for_host(host: k.host) { Present { value: _ } => true  Absent => false }))
     && all(rail, r => any(fleet_host_key_enrollments, k => host_identity_eq(a: k.host, b: r.host) && k.sha256_fingerprint == r.sha256_fingerprint && k.endpoint != r.endpoint))
     && all(rail, r => starts_with(s: r.endpoint, prefix: "192.168.110."))
-    && length(fleet_known_hosts_rows()) == length(fleet_host_key_enrollments) + 8
+    && length(fleet_known_hosts_rows()) == length(fleet_host_key_enrollments) + length(rail)
     && (match known_hosts_endpoint_conflict(rows: fleet_known_hosts_rows()) { Present { value: _ } => false  Absent => true })
 }
diff --git a/dag/test/claim/spark/spark_fabric_switch_witness_test.dag b/dag/test/claim/spark/spark_fabric_switch_witness_test.dag
index 11d96bfa364..30c95d9679c 100644
--- a/dag/test/claim/spark/spark_fabric_switch_witness_test.dag
+++ b/dag/test/claim/spark/spark_fabric_switch_witness_test.dag
@@ -2,7 +2,7 @@ module test.claim.spark.spark_fabric_switch_witness
 
 import std.types { Bool, List, NonEmptyStr, String }
 import product.host_identity { host_identity_eq }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_srv9, operator_host_srv12, operator_host_srv1 }
+import gunbc.fleet_host_identity { operator_host_srv9, operator_host_srv11, operator_host_srv12, operator_host_srv1 }
 import extdeps.mikrotik.crs812 { crs812_lane_speed_wire, Lane50GCr2, crs812_passive_dac_requires_forced_mode }
 import extdeps.transceiver.sff_8636 {
   Sff8636NominalRate, NominalRateUnspecified, NominalRateDirect, NominalRateEscaped,
@@ -19,11 +19,7 @@ import product.cable_leg_observation {
 }
 import product.cable_plant_assessment { CableLegReading, LegReadingTaken, LegNeverRead }
 import gunbc.spark.fabric_switch_observed {
-  fabric_lane_observations, fabric_lane_interface, fabric_lane_for_host, fabric_leg_cable_observed,
-  fabric_leg_eeprom_observations, fabric_leg_reading, fabric_cable_plant,
-  fabric_leg_reading_of_row, FabricLegEepromObservation, AcquisitionInvalidatedByReflash, AcquisitionCurrent,
-  fabric_forced_100g_attempts, fabric_forced_100g_ever_trained,
-  FabricGroup, FabricGroupA, FabricGroupB, fabric_group_hosts, fabric_group_of_host,
+  fabric_lane_observations, fabric_lane_interface, fabric_lane_for_host, fabric_leg_cable_observed, fabric_leg_eeprom_observations, fabric_leg_reading, fabric_cable_plant, fabric_leg_reading_of_row, FabricLegEepromObservation, AcquisitionInvalidatedByReflash, AcquisitionCurrent, fabric_forced_100g_attempts, fabric_forced_100g_ever_trained, FabricGroup, FabricGroupB, fabric_group_hosts, fabric_group_of_host,
 }
 
 // The coding from the FIRST receipt, for the byte-level witnesses below. Reached THROUGH the receipt
@@ -44,23 +40,20 @@ fn fabric_delivered_leg_coding_probe() -> CableLegObservation {
   }
 }
 
-// EIGHT LANES, EIGHT DISTINCT HOSTS, ONE LEG EACH, all on odd lanes of the two 400G cages.
+// FOUR LANES, FOUR DISTINCT HOSTS, ONE LEG EACH, all on odd lanes of the cage-2 400G breakout.
 test fn every_unit_has_exactly_one_leg_on_an_odd_lane() -> Bool {
-  length(fabric_lane_observations) == 8
+  length(fabric_lane_observations) == 4
     && all(fabric_lane_observations, o => o.lane == 1 || o.lane == 3 || o.lane == 5 || o.lane == 7)
     && all(fabric_lane_observations, o => length(filter(fabric_lane_observations, p => host_identity_eq(a: p.host, b: o.host))) == 1)
-    && (match fabric_lane_for_host(host: operator_host_srv6) { Present { value: o } => (fabric_lane_interface(o: o) as String) == "qsfp56-dd-1-7"  Absent => false })
+    && (match fabric_lane_for_host(host: operator_host_srv11) { Present { value: o } => (fabric_lane_interface(o: o) as String) == "qsfp56-dd-2-7"  Absent => false })
 }
 
-// THE GROUPS ARE THE CAGES. srv5..srv8 share cage 1, srv9..srv12 share cage 2, and a host off the
-// fabric belongs to neither.
+// THE GROUPS ARE THE CAGES. srv9..srv12 share cage 2, and a host off the fabric belongs to no group.
 test fn groups_derive_from_the_cage_and_a_host_off_the_fabric_has_none() -> Bool {
-  let a = fabric_group_hosts(g: FabricGroupA)
-  let b = fabric_group_hosts(g: FabricGroupB)
-  length(a) == 4 && length(b) == 4
-    && any(a, h => host_identity_eq(a: h, b: operator_host_srv5)) && any(a, h => host_identity_eq(a: h, b: operator_host_srv8))
+  let b = fabric_group_hosts(g: FabricGroupB {})
+  length(b) == 4
     && any(b, h => host_identity_eq(a: h, b: operator_host_srv9)) && any(b, h => host_identity_eq(a: h, b: operator_host_srv12))
-    && (match fabric_group_of_host(host: operator_host_srv7) { Present { value: FabricGroupA } => true  _ => false })
+    && (match fabric_group_of_host(host: operator_host_srv11) { Present { value: FabricGroupB {} } => true  _ => false })
     && (match fabric_group_of_host(host: operator_host_srv1) { Absent => true  Present { value: _ } => false })
 }
 
@@ -143,8 +136,8 @@ fn plant_readings_never() -> Nat {
     }))
 }
 
-test fn all_eight_legs_carry_a_reading() -> Bool {
-  plant_readings_taken() == 8 && plant_readings_never() == 0
+test fn all_four_legs_carry_a_reading() -> Bool {
+  plant_readings_taken() == 4 && plant_readings_never() == 0
 }
 
 // AN INVALIDATED ACQUISITION IS NOT A LIVE READING, and the roster now carries a real one: the
@@ -201,8 +194,8 @@ test fn every_receipt_has_a_distinct_module_identity() -> Bool {
   length(switch_current_receipts()) == 8
     && all(switch_current_receipts(), a =>
          length(filter(switch_current_receipts(), r => r.vendor_serial == a.vendor_serial)) == 1)
-    && all(switch_current_receipts(), a =>
-         length(filter(fabric_lane_observations, o => (o.spark_hostname as String) == (a.host as String))) == 1)
+    && all(fabric_lane_observations, o =>
+         length(filter(switch_current_receipts(), a => (o.spark_hostname as String) == (a.host as String))) == 1)
     && length(fabric_leg_eeprom_observations) > length(switch_current_receipts())
 }
 
diff --git a/dag/test/claim/spark/spark_first_party_serving_witness_test.dag b/dag/test/claim/spark/spark_first_party_serving_witness_test.dag
index 9a5d9b98ccf..cc260f56a6b 100644
--- a/dag/test/claim/spark/spark_first_party_serving_witness_test.dag
+++ b/dag/test/claim/spark/spark_first_party_serving_witness_test.dag
@@ -20,7 +20,6 @@ import extdeps.vllm.usage_stats {
   UsageStatsLaunchUnread, vllm_usage_stats_disable_assignment_wire, vllm_usage_stats_reporting,
 }
 import product.host_identity { HostIdentity }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
 import gunbc.spark.vllm_endpoint_process_launch { VllmEndpointProcessLaunch, vllm_endpoint_process_launch }
 import gunbc.spark.vllm_serving_launch {
   EndpointIncarnationStanding, EndpointIncarnationUnobserved, EndpointIncarnationObserved,
@@ -29,7 +28,8 @@ import gunbc.spark.vllm_serving_launch {
 import gunbc.spark.serving_offer { spark_serving_incarnation_unobserved_obligation }
 import std.measure { token_count }
 import std.optional { Present, Absent }
-import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv5, operator_host_srv6 }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv9, operator_host_srv10 }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import gunbc.spark.pair_serving_realization {
   spark_pair_model_path_in_container, spark_pair_desired_snapshot,
 }
@@ -114,7 +114,7 @@ fn t_declared_path() -> String {
 // THE SERVICE HALF'S EVIDENCE IS ABSENT IN THESE FIXTURES, as it is in production. The telemetry
 // standing does not read it; the fields are here because the realization carries them.
 fn t_endpoint() -> VllmEndpointProcessLaunch {
-  vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "http://10.0.0.1:8000" as NonEmptyStr, process_start_field: "1" as NonEmptyStr)
+  vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "http://10.0.0.1:8000" as NonEmptyStr, process_start_field: "1" as NonEmptyStr)
 }
 
 fn t_incarnation_unobserved() -> EndpointIncarnationStanding {
@@ -123,7 +123,7 @@ fn t_incarnation_unobserved() -> EndpointIncarnationStanding {
 
 fn t_pair_realization() -> SparkServingRealization {
   SparkServingRealization {
-    hosts: [operator_host_srv5, operator_host_srv6],
+    hosts: [operator_host_srv10, operator_host_srv9],
     readback: t_readback(path: t_declared_path()),
     endpoint: t_endpoint(),
     incarnation: t_incarnation_unobserved(),
@@ -136,7 +136,7 @@ fn t_pair_realization() -> SparkServingRealization {
 // engine on the same port would inherit an environment nothing observed it to have.
 fn t_foreign_realization() -> SparkServingRealization {
   SparkServingRealization {
-    hosts: [operator_host_srv5, operator_host_srv6],
+    hosts: [operator_host_srv10, operator_host_srv9],
     readback: t_readback(path: "/weights/models--zai-org--GLM-5.3-Flash/snapshots/eb9eb208eb0d988989d07a6a12d0fdeb5f52574a"),
     endpoint: t_endpoint(),
     incarnation: t_incarnation_unobserved(),
@@ -435,11 +435,11 @@ test fn a_pair_realization_with_no_hosts_is_unread_for_membership() -> Bool {
 // RED -- A REALIZATION WHOSE HOSTS ARE ONLY PARTLY OBSERVED IS UNREAD, NOT ANSWERED FROM THE HALF
 // THAT IS. The earlier spelling refused only an EMPTY lane result, so one observed host and one
 // unobserved host resolved from the observed one and silently dropped the other (review 64424).
-// Partial evidence is missing evidence: srv5 has an observed lane and srv1 does not, and the answer
-// is the obligation rather than srv5's environment.
+// Partial evidence is missing evidence: srv10 has an observed lane and srv1 does not, and the answer
+// is the obligation rather than srv10's environment.
 test fn a_partly_observed_realization_is_unread_rather_than_answered_from_its_observed_half() -> Bool {
   match spark_serving_usage_stats_unread_cause(realization: SparkServingRealization {
-    hosts: [operator_host_srv5, operator_host_srv1],
+    hosts: [operator_host_srv10, operator_host_srv1],
     readback: t_readback(path: t_declared_path()),
     endpoint: t_endpoint(),
     incarnation: t_incarnation_unobserved(),
@@ -461,7 +461,7 @@ test fn a_partly_observed_realization_is_unread_rather_than_answered_from_its_ob
 // all, which is a different refusal reason from a comparison that succeeds and still settles nothing.
 test fn an_unresolved_readback_leaves_the_deployment_unidentified() -> Bool {
   match spark_serving_usage_stats_unread_cause(realization: SparkServingRealization {
-    hosts: [operator_host_srv5, operator_host_srv6],
+    hosts: [operator_host_srv10, operator_host_srv9],
     readback: ModelsRouteDocumentUnreadable { cause: "the document's data member is not an array" as NonEmptyStr },
     endpoint: t_endpoint(),
     incarnation: t_incarnation_unobserved(),
@@ -488,8 +488,8 @@ test fn an_unresolved_readback_leaves_the_deployment_unidentified() -> Bool {
 
 fn t_launch() -> VllmServingLaunch {
   vllm_serving_launch(
-    group: FabricGroupA,
-    head: operator_host_srv6,
+    group: FabricGroupB {},
+    head: operator_host_srv9,
     systemd_invocation: "fixture-invocation-telemetry" as NonEmptyStr,
     container_id: "fixture-container-telemetry" as NonEmptyStr,
     executable_digest: as_content_hash_structural(structural: content_hash_atom(value: "fixture-image" as NonEmptyStr)),
@@ -500,7 +500,7 @@ fn t_launch() -> VllmServingLaunch {
 
 fn t_observed_realization(env: List<String>) -> SparkServingRealization {
   SparkServingRealization {
-    hosts: [operator_host_srv5, operator_host_srv6],
+    hosts: [operator_host_srv10, operator_host_srv9],
     readback: t_readback(path: t_declared_path()),
     endpoint: t_endpoint(),
     incarnation: EndpointIncarnationObserved {
diff --git a/dag/test/claim/spark/spark_host_commitment_witness_test.dag b/dag/test/claim/spark/spark_host_commitment_witness_test.dag
index cc55b9ad984..19dd0369c9d 100644
--- a/dag/test/claim/spark/spark_host_commitment_witness_test.dag
+++ b/dag/test/claim/spark/spark_host_commitment_witness_test.dag
@@ -6,12 +6,13 @@ import product.host_identity { HostIdentity, host_identity_eq }
 import std.decl_ref { DeclarationRef, decl_ref, declaration_ref_display_key }
 import std.optional { Present, Absent }
 import gunbc.spark.pair_serving_authority_log { HostEffectRecord }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12, operator_host_srv1, operator_host_srv2 }
+import gunbc.fleet_host_identity { operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12, operator_host_srv1, operator_host_srv2 }
 import gunbc.spark.cell_role {
   SparkCellRoleAssignment, SparkServingCell, SparkTrainingCell, spark_cell_role_assignments,
 }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 import gunbc.spark.dgx_procurement { dgx_spark_reserved_identities }
+import gunbc.spark.pair_serving_authority { spark_pair_serving_authorities }
 import gunbc.spark.serving_arm_placement { ServingArmHostClaim, glm_canary_host_claim, glm_group_b_serving_arm, spark_serving_arm_host_claims }
 import gunbc.spark.serving_subject {
   ServingSubject, PairServingUnitOn, PlacedServingArm, serving_subject_eq,
@@ -19,15 +20,16 @@ import gunbc.spark.serving_subject {
   glm_group_b_serving_subject, glm_group_b_serving_reservation, spark_serving_reservations,
 }
 import gunbc.spark.host_commitment {
+  spark_claimed_members_under,
+  spark_standing_of,
   spark_host_standings,
-  spark_host_standing,
+  spark_admissibility_to,
   SparkHostCommitment,
   AuthorityHeldCommitment,
   RulingDerivedCommitment,
   SparkHostAuthorityCommitment,
   CommittedToCellRole,
   MemberOfClaimedServingGroup,
-  HoldsUndischargedRpcReservation,
   CellRoleUndecidable,
   OccupiedByServingArm,
   OccupiedByHostEffect,
@@ -39,18 +41,16 @@ import gunbc.spark.host_commitment {
   SparkHostCommitted,
   SparkHostAdmitted,
   SparkHostRefused,
-  admit_unplaced_host,
+  admit_unplaced_host_in,
+  SparkHostAdmission,
   admit_unplaced_host_among,
-  spark_host_commitment_causes_wire,
   spark_commitment_causes_text,
   spark_commitment_causes,
   spark_host_standing_in,
   spark_host_standings_in,
   spark_unplaced_hosts_of,
   spark_committed_standings_of,
-  spark_claimed_serving_group_hosts,
   spark_unplaced_hosts,
-  spark_host_is_unplaced,
   spark_host_commitment_wire,
   spark_authority_held_causes_of,
   spark_ruling_derived_causes_of,
@@ -59,8 +59,6 @@ import gunbc.spark.host_commitment {
   SparkHostHeldAgainst,
   spark_host_admissibility_to,
   spark_admissible_hosts_to,
-  spark_serving_admissibility,
-  spark_serving_admissible_hosts,
   admit_host_held_by_subject_among,
 }
 
@@ -68,10 +66,8 @@ import gunbc.spark.host_commitment {
 //
 // The rosters are fixtures rather than the production ones for the reason gunbc.spark.cell_role gives
 // for its own roster-parameterised lookup: a capability's evidence must not depend on which machines
-// currently hold what. The reservation arm in particular commits nobody in production today -- the
-// one minted reservation was cleared by a release receipt on 2026-09-05 -- so asserting it against
-// production data would be a wall reporting that nothing collides because nothing is reserved.
-data fixture_units: List<HostIdentity> = [operator_host_srv7, operator_host_srv8, operator_host_srv9]
+// currently hold what.
+data fixture_units: List<HostIdentity> = [operator_host_srv10, operator_host_srv11, operator_host_srv9]
 
 data fixture_assignments: List<SparkCellRoleAssignment> = [
   SparkCellRoleAssignment { host: operator_host_srv9, role: SparkTrainingCell },
@@ -82,35 +78,81 @@ data fixture_duplicate_assignments: List<SparkCellRoleAssignment> = [
   SparkCellRoleAssignment { host: operator_host_srv9, role: SparkTrainingCell },
 ]
 
+// ── GROUP B AS FIXTURE ────────────────────────────────────────────────────────────────────────
+//
+// srv9-srv12 were sold 2026-10-10, so the production unit roster is empty (rung drop
+// `serving_fixtures_name_sold_group_b_hosts`). The serving subject still names them, so the
+// population these claims discriminate on is supplied here: the production placement, claim and
+// reservation rows folded over the four Group B identities. `production_unit_roster_is_empty` is the
+// inhabitance claim that keeps the real roster honest.
+data fixture_group_b_units: List<HostIdentity> = [operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12]
+
+data group_b_standings: List<SparkHostStanding> = spark_host_standings_in(
+  units: fixture_group_b_units,
+  assignments: spark_cell_role_assignments,
+  claimed_group_members: spark_claimed_members_under(authorities: spark_pair_serving_authorities),
+  arm_claims: spark_serving_arm_host_claims,
+  serving_reservations: spark_serving_reservations,
+  host_effects: [] as List<HostEffectRecord>,
+)
+
+fn spark_host_standing(host: HostIdentity) -> SparkHostStanding? {
+  spark_standing_of(standings: group_b_standings, host: host)
+}
+
+fn spark_host_is_unplaced(host: HostIdentity) -> Bool {
+  any(spark_unplaced_hosts_of(standings: group_b_standings), h => host_identity_eq(a: h, b: host))
+}
+
+fn spark_serving_admissible_hosts(subject: ServingSubject) -> List<HostIdentity> {
+  spark_admissible_hosts_to(standings: group_b_standings, subject: subject)
+}
+
+fn spark_serving_admissibility(subject: ServingSubject) -> List<SparkHostAdmissibility> {
+  spark_admissibility_to(standings: group_b_standings, subject: subject)
+}
+
+fn admit_unplaced_host(raw: String, purpose: NonEmptyStr) -> SparkHostAdmission {
+  admit_unplaced_host_in(raw: raw, purpose: purpose, standings: group_b_standings)
+}
+
+fn spark_host_commitment_causes_wire(host: HostIdentity) -> NonEmptyStr {
+  match spark_host_standing(host: host) {
+    Absent => "outside the fixture population" as NonEmptyStr
+    Present { value: SparkHostUncommitted { host: _ } } => "nothing has claimed that host" as NonEmptyStr
+    Present { value: SparkHostCommitted { host: _, commitments: c } } => spark_commitment_causes_text(c: c) as NonEmptyStr
+  }
+}
+
+test fn production_unit_roster_is_empty_and_standings_cover_no_host() -> Bool {
+  length(dgx_spark_reserved_identities()) == 0
+    && length(spark_host_standings) == 0
+    && length(spark_unplaced_hosts) == 0
+}
+
 fn member(group: FabricGroup, host: HostIdentity) -> ClaimedServingGroupMember {
   ClaimedServingGroupMember { group: group, host: host }
 }
 
-fn fixture_standings(held: List<HostIdentity>, arms: List<ServingArmHostClaim>) -> List<SparkHostStanding> {
+fn fixture_standings(arms: List<ServingArmHostClaim>) -> List<SparkHostStanding> {
   spark_host_standings_in(
     units: fixture_units,
     assignments: fixture_assignments,
     claimed_group_members: [],
     arm_claims: arms,
-    held_reservation_hosts: held,
     serving_reservations: [],
     host_effects: [] as List<HostEffectRecord>
   )
 }
 
-fn fixture_unplaced(held: List<HostIdentity>) -> List<HostIdentity> {
-  spark_unplaced_hosts_of(standings: fixture_standings(held: held, arms: []))
-}
-
 // The per-host lookup is roster-bounded now, so every fixture call names the unit population it asks
 // within; an Absent answer means the host is outside that universe rather than uncommitted in it.
-fn fixture_standing(assignments: List<SparkCellRoleAssignment>, claimed: List<ClaimedServingGroupMember>, arms: List<ServingArmHostClaim>, held: List<HostIdentity>, host: HostIdentity) -> SparkHostStanding? {
+fn fixture_standing(assignments: List<SparkCellRoleAssignment>, claimed: List<ClaimedServingGroupMember>, arms: List<ServingArmHostClaim>, host: HostIdentity) -> SparkHostStanding? {
   spark_host_standing_in(
     units: fixture_units,
     assignments: assignments,
     claimed_group_members: claimed,
     arm_claims: arms,
-    held_reservation_hosts: held,
     serving_reservations: [],
     host_effects: [] as List<HostEffectRecord>,
     host: host,
@@ -128,7 +170,6 @@ fn is_cell_role(c: SparkHostCommitment) -> Bool {
         CommittedToCellRole { role: _ } => true
         MemberOfClaimedServingGroup { group: _ } => false
         OccupiedByServingArm { claim: _ } => false
-        HoldsUndischargedRpcReservation => false
         OccupiedByHostEffect { purpose: _, executor: _ } => false
         CellRoleUndecidable { assignments: _ } => false
       }
@@ -143,7 +184,6 @@ fn is_group_member(c: SparkHostCommitment) -> Bool {
         MemberOfClaimedServingGroup { group: _ } => true
         CommittedToCellRole { role: _ } => false
         OccupiedByServingArm { claim: _ } => false
-        HoldsUndischargedRpcReservation => false
         OccupiedByHostEffect { purpose: _, executor: _ } => false
         CellRoleUndecidable { assignments: _ } => false
       }
@@ -151,14 +191,13 @@ fn is_group_member(c: SparkHostCommitment) -> Bool {
   }
 }
 
-fn is_held_reservation(c: SparkHostCommitment) -> Bool {
+fn is_serving_arm(c: SparkHostCommitment) -> Bool {
   match c {
     AuthorityHeldCommitment { cause: o } =>
       match o {
-        HoldsUndischargedRpcReservation => true
+        OccupiedByServingArm { claim: _ } => true
         MemberOfClaimedServingGroup { group: _ } => false
         CommittedToCellRole { role: _ } => false
-        OccupiedByServingArm { claim: _ } => false
         OccupiedByHostEffect { purpose: _, executor: _ } => false
         CellRoleUndecidable { assignments: _ } => false
       }
@@ -176,25 +215,11 @@ fn is_ruling_reservation_for(c: SparkHostCommitment, subject: ServingSubject) ->
   }
 }
 
-// ── RED 1: A HOST HOLDING AN UNDISCHARGED RESERVATION IS NEVER IN THE SET ─────────────────────
-//
-// This is the arm the scalar could not express at all. Under a roster of three units where srv7 holds
-// an undischarged internal-participant reservation, the set is srv8 alone -- srv7 because it is held,
-// srv9 because it is committed to a role -- and membership is asserted BY IDENTITY in both directions
-// rather than by a length, because a count of one would be satisfied by any one host.
-test fn a_host_holding_an_undischarged_reservation_is_never_unplaced() -> Bool {
-  let unplaced = fixture_unplaced(held: [operator_host_srv7])
-  !contains_host(hosts: unplaced, host: operator_host_srv7)
-    && contains_host(hosts: unplaced, host: operator_host_srv8)
-    && !contains_host(hosts: unplaced, host: operator_host_srv9)
-    && length(unplaced) == 1
-}
-
 // A COMMITTED HOST CARRIES EVERY CAUSE THAT COMMITS IT. srv9 is committed to a role, claimed by a
-// serving group and held by a reservation at once; dropping any of them would make a later release
-// receipt look like it freed a host it did not free.
+// serving group and occupied by a serving arm at once; dropping any of them would make a later release
+// look like it freed a host it did not free.
 test fn a_committed_host_carries_every_cause_that_commits_it() -> Bool {
-  match fixture_standing(assignments: fixture_assignments, claimed: [member(group: FabricGroupB, host: operator_host_srv9)], arms: [], held: [operator_host_srv9], host: operator_host_srv9) {
+  match fixture_standing(assignments: fixture_assignments, claimed: [member(group: FabricGroupB {}, host: operator_host_srv9)], arms: [glm_canary_host_claim], host: operator_host_srv9) {
     Absent => false
     Present { value: SparkHostUncommitted { host: _ } } => false
     Present { value: SparkHostCommitted { host: h, commitments: c } } =>
@@ -206,36 +231,19 @@ test fn a_committed_host_carries_every_cause_that_commits_it() -> Bool {
                is_group_member(c: second)
                  && (match rest {
                       Empty => false
-                      Cons { head: third, tail: _ } => is_held_reservation(c: third)
+                      Cons { head: third, tail: _ } => is_serving_arm(c: third)
                     })
            })
   }
 }
 
-// ── RED 2: A RELEASE RECEIPT WIDENS THE SET, WITH NO EDIT TO ANY CONSUMER ─────────────────────
-//
-// A release receipt's whole effect on this join is that its host leaves
-// `llama_cpp_rpc_undischarged_peer_reservation_hosts()`; the receipt-to-undischarged fold is
-// gunbc.spark.llama_cpp_rpc_observed's own, and its evidence is in
-// test.claim.spark.spark_llama_cpp_rpc_witness. What is asserted here is the PROPAGATION: the same
-// units and the same assignments, with the hold discharged, admit srv7 and admit strictly more --
-// for the placement question here, and for a serving subject's admissible set below.
-test fn discharging_a_reservation_widens_the_unplaced_set() -> Bool {
-  let held = fixture_unplaced(held: [operator_host_srv7])
-  let released = fixture_unplaced(held: [])
-  !contains_host(hosts: held, host: operator_host_srv7)
-    && contains_host(hosts: released, host: operator_host_srv7)
-    && contains_host(hosts: released, host: operator_host_srv8)
-    && length(released) == length(held) + 1
-}
-
 // ── RED 3: AN UNDECIDABLE ROLE IS NOT FREEDOM ─────────────────────────────────────────────────
 //
 // Two roster rows naming one host make the commitment unreadable. A lookup that cannot say what a
 // host is committed to has not said the host is uncommitted, and the committed arm names that cause
 // rather than folding it into either role.
 test fn a_host_with_an_ambiguous_role_is_committed_rather_than_free() -> Bool {
-  match fixture_standing(assignments: fixture_duplicate_assignments, claimed: [], arms: [], held: [], host: operator_host_srv9) {
+  match fixture_standing(assignments: fixture_duplicate_assignments, claimed: [], arms: [], host: operator_host_srv9) {
     Absent => false
     Present { value: SparkHostUncommitted { host: _ } } => false
     Present { value: SparkHostCommitted { host: _, commitments: c } } =>
@@ -246,7 +254,6 @@ test fn a_host_with_an_ambiguous_role_is_committed_rather_than_free() -> Bool {
             CommittedToCellRole { role: _ } => false
             MemberOfClaimedServingGroup { group: _ } => false
             OccupiedByServingArm { claim: _ } => false
-            HoldsUndischargedRpcReservation => false
             OccupiedByHostEffect { purpose: _, executor: _ } => false
           }
         RulingDerivedCommitment { cause: _ } => false
@@ -258,9 +265,9 @@ test fn a_host_with_an_ambiguous_role_is_committed_rather_than_free() -> Bool {
 //
 // Without this every refusal above would be satisfied by a fold that refuses everything.
 test fn an_unclaimed_unheld_unassigned_host_is_uncommitted() -> Bool {
-  match fixture_standing(assignments: fixture_assignments, claimed: [], arms: [], held: [], host: operator_host_srv8) {
+  match fixture_standing(assignments: fixture_assignments, claimed: [], arms: [], host: operator_host_srv11) {
     Absent => false
-    Present { value: SparkHostUncommitted { host: h } } => host_identity_eq(a: h, b: operator_host_srv8)
+    Present { value: SparkHostUncommitted { host: h } } => host_identity_eq(a: h, b: operator_host_srv11)
     Present { value: SparkHostCommitted { host: _, commitments: _ } } => false
   }
 }
@@ -270,18 +277,16 @@ test fn an_unclaimed_unheld_unassigned_host_is_uncommitted() -> Bool {
 // standing something holds on the host.
 test fn each_commitment_cause_renders_distinctly() -> Bool {
   let role = spark_host_commitment_wire(c: AuthorityHeldCommitment { cause: CommittedToCellRole { role: SparkServingCell } }) as String
-  let group = spark_host_commitment_wire(c: AuthorityHeldCommitment { cause: MemberOfClaimedServingGroup { group: FabricGroupA } }) as String
-  let held = spark_host_commitment_wire(c: AuthorityHeldCommitment { cause: HoldsUndischargedRpcReservation }) as String
+  let group = spark_host_commitment_wire(c: AuthorityHeldCommitment { cause: MemberOfClaimedServingGroup { group: FabricGroupB {} } }) as String
   let ambiguous = spark_host_commitment_wire(c: AuthorityHeldCommitment { cause: CellRoleUndecidable { assignments: fixture_duplicate_assignments } }) as String
   let armed = spark_host_commitment_wire(c: AuthorityHeldCommitment { cause: OccupiedByServingArm { claim: glm_canary_host_claim } }) as String
   let ruled = spark_host_commitment_wire(c: RulingDerivedCommitment { cause: ReservedForServingSubject { subject: glm_group_b_serving_subject, basis: glm_group_b_serving_reservation.basis } }) as String
-  role != group && role != held && role != ambiguous && role != armed && role != ruled
-    && group != held && group != ambiguous && group != armed && group != ruled
-    && held != ambiguous && held != armed && held != ruled
+  role != group && role != ambiguous && role != armed && role != ruled
+    && group != ambiguous && group != armed && group != ruled
     && ambiguous != armed && ambiguous != ruled
     && armed != ruled
     && string_contains(s: armed, pattern: "glm_canary_arm")
-    && string_contains(s: group, pattern: "group-a")
+    && string_contains(s: group, pattern: "group-b")
     && string_contains(s: ruled, pattern: "reserved by ruling")
     && string_contains(s: ruled, pattern: "2026-09-12")
     && string_contains(s: ruled, pattern: "operator")
@@ -291,7 +296,7 @@ test fn each_commitment_cause_renders_distinctly() -> Bool {
 //
 // WHAT THE FIRST CUT OF THIS CLAIM ACTUALLY ESTABLISHED, which is less than its name promised: it
 // required the three cause fragments and AT LEAST ONE "; ". Three causes need TWO separators, so a
-// render that dropped the second one -- "...cell role; ...claimsholding an undischarged..." -- carried
+// render that dropped the second one -- "...cell role; ...claimsa serving arm..." -- carried
 // every fragment, carried a separator, and passed. It discriminated against dropping the whole tail
 // and against omitting every separator, which is why it was worth having, and it did not establish
 // the property it is named for.
@@ -300,15 +305,14 @@ test fn each_commitment_cause_renders_distinctly() -> Bool {
 // controlled fixture; deriving it through the same map-and-join composition under test would compare
 // the renderer to itself, which is the oracle defect DESIGN section 5 names -- a measurement taken
 // from the subject is not an oracle for the subject.
-data expected_three_cause_rendering: String = "committed to a Spark cell role; a member of a serving group this repository claims (group-b); holding an undischarged llama.cpp RPC peer reservation"
+data expected_three_cause_rendering: String = "committed to a Spark cell role; a member of a serving group this repository claims (group-b); a serving arm is placed on it (gunbc.spark.glm_canary_converge::glm_canary_arm)"
 
 test fn a_multi_cause_host_renders_every_cause_with_both_separators() -> Bool {
   match spark_host_standing_in(
     units: fixture_units,
     assignments: fixture_assignments,
-    claimed_group_members: [member(group: FabricGroupB, host: operator_host_srv9)],
-    arm_claims: [],
-    held_reservation_hosts: [operator_host_srv9],
+    claimed_group_members: [member(group: FabricGroupB {}, host: operator_host_srv9)],
+    arm_claims: [glm_canary_host_claim],
     serving_reservations: [],
     host_effects: [] as List<HostEffectRecord>,
     host: operator_host_srv9,
@@ -331,26 +335,24 @@ test fn a_multi_cause_host_renders_every_cause_with_both_separators() -> Bool {
 // which is the positive half without which this red is satisfied by a function that refuses
 // everything.
 test fn the_per_host_producer_refuses_a_host_outside_the_named_unit_population() -> Bool {
-  (match fixture_standing(assignments: [], claimed: [], arms: [], held: [], host: operator_host_srv2) {
+  (match fixture_standing(assignments: [], claimed: [], arms: [], host: operator_host_srv2) {
      Absent => true
      Present { value: _ } => false
    })
-    && (match fixture_standing(assignments: [], claimed: [], arms: [], held: [], host: operator_host_srv5) {
+    && (match fixture_standing(assignments: [], claimed: [], arms: [], host: operator_host_srv12) {
          Absent => true
          Present { value: _ } => false
        })
-    && (match fixture_standing(assignments: [], claimed: [], arms: [], held: [], host: operator_host_srv8) {
+    && (match fixture_standing(assignments: [], claimed: [], arms: [], host: operator_host_srv11) {
          Absent => false
-         Present { value: SparkHostUncommitted { host: h } } => host_identity_eq(a: h, b: operator_host_srv8)
+         Present { value: SparkHostUncommitted { host: h } } => host_identity_eq(a: h, b: operator_host_srv11)
          Present { value: SparkHostCommitted { host: _, commitments: _ } } => false
        })
 }
 
 // ── THE PRODUCTION SETS, ASSERTED BY IDENTITY ────────────────────────────────────────────────
 //
-// srv5 and srv6 are committed cells, all four of srv5-srv8 are the hosts of the one serving group
-// this repository claims (cage 1 of gunbc.spark.fabric_switch_observed), and srv9-srv12 are the
-// hosts of group B, every one of which carries a placement claim from the native GLM arm converged
+// srv9-srv12 are the hosts of group B, every one of which carries a placement claim from the native GLM arm converged
 // on that group (gunbc.spark.serving_arm_placement, derived from
 // gunbc.spark.fabric_serving_assignment). So no production unit is UNPLACED, and the UNCOMMITTED set
 // -- no cause of any kind -- is empty.
@@ -389,7 +391,6 @@ fn placed_by_the_group_b_arm(host: HostIdentity) -> Bool {
             && string_contains(s: declaration_ref_display_key(ref: claimed.arm), pattern: "glm_group_b_serving_assignment")
         CommittedToCellRole { role: _ } => false
         MemberOfClaimedServingGroup { group: _ } => false
-        HoldsUndischargedRpcReservation => false
         OccupiedByHostEffect { purpose: _, executor: _ } => false
         CellRoleUndecidable { assignments: _ } => false
       })
@@ -401,15 +402,10 @@ test fn the_production_group_b_hosts_are_placed_by_the_converged_arm_by_identity
     && placed_by_the_group_b_arm(host: operator_host_srv10)
     && placed_by_the_group_b_arm(host: operator_host_srv11)
     && placed_by_the_group_b_arm(host: operator_host_srv12)
-    && !placed_by_the_group_b_arm(host: operator_host_srv5)
     && !spark_host_is_unplaced(host: operator_host_srv9)
     && !spark_host_is_unplaced(host: operator_host_srv10)
     && !spark_host_is_unplaced(host: operator_host_srv11)
     && !spark_host_is_unplaced(host: operator_host_srv12)
-    && !spark_host_is_unplaced(host: operator_host_srv5)
-    && !spark_host_is_unplaced(host: operator_host_srv6)
-    && !spark_host_is_unplaced(host: operator_host_srv7)
-    && !spark_host_is_unplaced(host: operator_host_srv8)
 }
 
 fn production_standing_is_committed(host: HostIdentity) -> Bool {
@@ -425,7 +421,7 @@ fn production_standing_is_committed(host: HostIdentity) -> Bool {
 // expected to have and it is asserted rather than assumed, because an empty set would satisfy every
 // "not in the set" claim above without saying anything.
 test fn every_production_unit_is_committed_so_the_uncommitted_set_is_empty_by_identity() -> Bool {
-  all(dgx_spark_reserved_identities(), h => production_standing_is_committed(host: h))
+  all(fixture_group_b_units, h => production_standing_is_committed(host: h))
     && production_standing_is_committed(host: operator_host_srv10)
     && production_standing_is_committed(host: operator_host_srv12)
 }
@@ -452,7 +448,6 @@ test fn the_group_b_head_host_is_committed_and_its_cause_names_the_assignment()
                      && string_contains(s: declaration_ref_display_key(ref: claimed.arm), pattern: "glm_group_b_serving_assignment")
                  CommittedToCellRole { role: _ } => false
                  MemberOfClaimedServingGroup { group: _ } => false
-                 HoldsUndischargedRpcReservation => false
                  OccupiedByHostEffect { purpose: _, executor: _ } => false
                  CellRoleUndecidable { assignments: _ } => false
                })
@@ -465,12 +460,12 @@ test fn the_group_b_head_host_is_committed_and_its_cause_names_the_assignment()
 test fn an_arm_claim_commits_only_the_host_it_names() -> Bool {
   let claims = [ServingArmHostClaim {
     arm: decl_ref(module_path: "test.claim.spark.spark_host_commitment_witness", decl_name: "an_arm_claim_commits_only_the_host_it_names"),
-    host: operator_host_srv8,
+    host: operator_host_srv11,
     basis: "fixture" as NonEmptyStr,
   }]
-  let unplaced = spark_unplaced_hosts_of(standings: fixture_standings(held: [], arms: claims))
-  !contains_host(hosts: unplaced, host: operator_host_srv8)
-    && contains_host(hosts: unplaced, host: operator_host_srv7)
+  let unplaced = spark_unplaced_hosts_of(standings: fixture_standings(arms: claims))
+  !contains_host(hosts: unplaced, host: operator_host_srv11)
+    && contains_host(hosts: unplaced, host: operator_host_srv10)
 }
 
 // ── RED 5: THE ONE ADMISSION SEAM REFUSES A CLAIMED HOST, AND SAYS WHY ────────────────────────
@@ -503,10 +498,6 @@ test fn the_admission_seam_refuses_a_claimed_host_naming_its_cause() -> Bool {
          && string_contains(s: why as String, pattern: "not a held claim")
      SparkHostAdmitted { host: _ } => false
    })
-    && (match admit_unplaced_host(raw: "srv5", purpose: "a fixture effect" as NonEmptyStr) {
-         SparkHostRefused { cause: why } => string_contains(s: why as String, pattern: "cell role")
-         SparkHostAdmitted { host: _ } => false
-       })
     && (match admit_unplaced_host(raw: "", purpose: "a fixture effect" as NonEmptyStr) {
          SparkHostRefused { cause: why } => string_contains(s: why as String, pattern: "does not pick")
          SparkHostAdmitted { host: _ } => false
@@ -535,33 +526,6 @@ test fn a_host_outside_the_unit_population_is_refused_as_unrostered() -> Bool {
   }
 }
 
-// THE SERVING GROUP IS WHERE THE COMMITMENT OF srv7 AND srv8 ACTUALLY COMES FROM, and that is worth
-// asserting on its own: they carry no cell role and no undischarged reservation, so a derivation that
-// consulted only those two authorities would call them free while they sit in the one cage this
-// repository claims for serving. (An earlier wording called that cage "the deployed four-rank-by-two
-// shape", which is a candidate label meaning two four-rank replicas across eight hosts; cage 1 is
-// four hosts, and what exactly runs on it is not established by this module.)
-test fn srv7_and_srv8_are_committed_by_the_claimed_serving_group_and_by_nothing_else() -> Bool {
-  contains_host(hosts: spark_claimed_serving_group_hosts(), host: operator_host_srv7)
-    && contains_host(hosts: spark_claimed_serving_group_hosts(), host: operator_host_srv8)
-    && production_commitment_is_group_membership_alone(host: operator_host_srv7)
-    && production_commitment_is_group_membership_alone(host: operator_host_srv8)
-}
-
-// THE PAYLOAD INSPECTION BOTH HOSTS GET, rather than one host inspected and the other assumed. An
-// earlier cut of the claim above checked group membership for both and the exact commitment payload
-// for srv7 only, while its name asserted "and by nothing else" about both -- a claim wider than its
-// evidence, which is the same over-reach this module keeps having to unlearn one level up.
-fn production_commitment_is_group_membership_alone(host: HostIdentity) -> Bool {
-  match spark_host_standing(host: host) {
-    Absent => false
-    Present { value: SparkHostUncommitted { host: _ } } => false
-    Present { value: SparkHostCommitted { host: _, commitments: c } } =>
-      is_group_member(c: c.head)
-        && (match c.tail { Empty => true  Cons { head: _, tail: _ } => false })
-  }
-}
-
 // THE DERIVATION IS TOTAL OVER ITS UNIVERSE: unplaced plus authority-held partitions the units,
 // and nothing here authors a host list. The partition is between the placement projection and its
 // complement, which is the pair of derived sets that consumers actually read.
@@ -574,10 +538,10 @@ fn production_host_has_authority_held_cause(host: HostIdentity) -> Bool {
 }
 
 test fn the_derivation_partitions_the_unit_population() -> Bool {
-  let units = dgx_spark_reserved_identities()
-  all(spark_unplaced_hosts, h => contains_host(hosts: units, host: h))
+  let units = fixture_group_b_units
+  all(spark_unplaced_hosts_of(standings: group_b_standings), h => contains_host(hosts: units, host: h))
     && all(units, h => spark_host_is_unplaced(host: h) != production_host_has_authority_held_cause(host: h))
-    && all(spark_committed_standings_of(standings: spark_host_standings), s => match s {
+    && all(spark_committed_standings_of(standings: group_b_standings), s => match s {
          SparkHostUncommitted { host: _ } => false
          SparkHostCommitted { host: h, commitments: _ } => contains_host(hosts: units, host: h)
        })
@@ -618,63 +582,40 @@ test fn authority_held_and_ruling_derived_causes_are_separable_by_a_fold() -> Bo
 
 // ── ADMISSIBILITY TO A SERVING SUBJECT ───────────────────────────────────────────────────────
 //
-// THE PRODUCTION ANSWER, BY IDENTITY IN BOTH DIRECTIONS. The pair unit on group A -- the subject V4.1
-// takes over by the operator's 2026-09-12 ruling -- sees exactly its own four hosts: srv5 and srv6
-// through their serving roles and group membership, srv7 and srv8 through membership alone. It does
-// NOT see srv9-srv12, which group B's assigned arm occupies and the ruling reserves for GLM. Group B's
-// subject sees srv9-srv12 and none of group A. Nothing is free to both, which is the sentence the
-// scalar could never say.
-data pair_unit_a: ServingSubject = PairServingUnitOn { group: FabricGroupA }
-
-test fn the_pair_unit_on_group_a_is_admitted_exactly_its_own_four_hosts() -> Bool {
-  let admissible = spark_serving_admissible_hosts(subject: pair_unit_a)
-  contains_host(hosts: admissible, host: operator_host_srv5)
-    && contains_host(hosts: admissible, host: operator_host_srv6)
-    && contains_host(hosts: admissible, host: operator_host_srv7)
-    && contains_host(hosts: admissible, host: operator_host_srv8)
-    && !contains_host(hosts: admissible, host: operator_host_srv9)
-    && !contains_host(hosts: admissible, host: operator_host_srv10)
-    && !contains_host(hosts: admissible, host: operator_host_srv11)
-    && !contains_host(hosts: admissible, host: operator_host_srv12)
-    && !contains_host(hosts: admissible, host: operator_host_srv2)
-}
-
-test fn group_b_s_assigned_subject_is_admitted_group_b_and_none_of_group_a() -> Bool {
+// THE PRODUCTION ANSWER. Group B's subject sees srv9-srv12, every host of its cage. A pair unit on
+// group B is used below as a SUBJECT that holds none of them: no group is claimed by pair serving,
+// so against it the arm claim and the ruling's reservation are both unheld.
+data pair_unit_b: ServingSubject = PairServingUnitOn { group: FabricGroupB {} }
+
+test fn group_b_s_assigned_subject_is_admitted_group_b() -> Bool {
   let admissible = spark_serving_admissible_hosts(subject: glm_group_b_serving_subject)
   contains_host(hosts: admissible, host: operator_host_srv9)
     && contains_host(hosts: admissible, host: operator_host_srv10)
     && contains_host(hosts: admissible, host: operator_host_srv11)
     && contains_host(hosts: admissible, host: operator_host_srv12)
-    && !contains_host(hosts: admissible, host: operator_host_srv5)
-    && !contains_host(hosts: admissible, host: operator_host_srv6)
-    && !contains_host(hosts: admissible, host: operator_host_srv7)
-    && !contains_host(hosts: admissible, host: operator_host_srv8)
+    && length(spark_serving_admissible_hosts(subject: pair_unit_b)) == 0
 }
 
 // ── ADMISSION BY THE SUBJECT THAT HOLDS THE HOST ──────────────────────────────────────────────
 //
 // THE SECOND ADMISSION RELATION THIS FILE OWNS, and it exists because the first one refuses exactly
 // where this one must admit. `admit_unplaced_host` asks whether a host is spoken for by nobody;
-// `spark_unplaced_hosts` is EMPTY in production and srv5-srv8 are committed to the pair subject, so
-// an effect that stages bytes at rest on a Group A host on its owner's behalf can never be admitted
-// that way -- and routing around that refusal would have asserted that a committed host is
-// unclaimed, which is the authority relation docs/plans/dsv41-cut-d-redesign.md protects. So the
-// weaker, true relation gets its own seam, and these rows are its discriminating evidence. Its
-// consumers are the two DS4.1 Group A modes (gunbc.spark.v41_checkpoint_materialize and
-// gunbc.spark.v41_runtime_image_converge).
-
-// EVERY GROUP B HOST REFUSES AGAINST THE GROUP A SUBJECT, AND THE REFUSAL RENDERS THE HELD LIST. Group
-// B is precisely the population a "just pick a Spark" reading would have admitted, so it is the
-// discriminating red; naming the held hosts is what makes the refusal actionable rather than a no.
-test fn no_group_b_host_is_held_by_the_group_a_pair_subject() -> Bool {
-  let held = spark_serving_admissible_hosts(subject: pair_unit_a)
-  all([operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12, operator_host_srv1, operator_host_srv2], h =>
-    match admit_host_held_by_subject_among(subject: pair_unit_a, raw: h, held: held) {
+// `spark_unplaced_hosts` is EMPTY in production, so an effect that stages bytes at rest on a held host
+// on its owner's behalf can never be admitted that way -- and routing around that refusal would have
+// asserted that a committed host is unclaimed. So the weaker, true relation gets its own seam, and
+// these rows are its discriminating evidence.
+
+// A HOST THE SUBJECT DOES NOT HOLD REFUSES, AND THE REFUSAL RENDERS THE HELD LIST; every host the
+// subject holds is admitted. Naming the held hosts is what makes the refusal actionable rather than a no.
+test fn a_host_not_held_by_the_group_b_subject_refuses_naming_the_held_hosts() -> Bool {
+  let held = spark_serving_admissible_hosts(subject: glm_group_b_serving_subject)
+  all([operator_host_srv1, operator_host_srv2], h =>
+    match admit_host_held_by_subject_among(subject: glm_group_b_serving_subject, raw: h, held: held) {
       Absent => false
-      Present { value: why } => why.contains(join([h as String, " is not held by"], "")) && why.contains("srv5") && why.contains("srv8")
+      Present { value: why } => why.contains(join([h as String, " is not held by"], "")) && why.contains("srv9") && why.contains("srv12")
     })
-    && all([operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8], h =>
-      match admit_host_held_by_subject_among(subject: pair_unit_a, raw: h, held: held) {
+    && all([operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12], h =>
+      match admit_host_held_by_subject_among(subject: glm_group_b_serving_subject, raw: h, held: held) {
         Absent => true
         Present { value: _ } => false
       })
@@ -684,17 +625,16 @@ test fn no_group_b_host_is_held_by_the_group_a_pair_subject() -> Bool {
 // population must refuse every host rather than fall through -- the absorbing arm DESIGN section 5
 // forbids, and the one a `if any(...) { .. } else { .. }` inverted by one edit would produce.
 test fn an_empty_held_population_admits_no_host() -> Bool {
-  all([operator_host_srv5, operator_host_srv8, operator_host_srv1], h =>
-    match admit_host_held_by_subject_among(subject: pair_unit_a, raw: h, held: [] as List<HostIdentity>) {
+  all([operator_host_srv9, operator_host_srv12, operator_host_srv1], h =>
+    match admit_host_held_by_subject_among(subject: glm_group_b_serving_subject, raw: h, held: [] as List<HostIdentity>) {
       Absent => false
       Present { value: _ } => true
     })
 }
 
 // THE REFUSAL NAMES THE CAUSE THAT WAS NOT HELD, so a host held against a subject is explained rather
-// than merely absent. srv9 against the pair unit: the arm claim is the unheld cause. srv5 against the
-// group B's subject: both the serving role and the group membership are unheld, and the role is unheld BECAUSE
-// the subject does not claim the host, which is the sibling-relative arm of the holder rule.
+// than merely absent. srv9 against the pair unit: the arm claim and the ruling's reservation are the
+// unheld causes; against group B's own subject nothing on srv9 is unheld.
 fn unheld_causes_against(host: HostIdentity, subject: ServingSubject) -> List<SparkHostCommitment> {
   flat_map(spark_serving_admissibility(subject: subject), a => match a {
     SparkHostAdmissibleTo { host: _, subject: _ } => []
@@ -704,67 +644,26 @@ fn unheld_causes_against(host: HostIdentity, subject: ServingSubject) -> List<Sp
 }
 
 test fn a_host_held_against_a_subject_names_the_unheld_causes() -> Bool {
-  let srv9_vs_a = unheld_causes_against(host: operator_host_srv9, subject: pair_unit_a)
-  let srv5_vs_group_b = unheld_causes_against(host: operator_host_srv5, subject: glm_group_b_serving_subject)
-  length(srv9_vs_a) == 2
-    && any(srv9_vs_a, c => match c {
+  let srv9_vs_pair = unheld_causes_against(host: operator_host_srv9, subject: pair_unit_b)
+  length(srv9_vs_pair) == 2
+    && any(srv9_vs_pair, c => match c {
          AuthorityHeldCommitment { cause: o } =>
            match o {
              OccupiedByServingArm { claim: cl } => host_identity_eq(a: cl.host, b: operator_host_srv9)
              CommittedToCellRole { role: _ } => false
              MemberOfClaimedServingGroup { group: _ } => false
-             HoldsUndischargedRpcReservation => false
              OccupiedByHostEffect { purpose: _, executor: _ } => false
              CellRoleUndecidable { assignments: _ } => false
            }
          RulingDerivedCommitment { cause: _ } => false
        })
-    && any(srv9_vs_a, c => is_ruling_reservation_for(c: c, subject: glm_group_b_serving_subject))
-    && length(srv5_vs_group_b) == 2
-    && any(srv5_vs_group_b, c => is_cell_role(c: c))
-    && any(srv5_vs_group_b, c => is_group_member(c: c))
-    && length(unheld_causes_against(host: operator_host_srv5, subject: pair_unit_a)) == 0
+    && any(srv9_vs_pair, c => is_ruling_reservation_for(c: c, subject: glm_group_b_serving_subject))
+    && length(unheld_causes_against(host: operator_host_srv9, subject: glm_group_b_serving_subject)) == 0
 }
 
-// ── RED 7: A HOST RESERVED BY ANOTHER SUBJECT OR BY AN UNDISCHARGED RPC RESERVATION IS NEVER
-// COUNTED, AND A RELEASE RECEIPT WIDENS THE SUBJECT'S SET ─────────────────────────────────────
-//
-// Over the fixture roster: srv7 and srv8 are members of a claimed group A, srv9 carries a fixture
-// arm. Against the pair unit on A, srv9 is never admissible (another subject's), srv7 is not
-// admissible while it holds an RPC reservation (nobody's), and discharging the reservation admits
-// srv7 back BY IDENTITY with no other change. The RPC arm is the one no serving subject can ever
-// hold, so it is asserted against the group's OWN unit -- the subject that holds everything else on
-// the host -- because that is the subject a fail-open would have admitted it to.
 data fixture_arm: DeclarationRef = decl_ref(module_path: "test.claim.spark.spark_host_commitment_witness", decl_name: "fixture_arm")
 
-fn fixture_admissible_to_a(held: List<HostIdentity>) -> List<HostIdentity> {
-  spark_admissible_hosts_to(
-    standings: spark_host_standings_in(
-      units: fixture_units,
-      assignments: [],
-      claimed_group_members: [member(group: FabricGroupA, host: operator_host_srv7), member(group: FabricGroupA, host: operator_host_srv8)],
-      arm_claims: [ServingArmHostClaim { arm: fixture_arm, host: operator_host_srv9, basis: "fixture" as NonEmptyStr }],
-      held_reservation_hosts: held,
-      serving_reservations: [],
-    host_effects: [] as List<HostEffectRecord>
-    ),
-    subject: pair_unit_a,
-  )
-}
-
-test fn a_reserved_host_is_never_admissible_and_a_release_receipt_widens_the_set() -> Bool {
-  let held = fixture_admissible_to_a(held: [operator_host_srv7])
-  let released = fixture_admissible_to_a(held: [])
-  !contains_host(hosts: held, host: operator_host_srv7)
-    && contains_host(hosts: held, host: operator_host_srv8)
-    && !contains_host(hosts: held, host: operator_host_srv9)
-    && contains_host(hosts: released, host: operator_host_srv7)
-    && contains_host(hosts: released, host: operator_host_srv8)
-    && !contains_host(hosts: released, host: operator_host_srv9)
-    && length(released) == length(held) + 1
-}
-
-// A DECLARED RESERVATION HOLDS FOR ITS SUBJECT AND AGAINST EVERY OTHER, over a fixture: srv8 reserved
+// A DECLARED RESERVATION HOLDS FOR ITS SUBJECT AND AGAINST EVERY OTHER, over a fixture: srv11 reserved
 // by ruling for the fixture arm's subject is admissible to that arm and held against the pair unit,
 // while a serving cell role on the same host is held by the reserving subject through the
 // sibling-relative arm of the holder rule -- a role on a host nobody claims would be held by nobody.
@@ -772,26 +671,25 @@ test fn a_declared_reservation_is_held_by_its_subject_and_against_every_other()
   let arm_subject = PlacedServingArm { arm: fixture_arm }
   let standings = spark_host_standings_in(
     units: fixture_units,
-    assignments: [SparkCellRoleAssignment { host: operator_host_srv8, role: SparkServingCell }],
+    assignments: [SparkCellRoleAssignment { host: operator_host_srv11, role: SparkServingCell }],
     claimed_group_members: [],
     arm_claims: [],
-    held_reservation_hosts: [],
     serving_reservations: [SparkServingReservation {
       subject: arm_subject,
-      hosts: [operator_host_srv8],
+      hosts: [operator_host_srv11],
       basis: ServingRulingCitation { decider: "fixture" as NonEmptyStr, ruled_on: "fixture" as NonEmptyStr, ruled: "fixture" as NonEmptyStr },
     }],
     host_effects: [] as List<HostEffectRecord>,
   )
   let to_arm = spark_admissible_hosts_to(standings: standings, subject: arm_subject)
-  let to_a = spark_admissible_hosts_to(standings: standings, subject: pair_unit_a)
+  let to_pair = spark_admissible_hosts_to(standings: standings, subject: pair_unit_b)
   let unplaced = spark_unplaced_hosts_of(standings: standings)
-  contains_host(hosts: to_arm, host: operator_host_srv8)
-    && !contains_host(hosts: to_a, host: operator_host_srv8)
-    && contains_host(hosts: to_a, host: operator_host_srv7)
-    && contains_host(hosts: to_arm, host: operator_host_srv7)
-    && !contains_host(hosts: unplaced, host: operator_host_srv8)
-    && contains_host(hosts: unplaced, host: operator_host_srv7)
+  contains_host(hosts: to_arm, host: operator_host_srv11)
+    && !contains_host(hosts: to_pair, host: operator_host_srv11)
+    && contains_host(hosts: to_pair, host: operator_host_srv10)
+    && contains_host(hosts: to_arm, host: operator_host_srv10)
+    && !contains_host(hosts: unplaced, host: operator_host_srv11)
+    && contains_host(hosts: unplaced, host: operator_host_srv10)
 }
 
 // A SERVING ROLE ON A HOST NO SUBJECT CLAIMS IS HELD BY NOBODY, and a training role is held by nobody
@@ -801,19 +699,18 @@ test fn an_unclaimed_serving_role_and_any_training_role_are_held_by_nobody() ->
   let standings = spark_host_standings_in(
     units: fixture_units,
     assignments: [
-      SparkCellRoleAssignment { host: operator_host_srv7, role: SparkServingCell },
-      SparkCellRoleAssignment { host: operator_host_srv8, role: SparkTrainingCell },
+      SparkCellRoleAssignment { host: operator_host_srv10, role: SparkServingCell },
+      SparkCellRoleAssignment { host: operator_host_srv11, role: SparkTrainingCell },
     ],
-    claimed_group_members: [member(group: FabricGroupA, host: operator_host_srv8)],
+    claimed_group_members: [member(group: FabricGroupB {}, host: operator_host_srv11)],
     arm_claims: [],
-    held_reservation_hosts: [],
     serving_reservations: [],
     host_effects: [] as List<HostEffectRecord>
   )
-  let to_a = spark_admissible_hosts_to(standings: standings, subject: pair_unit_a)
-  !contains_host(hosts: to_a, host: operator_host_srv7)
-    && !contains_host(hosts: to_a, host: operator_host_srv8)
-    && contains_host(hosts: to_a, host: operator_host_srv9)
+  let to_pair = spark_admissible_hosts_to(standings: standings, subject: pair_unit_b)
+  !contains_host(hosts: to_pair, host: operator_host_srv10)
+    && !contains_host(hosts: to_pair, host: operator_host_srv11)
+    && contains_host(hosts: to_pair, host: operator_host_srv9)
 }
 
 // THE PRODUCTION RESERVATION ROW IS THE RULING'S FIRST HALF, DERIVED THROUGH THE CAGE: its hosts are
@@ -824,7 +721,7 @@ test fn the_group_b_reservation_is_group_b_s_assigned_subject_over_the_observed_
     && serving_subject_eq(a: glm_group_b_serving_subject, b: PlacedServingArm { arm: glm_group_b_serving_arm })
     && contains_host(hosts: glm_group_b_serving_reservation.hosts, host: operator_host_srv9)
     && contains_host(hosts: glm_group_b_serving_reservation.hosts, host: operator_host_srv12)
-    && !contains_host(hosts: glm_group_b_serving_reservation.hosts, host: operator_host_srv5)
+    && !contains_host(hosts: glm_group_b_serving_reservation.hosts, host: operator_host_srv1)
     && (glm_group_b_serving_reservation.basis.ruled_on as String) == "2026-09-12"
     && any(spark_serving_reservations, r => serving_subject_eq(a: r.subject, b: glm_group_b_serving_subject))
 }
diff --git a/dag/test/claim/spark/spark_llama_cpp_rpc_witness_test.dag b/dag/test/claim/spark/spark_llama_cpp_rpc_witness_test.dag
deleted file mode 100644
index 7df80186f80..00000000000
--- a/dag/test/claim/spark/spark_llama_cpp_rpc_witness_test.dag
+++ /dev/null
@@ -1,448 +0,0 @@
-module test.claim.spark_llama_cpp_rpc_witness
-
-import std.types { Bool, String, NonEmptyStr, Int, List }
-import std.measure {
-  token_count, token_count_value, tokens_per_second,
-  positive_shard_count,
-  PositiveSlotCount, positive_slot_count, positive_measure_count,
-  positive_measure_count_value,
-  byte_size_count,
-}
-import extdeps.network.ipv4 { ipv4_address, render_ipv4_address }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv7, operator_host_srv8 }
-import gunbc.spark.cell_role { spark_serving_cell_hosts }
-import gunbc.spark.llama_cpp_rpc_observed {
-  llama_cpp_rpc_observed_fabric, llama_cpp_rpc_fabric_endpoint_on,
-  llama_cpp_rpc_front_door,
-  llama_cpp_rpc_weights_peer,
-  llama_cpp_rpc_slot_plan,
-  llama_cpp_rpc_construct,
-  llama_cpp_rpc_client_endpoint,
-  llama_cpp_rpc_peer_wire,
-  llama_cpp_rpc_slot_plan_total_kv,
-  llama_cpp_rpc_slot_plan_per_slot,
-  llama_cpp_rpc_observed,
-  llama_cpp_rpc_observed_units,
-  llama_cpp_rpc_observed_slot_plan,
-  llama_cpp_rpc_host_is_weights_peer,
-  llama_cpp_rpc_undischarged_peer_reservation_hosts,
-  llama_cpp_rpc_host_holds_undischarged_reservation,
-  llama_cpp_rpc_minted_peer_reservations, llama_cpp_rpc_host_has_release_receipt, llama_cpp_rpc_release_receipts,
-  ArtifactIdentityBound,
-  ArtifactIdentityUnobserved,
-  llama_cpp_rpc_observed_artifact,
-  llama_cpp_rpc_observed_shard_digests,
-  LlamaCppRpcShardDigest,
-  llama_cpp_rpc_shard_digest,
-  llama_cpp_rpc_bound_artifact_identity,
-  llama_cpp_rpc_observed_shard_count,
-  llama_cpp_rpc_observed_observation,
-  llama_cpp_rpc_observed_api_surface,
-  llama_cpp_rpc_artifact_is_bound,
-  llama_cpp_rpc_artifact,
-  llama_cpp_rpc_throughput_band,
-  llama_cpp_rpc_observed_throughput,
-}
-
-// THE POSITIVE CONTROL THAT EVERYTHING ELSE IN THIS FILE DEPENDS ON.
-//
-// llama_cpp_rpc_observed returns an Optional, and every claim below that matches on it would be
-// satisfied VACUOUSLY by Absent -- a file full of green claims about a deployment that never
-// constructed. That is the shape this corpus keeps finding and it is worth one claim of its own:
-// the observed deployment EXISTS, so the conditions in its constructor were all met by the measured
-// facts rather than merely not contradicted.
-test fn the_observed_llama_cpp_rpc_constructs() -> Bool {
-  match llama_cpp_rpc_observed() {
-    Present { value: _ } => true
-    Absent => false
-  }
-}
-
-// ONE ADDRESS A CLIENT MAY HOLD, and it is the front door. The peer has no sibling accessor, so
-// this is the only endpoint the model can hand anyone.
-test fn the_client_endpoint_is_the_front_door_only() -> Bool {
-  match llama_cpp_rpc_observed() {
-    Absent => false
-    Present { value: d } =>
-      llama_cpp_rpc_client_endpoint(d: d) == "http://192.168.1.232:30000"
-  }
-}
-
-// THE PEER IS ADDRESSED ON THE FABRIC, NOT THE LAN. The measured difference is 4.2 GB/min against
-// 144 GB/min -- 34x -- and nothing in the served behaviour distinguishes them, so this claim is the
-// only thing standing between the specified deployment and a working one that is silently slow.
-test fn the_rpc_peer_is_addressed_on_the_fabric() -> Bool {
-  match llama_cpp_rpc_observed() {
-    Absent => false
-    Present { value: d } =>
-      llama_cpp_rpc_peer_wire(d: d) == "192.168.100.11:50052"
-  }
-}
-
-// THE `-c` TRAP, ASSERTED AS THE DERIVATION IT NOW IS. The unit carries 10485760 because ten slots
-// each get 1048576 -- not because someone typed 10485760 next to a 10. The operator's table records
-// what the authored-pair version costs: -c 6291456 with --parallel 16 silently yields 2048 per slot.
-test fn the_total_kv_budget_is_derived_from_per_slot_and_slot_count() -> Bool {
-  token_count_value(t: llama_cpp_rpc_slot_plan_total_kv(plan: llama_cpp_rpc_observed_slot_plan)) == 10485760
-    && token_count_value(t: llama_cpp_rpc_slot_plan_per_slot(plan: llama_cpp_rpc_observed_slot_plan)) == 1048576
-}
-
-// A DISCRIMINATING RED: the silent shrink is now unwritable, because there is no second number to
-// disagree. Sixteen slots at the same per-slot window derives a LARGER total, never a smaller
-// per-slot window -- which is the exact inversion of the failure the operator recorded.
-test fn raising_the_slot_count_cannot_shrink_the_per_slot_window() -> Bool {
-  let wider = llama_cpp_rpc_slot_plan(
-    per_slot_context: token_count(count: 1048576),
-    slots: positive_slot_count(count: positive_measure_count(predecessor: 15)))
-  token_count_value(t: llama_cpp_rpc_slot_plan_per_slot(plan: wider)) == 1048576
-    && token_count_value(t: llama_cpp_rpc_slot_plan_total_kv(plan: wider)) == 16777216
-}
-
-// ================= DISCRIMINATING REDS ON THE CONSTRUCTOR =================
-
-// A SPLIT ACROSS ONE MACHINE IS NOT A SPLIT. It is one process addressing itself over a network
-// address, and it would report perfectly healthy.
-test fn a_deployment_whose_two_ends_are_one_host_refuses() -> Bool {
-  {
-    let link = llama_cpp_rpc_observed_fabric
-      match llama_cpp_rpc_fabric_endpoint_on(fabric: link, host: operator_host_srv8) {
-        Absent => false
-        Present { value: e } =>
-          match llama_cpp_rpc_construct(
-            served_alias: "x" as NonEmptyStr,
-            front_door: llama_cpp_rpc_front_door(
-              host: operator_host_srv8,
-              client_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 233),
-              port: 30000),
-            weights_peer: llama_cpp_rpc_weights_peer(
-              host: operator_host_srv8, fabric_address: e.address, port: 50052),
-            fabric: link,
-            slot_plan: llama_cpp_rpc_observed_slot_plan,
-          ) {
-            Absent => true
-            Present { value: _ } => false
-          }
-      }
-  }
-}
-
-// A PEER ADDRESSED OFF THE FABRIC REFUSES. This is the 34x claim as a wall: the deployment would
-// work, so no test of its behaviour could catch it.
-test fn a_peer_addressed_off_the_fabric_refuses() -> Bool {
-  {
-    let link = llama_cpp_rpc_observed_fabric
-      match llama_cpp_rpc_construct(
-        served_alias: "x" as NonEmptyStr,
-        front_door: llama_cpp_rpc_front_door(
-          host: operator_host_srv7,
-          client_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 232),
-          port: 30000),
-        weights_peer: llama_cpp_rpc_weights_peer(
-          host: operator_host_srv8,
-          fabric_address: ipv4_address(octet1: 192, octet2: 168, octet3: 1, octet4: 233),
-          port: 50052),
-        fabric: link,
-        slot_plan: llama_cpp_rpc_observed_slot_plan,
-      ) {
-        Absent => true
-        Present { value: _ } => false
-      }
-  }
-}
-
-// C1, ASKED AS A QUESTION A ROSTER CAN ANSWER. The host holding weights must never be published as
-// a serving endpoint by some OTHER roster that does not know this deployment exists -- which is
-// exactly how .233 would come to accept a load, given it also runs an unrelated ollama on :11434
-// with roughly 105 of 121 GiB already committed and swap disabled.
-test fn the_weights_peer_host_is_identifiable_as_one() -> Bool {
-  llama_cpp_rpc_host_is_weights_peer(
-    deployments: llama_cpp_rpc_observed_units(), host: operator_host_srv8)
-    && !llama_cpp_rpc_host_is_weights_peer(
-         deployments: llama_cpp_rpc_observed_units(), host: operator_host_srv7)
-}
-
-
-// THERE IS DELIBERATELY NO WITNESS THAT A THRESHOLD IS MET, because the predicate it would have
-// exercised has been deleted rather than fixed.
-//
-// It read the LOW end of the band, which is the fail-closed direction and is why it survived a first
-// review. That defence does not hold. The low end is the MINIMUM OF THE SAMPLES TAKEN SO FAR, not a
-// proven lower bound over the workloads this unit may meet: a deeper retained context or a different
-// context distribution could produce a rate below it, and the predicate would answer "meets" while
-// the service disappointed. Rounding down is fail-closed WITHIN the measured samples and says
-// nothing about the unmeasured population -- and the name promoted the former into the latter.
-//
-// The witness that used to stand here is the second half of the reason. Its only consumer was the
-// helper it tested, so it established that the helper reads its own low field and nothing else. No
-// actuator or selector was ever forced to consult it. A predicate with no production route, proved
-// only against itself, is specification-without-execution wearing a green check.
-//
-// An admissive floor belongs on a workload-qualified service profile -- one carrying occupancy,
-// incarnation and request shape -- and this carrier has none of those. Until it does, the honest
-// state is that the observation is published and NOTHING is authorised to admit against it.
-
-// A DISCRIMINATING RED: an inverted band has no constructor, so "low 59, high 50" -- the transcription
-// error that would silently invert every threshold comparison above -- cannot be authored.
-test fn an_inverted_throughput_band_refuses() -> Bool {
-  match llama_cpp_rpc_throughput_band(
-    slots: llama_cpp_rpc_observed_slot_plan.slots,
-    decode_low: tokens_per_second(count: 3),
-    decode_high: tokens_per_second(count: 2),
-    prefill: tokens_per_second(count: 14),
-  ) {
-    Absent => true
-    Present { value: _ } => false
-  }
-}
-
-
-// THE INTERLOCK IS A RESERVATION, NOT A CURRENT PROCESS CENSUS, AND THE NAME USED TO SAY OTHERWISE.
-//
-// This claim was called `no_serving_cell_is_also_a_weights_peer`, which asserts that the reserved
-// host IS CURRENTLY the weights peer. Nothing establishes that. The dated observation says it WAS
-// one; the current process topology of that host is UNOBSERVED, and a boolean named for a census it
-// never performed is the same absence-as-fact error this module keeps having to unlearn -- once when
-// a peer's report stood in for a readback, and once here in the opposite direction.
-//
-// WHAT IS ENFORCED IS THE RESERVATION'S LIFECYCLE. A positive observation minted it; only a positive
-// release receipt clears it; not looking again is not a release. So the refusal does not need to
-// prove the host is still a participant. It needs to refuse the one dangerous inference -- "we did
-// not re-observe the peer, therefore the host is free" -- and that is exactly what it refuses.
-//
-// FRONT-DOOR LIVENESS IS DELIBERATELY NOT A CONDITION OF THIS CLAIM. Making it one would read as
-// prudence and be FAIL-OPEN: a transient outage would dissolve the hold while the peer's process, its
-// boot-enabled unit, its memory commitment and its restart path all survived it untouched. The
-// reservation outlives the front door by construction.
-//
-// WHAT THE 2026-09-03 READBACK ADDS IS URGENCY AND CONTINUITY, NOT THE JOIN. Measured against the
-// live service: 192.168.1.232:30000 answers /v1/models with owned_by "llamacpp" at ftype
-// "IQ3_S - 3.4375 bpw", /props reports total_slots 10 with per-slot n_ctx 1048576 on all ten and
-// is_sleeping false, /slots showed 2 of 10 processing at the read instant, and /version answers 404.
-// So a matching front door is live and carrying work. That corroborates the danger and it does NOT
-// join the reserved host into the current topology -- and "2 processing" is work at ONE INSTANT, not
-// continuous load, not an owner, and not a queue depth.
-//
-// THE HAZARD IS STATED AT THE STRENGTH THE EVIDENCE SUPPORTS. 192.168.1.233:11434 answers /api/tags
-// with deepseek-v4-gguf:no-h3-stop at 86720111694 bytes, IQ2_XXS, so an actuation path to an 86 GB
-// artifact EXISTS on the reserved host and is exactly what the serving-cell roster selects. Whether
-// loading it would certainly OOM today is NOT established -- that needs a current memory census and
-// current peer residency, neither of which was observed. The honest form: loading it is potentially
-// catastrophic under the last observed internal-participant and memory state, and current evidence
-// has not discharged that risk. Refusing does not require converting an unresolved catastrophic risk
-// into a falsely certain claim about today.
-//
-// THE RULE IS DISJOINTNESS BETWEEN TWO ROSTERS, NOT A NAMED HOST. Nothing here says "srv8 may never
-// serve". It says a host carrying an undischarged internal-participant reservation may not enter an
-// independent serving roster, which stays the right rule under any partition and dissolves the
-// moment a release receipt exists.
-//
-// THE NON-EMPTINESS CONJUNCT IS NOT DECORATION. `any` over an empty list is false and its negation is
-// true, so the disjointness half alone goes GREEN when no reservation exists -- a wall reporting that
-// nothing collides because nothing is reserved.
-test fn no_serving_cell_uses_an_undischarged_llama_cpp_rpc_peer_reservation() -> Bool {
-  length(llama_cpp_rpc_minted_peer_reservations()) > 0
-    && all(llama_cpp_rpc_minted_peer_reservations(), r => llama_cpp_rpc_host_has_release_receipt(host: r.host))
-    && length(llama_cpp_rpc_undischarged_peer_reservation_hosts()) == 0
-    && !any(spark_serving_cell_hosts(), h =>
-         llama_cpp_rpc_host_holds_undischarged_reservation(host: h))
-}
-
-// THE RELEASE IS A RECEIPT WITH THE NAMED EVIDENCE, NOT A FLAG: the reserved host's receipt states
-// its process population, supervisor units, listeners and memory, each non-empty, and the receipt
-// clears exactly that host.
-test fn the_release_receipt_names_its_evidence_and_clears_only_its_host() -> Bool {
-  length(llama_cpp_rpc_release_receipts) == 2
-    && any(llama_cpp_rpc_release_receipts, r => host_identity_eq(a: r.host, b: operator_host_srv8) && string_contains(s: r.rpc_server_processes as String, pattern: "none") && string_contains(s: r.memory_state as String, pattern: "GB used"))
-    && llama_cpp_rpc_host_has_release_receipt(host: operator_host_srv8)
-    && !llama_cpp_rpc_host_has_release_receipt(host: operator_host_srv5)
-}
-
-
-// THE ARTIFACT IDENTITY IS BOUND, established by hashing the four shards in place on the front-door
-// host. This is also the positive control for every refusal below: without it they could all be
-// satisfied by a constructor that refuses everything.
-test fn the_observed_artifact_identity_is_bound() -> Bool {
-  match llama_cpp_rpc_observed_artifact() {
-    Absent => false
-    Present { value: a } =>
-      llama_cpp_rpc_artifact_is_bound(a: a) && length(llama_cpp_rpc_observed_shard_digests()) == 4
-  }
-}
-
-// A DISCRIMINATING RED, AND IT IS THE COUNT-VERSUS-COVERAGE CLASS. "Bound" once meant the digest
-// list was non-empty, so an artifact of four shards carrying ONE digest answered true -- a closure
-// naming a quarter of the bytes, reported as a fully identified artifact.
-//
-// THE REFUSAL NOW HAPPENS AT CONSTRUCTION, which is what this claim actually asserts: there is no
-// inexact Bound value to hand to a predicate, because minting one from a short chain yields Absent.
-test fn a_short_chain_mints_no_bound_identity() -> Bool {
-  match llama_cpp_rpc_bound_artifact_identity(
-    shards: fx_shard_chain(n: 1),
-    shard_count: positive_shard_count(count: positive_measure_count(predecessor: 3))) {
-    Present { value: _ } => false
-    Absent => true
-  }
-}
-
-// One well-formed shard digest per ordinal 1..n, so a fixture can vary the CHAIN without varying
-// digest validity -- the two conditions the bound arm now carries are then independently testable.
-fn fx_shard_chain(n: Int) -> List<LlamaCppRpcShardDigest> {
-  flat_map([1, 2, 3, 4], i =>
-    if i <= n {
-      match llama_cpp_rpc_shard_digest(
-        ordinal: positive_measure_count(predecessor: i - 1), hex: fx_digest_hex) {
-        Present { value: v } => [v]
-        Absent => []
-      }
-    } else {
-      []
-    })
-}
-
-data fx_digest_hex: String = "1111111111111111111111111111111111111111111111111111111111111111"
-
-// A DISCRIMINATING RED ON THE OTHER HALF OF EXACTNESS: right cardinality, wrong chain. Four digests
-// whose ordinals are 1,1,2,3 name a shard set that does not exist, and a length check alone reports
-// them as a fully bound artifact. This is the claim that would go green if the ordinal walk were
-// removed and the count check left standing.
-test fn a_repeated_ordinal_chain_mints_no_bound_identity() -> Bool {
-  match llama_cpp_rpc_bound_artifact_identity(
-    shards: fx_repeated_chain(),
-    shard_count: positive_shard_count(count: positive_measure_count(predecessor: 3))) {
-    Present { value: _ } => false
-    Absent => true
-  }
-}
-
-fn fx_repeated_chain() -> List<LlamaCppRpcShardDigest> {
-  flat_map([0, 0, 1, 2], pred =>
-    match llama_cpp_rpc_shard_digest(
-      ordinal: positive_measure_count(predecessor: pred), hex: fx_digest_hex) {
-      Present { value: v } => [v]
-      Absent => []
-    })
-}
-
-// A DIGEST IS A TYPED CONTENT HASH, SO A NON-HASH HAS NO CONSTRUCTOR. "banana" is what the previous
-// NonEmptyStr carrier accepted as a shard identity; it now yields no ShardDigest at all, which is
-// why the chain above cannot be assembled from it in the first place.
-test fn a_shard_digest_refuses_a_value_that_is_not_a_sha256_hex() -> Bool {
-  match llama_cpp_rpc_shard_digest(
-    ordinal: positive_measure_count(predecessor: 0), hex: "banana") {
-    Present { value: _ } => false
-    Absent => true
-  }
-}
-
-// POSITIVE CONTROL FOR THE TWO REDS ABOVE: the well-formed four-shard chain DOES mint an identity,
-// so the refusals discriminate rather than being a constructor that refuses everything.
-test fn a_well_formed_four_shard_chain_mints_a_bound_identity() -> Bool {
-  match llama_cpp_rpc_bound_artifact_identity(
-    shards: fx_shard_chain(n: 4),
-    shard_count: positive_shard_count(count: positive_measure_count(predecessor: 3))) {
-    Present { value: _ } => true
-    Absent => false
-  }
-}
-
-// AND THE ARTIFACT REFUSES A SHARD COUNT ITS OWN BOUND IDENTITY CONTRADICTS. Without this the record
-// could carry an exact four-shard identity beside a declared count of two, and the identity's
-// guarantee would be silently void while every part looked individually valid.
-test fn an_artifact_refuses_a_count_its_identity_contradicts() -> Bool {
-  match llama_cpp_rpc_bound_artifact_identity(
-    shards: fx_shard_chain(n: 4),
-    shard_count: positive_shard_count(count: positive_measure_count(predecessor: 3))) {
-    Absent => false
-    Present { value: bound } =>
-      match llama_cpp_rpc_artifact(
-        primary_shard_path: "/fixture/shard-00001.gguf" as NonEmptyStr,
-        shard_count: positive_shard_count(count: positive_measure_count(predecessor: 1)),
-        identity: ArtifactIdentityBound { identity: bound }) {
-        Present { value: _ } => false
-        Absent => true
-      }
-  }
-}
-
-// THE FRONT DOOR AND THE PEER MAY NOT BE THE SAME PORT ON THE SAME ADDRESS -- the fourth constructor
-// condition, which was CLAIMED in the module annotation before it was enforced. This claim is the
-// executed evidence that it is now real; it went green vacuously before the guard landed only
-// because the string carrier could not compare addresses at all.
-test fn a_unit_whose_ends_share_an_address_and_port_has_no_constructor() -> Bool {
-  {
-    let link = llama_cpp_rpc_observed_fabric
-      match llama_cpp_rpc_fabric_endpoint_on(fabric: link, host: operator_host_srv8) {
-        Absent => false
-        Present { value: e } =>
-          match llama_cpp_rpc_construct(
-            served_alias: "fixture" as NonEmptyStr,
-            front_door: llama_cpp_rpc_front_door(
-              host: operator_host_srv7, client_address: e.address, port: 50052),
-            weights_peer: llama_cpp_rpc_weights_peer(
-              host: operator_host_srv8, fabric_address: e.address, port: 50052),
-            fabric: link,
-            slot_plan: llama_cpp_rpc_observed_slot_plan,
-          ) {
-            Present { value: _ } => false
-            Absent => true
-          }
-      }
-  }
-}
-
-// THE CLAIM THAT USED TO SIT HERE ASSERTED THE MIXER REFUSED A BAND FROM A DIFFERENT SLOT COUNT.
-// The mixer is gone -- it admitted observations drawn from different realizations, which is the
-// failure the type names, so a slot-count agreement was not the condition that closed it. With only
-// the module's own observation constructible, that RED has no authorable subject, and a claim whose
-// forbidden state cannot be written is decoration rather than a weak wall. It is removed rather than
-// left permanently green; the trigger that restores it is the realization identity the module's
-// annotation names, which needs a second realization to discriminate.
-
-// POSITIVE CONTROL FOR THE JOIN: the observation of 2026-09-02 constructs, so the refusal above is
-// discriminating and every claim reading the join is non-vacuous.
-test fn the_observed_realization_joins_into_one_observation() -> Bool {
-  match llama_cpp_rpc_observed_observation() {
-    Present { value: _ } => true
-    Absent => false
-  }
-}
-
-// An unobserved identity is never bound, whatever else the record carries. The unobserved arm still
-// CONSTRUCTS -- observation standing permits an artifact whose bytes were never hashed; what it does
-// not permit is calling that artifact identified.
-test fn an_unobserved_artifact_identity_is_not_bound() -> Bool {
-  match llama_cpp_rpc_artifact(
-    primary_shard_path: "/fixture/shard-00001.gguf" as NonEmptyStr,
-    shard_count: positive_shard_count(count: positive_measure_count(predecessor: 0)),
-    identity: ArtifactIdentityUnobserved { cause: "fixture" as NonEmptyStr }) {
-    Absent => false
-    Present { value: a } => !llama_cpp_rpc_artifact_is_bound(a: a)
-  }
-}
-
-
-// THE SNAPSHOT RAIL IS THE RAIL THE OBSERVATION USED. The module carries the 2026-09-02 direct-cable
-// rail as its own dated value now that the desired fabric has moved to the switch; this pins every
-// field the constructor conditions were checked against, so an edit to the snapshot is an edit to
-// history and shows here.
-test fn the_snapshot_rail_carries_every_field_the_observation_was_checked_against() -> Bool {
-  {
-    let link = llama_cpp_rpc_observed_fabric
-      match llama_cpp_rpc_fabric_endpoint_on(fabric: link, host: operator_host_srv8) {
-        Absent => false
-        Present { value: peer } =>
-          match llama_cpp_rpc_fabric_endpoint_on(fabric: link, host: operator_host_srv7) {
-            Absent => false
-            Present { value: door } =>
-              render_ipv4_address(addr: peer.address) == "192.168.100.11"
-                && render_ipv4_address(addr: door.address) == "192.168.100.10"
-                && (peer.interface as String) == "enp1s0f0np0"
-                && (door.interface as String) == "enp1s0f0np0"
-                && peer.prefix == 24
-                && door.prefix == 24
-                && byte_size_count(b: peer.mtu) == 9000
-                && byte_size_count(b: door.mtu) == 9000
-          }
-      }
-  }
-}
diff --git a/dag/test/claim/spark/spark_oobe_execution_placement_witness_test.dag b/dag/test/claim/spark/spark_oobe_execution_placement_witness_test.dag
index ac5632fd55c..a56787439d2 100644
--- a/dag/test/claim/spark/spark_oobe_execution_placement_witness_test.dag
+++ b/dag/test/claim/spark/spark_oobe_execution_placement_witness_test.dag
@@ -8,7 +8,7 @@ import extdeps.network.endpoint { NetworkHost, HostByName, HostByAddress, render
 import extdeps.toolchain.types { Architecture, Aarch64 }
 import extdeps.automation.playwright { PlaywrightBuild, playwright_1_62_1 }
 import product.host_identity { HostIdentity }
-import gunbc.fleet_host_identity { operator_host_srv4, operator_host_srv7 }
+import gunbc.fleet_host_identity { operator_host_srv4, operator_host_srv10 }
 import extdeps.ssh.openssh_port_forwarding {
   ForwardingAdmission,
   ForwardingAdmitted,
@@ -165,12 +165,12 @@ test fn w_the_participant_gap_is_the_unratified_relay_identity() -> Bool {
 // refusal is attributable to the allocation and to nothing else.
 test fn w_the_same_relay_with_an_allocated_identity_has_complete_evidence() -> Bool {
   match relay_assessment(obs: RadioAssociated {
-    machine: FleetAllocatedMachine { host: operator_host_srv7 },
+    machine: FleetAllocatedMachine { host: operator_host_srv10 },
     radio_interface: "wlan0" as RadioInterfaceName,
     associated_ssid: "spark-0c75" as ObservedUnitAccessPointSsid,
   }) {
     RelayMeetsRequirements { host: h, radio_interface: _, associated_ssid: ssid } =>
-      h == operator_host_srv7 && ssid == "spark-0c75"
+      h == operator_host_srv10 && ssid == "spark-0c75"
     RelayAssessmentDeclined { cause: _ } => false
   }
 }
diff --git a/dag/test/claim/spark/spark_pair_head_unit_digest_witness_test.dag b/dag/test/claim/spark/spark_pair_head_unit_digest_witness_test.dag
index eb44f9a6ca9..17a295a480e 100644
--- a/dag/test/claim/spark/spark_pair_head_unit_digest_witness_test.dag
+++ b/dag/test/claim/spark/spark_pair_head_unit_digest_witness_test.dag
@@ -5,13 +5,13 @@ import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import std.content_hash {
   compare_content_hash, ContentHashEqual, ContentHashDifferent, ContentHashCrossFamilyIncomparable,
 }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import gunbc.spark.pair_serving_realization {
   SparkPairUnitRender, SparkPairUnitRendered,
   RenderedUnitDigestStanding, RenderedUnitDigested, RenderedUnitDigestUnavailable,
   DeclaredUnitDigested, DeclaredUnitDigestUnavailable,
   spark_pair_rendered_unit_digest, spark_pair_declared_head_digest,
-  spark_pair_head_unit_render_for_group, spark_pair_head_unit_name,
+  declared_head_unit_render_for_group, spark_pair_head_unit_name,
 }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
@@ -24,7 +24,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 //
 // TWO PROPOSITIONS, TWO SETS OF ROWS, MATCHING THE PRODUCTION SPLIT. The byte-level rows below
 // drive spark_pair_rendered_unit_digest, whose result is UNSEALED -- they supply fixture bytes, so
-// there is nothing to protect and no seal to bypass. The Group A row drives
+// there is nothing to protect and no seal to bypass. The group B row drives
 // spark_pair_declared_head_digest, the corpus's only constructor of DeclaredUnitDigestEvidence,
 // which takes a modeled group and renders from the production declaration. THIS FILE CANNOT MINT
 // SEALED EVIDENCE OVER BYTES OF ITS OWN, and that is the point rather than a limitation.
@@ -75,19 +75,19 @@ test fn unit_text_differing_by_one_byte_gives_a_different_digest() -> Bool {
   }
 }
 
-// THE PRODUCTION GROUP-A PRODUCER, EXECUTED. spark_pair_declared_head_digest renders the head unit
-// from the CURRENT declarations and digests exactly those bytes -- no store, no receipt, no
-// currency check. This is the function harness_bind_seat calls once per bind, so deleting the
-// render-to-DigestStdin wire inside it turns this row red.
+// THE PRODUCTION GROUP-LEVEL PRODUCER, EXECUTED. spark_pair_declared_head_digest renders group B's
+// declared head unit from the CURRENT declarations and digests exactly those bytes -- no store, no
+// receipt, no currency check. This is the function harness_bind_seat calls once per bind, so deleting
+// the render-to-DigestStdin wire inside it turns this row red.
 //
-// AND IT IS THE SAME BYTES: re-digesting the group's render through the supplied-input mint above
-// must agree with what the group-level producer returned. RED if the group producer ever digested
-// something other than the unit text it renders.
+// AND IT IS THE SAME BYTES: re-digesting the group's declared render through the supplied-input mint
+// above must agree with what the group-level producer returned. RED if the group producer ever
+// digested something other than the unit text it renders.
 test fn spark_pair_head_unit_declared_digest_hashes_the_realized_head_unit() -> Bool {
-  match spark_pair_declared_head_digest(group: FabricGroupA) {
+  match spark_pair_declared_head_digest(group: FabricGroupB {}) {
     DeclaredUnitDigestUnavailable { obligation: _ } => false
     DeclaredUnitDigested { evidence: e } =>
-      match spark_pair_rendered_unit_digest(render: spark_pair_head_unit_render_for_group(group: FabricGroupA)) {
+      match spark_pair_rendered_unit_digest(render: declared_head_unit_render_for_group(group: FabricGroupB {})) {
         RenderedUnitDigestUnavailable { obligation: _ } => false
         RenderedUnitDigested { unit_name: _, digest: again } =>
           match compare_content_hash(left: e.digest, right: again) {
diff --git a/dag/test/claim/spark/spark_pair_serving_apply_witness_test.dag b/dag/test/claim/spark/spark_pair_serving_apply_witness_test.dag
index 4b29f1e73d5..059caf0cd86 100644
--- a/dag/test/claim/spark/spark_pair_serving_apply_witness_test.dag
+++ b/dag/test/claim/spark/spark_pair_serving_apply_witness_test.dag
@@ -1,29 +1,35 @@
 module test.claim.spark.spark_pair_serving_apply_witness
 
-import std.types { Bool, List, NonEmptyStr, String, EpochSecs }
+import std.types { Bool, List, NonEmptyStr, String }
 import product.host_identity { host_identity_eq }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8 }
-import gunbc.spark.pair_serving_realization { spark_pair_realizations }
+import gunbc.spark.pair_serving_realization { SparkPairRealization, spark_pair_realization }
+import gunbc.spark.pair_serving_desired { spark_pair_serving_unit }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
+import gunbc.fleet_host_identity { operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
 import gunbc.spark.pair_serving_apply {
   SparkPairApplyPlan, SparkPairApplyPlanned, SparkPairApplyRefused, SparkPairHostApplyPlan,
-  spark_pair_apply_plan_current, spark_pair_apply_plans_current, spark_pair_apply_plan_refusals, spark_pair_apply_plans,
+  spark_pair_apply_plan_current, spark_pair_apply_plan_refusals,
 }
-import gunbc.spark.pair_serving_authority { spark_pair_serving_authorities, pair_serving_authority_group }
+import gunbc.spark.pair_serving_authority { PairServingGroupAuthority, PairServingActive, PairRealizationUnestablished }
 import gunbc.spark.pair_serving_authority_log { CurrentAuthority, CurrentAuthorityRead, CurrentAuthorityUnread, AuthorityTransitionRecord }
 import product.capacity.event_chain { HeadAbsent }
 
-// THE CURRENT AUTHORITY IS SUPPLIED: the resting row of every claimed group at generation 0, which
-// is exactly what the log folds to when no transition has been recorded. The log READ is
-// exercised by the supplied-host claim at the end of this file.
+// THE CURRENT AUTHORITY AND THE REALIZATION ARE SUPPLIED. No group is claimed by pair serving since
+// Group A's decommission, so the production roster is empty; these claims build the realization for
+// FabricGroupB directly and supply an active resting authority for it at generation 0, which is what
+// the log folds to when no transition has been recorded.
+data w_authority: PairServingGroupAuthority = PairServingActive { group: FabricGroupB {}, exact_realization: PairRealizationUnestablished { obligation: "witness: no content-addressed key for the supplied realization" as NonEmptyStr } }
+
 fn w_current() -> List<CurrentAuthority> {
-  map(spark_pair_serving_authorities, a => CurrentAuthorityRead { authority: a, head: HeadAbsent, generation: 0, grant: none, entry_state: none, previous: none, admitted_by: none, transitions: [] as List<AuthorityTransitionRecord> })
+  [CurrentAuthorityRead { authority: w_authority, head: HeadAbsent, generation: 0, grant: none, entry_state: none, previous: none, admitted_by: none, transitions: [] as List<AuthorityTransitionRecord> }]
+}
+
+fn w_realization() -> SparkPairRealization {
+  spark_pair_realization(unit: spark_pair_serving_unit(group: FabricGroupB {}))
 }
 
 fn w_plan() -> SparkPairApplyPlan {
-  match first(spark_pair_realizations()) {
-    Absent => SparkPairApplyRefused { cause: "no realization" }
-    Present { value: r } => spark_pair_apply_plan_current(r: r, current: w_current())
-  }
+  spark_pair_apply_plan_current(r: w_realization(), current: w_current())
 }
 
 fn w_planned(f: fn(List<SparkPairHostApplyPlan>, SparkPairHostApplyPlan) -> Bool) -> Bool {
@@ -33,13 +39,13 @@ fn w_planned(f: fn(List<SparkPairHostApplyPlan>, SparkPairHostApplyPlan) -> Bool
   }
 }
 
-// THE WORKERS ARE APPLIED ON srv5, srv8 AND srv7 AND THE HEAD ON srv6, each script beginning with
+// THE WORKERS ARE APPLIED ON srv10, srv11 AND srv12 AND THE HEAD ON srv9, each script beginning with
 // set -e and ending by enabling and reading back the rendered unit, and each retiring exactly its own
 // hand-authored predecessor and the old container.
 test fn the_plan_applies_workers_then_head_with_each_retiring_its_own_predecessor() -> Bool {
   w_planned(f: fn(ws, h) {
-    length(ws) == 3 && host_identity_eq(a: h.host, b: operator_host_srv6)
-      && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv5)) && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv7)) && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv8))
+    length(ws) == 3 && host_identity_eq(a: h.host, b: operator_host_srv9)
+      && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv10)) && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv11)) && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv12))
       && all(ws, w => starts_with(s: w.script, prefix: "set -e\n")) && starts_with(s: h.script, prefix: "set -e\n")
       && all(ws, w => string_contains(s: w.script, pattern: "systemctl disable --now spark-ray-worker.service") && !string_contains(s: w.script, pattern: "spark-vllm.service"))
       && string_contains(s: h.script, pattern: "systemctl disable --now spark-vllm.service")
@@ -66,47 +72,13 @@ test fn the_script_is_made_of_the_rendered_argv_and_carries_the_cache_over() ->
   })
 }
 
-// EVERY CLAIMED GROUP PLANS AND NONE REFUSES: one plan per authority row, so one apply carries
-// the whole claimed roster. The roster is the authority population -- Group A alone since the
-// membership became a projection of gunbc.spark.pair_serving_authority (#11501) -- and this claim
-// reads its expected count from that population rather than from a literal, so an earlier
-// spelling that named a second group headed by srv9 with srv12 was measuring a roster that no
-// longer exists. The head-and-workers shape of the one plan is the claim above.
-test fn every_claimed_group_plans_and_none_refuses() -> Bool {
-  let plans = spark_pair_apply_plans_current(current: w_current())
-  length(plans) == length(spark_pair_serving_authorities) && length(plans) >= 1
-    && length(spark_pair_apply_plan_refusals(plans: plans)) == 0
-}
-
-// RED -- AN UNREADABLE AUTHORITY IS NEVER PLANNED FROM THE RESTING ROW. The supplied roster says the
-// log could not be read for the claimed group; the plan for that group is a refusal carrying the
-// read's cause, and nothing renders. Folding the unread arm back onto the source row would plan
-// the incumbent here and turn this red.
+// RED -- AN UNREADABLE AUTHORITY IS NEVER PLANNED FROM THE RESTING ROW. The supplied current says the
+// log could not be read for the group; the plan is a refusal carrying the read's cause, and nothing
+// renders. Folding the unread arm back onto the source row would plan the incumbent here and turn
+// this red.
 test fn an_unread_authority_refuses_the_plan_with_the_reads_cause() -> Bool {
-  let unread = map(spark_pair_serving_authorities, a => CurrentAuthorityUnread { group: pair_serving_authority_group(a: a), step: "fetch" as String, reason: "witness: the partition could not be fetched" as String })
-  let plans = spark_pair_apply_plans_current(current: unread)
-  let refusals = spark_pair_apply_plan_refusals(plans: plans)
-  length(plans) == length(spark_pair_serving_authorities) && length(plans) >= 1
-    && length(refusals) == length(plans)
+  let unread = [CurrentAuthorityUnread { group: FabricGroupB {}, step: "fetch" as String, reason: "witness: the partition could not be fetched" as String }]
+  let refusals = spark_pair_apply_plan_refusals(plans: [spark_pair_apply_plan_current(r: w_realization(), current: unread)])
+  length(refusals) == 1
     && all(refusals, r => string_contains(s: r, pattern: "the serving authority could not be read") && string_contains(s: r, pattern: "witness: the partition could not be fetched"))
 }
-
-// THE OFF-FLEET PREMISE IS SUPPLIED, NOT READ FROM THE RUNNER. spark_pair_apply_plans resolves the
-// executor's event log layout and reads every claimed group's authority from the log before
-// planning anything. The executor and instant are supplied, so the verdict does not depend on which
-// runner executes it (gunbc.recurring_failure_mode wet_witness_premise_read_from_the_runner_it_happens_to_land_on).
-// The store resolution and the refusal that NAMES THE READ run for real, and nothing is planned
-// from the resting row. Deleting the log read, or letting an unreadable log fall back to the row,
-// turns these refusals into plans and this claim red.
-data witness_host_declaring_no_dashboard_instance: String = "gunbc-witness-host-without-dashboard-instance"
-data witness_instant: EpochSecs = 1000
-
-test fn the_apply_seam_reads_the_authority_before_planning_and_refuses_off_fleet() -> Bool {
-  let plans = spark_pair_apply_plans(executor: witness_host_declaring_no_dashboard_instance, at: witness_instant)
-  let refusals = spark_pair_apply_plan_refusals(plans: plans)
-  length(plans) > 0
-    && length(plans) == length(spark_pair_serving_authorities)
-    && length(refusals) == length(plans)
-    && all(refusals, r => string_contains(s: r, pattern: "the serving authority could not be read")
-      && string_contains(s: r, pattern: witness_host_declaring_no_dashboard_instance))
-}
diff --git a/dag/test/claim/spark/spark_pair_serving_desired_witness_test.dag b/dag/test/claim/spark/spark_pair_serving_desired_witness_test.dag
index d741d646d23..7a4f966e928 100644
--- a/dag/test/claim/spark/spark_pair_serving_desired_witness_test.dag
+++ b/dag/test/claim/spark/spark_pair_serving_desired_witness_test.dag
@@ -16,16 +16,16 @@ import extdeps.deepseek.deepseek_v4 { deepseek_v4_context_length }
 import gunbc.spark.pair_serving_realization { spark_pair_vllm_serve_argv }
 import gunbc.spark.model_snapshot_acquisition { deepseek_v4_flash_snapshot }
 import gunbc.spark.serving_engine { VllmServing, OllamaServing }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, operator_host_srv9 }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB }
+import gunbc.fleet_host_identity { operator_host_srv9, operator_host_srv10, operator_host_srv11, operator_host_srv12 }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup, fabric_group_wire }
 import gunbc.spark.fabric_rail_desired { fabric_rail_address }
 import gunbc.spark.pair_serving_desired {
   spark_pair_serving_engine_args,
   spark_pair_serving_unit, spark_pair_serving_unit_with,
   SparkPairServingUnit, SparkPairServingUnitReady, SparkPairServingUnitRefused,
   SparkPairServingSeqCapacity, SeqCapacityMeasured, SeqCapacityUnmeasured, SeqCapacityByOperatorPolicy,
-  spark_pair_serving_seq_capacity, spark_pair_serving_seq_capacity_for, spark_pair_serving_groups, spark_pair_serving_desired_hosts,
-  spark_pair_serving_unit_wire,
+  spark_pair_serving_seq_capacity, spark_pair_serving_seq_capacity_for,
+  spark_pair_serving_unit_wire, spark_pair_serving_groups,
 }
 
 // THE RENDERED LINE IS REACHED THROUGH THE DECLARED SNAPSHOT, because that is what the renderer now
@@ -102,7 +102,7 @@ fn w_refused_naming(unit: SparkPairServingUnit, fragment: String) -> Bool {
 // though it is not the live state: it is the wall against a group that has neither a measurement nor
 // an operator choice.
 test fn an_unmeasured_pool_refuses_the_unit_for_that_reason_alone() -> Bool {
-  w_refused_naming(unit: spark_pair_serving_unit_with(group: FabricGroupA, capacity: SeqCapacityUnmeasured), fragment: "max-num-seqs")
+  w_refused_naming(unit: spark_pair_serving_unit_with(group: FabricGroupB {}, capacity: SeqCapacityUnmeasured), fragment: "max-num-seqs")
 }
 
 // THE LIVE COUNT IS A CHOSEN LAUNCH ARGUMENT. Dressing `--max-num-seqs` as SeqCapacityMeasured would
@@ -120,57 +120,41 @@ test fn the_live_sequence_count_is_an_operator_launch_argument() -> Bool {
   }
 }
 
-// THE GROUPS ARE LAUNCHABLE, which is the property an over-corrected revision of this branch
-// destroyed by answering Unmeasured: the unit refused, the realization refused, the apply plan
-// refused, and no engine could ever start to produce the launch line a measurement needs.
-test fn the_promoted_group_is_launchable() -> Bool {
-  match spark_pair_serving_unit(group: FabricGroupA) {
+// NO GROUP IS PROMOTED, AND THAT IS ASSERTED RATHER THAN LEFT VACUOUS: the roster's only group was Group A,
+// decommissioned and sold on 2026-10-07, so the projection is empty -- and Group B, which serves the GLM
+// native canary, is not laundered into it.
+test fn no_group_is_promoted_and_group_b_is_not_in_the_roster() -> Bool {
+  length(spark_pair_serving_groups) == 0
+    && !any(spark_pair_serving_groups, g => (fabric_group_wire(g: g) as String) == "group-b")
+}
+
+// THE UNIT CONSTRUCTOR IS LAUNCHABLE OVER A SUPPLIED GROUP -- a property of spark_pair_serving_unit, not a
+// claim that Group B is promoted (no group is: see the claim above). It is the property an over-corrected
+// revision destroyed by answering Unmeasured: the unit refused and no engine could ever start.
+test fn the_pair_unit_is_launchable_over_a_supplied_group() -> Bool {
+  match spark_pair_serving_unit(group: FabricGroupB {}) {
     SparkPairServingUnitReady { group: _, engine: _, head: _, workers: _ } => true
     SparkPairServingUnitRefused { group: _, cause: _ } => false
   }
 }
 
-// GROUP A IS srv6 AT THE HEAD WITH srv5, srv7 AND srv8 AS WORKERS, EVERY RANK AT ITS RAIL ADDRESS,
-// tensor-parallel four, and the engine is vLLM.
-test fn group_a_is_four_ranks_headed_by_srv6_at_their_rail_addresses() -> Bool {
-  match spark_pair_serving_unit(group: FabricGroupA) {
+// OVER A SUPPLIED GROUP B (not a promoted one), THE UNIT IS srv9 AT THE HEAD WITH srv10, srv11 AND srv12 AS
+// WORKERS, EVERY RANK AT ITS RAIL ADDRESS, tensor-parallel four, and the engine is vLLM.
+test fn a_supplied_group_b_unit_is_four_ranks_headed_by_srv9_at_their_rail_addresses() -> Bool {
+  match spark_pair_serving_unit(group: FabricGroupB {}) {
     SparkPairServingUnitRefused { group: _, cause: _ } => false
     SparkPairServingUnitReady { group: _, engine: e, head: h, workers: ws } =>
-      host_identity_eq(a: h.host, b: operator_host_srv6)
+      host_identity_eq(a: h.host, b: operator_host_srv9)
         && length(ws) == 3
-        && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv5)) && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv7)) && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv8))
+        && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv10)) && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv11)) && any(ws, w => host_identity_eq(a: w.host, b: operator_host_srv12))
         && (match e { VllmServing { args: a } => a.tensor_parallel_size == 4  OllamaServing { profile: _ } => false })
         && (match fabric_rail_address(host: h.host) { Present { value: a } => ipv4_address_eq(a: a, b: h.host_ip)  Absent => false })
         && all(ws, w => match fabric_rail_address(host: w.host) { Present { value: a } => ipv4_address_eq(a: a, b: w.host_ip)  Absent => false })
   }
 }
 
-// EACH GROUP HAS EXACTLY ONE OWNER, AND THIS WITNESS ASSERTED BOTH BELONGED TO DEEPSEEK PRODUCTION.
-// It required two promoted groups and all eight fabric hosts in the desired projection, which was
-// true when written and stopped being true when group B was withdrawn for the GLM canary. A roster
-// witness that outlives the roster it describes is the same defect as an annotation that outlives its
-// declaration: it keeps asserting a fact nobody holds any more, and it is CI rather than a reader that
-// finds out.
-//
-// THE OWNERSHIP IT NOW ASSERTS: group A is DeepSeek production and reaches the desired hosts; group B
-// is NOT in that projection, because it is reserved for the canary. That group B still RESOLVES to a
-// ready unit when asked directly is a separate fact and deliberately left alone -- the unit function
-// is total, and its arm being reachable is not the same as the roster claiming it.
-test fn group_a_is_the_only_promoted_group_and_group_b_is_not_in_the_projection() -> Bool {
-  length(spark_pair_serving_groups) == 1
-    && length(spark_pair_serving_desired_hosts()) == 4
-    && any(spark_pair_serving_desired_hosts(), h => host_identity_eq(a: h, b: operator_host_srv6))
-    && !any(spark_pair_serving_desired_hosts(), h => host_identity_eq(a: h, b: operator_host_srv9))
-}
-
 test fn the_group_b_wire_names_srv9_at_its_rail_address() -> Bool {
-  let w = spark_pair_serving_unit_wire(unit: spark_pair_serving_unit(group: FabricGroupB))
+  let w = spark_pair_serving_unit_wire(unit: spark_pair_serving_unit(group: FabricGroupB {}))
   string_contains(s: w, pattern: "group group-b tp=4 head=srv9@192.168.110.17 workers=")
     && string_contains(s: w, pattern: "srv12@192.168.110.16")
 }
-
-test fn the_wire_names_the_group_its_degree_and_every_rank() -> Bool {
-  let w = spark_pair_serving_unit_wire(unit: spark_pair_serving_unit(group: FabricGroupA))
-  string_contains(s: w, pattern: "group group-a tp=4 head=srv6@192.168.110.14 workers=")
-    && string_contains(s: w, pattern: "srv5@192.168.110.11")
-}
diff --git a/dag/test/claim/spark/spark_pair_serving_realization_witness_test.dag b/dag/test/claim/spark/spark_pair_serving_realization_witness_test.dag
index eae0291c302..b410fe7edb9 100644
--- a/dag/test/claim/spark/spark_pair_serving_realization_witness_test.dag
+++ b/dag/test/claim/spark/spark_pair_serving_realization_witness_test.dag
@@ -9,24 +9,22 @@ import gunbc.spark.pair_serving_realization {
   SparkPairRealization, SparkPairRealized, SparkPairRealizationRefused,
   SparkPairHostRealization, SparkPairUnitRender, SparkPairUnitRendered, SparkPairUnitRenderRefused,
   RenderedUnitDigested, RenderedUnitDigestUnavailable,
-  spark_pair_realization, spark_pair_realizations, spark_pair_container_env_covers_every_baked_name,
+  spark_pair_realization, spark_pair_container_env_covers_every_baked_name,
   spark_pair_head_unit_unsigned, spark_pair_container_spec, spark_pair_container_env,
   spark_pair_head_unit_name, spark_pair_rendered_unit_digest,
 }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import gunbc.spark.pair_serving_desired {
   spark_pair_serving_unit_with, SeqCapacityMeasured,
   SparkPairServingUnit, SparkPairServingUnitReady, SparkPairServingUnitRefused,
   spark_pair_serving_engine_args,
 }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
 import extdeps.huggingface.hub { HubRepoId, HubModelRepo }
 import gunbc.spark.model_snapshot_acquisition {
   ModelSnapshotDesired, ModelSnapshotPinned, ModelSnapshotUnpinned, glm_5_3_flash_snapshot,
   SnapshotPlacement, HubCachePlacement, spark_hub_cache_root,
 }
 
-fn w_first() -> SparkPairRealization? { first(spark_pair_realizations()) }
-
 // THE CONTROLLED FIXTURE, AND WHY THE UNIT-FILE TESTS BELOW NEED ONE NOW. The live desired roster
 // refuses -- its sequence capacity is unmeasured for GLM-5.3-Flash, and its weights snapshot is
 // unobserved -- so nothing on the live path renders a unit file, and every structural assertion about
@@ -59,7 +57,7 @@ data w_fixture_snapshot: ModelSnapshotDesired = ModelSnapshotPinned {
 }
 
 fn w_fixture_unit() -> SparkPairServingUnit {
-  spark_pair_serving_unit_with(group: FabricGroupA, capacity: SeqCapacityMeasured {
+  spark_pair_serving_unit_with(group: FabricGroupB {}, capacity: SeqCapacityMeasured {
     max_num_seqs: 32,
     basis: "controlled fixture: this witness asserts renderer shape, never a measured capacity" as NonEmptyStr,
   })
@@ -83,35 +81,6 @@ fn w_realized(f: fn(SparkPairHostRealization, List<SparkPairHostRealization>) ->
   }
 }
 
-// THE LIVE ROSTER RENDERS DEEPSEEK, AND THIS WITNESS IS WHY IT DOES. A revision of this branch
-// pointed the production served-model name at GLM-5.3-Flash while this module still built its
-// runtime from `extdeps.docker.images.sparkrun_vllm_ds4_gb10` -- whose vLLM was measured on
-// 2026-09-08 not to register `Glm5NextForConditionalGeneration` at all. This witness was RED on that
-// revision, and it was right: the production planner had begun admitting a tuple that cannot start.
-//
-// IT WOULD HAVE BEEN EASY TO MAKE GREEN THE WRONG WAY, by relaxing it to accept whatever the roster
-// now renders. That would have blessed the impossible combination instead of reporting it. The
-// combination is removed instead: GLM lives behind gunbc.spark.glm_canary_converge, which admits its
-// exact arm through `serving_arm_admits` -- the wall that refuses an image that cannot load the
-// checkpoint.
-test fn the_live_roster_renders_the_model_its_image_can_actually_load() -> Bool {
-  match w_first() {
-    Absent => false
-    Present { value: r } =>
-      match r {
-        SparkPairRealizationRefused { group: _, cause: _ } => false
-        SparkPairRealized { group: _, head: h, workers: _ } => {
-          let t = w_unit_text(u: h.unit)
-          string_contains(s: t, pattern: "--served-model-name deepseek-v4-flash:iq3s-split")
-            && string_contains(s: t, pattern: "--tool-call-parser deepseek_v4")
-            && string_contains(s: t, pattern: "--kv-cache-dtype fp8_ds_mla")
-            && !string_contains(s: t, pattern: "GLM")
-            && !string_contains(s: t, pattern: "glm")
-        }
-      }
-  }
-}
-
 // AN UNPINNED SNAPSHOT CANNOT RENDER A SERVE LINE, asserted with the capacity supplied so that the
 // pin is the only thing missing. A path under `snapshots/<revision>/` needs a revision; composing one
 // out of a branch name would name a directory whose contents change under it, which is why the
diff --git a/dag/test/claim/spark/spark_serving_offer_route_witness_test.dag b/dag/test/claim/spark/spark_serving_offer_route_witness_test.dag
index 7448f45b325..ac303ef0f62 100644
--- a/dag/test/claim/spark/spark_serving_offer_route_witness_test.dag
+++ b/dag/test/claim/spark/spark_serving_offer_route_witness_test.dag
@@ -17,14 +17,15 @@ import std.optional { Present, Absent }
 import gunbc.spark.vllm_observed {
   ModelsRouteDocumentUnreadable, ModelsRouteRead, vllm_models_route_readback,
 }
+import gunbc.spark.serving_group_launch { serving_group_launch }
 import gunbc.spark.pair_serving_realization {
-  spark_pair_model_path_in_container, spark_pair_desired_snapshot, spark_pair_head_unit_name,
+  spark_pair_head_unit_name,
   DeclaredUnitDigestStanding, DeclaredUnitDigested, DeclaredUnitDigestUnavailable,
   spark_pair_declared_head_digest,
 }
 import std.measure { token_count }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv1 }
-import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv9, operator_host_srv10 }
+import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupB }
 import gunbc.serving.serving_enrollment { ServingRouteEndpoint }
 import gunbc.serving.serving_availability { ServingFrontDoorAvailabilityVerdict, FrontDoorAnswered, serving_availability_bracketing_read }
 import gunbc.spark.vllm_endpoint_process_launch {
@@ -81,8 +82,10 @@ import gunbc.spark.first_party_serving { spark_first_party_route }
 // So these rows now vary both, and the fixtures below are named for which half they exercise.
 // THE DECLARED PATH COMES FROM THE PRODUCER THE MODULE COMPARES AGAINST, never a literal, so this
 // fixture cannot drift into agreeing with itself when the pinned snapshot moves.
+// THE PATH GROUP B'S LAUNCH DECLARES -- the production route reads the declared path from the group's own
+// launch authority (gunbc.spark.serving_group_launch), so the fixture readback reports that path.
 fn t_declared_path() -> String {
-  match spark_pair_model_path_in_container(snapshot: spark_pair_desired_snapshot) {
+  match serving_group_launch(group: FabricGroupB {}).declared_model_path {
     Present { value: p } => p
     Absent => ""
   }
@@ -119,8 +122,8 @@ fn t_foreign_realization(hosts: List<HostIdentity>) -> SparkServingRealization {
     hosts: hosts,
     readback: ModelsRouteRead {
       readback: vllm_models_route_readback(
-        served_model_id: "glm-5.3-flash:native" as NonEmptyStr,
-        configured_model_path: "/weights/models--zai-org--GLM-5.3-Flash/snapshots/eb9eb208eb0d988989d07a6a12d0fdeb5f52574a" as NonEmptyStr,
+        served_model_id: "foreign-model" as NonEmptyStr,
+        configured_model_path: "/weights/models--fixture--foreign-model/snapshots/0000000000000000000000000000000000000000" as NonEmptyStr,
         max_model_len: token_count(count: 1048576)),
     },
     endpoint: t_launch(),
@@ -184,7 +187,7 @@ fn t_unobserved_configuration(cause: SparkServiceIdentityCause) -> SparkRealizat
 
 fn t_launch() -> VllmEndpointProcessLaunch {
   vllm_endpoint_process_launch(
-    group: FabricGroupA,
+    group: FabricGroupB {},
     endpoint: "http://10.0.0.1:8000" as NonEmptyStr,
     process_start_field: "1" as NonEmptyStr,
   )
@@ -194,7 +197,7 @@ fn t_observed_route() -> ProviderRoute {
   ProviderRoute {
     provider: decl_ref(module_path: "test.claim.spark.spark_serving_offer_route_witness_test", decl_name: "t_observed_route"),
     service: decl_ref(module_path: "gunbc.spark.serving_offer", decl_name: "spark_serving_quote"),
-    region: decl_ref(module_path: "gunbc.spark.fabric_switch_observed", decl_name: "FabricGroupA"),
+    region: decl_ref(module_path: "gunbc.spark.fabric_switch_observed", decl_name: "FabricGroupB"),
   }
 }
 
@@ -202,7 +205,7 @@ fn t_observed_route() -> ProviderRoute {
 // the fixture obtains one the way production does: a launch read naming the offered launch.
 fn t_ready() -> ServingFrontDoorAvailabilityVerdict {
   serving_availability_bracketing_read(
-    endpoint: ServingRouteEndpoint { group: FabricGroupA, address: "10.0.0.1" as NonEmptyStr, port: 8000 },
+    endpoint: ServingRouteEndpoint { group: FabricGroupB {}, address: "10.0.0.1" as NonEmptyStr, port: 8000 },
     before: LaunchObserved { launch: t_launch(), receipt: "gunbc.test.spark-serving-offer-route" as ObservationReceiptRef },
     front_door: FrontDoorAnswered,
     after: LaunchObserved { launch: t_launch(), receipt: "gunbc.test.spark-serving-offer-route" as ObservationReceiptRef },
@@ -277,7 +280,7 @@ test fn an_unobserved_region_refuses_naming_its_obligation() -> Bool {
 // allocation where it now lives -- on the refusing arm -- rather than demanding an answer that would
 // have to be unsupported to exist.
 test fn the_allocation_survives_a_service_refusal_with_its_date() -> Bool {
-  match t_standing(realization: t_realization(hosts: [operator_host_srv5, operator_host_srv6])) {
+  match t_standing(realization: t_realization(hosts: [operator_host_srv10, operator_host_srv9])) {
     ServingRouteRegionUnobserved { obligation: _ } => false
     ServingRouteObserved { route: _ } => false
     ServingRouteOperatorAsserted { route: _, allocation: _, answered_by: _ } => false
@@ -374,7 +377,7 @@ fn t_cause_is_reported_path_differs(cause: SparkServiceIdentityCause) -> Bool {
 }
 
 test fn a_matching_configuration_does_not_establish_the_specific_service() -> Bool {
-  match t_standing(realization: t_realization(hosts: [operator_host_srv5, operator_host_srv6])) {
+  match t_standing(realization: t_realization(hosts: [operator_host_srv10, operator_host_srv9])) {
     ServingRouteObserved { route: _ } => false
     ServingRouteOperatorAsserted { route: _, allocation: _, answered_by: _ } => false
     ServingRouteRegionUnobserved { obligation: _ } => false
@@ -383,7 +386,7 @@ test fn a_matching_configuration_does_not_establish_the_specific_service() -> Bo
         && string_contains(s: o as String, pattern: spark_serving_route_service_identity_obligation as String)
         && string_contains(
              s: o as String,
-             pattern: spark_realization_identity_cause(realization: t_realization(hosts: [operator_host_srv5, operator_host_srv6])) as String,
+             pattern: spark_realization_identity_cause(realization: t_realization(hosts: [operator_host_srv10, operator_host_srv9])) as String,
            )
   }
 }
@@ -411,7 +414,7 @@ fn t_service_refusal_cause_matches_the_standing(realization: SparkServingRealiza
 }
 
 test fn a_matching_configuration_does_not_bind_an_offer() -> Bool {
-  t_service_refusal_cause_matches_the_standing(realization: t_realization(hosts: [operator_host_srv5, operator_host_srv6]))
+  t_service_refusal_cause_matches_the_standing(realization: t_realization(hosts: [operator_host_srv10, operator_host_srv9]))
 }
 
 
@@ -420,13 +423,13 @@ test fn a_matching_configuration_does_not_bind_an_offer() -> Bool {
 // standing refuses. Without this row the eight-unit roster in the allocation would be decorative:
 // nothing else in the corpus compares a host to it (review 63995).
 test fn a_host_outside_the_allocation_refuses_and_names_it() -> Bool {
-  match t_standing(realization: t_realization(hosts: [operator_host_srv5, operator_host_srv1])) {
+  match t_standing(realization: t_realization(hosts: [operator_host_srv9, operator_host_srv1])) {
     ServingRouteObserved { route: _ } => false
     ServingRouteOperatorAsserted { route: _, allocation: _, answered_by: _ } => false
     ServingRouteServiceUnidentified { allocation: _, cause: _, obligation: _ } => false
     ServingRouteRegionUnobserved { obligation: o } =>
       string_contains(s: o as String, pattern: "srv1")
-        && !string_contains(s: o as String, pattern: "srv5")
+        && !string_contains(s: o as String, pattern: "srv9")
   }
 }
 
@@ -458,7 +461,7 @@ test fn an_unreadable_group_membership_refuses() -> Bool {
 // asserts both halves -- the allocation is present with its date, and the service is refused for the
 // readback's own reason rather than for a host-coverage reason that would belong to another row.
 test fn covered_hosts_with_an_unreadable_readback_refuse_the_service_and_keep_the_region() -> Bool {
-  match t_standing(realization: t_unreadable_realization(hosts: [operator_host_srv5, operator_host_srv6])) {
+  match t_standing(realization: t_unreadable_realization(hosts: [operator_host_srv10, operator_host_srv9])) {
     ServingRouteObserved { route: _ } => false
     ServingRouteOperatorAsserted { route: _, allocation: _, answered_by: _ } => false
     ServingRouteRegionUnobserved { obligation: _ } => false
@@ -468,9 +471,9 @@ test fn covered_hosts_with_an_unreadable_readback_refuse_the_service_and_keep_th
         && t_cause_is_unresolved_readback(cause: c)
         && string_contains(
              s: o as String,
-             pattern: spark_realization_identity_cause(realization: t_unreadable_realization(hosts: [operator_host_srv5, operator_host_srv6])) as String,
+             pattern: spark_realization_identity_cause(realization: t_unreadable_realization(hosts: [operator_host_srv10, operator_host_srv9])) as String,
            )
-        && !string_contains(s: o as String, pattern: "srv5")
+        && !string_contains(s: o as String, pattern: "srv10")
   }
 }
 
@@ -478,7 +481,7 @@ test fn covered_hosts_with_an_unreadable_readback_refuse_the_service_and_keep_th
 // whose service cannot be identified must not bind, for the same reason an uncovered region must
 // not: the refusal is only worth its type if something downstream acts on it.
 test fn an_unidentified_service_does_not_bind_an_offer() -> Bool {
-  t_service_refusal_cause_matches_the_standing(realization: t_unreadable_realization(hosts: [operator_host_srv5, operator_host_srv6]))
+  t_service_refusal_cause_matches_the_standing(realization: t_unreadable_realization(hosts: [operator_host_srv10, operator_host_srv9]))
 }
 
 // RED -- A DIFFERENT REPORTED PATH REFUSES THE SERVICE, AND FOR ITS OWN REASON. The foreign case was
@@ -495,7 +498,7 @@ test fn an_unidentified_service_does_not_bind_an_offer() -> Bool {
 // row asserts the refusal reports non-establishment, and asserts it does NOT claim the stronger
 // thing, which is the same wall this module applies to every other inference.
 test fn a_different_reported_path_refuses_the_service_without_claiming_a_different_launch() -> Bool {
-  match t_standing(realization: t_foreign_realization(hosts: [operator_host_srv5, operator_host_srv6])) {
+  match t_standing(realization: t_foreign_realization(hosts: [operator_host_srv10, operator_host_srv9])) {
     ServingRouteObserved { route: _ } => false
     ServingRouteOperatorAsserted { route: _, allocation: _, answered_by: _ } => false
     ServingRouteRegionUnobserved { obligation: _ } => false
@@ -510,7 +513,7 @@ test fn a_different_reported_path_refuses_the_service_without_claiming_a_differe
 // RED -- AND THAT REFUSAL REACHES THE BINDER, joined to the standing's own obligation rather than to
 // a literal, so the binder cannot forward a different refusal and still pass.
 test fn a_different_reported_path_does_not_bind_an_offer() -> Bool {
-  t_service_refusal_cause_matches_the_standing(realization: t_foreign_realization(hosts: [operator_host_srv5, operator_host_srv6]))
+  t_service_refusal_cause_matches_the_standing(realization: t_foreign_realization(hosts: [operator_host_srv10, operator_host_srv9]))
 }
 
 
@@ -529,7 +532,7 @@ test fn a_different_reported_path_does_not_bind_an_offer() -> Bool {
 // refuses, and asserts the constructor that yields. If the harness could not reach the refusal arms
 // this change adds, the join would be dangling.
 test fn the_production_route_refuses_because_no_incarnation_is_observed() -> Bool {
-  match harness_serving_route(group: FabricGroupA, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv5, operator_host_srv6]).readback, incarnation: t_incarnation_unobserved(), declared_unit: t_declared(), participation: none) {
+  match harness_serving_route(group: FabricGroupB {}, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv10, operator_host_srv9]).readback, incarnation: t_incarnation_unobserved(), declared_unit: t_declared(), participation: none) {
     ServingRouteServiceUnidentified { allocation: _, cause: c, obligation: _ } =>
       match c {
         ServiceIncarnationUnobserved { configuration: _, obligation: o } =>
@@ -555,7 +558,7 @@ fn t_sha256(hex: String) -> ContentHash {
 
 // THE DECLARED SIDE COMES FROM THE PRODUCTION MINT, AND THIS FILE COULD NOT AUTHOR IT IF IT WANTED
 // TO. DeclaredUnitDigestEvidence is a sole_constructor record whose only constructor in the corpus
-// is spark_pair_declared_head_digest(group), which renders the CURRENT Group A declaration and
+// is spark_pair_declared_head_digest(group), which renders the CURRENT group B declaration and
 // hashes it. There is no byte-level door: spark_pair_rendered_unit_digest returns the UNSEALED
 // RenderedUnitDigestStanding, so no amount of fixture text produces a DeclaredUnitDigested. Hence
 // this file executes a real DigestStdin over the production declaration and lives on the required
@@ -605,7 +608,7 @@ data t_other_unit_hex: String = "66666666666666666666666666666666666666666666666
 data t_image_hex: String = "7777777777777777777777777777777777777777777777777777777777777777"
 
 fn t_declared() -> DeclaredUnitDigestStanding {
-  spark_pair_declared_head_digest(group: FabricGroupA)
+  spark_pair_declared_head_digest(group: FabricGroupB {})
 }
 
 // THE UNAVAILABLE ARM YIELDS A STRUCTURAL FINGERPRINT ON PURPOSE. If the production mint ever stops
@@ -622,8 +625,8 @@ fn t_declared_digest() -> ContentHash {
 
 fn t_launch_with_unit(unit: ContentHash) -> VllmServingLaunch {
   vllm_serving_launch(
-    group: FabricGroupA,
-    head: operator_host_srv5,
+    group: FabricGroupB {},
+    head: operator_host_srv10,
     systemd_invocation: "fixture-invocation-1" as NonEmptyStr,
     container_id: "fixture-container-1" as NonEmptyStr,
     executable_digest: t_sha256(hex: t_image_hex),
@@ -666,7 +669,7 @@ fn t_cause(route: SparkServingRoute) -> SparkServiceIdentityCause? {
 }
 
 fn t_covered_matching() -> SparkServingRealization {
-  t_realization(hosts: [operator_host_srv5, operator_host_srv6])
+  t_realization(hosts: [operator_host_srv10, operator_host_srv9])
 }
 
 // POSITIVE CONTROL, FIXTURE EVIDENCE. All three facts hold: the observation binds this endpoint to an
@@ -712,7 +715,7 @@ test fn an_agreeing_unit_digest_without_an_observation_refuses() -> Bool {
 // RED -- AN OBSERVATION ABOUT ANOTHER ENDPOINT PROCESS. Same group and endpoint, a different exporter
 // start: the process was replaced, and the observation is about its predecessor.
 test fn an_observation_about_a_replaced_endpoint_process_refuses() -> Bool {
-  let replaced = vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "http://10.0.0.1:8000" as NonEmptyStr, process_start_field: "2" as NonEmptyStr)
+  let replaced = vllm_endpoint_process_launch(group: FabricGroupB {}, endpoint: "http://10.0.0.1:8000" as NonEmptyStr, process_start_field: "2" as NonEmptyStr)
   match t_cause(route: spark_serving_route_standing(
     realization: t_with_incarnation(base: t_covered_matching(), incarnation: t_observed(endpoint: replaced, launch: t_incarnation())),
     declared_unit: t_declared(), participation: none,
@@ -725,7 +728,7 @@ test fn an_observation_about_a_replaced_endpoint_process_refuses() -> Bool {
 // RED -- AN INCARNATION ON A HOST OUTSIDE THE REALIZATION.
 test fn an_incarnation_on_another_host_refuses() -> Bool {
   let elsewhere = vllm_serving_launch(
-    group: FabricGroupA, head: operator_host_srv1,
+    group: FabricGroupB {}, head: operator_host_srv1,
     systemd_invocation: "fixture-invocation-1" as NonEmptyStr, container_id: "fixture-container-1" as NonEmptyStr,
     executable_digest: t_sha256(hex: t_image_hex), unit_digest: t_declared_digest(), started_at: 1788907506,
   )
@@ -800,7 +803,7 @@ test fn an_observed_digest_in_another_family_is_incomparable_and_refuses() -> Bo
 // RED -- EVERYTHING ELSE HOLDS AND THE READBACK DISAGREES.
 test fn an_observed_declared_incarnation_with_a_disagreeing_readback_refuses() -> Bool {
   match t_cause(route: spark_serving_route_standing(
-    realization: t_with_incarnation(base: t_foreign_realization(hosts: [operator_host_srv5, operator_host_srv6]), incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation())),
+    realization: t_with_incarnation(base: t_foreign_realization(hosts: [operator_host_srv10, operator_host_srv9]), incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation())),
     declared_unit: t_declared(), participation: none,
   )) {
     Present { value: ServiceConfigurationDisagrees { configuration: _ } } => true
@@ -814,7 +817,7 @@ test fn an_observed_declared_incarnation_with_a_disagreeing_readback_refuses() -
 // RED: a harness that ignored its incarnation argument would return ServiceIncarnationUnobserved
 // here, because the digest is supplied and that arm is reachable.
 test fn the_production_route_consumes_an_observed_incarnation() -> Bool {
-  match harness_serving_route(group: FabricGroupA, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv5, operator_host_srv6]).readback, incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation()), declared_unit: t_declared(), participation: none) {
+  match harness_serving_route(group: FabricGroupB {}, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv10, operator_host_srv9]).readback, incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation()), declared_unit: t_declared(), participation: none) {
     ServingRouteOperatorAsserted { route: r, allocation: _, answered_by: _ } =>
       (r.service as String) == (spark_first_party_route().service as String)
     ServingRouteServiceUnidentified { allocation: _, cause: _, obligation: _ } => false
@@ -833,10 +836,10 @@ test fn the_production_route_consumes_an_observed_incarnation() -> Bool {
 // realization reaches ServiceConfigurationDisagrees or a match, so this assertion is discriminating
 // on the roster alone and not on any other fixture change.
 test fn an_assembled_looking_arm_with_adrift_ranks_refuses() -> Bool {
-  let epoch = rendezvous_epoch(head: operator_host_srv5, head_invocation: "fixture-invocation-1" as NonEmptyStr, master_endpoint: "10.0.0.9:29501" as NonEmptyStr)
+  let epoch = rendezvous_epoch(head: operator_host_srv10, head_invocation: "fixture-invocation-1" as NonEmptyStr, master_endpoint: "10.0.0.9:29501" as NonEmptyStr)
   let adrift = GroupHostsNotAllConnected {
     epoch: epoch,
-    adrift: [DeclaredRankHostNotConnected { host: operator_host_srv6, declared_rank: 1, peer: "10.0.0.9:29501" as NonEmptyStr }],
+    adrift: [DeclaredRankHostNotConnected { host: operator_host_srv9, declared_rank: 1, peer: "10.0.0.9:29501" as NonEmptyStr }],
     attached: 1,
     expected: 2,
   }
@@ -845,7 +848,7 @@ test fn an_assembled_looking_arm_with_adrift_ranks_refuses() -> Bool {
     declared_unit: t_declared(), participation: Present { value: adrift },
   )) {
     Present { value: ServiceRanksAdriftFromTheRendezvous { detail: d } } =>
-      contains(d as String, "srv6") && contains(d as String, "not assembled")
+      contains(d as String, "srv9") && contains(d as String, "not assembled")
     _ => false
   }
 }
@@ -868,16 +871,16 @@ test fn a_roster_that_could_not_be_read_refuses() -> Bool {
 // GREEN -- A FULLY ATTACHED ROSTER DOES NOT BLOCK ANYTHING. Without this the gate could be a wall that
 // refuses every arm, which would pass the two reds above and break production.
 test fn a_fully_attached_roster_passes_the_gate_and_reaches_the_configuration_check() -> Bool {
-  let epoch = rendezvous_epoch(head: operator_host_srv5, head_invocation: "fixture-invocation-1" as NonEmptyStr, master_endpoint: "10.0.0.9:29501" as NonEmptyStr)
+  let epoch = rendezvous_epoch(head: operator_host_srv10, head_invocation: "fixture-invocation-1" as NonEmptyStr, master_endpoint: "10.0.0.9:29501" as NonEmptyStr)
   let attached = GroupHostsAllConnected {
     epoch: epoch,
     ranks: [
-      DeclaredRankHostConnected { host: operator_host_srv5, declared_rank: 0, connections: 1 },
-      DeclaredRankHostConnected { host: operator_host_srv6, declared_rank: 1, connections: 1 },
+      DeclaredRankHostConnected { host: operator_host_srv10, declared_rank: 0, connections: 1 },
+      DeclaredRankHostConnected { host: operator_host_srv9, declared_rank: 1, connections: 1 },
     ],
   }
   match t_cause(route: spark_serving_route_standing(
-    realization: t_with_incarnation(base: t_foreign_realization(hosts: [operator_host_srv5, operator_host_srv6]), incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation())),
+    realization: t_with_incarnation(base: t_foreign_realization(hosts: [operator_host_srv10, operator_host_srv9]), incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation())),
     declared_unit: t_declared(), participation: Present { value: attached },
   )) {
     Present { value: ServiceConfigurationDisagrees { configuration: _ } } => true
@@ -896,7 +899,7 @@ test fn a_fully_attached_roster_passes_the_gate_and_reaches_the_configuration_ch
 // the configuration check, so the refusals below are discriminating on the epoch alone.
 
 fn t_epoch_one() -> RendezvousEpoch {
-  rendezvous_epoch(head: operator_host_srv5, head_invocation: "fixture-invocation-0" as NonEmptyStr, master_endpoint: "10.0.0.9:29501" as NonEmptyStr)
+  rendezvous_epoch(head: operator_host_srv10, head_invocation: "fixture-invocation-0" as NonEmptyStr, master_endpoint: "10.0.0.9:29501" as NonEmptyStr)
 }
 
 fn t_is_epoch_mismatch(route: SparkServingRoute) -> Bool {
@@ -913,11 +916,11 @@ test fn an_earlier_epochs_attached_reading_does_not_clear_a_later_incarnation()
   let attached = GroupHostsAllConnected {
     epoch: t_epoch_one(),
     ranks: [
-      DeclaredRankHostConnected { host: operator_host_srv5, declared_rank: 0, connections: 1 },
-      DeclaredRankHostConnected { host: operator_host_srv6, declared_rank: 1, connections: 1 },
+      DeclaredRankHostConnected { host: operator_host_srv10, declared_rank: 0, connections: 1 },
+      DeclaredRankHostConnected { host: operator_host_srv9, declared_rank: 1, connections: 1 },
     ],
   }
-  t_is_epoch_mismatch(route: harness_serving_route(group: FabricGroupA, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv5, operator_host_srv6]).readback, incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation()), declared_unit: t_declared(), participation: Present { value: attached }))
+  t_is_epoch_mismatch(route: harness_serving_route(group: FabricGroupB {}, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv10, operator_host_srv9]).readback, incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation()), declared_unit: t_declared(), participation: Present { value: attached }))
 }
 
 // (b) RED -- E1 DETACHED DOES NOT DIAGNOSE E2'S RANKS. The refusal is the epoch mismatch, never
@@ -925,24 +928,24 @@ test fn an_earlier_epochs_attached_reading_does_not_clear_a_later_incarnation()
 test fn an_earlier_epochs_detached_reading_is_not_a_diagnosis_of_a_later_incarnation() -> Bool {
   let adrift = GroupHostsNotAllConnected {
     epoch: t_epoch_one(),
-    adrift: [DeclaredRankHostNotConnected { host: operator_host_srv6, declared_rank: 1, peer: "10.0.0.9:29501" as NonEmptyStr }],
+    adrift: [DeclaredRankHostNotConnected { host: operator_host_srv9, declared_rank: 1, peer: "10.0.0.9:29501" as NonEmptyStr }],
     attached: 1,
     expected: 2,
   }
-  t_is_epoch_mismatch(route: harness_serving_route(group: FabricGroupA, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv5, operator_host_srv6]).readback, incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation()), declared_unit: t_declared(), participation: Present { value: adrift }))
+  t_is_epoch_mismatch(route: harness_serving_route(group: FabricGroupB {}, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv10, operator_host_srv9]).readback, incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation()), declared_unit: t_declared(), participation: Present { value: adrift }))
 }
 
 // (c) GREEN CONTROL ON THE PRODUCTION ROUTE -- the same attached reading at the candidate's own epoch
 // admits, so (a) is discriminating on the epoch and not on the roster shape.
 test fn a_same_epoch_attached_reading_admits_on_the_production_route() -> Bool {
   let attached = GroupHostsAllConnected {
-    epoch: rendezvous_epoch(head: operator_host_srv5, head_invocation: "fixture-invocation-1" as NonEmptyStr, master_endpoint: "10.0.0.9:29501" as NonEmptyStr),
+    epoch: rendezvous_epoch(head: operator_host_srv10, head_invocation: "fixture-invocation-1" as NonEmptyStr, master_endpoint: "10.0.0.9:29501" as NonEmptyStr),
     ranks: [
-      DeclaredRankHostConnected { host: operator_host_srv5, declared_rank: 0, connections: 1 },
-      DeclaredRankHostConnected { host: operator_host_srv6, declared_rank: 1, connections: 1 },
+      DeclaredRankHostConnected { host: operator_host_srv10, declared_rank: 0, connections: 1 },
+      DeclaredRankHostConnected { host: operator_host_srv9, declared_rank: 1, connections: 1 },
     ],
   }
-  match harness_serving_route(group: FabricGroupA, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv5, operator_host_srv6]).readback, incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation()), declared_unit: t_declared(), participation: Present { value: attached }) {
+  match harness_serving_route(group: FabricGroupB {}, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv10, operator_host_srv9]).readback, incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation()), declared_unit: t_declared(), participation: Present { value: attached }) {
     ServingRouteOperatorAsserted { route: _, allocation: _, answered_by: _ } => true
     ServingRouteServiceUnidentified { allocation: _, cause: _, obligation: _ } => false
     ServingRouteObserved { route: _ } => false
@@ -953,11 +956,11 @@ test fn a_same_epoch_attached_reading_admits_on_the_production_route() -> Bool {
 // RED -- SAME INVOCATION STRING, DIFFERENT HEAD. The epoch is (head, invocation), not the string alone.
 test fn a_reading_from_another_head_is_another_epoch() -> Bool {
   let attached = GroupHostsAllConnected {
-    epoch: rendezvous_epoch(head: operator_host_srv6, head_invocation: "fixture-invocation-1" as NonEmptyStr, master_endpoint: "10.0.0.9:29501" as NonEmptyStr),
-    ranks: [DeclaredRankHostConnected { host: operator_host_srv6, declared_rank: 0, connections: 1 }],
+    epoch: rendezvous_epoch(head: operator_host_srv9, head_invocation: "fixture-invocation-1" as NonEmptyStr, master_endpoint: "10.0.0.9:29501" as NonEmptyStr),
+    ranks: [DeclaredRankHostConnected { host: operator_host_srv9, declared_rank: 0, connections: 1 }],
   }
-  match t_cause(route: harness_serving_route(group: FabricGroupA, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv5, operator_host_srv6]).readback, incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation()), declared_unit: t_declared(), participation: Present { value: attached })) {
-    Present { value: ServiceRendezvousEvidenceFromAnotherEpoch { evidence: _, answering_head: h, answering_invocation: _ } } => host_identity_eq(a: h, b: operator_host_srv5)
+  match t_cause(route: harness_serving_route(group: FabricGroupB {}, launch: t_launch(), readback: t_realization(hosts: [operator_host_srv10, operator_host_srv9]).readback, incarnation: t_observed(endpoint: t_launch(), launch: t_incarnation()), declared_unit: t_declared(), participation: Present { value: attached })) {
+    Present { value: ServiceRendezvousEvidenceFromAnotherEpoch { evidence: _, answering_head: h, answering_invocation: _ } } => host_identity_eq(a: h, b: operator_host_srv10)
     _ => false
   }
 }
diff --git a/dag/test/claim/spark/spark_training_ready_witness_test.dag b/dag/test/claim/spark/spark_training_ready_witness_test.dag
index 32900799157..f305632a95b 100644
--- a/dag/test/claim/spark/spark_training_ready_witness_test.dag
+++ b/dag/test/claim/spark/spark_training_ready_witness_test.dag
@@ -2,7 +2,8 @@ module test.claim.spark.spark_training_ready_witness_test
 
 import std.types { String, Bool, List, NonEmptyStr, Int }
 import product.host_identity { HostIdentity }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6 }
+import gunbc.fleet_host_identity { operator_host_srv10 }
+import gunbc.spark.cell_role { SparkCellRole, SparkCellRoleAssignment, SparkTrainingCell, SparkServingCell }
 import gunbc.spark.training_ready {
   SparkServingProbeCapture,
   ProbeNeverRan,
@@ -18,6 +19,7 @@ import gunbc.spark.training_ready {
   SparkTrainingReady,
   SparkTrainingNotReady,
   spark_training_readiness,
+  spark_training_readiness_in,
   spark_serving_absence_from_probe,
   spark_serving_absence_refusal,
   SparkServingAbsenceEvidence,
@@ -79,8 +81,8 @@ fn w_retired(host: HostIdentity) -> SparkServingRetirementObservation {
   )
 }
 
-fn w_retired_srv6() -> SparkServingRetirementObservation {
-  w_retired(host: operator_host_srv6)
+fn w_retired_srv10() -> SparkServingRetirementObservation {
+  w_retired(host: operator_host_srv10)
 }
 
 // ONE AXIS SILENT, THE OTHER TWO POSITIVELY ABSENT. The axis under test is handed a capture that
@@ -93,7 +95,7 @@ fn w_silent_capture() -> SparkServingProbeCapture {
 
 fn w_retired_endpoint_silent() -> SparkServingRetirementObservation {
   spark_serving_retirement_observation_from_probes(
-    host: operator_host_srv6,
+    host: operator_host_srv10,
     endpoint_capture: w_silent_capture(),
     process_capture: w_process_absent_capture(),
     unit_capture: w_unit_absent_capture(),
@@ -102,7 +104,7 @@ fn w_retired_endpoint_silent() -> SparkServingRetirementObservation {
 
 fn w_retired_process_silent() -> SparkServingRetirementObservation {
   spark_serving_retirement_observation_from_probes(
-    host: operator_host_srv6,
+    host: operator_host_srv10,
     endpoint_capture: w_endpoint_absent_capture(),
     process_capture: w_silent_capture(),
     unit_capture: w_unit_absent_capture(),
@@ -111,7 +113,7 @@ fn w_retired_process_silent() -> SparkServingRetirementObservation {
 
 fn w_retired_unit_silent() -> SparkServingRetirementObservation {
   spark_serving_retirement_observation_from_probes(
-    host: operator_host_srv6,
+    host: operator_host_srv10,
     endpoint_capture: w_endpoint_absent_capture(),
     process_capture: w_process_absent_capture(),
     unit_capture: w_silent_capture(),
@@ -133,34 +135,57 @@ fn w_pool_or_refused(
   }
 }
 
-fn w_readiness(
+// THE ROLE ROSTER IS SUPPLIED (review 77708; DESIGN section 3, a witness discriminates at one interface): the
+// claims are about the readiness logic, so they hand it a roster rather than reading the production one,
+// whose only rows (srv5, srv6) went with Group A. srv10 is the fixture host in whichever role a claim names.
+fn w_roster(role: SparkCellRole) -> List<SparkCellRoleAssignment> {
+  [SparkCellRoleAssignment { host: operator_host_srv10, role: role }]
+}
+
+fn w_readiness_as(
+  role: SparkCellRole,
   retirement: SparkServingRetirementObservation,
   meminfo_stdout: String,
 ) -> Bool {
   match w_pool_or_refused(meminfo_stdout: meminfo_stdout, after: retirement) {
     Absent => false
     Present { value: pool } =>
-      match spark_training_readiness(pool: pool) {
+      match spark_training_readiness_in(pool: pool, assignments: w_roster(role: role)) {
         SparkTrainingReady { proof: _ } => true
         SparkTrainingNotReady { cause: _ } => false
       }
   }
 }
 
+fn w_readiness(
+  retirement: SparkServingRetirementObservation,
+  meminfo_stdout: String,
+) -> Bool {
+  w_readiness_as(role: SparkTrainingCell, retirement: retirement, meminfo_stdout: meminfo_stdout)
+}
+
 test fn w_a_fully_retired_training_cell_is_ready() -> Bool {
-  w_readiness(retirement: w_retired_srv6(), meminfo_stdout: "97656250")
+  w_readiness(retirement: w_retired_srv10(), meminfo_stdout: "97656250")
 }
 
-// THE POSITIVE CONTROL'S MIRROR: THE SERVING CELL IS NEVER READY.
-//
-// srv5's retirement observation is deliberately WELL-FORMED and fully absent here. If role were not
-// consulted, this input would be indistinguishable from srv6's and would pass. It refuses on role
-// alone, which is what "srv5 is statically reserved" has to mean to be worth anything.
+
+// THE PRODUCTION WRAPPER READS THE PRODUCTION ROSTER, which holds no assignment since Group A was
+// sold: the same observation the positive control admits is refused there, on role.
+test fn w_the_production_roster_holds_no_training_cell() -> Bool {
+  match w_pool_or_refused(meminfo_stdout: "97656250", after: w_retired_srv10()) {
+    Absent => false
+    Present { value: pool } =>
+      match spark_training_readiness(pool: pool) {
+        SparkTrainingReady { proof: _ } => false
+        SparkTrainingNotReady { cause: _ } => true
+      }
+  }
+}
+
+// THE SAME WELL-FORMED, FULLY ABSENT RETIREMENT ON A SERVING CELL REFUSES ON ROLE ALONE: if role were not
+// consulted this input would be indistinguishable from the training cell's and would pass.
 test fn w_a_serving_cell_refuses_even_with_a_perfect_retirement_observation() -> Bool {
-  !w_readiness(
-    retirement: w_retired(host: operator_host_srv5),
-    meminfo_stdout: "97656250",
-  )
+  !w_readiness_as(role: SparkServingCell, retirement: w_retired_srv10(), meminfo_stdout: "97656250")
 }
 
 // AN UNREACHED PROBE IS NOT ABSENCE, AND THIS IS THE CLAIM THAT COSTS THE MOST TO GET WRONG.
@@ -174,7 +199,7 @@ test fn w_an_unobserved_subject_refuses_on_every_axis() -> Bool {
 test fn w_a_still_serving_endpoint_refuses() -> Bool {
   !w_readiness(
     retirement: spark_serving_retirement_observation_from_probes(
-      host: operator_host_srv6,
+      host: operator_host_srv10,
       endpoint_capture: ProbeAnswered { stdout: "LISTEN 0 4096 127.0.0.1:11434 0.0.0.0:*" },
       process_capture: w_process_absent_capture(),
       unit_capture: w_unit_absent_capture(),
@@ -209,7 +234,7 @@ test fn w_a_pool_over_an_unestablished_retirement_is_refused() -> Bool {
 test fn w_a_capture_whose_body_is_not_a_count_is_refused() -> Bool {
   match spark_unified_pool_observation_from_capture(
     capture: ProbeAnswered { stdout: "MemAvailable:   97656250 kB" },
-    after: w_retired_srv6(),
+    after: w_retired_srv10(),
   ) {
     SparkUnifiedPoolUnread { cause: c } => length(c as String) > 0
     SparkUnifiedPoolRead { observation: _ } => false
@@ -217,7 +242,7 @@ test fn w_a_capture_whose_body_is_not_a_count_is_refused() -> Bool {
 }
 
 test fn w_a_non_positive_pool_refuses_rather_than_offering_nothing() -> Bool {
-  !w_readiness(retirement: w_retired_srv6(), meminfo_stdout: "0")
+  !w_readiness(retirement: w_retired_srv10(), meminfo_stdout: "0")
 }
 
 // A CAPTURE THAT DID NOT ANSWER CANNOT CARRY A COUNT AT ALL, which is now true by construction
@@ -225,7 +250,7 @@ test fn w_a_non_positive_pool_refuses_rather_than_offering_nothing() -> Bool {
 test fn w_a_pool_number_without_a_read_is_refused() -> Bool {
   match spark_unified_pool_observation_from_capture(
     capture: ProbeNeverRan { cause: "ssh timed out" as NonEmptyStr },
-    after: w_retired_srv6(),
+    after: w_retired_srv10(),
   ) {
     SparkUnifiedPoolUnread { cause: _ } => true
     SparkUnifiedPoolRead { observation: _ } => false
diff --git a/dag/test/claim/spark/spark_vllm_observed_witness_test.dag b/dag/test/claim/spark/spark_vllm_observed_witness_test.dag
index b768fd92c4c..d5600b9b207 100644
--- a/dag/test/claim/spark/spark_vllm_observed_witness_test.dag
+++ b/dag/test/claim/spark/spark_vllm_observed_witness_test.dag
@@ -2,12 +2,12 @@ module test.claim.spark.spark_vllm_observed_witness_test
 
 import std.types { Bool, List, NonEmptyStr, String }
 import product.host_identity { HostIdentity }
+import gunbc.fleet_host_identity { operator_host_srv10 }
 import extdeps.languages.json.emit { JsonValue, JsonNull }
 import extdeps.languages.json.parse {
   JsonDocumentParsed, JsonDocumentUnreadable, parse_json_document,
 }
 import std.measure { TokenCount, token_count, token_count_value, BasisPoint, basis_point, basis_point_count, basis_point_unity_count }
-import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6 }
 import gunbc.spark.vllm_observed {
   VllmModelsRouteReadback,
   VllmVersionRouteReadback,
@@ -140,8 +140,8 @@ fn w_bundle(host: HostIdentity, response: VllmEvidenceRouteResponse) -> VllmHist
 test fn w_the_refusal_host_is_derived_from_the_historical_scope_it_belongs_to() -> Bool {
   w_bundle(host: w_fixture_host, response: w_not_served()).realization.front_door_host as String
     == w_fixture_host as String
-  && w_bundle(host: operator_host_srv5, response: w_not_served()).realization.front_door_host as String
-       == operator_host_srv5 as String
+  && w_bundle(host: operator_host_srv10, response: w_not_served()).realization.front_door_host as String
+       == operator_host_srv10 as String
 }
 
 // ── BOTH LIMITATIONS ARE STAMPED, AND THEY ARE NOT THE SAME LIMITATION ─────────────────────────
diff --git a/dag/test/claim/spark/standing_host_effect_recover_witness_test.dag b/dag/test/claim/spark/standing_host_effect_recover_witness_test.dag
deleted file mode 100644
index e041e4e15c0..00000000000
--- a/dag/test/claim/spark/standing_host_effect_recover_witness_test.dag
+++ /dev/null
@@ -1,57 +0,0 @@
-module test.claim.spark.standing_host_effect_recover_witness
-
-import std.types { Bool, String, List, NonEmptyStr }
-import std.optional { Present, Absent }
-import std.measure { second }
-import product.host_identity { HostIdentity }
-import product.capacity.event_chain { EventId }
-import gunbc.spark.pair_serving_authority_log { HostEffectRecord }
-import gunbc.spark.host_effect_quiescence { HostEffectResidueSpec, ClaimantAbandoned, ClaimantTerminated, parse_claimant_standing }
-import gunbc.spark.pair_serving_d0_door { StandingGrantRowOnMain, StandingGrantRowNotOnMain }
-import gunbc.spark.standing_host_effect_recover { recover_authority_causes, recover_claim_selection, RecoverClaimSelected, RecoverNoClaim, RecoverAmbiguous, recover_receipt }
-
-// ── THE STANDING RECOVERY, AT ITS INTERFACES (side-chat review of #13102) ─────────────────────────────
-
-fn w_rec(id: String, host: String, released: Bool) -> HostEffectRecord {
-  HostEffectRecord {
-    id: (id as NonEmptyStr) as EventId, host: host as HostIdentity, purpose: "a runtime image distribution" as NonEmptyStr,
-    executor: "srv1" as NonEmptyStr, recorded_at: 1791020503, term: second(count: 7200),
-    residue: HostEffectResidueSpec { process_pattern: "gunbc-vllm-image" as NonEmptyStr, container: none },
-    released: released,
-  }
-}
-
-// (1) AUTHORITY: only the operator-merged row authorizes; a row not on main refuses, whatever its scope.
-test fn w_a_grant_row_not_on_main_authorizes_no_recovery() -> Bool {
-  length(recover_authority_causes(host: "srv7" as HostIdentity, row: StandingGrantRowNotOnMain { cause: "the row differs from origin/main's" })) == 1
-    && length(recover_authority_causes(host: "srv7" as HostIdentity, row: StandingGrantRowOnMain)) == 0
-}
-
-// (2) ROSTER: a Group B host is outside the grant, on main or not.
-test fn w_a_host_outside_the_grant_roster_is_not_covered() -> Bool {
-  length(recover_authority_causes(host: "srv9" as HostIdentity, row: StandingGrantRowOnMain)) == 1
-    && length(recover_authority_causes(host: "srv5" as HostIdentity, row: StandingGrantRowOnMain)) == 0
-}
-
-// (3) EXACTLY ONE unreleased claim on the host is derived; none or several refuse, and several are listed.
-// Released claims and other hosts' claims never count.
-test fn w_exactly_one_unreleased_claim_is_selected_and_several_are_listed() -> Bool {
-  (match recover_claim_selection(host: "srv7" as HostIdentity, effects: [w_rec(id: "a", host: "srv7", released: true), w_rec(id: "b", host: "srv6", released: false)]) { RecoverNoClaim => true  _ => false })
-    && (match recover_claim_selection(host: "srv7" as HostIdentity, effects: [w_rec(id: "a", host: "srv7", released: true), w_rec(id: "d66e55c35176c445", host: "srv7", released: false)]) { RecoverClaimSelected { record: r } => (r.id as String) == "d66e55c35176c445"  _ => false })
-    && (match recover_claim_selection(host: "srv7" as HostIdentity, effects: [w_rec(id: "x", host: "srv7", released: false), w_rec(id: "y", host: "srv7", released: false)]) { RecoverAmbiguous { claims: cs } => length(cs) == 2 && any(cs, c => string_contains(s: c, pattern: "x")) && any(cs, c => string_contains(s: c, pattern: "y"))  _ => false })
-}
-
-// (4) and (5): the receipt binds the exact claim and carries the typed disposition; "quiet" is no
-// disposition at all, so it never parses into one.
-test fn w_the_receipt_binds_the_claim_and_the_disposition_is_typed() -> Bool {
-  string_contains(s: recover_receipt(r: w_rec(id: "d66e55c35176c445", host: "srv7", released: false), run_id: "37" as NonEmptyStr, standing: ClaimantAbandoned) as String, pattern: "claim d66e55c35176c445")
-    && string_contains(s: recover_receipt(r: w_rec(id: "d66e55c35176c445", host: "srv7", released: false), run_id: "37" as NonEmptyStr, standing: ClaimantAbandoned) as String, pattern: "claimant declared abandoned")
-    && (match parse_claimant_standing(wire: "quiet") { Present { value: _ } => false  Absent => true })
-    && (match parse_claimant_standing(wire: "terminated") { Present { value: ClaimantTerminated } => true  _ => false })
-}
-
-// COVERAGE IS SUBSET: one granted host is covered, a granted host plus an ungranted one is not.
-test fn w_one_granted_host_is_covered_and_an_ungranted_one_is_not() -> Bool {
-  length(recover_authority_causes(host: "srv7" as HostIdentity, row: StandingGrantRowOnMain)) == 0
-    && length(recover_authority_causes(host: "srv12" as HostIdentity, row: StandingGrantRowOnMain)) == 1
-}
diff --git a/dag/test/claim/spark/v41_capacity_measurement_witness_test.dag b/dag/test/claim/spark/v41_capacity_measurement_witness_test.dag
deleted file mode 100644
index d9c28dba4f5..00000000000
--- a/dag/test/claim/spark/v41_capacity_measurement_witness_test.dag
+++ /dev/null
@@ -1,568 +0,0 @@
-module test.claim.spark.v41_capacity_measurement_witness
-
-import gunbc.spark.serving_performance_subject { ServingSubjectKey, serving_subject_key, serving_performance_subject }
-import gunbc.spark.serving_arm { DeepseekV41FlashDba1be0a, GunbcSparkrunVllmDs4Gb10 }
-
-import v2.std.algebra { filter }
-import v2.std.collection { list_at_optional }
-import std.staircase { StaircaseStopped, StaircaseCompleted }
-import std.types { Bool, Int, List, NonEmptyStr, String }
-import std.nat { Nat }
-import std.measure {
-  ByteSize, byte_size, byte_size_count, token_count, millisecond, microsecond, microsecond_count,
-  milli_tokens_per_second, concurrent_request_hundredths, basis_point, basis_point_count, token_count_value,
-}
-import std.content_hash { Sha256Digest, Sha256DigestHex, content_hash_of_value }
-import std.optional { Present, Absent }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import extdeps.container.oci.digest { OciSha256Digest }
-import extdeps.vllm.server { VllmSourceRevision, vllm_source_revision }
-import extdeps.vllm.log_lines { vllm_startup_reading, GpuKvCacheSize, MaximumConcurrency }
-import extdeps.vllm.kv_cache { VllmObservedKvPool, KvPoolAdmitted, KvPoolRefused, vllm_observed_kv_pool_from_reading, ResolvedFp8DsMla, ResolvedUnobserved }
-import extdeps.vllm.kv_layout { VllmReportedCapacity, ReportedCapacityAdmitted, ReportedCapacityRefused, vllm_reported_capacity }
-import extdeps.linux.psi { PsiReading, PsiRead, PsiUnparseable, parse_psi, PsiStallMeasured, PsiStallUnmeasurable, psi_full_stall_interval }
-import extdeps.linux.diskstats { parse_diskstats, DiskstatsDeviceRead, DiskstatsDeviceAbsent, DiskReadMeasured, DiskReadUnmeasurable, disk_read_interval }
-import extdeps.linux.mincore { MincoreFileResidency, MincoreResidencyAdmitted, MincoreResidencyRefused, mincore_file_residency }
-import extdeps.linux.cgroup_v2_memory { CgroupMemoryStat, CgroupMemoryStatRead, CgroupMemoryStatIncomplete, parse_cgroup_memory_stat }
-import gunbc.floor_memory_demand { CgroupMemoryEvents }
-import extdeps.vllm.engine_args { PrefixCachingExplicit, PrefixCachingOmitted }
-import gunbc.spark.v41_runtime_realized { V41OciImageDigest, v41_oci_image_digest }
-import gunbc.spark.serving_load_probe { ClientBenchLatency, ClientBenchLatencyReported, ForeignTrafficNotObserved, DrainObservedIdle }
-import gunbc.spark.v41_capacity_measurement {
-  V41RankStartupReading, V41RankParallelism, V41RankMemoryBreakdown,
-  V41StartupAdmission, StartupAdmitted, StartupRefused, v41_admit_startup, v41_min_rank_bytes_per_token,
-  v41_kv_bytes_per_token_bet, V41BetVerdict, BetConfirmed, BetFalsified, BetUnreadable, v41_judge_byte_range_bet,
-  V41ResidencyCell, V41ResidencyTimeline, ResidencyTimelineAdmitted, ResidencyTimelineRefused, v41_admit_residency_timeline,
-  EngramUpstreamPinned, EngramFileBackedReleased, BeforeStart, AfterChecksum, AfterKvAllocation, AfterRequests, V41TorchMemory,
-  V41ProbeCell, V41ProbeReading, V41ProbeRankReading, ProbeWarm, TouchCounterUnavailable, EngramLookupObserved,
-  v41_touch_counter_frontier, v41_judge_probe, ProbeRefused, ProbeWorkingSetResident, ProbeWorkingSetFaulted,
-  V41CapacityPolicy, PolicyOperatorSigned, PolicyProposed, V41TtftGate, v41_capacity_policy, V41StaircaseStepReading, v41_run_staircase,
-  V41PolicyStanding, V41StaircaseRun, V41StaircasePolicyUnsigned, V41StaircaseRan, StopKvPreemption, StopReadingMissing,
-  StopSuperlinearRefault, StopPsiFullSustained, StopNvmeLatency, StopSloBreach, V41ResidencyPhase,
-  V41Capacity, CapacityAt, CapacityBelowFirstStep, CapacityRefused, v41_capacity_wire,
-  v41_kv_admission_capacity, v41_engram_resident_capacity, v41_sla_capacity, v41_capacity_report,
-  V41CapacityReport, v41_calibration_receipt, V41CalibrationProjected, V41CalibrationRefused,
-  v41_capacity_measurement_plan_text, v41_measurement_ranks, v41_engram_resident_bets, V41RankStartupReceipt, RankStartupAdmitted, RankStartupRefused, v41_admit_rank_startup, ExtensionLoaded, ExtensionImportFailed, ExtensionUnobserved, v41_engram_arm_of, v41_engram_arm_bindings, v41_judge_engram_resident_bet, v41_after_requests_resident, PointBetObserved, PointBetUnreadable, v41_measurement_launch_shape,
-}
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-// THE FOLDS AT THEIR OWN INTERFACE, OVER SUPPLIED READINGS. The producer of real readings is the wet
-// fleet mode (gunbc.spark.v41_capacity_measurement v41_wet_runner_frontier), which cannot run until
-// the srv8 runtime image exists; its inhabitance claim lands with it.
-
-fn w_rev() -> VllmSourceRevision {
-  vllm_source_revision(repository: "github.com/vllm-project/vllm" as NonEmptyStr, full_revision: "1111111111111111111111111111111111111111" as NonEmptyStr)
-}
-
-fn w_rev_other() -> VllmSourceRevision {
-  vllm_source_revision(repository: "github.com/vllm-project/vllm" as NonEmptyStr, full_revision: "2222222222222222222222222222222222222222" as NonEmptyStr)
-}
-
-fn w_reported(tokens: Int, rev: VllmSourceRevision) -> VllmReportedCapacity? {
-  match vllm_observed_kv_pool_from_reading(tokens: token_count(count: tokens), reading: vllm_startup_reading(line: GpuKvCacheSize, captured_text: "GPU KV cache size: n tokens" as NonEmptyStr, observed_at_revision: rev)) {
-    KvPoolRefused { cause: _ } => none
-    KvPoolAdmitted { pool: p } => match vllm_reported_capacity(pool: p, max_concurrency: concurrent_request_hundredths(count: (tokens * 100) / 262144), reading: vllm_startup_reading(line: MaximumConcurrency, captured_text: "Maximum concurrency for 262,144 tokens per request: n" as NonEmptyStr, observed_at_revision: rev)) {
-      ReportedCapacityAdmitted { capacity: c } => Present { value: c }
-      ReportedCapacityRefused { cause: _ } => none
-    }
-  }
-}
-
-fn w_image() -> V41OciImageDigest {
-  v41_oci_image_digest(
-    manifest: OciSha256Digest(Sha256Digest { hex: "3333333333333333333333333333333333333333333333333333333333333333" as Sha256DigestHex }),
-    config: OciSha256Digest(Sha256Digest { hex: "4444444444444444444444444444444444444444444444444444444444444444" as Sha256DigestHex }),
-  )
-}
-
-// 1,850 bytes per token over the pool, so the bet (1,800-1,940) is confirmed on the min rank.
-fn w_rank(rank: Nat, tokens: Int, rev: VllmSourceRevision) -> V41RankStartupReading {
-  V41RankStartupReading {
-    run_id: "run-1" as NonEmptyStr,
-    rank: rank,
-    host: "srv5" as NonEmptyStr,
-    image: Present { value: w_image() },
-    vllm_revision: Present { value: rev },
-    parallelism: Present { value: V41RankParallelism { tp: 4, dcp: 1, pp: 1, dp: 1 } },
-    kv_format: ResolvedFp8DsMla,
-    block_size: Present { value: 64 },
-    max_model_len: Present { value: token_count(count: 262144) },
-    max_num_seqs: Present { value: 16 },
-    max_num_batched_tokens: Present { value: 8192 },
-    spec_decode_config: Present { value: "off" as NonEmptyStr },
-    memory: Present { value: V41RankMemoryBreakdown {
-      free: byte_size(count: 100000000000), total: byte_size(count: 130663231488),
-      weights: byte_size(count: 40000000000), non_torch: byte_size(count: 2000000000),
-      activation_peak: byte_size(count: 3000000000), cuda_graph: byte_size(count: 1000000000),
-      available_kv: byte_size(count: tokens * 1850),
-    } },
-    reported: w_reported(tokens: tokens, rev: rev),
-    num_gpu_blocks: Present { value: 1000 },
-    kv_cache_groups: Present { value: 2 },
-    deepselect: ExtensionImportFailed { logged: "Failed to import the DeepSelect extension (vllm._deepselect_C)" as NonEmptyStr },
-  }
-}
-
-// The same reading with the memory breakdown missing and the kv dtype unresolved.
-fn w_rank_broken(rank: Nat) -> V41RankStartupReading {
-  let r = w_rank(rank: rank, tokens: 2000000, rev: w_rev())
-  V41RankStartupReading {
-    run_id: r.run_id, rank: r.rank, host: r.host, image: r.image, vllm_revision: r.vllm_revision,
-    parallelism: r.parallelism, kv_format: ResolvedUnobserved, block_size: r.block_size,
-    max_model_len: r.max_model_len, max_num_seqs: r.max_num_seqs, max_num_batched_tokens: r.max_num_batched_tokens,
-    spec_decode_config: r.spec_decode_config, memory: none, reported: r.reported,
-    num_gpu_blocks: r.num_gpu_blocks, kv_cache_groups: r.kv_cache_groups, deepselect: r.deepselect,
-  }
-}
-
-// On the MIN rank (1,500,000) x4 fits and x6 (1,572,864) does not; the other ranks alone would admit x6.
-fn w_four_ranks() -> List<V41RankStartupReading> {
-  [w_rank(rank: 0, tokens: 2000000, rev: w_rev()), w_rank(rank: 1, tokens: 1500000, rev: w_rev()),
-   w_rank(rank: 2, tokens: 2000000, rev: w_rev()), w_rank(rank: 3, tokens: 2000000, rev: w_rev())]
-}
-
-test fn the_startup_receipt_is_judged_by_the_min_rank() -> Bool {
-  v41_capacity_wire(c: v41_kv_admission_capacity(s: v41_admit_startup(readings: w_four_ranks()))) == "x4"
-}
-
-test fn effective_bytes_per_token_confirms_the_bet_in_range() -> Bool {
-  match v41_judge_byte_range_bet(bet: v41_kv_bytes_per_token_bet, observed: v41_min_rank_bytes_per_token(s: v41_admit_startup(readings: w_four_ranks()))) {
-    BetConfirmed { key: _, observed: o } => byte_size_count(b: o) == 1850
-    BetFalsified { key: _, observed: _ } => false
-    BetUnreadable { key: _, cause: _ } => false
-  }
-}
-
-test fn a_reading_outside_the_bet_falsifies_it_and_a_missing_one_is_unreadable() -> Bool {
-  let falsified = match v41_judge_byte_range_bet(bet: v41_kv_bytes_per_token_bet, observed: Present { value: byte_size(count: 2400) }) {
-    BetFalsified { key: _, observed: _ } => true
-    BetConfirmed { key: _, observed: _ } => false
-    BetUnreadable { key: _, cause: _ } => false
-  }
-  let unreadable = match v41_judge_byte_range_bet(bet: v41_kv_bytes_per_token_bet, observed: Absent) {
-    BetUnreadable { key: _, cause: _ } => true
-    BetConfirmed { key: _, observed: _ } => false
-    BetFalsified { key: _, observed: _ } => false
-  }
-  falsified && unreadable
-}
-
-// THE REDS: a missing rank, a missing field, an unresolved kv dtype, and a rank on another commit each
-// refuse the whole receipt, and nothing about KV admission is computed.
-fn w_refused(s: V41StartupAdmission, needle: String) -> Bool {
-  match s {
-    StartupRefused { causes: cs } => length(filter(cs, c => contains(c, needle))) > 0
-    StartupAdmitted { receipt: _ } => false
-  }
-}
-
-test fn a_missing_rank_refuses_the_startup_receipt() -> Bool {
-  let three = filter(w_four_ranks(), r => r.rank != 3)
-  w_refused(s: v41_admit_startup(readings: three), needle: "rank 3 has no reading")
-    && contains(v41_capacity_wire(c: v41_kv_admission_capacity(s: v41_admit_startup(readings: three))), "refused")
-}
-
-test fn a_missing_field_is_named_in_the_refusal() -> Bool {
-  let broken = w_rank_broken(rank: 2)
-  let readings = [w_rank(rank: 0, tokens: 2000000, rev: w_rev()), w_rank(rank: 1, tokens: 2000000, rev: w_rev()), broken, w_rank(rank: 3, tokens: 2000000, rev: w_rev())]
-  w_refused(s: v41_admit_startup(readings: readings), needle: "memory breakdown")
-    && w_refused(s: v41_admit_startup(readings: readings), needle: "resolved kv dtype")
-}
-
-test fn a_rank_on_another_vllm_commit_refuses() -> Bool {
-  let readings = [w_rank(rank: 0, tokens: 2000000, rev: w_rev()), w_rank(rank: 1, tokens: 2000000, rev: w_rev_other()), w_rank(rank: 2, tokens: 2000000, rev: w_rev()), w_rank(rank: 3, tokens: 2000000, rev: w_rev())]
-  w_refused(s: v41_admit_startup(readings: readings), needle: "another vLLM commit")
-}
-
-// ── the kernel readers ──
-
-data w_psi_before: String = "some avg10=0.00 avg60=0.00 avg300=0.00 total=1000\nfull avg10=0.00 avg60=0.00 avg300=0.00 total=500\n"
-data w_psi_after: String = "some avg10=9.00 avg60=3.00 avg300=1.00 total=9000000\nfull avg10=8.00 avg60=2.00 avg300=1.00 total=7000500\n"
-
-test fn a_psi_full_stall_is_the_delta_of_two_totals() -> Bool {
-  match psi_full_stall_interval(before: parse_psi(body: w_psi_before), after: parse_psi(body: w_psi_after), window: microsecond(count: 60000000)) {
-    PsiStallMeasured { stalled: s, window: _ } => microsecond_count(m: s) == 7000000
-    PsiStallUnmeasurable { cause: _ } => false
-  }
-}
-
-test fn a_psi_total_that_went_backwards_is_unmeasurable() -> Bool {
-  match psi_full_stall_interval(before: parse_psi(body: w_psi_after), after: parse_psi(body: w_psi_before), window: microsecond(count: 60000000)) {
-    PsiStallUnmeasurable { cause: _ } => true
-    PsiStallMeasured { stalled: _, window: _ } => false
-  }
-}
-
-data w_disk_before: String = "   8       0 sda 1 0 8 1 0 0 0 0 0 0 0\n 259       0 nvme0n1 1000 0 80000 500 10 0 80 5 0 400 505 0 0 0 0\n"
-data w_disk_after: String = " 259       0 nvme0n1 3000 0 4080000 2500 10 0 80 5 4 1400 2505 0 0 0 0\n"
-
-test fn a_disk_read_interval_counts_512_byte_sectors_and_mean_await() -> Bool {
-  match disk_read_interval(before: parse_diskstats(body: w_disk_before, device: "nvme0n1" as NonEmptyStr), after: parse_diskstats(body: w_disk_after, device: "nvme0n1" as NonEmptyStr)) {
-    DiskReadMeasured { read_bytes: b, reads: n, mean_read_await: aw } =>
-      byte_size_count(b: b) == 4000000 * 512 && n == 2000
-        && match aw { Present { value: a } => microsecond_count(m: a) == 1000  Absent => false }
-    DiskReadUnmeasurable { cause: _ } => false
-  }
-}
-
-test fn an_absent_device_is_not_a_zero_read() -> Bool {
-  match disk_read_interval(before: parse_diskstats(body: w_disk_before, device: "nvme1n1" as NonEmptyStr), after: parse_diskstats(body: w_disk_after, device: "nvme1n1" as NonEmptyStr)) {
-    DiskReadUnmeasurable { cause: _ } => true
-    DiskReadMeasured { read_bytes: _, reads: _, mean_read_await: _ } => false
-  }
-}
-
-test fn mincore_refuses_more_resident_pages_than_the_file_has() -> Bool {
-  let ok = match mincore_file_residency(file: "rank0.engram" as NonEmptyStr, file_bytes: byte_size(count: 8193), page_bytes: byte_size(count: 4096), resident_pages: 3) {
-    MincoreResidencyAdmitted { residency: _ } => true
-    MincoreResidencyRefused { file: _, cause: _ } => false
-  }
-  let red = match mincore_file_residency(file: "rank0.engram" as NonEmptyStr, file_bytes: byte_size(count: 8193), page_bytes: byte_size(count: 4096), resident_pages: 4) {
-    MincoreResidencyRefused { file: _, cause: _ } => true
-    MincoreResidencyAdmitted { residency: _ } => false
-  }
-  ok && red
-}
-
-test fn memory_stat_reads_the_five_keys_and_names_a_missing_one() -> Bool {
-  let full = "anon 100\nfile 200\nkernel 5\nfile_mapped 50\nworkingset_refault_file 7\npgmajfault 9\n"
-  let read = match parse_cgroup_memory_stat(body: full) {
-    CgroupMemoryStatRead { stat: s } => byte_size_count(b: s.file) == 200 && s.pgmajfault == 9 && s.workingset_refault_file == 7
-    CgroupMemoryStatIncomplete { missing: _ } => false
-  }
-  let red = match parse_cgroup_memory_stat(body: "anon 100\nfile 200\nfile_mapped 50\npgmajfault 9\n") {
-    CgroupMemoryStatIncomplete { missing: m } => m == ["workingset_refault_file"]
-    CgroupMemoryStatRead { stat: _ } => false
-  }
-  read && red
-}
-
-// ── measurement 2 ──
-
-fn w_stat(refault: Nat, majfault: Nat) -> CgroupMemoryStat {
-  CgroupMemoryStat { anon: byte_size(count: 1), file: byte_size(count: 2), file_mapped: byte_size(count: 1), workingset_refault_file: refault, pgmajfault: majfault }
-}
-
-fn w_cell(phase: V41ResidencyPhase, rank: Nat) -> V41ResidencyCell {
-  V41ResidencyCell {
-    run_id: "run-1" as NonEmptyStr,
-    arm: EngramUpstreamPinned,
-    phase: phase,
-    rank: rank,
-    engram_files: [] as List<MincoreFileResidency>,
-    memory_current: byte_size(count: 1),
-    memory_stat: w_stat(refault: 0, majfault: 0),
-    memory_events: CgroupMemoryEvents { high_events: 0, max_events: 0, oom_kills: 0 },
-    memory_pressure: parse_psi(body: w_psi_before),
-    io_pressure: parse_psi(body: w_psi_before),
-    nvme: parse_diskstats(body: w_disk_before, device: "nvme0n1" as NonEmptyStr),
-    torch: Present { value: V41TorchMemory { free: byte_size(count: 1), reserved: byte_size(count: 1), allocated: byte_size(count: 1) } },
-  }
-}
-
-fn w_all_cells() -> List<V41ResidencyCell> {
-  flat_map([BeforeStart, AfterChecksum, AfterKvAllocation, AfterRequests], p => map(v41_measurement_ranks, k => w_cell(phase: p, rank: k)))
-}
-
-test fn a_complete_residency_timeline_is_admitted_and_a_missing_cell_is_named() -> Bool {
-  let ok = match v41_admit_residency_timeline(run_id: "run-1" as NonEmptyStr, arm: EngramUpstreamPinned, cells: w_all_cells()) {
-    ResidencyTimelineAdmitted { run_id: _, arm: _, cells: _ } => true
-    ResidencyTimelineRefused { causes: _ } => false
-  }
-  let holed = filter(w_all_cells(), c => !(c.rank == 2 && match c.phase { AfterChecksum => true  BeforeStart => false  AfterKvAllocation => false  AfterRequests => false }))
-  let red = match v41_admit_residency_timeline(run_id: "run-1" as NonEmptyStr, arm: EngramUpstreamPinned, cells: holed) {
-    ResidencyTimelineRefused { causes: cs } => cs == ["no cell for after-checksum rank 2"]
-    ResidencyTimelineAdmitted { run_id: _, arm: _, cells: _ } => false
-  }
-  ok && red
-}
-
-test fn a_cell_from_the_other_image_arm_refuses_the_timeline() -> Bool {
-  match v41_admit_residency_timeline(run_id: "run-1" as NonEmptyStr, arm: EngramFileBackedReleased, cells: w_all_cells()) {
-    ResidencyTimelineRefused { causes: cs } => length(cs) == 16
-    ResidencyTimelineAdmitted { run_id: _, arm: _, cells: _ } => false
-  }
-}
-
-// ── measurement 3 ──
-
-fn w_probe_rank(rank: Nat, observed: Bool, majfault_after: Nat) -> V41ProbeRankReading {
-  V41ProbeRankReading {
-    rank: rank,
-    lookup: if observed { EngramLookupObserved { distinct_pages_touched: 10, fetch_rows_calls: 3, fetch_rows_time: microsecond(count: 9) } } else { TouchCounterUnavailable { frontier: v41_touch_counter_frontier } },
-    residency_before: [] as List<MincoreFileResidency>,
-    residency_after: [] as List<MincoreFileResidency>,
-    stat_before: w_stat(refault: 0, majfault: 5),
-    stat_after: w_stat(refault: 0, majfault: majfault_after),
-    nvme_before: parse_diskstats(body: w_disk_before, device: "nvme0n1" as NonEmptyStr),
-    nvme_after: parse_diskstats(body: w_disk_after, device: "nvme0n1" as NonEmptyStr),
-  }
-}
-
-fn w_latency(ttft: Nat) -> ClientBenchLatency {
-  ClientBenchLatencyReported { output_throughput: milli_tokens_per_second(count: 1000), tpot_milli: millisecond(count: 50), itl_milli: none, ttft_milli: millisecond(count: ttft), window: ForeignTrafficNotObserved { drain: DrainObservedIdle } }
-}
-
-fn w_probe(context: Nat, concurrency: Nat, observed: Bool, majfault_after: Nat) -> V41ProbeReading {
-  V41ProbeReading {
-    run_id: "run-1" as NonEmptyStr,
-    cell: V41ProbeCell { context: token_count(count: context), concurrency: concurrency },
-    temperature: ProbeWarm,
-    prompts_disjoint: true,
-    prefix_caching_defeated: true,
-    latency: w_latency(ttft: 1000),
-    ranks: map(v41_measurement_ranks, k => w_probe_rank(rank: k, observed: observed, majfault_after: majfault_after)),
-  }
-}
-
-// TODAY'S STATE: no touch counter, so every probe refuses and the Engram-resident capacity refuses,
-// even though mincore residency and fault counters are present.
-test fn engram_resident_refuses_while_the_touch_counter_is_unavailable() -> Bool {
-  let probes = [w_probe(context: 32768, concurrency: 1, observed: false, majfault_after: 5), w_probe(context: 262144, concurrency: 1, observed: false, majfault_after: 5),
-                w_probe(context: 262144, concurrency: 2, observed: false, majfault_after: 5), w_probe(context: 262144, concurrency: 4, observed: false, majfault_after: 5),
-                w_probe(context: 262144, concurrency: 6, observed: false, majfault_after: 5)]
-  let c = v41_engram_resident_capacity(verdicts: map(probes, p => v41_judge_probe(p: p)))
-  contains(v41_capacity_wire(c: c), "distinct-touch counter is unavailable")
-}
-
-// ONCE THE COUNTER EXISTS: the largest 262k concurrency whose warm pass faulted nothing, stopping at
-// the first faulting cell.
-test fn engram_resident_is_the_last_warm_cell_without_major_faults() -> Bool {
-  let probes = [w_probe(context: 32768, concurrency: 1, observed: true, majfault_after: 5), w_probe(context: 262144, concurrency: 1, observed: true, majfault_after: 5),
-                w_probe(context: 262144, concurrency: 2, observed: true, majfault_after: 5), w_probe(context: 262144, concurrency: 4, observed: true, majfault_after: 90),
-                w_probe(context: 262144, concurrency: 6, observed: true, majfault_after: 5)]
-  v41_capacity_wire(c: v41_engram_resident_capacity(verdicts: map(probes, p => v41_judge_probe(p: p)))) == "x2"
-}
-
-// ── the staircase ──
-
-fn w_signed() -> V41PolicyStanding {
-  PolicyOperatorSigned {
-    policy: V41CapacityPolicy {
-      ttft_gate: V41TtftGate { context: token_count(count: 32768), ceiling: millisecond(count: 30000) }, tpot_ceiling: millisecond(count: 100),
-      psi_full_ceiling: basis_point(count: 1000), psi_window: microsecond(count: 60000000),
-      nvme_read_await_ceiling: microsecond(count: 5000), refault_growth_ceiling: basis_point(count: 15000),
-      production_pool_margin: basis_point(count: 1000),
-    },
-    ruling: "witness fixture, not the operator's policy" as NonEmptyStr,
-  }
-}
-
-fn w_step(c: Nat, preemptions: Nat) -> V41StaircaseStepReading {
-  V41StaircaseStepReading {
-    run_id: "run-1" as NonEmptyStr,
-    concurrency: c,
-    preemptions: Present { value: preemptions },
-    refault_file_before: 0,
-    refault_file_after: c * 100,
-    memory_pressure_before: parse_psi(body: w_psi_before),
-    memory_pressure_after: parse_psi(body: "some avg10=0.00 avg60=0.00 avg300=0.00 total=2000\nfull avg10=0.00 avg60=0.00 avg300=0.00 total=600\n"),
-    nvme_before: parse_diskstats(body: w_disk_before, device: "nvme0n1" as NonEmptyStr),
-    nvme_after: parse_diskstats(body: w_disk_after, device: "nvme0n1" as NonEmptyStr),
-    latency: w_latency(ttft: 1000),
-  }
-}
-
-fn w_policy(gate_context: Nat) -> V41CapacityPolicy {
-  V41CapacityPolicy {
-    ttft_gate: V41TtftGate { context: token_count(count: gate_context), ceiling: millisecond(count: 30000) }, tpot_ceiling: millisecond(count: 100),
-    psi_full_ceiling: basis_point(count: 1000), psi_window: microsecond(count: 60000000),
-    nvme_read_await_ceiling: microsecond(count: 5000), refault_growth_ceiling: basis_point(count: 15000),
-    production_pool_margin: basis_point(count: 1000),
-  }
-}
-
-fn w_step_ttft(c: Nat, ttft: Nat) -> V41StaircaseStepReading {
-  let s = w_step(c: c, preemptions: 0)
-  V41StaircaseStepReading {
-    run_id: s.run_id, concurrency: s.concurrency, preemptions: s.preemptions,
-    refault_file_before: s.refault_file_before, refault_file_after: s.refault_file_after,
-    memory_pressure_before: s.memory_pressure_before, memory_pressure_after: s.memory_pressure_after,
-    nvme_before: s.nvme_before, nvme_after: s.nvme_after,
-    latency: w_latency(ttft: ttft),
-  }
-}
-
-test fn the_staircase_refuses_while_the_policy_is_an_unsigned_proposal() -> Bool {
-  match v41_run_staircase(policy: PolicyProposed { proposal: w_policy(gate_context: 32768), reasons: "fixture" as NonEmptyStr }, run_id: "run-1" as NonEmptyStr, steps: map([1, 2, 4, 6, 8, 12, 16], c => w_step(c: c, preemptions: 0))) {
-    V41StaircasePolicyUnsigned { cause: _ } => true
-    V41StaircaseRan { outcome: _ } => false
-  }
-}
-
-// THE SIGNED POLICY RECORDS TTFT AT 262k AND DOES NOT STOP ON IT: a 120 s prefill at every step
-// completes the staircase at x16. The discriminating control is the same readings under a gate that
-// covers 262k, which stops at x1 on TTFT -- so the completion is the gate's scope, not a TTFT the
-// fold ignores.
-test fn the_signed_policy_records_ttft_at_262k_without_stopping_on_it() -> Bool {
-  let steps = map([1, 2, 4, 6, 8, 12, 16], c => w_step_ttft(c: c, ttft: 120000))
-  let signed = match v41_run_staircase(policy: v41_capacity_policy, run_id: "run-1" as NonEmptyStr, steps: steps) {
-    V41StaircaseRan { outcome: StaircaseCompleted { last_sustained: l } } => l == 16
-    V41StaircaseRan { outcome: StaircaseStopped { last_sustained: _, stop: _ } } => false
-    V41StaircaseRan { outcome: StaircaseRefused { refusal: _ } } => false
-    V41StaircasePolicyUnsigned { cause: _ } => false
-  }
-  let covering = match v41_run_staircase(policy: PolicyOperatorSigned { policy: w_policy(gate_context: 262144), ruling: "fixture" as NonEmptyStr }, run_id: "run-1" as NonEmptyStr, steps: steps) {
-    V41StaircaseRan { outcome: StaircaseStopped { last_sustained: l, stop: st } } => match l { Absent => true  Present { value: _ } => false } && match st { StopSloBreach { concurrency: c, which: w, observed: _ } => c == 1 && (w as String) == "ttft"  StopKvPreemption { concurrency: _, preemptions: _ } => false  StopSuperlinearRefault { concurrency: _, per_request: _, previous_per_request: _ } => false  StopPsiFullSustained { concurrency: _, stalled: _, window: _ } => false  StopNvmeLatency { concurrency: _, mean_read_await: _ } => false  StopReadingMissing { concurrency: _, cause: _ } => false }
-    V41StaircaseRan { outcome: StaircaseCompleted { last_sustained: _ } } => false
-    V41StaircaseRan { outcome: StaircaseRefused { refusal: _ } } => false
-    V41StaircasePolicyUnsigned { cause: _ } => false
-  }
-  signed && covering
-}
-
-test fn the_staircase_stops_at_the_first_kv_preemption() -> Bool {
-  let steps = [w_step(c: 1, preemptions: 0), w_step(c: 2, preemptions: 0), w_step(c: 4, preemptions: 0), w_step(c: 6, preemptions: 0), w_step(c: 8, preemptions: 3), w_step(c: 12, preemptions: 9)]
-  let o = v41_run_staircase(policy: w_signed(), run_id: "run-1" as NonEmptyStr, steps: steps)
-  let stopped_at_8 = match o {
-    V41StaircaseRan { outcome: StaircaseStopped { last_sustained: _, stop: s } } => match s { StopKvPreemption { concurrency: c, preemptions: p } => c == 8 && p == 3  StopReadingMissing { concurrency: _, cause: _ } => false  StopSuperlinearRefault { concurrency: _, per_request: _, previous_per_request: _ } => false  StopPsiFullSustained { concurrency: _, stalled: _, window: _ } => false  StopNvmeLatency { concurrency: _, mean_read_await: _ } => false  StopSloBreach { concurrency: _, which: _, observed: _ } => false }
-    V41StaircaseRan { outcome: StaircaseCompleted { last_sustained: _ } } => false
-    V41StaircaseRan { outcome: StaircaseRefused { refusal: _ } } => false
-    V41StaircasePolicyUnsigned { cause: _ } => false
-  }
-  stopped_at_8 && v41_capacity_wire(c: v41_sla_capacity(o: o)) == "x6"
-}
-
-test fn a_hole_in_the_staircase_refuses_the_sla_capacity_above_it() -> Bool {
-  let steps = [w_step(c: 1, preemptions: 0), w_step(c: 4, preemptions: 0)]
-  contains(v41_capacity_wire(c: v41_sla_capacity(o: v41_run_staircase(policy: w_signed(), run_id: "run-1" as NonEmptyStr, steps: steps))), "a reading is missing at x2")
-}
-
-// ── the report as V4.1's workload calibration (production admission is gunbc.spark.serving_promotion) ──
-
-test fn the_report_projects_the_minimum_of_three_capacities_and_leaves_unobserved_counts_absent() -> Bool {
-  let all = V41CapacityReport { run_id: "run-1" as NonEmptyStr, kv_admission: CapacityAt { concurrency: 6 }, engram_resident: CapacityAt { concurrency: 4 }, sla_sustainable: CapacityAt { concurrency: 8 }, indexer_kernel: ExtensionLoaded }
-  match v41_calibration_receipt(report: all, subject_key: w_v41_key(), trace_digest: content_hash_of_value(value: "fixture-trace" as NonEmptyStr)) {
-    V41CalibrationRefused { cause: _ } => false
-    V41CalibrationProjected { receipt: r } =>
-      r.sustained_concurrency == 4
-        && (match r.preemptions { Absent => true  Present { value: _ } => false })
-        && (match r.accepted_turns { Absent => true  Present { value: _ } => false })
-  }
-}
-
-test fn a_refused_capacity_refuses_the_projection_and_names_it() -> Bool {
-  let today = V41CapacityReport { run_id: "run-1" as NonEmptyStr, kv_admission: CapacityAt { concurrency: 6 }, sla_sustainable: CapacityAt { concurrency: 8 }, engram_resident: CapacityRefused { cause: "the distinct-touch counter is unavailable" as NonEmptyStr }, indexer_kernel: ExtensionLoaded }
-  match v41_calibration_receipt(report: today, subject_key: w_v41_key(), trace_digest: content_hash_of_value(value: "fixture-trace" as NonEmptyStr)) {
-    V41CalibrationRefused { cause: c } => contains(c as String, "Engram resident")
-    V41CalibrationProjected { receipt: _ } => false
-  }
-}
-
-test fn the_dry_run_plan_renders_the_derived_thresholds_and_the_open_preconditions() -> Bool {
-  let t = v41_capacity_measurement_plan_text()
-  contains(t, "x6 needs 1572864 tokens, x16 needs 4194304")
-    && contains(t, "engram arms: A-upstream-pinned")
-    && contains(t, "TouchCounterUnavailable")
-    && contains(t, "staircase policy: signed")
-}
-
-// THE ENGRAM POINT BETS ARE JUDGED IN BYTES AGAINST THE AFTER-REQUESTS RESIDENCY, and a refused
-// timeline leaves them unreadable rather than zero.
-test fn an_engram_bet_is_paired_with_the_after_requests_residency_in_bytes() -> Bool {
-  let timeline = v41_admit_residency_timeline(run_id: "run-1" as NonEmptyStr, arm: EngramUpstreamPinned, cells: w_all_cells())
-  match list_at_optional(xs: v41_engram_resident_bets, index: 0) {
-    Absent => false
-    Present { value: bet } => {
-      let observed = match v41_judge_engram_resident_bet(bet: bet, observed: v41_after_requests_resident(t: timeline, rank: 0)) {
-        PointBetObserved { concurrency: c, bet: b, observed: o } => c == 2 && byte_size_count(b: b) == 19 * 1073741824 && byte_size_count(b: o) == 0
-        PointBetUnreadable { concurrency: _, cause: _ } => false
-      }
-      let refused = v41_admit_residency_timeline(run_id: "run-1" as NonEmptyStr, arm: EngramFileBackedReleased, cells: w_all_cells())
-      let unreadable = match v41_judge_engram_resident_bet(bet: bet, observed: v41_after_requests_resident(t: refused, rank: 0)) {
-        PointBetUnreadable { concurrency: _, cause: _ } => true
-        PointBetObserved { concurrency: _, bet: _, observed: _ } => false
-      }
-      observed && unreadable
-    }
-  }
-}
-
-// A FAILED DeepSelect IMPORT IS RECORDED AND ADMITTED; A RANK WHOSE LOG WAS NOT READ FOR IT REFUSES.
-test fn a_deepselect_import_failure_is_recorded_and_an_unobserved_one_refuses() -> Bool {
-  let r = w_rank(rank: 0, tokens: 2000000, rev: w_rev())
-  let recorded = match v41_admit_rank_startup(r: r) {
-    RankStartupAdmitted { receipt: x } => match x.deepselect { ExtensionImportFailed { logged: _ } => true  ExtensionLoaded => false  ExtensionUnobserved => false }
-    RankStartupRefused { rank: _, missing: _ } => false
-  }
-  let unread = V41RankStartupReading {
-    run_id: r.run_id, rank: r.rank, host: r.host, image: r.image, vllm_revision: r.vllm_revision,
-    parallelism: r.parallelism, kv_format: r.kv_format, block_size: r.block_size,
-    max_model_len: r.max_model_len, max_num_seqs: r.max_num_seqs, max_num_batched_tokens: r.max_num_batched_tokens,
-    spec_decode_config: r.spec_decode_config, memory: r.memory, reported: r.reported,
-    num_gpu_blocks: r.num_gpu_blocks, kv_cache_groups: r.kv_cache_groups, deepselect: ExtensionUnobserved,
-  }
-  let refused = match v41_admit_rank_startup(r: unread) {
-    RankStartupRefused { rank: _, missing: m } => m == ["DeepSelect extension import (vllm._deepselect_C)"]
-    RankStartupAdmitted { receipt: _ } => false
-  }
-  recorded && refused
-}
-
-// ARM A RESOLVES FROM ITS IMAGE CONFIG DIGEST; THE FIXTURE IMAGE, WHICH NO BINDING NAMES, HAS NO ARM.
-test fn the_engram_arm_is_read_off_the_image_config_digest() -> Bool {
-  let arm_a_image = v41_oci_image_digest(
-    manifest: OciSha256Digest(Sha256Digest { hex: "3333333333333333333333333333333333333333333333333333333333333333" as Sha256DigestHex }),
-    config: OciSha256Digest(Sha256Digest { hex: "ea39410ed01d396caad86339d877c1adb181a983baadffd22c722069109ea664" as Sha256DigestHex }),
-  )
-  let a = match v41_engram_arm_of(image: arm_a_image, bindings: v41_engram_arm_bindings) {
-    Present { value: arm } => match arm { EngramUpstreamPinned => true  EngramFileBackedReleased => false }
-    Absent => false
-  }
-  let none_bound = match v41_engram_arm_of(image: w_image(), bindings: v41_engram_arm_bindings) {
-    Present { value: _ } => false
-    Absent => true
-  }
-  a && none_bound
-}
-
-// THE REPORT NAMES THE INDEXER KERNEL ITS NUMBERS RAN ON: a failed DeepSelect import on the ranks
-// reaches the report with its logged line, and a refused startup receipt leaves it unobserved.
-test fn the_capacity_report_carries_the_indexer_kernel_standing() -> Bool {
-  let signed_empty = v41_run_staircase(policy: w_signed(), run_id: "run-1" as NonEmptyStr, steps: [] as List<V41StaircaseStepReading>)
-  let failed = match v41_capacity_report(run_id: "run-1" as NonEmptyStr, startup: v41_admit_startup(readings: w_four_ranks()), probes: [] as List<V41ProbeReading>, staircase: signed_empty).indexer_kernel {
-    ExtensionImportFailed { logged: l } => contains(l as String, "_deepselect_C")
-    ExtensionLoaded => false
-    ExtensionUnobserved => false
-  }
-  let three = filter(w_four_ranks(), r => r.rank != 3)
-  let unobserved = match v41_capacity_report(run_id: "run-1" as NonEmptyStr, startup: v41_admit_startup(readings: three), probes: [] as List<V41ProbeReading>, staircase: signed_empty).indexer_kernel {
-    ExtensionUnobserved => true
-    ExtensionLoaded => false
-    ExtensionImportFailed { logged: _ } => false
-  }
-  failed && unobserved
-}
-
-// THE LAUNCH SHAPE IS THE PLAN'S: max_num_seqs is the largest staircase concurrency, max_model_len the
-// plan's context, and the two measurement axes are the declared values.
-test fn the_launch_shape_derives_from_the_plan() -> Bool {
-  let l = v41_measurement_launch_shape()
-  l.max_num_seqs == 16 && token_count_value(t: l.max_model_len) == 262144
-    && token_count_value(t: l.max_num_batched_tokens) == 8192 && basis_point_count(bp: l.gpu_memory_utilization) == 8000
-    && match l.prefix_caching { PrefixCachingExplicit { enabled: e } => !e  PrefixCachingOmitted => false }
-}
-
-// ARM B RESOLVES FROM THE PRODUCTION IMAGE'S CONFIG DIGEST.
-test fn arm_b_is_the_production_image() -> Bool {
-  let prod = v41_oci_image_digest(
-    manifest: OciSha256Digest(Sha256Digest { hex: "3333333333333333333333333333333333333333333333333333333333333333" as Sha256DigestHex }),
-    config: OciSha256Digest(Sha256Digest { hex: "5de3c35577e5c8f3026c143d3d5b2d66cc527119281369f4651d969f581829d3" as Sha256DigestHex }),
-  )
-  match v41_engram_arm_of(image: prod, bindings: v41_engram_arm_bindings) {
-    Present { value: arm } => match arm { EngramFileBackedReleased => true  EngramUpstreamPinned => false }
-    Absent => false
-  }
-}
-
-// THE PROJECTION'S SUBJECT IS SUPPLIED: the claim is about how the report becomes a receipt, not about
-// which subject V4.1 launches, so a fixture subject keys it.
-fn w_v41_key() -> ServingSubjectKey {
-  serving_subject_key(s: serving_performance_subject(
-    checkpoint: DeepseekV41FlashDba1be0a, checkpoint_revision: Absent, runtime: GunbcSparkrunVllmDs4Gb10,
-    runtime_image_reference: "fixture@sha256:0" as NonEmptyStr, topology: Absent, rank_population: Absent,
-    context_ceiling: Absent, max_num_batched_tokens: token_count(count: 8192), max_num_seqs: Absent,
-    kv_cache_dtype: Absent, speculative: Absent, collective_transport: Absent, indexer_kv_dtype: Absent,
-    scheduler_admission: Absent, launch_profile_key: Absent, deployment_env_key: Present { value: "env=none" } ))
-}
diff --git a/dag/test/claim/spark/v41_checkpoint_materialize_witness_test.dag b/dag/test/claim/spark/v41_checkpoint_materialize_witness_test.dag
deleted file mode 100644
index 9f086832008..00000000000
--- a/dag/test/claim/spark/v41_checkpoint_materialize_witness_test.dag
+++ /dev/null
@@ -1,272 +0,0 @@
-module test.claim.spark.v41_checkpoint_materialize_witness
-
-import std.types { Bool, String, List, NonEmptyStr }
-import std.nat { Nat }
-import std.measure { byte_size, byte_size_count }
-import std.optional { Present, Absent }
-import product.host_identity { HostIdentity }
-import extdeps.deepseek.deepseek_v4_1_flash { DeepseekV41PublishedFile, deepseek_v4_1_flash_safetensors_tree_file_bytes }
-import gunbc.artifact_acquisition {
-  ContentDigestSha256, UpstreamRevision, SourceArgv, SourceUrl, AcquisitionSource, AcquisitionFoldState, AttemptRejected,
-  acquisition_fold_step, acquisition_exhausted, AcquisitionRefused, AcquisitionAlreadyPresent, AcquisitionFetched, acquisition_refusal_text,
-  acquisition_key_wire,
-}
-import gunbc.spark.model_snapshot_materialize { spark_transfer_unit_for }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
-import gunbc.spark.serving_subject { PairServingUnitOn }
-import gunbc.spark.host_commitment { spark_serving_admissible_hosts, admit_host_held_by_subject_among }
-import gunbc.spark.v41_engram_row_store { V41PublishedSpan }
-import gunbc.sha256sum_byte_span { sha256sum_byte_span_program, sha256sum_byte_span_argv_of }
-import gunbc.spark.v41_index_engram_selection { V41IndexParsed, V41IndexParseRefused }
-import extdeps.safetensors.format { safetensors_index_member }
-import extdeps.linux.cgroup_v2_memory { CgroupMemoryLevelRead, CgroupMemoryLimited, CgroupMemoryUnlimited }
-import gunbc.spark.v41_checkpoint_materialize {
-  V41CheckpointPopulation, V41CheckpointPopulationAdmitted, V41CheckpointPopulationRefused,
-  v41_checkpoint_population, v41_checkpoint_bytes, v41_checkpoint_subject, v41_required_bytes,
-  v41_span_read_argv, v41_checkpoint_directory,
-  V41SpanReadOutcome, V41SpanPlanRefused, v41_span_line, v41_span_is_read,
-  V41MemoryFenced, V41MemoryUnfenced, v41_memory_fence_lines,
-  V41IndexSelectionOutcome, V41IndexSelectionRead, V41IndexSelectionUnread, v41_index_selection_lines, v41_index_selection_is_read, v41_wc_bytes,
-}
-
-// THE MODE'S PURE DECISIONS, OVER THE REAL ADMITTED POPULATION. Nothing here reaches a host: the
-// host legs are the mode's to run (fleet-converge spark_v41_checkpoint_materialize), and these rows
-// establish what it will ask for and what it refuses before it asks.
-
-fn w_files() -> List<DeepseekV41PublishedFile> {
-  match v41_checkpoint_population() {
-    V41CheckpointPopulationAdmitted { files: f } => f
-    V41CheckpointPopulationRefused { defects: _ } => [] as List<DeepseekV41PublishedFile>
-  }
-}
-
-fn w_file(path: String) -> List<DeepseekV41PublishedFile> {
-  filter(w_files(), f => (f.path as String) == path)
-}
-
-// THE POPULATION IS 48 SHARDS, THE INDEX AND THREE TOKENIZER FILES, and its shard bytes are the
-// publisher's tree total -- the disk requirement is derived from these rows, never transcribed.
-test fn the_admitted_population_is_the_shards_the_index_and_the_tokenizer() -> Bool {
-  let fs = w_files()
-  let shards = filter(fs, f => (f.path as String).ends_with(".safetensors"))
-  length(fs) == 52 && length(shards) == 48
-    && byte_size_count(b: v41_checkpoint_bytes(files: shards)) == byte_size_count(b: deepseek_v4_1_flash_safetensors_tree_file_bytes)
-    && length(w_file(path: "model.safetensors.index.json")) == 1
-    && length(w_file(path: "encoding/encoding.py")) == 1
-}
-
-// EACH SUBJECT IS KEYED BY THE MANIFEST ROW'S SHA256, lands under the pinned-revision directory, stages
-// beside it, and offers the Hub cache copy before the resolve URL at the pinned revision.
-test fn a_subject_carries_the_rows_digest_and_the_pinned_route() -> Bool {
-  match first(w_file(path: "encoding/encoding.py")) {
-    Absent => false
-    Present { value: f } => {
-      let s = v41_checkpoint_subject(file: f)
-      let key_ok = match s.key {
-        ContentDigestSha256 { hex: h } => (h as String) == (f.sha256.hex as String)
-        UpstreamRevision { revision: _ } => false
-      }
-      let url_ok = match get(xs: s.sources, index: 1) {
-        Absent => false
-        Present { value: src } => match src.locator {
-          SourceArgv { argv: a } => any(a, w => w == "https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash/resolve/dba1be0a40aa45a94ad051997016db3960a90277/encoding/encoding.py")
-          SourceUrl { url: _ } => false
-        }
-      }
-      key_ok && url_ok && length(s.sources) == 2
-        && (s.install_path as String) == join([v41_checkpoint_directory as String, "/encoding/encoding.py"], "")
-        && (s.parent_directory as String) == join([v41_checkpoint_directory as String, "/encoding"], "")
-    }
-  }
-}
-
-// THE TWO-ROW POPULATION THE LISTING CASES JOIN AGAINST. It is the REAL admitted population narrowed
-// to two rows, not a fixture: the 52-row shape is the previous claim's subject, and each case below
-// discriminates at the listing join and nothing else (DESIGN section 3, a witness discriminates at one
-// interface). The narrowing is what keeps three independent listings from costing three whole-
-// population folds.
-fn w_two_rows() -> List<DeepseekV41PublishedFile> {
-  filter(w_files(), f => (f.path as String) == "tokenizer.json" || (f.path as String) == "encoding/encoding.py")
-}
-
-fn w_listing_at_size(fs: List<DeepseekV41PublishedFile>) -> List<String> {
-  map(fs, f => join([to_string(byte_size_count(b: f.file_bytes)), " ", f.path as String], ""))
-}
-
-// THE THREE LISTING CASES ARE THREE WITNESSES, NOT THREE CONJUNCTS. As one claim they forced three
-// independent listings through one budget -- the required floor measured 113,763 eval steps against
-// the 72,300 new-witness budget and refused. Splitting loses no coverage, because no case reads
-// another's value, and it buys what the conjunction could not give: a regression in the one-short arm
-// now fails under its own name instead of reading as the same single failure as the all-present arm.
-test fn the_disk_requirement_is_the_whole_population_when_nothing_is_present() -> Bool {
-  let fs = w_two_rows()
-  length(fs) == 2
-    && byte_size_count(b: v41_required_bytes(files: fs, listing: [] as List<String>)) == byte_size_count(b: v41_checkpoint_bytes(files: fs))
-}
-
-// EVERYTHING PRESENT AT ITS DECLARED SIZE NEEDS NONE OF IT: the listing names the same rows at the
-// same sizes, so the requirement is zero rather than merely small.
-test fn the_disk_requirement_is_zero_when_every_file_is_present_at_size() -> Bool {
-  let fs = w_two_rows()
-  length(fs) == 2
-    && byte_size_count(b: v41_required_bytes(files: fs, listing: w_listing_at_size(fs: fs))) == 0
-}
-
-// ONE FILE AT THE WRONG SIZE NEEDS EXACTLY THAT FILE -- not the whole population and not nothing, so
-// the SIZE is compared and not merely the name. The tok > 0 conjunct is the control: a row whose
-// tokenizer.json were zero bytes would make the equality true for the wrong reason.
-test fn the_disk_requirement_counts_only_the_file_at_the_wrong_size() -> Bool {
-  let fs = w_two_rows()
-  let one_short = map(fs, f => if (f.path as String) == "tokenizer.json" { "1 tokenizer.json" } else { join([to_string(byte_size_count(b: f.file_bytes)), " ", f.path as String], "") })
-  let tok = match first(filter(fs, f => (f.path as String) == "tokenizer.json")) { Present { value: t } => byte_size_count(b: t.file_bytes)  Absent => 0 }
-  length(fs) == 2
-    && byte_size_count(b: v41_required_bytes(files: fs, listing: one_short)) == tok
-    && tok > 0
-}
-
-// ONLY A HOST THE GROUP A PAIR SUBJECT HOLDS IS ADMITTED, read through the real admissibility.
-test fn only_a_group_a_host_is_admitted() -> Bool {
-  let held = spark_serving_admissible_hosts(subject: PairServingUnitOn { group: FabricGroupA })
-  length(held) == 4
-    && (match admit_host_held_by_subject_among(subject: PairServingUnitOn { group: FabricGroupA }, raw: "srv5" as HostIdentity, held: held) { Absent => true  Present { value: _ } => false })
-    && (match admit_host_held_by_subject_among(subject: PairServingUnitOn { group: FabricGroupA }, raw: "srv8" as HostIdentity, held: held) { Absent => true  Present { value: _ } => false })
-    && (match admit_host_held_by_subject_among(subject: PairServingUnitOn { group: FabricGroupA }, raw: "srv9" as HostIdentity, held: held) { Absent => false  Present { value: why } => why.contains("is not held by pair-unit@") })
-    && (match admit_host_held_by_subject_among(subject: PairServingUnitOn { group: FabricGroupA }, raw: "srv1" as HostIdentity, held: held) { Absent => false  Present { value: _ } => true })
-}
-
-// THE SPAN READ PUTS ITS OPERANDS IN THEIR DECLARED SLOTS. The subject is how
-// sha256sum_byte_span_argv_of ASSEMBLES the list, which is not a fact about the serializer -- so the
-// program is a SUPPLIED value here. Forcing the real one to read index 4 would pay a 204k-eval-step
-// render this claim never inspects, which is DESIGN section 3's tell verbatim: a claim dominated by
-// one call whose result shape is all it looks at. The RED is authorable and it is the real defect --
-// any permutation of the seven slots fails this, where length(argv)==7 would stay green through all
-// of them.
-test fn the_span_read_puts_its_operands_in_their_declared_slots() -> Bool {
-  sha256sum_byte_span_argv_of(program: "P", path: "/m/s.safetensors", offset: "664", length: "98305579008")
-    == ["bash", "-c", "P", "bash", "/m/s.safetensors", "664", "98305579008"]
-}
-
-// INHABITANCE: the REAL producer emits that shape, with the REAL serialized program in the slot the
-// claim above supplies. This is the claim that pays the serialization, once, and it asserts the ROUTE
-// and not only the shape -- deleting the integration makes it fail (DESIGN section 3, the pairing
-// obligation: supplying inputs may never remove the last execution of the real path).
-test fn the_span_read_reads_exactly_its_region() -> Bool {
-  v41_span_read_argv(sp: V41PublishedSpan { tensor: "layers.1.engram.embed.weight" as NonEmptyStr, shard: "model-00047-of-00048.safetensors" as NonEmptyStr, file_offset: byte_size(count: 664), length: byte_size(count: 98305579008) })
-    == sha256sum_byte_span_argv_of(
-         program: sha256sum_byte_span_program,
-         path: join([v41_checkpoint_directory as String, "/model-00047-of-00048.safetensors"], ""),
-         offset: "664",
-         length: "98305579008")
-}
-
-// AN UNPLANNABLE SPAN PLAN IS CARRIED INTO THE RECEIPT, NOT DROPPED: its defects are the line, and the
-// run is not a success on it.
-test fn a_refused_span_plan_reaches_the_receipt() -> Bool {
-  let refused = V41SpanPlanRefused { defects: ["storage-backed tensor layers.1.engram.embed.weight is not exactly one header row" as NonEmptyStr] }
-  v41_span_line(o: refused).contains("span-plan-refused: storage-backed tensor layers.1.engram.embed.weight")
-    && !v41_span_is_read(o: refused)
-}
-
-// THE INDEX SELECTION'S RECEIPT CARRIES EVERY FIELD THE READING ROW NEEDS. The parse result is SUPPLIED:
-// this claim is about the receipt lines, and the parse fold has its own claims in
-// test.claim.spark.v41_index_engram_selection_witness. An unread index is a located line and not a success.
-test fn the_index_selection_receipt_carries_the_reading() -> Bool {
-  let parsed = V41IndexParsed { name_count: 2, members: [safetensors_index_member(name: "layers.1.engram.q_weight" as NonEmptyStr, shard: "model-00047-of-00048.safetensors" as NonEmptyStr)] }
-  let read = V41IndexSelectionRead { sha256_hex: "ab", bytes: byte_size(count: 7), parse: parsed }
-  let lines = v41_index_selection_lines(o: read)
-  lines.contains("index-selection sha256=ab bytes=7 names=2 selector=.engram.")
-    && lines.contains("index-selection member layers.1.engram.q_weight model-00047-of-00048.safetensors")
-    && v41_index_selection_is_read(o: read)
-    && !v41_index_selection_is_read(o: V41IndexSelectionUnread { cause: "fixture" as NonEmptyStr })
-    && !v41_index_selection_is_read(o: V41IndexSelectionRead { sha256_hex: "ab", bytes: byte_size(count: 7), parse: V41IndexParseRefused { cause: "fixture" as NonEmptyStr } })
-}
-
-// THE FENCE IS IN THE RECEIPT: the tightest hard limit with its directory, or a located refusal carrying
-// every level read -- so the run that parses is also the proof of what bounded it.
-test fn the_memory_fence_reaches_the_index_receipt() -> Bool {
-  let levels = [CgroupMemoryLevelRead { dir: "/sys/fs/cgroup/x" as NonEmptyStr, max: CgroupMemoryUnlimited, high: CgroupMemoryLimited { bytes: byte_size(count: 25) } }]
-  let refused = v41_memory_fence_lines(f: V41MemoryUnfenced { cause: "no hard memory.max binds this process" as NonEmptyStr, levels: levels })
-  let fenced = v41_memory_fence_lines(f: V41MemoryFenced { dir: "/sys/fs/cgroup/x" as NonEmptyStr, bytes: byte_size(count: 26), levels: levels })
-  refused.contains("memory-fence refused: no hard memory.max binds this process")
-    && refused.contains("memory-fence level /sys/fs/cgroup/x memory.max=max memory.high=25")
-    && fenced.contains("memory-fence hard memory.max=26 at /sys/fs/cgroup/x")
-}
-
-// THE DIRECTORY IS THE REPO'S CACHE NAME AND THE PIN, derived rather than spelled.
-test fn the_checkpoint_directory_is_derived_from_the_repo_and_the_pin() -> Bool {
-  (v41_checkpoint_directory as String) == "/home/briansrls/models/models--deepseek-ai--DeepSeek-V4.1-Flash/dba1be0a40aa45a94ad051997016db3960a90277"
-}
-
-// THE SIZE READ REFUSES RATHER THAN WIDENS: wc output that is not a count is no size at all.
-test fn an_unreadable_index_size_is_no_size() -> Bool {
-  (match v41_wc_bytes(out: "7470294 /x/model.safetensors.index.json") { Present { value: b } => byte_size_count(b: b) == 7470294  Absent => false })
-    && (match v41_wc_bytes(out: "") { Present { value: _ } => false  Absent => true })
-    && (match v41_wc_bytes(out: "wc: /x: No such file") { Present { value: _ } => false  Absent => true })
-}
-
-// ── THE TRANSFER UNIT'S NAME IS A VALID SYSTEMD UNIT NAME FOR EVERY FILE IN THE POPULATION ──────
-//
-// systemd refuses a unit name longer than 255 characters including its `.service` suffix. The first
-// dispatched run (fleet-converge 35806250877, srv5) had systemd-run refuse all 48 shards and accept
-// the index and tokenizer files, because the name carried the whole destination and a shard's came to
-// 260. The subject here is the REAL shard subject the mode builds, not a designed one.
-fn w_shard_subject_name() -> String {
-  match first(w_file(path: "model-00001-of-00048.safetensors")) {
-    Absent => ""
-    Present { value: f } => spark_transfer_unit_for(subject: v41_checkpoint_subject(file: f)) as String
-  }
-}
-
-test fn a_shard_transfer_unit_name_fits_systemd_with_its_suffix() -> Bool {
-  let n = w_shard_subject_name()
-  length(n) != 0 && length(join([n, ".service"], "")) <= 255
-}
-
-fn w_old_segment(x: String) -> String {
-  join(["-", join(split(x, "/"), "-")], "")
-}
-
-// THE RED INPUT, KEPT ENROLLED: the construction that failed on srv5 -- identity, key and destination
-// carried whole -- really is over the bound for this subject. If the published paths ever shortened
-// enough to pass it, this claim would say so rather than the fix above silently looking unnecessary.
-test fn the_whole_tuple_name_this_replaced_is_over_the_bound_for_a_shard() -> Bool {
-  match first(w_file(path: "model-00001-of-00048.safetensors")) {
-    Absent => false
-    Present { value: f } => {
-      let s = v41_checkpoint_subject(file: f)
-      let old = join(["gunbc-materialize", w_old_segment(x: s.identity as String), w_old_segment(x: acquisition_key_wire(key: s.key) as String), w_old_segment(x: s.install_path as String), ".service"], "")
-      length(old) > 255
-    }
-  }
-}
-
-// DIFFERENT FILES GET DIFFERENT UNITS: the digest keeps the tuple's discrimination, which is what lets
-// a rerun reattach to THIS file's transfer and never another's.
-test fn two_files_get_two_transfer_units() -> Bool {
-  match first(w_file(path: "model-00002-of-00048.safetensors")) {
-    Absent => false
-    Present { value: f } => (spark_transfer_unit_for(subject: v41_checkpoint_subject(file: f)) as String) != w_shard_subject_name()
-  }
-}
-
-// ── A REJECTED TRANSFER'S DETAIL REACHES THE REFUSAL ────────────────────────────────────────────
-//
-// The same srv5 run's receipt read "each REJECTED the transfer command itself" and nothing else: the
-// fold matched `AttemptRejected { detail: _ }`, so systemd-run's own stderr, which named the cause,
-// was dropped one step before it would have been printed.
-test fn a_rejected_transfer_names_its_source_and_detail_in_the_refusal() -> Bool {
-  match first(w_file(path: "tokenizer.json")) {
-    Absent => false
-    Present { value: f } => {
-      let subject = v41_checkpoint_subject(file: f)
-      let origin = AcquisitionSource { identity: "huggingface-resolve" as NonEmptyStr, locator: SourceArgv { argv: ["curl"] } }
-      let init = AcquisitionFoldState { terminal: none, reached_count: 0, saw_failed_key: false, rejections: [] as List<NonEmptyStr> }
-      let folded = acquisition_fold_step(acc: init, origin: origin, attempt: AttemptRejected { detail: "systemd-run exited 1: Invalid unit name" as NonEmptyStr })
-      match acquisition_exhausted(subject: subject, state: folded) {
-        AcquisitionRefused { cause: c } => string_contains(s: acquisition_refusal_text(cause: c), pattern: "huggingface-resolve: systemd-run exited 1: Invalid unit name")
-        AcquisitionAlreadyPresent { identity: _, install_path: _ } => false
-        AcquisitionFetched { identity: _, install_path: _, source: _ } => false
-      }
-    }
-  }
-}
diff --git a/dag/test/claim/spark/v41_engram_differential_witness_test.dag b/dag/test/claim/spark/v41_engram_differential_witness_test.dag
deleted file mode 100644
index 2c97edda949..00000000000
--- a/dag/test/claim/spark/v41_engram_differential_witness_test.dag
+++ /dev/null
@@ -1,128 +0,0 @@
-module test.claim.spark.v41_engram_differential_witness
-
-import std.types { Bool, List, NonEmptyStr, String }
-import std.measure { byte_size_count, byte_size }
-import std.optional { Present, Absent }
-import v2.std.algebra { filter }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import extdeps.container.oci.digest { render_oci_content_digest_wire }
-import gunbc.spark.v41_engram_differential_run {
-  V41DifferentialImage, DifferentialImageBuilt, ImageLacksEngramOverlay, v41_differential_image,
-  V41DifferentialOutcome, V41DifferentialRead, V41DifferentialRefused, v41_admit_differential, V41StoreKey,
-  V41HostOccupancy, V41HostFree, V41HostOccupied, v41_judge_occupancy, v41_differential_argv,
-}
-import gunbc.spark.v41_engram_store_manifest { V41EngramStoreManifest, V41StoreManifestDerived, V41StoreManifestRefused, v41_engram_store_manifest }
-import gunbc.spark.v41_engram_row_store {
-  V41PublishedStoreReadings, V41PublishedStoresRead, V41PublishedStoresUnread, V41ObservedRankStore, v41_rank_store_identity,
-  V41RowStoreEncodingSpec, v41_encoding_spec_of_layers, v41_layer_table, v41_row_geometry_of,
-}
-import gunbc.spark.v41_runtime_candidate { v41_candidate_partition }
-import extdeps.safetensors.format { SafeF8E4M3, SafeF8E8M0 }
-import extdeps.vllm.engram_layout { vllm_engram_rank_rows }
-import std.content_hash { Sha256Digest, Sha256DigestHex }
-import std.nat { Nat }
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-// THE DIFFERENTIAL RUNS FROM THE PRODUCTION IMAGE, which carries the overlay: the binding names its config
-// digest and the build run that produced it.
-test fn the_differential_image_is_the_production_image() -> Bool {
-  match v41_differential_image {
-    DifferentialImageBuilt { image: p } => render_oci_content_digest_wire(d: p.config) == "sha256:5de3c35577e5c8f3026c143d3d5b2d66cc527119281369f4651d969f581829d3" && (p.receipt_run as String) == "36327364664"
-    ImageLacksEngramOverlay { trigger: _ } => false
-  }
-}
-
-data w_owed: List<V41StoreKey> = [V41StoreKey { layer: 1, rank: 0 }, V41StoreKey { layer: 1, rank: 1 }]
-data w_equal: String = "DIFFERENTIAL 1 0 rows_sampled 4096 owned 8600 unowned_below 1200 out_of_range 2400 absent_heads 4096 equal\nDIFFERENTIAL 1 1 rows_sampled 4096 owned 8580 unowned_below 1230 out_of_range 2390 absent_heads 4096 equal\nDIFFERENTIAL_DONE failures 0\n"
-
-test fn an_all_equal_differential_over_every_owed_store_is_admitted() -> Bool {
-  match v41_admit_differential(image_config: "sha256:ea39" as NonEmptyStr, owed: w_owed, stdout: w_equal) {
-    V41DifferentialRead { image_config: _, stores: ds } => length(ds) == 2 && length(filter(ds, d => d.equal)) == 2
-    V41DifferentialRefused { step: _, cause: _ } => false
-  }
-}
-
-// THE RED: a store whose output differs from upstream in any bit refuses naming it; a missing store
-// and a run that did not report zero failures refuse too.
-fn w_refused_with(o: V41DifferentialOutcome, needle: String) -> Bool {
-  match o {
-    V41DifferentialRefused { step: _, cause: c } => contains(c as String, needle)
-    V41DifferentialRead { image_config: _, stores: _ } => false
-  }
-}
-
-test fn a_differing_or_missing_store_refuses() -> Bool {
-  let differs = "DIFFERENTIAL 1 0 rows_sampled 4096 owned 8600 unowned_below 1200 out_of_range 2400 absent_heads 4096 equal\nDIFFERENTIAL 1 1 rows_sampled 4096 owned 8580 unowned_below 1230 out_of_range 2390 absent_heads 4096 DIFFERS\nDIFFERENTIAL_DONE failures 1\n"
-  let missing = "DIFFERENTIAL 1 0 rows_sampled 4096 owned 8600 unowned_below 1200 out_of_range 2400 absent_heads 4096 equal\nDIFFERENTIAL_DONE failures 0\n"
-  w_refused_with(o: v41_admit_differential(image_config: "sha256:ea39" as NonEmptyStr, owed: w_owed, stdout: differs), needle: "layer 1 rank 1 DIFFERS from upstream")
-    && w_refused_with(o: v41_admit_differential(image_config: "sha256:ea39" as NonEmptyStr, owed: w_owed, stdout: missing), needle: "layer 1 rank 1 has 0 differential readings")
-}
-
-// OCCUPANCY REFUSES BEFORE ANYTHING IS CLAIMED: a GPU compute process, or too little available memory.
-test fn an_occupied_host_refuses_and_a_free_one_is_admitted() -> Bool {
-  let free_mem = "MemTotal: 127000000 kB\nMemAvailable: 120000000 kB\n"
-  let low_mem = "MemTotal: 127000000 kB\nMemAvailable: 16000000 kB\n"
-  let no_apps = "pid, process_name, used_gpu_memory [MiB]\n"
-  let pair = "pid, process_name, used_gpu_memory [MiB]\n4242, ray::RayWorkerWrapper, 99700 MiB\n"
-  let free = match v41_judge_occupancy(meminfo: free_mem, compute_csv: no_apps) { V41HostFree { available: a } => byte_size_count(b: a) == 120000000 * 1024  V41HostOccupied { cause: _ } => false }
-  let gpu = match v41_judge_occupancy(meminfo: free_mem, compute_csv: pair) { V41HostOccupied { cause: c } => contains(c as String, "RayWorkerWrapper")  V41HostFree { available: _ } => false }
-  let mem = match v41_judge_occupancy(meminfo: low_mem, compute_csv: no_apps) { V41HostOccupied { cause: c } => contains(c as String, "16384000000 bytes available")  V41HostFree { available: _ } => false }
-  free && gpu && mem
-}
-
-// THE MANIFEST AT ITS OWN INTERFACE, OVER A SUPPLIED SPEC AND READINGS: one layer over four ranks, with
-// three-byte records. Every owed (layer, rank) with exactly one read store derives a manifest naming
-// the encode's path and the read digest; a missing store or a store the spec does not owe refuses.
-// The real path (the live spec and the published readings) ran end to end in the differential on srv5,
-// fleet-converge run 36254702828, whose receipt is this module's evidence of record.
-fn w_tiny_spec() -> V41RowStoreEncodingSpec {
-  v41_encoding_spec_of_layers(
-    partition: v41_candidate_partition,
-    layers: [v41_layer_table(layer: 1, weight: "layers.1.engram.embed.weight" as NonEmptyStr, scale: "layers.1.engram.embed.scale" as NonEmptyStr, rows: 8, ranks: vllm_engram_rank_rows(head_sizes: [2, 2, 2, 2], tp_size: 4))],
-    geometry: v41_row_geometry_of(weight_dtype: SafeF8E4M3, scale_dtype: SafeF8E8M0, weight_width: 2, scale_width: 1),
-  )
-}
-
-fn w_store(layer: Nat, rank: Nat, hex: String) -> V41ObservedRankStore {
-  V41ObservedRankStore { identity: v41_rank_store_identity(layer: layer, rank: rank, digest: Sha256Digest { hex: hex as Sha256DigestHex }), size: byte_size(count: 12) }
-}
-
-fn w_read(stores: List<V41ObservedRankStore>) -> V41PublishedStoreReadings {
-  V41PublishedStoresRead { host: "srv5" as NonEmptyStr, observed_at: "fixture" as NonEmptyStr, stores: stores }
-}
-
-data w_d0: String = "0000000000000000000000000000000000000000000000000000000000000000"
-data w_d1: String = "1111111111111111111111111111111111111111111111111111111111111111"
-data w_d2: String = "2222222222222222222222222222222222222222222222222222222222222222"
-data w_d3: String = "3333333333333333333333333333333333333333333333333333333333333333"
-
-test fn the_manifest_names_every_owed_store_and_refuses_a_gap_or_an_extra() -> Bool {
-  let four = [w_store(layer: 1, rank: 0, hex: w_d0), w_store(layer: 1, rank: 1, hex: w_d1), w_store(layer: 1, rank: 2, hex: w_d2), w_store(layer: 1, rank: 3, hex: w_d3)]
-  let derived = match v41_engram_store_manifest(spec: w_tiny_spec(), readings: w_read(stores: four)) {
-    V41StoreManifestDerived { text: t, stores: n } => n == 4 && contains(t, "\"record_bytes\": 3") && contains(t, "\"weight_bytes\": 2") && contains(t, join(["\"sha256\": \"", w_d2, "\""], "")) && contains(t, "/engram-row-stores/layer.1.rank.2.engram")
-    V41StoreManifestRefused { causes: _ } => false
-  }
-  let gap = match v41_engram_store_manifest(spec: w_tiny_spec(), readings: w_read(stores: [w_store(layer: 1, rank: 0, hex: w_d0), w_store(layer: 1, rank: 1, hex: w_d1), w_store(layer: 1, rank: 2, hex: w_d2)])) {
-    V41StoreManifestRefused { causes: cs } => length(filter(cs, c => contains(c, "layer 1 rank 3 has 0 read stores"))) == 1
-    V41StoreManifestDerived { text: _, stores: _ } => false
-  }
-  let extra = match v41_engram_store_manifest(spec: w_tiny_spec(), readings: w_read(stores: concat(four, [w_store(layer: 14, rank: 0, hex: w_d0)]))) {
-    V41StoreManifestRefused { causes: cs } => length(filter(cs, c => contains(c, "layer 14 rank 0 is not owed"))) == 1
-    V41StoreManifestDerived { text: _, stores: _ } => false
-  }
-  let unread = match v41_engram_store_manifest(spec: w_tiny_spec(), readings: V41PublishedStoresUnread { obligation: "fixture" as NonEmptyStr }) {
-    V41StoreManifestRefused { causes: _ } => true
-    V41StoreManifestDerived { text: _, stores: _ } => false
-  }
-  derived && gap && extra && unread
-}
-
-// THE COMMAND: bounded twice, labelled for this lane, memory-capped, the stores mounted read-only, and
-// the overlay run as a module from the image with the manifest passed as its argument.
-test fn the_differential_runs_bounded_labelled_capped_with_read_only_stores() -> Bool {
-  let argv = join(v41_differential_argv(image: "sha256:ea39" as NonEmptyStr, claim: "c1" as NonEmptyStr, manifest: "{}"), " ")
-  contains(argv, "timeout -k 30 1620 ")
-    && contains(argv, "/engram-row-stores:ro --label gunbc.lane=engram-differential --label gunbc.claim=c1 --memory 17179869184 --memory-swap 17179869184 --entrypoint timeout sha256:ea39 -k 30 1500 python3 -u -m vllm.models.deepseek_v4_1.nvidia.engram_file_backed --differential - --manifest-json {} --rows 4096 --tokens 2048")
-}
-
diff --git a/dag/test/claim/spark/v41_engram_file_backed_witness_test.dag b/dag/test/claim/spark/v41_engram_file_backed_witness_test.dag
deleted file mode 100644
index 245063a242f..00000000000
--- a/dag/test/claim/spark/v41_engram_file_backed_witness_test.dag
+++ /dev/null
@@ -1,135 +0,0 @@
-module test.claim.spark.v41_engram_file_backed_witness
-
-import std.types { Bool, List, NonEmptyStr }
-import std.nat { Nat }
-import std.integer { UInt8 }
-import std.measure { ByteSize, byte_size, byte_size_count, microsecond, microsecond_count }
-import std.optional { Present, Absent }
-import gunbc.spark.v41_engram_row_store {
-  V41CompleteStore, V41Placed, V41PlacementRefused, V41FixtureCorrespondenceHolds, V41PublishedTransformUnestablished, V41TransformUnfaithful,
-  v41_place_row, v41_row_address, v41_transform_fixture, v41_row_store_magic_size,
-}
-import gunbc.spark.v41_engram_file_backed {
-  V41StoreOpenReceipt, V41OpenReleased, V41OpenResidueRefused, V41Gathered, V41GatherRefused,
-  v41_store_open_receipt, v41_open_residency_verdict, v41_gather_rows,
-  v41_touched_pages, v41_fetch_touch_receipt, v41_rank_touches,
-}
-import test.claim.spark.v41_engram_row_store_witness { w_tiny_spec, w_source, w_row }
-
-// ── OPEN: VERIFIED AND RELEASED, OR REFUSED ─────────────────────────────────────────────────────
-
-fn w_receipt(verified: Nat, after_release: Nat) -> V41StoreOpenReceipt {
-  v41_store_open_receipt(store_bytes: byte_size(count: 1000), verified_bytes: byte_size(count: verified), resident_after_verify: byte_size(count: 1000), resident_after_release: byte_size(count: after_release))
-}
-
-test fn a_verified_store_whose_cache_was_released_opens() -> Bool {
-  match v41_open_residency_verdict(r: w_receipt(verified: 1000, after_release: 0)) {
-    V41OpenReleased { receipt: r } => byte_size_count(b: r.resident_after_verify) == 1000
-    V41OpenResidueRefused { defect: _ } => false
-  }
-}
-
-// RED (a): verification that leaves its page cache resident fails the residency claim, by any
-// residue, including a single page; and a partial verification is no verification.
-test fn verification_that_leaves_the_cache_resident_refuses() -> Bool {
-  let resident = match v41_open_residency_verdict(r: w_receipt(verified: 1000, after_release: 1000)) {
-    V41OpenReleased { receipt: _ } => false
-    V41OpenResidueRefused { defect: d } => (d as String).contains("remain page-cache resident")
-  }
-  let one_page = match v41_open_residency_verdict(r: w_receipt(verified: 1000, after_release: 4096)) {
-    V41OpenReleased { receipt: _ } => false
-    V41OpenResidueRefused { defect: _ } => true
-  }
-  let partial = match v41_open_residency_verdict(r: w_receipt(verified: 999, after_release: 0)) {
-    V41OpenReleased { receipt: _ } => false
-    V41OpenResidueRefused { defect: d } => (d as String).contains("whole file")
-  }
-  resident && one_page && partial
-}
-
-// ── GATHER: THE BATCH IS THE PER-ROW RECORDS, IN ORDER; A SHIFTED OFFSET REFUSES ─────────────────
-
-fn w_rank1_store() -> V41CompleteStore? {
-  match v41_transform_fixture(source: w_source(), spec: w_tiny_spec()) {
-    V41FixtureCorrespondenceHolds { subject: _, placed: _, stores: st } => first(filter(st, c => c.rank == 1))
-    V41PublishedTransformUnestablished { obligation: _ } => none
-    V41TransformUnfaithful { defects: _ } => none
-  }
-}
-
-// The per-row reference: the record v41_place_row put for this global row, and its address.
-fn w_record(i: Nat) -> List<UInt8> {
-  match v41_place_row(row: w_row(i: i), spec: w_tiny_spec()) {
-    V41Placed { row: p } => p.record
-    V41PlacementRefused { defect: _ } => [] as List<UInt8>
-  }
-}
-
-fn w_offset(i: Nat) -> ByteSize {
-  match v41_row_address(spec: w_tiny_spec(), layer: 1, global_row: i) {
-    Present { value: a } => a.offset
-    Absent => byte_size(count: 0)
-  }
-}
-
-// RED (b), agreement arm: rank 1 owns global rows 2 and 3, its first and last local rows. A batch
-// over both boundaries, out of order and with a repeat, returns exactly the per-row records in
-// request order.
-test fn the_batched_gather_is_the_per_row_records_in_request_order_over_boundary_rows() -> Bool {
-  match w_rank1_store() {
-    Absent => false
-    Present { value: s } => match v41_gather_rows(store: s, spec: w_tiny_spec(), offsets: [w_offset(i: 3), w_offset(i: 2), w_offset(i: 3)]) {
-      V41GatherRefused { defect: _ } => false
-      V41Gathered { rows: rs } => length(w_record(i: 2)) == 3 && rs == [w_record(i: 3), w_record(i: 2), w_record(i: 3)]
-    }
-  }
-}
-
-fn w_refused(s: V41CompleteStore, offsets: List<ByteSize>) -> Bool {
-  match v41_gather_rows(store: s, spec: w_tiny_spec(), offsets: offsets) {
-    V41Gathered { rows: _ } => false
-    V41GatherRefused { defect: d } => (d as String).contains("is not magic + k * 3")
-  }
-}
-
-// RED (b), refusal arm: an offset shifted by one byte, one inside the magic, and one whose record
-// would run past the file each refuse the WHOLE batch, even beside a valid offset.
-test fn a_shifted_offset_batch_refuses() -> Bool {
-  match w_rank1_store() {
-    Absent => false
-    Present { value: s } => {
-      let end = length(s.bytes)
-      w_refused(s: s, offsets: [w_offset(i: 2), byte_size(count: byte_size_count(b: w_offset(i: 2)) + 1)])
-        && w_refused(s: s, offsets: [byte_size(count: byte_size_count(b: v41_row_store_magic_size()) - 1)])
-        && w_refused(s: s, offsets: [byte_size(count: end)])
-    }
-  }
-}
-
-// ── TOUCHES: DISTINCT PAGES, NOT ROWS ───────────────────────────────────────────────────────────
-
-fn w_offsets(xs: List<Nat>) -> List<ByteSize> {
-  map(xs, x => byte_size(count: x))
-}
-
-// RED (c): a duplicate offset within a batch counts once. 3-byte records on 8-byte pages.
-test fn a_duplicate_offset_in_a_batch_counts_once() -> Bool {
-  length(v41_touched_pages(offsets: w_offsets(xs: [8, 8, 8]), record: byte_size(count: 3), page: byte_size(count: 8))) == 1
-    && length(v41_touched_pages(offsets: w_offsets(xs: [8, 11, 8]), record: byte_size(count: 3), page: byte_size(count: 8))) == 1
-}
-
-// RED (d): a row spanning a page boundary counts both pages; the row just before the boundary
-// counts one, and a record longer than a page counts every page it covers.
-test fn a_row_spanning_a_page_boundary_counts_both_pages() -> Bool {
-  v41_touched_pages(offsets: w_offsets(xs: [6]), record: byte_size(count: 3), page: byte_size(count: 8)) == [0, 1]
-    && v41_touched_pages(offsets: w_offsets(xs: [5]), record: byte_size(count: 3), page: byte_size(count: 8)) == [0]
-    && v41_touched_pages(offsets: w_offsets(xs: [7]), record: byte_size(count: 18), page: byte_size(count: 8)) == [0, 1, 2, 3]
-}
-
-// A rank's (file, page) pairs across files are the per-file counts summed, with calls, rows and time.
-test fn a_rank_sums_its_files_touch_receipts() -> Bool {
-  let a = v41_fetch_touch_receipt(page_bytes: byte_size(count: 4096), page_count: 100, distinct_pages_touched: 7, fetch_rows_calls: 2, rows_fetched: 9, fetch_rows_time: microsecond(count: 30))
-  let b = v41_fetch_touch_receipt(page_bytes: byte_size(count: 4096), page_count: 100, distinct_pages_touched: 3, fetch_rows_calls: 1, rows_fetched: 4, fetch_rows_time: microsecond(count: 12))
-  let r = v41_rank_touches(files: [a, b])
-  r.distinct_pages_touched == 10 && r.fetch_rows_calls == 3 && r.rows_fetched == 13 && microsecond_count(m: r.fetch_rows_time) == 42
-}
diff --git a/dag/test/claim/spark/v41_engram_row_store_witness_test.dag b/dag/test/claim/spark/v41_engram_row_store_witness_test.dag
deleted file mode 100644
index 44a789020c2..00000000000
--- a/dag/test/claim/spark/v41_engram_row_store_witness_test.dag
+++ /dev/null
@@ -1,254 +0,0 @@
-module test.claim.spark.v41_engram_row_store_witness
-
-import std.types { Bool, String, List, NonEmptyStr, Int }
-import std.nat { Nat }
-import std.integer { UInt8, qualified_octet_members }
-import std.content_hash { Sha256Digest, Sha256DigestHex, serialize_content_hash }
-import std.measure { byte_size_count }
-import std.optional { Present, Absent }
-import extdeps.numeric.base16 { base16_decode_lower }
-import extdeps.toolchain.architecture_profile { BigEndian }
-import extdeps.safetensors.format { SafetensorsEntry, safetensors_entry, SafeF8E4M3, SafeF8E8M0, SafeF16 }
-import extdeps.vllm.engram_layout { vllm_engram_rank_rows }
-import test.claim.vllm.vllm_engram_layout_witness { w_published_head_sizes }
-import extdeps.deepseek.deepseek_v4_1_flash {
-  deepseek_v4_1_flash_engram,
-  deepseek_v4_1_flash_engram_entries_layer_1, deepseek_v4_1_flash_engram_entries_layer_14,
-}
-import gunbc.spark.v41_identity_input { V41EngramResidencyPartition }
-import gunbc.spark.v41_runtime_candidate { v41_candidate_partition }
-import gunbc.spark.v41_engram_row_store {
-  V41RowStoreEncodingSpec, V41SourceRow, V41RankStoreIdentity,
-  V41RowStoreSpecStanding, V41RowStoreSpecAdmitted, V41RowStoreSpecRefused,
-  V41Placement, V41Placed, V41PlacementRefused,
-  V41FixtureRows, V41PublishedEngramShards, V41FixtureCorrespondenceHolds, V41PublishedTransformUnestablished, V41TransformUnfaithful,
-  V41RowStoreEncodingIdentified, V41RowStoreEncodingUnestablished, V41RowStoreEncodingRefused,
-  RankMapReservedUninhabited, RowOrderReservedUninhabited,
-  v41_row_store_spec, v41_encoding_spec_of_layers, v41_layer_table, v41_row_geometry_of, v41_row_bytes,
-  v41_source_row, v41_place_row, v41_row_address, v41_transform_fixture, v41_magic_octets,
-  v41_tampered_record_is_unfaithful, v41_dropped_source_row_is_unfaithful,
-  v41_identify_row_store, v41_rank_store_identity,
-  v41_encoding_spec_key, v41_encoding_spec_inputs, v41_encoding_spec_override_endianness,
-  v41_encoding_spec_override_rank_map, v41_encoding_spec_override_row_order,
-  v41_published_transform_standing, v41_layer_index_from_tensor_name,
-  v41_row_store_magic, v41_row_store_magic_size,
-}
-
-// ── THE FIXTURE: EIGHT ROWS, FOUR RANKS OF TWO, THREE-BYTE RECORDS ─────────────────────────────
-
-fn w_tiny_spec() -> V41RowStoreEncodingSpec {
-  v41_encoding_spec_of_layers(
-    partition: v41_candidate_partition,
-    layers: [v41_layer_table(layer: 1, weight: "layers.1.engram.embed.weight" as NonEmptyStr, scale: "layers.1.engram.embed.scale" as NonEmptyStr, rows: 8, ranks: vllm_engram_rank_rows(head_sizes: [2, 2, 2, 2], tp_size: 4))],
-    geometry: v41_row_geometry_of(weight_dtype: SafeF8E4M3, scale_dtype: SafeF8E8M0, weight_width: 2, scale_width: 1),
-  )
-}
-
-fn w_row(i: Nat) -> V41SourceRow {
-  v41_source_row(layer: 1, global_row: i, weight: [i, i + 16], scale: [i + 32])
-}
-
-fn w_source() -> List<V41SourceRow> {
-  [w_row(i: 0), w_row(i: 1), w_row(i: 2), w_row(i: 3), w_row(i: 4), w_row(i: 5), w_row(i: 6), w_row(i: 7)]
-}
-
-// A STORE IS EXACTLY THE MAGIC, THEN ITS RANK'S RECORDS IN LOCAL ORDER. Rank k of the fixture owns
-// global rows 2k and 2k+1, whose records are [2k, 2k+16, 2k+32] and [2k+1, 2k+17, 2k+33]. These are the
-// bytes whose SHA-256 the consumer checks on open; the digest is read where the bytes live
-// (v41_identify_row_store takes it), so the claim is on the bytes.
-fn w_expected_store(k: Nat) -> List<UInt8> {
-  concat(v41_magic_octets(), [2 * k, 2 * k + 16, 2 * k + 32, 2 * k + 1, 2 * k + 17, 2 * k + 33])
-}
-
-fn w_stores_are_expected(source: List<V41SourceRow>) -> Bool {
-  match v41_transform_fixture(source: source, spec: w_tiny_spec()) {
-    V41FixtureCorrespondenceHolds { subject: _, placed: _, stores: st } =>
-      length(st) == 4 && all(st, c => c.layer == 1 && c.bytes == w_expected_store(k: c.rank))
-    V41PublishedTransformUnestablished { obligation: _ } => false
-    V41TransformUnfaithful { defects: _ } => false
-  }
-}
-
-test fn every_fixture_store_is_the_magic_then_its_records_in_local_order() -> Bool {
-  w_stores_are_expected(source: w_source())
-}
-
-// Supply order does not reach a store: the same rows reversed give the same bytes.
-test fn supply_order_does_not_change_any_store() -> Bool {
-  w_stores_are_expected(source: reverse(w_source()))
-}
-
-// RED: a tampered record or a dropped row is unfaithful; an untampered record is not.
-test fn a_tampered_or_dropped_row_is_unfaithful() -> Bool {
-  v41_tampered_record_is_unfaithful(source: w_source(), spec: w_tiny_spec(), tamper: [9, 9, 9])
-    && !v41_tampered_record_is_unfaithful(source: w_source(), spec: w_tiny_spec(), tamper: [0, 16, 32])
-    && v41_dropped_source_row_is_unfaithful(source: w_source(), spec: w_tiny_spec())
-}
-
-// RED: a row whose bytes do not match the geometry is refused at placement, never padded or cut.
-test fn a_row_of_the_wrong_width_is_refused_at_placement() -> Bool {
-  match v41_place_row(row: v41_source_row(layer: 1, global_row: 0, weight: [1, 2, 3], scale: [4]), spec: w_tiny_spec()) {
-    V41PlacementRefused { defect: d } => (d as String).contains("weight bytes")
-    V41Placed { row: _ } => false
-  }
-    && match v41_place_row(row: v41_source_row(layer: 1, global_row: 8, weight: [1, 2], scale: [4]), spec: w_tiny_spec()) {
-      V41PlacementRefused { defect: d } => (d as String).contains("no declared rank range")
-      V41Placed { row: _ } => false
-    }
-}
-
-// An empty or partial source builds no store: completeness is per store, every local row once.
-test fn an_incomplete_source_does_not_mint_identified_stores() -> Bool {
-  match v41_transform_fixture(source: [] as List<V41SourceRow>, spec: w_tiny_spec()) {
-    V41TransformUnfaithful { defects: d } => any(d, x => (x as String).contains("not each local row exactly once"))
-    V41FixtureCorrespondenceHolds { subject: _, placed: _, stores: _ } => false
-    V41PublishedTransformUnestablished { obligation: _ } => false
-  }
-    && match v41_transform_fixture(source: [w_row(i: 0), w_row(i: 1)], spec: w_tiny_spec()) {
-      V41TransformUnfaithful { defects: _ } => true
-      V41FixtureCorrespondenceHolds { subject: _, placed: _, stores: _ } => false
-      V41PublishedTransformUnestablished { obligation: _ } => false
-    }
-}
-
-// ── IDENTIFICATION: EXACT (LAYER, RANK) POPULATION, SHA-256 ONLY ───────────────────────────────
-
-fn w_sha(c: String) -> Sha256Digest {
-  Sha256Digest { hex: join([c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c], "") as Sha256DigestHex }
-}
-
-test fn identification_refuses_a_missing_foreign_or_duplicated_store() -> Bool {
-  let four = map([0, 1, 2, 3], k => v41_rank_store_identity(layer: 1, rank: k, digest: w_sha(c: "a")))
-  (match v41_identify_row_store(spec: w_tiny_spec(), rank_stores: four) {
-    V41RowStoreEncodingIdentified { spec: _, spec_key: _, rank_stores: _, content_digest: _ } => true
-    _ => false
-  })
-    && (match v41_identify_row_store(spec: w_tiny_spec(), rank_stores: four |> take(n: 3)) {
-      V41RowStoreEncodingRefused { defects: d } => any(d, x => (x as String).contains("layer.1.rank.3"))
-      _ => false
-    })
-    && (match v41_identify_row_store(spec: w_tiny_spec(), rank_stores: concat(four, [v41_rank_store_identity(layer: 14, rank: 0, digest: w_sha(c: "b"))])) {
-      V41RowStoreEncodingRefused { defects: d } => any(d, x => (x as String).contains("not declared"))
-      _ => false
-    })
-    && (match v41_identify_row_store(spec: w_tiny_spec(), rank_stores: concat(four, [v41_rank_store_identity(layer: 1, rank: 3, digest: w_sha(c: "b"))])) {
-      V41RowStoreEncodingRefused { defects: d } => any(d, x => (x as String).contains("more than one digest"))
-      _ => false
-    })
-}
-
-test fn a_reserved_rank_map_or_row_order_refuses_rather_than_minting_identity() -> Bool {
-  (match v41_identify_row_store(spec: v41_encoding_spec_override_rank_map(spec: w_tiny_spec(), rank_map: RankMapReservedUninhabited), rank_stores: [] as List<V41RankStoreIdentity>) {
-    V41RowStoreEncodingRefused { defects: d } => any(d, x => (x as String).contains("ReservedUninhabited"))
-    _ => false
-  })
-    && (match v41_transform_fixture(source: w_source(), spec: v41_encoding_spec_override_row_order(spec: w_tiny_spec(), row_order: RowOrderReservedUninhabited)) {
-      V41TransformUnfaithful { defects: d } => any(d, x => (x as String).contains("ReservedUninhabited"))
-      _ => false
-    })
-}
-
-test fn the_spec_key_moves_with_geometry_endianness_and_rank_ranges_and_carries_the_magic() -> Bool {
-  let base = w_tiny_spec()
-  let other_dtype = v41_encoding_spec_of_layers(partition: v41_candidate_partition, layers: base.layers, geometry: v41_row_geometry_of(weight_dtype: SafeF16, scale_dtype: SafeF8E8M0, weight_width: 2, scale_width: 1))
-  let other_ranges = v41_encoding_spec_of_layers(partition: v41_candidate_partition, layers: [v41_layer_table(layer: 1, weight: "layers.1.engram.embed.weight" as NonEmptyStr, scale: "layers.1.engram.embed.scale" as NonEmptyStr, rows: 8, ranks: vllm_engram_rank_rows(head_sizes: [1, 3, 2, 2], tp_size: 4))], geometry: base.geometry)
-  let k = serialize_content_hash(hash: v41_encoding_spec_key(spec: base)) as String
-  k != serialize_content_hash(hash: v41_encoding_spec_key(spec: other_dtype)) as String
-    && k != serialize_content_hash(hash: v41_encoding_spec_key(spec: v41_encoding_spec_override_endianness(spec: base, endianness: BigEndian))) as String
-    && k != serialize_content_hash(hash: v41_encoding_spec_key(spec: other_ranges)) as String
-    && any(v41_encoding_spec_inputs(spec: base), i => (i.identity as String) == "magic")
-    && (v41_row_store_magic as String).starts_with(prefix: "ENGR1")
-}
-
-// ── THE LIVE SPEC, FROM THE PUBLISHED POPULATION ───────────────────────────────────────────────
-
-fn w_live_population() -> List<SafetensorsEntry> {
-  concat(deepseek_v4_1_flash_engram_entries_layer_1, deepseek_v4_1_flash_engram_entries_layer_14)
-}
-
-// The published shapes give a 264-byte record (256 F8_E4M3 weight + 8 F8_E8M0 scale), and vLLM's
-// derived bucket layout tiles each layer's published rows exactly into four contiguous ranges.
-test fn the_live_spec_derives_a_264_byte_record_and_grounded_rank_ranges() -> Bool {
-  match v41_row_store_spec(population: w_live_population(), partition: v41_candidate_partition, tables: deepseek_v4_1_flash_engram, head_sizes: w_published_head_sizes()) {
-    V41RowStoreSpecRefused { defects: _ } => false
-    V41RowStoreSpecAdmitted { spec: s } =>
-      byte_size_count(b: v41_row_bytes(g: s.geometry)) == 264
-        && length(s.layers) == 2
-        && all(s.layers, t => length(t.ranks) == 4)
-        && all(s.layers, t => match first(reverse(t.ranks)) { Present { value: r } => r.end == t.rows  Absent => false })
-  }
-}
-
-// RED: a published row count the derived layout does not reach refuses -- the two authorities are
-// compared, never reconciled by picking one.
-test fn a_table_whose_rows_disagree_with_the_derived_layout_refuses() -> Bool {
-  let short = [
-    safetensors_entry(name: "layers.1.engram.embed.weight" as NonEmptyStr, dtype: SafeF8E4M3, shape: [384006167, 256], begin_offset: 0, end_offset: 98305578752),
-    safetensors_entry(name: "layers.1.engram.embed.scale" as NonEmptyStr, dtype: SafeF8E8M0, shape: [384006167, 8], begin_offset: 98305578752, end_offset: 101377628088),
-  ]
-  match v41_row_store_spec(population: concat(short, deepseek_v4_1_flash_engram_entries_layer_14), partition: v41_candidate_partition, tables: deepseek_v4_1_flash_engram, head_sizes: w_published_head_sizes()) {
-    V41RowStoreSpecRefused { defects: d } => any(d, x => (x as String).contains("derived bucket layout"))
-    V41RowStoreSpecAdmitted { spec: _ } => false
-  }
-}
-
-test fn a_missing_or_unnamed_storage_member_refuses() -> Bool {
-  (match v41_row_store_spec(population: deepseek_v4_1_flash_engram_entries_layer_1, partition: v41_candidate_partition, tables: deepseek_v4_1_flash_engram, head_sizes: w_published_head_sizes()) {
-    V41RowStoreSpecRefused { defects: d } => any(d, x => (x as String).contains("layers.14.engram.embed.weight") && (x as String).contains("not in the supplied population"))
-    V41RowStoreSpecAdmitted { spec: _ } => false
-  })
-    && (match v41_layer_index_from_tensor_name(name: "engram.embed.weight" as NonEmptyStr) { Absent => true  Present { value: _ } => false })
-    && (match v41_layer_index_from_tensor_name(name: "layers.14.engram.embed.weight" as NonEmptyStr) { Present { value: n } => n == 14  Absent => false })
-}
-
-// ── THE INHABITANCE CLAIM: REAL PUBLISHED ROWS ENCODE TO THE BYTES THE PATCH READS ─────────────
-//
-// Rows 96000563 and 96000564 of layers.1.engram.embed.{weight,scale}, read by HTTP range from
-// model-00047-of-00048.safetensors at dba1be0a (weight at header_end + row*256, scale at
-// header_end + 98305579008 + row*8; header_end = 8 + 656) on 2026-09-22. They straddle rank 0's end
-// under the derived layout, so the claim reaches the partition as well as the record.
-data w_real_weight_96000563: String = "5b71726d69725c6567cfea6ae069776871e87873eaf254f26a7458ebf2f7736c75f2eef17048f1ec63c356eef2646e51ecf5de6072ececf2737361e56ee349f979d8e2f96edd6c61f063dfefe96c6ff3f0f572d17afa5eec6b66dce47767f0fadcf7eb57cb7074696ae36dd46761f16e666072e0e46b69dbf362ec6ef4e17cf576ebe3dde9f0f17775e84ae3ccdad0f16b746c4d735ee75076ede2e96df1f7f4f0f67af2ddea67d7edda6ee9e871755cf6ebf660ede966f36eecf064636a66645b71f6637366dc60f0e6f27af7726c706ef971ae72de6bc8f473ecdbe2e75de0737566ec6b6be9d9f4da6f5376696f6ce761c4eeeb5d61eff8f44a766b7a6a60"
-data w_real_scale_96000563: String = "7878787878787878"
-data w_real_weight_96000564: String = "e9f6f3e17de9685271f57bf1f7fdfb71e679ea76f9fbfdeed2f67174fa78f17bc162eb5578f3f8696d66626f6def35f375f069e16072f5c0f1746a346ee969ddd0eb57f1f5f26f68ecf8e65c70f1e865dcddfbdb586cfad479f8f1f27bedf67662625ce2696de3ef70ebec72fcd366e9edd3e15aee61e9eadb7072f3e66b5b6c5cf0707262ed644877666869e664eee06071c760eae5d36c6a7560dcfb6a63eb79c178756af1687c45eb63f4f0f3f0f1e9f6555df4f8f1f16c6d6ff1e37d72efe35d71d2605cf26de1ebf3f469f96bf1d36ff768ef5ff270eced6c53e6de6ef4d9e96cebeb4c6eecefed7261e4ecbe73456d70ed635cf95972dfd1e8e0eaf070"
-data w_real_scale_96000564: String = "7778777878777878"
-
-fn w_octets(hex: String) -> List<UInt8> {
-  match base16_decode_lower(hex: hex) {
-    Present { value: q } => qualified_octet_members(q: q)
-    Absent => [] as List<UInt8>
-  }
-}
-
-// The record must be what fetch_rows copies from [offset, offset + nbytes): the weight row, then
-// the scale row.
-fn w_real_placed_as(spec: V41RowStoreEncodingSpec, global_row: Nat, weight_hex: String, scale_hex: String, rank: Nat, local_row: Nat) -> Bool {
-  let weight = w_octets(hex: weight_hex)
-  let scale = w_octets(hex: scale_hex)
-  match v41_place_row(row: v41_source_row(layer: 1, global_row: global_row, weight: weight, scale: scale), spec: spec) {
-    V41PlacementRefused { defect: _ } => false
-    V41Placed { row: p } =>
-      p.rank == rank && p.local_row == local_row
-        && byte_size_count(b: p.offset) == byte_size_count(b: v41_row_store_magic_size()) + local_row * 264
-        && length(p.record) == 264
-        && (p.record |> take(n: 256)) == weight
-        && (p.record |> skip(n: 256)) == scale
-  }
-}
-
-test fn real_published_rows_encode_to_the_record_the_patch_reads_at_their_offset() -> Bool {
-  match v41_row_store_spec(population: w_live_population(), partition: v41_candidate_partition, tables: deepseek_v4_1_flash_engram, head_sizes: w_published_head_sizes()) {
-    V41RowStoreSpecRefused { defects: _ } => false
-    V41RowStoreSpecAdmitted { spec: s } =>
-      w_real_placed_as(spec: s, global_row: 96000563, weight_hex: w_real_weight_96000563, scale_hex: w_real_scale_96000563, rank: 0, local_row: 96000563)
-        && w_real_placed_as(spec: s, global_row: 96000564, weight_hex: w_real_weight_96000564, scale_hex: w_real_scale_96000564, rank: 1, local_row: 0)
-  }
-}
-
-// THE PUBLISHED STORES HAVE NO CONSTRUCTOR HERE; the obligation names the only admitted producer.
-test fn the_published_stores_remain_unestablished_and_name_their_producer() -> Bool {
-  match v41_published_transform_standing() {
-    V41PublishedTransformUnestablished { obligation: o } => (o as String).contains("host realization of v41_place_row") && (o as String).contains("differential claim")
-    V41FixtureCorrespondenceHolds { subject: _, placed: _, stores: _ } => false
-    V41TransformUnfaithful { defects: _ } => false
-  }
-}
diff --git a/dag/test/claim/spark/v41_engram_runtime_witness_test.dag b/dag/test/claim/spark/v41_engram_runtime_witness_test.dag
deleted file mode 100644
index 38b4bee2724..00000000000
--- a/dag/test/claim/spark/v41_engram_runtime_witness_test.dag
+++ /dev/null
@@ -1,461 +0,0 @@
-module test.claim.spark.v41_engram_runtime_witness
-
-import std.types { Bool, String, List, NonEmptyStr }
-import std.nat { Nat }
-import std.decl_ref { DeclarationRef }
-import std.optional { Present, Absent }
-import extdeps.filesystem.filesystem_io { Filesystem }
-import std.content_hash { ContentHash, Sha256Hash, Sha256Digest, Sha256DigestHex, serialize_content_hash, content_hash_of_value }
-import std.measure { byte_size, byte_size_count }
-import std.realization { LocalFilesystem, RemoteNetwork }
-import extdeps.vllm.source_build { vllm_d2d649e6_revision, vllm_recipe_targeting }
-import extdeps.flashinfer.flashinfer { flashinfer_0_6_18_post1, flashinfer_0_6_18_post1_wheels }
-import gunbc.spark.serving_deployment_selection { topology_shape }
-import gunbc.fabric.engram_materialization { engram_route_b_identity, engram_route_d_identity }
-import gunbc.spark.serving_runtime_capability_probe { gb10_observed_compute_capability }
-import gunbc.spark.v41_identity_input { V41EngramResidencyPartition }
-import gunbc.spark.v41_runtime_candidate {
-  V41EnginePatch, v41_engine_patch, V41PatchPopulation, V41PatchesObserved, V41PatchesAbsentByObservation, V41PatchesUnestablished,
-  V41EngramPartitionAuthority, PartitionByLaunchConfiguration,
-  V41RuntimeArtifactInputs, V41ModelSourceInputs, V41EngramRealizationInputs, V41CandidateInputs,
-  V41ManifestObserved, V41ManifestUnestablished,
-  V41CandidateVerdict, V41CandidateKeyed, V41CandidateUnestablished, V41CandidateRefused,
-  v41_candidate_standing, v41_candidate, v41_candidate_partition, v41_candidate_recipe,
-  v41_storage_backed_patch_population, v41_engram_file_backed_overlay_path,
-}
-import extdeps.toolchain.architecture_profile { BigEndian }
-import extdeps.safetensors.format {
-  SafetensorsEntry, SafetensorsPopulationStanding, safetensors_population_standing, MembershipClosedAgainstFullIndex,
-  safetensors_entry, SafeF8E4M3, SafeF8E8M0, SafeF16,
-}
-import extdeps.deepseek.deepseek_v4_1_flash {
-  deepseek_v4_1_flash_engram_index_members, deepseek_v4_1_flash_engram_shard_files,
-  deepseek_v4_1_flash_engram_population_reading, deepseek_v4_1_flash_index_tensor_count,
-}
-import gunbc.spark.v41_engram_row_store { V41StoreReadback, V41StoreReadbackUnread, V41StoreReadbackVerified,
-  V41PublishedRowStoreKeyed,
-  V41RowStoreEncoding, V41RowStoreEncodingSpec, V41SourceRow,
-  v41_source_row, v41_encoding_spec_of_layers, v41_layer_table, v41_row_geometry_of,
-  v41_rank_digest_of, v41_identify_row_store, v41_rank_store_identity,
-  V41RowStoreEncodingIdentified, V41RowStoreEncodingUnestablished, V41RowStoreEncodingRefused,
-}
-import extdeps.vllm.engram_layout { vllm_engram_rank_rows }
-import gunbc.spark.v41_source_patch_converge { V41ObservedSourceIdentity, v41_observed_source_identity_of }
-import gunbc.spark.v41_runtime_realized {
-  V41OciImageDigest, V41PatchesConsumedByImage, V41PatchConsumptionEvidence,
-  v41_oci_image_digest, v41_residency_limits,
-  v41_realized_runtime, V41RuntimeRealized, V41RuntimeRealizationRefused, V41RuntimeRealizationUnestablished,
-  v41_realized_candidate, v41_selectable, V41SelectableRuntime, V41Selectable, V41NotSelectable, v41_specification_is_not_selectable,
-  v41_open_rank_store, V41StoreHandle, V41StoreOpenRefused, v41_distributed_launch,
-  v41_token_time, V41TokenTimeLocal, V41TokenTimeRefused,
-  v41_residency_under_trace, V41ResidencyWithinBound, V41ResidencyExceeded,
-  v41_observe_pinned, v41_candidate_refuses_full_pin, V41CandidateRealizationRefused,
-  V41CandidateRealized, V41CandidateRealizationUnestablished,
-}
-import gunbc.spark.vllm_runtime_image_build { BuiltByThisRun, AdoptedUnderExpectedTag }
-import extdeps.container.oci.digest { oci_content_digest_from_validated_sha256 }
-import gunbc.spark.v41_engram_staging {
-  v41_staging_request, v41_stage, v41_stage_rank_stores, V41StagingVerified, V41RankStoresVerified, V41StagingRefused, V41StagingUnestablished,
-  v41_group_a_staging_standing, v41_staged_matching, v41_staged_with_readback,
-  v41_engram_goes_to_disk_because,
-}
-import gunbc.spark.serving_deployment_selection { id_component_budget_authority }
-import std.decl_ref { declaration_ref_eq }
-
-// THE CANDIDATE'S DERIVATION EVIDENCE, SUPPLIED: these claims are about the key, which the readback never
-// enters, so they pass the one arm that leaves a keyed standing keyed.
-fn w_readback_unread() -> V41StoreReadback {
-  V41StoreReadbackUnread { obligation: "fixture: the stores were not read back" as NonEmptyStr }
-}
-
-data w_closed_population: SafetensorsPopulationStanding = safetensors_population_standing(
-  members: deepseek_v4_1_flash_engram_index_members,
-  shards: deepseek_v4_1_flash_engram_shard_files,
-  closure: MembershipClosedAgainstFullIndex {
-    index_population_count: deepseek_v4_1_flash_index_tensor_count,
-    how: "fixture: this closure is asserted by the test, not read from the revision's index" as NonEmptyStr,
-  },
-  reading: deepseek_v4_1_flash_engram_population_reading,
-)
-
-fn w_sha(c: String) -> Sha256Digest {
-  Sha256Digest { hex: join([c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c], "") as Sha256DigestHex }
-}
-
-fn w_consumed() -> V41PatchConsumptionEvidence {
-  V41PatchesConsumedByImage {
-    observed: v41_observed_source_identity_of(
-      revision_head: "d2d649e674c75425d2d6975c87eb89fd4d55fff8" as NonEmptyStr,
-      worktree_diff_sha256: w_sha(c: "a"),
-    ),
-  }
-}
-
-type WPatchSpec {
-  path: String
-  c: String
-}
-
-fn w_patch(path: String, c: String) -> List<V41EnginePatch> {
-  match v41_engine_patch(path: path as NonEmptyStr, applies_to: vllm_d2d649e6_revision, sha256_hex: w_sha(c: c).hex as String, purpose: "fixture" as NonEmptyStr) {
-    Present { value: p } => [p]
-    Absent => [] as List<V41EnginePatch>
-  }
-}
-
-fn w_observed(pairs: List<WPatchSpec>, partition: V41EngramPartitionAuthority) -> V41PatchPopulation {
-  V41PatchesObserved { patches: flat_map(pairs, x => w_patch(path: x.path, c: x.c)), partition: partition }
-}
-
-fn w_two_patches() -> V41PatchPopulation {
-  w_observed(pairs: [WPatchSpec { path: "engram_storage.patch", c: "1" }, WPatchSpec { path: "engram_prefetch.patch", c: "2" }], partition: PartitionByLaunchConfiguration)
-}
-
-fn w_inputs(patches: V41PatchPopulation, partition: V41EngramResidencyPartition, route: DeclarationRef) -> V41CandidateInputs {
-  V41CandidateInputs {
-    runtime: V41RuntimeArtifactInputs {
-      recipe: vllm_recipe_targeting(base: v41_candidate_recipe(), torch_cuda_arch_list: v41_candidate_recipe().torch_cuda_arch_list, install_kv_connectors: v41_candidate_recipe().install_kv_connectors, max_jobs: 6, nvcc_threads: 2),
-      kernel_acquisition: flashinfer_0_6_18_post1,
-      kernel_wheels: flashinfer_0_6_18_post1_wheels,
-      patches: patches,
-    },
-    model_source: V41ModelSourceInputs {
-      checkpoint_revision: "dba1be0a40aa45a94ad051997016db3960a90277" as NonEmptyStr,
-      weights: V41ManifestObserved { digest: w_sha(c: "a") },
-      tokenizer: V41ManifestObserved { digest: w_sha(c: "b") },
-    },
-    engram: V41EngramRealizationInputs { partition: partition, population: w_closed_population, row_store_encoding: V41PublishedRowStoreKeyed { digest: Sha256Hash(w_sha(c: "c")) }, route: route },
-    topology: topology_shape(tensor_parallel_degree: 4, replica_count: 1),
-    device: gb10_observed_compute_capability,
-  }
-}
-
-fn w_default(patches: V41PatchPopulation) -> V41CandidateInputs {
-  w_inputs(patches: patches, partition: v41_candidate_partition, route: engram_route_b_identity)
-}
-
-fn w_key(s: V41CandidateVerdict, which: String) -> String {
-  match s.standing {
-    V41CandidateKeyed { runtime_artifact: r, model_source: m, engram_realization: e, execution_profile: x, candidate: c, authorization_obligation: _ } =>
-      if which == "runtime" { serialize_content_hash(hash: r) as String }
-      else if which == "engram" { serialize_content_hash(hash: e) as String }
-      else { serialize_content_hash(hash: c) as String }
-    V41CandidateUnestablished { obligations: _ } => "unestablished"
-    V41CandidateRefused { defects: _ } => "refused"
-  }
-}
-
-// A FIXTURE SPEC SMALL ENOUGH TO BUILD EVERY STORE: one layer of eight rows whose four rank ranges
-// are two rows each, and a three-byte record (two weight bytes, one scale byte).
-fn w_tiny_spec() -> V41RowStoreEncodingSpec {
-  v41_encoding_spec_of_layers(
-    partition: v41_candidate_partition,
-    layers: [v41_layer_table(layer: 1, weight: "layers.1.engram.embed.weight" as NonEmptyStr, scale: "layers.1.engram.embed.scale" as NonEmptyStr, rows: 8, ranks: vllm_engram_rank_rows(head_sizes: [2, 2, 2, 2], tp_size: 4))],
-    geometry: v41_row_geometry_of(weight_dtype: SafeF8E4M3, scale_dtype: SafeF8E8M0, weight_width: 2, scale_width: 1),
-  )
-}
-
-fn w_row(i: Nat) -> V41SourceRow {
-  v41_source_row(layer: 1, global_row: i, weight: [i, i + 16], scale: [i + 32])
-}
-
-fn w_source() -> List<V41SourceRow> {
-  [w_row(i: 0), w_row(i: 1), w_row(i: 2), w_row(i: 3), w_row(i: 4), w_row(i: 5), w_row(i: 6), w_row(i: 7)]
-}
-
-// THE FIXTURE ENCODING, IDENTIFIED FROM SUPPLIED STORE DIGESTS -- the host's sha256sum readings in
-// production; four distinct SHA-256 values here, one per (layer 1, rank).
-fn w_identified() -> V41RowStoreEncoding? {
-  match v41_identify_row_store(spec: w_tiny_spec(), rank_stores: [
-    v41_rank_store_identity(layer: 1, rank: 0, digest: w_sha(c: "0")),
-    v41_rank_store_identity(layer: 1, rank: 1, digest: w_sha(c: "1")),
-    v41_rank_store_identity(layer: 1, rank: 2, digest: w_sha(c: "2")),
-    v41_rank_store_identity(layer: 1, rank: 3, digest: w_sha(c: "3")),
-  ]) {
-    V41RowStoreEncodingIdentified { spec: s, spec_key: k, rank_stores: rs, content_digest: d } => Present { value: V41RowStoreEncodingIdentified { spec: s, spec_key: k, rank_stores: rs, content_digest: d } }
-    V41RowStoreEncodingUnestablished { obligation: _ } => none
-    V41RowStoreEncodingRefused { defects: _ } => none
-  }
-}
-
-fn w_image() -> V41OciImageDigest {
-  v41_oci_image_digest(
-    manifest: oci_content_digest_from_validated_sha256(digest: w_sha(c: "a")),
-    config: oci_content_digest_from_validated_sha256(digest: w_sha(c: "b")),
-  )
-}
-
-fn w_keys() -> List<ContentHash> {
-  [
-    content_hash_of_value(value: "row0" as NonEmptyStr), content_hash_of_value(value: "row1" as NonEmptyStr),
-    content_hash_of_value(value: "row2" as NonEmptyStr), content_hash_of_value(value: "row3" as NonEmptyStr),
-    content_hash_of_value(value: "row4" as NonEmptyStr), content_hash_of_value(value: "row5" as NonEmptyStr),
-    content_hash_of_value(value: "row6" as NonEmptyStr), content_hash_of_value(value: "row7" as NonEmptyStr),
-  ]
-}
-
-test fn control_patch_digest_or_order_changes_runtime_and_candidate_keys() -> Bool {
-  let a = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches()))
-  let b = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_observed(pairs: [WPatchSpec { path: "engram_storage.patch", c: "9" }, WPatchSpec { path: "engram_prefetch.patch", c: "2" }], partition: PartitionByLaunchConfiguration)))
-  let ba = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_observed(pairs: [WPatchSpec { path: "engram_prefetch.patch", c: "2" }, WPatchSpec { path: "engram_storage.patch", c: "1" }], partition: PartitionByLaunchConfiguration)))
-  w_key(s: a, which: "runtime") != w_key(s: b, which: "runtime")
-    && w_key(s: a, which: "candidate") != w_key(s: b, which: "candidate")
-    && w_key(s: a, which: "runtime") != w_key(s: ba, which: "runtime")
-}
-
-test fn control_weight_or_tokenizer_change_moves_source_and_candidate_keys() -> Bool {
-  let a = w_default(patches: w_two_patches())
-  let b = V41CandidateInputs {
-    runtime: a.runtime,
-    model_source: V41ModelSourceInputs {
-      checkpoint_revision: a.model_source.checkpoint_revision,
-      weights: V41ManifestObserved { digest: w_sha(c: "z") },
-      tokenizer: a.model_source.tokenizer,
-    },
-    engram: a.engram,
-    topology: a.topology,
-    device: a.device,
-  }
-  w_key(s: v41_candidate_standing(readback: w_readback_unread(), c: a), which: "candidate") != w_key(s: v41_candidate_standing(readback: w_readback_unread(), c: b), which: "candidate")
-}
-
-test fn control_route_b_versus_d_moves_engram_not_runtime() -> Bool {
-  let b = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches()))
-  let d = v41_candidate_standing(readback: w_readback_unread(), c: w_inputs(patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_d_identity))
-  w_key(s: b, which: "runtime") == w_key(s: d, which: "runtime")
-    && w_key(s: b, which: "engram") != w_key(s: d, which: "engram")
-}
-
-test fn control_partition_set_reordering_does_not_change_identity() -> Bool {
-  let a = v41_candidate_partition
-  let swapped = V41EngramResidencyPartition {
-    storage_backed: a.storage_backed.sort_by(n => n as String),
-    resident: a.resident.sort_by(n => n as String),
-  }
-  w_key(s: v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches())), which: "engram")
-    == w_key(s: v41_candidate_standing(readback: w_readback_unread(), c: w_inputs(patches: w_two_patches(), partition: swapped, route: engram_route_b_identity)), which: "engram")
-}
-
-test fn control_incomplete_manifests_stay_unestablished() -> Bool {
-  let a = w_default(patches: w_two_patches())
-  let incomplete = V41CandidateInputs {
-    runtime: a.runtime,
-    model_source: V41ModelSourceInputs {
-      checkpoint_revision: a.model_source.checkpoint_revision,
-      weights: V41ManifestUnestablished { obligation: "weights unread" as NonEmptyStr },
-      tokenizer: a.model_source.tokenizer,
-    },
-    engram: a.engram,
-    topology: a.topology,
-    device: a.device,
-  }
-  match v41_candidate_standing(readback: w_readback_unread(), c: incomplete).standing {
-    V41CandidateUnestablished { obligations: o } => any(o, x => (x as String).contains("weights unread"))
-    V41CandidateKeyed { runtime_artifact: _, model_source: _, engram_realization: _, execution_profile: _, candidate: _, authorization_obligation: _ } => false
-    V41CandidateRefused { defects: _ } => false
-  }
-}
-
-test fn control_mismatched_rank_store_refuses_distributed_launch() -> Bool {
-  match w_identified() {
-    Absent => false
-    Present { value: enc } => match v41_rank_digest_of(e: enc, layer: 1, rank: 0) {
-      Absent => false
-      Present { value: d0 } => match v41_distributed_launch(
-        opened: [
-          v41_open_rank_store(path: "/nvme/rank0.engram" as NonEmptyStr, expected: d0, observed: d0, layer: 1, rank: 0),
-          v41_open_rank_store(path: "/nvme/rank1.engram" as NonEmptyStr, expected: d0, observed: d0, layer: 1, rank: 1),
-        ],
-        encoding: enc,
-      ) {
-        V41StoreOpenRefused { defects: ds } => any(ds, x => (x as String).contains("distributed launch refuses"))
-        V41StoreHandle { path: _, expected: _, observed: _, layer: _, rank: _ } => false
-      }
-    }
-  }
-}
-
-test fn control_full_engram_pinned_allocation_refuses_the_candidate() -> Bool {
-  match v41_candidate_refuses_full_pin(obs: v41_observe_pinned(pinned_bytes: byte_size(count: 100), table_bytes: byte_size(count: 100))) {
-    Present { value: V41CandidateRealizationRefused { defects: d } } => any(d, x => (x as String).contains("full Engram pinned"))
-    Present { value: V41CandidateRealized { realized_runtime: _, row_store: _, execution_profile: _, candidate: _, authorization_obligation: _ } } => false
-    Present { value: V41CandidateRealizationUnestablished { obligations: _ } } => false
-    Absent => false
-  }
-}
-
-test fn a_bounded_staging_pin_is_not_a_full_table_pin() -> Bool {
-  match v41_candidate_refuses_full_pin(obs: v41_observe_pinned(pinned_bytes: byte_size(count: 8), table_bytes: byte_size(count: 100))) {
-    Absent => true
-    Present { value: _ } => false
-  }
-}
-
-test fn control_missing_local_store_cannot_use_nfs() -> Bool {
-  match v41_token_time(placement: RemoteNetwork, local_present: false) {
-    V41TokenTimeRefused { defects: d } => any(d, x => (x as String).contains("NFS"))
-    V41TokenTimeLocal { placement: _ } => false
-  }
-    && match v41_token_time(placement: LocalFilesystem, local_present: false) {
-      V41TokenTimeRefused { defects: d } => any(d, x => (x as String).contains("missing"))
-      V41TokenTimeLocal { placement: _ } => false
-    }
-}
-
-test fn control_published_infeasibility_is_not_weakened_by_a_keyed_specification() -> Bool {
-  v41_specification_is_not_selectable(spec: v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: V41PatchesAbsentByObservation)))
-    && v41_specification_is_not_selectable(spec: v41_candidate())
-}
-
-test fn a_keyed_specification_is_not_selectable_even_when_every_axis_keys() -> Bool {
-  v41_specification_is_not_selectable(spec: v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches())))
-}
-
-test fn realized_identity_requires_produced_image_digest_and_consumed_patches() -> Bool {
-  let spec = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches()))
-  match spec.standing {
-    V41CandidateKeyed { runtime_artifact: rk, model_source: _, engram_realization: _, execution_profile: _, candidate: _, authorization_obligation: _ } =>
-      match v41_realized_runtime(spec_runtime: rk, image: w_image(), provenance: AdoptedUnderExpectedTag, consumed: w_consumed()) {
-        V41RuntimeRealizationRefused { defects: d } => any(d, x => (x as String).contains("tag"))
-        V41RuntimeRealized { specification_runtime_key: _, image: _, consumed_patches: _, realized_runtime_key: _ } => false
-        V41RuntimeRealizationUnestablished { obligations: _ } => false
-      }
-    V41CandidateUnestablished { obligations: _ } => false
-    V41CandidateRefused { defects: _ } => false
-  }
-}
-
-fn w_realized_under(readback: V41StoreReadback) -> V41SelectableRuntime? {
-  let spec = v41_candidate_standing(readback: readback, c: w_default(patches: w_two_patches()))
-  match spec.standing {
-    V41CandidateKeyed { runtime_artifact: rk, model_source: _, engram_realization: _, execution_profile: _, candidate: _, authorization_obligation: _ } =>
-      match w_identified() {
-        Absent => none
-        Present { value: enc } => Present { value: v41_selectable(realized: v41_realized_candidate(
-          runtime: v41_realized_runtime(spec_runtime: rk, image: w_image(), provenance: BuiltByThisRun, consumed: w_consumed()),
-          row_store: enc,
-          spec: spec,
-        )) }
-      }
-    V41CandidateUnestablished { obligations: _ } => none
-    V41CandidateRefused { defects: _ } => none
-  }
-}
-
-test fn only_the_realized_candidate_is_selectable() -> Bool {
-  match w_realized_under(readback: V41StoreReadbackVerified { host: "srv5" as NonEmptyStr, observed_at: "fixture" as NonEmptyStr, samples: 40 }) {
-    Present { value: V41Selectable { candidate: _ } } => true
-    _ => false
-  }
-}
-
-// A REALIZED CANDIDATE IS SELECTABLE, SO THE SPECIFICATION'S DERIVATION EVIDENCE GATES IT: the same keyed
-// specification, image and stores that are selectable once the stores are read back are not while the
-// readback is unread, and the reason is the readback's obligation.
-test fn an_unread_readback_keeps_a_realized_candidate_unselectable() -> Bool {
-  match w_realized_under(readback: w_readback_unread()) {
-    Present { value: V41NotSelectable { reason: r } } => (r as String).contains("the stores were not read back")
-    _ => false
-  }
-}
-
-test fn adversarial_trace_larger_than_cache_evicts_and_stays_in_bound() -> Bool {
-  let limits = v41_residency_limits(
-    configured_cache: byte_size(count: 40),
-    effective_cache: byte_size(count: 40),
-    configured_staging: byte_size(count: 16),
-    effective_staging: byte_size(count: 16),
-    configured_inflight_io: byte_size(count: 16),
-    effective_inflight_io: byte_size(count: 16),
-  )
-  match v41_residency_under_trace(limits: limits, keys: w_keys(), row_bytes: byte_size(count: 10)) {
-    V41ResidencyWithinBound { limits: _, occupancy: o, evicted: e } => e > 0 && byte_size_count(b: o) <= 40
-    V41ResidencyExceeded { defects: _ } => false
-  }
-}
-
-test fn exceeding_configured_cache_refuses() -> Bool {
-  let over = v41_residency_limits(
-    configured_cache: byte_size(count: 10),
-    effective_cache: byte_size(count: 40),
-    configured_staging: byte_size(count: 16),
-    effective_staging: byte_size(count: 16),
-    configured_inflight_io: byte_size(count: 16),
-    effective_inflight_io: byte_size(count: 16),
-  )
-  match v41_residency_under_trace(limits: over, keys: w_keys(), row_bytes: byte_size(count: 10)) {
-    V41ResidencyExceeded { defects: d } => any(d, x => (x as String).contains("effective cache exceeds"))
-    V41ResidencyWithinBound { limits: _, occupancy: _, evicted: _ } => false
-  }
-}
-
-test fn staging_verifies_readback_and_refuses_a_wrong_rank_identity() -> Bool {
-  match w_identified() {
-    Absent => false
-    Present { value: enc } => match v41_staging_request(image: w_image(), encoding: enc) {
-      Absent => false
-      Present { value: req } => {
-        let good = v41_staged_matching(encoding: enc)
-        let bad = v41_staged_with_readback(encoding: enc, readback: content_hash_of_value(value: "nope" as NonEmptyStr))
-        (match v41_stage(request: req, image_readback: w_image().manifest, rank_readbacks: good, provenance: BuiltByThisRun) {
-          V41StagingVerified { request_key: _, image_readback: _, ranks: rs } => length(rs) == 4
-          V41RankStoresVerified { ranks: _ } => false
-          V41StagingRefused { defects: _ } => false
-          V41StagingUnestablished { obligation: _ } => false
-        })
-          && (match v41_stage(request: req, image_readback: w_image().manifest, rank_readbacks: bad, provenance: BuiltByThisRun) {
-            V41StagingRefused { defects: d } => any(d, x => (x as String).contains("readback"))
-            V41StagingVerified { request_key: _, image_readback: _, ranks: _ } => false
-            V41RankStoresVerified { ranks: _ } => false
-            V41StagingUnestablished { obligation: _ } => false
-          })
-          && (match v41_stage_rank_stores(encoding: enc, rank_readbacks: good) {
-            V41RankStoresVerified { ranks: rs } => length(rs) == 4
-            V41StagingVerified { request_key: _, image_readback: _, ranks: _ } => false
-            V41StagingRefused { defects: _ } => false
-            V41StagingUnestablished { obligation: _ } => false
-          })
-          && (match v41_stage_rank_stores(encoding: enc, rank_readbacks: bad) {
-            V41StagingRefused { defects: d } => any(d, x => (x as String).contains("readback"))
-            V41RankStoresVerified { ranks: _ } => false
-            V41StagingVerified { request_key: _, image_readback: _, ranks: _ } => false
-            V41StagingUnestablished { obligation: _ } => false
-          })
-          && (match v41_group_a_staging_standing {
-            V41StagingUnestablished { obligation: o } =>
-              (o as String).contains("do not launch")
-                && (o as String).contains("v41_stage_rank_stores")
-                && (o as String).contains("acquisition")
-                && (o as String).contains("candidate_component_budget")
-                && (o as String).contains("engram_pool_relief")
-                && declaration_ref_eq(a: v41_engram_goes_to_disk_because(), b: id_component_budget_authority)
-            V41StagingVerified { request_key: _, image_readback: _, ranks: _ } => false
-            V41RankStoresVerified { ranks: _ } => false
-            V41StagingRefused { defects: _ } => false
-          })
-      }
-    }
-  }
-}
-
-test fn the_live_storage_backed_patches_are_digestfile_of_committed_bytes() -> Bool {
-  match v41_storage_backed_patch_population() {
-    V41PatchesObserved { patches: ps, partition: _ } =>
-      length(ps) == 7
-        && all(ps, p => (p.path as String).contains("d2d649e6"))
-        && !all(ps, p => !(p.path as String).contains("sm120_64_token_kernel_pages"))
-        && !all(ps, p => !(p.path as String).contains("flashinfer_0_7_1rc1_requirements"))
-        && !all(ps, p => !(p.path as String).contains("deepgemm_sm120_fp8_page32"))
-    V41PatchesAbsentByObservation => false
-    V41PatchesUnestablished { obligation: _ } => false
-  }
-}
-
-test fn overlay_magic_cites_the_row_store_authority() -> Bool {
-  let local = Filesystem.Read(path: v41_engram_file_backed_overlay_path as String)
-  local.success
-    && (local.content as String).contains("v41_row_store_magic")
-    && (local.content as String).contains("expected.magic")
-    && !(local.content as String).contains("MAGIC = b")
-}
-
diff --git a/dag/test/claim/spark/v41_group_a_launch_witness_test.dag b/dag/test/claim/spark/v41_group_a_launch_witness_test.dag
deleted file mode 100644
index c6579664e16..00000000000
--- a/dag/test/claim/spark/v41_group_a_launch_witness_test.dag
+++ /dev/null
@@ -1,570 +0,0 @@
-module test.claim.spark.v41_group_a_launch_witness
-
-import std.types { Bool, String, List, NonEmptyStr }
-import std.nat { Nat }
-import std.optional { Present, Absent }
-import std.measure { token_count, basis_point, kibibyte, kibibyte_count, mebibyte }
-import extdeps.systemd { Active }
-import gunbc.compute.host_occupancy { HostUnoccupied, HostOccupiedBy, ServingUnitActive }
-import std.content_hash { ContentHash, Sha256Hash, sha256_hex_digest }
-import std.temporal_effect { HeldLease, held_lease, LeaseEpoch, LeaseRunningExpected, LeaseRunningStale }
-import product.host_identity { HostIdentity }
-import extdeps.container.oci.digest { oci_sha256_content_digest }
-import extdeps.vllm.engine_args { PrefixCachingExplicit }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, fabric_group_hosts }
-import gunbc.spark.released_baseline { QuiescentReservedBaseline }
-import gunbc.spark.runtime_architecture_registry_reading { ArchitectureRegistryReading }
-import gunbc.spark.vllm_runtime_image_build { VllmImageDistributionSubject, VllmImageTargetRead, VllmImageTargetHolds, VllmImageTargetNeeds, VllmImageTargetRefused }
-import gunbc.spark.v41_source_patch_converge { v41_observed_source_identity_of }
-import gunbc.spark.v41_runtime_image_converge { V41ProducedImageHeld, v41_production_produced_image, v41_produced_image_subject }
-import gunbc.spark.v41_runtime_image_probe { V41ProbeRead, V41ProbeRefused }
-import gunbc.spark.v41_engram_store_manifest { V41StoreManifestDerived }
-import gunbc.spark.v41_runtime_candidate { v41_candidate_recipe, V41IdentityStanding, V41IdentityKeyed, V41IdentityUnestablished }
-import gunbc.spark.v41_runtime_candidate { V41CandidateStanding, V41CandidateKeyed }
-import gunbc.spark.pair_serving_authority {
-  PairServingGroupAuthority, PairServingActive, SuspendedForAuthorizedSuccessor,
-  PairRealizationKeyed, PairRealizationUnestablished,
-}
-import gunbc.spark.serving_arm_launch { ArmNodeLaunch }
-import gunbc.spark.serving_arm { deepseek_v41_launch_policy, gb10_unified_pool_gib, serving_arm_admits, serving_arm_admits_under, ServingArmAdmitted, ServingArmRefused, DeepseekV41FlashDba1be0a, FourSparkTp4 }
-import gunbc.spark.native_serving_realization { GlmNativeUnitRender, GlmNativeUnitRendered, GlmNativeUnitRenderRefused }
-import gunbc.spark.serving_capacity_intent {
-  uniform_cold_seats, envelope_at_cold_floor, profile_for_envelope, ServingCapacityIntentAdmitted, ServingCapacityIntentRefused,
-}
-import gunbc.spark.group_arm_launch {
-  GroupArmHostOccupancy, group_arm_dry_run_occupancy,
-  GroupArmLaunchAdmission, GroupArmLaunchAdmitted, GroupArmLaunchAdmittedForAdoptionOnly, ArmOwnFence, ArmOwnFenceHeld, ArmOwnFenceAbsent, GroupArmLaunchAdmissionRefused,
-}
-import gunbc.spark.v41_group_a_launch {
-  V41GroupALaunchInputs,
-  V41GroupALaunchPlan, V41GroupALaunchPlanned, V41GroupALaunchUnestablished, V41GroupALaunchRefused,
-  v41_group_a_launch_plan, v41_group_a_live_inputs, v41_group_a_unit_renders, v41_serving_runtime,
-  V41HeldRuntimeStanding, V41RuntimeHeldOnHosts, V41RuntimeHeldUnestablished, V41RuntimeHeldRefused,
-  v41_admit_held_runtime, v41_registry_reading_of, v41_group_a_memory_need,
-  v41_group_a_launch_admission, v41_group_a_dry_run_report,
-  v41_group_a_container_name, v41_engram_manifest_env_name, v41_engram_touch_receipt_env_name,
-  v41_engram_manifest_dir, v41_engram_touch_receipt_dir,
-  v41_sm120_selftest_argv, v41_sm120_selftest_module, v41_engine_model_path,
-}
-
-// ── THE FIXTURES ARE SUPPLIED AT THE LAUNCH'S OWN INTERFACE ────────────────────────────────────
-//
-// The launch plan takes four inputs that are values on main's production route -- the produced image,
-// its registry reading and the manifest text -- so every claim below hands
-// them in rather than re-running the build lane, the probe, or the row-store encode. The PAIRING
-// OBLIGATION is w_the_live_route_reaches_the_planner_and_names_every_gap: it runs the real live inputs
-// through the same planner and asserts the ROUTE it refuses by, not only that it refuses.
-
-data w_config_hex: String = "2222222222222222222222222222222222222222222222222222222222222222"
-
-fn with_w_hashes(scenario: fn(ContentHash, ContentHash) -> Bool) -> Bool {
-  match sha256_hex_digest(hex: "1111111111111111111111111111111111111111111111111111111111111111") {
-    Absent => false
-    Present { value: runtime_digest } =>
-      match sha256_hex_digest(hex: "3333333333333333333333333333333333333333333333333333333333333333") {
-        Absent => false
-        Present { value: candidate_digest } => scenario(Sha256Hash(runtime_digest), Sha256Hash(candidate_digest))
-      }
-  }
-}
-
-fn w_held(runtime_key: ContentHash) -> V41HeldRuntimeStanding? {
-  match oci_sha256_content_digest(hex: w_config_hex) {
-    Absent => none
-    Present { value: d } =>
-      match sha256_hex_digest(hex: "4444444444444444444444444444444444444444444444444444444444444444") {
-        Absent => none
-        Present { value: diff } => Present { value: V41RuntimeHeldOnHosts {
-          specification_runtime_key: runtime_key,
-          image: V41ProducedImageHeld {
-            observed: v41_observed_source_identity_of(revision_head: "d2d649e674c75425d2d6975c87eb89fd4d55fff8" as NonEmptyStr, worktree_diff_sha256: diff),
-            config: d,
-            held_on: "srv8" as HostIdentity,
-            receipt_run: "witness" as NonEmptyStr,
-          },
-          subject: VllmImageDistributionSubject { tag: "gunbc-vllm-v41-gb10:witness" as NonEmptyStr, config: d },
-        } }
-      }
-  }
-}
-
-fn w_registry() -> ArchitectureRegistryReading {
-  ArchitectureRegistryReading {
-    image_reference: join(["sha256:", w_config_hex], "") as NonEmptyStr,
-    host: "witness" as NonEmptyStr,
-    observed_at: "2026-09-26" as NonEmptyStr,
-    instrument: "witness" as NonEmptyStr,
-    architectures: ["DeepseekV41ForCausalLM" as NonEmptyStr],
-  }
-}
-
-data w_manifest: String = "{\"magic_hex\": \"witness\", \"stores\": []}"
-
-fn w_inputs(runtime_key: ContentHash, registry: ArchitectureRegistryReading?) -> V41GroupALaunchInputs? {
-  match w_held(runtime_key: runtime_key) {
-    Absent => none
-    Present { value: p } => Present { value: V41GroupALaunchInputs {
-      held: p, registry_reading: registry, manifest: V41StoreManifestDerived { text: w_manifest, stores: 0 },
-    } }
-  }
-}
-
-fn with_w_plan(f: fn(V41GroupALaunchPlan, ContentHash, ContentHash) -> Bool) -> Bool {
-  with_w_hashes(scenario: fn(rk, ck) {
-    match w_inputs(runtime_key: rk, registry: Present { value: w_registry() }) {
-      Absent => false
-      Present { value: i } => f(v41_group_a_launch_plan(inputs: i), rk, ck)
-    }
-  })
-}
-
-fn planned_lines(p: V41GroupALaunchPlan) -> List<ArmNodeLaunch> {
-  match p {
-    V41GroupALaunchPlanned { lines: ls, profile: _, specification_runtime_key: _, manifest_text: _, master_endpoint: _ } => ls
-    V41GroupALaunchUnestablished { obligations: _ } => [] as List<ArmNodeLaunch>
-    V41GroupALaunchRefused { causes: _ } => [] as List<ArmNodeLaunch>
-  }
-}
-
-data argv_frame: String = "\u{1f}"
-
-fn argv_pair_is(argv: List<String>, flag: String, value: String) -> Bool {
-  string_contains(
-    s: join(concat([""], concat(argv, [""])), argv_frame),
-    pattern: join([argv_frame, flag, argv_frame, value, argv_frame], ""))
-}
-
-fn argv_has(argv: List<String>, word: String) -> Bool {
-  any(argv, w => w == word)
-}
-
-// ── THE PLAN: FOUR RANKS, TP4 OVER mp, THE V4.1 FLAGS ON EVERY RANK ────────────────────────────
-test fn w_the_plan_is_four_mp_ranks_with_the_v41_engine_flags() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    let ls = planned_lines(p: p)
-    length(ls) == 4
-      && all(ls, l =>
-        argv_pair_is(argv: l.engine_argv, flag: "--tensor-parallel-size", value: "4")
-          && argv_pair_is(argv: l.engine_argv, flag: "--distributed-executor-backend", value: "mp")
-          && argv_pair_is(argv: l.engine_argv, flag: "--nnodes", value: "4")
-          && argv_pair_is(argv: l.engine_argv, flag: "--kv-cache-dtype", value: "fp8_ds_mla")
-          && argv_pair_is(argv: l.engine_argv, flag: "--engram-config.cpu_offload", value: "true")
-          && argv_pair_is(argv: l.engine_argv, flag: "--engram-config.dp_shared_memory", value: "false")
-          && argv_pair_is(argv: l.engine_argv, flag: "--max-model-len", value: "262144")
-          && argv_pair_is(argv: l.engine_argv, flag: "--max-num-seqs", value: "16")
-          && argv_pair_is(argv: l.engine_argv, flag: "--tokenizer-mode", value: "deepseek_v41")
-          && argv_pair_is(argv: l.engine_argv, flag: "--tool-call-parser", value: "deepseek_v41")
-          && argv_pair_is(argv: l.engine_argv, flag: "--master-port", value: "29500")
-          && argv_has(argv: l.engine_argv, word: "--no-enable-prefix-caching")
-          && (l.image_reference as String) == join(["sha256:", w_config_hex], ""))
-      && any(ls, l => l.node.node_rank == 0 && !argv_has(argv: l.engine_argv, word: "--headless"))
-      && length(filter(ls, l => argv_has(argv: l.engine_argv, word: "--headless"))) == 3
-  })
-}
-
-// THE LAUNCH SERVES TEXT ONLY ON EVERY RANK. The vision variant widens prefill sliding-window rows to
-// 1152, for which FlashInfer's SM120 DSv4 kernel has no specialization; --language-model-only alone
-// leaves that width, and the vision_n_layers override is what returns it to 128.
-test fn w_every_rank_serves_text_only_with_the_vision_layers_overridden_away() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    let ls = planned_lines(p: p)
-    length(ls) == 4
-      && all(ls, l =>
-        argv_has(argv: l.engine_argv, word: "--language-model-only")
-          && argv_pair_is(argv: l.engine_argv, flag: "--hf-overrides.vision_n_layers", value: "0"))
-  })
-}
-
-// THE SM120 GATE RUNS THE RANK'S OWN ARGV IN THE RANK'S OWN IMAGE. The self-test parses exactly the words
-// the container will hand `vllm serve`, so the gate's argv must end with that rank's engine argv
-// unchanged, run the overlay's module in the planned image, and mount the checkpoint read-only where
-// the engine argv's model path names it.
-test fn w_the_sm120_gate_runs_each_ranks_engine_argv_in_its_image() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    let ls = planned_lines(p: p)
-    length(ls) == 4
-      && all(ls, l => match v41_engine_model_path(l: l) {
-        Absent => false
-        Present { value: model_path } => {
-          let argv = v41_sm120_selftest_argv(l: l, model_path: model_path)
-          argv_pair_is(argv: argv, flag: "-v", value: join([l.host_model_path as String, ":", model_path, ":ro"], ""))
-            && argv_pair_is(argv: argv, flag: "-m", value: v41_sm120_selftest_module)
-            && argv_has(argv: argv, word: l.image_reference as String)
-            && argv_has(argv: argv, word: "--rm")
-            && join(argv, argv_frame).ends_with(suffix: join(concat([v41_sm120_selftest_module], l.engine_argv), argv_frame))
-        }
-      })
-  })
-}
-
-// THE FILE-BACKED ENGRAM PATH REACHES THE CONTAINER: both variables, the store mounted read-only at its
-// own path, the manifest directory read-only, the receipt directory writable -- and the container is
-// named for this arm, never the V4 pair's gunbc-spark-pair.
-test fn w_every_rank_carries_the_engram_env_and_mounts_under_its_own_name() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    let ls = planned_lines(p: p)
-    length(ls) == 4 && all(ls, l =>
-      (l.container.name as String) == (v41_group_a_container_name as String)
-        && any(l.container.env, e => (e.name as String) == (v41_engram_manifest_env_name as String) && string_contains(s: e.value, pattern: v41_engram_manifest_dir as String))
-        && any(l.container.env, e => (e.name as String) == (v41_engram_touch_receipt_env_name as String) && e.value == (v41_engram_touch_receipt_dir as String))
-        && string_contains(s: join(l.create.arguments, " "), pattern: join(["src=", v41_engram_manifest_dir as String, ",dst=", v41_engram_manifest_dir as String, ",ro"], ""))
-        && string_contains(s: join(l.create.arguments, " "), pattern: join(["src=", v41_engram_touch_receipt_dir as String, ",dst=", v41_engram_touch_receipt_dir as String], ""))
-        && string_contains(s: join(l.create.arguments, " "), pattern: "/engram-row-stores,ro")
-        && !string_contains(s: join(l.create.arguments, " "), pattern: "gunbc-spark-pair"))
-  })
-}
-
-// THE UNITS ARE THIS ARM'S: a head unit on rank 0, rank units elsewhere, and neither is a name the V4
-// pair or the GLM arm uses -- so a unit still running under those names reads as occupancy, not as this.
-test fn w_the_units_render_under_names_no_other_arm_uses() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    let rs = v41_group_a_unit_renders(p: p)
-    length(rs) == 4 && all(rs, r => match r {
-      GlmNativeUnitRenderRefused { unit_name: _, cause: _ } => false
-      GlmNativeUnitRendered { unit_name: n, text: t } =>
-        string_contains(s: n as String, pattern: "gunbc-v41-tp4-")
-          && string_contains(s: t, pattern: "--name gunbc-v41-tp4 ")
-          && !string_contains(s: t, pattern: "glm-native")
-          && !string_contains(s: t, pattern: "gunbc-spark-pair")
-    })
-  })
-}
-
-// THE UNITS ARE THE EXPERIMENT THE WALL ADMITTED: every rank renders bounded -- no restart, a finite
-// RuntimeMaxSec, one start, no [Install] -- because the plan and the render read one intent row
-// (gunbc.spark.v41_group_a_launch v41_group_a_intent). A persistent render (Restart=always, WantedBy)
-// of a launch admitted only as an experiment is the defect this row goes red on.
-test fn w_every_v41_unit_renders_as_the_bounded_experiment_it_was_admitted_as() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    let rs = v41_group_a_unit_renders(p: p)
-    length(rs) == 4 && all(rs, r => match r {
-      GlmNativeUnitRenderRefused { unit_name: _, cause: _ } => false
-      GlmNativeUnitRendered { unit_name: _, text: t } =>
-        string_contains(s: t, pattern: "RuntimeMaxSec=")
-          && string_contains(s: t, pattern: "Restart=no")
-          && string_contains(s: t, pattern: "StartLimitBurst=1")
-          && !string_contains(s: t, pattern: "Restart=always")
-          && !string_contains(s: t, pattern: "WantedBy=")
-    })
-  })
-}
-
-// ── REFUSALS, EACH ASSERTING ITS REASON ───────────────────────────────────────────────────────
-
-// WITH NO REGISTRY READING INSIDE THE PRODUCED IMAGE, THE ARM WALL REFUSES -- and it is the arm wall's
-// own refusal (gunbc.spark.serving_arm serving_arm_admits), not an accident of this module.
-test fn w_an_unprobed_image_is_refused_by_the_arm_wall() -> Bool {
-  with_w_hashes(scenario: fn(rk, ck) {
-    match w_inputs(runtime_key: rk, registry: none) {
-      Absent => false
-      Present { value: i } => match v41_group_a_launch_plan(inputs: i) {
-        V41GroupALaunchRefused { causes: c } => any(c, x => string_contains(s: x, pattern: "no registry reading exists"))
-        V41GroupALaunchPlanned { lines: _, profile: _, specification_runtime_key: _, manifest_text: _, master_endpoint: _ } => false
-        V41GroupALaunchUnestablished { obligations: _ } => false
-      }
-    }
-  })
-}
-
-// THE ENGRAM PAGE CACHE IS CHARGED TO THE POOL, NOT TREATED AS FREE. The allowance is the share of the
-// pool the profile leaves outside the engine: at the measurement's 0.80 the arm fits (the planned claims
-// above), and at 0.50 the same checkpoint's allowance is half of every rank, which the aggregate pool
-// cannot hold -- the refusal names the allowance, so a wall that charged zero would not produce it.
-test fn w_the_engram_page_cache_allowance_is_charged_to_the_pool() -> Bool {
-  with_w_hashes(scenario: fn(rk, ck) {
-    match w_held(runtime_key: rk) {
-      Absent => false
-      Present { value: p } => match v41_serving_runtime(held: p, registry_reading: Present { value: w_registry() }) {
-        Absent => false
-        Present { value: r } => {
-          match uniform_cold_seats(each: token_count(count: 262144), seats: 16, max_batched_tokens: token_count(count: 8192)) {
-            ServingCapacityIntentRefused { cause: _ } => false
-            ServingCapacityIntentAdmitted { intent: i } => {
-              let half = profile_for_envelope(
-                envelope: envelope_at_cold_floor(cold: i), policy: deepseek_v41_launch_policy,
-                decided_gpu_memory_basis_points: basis_point(count: 5000),
-                serve_port: 30000, served_alias: "witness" as NonEmptyStr, prefix_caching: PrefixCachingExplicit { enabled: false })
-              match serving_arm_admits_under(checkpoint: DeepseekV41FlashDba1be0a, runtime: r, topology: FourSparkTp4, profile: Present { value: half }) {
-                ServingArmRefused { cause: c } => string_contains(s: c as String, pattern: "GiB declared page-cache allowance")
-                ServingArmAdmitted => false
-              }
-            }
-          }
-        }
-      }
-    }
-  })
-}
-
-// WITHOUT A PROFILE THE ALLOWANCE IS UNKNOWN, AND UNKNOWN IS NOT ZERO: the profile-less wall refuses
-// this checkpoint rather than fitting it on weights alone.
-test fn w_without_a_profile_the_allowance_is_unknown_and_refuses() -> Bool {
-  with_w_hashes(scenario: fn(rk, ck) {
-    match w_held(runtime_key: rk) {
-      Absent => false
-      Present { value: p } => match v41_serving_runtime(held: p, registry_reading: Present { value: w_registry() }) {
-        Absent => false
-        Present { value: r } => match serving_arm_admits(checkpoint: DeepseekV41FlashDba1be0a, runtime: r, topology: FourSparkTp4) {
-          ServingArmRefused { cause: c } => string_contains(s: c as String, pattern: "no profile was supplied")
-          ServingArmAdmitted => false
-        }
-      }
-    }
-  })
-}
-
-// THE PAIRING OBLIGATION: THE LIVE ROUTE. The dry run's real inputs reach the planner and name the held
-// image as the wet entry's reading -- the route, not just the fact of a refusal. The manifest is supplied
-// here; its derivation is gunbc.spark.v41_engram_store_manifest's subject.
-test fn w_the_live_route_reaches_the_planner_and_names_every_gap() -> Bool {
-  match v41_group_a_launch_plan(inputs: v41_group_a_live_inputs(manifest: V41StoreManifestDerived { text: w_manifest, stores: 0 })) {
-    V41GroupALaunchUnestablished { obligations: o } =>
-      length(o) == 1
-        && any(o, x => string_contains(s: x, pattern: "the V4.1 image") && string_contains(s: x, pattern: "arm_group_launch_ci_wet"))
-        && !any(o, x => string_contains(s: x, pattern: "manifest"))
-    V41GroupALaunchPlanned { lines: _, profile: _, specification_runtime_key: _, manifest_text: _, master_endpoint: _ } => false
-    V41GroupALaunchRefused { causes: _ } => false
-  }
-}
-
-// ── ADMISSION ─────────────────────────────────────────────────────────────────────────────────
-
-fn w_lease(h: ContentHash, stale: Bool) -> HeldLease {
-  held_lease(
-    epoch: LeaseEpoch { lease_key: "witness-lease" as NonEmptyStr, resource_fingerprint: h, owner_fingerprint: h, generation: 1 },
-    observed: if stale { LeaseRunningStale } else { LeaseRunningExpected })
-}
-
-fn w_suspended_for(successor: ContentHash, stale: Bool) -> PairServingGroupAuthority {
-  SuspendedForAuthorizedSuccessor {
-    group: FabricGroupA, hosts: fabric_group_hosts(g: FabricGroupA),
-    authorization: "witness-escalation" as NonEmptyStr,
-    exact_candidate_realization: PairRealizationKeyed { key: successor },
-    lease: w_lease(h: successor, stale: stale),
-    cleanup: QuiescentReservedBaseline,
-  }
-}
-
-fn w_candidate(runtime_key: ContentHash, candidate: ContentHash) -> V41CandidateStanding {
-  V41CandidateKeyed {
-    runtime_artifact: runtime_key, model_source: candidate, engram_realization: candidate,
-    execution_profile: candidate, candidate: candidate,
-    authorization_obligation: "witness" as NonEmptyStr,
-  }
-}
-
-fn w_refused_with(a: GroupArmLaunchAdmission, fragment: String) -> Bool {
-  match a {
-    GroupArmLaunchAdmitted => false
-    GroupArmLaunchAdmittedForAdoptionOnly { hosts: _ } => false
-    GroupArmLaunchAdmissionRefused { causes: c } => any(c, x => string_contains(s: x, pattern: fragment))
-  }
-}
-
-fn w_vacant() -> List<GroupArmHostOccupancy> {
-  map(fabric_group_hosts(g: FabricGroupA), h => GroupArmHostOccupancy { host: h, own_fence: ArmOwnFenceAbsent, admission: HostUnoccupied { available: kibibyte(count: 120000000) } })
-}
-
-// THE HOSTS STILL RUNNING THE V4 PAIR WORKER: the srv8 state of 2026-09-26 (99.7 GB held by
-// gunbc-spark-pair-worker.service). It is occupancy to refuse on, never something this launch stops.
-fn w_hosts_running_the_pair_worker() -> List<GroupArmHostOccupancy> {
-  map(fabric_group_hosts(g: FabricGroupA), h => GroupArmHostOccupancy { host: h, own_fence: ArmOwnFenceAbsent, admission: HostOccupiedBy {
-    occupant: ServingUnitActive { unit: "gunbc-spark-pair-worker.service" as NonEmptyStr, state: Active },
-    others: [], gpu_used: mebibyte(count: 99700) } })
-}
-
-// THE POSITIVE CONTROL: suspended for exactly this candidate, lease running, the image built for the
-// candidate's runtime key, every host held. Each refusal below changes exactly one of those.
-test fn w_a_suspension_for_this_candidate_admits() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    match v41_group_a_launch_admission(plan: p, authority: Present { value: w_suspended_for(successor: ck, stale: false) }, candidate: w_candidate(runtime_key: rk, candidate: ck), held: fabric_group_hosts(g: FabricGroupA), occupancy: w_vacant()) {
-      GroupArmLaunchAdmitted => true
-      GroupArmLaunchAdmittedForAdoptionOnly { hosts: _ } => false
-      GroupArmLaunchAdmissionRefused { causes: _ } => false
-    }
-  })
-}
-
-test fn w_an_active_incumbent_refuses() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(
-      a: v41_group_a_launch_admission(plan: p,
-        authority: Present { value: PairServingActive { group: FabricGroupA, exact_realization: PairRealizationUnestablished { obligation: "witness" as NonEmptyStr } } },
-        candidate: w_candidate(runtime_key: rk, candidate: ck), held: fabric_group_hosts(g: FabricGroupA), occupancy: w_vacant()),
-      fragment: "is Active for the incumbent")
-  })
-}
-
-test fn w_an_expired_lease_may_not_start_a_launch() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(
-      a: v41_group_a_launch_admission(plan: p, authority: Present { value: w_suspended_for(successor: ck, stale: true) },
-        candidate: w_candidate(runtime_key: rk, candidate: ck), held: fabric_group_hosts(g: FabricGroupA), occupancy: w_vacant()),
-      fragment: "lease is not running as expected")
-  })
-}
-
-test fn w_a_suspension_for_another_successor_refuses() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(
-      a: v41_group_a_launch_admission(plan: p, authority: Present { value: w_suspended_for(successor: rk, stale: false) },
-        candidate: w_candidate(runtime_key: rk, candidate: ck), held: fabric_group_hosts(g: FabricGroupA), occupancy: w_vacant()),
-      fragment: "not this candidate")
-  })
-}
-
-test fn w_an_image_built_for_another_runtime_key_refuses() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(
-      a: v41_group_a_launch_admission(plan: p, authority: Present { value: w_suspended_for(successor: ck, stale: false) },
-        candidate: w_candidate(runtime_key: ck, candidate: ck), held: fabric_group_hosts(g: FabricGroupA), occupancy: w_vacant()),
-      fragment: "admitted against runtime key")
-  })
-}
-
-test fn w_a_host_the_subject_does_not_hold_refuses() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(
-      a: v41_group_a_launch_admission(plan: p, authority: Present { value: w_suspended_for(successor: ck, stale: false) },
-        candidate: w_candidate(runtime_key: rk, candidate: ck), held: filter(fabric_group_hosts(g: FabricGroupA), h => false), occupancy: w_vacant()),
-      fragment: "is not held by")
-  })
-}
-
-test fn w_a_host_still_running_the_v4_pair_worker_refuses() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(
-      a: v41_group_a_launch_admission(plan: p, authority: Present { value: w_suspended_for(successor: ck, stale: false) },
-        candidate: w_candidate(runtime_key: rk, candidate: ck), held: fabric_group_hosts(g: FabricGroupA), occupancy: w_hosts_running_the_pair_worker()),
-      fragment: "gunbc-spark-pair-worker.service")
-  })
-}
-
-// ABSENCE IS NOT VACANCY: a host the caller supplied no reading for refuses, and so does every host of
-// the live dry run, which reaches no host.
-test fn w_an_unread_host_is_never_vacant() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    w_refused_with(
-      a: v41_group_a_launch_admission(plan: p, authority: Present { value: w_suspended_for(successor: ck, stale: false) },
-        candidate: w_candidate(runtime_key: rk, candidate: ck), held: fabric_group_hosts(g: FabricGroupA), occupancy: []),
-      fragment: "no occupancy reading was supplied")
-    && w_refused_with(
-      a: v41_group_a_launch_admission(plan: p, authority: Present { value: w_suspended_for(successor: ck, stale: false) },
-        candidate: w_candidate(runtime_key: rk, candidate: ck), held: fabric_group_hosts(g: FabricGroupA), occupancy: group_arm_dry_run_occupancy(group: FabricGroupA)),
-      fragment: "could not be read for occupancy")
-  })
-}
-
-// ── THE DRY RUN RENDERS EVERY HOST'S UNIT, LINE AND SCRIPTS ──────────────────────────────────
-test fn w_the_dry_run_renders_all_four_hosts() -> Bool {
-  with_w_plan(f: fn(p, rk, ck) {
-    let report = v41_group_a_dry_run_report(plan: p, admission: GroupArmLaunchAdmitted)
-    length(split(report, "=== host ")) == 5
-      && length(split(report, "--- engram staging")) == 5
-      && length(split(report, "--- preflight")) == 5
-      && length(split(report, "--- apply")) == 5
-      && string_contains(s: report, pattern: "v41-engram-manifest: write-file /var/lib/gunbc/v41-engram-manifest/row-store-manifest.json")
-      && !string_contains(s: report, pattern: "row-store-manifest.json.next")
-      && string_contains(s: report, pattern: "admission: ADMITTED")
-  })
-}
-
-// ── THE HELD IMAGE: THE PRODUCTION RECEIPT JOINED TO EVERY HOST'S READBACK ─────────────────────
-//
-// These run the real admission over the real receipt row and candidate inputs, with each host's
-// readback supplied -- the readback is the only part that needs a host.
-
-fn w_reads(state_of: fn(HostIdentity) -> VllmImageTargetRead) -> List<VllmImageTargetRead> {
-  map(fabric_group_hosts(g: FabricGroupA), h => state_of(h))
-}
-
-// THE CANDIDATE'S RUNTIME KEY IS SUPPLIED: computing it reads the kernel wheels, and it is the build's
-// admission's subject (gunbc.spark.v41_runtime_realized), not this one's.
-fn w_artifact() -> V41IdentityStanding {
-  match sha256_hex_digest(hex: "1111111111111111111111111111111111111111111111111111111111111111") {
-    Absent => V41IdentityUnestablished { obligations: ["witness digest did not parse" as NonEmptyStr] }
-    Present { value: d } => V41IdentityKeyed { key: Sha256Hash(d) }
-  }
-}
-
-fn w_admit(reads: List<VllmImageTargetRead>) -> V41HeldRuntimeStanding {
-  v41_admit_held_runtime(recipe: v41_candidate_recipe(), artifact: w_artifact(), image: v41_production_produced_image, hosts: fabric_group_hosts(g: FabricGroupA), reads: reads)
-}
-
-// THE POSITIVE CONTROL: every host holds the receipt's digest under its tag, so the image is held and
-// its subject is the distribution's own (the tag re-derived from the receipt's tree).
-test fn w_every_host_holding_the_receipt_digest_is_held() -> Bool {
-  match w_admit(reads: w_reads(state_of: fn(h) { VllmImageTargetRead { host: h, state: VllmImageTargetHolds } })) {
-    V41RuntimeHeldOnHosts { specification_runtime_key: _, image: i, subject: sub } =>
-      (i.receipt_run as String) == (v41_production_produced_image.receipt_run as String)
-        && (sub.tag as String) == (v41_produced_image_subject(p: v41_production_produced_image).tag as String)
-    V41RuntimeHeldUnestablished { obligations: _ } => false
-    V41RuntimeHeldRefused { defects: _ } => false
-  }
-}
-
-// ONE HOST HOLDING NOTHING UNDER THE TAG IS AN OBLIGATION NAMING THAT HOST AND THE DISTRIBUTION MODE,
-// never a refusal and never a pass.
-test fn w_a_host_holding_nothing_is_an_obligation_to_distribute() -> Bool {
-  match w_admit(reads: w_reads(state_of: fn(h) { VllmImageTargetRead { host: h, state: if (h as String) == "srv7" { VllmImageTargetNeeds } else { VllmImageTargetHolds } } })) {
-    V41RuntimeHeldUnestablished { obligations: o } =>
-      length(o) == 1 && any(o, x => string_contains(s: x, pattern: "srv7") && string_contains(s: x, pattern: "runtime_image_distribute_ci_wet"))
-    V41RuntimeHeldOnHosts { specification_runtime_key: _, image: _, subject: _ } => false
-    V41RuntimeHeldRefused { defects: _ } => false
-  }
-}
-
-// A HOST HOLDING ANOTHER IMAGE UNDER THE TAG REFUSES: loading over it is not this launch's to do.
-test fn w_a_host_holding_another_image_refuses() -> Bool {
-  match w_admit(reads: w_reads(state_of: fn(h) { VllmImageTargetRead { host: h, state: if (h as String) == "srv6" { VllmImageTargetRefused { step: "deliver-digest-pre" as NonEmptyStr, cause: "the target holds sha256:ffff under the tag" } } else { VllmImageTargetHolds } } })) {
-    V41RuntimeHeldRefused { defects: d } => any(d, x => string_contains(s: x, pattern: "srv6") && string_contains(s: x, pattern: "sha256:ffff"))
-    V41RuntimeHeldOnHosts { specification_runtime_key: _, image: _, subject: _ } => false
-    V41RuntimeHeldUnestablished { obligations: _ } => false
-  }
-}
-
-// A HOST WITH NO READBACK AT ALL IS AN OBLIGATION, NEVER READ AS HOLDING THE IMAGE.
-test fn w_a_host_with_no_readback_is_an_obligation() -> Bool {
-  match w_admit(reads: filter(w_reads(state_of: fn(h) { VllmImageTargetRead { host: h, state: VllmImageTargetHolds } }), r => (r.host as String) != "srv5")) {
-    V41RuntimeHeldUnestablished { obligations: o } => any(o, x => string_contains(s: x, pattern: "no image readback was taken on srv5"))
-    V41RuntimeHeldOnHosts { specification_runtime_key: _, image: _, subject: _ } => false
-    V41RuntimeHeldRefused { defects: _ } => false
-  }
-}
-
-// ── THE REGISTRY READING, FOLDED FROM THE PROBE'S OWN OUTPUT ─────────────────────────────────
-
-data w_probe_stdout: String = "COMPUTE_CAPABILITY_MAJOR 12\nREGISTRY_COUNT 2\nREGISTERED DeepseekV41ForCausalLM\nREGISTERED DeepseekV4ForCausalLM\nVERDICT architecture-registered=present\n"
-
-fn w_probe_of(stdout: String, observed: String) -> V41ProbeRead {
-  V41ProbeRead { reference: "witness" as NonEmptyStr, observed_config_id: observed as NonEmptyStr, stdout: stdout, readings: [] }
-}
-
-fn w_production_digest() -> String {
-  "sha256:5de3c35577e5c8f3026c143d3d5b2d66cc527119281369f4651d969f581829d3"
-}
-
-// A PROBE INSIDE THE RECEIPT'S DIGEST, WITH A COUNT ITS LINES AGREE WITH, IS A READING OF EXACTLY THOSE
-// ARCHITECTURES AT THAT DIGEST.
-test fn w_a_joined_complete_probe_is_a_registry_reading() -> Bool {
-  match v41_registry_reading_of(probe: w_probe_of(stdout: w_probe_stdout, observed: w_production_digest()), image: v41_production_produced_image, host: "srv5" as HostIdentity, observed_at: "2026-09-27") {
-    Absent => false
-    Present { value: r } =>
-      (r.image_reference as String) == w_production_digest()
-        && length(r.architectures) == 2
-        && any(r.architectures, a => (a as String) == "DeepseekV41ForCausalLM")
-  }
-}
-
-// NO READING FROM A PROBE OF ANOTHER IMAGE, FROM A COUNT THE LINES DISAGREE WITH, OR FROM A REFUSED PROBE.
-test fn w_an_unjoined_or_incomplete_probe_is_no_reading() -> Bool {
-  let other = v41_registry_reading_of(probe: w_probe_of(stdout: w_probe_stdout, observed: "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"), image: v41_production_produced_image, host: "srv5" as HostIdentity, observed_at: "2026-09-27")
-  let short = v41_registry_reading_of(probe: w_probe_of(stdout: "REGISTRY_COUNT 3\nREGISTERED DeepseekV41ForCausalLM\n", observed: w_production_digest()), image: v41_production_produced_image, host: "srv5" as HostIdentity, observed_at: "2026-09-27")
-  let refused = v41_registry_reading_of(probe: V41ProbeRefused { step: "probe-run" as NonEmptyStr, cause: "witness" }, image: v41_production_produced_image, host: "srv5" as HostIdentity, observed_at: "2026-09-27")
-  match other { Present { value: _ } => false  Absent => match short { Present { value: _ } => false  Absent => match refused { Present { value: _ } => false  Absent => true } } }
-}
-
-// THE OCCUPANCY NEED IS THE MEASUREMENT'S 0.80 SHARE OF THE UNIFIED POOL.
-test fn w_the_occupancy_need_is_the_engine_share_of_the_pool() -> Bool {
-  kibibyte_count(k: v41_group_a_memory_need()) == 8000 * gb10_unified_pool_gib * 1048576 / 10000
-}
diff --git a/dag/test/claim/spark/v41_index_engram_selection_witness_test.dag b/dag/test/claim/spark/v41_index_engram_selection_witness_test.dag
deleted file mode 100644
index 1e54d26a86d..00000000000
--- a/dag/test/claim/spark/v41_index_engram_selection_witness_test.dag
+++ /dev/null
@@ -1,113 +0,0 @@
-module test.claim.spark.v41_index_engram_selection_witness
-
-import std.types { Bool, String, List, NonEmptyStr }
-import std.nat { Nat }
-import std.content_hash { Sha256DigestHex }
-import std.measure { byte_size }
-import extdeps.safetensors.format {
-  SafetensorsIndexMember, safetensors_index_member,
-  SafetensorsPopulationStanding, PopulationEstablished, PopulationIncomplete, PopulationRefused,
-  MembershipClosure, MembershipClosedAgainstFullIndex, MembershipScopedToReadRows, membership_closure_obligations,
-}
-import extdeps.deepseek.deepseek_v4_1_flash { deepseek_v4_1_flash_engram_index_members, deepseek_v4_1_flash_engram_shard_14_path }
-import gunbc.spark.v41_index_engram_selection {
-  V41IndexParse, V41IndexParsed, V41IndexParseRefused, v41_select_index_document, v41_index_engram_selector,
-  V41IndexEngramSelectionReading, V41IndexEngramSelectionRead, V41IndexEngramSelectionUnread,
-  v41_engram_population_observed_of, v41_engram_population_observed, v41_index_engram_selection_reading,
-}
-
-// THE INSTRUMENT AND THE READING, AT THEIR OWN INTERFACES. The parse fold runs over supplied index
-// text; the observed population runs over supplied readings, compared by the extdeps
-// fold against the pin. The live reading is the transcription of the instrument's receipt.
-
-data w_text: String = "{\"metadata\": {\"total_size\": 42}, \"weight_map\": {\"layers.0.attn.wq\": \"model-00001-of-00048.safetensors\", \"layers.1.engram.embed.weight\": \"model-00047-of-00048.safetensors\", \"layers.14.engram.q_weight\": \"model-00048-of-00048.safetensors\", \"head.weight\": \"model-00046-of-00048.safetensors\"}}"
-
-// THE FOLD OVER parse_json_document SELECTS EXACTLY THE .engram. NAMES AND COUNTS EVERY NAME.
-test fn the_parse_fold_selects_the_engram_names_and_counts_every_name() -> Bool {
-  match v41_select_index_document(text: w_text, selector: v41_index_engram_selector) {
-    V41IndexParsed { name_count: n, members: ms } =>
-      n == 4 && length(ms) == 2
-        && any(ms, m => (m.name as String) == "layers.14.engram.q_weight" && (m.shard as String) == "model-00048-of-00048.safetensors")
-    V41IndexParseRefused { cause: _ } => false
-  }
-}
-
-// AN ESCAPE IS READ, NOT REFUSED: the retired token scan refused any backslash because a quoted token
-// could hide a quote; the JSON authority decodes the key, so the selection sees the real name.
-test fn an_escaped_key_is_decoded_by_the_parser() -> Bool {
-  match v41_select_index_document(text: "{\"weight_map\": {\"layers.1.engram.\\u0071\": \"model-00047-of-00048.safetensors\"}}", selector: v41_index_engram_selector) {
-    V41IndexParsed { name_count: n, members: ms } => n == 1 && any(ms, m => (m.name as String) == "layers.1.engram.q")
-    V41IndexParseRefused { cause: _ } => false
-  }
-}
-
-fn w_refused_with(text: String, fragment: String) -> Bool {
-  match v41_select_index_document(text: text, selector: v41_index_engram_selector) {
-    V41IndexParseRefused { cause: c } => (c as String).contains(fragment)
-    V41IndexParsed { name_count: _, members: _ } => false
-  }
-}
-
-// EACH REFUSAL IS ITS OWN CLAIM, so a regression in one arm fails under its own name.
-test fn a_document_that_is_not_json_refuses() -> Bool {
-  w_refused_with(text: "{\"weight_map\": {", fragment: "not a JSON document")
-}
-
-test fn an_index_without_a_weight_map_refuses() -> Bool {
-  w_refused_with(text: "{\"metadata\": {\"total_size\": 1}}", fragment: "no weight_map member")
-}
-
-test fn a_weight_map_that_is_not_an_object_refuses() -> Bool {
-  w_refused_with(text: "{\"weight_map\": [\"x.safetensors\"]}", fragment: "not an object")
-}
-
-test fn a_value_that_is_not_a_shard_name_refuses() -> Bool {
-  w_refused_with(text: "{\"weight_map\": {\"a\": \"x.bin\", \"b\": 7}}", fragment: "2 entries whose value is not a .safetensors shard name")
-}
-
-test fn an_empty_weight_map_refuses() -> Bool {
-  w_refused_with(text: "{\"weight_map\": {}}", fragment: "empty")
-}
-
-fn w_reading(hex: String, names: Nat, members: List<SafetensorsIndexMember>) -> V41IndexEngramSelectionReading {
-  V41IndexEngramSelectionRead { index_sha256_hex: hex as Sha256DigestHex, index_bytes: byte_size(count: 7470294), name_count: names, members: members, observed: "fixture" as NonEmptyStr }
-}
-
-fn w_closure_of(s: SafetensorsPopulationStanding) -> Nat {
-  match s {
-    PopulationEstablished { population: p } => length(membership_closure_obligations(c: p.closure))
-    PopulationIncomplete { obligation: _, partial_entries: _ } => 99
-    PopulationRefused { defects: _ } => 98
-  }
-}
-
-data w_pin_hex: String = "74b0686a3d2891980d5e303251b075a3bccae2c2ff650747db2620a649b98fa8"
-
-// A READING OF THE PINNED FILE OVER ALL ITS NAMES CLOSES; A READING OF ANOTHER FILE, OR OF FEWER NAMES,
-// DOES NOT -- the reading is compared with the pin, not restated as it.
-test fn only_a_reading_of_the_pinned_file_over_every_name_closes() -> Bool {
-  w_closure_of(s: v41_engram_population_observed_of(reading: w_reading(hex: w_pin_hex, names: 96085, members: deepseek_v4_1_flash_engram_index_members))) == 0
-    && w_closure_of(s: v41_engram_population_observed_of(reading: w_reading(hex: "1111111111111111111111111111111111111111111111111111111111111111", names: 96085, members: deepseek_v4_1_flash_engram_index_members))) == 1
-    && w_closure_of(s: v41_engram_population_observed_of(reading: w_reading(hex: w_pin_hex, names: 96084, members: deepseek_v4_1_flash_engram_index_members))) == 1
-    && w_closure_of(s: v41_engram_population_observed_of(reading: V41IndexEngramSelectionUnread { obligation: "fixture" as NonEmptyStr })) == 1
-}
-
-// THE RED: a reading that selected a thirteenth .engram. name refuses the population by that name.
-test fn a_reading_with_a_thirteenth_engram_name_refuses() -> Bool {
-  let thirteen = concat(deepseek_v4_1_flash_engram_index_members, [safetensors_index_member(name: "layers.20.engram.embed.weight" as NonEmptyStr, shard: deepseek_v4_1_flash_engram_shard_14_path)])
-  match v41_engram_population_observed_of(reading: w_reading(hex: w_pin_hex, names: 96085, members: thirteen)) {
-    PopulationRefused { defects: d } => any(d, x => (x as String).contains("layers.20.engram.embed.weight"))
-    PopulationEstablished { population: _ } => false
-    PopulationIncomplete { obligation: _, partial_entries: _ } => false
-  }
-}
-
-// THE LIVE READING IS AN ENROLLED ROUTE'S RECEIPT, AND OVER THE PINNED FILE AND EVERY NAME IT CLOSES
-// MEMBERSHIP. The oracle is the extdeps fold against the pin; the row's own values are not asserted
-// here, because comparing them with literals copied from the row would only restate it (review 70580).
-test fn the_live_reading_closes_the_observed_population() -> Bool {
-  (match v41_index_engram_selection_reading {
-    V41IndexEngramSelectionRead { index_sha256_hex: _, index_bytes: _, name_count: _, members: _, observed: _ } => true
-    V41IndexEngramSelectionUnread { obligation: _ } => false
-  }) && w_closure_of(s: v41_engram_population_observed()) == 0
-}
diff --git a/dag/test/claim/spark/v41_indexer_topk_route_witness_test.dag b/dag/test/claim/spark/v41_indexer_topk_route_witness_test.dag
deleted file mode 100644
index 6a65f751afe..00000000000
--- a/dag/test/claim/spark/v41_indexer_topk_route_witness_test.dag
+++ /dev/null
@@ -1,96 +0,0 @@
-module test.claim.spark.v41_indexer_topk_route_witness
-
-import std.types { Bool, List, NonEmptyStr, String }
-import extdeps.vllm.sparse_indexer_topk {
-  vllm_d2d649e6_deepselect_block, vllm_d2d649e6_sm12_indexer_topk_route, vllm_d2d649e6_indexer_topk_class,
-}
-import extdeps.vllm.source_build { vllm_d2d649e6_revision }
-import gunbc.spark.v41_runtime_candidate { v41_candidate_recipe }
-import gunbc.spark.serving_runtime_capability_probe {
-  RuntimeKernelCapability, IndexerTopkRouteCorrect, V41SpeculativeDecode, V41BaselineDecode,
-  v41_required_capabilities, runtime_kernel_capability_label,
-}
-import gunbc.spark.v41_runtime_image_probe {
-  v41_probe_script, v41_capability_reading, v41_probe_label, v41_py_op_name,
-  V41CapabilityPresent, V41CapabilityAbsent, V41CapabilityUnread,
-}
-
-// THE DEEPSELECT WARNING IS EXPECTED IN THE IMAGE THIS RECIPE BUILDS, AND THIS IS THE JOIN THAT SAYS
-// SO. Upstream's DeepSelect arch set is the 10.x family alone; the V4.1 candidate recipe's
-// TORCH_CUDA_ARCH_LIST names no 10.x entry, so the extension cannot be compiled into it. If the
-// recipe ever gains a 10.x target -- or upstream's gate gains a 12.x family -- this goes red and the
-// warning becomes a question again rather than an expected state.
-// A FAMILY ENTRY (`10.0f`) MATCHES ANY TARGET WITH THE SAME MAJOR, which is cuda_archs_loose_intersection's
-// rule for the `f` suffix; the prefix is that major and its dot.
-fn gate_major_prefix(entry: NonEmptyStr) -> String {
-  match first(split(s: entry as String, delimiter: ".")) {
-    Absent => entry as String
-    Present { value: m } => join([m, "."], "")
-  }
-}
-
-test fn the_candidate_recipe_targets_nothing_in_deepselects_arch_family() -> Bool {
-  let gate = vllm_d2d649e6_deepselect_block.arch_entries
-  length(gate) > 0
-    && !any(gate, g => starts_with(s: g as String, prefix: "12."))
-    && !any(v41_candidate_recipe().torch_cuda_arch_list, a =>
-         any(gate, g => starts_with(s: a as String, prefix: gate_major_prefix(entry: g))))
-    && any(v41_candidate_recipe().torch_cuda_arch_list, a => starts_with(s: a as String, prefix: "12."))
-}
-
-// THE ROUTE FACT IS ANCHORED TO THE REVISION THE CANDIDATE IS BUILT FROM. indexer_topk.py does not
-// exist at the older revision the SM12 demand roster reads, so a route read against any source other
-// than the candidate recipe's would be a fact about a different program.
-test fn the_indexer_topk_route_is_read_at_the_candidate_recipes_own_revision() -> Bool {
-  (vllm_d2d649e6_sm12_indexer_topk_route.established_against.full_revision as String) == (v41_candidate_recipe().source.full_revision as String)
-    && (vllm_d2d649e6_revision.full_revision as String) == (v41_candidate_recipe().source.full_revision as String)
-}
-
-// BOTH PROFILES REQUIRE IT, because both decode through the sparse indexer.
-fn requires_route(caps: List<RuntimeKernelCapability>) -> Bool {
-  any(caps, c => runtime_kernel_capability_label(c: c) == runtime_kernel_capability_label(c: IndexerTopkRouteCorrect))
-}
-
-test fn both_v41_profiles_require_the_indexer_topk_route() -> Bool {
-  requires_route(caps: v41_required_capabilities(profile: V41SpeculativeDecode))
-    && requires_route(caps: v41_required_capabilities(profile: V41BaselineDecode))
-}
-
-// THE SCRIPT ASKS WHAT THE ROUTE ROW SAYS: the resolver class, both kernels by the name reached on
-// torch.ops._C, the backend it must answer, and a verdict that needs a nonzero case count. Rename a
-// kernel in the row and the probe calls the new name; drop the case-count clause and a run that
-// compared nothing would read present.
-test fn the_generated_probe_calls_the_route_and_both_kernels_the_row_names() -> Bool {
-  let script = v41_probe_script()
-  let route = vllm_d2d649e6_sm12_indexer_topk_route
-  string_contains(s: script, pattern: vllm_d2d649e6_indexer_topk_class as String)
-    && string_contains(s: script, pattern: join(["\"", v41_py_op_name(qualified: route.decode_operator) as String, "\""], ""))
-    && string_contains(s: script, pattern: join(["\"", v41_py_op_name(qualified: route.prefill_operator) as String, "\""], ""))
-    && (v41_py_op_name(qualified: route.decode_operator) as String) == "persistent_topk"
-    && string_contains(s: script, pattern: "_cases > 0 and _agreed == _cases")
-    && string_contains(s: script, pattern: "resolve_backend")
-}
-
-// A TIMING LINE IS NEVER A VERDICT. The cost instrument prints under the same label; a stdout that
-// carries only its TIMING and an error DETAIL must read UNREAD, and one carrying the verdict reads it.
-test fn timing_output_alone_never_admits_the_route() -> Bool {
-  let label = v41_probe_label(c: IndexerTopkRouteCorrect)
-  let timing_only = join(["TIMING ", label as String, " persistent rows 4 seq 65536 topk 512 kernel_ms 0.1 torch_topk_ms 0.2\nDETAIL ", label as String, " error RuntimeError\n"], "")
-  let read = join(["VERDICT ", label as String, "=present\n"], "")
-  let refused = join(["VERDICT ", label as String, "=absent\n"], "")
-  (match v41_capability_reading(stdout: timing_only, capability: label) {
-    V41CapabilityUnread { capability: _, cause: _ } => true
-    V41CapabilityPresent { capability: _ } => false
-    V41CapabilityAbsent { capability: _ } => false
-  })
-    && (match v41_capability_reading(stdout: read, capability: label) {
-      V41CapabilityPresent { capability: _ } => true
-      V41CapabilityUnread { capability: _, cause: _ } => false
-      V41CapabilityAbsent { capability: _ } => false
-    })
-    && (match v41_capability_reading(stdout: refused, capability: label) {
-      V41CapabilityAbsent { capability: _ } => true
-      V41CapabilityUnread { capability: _, cause: _ } => false
-      V41CapabilityPresent { capability: _ } => false
-    })
-}
diff --git a/dag/test/claim/spark/v41_produced_runtime_witness_test.dag b/dag/test/claim/spark/v41_produced_runtime_witness_test.dag
deleted file mode 100644
index a77ac1330d9..00000000000
--- a/dag/test/claim/spark/v41_produced_runtime_witness_test.dag
+++ /dev/null
@@ -1,208 +0,0 @@
-module test.claim.spark.v41_produced_runtime_witness
-
-import std.types { Bool, String, List, NonEmptyStr }
-import std.optional { Present, Absent }
-import std.content_hash { ContentHash, Sha256Digest, Sha256DigestHex, serialize_content_hash }
-import extdeps.container.oci.digest { OciContentDigest, oci_sha256_content_digest }
-import extdeps.vllm.source_build { VllmContainerBuildRecipe, vllm_8d09804_sm121_recipe, vllm_deepseek_v4_1_sm12_revision }
-import gunbc.spark.vllm_image_identity { vllm_image_tag_for_key }
-import gunbc.spark.vllm_runtime_image_build { BuiltByThisRun, AdoptedUnderExpectedTag, VllmImageProvenance }
-import gunbc.spark.v41_source_patch_converge { V41ObservedSourceIdentity, v41_observed_source_identity_of, v41_patched_image_build_key }
-import extdeps.flashinfer.flashinfer { FlashInferWheel, flashinfer_0_6_18_post1, flashinfer_0_6_18_post1_wheels }
-import gunbc.spark.v41_identity_input { V41EngramResidencyPartition }
-import gunbc.spark.v41_runtime_candidate {
-  V41RuntimeArtifactInputs,
-  V41EnginePatch, v41_engine_patch, V41PatchesObserved, PartitionByLaunchConfiguration,
-  v41_candidate_recipe, v41_candidate_partition,
-}
-import gunbc.spark.v41_runtime_realized {
-  V41ProducedRuntimeImage, V41ProducedRuntimeStanding,
-  V41RuntimeProduced, V41RuntimeProductionUnestablished, V41RuntimeProductionRefused,
-  v41_produced_runtime_image, v41_admit_produced_runtime, v41_runtime_was_produced,
-}
-
-// ── KEYED IS NOT PRODUCED, AND THIS MODULE IS THE WALL BETWEEN THEM ───────────────────────────
-//
-// gunbc.spark.v41_runtime_candidate keys a runtime artifact from a recipe, a wheel population and a
-// patch population. Nothing in that key is bytes. The produced standing says a particular image on a
-// particular host WAS built from those inputs, and the only thing that makes that statement worth
-// more than the sentence is that a produced record which did not come from them REFUSES. Every claim
-// below is that refusal under one substitution, against a positive control that differs in exactly
-// the substituted field -- so a green here is evidence about the discriminator and not about the
-// fixture being unadmittable.
-
-fn w_diff_sha() -> Sha256Digest {
-  Sha256Digest { hex: "4d2c1f0e9b8a7766554433221100ffeeddccbbaa99887766554433221100abcd" as Sha256DigestHex }
-}
-
-fn w_observed_at_recipe_revision() -> V41ObservedSourceIdentity {
-  v41_observed_source_identity_of(
-    revision_head: v41_candidate_recipe().source.full_revision,
-    worktree_diff_sha256: w_diff_sha(),
-  )
-}
-
-fn w_config_digest() -> OciContentDigest? {
-  oci_sha256_content_digest(hex: "1111111111111111111111111111111111111111111111111111111111111111")
-}
-
-// THE RUNTIME INPUTS ARE SUPPLIED, NOT COMPUTED, AND THE REASON IS A ROUTE AND NOT A PREFERENCE.
-// v41_candidate_inputs.runtime reaches v41_storage_backed_patch_population(), which DIGESTS THE TWO
-// PATCH FILES through sha256sum -- an effect the hermetic envelope has no arm for, so every claim
-// below would refuse as a route gap before touching its subject rather than returning a verdict.
-// The supplied population is two patches at the recipe's own revision with fixture digests, which is
-// the shape that population produces; what these claims discriminate is the KEY RELATION over those
-// inputs, and that relation does not read a patch's bytes -- it reads the digest the population
-// already carries.
-//
-// THE PAIRED INHABITANCE OBLIGATION IS NOT DISCHARGED HERE AND IS NAMED RATHER THAN LEFT SILENT. The
-// real producer is v41_candidate_inputs.runtime, exercised by test.claim.spark.v41_runtime_candidate
-// over the same boundary and under the same hermetic limit, and the only route that runs the live
-// population end to end is the wet one: the spark_v41_runtime_image_build mode, whose fold supplies
-// v41_candidate_inputs.runtime to this very admission. That is where deleting the integration makes
-// something fail.
-fn w_fixture_patches() -> List<V41EnginePatch> {
-  flat_map(
-    [WPatchSpec { path: "dag/gunbc/spark/patches/d2d649e6/engram_file_backed.py.patch", c: "1" },
-     WPatchSpec { path: "dag/gunbc/spark/patches/d2d649e6/engram_storage_backed.patch", c: "2" }],
-    x => match v41_engine_patch(
-      path: x.path as NonEmptyStr,
-      applies_to: v41_candidate_recipe().source,
-      sha256_hex: w_fixture_sha(c: x.c).hex as String,
-      purpose: "fixture" as NonEmptyStr,
-    ) {
-      Present { value: p } => [p]
-      Absent => [] as List<V41EnginePatch>
-    })
-}
-
-type WPatchSpec {
-  path: String
-  c: String
-}
-
-fn w_fixture_sha(c: String) -> Sha256Digest {
-  Sha256Digest { hex: join([c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c], "") as Sha256DigestHex }
-}
-
-fn w_inputs() -> V41RuntimeArtifactInputs {
-  V41RuntimeArtifactInputs {
-    recipe: v41_candidate_recipe(),
-    kernel_acquisition: flashinfer_0_6_18_post1,
-    kernel_wheels: flashinfer_0_6_18_post1_wheels,
-    patches: V41PatchesObserved { patches: w_fixture_patches(), partition: PartitionByLaunchConfiguration },
-  }
-}
-
-// THE RECORD A CONVERGED BUILD OF THIS CANDIDATE WOULD HAND OVER: the tag and the key the build ran
-// under, both derived from the candidate's own recipe over the tree the build observed, and
-// BuiltByThisRun because those bytes were produced rather than found.
-fn w_produced(
-  observed: V41ObservedSourceIdentity,
-  build_key: ContentHash,
-  tag: NonEmptyStr,
-  provenance: VllmImageProvenance,
-) -> V41ProducedRuntimeImage? {
-  match w_config_digest() {
-    Absent => none
-    Present { value: d } => Present { value: v41_produced_runtime_image(
-      tag: tag,
-      local_config_digest: d,
-      build_key: build_key,
-      observed: observed,
-      provenance: provenance,
-    ) }
-  }
-}
-
-fn w_expected_key(observed: V41ObservedSourceIdentity) -> ContentHash {
-  v41_patched_image_build_key(r: v41_candidate_recipe(), observed: observed)
-}
-
-fn w_admit(image: V41ProducedRuntimeImage?) -> V41ProducedRuntimeStanding {
-  match image {
-    Absent => V41RuntimeProductionRefused { defects: ["fixture: the configuration digest did not parse" as NonEmptyStr] }
-    Present { value: i } => v41_admit_produced_runtime(inputs: w_inputs(), partition: v41_candidate_partition, image: i)
-  }
-}
-
-fn w_refused_with(s: V41ProducedRuntimeStanding, fragment: String) -> Bool {
-  match s {
-    V41RuntimeProductionRefused { defects: d } => any(d, x => (x as String).contains(fragment))
-    V41RuntimeProduced { specification_runtime_key: _, image: _ } => false
-    V41RuntimeProductionUnestablished { obligations: _ } => false
-  }
-}
-
-fn w_faithful() -> V41ProducedRuntimeImage? {
-  let observed = w_observed_at_recipe_revision()
-  let key = w_expected_key(observed: observed)
-  w_produced(observed: observed, build_key: key, tag: vllm_image_tag_for_key(r: v41_candidate_recipe(), key: key), provenance: BuiltByThisRun)
-}
-
-// THE POSITIVE CONTROL. Without it every refusal below is satisfiable by a fixture that could never
-// be admitted at all, which is the accident that makes a negative control green for the wrong reason.
-test fn an_image_built_from_this_candidates_recipe_and_tree_is_produced() -> Bool {
-  match w_admit(image: w_faithful()) {
-    V41RuntimeProduced { specification_runtime_key: _, image: i } =>
-      (i.observed.revision_head as String) == (v41_candidate_recipe().source.full_revision as String)
-    V41RuntimeProductionRefused { defects: _ } => false
-    V41RuntimeProductionUnestablished { obligations: _ } => false
-  }
-}
-
-// THE DISCRIMINATING RED THE LANE EXISTS FOR: a produced digest whose build key did not come from
-// this candidate's recipe and patched tree. The substituted key is a real one -- the GLM 5.3 SM121
-// recipe over the same observed tree -- so this is not a malformed value being rejected for being
-// malformed; it is another image's honest key being refused for being another image's.
-test fn a_produced_image_keyed_from_another_recipe_refuses() -> Bool {
-  let observed = w_observed_at_recipe_revision()
-  let foreign_key = v41_patched_image_build_key(r: vllm_8d09804_sm121_recipe, observed: observed)
-  (serialize_content_hash(hash: foreign_key) as String) != (serialize_content_hash(hash: w_expected_key(observed: observed)) as String)
-    && w_refused_with(
-      s: w_admit(image: w_produced(observed: observed, build_key: foreign_key, tag: vllm_image_tag_for_key(r: v41_candidate_recipe(), key: w_expected_key(observed: observed)), provenance: BuiltByThisRun)),
-      fragment: "is not this candidate's runtime")
-}
-
-// A TREE AT ANOTHER REVISION IS ANOTHER RUNTIME, even when the key recomputes consistently over it:
-// the key would be self-consistent and the bytes would still be a build of something else, so the
-// head is compared to the recipe's revision rather than only folded into the hash.
-test fn a_produced_image_built_from_another_revision_refuses() -> Bool {
-  let wrong = v41_observed_source_identity_of(
-    revision_head: vllm_deepseek_v4_1_sm12_revision.full_revision,
-    worktree_diff_sha256: w_diff_sha(),
-  )
-  let key = w_expected_key(observed: wrong)
-  (wrong.revision_head as String) != (v41_candidate_recipe().source.full_revision as String)
-    && w_refused_with(
-      s: w_admit(image: w_produced(observed: wrong, build_key: key, tag: vllm_image_tag_for_key(r: v41_candidate_recipe(), key: key), provenance: BuiltByThisRun)),
-      fragment: "this candidate's recipe names")
-}
-
-// A NAME IS NOT PRODUCTION. Everything about this record is the faithful one except that the image
-// was FOUND under the expected tag rather than built, which is the one fact a recomputation over the
-// tag and the key can never catch -- an adopted image carries exactly the right key by construction.
-test fn an_image_adopted_under_the_expected_tag_is_not_produced() -> Bool {
-  let observed = w_observed_at_recipe_revision()
-  let key = w_expected_key(observed: observed)
-  w_refused_with(
-    s: w_admit(image: w_produced(observed: observed, build_key: key, tag: vllm_image_tag_for_key(r: v41_candidate_recipe(), key: key), provenance: AdoptedUnderExpectedTag)),
-    fragment: "is not bytes this run produced")
-    && w_runtime_was_produced_of_faithful()
-}
-
-fn w_runtime_was_produced_of_faithful() -> Bool {
-  v41_runtime_was_produced(s: w_admit(image: w_faithful()))
-}
-
-// THE TAG IS DERIVED FROM THE KEY, so an image wearing a tag the key does not derive is an image
-// whose name and whose contents disagree -- and the name is what a launch would be pinned to.
-test fn a_produced_image_wearing_another_tag_refuses() -> Bool {
-  let observed = w_observed_at_recipe_revision()
-  let key = w_expected_key(observed: observed)
-  let other_tag = vllm_image_tag_for_key(r: v41_candidate_recipe(), key: v41_patched_image_build_key(r: vllm_8d09804_sm121_recipe, observed: observed))
-  (other_tag as String) != (vllm_image_tag_for_key(r: v41_candidate_recipe(), key: key) as String)
-    && w_refused_with(
-      s: w_admit(image: w_produced(observed: observed, build_key: key, tag: other_tag, provenance: BuiltByThisRun)),
-      fragment: "this candidate's key derives")
-}
diff --git a/dag/test/claim/spark/v41_published_row_store_witness_test.dag b/dag/test/claim/spark/v41_published_row_store_witness_test.dag
deleted file mode 100644
index 3f9375e37d0..00000000000
--- a/dag/test/claim/spark/v41_published_row_store_witness_test.dag
+++ /dev/null
@@ -1,186 +0,0 @@
-module test.claim.spark.v41_published_row_store_witness
-
-import test.claim.vllm.vllm_engram_layout_witness { w_published_head_sizes }
-import std.types { Bool, String, List, NonEmptyStr }
-import std.nat { Nat }
-import std.measure { byte_size, byte_size_count }
-import std.optional { Present, Absent }
-import std.content_hash { Sha256Digest, Sha256DigestHex, serialize_content_hash }
-import extdeps.deepseek.deepseek_v4_1_flash {
-  deepseek_v4_1_flash_engram_sharded_entries, deepseek_v4_1_flash_engram_shard_files,
-}
-import gunbc.spark.v41_identity_input { V41EngramResidencyPartition }
-import gunbc.spark.v41_runtime_candidate { v41_candidate_partition }
-import gunbc.spark.v41_engram_row_store {
-  V41PublishedSpan, V41PublishedSpanPlan, V41PublishedSpansPlanned, V41PublishedSpansUnplannable,
-  V41PublishedSpanDigest, V41PublishedSpanReadings, V41PublishedSpansRead, V41PublishedSpansUnread,
-  V41PublishedRowStoreKey, V41PublishedRowStoreKeyed, V41PublishedRowStoreUnestablished, V41PublishedRowStoreRefused,
-  V41PublishedStoreReadings, V41PublishedStoresRead, V41PublishedStoresUnread, V41RankStoreIdentity, V41ObservedRankStore,
-  v41_published_span_plan, v41_row_store_encoding_key, v41_rank_store_identity,
-}
-import extdeps.safetensors.format { SafetensorsShardFile }
-
-// THE ROW-STORE ENCODING KEY, AT ITS OWN INTERFACE. The span digests and the store digests are SUPPLIED
-// values -- fixtures of what a Spark's reads return -- because these claims are about what the key does
-// with readings, not about a host. The plan the span readings are joined against is the REAL
-// derivation over the publisher's header rows, so the regions below are the ones the mode reads. The
-// spans are the encoder's input identity (joined, not hashed); the eight encoded stores key the axis.
-
-fn w_sha(c: String) -> Sha256Digest {
-  Sha256Digest { hex: join([c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c], "") as Sha256DigestHex }
-}
-
-fn w_plan(p: V41EngramResidencyPartition) -> List<V41PublishedSpan> {
-  match v41_published_span_plan(partition: p, sharded: deepseek_v4_1_flash_engram_sharded_entries, shards: deepseek_v4_1_flash_engram_shard_files) {
-    V41PublishedSpansPlanned { spans: s } => s
-    V41PublishedSpansUnplannable { defects: _ } => [] as List<V41PublishedSpan>
-  }
-}
-
-fn w_read(spans: List<V41PublishedSpan>, c: String) -> V41PublishedSpanReadings {
-  V41PublishedSpansRead { host: "srv5" as NonEmptyStr, observed_at: "fixture" as NonEmptyStr, spans: map(spans, sp => V41PublishedSpanDigest { span: sp, sha256: w_sha(c: c) }) }
-}
-
-// THE SIZE EACH LIVE STORE MUST HAVE: 6 bytes of magic plus 264 per row of the rank's range, computed
-// independently of v41_store_derived_size (Python, over vLLM's rank bounds for this checkpoint).
-fn w_size(layer: Nat, rank: Nat) -> Nat {
-  let l1 = [25344148902, 25344310470, 25344505302, 25344663702]
-  let l14 = [25344806262, 25345045974, 25345200678, 25345351158]
-  match get(xs: if layer == 1 { l1 } else { l14 }, index: rank) {
-    Present { value: n } => n
-    Absent => 0
-  }
-}
-
-// ONE STORE PER (LAYER, RANK) OF THE GIVEN LAYERS, ALL WITH DIGEST c, EACH AT ITS DERIVED SIZE.
-fn w_stores(layers: List<Nat>, c: String) -> V41PublishedStoreReadings {
-  V41PublishedStoresRead { host: "srv5" as NonEmptyStr, observed_at: "fixture" as NonEmptyStr, stores: flat_map(layers, l => map([0, 1, 2, 3], k => V41ObservedRankStore { identity: v41_rank_store_identity(layer: l, rank: k, digest: w_sha(c: c)), size: byte_size(count: w_size(layer: l, rank: k)) })) }
-}
-
-data w_candidate_layers: List<Nat> = [1, 14]
-
-fn w_key_with(p: V41EngramResidencyPartition, r: V41PublishedSpanReadings, st: V41PublishedStoreReadings) -> V41PublishedRowStoreKey {
-  v41_row_store_encoding_key(partition: p, sharded: deepseek_v4_1_flash_engram_sharded_entries, shards: deepseek_v4_1_flash_engram_shard_files, spans: r, stores: st, head_sizes: fn() { w_published_head_sizes() })
-}
-
-fn w_key(p: V41EngramResidencyPartition, r: V41PublishedSpanReadings) -> V41PublishedRowStoreKey {
-  w_key_with(p: p, r: r, st: w_stores(layers: w_candidate_layers, c: "c"))
-}
-
-fn w_hex(k: V41PublishedRowStoreKey) -> String {
-  match k {
-    V41PublishedRowStoreKeyed { digest: d } => serialize_content_hash(hash: d) as String
-    V41PublishedRowStoreUnestablished { obligation: _ } => ""
-    V41PublishedRowStoreRefused { defects: _ } => ""
-  }
-}
-
-fn w_refused_with(k: V41PublishedRowStoreKey, fragment: String) -> Bool {
-  match k {
-    V41PublishedRowStoreRefused { defects: d } => any(d, x => (x as String).contains(fragment))
-    V41PublishedRowStoreKeyed { digest: _ } => false
-    V41PublishedRowStoreUnestablished { obligation: _ } => false
-  }
-}
-
-// A DIFFERENT TABLE SET: layer 14's embed pair stays storage-backed, layer 1's does not.
-data w_other_partition: V41EngramResidencyPartition = V41EngramResidencyPartition {
-  storage_backed: ["layers.14.engram.embed.weight" as NonEmptyStr, "layers.14.engram.embed.scale" as NonEmptyStr],
-  resident: [] as List<NonEmptyStr>,
-}
-
-// THE PLAN IS THE PUBLISHER'S HEADER ARITHMETIC: four spans, and layer 1's weight starts after the
-// 8-byte length prefix and shard 47's 656-byte header.
-test fn the_span_plan_names_the_four_storage_backed_regions() -> Bool {
-  let plan = w_plan(p: v41_candidate_partition)
-  length(plan) == 4
-    && any(plan, sp => (sp.tensor as String) == "layers.1.engram.embed.weight" && (sp.shard as String) == "model-00047-of-00048.safetensors" && byte_size_count(b: sp.file_offset) == 664 && byte_size_count(b: sp.length) == 98305579008)
-    && any(plan, sp => (sp.tensor as String) == "layers.14.engram.embed.scale" && (sp.shard as String) == "model-00048-of-00048.safetensors" && byte_size_count(b: sp.file_offset) == 8 + 664 + 98308270592)
-}
-
-fn w_unplannable_with(plan: V41PublishedSpanPlan, fragment: String) -> Bool {
-  match plan {
-    V41PublishedSpansUnplannable { defects: d } => any(d, x => (x as String).contains(fragment))
-    V41PublishedSpansPlanned { spans: _ } => false
-  }
-}
-
-// THE SHARD-BOUNDS ARMS STAY APART. Two rows for one shard is a contradiction in the supplied files;
-// no row is a thing not yet read. Each is refused in its own words and never in the other's.
-test fn duplicated_shard_file_rows_refuse_as_contradicted_not_unread() -> Bool {
-  let plan = v41_published_span_plan(partition: v41_candidate_partition, sharded: deepseek_v4_1_flash_engram_sharded_entries,
-    shards: concat(deepseek_v4_1_flash_engram_shard_files, deepseek_v4_1_flash_engram_shard_files))
-  w_unplannable_with(plan: plan, fragment: "has 2 shard file rows") && !w_unplannable_with(plan: plan, fragment: "has no shard file row")
-}
-
-test fn an_absent_shard_file_row_refuses_as_unread_not_contradicted() -> Bool {
-  let plan = v41_published_span_plan(partition: v41_candidate_partition, sharded: deepseek_v4_1_flash_engram_sharded_entries,
-    shards: [] as List<SafetensorsShardFile>)
-  w_unplannable_with(plan: plan, fragment: "has no shard file row") && !w_unplannable_with(plan: plan, fragment: "shard file rows")
-}
-
-// POSITIVE CONTROL: the exact plan read, and all eight stores read, keys.
-test fn a_reading_of_exactly_the_planned_spans_keys() -> Bool {
-  w_hex(k: w_key(p: v41_candidate_partition, r: w_read(spans: w_plan(p: v41_candidate_partition), c: "a"))).length() > 0
-}
-
-// THE DISCRIMINATING RED: a digest over a different table set does not key the candidate's partition.
-// Readings of layer 14's pair alone are two spans short and refuse by name.
-// And a STORE set over a different table set -- layer 14's four stores alone -- refuses even with the
-// right input spans: the declared layer-1 stores carry no digest.
-test fn a_digest_over_a_different_table_set_does_not_key() -> Bool {
-  let other = w_read(spans: w_plan(p: w_other_partition), c: "a")
-  w_refused_with(k: w_key(p: v41_candidate_partition, r: other), fragment: "layers.1.engram.embed.weight")
-    && w_refused_with(k: w_key(p: v41_candidate_partition, r: other), fragment: "was not read")
-    && w_refused_with(k: w_key_with(p: v41_candidate_partition, r: w_read(spans: w_plan(p: v41_candidate_partition), c: "a"), st: w_stores(layers: [14], c: "c")), fragment: "layer.1.rank.0")
-}
-
-// AND A READING OF A TENSOR THE PARTITION KEEPS RESIDENT IS FOREIGN, EVEN ALONGSIDE THE RIGHT FOUR.
-test fn a_reading_of_a_resident_tensor_refuses_as_foreign() -> Bool {
-  let resident_span = V41PublishedSpan { tensor: "layers.1.engram.q_weight" as NonEmptyStr, shard: "model-00047-of-00048.safetensors" as NonEmptyStr, file_offset: byte_size(count: 664 + 101377628352), length: byte_size(count: 40960) }
-  w_refused_with(k: w_key(p: v41_candidate_partition, r: w_read(spans: concat(w_plan(p: v41_candidate_partition), [resident_span]), c: "a")), fragment: "is not a span this partition stores")
-}
-
-// THE RIGHT TENSOR OVER ANOTHER REGION IS NOT ITS READING.
-test fn a_shifted_region_refuses() -> Bool {
-  let shifted = map(w_plan(p: v41_candidate_partition), sp => V41PublishedSpan { tensor: sp.tensor, shard: sp.shard, file_offset: byte_size(count: byte_size_count(b: sp.file_offset) + 1), length: sp.length })
-  w_refused_with(k: w_key(p: v41_candidate_partition, r: w_read(spans: shifted, c: "a")), fragment: "was not read")
-}
-
-// THE KEY MOVES WITH THE ENCODED STORES' BYTES AND WITH THE TABLE SET -- and NOT with the input spans'
-// digests, which are joined but not hashed, nor with the order the readings arrived in.
-test fn the_key_moves_with_the_bytes_and_the_table_set() -> Bool {
-  let spans = w_read(spans: w_plan(p: v41_candidate_partition), c: "a")
-  let base = w_hex(k: w_key_with(p: v41_candidate_partition, r: spans, st: w_stores(layers: w_candidate_layers, c: "c")))
-  let other_store_bytes = w_hex(k: w_key_with(p: v41_candidate_partition, r: spans, st: w_stores(layers: w_candidate_layers, c: "d")))
-  let other_span_bytes = w_hex(k: w_key_with(p: v41_candidate_partition, r: w_read(spans: w_plan(p: v41_candidate_partition), c: "b"), st: w_stores(layers: w_candidate_layers, c: "c")))
-  let reversed = w_hex(k: w_key_with(p: v41_candidate_partition, r: w_read(spans: reverse(w_plan(p: v41_candidate_partition)), c: "a"), st: w_stores(layers: [14, 1], c: "c")))
-  let other_set = w_hex(k: w_key_with(p: w_other_partition, r: w_read(spans: w_plan(p: w_other_partition), c: "a"), st: w_stores(layers: [14], c: "c")))
-  base.length() > 0 && other_store_bytes.length() > 0 && other_set.length() > 0
-    && base != other_store_bytes && base == other_span_bytes && base == reversed && base != other_set
-}
-
-// UNREAD IS AN OBLIGATION, NEVER A KEY: unread spans, or read spans with the stores not yet encoded.
-test fn an_unread_reading_is_unestablished() -> Bool {
-  (match w_key(p: v41_candidate_partition, r: V41PublishedSpansUnread { obligation: "fixture: not read" as NonEmptyStr }) {
-    V41PublishedRowStoreUnestablished { obligation: o } => (o as String).contains("not read")
-    V41PublishedRowStoreKeyed { digest: _ } => false
-    V41PublishedRowStoreRefused { defects: _ } => false
-  }) && (match w_key_with(p: v41_candidate_partition, r: w_read(spans: w_plan(p: v41_candidate_partition), c: "a"), st: V41PublishedStoresUnread { obligation: "fixture: not encoded" as NonEmptyStr }) {
-    V41PublishedRowStoreUnestablished { obligation: o } => (o as String).contains("not encoded")
-    V41PublishedRowStoreKeyed { digest: _ } => false
-    V41PublishedRowStoreRefused { defects: _ } => false
-  })
-}
-
-// A STORE OF THE WRONG SIZE IS NOT KEYED, even with every digest present: layer 14 rank 3 one byte short
-// refuses by name (a digest over a file FileBackedEngramStorage could not open).
-test fn a_store_of_the_wrong_size_does_not_key() -> Bool {
-  let right = w_stores(layers: w_candidate_layers, c: "c")
-  let short = match right {
-    V41PublishedStoresRead { host: h, observed_at: t, stores: st } => V41PublishedStoresRead { host: h, observed_at: t, stores: map(st, o => if o.identity.layer == 14 && o.identity.rank == 3 { V41ObservedRankStore { identity: o.identity, size: byte_size(count: w_size(layer: 14, rank: 3) - 1) } } else { o }) }
-    V41PublishedStoresUnread { obligation: o } => V41PublishedStoresUnread { obligation: o }
-  }
-  w_refused_with(k: w_key_with(p: v41_candidate_partition, r: w_read(spans: w_plan(p: v41_candidate_partition), c: "a"), st: short), fragment: "layer.14.rank.3 is 25345351157 bytes and the layout derives 25345351158")
-    && w_hex(k: w_key_with(p: v41_candidate_partition, r: w_read(spans: w_plan(p: v41_candidate_partition), c: "a"), st: right)).length() > 0
-}
diff --git a/dag/test/claim/spark/v41_row_store_encode_run_witness_test.dag b/dag/test/claim/spark/v41_row_store_encode_run_witness_test.dag
deleted file mode 100644
index 1a86a73f682..00000000000
--- a/dag/test/claim/spark/v41_row_store_encode_run_witness_test.dag
+++ /dev/null
@@ -1,102 +0,0 @@
-module test.claim.spark.v41_row_store_encode_run_witness
-
-import std.types { Bool, String, List, NonEmptyStr }
-import std.nat { Nat }
-import std.measure { byte_size, byte_size_count }
-import std.content_hash { Sha256Digest, Sha256DigestHex }
-import std.optional { Present, Absent }
-import gunbc.spark.v41_row_store_encode { V41StoreEncodeArgs }
-import gunbc.spark.v41_row_store_encode_run {
-  V41StoreRun, V41StorePresent, V41StoreEncoded, V41StoreDigestUnread, V41StoreEncodeFailed, V41StorePresenceFailed,
-  V41StoreFound, V41StoreAbsent, V41StorePresenceUnread, v41_store_presence_of,
-  V41StoreSizeMismatch, V41StoreSizeUnread, V41SizeReadOk, V41SizeReadFailed, v41_sized, v41_store_expected_size,
-  V41EncodeRan, V41EncodeRefusedBeforeRun, v41_encode_succeeded, v41_store_line,
-}
-
-// THE RUN'S VERDICT AND RECEIPT, OVER SUPPLIED STORE OUTCOMES (the host legs are the dispatched run's).
-
-fn w_args(layer: Nat, rank: Nat) -> V41StoreEncodeArgs {
-  V41StoreEncodeArgs {
-    layer: layer, rank: rank, shard: "model-00047-of-00048.safetensors" as NonEmptyStr,
-    weight_offset: byte_size(count: 664), scale_offset: byte_size(count: 98305579672), start: 0, rows: 1,
-    weight_bytes: byte_size(count: 256), scale_bytes: byte_size(count: 8), magic_hex: "454e4752310a", out: "/m/s" as NonEmptyStr, expected_size: byte_size(count: 270),
-  }
-}
-
-data w_hex: String = "3e17ab5e78214d961c8ff395020ee135f485c7f5e84f635877e8058dbad7c435"
-
-fn w_sha() -> Sha256Digest {
-  Sha256Digest { hex: w_hex as Sha256DigestHex }
-}
-
-fn w_read(layer: Nat, rank: Nat) -> V41StoreRun {
-  V41StoreEncoded { store: w_args(layer: layer, rank: rank), digest: w_sha(), size: byte_size(count: 270) }
-}
-
-fn w_planned() -> List<V41StoreEncodeArgs> {
-  [w_args(layer: 1, rank: 0), w_args(layer: 1, rank: 1), w_args(layer: 1, rank: 2), w_args(layer: 1, rank: 3),
-   w_args(layer: 14, rank: 0), w_args(layer: 14, rank: 1), w_args(layer: 14, rank: 2), w_args(layer: 14, rank: 3)]
-}
-
-fn w_eight() -> List<V41StoreRun> {
-  map(w_planned(), a => V41StoreEncoded { store: a, digest: w_sha(), size: byte_size(count: 270) })
-}
-
-test fn every_planned_store_digested_succeeds() -> Bool {
-  v41_encode_succeeded(run: V41EncodeRan { planned: w_planned(), stores: w_eight() })
-    && v41_encode_succeeded(run: V41EncodeRan { planned: w_planned(), stores: concat(w_eight() |> take(n: 7), [V41StorePresent { store: w_args(layer: 14, rank: 3), digest: w_sha(), size: byte_size(count: 270) }]) })
-}
-
-// RED: completeness is an identity join against the PLAN, not a count -- a store whose digest read
-// failed, a failed encode, a missing store, a duplicated one, a store the plan does not name, and a
-// refusal before the run are each not success.
-test fn anything_short_of_the_planned_join_is_not_success() -> Bool {
-  let seven = w_eight() |> take(n: 7)
-  !v41_encode_succeeded(run: V41EncodeRan { planned: w_planned(), stores: concat(seven, [V41StoreDigestUnread { store: w_args(layer: 14, rank: 3), encoded: true, cause: "sha256sum exited 1: gone" as NonEmptyStr }]) })
-    && !v41_encode_succeeded(run: V41EncodeRan { planned: w_planned(), stores: concat(seven, [V41StoreEncodeFailed { store: w_args(layer: 14, rank: 3), cause: "the host program exited 3: short read" as NonEmptyStr }]) })
-    && !v41_encode_succeeded(run: V41EncodeRan { planned: w_planned(), stores: seven })
-    && !v41_encode_succeeded(run: V41EncodeRan { planned: w_planned(), stores: concat(seven, [w_read(layer: 1, rank: 0)]) })
-    && !v41_encode_succeeded(run: V41EncodeRan { planned: w_planned(), stores: concat(w_eight(), [w_read(layer: 7, rank: 0)]) })
-    && !v41_encode_succeeded(run: V41EncodeRan { planned: w_planned(), stores: concat(seven, [V41StorePresenceFailed { store: w_args(layer: 14, rank: 3), cause: "the presence check did not run: timeout" as NonEmptyStr }]) })
-    && !v41_encode_succeeded(run: V41EncodeRefusedBeforeRun { cause: "the span plan refused" as NonEmptyStr })
-}
-
-// THE RECEIPT LINE CARRIES THE (layer, rank) KEY AND THE DIGEST, which is what is transcribed; an arm
-// with no digest says UNREAD and why.
-test fn a_store_line_names_its_key_and_digest_or_says_unread() -> Bool {
-  let read = v41_store_line(r: w_read(layer: 14, rank: 2))
-  let unread = v41_store_line(r: V41StoreEncodeFailed { store: w_args(layer: 1, rank: 0), cause: "the encode leg did not run" as NonEmptyStr })
-  let digest_lost = v41_store_line(r: V41StoreDigestUnread { store: w_args(layer: 1, rank: 1), encoded: true, cause: "sha256sum exited 1" as NonEmptyStr })
-  read.contains("store layer.14.rank.2 sha256=") && read.contains(w_hex)
-    && unread.contains("store layer.1.rank.0 UNREAD") && unread.contains("did not run")
-    && digest_lost.contains("store layer.1.rank.1 UNREAD encoded but the digest read failed")
-}
-
-// PRESENCE IS THREE-VALUED: exit 0 found, exit 1 absent, anything else a failed check -- never absent,
-// which would re-encode a complete store (review 70586). Its receipt line says nothing was encoded.
-test fn a_failed_presence_check_is_not_absent_and_encodes_nothing() -> Bool {
-  (match v41_store_presence_of(exit_code: 0, stderr: "") { V41StoreFound => true  _ => false })
-    && (match v41_store_presence_of(exit_code: 1, stderr: "") { V41StoreAbsent => true  _ => false })
-    && (match v41_store_presence_of(exit_code: 2, stderr: "Permission denied") {
-      V41StorePresenceUnread { cause: c } => (c as String).contains("Permission denied")
-      _ => false
-    })
-    && v41_store_line(r: V41StorePresenceFailed { store: w_args(layer: 1, rank: 2), cause: "the presence check did not run: timeout" as NonEmptyStr }).contains("presence check failed, nothing encoded")
-}
-
-// THE SIZE CHECK (proud-deer-538, 2026-09-24): one row of 256 + 8 bytes after the 6-byte magic is 270
-// bytes; a store of any other size is a SIZE-MISMATCH carrying both figures and is not digested, and a
-// size that could not be read is not digested either.
-test fn a_store_of_the_wrong_size_is_refused_with_both_figures() -> Bool {
-  let a = w_args(layer: 1, rank: 0)
-  byte_size_count(b: v41_store_expected_size(a: a)) == 270
-    && (match v41_sized(a: a, encoded: true, d: w_sha(), size: V41SizeReadOk { size: byte_size(count: 270) }) { V41StoreEncoded { store: _, digest: _, size: _ } => true  _ => false })
-    && (match v41_sized(a: a, encoded: true, d: w_sha(), size: V41SizeReadOk { size: byte_size(count: 269) }) {
-      V41StoreSizeMismatch { store: _, digest: _, observed: n, derived: e } => byte_size_count(b: n) == 269 && byte_size_count(b: e) == 270
-      _ => false
-    })
-    && (match v41_sized(a: a, encoded: false, d: w_sha(), size: V41SizeReadFailed { cause: "stat exited 1: gone" as NonEmptyStr }) { V41StoreSizeUnread { store: _, digest: _, cause: _ } => true  _ => false })
-    && !v41_encode_succeeded(run: V41EncodeRan { planned: w_planned(), stores: concat(w_eight() |> take(n: 7), [V41StoreSizeMismatch { store: w_args(layer: 14, rank: 3), digest: w_sha(), observed: byte_size(count: 269), derived: byte_size(count: 270) }]) })
-    && v41_store_line(r: V41StoreSizeMismatch { store: a, digest: w_sha(), observed: byte_size(count: 269), derived: byte_size(count: 270) }).contains("SIZE-MISMATCH")
-    && v41_store_line(r: w_read(layer: 1, rank: 0)).contains("size_bytes=270")
-}
diff --git a/dag/test/claim/spark/v41_row_store_encode_witness_test.dag b/dag/test/claim/spark/v41_row_store_encode_witness_test.dag
deleted file mode 100644
index 9a85320dd5c..00000000000
--- a/dag/test/claim/spark/v41_row_store_encode_witness_test.dag
+++ /dev/null
@@ -1,139 +0,0 @@
-module test.claim.spark.v41_row_store_encode_witness
-
-import std.types { Bool, String, List, NonEmptyStr, Int }
-import std.nat { Nat }
-import std.measure { byte_size, byte_size_count }
-import std.integer { UInt8, qualified_octet_members }
-import std.optional { Present, Absent }
-import extdeps.numeric.base16 { base16_decode_lower }
-import extdeps.tools.sha256sum { Sha256FileDigest, Sha256FileDigestUnavailable, sha256sum_stdin_digest_via_shell }
-import extdeps.safetensors.format { SafeF8E4M3, SafeF8E8M0 }
-import extdeps.vllm.engram_layout { VllmEngramRankRows }
-import extdeps.deepseek.deepseek_v4_1_flash {
-  deepseek_v4_1_flash_engram, deepseek_v4_1_flash_engram_sharded_entries, deepseek_v4_1_flash_engram_shard_files,
-}
-import gunbc.spark.v41_runtime_candidate { v41_candidate_partition }
-import gunbc.spark.v41_engram_row_store {
-  V41RowStoreEncodingSpec, V41SourceRow, V41StoreComplete, V41StoreIncomplete,
-  V41RowStoreSpecAdmitted, V41RowStoreSpecRefused, V41PublishedSpansPlanned, V41PublishedSpansUnplannable,
-  v41_encoding_spec_of_layers, v41_layer_table, v41_row_geometry_of, v41_source_row,
-  v41_place_all, v41_placed_rows, v41_store_bytes, v41_row_store_spec, v41_published_span_plan,
-}
-import gunbc.spark.v41_row_store_encode {
-  V41StoreEncodeArgs, V41StoreEncodePlanned, V41StoreEncodeUnplannable, v41_store_encode_plan,
-  v41_store_encode_argv, v41_row_store_encoder_program, v41_row_store_host_realization, v41_magic_hex,
-}
-import test.claim.vllm.vllm_engram_layout_witness { w_published_head_sizes }
-
-// ── THE DIFFERENTIAL: THE HOST PROGRAM'S BYTES AGAINST THE .dag FOLD'S, OVER REAL PUBLISHED ROWS ──
-//
-// THE RECEIPT, and how it was produced (2026-09-23, bold-newt-50). Rows 96000562 and 96000563 of
-// layers.1.engram.embed.{weight,scale} were read by HTTP range from model-00047-of-00048.safetensors at
-// dba1be0a and written at their TRUE file offsets into a sparse copy of that shard. The rendered
-// program gunbc.spark.v41_row_store_encode v41_row_store_encoder_program -- the exact text the fleet
-// mode ships, whose sha256 is w_program_sha256 -- then ran as `python3 -c <program>` with
-//   --a-offset 664 --a-width 256 --b-offset 98305579672 --b-width 8 --first 96000562 --count 2
-//   --prefix-hex 454e4752310a --chunk 65536
-// and again with --chunk 1, which crosses a chunk boundary between the two rows and wrote the same
-// bytes (the offsets and widths are the live plan's for layer 1, asserted by
-// the_live_plan_hands_the_encoder_what_the_sample_run_used), and w_host_store is its output file. The
-// perturbed receipt is the same run with --b-offset one row further (98305579680): row 0 then
-// carries row 1's scale and row 1 carries row 2's.
-data w_program_sha256: String = "3d6a9c6d2a4c4423940af2b3f6467e0bf96eb5782e72792f1ffaa3edb681fec2"
-
-data w_weight_96000562: String = "73cbf4f370e0e7696f6ab56a6d5cec58e8e7e86e77f2ebc563eaee4b60f2e655c1ec657a76f7f5dad977f1fccef5d7ea5d74f1e57366f17174f1f3fb6ef6fe70f1faf3ebf1f36ff1f5db7b63e97779eb75f6ece87bf17af9717b79f777de78f8f36c6af272e4407375f179e4e55769faf7ecf068ea5e73e468776d6d6ff6f1f275d56eefc3d564e8ee6573686959e5ee71606a586b77e4e8e1f568ee5c595768df7377ef72f77bf763727b73fbf77b71767168f1e57a756c70fb6dea6dfbf57365f8f2f2e3e8fb775e6cfaf6f25cda707172e4e6f2eaea78f473fdecf2657252e979f24ff775fbf6707c71ef727ef7ecf767f6f377de6f706f706bfc7c6feaf9"
-data w_scale_96000562: String = "7877777778777777"
-data w_weight_96000563: String = "5b71726d69725c6567cfea6ae069776871e87873eaf254f26a7458ebf2f7736c75f2eef17048f1ec63c356eef2646e51ecf5de6072ececf2737361e56ee349f979d8e2f96edd6c61f063dfefe96c6ff3f0f572d17afa5eec6b66dce47767f0fadcf7eb57cb7074696ae36dd46761f16e666072e0e46b69dbf362ec6ef4e17cf576ebe3dde9f0f17775e84ae3ccdad0f16b746c4d735ee75076ede2e96df1f7f4f0f67af2ddea67d7edda6ee9e871755cf6ebf660ede966f36eecf064636a66645b71f6637366dc60f0e6f27af7726c706ef971ae72de6bc8f473ecdbe2e75de0737566ec6b6be9d9f4da6f5376696f6ce761c4eeeb5d61eff8f44a766b7a6a60"
-data w_scale_96000563: String = "7878787878787878"
-
-data w_host_store: String = "454e4752310a73cbf4f370e0e7696f6ab56a6d5cec58e8e7e86e77f2ebc563eaee4b60f2e655c1ec657a76f7f5dad977f1fccef5d7ea5d74f1e57366f17174f1f3fb6ef6fe70f1faf3ebf1f36ff1f5db7b63e97779eb75f6ece87bf17af9717b79f777de78f8f36c6af272e4407375f179e4e55769faf7ecf068ea5e73e468776d6d6ff6f1f275d56eefc3d564e8ee6573686959e5ee71606a586b77e4e8e1f568ee5c595768df7377ef72f77bf763727b73fbf77b71767168f1e57a756c70fb6dea6dfbf57365f8f2f2e3e8fb775e6cfaf6f25cda707172e4e6f2eaea78f473fdecf2657252e979f24ff775fbf6707c71ef727ef7ecf767f6f377de6f706f706bfc7c6feaf978777777787777775b71726d69725c6567cfea6ae069776871e87873eaf254f26a7458ebf2f7736c75f2eef17048f1ec63c356eef2646e51ecf5de6072ececf2737361e56ee349f979d8e2f96edd6c61f063dfefe96c6ff3f0f572d17afa5eec6b66dce47767f0fadcf7eb57cb7074696ae36dd46761f16e666072e0e46b69dbf362ec6ef4e17cf576ebe3dde9f0f17775e84ae3ccdad0f16b746c4d735ee75076ede2e96df1f7f4f0f67af2ddea67d7edda6ee9e871755cf6ebf660ede966f36eecf064636a66645b71f6637366dc60f0e6f27af7726c706ef971ae72de6bc8f473ecdbe2e75de0737566ec6b6be9d9f4da6f5376696f6ce761c4eeeb5d61eff8f44a766b7a6a607878787878787878"
-
-data w_host_store_perturbed: String = "454e4752310a73cbf4f370e0e7696f6ab56a6d5cec58e8e7e86e77f2ebc563eaee4b60f2e655c1ec657a76f7f5dad977f1fccef5d7ea5d74f1e57366f17174f1f3fb6ef6fe70f1faf3ebf1f36ff1f5db7b63e97779eb75f6ece87bf17af9717b79f777de78f8f36c6af272e4407375f179e4e55769faf7ecf068ea5e73e468776d6d6ff6f1f275d56eefc3d564e8ee6573686959e5ee71606a586b77e4e8e1f568ee5c595768df7377ef72f77bf763727b73fbf77b71767168f1e57a756c70fb6dea6dfbf57365f8f2f2e3e8fb775e6cfaf6f25cda707172e4e6f2eaea78f473fdecf2657252e979f24ff775fbf6707c71ef727ef7ecf767f6f377de6f706f706bfc7c6feaf978787878787878785b71726d69725c6567cfea6ae069776871e87873eaf254f26a7458ebf2f7736c75f2eef17048f1ec63c356eef2646e51ecf5de6072ececf2737361e56ee349f979d8e2f96edd6c61f063dfefe96c6ff3f0f572d17afa5eec6b66dce47767f0fadcf7eb57cb7074696ae36dd46761f16e666072e0e46b69dbf362ec6ef4e17cf576ebe3dde9f0f17775e84ae3ccdad0f16b746c4d735ee75076ede2e96df1f7f4f0f67af2ddea67d7edda6ee9e871755cf6ebf660ede966f36eecf064636a66645b71f6637366dc60f0e6f27af7726c706ef971ae72de6bc8f473ecdbe2e75de0737566ec6b6be9d9f4da6f5376696f6ce761c4eeeb5d61eff8f44a766b7a6a607778777878777878"
-
-fn w_sample_args() -> V41StoreEncodeArgs {
-  V41StoreEncodeArgs {
-    layer: 1, rank: 0, shard: "model-00047-of-00048.safetensors" as NonEmptyStr,
-    weight_offset: byte_size(count: 664), scale_offset: byte_size(count: 98305579672), start: 96000562, rows: 2,
-    weight_bytes: byte_size(count: 256), scale_bytes: byte_size(count: 8), magic_hex: v41_magic_hex(), out: "/s/out" as NonEmptyStr, expected_size: byte_size(count: 534),
-  }
-}
-
-fn w_octets(hex: String) -> List<UInt8> {
-  match base16_decode_lower(hex: hex) {
-    Present { value: q } => qualified_octet_members(q: q)
-    Absent => [] as List<UInt8>
-  }
-}
-
-// THE SAMPLE AS ONE STORE: the live geometry (256 x F8_E4M3 + 8 x F8_E8M0), layer 1, and a rank-0 range
-// that is exactly the two sampled rows -- the same range the host program was run over.
-fn w_sample_spec() -> V41RowStoreEncodingSpec {
-  v41_encoding_spec_of_layers(
-    partition: v41_candidate_partition,
-    layers: [v41_layer_table(layer: 1, weight: "layers.1.engram.embed.weight" as NonEmptyStr, scale: "layers.1.engram.embed.scale" as NonEmptyStr, rows: 384006168, ranks: [VllmEngramRankRows { rank: 0, start: 96000562, end: 96000564 }])],
-    geometry: v41_row_geometry_of(weight_dtype: SafeF8E4M3, scale_dtype: SafeF8E8M0, weight_width: 256, scale_width: 8),
-  )
-}
-
-fn w_dag_store() -> List<UInt8> {
-  let rows = [
-    v41_source_row(layer: 1, global_row: 96000562, weight: w_octets(hex: w_weight_96000562), scale: w_octets(hex: w_scale_96000562)),
-    v41_source_row(layer: 1, global_row: 96000563, weight: w_octets(hex: w_weight_96000563), scale: w_octets(hex: w_scale_96000563)),
-  ]
-  match v41_store_bytes(placed: v41_placed_rows(placements: v41_place_all(rows: rows, spec: w_sample_spec())), spec: w_sample_spec(), layer: 1, rank: 0) {
-    V41StoreComplete { store: c } => c.bytes
-    V41StoreIncomplete { defect: _ } => [] as List<UInt8>
-  }
-}
-
-test fn the_host_program_writes_exactly_the_folds_store_over_real_published_rows() -> Bool {
-  let dag = w_dag_store()
-  length(dag) == 6 + 2 * 264 && dag == w_octets(hex: w_host_store)
-}
-
-// RED: the same program with its scale table one row off writes a store the fold does not.
-test fn a_perturbed_placement_by_the_host_program_is_not_the_folds_store() -> Bool {
-  let dag = w_dag_store()
-  length(dag) == 6 + 2 * 264 && dag != w_octets(hex: w_host_store_perturbed)
-}
-
-// THE RECEIPT DESCRIBES THE RENDERED PROGRAM THE MODE SHIPS: the text that produced it is the text
-// v41_store_encode_argv carries. An edit to the program invalidates the receipt until it is re-run.
-test fn the_receipt_was_produced_by_the_rendered_program_the_mode_ships() -> Bool {
-  match sha256sum_stdin_digest_via_shell(content: v41_row_store_encoder_program) {
-    Sha256FileDigest { digest: d } => (d.hex as String) == w_program_sha256
-    Sha256FileDigestUnavailable { path: _, reason: _ } => false
-  }
-}
-
-// THE ARGV CARRIES THAT TEXT, and the declaration says what it realizes.
-test fn the_argv_ships_the_rendered_program_as_a_realization_of_v41_place_row() -> Bool {
-  let a = v41_store_encode_argv(shard_directory: "/s" as NonEmptyStr, a: w_sample_args())
-  match get(xs: a, index: 2) {
-    Present { value: prog } => prog == v41_row_store_encoder_program
-    Absent => false
-  } && (v41_row_store_host_realization.realizes.decl_name as String) == "v41_place_row"
-    && (v41_row_store_host_realization.realizes.module_path as String) == "gunbc.spark.v41_engram_row_store"
-}
-
-// THE LIVE PLAN HANDS THE ENCODER WHAT THE SAMPLE RUN USED for layer 1: the weight and scale tables at
-// their header-derived offsets, the 256 + 8 byte widths and the magic -- and eight stores in all.
-test fn the_live_plan_hands_the_encoder_what_the_sample_run_used() -> Bool {
-  match v41_row_store_spec(population: map(deepseek_v4_1_flash_engram_sharded_entries, e => e.entry), partition: v41_candidate_partition, tables: deepseek_v4_1_flash_engram, head_sizes: w_published_head_sizes()) {
-    V41RowStoreSpecRefused { defects: _ } => false
-    V41RowStoreSpecAdmitted { spec: spec } => match v41_published_span_plan(partition: v41_candidate_partition, sharded: deepseek_v4_1_flash_engram_sharded_entries, shards: deepseek_v4_1_flash_engram_shard_files) {
-      V41PublishedSpansUnplannable { defects: _ } => false
-      V41PublishedSpansPlanned { spans: spans } => match v41_store_encode_plan(spec: spec, spans: spans) {
-        V41StoreEncodeUnplannable { defects: _ } => false
-        V41StoreEncodePlanned { stores: st } =>
-          length(st) == 8
-            && any(st, a => a.layer == 1 && a.rank == 0
-              && byte_size_count(b: a.weight_offset) == 664 && byte_size_count(b: a.scale_offset) == 98305579672
-              && a.start == 0 && a.rows == 96000564
-              && byte_size_count(b: a.weight_bytes) == 256 && byte_size_count(b: a.scale_bytes) == 8 && a.magic_hex == "454e4752310a"
-              && (a.shard as String) == "model-00047-of-00048.safetensors"
-              && byte_size_count(b: a.expected_size) == 25344148902)
-      }
-    }
-  }
-}
diff --git a/dag/test/claim/spark/v41_row_store_readback_run_witness_test.dag b/dag/test/claim/spark/v41_row_store_readback_run_witness_test.dag
deleted file mode 100644
index 529700d958d..00000000000
--- a/dag/test/claim/spark/v41_row_store_readback_run_witness_test.dag
+++ /dev/null
@@ -1,69 +0,0 @@
-module test.claim.spark.v41_row_store_readback_run_witness
-
-import std.types { Bool, String, List, NonEmptyStr, Int }
-import std.nat { Nat }
-import std.measure { byte_size }
-import std.optional { Present, Absent }
-import extdeps.exec.command { argv_words }
-import extdeps.tools.gnu_coreutils { od_hex_span_command }
-import extdeps.safetensors.format { SafeF8E4M3, SafeF8E8M0 }
-import extdeps.vllm.engram_layout { VllmEngramRankRows }
-import gunbc.spark.v41_runtime_candidate { v41_candidate_partition }
-import gunbc.spark.v41_engram_row_store {
-  V41RowStoreEncodingSpec, v41_encoding_spec_of_layers, v41_layer_table, v41_row_geometry_of,
-  V41ReadbackSample, V41SampleMagic, V41SampleStoreRecord, V41SampleSourceWeight, V41SampleSourceScale,
-}
-import gunbc.spark.v41_row_store_encode { V41StoreEncodeArgs }
-import gunbc.spark.v41_checkpoint_materialize { v41_checkpoint_directory }
-import gunbc.spark.v41_row_store_readback_run { V41HostRegion, v41_host_region, v41_od_hex }
-
-// ── WHERE EACH SAMPLE IS READ ON THE HOST, AND HOW ITS BYTES ARE READ ─────────────────────────────
-//
-// The run's pure half over SUPPLIED encode-plan rows (the plan itself is witnessed by
-// test.claim.spark.v41_row_store_encode_witness): a store sample is read from that store's out path at the
-// region's offset; a source sample from the plan's shard at its table's published span offset plus the
-// region's offset -- the offsets the encoder itself was given, so a readback and an encode that disagree
-// about where layer 14's table starts cannot both be right.
-
-fn w_spec() -> V41RowStoreEncodingSpec {
-  v41_encoding_spec_of_layers(
-    partition: v41_candidate_partition,
-    layers: [v41_layer_table(layer: 14, weight: "layers.14.engram.embed.weight" as NonEmptyStr, scale: "layers.14.engram.embed.scale" as NonEmptyStr, rows: 10, ranks: [VllmEngramRankRows { rank: 0, start: 0, end: 4 }, VllmEngramRankRows { rank: 1, start: 4, end: 10 }])],
-    geometry: v41_row_geometry_of(weight_dtype: SafeF8E4M3, scale_dtype: SafeF8E8M0, weight_width: 256, scale_width: 8),
-  )
-}
-
-fn w_args(rank: Nat, start: Int, rows: Int) -> V41StoreEncodeArgs {
-  V41StoreEncodeArgs {
-    layer: 14, rank: rank, shard: "model-00048-of-00048.safetensors" as NonEmptyStr,
-    weight_offset: byte_size(count: 672), scale_offset: byte_size(count: 98308271264),
-    start: start, rows: rows, weight_bytes: byte_size(count: 256), scale_bytes: byte_size(count: 8),
-    magic_hex: "454e4752310a", out: join(["/s/layer.14.rank.", to_string(rank), ".engram"], "") as NonEmptyStr,
-    expected_size: byte_size(count: 6 + rows * 264),
-  }
-}
-
-fn w_plan() -> List<V41StoreEncodeArgs> {
-  [w_args(rank: 0, start: 0, rows: 4), w_args(rank: 1, start: 4, rows: 6)]
-}
-
-fn w_at(s: V41ReadbackSample) -> String {
-  match v41_host_region(spec: w_spec(), plan: w_plan(), s: s) {
-    Absent => "absent"
-    Present { value: r } => join([r.path, "@", to_string(r.offset), "+", to_string(r.length)], "")
-  }
-}
-
-test fn each_sample_is_read_where_the_encoder_put_or_took_it() -> Bool {
-  let shard = join([v41_checkpoint_directory as String, "/model-00048-of-00048.safetensors"], "")
-  w_at(s: V41SampleMagic { layer: 14, rank: 1 }) == "/s/layer.14.rank.1.engram@0+6"
-    && w_at(s: V41SampleStoreRecord { layer: 14, rank: 1, local_row: 5 }) == join(["/s/layer.14.rank.1.engram@", to_string(6 + 5 * 264), "+264"], "")
-    && w_at(s: V41SampleSourceWeight { layer: 14, global_row: 4 }) == join([shard, "@", to_string(672 + 4 * 256), "+256"], "")
-    && w_at(s: V41SampleSourceScale { layer: 14, global_row: 4 }) == join([shard, "@", to_string(98308271264 + 4 * 8), "+8"], "")
-    && w_at(s: V41SampleMagic { layer: 1, rank: 0 }) == "absent"
-}
-
-test fn od_reads_one_span_as_hex_and_its_lines_are_joined() -> Bool {
-  argv_words(command: od_hex_span_command(path: "/s/x", offset: 1590, length: 264)) == ["od", "-An", "-v", "-tx1", "-j", "1590", "-N", "264", "--", "/s/x"]
-    && v41_od_hex(stdout: " 45 4e 47\n 52 31 0a\n") == "454e4752310a"
-}
diff --git a/dag/test/claim/spark/v41_runtime_candidate_witness_test.dag b/dag/test/claim/spark/v41_runtime_candidate_witness_test.dag
deleted file mode 100644
index e2c98d021b2..00000000000
--- a/dag/test/claim/spark/v41_runtime_candidate_witness_test.dag
+++ /dev/null
@@ -1,576 +0,0 @@
-module test.claim.spark.v41_runtime_candidate_witness
-
-import std.types { Bool, String, Int, List, NonEmptyStr }
-import std.nat { Nat }
-import std.decl_ref { DeclarationRef, NamedField, decl_field_ref }
-import std.optional { Present, Absent }
-import std.content_hash { ContentHash, Sha256Hash, Sha256Digest, Sha256DigestHex, serialize_content_hash }
-import gunbc.spark.v41_engram_row_store { V41StoreReadback, V41StoreReadbackUnread, V41PublishedRowStoreKeyed, V41PublishedRowStoreRefused }
-import extdeps.gpu.types { GpuComputeCapability }
-import extdeps.vllm.server { VllmSourceRevision }
-import extdeps.vendor.nvidia { nvidia }
-import extdeps.vendor.amd { amd }
-import extdeps.vllm.source_build { vllm_d2d649e6_revision, vllm_deepseek_v4_1_sm12_revision, vllm_recipe_targeting }
-import extdeps.flashinfer.flashinfer { FlashInferWheel, FlashInferWheelAdmission, FlashInferWheelAdmitted, FlashInferWheelRefused, admit_flashinfer_wheel, flashinfer_0_7_1rc1, flashinfer_0_7_1rc1_wheels, FlashInferPublishedRelease, FlashInferProjectStable }
-import gunbc.spark.serving_deployment_selection { topology_shape }
-import gunbc.fabric.engram_materialization { engram_route_b_identity, engram_route_d_identity, engram_route_c_identity }
-import gunbc.spark.serving_runtime_capability_probe { gb10_observed_compute_capability }
-import gunbc.spark.v41_identity_input { V41EngramResidencyPartition }
-import gunbc.spark.v41_index_engram_selection { v41_engram_population_observed_of, V41IndexEngramSelectionRead }
-import std.measure { byte_size }
-import gunbc.spark.v41_runtime_candidate {
-  V41EnginePatch, v41_engine_patch, V41PatchPopulation, V41PatchesObserved, V41PatchesAbsentByObservation, V41PatchesUnestablished,
-  V41EngramPartitionAuthority, PartitionFixedByPatch, PartitionByLaunchConfiguration,
-  V41RuntimeArtifactInputs, V41ModelSourceInputs, V41EngramRealizationInputs, V41CandidateInputs,
-  V41ManifestObserved, V41ManifestUnestablished, V41ManifestRefused, V41ModelSourceInputs, v41_model_source_key, V41IdentityRefused, V41IdentityUnestablished, V41IdentityKeyed,
-  V41PartitionAdmitted, V41PartitionRefused, v41_admit_partition,
-  V41CandidateStanding, V41CandidateVerdict, V41CandidateKeyed, V41CandidateUnestablished, V41CandidateRefused,
-  v41_candidate_standing, v41_candidate, v41_candidate_inputs, v41_candidate_partition, v41_candidate_recipe,
-  v41_engram_population_of, v41_is_embedding_table,
-  V41PatchApplicationStanding, V41VanillaSourceAtRevision, V41PatchApplicationUnestablished, V41PatchApplicationRefused,
-  v41_patch_application_standing, v41_storage_patch_application_standing,
-}
-import extdeps.safetensors.format {
-  SafetensorsPopulationStanding, safetensors_population_standing,
-  MembershipClosedAgainstFullIndex, MembershipScopedToReadRows,
-}
-import extdeps.deepseek.deepseek_v4_1_flash {
-  deepseek_v4_1_flash_engram,
-  deepseek_v4_1_flash_engram_index_members, deepseek_v4_1_flash_engram_shard_files,
-  deepseek_v4_1_flash_engram_population_reading, deepseek_v4_1_flash_engram_population,
-  deepseek_v4_1_flash_index_tensor_count,
-}
-
-// THE CANDIDATE'S DERIVATION EVIDENCE, SUPPLIED: these claims are about the key, which the readback never
-// enters, so they pass the one arm that leaves a keyed standing keyed.
-fn w_readback_unread() -> V41StoreReadback {
-  V41StoreReadbackUnread { obligation: "fixture: the stores were not read back" as NonEmptyStr }
-}
-
-// THE SAME TWELVE ROWS, READ AS IF THE INDEX HAD BEEN ENUMERATED. Every key-identity law below needs a
-// candidate that actually keys, and the live population cannot produce one: it closes against the rows
-// that were read, which this module now treats as an unestablished axis. Supplying a closed standing is
-// the honest way to write "if the index were enumerated" -- it changes only the closure, and it is a
-// fixture rather than a claim about the checkpoint.
-data w_closed_population: SafetensorsPopulationStanding = safetensors_population_standing(
-  members: deepseek_v4_1_flash_engram_index_members,
-  shards: deepseek_v4_1_flash_engram_shard_files,
-  closure: MembershipClosedAgainstFullIndex {
-    index_population_count: deepseek_v4_1_flash_index_tensor_count,
-    how: "fixture: this closure is asserted by the test, not read from the revision's index" as NonEmptyStr,
-  },
-  reading: deepseek_v4_1_flash_engram_population_reading,
-)
-
-fn w_sha(c: String) -> Sha256Digest {
-  Sha256Digest { hex: join([c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c], "") as Sha256DigestHex }
-}
-
-fn w_patch_against(path: String, c: String, applies_to: VllmSourceRevision) -> List<V41EnginePatch> {
-  match v41_engine_patch(path: path as NonEmptyStr, applies_to: applies_to, sha256_hex: w_sha(c: c).hex as String, purpose: "fixture" as NonEmptyStr) {
-    Present { value: p } => [p]
-    Absent => [] as List<V41EnginePatch>
-  }
-}
-
-fn w_patch(path: String, c: String) -> List<V41EnginePatch> {
-  w_patch_against(path: path, c: c, applies_to: vllm_d2d649e6_revision)
-}
-
-type WPatchSpec {
-  path: String
-  c: String
-}
-
-fn w_observed(pairs: List<WPatchSpec>, partition: V41EngramPartitionAuthority) -> V41PatchPopulation {
-  V41PatchesObserved { patches: flat_map(pairs, x => w_patch(path: x.path, c: x.c)), partition: partition }
-}
-
-// A CONTROLLED FIXTURE WITH EVERY AXIS ESTABLISHED, so the key laws below are asserted over a keyed
-// candidate. The live candidate is deliberately unestablished and is asserted separately.
-fn w_inputs_with_wheels(patches: V41PatchPopulation, partition: V41EngramResidencyPartition, route: DeclarationRef, tp: Nat, device: GpuComputeCapability, max_jobs: Nat, wheels: List<FlashInferWheel>) -> V41CandidateInputs {
-  V41CandidateInputs {
-    runtime: V41RuntimeArtifactInputs {
-      recipe: vllm_recipe_targeting(base: v41_candidate_recipe(), torch_cuda_arch_list: v41_candidate_recipe().torch_cuda_arch_list, install_kv_connectors: v41_candidate_recipe().install_kv_connectors, max_jobs: max_jobs, nvcc_threads: 2),
-      kernel_acquisition: flashinfer_0_7_1rc1,
-      kernel_wheels: wheels,
-      patches: patches,
-    },
-    model_source: V41ModelSourceInputs {
-      checkpoint_revision: "dba1be0a40aa45a94ad051997016db3960a90277" as NonEmptyStr,
-      weights: V41ManifestObserved { digest: w_sha(c: "a") },
-      tokenizer: V41ManifestObserved { digest: w_sha(c: "b") },
-    },
-    engram: V41EngramRealizationInputs { partition: partition, population: w_closed_population, row_store_encoding: V41PublishedRowStoreKeyed { digest: Sha256Hash(w_sha(c: "c")) }, route: route },
-    topology: topology_shape(tensor_parallel_degree: tp, replica_count: 1),
-    device: device,
-  }
-}
-
-fn w_inputs(patches: V41PatchPopulation, partition: V41EngramResidencyPartition, route: DeclarationRef, tp: Nat, device: GpuComputeCapability, max_jobs: Nat) -> V41CandidateInputs {
-  w_inputs_with_wheels(patches: patches, partition: partition, route: route, tp: tp, device: device, max_jobs: max_jobs, wheels: flashinfer_0_7_1rc1_wheels)
-}
-
-fn w_wheels_named(names: List<String>) -> List<FlashInferWheel> {
-  flat_map(names, n => filter(flashinfer_0_7_1rc1_wheels, w => (w.package as String) == n))
-}
-
-fn w_two_patches() -> V41PatchPopulation {
-  w_observed(pairs: [WPatchSpec { path: "engram_storage.patch", c: "1" }, WPatchSpec { path: "engram_prefetch.patch", c: "2" }], partition: PartitionByLaunchConfiguration)
-}
-
-fn w_default(patches: V41PatchPopulation) -> V41CandidateInputs {
-  w_inputs(patches: patches, partition: v41_candidate_partition, route: engram_route_b_identity, tp: 4, device: gb10_observed_compute_capability, max_jobs: 6)
-}
-
-fn w_key(s: V41CandidateVerdict, which: String) -> String {
-  match s.standing {
-    V41CandidateKeyed { runtime_artifact: r, model_source: m, engram_realization: e, execution_profile: x, candidate: c, authorization_obligation: _ } =>
-      if which == "runtime" { serialize_content_hash(hash: r) as String }
-      else if which == "engram" { serialize_content_hash(hash: e) as String }
-      else if which == "execution" { serialize_content_hash(hash: x) as String }
-      else { serialize_content_hash(hash: c) as String }
-    V41CandidateUnestablished { obligations: _ } => "unestablished"
-    V41CandidateRefused { defects: _ } => "refused"
-  }
-}
-
-fn w_refused_with(s: V41CandidateVerdict, fragment: String) -> Bool {
-  match s.standing {
-    V41CandidateRefused { defects: d } => any(d, x => (x as String).contains(fragment))
-    V41CandidateKeyed { runtime_artifact: _, model_source: _, engram_realization: _, execution_profile: _, candidate: _, authorization_obligation: _ } => false
-    V41CandidateUnestablished { obligations: _ } => false
-  }
-}
-
-// THE LIVE CANDIDATE IS KEYED (2026-09-24): the eight encoded stores were read on srv5 with digests and
-// sizes (gunbc.spark.v41_engram_row_store v41_published_store_readings, fleet-converge run 36023830860)
-// over the verified spans, so the published-shard row-store content digest no longer names an obligation.
-// The weight manifest and the tokenizer files are keyed from the publisher's digests, and the Engram
-// membership closure is discharged by srv8's index-selection reading (gunbc.spark.v41_index_engram_selection
-// v41_engram_population_observed, run 35877813088). No axis remains open, so the verdict is Keyed; the
-// operator's authorization obligation rides inside it. Any residual obligation turns this claim red.
-test fn the_live_candidate_is_keyed_end_to_end() -> Bool {
-  match v41_candidate().standing {
-    V41CandidateKeyed { runtime_artifact: _, model_source: _, engram_realization: _, execution_profile: _, candidate: _, authorization_obligation: _ } => true
-    V41CandidateUnestablished { obligations: _ } => false
-    V41CandidateRefused { defects: _ } => false
-  }
-}
-
-// A DEFECT IS NOT AN OBLIGATION: a refused weight population refuses the model source naming the
-// defects (and the candidate with it), while an undigested tokenizer is an obligation; both present,
-// the defect is answered, never hidden behind pending work -- including on the Engram axis, where a
-// refused row store under a membership residual refuses rather than joining the residual's obligations.
-test fn a_refused_manifest_refuses_the_model_source_and_is_not_an_obligation() -> Bool {
-  let refused = V41ModelSourceInputs { checkpoint_revision: "dba1be0a40aa45a94ad051997016db3960a90277" as NonEmptyStr, weights: V41ManifestRefused { first: "weight manifest: path declared more than once: model-00003-of-00048.safetensors" as NonEmptyStr, rest: [] as List<NonEmptyStr> }, tokenizer: V41ManifestUnestablished { obligation: "the tokenizer text could not be digested" as NonEmptyStr } }
-  let pending = V41ModelSourceInputs { checkpoint_revision: "dba1be0a40aa45a94ad051997016db3960a90277" as NonEmptyStr, weights: V41ManifestObserved { digest: w_sha(c: "a") }, tokenizer: V41ManifestUnestablished { obligation: "the tokenizer text could not be digested" as NonEmptyStr } }
-  let residual_and_refused = v41_candidate_standing(readback: w_readback_unread(), c: V41CandidateInputs {
-    runtime: w_default(patches: w_two_patches()).runtime,
-    model_source: w_default(patches: w_two_patches()).model_source,
-    engram: V41EngramRealizationInputs { partition: v41_candidate_partition, population: deepseek_v4_1_flash_engram_population, row_store_encoding: V41PublishedRowStoreRefused { defects: ["row store: a row of another table" as NonEmptyStr] }, route: engram_route_b_identity },
-    topology: topology_shape(tensor_parallel_degree: 4, replica_count: 1),
-    device: gb10_observed_compute_capability,
-  })
-  (match v41_model_source_key(s: refused) { V41IdentityRefused { defects: d } => length(d) == 1 && any(d, x => (x as String).contains("more than once"))  _ => false })
-    && (match v41_model_source_key(s: pending) { V41IdentityUnestablished { obligations: o } => length(o) == 1  _ => false })
-    && (match residual_and_refused.standing { V41CandidateRefused { defects: d } => any(d, x => (x as String).contains("another table"))  _ => false })
-    && (match v41_candidate_standing(readback: w_readback_unread(), c: V41CandidateInputs { runtime: w_default(patches: w_two_patches()).runtime, model_source: refused, engram: w_default(patches: w_two_patches()).engram, topology: topology_shape(tensor_parallel_degree: 4, replica_count: 1), device: gb10_observed_compute_capability }).standing { V41CandidateRefused { defects: d } => any(d, x => (x as String).contains("more than once"))  _ => false })
-    && (match v41_candidate_standing(readback: w_readback_unread(), c: V41CandidateInputs { runtime: w_default(patches: w_two_patches()).runtime, model_source: pending, engram: w_default(patches: w_two_patches()).engram, topology: topology_shape(tensor_parallel_degree: 4, replica_count: 1), device: gb10_observed_compute_capability }).standing { V41CandidateUnestablished { obligations: o } => length(o) == 1 && any(o, x => (x as String).contains("tokenizer"))  _ => false })
-}
-
-// THE POSITIVE CONTROL: the same inputs with every axis established key, and the keyed candidate still
-// carries the authorization obligation -- identity is not permission.
-test fn an_established_fixture_is_keyed_and_still_owes_authorization() -> Bool {
-  match v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches())).standing {
-    V41CandidateKeyed { runtime_artifact: _, model_source: _, engram_realization: _, execution_profile: _, candidate: _, authorization_obligation: a } =>
-      (a as String).contains("authorized_v4_1_runtime_holds")
-    V41CandidateUnestablished { obligations: _ } => false
-    V41CandidateRefused { defects: _ } => false
-  }
-}
-
-// ONE PATCH'S BYTES CHANGE THE RUNTIME AND THE CANDIDATE, and leave the Engram realization alone -- a
-// patch under launch-configured partitioning is not a fact about where the rows live.
-test fn changing_one_patch_digest_changes_the_runtime_and_candidate_but_not_the_recipe_key() -> Bool {
-  let a = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches()))
-  let b = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_observed(pairs: [WPatchSpec { path: "engram_storage.patch", c: "9" }, WPatchSpec { path: "engram_prefetch.patch", c: "2" }], partition: PartitionByLaunchConfiguration)))
-  w_key(s: a, which: "runtime") != w_key(s: b, which: "runtime")
-    && w_key(s: a, which: "candidate") != w_key(s: b, which: "candidate")
-    && w_key(s: a, which: "engram") == w_key(s: b, which: "engram")
-}
-
-// APPLICATION ORDER IS SEMANTIC; AN OBSERVED EMPTY POPULATION IS AN IDENTITY OF ITS OWN.
-test fn patch_order_matters_and_absent_by_observation_differs_from_patched() -> Bool {
-  let ab = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches()))
-  let ba = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_observed(pairs: [WPatchSpec { path: "engram_prefetch.patch", c: "2" }, WPatchSpec { path: "engram_storage.patch", c: "1" }], partition: PartitionByLaunchConfiguration)))
-  let unpatched = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: V41PatchesAbsentByObservation))
-  w_key(s: ab, which: "runtime") != w_key(s: ba, which: "runtime")
-    && w_key(s: unpatched, which: "runtime") != "unestablished"
-    && w_key(s: unpatched, which: "runtime") != w_key(s: ab, which: "runtime")
-}
-
-// BUILD PARALLELISM IS NOT IDENTITY, by the same law the image build key already holds.
-test fn build_parallelism_does_not_change_the_runtime_key() -> Bool {
-  let six = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches()))
-  let sixteen = v41_candidate_standing(readback: w_readback_unread(), c: w_inputs(patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_b_identity, tp: 4, device: gb10_observed_compute_capability, max_jobs: 16))
-  w_key(s: six, which: "runtime") == w_key(s: sixteen, which: "runtime")
-}
-
-// ROUTE B VERSUS D IS AN ENGRAM REALIZATION FACT, NOT A RUNTIME FACT; ROUTE C IS REFUSED.
-test fn the_route_moves_the_engram_and_candidate_keys_but_not_the_runtime_key() -> Bool {
-  let b = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches()))
-  let d = v41_candidate_standing(readback: w_readback_unread(), c: w_inputs(patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_d_identity, tp: 4, device: gb10_observed_compute_capability, max_jobs: 6))
-  let c = v41_candidate_standing(readback: w_readback_unread(), c: w_inputs(patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_c_identity, tp: 4, device: gb10_observed_compute_capability, max_jobs: 6))
-  w_key(s: b, which: "runtime") == w_key(s: d, which: "runtime")
-    && w_key(s: b, which: "engram") != w_key(s: d, which: "engram")
-    && w_key(s: b, which: "candidate") != w_key(s: d, which: "candidate")
-    && w_refused_with(s: c, fragment: "engram_route_c_nfs_token_time")
-}
-
-// THE PARTITION AUTHORITY IS IN THE RUNTIME KEY, AND THE PARTITION ITSELF NO LONGER VARIES. A patch that
-// hard-codes the storage/resident split puts that split in the runtime's bytes, so the authority is keyed;
-// a runtime that takes it as launch configuration does not. Both arms still key differently because the
-// authority is an input to the key.
-//
-// WHAT THIS TEST USED TO ASSERT AND CANNOT ANY MORE, STATED RATHER THAN QUIETLY DROPPED: it varied the
-// partition under each authority and asserted the fixed arm's key moved while the configured arm's did
-// not. Its alternative partition kept layers.14.engram.embed.scale resident -- which is now refused,
-// because the role wall admits exactly one split of this population: every declared embedding tensor
-// storage-backed, every operator resident. So there is no second admissible partition to vary, and the
-// half of this claim that varied one was asserting a difference over a state the model now refuses to
-// construct. The consequence is real and worth knowing: for THIS checkpoint the partition is determined,
-// and PartitionFixedByPatch buys no key separation beyond the authority tag until a population arrives
-// where more than one split is admissible.
-test fn the_partition_authority_is_in_the_runtime_key() -> Bool {
-  let fixed = w_observed(pairs: [WPatchSpec { path: "engram_storage.patch", c: "1" }], partition: PartitionFixedByPatch)
-  let configured = w_observed(pairs: [WPatchSpec { path: "engram_storage.patch", c: "1" }], partition: PartitionByLaunchConfiguration)
-  let fixed_a = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: fixed))
-  let conf_a = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: configured))
-  w_key(s: fixed_a, which: "runtime") != w_key(s: conf_a, which: "runtime")
-    && w_key(s: fixed_a, which: "runtime") != "refused"
-    && w_key(s: conf_a, which: "runtime") != "refused"
-}
-
-// EXACTLY ONE SPLIT OF THIS POPULATION IS ADMISSIBLE, which is the fact the claim above now rests on, so
-// it is asserted rather than assumed: moving any single tensor across the line refuses.
-test fn the_role_wall_leaves_exactly_one_admissible_partition() -> Bool {
-  let moved_embed = V41EngramResidencyPartition {
-    storage_backed: map(filter(v41_candidate_partition.storage_backed, n => (n as String) != "layers.14.engram.embed.scale"), n => n),
-    resident: concat(v41_candidate_partition.resident, ["layers.14.engram.embed.scale" as NonEmptyStr]),
-  }
-  (match v41_admit_partition(p: v41_candidate_partition, standing: w_closed_population) {
-    V41PartitionAdmitted { partition: _ } => true
-    V41PartitionRefused { defects: _ } => false
-  })
-    && (match v41_admit_partition(p: moved_embed, standing: w_closed_population) {
-      V41PartitionRefused { defects: d } => any(d, x => (x as String).contains("layers.14.engram.embed.scale"))
-      V41PartitionAdmitted { partition: _ } => false
-    })
-}
-
-// THE LIVE PARTITION IS TOTAL AND DISJOINT OVER THE CITED POPULATION, AND ITS STORAGE-BACKED BYTES ARE
-// DERIVED FROM THE CITED SPANS: 101377628352 + 101380404048. A foreign or a missing tensor refuses.
-test fn the_partition_is_admitted_with_derived_bytes_and_a_malformed_one_refuses() -> Bool {
-  (match v41_admit_partition(p: v41_candidate_partition, standing: w_closed_population) {
-      V41PartitionAdmitted { partition: _ } => true
-      V41PartitionRefused { defects: _ } => false
-    })
-    && (match v41_admit_partition(p: V41EngramResidencyPartition { storage_backed: concat(v41_candidate_partition.storage_backed, ["layers.2.engram.embed.weight" as NonEmptyStr]), resident: v41_candidate_partition.resident }, standing: w_closed_population) {
-      V41PartitionRefused { defects: d } => any(d, x => (x as String).contains("layers.2.engram.embed.weight"))
-      V41PartitionAdmitted { partition: _ } => false
-    })
-    && (match v41_admit_partition(p: V41EngramResidencyPartition { storage_backed: v41_candidate_partition.storage_backed, resident: ["layers.1.engram.q_weight" as NonEmptyStr] }, standing: w_closed_population) {
-      V41PartitionRefused { defects: d } => any(d, x => (x as String).contains("layers.14.engram.wkv.scale"))
-      V41PartitionAdmitted { partition: _ } => false
-    })
-}
-
-// A MEMBERSHIP SCOPED TO THE ROWS READ STILL CANNOT KEY, AND ONE CLOSED BY A READING OF THE PINNED
-// INDEX CAN (gunbc.spark.v41_index_engram_selection v41_engram_population_observed_of, supplied a reading). The scoped
-// standing differs from it in the closure ALONE -- same members, same shards, same reading -- and must
-// stay unestablished, so this pair discriminates the membership closure and nothing else.
-fn w_engram_with(population: SafetensorsPopulationStanding) -> V41CandidateVerdict {
-  v41_candidate_standing(readback: w_readback_unread(), c: V41CandidateInputs {
-    runtime: w_default(patches: w_two_patches()).runtime,
-    model_source: w_default(patches: w_two_patches()).model_source,
-    engram: V41EngramRealizationInputs {
-      partition: v41_candidate_partition,
-      population: population,
-      row_store_encoding: V41PublishedRowStoreKeyed { digest: Sha256Hash(w_sha(c: "c")) },
-      route: engram_route_b_identity,
-    },
-    topology: topology_shape(tensor_parallel_degree: 4, replica_count: 1),
-    device: gb10_observed_compute_capability,
-  })
-}
-
-test fn a_scoped_membership_is_unestablished_and_the_closed_live_population_keys() -> Bool {
-  let scoped = safetensors_population_standing(
-    members: deepseek_v4_1_flash_engram_index_members,
-    shards: deepseek_v4_1_flash_engram_shard_files,
-    closure: MembershipScopedToReadRows { read_rows: 12, unenumerated: "fixture: the index is not enumerated" as NonEmptyStr },
-    reading: deepseek_v4_1_flash_engram_population_reading,
-  )
-  (match w_engram_with(population: scoped).standing {
-    V41CandidateUnestablished { obligations: o } => any(o, x => (x as String).contains("membership is reconciled against 12 index rows that were read"))
-    V41CandidateKeyed { runtime_artifact: _, model_source: _, engram_realization: _, execution_profile: _, candidate: _, authorization_obligation: _ } => false
-    V41CandidateRefused { defects: _ } => false
-  }) && (match w_engram_with(population: v41_engram_population_observed_of(reading: V41IndexEngramSelectionRead { index_sha256_hex: "74b0686a3d2891980d5e303251b075a3bccae2c2ff650747db2620a649b98fa8" as Sha256DigestHex, index_bytes: byte_size(count: 7470294), name_count: 96085, members: deepseek_v4_1_flash_engram_index_members, observed: "fixture: a reading of the pinned file" as NonEmptyStr })).standing {
-    V41CandidateKeyed { runtime_artifact: _, model_source: _, engram_realization: _, execution_profile: _, candidate: _, authorization_obligation: _ } => true
-    V41CandidateUnestablished { obligations: _ } => false
-    V41CandidateRefused { defects: _ } => false
-  })
-}
-
-// A TOTAL, DISJOINT PARTITION CAN STILL BE THE WRONG WAY ROUND, AND THE CHEAP TEST FOR IT IS NOT ENOUGH.
-// An earlier wall compared the two sides' byte totals. This is the partition that defeats it: layer 1's
-// embed pair AND every q/k/wkv operator on storage, layer 14's embed pair resident. Every shape check
-// passes, storage leads by 312268144 bytes, and a complete ~101 GB table is being kept in memory while
-// every small operator has moved to disk. It is the inversion the candidate exists to exclude, and the
-// byte-majority form admitted it.
-test fn a_partition_that_keeps_one_embedding_table_resident_refuses() -> Bool {
-  let population = v41_engram_population_of(standing: w_closed_population)
-  let layer_14_embed = map(filter(population, e => v41_is_embedding_table(e: e, tables: deepseek_v4_1_flash_engram) && (e.name as String).contains("layers.14.")), e => e.name)
-  let rest = map(filter(population, e => !any(layer_14_embed, n => (n as String) == (e.name as String))), e => e.name)
-  let sneaky = V41EngramResidencyPartition { storage_backed: rest, resident: layer_14_embed }
-  length(layer_14_embed) == 2
-    && length(rest) == 10
-    && match v41_admit_partition(p: sneaky, standing: w_closed_population) {
-      V41PartitionRefused { defects: d } => any(d, x => (x as String).contains("layers.14.engram.embed.weight") && (x as String).contains("keeps it resident"))
-      V41PartitionAdmitted { partition: _ } => false
-    }
-}
-
-// THE OTHER DIRECTION, so the wall is about roles rather than about the embedding side alone: a small
-// operator moved to storage is refused too.
-test fn a_partition_that_reads_a_small_operator_from_storage_refuses() -> Bool {
-  let moved = V41EngramResidencyPartition {
-    storage_backed: concat(v41_candidate_partition.storage_backed, ["layers.1.engram.q_weight" as NonEmptyStr]),
-    resident: map(filter(v41_candidate_partition.resident, n => (n as String) != "layers.1.engram.q_weight"), n => n),
-  }
-  match v41_admit_partition(p: moved, standing: w_closed_population) {
-    V41PartitionRefused { defects: d } => any(d, x => (x as String).contains("layers.1.engram.q_weight") && (x as String).contains("reads it from storage"))
-    V41PartitionAdmitted { partition: _ } => false
-  }
-}
-
-// THE ROLE JOIN IS THE PUBLISHER'S OWN DECLARED EXTENTS, so this asserts the join rather than a name rule:
-// exactly the four embed tensors carry an unpadded_embeddings count as their first dimension.
-test fn exactly_the_embedding_tensors_carry_a_declared_unpadded_extent() -> Bool {
-  let population = v41_engram_population_of(standing: w_closed_population)
-  let tables = filter(population, e => v41_is_embedding_table(e: e, tables: deepseek_v4_1_flash_engram))
-  length(population) == 12
-    && length(tables) == 4
-    && all(tables, e => (e.name as String).contains(".engram.embed."))
-}
-
-// THE SHAPE AND THE KERNEL PIN REFUSE. TP8, a 12.0 device, and a kernel acquisition naming a version the
-// recipe does not install are each refused, not keyed.
-test fn a_wrong_topology_device_or_kernel_version_refuses() -> Bool {
-  let wrong_kernel = V41CandidateInputs {
-    runtime: V41RuntimeArtifactInputs {
-      recipe: v41_candidate_recipe(),
-      kernel_acquisition: FlashInferPublishedRelease { version: "0.7.0" as NonEmptyStr, channel: FlashInferProjectStable, index: "fixture" as NonEmptyStr },
-      kernel_wheels: flashinfer_0_7_1rc1_wheels,
-      patches: w_two_patches(),
-    },
-    model_source: w_default(patches: w_two_patches()).model_source,
-    engram: w_default(patches: w_two_patches()).engram,
-    topology: topology_shape(tensor_parallel_degree: 4, replica_count: 1),
-    device: gb10_observed_compute_capability,
-  }
-  w_refused_with(s: v41_candidate_standing(readback: w_readback_unread(), c: w_inputs(patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_b_identity, tp: 8, device: gb10_observed_compute_capability, max_jobs: 6)), fragment: "tp8")
-    && w_refused_with(s: v41_candidate_standing(readback: w_readback_unread(), c: w_inputs(patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_b_identity, tp: 4, device: GpuComputeCapability { vendor: nvidia, major: 12, minor: 0 }, max_jobs: 6)), fragment: "12.0")
-    && w_refused_with(s: v41_candidate_standing(readback: w_readback_unread(), c: wrong_kernel), fragment: "0.7.0")
-}
-
-// THE PATCH BUILDER REFUSES A DIGEST THAT IS NOT sha256, and every fixture above was admitted by it: the
-// two-patch population really carries two patches, so the key laws are not asserted over an empty list.
-test fn a_patch_needs_a_sha256_digest_and_the_fixtures_are_admitted() -> Bool {
-  (match v41_engine_patch(path: "p" as NonEmptyStr, applies_to: vllm_d2d649e6_revision, sha256_hex: "not-a-digest", purpose: "fixture" as NonEmptyStr) {
-    Present { value: _ } => false
-    Absent => true
-  })
-    && (match w_two_patches() {
-      V41PatchesObserved { patches: ps, partition: _ } => length(ps) == 2
-      V41PatchesAbsentByObservation => false
-      V41PatchesUnestablished { obligation: _ } => false
-    })
-}
-
-// THE KERNEL CLOSURE IS AN EXACT PACKAGE POPULATION. A runtime carrying only flashinfer-python, or two
-// variants of one package, is not the closure upstream's Dockerfile installs, so it refuses instead of
-// keying. The complete population keys, which is what stops a mint that refuses everything.
-test fn the_kernel_population_must_be_exactly_the_required_closure() -> Bool {
-  let full = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches()))
-  let only_python = v41_candidate_standing(readback: w_readback_unread(), c: w_inputs_with_wheels(patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_b_identity, tp: 4, device: gb10_observed_compute_capability, max_jobs: 6, wheels: w_wheels_named(names: ["flashinfer-python"])))
-  let doubled = v41_candidate_standing(readback: w_readback_unread(), c: w_inputs_with_wheels(patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_b_identity, tp: 4, device: gb10_observed_compute_capability, max_jobs: 6, wheels: concat(flashinfer_0_7_1rc1_wheels, w_wheels_named(names: ["flashinfer-cubin"]))))
-  w_key(s: full, which: "runtime") != "unestablished" && w_key(s: full, which: "runtime") != "refused"
-    && w_refused_with(s: only_python, fragment: "carries no flashinfer-cubin wheel")
-    && w_refused_with(s: doubled, fragment: "more than one flashinfer-cubin wheel")
-}
-
-// A PATCH AUTHORED AGAINST ANOTHER vLLM REVISION REFUSES. Recording applies_to in the key is not the same
-// as enforcing it: the population must be applicable to the recipe's own source.
-test fn a_patch_for_a_different_revision_refuses() -> Bool {
-  let foreign = V41PatchesObserved { patches: concat(w_patch(path: "engram_storage.patch", c: "1"), w_patch_against(path: "engram_prefetch.patch", c: "2", applies_to: vllm_deepseek_v4_1_sm12_revision)), partition: PartitionByLaunchConfiguration }
-  w_refused_with(s: v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: foreign)), fragment: "07b75534")
-}
-
-// SET-LIKE POPULATIONS ARE CANONICAL. The wheels and the two sides of the partition are sets: writing
-// them in another order is the same candidate. Only the patch sequence is order-bearing, which the
-// patch-order witness above asserts in the other direction.
-test fn reordering_wheels_or_partition_members_does_not_change_the_key() -> Bool {
-  let a = v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: w_two_patches()))
-  let reversed_wheels = v41_candidate_standing(readback: w_readback_unread(), c: w_inputs_with_wheels(patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_b_identity, tp: 4, device: gb10_observed_compute_capability, max_jobs: 6, wheels: w_wheels_named(names: concat(["flashinfer-jit-cache-sm90a", "flashinfer-jit-cache-sm89", "flashinfer-jit-cache-sm80", "flashinfer-jit-cache-sm121a", "flashinfer-jit-cache-sm120f", "flashinfer-jit-cache-sm110a", "flashinfer-jit-cache-sm103a", "flashinfer-jit-cache-sm100a"], ["flashinfer-jit-cache", "flashinfer-cubin", "flashinfer-python"]))))
-  let reordered_partition = v41_candidate_standing(readback: w_readback_unread(), c: w_inputs(patches: w_two_patches(), partition: V41EngramResidencyPartition {
-    storage_backed: ["layers.14.engram.embed.scale" as NonEmptyStr, "layers.1.engram.embed.weight" as NonEmptyStr, "layers.14.engram.embed.weight" as NonEmptyStr, "layers.1.engram.embed.scale" as NonEmptyStr],
-    resident: v41_candidate_partition.resident,
-  }, route: engram_route_b_identity, tp: 4, device: gb10_observed_compute_capability, max_jobs: 6))
-  w_key(s: a, which: "runtime") == w_key(s: reversed_wheels, which: "runtime")
-    && w_key(s: a, which: "candidate") == w_key(s: reversed_wheels, which: "candidate")
-    && w_key(s: a, which: "engram") == w_key(s: reordered_partition, which: "engram")
-}
-
-// A ROUTE REFERENCE IS MODULE, DECLARATION AND FIELD. A reference naming route B's declaration in another
-// module, or one field of it, is not route B; comparing only the declaration name admitted both.
-test fn a_route_reference_that_differs_in_module_or_field_is_not_the_admitted_route() -> Bool {
-  let foreign_module = DeclarationRef { module_path: "scratch.impostor" as NonEmptyStr, decl_name: engram_route_b_identity.decl_name, field: engram_route_b_identity.field }
-  let field_of_b = decl_field_ref(module_path: engram_route_b_identity.module_path as String, decl_name: engram_route_b_identity.decl_name as String, field_name: "origin")
-  w_refused_with(s: v41_candidate_standing(readback: w_readback_unread(), c: w_inputs(patches: w_two_patches(), partition: v41_candidate_partition, route: foreign_module, tp: 4, device: gb10_observed_compute_capability, max_jobs: 6)), fragment: "engram_route_b_host_nvme")
-    && w_refused_with(s: v41_candidate_standing(readback: w_readback_unread(), c: w_inputs(patches: w_two_patches(), partition: v41_candidate_partition, route: field_of_b, tp: 4, device: gb10_observed_compute_capability, max_jobs: 6)), fragment: "engram_route_b_host_nvme")
-}
-
-// A WHEEL FROM A NEIGHBOURING RELEASE CARRIES THE RIGHT PACKAGE NAME AND THE WRONG BYTES. The row is minted
-// by the FlashInfer authority itself, against a 0.7.0 acquisition, so it is a well-formed wheel -- just not
-// one this runtime's acquisition installs. Package-bag equality alone admits it; re-admission refuses it.
-fn w_foreign_release_wheel() -> List<FlashInferWheel> {
-  match admit_flashinfer_wheel(
-    acquisition: FlashInferPublishedRelease { version: "0.7.0" as NonEmptyStr, channel: FlashInferProjectStable, index: "fixture" as NonEmptyStr },
-    package: "flashinfer-python" as NonEmptyStr,
-    filename: "flashinfer_python-0.7.0-py3-none-any.whl" as NonEmptyStr,
-    sha256_hex: w_sha(c: "d").hex as String,
-  ) {
-    FlashInferWheelAdmitted { wheel: w } => [w]
-    FlashInferWheelRefused { refusal: _ } => [] as List<FlashInferWheel>
-  }
-}
-
-// THE SAME RELEASE, THE WRONG BUILD. flashinfer_jit_cache is published at one version across several CUDA
-// local labels and platforms, so a cu129 x86_64 row carries this runtime's exact release version and the
-// right package name. It is minted here by the FlashInfer authority against THIS runtime's own acquisition,
-// which is the whole point: it re-admits cleanly, the package bag is exact, and neither the population check
-// nor re-admission can see anything wrong with it. Only the build-target assertion refuses it, and without
-// that assertion this fixture keys a runtime whose image installs kernels a GB10 cannot load.
-// THE EIGHT PER-ARCHITECTURE PROVIDERS THE 0.7.x JIT-CACHE SHIM REQUIRES, in the shim's own order.
-fn w_provider_names() -> List<String> {
-  ["flashinfer-jit-cache-sm100a", "flashinfer-jit-cache-sm103a", "flashinfer-jit-cache-sm110a", "flashinfer-jit-cache-sm120f",
-   "flashinfer-jit-cache-sm121a", "flashinfer-jit-cache-sm80", "flashinfer-jit-cache-sm89", "flashinfer-jit-cache-sm90a"]
-}
-
-fn w_jit_cache_wheel(filename: String) -> List<FlashInferWheel> {
-  match admit_flashinfer_wheel(
-    acquisition: flashinfer_0_7_1rc1,
-    package: "flashinfer-jit-cache" as NonEmptyStr,
-    filename: filename as NonEmptyStr,
-    sha256_hex: w_sha(c: "e").hex as String,
-  ) {
-    FlashInferWheelAdmitted { wheel: w } => [w]
-    FlashInferWheelRefused { refusal: _ } => [] as List<FlashInferWheel>
-  }
-}
-
-fn w_with_jit_cache(filename: String) -> V41CandidateVerdict {
-  v41_candidate_standing(readback: w_readback_unread(), c: w_inputs_with_wheels(
-    patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_b_identity,
-    tp: 4, device: gb10_observed_compute_capability, max_jobs: 6,
-    wheels: concat(concat(w_wheels_named(names: ["flashinfer-python", "flashinfer-cubin"]), w_jit_cache_wheel(filename: filename)), w_wheels_named(names: w_provider_names())),
-  ))
-}
-
-// EACH ROW RE-ADMITS FIRST, WHICH IS WHAT THE THREE LENGTH CHECKS BELOW ESTABLISH. A fixture the
-// admission authority had rejected would be an empty wheel list, the population check would refuse it for
-// carrying no jit-cache wheel, and this test would pass without ever reaching the assertion it exists to
-// discriminate.
-test fn a_jit_cache_wheel_for_another_cuda_label_or_platform_refuses() -> Bool {
-  let wrong_platform = w_jit_cache_wheel(filename: "flashinfer_jit_cache-0.7.1rc1+cu130-cp39-abi3-manylinux_2_28_x86_64.whl")
-  let wrong_label = w_jit_cache_wheel(filename: "flashinfer_jit_cache-0.7.1rc1+cu129-cp39-abi3-manylinux_2_28_aarch64.whl")
-  let wrong_abi = w_jit_cache_wheel(filename: "flashinfer_jit_cache-0.7.1rc1+cu130-cp312-cp312-manylinux_2_28_aarch64.whl")
-  length(wrong_platform) == 1
-    && length(wrong_label) == 1
-    && length(wrong_abi) == 1
-    && w_refused_with(s: w_with_jit_cache(filename: "flashinfer_jit_cache-0.7.1rc1+cu130-cp39-abi3-manylinux_2_28_x86_64.whl"), fragment: "carries platform tag manylinux_2_28_x86_64")
-    && w_refused_with(s: w_with_jit_cache(filename: "flashinfer_jit_cache-0.7.1rc1+cu129-cp39-abi3-manylinux_2_28_aarch64.whl"), fragment: "carries version 0.7.1rc1+cu129")
-    && w_refused_with(s: w_with_jit_cache(filename: "flashinfer_jit_cache-0.7.1rc1+cu130-cp312-cp312-manylinux_2_28_aarch64.whl"), fragment: "carries python tag cp312")
-}
-
-// THE POSITIVE CONTROL FOR THE ASSERTION ABOVE. The published row is the exact target, so the same fixture
-// with the real wheel keys rather than refusing -- which is what makes the three refusals above evidence
-// about the build target rather than about this fixture being unkeyable.
-test fn the_published_jit_cache_wheel_is_this_runtimes_build_target() -> Bool {
-  w_key(s: w_with_jit_cache(filename: "flashinfer_jit_cache-0.7.1rc1+cu130-cp39-abi3-manylinux_2_28_aarch64.whl"), which: "candidate")
-    != "refused"
-    && w_key(s: w_with_jit_cache(filename: "flashinfer_jit_cache-0.7.1rc1+cu130-cp39-abi3-manylinux_2_28_aarch64.whl"), which: "candidate")
-    != "unestablished"
-}
-
-test fn a_wheel_from_a_neighbouring_release_refuses_even_with_the_right_package_names() -> Bool {
-  let foreign = w_foreign_release_wheel()
-  let swapped = concat(foreign, w_wheels_named(names: concat(["flashinfer-cubin", "flashinfer-jit-cache"], w_provider_names())))
-  length(foreign) == 1
-    && length(swapped) == 11
-    && w_refused_with(s: v41_candidate_standing(readback: w_readback_unread(), c: w_inputs_with_wheels(patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_b_identity, tp: 4, device: gb10_observed_compute_capability, max_jobs: 6, wheels: swapped)), fragment: "does not re-admit")
-}
-
-// THE SAME TWO NUMBERS FROM ANOTHER VENDOR IS ANOTHER MACHINE. A GpuComputeCapability is a vendor and two
-// numbers, and an AMD part reporting 12.1 satisfied a gate written for a GB10 and then received GB10's
-// execution-profile identity, because both the gate and the key read only the numbers. This fixture is the
-// GB10's capability with the vendor replaced and nothing else, so it discriminates the vendor alone.
-test fn a_capability_from_another_vendor_with_the_same_numbers_refuses() -> Bool {
-  let impostor = GpuComputeCapability {
-    vendor: amd,
-    major: gb10_observed_compute_capability.major,
-    minor: gb10_observed_compute_capability.minor,
-  }
-  impostor.major == gb10_observed_compute_capability.major
-    && impostor.minor == gb10_observed_compute_capability.minor
-    && w_refused_with(
-      s: v41_candidate_standing(readback: w_readback_unread(), c: w_inputs(patches: w_two_patches(), partition: v41_candidate_partition, route: engram_route_b_identity, tp: 4, device: impostor, max_jobs: 6)),
-      fragment: "is not the GB10")
-}
-
-// ONE UNPATCHED RUNTIME, ONE IDENTITY. An observed population with no patches in it carries the same
-// observed bytes as V41PatchesAbsentByObservation -- none -- and used to mint a different key, so the same
-// runtime had two identities depending on which arm the author reached for. The second half is the
-// unsatisfiable claim: no patch can fix a partition in bytes that do not exist.
-test fn an_empty_observed_patch_population_refuses_in_both_partition_authorities() -> Bool {
-  let empty_config = w_default(patches: V41PatchesObserved { patches: [] as List<V41EnginePatch>, partition: PartitionByLaunchConfiguration })
-  let empty_fixed = w_default(patches: V41PatchesObserved { patches: [] as List<V41EnginePatch>, partition: PartitionFixedByPatch })
-  w_refused_with(s: v41_candidate_standing(readback: w_readback_unread(), c: empty_config), fragment: "is not the same claim as V41PatchesAbsentByObservation")
-    && w_refused_with(s: v41_candidate_standing(readback: w_readback_unread(), c: empty_fixed), fragment: "no bytes for it to be fixed in")
-    && (w_key(s: v41_candidate_standing(readback: w_readback_unread(), c: w_default(patches: V41PatchesAbsentByObservation)), which: "runtime") != "refused")
-}
-
-test fn observed_patches_do_not_mint_a_patched_source_tree() -> Bool {
-  (match v41_patch_application_standing(source: vllm_d2d649e6_revision, patches: V41PatchesAbsentByObservation) {
-    V41VanillaSourceAtRevision { revision: r } => (r.full_revision as String) == (vllm_d2d649e6_revision.full_revision as String)
-    V41PatchApplicationUnestablished { obligation: _ } => false
-    V41PatchApplicationRefused { defects: _ } => false
-  })
-    && (match v41_patch_application_standing(source: vllm_d2d649e6_revision, patches: w_two_patches()) {
-      V41PatchApplicationUnestablished { obligation: o } => (o as String).contains("upsert_decision")
-      V41VanillaSourceAtRevision { revision: _ } => false
-      V41PatchApplicationRefused { defects: _ } => false
-    })
-    && (match v41_patch_application_standing(source: vllm_d2d649e6_revision, patches: V41PatchesObserved { patches: concat(w_patch(path: "engram_storage.patch", c: "1"), w_patch_against(path: "engram_prefetch.patch", c: "2", applies_to: vllm_deepseek_v4_1_sm12_revision)), partition: PartitionByLaunchConfiguration }) {
-      V41PatchApplicationRefused { defects: d } => any(d, x => (x as String).contains("07b75534"))
-      V41VanillaSourceAtRevision { revision: _ } => false
-      V41PatchApplicationUnestablished { obligation: _ } => false
-    })
-    && (match v41_storage_patch_application_standing() {
-      V41PatchApplicationUnestablished { obligation: o } => (o as String).contains("upsert_decision")
-      V41VanillaSourceAtRevision { revision: _ } => false
-      V41PatchApplicationRefused { defects: _ } => false
-    })
-}
diff --git a/dag/test/claim/spark/v41_runtime_image_build_witness_test.dag b/dag/test/claim/spark/v41_runtime_image_build_witness_test.dag
index e3ffbb1c130..298e233cad1 100644
--- a/dag/test/claim/spark/v41_runtime_image_build_witness_test.dag
+++ b/dag/test/claim/spark/v41_runtime_image_build_witness_test.dag
@@ -424,11 +424,7 @@ test fn every_published_image_observation_carries_its_instrument_and_date() -> B
 // half therefore runs over a SUPPLIED unplaced set: asserting admission against the live census would
 // need a host the fleet does not have.
 test fn the_admissible_build_hosts_exclude_the_claimed_serving_group() -> Bool {
-  !spark_host_is_unplaced(host: "srv5" as HostIdentity)
-    && !spark_host_is_unplaced(host: "srv6" as HostIdentity)
-    && !spark_host_is_unplaced(host: "srv7" as HostIdentity)
-    && !spark_host_is_unplaced(host: "srv8" as HostIdentity)
-    && !spark_host_is_unplaced(host: "srv9" as HostIdentity)
+  !spark_host_is_unplaced(host: "srv9" as HostIdentity)
     && !spark_host_is_unplaced(host: "srv10" as HostIdentity)
     && !spark_host_is_unplaced(host: "srv11" as HostIdentity)
     && !spark_host_is_unplaced(host: "srv12" as HostIdentity)
@@ -436,7 +432,7 @@ test fn the_admissible_build_hosts_exclude_the_claimed_serving_group() -> Bool {
       SparkHostAdmitted { host: h } => (h as String) == "srv10"
       SparkHostRefused { cause: _ } => false
     })
-    && (match admit_unplaced_host(raw: "srv5", purpose: vllm_build_host_purpose) {
+    && (match admit_unplaced_host(raw: "srv9", purpose: vllm_build_host_purpose) {
       SparkHostRefused { cause: why } => string_contains(s: why as String, pattern: "not admissible for")
       SparkHostAdmitted { host: _ } => false
     })
@@ -448,25 +444,33 @@ test fn the_admissible_build_hosts_exclude_the_claimed_serving_group() -> Bool {
 
 // THE REACHABILITY JOIN IS COMPARED AGAINST THE VENDOR LABEL, NOT THE FLEET IDENTITY, and the second
 // arm is what makes that load-bearing rather than incidental: a Spark answers `hostname -s` with
-// spark-a3ee and never with srv5, so a join written against the identity would call every host in the
+// spark-0c75 and never with srv9, so a join written against the identity would call every host in the
 // fleet a defect. This is the same label-versus-identity confusion that refused this lane's first
-// modelled leg, asserted here so it cannot come back as a green check.
+// modelled leg, asserted here so it cannot come back as a green check. Sold srv5 (spark-a3ee, decommissioned
+// 2026-10-07) has no lane any more, so its reading is unjoinable rather than answered.
 test fn the_reachability_join_reads_the_vendor_label_and_refuses_the_identity() -> Bool {
-  (match classify_reported_hostname(host: "srv5" as HostIdentity, endpoint: "192.168.1.226" as NonEmptyStr, reported: "spark-a3ee" as NonEmptyStr) {
-    SparkHostAnswered { host: _, endpoint: _, reported_hostname: n } => (n as String) == "spark-a3ee"
+  (match classify_reported_hostname(host: "srv9" as HostIdentity, endpoint: "192.168.1.236" as NonEmptyStr, reported: "spark-0c75" as NonEmptyStr) {
+    SparkHostAnswered { host: _, endpoint: _, reported_hostname: n } => (n as String) == "spark-0c75"
     SparkHostIdentityMismatch { host: _, endpoint: _, expected: _, reported: _ } => false
     SparkHostIdentityUnjoinable { host: _, endpoint: _, reported: _ } => false
     SparkHostUnreachable { host: _, endpoint: _, cause: _ } => false
     SparkHostUnresolved { host: _ } => false
   })
-    && (match classify_reported_hostname(host: "srv5" as HostIdentity, endpoint: "192.168.1.226" as NonEmptyStr, reported: "srv5" as NonEmptyStr) {
+    && (match classify_reported_hostname(host: "srv9" as HostIdentity, endpoint: "192.168.1.236" as NonEmptyStr, reported: "srv9" as NonEmptyStr) {
       SparkHostIdentityMismatch { host: _, endpoint: _, expected: want, reported: got } =>
-        (want as String) == "spark-a3ee" && (got as String) == "srv5"
+        (want as String) == "spark-0c75" && (got as String) == "srv9"
       SparkHostAnswered { host: _, endpoint: _, reported_hostname: _ } => false
       SparkHostIdentityUnjoinable { host: _, endpoint: _, reported: _ } => false
       SparkHostUnreachable { host: _, endpoint: _, cause: _ } => false
       SparkHostUnresolved { host: _ } => false
     })
+    && (match classify_reported_hostname(host: "srv5" as HostIdentity, endpoint: "192.168.1.226" as NonEmptyStr, reported: "spark-a3ee" as NonEmptyStr) {
+      SparkHostIdentityUnjoinable { host: _, endpoint: _, reported: _ } => true
+      SparkHostAnswered { host: _, endpoint: _, reported_hostname: _ } => false
+      SparkHostIdentityMismatch { host: _, endpoint: _, expected: _, reported: _ } => false
+      SparkHostUnreachable { host: _, endpoint: _, cause: _ } => false
+      SparkHostUnresolved { host: _ } => false
+    })
     && (match classify_reported_hostname(host: "srv1" as HostIdentity, endpoint: "srv1" as NonEmptyStr, reported: "srv1" as NonEmptyStr) {
       SparkHostIdentityUnjoinable { host: _, endpoint: _, reported: _ } => true
       SparkHostAnswered { host: _, endpoint: _, reported_hostname: _ } => false
@@ -480,8 +484,8 @@ test fn the_reachability_join_reads_the_vendor_label_and_refuses_the_identity()
 // An earlier revision returned success whenever the receipt file wrote, so the run in which every
 // admissible host refused the key exited zero with its diagnostics intact and discarded.
 test fn only_a_joined_answer_counts_as_reachable() -> Bool {
-  spark_host_answered(r: SparkHostAnswered { host: "srv5" as HostIdentity, endpoint: "e" as NonEmptyStr, reported_hostname: "spark-a3ee" as NonEmptyStr })
-    && !spark_host_answered(r: SparkHostIdentityMismatch { host: "srv5" as HostIdentity, endpoint: "e" as NonEmptyStr, expected: "spark-a3ee" as NonEmptyStr, reported: "other" as NonEmptyStr })
+  spark_host_answered(r: SparkHostAnswered { host: "srv9" as HostIdentity, endpoint: "e" as NonEmptyStr, reported_hostname: "spark-0c75" as NonEmptyStr })
+    && !spark_host_answered(r: SparkHostIdentityMismatch { host: "srv9" as HostIdentity, endpoint: "e" as NonEmptyStr, expected: "spark-0c75" as NonEmptyStr, reported: "other" as NonEmptyStr })
     && !spark_host_answered(r: SparkHostIdentityUnjoinable { host: "srv1" as HostIdentity, endpoint: "e" as NonEmptyStr, reported: "srv1" as NonEmptyStr })
     && !spark_host_answered(r: SparkHostUnreachable { host: "srv9" as HostIdentity, endpoint: "192.168.1.236" as NonEmptyStr, cause: "Permission denied (publickey,password)" })
     && !spark_host_answered(r: SparkHostUnresolved { host: "srv9" as HostIdentity })
diff --git a/dag/test/claim/spark/v41_runtime_image_produce_witness_test.dag b/dag/test/claim/spark/v41_runtime_image_produce_witness_test.dag
deleted file mode 100644
index d2338a1b2ab..00000000000
--- a/dag/test/claim/spark/v41_runtime_image_produce_witness_test.dag
+++ /dev/null
@@ -1,156 +0,0 @@
-module test.claim.spark.v41_runtime_image_produce_witness
-
-import std.types { Bool, String, List, NonEmptyStr }
-import extdeps.container.oci.digest { parse_oci_content_digest_wire }
-import extdeps.flashinfer.flashinfer { flashinfer_0_7_1rc1_wheels }
-import std.optional { Present, Absent }
-import gunbc.spark.v41_runtime_image_probe { V41ProbeRead, V41ProbeRefused }
-import gunbc.spark.v41_runtime_image_converge {
-  V41ProducedRuntime, V41KernelWheelsVerified, V41KernelWheelVerificationRefused,
-  V41RuntimeProductionStopped,
-  V41ProbeIdentityJoin, V41ProbeJoinedToProducedImage, V41ProbeDescribesAnotherImage,
-  V41ProbeIdentityUnreadable, V41ProbeIdentityNotRead,
-  v41_probe_identity_join, v41_probe_identity_holds, v41_probe_identity_line,
-  v41_wheel_verification_line, v41_production_receipt, v41_production_succeeded,
-  v41_wheel_verify_script,
-}
-
-// WHY THIS FILE EXISTS AT ALL, BEFORE ANY ASSERTION IN IT.
-//
-// gunbc.spark.v41_runtime_image_converge is a FLEET-CONVERGE MODE ENTRY, and a mode entry is reached
-// only by a dispatched `gunbc run`. Until this witness, no compiled closure in the corpus imported
-// it, so the compiler never resolved it -- and it did not resolve: as merged on #12008 it constructed
-// `SparkBuildHostWork`, a sole_constructor type owned by gunbc.spark.vllm_runtime_image_build, across
-// the module boundary. Every required lane was green, because a green lane over a corpus that never
-// compiles a module says nothing about that module (DESIGN section 5: a typecheck that never ran is
-// not a consumer). The error would have surfaced on dispatch day, on a host, at the start of a
-// three-hour build.
-//
-// SO THE IMPORT ABOVE IS THE LOAD-BEARING PART OF THIS FILE and the assertions below are what makes
-// it honest: a claim whose subject is the module's own refusal vocabulary, over the real production
-// folds, rather than a bare `import` with a `true`. The next such error is a red here.
-
-fn w_stopped(step: String, cause: String) -> V41ProducedRuntime {
-  V41RuntimeProductionStopped {
-    step: step as NonEmptyStr,
-    cause: cause,
-    wheels: V41KernelWheelVerificationRefused { step: "wheel-verify" as NonEmptyStr, cause: "sha256sum -c refused" },
-  }
-}
-
-// A STOPPED PRODUCTION NEVER REPORTS SUCCESS, AND ITS RECEIPT CARRIES WHY. The entry writes this
-// receipt and then reads `v41_production_succeeded` for its exit, so a stopped run that rendered a
-// receipt and returned true would be the fabricated-plausible-output failure at the exit code.
-test fn a_stopped_production_never_reports_success() -> Bool {
-  let p = w_stopped(step: "image-readback", cause: "the daemon answered sha256:zz for the produced image")
-  !v41_production_succeeded(p: p)
-    && v41_production_receipt(p: p).contains("production STOPPED step=image-readback")
-    && v41_production_receipt(p: p).contains("the daemon answered sha256:zz for the produced image")
-    && v41_production_receipt(p: p).contains("kernel wheels REFUSED step=wheel-verify")
-}
-
-// THE WHEEL VERIFICATION LINE DISCRIMINATES, rather than rendering the same sentence either way.
-test fn the_wheel_verification_line_says_which_way_it_went() -> Bool {
-  v41_wheel_verification_line(v: V41KernelWheelsVerified { verified: 3 }).contains("kernel wheels verified=3")
-    && !v41_wheel_verification_line(v: V41KernelWheelsVerified { verified: 3 }).contains("REFUSED")
-    && v41_wheel_verification_line(v: V41KernelWheelVerificationRefused { step: "fetch" as NonEmptyStr, cause: "curl exit 22" }).contains("kernel wheels REFUSED step=fetch cause=curl exit 22")
-}
-
-// THE VERIFY SCRIPT COMPARES EVERY WHEEL TO THE DIGEST THE CANDIDATE KEYS, and fetching without
-// comparing would establish nothing -- so the digest and the `sha256sum -c -` are asserted together.
-test fn every_fetched_wheel_is_compared_to_its_keyed_digest() -> Bool {
-  let s = v41_wheel_verify_script(wheels: flashinfer_0_7_1rc1_wheels)
-  s.contains("set -e\n")
-    && s.contains("17b7a2d47a153456f056f9f4d309ac13a0a7bfccbec852f562f120f36146edd9")
-    && s.contains("a900e973695798581d60d5297fee3c9bee8d1f1e6211303af7c0171481446a34")
-    && s.contains("https://github.com/flashinfer-ai/flashinfer/releases/download/v0.7.1rc1/flashinfer_jit_cache_sm121a-0.7.1rc1+cu130-cp39-abi3-manylinux_2_28_aarch64.whl")
-    && !s.contains("v0.6.18.post1")
-    && s.contains("| sha256sum -c -")
-}
-
-// WHERE THE ADMISSION ITSELF IS WITNESSED. The host relation this entry takes --
-// `admit_host_held_by_subject` against PairServingUnitOn FabricGroupA -- is gunbc.spark.host_commitment's
-// interface, not this module's, so its discriminating rows live at its home in
-// test.claim.spark.spark_host_commitment_witness: a Group A host admitted, srv1 and every Group B host
-// refused with the held list rendered, and an empty held population admitting nothing. Re-running them
-// here would assert nothing new and pay for all of it again (DESIGN section 3).
-
-// ── THE PROBE MUST DESCRIBE THE IMAGE THE STANDING KEYS ───────────────────────────────────────
-//
-// THE BREAK THESE ROWS CLOSE. #12008 handed the capability probe `identity.tag`. A tag is a mutable
-// pointer, so a concurrent build, pull or retag between the build leg and the probe leg re-resolves
-// it to different bytes -- and the entry would then exit ZERO on a receipt whose standing keys one
-// image and whose capability readings describe another, each half individually true. The route is
-// now digest-pinned AND the daemon's own answer is joined back to the produced digest.
-
-data w_produced_wire: String = "sha256:11119c6c8a0b4f6e21b2e0b6f0b6e4f30d5d8a1e5f4c3b2a190807060504030a"
-data w_other_wire: String = "sha256:2222abcdefabcdefabcdefabcdefabcdefabcdefabcdefabcdefabcdefabcdef"
-
-fn w_probe_read(observed: String) -> V41ProbeRead {
-  V41ProbeRead {
-    reference: w_produced_wire as NonEmptyStr,
-    observed_config_id: observed as NonEmptyStr,
-    stdout: "",
-    readings: [],
-  }
-}
-
-fn w_join(observed: String) -> V41ProbeIdentityJoin {
-  match parse_oci_content_digest_wire(raw: w_produced_wire) {
-    Absent => V41ProbeIdentityUnreadable { observed: "the fixture digest did not parse" as NonEmptyStr }
-    Present { value: produced } => v41_probe_identity_join(produced: produced, o: w_probe_read(observed: observed))
-  }
-}
-
-// THE DISCRIMINATING RED: THE TAG MOVED BETWEEN BUILD AND PROBE. The probe read an image whose
-// configuration digest is not the one this build produced, so the join REFUSES and names both
-// digests. Before this change the same run reported success.
-test fn a_probe_that_read_another_image_breaks_the_identity_and_is_named() -> Bool {
-  let j = w_join(observed: w_other_wire)
-  !v41_probe_identity_holds(j: j)
-    && (match j {
-          V41ProbeDescribesAnotherImage { produced: p, observed: obs } =>
-            (p as String) == w_produced_wire && (obs as String) == w_other_wire
-          V41ProbeJoinedToProducedImage { digest: _ } => false
-          V41ProbeIdentityUnreadable { observed: _ } => false
-          V41ProbeIdentityNotRead { step: _, cause: _ } => false
-        })
-    && v41_probe_identity_line(j: j).contains("probe identity BROKEN")
-    && v41_probe_identity_line(j: j).contains(w_produced_wire)
-    && v41_probe_identity_line(j: j).contains(w_other_wire)
-}
-
-// THE POSITIVE CONTROL, without which the row above would be satisfied by a join that refuses
-// everything: the same fold on the produced digest joins, and says so.
-test fn a_probe_of_the_produced_image_joins() -> Bool {
-  let j = w_join(observed: w_produced_wire)
-  v41_probe_identity_holds(j: j)
-    && v41_probe_identity_line(j: j).contains("probe identity JOINED to the produced image")
-}
-
-// AN UNPARSEABLE ANSWER IS ITS OWN REFUSAL, never silently unequal and never assumed equal: the
-// daemon said something, and what it said is not a digest.
-test fn an_unparseable_daemon_answer_refuses_as_unreadable() -> Bool {
-  let j = w_join(observed: "not-a-digest")
-  !v41_probe_identity_holds(j: j)
-    && (match j {
-          V41ProbeIdentityUnreadable { observed: obs } => (obs as String) == "not-a-digest"
-          V41ProbeJoinedToProducedImage { digest: _ } => false
-          V41ProbeDescribesAnotherImage { produced: _, observed: _ } => false
-          V41ProbeIdentityNotRead { step: _, cause: _ } => false
-        })
-    && v41_probe_identity_line(j: j).contains("probe identity UNREADABLE")
-}
-
-// A PROBE THAT NEVER READ JOINS NOTHING, and is reported as that rather than as a mismatch: there
-// is no observed identity to disagree with, which is a different fact from disagreeing.
-test fn a_refused_probe_joins_nothing_and_says_which_step() -> Bool {
-  let j = match parse_oci_content_digest_wire(raw: w_produced_wire) {
-    Absent => V41ProbeIdentityUnreadable { observed: "unreachable" as NonEmptyStr }
-    Present { value: produced } =>
-      v41_probe_identity_join(produced: produced, o: V41ProbeRefused { step: "image-config-id" as NonEmptyStr, cause: "No such image" })
-  }
-  !v41_probe_identity_holds(j: j)
-    && v41_probe_identity_line(j: j).contains("probe identity NOT READ")
-    && v41_probe_identity_line(j: j).contains("image-config-id")
-}
diff --git a/dag/test/claim/spark/v41_serving_load_witness_test.dag b/dag/test/claim/spark/v41_serving_load_witness_test.dag
deleted file mode 100644
index ba5cc0a792f..00000000000
--- a/dag/test/claim/spark/v41_serving_load_witness_test.dag
+++ /dev/null
@@ -1,130 +0,0 @@
-module test.claim.spark.v41_serving_load_witness
-
-import std.types { Bool, List, NonEmptyStr, String }
-import std.nat { Nat }
-import std.measure { microsecond, microsecond_count, millisecond, millisecond_count, token_count_value }
-import std.optional { Present, Absent }
-import product.host_identity { HostIdentity }
-import extdeps.vllm.bench_serve { VllmBenchServeRequest }
-import extdeps.linux.psi { PsiReading, PsiRead, PsiUnparseable }
-import extdeps.linux.diskstats { DiskstatsReading, DiskstatsDeviceRead, DiskstatsDeviceAbsent, DiskstatsUnparseable, DiskstatsRow }
-import gunbc.spark.serving_load_probe { ClientBenchLatencyUnread }
-import gunbc.spark.serving_load_runner { step_subject_mismatch }
-import gunbc.spark.v41_capacity_measurement { v41_staircase_concurrencies }
-import gunbc.spark.v41_serving_load {
-  V41RankPressure, V41RankPressureObserved, V41RankPressureUnread, V41StepPressure,
-  V41StepProjected, V41StepUnprojected, V41StepConcurrencyUnbound, v41_project_step, v41_project_for_request, v41_serving_load_step, v41_serving_load_steps,
-  v41_serving_load_subject, v41_serving_load_dataset, v41_device_of_findmnt,
-}
-
-fn rank(host: String, refault: Nat, psi_full: Nat, ticks: Nat) -> V41RankPressure {
-  V41RankPressure {
-    host: host as HostIdentity,
-    refault_file: refault,
-    psi: PsiRead { some_total: microsecond(count: psi_full), full_total: Present { value: microsecond(count: psi_full) } },
-    nvme: DiskstatsDeviceRead { row: DiskstatsRow { device: "nvme0n1p2" as NonEmptyStr, reads_completed: 100, sectors_read: 800, read_ticks: millisecond(count: ticks), in_flight: 0 } },
-  }
-}
-
-fn step(ranks: List<V41RankPressure>) -> V41StepPressure {
-  V41StepPressure { ranks: map(ranks, r => V41RankPressureObserved { pressure: r }) }
-}
-
-fn rank_after(host: String, refault: Nat, psi_full: Nat, ticks: Nat) -> V41RankPressure {
-  V41RankPressure {
-    host: host as HostIdentity,
-    refault_file: refault,
-    psi: PsiRead { some_total: microsecond(count: psi_full), full_total: Present { value: microsecond(count: psi_full) } },
-    nvme: DiskstatsDeviceRead { row: DiskstatsRow { device: "nvme0n1p2" as NonEmptyStr, reads_completed: 200, sectors_read: 1600, read_ticks: millisecond(count: ticks), in_flight: 0 } },
-  }
-}
-
-data metrics_before: String = join(["vllm:num_preemptions_total{", "model_name=\"v41\"} 3.0\n"], "")
-data metrics_after: String = join(["vllm:num_preemptions_total{", "model_name=\"v41\"} 3.0\n"], "")
-
-test fn each_stop_rule_reads_its_own_worst_rank() -> Bool {
-  let before = step([rank(host: "srv5", refault: 10, psi_full: 0, ticks: 0), rank(host: "srv6", refault: 10, psi_full: 0, ticks: 0), rank(host: "srv7", refault: 10, psi_full: 0, ticks: 0), rank(host: "srv8", refault: 10, psi_full: 0, ticks: 0)])
-  let after = step([rank_after(host: "srv5", refault: 20, psi_full: 900, ticks: 10), rank_after(host: "srv6", refault: 11, psi_full: 5, ticks: 10), rank_after(host: "srv7", refault: 510, psi_full: 5, ticks: 10), rank_after(host: "srv8", refault: 12, psi_full: 5, ticks: 400)])
-  match v41_project_step(run_id: "run-1" as NonEmptyStr, concurrency: 4, before: before, after: after, before_body: metrics_before, after_body: metrics_after, latency: ClientBenchLatencyUnread { cause: "fixture" as NonEmptyStr }) {
-    V41StepUnprojected { concurrency: _, causes: _ } => false
-    V41StepConcurrencyUnbound { cause: _ } => false
-    V41StepProjected { reading: r } =>
-      r.concurrency == 4
-        && r.refault_file_after == 510
-        && nvme_after_ticks(r: r.nvme_after) == 400
-        && (match r.preemptions { Present { value: p } => p == 0  Absent => false })
-        && psi_after_full(r: r.memory_pressure_after) == 900
-  }
-}
-
-fn nvme_after_ticks(r: DiskstatsReading) -> Nat {
-  match r {
-    DiskstatsDeviceRead { row: w } => millisecond_count(m: w.read_ticks)
-    DiskstatsDeviceAbsent { device: _ } => 0
-    DiskstatsUnparseable { device: _, line: _ } => 0
-  }
-}
-
-fn psi_after_full(r: PsiReading) -> Nat {
-  match r {
-    PsiRead { some_total: _, full_total: f } => match f { Present { value: m } => microsecond_count(m: m)  Absent => 0 }
-    PsiUnparseable { body: _, cause: _ } => 0
-  }
-}
-
-test fn an_unread_rank_unprojects_the_step_and_names_it() -> Bool {
-  let before = step([rank(host: "srv5", refault: 10, psi_full: 0, ticks: 0), rank(host: "srv6", refault: 10, psi_full: 0, ticks: 0), rank(host: "srv7", refault: 10, psi_full: 0, ticks: 0), rank(host: "srv8", refault: 10, psi_full: 0, ticks: 0)])
-  let after = V41StepPressure { ranks: [
-    V41RankPressureObserved { pressure: rank_after(host: "srv5", refault: 20, psi_full: 9, ticks: 10) },
-    V41RankPressureObserved { pressure: rank_after(host: "srv6", refault: 20, psi_full: 9, ticks: 10) },
-    V41RankPressureUnread { host: "srv7" as HostIdentity, cause: "cat /proc/diskstats unreachable" },
-    V41RankPressureObserved { pressure: rank_after(host: "srv8", refault: 20, psi_full: 9, ticks: 10) },
-  ] }
-  match v41_project_step(run_id: "run-1" as NonEmptyStr, concurrency: 4, before: before, after: after, before_body: metrics_before, after_body: metrics_after, latency: ClientBenchLatencyUnread { cause: "fixture" as NonEmptyStr }) {
-    V41StepProjected { reading: _ } => false
-    V41StepConcurrencyUnbound { cause: _ } => false
-    V41StepUnprojected { concurrency: c, causes: cs } => c == 4 && any(cs, x => contains(x, "after srv7: cat /proc/diskstats unreachable"))
-  }
-}
-
-test fn every_staircase_step_addresses_the_v41_subject() -> Bool {
-  let steps = v41_serving_load_steps()
-  length(steps) == length(v41_staircase_concurrencies)
-    && (match v41_serving_load_subject() {
-      Absent => false
-      Present { value: subj } => all(steps, s => match step_subject_mismatch(subject: subj, req: s) { Absent => true  Present { value: _ } => false })
-    })
-    && all(steps, s => match s.max_concurrency { Present { value: c } => s.num_prompts == 2 * c  Absent => false })
-}
-
-test fn the_protocol_row_is_glms_shape_declared_as_v41s_own() -> Bool {
-  token_count_value(t: v41_serving_load_dataset.input_len) == 256
-    && token_count_value(t: v41_serving_load_dataset.output_len) == 128
-    && token_count_value(t: v41_serving_load_dataset.prefix_len) == 0
-}
-
-test fn findmnt_source_names_the_diskstats_device() -> Bool {
-  (match v41_device_of_findmnt(stdout: "/dev/nvme0n1p2\n") { Present { value: d } => (d as String) == "nvme0n1p2"  Absent => false })
-    && (match v41_device_of_findmnt(stdout: "overlay\n") { Present { value: _ } => false  Absent => true })
-}
-
-test fn a_request_without_a_concurrency_refuses_instead_of_judging_level_zero() -> Bool {
-  let p = v41_serving_load_step(concurrency: 4)
-  let unbound = VllmBenchServeRequest {
-    backend: p.backend, base_url: p.base_url, model: p.model, tokenizer: p.tokenizer, dataset: p.dataset,
-    num_prompts: p.num_prompts, arrival: p.arrival, max_concurrency: none, ignore_eos: p.ignore_eos, seed: p.seed,
-  }
-  let ranks = step([rank(host: "srv5", refault: 10, psi_full: 0, ticks: 0), rank(host: "srv6", refault: 10, psi_full: 0, ticks: 0), rank(host: "srv7", refault: 10, psi_full: 0, ticks: 0), rank(host: "srv8", refault: 10, psi_full: 0, ticks: 0)])
-  let later = step([rank_after(host: "srv5", refault: 11, psi_full: 1, ticks: 1), rank_after(host: "srv6", refault: 11, psi_full: 1, ticks: 1), rank_after(host: "srv7", refault: 11, psi_full: 1, ticks: 1), rank_after(host: "srv8", refault: 11, psi_full: 1, ticks: 1)])
-  let refused = match v41_project_for_request(run_id: "run-1" as NonEmptyStr, req: unbound, before: ranks, after: later, before_body: metrics_before, after_body: metrics_after, latency: ClientBenchLatencyUnread { cause: "fixture" as NonEmptyStr }) {
-    V41StepConcurrencyUnbound { cause: why } => contains(why, "no max_concurrency")
-    V41StepProjected { reading: _ } => false
-    V41StepUnprojected { concurrency: _, causes: _ } => false
-  }
-  let bound = match v41_project_for_request(run_id: "run-1" as NonEmptyStr, req: p, before: ranks, after: later, before_body: metrics_before, after_body: metrics_after, latency: ClientBenchLatencyUnread { cause: "fixture" as NonEmptyStr }) {
-    V41StepProjected { reading: r } => r.concurrency == 4
-    V41StepConcurrencyUnbound { cause: _ } => false
-    V41StepUnprojected { concurrency: _, causes: _ } => false
-  }
-  refused && bound
-}
diff --git a/dag/test/claim/spark/v41_source_patch_converge_witness_test.dag b/dag/test/claim/spark/v41_source_patch_converge_witness_test.dag
deleted file mode 100644
index 5810c03e2b2..00000000000
--- a/dag/test/claim/spark/v41_source_patch_converge_witness_test.dag
+++ /dev/null
@@ -1,392 +0,0 @@
-module test.claim.spark.v41_source_patch_converge_witness
-
-import std.types { Bool, String, List, NonEmptyStr }
-import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
-import std.optional { Present, Absent }
-import std.upsert_decision { Noop, Apply, Refuse }
-import std.realization_reconcile { Applied, NotApplied, classify_reconciled, EffectConverged, EffectNotConverged }
-import std.content_hash { Sha256Digest, Sha256DigestHex }
-import extdeps.vllm.source_build { vllm_d2d649e6_revision }
-import gunbc.spark.v41_runtime_candidate { v41_engine_patch, V41EnginePatch, v41_storage_backed_patch_population, V41PatchesObserved, V41PatchesUnestablished, V41PatchesAbsentByObservation }
-import extdeps.git { git_apply_args, git_reset_hard_args }
-import extdeps.crypto.hash { sha256sum_line_digest, sha256sum_file_command, sha256sum_argv }
-import extdeps.exec.command { argv_words }
-import gunbc.spark.v41_source_patch_converge {
-  V41PatchMemberRead, V41SourceTreeRead, V41SourcePatchPlan, V41ObservedSourceIdentity,
-  V41PatchedSourceConverged, V41PatchedSourceRefused,
-  v41_source_patch_decision, v41_source_patch_reconcile, v41_sha256_of_bytes,
-  v41_patch_member_read, v41_source_tree_read, v41_source_patch_plan,
-  v41_observed_source_identity_of, v41_patched_source_receipt_line, v41_patched_source_converged,
-  v41_needs_content_ownership, v41_known_patch_sets, V41KnownPatchSet, V41KnownPatchMember,
-}
-
-data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
-
-fn w_sha(c: String) -> Sha256Digest {
-  Sha256Digest { hex: join([c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c, c], "") as Sha256DigestHex }
-}
-
-fn w_patch(path: String, c: String) -> List<V41EnginePatch> {
-  match v41_engine_patch(path: path as NonEmptyStr, applies_to: vllm_d2d649e6_revision, sha256_hex: w_sha(c: c).hex as String, purpose: "fixture" as NonEmptyStr) {
-    Present { value: p } => [p]
-    Absent => [] as List<V41EnginePatch>
-  }
-}
-
-fn w_member(path: String, c: String, reverse_applicable: Bool, forward_applicable: Bool) -> V41PatchMemberRead {
-  v41_patch_member_read(path: path as NonEmptyStr, observed_sha256: w_sha(c: c), reverse_applicable: reverse_applicable, forward_applicable: forward_applicable)
-}
-
-fn w_read(head: String, porcelain: String, members: List<V41PatchMemberRead>) -> V41SourceTreeRead {
-  v41_source_tree_read(head: head as NonEmptyStr, porcelain: porcelain, worktree_diff_sha256: w_sha(c: "d"), members: members, recorded_converged_diff_sha256: none, known_set_diff_sha256s: [] as List<Sha256Digest>)
-}
-
-fn w_read_recorded(porcelain: String, diff: String, recorded: String, members: List<V41PatchMemberRead>) -> V41SourceTreeRead {
-  v41_source_tree_read(
-    head: vllm_d2d649e6_revision.full_revision as NonEmptyStr,
-    porcelain: porcelain,
-    worktree_diff_sha256: w_sha(c: diff),
-    members: members,
-    recorded_converged_diff_sha256: Present { value: w_sha(c: recorded) },
-    known_set_diff_sha256s: [] as List<Sha256Digest>,
-  )
-}
-
-fn w_read_known(porcelain: String, diff: String, known: List<String>, members: List<V41PatchMemberRead>) -> V41SourceTreeRead {
-  v41_source_tree_read(
-    head: vllm_d2d649e6_revision.full_revision as NonEmptyStr,
-    porcelain: porcelain,
-    worktree_diff_sha256: w_sha(c: diff),
-    members: members,
-    recorded_converged_diff_sha256: none,
-    known_set_diff_sha256s: map(known, k => w_sha(c: k)),
-  )
-}
-
-// Patch set B = [b1, b2]; the tree carries set A, which this converge recorded (diff "a" == record
-// "a"). Neither B member applies forward (a new module already exists) nor reverses.
-fn w_is_b(obs: V41ObservedSourceIdentity) -> Bool {
-  (obs.worktree_diff_sha256.hex as String) == (w_sha(c: "b").hex as String)
-}
-
-fn w_set_b() -> List<V41EnginePatch> {
-  concat(w_patch(path: "b1.patch", c: "1"), w_patch(path: "b2.patch", c: "2"))
-}
-
-test fn red1_patch_set_b_onto_a_tree_this_converge_recorded_under_a_resets_then_applies_and_reads_back_b() -> Bool {
-  let on_a = w_read_recorded(
-    porcelain: "A  vllm/models/deepseek_v4_1/nvidia/engram_file_backed.py\nM  vllm/models/deepseek_v4_1/nvidia/engram.py",
-    diff: "a",
-    recorded: "a",
-    members: [w_member(path: "b1.patch", c: "1", reverse_applicable: false, forward_applicable: false), w_member(path: "b2.patch", c: "2", reverse_applicable: false, forward_applicable: false)],
-  )
-  let after_reset = w_read_recorded(
-    porcelain: "",
-    diff: "e",
-    recorded: "a",
-    members: [w_member(path: "b1.patch", c: "1", reverse_applicable: false, forward_applicable: true), w_member(path: "b2.patch", c: "2", reverse_applicable: false, forward_applicable: true)],
-  )
-  let on_b = w_read_recorded(
-    porcelain: "A  vllm/models/deepseek_v4_1/nvidia/engram_file_backed.py",
-    diff: "b",
-    recorded: "a",
-    members: [w_member(path: "b1.patch", c: "1", reverse_applicable: true, forward_applicable: false), w_member(path: "b2.patch", c: "2", reverse_applicable: true, forward_applicable: false)],
-  )
-  match v41_source_patch_decision(desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), read: on_a) {
-    Apply { plan: p } => p.reset_to_revision_first && length(p.patches) == 2
-    Noop => false
-    Refuse { reason: _ } => false
-  }
-    && match v41_source_patch_decision(desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), read: after_reset) {
-      Apply { plan: p } => !p.reset_to_revision_first
-      Noop => false
-      Refuse { reason: _ } => false
-    }
-    && match classify_reconciled(r: v41_source_patch_reconcile(
-      decision: Apply { plan: v41_source_patch_plan(patches: w_set_b()) }, application: Applied, desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), after: on_b,
-    )) {
-      EffectConverged { converged: conv } => w_is_b(obs: conv.evidence)
-      EffectNotConverged { reason: _, attempt: _ } => false
-    }
-}
-
-test fn red2_a_tree_with_an_edit_this_converge_did_not_record_refuses_rather_than_resetting() -> Bool {
-  let members = [w_member(path: "b1.patch", c: "1", reverse_applicable: false, forward_applicable: false), w_member(path: "b2.patch", c: "2", reverse_applicable: false, forward_applicable: false)]
-  let foreign = w_read_recorded(porcelain: " M vllm/engine/llm_engine.py", diff: "f", recorded: "a", members: members)
-  let unrecorded = w_read(head: vllm_d2d649e6_revision.full_revision as String, porcelain: " M vllm/engine/llm_engine.py", members: members)
-  let untracked = w_read_recorded(porcelain: "?? stray.py", diff: "a", recorded: "a", members: members)
-  match v41_source_patch_decision(desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), read: foreign) {
-    Refuse { reason: r } => (r as String).contains("not ours to reset")
-    Noop => false
-    Apply { plan: _ } => false
-  }
-    && match v41_source_patch_decision(desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), read: unrecorded) {
-      Refuse { reason: r } => (r as String).contains("not ours to reset")
-      Noop => false
-      Apply { plan: _ } => false
-    }
-    && match v41_source_patch_decision(desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), read: untracked) {
-      Refuse { reason: r } => (r as String).contains("untracked")
-      Noop => false
-      Apply { plan: _ } => false
-    }
-}
-
-test fn red3_the_same_set_twice_is_a_noop_even_though_the_record_matches() -> Bool {
-  let on_b = w_read_recorded(
-    porcelain: "A  vllm/models/deepseek_v4_1/nvidia/engram_file_backed.py",
-    diff: "b",
-    recorded: "b",
-    members: [w_member(path: "b1.patch", c: "1", reverse_applicable: true, forward_applicable: false), w_member(path: "b2.patch", c: "2", reverse_applicable: true, forward_applicable: false)],
-  )
-  match v41_source_patch_decision(desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), read: on_b) {
-    Noop => true
-    Apply { plan: _ } => false
-    Refuse { reason: _ } => false
-  }
-}
-
-// The srv8 case: arm A converged set A before the record existed. With no record, the tree's diff
-// digest ("a") equals the derived digest of pin + a declared historical set, so it is ours: reset,
-// then apply the current set. The same tree without that derivation still refuses, and a foreign
-// diff ("f") matches no known set and refuses.
-test fn red4_bootstrap_a_tree_carrying_an_older_declared_set_with_no_record_converges_by_content() -> Bool {
-  let members = [w_member(path: "b1.patch", c: "1", reverse_applicable: false, forward_applicable: false), w_member(path: "b2.patch", c: "2", reverse_applicable: false, forward_applicable: false)]
-  let on_a = w_read_known(porcelain: "A  vllm/models/deepseek_v4_1/nvidia/engram_file_backed.py", diff: "a", known: ["0", "a", "b"], members: members)
-  let underived = w_read_known(porcelain: "A  vllm/models/deepseek_v4_1/nvidia/engram_file_backed.py", diff: "a", known: [] as List<String>, members: members)
-  let foreign = w_read_known(porcelain: " M vllm/engine/llm_engine.py", diff: "f", known: ["0", "a", "b"], members: members)
-  match v41_source_patch_decision(desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), read: on_a) {
-    Apply { plan: p } => p.reset_to_revision_first
-    Noop => false
-    Refuse { reason: _ } => false
-  }
-    && v41_needs_content_ownership(desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), read: underived)
-    && !v41_needs_content_ownership(desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), read: on_a)
-    && !v41_needs_content_ownership(desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), read: w_read_known(porcelain: "?? stray.py", diff: "a", known: [] as List<String>, members: members))
-    && match v41_source_patch_decision(desired_revision: vllm_d2d649e6_revision, desired_patches: w_set_b(), read: foreign) {
-      Refuse { reason: r } => (r as String).contains("not ours to reset")
-      Noop => false
-      Apply { plan: _ } => false
-    }
-}
-
-test fn git_reset_hard_names_the_pin_not_head() -> Bool {
-  git_reset_hard_args(repository_dir: "/tmp/vllm", revision: vllm_d2d649e6_revision.full_revision as String)
-    == ["-C", "/tmp/vllm", "reset", "--hard", vllm_d2d649e6_revision.full_revision as String]
-}
-
-test fn a_clean_tree_at_r_with_forward_checks_is_apply() -> Bool {
-  let ps = concat(w_patch(path: "a.patch", c: "1"), w_patch(path: "b.patch", c: "2"))
-  match v41_source_patch_decision(
-    desired_revision: vllm_d2d649e6_revision,
-    desired_patches: ps,
-    read: w_read(
-      head: vllm_d2d649e6_revision.full_revision as String,
-      porcelain: "",
-      members: [w_member(path: "a.patch", c: "1", reverse_applicable: false, forward_applicable: true), w_member(path: "b.patch", c: "2", reverse_applicable: false, forward_applicable: true)],
-    ),
-  ) {
-    Apply { plan: p } => length(p.patches) == 2
-    Noop => false
-    Refuse { reason: _ } => false
-  }
-}
-
-test fn reverse_checks_without_forward_are_noop_by_observation() -> Bool {
-  let ps = concat(w_patch(path: "a.patch", c: "1"), w_patch(path: "b.patch", c: "2"))
-  match v41_source_patch_decision(
-    desired_revision: vllm_d2d649e6_revision,
-    desired_patches: ps,
-    read: w_read(
-      head: vllm_d2d649e6_revision.full_revision as String,
-      porcelain: " M vllm/models/deepseek_v4_1/nvidia/engram.py",
-      members: [w_member(path: "a.patch", c: "1", reverse_applicable: true, forward_applicable: false), w_member(path: "b.patch", c: "2", reverse_applicable: true, forward_applicable: false)],
-    ),
-  ) {
-    Noop => true
-    Apply { plan: _ } => false
-    Refuse { reason: _ } => false
-  }
-}
-
-test fn a_digest_mismatch_refuses() -> Bool {
-  let ps = w_patch(path: "a.patch", c: "1")
-  match v41_source_patch_decision(
-    desired_revision: vllm_d2d649e6_revision,
-    desired_patches: ps,
-    read: w_read(
-      head: vllm_d2d649e6_revision.full_revision as String,
-      porcelain: "",
-      members: [w_member(path: "a.patch", c: "9", reverse_applicable: false, forward_applicable: true)],
-    ),
-  ) {
-    Refuse { reason: r } => (r as String).contains("digest mismatch")
-    Noop => false
-    Apply { plan: _ } => false
-  }
-}
-
-test fn a_wrong_revision_refuses() -> Bool {
-  match v41_source_patch_decision(
-    desired_revision: vllm_d2d649e6_revision,
-    desired_patches: [] as List<V41EnginePatch>,
-    read: w_read(head: "deadbeef", porcelain: "", members: [] as List<V41PatchMemberRead>),
-  ) {
-    Refuse { reason: r } => (r as String).contains("wrong revision")
-    Noop => false
-    Apply { plan: _ } => false
-  }
-}
-
-test fn partial_application_refuses() -> Bool {
-  let ps = concat(w_patch(path: "a.patch", c: "1"), w_patch(path: "b.patch", c: "2"))
-  match v41_source_patch_decision(
-    desired_revision: vllm_d2d649e6_revision,
-    desired_patches: ps,
-    read: w_read(
-      head: vllm_d2d649e6_revision.full_revision as String,
-      porcelain: " M x",
-      members: [w_member(path: "a.patch", c: "1", reverse_applicable: true, forward_applicable: false), w_member(path: "b.patch", c: "2", reverse_applicable: false, forward_applicable: true)],
-    ),
-  ) {
-    Refuse { reason: r } => (r as String).contains("partial application")
-    Noop => false
-    Apply { plan: _ } => false
-  }
-}
-
-test fn noop_readback_grounds_and_apply_without_after_read_does_not() -> Bool {
-  let ps = w_patch(path: "a.patch", c: "1")
-  let already = w_read(
-    head: vllm_d2d649e6_revision.full_revision as String,
-    porcelain: " M engram.py",
-    members: [w_member(path: "a.patch", c: "1", reverse_applicable: true, forward_applicable: false)],
-  )
-  let clean = w_read(
-    head: vllm_d2d649e6_revision.full_revision as String,
-    porcelain: "",
-    members: [w_member(path: "a.patch", c: "1", reverse_applicable: false, forward_applicable: true)],
-  )
-  match classify_reconciled(r: v41_source_patch_reconcile(
-    decision: Noop, application: NotApplied, desired_revision: vllm_d2d649e6_revision, desired_patches: ps, after: already,
-  )) {
-    EffectConverged { converged: _ } => true
-    EffectNotConverged { reason: _, attempt: _ } => false
-  }
-    && match classify_reconciled(r: v41_source_patch_reconcile(
-      decision: Apply { plan: v41_source_patch_plan(patches: ps) }, application: Applied, desired_revision: vllm_d2d649e6_revision, desired_patches: ps, after: clean,
-    )) {
-      EffectNotConverged { reason: why, attempt: _ } => (why as String).contains("still wants Apply")
-      EffectConverged { converged: _ } => false
-    }
-}
-
-test fn digestfile_inhabits_the_committed_patch_population() -> Bool {
-  match v41_storage_backed_patch_population() {
-    V41PatchesObserved { patches: ps, partition: _ } =>
-      length(ps) == 7
-        && match get(xs: ps, index: 1) {
-          Absent => false
-          Present { value: p } => (p.purpose as String).contains("FileBackedParallelEngramEmbedding for every Engram layer")
-        }
-    V41PatchesAbsentByObservation => false
-    V41PatchesUnestablished { obligation: _ } => false
-  }
-}
-
-test fn empty_diff_has_a_real_digest() -> Bool {
-  match v41_sha256_of_bytes(content: "") {
-    Absent => false
-    Present { value: d } => (d.hex as String).length() == 64
-  }
-}
-
-test fn git_apply_updates_the_index_so_diff_head_covers_new_modules() -> Bool {
-  any(git_apply_args(repository_dir: "/tmp/vllm", patch_path: "engram_file_backed.py.patch"), a => a == "--index")
-}
-
-test fn the_placed_patch_digest_is_sha256sum_over_the_remote_path() -> Bool {
-  let path = "/tmp/declared-patches/engram_file_backed.py.patch"
-  argv_words(command: sha256sum_file_command(path: path)) == sha256sum_argv(path: path)
-}
-
-test fn a_sha256sum_line_mismatch_is_authorable_without_the_desired_hex() -> Bool {
-  match sha256sum_line_digest(line: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  a.patch") {
-    Absent => false
-    Present { value: a } =>
-      match sha256sum_line_digest(line: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb  a.patch") {
-        Absent => false
-        Present { value: b } => (a.hex as String) != (b.hex as String)
-      }
-  }
-}
-
-test fn an_untracked_new_module_refuses_rather_than_sharing_a_diff_head_identity() -> Bool {
-  let ps = w_patch(path: "engram_file_backed.py.patch", c: "1")
-  match v41_source_patch_decision(
-    desired_revision: vllm_d2d649e6_revision,
-    desired_patches: ps,
-    read: w_read(
-      head: vllm_d2d649e6_revision.full_revision as String,
-      porcelain: "?? vllm/models/deepseek_v4_1/nvidia/engram_file_backed.py",
-      members: [w_member(path: "engram_file_backed.py.patch", c: "1", reverse_applicable: true, forward_applicable: false)],
-    ),
-  ) {
-    Refuse { reason: r } => (r as String).contains("untracked")
-    Noop => false
-    Apply { plan: _ } => false
-  }
-}
-
-test fn patched_source_receipt_names_the_observed_tree_not_a_clean_vanilla_checkout() -> Bool {
-  let obs = v41_observed_source_identity_of(revision_head: "deadbeef" as NonEmptyStr, worktree_diff_sha256: w_sha(c: "d"))
-  let applied = v41_patched_source_receipt_line(c: V41PatchedSourceConverged { patches_already_on_tree: false, observed: obs })
-  let refused = v41_patched_source_receipt_line(c: V41PatchedSourceRefused { step: "patch-apply" as NonEmptyStr, cause: "git apply refused" })
-  applied.contains("patched source revision=deadbeef")
-    && applied.contains("patches_already_on_tree=false")
-    && applied.contains("worktree_diff_sha256=")
-    && !applied.contains("clean=true")
-    && !applied.contains("already_present=")
-    && refused.contains("patched source REFUSED")
-    && v41_patched_source_converged(c: V41PatchedSourceConverged { patches_already_on_tree: false, observed: obs })
-    && !v41_patched_source_converged(c: V41PatchedSourceRefused { step: "patch-apply" as NonEmptyStr, cause: "git apply refused" })
-}
-
-// srv8's arm A tree, refused as not ours (run 36326156975): the pin d2d649e6 with the set main
-// 77193e6a carried staged -- that set's bytes are last written by 034aef01 -- whose git diff
-// --binary HEAD is 0f979787aa2a52e0fb831221df84a3e259f2a2b773256c78812607f83b32b0dc (re-derived:
-// git apply --index of these two blobs onto a clean pin reproduces it). The history derivation
-// enumerated 034aef01 but read its blobs through git.Core.Show, whose stdout is trailing-trimmed;
-// engram_storage_backed.patch there ends in two blank context lines, the re-appended newline
-// left the hunk short, git apply refused it as corrupt and the set contributed no digest. The
-// two hex literals are the git blob contents at that commit (sha256 of git show 034aef01:<path>).
-data w_arm_a_revision: String = "034aef01ad1768c977bfef9d4e6848cb9ae05177"
-
-fn w_member_digest_is(m: V41KnownPatchMember, hex: String) -> Bool {
-  match v41_sha256_of_bytes(content: m.bytes) {
-    Absent => false
-    Present { value: d } => (d.hex as String) == hex
-  }
-}
-
-test fn red5_the_arm_a_set_srv8_carried_is_derived_byte_exactly_from_history() -> Bool {
-  let ps = concat(
-    w_patch(path: "dag/gunbc/spark/patches/d2d649e6/engram_file_backed.py.patch", c: "a"),
-    w_patch(path: "dag/gunbc/spark/patches/d2d649e6/engram_storage_backed.patch", c: "b"),
-  )
-  match get(xs: filter(v41_known_patch_sets(patches: ps), k => k.revision == w_arm_a_revision), index: 0) {
-    Absent => false
-    Present { value: k } =>
-      length(k.members) == 2
-        && match get(xs: k.members, index: 0) {
-          Absent => false
-          Present { value: overlay } => w_member_digest_is(m: overlay, hex: "7e18f751cde9fd03feada25f6720822463d4ab4e7125621e5f94c4da3c9a9151")
-        }
-        && match get(xs: k.members, index: 1) {
-          Absent => false
-          Present { value: hook } =>
-            hook.bytes.ends_with(suffix: "(__name__)\n \n \n")
-              && w_member_digest_is(m: hook, hex: "4a526ba9874b4045c73a43a8775c3cec54de2bcef4b6591543528af7f87da22b")
-        }
-  }
-}
diff --git a/dag/test/claim/spark/v41_store_readback_witness_test.dag b/dag/test/claim/spark/v41_store_readback_witness_test.dag
deleted file mode 100644
index 275e21fc204..00000000000
--- a/dag/test/claim/spark/v41_store_readback_witness_test.dag
+++ /dev/null
@@ -1,214 +0,0 @@
-module test.claim.spark.v41_store_readback_witness
-
-import std.types { Bool, String, List, NonEmptyStr, Int }
-import std.nat { Nat }
-import std.optional { Present, Absent }
-import extdeps.numeric.base16 { byte_hex_lower }
-import extdeps.safetensors.format { SafeF8E4M3, SafeF8E8M0 }
-import extdeps.vllm.engram_layout { VllmEngramRankRows }
-import gunbc.spark.v41_runtime_candidate { v41_candidate_partition }
-import extdeps.deepseek.deepseek_v4_1_flash { deepseek_v4_1_flash_engram, deepseek_v4_1_flash_engram_sharded_entries }
-import test.claim.vllm.vllm_engram_layout_witness { w_published_head_sizes }
-import gunbc.spark.v41_engram_row_store {
-  V41RowStoreEncodingSpec, v41_encoding_spec_of_layers, v41_layer_table, v41_row_geometry_of, v41_magic_octets,
-  V41ReadbackSample, V41SampleMagic, V41SampleStoreRecord, V41SampleSourceWeight, V41SampleSourceScale,
-  V41ReadbackReading, V41StoreReadbackRead, V41StoreReadback, V41StoreReadbackVerified, V41StoreReadbackUnread, V41StoreReadbackRefused,
-  v41_readback_samples, v41_store_readback,
-  V41StoreReadbackReadingsUnread, V41RowStoreSpecAdmitted, V41RowStoreSpecRefused, v41_row_store_spec, v41_published_store_readback_readings,
-}
-
-// ── THE BOUNDARY-STRATIFIED READBACK, AT FIXTURE SCALE ──────────────────────────────────────────
-//
-// Two layers of two ranks, three-byte records (two F8 weights, one F8 scale), ranks of unequal size so a
-// swap or a shift lands on different rows. The source bytes are a function of (layer, global row), so
-// every row is distinct unless a fixture makes two equal. The readings are SUPPLIED -- what a host that
-// produced the stores in a given (possibly wrong) way would print -- and the verdict is the fold's.
-
-fn w_spec() -> V41RowStoreEncodingSpec {
-  v41_encoding_spec_of_layers(
-    partition: v41_candidate_partition,
-    layers: [
-      v41_layer_table(layer: 1, weight: "layers.1.engram.embed.weight" as NonEmptyStr, scale: "layers.1.engram.embed.scale" as NonEmptyStr, rows: 5, ranks: [VllmEngramRankRows { rank: 0, start: 0, end: 3 }, VllmEngramRankRows { rank: 1, start: 3, end: 5 }]),
-      v41_layer_table(layer: 14, weight: "layers.14.engram.embed.weight" as NonEmptyStr, scale: "layers.14.engram.embed.scale" as NonEmptyStr, rows: 5, ranks: [VllmEngramRankRows { rank: 0, start: 0, end: 2 }, VllmEngramRankRows { rank: 1, start: 2, end: 5 }]),
-    ],
-    geometry: v41_row_geometry_of(weight_dtype: SafeF8E4M3, scale_dtype: SafeF8E8M0, weight_width: 2, scale_width: 1),
-  )
-}
-
-// HOW THE STORES WERE (MIS)PRODUCED.
-type WProduction
-  = WHonest
-  | WRanksSwapped
-  | WLayer14FromLayer1
-  | WRank1ShiftedByOne
-  | WBadMagic
-  | WSeamRowsIdentical
-
-fn w_rank_start(layer: Nat, rank: Nat) -> Int {
-  if layer == 1 { if rank == 0 { 0 } else { 3 } } else { if rank == 0 { 0 } else { 2 } }
-}
-
-// THE SOURCE: weight [layer, row + 10], scale [row + 50]; WSeamRowsIdentical makes layer 1's rows 2 and 3
-// (its rank seam) the same bytes.
-fn w_source_row(p: WProduction, layer: Nat, g: Int) -> Int {
-  match p { WSeamRowsIdentical => if layer == 1 && g == 3 { 2 } else { g }  _ => g }
-}
-
-fn w_weight(p: WProduction, layer: Nat, g: Int) -> List<Int> {
-  [layer, w_source_row(p: p, layer: layer, g: g) + 10]
-}
-
-fn w_scale(p: WProduction, layer: Nat, g: Int) -> List<Int> {
-  [w_source_row(p: p, layer: layer, g: g) + 50]
-}
-
-// WHICH (layer, global row) THE PRODUCER WROTE INTO (layer, rank) AT local row k.
-fn w_written_layer(p: WProduction, layer: Nat) -> Nat {
-  match p { WLayer14FromLayer1 => 1  _ => layer }
-}
-
-fn w_written_row(p: WProduction, layer: Nat, rank: Nat, k: Int) -> Int {
-  match p {
-    WRanksSwapped => if layer == 1 { w_rank_start(layer: layer, rank: 1 - rank) + k } else { w_rank_start(layer: layer, rank: rank) + k }
-    WRank1ShiftedByOne => if rank == 1 { w_rank_start(layer: layer, rank: rank) + k + 1 } else { w_rank_start(layer: layer, rank: rank) + k }
-    _ => w_rank_start(layer: layer, rank: rank) + k
-  }
-}
-
-fn w_hex(bytes: List<Int>) -> String {
-  join(map(bytes, b => byte_hex_lower(v: b)), "")
-}
-
-fn w_read(p: WProduction, s: V41ReadbackSample) -> V41ReadbackReading {
-  match s {
-    V41SampleMagic { layer: _, rank: _ } => V41ReadbackReading { sample: s, hex: match p { WBadMagic => "454e4752320a"  _ => w_hex(bytes: v41_magic_octets()) } }
-    V41SampleStoreRecord { layer: l, rank: r, local_row: k } => {
-      let wl = w_written_layer(p: p, layer: l)
-      let g = w_written_row(p: p, layer: l, rank: r, k: k)
-      V41ReadbackReading { sample: s, hex: w_hex(bytes: concat(w_weight(p: p, layer: wl, g: g), w_scale(p: p, layer: wl, g: g))) }
-    }
-    V41SampleSourceWeight { layer: l, global_row: g } => V41ReadbackReading { sample: s, hex: w_hex(bytes: w_weight(p: p, layer: l, g: g)) }
-    V41SampleSourceScale { layer: l, global_row: g } => V41ReadbackReading { sample: s, hex: w_hex(bytes: w_scale(p: p, layer: l, g: g)) }
-  }
-}
-
-fn w_readback(p: WProduction) -> V41StoreReadback {
-  v41_store_readback(spec: w_spec(), readings: V41StoreReadbackRead {
-    host: "fixture" as NonEmptyStr, observed_at: "fixture" as NonEmptyStr,
-    readings: map(v41_readback_samples(spec: w_spec()), s => w_read(p: p, s: s)),
-  })
-}
-
-fn w_refused_naming(v: V41StoreReadback, fragment: String) -> Bool {
-  match v {
-    V41StoreReadbackRefused { defects: d } => any(d, x => (x as String).contains(fragment))
-    _ => false
-  }
-}
-
-// THE SAMPLE IS THE SEAMS: per store its magic, its first and its last record, and the source rows at the
-// same global rows -- which, over a layer, are row 0, the last row and both sides of every rank boundary.
-test fn the_sample_is_every_store_edge_and_both_sides_of_every_seam() -> Bool {
-  let keys = map(v41_readback_samples(spec: w_spec()), s => match s {
-    V41SampleSourceWeight { layer: l, global_row: g } => join([to_string(l), ":", to_string(g)], "")
-    _ => ""
-  })
-  let rows = filter(keys, k => k != "")
-  length(v41_readback_samples(spec: w_spec())) == 4 + 4 * 2 * 3
-    && rows == ["1:0", "1:2", "1:3", "1:4", "14:0", "14:1", "14:2", "14:4"]
-}
-
-test fn honestly_produced_stores_verify() -> Bool {
-  match w_readback(p: WHonest) {
-    V41StoreReadbackVerified { host: _, observed_at: _, samples: n } => n == 28
-    _ => false
-  }
-}
-
-// THE RED THE PARENT NAMED: two ranks' plans swapped. Rank 0's store holds rank 1's rows and vice versa;
-// every digest and size would still be self-consistent, and the readback refuses at the seam.
-test fn two_ranks_swapped_plans_refuse() -> Bool {
-  w_refused_naming(v: w_readback(p: WRanksSwapped), fragment: "store layer.1.rank.0 row 0 (global row 0): the stored record is not v41_place_row")
-    && w_refused_naming(v: w_readback(p: WRanksSwapped), fragment: "store layer.1.rank.1 row 0 (global row 3)")
-}
-
-test fn layer_14_encoded_from_layer_1_offsets_refuses() -> Bool {
-  w_refused_naming(v: w_readback(p: WLayer14FromLayer1), fragment: "store layer.14.rank.0 row 0")
-}
-
-test fn an_off_by_one_rank_boundary_refuses() -> Bool {
-  w_refused_naming(v: w_readback(p: WRank1ShiftedByOne), fragment: "store layer.1.rank.1 row 0 (global row 3)")
-    && !w_refused_naming(v: w_readback(p: WRank1ShiftedByOne), fragment: "store layer.1.rank.0")
-}
-
-test fn a_wrong_header_refuses() -> Bool {
-  w_refused_naming(v: w_readback(p: WBadMagic), fragment: "store layer.1.rank.0: the header is not the row-store magic")
-}
-
-// A SHIFT THAT CANNOT BE SEEN MUST REFUSE, NOT PASS: the stores are honest, but rows 2 and 3 of layer 1
-// are the same bytes, so the seam between its ranks is undiscriminating and the readback refuses there.
-test fn identical_rows_across_a_seam_refuse_as_undiscriminating() -> Bool {
-  w_refused_naming(v: w_readback(p: WSeamRowsIdentical), fragment: "layer 1 rows 2 and 3 (the rank 1 boundary) are byte-identical")
-}
-
-test fn a_missing_or_foreign_reading_refuses_by_identity() -> Bool {
-  let all = map(v41_readback_samples(spec: w_spec()), s => w_read(p: WHonest, s: s))
-  let missing = v41_store_readback(spec: w_spec(), readings: V41StoreReadbackRead { host: "f" as NonEmptyStr, observed_at: "f" as NonEmptyStr, readings: filter(all, r => match r.sample { V41SampleMagic { layer: l, rank: k } => !(l == 14 && k == 1)  _ => true }) })
-  let foreign = v41_store_readback(spec: w_spec(), readings: V41StoreReadbackRead { host: "f" as NonEmptyStr, observed_at: "f" as NonEmptyStr, readings: concat(all, [w_read(p: WHonest, s: V41SampleStoreRecord { layer: 1, rank: 0, local_row: 1 })]) })
-  w_refused_naming(v: missing, fragment: "owes magic layer.14.rank.1")
-    && w_refused_naming(v: foreign, fragment: "record layer.1.rank.0 row 1 is not a sample the spec owes")
-}
-
-// THE LIVE READBACK VERIFIES, ONE STORE PER CLAIM: srv5's eight stores, read at every seam by fleet-converge
-// run 36126002186 (gunbc.spark.v41_engram_row_store v41_published_store_readback_readings), are
-// v41_place_row of the published rows at every sampled row, and no seam is undiscriminating. The spec is the
-// live one over SUPPLIED head sizes (test.claim.vllm.vllm_engram_layout_witness w_published_head_sizes, whose
-// own claims draw them from the real prime search), so these claims pay for the readback and not for the
-// layout search; the whole-spec route runs for real in gunbc.spark.v41_runtime_candidate v41_live_store_readback,
-// which the D0 live-subject claim executes. One store per claim because decoding a store's seven samples
-// is the claim's cost, and a layer per claim exceeded the new-witness budget (v2.workflow.required_floor
-// claim_eval_step_budget_for_identity, as the floor's measured_eval_steps reports it). A store's slice is its own rank's range, so it cannot see the row before its start: the
-// undiscriminating-seam guard is NOT exercised here. It runs over the whole live spec in
-// v41_live_store_readback (executed for real by the D0 live-subject claim), and its discriminating RED is
-// identical_rows_across_a_seam_refuse_as_undiscriminating above.
-fn w_live_store_readback(layer: Nat, rank: Nat) -> V41StoreReadback {
-  match v41_row_store_spec(population: map(deepseek_v4_1_flash_engram_sharded_entries, e => e.entry), partition: v41_candidate_partition, tables: deepseek_v4_1_flash_engram, head_sizes: w_published_head_sizes()) {
-    V41RowStoreSpecRefused { defects: d } => V41StoreReadbackRefused { defects: d }
-    V41RowStoreSpecAdmitted { spec: spec } => match v41_published_store_readback_readings {
-      V41StoreReadbackReadingsUnread { obligation: o } => V41StoreReadbackUnread { obligation: o }
-      V41StoreReadbackRead { host: h, observed_at: at, readings: rs } =>
-        v41_store_readback(
-          spec: v41_encoding_spec_of_layers(partition: v41_candidate_partition, layers: map(filter(spec.layers, t => t.layer == layer), t => v41_layer_table(layer: t.layer, weight: t.weight, scale: t.scale, rows: t.rows, ranks: filter(t.ranks, r => r.rank == rank))), geometry: spec.geometry),
-          readings: V41StoreReadbackRead { host: h, observed_at: at, readings: filter(rs, r => w_sample_in_store(s: r.sample, layer: layer, spec: spec, rank: rank)) },
-        )
-    }
-  }
-}
-
-// A SAMPLE BELONGS TO A STORE'S SLICE when it is that store's magic or record, or a source row inside the
-// rank's range.
-fn w_sample_in_store(s: V41ReadbackSample, layer: Nat, spec: V41RowStoreEncodingSpec, rank: Nat) -> Bool {
-  let ranges = flat_map(filter(spec.layers, t => t.layer == layer), t => filter(t.ranks, r => r.rank == rank))
-  match s {
-    V41SampleMagic { layer: l, rank: k } => l == layer && k == rank
-    V41SampleStoreRecord { layer: l, rank: k, local_row: _ } => l == layer && k == rank
-    V41SampleSourceWeight { layer: l, global_row: g } => l == layer && any(ranges, r => r.start <= g && g < r.end)
-    V41SampleSourceScale { layer: l, global_row: g } => l == layer && any(ranges, r => r.start <= g && g < r.end)
-  }
-}
-
-fn w_store_verified(layer: Nat, rank: Nat) -> Bool {
-  match w_live_store_readback(layer: layer, rank: rank) {
-    V41StoreReadbackVerified { host: h, observed_at: _, samples: n } => (h as String) == "srv5" && n == 7
-    _ => false
-  }
-}
-
-test fn the_live_readback_of_layer_1_rank_0_verifies() -> Bool { w_store_verified(layer: 1, rank: 0) }
-test fn the_live_readback_of_layer_1_rank_1_verifies() -> Bool { w_store_verified(layer: 1, rank: 1) }
-test fn the_live_readback_of_layer_1_rank_2_verifies() -> Bool { w_store_verified(layer: 1, rank: 2) }
-test fn the_live_readback_of_layer_1_rank_3_verifies() -> Bool { w_store_verified(layer: 1, rank: 3) }
-test fn the_live_readback_of_layer_14_rank_0_verifies() -> Bool { w_store_verified(layer: 14, rank: 0) }
-test fn the_live_readback_of_layer_14_rank_1_verifies() -> Bool { w_store_verified(layer: 14, rank: 1) }
-test fn the_live_readback_of_layer_14_rank_2_verifies() -> Bool { w_store_verified(layer: 14, rank: 2) }
-test fn the_live_readback_of_layer_14_rank_3_verifies() -> Bool { w_store_verified(layer: 14, rank: 3) }
diff --git a/dag/test/claim/spark/vllm_allocation_plan_observe_witness_test.dag b/dag/test/claim/spark/vllm_allocation_plan_observe_witness_test.dag
index 4efcb6eeb7e..2d9ab8b8ea1 100644
--- a/dag/test/claim/spark/vllm_allocation_plan_observe_witness_test.dag
+++ b/dag/test/claim/spark/vllm_allocation_plan_observe_witness_test.dag
@@ -9,7 +9,7 @@ import std.measure {
   allocator_block_count_value,
   byte_size_count,
 }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import gunbc.spark.pair_serving_desired { spark_pair_serving_head }
 import gunbc.spark.vllm_serving_launch { VllmServingLaunch, vllm_serving_launch }
 import extdeps.vllm.server { vllm_source_revision_read }
@@ -71,8 +71,8 @@ fn w_digest(hex: String) -> ContentHash {
 
 fn w_launch() -> VllmServingLaunch {
   vllm_serving_launch(
-    group: FabricGroupA,
-    head: spark_pair_serving_head(group: FabricGroupA),
+    group: FabricGroupB {},
+    head: spark_pair_serving_head(group: FabricGroupB {}),
     systemd_invocation: "glm-plan-fixture-launch" as NonEmptyStr,
     container_id: "glm-native-tp4" as NonEmptyStr,
     executable_digest: w_digest(hex: "1111111111111111111111111111111111111111111111111111111111111111"),
@@ -538,8 +538,8 @@ fn w_real_reported(hundredths: Nat) -> VllmReportedCapacity? {
 
 fn w_real_launch() -> VllmServingLaunch {
   vllm_serving_launch(
-    group: FabricGroupB,
-    head: spark_pair_serving_head(group: FabricGroupB),
+    group: FabricGroupB {},
+    head: spark_pair_serving_head(group: FabricGroupB {}),
     systemd_invocation: "glm-bounded-experiment-262k-fixture-launch" as NonEmptyStr,
     container_id: "glm-native-tp4" as NonEmptyStr,
     executable_digest: w_digest(hex: "1111111111111111111111111111111111111111111111111111111111111111"),
diff --git a/dag/test/claim/spark/vllm_image_distribution_witness_test.dag b/dag/test/claim/spark/vllm_image_distribution_witness_test.dag
index 6000a2fe701..3f7a208cc9a 100644
--- a/dag/test/claim/spark/vllm_image_distribution_witness_test.dag
+++ b/dag/test/claim/spark/vllm_image_distribution_witness_test.dag
@@ -14,7 +14,6 @@ import gunbc.spark.vllm_runtime_image_build {
   VllmImageDistributed, VllmImageDistributionRefused, VllmImageHostDelivered, VllmImageHostDeliveryRefused,
   vllm_image_distribution_succeeded,
 }
-import gunbc.spark.v41_runtime_image_converge { v41_arm_a_produced_image, v41_production_produced_image, v41_produced_image_subject }
 
 // ── THE DISTRIBUTION'S DECISIONS, OVER SUPPLIED DAEMON ANSWERS ────────────────────────────────
 //
@@ -115,24 +114,3 @@ test fn distribution_succeeds_only_over_a_nonempty_all_delivered_set() -> Bool {
     && !vllm_image_distribution_succeeded(dist: VllmImageDistributionRefused { step: "distribute-save" as NonEmptyStr, cause: "x" })
 }
 
-// THE ARM A RECEIPT ROW RE-DERIVES THE TAG ITS PRODUCTION PRINTED. fleet-converge run 36207135528
-// printed tag=gunbc-vllm-dsv41-gb10:d73e307009a5d716 for this source tree; the row carries only the
-// tree, and the tag comes out of the candidate's recipe through the build's own key fold. A row
-// whose tree, or a recipe that has moved since, no longer derives that tag goes red here.
-test fn the_arm_a_receipt_derives_its_printed_tag_and_carries_its_digest() -> Bool {
-  let s = v41_produced_image_subject(p: v41_arm_a_produced_image)
-  (s.tag as String) == "gunbc-vllm-dsv41-gb10:d73e307009a5d716"
-    && render_oci_content_digest_wire(d: s.config) == join(["sha256:", subject_hex], "")
-    && (v41_arm_a_produced_image.held_on as String) == "srv8"
-}
-
-// THE PRODUCTION RECEIPT ROW RE-DERIVES ITS PRINTED TAG. fleet-converge run 36327364664 printed
-// tag=gunbc-vllm-dsv41-gb10:3cedb66f0ec0869e for its source tree (the design-B cutover's patch set); the
-// row carries only that tree, and the tag comes out of the build's own key fold. This is the image the
-// distribution mode moves.
-test fn the_production_receipt_derives_its_printed_tag_and_carries_its_digest() -> Bool {
-  let s = v41_produced_image_subject(p: v41_production_produced_image)
-  (s.tag as String) == "gunbc-vllm-dsv41-gb10:3cedb66f0ec0869e"
-    && render_oci_content_digest_wire(d: s.config) == "sha256:5de3c35577e5c8f3026c143d3d5b2d66cc527119281369f4651d969f581829d3"
-    && (v41_production_produced_image.held_on as String) == "srv8"
-}
diff --git a/dag/test/claim/spark/vllm_kv_layout_receipt_witness_test.dag b/dag/test/claim/spark/vllm_kv_layout_receipt_witness_test.dag
index e34fecbbb2b..411e188dea8 100644
--- a/dag/test/claim/spark/vllm_kv_layout_receipt_witness_test.dag
+++ b/dag/test/claim/spark/vllm_kv_layout_receipt_witness_test.dag
@@ -1,5 +1,6 @@
 module test.claim.spark.vllm_kv_layout_receipt_witness
 
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import std.types { Bool, String, Int, NonEmptyStr, List, EpochSecs }
 import std.optional { Present, Absent }
 import std.nat { Nat }
@@ -10,7 +11,6 @@ import std.measure {
   attention_layer_count,
   ByteSize, byte_size,
 }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
 import gunbc.spark.pair_serving_desired { spark_pair_serving_head }
 import gunbc.spark.vllm_serving_launch { VllmServingLaunch, vllm_serving_launch }
 import extdeps.vllm.server { VllmSourceRevision, vllm_source_revision, vllm_source_revision_read }
@@ -53,8 +53,8 @@ fn w_fork_revision() -> VllmSourceRevision {
 
 fn w_launch_id(invocation: String) -> VllmServingLaunch {
   vllm_serving_launch(
-    group: FabricGroupA,
-    head: spark_pair_serving_head(group: FabricGroupA),
+    group: FabricGroupB {},
+    head: spark_pair_serving_head(group: FabricGroupB {}),
     systemd_invocation: invocation as NonEmptyStr,
     container_id: "gunbc-spark-pair" as NonEmptyStr,
     executable_digest: w_digest(hex: w_exe),
diff --git a/dag/test/claim/spark/vllm_serving_launch_witness_test.dag b/dag/test/claim/spark/vllm_serving_launch_witness_test.dag
index 882f2d6c81b..734be4215cc 100644
--- a/dag/test/claim/spark/vllm_serving_launch_witness_test.dag
+++ b/dag/test/claim/spark/vllm_serving_launch_witness_test.dag
@@ -2,9 +2,9 @@ module test.claim.spark.vllm_serving_launch_witness
 
 import std.types { Bool, String, NonEmptyStr, EpochSecs }
 import std.content_hash { ContentHash, Sha256Hash, Sha1Hash, Sha256Digest, Sha1Digest, Sha256DigestHex, Sha1DigestHex }
-import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB }
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import gunbc.spark.pair_serving_desired { spark_pair_serving_head }
-import gunbc.fleet_host_identity { operator_host_srv9 }
+import gunbc.fleet_host_identity { operator_host_srv10 }
 import gunbc.spark.vllm_serving_launch {
   VllmServingLaunch, vllm_serving_launch,
   LaunchJoin, SameLaunch, DifferentLaunch, LaunchContradiction,
@@ -23,13 +23,13 @@ data w_exe_a: String = "11111111111111111111111111111111111111111111111111111111
 data w_exe_b: String = "2222222222222222222222222222222222222222222222222222222222222222"
 data w_unit: String = "3333333333333333333333333333333333333333333333333333333333333333"
 
-// The three launches the group A head actually produced on 2026-09-05 differ only by invocation:
+// The three launches the (since-decommissioned) group A head actually produced on 2026-09-05 differ only by invocation:
 // one rendered unit, one image, three engine cores with different KV. That is the shape this
 // witness fixtures.
 fn w_launch(invocation: String, container: String, exe: String, started: EpochSecs) -> VllmServingLaunch {
   vllm_serving_launch(
-    group: FabricGroupA,
-    head: spark_pair_serving_head(group: FabricGroupA),
+    group: FabricGroupB {},
+    head: spark_pair_serving_head(group: FabricGroupB {}),
     systemd_invocation: invocation as NonEmptyStr,
     container_id: container as NonEmptyStr,
     executable_digest: w_sha256(hex: exe),
@@ -62,29 +62,16 @@ test fn two_launches_of_one_unit_are_not_one_incarnation() -> Bool {
 // other about one launch, and it gets its own arm so it cannot be actioned as a restart.
 test fn one_invocation_with_a_disagreeing_field_is_a_contradiction_not_turnover() -> Bool {
   let rebuilt = w_launch(invocation: "inv-16-36", container: "gunbc-spark-pair", exe: w_exe_b, started: 1788000000)
-  let moved = vllm_serving_launch(
-    group: FabricGroupB,
-    head: spark_pair_serving_head(group: FabricGroupA),
-    systemd_invocation: "inv-16-36" as NonEmptyStr,
-    container_id: "gunbc-spark-pair" as NonEmptyStr,
-    executable_digest: w_sha256(hex: w_exe_a),
-    unit_digest: w_sha256(hex: w_unit),
-    started_at: 1788000000,
-  )
   (match same_launch(a: w_first(), b: rebuilt) {
      LaunchContradiction { invocation: i, field: f } => (i as String) == "inv-16-36" && (f as String) == "executable_digest"
      _ => false
    })
-    && (match same_launch(a: w_first(), b: moved) {
-          LaunchContradiction { invocation: _, field: f } => (f as String) == "group"
-          _ => false
-        })
     && !join_is_admissible(j: same_launch(a: w_first(), b: rebuilt))
     && (match same_launch(
           a: w_first(),
           b: vllm_serving_launch(
-            group: FabricGroupA,
-            head: operator_host_srv9,
+            group: FabricGroupB {},
+            head: operator_host_srv10,
             systemd_invocation: "inv-16-36" as NonEmptyStr,
             container_id: "gunbc-spark-pair" as NonEmptyStr,
             executable_digest: w_sha256(hex: w_exe_a),
@@ -104,8 +91,8 @@ test fn one_invocation_with_a_disagreeing_field_is_a_contradiction_not_turnover(
 // legible rather than reading as a rebuild.
 test fn cross_family_digests_refuse_as_incomparable_rather_than_reading_as_a_rebuild() -> Bool {
   let other_family = vllm_serving_launch(
-    group: FabricGroupA,
-    head: spark_pair_serving_head(group: FabricGroupA),
+    group: FabricGroupB {},
+    head: spark_pair_serving_head(group: FabricGroupB {}),
     systemd_invocation: "inv-16-36" as NonEmptyStr,
     container_id: "gunbc-spark-pair" as NonEmptyStr,
     executable_digest: w_sha1(hex: "4444444444444444444444444444444444444444"),
diff --git a/dag/test/claim/srv3/srv3_install_media_fetch_witness_test.dag b/dag/test/claim/srv3/srv3_install_media_fetch_witness_test.dag
index bd6e7074dda..db9dcdc7294 100644
--- a/dag/test/claim/srv3/srv3_install_media_fetch_witness_test.dag
+++ b/dag/test/claim/srv3/srv3_install_media_fetch_witness_test.dag
@@ -51,8 +51,14 @@ test fn install_media_fetch_absent_plans_mirror_order() -> Bool {
     FetchRequired { install_path: p, mirror_order: mirrors } =>
       p == srv3_ubuntu_install_media_install_path
         && mirrors == ubuntu_install_media_mirror_rows
-        && mirrors.first().host == ReleasesUbuntuCom
-        && mirrors.skip(n: 1).first().host == CdimageUbuntuCom
+        && (match mirrors.first() {
+            Present { value: v } => v.host == ReleasesUbuntuCom
+            Absent => false
+          })
+        && (match mirrors.skip(n: 1).first() {
+            Present { value: v } => v.host == CdimageUbuntuCom
+            Absent => false
+          })
     _ => false
   }
 }
diff --git a/dag/test/claim/srv3/srv3_seeded_install_media_real_execution_witness_test.dag b/dag/test/claim/srv3/srv3_seeded_install_media_real_execution_witness_test.dag
index c04a8b68a90..ee0b9b91ef0 100644
--- a/dag/test/claim/srv3/srv3_seeded_install_media_real_execution_witness_test.dag
+++ b/dag/test/claim/srv3/srv3_seeded_install_media_real_execution_witness_test.dag
@@ -1,8 +1,12 @@
 module test.claim.srv3_seeded_install_media_real_execution
 
 import std.logic { Bool }
-import std.types { String, NonEmptyStr }
-import gunbc.srv3_seeded_install_media_artifact { srv3_seeded_grub_kernel_cmdline }
+import std.types { List, String, NonEmptyStr }
+import extdeps.crypto.hash { sha256_digest }
+import gunbc.srv3_seeded_install_media_artifact { srv3_seeded_grub_kernel_cmdline, srv3_seeded_install_media_input_for }
+import std.optional { Present }
+import extdeps.provisioning.ubuntu_seeded_install_media { NoCloudSeedArtifact, UbuntuSeededInstallMediaBuildInput }
+import extdeps.provisioning.ubuntu_seeded_install_media_remaster { install_media_remaster_write_nocloud_seed, install_media_remaster_digest }
 import extdeps.provisioning.ubuntu_seeded_install_media_remaster { install_media_remaster_ensure_grub_cmdline, install_media_remaster_grub_cfg_with_cmdline, GrubCmdlineApplied, GrubCmdlineRefused }
 import extdeps.provisioning.ubuntu_install_media { noble_numbat_2404_3_live_server_arm64_grub_cfg }
 import gunbc.host_command_binding { LocalCommandHost }
@@ -36,3 +40,49 @@ test fn install_media_remaster_ensure_grub_cmdline_inserts_by_real_execution() -
     && wrote_other.success && refused_other && other_after.success && !string_contains(s: other_after.content, pattern: cmdline as String)
     && cleaned.success
 }
+
+fn with_seed_artifacts(input: UbuntuSeededInstallMediaBuildInput, artifacts: List<NoCloudSeedArtifact>) -> UbuntuSeededInstallMediaBuildInput {
+  UbuntuSeededInstallMediaBuildInput {
+    stock_artifact: input.stock_artifact,
+    nocloud_dir_on_iso: input.nocloud_dir_on_iso,
+    user_data_body: input.user_data_body,
+    seed_files: input.seed_files,
+    seed_artifacts: artifacts,
+    grub_kernel_cmdline: input.grub_kernel_cmdline,
+    volume_id: input.volume_id,
+    pinned_dates: input.pinned_dates,
+    image_stem: input.image_stem,
+    builder_revision: input.builder_revision,
+  }
+}
+
+// A BINARY SEED MEMBER, BY REAL EXECUTION: a safe basename is fetched (file:// through the same curl
+// the build uses), read back under the seed directory and admitted; the same bytes under a wrong
+// digest refuse; and an escaping name refuses BEFORE the seed directory exists, so no fetch ran and
+// nothing landed outside the seed.
+test fn a_seed_artifact_is_fetched_read_back_and_an_escaping_name_moves_no_byte_by_real_execution() -> Bool {
+  let dir = shell.Mktemp.Dir()
+  let root = dir.path as String
+  let source = concat(root, "/runner.tar.gz")
+  let wrote = Filesystem.Write(path: source, content: "runner tarball bytes")
+  let base = srv3_seeded_install_media_input_for(user_data_body: "#cloud-config\n" as NonEmptyStr)
+  let digest = match install_media_remaster_digest(host: LocalCommandHost, path: source as NonEmptyStr) { Present { value: d } => d Absent => "unread" }
+  let url = concat("file://", source) as NonEmptyStr
+  let safe_work = concat(root, "/safe") as NonEmptyStr
+  let safe = install_media_remaster_write_nocloud_seed(host: LocalCommandHost, work_dir: safe_work, input: with_seed_artifacts(input: base, artifacts: [NoCloudSeedArtifact { name: "runner.tar.gz", source_url: url, digest: sha256_digest(hex: digest as NonEmptyStr) }]))
+  let landed = Filesystem.Read(path: concat(safe_work as String, "/", base.nocloud_dir_on_iso as String, "/runner.tar.gz"))
+  let wrong_work = concat(root, "/wrong") as NonEmptyStr
+  let wrong = install_media_remaster_write_nocloud_seed(host: LocalCommandHost, work_dir: wrong_work, input: with_seed_artifacts(input: base, artifacts: [NoCloudSeedArtifact { name: "runner.tar.gz", source_url: url, digest: sha256_digest(hex: "0000000000000000000000000000000000000000000000000000000000000000") }]))
+  let escape_work = concat(root, "/escape") as NonEmptyStr
+  let escape = install_media_remaster_write_nocloud_seed(host: LocalCommandHost, work_dir: escape_work, input: with_seed_artifacts(input: base, artifacts: [NoCloudSeedArtifact { name: "../../boot/grub/grub.cfg", source_url: url, digest: sha256_digest(hex: digest as NonEmptyStr) }]))
+  let escape_seed = Filesystem.Read(path: concat(escape_work as String, "/", base.nocloud_dir_on_iso as String, "/user-data"))
+  let escaped = Filesystem.Read(path: concat(escape_work as String, "/boot/grub/grub.cfg"))
+  let cleaned = shell.Remove.RecursiveForce(path: dir.path)
+  dir.success && wrote.success && digest != "unread"
+    && (match safe { Absent => true Present { value: _ } => false })
+    && landed.success && landed.content == "runner tarball bytes"
+    && (match wrong { Present { value: r } => string_contains(s: r, pattern: "read back sha256") Absent => false })
+    && (match escape { Present { value: r } => string_contains(s: r, pattern: "not a single path component") Absent => false })
+    && !escape_seed.success && !escaped.success
+    && cleaned.success
+}
diff --git a/dag/test/claim/stage0_linked_partition_crates_witness_test.dag b/dag/test/claim/stage0_linked_partition_crates_witness_test.dag
index c09bfc0cdba..d79f0c86129 100644
--- a/dag/test/claim/stage0_linked_partition_crates_witness_test.dag
+++ b/dag/test/claim/stage0_linked_partition_crates_witness_test.dag
@@ -4,12 +4,7 @@ import std.types { List }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.text { String }
 import v2.std.algebra { any, length }
-import v2.workflow.rust_crate_partition {
-  Stage0PartitionCrateRow,
-  Stage0FoundationCrate,
-  Stage0LayeredCoreCrate,
-  CompilationUnitId,
-}
+import gunbc.crate_partition { Stage0PartitionCrateRow, Stage0FoundationCrate, Stage0LayeredCoreCrate, CompilationUnitId }
 import gunbc.stage0_executable_assembly_emit {
   LinkedPartitionCratesRendered,
   LinkedPartitionCratesRefused,
diff --git a/dag/test/claim/superseded_run_starvation_census_witness_test.dag b/dag/test/claim/superseded_run_starvation_census_witness_test.dag
index e5da6157f55..4974e330af1 100644
--- a/dag/test/claim/superseded_run_starvation_census_witness_test.dag
+++ b/dag/test/claim/superseded_run_starvation_census_witness_test.dag
@@ -83,7 +83,7 @@ test fn absent_job_rosters_remain_a_coverage_obligation() -> Bool {
 // dead_run_attempt is exactly the row that would then read wrong.
 // actor and triggering_actor: none. They are optional in the projection, no census fold reads
 // them, and inventing a login would be a fabricated observation rather than an absent one.
-data run_with_pull_request: WorkflowRun = WorkflowRun {
+data run_with_pull_request: WorkflowRun = WorkflowRun { display_title: none,
   id: 1,
   name: none,
   path: none,
@@ -103,7 +103,7 @@ data run_with_pull_request: WorkflowRun = WorkflowRun {
   pull_requests: [WorkflowRunPullRequest { number: 42 }],
 }
 
-data run_without_pull_request: WorkflowRun = WorkflowRun {
+data run_without_pull_request: WorkflowRun = WorkflowRun { display_title: none,
   id: 2,
   name: none,
   path: none,
@@ -137,7 +137,7 @@ test fn pr_number_for_run_without_pr_returns_none() -> Bool {
   }
 }
 
-data run_sha_abc: WorkflowRun = WorkflowRun {
+data run_sha_abc: WorkflowRun = WorkflowRun { display_title: none,
   id: 3,
   name: none,
   path: none,
@@ -157,7 +157,7 @@ data run_sha_abc: WorkflowRun = WorkflowRun {
   pull_requests: [WorkflowRunPullRequest { number: 42 }],
 }
 
-data run_sha_def: WorkflowRun = WorkflowRun {
+data run_sha_def: WorkflowRun = WorkflowRun { display_title: none,
   id: 4,
   name: none,
   path: none,
@@ -213,6 +213,8 @@ data job_cancelled: WorkflowJobRun = WorkflowJobRun {
   status: Completed,
   conclusion: Present { value: Cancelled },
   labels: [],
+  runner_id: none,
+  runner_name: none,
   created_at: Present { value: "2026-09-01T00:01:00Z" },
   started_at: Present { value: "2026-09-01T00:10:00Z" },
   completed_at: Present { value: "2026-09-01T00:20:00Z" },
@@ -226,6 +228,8 @@ data job_failed: WorkflowJobRun = WorkflowJobRun {
   status: Completed,
   conclusion: Present { value: Failure },
   labels: [],
+  runner_id: none,
+  runner_name: none,
   created_at: Present { value: "2026-09-01T00:00:00Z" },
   started_at: Present { value: "2026-09-01T00:00:00Z" },
   completed_at: Present { value: "2026-09-01T00:15:00Z" },
@@ -239,6 +243,8 @@ data job_success: WorkflowJobRun = WorkflowJobRun {
   status: Completed,
   conclusion: Present { value: Success },
   labels: [],
+  runner_id: none,
+  runner_name: none,
   created_at: Present { value: "2026-09-01T00:02:00Z" },
   started_at: Present { value: "2026-09-01T00:05:00Z" },
   completed_at: Present { value: "2026-09-01T00:10:00Z" },
@@ -252,6 +258,8 @@ data job_queued: WorkflowJobRun = WorkflowJobRun {
   status: Queued,
   conclusion: none,
   labels: [],
+  runner_id: none,
+  runner_name: none,
   created_at: Present { value: "2026-09-01T00:03:00Z" },
   started_at: none,
   completed_at: none,
@@ -265,6 +273,8 @@ data job_in_progress: WorkflowJobRun = WorkflowJobRun {
   status: InProgress,
   conclusion: none,
   labels: [],
+  runner_id: none,
+  runner_name: none,
   created_at: Present { value: "2026-09-01T00:04:00Z" },
   started_at: Present { value: "2026-09-01T00:30:00Z" },
   completed_at: none,
@@ -339,6 +349,8 @@ test fn earliest_created_at_returns_none_when_no_created_at() -> Bool {
     status: InProgress,
     conclusion: none,
     labels: [],
+    runner_id: none,
+    runner_name: none,
     created_at: none,
     started_at: none,
     completed_at: none,
diff --git a/dag/test/claim/supplier/oracle_oci_always_free_ensure_witness_test.dag b/dag/test/claim/supplier/oracle_oci_always_free_ensure_witness_test.dag
new file mode 100644
index 00000000000..b7a7ae82c18
--- /dev/null
+++ b/dag/test/claim/supplier/oracle_oci_always_free_ensure_witness_test.dag
@@ -0,0 +1,332 @@
+module test.claim.supplier.oracle_oci_always_free_ensure_witness
+
+import std.measure { gigabyte_count, second, second_count }
+import std.types { Bool, Int, List, NonEmptyStr, String }
+import extdeps.languages.json.emit { JsonValue, JsonArray, JsonObject, JsonNull, JsonBool, JsonNumber, JsonString }
+import extdeps.languages.json.parse { parse_json_document, JsonDocumentParsed, JsonDocumentUnreadable }
+import gunbc.oracle_oci.api { OciListRead, OciListed, OciListRefused, OciListInaccessible, OciAnswered, classify_oci_list }
+import extdeps.network.ipv4 { ipv4_same_network, render_ipv4_prefix }
+import std.optional { Absent, Present }
+import gunbc.oracle_oci.tenancy_usage {
+  OciUsagePart, UsagePart, UsagePartRefused, oci_instance_usage, oci_volume_usage, oci_usage_part_add,
+}
+import gunbc.oracle_oci.network_ensure {
+  OciStep, OciStepReady, OciStepStopped, oci_admit_wired,
+  oci_vcn_wiring, oci_igw_wiring, oci_access_disagreement,
+  oci_free_vcn_cidr, oci_free_subnet_cidr,
+  OciNamedDecision, NamedReady, NamedCreate, NamedStop,
+  oci_named_decision, oci_named_resource_of, oci_route_table_wiring, oci_subnet_wiring,
+}
+import gunbc.oracle_oci.instance_ensure {
+  OciInstanceDecision, InstanceHeld, InstanceLaunch, InstanceStop,
+  oci_instance_decision, oci_observed_instance_of, oci_free_plan, oci_launch_body,
+  oci_query_value, OciQueryEncoded, OciQueryRefused, oci_out_of_host_capacity, oci_free_authorized_keys,
+  oci_select_offering, oci_domain_answer, DomainOffers, DomainLacks, DomainReadRefused,
+  oci_attachments_disagreement, oci_answer_retires_record, oci_parse_launch_record, oci_launch_record_text,
+  oci_replay_window_open, OciLaunchRecorded, OciLaunchRecordMalformed,
+  CandidateDomains, CandidateDomainsRefused,
+}
+import product.supplier.oracle_oci { FitsAlwaysFree, ExceedsAlwaysFree, oci_always_free_fit }
+
+// The subject is each decision point of the Always Free converge at its list boundary, over supplied
+// list answers shaped as Oracle's SDK models them. The signed exchange runs only live, on srv1. Its
+// receipt is the inhabitance evidence for these boundaries, and these rows are what it must agree with.
+
+fn json_items(text: String) -> List<JsonValue> {
+  match parse_json_document(s: text) {
+    JsonDocumentUnreadable { gap } => []
+    JsonDocumentParsed { value } => match value {
+      JsonArray { elements } => elements
+      JsonObject { members } => []
+      JsonNull => []
+      JsonBool { value: b } => []
+      JsonNumber { lexeme } => []
+      JsonString { value: s } => []
+    }
+  }
+}
+
+fn one(text: String) -> JsonValue {
+  match json_items(text: join(["[", text, "]"], "")).first() {
+    Present { value: v } => v
+    Absent => JsonNull
+  }
+}
+
+fn named(display: String, text: String) -> String {
+  match oci_named_decision(kind: "vcn", display_name: display, read: OciListed { items: json_items(text: text) }) {
+    NamedReady { resource } => concat("ready:", resource.id)
+    NamedCreate => "create"
+    NamedStop { line } => "stop"
+  }
+}
+
+// ── THE OPERATOR'S PLAN ───────────────────────────────────────────────────────────────────────
+
+test fn the_operators_plan_fits_the_always_free_allowance() -> Bool {
+  match oci_always_free_fit(plan: oci_free_plan) {
+    FitsAlwaysFree => true
+    ExceedsAlwaysFree { breaches } => false
+  }
+}
+
+// ── LISTS ─────────────────────────────────────────────────────────────────────────────────────
+
+// Absence needs a complete list: an answer carrying opc-next-page refuses, even when its page is empty.
+test fn a_continued_list_refuses_and_a_finished_one_lists() -> Bool {
+  let continued = match classify_oci_list(operation: "List", exchange: OciAnswered { status: 200, body: "[]", next_page: "t" }) {
+    OciListRefused { cause } => true
+    OciListed { items } => false
+    OciListInaccessible { status, body } => false
+  }
+  let finished = match classify_oci_list(operation: "List", exchange: OciAnswered { status: 200, body: "[{\"id\":\"x\"}]", next_page: "" }) {
+    OciListed { items } => items.length() == 1
+    OciListRefused { cause } => false
+    OciListInaccessible { status, body } => false
+  }
+  continued && finished
+}
+
+// A network row missing a required field refuses the read. It does not read as "none live", which
+// would create a duplicate.
+test fn a_malformed_network_row_stops_rather_than_creating() -> Bool {
+  named(display: "gunbc-always-free", text: "[{\"displayName\":\"gunbc-always-free\",\"lifecycleState\":\"AVAILABLE\"}]") == "stop"
+    && named(display: "gunbc-always-free", text: "[{}]") == "stop"
+}
+
+// ── NETWORK ───────────────────────────────────────────────────────────────────────────────────
+
+test fn a_network_resource_is_created_only_when_none_live_has_the_name() -> Bool {
+  named(display: "gunbc-always-free", text: "[]") == "create"
+    && named(display: "gunbc-always-free", text: "[{\"id\":\"v1\",\"displayName\":\"other\",\"lifecycleState\":\"AVAILABLE\"}]") == "create"
+    && named(display: "gunbc-always-free", text: "[{\"id\":\"v1\",\"displayName\":\"gunbc-always-free\",\"lifecycleState\":\"TERMINATED\"}]") == "create"
+}
+
+test fn an_available_namesake_is_ready_and_a_provisioning_one_stops() -> Bool {
+  named(display: "gunbc-always-free", text: "[{\"id\":\"v1\",\"displayName\":\"gunbc-always-free\",\"lifecycleState\":\"AVAILABLE\"}]") == "ready:v1"
+    && named(display: "gunbc-always-free", text: "[{\"id\":\"v1\",\"displayName\":\"gunbc-always-free\",\"lifecycleState\":\"PROVISIONING\"}]") == "stop"
+    && named(display: "gunbc-always-free", text: "[{\"id\":\"v1\",\"displayName\":\"gunbc-always-free\",\"lifecycleState\":\"AVAILABLE\"},{\"id\":\"v2\",\"displayName\":\"gunbc-always-free\",\"lifecycleState\":\"AVAILABLE\"}]") == "stop"
+}
+
+test fn a_route_table_is_admitted_only_if_it_reaches_this_gateway() -> Bool {
+  let good = oci_named_resource_of(v: one(text: "{\"id\":\"rt\",\"displayName\":\"p\",\"lifecycleState\":\"AVAILABLE\",\"routeRules\":[{\"destination\":\"0.0.0.0/0\",\"destinationType\":\"CIDR_BLOCK\",\"networkEntityId\":\"igw1\"}]}"))
+  let other = oci_named_resource_of(v: one(text: "{\"id\":\"rt\",\"displayName\":\"p\",\"lifecycleState\":\"AVAILABLE\",\"routeRules\":[{\"destination\":\"0.0.0.0/0\",\"destinationType\":\"CIDR_BLOCK\",\"networkEntityId\":\"igw2\"}]}"))
+  let empty = oci_named_resource_of(v: one(text: "{\"id\":\"rt\",\"displayName\":\"p\",\"lifecycleState\":\"AVAILABLE\",\"routeRules\":[]}"))
+  oci_route_table_wiring(r: good, igw: "igw1") == ""
+    && oci_route_table_wiring(r: other, igw: "igw1") != ""
+    && oci_route_table_wiring(r: empty, igw: "igw1") != ""
+}
+
+test fn a_subnet_is_admitted_only_on_this_route_table() -> Bool {
+  let s = oci_named_resource_of(v: one(text: "{\"id\":\"sn\",\"displayName\":\"p\",\"lifecycleState\":\"AVAILABLE\",\"vcnId\":\"v1\",\"routeTableId\":\"rt1\",\"cidrBlock\":\"10.0.0.0/24\",\"prohibitPublicIpOnVnic\":false}"))
+  oci_subnet_wiring(r: s, vcn: "v1", route_table: "rt1") == "" && oci_subnet_wiring(r: s, vcn: "v1", route_table: "rt2") != ""
+}
+
+// ── INSTANCES ─────────────────────────────────────────────────────────────────────────────────
+
+fn decide_a1(text: String) -> String {
+  match oci_free_plan.skip(n: 2).first() {
+    Absent => "no-plan"
+    Present { value: p } => match oci_instance_decision(planned: p, observed: map(json_items(text: text), i => oci_observed_instance_of(v: i))) {
+      InstanceHeld { line } => "held"
+      InstanceLaunch => "launch"
+      InstanceStop { line } => "stop"
+    }
+  }
+}
+
+test fn the_a1_instance_launches_when_absent_and_holds_when_running() -> Bool {
+  decide_a1(text: "[]") == "launch"
+    && decide_a1(text: "[{\"id\":\"i\",\"displayName\":\"gunbc-free-a1\",\"lifecycleState\":\"TERMINATED\",\"shape\":\"VM.Standard.A1.Flex\"}]") == "launch"
+    && decide_a1(text: "[{\"id\":\"i\",\"displayName\":\"gunbc-free-a1\",\"lifecycleState\":\"RUNNING\",\"shape\":\"VM.Standard.A1.Flex\",\"shapeConfig\":{\"ocpus\":2.0,\"memoryInGBs\":12.0}}]") == "held"
+}
+
+// A stopped instance was stopped by someone, and a wrong-shaped namesake is not this instance. Neither
+// is started, reshaped or replaced.
+test fn a_stopped_or_wrong_shaped_namesake_stops_rather_than_launching() -> Bool {
+  decide_a1(text: "[{\"id\":\"i\",\"displayName\":\"gunbc-free-a1\",\"lifecycleState\":\"STOPPED\",\"shape\":\"VM.Standard.A1.Flex\",\"shapeConfig\":{\"ocpus\":2.0,\"memoryInGBs\":12.0}}]") == "stop"
+    && decide_a1(text: "[{\"id\":\"i\",\"displayName\":\"gunbc-free-a1\",\"lifecycleState\":\"RUNNING\",\"shape\":\"VM.Standard.E2.1.Micro\"}]") == "stop"
+}
+
+// The query values go through extdeps.uri's encoder: an availability domain's colon and the image
+// query's space come out percent-encoded, and an empty value refuses before any read is sent.
+test fn query_values_are_encoded_by_the_shared_uri_encoder() -> Bool {
+  let colon = match oci_query_value(value: "Uocm:US-ASHBURN-AD-1") { OciQueryEncoded { wire } => wire == "Uocm%3AUS-ASHBURN-AD-1"  OciQueryRefused { line } => false }
+  let space = match oci_query_value(value: "Oracle Linux") { OciQueryEncoded { wire } => wire == "Oracle%20Linux"  OciQueryRefused { line } => false }
+  let empty = match oci_query_value(value: "") { OciQueryRefused { line } => true  OciQueryEncoded { wire } => false }
+  colon && space && empty
+}
+
+test fn out_of_host_capacity_is_read_from_oracles_500_text_only() -> Bool {
+  oci_out_of_host_capacity(status: 500, body: "{\"code\":\"InternalError\",\"message\":\"Out of host capacity.\"}")
+    && !oci_out_of_host_capacity(status: 500, body: "{\"code\":\"InternalError\",\"message\":\"something else\"}")
+    && !oci_out_of_host_capacity(status: 400, body: "Out of host capacity.")
+}
+
+// The A1 launch carries its shapeConfig and both keys. The micro launch carries no shapeConfig,
+// because its size is fixed.
+test fn launch_bodies_carry_shape_config_only_for_the_flex_shape() -> Bool {
+  let micro = match oci_free_plan.first() { Present { value: p } => oci_launch_body(planned: p, compartment: "c", subnet: "s", domain: "AD-1", image: "img") Absent => "" }
+  let a1 = match oci_free_plan.skip(n: 2).first() { Present { value: p } => oci_launch_body(planned: p, compartment: "c", subnet: "s", domain: "AD-1", image: "img") Absent => "" }
+  !string_contains(s: micro, pattern: "shapeConfig")
+    && string_contains(s: a1, pattern: "\"shapeConfig\": {\"ocpus\": 2, \"memoryInGBs\": 12}")
+    && string_contains(s: a1, pattern: "\"bootVolumeSizeInGBs\": 50")
+    && string_contains(s: oci_free_authorized_keys(), pattern: "fleet-automation@gunbc")
+    && string_contains(s: oci_free_authorized_keys(), pattern: "macbook-m4")
+}
+
+// A refused ListShapes read is not "this domain lacks the shape" (review 76366). One refused domain
+// refuses the selection with its cause, even beside a domain that answered and offers the shape.
+// With every read answered, the offering domain is selected.
+test fn a_refused_shape_read_refuses_the_selection_rather_than_reading_as_lacking() -> Bool {
+  let refused = match oci_select_offering(answers: [oci_domain_answer(domain: "AD-1", offer: DomainReadRefused { line: "ListShapes for AD-1 refused: 500" }), oci_domain_answer(domain: "AD-2", offer: DomainOffers)]) {
+    CandidateDomainsRefused { line } => string_contains(s: line, pattern: "AD-1")
+    CandidateDomains { domains } => false
+  }
+  let selected = match oci_select_offering(answers: [oci_domain_answer(domain: "AD-1", offer: DomainLacks), oci_domain_answer(domain: "AD-2", offer: DomainOffers)]) {
+    CandidateDomains { domains } => domains == ["AD-2"]
+    CandidateDomainsRefused { line } => false
+  }
+  refused && selected
+}
+
+// The subnet is inside the VCN: its network shares the VCN's network at the VCN's prefix, and its
+// prefix is at least as long. The rendered CIDR text is what the create bodies send.
+test fn the_subnet_sits_inside_the_vcn() -> Bool {
+  let contained = match ipv4_same_network(a: oci_free_subnet_cidr.network, b: oci_free_vcn_cidr.network, prefix: oci_free_vcn_cidr.length) {
+    Present { value } => value
+    Absent => false
+  }
+  contained
+    && oci_free_subnet_cidr.length >= oci_free_vcn_cidr.length
+    && render_ipv4_prefix(p: oci_free_vcn_cidr) == "10.0.0.0/16"
+    && render_ipv4_prefix(p: oci_free_subnet_cidr) == "10.0.0.0/24"
+}
+
+// ── TENANCY USAGE ─────────────────────────────────────────────────────────────────────────────
+
+fn usage_text(u: OciUsagePart) -> String {
+  match u {
+    UsagePart { a1_ocpus, a1_memory, micros, block } => join([to_string(a1_ocpus), to_string(gigabyte_count(g: a1_memory)), to_string(micros), to_string(gigabyte_count(g: block))], "/")
+    UsagePartRefused { line } => "refused"
+  }
+}
+
+// What each live instance holds: an A1 its shapeConfig OCPUs and memory, read exactly from Oracle's
+// float numerals; a micro one micro. A terminated instance holds nothing. A stopped one still counts.
+test fn instances_contribute_their_allocation_and_terminated_ones_nothing() -> Bool {
+  usage_text(u: oci_instance_usage(row: one(text: "{\"id\":\"i\",\"lifecycleState\":\"RUNNING\",\"shape\":\"VM.Standard.A1.Flex\",\"shapeConfig\":{\"ocpus\":2.0,\"memoryInGBs\":12.0}}"))) == "2/12/0/0"
+    && usage_text(u: oci_instance_usage(row: one(text: "{\"id\":\"i\",\"lifecycleState\":\"STOPPED\",\"shape\":\"VM.Standard.E2.1.Micro\"}"))) == "0/0/1/0"
+    && usage_text(u: oci_instance_usage(row: one(text: "{\"id\":\"i\",\"lifecycleState\":\"TERMINATED\",\"shape\":\"VM.Standard.A1.Flex\"}"))) == "0/0/0/0"
+}
+
+// A fractional or missing allocation refuses rather than being rounded or read as zero, and a refusal
+// absorbs every later sum, so a usage total can never silently omit a row.
+test fn an_unreadable_allocation_refuses_and_stays_refused_through_the_sum() -> Bool {
+  let fractional = oci_instance_usage(row: one(text: "{\"id\":\"i\",\"lifecycleState\":\"RUNNING\",\"shape\":\"VM.Standard.A1.Flex\",\"shapeConfig\":{\"ocpus\":1.5,\"memoryInGBs\":6}}"))
+  let missing = oci_instance_usage(row: one(text: "{\"id\":\"i\",\"lifecycleState\":\"RUNNING\",\"shape\":\"VM.Standard.A1.Flex\"}"))
+  usage_text(u: fractional) == "refused"
+    && usage_text(u: missing) == "refused"
+    && usage_text(u: oci_usage_part_add(a: oci_volume_usage(row: one(text: "{\"id\":\"v\",\"lifecycleState\":\"AVAILABLE\",\"sizeInGBs\":50}")), b: fractional)) == "refused"
+}
+
+// Volumes hold storage in every state but TERMINATED, including a boot volume a terminated instance
+// left behind.
+test fn volumes_hold_storage_until_terminated() -> Bool {
+  usage_text(u: oci_volume_usage(row: one(text: "{\"id\":\"v\",\"lifecycleState\":\"AVAILABLE\",\"sizeInGBs\":50}"))) == "0/0/0/50"
+    && usage_text(u: oci_volume_usage(row: one(text: "{\"id\":\"v\",\"lifecycleState\":\"TERMINATED\",\"sizeInGBs\":50}"))) == "0/0/0/0"
+}
+
+// A running A1 namesake is held only at the planned size. A different size, or a size that cannot be
+// read, stops rather than being taken as converged (side-chat review on gunbc#13351).
+test fn an_a1_namesake_is_held_only_at_the_planned_size() -> Bool {
+  decide_a1(text: "[{\"id\":\"i\",\"displayName\":\"gunbc-free-a1\",\"lifecycleState\":\"RUNNING\",\"shape\":\"VM.Standard.A1.Flex\",\"shapeConfig\":{\"ocpus\":1.0,\"memoryInGBs\":6.0}}]") == "stop"
+    && decide_a1(text: "[{\"id\":\"i\",\"displayName\":\"gunbc-free-a1\",\"lifecycleState\":\"RUNNING\",\"shape\":\"VM.Standard.A1.Flex\"}]") == "stop"
+}
+
+// One admission for found and read-back resources: wiring that disagrees stops, whichever path
+// reached it (side-chat review on gunbc#13351).
+test fn wiring_admission_stops_on_any_disagreement() -> Bool {
+  let r = oci_named_resource_of(v: one(text: "{\"id\":\"rt\",\"displayName\":\"p\",\"lifecycleState\":\"AVAILABLE\"}"))
+  let ok = match oci_admit_wired(kind: "route table", display_name: "p", resource: r, disagreement: "", how: "created and AVAILABLE on read-back") { OciStepReady { id, line } => true  OciStepStopped { line } => false }
+  let bad = match oci_admit_wired(kind: "route table", display_name: "p", resource: r, disagreement: "route table has no rule sending 0.0.0.0/0 to igw1", how: "created and AVAILABLE on read-back") { OciStepStopped { line } => true  OciStepReady { id, line } => false }
+  ok && bad
+}
+
+// The network is admitted on what it claims to provide: a disabled gateway, a private subnet, a subnet
+// with another range, and a VCN without the planned range each stop, where only the route table was
+// checked before (side-chat review and review 78205 on gunbc#13351).
+test fn the_network_is_admitted_on_enabled_public_planned_properties() -> Bool {
+  let igw_on = oci_named_resource_of(v: one(text: "{\"id\":\"g\",\"displayName\":\"p\",\"lifecycleState\":\"AVAILABLE\",\"vcnId\":\"v1\",\"isEnabled\":true}"))
+  let igw_off = oci_named_resource_of(v: one(text: "{\"id\":\"g\",\"displayName\":\"p\",\"lifecycleState\":\"AVAILABLE\",\"vcnId\":\"v1\",\"isEnabled\":false}"))
+  let private = oci_named_resource_of(v: one(text: "{\"id\":\"sn\",\"displayName\":\"p\",\"lifecycleState\":\"AVAILABLE\",\"vcnId\":\"v1\",\"routeTableId\":\"rt1\",\"cidrBlock\":\"10.0.0.0/24\",\"prohibitPublicIpOnVnic\":true}"))
+  let other_range = oci_named_resource_of(v: one(text: "{\"id\":\"sn\",\"displayName\":\"p\",\"lifecycleState\":\"AVAILABLE\",\"vcnId\":\"v1\",\"routeTableId\":\"rt1\",\"cidrBlock\":\"10.0.9.0/24\",\"prohibitPublicIpOnVnic\":false}"))
+  let vcn_ok = oci_named_resource_of(v: one(text: "{\"id\":\"v1\",\"displayName\":\"p\",\"lifecycleState\":\"AVAILABLE\",\"cidrBlocks\":[\"10.0.0.0/16\"]}"))
+  let vcn_other = oci_named_resource_of(v: one(text: "{\"id\":\"v1\",\"displayName\":\"p\",\"lifecycleState\":\"AVAILABLE\",\"cidrBlocks\":[\"192.168.0.0/16\"]}"))
+  oci_igw_wiring(r: igw_on, vcn: "v1") == "" && oci_igw_wiring(r: igw_off, vcn: "v1") != ""
+    && oci_subnet_wiring(r: private, vcn: "v1", route_table: "rt1") != ""
+    && oci_subnet_wiring(r: other_range, vcn: "v1", route_table: "rt1") != ""
+    && oci_vcn_wiring(r: vcn_ok) == "" && oci_vcn_wiring(r: vcn_other) != ""
+}
+
+// Access rules are read, not assumed: SSH ingress from anywhere plus all egress admits; a list without
+// the SSH rule, or a named list that was not read, stops.
+test fn subnet_access_rules_are_admitted_only_when_read_and_sufficient() -> Bool {
+  let good = one(text: "{\"id\":\"sl1\",\"ingressSecurityRules\":[{\"protocol\":\"6\",\"source\":\"0.0.0.0/0\",\"tcpOptions\":{\"destinationPortRange\":{\"min\":22,\"max\":22}}}],\"egressSecurityRules\":[{\"protocol\":\"all\",\"destination\":\"0.0.0.0/0\"}]}")
+  let no_ssh = one(text: "{\"id\":\"sl1\",\"ingressSecurityRules\":[{\"protocol\":\"6\",\"source\":\"0.0.0.0/0\",\"tcpOptions\":{\"destinationPortRange\":{\"min\":443,\"max\":443}}}],\"egressSecurityRules\":[{\"protocol\":\"all\",\"destination\":\"0.0.0.0/0\"}]}")
+  let subnet = one(text: "{\"id\":\"sn\",\"securityListIds\":[\"sl1\"]}")
+  oci_access_disagreement(subnet_row: subnet, lists: [good]) == ""
+    && oci_access_disagreement(subnet_row: subnet, lists: [no_ssh]) != ""
+    && oci_access_disagreement(subnet_row: subnet, lists: []) != ""
+}
+
+// A held instance must be attached to the selected subnet: an otherwise identical instance on another
+// subnet, or with no attached VNIC, stops (side-chat review on gunbc#13351).
+test fn a_held_instance_must_be_attached_to_the_selected_subnet() -> Bool {
+  oci_attachments_disagreement(rows: json_items(text: "[{\"id\":\"a\",\"lifecycleState\":\"ATTACHED\",\"subnetId\":\"sn1\"}]"), subnet: "sn1") == ""
+    && oci_attachments_disagreement(rows: json_items(text: "[{\"id\":\"a\",\"lifecycleState\":\"ATTACHED\",\"subnetId\":\"sn2\"}]"), subnet: "sn1") != ""
+    && oci_attachments_disagreement(rows: json_items(text: "[{\"id\":\"a\",\"lifecycleState\":\"DETACHED\",\"subnetId\":\"sn1\"}]"), subnet: "sn1") != ""
+}
+
+// THE LAUNCH RECORD'S LIFECYCLE (side-chat review on gunbc#13351). Only the run that created a record,
+// on its first send, retires it on a definitive non-creation. A re-send never retires it: an auth
+// rejection on a re-send after an unknown original keeps the record. A 5xx, a throttle or a conflict
+// keeps it on any send.
+test fn only_a_first_send_definitive_refusal_retires_the_record() -> Bool {
+  oci_answer_retires_record(first_send: true, status: 400, body: "{}")
+    && oci_answer_retires_record(first_send: true, status: 500, body: "{\"message\":\"Out of host capacity.\"}")
+    && !oci_answer_retires_record(first_send: false, status: 401, body: "{}")
+    && !oci_answer_retires_record(first_send: false, status: 403, body: "{}")
+    && !oci_answer_retires_record(first_send: false, status: 400, body: "{}")
+    && !oci_answer_retires_record(first_send: true, status: 409, body: "{}")
+    && !oci_answer_retires_record(first_send: true, status: 429, body: "{}")
+    && !oci_answer_retires_record(first_send: true, status: 503, body: "{}")
+}
+
+// The record round-trips its first-send time and exact body, and a record outside the retry-token
+// window is not re-sent.
+test fn the_record_carries_its_send_time_and_expires_from_replay() -> Bool {
+  let round = match oci_parse_launch_record(content: oci_launch_record_text(sent_at: second(count: 1000), body: "{\"a\": 1}\n{\"b\": 2}")) {
+    OciLaunchRecorded { sent_at, body } => second_count(s: sent_at) == 1000 && body == "{\"a\": 1}\n{\"b\": 2}"
+    OciLaunchRecordMalformed { cause } => false
+  }
+  let malformed = match oci_parse_launch_record(content: "not-a-time\n{}") {
+    OciLaunchRecordMalformed { cause } => true
+    OciLaunchRecorded { sent_at, body } => false
+  }
+  round && malformed
+    && oci_replay_window_open(sent_at: second(count: 1000), now: second(count: 1000 + 3600))
+    && !oci_replay_window_open(sent_at: second(count: 1000), now: second(count: 1000 + 82800))
+    && !oci_replay_window_open(sent_at: second(count: 1000), now: second(count: 999))
+}
+
+// An SSH rule restricted to a source port does not admit a client connecting from an ephemeral port;
+// the same rule without the source restriction does (side-chat review on gunbc#13351).
+test fn a_source_port_restricted_ssh_rule_is_not_admitted() -> Bool {
+  let subnet = one(text: "{\"id\":\"sn\",\"securityListIds\":[\"sl1\"]}")
+  let egress = "\"egressSecurityRules\":[{\"protocol\":\"all\",\"destination\":\"0.0.0.0/0\"}]"
+  let restricted = one(text: join(["{\"id\":\"sl1\",\"ingressSecurityRules\":[{\"protocol\":\"6\",\"source\":\"0.0.0.0/0\",\"tcpOptions\":{\"sourcePortRange\":{\"min\":22,\"max\":22},\"destinationPortRange\":{\"min\":22,\"max\":22}}}],", egress, "}"], ""))
+  let full = one(text: join(["{\"id\":\"sl1\",\"ingressSecurityRules\":[{\"protocol\":\"6\",\"source\":\"0.0.0.0/0\",\"tcpOptions\":{\"sourcePortRange\":{\"min\":1,\"max\":65535},\"destinationPortRange\":{\"min\":22,\"max\":22}}}],", egress, "}"], ""))
+  oci_access_disagreement(subnet_row: subnet, lists: [restricted]) != ""
+    && oci_access_disagreement(subnet_row: subnet, lists: [full]) == ""
+}
diff --git a/dag/test/claim/systemd/service_exec_test.dag b/dag/test/claim/systemd/service_exec_test.dag
new file mode 100644
index 00000000000..2b3494ee072
--- /dev/null
+++ b/dag/test/claim/systemd/service_exec_test.dag
@@ -0,0 +1,39 @@
+module test.claim.systemd.service_exec_test
+
+import std.types { String, List, Bool }
+import extdeps.systemd.service_exec {
+  ExecLiteral, ExecVariable, ExecWordRendered, ExecWordRefused, exec_word_render,
+  InvocationIdVariable, ExitStatusVariable,
+  ExecCommandLineRendered, ExecCommandLineRefused, exec_command_line,
+}
+import extdeps.tools.gnu_coreutils { mkdir_create_only_command }
+
+test fn exec_word_spells_variables_as_braced_expansions() -> Bool {
+  match exec_word_render(parts: [ExecLiteral { text: "/spool/a+" }, ExecVariable { variable: InvocationIdVariable }, ExecLiteral { text: "+" }, ExecVariable { variable: ExitStatusVariable }]) {
+    ExecWordRendered { word } => (word as String) == "/spool/a+$\{INVOCATION_ID}+$\{EXIT_STATUS}"
+    ExecWordRefused { reason: _ } => false
+  }
+}
+
+test fn exec_word_refuses_a_literal_that_would_be_read_as_syntax() -> Bool {
+  let dollar = match exec_word_render(parts: [ExecLiteral { text: "/spool/$HOME" }]) { ExecWordRefused { reason: _ } => true ExecWordRendered { word: _ } => false }
+  let space = match exec_word_render(parts: [ExecLiteral { text: "/spool/a b" }]) { ExecWordRefused { reason: _ } => true ExecWordRendered { word: _ } => false }
+  let percent = match exec_word_render(parts: [ExecLiteral { text: "/spool/%n" }]) { ExecWordRefused { reason: _ } => true ExecWordRendered { word: _ } => false }
+  dollar && space && percent
+}
+
+test fn exec_command_line_admits_a_rendered_expansion_and_refuses_a_bare_one() -> Bool {
+  let admitted = match exec_command_line(command: mkdir_create_only_command(path: "/spool/a+$\{INVOCATION_ID}")) {
+    ExecCommandLineRendered { line } => (line as String) == "mkdir -- /spool/a+$\{INVOCATION_ID}"
+    ExecCommandLineRefused { reason: _ } => false
+  }
+  let bare = match exec_command_line(command: mkdir_create_only_command(path: "/spool/$EXIT_STATUS")) {
+    ExecCommandLineRefused { reason: _ } => true
+    ExecCommandLineRendered { line: _ } => false
+  }
+  let unmodeled = match exec_command_line(command: mkdir_create_only_command(path: "/spool/$\{HOME}")) {
+    ExecCommandLineRefused { reason: _ } => true
+    ExecCommandLineRendered { line: _ } => false
+  }
+  admitted && bare && unmodeled
+}
diff --git a/dag/test/claim/systemd_unit_file_witness_test.dag b/dag/test/claim/systemd_unit_file_witness_test.dag
index b105e301f20..500e39912d1 100644
--- a/dag/test/claim/systemd_unit_file_witness_test.dag
+++ b/dag/test/claim/systemd_unit_file_witness_test.dag
@@ -6,6 +6,7 @@ import extdeps.systemd.unit_file {
   SystemdUnitFile,
   ServiceUnitFile,
   TimerUnitFile,
+  PathUnitFile, PathUnit, DirectoryNotEmpty,
   SystemdInstallSection,
   NotInstallable,
   Installable,
@@ -231,6 +232,22 @@ test fn the_live_belt_timer_serializes_to_exactly_its_deployed_bytes() -> Bool {
   ) == "[Unit]\nDescription=gunbc roadmap belt tick cadence\n\n[Timer]\nUnit=gunbc-srv1-green-belt.service\nOnBootSec=2min\nOnUnitInactiveSec=60s\nAccuracySec=5s\n\n[Install]\nWantedBy=timers.target\n"
 }
 
+// The path-unit form (systemd.path(5)): a [Path] section between [Unit] and [Install], with Unit=
+// naming the activated unit and the condition rendered under its own key -- the shape the belt's exit
+// inbox path unit is emitted in (gunbc.live_deploy.emit live_deploy_belt_exit_path_unit_file).
+test fn a_path_unit_serializes_with_its_path_section() -> Bool {
+  serialize_systemd_unit_file(
+    file: PathUnitFile {
+      unit: [Description { text: "gunbc roadmap belt: a unit exit was recorded" as NonEmptyStr }],
+      path: [
+        PathUnit { target: "gunbc-srv1-green-belt-exit.service" as NonEmptyStr },
+        DirectoryNotEmpty { path: "/opt/gunbc/attempt-exit-spool/inbox" as NonEmptyStr },
+      ],
+      install: Installable { directives: [WantedBy { target: "paths.target" as NonEmptyStr }] },
+    },
+  ) == "[Unit]\nDescription=gunbc roadmap belt: a unit exit was recorded\n\n[Path]\nUnit=gunbc-srv1-green-belt-exit.service\nDirectoryNotEmpty=/opt/gunbc/attempt-exit-spool/inbox\n\n[Install]\nWantedBy=paths.target\n"
+}
+
 // `TimerUnit` renders as `Unit=`, not `TimerUnit=` — the same variant-name-versus-wire-name trap
 // `ServiceType` carries, and the one most likely to leak here because [Unit] is also a section name.
 test fn the_timer_unit_directive_renders_as_the_bare_unit_key() -> Bool {
diff --git a/dag/test/claim/tailscale_acl_phase2_design_witness_test.dag b/dag/test/claim/tailscale_acl_phase2_design_witness_test.dag
index 45705eadc8e..ec661074565 100644
--- a/dag/test/claim/tailscale_acl_phase2_design_witness_test.dag
+++ b/dag/test/claim/tailscale_acl_phase2_design_witness_test.dag
@@ -3,13 +3,18 @@ module test.claim.tailscale_acl_phase2_design_witness
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
 test fn witness_secret_homed_in_gunbai_secrets() -> Bool {
-  operator_tailscale_acl_secret_bindings.first().project == bmc_secrets_project_id
-    && operator_tailscale_acl_secret_bindings.first().secret == (tailscale_acl_ephemeral_token_secret_id as String)
+  match operator_tailscale_acl_secret_bindings.first() {
+    Present { value: b } => b.project == bmc_secrets_project_id && b.secret == (tailscale_acl_ephemeral_token_secret_id as String)
+    Absent => false
+  }
 }
 
 test fn witness_operator_user_principal_accessor_only() -> Bool {
   operator_bindings_are_user_principal_accessor_only(bindings: operator_tailscale_acl_secret_bindings)
-    && operator_tailscale_acl_secret_bindings.first().role == role_secretmanager_secret_accessor
+    && match operator_tailscale_acl_secret_bindings.first() {
+      Present { value: b } => b.role == role_secretmanager_secret_accessor
+      Absent => false
+    }
     && operator_principal_member() == fleet_operator_gcp_iam_member()
     && string_contains(s: operator_principal_member(), pattern: tailscale_acl_operator_email() as String)
     && tailscale_acl_operator_email() == fleet_operator_email
diff --git a/dag/test/claim/tailscale_acl_witness_test.dag b/dag/test/claim/tailscale_acl_witness_test.dag
index c9175a5083a..f1fc3a43cf9 100644
--- a/dag/test/claim/tailscale_acl_witness_test.dag
+++ b/dag/test/claim/tailscale_acl_witness_test.dag
@@ -7,7 +7,7 @@ data tailscale_acl_reference_fixture_path: String = "dag/test/fixture/tailscale_
 
 fn witness_operator_policy_row_counts() -> Bool {
   let policy = operator_tailscale_acl_policy
-  (length(policy.grants) == 4)
+  (length(policy.grants) == 5)
     && (length(policy.ssh) == 3)
     && (length(policy.node_attrs) == 1)
     && (length(policy.tag_owners) == 2)
@@ -43,6 +43,21 @@ fn witness_emit_matches_reference_fixture() -> Bool {
   read.success && (expected_tailscale_acl_json() == read.content)
 }
 
+fn witness_dusk_serving_api_only() -> Bool {
+  let wider = TailscaleAclPolicy {
+    grants: operator_tailscale_acl_policy.grants.append(TailscaleGrant {
+      src: [sel_tag_ci()],
+      dst: [sel_ipv4(address: dusk_serving_ip)],
+      ip: [sel_wildcard()],
+    }),
+    ssh: operator_tailscale_acl_policy.ssh,
+    node_attrs: operator_tailscale_acl_policy.node_attrs,
+    tag_owners: operator_tailscale_acl_policy.tag_owners,
+  }
+  dusk_serving_reached_by_dashboard_api_only(policy: operator_tailscale_acl_policy)
+    && !dusk_serving_reached_by_dashboard_api_only(policy: wider)
+}
+
 fn witness_dashboard_tag_not_ci_in_acl_model() -> Bool {
   tag_dashboard != tag_ci
     && !string_contains(s: tag_dashboard, pattern: "tag:ci")
@@ -58,4 +73,5 @@ test fn tailscale_acl_witnesses() -> Bool {
     && witness_security_spine()
     && witness_emit_matches_reference_fixture()
     && witness_dashboard_tag_not_ci_in_acl_model()
+    && witness_dusk_serving_api_only()
 }
diff --git a/dag/test/claim/target_invocation_witness_test.dag b/dag/test/claim/target_invocation_witness_test.dag
index c919bfbf374..fb72e21a86a 100644
--- a/dag/test/claim/target_invocation_witness_test.dag
+++ b/dag/test/claim/target_invocation_witness_test.dag
@@ -507,8 +507,18 @@ test fn the_instrument_target_and_its_binding_are_the_same_identity() -> Bool {
          LabelNonCanonical { cause: _ } => false
        })
     && (render_label(l: t.label) == differential_operand())
-    && ((instrument_targets() |> count) == 8)
-    && ((instrument_bindings() |> count) == 8)
+    && registry_and_bindings_are_one_population()
+}
+
+// THE REGISTRY AND ITS BINDINGS ARE ONE POPULATION, JOINED AT IDENTITY GRAIN. Completeness is an
+// identity join and never a count (DESIGN section 5): a literal count of the live registry is a
+// measurement copied from the tree it measures, and it went false the first time a row was added.
+// Both directions are asserted, so a target with no binding AND a binding for no registered
+// target each fail -- a count equality passes a registry that swapped one row for another.
+fn registry_and_bindings_are_one_population() -> Bool {
+  let bound = instrument_bindings() |> map(b => b.target)
+  fold(instrument_targets(), init: true, f: fn(acc, t) { acc && label_in(labels: bound, wanted: t) })
+    && fold(bound, init: true, f: fn(acc, l) { acc && label_in(labels: instrument_targets(), wanted: l) })
 }
 
 // THE ABSENCE PROOF, MEASURED OVER THE DERIVED POPULATION RATHER THAN ASSERTED IN PROSE.
@@ -524,15 +534,16 @@ test fn the_instrument_target_and_its_binding_are_the_same_identity() -> Bool {
 //
 // THE PLANNED SITE'S MODULE PATH MUST SIT INSIDE THE STATIC GATE. Since the 2026-08-29 bankruptcy
 // ruling, `v2.workflow.required_floor` `required_gate_prefixes` is a static roster and a site
-// outside it dispositions `DeclinedOutsideRequiredGate` -- which is what happened to the original
-// `test.claim.some_witness` fixture path: the presence conjunct above went silently red while the
-// module itself sat off-gate and unexecuted. `v2.test.` is a rostered prefix, so the fixture's
-// planned site plans again; a future roster shrink that drops the prefix reds this test loudly,
-// which is the control working rather than a new fragility.
+// outside it dispositions `DeclinedOutsideRequiredGate`, so the presence conjunct below goes
+// silently red while the fixture itself sits off-gate. This fixture has been bitten twice: the
+// original `test.claim.some_witness` path, and then `v2.test.some_witness`, whose `v2.test.` prefix
+// the revert of gunbc#12582 (gunbc#12852) removed from the roster. The path now rides the
+// `test.claim.infer_` family row, which has been in the roster throughout; a future roster change
+// that drops it reds the planned-site conjunct, which is the control working.
 fn census_fixture_sites() -> List<DiscoveredSite> {
   [
     DiscoveredSite {
-      module_path: "v2.test.some_witness",
+      module_path: "test.claim.infer_some_witness",
       function: "a_planned_site",
       reads_live_tree: SubstrateInputsOnly {}
     },
@@ -546,7 +557,7 @@ fn census_fixture_sites() -> List<DiscoveredSite> {
 
 fn planned_site_label() -> Label {
   Label {
-    package: PackagePath { segments: ["v2", "test", "some_witness"] }
+    package: PackagePath { segments: ["test", "claim", "infer_some_witness"] }
     target: TargetName { name: "a_planned_site" }
   }
 }
diff --git a/dag/test/claim/tmux_session_list_outcome_witness_test.dag b/dag/test/claim/tmux_session_list_outcome_witness_test.dag
index e6769e4ca2d..1fbe915252f 100644
--- a/dag/test/claim/tmux_session_list_outcome_witness_test.dag
+++ b/dag/test/claim/tmux_session_list_outcome_witness_test.dag
@@ -87,10 +87,22 @@ test fn witness_exit_ok_parses_sessions() -> Bool {
   match classify_tmux_session_list(exit_ok: true, stdout: output, stderr: "") {
     TmuxSessionsListed { entries } =>
       count(entries) == 2
-        && entries.first().session_name == "alpha"
-        && entries.first().windows == 1
-        && entries.skip(n: 1).first().session_name == "beta"
-        && entries.skip(n: 1).first().windows == 2
+        && (match entries.first() {
+            Present { value: v } => v.session_name == "alpha"
+            Absent => false
+          })
+        && (match entries.first() {
+            Present { value: v } => v.windows == 1
+            Absent => false
+          })
+        && (match entries.skip(n: 1).first() {
+            Present { value: v } => v.session_name == "beta"
+            Absent => false
+          })
+        && (match entries.skip(n: 1).first() {
+            Present { value: v } => v.windows == 2
+            Absent => false
+          })
     TmuxNoServer { evidence: _ } => false
     TmuxListUnknowable { stderr: _ } => false
     TmuxListStdoutRefused { line_number: _, raw: _, reason: _ } => false
@@ -102,7 +114,10 @@ test fn witness_ls_output_parse_matches_classifier() -> Bool {
   match parse_tmux_ls_output(output: output) {
     TmuxLsParsed { entries } =>
       count(entries) == 1
-        && entries.first().session_name == "gunbc-dispatch-node-4"
+        && (match entries.first() {
+            Present { value: v } => v.session_name == "gunbc-dispatch-node-4"
+            Absent => false
+          })
     TmuxLsParseRefused { line_number: _, raw: _, reason: _ } => false
   }
 }
diff --git a/dag/test/claim/transport_emission_not_modeled_witness_test.dag b/dag/test/claim/transport_emission_not_modeled_witness_test.dag
index 56ab6bc2bf3..129884b024d 100644
--- a/dag/test/claim/transport_emission_not_modeled_witness_test.dag
+++ b/dag/test/claim/transport_emission_not_modeled_witness_test.dag
@@ -58,6 +58,16 @@ data unmodeled_output_key_source: String = "module tfx_key\nservice Fk \{\n  ope
 
 data payload_verb_without_content_source: String = "module tfx_payload\nservice Fp \{\n  operation Read \{\n    input \{ path: String \}\n    output \{ content: String from \"content\" \}\n    readonly\n    transport file \{ path: \"\{path\}\" \}\n  \}\n  operation Seal \{\n    input \{ path: String \}\n    output \{ success: Bool from \"write_success\" \}\n    transport file \{ path: \"\{path\}\", verb: \"write_owner_only\" \}\n  \}\n\}\n"
 
+// The rust shell handler now realizes the declared stderr capture channels
+// (truncation + both byte counts) from WitnessStderrCapturePolicy. The mixed
+// row keeps the unmodeled-key RED beside that emission so a handler that
+// answered every sibling, or a wall that poisoned every sibling, still fails.
+data shell_stderr_capture_source: String = "module tfx_cap\nimport std.shell_stream_capture \{ WitnessStderrCapturePolicy, BoundedTail \}\nimport std.measure \{ byte_size \}\nservice Bin \{\n  operation Run \{\n    input \{\n      bin_path: String\n      stderr_capture: WitnessStderrCapturePolicy = BoundedTail \{ bytes: byte_size(count: 16) \}\n    \}\n    output \{\n      success: Bool from \"exit_success\"\n      stderr: String from \"stderr\"\n      stderr_truncated: Bool from \"stderr_truncated\"\n      stderr_total_bytes: Int from \"stderr_total_bytes\"\n      stderr_retained_bytes: Int from \"stderr_retained_bytes\"\n    \}\n    transport shell \{ argv: [\"\{bin_path\}\"] \}\n  \}\n\}\n"
+
+data shell_stderr_capture_beside_unmodeled_key_source: String = "module tfx_cap_mix\nimport std.shell_stream_capture \{ WitnessStderrCapturePolicy, BoundedTail \}\nimport std.measure \{ byte_size \}\nservice Bin \{\n  operation Run \{\n    input \{\n      bin_path: String\n      stderr_capture: WitnessStderrCapturePolicy = BoundedTail \{ bytes: byte_size(count: 16) \}\n    \}\n    output \{\n      success: Bool from \"exit_success\"\n      stderr_truncated: Bool from \"stderr_truncated\"\n      stderr_total_bytes: Int from \"stderr_total_bytes\"\n      stderr_retained_bytes: Int from \"stderr_retained_bytes\"\n    \}\n    transport shell \{ argv: [\"\{bin_path\}\"] \}\n  \}\n  operation Weird \{\n    input \{ bin_path: String \}\n    output \{ digest: String from \"stderr_digest_hex\" \}\n    transport shell \{ argv: [\"\{bin_path\}\"] \}\n  \}\n\}\n"
+
+data shell_stderr_capture_without_policy_input_source: String = "module tfx_cap_nop\nservice Bin \{\n  operation Run \{\n    input \{ bin_path: String \}\n    output \{\n      success: Bool from \"exit_success\"\n      stderr_truncated: Bool from \"stderr_truncated\"\n    \}\n    transport shell \{ argv: [\"\{bin_path\}\"] \}\n  \}\n\}\n"
+
 fn not_modeled_blocking_count(source: String) -> Int {
   match compile_dag_diagnostic_census(source) {
     CensusObserved { rows: rows } =>
@@ -104,3 +114,19 @@ test fn w_unmodeled_output_channel_refuses_only_its_own_operation() -> Bool {
 test fn w_payload_verb_without_content_input_refuses_only_its_own_operation() -> Bool {
   not_modeled_blocking_count(source: payload_verb_without_content_source) == 1
 }
+
+test fn w_declared_shell_stderr_capture_channels_emit() -> Bool {
+  not_modeled_blocking_count(source: shell_stderr_capture_source) == 0
+}
+
+test fn w_declared_shell_stderr_capture_module_is_clean_of_all_blocking_diagnostics() -> Bool {
+  blocking_diagnostic_count(source: shell_stderr_capture_source) == 0
+}
+
+test fn w_unmodeled_shell_channel_refuses_beside_realized_capture_channels() -> Bool {
+  not_modeled_blocking_count(source: shell_stderr_capture_beside_unmodeled_key_source) == 1
+}
+
+test fn w_capture_channel_without_stderr_capture_input_refuses() -> Bool {
+  not_modeled_blocking_count(source: shell_stderr_capture_without_policy_input_source) == 1
+}
diff --git a/dag/test/claim/v1_interpreter_primitive_roster_acceptance_test.dag b/dag/test/claim/v1_interpreter_primitive_roster_acceptance_test.dag
index e75dbb81390..4ec30f6ed7a 100644
--- a/dag/test/claim/v1_interpreter_primitive_roster_acceptance_test.dag
+++ b/dag/test/claim/v1_interpreter_primitive_roster_acceptance_test.dag
@@ -42,7 +42,6 @@ fn known_dispatch_sites_contribute_rows() -> Bool {
     "eval_algebra_method_inner",
     "eval_call",
     "try_v2_std_collection_map_primitive_grounding",
-    "try_parse_table_memo_dispatch",
   ]
   symbols |> all(s => v1_interpreter_authored_roster_arms() |> any(r => r.dispatch_symbol == s))
 }
diff --git a/dag/test/claim/v1_interpreter_primitive_surface_witness_test.dag b/dag/test/claim/v1_interpreter_primitive_surface_witness_test.dag
index ffcd82ce880..b166e16464d 100644
--- a/dag/test/claim/v1_interpreter_primitive_surface_witness_test.dag
+++ b/dag/test/claim/v1_interpreter_primitive_surface_witness_test.dag
@@ -60,7 +60,6 @@ test fn every_derived_site_contributes_rows() -> Bool {
     "eval_algebra_method_inner",
     "eval_call",
     "try_v2_std_collection_map_primitive_grounding",
-    "try_parse_table_memo_dispatch",
   ]
   symbols |> all(s => v1_interpreter_authored_roster_arms() |> any(r => r.dispatch_symbol == s))
 }
diff --git a/dag/test/claim/v1_source_audit_witness_test.dag b/dag/test/claim/v1_source_audit_witness_test.dag
index 21b7dcb0a93..24b28ec4c1f 100644
--- a/dag/test/claim/v1_source_audit_witness_test.dag
+++ b/dag/test/claim/v1_source_audit_witness_test.dag
@@ -113,8 +113,9 @@ test fn emit_handles_for_loop() -> Bool {
   src_has(emit_rust_path, "emit_typed_for_each")
 }
 
-test fn emit_generates_cargo_toml() -> Bool {
-  src_has(emit_rust_path, "emit_cargo_toml")
+test fn emit_returns_its_rust_crate_facts() -> Bool {
+  src_has(emit_rust_path, "rust_crates: [rust_crate]")
+    && src_lacks(emit_rust_path, "fn emit_cargo_toml(")
 }
 
 test fn emit_has_tco_support() -> Bool {
diff --git a/dag/test/claim/variant_literal_expected_application_witness_test.dag b/dag/test/claim/variant_literal_expected_application_witness_test.dag
new file mode 100644
index 00000000000..eae2cec9a55
--- /dev/null
+++ b/dag/test/claim/variant_literal_expected_application_witness_test.dag
@@ -0,0 +1,18 @@
+module test.claim.variant_literal_expected_application_witness_test
+
+import std.types { Bool }
+
+// A variant literal of a generic owner takes the expected APPLICATION of that owner as its type
+// (v1.compiler.infer variant_literal_expected_application). The specimen is the shape of
+// extdeps.dns.domain_name parse_dns_label_list: a fold in result position seeded with a bare
+// constructor, whose step pushes onto the accumulator's payload. Typed as the uninstantiated
+// declaration, the payload binding carried the formal `ok` and the pipe reached the emitter as a
+// plain `.list_push(` method no Rust type has (E0599). Typed as the declared return's application,
+// the payload is a List and the pipe lowers to the runtime list primitive. The excluded
+// `Outcome<ok, err>` keeps the declaration's formals from reappearing anywhere in the module.
+
+data vlea_fold_source: String = "module vlea_fold\n\ntype Outcome<ok, err> = Good \{ value: ok } | Bad \{ value: err }\n\nfn collect_nonempty(xs: List<String>) -> Outcome<List<String>, String> \{\n  fold(xs, init: Good \{ value: [] }, f: (acc, x) => match acc \{\n    Bad \{ value: e } => Bad \{ value: e }\n    Good \{ value: items } => if x == \"\" \{ Bad \{ value: \"empty\" } } else \{ Good \{ value: items |> list_push(x) } }\n  })\n}\n"
+
+test fn a_constructor_seeded_fold_in_result_position_takes_the_declared_application() -> Bool {
+  compile_dag_rust_emit_check(vlea_fold_source, "src/vlea_fold.rs", ["rc_list_push("], [".list_push(", "Outcome<ok, err>"])
+}
diff --git a/dag/test/claim/vllm_engine_args_render_witness_test.dag b/dag/test/claim/vllm_engine_args_render_witness_test.dag
index 78222a6b5c4..6b3faf74f80 100644
--- a/dag/test/claim/vllm_engine_args_render_witness_test.dag
+++ b/dag/test/claim/vllm_engine_args_render_witness_test.dag
@@ -55,7 +55,13 @@ test fn an_explicit_utilization_renders_the_flag_and_its_value() -> Bool {
     utilization: Present { value: basis_point(count: 9200) },
     kv_cache_bytes: none,
   })
-  length(argv) == 2 && argv.first() == "--gpu-memory-utilization" && argv.skip(n: 1).first() == "0.92"
+  length(argv) == 2 && (match argv.first() {
+      Present { value: v } => v == "--gpu-memory-utilization"
+      Absent => false
+    }) && (match argv.skip(n: 1).first() {
+      Present { value: v } => v == "0.92"
+      Absent => false
+    })
 }
 
 // EXPLICIT KV BYTES RENDER AS AN EXACT INTEGER, never as a rounded rendering: this is the one term in
@@ -65,7 +71,13 @@ test fn explicit_kv_bytes_render_exactly() -> Bool {
     utilization: none,
     kv_cache_bytes: Present { value: byte_size(count: 23372437156) },
   })
-  length(argv) == 2 && argv.first() == "--kv-cache-memory" && argv.skip(n: 1).first() == "23372437156"
+  length(argv) == 2 && (match argv.first() {
+      Present { value: v } => v == "--kv-cache-memory"
+      Absent => false
+    }) && (match argv.skip(n: 1).first() {
+      Present { value: v } => v == "23372437156"
+      Absent => false
+    })
 }
 
 // ── PREFIX CACHING: THREE STATES, THREE RENDERINGS ─────────────────────────────────────────────
@@ -79,10 +91,16 @@ test fn an_omitted_prefix_caching_request_renders_no_flag() -> Bool {
 
 test fn an_explicit_prefix_caching_request_renders_the_flag_the_pair_route_sends() -> Bool {
   let argv = vllm_prefix_caching_argv(r: PrefixCachingExplicit { enabled: true })
-  length(argv) == 1 && argv.first() == "--enable-prefix-caching"
+  length(argv) == 1 && (match argv.first() {
+      Present { value: v } => v == "--enable-prefix-caching"
+      Absent => false
+    })
 }
 
 test fn an_explicit_disable_renders_the_negative_flag_rather_than_silence() -> Bool {
   let argv = vllm_prefix_caching_argv(r: PrefixCachingExplicit { enabled: false })
-  length(argv) == 1 && argv.first() == "--no-enable-prefix-caching"
+  length(argv) == 1 && (match argv.first() {
+      Present { value: v } => v == "--no-enable-prefix-caching"
+      Absent => false
+    })
 }
diff --git a/dag/test/claim/vllm_memory_receipt_witness_test.dag b/dag/test/claim/vllm_memory_receipt_witness_test.dag
index 53c05cd9f3b..7e84e0b7e45 100644
--- a/dag/test/claim/vllm_memory_receipt_witness_test.dag
+++ b/dag/test/claim/vllm_memory_receipt_witness_test.dag
@@ -1,9 +1,9 @@
 module test.claim.vllm_memory_receipt
 
+import gunbc.spark.fabric_switch_observed { FabricGroupB, FabricGroup }
 import std.logic { Bool }
 import std.types { String, NonEmptyStr, EpochSecs }
 import std.content_hash { ContentHash, Sha256Hash, Sha256Digest, Sha256DigestHex, content_hash_of_value }
-import gunbc.spark.fabric_switch_observed { FabricGroupA }
 import gunbc.spark.vllm_serving_launch { VllmServingLaunch, vllm_serving_launch }
 import gunbc.spark.serving_deployment_selection { ServingExecutionProfile }
 import gunbc.spark.glm_canary_converge { glm_canary_arm, glm_canary_execution_profile }
@@ -32,7 +32,7 @@ data w_digest_hex: String = "444444444444444444444444444444444444444444444444444
 
 fn w_launch(invocation: String) -> VllmServingLaunch {
   vllm_serving_launch(
-    group: FabricGroupA,
+    group: FabricGroupB {},
     head: operator_host_srv9,
     systemd_invocation: invocation as NonEmptyStr,
     container_id: "glm-canary" as NonEmptyStr,
diff --git a/dag/test/claim/witness_deferral_freeze_witness_test.dag b/dag/test/claim/witness_deferral_freeze_witness_test.dag
index efedc35db53..27d0b8e9276 100644
--- a/dag/test/claim/witness_deferral_freeze_witness_test.dag
+++ b/dag/test/claim/witness_deferral_freeze_witness_test.dag
@@ -273,15 +273,15 @@ test fn witness_deferral_freeze_live_roster_is_well_formed() -> Bool {
 
 test fn witness_deferral_freeze_commit_roster_enrollment_admits() -> Bool {
   witness_has_executing_consumer_for_row(
-    entry: "src/v2/test/claim/long/parse_table_memo_governed_witness_test.dag",
-    function: "witness_content_key_subject_stable"
+    entry: "src/v2/test/claim/long/parse_binding_fidelity_witness_test.dag",
+    function: "witness_resolve_distinct_param_bindings_holds"
   )
 }
 
 test fn witness_deferral_freeze_commit_roster_row_is_not_frozen() -> Bool {
   !frozen_path_deferral_covers(
-    entry: "src/v2/test/claim/long/parse_table_memo_governed_witness_test.dag",
-    function: "witness_content_key_subject_stable"
+    entry: "src/v2/test/claim/long/parse_binding_fidelity_witness_test.dag",
+    function: "witness_resolve_distinct_param_bindings_holds"
   )
 }
 
diff --git a/dag/test/claim/worker_turn_dispatch_witness_test.dag b/dag/test/claim/worker_turn_dispatch_witness_test.dag
new file mode 100644
index 00000000000..2280b8a2026
--- /dev/null
+++ b/dag/test/claim/worker_turn_dispatch_witness_test.dag
@@ -0,0 +1,172 @@
+module test.claim.worker_turn_dispatch_witness_test
+
+import std.types { Bool, List, NonEmptyStr, String }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import std.optional { Present, Absent }
+import gunbc.roadmap_model { RoadmapNodeId }
+import gunbc.roadmap_launch_admission { launch_identity_exemplar }
+import gunbc.roadmap_belt_actuate { belt_snapshot_disposition, SnapshotConsumedByChild, SnapshotDiscardRequired, SpawnFailed }
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, srv1_live_dashboard_instance, srv2_lab_dashboard_instance }
+import gunbc.roadmap_dispatch_actuator {
+  DispatchProviderInnerArgv,
+  DispatchProviderInnerArgvReady,
+  CodexProviderExecutableAbsent,
+  CursorProviderOffCustodyHost,
+  CursorProviderCredentialUnbound,
+  CodexProviderOffCustodyHost,
+  ClaudeProviderCredentialUnbound,
+  GunbcHarnessSpawnNeedsInstance,
+  CursorDispatchProvider,
+  CodexDispatchProvider,
+  DispatchCliProvider,
+  dispatch_provider_inner_argv_for_instance,
+  dispatch_credential_snapshot_path_for_instance,
+}
+import extdeps.llm.cli { ReasoningMedium, ProviderAccountDefaultModel }
+import gunbc.cursor_harness_credential { cursor_worker_turn_api_key_host_path }
+import gunbc.codex_harness_credential { codex_harness_turn_lock_path, codex_worker_turn_codex_home }
+import gunbc.host_layout { srv2_roadmap_codex_home }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE PRODUCTION SPAWN FOLD for a dashboard instance, with nothing supplied but the instance: these
+// claims exercise dispatch_provider_inner_argv_for_instance over the declared srv1 and srv2 instances,
+// so a change that sends a Cursor or Codex turn to an ambient login, or to a host that does not hold
+// the credential, reds here.
+fn inner_for(instance: HostDashboardInstance, provider: DispatchCliProvider) -> DispatchProviderInnerArgv {
+  dispatch_provider_inner_argv_for_instance(
+    instance: instance,
+    provider: provider,
+    effort: ReasoningMedium,
+    model: ProviderAccountDefaultModel,
+    session_uuid: "00000000-0000-4000-8000-000000000000",
+    node_id: "node-worker-turn" as NonEmptyStr as RoadmapNodeId,
+    attempt_key: "0123456789abcdef",
+    worktree_path: "/tmp/w",
+    brief: "brief",
+    alignment_chain_fingerprint: "fp",
+  )
+}
+
+fn ready_argv(inner: DispatchProviderInnerArgv) -> List<String>? {
+  match inner {
+    DispatchProviderInnerArgvReady { argv } => Present { value: argv }
+    CodexProviderExecutableAbsent { reason: _ } => none
+    CursorProviderOffCustodyHost { reason: _ } => none
+    CursorProviderCredentialUnbound { reason: _ } => none
+    CodexProviderOffCustodyHost { reason: _ } => none
+    ClaudeProviderCredentialUnbound { reason: _ } => none
+    GunbcHarnessSpawnNeedsInstance { reason: _ } => none
+  }
+}
+
+fn first_word_is(argv: List<String>, word: String) -> Bool {
+  match argv.first() {
+    Present { value: w } => w == word
+    Absent => false
+  }
+}
+
+fn has_pair(argv: List<String>, flag: String, value: String) -> Bool {
+  string_contains(s: join(argv, separator: "\0"), pattern: join(["\0", flag, "\0", value], ""))
+}
+
+// THE CURSOR ROUTE on the custody host: the key is exported inside the child from the attempt's
+// credential snapshot, never the mutable custody file (the shared sh wrapper is the first word and the
+// snapshot path is its argument), the agent runs
+// unattended in print mode against the attempt worktree, and no word of the argv is --api-key.
+test fn a_cursor_turn_on_srv2_binds_the_custody_key_through_the_env_wrapper() -> Bool {
+  match ready_argv(inner: inner_for(instance: srv2_lab_dashboard_instance(), provider: CursorDispatchProvider)) {
+    Absent => false
+    Present { value: argv } =>
+      first_word_is(argv: argv, word: "sh")
+        && any(argv, a => a == dispatch_credential_snapshot_path_for_instance(
+             instance: srv2_lab_dashboard_instance(),
+             node_id: "node-worker-turn" as NonEmptyStr as RoadmapNodeId,
+             attempt_key: "0123456789abcdef",
+             provider: CursorDispatchProvider,
+           ) as String)
+        && !any(argv, a => a == cursor_worker_turn_api_key_host_path as String)
+        && any(argv, a => a == "cursor-agent")
+        && any(argv, a => a == "--print")
+        && any(argv, a => a == "--force")
+        && any(argv, a => a == "--trust")
+        && has_pair(argv: argv, flag: "--sandbox", value: "enabled")
+        && has_pair(argv: argv, flag: "--workspace", value: "/tmp/w")
+        && !any(argv, a => a == "--api-key")
+  }
+}
+
+test fn a_cursor_turn_off_its_custody_host_refuses() -> Bool {
+  match inner_for(instance: srv1_live_dashboard_instance(), provider: CursorDispatchProvider) {
+    CursorProviderOffCustodyHost { reason } => string_contains(s: reason as String, pattern: "srv2")
+    CursorProviderCredentialUnbound { reason: _ } => false
+    DispatchProviderInnerArgvReady { argv: _ } => false
+    CodexProviderExecutableAbsent { reason: _ } => false
+    CodexProviderOffCustodyHost { reason: _ } => false
+    ClaudeProviderCredentialUnbound { reason: _ } => false
+    GunbcHarnessSpawnNeedsInstance { reason: _ } => false
+  }
+}
+
+// THE CODEX ROUTE on the custody host: the whole command runs under the exclusive non-blocking flock
+// on the custody lock, with conflict exit 75, and CODEX_HOME is the custody directory -- never the
+// instance's ambient roadmap login, which is the arm this replaced.
+test fn a_codex_turn_on_srv2_runs_under_the_flock_on_the_custody_codex_home() -> Bool {
+  match inner_for(instance: srv2_lab_dashboard_instance(), provider: CodexDispatchProvider) {
+    DispatchProviderInnerArgvReady { argv } =>
+      first_word_is(argv: argv, word: "flock")
+        && any(argv, a => a == "--exclusive")
+        && any(argv, a => a == "--nonblock")
+        && has_pair(argv: argv, flag: "--conflict-exit-code", value: "75")
+        && any(argv, a => a == codex_harness_turn_lock_path as String)
+        && any(argv, a => a == concat("CODEX_HOME=", codex_worker_turn_codex_home as String))
+        && !any(argv, a => a == concat("CODEX_HOME=", srv2_roadmap_codex_home as String))
+    CodexProviderExecutableAbsent { reason: _ } => false
+    CursorProviderOffCustodyHost { reason: _ } => false
+    CursorProviderCredentialUnbound { reason: _ } => false
+    CodexProviderOffCustodyHost { reason: _ } => false
+    ClaudeProviderCredentialUnbound { reason: _ } => false
+    GunbcHarnessSpawnNeedsInstance { reason: _ } => false
+  }
+}
+
+test fn a_codex_turn_off_its_custody_host_refuses() -> Bool {
+  match inner_for(instance: srv1_live_dashboard_instance(), provider: CodexDispatchProvider) {
+    CodexProviderOffCustodyHost { reason } => string_contains(s: reason as String, pattern: "srv2")
+    DispatchProviderInnerArgvReady { argv: _ } => false
+    CodexProviderExecutableAbsent { reason: _ } => false
+    CursorProviderOffCustodyHost { reason: _ } => false
+    CursorProviderCredentialUnbound { reason: _ } => false
+    ClaudeProviderCredentialUnbound { reason: _ } => false
+    GunbcHarnessSpawnNeedsInstance { reason: _ } => false
+  }
+}
+
+// THE CURSOR ABANDONMENT CONTROL. The snapshot the cursor spawn loads is the provider-labelled path
+// the belt discards for every post-selection outcome but a launched child
+// (gunbc.roadmap_belt_actuate belt_snapshot_owned_outcome), and the spawn's wrapper refuses the exec
+// (exit 79) when it cannot remove that snapshot. If the cursor spawn read any other path, the belt's
+// discard would miss it and an abandoned attempt would leave the key on disk.
+test fn an_abandoned_cursor_attempt_leaves_no_snapshot_the_belt_does_not_discard() -> Bool {
+  let belt_path = dispatch_credential_snapshot_path_for_instance(
+    instance: srv2_lab_dashboard_instance(),
+    node_id: "node-worker-turn" as NonEmptyStr as RoadmapNodeId,
+    attempt_key: "0123456789abcdef",
+    provider: CursorDispatchProvider,
+  )
+  let id = launch_identity_exemplar()
+  let abandoned_discards = match belt_snapshot_disposition(
+    outcome: SpawnFailed { node_id: "node-worker-turn", step: "cursor-provider-preflight", detail: "refused", provider: "cursor", launch: id },
+  ) {
+    SnapshotDiscardRequired => true
+    SnapshotConsumedByChild => false
+  }
+  match ready_argv(inner: inner_for(instance: srv2_lab_dashboard_instance(), provider: CursorDispatchProvider)) {
+    Absent => false
+    Present { value: argv } =>
+      abandoned_discards
+        && any(argv, a => a == belt_path as String)
+        && any(argv, a => string_contains(s: a, pattern: "|| exit 79"))
+  }
+}
diff --git a/dag/test/claim/worker_turn_standing_witness_test.dag b/dag/test/claim/worker_turn_standing_witness_test.dag
new file mode 100644
index 00000000000..56d7e45f269
--- /dev/null
+++ b/dag/test/claim/worker_turn_standing_witness_test.dag
@@ -0,0 +1,192 @@
+module test.claim.worker_turn_standing_witness_test
+
+import std.types { Bool, List, NonEmptyStr, String, FilePath }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import std.optional { Present, Absent }
+import std.claim_evidence { RecordedFactId }
+import gunbc.roadmap_model { RoadmapNodeId }
+import gunbc.roadmap_dashboard_instance { srv1_live_dashboard_instance, srv2_lab_dashboard_instance }
+import gunbc.codex_app_server_press { parse_account_trip_stdout_for_tests, CodexAccountStandingEvidence }
+import gunbc.provider_standing_probe_bridge { provider_standing_bundle_from_codex_account_evidence }
+import gunbc.provider_standing {
+  ProviderStanding,
+  ProviderStandingUnobserved,
+  ProviderStandingFromFact,
+  InstallationReady,
+  ToolEnvironmentReady,
+  LimitDispatchDrawAutomatic,
+  provider_standing_from_observed_bundle,
+  provider_standing_is_selection_eligible,
+}
+import gunbc.dispatch_selection {
+  ProviderInventory,
+  OfferCodex,
+  OfferClaude,
+  OfferCursor,
+  provider_inventory_for_instance,
+  inventory_with_observed_standing,
+  inventory_with_codex_state_root,
+  resolve_dispatch_selection,
+  provider_selection_request_for_kind,
+  DispatchSelectionResolved,
+  DispatchSelectionRefused,
+  NoDerivedSizingExpectation,
+  dispatch_codex_process_fingerprint_unobserved_selection_refusal,
+}
+import extdeps.llm.cli_lifecycle { CodexCliProvider, ProviderInstance }
+import gunbc.codex_harness_credential { codex_harness_credential_context, codex_worker_turn_codex_home }
+import gunbc.cursor_harness_credential { cursor_status_reading }
+import gunbc.worker_turn_standing { cursor_standing_from_status, cursor_entitlement_trip_pending_reason }
+import gunbc.roadmap_dispatch_actuator {
+  dispatch_actuator_worker_turn_selection_observed,
+  DispatchActuatorSelectionOk,
+  DispatchActuatorSelectionRefused,
+  CodexDispatchProvider,
+  CursorDispatchProvider,
+}
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// SUPPLIED AT THE TRIP BOUNDARY: the account trip's stdout, in the wire shapes the press witnesses
+// already pin (test.claim.codex_app_server_press). The healthy trip is a chatgpt/pro account with
+// capacity left in the codex bucket; the exhausted one carries the live 2026-08-06 rateLimits
+// capture verbatim (usedPercent 100, rate_limit_reached). The inhabitance of the trip itself -- the
+// app-server run against the custody CODEX_HOME -- is the live exercise once custody lands.
+data initialize_line: String = "{\"jsonrpc\":\"2.0\",\"id\":1,\"result\":{\"userAgent\":\"x\"}}\n"
+data account_read_line: String = "{\"jsonrpc\":\"2.0\",\"id\":2,\"result\":{\"account\":{\"type\":\"chatgpt\",\"planType\":\"pro\",\"email\":\"REDACTED@example.invalid\"},\"requiresOpenaiAuth\":true}}\n"
+data rate_limits_capacity_line: String = "{\"jsonrpc\":\"2.0\",\"id\":3,\"result\":{\"rateLimits\":{\"limitId\":\"codex\",\"primary\":{\"usedPercent\":12},\"secondary\":{\"usedPercent\":3},\"spendControlReached\":false}}}\n"
+data rate_limits_exhausted_line: String = "{\"jsonrpc\":\"2.0\",\"id\":3,\"result\":{\"rateLimits\":{\"limitId\":\"codex\",\"limitName\":null,\"primary\":{\"usedPercent\":100,\"windowDurationMins\":10080,\"resetsAt\":1786159940},\"secondary\":null,\"spendControlReached\":false,\"planType\":\"pro\",\"rateLimitReachedType\":\"rate_limit_reached\"}}}\n"
+
+fn trip_evidence(rate_limits_line: String) -> CodexAccountStandingEvidence {
+  parse_account_trip_stdout_for_tests(stdout: concat(initialize_line, concat(account_read_line, rate_limits_line)))
+}
+
+fn observed_codex_standing(rate_limits_line: String) -> ProviderStanding {
+  match first_codex_instance(inventory: provider_inventory_for_instance(instance: srv2_lab_dashboard_instance())) {
+    Absent => ProviderStandingUnobserved { reason: "no codex offer on srv2 lab" as NonEmptyStr }
+    Present { value: provider } =>
+      provider_standing_from_observed_bundle(
+        fact_id: "witness-codex-harness-trip" as RecordedFactId,
+        provider: provider,
+        bundle: provider_standing_bundle_from_codex_account_evidence(
+          evidence: trip_evidence(rate_limits_line: rate_limits_line),
+          credential: codex_harness_credential_context(),
+          installation: InstallationReady,
+          tool_environment: ToolEnvironmentReady,
+        ),
+      )
+  }
+}
+
+fn first_codex_instance(inventory: ProviderInventory) -> ProviderInstance? {
+  fold(inventory.offers, init: none, f: (acc, offer) =>
+    match acc {
+      Present { value: _ } => acc
+      Absent =>
+        match offer {
+          OfferCodex { offer: o } => Present { value: o.instance }
+          OfferClaude { offer: _ } => acc
+          OfferCursor { offer: _ } => acc
+        }
+    }
+  )
+}
+
+fn codex_selection_reason(standing: ProviderStanding) -> String {
+  match resolve_dispatch_selection(
+    inventory: inventory_with_codex_state_root(
+      inventory: inventory_with_observed_standing(inventory: provider_inventory_for_instance(instance: srv2_lab_dashboard_instance()), kind: CodexCliProvider, standing: standing),
+      account_state_root: codex_worker_turn_codex_home as FilePath,
+    ),
+    request: provider_selection_request_for_kind(kind: CodexCliProvider),
+    sizing_expectation: NoDerivedSizingExpectation,
+  ) {
+    DispatchSelectionResolved { receipt: _ } => "RESOLVED"
+    DispatchSelectionRefused { sizing_expectation: _, requested_selection: _, reason } => reason as String
+  }
+}
+
+// THE OBSERVED STANDING REACHES SELECTION. A healthy custody trip makes the codex offer eligible, so
+// selection passes eligibility and stops at the next gate, the unobserved process fingerprint (kept by
+// operator ruling D1, 2026-10-05, until the wet tmux observation on srv2 is taken). The exhausted trip
+// is refused at eligibility instead, with a different reason. If the observation were not reaching
+// selection, the two would refuse for the same reason.
+test fn a_healthy_custody_trip_passes_eligibility_and_an_exhausted_one_does_not() -> Bool {
+  let healthy = codex_selection_reason(standing: observed_codex_standing(rate_limits_line: rate_limits_capacity_line))
+  let exhausted = codex_selection_reason(standing: observed_codex_standing(rate_limits_line: rate_limits_exhausted_line))
+  healthy == (dispatch_codex_process_fingerprint_unobserved_selection_refusal as String)
+    && exhausted != healthy
+    && exhausted != "RESOLVED"
+}
+
+test fn the_exhausted_custody_trip_is_not_selection_eligible_and_the_healthy_one_is() -> Bool {
+  provider_standing_is_selection_eligible(
+    standing: observed_codex_standing(rate_limits_line: rate_limits_capacity_line),
+    draw: LimitDispatchDrawAutomatic,
+  )
+    && !provider_standing_is_selection_eligible(
+      standing: observed_codex_standing(rate_limits_line: rate_limits_exhausted_line),
+      draw: LimitDispatchDrawAutomatic,
+    )
+}
+
+// THE CODEX OFFER IS JUDGED ON THE CUSTODY CODEX_HOME, not the instance's ambient account state root,
+// so changing the ambient login cannot change the verdict or the root the spawn binds.
+test fn the_observed_codex_offer_names_the_custody_codex_home() -> Bool {
+  let inventory = inventory_with_codex_state_root(
+    inventory: inventory_with_observed_standing(inventory: provider_inventory_for_instance(instance: srv2_lab_dashboard_instance()), kind: CodexCliProvider, standing: observed_codex_standing(rate_limits_line: rate_limits_capacity_line)),
+    account_state_root: codex_worker_turn_codex_home as FilePath,
+  )
+  any(inventory.offers, offer =>
+    match offer {
+      OfferCodex { offer: o } => (o.account_state_root as String) == (codex_worker_turn_codex_home as String)
+      OfferClaude { offer: _ } => false
+      OfferCursor { offer: _ } => false
+    })
+}
+
+// CURSOR: a rejected key refuses naming the rejection; an accepted key is still not selectable,
+// because entitlement waits on the one-word trip (D2). Neither arm is "available".
+data observed_unauthenticated_status: String = "{\n  \"status\": \"unauthenticated\",\n  \"isAuthenticated\": false,\n  \"hasAccessToken\": false,\n  \"hasRefreshToken\": false,\n  \"message\": \"Not logged in\"\n}"
+data supplied_authenticated_status: String = "{\"status\":\"authenticated\",\"isAuthenticated\":true}"
+
+test fn cursor_status_never_makes_the_offer_selectable_before_the_entitlement_trip() -> Bool {
+  let accepted = cursor_standing_from_status(reading: cursor_status_reading(stdout: supplied_authenticated_status))
+  let rejected = cursor_standing_from_status(reading: cursor_status_reading(stdout: observed_unauthenticated_status))
+  let accepted_pending = match accepted {
+    ProviderStandingUnobserved { reason } => reason == cursor_entitlement_trip_pending_reason
+    ProviderStandingFromFact { fact: _ } => false
+  }
+  let rejected_named = match rejected {
+    ProviderStandingUnobserved { reason } => string_contains(s: reason as String, pattern: "rejects")
+    ProviderStandingFromFact { fact: _ } => false
+  }
+  accepted_pending && rejected_named
+    && !provider_standing_is_selection_eligible(standing: accepted, draw: LimitDispatchDrawAutomatic)
+}
+
+// THE ROUTE, through the production actuator selection: on an instance that does not hold the
+// credentials, both observed draws refuse before any observation runs or any spawn is planned.
+test fn worker_turn_draws_on_a_non_custody_instance_refuse() -> Bool {
+  let codex = match dispatch_actuator_worker_turn_selection_observed(
+    instance: srv1_live_dashboard_instance(),
+    provider: CodexDispatchProvider,
+    node_id: "node-worker-turn" as NonEmptyStr as RoadmapNodeId,
+    attempt_key: "0123456789abcdef",
+    sizing_expectation: NoDerivedSizingExpectation,
+  ) {
+    DispatchActuatorSelectionRefused { reason: _ } => true
+    DispatchActuatorSelectionOk { provider: _, effort: _, model: _, process_fingerprint: _ } => false
+  }
+  let cursor = match dispatch_actuator_worker_turn_selection_observed(
+    instance: srv1_live_dashboard_instance(),
+    provider: CursorDispatchProvider,
+    node_id: "node-worker-turn" as NonEmptyStr as RoadmapNodeId,
+    attempt_key: "0123456789abcdef",
+    sizing_expectation: NoDerivedSizingExpectation,
+  ) {
+    DispatchActuatorSelectionRefused { reason: _ } => true
+    DispatchActuatorSelectionOk { provider: _, effort: _, model: _, process_fingerprint: _ } => false
+  }
+  codex && cursor
+}
diff --git a/dag/test/claim/workflow_dispatch_input_witness_test.dag b/dag/test/claim/workflow_dispatch_input_witness_test.dag
index ec9771b6864..e5d1b5e71c4 100644
--- a/dag/test/claim/workflow_dispatch_input_witness_test.dag
+++ b/dag/test/claim/workflow_dispatch_input_witness_test.dag
@@ -10,7 +10,7 @@ import v2.std.collection { Present, Absent }
 import gunbc.fleet_converge_workflow {
   fleet_converge_fabric_writer_identity_observe_receipt_if, fleet_converge_fabric_writer_identity_observe_step_if,
   FleetConvergeWorkflowMode, fleet_converge_workflow_modes, fleet_converge_workflow_mode_wire,
-  fleet_converge_mode_step_if, fleet_converge_mode_scope, fleet_converge_host_reset_return_job, fleet_converge_host_reset_return_step_if, fleet_converge_reset_observer_dispatch_admission_step,
+  fleet_converge_mode_step_if, fleet_converge_dashboard_deploy_step_if, fleet_converge_dashboard_deploy_job, fleet_converge_approval_broker_dark_install_job, fleet_converge_microvm_controller_install_job, fleet_converge_srv1_root_mutation_environment, fleet_converge_mode_scope, fleet_converge_host_reset_return_job, fleet_converge_host_reset_return_step_if, fleet_converge_reset_observer_dispatch_admission_step,
   ApprovalBrokerDarkInstall, fleet_converge_approval_broker_dark_install_step_if,
   FullHostPlan, LaunchEnvironmentPlan, AllocationStorePlan, WorkspaceCommissioningPlan, DashboardDeploy, HostResetReturn,
   fleet_converge_workspace_commissioning_plan_step, fleet_converge_any_plan_step_if,
@@ -22,14 +22,13 @@ import gunbc.fleet_converge_workflow {
   fleet_converge_in_job_compiler_pair_jobs, fleet_converge_mtcollins1_boot_pair_build_step,
   fleet_converge_microvm_network_observe_step, fleet_converge_mode_fleet_ssh_key_demand,
   MicrovmNetworkObserve, FleetSshKeyNotConsumed, FleetSshKeyConsumed,
-  fleet_converge_pair_serving_d0_step, fleet_converge_pair_serving_d0_admit_step, PairServingD0, SparkServingApply, SparkV41CheckpointMaterialize, SparkRuntimeImageProduce, SparkRuntimeImageProbe, SparkArmCheckpointMaterialize, SparkArmGroupLaunch, SparkArmGroupObserve, SparkNativeServingApply, FleetApply, ApprovalKeyringConverge, ApprovalBrokerDarkInstall, fleet_converge_mutation_group_for, ApprovalDeviceEnrolmentCodeIssue,
+  FleetApply, ApprovalKeyringConverge, ApprovalBrokerDarkInstall, fleet_converge_mutation_group_for, ApprovalDeviceEnrolmentCodeIssue,
   fleet_converge_mutation_concurrency_group_expression,
   fleet_converge_reset_subject_mutation_concurrency_group_expression, fleet_converge_reset_subject_map_json,
   reset_subject_map_json,
   fleet_converge_workflow, expected_fleet_converge_yml,
   FleetConvergeYamlGenerated, FleetConvergeYamlGenerationRefused,
-  fleet_converge_credential_prelude_steps, fleet_converge_mutation_concurrency_group_expression, fleet_converge_spark_v41_checkpoint_materialize_step,
-  fleet_converge_dispatch_inputs,
+  fleet_converge_dispatch_inputs, fleet_converge_dispatchable_modes, fleet_converge_spark_target_options,
 }
 import gunbc.host_reset_return {
   DispatchAssignment, DispatchAssignmentRefused, reset_dispatch_pairings,
@@ -37,9 +36,8 @@ import gunbc.host_reset_return {
   host_reset_observer_label_env,
 }
 import gunbc.host_reset_return_run { host_reset_dispatch_mode_env }
-import gunbc.ci_spec { gunbc_ci_host_reset_dispatch_admission_target, gunbc_ci_fleet_converge_apply_invoke, gunbc_ci_org_actions_inspect_invoke, gunbc_ci_spark_bootstrap_invoke, gunbc_ci_spark_serving_apply_invoke, gunbc_ci_approval_broker_dark_install_invoke, gunbc_ci_pair_serving_d0_invoke, gunbc_ci_sm_connect_timeout, gunbc_ci_sm_max_time, gunbc_ci_approval_keyring_converge_invoke, gunbc_ci_mtcollins1_boot_invoke, gunbc_ci_mtcollins1_fan_observe_invoke }
-import std.measure { minute_count, second_count }
-import gunbc.spark.pair_serving_d0_door { pair_serving_d0_step_timeout_minutes, d0_prelude_allowance, d0_approval_window, d0_transaction_allowance }
+import gunbc.ci_spec { gunbc_ci_host_reset_dispatch_admission_target, gunbc_ci_fleet_converge_apply_invoke, gunbc_ci_org_actions_inspect_invoke, gunbc_ci_spark_bootstrap_invoke, gunbc_ci_spark_serving_apply_invoke, gunbc_ci_approval_broker_dark_install_invoke, gunbc_ci_sm_max_time, gunbc_ci_approval_keyring_converge_invoke, gunbc_ci_mtcollins1_boot_invoke, gunbc_ci_mtcollins1_fan_observe_invoke }
+import std.measure { second_count }
 import gunbc.spark.pair_serving_apply { spark_pair_apply_receipt_path }
 import extdeps.languages.yaml.gha_workflow { workflow_trigger_entry }
 import extdeps.languages.yaml.types {
@@ -641,11 +639,17 @@ test fn the_browser_toolchain_mode_is_on_the_roster_with_distinct_wires() -> Boo
 // to a hand-kept list that merely happens to agree with it today. The join is both directions, so
 // a roster row with no option and an option with no row are both red.
 test fn every_dispatch_option_is_a_wire_value_of_the_vocabulary() -> Bool {
-  let wires = map(fleet_converge_workflow_modes, m => fleet_converge_workflow_mode_wire(mode: m))
+  let wires = map(fleet_converge_dispatchable_modes(), m => fleet_converge_workflow_mode_wire(mode: m))
   all(fleet_converge_mode_options, o => any(wires, w => w == o))
     && all(wires, w => any(fleet_converge_mode_options, o => o == w))
 }
 
+test fn empty_spark_roster_does_not_emit_an_empty_choice_or_spark_dispatch_modes() -> Bool {
+  count(fleet_converge_spark_target_options) == 0
+    && !any(fleet_converge_mode_options, o => o == "spark_grants")
+    && !any(fleet_converge_dispatch_inputs, i => i.name == "target")
+}
+
 // THE STEP CONDITION IS DERIVED, not spelled beside the option. The discriminating half is the
 // second conjunct: a projection that returned a constant, or ignored its argument, would satisfy the
 // first and fail this.
@@ -654,6 +658,15 @@ test fn a_step_condition_is_the_wire_value_of_the_mode_it_selects() -> Bool {
     && fleet_converge_mode_step_if(mode: FullHostPlan) != fleet_converge_mode_step_if(mode: DashboardDeploy)
 }
 
+test fn srv1_root_mutation_jobs_name_the_protected_environment() -> Bool {
+  let env = fleet_converge_srv1_root_mutation_environment as String
+  fleet_converge_dashboard_deploy_step_if == "github.event.inputs.mode == 'dashboard_deploy'"
+    && !string_contains(s: fleet_converge_dashboard_deploy_step_if, pattern: "github.ref")
+    && (match fleet_converge_dashboard_deploy_job().environment { Present { value: v } => v == env  Absent => false })
+    && (match fleet_converge_approval_broker_dark_install_job().environment { Present { value: v } => v == env  Absent => false })
+    && (match fleet_converge_microvm_controller_install_job().environment { Present { value: v } => v == env  Absent => false })
+}
+
 // DASHBOARD DEPLOYMENT IS EXPLICITLY OUTSIDE THE SCOPE PROJECTION, and this witness exists so that
 // changing it is a deliberate act with a red here rather than a quiet consequence of adding a member
 // to FleetConvergeScope. The three modes that DO name a scope are asserted beside it, so a projection
@@ -723,20 +736,6 @@ fn step_run_text(step: Step) -> String {
   }
 }
 
-// THE CREDENTIAL PRELUDE'S STEP IDS IN EMISSION ORDER, read as the value the job concatenates rather
-// than re-derived from the rendered workflow (DESIGN section 3: a witness discriminates at one
-// interface, and rendering the whole workflow to grep it costs the render for every substring asked).
-fn fleet_converge_credential_prelude_ids() -> List<String> {
-  map(fleet_converge_credential_prelude_steps(), st => step_id_text(step: st))
-}
-
-fn step_index(ids: List<String>, id: String) -> Int {
-  match first(flat_map(enumerate(ids), pair => if pair.second == id { [pair.first] } else { [] as List<Int> })) {
-    Present { value: i } => i
-    Absent => -1
-  }
-}
-
 fn microvm_network_step_env_text() -> String {
   match fleet_converge_microvm_network_observe_step() {
     RunStep { name: _, id: _, run: _, shell: _, env: e, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
@@ -786,111 +785,6 @@ test fn the_fabric_writer_identity_receipt_upload_survives_a_failed_observation(
     && !fleet_converge_fabric_writer_identity_observe_step_if.contains("always()")
 }
 
-// THE D0 DOOR MODE BINDS THE HOST, THE CONSENT AND THE EXPECTED REVISION INTO ITS ENVIRONMENT
-// (no group: the mode is Group A by construction), consumes the fleet ssh key (the transaction
-// reads the group's hosts), the consent is an INPUT, never the run id, the credential-free
-// admission step is emitted BEFORE the WIF token, the fleet key and the submission key, and the
-// job's concurrency domain for this mode is Group A's arm, which IS srv1's host key: shared with the
-// pair-serving apply on any executor and with every srv1 control-plane mutation (fleet apply,
-// keyring converge, dashboard deploy, broker install), distinct from Group B's native arm and from
-// other executors' domains.
-test fn the_pair_serving_d0_mode_binds_host_consent_and_revision_and_admits_before_credentials() -> Bool {
-  let env = step_env_text(step: fleet_converge_pair_serving_d0_step())
-  let admit_env = step_env_text(step: fleet_converge_pair_serving_d0_admit_step())
-  string_contains(s: env, pattern: "FLEET_CONVERGE_EXPECTED_HOST=$\{\{ github.event.inputs.host \}\}")
-    && string_contains(s: env, pattern: "GUNBC_D0_CONSENT=$\{\{ github.event.inputs.d0_consent \}\}")
-    && string_contains(s: env, pattern: "RLM_EXPECTED_REVISION=$\{\{ github.event.inputs.expected_revision \}\}")
-    && !string_contains(s: env, pattern: "d0_group")
-    && !string_contains(s: env, pattern: "github.run_id")
-    && string_contains(s: admit_env, pattern: "GUNBC_D0_CONSENT=")
-    && !string_contains(s: admit_env, pattern: "WIF_ACCESS_TOKEN")
-    && (match fleet_converge_mode_fleet_ssh_key_demand(mode: PairServingD0) { FleetSshKeyConsumed => true  FleetSshKeyNotConsumed => false })
-    && step_id_text(step: fleet_converge_pair_serving_d0_step()) == "pair_serving_d0"
-    && !any(fleet_converge_dispatch_inputs, i => i.name == "d0_group")
-}
-
-// THE SAME MODE'S ADMISSION ORDER, split out for the same reason as its concurrency domain: the
-// credential prelude is the whole job's step roster, a different subject from the step's environment.
-test fn the_pair_serving_d0_admission_runs_before_any_credential_step() -> Bool {
-  let ids = fleet_converge_credential_prelude_ids()
-  step_index(ids: ids, id: "pair_serving_d0_admit") >= 0
-    && step_index(ids: ids, id: "pair_serving_d0_admit") < step_index(ids: ids, id: "wif_auth")
-    && step_index(ids: ids, id: "pair_serving_d0") < 0
-}
-
-// THE SAME MODE'S CONCURRENCY DOMAIN, split from the environment claim above (DESIGN section 3: a
-// conjunction of independent cases is split when splitting loses no coverage -- the domain and the
-// environment are different subjects, and together they crossed the new-witness step budget).
-test fn the_pair_serving_d0_mode_shares_group_as_arm_domain_with_srv1_control_plane() -> Bool {
-  let group = fleet_converge_mutation_concurrency_group_expression
-  fleet_converge_mutation_group_for(mode: PairServingD0, host: "srv1", target: "srv5", run_id: "1") == fleet_converge_mutation_group_for(mode: SparkServingApply, host: "srv2", target: "srv5", run_id: "1")
-    && fleet_converge_mutation_group_for(mode: PairServingD0, host: "srv1", target: "srv5", run_id: "1") == fleet_converge_mutation_group_for(mode: FleetApply, host: "srv1", target: "srv5", run_id: "1")
-    && fleet_converge_mutation_group_for(mode: PairServingD0, host: "srv1", target: "srv5", run_id: "1") == fleet_converge_mutation_group_for(mode: ApprovalKeyringConverge, host: "srv1", target: "srv5", run_id: "1")
-    && fleet_converge_mutation_group_for(mode: PairServingD0, host: "srv1", target: "srv5", run_id: "1") == fleet_converge_mutation_group_for(mode: DashboardDeploy, host: "srv1", target: "srv5", run_id: "1")
-    && fleet_converge_mutation_group_for(mode: PairServingD0, host: "srv1", target: "srv5", run_id: "1") == fleet_converge_mutation_group_for(mode: ApprovalBrokerDarkInstall, host: "srv1", target: "srv5", run_id: "1")
-    && fleet_converge_mutation_group_for(mode: PairServingD0, host: "srv1", target: "srv5", run_id: "1") != fleet_converge_mutation_group_for(mode: SparkNativeServingApply, host: "srv1", target: "srv5", run_id: "1")
-    && fleet_converge_mutation_group_for(mode: PairServingD0, host: "srv1", target: "srv5", run_id: "1") != fleet_converge_mutation_group_for(mode: FleetApply, host: "srv2", target: "srv5", run_id: "1")
-    && string_contains(s: group, pattern: "github.event.inputs.mode == 'pair_serving_d0' && 'gunbc-host-mutation-srv1'")
-    && string_contains(s: group, pattern: "github.event.inputs.mode == 'spark_serving_apply' && 'gunbc-host-mutation-srv1'")
-}
-
-// THE CHECKPOINT MATERIALIZE MODE IS IN GROUP A'S ARM DOMAIN, NOT ITS EXECUTOR'S: whichever executor a
-// dispatch names, it queues behind D0 and the pair apply, and two dispatches for two Group A hosts
-// queue behind each other. The emitted step reads the target and runs the modeled entry.
-test fn the_v41_checkpoint_materialize_mode_serializes_on_group_a() -> Bool {
-  let step = fleet_converge_spark_v41_checkpoint_materialize_step()
-  fleet_converge_mutation_group_for(mode: SparkV41CheckpointMaterialize, host: "srv3", target: "srv5", run_id: "1") == fleet_converge_mutation_group_for(mode: PairServingD0, host: "srv1", target: "srv5", run_id: "1")
-    && fleet_converge_mutation_group_for(mode: SparkV41CheckpointMaterialize, host: "srv2", target: "srv5", run_id: "1") == fleet_converge_mutation_group_for(mode: SparkServingApply, host: "srv2", target: "srv5", run_id: "1")
-    && fleet_converge_mutation_group_for(mode: SparkV41CheckpointMaterialize, host: "srv2", target: "srv5", run_id: "1") != fleet_converge_mutation_group_for(mode: SparkNativeServingApply, host: "srv2", target: "srv5", run_id: "1")
-    && string_contains(s: fleet_converge_mutation_concurrency_group_expression, pattern: "github.event.inputs.mode == 'spark_v41_checkpoint_materialize' && 'gunbc-host-mutation-srv1'")
-    && step_id_text(step: step) == "spark_v41_checkpoint_materialize"
-    && string_contains(s: step_run_text(step: step), pattern: "--function v41_checkpoint_materialize_ci_wet")
-}
-
-// THE IMAGE PRODUCE AND THE CHECKPOINT MATERIALIZE ARE KEYED BY THEIR TARGET (operator ruling,
-// 2026-10-03): two targets run side by side, one target queues, and neither joins the executor's key
-// or the shared Group A key the launch and D0 hold -- the per-host claim inside each mode is the fence.
-// The probe stays keyed to its executor. The read-only observe is keyed by its own run, so no other
-// dispatch can supersede it, and the launch keeps the shared key.
-test fn the_produce_and_materialize_key_by_target_and_the_observe_by_its_own_run() -> Bool {
-  let expression = fleet_converge_mutation_concurrency_group_expression
-  let d0 = fleet_converge_mutation_group_for(mode: PairServingD0, host: "srv1", target: "srv5", run_id: "1")
-  fleet_converge_mutation_group_for(mode: SparkRuntimeImageProduce, host: "srv1", target: "srv7", run_id: "1") == "gunbc-host-mutation-srv7"
-    && fleet_converge_mutation_group_for(mode: SparkArmCheckpointMaterialize, host: "srv1", target: "srv5", run_id: "1") == "gunbc-host-mutation-srv5"
-    && fleet_converge_mutation_group_for(mode: SparkRuntimeImageProduce, host: "srv1", target: "srv7", run_id: "1") != fleet_converge_mutation_group_for(mode: SparkArmCheckpointMaterialize, host: "srv1", target: "srv5", run_id: "2")
-    && fleet_converge_mutation_group_for(mode: SparkRuntimeImageProduce, host: "srv1", target: "srv7", run_id: "1") != d0
-    && fleet_converge_mutation_group_for(mode: SparkArmGroupLaunch, host: "srv1", target: "srv6", run_id: "1") == d0
-    && fleet_converge_mutation_group_for(mode: SparkArmGroupObserve, host: "srv1", target: "srv6", run_id: "1") != fleet_converge_mutation_group_for(mode: SparkArmGroupObserve, host: "srv1", target: "srv6", run_id: "2")
-    && fleet_converge_mutation_group_for(mode: SparkArmGroupObserve, host: "srv1", target: "srv6", run_id: "1") != d0
-    && fleet_converge_mutation_group_for(mode: SparkRuntimeImageProbe, host: "srv3", target: "srv5", run_id: "1") != fleet_converge_mutation_group_for(mode: SparkRuntimeImageProbe, host: "srv2", target: "srv5", run_id: "1")
-    && string_contains(s: expression, pattern: "github.event.inputs.mode == 'spark_runtime_image_produce' && format('gunbc-host-mutation-{0}', github.event.inputs.target)")
-    && string_contains(s: expression, pattern: "github.event.inputs.mode == 'spark_arm_group_observe' && format('gunbc-read-only-{0}', github.run_id)")
-    && string_contains(s: expression, pattern: "github.event.inputs.mode == 'spark_arm_group_launch' && 'gunbc-host-mutation-srv1'")
-}
-
-// THE OPERATIONAL BOUNDS ARE A MAINTAINED INTERFACE, NOT A ONE-HEAD TEXT: the emitted invocation
-// carries the Secret Manager connect and total bounds, the prelude allowance covers the total bound,
-// the step timeout is the sum of the window and the two allowances rounded up, and a key fetch that
-// fails does not stop the door (no set -e exit on the curl; the door decides).
-//
-// SPLIT FROM THE SIBLING-PRELUDE CLAIM BELOW, which was the same claim's last three conjuncts. As one
-// claim it reached FOUR separate invocation producers and rendered each in full: 91,527 eval steps
-// against the 72,300 new-witness budget, and it refused the floor once a change to this file made it a
-// changed witness -- it is in neither the floor_cost_debt roster nor the grandfathered one. DESIGN
-// section 3: a claim reaches too far the moment its subject stops being ONE interface, and the d0
-// door's own bounds and the shared producer's reach are two subjects, not one.
-test fn the_pair_serving_d0_invocation_is_bounded_and_the_step_timeout_is_the_declared_sum() -> Bool {
-  let inv = gunbc_ci_pair_serving_d0_invoke()
-  let secs = (second_count(s: d0_approval_window()) as Int) + (second_count(s: d0_transaction_allowance) as Int) + (second_count(s: d0_prelude_allowance) as Int)
-  string_contains(s: inv, pattern: join(["--connect-timeout ", to_string(second_count(s: gunbc_ci_sm_connect_timeout))], ""))
-    && string_contains(s: inv, pattern: join(["--max-time ", to_string(second_count(s: gunbc_ci_sm_max_time))], ""))
-    && second_count(s: d0_prelude_allowance) >= second_count(s: gunbc_ci_sm_max_time) + second_count(s: gunbc_ci_sm_connect_timeout)
-    && string_contains(s: inv, pattern: "if DEST_FILE=")
-    && string_contains(s: inv, pattern: "a held lifecycle resumes without it")
-    && (minute_count(m: pair_serving_d0_step_timeout_minutes()) as Int) == (secs + 59) / 60
-    && (minute_count(m: pair_serving_d0_step_timeout_minutes()) as Int) == 47
-}
-
 // THE SAME TOTAL BOUND REACHES EVERY PRELUDE THAT FETCHES A SECRET, because they consume one producer
 // -- and that is THREE producers, so it is three claims. Folding them into one was the defect that made
 // the parent claim expensive, and folding them into one NEW claim does not fix it: measured as a single
@@ -914,17 +808,15 @@ test fn the_mtcollins1_fan_observe_prelude_carries_the_shared_total_bound() -> B
 }
 
 // THE LOCK KEY IS THE MUTATED SUBJECT, NOT THE DISPATCH HOST, IN BOTH DIRECTIONS: the enrolment-code
-// issue (the approval device store alone) leaves srv1's key, so a Spark V4.1 or D0 dispatch can no
-// longer supersede a pending enrolment; two issues still share one group; and the keyring converge,
-// which D0 must serialise with, still shares D0's group. Reverting the mode's row to the executor
-// domain turns the first conjunct red.
-test fn the_enrolment_code_issue_is_keyed_to_its_store_and_the_keyring_stays_with_d0() -> Bool {
+// issue (the approval device store alone) leaves srv1's executor key, so a control-plane dispatch on
+// srv1 can no longer supersede a pending enrolment; two issues still share one group; and the keyring
+// converge still shares srv1's executor key. Reverting the mode's row to the executor domain turns the
+// first conjunct red.
+test fn the_enrolment_code_issue_is_keyed_to_its_store_and_the_keyring_stays_with_the_executor() -> Bool {
   let issue = fleet_converge_mutation_group_for(mode: ApprovalDeviceEnrolmentCodeIssue, host: "srv1", target: "srv1", run_id: "0")
-  issue != fleet_converge_mutation_group_for(mode: PairServingD0, host: "srv1", target: "srv1", run_id: "0")
-    && issue != fleet_converge_mutation_group_for(mode: SparkV41CheckpointMaterialize, host: "srv1", target: "srv1", run_id: "0")
-    && issue != fleet_converge_mutation_group_for(mode: SparkRuntimeImageProduce, host: "srv1", target: "srv1", run_id: "0")
+  issue != fleet_converge_mutation_group_for(mode: FleetApply, host: "srv1", target: "srv1", run_id: "0")
     && issue == fleet_converge_mutation_group_for(mode: ApprovalDeviceEnrolmentCodeIssue, host: "srv2", target: "srv2", run_id: "0")
-    && fleet_converge_mutation_group_for(mode: ApprovalKeyringConverge, host: "srv1", target: "srv1", run_id: "0") == fleet_converge_mutation_group_for(mode: PairServingD0, host: "srv1", target: "srv1", run_id: "0")
+    && fleet_converge_mutation_group_for(mode: ApprovalKeyringConverge, host: "srv1", target: "srv1", run_id: "0") == fleet_converge_mutation_group_for(mode: FleetApply, host: "srv1", target: "srv1", run_id: "0")
     && string_contains(s: fleet_converge_mutation_concurrency_group_expression, pattern: "github.event.inputs.mode == 'approval_device_enrolment_code_issue' && 'gunbc-subject-mutation-approval-device-store-srv1'")
 }
 
diff --git a/dag/test/claim/workspace_allocation_dispatch_witness_test.dag b/dag/test/claim/workspace_allocation_dispatch_witness_test.dag
new file mode 100644
index 00000000000..f0c2a6c9610
--- /dev/null
+++ b/dag/test/claim/workspace_allocation_dispatch_witness_test.dag
@@ -0,0 +1,46 @@
+module test.claim.workspace_allocation_dispatch_witness_test
+
+import std.types { Bool, String, NonEmptyStr }
+import gunbc.workspace_allocation_dispatch_transport { workspace_allocation_dispatch_result, workspace_allocation_dispatch_command }
+import gunbc.workspace_allocation_dispatch { workspace_allocation_prepare_cli, workspace_allocation_readback_cli }
+import gunbc.workspace_allocation_convergence { WorkspaceConvergenceObserved, WorkspaceConvergenceUnobserved }
+import gunbc.workspace_allocation_launch_directive { workspace_launch_directive_text, WorkspaceLaunchDirectiveReady }
+import gunbc.test.claim.workspace_launch_directive_witness_test { launch_fixture_allocation_in_slot, launch_fixture_directive }
+import gunbc.workspace_commissioning_dispatch_operations { workspace_dispatch_grant_content }
+
+fn dispatch_result_admits(host: NonEmptyStr, installed: NonEmptyStr) -> Bool {
+  match launch_fixture_allocation_in_slot(index: 13) {
+    Absent => false
+    Present { value: allocation } => match launch_fixture_directive(allocation: allocation) {
+      WorkspaceLaunchDirectiveReady { directive } => match workspace_allocation_dispatch_result(
+        text: workspace_launch_directive_text(directive: directive), host: host, release_dir: installed) {
+        WorkspaceConvergenceObserved { basis } => basis.owner_generation == 4 && basis.allocation == allocation
+        WorkspaceConvergenceUnobserved { reason: _ } => false
+      }
+      other => false
+    }
+  }
+}
+
+test fn installed_observation_binds_host_release_and_owner_generation() -> Bool {
+  dispatch_result_admits(host: "srv1", installed: "/opt/gunbc/controller/fixture-revision")
+    && !dispatch_result_admits(host: "srv2", installed: "/opt/gunbc/controller/fixture-revision")
+    && !dispatch_result_admits(host: "srv1", installed: "/opt/gunbc/controller/other-revision")
+}
+
+test fn installed_observation_refuses_empty_and_malformed_responses() -> Bool {
+  all(["", "not-json", "\{}"], text => match workspace_allocation_dispatch_result(
+    text: text, host: "srv1", release_dir: "/opt/gunbc/controller/fixture-revision") {
+    WorkspaceConvergenceUnobserved { reason: _ } => true
+    WorkspaceConvergenceObserved { basis: _ } => false
+  })
+}
+
+test fn runner_grants_reconcile_existing_intent_without_operator_write_authority() -> Bool {
+  let grants = workspace_dispatch_grant_content(release_dir: "/opt/gunbc/controller/fixture-revision")
+  string_contains(s: grants, pattern: "workspace_dispatch_allocation_plan_cli")
+    && string_contains(s: grants, pattern: "workspace_dispatch_allocation_readback_cli")
+    && !string_contains(s: grants, pattern: "workspace_operator_request")
+    && !string_contains(s: grants, pattern: "workspace_operator_release")
+    && !string_contains(s: grants, pattern: "state-writer-mac-key")
+}
diff --git a/dag/test/claim/workspace_checkpoint_instrument_witness_test.dag b/dag/test/claim/workspace_checkpoint_instrument_witness_test.dag
index d3d9bfe29e1..ee9f77f24de 100644
--- a/dag/test/claim/workspace_checkpoint_instrument_witness_test.dag
+++ b/dag/test/claim/workspace_checkpoint_instrument_witness_test.dag
@@ -5,6 +5,7 @@ import std.optional { Present, Absent }
 import std.algebra { Cons, Empty }
 import std.measure { byte_size, measure_count, Nanosecond, nanosecond, nanosecond_count }
 import std.content_hash { Sha256Digest, sha256_hex_digest }
+import v2.std.collection { Map, empty_map, map_insert }
 import std.fabric_blob { FabricBlobAddress }
 import std.fabric_storage { FabricObject, FabricStoredObject, FabricObjectFetched, FabricObjectGetRefused, FabricObjectMissing, fabric_object_ref_of, fabric_object_ref_eq }
 import std.durable_compare_and_set { cas_generation_first }
@@ -24,12 +25,16 @@ import gunbc.auth.access_token_source { WorkloadIdentityToken }
 import gunbc.fabric_storage_r2_head { R2HeadCredential, r2_head_binding, R2HeadCasNotGrounded, R2HeadAdvanceKnown, R2HeadAdvancedTo, R2HeadStagingCustody }
 import gunbc.fabric.workspace_source {
   WorkspaceSourceRoot, workspace_credential_exclusions, workspace_exclusions, workspace_path_exclusion, workspace_source_tally,
-  workspace_pack_readback, WorkspacePackClean, WorkspacePackCarriesExcluded,
+  workspace_pack_readback, WorkspacePackReadback, WorkspacePackClean, WorkspacePackCarriesExcluded, WorkspacePackPlaceholderAbsent, WorkspacePackPlaceholderSizeDiffers,
+  WorkspacePackPlaceholderNotRegular, WorkspacePackPlaceholderUnread, WorkspacePackPlaceholderDigestDiffers, WorkspaceStagedPlaceholder,
+  workspace_transcript_caveat,
+  workspace_observed_agent_state_slots, workspace_agent_state_slot_admission, workspace_agent_state_slot_words,
+  AgentStateSlotAdmitted, AgentStateSlotAbsent, AgentStateSlotUnknown,
 }
 import gunbc.fabric.workspace_checkpoint_instrument {
   workspace_snapshot_capability, WorkspaceSnapshotBtrfs, WorkspaceSnapshotAbsent, WorkspaceSnapshotUnobserved,
   WorkspaceMeasuredPart, PartMeasured, PartUnmeasured, workspace_bound_verdict, BoundHolds, BoundExceeded, BoundUndecided,
-  workspace_quota_verdict, QuotaHolds, QuotaExceeded,
+  workspace_quota_verdict, QuotaHolds, QuotaExceeded, workspace_draft_verdict_lines, workspace_draft_numbers,
   workspace_instrument_commit, InstrumentCommitCasNotGrounded,
   WorkspaceCustody, workspace_custody_clean, workspace_custody_of_head_advance, workspace_exit_with_custody,
   WorkspaceRestoredFile, workspace_restore_compare, RestoreByteEqual, RestoreMissingFile, RestoreExtraFile, RestoreBytesDiffer, RestoreCarriesUncommittedChunk,
@@ -180,22 +185,195 @@ test fn the_tally_admits_only_unexcluded_non_build_files() -> Bool {
     && map(t.excluded_credential_members, m => m as String) == ["home/u/gunbc/.env", "home/u/gunbc/keys/id_rsa"]
     && t.excluded_transcripts == 2 && measure_count(m: t.excluded_transcript_bytes) == 5700
     && t.build_output == 1 && t.unparsed == []
+    && map(t.transcript_placeholders, p => join([p.member as String, "=", to_string(measure_count(m: p.size))], "")) == ["home/u/gunbc/projects/p/0d3a.jsonl=5000", "home/u/gunbc/history.jsonl=700"]
+}
+
+// A CREDENTIAL NEVER GETS A PLACEHOLDER, NOT EVEN ONE THAT ALSO LOOKS LIKE A TRANSCRIPT: credentials
+// are matched first, and only the TranscriptExclusion class mints a placeholder. A transcript
+// symlink carries no content to stand in for, so it gets none either.
+test fn a_credential_class_member_never_gets_a_placeholder() -> Bool {
+  let listing = join([
+    "f\t600\t.credentials.json\t\t450",
+    "f\t600\tprojects/p/.env\t\t30",
+    "f\t600\tprojects/p/id_rsa.jsonl\t\t0",
+    "f\t600\tprojects/.ssh/k.jsonl\t\t80",
+    "l\t777\tprojects/p/link.jsonl\tother.jsonl\t11",
+    "f\t644\tprojects/p/s.jsonl\t\t9",
+  ], "\n")
+  let t = workspace_source_tally(root: tally_root, exclusions: workspace_exclusions(), listing: listing)
+  t.excluded_credentials == 3
+    && map(t.transcript_placeholders, p => p.member as String) == ["home/u/gunbc/projects/p/id_rsa.jsonl", "home/u/gunbc/projects/p/s.jsonl"]
+    && t.excluded_transcripts == 3
+}
+
+data readback_member: String = "home/u/.claude/projects/p/s 1.jsonl"
+
+data readback_placeholder: WorkspaceStagedPlaceholder = WorkspaceStagedPlaceholder { member: "home/u/.claude/projects/p/s 1.jsonl", size: byte_size(count: 5000), expected_digest: digest(c: "a") }
+
+data readback_names: String = "home/u/gunbc/README.md\nhome/u/.claude/projects/p/s 1.jsonl\n"
+
+fn readback_sizes(type_letter: String, placeholder_bytes: String) -> String {
+  join([
+    "-rw-r--r-- 1000/1000       120 2026-10-05 12:00:01 home/u/gunbc/README.md",
+    join([type_letter, "rw-r--r-- 1000/1000 ", placeholder_bytes, " 2026-10-05 12:00:02 home/u/.claude/projects/p/s 1.jsonl"], ""),
+    "",
+  ], "\n")
+}
+
+fn archived_digest(hex_char: String) -> Map<String, String> {
+  map_insert(m: empty_map(), key: readback_member, value: digest(c: hex_char).hex as String)
+}
+
+fn readback_of(placeholders: List<WorkspaceStagedPlaceholder>, names: String, sizes: String, digests: Map<String, String>) -> WorkspacePackReadback {
+  workspace_pack_readback(exclusions: workspace_exclusions(), placeholders: placeholders, archive_listing: names, size_listing: sizes, archived_digests: digests)
 }
 
 // THE PACK READBACK'S RED: an archive that carries a credential refuses the upload, whatever list
 // built it.
 test fn an_archive_carrying_a_credential_refuses_the_upload() -> Bool {
-  match workspace_pack_readback(exclusions: workspace_exclusions(), archive_listing: "home/u/gunbc/README.md\nsession-home/.claude/.credentials.json\n") {
+  match readback_of(placeholders: [], names: "home/u/gunbc/README.md\nsession-home/.claude/.credentials.json\n", sizes: "", digests: empty_map()) {
     WorkspacePackCarriesExcluded { member: m, by: x } => (m as String) == "session-home/.claude/.credentials.json" && (x.spelling as String) == "~/.claude/.credentials.json"
     WorkspacePackClean { members: _ } => false
+    WorkspacePackPlaceholderAbsent { member: _ } => false
+    WorkspacePackPlaceholderNotRegular { member: _, type_letter: _ } => false
+    WorkspacePackPlaceholderSizeDiffers { member: _, planned: _, archived: _ } => false
+    WorkspacePackPlaceholderUnread { member: _ } => false
+    WorkspacePackPlaceholderDigestDiffers { member: _, expected: _, archived: _ } => false
+  }
+}
+
+// A TRANSCRIPT NAME WITH NO STAGED PLACEHOLDER IS REAL CONTENT AND REFUSES.
+test fn an_archived_transcript_without_a_placeholder_refuses_the_upload() -> Bool {
+  match readback_of(placeholders: [], names: readback_names, sizes: readback_sizes(type_letter: "-", placeholder_bytes: "5000"), digests: archived_digest(hex_char: "a")) {
+    WorkspacePackCarriesExcluded { member: m, by: x } => (m as String) == readback_member && (x.spelling as String) == "projects/**/*.jsonl"
+    WorkspacePackClean { members: _ } => false
+    WorkspacePackPlaceholderAbsent { member: _ } => false
+    WorkspacePackPlaceholderNotRegular { member: _, type_letter: _ } => false
+    WorkspacePackPlaceholderSizeDiffers { member: _, planned: _, archived: _ } => false
+    WorkspacePackPlaceholderUnread { member: _ } => false
+    WorkspacePackPlaceholderDigestDiffers { member: _, expected: _, archived: _ } => false
+  }
+}
+
+// THE CONFIDENTIALITY RED: a REAL transcript of the placeholder's exact name, type and size is
+// refused, because its bytes do not hash to the staged filler's digest.
+test fn a_same_size_real_content_member_refuses_the_upload_by_digest() -> Bool {
+  match readback_of(placeholders: [readback_placeholder], names: readback_names, sizes: readback_sizes(type_letter: "-", placeholder_bytes: "5000"), digests: archived_digest(hex_char: "b")) {
+    WorkspacePackPlaceholderDigestDiffers { member: m, expected: e, archived: a } => (m as String) == readback_member && (e.hex as String) == (digest(c: "a").hex as String) && a == (digest(c: "b").hex as String)
+    WorkspacePackClean { members: _ } => false
+    WorkspacePackCarriesExcluded { member: _, by: _ } => false
+    WorkspacePackPlaceholderAbsent { member: _ } => false
+    WorkspacePackPlaceholderNotRegular { member: _, type_letter: _ } => false
+    WorkspacePackPlaceholderSizeDiffers { member: _, planned: _, archived: _ } => false
+    WorkspacePackPlaceholderUnread { member: _ } => false
+  }
+}
+
+// THE PLACEHOLDER'S SIZE RED: archived at any size but its planned one, the upload refuses.
+test fn a_placeholder_whose_size_differs_refuses_the_upload() -> Bool {
+  match readback_of(placeholders: [readback_placeholder], names: readback_names, sizes: readback_sizes(type_letter: "-", placeholder_bytes: "4999"), digests: archived_digest(hex_char: "a")) {
+    WorkspacePackPlaceholderSizeDiffers { member: m, planned: p, archived: a } => (m as String) == readback_member && measure_count(m: p) == 5000 && measure_count(m: a) == 4999
+    WorkspacePackClean { members: _ } => false
+    WorkspacePackCarriesExcluded { member: _, by: _ } => false
+    WorkspacePackPlaceholderAbsent { member: _ } => false
+    WorkspacePackPlaceholderNotRegular { member: _, type_letter: _ } => false
+    WorkspacePackPlaceholderUnread { member: _ } => false
+    WorkspacePackPlaceholderDigestDiffers { member: _, expected: _, archived: _ } => false
+  }
+}
+
+test fn a_placeholder_archived_as_a_non_regular_member_refuses_the_upload() -> Bool {
+  match readback_of(placeholders: [readback_placeholder], names: readback_names, sizes: readback_sizes(type_letter: "c", placeholder_bytes: "5000"), digests: archived_digest(hex_char: "a")) {
+    WorkspacePackPlaceholderNotRegular { member: m, type_letter: t } => (m as String) == readback_member && t == "c"
+    WorkspacePackClean { members: _ } => false
+    WorkspacePackCarriesExcluded { member: _, by: _ } => false
+    WorkspacePackPlaceholderAbsent { member: _ } => false
+    WorkspacePackPlaceholderSizeDiffers { member: _, planned: _, archived: _ } => false
+    WorkspacePackPlaceholderUnread { member: _ } => false
+    WorkspacePackPlaceholderDigestDiffers { member: _, expected: _, archived: _ } => false
   }
 }
 
-test fn a_clean_archive_reads_back_its_member_count() -> Bool {
-  match workspace_pack_readback(exclusions: workspace_exclusions(), archive_listing: "home/u/gunbc/README.md\nhome/u/gunbc/src/a.rs\n") {
+test fn a_placeholder_whose_archived_bytes_were_not_read_refuses_the_upload() -> Bool {
+  match readback_of(placeholders: [readback_placeholder], names: readback_names, sizes: readback_sizes(type_letter: "-", placeholder_bytes: "5000"), digests: empty_map()) {
+    WorkspacePackPlaceholderUnread { member: m } => (m as String) == readback_member
+    WorkspacePackClean { members: _ } => false
+    WorkspacePackCarriesExcluded { member: _, by: _ } => false
+    WorkspacePackPlaceholderAbsent { member: _ } => false
+    WorkspacePackPlaceholderNotRegular { member: _, type_letter: _ } => false
+    WorkspacePackPlaceholderSizeDiffers { member: _, planned: _, archived: _ } => false
+    WorkspacePackPlaceholderDigestDiffers { member: _, expected: _, archived: _ } => false
+  }
+}
+
+test fn a_planned_placeholder_missing_from_the_archive_refuses_the_upload() -> Bool {
+  match readback_of(placeholders: [readback_placeholder], names: "home/u/gunbc/README.md\n", sizes: "-rw-r--r-- 1000/1000 120 2026-10-05 12:00:01 home/u/gunbc/README.md\n", digests: empty_map()) {
+    WorkspacePackPlaceholderAbsent { member: m } => (m as String) == readback_member
+    WorkspacePackClean { members: _ } => false
+    WorkspacePackCarriesExcluded { member: _, by: _ } => false
+    WorkspacePackPlaceholderNotRegular { member: _, type_letter: _ } => false
+    WorkspacePackPlaceholderSizeDiffers { member: _, planned: _, archived: _ } => false
+    WorkspacePackPlaceholderUnread { member: _ } => false
+    WorkspacePackPlaceholderDigestDiffers { member: _, expected: _, archived: _ } => false
+  }
+}
+
+// THE POSITIVE CONTROL: the placeholder at its name, regular, at size, hashing to its staged digest.
+test fn a_clean_archive_with_its_placeholder_intact_reads_back_its_member_count() -> Bool {
+  match readback_of(placeholders: [readback_placeholder], names: readback_names, sizes: readback_sizes(type_letter: "-", placeholder_bytes: "5000"), digests: archived_digest(hex_char: "a")) {
     WorkspacePackClean { members: n } => n == 2
     WorkspacePackCarriesExcluded { member: _, by: _ } => false
+    WorkspacePackPlaceholderAbsent { member: _ } => false
+    WorkspacePackPlaceholderNotRegular { member: _, type_letter: _ } => false
+    WorkspacePackPlaceholderSizeDiffers { member: _, planned: _, archived: _ } => false
+    WorkspacePackPlaceholderUnread { member: _ } => false
+    WorkspacePackPlaceholderDigestDiffers { member: _, expected: _, archived: _ } => false
+  }
+}
+
+// ── THE AGENT-STATE SLOT: A DECLARED INPUT, A CLOSED CHOICE OVER THE OBSERVED SLOTS ───────────
+
+data observed_home_dirs: List<String> = ["/home/briansrls/.claude@gmail2", "/home/briansrls/.claude@gmail3", "/home/briansrls/.claude", "/home/briansrls/.claude@", "/home/briansrls/gunbc", "/home/briansrls/.codex"]
+
+test fn the_observed_slots_are_the_claude_at_directories() -> Bool {
+  workspace_observed_agent_state_slots(dirs: observed_home_dirs) == ["gmail2", "gmail3"]
+}
+
+// A NAMED EXISTING SLOT IS ADMITTED, as that slot's root, and the receipt line carries slot and path.
+test fn a_named_existing_slot_is_admitted_and_its_receipt_carries_it() -> Bool {
+  let a = workspace_agent_state_slot_admission(requested: Present { value: "gmail2" }, observed: workspace_observed_agent_state_slots(dirs: observed_home_dirs))
+  let admitted = match a {
+    AgentStateSlotAdmitted { slot: s, root: r } => (s as String) == "gmail2" && (r.path as String) == "/home/briansrls/.claude@gmail2" && (r.label as String) == "claude-agent-state-gmail2"
+    AgentStateSlotAbsent { observed: _ } => false
+    AgentStateSlotUnknown { requested: _, observed: _ } => false
   }
+  admitted && workspace_agent_state_slot_words(admission: a) == "agent_state_slot=gmail2 path=/home/briansrls/.claude@gmail2"
+}
+
+// NO DEFAULT AND NO FALLBACK: an absent (or empty) slot refuses, naming what was observed.
+test fn an_absent_slot_refuses_naming_the_observed_slots() -> Bool {
+  let observed = workspace_observed_agent_state_slots(dirs: observed_home_dirs)
+  let absent = match workspace_agent_state_slot_admission(requested: none, observed: observed) {
+    AgentStateSlotAbsent { observed: o } => o == ["gmail2", "gmail3"]
+    AgentStateSlotAdmitted { slot: _, root: _ } => false
+    AgentStateSlotUnknown { requested: _, observed: _ } => false
+  }
+  let empty = match workspace_agent_state_slot_admission(requested: Present { value: "" }, observed: observed) {
+    AgentStateSlotAbsent { observed: _ } => true
+    AgentStateSlotAdmitted { slot: _, root: _ } => false
+    AgentStateSlotUnknown { requested: _, observed: _ } => false
+  }
+  absent && empty
+}
+
+test fn an_unknown_slot_refuses_naming_the_observed_slots() -> Bool {
+  let a = workspace_agent_state_slot_admission(requested: Present { value: "gmail9" }, observed: workspace_observed_agent_state_slots(dirs: observed_home_dirs))
+  let refused = match a {
+    AgentStateSlotUnknown { requested: r, observed: o } => r == "gmail9" && o == ["gmail2", "gmail3"]
+    AgentStateSlotAdmitted { slot: _, root: _ } => false
+    AgentStateSlotAbsent { observed: _ } => false
+  }
+  refused && string_contains(s: workspace_agent_state_slot_words(admission: a), pattern: "observed=gmail2,gmail3")
 }
 
 // ── VERDICTS ───────────────────────────────────────────────────────────────────────────────────
@@ -224,6 +402,20 @@ test fn measured_parts_over_the_bound_exceed_it_whatever_is_missing() -> Bool {
   }
 }
 
+// WHILE THE SUBJECT IS A STATIC TREE WITH SYNTHETIC TRANSCRIPTS, THE 10 s / 60 s VERDICTS ARE
+// WITHHELD -- even when every measured part is far under both bounds, no bound line says it holds --
+// and the quota decides over the static size, labelled static.
+test fn the_draft_time_verdicts_are_withheld_and_the_quota_is_static() -> Bool {
+  let fast = [PartMeasured { label: "snapshot", elapsed: ms(n: 40) }, PartMeasured { label: "upload", elapsed: ms(n: 900) }, PartMeasured { label: "commit", elapsed: ms(n: 20) }]
+  let block = workspace_draft_verdict_lines(snapshot_parts: fast, scan_parts: fast, static_size: Present { value: byte_size(count: 1600000000) }, n: workspace_draft_numbers)
+  let lines = split(block, separator: "\n")
+  string_contains(s: block, pattern: workspace_transcript_caveat as String)
+    && length(filter(lines, l => string_contains(s: l, pattern: "=withheld: churn not measured"))) == 4
+    && length(filter(lines, l => string_contains(s: l, pattern: "=holds") || string_contains(s: l, pattern: "=exceeded") || string_contains(s: l, pattern: "=undecided"))) == 1
+    && string_contains(s: block, pattern: "quota_static=holds bytes=1600000000")
+    && (workspace_transcript_caveat as String) == "transcript content synthetic, sizes preserved, static tree; NOT a 10 s / 60 s verdict"
+}
+
 test fn the_quota_verdict_compares_bytes_to_the_quota() -> Bool {
   let under = match workspace_quota_verdict(size: byte_size(count: 1600000000), quota: byte_size(count: 10000000000)) { QuotaHolds { size: _, quota: _ } => true  QuotaExceeded { size: _, quota: _ } => false }
   let over = match workspace_quota_verdict(size: byte_size(count: 10000000001), quota: byte_size(count: 10000000000)) { QuotaExceeded { size: _, quota: _ } => true  QuotaHolds { size: _, quota: _ } => false }
diff --git a/dag/test/claim/workspace_commissioning_witness_test.dag b/dag/test/claim/workspace_commissioning_witness_test.dag
index 6d50795ec38..f1ccda54bc8 100644
--- a/dag/test/claim/workspace_commissioning_witness_test.dag
+++ b/dag/test/claim/workspace_commissioning_witness_test.dag
@@ -13,7 +13,7 @@ import product.host_identity { HostIdentity }
 import gunbc.runner_slot_allocation { gunbc_microvm_shakedown_slot_memory_max, gunbc_runner_slot_desired_for }
 import gunbc.runner_slot_desired { SlotCpuQuotaUnbounded }
 import gunbc.fleet_host_budget { HostAllocationConserves }
-import product.fabric.sanitation { required_sanitation_facts, SlotScopedNetwork, FactConfirmed }
+import product.fabric.sanitation { required_sanitation_facts, SlotScopedNetwork, SlotNetworkQuiescent, FactConfirmed, FactUnobservable }
 import gunbc.runner_microvm_cell_readiness { WriteCommissioned, apply_cell_readiness_write, WriteAccepted }
 
 fn commissioning_test_slot() -> RunnerSlotIdentity { RunnerSlotIdentity { host: "srv1" as HostIdentity, slot_index: 13 } }
@@ -84,3 +84,23 @@ test fn workspace_cpu_binding_does_not_cap_another_slot() -> Bool {
     _ => false
   }
 }
+
+test fn commissioning_refusal_names_the_unobservable_sanitation_fact() -> Bool {
+  let slot = commissioning_test_slot()
+  match workspace_commissioning_admit(slot: slot,
+    authority: WorkspaceCommissioningAuthorizedPlan { slot: slot, plan_hash: "fixture-plan" as NonEmptyStr },
+    budget: HostAllocationConserves, cpu_budget: hardware_thread_count(count: 4),
+    attempt_envelope: gunbc_microvm_shakedown_slot_memory_max,
+    prior_purpose: WorkspacePriorPurposeWithdrawn,
+    obligations: WorkspaceNoPriorObligations { settled_generation: 0 },
+    sanitation: map(required_sanitation_facts(scope: SlotScopedNetwork), fact =>
+      if fact == SlotNetworkQuiescent {
+        FactUnobservable { fact: fact, reason: "tap-unheld: TUN attached-queue count is unavailable" as NonEmptyStr }
+      } else { FactConfirmed { fact: fact } }),
+  ) {
+    WorkspaceCommissioningRefused { reason } =>
+      string_contains(s: reason, pattern: "slot-network-quiescent")
+        && string_contains(s: reason, pattern: "tap-unheld: TUN attached-queue count is unavailable")
+    other => false
+  }
+}
diff --git a/dag/test/claim/workspace_dispatch_fleet_witness_test.dag b/dag/test/claim/workspace_dispatch_fleet_witness_test.dag
index 4d0063275df..1943edf9944 100644
--- a/dag/test/claim/workspace_dispatch_fleet_witness_test.dag
+++ b/dag/test/claim/workspace_dispatch_fleet_witness_test.dag
@@ -2,6 +2,10 @@ module test.claim.workspace_dispatch_fleet_witness
 
 import gunbc.fleet_converge_scope { WorkspaceSlotCommissioningOnly }
 
+import extdeps.crypto.hash { sha256_digest }
+import extdeps.shell.exec { ProcessOutputPresent, ProcessOutputAbsent, ProcessRefused }
+import gunbc.workspace_commissioning_executor_input { workspace_executor_grant_digest_matches }
+
 import std.types { Bool, String }
 import gunbc.fleet_converge_plan {
   ScopeDecoded,
@@ -9,9 +13,10 @@ import gunbc.fleet_converge_plan {
   fleet_converge_scope_wire
 }
 import gunbc.workspace_commissioning_executor_plan { workspace_executor_scope_wire }
-import gunbc.workspace_commissioning_dispatch_operations { workspace_dispatch_grant_content }
+import gunbc.workspace_commissioning_dispatch_operations { workspace_dispatch_grant_content, workspace_dispatch_grant_read_operation }
 import gunbc.workspace_commissioning_dispatch_transport { workspace_dispatch_captured_command }
 import gunbc.fleet_generation_execution { fleet_generation_writer }
+import gunbc.executor_privileged_operation { executor_privileged_operation_argv, executor_privileged_operation_sudoers_line }
 
 
 fn dispatch_grant_fixture() -> String {
@@ -46,3 +51,28 @@ test fn dispatch_uses_fleet_lock_owner_without_reopening_artifacts() -> Bool {
     && string_contains(s: operator, pattern: "'captured input'")
     && !string_contains(s: operator, pattern: "apply.sh")
 }
+
+// A job can read exactly its installation policy, without gaining a general root file reader.
+test fn installation_readback_grants_only_the_exact_policy_file() -> Bool {
+  let op = workspace_dispatch_grant_read_operation()
+  let argv = executor_privileged_operation_argv(op: op)
+  let grant = executor_privileged_operation_sudoers_line(grantee: fleet_generation_writer(), op: op) as String
+  argv == ["/usr/bin/sha256sum", "--", "/etc/sudoers.d/gunbc-workspace-commissioning"]
+    && string_contains(s: dispatch_grant_fixture(), pattern: grant)
+    && ends_with(s: grant, suffix: "/usr/bin/sha256sum -- /etc/sudoers.d/gunbc-workspace-commissioning")
+    && !string_contains(s: grant, pattern: "*")
+    && !string_contains(s: grant, pattern: "state-writer-mac-key")
+}
+
+
+// Independent SHA-256 fixtures for "policy\n" and "policy": captured text normalizes their
+// trailing newline, but the file digest must still distinguish them.
+test fn policy_digest_readback_preserves_final_newline_identity() -> Bool {
+  let expected = sha256_digest(hex: "c82fc52c78bf8154d4dd7d8766c422ab151052d72098d72ded237aafcd78e4e0")
+  workspace_executor_grant_digest_matches(expected: expected,
+    observed: ProcessOutputPresent { text: "c82fc52c78bf8154d4dd7d8766c422ab151052d72098d72ded237aafcd78e4e0  /etc/sudoers.d/gunbc-workspace-commissioning" })
+    && !workspace_executor_grant_digest_matches(expected: expected,
+      observed: ProcessOutputPresent { text: "823412d1eacb67956220e532959f0104603057c88704863ca38e7cd188fda812  /etc/sudoers.d/gunbc-workspace-commissioning" })
+    && !workspace_executor_grant_digest_matches(expected: expected, observed: ProcessOutputAbsent)
+    && !workspace_executor_grant_digest_matches(expected: expected, observed: ProcessRefused { exit_code: 1, stderr: "denied" })
+}
diff --git a/dag/test/claim/workspace_launch_directive_witness_test.dag b/dag/test/claim/workspace_launch_directive_witness_test.dag
index dd0f9d60cdf..e248ee51a1b 100644
--- a/dag/test/claim/workspace_launch_directive_witness_test.dag
+++ b/dag/test/claim/workspace_launch_directive_witness_test.dag
@@ -22,13 +22,15 @@ import gunbc.fabric_control_plane { fabric_money_reservation_ref }
 import gunbc.workspace_allocation_release { workspace_release_derive, workspace_release_wire, workspace_release_decode, WorkspaceReleasePrepared, WorkspaceReleaseRefused }
 import gunbc.workspace_money_codec { workspace_money_json }
 
-fn launch_fixture_allocation() -> WorkspaceAllocation? {
+fn launch_fixture_allocation() -> WorkspaceAllocation? { launch_fixture_allocation_in_slot(index: 7) }
+
+fn launch_fixture_allocation_in_slot(index: Int) -> WorkspaceAllocation? {
   let request = allocation_test_request(key: "launch-fixture" as NonEmptyStr)
   let work = workspace_work(request: request).id
   match workspace_memory_grant(request: request, work: work, attempt: FabricIdentity { principal: work.principal, key: "fixture-attempt" as ExecutionAttemptKey }) {
     MemoryGrantIssued { grant: committed } => {
       let reserved = WorkspaceReservation {
-        request: request, slot: RunnerSlotIdentity { host: "srv1" as HostIdentity, slot_index: 7 }, generation: 1,
+        request: request, slot: RunnerSlotIdentity { host: "srv1" as HostIdentity, slot_index: index }, generation: 1,
         grant: committed, work: work,
         demand: FabricIdentity { principal: work.principal, key: "fixture-demand" as DemandKey },
         offer: FabricIdentity { principal: "fixture-provider", key: "fixture-offer" as OfferKey },
diff --git a/dag/test/claim/workspace_network_observation_witness_test.dag b/dag/test/claim/workspace_network_observation_witness_test.dag
index eafd498acfd..6c1b07e51d8 100644
--- a/dag/test/claim/workspace_network_observation_witness_test.dag
+++ b/dag/test/claim/workspace_network_observation_witness_test.dag
@@ -3,7 +3,7 @@ module test.claim.workspace_network_observation_witness_test
 import std.types { Bool, String }
 import std.optional { Present, Absent }
 import extdeps.linux.procfs { procfs_status_effective_uid }
-import extdeps.ethtool { ethtool_combined_channels, EthtoolCombinedChannelsCurrent, EthtoolCombinedChannelsUnreadable }
+import extdeps.linux.ethtool_ioctl { linux_ethtool_channels_decode, LinuxEthtoolChannelsRead, LinuxEthtoolChannelsUnsupported, LinuxEthtoolChannelsUnreadable }
 import extdeps.linux.tun_fdinfo {
   TunDescriptorCount, TunDescriptorUnreadable,
   TunCensusMultiQueue, TunCensusFlagsUnreadable, TunCensusProcUnreadable,
@@ -18,12 +18,6 @@ import extdeps.linux.tun_fdinfo {
 // floor. The real reader runs in
 // test.claim.workspace_network_real_reader_witness_test on the local-repo wet lane.
 
-data channels_one: String = "Channel parameters for tap0:\nPre-set maximums:\nRX:\t\tn/a\nTX:\t\tn/a\nOther:\t\tn/a\nCombined:\t1\nCurrent hardware settings:\nRX:\t\tn/a\nTX:\t\tn/a\nOther:\t\tn/a\nCombined:\t1\n"
-
-data channels_current_na: String = "Channel parameters for tap0:\nPre-set maximums:\nRX:\t\tn/a\nTX:\t\tn/a\nOther:\t\tn/a\nCombined:\t1\nCurrent hardware settings:\nRX:\t\tn/a\nTX:\t\tn/a\nOther:\t\tn/a\nCombined:\tn/a\n"
-
-data channels_maximums_only: String = "Channel parameters for tap0:\nPre-set maximums:\nRX:\t\tn/a\nTX:\t\tn/a\nOther:\t\tn/a\nCombined:\t1\n"
-
 // Positive control: no holder descriptor, no attached queue, two clean sweeps.
 test fn zero_holders_requires_every_observation_to_affirm_zero() -> Bool {
   match tun_census_join(before: TunQueuesAttached { count: 0 }, first: TunSweepComplete { holders: [], exited: 2 },
@@ -74,17 +68,22 @@ test fn multi_queue_and_malformed_flags_refuse() -> Bool {
     && (match tun_queue_mode(flags: "0x1102\n") { TunMultiQueue => true other => false })
     && (match tun_queue_mode(flags: "1002") { TunFlagsMalformed => true other => false })
     && (match tun_queue_mode(flags: "0xzz") { TunFlagsMalformed => true other => false })
-    && (match tun_queue_reading(mode: TunMultiQueue, channels: EthtoolCombinedChannelsCurrent { count: 0 }) { TunQueuesRefused { cause: TunCensusMultiQueue } => true other => false })
-    && (match tun_queue_reading(mode: TunFlagsMalformed, channels: EthtoolCombinedChannelsCurrent { count: 0 }) { TunQueuesRefused { cause: TunCensusFlagsUnreadable } => true other => false })
+    && (match tun_queue_reading(mode: TunMultiQueue, channels: LinuxEthtoolChannelsRead { combined: 0 }) { TunQueuesRefused { cause: TunCensusMultiQueue } => true other => false })
+    && (match tun_queue_reading(mode: TunFlagsMalformed, channels: LinuxEthtoolChannelsRead { combined: 0 }) { TunQueuesRefused { cause: TunCensusFlagsUnreadable } => true other => false })
 }
 
 test fn channel_count_reads_only_the_current_combined_count() -> Bool {
-  (match ethtool_combined_channels(device: "tap0", success: true, value: channels_one) { EthtoolCombinedChannelsCurrent { count: n } => n == 1 other => false })
-    && (match ethtool_combined_channels(device: "tap0", success: true, value: channels_current_na) { EthtoolCombinedChannelsUnreadable { cause: _ } => true other => false })
-    && (match ethtool_combined_channels(device: "tap0", success: true, value: channels_maximums_only) { EthtoolCombinedChannelsUnreadable { cause: _ } => true other => false })
-    && (match ethtool_combined_channels(device: "tap0", success: false, value: channels_one) { EthtoolCombinedChannelsUnreadable { cause: _ } => true other => false })
-    && (match ethtool_combined_channels(device: "tap1", success: true, value: channels_one) { EthtoolCombinedChannelsUnreadable { cause: _ } => true other => false })
-    && (match ethtool_combined_channels(device: "tap0", success: true, value: "") { EthtoolCombinedChannelsUnreadable { cause: _ } => true other => false })
+  (match linux_ethtool_channels_decode(device: "tap0", text: "channels:tap0:60:8:8:8:16:2:2:2:1") { LinuxEthtoolChannelsRead { combined: n } => n == 1 other => false })
+    && (match linux_ethtool_channels_decode(device: "tap0", text: "channels:tap0:60:8:8:8:16:2:2:2") { LinuxEthtoolChannelsUnreadable { cause: _ } => true other => false })
+    && (match linux_ethtool_channels_decode(device: "tap0", text: "channels:tap0:60:8:8:8:16:2:2:2:-1") { LinuxEthtoolChannelsUnreadable { cause: _ } => true other => false })
+    && (match linux_ethtool_channels_decode(device: "tap0", text: "channels:tap1:60:8:8:8:16:2:2:2:0") { LinuxEthtoolChannelsUnreadable { cause: _ } => true other => false })
+    && (match linux_ethtool_channels_decode(device: "tap0", text: "channels:tap0:61:8:8:8:16:2:2:2:0") { LinuxEthtoolChannelsUnreadable { cause: _ } => true other => false })
+}
+
+test fn only_the_kernel_unsupported_errno_establishes_absent_capability() -> Bool {
+  (match linux_ethtool_channels_decode(device: "tap0", text: "errno:tap0:95") { LinuxEthtoolChannelsUnsupported => true other => false })
+    && all(["errno:tap0:1", "errno:tap0:13", "errno:tap0:19", "errno:tap1:95", "netlink error: Operation not supported", "", "errno:tap0:95\nerrno:tap0:1"], text =>
+      match linux_ethtool_channels_decode(device: "tap0", text: text) { LinuxEthtoolChannelsUnreadable { cause: _ } => true other => false })
 }
 
 test fn fdinfo_names_exactly_this_interface() -> Bool {
diff --git a/dag/test/claim/workspace_network_producer_witness_test.dag b/dag/test/claim/workspace_network_producer_witness_test.dag
index 59551d312d6..0414bc0f3a1 100644
--- a/dag/test/claim/workspace_network_producer_witness_test.dag
+++ b/dag/test/claim/workspace_network_producer_witness_test.dag
@@ -1,12 +1,33 @@
 module test.claim.workspace_network_producer_witness_test
 
-import std.types { Bool }
-import gunbc.runner_microvm_network_observe { tap_holders_reading }
+import std.types { Bool, NonEmptyStr }
+import gunbc.runner_microvm_network_observe { network_read_outcome }
+import gunbc.host_effect { SshShell }
+import gunbc.executor_privileged_operation { ReadNftRuleset }
+import extdeps.shell.exec { ProcessRefused }
+import gunbc.runner_microvm_network_sanitation_observe { tap_holders_reading }
 import gunbc.runner_microvm_network { TapPresentUnheld, TapHeld, TapHoldersUnreadable }
-import extdeps.linux.tun_fdinfo { TunDescriptorCount, TunDescriptorUnreadable, TunCensusMultiQueue }
+import extdeps.linux.tun_fdinfo { TunDescriptorCount, TunDescriptorUnreadable, TunCensusMultiQueue, TunCensusQueueCountUnreadable }
 
 test fn network_producer_requires_successful_tun_census() -> Bool {
   (match tap_holders_reading(census: TunDescriptorCount { count: 0, exited: 0 }) { TapPresentUnheld => true other => false })
     && (match tap_holders_reading(census: TunDescriptorCount { count: 1, exited: 0 }) { TapHeld { holders: n } => n == 1 other => false })
     && (match tap_holders_reading(census: TunDescriptorUnreadable { cause: TunCensusMultiQueue }) { TapHoldersUnreadable { reason: _ } => true other => false })
 }
+
+test fn network_producer_preserves_unsupported_queue_observation() -> Bool {
+  match tap_holders_reading(census: TunDescriptorUnreadable {
+    cause: TunCensusQueueCountUnreadable { cause: "ethtool --show-channels exited nonzero" as NonEmptyStr },
+  }) {
+    TapHoldersUnreadable { reason } => reason == "TUN attached-queue count is unavailable: ethtool --show-channels exited nonzero"
+    other => false
+  }
+}
+
+
+test fn unanchored_network_observation_refuses_before_opening_a_session() -> Bool {
+  match network_read_outcome(transport: SshShell { ssh_host: "unexpected-host" }, op: ReadNftRuleset) {
+    ProcessRefused { exit_code: _, stderr: _ } => true
+    other => false
+  }
+}
diff --git a/dag/test/claim/workspace_network_real_reader_witness_test.dag b/dag/test/claim/workspace_network_real_reader_witness_test.dag
index fde277bb90a..8e4d2f78b57 100644
--- a/dag/test/claim/workspace_network_real_reader_witness_test.dag
+++ b/dag/test/claim/workspace_network_real_reader_witness_test.dag
@@ -5,6 +5,7 @@ import std.optional { Present, Absent }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import extdeps.filesystem.filesystem_io { Filesystem }
 import extdeps.linux.procfs { procfs_status_effective_uid }
+import extdeps.linux.ethtool_ioctl { linux_ethtool_channels_observe, LinuxEthtoolChannelsUnsupported, LinuxEthtoolChannelsUnreadable }
 import extdeps.linux.tun_fdinfo {
   TunInterfaceMissing, TunDescriptorUnreadable, TunCensusReaderNotRoot, TunCensusSubjectInadmissible,
   tun_descriptor_census_observe
@@ -22,6 +23,8 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // effective uid dictates, and this claim reads that uid independently. As root, the reader reaches
 // tun_flags and answers Missing. Otherwise it refuses on the reader identity before touching /proc.
 // Neither route may produce a count.
+// Execute the actual Python/native-ioctl boundary too. Loopback exists but has no channel
+// operation; the absent interface answers ENODEV, which must NOT demand a kernel upgrade.
 test fn real_reader_takes_the_route_the_reader_identity_dictates() -> Bool {
   let status = Filesystem.Read(path: "/proc/self/status")
   status.success && (match procfs_status_effective_uid(content: status.content) {
@@ -32,4 +35,6 @@ test fn real_reader_takes_the_route_the_reader_identity_dictates() -> Bool {
       other => false
     }
   }) && (match tun_descriptor_census_observe(name: "bad/name") { TunDescriptorUnreadable { cause: TunCensusSubjectInadmissible } => true other => false })
+    && (match linux_ethtool_channels_observe(device: "lo") { LinuxEthtoolChannelsUnsupported => true other => false })
+    && (match linux_ethtool_channels_observe(device: "gunbcnotap0") { LinuxEthtoolChannelsUnreadable { cause: _ } => true other => false })
 }
diff --git a/dag/test/claim/workspace_network_receipt_population_witness_test.dag b/dag/test/claim/workspace_network_receipt_population_witness_test.dag
new file mode 100644
index 00000000000..43791d83f86
--- /dev/null
+++ b/dag/test/claim/workspace_network_receipt_population_witness_test.dag
@@ -0,0 +1,39 @@
+module test.claim.workspace_network_receipt_population_witness_test
+
+import std.types { Bool, String }
+import gunbc.fleet_host_identity { operator_host_srv1 }
+import gunbc.runner_slot_allocation { fabric_execution_slot_identities, srv1_microvm_shakedown_slot }
+import gunbc.runner_microvm_network_receipt_store { parse_host_network_receipt, NetworkReceiptPresent, StoredNetworkReceiptUnreadable }
+import gunbc.runner_microvm_network { parse_converged_slot_network, ConvergedSlotNetworkMalformed,
+  slot_network_sanitation_subject, SanitationSubjectAdmitted }
+import test.fixture.srv1_network_receipt { observed_srv1_network_receipt }
+
+// Actual publisher bytes discriminate the previous consumer's narrower fabric-cell roster.
+// Parsing the host receipt does not authorize another slot for fabric execution.
+test fn published_host_network_population_reaches_the_workspace_consumer() -> Bool {
+  (match parse_converged_slot_network(text: observed_srv1_network_receipt,
+    candidates: fabric_execution_slot_identities()) { ConvergedSlotNetworkMalformed { cause: _ } => true other => false })
+    && (match parse_host_network_receipt(text: observed_srv1_network_receipt, host: operator_host_srv1) {
+      NetworkReceiptPresent { receipt } => receipt.slots.count() == 10
+        && (match slot_network_sanitation_subject(slot: srv1_microvm_shakedown_slot(), receipt: receipt) {
+          SanitationSubjectAdmitted { subject: _ } => true other => false
+        })
+      other => false
+    })
+}
+
+test fn host_network_reader_refuses_another_receipt_host() -> Bool {
+  let text = join(split(s: observed_srv1_network_receipt, delimiter: "host=srv1"), "host=srv2")
+  match parse_host_network_receipt(text: text, host: operator_host_srv1) {
+    StoredNetworkReceiptUnreadable { reason } => reason == "network receipt names another host"
+    other => false
+  }
+}
+
+test fn host_network_reader_refuses_an_unenrolled_network_slot() -> Bool {
+  let text = join(split(s: observed_srv1_network_receipt, delimiter: "slot=srv1-13"), "slot=srv1-99")
+  match parse_host_network_receipt(text: text, host: operator_host_srv1) {
+    StoredNetworkReceiptUnreadable { reason: _ } => true
+    other => false
+  }
+}
diff --git a/dag/test/claim/workspace_reconcile_once_witness_test.dag b/dag/test/claim/workspace_reconcile_once_witness_test.dag
index 817f6da27d5..d8b56a7d5d0 100644
--- a/dag/test/claim/workspace_reconcile_once_witness_test.dag
+++ b/dag/test/claim/workspace_reconcile_once_witness_test.dag
@@ -25,12 +25,12 @@ fn request() -> WorkspaceRequest {
 
 fn offer_line_with(host: String, slot_index: Int, extra: Bool) -> String {
   let members = [
-    json_kv(key: "schema", value: json_string(s: "workspace-host-offer/v1")),
+    json_kv(key: "schema", value: json_string(s: "workspace-host-offer/v2")),
     json_kv(key: "host", value: json_string(s: host)),
     json_kv(key: "slot_index", value: json_int(n: slot_index)),
     json_kv(key: "observed_at", value: json_string(s: "2026-10-04T12:00:00Z")),
     json_kv(key: "commissioning_plan_hash", value: json_string(s: "plan-hash")),
-    json_kv(key: "gateway_receipt", value: json_string(s: "gateway-receipt")),
+    json_kv(key: "access_receipt", value: json_string(s: "access-receipt")),
     json_kv(key: "image", value: json_string(s: workspace_demo_image_identity() as String)),
     json_kv(key: "request_key", value: json_string(s: "reconcile-test")),
   ]
diff --git a/dag/test/claim/workspace_source_pack_archive_real_execution_witness_test.dag b/dag/test/claim/workspace_source_pack_archive_real_execution_witness_test.dag
new file mode 100644
index 00000000000..4663e1efb0e
--- /dev/null
+++ b/dag/test/claim/workspace_source_pack_archive_real_execution_witness_test.dag
@@ -0,0 +1,110 @@
+module test.claim.workspace_source_pack_archive_real_execution
+
+import std.types { String, NonEmptyStr, Int, Bool, List, FilePath }
+import std.measure { byte_size }
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.shell
+import gunbc.fabric.workspace_source {
+  WorkspaceTranscriptPlaceholder, WorkspaceStagedPlaceholder, workspace_stage_placeholders, WorkspacePlaceholdersStaged, WorkspacePlaceholdersRefused,
+  workspace_pack_archive, workspace_pack_refusal_words, WorkspacePackBuilt, WorkspacePackRefused,
+  WorkspacePackClean, WorkspacePackCarriesExcluded, WorkspacePackPlaceholderAbsent, WorkspacePackPlaceholderNotRegular,
+  WorkspacePackPlaceholderSizeDiffers, WorkspacePackPlaceholderUnread, WorkspacePackPlaceholderDigestDiffers,
+}
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE PACK'S TWO-ROOT TAR COMPOSITION AND ITS ARCHIVE READBACK, BY REAL EXECUTION, inside a directory
+// the witness mints and removes. A real tree (one source file, and a real transcript the plan
+// excludes) and a staged placeholder for that transcript are packed into one tar by the production
+// gunbc.fabric.workspace_source workspace_pack_archive, which lists the archive back, extracts the
+// placeholder member and hashes it. The positive control reads back clean. The red is the
+// confidentiality boundary itself: the staged placeholder's bytes are swapped for real content of
+// the SAME size before packing -- what a real transcript standing at the placeholder's path would
+// look like -- and the archive is refused by digest. The pure readback arms are discriminated in
+// test.claim.workspace_checkpoint_instrument; this witness is their inhabitance on the real route.
+
+fn with_temp_dir(scenario: fn(String) -> Bool) -> Bool {
+  let dir = shell.Mktemp.Dir()
+  if dir.success == false {
+    false
+  } else {
+    let observed = scenario(dir.path as String)
+    let cleaned = shell.Remove.RecursiveForce(path: dir.path)
+    observed && cleaned.success
+  }
+}
+
+fn relative_to_root(path: String) -> String {
+  substring(s: path, start: 1, end: length(path))
+}
+
+data transcript_text: String = "{\"type\":\"user\",\"message\":\"a real transcript line of exactly sixty-four bytes\"}\n"
+
+// The real tree under <dir>/real and the placeholder plan for its one transcript, at the
+// transcript's own size. Returns the plan only if the tree was written.
+fn plant(dir: String) -> List<WorkspaceTranscriptPlaceholder> {
+  let real = join([dir, "/real/.claude/projects/p"], "")
+  let made = shell.Mkdir.Parents(path: real as FilePath).success
+  let readme = Filesystem.Write(path: join([dir, "/real/README.md"], ""), content: "readme\n").success
+  let transcript = Filesystem.Write(path: join([real, "/s.jsonl"], ""), content: transcript_text).success
+  if made && readme && transcript {
+    [WorkspaceTranscriptPlaceholder { member: relative_to_root(path: join([real, "/s.jsonl"], "")) as NonEmptyStr, size: byte_size(count: length(transcript_text)) }]
+  } else {
+    []
+  }
+}
+
+fn pack(dir: String, plan: List<WorkspaceTranscriptPlaceholder>, swap_in_real_content: Bool) -> String {
+  let staging = join([dir, "/staging"], "")
+  let root = join([staging, "/placeholders"], "")
+  match workspace_stage_placeholders(root: root, placeholders: plan, staged: []) {
+    WorkspacePlaceholdersRefused { why: w } => concat("staging-refused: ", w)
+    WorkspacePlaceholdersStaged { placeholders: staged } => {
+      let swapped = if swap_in_real_content {
+        Filesystem.Write(path: join([root, "/", relative_to_root(path: join([dir, "/real/.claude/projects/p/s.jsonl"], ""))], ""), content: transcript_text).success
+      } else { true }
+      if swapped == false {
+        "swap-failed"
+      } else {
+        match workspace_pack_archive(staging: staging, members: [relative_to_root(path: join([dir, "/real/README.md"], "")) as NonEmptyStr], placeholders: staged, placeholder_root: root) {
+          WorkspacePackRefused { refusal: v, why: w } => join(["pack-refused: ", workspace_pack_refusal_words(refusal: v), " ", w], "")
+          WorkspacePackBuilt { archive: _, readback: r } =>
+            match r {
+              WorkspacePackClean { members: n } => concat("clean ", to_string(n))
+              WorkspacePackCarriesExcluded { member: _, by: _ } => "carries-excluded"
+              WorkspacePackPlaceholderAbsent { member: _ } => "placeholder-absent"
+              WorkspacePackPlaceholderNotRegular { member: _, type_letter: _ } => "placeholder-not-regular"
+              WorkspacePackPlaceholderSizeDiffers { member: _, planned: _, archived: _ } => "placeholder-size-differs"
+              WorkspacePackPlaceholderUnread { member: _ } => "placeholder-unread"
+              WorkspacePackPlaceholderDigestDiffers { member: _, expected: _, archived: _ } => "placeholder-digest-differs"
+            }
+        }
+      }
+    }
+  }
+}
+
+test fn the_two_root_archive_carries_the_placeholder_and_reads_back_clean_by_real_execution() -> Bool {
+  with_temp_dir(scenario: dir => {
+    let plan = plant(dir: dir)
+    length(plan) == 1 && pack(dir: dir, plan: plan, swap_in_real_content: false) == "clean 2"
+  })
+}
+
+test fn same_size_real_content_at_the_placeholder_path_is_refused_by_digest_by_real_execution() -> Bool {
+  with_temp_dir(scenario: dir => {
+    let plan = plant(dir: dir)
+    length(plan) == 1 && pack(dir: dir, plan: plan, swap_in_real_content: true) == "placeholder-digest-differs"
+  })
+}
+
+// A WORKSPACE WITH NO TRANSCRIPTS: one ordinary file and zero placeholders packs clean through the
+// same two-list route, its second list empty.
+test fn one_ordinary_file_and_zero_placeholders_packs_clean_by_real_execution() -> Bool {
+  with_temp_dir(scenario: dir => {
+    let made = shell.Mkdir.Parents(path: join([dir, "/real"], "") as FilePath).success
+    let readme = Filesystem.Write(path: join([dir, "/real/README.md"], ""), content: "readme\n").success
+    made && readme && pack(dir: dir, plan: [], swap_in_real_content: false) == "clean 1"
+  })
+}
diff --git a/dag/test/claim/workspace_ssh_access_witness_test.dag b/dag/test/claim/workspace_ssh_access_witness_test.dag
new file mode 100644
index 00000000000..87ad6534a08
--- /dev/null
+++ b/dag/test/claim/workspace_ssh_access_witness_test.dag
@@ -0,0 +1,56 @@
+module test.claim.workspace_ssh_access_witness_test
+
+import std.types { Bool, String }
+import gunbc.build_cache_instance { RunnerSlotIdentity }
+import gunbc.workspace_ssh_access { WorkspaceSshFromHost, WorkspaceSshThroughGateway, WorkspaceHostAccessObserved, workspace_access_refusal, workspace_access_receipt }
+import gunbc.workspace_allocation_policy { workspace_enrolled_ssh_access, workspace_operator_principal, workspace_operator_guest_key, workspace_operator_guest_identity_file }
+import gunbc.fleet_ssh_access { operator_ssh_principal, fleet_automation_ssh_key }
+import gunbc.runner_slot_allocation
+import gunbc.workspace_gateway
+import gunbc.fleet_known_hosts_anchor
+
+test fn direct_host_access_is_fresh_and_bound_to_the_selected_host() -> Bool {
+  let slot = RunnerSlotIdentity { host: "srv1", slot_index: 13 }
+  let path = WorkspaceSshFromHost { identity_file: "/fixture/vm-key" }
+  let observed = WorkspaceHostAccessObserved { host: "srv1", observed_at: "2026-10-09T00:00:00Z" }
+  let positive = match workspace_access_refusal(access: path, slot: slot, evidence: observed, now: "2026-10-09T00:00:01Z") { Absent => true _ => false }
+  let foreign = match workspace_access_refusal(access: path, slot: RunnerSlotIdentity { host: "srv2", slot_index: 13 }, evidence: observed, now: "2026-10-09T00:00:01Z") { Present { value: _ } => true _ => false }
+  let stale = match workspace_access_refusal(access: path, slot: slot, evidence: observed, now: "2026-10-09T00:01:01Z") { Present { value: _ } => true _ => false }
+  let future = match workspace_access_refusal(access: path, slot: slot, evidence: observed, now: "2026-10-08T23:59:59Z") { Present { value: _ } => true _ => false }
+  positive && foreign && stale && future
+}
+
+test fn a_host_local_observation_cannot_admit_a_gateway_route() -> Bool {
+  match workspace_access_refusal(access: WorkspaceSshThroughGateway,
+    slot: RunnerSlotIdentity { host: "srv1", slot_index: 13 },
+    evidence: WorkspaceHostAccessObserved { host: "srv1", observed_at: "2026-10-09T00:00:00Z" }, now: "2026-10-09T00:00:01Z") {
+    Present { value: _ } => true
+    Absent => false
+  }
+}
+
+test fn the_operator_uses_a_separate_guest_key_on_the_host() -> Bool {
+  let separate = workspace_operator_guest_key.material != operator_ssh_principal.public_key.material
+    && workspace_operator_guest_key.material != fleet_automation_ssh_key.material
+  separate && match workspace_enrolled_ssh_access(owner: workspace_operator_principal()) {
+    Present { value: WorkspaceSshFromHost { identity_file } } => identity_file == workspace_operator_guest_identity_file()
+    _ => false
+  }
+}
+
+test fn workspace_gateway_tailnet_names_have_one_enrolled_host_key() -> Bool {
+  all(gunbc.runner_slot_allocation.workspace_execution_slot_identities(), slot =>
+    match gunbc.workspace_gateway.workspace_fleet_gateway(slot: slot) {
+      Absent => false
+      Present { value: gateway } => count(filter(gunbc.fleet_known_hosts_anchor.fleet_known_hosts_rows(), row => row.endpoint == (gateway.tailnet_name as String))) == 1
+    })
+}
+
+// The wire identity must consume the observed host and instant, not a fixed success marker.
+test fn host_access_receipt_is_bound_to_its_observation() -> Bool {
+  let observed = WorkspaceHostAccessObserved { host: "srv1", observed_at: "2026-10-09T00:00:00Z" }
+  let receipt = workspace_access_receipt(evidence: observed)
+  receipt == workspace_access_receipt(evidence: observed)
+    && receipt != workspace_access_receipt(evidence: WorkspaceHostAccessObserved { host: "srv2", observed_at: "2026-10-09T00:00:00Z" })
+    && receipt != workspace_access_receipt(evidence: WorkspaceHostAccessObserved { host: "srv1", observed_at: "2026-10-09T00:00:01Z" })
+}
diff --git a/dag/test/claim/workspace_transcript_rate_real_execution_witness_test.dag b/dag/test/claim/workspace_transcript_rate_real_execution_witness_test.dag
new file mode 100644
index 00000000000..59ae0b07514
--- /dev/null
+++ b/dag/test/claim/workspace_transcript_rate_real_execution_witness_test.dag
@@ -0,0 +1,87 @@
+module test.claim.workspace_transcript_rate_real_execution
+
+import std.types { String, NonEmptyStr, Int, Bool, List, FilePath }
+import std.measure { measure_count }
+import std.algebra { Cons, Empty }
+import std.checkpointed_workspace { WorkspaceAgeOf, WorkspaceAgeUndefined, workspace_age_between }
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.shell
+import gunbc.fabric.workspace_source { WorkspaceSourceRoot }
+import gunbc.fabric.workspace_transcript_rate {
+  workspace_transcript_rate_sample_wet, workspace_transcript_rate_interval, TranscriptAppendInterval,
+  TranscriptRateSampled, TranscriptRateSampleRefused, TranscriptRateSample,
+}
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE INHABITANCE OF THE PURE BOUNDARIES IN test.claim.workspace_transcript_rate (DESIGN 3: supplied
+// inputs never remove the last execution of the real path). A real agent-state tree is planted in a
+// directory the witness mints and removes, and the production sampler -- the real find walk, the
+// pack's real matcher -- reads it, is written to, and reads it again. The route is asserted, not only
+// the answer: the transcript grows by exactly the bytes written, a new transcript appears at its
+// whole size, a file outside the transcript class is never observed however much it grows, and a
+// transcript rewritten shorter is a truncation. A root that does not exist refuses through find's
+// own status.
+
+fn with_temp_dir(scenario: fn(String) -> Bool) -> Bool {
+  let dir = shell.Mktemp.Dir()
+  if dir.success == false {
+    false
+  } else {
+    let observed = scenario(dir.path as String)
+    let cleaned = shell.Remove.RecursiveForce(path: dir.path)
+    observed && cleaned.success
+  }
+}
+
+fn root_at(dir: String) -> WorkspaceSourceRoot {
+  WorkspaceSourceRoot { label: "claude-agent-state-witness", path: join([dir, "/.claude"], "") as NonEmptyStr, build_output: [] }
+}
+
+fn interval_of(before: TranscriptRateSample, after: TranscriptRateSample) -> List<TranscriptAppendInterval> {
+  match before {
+    TranscriptRateSampleRefused { refusals: _ } => []
+    TranscriptRateSampled { at: a, files: fa } =>
+      match after {
+        TranscriptRateSampleRefused { refusals: _ } => []
+        TranscriptRateSampled { at: b, files: fb } =>
+          match workspace_age_between(from: a, to: b) {
+            WorkspaceAgeUndefined { order: _ } => []
+            WorkspaceAgeOf { age: span } => [workspace_transcript_rate_interval(before: fa, after: fb, span: span)]
+          }
+      }
+  }
+}
+
+test fn a_real_tree_grows_gains_a_transcript_and_truncates_one_by_real_execution() -> Bool {
+  with_temp_dir(scenario: dir => {
+    let projects = join([dir, "/.claude/projects/p"], "")
+    let planted = shell.Mkdir.Parents(path: projects as FilePath).success
+      && Filesystem.Write(path: join([projects, "/s.jsonl"], ""), content: "0123456789").success
+      && Filesystem.Write(path: join([projects, "/t.jsonl"], ""), content: "0123456789").success
+      && Filesystem.Write(path: join([dir, "/.claude/settings.json"], ""), content: "{}").success
+    let first = workspace_transcript_rate_sample_wet(roots: [root_at(dir: dir)], label: "transcript-rate-witness-first")
+    let written = Filesystem.Write(path: join([projects, "/s.jsonl"], ""), content: "0123456789abcdefghij").success
+      && Filesystem.Write(path: join([projects, "/t.jsonl"], ""), content: "0123").success
+      && Filesystem.Write(path: join([projects, "/u.jsonl"], ""), content: "01234").success
+      && Filesystem.Write(path: join([dir, "/.claude/settings.json"], ""), content: "{\"a\":\"a much longer settings file\"}").success
+    let second = workspace_transcript_rate_sample_wet(roots: [root_at(dir: dir)], label: "transcript-rate-witness-second")
+    planted && written && (match interval_of(before: first, after: second) {
+      Cons { head: row, tail: Empty } =>
+        measure_count(m: row.bytes_appended) == 15
+          && row.files_grown == 1 && row.files_created == 1 && length(row.truncations) == 1 && row.active_writers == 3
+      Cons { head: _, tail: Cons { head: _, tail: _ } } => false
+      Empty => false
+    })
+  })
+}
+
+test fn a_root_that_does_not_exist_refuses_by_real_execution() -> Bool {
+  with_temp_dir(scenario: dir => {
+    match workspace_transcript_rate_sample_wet(roots: [root_at(dir: dir)], label: "transcript-rate-witness-absent") {
+      TranscriptRateSampleRefused { refusals: rs } => length(rs) == 1
+      TranscriptRateSampled { at: _, files: _ } => false
+    }
+  })
+}
diff --git a/dag/test/claim/workspace_transcript_rate_witness_test.dag b/dag/test/claim/workspace_transcript_rate_witness_test.dag
new file mode 100644
index 00000000000..a73788bf019
--- /dev/null
+++ b/dag/test/claim/workspace_transcript_rate_witness_test.dag
@@ -0,0 +1,205 @@
+module test.claim.workspace_transcript_rate
+
+import std.types { String, NonEmptyStr, Int, Bool, List }
+import std.measure { InstantBefore, InstantSame, byte_size, measure_count, nanosecond, nanosecond_count, ObservationInstant, ProcessMonotonic, WallClock, CpuClock, InstantAfter, InstantIncomparable }
+import std.optional { Present, Absent }
+import std.algebra { Cons, Empty }
+import extdeps.shell.exec { ProcessRunOutcome, ProcessRan, ProcessNotSpawned, ProcessObservation }
+import extdeps.tools.findutils { find_regular_files_sha256_command, find_command_runs_another_program }
+import gunbc.fabric.workspace_source { WorkspaceSourceRoot, workspace_source_fixed_roots, workspace_agent_state_slot_admission }
+import gunbc.fabric.workspace_transcript_rate {
+  TranscriptFileStat, TranscriptFileMtime, TranscriptRateClockUndefined, workspace_transcript_rate_root_command, workspace_transcript_rate_root_reading,
+  TranscriptRootRead, TranscriptRootRefused, workspace_transcript_rate_interval, workspace_transcript_rate_mtime,
+  TranscriptRateSampled, TranscriptRateSampleRefused, TranscriptRateSample, workspace_transcript_rate_window_of,
+  TranscriptRateObserved, TranscriptRateRefused, TranscriptRateRootSelection, TranscriptRateObservation, workspace_transcript_rate_receipt,
+  workspace_transcript_rate_select_roots, workspace_transcript_rate_roots, TranscriptRateRootsSelected, TranscriptRateRootUndeclared, TranscriptRateSlotRefused, workspace_transcript_rate_fixed_root_labels,
+}
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE TRANSCRIPT APPEND-RATE INSTRUMENT AT ITS PURE BOUNDARIES, inputs supplied. Each claim has a
+// discriminating red beside its positive control: the walk is a reader of metadata and the
+// content-reading sha256 walk is not; a shrinking file is a truncation and never a negative append;
+// an unreadable root refuses the sample and the window. The real walk over a real tree -- growth,
+// creation, truncation and a missing root through find itself -- is the inhabitance claim in
+// test.claim.workspace_transcript_rate_real_execution.
+
+data root: WorkspaceSourceRoot = WorkspaceSourceRoot { label: "claude-agent-state-test", path: "/r/.claude", build_output: [] }
+
+fn stat(member: String, size: Int, mtime: Int) -> TranscriptFileStat {
+  TranscriptFileStat { member: member as NonEmptyStr, size: byte_size(count: size), mtime: TranscriptFileMtime { since_epoch: nanosecond(count: mtime) } }
+}
+
+// One clock for every sample of a window, as the wet sampler uses; a second process name or a CPU
+// basis is a different clock.
+fn at(ns: Int) -> ObservationInstant {
+  ObservationInstant { domain: ProcessMonotonic { process: "workspace-transcript-rate" }, basis: WallClock, since_origin: nanosecond(count: ns) }
+}
+
+fn ran(code: Int, stdout: String, stderr: String) -> ProcessRunOutcome {
+  ProcessRan { observation: ProcessObservation { exit_code: code, stdout: stdout, stderr: stderr } }
+}
+
+test fn the_walk_runs_no_other_program_while_the_sha256_walk_does() -> Bool {
+  let walk = workspace_transcript_rate_root_command(root: root)
+  (walk.program.invocation as String) == "find"
+    && find_command_runs_another_program(command: walk) == false
+    && find_command_runs_another_program(command: find_regular_files_sha256_command(root: "/r/.claude"))
+}
+
+test fn a_shrinking_file_is_a_truncation_and_not_a_negative_append() -> Bool {
+  let row = workspace_transcript_rate_interval(
+    before: [stat(member: "r/.claude/projects/p/a.jsonl", size: 100, mtime: 1), stat(member: "r/.claude/projects/p/b.jsonl", size: 50, mtime: 1)],
+    after: [stat(member: "r/.claude/projects/p/a.jsonl", size: 40, mtime: 2), stat(member: "r/.claude/projects/p/b.jsonl", size: 60, mtime: 2)],
+    span: nanosecond(count: 10000000000),
+  )
+  measure_count(m: row.bytes_appended) == 10
+    && row.files_grown == 1
+    && row.active_writers == 2
+    && (match row.truncations {
+      Cons { head: t, tail: Empty } => (t.member as String) == "r/.claude/projects/p/a.jsonl" && measure_count(m: t.from) == 100 && measure_count(m: t.to) == 40
+      Cons { head: _, tail: Cons { head: _, tail: _ } } => false
+      Empty => false
+    })
+}
+
+test fn growth_creation_removal_and_a_same_size_rewrite_are_counted_apart() -> Bool {
+  let row = workspace_transcript_rate_interval(
+    before: [stat(member: "a", size: 10, mtime: 1), stat(member: "b", size: 10, mtime: 1), stat(member: "c", size: 10, mtime: 1), stat(member: "d", size: 10, mtime: 1)],
+    after: [stat(member: "a", size: 15, mtime: 2), stat(member: "b", size: 10, mtime: 2), stat(member: "c", size: 10, mtime: 1), stat(member: "e", size: 7, mtime: 2)],
+    span: nanosecond(count: 100),
+  )
+  measure_count(m: row.bytes_appended) == 12
+    && row.files_grown == 1 && row.files_created == 1 && row.files_removed == 1 && row.files_rewritten_same_size == 1
+    && row.active_writers == 3 && nanosecond_count(n: row.span) == 100
+}
+
+test fn the_walk_keeps_only_the_packs_transcript_class_and_reads_mtime_to_the_nanosecond() -> Bool {
+  match workspace_transcript_rate_root_reading(root: root, run: ran(code: 0, stdout: "64\t1728123456.1234567890\tprojects/p/s.jsonl\n9\t1728123456.5\tsettings.json\n5\t1.0\t.credentials.json\n3\t2.25\thistory.jsonl\n", stderr: "")) {
+    TranscriptRootRefused { root: _, detail: _ } => false
+    TranscriptRootRead { files: fs } =>
+      length(fs) == 2
+        && any(fs, f => (f.member as String) == "r/.claude/projects/p/s.jsonl" && measure_count(m: f.size) == 64 && nanosecond_count(n: f.mtime.since_epoch) == 1728123456123456789)
+        && any(fs, f => (f.member as String) == "r/.claude/history.jsonl" && nanosecond_count(n: f.mtime.since_epoch) == 2250000000)
+  }
+}
+
+test fn an_unparsed_mtime_or_line_refuses_rather_than_dropping_the_file() -> Bool {
+  (match workspace_transcript_rate_mtime(text: "1.2.3") { Absent => true  Present { value: _ } => false })
+    && (match workspace_transcript_rate_root_reading(root: root, run: ran(code: 0, stdout: "64 projects/p/s.jsonl\n", stderr: "")) {
+      TranscriptRootRefused { root: _, detail: _ } => true
+      TranscriptRootRead { files: _ } => false
+    })
+}
+
+fn never(k: Int) -> TranscriptRateSample {
+  TranscriptRateSampleRefused { refusals: ["not sampled"] }
+}
+
+test fn an_unreadable_root_refuses_the_sample_and_the_window() -> Bool {
+  let reading = workspace_transcript_rate_root_reading(root: root, run: ran(code: 1, stdout: "", stderr: "find: '/r/.claude': Permission denied"))
+  let not_spawned = workspace_transcript_rate_root_reading(root: root, run: ProcessNotSpawned { program: "find", cause: "no such program" })
+  (match reading { TranscriptRootRefused { root: _, detail: _ } => true  TranscriptRootRead { files: _ } => false })
+    && (match not_spawned { TranscriptRootRefused { root: _, detail: _ } => true  TranscriptRootRead { files: _ } => false })
+    && (match workspace_transcript_rate_window_of(baseline: TranscriptRateSampleRefused { refusals: ["claude: denied"] }, remaining: 3, next: never, pause: k => true, rows: []) {
+      TranscriptRateRefused { reason: _, rows: rows } => length(rows) == 0
+      TranscriptRateObserved { rate: _ } => false
+      TranscriptRateClockUndefined { from: _, to: _, order: _, rows: _ } => false
+    })
+}
+
+fn second_sample(k: Int) -> TranscriptRateSample {
+  if k == 2 {
+    TranscriptRateSampled { at: at(ns: 10000000000), files: [stat(member: "a", size: 1010, mtime: 2)] }
+  } else {
+    TranscriptRateSampled { at: at(ns: 20000000000), files: [stat(member: "a", size: 1030, mtime: 3)] }
+  }
+}
+
+test fn a_completed_window_receipts_every_interval_and_the_summary_with_its_caveat() -> Bool {
+  match workspace_transcript_rate_window_of(baseline: TranscriptRateSampled { at: at(ns: 0), files: [stat(member: "a", size: 1000, mtime: 1)] }, remaining: 2, next: second_sample, pause: k => true, rows: []) {
+    TranscriptRateRefused { reason: _, rows: _ } => false
+    TranscriptRateClockUndefined { from: _, to: _, order: _, rows: _ } => false
+    TranscriptRateObserved { rate: r } => {
+      let receipt = workspace_transcript_rate_receipt(head: "", observation: TranscriptRateObserved { rate: r })
+      length(r.rows) == 2
+        && contains(receipt, "interval 1 span_ms=10000 bytes_appended=10 ")
+        && contains(receipt, "interval 2 span_ms=10000 bytes_appended=20 ")
+        && contains(receipt, " mean_bits_per_s=12 mean_bytes_per_s=1 ")
+        && contains(receipt, " p95_bits_per_s=16 p95_bytes_per_s=2 ")
+        && contains(receipt, "verdict=observed")
+        && contains(r.caveat as String, "ONE SAMPLE OF WORKLOAD")
+    }
+  }
+}
+
+test fn a_failed_pause_refuses_the_window() -> Bool {
+  match workspace_transcript_rate_window_of(baseline: TranscriptRateSampled { at: at(ns: 0), files: [] }, remaining: 2, next: second_sample, pause: k => false, rows: []) {
+    TranscriptRateRefused { reason: _, rows: _ } => true
+    TranscriptRateObserved { rate: _ } => false
+    TranscriptRateClockUndefined { from: _, to: _, order: _, rows: _ } => false
+  }
+}
+
+// The Claude root comes from the pack's slot admission, supplied here with an observed slot set; the
+// Codex root is the pack's fixed row. An unknown slot refuses the selection.
+fn roots_for(requested: String) -> TranscriptRateRootSelection {
+  workspace_transcript_rate_roots(
+    slot: workspace_agent_state_slot_admission(requested: Present { value: requested }, observed: ["gmail2", "gmail3"]),
+    fixed: workspace_transcript_rate_select_roots(labels: workspace_transcript_rate_fixed_root_labels, declared: workspace_source_fixed_roots),
+  )
+}
+
+test fn the_observed_roots_are_the_admitted_slot_and_the_codex_row_and_an_unknown_slot_refuses() -> Bool {
+  (match roots_for(requested: "gmail2") {
+    TranscriptRateRootsSelected { roots: rs } => length(rs) == 2 && any(rs, r => (r.path as String) == "/home/briansrls/.claude@gmail2") && any(rs, r => (r.path as String) == "/home/briansrls/.codex")
+    TranscriptRateRootUndeclared { label: _ } => false
+    TranscriptRateSlotRefused { slot: _ } => false
+  })
+    && (match roots_for(requested: "gmail9") {
+      TranscriptRateSlotRefused { slot: _ } => true
+      TranscriptRateRootsSelected { roots: _ } => false
+      TranscriptRateRootUndeclared { label: _ } => false
+    })
+    && (match workspace_transcript_rate_select_roots(labels: ["no-such-root"], declared: workspace_source_fixed_roots) {
+      TranscriptRateRootUndeclared { label: l } => (l as String) == "no-such-root"
+      TranscriptRateRootsSelected { roots: _ } => false
+      TranscriptRateSlotRefused { slot: _ } => false
+    })
+}
+
+fn sample_at(instant: ObservationInstant) -> fn(Int) -> TranscriptRateSample {
+  k => TranscriptRateSampled { at: instant, files: [] }
+}
+
+fn window_after(instant: ObservationInstant) -> TranscriptRateObservation {
+  workspace_transcript_rate_window_of(baseline: TranscriptRateSampled { at: at(ns: 10), files: [] }, remaining: 1, next: sample_at(instant: instant), pause: k => true, rows: [])
+}
+
+// THE SPAN IS DERIVED BY ORDERING TWO INSTANTS OF ONE CLOCK. The positive control is the ordered pair
+// on the same domain and basis; the reds are a later instant that does not follow (InstantAfter) and
+// an instant on another process's clock or another basis (InstantIncomparable) -- each its own typed
+// refusal carrying the order, never a zero span read as a quiet interval.
+test fn ordered_same_clock_instants_derive_a_span_and_reversed_or_foreign_instants_refuse_by_their_order() -> Bool {
+  (match window_after(instant: at(ns: 25)) {
+    TranscriptRateObserved { rate: r } => (match r.rows { Cons { head: row, tail: Empty } => nanosecond_count(n: row.span) == 15  Cons { head: _, tail: Cons { head: _, tail: _ } } => false  Empty => false })
+    TranscriptRateRefused { reason: _, rows: _ } => false
+    TranscriptRateClockUndefined { from: _, to: _, order: _, rows: _ } => false
+  })
+    && (match window_after(instant: at(ns: 5)) {
+      TranscriptRateClockUndefined { from: _, to: _, order: o, rows: rows } => length(rows) == 0 && (match o { InstantAfter => true  InstantIncomparable { left: _, right: _ } => false  InstantBefore => false  InstantSame => false })
+      TranscriptRateObserved { rate: _ } => false
+      TranscriptRateRefused { reason: _, rows: _ } => false
+    })
+    && (match window_after(instant: ObservationInstant { domain: ProcessMonotonic { process: "another-process" }, basis: WallClock, since_origin: nanosecond(count: 25) }) {
+      TranscriptRateClockUndefined { from: _, to: _, order: o, rows: _ } => (match o { InstantIncomparable { left: _, right: _ } => true  InstantAfter => false  InstantBefore => false  InstantSame => false })
+      TranscriptRateObserved { rate: _ } => false
+      TranscriptRateRefused { reason: _, rows: _ } => false
+    })
+    && (match window_after(instant: ObservationInstant { domain: ProcessMonotonic { process: "workspace-transcript-rate" }, basis: CpuClock, since_origin: nanosecond(count: 25) }) {
+      TranscriptRateClockUndefined { from: _, to: _, order: o, rows: _ } => (match o { InstantIncomparable { left: _, right: _ } => true  InstantAfter => false  InstantBefore => false  InstantSame => false })
+      TranscriptRateObserved { rate: _ } => false
+      TranscriptRateRefused { reason: _, rows: _ } => false
+    })
+}
diff --git a/dag/test/claim/workspace_workflow_dispatch_witness_test.dag b/dag/test/claim/workspace_workflow_dispatch_witness_test.dag
new file mode 100644
index 00000000000..db2ebeffc1c
--- /dev/null
+++ b/dag/test/claim/workspace_workflow_dispatch_witness_test.dag
@@ -0,0 +1,59 @@
+module test.claim.workspace_workflow_dispatch_witness_test
+
+import std.types { Bool, String }
+import gunbc.fleet_converge_workflow {
+  WorkspaceAllocationPlan, WorkspaceImageBuild,
+  fleet_converge_job_with_steps, fleet_converge_shared_job_if, fleet_converge_dispatch_inputs, fleet_converge_mode_scope, fleet_converge_mode_job_id, fleet_converge_shared_job_id,
+  fleet_converge_mode_release_product, CompilerPairOnly,
+  fleet_converge_mode_fleet_ssh_key_demand, FleetSshKeyNotConsumed,
+}
+import gunbc.fleet_converge_scope { WorkspaceAllocationOnly }
+import gunbc.ci_spec { gunbc_ci_workspace_image_build_invoke }
+import gunbc.workspace_image_delivery { workspace_image_artifact_paths }
+
+test fn workspace_allocation_uses_its_existing_scope() -> Bool {
+  (match fleet_converge_mode_scope(mode: WorkspaceAllocationPlan) {
+    Present { value: WorkspaceAllocationOnly } => true
+    Present { value: _ } => false
+    Absent => false
+  }) && all([WorkspaceImageBuild], mode =>
+    match fleet_converge_mode_scope(mode: mode) { Absent => true Present { value: _ } => false })
+}
+
+test fn workspace_operations_use_the_serialized_host_job_without_fleet_credentials() -> Bool {
+  all([WorkspaceAllocationPlan, WorkspaceImageBuild], mode =>
+    fleet_converge_mode_job_id(mode: mode) == fleet_converge_shared_job_id
+      && fleet_converge_mode_release_product(mode: mode) == CompilerPairOnly
+      && fleet_converge_mode_fleet_ssh_key_demand(mode: mode) == FleetSshKeyNotConsumed)
+}
+
+test fn workspace_image_build_preserves_ownership_and_archives_only_the_product() -> Bool {
+  let build = gunbc_ci_workspace_image_build_invoke()
+  let paths = workspace_image_artifact_paths()
+  string_contains(s: build, pattern: "fakeroot -- ")
+    && string_contains(s: build, pattern: "workspace_image_build_wet")
+    && string_contains(s: paths, pattern: "/workspace.ext4")
+    && !string_contains(s: paths, pattern: "workspace-tree")
+    && !string_contains(s: paths, pattern: "squashfs")
+}
+
+test fn fleet_dispatch_stays_within_github_input_limit() -> Bool {
+  count(fleet_converge_dispatch_inputs) <= 25
+}
+
+// SUPPLIED AT THE BOUNDARY: an empty step list avoids constructing unrelated deployment
+// programs. The production job envelope still owns the actual if-condition assignment. Shared
+// modes must select it positively; dedicated modes cannot select the credentialed shared job.
+test fn dedicated_installs_do_not_also_run_the_shared_credentialed_job() -> Bool {
+  match fleet_converge_job_with_steps(steps: []).if_condition {
+    Absent => false
+    Present { value: condition } => condition == fleet_converge_shared_job_if
+      && string_contains(s: condition, pattern: "github.event.inputs.mode == 'workspace_image_build'")
+      && string_contains(s: condition, pattern: "github.event.inputs.mode == 'workspace_allocation_plan'")
+      && string_contains(s: condition, pattern: "github.event.inputs.mode == 'plan'")
+      && !string_contains(s: condition, pattern: "microvm_controller_install")
+      && !string_contains(s: condition, pattern: "dashboard_deploy")
+      && !string_contains(s: condition, pattern: "gcp_iam_converge")
+      && !string_contains(s: condition, pattern: " != ")
+  }
+}
diff --git a/dag/test/claim/xorriso_path_list_witness_test.dag b/dag/test/claim/xorriso_path_list_witness_test.dag
index a4c49552407..3a76751b147 100644
--- a/dag/test/claim/xorriso_path_list_witness_test.dag
+++ b/dag/test/claim/xorriso_path_list_witness_test.dag
@@ -85,6 +85,7 @@ test fn nested_seed_directories_pin_owner_from_the_top_and_mode_on_every_level()
     Mtcollins1CensusImageDerived { input: i } => {
       let nested = UbuntuSeededInstallMediaBuildInput {
         stock_artifact: i.stock_artifact, nocloud_dir_on_iso: "nocloud/srv3", user_data_body: i.user_data_body, seed_files: [],
+        seed_artifacts: [],
         grub_kernel_cmdline: i.grub_kernel_cmdline, volume_id: i.volume_id, pinned_dates: i.pinned_dates, image_stem: i.image_stem, builder_revision: i.builder_revision,
       }
       install_media_remaster_seed_directory_levels(nocloud_dir_on_iso: "nocloud/srv3") == ["/nocloud", "/nocloud/srv3"]
diff --git a/dag/test/fixture/board_fru_observation.dag b/dag/test/fixture/board_fru_observation.dag
new file mode 100644
index 00000000000..b7169ec50c1
--- /dev/null
+++ b/dag/test/fixture/board_fru_observation.dag
@@ -0,0 +1,26 @@
+module test.fixture.board_fru_observation
+
+import std.optional { Present }
+import extdeps.board_authority { BoardFruIdentity, BoardFruObservation, BoardFruRead }
+
+// FRU board-area readings as SUPPLIED VALUES for witnesses that need a host's observed board. The
+// two committed reads carry exactly the fields of the captured `ipmitool fru print` texts
+// (artifacts/bmc/mtcollins1-controller-fru-2026-09-12.txt and
+// artifacts/bmc/mtjade1-ipmitool-fru-print-192.168.1.246-2026-10-04T110207Z.txt); the claim that
+// the real producer reads those texts into these shapes is gunbc board_authority_binding's
+// inhabitance witness. The ASRock read is a board with no binding row.
+data collins_fru_read: BoardFruObservation = BoardFruRead { fru: BoardFruIdentity {
+  manufacturer: "FOXCONN", product: "Mt. Collins", part_number: Present { value: "02030A800-600-G" }
+} }
+
+data jade_fru_read: BoardFruObservation = BoardFruRead { fru: BoardFruIdentity {
+  manufacturer: "WIWYNN", product: "Mt.Jade Motherboard", part_number: Present { value: "B81.03010.0041" }
+} }
+
+data asrock_fru_read: BoardFruObservation = BoardFruRead { fru: BoardFruIdentity {
+  manufacturer: "ASRockRack", product: "ALTRAD8UD-1L2T", part_number: none
+} }
+
+data gigabyte_fru_read: BoardFruObservation = BoardFruRead { fru: BoardFruIdentity {
+  manufacturer: "GIGABYTE", product: "MP72-HB0", part_number: none
+} }
diff --git a/dag/test/fixture/recorded_required_floor_log_excerpt.dag b/dag/test/fixture/recorded_required_floor_log_excerpt.dag
new file mode 100644
index 00000000000..6c738127189
--- /dev/null
+++ b/dag/test/fixture/recorded_required_floor_log_excerpt.dag
@@ -0,0 +1,22 @@
+module test.fixture.recorded_required_floor_log_excerpt
+
+import std.types { Int, String }
+
+// REAL BYTES FROM ONE RECORDED REQUIRED-FLOOR JOB LOG, NOT A DESIGNED FIXTURE. The source is GitHub
+// Actions run 35048059968, job 104642384772 (required-witnesses-floor, conclusion success, runner slot
+// actions-runner@srv4-18.service), read through GitHub's "Download job logs for a workflow run" on
+// 2026-10-04. The excerpt is every `[floor-phase]` and `[floor-cgroup]` line of that log, verbatim and
+// in log order with GitHub's timestamp prefix kept, plus a handful of the log's untagged and
+// differently tagged lines (an `[over-cost]` preview row among them) that a reader of the two tags
+// must pass over. Nothing is edited inside a line; the .dag string escapes are the only change.
+//
+// IT IS AN EXCERPT BECAUSE THE WHOLE LOG IS 1.5 MB, and that size is itself a recorded fact the
+// extraction relies on: it sits well under the seed REST handler's whole-body read, so the network
+// read of a log like this one is not refused for size.
+data recorded_floor_log_run_id: Int = 35048059968
+
+data recorded_floor_log_job_id: Int = 104642384772
+
+data recorded_floor_log_slot_unit: String = "actions-runner@srv4-18.service"
+
+data recorded_required_floor_log_excerpt: String = "2026-09-16T02:36:29.9676382Z [floor-cgroup] when=floor-entry path=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice/actions-runner@srv4-18.service\n2026-09-16T02:36:29.9692531Z [floor-cgroup] when=floor-entry level=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice/actions-runner@srv4-18.service max=17179869184 high=16106127360 current=8949473280 peak=10444185600 events=[low,0,high,0,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,0,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=0.00,avg60=0.00,avg300=0.00,total=2,full,avg10=0.00,avg60=0.00,avg300=0.00,total=2]\n2026-09-16T02:36:29.9698651Z [floor-cgroup] when=floor-entry level=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice max=max high=max current=196170059776 peak=364675248128 events=[low,0,high,53814358,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,0,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=0.00,avg60=0.00,avg300=0.02,total=13867330781,full,avg10=0.00,avg60=0.00,avg300=0.02,total=13729467014]\n2026-09-16T02:36:29.9703909Z [floor-cgroup] when=floor-entry level=/sys/fs/cgroup/system.slice max=max high=max current=212249088000 peak=380169330688 events=[low,0,high,53814358,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,0,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=0.00,avg60=0.00,avg300=0.02,total=13841256370,full,avg10=0.00,avg60=0.00,avg300=0.02,total=13703013143]\n2026-09-16T02:36:29.9709147Z [floor-phase] phase=strict-preparation state=started\n2026-09-16T02:40:20.9989392Z [floor-phase] phase=gate-closure state=completed wall_ms=22194 prefixes=0 seeds=1 closure=168 bare_pulled=36 outside_closure=5688 corpus=5856\n2026-09-16T02:40:32.0494666Z [floor-phase] phase=expr-var-classification expr_var_occurrences=13930 free_reference_edges=3081 bound_occurrences_suppressed=10836 qualified_chain_heads=13 classification_refusals=0\n2026-09-16T02:40:32.0501531Z [floor-phase] phase=expr-var-classification BoundByParameter=7869 BoundByLet=1153 BoundByMatchPattern=1814 DeclaredInThisModule=1964 DeclaredElsewhere=1117 QualifiedChainHead=13\n2026-09-16T02:40:32.0506107Z [floor-phase] phase=reference-closure-index state=completed wall_ms=63 modules=168 names=6680 subject=93ea90191edaf50d\n2026-09-16T02:40:32.7858463Z [floor-phase] phase=touched-entry-compile-subject seeds=5 modules=[\"extdeps.tmux\", \"gunbc.roadmap_dashboard_instance\", \"gunbc.roadmap_dashboard_instance_apply\", \"test.claim.roadmap_dashboard_instance_apply_witness\", \"test.claim.tmux_session_list_outcome_witness\"]\n2026-09-16T02:40:32.7866444Z [floor-phase] phase=arm-set-changed-consumers state=completed changed_declarations=0 consumers_added=0 flat_channel_consumers=0 outside_floor_roots=0 base=db2257679fb454fcf80ddb4b901d422e8afa5d51 head=84085164947f2c2116ecd8060368c2cf35d22c8c\n2026-09-16T02:41:38.2496524Z [floor-phase] phase=gate-closure state=completed wall_ms=65296 prefixes=32 seeds=1027 closure=3021 bare_pulled=71 outside_closure=2835 corpus=5856\n2026-09-16T02:46:29.9985719Z [floor-cgroup] when=beat-10 path=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice/actions-runner@srv4-18.service\n2026-09-16T02:46:29.9992653Z [floor-cgroup] when=beat-10 level=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice/actions-runner@srv4-18.service max=17179869184 high=16106127360 current=16104755200 peak=16106577920 events=[low,0,high,3848,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,3848,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=5.62,avg60=3.64,avg300=1.66,total=8053481,full,avg10=5.62,avg60=3.64,avg300=1.66,total=8053205]\n2026-09-16T02:46:30.0042734Z [floor-cgroup] when=beat-10 level=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice max=max high=max current=227828391936 peak=364675248128 events=[low,0,high,53837371,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,0,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=1.16,avg60=1.36,avg300=0.72,total=13872120203,full,avg10=1.16,avg60=1.36,avg300=0.72,total=13734253335]\n2026-09-16T02:46:30.0074968Z [floor-cgroup] when=beat-10 level=/sys/fs/cgroup/system.slice max=max high=max current=243909996544 peak=380169330688 events=[low,0,high,53837371,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,0,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=1.15,avg60=1.39,avg300=0.72,total=13846043407,full,avg10=1.15,avg60=1.39,avg300=0.72,total=13707796653]\n2026-09-16T02:48:21.6671401Z [floor-phase] phase=module-path-index-warm state=completed cpu_ms=0 wall_ms=0 rss_growth_bytes=8192 modules=5856 provenance=built-by-preparation\n2026-09-16T02:48:21.6828893Z [floor-phase] phase=shared-index-warm state=completed cpu_ms=0 wall_ms=0 rss_growth_bytes=61440 modules=5856 provenance=built-by-preparation\n2026-09-16T02:48:22.6822520Z [floor-phase] phase=expr-var-classification expr_var_occurrences=178167 free_reference_edges=47772 bound_occurrences_suppressed=129176 qualified_chain_heads=1210 classification_refusals=0\n2026-09-16T02:48:22.6831385Z [floor-phase] phase=expr-var-classification BoundByParameter=84278 BoundByLet=17473 BoundByMatchPattern=27425 DeclaredInThisModule=21920 DeclaredElsewhere=25852 QualifiedChainHead=1210 NamesNothingKnown=9\n2026-09-16T02:48:22.7377365Z [floor-phase] phase=expr-var-classification unclassified=9 distinct=7 specimens=[\"extdeps.cloud.gcp.iam::access_token\", \"extdeps.cloud.gcp.secret_manager::access_token\", \"extdeps.cloudflare.account_api_tokens::auth_token\", \"extdeps.github.pulls::List_PullRequest\", \"extdeps.github.pulls::List_PullReview\", \"extdeps.github.pulls::List_ReviewComment\", \"std.resources::ReadWrite\"]\n2026-09-16T02:48:22.7385985Z [floor-phase] phase=reference-closure-index state=completed wall_ms=926 modules=3019 names=68559 subject=eb8fa8db5887fb3b\n2026-09-16T02:48:24.2494508Z [floor-phase] phase=pool-root-index-warm state=completed cpu_ms=524 wall_ms=777 rss_growth_bytes=7786496 producer=v2.lens.registry.completeness.lens_registry_completeness_live_facts provenance=built-by-preparation\n2026-09-16T02:48:25.1817029Z [floor-phase] phase=languages-consumer-census-warm state=completed cpu_ms=729 wall_ms=785 rss_growth_bytes=0 decl_rows=72 provenance=built-by-preparation\n2026-09-16T02:48:27.8950074Z [floor-phase] phase=prepared-effect-input-acquire state=completed acquisition=gunbc.roadmap_authority.roadmap_acceptance_event_history_load checkout_input=dag/gunbc/roadmap/roadmap_acceptance_event_history.jsonl content_digest=ac7a97b227a758c0 disposition=RoadmapAcceptanceEventHistoryLoaded cpu_ms=13 wall_ms=23 rss_growth_bytes=0\n2026-09-16T02:48:28.1831332Z [floor-phase] phase=prepared-effect-input-warm state=completed producer=gunbc.roadmap_authority.roadmap_authority_projection input=gunbc.roadmap_authority.roadmap_acceptance_event_history_load disposition=Stored cpu_ms=250 wall_ms=287 rss_growth_bytes=1867776\n2026-09-16T02:48:30.3776259Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.native_decl_selection.collision_resolved disposition=Stored cpu_ms=2150 wall_ms=2194 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:30.3818798Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.extdeps.languages.bash_command_fold.bash_fold_formal_productions disposition=Stored cpu_ms=4 wall_ms=4 rss_growth_bytes=20480 provenance=built-by-preparation\n2026-09-16T02:48:30.3826228Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.extdeps.languages.bash_command_fold.bash_fold_lex disposition=Stored cpu_ms=0 wall_ms=0 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:30.4161518Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.compiler.program_assembly.dag_prepared_grammar disposition=Stored cpu_ms=32 wall_ms=32 rss_growth_bytes=4096 provenance=built-by-preparation\n2026-09-16T02:48:31.1141726Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.long.emit_host_produced_module_equals_eval.produced_add_module_source disposition=Stored cpu_ms=694 wall_ms=697 rss_growth_bytes=237568 provenance=built-by-preparation\n2026-09-16T02:48:31.6563401Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.long.emit_host_classical_not_ingested_equals_eval.ingested_classical_not_arrow_with_body disposition=Stored cpu_ms=529 wall_ms=531 rss_growth_bytes=20480 provenance=built-by-preparation\n2026-09-16T02:48:31.8729253Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.long.emit_host_classical_not_ingested_equals_eval.ingested_classical_not_swapped_arrow_with_body disposition=Stored cpu_ms=224 wall_ms=225 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:32.2808714Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.compiler.self_host.direct_rust_door_fixture.direct_rust_door_specimen_resolved disposition=Stored cpu_ms=405 wall_ms=408 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:32.6503107Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.execution.emit_on_demand_match_loop_fold_family_witness.mlf_family_primary_emitted disposition=Stored cpu_ms=358 wall_ms=369 rss_growth_bytes=487424 provenance=built-by-preparation\n2026-09-16T02:48:33.0043494Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.execution.emit_on_demand_family_crate_witness.logic_family_primary_emitted disposition=Stored cpu_ms=341 wall_ms=353 rss_growth_bytes=221184 provenance=built-by-preparation\n2026-09-16T02:48:33.3686481Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.self_host.stage0_production_target.stage0_boundary_profile_emitted_source disposition=Stored cpu_ms=358 wall_ms=364 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:33.5046083Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.self_host.stage0_production_target.stage0_boundary_base_emitted_source disposition=Stored cpu_ms=11 wall_ms=11 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:34.1446122Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.claim.self_host.rust_module_emission_population.population_emission_add disposition=Stored cpu_ms=744 wall_ms=764 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:34.3435250Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.claim.self_host.rust_module_emission_population.population_emission_add2 disposition=Stored cpu_ms=180 wall_ms=198 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:34.6980018Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.claim.self_host.rust_module_emission_population.population_emission_add_then_add2 disposition=Stored cpu_ms=342 wall_ms=354 rss_growth_bytes=114688 provenance=built-by-preparation\n2026-09-16T02:48:34.7349575Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.claim.self_host.rust_module_emission_population.population_declarationless_refuses disposition=Stored cpu_ms=35 wall_ms=36 rss_growth_bytes=20480 provenance=built-by-preparation\n2026-09-16T02:48:34.7437180Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.claim.self_host.rust_module_emission_population.population_unwired_two_declaration_refuses disposition=Stored cpu_ms=9 wall_ms=9 rss_growth_bytes=4096 provenance=built-by-preparation\n2026-09-16T02:48:34.7516227Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.claim.self_host.rust_module_emission_population.population_declaration_count_add disposition=Stored cpu_ms=6 wall_ms=6 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:34.7582621Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.claim.self_host.rust_module_emission_population.population_declaration_count_add_then_add2 disposition=Stored cpu_ms=8 wall_ms=8 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:34.9354974Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.parse.d1_declaration_grammar_parse.d1_where_reproducer_parsed disposition=Stored cpu_ms=166 wall_ms=173 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:35.0535117Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.parse.d1_declaration_grammar_parse.d1_where_bare_parsed disposition=Stored cpu_ms=116 wall_ms=121 rss_growth_bytes=90112 provenance=built-by-preparation\n2026-09-16T02:48:35.1540672Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.parse.d1_declaration_grammar_parse.d1_where_control_parsed disposition=Stored cpu_ms=97 wall_ms=100 rss_growth_bytes=49152 provenance=built-by-preparation\n2026-09-16T02:48:35.3384595Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.parse.d1_declaration_grammar_parse.d1_cache_identity_where_parsed disposition=Stored cpu_ms=183 wall_ms=184 rss_growth_bytes=4096 provenance=built-by-preparation\n2026-09-16T02:48:35.5009300Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.parse.where_refinement_clause_parse.where_refinement_bare_parsed disposition=Stored cpu_ms=161 wall_ms=162 rss_growth_bytes=16384 provenance=built-by-preparation\n2026-09-16T02:48:35.6112723Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.parse.expression_bodied_fn_decl_parse.expression_bodied_fn_parsed disposition=Stored cpu_ms=109 wall_ms=110 rss_growth_bytes=16384 provenance=built-by-preparation\n2026-09-16T02:48:35.6769819Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.parse.expression_bodied_fn_decl_parse.expression_bodied_literal_fn_parsed disposition=Stored cpu_ms=65 wall_ms=65 rss_growth_bytes=20480 provenance=built-by-preparation\n2026-09-16T02:48:35.7771869Z [floor-phase] phase=pure-producer-share-warm state=completed producer=v2.test.parse.expression_bodied_fn_decl_parse.braced_fn_control_parsed disposition=Stored cpu_ms=99 wall_ms=100 rss_growth_bytes=0 provenance=built-by-preparation\n2026-09-16T02:48:35.7781034Z [floor-phase] phase=pure-producer-share-scope state=completed rostered_modules_outside_subject=1 modules=[test.claim.live_deploy.emit]\n2026-09-16T02:48:55.2023750Z [floor-phase] phase=bare-reference-edge-index-warm state=completed roots=BareReferenceEdgeIndexBuild/source-roots cpu_ms=10124 wall_ms=17621 rss_growth_bytes=0 source_files=5856 bare_eligible=637 provenance=built-by-preparation\n2026-09-16T02:48:55.2034410Z [floor-phase] phase=bare-reference-edge-index-warm state=completed roots=BareReferenceEdgeIndexBuild/witness-layer-roots cpu_ms=6 wall_ms=6 rss_growth_bytes=0 source_files=5856 bare_eligible=637 provenance=already-warm-on-entry triggered_by=a-site-ahead-of-floor-preparation\n2026-09-16T02:48:55.2046185Z [floor-phase] phase=strict-preparation state=completed wall_ms=745230 modules_resolved=3019 modules_excluded=2 digest=eb8fa8db5887fb3b\n2026-09-16T02:48:55.4049682Z [floor-phase] phase=module-index state=completed wall_ms=202 modules=4460\n2026-09-16T02:48:55.7569513Z [floor-phase] phase=declarer-discovery state=completed wall_ms=350 declarers=18\n2026-09-16T02:48:56.1087890Z [floor-phase] phase=whole-tree-graph-facts state=completed wall_ms=353\n2026-09-16T02:48:56.1231903Z [floor-phase] phase=declarer-closure state=completed wall_ms=14 sources=19\n2026-09-16T02:48:56.2786170Z [floor-phase] phase=closure-strict-resolve state=completed wall_ms=155 sources=19\n2026-09-16T02:48:56.3076153Z [floor-phase] phase=published-mock-projection state=completed wall_ms=1105 keys=91\n2026-09-16T02:50:27.9817767Z [floor-phase] phase=discovery-authority state=completed wall_ms=90265 authority=v2.workflow.floor_discovery_source_authority sources=5856 rows=19891 entries=2194 full_inventory_release_rss_kb_before=15307380 full_inventory_release_trim_reclaimed_kb=731228 full_inventory_release_rss_kb_after=14577200\n2026-09-16T02:50:28.9533919Z [floor-claim-ceiling] grandfathered_identities=3779 grandfathered_budget_steps=361500 new_witness_budget_steps=72300\n2026-09-16T02:50:29.0124493Z [floor-phase] phase=site-projection state=completed wall_ms=91735 declared=19891 sites=4879 files=2194 claims=3971 declined_long=401 declined_fixture=0 declined_outside_gate=177 declined_gate_closure=15007 declined_discovery_excluded=5 declined_cost_debt=330\n2026-09-16T02:50:31.9575417Z [floor-phase] phase=expr-var-classification expr_var_occurrences=0 free_reference_edges=0 bound_occurrences_suppressed=0 qualified_chain_heads=0 classification_refusals=0\n2026-09-16T02:50:31.9580122Z [floor-phase] phase=expr-var-classification \n2026-09-16T02:50:31.9626843Z [floor-phase] phase=reference-closure-index state=completed wall_ms=0 modules=3 names=5 subject=c01458db5a196a34\n2026-09-16T02:50:31.9645327Z [floor-phase] phase=expr-var-classification expr_var_occurrences=1 free_reference_edges=0 bound_occurrences_suppressed=1 qualified_chain_heads=0 classification_refusals=0\n2026-09-16T02:50:31.9649696Z [floor-phase] phase=expr-var-classification BoundByParameter=1\n2026-09-16T02:50:31.9653062Z [floor-phase] phase=reference-closure-index state=completed wall_ms=0 modules=3 names=4 subject=92107e64fdc80bbc\n2026-09-16T02:50:31.9704793Z [floor-phase] phase=expr-var-classification expr_var_occurrences=1 free_reference_edges=1 bound_occurrences_suppressed=0 qualified_chain_heads=0 classification_refusals=0\n2026-09-16T02:50:31.9707855Z [floor-phase] phase=expr-var-classification DeclaredElsewhere=1\n2026-09-16T02:50:31.9712213Z [floor-phase] phase=reference-closure-index state=completed wall_ms=0 modules=4 names=7 subject=9b51427d706ae1d9\n2026-09-16T02:50:31.9898466Z [floor-phase] phase=expr-var-classification expr_var_occurrences=1 free_reference_edges=1 bound_occurrences_suppressed=0 qualified_chain_heads=0 classification_refusals=0\n2026-09-16T02:50:31.9903147Z [floor-phase] phase=expr-var-classification DeclaredInThisModule=1\n2026-09-16T02:50:31.9905070Z [floor-phase] phase=reference-closure-index state=completed wall_ms=0 modules=4 names=7 subject=3bd800efac0c7530\n2026-09-16T02:50:31.9923594Z [floor-phase] phase=expr-var-classification expr_var_occurrences=0 free_reference_edges=0 bound_occurrences_suppressed=0 qualified_chain_heads=0 classification_refusals=0\n2026-09-16T02:50:31.9926724Z [floor-phase] phase=expr-var-classification \n2026-09-16T02:50:31.9930122Z [floor-phase] phase=reference-closure-index state=completed wall_ms=0 modules=3 names=4 subject=fd4346f64dfada17\n2026-09-16T02:50:31.9993760Z [floor-phase] phase=expr-var-classification expr_var_occurrences=0 free_reference_edges=0 bound_occurrences_suppressed=0 qualified_chain_heads=0 classification_refusals=0\n2026-09-16T02:50:31.9995823Z [floor-phase] phase=expr-var-classification \n2026-09-16T02:50:31.9999837Z [floor-phase] phase=reference-closure-index state=completed wall_ms=0 modules=3 names=4 subject=fd4346f64dfada17\n2026-09-16T02:50:32.0033070Z [floor-phase] phase=expr-var-classification expr_var_occurrences=0 free_reference_edges=0 bound_occurrences_suppressed=0 qualified_chain_heads=0 classification_refusals=0\n2026-09-16T02:50:32.0037327Z [floor-phase] phase=expr-var-classification \n2026-09-16T02:50:32.0039559Z [floor-phase] phase=reference-closure-index state=completed wall_ms=0 modules=3 names=4 subject=fd4346f64dfada17\n2026-09-16T02:56:30.0047177Z [floor-cgroup] when=beat-20 path=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice/actions-runner@srv4-18.service\n2026-09-16T02:56:30.0056010Z [floor-cgroup] when=beat-20 level=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice/actions-runner@srv4-18.service max=17179869184 high=16106127360 current=16078217216 peak=16106631168 events=[low,0,high,7254,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,7254,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=2.17,avg60=1.80,avg300=1.62,total=26620107,full,avg10=2.17,avg60=1.80,avg300=1.62,total=26619735]\n2026-09-16T02:56:30.0068529Z [floor-cgroup] when=beat-20 level=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice max=max high=max current=159988195328 peak=364675248128 events=[low,0,high,53855074,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,0,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=0.24,avg60=0.28,avg300=0.47,total=13878228854,full,avg10=0.24,avg60=0.28,avg300=0.47,total=13740334938]\n2026-09-16T02:56:30.0079198Z [floor-cgroup] when=beat-20 level=/sys/fs/cgroup/system.slice max=max high=max current=176071000064 peak=380169330688 events=[low,0,high,53855074,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,0,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=0.21,avg60=0.26,avg300=0.45,total=13852086330,full,avg10=0.21,avg60=0.26,avg300=0.45,total=13713813769]\n2026-09-16T02:59:58.3859791Z [floor-fold-time] scope_build=143.5s over 695 construction(s) (mean=206ms) frame_build=2.2s over 3971 construction(s) (mean=0.5ms)\n2026-09-16T02:59:58.3860774Z [floor-scope-cost] max=0.13GB at=v2.test.claim.staging (1596 modules) total_built=1.29GB over 695 construction(s)\n2026-09-16T03:00:30.6968920Z [floor-phase] phase=terminal-ledger-publish state=completed resolve_ms=31249 total_ms=32635 rows=3971\n2026-09-16T03:00:30.8700701Z [over-cost] v2.test.claim.enforcement.determinism_transitive_witness.determinism_live_intra_holds observed_wall_ms=325 observed_cpu_ms=317 eval_steps=165094 line_ms=100 outcome=pass\n2026-09-16T03:00:30.8705737Z [over-cost] v2.test.lens_test_migration_debt.test_migration_debt_test.retained_rust_kernel_wall_holds_against_live_tree observed_wall_ms=295 observed_cpu_ms=292 eval_steps=3128 line_ms=100 outcome=fail\n2026-09-16T03:00:30.8711745Z [over-cost] v2.test.claim.body_lowering.arrow_body_form_witness.arrow_body_form_eval_value_vertical_holds observed_wall_ms=287 observed_cpu_ms=232 eval_steps=90747 line_ms=100 outcome=pass\n2026-09-16T03:00:30.8717111Z [over-cost] v2.test.claim.enforcement.lens_module_gate_witness.question_zero_verdict_live_holds observed_wall_ms=274 observed_cpu_ms=212 eval_steps=63825 line_ms=100 outcome=pass\n2026-09-16T03:00:30.8723183Z [over-cost] v2.test.emit.emit_module_contribution.emc_all_three_arms_are_constructed_by_the_emitter_holds observed_wall_ms=211 observed_cpu_ms=203 eval_steps=110579 line_ms=100 outcome=pass\n2026-09-16T03:00:30.8724944Z [over-cost] v2.test.parse.d5_expression_grammar_parse.cause_i_match_infix_parses_holds observed_wall_ms=204 observed_cpu_ms=203 eval_steps=76436 line_ms=100 outcome=pass\n2026-09-16T03:00:30.8726657Z [over-cost] v2.test.emit.emit_module_contribution.emc_origins_locate_the_unobserved_producer_holds observed_wall_ms=208 observed_cpu_ms=201 eval_steps=110307 line_ms=100 outcome=pass\n2026-09-16T03:06:30.0271620Z [floor-cgroup] when=beat-30 path=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice/actions-runner@srv4-18.service\n2026-09-16T03:06:30.0274812Z [floor-cgroup] when=beat-30 level=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice/actions-runner@srv4-18.service max=17179869184 high=16106127360 current=16106008576 peak=16112607232 events=[low,0,high,10824,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,10824,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=9.69,avg60=6.15,avg300=2.73,total=39674404,full,avg10=9.69,avg60=6.15,avg300=2.73,total=39670316]\n2026-09-16T03:06:30.0279569Z [floor-cgroup] when=beat-30 level=/sys/fs/cgroup/system.slice/system-actions\\x2drunner.slice max=max high=max current=172097458176 peak=364675248128 events=[low,0,high,53882643,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,0,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=0.61,avg60=1.03,avg300=1.39,total=13890030741,full,avg10=0.51,avg60=0.99,avg300=1.38,total=13752007203]\n2026-09-16T03:06:30.0283751Z [floor-cgroup] when=beat-30 level=/sys/fs/cgroup/system.slice max=max high=max current=188181905408 peak=380169330688 events=[low,0,high,53882645,max,0,oom,0,oom_kill,0,oom_group_kill,0] events_local=[low,0,high,0,max,0,oom,0,oom_kill,0,oom_group_kill,0] pressure=[some,avg10=0.61,avg60=1.00,avg300=1.35,total=13863806856,full,avg10=0.51,avg60=0.97,avg300=1.34,total=13725404851]"
diff --git a/dag/test/fixture/srv1_network_receipt.dag b/dag/test/fixture/srv1_network_receipt.dag
new file mode 100644
index 00000000000..2416e9c32c0
--- /dev/null
+++ b/dag/test/fixture/srv1_network_receipt.dag
@@ -0,0 +1,6 @@
+module test.fixture.srv1_network_receipt
+
+import std.types { String }
+
+// Captured root-owned srv1 receipt, 2026-10-09T07:45:19Z. Fixture bytes are not live authority.
+data observed_srv1_network_receipt: String = "gunbc.converged_slot_network.v1\nhost=srv1\ngeneration=local-83dcbb4d6ab51e0e05a519dd930dc41ef0539eaa-2026-10-09T07:45:19Z\nnft_digest=da7a00c54f267b39227a02557ebef28c90282376673cef9c78784caca7479099\nhelper_auto=absent_from_kernel:6.8.0-138-generic\nhelper_nft=counted:0\nhelper_xtables=counted:0\nhelper_userspace=counted:0\nhelper_expectations=counted:0\nslot=srv1-01|tap=gunbc-tap1|guest=172.30.1.2|mac=02:00:00:00:00:01|host_cidr=172.30.1.1/30|route=172.30.1.0/30 proto kernel scope link src 172.30.1.1 linkdown|ipv6=disabled\nslot=srv1-02|tap=gunbc-tap2|guest=172.30.2.2|mac=02:00:00:00:00:02|host_cidr=172.30.2.1/30|route=172.30.2.0/30 proto kernel scope link src 172.30.2.1 linkdown|ipv6=disabled\nslot=srv1-03|tap=gunbc-tap3|guest=172.30.3.2|mac=02:00:00:00:00:03|host_cidr=172.30.3.1/30|route=172.30.3.0/30 proto kernel scope link src 172.30.3.1 linkdown|ipv6=disabled\nslot=srv1-04|tap=gunbc-tap4|guest=172.30.4.2|mac=02:00:00:00:00:04|host_cidr=172.30.4.1/30|route=172.30.4.0/30 proto kernel scope link src 172.30.4.1 linkdown|ipv6=disabled\nslot=srv1-05|tap=gunbc-tap5|guest=172.30.5.2|mac=02:00:00:00:00:05|host_cidr=172.30.5.1/30|route=172.30.5.0/30 proto kernel scope link src 172.30.5.1 linkdown|ipv6=disabled\nslot=srv1-06|tap=gunbc-tap6|guest=172.30.6.2|mac=02:00:00:00:00:06|host_cidr=172.30.6.1/30|route=172.30.6.0/30 proto kernel scope link src 172.30.6.1 linkdown|ipv6=disabled\nslot=srv1-07|tap=gunbc-tap7|guest=172.30.7.2|mac=02:00:00:00:00:07|host_cidr=172.30.7.1/30|route=172.30.7.0/30 proto kernel scope link src 172.30.7.1 linkdown|ipv6=disabled\nslot=srv1-08|tap=gunbc-tap8|guest=172.30.8.2|mac=02:00:00:00:00:08|host_cidr=172.30.8.1/30|route=172.30.8.0/30 proto kernel scope link src 172.30.8.1 linkdown|ipv6=disabled\nslot=srv1-09|tap=gunbc-tap9|guest=172.30.9.2|mac=02:00:00:00:00:09|host_cidr=172.30.9.1/30|route=172.30.9.0/30 proto kernel scope link src 172.30.9.1 linkdown|ipv6=disabled\nslot=srv1-13|tap=gunbc-tap13|guest=172.30.13.2|mac=02:00:00:00:00:0d|host_cidr=172.30.13.1/30|route=172.30.13.0/30 proto kernel scope link src 172.30.13.1 linkdown|ipv6=disabled\n"
diff --git a/dag/test/fixture/tailscale_acl_reference.json b/dag/test/fixture/tailscale_acl_reference.json
index 77aa04a58bc..421d0009b35 100644
--- a/dag/test/fixture/tailscale_acl_reference.json
+++ b/dag/test/fixture/tailscale_acl_reference.json
@@ -1 +1 @@
-{"grants": [{"src": ["autogroup:member"], "dst": ["*"], "ip": ["*"]}, {"src": ["tag:ci"], "dst": ["100.65.94.55", "tag:dashboard"], "ip": ["tcp:3737"]}, {"src": ["tag:dashboard"], "dst": ["tag:dashboard"], "ip": ["*"]}, {"src": ["tag:dashboard"], "dst": ["tag:ci"], "ip": ["tcp:22"]}], "ssh": [{"action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self"], "users": ["autogroup:nonroot", "root"]}, {"action": "accept", "src": ["autogroup:member"], "dst": ["tag:ci"], "users": ["autogroup:nonroot"]}, {"action": "accept", "src": ["tag:dashboard"], "dst": ["tag:ci"], "users": ["autogroup:nonroot", "root"]}], "nodeAttrs": [{"target": ["autogroup:member"], "attr": ["funnel"]}], "tagOwners": {"tag:ci": ["autogroup:admin"], "tag:dashboard": ["autogroup:admin"]}}
+{"grants": [{"src": ["autogroup:member"], "dst": ["*"], "ip": ["*"]}, {"src": ["tag:ci"], "dst": ["100.65.94.55", "tag:dashboard"], "ip": ["tcp:3737"]}, {"src": ["tag:dashboard"], "dst": ["tag:dashboard"], "ip": ["*"]}, {"src": ["tag:dashboard"], "dst": ["tag:ci"], "ip": ["tcp:22"]}, {"src": ["tag:dashboard"], "dst": ["100.127.39.77"], "ip": ["tcp:8080"]}], "ssh": [{"action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self"], "users": ["autogroup:nonroot", "root"]}, {"action": "accept", "src": ["autogroup:member"], "dst": ["tag:ci"], "users": ["autogroup:nonroot"]}, {"action": "accept", "src": ["tag:dashboard"], "dst": ["tag:ci"], "users": ["autogroup:nonroot", "root"]}], "nodeAttrs": [{"target": ["autogroup:member"], "attr": ["funnel"]}], "tagOwners": {"tag:ci": ["autogroup:admin"], "tag:dashboard": ["autogroup:admin"]}}
diff --git a/dag/test/manual/runner_microvm_network_local_stage_probe.dag b/dag/test/manual/runner_microvm_network_local_stage_probe.dag
new file mode 100644
index 00000000000..e39e3b81c14
--- /dev/null
+++ b/dag/test/manual/runner_microvm_network_local_stage_probe.dag
@@ -0,0 +1,70 @@
+module test.manual.runner_microvm_network_local_stage_probe
+
+import std.types { String, NonEmptyStr, FilePath, Bool }
+import std.algebra { trim }
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+import extdeps.shell
+import extdeps.filesystem.filesystem_io { Filesystem, filesystem_listing_names_entry }
+import extdeps.tools.stat { stat_mode_command }
+import extdeps.shell.exec { ProcessOutputPresent, ProcessOutputAbsent, ProcessRefused }
+import gunbc.command_runner { run_shell_command_capture, LocalExec }
+import gunbc.file_access { FileTreeScope }
+import gunbc.runner_microvm_network_converge { StagedFile }
+import gunbc.runner_microvm_network_apply { write_local_staged_file, StagedWriteOutcome, StagedWritten, StagedWriteRefused }
+
+fn stage_succeeded(result: StagedWriteOutcome) -> Bool {
+  match result { StagedWritten => true StagedWriteRefused { step: _, reason: _ } => false }
+}
+
+fn owner_only(path: String) -> Bool {
+  match run_shell_command_capture(command: stat_mode_command(path: path), transport: LocalExec) {
+    ProcessOutputPresent { text } => trim(s: text) == "600"
+    ProcessOutputAbsent => false
+    ProcessRefused { exit_code: _, stderr: _ } => false
+  }
+}
+
+// The admitted directory exists, so removing scope admission would actually write the
+// out-of-scope destination. A missing directory would refuse for an unrelated reason.
+fn outside_scope_refuses(root: String) -> Bool {
+  let allowed = shell.Mktemp.DirWithTemplate(template: concat(root, "/allowed.XXXXXX") as FilePath)
+  if !allowed.success { false }
+  else {
+    let scope = FileTreeScope { root_path: trim(s: allowed.path as String) as NonEmptyStr }
+    let refused = write_local_staged_file(file: StagedFile { path: concat(root, "/outside") as NonEmptyStr, content: "no" }, scope: scope)
+    let children = Filesystem.List(path: scope.root_path as String)
+    let parent = Filesystem.List(path: root)
+    !stage_succeeded(result: refused) && children.success && trim(s: children.entries) == ""
+      && parent.success && !filesystem_listing_names_entry(listing: parent.entries, name: "outside")
+  }
+}
+
+// Real local filesystem effects in one freshly created scratch directory. No root, network,
+// sudo or host configuration is touched. This CLI control is not a hermetic floor witness.
+fn local_stage_replaces_owned_bytes_wet() -> ProcessExit {
+  let temporary = shell.Mktemp.Dir()
+  if !temporary.success { exit_failure(reason: "local staging control could not create its scratch directory") }
+  else {
+    let root = trim(s: temporary.path as String)
+    let path = concat(root, "/staged")
+    let scope = FileTreeScope { root_path: root as NonEmptyStr }
+    let first = write_local_staged_file(file: StagedFile { path: path as NonEmptyStr, content: "prior\n" }, scope: scope)
+    let first_read = Filesystem.Read(path: path)
+    let first_mode = owner_only(path: path)
+    let next = StagedFile { path: path as NonEmptyStr, content: "replacement\n\n" }
+    let second = write_local_staged_file(file: next, scope: scope)
+    let second_read = Filesystem.Read(path: path)
+    let second_mode = owner_only(path: path)
+    let replay = write_local_staged_file(file: next, scope: scope)
+    let replay_read = Filesystem.Read(path: path)
+    let listing = Filesystem.List(path: root)
+    let scope_refused = outside_scope_refuses(root: root)
+    let removed = shell.Remove.RecursiveForce(path: root as FilePath)
+    if stage_succeeded(result: first) && first_read.success && first_read.content == "prior\n" && first_mode
+      && stage_succeeded(result: second) && second_read.success && second_read.content == next.content && second_mode
+      && stage_succeeded(result: replay) && replay_read.success && replay_read.content == next.content
+      && scope_refused && listing.success && trim(s: listing.entries) == "staged" && removed.success {
+      ExitSuccess
+    } else { exit_failure(reason: "local staging failed create, replacement, replay, custody, scope refusal or cleanup control") }
+  }
+}
diff --git a/dag/test/probe/jit_deregistration_forged_probe.dag b/dag/test/probe/jit_deregistration_forged_probe.dag
index e4eda829526..48d0fc8ff3d 100644
--- a/dag/test/probe/jit_deregistration_forged_probe.dag
+++ b/dag/test/probe/jit_deregistration_forged_probe.dag
@@ -14,7 +14,7 @@ import extdeps.github.effect { GitHubOrganizationRef }
 import extdeps.github.actions_jit_runner { JitRunnerConfigRequest, JitRunnerName, JitRunnerGroupId, JitWorkFolder }
 import extdeps.github.actions_self_hosted_runners { OrganizationRunnerListWire }
 import gunbc.auth.github_apps { DeclaredGitHubApp }
-import gunbc.runner_jit_mint { JitSlot }
+import gunbc.runner.jit_registration_subject { JitRegistrationSubject }
 import gunbc.runner.runner_jit_perform { JitMintDispatch, JitMintDispatchAuthorized, AuthorizedJitMintDispatch }
 import gunbc.github_effect_perform { OrganizationRunnerListRead }
 import gunbc.runner.runner_jit_deregistration {
@@ -32,10 +32,10 @@ fn victim_request() -> JitRunnerConfigRequest {
 }
 
 // (a) AN OUTSIDE-AUTHORED AUTHORIZED ARM. Refuses at AuthorizedJitMintDispatch.
-fn forged_dispatch(slot: JitSlot, app: DeclaredGitHubApp, installation: GitHubAppInstallationId) -> JitMintDispatch {
+fn forged_dispatch(slot: JitRegistrationSubject, app: DeclaredGitHubApp, installation: GitHubAppInstallationId) -> JitMintDispatch {
   JitMintDispatchAuthorized {
     dispatch: AuthorizedJitMintDispatch {
-      slot: slot,
+      subject: slot,
       app: app,
       installation: installation,
       organization: GitHubOrganizationRef { login: "gunb-ai" },
@@ -45,16 +45,22 @@ fn forged_dispatch(slot: JitSlot, app: DeclaredGitHubApp, installation: GitHubAp
 }
 
 // (b) A HAND-BUILT DEREGISTRATION SUBJECT. Refuses at JitRegistration.
-fn forged_registration(slot: JitSlot, app: DeclaredGitHubApp, installation: GitHubAppInstallationId) -> JitRegistration {
+fn forged_registration(slot: JitRegistrationSubject, app: DeclaredGitHubApp, installation: GitHubAppInstallationId) -> JitRegistration {
   JitRegistration {
     organization: GitHubOrganizationRef { login: "gunb-ai" },
     name: JitRunnerName { value: "victim-runner" },
-    slot: slot,
+    subject: slot,
     app: app,
     installation: installation,
   }
 }
 
+// (b2) A HAND-BUILT REGISTRATION SUBJECT, the value a mint is planned for. Refuses at
+// JitRegistrationSubject: only a producer that proved its slot may build one.
+fn forged_subject() -> JitRegistrationSubject {
+  JitRegistrationSubject { name: JitRunnerName { value: "victim-runner" }, workflow: "gunb-ai/gunbc/x.yml@refs/heads/main", labels: [] }
+}
+
 // (c) A HAND-BUILT EMPTY LISTING FOR victim-runner. Refuses at OrganizationRunnerListRead.
 fn forged_listing(app: DeclaredGitHubApp, installation: GitHubAppInstallationId) -> OrganizationRunnerListRead {
   OrganizationRunnerListRead {
diff --git a/dag/test/probe/qualification_collection_relabel_probe.dag b/dag/test/probe/qualification_collection_relabel_probe.dag
new file mode 100644
index 00000000000..1df99eb5bdc
--- /dev/null
+++ b/dag/test/probe/qualification_collection_relabel_probe.dag
@@ -0,0 +1,19 @@
+module test.probe.qualification_collection_relabel_probe
+
+// THIS MODULE MUST NOT RESOLVE. Collecting outside the token join is minting a collection the join
+// never admitted: relabel another collection's run and floor job as dispatch d's. The carrier is
+// sealed, so the one function that mints it -- gunbc.runner.runner_qualification_dispatch
+// collect_qualification_run, whose reads sit in the arm the token join admits -- is the only route.
+// Reached only through test.claim.runner_qualification_delivery_rewrap_witness.
+
+import gunbc.runner.runner_qualification_dispatch { DispatchedQualificationRun, CollectedQualificationRun }
+
+fn relabel(d: DispatchedQualificationRun, c: CollectedQualificationRun) -> CollectedQualificationRun {
+  CollectedQualificationRun {
+    dispatched: d,
+    run: c.run,
+    floor_job: c.floor_job,
+    conclusion: c.conclusion,
+    instruments_unextracted: c.instruments_unextracted,
+  }
+}
diff --git a/dag/test/probe/qualification_delivery_rewrap_probe.dag b/dag/test/probe/qualification_delivery_rewrap_probe.dag
new file mode 100644
index 00000000000..4d81ba655b4
--- /dev/null
+++ b/dag/test/probe/qualification_delivery_rewrap_probe.dag
@@ -0,0 +1,19 @@
+module test.probe.qualification_delivery_rewrap_probe
+
+// THIS MODULE MUST NOT RESOLVE. Each function is a route by which a holder of two legitimate JIT
+// deliveries would relabel one: keep delivery B's sealed credential and the runner id GitHub returned
+// for B, and claim dispatch A produced them -- so a qualification subject over A would carry B's
+// runner. The witness test.claim.runner_qualification_delivery_rewrap_witness hands this source to the
+// compiler and requires the refusal at the sealed carrier by name. dag/test/probe/ sits under the
+// whole-tree strict-resolve exclusion, so this source reaches the compiler only through that witness.
+
+import std.types { Int }
+import gunbc.runner.runner_jit_perform {
+  AuthorizedJitMintDispatch, BoundJitCredential, JitCredentialDelivery, JitCredentialBoundToAttempt,
+}
+
+fn rewrap(a: AuthorizedJitMintDispatch, b: BoundJitCredential) -> JitCredentialDelivery {
+  JitCredentialBoundToAttempt {
+    bound: BoundJitCredential { dispatch: a, credential: b.credential, runner_id: b.runner_id },
+  }
+}
diff --git a/dag/test/probe/qualification_generate_answer_rewrap_probe.dag b/dag/test/probe/qualification_generate_answer_rewrap_probe.dag
new file mode 100644
index 00000000000..d710d3e0c2f
--- /dev/null
+++ b/dag/test/probe/qualification_generate_answer_rewrap_probe.dag
@@ -0,0 +1,15 @@
+module test.probe.qualification_generate_answer_rewrap_probe
+
+// THIS MODULE MUST NOT RESOLVE. The generate fold pairs a dispatch with a 201 body it is handed, so
+// an outside caller would mint a delivery for dispatch A from any created body. Only the perform
+// function, whose body is GitHub's answer to dispatch.request, is admitted. Reached only through
+// test.claim.runner_qualification_delivery_rewrap_witness.
+
+import extdeps.transports.rest { RestAnswered }
+import extdeps.github.actions_jit_runner { JitConfigCreatedBody }
+import gunbc.runner.runner_jit_perform { JitMintDispatch }
+import gunbc.github_effect_perform { JitMintPerformance, jit_mint_performance_of_generate }
+
+fn mint_from_a_supplied_body(a: JitMintDispatch, body: JitConfigCreatedBody) -> JitMintPerformance {
+  jit_mint_performance_of_generate(dispatch: a, outcome: RestAnswered { answer: body })
+}
diff --git a/dag/test/probe/qualification_job_log_receipt_forged_probe.dag b/dag/test/probe/qualification_job_log_receipt_forged_probe.dag
new file mode 100644
index 00000000000..5e0c7f066a8
--- /dev/null
+++ b/dag/test/probe/qualification_job_log_receipt_forged_probe.dag
@@ -0,0 +1,45 @@
+module test.probe.qualification_job_log_receipt_forged_probe
+
+// THIS MODULE MUST NOT RESOLVE. Each function below is a route by which a caller outside
+// gunbc.runner.runner_qualification_dispatch would otherwise hold a job-log receipt for rows it never
+// read from a run, or read a run's outputs under a token or run id the collector never admitted: (a)
+// writing the sealed receipt from invented readings, (b) calling the one function that mints it from
+// outside the collect stage, (c) calling the reads past the read plan, (d) reading the claim-cost
+// artifact for a free token and run id. The witness
+// test.claim.qualification_job_log_receipt_forged_probe_witness hands this source to the compiler and
+// requires each refusal at its subject by name. dag/test/probe/ sits under the whole-tree
+// strict-resolve exclusion, so this source reaches the compiler only through that witness.
+
+import std.content_hash { content_hash_atom }
+import std.types { Int, NonEmptyStr }
+import std.resources { Network }
+import gunbc.github_effect_perform { ControllerInstallationToken }
+import gunbc.runner.runner_host_unit_slot { HostUnitSlot }
+import gunbc.runner.runner_qualification_dispatch {
+  CollectedQualificationRun, QualificationJobLogReceipt, QualificationLogReadings,
+  JobLogInstrumentStanding, AttemptJobLog, job_log_standing,
+  QualificationCollectOutcome, collect_qualification_instruments_under,
+  ClaimCostArtifactRead, read_claim_cost_artifact,
+}
+
+// (a) AN OUTSIDE-AUTHORED RECEIPT. Refuses at QualificationJobLogReceipt.
+fn forged_receipt(c: CollectedQualificationRun, h: HostUnitSlot, rd: QualificationLogReadings) -> QualificationJobLogReceipt {
+  QualificationJobLogReceipt { collected: c, slot: h, log_code_points: 1, log_digest: content_hash_atom(value: "invented"), readings: rd }
+}
+
+// (b) THE MINTER CALLED FROM OUTSIDE THE COLLECT STAGE, over a log this caller supplies. Refuses at
+// job_log_standing.
+fn sneaked_receipt(c: CollectedQualificationRun, h: HostUnitSlot, l: AttemptJobLog) -> JobLogInstrumentStanding {
+  job_log_standing(collected: c, slot: h, log: l)
+}
+
+// (c) THE READS CALLED PAST THE READ PLAN: a genuine collection under a token the plan never admitted.
+// Refuses at collect_qualification_instruments_under.
+fn reads_past_the_plan(c: CollectedQualificationRun, t: ControllerInstallationToken) -> QualificationCollectOutcome uses net: Network {
+  collect_qualification_instruments_under(collected: c, token: t)
+}
+
+// (d) THE CLAIM-COST READ UNDER A FREE TOKEN AND ANOTHER RUN'S ID. Refuses at read_claim_cost_artifact.
+fn claim_cost_for_another_run(t: ControllerInstallationToken, owner: NonEmptyStr, repo: NonEmptyStr, other_run_id: Int) -> ClaimCostArtifactRead uses net: Network {
+  read_claim_cost_artifact(token: t, owner: owner, repo: repo, run_id: other_run_id)
+}
diff --git a/dag/test/probe/qualification_receive_jit_mint_rewrap_probe.dag b/dag/test/probe/qualification_receive_jit_mint_rewrap_probe.dag
new file mode 100644
index 00000000000..ed6688ed778
--- /dev/null
+++ b/dag/test/probe/qualification_receive_jit_mint_rewrap_probe.dag
@@ -0,0 +1,21 @@
+module test.probe.qualification_receive_jit_mint_rewrap_probe
+
+// THIS MODULE MUST NOT RESOLVE. It is the rewrap that needs no forged literal: hold an authorized
+// dispatch A and a legitimate delivery B, and hand B's credential and runner id to receive_jit_mint
+// under A. Unsealed, the result carries bound.dispatch == A and every equality on the dispatch admits
+// it. The witness test.claim.runner_qualification_delivery_rewrap_witness requires the refusal at
+// receive_jit_mint's admission. dag/test/probe/ sits under the whole-tree strict-resolve exclusion,
+// so this source reaches the compiler only through that witness.
+
+import gunbc.runner.runner_jit_perform {
+  AuthorizedJitMintDispatch, BoundJitCredential, JitCredentialDelivery, JitMintDispatchAuthorized,
+  receive_jit_mint,
+}
+import extdeps.github.actions_jit_runner { JitConfigMinted }
+
+fn rewrap_through_the_receiver(a: AuthorizedJitMintDispatch, b: BoundJitCredential) -> JitCredentialDelivery {
+  receive_jit_mint(
+    dispatch: JitMintDispatchAuthorized { dispatch: a },
+    outcome: JitConfigMinted { config: b.credential, runner_id: b.runner_id },
+  )
+}
diff --git a/dag/test/probe/seed_artifact_fetch_forged_probe.dag b/dag/test/probe/seed_artifact_fetch_forged_probe.dag
new file mode 100644
index 00000000000..154d0010fa5
--- /dev/null
+++ b/dag/test/probe/seed_artifact_fetch_forged_probe.dag
@@ -0,0 +1,34 @@
+module test.probe.seed_artifact_fetch_forged_probe
+
+// THIS MODULE MUST NOT RESOLVE. Each function below is a route by which a caller outside the
+// seeded-media remaster would otherwise write a seed artifact somewhere its admission never
+// checked: replaying an admitted artifact into a seed directory of its choosing (where its name
+// might collide with a text seed the admission never saw, or point outside the seed), or minting
+// an admitted artifact without the admission. The witness
+// test.claim.seed_artifact_fetch_forged_probe_witness hands this source to the compiler and requires
+// each refusal at its subject by name. dag/test/probe/ sits under the whole-tree strict-resolve
+// exclusion, so this source reaches the compiler only through that witness.
+
+import std.types { List, NonEmptyStr, String }
+import gunbc.host_command_binding { CommandHost }
+import extdeps.provisioning.ubuntu_seeded_install_media { AdmittedSeedArtifact, SeedArtifactBasename }
+import extdeps.provisioning.ubuntu_seeded_install_media_remaster { install_media_remaster_fetch_artifact, install_media_remaster_fetch_artifacts }
+
+// (a) ONE ADMITTED ARTIFACT, REBOUND TO ANOTHER SEED DIRECTORY. Refuses at install_media_remaster_fetch_artifact.
+fn rebound_one(host: CommandHost, artifact: AdmittedSeedArtifact) -> String? {
+  install_media_remaster_fetch_artifact(host: host, nocloud_dir: "/tmp/work/gunbc-runner" as NonEmptyStr, artifact: artifact)
+}
+
+// (b) THE ADMITTED POPULATION, REBOUND. Refuses at install_media_remaster_fetch_artifacts.
+fn rebound_all(host: CommandHost, artifacts: List<AdmittedSeedArtifact>) -> String? {
+  install_media_remaster_fetch_artifacts(host: host, nocloud_dir: "/tmp/work/../../boot" as NonEmptyStr, artifacts: artifacts)
+}
+
+// (c) AN ADMISSION NOBODY RAN. Refuses at SeedArtifactBasename and AdmittedSeedArtifact.
+fn forged() -> AdmittedSeedArtifact {
+  AdmittedSeedArtifact {
+    basename: SeedArtifactBasename { value: "runner-host-up.sh" },
+    source_url: "https://example.invalid/x",
+    sha256: "0000000000000000000000000000000000000000000000000000000000000000",
+  }
+}
diff --git a/docs/design-rung-drops.md b/docs/design-rung-drops.md
index 49916065be5..6e72c14d593 100644
--- a/docs/design-rung-drops.md
+++ b/docs/design-rung-drops.md
@@ -16,10 +16,6 @@ the green positive controls of the accumulator-copy lens's fold-shape evidence (
 
 interpreted file_gate ratchets over lean.dag, bash.dag, swift.dag, 00_compile.dag, analyze.dag, and glob_discovery_law.dag from v2.test.claim.complexity.accumulator_copy_roster_gate_*: RUNG DROP, mechanically preventable -> mitigatable (lost as a passenger of interpreted file_gate as 300s census test fns over those live files; family remains operator-ruled offline (gunbc.offline_local_recipe policy accumulator_copy_roster_gate_exclusion_note)). Population: v2.test.claim.complexity.accumulator_copy_roster_gate_lean_bash roster_lean_file_gate_walk, v2.test.claim.complexity.accumulator_copy_roster_gate_lean_bash roster_bash_file_gate_walk, v2.test.claim.complexity.accumulator_copy_roster_gate_swift roster_swift_file_gate_walk, v2.test.claim.complexity.accumulator_copy_roster_gate roster_compile_stage_file_gate_walk, v2.test.claim.complexity.accumulator_copy_roster_gate roster_lens_traversal_file_gate_walk, v2.test.claim.complexity.accumulator_copy_roster_gate roster_glob_discovery_file_gate_walk. Restored when: an executing census or lane with a declared ceiling can ingest those six live subjects as claims (native ingest, or interpreted ingest whose per-file cost fits the 300s census and whose glob walk fits the 8s changed-witness wall) so the six identities are test fns that call file_gate and reach PASS or a discriminating RED on that run. Passing under claim_batch is the declared state, not the trigger.
 
-### native route enforces admit_callers: a call from a declaration outside a fn's admitted caller list refuses — declared 2026-09-22
-
-native route enforces admit_callers: a call from a declaration outside a fn's admitted caller list refuses: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: a v2 stage checks caller admission; that stage adds the Arrow carrier with its consumer). Population: the native lane (std.compiler_entry SourceRootEvalDriver) -- every fn declaring admit_callers, the clause parsed and discarded at fn lowering. Restored when: a v2 stage checks caller admission on the native route from the fn's declared admit_callers list, refusing a call from a declaration outside it; that stage adds the Arrow carrier together with its consumer. Parsing the clause, or carrying the list with nothing reading it, does not retire this row.
-
 ### new-witness eval-step cost gate over the ten interpreted P-256 and P-384 point and group-law checks and SHA-384 FIPS vectors of the App Attest path: they still execute, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered — declared 2026-09-22
 
 new-witness eval-step cost gate over the ten interpreted P-256 and P-384 point and group-law checks and SHA-384 FIPS vectors of the App Attest path: they still execute, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the P-384 and SHA-384 primitives executing as natively emitted code rather than as interpreted bignat and Word64 folds). Population: test.claim.p384_dag_ecdsa_witness_test.the_p384_base_point_is_on_the_curve: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_interpreted_crypto_rows; measured by merge-queue required floor run 35678328407 (gunbc#11981), artifact required-ci-measurement-receipt; planned_as_changed_witness, verdict pass, wall under 2000ms, over the new-witness eval-step budget: the billed work is interpreted 384-bit field arithmetic (16 limbs) or a SHA-384 block over Word64 pairs, test.claim.p384_dag_ecdsa_witness_test.a_point_beside_the_base_point_is_off_the_curve: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_interpreted_crypto_rows; measured by merge-queue required floor run 35678328407 (gunbc#11981), artifact required-ci-measurement-receipt; planned_as_changed_witness, verdict pass, wall under 2000ms, over the new-witness eval-step budget: the billed work is interpreted 384-bit field arithmetic (16 limbs) or a SHA-384 block over Word64 pairs, test.claim.p384_dag_ecdsa_witness_test.a_point_with_a_coordinate_at_p_is_not_admitted: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_interpreted_crypto_rows; measured by merge-queue required floor run 35678328407 (gunbc#11981), artifact required-ci-measurement-receipt; planned_as_changed_witness, verdict pass, wall under 2000ms, over the new-witness eval-step budget: the billed work is interpreted 384-bit field arithmetic (16 limbs) or a SHA-384 block over Word64 pairs, test.claim.p384_dag_ecdsa_witness_test.apples_ca_and_root_keys_are_on_p384: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_interpreted_crypto_rows; measured by merge-queue required floor run 35678328407 (gunbc#11981), artifact required-ci-measurement-receipt; planned_as_changed_witness, verdict pass, wall under 2000ms, over the new-witness eval-step budget: the billed work is interpreted 384-bit field arithmetic (16 limbs) or a SHA-384 block over Word64 pairs, test.claim.sha384_fips_witness_test.sha384_of_the_empty_message_is_the_published_value_and_one_octet_discriminates: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_interpreted_crypto_rows; measured by required floor run 35703555837 (gunbc#11981, head 0b0a2dffe), artifact required-ci-measurement-receipt; planned_as_changed_witness, verdict pass, over the new-witness eval-step budget and above the per-subject line. The standing figure is whatever this identity's row reads in the artifact named above, never a number copied into this field. The billed work is two single-block SHA-384 compressions, the published empty message and a one-octet message on an interpreter that reifies no machine width; the published positive and its discriminating mutation are one subject, so the cost is caused by the claim's own boundary and not by neighbouring vectors, test.claim.sha384_fips_witness_test.sha384_of_abc_is_the_published_value_and_one_octet_discriminates: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_interpreted_crypto_rows; measured by required floor run 35703555837 (gunbc#11981, head 0b0a2dffe), artifact required-ci-measurement-receipt; planned_as_changed_witness, verdict pass, over the new-witness eval-step budget and above the per-subject line. The standing figure is whatever this identity's row reads in the artifact named above, never a number copied into this field. The billed work is two single-block SHA-384 compressions, the published abc vector and abd on an interpreter that reifies no machine width; the published positive and its discriminating mutation are one subject, so the cost is caused by the claim's own boundary and not by neighbouring vectors, test.claim.sha384_fips_witness_test.sha384_of_the_896_bit_message_is_the_published_two_block_value_and_one_octet_discriminates: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_interpreted_crypto_rows; measured by required floor run 35703555837 (gunbc#11981, head 0b0a2dffe), artifact required-ci-measurement-receipt; planned_as_changed_witness, verdict pass, over the new-witness eval-step budget and above the per-subject line. The standing figure is whatever this identity's row reads in the artifact named above, never a number copied into this field. The billed work is four SHA-384 block compressions, the published 896-bit two-block vector and a last-block mutation on an interpreter that reifies no machine width; the published positive and its discriminating mutation are one subject, so the cost is caused by the claim's own boundary and not by neighbouring vectors, test.claim.p256_dag_ecdsa_witness_test.the_base_point_is_on_the_curve: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_interpreted_crypto_rows; measured by required floor run 35708011844 (gunbc#11981), artifact required-ci-measurement-receipt; planned_as_changed_witness, verdict pass, well inside the wall deadline and over the new-witness eval-step budget. The billed work is one P-256 curve equation over the published base point as 11-limb bignat folds on an interpreter that reifies no machine width. It is a MEMBER BECAUSE IT WAS SPLIT OUT of a claim that also asserted n*G = infinity: that conjunction crossed the 8000ms wall deadline and was INTERRUPTED BEFORE ANY VERDICT, so both facts were being lost; the scalar multiplication left the floor for the native row the frontier names, and this cheap half now reaches a verdict. The standing figure is whatever this identity's row reads in the artifact named above, never a number copied into this field, test.claim.p384_dag_ecdsa_witness_test.doubling_and_adding_the_base_point_stay_on_the_curve: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_interpreted_crypto_rows; measured by claim_batch --hermetic [witness] receipt on session/nimble-eagle-216-step3 (added for review 69917 after run 35678328407): verdict pass, wall under the 8 s deadline, over the new-witness eval-step budget; the billed work is one Jacobian doubling, one addition and two projective curve-equation checks at 16 limbs, test.claim.p384_dag_ecdsa_witness_test.doubling_an_off_curve_point_stays_off_the_curve: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_interpreted_crypto_rows; measured by claim_batch --hermetic [witness] receipt on session/nimble-eagle-216-step3 (added for review 69917 after run 35678328407): verdict pass, wall under the 8 s deadline, over the new-witness eval-step budget; the billed work is one Jacobian doubling and one projective curve-equation check at 16 limbs. Restored when: THE CAPABILITY: gunbc test //gunbc/instruments:native-crypto-vectors EXECUTING ON THE MERGE PATH, i.e. as a phase of a required lane whose red blocks a merge, running these ten identities natively (its cases p256_the_base_point_is_on_the_curve, p384_the_base_point_is_on_the_curve, p384_red_a_point_beside_the_base_point_is_off_the_curve, p384_red_a_point_with_a_coordinate_at_p_is_not_admitted, p384_doubling_and_adding_the_base_point_stay_on_the_curve, p384_red_doubling_an_off_curve_point_stays_off_the_curve, p384_apples_ca_and_root_keys_are_on_the_curve and the sha384_* FIPS cases with their reds) while each still evaluates the real curve equation or the real hash; WHAT THAT MUST BE SUFFICIENT FOR: the P-384 parameters and SHA-384 are exercised on the acceptance path with no interpreted 16-limb fold inside a claim frame, so the interpreted identities can leave the floor for that row, or they measure under the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives. The same row run BY NAME (as it exists since gunbc#12306) executes the facts natively but is NOT the acceptance path and retires nothing. Supplying the curve check's answer or the digest as a fixture, or deleting the identities, satisfies neither.
@@ -40,6 +36,14 @@ new-witness eval-step cost gate over the one real-path claim of each approval-re
 
 two serving processes on one host can both open the single-writer approval store, and which of them may write is decided by a declaration they agree to consult rather than by a permission either one cannot bypass: RUNG DROP, structurally impossible -> mechanically preventable (replacement staged: gunbc.auth.approval_writer_authority approval_write_admission, consulted by both mutating routes before any store effect; the terminal replacement is a POSIX-principal restriction on the store generations). Population: gunbc-roadmap.service and gunbc-approval-broker.service on srv1, for the window in which both run under the service principal with gunbc.auth.approval_decision_store approval_decision_store_root readable and both keyrings loadable, any gunbc serve process started by hand from a checkout whose revision predates gunbc.auth.approval_writer_authority, which reads no such declaration at all. Restored when: THE CAPABILITY: the approval store's generations are writable by exactly ONE POSIX principal, and the other serving process's account cannot open them -- so a second writer is refused by the kernel rather than by agreement. SUFFICIENT FOR: attempting a store write as the non-writer principal and observing the OS refusal, with the broker principal alone holding the submission MAC key, the capability MAC key, the publisher token and the store, and the roadmap principal unable to read any of them. Nothing smaller retires this row. IN PARTICULAR, A PERMISSION-BITS READBACK DOES NOT: a receipt reporting owner, group, exact mode and forbidden bits establishes that only the declared principals HOLD permission, which is a statement about metadata and not about access. This trigger asks whether the non-writer CAN OPEN THE STORE, and only an attempt answers that: the execution-as-another-principal leg IS the evidence, and a metadata receipt is not a weaker form of it but a different observation. It is named here because it is the artifact that will exist and will therefore be reached for (raised by merry-bear-816 through zesty-crane-846, 2026-09-19, against the generalized custody work that produces exactly such a receipt). Nor does moving writer authority to the broker retire it -- that changes which process refuses, not whether the guarantee is by agreement; nor does deleting the roadmap's approval routes, because the roadmap process would still hold a principal that can open the store; nor does a claim over approval_write_admission, which establishes that the fold refuses and not that a process which skips the fold is stopped.
 
+### the RLM launch receipt's belt liveness: a publication answer that no publish obligation consumed within its bound is not refused, because nothing records which answer was consumed — declared 2026-10-06
+
+the RLM launch receipt's belt liveness: a publication answer that no publish obligation consumed within its bound is not refused, because nothing records which answer was consumed: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: gunbc.roadmap_launch_deployment_observe event_backlog_judge, which covers the exit spool's inbox and queued stages; the publication-answer half waits on a consumption record). Population: every deployment's publication answer directory (gunbc.host_layout publication_answer_dir), for the window between the belt timer's removal and the restoration trigger below. Restored when: THE CAPABILITY: the launch receipt's event backlog row refuses with StaleBacklog naming a publication answer that is older than its bound and that no publish obligation has consumed -- which needs each consumption to be recorded against the answer it consumed (the attempt's obligation receipt naming the answer's spool key, or the answer moving to a consumed stage once the publish obligation's receipt exists). SUFFICIENT FOR: planting an answer older than the bound with no consuming receipt and observing the receipt refuse, and planting the same answer with its consuming receipt and observing it pass. An armed publication-answer path unit does NOT retire this row (it proves the watcher is armed, not that answers are consumed), and neither does a discovery receipt (it proves discovery ran, not that the answer it should have queued was consumed).
+
+### new-witness eval-step cost gate over the one Apply inhabitance of converge_arrival_through_bmc_secure: it still executes, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered — declared 2026-10-07
+
+new-witness eval-step cost gate over the one Apply inhabitance of converge_arrival_through_bmc_secure: it still executes, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: converge_arrival_through_bmc_secure executing as natively emitted code rather than in the seed interpreter, so the one Apply inhabitance fits the NewWitnessTier eval-step budget). Population: test.claim.machine_intake_arrival_converge_witness.w_bmc_secure_apply_with_the_mtjade1_standing_grant_converges_over_the_dry_world: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_bmc_secure_apply_converge_rows; measured by claim_batch --hermetic --source-root dag --source-root src/v2 --entry dag/test/claim/machine_intake/machine_intake_arrival_converge_witness_test.dag --function w_bmc_secure_apply_with_the_mtjade1_standing_grant_converges_over_the_dry_world (BuildBuddy, GUNBC_BIND_MEMORY_CGROUP_BYTES=30064771072): PASS, eval_steps over the new-witness budget. The billed work is converge_arrival_through_bmc_secure over the production prefix captures plus dry Apply+grant, which this claim is the only Apply execution of. Restored when: THE CAPABILITY: converge_arrival_through_bmc_secure (AccessDiscover through BmcSecure Apply, including the fold's Apply-discharge mint) executing as natively emitted code in a claim frame. WHAT THAT MUST BE SUFFICIENT FOR: test.claim.machine_intake_arrival_converge_witness.w_bmc_secure_apply_with_the_mtjade1_standing_grant_converges_over_the_dry_world, still calling that entry with Apply+grant and still asserting the Applied route, measures under the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives. Deleting the identity, hard-coding discharges: [] in the entry, or relocating the claim off the required gate satisfies none of it.
+
 ### Arity agreement between a declared builtin parameter name and its derived algebra template — declared 2026-09-01
 
 Builtin signature grounding -- **RUNG DROP, DECLARED (2026-09-01).** PREVIOUS RUNG: none to lower -- this declares that a class created by this change lands below its attainable ceiling rather than at it. v1.compiler.infer_method pairs each row's DECLARED parameter names with the parameter TYPES derived from std.algebra. When the two lists disagree in length, pair_declared_names yields AlgebraTypeVariable { id: "unpaired_declared_parameter" } for the unpaired position instead of refusing. That is a value standing where a refusal belongs -- DESIGN section 5's fabricated-plausible-output arm -- and it is declared here rather than left as a marker that reads like a wall. TEMPORARY RUNG: mitigatable. The marker is distinctive, greppable, and reaches src/v1/stage0/src/v1_compiler_infer_method.rs, so a mismatch is DISCOVERABLE by inspection of a generated artifact. It is not mechanically preventable, because NO CONSUMER ASSERTS ITS ABSENCE: an unchecked marker is an inert lens, and DESIGN is explicit that the tier where the machinery exists and nothing gates on it is itself a lie. REASON: builtin_function_registry is a `data` initializer and a .dag data initializer has no refusal channel -- there is nowhere at construction for a typed, located diagnostic to go, so the only arms available were a fabricated value or a silently shorter list, and a marked fabrication is the more honest of the two. POPULATION: bounded and closed at 20 rows -- exactly the registry names that std.algebra also declares and that therefore pair at all (count, to_int, substring, to_string, concat, map_insert, map_merge, with, map_contains_key, map_has, lookup, map_get, map_keys, map_values, get, reverse, list_push, length, starts_with, replace). The other 112 rows author their types directly and cannot reach this arm. Zero occurrences of the marker in the tree today, which is the state this row exists to keep observable. RESTORATION TRIGGER: construction-time refusal available inside a `data` initializer -- SUFFICIENT FOR a declared/derived arity disagreement to stop the line with a typed, located diagnostic at the row that causes it, rather than to produce a marked value that construction accepts. The trigger names that capability and not any artifact that would contribute to one; a witness asserting the marker's absence would raise this to mechanically preventable but would NOT retire the row, because the invalid state would still be writable.
@@ -50,6 +54,10 @@ Builtin signature grounding -- **RUNG DROP, DECLARED (2026-09-01).** PREVIOUS RU
 
 **THE CITED-SYMBOL CENSUS IS NO LONGER A REQUIRED CHECK, AND THIS ROW DECLARES THE RUNG IT DROPS (2026-08-23).** It sits beside the CI entry above rather than inside it, for the reason the regen row already gives: that paragraph narrates the floor and regen cuts, this is a third drop on its own clock, and a declaration wedged into the repository's most-edited prose collides with every unrelated edit to it. WHAT WAS HERE: a second `witnesses.yml` job, `cited-symbol`, running `claim_executor --required-cited-symbol --source-root dag --source-root src/v2` and stopping the line when any authored `DeclarationRef` named a symbol that does not resolve — the executing half of §3's cite-the-symbol-not-the-position rule. **IT IS DELETED** — the job, its command authority (`gunbc.fabric_witness_run` `cited_symbol_run_command`), the job row and capability wiring in `gunbc.witness_floor_workflow`, and the closure witness that covered it. REASON: operator directive, 2026-08-23. This is not a defect finding and the mechanism was not failing; it was executing and green, and the directive is that it does not belong in CI as a separate corpus-wide job. PREVIOUS RUNG: *mechanically preventable* — a real wall, armed on every push, measured green at `checked=390` on run `32664434197` (`f49886339a5`, 2026-08-23T20:26Z). TEMPORARY RUNG: *mitigatable* — the rule survives as review diligence, which is strictly weaker in the exact way §6 already records for the deleted inert-lens census: a newly authored citation naming a symbol that does not exist is writable again, and nothing detects it. MEASURED POPULATION AT THE CUT: 390 authored references, on the last green run of the job. FUTURE EXPOSURE, STATED AS A SECOND FACT BECAUSE JOINING THE TWO IS THE DENOMINATOR ERROR THIS DOCUMENT KEEPS FINDING: unbounded. Nothing counts a citation authored after the cut and nothing refuses one, so §4b(3)'s BOUNDED-POPULATION REQUIREMENT IS NOT SATISFIED HERE, and this row does not pretend otherwise — the drop is an operator-approved exception to that clause rather than an instance of it, and saying so is the whole point of writing the row down. An earlier revision of this row read *the 390 references, plus every citation authored after it* and called that the bounded population; an exact measurement joined to an open future set is not bounded, and calling it so is the same move §5 forbids when a count copied from the current tree is asked to serve as an oracle. The measured half also rots the way §3 says positional citations do: it is the population's size AT THE MOMENT OF THE DROP, never a standing figure. WHAT WAS NOT CLAIMED WHILE THE DROP STOOD: the capability survived at its own entry point — `--required-cited-symbol` was still a flag on `claim_executor` — but a mode no workflow invokes guards nothing, and calling the surviving flag a mitigation would have been exactly the inflation §4b(1) forbids. **THE RESTORATION TRIGGER FIRED ON 2026-08-25 AND THIS ROW IS RETIRED AS A DROP, WITH ITS EXPOSURE CLOSED RATHER THAN RE-DECLARED.** The trigger read: this row retires when the citation wall is re-derived where the operator's own framing puts it — *you would just make them a normal compiler error* — checked at ingestion, on the module whose source carries the citation, from that module's own text, rather than reconstructed corpus-wide by a second job; and it named §6's module-authorship trigger as the same rung, to be landed together rather than each rebuilding a corpus walk. Both landed on one construction, `v1_compiler.declaration_index`, inside the `parse` phase of `claim_executor --required-ci`: the sweep that already parses every authored module now derives one record per module and resolves every authored `DeclarationRef` against it by keyed lookup. `--required-cited-symbol` is DELETED with the same change, so there is one route and not two. RUNG: back to *mechanically preventable*, and STRICTLY WIDER than what was dropped — the enrolled population is every authored citation in a non-fixture module (measured 1441 authored, 161 in fixture carriers, 79 naming namespaces no `.dag` module declares), not the five carriers the deleted lens's population named, and test modules are INDEXED, so the outside-index disposition those exclusions forced is not needed. WHAT THE FIRST EXECUTION FOUND, because a wall that lands green over a corpus nobody checked for two days would be the more suspicious result: 46 sites over 38 distinct targets, every one a citation naming a declaration that does not exist — the exact class this rule names, accumulated in the unguarded window this row declared unbounded. They are NOT repaired here and NOT silently excluded: they are enumerated at identity grain in `PRE_EXISTING_CITATION_DEBT` as a §5 monotone debt contract whose universe is discovered by the index itself and whose rows REFUSE once their citation stops refusing, so the roster can only shrink. WHAT IS STILL OPEN, stated so this retirement is not read as wider than it is: `v2.lens.cited_symbol_resolution` is DELETED as of 2026-08-26, and the disposition was three-way rather than the two this row admitted. The count was stale on arrival — sixteen was the file's size at #7707 and it had grown to 27 `test fn` identities by the time this sentence was written — and "dead" was true of the lens and false of a third of its witnesses. Measured against the seven symbols that file imported FROM the lens, only 6 of the 27 touch one; those 6 died with it. Six more call `resolve_declaration_ref`, which lives in `v2.std.decl_ref_resolution` and SURVIVES with four other consumers, so they are the only executing evidence for a live authority's five-arm refusal and §4b(4) rehomed them to `test.claim.long.decl_ref_resolution_witness_test` rather than deleting them with the machinery that climbed. The remaining 15 are population and projection claims about the carriers that PROJECT `DeclarationRef`s and moved to `test.claim.long.carrier_reference_integrity_witness_test`. What the corpus-wide census subsumes is TYPED-LITERAL citations specifically — `DeclarationRef` record literals and the `decl_ref`/`decl_field_ref` constructors — not "citations" in general; a prose reference inside a `String` is covered by nothing, before or after. The per-PR witness that survives was renamed `test.claim.doc_graph_reference_partition_witness_test`, because its subject is a bucket partition over `gunbc.doc_graph_roots` and never was resolution, and under the old name it would have been the only cited-symbol-named thing left in the tree — a misreading two readers made independently from exactly that surface; and the wall is host Rust rather than a modeled ingestion operation, declared as seed growth in `gunbc.declaration_index_seed_growth`.
 
+### std.algebra collection_count_shape: the result type of a bare count over a free monoid in v2 — declared 2026-10-05
+
+std.algebra collection_count_shape: the result type of a bare count over a free monoid in v2: RUNG DROP, structurally impossible -> mitigatable (replacement staged: collection_count_shape returns std.nat Nat (the template every other size row carries), with integer literals at the consuming positions elaborating at Nat). Population: v2.std.node: every bare count( call site (sizes of edge and child lists), each bound to collection_count_shape by the collection roster, v2.std.node_query: every bare count( call site, each bound to collection_count_shape by the collection roster, every other bare count( call in src/v2 that binds to collection_count_shape (a bare head no in-scope declaration claims), each typed Int rather than Nat, the SEED's method typing: v1.compiler 04_method reads algebra_templates_for_profile, which includes free_monoid_collection_templates, so a seed method-form count (`xs |> count`, `xs.count()`) over a FreeMonoid is typed by this row's Int (review 76274). The seed grounds std.nat Nat to the kernel integer (gunbc.structural_realization_bindings kernel_grounding_rows), so the REALIZED type of that result is unchanged; the declared type is what is narrowed. Restored when: BOTH capabilities: v2 infer elaborates an integer literal at its expected type through the declared elaboration tables of std.literal_elaboration (a carrier's kernel grounding with its declared range, or a literal homomorphism, whichever row the carrier has), AND v2 infer derives and judges a call's result type when the callee returns a declared (non-kernel) type (gunbc.recurring_failure_mode call_result_of_a_declared_return_type_unjudged_in_v2_infer) -- SUFFICIENT FOR collection_count_shape to return std.nat Nat with every count result judged at its consuming position and every literal at those positions written as it is today. Restoration: the row returns Nat and this drop retires.
+
 ### A compiler change that adds or tightens a refusal can refuse code in admitted modules that no required lane compiles on that change, so the refusal lands on main while every required lane reports SUCCESS — declared 2026-09-24
 
 A compiler change that adds or tightens a refusal can refuse code in admitted modules that no required lane compiles on that change, so the refusal lands on main while every required lane reports SUCCESS: RUNG DROP, mechanically preventable -> mitigatable (lost as a passenger of the whole-corpus compile-clean pass of the required floor, deleted by the 2026-08-15 floor cut (gunbc.rung_drop.floor_cut_effect_gates names compile-clean among its outstanding gates); the replacement floor compiles its nominal gate closure plus diff-derived seeds, and a compiler change seeds none of the modules its new refusal reaches). Population: every blocking diagnostic the whole-root compile reports in a module no required lane compiled on the change that introduced it, keyed by (module, verbatim message, occurrence); the standing members are enumerated by the instrument, not by this row: `gunbc compile --source-root dag --source-root src/v2 --target dag --repository gunbc --measured-root-demands tools/whole_corpus_compile_measured_root_demands.json --output-dir <tmp>` on a host its admission admits, decoded by gunbc.emit_diagnostic_observation read_emit_diagnostics, the modules the whole-root compile enters in the name census only are not compiled by it, so a refusal in one of them is outside this population as well as outside the lanes; that gap belongs to gunbc.rung_drop.required_lanes_do_not_resolve_product_layer_modules and is not claimed here, designed must-not-resolve probes under dag/test/probe/ and dag/test/fixture/ appear in that compile's blocking population because the whole-root compile does not apply floor_prepared_subject_exclusions; the roster that lands atomically with the join will carry them, so the join does not report them as new, and whether each still refuses with its designed class is gunbc.compile_diagnostic_census's question, not this row's. Restored when: THE CAPABILITY, AT TWO RUNGS WITH TWO DIFFERENT CONSEQUENCES FOR THIS ROW. The join: a whole-root blocking-diagnostic identity join compiles every admitted dag-primary source and joins its blocking diagnostics at (module, verbatim message, occurrence) grain against a committed debt roster that lands atomically with it. A NEW row is a red, attributed observation naming the row and the revisions since the last green run, and a DEPARTED row needs a typed disposition (repaired, module deleted, or now compiled by a required lane). (a) RUN ON A SCHEDULE OR AFTER MERGE, the join is MITIGATION: the refusal still lands on main and is only reported after it, so the rung stays at mitigatable and THIS ROW STAYS Standing. It is a real improvement in visibility, and it is not the restoration. (b) RUN AS A REQUIRED, MERGE-BLOCKING JOIN on the change, the same join RESTORES mechanically preventable, the declared previous rung, and only that retires this row. COMPLETENESS IS PART OF THE CAPABILITY. The compiler can stop early, so a reading may be a PREFIX of the true blocking population: gunbc.emit_diagnostic_observation read_emit_diagnostics distinguishes EmitPopulationComplete from EmitPopulationCompletenessUnestablished for exactly that reason. The join is sufficient only when each reading is either Complete, or built iteratively or per phase so that a diagnostic newly visible because an earlier refusal stopped masking it is recorded with a typed PreviouslyMasked disposition. Such a diagnostic is not reported as NEW, and it is not attributed to the revision that unmasked it. WHAT DOES NOT RETIRE THIS ROW: a scheduled or post-merge join, which is arm (a); a one-off whole-root run or a receipt outside a schedule or gate, which is the 2026-09-23 specimen this row was declared on; a roster landing with no join executing it, which is the inert tier DESIGN section 6 names; a count comparison in place of the identity join (DESIGN section 5); a join over completeness-unestablished readings with no PreviouslyMasked disposition, which would misreport unmasked standing debt as new; burning the standing rows down to zero, which empties the population without adding the capability; or gunbc.rung_drop.required_lanes_do_not_resolve_product_layer_modules retiring on its changed-declaration arm, which this row exists because it can. Arm (b) needs a runner above the whole-root compile's measured demand, and whether to fund it is the operator's call.
@@ -70,7 +78,9 @@ THE CAPABILITY: a required run that adjudicates a consumed transition-admission
 
 new-witness eval-step cost gate over the three coproduct type-declaration lowering claims of test.claim.parse_test_coproduct_leading_pipe (one type declaration fragment parsed at its production and lowered by normalize): they still execute, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: honest linear cost of parsing and lowering one declaration fragment at the interpreted route: a fixed term per lowered declaration plus a per-token term; owner: grammar program (stern-bear-500)). Population: test.claim.parse_test_coproduct_leading_pipe.positional_payload_variants_parse_and_normalize_holds: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_coproduct_fragment_normalize_rows; measured by v2.test.parse census phase 3, claim_batch BuildBuddy invocation acf43cce at main plus gunbc#13410 plus this change: verdict pass, over the new-witness budget; re-derived by claim_batch --source-root dag --source-root src/v2 --entry src/v2/test/claim/parse/parse_test_coproduct_leading_pipe_test.dag --functions positional_payload_variants_parse_and_normalize_holds. The billed work is one real parse of one declaration fragment at its production and its lowering by normalize_node; the scaling is read in BuildBuddy invocations d04df9ae and b01c394f, test.claim.parse_test_coproduct_leading_pipe.leading_pipe_normalizes_to_the_same_alternatives_as_without_holds: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_coproduct_fragment_normalize_rows; measured by v2.test.parse census phase 3, claim_batch BuildBuddy invocation acf43cce at main plus gunbc#13410 plus this change: verdict pass, over the new-witness budget; re-derived by claim_batch --source-root dag --source-root src/v2 --entry src/v2/test/claim/parse/parse_test_coproduct_leading_pipe_test.dag --functions leading_pipe_normalizes_to_the_same_alternatives_as_without_holds. The billed work is one real parse of one declaration fragment at its production and its lowering by normalize_node; the scaling is read in BuildBuddy invocations d04df9ae and b01c394f, test.claim.parse_test_coproduct_leading_pipe.distinct_alternatives_do_not_normalize_to_the_same_tree_holds: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_coproduct_fragment_normalize_rows; measured by v2.test.parse census phase 3, claim_batch BuildBuddy invocation acf43cce at main plus gunbc#13410 plus this change: verdict pass, over the new-witness budget; re-derived by claim_batch --source-root dag --source-root src/v2 --entry src/v2/test/claim/parse/parse_test_coproduct_leading_pipe_test.dag --functions distinct_alternatives_do_not_normalize_to_the_same_tree_holds. The billed work is one real parse of one declaration fragment at its production and its lowering by normalize_node; the scaling is read in BuildBuddy invocations d04df9ae and b01c394f. Restored when: THE CAPABILITY: normalize (body lowering) of a single type_decl fragment costs at most 1.0k eval steps per source token plus at most 20k fixed, measured as in claim_batch BuildBuddy invocations d04df9ae and b01c394f (normalize cost = lowered minus parse-only). WHAT IT MUST BE SUFFICIENT FOR: each of the three identities, still parsing its own declaration fragment at its production on the real prepared grammar and lowering it with normalize_node, measuring under the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives. Deleting an identity, shrinking a fragment below the construct it names, supplying its parse or its lowered tree, or bundling it into a shared producer does not satisfy this trigger.
 
-### a D0 pair-serving transaction admitted while the fabric store does not refuse a writer without D0 authorization for the operation — declared 2026-09-30
+### a D0 pair-serving transaction admitted while the fabric store does not refuse a writer without D0 authorization for the operation — declared 2026-09-30 · SUPERSEDED
+
+**SUPERSEDED — THE TRIGGER DID NOT FIRE.** Ruling: Group A decommissioned (operator, 2026-10-07, relayed by valiant-crab-775): srv5-srv8 were sold, so this drop's whole population -- D0 lifecycles for FabricGroupA -- no longer exists, and D0 itself (gunbc.spark.pair_serving_d0 and its door) was deleted with the group it was the only lifecycle of Decision record: dashboard messages msg_5d88338f (the removal, operator-approved) and msg_9e5a2fee (the arm path and D0 with it), both 2026-10-07 Loss now held by: none: with D0 gone, gunbc.fabric_store_operation_admission operation_requirement admits no scope for any operation D0 performed, so every such store write now refuses as NoApprovalFlowForOperation -- stricter than the walls this drop suspended, not weaker
 
 a D0 pair-serving transaction admitted while the fabric store does not refuse a writer without D0 authorization for the operation: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the fabric store door verifies each protected advance's credential per operation (gunbc.fabric_store_operation_admission, gunbc#12537 and the d0_store_operation_wall PR chain), and the served/local writer roster is live on srv1). Population: exactly one D0 lifecycle: gunbc.spark.pair_serving_d0 pair_serving_d0 for FabricGroupA under the escalation id gunbc.spark.pair_serving_d0 d0_single_lifecycle_escalation_id, including reruns of that same lifecycle (same escalation id, the frozen filing's execution revision), exactly one more D0 lifecycle (operator-ruled 2026-10-03, relayed by valiant-crab-775, dashboard message msg_eb268a0a): the Group A release-to-fleet for FabricGroupA under the escalation id gunbc.spark.pair_serving_d0 d0_release_lifecycle_escalation_id, including its reruns, on the same terms; that id moved once (the first release lifecycle froze at a revision that could not reach the broker and is inert), within the operator's standing Group A ruling of 2026-10-03 (gunbc.auth.standing_operator_grant group_a_dev_standing_grant), no other escalation id and no other fabric group. Restored when: BOTH store walls live, SUFFICIENT FOR a rostered fleet writer without D0 authorization for the operation to be refused at the store on srv1: gunbc.rung_drop.fabric_storage_append_principal_unrefused retired AND effective on srv1 (the unix-socket door deployed by dashboard_deploy), AND gunbc.spark.pair_serving_d0 d0_store_operation_wall at StoreOperationWallRestored. When both hold, d0_store_write_wall_standing admits every lifecycle through the walls and this row retires; retiring it earlier re-closes the door to this lifecycle too.
 
@@ -112,7 +122,7 @@ Transitive determinism reachability over the fn-arrow call graph: RUNG DROP, mec
 
 ### an edited witness file classified BinWitnessWet in gunbc.ci_layer_roots witness_exclusion_frontier: the required floor's changed-witness sublane declines it as DeclinedNoCiWetLane instead of blocking, and no CI lane executes it — declared 2026-09-30
 
-an edited witness file classified BinWitnessWet in gunbc.ci_layer_roots witness_exclusion_frontier: the required floor's changed-witness sublane declines it as DeclinedNoCiWetLane instead of blocking, and no CI lane executes it: RUNG DROP, mechanically preventable -> mitigatable (lost as a passenger of the per-PR bin-witness wet batch, deleted with the floor cut of 2026-08-15, and .github/workflows/falsifier.yml, deleted at 611fd02770 (gunbc#8283)). Population: self_host_artifact_materialization_real_execution_witness_test.dag, stage0_regen_convergence_real_execution_witness_test.dag, typed_witness_invocation_test.dag, namespace_structural_root_exposure_generated_witness_test.dag, emit_host_typed_smoke_test.dag, build_artifact_corruption_probe_witness_test.dag, dag_collect_fingerprint_witness_test.dag, dag_compile_clean_perturb_receipts_test.dag, test/claim/diagnostics_test.dag, effects_rest_transport_parse_witness_test.dag, test/claim/parse_test.dag, v1_dag_parse_witness_test.dag, auth_declared_but_unwired_witness_test.dag, test/claim/bootstrap_test.dag, infer_semantics_witness_test.dag, dag_compile_clean_shard_a_witness_test.dag, dag_compile_clean_shard_totality_witness_test.dag, dag_compile_clean_seam_witness_test.dag, run_verdict_exit_status_witness_test.dag, http_client_get_real_execution_witness_test.dag, roadmap_belt_actuate_witness_test.dag, roadmap_closing_contract_execution_witness_test.dag, host_build_cache_provision_real_execution_witness_test.dag, materialized_ssh_key_file_real_execution_witness_test.dag, proc_self_cgroup_real_execution_witness_test.dag, repo_local_git_config_real_execution_witness_test.dag, transport_script_stdin_byte_fidelity_witness_test.dag, push_event_witness_wet_test.dag. Restored when: a REQUIRED lane executes changed BinWitnessWet rows for the same pull_request or merge_group -- builds their witness binaries and runs the edited entries to a terminal verdict on a host that admits their effects -- so the changed-witness sublane can plan them instead of declining; sufficient for deleting DeclinedNoCiWetLane and this row together.
+an edited witness file classified BinWitnessWet in gunbc.ci_layer_roots witness_exclusion_frontier: the required floor's changed-witness sublane declines it as DeclinedNoCiWetLane instead of blocking, and no CI lane executes it: RUNG DROP, mechanically preventable -> mitigatable (lost as a passenger of the per-PR bin-witness wet batch, deleted with the floor cut of 2026-08-15, and .github/workflows/falsifier.yml, deleted at 611fd02770 (gunbc#8283)). Population: self_host_artifact_materialization_real_execution_witness_test.dag, stage0_regen_convergence_real_execution_witness_test.dag, typed_witness_invocation_test.dag, namespace_structural_root_exposure_generated_witness_test.dag, emit_host_typed_smoke_test.dag, build_artifact_corruption_probe_witness_test.dag, dag_collect_fingerprint_witness_test.dag, dag_compile_clean_perturb_receipts_test.dag, test/claim/diagnostics_test.dag, effects_rest_transport_parse_witness_test.dag, test/claim/parse_test.dag, v1_dag_parse_witness_test.dag, auth_declared_but_unwired_witness_test.dag, test/claim/bootstrap_test.dag, infer_semantics_witness_test.dag, dag_compile_clean_shard_a_witness_test.dag, dag_compile_clean_shard_totality_witness_test.dag, dag_compile_clean_seam_witness_test.dag, run_verdict_exit_status_witness_test.dag, http_client_get_real_execution_witness_test.dag, roadmap_belt_actuate_witness_test.dag, roadmap_closing_contract_execution_witness_test.dag, host_build_cache_provision_real_execution_witness_test.dag, materialized_ssh_key_file_real_execution_witness_test.dag, proc_self_cgroup_real_execution_witness_test.dag, repo_local_git_config_real_execution_witness_test.dag, transport_script_stdin_byte_fidelity_witness_test.dag, push_event_witness_wet_test.dag, materialization_store_local_immutable_pin_wet_witness_test.dag. Restored when: a REQUIRED lane executes changed BinWitnessWet rows for the same pull_request or merge_group -- builds their witness binaries and runs the edited entries to a terminal verdict on a host that admits their effects -- so the changed-witness sublane can plan them instead of declining; sufficient for deleting DeclinedNoCiWetLane and this row together.
 
 ### The EMIT-COST-QUAL-0 wet battery's only sanctioned executing consumer — declared 2026-09-04
 
@@ -142,14 +152,20 @@ an append to the fabric event log by a principal that is not a fleet writer: RUN
 
 per-module rust emit refusals of corpus modules reachable from required-floor fixture closures, outside the v1 seed closure: RUNG DROP, mechanically preventable -> mitigatable (lost as a passenger of gunbc#13037 (floor C1): compile_dag_rust_emit_check and compile_dag_diagnostic_census stopped rendering every closure module (RenderEveryModule -> v1_compiler.cli_run fixture_render_selection)). Population: every corpus module in the transitive import closure of a fixture source passed to compile_dag_rust_emit_check or compile_dag_diagnostic_census on the required floor, that is not a v1 seed module (no `// Source module:` header under src/v1/stage0/src) or is a seed mirror that the affected-set bound (v1_compiler.required_regen_host scope_selection) does not select on the run in question. Restored when: every corpus module reachable from a required-floor fixture closure is rendered at least once per required run through the rust emitter, and a per-module emit refusal refuses the floor.
 
-### fixture-closure union rust emit of a shell operation whose modeled capture-accounting channels the rust target cannot realize — declared 2026-10-06
+### fixture-closure union rust emit of a shell operation whose modeled capture-accounting channels the rust target cannot realize — declared 2026-10-06 · RETIRED
+
+**RETIRED — TRIGGER FIRED.** 2026-10-08 -- gunbc#13472. THE CAPABILITY, EXECUTED: v1.compiler.emit shell_channel_realized_by_target returns true for ShellChanStderrTruncated, ShellChanStderrTotalBytes and ShellChanStderrRetainedBytes on rust because emit_shell_call implements the declared WitnessStderrCapturePolicy. WitnessBin.Run emits without TransportEmissionNotModeled; the union strip of that service is deleted; this exclusion population is empty. DISCRIMINATING CONTROL, ENROLLED: v1_compiler.cli_run fixture_closure_union_controls admits a fixture whose closure reaches extdeps.gunbc, and a real emit error beside that reach still refuses as FixtureClosureUnionEmitRefused at module=efr_member. Answering the channels as untruncated whole-stream lengths did not discharge this. Deleting the channels from the interface did not discharge this.
 
-fixture-closure union rust emit of a shell operation whose modeled capture-accounting channels the rust target cannot realize: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the rust emitted realization implementing the declared WitnessStderrCapturePolicy, the same next-rung trigger v1.compiler.emit shell_channel_realized_by_target already names). Population: exactly gunbc.stderr_capture_gap_exclusion.exclusion (consumed here as capture_gap_exclusion_population): gunbc.WitnessBin.Run in extdeps.gunbc. Output channels stderr_truncated, stderr_total_bytes, stderr_retained_bytes, each a TransportEmissionNotModeled ShellChannelNotRealizedByTarget for target rust. A later shell operation with the same capture-gap fact is NOT a member: the union still renders it and still refuses. The union compiles and evaluates that record; deleting either this module or the carrier refuses the seed compile. Restored when: THE CAPABILITY: the rust emitted shell realization implements the operation's declared WitnessStderrCapturePolicy, sufficient for v1.compiler.emit shell_channel_realized_by_target to return true for ShellChanStderrTruncated, ShellChanStderrTotalBytes and ShellChanStderrRetainedBytes. WHAT THAT MUST BE SUFFICIENT FOR: those operations emit for rust without TransportEmissionNotModeled, this exclusion has an empty population and this row and the union's strip of those services delete together. Answering the channels as untruncated whole-stream lengths does NOT discharge it. Deleting the channels from the interface does NOT discharge it. Silently omitting the module from the union without naming this cause does NOT discharge it.
+fixture-closure union rust emit of a shell operation whose modeled capture-accounting channels the rust target cannot realize: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the rust emitted realization implementing the declared WitnessStderrCapturePolicy, the same next-rung trigger v1.compiler.emit shell_channel_realized_by_target already names). Population: . Restored when: THE CAPABILITY: the rust emitted shell realization implements the operation's declared WitnessStderrCapturePolicy, sufficient for v1.compiler.emit shell_channel_realized_by_target to return true for ShellChanStderrTruncated, ShellChanStderrTotalBytes and ShellChanStderrRetainedBytes. WHAT THAT MUST BE SUFFICIENT FOR: those operations emit for rust without TransportEmissionNotModeled, this exclusion has an empty population and this row and the union's strip of those services delete together. Answering the channels as untruncated whole-stream lengths does NOT discharge it. Deleting the channels from the interface does NOT discharge it. Silently omitting the module from the union without naming this cause does NOT discharge it.
 
 ### new-witness eval-step cost gate over the one claim that runs the real fleet-converge build-job step list to hold the reset-observer dispatch admission's membership: it still executes, eval_steps stay recorded, a semantic red still blocks; only the eval-step cost-gate rung is lowered — declared 2026-09-30
 
 new-witness eval-step cost gate over the one claim that runs the real fleet-converge build-job step list to hold the reset-observer dispatch admission's membership: it still executes, eval_steps stay recorded, a semantic red still blocks; only the eval-step cost-gate rung is lowered: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: gunbc.fleet_workflow_steps constructing only the steps a consumer demands, so demanding the build-job list does not construct the sibling release-bins steps at the cost it does today). Population: test.claim.workflow_dispatch_input_witness.the_build_job_carries_the_reset_observer_dispatch_admission: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_build_job_membership_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6, floor-shared-fill line for this identity: verdict pass, marginal_eval_steps=155333 with the shared fill netted separately, against the 72,300 new-witness budget. The same claim read marginal_eval_steps=174583 on run 36743802719 at ec1b8190320, when gunbc#12437's job-gate equality built the whole host-reset-return job inside it; splitting that equality into its own claim removed about 19k, so the ~155k is the cost the claim carried before gunbc#12437, not one this change introduced. Restored when: THE CAPABILITY: gunbc.fleet_workflow_steps constructs only the steps a consumer demands -- building the build-job admission step and establishing its membership does not construct the sibling release-bins steps (key, lookup, outcome, pack). WHAT THAT MUST BE SUFFICIENT FOR: test.claim.workflow_dispatch_input_witness the_build_job_carries_the_reset_observer_dispatch_admission measures under the NewWitnessTier budget v2.workflow.required_floor claim_ceiling_eval_step_budget derives, on the acceptance path, still running the real fleet_converge_build_job_own_steps and still asserting structural membership. Supplying the list, narrowing the claim to the step's id, moving the bill to another claim, deleting the identity or raising the budget retires nothing.
 
+### whether fleet-converge plan, apply and live-deploy, and gunbc converge --mode deploy, refuse unless the operator typed a 40-digit expected_revision and a nonempty --candidate-branch — declared 2026-10-10
+
+whether fleet-converge plan, apply and live-deploy, and gunbc converge --mode deploy, refuse unless the operator typed a 40-digit expected_revision and a nonempty --candidate-branch: RUNG DROP, mechanically preventable -> mitigatable (deleted without replacement). Population: gunbc.actions_run_binding admit_optional_expected_revision: ExpectedRevisionAbsent admits binding.run_revision (the dispatched / checked-out sha). Callers: gunbc.fleet_converge_plan_cli fleet_converge_scoped_plan_wet, fleet_converge_apply_wet; gunbc.live_deploy.apply live_deploy_transaction_admitted_wet_with_access. A present expected_revision still has to match; ExpectedRevisionMalformed still refuses. Operator 2026-10-10: the input is a cross-check, not a second revision authority, gunbc.fleet_converge_plan_cli fleet_converge_deploy_branch_admits: an empty required branch admits a nonempty observed branch. An empty observed branch still refuses. A named required branch still has to equal the checkout, NOT in the population: gunbc.roadmap.roadmap_launch_deployment_cli rlm_launch_deployment_receipt and gunbc.runner.runner_microvm_network_apply microvm_network_apply_admission, which still refuse an empty expected_revision. NOT: apply's plan-receipt / plan-hash lock. NOT: privileged WIF, which is equality-pinned at reviewed main. Restored when: THE CAPABILITY: R and the deploy branch are bound to a locked identity the operator produced (a plan receipt, or a required dispatch input with no silent default) so plan/apply/deploy cannot mutate a host at a revision or branch that was never named. WHAT THAT MUST BE SUFFICIENT FOR: omitting RLM_EXPECTED_REVISION and omitting --candidate-branch each refuse, or each is filled from that locked identity (dispatch revision = event sha; apply revision = the admitted plan receipt). Restoring the old main-only expected_revision / candidate-branch == main refusals does NOT discharge it — that re-locks the branch the operator ruled out for development operations. A comment citing an operator date does NOT discharge it.
+
 ### Per-claim cost qualification is unavailable at the subject grain the gate consumes — declared 2026-09-01
 
 Required floor cost — **RUNG DROP, DECLARED (2026-09-01).** SUBJECT: per-claim cost qualification at the subject grain the gate consumes. THIS ROW NAMES NO CAUSE, AND ITS EARLIER NAME DID -- it was `floor_cost_contention_verdict`, which asserted contention as the mechanism when the evidence establishes only that the charge is not a stable property of the claim. Renamed rather than reworded, because a row identity that carries a refuted attribution is cited onward as if the attribution were the finding. WHAT IS LOST: an attempt's CPU duration cannot be read as an invariant property of the witness, nor as proof of a witness-owned regression. the 500ms CPU line this row was declared over (now `required_floor_per_subject_cpu_line_ms`, which is still CPU milliseconds and still compared to a CPU reading by the enrolment margin, both as the ceiling its budget must sit below and as the line a live Roster (typed cost-debt) ground must clear, `v2.workflow.floor_enrolment_margin` `enrolment_declared_measured_standing`; the claim ceiling's own 500 moved to `required_floor_claim_work_envelope_ms`, a policy in milliseconds of work that no clock is compared to) was a cpu-ms literal compared against a measurement that is not a stable property of the claim. WHAT THE CHARGE IS MADE OF, MEASURED RATHER THAN ATTRIBUTED, and this is the whole of what this row asserts about mechanism: it contains a CLOSURE-LEVEL COMPONENT insensitive to the claim's own assertion work, and an EXECUTION-POSITION-SENSITIVE COMPONENT whose cause and bound are NOT established. Neither component is named as contention, memory pressure or warm-up here, because no evidence in hand separates those, and NO BOUND HAS BEEN ESTABLISHED -- which is a different statement from an unbounded cause and must not be read as one. THE MEASUREMENT IS NOT WRONG AND THIS ROW DOES NOT SAY SO: it is a VALID observation of THIS EXECUTION ATTEMPT. What it is not is a stable observation of the claim as an isolated subject, and only the second reading is what a cost verdict needs. WHAT REMAINS, AND STAYS REQUIRED: the 500ms attempt-safety stop, and fail-closed treatment of a required claim that produced no verdict. The position-sensitive component disqualifies the deadline as an INTRINSIC CLAIM-COST VERDICT; it does not disqualify it as a REQUIRED ATTEMPT-SAFETY AND VERDICT-AVAILABILITY criterion. Both terminal arms stay required reds and are distinct: an interrupted attempt means the required claim never produced a semantic verdict, and a completed-past-limit attempt means it crossed the declared safety envelope. Neither proves the witness intrinsically costs more than the limit, that it regressed, that it owns the observed excess, or that it belongs in permanent cost debt. False refusals are an AVAILABILITY loss that fails closed, and removing the deadline would let genuinely runaway evaluation consume the executor without bound. PREVIOUS RUNG: none for environment-independent claim-cost qualification -- that guarantee was never held, and saying it was would be inventing a rung to drop from. Mechanically preventable remains TRUE and undropped for attempt safety. TEMPORARY RUNG: claim-cost qualification UNAVAILABLE; verdict availability environment-sensitive; acceptance still fail-closed. REASON, and the three negative results that make this a capability claim rather than a shrug. (1) THE BASIS IS ALREADY CPU BY DECLARATION: `required_floor_cost_basis` returns `CpuCost` because these claims execute Hermetic, so 'judge cpu rather than wall' is DONE and what remains is cpu-time variance itself. (2) THE OBVIOUS CALIBRATOR IS REFUTED BY MEASUREMENT, and this is the sentence that stops the trigger being discharged by pointing at what we already measure: THE PREPARATION WARM PHASES ARE NOT A CALIBRATOR. Across main and two attempts of one identical tree, `pool-root-index-warm` measured 693 / 727 / 596 cpu-ms and `languages-consumer-census-warm` measured 858 / 606 / 531, so on the attempt whose CLAIMS ran hottest the census phase ran COLDER than main's. They do not track claim inflation. (3) NO CALIBRATION CONCEPT EXISTS IN THE REPOSITORY AT ALL. Normalizing by a quantity that does not track the machine would produce a threshold that LOOKS principled and is not, which is strictly worse than the honest literal. POPULATION -- THE CLOSED SUBJECT UNIVERSE IS NOT A THRESHOLD-SELECTED SET, AND THIS ROW SAID OTHERWISE FOR TWO REVISIONS. The universe is EVERY REQUIRED IDENTITY FOR WHICH THE CPU DEADLINE IS ARMED. That is closed, decidable from the run's own plan, and it does not move with anyone's measurement. WHY THE THRESHOLD SET IS NOT THAT UNIVERSE: the position-sensitive term has no established bound, so NO lower threshold can prove the rows beneath it unaffected. A set selected by 'measured cpu at or above N' is a VIEW whose membership is a property of the MEASUREMENT rather than of the subject, and letting a decidable admission predicate's output stand in for the class's population joins two different objects by an assumption. The predicate was the right answer to a censored-parameter refusal and the wrong answer to 'what is the population'. THE THRESHOLD SET SURVIVES AS AN EXPOSED ATTENTION SUBSET, which is what it is good for: prioritising optimisation and isolation work. Admission is measured cpu at or above the attention constant -- 219ms against the 500ms ceiling, the ceiling over the largest inflation floor observed to date -- and the constant is spelled ONCE here, with every later reference in this row naming it rather than repeating the digits, because a constant that has already moved twice in one day reforks the row on its next revision if it is spelled in three places. THAT SINGLE-SPELLING DISCIPLINE IS PROSE AND NOT STRUCTURE: `RungDrop` carries no numeric field, so nothing refuses a future revision that updates one mention and not another. That missing field is this discipline's next rung. THE ATTENTION CONSTANT'S OWN DERIVATION AND REVISION CONDITION: it is the ceiling over an inflation FLOOR, and a floor is not the inflation, so the constant MUST BE RE-DERIVED THE MOMENT A LARGER FLOOR IS MEASURED. RE-DERIVED 2026-09-03, BY THAT CONDITION AND BY NOTHING ELSE. The floor was 1.777 from a single identity join -- `v2.test.execution.emit_host_meet_join_equals_eval.emit_host_meet_wrong_fixture_refuses_holds` measured 501 cpu-ms on one attempt and 282 on a re-run of THE SAME TREE with nothing changed -- which is ONE PAIR, and one pair is one sample of a between-run quantity and therefore has no spread at all. A LARGER FLOOR IS NOW MEASURED OVER A SAMPLE THAT INDEXES OVER RUNS: 2.280, the worst per-identity max-over-min across TWELVE green `main` runs of `witnesses.yml` on twelve distinct runner registrations across three hosts, restricted to identities present in every run with a verdict, a baseline at or above 50 cpu-ms, and equal `eval_steps` in all twelve. THAT LAST RESTRICTION IS A FILTER AND NOT A FINDING, and the distinction matters here more than anywhere because MISSING ITEM (b) BELOW MEASURED THE SAME COLUMN AND REFUTED ITS INVARIANCE: selecting rows whose steps agree removes tree movement from the sample so the residual is inflation, and it establishes nothing about whether steps are invariant in general -- they are not. 500 over 2.280 floors to the constant above. THE PRODUCER IS NAMED AND THE DIGITS ARE NOT THE AUTHORITY: `gunbc.floor_cost_distribution` `worst_envelope_permille` over `work_invariant_envelopes` of `complete_envelopes`, driven by `tools.floor_cost_distribution_instrument` `floor_cost_envelope_report`, whose sampled runs and their runners are data in `floor_cost_envelope_sampled_runs`. This is the modeled producer the paragraph below says does not exist for the SUBSET; it exists for the CONSTANT'S INPUT and not for the subset, and those are different gaps. ROBUST IN DIRECTION AND NOT ONLY IN VALUE: restricting the same derivation to rows at or above 200 cpu-ms, where whole-millisecond quantisation cannot dominate, gives 1.874 and a constant of 266ms -- still below the superseded 280, so the re-derivation does not rest on the small-baseline tail. STILL A FLOOR: twelve runs on three hosts are a SUBSET of the admitted execution envelopes, so 2.280 can only rise and this constant can only fall. AND THE EXTREMES ARE CONCENTRATED ON PARTICULAR MACHINES, which a median run factor cannot see because a median is robust exactly where the envelope is driven: `run_extreme_census` over the same population reports one run holding the MINIMUM for 367 of 398 rows and one host holding the MAXIMUM for 279 of 398 from three of twelve runs, while per-run median factors span only 0.878 to 1.118. That is this row's own subject measured at host grain. Its predecessor was falsified within the hour for exactly this reason: sized at 400 against a floor of 1.196, it EXCLUDED the one row this class has been observed to trip on the completed-past-limit arm, and an admission rule that omits a known member is wrong at its own grain. TWO OBJECTS, ONE MONOTONE AND ONE NOT, AND THIS ROW PREVIOUSLY CONFLATED THEM: the EVIDENCE FLOOR is monotone -- the largest observed inflation floor can only rise, so the constant derived from it can only fall. THE MEMBERSHIP SET IS NOT MONOTONE: individual identities enter and leave the attention subset as their measured attempt costs vary, which is exactly what makes it a view rather than a population. Monotonicity of the first gives nothing about the second. ON THE NAMED RUN, AT THE SUPERSEDED 280ms CONSTANT AND NOT AT THE ONE ABOVE -- the enumeration is kept as the receipt of what was measured and must not be read as today's subset, which is larger at a lower constant (gunbc#9840 head 85c4a307, required-witnesses-floor, second attempt, 3381 executed rows) the attention subset holds 53 identities across 21 modules, the largest groups being `test.claim.compiler_frontend_program_status_witness` (9), `v2.test.execution.emit_host_meet_join_equals_eval` (4), `v2.test.emit.rust_body_add_emit` (4) and `v2.test.emit.rust_binop_emit` (4). THE SUBSET IS A MANUAL DERIVATION AND NOT AN EXPOSED RUN PRODUCT, AND AN EARLIER REVISION OF THIS ROW OVERCLAIMED IT. The enumeration above was computed BY HAND by reading a run's uploaded `required_floor_claim_cost.tsv` and filtering on the attention constant. NO MODELED FIELD, FUNCTION OR REPORT PRODUCES IT: the constant lives only in this prose, `RungDrop` carries no numeric field to hold it, and nothing consumes it -- so saying the artifact 'reports the subset' asserted an executable relationship that does not exist. WHAT WOULD MAKE IT A PRODUCER, and it is a carrier gap rather than a missing script: the constant modeled as a declaration, and the per-claim cost artifact modeled as data a function can read, at which point the subset is a fold and this paragraph becomes its projection. Neither exists today, and a hand-run filter described as a run product is the specification-without-execution DESIGN section 5 names -- which is why this row now says which of the two it is. THE CONSTANT SITS ON THE STEEPEST PART OF THE COST CURVE and must not be read as a measured threshold: 12 rows reach 400, 16 reach 350, 43 reach 300, 50 reach 290 and 53 reach 280 -- seven rows arrive in a 10ms interval, and 1388 rows measure zero. That histogram is that run's, at the superseded constant; on the twelve-run sample above, taking each identity's MAX over the twelve, 88 identities reach 280 and 158 reach the constant now standing, and the same doubling holds within a single run rather than only in the union (run 33754393519: 61 then 115; run 33775106554: 73 then 128; run 33766436293: 20 then 72). Lowering the constant roughly doubles the subset, which is the cost of the re-derivation stated rather than left for a reader to discover. WHAT LANDED TOWARD THE TRIGGER, AND WHY THIS ROW IS STILL STANDING. The deterministic-work-measure arm now EXISTS AS AN INSTRUMENT and does NOT yet exist AS A BASIS, and those are different things. `v1.interpreter` counts one evaluator step per `eval_expr` entry, UNCONDITIONALLY -- not under the profiling flag, because a measure available only in an instrumented envelope is not available in the envelopes this row is about -- and `run_claim_measured` takes the per-claim delta and nets stored shared-artifact fills out of it by exactly the rule the CPU clock is netted by. WHAT THAT NETTING BUYS, STATED AT THE WIDTH THE EVIDENCE SUPPORTS AND NOT WIDER: the net count is not determined by WHICH TESTED CLAIM PAYS THE MODELED SHARED-ARTIFACT FILL. That is ONE modeled path. It is NOT independence from arbitrary corpus execution order, which is unmeasured and which this row's own missing-item (b) below still names as owed; an earlier revision of this sentence claimed the broad property and contradicted that boundary paragraph two sentences later. It reaches `PerformanceReceipt.eval_steps`, the `[over-cost]` line, and an `eval_steps` column in the per-claim cost artifact. ITS EVIDENCE IS EXECUTED AND DISCRIMINATING, and it is enrolled rather than described: `evaluator_step_work_measure_tests` asserts EXACT equality of the count across two genuinely different envelopes -- one arm with the CPU deadline ARMED, which takes a different path through `eval_expr`, under a co-tenant thread spinning for the whole evaluation -- beside a work control at a different fixture size, so a counter frozen at any constant including zero fails; and a netting arm in which the claim that PAYS a shared fill and the claim that reads it warm are asserted to carry the SAME marginal count while their RAW counts are asserted to differ by more than a factor of ten, so the netted equality is not two identical numbers compared. NOTHING COMPARES THE COLUMN AGAINST A LINE, AND THAT IS DELIBERATE RATHER THAN UNFINISHED. The trigger asks for a claim-owned cost BASIS; a column no verdict reads is a measurement and not a basis, and calling this row retired on the strength of a published column would be exactly the rung inflation 4b(1) forbids. TWO THINGS ARE STILL MISSING and neither is bought by more prose. (a) A STEP-DENOMINATED LINE, which cannot be sized from this tree today because no run has yet published the distribution that the column now makes publishable -- and inventing one would be the same looks-principled-and-is-not threshold this row already refuses on the calibration arm. (b) THE CROSS-ENVELOPE A/B ON THE SHARED RUNNER AT CORPUS GRAIN: an identity join of `eval_steps` across two attempts of one identical tree, where the cpu column moves and this one must not. Until (b) is measured the invariance claim is grounded at FIXTURE grain and nowhere wider, which is the honest reading of what landed. THE CPU DEADLINE IS UNCHANGED BY ALL OF THIS: it is still the armed enforcement clock, still denominated in cpu-ms, and the new column changes no threshold and no verdict. RESTORATION TRIGGER, A CONJUNCTION AND NOT A MENU. An earlier revision offered three ALTERNATIVE arms -- isolation, a deterministic work measure, or a calibrated relative basis -- and that disjunction is refuted by the composition measured above: isolation can stabilise the WRONG SUBJECT, a deterministic measure can count the wrong subject EXACTLY, and calibration can normalise a WRONGLY ALLOCATED charge. Each arm answers a different one of three independent questions, so any one alone leaves the other two open. ALL THREE MUST HOLD. (i) CHARGE SUBJECT ALIGNED: the marginal claim work is separated from the closure-level component, OR the gate is honestly rehomed to closure identity and stops claiming to judge claims. (ii) BASIS INVARIANT OR BOUNDED BY CONSTRUCTION across execution POSITION and envelope, demonstrated by EXACT IDENTITY JOINS rather than by aggregates -- a median over a corpus cannot see a windowed effect, which is the specific error that produced this row's revision. (iii) POLICY LINE GROUNDED over the independently defined FULL population and CONSUMED AT THE SAME SUBJECT GRAIN it was derived at. A basis satisfying (ii) while the gate consumes it at a grain it was not derived for is the same defect wearing better numbers. TWO CONTROLS THAT WOULD DISCHARGE (i) AND (ii), named so the next lane does not have to re-derive them. POSITION CONTROL: the same exact tree and population, a deterministic ORDER ROTATION carrying the same identities through both the early inflated region and the flat tail, cpu allowed to move, and net eval_steps required to remain IDENTICAL by identity join. CHARGE-SUBJECT CONTROL: two claims in ONE closure with materially different assertion work -- do marginal eval_steps discriminate them? The ordinary larger-fixture-takes-more-steps control proves the counter is ALIVE and does NOT prove the steps belong to the claim rather than to its closure, and this row previously leaned on the first as if it answered the second. IF THE SAME-CLOSURE DIFFERENTIAL IS CONSTANT, THE ANSWER IS NOT A STEP THRESHOLD AT CLAIM GRAIN: rehome the policy to closure identity or subtract the closure component explicitly. AND DO NOT TRANSLATE THE 500 CPU-MS LINE INTO STEPS USING THE PER-CLAIM MEASURED CPU DISTRIBUTION, which carries the position-sensitive component this row exists to declare. THE QUALIFIER IS LOAD-BEARING AND WAS ADDED BY RULING (fierce-lark-661, 2026-09-13, on gunbc#11195) BECAUSE THE UNQUALIFIED SENTENCE FORBADE MORE THAN ITS EVIDENCE SUPPORTS -- DESIGN section 4d's over-prohibition arm, whose cost is the thing nobody does. WHAT IS FORBIDDEN is deriving a claim's budget from the population's own CPU readings: that is the run-varying, position-sensitive quantity, and a budget consuming it inherits the defect AND makes a verdict vary between runs. WHAT IS ADMITTED is a SINGLE CONTROLLED READING pinned as a POLICY CONSTANT -- `v2.workflow.floor_eval_step_calibration` -- taken on a fixture whose work is fixed by source rather than by the corpus. The discriminator is not the unit but the DEPENDENCE: an error in a pinned constant mis-scales BOTH tiers ONCE and UNIFORMLY and cannot make one claim's verdict differ between two runs of the same tree, which is precisely the property the denominator change buys and precisely what the per-claim distribution cannot offer. A RE-PIN RESCALES EVERY BUDGET UNIFORMLY AND NEVER ONE CLAIM, so it is a policy act taken deliberately and never maintenance. A SEPARATE CAPABILITY BOUND, RECORDED HERE AND EXPLICITLY NOT THIS ROW'S CAUSE: a shared artifact fill paid inside a claim's measured window before preemption bounds what any deadline mechanism can promise about attribution. PAYER TRANSFER IS REFUTED FOR THIS INCIDENT -- the red run's own `[floor-shared-fill]` ledger carries no `paid_by` line naming the module that tripped, the whole module shifted uniformly by 8 to 11 percent rather than one row taking a lump, and the rows that crossed sat mid-pack on the green attempt. It is a bound on the mechanism, not an explanation of these observations, and it is not this row's population producer. RAISING THE CEILING DOES NOT RETIRE THIS ROW AND IS NOT PROPOSED: 'the comparison does not qualify the claim' and 'the threshold is too low' are different claims, and only the first is recorded here. NOT PROPOSED EITHER: re-running an undecided row until it answers is retry-until-green -- fail-open wearing a fail-closed label -- admissible only as a counted, visible mitigation carrying this row's trigger as its dissolution condition. RECEIPT, 2026-09-02, AND THE MITIGATION THE SENTENCE ABOVE ADMITS CONDITIONALLY IS HEREBY MADE VISIBLE RATHER THAN LEFT IMPLICIT. Rerolling a refused required floor job has been in continuous informal use across this board today under a bounded rule -- at most one reroll per head, and only where the refusal is carried entirely by this row's two arms. THAT RULE WAS MIS-SPELLED AND MIS-EVIDENCED WHEN FIRST WRITTEN, AND BOTH DEFECTS ARE CORRECTED HERE RATHER THAN QUIETLY RESPELLED. It read `one reroll per head per signature`, which parses as a COUNTER KEY -- so many rerolls per distinct signature -- and that reading is self-defeating on this row's own claim: these arms vary across attempts of one unchanged tree, so A CHANGED SIGNATURE IS THE EXPECTED OUTCOME OF A REROLL rather than new information, and every reroll would license the next one for exactly the reason this row exists. The signature was only ever an ADMISSION PREDICATE -- which refusals are eligible at all -- and never a budget. The budget is ONE, PER HEAD. AND THE ELIGIBILITY TEST MUST NOT BE EVALUATED AGAINST THIS CLASS'S OWN COUNTERS. It said `the run reported failed=0`, which was read off the floor's disposition counters; those enumerate COST dispositions and do not range over other phases, so they cannot report that anything else failed and the test could only ever confirm itself. THE RULE STATED SO IT SURVIVES THE SPELLING: ELIGIBILITY IS A PROPERTY OF THE RUN'S PHASE VERDICT AND IS NEVER READ OFF A CLASS'S OWN DISPOSITION COUNTERS, whatever either is called. The quotation `failed=0` above is preserved as a RECEIPT of what a run actually printed on 2026-09-02 and must not be restated as the current key: at the time, one word `failed` carried FOUR SUBJECTS across four emitters of one binary -- lane phases, required-floor claims, DISCOVERY ROWS, and a package LIST -- which is why an inside-the-subject reading looked like an outside-the-subject one. THE DISCOVERY SUBJECT IS THE ONE THAT MATTERS AND IT IS NOT A NARROWER OR WIDER SPELLING OF THE CLAIM POPULATION: it is a DIFFERENT population that additionally absorbs NotBool, RuntimeError, HostToolUnresolved, timeout, panic and NotAttempted, so a reader treating the two as the same word silently unions failure classes the other excludes. That fork is being repaired at the producer by a separate lane, into `phases_failed`, `claims_failed`, `discovery_rows_failed` and `packages_failed`, with `FAILED PHASE` unchanged; this row therefore names the phase verdict as the adjudicating SURFACE rather than any counter key. Eligibility is decided by the RUN'S PHASE VERDICT -- `phases_run`, `failed`, and the `FAILED PHASE` lines -- which is evidence from outside the predicate's own subject. The class is `admission_predicate_evidenced_from_inside_its_own_subject`. Bounded is better than retry-until-green, and it was still NOT the admitted arm, because nothing enumerated the instances and nothing carried this row's trigger as their dissolution condition. This paragraph is that enumeration. DISSOLUTION CONDITION: this row's own RESTORATION TRIGGER and nothing short of it -- a claim-owned cost basis whose value is invariant, or bounded by construction, across the admitted execution envelopes. When that lands, the reroll has no subject and this paragraph goes with it. INSTANCES, CITED BY RUN ID SO EACH IS REACHABLE AND FALSIFIABLE RATHER THAN TALLIED: gunbc#9984 run 33604337589 attempts 1 and 2 on head 9b00e24f592 (refuse then pass; `interrupted_before_verdict` 4 then 0, `completed_over_cost_requirement` 3 then 0, `planned=executed=3486` and `failed=0` on both); gunbc#10022 run 33615900632 attempts 1 and 2 on head c2c1db141a (refuse then pass, two undecided rows in `test.claim.self_host_compile_phase_live_gate_witness`); gunbc#9954 commit 53088562e30 (`interrupted_before_verdict=15`, `completed_over_cost_requirement=0`, `failed=0` -- the largest single observation, and purely the non-verdict arm); gunbc#10044 run 33618811753 attempts 1 and 2 on head 2d42cca4b94 by session eager-ferret-714's lane (refuse THEN REFUSE on one tree with different accounting -- `interrupted` 2 then 4, `over_cost` 0 then 2); and gunbc#10044 run 33619277245 attempts 1 and 2 on head 0e9b1518b7b (refuse then refuse; `interrupted` 5 then 2, `over_cost` 4 then 0, `planned=executed=3477` and `failed=0` on both); gunbc#10047 run 33622971872 attempt 2 on head 1aa6d8f41dc (attempt 1 refused at 502ms on `v2.test.emit.rust_binop_emit.rust_binop_producer_emit_sub_holds`, a module carrying four identities in this row's own attention subset -- so the roster PREDICTED the row that blocked that PR, which is a stronger receipt than a fresh observation); gunbc#9986 at f5fca17678f (`planned=executed=3503`, `failed=0`, `interrupted_before_verdict=2` in `test.claim.compiler_frontend_program_status_witness` and `test.claim.self_host_compile_phase_frontier_witness` -- NEITHER in the live-gate family, on a head that had ALREADY taken 2d76d9ccb33, which is what establishes the arm is not confined to a repairable family); and gunbc#10044 run 33628404336 attempts 1 and 2 on head 03780b8c76c, floor jobs 100219422472 and 100256793010 (REFUSE THEN REFUSE at ONE ROW EACH, `failed=0` and `planned=executed=3486` on both, `interrupted_cpu_deadline=1` -- but attempt 1's row was `v2.test.emit.produced_decl_two_target` and attempt 2's was `v2.test.execution.emit_host_module_equals_eval`, a DIFFERENT identity at the same count). AND ONE FURTHER PAIR, ENTERED MARKED BECAUSE ITS ADMISSION WAS INVALID AND THAT IS PRECISELY WHY IT IS KEPT: gunbc#10077 run 33647114048, floor job 100317014535, head 74719e46dd, both attempts `planned=executed=3487` with no unexpected claim failures -- attempt 1 `interrupted_before_verdict=12` (all `interrupted_cpu_deadline`), `completed_over_cost_requirement=0`; attempt 2 `interrupted_before_verdict=1`, `completed_over_cost_requirement=2`. Refuse then refuse. All twelve of attempt 1's rows sit in `test.claim.self_host_compile_phase_frontier_witness` and `test.claim.self_host_compile_phase_live_gate_witness`, EACH MEASURED 501 TO 506 CPU-MS AGAINST THE 500MS LIMIT -- a one-to-six millisecond miss, which is the sharpest evidence this row has for its own claim: a witness failing at 900ms would be consistent with genuinely costing that much, and one failing at 501 is not. THE ADMISSION WAS FALSE WHEN IT WAS MADE. The run was `phases_run=3 failed=2`, refusing on the floor AND on `namespace-wave-admission` with 57 unadjudicated deltas, so the refusal was never carried entirely by this row's two arms; the eligibility test had been evaluated against the floor's own disposition counters, which cannot report that another phase failed. IT IS ENTERED RATHER THAN REPLACED BY A CLEANER RUN, and the reason is structural: a clean run cannot evidence a defective admission predicate, so this is the only receipt that the rule was broken, and dropping it for being untidy would filter the mitigation's record by how the mitigation turned out. WHAT IT DOES NOT ESTABLISH, stated because the counts invite it: attempt 2's single interrupted row was ALSO IN attempt 1's twelve, so the pair is a SUBSET and not a disjoint redraw, and a stable population straddling the threshold explains both attempts without any redraw at all -- one module in this run carries members at 481, 490, 499, 500 and 501 ms. The counts moved; the membership did not leave the prior set. An earlier reading of this pair asserted that a fixed marginal set could not produce those counts; that assertion was withdrawn by its own author on the membership measurement before it was entered here. THAT LAST PAIR IS SUGGESTIVE AND DOES NOT SETTLE IT ALONE, WHICH IS WORTH SAYING BECAUSE THE OVERSTATED VERSION WAS WRITTEN HERE FIRST: two draws showing DIFFERENT identities at n=1 per side are equally consistent with a FIXED set of marginal rows sitting so close to the deadline that ordering decides which one crosses. Identity change alone does not discriminate those two explanations. WHAT DISCRIMINATES IS THAT THE COUNT MOVES AS WELL AS THE MEMBERSHIP, across the instances above taken jointly: 4 then 0, 5 then 2, 1 then 1, 2 then 4, and 15. A fixed marginal set would have to explain a count ranging over 0, 1, 2, 4, 5 and 15 AND the membership changing; a population redrawn per attempt explains both, and near-threshold ordering explains only the second. So the redraw reading is CORROBORATED BY THE INSTANCES JOINTLY rather than established by any one pair -- and the load-bearing consequence survives either way, because on both readings no enumeration of the expensive claims can be the population, family-by-family cost repair lowers incidence without bounding the class, and a green reroll is not evidence the refused row was wrong. ; and gunbc#9986 run 33655367446 attempts 1 and 2 on head 2ee252f3339 (REFUSE THEN CLEAN, the mitigation's only successful roll recorded here: attempt 1 `interrupted_before_verdict=15` all `cpu_deadline`, attempt 2 `interrupted_before_verdict=0`, with `planned=executed=terminal=3504` and `failed=0` on BOTH -- and every one of the 15 sat in `test.claim.self_host_compile_phase_frontier_witness` or `test.claim.self_host_compile_phase_live_gate_witness`, neither of which that change touched. 15 equals the largest prior observation (gunbc#9954) on an unrelated tree, and the previous head of this same PR showed 2, so the amplitude moved by an order of magnitude across a main merge alone). THIS INSTANCE WAS ENUMERATED BY THE LANDING MANAGER RATHER THAN THE AUTHORING LANE, deliberately: this row is one very long line, so each lane appending its own instance produces a diff the review surface sizes as a one-line wording tweak -- the class filed as `gunbc.recurring_failure_mode` `salience_instrument_blind_to_the_record_it_sizes`, whose specimen is an earlier edit to THIS row. Batching the appends does not reduce the bytes a reviewer must read; it reduces the number of times that misreading is invited. RE-DERIVE ANY OF THESE WITH `gh api repos/OWNER/REPO/actions/jobs/JOB/logs --allow-escape-sequences` AND WITH NOTHING ELSE. Measured on the first pair above: `gh run view --job <job> --log` answers an ATTEMPT-1 job id with ATTEMPT 2's CONTENT -- banner timestamp and counters both attempt 2's -- so an auditor re-deriving a two-attempt specimen with it obtains IDENTICAL content on both sides, observes no disagreement, and reports these enumerated instances as fabricated. The instrument defect is WIDER THAN WRONG-ATTEMPT, measured 2026-09-02 on gunbc#10077 by diffing both fetches of ONE job: the `gh run view` copy was MISSING THE `FAILED PHASE` LINES ENTIRELY. It does not merely serve the wrong attempt; it can DROP THE LINES CARRYING THE VERDICT, turning a two-phase failure into an apparent one-phase failure -- which is precisely how the admission predicate above was evaluated as true while it was false. An instrument whose omission is invisible is worse than one that is merely stale. The instrument fails in the direction that discredits a true finding, and without the escape-sequences flag the same endpoint writes zero bytes instead. Anyone checking these numbers must be holding the right instrument before disagreeing with them. NO MODELED PRODUCER COUNTS THESE, AND THAT MISSING COUNTER IS THIS PARAGRAPH'S OWN GAP: `RungDrop` carries no field for a mitigation instance, nothing folds the run ids, and a hand-kept TALLY is deliberately absent here because this row has already had to retract one hand-derivation described as a run product. A count with no producer is stale at the next roll and re-derivable by nobody; a run id is reachable by anyone. Whoever wants the number counts the citations. WHAT THE INSTANCES ESTABLISH BEYOND THE MITIGATION ITSELF: the two arms vary INDEPENDENTLY and in both directions on fixed bytes, and a refusal can repeat while disagreeing with itself about which rows were undecided -- so a reroll is not a coin flip against a fixed population but a fresh draw of the population. ONE FINER OBSERVATION THAN THIS ROW PREVIOUSLY SUPPORTED, from the last instance: after the live-gate cost repairs in 2d76d9ccb33 (gunbc#10038), `test.claim.self_host_compile_phase_live_gate_witness` was ABSENT from attempt 1 and BACK in attempt 2 of ONE head. A cost repair lowering a family's incidence is the expected reading; that the family is intermittent WITHIN a single head's attempts is stronger, and it is the sharpest available statement that a cost repair moves incidence without touching the mechanism at the boundary. The conflation of a computed non-verdict with a refusal at the AGGREGATE boundary is a separate class and is filed as `gunbc.recurring_failure_mode` `non_verdict_disposition_surfaces_as_refusal`, which cites this row for the cost half rather than re-deriving it. RECEIPT, 2026-09-03, gunbc#10192: ONE EPISODE BY RUN ID -- ADMITTED IN PART AND NOT END TO END, WHICH THE ENUMERATION BELOW ADJUDICATES RATHER THAN SMOOTHS -- AND THE FIRST CORPUS-GRAIN MEASUREMENT OF MISSING ITEM (b) -- WHICH IT REFUTES RATHER THAN DISCHARGES. THE EPISODE, run 33716314510 on head b65a0eb5b32, ENUMERATED IN FULL INCLUDING THE ATTEMPTS THAT DO NOT QUALIFY, because the sequence contains a transition this row does NOT authorize and an enumeration that showed only the eligible attempts would present an unadmitted retry as part of an admitted mitigation. ATTEMPT 1 EXECUTED ZERO JOBS -- no required-witnesses-floor job exists for it; the run was created awaiting workflow approval -- so it is not an attempt of this class and counting it as one would inflate the denominator. ATTEMPT 2, job 100543957851: claims_failed=33 with BOTH cost arms at zero. OUTSIDE this row's domain: zero dispositions in either cost arm. THE CAUSE OF THOSE 33 IS NOT ESTABLISHED HERE AND AN EARLIER DRAFT CALLED THEM SEMANTIC, WHICH THE COUNTERS DO NOT SUPPORT -- claims_failed enumerates ordinary claim-failure dispositions and does not say why they failed, and a missing host capability surfacing as a runtime error would land in the same counter as a genuine false assertion. The honest reading is an ORDINARY CLAIM-FAILURE FLOOR REFUSAL, CAUSE UNESTABLISHED. ITS ROLE HERE IS A NEGATIVE ELIGIBILITY CONTROL AND NOT A DENOMINATOR MEMBER, which corrects the reason an earlier draft gave for including it: a mitigation's eligible population is the attempts satisfying its admission predicate, so an attempt outside the class can no more count as a failed use of the mitigation than an ordinary compile error can. It is kept because it PROVES THE PREDICATE EXCLUDES SOMETHING REAL. AND THE TRANSITION OUT OF IT IS UNADJUDICATED, WHICH THIS ROW RECORDS RATHER THAN LAUNDERS: outside this row's budget means attempt 2 SPENT no reroll; it does not mean attempt 2 EARNED one. The re-run that produced attempt 3 was NOT admitted by this row -- attempt 2's refusal was carried by neither cost arm -- and no other authority is named for it. So this sequence is not one admitted mitigation end to end: it is an unadmitted retry of an ordinary red on byte-identical executed input, followed by a cost-only refusal that this row does admit, followed by its one reroll. A clean attempt 4 does not retroactively discharge attempt 2, and with attempt 2's identity artifact absent it cannot even be shown that all 33 failures were offered again. ATTEMPT 3, job 100573179841: presents as the two-arm shape this row admits, AND THE ADJUDICATING SURFACE IS ENROLLED HERE RATHER THAN ASSUMED: the run reports phases_run=3 with phases_failed=1, the ONLY FAILED PHASE being the floor, and unexpected_failures=0 -- the external phase verdict this row names as the current eligibility surface, and what establishes that no other phase failed. Beneath it the cost arms are completed_over_cost_requirement=1 and interrupted_before_verdict=1 all cpu_deadline, one row each. An earlier revision removed the internal proof without putting the external one in its place, leaving a correct qualification unsupported by the very surface this row says must adjudicate it. THE `failed=0` SPELLING IS NOT THE ELIGIBILITY KEY AND IS NOT RESTATED AS ONE HERE, because this row already ruled that test defective: it is read off the floor's own COST disposition counters, which do not range over other phases and so could only ever confirm themselves. The current surface is the RUN'S PHASE VERDICT -- phases_run, failed, and FAILED PHASE lines -- and the counters below are receipt, not the test. The completed-past-limit row is v2.test.emit.produced_decl_two_target.produced_decl_module_folds_declarations_in_order at cpu_ms=515, an EXACT measurement against the 500 line; the interrupted row is its SIBLING IN THE SAME MODULE, produced_decl_two_targets_render_own_order, whose printed 509 is the BUDGET and not a measurement. ATTEMPT 4, job 100606296727: the consumed reroll, clean, failed=0 and both arms zero. A LATER AND DIFFERENT TREE, head 2b9e59206af (run 33746447180, job 100619903740), ran clean with MORE claims (executed 3519 rising to 3539) and spent no reroll -- consistent with this row's redraw reading and NOT evidence for it, since one clean draw discriminates nothing. MISSING ITEM (b) IS NOW MEASURED AND IS REFUTED. (b) asked for an identity join of eval_steps across two attempts of ONE IDENTICAL TREE where the cpu column moves and this one must not. Attempts 3 and 4 are exactly that pair, and the artifacts are required-floor-claim-cost 9885042655 and 9889079822, both executed=3519, the identity join TOTAL at 3519 with zero rows on either side alone. cpu_ms disagrees on 1394 of 3519 rows, max absolute delta 128ms. eval_steps disagrees on 18 of 3519. So the step measure reproduces exactly on 99.49 percent of the corpus against cpu's 60.4 percent -- FAR more stable, AND NOT INVARIANT, and (b) asked for invariance. THE JOB LOG SAYS THE OPPOSITE, AND THAT IS THE TRAP THIS PARAGRAPH EXISTS TO CLOSE: in the printed over-cost list every identity carries an identical eval_steps across all four runs while cpu swings by a third, so (b) reads as satisfied from the log alone. It is not. That list is ranked BY COST and truncated at 25, and 17 of the 18 disagreeing rows are too cheap to appear in it. A SUBSET SELECTED BY THE VARIABLE YOU ARE NOT TESTING CANNOT TEST THE ONE YOU ARE -- the same defect this row already records for the attention subset, reappearing on the new column, and the reason (b) must be joined on the uploaded artifact and never on the run's printed summary. WHAT THE 18 ARE, AND THEY ARE TWO DIFFERENT CLASSES RATHER THAN ONE POPULATION. SEVENTEEN ARE PASS/PASS with tiny deltas -- 3 to 161 steps, absolute relative difference at most 0.43 percent -- and they are CLUSTERED, NOT UNIFORM: sixteen of the seventeen sit in three modules, v2.test.claim.rust_crate_partition_witness (6), v2.test.claim.c_compilation_unit_witness (5) and v2.test.claim.compilation_unit_witness (5), one partition-and-unit witness family, with a single stray in v2.test.claim.emit.trait_derive_supplemental_generic_bound_contract -- out of 3519 claims spanning the corpus. So MODULE-CLUSTERED VARIANCE EXISTS IN THIS A/B. That is the measurement; it does NOT establish the source, and an earlier revision called it a nondeterminism SOURCE, asserting as fact the conjecture the paragraph below correctly labels as one. IT IS EVIDENCE ABOUT THE STEP COUNT AND NOT ABOUT THE REFUSAL POPULATION, and conflating those is the error this row has already had to retract once: it establishes that module-clustered variance EXISTS in the corpus, which is the mechanism a module-clustered redraw would require, and it does not establish that the refused set redraws by module. THE EIGHTEENTH IS A DIFFERENT CLASS AND BEARS DIRECTLY ON MISSING ITEM (a). produced_decl_two_targets_render_own_order carries 196608 steps in the attempt where it was budget_interrupted and 197227 where it passed, so AN INTERRUPTED CLAIM'S eval_steps IS A PARTIAL COUNT AT THE STOP, not the claim's work -- the exact twin, in the step domain, of the already-recorded fact that an interrupted row's printed ms is the budget rather than a measurement. 196608 is 3 times 2 to the 16th exactly, which is suggestive of a step-interval deadline check; that is n=1 and the mechanism is NOT asserted here. THE CONSEQUENCE FOR (a) IS CONCRETE AND IS WHY THIS IS RECORDED BESIDE IT: a step-denominated line would compare against this partial for precisely the rows it exists to judge, so (a) needs a rule for the non-terminal row BEFORE it needs a number. NET EFFECT ON THE TRIGGER, STATED PER ARM BECAUSE (ii) IS A DISJUNCTION: the conjunct reads INVARIANT OR BOUNDED BY CONSTRUCTION and only the first arm has been tested. EXACT-INVARIANCE ARM: measured and REFUTED. BOUNDEDNESS ARM: UNESTABLISHED -- the 556-identity distribution below calls itself a spread and not a bound, reinforcing the distinction rather than resolving it. WHOLE CONJUNCT: REMAINS UNSATISFIED. An earlier revision wrote that (ii) moves to MEASURED AND FAILING, which is too broad for a disjunction whose second arm is untested: unsatisfied and both-alternatives-measured-and-failing are different findings. The trigger is a conjunction of three and (i) and (iii) are untouched, so nothing here retires this row and nothing here proposes raising the ceiling. RE-DERIVE with gh run download rather than by piping the artifact zip through a shell: gh api .../artifacts/ID/zip redirected to a file, and curl -o on the redirect target, BOTH corrupt the bytes in this environment -- a malformed local header and roughly 380 bytes short -- so an auditor who reaches for the obvious command gets an unreadable archive and may conclude the artifacts are gone. Taking the Location header and fetching it UNAUTHENTICATED also works; forwarding the Authorization header to blob storage returns 401. ONE FURTHER MEASUREMENT FROM THE SAME EPISODE, AND IT BEARS ON THIS ROW'S OWN REROLL SIGNATURE RATHER THAN ON ITS COST ARMS: THE PLANNED POPULATION IS NOT A FUNCTION OF THE TREE. On the single head b65a0eb5b32, the three attempts carrying a floor job report planned=executed=3534 (attempt 2, 33 claims failed), 3519 (attempt 3) and 3519 (attempt 4) -- fifteen claims of difference across attempts of ONE head with no change to the source. NO CAUSE IS ASSERTED HERE AND THE OBVIOUS ONE IS NOT VERIFIED: if the plan is computed relative to a moving main rather than to the head under test, this is expected rather than anomalous, and that is the first thing to check before treating it as a defect. WHAT IT DOES ESTABLISH REGARDLESS OF CAUSE is that EXACT HEAD DOES NOT BY ITSELF FIX THE POPULATION A REROLL IS DRAWN FROM, so a changed planned COUNT is RECEIPT AND COMPARABILITY DETAIL, and a potential planning or coverage defect, and NEVER a fresh reroll allowance. An earlier draft left that open as though it were undecided; it was already decided earlier in this same row, and leaving it open invited the budget reading it forbids. IT DOES NOT CONTAMINATE THE (b) JOIN ABOVE: attempts 3 and 4 both planned 3519 and their identity join is total at 3519 with zero rows on either side alone, which is why that measurement stands independently of this one. AND IT CORRECTS A CHARACTERISATION THAT WAS OFFERED FOR ATTEMPT 2 AND IS FALSE: that attempt was not a toolchain or host-tool incident -- its own summary reports host_tool_unresolved=0 beside claims_failed=33, so it is an ordinary red floor and belongs to no runner-incident population. The disposition is unchanged either way, since both cost arms are zero, so THE COST-ARM ADMISSION PREDICATE DOES NOT HOLD -- stated that way because there is no failed=0 precondition to fail, that key having been retired earlier in this same row, and an earlier revision resurrected it here after removing it one paragraph away, but the ground for excluding it from the mitigation is the cost-arm test and NOT a tooling attribution. THE CAUSE NAMED AS LIKELY IN THE PARAGRAPH ABOVE IS NOW CHECKED AND REFUTED, WHICH IS WHY THAT PARAGRAPH SAID TO CHECK IT FIRST. The suggestion was that the plan might be computed relative to a moving main rather than to the head under test, which would make the differing planned counts expected. IT IS NOT THAT. GitHub Actions evaluates a SYNTHETIC MERGE rather than the branch head, and all three attempts checked out THE SAME SYNTHETIC MERGE COMMIT -- each job log carries the identical line naming the merge of b65a0eb5b32 into 3547b3f9028 at one merge SHA -- so the three attempts ran a BYTE-IDENTICAL TREE and the main they were merged against did not move between them. The planned population therefore varies across attempts of a genuinely fixed tree. THE COUNTERS THAT DO NOT VARY NARROW IT FURTHER, and they are the ones a reader would reach for first: known_red_held, route_gap_held and stale_quarantine are IDENTICAL across all three attempts, so this is not a roster, quarantine or route-gap difference selecting a different population. Only planned, executed and terminal move, together, by fifteen. WHAT CANNOT BE SAID, AND THE REASON IS an artifact gap rather than a judgement: WHICH fifteen identities differ is NOT recoverable, because the attempt that planned 3534 uploaded no per-claim cost artifact -- only the two 3519-attempts did -- so the finding is available at COUNT grain and not at IDENTITY grain, which is precisely the weaker form this row elsewhere refuses to accept as a population. It is recorded as a count because that is what was measured. ONE CONJECTURE, LABELLED AS ONE AND CARRYING ITS OWN TEST RATHER THAN A CONCLUSION: the same unpinned iteration order that would explain the module-clustered eval_steps variance recorded above -- sixteen of seventeen disagreements inside one partition-and-unit witness family, which is exactly the shape of a fold over a set with no declared order -- could also change how many claims a generator emits, giving both observations ONE root. NOTHING HERE ESTABLISHES THAT, and the discriminating test is named so the next lane does not have to invent it: recover the fifteen identities by having the planner emit its plan as an artifact on every attempt including a failing one, then join two attempts of one synthetic merge at IDENTITY grain and ask whether the differing rows are generated claims from the same witness families that carry the step variance. Until that artifact exists the two observations are adjacent and unjoined. THE CONSEQUENCE FOR THIS ROW'S REROLL RULE IS UNCHANGED BY THE REFUTATION AND IS STRENGTHENED BY IT: exact head does not fix the drawn population, and it is now known that no appeal to a moving base explains it away. AND IT DOES NOT EXPAND THE REROLL ALLOWANCE, WHICH IS THE READING IT MOST INVITES AND THE ONE THIS SENTENCE EXISTS TO REFUSE: a differing planned cardinality WEAKENS COMPARABILITY between two attempts and lowers confidence that they covered the same claims; it does not license a second draw. The allowance stays at ONE PER EXACT HEAD, consumed on actuation. IT IS NOT PER SIGNATURE, AND SAYING SO WOULD REINTRODUCE A SPELLING THIS ROW ALREADY REFUTED: the signature was only ever an ADMISSION PREDICATE -- which refusals are eligible at all -- and never a budget key. This finding makes exact head insufficient as a COMPARABILITY IDENTITY; it leaves exact head intact as the deliberately coarse BUDGET KEY, and letting a changed population mint a fresh signature would recreate retry-until-green exactly when the roster becomes unstable. An attempt that falls outside this row's domain spends nothing AND EARNS NOTHING -- it is not a free retry, and treating an ineligible red as though it restored the budget would be retry-until-green reached by a different route than the one this row already forbids. RECEIPT, 2026-09-03, gunbc#10231 -- THE SHARPEST INSTANCE THIS ROW CARRIES, BECAUSE THE VERDICT FLIPPED WHILE THE WORK MEASURE DID NOT MOVE BY ONE STEP. THE SUBJECT MAKES THE POINT BEFORE THE NUMBERS DO: it is a LEDGER-ONLY PROSE PR -- the filing of this row's sibling mechanism class -- touching one authority row and its generated projection, with no code, no types and no gates. A DIFF CATEGORY DOES NOT GRANT COST INNOCENCE BY CONSTRUCTION, and an earlier revision claimed it did: the ledger is ACCEPTED .dag SOURCE here, so altering a large literal can move parsing, resolution, allocation, generated structure or closure work, and shape is not an argument about cost. THE NARROWER CONTROL IS SUFFICIENT AND IS WHAT IS CLAIMED: the diff was IDENTICAL ACROSS BOTH ATTEMPTS, so whatever it costs relative to its base, it cannot explain the attempt-to-attempt flip. Run 33756177727 attempt 1, floor job 100651027559: REFUSED with completed_over_cost_requirement=1 beside claims_failed=0, interrupted_before_verdict=0 and host_tool_unresolved=0 -- one row, wholly inside this row's admitted domain on the two-arm test, with the run's phase verdict carrying no other failed phase. One reroll was actuated and thereby CONSUMED, against a budget of ONE PER EXACT HEAD. Attempt 2, job 100663093895: PASS. THE DISCRIMINATING PAIR, and it is one identity rather than an aggregate: v2.test.emit.rust_produced_decl_emit.rust_produced_decl_name_discriminates measured cpu_ms=523 on the refusing attempt and cpu_ms=404 on the passing one -- a ratio of 1.294 across the 500 line -- WHILE ITS eval_steps IS IDENTICAL AT 169297 ON BOTH. Same head, same tree, same identity, same count of evaluator steps, opposite verdicts. WHAT THAT SUPPORTS, AT THE INSTRUMENT'S REACH AND NOT BEYOND IT: for one fixed identity on one fixed head the cpu-line verdict flipped while the recorded net evaluator-step count stayed exactly identical, so THE CPU VERDICT IS NOT DETERMINED BY eval_steps ALONE -- stronger than showing cpu varies more often than steps, because it exhibits the mismatch at the very identity whose verdict changed. WHAT IT DOES NOT SUPPORT, and an earlier revision asserted it: that the deciding component lies OUTSIDE THE CLAIM'S WORK. Identical eval_steps establishes identical COUNTED EVALUATOR ENTRIES AFTER THIS INSTRUMENT'S NETTING RULE, not identical claim work -- host work, closure work, attribution and cache behaviour are uncounted and remain possible. This row keeps CHARGE-SUBJECT ALIGNMENT open as conjunct (i), so it cannot use this pair to place the varying component outside the claim; that would discharge (i) by assertion. THIS DOES NOT CONTRADICT THE (b) REFUTATION RECORDED ABOVE, and the reconciliation matters because the two readings look opposed: (b) failed because 18 identities of 3519 disagree on eval_steps, NOT because the measure is generally unstable -- 3501 reproduce exactly, and this identity is one of them. A measure can be exact on a given row and still fail an invariance claim asserted over a corpus. A THIRD SAMPLE OF THE SAME IDENTITY EXISTS ON GREEN MAIN, CITED BY RUN AND JOB SO IT IS RE-DERIVABLE RATHER THAN RELAYED: run 33754393519, floor job 100645180812, event push on main head 75873c28978, reports this identity at cpu_ms=406 with eval_steps=169297 -- the SAME step count as both attempts of the episode above, at a third distinct cpu. AND THE ORDERING IS WEAKER THAN AN EARLIER REVISION OF THIS PARAGRAPH CLAIMED, WHICH IS WHY THE CARRIER WAS WORTH DEMANDING. That revision said the identity had been NAMED IN ADVANCE and that a lane had PUBLISHED the crossing arithmetic before the refusal, which made it a prediction. The job timestamps refute that framing: the green-main job ran 12:17:45Z to 12:45:05Z and the refusing attempt ran 12:40:20Z to 13:10:22Z, so THE TWO RUNS OVERLAPPED. The green-main value was therefore observable 25 minutes before the refusal was observed, and it is CORROBORATION AT A THIRD SAMPLE rather than a prediction made before the event. The advance-prediction claim is withdrawn; it was received by relay and no carrier for the publication event was ever produced, which is exactly the transcribed-number failure DESIGN section 6 forbids -- name the producer, never copy its output. A prediction that names the row before it refuses a PR is worth more than a fresh observation of the same event. INDEPENDENT REPLICATION OF THE SPREAD, derived from the per-claim cost artifacts of THIS row's other episode rather than from the reporting lane's run, and it is an INDEPENDENT RUN AND ARTIFACT SAMPLE rather than an independent instrument -- an earlier revision said the two share NO instrument, which is false: they share the required-floor cpu producer, its accounting semantics, the evaluator-step counter and the artifact schema. What they do not share is a run or an artifact, and that is the whole of the independence claimed: over the 556 identities measuring at least 50 cpu-ms in BOTH attempts of one identical tree, the attempt-to-attempt cpu ratio -- DEFINED PER JOINED IDENTITY AS max(cpu_A, cpu_B) / min(cpu_A, cpu_B), so it is direction-free and never below 1.0, stated because an earlier revision published percentiles without the formula and B/A would give materially different numbers -- has median 1.045, p10 1.005, p90 1.219 and MAXIMUM 1.721. THE MEDIAN IS THE UNINTERESTING NUMBER AND THE TAIL IS THE ONE THAT DECIDES VERDICTS -- a corpus whose typical row moves by 4 percent still puts four identities at 94 to 103 percent of budget on a tree that PASSED. WHAT NONE OF THIS ESTABLISHES, stated because this row's trigger asks for exactly the thing it falls short of: A BOUND. Two attempts give a SPREAD, and (ii) requires the basis to be invariant OR BOUNDED BY CONSTRUCTION across the admitted envelopes; a maximum of 1.721 observed over one pair of attempts on one host pair is a FLOOR on the spread, not a bound on it, and the admitted envelope set is wider than the hosts these pairs sampled. THE CONSEQUENCE ON MAIN, MEASURED AT VERDICT GRAIN RATHER THAN AT ROW GRAIN (2026-09-03), because everything above measures ROWS and the thing that costs the fleet its afternoon is the VERDICT. Of the twenty-five most recent `witnesses.yml` runs on `main`, five reported `verdict=FloorRefused` with `claims_failed=0` and `unexpected_failures=0` -- the whole refusal carried by `interrupted_cpu_deadline` and `completed_over_cost_requirement`, so the required floor refused main five times without a single claim disagreeing with the tree. A GATE THAT REFUSES FOR REASONS UNRELATED TO THE CHANGE TEACHES ITS READERS THAT A RED REQUIRED FLOOR IS NOISE, and that is the cost this row had not priced: the sections above price the mis-attribution of a NUMBER to a row, and this one prices the mis-attribution of a VERDICT to a tree. AND THE HOST CORRELATION, STATED AT THE WIDTH THE SAMPLE SUPPORTS AND NOT WIDER. THE DECISIVE MEASUREMENT IS NOT THE HOST TABLE, IT IS A SAME-HEAD CONTROL, and it is stated first because it is established BY CONSTRUCTION rather than by correlation. Run 33806159353 was re-run at the same head: attempt 1 recorded `required-witnesses-floor` FAILURE on runner srv4-14 and attempt 2 recorded SUCCESS on runner srv4-19, both at head 07f81df887a, unchanged between them. ONE TREE, TWO ATTEMPTS, OPPOSITE VERDICTS. Nothing about the subject differed, so the required floor's verdict is demonstrably NOT A PROPERTY OF THE TREE -- which is this row's whole subject, now shown rather than inferred, and shown without needing any closure argument because nothing changed. THE HOST TABLE IS THE WEAKER EVIDENCE AND ITS FAMILY-SHAPED READINGS ARE REFUTED, twice, in the same direction. Eleven `required-witnesses-floor` jobs by runner registration: seven failed (srv1-02, srv1-07, srv1-10, srv1-16, srv1-17, srv4-11, srv4-14) and four passed (srv3-02, srv3-04, srv3-10, srv4-19). A first reading said srv1 is the bad host and srv4-11 refuted it; a second said srv3 is the only host observed clearing the ceiling and srv4-19 refuted that too, since srv4 now does BOTH. BOTH READINGS GENERALISED A HOST FAMILY FROM MACHINE-LEVEL SAMPLES AND THE NEXT SAMPLE CROSSED THE LINE EACH TIME, which is why the surviving statement names no family at all. WHAT THE MEASUREMENTS SUPPORT, AND NOTHING WIDER: the verdict is not a property of the tree; it is not cleanly a property of the host family; THE ACTUAL VARIABLE IS UNIDENTIFIED, with machine-level load or moment and a per-machine difference both consistent with the data, and eleven samples cannot separate them. Naming a cause here would be the looks-principled-and-is-not move this row already refuses on the calibration arm. MISSING ITEM (b) IS NOW DISCHARGED OVER THE MEASURABLE POPULATION AND THE ROW STILL STANDS, and the reason it still stands is the more useful half. THE JOIN (warm-seal-35, over the two attempts above): 338 shared-fill per-claim rows on each side, joined ON IDENTITY with ZERO unmatched rows in either direction, `marginal_eval_steps` and `measured_eval_steps` IDENTICAL for all 338, while measured cpu-ms moved by more than ten percent on 124 of them and spanned 0.627 to 1.217 as an attempt-2-over-attempt-1 ratio. That is (b) as worded -- an exact identity join of the step column across two attempts of ONE IDENTICAL TREE, with the cpu column moving and this one not -- and it is a population rather than a subject, which is what separates it from the single-claim reading above. ITS DENOMINATOR IS NOT THE FLOOR, AND QUOTING IT AS WHOLE-FLOOR COVERAGE WOULD BE THE ERROR THIS ROW EXISTS TO REFUSE: both attempts executed 3585 claims and the shared-fill instrument reports per-claim cost for 338 of them, so the join covers 9.4 percent and is silent about the rest. THE EXCLUSION IS THE FINDING, NOT A CAVEAT ON IT, AND IT IS SHARPER THAN THE CONSTRAINT PREDICTED ABOVE. An interrupted row is unmeasured in steps by construction, so the join can only cover completed rows -- and the rows it therefore excludes are EXACTLY THE ROWS THAT DECIDED THE VERDICT. Attempt 1 recorded passed=3507 with interrupted_before_verdict=2 and completed_over_cost_requirement=1 and refused; attempt 2 recorded passed=3510 with both counters at zero and was clean. 3507 plus 2 plus 1 is 3510: the three rows are precisely the difference between the two attempts, and they are precisely the rows no step measurement can speak about. THE MORE A CLAIM IS AFFECTED, THE LESS MEASURABLE IT BECOMES. So the join establishes that 338 OTHER claims did identical work under a moving envelope -- strong evidence about the envelope, and NO evidence about the three. WHICH IS A CONSTRAINT ON MISSING ITEM (a) AND NOT ONLY ON (b), and it is the first thing this row has been able to say about (a) at all: A STEP-DENOMINATED LINE BUILT ON THIS INSTRUMENT WOULD BE BLIND IN EXACTLY ITS OWN SUBJECT DIRECTION, because the rows that would cross such a line are the rows that carry no step count. Sizing one from the measurable population would produce a threshold that looks principled and is derived from the rows that were never at issue. EVIDENCE GRADES, KEPT SEPARATE AS EVERYWHERE ELSE IN THIS ROW. The two attempt summaries and their arithmetic were read FIRST-HAND from the run at two different times, attempt 1 while it was the only attempt and attempt 2 after the re-run; the 338-row join is taken from its builder with its own disclosed method corrections and was not re-derived here, because the attempt-1 log archive returns a truncated response that will not open. A CITATION TRAP WAS OBSERVED WHILE CHECKING THIS AND IS RECORDED SO THE NEXT READER DOES NOT LOSE AN HOUR TO IT: a bare job id serves the LATEST attempt, so job 100817014187 -- whose own conclusion is failure -- now serves attempt 2 FloorClean summary. An attempt-level citation is the only stable one. AND THE DISPOSITION GETS MORE DEFENSIBLE RATHER THAN LESS: a ceiling whose verdict flips on ONE UNCHANGED TREE between two attempts thirty-six minutes apart is not something a fifth shave of the claim would fix, which is the measured form of the argument that four prior lanes closed on the claim and it fired again. WHAT IS ESTABLISHED PER SAMPLE DIFFERS AND IS NOT FLATTENED: the `claims_failed=0` / `unexpected_failures=0` signature was read from the run logs for six of the seven failures, srv4-11 being the one taken on report rather than read. The distinction is kept because this carrier's own subject is a verdict being attributed to the wrong thing, and a floor job can redden on a phase that is not the floor -- so FAILED and FAILED-WITH-THIS-SIGNATURE are different facts and the row says which it has. A ONE-SUBJECT CROSS-ENVELOPE READING, WHICH BEARS ON MISSING ITEM (b) AND DOES NOT DISCHARGE IT (calm-deer-33, 2026-09-03, verified here rather than relayed). `v2.test.emit.rust_produced_decl_emit.produced_decl_unwired_target_still_refuses` measured 165802 eval_steps at 346 cpu-ms on run 33802603168 and 165802 eval_steps at 514 cpu-ms on run 33806159353 -- the step count IDENTICAL to the digit while cpu moved 1.49x, and the second reading is the one that crossed into completed-over-budget. Log-line controls of 3472 and 3465 rule out an empty capture on either side, which is this repository's standing guard against a zero that reads as a clean sweep. WHY IT IS NOT (b), ON THREE COUNTS, AND THE THIRD IS THE ONE A LATER READER WILL MISS. (i) GRAIN: (b) asks for a join AT CORPUS GRAIN and this is one subject. (ii) SUBJECT: (b) asks for TWO ATTEMPTS OF ONE IDENTICAL TREE, and these are two different trees -- 8b2323f is an ANCESTOR of 07f81df, so the pull request adds commits on top of the main commit it is compared against. (iii) THE WARRANT FOR THE-WORK-DID-NOT-CHANGE CANNOT COME FROM THE STEP COUNT ITSELF: constant steps are read as envelope-independence only if the work is identical on INDEPENDENT grounds, since a measure insensitive to the change produces the same reading. TWO ATTEMPTS OF ONE IDENTICAL TREE supplies that warrant BY CONSTRUCTION, which is why (b) is written that way. ACROSS TWO TREES IT WAS SUPPLIED SEPARATELY AND (iii) IS ANSWERED, by two arguments that do not depend on each other, both re-derived here rather than relayed. FIRST, A SYMBOL-GRAIN JOIN: the whole diff between the compared trees touches three files and adds or removes six declarations -- `absence_classifier_default_bucket`, `green_reported_over_a_population_the_instrument_does_not_own`, `live_03_normalize_data_inits`, `live_03_normalize_facts`, `live_argument_threaded_past_the_arm_that_decides` and `effect_reach_live_03_normalize_witness_derived_host_reading_holds` -- and the module declaring the measured claim, `v2.test.claim.emit.produced_decl_two_target_test`, references none of the six, with a positive control on the same grep finding `tt_emit`, `tt_emits` and `tt_refuses` there. SYMBOL GRAIN RATHER THAN IMPORT CLOSURE IS LOAD-BEARING IN THIS SUBSTRATE: names resolve by global uniqueness rather than by import lists, so a name absent from every import list still resolves and an import-closure argument would exclude modules that can still supply a binding. SECOND, AND INDEPENDENT OF WHETHER THAT JOIN IS EXHAUSTIVE: the diff is NET NEGATIVE, 32 insertions against 60 deletions, and the only witness change DELETES a row, so any corpus-scale work effect would push this claim CHEAPER while the observation is 1.49x MORE EXPENSIVE. The move is in the wrong direction for every work-based explanation. A CONSTRAINT ON HOW (b) CAN EVER BE DISCHARGED, WHICH IS A PROPERTY OF THE COLUMN AND NOT OF TONIGHT. An INTERRUPTED row is unmeasured in `eval_steps` BY CONSTRUCTION -- the poll fires before a count exists -- so a corpus-grain identity join over this column has a STRUCTURALLY EXCLUDED SUBPOPULATION, and the excluded rows are precisely the expensive ones the join most needs to cover. (b) as worded may therefore not be buildable at full coverage at all. A LATER LANE THAT BUILDS IT OVER COMPLETED ROWS AND REPORTS COVERAGE WILL BE REPORTING OVER A POPULATION IT DOES NOT OWN, which is `gunbc.recurring_failure_mode` `green_reported_over_a_population_the_instrument_does_not_own` -- so the honest discharge of (b) must either state the exclusion as part of its result or reach the interrupted rows by a different measure, and a coverage figure over completed rows alone does not retire this row. WHAT IT DOES ESTABLISH is still an advance on what this row had: the invariance reading was previously grounded at FIXTURE grain and nowhere wider, and this extends it to a live corpus subject under real floor pressure. Recorded as that and not as more. IT WAS MEASURED FORWARD, WHICH IS THE ONLY REASON IT IS RECORDED AT ALL: a prediction that srv1-10 would fail and srv3-10 would pass was registered before either returned, and runs 33794985110 and 33796487867 held it. WHAT IT IS NOT IS AN EXPLANATION. A SLOWER HOST is a hypothesis with no mechanism attached, three passes on one host is a thin denominator, and neither this correlation nor a wider one discharges (i), (ii) or (iii) of the trigger below -- a basis that varies with the machine is exactly what (ii) asks to be rid of, so measuring WHICH machines it varies with sharpens the subject and closes none of it. NOT PROPOSED HERE, AND THE DISTINCTION IS THE SAME ONE THIS ROW HAS MADE THROUGHOUT: raising the 500 line would change which rows cross and would not make the crossing a property of the claim, so it does not retire this row and is not requested.
@@ -204,10 +220,18 @@ CI — **RUNG DROP, DECLARED (2026-08-15, the floor cut).** WHAT WAS HERE: one c
 
 **NO REQUIRED LANE COMPARES A SECOND GENERATION AGAINST THE FIRST, AND THIS ROW DECLARES THAT RUNG (2026-09-03).** Split out of `floor_cut`, which named this loss in prose on 2026-08-15 and then enumerated five siblings that do not include it. PREVIOUS RUNG: 2 (mechanically preventable) -- a required run compared a second emit against the first and refused a difference. TEMPORARY RUNG: 1 (mitigatable): the capability survives as `v1_compiler` `--required-regen-fixed-point`, which has an entry point and no required consumer, so a non-deterministic emitter is caught only when a human runs it. REASON: the 2026-08-15 floor cut ended the enrolment of three capabilities at once -- second-generation agreement and the two behavioral-receipt instrument targets -- and `floor_cut` records that no workflow invokes them. The three are counted together and are not one kind: second-generation agreement is NOT itself a behavioral-receipt target, and an earlier revision of this row said it was. WHY IT IS NOT COVERED BY THE REGEN PHASE THAT DOES RUN: `RequiredCiPhase::Regen` adjudicates the committed mirrors against what the authority emits ONCE -- byte agreement between two artifacts -- which is a different question from whether a SECOND generation from the same authority transaction agrees with the referenced first. The receipt model already separates those two as different variants, and this row is scoped to the second. **WHAT THIS PHASE DOES NOT DETECT, CORRECTED 2026-09-03 AND KEPT RATHER THAN QUIETLY DELETED (bright-ram-778 on gunbc#10154).** An earlier revision of this row claimed that an emitter wrong the same way twice satisfies the phase that runs and fails the one that does not. THAT IS FALSE, and it is false in the direction that inflates the missing capability: if both generations produce the same wrong bytes W, the one-shot committed comparison may pass when the committed bytes are W, and the second-generation comparison passes too, because W equals W. A repeatability comparison cannot see deterministic semantic wrongness; the only thing it sees is a GENERATION DISAGREEMENT. Naming the property correctly narrows what this row is owed, which is the point of stating it: the missing capability is agreement between generations, not correctness of either one. BOUNDED POPULATION, WIDENED 2026-09-04 AND ENUMERATED RATHER THAN OBSERVED: one capability -- refusal of a non-deterministic emit on the merge path -- over EVERY REQUIRED PHASE THAT REGENERATES A COMMITTED POPULATION, which is TWO of the five the roster declares. The enumeration is the point and is recorded so a later reader can re-run it rather than trust it: gunbc.required_ci_phase_roster declares parse, namespace-wave-admission, regen, generated-artifact and floor; the discriminator is whether the phase holds a committed artifact population it regenerates, not whether it writes files. REGEN qualifies (src/v1/stage0/src/required_regen_host.rs reaches emitted_population, whose list carries 157 mirror paths). GENERATED-ARTIFACT qualifies (its population is gunbc.generated_artifact_registry committed_generated_artifacts, 38 paths, of which 4 are seed mirrors under src/v1/stage0/src). PARSE and NAMESPACE-WAVE-ADMISSION hold no such population and emit nothing (namespace_wave_admission.rs performs zero file writes). FLOOR DOES WRITE FILES AND IS STILL OUT: they are run receipts, not a regeneration of a committed baseline, and the phase holds no committed artifact population at all -- which is exactly why 'writes files' is the wrong discriminator and 'regenerates a committed population' is the right one. HOW MANY FILES FLOOR WRITES IS DELIBERATELY NOT STATED HERE. Three independent readings disagreed on it within one review -- uploaded artifact names in the emitted workflow, fs::write sites in cli_run/required_floor_runner.rs, and a real run's artifact set -- because they measure three different populations, and the number is not what excludes floor. Transcribing any of them would put a stale count in the one sentence whose whole purpose is that the count does not decide. The instrument is the runner and the emitted workflow; re-derive it there if a count is ever needed. THE EARLIER POPULATION NAMED NEITHER PHASE, and that is the defect this widening repairs rather than a restatement: a lane restoring second-generation agreement for REGEN ALONE would have discharged the trigger while the generated-artifact phase's 38 stayed unguarded -- a trigger naming less than the capability it restores, satisfied while the capability stays dead for part of its subject, which is the failure DESIGN 4b(3) names in terms. RESTORATION TRIGGER, A CAPABILITY AND DELIBERATELY NOT A LIST OF PHASES: a required lane producing a second generation from the same authority transaction and REFUSING a byte difference against the referenced first generation, FOR EVERY PHASE THAT REGENERATES A COMMITTED POPULATION -- stated as the property so that adding a sixth such phase and skipping it does not satisfy this row, which enumerating today's two would have allowed. SUFFICIENT FOR a merge whose emitter disagrees with itself across two generations being refused, demonstrated by a red on a fixture that produces generation_1 != generation_2 UNDER THE EXACT EXECUTION MODEL THE RESTORED PHASE USES -- a fixture that is unstable only under some other harness establishes nothing about this phase. THE BOUND ON WHAT THAT RED ESTABLISHES, stated so the row is not later cited past it: one two-generation experiment shows the phase catches the generation-instability class it deliberately exercises. It does NOT show that every nondeterministic emitter is rejected, and this row must not be read as claiming it. Restoring the flag's invocation without that red does not discharge it: the flag already exists and its existence is what this row records as insufficient. **`floor_cut` CANNOT RETIRE WHILE THIS ROW STANDS.** **AMENDED 2026-10-04 BY OPERATOR RULING (paraphrased: the regen need not run multiple times, and v1 determinism is no longer a concern).** Between 2026-09-23 and 2026-10-04 the stage0 mirror half of this capability WAS enrolled, as the `regen-fixed-point` phase of the build lane (a same-binary second emit compared against the first generation's receipt); the registry-projection half never was, so this row stood throughout. The ruling deletes that phase AND the `--required-regen-fixed-point` mode behind it, so nothing now detects a nondeterministic v1 emitter on any path. That is not a lower rung -- the ladder has none below mitigatable -- it is a scope decision: BY OPERATOR RULING 2026-10-04, v1 SEED-EMIT NONDETERMINISM IS OUTSIDE THE MODELED GUARANTEE. REASON: the second generation cost a whole-closure emit on every required run and on every author regen while v1 is frozen-semantics seed maintenance, and the operator judged determinism of that seed not worth the price. RESTORATION TRIGGER: an operator ruling that re-requires v1 emit determinism, at which point this row's original trigger above applies unchanged. A waiver of DETERMINISM only: CONVERGENCE (the committed mirrors equal one emission by the seed built from them) stays enforced by the generated-artifact phase. The row is NOT retired -- its trigger has not fired, and a ruling that the capability is not owed is not that trigger.
 
+### new-witness eval-step cost gate over the kotlin and rust extended-function grammar parse claims (test.claim.parse_test_kotlin_grammar, test.claim.parse_test_rust_grammar): they still execute, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered — declared 2026-10-05
+
+new-witness eval-step cost gate over the kotlin and rust extended-function grammar parse claims (test.claim.parse_test_kotlin_grammar, test.claim.parse_test_rust_grammar): they still execute, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: honest per-token parse cost of the interpreted parser over a foreign grammar; owner: grammar program (stern-bear-500)). Population: test.claim.parse_test_kotlin_grammar.claim_kotlin_extended_function_parses_holds: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_foreign_grammar_extended_parse_rows; measured by v2.test.parse census phase 4, claim_batch BuildBuddy invocations 2c8f9d0b and 9241511f on main of 2026-10-05 plus this change: verdict pass, the claim's own marginal over the new-witness budget even with its grammar preparation billed apart; re-derived by claim_batch --source-root dag --source-root src/v2 --entry src/v2/test/claim/parse/parse_test_kotlin_grammar_test.dag --functions claim_kotlin_extended_function_parses_holds. The billed work is one tokenize and one real parse of an extended function with the language's own grammar, test.claim.parse_test_rust_grammar.claim_rust_extended_function_parses_holds: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_foreign_grammar_extended_parse_rows; measured by v2.test.parse census phase 4, claim_batch BuildBuddy invocations 2c8f9d0b and 9241511f on main of 2026-10-05 plus this change: verdict pass, the claim's own marginal over the new-witness budget even with its grammar preparation billed apart; re-derived by claim_batch --source-root dag --source-root src/v2 --entry src/v2/test/claim/parse/parse_test_rust_grammar_test.dag --functions claim_rust_extended_function_parses_holds. The billed work is one tokenize and one real parse of an extended function with the language's own grammar. Restored when: THE CAPABILITY: a precedence-climbing tree contract (one node per operator application, not one per level), or parse claims evaluated on the native route -- the capability gunbc.rung_drop dag_text_round_trip_nested_bind_new_witness_eval_step_cost names. WHAT IT MUST BE SUFFICIENT FOR: both identities, still tokenizing and parsing their extended-function source once through their own language's grammar, measuring under the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives. Deleting an identity, shrinking its source below the constructs its claim names, supplying its tokens or parse, or bundling it into a shared producer does not satisfy this trigger.
+
 ### native G0 path records sole_constructor as a type-item property, the way v1 parsed_sole_constructor_properties does — declared 2026-09-18
 
 native G0 path records sole_constructor as a type-item property, the way v1 parsed_sole_constructor_properties does: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: v2 parse mints the sole_constructor property from the captured modifier terminal). Population: v2.compiler.body_lowering_fold body_lower_type_decl_declared_modifiers — the slot is CARRIED (NormalizedTree type_declaration_modifiers) but no stage checks construction against it, native emit of type decls that carry sole_constructor — the construction property is not minted. Restored when: v2 parse mints the sole_constructor property from the captured modifier terminal on a type decl, sufficient for the construction wall v1 parsed_sole_constructor_properties enforces. Consuming the token without minting that property does not retire this row. Token consumption of nominal_opaque matches v1 and is not this drop.
 
+### the mtcollins1 boot handoff no longer requires an established KVM observer; it requires this run's SOL observation instead, and the KVM screen still is recorded as not observed — declared 2026-10-06
+
+the mtcollins1 boot handoff no longer requires an established KVM observer; it requires this run's SOL observation instead, and the KVM screen still is recorded as not observed: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: gunbc.machine_intake_mtcollins1_boot_run sol_handoff_admission, a typed admission over the run-bound SolHeldAt of mtcollins1_sol_supervised, refusing the handoff without it). Population: the mtcollins1 boot handoff only (gunbc.machine_intake_mtcollins1_boot_run mtcollins1_boot_actuate), for as long as no public non-vendor KVM client exists. Restored when: THE CAPABILITY: a public, non-vendor KVM client that ESTABLISHES the observer, meaning it logs in to the controller, holds one seat, and journals an established line bound to the BMC host and the attempt, readable through kvm_observer_standing_now. WHAT THAT MUST BE SUFFICIENT FOR: restoring kvm_handoff_admission as a second required precondition of the mtcollins1 handoff beside the SOL admission, with the established-or-refuse control already enrolled in test.claim.machine_intake.megarac_kvm_still_witness_test. The existence of some KVM client, or of a client that cannot establish the observer, does not satisfy this.
+
 ### the harness seat pool ceiling per serving group: an operator-chosen count standing where a derivation from the engine's resolved KV layout belongs — declared 2026-09-06
 
 the harness seat pool ceiling per serving group: an operator-chosen count standing where a derivation from the engine's resolved KV layout belongs: RUNG DROP, mechanically preventable -> mitigatable (deleted without replacement). Population: gunbc.harness.harness_seat harness_interactive_quality_seats (the ceiling standing where a derived one belongs. It was the operator's interim count 3 when this row was declared; on 2026-09-07 it became 1 and changed KIND, from a guess at capacity to a product decision about interactive quality following the measured co-tenancy degradation. The drop is unchanged by that: capacity is still underived, and a quality ceiling that happens to sit below any real capacity is not a derivation of it), gunbc.harness.harness_seat harness_seat_capacity (the SeatCeilingByDeclaredPolicy arm, which is the only arm that currently yields a pool for a serving route), gunbc.serving.serving_enrollment serving_pair_route_turn_ceiling (added 2026-09-11 with the co-tenancy class split: the quality-tolerant pool's ceiling on the pair route, a manager-attributed allocation of 4 standing where a derivation belongs. It is a SECOND underived ceiling and is declared here rather than beside the first, because the same restoration discharges both -- a resolved-layout receipt bound to a live incarnation sizes every class's pool. It is NOT the whole wall for that class: admission takes the minimum of this ceiling and the route's own capacity-reason queue, so the route can refuse under it at any moment, which is why the temporary rung is unchanged rather than lowered again), gunbc.serving.serving_enrollment serving_group_b_route_turn_ceiling (group B's arm of the same question, a session-attributed allocation of 4 standing where a derivation belongs. It replaced serving_canary_route_ceiling on 2026-09-18, which delegated to the retired exl3 canary's operator bound; it is deliberately NOT the converged arm's --max-num-seqs, which is what the engine schedules rather than what this repository offers). Restored when: a seat lease is granted only against a resolved KV layout read back from the engine incarnation that will serve the request: the layout receipt names allocator inventory, per-group block sizes, windows and the engine's own startup projections, it is bound to a live incarnation identity so a restart invalidates every prior grant, and the amount leased is the block cost of the admitted sequence envelope computed from the whole group layout rather than any single field. A layout observation that is not incarnation-bound does not discharge this row, because an unbound receipt lets a grant taken against one launch authorize a request against another.
@@ -224,6 +248,10 @@ v2.compiler.infer inferred_facts_map_enter: a facts key carrying two different f
 
 the seed interpreter's purity routing decision for a named call (fn_node.uses.is_empty() in v1_interpreter), which reads the authored uses requirement alone while every other consumer reads derived demand OR authored: RUNG DROP, mechanically preventable -> mitigatable (lost as a passenger of the authored uses rows that restate derived service demand, deleted by D13 cut (c); the gate's agreement with the demand carrier rode on their presence, and the deletion census accounts for the rows, not for the gate that read them). Population: interpreted calls to a function whose effects are derived from its body (it reaches a service operation) and which carries no authored uses row after cut (c). Restored when: the interpreter's purity decision agrees with the D13 demand carrier for every function WITHOUT the effect-dispatch guard carrying correctness -- sufficient that deleting that guard could not route an effectful call into a memo. Any one of three capabilities discharges it: (1) the call gate reads derived demand by callee IDENTITY (owning module plus declaration, against the identity-keyed registry), never by a leaf-keyed name; (2) the interpreter consumes the bound-handler interface of D11/D13, so effectfulness is a property of the handler it is handed rather than a row it reads; or (3) D10 removes the interpreter from the production route, demoting it to an offline oracle whose memo routing no production answer depends on. Widening the gate to the leaf-keyed name lookup does NOT discharge it.
 
+### the real-execution witnesses of the deleted mtcollins1 KVM observer's protocol and process supervision no longer execute on any lane — declared 2026-10-09
+
+the real-execution witnesses of the deleted mtcollins1 KVM observer's protocol and process supervision no longer execute on any lane: RUNG DROP, mechanically preventable -> mitigatable (deleted without replacement). Population: THE 14 CLAIMS, by id, all of test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness, deleted with the observer and never replaced one-for-one, WITH A SURVIVING WET COUNTERPART in test.claim.machine_intake.sol_hold_stdin_wet_witness (4 of 14, each a process-supervision claim): a_launch_that_cannot_publish_its_pid_stops_its_child -> a_launch_that_cannot_publish_its_pid_stops_the_child_it_created; a_term_ignoring_child_with_an_unpublished_record_is_observed_stopped -> a_publication_failure_stops_even_a_term_ignoring_child; a_record_naming_another_process_is_foreign_and_not_released -> a_record_this_attempt_did_not_establish_is_not_released; an_owned_process_is_released_and_observed_gone -> our_collector_is_released_observed_gone_and_its_record_retired, WITH NO COUNTERPART, process supervision (2 of 14): an_unreadable_process_state_never_skips_the_kill_of_an_unpublished_child (unreadable process state); a_relative_observer_directory_is_resolved_once (observer directory), WITH NO COUNTERPART, viewer and protocol specific (8 of 14): a_held_observer_is_admitted_and_its_triggered_still_is_hash_bound; a_root_page_that_navigates_cannot_destroy_the_login; a_viewer_without_its_feature_list_never_opens_kvm; a_busy_viewer_slot_refuses_the_observer_and_the_handoff; a_connection_lost_mid_boot_is_reported_and_no_still_is_claimed_after_it; an_unreadable_canvas_is_acquisition_failed_with_the_browsers_words; a_stale_listening_line_from_another_pid_is_not_readiness; a_transport_that_exits_at_once_is_not_serving. Restored when: THE CAPABILITY: a public, non-vendor KVM client that ESTABLISHES the observer (the same capability named by gunbc.rung_drop handoff_observer_is_sol_not_kvm_viewer), AND a real-execution protocol witness for it enrolled on v2.workflow.local_repo_wet_terminal local_repo_wet_schedule that covers the 10 claims above with no counterpart (the 8 viewer and protocol claims and the 2 process-supervision claims with none). WHAT IT MUST BE SUFFICIENT FOR: each of those 10 behaviours executed against a real process and real transport, so that deleting the client or its supervision makes a control fail. A client without such a wet witness, a hermetic-only witness, or a witness not on local_repo_wet_schedule does not satisfy this. The 4 claims with a counterpart are covered meanwhile by sol_hold_stdin_wet_witness for the supervision they share, not for the viewer.
+
 ### Corpus-wide lens enforcement censuses — declared 2026-08-11
 
 **The corpus-wide backstops that used to police this are DELETED (2026-08-11), and the reason is the rule that replaces them:** the inert-lens reach census and the construction-justification census both ran inside floor witness discovery, so *every* discovery run — on every PR, on regen, in every coordinated worker — had to acquire a whole-corpus module graph in order to answer a question about who authored a lens. That is the §6 cost-shape defect at its purest: the unit of computation was the world, the unit of fact was one module's authorship, and the price was paid by every consumer that wanted a witness roster and nothing else. **Who paid it, split by era, because this document must not assert a superseded population as the present one:** before #8140 the walk was unconditional, so ordinary CI, regen, the falsifier cadence and every coordinated worker all paid; #8140 made it demand-directed, so a discovery-free plan such as regen stopped paying; from #8140 to this deletion the two censuses burdened every remaining discovery-bearing execution. The correction is recorded rather than reworded because a change deleting stale supply-side enforcement must not land a fresh stale assertion in the same diff (review on #8141). Neither census had a consumer that justified the acquisition; the inert-lens half additionally reported through two host builtins whose `.dag` surface was a pair of self-recursive stubs (`fn f() { f() }`) reachable only because the interpreter intercepted them. **What is NOT claimed:** this is a real scope narrowing, not a climb. A newly authored lens with no witness, and a lens recording no `construction_justification`, are both writable again and nothing detects either. The obligation survives as review diligence, which is strictly weaker. **THAT NEXT-RUNG TRIGGER HAS NOW FIRED FOR THE CONSTRUCTION-JUSTIFICATION HALF (2026-08-25), AND ONLY FOR THAT HALF.** The trigger read: an authorship fact belongs on the module's own declaration, checked at ingestion where the module is parsed anyway — one module's facts from one module's source — rather than reconstructed corpus-wide by a consumer that wanted something else. `v1_compiler.declaration_index` is that construction. The `.dag` parse sweep inside `claim_executor --required-ci` already parses every authored module once, on every required run, and discarded the tree; it now derives one record per module from that same parse, and the presence of `construction_justification` on a top-level lens is read off the lens's own declaration list. The class moves from *mitigatable* to *mechanically preventable*: measured at the landing, 71 top-level lens modules, all 71 carrying it, and the RED is authorable — and authored — at the FIXTURE boundary rather than only over the corpus, which is what §4b requires of a check that is green everywhere it can currently run. **THE INERT-LENS HALF DID NOT CLIMB AND IS NOT CLAIMED TO HAVE**, for a reason this clause already stated when it named the trigger: whether a lens has a discovered witness is not a single-module fact, so no ingestion-time reader can answer it from one module's source. That half stays at *mitigatable*, on review diligence, and its own next rung is a different construction. **AND THE HAND-RUST HALF OF THE TRIGGER STAYS OPEN**: the index is host Rust reading the filesystem, not a modeled ingestion operation, so what discharged here is the CORPUS-WALK half — the obligation is declared, enumerated at declaration grain, and carries its dissolution trigger in `gunbc.declaration_index_seed_growth`.
@@ -292,11 +320,11 @@ the mtcollins1 boot qualification accepts a boot on which only socket 0's 80 har
 
 ### the enrolment-margin decision over the mtcollins1 boot acceptance matrix cases whose honest CPU lies in (margin, per-subject line]: they execute, and an exact reading inside the band is reported rather than decided — declared 2026-09-30
 
-the enrolment-margin decision over the mtcollins1 boot acceptance matrix cases whose honest CPU lies in (margin, per-subject line]: they execute, and an exact reading inside the band is reported rather than decided: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the matrix cases executing as natively emitted witnesses, the same replacement the eval-step drop mtcollins1_boot_matrix_new_witness_eval_step_cost waits on). Population: test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_host_that_never_prints_a_census_refuses_at_the_deadline: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 449 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_healthy_census_completes_and_releases_its_collector: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 433 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_the_handoff_is_the_reported_cause: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 421 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_already_presented_image_is_not_attached_again: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 411 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_two_socket_answer_is_a_truthful_topology_refusal: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 374 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_sol_loss_mid_boot_is_reported_before_the_deadline: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 381 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_stale_lane_image_with_a_code_the_stop_clears_is_replaced_and_booted: the real boot entry end to end over the dry realization through a stop, a replace and a full boot, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 473 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_readiness_stops_the_handoff: the real boot entry end to end over the dry realization up to the handoff gate, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it straddles the margin between runners at identical eval_steps -- PR required floor run 36775473983 of gunbc#12800 at b907f7dc0c3 (srv3) observed 303 ms CPU, strictly above the 302 ms margin and under the 500 ms line, and run 36765162766 at 6cac35eb1a6 (srv1) observed 287 ms, inside the runner envelope below the margin (EnrolmentDeadBandWithinRunnerEnvelope), test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_mount_error_refuses_by_name: the real boot entry end to end over the dry realization through an accepted start whose row falls back to Stopped and the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it sits at the margin as media_that_never_becomes_ready_refuses_before_any_power_action does -- PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 288 ms CPU, inside the runner envelope below the 302 ms margin (EnrolmentDeadBandWithinRunnerEnvelope), and a slower runner reads it above, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_device_ejected_refuses_by_name_as_no_fault: the real boot entry end to end over the dry realization through an accepted start whose row falls back to Stopped and the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it sits at the margin as media_that_never_becomes_ready_refuses_before_any_power_action does -- PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 291 ms CPU, inside the runner envelope below the 302 ms margin (EnrolmentDeadBandWithinRunnerEnvelope), and a slower runner reads it above, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.media_that_never_becomes_ready_refuses_before_any_power_action: the real boot entry end to end over the dry realization through the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it straddles the margin between runners at identical eval_steps -- PR required floor run 36783312538 of gunbc#12800 at 8042d175c2a (srv3) observed 320 ms CPU, strictly above the 302 ms margin and under the 500 ms line, and run 36765162766 at 6cac35eb1a6 (srv1) observed 283 ms, inside the runner envelope below the margin (EnrolmentDeadBandWithinRunnerEnvelope). Restored when: THE CAPABILITY: witnesses emitted to native code with the emitted runtime realizing v2.std.witness_evaluation evaluate_in_witness_frame and its v2.std.operation_realization modeled realization, EXECUTING ON THE MERGE PATH as a phase of a required lane whose red blocks a merge, running the mtcollins1 boot acceptance matrix with the real mtcollins1_boot_wet_on_srv1 entry; WHAT THAT MUST BE SUFFICIENT FOR: each dead-band identity reaches its verdict with stable headroom under the enrolment margin v2.workflow.floor_enrolment_margin derives, with its route and outcome assertions unchanged -- at which point every row stales and deletes. Cutting the polling route the cases assert, or supplying a decided value in place of the entry, satisfies neither.
+the enrolment-margin decision over the mtcollins1 boot acceptance matrix cases whose honest CPU lies in (margin, per-subject line]: they execute, and an exact reading inside the band is reported rather than decided: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the matrix cases executing as natively emitted witnesses, the same replacement the eval-step drop mtcollins1_boot_matrix_new_witness_eval_step_cost waits on). Population: test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_host_that_never_prints_a_census_refuses_at_the_deadline: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 449 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_healthy_census_completes_and_releases_its_collector: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 433 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_the_handoff_is_the_reported_cause: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 421 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_already_presented_image_is_not_attached_again: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 411 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_two_socket_answer_is_a_truthful_topology_refusal: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 374 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_sol_loss_mid_boot_is_reported_before_the_deadline: the real boot entry end to end over the dry realization, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 381 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_stale_lane_image_with_a_code_the_stop_clears_is_replaced_and_booted: the real boot entry end to end over the dry realization through a stop, a replace and a full boot, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) observed 473 ms CPU, strictly above the 302 ms margin and under the 500 ms line, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_readiness_stops_the_handoff: the real boot entry end to end over the dry realization up to the handoff gate, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it straddles the margin between runners at identical eval_steps -- PR required floor run 36775473983 of gunbc#12800 at b907f7dc0c3 (srv3) observed 303 ms CPU, strictly above the 302 ms margin and under the 500 ms line, and run 36765162766 at 6cac35eb1a6 (srv1) observed 287 ms, inside the runner envelope below the margin (EnrolmentDeadBandWithinRunnerEnvelope), test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_mount_error_refuses_by_name: the real boot entry end to end over the dry realization through an accepted start whose row falls back to Stopped and the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it sits at the margin as media_that_never_becomes_ready_refuses_before_any_power_action does -- PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 288 ms CPU, inside the runner envelope below the 302 ms margin (EnrolmentDeadBandWithinRunnerEnvelope), and a slower runner reads it above, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.media_that_never_becomes_ready_refuses_before_any_power_action: the real boot entry end to end over the dry realization through the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it straddles the margin between runners at identical eval_steps -- PR required floor run 36783312538 of gunbc#12800 at 8042d175c2a (srv3) observed 320 ms CPU, strictly above the 302 ms margin and under the 500 ms line, and run 36765162766 at 6cac35eb1a6 (srv1) observed 283 ms, inside the runner envelope below the margin (EnrolmentDeadBandWithinRunnerEnvelope). Restored when: THE CAPABILITY: witnesses emitted to native code with the emitted runtime realizing v2.std.witness_evaluation evaluate_in_witness_frame and its v2.std.operation_realization modeled realization, EXECUTING ON THE MERGE PATH as a phase of a required lane whose red blocks a merge, running the mtcollins1 boot acceptance matrix with the real mtcollins1_boot_wet_on_srv1 entry; WHAT THAT MUST BE SUFFICIENT FOR: each dead-band identity reaches its verdict with stable headroom under the enrolment margin v2.workflow.floor_enrolment_margin derives, with its route and outcome assertions unchanged -- at which point every row stales and deletes. Cutting the polling route the cases assert, or supplying a decided value in place of the entry, satisfies neither.
 
 ### new-witness eval-step cost gate over the mtcollins1 boot acceptance matrix cases that run the real boot entry end to end over the dry operation realization: they still execute, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered — declared 2026-09-28
 
-new-witness eval-step cost gate over the mtcollins1 boot acceptance matrix cases that run the real boot entry end to end over the dry operation realization: they still execute, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the evaluation frame and its modeled operation realization realized by the natively emitted runtime, so the boot entry runs as emitted code rather than in the seed interpreter). Population: test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_host_that_never_prints_a_census_refuses_at_the_deadline: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=248288 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_healthy_census_completes_and_releases_its_collector: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=237233 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_already_presented_image_is_not_attached_again: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=215502 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.media_that_never_becomes_ready_refuses_before_any_power_action: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=140940 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_readiness_stops_the_handoff: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=146038 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_the_handoff_is_the_reported_cause: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=204469 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_sol_loss_mid_boot_is_reported_before_the_deadline: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=202126 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_two_socket_answer_is_a_truthful_topology_refusal: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=194599 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_listing_that_names_the_image_twice_starts_nothing: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=122748 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.the_right_filename_on_the_wrong_share_refuses_before_any_power_action: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=116804 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_interrupted_attempts_dead_hold_is_recovered_by_the_next_one: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=276996 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_live_holder_still_blocks_the_next_attempt: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=102436 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_unobservable_holder_is_refused_not_recovered: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=102525 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_successor_in_another_pid_namespace_refuses_rather_than_recovering: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=102114 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_stale_lane_image_with_a_code_the_stop_clears_is_replaced_and_booted: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=262400 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.cd_error_appearing_with_readiness_is_recorded_and_booted: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=255253 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through readiness and a full boot, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_stale_lane_image_with_a_code_the_stop_does_not_clear_is_replaced_and_booted: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=250207 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through a stop of a stale image, a replace and a full boot, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.cd_error_16_with_nothing_presented_attaches_and_boots_with_the_code_recorded: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=242216 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through readiness and a full boot, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_wall_clock_stepping_back_during_readiness_refuses_as_unbounded: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=138564 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_wall_clock_jumping_forward_during_readiness_closes_the_window: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=137976 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_uncatalogued_cd_error_with_the_host_on_writes_nothing: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=137261 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, up to the pre-write refusal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_mount_error_refuses_by_name: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=162614 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through an accepted start whose row falls back to Stopped, up to the readiness refusal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_device_ejected_refuses_by_name_as_no_fault: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=161874 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through an accepted start whose row falls back to Stopped, up to the readiness refusal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_foreign_presented_image_is_not_stopped: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=118325 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_toolchain_that_is_not_ready_starts_no_observer_and_no_power_action: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=112482 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_unresolved_toolchain_starts_no_observer_and_no_power_action: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by claim_batch --entry dag/test/claim/machine_intake/mtcollins1_boot_acceptance_matrix_test.dag --functions an_unresolved_toolchain_starts_no_observer_and_no_power_action, over gunbc#12800 at 6cac35eb1a6, 2026-09-30: PASS, eval_steps=102990 against the 72,300 new-witness budget (eval_steps are host-independent; PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) printed no eval-step line for it before its cancel); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, up to the handoff gate's refusal. Restored when: THE CAPABILITY: witnesses emitted to native code with the emitted runtime realizing v2.std.witness_evaluation evaluate_in_witness_frame and its v2.std.operation_realization modeled realization, EXECUTING ON THE MERGE PATH as a phase of a required lane whose red blocks a merge, running the mtcollins1 boot acceptance matrix with the real mtcollins1_boot_wet_on_srv1 entry; WHAT THAT MUST BE SUFFICIENT FOR: each of these identities measures under the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives, with its route and outcome assertions unchanged. Hoisting the shared world construction or the route prefix lowers the bill and retires nothing on its own; supplying a decided value in place of the entry, or deleting the identities, satisfies neither.
+new-witness eval-step cost gate over the mtcollins1 boot acceptance matrix cases that run the real boot entry end to end over the dry operation realization: they still execute, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the evaluation frame and its modeled operation realization realized by the natively emitted runtime, so the boot entry runs as emitted code rather than in the seed interpreter). Population: test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_host_that_never_prints_a_census_refuses_at_the_deadline: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=248288 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_healthy_census_completes_and_releases_its_collector: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=237233 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_already_presented_image_is_not_attached_again: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=215502 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.media_that_never_becomes_ready_refuses_before_any_power_action: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=140940 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_readiness_stops_the_handoff: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=146038 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_presentation_lost_after_the_handoff_is_the_reported_cause: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=204469 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_sol_loss_mid_boot_is_reported_before_the_deadline: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=202126 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_two_socket_answer_is_a_truthful_topology_refusal: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=194599 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_listing_that_names_the_image_twice_starts_nothing: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=122748 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.the_right_filename_on_the_wrong_share_refuses_before_any_power_action: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=116804 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_interrupted_attempts_dead_hold_is_recovered_by_the_next_one: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=276996 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_live_holder_still_blocks_the_next_attempt: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=102436 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_unobservable_holder_is_refused_not_recovered: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=102525 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_successor_in_another_pid_namespace_refuses_rather_than_recovering: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=102114 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_stale_lane_image_with_a_code_the_stop_clears_is_replaced_and_booted: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=262400 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.cd_error_appearing_with_readiness_is_recorded_and_booted: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=255253 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through readiness and a full boot, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_stale_lane_image_with_a_code_the_stop_does_not_clear_is_replaced_and_booted: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=250207 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through a stop of a stale image, a replace and a full boot, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.cd_error_16_with_nothing_presented_attaches_and_boots_with_the_code_recorded: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=242216 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through readiness and a full boot, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_wall_clock_stepping_back_during_readiness_refuses_as_unbounded: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=138564 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_wall_clock_jumping_forward_during_readiness_closes_the_window: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=137976 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_uncatalogued_cd_error_with_the_host_on_writes_nothing: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=137261 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, up to the pre-write refusal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_mount_error_refuses_by_name: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=162614 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through an accepted start whose row falls back to Stopped, up to the readiness refusal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_code_16_refuses_as_a_timeout_carrying_the_raw_code: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=161874 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through an accepted start whose row falls back to Stopped, up to the readiness refusal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_foreign_presented_image_is_not_stopped: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=118325 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_toolchain_that_is_not_ready_starts_no_observer_and_no_power_action: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=112482 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, now including the dry KVM observer's launch and journal, test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.an_unresolved_toolchain_starts_no_observer_and_no_power_action: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_boot_matrix_rows; measured by claim_batch --entry dag/test/claim/machine_intake/mtcollins1_boot_acceptance_matrix_test.dag --functions an_unresolved_toolchain_starts_no_observer_and_no_power_action, over gunbc#12800 at 6cac35eb1a6, 2026-09-30: PASS, eval_steps=102990 against the 72,300 new-witness budget (eval_steps are host-independent; PR required floor run 36765162766 of gunbc#12800 at 6cac35eb1a6 (job floor, cancelled after adjudication) printed no eval-step line for it before its cancel); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, up to the handoff gate's refusal. Restored when: THE CAPABILITY: witnesses emitted to native code with the emitted runtime realizing v2.std.witness_evaluation evaluate_in_witness_frame and its v2.std.operation_realization modeled realization, EXECUTING ON THE MERGE PATH as a phase of a required lane whose red blocks a merge, running the mtcollins1 boot acceptance matrix with the real mtcollins1_boot_wet_on_srv1 entry; WHAT THAT MUST BE SUFFICIENT FOR: each of these identities measures under the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives, with its route and outcome assertions unchanged. Hoisting the shared world construction or the route prefix lowers the bill and retires nothing on its own; supplying a decided value in place of the entry, or deleting the identities, satisfies neither.
 
 ### Consumed-row deletion obligation on the namespace transition-admission roster — declared 2026-09-02 · RETIRED
 
@@ -330,7 +358,9 @@ The native lane's live-verdict control pair as a required admission clause: RUNG
 
 single authority over the `module` and `import` productions, for the route's universe derivation: RUNG DROP, structurally guaranteed -> mitigatable (replacement staged: the closure computed from the front end's own import edges after a cheap parse of the seed set). Population: v2.compiler.compile native_lane_declared_module_name — the textual reading of the `module` production, v2.compiler.compile native_lane_declared_imports — the textual reading of the `import` production, v2.compiler.compile native_lane_first_malformed_import — the refusal arm that exists because the scan can misread a line, v2.compiler.compile native_lane_source_facts — their one consumer, which carries both readings onto every facts row. Restored when: The route derives the universe's import closure from the FRONT END'S OWN IMPORT EDGES, after a parse of the seed set that yields those edges WITHOUT preparing each module. That capability must be sufficient for the whole derivation -- module identity and import identity both -- so that native_lane_declared_module_name and native_lane_declared_imports are DELETED rather than retained beside the grammar. A parse that yields edges only after preparation does not retire this row: preparation is the cost the scans exist to avoid, so satisfying the sentence that way would leave the second reading standing.
 
-### the per-request evaluation budget on a NativeServeDriver service (std.compiler_entry NativeServeDriver, gunbc.native_serve): a compiled handler that does not return holds the serial loop — declared 2026-10-03
+### the per-request evaluation budget on a NativeServeDriver service (std.compiler_entry NativeServeDriver, gunbc.native_serve): a compiled handler that does not return holds the serial loop — declared 2026-10-03 · RETIRED
+
+**RETIRED — TRIGGER FIRED.** 2026-10-08 -- gunbc test //gunbc/instruments:native-serve held on main at the gunbc#13219 merge (23 requests, refused launch status 2): the probe's /spin cases observe the typed 500 at the 500ms request deadline for a handler that does not return, a later /hello on the same process answered 200, and past the stuck-worker ceiling the typed 503 and exit 75. The wall is gunbc.native_serve native_serve_admission / native_serve_deadline_refused enforced by the rendered main, built in gunbc#13278
 
 the per-request evaluation budget on a NativeServeDriver service (std.compiler_entry NativeServeDriver, gunbc.native_serve): a compiled handler that does not return holds the serial loop: RUNG DROP, mitigatable -> outside the ladder (replacement staged: a NativeServeDriver budget wall: the native door refuses a non-returning or over-budget compiled request with a typed 500 and keeps serving later requests). Population: every NativeServeDriver service; at declaration gunbc.instruments.native_serve_fixture, the only one. Restored when: a non-returning or over-budget compiled request is refused with a typed 500 and cannot block later requests on the native door. SUFFICIENT FOR: the native-serve instrument carries a case whose handler does not return within the declared budget, observes the typed 500 for it, and observes a later request on the same process answered. A thread pool, a timeout knob, or a supervisor restart that drops the request without a typed answer does not retire this row.
 
@@ -350,6 +380,10 @@ Availability of a resolved-graph disk hit, and Hit/WrongArtifact/WrongContent di
 
 native-route body lowering either lowers a postfix chain step whose suffix is a brace record-literal or an `as` suffix, or refuses it located: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: a construct tag that carries a qualified name, so the one-walk postfix chain door lowers `a.b.C { f: v }` as a construction and an `as` step as its conversion). Population: every module over dag + src/v2 for which v2.compiler.body_lowering_fold emits body_lowering_reason_postfix_suffix_carried: a postfix chain step whose suffix is a brace record-literal (`a.b.C { f: v }`) or an `as` suffix. the population is re-derived, not transcribed: the workload adjudicate over dag + src/v2 (claim_executor --v2-native-route) counts the advisory per module. Restored when: native-route body lowering LOWERS every brace-suffix and `as`-suffix postfix step in dag + src/v2, so that body_lowering_reason_postfix_suffix_carried is emitted for zero modules in the workload adjudicate. Alternatively the door REFUSES those steps located, with no module that accepts on base refusing for any other reason. Changing the construct tag alone does not satisfy this: the trigger is that the population is lowered or refused, not that the carrier exists.
 
+### untrusted CI job code on a per-job-rebuilt provider guest reaching hosts it was not granted (gunbc.runner.runner_isolation_admission DefaultDenyEgress), excused by gunbc.runner.provider_guest_incarnation for the population below — declared 2026-10-09
+
+untrusted CI job code on a per-job-rebuilt provider guest reaching hosts it was not granted (gunbc.runner.runner_isolation_admission DefaultDenyEgress), excused by gunbc.runner.provider_guest_incarnation for the population below: RUNG DROP, mitigatable -> outside the ladder (replacement staged: operator ruling 2026-10-09: a guest rebuilt from the provider's image before every job, so nothing a job leaves behind survives into the next; egress itself is uncontained). Population: gunbc.fleet_host_identity operator_host_183527 (Hetzner Cloud CAX41 169308819, nbg1), gunbc.fleet_host_identity operator_host_3dde7f (Hetzner Cloud CAX41 169308796, hel1). Restored when: egress from these guests is contained BELOW the guest -- at the site's network layer (SDN / VXLAN behind a router the fleet owns) or at the provider's hypervisor -- so a job with root in the guest cannot widen it, and a filtered-egress receipt on one of them records denials and grants each proven by the guest's outcome and the enforcing layer's own counter, as gunbc.runner.runner_filtered_egress_receipt does for the microVM path. SUFFICIENT FOR deleting this row: the provider-rebuild offer lists DefaultDenyEgress as evidenced on that receipt and the excuse is removed from the admission in the same change. NOT satisfied by an nftables ruleset inside the guest.
+
 ### one ProviderPathLocated whose jurisdiction upstream does not document, admitted rather than refused because the path carries no route material, with the unread fact reachable from the cited field and not from the arm -- both by product.fabric.provider_route's resolution fold, which reads it as Located, and by product.fabric.provider_admission TransferOrLocationUnresolved, which cannot compare a non-jurisdiction against a permitted-jurisdiction population — declared 2026-09-11
 
 one ProviderPathLocated whose jurisdiction upstream does not document, admitted rather than refused because the path carries no route material, with the unread fact reachable from the cited field and not from the arm -- both by product.fabric.provider_route's resolution fold, which reads it as Located, and by product.fabric.provider_admission TransferOrLocationUnresolved, which cannot compare a non-jurisdiction against a permitted-jurisdiction population: RUNG DROP, structurally guaranteed -> mitigatable (deleted without replacement). Population: . Restored when: product.fabric.provider_route ProviderPathStanding carries a jurisdiction standing SUFFICIENT FOR a located path to declare its jurisdiction unread without the whole path becoming unread -- so that a consumer matching the located arm can see which of its three components were established -- and gunbc.spark.first_party_serving's telemetry path states the fact in its arm. Reading who operates the usage-stats service does NOT discharge this row: it fills one slot on one route and leaves every other located path with an undocumented counterparty in the same unexpressible position.
@@ -372,7 +406,7 @@ the renderer hop's structural arm (v1.compiler.emit_rust provenance_declares_str
 
 **RUNG DROP, DECLARED (2026-08-29, the CI bankruptcy, operator ruling in session neat-tern-658).** PREVIOUS RUNG: mechanically preventable for every class the required run carried -- eight phases over two lanes, the floor folding every discovered witness (11,996 on the last green run) through a whole-corpus strict preparation, plus v2-emission, emit-compile, partition-crates and generated-artifact drift. TEMPORARY RUNG: mechanically preventable ONLY for what the static gate names -- parse, namespace-wave-admission, regen, generated-artifact drift, and a floor over `v2.workflow.required_floor` `required_gate_prefixes` prepared as that roster's import closure -- and MITIGATABLE for everything else: those witnesses and phases are still runnable (the floor with the gate widened, `claim_executor --required-v2-emission`, `--required-emit-compile`; and -- CORRECTED 2026-08-31, re-verified against main AFTER the generated-artifact partial climb below, because a drop whose stated mitigation cannot be executed is not mitigated but a rung-honesty defect in the drop row itself, and one cited as coverage -- NOT `--required-partition-crates`, which is ABSENT from claim_executor's argument parser: that build is projected by `gunbc.repo.repo_self_build` `repo_self_build_partition_crates_command`. `--required-generated-artifact` is absent from that parser too, and the climb below restores the CHECK without restoring that spelling, so the generated-artifact projection is regenerated through the .dag entry point `tools.generated_artifact_gate` `main_wet_one`, invoked per artifact path via `gunbc run` on a gunbc BUILT FROM SOURCE -- the installed binary predates the section 4c annotation channel and cannot parse the corpus. Both flag spellings went with this cut's deleted phases and the prose naming them was not updated, so this sentence recited two remedies nobody could run) and their receipts are produced only when someone runs them, so a regression there is caught at the next manual run, not at merge. REASON: the last green run was 87 wall minutes (`gh run view 33140387402`), strict preparation alone 27 of them on one core, against ~50 squash-merges a day; main sat red for fifteen consecutive runs on two integration collisions no PR could have seen (#9662), and the CI-cost lane's change-denominated selection did not land in time to prevent it. A gate no merge can wait for validates nothing, which is a lower rung than a small gate that runs. POPULATION: every witness outside the roster (reported per run as `declined_outside_required_gate` in the disposition TSV), the three deleted required phases v2-emission, emit-compile, and partition-crates, and the v1-compiler lib tests that carry the `live-corpus` ignore reason -- enumerated by `cargo test -p v1-compiler --lib -- --ignored --list` -- each of which prepares or builds over the live tree and is run only by the receipts lane; AND -- POPULATION AMENDED 2026-09-02, because this row was cited as coverage for a member it did not name -- every module OUTSIDE THE REQUIRED FLOOR GATE CLOSURE, which no required phase compiles at all: the floor prepares the import closure of `required_gate_prefixes`, not the corpus, so a module that no rostered prefix transitively imports is never checked by any required run, and a green required run has therefore never entailed that the corpus holds the floor. That member is a FOURTH thing the original population sentence did not name -- not a witness outside the roster, not a deleted phase, not an ignored lib test -- while the RESTORATION TRIGGER below already covers it verbatim (the whole corpus as its universe). The omission was a rung-honesty defect in THIS ROW rather than a missing class, so it is amended here instead of filed as a second row: two rows behind one trigger is the same single-authority fork this project rejects in every other subject, and the more dangerous form when the row is quoted as evidence of what CI checks. the first-ever CI run of `cargo test -p v1-compiler --lib` (run 33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, which is how that class was measured into existence. The workflow's two-lane shape, the aggregate context, and the per-claim cost receipt are unchanged, and the drop is countable from that receipt every run. RESTORATION TRIGGER: the CAPABILITY of a required run whose population is DERIVED from the change -- the roadmap's 'decide what matters before paying to prepare everything' -- executing on the required path with the whole corpus as its universe; a widening of the static roster does not retire this row, it only moves the population. Widening the roster is a wall-clock decision priced by the cost receipt and recorded on the roster's own header. GENERATED-ARTIFACT PARTIAL CLIMB (2026-08-31): restoring generated-artifact drift widens the static required roster by one exact class and does NOT retire this drop; the population-derived restoration trigger has not fired. INCIDENT RECEIPT (2026-08-31), recorded because a drop whose population has demonstrably fired ranks differently for restoration than one that never has: the generated-artifact drift member produced a real stale artifact on main -- two correct regens composed a `docs/design-ledgers.md` missing the frontier-receipts projection of `gunbc.self_host_compile_phase_frontier`, with no conflict and no author error -- detected only sideways by an adjacent-diff review question, and bounded to exactly one file by a dispatched whole-population `main_wet` regen on pristine main (repair and measurement: PR #9804). The window between drift landing and detection is the cost this row's REASON accepted, now materialized once. INCIDENT RECEIPT (2026-09-02), recorded on the same principle as the one above -- a population that has demonstrably fired ranks differently for restoration than one that never has: a whole-corpus compile over dag plus src/v2 found 11 NON-EXHAUSTIVE MATCH SITES STANDING ON GREEN MAIN, closed variants that do not eliminate exhaustively, which is the ordinary compiler floor this document names first; every one of them sits in a module the gate closure never compiles, so no required run has ever been able to see them. Measured as the BASELINE arm of the nested-pattern exhaustiveness checker in gunbc#10028 (whose own change additionally exposes a larger population of ordinary floor defects that the OLD checker could not see -- that population is counted by that PR and its repair program, deliberately NOT transcribed here, because a number copied into this row rots the moment the instrument that produced it is re-run; it is not evidence about this gate in any case, since those sites were invisible to the CHECKER rather than to CI, and only the 11 that main already carries under today's checker measure what the gate does not compile). Those 11 are the first number anyone has put on the gap between main is green and the corpus holds the floor, and they are exactly the population this amendment names. INCIDENT RECEIPT (2026-10-07), a further firing of this drop: the EqualityOptionalityMismatch wall (failure mode optional_compared_with_required_value) landed with its consumers outside the gate, so every site it refuses stayed broken while every required lane reported success, and was found only by a whole-population emit census run as a scratch script (not an instrument, and no count is carried here); gunbc#13549 repaired the sites by matching on the optional. Standing, trigger and gate prefixes are unchanged.
 
-AMENDED 2026-10-01: the srv1 probe of the withdrawn v2.test. family (neat-boar-16, scratch commit eff2d73b14 = main c95f906 plus the family, artifacts on branch artifact/v2-gate-probe) measured what this row's population holds for that family: 841 v2.test.* modules declaring 5,030 test fns at c29acd041e1 have no required route; with the family restored, 4,265 were planned, 4,192 passed, 17 reached no verdict (route gaps already rostered by v2.workflow.floor_route_gap), and 44 were red on main with no lane observing them. Preparation dominated, about 3,569 modules resolved and 3,096 s wall against about 101 s of claim evaluation, the shape of this row's 2026-09-19 nominal-roster cut, so the family stays out until the trigger below. One module, v2.test.claim.cargo_build_run_argv_witness, did not typecheck on main and refused the whole floor in strict preparation when the family was restored; gunbc#12860 repaired it; of the 44 measured red identities, those still red are named here with their owners, and each leaves this amendment's list when its fix lands, so restoring the family does not inherit them as silent reds. Owner deep-ferret-305 (floor lane), fixed by work item adhoc-e6c8990b-ccf: v2.test.emit.rust_variant_construct_emit.rust_variant_construct_emit_holds_accepts (returned false); v2.test.emit.rust_variant_construct_emit.rust_variant_construct_emit_wrong_value_discriminates (returned false); v2.test.name_resolve.test_code_reference_wall.supplied_root_is_what_normalize_emits_holds (returned false). Owner calm-fox-43 (grammar lane), measured red in a SEPARATE measurement from the srv1 probe: gunbc run --claim-run on main eb60ee176d0 on 2026-10-01 (remote 48GB runner), identical on main's grammar and on gunbc#12920, so not caused by that change; cause not yet derived: v2.test.execution.emit_ingest_grammar_relation_round_trip.same_grammar_parse_ingest_bridge_holds (returned false); v2.test.execution.dag_add_emit_round_trip.dag_add_domain_coerce_accepts_holds (returned false); v2.test.execution.dag_add_emit_round_trip.dag_add_domain_translate_accepts_holds (returned false). None is an expected-red row: that roster asserts the identity executes, and these do not while the family is outside the gate. The restoration trigger above stands whole.
+AMENDED 2026-10-01: the srv1 probe of the withdrawn v2.test. family (neat-boar-16, scratch commit eff2d73b14 = main c95f906 plus the family, artifacts on branch artifact/v2-gate-probe) measured what this row's population holds for that family: 841 v2.test.* modules declaring 5,030 test fns at c29acd041e1 have no required route; with the family restored, 4,265 were planned, 4,192 passed, 17 reached no verdict (route gaps already rostered by v2.workflow.floor_route_gap), and 44 were red on main with no lane observing them. Preparation dominated, about 3,569 modules resolved and 3,096 s wall against about 101 s of claim evaluation, the shape of this row's 2026-09-19 nominal-roster cut, so the family stays out until the trigger below. One module, v2.test.claim.cargo_build_run_argv_witness, did not typecheck on main and refused the whole floor in strict preparation when the family was restored; gunbc#12860 repaired it; of the 44 measured red identities, those still red are named here with their owners, and each leaves this amendment's list when its fix lands, so restoring the family does not inherit them as silent reds. Owner deep-ferret-305 (floor lane), fixed by work item adhoc-e6c8990b-ccf: v2.test.name_resolve.test_code_reference_wall.supplied_root_is_what_normalize_emits_holds (returned false). The two rust_variant_construct_emit identities that work item named left this list when proud-wren-900 grounded unit-variant True on the binding-ref literal ladder (dag_binding_type_variant_true stays a coproduct arm, never a bool keyword), stopped treating BindingRef match as the int-bool octet channel, and retargeted complement/meet/join goldens and emit_host allocators onto dag_token_kw_true/false; emit_host_variant_construct_equals_eval left when its eval stub read ConstructTagEdge instead of a named Holds child the construct node does not carry. Owner calm-fox-43 (grammar lane), measured red in a SEPARATE measurement from the srv1 probe: gunbc run --claim-run on main eb60ee176d0 on 2026-10-01 (remote 48GB runner), identical on main's grammar and on gunbc#12920, so not caused by that change; cause not yet derived: v2.test.execution.emit_ingest_grammar_relation_round_trip.same_grammar_parse_ingest_bridge_holds (returned false); v2.test.execution.dag_add_emit_round_trip.dag_add_domain_coerce_accepts_holds (returned false); v2.test.execution.dag_add_emit_round_trip.dag_add_domain_translate_accepts_holds (returned false). None is an expected-red row: that roster asserts the identity executes, and these do not while the family is outside the gate. The restoration trigger above stands whole.
 
 ### Required lanes do not resolve product-layer modules: a module outside the nominal gate closure and the drift gate's entry closure can stop resolving on main while every required lane reports SUCCESS — declared 2026-09-20
 
@@ -402,7 +436,9 @@ gunbc.roadmap_forecast schedule_forecast: RUNG DROP, mitigatable -> outside the
 
 the hermetic apply-route witness for gunbc.runner_host_file_converge run_runner_host_files, which used to drive the whole remote plan against the fleet-ssh mock and refuse a host that reported no path and no unit: RUNG DROP, mechanically preventable -> mitigatable (deleted without replacement). Population: test.claim.runner_host_file_converge_witness_test the_apply_route_refuses_what_the_host_did_not_report (deleted; observe_reports_what_apply_refuses and the file/slot classifiers remain). Restored when: shell.PosixCommandV.Check carries mock_response coverage sufficient for a hermetic discovery member that calls run_runner_host_files to reach a terminal verdict rather than a Check route gap. Authoring that mock_response is the capability; restoring the witness without it does not retire this row, because the floor already classified that call as never reaching its subject.
 
-### a failing v1-compiler --lib unit test turns the required witnesses context red on the pull request that introduced it — declared 2026-10-06
+### a failing v1-compiler --lib unit test turns the required witnesses context red on the pull request that introduced it — declared 2026-10-06 · SUPERSEDED
+
+**SUPERSEDED — THE TRIGGER DID NOT FIRE.** Ruling: the operator ruling of 2026-10-09 (the v1 withdrawal): v1 is no longer a validation authority, and the rust-unit-tests job was deleted from gunbc.compiler_gate_workflow with the floor, generated and seed lanes. The trigger did NOT fire -- no failing v1 unit test is reported on a pull request, or anywhere on the required path Decision record: the operator's brief to session smart-gull-336 on 2026-10-09 (the v2 half of the v1 withdrawal), carried by the change that declares gunbc.rung_drop v1_required_lanes_withdrawn Loss now held by: v1_required_lanes_withdrawn
 
 a failing v1-compiler --lib unit test turns the required witnesses context red on the pull request that introduced it: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: per-push runner cost of the CI programme (docs/plans/ci-end-to-end-accounting.md) brought below the point where the unit lane can run on every pull request). Population: pull_request runs of the fleet rust-unit-tests job of gunbc.compiler_gate_workflow: cargo test --release -p v1-compiler --lib (gunbc.repo_self_test_command) is not executed per push, so a failing v1-compiler unit test blocks at merge_group instead of on the pull request. Restored when: THE CAPABILITY: a failing v1-compiler --lib unit test is reported on the pull request that introduced it, within the per-push CI budget. WHAT THAT MUST BE SUFFICIENT FOR: the author of a breaking change sees the red before entering the queue; re-adding the job to pull_request without that budget does not retire this row.
 
@@ -436,13 +472,19 @@ the enrolled emit-derisk hold-claims over emit_compiler_import_closure_from_inge
 
 two of the six priced axes for a serving offer -- operating and opportunity -- answered with asserting arms from facts this repository has not observed, so that an admission-only placement can reach a priced selector: RUNG DROP, structurally guaranteed -> mitigatable (deleted without replacement). Population: gunbc.serving.turn_admission serving_operating_cost (returns OperatingCostBorneBySupplier for a group whose operating cost is ours and unmeasured; the fail-closed arm OperatingCostUnread is reachable and refuses), gunbc.serving.turn_admission serving_opportunity_cost (returns NoFeasibleAlternativeUse from gauges that establish no running turn and cannot enumerate competing fabric demands; the fail-closed arm AlternativeUseUnread is reachable and refuses). Restored when: a selection policy instantiation exists that decides an admission-only placement from what such a placement knows -- fungibility, admission, quality-seat availability and the equal-cost tie policy -- and refuses to require any economic axis its caller did not observe, so that serving placement no longer routes through the priced selector's cost axes and these two functions have no question left to answer. A measured operating cost for a serving group does NOT discharge this row on its own: it leaves the opportunity axis asserted, and it leaves an admission-only placement answering a pricing question it has no standing to answer.
 
+### serving, harness and fabric witnesses whose fixtures name FabricGroupB and the sold hosts srv9-srv12 as test data rather than a live host population — declared 2026-10-10
+
+serving, harness and fabric witnesses whose fixtures name FabricGroupB and the sold hosts srv9-srv12 as test data rather than a live host population: RUNG DROP, structurally guaranteed -> mitigatable (lost as a passenger of the live Group B host population (srv9-srv12) that the serving and fabric witnesses' fixtures were authored against). Population: witness fixtures under dag/test/claim that name FabricGroupB or operator_host_srv9 through operator_host_srv12 as inputs, gunbc.spark.glm_serving_load, which still addresses srv9_host_lan_endpoint, no rostered fleet target, enrolment, binding, reservation or endpoint list: those are removed, not dropped. Restored when: serving re-fixtured onto a live host population: the serving, harness and fabric witnesses and gunbc.spark.glm_serving_load take their hosts from a live roster (hosts that exist and are reachable) instead of the sold srv9-srv12 symbols, SUFFICIENT FOR the srv9-srv12 identity and endpoint data symbols to be deleted without a witness or serving module resolving them.
+
 ### a serving offer's identity and its post-acquisition fence are the metrics-exporting process, so an engine-core or rank replacement behind a surviving exporter keeps the offer identity, its readiness evidence and its fence — declared 2026-09-08
 
 a serving offer's identity and its post-acquisition fence are the metrics-exporting process, so an engine-core or rank replacement behind a surviving exporter keeps the offer identity, its readiness evidence and its fence: RUNG DROP, structurally guaranteed -> mitigatable (deleted without replacement). Population: gunbc.spark.serving_offer spark_serving_offer_key (the exporting process's key standing as the complete SupplierOffer identity), gunbc.harness.harness_seat harness_fence_grant (the post-acquisition re-read, which compares the exporter's launch and therefore cannot see an engine replacement beneath it). Restored when: a launch receipt read from the running engine joins the metrics-exporting process to the engine-core incarnation and its rank population, so that the offer identity and the post-acquisition fence both name the incarnation that will execute the turn. An observation of the exporting process alone does NOT discharge this row: that is what stands today, and it is what lets a seat taken against one engine authorize a request against its replacement.
 
-### new-witness eval-step cost gate over the one claim that inhabits the real byte-span argv with its really-serialized program: it still executes, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered — declared 2026-09-22
+### new-witness eval-step cost gate over the one claim that inhabits the real byte-span argv with its really-serialized program: it still executes, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered — declared 2026-09-22 · SUPERSEDED
 
-new-witness eval-step cost gate over the one claim that inhabits the real byte-span argv with its really-serialized program: it still executes, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the serialized byte-span program reaching a claim frame as a served value rather than being re-rendered inside it, or a serialization that fits the budget). Population: test.claim.spark.v41_checkpoint_materialize_witness.the_span_read_reads_exactly_its_region: over the new-witness eval-step budget, rostered in v2.workflow.floor_eval_step_cost_drop floor_eval_step_cost_drop_span_program_rows; measured by gunbc#12010, claim_batch over dag/test/claim/spark/v41_checkpoint_materialize_witness_test.dag; planned_as_changed_witness, verdict pass, over the new-witness budget. The billed work is the one real serialization of gunbc.sha256sum_byte_span sha256sum_byte_span_program through gunbc.shell_command_text, which this claim is the argv's only inhabitance route for. Restored when: THE CAPABILITY, EITHER CLAUSE SATISFIES IT, AND BOTH ARE STATED BECAUSE THE CAUSE IS NOT YET ESTABLISHED. (i) gunbc.sha256sum_byte_span sha256sum_byte_span_program is served across claim frames by v2.workflow.floor_pure_producer_share on the acceptance path; WHAT THAT MUST BE SUFFICIENT FOR: a required-floor claim asserting the real byte-span argv carries the really-serialized program does not re-render it inside its own frame. A share row not covering this identity's demand does not satisfy this clause. OR (ii) v2.workflow.bash_command_fold_serialize serializes a fourteen-word statement list inside the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives -- whether by repair of a cost-shape defect there or by any other means. IN EITHER CASE this identity must measure under that budget WHILE STILL EXECUTING the real serialization route. Deleting the identity, supplying the program as a fixture, asserting only length(argv), or relocating it to a home that does not execute it satisfies neither clause.
+**SUPERSEDED — THE TRIGGER DID NOT FIRE.** Ruling: Group A decommissioned (operator, 2026-10-07, relayed by valiant-crab-775): the one claim this drop covered lived in test.claim.spark.v41_checkpoint_materialize_witness, and gunbc.spark.v41_checkpoint_materialize -- the only consumer of gunbc.sha256sum_byte_span -- acted only on Group A hosts, so the module, its witness and the byte-span producer were deleted with the group Decision record: dashboard messages msg_5d88338f (the removal, operator-approved) and msg_9e5a2fee (the arm path with it), both 2026-10-07 Loss now held by: none: no producer and no claim remain for the cost gate to be suspended over; the population is empty
+
+new-witness eval-step cost gate over the one claim that inhabits the real byte-span argv with its really-serialized program: it still executes, eval_steps stay recorded, a semantic red and a wall-clock crossing still block; only the eval-step cost-gate rung is lowered: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the serialized byte-span program reaching a claim frame as a served value rather than being re-rendered inside it, or a serialization that fits the budget). Population: . Restored when: THE CAPABILITY, EITHER CLAUSE SATISFIES IT, AND BOTH ARE STATED BECAUSE THE CAUSE IS NOT YET ESTABLISHED. (i) gunbc.sha256sum_byte_span sha256sum_byte_span_program is served across claim frames by v2.workflow.floor_pure_producer_share on the acceptance path; WHAT THAT MUST BE SUFFICIENT FOR: a required-floor claim asserting the real byte-span argv carries the really-serialized program does not re-render it inside its own frame. A share row not covering this identity's demand does not satisfy this clause. OR (ii) v2.workflow.bash_command_fold_serialize serializes a fourteen-word statement list inside the NewWitnessTier budget that v2.workflow.required_floor claim_ceiling_eval_step_budget derives -- whether by repair of a cost-shape defect there or by any other means. IN EITHER CASE this identity must measure under that budget WHILE STILL EXECUTING the real serialization route. Deleting the identity, supplying the program as a fixture, asserting only length(argv), or relocating it to a home that does not execute it satisfies neither clause.
 
 ### one resident pool per precedence slot in the thread's shared index memo (entry_resolve::PROCESS_RESOLVE_INDEX) — declared 2026-09-30 · RETIRED
 
@@ -450,7 +492,9 @@ new-witness eval-step cost gate over the one claim that inhabits the real byte-s
 
 one resident pool per precedence slot in the thread's shared index memo (entry_resolve::PROCESS_RESOLVE_INDEX): RUNG DROP, mechanically preventable -> mitigatable (replacement staged: the caller audit plus a build-site refusal in try_process_shared_index_for_pool (the follow-up to gunbc#12821)). Population: v1_compiler::bin::claim_batch::run, v1_compiler::cli_run::call_compile_clean_bool_list_fn, v1_compiler::cli_run::ci_floor_commit_witness_claim_pairs, v1_compiler::cli_run::compile_clean::compile_clean_scope_plan_from_touched_paths, v1_compiler::cli_run::compile_emission, v1_compiler::cli_run::discover_owned_data_decls, v1_compiler::cli_run::emit_host::compile_dag_candidate_resolved_call_edges_uncached, v1_compiler::cli_run::emit_host::compile_xl1_primary_root_tap, v1_compiler::cli_run::emitted_crate_workspace_host::evaluate_plan, v1_compiler::cli_run::entry_resolve::load_sources_for_entry, v1_compiler::cli_run::entry_resolve::load_sources_for_entry_with_pool_index, v1_compiler::cli_run::entry_resolve::resolve_entry_graph, v1_compiler::cli_run::handle_serve, v1_compiler::cli_run::install_group_syntax, v1_compiler::cli_run::install_output_policy, v1_compiler::cli_run::measure_selected_entry_closure_overlap, v1_compiler::cli_run::project_witness_cost_receipt, v1_compiler::cli_run::render_batch_summary_line, v1_compiler::cli_run::required_floor_runner::floor_base_test_decl_census, v1_compiler::cli_run::required_floor_runner::floor_compile_clean_emit_ok_via_index, v1_compiler::cli_run::required_floor_runner::floor_diff_baseline_readout, v1_compiler::cli_run::required_floor_runner::floor_diff_comparison_readout, v1_compiler::cli_run::required_floor_runner::floor_git_diff_name_status_range, v1_compiler::cli_run::required_floor_runner::floor_git_diff_range, v1_compiler::cli_run::required_floor_runner::head, v1_compiler::cli_run::required_floor_runner::run_required_floor, v1_compiler::cli_run::required_floor_runner::unimported_bare_provider_roster_source_at_base, v1_compiler::cli_run::required_lane_resolution_census::entry_closure_module_identities, v1_compiler::cli_run::required_lane_resolution_census::required_floor_nominal_subject_module_identities, v1_compiler::cli_run::resolve, v1_compiler::cli_run::resolve_workspace_entry, v1_compiler::cli_run::run_required_bare_reference_admission, v1_compiler::cli_run::test_module_hygiene_bridge::resolve_hygiene_ctx, v1_compiler::cli_run::witness_gates::commit_witness_claim_pair_resolvable, v1_compiler::cli_run::witness_gates::commit_witness_claim_roster_defects, v1_compiler::generated_artifact_boundary_host::generated_artifact_ctx, v1_compiler::generated_artifact_boundary_host::run_docs_projection_agreement, v1_compiler::pre_push::load_plan_ctx, v1_compiler::required_regen_host::load, v1_compiler::required_regen_host::partition_rebuild_actuation, v1_compiler::required_regen_host::regen_generation_role_population, v1_compiler::required_regen_host::render_affected_set_bound, v1_compiler::required_regen_host::render_round_cost_receipt, v1_compiler::required_regen_host::render_scope_selection. Restored when: every population caller's root set is audited (it passes the run's own roots, or owns an index for a pool no other caller reads) and try_process_shared_index_for_pool refuses a second resident pool in a slot at the build site, before it is built; shared_index_residency_control then becomes the positive control of that refusal. Observed at retirement: the build-site refusal fires on a two-pool fixture and the floor and a regen round pass with it; this row retires in the same change.
 
-### the slot wall's floor-demand conjunct (gunbc.runner_slot_allocation gunbc_runner_slot_allocation_wall_holds over gunbc.floor_demand gunbc_floor_measured_peak_observation): a per-slot MemoryHigh below the floor's demonstrated demand is not refused when the demonstration is a throttle pin at the declared line — declared 2026-09-19
+### the slot wall's floor-demand conjunct (gunbc.runner_slot_allocation gunbc_runner_slot_allocation_wall_holds over gunbc.floor_demand gunbc_floor_measured_peak_observation): a per-slot MemoryHigh below the floor's demonstrated demand is not refused when the demonstration is a throttle pin at the declared line — declared 2026-09-19 · SUPERSEDED
+
+**SUPERSEDED — THE TRIGGER DID NOT FIRE.** Ruling: the operator ruling of 2026-10-09 (the v1 withdrawal): the floor lane was deleted from gunbc.compiler_gate_workflow, so the floor no longer runs in a fleet slot and the slot wall's floor-demand conjunct (the subject of this row) was withdrawn with it; the same ruling moved the slot to a fixed 22 GiB maximum with no swap for the emit-and-build steps that do run there Decision record: the relayed REQUEST_CHANGES on gunbc#13641 and the operator's brief to session smart-gull-336 (2026-10-09), carried by the change that declares gunbc.rung_drop v1_required_lanes_withdrawn and moves gunbc.runner_slot_desired to 22/21 GiB and MemorySwapMax=0; the floor's own envelope survives as gunbc.floor_demand gunbc_floor_pinned_memory_max / _high Loss now held by: v1_required_lanes_withdrawn
 
 the slot wall's floor-demand conjunct (gunbc.runner_slot_allocation gunbc_runner_slot_allocation_wall_holds over gunbc.floor_demand gunbc_floor_measured_peak_observation): a per-slot MemoryHigh below the floor's demonstrated demand is not refused when the demonstration is a throttle pin at the declared line: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: gunbc.floor_demand's typed pin receipt and charge-ceiling fold, observed by witness_declared_high_sits_below_the_floor_charge_ceiling and tracked by gunbc.guarantee_stall.runner_microvm_floor_fit_stall, standing in for a wall conjunct that consumes the pin). Population: gunbc.runner_slot_desired gunbc_runner_slot_desired memory_high (26843545600) against gunbc.floor_demand gunbc_floor_throttle_pin_receipt_2026_09_19 (peak 26849763328 at that line). Restored when: BOTH: (i) the per-slot MemoryHigh rises above gunbc.floor_demand gunbc_floor_cgroup_charge_ceiling, or the floor's demand falls below the current line and a later uncensored receipt at this row supersedes the pin -- an operator ruling cited on the moving change; AND (ii) gunbc_runner_slot_allocation_wall_holds gains a conjunct under which a throttle-pin receipt whose armed line equals the current memory_high refuses on the required path, with its red executed on a fixture pin. Retiring the pin receipt or narrowing the charge-ceiling fold satisfies neither clause.
 
@@ -534,6 +578,10 @@ the v1 consumer census's live population -- v1_consumer_population(), v1_blockin
 
 the behaviours the deleted v1 integration tests exercised (required-floor runner, reach-base standings, regen and emit hosts, compile-clean, entry-resolve censuses, interpreter depth walkers) are exposed by an enrolled test on a required lane: RUNG DROP, mechanically preventable -> mitigatable (deleted without replacement). Population: every #[test] gunbc#13452 deleted (190, each over 100ms) from these v1-compiler files: census_exclude_derive.rs, cli_run.rs, cli_run/checker_dependency.rs, cli_run/compile_clean.rs, cli_run/emit_host.rs, cli_run/entry_resolve.rs, cli_run/floor_discovery_snapshot.rs, cli_run/non_fold_residue.rs, cli_run/reach_base_standings.rs, cli_run/required_floor_runner.rs, compiler_tests.rs, coproduct_reflection.rs, evaluation_budget_consequence_falsifier_host.rs, phase_profile.rs, process_group.rs, required_regen_host.rs, v1_interpreter.rs (all under src/v1/stage0/src), the 17 DeclarationRef evidence rows #13452 removed from floor_arm_set_consumer_seed_growth, floor_checker_input_seed_growth, interpreter_eval_correctness_seed_growth, live_tree_stamp_detector_seed_growth and observation_file_effect_seed_growth, whose seed-growth rows lost the test they cited. Restored when: THE CAPABILITY: each behaviour a deleted test exercised is exposed again by an enrolled claim on a required lane, with a discriminating red -- by a v2 witness or floor claim over the same subject, or because the v1 host code it tested has itself been deleted (a behaviour with no remaining realization needs no test). WHAT THAT MUST BE SUFFICIENT FOR: no behaviour this population covered can regress with every required lane green. Restoring the tests to the v1 unit lane is not the route the owner ruling admits; re-adding any one test, or covering the subject areas in aggregate rather than per behaviour, does not retire this row.
 
+### The four v1-judged required lanes (`floor`, `generated`, `rust-unit-tests`, `seed`) as a merge gate — declared 2026-10-09
+
+The four v1-judged required lanes (`floor`, `generated`, `rust-unit-tests`, `seed`) as a merge gate: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: a binary built from an emission of v2 judging this population on the required path, admitted to the gate as rows of `gunbc.emitted_subject_build_gate` `emitted_subject_build_rows`. No such row covers any member of this population at declaration). Population: every claim the `floor` lane folded on a pull request or a merge_group: the prepared subject of `v2.workflow.required_floor` `required_gate_prefixes` with its seeds, plus the changed-witness and touched-entry selection. `claim_executor --required-ci --required-lane witnesses` is run by no job, the stage0 mirrors equal one emission by the seed built from them, and the registry-rostered generated artifacts (`gunbc.generated_artifact_registry` `committed_generated_artifacts`) equal one emission of their authorities: `claim_executor --required-ci --required-lane build` is run by no job. That population includes `.github/workflows/witnesses.yml` and `DESIGN.md`, so the gate's own workflow file is compared with `gunbc.compiler_gate_workflow` by nothing; the heal publisher workflow that published repair candidates was deleted with the lanes (nothing sealed one), and its WIF pool (`gunbc.auth.heal_publisher_federation`) stands dead until retired by hand -- an external-estate obligation, not a drop, the lint: `cargo clippy --all-targets -- -D warnings` (`gunbc.repo_self_build` `repo_self_clippy_command`), the only command that compiles the integration-test and example targets, the v1 unit tests: `cargo test --release -p v1-compiler --lib` (`gunbc.repo_self_build` `repo_self_test_command`), which ran on merge_group and workflow_dispatch, module resolution: every module the source-root ingestion admits under dag/ and src/v2/ that is outside the import closures of `gunbc.instrument_targets` `self_host_entry` and `v2_native_cli_entry` is handed to a compiler by no required step, so it can stop resolving on main with the required context green. Enumerated BY IDENTITY, not by count, by `gunbc test //gunbc/instruments:required-lane-resolution-census` (`gunbc.required_lane_resolution_census_live`), which from this change does not hold by design, the consumers of those lanes' products: no merge_group run uploads a compiler pair candidate, so `gunbc.fleet_desired_admission_workflow` builds the pair itself; and `gunbc.fleet_revision_acceptance` admits a revision on a required-CI success that carries the `witnesses` job's emit-and-build verdict alone, under the contract epoch `gunbc.required_ci_contract_epoch` moved to with this change, NOT ENUMERATED HERE, and named so the gap is not read as empty: every `gunbc.recurring_failure_mode` row and every standing `gunbc.rung_drop` row whose stated current rung is held by a step of the four lanes. Those rows are not amended by this change, and each now sits no higher than this row's temporary rung. Restored when: THE CAPABILITY: on every landing revision, a binary built from an emission of v2 -- the seed's emission today, v2's own after the generation transition -- judges this population on the required path with a discriminating red. Member by member: (1) every claim the floor folded is executed by such a binary, or its subject has been deleted; (2) every module the source-root ingestion admits is resolved, observed as `gunbc test //gunbc/instruments:required-lane-resolution-census` holding against the workflow as emitted; (3) every committed generated artifact, `.github/workflows/witnesses.yml` included, is compared with one emission of its authority; (4) for the three members whose subject is v1's own Rust -- the stage0 mirrors, the lint and the v1 unit tests -- a change to the seed's sources cannot land with the required context green unless a required step judged it, or the seed no longer exists. WHAT THAT MUST BE SUFFICIENT FOR: no member of this population can regress with the required context green. WHAT DOES NOT RETIRE THIS ROW, stated because each is the likely mistake: returning any of the four lanes, or any step that hands the corpus to the v1 interpreter, because the ruling withdraws that authority; a native row that judges part of the population, which narrows this row member by member and retires nothing; a manual or dispatched run off the required path; and a count of claims or modules standing where the identity join belongs. The TEMPORARY rung is Mitigatable only while the seed's own runners for these members exist at head, so a change that deletes one of them owes its own declaration.
+
 ### The v2 native frontier (the ratchet over the emitted-native route's refusals) runs on no merge candidate and on no schedule until the required native-route lane is live — declared 2026-09-23
 
 The v2 native frontier (the ratchet over the emitted-native route's refusals) runs on no merge candidate and on no schedule until the required native-route lane is live: RUNG DROP, mechanically preventable -> outside the ladder (replacement staged: the native route's REQUIRED lane on the merge_group revision (node://adhoc-11684de4-07b), running //gunbc/instruments:v2-native-frontier). Population: gunbc.native_frontier_ratchet native_frontier_verdict over the whole v2.test.* universe, on every merge candidate (nothing runs it at all until the required native-route lane is live), the derived v2.test.* universe executed by the emitted-native compiler, on every merge candidate, the [native-frontier-roster] proposal a mint or re-mint pull request carries: with no run there is no proposal, so the roster stays RosterUnminted and the ratchet has no baseline to hold, what the route cannot see even when it runs, so a shrinking roster bounds the frontier from below and never measures it exactly: (i) every refusal inside a module whose FILE the front end refused; (ii) sites under a refused binder, which resolve marks ObservationIncomplete and never visits; (iii) call arguments, which do not reach resolve (gunbc.recurring_failure_mode call_expression_erased_at_v2_body_lowering); and, per identity, every refusal after the FIRST terminal one. Restored when: The required native-route lane's run on the merge_group revision executes //gunbc/instruments:v2-native-frontier over the whole v2.test.* universe, its red blocks the landing, AND that run produces a [native-frontier-roster] proposal that a mint pull request carries into gunbc.native_frontier_roster -- the capability is a ratchet judging every merge candidate against a minted roster, so the lane existing, or running without a mint taken from it, does NOT retire this row. The receipt (run id, merge_group sha as tested_tree, the minting pull request) becomes trigger_fired. The lower-bound population (front-end file refusals, ObservationIncomplete under refused binders, call arguments, per-identity refusals after the first) is NOT restored by that lane either. Each of those retires only when the route observes it, and a row naming one of them must be split out rather than retired with this one.
@@ -542,6 +590,8 @@ The v2 native frontier (the ratchet over the emitted-native route's refusals) ru
 
 The v2 native route (emitted-native compiler over the derived v2.test.* universe) as a required CI lane: RUNG DROP, mechanically preventable -> mitigatable (deleted without replacement). Population: gunbc.witness_v2_native_route native_route_admission — every receipt clause, on every merge candidate, the derived v2.test.* universe executed by the emitted-native compiler (positive population), v2.native_lane_fixture.control native_lane_false_control / native_lane_true_control (live-verdict controls), fixtures/native_lane_malformed/poison.dag.poisoned (malformed-specimen control), the old-route-withdrawn (no-fallback) control. Restored when: THE FIRST GREEN merge_group RUN OF THE `emit-build` LANE (gunbc.compiler_gate_workflow compiler_gate_emit_build_job_id) AS A REQUIRED LANE -- its compiler_gate_lane_rows row LaneBlocks and the job on the fleet runner -- IN WHICH THAT LANE ALSO EXECUTES //gunbc/instruments:v2-native-frontier over the derived v2.test.* universe on the merge_group revision and publishes its [native-frontier-roster] proposal with tested_tree = that merge_group sha. Its receipt (run id, job id, tested tree, measured wall on the fleet runner class) becomes `trigger_fired`. Sufficient for: execution of the native route on every landing, inside the lane's declared timeout on the real runner class (a measured wall, not a cited one), with supersession so no head holds more than one native claimant, and a red that still discriminates every clause of gunbc.witness_v2_native_route native_route_admission -- universe join, a positive population held to a FLOOR rather than to non-emptiness (gunbc.witness_v2_native_route native_route_required_pass_identities enrols the identities that pass natively at that head -- it holds only the one smoke member at this writing, so a run whose population regressed to that member would still be admitted), classified refusals, per-identity agreement with the floor reference, and all four controls, with the live false/true pair OBSERVED at native_route_live_pair_standing = LivePairRequired (gunbc.rung_drop.native_lane_live_pair_expected_red retired first or in the same change). NOT sufficient, and named so it cannot be mistaken for the trigger: a green run of the lane with only //gunbc/instruments:self-host and //gunbc/instruments:v2-native-cli, required or not -- those emit and build the native compiler and CLI but execute none of the v2.test.* universe this row lists. Re-adding `required-v2-native` with its 2026-09-10 shape does not retire this row and is refused by test.claim.deleted_lanes_countable_witness_test w_RED_the_deleted_lanes_do_not_return.
 
+AMENDED 2026-10-09: the v1 withdrawal (gunbc.rung_drop v1_required_lanes_withdrawn) deleted the floor, generated, rust-unit-tests and seed lanes, and the same operator ruling collapsed `emit-build` and the `witnesses` aggregate into ONE required job named `witnesses` (gunbc.compiler_gate_workflow compiler_gate_required_job_id) that emits and builds both retained products fresh on every run. compiler_gate_emit_build_job_id, compiler_gate_lane_rows and the LaneBlocks standing the trigger cites were deleted with the aggregate; read the trigger's 'the `emit-build` LANE ... AS A REQUIRED LANE -- its compiler_gate_lane_rows row LaneBlocks and the job on the fleet runner' as 'the required `witnesses` job of gunbc.compiler_gate_workflow, on the fleet runner'. Everything else the trigger requires is unchanged: the first green merge_group run of that job which ALSO executes //gunbc/instruments:v2-native-frontier over the derived v2.test.* universe and publishes its proposal with tested_tree = the merge_group sha; a green run of the job with only the two emit-and-build subjects is still NOT sufficient. The operator's same-day rule that the native obligation is a SEPARATE population executed by one built SourceRootEvalDriver, with a monotone green set and exactly one observed frontier, is the shape that run takes; it does not retire this row either until it is observed on a landing. The restoration trigger above stands whole.
+
 ### the published DeepSeek V4.1 Engram row stores' bytes: produced on the host by a program realizing gunbc.spark.v41_engram_row_store v41_place_row, admitted by differential agreement with the .dag fold over a real published sample rather than by the fold itself — declared 2026-09-23
 
 the published DeepSeek V4.1 Engram row stores' bytes: produced on the host by a program realizing gunbc.spark.v41_engram_row_store v41_place_row, admitted by differential agreement with the .dag fold over a real published sample rather than by the fold itself: RUNG DROP, structurally guaranteed -> mitigatable (replacement staged: the .dag encoder (v41_place_row / v41_store_bytes) emitted and built, encoding every published store itself). Population: the eight stores gunbc.spark.v41_row_store_encode v41_store_encode_plan derives (layers 1 and 14 x ranks 0..3), identified from v41_published_store_readings. Restored when: THE CAPABILITY: the emitted .dag row-store encoder builds and encodes all eight published stores from the materialized shards, and their sha256 are the identities v41_identify_row_store admits. An emitted encoder that encodes only a sample, or only one rank, or whose output is compared to the host program's rather than replacing it, does not satisfy this; the host program and this row delete together when it does.
diff --git a/docs/onboarding.md b/docs/onboarding.md
index 4d64ca9ced7..c9d5997ed3e 100644
--- a/docs/onboarding.md
+++ b/docs/onboarding.md
@@ -60,7 +60,7 @@ Done when: git config core.hooksPath reads back .githooks. THAT IS THE WHOLE CHE
 
 ### 5. run-witnesses
 
-Run the corpus lane the merge gate runs: the parse sweep and the witness floor. EXPECT TENS OF MINUTES, NOT SECONDS -- this and the emission lane are the two long steps on this page, and a reader who assumes a hang and kills it has thrown away the run rather than the wait.
+Run the corpus lane that WAS the merge gate's floor until the v1 withdrawal of 2026-10-09 (gunbc.rung_drop v1_required_lanes_withdrawn): the parse sweep and the witness floor. Nothing on the required path executes a witness now, so this run is the only place the enrolled population is folded, and a red here reaches main unless you act on it. EXPECT TENS OF MINUTES, NOT SECONDS -- this and the emission lane are the two long steps on this page, and a reader who assumes a hang and kills it has thrown away the run rather than the wait.
 
 `target/release/claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane witnesses`
 
diff --git a/docs/plans/accumulator-copy-roster-gate-census-ledger.md b/docs/plans/accumulator-copy-roster-gate-census-ledger.md
deleted file mode 100644
index 3cdcba2b658..00000000000
--- a/docs/plans/accumulator-copy-roster-gate-census-ledger.md
+++ /dev/null
@@ -1,17 +0,0 @@
-# Ledger: accumulator_copy roster gate (300s census)
-
-Parent: sunny-bat-82 / snappy-stag-806 silent reds. Subject: `complexity/accumulator_copy_roster_gate_*` as one roster-scan cost. Cap not raised. Not enrolled in the required gate.
-
-Instrument: out-of-gate 300s census of those entries. Classification: **(d)** — real standing and scan-cost defects, not stale greens.
-
-Typed standing for priced-out lens walks: `gunbc.rung_drop.accumulator_copy_priced_out_file_gate_ratchets`. Executing consumer for those walks: `gunbc.offline_local_recipe` `RecipeFunctions` rows (not the drop's population strings). Exclusion rationale stays `gunbc.ci.ci_layer_roots` `accumulator_copy_roster_gate_exclusion_note` (unchanged from main).
-
-| Row | Class | Cause | Repair |
-| --- | --- | --- | --- |
-| TIMEOUT lean/bash/swift entries | (d) | Interpreted `file_gate` of `src/v2/extdeps/languages/{lean,bash,swift}.dag`. | Freeze identities deleted (meaning fork: ratchet name on a weaker contract). Walks: `roster_{lean,bash,swift}_file_gate_walk` in `*_walk.dag`, named by `gunbc.offline_local_recipe`. |
-| TIMEOUT `accumulator_copy_roster_gate_test.dag` | (d) | Same scan packed `00_compile.dag` and `analyze.dag`. | Ordinary `fn`s `roster_compile_stage_file_gate_walk`, `roster_lens_traversal_file_gate_walk`. Executing `file_gate` `test fn`s: snippets plus `roster_std_algebra_zero_suspects_within_ratchet`, `roster_machine_code_zero_suspects_within_ratchet`, `roster_lens_cost_model_zero_suspects_within_ratchet`. |
-| RED `red_control_planted_copy_still_alarms` | (d) | Control used `list_append(left: acc, right: x)` — linear non-copy polarity (`noncarrier_name_snippet`). Fixture `planted_copy.dag` and `quadratic_snippet` use `left: x, right: acc`. | Snippet polarity aligned with the planted fixture. |
-| RED `roster_glob_discovery_zero_suspects_within_ratchet` | (d) | Path moved to `src/v2/test/workflow/glob_discovery_law.dag` (#9637). Interpreted `file_gate` also interrupted the 8s changed-witness wall. | Freeze identity deleted. Walk: `roster_glob_discovery_file_gate_walk` named by `gunbc.offline_local_recipe`. |
-| RED `roster_compile_stage_zero_suspects_within_ratchet` | (d) | `00_compile.dag` is not a 300s interpreted subject. | Renamed `roster_compile_stage_file_gate_walk`; named by the recipe. |
-
-Freeze rows for demoted walks were deleted so they cannot rot as `StaleFrozenPathDeferral`. CI exclusion substring `claim/complexity/accumulator_copy_roster_gate` is unchanged.
diff --git a/docs/plans/anonymous-record-literal-design.md b/docs/plans/anonymous-record-literal-design.md
deleted file mode 100644
index 7cb43d6b562..00000000000
--- a/docs/plans/anonymous-record-literal-design.md
+++ /dev/null
@@ -1,305 +0,0 @@
-# Anonymous record literals: the tag-absent construct, elaborated from the expected type
-
-Status: PR1 of two (the model and its consumer census). PR2 is the cut. Owner lane: sleek-fox-423,
-parent gentle-koi-724, reviewer neat-boar-16. This builds on the construct carrier of
-`docs/plans/construct-tag-reference-design.md` (gunbc#12701, lively-eagle-657) and does not restate
-it.
-
-## Symptom and the chain (DESIGN 6b)
-
-A headless brace literal, `data x: T = { f: v }` or a nested `f: { g: w }`, file-refuses at native
-ingest with `body_lowering_reason_unsupported_form`. A refused file drops its declarations from the
-native index, so every importer then fails as unbound. The survey (lively-eagle-657, quiet-hawk-702
-probe on the #12420 tree) names seven files.
-
-The slice, read from the grammar forward:
-
-- **Grammar.** `v2.extdeps.languages.dag` `dag_grammar_primary_expr_core` has ONE headless-brace
-  alternative, `{ field_init_list }`. `dag_grammar_field_init_expr` keys each item on EITHER a
-  binding name OR a string literal. The record literal `{ f: v }` and the map literal
-  `{ "k": v }` are the same production. Only the lexical kind of each key tells them apart.
-- **Lowering.** `v2.compiler.body_lowering_fold` `body_lower_try_record_literal` needs a head tag
-  from `body_lower_record_literal_tag_optional`. A headless brace has none, so the primary is
-  unreadable and refuses at the primary (the XL-2 refusal arm,
-  `unrecognized_primary_expression_lowers_to_its_first_atom_at_v2_body_lowering`). This refusal is
-  CORRECT at this link. Lowering runs before resolve and before infer, so it cannot know the
-  constructor. The earliest unjustified boundary is therefore not lowering. It is the construct
-  carrier, which has no tag-absent case, together with the absence of any stage that carries a
-  declared type DOWN into the expression it types.
-- **No stage pushes a declared type down.** v2 infer is a bottom-up fold. Its declared-type
-  judgments run AFTER a body is synthesised: `infer_arrow_body_inhabits_declared_return` compares a
-  derived body type with a declared return (cause `arrow_body_does_not_inhabit_declared_return`),
-  and only for a return the language join denotes (`dag_binding_denotation`). Call arguments are
-  judged the same way (`position_direct_call_argument`). A tag-elided construct cannot be
-  synthesised at all, because its tag is what types it. So its tag must be supplied BEFORE infer's
-  fold reaches it, by a stage that walks top-down with the declared type as context.
-- **The seed is not an oracle for the choice.** v1 chooses the struct in its Rust emitter by
-  matching field names: `v1.compiler.emit_rust` `anonymous_record_struct_candidates`, and it
-  refuses `AmbiguousAnonymousRecordLiteral` ("shape matches N structs -- add a nominal type").
-  That is the selection this lane is forbidden to make. So seed-vs-native agreement on the chosen
-  tag is not evidence. The oracle is content equality with the authored headed form (control 1).
-
-## The model
-
-**The carrier.** Form B is the tag-ABSENT case of the one construct carrier of #12701. It is not a
-new node kind. After #12701 a construct is `Conj { <construct_tag_marker>: <reference>, fields.. }`.
-The tag-absent construct is `Conj { <construct_tag_marker>: <construct_tag_elided_marker>, fields.. }`.
-
-- The tag edge is always present, so every construct reader keys on the same first edge and asks
-  only whether its target is a reference or the elision marker. The alternative, a construct with
-  no tag edge, is a bare `Conj` of Named edges. That is also the anonymous record TYPE
-  (`body_lower_anonymous_record_type_optional`, `-> { success: Bool }`) and the shape every
-  "unmarked Conj" reader already means something else by. Presence-by-absence would be a second,
-  implicit representation. It is refused for the same reason #12701 keeps `construct_tag_marker`
-  distinct from `declaration_reference_marker`.
-- `construct_tag_elided_marker` is a structural core marker declared beside `construct_tag_marker`
-  in `v2.std.node`, in the same form, and counted once in the #12473 `EdgeLabel` census. It
-  carries no spelling and no guess.
-- **Key kind is recorded, not interpreted.** Each field edge keeps its authored key kind. A name key
-  is `Named { name }`, as today. A string key has no field-edge form yet (see Scope). Lowering does
-  not decide "record" versus "map". It records what was written.
-
-**Where elaboration happens: in resolve, at the construct-tag writer, with an expected-type
-context threaded down from declared types.** (Revised after the first review. The first draft
-placed it in infer "before synthesis". Infer is a bottom-up fold, so that would have been a second,
-top-down pass beside it.)
-
-Choosing the tag reads exactly two facts, and both are NAME facts that resolve already has:
-
-- The expected type's HEAD resolves to a declaration. Resolve resolves every type expression.
-- Whether that declaration is a single record, and, for nesting, its fields' declared types. Resolve's
-  `ResolveContext.namespace.symbol_index` returns the declaration node through `symbol_index_lookup`,
-  and `v2.std.type_binder` `type_decl_view` reads its shape.
-
-Resolve is also, after #12714, the ONE writer of construct tags: `resolve_construct_walk` rewrites
-the authored tag spine into `declaration_reference_node(path)`. Writing the elided tag anywhere else
-would give one fact, "the declaration this construct constructs", two writers (§3). So the elided
-case is a second arm of that same writer, with the reference derived from the expected type rather
-than from an authored spine. Infer then sees only ordinary resolved constructs, and checks them
-with its existing construct typing and declared-return judgment.
-
-**The expectation is a parameter, not ambient context.** An expectation (`ResolveExpectation`: the
-authored type expression, and the position its names are read at) is handed, as an explicit
-argument, by exactly the four position rules below to the one child each rule owns
-(`resolve_expected_edge`). It is never a `ResolveContext` field. Every other walk goes through
-`resolve_node_walk`, which has no expectation to give, and a headless literal there refuses. That
-makes review condition 3 structural rather than a clearing discipline: a field on the context would
-have been inherited by every child walk that copies the context (a call's arguments, for one), and
-each would have had to remember to clear it.
-
-**The expectation is set ONLY from an AUTHORED type annotation** (ruling, gentle-koi-724): a data
-declaration's declared type, a fn's declared return, a record field's declared type, or the element
-type of an annotated list. Resolve never infers, unifies or propagates a type it computed. Where no
-annotation reaches an elided construct, it refuses located (`resolve_anonymous_record_no_expected_type`)
-and never guesses. A record field's declared type is an annotation authored on the record
-declaration, so nesting stays within this rule. **Syntactic peel only** (review condition 1, neat-boar-16, binding both arms). The expectation is peeled
-syntactically from the authored annotation. Where reaching a closed record head would need
-inference, type-variable instantiation, alias unfolding beyond resolve's existing lookup, or any
-head that is not a closed record (or `Map`, for the map arm), the construct REFUSES located. There
-is no unification and no substitution in resolve. A record field whose declared type is one of the
-record's own binders (`top: T` of `BoundedLattice<T>`) therefore gives no record head, and a headless
-literal there refuses. The four positions:
-
-- **data initializer**: `data x: T = e` lowers to `Arrow(<empty domain>, T, T, body: e)`, so the
-  body edge of an Arrow is walked with its declared return as the expectation;
-- **declared return**: the same Arrow rule covers `fn f(..) -> T { e }`, reaching `e`'s tail
-  expression through blocks and `let .. in` bodies (the value position, not the statements);
-- **record field**: under a construct resolved to record `R` (authored OR elaborated), field `f`'s
-  init is walked with the declared type of `R.f` as the expectation, as authored (no substitution). This is how nesting works: `compile_stage_memo`'s
-  `key_derivation: { .. }`, and `host_transport`'s `RuntimePrimitive { value: { .. } }`;
-- **list element**: under a list literal whose expected head is `List` (through its alias
-  authority), each element is walked with the element type argument as the expectation.
-  `dag/std/algebra`'s 88 `AlgebraFieldTemplate` rows need this.
-
-At a tag-elided construct, the elided arm of the writer:
-
-1. Takes the expectation. If there is none, refuse `resolve_anonymous_record_no_expected_type`.
-2. Takes its HEAD's resolved declaration, through resolve's existing lookup only. Type arguments
-   (`BoundedLattice<DescentEvidence>`) never choose the constructor, and they are not substituted
-   anywhere. If the head does not resolve, the head's own resolve refusal stands, and no second
-   cause is minted for it. A head that is a type binder, or that reaches a record only through
-   alias unfolding the lookup does not already do, refuses
-   `resolve_anonymous_record_expected_type_not_record`.
-3. Requires the declaration to be a single record (`type_decl_view` `PlainTypeDecl` whose member is a
-   product), or `Map` (the MAP arm, which this lane refuses located; see Scope). Anything else,
-   whether a multi-variant coproduct, a primitive, or `List`, refuses
-   `resolve_anonymous_record_expected_type_not_record`.
-4. Writes `declaration_reference_node(path)` of that declaration through `resolved_reference_node`,
-   the same carrier the authored arm writes.
-5. Walks the fields under the record-field rule above.
-
-The choice reads the expectation only. The field set is never an input to steps 1-3.
-
-**Resolve's choice is not proof** (review condition 2). Infer CHECKS the elaborated construct
-against the declared type exactly as it checks an authored tag: field names and field value types
-through its existing construct typing, and the declared return through
-`infer_arrow_body_inhabits_declared_return`. A wrong field or a wrong value type refuses in infer, at
-the field.
-
-**Refusal causes** (typed, located at the literal's `{`, each with an ownership row in
-`v2.workflow.compile_door_cause_ownership`, per
-`refusal_producer_lands_without_its_ownership_row`):
-
-- `resolve_anonymous_record_no_expected_type`: the construct sits in a position with no declared
-  type. Examples: a `let` without an annotation, a call argument, a match-arm body, a list literal
-  that itself has no expected type. These are not guessed. Call arguments stay here on purpose:
-  their formal's declared type is a fact about the CALLEE, whose resolution this position does not
-  own. Widening to them is a named follow-up, not an implicit one.
-- `resolve_anonymous_record_expected_type_not_record`: the expected head resolves to something other
-  than a single record or `Map`.
-- `map_literal_construction_not_modeled`: the expected head is `Map`. This is the MAP arm, and it
-  plugs into the same writer.
-
-A tag-elided construct that survives resolve is unwritable downstream. The emit, eval and target_model
-readers gate on a reference target, and the elision marker is not one. So a missed elaboration
-refuses at their existing gates, and cannot emit an anonymous struct.
-
-## As built in PR2 (gunbc#12740)
-
-The model above was refined while the cut was reviewed. Each refinement below is the authority that
-the PR2 code cites by section name.
-
-### One reader of the construct tag
-
-`v2.std.node_query` `construct_tag_reading` answers
-`ConstructTagAuthored { reference } | ConstructTagElided | NotAConstruct`. Every reader (body
-lowering's core-substrate test, resolve's construct-tag writer, the claims) matches on that one
-answer. `construct_tag_optional` is its projection. The elision is carried as an EDGE LABEL
-(`construct_tag_elided_marker`) on the tag's target, the mechanism the tag marker itself uses. A
-marker carried as an atom's identity did not survive to resolve. And body lowering must count an
-elided construct as core substrate, or its fold re-lowers the literal to its first atom.
-
-### The string key is a grammar production
-
-`dag_grammar_field_init_expr` is a choice between a name alternative and a production of its own,
-`^dag_production_field_init_string_key` (emitted `^dag_surface_field_init_string_key`), whose key is
-the class-stamped string terminal that gunbc#12759 decodes. So the key's kind is a fact of the parse
-tree, read by its production identity (`body_lower_field_init_is_string_keyed`), and never recovered
-from a spelling. A record literal refuses a string key at the item (`field_init_unlowered`). The
-occurrence-role row of the new production reads its names as references, and the field-init reader
-answers `NoNameHere` for it. The map arm (gunbc#12758) dispatches on the same identity. Admitting a
-quoted key whose DECODED text names a declared field is a declared frontier. It is a follow-up in the
-record arm, and it also carries the quoted-key round trip; the first lane that admits quoted keys
-(gunbc#12758) carries that round trip for maps.
-
-### The head resolves the way the annotation resolves
-
-An annotation written in the literal's own module resolves its head through `resolve_atom` in the
-literal's context, the same route the annotation itself takes, so the two cannot bind different
-declarations. A field type is written in the record's own module, so it is read at the record's path
-through the index's lexical lookup.
-
-### The list-element rule
-
-A list literal passes its element type to its elements only when the annotation's head reaches the
-declaration infer types list literals with (`v2.std.list_introduction`
-`list_introduction_head_path`, `std.algebra.FreeMonoid`).
-
-### Pure-renaming aliases
-
-`List` is an alias (`type List<element> = FreeMonoid<element>`), so the list rule needs one kind of
-alias to be followed. Exactly one kind is followed: a PURE RENAMING, `type A<p1..pn> = H<p1..pn>`
-(the aliased expression is a head applied to exactly the alias's own binders, in declared order) or
-`type A = H`. Following one substitutes nothing, because the annotation's arguments stay in the
-positions they were written.
-
-- Purity is decided ONCE, on the declaration (`v2.std.type_binder` `type_alias_renaming`). It is
-  recorded when the index records the declaration (`v2.std.symbol_index` `renaming_aliases`,
-  `symbol_index_renaming_alias_at`), and resolve reads the recorded fact, never re-deriving it at a
-  use.
-- Chains are followed transitively, each renamed head read at the alias's own position. A revisited
-  path refuses located (`resolve_anonymous_record_alias_cycle`).
-- A reordering, constant or partially applied alias is not a renaming. It is the declaration the head
-  names, so the literal refuses.
-
-## Consumers (producers, readers, rewriters)
-
-Stated as a delta on #12701's census. Every row there still applies; the rows here are the ones
-the elided case adds.
-
-| Module | Symbol | Role | Change |
-|---|---|---|---|
-| v2.std.node | `construct_tag_elided_marker` | vocabulary | New structural core marker beside `construct_tag_marker`. |
-| v2.std.node_query | `construct_node` | producer | Takes the tag target as the reference OR the elision marker (one parameter; a typed `ConstructTag = Authored { reference } \| Elided` at the call boundary so a caller cannot pass an arbitrary node). |
-| v2.std.node_query | `construct_tag_optional` | reader | Answers the reference only. For an elided tag it answers Absent. `construct_tag_is_elided` is the one reader of the elided case. |
-| v2.std.node | `arrow_body_record_construct_conforms`, `classify_arrow_body_form` | well_formed gate | Admits the elided marker ONLY before resolve. After resolve the well_formed gate refuses it. |
-| v2.compiler.body_lowering_fold | `body_lower_try_record_literal` | producer | A headless `{ field_init_list }` whose every key is a name lowers to `construct_node(Elided, ..)`. The field inits go through the existing `body_lower_field_init_edge`. |
-| v2.compiler.resolve | `ResolveExpectation`, `resolve_expected_edge`, `resolve_arrow_body_or_named_edge`, `resolve_record_field_edge`, `resolve_list_literal_expected` | position rules | The expectation parameter and the four rules that hand it to one child each. `ResolveContext` is unchanged. |
-| v2.compiler.resolve | `resolve_construct_walk`, new `resolve_construct_walk_with_tag`, `resolve_elided_construct_walk` | writer | The tag is walked once before the fields, and its resolved path is handed to the field rule, so a headless literal nested under an authored head elaborates. The elided arm writes the tag from the expectation (steps 1-5). In `resolve_node_walk`, an elided construct refuses `resolve_anonymous_record_no_expected_type`. |
-| v2.compiler.resolve | `resolve_pattern_node_walk` | reader | A tag-elided PATTERN does not arise (the pattern grammar requires a head). No change. |
-| v2.compiler.infer | Conj gather arms | reader | No change. A tag-elided construct cannot reach infer, because resolve either writes its tag or refuses. |
-| v2.workflow.compile_door_cause_ownership | three rows | ownership | One row per refusal cause. |
-| v2.test.claim.namespace_xl0.reference_conservation_accepted_drops | `a_map_literal_value_refuses_at_the_literal_holds` | control | Today it asserts `unsupported_form` for `Map<String, Bool> = { "k": .. }`. UNCHANGED by this lane: a string-keyed item still refuses at lowering here. It moves with the map arm (gunbc#12734, jolly-boar-246), which gives string keys an edge form and must then read the RESOLVE outcome. |
-| v2.compiler.eval, v2.std.compilers.target_model, emit | construct gates | reader | No change. They already refuse a non-reference tag after #12701. PR2 adds a control proving an elided construct cannot reach them. |
-
-## Scope: which of the seven Form B admits
-
-THE READING THAT SET THIS LANE'S SCOPE, not a standing fact. It comes from a one-off probe on main
-7f144278c57: each file's source was run through the parse and normalize route of
-`v2.test.claim.namespace_xl0.reference_conservation` `conservation_subject`, and the first fatal was
-rendered through the parse's `SpanIndex`. Only the FIRST fatal per file is shown, so a file can have
-later blockers. The standing instrument is the #12550 base-vs-head native census, run on PR2's head.
-It re-derives which of these files are admitted, and PR2 cites that census rather than this table
-(DESIGN §6: name the instrument, never transcribe its output).
-
-| File | First fatal refusal (line) | Form | Form B admits it? |
-|---|---|---|---|
-| dag/std/algebra | 359, `{ name: "filter", .. }` | the body of `fn collection_filter_shape() -> AlgebraFieldTemplate`; 88 more rows of the same record inside list literals | yes: declared return, and list element |
-| dag/std/primitives | 17, `data char_at_contract: PrimitiveContract = {` | data initializer | yes |
-| dag/std/termination | 45, `data .. : BoundedLattice<DescentEvidence> = {` | data initializer, generic, newline-separated fields | yes, by HEAD lookup: `BoundedLattice` resolves to a single record. Its type argument is not substituted and chooses nothing, and none of its field inits is headless. The newline separator is to be confirmed in PR2. |
-| dag/extdeps/realization/compile_stage_memo | 39, `key_derivation: {` | record field under a headless data initializer (lowering refuses the inner brace first) | yes: data initializer plus record field |
-| dag/extdeps/realization/parse_table_memo | 50, `key_derivation: {` | same | yes |
-| dag/std/types | 5, `data kernel_type_set: Map<String, Bool> = {` | MAP literal | **no: MAP arm.** Reaches the elided-tag writer in resolve and refuses located `map_literal_construction_not_modeled`, as a declared population (below). |
-| src/v2/std/host_transport | about 119, `reason: ^emit_host_runtime_row_..` | **caret symbol literal** (`body_lowering_reason_caret_symbol_not_lowered`), not Form B | **not by Form B alone.** Its first blocker is the caret form. Its Form B site (`RuntimePrimitive { value: { .. } }`, record field) is admitted by this lane, but the file stays refused until caret symbols lower. That is #12420 (vivid-ant-536), so PR2 lists it as depending on #12420. |
-
-**The map arm (ruling, gentle-koi-724).** This lane builds the ONE elided-tag writer (in resolve) and its
-RECORD arm. At that same site, a headless brace whose expected head is `Map` takes the MAP arm, which
-refuses located `map_literal_construction_not_modeled`, with its ownership row. It is not left as
-`unsupported_form`, and there is no second site later: map construction plugs into this arm.
-
-For lowering to reach the site, a string-keyed item needs a field-edge form. It lowers to the same
-tag-elided construct, with each item carried as a `map_literal_entry_marker` edge to a
-`(key, value)` pair. Lowering still does not pick map or record; a construct that mixes name keys
-and string keys refuses at lowering, located at the first key of the other kind.
-
-The refusing population is DECLARED, as a `gunbc.rung_drop` row. Population: `dag/std/types` plus
-every other map-literal file the base census locates, named. Restoration trigger: map construction
-is modeled, so a `Map<K, V>` expected type elaborates the literal to a value that inhabits it, linked
-to the open question on the XL-2 row
-(`unrecognized_primary_expression_lowers_to_its_first_atom_at_v2_body_lowering`).
-
-If `dag/std/types` staying refused still blocks the native seven transitively, the map arm is on the
-critical path; the parent dispatches it.
-
-**The seed.** The seed choosing by field names is not an oracle. If it chooses WRONGLY for a real
-file, meaning the chosen struct differs from the declared type, that is a silent seed defect, and PR2
-files a `gunbc.recurring_failure_mode` receipt for it.
-
-## PR2 (the cut) and its controls
-
-1. `data x: T = { f: v }` lowers, resolves and elaborates to a node whose `content_hash` equals that
-   of `data x: T = T { f: v }`. Content equality with the headed form. The authored-tag token occurrence
-   is the one expected difference. `v2.std.node` `content_hash` folds only kind, edge labels and
-   children, so it should fall outside the hash. PR2 confirms this by execution. If it does not, the
-   control compares the occurrence-erased projection, and says so.
-2. A tag-elided literal with no expected type (a `let` without an annotation) refuses
-   `resolve_anonymous_record_no_expected_type`, located at its `{`.
-3. The expected type is a two-constructor coproduct: refuses `resolve_anonymous_record_expected_type_not_record`.
-4. Fields that do not match the chosen record refuse at the field, through the existing construct
-   typing, and not as "no constructor".
-5. **Mutation: choose by field names.** Two records share the literal's field set. The expected
-   type names the one declared SECOND. The control asserts the declared type's path is chosen. A
-   field-name chooser picks the first or refuses as ambiguous, so it goes red either way.
-6. Nesting: `host_transport`'s form, and a two-level `compile_stage_memo` form, each equal to their
-   hand-headed form.
-7. **Infer still checks** (review condition 2): elaboration succeeds, and infer then refuses a field
-   value of the wrong type, located at the field.
-8. **The expectation does not leak** (review condition 3): an anonymous literal passed as a call argument
-   under an annotated data declaration refuses `resolve_anonymous_record_no_expected_type`. A second
-   case puts it in a match-arm body under an annotated fn return.
-9. **Syntactic peel** (review condition 1): a headless literal at a record field declared as the
-   record's own binder (`top: T`) refuses `resolve_anonymous_record_expected_type_not_record`.
-10. An elided construct cannot pass the post-resolve well_formed gate or the target_model gate
-   (a discriminating pair with the headed form).
-11. Evidence: the #12550 base-vs-head native census shows each Form B file of the table admitted,
-   with every other outcome change explained. Seed claims show no true->false.
diff --git a/docs/plans/approval-enrolment-handshake.md b/docs/plans/approval-enrolment-handshake.md
deleted file mode 100644
index 8b9087f647a..00000000000
--- a/docs/plans/approval-enrolment-handshake.md
+++ /dev/null
@@ -1,129 +0,0 @@
-# Approval device enrolment as a handshake
-
-Status: design (node://adhoc-19a8196b-f67, operator scope 2026-09-30). Authority once landed:
-`gunbc.auth.approval_enrolment_handshake`. This page states the design; the model is the fact.
-
-## The defect this replaces
-
-Today one POST both consumes the enrolment code and mints the enrolment
-(`gunbc.auth.approval_device_redemption` `commit_enrolment`: slot generation 1 `code` → 2
-`enrolled`). A phone whose POST gets no decodable answer holds `SubmissionUnknown`, and the only way
-out is a readback authenticated by the *enrolled* App Attest key. For an enrolment that never
-existed, that read can only refuse, and a bare refusal is not proof of absence. So the phone can't
-safely discard its keys, can't reuse its code, and has no typed exit. On 2026-09-30 an operator's
-phone sat in exactly that state after a front-door 404 (the device routes were unrouted), with an
-expired code the server had never spent.
-
-The operator's requirement: **enrolment must never be a death sentence.** Every phone state has a
-typed exit, and the phone may always start over safely.
-
-## The one invariant
-
-> **An enrolment can decide only if it is ACTIVE, and it becomes ACTIVE only on a signature by its
-> decision key over a server challenge issued for that enrolment.**
-
-Everything else follows. A phone that discards its prepared keys can't produce that signature, so
-nothing it discarded before sending the ACK can ever become ACTIVE. The worst case is a PENDING
-record nobody holds, and PENDING lapses at its deadline on its own. **So a handshake ends by expiry
-or by either party walking away, and the phone never has to tell the server it is leaving**
-(operator refinement, 2026-09-30). Cancel is a local discard of the prepared keys. The one state
-where a discard can leave something behind is after the ACK may have landed (see
-*ConfirmUnknown*). What it leaves is an ACTIVE enrolment whose decision key no longer exists
-anywhere, so it can never sign a decision.
-
-## The server record: one CAS slot per code
-
-The code stays the identifier (one thing typed, one slot). The slot's generations form a line, and
-each write is a compare-and-set expecting the generation before it
-(`std.durable_compare_and_set`), so two writers can never both win:
-
-| gen | record | written by | reached from |
-|---|---|---|---|
-| 1 | `IssuedCode { code, login, issued_at, expires_at }` | code issue verb (operator, via fleet-converge) | absent |
-| 2 | `Pending { enrollment_id, login, platform, decision_key, attestation, submitted_at, pending_deadline, confirm_nonce }` | SUBMIT (SYN) | 1, code live |
-| 3 | `Active { …pending, confirmed_at }` | CONFIRM (ACK) | 2, before `pending_deadline` |
-| 4 | `Revoked { …active, revoked_at, reason }` | operator revocation | 3 Active |
-
-**The PENDING deadline is read, not swept.** A `Pending` observed at or after `pending_deadline`
-*reads* as `Lapsed`, and CONFIRM refuses it. Nothing is ever written to end a handshake. This is the same pattern
-the code already uses for its own window (`expires_at` compared at observation by
-`utc_instant_before`). No background writer is needed and none can be forgotten.
-
-*Stated divergence (DESIGN §3b, leasing):* the brief said "std.temporal_effect lease". Its
-`HeldLease` models an observed running process, `std.durable_exclusive_hold` has no deadline, and
-`std.scoped_authorization` `OperatorGrant.expires_at` is an operator's grant, not a party's
-provisional hold. So the deadline follows the enrolment code's existing `expires_at` pattern in
-this module. If a deadline-bearing hold is ever added to std, this record should inhabit it.
-
-## The legs
-
-| leg | route | authenticated by | effect |
-|---|---|---|---|
-| SYN | `POST /approve/device/enrol` `{code, platform, decision_key, evidence, push}` | the code (bearer secret) + App Attest attestation over the transcript | gen 1→2 `Pending`; answers SYN-ACK |
-| SYN-ACK | (the SYN's answer) `{enrollment_id, confirm_challenge {nonce, pending_deadline}}` | — | — |
-| ACK | `POST /approve/device/confirm` `{enrollment_id, signature}` | **decision key** signature over `confirm_signing_input(enrollment_id, nonce)` (one Face ID at enrolment; operator-confirmed 2026-09-30) | gen 2→3 `Active`; answers `{standing: active}` |
-| STATUS | `POST /approve/device/enrolment-status` `{code, requested_at}` | possession of the code | none; answers the closed status |
-
-**SYN is idempotent.** A SYN against a `Pending` slot whose stored decision key and attest key id
-equal the request's answers the *same* SYN-ACK (same `enrollment_id`, same nonce, same deadline)
-and writes nothing. A SYN against a slot already at gen 2+ with a *different* key refuses with
-`code_already_used`. That's the only way a spent code refuses, and it can't be reached by the phone
-that spent it.
-
-**STATUS is authenticated by the code.** Every state has a code, and the phone holds it from the
-moment it's typed. So one authentication covers every state, including states where the server
-holds no key for the phone (gen 1, absent). The answer is a closed set:
-
-```
-NeverSubmitted     gen 1, code live           → phone may SYN (again)
-CodeExpired        gen 1, code past expires_at → phone discards, needs a new code
-CodeNotIssued      slot absent                 → phone discards, needs a new code
-Pending { enrollment_id, confirm_challenge }  → phone confirms (ACK), or walks away
-Lapsed                                         → gen 2 past its deadline; phone discards
-Active { enrollment_id, decision_key_matches: Bool }  → phone adopts iff its key matches
-Revoked                                        → terminal, phone discards
-```
-
-`Active` answers whether the stored decision key equals the one in the request's proof. That's
-why STATUS also carries the phone's decision key: a code holder learns only whether *its own* key
-is the active one.
-
-## Phone states and their exits (every one typed)
-
-| phone state | how it's left |
-|---|---|
-| `Unenrolled` | code typed → `Prepared` |
-| `Prepared` (keys made, nothing sent) | SYN → `SubmissionUnknown`; Cancel → discard → `Unenrolled` (nothing left the phone) |
-| `SubmissionUnknown` (SYN may have landed) | SYN-ACK → `Pending`; STATUS: `NeverSubmitted` → resend SYN; `Pending` → `Pending`; `CodeExpired`/`CodeNotIssued`/`Lapsed` → discard → `Unenrolled`; `Active`+match → `Enrolled` (impossible without an ACK, answered for completeness) |
-| `Pending` (SYN-ACK held) | ACK → `ConfirmUnknown`; Cancel → local discard → `Unenrolled` (the PENDING lapses unaided) |
-| `ConfirmUnknown` (ACK may have landed) | `{standing: active}` → `Enrolled`; STATUS: `Active`+match → `Enrolled`; `Pending` → re-ACK; `Lapsed` → discard → `Unenrolled`. Cancel → local discard. If the ACK had landed, the ACTIVE record is left with a decision key that no longer exists: inert for deciding, and removed by the operator's existing revocation. The phone shows that consequence before discarding here. |
-| `Enrolled` | revocation, key invalidation (existing) |
-
-Cancel is the operator's existing local Cancel button, and it stays local: no route, no signature, no server write. The phone never has to revoke or abandon anything (operator refinement, 2026-09-30); a server-confirmed withdraw route is explicitly not the design.
-
-## RED per transition (a lost answer at each leg)
-
-Each row is a claim in the PR. It names the state the phone holds, what was lost, what the server
-holds, and the typed exit the phone must take. The RED is the mutation that must make it fail.
-
-| # | lost | server holds | phone exit | RED |
-|---|---|---|---|---|
-| R1 | SYN never arrived | gen 1 live | STATUS→`NeverSubmitted`→resend | STATUS on gen 1 answers anything but `NeverSubmitted` |
-| R2 | SYN-ACK lost | gen 2 `Pending` | resend SYN → same SYN-ACK, one record | a repeated identical SYN writes or answers a different nonce |
-| R3 | SYN with another key | gen 2 | `code_already_used` | a second key's SYN is admitted or overwrites |
-| R4 | ACK never arrived | gen 2 | STATUS→`Pending`→re-ACK | a PENDING record decides a redemption |
-| R5 | ACK answer lost | gen 3 `Active` | STATUS→`Active`+match→`Enrolled` | STATUS answers `Active` without the key match, or matches a foreign key |
-| R6 | ACK after deadline | gen 2 past deadline | refuse → STATUS `Lapsed` → discard | a lapsed PENDING confirms |
-| R7 | phone walked away (Cancel) | gen 2 | deadline lapses → reads `Lapsed`; a new code enrols afresh | a lapsed PENDING reads `Pending`, or blocks a new code |
-| R8 | two ACKs (retry after a lost answer) | gen 2 or 3 | the second answers `active` idempotently | a repeated ACK writes a second record or refuses a confirmed enrolment |
-| R9 | code expired unspent | gen 1 past expiry | STATUS→`CodeExpired`→discard | an expired code reads `NeverSubmitted` |
-| R10 | ACK with a key other than the pending one | gen 2 | refuse | a signature by any key but the pending decision key activates |
-
-## Migration
-
-This replaces generations 2 and 3 of the enrolment slot (`enrolled`, `revoked` → `pending`,
-`active`, `revoked`). It's a replacement migration cut at the root (DESIGN §3): the
-store on srv1 holds **no** enrolled record today (only two expired gen-1 codes), so there's no
-persisted population to carry. The redemption path (`device_redemption_admission`) reads `Active`
-where it read `EnrolmentCodeConsumed`, and every enrolment-only route that took the enrolled
-standing takes `Active` and nothing else.
diff --git a/docs/plans/arrow-contract-edges.md b/docs/plans/arrow-contract-edges.md
deleted file mode 100644
index 3763fc13eff..00000000000
--- a/docs/plans/arrow-contract-edges.md
+++ /dev/null
@@ -1,89 +0,0 @@
-# Arrow contract edges (XL-2 PR2a)
-
-Parent design: [service-interface-and-uses-carriers.md](service-interface-and-uses-carriers.md) (#12851). Ruling: the side chat, 2026-10-01, option A, admitted with no operator sign-off needed. The ruling forbids four things, none of which this change does: a new connective or behaviour, an annotation bag, unknown labels, and a second carrier for one fact.
-
-## What lands
-
-An Arrow may carry three optional **contract edges**. The first two (effect claims and execution mode) landed in PR2a. The third (resource requirements) landed with D13 step (a); see the section on it below.
-
-| Edge | Target shape | Vocabulary home | Admitted labels |
-| --- | --- | --- | --- |
-| `^arrow_effect_claims_edge` | NONEMPTY Conj of self-named childless Atoms, no label twice (no claims has one form: the absent edge) | `std.effects` `EffectClaim` (`ReadonlyClaim`, `IdempotentClaim`), new here | `readonly`, `idempotent` |
-| `^arrow_execution_mode_claim_edge` | one childless Atom | `std.execution_mode` `ExecutionMode` (existing) | `hermetic` (only `Hermetic` is claimable) |
-| `^arrow_resource_requirements_edge` | one of THREE declared forms: a NONEMPTY Conj, one Named edge per member (label = spelling, target = type reference); the childless Atom `^requirements_declared_none` (`requires none`); the childless Atom `^requirements_opaque` (`requires opaque`). An ABSENT edge is an undeclared operation, read as Undecided (see the reversal below) | the open set of `resource` declarations, checked at resolution (`v2.std.symbol_index` `symbol_index_declares_resource_at`) | any declared resource, each at most once by resolved declaration |
-
-`hermetic` is kept off the effect claims: it says where the Arrow may run, not what its effect does. The surface `OperationModifier` stays one syntax vocabulary (`v2.extdeps.languages.dag` `dag_grammar_op_modifier_expr`), and lowering (PR2c) projects each arm to its home.
-
-**Three layers, one fact each:**
-- **Structure: `v2.std.node`.**
-  - `arrow_named_edge_is_contract`.
-  - `arrow_named_edge_is_non_binder`, the one predicate every count of an Arrow's binders reads, here and in `v2.std.type_binder` `arrow_named_labels_conform`, which no longer restates an allowlist.
-  - `arrow_signature_edges_conform`: at most one of each contract edge, and never a binder. This module names no claim or mode.
-- **Vocabulary: the homes.** `std.effects` `EffectClaim` and `std.execution_mode` `ExecutionMode`.
-- **Spelling and check: `v2.std.arrow_contract`.**
-  - `effect_claim_label` and `execution_mode_claims_label` are exhaustive matches over the home types. They are the only place the surface spellings appear, so a variant added to a home must be decided there.
-  - `arrow_contract_conforms` checks each contract edge's target against the homes. `v2.std.type_binder` `type_binder_node_conforms` runs it on every Arrow.
-
-**Declared residue (🟡).** A label is admitted by comparing it against each claimable variant's projection (`effect_claim_label_is_admitted`, `execution_mode_claim_label_is_admitted`). That is a hand list of the variants, because the language cannot fold over a closed coproduct's constructors. No decoded variant is produced, because nothing consumes one: lowering (PR2c) projects variants to labels, never the reverse. A variant missing from the list is refused, never admitted, so the residue fails closed. **Bound:** two claims and one claimable mode. **Owner:** XL-2. **Trigger:** a language capability to enumerate a closed coproduct's constructors; the list is then derived from the projections and deleted. For the same reason, the edge target is a label checked against the home rather than a value of the home type: a Node edge carries Symbols, and making a wrong claim unwritable would need typed node targets. That is a substrate capability beyond this ruling, which forbids a new connective without operator sign-off.
-
-Properties required by the ruling, and where each is established:
-- **Contract edges are not binders.** `arrow_named_edge_is_non_binder`. Test: `admitted_contract_edges_conform_and_are_not_counted_as_a_binder`.
-- **Duplicates and unknown labels refuse.** Tests: `a_malformed_effect_claim_refuses` and `a_malformed_execution_mode_claim_refuses`. The reds include an empty claims edge (a second identity for "no claims"), `hermetic` among the effect claims, and `wet`, a real `ExecutionMode` that is not claimable. Every test checks both walls, the structural one and `v2.std.type_binder` `type_binder_node_conforms`, so a positive control goes red if `arrow_named_labels_conform` omits either label.
-- **Canonical identity is order-independent, and a claim is part of identity.** Test: `contract_edge_identity_is_order_independent`, over `v2.std.node` `content_hash`.
-- **A claim-free Arrow keeps its identity.** It carries neither edge, so nothing about it changes.
-
-All tests are in `v2.test.claim.arrow_contract_edge_conformance`.
-
-## Readers that must not consume the edges
-
-Audit of every Arrow reader outside `src/v2/test`. "Metadata" means: handled exactly as the declared-order edge is.
-
-| Reader | Today with an unknown named edge | Owed |
-| --- | --- | --- |
-| `v2.std.node` `arrow_signature_edges_conform` | counted as the binder | **this change** |
-| `v2.std.type_binder` `arrow_named_labels_conform` | refuses | **this change**: reads `arrow_named_edge_is_non_binder` |
-| `v2.std.type_binder` `type_binder_node_conforms` | — | **this change**: runs `v2.std.arrow_contract` `arrow_contract_conforms` |
-| `v2.std.type_binder` `node_inferred_subtree_nodes` | walked as inferable | skip every `arrow_named_edge_is_contract` edge. **Landed with D13 step (a)** (the first producer) |
-| `v2.compiler.resolve` `resolve_arrow_node_in` | resolved under the body scope | effect claims and execution mode: carried unwalked. Resource requirements: walked in the Arrow's type scope (no value params), each member must name a declared resource, at most once (`resolve_arrow_resource_requirements`). **Landed with D13 step (a)** |
-| `v2.compiler.infer` `infer_gather_fold_step` / `infer_arrow_signature_order_edge` | inferred as a value child | skip every contract edge. **Landed with D13 step (a)** |
-| `v2.compiler.infer` `infer_product_child_evidence_edges` (the Arrow's derived TYPE) | its type enters the derived type | every contract edge rides as metadata. **Landed with D13 step (a)** |
-| `v2.compiler.translate` `translate_grounding_derived_gate_subtree` | requires grounding for every subtree node | exempt (metadata). **Landed with PR2c-i**: the walk skips a contract edge under an Arrow (`translate_edge_is_arrow_contract`, reading `arrow_named_edge_is_contract`), so a claim payload is never required to carry grounding. Discriminator: `v2.test.claim.translate_underived_refusal` `translate_gates_a_positional_payload_but_not_a_contract_payload_holds` |
-| `v2.std.node` content hash (`canonicalize_arrow_labeled`) | hashes every edge, named edges sorted by label | in the hash, order-independent (tested here) |
-
-Readers that ignore a named edge safely: the domain, codomain and body readers in resolve, infer, eval, translate and `v2.std.compilers.target_model`; `v2.std.node_query`; `v2.std.decl_index`; `v2.compiler.symbol_index_fill`; `v2.compiler.emit_produced`; `v2.compiler.compile`; `v2.std.node` `cost_edge_role`; `v2.lens.cost.copied_port_derivation`.
-
-## Standing: DESIGN §3c, per edge family
-
-The two families have different producers and different consumers, so each has its own standing.
-
-### Effect claims and execution mode (PR2a, produced by PR2c-i): consumer a declared frontier
-
-- **Consumed by execution:** the conformance wall (`v2.std.node` `arrow_signature_edges_conform`, reached by every `well_formed` check of an Arrow) and `v2.test.claim.arrow_contract_edge_conformance`. The pipeline reader arms (resolve carries both unwalked; infer and `type_binder` skip them) landed with D13 step (a), the first producer of any contract edge.
-- **Produced by execution (PR2c-i):** the operation-modifier lowering (`v2.compiler.body_lowering_fold` `body_lower_operation_modifier`) emits both edges from `readonly`, `idempotent` and `hermetic`, and refuses a repeated modifier at the second (`v2.test.claim.normalize.operation_modifier`). `translate_grounding_derived_gate_subtree` carries them as metadata in the same change.
-- **Consumer of the claims themselves, still a declared frontier:** no stage yet reads an effect claim or the execution mode to decide anything (retry admission, caching, hermetic placement). Trigger: the first such reader lands and consumes the edge off the operation Arrow; until then the conformance wall and the reader arms are the consumers.
-- **Why ahead of the consumer:** the 2026-10-01 ruling asked for the substrate change to be reviewable on its own diff.
-
-### Resource requirements (D13 step a): producer landed, demand consumer a declared frontier
-
-- **Produced and consumed by execution in step (a):** `body_lower_operation_requires` emits the edge from an operation's `requires` clause. `v2.compiler.resolve` `resolve_arrow_resource_requirements` reads it on every resolved operation Arrow and refuses a member that is not a declared resource or that repeats one. Controls: `v2.test.claim.normalize.operation_requires_edge`. That is a conformance consumer: it establishes that the requirement names real resources. It does not use the requirement.
-- **Production consumer of the requirement itself, a named later change:** D13 step (b), the DependencyDemand derivation. A function's demand is the union of three parts: its direct resource operations; for each service operation it calls, that callee Arrow's `^arrow_resource_requirements_edge`; and its resolved callees' demand. That is how a `net: Network` requirement becomes derived instead of authored, which is the restoration trigger of `gunbc.rung_drop` `network_requirement_unrepresented_after_uses_cut`.
-- **Transition trigger, at executable grain:** step (b) lands, and its derivation reads this edge off the callee operation's Arrow into the calling function's derived demand. Executed evidence is a control in which a function calling an operation that `requires Network` derives demand naming `std.resources.Network`, and that demand disappears when the clause is removed. Reading the edge only for conformance, or adding Network to demand by spelling, does not satisfy the trigger.
-- **If step (b) is abandoned:** the `requires` grammar member, `body_lower_operation_requires`, the `^arrow_resource_requirements_edge` label and its at-most-one count, its target check in `v2.std.arrow_contract`, and `resolve_arrow_resource_requirements` with its two refusal reasons are deleted. The resource declaration's index mark (`symbol_index_declares_resource_at`, from #12898) then has no reader left, so it is deleted with them, along with its `resource_declarations` carrier.
-
-## Not in this change: input defaults
-
-Per the ruling, a default belongs to the binder and not to its type. One binder representation (a required type, an optional single default, closed labels, one reader and builder) serves fn parameters, service io fields and record fields. That changes the existing name-to-type binder shape, so it is a replacement migration (DESIGN §3) and is PR2b: its producers and readers are measured first, then all move together.
-
-## Third edge: resource requirements (D13 step a)
-
-`^arrow_resource_requirements_edge` (`v2.std.node` `arrow_resource_requirements_label`) is the operation's declared `requires R, ..` (`v2.extdeps.languages.dag` `dag_grammar_op_requires_expr`), lowered by `v2.compiler.body_lowering_fold` `body_lower_operation_requires`. Its target is a nonempty Conj with one Named edge per member: the label is the member's spelling, and the target is its type reference. Unlike the two claim edges, it names DECLARATIONS from an open set, so `v2.compiler.resolve` walks it and checks each member against `v2.std.symbol_index` `symbol_index_declares_resource_at`. It is the first producer of any contract edge, so the pipeline reader arms above landed with it, for all three edges. Controls: `v2.test.claim.normalize.operation_requires_edge`.
-
-### Reversal: an absent requirements edge is UNDECLARED, not "none" (D13 ruling B)
-
-**This reverses #12911**, where "no requirements has one form, the absent edge". D13 step (b) derives a function's demand from the operations it calls. Under the old reading, every operation nobody audited, and every one added later, would silently read as requiring nothing. That is the fail-open default DESIGN section 5 forbids, so the lane owner ruled it out (option B). Every operation now declares one of three forms, all on this one edge, with no second carrier:
-
-- `requires R, ..`: the named resources, checked at resolution as above.
-- `requires none`: **no requirement in the audited vocabulary.** Today that vocabulary is `Network` only (the D13 Network audit, `docs/plans/d13-network-audit.md`). It is not a claim about Filesystem, Clock or Entropy: their demand derives from direct capability calls and is never authored. When the audited vocabulary grows, the meaning of `none` grows with it, and the rows are re-audited.
-- `requires opaque`: the operation's demand is decided by runtime values (a generic exec, `shell.exec Run`, `systemd-run`, a runtime-program runner), so a caller's derived demand is **Undecided**, a located refusal at the uses-wall, never empty.
-
-An operation with no clause carries no edge. Step (b) reads that as **Undecided**, exactly like `opaque`, so silence can never mint "none". The grammar (`dag_grammar_op_requires_expr`) makes `none` and `opaque` whole clauses: a member after either refuses. The v1 seed carries the same three forms (`v1.compiler.parse` `operation_requires_declaration`: `RequiresUndeclared | RequiresNone | RequiresOpaque | RequiresResources`). Controls: `v2.test.claim.normalize.operation_requires_edge` and `test.claim.v1_operation_requires_parse_witness_test`.
diff --git a/docs/plans/arrow-elimination-model.md b/docs/plans/arrow-elimination-model.md
deleted file mode 100644
index 44614d3bd65..00000000000
--- a/docs/plans/arrow-elimination-model.md
+++ /dev/null
@@ -1,125 +0,0 @@
-# Arrow elimination in v2 infer — model for ruling
-
-Status: RULED by v2 foundation (neat-boar-16), 2026-09-26, and implemented in the PR that
-carries this file. Rulings: Int's value type is owned by `v2.std.integer`
-(`integer_int_type_node`) as Bool's is by `v2.std.logic` (`bool_node`); `dag_binding_denotation`
-stays the one binding→type join and its rows point at those authorities. Elimination reads the
-DECLARED return atom, never the composed evidence. The composed-evidence defect is rostered as
-`gunbc.recurring_failure_mode` `function_type_evidence_carries_its_body`.
-
-Found while building: the evaluator carried the same second representation for Bool
-(`v2.extdeps.runtimes.v2_evaluator` `v2_eval_bool_literal_pin` as every Bool runtime value's
-type), so eval's resolved-type acceptance refused the derived Bool application with
-`eval_rejected_resolved_type_mismatch`. Bool runtime values now carry `bool_node()`; the pin
-remains only as the evaluator's literal-shaped node for `true`. The evaluator's Int copy
-(`v2_eval_int_type_node`) is deleted in favour of `integer_int_type_node`.
-Trigger: work item "v2: infer derives a Bool-returning application", parent `deep-bee-18`,
-consumer `v2.compiler.refinement_discharge`.
-
-## What was measured (main `21f4d0c390`, a locally built `gunbc run` over a probe entry)
-
-| application `Transform[Arrow(Conj{x: Int}, R, body), 1]` | infer | root facts | eval |
-|---|---|---|---|
-| R = Int, body = int literal | Accepted | GroundingNotDerived | `eval_rejected_grounding_not_derived` |
-| R = Bool, body = `true` | Accepted | GroundingNotDerived | `eval_rejected_grounding_not_derived` |
-| R = Int, body = `true` | Accepted | GroundingNotDerived | — |
-| R = Bool, body = int literal | Accepted | GroundingNotDerived | — |
-
-`infer_compatible_argument_admits` asserts only `Accepted`, so it never witnessed derivation.
-
-## The slice, re-derived (DESIGN §6b)
-
-1. **Return type atom → its grounding.** `v2.compiler.infer` `infer_node_facts` grounds a
-   binding atom through `v2.extdeps.languages.dag` `dag_binding_denotation`, which declares
-   only `^dag_binding_type_int` and maps it to `dag_int_inhabitant_node` — the *roster record
-   describing* Int (inhabitant atom + surface spelling), not the Int type. Bool has no row, so
-   a Bool return atom stays on the frontier, and so does its Arrow (the product row needs every
-   child).
-2. **Arrow introduction.** Nothing compares an Arrow's body type to its declared return. The
-   Arrow product row composes children's evidence — including the body's — into the Arrow's
-   "type".
-3. **Arrow elimination — the earliest unjustified boundary.**
-   `infer_transform_derived_optional` derives a type only for binary Int add and casts. No rule
-   types `f(a)` as `f`'s codomain, so NO application derives, Int included. Argument
-   inhabitance (`infer_application_argument_inhabitance`) is judged, then the node falls to
-   the frontier.
-
-## One Int, not two (the unification)
-
-Census of what each form means today:
-
-- `Atom(^dag_binding_type_int)` is the Int **value type** at every consumer: the Int literal
-  rule (`infer_branch_int_binding_type_node`), binary add's unified type, match/branch
-  unification (`infer_branch_type_is_int`), parameter operand types (the declared domain atom
-  via `infer_find_arrow_domain_type_in_tree`), argument inhabitance (declared formal compared
-  structurally to the argument's type), and the evaluator's runtime primitive type
-  (`v2.extdeps.runtimes.v2_evaluator` `v2_eval_int_type_node`).
-- `dag_int_inhabitant_node` (a Conj) is the dag language roster's record about Int. Its only
-  use as a *type* is `dag_binding_denotation` → the binding atom's derived type.
-
-So the fork is `dag_binding_denotation` returning the record. The model:
-
-- **`dag_binding_denotation(sym)` is the single binding → value-type authority** and returns
-  the value type the binding names: Int → `Atom(^dag_binding_type_int)`, Bool →
-  `v2.std.logic` `bool_node()` (the node the Bool literal rule already uses). The Bool row is
-  one more row of the same join, not a special case.
-- **The literal rules consume it** instead of minting their own nodes: an Int literal's type is
-  `dag_binding_denotation(^dag_binding_type_int)`, a Bool literal's is
-  `dag_binding_denotation(^bool_node_symbol)` (bool_node's own identity since gunbc#12785, which
-  derives every kernel row from `dag_kernel_value_type_roster` and deleted the second Bool name). `infer_branch_int_binding_type_node`
-  deletes. (The evaluator's `v2_eval_int_type_node` is the runtime's own copy of that node, and
-  is left to a later cut; it is equal by structure today.)
-- **A type-expression atom's OWN grounding is its kind**, not its denotation:
-  `kind_node(TypeDenotationKind)` (`std.kind`), exactly as a roster type member derives today.
-  This is forced, not chosen: the Int denotation is structurally the atom itself, so taking it as
-  the atom's derived type hits `std.constraints` `canonical_grounding_from_derived_type`'s
-  self-evidence wall — and it was always a category error (the type of the expression `Int` is
-  a type-kind, not `Int`).
-
-## The two rules
-
-**Arrow introduction (body/return check), at the Arrow product row.** When an Arrow carries a
-body edge (`^arrow_body_edge`) and both the body's facts and its declared return atom's
-denotation are derived: the body's value type must equal the denotation, structurally with
-provenance stripped (`infer_type_equal_ignoring_provenance`, the list rule's authority). A
-mismatch refuses with the new reason `^arrow_body_does_not_inhabit_declared_return`, located at
-the body. A body or return that is not derived leaves the Arrow on the counted frontier, never
-admitted.
-
-**Arrow elimination, in `infer_transform_derived_optional`.** For `Transform[callee, args…]`
-whose callee is an Arrow and whose argument inhabitance was admitted: the application's derived
-type is `dag_binding_denotation` of the callee's declared return atom. The derivation requires
-the callee Arrow itself derived (so the introduction check has run). A non-Arrow callee (an Atom
-operator — `FormalUnresolved`), an underived callee, or a return with no denotation stays on the
-counted frontier.
-
-Red and controls owed:
-- Accepting: `R = Bool, body = true` derives Bool at the application; eval of it equals eval of
-  the literal `true` and differs from eval of `false`.
-- Accepting: `R = Int, body = 1` derives Int at the application (same rule, not a Bool case).
-- Red: `R = Bool, body = 1` and `R = Int, body = true` refuse
-  `^arrow_body_does_not_inhabit_declared_return`.
-- The existing argument-inhabitance reds stay red.
-
-## Consumers that see the newly derived facts
-
-- `v2.compiler.eval` `inferred_facts_for_eval` — applications now pass its grounding gate.
-- `v2.compiler.translate` — the `translate_rejected_grounding_not_derived` gate, same.
-- `v2.std.coercion` via `infer_transform_cast_optional` — a cast whose operand is an
-  application is now judged by `coercion_cast_crossing` instead of staying on the frontier.
-- `v2.compiler.refinement_discharge` (deep-bee-18) — the intended consumer.
-- infer's own branch/match/loop unification — an arm that is an application now has a type, so
-  a previously frontier arm pair can now unify or refuse `arm type mismatch`. This is the
-  population the floor has to census.
-- Readers of an Arrow's evidence or a binding atom's resolved type: the return atom's evidence
-  changes from the inhabitant record to the type kind. `v2.test.execution.dag_binding_denotation`
-  counts derivation only and holds either way.
-
-## Questions for the ruling
-
-1. Is `dag_binding_denotation` the right single authority for binding → value type, or should
-   Int's value type live in `std.integer` (as Bool's lives in `std.logic`), with the language row
-   pointing at it?
-2. The Arrow's composed evidence includes the body's type (and `dag_arrow_with_body_node` lists
-   the return atom twice). A function type is domain → codomain. Out of scope here unless you
-   rule otherwise; noted so it is not mistaken for part of this model.
diff --git a/docs/plans/belt-event-driven-obligations.md b/docs/plans/belt-event-driven-obligations.md
new file mode 100644
index 00000000000..9c60c00fc94
--- /dev/null
+++ b/docs/plans/belt-event-driven-obligations.md
@@ -0,0 +1,125 @@
+# Belt demotion: event-driven attempt obligations
+
+Status: implemented on gunbc#13125. This is the design for items #6 and #4 of [dogfood-route-manual-interventions](dogfood-route-manual-interventions.md), and it executes the owner ruling "The belt demoted: wake-up and anti-entropy only" (2026-09-22, [harness-work-lifecycle](harness-work-lifecycle.md)).
+
+The model's homes are the factory controller, which owns wake-ups and event delivery, and the factory attempt lifecycle. `factory-dogfood-route` (gunbc#13077) only consumes their receipts and carries a gating edge on them.
+
+## The defect, re-derived (DESIGN §6b)
+
+`gunbc.roadmap_belt_actuate` `belt_tick_for_instance` was one process that ran, in order:
+- launch admission, spawn and teardown;
+- commit, then verify, then review and audit, then publish, then metering, over every attempt;
+- then, in `gunbc.roadmap_belt_tick_cli`, the result return, the served observation, the dogfood start record and the snapshot census.
+
+The earliest unjustified boundary was not a slow stage. It was the claim, implicit in that one function, that these are one fact. They are separate facts:
+- each attempt's capture, verify, review, audit and publish is an obligation of that attempt alone;
+- launch is an obligation of the frontier;
+- each instance fold is an obligation of the instance.
+
+Fusing them made every stage's latency every other stage's latency. On srv2, from 06:50 to 16:30 on 2026-10-03, one SCM capture held every tick at its 90-minute bound, and nothing behind it ran for any attempt.
+
+## What was built
+
+### Obligations (`gunbc.roadmap.roadmap_belt_obligation`)
+
+- **Per-attempt kinds:** capture, verify, review, audit, publish.
+- **Instance kinds:** launch, served observation, result return, metering, dogfood start record, snapshot census.
+- **Outstanding is derived, never stored.** `belt_attempt_outstanding` reads the attempt's projected segments, so no second record repeats what the receipts say (ruling Q1).
+- **A failed or refused stage is not outstanding.** The line stops for that attempt only, and the operator resumes it, per the 2026-10-03 manual-resume ruling.
+
+### One unit per attempt, one per instance obligation
+
+- **Why per attempt.** Every `gunbc run` loads the corpus, measured at about 60 s and about 8 GB peak RSS for a typecheck. A unit per (kind, attempt) would pay that once per kind.
+- **What the attempt's unit does.** It is `gunbc-obligation-attempt-<node>-<attempt>`, running `belt_attempt_obligations_cli`. It runs the attempt's outstanding kinds in eligibility order (`belt_attempt_obligations_run`), re-observing after each one, and stops at the first that waits on something outside the process.
+- **Each kind is still its own ensure** over the core the tick used to call per attempt. Each core is idempotent over unchanged evidence.
+- **The unit name is the exclusive hold.** `belt_obligation_hold_decision` reads the manager for that one name: a loaded unit is held, an unreadable answer refuses, anything else starts. Another attempt's unit never reaches the decision. That is the #6 isolation.
+- **Deadline.** `RuntimeMaxSec` is the obligation's deadline, and `CollectMode=inactive-or-failed` lets the name be reused after a failure.
+- **Grain ruling.** bold-bee-114 agreed to the per-attempt grain on 2026-10-06.
+
+### Exit records (`gunbc.roadmap.roadmap_attempt_exit_spool`)
+
+- **Who writes them.** Worker, reviewer and auditor units end with a create-only exit record. Their `ExecStopPost` is a typed argv: `+mkdir -- <inbox>/<node>+<attempt>+<role>+${INVOCATION_ID}+${SERVICE_RESULT}+${EXIT_CODE}+${EXIT_STATUS}`.
+  - No shell is involved. This follows bold-bee-114's ruling against shell control text in minted commands.
+  - The `+` prefix runs only the hook outside the unit's sandbox, so a confined reviewer cannot forge records.
+  - The stop-time variables and the command-line rendering are modeled in `extdeps.systemd.service_exec`.
+- **RemainAfterExit is removed from worker, reviewer and auditor units.** This reverses the 2026-09-05 choice. That choice kept a successful exit readable as `active (exited)`, which is manager memory: it is lost on reboot, and while it stands the unit never stops, so no stop hook can fire at exit. The record replaces it.
+- **The supervisor keeps RemainAfterExit.** Moving its convene gate onto the record is a follow-up.
+- **Observer conditions (bold-bee-114):**
+  - A collected unit is read from its record.
+  - A collected unit with no record is unobserved, never "never ran". The start receipt (the G5 placement record for workers, the metering roster entry for reviewers and auditors) separates "never started" from "exited without a record".
+  - A failed hook surfaces as that located unobserved arm.
+  - One wet control reads the exit verdict from the spool alone.
+- **Signals.** A signaled worker reads as the signal number, which is exactly what `ExecMainStatus` reported, so no consumer's decision moves. A distinct signaled arm on `WorkerProcessEvidence` is a follow-up.
+
+### Events, not a timer (`gunbc.live_deploy`)
+
+- **No belt timer.** The deployment member is `BeltEventPathUnit`, which installs:
+  - the exit path unit, a `DirectoryNotEmpty=` level on the exit inbox and on `queued/`, which starts the drain service (`belt_exit_drain_cli`);
+  - the publication-answer path unit, a `PathChanged=` edge on the answer directory, which starts the discovery service (`belt_discover_once_cli`);
+  - the spool stages: inbox, queued, running, done and refused.
+- **The drain** hands each recorded exit to its attempt's unit and moves it to `queued/`, or to `refused/` when it cannot be handed off, so the inbox path goes quiet. It then **sweeps `queued/`**: every attempt that still has an unclaimed entry there is enqueued again (a held unit is a no-op; a gone unit is started). A worker exit also queues the launch obligation.
+- **Queued is a level, and acknowledgment is bound to a run** (bold-bee-114, 2026-10-09). The exit path unit watches `inbox/` and `queued/` with `DirectoryNotEmpty=`. An attempt's run first **claims** its population, the create-only move `queued -> running` of every entry for the attempt (an entry whose exit was recorded before the run's first observation, so the run is guaranteed to have seen it). The receipt names the claim (`claimed_exits`), and only after it is written does the run move exactly that claim `running -> done`. A later arrival is never in the claim, so it is never acknowledged by a run that did not observe it; it stays `queued`, the level starts the drain, and the sweep hands the attempt to a new run. A held unit is not proof the active run includes a new event. A run that finds `running` entries for its attempt adopts them (the unit name is the exclusive hold, so they are a dead predecessor's). The run makes at most `belt_attempt_obligation_pass_bound` passes, re-claiming when an arrival is already queued; the bound leaves the rest to the level. Controls: `test.claim.roadmap.roadmap_belt_exit_drain_wet_witness_test` cuts A (exit after the final observation, before settlement), B (after settlement, before the unit exits) and C (unit or host gone while queued, or dead claim).
+- **A claim orphaned with no new event is recovered** (bold-bee-114, 2026-10-09). The path unit does not watch `running/`: a long verify legitimately holds it, so a level there would re-trigger while the run lives and fail the path unit at its rate limit. Two routes instead.
+  - **Claimant-terminal rescue.** The attempt unit's own `ExecStopPost` (typed argv, no shell) records an `obligation`-role entry in the inbox whenever the unit ends, including at its `RuntimeMaxSec` bound. The inbox level starts the drain; the drain reconciles every `running` entry whose unit is not live back to `queued`, consumes the obligation entry (inbox to done, never enqueued, only once the unit is gone) and its sweep starts the attempt again, which adopts the claim. A settled run leaves nothing to reclaim, so this cannot loop.
+  - **Boot reconciliation.** The drain service is `WantedBy=multi-user.target`, so a host or user-manager restart (no stop hook ran) runs one drain that does the same reconcile.
+  - Controls in `roadmap_belt_exit_drain_wet_witness_test`: a lone orphaned claim, a claim held by a live unit not reclaimed, a claimant killed at its run bound, and a settled run's hook entry consumed without starting anything.
+- **Stated cost.** An unclaimed arrival that lands while its attempt's unit is held restarts the drain (a corpus load) repeatedly until that unit's pass re-claims or the unit exits; this wastes work and loses nothing. A stuck `running` or `queued` entry is the backlog row's `StaleBacklog`.
+- **Launch** is the demoted tick: admission, spawn, teardown and bounded discovery. It has one unit name per instance. The deployment's belt service only queues it (`belt_launch_enqueue_cli`).
+- **Deadlines need no wake-up timer.** Every awaited unit (worker, reviewer, auditor) has its own run bound, and ending at that bound writes an exit record like any other ending. The deadline is therefore an event too.
+
+### Discovery, bounded
+
+`belt_discover_for_instance` reads every current attempt's evidence and hands at most `belt_discovery_attempt_bound` owed attempts to their units, plus the instance obligations a moved record makes owed. It never does the work, and nothing requires it to run on a cadence.
+
+### Receipts and the page
+
+- **Tick receipt v7:** spawn, teardown and discovery passes.
+- **Per-attempt obligation receipt:** `receipts/obligations-<node>-<attempt>.json`, consumed by `/workflow.json`. Its decoder is total and subject-bound: node and attempt must equal the requested subject, `observed_at`, the claim and the standing are validated, every step is decoded (each kind at most once, no unknown kind, no malformed pass) before verify is projected. A pending verification now shows that attempt's own verify step.
+
+### The RLM launch receipt
+
+bold-bee-114 ruled on 2026-10-06:
+- **Timer row replaced.** The two event path units must be loaded, enabled, armed and aimed at the emitted target.
+- **Tick freshness replaced by an event backlog row.** An exit-spool entry unconsumed past its stage's bound refuses with `StaleBacklog`, naming the oldest entry. An armed path unit proves the watcher is armed; the backlog row proves events are consumed.
+- **Declared rung drop.** The publication-answer half has no consumption record yet, so it is declared as `gunbc.rung_drop` `belt_liveness_publication_answers_unconsumed`.
+
+## REDs, and where they run
+
+- **#6:** `test.claim.roadmap.roadmap_belt_obligation_witness_test` `a_long_verify_does_not_delay_another_attempts_publish_or_the_observation`.
+- **#4, deployment half:** `the_deployment_wakes_the_drain_on_an_exit_and_installs_no_belt_timer` in the same file.
+- **#4, hand-off half:** `test.claim.roadmap.roadmap_belt_exit_drain_wet_witness` `a_recorded_worker_exit_is_handed_to_its_attempt_and_leaves_the_inbox`. This runs a real spool on the local-repo wet lane.
+- **Worker hook:** `test.claim.roadmap.dispatch_worker_confinement_witness_test` `the_worker_unit_stops_with_its_process_and_writes_its_exit_record`.
+
+## Conformance (DESIGN §3b)
+
+- **Leasing / locking:** the hold is the manager's unit-name uniqueness. It diverges from `std.durable_exclusive_hold`, for a stated reason: the subject is the manager's own unit population, and a second store would be a second authority for which unit is running.
+- **Materialization / realization:** obligations reuse the existing per-attempt cores, with no second copy.
+- **Process observability:** each obligation writes its own receipt, the page reads the attempt's own receipt, and the launch receipt carries liveness against events.
+
+## Follow-ups, stated
+
+- **One PR per work item.** Publication still keys the PR by the attempt branch. The publish obligation is idempotent per attempt (it observes before creating), not per work item. Raised with bold-bee-114 on 2026-10-06.
+- **Publication helper.** It still runs on its own timer (`PublicationHelperTimerUnit`), under a separate principal.
+- **Supervisor units** keep RemainAfterExit.
+- **`WorkerProcessSignaled`.** The process model has no signaled arm yet.
+- **Publication-answer consumption record.** This is the rung drop's restoration trigger.
+
+## Rulings (bold-bee-114)
+
+- **2026-10-03, Q1:** no `std.obligation` carrier.
+- **2026-10-03, Q2:**
+  - Exits are recorded in an instance-local spool, not `gunbc.roadmap_event_log` (the issue history) or `gunbc.fabric_event_log`, which needs a head compare-and-set per append.
+  - The hook never runs the interpreter.
+  - The hook is a typed `mkdir` argv, with no shell.
+- **2026-10-03, homes and PR identity:**
+  - Homes are the factory controller and the factory attempt lifecycle.
+  - There is one PR per work item. Not yet built; see follow-ups.
+- **2026-10-06, process grain:** per attempt.
+- **2026-10-06, exit records:**
+  - Reviewers and auditors get exit records in this PR.
+  - The deadline is only a typed timeout, never the completion route.
+- **2026-10-06, RemainAfterExit:** removed, with three conditions:
+  - A unit gone with no record reads as unobserved.
+  - A failed hook write is a located refusal.
+  - One control produces the exit verdict from the spool alone.
+- **2026-10-06, RLM receipt:** event path rows, plus the backlog row or a declared drop.
diff --git a/docs/plans/binder-node-representation.md b/docs/plans/binder-node-representation.md
deleted file mode 100644
index b69d1070400..00000000000
--- a/docs/plans/binder-node-representation.md
+++ /dev/null
@@ -1,81 +0,0 @@
-# The binder node (XL-2 PR2b-3)
-
-Parent design: [service-interface-and-uses-carriers.md](service-interface-and-uses-carriers.md).
-
-Rulings (side chat, 2026-10-01):
-- A default belongs to the BINDER, never to its type.
-- One binder representation (a required type, an optional default, closed labels, one reader and one builder) is shared by fn parameters, service io fields and record fields.
-- For the representation, option A: a `Conj` told apart in the way `v2.std.type_binder` tells type-parameter binders apart. That needs no new connective, so no operator sign-off.
-
-## The representation
-
-A binder is still the Named edge `name -> target` inside an Arrow domain, io payload or record payload. Its **target** is now a **binder node**:
-
-```
-Conj {
-  <binder-type>    -> T          (exactly one)
-  <binder-default> -> v          (at most one)
-}
-```
-
-- **Self-identifying labels.** Both labels are interned from lexemes no source can spell, as `type_params_marker` is. A binder node therefore identifies itself from its own labels, with no parent context and no guessing. No authored record field can collide with it: a field spelled `binder_type` interns a different symbol.
-- **One reader.** `v2.std.node_query`: `binder_node_parts`, `declared_field_from_edge` (which now carries `default`), `member_edge_type_node` (now `Optional`), `find_binder_type`.
-- **One builder.** `binder_edge`, `binder_edge_with_default`, `binder_relabelled`. 2b-1 (#12899) and 2b-2 (#12904) routed every reader and every producer through this pair, so the representation changed in these functions alone.
-- **Fail-closed.**
-  - A Named member whose target is not a binder node is **not** a binder. `declared_field_from_edge` answers Absent, `member_edge_type_node` answers Absent, and `find_binder_type` refuses with `^named_child_not_a_binder`.
-  - The **binder wall**, `v2.std.type_binder` `arrow_domain_members_are_binders`, run by `type_binder_node_conforms` on every Arrow, refuses a hand-built domain member at the Arrow.
-  - A record payload the wall does not reach still fails closed at its first reader. `type_decl_view` cannot tell a record type from a module body structurally, so the wall cannot be stated there without guessing.
-
-## Walkers that would have misread a binder node, and what each does now
-
-The inventory covered every Arrow, domain and payload reader outside `src/v2/test`. **None needed parent context** (the ruling's stop condition):
-
-| Walker | Now |
-| --- | --- |
-| `v2.compiler.infer` formation (`infer_formation_facts_from_entries`) | A binder node has its own arm, `infer_binder_node_facts_from_entries`. Its derived type is a binder node over the type's derived type with **no default**, so defaults are not type identity, and derived types and source types share one binder shape. A binder's default is judged at the binder's declared type (`infer_binder_default_check`, position `PositionBinderDefault`; XL-2 PR2c-ii). |
-| `v2.compiler.symbol_index_fill` `symbol_index_fill_containment_edge` | Indexes a binder at its **type** (`symbol_index_binder_type_or_target`), so a parameter or field path resolves to its declared type. `<binder-type>`/`<binder-default>` never become path segments. |
-| `v2.compiler.translate` `translate_algebra` | A binder node translates **as its type** (`TypeExprTranslateBinder`, `translate_binder_node_step`). The default's fold result is discarded. A non-binder record member refuses (`translate_binder_member_type`). Arrow type expressions read parameter types through `find_binder_type`. |
-| `v2.compiler.resolve` declaring path | Does not extend across `binder_node_label`s. |
-| `v2.std.bounded_lattice_completeness` | Reads a binder field's shape from its type (`bounded_lattice_field_subject`). |
-| Lenses (unit modeling, lifecycle, residency) | Through `member_edge_type_satisfies`. A non-binder answers no. |
-| Type-name indexes (`node_query`, `concept_index`) | Through `member_edge_type_name`. A non-binder renders `<not-a-binder>`, never a fabricated name. |
-| `target_model` parameter rendering | Through the reader. A non-binder refuses. |
-| `lens/application` paths | A path that addressed a field's type now addresses its binder node. An edit replacing it with a bare type produces a hand-built binder, which the readers and the wall refuse. Loud, not silent. |
-| Subtree-fold lenses (effect reach, determinism, cost, fn index, mandatory tag, decl-facts skeleton) | Will see a default as code once defaults exist. No default exists before 2c, which decides count-or-skip per lens. |
-| Structural equality / anti-unification | Compare binder nodes structurally. Derived types carry no default, so two Arrows differing only in a default compare equal once defaults are judged in 2c. Nothing to change before then. |
-
-## Expected content-hash churn (one-time, intended)
-
-Every binder's target changes from `T` to `Conj { <binder-type> -> T }`. So the content hash (`v2.std.node` `content_hash`) of **every Arrow with a parameter, every record type with a field, every variant arm with a payload field, and every node containing one** changes once in this PR. The ruling anticipated this ("a claim-free Arrow keeps its identity except for an intentional one-time binder migration").
-
-What moves with it:
-- `v2.lens.interface_summary` `signature_fingerprint_of_node`. Every declaration with a parameter or field gets a new fingerprint. No API change is implied.
-- `v2.lens.affected_set` `canonical_boundary_hash_receipt`.
-- Any committed fixture or receipt that pins such a hash.
-
-A nullary Arrow, an Atom type, and a payload-free variant keep their hashes.
-
-## Defaults (XL-2 PR2c-ii)
-
-- **Lowering.** Every default lowers onto its binder through `v2.compiler.body_lowering_fold` `body_lower_binder_edge_read` (`binder_edge_with_default`):
-  - a fn or pattern parameter's from its own tail (`body_lower_typed_param_optional`);
-  - a record field's and a service io field's from the field tail (`body_lower_io_field_default_optional`).
-
-  The value lowers through the one value reader (`body_lower_value_read`) and refuses at the value under that reader's cause. `body_lowering_reason_default_value_unmodeled` has no producer and is deleted. A field's **wire key** is a realization fact and still refuses (records) or is set aside (io blocks) until the realization binding (XL-2 PR3).
-- **Judgment.** `v2.compiler.infer` `infer_binder_default_check` judges the default at the binder's declared type through `infer_judge_declared_position`, at a fifth position, `v2.std.inhabitance` `PositionBinderDefault`. That is the same relation an argument meets at its formal. A non-inhabiting default refuses as `^infer_reason_default_does_not_inhabit_binder_type`, located at the default. `^infer_binder_default_unjudged` is retired.
-- **Scope.** A default sits under the Arrow's domain, which resolve walks in the type-parameter frame over the OUTER scope, never the Arrow's own value parameters. So a default cannot read a sibling parameter.
-- **Emission.** A target with no parameter or field defaults refuses a defaulted binder, located at the default (`^produced_decl_render_param_default_unrealized`, `^target_semantic_decl_field_default_unrealized`), rather than dropping it.
-- **Subtree lenses.** A default is code that runs when its argument is omitted, so the subtree-fold lenses (effect reach, determinism, cost, fn index, mandatory tag, decl-facts skeleton) COUNT it as code of the declaration it sits in. No lens skips it.
-
-## Declared frontier: omission at a call or a construction
-
-A caller may not yet OMIT a defaulted argument, and a construction may not yet omit a defaulted field. Both bind through one binding plan, which still requires every formal, so an omitting call or construction refuses at the application or construct, loudly:
-- calls: `v2.std.arrow_signature` `application_binding_plan`, used by infer and eval;
-- record construction: `application_binding_plan_over`, used by `v2.compiler.infer` `infer_record_field_binding`.
-
-**Trigger:** one shared binding plan that reads each formal's binder metadata (via `declared_field_from_edge`) and admits a defaulted formal as optional, together with default materialization, so that eval, and emission where the target admits it, supply the default for the missing slot or field. Until then a default is lowered, judged and carried, and an omitting site refuses.
-
-## Scope and generics (side-chat review on #12948)
-
-- A default resolves in the ENCLOSING value scope, with the declaration's type parameters only as its type scope (`v2.compiler.resolve` `resolve_arrow_domain_walk`). An outer value is visible; a sibling parameter is not; a type parameter's spelling does not resolve as a default value.
-- A default under a generic declaration (an Arrow or type declaration with type parameters) refuses at the default as `^infer_binder_default_generic_unmodeled` (`v2.compiler.infer` `infer_generic_default_refusal`), until a default is judged with its declaring type parameters in scope.
diff --git a/docs/plans/buganizer-visual-contract.md b/docs/plans/buganizer-visual-contract.md
deleted file mode 100644
index c12af449091..00000000000
--- a/docs/plans/buganizer-visual-contract.md
+++ /dev/null
@@ -1,59 +0,0 @@
-# Buganizer visual contract (captured 2026-09-22)
-
-Authority for the issue-tracker frontend's look and feel. Owner's directive: anchor
-on Google's Issue Tracker — no homegrown UX. Provenance per section. The anatomy sections
-are MEASURED (2026-10-04): the modeled values are in `extdeps.google.issue_tracker`, and the
-captures and probe output they were read from are named below.
-
-## Captures on disk
-- `~/Assigned to me - Issue Tracker.html` (259KB — client-rendered DOM, empty state + advanced search open)
-- `~/Assigned to me - Issue Tracker_files/` (assets incl. main CSS bundle `m=c` 6.3MB)
-- `~/issue-tracker-shots/` (2026-10-04: issues.chromium.org signed out at 1440x1100; screenshots,
-  computed-style probes, the instrument, and `element-spec.md`, the element-by-element comparison
-  and the owner's rulings). Shared copy of the screenshots:
-  https://drive.google.com/drive/folders/14rcDZQtJAHzrAYimoRNmm7rBS1HqV_9b?usp=sharing
-
-## Status vocabulary (VERIFIED — the product's own query builder)
-open · new · assigned · accepted · closed · fixed · verified · duplicate · inactive ·
-infeasible · intended behavior · not reproducible · obsolete
-
-## Sidebar roster (VERIFIED — owner's session)
-Assigned to me · Starred by me · Upvoted by me · CC'd to me · Collaborating ·
-Reported by me · To be verified · Bookmark groups · Saved searches · Hotlists
-(Create hotlist) · Create bookmark group · Browse components
-
-## App shell (VERIFIED)
-- Header: product wordmark "Issue Tracker"; search input with "Search help" + "Save";
-  "Create Issue" primary button; right side: theme switcher, help, Google Account block.
-- Content region: search builder (Match all/any, + OR rows), "Issue search results" heading.
-- Empty state: "No issues match your search." + "Learn more about searching" link.
-
-## Design tokens (VERIFIED — extracted from the CSS bundle)
-- Text: `#202124` primary · `#5f6368` secondary · `#3c4043` tertiary
-- Borders/dividers: `#dadce0` · `#bdc1c6` · `#e8eaed`
-- Action blue: `#1a73e8` · hover `#1967d2` · pressed `#185abc`
-- Error/red: `#c5221f` · `#ea4335`
-- Backgrounds: `#f1f3f4` · `#f8f9fa` · highlight blue `#e8f0fe` · `#d2e3fc`
-- Type: Roboto, Arial, sans-serif · Google Sans, Roboto, Arial, sans-serif (headings)
-
-## Issue-row anatomy (MEASURED 2026-10-04 — captures `06-grid`, `14-grid-default`, `03-deps-tree`)
-Results grid columns: select · star · P · Type · Title · Assignee · Status · 7d views · ID ·
-Last modified; rows are one dense line and the title links to the detail page. Row, header and
-relation-table heights are `issue_tracker_measured_metrics`; the served column roster and its
-owner amendments are `issue_results_columns`.
-
-## Issue detail anatomy (MEASURED 2026-10-04 — captures `01-detail-comments`, `11-ancestor-menu`, `15-status-edit`)
-Header: component path and ancestor chain as chips, then the title and the action buttons. Tabs:
-Comments · Dependencies · Duplicates · Blocking · Resources, each with a count. Main column: a chip
-row (status, type, priority), then cards (status update, description, comments). Field rail at
-the trailing edge. Type scale, palette (light and dark), metrics, card, status chip and button
-anatomy are the `issue_tracker_measured_*` rows; the dark token row of 2026-09-23 is replaced by
-`issue_tracker_measured_palette_dark`. Our Work tab maps onto the History half + execution
-receipts.
-
-## Mapping notes for the frontend (workflow policy, not extdeps)
-- Issue = roadmap node; Component = domain placement (owner/lane); Blocking edges =
-  dependency edges; Stars/CC/Upvotes = per-user subscription facts (new modeled state).
-- Status = our derived present-tense explanation mapped to the product's standings
-  (open/new/assigned/accepted/fixed/verified), never a flattened label.
-- "To be verified" (stock view) = our verification-owed candidates.
diff --git a/docs/plans/canonical-content-order-draft.md b/docs/plans/canonical-content-order-draft.md
deleted file mode 100644
index 6d83f0a77ec..00000000000
--- a/docs/plans/canonical-content-order-draft.md
+++ /dev/null
@@ -1,77 +0,0 @@
-# Canonical content order — draft declaration for fit check (node adhoc-77383faf-d07)
-
-Decision (deep-ferret-305): declare in std now; #12895 portable_value_cmp becomes its interpreter realization.
-
-## 1. Inhabit std.algebra, no parallel vocabulary
-- `type TotalOrder<T> { compare: fn(T, T) -> Ordering }` — result is the existing `std.algebra Ordering`.
-- `AlgebraProfile` gains `TotalOrderProfile`; `total_order_templates()` = [compare].
-- `OrderedRing<T>` / `Field<T>` COMPOSE it: `ordered_ring_templates()` / `approximate_field_templates()`
-  take their `compare` row from `total_order_templates()` instead of restating it (one compare concept).
-
-## 2. The canonical order is a DERIVED inhabitance, not a function over a dynamic value
-No `.dag` carrier for "any value" exists (PortableValue is seed Rust), and typed `.dag` map keys are
-one type K. So the authority is a structural derivation rule — the same shape as
-`algebra_profile_equality_extensional` — saying how every admissible key type inhabits TotalOrder:
-- Bool: false < true. Int: numeric. String: Unicode-scalar lexicographic (= UTF-8 byte order).
-- Float: IEEE 754-2019 §5.10 totalOrder, cited through the binary64 authority of #12547
-  (lively-newt-480). Realized by `f64::total_cmp`. NOT raw u64 bit compare (that inverts negatives).
-- List: lexicographic by element, then length. Map: lexicographic over entries in canonical key order,
-  comparing (key, value). Set: lexicographic over members in canonical order.
-- Record: fields compared in canonical field order. Variant: by arm key, then fields as a record.
-- Cross-kind rank (Null < Unit < Bool < Int < Float < Str < List < Map < Set < Record < Variant) is
-  only reachable in the interpreter's untyped value space; it is the interpreter realization's
-  extension and is never observable on a well-typed key.
-
-## 3. Record/variant key: spelling now, declared identity is the climb
-Declared identity (owner module + declaration, arm ordinal) is the right key, but it is not carried by
-`Value::Variant` / `PortableValue::Variant` today — `gunbc.guarantee_stall.variant_owner_identity_stall`
-(NS-0B). Spelling is the only key BOTH realizations carry, and it is total on what they carry.
-The residual (two same-spelled owners compare Equal) is exactly that stall's population; the order
-switches to declared identity when NS-0B's trigger fires. Stated, not silent.
-
-## 4. Realizations (the one authority, two realizations)
-- Interpreter: portable_value_cmp (#12895) realizes §2; to_string/interpolation of Value::Map render
-  entries in that order.
-- Emitted Rust: map rendering sorts entries by the emitted compare for K (generated from the same
-  derivation rows), never by im::HashMap iteration.
-- Control: a fixture spanning every kind rank (incl. -0.0/+0.0/negative/NaN floats, same-length lists,
-  nested maps) — interpreter and emitted compare agree; a multi-entry map renders byte-identically
-  across 2 processes, interpreted and emitted.
-
-## 5. Gate
-v2.lens.determinism classifies every remaining host-order path (iteration, Debug formatting) as
-HostUnspecifiedOrder; red on any unclassified one.
-
-## Fit check (neat-boar-16) — conditions accepted
-1. Interpreter and emitted comparisons are both DERIVED from the rule rows (kind rank, float rule, field/arm
-   key), not two hand comparators; control = same multi-entry map, identical bytes, 2 processes, both.
-2. OrderedRing/Field DELETE their restated compare in the same change.
-3. Ordering reused; no new carrier.
-4. Spelling key is a named stand-in on the carrier, trigger = variant_owner_identity_stall (NS-0B);
-   spelling is an ordering key only, never identity. OPEN — see below.
-5. Float controls: -0/+0, NaN payloads, negatives (totalOrder via #12547).
-6. #12895 consumes this authority; sign-off from jolly-boar-500 / sleek-ibex-207 before either lands.
-
-### Condition 4 is not realizable in the interpreter before NS-0B
-Value::Variant / PortableValue::Variant carry no owner identity, so the interpreter cannot detect "two
-distinct declarations, same spelling": it can neither refuse nor tiebreak by declaring module. In the
-emitted Rust the case cannot arise for a typed key (distinct declarations are distinct Rust types; an
-enum key distinguishes them by arm). So the residual is interpreter-only and is exactly the stall's
-population.
-
-### Ruling on condition 4 (neat-boar-16): option A
-- Variant/record order = spelling, THEN full payload by the same canonical order. Keys tie only when they
-  render to identical bytes, so tie order is unobservable in output.
-- Control: two same-spelled variants with DIFFERENT payloads render in a fixed order across 2 processes.
-- §4b drop row, interpreter path only. Population: variant_owner_identity_stall's two members, plus
-  same-spelled variant keys from distinct declarations. The interpreter conflates those for ordering AND,
-  pre-existing (not introduced here), for equality. Trigger: owner identity carried on Value::Variant and
-  PortableValue::Variant (NS-0B), the capability, not a PR. Emitted Rust: no row (distinct types).
-
-### jolly-boar-500 sign-off (conditions)
-(a) Kind rank derived from the declaration order of the portable value model's variants. PortableValue's
-    order (Null, Unit, Bool, Int, Float, Str, List, Map, Set, Record, Variant) matches the list exactly; no change.
-    Correction: Set is OrdSet<String>, so "canonical member order" equals byte-lexicographic member strings.
-    #12895's Set rule was already conformant; only the float rule diverges.
-(b) Differential control: interpreter vs emitted compare agree on a generated corpus covering every kind
-    pair, NaN, -0.0/+0.0, empty vs non-empty collections, nested maps and sets.
diff --git a/docs/plans/carrier-realization-arbiter-repair-design.md b/docs/plans/carrier-realization-arbiter-repair-design.md
deleted file mode 100644
index e085e4336b1..00000000000
--- a/docs/plans/carrier-realization-arbiter-repair-design.md
+++ /dev/null
@@ -1,646 +0,0 @@
-# Repair design: shadow census, then an A/B/C/D counterfactual over the one fork (2026-08-21)
-
-**Session:** `royal-dove-436`. **Work item:** `node://adhoc-c735d227-60b`.
-**Authorized by:** `smart-ram-730`, after the arm census in
-[`t2_t3_realization_route_2026-08-21.md`](../probes/t2_t3_realization_route_2026-08-21.md).
-**Status: DESIGN. Nothing here is built.**
-**This revision supersedes an earlier one in the same PR** that proposed deleting the short-circuit
-as the first experiment. That is still the right eventual repair and it is the wrong first move; §2
-says why, and the reason is not caution — it is that a deletion cannot measure the quantity the
-decision turns on.
-
-## What the measurement forces, before any design choice
-
-| arm | T2 | T3 |
-|---|---:|---:|
-| **A** — generic carrier signature (`list_append`, `length`, `is_empty`) | **25** | 0 |
-| **B** — declared-structure constructor | 4 | 17 |
-| **C** — direct carrier-to-carrier assignment | 3 | 0 |
-| UNALIGNED — not attributed | 2 | 1 |
-
-Arm A makes this a forced conclusion rather than a menu:
-
-> `list_append<T>(left: FreeMonoid<T>, right: FreeMonoid<T>)` is emitted **once**, generically, so it
-> has exactly **one** host parameter type. Its `.dag` callers pass values declared `String` — the same
-> modeled type, by `std.string_type` `String = FreeMonoid<Char>`. With two host realizations the
-> generic function can only be one of them, and every call from the other is an E0308 **no call-site
-> edit can remove**.
-
-So the landed shape is **one exact identity query → one base target realization → position-specific
-reference-layer rendering**, and two candidate repairs are already refuted:
-
-- **Constructor-side only** closes arm B — 21 of 52 — and leaves arm A's 25, the largest arm.
-- **Anything relying on monomorphization** cannot help: the type renderer's test is
-  `rust_host_text_carrier_elem_name(n) == "Char"`, a syntactic read of the authored element spelling
-  decided *before* instantiation. A generic `T` is never spelled `Char`.
-
-## The authority exists, is unreachable, and is MIS-KEYED
-
-*An earlier revision of this heading said "is correct". That was wrong, and wrong in the
-direction that matters: the authority's **logic** was checked and its **key** was not. A total
-function over a wrong key does not fail — it returns a confidently wrong answer. The key defect
-is `type_reference_decl_file`'s fallback arm, traced in the section beginning "the identity key
-is a LOCATION" below; the retraction is restated here because a reader who stops at this heading
-must not leave with the superseded claim.*
-
-`type_realization_decision` **does have consumers** — `v1.compiler.coercion` `lookup_checkpoint` is a
-thin derivation of it for every `decl_file != ""` caller. (An earlier revision of this lane's PR body
-claimed zero consumers; that was an error, from grepping the type name rather than the function.)
-
-`structural_declaration_modules_for("String")` = `["src/v2/std/text.dag", "dag/std/string_type.dag"]`,
-so the strict query **would** refuse the native spelling. But six type renderers — `render_rust_type`, `render_rust_type_without_applied_binding`,
-`render_rust_applied_type`, `render_rust_type_with_applied_binding`, `render_rust_decl_type`,
-`render_rust_fn_sig_type` — each **return on their first line** via
-`is_host_text_carrier_type` → `"String"`, unconditional on `decl_file`. **No `String`-spelled
-reference in type position can reach the authority.** An unreachable wall, not a missing one (DESIGN
-§6 coverage-by-illusion). Established from those six renderers' control flow — each call verified to be the statement
-immediately following its own `fn` declaration, not merely early in the body; **not** established by
-a discriminating execution. (This count read *five* until 2026-08-21:
-`render_rust_type_with_applied_binding` was missed when the first sweep's grep output was truncated
-before reaching it. The full derivation is in gunbc#8805; the correction is recorded rather than
-silently applied because the earlier count was relayed upward and a review restated it as fact.)
-
-## §2 — Why the experiment is not "delete the short-circuit"
-
-Two quantities are being confused, and only one is answerable without emitting:
-
-- **Decision divergence** — how many occurrences get a different answer from the short-circuit than
-  from the authority. Statically computable.
-- **Diagnostic conversion** — which rustc failures appear once the authority controls emitted Rust.
-  Only observable by emitting and compiling.
-
-A deletion produces the second with no record of the first, so every downstream question ("was this
-error caused by the change, or exposed by it?") becomes narration. The census below produces the
-first *before* any byte moves, which is what makes the second adjudicable.
-
-## Step 1 — Shadow census, no output change
-
-At every affected type and value renderer, compute **both** answers and keep emitting the legacy one.
-Write a **sidecar receipt** — explicitly **not** comments into the emitted Rust (an earlier
-suggestion, withdrawn: DESIGN §4c makes an annotation unreadable by any `Accepted` program, so a
-receipt emitted as commentary is a receipt no consumer can join on).
-
-One row per occurrence, keyed by: source `DeclarationRef`; source occurrence / use site; emitted file
-+ enclosing declaration; **position kind** (declaration / fn signature / value constructor / applied
-type argument); legacy base realization; authority decision; reference-layer decision; identity
-available?
-
-Two constraints that are load-bearing, not stylistic:
-
-1. **Query the strict `type_realization_decision`, never `lookup_checkpoint`.** `lookup_checkpoint`
-   deliberately preserves the bare-name fallback when `decl_file == ""`, so censusing through it
-   measures the bypass against itself.
-2. **Outcomes are `Agrees` / `DivergesWithExactIdentity` / `IdentityUnavailable`, and
-   `IdentityUnavailable` is never folded into structural rendering.** `Unrealized` (a known
-   structural declaration) and `Refused` (identity not supplied) are different answers. Merging them
-   reproduces the bypass under a newer name — the exact defect this work exists to delete.
-
-### Step 1 shape: RULED — (b), a separate substrate walk, plus a mandatory calibration control
-
-Reconnaissance surfaced a fork the brief did not settle, and `smart-ram-730` ruled it. Both the fork
-and the ruling are recorded, because the reasoning constrains how step 1 may report.
-
-**What was never the obstacle.** Both inputs the census needs are pure and exist today:
-`v1.compiler.coercion` `type_realization_decision` is importable (three modules already import from
-that module), and `v1.compiler.05_emit_rust` `is_host_text_carrier_type` is pure — but **private to
-that module**, imported by nothing.
-
-**The fork was where the census runs.**
-
-- **(a) Inside the emitter** — the brief's literal shape: both answers at each of the six renderers,
-  legacy one emitted, receipt routed out. The v1 Rust emit path's file writing is host-driven, so
-  routing a receipt out means a **second output channel through a load-bearing file**.
-- **(b) A separate substrate walk** — a `v2.workflow` census module over the same assembled closure,
-  a probe entry, and a thin host driver: the shape `v2.workflow.realization_sweep` and
-  `realization_sweep_survey.rs` already establish, substrate analysing and host transporting.
-
-**Ruled: (b).** On the merits: (a) obliges step 1 to prove its own inertness before it can report
-anything about its subject, and *an instrument that must first prove it did not disturb the thing it
-measures is a worse instrument than one that cannot disturb it*. Under (b), acceptance condition 8 —
-bytes outside the divergence population unchanged — is true **by construction** for step 1 rather
-than something step 1 establishes.
-
-**The objection against (b), and what neutralises it.** A parallel walk can drift from the control
-flow it claims to describe, and *this lane exists because a parallel answer path was authoritative in
-the wrong place*. That suspicion is correct, but the drift risk is not uniform across the two things
-(b) borrows, and separating them is what decides it:
-
-- **The predicate cannot drift**, because `is_host_text_carrier_type` is **imported, not
-  re-derived**. A re-derived copy would be the same §3 fork again and is an immediate refusal;
-  importing it is the whole reason (b) is admissible.
-- **The traversal can drift.** The walk may visit occurrences the emitter never renders, or miss ones
-  it does. That is the real exposure, and it is not hypothetical: a subtly wrong occurrence set makes
-  every count wrong while looking perfectly well-formed.
-
-**So the calibration control is a precondition of the census being reportable, not a nice-to-have:**
-
-> The walk must **reproduce the known 25 as its diagnostic-producing divergence subset.** Partition
-> the walk's `DivergesWithExactIdentity` rows by whether the occurrence currently produces a rustc
-> diagnostic; that subset must equal the 25 sites of arm A — joined by source declaration + enclosing
-> emitted declaration + operation, **never by line**. **If it does not, the census is WRONG and its
-> divergence count must not be published. Report the mismatch instead.**
-
-This converts the drift objection from an argument into a measurement, which is the only way to
-settle it. Note what it does **not** require: the walk need not *explain* the 25, only **find** them.
-It composes with the cross-tab already committed to — the calibration is one cell of it, and the
-interesting cell (`DivergesWithExactIdentity` at zero diagnostics) is trustworthy only once the
-calibrated cell checks out.
-
-### Correction to (b) as ruled: the v2 assembly is the WRONG TREE, so (b) is v1-side
-
-Found while building it, and recorded because it falsifies a premise both the recommendation and the
-ruling rested on — not the ruling's *reasoning*, which survives intact, but the concrete artifact it
-named.
-
-**(b) was described as "a `v2.workflow` census module over the same assembled closure", reusing the
-`v2.workflow.realization_sweep` pattern. That is not implementable as stated.** That pattern's
-`assemble_program_from_ingest` returns an `Outcome<Node>` over **`v2.std.node.Node`**, while
-`v1.compiler.05_emit_rust` — the module whose decisions the census exists to measure — operates on
-**`v1.std.core.Node`**, imported by name at the top of that file. They are different types. A walk
-over the v2 assembly would be measuring a different tree from the one the emitter renders, which is
-the traversal-drift failure the calibration control exists to catch, built in at the foundation.
-
-**(b′), the corrected shape, is v1-side and is implementable today.** `v1.compiler.compile`
-`front_end_sources(sources: List<SourceFile>) -> FrontendResult` is a public entry returning
-`FrontendResult { graph: ModuleGraph?, newline_indices, intern_table, … }` — the v1 tree the emitter
-consumes, plus the `newline_indices` that `authored_name_at` needs. So:
-
-1. the host supplies the closure's `SourceFile` rows — **transport only**, the same role
-   `realization_sweep_survey.rs` plays for its probe;
-2. the census module calls `front_end_sources` and walks each module's items for type-reference
-   occurrences;
-3. per occurrence: `authored_name_at`, `v1.compiler.coercion` `type_reference_decl_file`, position
-   kind;
-4. legacy answer from the **imported** `is_host_text_carrier_type`; authority answer from the strict
-   `type_realization_decision`;
-5. rows out as TSV.
-
-**Everything the ruling actually reasoned about survives this correction**, which is why it is a
-correction and not a re-open: the predicate is still imported rather than re-derived, no output
-channel is added to the emit path, acceptance condition 8 is still true by construction for step 1,
-and the calibration control is unchanged and now matters more — a v1-side walk *can* still drift from
-the emitter's control flow, and reproducing the 25 is still what settles it.
-
-**REFUTED BY CI, 2026-08-21 — the census module DOES have to live in `src/v1/`.** This paragraph
-claimed the module need not, on the grounds that import direction is not a layer rule (DESIGN §3
-makes acyclicity the only structural law and folders a browsing convention), and concluded that this
-"removes the v1-growth question from step 1 entirely".
-
-**The premise is true and the conclusion is false.** Import direction is indeed not a layer rule, but
-that is not the constraint that binds. The required floor discovers subjects by **path**, over the
-roots `dag` and `src/v2` (`witness_layer_roots`), and resolves that closure as one program —
-`modules_resolved=3820`. A module authored at `src/v2/workflow/` is therefore swept into discovery
-because of **where it sits**, not because of what imports it, and its `v1.*` imports are unresolvable
-inside that envelope. Measured, on PR #8816:
-
-```
-src/v2/workflow/carrier_realization_census.dag:3:1: error: unresolved import:
-    module 'v1.compiler.compile' not found
-required-ci: floor refused: subject=7b5536161546187e modules_resolved=3820 modules_excluded=4
-```
-
-This is the same structural unresolvability `dag/test/claim/checkpoint_identity_keying_witness_test.dag`
-already documents about itself; I read that precedent and still authored outside `src/v1/`.
-
-The module now lives at `src/v1/tests/claim/carrier_realization_census.dag` and produces
-**byte-identical** results there, so nothing measured is invalidated — only this placement claim is.
-
-**So the v1-growth question is REOPENED, and it is an admission to state rather than one to assume.**
-Step 1 adds one module to the seed tree. Under DESIGN §3's v1 maintenance standing the admission test
-is PURPOSE — *"anything in support of v2 self host is safe"* — and the E0308 board is that program,
-so it reads as admissible. It is recorded here as an open admission, not as a settled one: this
-document does not get to grant itself the exception, and the paragraph it replaces is exactly what
-happens when a design talks a question out of existence instead of answering it.
-
-### There is no visibility change: (b′) is zero-touch on `05_emit_rust` after all
-
-This heading previously read *"(b) is NOT zero-touch on `05_emit_rust`, stated plainly"* and
-disclosed a visibility change on `is_host_text_carrier_type` as the one seed edit step 1 needs.
-**That disclosure was wrong, and it is corrected in the direction of touching less, which is exactly
-the direction a disclosure must not be left wrong in.**
-
-The `.dag` language has **no visibility syntax at all** — corpus-wide there is no `export`, `pub` or
-`private` form; every top-level `fn` in a module is importable by name. `is_host_text_carrier_type`
-is an ordinary top-level `fn`, exactly like `rust_scalar_checkpoint_render_base` — which
-`src/v1/tests/claim/checkpoint_identity_keying_witness_test.dag` **already imports from this same
-module** today. `v1.compiler.05_emit_rust` is likewise already imported by `v1.compiler.compile` and
-`v1.compiler.stage0_crates`.
-
-So **step 1 requires no edit to `v1.compiler.05_emit_rust`, and no edit to the v1 seed at all.** The
-predicate is imported, not re-derived — the property the ruling actually depended on — and nothing is
-widened to achieve it.
-
-**The lifetime question dissolves with the change that raised it.** It asked whether a widened
-surface survives the repair or is scoped to the census. There is no widened surface: the predicate's
-importability is a property of the language, not a grant this lane made. If the terminal repair
-deletes the spelling-keyed short-circuits and the predicate with them, the census's import fails
-loudly at that point — which is the correct coupling, and is a live dependent rather than residue.
-Recorded rather than dropped, because an unasked question and a dissolved one look identical in six
-weeks.
-
-### The census's executing consumer is its own driver, because the batch it would have used is gone
-
-`src/v1/tests/claim/checkpoint_identity_keying_witness_test.dag` documents its own execution as
-`gunbc.ci_layer_roots` `v1_claim_scoped_witness_entries` → `v1_claim_scoped_witness_batch`, "whose
-source-root envelope is dag plus src/v1". **That batch is deleted** — `ci_layer_roots`
-`v1_claim_scoped_witness_batch_deleted_note` records the deletion (2026-08-15), and
-`witness_fold_src_v1_coverage_gap_note` carries the resulting declared coverage gap.
-
-So a census module cannot inherit that enrollment, and step 1 does not try to. Its executing consumer
-is **its own host driver**, the "local recipe" standing `realization_sweep_survey.rs` already
-occupies for its probe — the driver supplies the `dag` + `src/v1` source-root envelope for the census
-module itself, and separately supplies the subject closure's sources as `SourceFile` **data**. Those
-are two different roles for two different populations and the design keeps them apart deliberately:
-confusing them is how a census ends up measuring its own pool instead of its subject.
-
-## Step 2 — Four counterfactual crates over one pinned tree
-
-Same toolchain, same assembly path, same manifest, same source population, separate fresh output
-directories:
-
-| | type position (decl + fn sig) | value position |
-|---|---|---|
-| **A** baseline | legacy | legacy |
-| **B** | strict | legacy |
-| **C** | legacy | strict |
-| **D** | strict | strict |
-
-A factorial over exactly the fork the census measured. It answers what no total and no single
-treatment can: whether arm A's 25 are controlled by the **type** short-circuit, whether arm B's 21
-are controlled by the **value** short-circuit, and whether converging both produces agreement or
-merely relocates the disagreement.
-
-**Publish a site-conversion ledger, not four totals:** baseline site, treatment site, source
-declaration, old expected/found, new expected/found, old category, new category. **Join by source
-declaration + enclosing emitted declaration + operation — never by line.** One error block can split
-into several sites, and lines move.
-
-**Do not land the dual renderer.** It is experimental quarry: leaving both answers in production
-creates the second authority this work exists to delete (DESIGN §3).
-
-### Ledger requirement: diff the full warning histogram — and the probe's column CANNOT carry it
-
-**The requirement, and the near-miss that produced it.** `smart-ram-730`, from another lane: a repair
-keyed on the emitted pattern string moved its board 31 → 32 — noise — while underneath it
-`unreachable_pattern:6` appeared. **Those are errors here, not lints.** Two arms of the same variant
-emitted different patterns, the first lost its guard and shadowed the second into dead code at six
-sites. The headline moved by one; six arms died. A realization change is exactly the edit that can
-make one arm subsume another: if a carrier's base realization changes, arms distinguishable by its
-host type may cease to be.
-
-**An earlier revision of this section said to satisfy that by diffing the probe's histogram column.
-That check cannot work, and the defect is in the instrument, not the diff.** Verified first-hand in
-`docs/probes/curated_cargo_probe_one.sh`: `ERROR_HISTOGRAM` greps `'^error\[E[0-9]+\]'` and
-`HISTOGRAM_SUM` greps `'^error(\[E[0-9]+\])?:'`, over a plain `cargo build --release --lib` with no
-`--message-format=json`. `warning: unreachable pattern` matches **neither**. The class can never
-appear in that column.
-
-**So absence of that row is blindness, not zero.** Reporting the class clean from that column would
-not be a measurement — it would be an instrument that cannot express the class, which is the
-absorbing fallback (DESIGN §5) relocated into the measuring apparatus. (Older readings that *did*
-carry the class legitimately came from a `rustc --message-format=json` instrument, which includes
-lints. Same question, different instrument, different answer.)
-
-**What the A/B/C/D ledger does instead:** read the kept cargo log directly and diff the **full sorted
-`warning:` histogram** across all four crates, in one dispatch covering every arm.
-
-**And it carries the honest bound, because at a refusing baseline nobody can do better:** the emitted
-crate fails to build, so rustc stops before typechecking most items and never runs reachability on
-them. A zero from that log means *"none among what rustc reached, and unchanged between arms"* — it
-does **not** mean the crate has none. That bound is published with the number, not left to a reader.
-
-**NARROWING, verified first-hand after `bright-dove-741` refuted the general form.** The emitted
-crate carries `#![deny(unreachable_patterns)]` — confirmed in `v1.compiler.stage0_crates`'s emitted
-crate attributes and in the seed's own `lib.rs`. A **denied** lint renders as `error: unreachable
-pattern`, which **does** match the probe's uncoded-suffix grep. So the blindness above is real for
-**warning-form** lints and **not** for denied ones, and `bright-dove-741` holds the positive control
-in band: 6-then-0 across their own defective and shipped runs, on this instrument and entry.
-
-**So the standing rule is narrower than first stated, and this is the corrected form: whether an
-instrument can emit a class is a property of the EMITTED ARTIFACT's lint attributes, answered per
-artifact — not a fixed property of the probe.** The cheap way to answer it is to find a run where
-that class was nonzero; a class no run has ever produced is a class you cannot report clean. The
-log-level warning reading above stays the right mechanism for warning-form classes; the rule around
-it is what changes.
-
-## Step 3 — Pre-registered acceptance
-
-A rising rustc total is neither proof of progress nor proof of failure. The repair is semantically
-correct only if **all** hold:
-
-1. Every changed occurrence was already in the shadow divergence population.
-2. The selected base equals `type_realization_decision` for the exact declaration.
-3. Type and value positions consume the **same** base answer for one declaration.
-4. The reference layer stays a **separate axis**; `Rc` is never inferred from base spelling.
-5. Same spelling + different declaration identity can still give different answers.
-6. Unavailable identity **refuses** rather than taking the legacy bare-name answer.
-7. A generic `FreeMonoid<T>` is not classified as text because some instantiation later uses `Char`.
-8. **Emitted bytes outside the divergence population remain byte-identical.**
-
-Condition 8 is the discriminator this lane did not previously have, and it is why it is stated as a
-test rather than a hope: **a new error in an emitted file whose bytes did not change is not "debt
-exposed by the repair" — it is contamination or an unrelated tree delta.** It converts a vague worry
-into a mechanical check.
-
-Then classify every treatment-only error as `ExpectedSuccessor` / `UnrelatedRegression` /
-`Unclassified`. `ExpectedSuccessor` requires a **carried** causal relation, not a narrated one: it
-occurs at the changed occurrence or a direct use of the changed declaration; its expected/found
-contains the authority-selected realization or its independently derived reference layer; the
-baseline emitted a different type at that exact semantic position; and the obligation could not have
-arisen until that representation was selected.
-
-**Acceptance: wrong-authority decisions = 0 over the scoped population, unrelated regressions = 0,
-unclassified = 0.** Only then does the raw total speak to convergence at all.
-
-## The Root B precedent, used for what it actually establishes
-
-Root B's forced `HostNative` changed **two independent axes at once** — primitive realization *and*
-import/use-line synthesis. So its 693 → 807 established neither "the rise is hidden debt" nor the
-opposite; it established that the repr caused its target family, and that the switch was not a valid
-repair because it carried a fused unrelated decision. **Use Root B as precedent for isolating axes —
-which is exactly what A/B/C/D does — never as precedent for admitting an increase.** This experiment
-can be cleaner than its precedent: the identity authority already exists, and the short-circuit
-varies without touching import policy, closure selection, or Cargo config.
-
-## Instrument lesson this design adopts for its own ledgers
-
-`smart-ram-730`, on the RT-builtin misattribution: **a classifier that folds its discriminating input
-into its derived label destroys the ability to re-adjudicate later**, and the cost lands on whoever
-needs a different partition than the one that was authored. The 2026-08-21 partition consumed each
-block's `note: function defined here` into its `root` column, so 5 sites coded `RT-builtin` cannot be
-re-split from the TSV — the callee note is a good **field** and was a bad **label**.
-
-This design's ledgers therefore carry the raw discriminating inputs beside every derived label, as
-`routes.tsv` and `arbiter_arms.tsv` already do (raw `expected`/`found` beside `expected_route` /
-`found_route` / `carrier` / `verdict`). Concretely, the step-2 ledger carries position kind, identity
-availability, and both decisions as **fields**, never only the conversion verdict computed from them.
-
-## Population, pinned so it cannot drift
-
-The scoped population is the **52 shared-root sites** in `arbiter_arms.tsv`, and the first deliverable
-is the A/B/C/D conversion receipt over **arm A's 25**: largest measured arm, constructor-only already
-falsified against it, mechanism located, authority present, and its failure is that the authority is
-*unreachable* rather than unspecified.
-
-The 5 `RT-builtin` sites in `v2_std_compilers_target_model.rs` (lines 6183 ×2, 6198, 6242, 6267) are
-**outside** this population and stay outside it. Two of them plausibly belong to this root and three
-to the cross-realization signature-drift root, but this lane's spelling-keyed classifier cannot
-discriminate `HashMap`-from-inhabitant-row from `HashMap`-from-`v1_rt::lookup`-signature, so the
-adjudication waits for the callee-note field rather than being made by an instrument that cannot make
-it. Two sites either way do not touch the 25.
-
-## What this design does not establish
-
-- **It is not costed.** No estimate is offered, because the A/B/C/D receipt is what produces the
-  blast-radius number any estimate would need.
-- **It does not claim the arms share one fix.** B and C are treatments precisely so that question is
-  measured rather than assumed.
-- **It does not pick structural vs native `String`.** That is a policy about the seed's own
-  representation; the experiment produces the data it should be decided on, and
-  `checkpoint_table_bypasses_identity_note` records what picking a direction without that data cost
-  last time (the over-broad `Bool` row: 5 fixture refusals plus `required-regen` drift).
-- **It does not touch the v1 freeze question.** Every step edits the v1 seed emitter, admissible
-  under the DESIGN §3 purpose test only insofar as it serves the v2 self-host program — which the
-  E0308 board is, but the admission is the operator's, not this document's.
-
-### The census is permanent, and it is NOT enrolled — declared, not solved
-
-`smart-ram-730` asked whether the census is a permanent lens or a one-measurement instrument,
-because the second is a scaffold and DESIGN §6 lets no scaffold land on author declaration alone.
-
-**It is permanent, by design and not by relabelling.** The question it answers — *does the legacy
-short-circuit still diverge from the identity authority at this occurrence* — does not retire when
-T2/T3 is repaired; it **inverts**. Today the divergence set is the defect population. After the
-repair, the same walk over the same subject must produce an **empty** divergence set, and any row
-reappearing is the regression. That is DESIGN §4b(4) exactly: a climb deletes the redundant
-production machinery (the short-circuit in the six renderers) and **keeps the discriminating
-evidence enrolled**, because deleting the evidence alongside the machinery recreates
-specification-without-execution one rung up. The census carries both halves — the diverging rows are
-the discriminating RED, the `Agrees` rows the accepted positive control.
-
-So no scaffold admission is owed and no dissolution trigger is owed.
-
-**But "permanent" must not be allowed to do the work of "enrolled", and today it cannot.** CI's only
-invocation is `claim_executor --required-ci --source-root dag --source-root src/v2`. `src/v1` is not
-a source root; it is reached only by the `.dag` **parse sweep** (`v1_src_dag_parse`), which parses
-and does not evaluate. A module at `src/v1/tests/claim/` is therefore **parsed and never executed**
-by the required run. Claiming it as an enrolled regression control would be precisely the tier
-DESIGN §6 names — the machinery exists and nothing gates on it — and an inert lens is itself a lie.
-
-Stated at the honest grain instead:
-
-| | |
-|---|---|
-| **rung now** | *mitigatable* — a hand-invoked probe; its evidence is real when run, and runs only when a human runs it |
-| **ceiling** | *mechanically preventable* — a witness the required floor executes on every PR |
-| **next-rung trigger** | an execution route from the required run into `src/v1`, **or** relocation to a home the floor already executes |
-
-Which of those two is right is not decided here, and the second one is now known to be **closed**:
-relocating out of `src/v1` is exactly what CI refused, because the `v1.*` imports are unresolvable
-inside the `dag` + `src/v2` envelope. So the trigger is the first: **`src/v1` becomes an executed
-root, or an execution route reaches it.** That is a CI-scope change affecting every lane, it is not
-this lane's to land, and it is owned by `smart-ram-730`.
-
-**One connection is withdrawn as wrong, and it is recorded here even though it never reached a
-shipped revision of this document** — it was the reasoning behind the trigger, so a reader who
-re-derives the trigger would re-derive the error. Replying to the permanence ruling I named the
-seven-witnesses-in-a-declined-home lane (`royal-tern-339`) as the lane whose answer this trigger
-would consume. It is not, and the difference is mechanism rather than degree: those witnesses live
-inside `src/v2`, which **is** a source root, so they are **discovered and then declined by home
-policy**, and their fix is a move between homes inside an already-discovered root. This census is
-never discovered at all. Same symptom, different mechanism — the surface-versus-mechanism error this
-whole lane exists to measure, committed by me at the level of coordination, and caught by
-`smart-ram-730` only because the connection was stated out loud rather than assumed silently.
-
-For the record, and because it re-sizes the trigger rather than merely relocating it: the objection
-to adding `src/v1` as a root is **not** roster blast radius. The whole `src/v1` tree currently holds
-14 test fns in one file — the checkpoint-identity assertions that an emitter authority note cites
-**by name** and that have never executed — and this census would make it two files. The real open
-question is **resolution**, not population: the floor resolves its roots as one program
-(`modules_resolved=3820`), so whether `v1` and `v2` module namespaces collide when unified is the
-thing to measure. That measurement is a one-command experiment and it belongs to the owner above.
-
-## THE REPAIR IN THIS DOCUMENT DOES NOT FIX ARM A — the identity key is a location (2026-08-21)
-
-Measured, then confirmed from the code. Both halves are below, and the second one invalidates the
-design above rather than qualifying it.
-
-### The measurement: `decl_file` is where the reference SITS, not where the type is DECLARED
-
-The calibration control ran over the 22-module import closure of `src/v2/compiler/01_tokenize.dag` —
-the module that emits `src/v2_compiler_tokenize.rs`, where all 25 arm-A sites live. It **failed**, and
-the failure is the finding:
-
-```
-1142 rows: 1134 Agrees, 8 DivergesWithExactIdentity, 0 IdentityUnavailable
-arm x outcome:  1036 fallback|Agrees   98 resolved|Agrees   8 fallback|Diverges
-```
-
-Every one of the **111 `String` references took the fallback arm**; the resolved arm fired zero times
-for this carrier. `decl_file` came back as the referencing module's own file in every case —
-`std.types` → `dag/std/types.dag`, `v2.compiler.tokenize` → `src/v2/compiler/01_tokenize.dag`,
-`v2.std.text` → `src/v2/std/text.dag`. The value `src/v2/std/text.dag` is produced **only** from
-inside `v2.std.text` itself; no cross-module reference to `String` ever yields it.
-
-So the 8 divergences are **true by accident**: they are exactly the references that happen to sit
-inside their own declaring module, where "the file I am in" and "the file it is declared in" are the
-same string.
-
-This also dissolves the `decl_file` partition recorded earlier in this lane (41 `types.dag` /
-6 `algebra.dag` / 4 `string_type.dag`, "zero counterexamples"). That was never a partition by
-declaring module — it was a histogram of which file each occurrence sits in. Its zero counterexamples
-were **structural**: a column that is a function of the row's own location cannot produce one.
-
-### The mechanism, named as the class DESIGN already names
-
-`v1.compiler.coercion` `type_reference_decl_file` projects the resolved node bound to the reference
-and otherwise **falls back to the reference node's own `ident_span`**. Its authority note describes
-that arm as firing *"when the reference IS the declaration"* — but the arm also fires whenever
-inference is simply unavailable, with no way to tell the two apart from outside. That is:
-
-- **state-space conflation** (§5) — *the reference is its own declaration* and *inference was
-  unavailable* are different states with different remedies, collapsed into one arm;
-- **the absorbing fallback** (§5) — a failure arm that **widens instead of refusing**. The note itself
-  warns that an empty identity yields no realization and silently renders structurally; the fallback
-  avoids the empty string by substituting a **wrong non-empty one**, which is strictly worse — it is
-  undetectable rather than merely absent, and its deficit frequency is zeroed by construction.
-
-Splitting that arm into two named outcomes is a **prerequisite** for the census, not a cleanup after
-it: until they are split, 1036 of 1142 rows are `fallback` and cannot be scored correct or wrong.
-
-### Why this invalidates the repair above
-
-`type_realization_decision` **takes `decl_file` as a parameter** —
-
-```
-fn type_realization_decision(target: RenderTarget, dag_name: String, decl_file: String)
-```
-
-— and derives nothing declaration-shaped internally. Every production caller supplies it identically:
-`v1.compiler.emit` and `v1.compiler.emit_rust` both pass `type_reference_decl_file(n: n)`, and
-`lookup_checkpoint` is a thin derivation of the same call, so it inherits the key too.
-
-**Therefore routing the six renderers through the authority changes which function computes the answer
-and leaves the basis of the answer identical.** The authority is not a second opinion about identity;
-it is the same location-valued key wearing a better name. Arm A survives the repair with its 25 sites
-intact, and an A/B counterfactual would return `converted=0` for a reason unrelated to whether routing
-was the right idea.
-
-**One retraction this forces, on the finding that opened this lane.** It was reported that
-`type_realization_decision` is *"present, correct, and unreachable"* for the text carrier in type
-position. *Present* and *unreachable* hold. **Correct does not** — its logic was checked and its key
-never was. A total function over a wrong key is not a correct authority that happens to be bypassed;
-reaching it would have produced a confidently wrong answer instead of no answer. That word is what
-made routing look sufficient, so it is retracted here rather than left standing as the premise.
-
-### Sequencing, replacing the step order above
-
-1. Split the fallback arm into two named outcomes — prerequisite.
-2. Establish **why** `n.inferred` is not `Resolved` at these reference sites. This is likely the defect
-   itself rather than something to route around, and the fallback is what has been hiding it.
-3. Only then ask whether routing to the authority is the right repair, on a key that means something.
-
-No production change is made on any of this yet. The A/B/C/D counterfactual crates are **not** built
-on the current design, and no divergence count is published.
-
-**One thing deliberately not claimed:** `v2.compiler.tokenize` has exactly 25 `String` rows and there
-are exactly 25 arm-A sites. The relation should be many-to-one, so equal counts are as consistent with
-coincidence as with a join. Upgrading it requires a join on the **same occurrences**, not on both sets
-having 25 members.
-
-## THE MEASUREMENT ABOVE IS PRE-RECONCILE — the subject claim is withdrawn (2026-08-21)
-
-Everything above about `0 of 111` is a real measurement of the **wrong phase**, and the sentence that
-made it look like a production finding is withdrawn here rather than amended in place.
-
-**Verified first-hand in `v1.compiler.compile` `compile_to_resolved_with_options`:**
-
-```
-let frontend = front_end_sources(sources: sources)     <- what the census walks
-let norm     = normalize_graph(graph: graph, ...)
-let typed    = reconcile_with_census_extra(graph: norm.graph, ...)
-ResolvedPipelineResult { graph: typed, ... }
-```
-
-and `emit_artifact(typed: ResolvedGraph, artifact: Artifact)` consumes the **typed** graph. So
-`front_end_sources` returns the **input** to normalization and inference — not the output.
-
-| | |
-|---|---|
-| **what `0 of 111` establishes** | type references in the **pre-reconcile** tree do not carry the inference answer that reconcile is responsible for producing |
-| **what it does NOT establish** | that production emission takes the fallback at those sites |
-
-The second sentence was published in this document and in this lane's PR body. **Withdrawn.**
-
-This is the same shape as the other errors recorded in this lane: the instrument ran, the number is
-correct, and it answers a *neighbouring* question. The earlier (b′) correction moved the census onto
-`front_end_sources` because the v2 assembly was the wrong **tree** — it fixed the tree and missed the
-**phase**.
-
-**What survives unconditionally:** the helper's shape defect. `type_reference_decl_file` cannot
-distinguish *this node IS the declaration* from *this is a reference whose declaration was not
-recovered here*, and in the second case returns the file containing the reference. That is
-state-space conflation on any tree. What is **unmeasured** is whether the production typed graph
-reaches the bad arm for the T2 population. The three-case cross-module trace recorded above is built
-on the withdrawn premise and is likewise unconfirmed for production.
-
-### The corrected grain
-
-`compile_to_resolved` → `ResolvedGraph.modules` → `TypedModule.items` + `TypedModule.type_env`.
-
-Every `TypedModule` carries both, which is exactly the pair the census needs, and `05_emit_rust.dag`
-**already imports `lookup_type_for`** — so this is an existing dependency, not a new abstraction. The
-renderers visibly receive `env` while the current identity helper ignores it.
-
-At every occurrence, record all three answers **independently**, never letting one substitute for
-another before comparison:
-
-| column | source |
-|---|---|
-| `inferred_declaration` | `n.inferred` → `Resolved` node, if present |
-| `environment_declaration` | `lookup_type_for(m.type_env, n)`, if present |
-| `legacy_file_key` | `type_reference_decl_file(n)` |
-
-Two constraints on the carrier. `ReferenceIsDeclaration` may be produced **only** when the resolved
-declaration is demonstrably the same declaration node — never merely because inference was absent,
-since that is the conflation under measurement and the instrument must not reproduce it. And the raw
-reference-file fallback appears only as `LegacyFallbackUsed { reference_file }`, an observation of
-current behaviour; it is **never** labelled declaration identity.
-
-### The four outcomes, fixed before the data
-
-- **A — inference resolves and agrees with the TypeEnv.** The identity key is *not* the active T2
-  root; the first-line text shortcut is the primary defect, and routing proceeds after recalibration
-  on the typed tree.
-- **B — inference absent but `lookup_type_for` resolves correctly.** The defect is narrower than
-  "inference is broken": `type_reference_decl_file` reads the **wrong carrier** for declaration
-  identity. Repair the helper to consume the TypeEnv or an already-resolved declaration; do **not**
-  modify global inference to populate a redundant field. Most plausible, given the renderers already
-  carry `env`.
-- **C — both fail.** The binding/inference defect is genuinely upstream and becomes the primary
-  front; T2 is downstream. Refusal stays explicit — no falling back to reference file or bare
-  spelling.
-- **D — they resolve different declarations.** Strongest possible finding: two resolution authorities
-  disagreeing inside the production typed tree. Realization work stops and that fork closes first.
-
-### T3 is not wholly downstream of an identity repair
-
-Recorded as a correction to this document's own framing. The collection paths are decided by separate
-mechanisms — `rust_seed_host_container_base`, `node_is_keyed_collection`, `node_is_set_collection`,
-`emit_map_type`, element-collection rendering, declared-structure record construction — which select
-`Vec` / `HashMap` / `BTreeSet` / `PartialFunction` / `PointwisePower` independently of the checkpoint
-decision. A correct declaration key is **necessary infrastructure** for a unified realization
-authority, but will not by itself make `HashMap`↔`PartialFunction` or `BTreeSet`↔`PointwisePower`
-converge.
-
-So **"52 sites are one root" reads from here on as one _non-confluence class_** — target
-representation selected by position — **and not as one implementation repair.** Likely decomposition:
-(I) exact reference→declaration identity, (II) T2 text-carrier base realization, (III) T3 parametric
-collection realization, (IV) shared reference-layer projection.
-
-### What is blocked and what is not
-
-The **production routing edit** is blocked; the lane is not. Proceeding: refresh the 52-site
-population against the current 399-error board, map each site to its type/value rendering consumer,
-separate T2 from T3, and prepare the counterfactual comparison. **The six shortcuts are not deleted
-until the identity census has a trustworthy key.**
diff --git a/docs/plans/census-part-2-inference-design.md b/docs/plans/census-part-2-inference-design.md
deleted file mode 100644
index 2371f9aec71..00000000000
--- a/docs/plans/census-part-2-inference-design.md
+++ /dev/null
@@ -1,213 +0,0 @@
-# Census part 2 — inference (and emit) census below resolve
-
-**Status: design only.** The build waits until census part 1 lane A lands: #13026,
-deep-badger-684, reconciled here against its final head `9b7d2adc5c`. This doc does not mint a row
-format. A's member already carries a stage, so part 2 **adds two arms to A's stage coproduct** and
-adds no new field. Items marked **[lane C]** are a declared frontier, because lane C has not been
-dispatched (§8).
-
-Governing sections: DESIGN §3 (one row format, not two), §3c (every declaration added here names its
-consumer), §4b (rung honesty at a declared subject grain), §5 (a refusal is a row, never a widened
-pass), §6 (name the instrument; never transcribe its output).
-
-## 1. What part 1 already establishes (reused, not restated)
-
-- **The population authority.** `v2.compiler.compile` `native_census_modules` maps an ingest to
-  `NativeCensusModule { module, path }`, one row per file that declares a module line.
-- **The resolve decision.** `native_census_module_resolution` returns one of
-  `NativeCensusModuleFileRefused | NativeCensusModuleResolveRefused { first, rest, observation } |
-  NativeCensusModuleResolved`. The lane and the census both read this one decision.
-- **The residual grain.** `NativeCensusResidualRow { module, path, chain }` has one row per failure
-  chain, so one module can produce several rows. The fatal is *derived* with
-  `v2.std.diagnostic diagnostics_fatal(chain)` and is never stored.
-- **The file-refusal row.** `v2.compiler.native_test_vocabulary` `NativeTestFileRefusal { path,
-  module, head_reason, fatal_reason }`. The rendering in swift-lynx-592's #13005 groups by **fatal**
-  and treats **head** as an advisory field, because `parse_grammar_choice_overlap_residue` heads
-  every file.
-- **Locus.** swift-lynx-592's path renders a chain's located fatal through
-  `lens_verdict_diagnostics_located_chain_text_in_spans`. Part 2 uses that renderer and adds no
-  second one.
-- **Lane A (#13026).** The carrier is `v2.compiler.compile` `NativeCensusCauseMember
-  { stage: NativeCensusCauseStage, path, module, head_reason, … }`, grouped into
-  `NativeCensusCauseGroup { fatal_reason, members }` by `native_census_cause_groups_add`. The
-  partition check is `native_census_cause_partition_holds`. The stage coproduct is
-  `NativeCensusCauseFrontEnd | NativeCensusCauseResolve`. The instrument row is
-  `//gunbc/instruments:v2-native-census` (`V2NativeCensusProducer`), and it runs the driver verb
-  `census-resolve`. **Line:col is not part of A.** It waits on swift-lynx-592's path, which is held
-  on #12506, so it is a dependency of this doc (§8) and not an A field.
-
-## 2. Subject population
-
-The population is **every module that `native_census_module_resolution` answers
-`NativeCensusModuleResolved`** over the same ingest part 1 censused. The ingest is the same source
-roots at the same revision. Below that boundary, a module is a subject of:
-
-1. **infer**: `native_test_infer_resolved`, that is `infer_and_discharge`, over the module's
-   `ResolvedTree`.
-2. **emit**: `compile_inferred_translate`, that is `v2.compiler.emit` `emit`, over the
-   `InferredTree` for the target the instrument row declares. Only modules that infer are subjects
-   of emit.
-
-The population is **derived, never re-enumerated**. Part 2 reads part 1's per-module decision and
-filters to the resolved arm. A module that part 1 left in the file-refused or resolve-refused arms
-is **not a part 2 subject**. It still appears in the receipt as an `UpstreamRefused` disposition
-(§5), so the identity join over `native_census_modules` stays complete (DESIGN §5: completeness is
-an identity join, not a count).
-
-
-### 2a. The infer demand is shared (sharp-raven-357 ruling)
-
-The per-module infer step is **one demand subject in the native drain**, not a walk owned by this
-census. The working name is `NativeInferCensusSubject { entry }`. It resolves via
-`native_demand_resolved_tree`, then runs `native_test_infer_resolved`, and yields
-`Inferred { InferredTree } | InferRefused { chains }`. Two folds read that one result:
-
-- This census reads the `InferRefused` arm: one row per chain, with cascade attribution (§4).
-- M0 of the nominal-type plan (gunbc#13024) reads the `Inferred` arm: type declarations and
-  `as` sites. On `InferRefused`, M0 records each of the module's `as` sites as
-  `OperandTypeUndecided` with the infer cause, counted and never dropped.
-
-Each fold measures a different fact, so each keeps its own line kind (refusal rows vs
-classification rows) in one stdout. They share the subject. They do not share a row format.
-
-The driver verb is **`census-infer`**. Widening `census-resolve` would make that word mean two
-things, and §3 forbids a meaning fork. `census-resolve` stays part 1's verb. Its resolve rows and
-`census-infer`'s rows are the one carrier of §5, distinguished by `stage`.
-
-## 3. What a refusal at each stage means
-
-| stage | refusal means | row stage |
-|---|---|---|
-| file (front end) | The file never parsed into a module. This is part 1's `NativeTestFileRefusal` and is not re-reported. | — |
-| resolve | Some reference in the module did not bind. Part 1 reports this. | — |
-| **infer** | The module resolved, but `infer_and_discharge` refused. Causes include no grounding derived, a fact-lookup miss, incoherent canonical grounding, a branch-shape mismatch, or an undischarged obligation. Each is a located `Diagnostic` from `v2.compiler.infer`. | `Infer` |
-| **emit** | The module inferred, but the target realization refused. The refusal is the target's inability to realize a semantically legal program (DESIGN §4: the target never decides legality). | `Emit` |
-
-**Part 2 needs a discriminator that does not exist yet.** The native lane folds resolve and infer
-into one `NativeTestStagePrepare` (`native_test_prepare_module` binds them). A census whose stage
-column read `Prepare` would attribute an infer refusal to resolve, which is the fabricated
-attribution that the `NativeLaneModuleResolution` comment already refuses at the context/resolve
-split. So the census does **not** read the lane's `Prepare` verdict. It calls the two halves
-separately, using part 1's resolved tree, and stamps the stage from which call refused. Whether
-`NativeTestStagePrepare` should itself be split into `Resolve | Infer` is a lane-vocabulary change
-that is out of scope for this doc. It is flagged here because the census makes that conflation
-visible.
-
-An infer refusal is also **per chain**, as it is for resolve. If `infer_and_discharge` returns
-several `NonEmptyDiagnostics`, the module yields one row per chain. If infer stops at the first
-fatal, the row set for that module is a **lower bound**. The receipt says so with the same
-`ObservationCompleteness` arm resolve uses (`ObservationIncomplete { reason }`), and the census does
-not report it as complete.
-
-## 4. Cascade attribution
-
-Part 1 lane C collapses import cascades to their roots. If module M fails to resolve only because an
-import target T was refused, the row belongs to T and M is a cascade member.
-
-Below resolve, the same structure applies along a different edge. **Infer runs per module over a
-resolved tree whose imported declarations come from other modules.** When M's infer refuses at an
-occurrence whose fact is owned by an imported declaration in module T, and T itself refused infer,
-M's row is a **cascade** of T's root row.
-
-- **The attribution edge.** The refused fatal's locus resolves to a declaration. If that
-  declaration's owning module is not M and that owning module has its own infer row, M's row is
-  attributed `CascadeOf { root: <T's row identity> }`. Otherwise it is `Root`.
-- **The rule is reused, not reinvented.** Lane C's collapse rule (root = earliest refused module on
-  the import path) is applied with the infer-stage row table substituted for the resolve-stage one
-  **[lane C]**. Part 2 adds no second cascade authority. If lane C's rule cannot take a stage
-  parameter, that rule is the thing to generalize.
-- **Cross-stage cascades are not collapsed.** A module whose import target refused at *resolve* is
-  not an infer subject at all (§2), so it never produces an infer row to attribute.
-- **Emit cascades.** Emit runs over one module's inferred tree. A cascade at emit is only possible
-  if emit reads another module's emitted artifact. Until a measurement shows such an edge, every
-  emit row is `Root`. A cascade reported at emit is then a **red signal** that the edge exists. It
-  is never silently attributed.
-
-## 5. Receipt shape — A's carrier, two more stage arms
-
-```
-NativeCensusCauseStage
-  = NativeCensusCauseFrontEnd        -- A
-  | NativeCensusCauseResolve         -- A
-  | NativeCensusCauseInfer           -- part 2
-  | NativeCensusCauseEmit            -- part 2
-NativeCensusCauseMember              -- A's member, unchanged apart from the stage arms
-NativeCensusCauseGroup { fatal_reason, members }   -- A's grouping key, unchanged
-attribution: Root | CascadeOf{root}  -- [lane C] declared frontier
-```
-
-- **Grouping stays on `fatal_reason` alone,** as A has it. Stage is a member field and never a key.
-  This is the same rule A applies to head: a fatal shared across stages is one cause group with
-  members at several stages, and a reader filters on the field. Heads are carried and never tallied.
-- **The partition check is A's.** `native_census_cause_partition_holds` covers infer and emit
-  members without change. A member that lands in no group, or in two, breaks the partition at every
-  stage.
-- **Per-module disposition** is one coproduct per module, so the join over `native_census_modules`
-  is total: `UpstreamRefused { stage: FrontEnd | Resolve }` | `InferRefused` | `EmitRefused` |
-  `Emitted`. Rows hang off the refused arms.
-- **Completeness** is a coproduct, as in part 1 (`Xl2CensusCompleteness` pattern). An incomplete
-  infer observation or an unjoinable cascade root each refuses completeness. Neither is a zero.
-- **No parallel carrier.** An `InferCensusRow` beside A's member would be the §3 fork. Adding
-  arms makes every exhaustive match over `NativeCensusCauseStage` fail to compile until it handles
-  them, which is the enrollment we want.
-
-## 6. Instrument label — extend `v2-native-census`, no second label
-
-Part 2 is **the same label**: `//gunbc/instruments:v2-native-census`. The label measures one fact,
-the native census's cause groups over the self-host roots. Part 2 extends the stages the census
-reaches; it does not measure a different fact. A second label would give one measurement two
-routes, which DESIGN's "Building & checks" forbids (the `--self-host` precedent A also cites).
-
-- **Realization.** `V2NativeCensusProducer` switches from running `census-resolve` to running
-  `census-infer` (§2a). That verb reaches infer and emit through the shared demand subject and
-  prints A's `cause_group` lines, whose members now include infer and emit members. `census-resolve`
-  stays as a verb for part 1's grain. It is a realization, not a peer route, so this is not a
-  second label.
-- **Exit codes are A's, unchanged.** 0: the partition held. 1: the partition broke. 2: the run did
-  not complete. Refusals are the census's data and do not change the exit code. Completeness below
-  complete is reported on the status line, as A reports `cause_groups` and `partition_holds`.
-- **Emit target.** The target is the instrument's own fact (the row names it), never a CLI option,
-  so that one label cannot quietly measure a different target.
-- **Cost.** This is a whole-tree run: CI or `ctrl-build --remote`, never in a session. The infer
-  pass reuses the single `ResolutionContext` per ingest (#11401). Inferring per module must not
-  rebuild that context.
-
-## 7. Discriminating controls
-
-Each control must go red when the behavior it guards is wrong. These are fixtures handed to the
-compiler (DESIGN §4b: a compiler's probes are invalid programs).
-
-1. **Stage discrimination.** In a two-module fixture, A resolves and fails infer (a branch-shape
-   mismatch), and B fails resolve. The expected rows are A with `Infer` and B with `Resolve`.
-   Rendering both as `Prepare`, or giving A `Resolve`, must red.
-2. **Per-chain grain.** One module with two independent infer refusals yields two rows. Folding
-   them to one must red. If infer cannot produce two, the control instead asserts
-   `ObservationIncomplete`.
-3. **Cascade.** T fails infer at a declaration that M uses, and M's only infer failure is at that
-   use. Expected: M is `CascadeOf T` and T is `Root`. Removing T's defect must make **both** rows
-   disappear. That is the route assertion, not only the answer (DESIGN §3 pairing).
-4. **Non-cascade.** M has its own infer defect and also imports a refused T. M's own row must be
-   `Root`. This catches over-collapse.
-5. **Emit.** A module that infers but uses a construct the target refuses yields one `Emit` row.
-   The positive control is a module that emits, with disposition `Emitted` and no rows.
-6. **Join completeness.** Delete one module from the disposition table. The identity join must
-   refuse, and a count comparison must not pass it.
-7. **Inhabitance.** One control runs the real whole-tree route (the instrument row itself, on CI)
-   and asserts that at least one `Infer`-stage row was produced **by the infer call** and not by a
-   supplied fixture. Removing the infer call from the route must red it.
-
-## 8. Open dependencies
-
-- **Line:col on members.** swift-lynx-592 owns this path (#13005 follow-up), and it is held on
-  #12506. A's member shape takes the field once that lands. Part 2's infer and emit members inherit
-  it with no second locus path. Until then, a member's position is whatever its chain's diagnostics
-  carry, rendered by nothing new.
-- **[lane C], declared frontier.** The cascade carrier (`Root | CascadeOf`) and its collapse rule
-  belong to lane C, which has not been dispatched. Its trigger is lane C landing a carrier that takes
-  the stage as a parameter. If C's rule is resolve-only, it is generalized in C's module, not copied
-  here. Until then, part 2 members carry no attribution, and the census reports `attribution
-  unobserved` as a completeness refusal, never as `Root`.
-- **The shared infer subject** (§2a), with tidy-koi-264's M0. Whichever lane builds first owns the
-  subject and the `census-infer` verb arm.
-- **`NativeTestStagePrepare` split.** This is a lane-vocabulary question (§3) that this doc raises
-  and does not decide.
diff --git a/docs/plans/ci-throughput-subject-census.md b/docs/plans/ci-throughput-subject-census.md
deleted file mode 100644
index 7ebf77fc75c..00000000000
--- a/docs/plans/ci-throughput-subject-census.md
+++ /dev/null
@@ -1,190 +0,0 @@
-# CI throughput comparability — a whole-path census of the current tree
-
-Stage 3 of the throughput-qualified convergence design, which named the CI side a frontier rather than
-a bound subject and required its census to read the CURRENT tree. **That parent does not exist in this
-tree: it is open as gunbc#11540 and this census must land with or after it** — the link below resolves
-only once that PR lands, and naming it here is the declared frontier's trigger (§3c) rather than a
-citation that silently dangles: [throughput-qualified-convergence-design.md](throughput-qualified-convergence-design.md).
-That instruction was specific and is honoured literally here: `docs/plans/ci-humming.md` describes the
-June slot/cgroup program and an older control/apply architecture, and deriving axes from it would
-model a fleet that has since been replaced.
-
-This is a census, not a design. It answers one question — **which properties, if they change, make a
-prior CI rate inapplicable** — and it answers it by naming carriers that exist today.
-
-## The finding that motivates the rest
-
-**No fold anywhere derives an aggregate CI rate** — completed homogeneous work per unit time, bound to
-an admitted subject, a declared protocol and an observed realization. Durations DO exist and are
-derived (`gunbc.superseded_run_starvation_census` `timestamp_diff_seconds`); a rate does not.
-
-The runner modules under `dag/gunbc/runner/` model slot identity, width admission, microVM sizing,
-placement, connectivity repair, and receipts for nearly every step of an attempt's life. The query
-behind the claims below is named rather than its output copied (§6): a case-insensitive search of
-those modules for a rate or duration vocabulary — `throughput`, `per_hour`, `jobs_per`, `duration`,
-`elapsed`, `wall_clock` — re-derives what this census read, and a reader who runs it today sees
-whatever is true today rather than what was true when this was written. **Naming the producer instead
-of its count is not a formality here**: an earlier revision of this census copied a hit count out of a
-narrower search and used it as the evidence for a claim this document has since retracted (see the
-corrections below), so the copied number outlived the search that produced it by exactly the margin
-that makes transcription dangerous.
-
-What that search surfaces in the runner modules is not a rate: `runner_unit_file` `InvocationLocalCargo { jobs_per_slot }` is a **cargo invocation
-parameter** — how many compile jobs one slot may spawn — and `runner_slot_allocation` carries a prose
-aside about oversubscription degrading throughput. Both are inputs to a configuration; neither is an
-observation of delivered work per unit time.
-
-So the CI side is in exactly the state the parent design describes for serving: a configuration
-derived with care, converged, verified, and never put to the question it was chosen to answer.
-
-## Candidate axes, each with its carrier in the current tree
-
-An axis is a property whose change makes a prior number inapplicable. Each row names where the
-property lives today, so the eventual subject type is assembled from existing authorities rather than
-re-coined.
-
-| candidate axis | carrier in the tree today |
-|---|---|
-| host class | `gunbc.runner.runner_host_tpm_observation` and the Mt Collins extdeps briefs distinguish host populations; no single host-class carrier joins them yet |
-| requested and observed slot width | `gunbc.runner_capacity_plan` `RunnerCapacityHostPlan { requested_width, observed_width }` |
-| microVM shape | `gunbc.runner.runner_microvm` `RunnerMicroVmSize { vcpu_count, memory }`, with `GuestMemoryRequest` and `GuestResources` beside it |
-| guest image | `gunbc.runner.runner_microvm` `RunnerGuestImage { distribution, release_series, arch, runner }` |
-| actions-runner revision | `RunnerGuestImage.runner` (`ActionsRunnerRelease`) |
-| cores per slot / jobs per slot | `gunbc.runner_slot_allocation` `gunbc_runner_cores_per_slot`, consumed by `runner_unit_file` `InvocationLocalCargo` |
-| memory envelope per slot | `gunbc.memory_per_vcpu_convention`, with the microVM sizing relation |
-| kernel and rootfs | `gunbc.runner.runner_microvm` config resolution (`kernel_path`, `rootfs_path`) |
-| toolchain revision | not carried by the runner subsystem; the closest authority is the repo's own toolchain coherence module |
-| cache topology and cache state | **no carrier** — see below |
-| exact Work and source-tree identity | `gunbc.compute.work_request` `WorkOperation` is the nearest home; the join from a CI attempt to the exact tree it built is not modelled |
-| dispatch policy | `gunbc.runner_attempt_launch` and the broker modules carry attempt admission; no policy-identity carrier |
-
-## What the census found missing, which is the useful half
-
-**1. Cache state has no carrier, and it is the axis most able to produce a meaningless comparison.**
-`sccache` appears in the build environment and in `extdeps.cache` as a general notion, but nothing
-models whether a given attempt ran against a warm or cold cache, or against which cache population. A
-cold-cache run and a warm-cache run over the same tree on the same hardware differ by a large factor,
-so without this axis two honest readings can disagree wildly and neither is wrong. Any CI floor set
-before this exists is a floor over an unstated variable.
-
-**2. The actions-runner revision already diverges across the fleet, and it is declared.**
-`runner_microvm` states that the guest image pins 2.337.0 while the fleet's host slots pin 2.336.0 —
-found in review rather than by anything in the repository, and resolved forward deliberately. This is
-a live specimen of exactly what an axis is for: two attempts on "the same fleet" can differ on runner
-revision depending on which population served them, so a rate compared across that boundary is
-comparing two subjects.
-
-**3. The rate INPUTS largely exist and nothing folds them — which an earlier revision of this census
-missed, and the correction makes the CI probe cheaper rather than more expensive.**
-`extdeps.github.workflow_runs` `WorkflowJobRun` carries `created_at`, `started_at`, `completed_at`,
-`run_attempt`, `labels`, `status` and `conclusion`, and `gunbc.public_workload_census` already holds
-observed execution rows with those timestamps populated. So the claim to make is narrower and sharper
-than "nothing measures a rate": **every current consumer uses those timestamps as ORDERING
-PREDICATES, never as an interval.** `gunbc.run_disposition` asks whether `run_started_at` is strictly
-later than `created_at` to prove execution began; `gunbc.pr_base_freshness` asks whether a base commit
-landed after a run started — both use the timestamps as ordering predicates rather than intervals.
-That is a fact about THOSE TWO consumers and not about the tree, which is where an earlier revision of
-this census overreached.
-
-**And the sentence above was itself wrong when first written, which is the correction worth reading.**
-A revision of this census asserted that "neither subtracts; no fold in the tree derives a duration, a
-queue delay or a rate". That is false. `gunbc.superseded_run_starvation_census` declares
-`timestamp_diff_seconds(end, start) -> DurationComputed { duration_seconds: Second }` and uses it for
-dead time under hold and for group hold after jobs — real timestamp arithmetic into a typed
-`std.measure` quantity, over live workflow-run and job API calls with paging and terminal
-classification. It is an executing precedent for acquisition and interval derivation, not a declared
-shape. The claim was over-stated from an incomplete grep and asserted as established, which is the
-§4d failure of asserting as deduced what was only inferred.
-
-The surviving claim is narrower and is the one that matters: **no fold derives an aggregate RATE** —
-completed homogeneous work per unit time, bound to an admitted subject, a declared protocol and an
-observed realization. Durations exist; a rate does not.
-
-Two consequences. A CI rate needs a fold over a substrate that exists, with an interval precedent
-already executing — a materially smaller job than this census first implied. And because that
-substrate is a census of REAL production jobs, some CI rate questions can be answered without a
-synthetic probe at all, as a reading over observed work carrying `WindowSharedWithDeclaredTraffic`
-rather than an isolated window: a weaker standing, much cheaper, and for a trend possibly the right
-instrument.
-
-What remains genuinely absent is the **join from an attempt to the exact Work identity and source tree
-it built**. A rate needs an operation ledger over homogeneous work (a one-minute no-op and a
-fifteen-minute clean build are not interchangeable units), and job labels plus a run attempt do not
-establish what was compiled. That, not the timestamps, is the precondition still missing.
-(Correction raised by the side-chat review, 2026-09-17.)
-
-**4. Host class is implied by module paths rather than carried.** Mt Collins facts live in extdeps
-briefs and the runner modules observe individual hosts; nothing names "this host belongs to class C"
-in a way a measurement could cite.
-
-## Corrections after review (2026-09-17)
-
-**The census searched the wrong closure.** It read the modules under `dag/gunbc/runner/` and drew a
-conclusion about CI, while the measurement substrate lives largely outside that subtree:
-`extdeps.github.workflow_runs::WorkflowJobRun` (exact run attempt, status, conclusion, observed runner
-labels, three timestamps, with exact-attempt and latest-attempt listings),
-`gunbc.public_workload_census::ObservedExecution` (which joins a job to repository, workflow path,
-workflow-blob SHA at the observed head, head SHA and an observed correctness standing — much closer to
-a homogeneous operation ledger than this census allowed), and
-`gunbc.superseded_run_starvation_census` (live API acquisition plus the interval derivation above). A
-subtree is not a closure, and "I searched `runner/`" does not ground a claim about CI.
-
-**A second run-record authority already exists.** `extdeps.github.actions_runs` is another
-workflow-runs projection with run timestamps and a `gh run list` transport, and `workflow_runs`
-already names the pair as a meaning fork awaiting consolidation. A CI probe must CHOOSE or consolidate
-that authority; introducing a third run record would make the fork three-way (§3).
-
-**The axis table conflates three layers.** Its test — does changing this make a prior rate
-inapplicable — identifies a comparability dimension but does not decide where the dimension lives, and
-the parent design already partitions subject / protocol / realization / window. Putting exact Work in
-the subject makes the runner a new subject every commit; putting cache POPULATION in the subject makes
-it change on every fill or eviction. Both are comparability facts and neither is stable configuration.
-
-| dimension | layer |
-|---|---|
-| host hardware class; configured slot width and resource envelope | subject |
-| runner agent, guest environment, toolchain identities | subject |
-| cache implementation, namespace/topology, configured policy | subject |
-| exact Work, source tree, workflow definition | protocol (operation identity) |
-| offered concurrency, stopping rule, required warm/cold condition | protocol |
-| exact cache population encountered; exact host, VM, runner and attempt population | realization |
-| ambient or foreign work during the window | window/isolation standing |
-
-So the cache finding splits three ways rather than being one missing axis: topology and policy are
-subject, the required condition is protocol, the observed hit state is realization.
-
-**The Work-identity gap is narrower than stated, and the repair is different.**
-`gunbc.runner_attempt_launch::plan_attempt_launch` already RECEIVES exact Work, Demand and Offer
-identities and calls `grant_authorizes_reservation` before planning the VM — so Work identity reaches
-the launch planner. The loss is downstream: `LaunchAuthorized` retains the coarse `GrantAuthorization`
-verdict and not the admitted identities, so later receipts cannot rejoin the attempt to the exact Work.
-The missing piece is a BRIDGE — admitted fabric Work identity → launched microVM attempt → observed
-`WorkflowJobRun` and terminal receipt — and the repair carries the existing admitted identity forward
-rather than coining a second CI-work identity.
-
-**Two "existing axes" are locators, not execution identities.** `RunnerGuestImage` carries
-distribution, release series, architecture and actions-runner release; none of that content-identifies
-the guest rootfs bytes, whatever its own comment calls itself. The launch planner likewise takes
-`firecracker_binary`, `kernel_source` and `rootfs_source` as paths, and one path can name different
-bytes across hosts or across time. So exact rootfs content identity, exact kernel content identity,
-Firecracker/jailer release identity, and a host execution class covering host kernel, CPU class/policy
-and storage realization are all REMAINING GAPS, not settled axes.
-
-## What this census does NOT do
-
-It does not propose the CI subject type. The gaps above are modelling obligations
-(DESIGN §6) rather than conformance rows (§3b), because a row whose home does not exist is an
-obligation and not a domain — and coining a subject over carriers that do not exist would be the
-re-invention DESIGN §2's test names. The order is: close the cache-state and work-identity gaps, then
-assemble the subject from carriers that exist, then probe.
-
-It also does not rank hosts, shapes or widths. The moment anything chooses among configurations,
-`std.decision` is the home and §3d binds.
-
-## Standing
-
-A census, not enrolled in DESIGN, governing nothing. Its consumer is stage 3 of the parent design —
-which is gunbc#11540 and is NOT YET IN THE TREE, so this document's only consumer is a declared
-frontier and its merge dependency is that PR,
-and its finding — that CI models its configuration thoroughly and its rate not at all — is the same
-finding the parent made for serving, arrived at independently on the other side of the fleet.
diff --git a/docs/plans/cli-invocation-emission-design.md b/docs/plans/cli-invocation-emission-design.md
deleted file mode 100644
index 5f71cedd681..00000000000
--- a/docs/plans/cli-invocation-emission-design.md
+++ /dev/null
@@ -1,1418 +0,0 @@
-# CLI invocation emission — the tree is the authority, argv is emitted
-
-**Status: DESIGN NOTE PLUS ITS FIRST CUT.** An earlier revision read "No code lands from this
-note yet" while the branch already carried a carrier, a seed realization, witnesses and one
-migrated production site — the stale-citation class in the lane's own authority. What has landed
-is stated at each wave below; what has not is stated as not. Design-note-first, per the
-hollow-alias precedent.
-
-**Lane scope, narrowed (raised by the `shell → dag` session, accepted):** this note governs
-**CLI-backed host effects only** — effects realized as a process invoked with an argument vector.
-It is *not* a universal effect model: a Redfish/REST path reaches a modeled request and must reach
-**no** `JqInvocation`, `CliSurface`, `ProcessArgvExpansion` or shell target. Treating every host
-effect as a CLI invocation would repeat at the effect layer the mistake this lane removes at the
-argv layer — one realization mistaken for the interface. A negative falsifier witness proving a
-REST path reaches none of these carriers is **owed by this lane and not yet built.**
-
-**Lane:** supersedes the Lane B destination of `gunbc.plans.transport_argv_anemia_dissolution`.
-Its *diagnosis* stands — "the model is the request; the curl argv is one derived realization of
-it" — and its Lane A (HTTP → `transport rest`) is substantially right. Its Lane B destination
-terminates at typed `extdeps/tools/*` operations and `ArgvCommand` builders, both still containing
-literal argv — one layer short.
-
----
-
-## 1. The defect
-
-An invocation is authored today as a list of opaque strings:
-
-```
-argv: ["jq", "-er", "--argjson", "index", "{index}", ".data[0] | keys | .[$index]"]
-```
-
-Three independent facts are welded into that one list:
-
-1. **what jq is** — a program operand, a raw-output mode, typed variable bindings, an exit policy;
-2. **how we reached it** — locally, or over `sshpass`+`ssh` to a BMC;
-3. **what we asked it** — an OpenBMC-specific projection over fan PID zones.
-
-Welded, every new question is a new hand-typed list re-deciding all three. A flag nobody
-modeled is trivially droppable — which is how `--fail` went missing from eleven curl sites and
-made a 401 read as success.
-
-### The census (measured in-tree, not inherited from the plan)
-
-| fact | count |
-|---|---|
-| `argv:` lines | 597 across 129 files |
-| `transport shell` blocks | 250 |
-| `transport rest` blocks | 95 |
-| `operation` declarations | 322 |
-| operations declaring `success: Bool from "exit_success"` | 173 |
-| operations declaring `exit_code: Int from "exit_code"` | 69 |
-| `shell_quote` call sites | 36 |
-| argv lines with a literal program head | 282 |
-| …of those, heads that are **wrappers**, not tools | 78 |
-| `sh -c` / `bash -c` embedded-language leaves | 14 |
-
-**Every count in this section is a measurement of one commit, `5c106b8a30` (2026-09-04), and is
-not re-derived as the tree moves.** It is recorded that way deliberately rather than hand-refreshed:
-a number edited to match today's tree is unreachable from whatever produced it and rots silently at
-both ends (§6). Re-derive against a named ref before relying on any figure here; what the section
-argues does not depend on the exact values.
-
-Two precision bounds: 315 of 597 argv lines have computed heads and are unclassifiable by
-this method, so 78 is a **lower bound** on wrapper-hidden tools; the metacharacter count is
-a text match, not a parse.
-
-**The plan's own census is stale by ~2.3×** — it records 262 argv lines across 37 files, and
-148/51 for the success/exit_code split. Both measured above.
-
-### The census cannot currently be taken
-
-Counting by argv head yields `git` 43, `sshpass` 40, `sh` 13, `sudo` 9, `env` 9. The middle
-four are wrappers, not tools; the real program sits at some positional offset. All seventeen
-jq-over-ssh sites count as `sshpass`, not jq.
-
-**Moved since that measurement: #11061 binds the 40 `sshpass` heads to the computed
-`extdeps.exec.command` `sshpass_binary_name`**, in `extdeps.bmc.openbmc_password_ssh_transport` and
-`extdeps.ssh.password_session`. The invocations are unchanged — those operations still exec sshpass,
-so the tool count of 40 still holds — but they have crossed from the literal-head population into
-the computed-head one, so a re-derivation by matching the literal now answers zero for sshpass. That
-is the shape this section is arguing about: the count was never wrong, the METHOD is what the corpus
-moved out from under.
-
-This is itself the argument: tool identity is a positional accident in a flat string array, so
-the corpus cannot answer "what do we invoke" without knowing `argv[11]` is the real program
-because `argv[0..10]` happened to be an ssh prefix.
-
----
-
-## 2. Facts, separated by kind
-
-### 2a. Substrate facts (read from source)
-
-- `v2.std.compilers.target_model` `TargetModel` is target-agnostic in its bundle/lex/spellings
-  shape, but **text-specialized** in three fields: `binding_spellings: Map<Symbol, String>`,
-  `token_class_emit_transforms: Map<Symbol, fn(String) -> String>`, `authority_source_text: String`.
-- The emit carrier is `v2.std.compilers.target_model` `TargetText { source: String }` — one
-  String→atom introduction, concatenation as the only join, whole-value render as the only exit.
-- `v2.extdeps.formats.sql_target` proves a **non-programming-language** target registers through
-  `target_model_make_with_emit_transforms`. It does **not** prove carrier independence: its
-  serialization node is still source-text shaped.
-- The public emit seam commits to `Medium<String>`. `Medium<R>` itself is generic; the text lock
-  is in `TargetModel`, `serialize_target` and `emit`, not in `Medium`.
-- `dag/extdeps/languages/` holds 32 language authorities. **None is a CLI-invocation authority.**
-- `extdeps.exec.command` renders argv as `join(map(argv, shell_quote), " ")`, and is anchored to
-  the **SSH** manual while defining `curl`, `mkdir`, `tar`, `make`, `sed`, `cp` builders — plainly
-  a cross-tool realization utility, not the authority for those tools' semantics.
-- `v2.std.host_transport` `ProcessInvocation` / `InvocationArg` exist with 72 consumer references.
-- `v2.extdeps.posix` `Command`, `PosixArgument`, `SpawnProcessRequest` exist with **zero consumers
-  outside the declaring module**.
-- `extdeps.posix.shell_command_language` exists as its own subject.
-- `gunbc.command_runner` carries `command_runner_scaffold: Disposition = Scaffold`.
-
-### 2b. Upstream authority facts (cited)
-
-- **IEEE Std 1003.1-2024, Base Specifications Issue 8, §12** — 14 numbered Utility Syntax
-  Guidelines; `--` ends options; options precede operands (G9); `-` denotes stdin (G13);
-  option grouping behind one `-`; option-arguments as separate tokens.
-- **POSIX `sed`** declares an explicit deviation: the relative order of `-e` and `-f` is
-  significant. So POSIX is the *base* grammar, never the whole tool grammar.
-- **RFC 4254 §6.5** — the SSH `exec` channel request carries a single `command` field of type
-  **string**. No argv vector exists in the request, so argv structure cannot cross that boundary
-  as structure. The protocol does *not* define that string as shell source; shell re-parse is an
-  OpenSSH implementation fact, as `extdeps.ssh.session` already records.
-- **IEEE Std 1003.1 Shell Command Language** — grounds the shell leg. Already cited by
-  `extdeps.posix.shell_command_language`, whose own note reserves it for exactly this use:
-  a POSIX-shell target "registers against THIS declaration and needs no new grounding."
-- **jq manual** (`jqlang.org/manual/`) — `--raw-output`/`-r`, `--exit-status`/`-e`,
-  `--argjson name JSON-text`, `--arg name value`, `--` terminator, file operands vs stdin.
-- **RFC 7950 (YANG 1.1)** — abstract data model held separate from concrete encoding; one model
-  renders as NETCONF XML or RESTCONF JSON. Cisco IOS XR ships "Model-Driven CLI" on that basis.
-  Prior art: the networking industry ran this exact migration from CLI-scraping to modeled trees.
-- **PowerShell 7.6** — parameters bind to typed .NET objects; parameter metadata (`Position`,
-  `Required`, `Accepts multiple values`, `Accepts pipeline input`) is machine-readable. Evidence
-  that a per-tool option table can be data rather than prose.
-
-### 2c. Domain facts discovered during design (these constrain the model)
-
-- `extdeps.bmc.openbmc_fan_control` declares `OpenBmcSensorValueAbsent` — a **third state**
-  beside Refused and Observed. `openbmc_sensor_integer_projection_result` decodes empty stdout
-  to it, and `dag/test/claim/bmc_typed_operations_witness_test.dag` witnesses it.
-  **jq producing no output is a modeled value, not an error.** Any exit partition folding
-  "no result" into failure breaks working, witnessed code.
-- `gunbc.host_effect_realize` `bmcweb_token_extraction_verdict` refuses blank stdout on its own.
-  So at that site `-e` was never the mechanism; it is transport *loudness*.
-- Of the four jq operations in `openbmc_fan_control`, **all are live**:
-  `ProjectFanConfig`, `ObjectMapperServiceCount`, `ObjectMapperServiceAt`, `SensorIntegerValue`.
-  Only `extdeps.tools.jq` `jq.Json.ExtractRaw` is zero-consumer tree-wide.
-
----
-
-## 3. The layering
-
-A layer is only real if something varies at it. Checked against three CLI families:
-
-| layer | owns | POSIX | PowerShell | Cisco |
-|---|---|---|---|---|
-| **intent** | the tree: subject, named params, operands | *identical across all three* |
-| **vocabulary** | which params exist, types, cardinality, positional, exclusivity | tool's manual | cmdlet parameter metadata | YANG module |
-| **surface grammar** | how a bound param renders | `-a`, `--long=v`, bundling, `--` | `-Name value` / `-Name:value` | keyword paths in a mode hierarchy |
-| **value encoding** | how a typed value becomes a param value | bytes; nested languages embedded | .NET objects — no serialization | typed per YANG leaf → XML/JSON |
-| **carrier** | what the emitted thing physically is | argv vector *or* shell text | in-process object pipeline | NETCONF RPC document |
-| **transport** | where it runs | local exec, ssh, enable-mode session, REST |
-
-The families agree at *intent* and disagree at *surface grammar*, *value encoding* and
-*carrier* — so intent is the authority and everything below is a rendering.
-
-### Two consequences
-
-**Carrier ≠ surface grammar.** Emitting to shell text when the destination is `execve` invents
-a quoting problem that does not exist. `shell_quote` at 36 sites is the current mitigation for
-that conflation, not a requirement.
-
-**Value encoding nests.** A jq program is a language embedded as a leaf in a POSIX argument; so
-is `sh -c` — 14 sites. Such a leaf should be a typed sub-tree, not an opaque String. Modeling
-jq's *expression* language is a separate vertical from its *invocation* structure and is not a
-prerequisite here.
-
----
-
-## 4. The model
-
-```
-JqInvocation                    semantic axes only; no flag spellings reachable
-    |
-    |  jq cited option rows  +  shared CLI grammar rows
-    v
-CliInvocationTree               options grouped with their values; operands; terminator
-    |
-    |  emission — roles erased here, correctly
-    v
-List<PosixArgument>             argument boundaries structural; no quoting
-    |
-    +-- local:  tool resolution -> extdeps.posix Command -> spawn
-    |
-    +-- ssh:    -> shell simple-command tree -> shell text -> RFC 4254 command string
-```
-
-### 4a. Semantic layer
-
-```
-type JqProgram { source: NonEmptyStr }        // opaque, upstream-grounded, for now
-
-type JqBinding
-  = JqJsonBinding { name: JqBindingName, value: Json }
-  | JqTextBinding { name: JqBindingName, value: String }
-
-// JqBindingName is jq-owned, not a bare NonEmptyStr. Duplicate-name policy is declared,
-// not left to jq's last-wins behaviour: the admission fold refuses a repeated name.
-
-type JqInput
-  = JqInputFile  { path: FilePath }
-  | JqInputStdin { content: String }
-
-type JqOutputEncoding = JqJsonOutput | JqRawOutput   // -r writes STRING results raw;
-                                                     // non-string results stay JSON-formatted
-
-type JqExitPolicy = JqProgramExit | JqLastResultTruthiness
-
-type JqInvocation {
-  program: JqProgram
-  bindings: List<JqBinding>
-  input: JqInput
-  output_encoding: JqOutputEncoding
-  exit_policy: JqExitPolicy
-}
-```
-
-`JqInput` is where stdin stops pretending to be an option: `JqInputFile` produces one file
-operand, `JqInputStdin` produces **no operand** and sets process stdin. Load-bearing: the four
-local sites are stdin-fed, the seventeen remote ones file-operand.
-
-### 4b. Observation: two orthogonal axes, sealed
-
-Two earlier revisions of this section put on one axis a fact that lives on two.
-
-**Termination and output presence are orthogonal.** The live `SensorIntegerValue` specimen holds
-both at once: exit status 0 **and** zero results. It runs `-r` without `-e`, its filter takes the
-`empty` branch for a non-number, and exits zero with empty stdout. So
-`JqExitZero | JqProducedNoResult` is a product, not a coproduct; written as a sum, the live case
-is unrepresentable.
-
-Verified against `jqlang.org/manual/`:
-
-```
-default             exit 0 when the program runs successfully, REGARDLESS of output
---exit-status / -e  exit 0  last output neither false nor null
-                    exit 1  last output false or null
-                    exit 4  no valid result was ever produced
-halt_error          program-chosen, default 5      usage 2      compile error 3
-```
-
-```
-type JqExitDisposition
-  = JqExitZero
-  | JqExitFalseOrNullUnderExitStatus      // JqLastResultExit only
-  | JqExitNoResultUnderExitStatus         // JqLastResultExit only
-  | JqExitRefused { code: Int }
-
-type JqOutputPresence
-  = JqOutputAbsent
-  | JqOutputPresent { stdout: String }
-
-type JqObservation sole_constructor {
-  process: ProcessObservation      // raw evidence, retained
-  exit: JqExitDisposition          // decoded projection, bound to it
-  output: JqOutputPresence
-  stderr: String
-}
-```
-
-| case | exit disposition | output presence |
-|---|---|---|
-| `SensorIntegerValue`, numeric | `JqExitZero` | `JqOutputPresent` |
-| `SensorIntegerValue`, non-numeric | `JqExitZero` | **`JqOutputAbsent`** |
-| `ObjectMapperServiceAt`, found | `JqExitZero` | `JqOutputPresent` |
-| truthiness policy, no result | `JqExitNoResultUnderExitStatus` | `JqOutputAbsent` |
-| jq execution error | `JqExitRefused` | independently observed |
-
-**The decoder is policy-indexed and is the only mint.**
-`decode_jq_observation(invocation, process) -> JqObservation` — not a global `exit_code -> JqExit`
-lookup, because codes 1 and 4 mean nothing under `JqProgramExit`, and zero results under
-`JqProgramExit` still produce code zero.
-
-**Sealing is required, not decorative.** Rejecting `success: Bool` beside `exit_code` removes one
-writable contradiction; a freely constructible `JqObservation` recreates it under richer names —
-`{ exit: JqExitZero, exit_code: 4 }` would be authorable. `sole_constructor`, minted only by the
-policy-aware decoder, closes it: the raw process observation is retained as evidence and the
-decoded facts are a projection **bound to it**, never two caller-authored fields. This is the first
-concrete place where a construction wall is available today.
-
-**A stdout `String` cannot generically prove "exactly one nonempty raw string".** jq emits a
-*stream*; under `--raw-output` a raw string may contain newlines, which is why `--raw-output0`
-exists ("Like `-r` but jq will print NUL instead of newline after each output"). `foo\nbar\n` is
-ambiguous between one string with a newline and two results. This does not block the first
-vertical — an integer has an unambiguous textual grammar — but **this note promises no generic
-`decode_exactly_one_nonempty_string`.** Lifting that requires one of: a single JSON envelope
-parsed as JSON; `--raw-output0` once jq version/capability is modeled; or a program collecting its
-result into a one-result container the domain decoder checks.
-
-**No `success: Bool`.** The seed derives it as exactly `exit_code == 0` — one fact twice.
-`extdeps.git.git` `ls_remote_reports_termination_not_success_note` establishes this; 173
-operations still carry the Bool.
-
-### 4c. Two-level row derivation — the keystone
-
-Both the **selection** of an option and its **spelling** must be row-derived:
-
-```
-JqLastResultTruthiness  -> JqCliOptionExitStatus                 (prevents omission)
-JqCliOptionExitStatus   -> canonical "--exit-status", alias "-e" (prevents bespoke spelling)
-
-JqJsonBinding { name, value }
-    -> [ argument "--argjson", argument emit(name), argument emit(value, Json) ]
-```
-
-If only the second level is data-driven while a function still says "when policy is X, append
-option Y," the droppable-option class survives one layer down — the difference between this design
-and centralizing 597 literals into N helper functions.
-
-The precise statement replacing "`-e` is part of the contract, not a flag":
-
-> `JqLastResultTruthiness` is part of the contract. `-e` and `--exit-status` are concrete
-> spellings of that property in the jq CLI realization.
-
-### 4d. Grammar decomposition
-
-```
-shared CLI grammar          option, option-argument, operand, repeated group,
-                            terminator, short-option cluster, long spelling,
-                            joined vs separate value
-
-+ per-tool cited rows       jq options and operand order
-                            sed's -e/-f ordering exception
-                            git subcommand grammar
-                            tar mode-word grammar
-                            ssh -o forms
-```
-
-Named `CliSyntax`, not `PosixCli`: real tools deviate (POSIX `sed` provably), and the name must
-not assert conformance the corpus cannot claim.
-
-### 4e. The structured CLI tree — why roles live here and not in the arg vector
-
-```
-type CliElement
-  = CliOption  { option: CliOptionRef, values: List<CliValue> }
-  | CliOperand { value: CliValue }
-  | CliOptionTerminator
-```
-
-An option's values cannot detach from their option: `--argjson`, its binding name and its JSON
-value stay one subtree until the grammar lowers them.
-
-**Role and provenance are orthogonal axes and must not share a coproduct.** A workspace path may
-be an option value *or* an operand; a produced artifact either; a literal an option, subcommand,
-option value, mode word or operand. Fusing them makes `OptionValue ∧ WorkspacePath`
-unrepresentable, and expanding to `WorkspacePathOptionValue`, `WorkspacePathOperand`, … is the
-combinatorial growth the grammar exists to remove.
-
-**`CliOption { values: List<CliValue> }` is too permissive as a *public* carrier.** Freely
-constructible, it admits `--argjson` with zero, one or three values; a flag with a value; a
-non-repeatable option twice; illegal order; another tool's option; operands before options where
-forbidden. So the cited row must carry option identity, canonical spelling, aliases, argument
-arity, repeatability, placement and joining discipline — and the emitter accepts only a
-**normalized, admitted** tree:
-
-```
-type CliOptionSchema {
-  option: CliOptionRef
-  arguments: CliArgumentSchema
-  repeatability: CliOptionRepeatability
-  spelling: CliCanonicalSpelling
-  placement: CliOptionPlacement
-}
-
-type AdmittedCliInvocation { tool: CliToolRef, options: List<AdmittedCliOptionUse>, operands: List<CliOperand> }
-```
-
-Domain callers receive **no constructor** for `AdmittedCliOptionUse`. The jq semantic-to-syntax
-projection selects the row and supplies values; the admission fold checks the schema — the
-`sole_constructor` + `admit_callers` shape that sealed `TransportScript`, and what raises the rung
-for the migrated path (§9).
-
-Roles are then **deliberately erased** at emission, because the OS receives an ordered vector of
-strings. That erasure is emission, not anemia; the present defect is only that no preceding tree
-exists — authors write the vector directly.
-
-### 4e-bis. The process plan is not the CLI grammar
-
-`CliSyntax` owns how options and operands become argument boundaries and **nothing else**:
-stdin, environment, working directory and descriptor routing belong to the *process plan*.
-
-```
-type JqProcessPlan { command: CliCommandSurface, stdin: ProcessInput }
-
-JqInputFile(path)     -> one CLI operand,  no jq-data stdin
-JqInputStdin(content) -> no file operand,  stdin = content
-```
-
-This is why `SensorIntegerValue` is a good first proof: input content stays **outside argv** while
-the jq program stays **one argv argument** — two properties an argv-only model cannot state, and
-the gap `extdeps.llm.cursor_cli` hit when an argv-shaped carrier could not hold an
-environment-passed credential.
-
-### 4f. Carrier: argv is native, text is the derived special case
-
-POSIX utility syntax operates over *arguments*; shell syntax is the preceding language that turns
-words and expansions into them, with quote removal before the utility sees them. So argv is the
-higher-structure carrier and shell text a serialization of it through an additional language.
-
-Making text canonical and re-deriving argv by parsing is backwards: it forces the strongest local
-transport through an unnecessary shell grammar, quoting discipline and injection surface because
-one weaker remote transport loses structure.
-
-**Local and SSH are not two jq targets.** They are one utility target, two realization carriers,
-and one *additional nested target* on the SSH path — the POSIX shell grammar, modeled
-independently and already grounded by `extdeps.posix.shell_command_language`.
-
-Counterfactual proving command text is not intrinsic: a remote receiver accepting a structured
-request and calling `execve` itself would eliminate the shell leg while keeping SSH as transport.
-
-**Precedent for the composition shape:** `effect_plan_bash_materialize` obtains an argv vector,
-converts it to Bash command nodes, then serializes the Bash grammar. Its argv source is still the
-old declaration-owned materializer, but the shape is right.
-
-### 4g. Physical layer
-
-Lower into `v2.extdeps.posix` `Command` / `PosixArgument`, **not** `v2.std.host_transport`
-`ProcessInvocation`. The latter is an emit-harness carrier whose `InvocationArg` variants
-(`LiteralArg | WorkspacePath | ProducedArtifact`) classify build-workspace provenance, not CLI
-roles; `build_transport_admission` only asks whether a step reads a declared workspace resource,
-and `emit_host` flattens all three variants back to text.
-
-Its provenance vocabulary is hand-applied, not derived: `python.dag` models its script as
-`WorkspacePath`, `go.dag` models `main.go` as `WorkspacePath`, and `c.dag` models `fixture.c`,
-`-o` and `fixture` as three undifferentiated `LiteralArg`s — so C's compiler read of `fixture.c`
-is invisible to the admission fold. A real harness defect, and an independent reason not to
-promote this carrier to the universal process boundary.
-
-`ProcessInvocation` also lacks process-wide axes needed elsewhere: **no environment, no stdin, no
-working directory, no file-descriptor mapping.** `extdeps.llm.cursor_cli` already forked around
-this, minting `CursorProcessInvocation { program, argv, environment }` rather than reuse it; its
-note states the principle with a security consequence —
-
-> an argv is not a process. A process is a program, an argv AND an environment, and a credential
-> passed by environment is invisible in a model whose output stops at the argv — there was no
-> field for it to appear in.
-
-A fork in `dag/extdeps/llm` against a carrier in `src/v2/std` would be unnecessary if
-`host_transport` `ProcessInvocation` were the general authority its name suggests — independent
-corroboration of the name collision from a different lane.
-
-**What `ProcessInvocation` remains good for.** Not deleted by this lane. It stays as a downstream
-adapter for the emit-host harness — fixed option spelling to `LiteralArg`, workspace file operand
-to `WorkspacePath`, generated binary operand to `ProducedArtifact` — keeping effect provenance
-*after* CLI emission. Two constraints: no jq or domain caller constructs those variants directly,
-and jq does not route through the emit-host harness merely because the type exists. The longer-term
-cleanup is renaming it and `InvocationArg` to their real scope (`EmitHostProcessInvocation`,
-`EmitHostArgumentMaterialization`) — a separate replacement migration, not bundled here.
-
-**Generalizing that subsystem is NOT a prerequisite for the first vertical.** Landing stdin, cwd
-and fd mapping on `Command`/`SpawnProcessRequest` before any jq migration turns one proof vertical
-into a process-runtime project. The stable boundary is `CliCommandSurface + ProcessInput`; it
-binds first through one narrow local jq realization whose entire content is the jq executable
-identity, a splice of already-emitted arguments, and the process channel wiring — **no option
-spelling and no domain filter**. An honest realization boundary, not another argv authority. Its
-dissolution trigger: the same emitted surface binds to `extdeps.posix` `Command`. Emit a
-`CliToolRef` and let each realization resolve `"jq"` or an absolute path.
-
-`v2.extdeps.posix` `Command` is the right conceptual layer, with four bounded deficiencies:
-
-1. `program: AbsolutePath` — a semantic invocation names a *tool*; resolution must produce the
-   path at realization time.
-2. no stdin or file-descriptor actions on `Command`/`SpawnProcessRequest`.
-3. `PosixByteString = FreeMonoid<Byte>` does not visibly exclude embedded NUL, which POSIX
-   process arguments require.
-4. no executed proof that the active `dag/` lane can consume this `src/v2` carrier.
-
----
-
-## 5. Ownership
-
-| owner | owns |
-|---|---|
-| `extdeps.tools.jq` | what raw output means, what exit-status mode means, that `--argjson` takes a name and a JSON value, which options repeat — and **which spellings exist and which is canonical** (`long = exit-status`, `short alias = e`, canonical preference, value cardinality) |
-| shared `CliSyntax` | **how a chosen form is constructed** — a long name renders `--` + name, a short renders `-` + character, clustering where the tool row permits, joined vs separate values, option/operand/terminator order |
-| `gunbc.bmc_fan_projection` | the `TEMP_SOC` policy, the fan curve, controller cardinality, the desired topology |
-| `extdeps.bmc.*` | programs projecting a documented OpenBMC response or config field |
-| realization | local vs SSH vs another handler |
-| **no caller** | `-e`, `-r`, `--argjson`, `--`, their positions, or the choice between `-e` and `--exit-status` |
-
-The tool row owns *which forms exist and which is canonical*; the grammar owns *how a chosen form
-is constructed*. An earlier revision gave both "canonical spelling" — two authorities for one
-decision, the §3 violation this note is about, committed inside it.
-
-The split is by **what fact the program encodes**, not that jq executes it. `ProjectFanConfig`
-embeds `TEMP_SOC`, the aggregate fan PID entry, desired inputs, minimum and failsafe duties,
-hysteresis and exact-one-controller policy — gunbc's chosen topology, so it moves.
-`SensorIntegerValue`, `ObjectMapperServiceCount` and `ObjectMapperServiceAt` interpret **upstream
-OpenBMC response shapes** and stay under `extdeps.bmc` even though jq realizes them. The several
-*remote* fan-query programs carrying a literal `TEMP_SOC` are the ambiguous middle: they belong
-beside the projection authority, or should derive that value from it, not keep the literal in
-`extdeps`.
-
-Filters leave both `extdeps.tools.jq` (business policy in extdeps is a layer inversion) and
-`openbmc.PasswordSshTransport` (SSH does not own what the remote program means). They do not all
-land in one generic "workflow layer": policy-bearing ones go to `gunbc.bmc_fan_projection`, which
-already owns the board, firmware, curve, config path, controller entry and tach inputs.
-
----
-
-## 6. Rules
-
-1. `-e`, `-r`, `--argjson`, `--` and their aliases may appear **only** in cited concrete-syntax rows.
-2. Semantic modules construct no option node and no argv string.
-3. Per-tool lowering contains no bespoke option-selection fold; semantic variants select grammar
-   rows exhaustively.
-4. Transport consumes an inner invocation. SSH may **not** be modeled as `append(ssh_prefix, inner.argv)`.
-5. The CLI inverse consumes `List<CliArgument>`, not shell text — and it is **partial and
-   ambiguity-aware**, not bijective: clustered short options, optional option-arguments, operands
-   beginning with `-` and tool deviations admit multiple parses, so it answers
-   `CliParseUnique | CliParseAmbiguous | CliParseRefused`. It is **not** a Wave 1 acceptance
-   criterion; current argv remains an offline behavioral oracle. Shell text is parsed by the shell
-   grammar first; only a static literal simple command projects back to a CLI surface.
-6. Every vertical deletes its prior argv authoring site **in the same cut**. "New tree plus old
-   helper for compatibility" creates two authorities.
-7. No new production function returns `List<String>` or `ArgvCommand` containing tool flag literals.
-8. `ArgvCommand` builders and `transport shell { argv: [...] }` are migration substrates, not the
-   final authority.
-
----
-
-## 7. The cut
-
-Per the §3 replacement-migration rule, stated at exact identity grain.
-
-**Authority being replaced:** argv-as-authored-authority for jq invocations.
-
-**Root consumer × subject population:** the four live `openbmc.JsonProjection` operations
-(`ProjectFanConfig`, `ObjectMapperServiceCount`, `ObjectMapperServiceAt`, `SensorIntegerValue`)
-plus the seventeen `openbmc_password_ssh_transport` remote jq operations.
-
-**Recut: the first vertical is LOCAL only.** An earlier revision put local execution and SSH in
-one "smallest complete" vertical. SSH adds a second language target, RFC 4254 string loss,
-portable-word refusal, quoting, and the latent `sshpass -d 0` collision. The unit is **one local
-jq vertical, demonstrated by one feature-rich migration and one discriminating counterexample.**
-
-**Wave 0 — carrier probe.** Stacked with its first production consumer, never mergeable alone.
-A probe-only non-text serializer beside the text one; sealed `CliSurface`; existing text emission
-byte-identical; argument boundaries observable *by execution*; direct/cast/unadmitted-mint REDs;
-explicit refusal when no CLI serializer is wired. See §10 — the probe must execute, because it
-will not refuse at compile time.
-
-**WAVE ORDER CORRECTED BY EXECUTION: 1B CUT FIRST, and the note was wrong, not the branch.**
-Wave 1A was named first because it exercises the most axes at once, including a typed JSON binding
-through `--argjson` — exactly why it cannot be first: that lowering is **not built**, and
-`jq_invocation_lower` refuses it as `JqBindingLoweringUnwired`. `SensorIntegerValue` (Wave 1B)
-migrated first because every axis is wired: program operand, stdin input, raw output, and
-`JqProgramExit` selecting no exit-status option. Its falsifier role is undiminished by going first
-— a counterexample does not require the thing it falsifies to exist yet. 1A follows once
-`--argjson` lowers.
-
-**Wave 1A — `ObjectMapperServiceAt`.** The strongest exemplar: its argv exercises nearly every
-load-bearing axis — `-e` truthiness exit, `-r` raw output, a typed JSON binding through
-`--argjson` (an option with **two** values), stdin input, a jq program operand, exact
-nonempty-string domain decoding, and a live recursive consumer. After migration the OpenBMC caller
-stops reading `success`/`stdout`/`stderr` and matches
-`OpenBmcServiceObserved | OpenBmcServiceProjectionRefused`. No layer above jq's cited rows can
-name `-e`, `-r`, `-er` or `--argjson`.
-
-**Wave 1B — `SensorIntegerValue`, the required falsifier.** Immediately stacked, *before* the
-abstraction is advertised as ready for repetition. The counterexample to a design overfit to `-e`,
-proving four things Wave 1A cannot: `JqProgramExit` selects **no** `JqCliOptionExitStatus`;
-`JqOutputAbsent` is not automatically a refusal; termination and output presence are orthogonal in
-the observation model; one lowering supports two opposite domain policies unchanged. Its
-acceptance population:
-
-```
-{"data": 41.6}      -> Observed 42        {"data": "41"}     -> Absent
-{"data": 41}        -> Observed 41        {"data": null}     -> Absent
-{}                  -> Absent             invalid JSON       -> Refused
-two numeric inputs  -> Refused, never first-pick              jq nonzero -> Refused
-```
-
-**Wave 2 — first SSH migration.** Only after the local vertical is green: `CliSurface` → shell
-simple-command tree → shell grammar emission → RFC 4254 command string, reusing the grammar-owned
-quoting the effect-plan Bash path demonstrates rather than retaining `shell_quote`. Owns the
-portable-word limitation, file-input-only admission, and a typed refusal for stdin-fed remote jq
-while `sshpass -d 0` holds fd 0. Then the remaining remote population is mechanical.
-
-Emission-side witnesses, proven separately from semantics at every wave:
-
-```
-the semantic property selects the option identity     (row level 1 perturbation)
-that identity selects its canonical spelling          (row level 2 perturbation)
-JqProgramExit emits NO exit-status option
-the jq program is exactly one argument
-stdin content appears NOWHERE in argv
-argument order is stable
-direct / cast / unadmitted-mint construction refuses
-the old transport argv site is absent in the same cut
-no success: Bool survives on the new path
-```
-
-Both row levels need independent perturbation controls: a spelling perturbation proves spelling
-is authoritative but says nothing about whether a required semantic property can be omitted.
-
-**Do not make the first vertical solve SSH.** Local exemplar and transport composition are
-separate proofs.
-
-**First vertical (smallest complete):**
-
-1. `JqInvocation` and its semantic axes.
-2. `CliInvocationTree`.
-3. Shared CLI grammar rows + jq's cited option rows.
-4. Emission to `List<PosixArgument>`.
-5. Local resolution into `extdeps.posix` `Command`.
-6. A process-input realization for jq stdin, separate from argv.
-7. One live jq population cut over, with its prior argv authoring site deleted.
-
-The SSH handler is **Wave 2 and deliberately absent from this list.** An earlier revision carried
-it as item 7, contradicting "Do not make the first vertical solve SSH" above and the recut in §7.
-SSH adds a second language target, RFC 4254 string loss and the `sshpass -d 0` collision; none is
-needed to prove a local vertical.
-
-The carrier lands **with** its first live consumer, or in an immediately preceding stacked PR
-containing an executing consumer. A standalone carrier PR would reproduce the unconsumed
-`v2.extdeps.posix` situation exactly.
-
-**Deleted at cutover:** `extdeps.tools.jq` `jq.Json.ExtractRaw` (zero consumers — deleted first,
-not kept beside the new authority); the migrated sites' `transport shell` argv literals; the
-seventeen re-inlined `sshpass`/`ssh` prefixes.
-
-**Explicitly NOT in this cut:** adding variants to `InvocationArg`; updating its 72-reference
-population; renaming the harness carrier to `EmitHostProcessInvocation`; repairing the C/Go/Python
-descriptor inconsistency; making `HostTransportDescriptor` a general process authority; modeling
-jq's expression language; the other 575 argv lines. Those are independent lanes.
-
-**Deliberately not built:** a coverage lens over argv arrays. Under the replacement-migration
-rule that is a census over a structure being deleted — the deletion is the census. The plan
-proposes one; this note declines it.
-
----
-
-## 8. Witnesses
-
-Semantics and serialization are witnessed separately:
-
-- **semantic** — the caller requested the correct jq behavior.
-- **emission** — that semantic tree lowers to the expected argument vector.
-- **perturbation** — changing the jq option row changes or refuses the emitted vector; the
-  control proving the rows are load-bearing, not decorative.
-- **domain** — absent, null, false, blank, wrong-type and multiple outputs cannot reach the write.
-- **positive control** — one valid token still does.
-- **absence control** — a non-numeric sensor reading still decodes to `OpenBmcSensorValueAbsent`
-  and does not become a refusal.
-
----
-
-## 9. Rung, by exact subject
-
-An earlier revision said "mechanically preventable, because a caller can still construct a raw
-`List<String>` and nothing yet refuses it." **If nothing refuses it, it is not mechanically
-prevented** — it is measured or mitigated. It also *understated* what the migrated path can reach.
-One number for several populations was the error.
-
-| exact subject | honest rung after the first vertical | mechanism |
-|---|---|---|
-| forging a `CliSurface` **by record literal or cast** | structurally impossible | `sole_constructor`, whose cross-module refusal is witnessed by the corpus `sole-constructor-cross-module` probes — not re-proved here |
-| minting a `CliSurface` **whose content did not come from rows** | **mitigatable only** | *no wall.* `serialize_cli_arguments` is public and accepts caller-supplied `lex` and fragments, so any module can obtain a well-typed `CliSurface` carrying arbitrary text |
-| omitting `--exit-status` from an accepted truthiness invocation | **structurally impossible within the new path** | exhaustive semantic→option selection; zero-or-many rows refuse; no mint on miss |
-| hand-authoring flags inside a migrated route | **structurally impossible after cutover** | handler takes a semantic invocation, emits internally, old argv site deleted |
-| reintroducing the exact old operation transport | mechanically preventable | structural deletion witness |
-| a computed argument vector losing its argument boundaries at the host edge | **mitigatable only** | the `ProcessArgvExpansion` arm makes boundaries survive *on the carrier path* and refuses every malformed shape it is handed, but the guessing path it sits in front of is untouched for every value that is not this carrier — 21 operations still splice a declared `List` param. This is a repair at ONE seam, not a wall over the class |
-| a domain module authoring jq program source | **mitigatable only** | §12 — `JqProgram` is public; nothing prevents it |
-| decoding a jq exit code against the wrong contract | **structurally guaranteed on the new path** | §13 — the policy travels on the plan and `jq_classify_observation` is the only reader; a domain module has no exit code to misread |
-| writing another raw jq argv elsewhere | **still writable** | unrelated raw shell/process routes remain |
-| arbitrary raw argv corpus-wide | outside this vertical | later process/transport confinement |
-
-So: **the first migrated jq path can be structural now; the repository-wide raw-jq class stays
-open; the repository-wide raw-argv class is a later migration.**
-
-**The seal is on the shape, not on the provenance — corrected 2026-08-19.** The row above
-previously read *structurally impossible now — only the row emitter, serializer and decoder may
-mint*: false, and the §4b inflation this document warns about, asserted about its own subject.
-`sole_constructor` closes the record literal and the cast; it says nothing about a **public fold
-that takes caller-supplied inputs**, which `serialize_cli_arguments` is. An earlier claim that
-`CliSurface` was therefore *stronger* than `TransportScript` had it backwards: `TransportScript`'s
-mint is `admit_callers`-sealed to two named production declarations; `CliSurface`'s is not sealed.
-
-**Ceiling and trigger.** The obvious repair — `admit_callers` on the serializer — is refused on §3
-grounds: `v2.std.compilers.cli_surface` would name every tool module that may emit a CLI, dispatch
-fused into the interface. So the wall belongs on the **input**: a sealed `AdmittedCliInvocation`
-that only a tool's own row-derived lowering can produce, with the serializer total over it. That
-is **not built**, and its mint design is genuinely open — whatever seals it faces the same
-recursion one level up. Until it lands, provenance sits at *mitigatable*; the practical
-containment is that the only public jq entry point is `jq_invocation_process_plan` — a
-convention, not a wall.
-
-**Application-argument typechecking is not the terminal trigger.** The `04_infer` gap is real —
-`explicit_return_conformance_note` records that conformance is judged only by the
-ground-kernel-scalar and ground-element-collection discipline — but it is neither *necessary* for
-sealing this path nor *sufficient* to eliminate alternate raw routes. It matters when a sealed
-carrier crosses an open function boundary and correctness rests on argument conformance; the first
-vertical avoids that: no caller receives a public `execute(surface: CliSurface)` to smuggle into.
-The domain caller passes a `JqInvocation`; the handler emits and consumes the sealed surface
-internally.
-
-The real terminal trigger for the broad jq class is a **dominator condition**:
-
-> every production path capable of executing jq is dominated by the semantic jq handler, and raw
-> process/shell routes cannot name jq except through an explicitly retained escape population.
-
-General argument typechecking strengthens the boundary; it does not prove that property.
-
-## 10. Open questions
-
-1. **Carrier parameterization — and the probe will NOT refuse.** The current answer is not
-   "unknown diagnostic" but: **there is no carrier-mismatch refusal on this path, so a compile-only
-   probe false-greens.** `emit`, `serialize_target` and `serialize_source_for_emitted` are fixed
-   to `Medium<String>`, and underneath them `target_serialize_source_from_model_bounded` returns
-   `TargetText` rendered through `target_source_medium`. Passing a `cli_target` still takes the
-   text serializer. And `v1.04_infer` `explicit_return_conformance_note` records that declared
-   return conformance is judged only by the ground-kernel-scalar and ground-element-collection
-   discipline, so a structured mismatch such as `Outcome<Medium<String>>` vs
-   `Outcome<Medium<CliSurface>>` yields no diagnostic. **Do not treat a green compile as a
-   positive result.**
-
-   The smallest discriminating probe is a **sibling concrete seam**, executed rather than compiled
-   — `emit_cli_probe` binding `translate`'s target tree to a non-text serializer — asking: can
-   `translate`'s output be consumed by a non-text serializer while the text serializer stays
-   byte-identical? It does not ask the current `emit` to produce what its signature cannot
-   express, and does **not** start by genericizing `TargetModel`.
-
-   Controls: existing `emit` returns the exact prior bytes; the probe returns a sealed `CliSurface`
-   whose argument boundaries are inspectable **by execution**; swapping the CLI serializer for the
-   text one must *fail the test*; direct, cast and unadmitted-mint construction of `CliSurface`
-   refuse; a missing serializer raises a typed `TargetSurfaceSerializerUnwired` rather than
-   falling back to source text.
-
-   Only after that receipt is the seam chosen. Prior: `TargetSurfaceSerializer<R>` is the smaller
-   terminal seam, with the existing `emit` kept as a compatibility wrapper selecting the text
-   serializer — parameterizing every `TargetModel` consumer before a non-text target has proven it
-   necessary is the larger, less reversible move.
-
-2. **`sshpass -d 0` and stdin.** The password occupies fd 0; a remote stdin-fed jq would collide.
-   Latent, not live — all seventeen remote sites use file operands. Must be a typed refusal, not
-   an accidental limitation. Options: remote file-input only; password delivery on another
-   descriptor; a framed remote receiver.
-3. **Portable-word allowlist.** `gunbc.typed_argv_exec` bounds what may cross SSH. jq programs
-   contain spaces, pipes, brackets, parentheses and quotes — outside that alphabet. The shell leg
-   must own canonical shell-word serialization with injection controls, or refuse.
-4. Which of the 315 computed-head argv lines hide further wrappers.
-5. **The remote jq rows do not preserve the jq program as one argument. Source-proven.**
-   Traced end to end, with the local half verified in this tree:
-
-   - `v1_interpreter.rs` `push_shell_argv_tokens` pushes each evaluated `String` **verbatim** — no
-     splitting, no quoting — and both exec branches call
-     `Command::new(&argv[0]).args(&argv[1..])`. Despite its name, `transport shell` here is
-     **direct process execution**: no local shell, no `shell_quote`, no command-string renderer.
-   - `sshpass` parses its own options, copies the remaining argument pointers, and `execvp`s them
-     unchanged.
-   - OpenSSH's client consumes the `--` after the destination as its **own option terminator**
-     (not a remote quoting construct) and builds the remote command by appending each remaining
-     argv member separated by one literal space, with no escaping.
-   - OpenBMC's default SSH server is **Dropbear**, not OpenSSH — its `run_shell_command`
-     invokes the user's login shell with `-c`.
-
-   So `["jq", "-er", "[.zones[].pids[] | select(...)] | length", path]` arrives remotely as
-   `jq -er [.zones[].pids[] | select(...)] | length /path`, and the remote shell reads the
-   unquoted `|` as pipeline operators. The law the code needs is
-   `shell_parse(join(map(shell_quote, argv), " ")) == argv`; it assumes
-   `shell_parse(join(argv, " ")) == argv`, which holds only inside the portable-word alphabet
-   these filters are outside — the alphabet `gunbc.typed_argv_exec` exists to bound. Dynamic values
-   such as `config_path` are unquoted too; the current path happens to be shell-safe, but
-   `NonEmptyStr` does not establish that.
-
-   **Split the judgments rather than calling the whole thing broken:**
-
-   ```
-   RemoteJqArgumentBoundaryPreservation   Violates — source-proven
-   DeployedSshClientIsStandardOpenSsh     Unverified
-   DeployedBmcServerUsesDropbearShellExec StronglySupported, not observed on this firmware
-   AffectedOperationReachability          Unverified
-   ObservedProductionManifestation        Unverified
-   ```
-
-   The saving conditions are enumerable and none is visible in the repository: a custom binary
-   named `ssh` that shell-quotes (most plausible, since `sshpass` resolves through `PATH`); filters
-   already carrying canonical outer quoting; a forced-command or structured receiver decoding an
-   encoded argv; a row whose program is entirely portable words.
-
-   **The executed control** uses the exact current prefix and direct argv execution — not a local
-   shell — with `jq -n`, so it needs no stdin or file and cannot mutate BMC state:
-
-   ```
-   portable positive   ["jq","-n","-r","7"]                 -> exit 0, stdout "7"
-   current form        ["jq","-n","-r","[1,2] | length"]     -> intended "2"
-   serialized form     ["jq","-n","-r","'[1,2] | length'"]   -> expected "2"
-   ```
-
-   Discriminating result: portable and serialized controls succeed while the current form does not
-   produce the same exit/stdout observation. Capture local client version, remote SSH banner and
-   remote login shell. **If the current form unexpectedly yields `2`, that is positive evidence for
-   an unmodeled saving layer**, and the next probe captures the command string seen remotely.
-
-6. The SSH slice needs a discriminating program containing spaces, a pipe, quotes, brackets and a
-   value containing a single quote, and must reuse the grammar-owned quoting the effect-plan Bash
-   path already demonstrates rather than retaining `shell_quote`.
-7. Reverse ingestion — reading argv back through the same rows — is the terminal second reading
-   and is **not a prerequisite for the first emitter cut**.
-8. **Measured substrate observation — `Optional<T>` at a primitive `T` in record-field
-   construction position.** `stdin: Optional<String>` with an inline `Present { value: … }`
-   refuses with `expected 'Coproduct(Optional)', got 'Primitive(String)'`, independent of the
-   payload expression: a pattern-bound variable, a renamed binding, a shorthand pattern and a bare
-   `"x"` literal all reproduce it, while `stdin: Absent` resolves. Inline `Present` into a declared
-   `Optional<T>` field is ordinary elsewhere (`gunbc.witness_row_cost` `basis`,
-   `gunbc.declared_import_closure_binding` `binding_source`,
-   `v2.workflow.effect_plan_bash_materialize` `operation`), but every such `T` is a record or
-   coproduct — so the discriminator is the **primitive type argument**, not the field form or the
-   explicit-vs-sugar spelling. This lane uses the corpus's own `String?` sugar, the existing
-   modeled form for an optional field (625 sites), not a workaround. **The observation is
-   recorded, not diagnosed:** whether sugar and explicit generic genuinely differ at a primitive
-   argument, or the refusal has another cause this bisect did not separate, is unestablished — a
-   §5 line-stop is owed before anything in this lane relies on the distinction.
-
-9. **A live Class B specimen, in this lane's own new code (found by review, 2026-08-19).**
-   `extdeps.tools.jq` `jq_option_canonical_spelling` calls `cli_long_option_spelling` while the
-   module's import list named only `CliArgumentSyntax`, `CliSurface` and `serialize_cli_arguments`.
-   The call resolved — and every Wave 1A assertion passed — because `cli_surface` was already in
-   the assembled closure via those imports: the accidental coverage DESIGN's import-strip thread
-   records as **blocking all further `dag/**` import stripping**, binding by pool membership, not
-   the bare-reference closure. The bystander probe above does *not* catch this — it refuses a
-   *qualified* import of an unexported name, whereas this is an *unimported bare reference* into a
-   module present for other reasons; only the second is silent. Fixed by naming the symbol in the
-   import list. **The general defect is untouched and not this lane's:** nothing refuses the next
-   such reference, and a green witness is not evidence that a module's imports are complete.
-
-9-ter. **BLOCKER, PROVEN BY EXECUTION: the argv transport silently destroys argument boundaries
-   for computed lists (2026-08-19).** A `List<String>` built by folding is CONCATENATED into one
-   argv word; the identical literal list is SPLICED. Same declared type, elements and handler, two
-   different processes.
-
-   **Receipt, through the production handler `jq.Process.RunWithStdin`:**
-
-   ```
-   arguments = ["--raw-output", "."]        literal   -> exit 0   (jq ran; two argv words)
-   arguments = fold_list(... same two ...)  folded    -> exit 2
-       jq: Unknown option --raw-output.
-   ```
-
-   And from the first wet run of the real vertical, three lowered arguments arriving as one:
-
-   ```
-   $ jq --raw-output--exit-status.missing   (exit=2)
-   ```
-
-   **Mechanism** — `v1_interpreter.rs` `push_shell_argv_tokens`. `Value::List` splices each item.
-   `Value::Variant` tries `value_as_host_string` FIRST, which walks a free monoid and concatenates
-   it into one String, pushing a single argv word; only on `None` does it fall through to
-   `free_monoid_to_vec` and splice. A folded list is monoid-encoded with all-`Str` elements, so
-   the concatenating reader wins. `gunbc.WitnessBin.Run` escapes only because its `args` is a
-   literal at each call site.
-
-   **Independently attacked:** an outside reviewer failed to refute this — the source matches the
-   reading, and the collapse occurs BEFORE `Command::args`, ruling out a downstream shell or SSH
-   join.
-
-   **Why neither obvious repair is correct.** Reordering the arms would splice this case but SHRED
-   a modeled `String`, because a String is itself a monoid here (`value_as_host_string`
-   reconstructs one from code points): both readings succeed on a monoid of `Str`s, and the runtime
-   cannot separate *list of arguments* from *string assembled from pieces*. The disambiguator is
-   the DECLARED TYPE, erased at that seam — the missing application-argument typechecking that
-   `target_model` `target_text_carrier_scaffold_note` names as the trigger for every type-based
-   construction guarantee at a call boundary. Hand-authoring a literal argv in the handler defeats
-   row-derived lowering and leaves the next caller silently joined — the workaround shape §5 treats
-   as a line-stop.
-
-   **Rung:** a §5 fail-open — it fabricates one plausible argument instead of refusing — and the
-   LANE'S OWN DEFECT CLASS one layer below the lane: Wave 0's witness asserts fragments concatenate
-   within an argument and never across, and the transport violates exactly that. Also a live
-   specimen of the model↔realization fork DESIGN tracks as an open thread.
-
-   **CORRECTION (same day, adversarial review): "blocked on application-argument typechecking"
-   was WRONG, and too strong.** The diagnosis survived independent verification — the reviewer
-   traced `build_service_param_env` (clones call arguments with no conformance check),
-   `dispatch_shell`, and `Command::new(&argv[0]).args(&argv[1..])`, confirming the vector is
-   malformed before `Command` sees it, so no later join is an alternative explanation. The refusal
-   to reorder the branches was upheld. The conclusion was not: **a correct construction is
-   available now.**
-
-   In-tree counter-evidence: `OperationInputValue = InputText | InputTextList` already carries
-   tagged list intent, and its realization converts that tag into a native `Value::List`
-   (`free_monoid_to_vec` then `list_value`), so the later flattening splices. Tagged intent →
-   native list is proven possible *without* global argument typechecking.
-
-   The deeper correction: even a fully typechecked system would not answer the transport's
-   question. `List<String>` does not say whether a collection becomes several argv words, one JSON
-   argument, a comma-joined option value, or repeated option/value groups. **That is a transport
-   ROLE, not a data type**, to be modeled rather than inferred from runtime encoding.
-   Application-argument typechecking remains independently valuable and is neither necessary nor
-   sufficient here.
-
-   **The construction:** one explicit nominal carrier — `ProcessArgvExpansion { surface: CliSurface }`,
-   sealed — with an interpreter branch BEFORE the generic string/list heuristic that requires the
-   nominal `CliSurface`, iterates its arguments, and pushes exactly one host word per
-   `CliArgument`, concatenating that argument's fragments into that word. It carries `CliSurface`
-   rather than `List<String>` so the payload cannot be dynamically ambiguous: a modeled string
-   cannot impersonate a list of nominal `CliArgument` records, and `value_as_host_string` is used
-   only on one admitted argument's text, where concatenation IS correct. Wave 0's theorem enforced
-   at the host edge.
-
-   **Explicitly not to be landed** (each rejected for a stated reason): reversing the two `Variant`
-   branches (damages modeled strings); `map(identity)` to coerce a native list, rebuilding the
-   emitted argv as a literal, or join-then-shell-split (runtime-representation workarounds, and the
-   last reintroduces shell parsing); routing jq through `OperationInputValue` permanently (that
-   carrier belongs to declaration-owned operation materialization); accepting BOTH a raw
-   `List<String>` and the explicit carrier (two authorities, future callers free to pick the unsafe
-   one). The raw-list handler signature is REPLACED, not retained for compatibility.
-
-   **Consequence for this lane:** the cutover is blocked at the execution seam *until that carrier
-   lands* — a build, not a decision. The semantic spine is built and resolving; no consumer can
-   move until then, because every migrated call site computes its argv rather than authoring it
-   literally — precisely what the migration asks callers to do.
-
-9-bis. **The Class B specimen RECURRED, in code written after it was documented (review 53669,
-   2026-08-19).** `jq_invocation_process_plan` used `bind_outcome` and `outcome_accepted` with
-   neither in the module's `v2.std.diagnostic` import list. Same mechanism as the
-   `cli_long_option_spelling` case one commit earlier, same lane, same author who had just written
-   that entry.
-
-   **Two things this settles.** First, the mitigation must run *after every addition*: the
-   unimported-reference sweep was clean, then a function was added and the sweep not re-run. A
-   one-time audit does not close a class whose defect is invisible. Second — correcting the review
-   that found it — the stated consequence, "as written this file will not resolve", is **false**,
-   and its falsity is the point. The file resolves, and
-   `stdin_survives_lowering_into_the_process_plan` executes green *through the affected function*,
-   because `v2.std.diagnostic` is already in the closure via other imports. A reviewer predicting a
-   resolution failure would be refuted by running it and might dismiss a real finding. The correct
-   statement: the reference is unimported, it binds by pool membership, and **nothing in the tree
-   will tell you** — not the resolver, not CI, not a green witness.
-
-10. **The spelling-seam extraction is right, but its obvious shape is forbidden — corrected
-   2026-08-19.** The static-dependency finding stands: at execution grain the jq fold reaches no
-   compiler machinery, but at dependency grain `cli_surface` imports `v2.std.compilers.target_model`,
-   whose closure carries target-representation, host-runtime and node-query machinery. The property
-   worth having is not *nobody calls translate* but *this fold cannot acquire that dependency
-   accidentally*.
-
-   The proposed repair — extract a shared `spell_concrete_syntax_fragments -> Outcome<String>`
-   below `target_model`, with the TargetText serializer wrapping its result — **violates an
-   operator ruling in the file it would edit.** `target_model` `target_text_carrier_scaffold_note`
-   (operator, 2026-07-15) places `TargetText` beside `bound_tokens_source_text` so that fold is
-   *carrier-native*: the single `String -> TargetText` introduction is `text_atom` applied to one
-   grammar-classified token **inside** the fold, the only join is `target_text_seq`, the only exit
-   is `render_target_text`, and there is deliberately **no** `String -> TargetText` lift of an
-   already-composed unit — "that direction is the smuggle the wall closes." Wrapping a composed
-   `String` is that lift.
-
-   **The corrected decomposition, better anyway.** The shared authority is *what is this token's
-   spelling* — `lex_rules_literal_for_class` and `bound_spelling_from_map`, both token-grain —
-   **not** *how spellings are concatenated*. Concatenation is carrier-specific: emitted source
-   composes through `TargetText`, an argv argument into a `CliArgument` — different media. So the
-   extraction moves the token type and the two token-grain lookups into
-   `v2.std.compilers.concrete_syntax`, `target_model` imports them back (re-export proven — see
-   below), and each carrier keeps its own fold. No composed `String` is lifted, `cli_surface` stops
-   importing `target_model`, and one lookup authority serves both.
-
-   **Re-export is measured, not assumed.** A three-module probe showed a consumer importing a
-   symbol from a module that merely imported it resolves and executes. Alone that proves nothing,
-   since this resolver can bind by *pool-membership coincidence* (DESIGN's Class B finding). The
-   discriminating control: importing the same symbol from a bystander module that never saw it
-   **refuses**, located — `name 'ProbeToken' not found in module '...bystander'` — even with the
-   defining module in the pool. Qualified-import resolution is import-list-driven, so
-   `target_model` importing the seam back keeps its 167 other importers untouched.
-
-   **Not performed.** `target_model` is load-bearing and carries the ruling above; the move is its
-   own increment under its own review.
-
-11. **A downstream typed verdict may be the redundant lower rung, not a peer** (raised by
-   `eager-wren-138`, 2026-08-18). `gunbc.host_effect_realize` `bmcweb_token_extraction_verdict`
-   refuses blank stdout as its own decode — the wall that closed that fail-open, with `jq -e` only
-   loudness beside it. If the semantic layer makes *absence-is-a-value* unwritable at the decode,
-   that verdict is a second representation of one requirement (§2/§3) and must **dissolve into**
-   the decode. A §4b climb: its discriminating RED stays enrolled against the new decode while the
-   production check is deleted. Open because it is not established whether the requirement is
-   exactly one nonempty string at *every* consumer or only at the credential path; the OpenBMC
-   sensor path models absence as a legitimate third state (`OpenBmcSensorValueAbsent`), so a
-   blanket absence-is-refusal decode would be the state-space collapse this lane exists to remove.
-
----
-
-## 11. Corrections receipt
-
-Claims asserted during this design and refuted by measurement, kept so they are not re-derived:
-
-- *"The declarative `transport shell` form is fixed-arity and cannot express variadic options."*
-  **False** — `ssh.Session.ExecArgv` and `ExecPortableWords` splice `List<String>`.
-- *"SSH becomes a bound handler over the same tree."* **Incomplete** — RFC 4254 forces a string
-  at that boundary; structure cannot cross it as structure.
-- *"`ProcessInvocation` is the general process carrier."* **False** — it is an emit-harness carrier;
-  its argument variants are provenance, not CLI roles.
-- *"`SensorIntegerValue` has no consumers."* **False** — two live consumers, and its empty-output
-  branch is a modeled `OpenBmcSensorValueAbsent`, so an `-e` sweep would have collapsed a correct
-  three-state decode into a refusal.
-- *"`ExtractRaw` and `SensorIntegerValue` are both latent traps."* **False** for the second; only
-  `ExtractRaw` is zero-consumer.
-- The plan's census (262 lines / 37 files; 148/51 success/exit_code) is **stale**; measured
-  597/129 and 173/69.
-- *"`JqProducedNoResult` is a general arm on every jq execution."* **False** — verified against
-  `jqlang.org/manual/`: default jq exits 0 regardless of output, and only `--exit-status` yields
-  exit 4 for "no valid result was ever produced". Claiming the arm unconditionally would have
-  reintroduced the `Absent → Refused` collapse #8454 had just withdrawn.
-- *"'Exactly one nonempty string' is a decode the domain can perform."* **Over-claimed** — jq emits
-  a stream and `-r` permits newlines inside a raw string, so a collapsed stdout `String` is
-  ambiguous. `--raw-output0` exists precisely because of this.
-- *"The class sits at mechanically preventable."* **Too coarse** — that is the corpus-wide claim;
-  the migrated path can reach structurally guaranteed now via a sealed constructor.
-- *"Filters move to `gunbc.bmc_fan_projection`."* **Needed splitting** — only policy-bearing
-  programs move; OpenBMC wire decoders stay in `extdeps.bmc`.
-- *"`JqProducedNoResult` is an arm beside `JqExitZero`."* **False** — the live `SensorIntegerValue`
-  case holds both at once (exit 0, zero results), so termination and output presence are a
-  product, not a sum. Written as a sum, the live case is unrepresentable.
-- *"Removing `success: Bool` closes the contradiction."* **Insufficient** — an unsealed
-  `JqObservation` lets `{ exit: JqExitZero, exit_code: 4 }` be authored, the same contradiction
-  under richer names. The carrier must be `sole_constructor`, minted only by the decoder.
-- *"The class sits at mechanically preventable because nothing refuses it."* **Internally
-  inconsistent** — if nothing refuses it, it is not prevented. Replaced by the subject-grained
-  matrix.
-- *"jq owns how it spells options AND `CliSyntax` owns canonical spelling."* **Two authorities for
-  one decision**, committed inside a note about exactly that.
-- *"The carrier probe will hit a named refusal."* **False** — `emit`/`serialize_target` are fixed
-  to `Medium<String>` and structured return mismatches fall outside the judged conformance
-  population, so a compile-only probe **false-greens**.
-- *"The smallest complete vertical includes SSH."* **False** — SSH adds a second language target
-  and three independent failure modes; the unit is local-only.
-
----
-
-## 12. `JqProgram` is public, and the domain still authors jq source
-
-Raised by the `shell → dag` session against the `SensorIntegerValue` cut: after the migration,
-`extdeps.bmc.openbmc_fan_control` no longer authors argv — but it *does* author
-
-```
-data openbmc_sensor_integer_program: String =
-  "if (.data | type) == \"number\" then (.data | round) else empty end"
-```
-
-so the workflow moved from authoring shell to authoring jq. `JqProgram { source: NonEmptyStr }`
-is a public constructor, so every domain module may do the same.
-
-**The objection is right about the residue.** The cut established something narrower than "the
-domain stopped authoring foreign syntax": it stopped authoring *argv*. OpenBMC no longer names
-`-r`, `--raw-output`, an option spelling, an argument position, argv[0], or the stdin routing — all
-derived from jq's cited rows, the property the two-level derivation buys. The jq *program* is
-untouched.
-
-**The proposed remedy — keep `OpenBmcSensorIntegerProjection { content }` public and have the
-handler privately select a sealed program identity — is refused as stated, on §2.** It does not
-decompose the program; it relocates the same string behind an indirection and adds a registry.
-If the handler is OpenBMC's, the jq source is still in the OpenBMC layer with a wrapper added. If
-the handler is jq's, `extdeps.tools.jq` knows what a BMC sensor reading is — a layer inversion.
-Neither beats the existing row, and the second is worse. A sealed identity buys something only if
-*derived*, which is the real answer:
-
-**The terminal shape is that the program is not authored at all.** `.data`, "is it a number",
-"round it", "otherwise nothing" are a modeled JSON projection — a path, a type guard, a rounding
-policy, an absence arm — of which a jq program is ONE realization, as an argv vector is one
-serialization of a `CliSurface`. The domain declares the projection, jq's module derives the
-program text as it already derives option spellings, and a second realization (a native JSON fold
-with no process) comes free. The same move the lane made one layer out, applied one layer in —
-and what stops this work generalizing into a thousand bespoke jq programs where it found a
-thousand bespoke argv lines.
-
-**Rung, honestly.** Domain-authored jq source is **mitigatable**: nothing prevents it; the only
-things between it and an arbitrary computed program are that the row is `data`, not a function —
-so it cannot vary per call — and review. Not a wall.
-
-**Dissolution trigger:** a modeled JSON projection carrier with jq as a derived realization. Until
-it lands, `JqProgram` stays public and this section is the reason. Deliberately NOT in the current
-cut: a JSON projection algebra is its own vertical, and bundling it would repeat the Wave 1A
-mistake of selecting the richest thing first.
-
-
----
-
-## 13. The observation contract travels with the plan
-
-Raised as "`JqAdmittedProcessPlan` cannot be decoded" by the `shell → dag` session. Verified
-against the code and **worse than raised** — a live latent defect in the cut itself, not a missing
-convenience.
-
-The sensor decoder read `exit_code`, `stdout` and `stderr` directly and mapped every nonzero exit to
-a refusal — correct under `JqProgramExit`, silently wrong under `JqLastResultExit`, where jq
-documents exit **1** as "the last output was false or null" (a legitimate *value*) and exit **4**
-as "no valid result was ever produced" (*absence*). Nothing connected the decoder to the policy
-that produced the argv, so changing `exit_policy` would leave the decoder answering the previous
-contract. §5's own tell: the declaration is edited while the realization goes on lying, and the
-witnesses stay green because they never varied the policy.
-
-**Repair.** `JqAdmittedProcessPlan` carries `exit_policy`, so the plan is self-describing. One
-authority, `jq_classify_observation`, reads an exit code *against* the policy that asked for it and
-returns `JqOutputPresent | JqOutputAbsent | JqExecutionRefused`. The domain matches those arms and
-decides only what OpenBMC alone can — whether a present projection parses as an integer. No domain
-module reads a jq exit code any more.
-
-**Discriminating evidence.** Five assertions hold one observation fixed and vary only the policy:
-
-```
-exit 1, stdout "false"   under JqProgramExit     -> Refused
-exit 1, stdout "false"   under JqLastResultExit  -> Present     <- the policy-blind decoder fails here
-exit 4, stdout ""        under JqLastResultExit  -> Absent
-exit 2, stderr "usage"   under BOTH              -> Refused
-exit 0, stdout "   "     under JqProgramExit     -> Absent
-```
-
-The second row discriminates: a policy-blind decoder must answer `Refused` for exit 1 under both
-policies, so it cannot make rows one and two true at once. The fourth row keeps the law from
-overfitting — the policy changes how *some* codes read, not whether jq can fail.
-
-**This also closes the point `eager-wren-138` reached from the other direction.** That session
-proposed sweeping `-e` across jq sites as hardening; the counter was that `-e` reports on the *last
-output*, converting legitimate `false`/`null` into failure. Both facts are now modeled: selecting
-`JqLastResultExit` changes the *decode*, not just the flag, and absence stays distinct from refusal
-on both arms.
-
----
-
-## 14. Verification scoped to the consumers I already knew about
-
-Recorded as the third instance of one failure mode in this lane's own work; the first two were
-caught by other people.
-
-Changing `openbmc_sensor_integer_projection_result`'s signature broke two enrolled witnesses
-(`failed_sensor_projection_cannot_become_absent`, `successful_empty_sensor_projection_is_absent`)
-that call the decoder directly. I did not find them: I selected witnesses by asking which files
-import `openbmc_fan_control.dag` **and then hand-picking three** — the verification denominator was
-a list I wrote, not one the tree produced. The break surfaced only when a resolve failed on an
-unrelated run.
-
-The same shape produced the two earlier defects: an unimported-reference sweep run *before* the
-last addition, and a grep whose zero result was accepted without a control that must hit. Each
-time the mechanism was sound and the **denominator** was authored.
-
-**A third instance, one level up, caught by CI after the above was written.** The rule below fixed
-the witness denominator and was still not enough: I minted `type ExpectedOutcome` in the jq witness,
-colliding with `gunbc.output_policy`'s load-bearing carrier of the same name, and the failure landed
-in `output_policy_witness_test.dag` — **a file referencing none of my symbols, never touched by this
-branch.** Bare-reference resolution is corpus-global, so a new top-level name can red a file no
-per-file closure of mine would load. Every local run passed; the whole-corpus strict resolve caught
-it.
-
-Two rules follow, both mechanical because the authored version keeps failing:
-
-```
-# every top-level name the branch ADDS, from the diff -- not from memory
-git diff main...HEAD -- '*.dag' | grep "^+"   | grep -oE "^\+\s*(type|fn|data)\s+[A-Za-z_][A-Za-z0-9_]*" | awk '{print $NF}' | sort -u
-# each one must have exactly ONE declaration corpus-wide
-
-# and run what CI runs, before pushing, not after it fails
-claim_executor --required-floor --source-root dag --source-root src/v2
-```
-
-The second matters most: **a per-file run and the floor are different universes**, and only the
-floor is the acceptance path. Reporting a per-file green as the floor is rung inflation against a
-declared boundary (§4b) — citing the strongest path while another stays silent, committed against
-my own change.
-
-**Rule adopted for the rest of the lane:** verification enumerates test functions from the FILE,
-never from memory —
-
-```
-grep "^test fn" <witness> | sed 's/test fn \([a-z_0-9]*\).*/\1/'
-```
-
-— and every function in every witness file touching a changed signature runs, not a chosen subset.
-§5's oracle principle applied to coverage: a population I author is not an observation of the
-population that exists.
-
-**What the break demonstrates — the argument for the cut.** Both witnesses were re-enrolled
-unchanged in *requirement* — a refusal must not decay into absence, an empty successful projection
-must not decay into a refusal — while their *carrier* moved from a `success: Bool` triple to the
-typed jq outcome. The migration also made a third requirement stateable that the old triple could
-not: a present numeric projection is an observation. A replacement migration behaving correctly
-(§3): deletion surfaced the load, the load was dispositioned as re-enrolled evidence rather than
-restored by reflex, and the new representation is strictly more expressive.
-
----
-
-## 15. Wave 1B cutover receipt
-
-Executed on BuildBuddy against the branch tree. Counts are from enumerating `^test fn` in each
-file, not from a chosen subset (§14).
-
-```
-extdeps.bmc.openbmc_fan_control                 SensorIntegerValue operation DELETED
-  consumers rewired                             2 (openbmc_sensor_value, openbmc_sensor_threshold_result)
-  both now route through                        openbmc_sensor_integer_projection  (one shared fn, not two call sites)
-  argv authored by the domain after cutover     0 -- no -r, no --raw-output, no argv position, no argv[0]
-  residual foreign syntax authored              1 jq program row (S12, mitigatable, trigger recorded)
-
-test/claim/bmc_typed_operations_witness         29 / 29 pass
-  of which migrated onto the typed jq outcome    2 (requirement unchanged, carrier replaced)
-  of which newly stateable and added             1 (present numeric projection is an observation)
-test/claim/jq_invocation_lowering_witness        9 / 9 pass  (lowering)
-                                                 5 / 5 pass  (S13 exit-policy classification)
-test/claim/bmc_fan_converge_witness              duty_curve pass
-test/manual/process_argv_expansion_receipt       case 4 pass -- real jq, exit 0 reachable only
-                                                 with two argv words, through the production handler
-```
-
-**What this receipt does NOT establish** — the table reads stronger than the lane's position:
-
-- The argv splice defect is repaired at **one seam**, not closed as a class. 21 operations still
-  splice a declared `List` parameter through the guessing path.
-- The other three `openbmc.JsonProjection` operations were unmigrated, and two of them
-  (`ObjectMapperServiceCount`, `ObjectMapperServiceAt`) needed `--argjson` lowering, which was
-  unbuilt. Both are now landed — see §17 (Wave 1A cutover receipt). The remaining unmigrated
-  operation is `ProjectFanConfig`, whose sole consumer is dead code; file-input lowering has since
-  landed with the remote population (Wave 2, §18), so its migration is unblocked but not yet cut.
-- No negative falsifier exists yet proving a REST path reaches none of these carriers.
-- **The wet receipt does not execute in CI — a declared gap, not an enrollment.** The hermetic
-  floor refuses `jq.Process.RunWithStdin` (no `mock_response`) and mocking would defeat the
-  assertion, so the file is named in `cli_run.rs` `floor_prepared_subject_exclusions`. No wet lane
-  exists to host it: the falsifier and wet batches died with the floor cut, and
-  `v2.workflow.required_floor` deliberately defers wet lanes until the question can be "asked
-  against a live consumer". The claim sits at **UNEXECUTED-IN-CI**, evidenced only by the recorded
-  run above and reproducible locally with:
-
-  ```
-  claim_batch --wet --source-root dag --source-root src/v2     --entry dag/test/manual/process_argv_expansion_receipt_test.dag     --functions case4_expansion_carrier_splices
-  ```
-
-  **Re-enrollment trigger:** a wet lane with a live consumer exists again.
-
-  The first attempt at this admission added rows to `gunbc.ci_layer_roots`
-  (`witness_exclusion_frontier` + `bin_witness_wet_entries`) with a commit message asserting they
-  would take effect. They did not — `run_required_floor` consults the Rust list and nothing else;
-  the CI receipt was an unchanged `modules_excluded=2`. Both rows were reverted: a roster row with
-  no live consumer is specification-without-execution, and the enrollment half would have *claimed*
-  an executing consumer for a witness nothing runs. Instructive mistake — I read a neighbouring
-  row's shape as the mechanism instead of tracing the mechanism's caller.
-- The wet receipt run reports `[expectation-frontier] 1 site(s), 1 dispatch(es) undeclared:
-  jq.Process.RunWithStdin=1` — the new handler's dispatch is not declared to the expectation
-  registry. Left standing, not silenced, because it is the shape §5 asks for — typed, located,
-  counted, visible — but it IS an open item; a `PASS` line does not mean nothing else was reported.
-- The 5 classification assertions and the wet receipt ran separately from the 29+9; a single run
-  of all 43 exceeded the 45-minute remote timeout, because every `gunbc run` pays a whole-corpus
-  typecheck. A cost-shape observation about the harness, not evidence about the code.
-
-## 16. The negative falsifier: the REST/CLI boundary becomes a row that reds
-
-Every prior section asserts, in prose, that the REST path constructs no process invocation.
-Prose cannot be contradicted by the tree; this section records the mechanism that can.
-
-**The question already had an authority, so no second mechanism was minted.**
-`v2.lens.realization_vocabulary_containment` answers "does module X reach construction vocabulary
-from set V" and has since the TypeScript-only ratchet. The obstacle was that `V` was a literal:
-`scan_facts_for_leaks_under` threads the *importer-path* axis as a parameter while
-`module_is_target_ast_vocab` was welded into the predicate. A second lens for a second `V` would
-be the §3 duplication this lens exists to detect, so the vocabulary axis was opened instead — the
-§2 horizontal move, one axis rather than N copies.
-
-What that cost:
-
-- `RealizationVocabularySet` (name, modules, module_prefixes) and `module_is_in_vocab`.
-- `target_ast_vocabulary()` derives from the existing `target_ast_vocab_modules` /
-  `target_ast_vocab_module_prefixes` rows rather than replacing them — those rows are consumed
-  directly by `gunbc.realization_vocab_confinement_census`, which has live claims against them.
-- `is_vocab_leak_in` / `scan_facts_for_leaks_in` / `vocab_leak_count_in` / `vocab_leak_count_live_in`,
-  taking vocabulary and exempt-edge population as arguments. Every pre-existing entry point
-  delegates to these with the target-AST set, so no behavior moved.
-- The exempt population is a **parameter**, not a global roster read, so "this vocabulary has
-  zero admitted exceptions" is a stated fact, not an accident of the target-AST roster naming no
-  CLI module.
-
-**Two sites were left target-AST-only, deliberately.**
-`realization_vocab_leak_candidate_paths_from_facts` and
-`realization_vocab_live_leak_edges_from_facts` feed the grandfathered-roster staleness check, and
-every row in that roster is target-AST debt by construction — `RealizationVocabDebtClass` has no
-other inhabitant. A second vocabulary reaches the lens with an empty exempt population, so it has
-no roster to be stale against; parameterizing them now would answer staleness about a population
-that does not exist. Trigger recorded in-file: the first non-empty exempt roster for a second
-vocabulary.
-
-**The subject is not an empty universe** — the usual way a negative claim turns vacuous. The
-scanned population (`dag/extdeps/bmc`, `dag/extdeps/transports`) *contains* a module that
-legitimately reaches CLI vocabulary: `extdeps.bmc.openbmc_fan_control`, which this lane routes
-through jq, in the same directory as `extdeps.bmc.redfish`, which does not. So the scan
-discriminates *within* the population, and the RED control is live corpus data, not a planted
-fixture: withdraw the one admitted edge and the count must become 1. Without that assertion the
-positive result is indistinguishable from a scan that read nothing — the empty-observation narrow
-DESIGN names, ⊥-as-answer conflated with ⊥-as-ignorance.
-
-The admitted edge is named at exact `(importer_path, vocab_module)` grain, not by category or path
-prefix, so a *second* jq-reaching module anywhere in the scanned roots reds instead of being
-absorbed by a broad pattern.
-
-**What executes, and what does not.** The witness is floor-discovered — neither `long/`-homed nor
-in `floor_prepared_subject_exclusions` — and its scan is a live read of the two named directories:
-corpus data, not a fixture. It is **not** whole-corpus coverage: a module outside those roots
-reaching CLI vocabulary is not seen, and no green here says otherwise. The whole-corpus half of
-this lens is enrolled on a cadence that does not currently run — a fact about that cadence, not
-this witness. Both halves are stated because a scoped green presented as general is the rung
-inflation §4b calls worse than sitting low.
-
-**Where this goes, not scoped here.** The boundary in #8535 is a paragraph today. If this
-generalization holds, the successor is that the paragraph becomes a row that reds — changing what
-the lens is *for*: not one witness for one lane, but the mechanism by which a named architectural
-boundary is enforceable at all. A separate change, deliberately not attempted here.
-
-## 17. Wave 1A cutover receipt
-
-Executed on the session tree against `origin/main` @ #10104. Counts are from enumerating `^test fn`
-in each file, not from a chosen subset (§14).
-
-```
-extdeps.tools.jq  jq_invocation_lower now lowers a JqJsonBinding instead of refusing it
-  JqCliOptionArgJson                      --argjson, cited long form, canonical spelling, lex rule
-  refusal causes                          JqBindingNameDuplicate | JqTextBindingUnwired | JqFileInputLoweringUnwired
-  binding argv                            --argjson <name> <value> as THREE words, before the program operand
-  binding spelling keys                   injective over (name, role): role prefix + name, duplicate names refuse
-  JqBindingLoweringUnwired                DELETED (dissolution on climb)
-
-extdeps.bmc.openbmc_fan_control           ObjectMapperServiceAt / ObjectMapperServiceCount operations DELETED
-  consumers rewired                       2 (openbmc_object_mapper_services_rec, openbmc_sensor_service)
-  both now route through                  openbmc_object_mapper_service_at / _count (semantic JqInvocation)
-  argv authored by the domain after cutover 0 -- no --argjson, no -e, no -r, no argv position
-  residual foreign syntax authored        2 jq program rows (S12, mitigatable, trigger recorded)
-  callers match                           OpenBmcServiceObserved | OpenBmcServiceProjectionRefused (+ count sibling)
-```
-
-**Witness standing at cutover:**
-
-```
-test/claim/jq_invocation_lowering_witness   16 / 16 pass  (lowering + S13 classification)
-  of which newly stateable and added          3 (json_binding_lowers_to_exact_argv, duplicate_binding_names_refuse, text_binding_refuses)
-  of which flipped from refusal to positive   1 (the old unlowered_bindings_refuse became json_binding_lowers_to_exact_argv)
-test/claim/bmc_typed_operations_witness      object_mapper_zero/one_cardinality + duplicate_matches pass
-whole-corpus regen                           first_generation_equal=true
-```
-
-**What this receipt does NOT establish** — the table reads stronger than the lane's position:
-
-- Wave 1A lands the **local** `--argjson` vertical. File-input lowering and the first SSH
-  migration have since landed — see §18 (Wave 2 cutover receipt). `ProjectFanConfig` still carries
-  a raw argv (its sole consumer is dead code), and `JqFileInputLoweringUnwired` dissolved with the
-  file-input lowering.
-- `JqTextBinding` deliberately refuses: no live consumer this wave, so it must not emit a plausible
-  guess (DESIGN §5). It lowers when a caller needs `--arg name value`.
-- The ObjectMapper callers were verified against the bmc witness mocks; no live BMC was exercised.
-
-## 18. Wave 2 cutover receipt — the first SSH migration
-
-Executed on the session tree against `origin/main` (PR #10148). Counts are from enumerating
-`^test fn` in each file, not from a chosen subset (§14).
-
-```
-extdeps.tools.jq                    jq_invocation_lower now lowers JqInputFile instead of refusing it
-  file-input argv                     the path is ONE bound operand AFTER the program operand
-  process input                       JqProcessNoStdin -- the file's bytes never enter a process channel
-  JqFileInputLoweringUnwired          DELETED (dissolution on climb)
-
-extdeps.bmc.openbmc_password_ssh_transport
-  FanStepwiseCount operation          DELETED at the root (raw sshpass/ssh argv: jq -er <program> {config_path})
-  RunCommand operation                ADDED -- the RFC 4254 command-string carrier, fixed sshpass/ssh argv
-  note                                one command-string row declared; the caller never authors argv
-
-extdeps.bmc.openbmc_fan_control      openbmc_fan_config_stepwise_count (semantic JqInvocation -> remote realization)
-  remote realization                  openbmc_remote_jq_command / openbmc_remote_jq_execute
-  stdin-fed remote jq                 TYPED refusal (OpenBmcRemoteJqStdinUnwired): sshpass -d 0 holds fd 0
-  command string                      grammar-owned single-quote encoding (remote_exec_command_string),
-                                      never append(ssh_prefix, inner.argv)
-  interpretation                      PRODUCTION PATH PASSES Unknown AND REFUSES until a live target
-                                      confirms a POSIX shell (review 38602; openbmc_dropbear_interpretation
-                                      stays the pure emitter's witness-time understanding, not a
-                                      fabricated production assumption)
-  decode                              openbmc_fan_config_stepwise_count_result reads JqOutcome,
-                                      never success/stdout/stderr
-
-test/claim/jq_invocation_lowering_witness   16 / 16 pass  (file-input lowering + refusal-cause split)
-  of which flipped from refusal to positive   2 (unlowered_file_input_refuses ->
-                                                file_input_lowers_to_exact_argv; and the file-cause
-                                                test became file_input_reaches_the_plan_as_no_stdin)
-test/claim/remote_jq_ssh_migration_witness   12 / 12 pass  (decode + words + command string +
-                                                stdin refusal + interpretation + review pin +
-                                                production-gate refusals)
-test/claim/bmc_typed_operations_witness      object_mapper/threshold/sensor tests still pass
-whole-corpus regen                           first_generation_equal=true
-```
-
-**What this receipt does NOT establish** — the table reads stronger than the lane's position:
-
-- Wave 2 migrates the FIRST remote jq population (`OpenBmcStepwiseCount`). The other remote jq
-  operations (`FanMinimumDuty` … `FanInputAt`, `FanConfigValidate`, `FanConfigVerify`) still carry
-  raw sshpass/ssh argv; each is the same mechanical shape now proven — a semantic JqInvocation,
-  the remote realization, a JqOutcome decode — but the cutover is deliberately one site.
-- The REMOTE half of the command-string path is UNEXECUTED against a live target. The hermetic
-  witnesses prove `emit_remote_shell` matches the cited IEEE 1003.1-2017 §2.2.2 single-quote
-  encoding exactly; they never prove the far side agrees. That is the declared, unexecuted
-  `remote_exec_command_live_confirmation` receipt in `gunbc.remote_shell_command` — run it against
-  a live OpenBMC/Dropbear target before the remaining remote population is cut over.
-- **The first migration's production cutover is GATED on that live confirmation** (review 38602,
-  REQUEST_CHANGES): `openbmc_remote_jq_execute` passes `Unknown` and REFUSES until a live target
-  confirms a POSIX-shell interpretation — DESIGN §4b/§5, the unobserved assumption is never
-  fabricated into the accepted path. The migration is structurally complete and hermetic-witnessed,
-  but a live OpenBMC/Dropbear target must confirm the interpretation (and record it in
-  `remote_exec_command_live_confirmation`) before `openbmc_fan_config_stepwise_count` can produce
-  an observation instead of the gate refusal.
-- `ProjectFanConfig` still carries a raw argv (its sole consumer `openbmc_fan_config_project_local`
-  is dead code). It needs file-input lowering (now landed) plus its own consumer migration; it is
-  not part of this wave's first SSH migration.
-- `JqTextBinding` still deliberately refuses: no live consumer, so it must not emit a plausible
-  guess (DESIGN §5). It lowers when a caller needs `--arg name value`.
-- The migrated decode was verified against witness fixtures; no live BMC was exercised.
diff --git a/docs/plans/cli-run-reconcile-defork.md b/docs/plans/cli-run-reconcile-defork.md
index 0eca50ae07c..044b84969ae 100644
--- a/docs/plans/cli-run-reconcile-defork.md
+++ b/docs/plans/cli-run-reconcile-defork.md
@@ -25,7 +25,7 @@ Three findings, each a reason to *design* rather than transliterate:
 
 1. **CORRECTED (cursor review caught this):** `decl_facts`/`concept_decl_facts` (`src/v2/std/concept_index.dag`) is the wrong authority to cite — its `ConceptDecl`/`DeclFact` rows carry `{qualified_name, name, kind, node, rel_path}`, no import edges. The real structural surface already exists and is `.dag`-modeled: `cli_run.rs`'s `import_resolution_facts`/`module_declaration_facts` (~line 7012–7068) produce `ImportResolutionFact`/`ModuleDeclarationFact` rows, projected purely in `src/v2/lens/module_graph.dag`. So the redundancy is narrower than "cli_run.rs re-scans text instead of using decl_facts": `resolve_transitively`'s BFS in the *resolve/reconcile* path duplicates the closure `module_graph.dag` already computes over that fact shape (see #2). The `extract_import_paths` regex-scan is a real but *separate* lever — still live inside `import_resolution_facts` (the host builtin backing the modeled facts), not eliminated by this lane, and NOT gated on `decl_facts_project.rs`'s dissolution (unrelated fact shape, no import edges there either).
 2. **The closure fold already exists in `.dag` — repoint onto it, don't re-author it.** `src/v2/lens/module_graph.dag`'s `import_closure`/`import_closure_live` already computes the transitive module closure over `ImportResolutionFact`/`ModuleDeclarationFact` (a `FreeMonoid`+fuel-bounded fixpoint, not `std.graph`'s `CallGraph` adjacency — a possible second closure-algorithm fork, worth a separate note to the operator, out of this lane's scope). `resolve_transitively`/`resolve_entry_graph`'s closure computation should call `import_closure_live` — not `std.graph`, not a new bespoke BFS, not a new `compile_module_graph.dag`; the modeled authority for module closure is `v2.lens.module_graph`, in-tree today.
-3. **Three independent cache tiers, one undeclared authority.** `parse_cache` (keyed by file path), `typed_module_cache` (keyed by module *name*) and the cross-process `resolved_graph_cache` (keyed by content digest via `subject_digest_for_closure`) are three hand-rolled `HashMap`s with three keying policies for one question: "have I already computed this from this content?" `dsl/std/cache_interface.dag` is already modeled AND has real `CacheInterfaceCatalogFacts` inhabitants — `extdeps/realization/resolved_graph.dag` (the disk-tier `resolved_graph_cache` itself) and `extdeps/realization/parse_table_memo.dag` (an existing `locality: InProcess` sibling row — the exact shape `parse_cache`/`typed_module_cache` should take). So this is a de-fork, not greenfield inhabitance: the in-process tiers need `InProcess`-locality sibling rows under the same authority, and the disk-tier realization (`resolved_graph_cache.rs`) should be checked for a model↔realization fork against its own `resolved_graph.dag` row. Keying `typed_module_cache` by name rather than content is a live §5 cache-impurity instance ("key on declared-input content"); the disk tier already keys by content digest, and two policies for one fact is the §3 violation to close.
+3. **Three independent cache tiers, one undeclared authority.** `parse_cache` (keyed by file path), `typed_module_cache` (keyed by module *name*) and the cross-process `resolved_graph_cache` (keyed by content digest via `subject_digest_for_closure`) are three hand-rolled `HashMap`s with three keying policies for one question: "have I already computed this from this content?" `dsl/std/cache_interface.dag` is already modeled AND has real `CacheInterfaceCatalogFacts` inhabitants — `extdeps/realization/resolved_graph.dag` (the disk-tier `resolved_graph_cache` itself) and `extdeps/realization/parse_table_memo.dag` (since deleted with the parse memo carrier, operator ruling R2 2026-10-08; at writing an existing `locality: InProcess` sibling row — the exact shape `parse_cache`/`typed_module_cache` should take). So this is a de-fork, not greenfield inhabitance: the in-process tiers need `InProcess`-locality sibling rows under the same authority, and the disk-tier realization (`resolved_graph_cache.rs`) should be checked for a model↔realization fork against its own `resolved_graph.dag` row. Keying `typed_module_cache` by name rather than content is a live §5 cache-impurity instance ("key on declared-input content"); the disk tier already keys by content digest, and two policies for one fact is the §3 violation to close.
 
 ## 2. Proposed phased authoring (do NOT attempt all of this as one PR)
 
diff --git a/docs/plans/concept-index-enumeration-census-ledger.md b/docs/plans/concept-index-enumeration-census-ledger.md
deleted file mode 100644
index c3660fac121..00000000000
--- a/docs/plans/concept-index-enumeration-census-ledger.md
+++ /dev/null
@@ -1,17 +0,0 @@
-# Census ledger: `concept_index_enumeration` (7 reds, one root)
-
-Parent lane: sunny-bat-82 (out-of-gate v2 silent reds). Pin at dispatch: `9bb74408bd`. Re-derived on current main.
-
-Classification: **(a) producer encoding vs type-name reader**, not (b) drifted claims, not (c) gone subject.
-
-| Row | Cause | Disposition | PR |
-| --- | --- | --- | --- |
-| `witness_fieldref_self_projection` | `member_edge_type_name` required an XL-2 binder; `concept_decl_facts` / `_live` marshal `name → Atom` | Read Atom identity when the binder reader is Absent; claims keep `String` | this PR |
-| `witness_qualified_concept_self_projection` | same root (`qualified_name: String`) | same | this PR |
-| `witness_local_record_enumerated` | same root (`alpha: String`) | same | this PR |
-| `witness_parse_only_extract_reflects_canonical_field_types` | live and parse-only share `marshal_variant_arm_target` | same | this PR |
-| `witness_parse_only_extract_reflects_perturbed_field_type` | same root; `beta: Int` was never the failing conjunct | same | this PR |
-| `witness_coproduct_arms_live` | payload `{ alpha: String, beta: Bool }` is `conj_authored_payload_type_name` over the same function | same | this PR |
-| `witness_coproduct_arms_parse_only` | same as live | same | this PR |
-
-Not Instantiation/`FreeMonoid<Char>`: marshal always stamps an Atom from the authored type spelling (`marshal_type_expr_ref`). Discrimination (`String` vs `Bool` vs `Int` vs `ConceptStruct`, coproduct payload vs nullary) is unchanged. Marshal wrapping through `binder_edge` waits on stage0 HOLD (#13388). `member_edge_type_node` is not relaxed.
diff --git a/docs/plans/construct-tag-reference-design.md b/docs/plans/construct-tag-reference-design.md
deleted file mode 100644
index 46b436823a1..00000000000
--- a/docs/plans/construct-tag-reference-design.md
+++ /dev/null
@@ -1,156 +0,0 @@
-# Construct tag as a declaration reference (qualified variant construction and patterns)
-
-Status: PR1 of two (model and migration census). PR2 is the cut. Owner lane: lively-eagle-657, parent
-gentle-koi-724, reviewer neat-boar-16.
-
-## Symptom and the chain (DESIGN 6b)
-
-`src/v2/compiler/01_tokenize.dag` (`v2.compiler.tokenize`) is file-refused at native ingest with
-`body_lowering_reason_unsupported_form` at `v2.std.diagnostic.Rejected { diagnostics: .. }` in
-`lex_walk_artifact`, so none of its declarations enter the index and every importer refuses
-`tokenize` as unbound. That is the single root of the native seven. quiet-hawk-702 established this
-by execution on D1: the native resolve walk names only `tokenize` for all seven, while explicit
-imports of admitted files bind.
-
-The chain behind it:
-
-- **Unqualified `R { f: e }`** lowers through `v2.compiler.body_lowering_fold`
-  `body_lower_try_record_literal` to `v2.std.node_query` `construct_node(tag: Symbol, ..)`, which
-  builds `Conj { R: Atom(R), f: e }`. A fielded pattern lowers to the same shape.
-- **Dotted head `a.b.R { .. }`** never reaches that route. `body_lower_record_literal_tag_optional`
-  reads only one branded atom. The postfix read classifies the brace suffix as
-  `PostfixChainSuffixCarried` and declines it. Its own comments name the reason: a construct tag
-  is a `Symbol`, so a module-qualified tag has no representation.
-- **The earliest unjustified boundary is therefore the construct carrier**, not body lowering.
-
-The same boundary is already wrong on the unqualified path, one stage later. `v2.compiler.resolve`
-`resolve_pattern_node_walk` and `resolve_node_walk` resolve the tag atom through `resolve_atom`,
-then `resolved_reference_node`, into `declaration_reference_node(path)`. The edge label stays the
-leaf `Symbol`. After resolve, the readers that key on "the label equals the atom's identity" answer
-Absent for every user constructor: `construct_tag_optional`, `v2.std.node`
-`arrow_body_record_construct_conforms`, and `v2.std.compilers.target_model`
-`target_value_expr_record_construct_gate`. The construct shape holds only before resolve and in
-hand-built fixtures.
-
-## The model
-
-The tag edge stops being a nickname and becomes a reference.
-
-- **Construct** = `Conj { <construct_tag_marker>: <reference>, field edges.. }`.
-  - `construct_tag_marker` is a STRUCTURAL CORE MARKER in the typed `EdgeLabel` vocabulary of
-    #12473 (quiet-koi-814, ruling A; review condition from neat-boar-16). It names the edge's role
-    (constructor tag); the target is an ordinary authored reference. It is counted once in the
-    #12473 census. Landing order, agreed with quiet-koi-814: this lane's PR2 lands first, because #12473 is the
-    model document only and its cut has not started. PR2 therefore declares the marker beside
-    `declaration_reference_marker` in `v2.std.node`, in the same form. It also records the marker once, in
-    the Core-marker list of `docs/plans/edge-label-coproduct/README.md` (item 1 under "Who owns the
-    closed set") if #12473 has landed by then, or in #12701 otherwise. The #12473 cut converts it to
-    the Core arm `ConstructTag` together with the other markers. It is distinct from
-    `declaration_reference_marker`. If they were the same, a nullary `Rec {}`
-    would read as a declaration reference under `declaration_reference_body_marked`.
-  - The label is never the constructor's spelling. That removes the label-as-second-name (§3).
-- **Reference form: one form, a qualified_name spine.** Before resolve, `<reference>` is the
-  authored `qualified_name` spine built by `v2.std.qualified_name` `qualified_name_spine_of_atoms`
-  from the authored segment atoms, so each segment keeps its token occurrence. An unqualified `R` is
-  the one-segment case of that spine: `fold_list_node` over one atom is the two-edge head/tail Conj
-  that `qualified_name_spine_shape_present` accepts. Readers do not branch on atom-or-spine.
-  - The ambiguity of a bare spine (an integer literal is also a cons list) is discharged by the
-    marker label, not by the spine's shape.
-- **After resolve,** `<reference>` is `declaration_reference_node(path)` produced by
-  `resolved_reference_node`, the same carrier every other resolved reference uses. The path is the
-  VARIANT's own declaration path, never its owning coproduct (quiet-hawk-702's v1 trap). No new tag
-  type; the shared identity stays the declaration path (`std.decl_ref DeclarationRef` in v1).
-- **Lowering never resolves or trims.** The construct producer receives the whole authored path.
-  Nothing takes the last segment anywhere on the route.
-- **Resolution is one route.** A tag spine resolves in both walks through a single function that
-  reads the path with `qualified_name_from_node` and dispatches by length:
-  - two or more segments go to the existing `try_resolve_qualified_name_node`;
-  - one segment goes to the existing bare door, `resolve_atom` on its only atom.
-
-  Both end in `resolved_reference_node`. The one-segment case is needed because
-  `try_resolve_qualified_name_node` answers Absent for length 1.
-- **Nullary qualified values** (`v2.std.diagnostic.None`) are not constructs. They are dotted
-  references, which already lower to the spine and resolve through `try_resolve_qualified_name_node`.
-  PR2 adds a control proving they bind to the variant declaration. It changes that route only if
-  the control goes red.
-- **Patterns** use the same producer and the same reference form for the constructor head.
-  `resolve_pattern_binders` keeps reading only the field edges.
-
-## Reader and producer census, with each migration
-
-Established by greps over `src/` and `dag/` (`*.dag` and `*.rs`) for `construct_node`,
-`construct_tag`, `construct_field_edges`, `RecordConstructBody`, `record_construct`,
-`TargetRecordConstructShape`, and the label-equals-identity comparison. No Rust code reads the v2
-construct shape. `src/v1/stage0` `coproduct_reflection` emits the unrelated v1
-`record_construction_spelling` edge.
-
-| Module | Symbol | Role | Migration |
-|---|---|---|---|
-| v2.std.node_query | `construct_tag_edge`, `construct_node` | producer | Take the reference node (a spine) in place of `tag: Symbol`, and emit `Named{construct_tag_marker}` targeting it. |
-| v2.std.node_query | `construct_tag_optional` | reader | Key on first-edge label == marker, and answer the reference node (a pre-resolve spine or a post-resolve marked reference). It no longer answers a Symbol. |
-| v2.std.node_query | `construct_field_edges` | reader | Unchanged apart from the gate. |
-| v2.std.node | `arrow_body_record_construct_conforms` | well_formed gate | First edge is the marker, targeting a spine or a marked reference, and every other edge is Named. Fixes resolved bodies being rejected today. |
-| v2.std.node | `classify_arrow_body_form`, `declaration_reference_body_marked` | classifier | Classify a construct by the marker explicitly, not as "any unmarked Conj". |
-| v2.compiler.body_lowering_fold | `body_lower_try_record_literal`, `body_lower_record_literal_tag_optional` | producer | Read the head as a qualified-name spine (bare or dotted) and pass it to `construct_node`. The brace suffix leaves `PostfixChainSuffixCarried`; the declined arm and its advisory for this suffix are deleted. |
-| v2.compiler.body_lowering_fold | constructor-pattern lowering (the `construct_node` call in the pattern arm) | producer | Same: the spine from the pattern head. |
-| v2.compiler.body_lowering_fold | `body_lower_is_core_substrate` | reader | Through the migrated `construct_tag_optional`. Check the order against the `qualified_name_spine_shape_present` test. |
-| v2.compiler.resolve | `resolve_pattern_node_walk`, `resolve_node_walk` Conj arm | rewriter | Resolve the marker edge's spine through the one length-dispatching function above. Field edges walk as today. Check the `resolve_ctx_snoc_position` side effect now that the label is the marker. |
-| v2.compiler.resolve | `resolve_pattern_binders` | reader | Unchanged apart from the gate. |
-| v2.compiler.infer | Conj gather arms (`infer_gather_*`, `infer_product_facts_from_entries`) | reader | The marker edge must not be read as a product field. Skip it by its TYPED edge role, never by the label's spelling, and type the construct by the referenced declaration where a row exists. Today the tag is `infer_gather_fold_not_derived`. |
-| v2.compiler.eval | `eval_callee_body_refusal_reason` | reader | Refusal only; no change. |
-| v2.std.compilers.target_model | `target_value_expr_record_construct_gate`, `target_project_record_construct` | reader | Gate on the marker. `type_name` comes from the resolved declaration's path, spelled through the target's binding rows, not from an atom identity. This admits resolved constructs the gate refuses today; that is a behaviour change, and it is named. |
-| v2.std.compilers.target_model | `target_value_expr_arrow_has_record_construct_body`, the arm body projection and match-arm slot readers | reader | Follow the gate. |
-| v2.std.compilers.target_model | `TargetRecordConstructShape` decode; the `record_construct_form` rows in extdeps.languages rust, typescript, c and dag | token rows | No change. |
-| v2.extdeps.languages.dag | `dag_rec_construct_body_node`, `dag_variant_holds_construct_node` and their users | fixture | Rebuild through `construct_node` with a spine. |
-| v2.lens.machine_shape | `constructed_tag` | reader | Compare the resolved declaration path of `MachineShape`, not a leaf Symbol. |
-| tests: `variant_field_lowering_test`, `wildcard_pattern_form_test`, `arrow_body_form_witness_test` and `arrow_body_form_semantic_helpers`, `record_construct_emit_test`, `rust_record_construct_emit_test`, `rust_record_construct_emit_host_equals_eval_test`, `reference_conservation_test` (occurrence counts), `value_position_whole_read_test`, `declaration_graft_assemble_test` | | test | Rebuild each fixture with the marker, and recount occurrences (segments keep their token occurrences). The unmarked reference-shaped negative must still go red. |
-| recurring_failure_mode and rung_drop prose (`postfix_suffix_step_declined_to_the_pre_existing_arms`, `call_expression_erased_at_v2_body_lowering`), `docs/plans/lowering-occurrence-projection-design.md` | | prose | Update the prose. Retire the brace-suffix population of the rung drop by its trigger. |
-
-Not readers of this shape: `v2.std.data_initializer_identity`, `v2.std.decl_facts_skeleton` and the
-v1 `record_construction_census` fixtures all read the v1 reflection edge. The orchestration
-`construct_tag:` fields are an unrelated name clash.
-
-## One decision for a dotted path (ruled by gentle-koi-724, 2026-09-29)
-
-Whether a dotted path is a qualified name or a field projection on a local is decided in ONE place:
-`v2.compiler.resolve` `try_resolve_qualified_name_node`, by `qualified_head_bound_on_chain`, which is
-the scope of the first segment. eager-newt-412's lane owns the projection arm there. This lane only
-consumes that door. A construct tag whose resolved answer is not a constructor declaration (or a
-kernel canonical atom) refuses `resolve_reason_construct_tag_not_a_constructor`. The door's projection arm is gunbc#12506's
-`resolve_bound_head_projection`. The LOCAL wins: a bound first segment shadows a whole-path
-declaration, so the bound-head check precedes any declaration lookup, and that change is made inside
-#12506. Whichever of #12506 and this lane's PR2 lands second adds the control. It is one module with
-`artifact.tree` (a match binder), `v2.std.diagnostic.Rejected { .. }` (qualified), and a local
-shadowing a module segment.
-
-## The live defect on main
-
-Filed as `gunbc.recurring_failure_mode`
-`construct_tag_read_by_label_equality_after_resolve_rewrote_the_target`. Confirmed by execution: a
-resolved `PcrA { n: true }` is `Conj { PcrA -> <declaration reference> v2.test.pc_provider.PcrA, n -> true }`,
-and `construct_tag_optional` answers Absent. The well_formed and target_model gate arms are inferred
-from their definitions, and the row labels them that way.
-
-## PR2 (the cut) and its evidence
-
-All readers migrate in one motion, and no `Symbol`-tag path remains. Controls, fed by production:
-
-1. `a.b.R { f: e }`, `a.b.C` (nullary) and `a.b.R { f: x } =>` each lower and resolve to the same
-   node as their unqualified form under an import of the same declaration. This is a content
-   equality check.
-2. Two variants with the same leaf in different modules, constructed qualified, bind to different
-   declaration paths.
-3. Mutations go red: dropping the qualifier binds the other module's variant or refuses as
-   ambiguous, and dropping the record body changes the node.
-4. The variant is bound, not its coproduct.
-5. A qualified tag whose last segment names a TYPE rather than a variant, or a variant of a
-   different type, refuses at a located site and never resolves by spelling (neat-boar-16).
-6. The target_model gate is shown by a discriminating pair: a resolved construct is admitted, and
-   an unresolved or wrong-variant construct still refuses at that gate.
-7. The seven's actual form, `v2.std.diagnostic.Rejected { diagnostics: .. }`, is the positive
-   control on the production route.
-8. The live defect below has a control that is RED on main (a resolved user construct read by
-   `construct_tag_optional`), turns green in PR2, and stays enrolled as the regression control.
-9. `01_tokenize.dag` is admitted on the native route. A base-vs-head census (the #12550 recipe)
-   shows the newly admitted files and no unexplained new refusal. quiet-hawk-702 runs the native
-   seven against the head.
diff --git a/docs/plans/convergence-one-program.md b/docs/plans/convergence-one-program.md
deleted file mode 100644
index 10b9f73bada..00000000000
--- a/docs/plans/convergence-one-program.md
+++ /dev/null
@@ -1,300 +0,0 @@
-# CONVERGENCE-ONE — program record at wind-down
-
-One convergence protocol and one fleet authority for persistent host effects. A subject is
-**selected**, **observed goal-blind**, **assessed** against the goal, **planned**, **admitted
-against the observed basis**, **applied**, **independently read back**, and given a **terminal
-verdict**. Anything that calls itself convergence without running that lifecycle is a second
-convergence algebra — a §3 authority fork — and the program's job was to end it.
-
-This page is the record at the point the program was wound down (2026-09-20) under system
-pressure, so that v1 performance and v2 migration take priority. It exists because the state
-was held in a session's pinned plan and in seven lanes, none of which survive. Its roadmap home
-is `fleet-closed-loop-converge`; the two remaining cuts that have no home of their own are
-`fleet-convergence-census-closure` and `fleet-convergence-legacy-deletion`.
-
-## What landed
-
-- **C0** — the census of persistent host effects; dual-home made unwritable.
-- **C1** — the canonical protocol bound; `ensure` is a projection of it.
-- **C2** — one selected LiveDeploy roster. `deployment_spec_srv1` has exactly one home.
-- **C3** — LiveDeploy scope, member basis, plan-side frontier discharge; and, in its remainder,
-  the request arm binding `DesiredDeployment.selected_identity`.
-- **C4** — the apply frontier row, honestly **awaiting** rather than falsely discharged
-  (see *An undischarged frontier* below), plus a production gate on the protocol being bound.
-- **C5** — readiness defork and the canonical readiness algebra.
-- **C6** — owned roots folded into the member model.
-
-## Ready but unmerged when the program stopped
-
-Six pull requests were CLEAN with every check green, waiting on an operator merge:
-
-| PR | Cut | What it carries |
-|----|-----|-----------------|
-| #11678 | C9a.1 | GCP Secret IAM: read the policy back **independently** after the write |
-| #11676 | C7 | provider-state root as a `live_deploy` ensured member, read back — **now DIRTY** |
-| #11689 | C11 | GitHub reads rebound onto the canonical join — **parked, see below** |
-| #11732 | C9b | App-key rotation: exact-version verifier, contract, `DisableOnly` — **MERGED** |
-| #11795 | — | `RungDropAmendment` carrier, so a later ruling on a standing drop has a home |
-| #11828 | — | `mtcollins1_boot` narrowed to `FleetSshKeyNotConsumed` |
-
-**#11689 is parked for the same reason, one rung further on.** It is complete and correct at
-`2e63f9d53`: the rebind is done, and a scratch regeneration driver that an earlier `git add -A` had
-swept in — no consumer, re-minting a generated workflow path as a literal — was found by review and
-deleted, so the PR no longer carries a defect that would land. It then went DIRTY again within the
-hour on the contended pair. It is left open, not closed.
-
-**#11732 is parked green, and parking it leaves a real gap open.** At `e0c453f961` it had one
-approval, no change requests, and all four checks green by name; its eighth review cleared the
-thing most likely to be wrong in such a cut — that the frontier row names the add-version and
-disable-prior *capability* rather than letting the verifier's own existence retire it. It was
-stopped by queue position on the contended pair, twice. The consequence, stated so it can be
-weighed rather than forgotten: **`ci-github-app-private-key` still has no rotation deadline, no
-restore test and no rehearsed compromise answer on main, and nothing in the corpus can answer
-"does the key in version N actually work."** That key is the root of trust for every org-admin
-action CI takes.
-
-**#11676 (C7) MERGED.** The provider-state root is an ensured member derived from the spec, so the emitted ensure and the read-back member come from one function and cannot diverge; absent, duplicated, wrong-owner and not-a-directory have no constructor, so the first cut's refusal arms were deleted rather than left permanently green.
-
-**The launcher deletion is the next cut, and its census is already on main** as an annotation on `deployment_provider_state_step`. For `srv1_live` the provision plan's `DashboardEnsureProviderStateRoot` is now REDUNDANT — that is the op the deletion may remove. For `srv1_lab`, `srv2_lab`, `srv2_deploy` and `macbook_local` it remains the ONLY creator: their specs carry the member, but no production caller applies those specs, so the member creates nothing for them yet. The op may be deleted for an instance only when a production caller applies its spec; deleting it sooner is the serve-binary deadlock again.
-
-**#11828 must not merge on checks alone.** Its acceptance is a wet dispatch of
-`fleet-converge mode=mtcollins1_boot`: if that mode does need the fleet key, it fails at the
-point of use, and discovering that on main is strictly worse than discovering it before.
-
-**C9b's verifier has never run against the live surface.** All fifteen witnesses supply an
-observation record; none executes the real mint, which needs the fleet-converge runner, the
-federated principal and the live App. Three shapes are therefore *readings* of upstream rather than
-observations: that the Secret Manager response carries the resolved version in its name field, that
-`curl -D` writes a status line whose second word is the code, and that the mint step's refusal arms
-leave their record lines before exiting. **The first dispatch of `app_key_version_verify` is the
-inhabitance claim for that whole cut**, and it is cheap — read-only, one installation-token mint, no
-mutation. If it refuses with an absent mint observation on a version that plainly exists, suspect
-the record wire before the mint. Its actuation half (add-version, disable-prior) is blocked on
-`gunbc.github_actions_wif` being absent from main: on a runner there is no federated identity for a
-Secret Manager write, so the only honest route today is an operator workstation.
-
-## Two operator acts C9b left open, one of them dated
-
-**`rotate_by` on main is `2026-12-18`, and it is a placeholder a lane chose rather than policy.**
-The verifier reads it on every run and refuses once it passes. So if nobody sets it, the first
-thing that happens on that date is that a green verify run turns red with a deadline-passed
-refusal. That is the honest behaviour, and it is also a trap for whoever meets it first: **the fix
-is a policy decision and a rotation, not a code change.**
-
-**Nothing in that cut has run against the live surface.** Every witness supplies its own
-observation record. The first dispatch of `app_key_version_verify` against the currently enabled
-version *is* the inhabitance claim for the whole thing, and it is cheap and safe — read-only, one
-installation-token mint. Three shapes are readings of upstream rather than observations, so that is
-where a first-dispatch failure will be: that the Secret Manager response carries the resolved
-version in its name field, that `curl -D` writes a status line whose second word is the code, and
-that the mint's refusal arms leave their record line before exiting. A refusal reporting an absent
-mint observation on a version that plainly exists means the record wire, not the mint.
-
-**The actuation half is blocked on identity, not on design.** Add-version and disable-prior with
-independent readback need a federated identity for a Secret Manager *write*, and
-`gunbc.github_actions_wif` is still absent from main — so a runner has none, and the only honest
-route today is an operator workstation. Reaching for a print-token on a runner fails at runtime
-rather than degrading, which is why the lane did not.
-
-## Still held, and on what
-
-- **C8 — wet apply.** Held until three proofs close: temporal order (control 6), Baseline vs
-  PostApply (control 7), and apply-script path disjointness. C8 must **execute** a nonempty
-  `ReleaseEffectPlan`; until it does, that terminal answers `AwaitingCapability`. C8 also owes
-  the discharge of C4's frontier: naming its projection-routed apply carrier moves that row off
-  a prose condition. Note the cost trap recorded by C4's lane — a bound discharge needs an
-  observed population, and computing it costs ~60s over the live tree, so it must not go on the
-  plan route blindly.
-- **C9 — census closure by effect family.** The denominator is every non-terminal row in the C0
-  census, not a keyword search. One effect family per change, each answering the same seven
-  questions: who selected the desired state, what independently observed reality, what assessed
-  the difference, what exact plan was admitted, what authority executed it, what independently
-  read it back, and what old path was deleted or renamed. C9a (GCP IAM) was pulled forward
-  because it touches production; C9a.2 (the bare-grant authorization closure) is unstarted.
-- **C10 — deletion and the recurrence wall.** Deliberately last, and performs no new semantic
-  migration: it deletes superseded routes and makes recurrence mechanically visible. Its gate
-  must join against an independently discovered producer population, never a search for
-  suspicious names.
-
-## Unowned residue
-
-- **C5's poll Ready-exit** is recorded unproven. It closes when a fixture can supply `Ready`
-  into the poll outcome without materializing the live site.
-- **The org-admin credential admission surface** was censused and the answer is DELETE, but the
-  deletion was never written: that lane produced analysis only and has **no PR**. Its findings
-  exist nowhere else, so they are here.
-  - Obligations 1–8 are met or dissolved by the live App-token path, and two carry the argument.
-    **Genealogy is enforced by construction**: the mint is serial and each link exits on failure,
-    so a token cannot exist with an incomplete genealogy — deleting a rung-2 validation that a
-    rung-4 construction replaced. **Capability sufficiency is enforced better**: an unconditional
-    probe that refuses on the real response proves more than a declared capability list, which is
-    exactly why the dead model carried `CredentialOperationProbeRequired`.
-  - **The sharpest fact in the census**: `ci_spec`'s own annotation says the interim PAT step *"was
-    never taken, and it was never necessary."* So the whole `SecretMaterial` surface — custody,
-    genealogy, rotation contract, continuity due-dates — modelled the lifecycle of a credential
-    **that was never minted at all**. Not superseded; never inhabited. That turns the deletion from
-    a cleanup into evidence about how the model got there.
-  - **The delete set is grep-verified, not refusal-verified.** Under §3 the deletion *is* the
-    census, so treat the set as a hypothesis and let the compiler refuse. Six declarations are
-    already dangling on main today with no consumer at all, including the witness.
-  - **Keep** `org_admin_app_key_unreadable_message`, `org_admin_installation_token_refused_message`
-    and the two arms they name: `ci_spec`'s prelude renders them and a witness checks it. They are
-    a declared frontier with a stated trigger, not dead code, and a dead-code sweep would wrongly
-    take them. Do not touch `extdeps.github.org_admin_auth` — faithful upstream modeling with four
-    live importers.
-  - **Open, for the operator**: `docs/plans/org-admin-credential-acquisition.md` is the prose home
-    of this model. Deleting it orphans two live annotations that cite it; keeping it leaves a plan
-    document for a credential that was never minted.
-- **#11760 would re-fork the authority #11795 just consolidated.** It still carries the postscript
-  text inline on the drop's `restoration_trigger`. If it lands after #11795, that string must be
-  deleted and replaced with a row under `dag/gunbc/rung_drop_amendment/`. Its author agreed. This
-  is the only known change that would undo that consolidation.
-- **The amendment witness is enrolled on no lane at all.** Its four claims were executed on the
-  committed tree, but not through a claim harness: `claim_executor` has no per-module selection,
-  and a whole-floor run is a CI job rather than a session one. They were run via `gunbc run
-  --function`, which refuses to map a `Bool` to an exit code and *prints the value in the refusal*
-  — a real execution of the real function, but not a harness run. Since required CI runs no claims,
-  nothing today would notice if that file went red. If claims return to the merge path, it belongs
-  in the first batch.
-- **A read-write-re-read fold is unfalsifiable under the current replay harness**, and this is a
-  frame-level gap rather than a defect in any subject. REST replay keys a fixture by exact
-  invocation, and the first read and the re-read of such a fold are the *same* invocation — same
-  operation, target and input digest — so no fixture set can answer 200 to one and 403 to the
-  other. Sequencing is not expressible at all. Worse, an invocation's `input_digest` is minted
-  host-side over the bound parameter environment and has no `.dag` constructor, so an authored
-  fixture cannot reproduce it for any operation that takes inputs; the existing probe matches only
-  because its operations take none. This is why C9a.1's unreadable-re-read stop is declared
-  unexecuted for its route. It belongs to `v2.std.witness_evaluation`, and closing it is what
-  would let that stop be executed rather than argued.
-- **The projected `restoration_trigger`** on the namespace-wave-admission drop does not state
-  that restoration half (1) was built and then deleted; #11795's amendment supplies that context
-  in the projection, so check the rendered page before re-opening it.
-
-## Findings worth keeping
-
-These cost real time to establish and are not derivable from the diffs.
-
-**An undischarged frontier was unwritable.** `converge_apply_for_host` calls `host_effect_apply`
-directly and never the projection, so no honest consumer exists before C8 — but `FrontierStanding`
-carried only *honest* and three defect arms. The corpus forced a choice between a citation that
-lies and a protocol that can never bind, whose gate would then refuse every healthy run. C4
-resolved it by inhabiting `std.dissolution`: an awaiting arm that can never be read as discharged,
-refusing when the capability has arrived and the row was never updated. The closing sentence is
-**derived** from the row's standing; authoring it would have been a second authority for
-retirement.
-
-**A successful actuation return cannot mint convergence.** The GCP IAM writer classified the
-policy returned *by its own write* and greened. The repair reads the policy back independently.
-The load-bearing control is the one that fails when the write response carries the grant and the
-re-read does not.
-
-**Observation must be goal-blind.** `decode_registration_json` took the expected App identity
-*into the decoder*, so a valid response describing another App was filed as *unobserved* rather
-than observed-then-diverged — a known mismatch laundered through the refusal arm.
-
-**Check that a check can fail.** Two witnesses were deleted rather than kept: one asserted that a
-prose sentence contained certain words while its name claimed a structural impossibility, and one
-tested a state that, once the member was derived from the spec, had no constructor at all. A
-permanently green check is worse than none, because it gets cited as coverage.
-
-**A stale-plan fingerprint must carry identity.** The LiveDeploy baseline hashed member *labels*,
-so a changed executable digest, tree revision, dirty tree, unit document, running release or root
-owner all left it unchanged. Caught by an external review after two approvals, including mine.
-
-## A first-apply risk C8 must clear before it touches srv1
-
-C7 models the provider-state root as an ensured directory, and the emitted command is
-`install -d -m 0755 -o <service user> -g <service user> <codex home>`. **`install -d` chmods and
-chowns a directory that already exists.** The mode is a constant of the ensured-directory arm,
-not a fact read from the host, and nothing in the model refuses a widening.
-
-So if srv1's provider-state root is currently `0700` — which is what a provider CLI creating its
-own state directory under a umask would plausibly leave — **the first real apply silently widens a
-credential directory to world-readable**, and the same command re-owns it if the live owner
-differs. This was never verified against a host, because no wet effects were permitted; it is an
-inference from reading both code paths, and its author flagged it rather than letting it pass as
-settled.
-
-**Before C8's first apply: stat the live directory** and compare its mode and owner against what
-the ensured step emits. If the observed mode is tighter, the ensured-directory arm needs a mode
-carried per subject — the `ManagedDirectory` derivation — **before** anything applies, not after.
-
-**A typed outcome on the policy read is a fail-open, and the next reader will re-derive it.** The
-obvious way to make C9a.1's inaccessible arm a typed value is to declare `RestOutcome` on
-`GetSecretIamPolicy`. Do not. The other caller reads the policy in the node-pattern form, which
-cannot branch, so a failed read there returns an empty policy with a blank etag that flows
-straight into `SetSecretIamPolicy` — an unconditional whole-policy overwrite of a live IAM policy,
-driven by a read that never happened. That is strictly worse than the defect C9a.1 repairs. The
-ordering is therefore fixed: make that caller an `EffectPlan` step that can refuse **first**, and
-only then declare the outcome.
-
-## Process facts a later program will need
-
-- **The required CI check builds the compiler and runs no witnesses** (#11742), and the
-  namespace-wave-admission gate was removed (#11774). A green check means *it compiles*. Lanes
-  must run what they claim and say what they ran. Three composition breaks reached main in one
-  day — each PR green against its own base, red only in composition — and the repair commits say
-  so in their titles.
-- **A PR failing the generated-artifact gate self-heals.** Since #11791, `heal.yml` is
-  dispatch-only and the repair moved into the required run's fleet lane: the branch picks up a
-  `gunbai-bot` commit within ~10 minutes. Authors must **wait for the publisher**, never
-  hand-produce the bytes and never push over a sealed candidate — doing so invalidates it and
-  restarts the cycle.
-- **Heal regenerates `.github/workflows` but cannot publish it, and nothing detects that.** It does
-  push — a heal commit landed `.gitattributes` and `docs/design-rung-drops.md` on one branch — so
-  the constraint is *workflow paths specifically*, consistent with an App token that cannot write
-  them. On one head heal reported success, logged writing the 89,904-byte workflow in its own
-  workspace, and emitted a candidate manifest holding only the two non-workflow paths. Since #11742
-  removed the regeneration gate from PR CI, a stale workflow projection is now **invisible**: that
-  drift survived three pushes and four green heal runs and was caught only by reviewers. Any PR
-  changing a `ci_spec` entry target inherits this, and must carry its own derived bytes.
-- **`fleet_converge_workflow.dag` and its generated `.yml` are the contended pair**: every lane that
-  adds a dispatch mode touches the same two rows, so PRs there go DIRTY on queue position rather
-  than on any defect. A conflict region there can split a step, and a keep-both resolution is not
-  safe by reading — the class and its fourth specimen are rostered at
-  `gunbc.recurring_failure_mode.merge_region_excludes_shared_tail`.
-- **The verification that discriminates, for anyone hand-committing a projection:** push, then read
-  heal's repair-candidate *manifest* on that head. An empty entry set against two entries on the
-  prior head is a real signal. A byte count matching heal's own is corroboration only — a different
-  delta could preserve length.
-- **No session can execute a `gunbc run` remotely.** BuildBuddy executors expose no cgroup memory
-  limit, so `gunbc.host_budget_source` refuses with `HostBudgetUnreadable` before planning; a lane
-  that bound a limit by hand got SIGKILLed instead. Briefs that offer "CI or one remote dispatch"
-  as the escape from local memory pressure are offering something that does not exist today.
-- **The local regeneration hazard is LOAD, not a ceiling.** The same command made no progress in
-  40 minutes at host load ~270 and finished in about 20 at load ~66, writing correct bytes. Each
-  `gunbc run` loads the whole corpus, so runs must be serial — running claims alongside a regen
-  makes both thrash. Do not conclude the local arm is dead; check the load first.
-- **A workflow run's branch column is not the ref it built.** `heal.yml` checks out an input SHA,
-  so the branch column names where the dispatch fired. Reading it as the built ref produced a
-  false "main is red" alarm and a dispatched repair lane against innocent substrate files.
-- **`git merge origin/main` in a session worktree is dangerous and looks fine.** The worktree is a
-  shallow clone, so the merge base is wrong. On one lane it reported two trivially additive
-  conflicts and produced a commit that reverted 99 files and 6,886 lines of other lanes' work —
-  including `witnesses.yml` back to a pre-#11742 revision, so CI then ran an old job roster and
-  went **green on a revision that had reverted main**. The safe recipe: `reset --hard origin/main`,
-  check out your own files, then assert that every deleted line in `git diff origin/main` is one
-  you wrote.
-- **A session worktree is a shallow clone, and git lies about it confidently.** Two lanes hit this
-  with different symptoms: one was told it was 231 commits *ahead* of main and not an ancestor
-  (truth after `git fetch --deepen=200`: 0 ahead, 26 behind, ancestor yes), the other had a merge
-  refuse with *unrelated histories* while GitHub's compare API reported eleven ahead and four
-  behind. It also re-shallows, so the false readings come back. Run
-  `git rev-parse --is-shallow-repository` before believing any ancestor or count answer — a missing
-  merge base here is a fetch-depth artifact, never a force-pushed main.
-- **Do not revert main's generated-artifact drift out of your own PR.** The auto-heal bot pushes
-  exactly that regeneration back onto your branch, and its commit **resets the approval tally**. The
-  only real choice is whose commit carries the bytes, and the bot's is better because it is
-  attributable.
-- **`extdeps.time.rfc3339` models no arithmetic and no parse**, only a conditional lexical
-  comparator. So a period-shaped deadline (`create_time + N days`) is not expressible, which is why
-  C9b's rotation contract carries an absolute `rotate_by` that a completed rotation must move
-  forward by hand. A period first owes rfc3339 parse and arithmetic.
-- **A one-arm coproduct is not a coproduct.** `type X = OnlyArm` — a name, equals, a single bare
-  arm, no pipe — parses as a type *alias* to an unknown name and fails with *name not found in
-  module*, attributed to the importing module rather than to the declaration. It cost a lane a
-  cycle. C9b's restore cadence became a record naming the consumer that discharges it, which is
-  better anyway: the intent builds its roster from that record, so the field is read rather than
-  declared beside the thing it describes.
-- **Merge order is not a preference.** Out-of-order merges broke sibling cuts four times, and none
-  of it was a defect in the changes.
diff --git a/docs/plans/corpus-acquisition-design.md b/docs/plans/corpus-acquisition-design.md
deleted file mode 100644
index 6fc197a066f..00000000000
--- a/docs/plans/corpus-acquisition-design.md
+++ /dev/null
@@ -1,533 +0,0 @@
-# Corpus acquisition: the listing root cut, the descent measure, and the symlink rule
-
-The corpus manifest landed in gunbc#10445 as a carrier with no producer: `store_corpus_manifest`
-builds one from entries a caller already holds, and nothing builds one from a working tree. This
-document is the design for that producer, settled **before** any of it is written.
-
-It exists because the survey turned up two modeling questions the SCM brief does not answer, and
-answering them unilaterally is how the previous PR acquired five rounds of findings. Both were put
-to external review and ruled on; this records the ruling and the facts that forced it.
-
-## 0. The two questions, and what the survey actually found
-
-**Q1 — where does enumeration live?** `extdeps.filesystem.filesystem_io` returns a directory listing
-whose `entries` member is a raw newline-joined `String`, with membership answered by a substring test
-over that blob. It carries no file-versus-directory discriminator, so a corpus walk cannot ask the
-one question it must ask at every entry: descend, or read.
-
-Three facts qualify that, and the first two cut against widening:
-
-- **No existing consumer enumerates.** Every one of the eight modules that consume the listing feeds
-  it straight into `filesystem_entry_presence`, which answers *membership* — is this one name in this
-  directory. Not one iterates the entries; not one needs `EntryKind`. ~~The blob is adequate for every
-  consumer that exists.~~ **SUPERSEDED — see §10.** The blob is not adequate for its existing
-  consumers: its producer silently narrows the population it returns, so the membership answers built
-  on it are unsound on two paths. That existing consumers ask only membership does not save a
-  population the producer already narrowed.
-- ~~**So enumeration is a new capability, not a failing carrier.**~~ **SUPERSEDED — see §10.** It is
-  both. Enumeration and `EntryKind` are new capability; the listing is *also* a failing carrier, and
-  the failure is live on main. The repair therefore comes first and does not wait on the capability
-  that discovered it.
-- **But the blob is a workaround whose justification has lapsed.** `filesystem_io` justifies the
-  substring test by saying newline-wrapping makes the test line-exact "without needing a split the
-  interpreter does not offer". That is false today: `split` is a builtin string method — declared in
-  the seed at `std_algebra` and dispatched by the v1 interpreter as `MethodCallSplit`, requiring no
-  import — and `extdeps.languages.markdown` `md_split_blocks` calls `split(s:, delimiter:)` on a plain
-  `String` now, with further splits in `extdeps.git.object_store` and `extdeps.systemd`.
-
-The deciding argument is `filesystem_io`'s own. The comment above `filesystem_listing_names_entry`
-pulls the membership predicate down beside the operation because two consumers had spelled it
-independently over one wire format, "which is the second representation section 3 forbids: the
-encoding is `List`'s fact, so the membership question over it is too." That argument does not weaken
-when the question is enumeration instead of membership. Either the structure belongs at the
-authority, or that comment is wrong about membership.
-
-**Q2 — what does the walk descend on?** DESIGN §4 makes execution bounded and forward, with
-termination *checked* rather than discovered. A directory tree offers no static bound and, with
-symlinks, not even a guaranteed finite one.
-
-## 1. RULING — root-widen the listing at its authority
-
-Replace the lossy listing representation where it is produced and migrate its consumers together.
-Names-only consumers project names from the richer result; they acquire no interest in ingestion,
-MIME types, or semantic source validity. The unrelated read consumers do not migrate merely because
-their operations share a module.
-
-The migration population, corrected after the first census undercounted it:
-
-| module | how it reaches the listing |
-|---|---|
-| `gunbc.generated_artifact_observation` | directly |
-| `gunbc.deploy_transition` | directly |
-| `gunbc.scm.init` | directly |
-| `gunbc.roadmap.roadmap_verification_receipt` | directly |
-| `gunbc.roadmap.roadmap_publication_helper` | directly |
-| `gunbc.fleet.fleet_converge_plan_cli` | directly |
-| `gunbc.devboot.build` | directly |
-| `gunbc.roadmap.roadmap_belt_actuate` | directly |
-| `gunbc.fabric.fabric_allocation_store_substrate` | only `FilesystemEstablishedAbsence` |
-| `gunbc.scm.repository_save` | only `FilesystemEstablishedAbsence` |
-
-The first census reported eight. It keyed on the listing's *type and constructor spellings*, so it
-found every module that names the listing and missed the two that reach it through the derived
-absence carrier. Those two move only if the widening changes the shape of `FilesystemEstablishedAbsence`
-rather than the blob behind it, so they may be zero-diff — but they are in the subject population, and
-a filter whose vocabulary is narrower than its subject reporting its own reach as the population is
-the partial-observer class this lane keeps finding. It is recorded here rather than quietly fixed.
-
-The cut is not eight call expressions: the listing folds, the witnesses, the transport realization
-and the emitted representation belong to it too.
-
-### Two properties must survive the replacement
-
-**Enumeration failure stays distinct from successful exhaustion.** Opening a directory successfully
-does not establish that enumerating it succeeded — a host iterator can fail while advancing. A result
-accumulated before such an error must not become a complete listing, and so must not establish
-absence for an entry it never reached. This is the absorbing-fallback rule (§5) at the listing
-boundary: the failure arm refuses, it does not widen into "not there".
-
-**Entry names and kind observations stay unconflated.** An entry's name can be known while observing
-its kind fails. That entry is neither dropped nor called `Other`; the two facts are separately
-carried, because the host interface itself separates a name from a fallible type observation.
-
-And no newline-delimited membership may survive underneath the structured result as an independent
-authority. `filesystem_listing_names_entry` is deleted by this cut, not kept beside it.
-
-### A consequence the cut inherits: two of `FilesystemEntryName`'s refusals lose their reason
-
-`admit_filesystem_entry_name` refuses a name containing `\n` and separately one containing `\r`, and
-both refusals are justified **by the wire format** — the newline is `Filesystem.List`'s delimiter, so
-such a name could make the membership test answer about a different spelling. Under a structured
-listing that delimiter does not exist, and those two justifications lapse with it.
-
-That does not automatically mean the refusals go. It means each must be re-decided on its own
-grounds: either the structured representation preserves such a name losslessly and the refusal is
-deleted, or the refusal stays as an explicit *unsupported spelling* with a new stated reason. What it
-may not do is survive carrying a justification the cut has falsified — which would be this same class
-a second time, created by the repair rather than found by it.
-
-The `/`, `\` and NUL refusals are untouched: path traversal and C-string truncation are facts about
-the host, not about the listing's encoding.
-
-## 2. RULING — layering: acquisition, captured inputs, pure construction
-
-```
-bounded filesystem acquisition
-          ↓
-explicitly scoped captured inputs
-          ↓
-pure corpus construction / semantic ingestion
-```
-
-Build **both** layers. The already-enumerated interface is not eliminated by the root cut — it is
-placed correctly. An explicit input list is the right subject for the pure operation, and it is *not*
-evidence that anybody enumerated a directory successfully: a caller may intentionally select ten
-files, which is a complete selection of those ten and not a complete capture of their parent.
-
-The failure mode to refuse explicitly: using the lower layer to claim the upper producer has been
-delivered.
-
-## 3. RULING — finite work fuel is the descent measure
-
-Admit a finite, nonnegative budget supplied by the acquisition policy. The walk carries `R(s)`,
-remaining work fuel. Every continuing discovery transition establishes `R(s) > 0` and
-`R(s') = R(s) - 1`.
-
-That is a well-founded arithmetic descent even though discovering one directory adds several pending
-children: **the worklist may grow; the rank does not.**
-
-```
-all acquisition obligations discharged      → completed capture
-obligations remain, no work fuel remains    → located budget-exhaustion refusal
-obligations remain, fuel positive           → one bounded transition, continue with less fuel
-```
-
-Prohibited: resetting the budget per sibling, replenishing it when a new directory appears, or
-charging only newly discovered inodes while another continuation path runs unbounded. Each loop needs
-its own demonstrable descent or must share the globally decreasing measure.
-
-The refusal says *the admitted budget was exhausted before completion was established*. It does not
-claim the corpus contains more than some number of files — that number was never observed. Reaching
-the numeric limit after every obligation is discharged is not a reason to refuse.
-
-**The budget is operational, not part of corpus selection.** Raising it must not change the identity
-of a successfully captured unchanged corpus, and exhausting it must not mean "this now denotes the
-prefix we happened to read" — that is the absorbing fallback wearing a limit's clothes.
-
-### Why the three candidates I proposed are not this
-
-| candidate | honest role | what it does not establish |
-|---|---|---|
-| remaining depth | can prove recursive descent when each child enumeration is a finite admitted input | any bound on total discovery work, directory width, or I/O |
-| visited-object set | detects repeated expansion; supports traversal of a *fixed finite* graph | that the live universe of discoverable objects is fixed and finite |
-| no symlink following | removes symlink-induced traversal into aliases and cycles | that remaining discovery terminates or fits a resource bound |
-
-A visited set becomes a termination proof through a measure like `|U \ V|` only when `U` is an
-established finite universe and each continuation removes an element from it. Maintaining `V` — what
-has been seen — does not establish `U`. Directory contents can change during enumeration, and POSIX
-leaves aspects of observing concurrent additions and removals unspecified.
-
-A depth budget is legitimate as an *additional* policy limit with its own located refusal, and an
-explicit worklist with work fuel also stops the host call stack from being the mechanism that
-enforces it.
-
-One qualification I had wrong: an unknown compile-time size is not the same as having no termination
-argument. A materialized finite tree traverses structurally without a compile-time size, and a finite
-list folds without a literal length. The problem here is specifically that a filesystem walk
-**discovers more input through effects while it runs** — a child pathname is not a compiler-visible
-subvalue of an already-held finite tree. `std.termination` already separates `TreeSize`,
-`ListLength`, `ArithmeticValue` and `SetCardinality`; these are different arguments, not
-interchangeable labels for "making progress".
-
-### The fuel must reach the actual discovery mechanism
-
-The boundary most likely to recreate the problem:
-
-```
-unbounded host enumeration → fully collected list → check the budget
-```
-
-A budget cannot bound work that already happened. The listing realization must either expose bounded
-progression or perform a bounded collection internally, with explicit completion-versus-limit
-outcomes. A new streaming framework is not required; a host-side bounded collector that **refuses
-rather than truncates** satisfies the contract.
-
-The same distinction applies to content: a bound on directory transitions does not bound a whole-file
-read. Content acquisition is bounded separately, and I/O deadlines or cancellation stay in the effect
-contract. An arithmetic rank bounds modeled continuations; it does not prove an arbitrary kernel or
-remote-filesystem call returns within a wall clock.
-
-And the decrement must be established by the compiler's actual enforcing path. `Strict` existing in
-`std.termination` is not proof that the compiler derives it for this walk.
-
-## 4. RULING — never follow a symlink implicitly
-
-Do not follow file or directory symlinks during authored-corpus acquisition. Following a link
-substitutes the referent's contents for the authored link, which changes the subject being captured.
-A link to an external file, a link to a directory, and a dangling link must not acquire different
-preservation semantics because one happens to resolve today.
-
-Three facts stay separate:
-
-```
-the directory entry is a symlink
-the symlink stores a particular target spelling
-resolving that spelling currently produces some outcome
-```
-
-`std.filesystem.types.SymlinkTarget` is `TargetFile | TargetDir | Broken`. That records the *third*
-fact only. It cannot serve as a persisted link payload, because it does not carry the stored target
-spelling needed to reconstruct the link. A link-preserving representation needs the link's actual
-stored target, read without substituting the referent's contents, and without accepting a truncated
-target.
-
-### What this producer does, given the manifest it actually has
-
-`CorpusManifestEntry` is a path and an `AuthoredSourceTarget`, with no link discriminator. It cannot
-express "this path denotes a symlink with this target". So for an in-scope symlink this producer
-returns a **located unsupported-symlink acquisition refusal**. It must not:
-
-- omit the link silently and report complete capture;
-- store its target text as though it were an ordinary file;
-- put `Broken` or a traversal error into the manifest as though it were authored content.
-
-The refusal belongs to the acquisition outcome. The manifest's existing ability to represent a
-*deliberate* partial corpus is not permission to label an *accidentally* incomplete acquisition
-complete — that distinction is the whole of §5 at this boundary.
-
-A regular-source-only producer with an explicit refusal is a valid narrower contract. It is not
-full-directory support, and an unrestricted directory-freezing operation over a scope containing
-links needs real link-preservation semantics — an explicit representation with its identity,
-persistence and reconstruction behaviour — before it can claim that input.
-
-### One existing helper is the wrong policy to reuse
-
-`std.filesystem.is_text_readable` treats a symlink resolving to a text file as readable, and
-`partition_entries` divides inputs into `readable` and `skipped`. That is a *readability* policy, not
-an exhaustive authored-corpus capture policy. Consuming its `readable` population would both admit
-link dereferences and discard other entries. Reuse the `EntryKind` vocabulary; do not inherit that
-partition as the capture decision.
-
-## 5. RULING — enforce no-follow at acquisition, not only at observation
-
-This sequence is insufficient:
-
-```
-observe "regular file"  →  another actor replaces the entry with a symlink  →  read the pathname
-```
-
-The observation and the read then concern different objects; a prior `EntryKind` value does not
-constrain subsequent pathname resolution.
-
-The acquisition realization must enforce no-follow and root-resolution when it **opens** the object,
-and inspect and read the object actually opened. On Linux `openat2` supplies resolution constraints
-(`RESOLVE_NO_SYMLINKS`, `RESOLVE_BENEATH`); plain `O_NOFOLLOW` constrains only the final component,
-not every component of a pathname. Those are realization facts modeled under their platform
-authority, not assumptions attached to a generic string read.
-
-This changes nothing for the other read consumers. It means the new corpus-acquisition path obtains
-the capability it needs instead of assuming the generic `Read` already provides it — and where a
-realization cannot supply it, the result is an explicit unsupported-capability refusal, never a
-fallback to following the path.
-
-## 6. RULING — completion must say what was completed
-
-**"The walk exhausted its selected observations" is not "these files all existed together at one
-instant."** A traversal over a mutable directory is not a snapshot; successful enumeration and
-content reads do not supply that temporal guarantee, and POSIX's concurrent-enumeration semantics
-rule out deriving it from ordinary listing.
-
-This producer may freeze the exact admitted contents it captured, under an explicit selection and
-observation contract. A point-in-time whole-tree claim additionally needs a snapshot or quiescence
-mechanism. Snapshot infrastructure is not silently made a prerequisite for a smaller capture — and a
-snapshot is not silently claimed either.
-
-The completed-capture arm requires that every selected enumeration continuation reached successful
-exhaustion, every selected entry was accounted for, and every required content acquisition completed.
-Budget exhaustion, an inaccessible selected subtree, an unsupported in-scope entry, or an unresolved
-acquisition failure must not reach that arm. Partial observations may remain for diagnostics; they do
-not authorize publication as the completed capture.
-
-## 7. The discriminating evidence
-
-Witnesses target the distinctions above rather than demonstrating one successful walk.
-
-| property | discriminating specimen |
-|---|---|
-| listing completeness | a directory yields one entry then fails: no complete listing, and no false absence for an unreached name |
-| work descent | a synthetic provider keeps revealing new work: finite fuel refuses, with no replenishment and no successful prefix |
-| budget boundary | a small capture completes; the same attempt with pending work at exhaustion refuses |
-| symlink policy | file, directory, ancestor-cycle, external and dangling links cause **no referent acquisition** and receive the declared refusal |
-| observation-to-open safety | an entry changes from regular file to symlink between observation and open: no implicit dereference |
-| occurrence preservation | two selected paths naming the same underlying file: both paths stay represented |
-| completion authority | an acquisition fails after earlier files succeeded: no completed-capture result and no publication under that claim |
-
-Compiler-side evidence is separate: the intended loop is accepted with its real decreasing measure,
-and the non-decreasing variant is **rejected by the path claimed to enforce termination** — because a
-wall nothing red has ever hit is a decoration (§4b).
-
-Inode deduplication must not erase path *occurrences*: object identity on Unix is device plus inode,
-and several directory entries may name one file. The manifest needs both selected paths even when
-captured content shares storage.
-
-## 8. Sequencing
-
-1. **The listing root cut.** Widen the listing at its authority, migrate the ten-module population,
-   delete `filesystem_listing_names_entry`, re-decide the two `FilesystemEntryName` refusals whose
-   justification the cut falsifies, and file the failure-mode row below. Self-contained, with real
-   consumers today.
-2. **Bounded acquisition.** Work fuel, the bounded collector that refuses rather than truncates,
-   no-follow at open.
-3. **The producer.** Captured inputs → `CorpusManifestObject`, with the completion contract of §6.
-4. **`RepositoryCommit.corpus`**, then the verbs. `gunbc.scm.status`'s own header currently declares
-   that it has no path and no working tree and calls those facts unproducible; the manifest is what
-   makes a path-bearing status expressible, so that header is revised *with* the change, not around it.
-
-## 9. The failure-mode row this survey owes
-
-`a_workaround_outlives_the_constraint_that_justified_it` — a construction justified by a named absent
-capability, where the capability now resolves and nothing re-reads the justification.
-
-The three nearest rostered rows are each a different class. `unmarked_workaround` is a workaround with
-*no* trigger; this one has a stated justification acting as an implicit one.
-`trigger_satisfied_before_the_row_was_written` is a trigger already true *at filing time*; this is its
-temporal sibling — true at filing, lifted later.
-`a_live_authority_name_carries_a_superseded_claim` is a name refreshed while its claim died; here
-nobody touched the sentence at all and its precondition moved underneath it.
-
-Recognition rule, decidable: a comment justifying a construction by a named absent capability, where
-the capability now resolves. Receipt: `filesystem_io`'s "a split the interpreter does not offer",
-against `split` as a seed builtin dispatched as `MethodCallSplit`.
-
-It lands with the cut in step 1, not as a bare roster append.
-
-## 10. A live defect found while sizing the cut, and a correction to how I first reported it
-
-The completeness property §1 requires is not merely unmodeled. It is **violated on main today**, in
-the seed, where no `.dag` wall can see it. The file transport's `list` verb:
-
-```rust
-return match std::fs::read_dir(&path) {
-    Ok(entries) => {
-        let mut names: Vec<String> = entries
-            .filter_map(|e| e.ok())
-            .filter_map(|e| e.file_name().into_string().ok())
-            .collect();
-        ...
-        Ok(FileResult { success: true, content: names.join("\n"), .. })
-```
-
-Two silent drops, both landing in a result whose `success` channel says `true`. **They are not
-equally harmful, and my first report of them said they were.**
-
-**The iterator drop is live.** `filter_map(|e| e.ok())` discards a `read_dir` iterator error
-mid-enumeration and returns what was collected as a *complete* listing. ~~the prefix collected so
-far~~ — **corrected: not a prefix.** The API permits iteration to continue past an error, so what a
-discarding filter collects is an arbitrary *subset*, and "prefix" understates it. It omits ordinary,
-askable names, so `filesystem_entry_presence` finds no membership for an entry that exists and
-constructs a `FilesystemEstablishedAbsence` for it.
-
-~~A wrong answer under every absence established in the tree.~~ **Corrected:** that was a
-shared-dependency claim dressed as an observed population. What is established is a *reachable route*
-from a discarded enumeration error to an unsupported absence assertion — not that any particular
-absence is wrong, nor that anything destructive followed. The absorbing fallback ("could not
-enumerate" widened into "enumerated, nothing more") sits underneath the module built to make absence
-honest; how often it has fired is unmeasured.
-
-**The non-UTF-8 drop is latent.** `into_string().ok()` discards any entry whose name is not valid
-UTF-8, again into a `success: true` listing. But `filesystem_entry_presence` takes `name: String`, so
-the asked name is always valid UTF-8 by construction and a dropped entry could never have matched it.
-~~`admit_filesystem_entry_name` would refuse such a spelling independently.~~ **Corrected:** it would
-not. It checks component spellings — separators, NUL, LF, CR — and is not the native-name conversion
-boundary; a non-UTF-8 native spelling cannot reach its `String` parameter faithfully in the first
-place. It must not be credited with a second UTF-8 admission check. Since **no consumer
-enumerates** — the fact §0 establishes — the dropped entry is currently unobservable.
-
-It is still a success channel claiming a completeness it does not have, and it becomes load-bearing
-the instant enumeration exists, which is this cut. But it is not a live wrong answer, and reporting it
-as the second half of a live fail-open was the same defect this lane keeps finding, applied to my own
-finding: asserting a population without checking whether the distinction reaches a consumer. The
-correction is recorded rather than quietly edited, because a design document that silently agrees
-with whatever was true last is not evidence of anything.
-
-### A third defect, which review found and I had missed: fabricated presence
-
-The two drops narrow the population. There is a third path that *widens* the answer, and it is the
-exact dual.
-
-While the newline wire stands, a returned name containing a line feed makes one entry
-indistinguishable from two. These produce identical bytes:
-
-```
-one entry:    "prefix\nrepo.json"
-two entries:  "prefix", "repo.json"
-```
-
-`filesystem_listing_names_entry` searches for a newline-delimited occurrence, so it answers
-`repo.json` **present** in both cases. That is a fabricated presence, and admitting the *queried*
-name does not protect against it — `admit_filesystem_entry_name` constrains what a caller may ask,
-and the collision is in the name the directory *returned*.
-
-So the repair has two directions to close, not one: a listing may not silently shrink, and it may not
-silently claim an entry it does not hold. Both belong to 1A, because both are live under the current
-encoding.
-
-Carriage return is deliberately **not** given a matching refusal. It does not collide under the
-exact-`\n` join and split, and minting a refusal for it here would be a restriction with no
-demonstrated defect behind it — the inverse error of leaving one standing on a lapsed justification.
-Its disposition belongs with the LF case to the cut that retires this encoding.
-
-### What that implies for sequencing
-
-Step 1 of §8 splits, and the split settled differently from the first proposal here.
-
-~~The latent defect has no honest home except the cut that activates it.~~ **Superseded.** Refusing
-an unrepresentable name in the *current* producer is also a valid repair, and it is the one taken:
-the existing `String` output cannot carry such a name faithfully, and silent omission is not faithful
-enumeration. That is the operation's own semantics, not a convenience.
-
-- **1A — the listing refuses rather than narrowing or fabricating.** All three routes, not the
-  iterator alone: the advancement error stops being discarded, an unrepresentable native name refuses
-  instead of being dropped, and a returned name colliding with the delimiter refuses instead of
-  fabricating an entry. Precisely: *a listing cannot report success after discarding an iterator
-  error, dropping an unrepresentable native name, or serializing a returned name that collides with
-  the listing delimiter. Supported successful listings retain their existing representation.* The
-  wire representation is unchanged; **the conditions for returning success change**, which is
-  observable behaviour and is not concealed under "the contract is untouched".
-- **1B — the structured listing.** The JSON representation, exact-Unicode support with explicit
-  native-name refusal, one completion authority, deletion of `filesystem_listing_names_entry`, and
-  re-decision of the restrictions the replacement makes unnecessary — **including the two 1A makes
-  correct for the old encoding.** They must not survive 1B merely because 1A justified them.
-
-### The substrate constraint that shapes 1B
-
-The effect boundary carries only flat scalars and lists of **string-alias** elements: every `List`
-output in `extdeps` is `List<String>`, `List<FilePath>` or `List<CommitSha>`, all from
-`stdout_lines`, and no operation anywhere returns a list of records. So `entries` cannot come back as
-`List<{name, kind}>` directly. Three candidates:
-
-| candidate | verdict |
-|---|---|
-| per-line encoding decoded in `filesystem_io` | viable — a *rigorously specified* record-per-line format could escape names and carry a terminal record |
-| two index-correlated parallel lists | **rejected** — an unenforced index correlation is the conflation this module exists to remove |
-| a JSON document on the `entries` channel, decoded once beside the operation | **chosen** |
-
-~~JSON is the only encoding that preserves a newline-bearing name and makes completion
-representable.~~ **Corrected:** it is not the only *possible* lossless framed encoding, and a
-per-line format does not *necessarily* restrict names. The reason to choose one document is simpler:
-it gives this operation a single place to bind entries, their observations and the enumeration
-outcome, and there is no reason to invent another line protocol. Decoding it beside the operation is
-the move `filesystem_io` already makes for membership — the encoding is `List`'s fact, so the
-structure over it is too.
-
-**And JSON framing is not a name contract.** JSON strings are Unicode; escaping removes the delimiter
-collision but does not make arbitrary native filename bytes into Unicode. The two honest contracts
-are *exact Unicode names*, refusing the listing on a native name that cannot be represented, and
-*exact native names*, which needs an explicit reversible representation carried through every
-operation that consumes the name. **1B takes the first.** Supporting arbitrary native names is a
-larger, separately declared capability — not something JSON supplies automatically — and the generic
-`OsString` internal encoding is explicitly not a portable wire format.
-
-Completion belongs to the decoded **outcome's shape**, not to an independent flag beside `entries`:
-`EnumerationCompleted { entries } | EnumerationRefused { cause }`, with only the completed arm
-supplying a population from which non-membership can establish absence. A document parsing
-successfully does not establish that enumeration completed, and missing or malformed completion
-information must not default to completion.
-
-## 11. What this cut does not claim
-
-`filesystem_absence_establishment_adoption_standing` carries a next-rung trigger reading that the raw
-`List` and `Read` result projections cease to be reachable outside this module's folds, so a consumer
-cannot spell the conflation at all. **This cut does not satisfy that trigger** — the raw operations
-stay callable — and must not be reported as retiring it. A trigger is retired by its trigger and by
-nothing else.
-
-## 12. The seed-growth receipt this cut owes
-
-1A adds hand Rust to `src/v1`, which `gunbc.seed_growth_admission`
-`seed_growth_forward_freeze_policy_note` makes a stop-line unless the addition is enumerated. The row
-is `gunbc.listing_completeness_seed_growth`, enrolled in the roster's own declaration list.
-
-**The population is derived, not authored.** `tools.seed_growth_change_population` runs
-`observe_rust_item_change_against` over this branch and projects each added item through
-`item_declaration_ref`; the row's list is that output. No cardinality appears in the row or in this
-section — the same policy note retired authored hand-item and hand-LOC deltas because they are
-functions of the diff, and a number here would re-create exactly the second representation it
-deleted. Run the instrument to re-derive the list.
-
-**Inline modules are scopes, not leaves.** `item_declaration_ref_in` folds `enclosing_module` into
-each member's `module_path`, and the admission join compares exact references, so naming a test
-module does not cover the functions inside it. A first cut of the row named four items on the
-opposite reading; the instrument named the nested functions the row was missing. Test items belong
-in the roster on the same footing as production ones — there is no production-only exemption.
-
-**Its trigger binds the declarations, not a format milestone.** Three conditions, all required:
-implementation displacement (the production consumers no longer need this hand code — a renamed hand
-successor moves the obligation rather than retiring it), evidence continuity (each still-live
-behaviour stays discriminated at the boundary where it can fail; a `.dag` witness starting from
-`EnumerationRefused` begins *after* the point where the host defect discarded the error), and the
-changed representation contract (under a representation supporting LF-bearing names, "LF must
-refuse" is re-decided into exact preservation with no fabricated membership, not carried forward).
-The narrow check is that **no operational name observation depends on the ambiguous unescaped
-delimiter representation** — not a ban on `List<String>` or on joining, since an internal list of
-names, or a join over already-escaped fragments, is not the lossy transport.
-
-**What the instrument is not.** It is the callable **roster-coverage diagnostic**. A required
-admission phase may reuse its observation and coverage components, but must retain the full admission
-authority's obligations: `seed_growth_admit_change` takes `change`, `live`, `bridges` and `evidence`,
-performs `gunbc.capability_origin`'s origin checks, and preserves diagnostics this entry point
-deliberately omits — and the policy's next-rung trigger names stopping the line on
-`SeedGrowthAdmissionRefused` specifically. **Scheduling this function would not establish that
-trigger**, and running it green retires nothing.
-
-**Its own partial-observer repair.** `item_declaration_ref` has three outcomes and the first cut of
-the verdict decided success from two: `projected_declaration_refs` excludes uncitable *and* refused
-projections, `projected_refused_keys` collects only refused ones, so an added `RustImplMethod` —
-which `std.decl_ref` cannot name at all — fell out of both lists and the run exited success reporting
-neither the item nor the limitation. The same defect this branch exists to repair, committed by the
-instrument that measures it. The verdict now carries all three causes together rather than ranking
-them, is complete only when every one is empty, and keeps them distinct: unaddressable is an
-unclaimed source tree, uncitable is an item no `DeclarationRef` can spell (not a row an author can
-add), unjustified is a missing roster row. `test.claim.seed_growth_change_population_witness_test`
-hands the decision populations no diff on this branch produces, which is the only way the uncitable
-arm is reachable.
diff --git a/docs/plans/d13-network-audit.md b/docs/plans/d13-network-audit.md
deleted file mode 100644
index 56645f9e0f3..00000000000
--- a/docs/plans/d13-network-audit.md
+++ /dev/null
@@ -1,199 +0,0 @@
-# D13 Network audit — the selection rule and its citations
-
-Input to D13 step (b) (`gunbc.plans.demand_engine_program`; rung drop `gunbc.rung_drop` `network_requirement_unrepresented_after_uses_cut`). This page holds the reasoning behind the `requires` clauses on `dag/extdeps` operations: the rule, the rulings, and a citation for each program or API class. **It holds no per-operation verdicts.** Each verdict is the operation's own `requires` clause, which is the single authority (DESIGN §3, §6). Read the population from the clauses themselves, e.g. `grep -rn 'requires ' dag/extdeps`. The per-row table used for review was posted on gunbc#12965 rather than committed.
-
-## Selection rule (ruled by quiet-seal-543, 2026-10-01)
-
-A `requires` clause states what a sandbox must GRANT, so the fail-closed direction is to over-declare. An operation is **Network** if executing it Wet **may** open a connection to a non-local endpoint. This replaces the first draft's "necessarily". The judgement is made from the operation's own declaration (transport kind + argv/endpoint) against the cited upstream behaviour of the program or API it invokes.
-
-- **rest**: Network unless the declared endpoint is a unix socket or a fixed loopback address. Docker Engine binds `extdeps.docker.endpoint` `docker_default_endpoint`, a unix socket, so it is NotNetwork. The GCP metadata server (169.254.169.254) is link-local, not loopback, so it is Network.
-- **file**: NotNetwork.
-- **shell**: decided by program **and** authored argv:
-  - A fixed network protocol to a host is Network: ssh/scp/sshpass, `ipmitool -I lanplus`, `curl https://…`, `gh`, `gcloud auth`, hosted-model CLIs.
-  - A url/remote parameter is Network: `curl {url}`, `git fetch|push|ls-remote {remote}`, Playwright `goto {url}`, and `github.OIDC` `GetToken` with its runtime `request_url`. An operation name is not a type, so `http.Client` `GetLocalhostBounded` is Network until its `{url}` is typed loopback. That typing is the trigger that would move it.
-  - A fetch that depends on cache state is Network: cargo without `--offline`, `npm ci`, `npm cache add`, `npx -y`, `apt-get install`, `gcloud auth print-access-token`.
-  - `arping` is Network: it uses the network interface.
-  - A runtime-program parameter is **OpaqueDemand**: `shell.exec` Run*, `systemd-run` with `command_argv`, the sudo probe `Check`, `gunbc.WitnessBin` `Run`, and the node/python/go `RunFile` runners. The argv is runtime data, so step (b) yields DemandUndecided for their callers instead of an empty demand.
-  - **Runtime program in an argument** (ruling 2026-10-02): an argument that carries a program the invoked tool executes is **OpaqueDemand** -- scripts, expressions, inner argv, executing templates, and a caller-supplied program path in argv[0] (`codex_app_server` `GenerateJsonSchema`). This includes an unrefined string in option position that the tool accepts as a program-executing option (`git grep -O<pager>`). A runtime program whose language has no network or exec primitive (a jq filter; Rust source that rustc only compiles) does not raise the demand above its host program's.
-  - **Remote-selecting option in an unrefined string** (ruling 2026-10-02): if an unrefined string sits where the tool parses options, and the tool has an option that selects a remote host or URL (`systemctl -H/--host=`, `hostnamectl -H`, curl `-K<config>`/`-x<proxy>`), the operation is **Network**. That holds unless the argv structurally prevents it, e.g. the string follows `--` or is the value of a preceding option.
-  - Everything else is a local program on local paths: NotNetwork.
-  - **Live browser page** (ruling 2026-10-02): an interaction with a running browser is **Network**. A click can navigate, page scripts run during any call, and browser startup can fetch. A program whose option surface cannot be verified (`playwright-runner` is not in this repository) is **OpaqueDemand** for every runtime positional it receives; it is never assumed none.
-  - **Partial clone** (ruling 2026-10-02): a git read that needs blob or tree objects is **Network**, because in a partial clone git lazily fetches missing objects from the promisor remote, and whether a repository is a partial clone belongs to the repository the operation is pointed at, i.e. its input. Reads of commits, refs, the index or config only are not affected.
-- **Repository-selected executable** (ruling 2026-10-02): if the invoked command executes a program selected by the input repository or its configuration, the operation is **OpaqueDemand**, unless the operation structurally disables that surface. This covers hooks, clean/smudge/process filters, diff/merge drivers, textconv, the credential helper, the fsmonitor hook, `core.sshCommand`, `remote.*.uploadpack`, a cargo build script or proc macro, `.cargo/config` aliases and runners, the `.npmrc` `git` executable, and agent hooks in a settings argument. Upstream surfaces, all git per git-scm.com/docs:
-  - githooks(5): `pre-commit`, `prepare-commit-msg` (not suppressed by `--no-verify`), `commit-msg`, `post-commit`, `post-checkout` (checkout, worktree add), `pre-merge-commit`/`post-merge`, `pre-push`, `reference-transaction` (every ref update, including `update-ref`), `post-index-change` (every index write: add, read-tree, update-index, write-tree).
-  - gitattributes(5): clean on add/status/diff-against-worktree/`hash-object` with a path; smudge on checkout/restore/reset/checkout-index/merge; diff drivers and textconv on patch output; merge drivers on merge and merge-tree.
-  - git-config(1): `core.fsmonitor` on index refresh (status, add, commit, untracked scans); `credential.helper`, `core.sshCommand`, `remote.<name>.uploadpack`/`receivepack` on every transport (fetch, push, ls-remote).
-  - Cargo: build scripts and proc macros (doc.rust-lang.org/cargo/reference/build-scripts.html), and user aliases that shadow external subcommands such as `fmt` (doc.rust-lang.org/cargo/reference/config.html#alias).
-  - npm: the `git` config key (docs.npmjs.com/cli/using-npm/config#git) for git dependencies.
-  - Claude Code: hooks in `--settings` (docs.anthropic.com/claude-code/hooks).
-  - Agent CLIs (`codex exec`, and `claude -p` with a runtime permission mode) execute model-chosen commands, which makes them runtime programs.
-
-  - Index reads (ruling 2026-10-02, no special case): any git command that reads the index can run the `core.fsmonitor` hook on the first index load (read-cache `tweak_fsmonitor`). That covers plain `ls-files`, and also every unrefined revision argument, because a revision may be spelled `:<path>` or `:<stage>:<path>`, which reads the index (gitrevisions(7)). So rev-parse/show/cat-file/ls-tree/merge-base/reflog/rev-list/commit-tree/diff with a runtime revision are opaque.
-  - Toolchain proxies in an input directory (ruling 2026-10-02): rustup selects the toolchain from `rust-toolchain.toml` in the working directory (rust-lang.github.io/rustup/overrides.html). npx reads the project `.npmrc` (e.g. `node-options`). So an operation that runs these in a cwd or repository it takes as input is opaque. The same programs run with an ambient cwd (`cargo --version`, `rustc --version`) fall under the host-environment boundary.
-
-  Git operations that reach none of these surfaces keep their transport verdict. They have fixed revisions and no index read: rev-parse of `HEAD`/`--show-toplevel`, `rev-list --before=… HEAD`, `for-each-ref`, `worktree list`, `branch -r`, `config`, `init`, `hash-object --stdin`, and `log -- {path}` (Network: partial clone). Paging is not reached because stdout is captured, not a TTY.
-- **Boundary — host environment is not demand** (ruling 2026-10-02): host-wide configuration (global/system git config, `~/.ssh/config`, rustup toolchain selection from an ambient cwd) and host-wide resolver configuration (NSS, which can route `id`/`whoami`/`stat %U` to LDAP; DNS) is the sandbox's environment, not an operation's demand, and does not raise a clause.
-
-## Citations by class
-
-| verdict → clause | citation | modules |
-|---|---|---|
-| Network → `requires Network` | Cloudflare API v4 (developers.cloudflare.com/api) | `extdeps.cloudflare.account_api_tokens`, `extdeps.cloudflare.r2_buckets` |
-| Network → `requires Network` | GCP metadata server (cloud.google.com/compute/docs/metadata/overview): metadata.google.internal = 169.254.169.254, link-local, not loopback | `extdeps.cloud.gcp.sts` |
-| Network → `requires Network` | GitHub REST API docs (docs.github.com/rest), base https://api.github.com | `extdeps.github.actions_jit_runner`, `extdeps.github.app`, `extdeps.github.checks`, `extdeps.github.code_search`, `extdeps.github.commits`, `extdeps.github.gists`, `extdeps.github.git_database`, `extdeps.github.issues`, `extdeps.github.org_actions`, `extdeps.github.pulls`, `extdeps.github.repository_contents`, `extdeps.github.rulesets`, `extdeps.github.users`, `extdeps.github.workflow_runs`, `extdeps.github.workflows` |
-| Network → `requires Network` | Google Drive API v3 reference (developers.google.com/drive/api/reference/rest/v3) | `extdeps.google.drive` |
-| Network → `requires Network` | Google Sheets API v4 reference (developers.google.com/sheets/api/reference/rest) | `extdeps.google.sheets` |
-| Network → `requires Network` | PARAM remote: git-fetch(1)/git-push(1)/git-ls-remote(1) use the remote's transport (gitprotocol-v2(5)); a {remote} may be a local path (file transport) or a URL; operations run in a repository are now opaque (repository-selected credential helper/sshCommand/uploadpack/pre-push/reference-transaction); the Network clause remains only where none of those surfaces is reached | `extdeps.git`, `extdeps.git.publication_transport` |
-| Network → `requires Network` | PARAM request_url: endpoint is the runtime ACTIONS_ID_TOKEN_REQUEST_URL (docs.github.com/actions/reference/security/oidc); declaration fixes no host | `extdeps.cloud.gcp.sts` |
-| Network → `requires Network` | PARAM tarball: npm cache add (docs.npmjs.com/cli/commands/npm-cache) accepts a path or a URL | `extdeps.tools.npm` |
-| Network → `requires Network` | PARAM url: Playwright page.goto (playwright.dev/docs/api/class-page#page-goto) navigates to a runtime URL | `extdeps.browser` |
-| Network → `requires Network` | PARAM url: curl(1) URL scheme+host both runtime (could be file:// or loopback) | `extdeps.http.client` |
-| Network → `requires Network` | RULING link-layer: arping(8) broadcasts ARP on {device} to {target}; L2 traffic, no connection to an endpoint | `extdeps.iputils.arping` |
-| Network → `requires Network` | SEC EDGAR APIs (sec.gov/search-filings/edgar-application-programming-interfaces) | `extdeps.sec.edgar_rest` |
-| Network → `requires Network` | STATE credential cache: gcloud auth print-access-token (cloud.google.com/sdk/gcloud/reference/auth/print-access-token) refreshes over oauth2.googleapis.com only when the cached token is expired | `extdeps.shell` |
-| Network → `requires Network` | STATE package cache: apt-get(8) install downloads .debs from sources.list unless already installed/cached; PARAM package | `extdeps.apt` |
-| Network → `requires Network` | STATE package cache: npm ci (docs.npmjs.com/cli/commands/npm-ci) fetches from the registry unless every tarball is cached; superseded for `npm.Ci` by the repository-selected executable rule (`.npmrc` `git`): opaque | `extdeps.tools.npm` |
-| Network → `requires Network` | STATE package cache: npx -y -p (docs.npmjs.com/cli/commands/npx) installs the package from the registry unless already cached | `extdeps.typescript` |
-| Network → `requires Network` | STATE registry cache: cargo build/check/test (doc.rust-lang.org/cargo/commands/cargo-build.html, --offline/--frozen) fetch the index/crates only when Cargo.lock deps are not already downloaded; argv does not pass --offline; superseded for `cargo.Build` by the repository-selected executable rule (build scripts, proc macros): opaque | `extdeps.cargo_build` |
-| Network → `requires Network` | TCGplayer API (docs.tcgplayer.com), base https://api.tcgplayer.com | `extdeps.tcgplayer.catalog`, `extdeps.tcgplayer.pricing`, `extdeps.tcgplayer.store`, `extdeps.tcgplayer.tcgplayer` |
-| Network → `requires Network` | curl(1) to fixed https://api.github.com (GitHub Apps REST docs.github.com/rest/apps) | `extdeps.github.app` |
-| Network → `requires Network` | curl(1) to https://{bmc_host}: DMTF Redfish DSP0266 / MegaRAC web API over HTTPS — argv fixes the https scheme to a BMC host | `extdeps.bmc.http`, `extdeps.bmc.megarac` |
-| Network → `requires Network` | eBay REST APIs (developer.ebay.com/api-docs), base https://api.ebay.com | `extdeps.ebay.browse`, `extdeps.ebay.inventory`, `extdeps.ebay.oauth` |
-| Network → `requires Network` | fixed HTTPS endpoint https://api.anthropic.com (upstream API reference for that host) | `extdeps.llm.anthropic_rest` |
-| Network → `requires Network` | fixed HTTPS endpoint https://api.openai.com (upstream API reference for that host) | `extdeps.llm.openai_rest` |
-| Network → `requires Network` | fixed HTTPS endpoint https://api.tailscale.com (upstream API reference for that host) | `extdeps.tailscale.acl_api` |
-| Network → `requires Network` | fixed HTTPS endpoint https://cloudresourcemanager.googleapis.com (upstream API reference for that host) | `extdeps.cloud.gcp.iam` |
-| Network → `requires Network` | fixed HTTPS endpoint https://iam.googleapis.com (upstream API reference for that host) | `extdeps.cloud.gcp.iam`, `extdeps.cloud.gcp.iam_admin` |
-| Network → `requires Network` | fixed HTTPS endpoint https://iamcredentials.googleapis.com (upstream API reference for that host) | `extdeps.cloud.gcp.iam` |
-| Network → `requires Network` | fixed HTTPS endpoint https://jsonplaceholder.typicode.com (upstream API reference for that host) | `extdeps.test.http_pilot` |
-| Network → `requires Network` | fixed HTTPS endpoint https://oauth2.googleapis.com (upstream API reference for that host) | `extdeps.cloud.gcp.gcp` |
-| Network → `requires Network` | fixed HTTPS endpoint https://secretmanager.googleapis.com (upstream API reference for that host) | `extdeps.cloud.gcp.secret_manager` |
-| Network → `requires Network` | fixed HTTPS endpoint https://serviceusage.googleapis.com (upstream API reference for that host) | `extdeps.cloud.gcp.serviceusage` |
-| Network → `requires Network` | fixed HTTPS endpoint https://sts.googleapis.com (upstream API reference for that host) | `extdeps.cloud.gcp.sts` |
-| Network → `requires Network` | gcloud auth login (cloud.google.com/sdk/gcloud/reference/auth/login): OAuth flow against accounts.google.com | `extdeps.cloud.gcp.gcp` |
-| Network → `requires Network` | gh(1) manual (cli.github.com/manual): `gh api`/`gh pr`/`gh run` call api.github.com | `extdeps.github.actions_runs`, `extdeps.github.ci_runner`, `extdeps.github.org_actions`, `extdeps.github.organizations`, `extdeps.github.pulls` |
-| Network → `requires Network` | ipmitool(1) INTERFACES: -I lanplus = IPMI v2.0 RMCP+ over UDP/623 to -H {bmc_host} | `extdeps.bmc.ipmi` |
-| Network → `requires Network` | ssh(1)/scp(1) (+sshpass(1)): opens TCP/22 session to the host named in argv | `extdeps.bmc.openbmc_password_ssh_transport`, `extdeps.ssh.password_session`, `extdeps.ssh.session` |
-| Network → `requires Network` | vendor CLI prompt mode calls the hosted model API (Claude Code docs.anthropic.com/claude-code/cli-reference; Codex CLI `exec` github.com/openai/codex; Gemini CLI github.com/google-gemini/gemini-cli); `claude.Invoke.Run` (hooks in `--settings`), `llm.Anthropic.CliPrompt` (runtime permission mode) and `llm.Codex.Review` (agent exec in `-C {cwd}`) are opaque | `extdeps.llm.anthropic_rest`, `extdeps.llm.cli` |
-| NotNetwork → `requires none` | /usr/bin/stat: local coreutils/POSIX utility (man stat(1)); argv names only local paths/values | `extdeps.tools.stat` |
-| NotNetwork → `requires none` | Docker Engine API (docs.docker.com/reference/api/engine): default endpoint unix:///var/run/docker.sock (extdeps.docker.endpoint docker_default_endpoint), a unix socket | `extdeps.docker.container_inspect`, `extdeps.docker.container_stats` |
-| Network → `requires Network` | RULING live page: Playwright Page/BrowserContext API (playwright.dev/docs/api/class-page); a running page and browser startup may fetch (`Launch`, `CurrentUrl`, `Title`) | `extdeps.browser` |
-| OpaqueDemand → `requires opaque` | RULING unverifiable surface: `playwright-runner` is not in this repository, so a runtime positional (selector, text, path, ms, context) may reach an unknown option | `extdeps.browser` |
-| OpaqueDemand → `requires opaque` | RULING runtime program: Playwright page.evaluate / locator.evaluate (playwright.dev/docs/evaluating) run runtime JavaScript in the page, which can call fetch | `extdeps.browser` |
-| NotNetwork → `requires none` | cargo(1) --version / cargo-fmt: no registry access (doc.rust-lang.org/cargo/commands); `cargo fmt` is now opaque (a workspace alias can shadow the external subcommand); `--version` stays none | `extdeps.cargo_build` |
-| NotNetwork → `requires none` | cat: local coreutils/POSIX utility (man cat(1)); argv names only local paths/values | `extdeps.linux.cgroup_v2`, `extdeps.linux.procfs` |
-| NotNetwork → `requires none` | chmod: local coreutils/POSIX utility (man chmod(1)); argv names only local paths/values | `extdeps.shell` |
-| OpaqueDemand → `requires opaque` | RULING runtime program: argv[0] is the caller-supplied `CodexAppServerExecutable.path`, so the executed program is runtime-selected (codex app-server generate-json-schema itself writes schema files locally, per the github.com/openai/codex app-server README) | `extdeps.llm.codex_app_server` |
-| NotNetwork → `requires none` | cp: local coreutils/POSIX utility (man cp(1)); argv names only local paths/values | `extdeps.shell` |
-| NotNetwork → `requires none` | crontab(1): local spool | `extdeps.cron` |
-| Network → `requires Network` | RULING remote option: curl(1) --unix-socket, but the `{url}` positional is unrefined and not after `--`, so it can carry curl options (`-K<config>`, `-x<proxy>`) that retarget the connection | `extdeps.http.client` |
-| NotNetwork → `requires none` | date: local coreutils/POSIX utility (man date(1)); argv names only local paths/values | `extdeps.clock` |
-| NotNetwork → `requires none` | diff: local coreutils/POSIX utility (man diff(1)); argv names only local paths/values | `extdeps.tools.diffutils` |
-| NotNetwork → `requires none` | dpkg(1): local status database | `extdeps.dpkg` |
-| NotNetwork → `requires none` | find: local coreutils/POSIX utility (man find(1)); argv names only local paths/values | `extdeps.linux.cgroup_v2`, `extdeps.shell` |
-| NotNetwork → `requires none` | getconf: local coreutils/POSIX utility (man getconf(1)); argv names only local paths/values | `extdeps.posix.getconf` |
-| NotNetwork → `requires none` | git(1); local subcommand per git-scm.com/docs reading only commits, refs, the index or config (no transport; only fetch/push/ls-remote/clone/pull use git transfer protocols, gitprotocol-v2(5)), and running no hook, filter, driver or fsmonitor surface | `extdeps.git`, `extdeps.git.inspect`, `extdeps.git.plumbing`, `extdeps.git.publication_transport` |
-| Network → `requires Network` | RULING partial clone: git-partial-clone (git-scm.com/docs/partial-clone) lazily fetches missing blobs/trees from the promisor remote; diff, show, cat-file, ls-tree, log -- path, read-tree, checkout-index, unpack-file, merge, merge-tree, checkout, restore, reset --hard, worktree add; any of these that also runs a repository-selected executable is opaque instead | `extdeps.git`, `extdeps.git.inspect`, `extdeps.git.plumbing` |
-| OpaqueDemand → `requires opaque` | RULING runtime program: git-grep(1) `-O<pager>` opens matches with a runtime program; `{pattern}` and `{ref}` (GitRef is only non-empty) sit in option position | `extdeps.git.inspect` |
-| NotNetwork → `requires none` | grep: local coreutils/POSIX utility (man grep(1)); argv names only local paths/values | `extdeps.tools.grep` |
-| NotNetwork → `requires none` | gunbc file transport: local filesystem read/write (POSIX open(2), read(2)) | `extdeps.filesystem.filesystem_io`, `extdeps.linux.procfs` |
-| NotNetwork → `requires none` | gzip: local coreutils/POSIX utility (man gzip(1)); argv names only local paths/values | `extdeps.tools.gzip` |
-| NotNetwork → `requires none` | hostname: local coreutils/POSIX utility (man hostname(1)); argv names only local paths/values | `extdeps.tools.hostname` |
-| Network → `requires Network` | RULING remote option: hostnamectl(1) `-H/--host=` runs over SSH; `Process.Run` forwards an unrestricted ProcessArgvExpansion | `extdeps.tools.hostname` |
-| NotNetwork → `requires none` | id: local coreutils/POSIX utility (man id(1)); argv names only local paths/values | `extdeps.shell`, `extdeps.tools.id` |
-| NotNetwork → `requires none` | ip-address(8): rtnetlink to the local kernel | `extdeps.iproute2.ip_address` |
-| NotNetwork → `requires none` | journalctl(1): reads the local journal | `extdeps.systemd.journalctl` |
-| NotNetwork → `requires none` | jq(1) manual: filter over stdin/args | `extdeps.bmc.openbmc_fan_control`, `extdeps.tools.jq` |
-| NotNetwork → `requires none` | kill: local coreutils/POSIX utility (man kill(1)); argv names only local paths/values | `extdeps.posix.signal` |
-| NotNetwork → `requires none` | ln: local coreutils/POSIX utility (man ln(1)); argv names only local paths/values | `extdeps.shell` |
-| NotNetwork → `requires none` | mkdir: local coreutils/POSIX utility (man mkdir(1)); argv names only local paths/values | `extdeps.shell` |
-| NotNetwork → `requires none` | mktemp: local coreutils/POSIX utility (man mktemp(1)); argv names only local paths/values | `extdeps.shell` |
-| NotNetwork → `requires none` | mv: local coreutils/POSIX utility (man mv(1)); argv names only local paths/values | `extdeps.shell` |
-| NotNetwork → `requires none` | node: local coreutils/POSIX utility (man node(1)); argv names only local paths/values | `extdeps.tools.node` |
-| NotNetwork → `requires none` | npm --version (docs.npmjs.com/cli/commands/npm) | `extdeps.tools.npm` |
-| NotNetwork → `requires none` | npm ci --offline (docs.npmjs.com/cli/using-npm/config#offline): forces cache-only, no network; superseded by the repository-selected executable rule: opaque | `extdeps.tools.npm` |
-| NotNetwork → `requires none` | nvidia-smi(1): local NVML | `extdeps.nvidia.system_management_interface` |
-| NotNetwork → `requires none` | oomctl(1): local systemd-oomd | `extdeps.systemd.oomd` |
-| NotNetwork → `requires none` | openssl-dgst(1): local signing | `extdeps.tools.openssl` |
-| NotNetwork → `requires none` | printenv: local coreutils/POSIX utility (man printenv(1)); argv names only local paths/values | `extdeps.shell` |
-| NotNetwork → `requires none` | ras-mc-ctl(8): local EDAC sysfs/rasdaemon DB | `extdeps.linux.edac` |
-| NotNetwork → `requires none` | realpath: local coreutils/POSIX utility (man realpath(1)); argv names only local paths/values | `extdeps.shell` |
-| NotNetwork → `requires none` | rm: local coreutils/POSIX utility (man rm(1)); argv names only local paths/values | `extdeps.shell` |
-| NotNetwork → `requires none` | rmdir: local coreutils/POSIX utility (man rmdir(1)); argv names only local paths/values | `extdeps.shell` |
-| NotNetwork → `requires none` | rustc --version / local compilation (doc.rust-lang.org/rustc) | `extdeps.rustc` |
-| NotNetwork → `requires none` | rustfmt: local coreutils/POSIX utility (man rustfmt(1)); argv names only local paths/values | `extdeps.tools.rustfmt` |
-| OpaqueDemand → `requires opaque` | RULING runtime program: GNU sed's `e` command and `s///e` execute shell commands; the operations take a runtime sed program without `--sandbox` | `extdeps.tools.sed` |
-| NotNetwork → `requires none` | sh -c script authored in the declaration uses only local programs (mktemp(1), find(1), sort(1), head(1)/tr(1) over /dev/urandom, rustc --emit=metadata, command -v) | `extdeps.entropy`, `extdeps.rustc`, `extdeps.shell` |
-| NotNetwork → `requires none` | sha256sum: local coreutils/POSIX utility (man sha256sum(1)); argv names only local paths/values | `extdeps.crypto.hash`, `extdeps.tools.sha256sum` |
-| NotNetwork → `requires none` | sha512sum: local coreutils/POSIX utility (man sha512sum(1)); argv names only local paths/values | `extdeps.tools.sha512sum` |
-| NotNetwork → `requires none` | sleep: local coreutils/POSIX utility (man sleep(1)); argv names only local paths/values | `extdeps.tools.sleep` |
-| NotNetwork → `requires none` | stat: local coreutils/POSIX utility (man stat(1)); argv names only local paths/values | `extdeps.shell`, `extdeps.tools.coreutils_stat` |
-| NotNetwork → `requires none` | sudo(8) -l: local policy | `extdeps.sudo.nopasswd_execute_probe_check_op` |
-| NotNetwork → `requires none` | systemctl(1): talks to the local systemd manager over D-Bus/private socket; only operations with no unrefined positional string (`DaemonReload`) | `extdeps.systemd.systemctl` |
-| Network → `requires Network` | RULING remote option: systemctl(1) `-H/--host=` runs over SSH; the unit/pattern positional is an unrefined NonEmptyStr with no `--` before it | `extdeps.systemd.systemctl` |
-| NotNetwork → `requires none` | tailscale CLI `serve status` reads the local tailscaled LocalAPI socket (tailscale.com/kb/1242/tailscale-serve) | `extdeps.tailscale.serve` |
-| NotNetwork → `requires none` | test: local coreutils/POSIX utility (man test(1)); argv names only local paths/values | `extdeps.linux.cgroup_v2`, `extdeps.shell` |
-| NotNetwork → `requires none` | tmux(1): local server socket (`List`, `Kill`) | `extdeps.tmux` |
-| OpaqueDemand → `requires opaque` | RULING runtime program: tmux new-session runs `inner_argv`, a runtime command | `extdeps.tmux` |
-| NotNetwork → `requires none` | uname: local coreutils/POSIX utility (man uname(1)); argv names only local paths/values | `extdeps.shell` |
-| NotNetwork → `requires none` | wc: local coreutils/POSIX utility (man wc(1)); argv names only local paths/values | `extdeps.tools.wc` |
-| NotNetwork → `requires none` | whoami: local coreutils/POSIX utility (man whoami(1)); argv names only local paths/values | `extdeps.access.posix_effective_principal_read_op` |
-| NotNetwork → `requires none` | xorriso: local coreutils/POSIX utility (man xorriso(1)); argv names only local paths/values | `extdeps.tools.xorriso` |
-| OpaqueDemand → `requires opaque` | PARAM bin_path: program is runtime | `extdeps.gunbc` |
-| OpaqueDemand → `requires opaque` | PARAM command_argv: systemd-run(1) itself is local; the transient unit runs a runtime command | `extdeps.systemd.systemd_run` |
-| OpaqueDemand → `requires opaque` | PARAM probe.command_path: sudo(8) runs a runtime program | `extdeps.sudo.nopasswd_execute_probe_check_op` |
-| OpaqueDemand → `requires opaque` | PARAM program/command body: argv supplied at runtime | `extdeps.shell.exec` |
-| OpaqueDemand → `requires opaque` | PARAM script_path: behaviour is the runtime script | `extdeps.go`, `extdeps.node`, `extdeps.python` |
-
-## Follow-ups (better modeling than the clauses above; not done here)
-
-- Repository-selected executables in git, by structural disabling. Each item has its citation, and each would move the affected operations back to their transport verdict:
-  - `-c core.hooksPath=/dev/null` disables every hook, including `prepare-commit-msg` and `reference-transaction` (git-config `core.hooksPath`; githooks(5)). `--no-verify` alone is insufficient.
-  - `-c core.fsmonitor=false` (git-config `core.fsmonitor`) disables the fsmonitor hook on every index read. `--no-optional-locks` does not: it only skips the opportunistic index write (git(1)).
-  - Revision arguments: a refined revision type that excludes the `:<path>` index forms, or `--end-of-options` plus a full object id, removes the index read from rev-parse/show/cat-file/ls-tree/merge-base/rev-list.
-  - Toolchain proxies: pin the toolchain explicitly (`cargo +<toolchain>`, `RUSTUP_TOOLCHAIN`) and run npx with `--userconfig`/an isolated cwd, or the operation stays opaque.
-  - `--no-textconv --no-ext-diff` on diff (git-diff(1)).
-  - `hash-object --no-filters` (git-hash-object(1)).
-  - Overriding the filter and merge-driver surfaces needs per-driver `-c filter.<driver>.*`/`merge.<driver>.driver` overrides, which are unknown in advance. A typed attribute-free checkout realization is the structural route; otherwise those operations stay opaque.
-  - On transports, `-c credential.helper=` (an empty value resets the helper list; gitcredentials(7)), `-c core.sshCommand=ssh`, and dropping `--upload-pack`.
-- Cargo: no flag disables build scripts or proc macros, so those operations stay opaque until the workspace's build-time programs are modeled.
-- npm ci: `--git=false`-style suppression is not documented. Pin the lockfile to registry-only sources and refuse git dependencies.
-
-- `systemd.Systemctl` and `hostnamectl.Process`: terminate options before the unit/pattern positional (`--`), or refine the input to a unit-name type. Either move those operations back to `requires none`.
-- `sed.Sed`: a typed non-executing sed subset, or `--sandbox` in the argv, would move both operations to `requires none`.
-- `tmux.Session.New`: an inner-command carrier whose program demand is declared.
-- `browser.Page.Evaluate` / `browser.Element.EvaluateOn`: a structurally non-network expression vocabulary.
-- `git.Inspect` grep operations: `-e {pattern}` plus `--` before the revision, or a refined GitRef, would remove the `-O` route.
-- git object reads: add `git --no-lazy-fetch` (git 2.44+) to the read operations, then move them to `requires none`.
-- `extdeps.browser`: bring the runner's CLI into the repository (or cite its option surface) and terminate options before positionals; the selector operations then fall to the live-page Network rule.
-- `http.Client.PostStdinWithinUnixSocket`: put `--` before `{url}` and type the url to the socket's authority.
-
-## Product-layer operations outside `dag/extdeps` (same rule)
-
-These 14 services in `dag/gunbc` had no clause; an absent clause is Undecided, so every caller would refuse. Verdicts:
-
-| verdict → clause | reason | operations |
-|---|---|---|
-| Network → `requires Network` | rest to `approval_ntfy_endpoint` (`https://ntfy.sh` or the tailnet HTTPS base), not a unix socket or loopback | `gunbc.auth.approval_ntfy_deployment` `ntfy.Publish.PublishMessage` |
-| OpaqueDemand → `requires opaque` | runtime program: argv[0] is the caller-supplied `bin_path` | `gunbc.cli_services` `gunbc.Cli.Run`, `claim_executor.Executor.VerifyBuildArtifacts` |
-| OpaqueDemand → `requires opaque` | runtime program: the script runs the caller-supplied `{ipmitool}` path (lanplus to `{bmc_host}`) | `gunbc.machine_intake.sol_hold` `ActivateHeld` |
-| OpaqueDemand → `requires opaque` | runtime program: launches the caller-supplied `command` argv | `gunbc.owned_process` `launch.LaunchOwned` |
-| NotNetwork → `requires none` | local only: reads the pid record, checks `/proc`, `kill`s the recorded pid | `gunbc.machine_intake.sol_hold` `ReleaseHeld` |
-| NotNetwork → `requires none` | no transport: a pure fold over its inputs | `gunbc.code_change_workflow` `ClassifyGithubPrTerminalAnchor`, `DecideTransition`; `gunbc.pr_digests` `ExtractAttachedUrls`, `RenderPrSummaryLine`, `JudgeMergeReadiness`, `ClassifyRestFallback`; `gunbc.review_verdict` `Parse`, `Tally` |
-
-## Deliberately undeclared test fixtures
-
-These test and fixture operations carry no `requires` clause on purpose. Each exists to exercise a transport, argv or governance mechanism, and no test of theirs reads a demand, so none needs a clause today. A fixture gains one when a test first needs it. The list is the population at this writing; read the current one by scanning for `operation` blocks without `requires` outside `dag/extdeps` and `dag/gunbc`.
-
-- `dag/test/claim/m4_governed_service_witness.dag`: `GovernedProbe` `Allowed`, `Forbidden`
-- `dag/test/claim/reconstruction_door_fixture_probe.dag`: `DoorProbe.Fetch`
-- `dag/test/claim/reconstruction_door_rest_probe.dag`: `DoorProbeRest.Fetch`
-- `dag/test/claim/shell_spawn_refused_real_execution_witness_test.dag`: `test.ShellSpawnProbe.Observed`
-- `dag/test/fixture/argv_executable_position_probe.dag`: `ArgvExecutablePositionProbe` `SmuggleExecutable`, `LiteralExecutable`
-- `dag/test/fixture/m4_universal_governed_probe.dag`: `GovernedUniversalProbe` `Allowed`, `Forbidden`
-- `dag/test/fixture/rest_exchange_replay_probe.dag`: `test.RestReplay` `Observe`, `RootArray`, `RootFile`, `RootPage`, `WorkflowRunsPage`, `WifProvidersPage`, `WifPool`, `WorkflowRunsPageLegacy`, `RootUncontracted`, `Sibling`, `OptionalObserve`, `Legacy`
-- `fixtures/atomic_materialization/subject.dag`: `AtomicFixture.Read`
-- `fixtures/bare_service_provider/provider.dag`: `fixture.BareServiceEcho.Say`
-- `fixtures/fixture_closure_rustc/argv_word_list_splice_probe.dag`: `fixture.WordListTransport` `InteriorList`, `TrailingList`, `TwoListsOneArgv`, `SingleWordOnly`
-- `fixtures/fixture_closure_rustc/shell_multi_field_projection_probe.dag`: `fixture.MultiFieldProjection.TwoFieldExitSuccess`
-- `fixtures/fixture_closure_rustc/shell_single_field_projection_probe.dag`: `fixture.SingleFieldProjection.OneFieldExitSuccess`
diff --git a/docs/plans/dag-emit-one-grammar-backward.md b/docs/plans/dag-emit-one-grammar-backward.md
deleted file mode 100644
index 5bf453025e3..00000000000
--- a/docs/plans/dag-emit-one-grammar-backward.md
+++ /dev/null
@@ -1,248 +0,0 @@
-# The dag target emits by reading `dag_grammar_root` backward
-
-Status: **implemented** in gunbc#12878 (`v2.std.grammar` `grammar_emit_parse_tree`, `v2.extdeps.languages.dag` `dag_emit_parse_tree`) (work item adhoc-da997c00-fa0). This page states how emit selects a
-production for a Node shape and how each terminal's token class is recovered. It was written as the
-model before code and accepted, and the implementation follows it except where a section below says
-otherwise.
-
-## The defect being replaced
-
-DESIGN §4 says there is one grammar, read in both directions. For the v2 dag target that is
-currently false (measured by tidy-lark-233 on main `cc2fefacac`):
-
-- `v2.extdeps.languages.dag` `dag_translation_rules_node` carries one row, the `fn add` fixture.
-- `token_class_emit_transforms` is `target_model_emit_transforms_empty`.
-- The `emit_row_*` functions have no consumer outside the module.
-- `data m: Int = 1` refuses with `v2.compiler.ingest` `parse_tree_atom_token_class_not_recoverable`.
-- The only declaration round trip,
-  `v2.test.execution.emit_ingest_type_decl_round_trip`, runs on
-  `dag_type_decl_structural_formal_productions` and its own lexer
-  (`dag_type_decl_structural_lex_rules`). That is a second, hand-authored grammar for one
-  language, which is a parallel authority under DESIGN §3.
-
-`gunbc.dag_grammar_fork_census` rosters the root of the problem: two production tables. One is the
-reachable `dag_grammar_root`, which is `GrammarExpr` with choice, repeat, optional and
-nonterminals. The other is the unreachable flat `FormalProduction` token spines, and every
-relation row is grounded on them. The backward machinery in `v2.std.grammar`
-(`grammar_relation_row_backward_selection`, `resolve_emitted_productions`) can only read the
-second table.
-
-## The subject: which Node emit starts from
-
-Emit's input is the **parse-tree Node that ingest's parse produces**. That is the surface Node whose
-production wraps are stamped by `v2.compiler.parse` `parse_wrap_production_captured`. It is not the
-core Node that body lowering produces from it.
-
-The grammar's own `emitted` values are surface atoms (`^dag_surface_fn_decl`, and so on). So
-"one grammar read backward" relates source text to *this* Node. Inverting body lowering is a
-different relation with a different authority, and it is out of scope here (see the open
-questions). The round-trip control is therefore:
-
-    parse(text) = N
-    emit(N) = text'
-    parse(text') = N'
-
-and it asserts `v2.std.node` `content_hash(N) == content_hash(N')`. `content_hash` does not cover
-occurrence identity, so source spans can legitimately differ.
-
-## How emit selects a production: read the stamp, then invert each `GrammarExpr` arm
-
-**Production selection is a lookup, not a search.** Every production capture in the parse tree is
-the Conj `{grammar_production_identity_node_projection: production.emitted,
-grammar_production_captured_node_projection: captured}`. Emit reads the identity edge and looks up
-the one production in `dag_grammar_root` whose `emitted` is that identity. That lookup is total over
-the closed production list. A missing production is the typed refusal below.
-
-There is no shape-guessing at production grain, and no second index. `emitted` atoms are unique
-per production. The implementation checks that once, when it builds the index from the
-`GrammarRoot`, and refuses a duplicate there.
-
-**Within a production, emit walks the `GrammarExpr` and the captured Node together.** Each arm is
-the exact inverse of what its parse arm in `v2.compiler.parse` builds:
-
-| `GrammarExpr` arm | What parse captured | What emit does |
-|---|---|---|
-| `Sequence { left, right }` | Conj `{sequence_left: cap1, sequence_right: cap2}` (`parse_stamp_derived_conj`) | emit `left` over `cap1`, then `right` over `cap2`, and concatenate the token spines |
-| `Repeat { element }` | right-folded Conj spine of `sequence_left`/`sequence_right`, ending in empty Conj (`parse_repeat_captured_node`) | unfold the spine and emit `element` over each item |
-| `Optional { element }` | the element's capture, or `grammar_empty_node()` | empty Conj gives no tokens; otherwise emit `element` |
-| `Choice { left, right }` | the winning arm's capture, untagged | **ordered:** try `left` backward; if it refuses, try `right`; if both refuse, refuse |
-| `Expect { element, reason }` | the element's capture (an Expect is a label, never a cut) | emit `element` |
-| `Nonterminal { production }` | a production wrap | select by stamp as described above, and check the stamp names `production` |
-| `Terminal` / `LiteralTerminal` | an atom, or a literal payload node | emit one token (next section) |
-
-Ordered backward choice mirrors parse's ordered forward choice. If the left arm accepts a shape,
-its spine re-parses through the left arm first.
-
-There is one place where a shape alone could mislead: a `StampClass` atom and a `StampLexeme`
-atom are both childless atoms. An identifier spelled exactly like a token-class symbol could
-therefore satisfy the wrong arm. That is not a case to guess about. The round-trip control is what
-falsifies it. The walk resolves the collision one way: a `StampLexeme` position reads a childless
-atom as its lexeme first.
-
-None of this needs a per-production emit row. The rows ARE the `dag_grammar_root` productions. A
-new production gets emit for free, and a new target language is still rows, not an edit to the
-walk. The walk is generic over `GrammarExpr`, so it belongs in `v2.std.grammar` beside the forward
-reader, not in `extdeps/languages/dag.dag`.
-
-## How each terminal's token class is recovered: from the grammar position, never from the atom
-
-`parse_tree_atom_token_class_not_recoverable` exists because today's reverse path asks the *atom*
-for its class. A `StampLexeme` atom carries the interned lexeme, so its class cannot be read back
-from it. Walking the grammar alongside the tree removes the question. At every terminal, emit
-already holds `Terminal { token_class, stamp }` or `LiteralTerminal { token_class, lexeme }`, so
-the class is a fact of the grammar position.
-
-The **spelling** of the token then comes from one of two places.
-
-**Fixed-text classes**, such as keywords and punctuation, are spelled by the class's
-`TokenRule { pattern: LiteralPattern }` in `dag_lex_rules`. That is the lexer's own row, so there
-is no second spelling table. A `LiteralTerminal` is spelled by its `lexeme`.
-
-**Value-carrying classes** are spelled by `v2.extdeps.languages.dag`
-`dag_emit_class_terminal_spelling`. Each arm is the inverse of the parse-side decoder that #12759 and
-its predecessors stamped. These arms do **not** go into `TargetModel` `token_class_emit_transforms`:
-that map transforms one spelling into another, whereas these arms start from a decoded value. The
-map stays empty for the dag target.
-
-| class | captured Node (parse side) | emit transform |
-|---|---|---|
-| `dag_token_ident` (`StampLexeme`, `StampBinding`) | atom whose identity is the interned lexeme | the interned spelling |
-| `dag_token_int_literal` | `dag_int_literal_node_from_magnitude` payload | the magnitude in decimal, the inverse of `dag_int_literal_node_from_lexeme` |
-| `dag_token_float_literal` | `float_literal_lexeme_field` payload | the stored lexeme, verbatim |
-| `dag_token_string_literal` | `string_literal_value_field`, the decoded value (#12759) | quote-frame the value, and **escape it from the same `dag_string_escapes` rows** the decoder reads; a scalar with no printable row is written `\u{H..H}` |
-| caret symbol | `dag_token_caret` then an ident (`dag_grammar_caret_symbol_expr`) | not a transform: a fixed token, then the ident transform |
-| quoted field key | `dag_grammar_field_init_string_key_expr`'s class-stamped string terminal | not a transform: the string-literal row (the key and the literal are one terminal since #12759) |
-
-For strings, the encoder and the decoder read one table. Decode composed with encode is the
-identity on values. Encode composed with decode is not the identity on spellings, and does not need
-to be: the round trip is on the Node.
-
-**Literal payloads are read through the model's own readers:**
-`dag_int_literal_magnitude_int_from_node`, `dag_string_literal_value_optional`, and
-`dag_float_literal_lexeme_optional`. Lowering uses the same readers. A literal is an `Atom` that
-carries a payload edge, and `v2.std.node_query` `named_child_lookup` searches only `Conj` roots, so
-it cannot be used to read one.
-
-**Token separation.** Emit writes one space between adjacent tokens. This is **not** source-faithful
-layout: `module rt.x` comes back as `module rt . x`. The one exception is layout the grammar
-itself requires. An `AfterLineBreak` row (gunbc#12773) matches only after a line break, so the walk
-yields `GrammarEmitLineBreak` before its element, and the dag spelling writes a newline there.
-A `RefuseOnMatch` row derives no tree, so backward it is an arm that never fits. Whitespace is a
-`TriviaRule`, so this cannot change the Node. Annotations (DESIGN §4c) are erased from the parse
-tree and are not emitted. A target that needs layout is a separate projection.
-
-## Typed refusals
-
-Each refusal is located with `node_locus` at the node being emitted. The generic ones come from
-`v2.std.grammar`; the spelling one comes from the dag model.
-
-**Hard refusals.** These are never retried by an enclosing choice:
-
-- `grammar_emit_production_unknown`: the stamp names no production in the root. This is the
-  "missing emit row" red.
-- `grammar_emit_projection_ambiguous`: a capture carries two projection edges of one name. Parse
-  mints each projection edge once, so this is a malformed tree, not an arm that does not fit.
-
-**Arm mismatches.** An enclosing ordered choice tries its next arm; if no arm fits, the last
-mismatch is the refusal:
-
-- `grammar_emit_production_stamp_absent`: a nonterminal position holds a capture with no
-  production stamp. This is neat-boar-16's condition (3): a production is never guessed.
-- `grammar_emit_nonterminal_stamp_mismatch`: the stamp names a different production than the
-  position expects.
-- `grammar_emit_sequence_shape_mismatch`, `grammar_emit_terminal_not_atom`,
-  `grammar_emit_terminal_class_mismatch`: the capture is not what the arm's parse builds.
-
-**Index refusals.** These refuse the grammar itself:
-
-- `grammar_emit_production_emitted_not_atom`
-- `grammar_emit_production_emitted_duplicate`
-
-**Spelling refusal.** `dag_emit_token_class_untransformable`: a class with neither a fixed lexeme nor
-a value inverse. It is located at the terminal.
-
-The atom-collision case named above (a class atom versus a lexeme atom) is not a separate refusal. A
-`StampLexeme` position reads a childless atom as its lexeme first, and the round-trip control is the
-falsifier.
-
-There is no fallback arm anywhere. A refusal never widens to "emit the atom's spelling" (DESIGN §5).
-
-## The cut
-
-This is one change, per DESIGN §3 on replacement migrations: delete first, then fix forward.
-
-1. **Add** the generic backward walk to `v2.std.grammar` (`grammar_emit_parse_tree`), and the dag
-   spelling to `v2.extdeps.languages.dag` (`dag_emit_parse_tree`). The string encoder shares
-   `dag_string_escapes`.
-2. **Not done here; this is the declared frontier.** `dag_translation_rules_node` still enrolls only
-   the `fn add` row. It serves the core route, which needs the inverse of body lowering before it
-   can read this walk (see "Rulings and declared frontier").
-3. **Delete, in the same change:** the hand-authored declaration grammar. That means
-   `dag_type_decl_structural_formal_productions`,
-   `dag_type_decl_productions_only_translation_rules`, `dag_type_decl_structural_lex_rules`,
-   `dag_type_decl_structural_lex`, `dag_type_decl_structural_target_model`, and their only consumer,
-   `v2.test.execution.emit_ingest_type_decl_round_trip`. Its roster entries in
-   `v2.workflow.floor_grandfathered_roster` and `gunbc.witness.witness_deferral_freeze` go with it.
-
-   **Correction, measured while cutting.** The flat `dag_formal_production_fn_*` table and
-   `v2.compiler.ingest` `parse_atom_frontier_class` are **not** part of this route, so this change
-   does not delete them:
-   - They serve the cross-language forward bridge `parse_tree_to_emitted_node`, which Python and
-     TypeScript also use.
-   - They serve `v2.compiler.body_producer_forward`.
-   - They serve the core-route emit, `compile_dag_source_to_target_text`.
-
-   That is the core -> surface frontier above. They are retired when that item lands, against the
-   roster in `gunbc.dag_grammar_fork_census`, which keeps rostering them until then.
-4. **Replace** `emit_ingest_type_decl_round_trip` with the coverage round trip over the real
-   grammar.
-
-**Controls.** Round trip on the parse-tree Node for each of these fixtures:
-
-- `data m: Int = 1`
-- a fn declaration
-- a record type
-- a coproduct
-- `match`
-- `let`
-- a list
-- a map literal
-- a quoted key
-- string escapes (`\"`, `\\`, `\n`, `\u{e9}`, `\x41`)
-- a caret symbol
-
-Quoted keys add more controls (from gentle-koi-724, for #12740 and #12758):
-
-- **The key's kind follows production identity, not spelling.** `{"Node": true}` must emit quoted,
-  through `^dag_surface_field_init_string_key`, and `{Node: true}` must emit bare. Both are
-  fixtures.
-- **An escaped key round-trips.** `"a\"b"` and a key containing a `\u{..}` scalar re-escape to
-  an equivalent spelling and re-ingest to the identical node.
-- **Two mutants must go red:** emitting the raw lexeme, and emitting a quoted key in bare form.
-- **The tree covered is the surface tree.** This is the pre-elaboration map literal, not resolve's
-  elaborated `map_from_entries(..)`. Quoted keys in record literals still refuse at lowering
-  (#12740's frontier), so they are parse-tree fixtures only.
-
-There is also one red: a root with one production removed must refuse with
-`grammar_emit_production_unknown` at the right locus. Both the reds and the positives run through the
-real `parse_module` route, not a supplied tree. This route is the inhabitance claim.
-
-## Rulings and declared frontier
-
-**Subject (neat-boar-16's ruling).** Emit's subject is the **parse-tree Node**. The control is
-text -> parse tree -> text -> parse tree, and the two trees must be identical. The core Node is not
-the subject.
-
-**A missing stamp refuses.** A tree that lacks the production stamps emit needs is refused, typed
-and located, as `grammar_emit_production_stamp_absent`. Emit never guesses a production from the
-shape.
-
-**Declared frontier: core -> surface.** This emitter is a parse-tree emitter. It is **not** full
-dag emission. To emit a program that was constructed or lowered rather than parsed, emit needs the
-inverse of body lowering: from a core Node back to a production-stamped surface tree, which this
-walk then reads. That inverse belongs to the lowering's own authority and is a separate work item.
-Its named consumer is gen-2 self-host emission: the built CLI emitting a closure (DESIGN §7). Until
-that item lands, nothing on that route may cite this walk as dag emission.
-
-**Open: 02_parse's prepared grammar.** I still need its owner to confirm that the projection-edge
-shapes in the table above are a stable contract.
diff --git a/docs/plans/dag-native-scm-design.md b/docs/plans/dag-native-scm-design.md
deleted file mode 100644
index 807b59f5a9e..00000000000
--- a/docs/plans/dag-native-scm-design.md
+++ /dev/null
@@ -1,548 +0,0 @@
-# A `.dag`-native SCM — model, vocabulary, and first executable slice
-
-DRAFT, design-note-first. **No code lands from this note.** Claims are marked **verified** (read
-out of the live tree), **derived** (a consequence of a verified claim plus an authority doc), or
-**proposed** (a design position awaiting a discriminating witness or an operator ruling).
-
-This note supersedes an earlier draft on the same branch that modelled merge as a three-way diff
-over parsed trees. §9 records what was rejected and why; the scenario corpus from that draft
-survives unchanged in §8.
-
----
-
-## 1. Vocabulary — git's words, git's constraints deliberately not inherited
-
-Operator ruling: **anchor on git's terms** — for anti-forking, not familiarity. Coining a new word
-for a concept that already has an industry-standard one is the nicknaming DESIGN §3 forbids, and
-git's vocabulary is the shared one. New vocabulary must earn its place by naming something git
-genuinely fuses or lacks.
-
-The separating rule: **keep the word for what it *means*; drop what git *does* to implement it.**
-"Commit" means *record a state I can point at later* — that survives. Git's mechanism — a whole-tree
-snapshot fused with one parent, an author and a timestamp — is one realization, not the meaning:
-DESIGN §3's interface/realization split applied to naming.
-
-| term | meaning here |
-|---|---|
-| **object** | immutable language content, content-addressed |
-| **proposal** | requested obligations — what an author asks the program to contain |
-| **branch** | a line of proposals and commits; a grouping label, contributing nothing to identity |
-| **role-requirement integration** | combine proposals into one target commit. Named `merge` until 2026-09-04; renamed because two-commit merge is a materially different contract and one spelling cannot carry both |
-| **commit** | the exact frozen program |
-| **acceptance** | agreement to use a commit — the one new term |
-| **deploy** | make an accepted commit active |
-
-`acceptance` earns its place because git's `commit` fuses three separate questions: *is this program
-valid?*, *have we agreed to use it?*, and *is it what is running?* Merging them back into one word
-would re-create the fusion this model exists to remove.
-
-**Git terms and their disposition.** Almost every row is *refused*: it names a *mechanism* rather
-than something a person wants, and exists to repair a model that loses information. One row is a
-*withdrawal* — a term this note refused on reasoning that turned out to be wrong — carried here and
-marked rather than deleted, so the correction stays attached to the claim it corrects. Each term's
-standing is stated by its `disposition` cell; membership in this table no longer asserts refusal.
-
-| term | disposition | why |
-|---|---|---|
-| `rebase` | refused | "rewrite my work as though it started elsewhere" is a procedure, not a goal; the goal — make my work apply to the current state — happens without it |
-| merge base / common ancestor | **withdrawn 2026-09-04** | It read "requires a total order that need not exist", which is false: a commit DAG supplies a PARTIAL ancestry order, common ancestors are the intersection of two ancestor closures, and best common ancestors are the maximal elements of that intersection. No total order is involved. The concept is a prerequisite of two-commit merge, which this note does not yet model |
-| `HEAD~3`, `HEAD^` | refused | parent arithmetic assumes a single line |
-| force push | refused | acceptances only append; there is nothing to force |
-| index / staging area | refused | an artifact of the working-copy model |
-| `reset --hard` | refused | mutating a pointer |
-| `cherry-pick` | refused | patch transport, which this model does not do |
-| conflict markers | refused | a textual representation of an unresolved choice |
-| `squash` | refused | role-requirement integration already produces one exact commit; squash is a git-export description |
-
-## 2. Comments, formatting, and everything that is not the program
-
-Stated first because it decides what a commit *is*, and because getting it wrong is how a system
-silently loses what people wrote.
-
-**Verified.** `std.source_annotation` already models this: `AnnotationPlacement`,
-`UnboundAnnotationCapture`, `SourceAnnotationDebt`, `SourceAnnotationGraph`,
-`AnnotationAttachmentRefusal`. Comments are captured *data attached to structural subjects*, not
-discarded trivia and not semantic program content.
-
-DESIGN §4c rules the two facts this design needs. Adding, deleting or moving an annotation **cannot
-alter any semantic occurrence identity, semantic graph, resolution result, semantic hash, or
-target-program bytes**; and semantic passes receive the annotation-erased projection while *"source
-authoring, formatting, **SCM**, and annotation lenses consume and preserve the authored wrapper."*
-
-**Derived — two identities, deliberately:**
-
-- **semantic identity** — over the annotation-erased graph. Annotation-invariant *by rule*.
-- **authored identity** — the semantic graph together with its annotation graph. What was written.
-
-Four consequences, all of them features:
-
-1. **A comment-only change is provably a semantic no-op** — new authored identity, identical
-   semantic identity, stated as a fact rather than guessed from bytes.
-2. **Comments never cause semantic conflicts.** Annotations are keyed by their subject, so two
-   people annotating different declarations never interact.
-3. **An annotation collision is its own lower-stakes conflict**, reportable separately from a
-   semantic one.
-4. **Reformatting is free**, and the authored form still round-trips because captures carry the raw
-   `lexeme` — delimiter included — normalized on read, never on capture. That distinction is
-   load-bearing: its own carrier records that a realization stripping the delimiter where another
-   does not makes parse→render→parse either double it or silently change content.
-
-**Comments are eternal carried debt** (operator framing; the type is literally
-`SourceAnnotationDebt`). DESIGN calls plain annotations modeling debt: prose not yet migrated into
-typed carriers, carried forward until someone models it properly. The SCM's obligation is to **carry
-them faithfully without enshrining them** as permanently first-class, so the debt stays payable
-rather than load-bearing.
-
-## 3. The model
-
-**The store is append-only and immutable.** Editing creates another object, never modifies one.
-Objects are content-addressed, so identical content is one object. Nothing in the store ever
-conflicts.
-
-**A program is an act of exclusion, so the store alone is not enough.** The store only grows —
-adding an object never invalidates anything — but choosing one `foo` means not the other. A
-monotonic store cannot produce that non-monotonic fact, so something must *close* a selection and be
-nameable. This is A3 (agreement holds only on what stays stable across time) reaching the design
-directly.
-
-**A commit is that closed thing: one root object identity whose every reachable edge names exact
-content.** No parent list, author, timestamp, message, or branch — those are facts about proposals
-and acceptances, not the program.
-
-**Selection must not stay live after a commit.** A program re-querying the store at use time would
-let later additions retroactively change its meaning. Integration outputs an immutable exact graph, which
-is why the unit of agreement is a commit root rather than a choice function.
-
-Five facts, kept apart:
-
-```
-store        possibility          — every object that exists
-commit       a program            — one exact closed graph
-certificate  validity             — does this program hold together
-acceptance   agreement            — we have agreed to use it
-deploy       now                  — it is what is running
-```
-
-**Identity does not need to survive across revisions, and cannot.** *Verified:*
-`std.occurrence_identity` `occurrence_identity_scope_law` makes `OccurrenceId` unique only inside
-one graph-scoped allocator and forbids filename, span, authored name, structural equality and
-content hash as identity inputs. *Derived:* cross-revision identity could therefore only be minted
-at authoring time and carried in the source — and DESIGN §3's fleet ruling says inferring it from
-content similarity is the heuristic §4 forbids. **It is also unnecessary:** identity's only job in a
-line-based merge is transporting a patch to the right place, and combining proposals transports
-nothing.
-
-**A name identifies a binding role in a context, not a thing.** Renaming changes a binding; the
-value is untouched. So content equality does not imply one program occurrence — one object may sit
-at several positions, sharing storage while independently addressable by path.
-
-**"Latest" is a query, not an identity.** Already ruled here: `extdeps.pin` `pin_selection_note` —
-*execution always resolves an exact identity, because resolving "latest" at execution is
-nondeterminism at the substrate boundary; re-resolution is an explicit action producing a reviewable
-diff.* Pinning a moving reference is no contradiction: resolve it to an exact identity and record
-that it came from a channel. `Pin<Subject>` is already that shape, subject-generic by operator
-ruling, and `Pin<NodeName>` is an instantiation, not a new concept.
-
-## 4. What role-requirement integration is
-
-This section is about combining PROPOSALS into one target commit. It is not about two-commit merge,
-which this note does not model; see the vocabulary table in section 1.
-
-Two proposals combine by taking both. A conflict exists only where one binding is required to hold
-two different objects — a genuine disagreement about what the code should be, never a collision of
-positions.
-
-Where the substrate says an edge is `Named`, recursion is keyed by that name; where `Positional`,
-**order carries meaning** — list elements, match-arm order — and the region is compared whole.
-Refusing there is the safety half of the design: combining positional edits by identity would
-fabricate a sequence nobody wrote, which is precisely what line-based merge does and calls success.
-*Verified:* `v2.std.node` carries `EdgeLabel = Named { name } | Positional` per-edge at every depth,
-and named edges reach deep — `match_arm_pattern`, `binding`, `field`, and a function attaching to
-its parent as `Named { name: fn_name }`.
-
-**One grain — the node.** Depth is not a parameter; it falls out of where the substrate says
-identity is by name versus by order.
-
-## 5. What this model does not claim
-
-**Integrations are not "always safe."** Deep semantic understanding makes conflicts rarer and better
-explained, not absent. Two changes can each be valid alone and interact — a new call to `foo` plus a
-narrowing of `foo`'s contract. Structural combination and **validity** are separate, and the second
-genuinely refuses: a structurally clean rename plus a stale reference is a broken program. The
-honest claim is *far fewer conflicts, each a real question in the user's own vocabulary.*
-
-**The hard part is not removed, only the accidental part.** Two proposals may admit no common
-program, or several materially distinct ones — the same compatibility problem that combining
-independently authored work has always addressed. Gone is everything around it: mutable files, patch transport, branch topology, global
-history, working-tree alignment, rebasing, and cloning.
-
-**Identity is currently weaker than the model needs.** *Verified:* `v2.std.node` `Hash` is
-`Fnv1a64Structural` — 64-bit, non-cryptographic. A 64-bit non-cryptographic digest is a **locator,
-not a durable intersubjective identity**, and adding a host builtin is closed because DESIGN freezes
-the v1 seed's growth surfaces. **Declared rung:** the first slice uses the available digest and
-states this limitation rather than implying cross-party agreement it cannot support.
-
-**Corrected 2026-09-21 — the dissolve-on condition has been half met, and the half that remains is a
-different one.** This paragraph said "no SHA-256 *computation* exists in `.dag`
-(`std.content_hash` `sha256_hex_digest` and `extdeps.crypto.hash` `sha256_digest` validate hex; they
-do not hash bytes)". That was true when written. `extdeps.crypto.sha2` now computes SHA-256 in the
-substrate (`sha256`, `sha256_hex`, FIPS 180-4), witnessed by `test.claim.sha256_fips_witness` — and
-the witness discriminates rather than restating the type, because `sha2` routes every 32-bit
-operation through `std.bitwise`, whose `word32_add` wraps by comparison against `word32_modulus` so no value transits above 2^32-1, and the
-interpreter's unbounded-`Int` evaluation yields the same residues and a wrong wrap changes the
-digest.
-
-What has **not** happened is the migration: `extdeps.crypto.sha2`'s only importers are
-`extdeps.crypto.nist_p256` and its own witness. `std.content_hash` does not import it, so
-`v2.std.node` `Hash` and `std.fabric_storage`'s object refs still mint through
-`content_hash_of_value`. **Revised dissolve-on:** `v2.std.node` `Hash` minted from a cryptographic
-family. `std.fabric_storage`'s object refs are being moved onto the pure kernel in gunbc#11996 —
-the shell-out alternative was refused there for a structural reason worth recording, since it is the
-one this note would otherwise invite: `fabric_object_preimage` produces bytes **in memory**, so a
-shell transport over a file path means a temp-file write per object, which manufactures the custody
-gap (hash one file, store another) that verification exists to close. `v2.std.node` is the half that
-remains, and it is gated on native emission of the `sha2` closure — blocked by
-`gunbc.recurring_failure_mode` `bounded_natural_arithmetic_evaluated_as_unbounded_int`, whose
-prerequisite is `MachineWidth<N>` reified as a value. Both halves are owned by the lane holding
-`#11819`; open question 2 below is narrowed accordingly rather than closed.
-
-## 6. Confidentiality
-
-Secrets are the forcing function for redaction, and redaction is where a content-addressed history
-either has an answer or admits it does not.
-
-**Git's answer is a non-answer**, and that is the design input. A secret in git history requires
-rewriting every subsequent commit; every hash changes; every clone, fork and open PR diverges. On a
-public repository this is *ineffective*, not merely expensive — the objects are already distributed.
-Practitioners actually "rotate the credential and assume the bytes are permanently public." We must
-not build a better version of that theater.
-
-**Five independent facts git fuses into one.** Prevention, current-state retraction,
-audience-history retraction, credential invalidation, and bounded erasure are separate, and the
-distinction between the two retractions is load-bearing:
-
-- **Prevention** — bytes never reach the public store. *The only operation that preserves
-  confidentiality.*
-- **Current-state retraction** — the head no longer contains the material. **Not enough**: a clone
-  replaying from the original root still recovers it.
-- **Audience-history retraction** — new readers begin from a sanitized anchor and never receive the
-  material. This is what people mean by redaction, and a different fact from the above.
-- **Invalidation** — rotate the credential so leaked bytes are worthless. **Already modeled**:
-  `gunbc.auth.secret_rotation`, with exactly-once walls, receipt-backed retirement, and no stored
-  payload digest.
-- **Erasure** — bytes unrecoverable. Claimable only inside a closed sanitization scope covering
-  every key, wrap, backup, cache, derivative, index and recovery path. Never "delete one key."
-
-**Derived rule:** on a committed secret, SCM performs retraction, the rotation kernel performs
-invalidation, and erasure is claimable only in the private realm. **The SCM must never report
-retraction as erasure.** Once disclosure escapes a controlled scope, `UncontrolledCopiesMayRemain` is
-a **terminal standing** and **no global-erasure constructor exists** — the impossible claim is made
-unwritable rather than merely discouraged.
-
-Two consequences easy to get wrong in opposite directions. Invalidation is **not** established by
-the secret manager disabling a version: the service may still accept the leaked token, so
-invalidation needs a subject-specific negative authentication probe. And a rewrite lacking a
-complete sanitization receipt is `PrivateHistoryReanchored`, **not** erased.
-
-**Where the wall sits.** Integration-time or CI-time checking is structurally incapable of confidentiality
-— the deleted Stage-0 placement gate established exactly this: a required check could refuse `main`,
-but pushed objects had already reached public storage. The chronology must be private capture →
-private integration and admission → derive an audience-authorized projection → serialize → write public
-storage. The public writer accepts only a projection minted by the authoritative private context,
-never an arbitrary `Node`, blob or patch. **Corollary:** a public PR branch cannot safely carry
-secret bytes on the theory that squash-landing removes them. The surface is wider than file content:
-a secret in a commit message, path, diagnostic, workflow log, or projection metadata is the same
-disclosure.
-
-**Retraction without rewriting.** Where a commit is *accepted parent plus sparse transformation*,
-retraction can be an ordinary **appended transformation** — no existing identity changes, no
-downstream clone is invalidated. **This holds only if public history is an audience projection
-rather than a replayable copy of private transitions**; otherwise replay from an early checkpoint
-reconstructs the secret on the way to the head, achieving current-state retraction only. The
-resolution is an **audience-specific projection epoch with a sanitized anchor**: re-anchor the
-*public projection*, never the authoritative history.
-
-Three constraints on that epoch, each of which an earlier draft got wrong by vagueness. The
-sanitized epoch must have **no public predecessor relation** to the contaminated one — a tombstone
-naming the old root, path, or incident reason is itself the leak, so the mapping is retained
-privately or not at all. The old epoch must be **retired from authoritative service**: a clean head
-with the old refs still advertised is not retraction. And **hiding a ref is not retraction** if
-direct object retrieval still serves the bytes. *(Proposed — the least settled part of this note.)*
-
-**No confidentiality receipt carries secret bytes or a secret-derived digest**, following the
-rotation kernel's existing rule. Receipts retain opaque incident identity, subject references,
-non-secret-derived transition identities, verification verdicts, audience standings, and bounded
-sanitization evidence.
-
-**Diagnostics are an information-flow surface.** If an old-root lookup answers "retracted" where a
-nonexistent root answers "unknown", that difference is an existence oracle; where existence is
-confidential the unauthorized responses must be indistinguishable. Over-redaction is the paired
-failure — an authorized responder must still receive located detail — so both directions need
-controls.
-
-**At the user boundary:** "keep the revoked secret" is never offered as a `ChoiceRequired`. It is a
-hard `CouldNotLand`.
-
-**`.env` does not belong in the graph.** Secret *values* live in a secret store; the graph holds
-`SecretRef` nodes, schema, and required binding identities, and `.env` becomes a local
-materialization, not source-control authority. A marker inside the file cannot self-authorize:
-removing `secret=true` must be an authorized policy change, not an ordinary content edit.
-
-**Node-grain withholding survives only at a real interface/realization boundary**, consistent with
-the existing refusal of per-statement holes. Public signature with encrypted body: allowed. Public
-body with one expression silently missing: refused.
-
-**Erasure is not strictly harder than git's** — git is already a Merkle DAG, and finer grain can
-help: a secret subtree can carry its own key instead of requiring a whole file's destruction. But
-*accounting* is harder, and two hazards are specific to this design: never publish the private
-canonical root hash as the public root, and **never deduplicate secret plaintext across audience
-realms — cross-audience content-address equality is an oracle.**
-
-## 7. `NATIVE-COMMIT-0` — the first executable slice
-
-**Honest feasibility ruling first.** An executable slice exists without the parked authoring-capture
-surface, but it **cannot honestly integrate arbitrary concurrent edits to existing `.dag` files**.
-Without capture, nothing can tell from two file endpoints which proposal, deletion, rename or frame
-the author intended; claiming otherwise reconstructs patch inference under new vocabulary. So the
-first slice integrates **explicitly authored proposals**, and says so.
-
-Three operations. No base, ancestor, parent, branch pointer, working copy, or patch. **This is the
-shipped signature, corrected 2026-08-21 against the operation then at `dag/gunbc/scm/merge.dag` as
-merged in #8719, now `gunbc.scm.role_requirement_integration`** — the
-draft below it specified a two-proposal call and a `ChoiceRequired` arm, neither of which exists,
-and a stale authority describing an operation nobody can invoke is the premise contamination DESIGN
-documents against its own CI paragraph:
-
-```
-integrate_role_requirements(store, target, target_dependencies, proposals)
-  -> RoleRequirementsIntegrated { store, commit, roles }
-   | RoleRequirementsContested { role, alternatives }
-   | RoleRequirementIntegrationRefused { cause }
-accept(store, commit, authority, contract) -> appended; never changes the commit
-checkout(store, commit) -> CheckedOut { program } | CheckoutRefused { cause }
-```
-
-**Why the signature grew a target and lost a proposal count** (operator direction, 2026-08-20). The
-two-proposal form had nothing to preserve *from*, so all it could do was union bindings — neither
-the literal closed-scope reading nor a dependency model — and it ships a program referencing a
-deleted node when one proposal adds `k` depending on `f` while the other deletes `f`. The target
-supplies every fact outside the implication frontier, and **silence means preserve it**. Proposals
-became a list because a contest is a property of the whole population, not a pair.
-
-**Why the outcome arms are named for less than they conclude.** `RoleRequirementIntegrationRefused` rather than
-`CouldNotLand`: the engine cannot establish terminality — an unsupported dependency kind may be
-unmodelled implementation, a missing target root an incomplete fetch. `RoleRequirementsContested` rather
-than `ChoiceRequired`: this layer establishes that distinct alternatives exist; that a *user* must
-choose requires proving they survive the admitted equivalence quotient, that the candidate
-population is closed, and that no further machine work resolves them — none of which lives here.
-**`RoleRequirementsContested` is complete over the proposal population supplied to that call and proves
-nothing about global candidate-space closure.** That boundary is held by this paragraph and the type
-name, not structurally; the landing seam is where it becomes structural.
-
-A proposal is a set of authored requirements — `RequireBinding { role, value }` or
-`RequireBindingAbsent { role }` — meaning *the resulting program must contain this exact value at
-this named binding*, or *must not bind this role at all*. Absence is authored, not implied, because
-silence already means preserve: a delete by omission would read as "leave it alone", the inversion
-of the request. Both sides normalize to a requested state (`DesiredRoleValue`) before any contest is
-decided, so identical authorings are **agreement**, not a question with identical alternatives.
-Distinct bindings combine by construction; two different requested states at one binding produce
-`RoleRequirementsContested` carrying **every** distinct alternative — accumulated over the whole
-population so arrival order cannot decide which evidence survives, and never latest-wins,
-first-wins, or branch-priority-wins.
-
-`checkout` follows exact object links from the commit root and consults **nothing else** — not
-names, branches, proposals, acceptances, or the live store beyond the identities it was given.
-
-**Storage:** objects keyed by identity, plus append-only acceptances. Canonical encoding excludes
-occurrence provenance, sorts named edges, retains positional order, and tags constructors distinctly.
-In-memory first; persistence, packing, networking and collection are separate realizations
-deliberately kept out of the semantic slice.
-
-**Witnesses**, each with a deliberately-wrong control so that a passing suite means something:
-
-| claim | witness | wrong control that must fail |
-|---|---|---|
-| a later object cannot change an agreed program | commit, accept, add a second object at the same name, re-checkout | a checkout that queries live names |
-| a commit rebuilds from its own closure | discard proposals, branches, acceptances and indexes; checkout from the root alone | — |
-| a missing object refuses | remove one reachable object, re-checkout | any fallback substitution |
-| proposals combine without node identity | remint every occurrence id, re-integrate | an integration requiring matching occurrence ids |
-| conflicting bindings ask rather than guess | same name, different objects | any winner rule |
-| arrival order is not authority | integrate (a,b) and (b,a) | — |
-| integration does not imply agreement | integrate without accept | — |
-
-**Deliberate non-goals:** no proposal inference from file edits, no capture, no diffing, no
-deletion/rename/move, no repository-wide candidate search, no general constraint solving, no
-positional-sequence integration, no git import or export, no `GIT-PLUMBING-0` dependency, no refs, no
-compare-and-swap, no cross-process persistence, no deploy, no confidentiality, and **no merging of
-this repository's live concurrent edits.**
-
-**Known scope limit, stated because it affects what the slice demonstrates.** Proposals are keyed by
-top-level binding, so two proposals touching one binding differently ask a question even when they
-changed unrelated sub-nodes. **The headline win — two people editing different functions in one
-module combining cleanly — is the *next* slice**, which recurses §4's named-edge rule. This slice
-proves the foundation: content-addressed objects, stability under growth, exact reconstruction, and
-combination without identity.
-
-**Dogfood disposition:** a small controlled subject first. Making this repository's concurrent edits
-the first consumer would fuse a model proof with unrelated frontend and performance work.
-
-**Direction after `NATIVE-COMMIT-0`, operator ruling 2026-08-21: a CLI vertical before the depth
-recursion**, reversing the "headline win is the next slice" ordering above. The reason is DESIGN
-§5's specification-without-execution trap, not a changed view of which slice is more valuable.
-Nothing has ever *consumed* this kernel: the claims declared in `test.claim.scm_role_requirement_integration_witness` are
-assertions **about** it, authored alongside it, and a witness suite is not a consumer. A CLI is the
-first artifact that uses the store, checkout, identity and role-requirement integration together under conditions nobody
-authored to make them pass.
-
-The ordering is safe because **depth changes how `integrate_role_requirements` combines, not how
-`add` authors**. A user
-adds a module either way; whether integration recurses into it is orthogonal, so the command surface built
-now survives the recursion landing later.
-
-The known cost, designed for rather than discovered: a CLI makes the top-level-binding limitation
-*user-visible*, since the first thing anyone tries is editing two functions in one module — which
-today asks a question instead of combining. That refusal must say exactly that, in those terms,
-rather than reading as a defect.
-
-## 8. Scenario corpus (retained)
-
-No role-requirement integration kernel should be built without these. Each is a RED unless marked
-otherwise.
-
-**Structural integration — with measured coverage as of 2026-08-21 (#8719 merged).** The corpus
-opens "no integration kernel should be built without these", and a kernel was built, so this states
-which rows it
-actually answers. **4 of 13 were covered when that join was run on 2026-08-21**; see the
-measurement note below the table for why that figure has not been re-derived since. The `witness`
-column names the claim, which now resolves in
-`test.claim.scm_role_requirement_integration_witness`; the `blocked on` column says what would close each gap, because
-"uncovered" collapses three situations — a gap the current grain could close today, a gap needing
-the sub-node recursion, and a gap needing vocabulary the model does not yet have.
-
-| scenario | required result | covered | witness / blocked on |
-|---|---|---|---|
-| target changes an untouched named node | preserved, no conflict | **yes** | `an_independent_sibling_is_preserved_exactly`, `an_empty_proposal_set_preserves_the_target` — preserved at *identity* grain, so it is object reuse rather than a recomputed equal |
-| proposal edits one named child, target edits another | both preserved | no | **sub-node recursion.** This is the headline win; the kernel is top-level-binding keyed and cannot express it |
-| proposal deletes a subtree, target edits a descendant | conflict | no | **sub-node recursion.** `dependent_add_and_delete_refuses` is the role-grain analogue — delete `f` while `k` requires it — and is *not* this scenario |
-| concurrent same-name add, same kind, different children | conflict | **yes** | `two_distinct_requests_for_one_role_are_contested` — different children give a different content hash, hence a distinct `DesiredRoleValue` |
-| one side changes node kind, other edits a child | conflict | no | **sub-node recursion** |
-| both sides produce an identical kind-changed subtree | clean | **yes**, degenerately | `the_same_request_authored_twice_is_not_a_contest` — identical results agree at top-level grain; the sub-node path is untested |
-| unchanged-body rename | unique relocation candidate | no | **no rename vocabulary.** Neither `Requirement` nor the outcome can express relocation |
-| rename versus edit under the old name | conflict; the edit is not lost | no | **no rename vocabulary** |
-| two sides move one subtree to different parents | conflict, never duplicated | no | **no move vocabulary** |
-| duplicate named siblings in any input | input refusal | no | **closable at the current grain.** Measured 2026-08-21: nothing in `gunbc.scm.*` or `v2.std.node` refuses a node carrying two children with one name. The nearest live behaviour is content-hash canonicalization *sorting* named edges, which orders duplicates rather than refusing them. This is the one structural gap that needs no new grain and no new vocabulary |
-| two different positional appends | conflict or explicit order choice | no | **positional-sequence integration**, an explicit §7 non-goal for this slice |
-| distinct positional ordinals edited without shape change | both preserved | no | **positional-sequence integration** |
-| only one side changed a node | **preserved — the §6 asymmetry regression control** | **yes** | `an_independent_sibling_is_preserved_exactly` |
-
-**What the partition says about the next slice.** Four gaps are one job — the sub-node recursion of
-§4's named-edge rule. Three are a second job needing rename/move vocabulary the model lacks. Two are
-the positional-sequence-integration non-goal. **One — duplicate named siblings — is closable now**: the only
-structural scenario waiting on neither depth nor new vocabulary, hence the cheapest real coverage
-available.
-
-**Coverage claims about this table must be measured, not recalled.** The `4 of 13` above was
-measured on 2026-08-21 by joining, one row at a time, the claims that the witness module declared
-ON THAT DATE — when it was `test.claim.scm_merge_witness` and held a different population. An
-earlier estimate from reading was "roughly five" — close enough to feel safe, wrong enough to
-mis-scope the next slice.
-
-**That number is a historical result and is NOT a current-completeness claim.** Naming today's
-module does not re-run an August join, so this paragraph deliberately does not cite the renamed
-module as the measurement's source: a citation that silently re-points at a changed population
-would make a dated receipt look re-derived when nothing re-derived it. The 13-row table below is
-the current authority on WHICH scenarios exist; what is missing is an executable instrument that
-re-joins today's claims against those rows, and until one exists no row here may be described as
-covered on the strength of the August figure.
-
-**Admission and capture**
-
-| scenario | required result |
-|---|---|
-| structurally clean rename plus stale reference | semantic admission refuses |
-| occurrence ids collide numerically across allocator scopes | result reminted or remapped |
-| comment or annotation absent from `Node` capture | opaque residue or capture refusal, never silent loss |
-
-**Confidentiality.** Every refusal needs a nearby positive control, so that "always refuse" cannot
-satisfy the suite.
-
-| scenario | required result |
-|---|---|
-| raw payload reaches the public writer before policy evaluation | writer invocation count stays zero; `PublicationPrevented` |
-| publication authority unavailable | refuse before write; never classify as clean |
-| secret inside opaque/unparsed file residue | capture-fidelity refusal before serialization |
-| secret in commit message, path, diagnostic, log, or projection metadata | refuse or redact; no public object carries it |
-| bytes already public but lifecycle reports `PublicationPrevented` | impossible state |
-| append a retraction, then clone by replaying from the original root | secret recovered — only `CurrentStateRetracted`, never audience retraction |
-| sanitized epoch names the contaminated predecessor | commitment/existence leak |
-| old ref hidden but direct object retrieval still serves the bytes | retraction incomplete |
-| clean head while the old epoch is still advertised | retraction incomplete |
-| any receipt stores a payload digest | type uninhabitable |
-| one backup, cache, wrap, derivative or recovery path unobserved | `ErasureUnestablished` |
-| rewrite succeeds without a sanitization receipt | `PrivateHistoryReanchored`, not erased |
-| private realm erased after public exposure | private erasure **plus** `UncontrolledCopiesMayRemain` |
-| secret-manager version disabled but the service still accepts the token | not invalidated |
-| unauthorized diagnostic names retracted path, secret kind, or incident time | audience-projection refusal |
-| authorized responder denied located detail | over-redaction control |
-| retracted-vs-nonexistent lookups distinguishable to an unauthorized reader | existence oracle |
-| public graph retains a dangling reference to retracted material | public projection refuses |
-| proposal from a revoked epoch persisted publicly before inspection | ingress wall |
-| proposal independent of revoked material blanket-refused | recovery-expectation failure |
-| proposal relying on revoked material lands via ordinary stale-parent retry | admission failure |
-| "keep the revoked secret" offered as a choice | user-boundary failure — must be `CouldNotLand` |
-| retraction reported to a user as erasure | never |
-
-## 9. What was rejected, and why
-
-Kept because the reasoning is the most reusable part of this note.
-
-**Three-way merge over parsed trees.** The first draft modelled merge as `capture(base, proposal)`
-producing a patch keyed by declaration name. It works and beats line-based merge, but it is
-diff-and-patch with a semantic key — reconstructing intent from endpoints because the information
-was destroyed before it was seen. It also inherits a base, and through the base a timeline.
-
-**Cross-revision node identity.** Pursued for most of a day as the way to make renames carry. Closed
-by `occurrence_identity_scope_law` and, more importantly, unnecessary: identity exists to transport
-patches.
-
-**`std.change` `keyed_three_way_fold` as the integration kernel.** *Verified:* its leaf verdict returns
-`KeyedConflict` when only one side changed a value — correct for reconciliation, where `desired` is
-authority, and wrong for integration, where the sides are peers. The traversal is shared with the
-fleet-reconcile spine; the verdict is not.
-
-**The seven inherited assumptions.** Text as storage, commit-as-whole-tree-snapshot, one global
-timeline, branch-as-mutable-pointer, merge-as-invoked-event, the working copy, and the repository as
-a unit. Three are simply wrong here. Four contain a real requirement in a git costume: a state
-commitment is load-bearing though the snapshot is not; arbitration is real at a unique effectful
-target though compare-and-swap is not fundamental to content; a sparse working *context* is real
-though a materialized tree is not; and authority domain, confidentiality realm, retention scope and
-trust policy are real boundaries that must not be re-fused into a "repository" type.
-
-**The existing P1 kernel.** `gunbc.source_integration_proof_kernel` is built around an
-`accepted_parent` and a before/after delta — the mutation-and-parent assumptions this model rejects.
-*Proposed:* freeze it as quarry rather than extend it. This touches an active roadmap node and is an
-operator decision, not this note's.
-
-## 10. Open questions
-
-1. **Authoring capture.** The largest fork, and the reason §7 is scoped as it is. Until an authoring
-   surface records what an author *did*, proposals must be stated explicitly rather than inferred.
-2. **Durable identity** (§5) — the declared rung. **Narrowed 2026-09-21:** a computing
-   cryptographic digest now exists (`extdeps.crypto.sha2`); what is missing is a consumed path from
-   it to `v2.std.node` `Hash`, which is gated on native emission of that closure.
-   `std.fabric_storage` is being migrated in gunbc#11996; `v2.std.node` is the remaining half.
-   See §5.
-3. **Recursion into named edges** — the next slice, and the one that demonstrates the differentiator.
-4. **Retraction epochs** (§6) — the weakest claim in the note.
-5. **Positional append** — whether two appends commute. Special-casing risks re-importing the
-   line-merge heuristic through the back door.
-6. **Alpha-renaming neutrality** — may hold only for non-exported, non-shadowing names, since an
-   exported name is an external interface.
-
-## Dissolution trigger (DESIGN §6)
-
-This note dissolves into the carriers it names when an integration kernel and a confidentiality
-lifecycle
-land. Until then it is evidence about a model, never authority over one. The §8 corpus outlives it:
-those rows re-enroll against whatever kernel lands, per DESIGN §4b's rule that discriminating
-evidence survives the machinery that prompted it.
diff --git a/docs/plans/declaration-body-resolution-provider.md b/docs/plans/declaration-body-resolution-provider.md
deleted file mode 100644
index 53f1038a641..00000000000
--- a/docs/plans/declaration-body-resolution-provider.md
+++ /dev/null
@@ -1,201 +0,0 @@
-# Declaration-body types: one resolution per ingest, produced on demand
-
-Work item adhoc-603dcdcb-f4b (royal-stag-371). Plan only; no code lands under this document until
-quiet-gull-780 and neat-boar-16 clear it. Rulings it builds to: quiet-gull-780 (demand-driven, one
-resolution, not eager) and neat-boar-16 (conditions a, b and c, stated in §5).
-
-## 1. The defect, re-derived
-
-The brief assumed field and payload type positions reach resolve as unlowered shells. On main that
-is no longer true. `v2.compiler.body_lowering_fold` already lowers record fields
-(`body_lower_field_decl_edge_optional`), positional payloads (`body_lower_positional_payload`) and
-alias right-hand sides (`body_lower_alias_rhs_optional`) through `body_lower_type_expr_lowered_optional`,
-and #12629 adds the where-head. So `gunbc.recurring_failure_mode`
-`declaration_body_type_shell_preserved_unresolved` overstates its frontier.
-
-The earliest unjustified boundary is one link later. `v2.compiler.infer` `infer_projection_receiver`
-(on the field-projection lane, #12506) reads the receiver's declaration from
-`ResolvedTree.symbol_index`. That index holds declarations AS AUTHORED: it is built by
-`v2.compiler.name_resolve` `resolution_context` from normalized roots, before any resolve. So
-`artifact.tree` is typed as the bare atom `ParseTree`, while a parameter annotated `ParseTree`
-carries the resolved reference. The match-arm mismatch that calm-pike-507 measured on #12641
-follows directly.
-
-#12629's `ResolvedTree.resolved_declarations` cannot repair it. `resolved_declarations_of(root)`
-folds the SUBJECT module's declarations only, and the real seven reads `v2.compiler.parse`
-`ParseArtifact.tree` from another module. On the native lane that declaring module often has no
-resolve result at all. The seed main (`v1.compiler.emit_rust`, the native driver loop) resolves,
-infers and evaluates one universe member at a time, in universe order rather than import order, and
-the universe is test-bearing modules only.
-
-Why a type position needs its DECLARING module: the reference resolves in that module's namespace
-(its import bindings and origins). `v2.compiler.name_resolve` `namespace_for_subject_root` builds
-that namespace per subject, lazily, every time the subject is resolved. It is carried nowhere.
-
-## 2. The construction
-
-Two produced values, both scoped to ONE INGEST and keyed by declaration identity, both on the
-existing per-ingest carrier `v2.compiler.name_resolve` `ResolutionContext` (#11401 R1: one context
-per native ingest, built in `v2.compiler.compile`).
-
-**P1. The module namespace provider.**
-- Identity: the module's `QualifiedName`, the key `ValidatedModuleRoots.by_name` already uses.
-- Value: the admitted `Namespace` that `namespace_for_subject_root` computes today.
-- Scope and retention: one ingest, meaning every module the native ingest read into the closure
-  (not only universe members). Released with the context.
-- Production: on first demand, by either consumer (the module's own resolve, or a declaration-body
-  resolution in P2). Both read the same stored value.
-- Refusal: a module outside the ingested closure refuses at the provider with a typed, located
-  diagnostic. There is no per-subject rebuild and no fallback.
-- `namespace_for_subject_root` stops being a builder that callers invoke and becomes the provider's
-  producer. It has exactly one call site, the provider's miss arm.
-
-**P2. The resolved declaration-body provider.**
-- Identity: `std.decl_ref` `DeclarationRef`, the identity `v2.compiler.resolve`
-  `resolved_reference_node` already writes into resolved trees.
-- Subjects: every declaration whose TYPE POSITIONS a later stage reads -- type declarations
-  (record fields, variant payloads, alias right-hand sides, where-heads) AND function signatures
-  (parameter and return types), because infer reads a callee's Arrow across modules too.
-- Value: the declaration's body with every type position resolved in its declaring module's P1
-  namespace, by the same `resolve_node_walk` (no second resolver).
-- Scope and retention: one ingest, beside P1.
-- Production: on first demand. A module's own resolve DEMANDS its own type declarations and grafts
-  the provided bodies instead of walking them, so no type position is ever resolved twice. After
-  the walk, the module's resolve demands the transitive closure of declarations its resolved tree
-  references in type positions, following resolved bodies (`ParseArtifact` then `ParseTree`, and so
-  on).
-- Refusal: a reference whose declaring module is outside the ingest refuses at P1, and so does a
-  declaration P1's namespace does not hold.
-
-**P2 mechanism: how "one resolution" and "the module grafts" are realized.**
-- Subject grain: one top-level declaration, either a type declaration or a function SIGNATURE (the
-  Arrow's parameter and return types; never a function body, which is not a declaration type).
-  Identity: `DeclarationRef` (declaring module, declaration name).
-- Production: ONE WALK OF THE DECLARING MODULE IN A DECLARATION-TYPES-ONLY SELECTION. The walker is
-  the existing `resolve_node_walk` over the module's validated normalized root and its P1 namespace,
-  and `ResolveContext` gains a selection: `WholeModule` or `DeclarationTypesOnly`. Under the second,
-  value bodies are carried unwalked: an Arrow's named body edges and a `data` declaration's value.
-  Every type position is walked exactly as the module's own walk would walk it, so each declaration
-  gets the scope, position and `under_module_root` the full walk would give it BY CONSTRUCTION. The
-  spine descent is not replicated by hand. Production grain is the module, because one selective walk
-  covers all its declarations. Storage and snapshot grain is the declaration: entries are cut from
-  that walk's resolved root, keyed by `DeclarationRef`. A refusal in a declaration type is stored as
-  that declaration's outcome, and the grafting module surfaces it, located.
-- Graft: before walking, a module's own resolve demands every type declaration and signature it
-  declares from P2. The walk then carries a READ-ONLY map from occurrence id to provided node in
-  `ResolveContext`, and at such a node it returns the stored node instead of descending. The walk
-  itself stays pure; only the pre-walk demand threads the context.
-- Snapshot: after the walk, the module's resolve demands the transitive closure of declarations its
-  resolved tree references in type positions, and `ResolvedTree` carries that set as a projection of
-  the provider's values (C10).
-
-**Every loop over modules threads the context in PR2.** In PR1 a module's namespace is demanded only
-by its own resolve, so two loops drop the returned context at no cost: `v2.compiler.compile`
-`native_demand_execute`, the demand-engine drain that replaced the seed main's lane loop in #12401,
-and `gunbc.namespace_xl2_rehearsal_census` `xl2_observe_module`. Once PR2 adds cross-module
-declaration demands, a dropped context re-produces what another module already produced. So PR2
-carries the context on `NativeDemandRun` and through that census fold.
-
-**Sequencing (quiet-gull-780 decision A, 2026-09-30).** #12629, #12407, #12506 and smart-newt-725's PR
-land first. PR2 then cuts over on main in one commit: every reader switch plus the deletion. P2 is
-built meanwhile on a branch off PR1, not opened for merge, and never merges without its production
-reader switch in the same change. Before cutting, the reader census is re-taken on main at identity
-grain, because each of the four adds readers of per-module `resolved_declarations`. If one stalls
-more than a day, quiet-gull-780 decides whether its reader is pulled into PR2.
-
-**Purity: how "at most once" is realized in a pure substrate.** A provider cannot mutate. The
-context is threaded as a value: every resolve returns `(ResolvedTree, ResolutionContext)`, and the
-driver loop carries the returned context into the next module. The native driver loop is the seed
-main rendered by `v1.compiler.emit_rust`; that template changes so the module loop binds the
-context it gets back. That is a v1 change admitted under `gunbc.v1_maintenance_standing` purpose
-admission, because it serves the v2 native route. Inserting under a key that is already present
-refuses (`resolve_provider_entry_built_twice`), so a double build is a typed error, never a silent
-overwrite.
-
-**Infer reads a snapshot, not the provider.** `ResolvedTree` carries the P2 bodies demanded for this
-module (the closure computed above). Infer stays pure and single-argument. A lookup outside that
-snapshot refuses as `infer_declaration_outside_resolved_closure`; it never widens to `symbol_index`.
-
-## 3. The PRs (stacked)
-
-**PR1: namespace provider (P1), replacing the lazy per-subject build.** CLEARED (quiet-gull-780, 2026-09-30) to land alone as one motion: the provider replaces the lazy build, the lazy build is deleted in the same PR, and no reader can reach both. Condition (a) then governs PR2. The v1 `emit_rust` main-loop change is admitted under v1 purpose admission because it serves the v2 self-host. A root cut in one motion: after
-it, "what is module X's namespace" has one producer and every caller reads it. Context threading
-lands here, through `native_lane_module_resolution`, `native_test_resolve_module` and its
-`_walk`, the seed main template and the stage0 mirror, `v2.compiler.compile`'s single-subject
-route, and the test harnesses. Condition (a): whether PR1 may land alone, as a self-contained
-replacement with no two structures, or must fold into PR2, is neat-boar-16's call. Folding it in is
-mechanical.
-
-**PR2: declaration-body provider (P2) and the reader cut, together.** P2 lands; resolve grafts P2
-bodies; four infer readers move to the snapshot in the same commit: `infer_projection_receiver`
-(field projection), `refinement_declaration` (#12407, per wise-bat-862), and
-`infer_declaration_reference_facts`'s callee-Arrow read (#12506, found by calm-pike-507: it reads
-`symbol_index_lookup` and gets unresolved atoms for the seven's cross-module
-`parse_module_prepared(...)` call; its Arrow feeds `infer_application_callee_arrow_with_facts` and
-`infer_arrow_declared_return_type`), and `infer_match_coproduct_of_type` with
-`infer_binding_type_in_scope` (#12641, calm-pike-507: variant payload and field types for match
-binders; type parameters are still substituted from use-site arguments, over the resolved body).
-A fifth consumer moves in the same cut (quiet-gull-780, 2026-09-30): smart-newt-725's
-record-construct field typing. It reads #12629's per-module `ResolvedTree.resolved_declarations` for
-same-module records, so it must move in the commit that deletes that field; its cross-module
-population is what P2 adds. smart-newt-725 names this PR as its trigger. A sixth consumer (quiet-gull-780, 2026-09-30): quick-hawk-799's gunbc#12809, a v2 `String`
-literal lowered through the unfold. Its judge sees `declared = Ref(q.String)`, an imported
-declaration, so it needs `q.String`'s resolved body, which #12629's root-only index lacks. It
-stays draft until this PR lands. What dissolves in this
-commit is #12629's `ResolvedTree.resolved_declarations` with `resolved_declarations_of`; no reader
-is left on it.
-All of these took declaration types off an authored or subject-local node; after PR2 none of them can
-reach it. Branch: `session/royal-stag-371-pr2-declaration-bodies`. calm-pike-507 stacks the return-type derivation on this branch. `ResolvedTree.resolved_declarations` and `resolved_declarations_of` (#12629) are deleted
-in the same commit. The RFM row is retired, and its red stays enrolled.
-
-**PR3 (stacked on PR2): call-return derivation** (scope added by quiet-gull-780 when calm-pike-507's
-node closed with #12641 merged into #12506's branch). `infer_arrow_declared_return_type` derives a
-declared corpus return type beyond kernel and `Bool`, from the resolved callee Arrow PR2 hands
-`infer_declaration_reference_facts`. As a result the seven's `parse_module_prepared(...)` is typed as
-`Outcome<ParseArtifact>`. Proof: calm-pike-507's seven's-frontier claim in
-`v2.test.claim.match_binder.match_binder_typing`
-(`infer_match_scrutinee_type_underived` on that call shape) flips to a typed binder (C12). Concretely,
-`mbt_the_sevens_call_scrutinee_is_a_counted_frontier_holds` goes red and is replaced by a positive
-claim that the binder `artifact` in `mbt_seven_src` is `ParseArtifact` (`mbp_fact_of` with
-`mbp_find_atom(^artifact)`, the shape of `mbt_binder_is_typed_parse_artifact_from_accepted_value_holds`).
-The coproduct readers (`infer_match_coproduct_of_type`, `infer_binding_type_in_scope`,
-`infer_match_field_type_instantiated`) currently leave non-parameter field types that are scoped to
-their declaration underived on purpose. In PR2 they read the resolved types from the provider
-instead.
-
-## 4. Controls
-
-| # | Control | Kind |
-|---|---|---|
-| C1 | calm-pike-507's one-module projection-vs-param arm (`v2.test.claim.match_binder.match_binder_typing` `mbt_match_is_typed_parse_tree_holds`) | red before PR2, green after |
-| C2 | cross-module `ParseArtifact.tree`, where the declaring module is not a universe member | red before PR2, green after |
-| C3 | a field whose type names an undeclared type refuses at resolve, located | red |
-| C4 | a declaration demanded from a module outside the ingest refuses at P1, typed | red |
-| C5 | AT MOST ONCE: two subjects that both demand module X's namespace build it once. The double-insert refusal goes red if it is built twice. | red if violated |
-| C6 | IDENTITY: the `DeclarationRef` for a type in the P2 body equals the one the module's own resolved root holds at the same use | positive |
-| C7 | wise-bat-862's `body_cast_node` rows 15, 15b, 15c, 15c2 and 15d stay green, and 15d, the miss, still refuses | regression |
-| C8 | #12629's where-head controls (`declaration_graft_where_alias_*`), re-pointed at the P2 read | regression |
-| C10 | SNAPSHOT IDENTITY: an entry in infer's per-module snapshot and the P2 provider entry it projects are the identical `DeclarationRef` and body; the snapshot is a derived projection, never re-resolved | positive |
-| C11 | a cross-module callee's Arrow read by `infer_declaration_reference_facts` carries resolved parameter and return types (calm-pike-507's measurement on the stacked branch) | red before PR2, green after |
-| C12 | the seven's `parse_module_prepared(...)` scrutinee types as `Outcome<ParseArtifact>`, so calm-pike-507's `infer_match_scrutinee_type_underived` frontier claim flips to a typed binder | red before PR3, green after |
-| C9 | the retired RFM row's discriminating red stays enrolled as a regression control (condition c) | regression |
-
-## 5. Conditions this plan builds to (neat-boar-16, via quiet-gull-780)
-
-- (a) There is no moment where two structures answer the same question. The reader switch, the
-  deletion of per-module `resolved_declarations`, and the deletion of the lazy per-subject namespace
-  build all land in the transition that makes them redundant.
-- (b) The provider has no fallback. Out-of-closure refuses at the provider. "In the ingest" means
-  every module the native ingest read into the closure. The provider's identity and per-ingest scope
-  are named the way #11401's `ResolutionContext` is. At-most-once is C5.
-- (c) The RFM row retires in PR2, and its red stays enrolled (C9).
-
-## 6. Cost
-
-Baseline, taken before PR1 on `origin/main` 077af249458: `gunbc test //v2/test/claim/body_lowering/...`
-on the native route, reading the per-module `[native-prepare-split]` `resolve_nanos` lines and the
-`[native-cost-partition]` rows. The same pattern is re-run on each PR head. Cite the run by tag; do not
-transcribe its numbers. Expected shape, not a claim: P1 moves namespace work from once per resolve to
-once per module per ingest. For a declaring module that is not a universe member it is new work,
-bounded by demand. Demand-scoping follows bold-bat-516's cost lane (no eager whole-closure
-admission). The baseline measures the change; it does not define it.
diff --git a/docs/plans/dedicated-coding-harness-plan.md b/docs/plans/dedicated-coding-harness-plan.md
deleted file mode 100644
index e1dd062ed57..00000000000
--- a/docs/plans/dedicated-coding-harness-plan.md
+++ /dev/null
@@ -1,795 +0,0 @@
-# Dedicated Coding Harness — scope
-
-Project ID: DCH
-
-Repository anchor: gunb-ai/gunbc
-
-Baseline: main@de2f5f86346, read 2026-09-01.
-
-Operator direction (2026-09-01): serve a large open model on the DGX Sparks and drive a minimal
-coding harness against it, retiring the Claude, Codex and Cursor provider runtimes. Written from
-the ground up in `.dag` and Rust. **DCH and the dedicated harness must not import, vendor, depend
-on, or cite `ctrl` as authority.** Stated at that grain deliberately: the wider claim would be false
-of the repository today, because `extdeps.ctrl.gunbc_pin` already declares an `ExternalAuthority`
-pointing into `gunb-ai/ctrl` and compares the host pin against the ctrl pin. That row is out of this
-lane's scope and is not to be touched here. Spark parity is to be handled by fleet convergence
-rather than by hand. **Operator direction 2026-09-02 withdrew the RLM-first start barrier**: DCH-0
-through DCH-2 proceed CONCURRENTLY with RLM, and the two lanes meet at DCH-3 rather than queueing.
-DCH-3 is a join, not a start barrier.
-
-## 0. What is measured, and what is assumed
-
-Every claim below is either a read of this tree at the stated baseline or a live probe taken
-2026-09-01. Where a fact came from another session it is attributed, and where it is unverified it
-says so. Three earlier readings in this lane's own correspondence were stale or truncated, so the
-provenance is part of the scope rather than beside it.
-
-## 1. Terminal
-
-Success is the RLM terminal procedure, unchanged, executed with our harness selected as the
-provider realization:
-
-> From a clean revision R on main, clicking Launch on the roadmap canary creates exactly one
-> attempt, one worktree, **one harness process of ours — the default and only harness**, and one
-> durable attempt record; the
-> worker performs only the canary's exact change; verification evaluates the pinned oracle against
-> the exact attempt head; publication records a receipt; the child unblocks on acceptance.
-
-This lane authors **no new acceptance procedure**. RLM already owns a 14-step terminal that is
-provider-agnostic in every step but one, and reusing it is what keeps this from being graded on its
-own homework. `docs/plans/roadmap-launch-mvp-plan.md` is that procedure.
-
-No substitute terminal counts. A harness that completes a turn against a Spark in isolation is a
-component probe, not this terminal.
-
-**And this terminal is necessary without being sufficient** — accepted without objection by the
-controlling reviewer on 2026-09-02, at this grain:
-
-> The RLM terminal is the sole DCH integration terminal and remains necessary; it is **not a
-> coverage closure** for DCH's operational failure classes. Its bounded canary proves that the
-> accepted components compose on one exact task. It does not prove behavior under long context,
-> long tools, unreadable observation, process failure, control-plane deployment, serving
-> maintenance, cache reuse, or transport truncation. Each such class is discharged only by its own
-> named instrument, exact subject, positive control, and discriminating refused case. **A green RLM
-> terminal carries no evidence for a class whose distinguishing subject it did not execute.**
-
-This strengthens the rule already in §4 — treat one completed turn as evidence for nothing but that
-— rather than weakening the terminal.
-
-## 2. Current-state ruling
-
-### Already usable
-
-- **The seam exists and is a single-variant coproduct.** `gunbc.provider_interface_binding`
-  declares `ProviderControlInterface = CodexAppServer {}`. Adding a harness is a variant addition
-  at a modeled seam. That module's own annotation already separates the two senses of "provider" —
-  the runtime we install and control, versus the inference backend it sends requests to — and names
-  `gunbc.spark.serving_desired` `spark_serving_local_endpoint_url` as the seam where the two would
-  silently fuse.
-- **The serving runtime speaks the shape the harness needs, natively.** Probed against
-  192.168.1.225 on 2026-09-01: Ollama 0.32.9 answers `POST /v1/messages` with an Anthropic-shaped
-  response — content blocks including `thinking` and `tool_use`, `stop_reason: "tool_use"`, and a
-  `usage` object — for a request carrying a tool with a JSON input schema. `/v1/chat/completions`
-  and `/api/chat` also route. So no translating proxy is required for gunbc to drive it.
-- **Some of the wire shape is already modeled.** `extdeps.llm.anthropic` (378 lines) carries tool
-  result blocks, image sources and model specs; `extdeps.llm.anthropic_rest` names the `/v1/messages`
-  path and body.
-- **The convergence spine reaches spark serving.** `gunbc.fleet.fleet_converge_plan` imports
-  `gunbc.spark.serving_membership`, `serving_realization` and `serving_execution_schedule`, and
-  declares `fleet_converge_spark_serving_row_executions` / `_row_effects`.
-- **Both Sparks are reachable and serving.** `/api/version` answers 0.32.9 on 192.168.1.225 and
-  192.168.1.226; `/v1/models` returns the same seven ids on each.
-
-### Prevents it today
-
-- **The Sparks are not enrolled in the fleet.** `fleet_intent_network.endpoints` lists srv1–srv4
-  only, and `srv5`/`srv6` appear in neither it nor `gunbc.fleet_intent`'s `ComputeHost` list. In
-  that module **membership IS enrollment**, so this is not an omission to be patched around: it is
-  the reason parity is managed by hand. The module's own note records that the standing reason has
-  already changed from "there is nothing to enroll" to "enrolling is a decision nobody has taken
-  yet."
-- **"The models resident" is not representable.** `spark_serving_desired_manifest` governs exactly
-  one member; the other six resident models are outside that authority and nothing in gunbc owns
-  them. The structural tell, from eager-pike-541: the materializer carries a single manifest, digest
-  and blob closure, so no carrier could hold seven. Nobody can state, check, or drift-detect the
-  difference between the model we converge and the models the hosts hold.
-- **Desired and observed disagree on both hosts.** The deployed user unit still describes
-  `gpt-oss:20b`, predating the #9859 amendment to 120b, and carried no context-length line at all.
-  Two independently declared desired values, un-rendered on both hosts. **This survives #9960**
-  (see §2.1): that PR completed the DESIRED side, and a complete desired value is not a converged
-  host.
-- **There is no generic inference interface.** `extdeps/llm/llm.dag` is 11 lines and
-  `llm_contracts.dag` is 14 — anchors only. Every wire fact lives in a per-vendor module, and
-  tool-calling is modeled only inside `openai.dag` and `cursor_stream.dag`. What exists in
-  `anthropic.dag` fuses **shape** with **vendor**, which DESIGN's external-upstream decomposition
-  separates: Ollama implementing the Anthropic wire shape is precisely the shared-standard case, so
-  the shape belongs in its own module with the two implementations citing it.
-- **Whether the spine can APPLY a serving row is unproven.** The `converge` CLI verb is unwired
-  deliberately — rebuilding it would make the interpreter load-bearing for a new capability while
-  two lanes delete it — and its refusal names the live successor route. But this lane's own wet plan
-  run came back `PartiallyApplied` with apply refused. That is what RLM-2b is currently measuring.
-
-### 2.1 Changes since the baseline — the concurrency axis is RESOLVED ON MAIN
-
-The baseline above is fixed at `main@de2f5f86346` and is not rewritten as main moves; completed work
-is dispositioned here instead. Recorded 2026-09-01, after the controlling reviewer identified that
-this plan's active claims had been falsified by a merge that landed while it was in review.
-
-**#9960 (`7810e68b3ea`, ancestor of current main) resolves the concurrency-axis item outright**, and
-verified here rather than relayed:
-
-- `extdeps.ollama.server_env` declares `OllamaNumParallel` → `OLLAMA_NUM_PARALLEL`, and
-  `spark.serving_unit_render` now emits **four** environment axes, binding
-  `ollama_num_parallel_env_assignment` to the spec's slot count. The axis is no longer absent.
-- `spark_serving_desired_serving_slots_value` carries a desired count of 4, so the axis has a
-  desired value and is drift-reportable — the specific consequence this plan said was missing.
-- The false cost model is corrected at the desired value, in the direction this plan predicted:
-  the count does **not** divide the window, each slot receives its own full window, and the
-  per-slot price is recorded as a property of the **realization** rather than a fleet-wide constant
-  — the per-realization objection this plan raised is answered by a declared §4b drop naming that
-  exact subject.
-
-**One defect found while verifying it, and it is not #9960's to fix by this lane.**
-`gunbc.spark.serving_desired` still carries an *earlier* annotation block stating in the present
-tense that concurrency "is not modeled anywhere in desired state", that the two facts trade "because
-the slot count divides the context window", and that the concurrency row "is P1b and is deliberately
-not smuggled in here". All three are now false, and they contradict that same module's own value and
-annotation roughly 140 lines below. That is a §3 meaning fork inside one authority — a stale
-annotation is data the substrate cannot check, so nothing reds. **Reported, not repaired here**, and
-out of this lane's scope.
-
-**What this does NOT resolve.** #9960 made the state representable, declared and renderable. It did
-not read either host back. The observed-versus-desired receipt below stays open, and so do the two
-outstanding operator hand-edits it must account for.
-
-### Explicitly off the critical path
-
-`ctrl`'s harness and router are **prior art, not a dependency and not a citation**. Two of their
-findings are worth re-deriving deliberately rather than inheriting, because gunbc must establish
-them on its own evidence: that a cold large model can exceed a default HTTP client's header/body
-timeout, and that an assistant turn must be echoed back verbatim — thinking blocks included — with
-all tool results for one turn batched into a single user message. Treat both as **hypotheses with a
-predicted failure**, not as facts on loan.
-
-Two more joined that list on 2026-09-01 from the transcript §5 reads, on the same terms: that a
-streaming request may terminate a response early where an otherwise identical non-streaming request
-returns it complete, and that an assistant turn may stop at `end_turn` having announced work it did
-not perform.
-
-**The second is superseded on 2026-09-02, and the correction is worth more than the hypothesis.**
-A mechanical cause was found: a serving package carrying `PARAMETER stop ###` terminates generation
-on ordinary Markdown H3 output while returning a well-formed stream and `stop_reason: end_turn`.
-That is a *package configuration* colliding with content, reproduced by a tiny prompt and removed by
-rebuilding the package — not a model deciding to stop, which is what the single surviving
-observation appeared to show. The heading-then-stop symptom therefore had a determinate external
-cause the whole time, and the hypothesis about model behaviour was an artifact of reading a
-transport symptom as a semantic one. It leaves the hypothesis list and becomes DCH-0p's subject.
-The streaming hypothesis is untouched and still has **no** observation: its isolating step was never
-run.
-
-## 3. Serial gate chain
-
-Only one gate mutates at a time. A later gate may author inert types and fixtures but may not
-activate production rows before its predecessor's receipt is accepted.
-
-**A gate does not complete while a §5.2 question that owns one of its dispositions is open.** This
-is a precondition of the gate, not a note beside it: §5 exists to answer these classes *in advance*,
-and a plan that lets a gate finish while its own identified fail-open is unadjudicated has recorded
-the class instead of handling it. The bindings, and each is repeated in the gate itself:
-
-**All five returned on 2026-09-02** (§5.2). The rule stands for any question opened later; what the
-returned rulings changed in the chain is recorded here:
-
-| Question | Effect on the chain |
-|---|---|
-| Q3 | **A new gate, DCH-0r, is inserted before DCH-0c.** A §4b drop was REJECTED as the normal shape — reordering removes the need for debt. |
-| Q1 | DCH-2's failure-arm partition is specified, not left open. |
-| Q2 | DCH-2 owes a typed-obligation adjudication; length-based dispositions are forbidden. |
-| Q5 | DCH-2 owes journal-before-effect ordering and a two-axis model. |
-| Q4 | Governs how §2's hypothesis list is read; each hypothesis owes its own instrument before DCH-3. |
-
-The resulting order is:
-
-```
-DCH-0  endpoint rows
-DCH-0r quiescent-maintenance construction
-DCH-0c ComputeHost enrolment / apply reachability
-DCH-2  turn activation
-```
-
-DCH-0c may precede DCH-0r **only** if the destructive restart path stays structurally unreachable,
-or refuses because the maintenance fence is absent.
-
-### DCH-0 — Enrol the Sparks, and reconcile the rendered unit against the live hosts
-
-**Question owned:** what does the fleet know about these two machines, who says so, and does either
-host actually carry what desired state now declares?
-
-The parallel axis and the cost model **left this gate on 2026-09-01**; #9960 performed both, and
-§2.1 records the verification. What remains is enrolment and the live reconciliation.
-
-- Enrol srv5/srv6 in `fleet_intent_network.endpoints` and `fleet_intent`'s `ComputeHost` list — the
-  act the address correction deliberately did not perform. (The `ComputeHost` half is DCH-0c; see
-  below.)
-- Reconcile the rendered unit on both hosts against desired state, which is now complete on four
-  axes where it was complete on three.
-- Q3 **returned**: the drain is not deferred and not declared as debt. It becomes its own gate,
-  **DCH-0r**, sequenced immediately after this one. This gate's own receipt is unchanged.
-
-**Receipt:** an observed-vs-desired comparison of the rendered unit on both hosts, not a return
-code. The rendered unit is the only member of the must-move-together set that produces **no failure
-signal** when stale — ref, manifest, digest and closure each raise a checksum event, while a stale
-unit is silent, which is how both hosts drifted on two axes unreported. Two hand-edits are
-outstanding against that receipt: the context length raised today, and `OLLAMA_NUM_PARALLEL=4` set
-on both hosts, each under operator instruction. **#9960 does not discharge this and it sharpens
-it**: a hand-set value on a host and a declared value in the corpus agreeing by coincidence is
-exactly what a silent carrier cannot distinguish from convergence, so the readback is the whole
-receipt.
-
-**Enrolment is inert today, and that is the risk rather than the reassurance.**
-eager-pike-541 looked for the executor rather than arguing from principle: no
-`ctrl-fleet-converge` timer or service exists on either Spark in either scope, and
-`gunbc.fleet_converge_timer` says of itself that it "remains the naming and cadence authority; it is
-no longer a renderer" — its installer chain died with `ci.yml` in #8283. So enrolment cannot cause
-an apply, because nothing on those hosts is scheduled to run one. The failure mode to guard is
-therefore not prematurity but **a row that reads as an outcome**.
-
-**The consumer census, which was the open item on that reasoning, is done and it sharpens the gate.**
-Of 57 non-test modules importing `fleet_intent_network`, the number that read the `endpoints` list
-or `fleet_intent_network_topology()` is **zero** — production modules consume individual endpoint
-rows *by name* (`bmc_virtual_media`, `host_identity_access` take `srv1_host_lan_endpoint` and
-friends). The topology function has exactly one consumer in the tree:
-`test.claim.fleet.fleet_intent_network_witness_test`, asserting
-`list_length(items: fleet_intent_network.endpoints) == 11`.
-
-Two consequences. First, **list membership is not the load-bearing act** — authoring the srv5/srv6
-endpoint rows that named consumers can reach is. Second, enrolment will turn that witness red at
-11 → 13, and the right response is not to bump the literal: a count copied from the current tree is
-the change-detector DESIGN §5 names, and completeness here is an identity join, not a count
-equality. Enrolment is the occasion to fix the oracle, and that repair belongs in this gate.
-
-**ENROLMENT IS TWO ACTS, NOT ONE, AND ONLY ONE OF THEM IS INERT.** The census above covers
-`fleet_intent_network.endpoints`. `fleet_intent`'s `fleet_intent_known_hosts` is its opposite —
-censused by eager-pike-541 and verified here — with three production consumers:
-
-- `gunbc.generated_artifact` maps the list to `RunnerHostSudoersArtifact`, so enrolment **mints two
-  new generated artifacts**; the rows cannot land without a regeneration in the same commit or the
-  drift gate reds. Mechanical consequence, mechanical receipt.
-- `gunbc.runner.runner_host_deploy` `admit_runner_host` returns `RunnerHostUnenrolled` for any host
-  absent from the list. Its annotation calls itself **the enrollment wall** and is explicit that it
-  is construction rather than a check: no function in the module takes a bare `RunnerHostDeploy` and
-  yields a command, so "run the installer on an unenrolled host" is unrepresentable rather than
-  discouraged. It prices the srv4 host-convergence OOM — converge against an unenrolled host derives
-  nothing for it, or stamps drop-ins carrying another host's widths — and names the enrolled row as
-  exactly where `runner_deployment_plan`'s conservation wall gets the host RAM to check slot caps
-  against. **So enrolling srv5/srv6 removes a fail-closed refusal that currently protects them.**
-- `gunbc.fleet_converge_apply` finds hosts by identity in that list, so enrolment is precisely what
-  makes a Spark reachable by the apply path this lane measured as `PartiallyApplied` / refused.
-
-The inertness argument had two independent legs — no executor, and no consumer. `ComputeHost`
-knocks out the second. **Only the executor leg survives**, and it is the leg that changes the moment
-anyone installs the timer.
-
-**So DCH-0 lands the endpoints half only.** Author `srv5_host_lan_endpoint` / `srv6_host_lan_endpoint`
-as rows the named-import consumers can reach, add them to the list as the authority's completeness
-statement, repair the count oracle. The `ComputeHost` half is **DCH-0c**, and it is a decision
-rather than a row: it needs the host facts the conservation wall consumes (RAM at minimum), the two
-sudoers artifacts regenerated in the same commit, and someone stating out loud that the enrollment
-wall is coming down for these two machines on purpose.
-
-Note the row/list split holds on both sides and inverts between them: `srv1_host` and `srv2_host` are
-imported by name in at least `os_install_actuator_selection`, `deployed_intent_v1`,
-`nbd_proxy_virtual_media_install`, `ci_deploy_access` and `srv3_install_media_fetch`, so authoring
-`srv5_host`/`srv6_host` rows is separable from list membership here too — except that here the LIST
-is the load-bearing half and the row is the quiet one.
-
-**Owner: eager-pike-541**, agreed 2026-09-01.
-
-### DCH-0r — Quiescent serving maintenance
-
-**Question owned:** can a converge restart the serving process without destroying work in flight,
-and can it prove it?
-
-Created by the Q3 ruling. A §4b drop was **rejected** as the normal shape: a drop reports a lower
-guarantee, it does not turn an unsafe arm green, and DESIGN is explicit that a dissolution trigger
-does not authorize creating the debt. Reordering the chain removes the need for debt entirely.
-
-**The mechanical blocker, verified in this tree rather than relayed.** `spark.serving_realization`
-realizes `EnableSystemUnit` as three commands in one effect — `systemctl enable`, `systemctl start`
-and `systemctl restart` — so **restart has no independently matchable effect identity** and no fence
-can structurally guard it. Two refinements found while verifying, both sharper than the finding as
-received:
-
-- The restart is **unconditional**: it is emitted every time the effect is realized, not only when
-  the unit definition changed. So converging this unit is destructive to in-flight work even when it
-  changes nothing.
-- **The user-unit path is the opposite shape**, and the Sparks are on it. Its closure is
-  `[… EnableUserUnit, StartUserUnit …]` — enable and start already separated — and it carries **no
-  restart effect at all**. So on the very hosts this lane targets, a changed unit definition has no
-  modeled route to take effect. That is a candidate cause for the observed-versus-desired drift
-  DCH-0 must reconcile, and it is stated as a candidate because nothing here has read a host back.
-
-So the first required change is that restart becomes its own typed effect, distinct from
-enablement and from initial start, on both paths.
-
-**The admitted restart sequence.** A bare `active == 0` reading is insufficient, because a turn may
-enter immediately after the read: **the admission fence and the drain are one protocol.**
-
-**THREE IDENTITIES, NOT ONE.** The 2026-09-02 ruling corrected an earlier conflation in this
-protocol, and the correction is the load-bearing part of the gate:
-
-| Identity | Stability | Answers |
-|---|---|---|
-| **Service locus** | stable across restarts | which service is fenced — host plus unit slot |
-| **Service invocation identity** | changes on every activation | is this still the exact process generation observed before? |
-| **Running-definition identity** | stable for equal restart-relevant specs | which definition produced this invocation? |
-
-The `/proc/<MainPID>/environ` stamp answers the **third**. It is invocation-BOUND evidence but it is
-not an invocation IDENTITY: two successive restarts from one definition carry the same stamp, so it
-cannot prove the old process was replaced. DCH-0r still needs the second, read from observation
-rather than desired state, and it must change whenever the process is replaced, stay stable within
-one observation transaction, never repeat merely because a PID was reused, and bind to the process
-whose environment and health were read. `MainPID` alone satisfies none of the last two.
-
-**The fence is keyed by the LOCUS, not by the incarnation.** An earlier wording said draining refuses
-leases "for that incarnation"; that is too narrow, and it fails exactly when it matters — if the
-backend restarts unexpectedly mid-drain, an incarnation-scoped fence stops blocking admissions at the
-moment an unvalidated new incarnation appears. The pre-restart invocation is a compare-and-swap
-condition and an evidence anchor, never the scope of the refusal. Each running lease separately binds
-the invocation it uses, which is what lets an unexpected replacement produce a typed interruption
-against the right turns.
-
-1. Observe one transactional pre-state: locus, invocation `J0`, running definition `D0`, desired `D*`.
-2. Atomically move `Open` to `Draining`, keyed by locus and maintenance, with `J0` as the expected
-   pre-invocation.
-3. Refuse **every** new turn admission at the locus, whatever invocation is present.
-4. Drain the complete active lease population at the locus to zero; each lease identifies its
-   invocation.
-5. While the same fence is held, re-observe zero leases **and** that the invocation is still `J0`.
-   If it changed, the drain did not succeed: settle the affected turns as interrupted, reconcile the
-   pre-state, and restart the protocol.
-6. Execute the independently typed restart.
-7. Read one transactionally joined post-state and require ALL of: `J1 != J0`; `D1 == D*`; the
-   registered definition equals the render of `D*`; readiness and health belong to `J1`; and an
-   empty replan.
-8. Reopen admission bound to the pair `(J1, D1)`, and have every later admission recheck that the
-   observed pair still equals the admitted one — so an out-of-band restart refuses immediately
-   rather than silently granting a turn against an unvalidated backend.
-
-`std.temporal_effect` already carries the general direction — held leases, refusal on foreign
-ownership, `DrainThenStart` as a distinct plan — but the service-level population and admission
-fence that make the drain exact do not exist yet.
-
-**Guarantee grain, stated rather than assumed.** A census of DCH turn leases proves quiescence for
-DCH-managed clients only. To claim the *service* is quiescent, one of these must hold: every
-admitted client routes through the same lease authority; DCH holds exclusive access for the window;
-or the service exposes a complete active-request observation including external clients. Otherwise
-external occupancy is **outside the modeled guarantee** — and then an automated destructive restart
-must refuse, or the guarantee is stated narrowly as DCH-managed-turn continuity. It may not be
-stated broadly and held narrowly.
-
-**THE UNSTAMPED READING, NARROWED.** A complete successful environment read that finds no stamp is
-positive evidence and is not "unobservable" — but its honest conclusion is that **this invocation
-cannot be established as having been started from the current desired definition**, whose render
-stamps unconditionally. It is NOT that the process temporally predates that definition: a foreign or
-manually started process could have been launched later and would carry no stamp either. It still
-requires reactivation; chronology is simply not what was established. The arm holds only while four
-conditions do: the environment read completed, absence is distinguished from permission, parse,
-truncation and observation failure, the desired unit specification stamps unconditionally, and the
-stamp identity covers every process-start input whose change requires reactivation.
-
-**THE SUBORDER.** DCH-0r-a deletes the fused unconditional restart, separates enable from start, and
-defines the reactivation vocabulary with its refusing selector. DCH-0r-b observes the
-running-definition identity AND the service-invocation identity, and proves the process/environment
-read is transactionally joined. DCH-0r-c builds the locus admission fence, the exact lease drain, the
-guarded production reactivation, the two-identity readback and the validated reopening. Joining the
-reactivation arm into the production planned-effect sum belongs with DCH-0r-c's guarded producer, not
-with DCH-0r-a — no production consumer can use the arm before then.
-
-**DCH-0r-c's CONSTRUCTION HALF HAS LANDED, AND WHAT IT DOES NOT ESTABLISH IS THE LOAD-BEARING HALF OF
-THIS SENTENCE.** `gunbc.spark.serving_admission_fence` carries the locus, the three identities kept
-apart, the locus-keyed admission fence, the compare-and-swap onto `Draining`, the exact drain
-adjudicated as one reading with its revalidation, the occupancy grain, `BoundReactivationPlan`, the
-guarded producer and the two-identity readback with its validated reopening; the fence and the
-drained evidence are `sole_constructor`, so a plan cannot be assembled from a count taken outside a
-held fence. The production consumer is `gunbc.spark.serving_converge_slice_wet`
-`spark_serving_reactivation_standing_for`, which computes the remedy verdict from the host's own
-observation transaction and REFUSES on every host, because no admission-state authority and no
-active-turn population exist. The executable sum was NOT widened: the exclusion in
-`SparkServingExecutablePlannedEffect` and its witness still stand, and the plan carries its steps as
-a derivation rather than the `{ plan, steps }` field pair sketched above — storing them beside the
-plan would rebuild the authored-label-beside-unrelated-commands defect that exclusion holds shut.
-
-**What remains, and it is the receipt below rather than wiring:** a lease authority that admits every
-turn at a serving locus and can enumerate the population held there, a persisted admission state the
-fence can swap, and SSH to srv5/srv6 under an operator credential decision. Until those exist the
-Planned arm has never been reached from a production call site, and neither DCH-0r-a's nor DCH-0r-b's
-standing is retired.
-
-**Receipt:** a restart executed against a held fence, with the drain observed to zero under that
-same fence, and a post-restart incarnation readback. An exit status of zero from the invoking
-program establishes only that the program reported completion — service convergence still requires
-independent observation and an empty replan.
-
-### DCH-0b — Make residency representable
-
-**Question owned:** what is a resident-model fact, and who owns the six nobody converged?
-
-Split from DCH-0 at eager-pike-541's request, and the reason is the right one: enrolment and the
-parallel axis both write a value into a carrier that already exists and has a shape, whereas the
-resident set has **no carrier at all**. Someone must first decide whether a resident-model fact is
-desired state or observation, whether it is per host or per fleet, what its identity is when the
-same weights appear under two refs, and what a drift between the converged member and the resident
-set *means* when nothing put six of those models there through gunbc. That is design, and folding
-it into a gate of row-writes would make the row-writes wait on it.
-
-The structural tell that no carrier exists: the materializer carries a single manifest, digest and
-blob closure, so nothing in it could hold seven.
-
-**AND THE SUBJECT IS A BEHAVIOUR-BEARING PACKAGE, NOT RESIDENT WEIGHTS** (ruling, 2026-09-02). The
-discriminating pair is: same weight blob, same template, same runtime, same host, **different
-effective stop set** — materially different observable behaviour. So a weights digest, a GGUF
-manifest or a model tag is not the model identity this lane needs. The carrier is a
-`ServingModelPackageIdentity` over the target model artifact, quantization, prompt-template identity,
-parser/renderer identity, effective parameter identity, **effective stop-sequence set**, runtime
-release and decoding realization. A tag is an allocated handle to that package and must never be
-treated as the semantic identity — a package rebuilt from the same weights without a stop string is
-a **different serving package**, and treating it as identical makes the repair invisible to
-convergence. The gate's question becomes *which exact behaviour-bearing package is resident and
-active on each router-eligible host*, not which weights occupy disk.
-
-### DCH-0p — Effective package qualification
-
-**Question owned:** what is this endpoint actually serving, and can a stop string in its package
-silently truncate our output?
-
-Created by the 2026-09-02 ruling. It runs after DCH-0b makes package identity representable and
-after DCH-0r makes a required restart safe, and it must complete before DCH-2's production
-qualification.
-
-**The defect it exists to prevent, which is not hypothetical.** A serving package carrying
-`PARAMETER stop ###` terminates generation on ordinary Markdown H3 output, while the serving surface
-returns a well-formed stream and `stop_reason: end_turn`. A tiny prompt reproduces it; removing the
-package stop restores the answer. The client can neither identify the cause from the response nor
-remove a server-side stop through an additive request option. **This is a mechanical cause for the
-heading-then-stop symptom §5 records as a hypothesis** — see the reclassification there.
-
-**Read the effective configuration, never the intended one.** Before admitting a backend, read what
-the running endpoint actually serves (Ollama exposes template, serialized parameters and model
-information on `/api/show`). A source Modelfile, a tag name, or the command used to build the package
-are all statements of intent, not observations. The receipt binds host, service invocation, model
-handle, target artifact, runtime release, template, the complete effective parameter set, the
-canonicalized stop-sequence population, parser and decode realizations, and the observation
-transaction. Where a behaviour-bearing field is not fully exposed, the answer is
-`PackageConfigurationIncomplete` — never an inferred value.
-
-**Stop-sequence admission is the wall.** Every effective stop carries a typed role: either a
-protocol-boundary sentinel binding uniquely to a declared boundary in that exact package's
-template/parser contract, or an unbound content stop. A copied allowlist of strings is not a role.
-`###` has no protocol-boundary role and is ordinary output content, so a package carrying it refuses
-**before** DCH starts a turn. Sentinel-looking values inherited from a prior lane are admitted only
-once DCH independently establishes their relationship to the exact conversation protocol — "the
-other lane called them legitimate" is not our evidence.
-
-**Controls this gate does not exit without:** stop sets differing only by `###` produce different
-package identities; a package carrying unbound `###` refuses; a fixed package completes a request
-requiring H3 output with the H3 bytes present; the original package discriminates by terminating
-before those bytes; an unreadable, incomplete, or handle-inconsistent `/api/show` refuses; one tag
-resolving to different package identities on two router-eligible hosts refuses; a router endpoint
-missing the selected package becomes ineligible rather than silently retained; and a package
-configuration changing under an active session changes the session generation, so old evidence
-cannot carry.
-
-The runtime H3 pair is evidence that the endpoint realizes the modeled rule. It is not a substitute
-for reading the effective configuration.
-
-### DCH-1 — Hoist the wire shape off the vendor
-
-**Question owned:** what is the interface, and which module owns it?
-
-- One module for the messages/tool-use shape, cited to its specification; `extdeps.llm.anthropic`
-  and the Ollama serving surface become two implementations that reference it.
-- Tool-calling gets a shape here rather than a third copy inside a vendor module.
-- This is a replacement migration at the root, not a new fork: the vendor module's shape rows move,
-  they are not duplicated.
-
-The authority is `extdeps.llm.anthropic_messages_api`, its own module rather than a row
-in `extdeps.llm.llm` or `extdeps.llm.llm_contracts`: those two are agnostic anchors, and the
-specification is a named, versioned upstream subject with a citation and a version axis of its own,
-which is the `extdeps.whatwg.html_navigation` position rather than the generic-hub one. It keeps the
-publisher's names because coining a neutral second name for a concept that already has one is the
-nicknaming violation, and it names no implementation: `MessagesApiImplementation` is the carrier
-each implementation declares its own row in.
-
-The shape rows MOVE, they are not copied. `extdeps.llm.anthropic` retains only what is true of the
-API product — its model roster — plus its own conformance row; the wire contracts move with the
-shape into the `_contracts` sidecar the emitter merges into the specification module, so no contract
-row is left pointing at the vendor module. `extdeps.ollama.api` gains the `/v1/messages` endpoint
-row and `ollama_messages_api_conformance`, and re-models none of the shape. This section records the
-design the gate implements; git records what merged, and nothing here claims a merge state.
-
-The version binding is the axis worth having, and it lives on the carrier rather than in this
-document. Upstream documents that Ollama ACCEPTS the `anthropic-version` header and does not use it,
-so an accepted request is not evidence of the revision served — an accepted-and-ignored parameter is
-worse than a refused one, because it looks like a control and is not. The two implementations
-therefore declare different arms of `MessagesApiVersionBinding` against the same spec version.
-`test.claim.messages_api_conformance_witness_test` carries the discriminating controls: it goes red
-if the axis collapses, if either arm goes uninhabited, if a conformance row stops pointing at a
-declaration in its own module, or if a wire contract is left behind on the vendor module. Ollama's
-`/v1/messages` behaviour is grounded in upstream's own `docs/api/anthropic-compatibility.mdx`, not in
-a probe transcribed into prose.
-
-### DCH-2 — The harness, in `.dag` and Rust
-
-**Question owned:** can we drive a turn to a terminal disposition and report it?
-
-- The loop: post a request, and while the response stops on tool use, execute the tools and post the
-  results back. Four tools is the starting surface: run a command, read, write, edit.
-- **The tool surface is where §5.1 row 7 lands, so it is specified here rather than left to the
-  implementer.** Every quirk in the relayed transcript was a real semantic of this surface that
-  nothing announced, so the rule for all of them is one rule: **a tool's contract is carried in the
-  tool's declared shape, and any limit it enforces is reported in its result rather than inferred
-  from a truncated or missing one.** Concretely, six dispositions this gate owes:
-  - **Working directory.** Either a command's working directory is part of the call's declared
-    input, or the surface states that each call is independent — the failure to avoid is a caller
-    that happens to comply, which is what theirs did, by luck and unprompted.
-  - **Duration.** A limit that kills a build is a real refusal and must arrive as one: a typed
-    timeout disposition naming the limit, distinguishable from the command's own failure. A default
-    chosen for a chat turn is the wrong default for a compile.
-  - **Input.** No stdin means anything that prompts hangs until the limit kills it, and the operator
-    sees a timeout rather than a prompt. Either the surface supplies input, or a prompt-shaped hang
-    is typed as its own disposition.
-  - **Truncation.** Keep their shape: a cap that **announces** it, so a large result is
-    distinguishable from a complete one. This is already right and is adopted deliberately.
-  - **Edit matching.** Keep their shape: refuse on zero or multiple matches rather than patching the
-    first. Construction over validation, and already right.
-  - **Context exhaustion.** A full window must be a typed refusal, not a turn that begins to fail.
-    Compaction is a later capability; the disposition is owed now, because without it exhaustion
-    presents as the model getting worse.
-- Preserve what the codex realization learned expensively, because these are provider-independent
-  and were paid for once: the three separated layers (durable goal, execution lease, controller),
-  the exactly-once command identity, and the trap that an idle thread never authorizes a start.
-- A harness that **reports** its own status retires the observation layer that dominates every
-  existing provider module — guessing which transcript belongs to a session, inferring state from a
-  foreign schema. That is where the simplification is, and it should be measured, not asserted.
-
-**The exit bar, set by the Q1/Q2/Q5 rulings.** This gate does not exit on "it performs the four
-tools and reaches one terminal turn". Four qualification groups, each owing a named instrument with
-a positive control and a discriminating refused case:
-
-- **Supervision and observation.** A harness throw yields a durable failed-or-interrupted attempt
-  **while the controller stays observable**. A transcript-resolution failure stays distinct from
-  idle and from provider silence — the specific conflation that made a working session read as a
-  frozen one.
-- **Execution provenance and lifecycle.** Tests execute the production transport rather than a
-  test-owned twin; a control-plane restart does not terminate the turn worker; a backend restart
-  produces a typed interruption.
-- **Turn and transport semantics.** The stream/non-stream differential; `EndTurn` with outstanding
-  typed obligations; performance separated by cold, warm and cache-reused state.
-  - **The harness may never state that `end_turn` means the model naturally finished.** On this
-    transport at least two upstream causes produce that same observed label — natural completion,
-    and a configured server-side stop colliding with content. So the raw provider observation and
-    the semantic disposition stay different axes: a provider terminal observation carries the wire
-    stop reason and, honestly, that the native cause is *not exposed*; the DCH disposition is
-    decided by obligations, and external pinned verification — never the model's stop reason —
-    decides success. This is the second of two independent walls: DCH-0p prevents known
-    content-colliding package stops, and DCH-2 still refuses to equate a provider label with task
-    completion, because the client cannot prove the native cause from a surface that erased it.
-  - **Throughput is a construction, not a threshold.** "No four-digit rate is reachable" is a
-    threshold over a measured value — a view, which #9946's ruling forbids as a correctness wall,
-    and which faster hardware would falsify while a smaller fabricated value passed. The durable
-    shape is a cache lineage (backend host, service invocation, package identity, conversation
-    prefix identity, cache generation) joined to per-turn accounting that separates total input
-    tokens from **newly evaluated** and **reused** ones. A prefill rate may be constructed only over
-    newly evaluated tokens against the prefill duration; anything else divides mismatched subjects
-    and produces a valid arithmetic operation that is not a hardware measurement.
-- **Tool-contract honesty.** The six dispositions above, at this grain: explicit working directory
-  on every invocation or a separately leased persistent shell; typed stdin or a typed refusal; a
-  per-operation budget rather than one universal kill; termination of the **owned process
-  population** rather than one PID; and compaction or an explicit typed context-exhaustion refusal.
-
-### DCH-3 — Bind it at the seam, make it the default, and run RLM's terminal
-
-**Operator direction, 2026-09-02: the harness is to be the only and default harness; Claude and
-Codex are to be ignored.** That is adopted, and it changes this gate's shape in a way worth stating
-rather than absorbing.
-
-**Default is a selection; retirement is a deletion. They are separated deliberately.** "Ignore the
-other providers" is discharged by making ours the default selection at the seam and stopping
-investment in the others — it does **not** require deleting them, and DCH-4's deletion still waits
-on this gate's receipt. Deleting them to satisfy "only" before that receipt would leave the
-repository with zero working harnesses, which is the failure mode the replacement-migration doctrine
-calls erasing a correctness distinction rather than completing the replacement. The other variants
-stay **frozen** in the doctrine's sense — no new investment, no new rows on their growth surfaces —
-until DCH-4.
-
-**"Only" raises this gate's bar; it does not lower it.** With three providers, a weak DCH-3 is
-tolerable because a fallback exists. With one, there is none — every DCH-2 qualification class
-becomes load-bearing on the day it becomes default, and the relayed transcript in §5 is precisely a
-record of what a sole harness with no fallback feels like when it breaks: three sessions dead, an
-exit status of zero, and an operator who cannot tell working from dead. So the combined admission
-below is not ceremony to be traded away for focus — it is the thing that makes "only" survivable.
-
-- The `ProviderControlInterface` variant, its receipt types, and the belt binding.
-- Make it the **default selection** at that seam.
-- Re-run the RLM terminal with the variant selected.
-- **Admission requires BOTH**, and neither substitutes for the other: every DCH-2 qualification
-  receipt accepted, **and** the unchanged RLM 14-step terminal with the DCH variant selected. The
-  §2 hypotheses each owe their own DCH-run instrument before this gate, per Q4.
-
-### DCH-4 — Retire the three provider runtimes
-
-Delete-first at the root, per the replacement-migration doctrine, once DCH-3's receipt is accepted
-— which now means the **combined** admission above, not the canary alone. Retiring a working runtime
-on the strength of an easy-path green is how a replacement erases a correctness distinction instead
-of completing.
-The population, to be counted rather than estimated at the time: in `extdeps/llm` the anthropic,
-openai, cursor and codex families; in `gunbc` the codex supervised-turn and runtime modules, the
-cursor SDK modules, provider account and standing, and the Claude setup-token enrolment. The auth
-surface goes with them — it exists to solve a problem that a self-hosted endpoint does not have.
-
-## 4. What this lane must not do
-
-- Import, vendor, or cite `ctrl`.
-- Become the default production harness before DCH-2's qualification receipts and the RLM terminal
-  are BOTH ready for the DCH-3 join. Concurrent authoring and qualification are authorized; an early
-  cutover is not, and "only" raises that bar rather than licensing it.
-- Land a change to an authority already inside another lane's frozen approved delta without
-  serializing it. Concurrency is authorized for authoring, testing and review; it is not authorized
-  for landing on a shared file, because a clean textual composition still yields a blob nobody
-  approved. `dag/gunbc/fleet/fleet_converge_plan.dag` is the live instance, shared with #9832.
-- Enrol the Sparks as a side effect of harness work — DCH-0 is a separate gate with a separate owner.
-- Bump `fleet_intent_network_witness_test`'s endpoint-count literal to absorb enrolment. Repair the
-  oracle or leave it red; a count copied from the tree it measures is not one.
-- Treat "it completed one turn" as evidence for anything but that.
-- Delete or break the existing provider runtimes to satisfy "ours is the only harness" before
-  DCH-3's receipt. Default first, retire after — otherwise the count of working harnesses passes
-  through zero.
-
-## 5. Adversarial review — the failure classes this lane must answer in advance
-
-**Provenance, stated once.** On 2026-09-01 the operator relayed a transcript of the `ctrl`
-mini-agent lane debugging its own harness against these same Sparks, and directed that DCH be made
-to answer it before it starts. Everything in this section is **second-hand and unreproduced here**.
-It is admitted on exactly the terms §2 sets for the rest of that lane's output: each row is a
-**hypothesis about our design with a predicted failure**, never a fact on loan, and none of it is
-citable as evidence. What their session buys us is not findings — it is a cheap enumeration of
-where a harness of this shape breaks, produced by someone who paid for it.
-
-The value is concentrated in one property: **every class below was operator-visible as something
-other than itself.** A harness throw read as a clean exit. A dead session read as a working one. A
-control-plane restart read as a Spark fault. An inflated rate read as fast hardware. A model that
-stopped early read as a truncated message. That is one class, not five, and it is the class DESIGN
-§5 exists for — so the obligation this section places on DCH is not "handle these bugs" but
-**produce a disposition that cannot be mistaken for a different one.**
-
-### 5.1 Classes, and the gate that owns each
-
-| # | Class | Observed as | Owner |
-|---|---|---|---|
-| 1 | A harness fault reaches the operator as success | process exited 0 for an hour after a first-write throw | DCH-2, and Q5 below |
-| 2 | One throw destroys unrelated work | any error in the loop took down the whole container | DCH-2, and Q1 below |
-| 3 | Self-reported status that no observer can resolve | frozen at `idle` while the harness emitted `working` throughout | DCH-2 |
-| 4 | A backend restart kills every in-flight turn | control plane and inference router shared a process | **DCH-0**, and Q3 below |
-| 5 | A turn ends without doing the work and nothing types it | `end_turn`, one heading, after 50k input | DCH-2, and Q2 below |
-| 6 | An instrument that fails toward a flattering number | 687 tok/s the hardware never reached, from KV reuse | DCH-2 |
-| 7 | Tool-surface semantics that are real and unannounced | `cd` not persisting; a 120s SIGKILL; no stdin; no compaction | DCH-2 |
-| 8 | A repair whose blast radius exceeds the bug's | a failed `chown` under `set -e` blocked every spawn on the node | this lane's own discipline |
-| 9 | Evidence filtered by survivorship | one completed final turn existed; the rest died of other bugs | Q4 below |
-
-Row 3 is the one that most directly touches a claim this plan already makes. DCH-2 says a harness
-that reports its own status retires the observation layer. Their harness **did** report its own
-status, correctly, the entire time — and the operator still saw a frozen session, because the
-report's *transport* failed independently of the report. So self-reporting is necessary and is not
-the simplification on its own; the plan's existing instruction to **measure** that claim rather
-than assert it is upheld, and this is what it will be measured against.
-
-Row 6 is the same defect this plan already corrects in DCH-0 for a different subject: a plausible
-number that nobody could re-derive. DESIGN §6 governs both — name the instrument, never transcribe
-its output. A harness of ours may not report a rate it cannot ground, and where a quantity is not
-measurable the honest render is a refusal to render, not a zero.
-
-Row 7 was a single line in DCH-2 ("four tools: run a command, read, write, edit"), and that line is
-where every operator-visible quirk in their lane lived. **It is now specified in DCH-2 as six owed
-dispositions** — working directory, duration, input, truncation, edit matching, context exhaustion —
-rather than deferred by a forward reference, since a promise to expand a brief elsewhere is the same
-unreachable route this plan refuses in others. Two of their choices are adopted deliberately because
-they are already the right shape: an output cap that **announces** its truncation, so a large result
-is distinguishable from a complete one; and an edit that **refuses on zero or multiple matches**
-rather than patching the first, which is construction over validation.
-
-Row 8 is not about the harness. It is a note to this lane's own reviewers: their repair for a
-mini-agent-only failure aborted bootstrap for every session on the node. A fix that widens the
-failure population is a regression regardless of the class it closes.
-
-### 5.2 The five dispositions, returned 2026-09-02
-
-Sent 2026-09-01 and **all five returned**. Recorded as rulings rather than positions; where my
-proposal was accepted with refinement, the refinement is what binds.
-
-**Q1 — the stop-the-line boundary. Accepted with refinement.** "Whose failure?" is evidence; it does
-not decide. The controlling discriminator is **which continuation preconditions remain established,
-and what is the smallest closed causal scope containing the uncertainty**. Stop-the-line means no
-ordinary next effect is admissible — it does **not** mean the supervisor must die: a supervisor
-alive in a typed stopped state substitutes no answer and admits no ordinary work, so it is not an
-absorbing fallback, and destroying the mechanism that reports the failure was never §5's bar.
-Consequences DCH-2 owes:
-
-- A tool timeout is first an observation that completion was **not seen by the deadline** — not
-  proof the command failed or changed nothing. It splits: timeout **plus** a settled owned process
-  population **plus** known effect state may be returned to the model as a typed result and the turn
-  continues; timeout with a surviving process or unknown effect state enters reconciliation, where
-  mutating tools and automatic retry are refused. So the honest surface is two dispositions,
-  `TimedOutQuiesced` and `TimedOutEffectStateUnknown`, plus termination of the owned process
-  population rather than one PID, and captured output through the last observed byte.
-- An unexpected model stop reason is **turn-stopping**, not tool-level. A recognized-but-state-
-  invalid reason is a typed turn-protocol refusal; an undecodable wire value is a typed
-  unreadable-stop-reason observation carrying its raw evidence. None may throw through the
-  supervisor boundary, and none may collapse into one generic failure — terminal disposition and
-  native cause are separate axes, and an unreadable stream is neither "nothing happened" nor "the
-  provider failed".
-
-**Q2 — a degenerate turn. Accepted at typed-obligation grain, rejected at prose or character grain.**
-No length, token count or heading shape may produce a disposition; those may drive an operator
-attention view and nothing more. The adjudication is over **outstanding typed obligations**, whose
-authority is the task and execution contract — the requested change, required validation, tool calls
-awaiting results, mutations requiring readback — not the assistant's prose. The model may add
-structured obligations; it may not erase task-owned ones or self-declare an empty set to obtain
-completion. Three arms: `EndTurn` with obligations outstanding is **ended-incomplete**; with
-obligations closed it is **awaiting verification**, which is deliberately *not* acceptance, because
-the model's own `EndTurn` cannot grade the model's work; with obligation standing unobserved it is
-**unadjudicated**. A heading-only reply becomes incomplete without any length rule, whenever the
-task obligation is still unsatisfied. This also fixes the UI defect at its root: the surface renders
-a typed state and never infers idle from a small text buffer.
-
-**Q3 — convergence restarting the serving process. (a) required, a constrained (b) required, (c)
-rejected.** The drain is the construction and it becomes its own gate, **DCH-0r**; a §4b drop is not
-the planned answer, because a drop reports a lower guarantee rather than making an unsafe arm green.
-The prior-art incident is also **two** defects, answered differently: a control-plane restart killing
-the worker is a lifecycle-separation problem (the harness worker must be supervised independently of
-the dashboard), while a serving restart killing a request is a quiescence problem. The constrained
-(b): the harness must survive backend death as a typed `BackendStreamInterrupted` carrying the old
-incarnation, the observed termination and the retained stream prefix — and it must **not** resend.
-A partially streamed response may already have executed tool calls and shown the operator prose;
-exactly-once command identity covers commands that reached that boundary, not the replayability of a
-model turn. Restart survival means **survive to report interruption**, never transparent
-continuation.
-
-**Q4 — n=1 under survivorship.** It licenses exactly one existential proposition — that at least one
-surviving execution showed the symptom — and not frequency, typicality, threshold, cause, or any
-claim about long-context turns in general. Because it is prior art rather than DCH-owned evidence,
-it does not establish even that existential proposition **for our harness**. Both hypotheses join
-§2's list now and stay **separate**, because they are different subjects: streaming terminal
-integrity is transport and decoder; incomplete-stop is turn semantics. Sharing a fixture does not
-merge their verdicts. The streaming instrument is a paired differential holding model artifact,
-host, service incarnation, request bytes, sampling parameters, context and cache condition fixed and
-**changing only the stream mode**, judged on content-block sequence, tool-call sequence, usage and
-terminal completeness rather than final rendered text. The incomplete-stop instrument constructs a
-typed task with a known outstanding obligation and must not mention character count. And any
-throughput receipt binds its cache condition as an **input identity**, not a footnote.
-
-**Q5 — the process exit status. Neither of my options exactly; closest to the first, corrected.**
-An exit status carries **how that exact observed process terminated** — never whether the attempt
-completed. An exhaustive integer partition does not fix the incident, because no mapping can say
-whether the integer belongs to the watchdog, the wrapper, the container or the harness, whether the
-harness ever started, whether a child outlived its wrapper, or whether the attempt had already
-failed before something else exited zero. Two axes: a process-termination observation
-(exited / signaled / unobserved, which this tree already models in `std.process_termination`,
-including its refusal to fabricate a code for signal death) is **evidence carried into** an attempt
-disposition, and never substitutes for it. The ordering, which is a real constraint on DCH-2:
-**journal before effect** — attempt, task, base and worktree identity durably written before the
-harness spawns or mutates anything; the process bound to that record; the semantic receipt written
-before voluntary exit; and if the harness disappears without one, an independent supervisor records
-interrupted, carrying the exact termination observation. A supervisor may move a journaled record
-from running to interrupted and **may never move it to accepted**. So a watchdog exiting zero over a
-thrown harness resolves to interrupted-with-receipt-missing, and no integer is read as "done".
-
-### 5.3 Standing rules this section adds to §4
-
-- Do not report a measurement the harness cannot ground; render a refusal where a quantity is not
-  measurable, never a zero and never a back-computed figure.
-- Do not treat a green canary as evidence for any class in §5.1.
-- Do not land a repair whose failure population is larger than the one it closes.
-- Do not produce a turn or attempt disposition from a length, token count or output shape.
-- Do not resend a request whose response was already partially streamed.
-- Do not read any process exit status as evidence that an attempt completed.
diff --git a/docs/plans/demand-engine-program.md b/docs/plans/demand-engine-program.md
index 1aa669cd470..83fb223241a 100644
--- a/docs/plans/demand-engine-program.md
+++ b/docs/plans/demand-engine-program.md
@@ -277,7 +277,7 @@ Every decision row is Ruled or Deferred with a trigger. Do not transcribe a coun
 8. **D8 — First authority cut.** The v2 native fold's driver (M3a). Recommendation: confirm. **Deferred:** trigger is M3a's detailed plan confirming that driver as the first production scheduling cut; the consumer is not changed here.
 9. **D9 — Crate partition of the emitted closure; generator promotion is a separate fact.** Two facts joined through generation identity, not one decision (side-chat ruling, 2026-09-15). GENERATOR PROMOTION -- seed (v1 emitting v2) versus self-hosted (v2 emitting itself) -- is an admission root cut governed by DESIGN §7 and D1: the seed remains the production generator until the self-hosted route satisfies the complete judgment and refusal contract, then the root cuts over; cost never keeps the seed as a semantic fallback, and it is not a `std.decision` candidate. PARTITION SELECTION is a realization selection over the closure the ACTIVE generator produced: hard constraints first (every module owned exactly once; every source and reference edge represented; complete `CompilationUnit` interface closure; Rust R4 validity; no illegal private access or impl ownership; the stable facade; complete semantic and refusal equivalence), then `std.decision` `select_realization` over a bounded declared candidate field -- one crate (the baseline, which remains a candidate), runtime + remainder, a few derived target-count cuts via `PartitionPolicy`, the policy-derived cut, SCC-per-unit as the diagnostic extreme -- funded on clean emitted-closure build wall, warm incremental wall over a declared edit population (a leaf, a high-fan-in foundation module, a large ordinary compiler module), total CPU, peak memory and process count, link/metadata/process overhead, artifact and binary size, and emission/workspace-construction wall; scoped by closure identity, producer compiler, toolchain, build profile, machine shape, candidate-field identity, evidence snapshot and policy; result `SelectedWithin`, never 'optimal'. At self-host cutover the same authority and decision re-run over the new closure; the prior selection is evidence, not an inherited answer. MEASUREMENT: the reading taken so far is a route wall partition -- seed workspace build, closure emission and one-crate emitted build as three walls read from the native route's build-log timestamps (`build.sh` in the srv1 A/B harness is the producer) -- not a rustc phase partition; `[native-prepare-split]` measures native-driver prepare, not rustc, and is not this instrument. The trigger is therefore the direct candidate A/B: each admitted candidate built from the same emitted closure, toolchain, profile, features and warm shared dependency target, recording per-crate start/end wall, ready/running crate concurrency, total wall and CPU, peak RSS and process count, link wall and artifact size; then the three edit classes with the crate DAG's PREDICTED rebuilt set pre-registered against cargo's observed rebuilt set. Pre-registered structural consequences if a derived cut is right: more than one admitted crate is ready during a nontrivial part of the build; cargo overlaps their compilation; observed rebuilt crates equal the predicted downstream closure after each edit; semantic outputs and refusals identical; the selected candidate wins under the declared field. Line share is not a bound on front-half time and is not a prediction. SEQUENCE: this is a standalone native-route realization cut with a current production consumer (the emitted native closure build) and a current displaced route (the one-crate writer), depending on no engine, fabric supply, cross-run store or width deletion -- it does NOT wait for M5. Its serial position is after M1.a (the JudgmentContract cut) and before M1.b (the keying-relation cut) and M1.c (the cross-run hit cut): it precedes M1.c because the selected `RustCratePartitionIdentity` is part of the compiler artifact's build configuration and therefore of its evaluation identity from the first persistent implementation; if the candidate field selects the one-crate baseline, D9 records that `SelectedWithin` result, performs no physical cut, and the sequence continues; if the runner envelope cannot honestly bound multi-crate cargo concurrency, the authority and A/B still complete and execution defers to M5 -- no `-j` setting belongs here. **Deferred:** trigger = the edge-provenance classification of the emitted reference graph and the candidate A/B above; until both exist this row admits no implementation. **Declared frontier waiting on this row (DESIGN §3c): cross-run materialization of the per-file pool heads reading.** Every entry-subject run re-derives the heads reading of every pool file (`v1_compiler.cli_run.pool_acquire` `heads_reading_for`; the `[pre-entry]` rows `pool_source_tokenize`, `pool_source_newline_index` and `pool_heads_parse`) because the declared-name index it feeds is a tree-subject fact each new process demands for the same tree: recurrence across processes, not authored duplication. Its request is a sibling variant of `std.materialization_provider` `ParseModuleRequest` with the same key fields (`source_digest`, `compiler`) and its own kind and output roster, the persisted value spelling-free with spans rebound on load, stored in the bounded local store under a per-family budget sized so the whole pool fits. It is not built, because its `compiler` input must be the identity of the tokenizer and heads parser alone: the running-binary hash re-keys on every commit, and a lane-local crate digest would be a second crate-identity mechanism beside this row. TRIGGER: D9's crate partition identity exists AND the front-end unit (`v1_compiler_tokenize` and `v1_compiler_parse`, below `v1_infer`) is a partition crate, so that crate's identity is the `compiler` input. CASE ON FILE, a one-off probe of 2026-10-03 and not an instrument (uncommitted test, release build, BuildBuddy runner, the live `dag` plus `src/v2` pool of 7417 files): recomputing every heads reading took 22.5 s (16.2 s under a timer that then covered lexing AND the newline index together, heads parse 6.3 s); reloading them from per-file `serde_json` took 3.3 s (read 0.12 s from a warm page cache, deserialize 3.17 s); 7417 of 7417 reloaded readings compared equal; the JSON was 777 MB for 98 MB of source. WHAT THE PROBE DID NOT TEST: it persisted and reloaded the reading AS IS, with the file spelling still in every span, so its equality count and its reload time are evidence about that form only. The proposed form (spelling-free, spans rebound on load) was not built, not compared and not timed; no pool file had a heads refusal, so a persisted refusal was never exercised. Owed before any build, and unmeasured: an executing comparison, over the live pool, of a fresh reading against the spelling-free persisted value after rebinding, covering the module node, diagnostic and refusal spans, and the file-local intern strings and occurrence-allocator end; the measured cost of that rebinding; the size of the spelling-free form (if it stays near that figure, a compact encoding through `std.materialization_object`'s versioned encoding rather than JSON), one cold-disk read, and the family budget declared from that measurement. The tree name census is a second candidate keyed over the heads digests of a source root's closure; it waits on this one, and `UniverseArtifactRequest` is checked as its family before any new variant.
 10. **D10 — Native production admission: when the v2-compiled route becomes the production semantic route.** Operator direction (2026-09-15): anchor on the native route now and root-cause disagreements over time; v1 is not the semantic oracle -- the authority is the modeled `JudgmentContract`, and a v1/v2 disagreement is evidence demanding investigation, with neither side winning by age. Two cuts stay separate: native v2 EXECUTION becoming the production semantic route (this row) and the self-hosted GENERATOR replacing the seed (D9 / §7, which still requires the complete generation judgment and refusal contract; a native evaluator may be production while the seed still generates it). Admission is a typed whole-route verdict, `NativeProductionAdmission = NativeProductionAdmitted { contract_identity, required_subject_denominator, result_contract_coverage, refusal_census, divergence_dispositions } | NativeProductionRefused { causes }`, requiring: a named denominator of the judgments and subjects the route promises to serve; total outcomes -- every demanded subject yields an admitted result or an attributed typed refusal; zero unattributed refusals; no contract-violating acceptance; no contract-violating refusal inside the required denominator; every v1/v2 divergence classified against the independent contract or source authority; and no interpreter fallback after the cut. A v2 refusal where v1 accepted is worked after cutover only when the refusal is correct under the contract or the subject lies outside the declared denominator with that boundary explicit -- deferring a false refusal of a valid required subject is not a complete production handler. After cutover, a red parity or admission result latches `NativeProductionRevertRequired` or stops new admissions and awaits an explicit operator disposition; it never silently re-executes the judgment through v1 (the current routing consumer's fall-back-to-interpreted arm is exactly the escape hatch this row deletes). Recommendation: adopt, and run the pre-anchor census of §1 as its first instrument. **Deferred:** trigger is that census reaching zero unattributed refusals with every divergence dispositioned, at which point the admission verdict is computed for the declared denominator; the interpreter-remains-production sentence in M3a is retired by this row's `NativeProductionAdmitted` and by nothing else.
-11. **D11 — Effects on the native route: the minimal set, and callability. Ruled 2026-09-16.** Scope (operator): Filesystem plus the Gap-B boundary of section 2.9 (argv, stdout/stderr, and the existing elapsed and peak-resident measurement seams) are realized in the emitted closure through bound realizations returning values; Clock, Network, Entropy and AuthContext are not realized by this program -- emitted interfaces refused by `NativeEffectRealizationAdmission`, outside D10's denominator; a scope ruling, not a drop. Callability (side-chat ruling, refined option (a)): resource operations are admissible in ORDINARY functions only through an explicit effect/resource requirement -- an effect envelope or capability parameter on the function -- and the entry realization supplies the matching handler; no ordinary function acquires an ambient global capability merely because a native handler exists. Option (b), entry folds as workflow functions, is refused: it makes 'workflow function' the price of any effect and pulls the workflow realization into every native entry, conflating a semantic effect requirement with one orchestration realization -- against this program's terminal goal of ordinary sequential programs receiving lawful realization for free. E1 falsifies the emitter's implementation of this ruling; it does not reopen it. The fork that option (b) would have deepened -- `uses` read as workflow identity -- is resolved by D12 below: the workflow-function concept is DELETED, not separated. There is no marker and no function-kind authority; executable-entry identity is the artifact-relative `compiler_pipeline_entry` (an executable has exactly one, a library none, and more than one or an unresolved driver refuses), never a property of a function; `uses` keeps its one meaning as an effect requirement; and sync/async derives from effects plus the bound handler, which the emitter was measured to key on `has_services` and `uses`, never on any entry role. **D11 terminal** (a condition of D10 and of this plan's dissolution): ordinary-function effect callability is implemented through explicit contracts; every in-denominator host effect has exactly one admitted native handler; unsupported effects produce typed admission refusals; the direct per-driver implementations those handlers displace are deleted; and the no-interpreter controls execute on the production route. A terminal D10 may not be reached by choosing a denominator that sidesteps this obligation.
+11. **D11 — Effects on the native route: the minimal set, and callability. Ruled 2026-09-16.** Scope (operator): Filesystem plus the Gap-B boundary of section 2.9 (argv, stdout/stderr, and the existing elapsed and peak-resident measurement seams) are realized in the emitted closure through bound realizations returning values; Clock, Network, Entropy and AuthContext are not realized by this program -- emitted interfaces refused by `NativeEffectRealizationAdmission`, outside D10's denominator; a scope ruling, not a drop. Callability (side-chat ruling, refined option (a)): resource operations are admissible in ORDINARY functions only through an explicit effect/resource requirement -- an effect envelope or capability parameter on the function -- and the entry realization supplies the matching handler; no ordinary function acquires an ambient global capability merely because a native handler exists. Option (b), entry folds as workflow functions, is refused: it makes 'workflow function' the price of any effect and pulls the workflow realization into every native entry, conflating a semantic effect requirement with one orchestration realization -- against this program's terminal goal of ordinary sequential programs receiving lawful realization for free. E1 falsifies the emitter's implementation of this ruling; it does not reopen it. The fork that option (b) would have deepened -- `uses` read as workflow identity -- is resolved by D12 below: the workflow-function concept is DELETED, not separated. There is no marker and no function-kind authority; executable-entry identity is the artifact-relative `compiler_pipeline_entry` (an executable has exactly one, a library none, and more than one or an unresolved driver refuses), never a property of a function; `uses` keeps its one meaning as an effect requirement; and sync/async derives from effects plus the bound handler, which the emitter was measured to key on `has_services` and `uses`, never on any entry role. **D11 terminal** (a condition of D10 and of this plan's dissolution): ordinary-function effect callability is implemented through explicit contracts; every in-denominator host effect has exactly one admitted native handler; unsupported effects produce typed admission refusals; the direct per-driver implementations those handlers displace are deleted; and the no-interpreter controls execute on the production route. A terminal D10 may not be reached by choosing a denominator that sidesteps this obligation. **Declared extension for native SERVICE entries (gentle-dove-36, 2026-10-04, extending this operator ruling of 2026-09-16):** a `NativeServeDriver` entry (first consumer the approval broker) is a different denominator from the compiler route, and in it Clock and Network are admitted; Entropy and AuthContext stay out, and the compiler route keeps this ruling whole. No transport is added: the broker's clock is the `extdeps.clock` `Clock` service on the existing shell transport and its outgoing HTTP is a `transport rest` service on the existing REST lowering, so each is admitted as the one handler `bind_operation_transport` already binds. The carrier, both denominators and the emission refusal are `v1.compiler.emit` `NativeEffectRealizationAdmission`, computed by `v1.compiler.emit_rust` `native_entry_effects`, and both native mains bind exactly the handlers it admits.
 12. **D12 -- Executable composition root and legacy workflow deletion. Ruled 2026-09-17 (operator + side-chat A').** Workflow was never a semantic kind: it was an emitter heuristic (`v1.compiler.emit_rust` `is_workflow_item`, true for `uses` present, a service or resource name in the registry, or a registry miss) whose sole product was the clap subcommands `emit_main_rs` rendered. The census that grounds the ruling: every built binary is single-entry through `compiler_pipeline_entry` and pulls no workflow function into its main; a closure with no entry already renders the typed exit-2 `emit_entry_point_absent_main_rs`; `v1.compiler.infer` gates no resource operation on workflow, since admissibility is the `uses` clause; and the `is_async` signature field had no reader. So deletion breaks no production binary. Entry identity is an artifact-relative RELATION carried by `compiler_pipeline_entry`; a multi-command surface, when one is demanded, is explicit dispatch data as `gunbc.cli_dispatch_surface` models it, not a function kind. The cut deletes `is_workflow_item`, `collect_workflow_funcs`, `WorkflowFunc`, `to_workflow_func`, `validate_workflow_param_defaults`, the `emit_main_rs` workflow arm, the imported-data-reference default folding that only that arm consumed, and the dead `is_async` field; it keeps `compiler_pipeline_entry` and the entry-absent refusal, and leaves `uses` as an effect requirement -- the legacy workflow population is not marked. Enrolled discriminators (`test.claim.entry_authority_witness_test`): adding a `uses` requirement or a service call does not change the entry population, so reintroducing `uses`, a service name or a registry miss as entry identity turns a regression control red; one declared entry is the sole root beside an effect; two declarations and an unmodeled driver each refuse. The witnesses whose subject was folding an imported data reference into a CLI default are deleted with the path, because that folding had no other consumer. This SUPERSEDES the D12-marker / FunctionRole direction and its migration of the legacy workflow population. D13 below refines the remaining `uses`-as-carrier sentence: for transparent bodies the requirement is derived, not authored.
 13. **D13 -- Derived dependency demand and provider binding. Ruled 2026-09-18 (operator).** This SUPERSEDES the E1b 'add uses to every call chain' migration -- that migration is not run. For a transparent (visible-body) function, dependency demand is DERIVED from resolved dependency and operation references, not authored in the header. Direct demand is produced once by resolution; transitive demand is derived over resolved call relations. The qualified carrier is DependencyDemand (the R1/#11401 derive-once-carry pattern): produced once by resolution, not re-read per backend. Dependency identity includes the logical SUBJECT (`source_tree` is not `output_tree`), not only the interface type. Opaque declarations (no body) carry explicit dependency contracts. Policy (may-not-use-Network, upper bounds) constrains the derived set; it is not an asserted use-list. Composition roots bind demanded subjects to admitted providers. Targets may closure-convert derived demands into explicit params or a typed environment. No source operation reaches an ambient host by name; absent or ambiguous provider is a typed refusal. Existing `uses` rows are classified before migration (USES-0); restating rows are deleted because they are derived, and binder / opaque / policy rows move to their owning carriers. A local `std::fs` impl is admitted as ONE Filesystem provider, not a second source-level operation surface. D13 refines D11's uses-as-carrier: the requirement is DERIVED for transparent bodies, authored only for opaque declarations, distinct subjects, and policy envelopes. USES-0 is the identity-grain join of authored `uses` rows against resolved direct-plus-transitive demand -- not a count equality -- and it decides the split; no `uses` row is added to a call chain and no `uses` row is deleted until that census is dispositioned. The analysis that holds the join is `docs/plans/uses-occurrence-census.md`. E2 shape under this ruling: CLI code references `source_tree.list` / `source_tree.try_read`; resolution binds the `source_tree` SUBJECT; the compiler derives direct and transitive DependencyDemand; the NativeCliDriver root binds LocalFilesystem (impl Filesystem: try_read -> `std::fs::read`, list -> `read_dir`); realization threads it; `std::fs` leaves main; tests bind InMemoryFilesystem. No bare `filesystem_try_read` / `filesystem_list` globals. `emit_file_call` stays renderer machinery reused internally, not the dependency model and not a handler.
 14. **D13 follow-up population.** Cut (c) measured its population, then main added more `uses` rows while it was in flight; those were carried unmeasured until a final-base census over 5ff323b6d29..4446f2e990f measured every authored row in the tree and, under the same criterion, deleted each one whose derived demand was nonempty EXCEPT the identities explicitly retained under EditedWitnessHasNoHermeticRoute. None had empty demand, so no function flipped from effectful to pure. What remains is two kinds of row, each named at the row identity USES-0 defined and each carrying the trigger that is true for IT rather than for its module. Rows the criterion cannot type: ordinary fns whose module does not resolve, one refusal probe that never will, and pattern declarations the criterion never ranged over. And rows MEASURED DELETABLE whose deletion is not yet landable: wet witnesses whose edit the floor would plan onto a hermetic route that has no arm for their operation. The retained rows, each with its trigger: test.probe.census_app_acquisition_forged_probe::mint_a_receipt_from_authored_standings (uses net: std.resources.Network; trigger: the probe declaration is deleted from the corpus -- its module refuses by design, so resolution will never type the row, and its identities leave with the probe); test.probe.census_app_acquisition_forged_probe::mint_a_receipt_from_authored_standings (uses fs: std.resources.Filesystem; trigger: the probe declaration is deleted from the corpus -- its module refuses by design, so resolution will never type the row, and its identities leave with the probe); test.manual.runner_microvm_lifecycle_wet_receipt::start_payload (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::clear_slice (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::slice_is_quiet (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::a_sigterm_ignoring_child_is_stopped_by_force (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::a_process_in_a_child_cgroup_is_found_and_the_flat_read_is_empty (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::a_missing_cgroup_events_is_unobservable_and_never_empty (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::show_property_reads_a_units_active_state (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::show_property_reads_a_units_environment (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::unit_property_text (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::the_unit_reports_the_attempt_invocation_id_it_was_started_with (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::a_unit_with_no_attempt_assignment_reads_as_unread (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::start_with_invocation (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::stop_incarnation_unit (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::a_successful_job_can_leave_the_cell_subtree_populated (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::the_cell_wide_force_ends_a_survivor_in_a_sibling_cgroup (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::the_cell_wide_force_ends_a_survivor_in_a_sibling_cgroup (uses fs: std.resources.Filesystem; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); test.manual.runner_microvm_lifecycle_wet_receipt::a_clean_slice_reads_empty_and_absent_paths_read_absent (uses net: std.resources.Network; trigger: extdeps.linux.cgroup_v2 ReadInterfaceFile gains a mock_response, so an edited witness in this module reaches a verdict on the floor's hermetic route instead of a route gap); gunbc.auth.credentials::gcp_secret_credential (uses net: std.resources.Network; trigger: derived demand ranges over pattern declarations); gunbc.auth.credentials::gcp_oauth_access_token_via_adc_refresh (uses net: std.resources.Network; trigger: derived demand ranges over pattern declarations); gunbc.auth.credentials::gcp_adc_token_from_credentials (uses net: std.resources.Network; trigger: derived demand ranges over pattern declarations); gunbc.auth.credentials::gcp_oauth_access_token_adc_for_path (uses net: std.resources.Network; trigger: derived demand ranges over pattern declarations); gunbc.tailscale_acl_phase2_credential::tailscale_acl_operator_ephemeral_credential (uses net: std.resources.Network; trigger: derived demand ranges over pattern declarations); gunbc.tailscale_acl_phase2_credential::tailscale_acl_credential_with_operator_token (uses net: std.resources.Network; trigger: derived demand ranges over pattern declarations); gunbc.assimilate.bmc_bootstrap_provision::bmc_bootstrap_provision_srv3 (uses net: std.resources.Network; trigger: derived demand ranges over pattern declarations).
diff --git a/docs/plans/dependency-acquisition-gap-analysis.md b/docs/plans/dependency-acquisition-gap-analysis.md
deleted file mode 100644
index 67346ef029a..00000000000
--- a/docs/plans/dependency-acquisition-gap-analysis.md
+++ /dev/null
@@ -1,172 +0,0 @@
-# Dependency acquisition: why every new dependency is a modeling project
-
-**Status:** gap analysis, 2026-09-07. Reached from a concrete blocker — the approval loop needs an
-ntfy server on srv1, and "install ntfy" turned out to be a slice rather than a data row. The
-question this answers is the operator's: *the convergence is supposed to handle this; what is the
-gap from here to there?*
-
-**Framing correction, operator, 2026-09-07:** fleet convergence "was never supposed to be host keys
-— I think we started making a world convergence but got halfway through like all things." That is
-the right frame and this document adopts it. What follows is not "convergence lacks a feature"; it
-is an inventory of which half got built.
-
----
-
-## 1. The finding
-
-**There is no `Dependency` concept.** There is no type whose inhabitants are "a piece of software
-this fleet depends on", and consequently no single place that answers *where does it come from, how
-is it verified, and how do we know it is present*.
-
-What exists instead is `gunbc.host_effect` `HostEffect`, a closed coproduct of **34 arms**. It is
-genuinely the world-convergence spine the operator describes — it has arms for host OS, BMC,
-deploys, runners, compile pools, and OS install media. But its vocabulary is **one arm per
-instance, not one arm per concept**, and at least eight of the 34 arms mean the same thing:
-
-`OsInstallActuatorToolchainEnsure` · `EnsureBuildCacheInstance` · `ProvisionCodexRuntime` ·
-`EnsureCompilePoolSlice` · `Srv3SeededInstallMediaToolchainEnsure` · `LiveDeployEnsureDependency` ·
-`EnsureActionsRunnerRelease` · `EnsureRunnerSlotDirectory`
-
-Every one of those is *ensure some software is present and configured on a host*. A world
-convergence with one arm per thing in the world is an **enumeration wearing a convergence's name**,
-and its cost per new dependency is constant — it never amortizes. That is DESIGN §2 exactly: the
-same work, duplicated once per dependency, priced as if each were new.
-
-## 2. The census — six dependencies, five mechanisms, five homes
-
-| dependency | acquisition mechanism | authority home | actuated through |
-|---|---|---|---|
-| tailscale, tmux | apt package, `dpkg -s` guard then `apt-get install` | `live_deploy.spec` `EnsuredDependencyKind` | `LiveDeployEnsureDependency` |
-| docker-ce | third-party apt repo + **pinned GPG fingerprint** | `extdeps.container.docker_ce` | `runner_host_docker_provision_script` |
-| sccache | pinned GitHub release tarball + **per-arch sha256** | `extdeps.cache.sccache` | `EnsureBuildCacheInstance` |
-| actions-runner | GitHub release artifact | `extdeps.github.actions_runner` | `EnsureActionsRunnerRelease` |
-| codex | npm registry + lockfile integrity | `gunbc.package_delivery` (3,391 lines) | `ProvisionCodexRuntime` |
-| **npm itself** | **a prose string** | `gunbc.host_cli_dependency` | **nothing** |
-
-The verification posture is good and was clearly reasoned each time — docker's keyring fingerprint
-is pinned against a published fact, sccache's tarball is sha256-verified per architecture. **The
-defect is not rigor; it is that the rigor was re-derived from scratch six times**, and lives in
-five modules that share no vocabulary.
-
-### The last row is the class the operator named
-
-`gunbc.host_cli_dependency` carries the fallback for a dependency with no bespoke arm.
-
-The roster is `gunbc.host_cli_dependency` `codex_wet_materialization_host_cli_requirements`, walked
-by `first_absent_host_cli_dependency` and observed through `observe_host_cli_dependency`. Read those
-declarations rather than a copy of them here — §6, name the instrument rather than transcribing its
-output, and §3, cite the symbol rather than a positional or duplicated copy.
-
-**Updated by #11061, because that change falsified how this section used to make its point.** It
-transcribed the row as it then stood and observed that its `provision` field was a `NonEmptyStr` —
-"an instruction to a human, typed as a string". That field is gone: the requirement wrapper carried
-a tool NAME resolved back to a `CliTool` by a hand-rolled if-chain, and carrying the `CliTool`
-itself made the unresolvable row unconstructible, which deleted the resolver, its unresolved arm,
-and the `provision` prose that only fed that arm. The roster is now a plain `List<CliTool>`, and
-the install sentence a refusal carries is derived from `CliTool.installable_via` through
-`install_hint` rather than authored beside it.
-
-**That narrows the defect below without dissolving it.** The hint is no longer a free-text sentence
-that can disagree with the tool it describes; it is derived from the tool's own declared install
-sources. But `installable_via` is still a description of how a human would install the thing, not a
-route anything executes — `SourceApt { package }` names a package, and no modeled effect consumes it
-to converge a host. So the paragraph that follows was written about `provision` and remains true of
-`installable_via`: what changed is that the sentence is now derived rather than authored, not that
-anything acquires the dependency.
-
-It is worth being precise about what is and is not wrong here, because the obvious reading is the
-wrong one. The module's *refusal* behaviour is correct and deliberately so: an absent tool stops
-with a typed `HostDependencyAbsent` carrying tool and hint, and the module's own annotation says
-"absent npm stops as HostDependencyAbsent, **never auto-install inside the witness**". That is
-§5 fail-closed, and auto-installing inside a witness would be the absorbing fallback.
-
-**The defect is that the refusal has no route to a fix.** It hands a person a sentence — derived
-from the tool's declared install sources since #11061, but still only a sentence — and there is
-no modeled thing that sentence refers to — so the convergence cannot act on it, no census can count
-what is unprovisioned, and nothing goes red when the hint rots. An unmodeled dependency is invisible
-to every instrument that would otherwise rank it for work.
-
-## 3. The gap is already named by the corpus
-
-This is not an unrecognized problem. `extdeps.cache.sccache` states it in its own dissolution
-trigger:
-
-> It dissolves when `host_effect_apply` binds a **verified-download-plus-install effect
-> (FetchAndVerify then InstallBinary)** without the shell leaf, at which point
-> `sccache_install_script` is deleted rather than edited.
-
-Neither `FetchAndVerify` nor `InstallBinary` exists anywhere in the corpus — grep returns exactly
-that one comment. The missing concept was identified, its dissolution trigger was written, and the
-capability was never built. `extdeps.container.docker_ce` carries a parallel trigger for the same
-reason.
-
-So `sccache_install_script` and `docker_ce_repo_install_script` remain **shell leaves**: install
-sequences assembled as strings, typed as `String`, with the modeled row supplying only version and
-digest. The shell-leaf residue and the missing `Dependency` concept are **one gap seen twice**.
-
-## 4. What "install ntfy" costs today
-
-Concretely, why the blocker is a slice and not a row. Adding ntfy through the existing shape
-requires:
-
-1. a new `extdeps` module for the release, its version and per-arch digests (sccache's shape);
-2. a **35th `HostEffect` arm**, plus its realize handler and its plan handler;
-3. an actuation site — `live_deploy` (scheduled for deletion) or `runner_host_deploy` (runner-scoped, and ntfy is not a runner concern);
-4. a shell-leaf install script that lands already carrying a dissolution trigger it cannot discharge;
-5. a systemd unit, which has no general home either — units are emitted per service family (`RunnerUnitStanding`, `LaunchUnitStanding`) rather than by one authority.
-
-Five pieces of bespoke modeling to install one binary — and every one of them is work the *next*
-dependency will do again from scratch. **That is the cost the operator is feeling, and it is a real
-cost rather than an impression.**
-
-## 5. The route
-
-The shape of the repair follows from §2: model the concept once, derive every use.
-
-**Phase 1 — `Dependency` in `extdeps`.** Identity, version, and an acquisition source as a
-coproduct over the mechanisms already in evidence:
-
-```
-AptPackage { package }
-AptRepoPackage { package, repo_url, keyring_url, keyring_path, keyring_fingerprint }
-PinnedRelease { url_template, digest_by_arch }
-NpmPackage { name, lock_integrity }
-```
-
-Every arm is a shape the corpus already implements correctly somewhere — this is decompression and
-reduction of existing rows, not invention. Verification stops being per-dependency diligence and
-becomes a property of the arm: a `PinnedRelease` **cannot be constructed without a digest**, which
-moves supply-chain verification from §4b rung 1 (each author remembered) to rung 4 (unwritable
-otherwise). That is the safety payoff, and it is larger than the DRY payoff.
-
-**Phase 2 — one arm.** `EnsureDependency { dep: Dependency }` replaces the bespoke arms; the six
-existing dependencies become **data rows**. This is a §3 replacement migration and it must cut at
-the root: build the arm, move all six at once, delete the old arms and their shell leaves in the
-same motion. Six is a tractable atomic cut, and a surviving `EnsuredDependencyKind` would be an
-attractor — every later dependency would be answered in its vocabulary.
-
-**Phase 3 — the prose route closes.** Stated against `provision: NonEmptyStr` when written; #11061
-deleted that field, so the subject is now the install sentence `host_cli_dependency` derives from
-`CliTool.installable_via` through `install_hint`. The phase is unchanged in substance: that
-derivation becomes a reference to a `Dependency`, so the refusal *names the acquisition that would
-satisfy it* and an absent tool is a routable obligation rather than a sentence — derived prose is
-still prose. Unprovisioned dependencies become countable only at that point.
-
-**Phase 4 — ntfy is a data row**, and so is the next one.
-
-**Ordering note.** Phase 1 is worth landing on its own even if Phase 2 waits: it is additive, it
-gives the digest-by-construction win immediately, and the six existing rows can migrate one at a
-time *into* it. Phase 2's cut is what must be atomic — not the whole program.
-
-## 6. What this does not settle
-
-- **Units.** `EnsureDependency` gets the binary onto the host; it does not run it. Unit emission has
-  no general authority either (`live_deploy` for apps, per-family standings elsewhere), and that is
-  a **separate half-built convergence** deserving its own analysis. The ntfy work needs both.
-- **`live_deploy`'s disposition.** It holds app deployment members and the only working apt-ensure
-  path, and is scheduled for deletion with no declared cut. Phase 2 would take the apt path out of
-  it, which makes the cut smaller — but does not make it.
-- **ntfy's actual packaging.** Whether ntfy ships an apt repo, a `.deb`, or only a release tarball
-  was **not verified while writing this** (no apt available in the session container). It changes
-  which arm the row uses and nothing structural, but it should be checked rather than assumed
-  before the row is written.
diff --git a/docs/plans/deploy-convergence-observed-side.md b/docs/plans/deploy-convergence-observed-side.md
index 753fcc68608..eebf2b8a754 100644
--- a/docs/plans/deploy-convergence-observed-side.md
+++ b/docs/plans/deploy-convergence-observed-side.md
@@ -85,7 +85,7 @@ And it is this record's own class once more: repository revision equality is a s
 
 Three placements, and the question was which one -- the answer is that they are three different boundaries and all three are required. **At the OPERATION boundary**, a publication plan must be unconstructible without a guard proving release-consuming actuators are quiesced: the guard is a required field, so an unguarded publication has no constructor rather than being refused by a check. **At the PARENT TRANSACTION boundary**, that same frozen plan must acquire the quiescence, publish, verify, and restore actuation automatically -- because a guard supplied from outside would leave the fleet permanently undeployable (the belt is normally enabled), so someone disables it, retries, and re-enables by hand, which is out-of-band convergence wearing a safety label. **In the STEADY-STATE model**, belt admission must consume a coherent release identity rather than a repository revision.
 
-**The objection that made this look like a new ownership claim was wrong, and it was mine.** `BeltTimerUnit` is already a live-deploy OWNED artifact kind -- its upsert installs and enables the unit, its teardown disables and removes it -- so deployment already owns that lifecycle. What changes is not who owns it but that the dependency becomes honest instead of relying on apply-all moving everything fast enough.
+**The objection that made this look like a new ownership claim was wrong, and it was mine.** `BeltEventPathUnit` is already a live-deploy OWNED artifact kind -- its upsert installs and enables the unit, its teardown disables and removes it -- so deployment already owns that lifecycle. What changes is not who owns it but that the dependency becomes honest instead of relying on apply-all moving everything fast enough.
 
 **The fourth requirement sits underneath all three: the quiescence authority must span admission THROUGH actuation.** A check performed before a dispatch, followed by an unrelated mutation, is another time-of-check/time-of-use gap -- a tick that passed admission a moment before deploy acquired quiescence still executes during publication. So two mechanisms are needed, not one: a PERSISTENT inhibition that survives process failure, so a deploy that dies after publishing the tree and before restarting the service leaves the belt still refusing and the next converge resumes or rolls back with no operator re-enabling anything; and an EXECUTION LEASE that both sides hold, deploy exclusively from its final pre-mutation observation through read-back, every release-consuming belt path shared from its standing read through operation commitment. A lock that serializes only two deployment runs does not protect against the third actuator.
 
diff --git a/docs/plans/deployment-risk-conformance.md b/docs/plans/deployment-risk-conformance.md
deleted file mode 100644
index 0aaf1789486..00000000000
--- a/docs/plans/deployment-risk-conformance.md
+++ /dev/null
@@ -1,41 +0,0 @@
-# Deployment-risk conformance
-
-Operator direction 2026-10-03; vocabulary fixed the same day by a side-chat ruling relayed through silent-lark-156. Home: `gunbc.deployment_risk`.
-
-## Terms (approved; use these names)
-
-| Term | Meaning | Is NOT |
-|---|---|---|
-| `DeploymentId` | the stable identity of one Deployment whose desired state, mutable state, and external attachments move together; an instance realizes that Deployment and carries this identity | a host, machine, process, release stage, dashboard `instance_id` |
-| `DeploymentRiskClass = TestRisk \| ProdRisk` | coarse harm class, DERIVED from `ProdRoleSelection` only | a number, machine qualification, stage, branch, host |
-| `DeploymentHarmMagnitudeBet` | Fermi order of magnitude of harm conditional on doing the wrong thing, typed as a §4d bet | a probability, a fact, the class, an SLA |
-| `ProdRoleSelection = NoProdRole \| ProdRoleHeldBy { deployment }` | the sole switch (`prod_role_selection`) | inferred from srv1, "live", main, a host |
-| `DeploymentExternalBindingSet` | the external attachments of exactly one class; absent set refuses | a fallback, a shared default, a borrow |
-| `DeploymentRiskInterface` | what each deployment exposes (identity, harm bet) and consumes (class, bindings) | a `DeploymentSpec`, an actuator, a stage model |
-| `DeploymentReleaseStage` | independent rollout axis | out of scope; next candidate |
-
-`DesiredDeployment` (selection row) and `DeploymentSpec` (desired realization) stay distinct from `DeploymentId`. `MachineOperatingEnvironment` is replaced by `MachineQualificationPolicy { admits: DeploymentRiskClass }`: a machine admits a class, never holds one. A `ProdRoleHeldBy` assignment refuses unless its host admits `ProdRisk`.
-
-## Deliverables
-
-1. **Model** (this PR): `gunbc.deployment_risk`; `HostDashboardInstance.deployment` (required, all six constructors); `dashboard_instance_risk_class`; the failure-mode row `a_test_deployment_acts_on_the_prod_deployments_state`; RED `test.claim.deployment_risk_witness_test`.
-   - Declared frontier (§3c): `resolve_deployment_bindings` and `dashboard_instance_risk_class` gain production consumers in deliverables 2 and 3.1.
-   - Deferred to deliverable 2 (review 74937): `DeploymentRiskInterface` and `DeploymentHarmMagnitudeBet` land with their first executing consumer, the operator-disposition gate (which actions on a deployment need an operator), and the bet's magnitude is grounded as an order of magnitude over `std.measure` `Duration`, not a bare `Int`.
-1b. **Machine qualification migration**: one motion over machine_intake (re-census on main first; coordinate warm-crane-577's mtcollins1 untangle lane). eager-gull-22 handed it to this lane.
-2. **Repoint the prod pins** through `prod_role_selection` (broker owner, fabric storage placement, approval client/store/trust, serve/dispatch entry points, apply's prod peer → `DashboardProtectedSibling`, `fleet_reach_endpoint`). RED: a fixture selection moves the broker owner and storage placement.
-3. **Split shared bindings**, one PR each: ntfy → Codex account/home → admitted ref → publication identity/GitHub App → R2/GCP → OIDC. Each adds a field to `DeploymentExternalBindingSet` and either a TestRisk resource (operator approval first) or a standing refusal.
-4. **One spec per deployment**; retire the `live_deploy.desired` rung drop by its own trigger. Renames: `srv1_production_desired_deployment → srv1_primary_desired_deployment`, `roadmap_belt_production_spawn_mode → roadmap_belt_operational_spawn_mode`.
-5. **Conformance row** `deployment-risk conformance` in `gunbc.design_argument conformance_domains`, once the home is consumed.
-
-Widened scope (side chat): classify every convergence subject as deployment-bound (Spark serving/experiments/seat grants, fabric storage, approval broker, R2 keyed by class + `BucketPurpose`, IAM targets, DNS/routes/certs, runner workloads, mutable caches), host-shared (Spark Wi-Fi/SSH/admin grants, KVM, base networking, toolchains), or fleet-control (root IAM writer, account admin). Pure computation identity and content-addressed outputs gain no deployment key. Manual convergence requests take `DeploymentConvergence { deployment } | HostResourceConvergence { host, resource } | FleetControlConvergence { operation }`.
-
-## Shared-binding table (as of deliverable 1)
-
-| Binding | State | Reason |
-|---|---|---|
-| ntfy topic | modeled in the binding set; ProdRisk only; TestRisk **refuses** at the resolver | broker path still reads `approval_ntfy_topic` directly until 3.1 |
-| GitHub App (publication) | modeled; ProdRisk only; TestRisk **refuses** at the resolver | publishers still name `gunbai_*_declared` until 3.4 |
-| Codex account and home | still shared | 3.2 |
-| admitted ref | still shared (labs on `refs/fleet/desired`) | 3.3 |
-| R2 / GCP / WIF | still shared | 3.5; coordinate royal-moth-86 (#13035) |
-| OIDC client | still shared, unmodeled | 3.6 |
diff --git a/docs/plans/derived-node-identity-design.md b/docs/plans/derived-node-identity-design.md
deleted file mode 100644
index 49fcf128cc2..00000000000
--- a/docs/plans/derived-node-identity-design.md
+++ /dev/null
@@ -1,184 +0,0 @@
-# Derived-node identity in v1 infer
-
-Status: step 1 landed (#12913, #12914); step 2 scheduled 2026-10-04, starting with §7's instrument.
-Owner: jolly-pike-330 (staffed by gentle-dove-36); scheduled by gentle-dove-36 on neat-boar-16's
-handoff, 2026-10-04. Step 1 owner: clever-lynx-801. Ruling: quiet-gull-780, 2026-10-01.
-Class row: `gunbc.recurring_failure_mode` `generic_identity_decided_by_spelling`.
-
-## 1. The question
-
-When `v1.compiler.infer` **builds** a type node after resolution, what identity does that node
-carry, and who says so?
-
-"Builds" covers:
-- substituting a generic's binding into a signature,
-- instantiating a generic record's fields or an alias chain,
-- forming a call plan's formals,
-- minting a kernel container type for a value.
-
-Today the answer is: whatever spelling the node happens to have. Every consumer that needs to know
-whether a node *is* a generic parameter, rather than merely spelled like one, has nothing else to
-read. This note models the identity those nodes must carry.
-
-## 2. What was measured (not inferred)
-
-These facts locate the problem. Their magnitudes are deliberately not transcribed (DESIGN §6);
-§7 names the instrument that re-derives them.
-
-- **The spelling collides by construction.** The kernel container type names its element child
-  after its own template parameter. Every `List<M>` therefore carries a child spelled `T` and
-  resolved to `M`, and it collides with any generic parameter also spelled `T`.
-- **Three sites decide generic identity by spelling:**
-  - `unify_generics` binds a bare formal by its label;
-  - `substitute_generics_apply` replaces a bare node by its label;
-  - that function's self-binding guard compares labels.
-- **Two identity facts already exist after resolution.** Neither reaches the nodes infer builds:
-  - `TypeVariable` (inferred) is bound to each declared parameter by
-    `v1.compiler.infer_env` `env_with_type_variable_bindings`. Its id is the bare parameter name.
-  - `Node.declaration = (owner, TypeParameter { name })` is written by `v1.compiler.resolve`
-    `binder_marked_type` (#12690) on authored signature positions: parameter types, returns, type
-    arguments, declaration fields and arrow positions.
-- **Coverage, measured over the whole-corpus compile.** A large share of generic bind and
-  substitute events act on nodes that carry neither fact in a usable form. They come from about a
-  dozen constructors, listed on the class row, led by `infer_call_arguments_generic_pass` and
-  `build_call_application_plan`. No magnitudes are given here: per DESIGN §6 they belong to the
-  instrument (§7), not to prose.
-- **What happened when each fact was read alone.** Reading the `TypeVariable` mark made the
-  compiler's next generation refuse its own sources: generic record fields arrive unmarked. Reading
-  the declaration mark would stop substituting at every event the constructors above produce.
-
-## 3. Hypotheses step 2 must settle first (labelled as bets, DESIGN §4d)
-
-1. **Read before marking, not lost in copying.** The unmarked call-plan formals are read from a
-   signature representation built before `binder_marked_type` runs, not lost while copying.
-   `v1.compiler.infer` `bind_local_func_conformance` builds `ResolvedFormal.declared_type` from
-   `param_node_type_expr` of the func-env signature. If that signature predates marking, the repair
-   at those two sites is to read the marked signature, not to add a carrier. The test is the same
-   instrument, tagged by whether the node is reachable from a marked signature.
-2. **`substitute_generics_apply` keeps its input's declaration.** It already copies
-   `n.declaration` into the node it rebuilds, so it is not a loss site. Its *output* node, the
-   binding, carries the binding's identity, which is correct.
-3. **The kernel element child needs no parameter spelling.** Its identity is "element position
-   of this container". The open question is whether any reader depends on the child being spelled
-   `T`. The instrument answers it by deleting the spelling and listing what breaks; quiet-gull-780
-   asked for that reader to be named.
-
-## 4. The model
-
-A derived type node carries exactly one **origin**, named by the constructor that builds it, never
-reconstructed from the node's shape (bold-fox-455's constraint):
-
-```dag
-type DerivedTypeOrigin
-  = CarriedDeclaration { declaration: DeclarationRef }    // a copy keeps the identity it was given
-  | ParameterBinding { parameter: DeclarationRef }         // the node a generic parameter was bound to
-  | KernelElementPosition { container: KernelContainer, position: Int }
-  | DerivationRefused { constructor: NonEmptyStr, cause: NonEmptyStr }
-```
-
-- **`CarriedDeclaration`** is the default for every copy. A constructor that rebuilds a node from
-  another node carries the input's declaration unchanged. This is the copy law, and most of the
-  inventory falls under it.
-- **`ParameterBinding`** names the generic parameter a substituted node stands in for. It is
-  needed only where a consumer asks "which parameter did this come from" (cross-owner keying, §6).
-- **`KernelElementPosition`** replaces the spelled `T`. A container's element child is identified
-  by its position in a kernel container and is never mistaken for a `TypeParameter`.
-- **`DerivationRefused`** is the fail-closed arm. A constructor that cannot name an origin refuses,
-  located at the constructor. It never falls back to the spelling.
-
-Generic identity at the three sites becomes: a node is generic parameter `p` exactly when its
-origin is `CarriedDeclaration` with `field: TypeParameter`, or a `ParameterBinding` to `p` whose
-binding is `p` itself. A self-binding is identity equality. Spelling never enters the decision.
-
-**Laws** (the step-1 carrier states these and its control executes them):
-- **L1, copy:** a copied node's origin equals its input's origin.
-- **L2, no shape inference:** a constructor that builds a node names its origin, and two nodes
-  that are structurally equal but have different origins stay distinct.
-- **L3, kernel distinctness:** a `KernelElementPosition` origin is never a `TypeParameter` identity,
-  whatever its spelling.
-- **L4, refusal:** `DerivationRefused` is never read as a generic parameter or as a concrete type;
-  a consumer reaching it refuses.
-
-## 5. Its own relation, or an extension of an existing one (DESIGN §3b)
-
-This is **not a new keying relation**, and **not an extension of `std.occurrence_identity`**.
-
-- **Not #12790.** Occurrence identity answers "which authored occurrence". The nodes in question
-  are built by infer and have no authored occurrence, so allocating one would infer their cause
-  from their shape. That is option A, which 3e already rejected for the same reason.
-- **Not the facts site key (3e).** That key answers "which site of one inferred tree a fact is
-  about". It is positional inside one tree and says nothing about what a node denotes.
-- **The same relation as `std.decl_ref`, carried further.** Its relation is "this node denotes this
-  declaration-level entity". The model extends where that identity is *carried*, through infer's
-  constructors, and adds the two arms `DeclarationRef` cannot express: a kernel element position
-  and a refusal.
-
-**Reconciliation with A′** (`keying-relation-design.md` §3e, declared model item): A′ is "identity
-for every node at infer's input, with each builder naming its cause". This note is A′'s
-type-level interior: the same constraint, that builders name their cause, applied to the type
-nodes infer builds *inside* the stage. They are one model item, not two. If A′ lands, its
-input-side origins and these interior origins are arms of one carrier. This note's carrier is
-named and placed so A′ extends it rather than forking it.
-
-**Scope:** type nodes built by `v1.compiler.infer` after resolution, covering the dozen
-constructors inventoried in §2. The following are outside this note:
-- value-expression nodes;
-- other stages;
-- v2 infer, which has its own carrier work (#12763 and its line).
-
-## 6. Sequencing
-
-1. **Step 1, in two PRs, with no infer edits:**
-   - **1a (#12913):** this note and the class row.
-   - **1b (#12914):** the std carrier `std.derived_type_origin`, which declares `DerivedTypeOrigin`
-     and `GenericIdentityVerdict`, and its control `test.claim.derived_type_origin_witness_test`,
-     which executes L1 to L4 over supplied origins. Until step 2 lands, that control is the
-     carrier's only consumer, a declared frontier whose trigger is step 2 (DESIGN §3c).
-2. **Step 2:** first settle §3's three bets with the instrument. Then carry origins through the
-   inventoried constructors, switch the three sites to identity, and delete their name branches.
-   The evidence is:
-   - the compiler's next generation builds and compiles its own sources (the control that caught
-     the first attempt);
-   - a whole-corpus census in both directions at identity grain;
-   - the srv3 witness, the `00_compile` native-lane site, and `head_of(xs: [1], d: 2)` into a
-     String parameter.
-
-   **Step 2 does not wait on the site-keyed facts store** (struck 2026-10-04, gentle-dove-36). This
-   note used to sequence step 2 after that work "because both rewrite infer's copying paths". They
-   are two modules both named infer, and they share no symbol:
-   - step 2 edits `v1.compiler.infer` (`unify_generics`, `substitute_generics_apply`,
-     `infer_call_arguments_generic_pass`, `build_call_application_plan`,
-     `bind_local_func_conformance`, `infer_record_lit_structural`) and `v1.compiler.infer_env`
-     `env_with_type_variable_bindings`, which copy type nodes;
-   - the facts store edits `v2.compiler.infer` (`inferred_facts_map_enter`,
-     `facts_map_from_entries`, `inferred_facts_witness_for_node`) and the readers of
-     `InferredTree.facts` in v2 eval, emit, translate and the lenses, which key a facts table.
-
-   `v1.compiler.infer` imports nothing from v2 and holds no facts table, and §5 already scopes v2
-   infer out of this note. The facts store was never built past its model
-   (`keying-relation-design.md` §3e) and has no owner. The one indirect link: step 2's
-   next-generation control compiles `src/v2`, so a facts conversion landing during step 2 changes
-   that control's corpus, not step 2's code.
-   **Residue admitted to step 2** (quiet-gull-780, 2026-10-01, via clever-newt-773): a generic
-   variant literal with no expected type, such as `Cons { head, tail }` at
-   `gunbc.spark.host_commitment`, is typed as its parent's *unapplied* declaration in
-   `v1.compiler.infer` `infer_record_lit_structural` (`raw_resolved`). Instantiating it from its
-   field values needs an applied-type constructor that carries identity, which is this model's
-   `ParameterBinding` origin. It is left to step 2 rather than added as another spelling-keyed
-   instantiation site.
-3. **Then:** re-key the substitution map by the `TypeParameter` declaration
-   `(owner, declaration, name)`, so two owners' parameters spelled alike cannot share a key. This
-   is a separate PR, and the first production reader of #12690's field for this population.
-
-## 7. Instrument
-
-- **What it measures.** For each event in which `unify_generics` or `substitute_generics_apply`
-  binds or substitutes a generic, whether the node carries a `TypeParameter` declaration, and its
-  two nearest infer callers. It runs over the whole-corpus compile, `gunbc compile --source-root dag
-  --source-root src/v2 --target dag --repository gunbc --measured-root-demands
-  tools/whole_corpus_compile_measured_root_demands.json`.
-- **Not yet an entry point.** The one measurement taken so far was a local, uncommitted probe on
-  main `b793732902`. It is a one-off, so its numbers are not quoted in this note or on the row.
-  Step 2's first task is to make it an instrument: a `gunbc test` label over the same compile,
-  reporting by constructor. The step-2 decisions rest on its output, not on any figure written
-  here.
diff --git a/docs/plans/dogfood-route-manual-interventions.md b/docs/plans/dogfood-route-manual-interventions.md
deleted file mode 100644
index 490651cee3e..00000000000
--- a/docs/plans/dogfood-route-manual-interventions.md
+++ /dev/null
@@ -1,175 +0,0 @@
-# Dogfood route: the manual interventions, dispositioned
-
-Status: plan, operator-agreed 2026-10-03. Each functional row below lands under the home it names. `factory-dogfood-route` (gunbc#13077) consumes their receipts, or carries dependency edges where they gate the qualifying route. Its lane coordinates route integration; it does not own every underlying capability.
-
-## Why this exists
-
-The first end-to-end attempt on srv2 (attempt `01feb0b65dee1377`, node `shell-dag-live-deploy-restart-tailscale`) did its work: 40 steps on a group-b seat, ending at its planned alignment checkpoint (exit 3). It never reached a PR, because every belt tick after about 06:50 UTC hit its start timeout and was killed. Getting it that far took six kinds of hand intervention. The operator's go/no-go on external customers is their own confidence from dogfooding, and a route that needs a person to keep it moving is not yet that evidence.
-
-This document records each intervention, what it exposed, what must become automatic, what stays with the operator, and the test that must go red first.
-
-## Three properties, not one
-
-Each intervention was first read as "make it idempotent / retryable". That conflates three properties:
-
-1. **Safe to retry**: repeating an operation cannot duplicate or corrupt its effect. Required everywhere.
-2. **Convergent**: desired state and observed state decide Noop, Apply or Refuse. Required everywhere.
-3. **Automatically repaired**: the controller chooses and applies the repair with no operator. A policy choice, and today the answer is **no**.
-
-`gunbc.ensure` `EnsurePolicy` already carries the distinction. `EnsureObserveOnly` refuses a mismatch; `EnsureMayApply` applies an available plan. Convergence therefore does not imply self-healing. It can converge to a safe, visible state and stop there.
-
-### Operator ruling (2026-10-03): manual resume, for now
-
-A crash or failure is observed by a person, root-caused, then resumed by hand, until there is confidence in the automated remedy. This is DESIGN §5's factory model: the line stops, and the stop is analysed before restart. What the system owes is that the stop is loud and located, and that the operator's resume is a single retry-safe action.
-
-### The incident shape every intervention below uses
-
-```text
-normal desired state
-  -> fault observed
-safe incident state
-  evidence captured
-  route or work withdrawn where necessary
-  AwaitingOperatorDisposition
-  -> operator records a disposition, keyed by incident identity
-ResumeRequested | AbandonRequested | ClearRequested | QuarantineRequested
-  -> ensure
-Noop | Apply | Refuse
-```
-
-Every disposition effect is keyed by its incident identity, so running it twice is a no-op. A crash after the effect but before its receipt re-observes the subject and finds the effect already done.
-
-The same rule applies to every outward effect on the route: "open the PR" means "ensure logical work item X has exactly one PR". An attempt or candidate revision updates that PR; it never acquires a second PR identity. After uncertain remote success, observe before create. The attempt identity may key the publication operation and its receipt, but not the PR itself. Pushes, comments and R2 writes follow the same rule.
-
-## The six interventions
-
-### 1. Stale units cleared by hand, three times
-
-**Exposed:** exited worker and supervisor units blocked redispatch until a teardown pass ran. With the timer off, they had to be cleared by hand, and the clearing left no record. #13066 records the same follow-up.
-
-**Automation owed:**
-- observe the terminal or lease-expired unit;
-- bind it to one incident identity;
-- preserve its status, journal, attempt, lease and process evidence;
-- stop counting it as live;
-- withhold any replacement attempt until a disposition is recorded.
-
-A lease deadline (`std.temporal_effect` `HeldLease`) establishes `TerminalOrLeaseExpired`. It never by itself kills, deletes or restarts.
-
-**Stays manual:** the root cause, and the choice of Resume, Abandon, Clear or Quarantine.
-
-**Home:** the factory attempt lifecycle, consumed by `factory-dogfood-route`.
-
-**RED first:** kill a worker mid-turn. The unit is reported stale under one incident identity, with evidence preserved, and no replacement spawns. Recording `ClearIncident` twice changes nothing the second time.
-
-### 2. srv10 Wi-Fi restored by hand
-
-**Operator ruling:** the Sparks will serve on Wi-Fi for a while, and that is a valid medium. Why the link dropped still needs debugging.
-
-**Exposed:** a host lost its network and stayed routable.
-
-**Automation owed:**
-- a missing or stale health receipt withdraws the host from routing;
-- link evidence is captured before reconnection obscures it: association state, addressing and routing state, relevant service and driver evidence, and timestamps.
-
-A fresh health reading may say the host is technically available again, while a separate unresolved incident keeps it operator-held.
-
-**Stays manual:** the diagnosis, and returning the host to service.
-
-**Home:** fabric host health (`gunbc.fleet_health`) and network incident handling, with an edge into the route. The existing roadmap row "A host serves only on a fresh satisfied health receipt" is the admission half.
-
-**RED first:** drop Wi-Fi while the serving process stays alive. The host leaves the routable population, the incident evidence survives reconnection, and the host does not return until the operator's disposition permits it.
-
-### 3. Untracked senders on group-b, paused or killed by hand
-
-**Exposed:** a second door. Seat admission (`gunbc.serving.turn_admission` `serving_group_admission`) is not the only path onto group-b.
-
-**Operator ruling:** move the other senders onto seat admission, and add authentication to the Spark deployments through a real auth process, so every caller is forced onto the right path.
-
-**Authentication alone does not close the door.** A caller with a valid general-purpose credential could still bypass the seat ledger. The forwarding boundary needs both:
-- an authenticated caller identity; **and**
-- a current serving grant naming the admitted serving launch, the granted route or group, the seat entitlement, the caller or work identity, and an expiry or revocation boundary.
-
-A practical realization is a short-lived signed request permit minted by successful seat admission. A Spark-side front door verifies it before forwarding to vLLM, and refuses before the engine sees the request.
-
-**Stays manual:** migrating the existing senders, and deciding which identities may request grants.
-
-**Home:** managed identity owns the credentials (`credential-lifecycle-revocation`, gunbc#13068); serving and capacity own request admission and grant validation.
-
-**RED first:** a request with a valid caller credential and no seat grant is refused at the front door, and the refusal is counted.
-
-### 4. Belt timer started by hand
-
-**Operator ruling:** event-driven wherever possible, not timer-driven.
-
-**Automation owed:**
-- events invoke the smallest affected obligation directly;
-- deadline-bearing obligations schedule a one-shot wake-up;
-- a bounded anti-entropy sweep discovers missed events and **queues** them. It never performs the work itself.
-
-**Stays manual:** only typed refusals and incident dispositions.
-
-**Home:** factory controller and event delivery. The timer is not a product requirement and does not become a desired-state row.
-
-**RED first:** with no timer installed, a worker exit causes its capture to run.
-
-### 5. #13066 deployed to srv2 by hand
-
-**Exposed:** srv2 runs `cc5bbdcc` plus the #13066 commit, placed by hand. The model exists: `gunbc.live_deploy.desired` declares srv1-live, srv1-lab and srv2-deploy (`srv2_deploy_desired_deployment`) beside `repository_convergence`. What was missing is converging an admitted revision onto the host.
-
-**Correction to the first reading:** a branch revision is valid when it has been explicitly admitted to the deployment that runs it. "Not main" is not inherently drift.
-
-**Operator context:** srv1 and srv2 are both used for development today. That use is separate from deployment risk: the srv1 daily-workspace deployment holds ProdRisk because `ProdRoleSelection` selects it, and the srv2 deployment derives TestRisk.
-
-**Automation owed:** each deployment's explicitly admitted revision is observed and converged into the running deployment, with readiness and member-identity readback.
-
-**Stays manual:** selecting and admitting the revision for that deployment.
-
-**Home:** generic live-deploy convergence (`gunbc.live_deploy`).
-
-**Operator ruling (2026-10-03): converges are triggered manually today, and automated later.** Until they are automated, the manual trigger is one retry-safe action, the converge entry point, never a hand-run sequence of steps. Running it twice against a converged host is a Noop. The deployment hand-placed on srv2 for #13066 is the case this rules out: the admitted revision goes onto the host through the converge, not around it.
-
-**Which deployment is prod: decided 2026-10-03.** The operator approved the deployment-risk conformance vocabulary. `DeploymentRiskClass = TestRisk | ProdRisk` is derived from one switchable row, `ProdRoleSelection = NoProdRole | ProdRoleHeldBy { deployment }`, and is never inferred from srv1, "live", main or a host name. The row initially holds the srv1 daily-workspace dashboard. Turning prod off is setting that row to `NoProdRole`. A TestRisk deployment that lacks its own `DeploymentExternalBindingSet` refuses rather than borrowing prod's. The migration that names it is a separate lane; this item only consumes it. The belt-tick near miss (a tick ran `git worktree add` into srv1's production tree) is one of the wrong-instance incidents that migration files as a recurring failure mode.
-
-**RED first:** admit a revision for srv2. Convergence brings the running deployment to it and reads it back. A running revision that differs from the admitted one is reported as drift.
-
-### 6. Every belt tick times out (unsolved)
-
-**Exposed:** `gunbc.roadmap_belt_actuate` `belt_run_once` is one monolithic pass that runs these stages in sequence:
-1. spawn;
-2. teardown;
-3. launch;
-4. commit;
-5. verify;
-6. review;
-7. publish;
-8. write the served observation.
-
-Any slow stage blocks every stage behind it. The module's own note on `belt_observe_once_cli` says that when the monolithic pass is too slow to reach its observation write, the page freezes at the last completed tick's bytes. After about 06:50 UTC, no tick completed, so capture, verify and publish never ran for the attempt.
-
-**Not the fix:** stage checkpoints that make the monolithic tick resumable. That preserves the structure that should go.
-
-**Automation owed:** expensive work leaves the tick. Each durable obligation gets its own event-driven ensure and its own effect identity:
-- a worker-terminal event triggers capture and submission classification;
-- a captured `SubmissionIsCandidate` triggers authoritative verification;
-- a passing verification receipt triggers review and goal audit, independently;
-- an approved review plus an approved goal audit admits publication;
-- a yielded, blocked or needs-context capture stays visible but does not enter verification.
-
-The anti-entropy pass only discovers and queues a bounded number of outstanding obligations.
-
-**Stays manual:** intervention only on a typed refusal.
-
-**Home:** belt demotion and the factory lifecycle.
-
-**RED first:** a verify that runs long does not delay publish of an unrelated attempt, or the served observation.
-
-## Order
-
-The two that matter most for the dogfood clock:
-- **6 (belt):** it is why the first attempt has no PR.
-- **3 (second door):** untracked traffic blocks admission.
-
-Next, 1 (incident record for stale units) and 5 (admitted-revision convergence) turn the remaining hand steps into single recorded actions. Items 2 and 4 follow.
-
-None of this counts toward the dogfood window by itself. The window starts with the first qualifying run under `factory-dogfood-route` that also carries the joined evidence receipt from `service-evidence-capture` (gunbc#13068).
diff --git a/docs/plans/dsv41-cut-d-redesign.md b/docs/plans/dsv41-cut-d-redesign.md
deleted file mode 100644
index 76f468529d9..00000000000
--- a/docs/plans/dsv41-cut-d-redesign.md
+++ /dev/null
@@ -1,721 +0,0 @@
-# DSV41 Cut D — redesign against the observed Group A, not the assumed one
-
-Cut D of DSV41-ENGRAM-RUNTIME-0 was specified as a bounded replacement transaction against a
-live V4 Flash incumbent: drain its offer, stop it, launch V4.1 TP4, probe, then **promote or
-restore V4 Flash**, with promotion gated on *rollback demonstrated* — an incumbent request
-served again after the experiment.
-
-**No incumbent was observed**, twice, 14 hours apart. Every terminal in the original cut that
-names V4 Flash therefore has no subject *on those readings*, so the cut cannot be executed as
-written, and executing a lightly-edited version would silently drop safety properties the
-original bought.
-
-**That absence is a dated observation, not a property of Group A** — D0 re-establishes it under
-the transaction's own claim, because something can become live between a reading and a stop.
-This document records what was observed, what follows, and the cut that replaces the original.
-
-> ## ⛔ THIS CUT CANNOT BE EXECUTED TODAY
->
-> It describes a transaction that depends on **suspending Group A's pair-serving authority** —
-> the realization disabled while all four hosts stay held for the named successor, build and
-> probe admission still fenced, under a bounded lease with cleanup.
->
-> **No carrier provides that.** The model can express *withdrawal* only, as
-> `spark_pair_serving_groups` shrinking — and for Group A, which is that roster's sole member,
-> shrinking means **emptying**, which reclassifies the hosts the cut needs and hands two of them
-> to any lane that asks. Emptying the roster is not a suspension substitute.
->
-> So this is a **design with a named prerequisite**, not an instruction sheet. Modelling
-> `PairServingGroupAuthority` (§2) is the work that has to land before D0 can take its first
-> step. Everything below assumes that operation exists.
-
-**HOW TO READ THIS DOCUMENT.** It went through nine review rounds and several of its own
-premises were rejected along the way. Rejected premises are marked **⚠ REJECTED PREMISE** and
-kept only so they are not re-derived; everything else is operative. Nothing here should require
-inferring that a later section supersedes an earlier one.
-
-## What was observed
-
-Read directly from the four Group A ranks (`spark-a3ee`, `spark-3bd5`, `spark-c2b1`,
-`spark-ac79`) over SSH, twice, ~14 hours apart:
-
-| fact | reading |
-|---|---|
-| serving process | none — no `vllm`/serving systemd unit running |
-| OpenAI endpoint on the serving port | no answer |
-| occupant | one `gunbc-spark-pair` container, image `gunbc-spark-pair-runtime:ray-2.58.0`, created `2026-09-14T00:15:35Z`, up >2 days |
-| memory held | 107–109 GiB of 121 GiB per rank; `nvidia-smi` attributes ~100.7 GiB to `ray::RayWorkerProc.run` |
-| top process RSS | 2.6 GiB |
-| free disk | 2.6–3.1 TB of 3.7 TB per rank |
-
-Two details make that table read correctly rather than look contradictory. `nvidia-smi
---query-gpu=memory.total` returns `[N/A]` on a GB10 because there is no separate accelerator
-pool — the figure it attributes to the Ray worker is a claim on the same unified RAM `free`
-reports. And the top process RSS being 2.6 GiB while 108 GiB is used is not an inconsistency:
-CUDA device-side allocations on a unified pool do not appear in RSS. A process listing
-therefore makes these nodes look idle while they are 89% full.
-
-The operator's statement that Group A "is not being used by anyone" is correct about
-**traffic** and not about **occupancy**.
-
-### These readings do not contradict the fold's input, and the document must say so
-
-`gunbc.spark.pair_serving_observed` `group_rank_free_memory_observed` — the reading the fit
-fold consumes — is qualified **"with the engine idle"**. The table above is a reading of an
-**occupied** rank. They are answers to different questions and neither supersedes the other:
-
-| question | condition | who answers it |
-|---|---|---|
-| would V4.1 at TP4 fit if these hosts were cleared? | engine **idle** | `group_rank_free_memory_observed`, consumed by `candidate_component_budget` |
-| are these hosts clear right now? | **as found** | the table above, and D0 |
-
-So the occupancy reading is not evidence that the fold's input is stale, and the fit verdict
-stands on its own reading. **Presenting both without reconciling them would have been the
-defect** — a reader comparing 116.9 GiB free against 107–109 GiB used would conclude one of
-them is wrong, when what actually differs is whether anything was running at the time.
-
-### Why these readings are prose here, stated as a divergence rather than left silent
-
-§6 says name the instrument, never transcribe its output — and `pair_serving_observed` is the
-modeled home, carrying `PairServingObservationProvenance` with `observed_on` / `observed_by` /
-`sources`, and free memory as a `std.measure` interval with an `instrument` and a
-`precision_caveat` rather than a hand-typed figure. A `FabricGroupA` occupancy row there is the
-conforming move, and these figures are not in it.
-
-**This is a §3b divergence and the reason is that D0 is the step that produces that row.** The
-cut below exists precisely to take the claim, reconcile the occupancy against the declared
-realization, and emit an entry-state receipt. Hand-authoring the row now would author by hand
-the artifact the cut produces by execution — and it would do so from a one-off SSH procedure
-rather than through the instrument the model would name, which is the weaker evidence of the
-two.
-
-So these figures are carried here as **what motivated the redesign**, not as the corpus's
-record of Group A's occupancy. The corpus's record is `EntryStateReceipt`, D0 produces it, and
-if this program stalls before D0 runs then the corpus correctly continues to have no modeled
-observation of Group A being occupied — which is honest, because nothing executing has made
-one.
-
-## What follows, stated as consequences rather than edits
-
-### 1. On the incumbent-absent branch there is no drain, and calling a reclaim a drain would claim a property we do not have
-
-**Everything in this section is scoped to `IncumbentAbsent`.** If D0 finds a live incumbent, the
-original drain-and-preserve transaction applies instead and none of what follows does.
-
-The original sequence was *withdraw the incumbent offer → stop the incumbent*. A drain exists
-to preserve continuity for live traffic. There is no live traffic and no offer being served,
-so what the transaction actually performs is a **reclaim** of an occupying container.
-
-The distinction is not cosmetic. A drain's safety property is "no in-flight request was lost";
-a reclaim has no such property and needs none. Keeping the word would assert a guarantee the
-step does not provide — §4b rung honesty applied to a transaction step.
-
-**But dropping the drain obligation does not drop the QUIESCENCE obligation, and an earlier
-draft read as though it did.** No answering front door means no demonstrated serving traffic.
-It does not mean the occupant is safe to stop: those Ray workers hold ~100 GiB each, and what
-they are holding it for is unread. Before the reclaim, D0 must establish or revoke — never
-assume — Ray jobs, actors and placement groups; serving offers and new-admission eligibility;
-acquired or stranded seats; host claims, leases and ownership; and any actuator that could
-recreate the occupant after it is stopped. So the operation is:
-
-```
-fence new acquisition
-→ establish or revoke active work, claims and seats
-→ stop the occupying realization
-→ verify resource release
-```
-
-A reclaim with no in-flight-request obligation still has a fencing one. And note that
-enrollment says only that Group A is a route that *may be asked* — it does not say the route
-is live, and availability is separately three-valued (Available / Unavailable / **Unread**).
-Unread is where Group A sits, and unread is not empty.
-
-### 2. The occupant is DECLARED, not residue — and that changes the rollback question entirely
-
-An earlier draft of this document rejected "restore the occupant" on the grounds that *we hold
-no declaration that produces that Ray container, so restoring it would mean reconstructing from
-an observation*. **That sentence is false**, and the correction matters more than the error.
-
-The corpus declares exactly what was observed:
-
-- `extdeps.docker.images.sparkrun_vllm_ds4_gb10` `gunbc_spark_pair_runtime_image_tag` is
-  `gunbc-spark-pair-runtime:ray-2.58.0` — the observed image, with its pinned base and its
-  exact `ray[default]==2.58.0` requirement;
-- `gunbc.spark.pair_serving_realization` `spark_pair_container_name` is `gunbc-spark-pair` —
-  the observed container, with head and worker units and a one-container-per-host realization;
-- `gunbc.spark.pair_serving_desired` `spark_pair_serving_groups` still contains
-  **`FabricGroupA`**, and `spark_pair_realization` maps that desired set into realizations.
-
-So the ranks are not carrying residue. They are carrying an instance with **declared lineage** —
-image tag, container name, desired roster, realization and apply path all join.
-
-**But "converged" is stronger than the evidence, and an earlier draft claimed it.** This
-document's own observation table says no vLLM process, no serving unit running, no answer on
-the enrolled endpoint — while the declared realization includes a head unit that starts Ray and
-then vLLM, worker units under supervision, a head engine with `Restart=always`, and an apply
-that treats an inactive unit as grounds for restart and finally requires `systemctl is-active`.
-An instance matching that declaration would be answering. What the evidence supports is:
-
-```
-declared producer and authority        ESTABLISHED
-full realization presently converged   NOT ESTABLISHED
-observed instance                      apparently DRIFTED
-```
-
-So on the facts written here, the expected D0 answer is **`DeclaredOccupantDrifted`**, not
-`DeclaredOccupantObserved`, unless D0 reads the rendered units, container specs, rank membership
-and serving state and proves otherwise. That does not weaken this section's conclusion — the old
-authority can still recreate its desired realization, which is the whole hazard — it only stops
-container lineage being used as proof that the realization currently converges.
-
-**The consequence is a design break, not a wording fix.** If Group A remains in the desired set,
-an existing apply path can recreate exactly what D1 would call residue. "Return to a released
-empty state" is then *not a converged state*: a converger reasserting the desired realization
-would undo D1's terminal, and nothing in the transaction would notice. A terminal that another
-authority can silently reverse is not a terminal.
-
-So the question is not *may we restore the occupant* — it is **under whose authority do the
-hosts sit while V4.1 is on them**, and the plan must answer it explicitly:
-
-- **suspend Group A's pair-serving desired authority**, and record that suspension as part of
-  the authorization, so the hosts are never in a position where two authorities both believe
-  they own them. *Suspend*, not *withdraw*: different operations, and only withdrawal is
-  expressible today.
-
-**THE SUSPENSION'S LIFETIME IS ONE RULE, because an earlier draft gave three and they were not
-interchangeable** — "for the experiment's duration", "record that withdrawal", and an
-undifferentiated "claims released" each permitted a different implementation:
-
-```
-atomic transfer into suspension
-→ the suspension AND the exact four-host reservation persist through
-  QuiescentReservedBaseline — they do NOT end when D1 ends
-→ they end only when one of:
-     D2 promotion assumes the authority
-     the prior authority is explicitly restored
-     FleetReleasedBaseline is explicitly selected
-
-D1 cleanup RELEASES      rank and process claims, offers, seats, live allocations
-D1 cleanup RETAINS       the four-host reservation, under QuiescentReservedBaseline
-```
-
-"Claims released" is not one category: the execution claims must end and the host reservation
-must not, and a cut that says only "claims released" leaves an implementer to guess which.
-
-That is a real decision with its own consequences — it means Group A is deliberately not
-pair-serving while this runs — and it belongs in the authorization, not in a footnote. It also
-**cannot be performed today**: the operation it names does not exist, which is the gap this
-section ends on.
-
-**THE CORPUS HAS FACED THIS HAZARD BEFORE, THOUGH IT ANSWERED A DIFFERENT QUESTION.**
-`gunbc.serving.serving_enrollment` records that one list used to answer two questions that move
-for different reasons — *whose hosts this repository claims and converges*, and *which endpoints
-a turn may be offered* — and that they stopped coinciding on 2026-09-08. The reason given is the
-hazard this section is about: Group B's head is a host another authority also names, so leaving
-B in the convergence roster left **two authorities claiming one machine, and the first
-pair-serving convergence to run would have acted on a host it believed idle.** The operator
-authorised removing the claim, and the module was split so the two questions could move apart.
-
-That split is real and is observable in the current rosters — it is why a group can be enrolled
-for serving without being claimed for convergence:
-
-```
-serving_enrolled_groups   = [FabricGroupA, FabricGroupB]   ← who may be ASKED
-spark_pair_serving_groups = [FabricGroupA]                 ← whose hosts we CLAIM and converge
-```
-
-**⚠ REJECTED PREMISE, kept only so it is not re-derived.** An earlier draft concluded from this
-that Group B is "precisely the state this cut needs for Group A", that withdrawal therefore
-needs "no new mechanism", and that the precedent could simply be applied a second time. **That
-is wrong and the next subsection says why.** Group B's withdrawal was a removal from a roster
-that still had another member; Group A's would empty it, and Group A is the row that speaks for
-srv7 and srv8 whereas Group B's hosts were claimed by another authority that wanted them. The
-precedent establishes that the enrolled/claimed split exists and that a claim can be withdrawn —
-it does **not** establish that this withdrawal is safe.
-
-**Does the withdrawal also remove the host admissibility or launch authority D1 and D2 need?**
-**Yes — and an earlier version of this section answered that wrongly.** It traced admissibility
-to `gunbc.spark.host_commitment` `spark_serving_admissible_hosts`, found that removing a claim
-*loosens* commitment, and concluded the withdrawal "revokes a competing claim, which is the
-objective." That conclusion is false, because it asked who is let in and never asked who is let
-out.
-
-`host_commitment` derives every `MemberOfClaimedServingGroup` cause directly from
-`spark_pair_serving_groups`, and uses those causes to decide **which serving subject owns each
-host**. The cell-role roster assigns `SparkServingCell` to **srv5 and srv6 only** — the Group A
-claim is what speaks for srv7 and srv8. So a literal withdrawal produces:
-
-| hosts | after withdrawal |
-|---|---|
-| srv5, srv6 | cell role remains, Group A ownership cause gone → serving role held by **no serving subject** |
-| srv7, srv8 | no cell-role row, no ownership cause → **uncommitted**, admissible to any serving subject, and eligible as "unplaced" effect hosts |
-
-And V4.1's own candidate field derives its host population through `spark_serving_admissible_hosts`
-for the **Group A pair-unit subject** — `PairServingUnitOn { FabricGroupA }`, deliberately
-unchanged across the V4→V4.1 transition. **So the TP4 subject this program exists to run loses
-two of its four hosts**, while srv7 and srv8 become available to unrelated lanes: the vLLM
-source-build and runtime-image-probe roots both authorize effects through `admit_unplaced_host`,
-and the latter pulls an image and starts a container.
-
-The remedy would have destroyed the authority relation it exists to protect, and the plan's
-prose-level "exclusive claim" would have disagreed with the production authority that build and
-probe lanes actually consult. Loosening is not neutral when your own exclusivity is what is
-being loosened.
-
-**WITHDRAW AND SUSPEND ARE NOT INTERCHANGEABLE, and this document may not use them as though
-they were.** Suspension is the right operation here. **No such modeled operation exists yet** —
-that is the gap this cut must close before it can run, and it is a modeling obligation rather
-than a sequencing detail. It needs a typed authority state whose projections differ per
-consumer:
-
-```
-PairServingGroupAuthority
-  = PairServingActive { group, exact_realization }
-  | SuspensionPendingReconciliation { group, transaction, lease }      // both actuators disabled
-  | SuspendedForAuthorizedSuccessor { group, authorization,
-                                      exact_candidate_realization,
-                                      lease, cleanup }
-  | FencedRefusal { group, cause, disposition_authority }              // foreign / unread
-  | ReleasedToFleet { group, release_receipt }
-```
-
-**Every state the rest of this document requires is in that list.**
-`SuspensionPendingReconciliation` and `FencedRefusal` are authority states, not diagnostic
-labels — D0 holds the fleet in the first while both actuators are disabled, and the second is
-the long-lived terminal for foreign or unread occupancy. A coproduct without them cannot express
-the state machine D0 declares total.
-
-And the realization must survive in the genealogy: `PairServingActive { group }` alone cannot
-distinguish V4 from V4.1, because both deliberately share `PairServingUnitOn { FabricGroupA }`.
-A successor is discriminated by its exact authorization and candidate realization, never by
-subject identity.
-
-**THE LEASE NEEDS AN EXPIRY TRANSITION, and the lifetime rule above does not give it one.** The
-three ways it ends — D2 assumes the authority, the prior authority is restored,
-`FleetReleasedBaseline` is selected — are all deliberate acts. A bounded lease also ends by
-*running out*, and each silent answer is unsafe: expiry releasing the reservation lets another
-lane take a host with no cleanup or readback; expiry restoring the old authority may restart
-convergence over drifted, foreign or unread state; expiry changing nothing makes "bounded" a
-word rather than a property. So:
-
-```
-authorization expires
-→ launch, offer and seat authority are GONE
-→ cleanup and fencing authority REMAIN
-→ release or restoration only after the required receipt
-```
-
-Expiry removes the right to *start* things and keeps the right to *finish* them, which is the
-only arrangement where a lease can expire mid-transaction without stranding the fleet.
-
-with each consumer told explicitly what it sees:
-
-| consumer | Active | Suspended |
-|---|---|---|
-| pair realization / apply | acts | **does not act** |
-| host commitment | all four hosts owned | all four hosts **still owned**, by the named successor |
-| build / probe host admission | placed | **still placed**, never unclaimed |
-| serving enrollment | unchanged | unchanged |
-| capacity standing | ordinary result | a **typed suspended** result, never an empty population |
-
-**One positive result from the trace:** serving enrollment is genuinely independent of pair
-desired state. Group A stays enrolled as a route and the harness still probes it before
-offering work, so suspending the old realization does not delete the front door.
-
-### The withdrawal EMPTIES the roster, and that is not a local toggle
-
-`spark_pair_serving_groups` is `[FabricGroupA]`. **Group A is its only member**, so withdrawing
-it does not remove one entry — it leaves the list empty. Every fold over that roster then runs
-over an empty domain, and the repository already carries this class by name:
-`gunbc.recurring_failure_mode.predicate_vacuously_true_on_an_empty_domain`.
-
-An `all(...)` over an empty list is **true**. So a check of the form *every claimed serving
-group satisfies X* stops being evidence the moment the roster empties — it passes, loudly and
-greenly, because there is nothing left to fail it. That is the opposite of what a safety check
-should do when its subject disappears, and it would arrive exactly when the fleet is least
-ordinary.
-
-**The obligation lives on the roster, and this document deliberately does not restate it.** §6
-says the mark on the carrier is the authority; an earlier draft then restated the obligation
-here in its own words, which drifted from the carrier's as the carrier was corrected — the two
-disagreed on whether it covers *folds* or *every direct and transitive consumer*, and on whether
-the row is *ownership* or a *commitment input*. Restating an authority is how you end up
-maintaining two of them.
-
-So the obligation is the annotation above `spark_pair_serving_groups` in
-`gunbc.spark.pair_serving_desired`, and it is authoritative over anything this document says
-about it. Read it there.
-
-The roster also reaches **build and probe admission** and **capacity**, not only convergence —
-which is precisely why the accepted design is suspension and **not** a roster edit: a suspension
-that emptied this row would reclassify the hosts it is trying to hold. The authorization names
-the authority it suspends and the reservation it retains; it empties nothing.
-
-**THREE SUBJECTS, THREE NAMES.** An earlier draft used one word — "baseline" — for the state
-D0 records and the state D1 returns to. Those are mutually exclusive, and the ambiguity sat in
-the one sentence that tells a rollout worker where to leave the hosts.
-
-| subject | what it is | who produces it | is it a return target |
-|---|---|---|---|
-| **`EntryStateReceipt`** | the ranks as found — occupant present, ~108 GiB held | D0 | **no** |
-| **`ReleasedBaselineSpec`** | the *desired* post-experiment state: no ranks, no engine, no serving offer, no seat, no occupying container, no live device allocation. **Whether a host reservation remains is the choice made below** — for the ordinary D1→D2 path it does | declared before D1 runs | it is the target |
-| **`ReleasedBaselineReceipt`** | a readback establishing that the spec holds | D1's terminal | — |
-
-A spec and its readback are two facts, and collapsing them is how "we returned to baseline"
-becomes an assertion instead of a reading.
-
-**RESERVED OR FREE — the spec must choose, and an earlier draft claimed the guarantees of
-both.** It defined the released state as having *no host claim* while also suspending the old
-authority only "for the experiment's duration". That leaves three readings, and two of them are
-broken: if suspension ends when D1 ends, the old realization can be reapplied immediately and
-the released terminal is invalidated; if suspension persists with no reservation, srv7 and srv8
-become effect targets and srv5 and srv6 are held by nobody. Only the third is coherent:
-
-```
-QuiescentReservedBaseline          ← the target when D2 is expected to follow
-    no rank processes, no engine, no offer, no seat, no live device allocation
-    immutable verified artifacts may remain
-    the exact four-host reservation REMAINS
-```
-
-That holds no runtime live across the authorization boundary — only the right to use the four
-hosts, so an unrelated build or probe cannot occupy them before D2. If the intent is instead to
-give the hosts back to the fleet, that is a **different** terminal and must be named as one:
-`FleetReleasedBaseline`, where D2 must reacquire the hosts and may not assume the same four
-remain available.
-
-**What may remain.** The released state releases *processes, seats and live memory* — not bytes
-at rest, and under `QuiescentReservedBaseline` not the reservation either. The exact runtime image and the content-addressed row stores may stay on
-local storage. Rematerialising hundreds of gigabytes to satisfy a definition would be redundant
-work, and immutable content-addressed artifacts carry no live runtime across the authorization
-boundary. The spec says so explicitly rather than leaving a later reader to decide whether a
-staged row store violates "released".
-
-The **released state** remains the return target rather than the entry state, but now for a
-stated reason: the entry state is an instance of a desired authority we are suspending, so returning to it means *restoring that authority*, which is a separate decision
-from ending the experiment. D1 ends the experiment; restoring pair-serving authority is its own
-step with its own evidence.
-
-### 3. On the same branch the risk profile inverts, and that makes P1 Cut 3 more important rather than less
-
-**Also scoped to `IncumbentAbsent`.** The original cut's danger was **breaking a live service**.
-On this branch that danger is absent — not abolished, and it returns the moment D0 answers
-`IncumbentLive`. The remaining
-danger is **not being able to give the hosts back** — a partial or stalled launch leaving
-ranks up, seats held, and 121 GiB per node unavailable, with no incumbent whose restoration
-would incidentally clear it.
-
-The original brief said P1 Cut 3 "should block" ordinary production promotion. Against an
-incumbent, that hedge was defensible because restoring the incumbent was itself a cleanup path.
-Without one it is not: **promotion must refuse.** But the condition is CONJUNCTIVE, and an
-earlier draft joined two different problems with `or`:
-
-```
-(P1 Cut 3, or an exact seat-lifecycle equivalent)
-AND
-(a demonstrated rank / process / offer / claim cleanup path to ReleasedBaselineSpec)
-```
-
-P1 Cut 2 detects an exporter still live over an engine that has stopped advancing and
-explicitly leaves held-seat invalidation to Cut 3. That is Cut 3's subject: **seat and
-incarnation invalidation.** It is not the same fact as killing partial ranks, withdrawing
-offers, releasing host claims, stopping containers and returning unified memory — those are
-host and runtime cleanup. A single realization may discharge both, but only if its evidence
-actually proves both, and writing `or` invites treating either one as sufficient.
-
-### 4. The serving route is declared and unfulfilled, and the experiment must not paper over it
-
-`gunbc.serving.serving_enrollment` enrolls `FabricGroupA` — `serving_enrolled_groups` carries
-it, with an endpoint, a port and a turn ceiling. The model says Group A is a serving route.
-Nothing answers there.
-
-So *one bounded request through the normal route* is, today, unachievable for **any** model
-rather than specifically for V4.1. A cut that lists it as a terminal without saying so would be
-specifying an outcome nobody can currently produce, and the first lane to attempt it would
-discover the gap under a live transaction. Establishing that the enrolled route actually
-carries a request is its own precondition, and it is stated as one below.
-
-## The replacement cut
-
-### D0 — take the claim, reconcile the occupancy, then record the ENTRY state
-
-**D0 performs an ATOMIC AUTHORITY TRANSFER, not an acquire-then-withdraw sequence.** An earlier
-draft said D0 takes the exclusive claim first *and* that the hosts must never be owned by two
-authorities. **Those cannot both hold without a transfer operation**, and writing both was a
-contradiction rather than a plan:
-
-```
-acquire experiment claim, then withdraw old   → OVERLAP: two authorities own the hosts
-withdraw old, then acquire experiment claim   → GAP: build/probe lanes may take them
-atomic transfer                               → one active owner throughout
-```
-
-The gap arm is not theoretical: srv7 and srv8 become `admit_unplaced_host` targets the moment
-their ownership cause disappears. So the transfer is the operation, and it is part of the
-suspension gap named in §2 — there is no modeled transfer today.
-
-**D0 still brackets its readings with the claim it holds.** "No incumbent was
-observed" is a dated observation, not a property of Group A — the two SSH readings above are
-14 hours apart and say nothing about the interval between the last one and the stop. Without a
-claim held across that interval, something can become live between observing and reclaiming,
-and the transaction would proceed on a stale premise. That is the same defect this whole
-document exists to correct, one level down.
-
-**THE QUESTIONS ARE ORDERED, because an earlier draft's branches overlapped on the load-bearing
-state.** It asked occupancy reconciliation and incumbent presence as if independent — but this
-document establishes that a *converged* declared realization would be answering, so
-`DeclaredOccupantObserved { converged }` and "a live serving incumbent" are the **same state**,
-sent by one branch into the reclaim redesign and by the other into the original transaction. The
-incumbent question is asked **first**:
-
-```
-under SuspensionPendingReconciliation, both actuators disabled:
-
-  incumbent live
-      → hand off to the original drain-and-preserve transaction,
-        or a typed fenced refusal
-  incumbent absent
-      → reconcile the remaining occupancy (below)
-```
-
-**Then** the reconciliation question. Not *what is here*, but:
-
-```
-does the observed container / image / unit population reconcile
-with the declared pair-serving realization?
-```
-
-with four answers, each leading somewhere different:
-
-| answer | meaning | disposition |
-|---|---|---|
-| `DeclaredOccupantObserved` | declared, and shown converged **without answering** — a narrow case, since a converged realization would ordinarily answer | `SuspensionPendingReconciliation → SuspendedForAuthorizedSuccessor` |
-| `DeclaredOccupantDrifted` | declared lineage, convergence not established — **the expected answer on the readings above** | `SuspensionPendingReconciliation → SuspendedForAuthorizedSuccessor`, drift recorded; the drifted state is not a target |
-| `ForeignOccupantObserved` | something we do not declare | `→ FencedRefusal` — not ours to reclaim; needs operator disposition |
-| `OccupancyUnread` | the question could not be answered | `→ FencedRefusal` — unread is not empty |
-
-**EVERY ARM NEEDS AN AUTHORITY-STATE TERMINAL, including the refusing ones.** The transfer
-happens before the readings — that is what closes the overlap and gap arms — so a refusal fires
-*after* the authority has already moved, and an earlier draft said nothing about what becomes of
-it. Neither silent answer is acceptable: restoring `PairServingActive` may reactivate
-convergence over a foreign or unread occupant, and leaving `SuspendedForAuthorizedSuccessor`
-standing means a **refused** D0 has permanently changed a long-lived authority. So the transfer
-lands in an intermediate state that inspection happens inside:
-
-```
-PairServingActive
-→ SuspensionPendingReconciliation { transaction, lease,
-                                    old actuator disabled,
-                                    successor actuator disabled }
-→ read and reconcile, then:
-     SuspendedForAuthorizedSuccessor   declared eligible branch
-   | PairServingActive                 only when restoration is shown safe
-   | FencedRefusal                     foreign or unread — needs operator disposition
-```
-
-A versioned compare-and-swap protocol with the same dispositions would serve equally. The
-requirement is that **no D0 answer leaves the authority state undefined**, and that both
-actuators are disabled while the answer is being determined.
-
-And it branches on the incumbent rather than assuming its absence:
-
-```
-live serving incumbent observed      → the original drain/preserve path, or refuse this one
-no incumbent + quiescent declared occupant → the reclaim path below
-foreign, active, or unread occupancy → refuse
-```
-
-Only then does it record the entry state per rank: occupant identity and creation time, memory
-used and free, absence of a serving process, absence of an answer on the enrolled endpoint, and
-free disk. That receipt is evidence of **what changed** and forensic record. It is not the
-rollback target.
-
-**D0'S TERMINAL IS TWO SHAPES, NOT ONE, because an earlier draft required a complete receipt on
-every arm — including the arm where the instrument answered "unread".** If occupancy could not
-be read, D0 cannot produce the entry-state facts an `EntryStateReceipt` is defined to contain,
-and demanding one anyway would force either a fabricated receipt or an unreachable terminal:
-
-```
-D0Eligible {
-    entry_state_receipt : EntryStateReceipt,          // complete, all four ranks
-    authority           : SuspendedForAuthorizedSuccessor,
-}
-
-D0Refused {
-    partial_readings    : whatever was read,
-    cause               : foreign | unread | incumbent-live,
-    authority           : FencedRefusal,
-}
-```
-
-Equivalently, `EntryStateReceipt` could itself be total, with per-rank unread arms carrying their
-causes. What must not happen is a complete positive receipt being required after the instrument
-has already said it could not read.
-
-Terminal: the authority is in exactly one of `SuspendedForAuthorizedSuccessor` or
-`FencedRefusal`, the corresponding receipt exists, and no host state was altered.
-
-### D1 — reclaim, bounded experiment, mandatory return to the RELEASED state
-
-Authorization is exact and time-bounded over: candidate key, the four host identities, the
-**produced** runtime image digest, model source identity, the four row-store identities, the
-TP4 profile, the selected Engram route, the D0 entry-state receipt, and the cleanup path of §3.
-Candidate identity is not authorization.
-
-```
-claim the four ranks
-→ reclaim the occupant, read back that its memory is released
-→ re-verify the staged artifacts against their declared identities
-→ launch V4.1 TP4
-→ establish all-rank agreement
-→ complete model load
-→ complete graph/runtime initialisation
-→ answer semantic and differential probes
-→ ONE NORMAL ROUTED REQUEST, while the candidate is still live
-→ RETURN TO THE BASELINE THE AUTHORIZATION NAMED, unconditionally
-   (QuiescentReservedBaseline on the ordinary D1→D2 path)
-→ read back that baseline's receipt
-```
-
-D1 **always** ends at the released state — not at the entry state, which it deliberately does
-not restore. It does not promote.
-
-**AND THE IDEMPOTENCE CLAIM AN EARLIER DRAFT MADE HERE WAS FALSE.** It said a rerun of D1
-mutates nothing. A rerun of D1 cannot mutate nothing: it reclaims hosts, launches V4.1,
-initialises it, routes a request and tears it down. **The experiment is REPEATABLE; the cleanup
-converger is IDEMPOTENT**, and those are different properties that one sentence was conflating.
-What is actually checkable:
-
-```
-run the D1 experiment
-→ converge the baseline (QuiescentReservedBaseline or FleetReleasedBaseline)
-→ read the baseline receipt
-→ run THAT CONVERGER again
-→ require no mutation
-```
-
-The no-mutation property belongs to the converger and is asserted against it. Attaching it to
-the experiment made the receipt unfalsifiable, because no honest rerun could have satisfied it.
-
-Weight loading is not success. Acceptance begins after runtime initialisation and one valid
-semantic completion. An HTTP 200 discharges nothing.
-
-**The normal routed request happens INSIDE this window, and an earlier draft had it outside.**
-The end-to-end join — router request, selected offer, authorization, four agreeing ranks,
-produced completion — binds the exact realization D1 created. Deferring it past the teardown
-would mean relaunching V4.1 to perform it, which is a second fleet-mutating experiment, or
-performing it against a different model, which establishes nothing about this candidate's
-offer and rank wiring. The original Cut D placed it correctly and this redesign keeps that
-ordering.
-
-**The cleanup closure D2 requires is needed HERE too**, not only at promotion: once D1
-acquires a seat to serve that request, any failure after acquisition can strand exactly the
-seat P1 Cut 3 exists to invalidate.
-
-Every stage capable of preventing a later observation carries a terminal disposition: ranks
-stopped, rank and process claims released, offers and seats released, live allocations released,
-**the host reservation retained or released exactly as the named baseline requires**, that
-baseline read back — or a typed refusal naming the missing cleanup evidence. A failure arm that cannot reach it is the one outcome that must
-stop the line loudly, because it is the risk this cut actually carries.
-
-### D1a — the route reaches a process, which is the only model-independent half
-
-An earlier draft claimed the routed request was separable from V4.1 and then wrote a terminal
-requiring *four agreeing ranks and a produced completion* — which no model-independent step can
-produce. **That terminal was not separable and the claim of separability was wrong.** The two
-halves come apart like this:
-
-**Model-independent, but NOT free, and an earlier draft called it cheap.** Whether the enrolled
-route reaches a listening process is a fact about routing rather than about V4.1, and it can be
-established against any responder. But **binding a responder to the enrolled endpoint means
-starting a process on Group A's declared address and port** — that is fleet mutation, on the
-hosts this entire cut exists to fence. It cannot happen before the authority transfer, and it
-owes a teardown like any other launch:
-
-```
-after D0 reaches SuspendedForAuthorizedSuccessor
-→ launch a bounded endpoint responder
-→ issue the enrolled-route reachability request
-→ stop the responder
-→ re-establish QuiescentReservedBaseline
-```
-
-Its output is narrow and should be named so nobody reads it as more:
-**`EnrolledEndpointReachabilityReceipt`** — it establishes router-to-endpoint transport and
-listener reachability, and **nothing else**. Not offer selection, not seat acquisition, not rank
-agreement, not model advertisement, not that any candidate serves. D1 and D2 still owe every one
-of those joins.
-
-**Model-dependent, and therefore NOT separable.** The end-to-end join — router request, to
-selected offer, to authorization, to four agreeing ranks, to a produced completion — cannot
-exist without a TP4 model actually loaded. It belongs inside D1 (as the experiment's semantic
-terminal) and inside D2 (as the promotion terminal), and it is stated in both. Extracting it
-into a precondition would be specifying a step nobody can perform alone.
-
-### D2 — production promotion, separately authorized
-
-A new authorization over the already-proven realization. Promotion **refuses** unless:
-
-- the candidate is realized, not merely keyed — produced image digest, applied patch
-  population, four row-store identities;
-- row-store faithfulness is established over the **published** population, not a fixture;
-- D1 completed and its `ReleasedBaselineReceipt` was read back;
-- D1a established that the enrolled route reaches a process, and D1 produced the end-to-end join while the candidate was live;
-- **P1 Cut 3 (or an exact seat-lifecycle equivalent) AND a demonstrated cleanup path to `ReleasedBaselineSpec`** — two facts, not one;
-- **and the no-mutation rerun is a TERMINAL, not a precondition.** An earlier draft listed
-  "a second convergence run mutates nothing" among the conditions promotion refuses without —
-  but a no-mutation *promotion* rerun cannot precede the first promotion. The order is:
-
-```
-D2 preconditions satisfied
-→ apply the production promotion
-→ one exact normal routed request succeeds
-→ apply the production desired state AGAIN
-→ require no mutation
-```
-
-Capacity calibration is a follow-up. Record steady resident bytes, cache retention, local read
-bytes, lookup hit/miss population, prefill and decode rates, TTFT and ITL — and do not turn any
-of them into policy before correctness converges.
-
-## What this redesign does not change
-
-The identity discipline is untouched: checkpoint identity is not runtime identity, route B
-versus D is not a different binary, TP4 is an execution-profile fact, patch order is semantic,
-and build evidence does not transfer across a patch, tokenizer, checkpoint, row-store, topology
-or route change. The published runtime's scoped `NoFeasibleRealization` stays true about the
-published runtime; a file-backed runtime is a new candidate subject and does not weaken it.
-
-## Why the program is still worth running
-
-**Named, not transcribed.** An earlier draft re-derived the fit in prose and inverted it. The
-correction is not a better number — it is that this document should not carry the number at
-all.
-
-The authority is `gunbc.spark.serving_deployment_selection` `candidate_component_budget`. The
-reading it consumes is `gunbc.spark.pair_serving_observed` `group_rank_free_memory_observed`.
-Its per-rank verdict at 8 and at 4 ranks, the component breakdown behind the budget, and the
-corroborating figure from the rollout lane's independent instrument are all carried in the
-annotation beside `test.claim.spark.serving_deployment_selection_witness_test`'s selecting
-witness. Read them there; they move when the fold's inputs move, and a copy here would not.
-
-What this document needs to state is the **shape** of that result, because the cut depends on
-it: **route A at TP4 is excluded by a measured shortfall that exceeds the reading's own
-precision** — an established exclusion, not a near miss.
-
-Three things invert that answer if taken from outside the fold, and all three are mistakes this
-document made before it was corrected:
-
-- **the denominator is the observed idle-free reading, not the device total.**
-  `candidate_component_budget` says so in as many words, and refuses rather than substituting
-  the total when a reading is missing;
-- **the budget is what remains after the artifact's other three components, not one.** The
-  vision tower with its aligner and the DSpark draft model are the difference between a
-  two-component sum showing headroom and the fold showing a shortfall;
-- **the shortfall must clear the reading's precision.** The runtime prints one decimal of GiB,
-  so the free figure is an interval, and a verdict drawn against it is established only if it
-  exceeds that width. The fold's does.
-
-**That is why Cut B exists.** Not because the published runtime nearly fits — it does not fit,
-by a margin the measurement can carry — but because moving Engram off the resident budget is
-the only change that alters the term the fold is short on.
diff --git a/docs/plans/edge-label-coproduct/README.md b/docs/plans/edge-label-coproduct/README.md
deleted file mode 100644
index b05f9f5fd4f..00000000000
--- a/docs/plans/edge-label-coproduct/README.md
+++ /dev/null
@@ -1,97 +0,0 @@
-# Typed EdgeLabel coproduct — model proposal (step 1 of 2)
-
-Status: model approved and landed (gunbc#12473). Step 2, the cut, is the follow-up PR from quiet-koi-814; its scope was ruled by gentle-koi-724 (see "Step 2 as landed" below).
-Climb on record: `gunbc.recurring_failure_mode` `behavior_named_edge_label_validated_not_constructed` (the next-rung trigger names "edge labels ... a closed coproduct owned by `v2.std.node`"). No parallel RFM row is filed. The text-matching readers below are a second instance of that class, and the step-2 PR adds their evidence to that row.
-
-## Defect
-
-`v2.std.node` `EdgeLabel = Named { name: Symbol } | Positional`. Grammar-structural labels (for example `^dag_surface_module_header`, `^arrow_body_edge`, `<cast-target>`) and AUTHORED names (a field, a named actual, a declaration name) share one `Symbol` identity space. A reader that asks "is this the module-header edge?" can only compare text, and an authored name spelled the same way inhabits the answer. The invalid state is constructible, and today only `v2.std.type_binder` `type_binder_labels_conform` refuses it, for behavior nodes (rung 3), while four readers are not guarded at all:
-
-| reader | module | reads |
-|---|---|---|
-| `dag_surface_module_header_metadata_edge` | `v2.extdeps.languages.dag` | `Symbol ==` two header symbols; its callers bind `Named { name }` first |
-| `dag_node_is_module_root_conj` (fallback arm) | `v2.extdeps.languages.dag` | `sym == ^dag_surface_module_header` |
-| `d1_edge_names_where_clause` | `v2.test.claim.parse.d1_declaration_grammar_parse_test` | `n == ^dag_surface_where_refinement_clause` |
-| `site_is_import_syntax_mention` | `v2.lens.module_graph` | `contains(site.position, ^dag_surface_import_*)`; the path is a Symbol list that already mixes production names with authored names (`v2.compiler.reference_site_collector` `reference_sites_in_edge`) |
-
-## Proposed shape
-
-```
-// v2.std.node
-type EdgeLabel
-  = Structural { label: StructuralEdgeLabel }   // constructed only by a grammar / lowering authority
-  | Authored   { name: Symbol }                 // carries the source name
-  | Positional
-```
-
-`Named { name: Symbol }` does not survive beside these arms (DESIGN §3 replacement migration). Step 2 deletes it first and fixes forward.
-
-### Who owns the closed set (ruled: A)
-
-Candidate structural labels come from two layers:
-
-1. **Core substrate markers**, owned by `v2.std.node` and `v2.std.type_binder`: arrow body and signature order, loop bound and carrier, loop domain (`^loop_domain_edge`, #12548) and the MQ-5 Loop head-reference edge `^loop_realized_declaration_edge` (Core arm `LoopRealizedDeclaration`; at most one, never on for/while; deep-raven-602 S3), match arm pattern and body, cast target, type annotation, type params, type body, type alias, the `v2.std.node_query` projection markers, and `declaration_reference_marker`. This set is language-independent and closed today, so it can be a closed coproduct in `v2.std.node`: `CoreEdgeLabel = ArrowBody | ArrowSignatureOrder | LoopBound | ...`.
-2. **Grammar production edges**, per language: `dag_surface_*`, `rust_*`, `ts_*`, `target_model_edge_*`, and the per-language `*_named_edge` helpers that build them. These belong to the language rows in `extdeps/languages/`. Enumerating them in `v2.std.node` would be a layer inversion (DESIGN §3: each upstream has its own authority, and a generic hub may not enumerate products). Adding a language would also widen a core enum.
-
-Recommended (A):
-```
-type StructuralEdgeLabel
-  = Core { marker: CoreEdgeLabel }                      // closed, v2.std.node
-  | Production { grammar: GrammarRef, edge: Symbol }    // minted only by the grammar fold from a declared row
-```
-Here `Production` is closed per grammar by construction. Its only constructor is the grammar's own projection (`v2.std.grammar` / `v2.compiler.02_parse` `parse_tree_projection_edge`, already a closed roster, is the precedent). Readers compare `Production` values minted from the same row, not `^text`.
-Alternative (B): one flat closed enum of every candidate in `v2.std.node`. Rejected for the layer inversion above.
-**Ruled (neat-boar-16, 2026-09-28): A.** Core markers live in `v2.std.node`; `Production { grammar, edge }` can be minted only by the grammar fold. Rung 4 is claimed only with a discriminating RED enrolled on the real acceptance path. Otherwise the claim is rung 3.
-Open for the cut: whether `Production.edge` can be a row reference rather than a Symbol. That depends on `v2.std.grammar` exposing a row identity type. If it cannot, `Production` is rung 3 per grammar (it is checked when the grammar is admitted), not rung 4.
-
-### Other judgment calls flagged for review
-
-- **Hand-built type-node literals** (`^magma_field_op` in `v2.std.algebra`, `effects`, `testgen`, `target_model`, and others) model the AUTHORED field names of modeled records but are spelled like markers. **Ruled: `Authored`.** If those nodes are meant to equal what ingest produces, their names are already wrong (`magma_field_op` ≠ `op`). That is a separate finding.
-- **`ReferenceSite.position`** must carry `EdgeLabel` segments, or only Authored segments plus a separate structural context. This is a model change to `v2.compiler.reference_site_collector`, not a rename. **Ruled: it lands in the cut**, because `site_is_import_syntax_mention` is a consumer that needs it.
-- **Pending question (adhoc-db43a2ff-e50):** whether the namespace-spine mark belongs in this coproduct as a `Core` marker. The rule is the same as for the other markers: it joins `CoreEdgeLabel` only if it is language-independent and minted by the substrate, not by a grammar row.
-- **Consistency with the Loop edge roster (#12548 and MQ-5 S3, deep-raven-602):** the loop domain edge and the Loop head-reference edge are `Core` markers, added ONCE, so the Loop edge roster and this census agree. Whichever PR lands second adds the label to the other roster. If this model lands first, S3 constructs the label through the `Core` arm and never as an authored Symbol. `v2.std.node` `loop_edge_role` (#12548) is the one reader of Loop labels, so it is the single site the cut converts.
-- **Symbol-keyed query APIs** (`v2.std.node_query` `find_named_child`, `named_child_lookup`, `named_edge_target_lookup`, and `v2.std.node` `name_occurrences`) split into a structural lookup that takes a `StructuralEdgeLabel` and an authored lookup that takes a `Symbol`. A single Symbol-keyed lookup must not survive.
-- **named-args PR-B #12382** (vivid-ram-65): the Named edges for named actuals under Transform are `Authored`. `PositionalPlusOneNamedEdges` for Transform then counts `Structural { Core { CastTarget } }` separately from the authored actuals.
-
-## Consumers of each new declaration (DESIGN §3c)
-
-Every declaration below lands in the step-2 cut together with its consumers. None of them lands in this model PR.
-
-| declaration | consumer, executing route |
-|---|---|
-| `EdgeLabel.Structural` / `Authored` (replacing `Named`) | every current `Edge.label` reader and constructor. The fail-closed deletion refuses each one until it is dispositioned. `v2.std.node` `content_hash` hashes both arms. |
-| `StructuralEdgeLabel.Core` / `CoreEdgeLabel` | `v2.std.node` edge discipline (`kind_edge_discipline`, `arrow_signature_order_label`, the loop bound/carrier checks) and `v2.std.type_binder` `type_binder_labels_conform`, whose behavior-label arm dissolves |
-| `StructuralEdgeLabel.Production` | the grammar fold (`v2.compiler.02_parse` `parse_tree_projection_edge`, `v2.extdeps.languages.dag` productions) mints it. `dag_surface_module_header_metadata_edge`, `dag_node_is_module_root_conj` and `d1_edge_names_where_clause` read it. |
-| `ReferenceSite.position` segments carrying `EdgeLabel` | `v2.lens.module_graph` `site_is_import_syntax_mention` |
-| split structural/authored lookups | callers of `v2.std.node_query` `find_named_child` and its siblings |
-
-## Census
-
-[census.md](census.md) keeps only the findings the ruling was made over: the four readers and the non-EdgeLabel `Named` types that are excluded (`std.algebra` `ContainerSource`, `extdeps.formats.spice`). No counts are transcribed (DESIGN §6). The authoritative consumer population is the step-2 deletion itself (DESIGN §3, "the deletion is the census"): removing `Named` makes every dependent refuse under self-host and neat-boar-16's srv1 per-file native census, and each refusal gets one disposition: Structural/Core, Structural/Production, Authored, or arm-only. The largest dependent populations are the per-language `*_named_edge` helpers and the Symbol-keyed lookups in `v2.std.node_query`. Rust `src/v1/stage0` has no hand-written EdgeLabel sites; the generated reflection regenerates.
-
-## Identity impact (a deliberate change)
-
-`v2.std.node` `canonical_hash_of_edge_label` gains distinct tags for Structural/Core, Structural/Production and Authored. `Positional` keeps its tag. `label_sort_key` (canonical order) follows. Churn:
-
-- **Pinned digests:** in `node_hash_protocol_witness_test`, every vector with a named edge changes. The positional and no-edge vectors stay stable, which is the control that only the label arm moved.
-- **SCM:** every `object_store` object id derived through `content_hash_of_children` changes. The JSON wire `encode_label` / `decode_named_label` splits its `"named"` tag. No committed fixture carries a `"named"` label.
-- **Hermetic fixtures keyed by a content-hash locator** change. Their on-disk store is still to be located before step 2.
-- **Invalidate only, nothing pinned:** the test-claim cache digest (`05_eval`), the parse memo grammar digest (`02_parse`), and the bootstrap closure hash.
-
-## Step-2 controls (the cut)
-
-1. For each of the four readers, an authored name spelled like its structural label (for example an authored `dag_surface_module_header`) reaches none of them.
-2. The real structural labels still route (positive control over the real ingest path).
-3. A mutation that re-keys a reader on text makes the control red.
-4. Gating: base-vs-head over shape consumers, neat-boar-16's srv1 per-file native census, and self-host.
-
-## Step 2 as landed
-
-Arm names differ from the sketch above because `.dag` names are corpus-global and `Structural`, `Production` and `Core`-prefixed spellings already name other types: the arms are `Authored { name }`, `StructuralLabel { label: StructuralEdgeLabel }` and `Positional`, with `StructuralEdgeLabel = CoreMarker { marker: CoreEdgeLabel } | ProductionEdge { language, edge }`.
-
-- **Root first.** `Named { name: Symbol }` was deleted and every site renamed to `Authored` in the same change; the compiler's exhaustiveness refusals were the census of every reader that had to decide what a structural edge means at its site.
-- **Converted, every minter and reader:** the core markers (arrow body and signature order; loop bound, carrier and domain; match arm pattern and body; cast target, type annotation, type params, type body, type alias; declaration reference; field projection base and field) and the dag surface productions the four readers need (module header and its qualified name, where-refinement clause, import decl, import block, import decl block, import decl qualified name). `v2.std.node` `Path` steps and `ReferenceSite.position` carry whole labels.
-- **Deviation, stated:** the positional-payload field `"0"` stays Authored. It is consumed as `DeclaredField.name` like every authored field, so making it a marker would fork the field-name authority.
-- **Frontier:** grammar-emitted labels no converted reader matches stay on the Authored arm. The population (by minting declaration) and the capability trigger are recorded on `gunbc.recurring_failure_mode` `behavior_named_edge_label_validated_not_constructed`.
-- **Identity:** an authored label keeps the tag every Named edge had, so only nodes holding a structural label change identity. The two pinned vectors in `test.claim.node_hash_protocol_witness` that carry converted labels were re-derived by an independent reference implementation that first reproduced their previous values.
-- **Coordination:** the construct tag (#12714) landed first, so this cut converted it to `ConstructTagEdge`. `^loop_realized_declaration_edge` (#12550) is not on main; whichever lands second adds its arm.
diff --git a/docs/plans/edge-label-coproduct/census.md b/docs/plans/edge-label-coproduct/census.md
deleted file mode 100644
index 771acdd1e7a..00000000000
--- a/docs/plans/edge-label-coproduct/census.md
+++ /dev/null
@@ -1,24 +0,0 @@
-# EdgeLabel `Named` census — scoping findings, not an instrument
-
-This file keeps only the FINDINGS that need a ruling. The one-off lexical scan that located them is not committed, and neither are its counts: the repo admits no `*.py`, and DESIGN §6 forbids transcribing an instrument's output. The step-2 census is the fail-closed one DESIGN §3 names. Deleting `Named { name: Symbol }` first makes every real dependent refuse loudly, under `gunbc test //gunbc/instruments:self-host` and neat-boar-16's srv1 per-file native census. The dependents that refuse are the population the cut is scoped over. Symbols are cited by module and name.
-
-## Premise correction: other types with a `Named` arm
-
-Only three types in the corpus declare a `Named` variant:
-- `v2.std.node` `EdgeLabel` (the subject)
-- `std.algebra` `ContainerSource = SameAsReceiver | Named { name: String }`: string-method rows in `dag/std/algebra.dag`. Excluded.
-- `extdeps.formats.spice` `Named { node: NamedNode }`: spice.dag and its fixtures and tests. Excluded.
-
-`target_model.dag`, `testgen.dag`, `effects.dag`, `algebra.dag` (src/v2/std), and `body_lowering_fold.dag` have NO other `Named` type. All of their `Named {` hits are EdgeLabel (they import `Named` from `v2.std.node`).
-
-## The four named readers
-
-| reader (actual symbol) | file | how it reads | disposition |
-|---|---|---|---|
-| `dag_surface_module_header_metadata_edge(name: Symbol)` (asked-for "header_metadata_edge") | src/v2/extdeps/languages/dag.dag | Symbol equality against `^dag_surface_module_header`, `^dag_surface_module_header_qualified_name`; callers in symbol_index_fill, namespace_graft, 03_name_resolve, reference_site_collector `reference_sites_in_edge`, 03_resolve and zero_metadata_test — every caller first binds `Named { name: sym }` | becomes Structural arm match: take `StructuralEdgeLabel`, match the two arms; callers match `Structural { label }` instead of binding a Symbol |
-| `dag_node_is_module_root_conj` | src/v2/extdeps/languages/dag.dag | fallback arm folds children: `Named { name: sym } => sym == ^dag_surface_module_header` | becomes Structural arm `dag_surface_module_header` (Authored arm → false) |
-| `d1_edge_names_where_clause` (asked-for "edge_names_where_clause"; it lives in **src/v2/test/claim/parse/d1_declaration_grammar_parse_test.dag**, not module_graph.dag) | test | `Named { name: n } => n == ^dag_surface_where_refinement_clause` | becomes Structural arm `dag_surface_where_refinement_clause`; production minter is `v2.compiler.body_lowering_fold` (`label: Named { name: ^dag_surface_where_refinement_clause }`) |
-| `site_is_import_syntax_mention(site: ReferenceSite)` | src/v2/lens/module_graph.dag | `contains(site.position, ^dag_surface_import_decl / ^dag_surface_import_block / ^dag_surface_import_decl_qualified_name)` — no Named match at all; `ReferenceSite.position` is a Symbol path mixing production and authored segments (`v2.compiler.reference_site_collector` `reference_sites_in_edge`) | requires `ReferenceSite.position` to carry label arms; then becomes a Structural-arm membership test. Not a mechanical rename. |
-
-Related closed roster already present: `v2.compiler.02_parse` `parse_tree_projection_edge`. It is the precedent for `StructuralEdgeLabel` being a closed coproduct.
-
diff --git a/docs/plans/enrolment-margin-eval-step-denomination.md b/docs/plans/enrolment-margin-eval-step-denomination.md
deleted file mode 100644
index bf0dbaa5d2d..00000000000
--- a/docs/plans/enrolment-margin-eval-step-denomination.md
+++ /dev/null
@@ -1,194 +0,0 @@
-# Denominating the enrolment margin in eval steps
-
-Governed by DESIGN §5 (fail-closed, oracles, construction over validation) and §4b
-(the guarantee ladder). This plan discharges clause (iv) of the §4b(3) drop
-`gunbc.rung_drop` `floor_cost_cpu_regression_at_constant_eval_steps`, which is the
-only clause of that row gunbc#11195 left standing.
-
-## The defect this closes, stated as the drop already states it
-
-gunbc#11195 moved the required floor's **claim ceiling** off CPU and onto eval steps,
-and made CPU observed-only for every claim. It did not move every per-subject budget.
-`v2.workflow.floor_enrolment_margin` still derives a 302ms budget from
-`required_floor_per_subject_cpu_line_ms` and compares an **observed CPU reading**
-against it, so a newly enrolled witness can still be refused on a figure that is a
-property of the machine rather than of the claim.
-
-That is exactly what the drop's restoration trigger forbids, in its own words:
-
-> NO PER-SUBJECT BUDGET MAY CONSUME A RUN-LEVEL READING
-
-The trigger is stated at **budget grain and not at denomination grain** deliberately,
-and gunbc#11195 records why: an earlier revision quantified over the *primitives* a
-cost-fidelity report must cover and said nothing about *which budgets* must stop being
-vulnerable, so it could have been discharged by denominating one ceiling while another
-per-subject budget kept charging a run-level cost to an arbitrary claim. Denominating
-the claim ceiling was one step toward the trigger and is not the trigger.
-
-## Why the first phase is not the enrolment margin
-
-`floor_enrolment_margin` consumes `gunbc.floor_cost_distribution` `ClaimCostReading`
-directly — `EnrolmentCostReading = EnrolmentCostMeasured { reading: ClaimCostReading } | …`.
-Every arm of that coproduct is CPU-shaped:
-
-```
-type ClaimCostReading
-  = ObservedCpuReading          { cpu_ms }
-  | RightCensoredCpuReading     { cpu_lower_bound_ms, censoring_ceiling_ms }
-  | CpuLowerBoundWithoutCeiling { cpu_lower_bound_ms }
-```
-
-So the gate **cannot see a step count at all** until the carrier carries one. The step
-count exists today only as `FloorCostRow.eval_steps: Int`, a bare scalar beside the
-coproduct, and a consumer reaching for it inherits a defect the corpus has already
-filed against itself.
-
-## The filed stall this phase discharges
-
-`gunbc.guarantee_stall.eval_steps_outside_the_reading_coproduct_stall` — `current:
-OutsideTheLadder`, `ceiling: StructurallyImpossible`, `blocker: ClimbableButUnbuilt`,
-population `["gunbc.floor_cost_distribution"]`. Its subject, in its own words: the bare
-`Int` means a right-censored row's observed-steps-**before-censor** and a completed
-row's **performed** steps share one type and one constructor, so a fold may compare
-them for equality and manufacture an equal-work cohort out of two observations that
-measured different things — a **half-applied construction**, because the same file
-already models the CPU half correctly and one field did not follow the decision its
-sibling already made.
-
-Its `next_rung_trigger` is this phase, verbatim: *eval_steps moves INSIDE the
-`ClaimCostReading` arms, so an observed step count and an observed-so-far-before-censor
-count are reached through different constructors and no fold can compare them.*
-
-This plan therefore **does not invent its own first phase**. It executes a trigger the
-corpus declared before this lane existed.
-
-## Phase 1 — the carrier (the model)
-
-```
-type ClaimCostReading
-  = ObservedCpuReading {
-      cpu_ms: Millisecond
-      eval_steps: EvalStepCount
-    }
-  | RightCensoredCpuReading {
-      cpu_lower_bound_ms: Millisecond
-      censoring_ceiling_ms: Millisecond
-      eval_steps_before_censor: EvalStepCount
-    }
-  | CpuLowerBoundWithoutCeiling {
-      cpu_lower_bound_ms: Millisecond
-      eval_steps_before_censor: EvalStepCount
-    }
-```
-
-with two accessors mirroring the CPU pair the file already carries, and named for the
-same distinction:
-
-- `observed_eval_steps(reading) -> EvalStepCount?` — `Present` on the observed arm
-  only. The point question. A bound cannot reach a site that treats it as performed
-  work without the caller writing an `Absent` arm.
-- `eval_steps_at_least(reading) -> EvalStepCount` — total over all three arms. The one
-  question a censored row can answer soundly: *this claim performed at least N steps*.
-
-`FloorCostRow.eval_steps: Int` is **deleted**, not deprecated. DESIGN §3's replacement
-migrations cut over at the root, and a surviving bare `Int` is the attractor that rule
-exists to prevent: while it stands, every nearby question is answered in its vocabulary.
-
-### Why inside the arms rather than a sibling coproduct
-
-A sibling `EvalStepReading` beside `cost: ClaimCostReading` would satisfy the trigger's
-*letter* — two constructors, no bare `Int` — while leaving the incoherent state
-constructible: a row claiming an **observed** CPU reading beside a
-**before-censor** step count. Whether the claim reached its end is ONE fact about ONE
-occurrence, and it discriminates both readings. Carrying the step count inside the arm
-makes disagreement unconstructible, which is the stall's declared ceiling
-(`StructurallyImpossible`) rather than one rung below it.
-
-This is not the clock fusion `std.measure` `measure_clock_basis_note` forbids, and the
-distinction is worth stating because gunbc#11195 was reworked twice over exactly it.
-Fusion is *comparing* magnitudes read from different clocks. This is *co-locating*
-three observations of one occurrence under the discriminator they genuinely share. No
-arm compares a step count to a millisecond.
-
-### Phase 1 blast radius, measured rather than estimated
-
-Measured on `origin/main` at `3a0f2d4b585`:
-
-| surface | sites |
-| --- | --- |
-| `ObservedCpuReading {` | 41 |
-| `RightCensoredCpuReading {` | 21 |
-| `CpuLowerBoundWithoutCeiling {` | 11 |
-| `FloorCostRow {` | 41 |
-
-across 7 `.dag` files (`floor_cost_distribution` and its witness test and instrument,
-`floor_enrolment_margin` and its test, `floor_cost_debt_admission` and its test) plus
-the seed mirror in `required_floor_runner.rs`, `cli_run.rs` and `v1_interpreter.rs`.
-
-The type change admits **no partial state** — every constructor site moves in the same
-commit or the corpus does not compile. That is why this is its own phase and why this
-PR opens with the plan rather than a half-migration.
-
-**The step value at each site is authored, not mechanical.** A fixture's step count is
-part of what the fixture asserts, so these are not a `sed`. Fixtures whose subject is
-the CPU half take a step count that is declared as incidental beside the reading they
-actually exercise.
-
-### Phase 1 evidence
-
-- **RED** — a fold that compares a performed step count to a before-censor one must
-  become unwritable. The discriminating probe is the *source* handed to the compiler by
-  a fixture, per §4b: the invalid program is authorable there even once it is
-  unwritable in the accepted corpus, and declining the fixture would be
-  specification-without-execution.
-- **CONTROL** — `observed_eval_steps` answers `Absent` on both bound arms and `Present`
-  on the observed one, executing, so the accessor is not a decoration.
-
-## Phase 2 — the enrolment margin consumes it
-
-`floor_enrolment_margin_budget_ms` becomes an `EvalStepCount` derived through the **same**
-pinned calibration the claim ceiling uses (`v2.workflow.floor_eval_step_calibration`
-`eval_step_budget_for`), from a declared policy in milliseconds of work. It is not a
-second calibration and not a literal: §5's oracle rule admits the budget only because it
-is grounded in a controlled fixture, and a second rate would be a §3 fork of that
-authority.
-
-`EnrolmentMarginStanding` keeps its arms and changes their denomination:
-`EnrolmentWithinMargin` / `EnrolmentOverMargin` carry `EvalStepCount`, and the CPU
-reading is **carried beside the verdict as an observation** rather than deciding it —
-the same shape gunbc#11195 gave the claim ceiling.
-
-`EnrolmentBoundWithoutCeiling` survives unchanged in meaning: a preempted row's steps
-are a lower bound with no ceiling, exactly as its CPU is.
-
-### Phase 2 evidence
-
-- **RED** — a claim whose eval steps exceed the enrolment budget refuses.
-- **CONTROL** — a claim far over the 302ms CPU line with in-budget steps is admitted,
-  with the CPU observation recorded. This is the same pair gunbc#11195 enrolled for the
-  claim ceiling, and it must be re-authored here rather than cited: a different budget
-  is a different subject.
-
-## Phase 3 — retire the CPU line, or say why it stays
-
-`required_floor_per_subject_cpu_line_ms` exists only because per-subject decisions still
-read a CPU clock. Since gunbc#11700 `v2.workflow.floor_cost_debt_admission` compares nothing
-(a typed admission is identity and reason); the consumers are both in
-`v2.workflow.floor_enrolment_margin`: the margin budget, which must sit below the line, and
-the live Roster ground (`enrolment_declared_measured_standing`), which admits only a reading
-over it. When Phase 2 denominates the margin, the Roster ground is the remaining consumer, and
-Phase 3 decides that one: either it is denominated too and the symbol is deleted with its own
-dissolution condition discharged, or the symbol survives with a population of exactly one,
-stated.
-
-**Only when no per-subject budget reads a run-level figure does the drop's clause (iv)
-retire**, and the drop is retired by its trigger and by nothing else.
-
-## What this plan deliberately does not do
-
-- It does not re-arm a CPU ceiling anywhere. gunbc#11195's evidence stands: three
-  prose-only heads measured the same floor at 36.7s / 40.8s / 44.7s of summed CPU, and
-  one identity at an identical 2884 eval steps read 34ms, 455ms and 511ms. A CPU line
-  refuses on the environment, not on the claim.
-- It does not normalise per runner, and does not enrol slow identities as cost-debt
-  rows. Both are refused designs of record, for the reasons the floor authority states.
diff --git a/docs/plans/execution-cell-contract.md b/docs/plans/execution-cell-contract.md
deleted file mode 100644
index 119236fde94..00000000000
--- a/docs/plans/execution-cell-contract.md
+++ /dev/null
@@ -1,92 +0,0 @@
-# The execution-cell contract (owner directive 2026-09-25)
-
-Supersedes the "crash-era residue" framing of the Group B start failure.
-
-## The ruling, verbatim
-
-Treat the Group B failure as a missing execution-generation dependency, not as
-incidental residue. The new unit's cleanup hooks are downstream of systemd start
-admission, so they cannot repair start-rate state or orphan resources that
-prevent the start. Move prior-generation inventory, quiescence, disposal,
-manager-state settlement, and readback ahead of preparation.
-
-Prepare every rank before activating any. A four-rank arm is one cohort:
-preparation failure starts none; partial activation rolls back all started
-members; success requires one exact generation across every rank.
-
-Extract this as a realization-neutral execution-cell contract. Keep
-systemd/Docker as the current Group B realization and adopt Firecracker next for
-disposable harness workers. Do not claim that microVMs provide idempotency by
-themselves — the host controller must still own operation identity, CAS,
-resource conservation, disposal, and readback.
-
-Preserve the current wet run as measurement evidence only. Even if it succeeds
-after manual cleanup, prove the repaired convergence route against planted
-failed-unit and orphan-container residue before restoring persistent service.
-
-## What this means structurally
-
-### The phase order is law
-
-```
-inventory(prior generation)
-  → quiescence(prior generation)
-  → disposal(prior generation)
-  → manager-state settlement (rate counters, failed state, unit-table)
-  → readback(the prior generation is actually gone)
-  → preparation(new generation, every member)
-  → activation(cohort)
-```
-
-Anything in the new generation's cleanup hooks is unreachable for failures of
-start admission; cleanup of the PRIOR generation must precede preparation of
-the new one. The Sep 25 failure is the canonical witness: start-rate counters
-and an orphan container blocked admission before the unit's own ExecStartPre
-could run.
-
-### Cohort semantics
-
-An N-rank arm is ONE execution cell, not N units:
-
-- preparation is per-member but all-or-nothing: any member's preparation
-  failure activates none;
-- activation is sequenced with rollback: a member that fails after others
-  started disposes the started members;
-- success is a single exact generation (identity of the rendered intent)
-  observed across every member — never "three ranks on generation G, one on
-  G-1".
-
-### Realization neutrality
-
-The contract names phases, not tools. systemd/Docker is the current Group B
-realization; Firecracker is the next realization for disposable harness
-workers. A realization supplies the mechanisms for inventory / quiescence /
-disposal / settlement / readback / prepare / activate. Idempotency is NEVER a
-property of the substrate: the host controller owns operation identity,
-compare-and-set on admission, resource conservation (nothing leaks, nothing is
-double-consumed), disposal, and readback, for every realization.
-
-### Evidence discipline
-
-The 2026-09-25 wet run (manual pre-cleanup by the operator session) is
-measurement evidence only — its memory-profile receipts feed the fit proof,
-but it does NOT discharge the convergence-route proof. Before persistent
-service is restored, the repaired route must pass against PLANTED failure
-state: a failed-unit (tripped start-rate counter) and an orphan container,
-planted per host, with the route required to inventory, settle, and read back
-their absence before activation. That planted-residue witness joins
-`fleet-slot-retirement-wet-proof` as a reopening precondition.
-
-## Work queued from this ruling
-
-1. Execution-cell contract module (realization-neutral): the phase vocabulary,
-   cohort type, operation identity + CAS, conservation laws.
-2. systemd/Docker realization of the contract, replacing the current apply
-   bracket's prepare-then-start shape (shared by the experiment bracket and
-   the persistent serving apply).
-3. Planted-residue witness: failed-unit + orphan container, per host, repaired
-   by the route itself.
-4. Conjunctive reopening gate amendment: + execution-cell route proven against
-   planted residue.
-5. Firecracker realization for disposable harness workers (the microVM node),
-   owning identity/CAS/conservation/disposal/readback in the host controller.
diff --git a/docs/plans/extdeps-disputed-row-classification.md b/docs/plans/extdeps-disputed-row-classification.md
deleted file mode 100644
index 60f47c242b6..00000000000
--- a/docs/plans/extdeps-disputed-row-classification.md
+++ /dev/null
@@ -1,265 +0,0 @@
-# Disputed extdeps rows: a two-axis classification template, tested on the adjudicable subset
-
-Operator ruling (2026-10-05): placement batches pause because about half of
-placements were rejected on review — the classification rule is not yet ready to
-be used as a template. This document records **two judgments per case**, because
-the disputes of the last several batches were two different questions being
-answered with one label:
-
-- **Semantic standing** — who owns the semantic information the declaration
-  carries: *exact upstream fact* (a versioned upstream artifact states the
-  surface and the declaration transcribes it field-for-field), *shared formal
-  semantics* (recorded somewhere nameable but not one product's artifact),
-  *product policy* (the product's own choice: dispatch algebras, serializer
-  policies, normalizing tables, partial grammars, transports), or *unsupported*
-  (nothing states it and no product purpose holds it up).
-- **Consumption standing** — per DESIGN 3c's three honest states: *executing*
-  (consumed by execution in this tree), *declared frontier with trigger* (a
-  named consumer lands in a named later change, trigger stated beside it), or
-  *dangling* (nothing consumes it — red regardless of how well modeled it is).
-
-The **disposition follows from both axes together**: scope (fact + executing),
-re-home or re-label (policy + executing), delete or name-a-consumer (fact or
-unsupported + dangling), repair (a mixed module whose subjects must be separated
-before either axis can be judged honestly). No single axis decides.
-
-## The evidence must fit the surface
-
-A standing is only as good as its evidence, and the evidence has to be of the
-kind the surface admits:
-
-- **Data shapes are judged by field/constructor diff** against the cited
-  artifact. If the declaration adds, drops, reshapes or renames anything the
-  artifact does not state, the standing is not exact-upstream-fact — the diff
-  is how the judgment is made, not a formality after it.
-- **Decision procedures are judged by behavioural conformance** to the
-  artifact's stated rule. A precedence rule, an ordering, a matching policy: the
-  question is whether the implementation orders/matches the way the artifact
-  says on its cases — not whether its fields resemble the artifact's. A field
-  diff cannot establish conformance, and a passing field diff cannot excuse a
-  failing behaviour.
-- **Consumption is established only by an executing route** — a fold, an entry
-  point, a realization, an emitted artifact that reads the declaration. A grep
-  hit names a candidate site; it cannot establish that the site executes. A
-  name-keyed pattern establishes nothing: a predicate that reads no module
-  content is a classification, not a consumer. A mirror's definition of a
-  declaration is not a consumer of it. A witness that exercises a call inside a
-  test is not a production route.
-- **Both consumption labels are positive claims at this grade.** `executing`
-  asserts a route exists; `dangling` asserts no route exists across the decoded
-  surfaces. Grep-grade evidence supports neither — it supports **unadjudicated:
-  grep-grade only**, and that is what this document records wherever its own
-  evidence is grep-grade. The one exception in the sample is `semver_scheme`,
-  whose `dangling` label below is a recorded ruling of the side chat (review
-  5424597802), kept with its evidence grade attached and marked as a ruling,
-  not an adjudication.
-
-**Misfile shapes (the recurring review failure).** A citation can be live and
-real and still not own the declaration. Observed, each a real pulled row: a
-tool's CLI citing the standard the tool implements; a repo-normalized table
-citing the spec it normalizes; a dispatch algebra citing one tool it drives; a
-repo extension inside an otherwise transcribed enumeration silently breaking the
-predicate; a repo plan citing fragments of a CLI grammar it does not fully
-reproduce.
-
-## The recorded cases
-
-Seven cases with both axes recorded. Semantic standings were decided against
-the cited artifacts (the instruments those surfaces admit); every consumption
-standing below is grep-grade, so each carries its evidence kind in place —
-the four `unadjudicated` labels are this document's own grade, and the three
-`dangling` labels are recorded rulings of the side chat (reviews 5423944315 and
-5424597802), kept with their grade attached. Dispositions that would change
-with the consumption walk are marked provisional and name what would settle
-them.
-
-**1. `docker/cli.dag` — `DockerCreateSpec` and its flag types.**
-Semantic standing: **product policy.** The type is a repo-normalized plan: its
-flag grammars are partial (Docker's CLI reference owns `--restart` fully —
-`on-failure:N` cannot be expressed by `DockerRestartPolicy` as written, cli.dag
-lines 32-39 — and `DockerNamespaceMode` covers only host/private, line 43), so
-it borrows CLI grammar fragments rather than transcribing the cited surface.
-Consumption standing: **unadjudicated: grep-grade only** — candidate consumer
-sites (grep hits): the `dag/gunbc/spark/*` serving modules and
-`docker/container_inspect.dag` name `DockerCreateSpec`; no execution-grade walk
-has run.
-Disposition: **repair** (consumption-independent). Either complete the grammars
-field-for-field against Docker's CLI reference — after which the (a) predicate
-is judged again on the diff — or re-label the plan as repo vocabulary in the
-product layer. What the walk decides is the module's longer-term standing
-(kept-and-consumed vs delete-or-declare); that waits.
-
-**2. `bmc/openbmc_operation.dag` — `OpenBmcOperation`.**
-Semantic standing: **product policy.** Owner: this repo — the dispatch algebra
-over file ops, systemctl, busctl, jq, mkdir/rm/cp, sleep is our vocabulary of
-what a BMC operation is; the busctl man page owns only busctl's argv semantics.
-Consumption standing: **unadjudicated: grep-grade only** — candidate consumer
-sites (grep hits): `openbmc_fan_control` and `openbmc_password_ssh_transport`
-name it.
-Disposition: provisional **re-home** to the product layer. The algebra is
-product vocabulary regardless of the walk — that part is consumption-
-independent; what the walk decides is whether the row leaves as re-homed
-(kept-and-consumed) or as deleted. The internal consumers, if the walk confirms
-them, keep depending on it — they should, it is the product's own vocabulary.
-
-**3. `languages/json/grammar.dag` — `json_production_rows`.**
-Semantic standing: **product policy.** Owner: this repo — the columns
-(`rfc_section`, `lhs`, `rhs`, `value_variant`) are a repo-normalized grammar
-whose `lhs` names a local `literal` nonterminal and whose `value_variant` maps
-to repo AST names; the raw RFC 8259 production strings embedded in the rows are
-upstream fragments, not the surface the table models.
-Consumption standing: **dangling, as ruled** (side chat, review 5423944315;
-grep-grade: no production consumer found; the parse path is `json/parse.dag`,
-scoped separately).
-Disposition: **delete or re-home** — the table is a documentation artifact in
-code; both dispositions are live and the call belongs to the operator.
-
-**4. `languages/markdown.dag` — `commonmark_gfm_spellings`.**
-Semantic standing: **product policy.** Owner: this repo's serializer policy —
-choosing which dialect's spellings to emit over CommonMark 0.31.2 and GFM
-extensions (tables, task lists) is a product decision; no single upstream owns
-"both dialects at once."
-Consumption standing: **unadjudicated: grep-grade only** — candidate consumer
-sites (grep hits): `truth_table_projection` and the markdown tests name the
-spellings.
-Disposition: **re-label** as product policy (consumption-independent); the row
-stops requesting a citation that cannot exist. What the walk decides is kept-
-vs-deleted; the serializer behavior itself is untouched.
-
-**5. `tools/curl.dag` — `curl_cli_tool` and its policy rows.**
-Semantic standing: **mixed — repair required.** The exit-code table (6/7/28/35/
-52/56) is an exact upstream fact owned by curl's own man page, which the anchor
-cites correctly. The pinned minimum version (>= 7.68), the localhost timeout
-rows, and the apt install realization are product policy — choices, not curl
-facts.
-Consumption standing: **unadjudicated: grep-grade only** — candidate consumer
-sites (grep hits) name the tool rows.
-Disposition: **repair — split** the policy rows out from under the
-external-authority anchor (consumption-independent); the CLI-fact side is then
-re-judged field-for-field against the man page on its own diff. Kept-vs-deleted
-waits on the walk.
-
-**6. `extdeps/ebay/mock_corpus.dag` — dangling repo data; the deletion-safety
-check.**
-Semantic standing: **unsupported.** The module is repo-authored
-`PublishedMockCase` hermetic-replay data; no upstream states it.
-Consumption standing: **dangling, as ruled** (side chat, review 5424597802).
-The census (2026-08-22, re-derived 08-26)
-classifies it STILL-UNCONSUMED, and the v1 mirror's
-`ends_with(".mock_corpus")` predicate (in
-`external_authority_is_clean_tree_roster_excluded_for_module_path`,
-`src/v1/stage0/src/cli_run/external_authority.rs` line 211) does not change
-that: the predicate reads no module content, so it is a classification, not a
-consumer.
-Disposition: **delete vs declared future consumer** — operator's, between
-deletion and re-homing to a fixture namespace with a named trigger. The
-convention scan survives only as a **deletion-safety check** (before deleting,
-confirm no compiled logic keys on the module's name in a way that reads its
-content), not as consumption evidence — and it is the check the census's
-mention scan does not collect.
-
-**7. `dag/extdeps/docker/container_stats.dag` — dangling and not
-field-for-field.**
-Semantic standing: **product policy over upstream fragments.** It adds a
-repo-authored `cpu_percent` field and reshapes `networks`, so it is not the
-Engine API's stats payload; owner of the real surface: Docker's Engine API
-stats reference.
-Consumption standing: **dangling, as ruled** (side chat, review 5423944315;
-grep-grade: no production caller; the #13304 review confirmed it
-independently).
-Disposition: **delete or name a consumer** (DESIGN 3c). Repairing the
-transcription — dropping `cpu_percent`, restoring the API shapes, re-diffing —
-is worthwhile only once a consumer or a declared frontier with a trigger
-exists; on today's tree the honest move is deletion or a named trigger.
-
-## Set aside — not adjudicated at execution grade
-
-Five cases from the sample could not be adjudicated on both axes now. They are
-recorded so the work is not lost, with their consumption standings marked
-**unadjudicated: grep-grade only** — grep hits name candidate sites and cannot
-establish that the site executes (the one recorded ruling in this section,
-`semver_scheme`'s dangling, is attributed above).
-
-- **`cloud/gcp/errors.dag` — `GcpRpcCode`**: semantic standing **non-exact**.
-  The module adds `GcpRpcCodeOther { raw: NonEmptyStr }` (errors.dag line 32)
-  beside the 17 transcribed `google.rpc.Code` values, so there is no
-  exact-upstream subject until the enumeration is split from the repo variant
-  and the enumeration alone is diffed against
-  `cloud.google.com/apis/design/errors#http_mapping`. Consumption:
-  unadjudicated (grep-grade: only its grounding witness test references the
-  module).
-- **`crypto/hash.dag` — `HashAlgorithm`/`Digest`**: **FIPS-derived fragments
-  plus local carriers.** `Sha256`/`Sha512` is not FIPS 180-4's family naming —
-  the carriers are repo-local and sit beside `sha256sum(1)` machinery (coreutils
-  manual owns the tool). There is no exact-upstream subject until the FIPS
-  facts are split out and diffed against FIPS 180-4, and the verifier machinery
-  is judged against the coreutils manual. Consumption: unadjudicated
-  (grep-grade: the sccache pin and live-deploy paths name the verifier).
-- **`ssh/session.dag` — `service ssh.Session`**: **mixed subjects.** The module
-  quotes ssh(1)'s exit-255 contract (an exact upstream fact owned by the
-  OpenSSH client manual — not RFC 4254, which owns channel messages) but also
-  carries repo transports, session records and mocks. Until the subjects are
-  separated (one module per authority), neither side's semantic standing can be
-  judged. Consumption: unadjudicated (grep-grade: repo consumers name the
-  machinery subjects).
-- **`version/semver.dag` — `semver_scheme`**: an **upstream-owned decision
-  procedure** (semver.org section 11 precedence) whose fitting evidence is
-  **behavioural conformance** — does `compare` order identifiers the way §11
-  says — not a field diff. That conformance has not been established; the
-  dispatch was lexical (`semver_identity_compare`), which is the recurring
-  failure mode filed as
-  `a_citation_attests_a_decision_rule_the_code_does_not_implement` (#13235).
-  Consumption standing: **dangling, as ruled** — the side chat's ruling
-  (review 5424597802): only the witness test calls `semver_scheme.compare`
-  (`extdeps_version_semver_witness_test.dag`), and the v1 stage0 mirror defines
-  `semver_scheme()` — a definition is not a consumer. Recorded with its
-  evidence grade attached: under this document's own rule the witness-only
-  grep supports `unadjudicated`, so the ruled label is kept as a ruling, and
-  any delete-or-scope decision on this module should not fire until an
-  execution-grade walk confirms it. Whether the type family passes a field
-  diff against semver.org's grammar is likewise unverified and not asserted
-  here.
-- **The `github/*` family**: **dropped from this document.** The per-row rule
-  (each surface judged against its specific REST page, field-for-field; each
-  row's consumption its own) is carried as a rule, but no row of the 19 was
-  adjudicated here — none has had a field-for-field diff or an execution-grade
-  consumer walk run for it in this work.
-
-## What this template changes for bulk work
-
-1. **Two judgments, two instruments — and the instrument must fit the
-   surface.** Field/constructor diffs for data shapes; behavioural conformance
-   for decision procedures; an executing route for consumption. An anchor alone
-   decides nothing: an anchor is exactly the thing product-policy rows can
-   borrow, and a grep hit, a mirror definition or a name-keyed pattern is
-   exactly what a dangling row can borrow.
-2. **Dispositions are derivable, not argued** — from admissible evidence only:
-   fact + executing → scope; fact + dangling → delete or declare a trigger;
-   policy + executing → re-home or re-label; unsupported + dangling → delete
-   (safety-checked); mixed → repair by splitting subjects, then re-judge each
-   side. Where the evidence grade is below the axis, the axis is recorded
-   unadjudicated — and a disposition that would depend on it is recorded as
-   provisional, naming what would settle it (the execution-grade walk or the
-   fitting diff), rather than fired on the lower-grade evidence.
-3. **Shared formal semantics stays a discipline.** Among the cases recorded
-   here, none finally landed there. That is a statement about this sample, not
-   about the frontier. The procedure stands: when a row looks shared, hunt for
-   the recording source; if none exists, the row is product policy or
-   unsupported, never settled as shared by default.
-4. **Unconsumed is a delete-or-declare decision, not a scope** (DESIGN 3c) —
-   and "unconsumed" itself is only decided at the evidence grade above: a row
-   whose consumption is unadjudicated is not thereby dangling, but it is not
-   scopeable either; the execution-grade walk has to run first.
-
-## Verification status of this document
-
-Every consumption claim above is **grep-grade**: no executing route has been
-established at identity grade for any case in this document, so the four
-`unadjudicated` labels are the grade's honest reading and the three `dangling`
-labels are recorded rulings of the side chat with that grade attached — none
-of them is presented as execution-established. The semantic standings of the
-recorded cases were decided against the cited artifacts (the docker/cli line
-numbers are quoted from the module); standings in the set-aside section are
-recorded with their missing evidence named. The census numbers are its own (2026-08-22 / re-derived 2026-08-26) and
-carry that clock. No code, no tsv, and no roster is changed by this PR; it is
-a classification template, and bulk work waits on the operator's ruling on it.
diff --git a/docs/plans/fabric-switch-100g-convergence-gap-analysis.md b/docs/plans/fabric-switch-100g-convergence-gap-analysis.md
deleted file mode 100644
index 77d3ff8d71b..00000000000
--- a/docs/plans/fabric-switch-100g-convergence-gap-analysis.md
+++ /dev/null
@@ -1,237 +0,0 @@
-# Fabric switch 100G convergence — gap analysis
-
-Subject: bringing the eight DGX Spark fabric legs on the MikroTik CRS812-8DS-2DQ-2DDQ-RM from
-50GBASE-CR2 to 100GBASE-CR2, end to end, by execution rather than by hand.
-
-Authorities read: `extdeps.mikrotik.crs812`, `extdeps.ethernet.link_mode`,
-`gunbc.spark.fabric_switch_desired`, `gunbc.spark.fabric_switch_observed`,
-`gunbc.spark.fabric_switch_assessment`, `gunbc.spark.managed_access_bootstrap`,
-`gunbc.spark.grant_privileged_operation`, `gunbc.fleet_ssh_locus`,
-`product.breakout_leg_programming`.
-
-## 0. The standing observation, and what changed under it
-
-`gunbc.spark.fabric_switch_observed` records the legs as QSFP28-coded — extended compliance byte 192
-= `0x0B`, byte 116 = `00h` — so nothing attests 100GBASE-CR2, and the ConnectX-7 derives
-`50G_2X` and refuses `100G_2X` (mstlink opcode 16).
-
-**The operator re-flashed the legs with an FS BOX V4 on 2026-09-17.** That invalidates the EEPROM
-half of the observation above; it does not replace it, because nothing has re-read the bytes.
-
-Read live on 2026-09-17 against `spark-a3ee` (192.168.1.226) as `gunbc-automation`: both fabric
-netdevs (`enp1s0f1np1`, `enP2p1s0f1np1`) are **up, autoneg on, 50000Mb/s**.
-
-That reading is **not** evidence the re-flash failed, and must not be recorded as such. Two causes
-are live and unseparated:
-
-1. the coding did not change, or
-2. the coding is correct and **nothing has forced the mode on either end** —
-   `crs812_passive_dac_requires_forced_mode` is `true`, and the host is currently on autoneg.
-
-The discriminator is the EEPROM bytes plus the NIC's supported-speed set. Neither is readable today
-(§1). Establishing which cause holds is the **first** work item; everything downstream is premised
-on it.
-
-> **SUPERSEDED 2026-09-17 (see G12).** This §0 was written before the read grant landed and the
-> bytes were read. They have since been read: byte 192 = `0x40` (attests 100GBASE-CR2) and the NIC
-> reports `Supported Cable Speed: 100G_2X`. So cause (1) is ruled out — **the re-flash took** — and
-> "the first work item" is done. The current standing fact lives in **G12** and the actuation log;
-> the two paragraphs above are retained as the original framing, not a current open question. The
-> live blocker is now the switch-side QSFP-DD end, not the host coding.
-
-## 1. Gap: the host end cannot be read or set
-
-`sudo -n -l` on spark-a3ee, 2026-09-17, shows `gunbc-automation` holds exactly:
-
-```
-(root) NOPASSWD: /usr/bin/loginctl enable-linger gunbc-automation
-(root) NOPASSWD: /usr/bin/systemctl reboot
-```
-
-So `ethtool -m` (EEPROM read), `ethtool -s` (forced speed) and `mstlink` (supported-speed set,
-`100G_2X` enable) are all unreachable by the principal the fleet runs as.
-
-Missing, in dependency order:
-
-| # | Gap | Home |
-|---|---|---|
-| 1.1 | No `extdeps` authority for the `ethtool` binary — name, path, verbs | new `extdeps/ethtool/` |
-| 1.2 | No `extdeps` authority for `mstlink` / the MFT tools | new `extdeps/mellanox/` |
-| 1.3 | `SparkManagedGrant` has no arm for a module read or a link-mode set | `gunbc.spark.managed_access_bootstrap` |
-| 1.4 | No disclosure standing for what `ethtool -m` returns | same, `spark_managed_grant_disclosure_standing` |
-
-On 1.4: the existing arms are `GrantReturnsNoHostData` (reboot) or `GrantDisclosureUnestablished`
-(container inspect, which is why that grant is **desired but not installable**). `ethtool -m` returns
-module vendor / part / serial and the EEPROM page — host data, but with no analogue of `Config.Env`.
-It needs its own classification; it should not borrow `GrantReturnsNoHostData`, and it is not the
-hard case `InspectServingContainer` is.
-
-**A read grant and a set grant are two grants, not one.** Reading the EEPROM is what settles §0;
-forcing the mode is an actuation on a live fabric. They should be installable independently so the
-discriminating read does not require authorizing the mutation.
-
-## 2. Gap: the switch has never been read
-
-Better than expected — the REST surface is already modeled in `extdeps.mikrotik.crs812`:
-`routeros_rest_authority`, and paths for `/rest/interface/ethernet`, `/rest/interface/ethernet/monitor`,
-`/rest/ip/neighbor`, `/rest/system/identity`, plus `crs812_factory_address` (192.168.88.1/24) and
-`crs812_factory_credential_location`.
-
-And the assessment vertical is genuinely complete: `gunbc.spark.fabric_switch_assessment` carries
-intent, observed, per-lane divergence with causes, typed refusals, expectation-driven unknowns, and a
-`GoalInspection`. `gunbc.spark.fabric_switch_desired` correctly derives the desired lane speed from
-the cable plant rather than declaring it, and refuses rather than degrades when the plant does not
-converge.
-
-**The gap is the transport, and it is total.** `fabric_switch_subject()` passes `readings: []`.
-`observe_fabric_switch_attempt` takes readings as a **supplied** argument. Nothing in the corpus has
-ever performed an HTTP request against the switch, so today every lane resolves to
-`Crs812LaneUnknown` and the assessment is structurally incapable of returning anything else.
-
-| # | Gap | Home |
-|---|---|---|
-| 2.1 | No RouterOS REST **transport** — nothing turns a modeled path into a request | new realization handler |
-| 2.2 | No producer of `List<Crs812LaneReading>` from a live response | `gunbc.spark.fabric_switch_observed` or a new observer |
-| 2.3 | No management address for the switch (only `crs812_factory_address`) | `gunbc.fleet.fleet_intent_network` |
-| 2.4 | No credential standing for the switch | new, mirroring `gunbc.spark.bootstrap_credential` |
-| 2.5 | No apply/actuation path — assessment can diverge but nothing converges | new, after 2.1–2.4 |
-
-Note the ordering constraint from DESIGN §3d: selection precedes convergence, and the assessment
-fold must not grow a realization. 2.1 is a **bound handler**, peripheral to the interface — not an
-edit to `assess_fabric_switch`.
-
-## 3. Gap: the switch credential
-
-`crs812_factory_credential_location` already records that the credential is on the underside label,
-user `admin`. What is missing is a **carried** `SecretRef`.
-
-Per the operator ruling of 2026-08-07 recorded in `gunbc.spark.grant_privileged_operation`, secret
-names are **carried, never derived** — a computed name makes the secret namespace a function of how a
-host is spelled today. And a bare `SecretRef` asserts a secret exists, which is why
-`SparkCredentialStanding` models `CredentialMaterialized` against `CredentialMaterializationPending`.
-
-Minted now so the operator can upload against an exact name, in project `gunbai-secrets`
-(`fleet_secrets_gcp_project`), following the established kebab convention
-(`bmc-srv3-admin`, `spark-administrator-password`, `fleet-automation-ssh-key`):
-
-- **`fabric-switch-factory-admin`** — the factory label credential, treated as **one-time
-  authorization material** exactly as `OperatorBootstrapCredentialRequired` treats the Spark
-  bootstrap admin. Not a serving credential, not retained.
-- **`fabric-switch-admin`** — the rotated credential the fleet actually runs under, generated during
-  bootstrap.
-
-Bootstrap is therefore **not** "log in with the sticker password". It is: authorize once with
-`fabric-switch-factory-admin`, mint and store `fabric-switch-admin`, and leave the factory credential
-dead. Leaving the device on its factory password would be a standing exposure the model would be
-silent about.
-
-These rows land **with their first consumer**, not before — a `SecretRef` nothing reads is the
-dangling declaration DESIGN §3c makes red.
-
-## 4. What is NOT a gap
-
-Worth stating so the work does not re-invent it:
-
-- the desired-speed derivation (cable-plant-driven, refuses rather than degrades) — done;
-- the divergence / unknown / refusal algebra over lanes — done;
-- lane interface naming, lane-speed and FEC wire encodings, the forced-mode fact — done;
-- the SSH credential locus and known-hosts anchor for the host end — done, and verified working;
-- the human cost of the re-flash, and the part that removes it (`extdeps.transceiver.fs_145681`) — done.
-
-## 5. Sequence
-
-**A. Settle §0 before building anything in §2.** Land 1.1 + 1.3 + 1.4 (read grant only), install it,
-read bytes 116 / 192 / 222 and the mstlink supported set off a re-flashed leg. One read decides
-whether the fabric work proceeds or returns to the cable plant.
-
-**B. If the coding attests the mode:** the switch address and `fabric-switch-factory-admin` upload,
-then 2.1–2.4 — read the switch for the first time, which turns eight `Crs812LaneUnknown`s into real
-readings and makes the existing assessment say something.
-
-**C. Then converge,** both ends together: 1.2 + the set grant on the host, 2.5 on the switch, forced
-100GBASE-CR2 with matched FEC.
-
-**D. Re-read and confirm** `100G_2X` actually enabled and the link at 100000Mb/s, then update
-`gunbc.spark.fabric_switch_observed`. Per that module's own standing, this is an **experiment**: only
-the post-change read establishes anything about the copper. If the legs are correctly recoded, both
-ends are forced, and the link still will not come up at 100G, `extdeps.ethernet.link_mode` is explicit
-that operating at 50GBASE-CR2 never certified 100GBASE-CR2 — that outcome is a real possible answer,
-not a failure of the procedure.
-
----
-
-## 6. Modeling gaps & incompatibilities found during actuation (2026-09-17)
-
-Discovered by actually driving the switch and hosts (see fabric-switch-actuation-log.md).
-Each is a place the `.dag` model does not yet express something the real path required.
-
-### Switch model (extdeps.mikrotik.crs812 / gunbc.spark.fabric_switch_*)
-
-- **G1 — no autonegotiation dimension.** The lane model carries speed and FEC but NOT
-  auto-negotiation on/off. Copper (BASE-CR) bring-up is entirely governed by autoneg
-  state; the whole experiment turned on it. `Crs812LaneIntent` needs an autoneg field.
-- **G2 — the FEC enum names FEC by RouterOS label, not by codeword, and the correct 100G
-  codeword is UNWITNESSED.** `Crs812FecMode = FecAuto|FecOff|Fec74|Fec91` carries RouterOS's
-  strings, not the RS codeword (528,514 vs 544,514) each implies — a modeling nicety. Two
-  §4d errors to NOT repeat: (a) an earlier head asserted 100GBASE-CR2 needs RS(544,514) from
-  the IEEE 50G-PAM4 lane FEC and concluded the CRS812 might not expose it — an inference
-  stated as a fact about this switch, retracted; (b) a later head asserted "MikroTik
-  documents fec91 for 100G-baseCR2" (from review, no cited vendor document) and on that
-  strength deleted the converge's FEC-capability refusal arm — the same move in the other
-  direction, also retracted. NEITHER codeword claim is grounded. What IS grounded: the eight
-  fabric legs are OBSERVED running fec-mode fec91 today (at 50G). So `fec91` is the desired-FEC
-  CANDIDATE (the FEC the plant already runs), the converge KEEPS its refusal arm rather than
-  assuming the candidate trains 100G, and grounding the codeword needs a cited MikroTik doc,
-  not an annotation.
-- **G3 — the live link OUTCOME is unmodeled.** The assessment models intent-vs-observed
-  lane divergence, but the observed reading needs: negotiated speed, link state
-  (up / polling / down / auto-init-failed), and FEC-locked, read from BOTH ends. RouterOS
-  `status` (link-ok/auto-init-failed) and `eeprom-checksum` are unmodeled.
-- **G4 — a link is two-ended; the model treats the switch lane as the subject.** The
-  switch reporting `link-ok/100Gbps` is a LOCAL claim; the host was in `Polling`. Link-up
-  is a bilateral fact requiring both ends to agree. The observed model joins both ends for
-  the CABLE receipt but not for the live LINK state.
-- **G5 — QSFP-DD (switch-side) module is unmodeled.** The switch reads the QSFP-DD end,
-  which is CMIS/SFF-8024, NOT the SFF-8636 the host QSFP56 end uses. `sff8636_*` decoders
-  don't cover it. The `eeprom-checksum: bad` on the Generic-coded DD end has no home.
-- **G6 — no RouterOS REST transport / reader / apply.** Still the whole of step B: nothing
-  turns crs812_rest_* paths into requests; `fabric_switch_subject()` passes `readings: []`.
-- **G7 — no switch credential standing landed.** `fabric-switch-factory-admin` exists in
-  Secret Manager but no SecretRef rows; factory->rotated bootstrap unmodeled.
-- **G8 — the fabric legs are on qsfp56-dd cages, not qsfp56.** Confirm desired/assessment
-  target the qsfp56-dd interfaces (the 50G breakout legs), per the observed roster.
-
-### Host model (gunbc.spark.*)
-
-- **G9 — host link control is via mstlink (MFT), which has NO extdeps authority.** The
-  NVIDIA firmware tool surface (mstlink, mstconfig, mstflint) is entirely unmodeled. Host
-  link force/FEC/lane-count lives there, not in ethtool.
-- **G10 — ethtool cannot express 2-lane (CR2) forcing on ConnectX-7.** `ethtool -s speed
-  100000` is lane-count-ambiguous and selects CR4; only mstlink can pin 100G_2X. A modeled
-  host-force MUST use mstlink, and mstlink's flags `-s`, `--link_mode_force`, `-k` are
-  mutually exclusive per invocation (separate calls required).
-- **G11 — no host-side SET/force grant.** This PR modeled only the EEPROM READ grant.
-  Forcing the host link needs a mstlink grant (root), unmodeled and uninstalled.
-- **G12 — fabric_switch_observed is now STALE on main.** It states legs are 0x0B-coded and
-  the NIC refuses 100G_2X. Post-recode: byte 192 = 0x40, NIC Supported Cable Speed =
-  100G_2X. The observed authority must be updated with the new reading (and should model
-  the recode as an event, not overwrite silently).
-
-### Operational / workflow
-
-- **G13 — spark_grants dispatch cannot fan out.** Dispatching 8 fleet-converge runs 3s
-  apart CANCELLED 4 via the workflow concurrency group. Multi-target grant install must be
-  serialized (one run completes before the next) or the workflow needs a fan-out mode.
-- **G14 — spark_grants installs ALL missing grants, not a scoped one.** No dispatch-level
-  way to install only the EEPROM grant vs also InspectServingContainer.
-- **G15 — dropin filename drift.** Host holds `/etc/sudoers.d/gunbc-gunbc-automation` for
-  the linger grant while the model derives `gunbc-enable-linger`. The installed filename
-  and the modeled `spark_managed_grant_dropin_name` disagree; re-install would write a
-  second file. (Noticed earlier, unrelated to this PR, still real.)
-
-### Credential containment (process, not model)
-
-- **G16 — actuation ran on ad-hoc curl with pasted GCP tokens.** The token expired
-  mid-experiment and left srv5 down with no recovery path in-session. The modeled path
-  (WIF on a runner, credential materialized and removed in-step) exists for grant install
-  and must be the ONLY actuation path; ad-hoc curl from a session is the scaffold to kill.
diff --git a/docs/plans/fabric-switch-actuation-log.md b/docs/plans/fabric-switch-actuation-log.md
deleted file mode 100644
index b855a680fcb..00000000000
--- a/docs/plans/fabric-switch-actuation-log.md
+++ /dev/null
@@ -1,118 +0,0 @@
-# Fabric switch 100G — out-of-band actuation log
-
-Operator-approved workaround (2026-09-17): the switch and host link modes were driven
-directly over the RouterOS REST API and the host's `mstlink`, from a session on the LAN,
-ahead of the modeled convergence path (docs/plans/fabric-switch-convergence-build-plan.md).
-
-**This file is an INPUT to the modeled apply, and its dissolution trigger** -- it is NOT an
-exact transcription of a successful configuration, because no bilateral 100G configuration
-worked. It records the facts established, the NORMALIZED operation shapes attempted (with
-placeholders like `<iface>`/`<pci>`/`<dev>`, and RouterOS CLI equivalents for REST
-mutations), and the verdict. A future receipt may carry the exact REST method, resource
-identity, request body, real interface/PCI identifiers, timestamps and pre/post
-observations; that is safely deferred. The
-scaffold is retired when that modeled path lands and reproduces this end state. Round-by-
-round exploration (wrong turns, corrected framings) is intentionally NOT preserved here;
-git history carries it, and this file states each conclusion once, at witnessed confidence.
-
-## Facts established
-
-- **Switch:** MikroTik CRS812-8DS-2DQ-2DDQ, RouterOS 7.20.8, management 192.168.1.240,
-  identity `gunbc-fabric-switch`. REST API live (401 unauth). Credential in Secret
-  Manager: `fabric-switch-factory-admin`.
-- **Host recode confirmed** (read on spark-a3ee, 2026-09-17): EEPROM byte 192 = `0x40`
-  (was `0x0B`), attesting 100GBASE-CR2; `mstlink` reports `Supported Cable Speed: 100G_2X`
-  (was `50G_2X` only); the former "Cable speed not enabled" refusal is gone. All 8
-  ConnectX-7 NICs advertise `100000baseCR2/Full`. This is carried on the modeled carrier:
-  gunbc.spark.fabric_switch_observed `fabric_leg_eeprom_observations` (spark-a3ee row).
-- **The fabric legs are on the switch's `qsfp56-dd` (400G breakout) cages**, comment
-  "gunbc fabric leg": qsfp56-dd-{1,2}-{1,3,5,7}. Each was forced to `50G-baseCR2`,
-  autoneg off, `fec-mode fec91`. `crs812_passive_dac_requires_forced_mode = true`.
-- Lane roster (cage:lane -> host): 1:1 srv5, 1:3 srv8, 1:5 srv7, 1:7 srv6, 2:1 srv10,
-  2:3 srv12, 2:5 srv9, 2:7 srv11.
-
-## Normalized operation shapes attempted (an input to the modeled actuator)
-
-Switch, per lane, over `/rest/interface/ethernet/<iface>` (RouterOS CLI form):
-```
-/interface/ethernet/set <iface> speed=100G-baseCR2 auto-negotiation=no fec-mode=fec91
-/interface/ethernet/disable <iface> ; /interface/ethernet/enable <iface>   # bounce to retrain
-```
-Host (ConnectX-7, PCI 0000:01:00.1), forced 2-lane 100G via mstlink (ethtool -s cannot
-pin CR2 — it ambiguously selects CR4; the flags below are mutually exclusive per call):
-```
-mstlink -d <pci> --link_mode_force -s 100G_2X --yes
-mstlink -d <pci> -k RS --fec_speed 100G_2X --yes
-```
-Restore to known-good 50G: switch `speed=50G-baseCR2 auto-negotiation=no fec-mode=fec91`
-+ bounce; host `mstlink -d <pci> -s 100G_2X,50G_2X,50G_1X,25G,10G,1G --yes` (re-enables
-AN) then `ip link set <dev> down; ip link set <dev> up` (the host needs its own bounce to
-retrain after the mstlink change).
-
-## Verdict (witnessed confidence)
-
-The QSFP56 host recode succeeded and is recognized: the ConnectX-7 advertises 100GBASE-CR2
-and no longer refuses the cable speed. On the CRS812 breakout legs, **no bilateral 100G
-link was established** under either tested production configuration — automatic (both-ends
-autoneg) or forced (both-ends forced, via mstlink for the host), across every switch FEC
-mode. The host sits in `Polling`; the switch reports its own side `link-ok/100Gbps`
-locally while the host never trains. On the autoneg path, RouterOS reports
-`auto-init-failed` and `eeprom-checksum: bad` for the still-Generic-coded QSFP-DD end.
-
-This makes **switch-side QSFP-DD coding/compatibility the leading hypothesis, NOT a proven
-cause**: the current tests do not isolate it from signal integrity, lane grouping,
-firmware, or endpoint interoperability. The tested srv5 leg was the mutated specimen and
-was restored and verified at 50G; all eight legs were verified at their known-good 50G state
-after the experiment.
-
-## FS support escalation (2026-09-18)
-
-FS support asked us to follow the CRS812 breakout documentation: force the port speed with
-auto-negotiation off (`auto-negotiation=no speed=100G-baseCR2` on the odd sub-ports). That
-is the configuration already tested above. They also asked whether the ConnectX-7 was
-actually up when the switch reported link-ok. To answer, one operator-approved retest ran on
-the srv5 leg only (`qsfp56-dd-1-1`, 12:55:07-12:56:00 UTC). Both credentials were loaded
-before the change and the restore was armed to run on exit, which closes the expired-token
-failure above.
-
-- **FS's exact configuration was applied** on the switch with `fec91` and a bounce. The
-  host was forced to `100G_2X` with RS-FEC and bounced.
-- **Both ends were read at +10s and +30s, with the same result each time:**
-  - CRS812: `link-ok`, `rate=100Gbps`.
-  - ConnectX-7: `mstlink State: Polling`, speed N/A.
-  - Linux: `NO-CARRIER`, carrier 0. `ethtool`: `Link detected: no (Autoneg, No partner
-    detected)`, active FEC None.
-  - Ping across the fabric link: 100% loss.
-- **Answer to FS: no, the ConnectX-7 was not operationally up.** The switch's 100G reading
-  describes only its own side.
-- **RouterOS reports `eeprom-checksum: bad` for the QSFP-DD end at the healthy 50G state
-  too.** On its own, the flag therefore does not explain the 100G failure.
-- **The restore was verified from both ends:**
-  - Switch: 50G-baseCR2, fec91, link-ok.
-  - Host: Active, 50G, 2 lanes, RS(528,514), carrier 1.
-  - Ping to .14 and .12: 0% loss.
-- **Operator sent the evidence to FS the same day** (after redacting it): the CRS812 system
-  information and hide-sensitive export, the port and module information, the ConnectX-7
-  mstlink/ethtool/module EEPROM baselines, and simultaneous captures from both ends for the
-  forced test and the restore. Awaiting FS engineering's review. Cable: FS
-  QDD-400G-4QPC015, host-end serial S2630771509-2. Switch: RouterOS 7.20.8. NIC firmware:
-  28.45.4028.
-
-The verdict above stands unchanged. The leading hypothesis is still unproven, and the next
-step is still the substitution control below, unless FS identifies a configuration error.
-
-## Next step: a substitution control, not more configuration
-
-The single experiment that isolates cable/coding from switch/NIC/signal-integrity is a
-hardware substitution: a known-good dual-compatibility cable (FS SKU 145681 / 101806) in
-the same ports, OR the same cable with a known-good 100GBASE-CR2 endpoint pair. Until that
-runs, contacting FS is reasonable but "cause proved" is not. Further out-of-band actuation
-is paused pending credential containment.
-
-## Cross-references
-
-- Credential/restore incident (token expired mid-run, srv5 left down): filed as
-  gunbc.recurring_failure_mode
-  `a_rollback_depends_on_a_credential_that_can_expire_mid_actuation`.
-- Modeling gaps found while driving the hardware: gap-analysis §6 (G1–G16).
-- The modeled path this scaffold dissolves into: fabric-switch-convergence-build-plan.md.
diff --git a/docs/plans/fabric-switch-convergence-build-plan.md b/docs/plans/fabric-switch-convergence-build-plan.md
deleted file mode 100644
index b151cb7d779..00000000000
--- a/docs/plans/fabric-switch-convergence-build-plan.md
+++ /dev/null
@@ -1,90 +0,0 @@
-# Fabric switch convergence — build plan (the normal path)
-
-Goal: when the correctly-coded QSFP-DD end arrives, converge the 8 CRS812 fabric lanes to
-100GBASE-CR2 through a MODELED, repeatable path — no ad-hoc curl. This defines that path
-and sequences it into reviewable PRs. It dissolves the actuation scaffold in
-fabric-switch-actuation-log.md and closes gaps G1-G16 in
-fabric-switch-100g-convergence-gap-analysis.md.
-
-## Layering (DESIGN §3: interface / realization / policy are three facts)
-
-- INTERFACE — `extdeps.mikrotik.crs812` already owns the REST paths, lane speed and FEC
-  wire values, and the forced-mode fact. Extended here with the autoneg axis and a live
-  link-outcome shape (G1, G3). This is what RouterOS's API IS, not what we do with it.
-- REALIZATION — RouterOS REST operations declared as `transport rest` operation rows
-  (method × path × basic-auth), realized by the shared HTTP-client machinery and
-  fixture-tested via `RestExchangeFixture`. Precedent: `extdeps.bmc.http` Redfish ops.
-- POLICY — `gunbc.spark.fabric_switch_*` (workflow layer): which lanes, forced 100G-CR2 +
-  RS-FEC, the credential, the converge order. This is our business decision, not a fact
-  about MikroTik.
-
-## Credential (G7)
-
-Mirror `gunbc.spark.bootstrap_credential` / `grant_privileged_operation`:
-- `fabric-switch-factory-admin` (exists in Secret Manager) as one-time bootstrap material.
-- `fabric-switch-admin` (rotated) as the operating credential.
-- A `FabricSwitchCredentialStanding = CredentialMaterialized{ref} | CredentialMaterializationPending`.
-- Fetched runner-side over Secret Manager REST (as spark_grants does), never in argv.
-- Bootstrap = rotate factory -> admin; the factory credential is not a serving credential.
-
-## PR sequence
-
-- **PR-1 (model only, safe, this session's target): domain + credential.**
-  - Add `auto_negotiation` to the lane intent/reading (G1).
-  - Add `Crs812LinkOutcome` (negotiated speed, link state:
-    LinkUp|Polling|AutoInitFailed|Down, fec-locked) as a two-ended live fact (G3, G4).
-  - Carry the FEC codeword the RouterOS label maps to (G2), a modeling nicety. The desired
-    FEC is `fec91` as a CANDIDATE -- the FEC the eight legs are observed running today -- not
-    a deduced fact: neither the earlier RS(544,514)-is-needed claim (IEEE inference) nor the
-    later fec91-per-MikroTik claim (uncited) is grounded, so the converge intent KEEPS a
-    FEC-capability refusal/observe arm rather than assuming `fec91` trains 100G (§4d).
-  - `FabricSwitchCredentialStanding` + the two SecretRef rows.
-  - Update `gunbc.spark.fabric_switch_observed` (G12): the 2026-09-17 recode is an EVENT
-    (byte 192 0x0B->0x40, NIC Supported Cable Speed 50G_2X->100G_2X) plus the live 50G
-    link reading; do not silently overwrite the prior observation.
-  - Witnesses for each new type/derivation; fixtures from the real REST/mstlink output
-    already captured in the actuation log.
-
-- **PR-2: the read path.** RouterOS REST read operations (GetEthernetInterfaces,
-  MonitorLane) as `transport rest` rows, a reader producing `List<Crs812LaneReading>` from
-  the JSON, fixture-tested against captured responses. Wire `fabric_switch_subject()` to a
-  live read so `assess_fabric_switch` stops being vacuous (readings: []). Read-only.
-
-- **PR-3: the converge path, as ONE two-ended transaction.** The mutating actuator is a
-  single transaction over BOTH endpoints, never a switch-only mutation. Its safety shape is
-  fixed now even though the successful parameter tuple and the implementation defer:
-  1. obtain and validate ALL forward AND recovery authorization before the first effect;
-  2. capture host and switch pre-state;
-  3. apply the complete candidate to both endpoints;
-  4. accept success only on bilateral agreement on the required link state (switch monitor
-     AND host both report the negotiated speed, never one end's local "link-ok");
-  5. on every other terminal -- refusal, timeout, interruption, `Polling`, producer
-     disagreement -- restore both captured pre-states WITHOUT fetching new authorization;
-  6. read both endpoints back and make VERIFIED restoration part of the terminal result;
-  7. remove credentials only after confirmed success OR confirmed rollback.
-  It mirrors `gunbc.spark.managed_access_apply` for the per-step typed-outcome/receipt
-  shape, run via `fleet-converge.yml`. The desired FEC is the `fec91` candidate (G2); the
-  intent KEEPS a FEC-capability refusal/observe arm -- whether `fec91` trains 100G is
-  unwitnessed, so the actuator observes and refuses rather than assuming it works.
-  **Sequencing rule (the design commits to this now):** because forcing the HOST end needs
-  PR-4's mstlink set grant, the mutating switch effect and the host effect are components of
-  ONE actuator -- PR-3 and PR-4 land together, or the switch converge stays READ-ONLY until
-  both exist. The design does NOT authorize "mutate the switch now, add host actuation and
-  rollback later": that terminates with the endpoints intentionally divergent, which step 5
-  forbids. Reading negotiated speed is unprivileged (`ethtool`), so OBSERVING both ends is
-  available before PR-4; only the two-ended MUTATION requires it. Forced-both is the
-  MikroTik-documented production candidate, not an established working config (the one
-  mstlink run of it did NOT train -- host stayed in Polling -- fabric-switch-actuation-log.md),
-  so PR-3+PR-4 let us RE-TEST it once the QSFP-DD coding is fixed rather than achieve
-  convergence by themselves.
-
-- **PR-4 (host side): mstlink authority + set grant.** `extdeps.mellanox` for mstlink
-  (G9), the 2-lane-force fact (G10: ethtool cannot pin CR2), and the host-side set grant
-  (G11) so the host end is forced through the modeled grant path, not sudo-over-SSH.
-
-## What none of this can do until the hardware is right
-
-The model + fixtures do not need a live 100G link to be correct and tested. But end-to-end
-CONVERGENCE to 100G cannot SUCCEED until the QSFP-DD end links at 100G (pending FS /
-substitution). PR-3's converge will correctly REFUSE or report Polling until then — which
-is the honest behavior, not a failure of the model.
diff --git a/docs/plans/fleet-revision-relation-fixture.md b/docs/plans/fleet-revision-relation-fixture.md
deleted file mode 100644
index 1f9e7b9dc9d..00000000000
--- a/docs/plans/fleet-revision-relation-fixture.md
+++ /dev/null
@@ -1,118 +0,0 @@
-# The fleet-revision-relation fixture repository
-
-Rebuild recipe for the controlled git repository behind
-`dag/test/claim/fleet_revision_relation_wet_matrix_test.dag`.
-
-## Why a fixture repository at all
-
-The pure merge-base fold is already witnessed by authored exit codes, and
-`git.Inspect.MergeBase` itself is witnessed by record/replay. Neither covers the
-*composition* — `observe_fleet_revision_relation_in` → `MergeBase` →
-`fleet_revision_relation_from_merge_base` — where a swapped operand, a dropped `trim`, or a
-mis-decoded stdout would live. A fold fed authored inputs cannot catch those: authoring the
-inputs is the step under test.
-
-## The graph
-
-```
-        B  main
-       /
-  A ──┤   base-a
-       \
-        C  sibling
-
-  D  orphan      an independent root, no common ancestor with anything above
-```
-
-Every commit carries a branch **on purpose**. `C` was originally created on a detached
-HEAD and so unreachable; `merge-base` still answered only because the object had not been
-collected yet. A fixture whose correctness depends on gc not having run is not a fixture.
-
-## Recipe
-
-Identities and timestamps are fixed because the object ids participate in the operation
-input hash: a machine-dependent id makes the recorded fixtures unportable.
-
-```sh
-FX=target/test-fixtures/fleet-revision-relation
-rm -rf "$FX"; mkdir -p "$FX"
-export GIT_AUTHOR_NAME=fixture GIT_AUTHOR_EMAIL=fixture@invalid
-export GIT_COMMITTER_NAME=fixture GIT_COMMITTER_EMAIL=fixture@invalid
-export GIT_AUTHOR_DATE="2020-01-01T00:00:00+0000"
-export GIT_COMMITTER_DATE="2020-01-01T00:00:00+0000"
-git -C "$FX" init -q -b main
-echo a > "$FX/f"; git -C "$FX" add -A; git -C "$FX" commit -q -m A
-git -C "$FX" branch base-a
-echo b > "$FX/f"; git -C "$FX" add -A; git -C "$FX" commit -q -m B
-git -C "$FX" checkout -q -b sibling base-a
-echo c > "$FX/f"; git -C "$FX" add -A; git -C "$FX" commit -q -m C
-git -C "$FX" checkout -q --orphan orphan
-echo d > "$FX/f"; git -C "$FX" add -A; git -C "$FX" commit -q -m D
-git -C "$FX" checkout -q main
-
-mkdir -p target/test-fixtures/not-a-repository   # case 7 needs a real non-repository path
-```
-
-Verified reproducible: two independent builds produced identical `show-ref` output.
-
-## Object roster
-
-| ref | commit | oid |
-|---|---|---|
-| `base-a` | A | `3728e5635c811256194971bcaed367914a6040e6` |
-| `main` | B | `3ad80d79bd1f64a7f75e121d7323aed053a81f0b` |
-| `sibling` | C | `d0d3a7f6e323428bd771a32b1a19554481e1ae7c` |
-| `orphan` | D | `8286843fce4511d0157573ba33b48ba46e48958a` |
-| — | absent, decodable | `1111111111111111111111111111111111111111` |
-
-The absent id must be **decodable**, or the probe is never dispatched and the case proves
-nothing about exit 128.
-
-## The seven cases, and what each one is for
-
-| # | current, accepted | exit | relation | why it is in the matrix |
-|---|---|---|---|---|
-| 1 | B, B | — | `SameRevision` | short-circuits before any dispatch |
-| 1b | B, B (non-repository path) | — | `SameRevision` | the short-circuit does not depend on the repository existing |
-| 2 | A, B | 0, base = A | `DeployedIsAncestor` | ordinary forward advance; base **is** current |
-| 3 | B, A | 0, base = A | `CandidateIsAncestor` | superseded; base **is** accepted |
-| 4 | B, C | 0, base = A | `UnrelatedHistories` | diverged **with a shared ancestor** — the case whose receipt used to claim a disjoint history |
-| 5 | B, D | 1 | `UnrelatedHistories` | no common ancestor; exit 1 is an **answer** |
-| 6 | B, absent | 128 | `RelationUnverifiable` | could not look — must not collapse into 5 |
-| 7 | B, C (non-repository path) | 128 | `RelationUnverifiable` | a second route to 128; if it ever answered a relation, the observation is reading some other repository |
-
-Cases 5 and 6 are additionally asserted as one row
-(`no_merge_base_and_could_not_look_stay_distinguishable`) so the distinction cannot be
-half-satisfied. A consumer reading the operation's `success: Bool` instead of its exit code
-cannot tell them apart at all — the live residual recorded on `MergeBaseOutcome`.
-
-## Record, replay, and the controls
-
-Commands are in the exclusion row's dissolution description
-(`gunbc.ci_layer_roots`, pattern `fleet_revision_relation_wet_matrix_test.dag`) so the recipe
-sits beside the reason a reader looks it up.
-
-Measured results:
-
-- **record (wet)** — 9/9 PASS, 6 distinct fixtures written for `git.Inspect.MergeBase`
-  (six, not seven, because case 5 and case 6 each appear twice across the nine rows).
-- **replay (hermetic, exact store)** — 9/9 PASS.
-- **control: empty store** — the two short-circuit rows still PASS; the other seven FAIL
-  with `missing recorded fixture`, each naming a **distinct** input hash. This proves the
-  passing replay consumed recorded observations rather than reaching live git, and separately
-  that the short-circuit is real.
-- **control: wrong input hash** — one fixture renamed to a bogus hash, the rest left in
-  place. Its case refuses with its own exact hash while a sibling case still passes from
-  the same store. The store is an exact observation map, not a nearest-match catalog.
-
-The recorded `inputs` array includes `repository_path`, which is the direct evidence that
-the repository participates in the key rather than being ambient.
-
-## What this does not cover
-
-The file does not run in the required floor: `git.Inspect.MergeBase` publishes no
-`mock_response`, and recorded shell observations cannot reach a floor run —
-`WitnessEvaluationFrame` carries only `rest_fixtures`, and `--fixture-store` is a
-`claim_batch` flag with no `claim_executor` equivalent. The exclusion row carries the
-substantiated reason and the dissolution trigger — a shell/service fixture arm on
-`WitnessEvaluationFrame`, after which these rows enroll unchanged.
diff --git a/docs/plans/floor-aggregate-cost-authority.md b/docs/plans/floor-aggregate-cost-authority.md
deleted file mode 100644
index 82759f3305c..00000000000
--- a/docs/plans/floor-aggregate-cost-authority.md
+++ /dev/null
@@ -1,121 +0,0 @@
-# The floor's aggregate cost has no authority
-
-Status: proposal. No code yet.
-
-Raised from reading two required-floor runs (35365418267 merge_group,
-35366842458 pull_request, 2026-09-18). Those IDs say WHERE the reading was
-taken and are deliberately not doing the work of a producer: nothing in this
-document quotes a duration, a population or a ratio as a standing quantity.
-The producer for a floor run is the `required-witnesses-floor` job of
-`gunbc.witness_floor_workflow`, and this proposal's whole point is that the
-quantity it is about has no carrier yet -- so where a figure would go, it names
-what would emit it instead (DESIGN §6: name the instrument, never transcribe
-its output).
-
-## The gap
-
-The floor has a rich **per-item** cost model and no **population** model.
-
-Per item, today: `std.evaluation_budget` bounds one evaluation on two clocks;
-`v2.workflow.floor_enrolment_margin` requires a newly enrolled witness to reach
-a verdict with derived headroom; `v2.workflow.floor_cost_debt` withholds
-identities whose marginal cost exceeds
-`v2.workflow.required_floor` `required_floor_per_subject_cpu_line_ms`;
-`gunbc.floor_cost_distribution` `implied_clean_run_budget` derives that line
-from measured run-to-run inflation as an order statistic.
-
-Every one of those is denominated in ONE witness. None is a statement about the
-run. So the floor's total is a quantity no declaration carries, no gate reads,
-no refusal can cite, and no change is charged against.
-
-Each added witness is individually justified, individually inside its margin,
-individually admitted -- and the aggregate is nobody's finding. That is §5's
-externalization at authoring time: the cost is real, it is caused by a specific
-change, and it is paid by every session that later waits on CI.
-
-## Why a per-item budget cannot be tightened into a population budget
-
-Tightening `required_floor_per_subject_cpu_line_ms` prices the TAIL, not the
-SUM. A per-subject line low enough to bound the sum would withhold a large
-population of individually cheap, individually correct witnesses -- a §4d
-over-prohibition, forbidding more than the evidence supports. Sum and maximum
-are two facts; one authority cannot carry both.
-
-## What is missing, stated as a modeling obligation
-
-Per §3b, a domain whose home does not exist is a modeling obligation, not yet a
-conformance row. The obligation is an observation carrier and a disposition.
-
-**The observation must be attributed, not a single wall figure.** A lump total
-would blame whichever witness's window happened to contain a shared cost --
-the same attribution defect `floor_cost_debt` already discovered per-claim.
-The grains are: fixed preparation demand; shared-fill demand; marginal claim
-work; orchestration; and an explicit **unattributed remainder**. The remainder
-is a declared field rather than a silent residue, because on the measured runs
-on the run this proposal was raised from it was the largest single component --
-a ONE-OFF reading, taken by summing the `done in` stage lines against the
-`[floor-phase]` seam markers in one required run's log, with no entry point that
-re-derives it. It is named as a one-off rather than quoted as a quantity, and
-the carrier's `unattributed_work` field is what makes the figure a produced
-output instead of a remembered one and an authority that cannot say how much it cannot explain is
-reporting a number it has not earned. `measurement_completeness` travels with
-the observation so a disposition derived from a partial reading is refusable
-rather than quietly authoritative.
-
-**The policy carries three facts, not one budget.**
-
-- **desired target** -- 20 minutes.
-- **hard steady-state ceiling** -- 30 minutes.
-- **declared migration debt** -- NOT a figure carried here. It is read from the
-  `required-witnesses-floor` job of `gunbc.witness_floor_workflow` at the revision
-  the authority lands, by the producer the observation names. A number transcribed
-  into this proposal would be the baseline the whole policy is denominated in,
-  decaying without anyone touching either end (DESIGN §6).
-
-The three are separate because the floor is ALREADY over the ceiling. A policy
-that refused everything above 30 today would deadlock the repository, and a
-policy that silently adopted the observed figure as the budget would let the
-temporary baseline replace the target. So during migration the ordinary obligation is
-**non-worsening against the declared debt**, while the performance lanes lower
-the debt; once the floor is under 30 the ceiling ratchets down and becomes an
-ordinary refusal boundary. The target stays visible throughout.
-
-**An increase is a separately authorized act.** An envelope any cost-adding
-change may raise is accounting, not governance -- the change cannot grant
-itself the room. An amendment names the added capability, its measured cost,
-the authorizing operator, and a retirement or offset condition, and it raises
-the ceiling without raising the target.
-
-## What this does NOT license
-
-It does not license deleting evidence. §4b(4) requires a repaired class's
-discriminating RED and positive control to **remain enrolled**. What it does
-not require is one permanent authored file and one independently paid compile
-per specimen: evidence may be consolidated into a data-driven matrix, carried
-by one stronger discriminating construction, evaluated over a shared prepared
-closure, or subsumed by a stronger wall that retains the required RED and
-positive control. Consolidation of the physical representation is therefore a
-legitimate lane for lowering the debt; retirement of the obligation is not.
-
-If an envelope ever forces the choice, the ladder wins and the envelope is
-amended -- which is the whole reason amendment exists.
-
-## An open quantity this proposal deliberately does not assert
-
-Whether, and how steeply, floor runtime grows with authored witnesses. The authored
-population is re-derived by `git grep -cE '^\s*test fn ' <rev> -- '*.dag'` over
-any two revisions, and it grows steeply. But the topology filters hard: the
-floor's own `required-floor: declared=N offered=N routed=N ...` census line
-(`v1_compiler.bin.claim_executor`) is the producer for what survives to run, and
-it reports a small fraction of the declared population. Declaration count is
-therefore NOT the demand unit, and a
-claim that a speedup would be consumed by growth needs a measured slope from
-added identities to routed closures, compile groups and critical-path time.
-That slope is the first instrument this authority needs and is not yet
-measured. Until it is, growth is a motive for building the authority and not
-evidence for any particular envelope.
-
-## Relation to the performance lane
-
-An aggregate authority does not make the floor faster. It makes the floor's
-speed a governed quantity instead of a side effect.
diff --git a/docs/plans/floor-cost-distribution-near-the-ceiling.md b/docs/plans/floor-cost-distribution-near-the-ceiling.md
deleted file mode 100644
index 42592b5e0ad..00000000000
--- a/docs/plans/floor-cost-distribution-near-the-ceiling.md
+++ /dev/null
@@ -1,437 +0,0 @@
-# The floor cost distribution near the 500ms ceiling
-
-*Measurement, not a repair. Commissioned by tidy-lynx-804 after gunbc#10133 to decide whether
-further per-producer work is a treadmill. The question is whether the population near the ceiling
-is dense, whether the rows now crossing share a root, and what an honest margin policy would be.*
-
-## The instrument
-
-**Every figure below is produced by `tools.floor_cost_distribution_instrument`
-`floor_cost_distribution_report`, and the derivations it composes are
-`gunbc.floor_cost_distribution`.** Re-derive rather than trust this page:
-
-```
-# one download per run id in `floor_cost_sampled_runs`, into `floor_cost_artifact_root`:
-gh run download <run-id> -n required-floor-claim-cost -D /tmp/floor-cost/<run-id>
-
-gunbc run --source-root dag --source-root src/v2 \
-  --entry dag/gunbc/instruments/floor_cost_distribution_instrument.dag \
-  --function floor_cost_distribution_report
-```
-
-The first version of this memo named `gunbc.witness_floor_workflow` as its instrument. That
-workflow produces the raw rows and performs none of the analysis — the ten-run intersection, the
-band histogram, the counterfactual replay and the inflation percentiles existed only as prose plus
-numbers, so a reader could check the arithmetic of nothing. Review 58983 refused it on exactly that
-ground. The figures that remain below are illustrative of what the instrument returned on the runs
-it names; the instrument is the authority, and where the two disagree the instrument is right.
-
-**The input needs no floor run.** `required-floor-claim-cost` is uploaded by every required-floor
-run and carries the COMPLETE executed population — the `[over-cost]` lines in the job log are a
-25-row preview of the same data and say so. The runs are named as data in
-`floor_cost_sampled_runs`, because a measurement over "whatever happened to be downloaded" is not
-re-derivable: a second reader would get different numbers with no way to tell a real change from a
-different sample.
-
-**THE TEN SAMPLED RUNS REFUSE AS OF THE DISJOINT-COLUMN ARTIFACT CHANGE, AND THIS INSTRUMENT WAS
-ITSELF THE SPECIMEN THAT MOTIVATED IT.** Every run named in `floor_cost_sampled_runs` predates that
-change: their `required-floor-claim-cost` carries the old shared `cpu_ms` column, in which a
-completed cost and the lower bound of a claim a safety deadline preempted sit in one field with
-only an adjacent `verdict_reached` to separate them. This analysis resolved `cpu_ms` by name,
-refused correctly on a *missing* column, and never asked for that discriminator — so every band,
-every worst-cost fold and every inflation ratio on this page consumed bounds as costs. The bound's
-magnitude is approximately the ceiling that stopped the row, so the "population dense near the
-ceiling" that a histogram over those rows shows is partly manufactured by the ceiling itself.
-
-`claim_cost_columns` no longer resolves the old header, so those runs load as `RunRefused` — **not
-`RunEmpty`**, which is a distinction the reader must not lose: an artifact whose measurements cannot
-be read is not a run that measured nothing. The cause is typed and named
-`UnsupportedSharedCpuMsVintage`, and `floor_cost_distribution_check` refuses the whole sample.
-
-That is the correct fail-closed answer rather than a regression, but the honest reason is narrower
-than the one this page used to give. It said the two populations "are not separable in those bytes
-at all". **That is overstated.** The old artifact carries `outcome` and `verdict_reached`, and this
-very instrument treats `outcome=budget_interrupted` as an interruption signal — so an identifying
-signal exists. The accurate statement is that the vintage is *known and unsupported*: one `cpu_ms`
-column held both populations, and this version declines to reconstruct the split rather than being
-unable to detect that one is needed. Nothing here obligates a legacy migration; it only forbids
-claiming the bytes are silent when they are not. **The figures this page describes as illustrative should be read as carrying
-that defect, not merely as stale.** Re-pointing `floor_cost_sampled_runs` at runs from the new
-artifact vintage restores the instrument; the derivations are unchanged and their witness runs on a
-hand-built fixture, so nothing but the live figures is waiting on the re-sample.
-
-**An incomplete sample refuses.** `floor_cost_distribution_check` exits non-zero naming every run
-that failed to load. One artifact in an eleventh run (`33667468330`) downloaded empty during the
-original analysis and silently emptied a ten-way identity intersection before it was caught — a run
-that reads as zero rows is indistinguishable from a run in which nothing crossed, which is the
-absorbing fallback DESIGN §5 forbids. Both refusal arms are witnessed in
-`test.claim.floor_cost_distribution_witness`, along with a discriminating red for each derivation
-below.
-
-## 1. The band is dense, and the tail is a plateau
-
-Post-repair run `33691893294`, CPU basis, 3,498 rows: median 2ms, mean 34ms, p90 86ms, p99 397ms.
-
-| CPU band | rows | cumulative from top |
-| --- | --- | --- |
-| ≥500 | 5 | 5 |
-| 400–500 | 27 | 32 |
-| 300–400 | 55 | 87 |
-| 200–300 | 89 | 176 |
-| 100–200 | 148 | 324 |
-| <100 | 3,174 | 3,498 |
-
-**There is no gap below the ceiling.** The decision-relevant form of that is what happens if modules
-are repaired top-down. Taking the worst row remaining across all ten runs, removing modules in
-max-cost order after the three gunbc#10133 already fixed:
-
-| modules repaired | worst row remaining | runs refused /10 |
-| --- | --- | --- |
-| (the 3 from #10133) | 533 | 1 |
-| +`rust_produced_decl_emit` | 525 | 1 |
-| +`emit_host_field_access_equals_eval` | 511 | 1 |
-| +`emit_host_fold_closure_equals_eval` | 490 | 0 |
-| +`semantic_decl_serialize_parity` | 487 | 0 |
-| +`emit_host_meet_join_equals_eval` | 486 | 0 |
-| +5 more modules | 429 | 0 |
-
-The first three modules buy 43ms. The next seven buy 61ms — roughly **10ms per module**. That is the
-treadmill, quantified: below the top of the band each repair returns about one fiftieth of the
-ceiling.
-
-## 2. The new crossers do NOT share a root the way the #10133 three did
-
-`eval_steps` is a cheap structural fingerprint of shared work, and it separates the two cases
-cleanly.
-
-The three modules gunbc#10133 repaired reported **612,662–658,336** eval steps — a 1.07x spread
-across seventeen rows in three modules with unrelated subjects. That uniformity *is* the signature of
-one shared dominant producer, and it was: `compile_phase_frontier_standing`.
-
-The families now near the ceiling report **63,196–197,227** eval steps — a 3.1x spread. They are
-three distinct shapes rather than one:
-
-| family | rows ≥200ms | eval_steps | wall/cpu |
-| --- | --- | --- | --- |
-| `v2.test.execution.emit_host_*_equals_eval` | 33 | 63k–174k | **2.05** |
-| `v2.test.emit.semantic_decl_*` | 27 | 78k–141k | 1.01 |
-| `v2.test.emit.rust_*` / `produced_decl_*` | 48 | 77k–197k | 1.00 |
-
-The `emit_host_*` family spends half its wall clock off-CPU, which is the region
-`v2.workflow.required_floor` already carries a §4b rung drop for (`OpaqueHostCallUnbounded`).
-
-**There is one shared-producer lead, and it is not a plan.** `required-floor-cross-claim-demand`
-ranks `bind_outcome` (`v2.std.diagnostic`, unkeyed, 679 claims / 108,085 evals / 183 modules) at the
-top by a factor of 13, and its module samples reach both the emit and the execution families. But
-that artifact's own header states `cost_columns=inclusive_of_callees_do_not_sum`, and its column
-totals 1,736,654ms against the run's actual `claim_cpu_total_ms=120,177` — a factor of 14. It ranks
-candidates; it cannot quantify a saving, and it must not be cited as one.
-
-## 3. The margin, measured
-
-Run-to-run variation on the **same identity** across the sample, restricted to rows with enough
-signal that integer milliseconds are not noise:
-
-- median **1.16x**, p90 **1.35x**, p95 ~1.43x, max ~**2.0x**.
-
-Two mechanism hypotheses were tested and both are refuted, which is what makes a single global margin
-defensible:
-
-- **Expensive rows do not inflate more.** By baseline-cost bucket the median inflation is 1.18, 1.13,
-  1.19, 1.17, 1.07, 0.92 for the 20–50 … 400–500ms buckets.
-- **Host-call-heavy rows do not inflate more.** By wall/cpu class the median inflation is 1.16 (pure
-  CPU), 1.13, 1.16 (host-heavy ≥1.8).
-
-Run-level contention alone spans only 0.92x–1.15x across the ten runs, so most of the spread is
-per-row rather than per-run. And run `33688140761` **refused with a below-median run factor of
-0.96**, which is why a refusal cannot be read as evidence that the fleet was busy.
-
-**PR runs are harsher than `main` runs.** All four modules reported crossing on PR runs
-(#10109/#10122/#10123) have `main`-run medians of 314–391ms and `main`-run maxima of 417–487ms, so
-the PR path reaches roughly 1.6x on a median row.
-
-At 1.6x a row must sit under **312ms** on a clean run to be safe; at the observed 2.0x, under
-**250ms**. **87 rows exceed 300ms today.**
-
-## 4. What this corrects
-
-The framing that prompted this measurement was that gunbc#10133 promoted the next rows down the
-ranking into the margin. **The promotion mechanism is refuted, and the repair was disproportionate
-rather than one step of a treadmill.**
-
-*Refuted:* rank does not cause a crossing, absolute cost does, and removing rows above a row does not
-make it slower. Measured directly, the five rows that crossed on the post-repair run went **above
-their own pre-repair maxima** — pre-repair median 343ms and max 472ms over 45 observations, against
-504–533ms post-repair. They did not inherit a margin; they got slower, on the most contended run in
-the sample (run factor 1.15, the highest of the ten).
-
-*Disproportionate:* replaying all ten runs with the three repaired modules excluded —
-
-| | runs refused |
-| --- | --- |
-| as observed | **5 / 10** |
-| with the #10133 modules excluded | **1 / 10** |
-
-Across the nine pre-repair runs, **no row outside those three modules ever crossed 500ms.** Those
-three modules were 17 of the 22 distinct identities that crossed anywhere in the sample. They were an
-outlier — one shared 612k-step producer — not a sample of the plateau.
-
-## 5. What follows
-
-The plateau is real and per-producer repair is the wrong unit for 87 rows returning ~10ms each. Two
-remedies are sanctioned by `v2.workflow.required_floor`: reduce what the witness reaches for, or
-enroll it in a lane declaring its own dated ceiling **and** naming the row as an executing consumer.
-
-**Raising the ceiling is not a third option and should not be re-proposed.** That module records the
-value being raised 500→1552→5000 and both raises being repudiated: 1552 was measured-max plus a
-scheduler quantum on the same current tree, which is the oracle DESIGN §5 forbids by name, and 5000
-rode in as a passenger on a ruling about something else. The population that accumulated under that
-drift is frozen in `v2.workflow.floor_cost_debt` precisely so it is not granted a higher ceiling.
-
-Which of the two remedies fits the emit and execution families — and whether a `bind_outcome` repair
-buys real margin or only a rank change — is a decision this measurement informs and does not make.
-
-## 6. The premise is measured false: there is no fixed above-ceiling identity set, and the budget is not mis-set
-
-*Added after the §5 question was worked. It is recorded here rather than in the thread that produced
-it because the belief it refutes is the one a reader re-forms from the same symptom — a red floor
-lane naming a handful of emit rows — and re-deriving it costs a night.*
-
-**The claim being retired: "three (later seven) self-host witness modules sit above the 500ms hard
-CPU ceiling." Measured, no fixed above-ceiling identity set exists.** Completed green runs place this
-family's band below 500ms; run variance can carry its top across, and four completed-over-cost rows
-were observed at 506–515ms. What is retired is that the family is *intrinsically* above the ceiling —
-a row does not stably "sit" on either side of an attempt-safety boundary — not the crossings
-themselves, which are real and recur. Both remedies §5 names are
-refused for this family on evidence, and the ceiling is correctly denominated. What remains is a
-different subject, stated at the end.
-
-### How to re-derive this, because there is no instrument module for it
-
-The §5 instrument reads one artifact per run. The join below needs a second axis — the same
-identities measured off-CI — and **no authority owns it today**, which is a gap and not a style
-choice. The recipe, at identity grain:
-
-```
-# CI side: per-claim identity/outcome/cpu_ms for a completed run
-gh run download <run-id> -R gunb-ai/gunbc -n required-floor-claim-cost -D /tmp/ci/<run-id>
-
-# local side: ONE function per process, which matches the floor's fresh-frame-per-claim
-claim_batch --source-root dag --source-root src/v2 \
-  --eval-budget-ms 300000 --entry <entry> --functions <one identity>
-```
-
-Join on identity. Use runs whose rows **completed**; prefer green runs for the baseline factor.
-
-### Three readings that are wrong, and the control that exposes each
-
-**An `interrupted_before_verdict` figure is the budget, not the row.** The deadline preempted the
-measurement, so the cost is unbounded above 500. Every interrupted row reports approximately whatever
-ceiling stopped it, so a set of them looks like a tight cluster "just over" no matter what the true
-costs are. Only `completed_over_cost_requirement` rows carry costs. Raising `--eval-budget-ms` on a
-probe is how you measure one; that is instrumenting, and is not the ceiling-raise §5 repudiates.
-
-**The crossing set is not the expensive set.** Measured with the budget raised, the row in
-`v2.test.emit.rust_body_add_emit` that *passed* on CI is the most expensive of its four, and the
-three that were interrupted are all cheaper — a single-digit-ms spread separates survivor from
-casualty. Repairing "the rows that crossed" therefore fits noise. **Always measure the non-crossing
-siblings**; they are what reveals the band.
-
-**A one-anchor local→CI factor does not transfer.** A factor taken from one identity predicted
-another row comfortably under the ceiling that CI had in fact interrupted. Take the factor from
-many identities across several runs, or not at all.
-
-### What the join shows
-
-Joined over the emit and execution rows of this family across three main runs, the local→CI cpu
-factor is **stable across green runs and materially higher on a failed one** — the same tree and the
-same rows, with every row inflated together. At the green factor the family's whole band lands well
-inside the ceiling; at the failed run's factor its top crosses. That is CI run-to-run variance, and
-it independently corroborates the inflation distribution §3 measures from the other direction — two
-instruments built for different purposes agreeing on one phenomenon.
-
-`v2.test.execution.emit_host_fold_closure_equals_eval` is the worked example: interrupted at
-`cpu_at_least=522ms` on one job, it completes under budget on every green run in the join.
-
-**The host-independent form of this, which is stronger and needs no factor at all.** `eval_steps` is
-carried in the same artifact and does not depend on the machine. Across the three runs, **every row
-of this family that completed has a byte-identical step count** — identical work — while its
-`cpu_ms` swings by up to the full green-to-failed ratio. Milliseconds move; the work does not. That
-settles the question without any local→CI conversion, and it is the axis to use.
-
-The single row whose step count differs is the one that was **interrupted** on the failed run: its
-count is truncated where the deadline stopped it. So the one apparent exception is a second
-demonstration of the first misreading above — an interrupted row is not measured, in steps or in
-milliseconds. *(The `eval_steps`-as-control technique is `gunbc#10158`'s; see the caveat below.)*
-
-### Why reducing the cost is the only lever, and what the cost is
-
-Both §5 remedies are refused for this family:
-
-- **Reduce what the witness reaches for** — refused by measurement. Decomposing `rust_target_model`
-  component-by-component (each in its own process, against a baseline replicated across four
-  independently written probe modules) shows every component except the bundle costs nothing, and
-  the bundle is what the emission reads. There is no oversized subject to trim, the test fixture is
-  free, and both cost-shape defects were looked for and are absent — the module fold is linear, and
-  the two `list_snoc_item`-in-a-fold sites operate over ~8 and 3 elements.
-- **Enroll it in a lane declaring its own dated ceiling** — no such lane exists. Every candidate
-  either withholds rows from execution (`v2.workflow.floor_cost_debt`, whose own header states
-  membership deletes coverage, and which is shrink-only and closed to new crossers) or names a
-  cadence with no workflow (`FalsifierSubstrateLongLane`; no workflow in the tree carries a
-  `schedule:` trigger). Taking that arm would mean *building* a lane.
-
-The per-claim cost is a **fixed floor plus a small per-declaration term**, not per-declaration work:
-the second declaration emitted in a frame costs a fraction of the first, and the module fold adds
-nothing over separate calls. The fixed part splits into `rust_target_model` construction, the
-arrow-body projection, and two smaller serialize steps. The projection term is **measured at the
-`v2.std.compilers.target_model` `target_project_arrow_body_to_value_expression` frame and attributed
-by elimination** to the primitive-apply step beneath it — the neighbouring candidates
-(`dag_value_expression_projection`, `dag_surface_operator_canonicalization_member`, the
-translation-rules lookup, the inner-arrow construction) each measure zero, the last two tested with
-inputs that would have exposed a table build even on a miss.
-
-**One live lead, left undetermined on purpose.** The first projection in a frame costs; subsequent
-ones do not, *regardless of which declaration body is projected*. That is equally consistent with a
-memo keyed above the body and with a one-time warm of a shared structure that any first caller pays.
-Those want different providers, so the mechanism must be separated before any provider is proposed —
-that ambiguity, not the cost, is the open question. Two prior sharing attempts on this surface are
-already refused: a `data`-row promotion cannot reach the floor at all (`required_floor_runner` builds
-a fresh evaluation frame per claim, so `data_cache` never spans claims), and `rust_target_model` was
-enrolled in `v2.workflow.floor_pure_producer_share` and withdrawn after measuring this exact cluster
-*worse* — read that roster's header before re-proposing either.
-
-**One caveat on that withdrawal, added because `gunbc#10158` landed while this section was being
-written.** The roster's rust-row measurements were normalised against *rows in no consumer module of
-any enrolled key*, and #10158 shows that control is **biased by composition** — it demonstrated the
-point by splitting a subject's own rows on `eval_steps` into those the serve reached and those doing
-byte-identical work, and finding the supposedly untouched group moved almost as much. Rows elsewhere
-are an assumption about the corpus; rows doing byte-identical work are an observation about the row.
-That does not overturn the withdrawal, and the roster's own next trigger still governs — but the
-strength of "measured worse" now rests on a control known to be biased, so a re-proposal should
-re-measure against the step-split control rather than treat the question as closed.
-
-A value check was run before treating any of this as a caching opportunity: the projections of
-`x + y` and `y + x` are compared and **differ**, carrying both a positive control that the equality
-works and a by-construction-false row proving the harness reports failures at all. A cheaper-looking
-result that lost operand order would have been a correctness defect, not a saving.
-
-### The subject, restated
-
-The floor is not flipping because a few rows are too expensive. **The emit surface sits at roughly
-two-thirds to four-fifths of the per-claim budget on a normal run, and CI run-to-run variance is
-large enough to carry its top across the line** — so which rows cross is a property of the run, not
-of the rows. Reducing the shared fixed cost raises the margin against that variance. Nothing else
-currently on the table does, and per-row repair aimed at whichever identities crossed last is
-repairing the sample rather than the population.
-
-## 7. The margin of §3 is a two-run point estimate; the between-run envelope is wider
-
-*Commissioned after `v2.test.emit.rust_produced_decl_emit.rust_produced_decl_name_discriminates`
-passed at 406ms against the 500ms ceiling on green `main` and refused at `cpu_at_least=516ms` on an
-unchanged tree — a required-floor refusal with `claims_failed=0`.*
-
-*This section and §8 are the quantitative form of §6's conclusion. §6 establishes from a local→CI
-join that no fixed above-ceiling identity set exists; these two measure how wide the variance that
-makes membership unstable actually is, from the CI artifact alone.*
-
-**§3's figures index over rows inside one pair of runs, not over runs — and its prose says
-otherwise.** §3 reads "run-to-run variation on the same identity across the sample", but the
-producer behind it, `identity_inflation_permille`, takes a `base` and an `other` and is driven with
-exactly two named runs (`floor_cost_baseline_run`, `floor_cost_contended_run`). Its percentiles are
-therefore computed across ROWS inside one pair, and describe how unevenly one host-pair ratio lands
-over different rows. Two runs are one sample of the between-run quantity and one sample has no
-spread, so the pairwise median is a point estimate wearing a distribution's clothes. The instrument
-was right and the sentence over it was not, which is the failure the "name the producer" rule exists
-to make detectable. If the admitted execution envelope set is wider than the
-pair sampled, it is a **lower bound**, and a budget set from it moves the cliff rather than closing
-it. §3 is not withdrawn — it measures what it measures — but it may not be used as a budget input.
-
-**The producer for this section is `gunbc.floor_cost_distribution` `identity_envelopes` /
-`complete_envelopes` / `work_invariant_envelopes` / `worst_envelope_permille` /
-`run_extreme_census`, driven by `tools.floor_cost_distribution_instrument`
-`floor_cost_envelope_report`.** The sample is twelve green `main` runs of `witnesses.yml` on twelve
-distinct runner registrations across three hosts, named with their runners in
-`floor_cost_envelope_sampled_runs` — the runner is not in the artifact and is acquired from the
-run's `required-witnesses-floor` job. Re-derive rather than trust this page; where the two disagree
-the instrument is right.
-
-`floor_cost_envelope_check` is the exit-code actuator and refuses an incomplete sample by name;
-`floor_cost_envelope_report` returns the lines, and `gunbc run` renders them through its
-entry-point refusal because the host requires a `ProcessExit` from an entry function — the sibling
-report in §1 has the same shape.
-
-One row's envelope is its max over the twelve runs against its min over the same twelve, computed
-only over identities present in every run with a verdict and a baseline at or above 50ms, and
-restricted to rows whose `eval_steps` were identical in all twelve so the remaining movement is
-inflation rather than a tree change.
-
-**Between-run envelope, work-invariant population (n=398 of 400 complete rows, 3,628 identities
-observed across the twelve runs):** median **1.367x**, p90 **1.653x**, p95 **1.819x**, p99
-**2.046x**, worst observed **2.280x** — the instrument's own order statistics, which select an
-observed member and never interpolate. §3's pairwise median of 1.16x understates the median by a
-fifth and the worst case by more than half.
-
-**That step equality is a filter, not a finding, and it must not be read as evidence of
-invariance.** Selecting rows whose counts agree across all twelve runs removes tree movement from
-the sample so the residual is inflation; it says nothing about whether `eval_steps` is invariant in
-general. It is not: the rung-drop row's missing item (b) has since been measured properly on one
-identical tree (gunbc#10228) and **refutes** — `eval_steps` disagreed on 18 of 3,519 joined rows
-against `cpu_ms`'s 1,394. Far more stable, and not invariant.
-
-**No cost trend.** Restricting the population by baseline leaves the envelope essentially flat —
-p50 1.37 / p90 1.65 at ≥50ms, 1.35 / 1.58 at ≥100ms, 1.36 / 1.64 at ≥200ms, 1.47 / 1.51 at ≥300ms
-— which confirms §3's refutation of "expensive rows inflate more" over runs rather than over one
-pair, and is what makes a single global margin defensible.
-
-## 8. §6's "property of the run" conclusion, quantified — and it reaches host grain
-
-§6 concludes from a local→CI join that "which rows cross is a property of the run, not of the rows".
-This section reaches the same conclusion from the other direction — the CI artifact alone, no
-local→CI conversion — and carries it one grain further, to the machine.
-
-A median run factor cannot answer this: it is robust exactly where the envelope is driven. The
-discriminator is `run_extreme_census`, which counts how often each run holds a row's maximum and its
-minimum. Under per-row jitter each of twelve runs is the extreme for about a twelfth of the
-population.
-
-It is not close to that. Over the 398 work-invariant rows, run `33766436293` (**srv4-09**) holds the
-minimum for **367**; run `33775106554` (**srv1-19**) holds the maximum for **160**. At host grain
-srv1 holds the maximum for **279 of 398 rows from 3 of 12 runs**, against 83 for srv3 (5 runs) and 36
-for srv4 (4 runs). The extremes are concentrated on particular machines, so a row near the line is
-adjudicated by which host dequeued the job.
-
-**An earlier reading of this measurement said the opposite and is corrected here rather than
-deleted.** Per-run *median* factors span only 0.878–1.118 and per-host medians are nearly identical
-(srv1 1.069, srv3 0.985, srv4 0.992), which reads as "the host does not matter". It is the wrong
-statistic for the question: a ceiling is crossed by the extreme, not by the median, and the extreme
-census shows the concentration the median averages away.
-
-## 9. What this bounds, and what it does not
-
-**The subject row.** `rust_produced_decl_name_discriminates` measured **313–444ms across the twelve
-runs** (envelope 1.42x, `eval_steps` 169,297 in every one — the work never changed). Its minimum,
-313ms, is above the clean-run budget the measured p90 implies (500 / 1.653 = **302ms**) and well above
-the worst-case budget (500 / 2.280 = **219ms**). The row is inside the variance cliff by measurement,
-not by anecdote, and the 516ms refusal is an ordinary member of this distribution.
-
-**The bound is a floor, not a bound.** Twelve runs on three hosts are a subset of the admitted
-execution envelopes. A wider sample can only find a larger worst case, so 2.280x may only rise and the
-implied budget may only fall.
-
-**Raising the ceiling remains not an option** for the reasons §5 gives. What this measurement
-supplies is a re-derivation the authority already asked for: `docs/design-rung-drops.md`, *Per-claim
-cost qualification is unavailable at the subject grain the gate consumes*, sizes its attention
-constant as the ceiling over the largest inflation floor observed to date and states that the
-constant **must be re-derived the moment a larger floor is measured**. The floor it was sized against
-was 1.777 from a single 501→282 pair. This sample measures **2.280**, so the constant falls from 280ms
-to **219ms**, and the row is updated accordingly. Restricting the derivation to rows at or above
-200ms — where whole-millisecond quantisation cannot dominate — gives 1.874 and a constant of 266ms,
-so the direction of the re-derivation does not depend on the small-baseline tail.
-
-**Which remedy the subject family takes is not decided here, and §6 has already narrowed it.** §6
-refuses both of §5's sanctioned arms for this family on evidence — there is no oversized subject to
-trim, and no lane with its own dated ceiling exists to rehome into — leaving the shared fixed cost as
-the only lever. What this section adds is the size of the gap that lever has to close: at the p90
-envelope the family needs to come down to 302ms on a clean run, and at the worst observed to 219ms.
-The subject's cheapest of twelve observations is 313ms, so the required reduction is real and
-quantified rather than "some".
diff --git a/docs/plans/floor-memory-envelope-2026-09-12.md b/docs/plans/floor-memory-envelope-2026-09-12.md
deleted file mode 100644
index 1226f59b5f6..00000000000
--- a/docs/plans/floor-memory-envelope-2026-09-12.md
+++ /dev/null
@@ -1,310 +0,0 @@
-# The floor cannot account for the phase memory it refuses on
-
-The floor refuses on memory, but its cost receipts publish evaluation time and
-no resident-memory reading for the terminal-ledger phase. The refusing run
-publishes neither cost artifact. **The exact terminal-ledger typecheck peak and
-its run median are UNOBSERVED.** This is an instrumentation gap: the available
-cgroup readings establish throttle contact but cannot account for the phase's
-memory demand. No cap change is justified by this finding.
-
-The strongest available evidence is the natural experiment: the assignment
-reports #11115 refused twice before a genuine floor SUCCESS at 42m23s, while
-#11139 refused three times and never reached a verdict. The inspected jobs below
-independently confirm a same-merge-subject refusal/success pair for #11115 and all
-three refusals for #11139. The workload is marginal, not universally unable to
-complete. These selected outcomes are not an estimate of the fleet's pass rate.
-
-This is a stopped-line measurement report under DESIGN §§2, 4d and 5, not a repair
-or a claim that the requested phase measurement has been completed. No refusal,
-merge-admission wiring, OOM classification, or runner allocation changes here.
-
-## Throttled slot envelopes: producer and subject
-
-The observations below come from `floor_cgroup_envelope` in
-`src/v1/stage0/src/cli_run/required_floor_runner.rs`: its `[floor-cgroup]` rows
-read `memory.high`, `memory.max`, `memory.current`, `memory.peak`, and event
-counters from the named cgroup and its ancestors. Only the **runner service's**
-rows enter this table, never the aggregate parent slice's peaks.
-
-| PR / attempt within run | CI job (raw log producer) | runner | largest printed service `memory.peak`, bytes | terminal result / refusal site |
-| --- | --- | --- | ---: | --- |
-| #11115 / 1 | [103493724795](https://github.com/gunb-ai/gunbc/actions/runs/34670663495/job/103493724795) | srv3-16 | 16106778624 | refused / `extdeps.git.object_store` |
-| #11115 / 2 | [103498744149](https://github.com/gunb-ai/gunbc/actions/runs/34670663495/job/103498744149) | srv1-13 | 16114794496 | success |
-| #11139 / 1 | [103491056928](https://github.com/gunb-ai/gunbc/actions/runs/34670582182/job/103491056928) | srv4-19 | 16106856448 | refused / `v2.workflow.floor2_prepared_subject` |
-| #11139 / 2 | [103496272864](https://github.com/gunb-ai/gunbc/actions/runs/34670582182/job/103496272864) | srv4-21 | 16106946560 | refused / `v2.workflow.floor2_prepared_subject` |
-| #11139 / 3 | [103505983106](https://github.com/gunb-ai/gunbc/actions/runs/34670582182/job/103505983106) | srv4-10 | 16107003904 | refused / `std.primitives` |
-
-All five read `memory.high=16106127360` (15 GiB) and
-`memory.max=17179869184` (16 GiB). Their service-local high events grow;
-the printed service OOM and OOM-kill counters remain zero. The refusal is
-`MemoryStallRefusedPageThrash`, not evidence of an OOM kill.
-
-The checked subjects are the merge commits, verified from each job's checkout:
-
-- #11115: `fb82d4c10374e61a135f4038ef4f7b414bbcaa7d`, head
-  `53fc8e668b7812bd5f64f3d86feab18c6bb8b52b`.
-- #11139: `45a4956c998e9b4ce11ca0c41e9dbb9907fdfbca`, head
-  `c54441d2a45d0e67c2162be5f01f7c45d276bde0`.
-- Both merge subjects use base `6cdebf53c4b1648e282de2f5ed1896b434b15b34`.
-
-This is a five-job convenience sample, not a census of every attempt mentioned in
-the assignment. In particular the selected #11115 run contains one refusal and
-one success; this report does not claim to have found its other reported refusal.
-
-The median of the five **largest printed service high-water readings** is
-16106946560 bytes, or 15.000763 GiB: 0.78125 MiB **above** `memory.high`.
-The range is 15.000607–15.008072 GiB. These are observations of a reclaim-throttled
-slot, not a distribution of uncensored working-set demand. `memory.high` is a
-throttle and can be crossed. Calling this median “the typecheck fits within
-0.8 MiB” would invert the evidence.
-
-There is no reset at the terminal-ledger boundary, no terminal-boundary cgroup
-read in these logs, and no process RSS peak specific to this phase. The last
-printed peak can even include work after ledger publication. Therefore neither
-subtracting the threshold from this peak nor subtracting two cumulative peaks
-answers the requested phase-memory question. Even the successful job is not an
-uncensored measurement of demand on an unconstrained host.
-
-## What the cost receipts can and cannot decide
-
-For successful run `34670663495`, downloaded artifacts:
-
-- `required-floor-claim-cost` (artifact `10292490653`):
-  `required_floor_claim_cost.tsv`, summary `executed=3771`, columns for identity,
-  outcome, observed/censored wall and CPU time, eval steps, and safety limits.
-- `required-floor-cross-claim-demand` (artifact `10292285976`):
-  `required_floor_cross_claim_demand.tsv`, summary `claims_absorbed=3771`,
-  `claim_cpu_observed_total_ms=42837`, `claim_cpu_censored_rows_excluded=0`.
-  Its header explicitly says `cost_columns=inclusive_of_callees_do_not_sum`.
-
-Neither schema has an RSS column, and neither file contains
-`terminal_ledger` or `floor2_prepared_subject`. They observe claim evaluation,
-not the later ledger resolve. The artifact list for refusing run `34670582182`
-contains measurement and outcome receipts but neither of these cost artifacts.
-An absent artifact is unavailable evidence, not zero cost. No cost-partition
-instrument was run; no `OverAttributed` result is asserted here.
-
-The passing job does carry a phase-local **time** producer:
-`publish_terminal_ledger` in `cli_run/terminal_ledger_publish.rs` prints
-`phase=terminal-ledger-publish state=completed resolve_ms=31100 total_ms=32485
-rows=3771` at `2026-09-12T05:07:51.2992978Z`.
-That measures one resolve, not 3,771 repeated resolves.
-
-## Why it costs what it costs: established facts and remaining discriminator
-
-`build_ledger_wire_ctx` uses `process_shared_index(source_roots)` and
-`resolve_entry_with_index_for_discovery_corpus` for the exact entry
-`src/v2/workflow/floor_terminal_ledger_wire.dag`. `run_required_floor` invokes
-publication once after its claim fold. Its prepared graph is still live;
-`prepared.subject_digest` also has later consumers. The shared parse/typecheck
-index survives. This is **a fresh context beside retained floor state**, not a
-fresh empty process. The source explicitly chose rebuilding over retaining an
-additional context across the fold; whether that tradeoff still saves memory
-needs measurement, not reliance on that comment.
-
-The named module is where the governor detects the stall. The four refusals
-name three different modules, including `std.primitives`; this rules out treating
-`floor2_prepared_subject` as a demonstrated unique allocation culprit. It does
-not rule out a costly common dependency or retained state elsewhere.
-
-The specific recurrence repaired by [#10992](https://github.com/gunb-ai/gunbc/pull/10992)
-and [#11032](https://github.com/gunb-ai/gunbc/pull/11032) was fixture preparation
-re-derived across isolated claim frames. That evidence does not transfer to this
-once-per-publication resolve. Re-typechecking an already prepared fact is a
-separate possible recurrence; the index's cache hits, misses and retained graph
-ownership must distinguish it from new work. No allocation profile here proves
-either “quadratic cost shape” or “genuinely irreducible large closure.”
-
-There is an existing, more specific cost-shape lead:
-`gunbc.recurring_failure_mode.entry_scoped_typecheck_rss_tracks_the_name_census`.
-It records sleek-swift-789's 2026-09-11 arm64 `gunbc compile --entry
-src/v2/workflow/floor2_prepared_subject.dag --target dag` observation: 16 resolved
-sources, 5385 census-indexed modules, peak 9964140 KiB from `/proc/<pid>/status`
-`VmHWM`, and exit 0. **That is prior evidence from its named producer, not a new
-measurement of this entry or an amd64 requirement.** The row does not pin an exact
-source SHA for its binary; this report does not promote its provenance. Its
-isolated peak cannot be added to an independently observed floor RSS: shared
-pages, caches and lifetimes overlap.
-
-Current source confirms `tree_bare_census_for_root` builds the whole-root compile
-closure's symbol census and caches it per root in `MultiEntryIndex`. The existing
-`GUNBC_EDGE_INDEX_CENSUS_TRACE=1` miss trace identifies both root and index. Joining
-those identities across preparation and ledger resolve is a concrete discriminator
-for repeated census construction. The old isolated observation and current source
-make this a stronger lead than assuming the small named module is intrinsically
-large, but do not establish the allocation owner in these five runs.
-
-The entry is **already scoped**. The wire imports identity, disposition and safety
-vocabulary; `v2.workflow.required_floor` also imports roster/policy modules.
-Narrowing further means separating those concepts at their existing authority
-boundaries, not adding an `--entry` flag that is already present or omitting
-required witnesses. A smaller import closure may still pay the whole-root census;
-source size or an import grep is not a measured byte saving.
-
-## Ranked repair experiments and costs
-
-These are ranked by boundedness and expected diagnostic value. Savings are
-unmeasured unless explicitly labeled otherwise; implementation costs are estimates.
-
-| Rank | Candidate | Required discriminating observation | Cost / risk |
-| --- | --- | --- | --- |
-| 1 | Remove unnecessary co-residence at the terminal boundary | Read current RSS, cgroup charge and live graph/cache ownership immediately before resolve; compare the same subject after releasing only objects with no remaining consumers | Small ownership audit; potentially substantial memory benefit, presently unquantified. Do not clear reusable caches indiscriminately or retain another whole context across the fold. |
-| 2 | Investigate the existing whole-root name-census cost-shape lead | Join census misses by root and index; attribute allocations and retained maps across preparation and this resolve | Small diagnostic exercise first; a compiler repair could be medium-to-large. Prior scoped evidence identifies a lead, not a measured saving on this floor. The earlier per-claim fixes are not its evidence. |
-| 3 | Narrow the wire's dependency closure through existing concept boundaries | Exact compiler-produced closure census plus matched before/after phase peak and identical rendered ledger/refusals; establish that census cost also falls or is already shared | Small-to-medium model move with import consumers to update. Could reduce the measured 31.1s resolve and its memory increment; neither saving is established. |
-| 4 | Size/place the runner for measured co-resident demand | Completed amd64 phase peaks and cgroup anonymous/file/kernel charge under an externally enforced, characterized envelope, including repeat variance | Operational allocation and reduced fleet concurrency; no supported GiB request yet. Legitimate if demand remains after ranks 1–3 are ruled out, not a cap-only green. |
-| 5 | Split execution at the terminal boundary | Show that serial release plus a separately executed ledger producer preserves subject binding, all terminal identities and all refusal arms | Largest complexity: process/artifact boundary, startup and parse costs, ownership and failure propagation. Premature without proving retained co-residence is unavoidable. |
-
-**Plain answer on sizing:** the current slot demonstrably reclaims at 15 GiB on
-both heads. We cannot yet say how large a box this phase requires. There is no
-evidence here for declaring 16, 18 or 20 GiB sufficient.
-
-## Did #11078 measurably increase cost?
-
-**No consistent wall-time increase is visible in this small before/after sample;
-the census's isolated CPU and typecheck increment remain unobserved.** This is
-not a finding that its incremental cost is zero.
-
-[#11078](https://github.com/gunb-ai/gunbc/pull/11078) merged at
-`2026-09-12T03:15:29Z` as `f4b63e3b80ba142d8650e2d2d033881e7ba04a9e`.
-It expanded the per-claim-scope ambiguity report from counts to named rows.
-That report and `tree_bare_census_for_root` are different producers; sharing the
-word “census” does not make the older RSS attribution apply to this change.
-
-Two nearby completed main runs before the merge and two after it give:
-
-| Main run / floor job | source SHA prefix | relation to #11078 | completed fold wall, ms | completed ledger resolve wall, ms | observed claim CPU total, ms |
-| --- | --- | --- | ---: | ---: | ---: |
-| [34665537725 / 103478308337](https://github.com/gunb-ai/gunbc/actions/runs/34665537725/job/103478308337) | `b2bda4edda7d` | before | 526589 | 44878 | 44027 |
-| [34668064603 / 103484007739](https://github.com/gunb-ai/gunbc/actions/runs/34668064603/job/103484007739) | `c25ab6d87477` | before | 524850 | 34747 | 46789 |
-| [34669916077 / 103489226361](https://github.com/gunb-ai/gunbc/actions/runs/34669916077/job/103489226361) | `6cdebf53c4b1` | after | 558781 | unobserved: refused | unobserved: no summary |
-| [34672874238 / 103499666826](https://github.com/gunb-ai/gunbc/actions/runs/34672874238/job/103499666826) | `88c67ace130ef` | after | 487936 | 40831 | 42202 |
-
-Membership is verified with `git merge-base --is-ancestor` against #11078's
-merge commit, not inferred from job completion time. The before runs also lack
-the added `names_distinct` field; the after runs print it. Cancelled runs are
-excluded and this convenience sample is not a population trend estimate.
-
-Producers: `run_required_floor` prints the completed
-`floor: evaluating N / N (Xms)` fold span; `publish_terminal_ledger` prints
-`resolve_ms`; the `[cross-claim-demand] claims_absorbed=...` summary prints
-`claim_cpu_observed_total_ms`. The CPU totals cover 3754, 3781 and 3760 completed
-claims respectively, with zero censored claim rows in those three summaries.
-They are marginal claim-evaluation CPU, **not whole-floor CPU or census CPU**;
-they cannot measure the cost of scope construction or reporting outside the
-claim window. Nor is ledger `resolve_ms` a pure typecheck timer.
-
-The completed post-merge ledger resolve, 40.831s, lies inside the pre-merge
-34.747–44.878s range. Post-merge fold times straddle the pre-merge range; the
-completed post-merge claim CPU total is lower. Hosts and source populations
-differ, and one post-merge ledger resolve is censored. These observations do not
-identify a regression caused by #11078, nor rule out a smaller increment hidden
-by those differences. Its specific cost needs a producer-local bracket;
-whole-run wall/CPU cannot supply that attribution. No retained-state experiment
-or new heavy run was added for this comparison.
-
-## Next-rung capability and reproduction
-
-**Next-rung trigger:** the floor's own receipts publish per-phase resident-memory
-readings on refusing runs as well as successful ones, sufficient to compare the
-terminal-ledger typecheck phase's peak with the admitted budget. The readings must
-carry subject identity, phase boundaries, resource/budget scope and unavailable
-or censored standing. A named file or access grant alone does not discharge this
-capability. The existing failure-mode row
-`gunbc.recurring_failure_mode.instrument_blind_spot_anti_correlated_with_severity`
-carries this specimen; it does not assert that the memory behavior is repaired.
-
-Fetch each of the five jobs once, preserving its id in the filename:
-
-```sh
-gh api repos/gunb-ai/gunbc/actions/jobs/103498744149/logs --allow-escape-sequences > 103498744149.log
-gh run download 34670663495 -n required-floor-claim-cost -D cost
-gh run download 34670663495 -n required-floor-cross-claim-demand -D demand
-```
-
-For each job log, select `[floor-cgroup]` lines whose `level` ends in the runner
-`.service`, take the maximum printed `peak`, then the median across the five job
-values. Convert bytes to GiB by division by `2**30`; convert the difference from
-`high` to MiB by division by `2**20`. Preserve the measurement grain stated above.
-Read the actual refusal lines, not the echoed shell grep that classifies them.
-
-A new measurement must retain the real floor's baseline, bracket **typecheck**
-within this entry resolve (not all preparation), record current and peak process
-RSS separately from cgroup charge, retain missing/censored distinctions, and
-name exact source and binary identities. An isolated entry run is a useful
-closure-increment control, but cannot replace the in-floor observation. Repeat
-the same subject to report a phase-peak median; a refused attempt cannot supply
-its unobserved completing demand. Keep the existing MemoryStall refusal active.
-
-Two execution routes were checked in this session and could not provide that
-measurement:
-
-- [BuildBuddy envelope probe](https://app.buildbuddy.io/invocation/b6c1a5db-8f85-4197-a915-cea73a5745ee) reached amd64, but `/proc/self/cgroup` read `0::/` and both
-  `/sys/fs/cgroup/memory.high` and `memory.max` were absent. The command stopped
-  before building or running the workload. A separate
-  [invalid-Cargo-flag control](https://app.buildbuddy.io/invocation/e56f48bc-d69a-4d8c-a6fc-d02fcf2c079d)
-  reached remote Cargo and failed as expected; remote transport itself
-  was working. No budget was invented to pass admission.
-- The parent's bounded local alternative was
-  `systemd-run --user --scope -p MemoryHigh=15G -p MemoryMax=16G ...`.
-  This container has no `systemd-run`, its cgroup directory is not writable, and
-  it has no built local interpreter. Its visible 31 GiB container limit is not
-  permission to consume the shared host slice. No local heavy run was started.
-
-An arm64 scoped control, if subsequently enabled, establishes a cost-shape lead;
-it does not establish an amd64 cap. The exact runner phase peak and median remain
-the outstanding measurement, explicitly reported to `bright-eagle-728`.
-
----
-
-## Outstanding state of the sizing response, 2026-09-14
-
-This report concluded that no cap change was justified *by its own findings*. The
-sizing change was authorised separately and is carried on `session/slot-sizing-26-25`
-(PR #11204). It is **not converged**, and this section records what remains so the
-state is readable without reconstructing it from the branch.
-
-**Live fleet, unchanged.** srv1 carries `MemoryHigh=16106127360` over 21 units. No
-host effect has been performed by this work: no cap write, no slot retirement, no
-canary. Every claim below is about source and CI, never about a host.
-
-**What the branch establishes in source.** The slot ceiling moves to 26 GiB
-`MemoryMax` / 25 GiB `MemoryHigh`; `cores_per_slot` rises 6 → 10, so CPU binds every
-host at 12 and the fleet commits 36 rather than 68. A raise is gated behind a
-retirement transaction: the required-retiree set is derived from a declared prior
-width (`gunbc.runner_width_transition`) and reads no observation, so it cannot shrink
-when a unit stops being listed; operator interruption authority is checked as
-*coverage over* that obligation and never contributes members to it; `mask --now` is
-rendered into the hashed fleet artifact and executed only by fleet apply; and
-completion comes from an independent readback of `UnitFileState`, `ActiveState` and
-the real cgroup. Retirement disposition participates in the plan/apply fingerprint,
-so a plan built while a unit read complete refuses if apply reobserves it populated.
-
-**srv2 is refused, not narrowed.** Its width resolves to a typed refusal and no
-`RunnerHostDeploy` is constructed for it at all; slot planning, cap construction and
-the cap writer all consume that same admission, and its generated sudoers projection
-renders teardown and host-wide grants only — no slot-install, no activation, nothing
-that could widen a host nobody can size.
-
-**What is NOT established, and is the work remaining.**
-
-1. **No wet proof.** Nothing has executed `mask --now` on a host. Every retirement
-   result is hermetic. The srv4 canary — interrupt → observed retirement → guarded
-   raise → effective-limit readback → no-change second pass — is the first real
-   proof and has not been run or authorised.
-2. **No terminal green.** The last exact-head required run was red. Two failures are
-   measured as inherited rather than assumed, each reproduced at the committed head
-   with the branch's later changes stashed:
-   `witness_fabric_cell_absent_address_plans_add_and_never_change` and
-   `srv4_sccache_prereq_pins_version_and_digest`.
-3. **One acceptance condition is specific and unmet.**
-   `test.claim.runner_slot_provision.no_deploy_row_out_commits_the_memory_budget`
-   must appear in the terminal disposition as `planned` (or
-   `planned_as_changed_witness`) **and** `passed`. At `890c264be36` it was
-   `declined_outside_required_gate` — its whole module carried no admitted
-   prefix — so the aggregate `planned=3938 executed=3938` was true and said nothing
-   about it. The prefix is now enrolled; the run proving it selected has not happened.
-
-**The instrumentation gap this report opened is still open.** Nothing here measures
-the terminal-ledger phase peak. The sizing change was justified by the floor's
-*uncensored demand* reading, not by the phase measurement this document says is
-missing, and raising the ceiling does not close that gap.
diff --git a/docs/plans/floor-shared-fill-ledger.md b/docs/plans/floor-shared-fill-ledger.md
deleted file mode 100644
index 952bd2e7a66..00000000000
--- a/docs/plans/floor-shared-fill-ledger.md
+++ /dev/null
@@ -1,226 +0,0 @@
-# The floor's shared-fill ledger — measuring what a slow witness actually costs
-
-gunbc#8455 established that the floor's per-row wall time is not always the row's cost and named
-the repair it did not perform: *attribute shared cost to the entry rather than its first row*.
-This is that repair, plus the defect's mechanism root-caused to source.
-
-## The mechanism, named
-
-The floor builds a **fresh evaluation frame per claim**, so the sharing #8455 measured is not an
-eval memo (a per-claim memo cannot survive between claims) but a population of
-**process-global corpus-scan caches in the seed**, each filled at most once per process and read
-free thereafter:
-
-| cache | what the fill is |
-|---|---|
-| `reference_edges` | one O(corpus) tokenize+parse pass over the whole pool |
-| `module_graph_facts` | the live module graph over the pool roots |
-| `module_path_index` | module → path over the source roots |
-| `inert_carrier_data`, `complexity_linearity_audit`, `complexity_linearity_wildcard`, `fallback_arm_census`, `non_fold_residue`, `doc_graph_report`, `test_migration_behavior_discovery`, `test_migration_debt` | whole-corpus census reports |
-
-The #8455 specimen resolves exactly onto the first row. `g2_data_reference_under_selection`
-calls `specimen_projection` → `v2.lens.live_read_classification`
-`live_read_selection_manifest_live` → `dependency_resolution_facts_live`, whose seed realization
-`cli_run.rs` `reference_resolution_facts` performs that whole-pool parse behind
-`REFERENCE_EDGE_CACHE`. The first claim pays the pass (12197ms); the second reads the map
-(31ms). Same call, 393x, 35ms apart.
-
-## Why the existing number cannot answer the paring question
-
-Nothing is computed twice — the caches are correct and the sharing is the saving. What is wrong
-is the **attribution**, and it matters because the ceiling refuses per row:
-
-- A refusal names the **first toucher**, whose own cost may be milliseconds.
-- **Splitting** such a row moves the charge to whichever fragment runs first
-  (`gunbc.witness_row_cost` `witness_decomposition_does_not_reduce_entry_cost_note`, observed
-  rather than predicted).
-- **Removing** such a row does not remove its cost either: the next claim to touch the fill pays
-  the same seconds, so a quarantine decided on the per-row number can trade a named refusal for
-  an unnamed one in a module that was fast before.
-
-## What the ledger records, and the quantity it yields
-
-`cli_run/shared_fill.rs` records, per fill: the cache, the key it is declared on, what the fill
-cost, which claim paid it, and every later claim and module that read it. `[floor-shared-fill]`
-lines are emitted once at the end of the fold. The disposition on each line is derived by
-`gunbc.witness_row_cost` `shared_fill_disposition` from the payer and the consumer breadth —
-three states because three remedies:
-
-- `outside-fold` — preparation's cost. No witness can be pared to recover it.
-- `exclusive` — one module consumed it. It is removable with that module.
-- `shared` — more than one module consumed it. It survives any single removal.
-
-From that, joined against the `[floor-witness-slow]` rows the floor already prints:
-
-```
-what removing module M saves  =  M's rows' wall time
-                              -  fills M paid that are `shared`
-                              (+ nothing for `outside-fold` fills at all)
-```
-
-## What this is not
-
-It refuses nothing, skips nothing, changes no verdict, makes no witness faster, and takes no
-position on which rows to pare; it prints a table (DESIGN §5's sanctioned stopped-line audit — it
-reports, it does not green) measuring the quantity that decision needs and nobody currently has.
-
-`unattributed_hits` on the total line is the honest bound: reads served by a fill this ledger did
-not observe. Nonzero means the shared figure is a **lower** bound on the sharing.
-
-## Two bounds on reading the output
-
-**Run-to-run variance is real and is not this ledger's subject.** `where_refinement_cast_literal_oci_other_digest_algorithm_accepts` measured 1505ms, 1274ms and 1364ms — the first two on *byte-identical* input (a rerun of one frozen merge ref) — an ~18% spread straddling a 1500ms ceiling (sharp-raven-273, 2026-08-18, runs 32155779798 / 32153078487). For a row within ~20% of its ceiling, which side it lands on is partly a fact about the runner; a smaller fill difference is not readable from one run.
-
-**A right-censored row cannot be decomposed.** Exclusive-vs-shared subtracts from a *completion*
-cost, so a row whose figure is its interrupt point has nothing to decompose. On main run
-32177951514, 84 of the 97 budget-refused rows sit pinned at 1552–1560ms and must be excluded from
-any ranking; the deadline is cooperative (polled every 4096 evals), so the other 13 ran past it
-with real overshoots — up to `grounding_lens_whole_tree` at 21868ms. The `[floor-witness-slow]`
-channel is the better census (720 rows, all with measured elapsed), on the same condition: its
-~85 rows in the pinned band are censored, the rest are measurement.
-
-**The signature to look for, and the one that refutes the model.** A shared fill looks like *one
-large row and cheap siblings* — the g2 pair's 12197ms then 31ms. Several siblings at roughly the
-*same* cost is the opposite evidence: nothing was amortized, each pays its own way. The eight
-`effect_reach_test` rows clustered at 1788–2134ms are therefore a prior *against* shared fill in
-that module, and the ledger says so directly rather than by inference.
-
-## Receipt — run 32192150969, 9425 claims, one fold
-
-19 fills. The red is main's inherited (`failed=0 stale_quarantine=5 budget_refused=102`), not
-this diff's; the ledger reported from a complete fold.
-
-**Read `fill_ms` as SELF time.** The first receipt exposed an instrument defect, fixed in the same
-PR: these caches compose, so an outer fill's wall contains its inner fills'. A 17890ms
-`module_graph_facts` fill contained a 12054ms `module_path_index` fill and a 5141ms
-`reference_edges` fill — ~695ms of its own. The first receipt's `TOTAL fill_ms=302362` was an
-inclusive over-count; the corrected self-time total is **~180s**. The per-fill
-payer/consumer/disposition columns were never affected.
-
-### The finding: one row's entire cost is a fill 29 other modules read
-
-```
-cache=module_path_index  key=dag+src/v2   fill_ms=51508
-  paid_by  test.claim.dissolution_census_witness_test.unbound_dissolution_empty_literal_refuses
-  read by  139 claims across 29 modules            disposition=shared
-```
-
-That payer is one of the five rows in the corpus with an *exact* cost: **51620ms**, of which the
-fill is 51508ms. So **99.8% of that witness's measured cost is a computation 29 other modules
-consume**, and it is the run's only `shared` fill. Removing the witness recovers ~112ms and hands
-51.5s to whichever of the 29 runs first — the paring question answered at identity grain, on the
-row where it matters most.
-
-### And the opposite finding, which matters just as much
-
-The 86741ms row — `extdeps_scope_placement_gate_loudness_witness`
-`red_seed_runner_failure_detail_projects_located_receipt`, the most expensive exact row in the
-corpus — paid a 29017ms `module_graph_facts` fill and a 24965ms `reference_edges` fill, **both
-`exclusive`**: no other module reads either. Its cost is its own and it is a real paring target.
-Two rows adjacent on a slow list, opposite answers; per-row wall time cannot distinguish them.
-
-### Preparation's share, which no paring can recover
-
-Three fills totalling ~108s inclusive are `outside-fold` — a 55392ms `module_graph_facts`, a
-35060ms `module_path_index`, a 17646ms `reference_edges`, all paid before any claim ran. That
-cost is preparation's; quarantining every witness on the floor would not move it.
-
-### Second receipt — run 32196069889, 9001 claims, 8 fills: the relocation, at identity grain
-
-The first receipt reported consumer *counts*; this one names them, and caught the same fill
-changing hands.
-
-```
-run 32192150969   cache=module_path_index key=<root>/dag + <root>/src/v2   fill_ms=51508
-                  paid_by  dissolution_census_witness_test.unbound_dissolution_empty_literal_refuses
-                  read by  139 claims across 29 modules      disposition=shared
-
-run 32196069889   cache=module_path_index key=<root>/dag + <root>/src/v2   fill_ms=45075
-                  paid_by  emitter_nested_refinement_cast_witness_test
-                             .single_refinement_carrier_emits_no_unsupported_cast
-                  read by  94 claims across 20 modules       disposition=shared
-```
-
-Same cache, same key, `paid_by` changing hands after #8457 quarantined the first payer. The second
-payer is **main's only failing witness**: 45784ms on this run, of which 45075ms is this fill —
-~98.5%. **Pin that share to the run**: the same row measured 45784, 45941, 46714, 50532 and 52982
-across five runs the same day, so the fill *fraction* is robust and the denominator is not. Under
-every reading, nearly all of the remaining red is one build that 20 other modules read for free.
-
-### The consumer set shrank, which prices the quarantine itself
-
-The two receipts also price what #8457's quarantine bought on this axis — close to nothing for
-part of the population:
-
-```
-pre-quarantine    read by 139 claims across 29 modules
-post-quarantine   read by  94 claims across 20 modules
-```
-
-Nine modules and 45 claims left the consumer set. A consumer is a **free rider** — it reads a fill
-someone else built, so its marginal cost for that fill is ~zero. Quarantining a rider removes
-coverage and recovers nothing here; quarantining the *payer* handed the bill to the next module and
-produced main's sole red.
-
-**The honest limit:** the first receipt reported consumer *counts* only, so those nine modules
-cannot be named retroactively — the delta is consistent with riders having been quarantined, not
-proof of which. That is why the line now names consumers; from here the question is a set
-difference, not an inference.
-
-The 20-module list is two lists at once: who inherits the bill if the current payer is quarantined,
-and who is first to come **back** once the fill belongs to preparation.
-
-Evaluation order is alphabetical and the riders are named, so the prediction is checkable:
-quarantining this payer hands ~45s to `emitter_optional_payload_cast_witness_test` next — the
-fourth hop of a chain that has already run three times (`dissolution_census` → `emitted_lib_rs` →
-this row).
-
-It remains the **only** `shared` fill — 8 fills this run, one with more than one consuming module.
-The fix is `gunbc#8470`, which pays this index during preparation; the self-verifying
-post-condition is that this row reappears as `paid_by=<outside-fold> disposition=outside-fold`.
-
-The nesting correction shows here too: `module_graph_facts key=dag` reports
-`fill_ms=2990 inclusive_ms=55048` — 52s of it was the path-index and reference-edge scans it
-triggered, which the first receipt's total counted twice.
-
-### The prediction, confirmed on an experiment nobody had to build
-
-When #8457 quarantined 102 over-budget witnesses, this model predicted the cost would not leave
-with them — the next module to touch the fill would pay it. Main before (run 32177951514) against
-main after (run 32193032348), **one module, one run, one tree**:
-
-```
-single_refinement_carrier_emits_no_unsupported_cast    746ms -> 45941ms   61.6x
-nested_refinement_carrier_deficit_remains_observable   728ms ->   763ms   flat
-```
-
-Neither row changed; 38 modules were removed from the fold ahead of them. Were the 45.9s the row's
-own work it would have been 45.9s before; were it a general slowdown the sibling would have moved
-too. It is the first-touch signature exactly: the fill that row now pays was previously paid by
-one of the quarantined 102, and the sibling rides it free in both eras. **Quarantining a first
-toucher relocates the bill; it does not retire it.** (Measured by tidy-lark-471. It landed in the
-failures channel rather than the refused one, which is why a scan for new refusals read the run as
-refuting the prediction.)
-
-### What `exclusive` does and does not establish
-
-`exclusive` means **no other module in the executed population read this fill on this run** —
-not that none ever would. Remove the payer and a would-be consumer could pay the same fill next
-run: the first-toucher trap one level up, invisible from inside one run.
-
-Two things bound that doubt. The `key` is the fill's *declared inputs*, so an exclusive fill on a
-key no other consumer requests is exclusive by construction, not luck — the 29017ms
-`module_graph_facts` above is keyed on `dag+src/v2` roots that the shared 51508ms
-`module_path_index` fill also serves, while the 17890ms one is keyed on a four-root pool only its
-own module asks for. And the answer is decidable by execution: run the fold with the payer absent
-and read the ledger again. Until then an `exclusive` row is one run's observation, and a recovery
-estimated from it is an upper bound.
-
-A second edge corrects a reading of the same rows from isolation. A witness whose SUBJECT is the
-corpus is not made cheap by shrinking the corpus: the 71s row measures 70–85ms in a 67-module
-closure and 71060ms against the floor's 2376-module subject, with the witness unchanged.
-Isolation structurally cannot price that class, which is why the ledger measures on the floor
-path (quiet-ibex-39, 2026-08-18).
-
-`unattributed_hits=1`: one read was served by a fill this ledger did not observe, so the shared
-figure is a lower bound. Small, but reported rather than rounded away.
diff --git a/docs/plans/floor-time-attribution-2026-10-02.md b/docs/plans/floor-time-attribution-2026-10-02.md
deleted file mode 100644
index 6cb311473d2..00000000000
--- a/docs/plans/floor-time-attribution-2026-10-02.md
+++ /dev/null
@@ -1,156 +0,0 @@
-# Where the required floor's time goes (2026-10-02)
-
-Status: investigation and plan. No code lands from this note; the repairs are dispatched separately.
-
-Trigger: #12506 (N7-2) was refused by `v2.workflow.floor_enrolment_margin` (55 of 96 newly enrolled
-identities over margin). The question asked was where the floor's time goes, and whether that
-overage is one case of a general cause. Raising the budget is not on the table.
-
-## Instrument and subject
-
-The subject is main at `d8eebaea3f`, merge_group run 37070592712, `floor` job 111048851355. The
-#12506 reading is run 37071586760, job 111052035724.
-
-**No new instrument was minted.** The floor already prints every carrier this needs. They appear
-in the job log:
-
-| carrier | grain | producer |
-| --- | --- | --- |
-| `[floor-seam-cpu] seam=<s> thread_cpu_ms=` | cumulative thread CPU at each seam boundary | `claim_executor --required-ci` |
-| `[floor-shared-fill] claim=<id> marginal_cpu_ms= fill_cpu_ms=` | per claim, split into its own work and the shared fill it paid for | `cli_run::shared_fill` |
-| `[floor-shared-fill] cache=<c> key=<k> fill_ms= consumer_claims=` | per shared computation, with the count of claims that read it | `cli_run::shared_fill` |
-| `[cross-claim-demand] producer=<p> claims= evals=` | per producer, recomputation across claims | `claim_executor` |
-| `compile.<stage> done in` | each host compile stage | seed compile pipeline |
-
-To re-derive, fetch the log with
-`gh api --allow-escape-sequences repos/gunb-ai/gunbc/actions/jobs/<job>/logs`. Then difference
-consecutive `floor-seam-cpu` values, and sum `fill_cpu_ms` and `marginal_cpu_ms` per claim and per
-module.
-
-**Instrument defect found along the way.** The two durable carriers are no longer uploaded:
-`required-floor-claim-cost` and "the cross-claim demand TSV this run uploads" (that phrase is the
-log's own). On both runs above, the only artifact is `required-ci-measurement-receipt`.
-`tools.floor_cost_distribution_instrument` therefore has no input, and the log's sentence about the
-upload is false. Restoring the upload is PR 3 below. Until then the attribution can only be read
-from the log, which is a scrape.
-
-## Structural predictions, stated before the confirming read
-
-I wrote these down from DESIGN §2, §3 and §6b before differencing the seams:
-
-- P1. Very little floor time is claim marginal work. Most of it is computation shared by many
-  claims, paid either in preparation or by whoever touches it first.
-- P2. The witness families that compile fixtures pay a compile of the fixture's whole live import
-  closure once per distinct fixture, even though preparation has already compiled that closure.
-- P3. The N7 overage is the same shape one layer up: a pure function of module-constant text,
-  evaluated once per claim, with no provider joining the claims.
-- P4. Some preparation work is demanded by the gate closure and read by no claim the run plans.
-
-## Attribution (one reading; the carriers above are the authority)
-
-Floor job wall time was about 47.5 minutes. Thread CPU, differenced by seam:
-
-| slice | CPU | what it is |
-| --- | --- | --- |
-| build + parse + declarations | ~4m wall + ~61s | `cargo build`, parse of 7347 files |
-| diff planning (base decl census, edits, nominal seeds) | ~100s | |
-| **prepare-closure-resolve** | **~646s** | seed compile of the 2585-module gate closure; `compile.reconcile` alone took 8 minutes wall |
-| **prepared-subject-warm** | **~377s** | 343 `cross_claim_pure_share` fills ≈ 316s, plus effect inputs |
-| bare-reference edge index + discovery + site projection | ~120s | includes a second full parse of 7286 files (`reference-reading-parses full_parses=7286`) |
-| **claim-evaluation-fold** | **~715s** (732s wall) | 673 claims |
-| publication (wet witnesses) | ~6.5m wall, ≈0 thread CPU | `[local-repo-wet]` rows |
-
-Inside the fold, the 197 claims with fill lines account for about 667s. Of that, about 666s is
-`fill_cpu_ms` and about 1s is marginal. The fill is host compiles: 90 `compile.emit` runs (~539s)
-plus the frontend and reconcile runs of 244 fixture compiles. Fourteen v1-checker witness modules
-pay all of it, led by `test.claim.declared_type_inhabitance_direct_call_witness` (~210s),
-`infer_function_value_argument_arrow_witness_test` (~103s) and
-`declared_type_expected_type_path_witness` (~84s). Summed across all claims, the run's own
-`claim_cpu_observed_total_ms` is about 10s.
-
-Of the 343 pure-share fills paid in preparation, **298, totalling about 277s, report
-`consumer_claims=0`**: no claim this run planned read them. The 45 that some claim did read total
-about 39s.
-
-P1, P2 and P4 hold on this reading. P3 holds on #12506's `[cross-claim-demand]` rows:
-`cref_assemble claims=6 evals=6`, `fps_assemble claims=5 evals=5`, `mbp_assemble claims=2 evals=4`.
-Each claim re-runs `assemble_program_from_ingest` on the same module-constant fixture, at roughly
-0.6–0.8s per evaluation and about 250k–325k eval steps per claim. The new-witness budget is 72,300
-steps.
-
-## Causes, ranked by floor time removed
-
-**C1. A fixture compile re-compiles the live closure the floor has already prepared (~10 min).**
-The earliest unjustified boundary is `cli_run::emit_host` `compile_dag_diagnostic_census_uncached`
-and its sibling `compile_dag_rust_emit_check`. For each distinct fixture they rebuild
-`build_module_path_index_from_witness_roots`, resolve the fixture's imports from disk, and run
-`compile_sources` over the whole closure. The contract only requires the fixture module to be new;
-the closure is the prepared subject, which is already compiled under the same inventory digest
-these memos key on. The memo is keyed per source, so it only absorbs repeats of the same text and
-cannot reach the shared work across sources.
-Repair class: **share a context at the least common ancestor.** Compile the fixture module against
-the prepared closure's resolved and reconciled state, so only the new module is compiled. This is
-#11401's R1 at fixture grain. Keep one claim that runs a fixture compile cold, as the inhabitance
-claim for the real path.
-
-**C2. The whole gate closure is reconciled for a small diff (~8–11 min).** Here `seeds=259`
-produced `closure=2585`, and `compile.reconcile` took 8 minutes. I have not located the boundary
-yet. The reconcile cost overlaps the type_env PR-2 slowdown, which calm-pike-525 owns (#13008,
-#13009). Take that attribution as the input here; I am not redoing it. The open question for this
-plan is narrower: does any planned claim demand a reconciled closure, or only a resolved one? If
-only resolved, reconcile beyond the planned claims' reach is redundant demand.
-Repair class: **delete redundant demand**, if that question confirms it.
-
-**C3. The warm phase fills producers no planned claim reads (~4.6 min).** The roster
-`v2.workflow.floor_pure_producer_share` is warmed for everything in the gate closure, but the run
-plans 673 of 26,150 declared claims. The earliest unjustified boundary is the warm phase's
-demand: it is keyed on the roster intersected with the closure, not on the roster intersected with
-the planned claims' reach.
-Repair class: **delete redundant demand.** Warm only producers that some planned claim reaches.
-`body-reach-selection` already computes that reach.
-Before cutting, one caveat needs checking. `unattributed_hits=399` counts hits outside the fold,
-so confirm the zero-consumer rows are not being read by preparation itself.
-
-**C4. Small items.** There is a second full parse of the pool after preparation (~1 min; share
-the parse). The ~6.5 minutes of wall-bound publication and wet-witness time is not analysed here.
-
-## Is #12506's overage a general cause? Yes: C1's shape, one layer up
-
-The N7 witnesses intentionally execute the real front end over a fixture; their header argues
-that the red is not authorable against a supplied index. A real path is legitimately demanded once
-per fixture. What is not legitimate is paying it once per **claim**. The floor isolates claims, so
-every claim is an isolated consumer of a pure function of module-constant text. DESIGN §2 says
-such consumers create **one reuse obligation at their least common visible ancestor**. Today that
-obligation is discharged only by hand. An author must make each producer nullary, roster it, and
-re-verify, which is the restructure swift-wren-597 and bright-ant-369 are now doing. The roster
-has 343 entries, and that number grows with every PR in the class. The next N7 PR will hit the
-same wall for the same reason.
-
-Two facts make it general.
-
-1. **The obligation is derivable but authored.** `[cross-claim-demand]` already computes the
-   signal: claims ≥ 2, keyed arguments, module-constant input. Rostering by hand is a second
-   authority over a fact the demand graph carries (§3).
-2. **The margin charges the shared fill to every claim.** `floor_enrolment_margin` is an honest
-   policy budget under §5. It is denominated in deterministic eval steps, from a declared p90
-   envelope. But it is applied to marginal work plus fill. Without a provider, every claim of the
-   module re-pays the fill. So splitting a witness into more claims multiplies cost rather than
-   isolating it, and the budget measures the absent provider rather than the claim.
-   It is the first-toucher defect of gunbc#8455.
-
-## Recommended first PRs
-
-1. **C1: compile fixtures against the prepared closure** in `emit_host`. This is the largest
-   removal, about 10 of 12 fold minutes. Postcondition: the 14 modules' `fill_cpu_ms` collapses
-   to the fixture module's own compile, and `[floor-shared-fill]` shows one closure fill
-   `paid_by=<outside-fold>`.
-2. **C3: scope the pure-share warm to the planned claims' reach.** This is small and about 4.6
-   minutes. Postcondition: `prepared-subject-warm` reports no `consumer_claims=0` fills.
-3. **Derive the pure-share obligation from `[cross-claim-demand]` and restore the upload of the
-   claim-cost and cross-claim TSV artifacts.** This also restores the named instrument this note
-   had to read from the log. Postcondition: an N7-class witness module whose claims share one
-   fixture is admitted with no rostering edit, and `floor_cost_distribution_instrument` runs
-   against a current run.
-
-Item 3 is the one that releases the N7 lane in general. Items 1 and 2 are the larger time
-removals.
diff --git a/docs/plans/gcp-iam-bootstrap.md b/docs/plans/gcp-iam-bootstrap.md
deleted file mode 100644
index 0f16550d167..00000000000
--- a/docs/plans/gcp-iam-bootstrap.md
+++ /dev/null
@@ -1,280 +0,0 @@
-# Commission the approval-gated GCP IAM workflow
-
-The existing `gcp_iam_converge` fleet workflow needs its own cloud identities
-before it can request approval and configure other workflows. This bootstrap
-commissions that foundation from the existing IAM declarations. It does not
-depend on the workspace allocation branch.
-
-## Entry points
-
-`gunbc.auth.gcp_iam_bootstrap.iam_bootstrap_plan` prints the exact roles,
-permissions, bindings, deny permissions, and workflow admission condition without
-cloud effects. `iam_bootstrap_apply` uses an explicitly supplied operator token
-file and a fresh receipt identity:
-
-```bash
-export GUNBC_GCP_ACCESS_TOKEN_FILE=/path/to/private/operator-token
-export GUNBC_IAM_BOOTSTRAP_RECEIPT=operator-bootstrap-unique-attempt
-export GUNBC_IAM_BOOTSTRAP_AUTHORITY_ID=stable-authority-operation
-export GUNBC_IAM_BOOTSTRAP_AUTHORITY_EXPIRES_AT=2026-09-28T23:00:00Z # illustrative; set once for the intended operation
-export GUNBC_IAM_BOOTSTRAP_PROBE_ID=stable-probe-operation
-export GUNBC_IAM_BOOTSTRAP_PROBE_EXPIRES_AT=2026-09-28T23:00:00Z # illustrative; set once, at most one hour away
-systemd-run --user --scope -p MemoryMax=6G -p MemorySwapMax=0 --quiet \
-  ./target/release/gunbc run --source-root dag --source-root src/v2 \
-  --entry dag/gunbc/auth/gcp_iam_bootstrap.dag \
-  --function iam_bootstrap_apply
-```
-
-`iam_bootstrap_plan` (same roots and entry, `--function iam_bootstrap_plan`) prints the
-operator-supplied intent variables the run reads; this block illustrates them.
-
-The token file must be private and short-lived. No token belongs in a command
-argument, source file, receipt, or GitHub variable. The ongoing workflow never
-falls back to this operator token. No service-account key is created.
-
-The missing deny-policy permission is a modeled dependency, not a console task.
-Under the operator's explicit authorization, the organization IAM writer can publish a
-time-limited `roles/iam.denyAdmin` grant to `user:brian@gunb.ai`, install the
-protection policy, then remove exactly that grant. GCP documents
-[Deny Admin](https://docs.cloud.google.com/iam/docs/deny-access) and
-[time-limited conditional bindings](https://docs.cloud.google.com/iam/docs/managing-conditional-role-bindings).
-The account used for continuing automation never receives this grant.
-
-The operation ID and absolute UTC expiry identify one desired authority lease.
-The maximum remaining duration is one hour. Retries retain both values and the
-journal; they do not recalculate the expiry. A new lease requires a new explicit
-intent. The current credential must be able to read/write organization IAM; if it
-cannot, convergence reports that upstream dependency. This is an observed
-boundary, not a declaration that organization IAM authority must forever be manual.
-
-## What bootstrap owns
-
-1. Observe and enable the declared APIs with independent readiness readback, then
-   create or exactly read back the dedicated IAM workflow pool/provider and its
-   observer/apply accounts. Create only bare pools and accounts for declared
-   target federations, so resource-local administrative roles can be attached.
-2. Create or exactly read back the existing four apply role definitions and
-   three resource-specific observer roles plus one single-permission bootstrap probe role. Existing drift refuses adoption.
-3. For an absent deny policy, converge the temporary operator authority, install
-   and read back the policy, and retire the exact temporary grant. Cleanup is
-   attempted on ordinary failure too; later capabilities and workflow trust require
-   successful cleanup. Existing exact deny policies need no new authority grant.
-4. Add declared capability bindings with policy etags, preserving foreign cells.
-5. Converge a time-bounded probe grant for the verified operator on only the
-   observer/apply accounts. The custom role contains only
-   `iam.serviceAccounts.getAccessToken`. Check access using 600-second tokens:
-   observer reads must work, and the apply account must receive HTTP 403 reading
-   a credential that the observer just successfully read.
-6. Remove and independently verify absence of both temporary probe grants. Cleanup
-   also runs after ordinary failure and has a standalone recovery entry. Issued
-   tokens retain their original 600-second lifetime; deleting a grant is not
-   revocation of an already minted token.
-7. Only after these checks and cleanup, add workload-identity impersonation
-   bindings for the existing, pinned IAM workflow.
-
-Target providers, workload impersonation, and target secret-access grants remain
-in the existing approval-gated convergence plan. Bare target containers do not
-activate those workflows. The target roster comes from `gcp_iam_converge_targets`,
-including its current private-publisher and Namecheap entries; it is not copied
-from the older allocation branch.
-
-Permission probes are diagnostics, not an authorization oracle. Configuration
-readback and the real observer/apply secret-read control are separate checks.
-Successful bootstrap still requires a real GitHub OIDC/approval/apply run before
-the ongoing workflow can be called operational.
-
-## Recovery and evidence
-
-Each invocation creates `target/gcp-iam-bootstrap-<receipt>-started.txt` before
-effects, then a separate receipt for every attempted stage. A refusal stops
-later stages. A process loss or asynchronous creation may require a new attempt
-identity; it rereads named resources and their current policies. A started
-receipt is not completion evidence. Existing policy drift never authorizes
-automatic privilege expansion.
-
-The existing `fleet_converge_workflow.dag` job already performs observer WIF,
-request/approval, apply WIF, live approval recheck, and independent readback.
-Bootstrap supplies its missing cloud prerequisites rather than adding another
-approval workflow or a pasted-token path to secret consumers.
-
-## Validation
-
-The witness `test.claim.auth.gcp_iam_bootstrap_witness_test` is discovered and
-executed by the required floor lane (`claim_executor --required-ci --required-lane
-witnesses`) on every pull request and merge group that touches its closure; no
-hand-assembled source root is needed. Qualification must also record
-the binary hash, source revision, pure plan, missing-credential refusal, cloud
-stage receipts, and a real approval-workflow run when available.
-
-API contracts follow Google Cloud's official references for
-[custom roles](https://docs.cloud.google.com/iam/docs/reference/rest/v1/projects.roles/create),
-[project policy updates](https://docs.cloud.google.com/resource-manager/reference/rest/v1/projects/setIamPolicy),
-[workload identity pools](https://docs.cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools),
-and [deny policy creation](https://docs.cloud.google.com/iam/docs/reference/rest/v2/policies/createPolicy).
-
-## Current commissioning standing
-
-Bootstrap completed successfully at source `85bdb4e19` on 2026-09-29. All ten
-stages passed: required API readiness, identities, roles, deny protection,
-temporary deny-authority cleanup, capabilities, temporary probe authority,
-effective access checks, probe-authority cleanup, and workflow trust. The observer
-read the pinned approval credential and the writer received exact HTTP 403 for it.
-Both temporary probe grants and the earlier Deny Admin grant were verified absent.
-The operator token file was removed. See
-`receipts/gcp-iam-services-2026-09-29/README.md` for evidence and limitations.
-
-The existing approval-gated workflow was then dispatched on main as run
-`36505895733`. Bootstrap completion does not establish that workflow's approval
-or apply acceptance, nor VM commissioning. Earlier refusal receipts remain as
-historical evidence of the dependencies repaired along the way.
-
-## Temporary-authority dependency and recovery
-
-```mermaid
-flowchart TD
-  P[Read project ancestry; verify pinned organization] --> R[Read organization IAM]
-  R --> W[Organization IAM write authority]
-  W --> I[Persist fixed operator lease intent]
-  I --> E[Elect one publication]
-  E --> G[CAS grant and read back exact conditioned cell]
-  G --> D[Install and read back deny policy]
-  D --> C[CAS remove owned cell and read back absence]
-  G --> F[Deny installation refuses or lease expires]
-  F --> C
-  C --> T[Persist retirement; continue bootstrap]
-  E --> U[Interrupted or unreadable publication]
-  U --> O[Reobserve the same intent and cell]
-  O --> C
-  U --> Q[Absent cell with unresolved write: keep obligation outstanding]
-```
-
-`target/gcp-iam-authority-<operation>-*.txt` records the exact project, organization, principal,
-role, condition, and expiry before effects. Keep these records with the operator
-recovery workspace; they are local bootstrap state, not yet protected fabric
-storage. Intent drift or unreadable records refuse. A create-only election means
-at most one grant request is issued for this operation, even across retries.
-An acknowledged successful publication or a grant observed present closes that publication; cleanup can recover a crash
-between removal and recording retirement. A definitive publication HTTP 4xx also
-closes the no-effect attempt. Other unresolved write outcomes remain outstanding
-when a read sees absence. Neither a timeout nor expiry proves physical cleanup.
-The cloud condition independently bounds effective access after process loss.
-
-The shared policy reconciler preserves unrelated grants and conditions, uses
-version 3, and requires etags. Cleanup owns only the exact conditioned cell;
-unconditional pre-existing administrator access survives. A retired operation
-cannot publish again. `iam_bootstrap_authority_cleanup` drives withdrawal alone,
-using the same authority ID, expiry, journal, and operator token-file input.
-
-The downstream account-impersonation readback still requires its actual authority.
-That is a separate dependency to classify when reached, not permission to invent
-an approval or give the continuing workflow self-elevation rights.
-
-
-### Role grant scope correction
-
-The first dependency attempt was rejected with HTTP 400 because Deny Admin cannot
-be granted on a project. The current model uses the role's documented
-[organization-only grant scope](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.denyAdmin).
-A read-only Resource Manager observation established that active
-`projects/582015116396` (`gunbai-secrets`) belongs to
-`organizations/266638272282`. The authority declaration pins that organization;
-publication rereads the project and follows validated folder parents, refusing
-unknown, changed, cyclic, or incomplete ancestry. No project move or organization
-creation is inferred from missing ancestry.
-
-This temporary role is organization-scoped and time-limited; it is not represented
-as project-scoped access. Only the named human operator receives it. The modeled
-actuator still installs only the exact project deny policy. Cleanup addresses the
-pinned organization even if the project later moves. These local journals support
-one shared operator recovery workspace; they are not a distributed election across
-independent workspaces or hosts. The original project-level attempt was rejected,
-not an effective grant, and its historical receipt remains preserved.
-
-
-A newly read-back authority binding may not yet be effective. Deny installation
-permits at most 30 attempts separated by ten seconds, only after an explicit HTTP
-403 and while the original lease remains live. Transport/server faults are not
-retried as if nothing committed. An accepted create is followed by at most seven
-readbacks separated by ten seconds, with no additional creation request. Exhaustion
-or clock/deadline refusal enters the same authority cleanup obligation.
-
-
-Before publishing temporary authority, the native Google UserInfo operation must
-establish subject `116084671989231734979` (previously confirmed by the operator),
-verified email, and the pinned IAM member `user:brian@gunb.ai`. Live UserInfo readback
-identified this primary email; the earlier `briansrls@gunb.ai` spelling is not used
-as the authority identity. A different subject with the same email, missing claims,
-or changed transport email refuses publication. Cleanup does not require the old
-operator credential's identity: an authorized recovery credential may remove the
-already-pinned exact cell. No access token is put in a URL or command argument.
-
-## Exclusive initialization of an empty pool policy
-
-On 2026-09-29 the operator confirmed that no other administrator will update
-these pool policies during bootstrap. This supplies an operational exclusivity
-assumption, not a provider-enforced CAS token. Normal policy updates still require
-an observed nonempty etag.
-
-The one-off initializer is limited to pool resources already derived by
-`iam_bootstrap_capability_bindings`: `github-heal-publisher`,
-`github-heal-publisher-private`, `github-mtcollins1-boot`,
-`github-namecheap-dns`, and `github-gcp-iam-converge`. Each initial policy contains
-all and only that pool's declared capability cells. The last pool receives
-observer capability only; the apply principal cannot administer its own trust.
-It does not install target OIDC providers or account impersonation grants.
-
-An invocation must explicitly select the confirmed window using
-`GUNBC_IAM_BOOTSTRAP_POOL_WINDOW=exclusive-pool-policy-initialization-20260929`.
-The native initializer verifies the same stable Google administrator identity,
-requires an empty policy without a revision, elects one publication through a
-create-only local journal, and performs independent readback. Completion requires
-exact declared cells and a returned revision before later CAS updates are allowed.
-A failed or ambiguous write retains the journal and cannot issue another
-unconditional request. Recovery can close it only after matching readback.
-Keep the same journal workspace across retries; do not delete election records or
-run independent copies. The operator's exclusive window must still be in force
-at actual execution. This is not a standing permission for future initializations.
-
-This slice has not been applied to Google yet. An approval receipt does not
-create an administrator credential. The normal `gcp-iam-converge` workflow first
-federates as `iam-observe`, files its request, and only after approval federates as
-`iam-converge`. Both trust grants are deliberately the final bootstrap stage.
-Consequently that workflow cannot bootstrap its own initial trust. An existing
-administrator credential is a remaining explicit dependency; this environment
-has neither gcloud nor a configured readable GCP token file. No credential or
-refresh token is stored in these sources or receipts.
-
-
-## Temporary probe authority
-
-The live pool run completed all capability grants, then the administrator token
-received HTTP 403 for `iam.serviceAccounts.getAccessToken` on `iam-converge`.
-That is now another explicit bootstrap dependency, not a console instruction.
-`GUNBC_IAM_BOOTSTRAP_PROBE_ID` and `GUNBC_IAM_BOOTSTRAP_PROBE_EXPIRES_AT` pin its
-operation and deadline, at most one hour away. The two exact-account conditional
-grants name the verified human identity. They share the deny authority's journal,
-publication election, etag update and cleanup machinery. No signing, key-creation,
-policy-write or project-wide impersonation permission is included.
-
-Google documents the [access-token permission](https://docs.cloud.google.com/iam/docs/service-account-permissions).
-Permission propagation retries accept only explicit HTTP 403, at most 85 attempts
-with five-second waits (seven minutes of waiting), and stop at the original deadline. Other failures are not
-converted to propagation. `iam_bootstrap_probe_cleanup` can recover both exact
-grants without rerunning bootstrap; keep its journal and original environment.
-Trust requires cleanup success. A retired probe operation cannot grant again.
-
-The first probe lease was removed after 30 token-mint refusals over roughly one
-minute. That did not establish a permission-design defect: Google documents policy
-propagation as typically two minutes, potentially seven or longer. The bounded
-retry now permits seven minutes within the original lease; no role is widened.
-
-### Re-running after an interrupted probe-authority stage
-
-The probe stage first reads back the operator identity, and only then does
-`iam_bootstrap_cell_authority_reconcile` pin an intent or elect a publication. A run that
-stops inside that readback therefore leaves no `gcp-iam-probe-*` journal and no grant.
-Re-run with a fresh `GUNBC_IAM_BOOTSTRAP_RECEIPT` (the started receipt is create-only):
-earlier stages read back and adopt what exists (the deny stage elects no temporary
-authority when its policy already reads back), and the probe stage elects fresh under
-the same or a new probe intent. Any `gcp-iam-probe-*` or `gcp-iam-authority-*` journal
-that does exist must be kept with its original environment, as above.
diff --git a/docs/plans/git-plumbing-extdeps-authority-design.md b/docs/plans/git-plumbing-extdeps-authority-design.md
deleted file mode 100644
index f81f0bd5381..00000000000
--- a/docs/plans/git-plumbing-extdeps-authority-design.md
+++ /dev/null
@@ -1,233 +0,0 @@
-# Git plumbing as an extdeps authority
-
-LANDED, in part, by `GIT-PLUMBING-0`. This note scoped the dissolution of a split Git authority;
-the operation family and the whole devboot migration are now in tree, and §7 records exactly which
-acceptance rows landed and which did not, so the note reads neither as a plan for done work nor as
-a receipt for undone work.
-
-## 1. The finding
-
-`extdeps.git` models Git's **porcelain and read** surface. `gunbc.devboot` privately models Git's
-**object-store plumbing** surface, as raw argv. Neither fact is written down, and together they are
-one authority split at the surface grain (DESIGN §3), not one un-lifted operation.
-
-Measured against the current tree:
-
-- `extdeps.git` `git` service declares ~35 operations — `CommitInRepo`, `MergeNoEditInRepo`,
-  `RevParseInRepo`, `LsFilesUnmergedInRepo`, the diff family, config, fetch. It declares **no**
-  `write-tree`, `commit-tree`, `hash-object`, `update-ref`, `checkout-index`. The sole `update-ref`
-  spelling in `extdeps/` is an argv helper that hardcodes `FETCH_HEAD` and carries no expected-old.
-- `gunbc.devboot` carries the plumbing as argv: `update-ref` ×6, `hash-object` ×5, `cat-file` ×5,
-  `read-tree` ×3, `write-tree` ×2, `unpack-file` ×2, `rev-parse` ×2, `commit-tree` ×1.
-- `extdeps.git.object_store` `git_model_update_ref_exact` is the **pure** exact-old transition, and
-  it is already rich: recursive symbolic-ref dereference with the symbolic ref retained, stale,
-  missing, duplicate, symbolic cycle, repository-invalid, format mismatch, target unavailable, and
-  target-kind-refused arms. Its own `git_modeled_ref_transition_boundary_note` already rules that
-  P3 must consume an executing transport observation and never promote the model to `Applied`.
-
-So the pure model exists and is good; the *operation* does not; the only realization in the tree
-is private to one service.
-
-## 2. Why this is a mis-aimed dissolution, not merely missing work
-
-`gunbc.devboot.transport` is disciplined: all 30 raw argv sites are registered `RetainedWitnessRun`
-rows with a reason, and the module note claims no unmarked `WitnessBin.Run` call survives review.
-Every row declares the same dissolution target — `gunbc.host_effect_realize` `host_effect_apply`,
-shell→intent Phase 2.
-
-That target is correct for roughly 13 rows (`rm_rf`, `mkdir`, `cp`, `mv`, `chmod`, `sleep`, `uname`,
-`ldd`, `sha`, `cargo_build`, `rustc_version`, `execute_artifact`, `rm_file`) and **wrong for
-roughly 17** (the git plumbing above). A Git operation's terminus is a modeled `extdeps.git`
-service operation — DESIGN §3 (a), the dependency's interface shape, which extdeps owns — while
-`host_effect_apply` is §3 (b), a transport. Routing `git write-tree` into a generic host-effect
-actuator dissolves the *transport* and leaves Git's interface permanently unmodeled.
-
-The roster thus conflates two dissolution classes under one target, and the git half's trigger
-cannot fire correctly. This PR discharges declared debt rather than adding surface.
-
-## 3. The operation family
-
-One closed mutation family, three arms. Create, exact advance and exact delete are distinct
-transitions with distinct preconditions in Git's own interface, not distinct authorities.
-
-```
-GitExactRefMutation
-  = GitCreateRefIfAbsent    { name, new }
-  | GitAdvanceRefIfExpected { name, expected_old, new }
-  | GitDeleteRefIfExpected  { name, expected_old }
-```
-
-`expected_old: Optional<GitObjectId>` is **refused**. An absent expected-old would conflate four
-states with different remedies — create-only, update unconditionally, the caller did not supply the
-fact, the caller does not know the current value — the state-space conflation DESIGN §5 names. The
-empty string devboot passes today is a transport encoding of Git's protocol, never a semantic value,
-and disappears from the model.
-
-The pure model generalizes to the family while preserving every existing arm; `git_model_update_ref_exact`
-becomes the advance arm's caller-facing spelling, not a second authority. Create and delete must
-inherit — not re-derive — repository decode, symbolic dereference, format consistency and
-target-kind validation.
-
-### Outcome and read-back
-
-The operation does not decode Git's stderr into semantic causes. Devboot establishes why: losing a
-race and failing to reach the store both exit 128 (`produce.dag` records this by measurement), so
-exit codes do not discriminate and messages are not a structural interface. The outcome is decided
-by **observation**, not by the process result alone:
-
-```
-exit 0   + desired state observed        => Applied
-nonzero  + expected state no longer held => PreconditionNotHeld
-nonzero  + expected state still held     => ExecutionRefused
-any exit + state not observable          => ObservationRefused
-exit 0   + desired state not observed    => ReadBackMismatch
-```
-
-`Applied` is unreachable without an independent read-back, as the existing boundary note already
-requires of P3. Consumers project their own remedies from the common fact — a refused advance whose
-observed value differs is a stale parent and re-evaluates internally; a refused create whose ref is
-present is an attach.
-
-## 4. The migration is the discriminator
-
-Replacing devboot's argv sites is the point of the PR, not a cleanup tail. Each site must declare
-which transition it is; one already fails that test:
-
-**`gunbc.devboot.build` `publish_produced_tree` writes the produced-answer ref unconditionally.**
-The ref is per-request-token and holds one build answer; the function is reached from both the
-success path and `serve_refusal`. A re-serve of one token therefore silently overwrites a previous
-answer, and a client that read the old answer and one reading the new disagree with no signal. The
-ref is write-once by intent, so the correct transition is `GitCreateRefIfAbsent`, and a second
-publish for one token is a real conflict that must refuse loudly.
-
-No unconditional arm is added to preserve that call. A site that can name neither create nor exact
-advance refuses until its intended transition is modeled.
-
-## 5. The cut is the whole plumbing surface, not one operation
-
-DESIGN §3's replacement-migration rule is greedy root-first: attempt the maximal cut and descend
-only on an exact refusal — Y-incomplete, an escaping consumer, or opaque — because a separate
-deeper cut pays admission surfaces, receipts and X-compatibility work the root cut never pays.
-
-An earlier draft cut at ref mutation alone and left the other seven plumbing families private to
-`gunbc.devboot`, with no refusal behind it. Ref mutation's interesting transactional guarantee is a
-reason to sequence the *proof* there, not to leave the authority split standing. Descoping would
-have left devboot the private authority for Git plumbing while each later family paid its own
-admission round — the attractor the rule exists to prevent.
-
-So the cut is the split itself: **no `gunbc.devboot` declaration constructs a Git plumbing argv
-list, and the corresponding `RetainedWitnessRun` rows delete rather than being repointed.** The
-census in §1 is the deletion population, not a work-list for later.
-
-The upstream-shaped surface, joining `extdeps/git/`'s existing decomposition rather than arriving
-as one generic operation:
-
-```
-object database   HashObjectWrite · CatFileExists · CatFileSize · CatFileRead · UnpackObject
-index and tree    ReadTreeIntoIndex · CheckoutIndexToPrefix · WriteTreeFromIndex
-commit            CommitTree { tree, parents: NoParents | Parents { first, remaining }, message }
-ref store         ObserveRef · CreateRefIfAbsent · AdvanceRefIfExpected · DeleteRefIfExpected
-```
-
-Repository-scoped operations that already exist — `RevParseInRepo`, `CatFileBlobInRepo` — are
-consumed, never reintroduced under a plumbing module.
-
-Acceptance:
-
-1. The three-arm pure ref model in `extdeps.git.object_store`, preserving every existing refusal arm
-   (repository-invalid, stale, missing, duplicate, symbolic cycle, format mismatch, target
-   unavailable, target-kind refused). Create and delete inherit that decode and dereference; they do
-   not re-derive it.
-2. Repository, index path, ref, OID, parent set and output path are typed operation inputs. Git's
-   empty-old encoding exists only in the `CreateRefIfAbsent` transport projection.
-3. Executed against real repositories, with independent read-back on every success: create succeeds;
-   a second create refuses with the original value intact; exact advance succeeds; stale advance
-   refuses; exact delete succeeds; stale delete refuses.
-4. Devboot's behavior survives unchanged except where the migration intentionally exposes a defect
-   (§4).
-5. The ~17 Git rows leave `gunbc.devboot.transport`; the ~13 host-effect rows remain, still pointing
-   at `host_effect_apply`.
-
-Out of scope: any SCM behavior. This PR makes the plumbing an authority with one real consumer cut
-over; M0, in its own PR, is the second consumer and proves the surface is not devboot-specific.
-
-## 6. Deliberately undecided
-
-Whether `gunbc.devboot` should adopt `std.materialization_provider` is **open**, and the roster
-argues against assuming it. All seven rows of `gunbc.materialization_provider_targets` are
-compiler-internal caches identified by a `CacheInterfaceId` from a cited catalog row; devboot is a
-cargo-build artifact service with no such row and a different grain. The roster already carries a
-declared exclusion of this exact shape — `extdeps.realization.artifact_store_fs` sits *under* the
-contract as a transport and cannot inhabit the target's cache field at all — and devboot's Git
-object database plausibly occupies the same position. `ArtifactRequest` is additionally a closed
-coproduct with an explicit `request_fold`, so a new arm edits every consumer.
-
-Two facts found while scoping make the question not merely open but currently **unanswerable in
-the adoption direction**, recorded so the next author need not rediscover them. Devboot decides
-reuse by `build_subject_equal` over the whole `BuildSubject` after the digest narrows to a candidate
-— the digest is documented there as an index, not a decision — whereas `provider_serve` decides on
-`ContentHash` equality alone. And `MaterializedArtifact` retains only `request_key` plus its parts,
-so the contract holds no subject that could differ from a request's: the same-key-different-subject
-state is not representable, which is why the provider's witness suite has no collision test.
-Routing devboot into the contract as it stands would lower a wall rather than share one.
-
-That is a finding about `std.materialization_provider`, not about devboot or this PR, and belongs
-to its own lane with its own operator ruling — the module is contract-stable after four review
-passes and seven consumers are scheduled to adopt it. Nothing here depends on its outcome: if the
-contract later grows an exact-comparison door, devboot's fold is the reference implementation; if
-not, devboot remains a build-domain materializer whose storage realization is Git. Either way its
-uniformity work is exactly §5's cut and nothing more.
-
-## Dissolution trigger (DESIGN §6)
-
-This note dissolves into the carriers it names when the family lands: the model and operations in
-`extdeps.git`, and the deleted rows in `gunbc.devboot.transport`. The §6 materialization finding
-does not dissolve with it; it is owed a lane of its own.
-
-## 7. What landed, and what did not (added when `GIT-PLUMBING-0` merged)
-
-Landed:
-
-- `extdeps.git.plumbing` — `service git.Plumbing`, seventeen operations covering the object
-  database, index and tree, commit, repository init and the ref store. Repository addressing is one
-  parameter (`GitRepositoryAddress`, worktree `-C` versus store `--git-dir=`) rather than two
-  operation families; `GIT_INDEX_FILE` is an operation-owned transport prefix rather than an `env`
-  spelled at a call site. Every operation reports `exit_code` and `stderr`, never a `success` Bool,
-  and none declares an `exit` block — both per the notes in `extdeps.git` that already ruled it.
-- `extdeps.git` gains `FetchForcedRefInRepo` and `PushForcedRefInRepo`. These are not plumbing and
-  are not publication; they are the repository-addressed forced-refspec exchange devboot's git-only
-  channel runs on, which no operation in the corpus could express.
-- `GitExactRefMutation` — the three arms, with `expected_old` refused as an `Optional` exactly as
-  §3 argued. Git's empty-string old value now appears once, inside `CreateRefIfAbsent`'s transport
-  row.
-- The outcome table of §3, as `git_ref_mutation_outcome`, decided from an independent read-back
-  rather than from the exit code. `Applied` is unreachable without the read-back.
-- All thirty-five git argv sites in `gunbc.devboot` are gone; the seventeen `RetainedWitnessRun`
-  rows are deleted rather than repointed. The thirteen host-effect rows remain, still pointing at
-  `host_effect_apply`.
-- §4's discriminator: `publish_produced_tree` wrote the per-token answer ref unconditionally and now
-  creates it, so a re-serve of one token refuses loudly instead of silently replacing an answer a
-  client may already have read. It returns a typed `ProducedPublication` rather than a Bool, because
-  the Bool could not carry which of the five outcomes occurred. The lease take and the three
-  artifact bindings are creates for the same reason; the stranded-lease break is an exact delete.
-
-Did NOT land, and is not a stall: **acceptance row 1** — generalizing the *pure R0 model*
-`git_model_update_ref_exact` in `extdeps.git.object_store` to the three-arm family. Left undone
-deliberately, not forgotten: that model simulates a repository state, nothing in this cut consumes
-it, and devboot decides from an executing observation instead, so generalizing it here would have
-added authority with no consumer — the §6 tell this repository treats as a finding.
-NEXT TRIGGER: the first consumer that simulates a ref transition rather than performing one, which
-is the P3 boundary `git_modeled_ref_transition_boundary_note` already names. Until then the R0 model
-answers exactly the question it has always answered, and the execution-side family answers the other
-one.
-
-**Acceptance row 3 (execution against real repositories with independent read-back on every
-success) is likewise NOT claimed by this PR; the bound is stated rather than left to be inferred
-from a green witness suite.** What executes is the DECISION: `git_ref_mutation_outcome`
-takes the three values a caller holds after an attempt, so all five arms — including the pair that
-share exit 128 — are reachable hermetically and are claimed in
-`test.claim.git_plumbing_ref_mutation_witness_test`. What does not execute is any
-`git.Plumbing` operation, so a change that broke a transport argv while leaving the decision intact
-would keep those witnesses green. The residue is the transport spellings; the wet receipt that would
-close it is the same shape as
-`test.manual.git_upstream_model_execution`'s and belongs with a live devboot run.
diff --git a/docs/plans/glm-group-b-workload-qualification.md b/docs/plans/glm-group-b-workload-qualification.md
deleted file mode 100644
index 89578838827..00000000000
--- a/docs/plans/glm-group-b-workload-qualification.md
+++ /dev/null
@@ -1,163 +0,0 @@
-# GLM group B: workload qualification after the variant-e capture
-
-Status 2026-09-28. Supersedes the "per-step timing experiment" proposal. External review
-2026-09-27 (serving mechanisms) supplies the corrections this plan encodes; the variant-e
-capture (2026-09-27, watchdog ts=1790547523) is the evidence base.
-
-## What the capture established — and what it did not
-
-Established:
-
-- Six concurrent cold 262K submissions: five completed (~5 min apart), the sixth's 1800s
-  client bound expired while the engine was still making progress. Zero preemption log lines
-  anywhere; the preemption/recompute-storm hypothesis is DISPROVED for this arm.
-- The watchdog stacks show the engine core waiting on workers with a worker on-CPU — no
-  deadlock shape.
-- The budget arithmetic closes the observation: 6 × 262,144 = 1,572,864 fresh tokens at the
-  observed ~874 tok/s aggregate ≈ 30 minutes of engine work; the five completions plus the
-  bound expiry fit inside it.
-
-Corrections now law (from the review):
-
-- Six cache seats are SIX REQUEST STATES, not six compute lanes. TP4 splits every operation
-  across the four ranks; "the engine serializes seats" is not a mechanism, it is one shared
-  compute pool under one shared 2,048-token step budget (running-before-waiting admission in
-  the pinned scheduler).
-- A max_tokens=1 completion latency is a COMPLETION latency (input processing, queueing,
-  prefill, sampling, delivery), not an instrumented GPU-prefill duration.
-- Completion order alone cannot distinguish driver-serial from budget-starved from
-  shared-throughput. Every timing claim binds to the frozen run plan / launch receipt, never
-  to the live spark_active_workload_variant selector (a mid-flight flip or a second launcher
-  — both happened 2026-09-27 — must not be able to relabel a run's mode). Runs interrupted by
-  another controller are CONTENDED evidence and excluded from latency claims.
-
-The remaining open question: is ~874 tok/s aggregate (≈2.3s per 2,048-token step) an
-EFFICIENT execution of that work on this realization? That is an attribution question —
-sparse-indexer, attention, collectives, host gaps — and it is answered by operation-level
-timing on representative steps, not by more repro campaigns.
-
-## Corrections adopted 2026-09-28 (review of the W1 reading)
-
-1. **W1's observation is narrower than first reported.** One cold 262K completing in 323.16s
-   without six-way contention establishes that the slow near-full-window request OCCURS
-   without the cohort. It does not establish compute-bound execution and does not make
-   ~5 minutes an immutable price. The observation stays bound to its exact
-   runtime/profile/workload subject; W1b attribution remains REQUIRED.
-2. **The "26k tok/s" engine log lines are reconciled and retired as a progress signal.** The
-   pinned metric producer credits prompt tokens at FIRST-OUTPUT processing divided by the
-   logging interval — completion accounting. Per-step progress evidence must come from
-   scheduled-token/per-step observation (W1b), never from those lines.
-3. **gap_mib=2 does NOT discharge any rank fragmentation obligation.** The present producer
-   measures head-host maximum-process footprint growth above a post-prefill reference — not
-   allocator fragmentation — and observes the head host only, not the other ranks. The
-   observation is preserved under that actual meaning; the instrumentation-to-obligation join
-   needs repair (an allocator-level, per-rank measurement) before any fragmentation obligation
-   can close.
-4. **Wet work is strictly sequential under exclusive cohort ownership.** W1b and other
-   investigations are prepared independently, but no second run may replace the engine whose
-   cache or timing another run is observing (the 2026-09-27 mid-flight teardown is the named
-   counterexample).
-5. **W2 is an explicit cache-reuse qualification, not a two-seat latency comparison.** Cold
-   prime, exact replay, genuine suffix continuation, and a controlled prefix-miss leg, all
-   bound to the same admitted engine/cache incarnation, recording ACTUAL cached and computed
-   token counts (the response's prompt_tokens_details.cached_tokens, not inferred reuse) plus
-   request-level timing. A fast replay alone does not establish free general follow-ups.
-
-## The frozen objective and the unified qualification (2026-09-28 steering)
-
-**Objective: restore GLM at a qualified 262,144-token x 8-seat configuration, then stop.** One
-deliverable: an operational eight-seat service with its exact acceptance bundle and persistent
-readback. DeepSeek reuse continues independently and never becomes a deployment prerequisite.
-
-The closing qualification is ONE frozen eight-seat candidate and ONE exclusively owned
-execution — not separate campaigns:
-
-    freeze candidate (eight requested; executable derived; the old summary-based six-seat
-      derivation retained as floor only)
-    -> all-rank startup + resolved allocation evidence (the eight-seat candidate's OWN
-       allocation plan and per-rank phase bounds; the six-seat run's 1,035-block inventory is
-       a conditional expectation, never the verdict)
-    -> W2 cache-reuse legs (cold prime / exact replay / suffix continuation / prefix miss)
-       BEFORE any unrelated churn can evict the prefix under test
-    -> occupancy high-water evidence: live request identities, resident context/block demands,
-       concurrent decode/workspace shape, per-rank memory standing — eight submitted
-       max_tokens=1 requests do NOT establish eight simultaneously resident full-window
-       contexts; the run records the population it actually exercised
-    -> real decode + at least one real harness protocol interaction (one-token completions do
-       not establish tool-call parsing, multi-turn continuation, or sustained decode)
-    -> settlement: cancellation, its observed completion, deterministic stop
-    -> promotion through persistent convergence; deployed configuration, generation, and route
-       verified after the existing readiness/access gates
-
-The execution budget covers the WHOLE sequence (startup + readback + queued and executing
-requests + reuse controls + settlement). A client deadline is never an engine failure, and a
-client's disappearance is never proof its engine work or reservation was released —
-cancellation and its observed completion ride the shared request lifecycle.
-
-Deployment gate vs follow-on (the release distinction):
-
-    REQUIRED before normal serving: exact runtime/checkpoint/config/rank identity; complete
-    applicable memory bounds including the allocator allowance; ENFORCED context/concurrency
-    limits (the first operational admission policy is conservative about NEW cold-prefill
-    work, and the restriction is enforced, never aspirational); correct generation and
-    required protocol behavior; exclusive ownership, settlement, restart, readback; route
-    withdrawal and cancellation/recovery; any latency/reuse guarantee actually advertised.
-
-    FOLLOW-ON unless explicitly promised: W1b performance attribution (blocks only if it
-    uncovers a correctness/resource defect or an explicitly required operating contract);
-    maximizing concurrent cold-prefill throughput; broad benchmark matrices; an unadvertised
-    "nearly free warm continuation" objective (a cache miss is not a deployment failure when
-    cold execution is safe); DeepSeek's complete deployment.
-
-Safety-term closure order for each open term: derive a defensible bound from the mechanism;
-use a justified conservative bound where exact derivation is unnecessary (a conservative bound
-covers the candidate's actual allocation behavior — never an arbitrary allowance beside a
-green result); measure the specifically unresolved term where needed.
-
-## The three qualification workloads (replace the single cold stress test)
-
-W1. ONE COLD FULL-WINDOW REQUEST — the attributable cold-prefill cost. One 262K request,
-    nothing else admitted. Per-request timing: submission, engine arrival, first scheduled
-    work, prefill completion / first output, request completion, scheduled tokens per step,
-    plus operation-level durations and rank waits for a small number of representative
-    steps. The output is the cold-prefill service time with its dominant term named
-    (compute / indexer / communication / host / cache-recompute / unresolved).
-
-W2. CACHE-REUSE QUALIFICATION, four legs on one admitted engine/cache incarnation: (1) COLD
-    PRIME — a full-window body A, the cold reference; (2) EXACT REPLAY — A again, the pure
-    reuse measurement; (3) SUFFIX CONTINUATION — A plus a small new suffix, the genuine
-    follow-up shape; (4) PREFIX MISS — a disjoint body B, the control that must NOT reuse.
-    Each leg records the response's actual cached/computed token counts
-    (prompt_tokens_details.cached_tokens) and driver timing. Verdict shape: replay near-free
-    AND suffix near-free AND miss cold-priced means reuse is real and general for this
-    subject; a fast replay with a cold suffix means replay-only reuse; a fast MISS means the
-    measurement is lying. No leg's speed alone establishes free general follow-ups.
-
-W3. COLD PREFILL ALONGSIDE ONGOING DECODES — does admitting new work damage useful
-    interactive progress? N decode sessions established and streaming; one cold 262K prefill
-    admitted; the decode-latency standing before/during is the verdict's subject.
-
-## Service-promise shape this feeds
-
-The capacity intent stops being "262144 × N uniform seats" and becomes separate quantities:
-
-    resident context capacity      (the CacheFitProved wall — done: 6 proved, 8 hard ceiling)
-    active decode population       (W3's subject)
-    new-prefill admission policy   (W1's price, W3's coexistence standing)
-    per-step token budget          (2048 today; raising it is an OPTIMIZATION CANDIDATE that
-                                    changes the activation/workspace subject — it goes through
-                                    the memory model before any service promise reads it)
-    cold-start latency objective
-    decode-latency objective while prefill is active
-
-The serving-liveness verdict (ArmServingLivenessVerdict, one open obligation) consumes W1–W3
-evidence; the watchdog remains capture-only instrumentation and never mints a verdict. The
-stall predicate ("no forward progress within T under admitted occupancy") is a named modeled
-term over the engine's own counters before any further watchdog-armed run — see the owner
-directive 2026-09-27 on watchdogs not substituting for modeling.
-
-## Non-goals
-
-No preemption-flag tuning, no max_num_batched_tokens change, and no service-shape restoration
-decision until W1 attributes the cold cost. Group B stays down in the interim; the arm stays
-Unestablished.
diff --git a/docs/plans/google-workspace-identity-convergence.md b/docs/plans/google-workspace-identity-convergence.md
deleted file mode 100644
index 6f462549ca9..00000000000
--- a/docs/plans/google-workspace-identity-convergence.md
+++ /dev/null
@@ -1,108 +0,0 @@
-# Google Workspace identity/profile convergence (Cut 4)
-
-Owner directive 2026-09-27: the Google-side configuration the tracker depends on is modeled
-and converged — "we need to model this via convergence"; the owner performs only the literal
-initial clicks. External review 2026-09-27 (Workspace onboarding) supplies the acceptance
-boundaries; this plan is its convergence-shaped reduction.
-
-## Law
-
-1. Every Google-side setting the product depends on is a DECLARED DESIRED FACT in the model.
-2. Where Google exposes a supported READ, the setting is OBSERVED through it and the
-   observation is what standing claims consume.
-3. Where Google exposes a supported WRITE, the setting is CONVERGED through the fleet's
-   approval-gated credential path (org_admin_credential, gcp_secret_access, the PR #12421
-   IAM pattern).
-4. Where Google exposes NEITHER, the setting is a MANUAL-ADMINISTRATION OBLIGATION with a
-   readback receipt — never a fabricated convergence API, never "established because login
-   worked once".
-5. Authentication and profile acquisition are SEPARATE operations. A tenant selects ONE
-   profile source by policy: UserInfo (ordinary OIDC) or the authorized Directory source
-   (managed Workspace org). Never a runtime fallback chain.
-6. The principal stays the only identity. Names/photos are mutable profile projections with
-   explicit source, provenance, freshness, and display-audience policy.
-
-## Surfaces and their convergence class
-
-| # | Google-side fact | Read API | Write API | Class |
-|---|---|---|---|---|
-| 1 | OAuth client registration (client id/secret) for the tracker | no supported read found in the reviewed Auth Platform documentation (2026-09-28) | none | MANUAL obligation (owner's initial clicks); the secret rides Secret Manager via the existing gcp_secret_access path; the deployment config is already modeled (oidc_deployment_config) |
-| 2 | Auth Platform audience = Internal (project inside the gunb.ai org) | console readback (documentation reviewed 2026-09-28) | console-only | MANUAL obligation + readback receipt |
-| 3 | API controls: THIS client's app access — Specific Google data (openid/email/profile scopes), top OU | console readback (documentation reviewed 2026-09-28) | console-only | MANUAL obligation + readback receipt |
-| 4 | Directory sharing: authenticated-user basic profile fields (minimum); org-data sharing ONLY if assignee directory discovery requires it — the reason is recorded either way | Cloud Identity Policy API: `directory.external_directory_sharing` | no supported mutation | MANUAL change obligation + effective Policy API readback |
-| 5 | Profile-editing policy (photo) org-wide | console readback (documentation reviewed 2026-09-28) | console-only | MANUAL obligation (already set 2026-09-27) + readback receipt |
-| 6 | Managed user photos (assignee avatars, header) | Admin SDK users.photos.get (read-only scope admin.directory.user.readonly) | n/a (read-only source) | OBSERVED: periodic observation → profile projection refresh |
-| 7 | Directory people discovery (assignee picker population) | People API people.listDirectoryPeople (directory.readonly) | n/a | OBSERVED: same projection, pagination + deletion semantics preserved (incremental sync lags writes; a completed sync is not a post-change readback) |
-
-The authorized backend identity for 6/7 (service account + domain-wide delegation, if chosen)
-is a SEPARATELY APPROVED integration — never silently acquired, never required for basic
-login.
-
-## Model shape
-
-- extdeps.google.workspace grows from a citation anchor into the external model of these
-  admin controls and directory/profile operations — Google's documented semantics only, no
-  gunbc policy inside.
-- extdeps.auth.oidc keeps claims + UserInfo protocol + the sub-equality admission (a UserInfo
-  result whose sub differs from the ID token's sub is rejected whole).
-- gunbc profile projection: revisioned, source-bound, with a declared refresh policy; a new
-  login MAY update it but is not its only producer; identity history is stable across profile
-  change.
-- Photo vocabulary preserved end-to-end: PhotoReturned / ProviderDefaultPhotoReturned /
-  PhotoNotReturned / PhotoReadRefused / PhotoNotObserved. PhotoNotReturned never becomes
-  AccountHasNoPhoto; omission is never labeled PolicyDenied without a policy observation.
-- Display audience is an access-policy term: self-header vs assignee-picker vs comment-thread
-  viewers are different audiences; admitted images serve through a controlled application
-  route with bounded caching — no tokens in image URLs, no open URL-fetch proxy.
-
-## Acceptance (behavioral matrix, from the external review)
-
-Admin-managed non-public photo retrievable via the authorized Directory path or a located
-access refusal (never "make it public"); ID token omitting picture leaves authentication
-valid with no photo-absence inference; UserInfo sub mismatch rejects the profile; API
-denial/timeout is a distinct refusal, never stored as absence; provider default-photo marker
-preserved; photo lost between serialization and readback fails that boundary's propagation
-control; photo change/removal updates under the declared refresh policy; revoked profile
-access follows the retention policy; child-OU/group overrides reported as effective policy;
-second tenant isolated; email change keeps principal history; avatar absence never blocks
-issue/approval authorization. Tested with at least one NON-ADMIN managed account.
-
-## Sequencing
-
-C4.1 — Workspace external model + convergence declarations for rows 1–5 (manual-obligation
-machinery with readback receipts; VERIFY each row's API standing before classing it).
-C4.2 — Profile projection: revisioned store, refresh policy, the five-valued photo
-vocabulary, session mint becomes one producer.
-C4.3 — UserInfo profile operation (sub-equality admission) for OIDC tenants.
-C4.4 — Directory source (rows 6–7) with the separately-approved backend identity; assignee
-picker consumes the projection.
-C4.5 — Display-audience policy + controlled image route; the header, picker, and comments
-share the one projection.
-C4.6 — Receipt completion: the structured propagation trace (payload member standing →
-parsed claim → verdict → projection → persisted readback → render selection → image-load
-standing), plus the positive end-to-end control.
-
-## Done in this lane already (2026-09-27)
-
-- Login claims receipt: post-verdict writes only, typed publication standing
-  (LoginClaimsReceiptPublished/PublicationRefused), observed-boundary comment.
-- Session profile projection carries name + picture as optional members end-to-end; the
-  header prefers the display name and paints the photo with the initials fallback.
-- The direct evidence discipline held the diagnosis: three consecutive receipts established
-  provider-side omission before any account-level claim was made.
-
-## C4.1 API qualification and receipt boundary (2026-09-28)
-
-The source and limits of this classification are recorded in
-[the C4.1 research receipt](receipts/google-workspace-admin-api-2026-09-28.md).
-`extdeps.google.workspace` owns the external subjects, values and API standing.
-`gunbc.auth.google_workspace_admin_convergence` declares the five obligations and feeds
-subject-bound, time-bounded readback into `std.goal_assessment`. It does not mutate Google
-configuration or alter login. Rows 6–7 remain separate integrations.
-
-The receipt producer must authenticate its source and persist the referenced evidence before
-calling the assessor. These types and tests establish the assessment contract, not a deployed
-observer or proof that the live organization matches it. No live admin receipt is supplied by
-this change. Missing observations, unread overrides, wrong tenant/client/OU and expired
-receipts refuse assessment. The photo obligation is scoped to the declared OU: an organization-wide
-claim additionally needs resolved child-OU/group coverage; a top-OU receipt alone is insufficient.
diff --git a/docs/plans/group-a-authority-establishment-plan.md b/docs/plans/group-a-authority-establishment-plan.md
deleted file mode 100644
index 827a030fe7c..00000000000
--- a/docs/plans/group-a-authority-establishment-plan.md
+++ /dev/null
@@ -1,144 +0,0 @@
-# Establishing Group A's pair-serving authority on the fabric log
-
-Plan for the D0 prerequisite. Nothing here has been run. Every claim cites the symbol it was read from.
-Anything not read from the live store on srv1 is marked as an inference.
-
-## What refused, and why
-
-Run 36220729318 (fleet-converge `spark_v41_engram_access_probe`, srv1) read
-`heads/pair-serving-authority-group-a.1` and `…-group-b.1`, and refused srv8 with
-`gunbc.spark.host_commitment` `group_standing_over`'s `GroupStandingUnread` arm. That arm fires when a
-group's partition folds to `AuthorityUnestablished` **and** `gunbc.spark.pair_serving_authority`
-`pair_serving_authority_for` finds a source row for the group.
-
-- **group-a:** `spark_pair_serving_authorities` declares
-  `PairServingActive { group: FabricGroupA, exact_realization: PairRealizationUnestablished {…} }`. The
-  log has no `AuthorityEstablished` event for it, so its standing is Unread.
-- **group-b:** the roster has **no** group-b row. So an unestablished group-b partition reads
-  `GroupStandingUnclaimed`, and the probe doesn't refuse on it. **This corrects the brief:** the probe
-  output doesn't show that group-b is *established*. It only shows group-b isn't claimed. (Inference: no
-  repository route has ever written group-b's partition except the witness fixtures.)
-
-**Why group-a was never established.** There's no route for it. The only entry point is
-`gunbc.spark.pair_serving_authority_log` `pair_serving_authority_establish_wet`, and its annotation says
-"run once per group by an operator on an executor with the event log placed". No fleet-converge mode
-invokes it: the mode list in `.github/workflows/fleet-converge.yml` has `pair_serving_d0` but nothing for
-establishment, and no run has ever carried it. The roster row landed in #11501 and the log route in
-#11555, and the one-time actuation between them was never done.
-
-## What the run requires
-
-```
-gunbc run --source-root dag --source-root src/v2 \
-  --entry dag/gunbc/spark/pair_serving_authority_log.dag \
-  --function pair_serving_authority_establish_wet --arg group=group-a
-```
-
-Inputs: only `group`. The authority is the source row, never an argument. The actor is the executor's
-short hostname (`observe_executor_reach`). The store is `gunbc.fabric_event_log_host`
-`event_log_store_for_host`, so it must run on a host with a declared dashboard instance. For in-process
-access to `/opt/gunbc/fabric-storage`, that host is srv1.
-
-Preconditions, all enforced by `pair_serving_authority_establish` and `preparation_refusal`:
-
-1. The group-a partition folds to `AuthorityUnestablished`. A second run refuses at `established`.
-2. `establishment_refusal`: the row commits hosts, and at least one is named (srv5, srv6, srv7, srv8 via
-   `fabric_group_hosts`, cage 1). The row holds no lease.
-3. On `host-placement`: no pending group-a preparation, and group-a's live commitment is empty (no
-   finalization yet).
-4. **No live host-effect claim on srv5–8.** A live claim, such as an in-flight V4.1 build, checkpoint
-   materialize or row-store encode, makes the run refuse at `host-effects`. Run it when those modes are
-   idle.
-5. No srv5–8 host is fenced by group-b.
-
-## What it writes (a saga across two partitions)
-
-1. `host-placement`: `PlacementPrepared { operation: "establish group-a", previous: [], next: [srv5..8] }`
-2. `host-placement`: `PlacementAppendClaimed { preparation, intent }`
-3. `pair-serving-authority-group-a`: `AuthorityEstablished { authority: <the row>, placement: <ref> }`,
-   compare-and-set at `HeadAbsent`
-4. `host-placement`: `PlacementFinalized`, with up to 3 attempts. If finalization fails, the run exits
-   non-zero and says to run `host_placement_finalize_wet`. A stale write or a refused write aborts the
-   run's own preparation (`saga_abort_own`).
-
-## Consequence to decide before consenting
-
-After step 4, srv5–8 are **fenced** by group-a (`group_fenced_hosts` ⊇ `group_live_commitment`).
-`host_effect_admit_at` then refuses **every** new host-effect claim on those hosts with
-`committed: … is fenced by an authority: group-a`. This covers the `spark_v41_*` modes that claim a
-Group A host, such as `v41_runtime_image_converge`.
-
-**Establishing the authority does not unblock the Engram probe on srv8.** It changes the refusal from
-"unread" to "committed". (Inference: the exact wording depends on the probe's admission route, which
-wasn't traced to its end.) So establishment is correct for D0. For the V4.1 staging modes it's a
-**regression unless they admit through the group's authority** (`admit_host_held_by_subject`) rather than
-through a free-host claim. Parent: sequence staging work against this.
-
-## Operator authorization
-
-The code has **no consent gate** on this route. `pair_serving_d0_door`, by contrast, files an escalation.
-It is still an operator-consented act, because:
-
-- It is a one-off, irreversible, privileged write to the shared production log. The only way out of the
-  state is a transition, never a re-establishment.
-- It fences four production hosts against all other lanes.
-
-Under §3b's authorization-pattern selection (`gunbc.auth.authorization_pattern_selection`), a one-off
-effect is **one operator approval**. The two ways to run it both need the operator:
-
-- **(A) Recommended.** The operator runs the command above on srv1 as the serve principal (briansrls).
-  briansrls writes under its own umask, so the file-mode defect is avoided. Actor = `srv1`.
-- **(B)** Add a fleet-converge mode for it. This is a new modeled route in the workflow emission and
-  needs operator sign-off. It also writes as ghrunner under `umask 077`, so **it must wait for #12342**
-  and #12342's area-ensure repair. Otherwise the serve side can't read the four new objects or the
-  group-a head: they'd be 0600.
-
-Under (A), #12342 still matters downstream. D0 runs as ghrunner in CI (`pair_serving_d0`), and its later
-appends are written 0600 until #12342 lands.
-
-## Verification
-
-- The command exits 0.
-- Re-dispatch the read-only admission that refused: the Engram probe's admission, or D0's
-  `pair_serving_d0_admit_executor`. It must now read group-a as `GroupStandingEstablished`, generation 0,
-  `PairServingActive`. It must not say "has not been established".
-- On srv1: `heads/pair-serving-authority-group-a.1` exists and names the `AuthorityEstablished` object.
-  The `host-placement` head has advanced by three events, ending in `placement-finalized`.
-- Run the command a second time. It must refuse at `established`. This is the discriminating control.
-
-## Sequencing (parent ruling)
-
-Establishment fences srv5–8, so it runs **after** the remaining V4.1 staging: the production image
-build on srv8, distribution to srv5–7, and the image probe. The operator runs it on srv1 at that point,
-under route (A).
-
-## What follows Established, for the V4.1 launch
-
-The launch admits through `gunbc.spark.pair_serving_authority` `pair_serving_successor_may_launch`. The
-states below are read from `gunbc.spark.pair_serving_d0` (`d0_transaction`, `d0_settle`, `d0_decide`).
-
-1. **Established:** `PairServingActive`, generation 0 (the genesis event). may_launch = **false**.
-2. **D0 first write:** a transition at the exact head that was read, to
-   `SuspensionPendingReconciliation { hosts: grant.subject.hosts, transaction, authorization_binding, lease }`.
-   - The lease epoch is minted for generation + 1.
-   - No grant is carried yet.
-   - D0 refuses first if the grant's hosts are not the group's current population (an identity join).
-   - may_launch = **false**.
-3. **D0 settle:** records an entry-state receipt, then makes **one** compare-and-set from the pending
-   state to one of three terminals:
-   - `SuspendedForAuthorizedSuccessor { hosts, authorization: <escalation id>, exact_candidate_realization: PairRealizationKeyed { key: grant.subject.successor }, lease, cleanup }`.
-     This is reached only when the incumbent didn't answer, the head is quiet, and the declared occupant
-     has drifted. Only this terminal carries a `LeaseGrant`:
-     - `reference` = transaction
-     - `fence` = (the admitting pending event, the pending generation)
-     - `max duration` = `grant.subject.term` (`d0_lease_policy`)
-   - `PairServingActive`, restored unchanged, when the incumbent answers as the declared realization.
-     may_launch = false.
-   - `FencedRefusal` for any unread or unidentified occupancy. may_launch = false; only
-     `pair_serving_may_finish` is true.
-4. **Launch admission:** true only for `SuspendedForAuthorizedSuccessor` whose lease's **observed**
-   state is `LeaseRunningExpected`, which maps to `Converged`. The observed state is derived **at read
-   time** from the grant and the current instant (`lease_observed_at`). The launch must therefore read
-   `current_pair_serving_authorities` (the log), never the source row. An expired term reads
-   `LeaseRunningStale`, which maps to `Drifted`. That blocks START, while cleanup continues through
-   `pair_serving_may_finish`.
diff --git a/docs/plans/harness-work-lifecycle.md b/docs/plans/harness-work-lifecycle.md
deleted file mode 100644
index bb6c39c1651..00000000000
--- a/docs/plans/harness-work-lifecycle.md
+++ /dev/null
@@ -1,634 +0,0 @@
-# Harness work lifecycle (sketch → structure)
-
-Status: DRAFT v2 — owner-approved direction, external review folded in (2026-09-20).
-Born of the srv2-deploy dispatch experiment: infrastructure proven end-to-end; the
-missing thing is an authoritative lifecycle for coding work, so the known-mandatory
-journey is owned by the workflow and never depends on an agent remembering it.
-
-Guiding line: **make the known obligations unavoidable, keep agent judgment
-flexible, and make every claimed improvement visible in the real execution path.**
-
-## Axiom
-
-Work is **delivered** per the delivery contract declared at intake:
-
-- a **code-change task** is delivered only when its submitted candidate is
-  published to its PR;
-- an **orientation task** delivers an orientation result;
-- a **review task** delivers a review.
-
-The worker may not redefine a code-change task as "analysis completed" to escape
-publication; orientation and review processes are never forced to manufacture PRs.
-
-The five evidence states are distinct and never collapse:
-
-**Ready ≠ Verified ≠ Published ≠ Approved ≠ Merged**
-
-## Anchors
-
-| Anchor | Owner | Structural (workflow) | Judgment (worker) |
-|---|---|---|---|
-| Intake | roadmap authority | accepted task + delivery contract + context bundle + base sha | — |
-| Orientation | workflow (centering contract) | task, source pointers, constraints, exemplars, verification route; a typed way to report missing context | understand the problem; name uncertainty |
-| Scoped editing | worker | bound workspace + permitted effects; nothing outside the scope is reachable | implementation, local debugging, local test iteration |
-| Candidate handoff | worker submits, workflow binds | the handoff operation CAPTURES the candidate; the harness materializes its commit identity and carries the acknowledgment onto exactly that candidate | readiness claim + explanation + limitations; or blocked/needs-context |
-| Verification | workflow (belt) | declared oracle runs against the captured head in a detached checkout; receipt retained | interpreting failure (feeds the next editing pass) |
-| Publication | workflow (helper, credentialed) | push captured head, create-or-update the one PR per logical work item, receipt bound to the OBSERVED PR | PR body explanation |
-| Review | owner/fleet | feedback bound to the reviewed head; changes route back as a new candidate | approval/merge decision (human) |
-
-## Rules
-
-1. **Delivery obligation.** A code-change task is never reported complete while a
-   publication obligation is outstanding. `Ready` (submitted) enables publication
-   and leaves the obligation open; passing verification is not publication;
-   approval and merge are later, separate states.
-2. **Submission ≠ checkpoint, and binds the CAPTURED candidate.** The belt may
-   commit a dirty tree as a checkpoint (preservation only, no readiness claim).
-   A submission is a declared act whose handoff operation captures the candidate
-   as it stands THEN; the acknowledgment binds to that capture — never to
-   whatever a later belt tick sweeps up. Budget exhaustion without a submission =
-   `Yielded`, not ready. "A later edit inherits nothing" means old
-   candidate-specific evidence does not admit the new candidate; the old evidence
-   is PRESERVED, current eligibility recomputed.
-3. **Head binding.** Verification and review bind to an exact commit. Revisions
-   update the SAME PR (the obligation belongs to the logical work item).
-4. **Authority allocation is modeled and enforced by effects.** Who may commit,
-   publish, approve is a model fact; the worker's available effects, credentials,
-   the execution path, AND the rendered instruction all derive from it. Generating
-   "the worker may not publish" enforces nothing by itself — the selected effects
-   must make the restriction true; the prompt only explains it.
-5. **The worker may iterate; the workflow owns obligations.** Local test/debug
-   loops are the worker's business. The authoritative verification, its receipt,
-   publication, review routing, and per-failure-class retry ownership are the
-   workflow's. Failure classes route by owner: CandidateFault → editing
-   (continuation with verdict); VerificationInfra → retry/repair the verifier;
-   PublicationInfra → blocked-on-publication with a named owner and next action.
-   Never fold all three back onto the worker.
-6. **Typed blockers have owners.** `BlockedOnPublication(cause)` preserves the
-   pending obligation across restart, owns retry/escalation, and reconciles
-   uncertain remote success before creating anything: if the PR was created but
-   the local process died before recording it, resumption DISCOVERS the existing
-   PR — it never creates a duplicate.
-7. **Tests are behavioral, at the real execution boundary.** The suite must show:
-   terminal response without submission is not ready; submission + pass discharges
-   into publication with no discretionary request; publication failure stays
-   visible and resumable; uncertain remote success reconciles without a duplicate
-   PR; a later edit cannot reuse a prior head's evidence; the worker cannot invoke
-   an effect the model assigns to the harness. Marker/projection comparisons are
-   secondary.
-8. **Agent-facing documents are a justified argument, not just generated text.**
-   Once documentation is an input to execution, its correctness is part of the
-   work's correctness. Every consequential instruction must have traceable
-   support: WHY it must happen (applicable requirement/dependency), WHO may/must
-   (modeled authority allocation), WHEN it applies (task/role/stage/conditions),
-   HOW (the actual operation and admitted route), WHAT ESTABLISHES it happened
-   (observation bound to its subject), and WHAT IF it cannot (typed blocked/
-   repair/retry/escalation). Explanatory prose may stay authored, but it may not
-   introduce an unmodeled permission, obligation, exception, or success claim.
-   Deriving prompt and docs from one source removes drift; it does NOT remove
-   consistent-wrongness — composition is checked, not just generation.
-9. **The composed context must be consistent, not just each document.** The load
-   phase admits an applicable instruction set; individually valid documents can
-   compose into contradiction (case on file: worker prompt forbids claim_batch,
-   DESIGN.md teaches it — the repair is declaring the SCOPE distinction in the
-   model: the verifier uses the batch route, the worker submits candidates and
-   never runs authoritative verification; both documents then express it
-   correctly). Ordering one instruction before another does not repair meaning.
-   The check covers brief, orientation, stage instructions, available tools, and
-   observations: "publish the PR" is not a plan for a worker with neither
-   publication authority nor a handoff to its owner.
-10. **Policy, observed fact, and plan never render as the same standing.**
-    "Publication is required", "publication succeeded", and "we intend to
-    implement publication" are three different premises. Stage instructions
-    reflect what is established NOW, not the aspirational pipeline. (The
-    experiment's own trace called oracle-green "the full loop" with the PRs
-    unopened — that class of unsupported conclusion is what this rule exists to
-    expose.)
-11. **Contradiction reporting is a first-class, consumed route.** The worker
-    contract: when applicable instructions conflict, or a required conclusion
-    lacks its stated support, report the conflict BEFORE acting on anything that
-    depends on resolving it — never silently choose a convenient interpretation
-    or claim satisfaction. The report names the conflicting statements and their
-    sources, the affected operation, and the missing decision/evidence; a
-    suggested reconciliation is a proposal until the responsible authority
-    accepts it. The workflow preserves the affected obligation, surfaces the
-    blocker, and routes it to the owner of the contradictory instruction or
-    missing capability — a warning buried in a transcript is not consumption.
-    Two complementary protections: modeled contradictions are caught BEFORE
-    dispatch where possible; ambiguities found in execution are returned during
-    it. The agent is an additional reviewer of the supplied argument, not the
-    sole consistency checker, and it must never absorb our defect and disguise
-    it as successful execution.
-
-## The load phase (required dependency of every model-backed session)
-
-Before a model-backed process starts — worker, planner, or reviewer — the harness
-resolves its declared context manifest against the applicable source snapshot,
-assembles the required contents in the declared order, and supplies that assembly
-to the ACTUAL model request.
-
-Honest boundaries (conceptual, not new modules):
-
-- **Context declared**: which sources and instructions are required.
-- **Context assembled**: those contents were resolved from the source snapshot,
-  in order.
-- **Context supplied**: the real provider request consumed the assembly (verified
-  against the request as sent, including provider rendering and tool definitions —
-  not against an intermediate prompt string).
-- **Orientation produced**: the task-specific interpretation produced its output.
-  Load is the common foundation; orientation applies it to this task. Neither
-  proves the agent understood anything.
-
-The initial manifest: (1) full DESIGN.md (the canonical READING surface;
-AGENTS.md/CLAUDE.md/README.md symlink to it), (2) genuinely additional standing
-instructions — NOT a duplicate of the operational-essentials section already
-inside (1), (3) the anchor-relevant context for this session. The reported file
-size is a reason to measure token usage and context fit, not authorization to
-substitute a smaller subset.
-
-Ordering law: stable project prefix first, role- and task-specific material last,
-wherever the provider request format permits.
-
-## Alignment ladder (owner direction, 2026-09-21): cadenced alignment at every level
-
-Alignment is a RECURRING workflow responsibility across three scopes: the root
-principles, the parent project's purpose and approach, and the task's outcome.
-Functional decomposition exists so this is checkable: a decomposition must
-PRESERVE each task's contribution to the levels above it — every node carries not
-just its own contract but the derived statement of what that contract contributes
-to its parent's intent. Alignment checks at any level are readings against that
-carried contribution, never a fresh interpretation invented at check time.
-
-A budget is NOT a failure measure — it is the alignment cadence. When a turn
-exhausts its budget the question is never "did it fail" but "is the work still
-aligned." Orientation establishes the initial grounding; alignment MAINTAINS that
-grounding as the work develops. Verification, publication, and review remain
-distinct obligations — an alignment check never discharges them and they never
-discharge it.
-
-The levels — each a different authority, and a check at one level never
-substitutes for another:
-
-- **L0 root principles** — DESIGN.md (the axioms and what follows from them).
-  Question: does the work's approach still conform (single authority, fail-closed,
-  displaced cost, no workaround)? Carried by the load phase.
-- **L1 project intent** — the decomposition node's declared purpose, approach, and
-  this task's carried contribution to it. Question: does the work still serve the
-  arc's intent, by its declared approach?
-- **L2 task contract** — the node's boundary / red control / handback plus the
-  pinned witness. Question: is the current diff advancing THIS contract, or
-  drifting (scope creep, adjacent improvements, goalpost edits)?
-- **L3 the live work** — the candidate and its submission against L2: the
-  submission's explanation is the worker's own alignment claim; verification and
-  goal audit are the independent ones.
-
-Cadence points — each cheap, each evidence-based, each producing an alignment
-receipt:
-
-1. **Dispatch** — orientation + load phase (initial alignment).
-2. **Each work interval / continuation turn** — a brief direction check. It
-   CONSUMES the actual work and its observations (the current diff, the receipts
-   produced so far, the worker's own account), never the worker's self-report
-   alone. Its verdict is a MAGNITUDINAL standing — a Fermi estimate, order-of-
-   magnitude and evidence-cited, never false precision (owner direction,
-   2026-09-21): **ALIGNED (+0/−0)** — no measurable drift; **MISALIGNED
-   (direction)** — a named drift with a named correction; **EXTREMELY
-   MISALIGNED** — the work is off the task/project contract; **CATASTROPHICALLY
-   MISALIGNED** — the work violates a level above it (a root principle, the
-   project's declared approach). Each magnitude maps to exactly one action:
-   ALIGNED → justified continuation (evidence named); MISALIGNED → concrete steer
-   binding the next interval; EXTREMELY → escalate to the supervisor (plan-defect
-   territory; the cadence interval drops to its floor); CATASTROPHIC → stop the
-   line (the supervisor is convened immediately; work does not continue on the
-   candidate). The outcome AFFECTS the next work performed: a check whose answer
-   cannot change what happens next is ceremony, and ceremony here is worse than
-   absence because it reads as diligence.
-3. **Budget checkpoints** — the Yielded path: the supervisor's adjudication IS the
-   alignment verdict (Nominal = aligned but slow; Plan defect = misaligned by plan;
-   Stuck = misaligned by reality).
-4. **Submission and review/audit** — the worker's claim, then the independent
-   verdicts.
-
-Rules:
-
-- **A direction check is never pressure to manufacture completion.** The check
-  measures alignment and direction, not proximity to done; a check that punishes
-  an honest "not yet converging" teaches workers to fabricate convergence, which
-  is the same failure as budget-as-failure wearing a friendlier face. "Aligned
-  and still working" is a complete, acceptable answer.
-- Alignment content is DERIVED from the modeled artifacts — DESIGN.md from
-  gunbc.design_document, arc intent and task contribution from the node's declared
-  fields and its parent's, the task contract from the node and its pinned
-  contract — never hand-typed prose that can drift (the submission-schema defect
-  is the standing specimen of prose drift).
-- **The cadence is adaptive — a step function over verdicts (owner direction,
-  2026-09-21).** Each level's interval starts at its magnitudinal base (scaled by
-  the chain's depth — more levels above a task means more to stay aligned to),
-  then steps with the VERDICT'S MAGNITUDE: ALIGNED widens that level's interval by
-  a declared step (+2 turns), MISALIGNED shortens it by the same step (sooner
-  re-check), EXTREMELY drops the interval to its floor outright, and
-  CATASTROPHICALLY stops the line rather than tuning anything. A RoutedConflict
-  (instructions disagree — not a worker signal) does not tune cadence at all. Every
-  level's interval stays bounded: never rarer than its magnitudinal ceiling (root
-  principles still re-check at their epoch regardless of streaks), never more
-  frequent than a declared floor that keeps probe cost subordinate to work. The
-  cadence state is per attempt-lineage, recorded on the alignment receipt (the
-  interval used and the verdict that moved it), so a later reader can replay why
-  the checks came when they did. The step reads only typed verdicts — never
-  vibes — and verification/publication/review gates are untouched by it: cadence
-  tunes HOW OFTEN we look, never what advancing requires.
-- Alignment is not re-planning: the probe measures drift against existing
-  contracts; re-deriving the plan is the supervisor's job on escalation.
-- What it is not: not a per-round interrupt, not a second full orientation, and
-  never a vibe check that can stall progress unbounded.
-
-First mechanical slice: the continuation brief carries the projected three-level
-preamble; the answer rides in the submission's explanation; the belt records the
-cadence point. Deeper slices: alignment answers as a typed per-turn artifact
-consuming the diff and receipts, not just self-report; supervisor verdicts citing
-alignment receipts.
-
-## Warm-prefix reuse
-
-**Warm-prefix reuse is an optimization to qualify and measure, not a guarantee.**
-vLLM prefix caching matches processed token prefixes of resident blocks; eviction
-and data-parallel cache scoping mean actual reuse depends on the serving route
-and cache state, and must be OBSERVED. A canonical shared prefix makes sibling
-requests ELIGIBLE for reuse — that is the whole claim. Consequences:
-
-- No warm-up agent, no conversation-fork mechanism: the first real request
-  supplies the initial demand; reuse shares eligible prefix computation, never
-  another session's mutable conversation or conclusions.
-- **Missing required context blocks the request. A cache miss must never weaken
-  the context contract** — the declared cold route is taken when admitted.
-- Cache savings are reported only when measured; prefill savings do not bound
-  generation cost.
-- No "stability class" field until it has a concrete consumer; exact source
-  identity + declared order are what matter now.
-
-## Slice 3's authority shape (the extdeps distinction)
-
-DESIGN.md is the reading surface, not a second command authority. The intended
-derivation is:
-
-**modeled operation + applicable policy → executable invocation, documentation,
-and worker-facing explanation**
-
-— not one paragraph copied into both DESIGN.md and the prompt while execution is
-authored elsewhere. Batching rules, witness population selection, wet-execution
-requirement, executable provenance, and memory-budget requirements govern the
-chosen execution ROUTE; the docs and prompt explain that same route. External
-interface shapes stay in extdeps; the harness lifecycle composition and policy
-stay in the workflow; the lifecycle does not move into extdeps to look modeled.
-Slice 3's acceptance is the real execution boundary: at least one control fails
-when the production connection between model facts and the session request is
-removed.
-
-## Resource policy (subordinate, not organizing)
-
-**Budgets flow down the decomposition DAG; they are never flat.** A root carries
-a declared bandwidth (rounds/tokens/wall-clock — the total effort the owner
-allocates to that arc). A decomposition node allocates fractions of its
-bandwidth to its children; a leaf's worker budget is what its parent dealt it,
-not a global constant. Escalation sessions run one to two magnitudes above the
-leaf budget they supervise — the supervisor must be able to re-read the
-checkpoint, adjudicate, and still have runway to act, which a same-size budget
-cannot do. Effort expended is therefore proportional to the project's bandwidth
-by construction: big arcs afford big attempts; a leaf of a small chore node
-gets a small one. Every budget figure is a declared allocation on the node,
-visible on the dashboard — never a literal buried in harness code.
-
-Budget exhaustion is NEVER a bare "task failed". It produces a defined outcome:
-
-1. **Checkpoint** — the attempt state (transcript, worktree, receipts-so-far) is
-   preserved as a checkpoint. If the worker left a submission, it advances
-   normally; without one the attempt is `Yielded`, not failed.
-2. **Escalation** — a Yielded attempt escalates to the supervisor session for
-   the node it was dispatched under (leaf → its parent decomposition node's
-   supervisor; the root arc's supervisor is the top). The supervisor resumes
-   from the checkpoint (the attempt's warm context/state — a KV checkpoint,
-   not a cold re-read) and adjudicates one of three routes:
-   - **Nominal** — the worker was progressing; issue a continuation turn with a
-     renewed budget. (Cheap tasks legitimately finishing late take this route;
-     attempt 1 of wave 1 would have.)
-   - **Plan defect** — the brief/centering sent the worker wrong (scope too big,
-     exemplar missing, contradictory instructions). Routes to the node's owner
-     as a plan defect — the worker is not re-dispatched against a known-bad
-     plan, and rule 11's contradiction machinery carries it.
-   - **Genuinely stuck** — the task itself can't advance (missing capability,
-     external blocker). Typed `Blocked` with the supervisor's stated cause.
-3. **Supervisor verdicts are evidence**: the route, its basis, and the
-   continuation count are recorded per attempt. Continuation caps remain
-   tunable policy attached to the anchor; a cap hit escalates again rather than
-   failing silently.
-
-The supervisor is a modeled session role (like worker/reviewer/auditor), not a
-human pager: it runs on the same harness, with its own guidance contract and the
-load phase applied. Escalation depth is bounded by the decomposition DAG — a
-supervisor that itself yields escalates to its parent, terminating at the root.
-
-## Metrics
-
-Outcome metrics: cost per delivered code-change result, publication success rate,
-operator interventions per delivery, review rework per delivery. Rounds-per-diff
-is retained as a DIAGNOSTIC (it is how orientation/repair cost movements are
-observed); it is no longer a success metric.
-
-## Substrate ruling (owner, 2026-09-20): gunbc SCM inside, git at the edge
-
-The internal process substrate uses gunbc SCM (`dag/gunbc/scm/*`: object store,
-write spine, staging, proposals) for everything it can cover: candidate capture,
-the submission's head binding, attempt state identity, and the fanin merge of
-worker candidates into the project's integration head (SCM proposals, typed
-conflicts, modeled merge verdict — not textual three-way git merge). Git is used
-ONLY at the final publish layer: translating the project's integration head to a
-git push + GitHub PR. The repo being git-hosted and GitHub publication are the
-edge; nothing internal speaks git where an SCM operation exists. Belt commit/
-verify/publish seams sit behind an explicit interface so the SCM realization is
-the authority and the git realization is edge-only.
-
-## Delivery structure: recursive decomposition (owner ruling 2026-09-20)
-
-There is no separate "project" mechanism. A project IS a node — one whose work is
-the completion of its children. The work graph is a DAG with the same structure
-as the substrate itself: any node may decompose into child nodes (recursively),
-a child may serve more than one parent (DAG, not tree — the import graph's law,
-acyclicity, is the only structural rule), and every dispatchable node must have
-at least one parent. Totally flat items — no parent — are not dispatchable work;
-dispatch admission refuses them with a typed cause.
-
-Consequences:
-
-- **Fanout**: dispatching a decomposition node dispatches its ready descendants
-  (capacity-bounded), each attempt producing a verified candidate.
-- **Fanin is a fold, recursively**: a decomposition node's own candidate is the
-  integration of its children's verified candidates (SCM proposal merges, typed
-  conflicts); its evidence is complete when every child is delivered. The fold
-  bottoms out at leaf nodes (ordinary single-worker tasks).
-- **Delivery obligation binds at the grain you publish**: a leaf is a
-  decomposition of one (the degenerate case — per-attempt PR behavior falls out
-  without special-casing); a batch like the shell→dag ten publishes ONE PR at
-  the decomposition node's integration head; a whole arc could publish one PR
-  at its root.
-- Evidence states still bind per-candidate-head at every grain; a parent head is
-  Published only when its integration carries every included child's
-  verification receipt.
-
-Slice 2's publication machinery is unaffected in mechanism — the obligation
-subject is "the node whose delivery contract was dispatched", at any depth.
-
-## Distribution layer (owner direction, 2026-09-20): stateless executors, fabric-resident state
-
-Agents are stateless step functions over stored state; any conforming executor on
-the fabric can run the next slice of any attempt. The worker's signature:
-
-> input: (attempt identity, transcript head ref, workspace ref, budget slice)
-> output: appended events + typed terminal (Continue | Yielded | Submitted | Blocked)
-
-Nothing an attempt needs may live only in an executor's local filesystem. Attempt
-state maps onto the fabric's storage tiers — each class into the store that is
-already shaped for it, never a new per-lane persistence invention:
-
-| State class | Fabric storage home | Status (2026-09-20) |
-|---|---|---|
-| Transcript events (append-only, ordered, replayed on resume) | Fabric event log — the transcript becomes a hash-chained event stream with a head ref | Log exists; attempt transcripts not yet written to it |
-| Indexes over events (transcript heads, attempt-by-node, executor fencing) | The fabric DB (gunbc#11723 — shared dependency with the group-A seat pool) | In flight |
-| Workspace / candidate / receipt objects (immutable, content-addressed) | SCM object store — the belt's candidate capture already writes here | Landed (e9f0683adb) |
-| Bulk artifacts (worker logs, large dumps) | Artifact store (artifact_store_fs realization today; storage-tiering policy later) | Exists |
-| Executor leases / seats | Fabric cells (fabric_cell_acquire) | Exists for fleet work, not yet for dispatch |
-
-Rules:
-
-1. **Exactly one active executor per attempt**, fenced by a fabric lease. Two
-   executors continuing one transcript is the corruption case; the fence, not
-   politeness, prevents it.
-2. **The belt observes fabric state, not host state.** Today it polls
-   attempt-state dirs on the dashboard host; the same facts read from the store
-   make it restart-safe and host-independent (a belt on srv1 cannot see srv2's
-   disk).
-3. **Placement is a claim, not a hardcode.** Dispatch mints work + state refs;
-   executors (systemd units today, microVMs later) claim seats through the cell
-   machinery. A microVM worker is pool member N behind this seam — never a
-   bespoke spawn path.
-4. **Executor switches pay cold prefill, stated honestly.** Prefix caches are
-   per serving engine; a resumed attempt on a different executor recomputes its
-   prefill. The slice-3 stable load-phase prefix is what keeps that cheap; it is
-   a cost to measure, not a reason to pin attempts to hosts.
-5. **Transcripts compact.** Long attempts append a compaction event
-   (summary + reference to the compacted range) rather than growing unboundedly;
-   the resume reads the compaction head.
-6. **Transcripts carry private facts.** Store placement and access for attempt
-   state inherit the private-facts boundary that ctrl/ used to be; this is a
-   placement decision, not an afterthought.
-
-The supervisor/escalation design (Resource policy) rides this substrate: a
-supervisor session is just another executor reading the same refs — "resume
-from the KV checkpoint" is, mechanically, load transcript head + workspace ref +
-a warm prefix.
-
-Graduated path, each step independently useful:
-
-1. **State into the store** — transcripts and receipts content-addressed
-   alongside candidate capture; the belt dual-reads (store first, disk
-   fallback).
-2. **Checkpoint/resume on one host** — a budget-exhausted worker exits Yielded
-   with a transcript head; a fresh unit resumes from the ref. (The continuation
-   routing built 2026-09-20 is this step's decision layer.)
-3. **Executor pool seam** — spawn targets a claimed seat instead of the
-   dashboard host by name.
-4. **Second executor + microVM** — another host or a microVM joins the pool;
-   nothing above this line changes.
-
-## Workflow execution (owner ruling, 2026-09-21): durable obligations, replaceable processes
-
-Repair the current failure, but the global belt pass is NOT the permanent
-architecture. The durable facts are: accepted work, each outstanding obligation
-(capture, verification, publication, review, audit, alignment check), its state,
-its due time, and its last result or located failure. Processes, systemd units,
-timers, and page bodies are replaceable realizations over those facts — never
-the facts themselves.
-
-1. **Per-item advancement, per-operation persistence.** Each work item's
-   operations advance when INDEPENDENTLY eligible — not when a global pass
-   reaches them. Every operation's result AND its located failure persists at
-   the moment it is produced, never at pass end. A blocked capture is an
-   item-scoped fact by construction: it must never prevent unrelated
-   verification, publication, or alignment from advancing. And a required
-   operation never disappears as a legacy skip — an unperformable operation
-   stays outstanding with a typed cause and an owner, because a skip that sinks
-   an obligation is a silent drop wearing a receipt.
-2. **Scheduling: wake-ups, due times, bounded reconciliation.** Targeted
-   wake-ups (submission written, worker terminal, receipt landed) advance the
-   affected item's next operation promptly — the timer is not the critical
-   path. Due times live ON obligations (retry-after, the alignment cadence) so
-   anything time-driven is data, not a loop's period. Bounded reconciliation
-   (the sweep) is the RECOVERY backstop that re-derives from durable state —
-   never the primary driver. Missing a notification or restarting a controller
-   is a non-event: recovery replays from the durable obligations and no user
-   action is ever required to resume.
-3. **The page: fast, honest, decoupled.** Observations are decoupled from
-   execution success — a failed, poisoned, or hung item still renders
-   truthfully. Staleness is EXPLICIT (rendered-at and observed-at per region),
-   never implied by a fresh-looking body.
-4. **Acceptance demonstrations.** (a) One submitted change reaches its PR
-   while another attempt is poisoned or hung. (b) Restart and executor-loss
-   recovery through the same path — kill the controller mid-obligation and
-   watch recovery resume it without user action.
-
-5. **The contract (owner ruling, 2026-09-21): durable, versioned handoff of
-   responsibility across execution boundaries.** This generalizes clauses 1-4
-   beyond the belt - and it does NOT mean queueing every local function call.
-   The authority is a modeled module in the repo (lands as
-   `gunbc.workflow.durable_handoff` with its first real consumer); this document
-   REFERENCES it and must never become the only place the rule exists. The
-   contract:
-   - **Inbound**: a handler performs bounded admission, then confirmed durable
-     acceptance, and returns an operation reference - it finishes there. The
-     accepted work, its required inputs, and its continuation survive the caller
-     and the executing process.
-   - **Processing**: consumes identified inputs and advances state
-     conditionally; settlement records an attributable result, a refusal, or a
-     durable transfer of responsibility.
-   - **Three separate facts**: transport acknowledgment, execution-resource
-     release, and historical retention are distinct - a delivery may be settled
-     once durable responsibility transfers, but settlement never erases the
-     obligation or the information recovery needs.
-   - **Outbound**: the same contract applies to effects at the upstream
-     boundary, with guarantees limited to what the upstream API actually
-     provides - modeled as observed guarantees, never invented ones.
-   - **Composition, not invention**: the contract composes the existing work,
-     storage, identity, ownership, and observation authorities.
-6. **The missing conformance question lands with the first real inbound
-   consumer.** The §3b roster (gunbc.design_argument conformance_domains ->
-   roadmap_review_criteria) has no row whose question is "does this boundary
-   hand off responsibility durably - bounded admission, durable acceptance,
-   conditional advance, honest settlement?" - so this week's failure classes had
-   no mechanical reviewer: a pass-killing item failure, a hung tick freezing a
-   pipeline, an undecidable artifact sinking a candidate, a fresh-looking body
-   hiding stale observations. The boundary with neighbors: leasing (§3b) owns
-   the lease as a PRIMITIVE; fabric/compute owns allocation; the new row owns
-   the handoff architecture that uses them. Per §3b's own rule a row names homes
-   that EXIST: the durable_handoff authority lands first with its executable
-   controls, and the conformance row is added naming it plus the lease
-   authorities - until then this is a modeling obligation, not a reviewer. These
-   classes are its seed tells.
-
-## The belt demoted (owner ruling, 2026-09-22): wake-up and anti-entropy only
-
-The belt tick is NOT the workflow authority, NOT the unit of execution, and NOT
-the source of current state. It is demoted to two duties: delivering wake-ups
-and bounded anti-entropy repair. Every accepted issue, attempt, candidate, and
-external observation has its OWN durable authority and version — that is where
-state lives.
-
-The working shape:
-
-- An event or a due refresh recomputes the SMALLEST affected projection,
-  conditionally publishes it (publish only when the version moved — never
-  republish unchanged), and creates ONLY the next eligible obligation.
-- Duplicate, lost, and out-of-order wake-ups are harmless: every consumer is
-  idempotent and version-checked, so a wake-up is a hint, never a fact.
-- The expensive operations (verification, escalation convening, integration,
-  publication) are per-item obligations invoked on wake-up — never phases of a
-  monolithic pass whose completion bound the corpus scale will always
-  eventually break. The 90-minute tick that dies unfinished is the standing
-  specimen.
-
-## The frontend as an issue tracker (owner ruling, 2026-09-22)
-
-**Issue intake is fabric-resident (owner ruling, 2026-09-23).** Created issues
-never touch the git tree: content versions go to the SCM object store, intake and
-state-change events to the fabric event log, and the current-state index
-(issue id → current version + standing) to the fabric DB (the shared in-flight
-dependency — group-A seats and attempt-state indexing consume the same
-substrate). The roadmap projection consumes the fabric-resident intake as an
-overlay onto the .dag-authored nodes; the two populations present identically
-downstream. `POST /issues` is the first real inbound consumer of
-`gunbc.workflow.durable_handoff`: bounded admission (fields valid, a parent
-required — the no-flat-items ruling), durable acceptance, an issue reference
-back.
-
-The frontend IS an issue tracker over the same authorities — and the interface
-itself is an external authority, modeled in extdeps with its real vocabulary:
-**Google's Issue Tracker (Buganizer)** (`extdeps.google.issue_tracker` — Issue,
-Component, Status, Assignee, CC, Star, Upvote, Hotlist, SavedSearch,
-BookmarkGroup, BlockingRelation, and its stock sidebar views: Assigned to me,
-Starred by me, Upvoted by me, CC'd to me, Collaborating, Reported by me, To be
-verified, plus Hotlists and Browse components). The roadmap frontend is a
-MAPPING from our domain authorities onto that modeled interface (interface in
-extdeps; mapping and policy in the workflow) — never a homegrown tracker shape.
-
-- **Components express domain placement; parent issues express decomposition;
-  blocking edges express dependencies; attempts express execution history.**
-- The default view is a searchable issue table. Each issue has a detail page
-  and a separate Work tab. A project-tree view uses nested title-in-progress
-  bars (the landed taskbar component, promoted to the tree grammar).
-- **Four facts stay separate**: planning status, the current workflow
-  obligation, the attempt outcome, and the delivery evidence. The page derives
-  a concise PRESENT-TENSE explanation from them ("verifying candidate
-  2ccf4dc72f", "blocked: turn 2's artifact undecodable; turn 3 re-declared") —
-  it NEVER flattens them into one label like "Submission failed" plus a row of
-  misleading pending stages. A pending stage names what it waits on, not just
-  that it waits.
-
-## Review ruling (2026-09-23): branch held on two blockers; the conservation laws
-
-The first full review of the integration branch returned HOLD with two blockers
-(the launch census reads only tmux while production attempts run in systemd
-units — an invisible-population defect on the live admission path; and
-ContinuationFresh conflating "no lineage" with "lineage active/unresolved" —
-an effectful spawn answer for non-fresh states) plus high findings (alignment
-model parallel-not-authoritative; submission capture not self-authenticating;
-launch admission not an atomic cross-invocation reservation; the actuation root
-too broad to audit). The laws it minted are now doctrine:
-
-1. **Observation conservation**: every identity discovered at an external
-   boundary survives into exactly one modeled output arm — classified,
-   unclassified/unknown, foreign, or malformed. No arm may mean "drop it."
-   Classification failure weakens what is KNOWN about the identity; it never
-   erases the identity.
-2. **No refusal-to-neutral conversion**: Refused or Unknown must never become
-   [], 0, false, or none at a safety boundary.
-3. **Current policy does not identify a historical occurrence**: an existing
-   attempt is read through the provider/realization/profile it was launched
-   with (its persisted spawn identity), never through the currently selected
-   policy.
-4. **Adjacency is not a join**: a digest, subject, locator, or authority
-   supplied beside a payload must be derived from it or checked against it.
-5. **Weaker evidence cannot improve admission**: replacing an observed fact
-   with unread/unknown keeps the verdict equal or more restrictive.
-
-The recurring-failure-mode row to file on the public side: "an observed member
-disappears when classification refuses," with the static census tripwire over
-helper-layer shapes (Refused => [], Unknown => none, Absent => accumulator).
-
-**The reopening gate is conjunctive (review ruling, 2026-09-24):** model-backed
-dispatch resumes only when ALL of: the population-conservation + continuation
-composition proof is accepted (an active systemd attempt reaches zero spawn
-effects), the memory proof reaches FitProved for the declared capacity intent,
-and the exact combined revision is deployed and read back. Until the launch
-lease lands, launch authority stays single-controller/manual — a bounded
-intermediate state, never evidence of cross-invocation exclusivity.
-
-## Slices and their production exit criteria
-
-| Slice | What must be true before calling it complete |
-|---|---|
-| 1. Orientation requirement (in flight: agent-13, roadmap_centering.dag) | The real dispatch path consumes the applicable orientation input; absent or inapplicable orientation cannot be bypassed by a presence flag. |
-| 2. Handoff and delivery | A submitted candidate is captured, authoritatively verified, and published to its associated PR without another discretionary request. Yield, publication failure, restart, and uncertain remote success all remain truthful. |
-| 3. Justified instruction contract + load phase | The real session request consumes the ordered, source-bound context. Consequential build/test and submission/delivery claims derive from the same modeled facts that govern execution (traceable support per rule 8); the composed instruction set is consistent per rule 9 (the claim_batch scope distinction is the demonstration case, declared in the model and expressed correctly in both surfaces); the worker has the rule-11 contradiction route and it is consumed. At least one control catches a DELIBERATELY INTRODUCED conflict. |
-| 4. Evidence-driven refinement | Actual dispatch records show where cost and failures occur. Improvements are evaluated against those records, including unsuccessful attempts and review rework. Cache savings reported only when measured. |
-
-Serialization note: `roadmap_belt_actuate.dag` edits serialize behind agent-13;
-preparation, source inspection, acceptance-case design, and non-conflicting work
-do not.
-
-## The review deliverable
-
-The owner-facing PR contains the harness changes ACTUALLY EXERCISED (identifying
-the source head that ran), links the resulting task PRs and evidence, and shows
-at least one real dispatch reaching its task PR: this dispatch used this source
-and context, submitted this candidate, verified this head, created/updated this
-PR, reached this review state — plus which failure controls were exercised and
-which capabilities remain unproven. A dashboard restart is an operational step,
-not evidence. Plan text and dashboard status are not the deliverable.
diff --git a/docs/plans/host-network-attachment-converge-design.md b/docs/plans/host-network-attachment-converge-design.md
deleted file mode 100644
index d5d5ae53456..00000000000
--- a/docs/plans/host-network-attachment-converge-design.md
+++ /dev/null
@@ -1,115 +0,0 @@
-# Host network attachment as a converged fact — retiring the router click-path
-
-**Status:** design, operator-directed 2026-08-27 ("can we figure out how to do this stuff
-via fleet converge in the future? i don't really want to poke at my router anymore").
-
-## 1. The displaced cost
-
-Paid on 2026-08-27: moving two DGX Sparks from ethernet to wifi meant hand-editing DHCP
-reservations in the CR1000A web UI — delete two entries, wait on a stale dynamic lease the UI
-refuses to remove, re-author two static rows against MACs read off the hosts by hand. Each act
-is a fleet fact, none is expressible in the model, and the model's record was wrong in a way
-nobody could catch from inside the repo — `dgx_procurement.dag` asserted two
-`StaticDhcpReservation` rows while the router had been handing out ordinary dynamic leases the
-whole time. A fact the repo cannot read is a fact the repo will eventually misstate.
-
-The cost to displace: **a host's address is currently owned by a device the fleet cannot
-observe, cannot converge, and cites only through a user-guide PDF.**
-
-## 2. Two paths, and why one is declined
-
-### Path A — the host owns its address (RECOMMENDED)
-
-Take DHCP out of the loop for fleet hosts. A host's address becomes a netplan fact, authored
-from the model and applied over the existing `host_effect_apply` path — the transport that
-already converges hostname, toolchain, runner slots and build cache. The router's only remaining
-involvement is a **one-time** DHCP-pool shrink so the static range cannot collide; after that it
-is never touched.
-
-This fits the machinery already in tree:
-
-- `extdeps.netplan.netplan` already models the applier half, including the load-bearing
-  fact that presence in `/etc/netplan` is sufficient for application regardless of writer.
-- `host_effect_apply` already delivers typed effects to these exact hosts.
-- `membership_reconcile<M,K>` is the spine: desired vs observed attachments, keyed by
-  `(host, interface)`. Added/Modified → upsert, Removed → teardown-or-refuse. A new medium is
-  a new instantiation, not a forked reconcile.
-- **No new transport.** §3 permits one as a Realization handler, but the cheapest correct
-  move needs none.
-
-### Path B — model the CR1000A admin transport (DECLINED, recorded)
-
-Converge DHCP reservations by driving the router. `Cr1000aAdminTransport` today is
-`WebUiManual | UnknownTransport`, so a real handler is the structurally sanctioned addition.
-Declined on cost and on §5:
-
-- The CR1000A's local admin API is undocumented. The module's cited authority is a Verizon
-  user-guide PDF describing the UI, not an API — any handler would be reverse-engineered from
-  a SPA's traffic and **could not be cited**, the grounding requirement `extdeps/` exists to
-  hold.
-- Firmware-fragile: a Verizon-pushed update can change it with no notice and no version to
-  declare.
-- Buys strictly less than Path A: the address still lives in a device that is not the fleet,
-  and the model still has to transcribe it back.
-
-Recorded rather than left implicit because the next reader will otherwise re-derive it: the
-router *is* the obvious place to converge a DHCP reservation, and the reason not to is not
-obvious.
-
-## 3. What is missing
-
-Four gaps, in dependency order. None is large; the first is what everything else waits on.
-
-**(a) A per-host interface roster, and its producer.** No model of "srv6 has `enP7s7`
-(ethernet, dark) and `wlP9s9` (wireless, up)". `InterfaceObservation` is a shape with **no live
-producer** — `host_network_diagnosis.host_network_observation` returns `none` for every host,
-and the module says so, counting the whole fleet as an honest deficit. Landing the producer is
-not new scope: an existing model is already waiting for it, and its tally falling is the
-receipt.
-
-**(b) Wireless in netplan.** `extdeps.netplan.netplan` models the renderer and the interface,
-not config *content* — no `addresses:`, no `wifis:`/`access-points:`. The wifi block needs an
-SSID and a key. **The PSK is a secret and must be a `SecretRef`**, never an inline literal, on
-the reasoning `nvidia_dgx_spark_setup` already applies to the per-unit sticker credential: a
-shared home SSID password in source is the FactoryLogin mistake with a different subject.
-
-**(c) MAC grounding.** `MacAddress` is still the anemic `NonEmptyStr where brand` in
-`extdeps.dhcp.v4`, with a named dissolution to an unwritten `extdeps/network/mac.dag`. Two MACs
-per host makes this load-bearing: the model must say *which interface's* MAC a row binds, and
-today it cannot. The 2026-08-27 incident is the witness — a reservation silently kept naming a
-dead port.
-
-**(d) A medium axis on the attachment.** `NetworkPortMedium` carries `WirelessLan`, but as a
-*hardware catalog* fact (what the box ships with), not an *attachment* fact (what the host is
-using). `product.network_topology.NetworkLocality` has `Lan` with no wired/wireless
-distinction, so the topology cannot express the change that just happened.
-
-## 4. Staging
-
-- **Phase 0 — read.** Land the `InterfaceObservation` producer over `host_effect_apply`:
-  name, permanent MAC, admin state, carrier, medium, addresses. Discharges the counted
-  deficit in `host_network_diagnosis` and makes (c) and (d) authorable from measurement
-  instead of transcription. No writes.
-- **Phase 1 — ground.** `extdeps/network/mac.dag` (hex-octet parse, dissolving the brand);
-  medium on the attachment; the roster keyed by `(host, interface)`.
-- **Phase 2 — write, wired first.** Netplan `addresses:` content + apply, converged through
-  `membership_reconcile`. Wired is the safe pilot: a mistake leaves the box reachable on
-  wifi. Requires the one-time pool shrink.
-- **Phase 3 — wireless.** `wifis:`/`access-points:` with the PSK as a `SecretRef`.
-
-**The standing hazard:** every phase after 0 can strand a host. These two boxes have no BMC and
-both ethernet ports are now dark, so a bad wireless apply is a physical trip. Wireless converge
-must land behind the same read-back-and-revert discipline as the rest of the converge path, and
-Phase 2's wired-first ordering exists so there is a second way in before the first is edited.
-
-## 5. Acceptance
-
-- Phase 0 RED: a host whose observation cannot be produced answers `UnknownRefused` and is
-  **counted**, never defaulted to a plausible interface list.
-- Phase 2/3 RED: an attachment whose desired address collides with the router's live DHCP
-  pool **refuses** rather than applying — decidable from the pool bound and the desired set,
-  so a construction wall, not a post-check.
-- The flagship: srv5/srv6's addresses become derived from converged attachment rows, and
-  `dgx_procurement.dag`'s reservation rows stop being the address authority — at which
-  point the CR1000A rows are observation-only, and the click-path is retired by having
-  nothing left to click.
diff --git a/docs/plans/human-identity-authorization.md b/docs/plans/human-identity-authorization.md
deleted file mode 100644
index edb4213b1fa..00000000000
--- a/docs/plans/human-identity-authorization.md
+++ /dev/null
@@ -1,194 +0,0 @@
-# Human identity and authorization (owner ruling 2026-09-25)
-
-> **Network placement decides who can reach an endpoint. Google OpenID Connect
-> establishes which human is present. Application policy decides what that
-> principal may do.**
-
-Tailnet no longer authenticates people for the tracker or approvals app. It
-remains transport: development network, TLS/reverse-proxy, a reachability
-boundary. A `Tailscale-User-Login` header is optional transport/audit
-metadata; it never mints an application principal and never authorizes a
-mutation. (The tailnet model itself flags the fragility: the header is
-unsigned and trustworthy only when the proxy is provably the sole route.)
-
-## Three separate concepts
-
-```text
-Transport:        Direct HTTPS | Tailnet proxy | local development
-Authentication:   Google Workspace principal
-Authorization:    assign | comment | approve | administer | merge
-```
-
-## One qualified-principal authority
-
-```text
-PrincipalRef { authority, namespace, subject }
-
-principal:google-oidc/accounts/<google-sub>     -- authority https://accounts.google.com, subject = ID-token sub
-principal:gunbc/workflows/fabric                -- authority gunbc, namespace workflows
-```
-
-Email, display name, picture are `PrincipalProfile` facts with a
-profile_revision — never identity inputs. `sub` is the durable identifier
-(email can change; Workspace membership comes from the `hd` claim, not email
-parsing). Consequences: email changes don't mint people; email reuse doesn't
-inherit authority; avatar failures can't weaken auth; one human = one
-principal across tracker, web approvals, native approvals.
-
-The known contradiction at a3fd5eb is BANNED going forward:
-`principal_from_email` setting `subject = email` keeps the selector as
-durable identity. Comments must not copy that shape.
-
-## Authority placement
-
-Buganizer extdeps keeps `User { email }` (the interface's visible user).
-gunbc's principal/profile/auth authorities live OUTSIDE extdeps:
-
-```text
-extdeps.google.openid_connect     -- Google's protocol + claim vocabulary
-extdeps.google.workspace          -- Workspace org/domain interface facts
-gunbc.identity.principal          -- PrincipalRef, workflow principals, profile refs
-gunbc.auth.google_workspace_login -- gunb.ai policy over Google OIDC
-gunbc.auth.session                -- application session identity + lifetime
-gunbc.auth.request_authentication -- raw HTTP request → authenticated request
-```
-
-(The existing oauth2.Google.Refresh is API-token refresh, not a login model.)
-
-## Authentication vs authorization (Google's own split)
-
-Login requests ONLY `openid email profile`. No Gmail/Contacts/Directory/Drive
-scopes for login. Profile enrichment for the assignee picker is a separately
-authorized directory producer feeding the internal principal-profile cache.
-Avatar order: internal profile → Workspace directory → cached → initials;
-absent/unread never blocks auth, assignment, comments, or approval.
-
-## Web flow (tracker + web approvals)
-
-Authorization-code flow with PKCE (implicit is deprecated-insecure). Routes:
-`GET /auth/login`, `GET /auth/google/callback`, `POST /auth/logout`,
-`GET /auth/session`. Steps: state+nonce+PKCE verifier persisted as a
-short-lived transaction → redirect → verify state → exchange code → verify ID
-token (signature/JWKS, iss, aud, exp, nonce, email_verified, hd == gunb.ai) →
-mint opaque `AuthenticatedSession` → redirect only to an admitted relative
-return path.
-
-Browser gets an opaque cookie: Secure, HttpOnly, SameSite=Lax, bounded
-lifetime, rotated on authentication. State-changing forms additionally require
-application CSRF proof (login state ≠ CSRF token).
-
-Redirect URIs: exact-match owned domains (`tracker[-dev].gunb.ai`,
-`approvals[-dev].gunb.ai`); dev names may resolve only inside the tailnet.
-Separate OAuth clients per app × environment × platform (tracker web
-dev/prod, approvals web dev/prod, approvals iOS/Android); one admitted
-audience roster, no silent cross-app token acceptance.
-
-## Approvals: three proofs, never one
-
-```text
-Human authentication   — Google OIDC principal
-Decision authority     — one-time approval capability + approval policy
-Device/app integrity   — App Attest / Android equivalent / enrolled device
-```
-
-GET confirmation page never decides; POST decision is the only mutation,
-requiring: authenticated session + CSRF proof + one-time capability +
-expected current decision state + approval authorization (an explicit
-approver roster/role — `hd == gunb.ai` alone is org membership, not approval
-authority; first production cut = an exact stable-principal roster, even of
-one). Native apps: platform Google Sign-In → ID token to the backend
-validated against the native client audience; the mutation requires Google
-principal + device integrity + capability.
-
-## Event-log migration
-
-`roadmap-event/v3`: `author: PrincipalRef`; `Claimed { assignee:
-PrincipalRef, return_to: PrincipalRef }`; `CommentCreated { ..., author:
-PrincipalRef }`. Historical v1/v2 email strings decode as
-`LegacyEmailPrincipal { email, authentication_unestablished }` — readable,
-never authorizing, NEVER auto-matched to a current `sub`. New v3 writes
-require an authenticated principal; missing/invalid session refuses.
-
-Assignee picker stays email-centric in display, but suggestion rows submit
-the stable PrincipalRef. Typed email → directory lookup → exactly one
-admitted principal or typed refusal (none / multiple / external domain /
-unverified). Fabric: selector `fabric@gunb.ai`, stored
-`principal:gunbc/workflows/fabric`.
-
-## Comments and planning behind the seam
-
-Order: stable principal model → Google OIDC authentication → authenticated
-comment append → Ask Fabric / planning work requests. The comment CARRIER may
-be built against PrincipalRef immediately; its production POST stays blocked
-until Google session auth is wired. The one-principal one-work-request design
-stands: Issue (durable outcome) / Comment (narrative or explicit request
-origin) / IssueWorkRequest (the exact work requested now) /
-DeliverableContract (code candidate | issue-revision candidate |
-investigation report | review verdict). No planner role, no Planning type.
-
-## The canonical work graph
-
-```text
-A. Human identity and authorization
-   A1 PrincipalRef authority
-   A2 Google OIDC external model
-   A3 server session + CSRF boundary
-   A4 tracker assignment migration to event v3
-   A5 durable comments
-   A6 issue-revision/planning work contracts
-   A7 web approval migration
-   A8 native approval-client identity
-   A9 directory/avatar enrichment
-B. Stage0 driver iteration (identity split, immutable cache + private
-   overlay, A/B qualification, freeze, incremental closure, fixed point)
-C. Group B serving (cache proof → prefill bound → FitProved intent →
-   persistent convergence/readback)
-D. SCM fanin (conversion → generation/CAS save → structural locator →
-   integration-head advance)
-E. Workflow reliability (population, continuation, alignment, capture,
-   launch lease, actuation split)
-
-A1→A2→A3; A3→A4→A5→A6; A3→A7→A8; A1→A9.
-B independent of A. C independent of A,B. D independent of A,B,C.
-E constrains broad autonomous dispatch.
-```
-
-The stage0 (B) acceptance contract is preserved verbatim from the ruling:
-never hand-edit the tracked stage0 mirror; scratch driver rendered by
-interpreting emit_source_root_eval_driver_main_rs; one exact materialized
-library identity; Library/DriverA/DriverB mutation receipts; immutable
-content-addressed library + private mutable overlay (overlay output is never
-authority until copied under the full content key); freeze the rendered main
-digest after qualification (instrumentation lives at the modeled runtime
-boundary, not in 05_emit_rust.dag); landing = regen-round receipt + stage0
-partition rebuild decision; final acceptance = A′/B′ parallel on two hosts,
-full two-build fixed point paid once, generated driver digest == fast-loop
-qualified digest.
-
-## Acceptance controls
-
-- A forged Tailscale-User-Login establishes no application principal.
-- Direct HTTPS and tailnet-proxied requests authenticate to the same
-  principal.
-- Wrong iss/aud/exp/nonce/hd or unverified email refuses.
-- Same sub + changed email = same principal; same email + different sub ≠
-  same principal.
-- Comment events store PrincipalRef, not email.
-- Historical email-only events readable but unverified.
-- Valid capability + wrong principal refuses; GET never decides; POST
-  requires capability + principal + authorization + CSRF.
-- Avatar/directory failure renders fallback, never affects authorization.
-- Service/machine writers cannot use a human Google session as workload
-  identity.
-- Tailnet loss changes reachability, not stored-event identity semantics.
-
-## Immediate sequencing (owner-set)
-
-1. Amend the comments lane: author is PrincipalRef, not email/Tailnet.
-2. HOLD deployment of the assignment POST at a3fd5eb until the v3 migration
-   lands there.
-3. Build A1–A3 (principal authority, OIDC model, session/CSRF).
-4. Cut tracker assignment + comments over (A4, A5).
-5. Cut the web approval broker over (A7), then native audiences (A8).
-6. Demote tailnet identity to transport observation on user-facing routes.
-7. B, C, D continue independently.
diff --git a/docs/plans/infer-checking-mode-plan.md b/docs/plans/infer-checking-mode-plan.md
deleted file mode 100644
index c636899ed37..00000000000
--- a/docs/plans/infer-checking-mode-plan.md
+++ /dev/null
@@ -1,140 +0,0 @@
-# Checking mode in v2 infer: the expected type reaches a row before it decides
-
-Owner: smart-newt-725. Status: plan only; nothing here is built. It is sequenced after
-eager-newt-412's site-keyed facts store (branch `eager-newt-412/facts-site-key`,
-[keying-relation-design.md](keying-relation-design.md) §3e), because both restructure the same fold.
-
-## The defect this answers
-
-`v2.compiler.infer` is one bottom-up fold (`v2.std.node` `fold_node` in `infer_entries_for_tree`).
-A row decides from its children alone. A generic record construct is typed from its field values
-alone. When no field value fixes a type parameter, the construct stays untyped and counted, even
-when the position consuming it declares the instantiation. That happens for a phantom parameter
-(`Ph<T> { n: Int }`), or for a parameter that occurs only in a field whose value is itself such a
-construct (`Two<T> { a: Ph<T>, b: T }`).
-
-The controls are the two claims in
-`v2.test.claim.compiler.infer_expected_type_record_instantiation_witness_test`, enrolled
-expected-red (`v2.workflow.floor_expected_red` `floor_expected_red_chunk_infer_checking_mode`),
-plus the discriminating refusal below, which this work ENROLLS when it lands. It is done when all
-three pass.
-
-The refusal is not enrolled expected-red today because, while it is red, infer does not refuse the
-program and runs the whole member, which costs about 75.8k eval steps against the 72.3k floor
-budget for a new witness. Once checking mode refuses at the field, the same claim stops early and
-fits. Its specimen, to enroll with this work as `etr_a_field_value_disagreeing_with_the_contexts_instance_refuses_holds`:
-
-```
-module v2.test.etr_two_bad
-
-import v2.std.logic { Bool }
-
-type Ph<T> {
-  n: Int
-}
-
-type Two<T> {
-  a: Ph<T>
-  b: T
-}
-
-data t: Two<Bool> = Two { a: Ph { n: 1 }, b: 3 }
-```
-
-Infer only the `data` member `t` (handed the module's own indexes) and require a refusal with
-`record_field_value_does_not_inhabit` at `b`. The nested `a: Ph<T>` must stay: it is what leaves
-`T` fixed only by the context, so the claim discriminates checking mode rather than plain
-field-value instantiation.
-
-## The rule that shapes everything: deliver before deciding, never revise
-
-The site-keyed store keeps one fact per site. A row that enters a different second fact at an
-occupied site refuses `infer_facts_key_conflict`. So the expected type cannot be applied after a
-child has decided, by re-judging it or overwriting its fact. It must reach the child's row before
-the row decides.
-
-A consumer-side re-judgment that worked after the fact was built and withdrawn (#12935). It would
-have been a second route that this plan deletes.
-
-## The mechanism: the expected type is fold context, not a fact
-
-`v2.std.node` already has the fold this needs: `fold_node_topdown` with
-`NodeFoldTopDown { init, child_context, step }`. `child_context(parent, ctx, edge)` computes what a
-child is told from its parent and the parent's own context. Checking mode runs infer's gather on
-that fold, with the context carrying at most one expected type.
-
-- **It is an input, not a fact.** It is never stored in the facts trie, and no site gets a second
-  entry because of it.
-- **A child's site is the parent's site plus one step**, which the site-keyed store makes directly
-  addressable. That is why this goes second.
-
-## Where an expected type enters (`child_context` arms)
-
-Each arm states the one edge it speaks for. Every other edge passes **no** expectation: context is
-never inherited blindly through a node that does not declare a type for that child.
-
-| parent | edge | expected type for the child |
-|---|---|---|
-| bodied Arrow | `^arrow_body_edge` | the declared return, at its denotation, unless it mentions the Arrow's own type parameters |
-| annotated Bind (`let x: T = e`) | the bound value | the annotation |
-| record construct | a field edge | the field type the record declares. If the construct itself has an expected `R<A..>` of its own record, the record's binders are first instantiated to `A..`. |
-| list introduction | an element | `T`, when the list's own expected type is `FreeMonoid<T>` |
-| application | an argument | the formal's declared type, only while the callee's Arrow is known (inline today; named calls after #12506) |
-
-The record-construct arm is the one that matters for the controls, and it is recursive. The
-construct's own expectation instantiates its binders, which instantiates the field types, which
-become the expectations of nested constructs.
-
-## Which rows consume it (first slice: one)
-
-Only **the record construct row** consumes the expected type in the first slice. When its context
-is an Instantiation of its own record with every argument present, it starts the existing
-instantiating walk (`infer_judge_formal_args`) from those instances, not from empty. A field value
-that disagrees with an instance the context fixed is refused at the value by the same relation and
-reason as any field. The construct forms `R<A..>` itself, so the consuming position's existing
-judge sees an equal type and decides.
-
-That one row needs two supporting changes, both written once in #12935 and withdrawn with it:
-
-- a starting-instances parameter on `infer_judge_formal_args`;
-- the instantiating walk judging a formal that mentions an already-instanced type parameter at that
-  instance (`inner: Ph<T>` with `T` fixed reads as `Ph<Bool>`).
-
-Other rows that could consume an expectation are later slices, each with its own red. Two examples:
-an empty list literal `[]`, which is on the frontier today, and an unannotated `let`.
-
-## What does not change
-
-- **There is no second judgment.** The consuming position still judges produced against declared
-  through `v2.std.inhabitance` `declared_type_inhabitance`. Checking mode only lets the child
-  decide with more information.
-- **No type is guessed.** A declared type that is a declaration reference (possibly an alias), an
-  Instantiation of a different record, the wrong arity, or one mentioning an enclosing function's
-  type parameters gives no expectation. The construct stays counted exactly as today.
-- **String literals stay out of scope.** They are untyped until work item adhoc-3e4eee5a-d66, so
-  the map-literal case stays counted on that item.
-
-## Cost shape
-
-`child_context` runs once per edge. For a construct, the record's declared fields must not be
-re-derived per field edge, which would be quadratic in the field count. The context for a
-construct's children carries the instantiated field-type map, built once when the construct's own
-context is computed. Reading the record declaration is a guarded index lookup
-(`v2.std.symbol_index` `symbol_index_lookup`) against the subject's `resolved_declarations`.
-
-## Evidence when built
-
-- The two enrolled controls pass unchanged and leave `floor_expected_red` in the same change, and the
-  refusal above is enrolled green, as
-  that roster's monotone arm requires.
-- Existing record-construct, declared-return, application-argument and optional-at-required
-  witnesses stay green.
-- A native-route census, base against head: N reach / M changed, at identity grain.
-- A cost reading on a construct with many fields, showing the field map is built once.
-
-## Sequencing
-
-1. eager-newt-412's site-keyed facts store lands. It converts the gather rows to per-site entries.
-2. Checking mode: the gather moves to `fold_node_topdown`, adds the `child_context` arms above, and
-   changes the construct row as the only consumer. One PR, with the controls flipping in it.
-3. Later slices add other consumers one at a time, each with its own red.
diff --git a/docs/plans/issue-boundary-cuts-review.md b/docs/plans/issue-boundary-cuts-review.md
deleted file mode 100644
index 360f3ae9964..00000000000
--- a/docs/plans/issue-boundary-cuts-review.md
+++ /dev/null
@@ -1,86 +0,0 @@
-# Issue boundary cuts and project focus — review index
-
-Base: `e286b29962c3b89904277c64d0e0c7cc25ddb2d0` (PR #12387).
-Branch: `codex/issue-cut1-toposort`. Implementation is isolated from the serving checkout.
-Nothing in this branch is merged or deployed. The auth flow, compiler, fleet configuration and
-held allocation PR #12465 are untouched.
-
-## Review order
-
-1. `d446000e2d6` — Cut 1: command/state boundary. Private carrier snapshots, exact remote-ref
-   CAS, atomic event + operation receipt, original-result retry, native URL-encoded forms and
-   truthful detail-history refusals. [Detailed receipt](receipts/issue-cut1-command-boundary-2026-09-28.md).
-2. `b09db59f677` — Cut 4.1: five Workspace administration obligations over the existing goal
-   assessment vocabulary. Row 4 has a supported Policy API read, but manual mutation. The
-   others use bounded console readback. No Google setting or credential was changed.
-   [API qualification](receipts/google-workspace-admin-api-2026-09-28.md).
-3. `abd2d6857f2` — Cut 2: independent nesting, shared by worker alignment, supervision,
-   integration and presentation. A single event transition produces standing and assignment;
-   progress actors and attempt existence do not assign ownership. Typed ticket fields survive
-   presentation; description uses the brief; fleet placement leaves Google's extdeps model.
-4. `8e8796ea0d5` — Project focus: clicking a title focuses its recursive project, displays the
-   recent three completed items and upcoming work in dependency order, and offers “…” for
-   earlier work. Open selected issue retains detail navigation; modifier-click keeps native
-   link behavior. Undo restores order/focus/expansion, column sorting exits topological mode,
-   and cycles refuse before changing the view.
-
-The first authored nesting migration is shell → DAG batch 1: the ten `shell-dag-*` work items
-belong to `shell-typed-invocation`, as the existing batch contract explicitly states and the
-operator selected for this acceptance case. Other reverse dependency links were **not** copied
-into ownership. Their scheduling meaning remains intact. Additional projects require authored
-membership; issues with no nesting stay independent. Both ends of nesting are the same work-item
-kind. There is no separate Epic/Task hierarchy; the redundant hardcoded Task chip is removed.
-
-The old tree's shared-prerequisite links remain dependency links, but do not inflate owned-child
-progress counts. This prevents the old “0 of 1” project claim for work owned somewhere else.
-
-## Validation boundaries
-
-The changed workflow has focused pure, actual carrier and browser controls. The full page
-suite still reports the pre-existing ticket-brief budget failure. A run against an untouched
-worktree at the base reproduced these six violations: `2-scm-native-authority-program` (134),
-`floor-ceiling-roster-cut-completeness` (123), `frontend-eval-training-program` (177),
-`fleet-mtcollins1-first-host` (153), `fleet-slot-retirement-wet-proof` (116), and
-`cardinality-vertical-slice` (119). The limit is 100 words. This branch does not weaken it or edit
-unrelated ticket contracts.
-
-The full serve witness closure previously exceeded the unchanged 6 GiB limit (exit 137).
-Focused passes are not a green integrated floor. This branch remains a draft for review, not a
-merge/deployment recommendation. Each receipt names the executed boundary; a typecheck is not
-reported as an executed HTTP acceptance test.
-
-Known boundaries retained from the handoff: first-time Fabric assignment still invokes the
-existing inline launch path; this cut does not install a durable launch-obligation consumer.
-Per-issue attempt observation remains unavailable with an explicit rendered reason. Workspace
-readback types are not a deployed Google observer; receipt producers must authenticate and
-retain their evidence. Broad protected-storage cutover remains in the held allocation lane.
-
-## Reproducing the narrow controls
-
-Each control is a `.dag` entry, run with `gunbc run --source-root dag --source-root src/v2
---entry <entry> --claim-run`. The Git CAS/race/replay control is
-`test.manual.issue_command_wet`. The emitted clients come from `test.manual.issue_assignment_client`
-(`write_issue_sort_script`, `write_assignment_client_script`). The form codec is
-`test.claim.http.form_urlencoded_witness_test`. The Python browser drivers and closure copier that
-were used locally had no `.dag` authority and no consumer, so they were removed rather than landed
-as unmodeled harnesses (DESIGN §6). The browser-side controls have no committed instrument until
-they are modeled.
-
-## Final local results
-
-- Page: 83 PASS; 1 FAIL, the six brief overruns reproduced on the untouched base.
-- Presentation: 57 PASS. Alignment: 42 PASS. Continuation: 22 PASS. Submission: 34 PASS.
-- Event-state: 19 PASS. Tracker: 34 PASS. Fleet component projection: 2 PASS.
-- Recursive nesting: 3 PASS. Workspace administration: 5 PASS. Form codec: 2 PASS.
-- Actual Git CAS/race/replay commands: PASS. Native Chromium form → DAG decoder: PASS.
-- Emitted assignment retry client: PASS. Emitted project-focus/sort client with served CSS: PASS.
-
-These results are re-derived by the entries named above; the transcribed logs are not committed
-(DESIGN §6: name the instrument, never transcribe its output). The late detail-parameter forwarding and whitespace cleanup are
-small follow-ups to the executed page snapshot; they do not change the default served inputs.
-
-The ordinary push was rejected by `.githooks/pre-push`: inherited Rust formatting drift at
-`src/v1/stage0/src/cli_run.rs:20257`. `cargo fmt --all --check` reproduces it on the untouched
-base. The hook explicitly documents `git push --no-verify` as its override. That override is
-used only to publish this draft for review; Rust source and the hook are unchanged. No landing
-check is represented as passing because the push was allowed.
diff --git a/docs/plans/issue-page-architecture.md b/docs/plans/issue-page-architecture.md
deleted file mode 100644
index 15e7959ef9a..00000000000
--- a/docs/plans/issue-page-architecture.md
+++ /dev/null
@@ -1,108 +0,0 @@
-# The issue page architecture (owner mandate 2026-09-25)
-
-The per-issue page copies Buganizer's information architecture nearly
-literally, retaining gunbc's stronger workflow evidence. The page must answer
-at first glance: what is this, who owns it, what blocks it, what changed, what
-happens next. It feels alive because people and Fabric visibly participate in
-one narrative — not because more diagnostics are on screen.
-
-## Layout law
-
-- Title is the primary object/link; the canonical slug is secondary identity.
-- Header carries ONLY planning status + type + priority (`[Done] [Task] [P2]`).
-  No competing status strings (`done`, `claimed by…`, `accepted`, standing
-  lines all at once is the defect).
-- Default tab is **Comments**: description pinned above a chronological
-  comments/activity stream with author avatars, comment numbers, timestamps,
-  and a real composer. Tabs: `Comments · Dependencies · Work · History`
-  (Duplicates later, when duplicate semantics exist).
-- Right metadata rail: status, assignee (the editable control), reporter,
-  component, parent, blocked-by/blocking, delivery, return-to, modified,
-  observation.
-- Authored fields are not seven equal rows: Description (brief/motivation/
-  outcome), Acceptance criteria (red control, hand-back), Current plan
-  (current state, first slice — collapsed once done), Scope (collapsible),
-  Work (implementation instructions and evidence). An empty
-  `verified · last verified` row never renders.
-- Work tab: attempts, incarnations, provider selection, candidate heads,
-  verification receipts, raw diagnostics. Comments tab: discussion, assignment
-  changes, important blockers, publication, review handoff, status changes.
-  Never raw provider/belt noise in Comments.
-
-## One qualified-principal model
-
-```text
-QualifiedPrincipal { subject, primary_email, display_name,
-                     kind: Human | Workflow, avatar }
-```
-
-Email is the user-facing selector, never the durable identity — aliases can
-change without rewriting history. The assignee control is an email
-autocomplete (search, recents first from durable assignment history, avatar +
-display name + email + kind, keyboard navigation, dedupe by stable principal,
-`fabric@gunb.ai` pinned near top). NO model names anywhere in the assignment
-UI (no glm/kimi/codex); Fabric picks the worker through capability/cost/
-capacity/serving authorities. The realization may appear in the Work tab.
-
-Avatar resolution order: internal principal profile → Google Workspace
-directory/Contacts photo → cached prior → deterministic initials. Served via
-`/avatar/<qualified-principal>` with TTL/ETag. Standing:
-`AvatarResolved | AvatarAbsent | AvatarUnread`; absent and unread render
-initials and NEVER refuse assignment, comments, or rendering. Fabric gets a
-stable service avatar with a workflow badge — it must not masquerade as human.
-
-## Assignment IS the execution entry point
-
-```text
-AssignIssue { issue, expected_issue_revision, assigned_by, assignee, return_to }
-```
-
-- Assign to human → transfer responsibility, no dispatch.
-- Assign to `fabric@gunb.ai` → transfer responsibility + durably request
-  execution (`IssueAssignedToWorkflow → WorkRequested → launch admission`).
-  No Start Work button anywhere.
-- Admission refusal does NOT undo assignment: the issue stays assigned to
-  Fabric and renders the located waiting condition ("blocked — no admissible
-  serving offer; retry when an offer becomes available"), not "assignment
-  failed".
-- Re-assigning the same issue revision to Fabric joins the existing request
-  rather than minting another attempt.
-
-## Return-to-merge
-
-Record `requester`, `assignee`, `return_to/merge_owner` explicitly (default
-`return_to = requester` — never derived from whichever event was first). On
-OBSERVED publication: durable publication event → one compact automated
-comment with PR/head → status Ready for review → assignee becomes return_to.
-Merge remains the human completion action; publication never closes the issue.
-
-## Comments are durable events
-
-`IssueCommentCreated / Edited / Deleted` — each comment carries issue id,
-comment id, author principal, body (or body ref), created/edited times,
-visibility. Edits/deletes append events, never invisible mutation. Stable deep
-links `/issue/<id>#comment-7`. Composer with markdown/code/@mentions; retries
-never duplicate. The stream interleaves only meaningful lifecycle events
-(assignment, work accepted, attempt started, blocking decision needed,
-candidate submitted, PR published, review requested, reassigned for merge,
-closed/reopened).
-
-## Dependencies stay dimensional
-
-Dependencies tab preserves separate sections: parent/children, blocked
-by/blocking, related, supersedes/superseded-by — never one flattened list.
-Header may carry a compact summary (`Blocked by 2 · Blocking 1 · 4 children`)
-that opens the tab.
-
-## Acceptance controls (12)
-
-1. Title primary link, slug secondary. 2. Assignee field opens avatar-backed
-email autocomplete with fabric + humans + recents. 3. Human assignment never
-dispatches. 4. Fabric assignment = exactly one work request, no Start Work.
-5. Serving/capacity refusal leaves Fabric assigned with the located blocker.
-6. Reload preserves assignments and comments. 7. Comment retries never
-duplicate. 8. Missing avatars render initials, never block operations.
-9. Publication posts one handoff comment and reassigns to the stored merge
-owner. 10. Dependencies separate from parent/child. 11. No raw provider/belt
-noise in Comments. 12. Work tab keeps exact attempt/candidate/verification/
-publication/incarnation evidence.
diff --git a/docs/plans/kv-capacity-proof-abstract.md b/docs/plans/kv-capacity-proof-abstract.md
deleted file mode 100644
index 5de1b94a1ff..00000000000
--- a/docs/plans/kv-capacity-proof-abstract.md
+++ /dev/null
@@ -1,129 +0,0 @@
-# KV capacity proof: the model-agnostic abstract (for the DS4.1 lane)
-
-Distilled from the GLM-5.3-Flash / group-B work (2026-09-24/25). Everything
-here except section 4 is model-agnostic; section 4 is the worked GLM instance
-to imitate. Governing doctrine: docs/plans/moa-memory-modeling.md.
-
-## 1. The question the proof answers
-
-Given a qualified subject — model, runtime, topology, parallelism, allocator,
-workload, generation — decide, WITHOUT launching:
-
-```text
-CacheFitProved / CacheFitRefused / CacheFitUnestablished
-```
-
-for a workload intent (sequence_length × seats) against every rank's allocator
-inventory. The whole-arm verdict (ArmMemoryFit*) is a CONJUNCTION of subproofs
-of which this is one: static residency, cache capacity, prefill transient,
-decode transient, load transient, supply reserve. CacheFitProved never implies
-ArmMemoryFitProved while another subproof is open.
-
-## 2. The one algebraic law
-
-A hybrid model's persistent cache is NOT a fungible token inventory. It is a
-sum over cache GROUPS with different growth shapes:
-
-```text
-PersistentCache(rank, length, seats) =
-      seats × Σ(fixed-per-sequence groups)          (recurrent/state groups)
-    + seats × Σ(per-token groups) × length           (full attention)
-    + seats × Σ(windowed groups) × min(length, window)
-    + seats × Σ(pooled-index groups) × ceil(length / pool_every)
-    + allocator grouping / padding                   (per-group block rounding)
-```
-
-The four growth shapes (extdeps.vllm.kv_layout's KvGroupKind):
-
-| shape | scales with | example |
-|---|---|---|
-| FullAttention | length × seats | dense attention layers |
-| SlidingWindow | min(length, window) × seats | windowed attention |
-| Mamba/KDA recurrent | seats ONLY | KDA/linear-attention state |
-| KPoolIndex | ceil(length / pool_every) × seats | compressed sparse index |
-
-Demand: `seats × cold_admission_blocks(exact_layout, length)` per group,
-folded against `allocator_blocks` and `arena_bytes` on EVERY rank, joined by
-the LIMITING rank (ranks are asymmetric — measure or derive per rank, never
-average).
-
-### The three forbidden moves
-
-1. **No full-context-equivalent division.** The engine's printed "GPU KV cache
-   size: N tokens" is a projection at one profile, not an inventory;
-   `N / new_length` is a CacheCapacityCandidate, never a proof.
-2. **No linear rescale of allocated arena.** "KV memory in use" is the
-   RESIDUAL allocation (envelope − weights − activation − graphs), not demand
-   of the configured seat.
-3. **No negative or composite terms as credits.** A negative component
-   observation is an attribution refusal (lower 0, upper open);
-   `weights + non-torch` is a composite observation, not a placement receipt.
-
-## 3. The proof machinery (all reusable)
-
-- **MemoryProofSubject** (7 axes): model@checkpoint-digest, runtime@source-sha
-  +image-digest, topology@host-census-revision, parallelism policy,
-  allocator@configuration-digest, workload@intent-revision, generation.
-- **MemoryTerm**: { component, placement_law, scaling_law, phase, lifetime,
-  bound, derivation } — every byte names its mechanism.
-- **Receipt-subject compatibility**: computed FROM the scaling law. Static
-  residency transfers across workloads; per-sequence-fixed transfers across
-  lengths at equal seat counts; every workload-sensitive term refuses across
-  subjects; a TP4 receipt refuses TP2 at the topology axis. Generation is
-  provenance, not a gate.
-- **Measurement standings**: DerivedExact / DerivedConservativeInterval /
-  MeasuredUpperBound / ObservationOnly / ModelFalsified. A point sample never
-  becomes MeasuredUpperBound by being the largest seen once.
-- **The allocation plan as the durable instrument**
-  (ResolvedKvAllocationPlan): the engine emits its group roster — kinds,
-  layer identities/counts, block sizes, page bytes, tokens-per-state,
-  grouping/padding — and the plan MUST reproduce the engine's printed capacity
-  as an independent control. After that, any workload point evaluates offline;
-  wet runs become falsification, not sizing.
-- **Discriminating controls** (witness these in any new instance):
-  same arena + different roster → different capacity;
-  missing group → Unestablished;
-  pool_every 4→8 → derived capacity changes;
-  cross-topology receipt → refused;
-  cross-workload transient receipt → refused;
-  negative observation → cannot improve headroom.
-
-## 4. The GLM worked instance (what to swap for DS4.1)
-
-GLM-5.3-Flash @ TP4 (GB10 unified pool, fp8 KV, 0.8567 envelope):
-
-```text
-architecture (from config.json, cited):
-  45 layers = 34 KDA linear-attention + 11 sparse-attention (~3:1 interleave)
-  KDA: 64 heads × dim 128 → recurrent state ∝ seats (≈1 MiB/layer/seq/rank)
-  sparse: 512-dim MLA latent (∝ tokens), index_kpool 4 (∝ tokens/4), per-req tail
-measured (bounded experiment, subject-bound per rank):
-  pools 119.69–121.69 GiB; weights+nontorch 77.0–81.6 (composite, asymmetric);
-  limiting rank TP3 (pool 119.69, arena 17.03 GiB)
-engine control print: 1,805,689 tokens @ 64K profile → 27.55x at 65,536
-candidate (NOT a verdict): floor(1,805,689 / 262,144) = 6 seats at 262K
-open: 262K prefill transient (sparse-indexer buffer ≈ 40 × 262,144 × 132 B
-      ≈ 1.289 GiB/rank, formula from the pinned runtime source)
-```
-
-For DS4.1, swap exactly: the architecture facts (layer census by attention
-kind, head counts/dims, latent widths, any pooling), the pinned runtime
-revision, the topology/host census, and the envelope policy. The fold, the
-verdicts, the standings, the compatibility law, and the controls do not
-change. DeepSeek-family specifics to resolve in the roster: MLA latent
-dimensions, whether a pooled/index state exists, MoE expert placement under
-the chosen EP policy (active-params is compute, NOT residency).
-
-## 5. Module map (reuse, don't fork)
-
-- `dag/extdeps/vllm/kv_layout.dag` — growth shapes, cold_admission_blocks,
-  layout mint refusals. Add DS4.1's group roster HERE as cited architecture
-  facts beside GLM's.
-- `dag/extdeps/vllm/kv_group_metadata.dag` — the emission-gap model; the
-  ResolvedKvAllocationPlan rung.
-- `dag/gunbc/spark/arm_memory_fit.dag` — the three-arm verdicts, MemoryTerm
-  census, receipt join, compatibility law.
-- `dag/gunbc/spark/arm_memory_experiment_observed.dag` — the wet-bundle
-  binding pattern (how receipts admit with standings).
-- `dag/gunbc/spark/group_b_serving_capacity.dag` — the capacity-intent →
-  derived-profile pattern (intent is the owner's decision; profile derives).
diff --git a/docs/plans/lowering-occurrence-projection-design.md b/docs/plans/lowering-occurrence-projection-design.md
deleted file mode 100644
index d08c8ae4a08..00000000000
--- a/docs/plans/lowering-occurrence-projection-design.md
+++ /dev/null
@@ -1,176 +0,0 @@
-# Lowering occurrence projection (XL-2 prerequisite `LoweringOccurrenceProjection`): design
-
-Status: design only. No compiler behaviour changes in the PR that lands this file. Tracked by
-`gunbc.recurring_failure_mode.lowering_rebuilds_an_authored_atom_without_its_occurrence`, carrier arm
-`gunbc.compiler_frontend_program_status` `LoweringOccurrenceProjection`.
-
-## 1. What was measured, and how
-
-**The instrument for the totals** is the census:
-`v2.compiler.reference_conservation_census` `reference_conservation_census_for_paths`, run over
-`reference_conservation_stratified_sample_paths` in batches of 25 paths. The whole sample in one
-process does not fit in memory. Its per-module summary is the authority for `conserved`,
-`locus_erased`, `dropped` and the channels, and this document does not copy those numbers. The
-figures that were measured when this design was written are a dated receipt in the PR that landed
-it, not a fact kept here.
-
-**The per-site split has no committed instrument yet, on purpose.** Nothing on a lowered node says
-which function built it, so the census cannot attribute an erased atom to a site. The split in the
-PR receipt came from a one-off instrumentation:
-
-- Each synthetic-minting site on the normalize route was tagged with a site id carried in
-  `OccurrenceProjected`, which the census treats exactly like `OccurrenceSynthetic`.
-- A probe recorded which pool entry each locus-erased atom consumed: a rebuilt atom with its tag,
-  a `Named` edge label, or an atom lowered from the wrong source.
-
-That tagging is an edit to the compiler, so it cannot be an entry point, and it was not committed
-(DESIGN §6: a one-off is not an instrument). **Nothing below depends on its numbers.** §3's
-exclusion rests on grammar role alone, and §4's order uses only a coarse size comparison. PR 3 of
-§4 makes the split re-derivable without tagging: the census reports each erased atom's grammar role
-and its encoding (label, rebuilt atom, or wrong-source atom) as typed dispositions.
-
-### The sites, by grammar role and encoding
-
-Each row names the function that builds the node and how the locus is lost. The classification
-is structural, from reading the lowering: which grammar role the atom has, and whether the
-lowering encodes it as a label or as a rebuilt atom.
-
-| site | how the locus is lost | grammar role | XL-2 population? |
-|---|---|---|---|
-| `v2.std.node_query` `construct_tag_edge`, called from `body_lower_try_record_literal` (record tag `Uri { .. }`) and `body_lower_pattern_suffix_lowered` (pattern constructor `Present { .. }`) | the atom exists but is lowered from the **enclosing captured shell**, so it carries the shell's occurrence instead of the tag token's | constructor or type reference | **yes** |
-| `v2.std.qualified_name` `qualified_name_spine_node`, reached from `body_lowering_fold` `body_lower_qualified_name_spine_node` | every segment atom is built with `node_synthetic`; the `occurrence_id` parameter reaches only the spine's root, and the input is already `List<Symbol>`, so there is no segment node to carry | dotted reference or type path | **yes** for the head segment and type paths; tail field projections are not |
-| `body_lower_field_init_edge`, `body_lower_field_pattern_edge` | the name becomes a `Named` edge label | field name | no |
-| the module body's `Named` edges for `data`, `fn`, `test fn` and `type` names; parameter lists; field declarations; variant declarations; named-argument labels | label | binder or label | no |
-| `body_lower_let_expr` let binders | atom lowered from an enclosing shell | binder | no |
-| module-header segments (namespace graft; the census matches them against its `header_pool`) | header pool | the module's own name | no (see §3; to be proven in PR 3) |
-| `body_lower_method_operator_atom` (`.first` and similar method selectors) | `node_synthetic` | method selector, resolved through the receiver's type | no |
-
-**The reading that matters, and it holds without the counts:**
-
-- Only two constructors rebuild a *reference*. Everything else in the table is a binder or a
-  label.
-- The largest reference site does not use `node_synthetic` at all. Its atom **is** lowered from a
-  source, just the wrong one.
-- In the one-off measurement, `node_synthetic` inside `body_lowering_fold` itself was a negligible
-  site. The loss is in two `v2.std` constructors and in the readers that feed them.
-- On the pinned sample, `dropped` is larger than `locus_erased`. The census shows this directly:
-  most of it is in modules that normalize refuses, which belong to other `xl2_prerequisites`
-  arms, and the rest is atoms `absent` from modules that normalize accepts.
-
-## 2. #11985's mechanism, and the one this carrier reuses
-
-#11985 added `v2.std.node` `node_lowered_from(kind, children, source: Node)`. It builds the new
-node with `source.occurrence_id`, taken whole. A lowered node stands for the same authored text at
-the same position, so it keeps that occurrence. A source that had no authored origin gives a node
-that still has none, so the constructor can only preserve attribution and never invent it.
-
-**`OccurrenceProjected { caused_by }` is not the right carrier, and the RFM row's ceiling text is
-wrong to name it.** `std.occurrence_identity` reserves `OccurrenceProjected` for a node minted in a
-*different allocator*, meaning an insertion with no counterpart in the base, whose cause must be a
-`ScopedOccurrenceRef`. It states outright that "a carried-forward node gets no arm here". Lowering
-within one graph owns its source's occurrence, so using `OccurrenceProjected` there would create a
-second identity for a fact `OccurrenceMinted` already carries. That is the parallel identity the
-brief rules out.
-
-**The one mechanism:** every lowering site that rebuilds an authored atom builds it with
-`node_lowered_from(source: <the authored terminal node itself>)`. The reused type is
-`std.occurrence_identity` `NodeOccurrenceIdentity`, the `OccurrenceMinted` arm, carried unchanged.
-No new type, arm, or index is added. The measurement shows two ways a site gets this wrong, and the
-same mechanism fixes both:
-
-1. **The source is the enclosing shell, not the terminal** (rank 3). `construct_tag_edge(tag:
-   Symbol, source: captured)` has a source, but it is the whole captured literal. The fix passes the
-   tag's own terminal node. That means `body_lower_record_literal_tag_optional` and the
-   pattern-suffix reader return the tag **node** instead of `Symbol`, and the tag atom is built with
-   `node_lowered_from(source: tag_node)`.
-2. **The input no longer holds the nodes** (rank 4). `qualified_name_spine_node(qn: QualifiedName)`
-   receives `List<Symbol>`. By then there is nothing to carry, and `node_synthetic` is the honest
-   answer. Re-deriving the chain (DESIGN §6b) puts the earliest unjustified boundary at the reader
-   that turns segment nodes into symbols (`body_lower_postfix_chain_read` and its `segments`), not
-   at the spine builder. The fix carries the segment terminals to the builder, and the builder makes
-   each segment atom with `node_lowered_from(source: segment)`.
-
-   `v2.std.qualified_name` `declaration_reference_node`, the marked carrier that resolve mints, keeps
-   the occurrence on its marker only, and does so on purpose. That is a separate post-resolve
-   decision and this design leaves it alone.
-
-**Climbing from mitigation to construction.** Once each reference site takes a `Node` source, the
-constructors that only take a `Symbol` leave the lowering surface. A lowered atom is then built by a
-constructor that *requires* its authored source, and "rebuilt without its occurrence" cannot be
-written on the lowering route, with no lens needed. `body_lower_type_atom_node(sym, source)` already
-has this shape. The remaining writable path is `node_synthetic` used with an `Atom` kind inside
-lowering, and the last build PR closes it for reference positions.
-
-## 3. Binders and edge labels: not in the XL-2 population
-
-The XL-2 residual is the set of **resolve refusals after the typed import strip**
-(`gunbc.compiler_frontend_program_status` `ExactOccurrenceResidualCensus`). XL-5's waves rewrite
-those references. An atom is in the population only if removing imports can make resolve refuse
-*at it*.
-
-- **A binder** (the name of a `fn`, `data`, or `type`, a variant declaration, a parameter, a field
-  declaration, a `let` name) introduces a name. Stripping imports cannot make it refuse, and no wave
-  rewrites it.
-- **A field or argument label** (`Uri { uri: .. }`, `f(path: ..)`, `R { value: v } =>`) resolves
-  against the declaration of its type or callee. When that declaration is imported and stripped,
-  resolve refuses **at the type or callee reference** (rank 3 or 4), not at the label. A namespace
-  wave renames modules and declarations; it never renames a field or a parameter.
-- **Module-header segments** are the module's own name. The graft consumes them, not resolve.
-
-So `EdgeLabel` (`v2.std.node` `Named { name: Symbol }`) does **not** need an occurrence for XL-2.
-Adding one would change a substrate type that participates in structural equality and content
-hashing, for a population XL-2 never reads.
-
-There is one real caveat. An occurrence-exact rename of a *declaration*, which XL-5 is not, would
-need binder occurrences. That is a separate future carrier and should be modelled when a consumer
-exists, not before (DESIGN §3c).
-
-Two consequences for the tracking rows, both corrected in this PR:
-
-- The RFM trigger "`locus_erased` reads zero on the stratified sample" is **over-scoped**: most of
-  that count is binders and labels, which no XL-2 fix will or should move. The capability is
-  stated as: *every reference-position atom that lowering rebuilds carries its authored terminal's
-  occurrence*.
-- Deleting the declaration-scoped spelling pool in `v2.compiler.reference_conservation` needs a
-  second thing: binders must be told apart from references **by a grammar fact**, namely the atom's
-  role in its production, instead of by a spelling match. Until then the pool can shrink to binders
-  and labels, but it cannot be deleted. That work is PR 3 below.
-
-## 4. Rollout order and the regression check
-
-In order of size and risk:
-
-1. **Constructor tags: `construct_tag_edge` sources.** Change one shared constructor and its two
-   call sites: record literal and pattern suffix. It goes first because it is the smallest change.
-   In the one-off measurement it was about the same size as the spine site.
-2. **Qualified spines: segment nodes reach `qualified_name_spine_node`.** This is larger: the chain
-   reader's result type changes, and so does a `v2.std.qualified_name` constructor that other
-   callers use.
-3. **Census and closure.** Split the census's `locus_erased` into a typed binder/label channel
-   (counted, like `import_channel`) and a reference-position count, using the grammar role of the
-   atom. Take the `Symbol`-only atom constructors off the lowering route. Shrink the spelling pool.
-
-**The check: one controlled-fixture control per site, not a ratchet over the live sample.** Each
-build PR brings a fixture module that exercises its site. A claim runs
-`reference_conservation_of_subject` on it and asserts that the site's reference atoms are
-`conserved`. The number is grounded in the controlled fixture, so it is a real oracle (DESIGN §5).
-The red is run before the fix: on the base, the same claim reports the atom as `locus_erased`. The
-positive control is a fixture atom that already conserves, such as a type atom (#11985).
-
-A conserved-share floor over the pinned sample is **not** recommended. That literal would be copied
-from the current tree, which makes it a change detector. It is also not a closed universe: six of
-its 315 paths have already been deleted. The sample census remains the observation that ranks the
-sites, and PR 3 lets it report the split without the probe.
-
-## 5. Size
-
-- **In-population sites to change: 3** (the record-tag call, the pattern-constructor call, and the
-  qualified spine), in **2 constructors**: `construct_tag_edge` and `qualified_name_spine_node`.
-  Readers that change type: `body_lower_record_literal_tag_optional`, the pattern-suffix tag reader,
-  and `body_lower_postfix_chain_read`.
-- **Out-of-population sites, recorded but not changed:** 8 label and binder encodings, the
-  let-binder atom, and the method-selector atom.
-- **PRs: 3**, as in §4, each with its site fixture and a pre-fix red. PR 2 is the largest because
-  it changes a `v2.std.qualified_name` signature, so it has to enumerate that constructor's other
-  callers first. An optional fourth PR could cover the 7-atom method-selector site, but it is not in
-  the population.
diff --git a/docs/plans/machine-intake-design.md b/docs/plans/machine-intake-design.md
deleted file mode 100644
index b04e8ad6888..00000000000
--- a/docs/plans/machine-intake-design.md
+++ /dev/null
@@ -1,413 +0,0 @@
-# Machine intake: hardware qualification, provisioning, placement commissioning
-
-Operator ruling of 2026-08-29, transcribed as the authority for the `gunbc.machine_intake_*`
-lane. The `.dag` modules cite this document; this document does not restate what they declare.
-Where a section below names a type, the type is the authority and this is its rationale.
-
-Status: **INTAKE-0 and BOOT-DELIVERY-0 modeling in review** (gunbc#9690), reworked under the
-operator's second ruling of 2026-08-29, the third ruling of 2026-08-30
-([machine-intake-ruling-3.md](machine-intake-ruling-3.md)) and the fourth ruling of 2026-08-30
-([machine-intake-ruling-4.md](machine-intake-ruling-4.md), whose ten-item final approval gate is
-the merge gate: neither slice is recorded complete until they hold). Under ruling 4 the request's
-`BootDeliveryTarget` (subject × protocol-neutral `BmcControllerEndpoint`) is BOUND to the access
-context before any candidate is judged (`bind_boot_delivery_target`; subject and controller
-mismatches are separate refusals), every transport-local standing (configfs via
-`target_bound_reinstall_path`, whose observations are bound to a target at the observation and whose standing is derived by the producer — an empty population is Unestablished; UEFI HTTP; network boot) carries the target it was established for
-and is refused as `CandidateEvidenceForOtherTarget` otherwise; the profile's capability row is
-the exact-release `BmcFirmwareReleaseCapabilityRow` so raw "0.32" inhabits a valid profile (a
-positive control proves it); a promoted profile binds only beside `ProfilePromotionVerified`,
-which no producer can construct until INTAKE-AGENT-0A's evidence store — so every promoted
-profile refuses today; the Redfish probe receipt is one coherent reading (payload-free ladder arm at the floor AND a nonempty `admitted_protocols`; a receipt saying one without the other is refused as a contradiction), boot CONTROL is established on its own evidence (`SurfaceBootControl` in the profile/observation intersection plus exactly one OBSERVED control route — `BmcBootControlRouteObservation`, its bytes in the evidence manifest, the route named by the profile — carried on the plan as `boot_control_route`; no observation refuses, an observed route the catalog does not name refuses, two observed routes are a typed ambiguity, never a catalog preference) and the observation
-receipt carries an evidence MANIFEST that must name both the discovery bytes and the nested
-probe's bytes; the plan's provenance preserves the selected candidate's own evidence. The
-changed-witness execution sublane #9717 requires is dispatched as its own CI PR (child work
-item of this lane). Under ruling 3 the solver reads a
-`BootDeliveryRequest` (target unit and attempt, exact `BootArtifact`, staging offers each naming
-the digest they serve), a `BoundBootDeliveryEvidence` whose access context
-`gunbc.machine_intake_access` has already bound to this attempt (profile ∩ observation, capability
-row read off the profile, observation receipt digest checked), and a `BootDeliveryPolicy`; it
-answers with a `BootDeliveryPlan` that repeats target and artifact, derives the Redfish locator and
-protocol from the probe RECEIPT, requires the MegaRAC route's `image_redirection` fact, and names
-the profile provenance and observation receipt its eligibility came from. The capability-only
-legacy solver, its `FirmwareUpdateThenVirtualMedia` shortcut, `srv3_install_mechanism`,
-`fleet_install_server_specs` and the ProxyDHCP artifact path are deleted; `gunbc.os_install_mechanism`
-is a compatibility projection that refuses at `InstallAccessProfileNotLookedUp`. Firmware release
-identity is the raw vendor string (`BmcFirmwareReleaseIdentity`, so "0.32" is representable);
-`FirmwareTransition*` lives in `gunbc.bmc_firmware_transition` and `NetworkBoot*` in
-`gunbc.network_boot_delivery`. Under ruling 2: the Mt. Collins family binding is an EXPECTATION
-(`MtCollinsBmcImplementationExpected`) until a workflow-layer `BmcImplementationObserved`
-receipt exists; the one solver reads `BmcAccessProfile × BmcAccessObservation` through a total
-profile lookup (`BmcAccessProfileStanding`), plans the Redfish arm only at
-`TransferProtocolAdmitted` or above on the probe ladder, and takes its transport preference as an
-explicit policy input; `derive_fleet_admission` consumes only a `ValidatedIntakeReceiptLedger`
-(one genesis, linked, one subject and attempt, monotone); the in-substrate receipt hash is named
-a structural fingerprint, with SHA-256 reserved for the durable producer; and
-`gunbc.bmc_onboarding` is quarantined as non-authoritative legacy vocabulary. Executed
-Mt. Collins and ASRock boots reaching the nonce-bound intake-agent callback are BOOT-DELIVERY-0's
-acceptance and are still owed; INTAKE-AGENT-0, MEMORY-0 and SOAK-ADMISSION-0 are unbuilt.
-
-## 0. The ruling, in one paragraph
-
-The correct system is one hardware-independent qualification transaction with multiple
-platform-specific access and boot-delivery realizations. "Virtual CD" is not a phase. Redfish,
-OEM NBD/WebSocket, OpenBMC configfs USB gadget, UEFI HTTP, and PXE are alternative constructors
-for one obligation: *deliver this content-addressed boot artifact to this identified host for one
-boot, prove that the intended artifact executed, and restore the prior boot-control state.*
-(`gunbc.boot_artifact_delivery`.)
-
-Four corrections to the original brief:
-
-1. Board serial is the durable unit key but is not enough to key a qualification. A repaired
-   machine keeps its board serial while every DIMM changes. Qualification is keyed to the board
-   serial plus an assembly-manifest digest (`gunbc.machine_intake_subject`).
-2. Hardware qualification, OS provisioning, and placement commissioning are separate
-   transactions. They share boot delivery and receipts; success in one must not fabricate success
-   in another (`gunbc.machine_intake_phase`).
-3. NFS traffic, a redirection session, boot-rail activity, KVM pixels, and a consumed boot
-   override prove activity, not test success. A memory verdict needs a machine-readable report or
-   an intake-agent receipt (`attest_diagnostic_boot`).
-4. BMC-reported watts are not automatically wall watts, and EDAC reports are not automatically
-   DIMM-attributed. Both need explicit provenance types (SOAK-ADMISSION-0, MEMORY-0).
-
-Operationally: run all return-window-sensitive hardware testing immediately on arrival, before
-shelving; run a second placement-specific commissioning soak after installation in its actual
-power, cooling, and network environment; nothing serves until both have succeeded. srv2 is the
-current candidate realization of an abstract staging service, not its identity
-(`gunbc.machine_intake_staging`).
-
-## 1. The subject being qualified
-
-```
-QualificationSubject = UnitKey × AssemblyManifestDigest × FirmwareManifestDigest
-UnitKey              = validated unique baseboard serial
-AssemblyManifest     = chassis identity × CPU × DIMM × accelerator × storage × NIC × PSU identities
-FirmwareManifest     = BMC implementation/version × BIOS/UEFI × CPLD/SCP/platform firmware × configuration digests
-MachineIntakeSubject = QualificationSubject × IntakeAttemptId
-```
-
-| Event | Consequence |
-|---|---|
-| BMC IP changes | Same unit; no identity change |
-| Machine moves racks | Same unit and assembly; placement receipt becomes stale |
-| One DIMM changes | New assembly subject; previous admission cannot apply |
-| BIOS/BMC firmware changes | New firmware subject; affected qualification must be repeated |
-| Motherboard changes | New unit key |
-| Board serial absent, duplicated, or contradictory | Identity refuses; no fleet key is fabricated |
-
-The chassis part number is a first-class identity fact (platform-variant discriminator), not the
-unit key. A physical DIMM label is bound to its SPD identity (`PhysicalDimmLabelBinding`); an
-absent or duplicated SPD serial is preserved as a limitation, never papered over by the label.
-
-## 2. Platform facts vs live access observations
-
-`extdeps.bmc.access_profile`: `BmcAccessProfile` is platform/catalog data keyed by baseboard ×
-`ChassisApplicability` (an explicit arm, never absence-means-all) × implementation × exact raw
-firmware release (`BmcFirmwareReleaseIdentity`), carrying its routes as inhabitants
-(`BmcAccessRoute`: Redfish locators, IPMI lanplus, the MegaRAC REST route with its typed
-`image_redirection` fact, the OpenBMC shell, the OpenBMC NBD WebSocket path) so a no-Redfish
-build is representable without inventing locators, plus the capability row that release carries
-(a catalog row whose row firmware disagrees with its key is refused at lookup). Provenance is
-`ProfileFromExternalAuthority | ProfilePromotedFromObservation`, never the rendering declaration.
-`BmcAccessObservation` is per endpoint with its raw response digest and a resource-bound
-`RedfishVirtualMediaProbeReceipt?`; the lookup answers `Known | Uncatalogued | Ambiguous |
-CatalogRowRefused` (external facts only). The controller is named protocol-neutrally
-(`BmcControllerEndpoint { host }`, ruling 4 §3): one Mt. Collins boot drives one controller over
-MegaRAC REST for delivery and IPMI for boot control, so an identity carrying a protocol has
-already selected a route. The capability row a profile carries is the exact-release
-`BmcFirmwareReleaseCapabilityRow` (ruling 4 §2), so a release with no semantic reading can be
-catalogued. Which attempt the observation belongs to, whether the lookup ran, whether the
-evidence manifest names every blob read, and whether a promoted profile's receipts were
-verified are WORKFLOW standings: `gunbc.machine_intake_access.bind_bmc_access_context` produces
-the one `BoundBmcAccessContext` the solver may read, and `ProfilePromotionVerificationStanding`
-refuses every promoted profile until the INTAKE-AGENT-0A evidence store produces
-`ProfilePromotionVerified` (ruling 4 §4).
-
-`BmcFirmwareFamily` gained `AmiMegaRac` (`extdeps.bmc.endpoint`, gunbc#9678); the implementation
-module is `extdeps.bmc.megarac` and the vendor row `extdeps.vendor.ami`. The family-keyed
-dispatchers moved out of `extdeps.bmc.openbmc` into `gunbc.bmc_implementation_dispatch` so a
-MegaRAC change never edits the OpenBMC module (DESIGN §3 external upstream decomposition).
-Family-grain MegaRAC facts are cited (admin/admin published default, IPMI-only protocol floor);
-build-scoped facts live on the build binding `extdeps.ampere.mt_collins_product_brief.bmc` —
-the observed Foxconn Mt. Collins build (BMC 0.32) serves NO Redfish and boots through the
-proprietary REST remote-media surface, so the Mt. Collins delivery arm is
-`MegaRacRestRemoteMedia`, not the DMTF pull. A profile/capability row per exact firmware is
-still to be authored from that observation.
-
-## 3. The boot boundary
-
-Boot control (set one-shot target × reset × observe override consumption × restore) and artifact
-delivery (visible to firmware × bytes proven × intended host consumed it × detach) are
-independent obligations. `BootArtifactDelivery` is the coproduct
-`RedfishVirtualMediaPull | MegaRacRestRemoteMedia | OpenBmcNbdProxyWebsocket |
-OpenBmcConfigfsUsbGadget | UefiHttpBoot | PxeChainBoot`; `extdeps.bmc.virtual_media` gained the
-`RedfishVirtualMediaTransport` and `MegaRacRemoteMediaTransport` arms and
-`extdeps.bmc.redfish_virtual_media` models the DMTF shape. Boot purpose is data
-(`BootPurpose`); the artifact set is per architecture (`IntakeArtifactSet`), never a bi-arch
-invariant.
-
-Platform mapping:
-
-| Platform observation | Candidate delivery |
-|---|---|
-| MegaRAC build with live-observed Redfish VirtualMedia | RedfishVirtualMediaPull |
-| Mt. Collins MegaRAC (observed build 0.32: no Redfish) with live-observed REST remote media | MegaRacRestRemoteMedia |
-| ASRock/OpenBMC with live-observed OEM NBD WebSocket | OpenBmcNbdProxyWebsocket |
-| ASRock/OpenBMC with BMC SSH, NBD client, configfs gadget, usable UDC | OpenBmcConfigfsUsbGadget |
-| Firmware with observed UEFI HTTP support and reachable artifact service | UefiHttpBoot |
-| Firmware with all network-boot requirements established | PxeChainBoot |
-
-`gunbc.os_install_mechanism` is a compatibility projection of the delivery solver with no solver
-of its own; its consumers migrate to `BootDeliverySolution` and it is then deleted (its frozen note
-carries the trigger). A `BootDeliveryPlanned` result is a candidate PLAN bound to target and
-artifact — insert, host consumption, eject and detach are established only by execution receipts.
-The boot-control target is protocol-neutral (`BootControlTarget`); which BMC operation sets it is
-realization bound to the route the profile exposes. The request's `BootDeliveryTarget` is bound
-to the access context first (`BoundBootDeliveryTargetContext`, ruling 4 §1) and the transport-local
-standings each carry their own target, so a plan can never name a subject or controller other
-than the one its evidence was gathered for; the plan's `BootDeliveryEligibilityProvenance` names
-the profile provenance, the evidence manifest, the selected candidate's own evidence
-(`SelectedCandidateEvidence`) and every candidate's standing.
-
-## 4. The workflow: one `MachineIntake`, three transactions
-
-**A — arrival hardware qualification** (immediately after delivery or repair, before shelving):
-
-| Phase | Required result |
-|---|---|
-| AccessDiscover | BMC implementation, exact firmware, supported protocol surfaces, BMC clock observed |
-| IdentityBindProvisional | Board/chassis/BMC identities collected without contradiction |
-| PriorLifeBoundary | Existing logs archived, then cleared or a precise immutable baseline cursor established |
-| BmcSecure | Unique managed credential works; published factory credential no longer works |
-| BootDeliveryEstablish | One eligible delivery transport selected from live observations |
-| DiagnosticBootAttest | Intended intake artifact calls back with the attempt nonce and repeats machine identity |
-| InventoryConform | BMC, SMBIOS/OS, and platform slot-table observations reconcile |
-| MemoryFastQualify | Parseable pre-OS memory-test result |
-| MemoryAuthoritativeQualify | Linux stress plus ECC/RAS before-and-after delta |
-| SubsystemQualify | CPU, storage, network, accelerator, PSU, cooling obligations for the expected component set |
-| AcceptanceSoak | Return-window heat/load test succeeds |
-| ArrivalCleanup | Media detached, override cleared, temporary access revoked, desired power state restored |
-
-A machine that completes this is HardwareQualified. It still cannot serve.
-
-**B — provisioning:** OsArtifactDelivered → OsInstalled → InstalledSystemBootedFromLocalTarget
-→ RuntimeIdentityMatchesIntakeSubject. OsInstalled needs a post-install producer (the installed
-agent calling back after a normal local boot); a consumed override, a read ISO, or a DHCP lease
-is not sufficient.
-
-**C — placement commissioning** (in the serving location): PlacementIdentityBound →
-ActualCoolingAndFanPolicyObserved → ActualNetworkPathsQualified → PlacementLoadSoakQualified →
-WallPowerMeasured → ServiceRuntimeAdmitted → FleetAdmitted. Moving the machine, changing its PSU
-feed, cooling, or fan policy invalidates this receipt without invalidating memory qualification.
-
-`gunbc.bmc_onboarding` combines factory credentials, rotation, OsInstalled and FabricJoined in
-one vocabulary; extracting those into the three transactions is a follow-up, not a second
-lifecycle.
-
-## 5. Identity and prior-life handling
-
-Identity is provisional until the Linux intake environment repeats collection from the host
-side and BMC identity agrees with host-visible SMBIOS/SPD/PCI identity agrees with platform
-expectations. Disagreement is a named finding: BoardSerialDisagrees, ChassisPartNumberDisagrees,
-BmcAndHostMemoryPopulationDisagree, DuplicateDimmSerial, ExpectedComponentAbsent,
-UnexpectedComponentPresent (InventoryConform, unbuilt).
-
-Prior-life boundary: before clearing anything, preserve BMC clock, SEL/event logs, Redfish log
-collections, audit/account events, current boot override, virtual-media state, power state, and
-a sensor snapshot as an immutable content-addressed capture. Then
-`PriorLifeBoundaryEstablished = LogsArchivedAndCleared | LogsArchivedWithBaselineCursor`; the
-second arm only where platform policy explicitly admits an uncleared append-only boundary. The
-receipt carries the pre-clear archive digest and the post-clear observation.
-
-## 6. Credential qualification
-
-Factory credentials are a bootstrap mechanism, not an ordinary credential state. BmcSecure:
-probe published bootstrap credential → authenticated session → create/rotate unique per-unit
-credential → verify new works → verify published fails → record secret reference and credential
-epoch. The receipt never contains the password. A non-working factory credential is an access
-state (CredentialStateUnknown, PreviouslyRotatedCredentialRequired,
-AccountManagementUnavailable) → PartsHold, not ReturnWindow, absent other evidence.
-
-`gunbc.machine_intake_bmc_secure` is the authority for that standing: `derive_bmc_secure` folds
-one `BmcCredentialRotationObservation` — the bootstrap reading, the rotation application, and the
-two post-rotation readbacks — into a `BmcSecureStanding`, and `bmc_secure_phase_receipt` projects
-that onto the receipt spine so `derive_fleet_admission` reads it like any other phase. The
-standing is `sole_constructor` and carries the `MachineIntakeSubject` it was adjudicated for, and
-the receipt reads its subject off the standing rather than taking one: a standing derived for one
-attempt has no argument left to swap, so it cannot be re-addressed as another attempt's evidence.
-Both post-rotation readbacks must be ordered after the rotation they claim to verify — an ordering
-among the supplied readings, which establishes nothing about whether a BMC was probed — and a
-readback that did not establish a credential state refuses rather than widening into the good arm.
-No refusal cause is owned by `UnitHardware`. The module observes nothing; the effectful rotation
-actuator that produces the observation is the declared frontier, and it is the same producer the
-ruling gates on the `gunbc.bmc_onboarding` split. Evidence:
-`test.claim.machine_intake_bmc_secure_witness_test`.
-
-## 7. Proving the diagnostic environment booted
-
-Each attempt mints a nonce; the intake agent returns `IntakeAgentBootReceipt { attempt_nonce,
-artifact_digest, architecture, board_serial, assembly_observation, firmware_observation,
-booted_at }`. That receipt, and nothing else, is what a future attestation would rest on —
-but nothing constructs DiagnosticBootAttested today, and
-`gunbc.machine_intake_receipt.attest_diagnostic_boot` does not: a matching singleton returns
-DiagnosticBootCompletenessUnestablished, because an observed population is not a closed one.
-The positive arm waits on an acquisition producer that CLOSES the callback population — bound
-issuance, single ingress, close-before-snapshot, gap-free transcript, evidence from that same
-acquisition. The module is the authority for which arms exist. NFS plateaus, redirection sessions,
-power signatures, reset completion, SOL streams and KVM pixels are supporting observations that
-ride in the refusal. KVM is optional forensic capture.
-
-## 8. Memory qualification (MEMORY-0, unbuilt)
-
-Fast gate: `FastMemoryQualified { artifact, report_digest, pass_count, tested_bytes, error_count }
-| FastMemoryRefused`; a delivery session plus power activity without a report is
-`MemoryExerciseObserved`. Authoritative gate: before snapshot, test plan, after snapshot
-(SMBIOS/DMI, SPD, Redfish Memory, EDAC topology, EDAC CE/UE before/after, rasdaemon, MCE/APEI/
-GHES, stressapptest, stress-ng); deltas during the interval, not lifetime counters; thresholds in
-policy rows (new UE → defect; new CE → refuses, swap diagnosis; zero → gate may hold).
-Attribution is a separate standing: `DimmAttributed | RankAttributed | ChannelAttributed |
-ControllerAttributed | Unattributed` — a channel-level error fails the gate but cannot construct
-DimmDefective. Swap-pass diagnosis binds every stick label to SPD first; every physical swap
-changes the assembly digest and starts a new subject.
-
-## 9. Beyond memtest (SOAK-ADMISSION-0, unbuilt)
-
-`ExpectedSubsystemSet` derives from platform and assembly inventory; an expected component cannot
-silently disappear from testing, and a platform with no accelerator derives no accelerator
-obligation rather than a Skipped row. Per-subject observations: CPU topology/load/throttling/RAS
-deltas; memory population/stress/CE-UE/temperature; storage identity/SMART/self-test (destructive
-only on declared-disposable storage); NIC MAC/link/errors/throughput to staging; accelerator
-PCIe/device memory/compute/ECC-Xid-AER/thermal; fans tach presence and response; PSU inventory,
-telemetry, external wall measurement where required; BMC sensor completeness, clock, log service,
-account state.
-
-## 10. Load soak and power (SOAK-ADMISSION-0, unbuilt)
-
-Two policy rows: ArrivalAcceptanceSoak (return-window defects) and PlacementCommissioningSoak
-(environment-specific). Both record load recipe digest, duration, ambient, sample interval,
-temperature maxima, fan extrema, throttling, RAS deltas, power samples, cooldown.
-`PowerMeasurementPoint = WallAcInput | PsuAcInput | PsuDcOutput | BoardRail | BmcUnspecified`.
-Only a WallAcInput observation (or a justified calibrated conversion from a precisely identified
-point) may retire the economics model's 350 W wall-power assumption; without one, emit
-WallPowerUnestablished. `PowerTelemetryAgreement { wall_ac, bmc_reported, difference }`.
-
-## 11. Disposition
-
-`MachineIntakeDisposition = Admitted | ReturnWindow | PartsHold` with
-`QualificationRefusalOwner = UnitHardware | BmcAccess | StagingInfrastructure | PlatformModel |
-QualificationPolicy | OperatorAction`. Mapping (`gunbc.machine_intake_disposition`): observed
-hardware defect ∧ window open → ReturnWindow; defect ∧ window closed → PartsHold{RepairOrCull};
-qualification unestablished → PartsHold{cause, owner}; placement pending →
-PartsHold{PlacementPending}; all gates ∧ subject current ∧ cleanup confirmed → Admitted.
-`FleetAdmissible` is derived from receipts; a hand-authored Admitted row cannot substitute.
-
-## 12. Receipt architecture
-
-Every phase emits one normalized envelope (`IntakeReceiptEnvelope`) plus evidence refs by
-digest. Wire schema `gunbc.machine-intake.receipt/v1`; raw archive
-`/srv/bmc/intake/artifacts/<sha256>/`, `attempts/<id>/manifest.json`, `phase/*.json`,
-`evidence/<blobs>`. The JSON is an observation transport, not a second decision authority.
-Required properties: canonical digest; attempt identity and exact subject; tool/agent/artifact/
-policy identities; start/end; evidence by digest; success or typed refusal; hash-chain link;
-staging identity; no credentials or one-time tokens.
-
-## 13. The `intake <bmc-ip>` executable (unbuilt)
-
-One operator command: acquire endpoint lock → discover access surface → bind provisional identity
-→ acquire unit/attempt lock → ask the modeled solver for the next phase plan → execute through the
-selected adapter (redfish-standard, ipmi-fru, ami-megarac, openbmc-nbdproxy, openbmc-configfs,
-uefi-http, pxe) → append receipt → resume until terminal disposition. Phase order and disposition
-live in `.dag`, not in `if chassis == ...` branches. Needs idempotent resume, per-endpoint then
-per-unit locks, one-shot callback tokens, content-addressed artifacts, cleanup/compensation after
-every failed delivery, no secrets in logs, a dry plan mode, a typed terminal receipt on staging
-failure. It emits observations; it does not author `.dag` rows. Dissolution: delete it when the
-modeled fleet-ops executor consumes the same plan, performs every effect, and produces
-byte/schema-equivalent receipt envelopes for both the Mt. Collins and ASRock transport fixtures.
-
-## 14. Integration map
-
-| Existing authority | Change |
-|---|---|
-| `extdeps.bmc.endpoint` | `AmiMegaRac` arm (landed via gunbc#9678 and this PR) |
-| `extdeps.bmc.megarac`, `extdeps.vendor.ami` | implementation module (gunbc#9678: cited admin/admin default, IPMI floor, proprietary REST remote-media operations, executed Mt. Collins boot recipe) and vendor row |
-| `extdeps.bmc.access_profile` | profile/observation carriers and intersection (landed) |
-| `extdeps.bmc.redfish_virtual_media`, `extdeps.bmc.virtual_media` | DMTF shape; `RedfishVirtualMediaTransport` arm (landed) |
-| `gunbc.boot_artifact_delivery` | the one delivery solver: request × bound evidence × policy → plan (landed, ruling 3 §1-§2) |
-| `gunbc.machine_intake_access` | attempt-bound access context producer; `BootDeliveryTarget`, evidence manifest, promotion verification standing (landed, ruling 3 §1, ruling 4 §1/§4/§5) |
-| `extdeps.bmc.endpoint`, `extdeps.bmc.capability` | `BmcControllerEndpoint`; `BmcFirmwareReleaseCapabilityRow` (landed, ruling 4 §2-§3) |
-| `gunbc.install_transport_qualification` | `TargetBoundReinstallPath` — the host transport standing joined to an intake target (landed, ruling 4 §1) |
-| CI changed-witness execution sublane | dispatched as its own PR (child work item; ruling 4 "#9717 is not an unrelated CI incident") |
-| `gunbc.bmc_firmware_transition`, `gunbc.network_boot_delivery` | standings cut out of the solver into their own authorities (landed, ruling 3 namespace ruling) |
-| `gunbc.os_install_mechanism` | compatibility projection; capability-only solver and `FirmwareUpdateThenVirtualMedia` deleted (landed, ruling 3 §3) |
-| `gunbc.os_install`, `gunbc.generated_artifact` | `fleet_install_server_specs`, `InstallServerSpec`, `gunbc.install_server_emit` and the `ProxyDhcpDnsmasqArtifact` path deleted (ruling 3 §3) |
-| `gunbc.bmc_implementation_dispatch` | family dispatch moved out of `extdeps.bmc.openbmc` (landed) |
-| `gunbc.machine_intake_*` | subject, phase, receipt, disposition, staging (landed) |
-| `gunbc.bmc_onboarding` | extract BMC access/security, provisioning, fabric joining (follow-up) |
-| `gunbc.nbd_proxy_virtual_media_install` | realize `ActuatorRedfishInsertMedia` through the Redfish arm (follow-up) |
-| `extdeps.bmc.capability` | inventory, log, telemetry, cleanup capabilities (follow-up) |
-| private `strategy.*` | per-unit normalized receipts and return-window facts (follow-up) |
-
-srv1 vs srv2 as staging host is resolved by observation (`intake_staging_realization_today`
-is `StagingUnobserved`), not by prose.
-
-## 15. Implementation sequence
-
-- **INTAKE-0 (modeling in review; ruling 3 gate 5 — lifecycle-valid ledger, admission
-  provenance — in this PR):** subject, manifests, attempt, phase standing, refusal owner,
-  disposition, fleet-admission derivation, receipt envelope; controls in
-  `test.claim.machine_intake_subject_witness_test` and
-  `test.claim.machine_intake_disposition_witness_test`.
-- **BOOT-DELIVERY-0 (modeling landed; execution owed):** MegaRAC identity, Redfish VirtualMedia
-  transport, solver consuming configfs/WebSocket, UEFI HTTP split from PXE; controls in
-  `test.claim.boot_artifact_delivery_witness_test`. Acceptance: one executed Mt. Collins boot and
-  one executed ASRock boot reaching the same nonce-bound intake-agent callback.
-- **INTAKE-AGENT-0A (next, per ruling 3):** deterministic x86-64 and AArch64 artifacts with
-  recorded content identities; a callback carrying attempt nonce, exact artifact digest,
-  architecture, raw board serial, assembly/firmware observation digests and boot time; replay and
-  duplicate-callback refusal; wrong-nonce/artifact/unit/architecture REDs; canonical durable receipt
-  bytes and their SHA identity; raw EDAC/RAS, inventory and sensor capture only; local execution of
-  the callback contract without a BMC. Then ACCESS-OBSERVE-0 / BOOT-DELIVERY-0E on hardware:
-  observation → profile lookup → plan → execute → agent callback → cleanup, on Mt. Collins and ASRock.
-- **MEMORY-0:** fast report ingestion, authoritative plan, EDAC/Redfish deltas, attribution,
-  label/SPD binding, swap-pass diagnosis.
-- **SOAK-ADMISSION-0:** subsystem recipes, thermal/fan policy, wall-power producer, two soak
-  profiles, final fleet-admission consumer.
-
-The smallest useful MVP reaches the Linux agent, inventory conformance, and authoritative memory
-evidence; automating media attachment while the verdict stays manual is not it.
-
-## 16. Discriminating controls
-
-| Perturbation | Required result | Where |
-|---|---|---|
-| Change one DIMM while retaining the board serial | Old admission no longer applies | subject + disposition witnesses |
-| Leave factory credential working after rotation | BmcSecure refuses | bmc secure witness |
-| Remove Redfish VirtualMedia from live observation, keep it in the profile | Redfish transport not selected | boot delivery witness |
-| Stage a URI serving digest B for a request naming digest A | `CandidateStagedArtifactMismatch`, no plan | boot delivery witness |
-| Hand the solve an observation receipt from another attempt | `AccessContextObservationForOtherAttempt`, no plan | boot delivery witness |
-| Receipt manifest omits the observation's raw response | `AccessContextObservationEvidenceMismatch` | boot delivery witness |
-| Receipt manifest names the discovery bytes but not the nested probe's | `AccessContextProbeEvidenceMismatch` | boot delivery witness |
-| Request target for attempt two, context bound for attempt one (same controller) | `DeliveryTargetSubjectMismatch`, no plan | boot delivery witness |
-| Request target for controller .61, context bound for .60 (same subject) | `DeliveryTargetControllerMismatch`, no plan | boot delivery witness |
-| Configfs path / network boot established for another target | `CandidateEvidenceForOtherTarget` | boot delivery witness |
-| Profile promoted from an observation, receipts unresolvable | `AccessContextPromotedProfileUnverified`, no plan | boot delivery witness |
-| Raw release "0.32" with an exact-release OEM row and matching observation | context binds, MegaRAC plan (positive) | boot delivery witness |
-| Probe arm below the floor while the population lists HTTPS | `CandidateRedfishProbeContradictory`, never resolved by preferring one side | boot delivery witness |
-| Live observation lacks `SurfaceBootControl` while catalog names override and media is live | `DeliveryBootControlSurfaceUnestablished`, no plan | boot delivery witness |
-| Profile names Redfish and IPMI; boot control observed over IPMI only | plan carries IPMI, never Redfish | boot delivery witness |
-| No route-specific boot-control observation / both routes observed | `DeliveryBootControlRouteUnobserved` / `DeliveryBootControlRouteAmbiguous`, no plan | boot delivery witness |
-| Boot control observed over MegaRAC REST (named by the profile, no control operation) | `DeliveryBootControlRouteNotControlCapable` | boot delivery witness |
-| Control-route observation bytes absent from the manifest | `AccessContextControlRouteEvidenceMismatch` | boot delivery witness |
-| Empty configfs observation population | `CandidateConfigfsUnestablished` with all eight probes missing — no authored establishment | boot delivery witness |
-| Every current phase in the three rosters | exactly one rank, all distinct (positive) | disposition witness |
-| Catalog row whose capability firmware differs from its key | lookup refuses the catalog | boot delivery witness |
-| Probe admitted NFS only, staging offers HTTPS | `CandidateRedfishProtocolNotAdmitted` | boot delivery witness |
-| MegaRAC route with `image_redirection` Unset | `CandidateOemParameterUnset`, no plan | boot delivery witness |
-| Remove virtual media and provide no network-boot evidence | No implicit PXE | boot delivery witness |
-| Preserve NFS/media activity, remove the report/callback | Boot verdict refuses | disposition witness |
-| Make EDAC unavailable | Memory standing unestablished, not zero-error | MEMORY-0 |
-| Channel-attributed error only | Gate fails; no DIMM convicted | MEMORY-0 |
-| BMC watts without wall meter | Wall power unestablished | SOAK-ADMISSION-0 |
-| Fail the staging artifact service | PartsHold{StagingInfrastructure}, never ReturnWindow | disposition witness |
-| Leave media attached or override active | Cleanup refuses; admission impossible | ArrivalCleanup (unbuilt) |
-| Re-run from a stale attempt after a repair | Receipt subject mismatch refuses | disposition witness |
-| Manually write Admitted without receipts | Derivation refuses | disposition witness |
diff --git a/docs/plans/machine-intake-ruling-3.md b/docs/plans/machine-intake-ruling-3.md
deleted file mode 100644
index 577e67a7dd2..00000000000
--- a/docs/plans/machine-intake-ruling-3.md
+++ /dev/null
@@ -1,421 +0,0 @@
-# Machine-intake ruling 3 — review of #9690 @ d4b1e6a104 (2026-08-30)
-
-Transcribed verbatim from the design side-chat (turn c6f87ffa). Citations stripped.
-
-# Review verdict
-
-**REQUEST CHANGES / HOLD at `d4b1e6a104ce8bf78e147642742c259e98994a59`.** The major repairs are real, but ruling 2 is not fully discharged. I would not yet record either **INTAKE-0 complete** or **BOOT-DELIVERY-0 modeling complete**.
-
-The following parts now satisfy the ruling:
-
-- `MtCollinsBmcImplementationExpected` no longer presents the family as an Ampere-authored platform fact.
-- The solver returns `BootDeliveryPlanned`, not an execution establishment.
-- `derive_fleet_admission` accepts only `ValidatedIntakeReceiptLedger`.
-- `intake_staging_realization_today` remains `StagingUnobserved`.
-- The `bmc_onboarding` split may remain a follow-up. fileciteturn35file0L2-L2 fileciteturn31file0L2-L2 fileciteturn46file0L2-L2 fileciteturn50file0L2-L2
-
-Four ruling-level blockers remain.
-
-## 1. The new solver is not bound to **this artifact on this host**
-
-`BootArtifact` correctly names purpose, architecture, digest, format, entrypoint, and build identity. But `BootDeliveryEvidence` contains no `BootArtifact`, target unit, target host identity, or intake attempt, and `BootDeliveryPlanned` contains only a transport plus the considered verdicts. The selected Redfish URI, MegaRAC image name, NBD export, or network-boot evidence is therefore not proven to represent the `BootArtifact` defined earlier in the same module. The plan also drops the endpoint from which eligibility was derived. fileciteturn51file0L2-L2 fileciteturn31file0L2-L2 fileciteturn52file0L2-L2
-
-This admits a straightforward false plan:
-
-```text
-requested artifact digest = A
-Redfish image URI actually serves digest = B
-profile + probe + params are otherwise eligible
-result = BootDeliveryPlanned
-```
-
-Nothing in the solver compares A and B because A is not an input.
-
-The solver needs a request and a result closer to:
-
-```dag
-type BootDeliveryRequest {
-  target: BootDeliveryTarget
-  artifact: BootArtifact
-  access: BoundBmcAccessContext
-  staging: BootArtifactStagingBinding
-}
-
-type BootDeliveryPlan {
-  target: BootDeliveryTarget
-  artifact: BootArtifact
-  delivery: BootArtifactDelivery
-  boot_control: BootControlPlan
-  eligibility_provenance: BootDeliveryEligibilityProvenance
-}
-```
-
-Every transport-specific staging binding must name or derive the exact artifact digest. The eventual callback then repeats the digest from the same plan.
-
-### The access evidence can also be spliced across identities
-
-`BootDeliveryEvidence` independently accepts:
-
-```text
-BmcFirmwareCapabilityRow
-BmcAccessProfileStanding
-BmcAccessObservationStanding
-```
-
-The capability test reads `ev.row`; surface eligibility reads only the profile and observation. There is no check that:
-
-```text
-row.firmware
-= profile.key.firmware
-= observation.identity.firmware
-= observation.firmware
-```
-
-A capability row for firmware A can therefore contribute `CapabilityVirtualMedia` while a profile and observation for firmware B establish the surface. `BmcFirmwareCapabilityRow` itself carries only firmware and a capability list—not board identity or source provenance. fileciteturn31file0L2-L2 fileciteturn47file0L2-L2
-
-`BmcAccessObservation` also carries the firmware twice—inside `identity.firmware` and again as `firmware`—with no constructor proving they agree. It is described as per-attempt, but carries neither an attempt ID nor a qualification subject, and it contains no raw-response evidence digest. An observation from a previous attempt can therefore be handed to the current solve as long as its interpreted identity still fits. fileciteturn30file0L2-L2
-
-Required shape:
-
-```dag
-type BoundBmcAccessContext {
-  subject: MachineIntakeSubject
-  endpoint: BmcEndpoint
-  identity: BmcObservedIdentity
-  capability_row: BmcFirmwareCapabilityRow
-  profile: BmcAccessProfile
-  profile_provenance: BmcAccessProfileProvenance
-  observation_receipt: EvidenceRef
-}
-```
-
-Its producer must prove all identity joins before the delivery solver can run. Better still, place the exact capability row inside `BmcAccessProfileCatalogRow`, with a constructor proving that its firmware equals the profile key. Then remove the independently supplied `row` from `BootDeliveryEvidence`.
-
-Add RED controls for:
-
-- capability-row firmware different from the profile;
-- `observation.firmware != observation.identity.firmware`, if the duplicate field remains;
-- a live observation from another attempt;
-- a profile whose declaration exists but whose underlying observation receipt is absent.
-
-### The real Mt. Collins firmware cannot currently inhabit the key
-
-The retained historical report calls the Mt. Collins firmware `0.32`, while `bmc_firmware_version_from_wire` accepts exactly three numeric components and every profile/observation key requires `BmcFirmwareVersion`. A live wire value of `0.32` therefore either refuses or must be fabricated as `0.32.0`. fileciteturn35file0L2-L2 fileciteturn47file0L2-L2 fileciteturn30file0L2-L2
-
-Preserve an opaque exact vendor release identity:
-
-```dag
-type BmcFirmwareReleaseIdentity {
-  family: BmcFirmwareFamily
-  raw_version: NonEmptyStr
-  semantic_version: FirmwareSemanticVersion?
-}
-```
-
-Exact profile lookup should use the raw vendor identity. Semantic parsing is an optional derived view, never a prerequisite for observing the firmware.
-
-## 2. A planned transport can disagree with the route that was observed
-
-### Redfish protocol and resource are unbound
-
-`TransferProtocolAdmitted` carries the admitted protocol, but `redfish_virtual_media_candidate` discards that payload and merely checks that separate `RedfishVirtualMediaParams` are present. Those params independently carry a media locator and protocol. Thus:
-
-```text
-probe admitted NFS
-params request HTTPS
-```
-
-still produces `BootDeliveryPlanned`. The same is true of the media member: the probe carries no locator, while the params may name any member. `InsertSucceeded` and `EjectSucceededAndDetached` are also accepted as plan-floor evidence even though those arms have lost both locator and protocol. fileciteturn32file0L2-L2 fileciteturn31file0L2-L2 fileciteturn44file0L2-L2
-
-The probe must be resource-bound:
-
-```dag
-type RedfishVirtualMediaProbeReceipt {
-  locator: RedfishVirtualMediaLocator
-  progress: RedfishVirtualMediaProbe
-  admitted_protocols: List<RedfishVirtualMediaTransferProtocol>
-  raw_response: EvidenceRef
-}
-```
-
-The solver should derive the locator and protocol from that receipt. It should accept only the artifact URI from staging, rather than accepting complete final params that can contradict the observation.
-
-### The MegaRAC constructor omits the parameter its own authority calls required
-
-`extdeps.bmc.megarac` says the start-media request **must** carry `image_redirection: 1`. The design document likewise says that OEM quirk belongs in the access profile. Yet `MegaRacRemoteMediaParams` has no such field, the solver never examines `profile.oem_parameters`, and the positive Mt. Collins control uses `oem_parameters: []` while still selecting `MegaRacRestRemoteMedia`. fileciteturn36file0L2-L2 fileciteturn37file0L2-L2 fileciteturn44file0L2-L2 fileciteturn34file0L2-L2
-
-That is a direct false-green against the observed operation contract. Encode the requirement structurally, preferably as a typed field rather than a generic name/value pair:
-
-```dag
-type MegaRacRemoteMediaBinding {
-  ...
-  image_redirection: MegaRacImageRedirectionEnabled
-}
-```
-
-The positive test must fail when that binding is absent.
-
-### The access-profile shape cannot honestly represent the no-Redfish platform
-
-Every `BmcAccessProfile` is required to provide three nonempty Redfish locators, even for the Mt. Collins build whose retained report says Redfish is absent. The synthetic control therefore invents `/redfish/...` locators for an OEM-only profile. Meanwhile `BmcEndpoint.protocol` has only `Redfish | Ipmi`, and the no-Redfish MegaRAC OEM-REST fixture is labeled `protocol: Redfish`. fileciteturn30file0L2-L2 fileciteturn33file0L2-L2 fileciteturn34file0L2-L2
-
-Replace mandatory Redfish fields with route inhabitants:
-
-```dag
-type BmcAccessRoute
-  = RedfishRoute { ... }
-  | IpmiLanplusRoute { ... }
-  | MegaRacRestRoute { ... }
-  | OpenBmcShellRoute { ... }
-  | OpenBmcNbdWebsocketRoute { ... }
-```
-
-The BMC host identity should be separate from the routes it exposes; one controller may expose IPMI and OEM REST simultaneously. The boot-control target should also be protocol-neutral. Presently every delivery, including the IPMI-controlled no-Redfish MegaRAC path, projects to `RedfishBootSourceOverrideTarget`. fileciteturn31file0L2-L2
-
-Also replace `chassis_part_number: None means match every chassis` with an explicit applicability:
-
-```dag
-type ChassisApplicability
-  = ExactChassisPartNumber { part_number: NonEmptyStr }
-  | AllChassisVariants
-```
-
-Absence must not silently mean universality.
-
-## 3. There are still two delivery solvers
-
-The frozen projection is not the offending path. The offending path is the still-live original solver:
-
-```dag
-fn solve_install_mechanism(...)
-```
-
-It selects virtual media from a capability row alone and defaults to PXE in its final `else`. `srv3_install_mechanism` still calls it, and `gunbc.os_install.fleet_install_server_specs` still consumes that result. The generated-artifact registry then consumes the install-server roster for `ProxyDhcpDnsmasqArtifact`. This remains an independent live modeled answer beside `solve_boot_artifact_delivery`. fileciteturn28file0L2-L2 fileciteturn29file0L2-L2 fileciteturn23file0L2-L2 fileciteturn25file0L2-L2
-
-That chain must be deleted or migrated now:
-
-```text
-solve_install_mechanism
-srv3_install_mechanism
-fleet_install_server_specs_for
-fleet_install_server_specs
-the stale ProxyDHCP artifact path, if its consumer census remains empty
-```
-
-Do not retain a second solver merely because the generated registry cannot express a refusal. Given that the proxy-DHCP artifact is currently `NotCommitted`, deleting the dead consumer is preferable to growing an additional standing solely to preserve it. fileciteturn25file0L2-L2
-
-There is a second bypass inside the purported projection: `firmware_transition_precursor` returns `FirmwareUpdateThenVirtualMedia` when a transition is established and **some** catalog row supports VM. It ignores the exact `to` version and performs no post-transition profile lookup or live observation. A transition to an unrelated, non-VM release can therefore select the combined mechanism. fileciteturn29file0L2-L2
-
-A firmware transition is not a delivery. The result should be:
-
-```text
-FirmwareTransitionRequired / FirmwareTransitionPlanned
-```
-
-After executing it, the workflow must re-observe the endpoint and call the one delivery solver again. It may not preselect “then virtual media.”
-
-### Ruling on `AccessProfileNotLookedUp`
-
-**The refusing projection is honest and should not be deleted blindly.** `srv3_os_install_actuate_scope` and `gunbc.nbd_proxy_virtual_media_install` still consume its refusal-bearing solution and currently fail closed because of it. fileciteturn26file0L2-L2 fileciteturn27file0L2-L2
-
-Keep that compatibility adapter until those consumers read `BootDeliverySolution` directly. Delete the capability-only total solver now. Also rename:
-
-```text
-InstallVirtualMediaLiveSurfaceUnestablished
-```
-
-because `AccessProfileNotLookedUp` is not a live-surface observation failure. `InstallBootDeliveryEvidenceUnestablished` or a specific `InstallAccessProfileNotLookedUp` arm would preserve the actual cause.
-
-## 4. The receipt ledger is link-valid, but not yet lifecycle-valid
-
-The raw-list admission defect is fixed: admission now receives only `ValidatedIntakeReceiptLedger`, and the validator rejects empty, disconnected, differently linked, mixed-subject/attempt, and decreasing-start-time ledgers. The FNV value is also honestly named a structural fingerprint. Those are substantial corrections. fileciteturn38file0L2-L2 fileciteturn39file0L2-L2 fileciteturn46file0L2-L2
-
-But the prior ruling also required valid phase ordering or explicit retry semantics. The validator does not read the declared phase order at all. It checks only subject, predecessor, and nondecreasing `started_at`; admission later searches the entire ledger independently for each required phase. fileciteturn38file0L2-L2 fileciteturn39file0L2-L2 fileciteturn40file0L2-L2 fileciteturn46file0L2-L2
-
-A counterexample that currently admits:
-
-1. Put every required receipt in reverse phase order.
-2. Give them increasing timestamps.
-3. Recompute every predecessor fingerprint.
-4. Validate the ledger.
-5. Admission finds one success for every required phase and returns `FleetAdmissible`.
-
-A subtler counterexample is a complete successful lifecycle followed by a new successful `AccessDiscover`. Last-wins makes the new access receipt current, while all downstream qualifications still predate that new discovery.
-
-Add either a declared prerequisite relation or a monotone phase rank. For a serial first implementation, the simplest rule is:
-
-- phase rank may remain the same for an immediate retry;
-- phase rank may advance;
-- phase rank may never regress after a later phase has been recorded;
-- retrying an earlier phase requires a new attempt or explicitly invalidates all descendants.
-
-The validator also needs:
-
-- `started_at <= ended_at`;
-- a declared time-order rule across receipts;
-- policy-digest compatibility across the attempt;
-- producer-version compatibility or a typed producer-transition receipt;
-- a RED for each violation.
-
-### The generic ledger still cannot validate the promised SHA chain
-
-The comment says the eventual durable producer will emit SHA-256, but validation always calculates the expected predecessor with `intake_receipt_structural_fingerprint`. Cross-family comparison refuses. Consequently, a genuine SHA-linked ledger cannot pass this validator. The receipt note also still names the nonexistent `intake_receipt_digest` and calls the ordering immutable. fileciteturn38file0L2-L2
-
-Either:
-
-- explicitly name this `StructurallyValidatedIntakeFixtureLedger` and do not claim it is the durable admission ledger; or
-- introduce `IntakeReceiptRecord { envelope, identity }`, have the producer establish the canonical SHA identity, and validate links against the supplied current-record identities.
-
-Finally, `FleetAdmissionReceipt` drops the ledger’s terminal identity and the exact receipt identity for each satisfied phase. It carries only subject, phase names, and derivation time. The derivation reads the producer ledger, but its output does not preserve which producer ledger it read. Add the terminal ledger identity, policy identity, and phase-to-receipt bindings. fileciteturn46file0L2-L2
-
-# Layer-placement rulings
-
-## `BootDeliveryPreference`
-
-**Correctly belongs in `gunbc`, not `extdeps`.** It is product/workflow policy, not a vendor or protocol fact. Keeping it in `gunbc.boot_artifact_delivery` is acceptable while there is only one local policy.
-
-However, it should not be a field of a type named `BootDeliveryEvidence`. Separate fact from policy:
-
-```dag
-fn solve_boot_artifact_delivery(
-  request: BootDeliveryRequest,
-  evidence: BoundBootDeliveryEvidence,
-  policy: BootDeliveryPolicy,
-) -> BootDeliverySolution
-```
-
-Move it to `gunbc.boot_delivery_policy` only when a second workflow or policy row needs independent governance.
-
-## `BmcAccessProfileStanding`
-
-The current type fuses two layers. Split it:
-
-**Keep in `extdeps.bmc.access_profile`:**
-
-```text
-BmcAccessProfile
-BmcAccessProfileKey
-BmcAccessProfileCatalogRow
-BmcAccessProfileLookup =
-  Known | Uncatalogued | Ambiguous
-```
-
-**Move to a workflow module such as `gunbc.machine_intake_access`:**
-
-```text
-ProfileLookupNotRun
-AccessUnobserved
-AccessObservationCaptured
-ProfileBoundToObservation
-ProfileObservationIdentityMismatch
-```
-
-`AccessProfileNotLookedUp` is workflow progress, not an external fact. `AccessProfileIdentityMismatch` is presently not produced by `bmc_access_profile_for` at all; the lookup produces only known, uncatalogued, or ambiguous, while a different function produces the profile-observation mismatch. That arm should either acquire a real producer or disappear from the lookup standing. fileciteturn30file0L2-L2
-
-Also, `DeclarationRef` is not sufficient profile provenance. It identifies the catalog declaration—the renderer—not the observation or cited producer that made the profile admissible. Preserve both:
-
-```dag
-type BmcAccessProfileProvenance
-  = ProfileFromExternalAuthority { authority: ExternalAuthority }
-  | ProfilePromotedFromObservation {
-      observation_receipt: ContentHash
-      promotion_receipt: ContentHash
-    }
-```
-
-# Namespace ruling
-
-The 31 rows use the correct **mechanical disposition** for the movement that actually occurred: the referenced declarations changed target, so `TargetChanged` is the right classification. fileciteturn43file0L2-L2
-
-The target cut is not final, however.
-
-### `FirmwareTransition*`: move to its own module now
-
-This one is mandatory. `boot_artifact_delivery` itself says a firmware transition is **not** a delivery, and the new delivery solver does not consume `FirmwareTransitionStanding`; only the frozen legacy projection does. It belongs in something like:
-
-```text
-gunbc.bmc_firmware_transition
-```
-
-That module should own the six requirements, the establishment producer, exact target-row binding, and execution receipt. fileciteturn31file0L2-L2 fileciteturn29file0L2-L2
-
-### `NetworkBoot*`: separate module is the cleaner final cut
-
-I would also move the network-boot establishment vocabulary to:
-
-```text
-gunbc.network_boot_delivery
-```
-
-Its four evidence axes have independent producers—client firmware mode, serving infrastructure, boot artifacts, and boot control—and form an independently useful standing consumed by the compositor. `gunbc.boot_artifact_delivery` should import that standing and select the `PxeChainBoot` constructor.
-
-This is less categorical than the firmware-transition move: keeping it beside its sole constructor would not violate ruling 2. But the separate module is the better final authority boundary and avoids turning the 605-line solver into the home of every candidate’s evidence lifecycle.
-
-**Do not preserve the current 31 rows and then move the subjects again.** Make the final module cut, rerun the required namespace instrument, and transcribe the resulting final-target admissions.
-
-# `bmc_onboarding` quarantine
-
-Deferring the split remains approved. The header quarantine says the correct things. fileciteturn42file0L2-L2
-
-The new witness is not discriminating, though. It proves:
-
-```text
-legacy lifecycle reaches FabricJoined
-empty receipt list does not validate
-```
-
-Those are independent facts. A future function converting `FabricJoined` into an intake receipt could be added and the witness would remain green. fileciteturn41file0L2-L2
-
-Replace or supplement it with a dependency/producer wall that derives and requires:
-
-```text
-consumers of BmcOnboardingPhase in gunbc.machine_intake_* = []
-producers from BmcLifecycleState to intake receipt/standing/disposition = []
-```
-
-That correction is small and does not require doing the full split now.
-
-The `MtCollinsBmcImplementationExpected` correction itself is accepted, but the adjacent strings still call the unpreserved `0.32` report an “observation,” say it was “grounded by execution,” and describe fallback to a platform default. The same module now admits that the raw producer was not preserved. Rename those to an explicitly unverified historical operator-report note and remove any claim that a workflow may use them as fallback authority. fileciteturn35file0L2-L2
-
-# Next slice
-
-**INTAKE-AGENT-0 is next. Not MEMORY-0, and not the full `bmc_onboarding` split.**
-
-MEMORY-0 would otherwise model report ingestion, attribution, and verdicts before the producer capable of returning the report exists. The project’s own sequence places the minimal multi-architecture agent before MEMORY-0, and BOOT-DELIVERY-0 acceptance explicitly requires both physical transports to reach that common nonce-bound callback. fileciteturn45file0L2-L2
-
-I would make the next serial gate:
-
-## INTAKE-AGENT-0A — artifact and callback contract
-
-Exit requires:
-
-1. Deterministic x86-64 and AArch64 artifacts with recorded content identities.
-2. A callback carrying attempt nonce, exact artifact digest, architecture, raw board serial, assembly-observation digest, firmware-observation digest, and boot time.
-3. Replay and duplicate-callback refusal.
-4. Wrong-nonce, wrong-artifact, wrong-unit, and wrong-architecture RED controls.
-5. Canonical durable receipt bytes and their SHA identity.
-6. Raw EDAC/RAS, inventory, and sensor capture only—no memory pass/fail verdict yet.
-7. Local execution of the callback contract without needing a physical BMC.
-
-Then run a narrow **ACCESS-OBSERVE-0 / BOOT-DELIVERY-0E** slice on hardware:
-
-```text
-Mt. Collins observation → profile lookup → plan → execute → agent callback → cleanup
-ASRock observation      → profile lookup → plan → execute → same callback → cleanup
-```
-
-Only after those producers exist should MEMORY-0 consume the real agent evidence. The `bmc_onboarding` split remains a gate before the general effectful `intake` executor or before live `BmcSecure`, `OsInstalled`, or `ServiceRuntimeAdmitted` producers—not before building the diagnostic agent artifact.
-
-## Merge gate from this review
-
-Before approval of #9690:
-
-1. Bind target and exact `BootArtifact` into the solve and plan.
-2. Replace the independently supplied capability/profile/observation tuple with one validated, attempt-bound access context carrying real producer provenance.
-3. Bind Redfish locator/protocol and MegaRAC OEM requirements into the selected transport.
-4. Remove the capability-only solver and the `FirmwareUpdateThenVirtualMedia` shortcut; keep only the fail-closed compatibility projection until its real consumers migrate.
-5. Add phase/prerequisite, interval, policy, and producer compatibility to ledger validation; preserve ledger provenance in admission.
-6. Split `FirmwareTransition*`, preferably `NetworkBoot*`, and regenerate namespace admissions.
-7. Replace the onboarding tautology with a dependency/producer wall and quarantine the unpreserved Mt. Collins prose as historical report only.
-
-This review is against the requested exact head. Current `main` has since advanced to `1b59e7d3de3d11d1de7e1551cfbac092067660a7`, so after the architectural corrections the branch must be brought current and the namespace census and claims rerun on the final integrated head. fileciteturn2file0L12-L16 fileciteturn48file0L2-L2
diff --git a/docs/plans/machine-intake-ruling-4.md b/docs/plans/machine-intake-ruling-4.md
deleted file mode 100644
index d8e7490ed08..00000000000
--- a/docs/plans/machine-intake-ruling-4.md
+++ /dev/null
@@ -1,265 +0,0 @@
-# Machine-intake ruling 4 (2026-08-30) — reviewer second pass on head cdbf4611bb
-
-Transcribed verbatim from the side chat (https://chatgpt.com/c/6a933560-5590-83ea-bc5c-731d17bfa2e3). The two short interim notes precede the ruling.
-
-> The structure is much stronger, but one splice remains: `request.target` is not proved equal to the bound access subject/endpoint. I’m checking transport-local evidence for analogous joins.
-> The deleted solver chain and module cut look sound; keep `LedgerPhaseUnranked` and the fail-closed projection. #9717 instead exposes that this PR’s changed witnesses never ran.
-
-## Ruling
-
-**HOLD / request changes on exact head `cdbf4611bbc472275130722cd6dc3da3d12fea42`.** This is substantially closer than the prior head: the second solver is gone, the compatibility layer is honestly fail-closed, the ledger now enforces lifecycle ordering, and the authority split is mostly right. The remaining blockers are narrow joins and provenance gaps rather than another redesign.
-
-Also, all seven gate items are not yet present on this exact head. The onboarding dependency wall and Mt. Collins prose correction are still absent; the current witness remains the earlier “legacy terminal plus empty ledger” test, and the current Mt. Collins module still describes the unpreserved run as an executed observation and a fallback platform default. fileciteturn76file0L2-L2 fileciteturn77file0L2-L2
-
-## What is accepted
-
-The deletion decision is accepted. `solve_install_mechanism`, `FirmwareUpdateThenVirtualMedia`, the generated proxy-DHCP path, and the capability-only default-to-PXE chain are gone. `gunbc.os_install_mechanism` now contains only projections of `BootDeliverySolution` and per-host fail-closed standings. **Keep that projection until its two real consumers migrate; do not delete it merely because it currently refuses.** It is no longer a second solver. fileciteturn65file0L2-L2
-
-The module cut is accepted. `gunbc.network_boot_delivery` is the right home for network-boot establishment, and `gunbc.bmc_firmware_transition` correctly states that a transition is not a delivery and is not consumed by the delivery solver. Its unbuilt producer can remain a declared next rung because nothing uses an `Established` value to authorize delivery today. fileciteturn62file0L2-L2 fileciteturn73file0L2-L2
-
-The ledger climb is accepted at its stated rung. It now checks one subject and attempt, one genesis, links, interval direction, nondecreasing start time, phase rank, policy identity, and producer identity. Admission preserves the terminal ledger fingerprint, policy digest, and exact receipt selected for every phase. The source is also explicit that this is structural-fingerprint validation, not the future durable SHA-256 ledger. fileciteturn68file0L2-L2 fileciteturn70file0L2-L2
-
-**Keep `LedgerPhaseUnranked`.** Its current refusal is unreachable because every present `IntakePhase` is enrolled, but it is the fail-closed arm that becomes reachable when a future phase variant is added without being placed in the required ordering. That is a legitimate totality guard, not speculative product state. Add a positive witness that every current phase has exactly one rank; an authorable negative fixture is not required. fileciteturn69file0L2-L2
-
-## 1. The request target is still not bound to the access context
-
-`BootDeliveryRequest.target` carries a subject and endpoint. `BoundBmcAccessContext` independently carries a subject and endpoint. The access binder correctly joins the observation receipt to the subject it was asked to bind, but the delivery solver does not compare the resulting context with `request.target`; it uses the context to select a transport and then copies the request target into the output plan. The existing witnesses always build both sides from the same helper, so they do not discriminate this splice. fileciteturn59file0L2-L2 fileciteturn58file4 fileciteturn58file5 fileciteturn64file0
-
-As written, this can plan:
-
-```text
-access observation and profile for subject/endpoint A
-+
-boot-delivery request for subject/endpoint B
-=
-plan that names B but was admitted using A
-```
-
-Add a binding step before candidate evaluation:
-
-```dag
-type BoundBootDeliveryTargetContext
-  = DeliveryTargetContextBound {
-      target: BootDeliveryTarget
-      access: BoundBmcAccessContext
-    }
-  | DeliveryTargetSubjectMismatch { ... }
-  | DeliveryTargetControllerMismatch { ... }
-```
-
-The solver should consume only the bound arm. Required REDs:
-
-1. same endpoint, different attempt or qualification subject;
-2. same subject, different BMC controller.
-
-The same target binding is needed for the other evidence inputs. `ReinstallPathEstablished` is currently accepted while its `qualified_by` population is ignored; UEFI HTTP evidence carries an artifact digest but no target; network-boot establishment carries four evidence references and a digest but no unit, endpoint, or attempt. Evidence from one machine can therefore authorize another machine’s request even after the access-context join is repaired. fileciteturn58file0 fileciteturn62file0L2-L2
-
-Each established transport standing should carry the `BootDeliveryTarget`, or consume a target-bound observation type whose sole producer performs that join. Artifact-digest agreement is necessary, but it does not bind the host.
-
-The plan’s positive provenance should also preserve the evidence particular to the selected candidate. The generic `profile_provenance + observation_receipt + considered` product is sufficient for the profile-shaped candidates, but it drops configfs `qualified_by` evidence and UEFI HTTP’s evidence list. A `CandidateEligible` verdict alone does not tell an executor or reviewer what made that candidate eligible.
-
-## 2. `"0.32"` is representable but still cannot inhabit a valid profile
-
-The opaque `BmcFirmwareReleaseIdentity` repair is right. `"0.32"` remains exactly `"0.32"` and has no fabricated semantic patch component. However, every `BmcAccessProfile` still embeds a semantic `BmcFirmwareCapabilityRow`, and catalog admission requires the raw release’s optional semantic view to equal that row’s semantic firmware. For `"0.32"`, the semantic view is absent, so the match always refuses. fileciteturn72file0L2-L2 fileciteturn60file0L2-L2
-
-The new witness demonstrates exactly that: `"0.32"` is representable, but both profile lookup and access-context binding refuse it. That is a useful RED, but it means the observed Mt. Collins firmware can never progress to `AccessProfileKnown` under this model. fileciteturn64file1 fileciteturn64file2
-
-Introduce an exact-release capability carrier:
-
-```dag
-type BmcFirmwareReleaseCapabilityRow {
-  release: BmcFirmwareReleaseIdentity
-  capabilities: List<BmcCapability>
-}
-```
-
-and make the new access-profile path consume it. The legacy semantic capability row can remain for existing OpenBMC consumers.
-
-The required positive control is:
-
-```text
-raw release "0.32"
-+ exact-release OEM-remote-media capability row
-+ matching profile
-+ matching synthetic observation receipt
-→ bound access context and MegaRAC delivery plan
-```
-
-That is a fixture proving inhabitability, not a seeded fleet observation.
-
-## 3. Controller identity is still fused to one protocol
-
-The profile now correctly carries route inhabitants, including Redfish, IPMI lanplus, and MegaRAC REST. But `BmcEndpoint` itself remains `{ host, protocol: Redfish | Ipmi }`, and that route-specific value is used as the intake target and access-context endpoint. fileciteturn71file0L2-L2
-
-One Mt. Collins boot needs at least two routes against one controller:
-
-```text
-MegaRAC REST for artifact delivery
-IPMI lanplus for boot control/reset
-```
-
-A single `protocol` field cannot identify that controller without selecting one route in advance. The current fixture demonstrates the problem indirectly: the supposedly no-Redfish OEM profile is observed through a `BmcEndpoint` constructed with `protocol: Redfish`. fileciteturn64file0L2-L2
-
-Do not expand `BmcProtocol` with another arm. Introduce a protocol-neutral intake identity, for example:
-
-```dag
-type BmcControllerEndpoint {
-  host: NonEmptyStr
-}
-```
-
-Use it in `BootDeliveryTarget`, `BmcAccessObservation`, and `BoundBmcAccessContext`. The profile’s `BmcAccessRoute` population remains the authority for how that controller is reached. Existing legacy users of `BmcEndpoint` need not migrate in this PR.
-
-## 4. Promoted profiles must refuse while their provenance is unverified
-
-You are right not to fabricate a receipt store. The conclusion, however, is not that `ProfilePromotedFromObservation` may produce `AccessProfileKnown` while the gap is merely described.
-
-At present, two arbitrary hash-shaped values can be authored as `observation_receipt` and `promotion_receipt`, placed on a catalog row, and accepted by lookup and access binding. The positive fixtures do exactly this with synthetic content hashes. No producer establishes that either receipt exists or that the observation describes the profile being promoted. fileciteturn60file0L2-L2 fileciteturn64file0L2-L2
-
-No store is required to fail closed now. Put verification in the workflow layer:
-
-```dag
-type ProfilePromotionVerificationStanding
-  = ProfilePromotionVerified { ... }
-  | ProfilePromotionUnverified {
-      observation_receipt: ContentHash
-      promotion_receipt: ContentHash
-    }
-```
-
-`bind_bmc_access_context` may bind:
-
-- a profile grounded directly in an external authority; or
-- a promoted profile accompanied by `ProfilePromotionVerified`.
-
-Without the future store, every promoted profile produces `ProfilePromotionUnverified` and refuses. That gives the missing discriminating control today without pretending that receipt lookup exists.
-
-INTAKE-AGENT-0A can later introduce the store-backed producer that constructs `ProfilePromotionVerified`.
-
-## 5. The Redfish probe still has two protocol authorities
-
-`RedfishVirtualMediaProbeReceipt` carries both:
-
-```text
-progress = TransferProtocolAdmitted { protocol: ... }
-admitted_protocols = [...]
-```
-
-The solver uses the progress arm only to decide whether the plan floor was reached, then decides protocol eligibility from `admitted_protocols`. Consequently, the receipt can claim `TransferProtocolAdmitted { NFS }`, list only HTTPS, and admit an HTTPS offer. fileciteturn63file0L2-L2 fileciteturn58file1
-
-Use one representation:
-
-- make the progress arm payload-free and let a nonempty admitted-protocol population establish the plan floor; or
-- put the admitted protocol population directly on the progress arm and remove the sibling field.
-
-The nested probe’s `raw_response` also needs to be part of the observation receipt’s verified evidence manifest. The access binder currently checks the overall observation `raw_response` against one `EvidenceRef`, but the transport plan derives its locator and protocols from the nested probe receipt’s separate hash. There is no structural statement that this second blob was among the captured evidence. A receipt manifest containing all referenced evidence digests is the clean correction.
-
-## Ledger and durable-receipt ruling
-
-`IntakeReceiptRecord` may remain deferred to **INTAKE-AGENT-0A**. The current code is honest that `ValidatedIntakeReceiptLedger` is an in-substrate structural ledger and cannot validate the future SHA-linked wire ledger. That is sufficient for the INTAKE-0 semantic model, but it is not sufficient for a live admission producer. fileciteturn68file0L2-L2
-
-The PR body is now stale: it still claims a “canonical digest and hash-chain check” and still describes the superseded live-surface refusal rather than `InstallAccessProfileNotLookedUp`. Update it only after the final code head is fixed. fileciteturn79file0L8-L8
-
-The gate before any effectful intake/admission executable is:
-
-```text
-IntakeReceiptRecord {
-  envelope
-  canonical_bytes_identity: Sha256Digest
-}
-```
-
-with links checked against those supplied record identities, not recomputed FNV fingerprints.
-
-## Onboarding and Mt. Collins worker
-
-The proposed worker direction remains correct, but it must land before this review can close.
-
-The dependency wall must inspect the live producer/consumer relation—no path from `BmcOnboardingPhase` or `BmcLifecycleState` into intake standings, receipts, disposition, or admission. The exact-head witness currently proves only that the legacy state reaches `FabricJoined` and that an unrelated empty receipt list does not validate; adding a conversion function would not make that witness red. fileciteturn76file0L2-L2
-
-For Mt. Collins, retain `MtCollinsBmcImplementationExpected`, but rewrite or delete the adjacent rows that currently say:
-
-- the stack was “established by execution”;
-- `0.32` and no-Redfish are an “observation”; and
-- workflows may fall back to this platform default.
-
-The raw producer was not preserved, so these may survive only as an explicitly unverified historical operator report with no authority path into lookup or planning. fileciteturn77file0L2-L2
-
-## Namespace ruling
-
-The final module cut is approved, but do not transcribe admissions from the present intermediate head. The exact head still carries the earlier 31-entry roster describing the old move directly into `boot_artifact_delivery`. Those are not the final targets after the split into `network_boot_delivery` and `bmc_firmware_transition`. fileciteturn74file0
-
-The sequence is:
-
-1. land the target/context, raw-release, endpoint, provenance, probe, and onboarding corrections on the branch;
-2. merge current `main`;
-3. run the namespace instrument against that exact integrated head;
-4. transcribe only the resulting final `TargetChanged` identities;
-5. rerun once to prove no unadjudicated or stale admissions.
-
-`main` has already advanced to `61c6dfde780430ea6fd20ac3985a72f5cdbd9384`, well beyond the PR’s recorded base, so the final census cannot be taken from `cdbf4611bbc472275130722cd6dc3da3d12fea42`. fileciteturn80file0L2-L2
-
-## #9717 is not an unrelated CI incident
-
-The red is truthful. #9717 was specifically built because prior PRs added witnesses that passed remotely but executed **zero** times in the required floor. It now blocks every changed witness whose required-floor disposition is declined, missing, or nonterminal. fileciteturn81file0L8-L8
-
-The 2026-08-29 compiler-floor ruling and #9717 can coexist:
-
-```text
-static global required-gate roster = compiler floor only
-dynamic per-PR changed-witness lane = exactly the changed witness identities
-```
-
-The honest repair is a changed-witness execution sublane:
-
-1. reuse #9717’s already-derived changed identity set;
-2. execute exactly that set, without adding product prefixes to the global compiler gate;
-3. write terminal outcomes into the same disposition ledger;
-4. let #9717 project those outcomes.
-
-Do **not**:
-
-- weaken #9717;
-- classify `DeclinedOutsideGateClosure` as green;
-- add a blanket exception for #9690;
-- expand the standing global compiler gate with every product namespace;
-- convert the 53 identities to expected-red or transition admissions.
-
-The reported 74 remote greens are valuable development evidence, but they are not yet an exact-head required-CI receipt. They could substitute only if imported as subject-bound, identity-complete execution receipts that the required gate itself consumes.
-
-At the time I checked, the exact-head GitHub run was still nonterminal: Rust unit tests had succeeded, while the required build and floor jobs were still running. Thus there is not yet a final CI verdict on `cdbf4611bbc472275130722cd6dc3da3d12fea42` to classify. fileciteturn82file0L2-L2
-
-The changed-witness execution repair can land as its own CI PR ahead of #9690. Until it does, #9690 remains correctly blocked rather than “green except for infrastructure.”
-
-## Next slice
-
-After these corrections and #9690’s merge, **INTAKE-AGENT-0A remains next**.
-
-That slice should produce the missing common substrate:
-
-1. deterministic x86-64 and AArch64 artifacts;
-2. canonical SHA-256 `IntakeReceiptRecord` identities;
-3. an evidence manifest/store capable of resolving observation and promotion receipts;
-4. nonce-bound callback with artifact, architecture, unit, assembly, firmware, and attempt identity;
-5. replay and duplicate-callback refusal;
-6. raw inventory, EDAC/RAS, sensor, and access-observation captures without memory verdicts;
-7. local callback-contract execution before hardware use.
-
-That slice supplies the producer needed to verify `ProfilePromotedFromObservation` rather than forcing #9690 to invent a generic receipt store. Then execute the Mt. Collins and ASRock access/boot callbacks. **MEMORY-0 follows those real agent receipts.** The full `bmc_onboarding` split remains required before the general effectful intake executor or live `BmcSecure`, `OsInstalled`, or `ServiceRuntimeAdmitted` producers, not before the agent artifact.
-
-## Final approval gate
-
-Approval requires one final head containing:
-
-1. request target ↔ access-context subject/controller binding;
-2. target-bound configfs, UEFI HTTP, and network-boot standings;
-3. a positive exact-raw `"0.32"` capability/profile path;
-4. protocol-neutral BMC controller identity;
-5. one Redfish protocol authority plus bound probe evidence;
-6. fail-closed unverified promoted-profile provenance;
-7. the real onboarding dependency wall and historical-report rewrite;
-8. namespace admissions generated from the final current-main composition;
-9. updated PR body;
-10. terminal required CI in which every changed witness has an executed disposition.
-
-The architecture no longer needs another broad rewrite. These are the remaining seams where independently valid values can still be paired to manufacture a plan about the wrong subject, controller, release, route, or producer.
diff --git a/docs/plans/managed-host-untangle.md b/docs/plans/managed-host-untangle.md
deleted file mode 100644
index 5a0506e0b3a..00000000000
--- a/docs/plans/managed-host-untangle.md
+++ /dev/null
@@ -1,744 +0,0 @@
-# Managed-host untangle: mtcollins1 → unit / platform / silicon / BMC stack / fleet procedure
-
-*Work item adhoc-81aa03f8-bc8 (session warm-crane-577), measured at `26e99a9c7f`. Governing doctrine: DESIGN §3 (single authority; replacement migrations cut over at the root, consumers enumerated before deleting a root that is outside the required gate), §3b, §3c, and [the replacement migration doctrine](replacement-migration-doctrine.md).*
-
-## Why
-
-A second Ampere Altra platform, Mt. Jade 2U (unit `mtjade1`), is arriving. Most of what is named for `mtcollins1` is not specific to Mt. Collins: it is Ampere silicon knowledge, AMI MegaRAC knowledge, or fleet procedure for any BMC-managed host, with the unit hardcoded through a handful of constants. As long as the procedure is `mtcollins1_*`, Mt. Jade has two options: fork the procedure (a §3 nickname) or wait. The fix is the root seam below, plus one cut per authority.
-
-## How the census was taken (the instrument)
-
-This is an import census over every `.dag` module under `dag/` and `src/v2/`, not a grep for consumers:
-
-- **Population**: every module whose name or text matches `mtcollins`. That is 269 modules: 81 witnesses and 188 production/reference modules.
-- **Consumers**: the reverse `import` edges into each module.
-- **Gate**: transitive import closure from `v2.workflow.required_floor` `required_gate_prefixes`.
-- **Constants**: the `mtcollins|mt_collins|MtCollins` symbols each module imports from another module. These are the unit/platform constants it depends on.
-
-The method is under **Census method** below. It is a one-off that each cut re-runs at its own head.
-
-### Findings that shape the plan
-
-1. **No layer-1/2/3/5 machine-intake module is in the required gate.** The 12 gate-reachable members are generic modules carrying prose or a single row:
-   - `extdeps.bmc.megarac`
-   - `extdeps.boards.types`
-   - `gunbc.fleet_intent_network`
-   - `gunbc.secret_provision`
-   - `gunbc.ci_layer_roots`
-   - `gunbc.durable_cas_file_store`
-   - `gunbc.floor_demand`
-   - `gunbc.roadmap_authority`
-   - `gunbc.runner_registration_labels`
-   - `gunbc.runner_throughput_qualification`
-   - `v2.workflow.floor_route_gap`
-   - `test.claim.action_use_admission_witness`
-
-   **So every cut below deletes a root outside the gate.** Per §3, each child brief carries its consumer list by name, from the tables below, and must run each named consumer's witnesses itself. A green required run proves nothing about these modules (`docs/rung-drops/required_lanes_do_not_resolve_product_layer_modules_2026-09-20.txt`).
-
-2. **The unit enters through about ten roots.** These are the most-imported unit symbols:
-
-   | Symbol | Home | Importers |
-   |---|---|---|
-   | `mtcollins1_endpoint` | `gunbc.machine_intake_mtcollins1_access_observation` | 10 |
-   | `operator_host_mtcollins1` | `gunbc.fleet_intent_network` | 7 |
-   | `mtcollins1_firmware`, `mtcollins1_capability_row`, `mtcollins1_access_observation` | access observation | 7 / 5 / 4 |
-   | `mtcollins1_bmc_gunbc_secret_ref` | `gunbc.secret_provision` | 6 |
-   | `mtcollins1_secured_account` | `gunbc.machine_intake_mtcollins1_bmc_secure_observation` | 6 |
-   | `mtcollins1_unit_hold_key`, `mtcollins1_unit_hold_store_host` | `gunbc.machine_intake_mtcollins1_maintenance_hold` | 6 / 4 |
-   | `mtcollins1_cdrom_selection` | `gunbc.machine_intake_mtcollins1_actuate` | 5 |
-   | `mtcollins1_host_nic_mac` | `gunbc.machine_intake_mtcollins1_netboot_client_observation` | 7 |
-   | `mtcollins1_boot_export_dir` | `gunbc.machine_intake_mtcollins1_boot_artifact` | 6 |
-   | `mt_collins_channel_population_roles`, `mt_collins_channel_connector_pairs`, … | `extdeps.ampere.mt_collins_*` (the board figure) | 10 / 5 |
-
-   **Fleet procedure is unit-specific only through these roots.** Thread a host record through them and the procedure modules become host-generic without restating their logic.
-
-3. **`gunbc.host_reset_subject_roster` `ResetSubjectCandidate` is already the per-host record in embryo.** It carries:
-   - `host` (a `HostIdentity`)
-   - `observation` (a `BmcAccessObservation`, which carries the endpoint)
-   - `capability_row`
-   - `username`
-   - `boot_selection`
-   - `unit_hold`
-
-   Its note says a second host joins "the day it authors an observation". But it is named and scoped for *reset*, and the boot, hold and census procedures each re-import the same unit constants independently. Those are four consumers holding four copies of one row.
-
-4. **`gunbc.machine_intake_subject` is not the home.** `MachineIntakeSubject` / `QualificationSubject` is the *identity of a unit under qualification*: unit key, assembly manifest, firmware manifest and attempt. It has no BMC endpoint, credential or stack. It stays what it is, and the new record references it rather than absorbing it.
-
-5. **`mtjade1` has no `HostIdentity` row.** `gunbc.fleet_intent_network` names `operator_host_mtcollins1` but no `mtjade1`. What exists for the unit:
-   - `gunbc.machine_intake_mtjade1_access_observation` carries `FamilyUnobserved`, a refused unit key, and `SecretLocusReservedNotOnAccessorRoster`.
-   - `gunbc.machine_intake_bmc_firmware_family_discriminator` and `bmc_first_contact_standing` already model "BMC family not yet observed".
-
-6. **The platform home exists.** `extdeps.boards.types` `BaseboardModel` / `ServerBaseboard` is in the gate, has 25 importers, and is where the board figure is keyed.
-
-7. **`.github/workflows/fleet-converge.yml` is a projection.** Its authority is `gunbc.fleet_converge_workflow` (271 references, 4,446 lines). It carries 8 `mtcollins1_*` mode literals in conditions and about 30 `mtcollins1_*` step/job identifiers. Renaming any mode needs operator sign-off.
-
-## The root seam (revised after the #13046 review)
-
-**Name.** The name was chosen by DFS of existing vocabulary. The corpus already says *managed* for "a host this fleet drives through its baseboard controller" (`gunbc.host_reset_subject_roster` contrasts it with "executor fleet host"). No `ManagedHost` type exists, and none of the existing `Managed*` types is the same concept.
-
-**The record is a projection over standings that already exist, not a new bundle.** Two joined authorities already cover most of it:
-
-- `gunbc.machine_intake_access` `BoundBmcAccessContextStanding` binds the `MachineIntakeSubject`, endpoint, observed identity (which includes baseboard and BMC family), capability row, profile, observation and evidence manifest.
-- `gunbc.machine_intake_bmc_secure` `BmcSecureStanding` / `ManagedCredentialReference` carry the secured account, role, `SecretRef` and credential epoch.
-
-Restating any of that as loose `baseboard` / `bmc_stack` / `credential` fields would be a second authority and would lose the capability row that `reset_subject_admission` needs. So:
-
-```
-module gunbc.managed_host
-type ManagedHost {
-  host: HostIdentity                       // gunbc.fleet_intent_network, the sole naming authority
-  access: BmcAccessObservationStanding     // endpoint and observed identity (baseboard, BMC family)
-  capability_row: BmcFirmwareReleaseCapabilityRow  // the pair oob_boot_handoff_admission consumes today
-  secure: BmcSecureStanding                // managed credential: account, role, SecretRef, epoch
-  unit_hold: ResetUnitHold                 // moved here from host_reset_subject_roster
-}
-fn managed_hosts() -> List<ManagedHost>
-fn managed_host_binding(h: ManagedHost) -> ManagedHostBindingStanding   // THE join; effectful consumers read only this
-```
-
-**The seam is a join, not a bundle** (side-chat review, 2026-10-03). There are two invariants.
-
-1. **One joined standing.** The subject is derived from `secure.subject` and never stored again. `managed_host_binding` refuses, with a typed and located cause, unless all three hold:
-   - `access` is observed;
-   - the observed endpoint equals the `BmcSecured` endpoint;
-   - the secured subject's unit is bound to the row's `host`.
-
-   Every effectful consumer (reset, boot, hold) reads the credential and the endpoint only through the bound result. Without the join, unit A's secured account could be used against unit B's controller. The discriminating RED uses a secure standing for endpoint A and an access observation for endpoint B.
-2. **Operation admission includes the operation's policy.** A host is a member of an operation's roster only if that operation's policy is decided for it. For reset, one reset-specific authority takes the bound `ManagedHost` plus the reset boot selection and produces an admitted reset subject. The roster lists exactly those hosts, and `gunbc.host_reset_return_run` consumes the selection from that admitted subject with no second lookup. The RED is a capable host with no reset selection, which must be absent from the roster. Every later cut that adds an operation (boot, hold) follows the same shape.
-
-Rules for the record:
-
-- **Baseboard and BMC family are read through `access` (its observed identity), never stored beside it.** A procedure that needs MegaRAC matches the bound identity and refuses otherwise.
-- **The silicon field arrives in cut 1** as a standing authored there, not as a placeholder in cut 0.
-- **Cut 0 has exactly one row, `mtcollins1`.** Its `subject` and `secure` come from `gunbc.machine_intake_mtcollins1_bmc_secure_observation` (`mtcollins1_intake_subject`, `mtcollins1_bmc_secure_standing`). Its `access` and `capability_row` are the unit's existing `mtcollins1_access_standing` and `mtcollins1_capability_row`.
-- **Why `access` is the observation standing plus the capability row, not `BoundBmcAccessContextStanding`** (measured by cut 0, 2026-10-03):
-  - `gunbc.machine_intake_access` `bind_bmc_access_context` has no production caller.
-  - There are no production `AccessObservationReceipt` values.
-  - No `BmcAccessProfileCatalogRow` exists outside type declarations.
-  - Binding mtcollins1 would require authoring a catalog row whose provenance cannot be honestly decided today. `ProfileFromExternalAuthority` has no source, and `ProfilePromotedFromObservation` binds only beside a `ProfilePromotionVerified` that no producer makes.
-
-  So the row carries the pair that the consumed admission (`oob_boot_handoff_admission`) actually reads today. This is a **declared frontier, not a second authority**. Its trigger: the first production producer of a `BoundBmcAccessContextStanding` for a managed host, which needs a catalog row with a decided provenance. In that change, `access` and `capability_row` collapse into the bound context and these two fields are deleted.
-
-- **`mtjade1` gets no row yet.** It has no `MachineIntakeSubject` (its unit key is refused), no endpoint, no family and no hold decision. Fabricating any of them to populate a row is the §5 defect the review named.
-- **mtjade1's absence is the honest standing.** Every procedure refuses a host that is not in `managed_hosts()`.
-- **mtjade1 joins on a trigger, not by edit.** It becomes a row the day first contact authors its subject and access context standing (`gunbc.machine_intake_jade_first_contact_frontier`) and a hold decision is made. That is the trigger, and it is not a cut of this program.
-- **`ResetSubjectCandidate` dissolves.** `gunbc.host_reset_subject_roster` becomes a filter over `managed_hosts()` with the same admission fold, and `boot_selection` returns to the reset arm as reset policy.
-
-**Operation-keyed policy is not host identity** (ruling (b), 2026-10-03). The boot federation is policy for the pair (managed host, operation):
-
-```
-ManagedHostBootFederationStanding {host, operation, pool, provider, service_account, environment, claim_pins, secret_grants}
-```
-
-- `mtcollins1` is bound to the existing live names (`github-mtcollins1-boot` pool and provider, the `mtcollins1-boot` service account and GitHub environment, and the grants), which are not renamed.
-- Any other host is explicitly unprovisioned, and the generic job refuses it.
-- None of these ids appear on `ManagedHost`.
-
-## Rulings recorded (operator, via eager-gull-22 side-chat review, 2026-10-03)
-
-- **(a)** The fleet-converge mode recut is approved in principle as the **last** cut: one atomic transition, no aliases, the eight old literals deleted in the same change.
-  - Do **not** overload the existing `host` input, which is the executor host. Add a distinct managed-subject input and keep the executor axis.
-  - Names are derived after cuts 2–6 expose the axes. Census-QEMU modes are executor-toolchain operations, census image publish/readback are artifact operations, and boot/fan/UI/KVM are managed-host operations.
-  - The final names still need operator sign-off.
-- **(b)** Keep the live GCP IAM names. Model them as the operation-keyed standing above.
-
-## Ordered cut list (re-cut vertically)
-
-**The governing rule** (review item 3): *a module may not acquire a generic name while its answer is still transitively fixed to mtcollins1.* Each cut therefore moves a module only after everything it transitively imports from the `mtcollins1` population is either already generic or is a layer-1 unit observation that the generic module now receives as a **parameter** or reads off the `ManagedHost` row.
-
-The boot vertical is large. Its transitive closure from `gunbc.machine_intake_mtcollins1_boot_run` reaches 50 census modules, including:
-- the layer-1 `mtcollins1_memory_census_observation`;
-- the layer-3 `mtcollins1_smpro_observation`;
-- the layer-4 `mtcollins1_kvm_still`, `mtcollins1_bmc_sensor_observation` and `mtcollins1_bmc_secure_observation`.
-
-So the BMC and silicon leaves it needs move first.
-
-| # | Cut (one authority) | Root deleted | Sequencing |
-|---|---|---|---|
-| **0** | **Seam**: `gunbc.managed_host` as above, `mtcollins1` row only; dissolve `ResetSubjectCandidate`. | `reset_subject_candidates`, and the roster's direct `mtcollins1_*` imports | Now. Disjoint from #13025 and #13041. |
-| **1** | **Silicon**: Ampere-generic SMpro/PMpro, boot-stage, `CP:` and CCIX decoding moves out of `mtcollins1_smpro_observation` into `extdeps.ampere.*`, next to the existing `ampere_{dram,socket}_console_observation`. Adds the silicon standing to `ManagedHost`. | the generic decoders inside the unit module | After #13025, and after cool-ant-760's error-record decoder lands. Public-tree rule: no SCP UM, no CHANGELOG.txt, nothing disassembled. |
-| **2** | **Maintenance hold**: host-generic over `ManagedHost.unit_hold`. | `mtcollins1_unit_hold_*`, `mtcollins1_maintenance_hold_{take,release}` | After 0. The env var `GUNBC_MTCOLLINS1_MAINTENANCE_REASON` is a workflow surface: keep it until cut 7. |
-| **3** | **Boot-critical BMC leaves**: `mtcollins1_kvm_still`, `mtcollins1_media_attach` (the MegaRAC virtual-media half), `mtcollins1_bmc_sensor_observation`, and the secured-account projection of `mtcollins1_bmc_secure_observation`. These become MegaRAC-scoped modules that take a `ManagedHost` and refuse a non-MegaRAC bound identity. The unit's own readings stay unit-named. | those modules' `mtcollins1_` procedure roots | After 0. |
-| **4a** | **Boot subject leaves**: artifact, image fetch, milestone, phase timing, admission, authorization, actuate. `MtCollins1BootSubject` becomes a boot subject over `ManagedHost`. | `MtCollins1BootSubject`, `mtcollins1_boot_subject*`, `mtcollins1_cdrom_selection`, `mtcollins1_boot_export_dir` as procedure inputs | After cuts 1 and 2. **Not after cut 3**: measured on main 2026-10-04, the 4a modules import none of the cut-3 modules. The census-image import in the boot authorization becomes the boot **medium parameter**, so 4a does not wait on 4b either. The runner-image medium arm and its terminal milestone (quiet-stag-623's lane) land on top of 4a. |
-| **4b** | **Census boot image chain**: the 7 `mtcollins1_census_*` modules. Toolchain and QEMU modules are executor-host operations, so they are keyed by executor host, not managed host. | the `mtcollins1_census_*` procedure roots | After 4a. |
-| **4c** | **Boot federation standing**: `ManagedHostBootFederationStanding` replaces `gunbc.auth.mtcollins1_boot_federation*`, live names kept as the `mtcollins1` binding (ruling b). | `mtcollins1_boot_*` federation decls | After 0. Independent of 4a/4b. |
-| **4d** | **Boot run, dry realization, diagnostic bundle**: the vertical's root. Unit observations it reads today (`mtcollins1_memory_census_observation`, `mtcollins1_access_observation`) become row reads or parameters, so the dependency direction is procedure ← unit. | `mtcollins1_boot_run`, `_boot_dry_realization`, `_boot_diagnostic_bundle` | After 1, 4a, 4b, 4c. Likely split run/dry and bundle at dispatch. |
-| **O1** | **Arrival convergence, factory state through an admitted managed host** (operator requirement and rulings, 2026-10-03). PRs: O1a route standing, O1b state-shaped `BmcSecure` and observer clock, then O1c in three parts (the shared step-sequence fold with its first consumer; the prior-life archive; `BmcSecure` wiring and the admission population). See its own section below. | the family-keyed rotation route; the rotation-event-only `BmcSecure` derivation; the supplied `BmcSecureStanding` in the firmware convergence; the source-roster `managed_hosts()` | After 4c. Does not need the generic boot run. Each unit's live credential write needs its own operator go-ahead; mtcollins1 goes first. |
-| **O2** | **Boot enters through the arrival convergence** (replacement migration): the `mtcollins1_boot` mode is re-rooted onto the convergence in one transition, and the old boot entry is deleted. | the boot run's own entry (the root that assumes `BmcSecured`); the caller-supplied password path into the boot wrappers | **After 4d.** The convergence is host-generic, so it may not call a boot run whose answer is still fixed to mtcollins1. |
-| **5** | **Remaining BMC-stack observations**: fan observe, UI bundle observe, KVM observer, SOL notice, served-UI catalog, BMC fan, which the boot does not need. | those `mtcollins1_` procedure roots | After 3. |
-| **6** | **Platform**: physical orientation, DIMM connector and platform observation become logic over the baseboard read through `ManagedHost.access`. The Mt. Collins figure stays in `extdeps.ampere.mt_collins_*`. | the board bindings in those modules | After #13025 (it edits `mtcollins1_physical_orientation`). |
-| **7** | **Workflow modes**, per ruling (a). | the 8 `mtcollins1_*` literals and their steps in `gunbc.fleet_converge_workflow` and its projection; `mtcollins-canary.yml` dispositioned in the same change | Last. Operator sign-off on names first. |
-
-### Cut O — arrival convergence (plan delta, 2026-10-03; revised for the side-chat review of `b42944791e`)
-
-**Requirement** (operator, via eager-gull-22). Boot is to be entered from onboarding, starting at **factory state**. Today's boot run assumes `BmcSecured` already holds. First subject by requirement: `mtjade1` (MegaRAC at 192.168.1.246, factory `admin`/`admin`, BMC clock reading the year 2000). First **wet** subject by ruling: `mtcollins1`.
-
-**Framing (operator ruling, 2026-10-03): a consolidation, not a new mode beside the boot.** It is a replacement migration under DESIGN §3.
-- The arrival convergence becomes the one entry for boot, and no second boot route survives beside it.
-- No new mode, no new job, no renamed mode. The literal `mtcollins1_boot` and its job stay byte-identical until cut 7.
-- Boot is the gap-intolerant boundary, so the staged form applies: the convergence is built and witnessed first (O1), then **one transition** re-roots the mode and deletes the old entry together (O2).
-
-**Module name.** `gunbc.machine_intake_arrival_converge` (approved). It avoids "onboarding" because `gunbc.bmc_onboarding` is quarantined legacy (ruling 2026-08-29). That module is not imported, and the quarantine witness keeps holding.
-
-#### Scope: a prefix of the existing `ArrivalPhase` order, exactly
-
-`gunbc.machine_intake_phase` `arrival_phases_all` orders twelve phases. Cut O is the **prefix through `BootDeliveryEstablish`**: five phases, in the authority's own order, with none omitted and none added. The later phases (`DiagnosticBootAttest` through `ArrivalCleanup`) are not in this cut and keep their present standing. The fold is over `arrival_phases_all`, cut at `BootDeliveryEstablish` by `intake_phase_rank`. It is not a second, shorter list.
-
-Each phase yields one result and one receipt. Supporting operations are **nested under the phase that consumes them**; they are not phases.
-
-| Phase | Goal, read back independently | Effects, and whether each is a write | Nested support |
-|---|---|---|---|
-| `AccessDiscover` | access observation, firmware family, **and the sealed route standing** (below) | read-only probes | the controller's own clock reading, recorded as an observation and never used for ordering |
-| `IdentityBindProvisional` | the exact `MachineIntakeSubject` (below) and its `HostIdentity` binding | read-only: FRU, firmware versions | subject construction; host allocation lookup |
-| `PriorLifeBoundary` | `LogsArchivedWithBaselineCursor`: the prior-life carriers are archived as content-addressed evidence and a cursor is derived from that archive (below) | **read-only arm**: archive, derive the cursor, clear nothing. **`LogsArchivedAndCleared`**: a write with its own admission and operator sign-off, **not in this cut**. | per-carrier completeness standings |
-| `BmcSecure` | the existing conjunction: the managed credential is accepted **and** the published credential is refused on every LAN member of the channel census | **write**: the typed account action, operator-gated per unit | secret generation, store and exact-version fetch **before** the write (below) |
-| `BootDeliveryEstablish` | **one eligible delivery transport selected from live observations**: a `gunbc.boot_artifact_delivery` `BootDeliveryPlan`, bound to subject, controller and artifact. **This is not the boot run.** | read-only observations; the selection | managed-host admission (below) |
-
-`PriorLifeBoundary` has no implementation today: the phase is declared and nothing produces it. A factory or repaired unit cannot skip it, so O1c builds its read-only arm. That is new work this plan had omitted.
-
-**What the `PriorLifeBoundary` read-only arm is** (`docs/plans/machine-intake-design.md` §5: `PriorLifeBoundaryEstablished = LogsArchivedAndCleared | LogsArchivedWithBaselineCursor`). It is an **archive**, not a bare cursor.
-- **Carriers archived**, each as content-addressed evidence with its own completeness standing: the BMC clock, the SEL and event logs, the Redfish log collections, audit and account events, the current boot override, virtual-media state, power state, and a sensor snapshot.
-- **Cursor:** derived **from that archive**.
-- **Nothing is cleared.**
-- **Incomplete archive:** a required carrier that cannot be archived makes the phase refuse, or records a typed gap. It is never silently omitted.
-- **Policy admission:** the design admits this arm "only where platform policy explicitly admits an uncleared append-only boundary". That admission is an authored policy row per platform. It is a decision this cut must state for Mt. Collins and Mt. Jade, not assume.
-- **Control:** only the SEL final record id, with the other carriers absent → not established.
-
-**What `BootDeliveryEstablish` is, and is not.** It is phase 5: a delivery plan or standing. The boot run is not part of it, and establishing it completes no later phase.
-- **O2:** consumes the established delivery to enter the existing boot run.
-- **Controls:**
-  - delivery selected → `BootDeliveryEstablish` established **and `DiagnosticBootAttest` unestablished**;
-  - no `BootDeliveryEstablish` → the boot entry cannot start.
-
-**O1 and O2.** O1 runs the prefix through `BmcSecure` and ends at an admitted managed host. O2 adds `BootDeliveryEstablish` (the delivery standing) and re-roots the boot mode so that the existing boot run is entered only from an established delivery. It lands only after cut 4d has made the boot run host-generic. The boot run itself, and every phase after phase 5, stays what it is. mtcollins1's wet `BmcSecure` control needs no boot, so it runs at O1.
-
-#### The subject (`IdentityBindProvisional`)
-
-A FRU serial yields only a `UnitKeyStanding`. A `MachineIntakeSubject` is a `QualificationSubject` (unit key, assembly-manifest digest, firmware-manifest digest) plus an `IntakeAttemptId`. Each part has a named producer:
-
-| Part | Producer | Evidence |
-|---|---|---|
-| unit key | `gunbc.machine_intake_subject` `bind_unit_key` over `BoardSerialObservation`s | committed FRU capture |
-| provisional assembly manifest | `AssemblyManifest` of the `ComponentIdentity` rows readable before boot (board, BMC, and what the FRU and the BMC inventory expose), digested by `assembly_manifest_digest`. Provisional is the phase's own word: `InventoryConform` later re-derives it from the booted host. | the same captures |
-| live firmware manifest | `FirmwareManifest` of the versions read back from the controller now, digested by `firmware_manifest_digest` | committed version readbacks |
-| attempt identity | one `IntakeAttemptId` minted per convergence run | the run's receipt |
-| subject | `qualification_subject_of`, then `MachineIntakeSubject` | the above |
-
-**That exact subject flows through `BmcSecure`, managed-host admission and boot.** A firmware reflash changes the firmware-manifest digest, so `compare_qualification_subject` reports `FirmwareManifestStale`. A `BmcSecureStanding` bound to the old subject is then not current and is never reused: re-entry after a reflash re-derives the subject and re-runs the phases against it.
-
-**Host identity.** A `UnitKey` is not a fleet-operation identity. The `HostIdentity` comes from `gunbc.fleet_intent_network` (naming) and `gunbc.hostname_allocation` `gunbc_fleet_hostname_allocations` (the allocation row). The binding of a `HostIdentity` to a subject is recorded in the admission record below. mtjade1 has neither a name row nor an allocation today, and both are authored decisions, not derived.
-
-#### The route standing (`AccessDiscover`), corrected first (O1a)
-
-`gunbc.bmc_implementation_dispatch` `rotation_route_for_family(AmiMegaRac)` answers `RotationRouteUnavailable` for a whole family. That is wrong in the direction the evidence shows, and the replacement must not be another family-keyed answer. The evidence is exactly this, and no wider:
-
-- **mtcollins1**: an IPMI user-management rotation was **executed** on that controller and build (`artifacts/bmc/mtcollins1-bmc-user3-route-2026-09-13.txt`).
-- **mtjade1**: a Redfish Manager **read** is committed (#13065). It proves a Redfish surface. It does not prove a Redfish AccountService write, nor an IPMI user-management request, on that controller.
-
-So the route is a **sealed standing bound to an endpoint, a firmware build and evidence**, derived **inside** the convergence after `AccessDiscover`. It is not passed in, which withdraws this plan's earlier "selected before and passed in" sentence: that would have been a second observation authority. The arms:
-- **grounded by an executed request on this controller and build** (carries the evidence);
-- **grounded by a cited source for this build** (carries the citation);
-- **ungrounded.**
-
-An ordinary `BmcSecure` Apply consumes **only a grounded standing**. mtcollins1's IPMI route does **not** authorize mtjade1, whose route is ungrounded today.
-
-**Grounding a route is its own effect, not the Apply.** The Apply cannot produce the premise that admits it, so there is a bootstrap with its own authorization:
-
-`RouteUngrounded` → `RouteQualificationCandidate { endpoint, firmware_build, request shape, evidence }` → `RouteGroundedByExecutedRequest { endpoint, firmware_build, request receipt, response receipt }`
-
-- The transition is made by a **separately authorized route-qualification effect**. It is classified as its own privileged effect through `select_authorization_pattern`, and it has its own operator go-ahead per controller.
-- The candidate names the exact request shape and the evidence that makes it worth trying (an observed surface, a public standard's operation). It authorizes nothing by itself.
-- Only the grounded arm enters ordinary `BmcSecure` Apply.
-- **RED:** `RouteUngrounded` + operator approval of the rotation + ordinary Apply → refuse.
-
-This is the MegaRAC rotation operation that the runner-bringup gap analysis lists first. The route standing is keyed by endpoint and build and carries request and response receipts, so the same model serves that backlog's other consumers without a second route vocabulary.
-
-Controls:
-- two `AmiMegaRac` controllers with different observed and executed surfaces produce different route standings;
-- a Manager GET alone cannot construct an account-write route.
-
-`rotation_route_consumption_frontier` stands until the held O1b transition: O1b supplies the consumer's code (`gunbc.machine_intake_bmc_secure` `plan_bmc_account_action` computes each write's admission with `admit_rotation_apply` and refuses on every other arm), but not yet its production route.
-
-#### Request shapes, and what a grounding establishes (O1a-2, ruled 2026-10-04)
-
-The route standing is per **request shape**, per controller and build. Two shapes exist.
-
-- **Set User Password** (`IpmiSetUserPassword`). mtcollins1's committed execution grounds it **at BMC 0.32 only**. The controller is now on 0.45.3, so for the current build this route is another build's and the Apply refuses (`RouteForAnotherBuild`).
-- **Set User Access, privilege-limit-only form** (`IpmiSetUserPrivilegeLimit`). It is needed because the `BmcSecure` conjunction requires the published credential refused on every LAN member, and a password write cannot set a channel privilege to no-access. mtcollins1 is a **candidate** only, and nothing is grounded.
-
-What the model holds:
-- **One shape never admits another.** A route grounded for one request shape does not admit an Apply of the other.
-- **A grounding records what it established.** `EffectObserved`, or `AcceptedEffectUnobserved`, computed from before and after readings. A privilege-**lowering** write is admitted only over an effect-observed grounding.
-- **The lockout guard runs before the first dangerous write, including the qualification write itself.** The live transport may be driven only from a sealed admitted qualification request. For the privilege-limit shape, that request requires a sealed, evidence-bound readback from the same run showing the goal's managed account at administrator on that channel. The readback must be for the same controller and build, with one unambiguous row.
-- **mtcollins1's qualifying request is non-destructive.** It re-asserts the value already there. That grounds acceptance only, so it does **not** admit closing the factory administrator.
-
-**What mtcollins1's wet transition therefore needs, in order.** Each item is an operator-gated act; eager-gull-22 batches them into one go-ahead.
-1. A committed read-only post-reflash probe: firmware version, channel info for every channel, and user access and user name for every user id on each LAN channel. The last of these is what lets a candidate name a spare slot.
-2. Qualify Set User Password at 0.45.3.
-3. Converge the managed account and read it back.
-4. Qualify the privilege-limit shape with a **discriminating, harmless** request: a spare user slot changed, read back, then restored.
-5. Only then, the closing write on the factory administrator.
-6. The independent re-read from which `BmcSecure` is derived.
-
-The convergence refuses at each step that is not yet grounded. It never widens.
-
-#### mtjade1's wet sequence (operator ruling, 2026-10-06)
-
-**The ruling.** Given by the operator directly in eager-gull-22's session and relayed in dashboard message `msg_7402f8df`: live operations on mtjade1 are authorized whenever and indefinitely, with no per-run approval. That covers BMC reads and writes (history archive, login and credential change), boots, and firmware qualification on Mt. Jade. **The scope is mtjade1 only**: mtcollins1's wet steps still need their own go-ahead.
-
-**Where it lives.** The ruling is recorded as a standing grant in `gunbc.auth.standing_operator_grant`, not here. That module's `StandingOperatorGrant` is scoped today by a Spark `FabricGroup`, so its scope is re-derived to also name a managed-host subject, with Group A's meaning unchanged. The grant carries only effects that a gate consumes (§3c). Each covered effect is classified by executing `gunbc.auth.authorization_pattern_selection` and gets its row in `gunbc.auth.privileged_effect_census`. An effect whose consuming gate has not landed is a declared frontier, not a row.
-
-**What the ruling does not change.** It discharges the per-run approval only. Every other wall stands:
-- the route standing;
-- the lockout guard before the first dangerous write;
-- the sealed, evidence-bound readbacks;
-- the per-build grounding;
-- **real readings only.** Anything unmeasured stays a refusal; nothing is defaulted or transcribed from another unit or another build.
-
-**Order.** Each step lands as a committed, digest-cited capture or receipt, taken from srv1 the way the 2026-10-04 Manager and FRU reads were. A step whose consuming code has not landed waits for it.
-
-| # | Step | Consumed by | Waits on |
-|---|---|---|---|
-| J0 | The standing grant row for mtjade1 | the gates below | its own PR (no hardware) |
-| J1 | Read-only probe at the current build (Wiwynn/AMI MegaRAC SPX, firmware `2.11.104000`): channel info for every LAN channel; user access and user name for every user id; SDR record names and readings; the controller clock | O1a route standing, O1b `BmcSecure` observe, `gunbc.megarac_operation_standing` `BuildReading` | J0 (reads only) |
-| J2 | **Prior-life archive**, read-only on the BMC: all eight carriers captured from the box, archived and read back by digest; the cursor derived from the archive | O1c-2 `PriorLifeBoundary` | #13419 landed |
-| J3 | **Per-build MegaRAC operation evidence** at `2.11.104000`: virtual-media attach, a KVM canvas still, SDR socket naming; each an executed receipt, never a recovered or transcribed one | `gunbc.machine_intake_megarac_operation_evidence`, `admit_megarac_host_at_current_build` | J1 |
-| J4 | **Login and credential change**: `BmcSecure` Apply through the route O1a grounds at this build, the lockout guard first, then the independent re-read from which `BmcSecure` is derived; then mtjade1's `ManagedHostAdmission` record | O1c-3 (the gate discharged by the J0 grant; the admission population) | O1c-3 landed, J1 grounding the routes |
-| J5 | **Board figure and BMC-stack readings measured on the box**: SMBIOS type 17 locators and the DIMM population; fan and sensor names | a Mt. Jade figure for cut 6's board selection, from the cited Mt. Jade guide joined to these readings; cut 5's family-selected fan policy | J1, and the board-identity decision below |
-| J6 | **Boots** | the host-generic boot run | cuts 4b-ii and 4d, then O2 |
-
-**mtjade1's board is not `GigabyteMp72Hb0`.** Its FRU capture (`artifacts/bmc/mtjade1-ipmitool-fru-print-192.168.1.246-2026-10-04T110207Z.txt`) reads Board Mfg `WIWYNN`, Board Product `Mt.Jade Motherboard`, part `B81.03010.0041`. `extdeps.boards.types` `GigabyteMp72Hb0` is a different board: a candidate reference row with no fleet instance.
-
-Cut 6's selection is keyed by the closed `BaseboardModel`. `extdeps.ocp.mt_jade.platform` deliberately keeps Mt. Jade out of that enum: adding a board must not edit a generic product enum (§3, external upstream decomposition). So J5 has two prerequisites, and it does not add an enum arm:
-- **Board identity:** decide how a bound host's board identity reaches the per-board authority (`extdeps.ocp.mt_jade` and `extdeps.ampere.mt_jade_getting_started_guide`), read from that host's own FRU.
-- **Re-key the selection:** cut 6's figure selection moves to that identity. If it stays on the closed enum, the closed enum is a §3 hub.
-
-Until both are done, mtjade1's orientation refuses.
-
-**What stays a refusal until measured:**
-- Mt. Jade's DIMM figure: none is authored from the guide alone, and nothing comes from proprietary documents.
-- A MegaRAC operation not executed at `2.11.104000`.
-- A route not grounded at this build.
-- mtjade1's managed-host membership, until J4's record exists.
-
-#### `BmcSecure` as a desired state (O1b)
-
-Today `derive_bmc_secure` is rotation-event shaped. A rejected bootstrap credential is `PreviouslyRotatedCredentialRequired`, an accepted one with no rotation is `CredentialRotationNotApplied`, and only `RotationApplied` with an advanced epoch can mint `BmcSecured`. **So a correctly secured controller cannot be observed as a Noop through the existing fold.** The phase is therefore decomposed in `gunbc.machine_intake_bmc_secure`, with its conjunction unchanged:
-
-1. **Observe** the current managed-account and published-account state: the managed probe, plus the published probes joined to the channel census. This is independent of whether this run rotated anything.
-2. **Noop only when the full existing conjunction already holds.**
-3. Otherwise **Apply** a typed account action over the grounded route.
-4. **Re-read independently** and derive `BmcSecure` from that readback.
-
-**Secret order, structurally.** The new credential generation is generated and stored under the unit's `SecretRef`, and its **exact resolved version is fetched**, before the account write and before the managed probe. Later consumers materialize that same `SecretRef` generation through `gunbc.auth.secret_ref_credential` `fetch_secret_ref_credential`. The earlier table's separate "managed secret materialized" row after `BmcSecure` was wrong: the rotation path cannot first obtain the secret after it has supposedly completed.
-
-Controls:
-- already secured → Noop;
-- managed accepted and factory accepted → not Noop;
-- reflash-restored factory access → the same Apply and readback path, with no second recovery authority.
-
-**Ruling on mtcollins1's standing (eager-gull-22, 2026-10-04): staged, option C.**
-- **Measured by O1b.** The committed `BmcSecured` standing is the 2026-09-13 observation on BMC 0.32. The 2026-10-02 reflash to 0.45.3 changed the subject and re-enabled the factory `admin`. No post-reflash readback is committed. So the honest standing for the current subject is not secured, and landing that alone would empty `managed_hosts()` and stop boot, reset, hold and federation admission.
-- **O1b lands in shadow.** Boot is gap-intolerant, so O1b lands the state-shaped derivation, the carriers, the clock and the controls, with mtcollins1's live observation and the rotation-event path untouched and frozen.
-- **One later transition** lands the honest re-expression and deletes the old path, **together with** a committed read-only post-reflash probe and the operator-approved wet `BmcSecure` Apply on mtcollins1.
-- **Declared drop.** Until then, main's stale claim is a declared drop under `gunbc.rung_drop`, whose trigger is that capability.
-- **What the state-shaped fold refuses** (side-chat reviews of #13221). The firmware build that admits a route is read from the observation, never supplied. The published account's replacement is the goal's exact break-glass generation, checked before the write, in the assessment and in the post-read. An unaddressed LAN channel, or channel access not closed, is refused with a typed cause naming the missing operation; it is not planned as a password write.
-- **`rotation_route_consumption_frontier` stays open** until the planner is on a production path. This shadow cut supplies the consumer's code, not its production route.
-- **Order on the hardware:** the operator's DIMM change, then cut 2 (#13131) landing, then the probe and the wet `BmcSecure`, then the census boot the runner lane needs, on a secured BMC.
-
-**mtcollins1 is not assumed satisfied.** This withdraws the earlier sentence that it "enters at its satisfied state and every step is a Noop". After the 2026-10-02 reflash the `gunbc` user and IPMI admin were restored by hand and the factory `admin` was not disabled (eager-gull-22, 2026-10-03). The readback is therefore expected to find managed accepted and factory accepted: not Noop.
-
-**Firmware re-entry.** `gunbc.fleet.mtcollins_firmware_converge` `BmcCredentialReestablishment.ipmi` is today a supplied `BmcSecureStanding`. It becomes this phase's result, for the post-reflash subject.
-
-#### Managed-host admission: a durable, named population (O1c)
-
-`managed_hosts()` is today a source roster with one construction-confined row. A runtime convergence cannot add a row, and the earlier sentence "mtjade1 joins by converging, not by edit" is withdrawn. Membership needs a durable authority, and the repository already has the mechanism: an intake fact is a **git-tracked observation consumed at mint time**. So:
-
-- **`ManagedHostAdmission`**: one committed record per unit. It is authored from that unit's arrival receipts in the unit's own observation module, the way the mtcollins1 observations are today. It retains:
-  - `HostIdentity` ↔ the exact `MachineIntakeSubject`;
-  - the access and capability standing;
-  - the `BmcSecureStanding`;
-  - the unit-hold decision;
-  - the receipt identity and its currency.
-- **`managed_hosts()` becomes a projection** over the admission records. A unit is a member only when its record is complete, its standings are bound to the same subject, and that subject is current.
-- **Absent, not defaulted.** A secured unit with no hold decision, with no host allocation, or with a receipt for another subject, is absent.
-- The boot and reset consumers enumerate that same population (they already read `managed_hosts()`).
-- `managed_host_binding` stays what it is: a pure join over a row. It is not the membership event.
-
-So mtjade1 joins when its receipts are committed and its admission record is authored, which is an edit of evidence and never of the roster's logic.
-
-#### Receipts and clock: domain carriers, not `gunbc.ensure` alone (O1b, O1c)
-
-`gunbc.ensure` says of itself that its before and after observations and its satisfaction Booleans are caller-supplied, that one observation can be passed twice, and that it does not prove the decided plan is the effect that ran. So "ensure-style" is the decision shape only. For every effectful phase, the effect authority mints a **construction-confined domain carrier** that binds:
-
-`subject + phase + admitted plan + application receipt + independent post-read + evidence`
-
-The dry realization over `gunbc.bmc_model` `BmcWorld` exercises those carriers, not only the generic Noop / Apply / Refuse arms.
-
-**Observer clock.** `bmc_secure` carries bare `EpochMs`, so a comment cannot make a controller-sourced time unconstructible. O1b introduces an observer-clock timestamp whose only producer is `gunbc.clock_read`, and every ordering field in the phase consumes it. The controller's year-2000 clock is preserved as an `AccessDiscover` observation and can never be the ordering clock. Control: a controller-sourced year-2000 timestamp cannot satisfy the rotation and readback ordering, and an observer timestamp can. Setting the BMC clock is a write and is out of scope.
-
-#### The convergence fold: one shared home, landed with its first consumer (O1c-1)
-
-**Why this is here** (eager-gull-22, 2026-10-03). The Spark serving bring-up (valiant-crab-775) needs the same thing cut O does: several effectful steps run as one convergence instead of separately dispatched modes that a human sequences. The operator pointed that lane at this one. The home lands **once**, with cut O and the Spark arm as its consumers. It does not go inside `gunbc.machine_intake_arrival_converge`.
-
-**What already exists (DFS before naming anything).**
-- **The per-step lifecycle has a consumed home.** `gunbc.host_convergence_protocol` is the canonical protocol from the CONVERGENCE-ONE program (`docs/plans/convergence-one-program.md`): select, observe goal-blind, assess, plan, admit, apply, independently read back, terminal verdict.
-  - `HostEffectDomainProjection { observe, assess, decide }`, `inspect_via_host_effect_projection` and `reconcile_from_read_attempt` are the step.
-  - `gunbc.ensure` is a projection of it.
-  - That program's own rule: "anything that calls itself convergence without running that lifecycle is a second convergence algebra".
-- **The roster of persistent host effects has a home.** `gunbc.host_convergence_census` `host_convergence_census_rows`. Each arrival phase's effect, and each Spark step, is a row there. It is not a parallel list.
-- **The sealed receipt is the domain's.** `std.realization_reconcile` states that std cannot seal the relation decided plan ↔ performed plan ↔ evidence without accepting a law from the caller it would be checking, and that the binding "is the DOMAIN's obligation, discharged by a domain carrier minted only by the authority that performed the effect" (worked example: `gunbc.typed_remote_file_write` `RemoteFileConverged`). So there is **no generic sealed receipt** to build. O1b's `BmcSecure` receipt and Spark's receipts stay domain carriers.
-
-**What is still open in that home, stated honestly** (side-chat review of `5044d42`). Ordered composition is not the only missing piece.
-- **The protocol's apply side is an awaiting frontier.** `host_effect_decide_apply_frontier` is `FrontierConsumerAwaiting`: `converge_apply_for_host` bypasses `HostEffectDomainProjection` and calls `host_effect_apply` directly. That is CONVERGENCE-ONE's unbuilt C8.
-- **`gunbc.ensure` `ensure_reconcile` does not execute the lifecycle.** It classifies reports.
-
-**The boundary this plan takes: (B).** The fold **composes already-executed, domain-owned step outcomes**. It does not execute the protocol and does not claim to.
-- Each domain runs its own step (observe, decide, apply, read back) and mints its own sealed receipt.
-- The fold orders step instances, checks preconditions against those receipts, and produces the run's ledger.
-- **C8 stays open.** It is discharged only by a production route through the projection's apply side. Nothing in cut O claims to discharge it. If an O1c PR does route a real apply through the projection, it says so and retires the frontier by its own trigger.
-
-It goes in the workflow layer, `gunbc.fleet`. It does not go in std, because lanes, principals and resumability are fleet policy. The module is named by DFS when built.
-
-**The runtime steps are joined to the census, so the census stays the roster.**
-- `StepInstanceKey { run, step_identity, subject }` identifies a step instance.
-- Every runtime step maps to **exactly one** `HostConvergenceCensusRow`.
-- A missing, extra, duplicate or unresolved identity refuses.
-- A duplicate `(run, step, subject)` also refuses.
-
-Without that identity join the runtime list would become the real roster and the census would be commentary.
-
-**Its shape, tested against two real consumers:** cut O's five arrival phases, and the Spark arm's steps S1–S9 (image produce and distribute, checkpoint seed and replica, sudo grants, claim recovery, supersede, launch). valiant-crab-775 reviewed the shape on 2026-10-04, and its six corrections are in the table.
-
-| Requirement | Shape | Driven by |
-|---|---|---|
-| A step | an identity; a `HostEffectDomainProjection`; its domain receipt type; its preconditions. **A step instance is step × subject**: the Spark steps are per (host, artifact), the arrival steps per unit. | both |
-| Preconditions | step identities **with a quantifier over subjects**: all-of or any-of, each over a stated subject set. So "3 of 4 hosts converged" is representable as partial progress and is not read as a refusal. | Spark S9 (S3, S5, S6 on all hosts); S5 (S4 verified on some peer) |
-| Order | derived from preconditions by an identity join (an unknown identity or a cycle refuses). **Where an order authority already exists, each step is bound to one member of it and the derived order must agree with that authority's ranking, or refuse.** For cut O, each step is bound to one `IntakePhase` and checked with `intake_phase_rank`. The roster is a projection of the authoritative order (2 phases in O1c-1, 4 in O1, 5 with O2), not the 12-phase list itself. | arrival (authority), Spark (derived) |
-| Per step | the canonical protocol, unchanged: Noop / Apply / Refuse, independent readback, the domain receipt minted by the effect authority | both |
-| Precondition satisfied | only by a **readback in this run** of the precondition instance: a receipt for the same subject. Never by an earlier step's return value. **Which readback is sufficient is the domain's declaration**, and the fold does not force the most expensive one. A domain may declare a cheap identity readback that binds to an earlier full-verification receipt, and it must then state what that cheap readback does and does not establish (§4b rung honesty). | both; Spark S5, whose full verify re-hashes the whole checkpoint on every host |
-| Refusal | names the unmet step by identity. The fold may take that step **only if it is in the roster and ungated**. A gated step stops with a typed refusal naming the discharge it needs. | Spark S9 naming S6/S7; the arrival credential write |
-| Gate | a step is ungated, or gated on an authorization discharged for that subject and that run. The pattern comes from `select_authorization_pattern`, selected **before** the fold (§3d: the fold chooses nothing). | arrival `BmcSecure`; Spark S7 |
-| Principal | per step, from the same selection. A step whose principal is not bound refuses. | Spark S6/S7 vs S9 |
-| No fallback arms | a step with no admissible realization refuses; it never widens (§5) | Spark S5: no verified peer, no Hub fallback |
-| Uncertain completion | an applied step whose readback does not yet ground is **pending**, distinct from converged and from refused. A rerun re-observes and reattaches. A pending instance never satisfies a precondition. **Only its dependents wait.** Independent instances proceed in the same run; otherwise every run degenerates to one step. | Spark S2/S4 (hours, resumable) while S3 and S6 proceed; arrival archive |
-| Deadline | every effect leg carries a deadline. A leg with none is unconstructible. | Spark's ssh leg that hangs instead of refusing |
-| Lane | the set of hosts a run may mutate is derived from its step instances' **mutated subjects**, one lane per affected host. **The executor host that dispatches the run is not a lane key.** | Spark, where every mode dispatches from srv1 and collides there; the arrival unit hold |
-| Verdict | one ledger per run: each step instance converged, pending, refused, or not reached. **A refusal stops the line. A pending instance does not.** | both |
-| Selected before the fold | everything that is a choice: the route, the authorization pattern, the principal, and **roles** such as seed versus replica. A role derived inside a step is how a silent fallback happens. | arrival route (O1a); Spark S4/S5 roles |
-| Not a step | a **measurement** is not a persistent host effect. It consumes a converged verdict and produces an observation receipt, outside the fold and outside the census. Otherwise "converged" comes to mean "benchmarked". | Spark S10 (load) |
-
-**Workflow surface.** Lane derivation changes concurrency groups in the generated workflow, which is an operator-visible surface. Cut O's use changes none: it runs inside the existing `mtcollins1_boot` job and its unit hold. The Spark arm's reshaping of its modes is that lane's proposal to the operator, not part of this cut.
-
-**§3c, and the pairing obligation: each capability lands with its first REAL consumer.** A fold with no consumer is a dangling declaration, and a capability exercised only by a designed fixture has no inhabitance claim (`DESIGN.md` §3, "a witness discriminates at one interface"). So the fold is not built whole in one PR. Each row of the shape table arrives in the PR whose consumer really exercises it:
-
-| PR | Real consumer | Capabilities it brings |
-|---|---|---|
-| **O1c-1** | the arrival prefix's two **read-only** phases, `AccessDiscover` (with the O1a route standing) and `IdentityBindProvisional` | the read-only scheduler core: `StepInstanceKey`; the census join and its refusals; step-to-`IntakePhase` binding and the rank check; preconditions satisfied by an in-run readback receipt; refusal naming the unmet step; the run ledger. **No apply, gate, lane, deadline or pending arm.** |
-| **O1c-2** | `PriorLifeBoundary`'s archive (an effect that writes evidence and can be incomplete) | an applied step with its domain receipt; per-leg deadlines; incomplete-versus-refused |
-| **O1c-3** | `BmcSecure` (O1b's receipt) and the `ManagedHostAdmission` population | the authorization gate and its discharge; principal per step; the mutation lane (the unit hold on the store host); apply followed by independent readback |
-| **Spark arm** (valiant-crab-775's lane) | S1–S9 over four hosts | subject quantifiers (all-of, any-of); pending that blocks only dependents; the domain-declared cheap readback; multi-host lanes keyed on mutated subjects |
-
-**Controls land with the capability.**
-- O1c-1's are:
-  - a step whose phase rank disagrees with the authority refuses;
-  - an unknown precondition refuses;
-  - a runtime step with no census row, or two rows, refuses;
-  - a duplicate `(run, step, subject)` refuses;
-  - a precondition is not satisfied by a receipt for another subject.
-- The quantifier, pending and lane controls arrive with the consumer that inhabits them, not earlier with a fixture.
-
-valiant-crab-775 reviews O1c-1's shape before it lands. `DESIGN.md` §3d names the fleet admission spine as this cycle's first consumer, so the shape must not preclude it, and O1c-1's PR says how it fits.
-
-**What O1b changes.** Nothing in its scope. Its observe, assess and decide go through the canonical projection (`HostEffectDomainProjection`), and its effect is a census row. Its apply and readback are the domain's own, with its own sealed receipt, because the projection's apply side is the open C8 frontier.
-
-#### Authorization and what lands
-
-- **The rotation is a privileged effect.** It is classified by executing `gunbc.auth.authorization_pattern_selection` `select_authorization_pattern` over its real attributes, and it gets its row in `gunbc.auth.privileged_effect_census`. The pattern is what the selection returns.
-- **The write is gated inside the single route.** The `BmcSecure` Apply arm refuses unless that authorization is discharged for that unit and that run. A run that finds the unit unsecured with no discharge stops with a typed refusal at `BmcSecure`. It never boots on a factory credential and never widens.
-- **O2 preserves every refusal** the current boot entry makes (admission, authorization, maintenance hold, artifact, medium readback). Each is listed and witnessed in that PR.
-- **The O1 PRs land** the route standing, the state-shaped `BmcSecure`, the observer clock, the convergence through `BmcSecure`, the admission population, and the dry realization with the controls above. **No live credential write** is part of any PR; each unit's write gets its own operator go-ahead, mtcollins1 first.
-- **Password-path frontier.** The remaining wrappers (media attach, KVM, SOL, fan, UI bundle) cut over in cuts 3, 4a, 4d and 5. `mtcollins1_managed_secret_fetch_frontier` is retired when the last one refuses a caller-supplied path.
-- **Workflow surface:** none added. O2's generated-workflow diff is shown in its PR.
-
-#### Decisions (eager-gull-22 for the operator, 2026-10-03)
-
-- **(i) Module name:** `gunbc.machine_intake_arrival_converge`. Approved.
-- **(ii) Read-only reads of mtjade1 with the factory credential:** no separate sign-off; the operator approved hands-on access to the unit on 2026-10-03. **The rotation and any account write do need sign-off.**
-- **(iii) First wet subject:** mtcollins1, with its unsecured state treated as likely real.
-- **(iv) Workflow mode:** approved as a **re-root of the existing `mtcollins1_boot` mode**, not a new mode. The live credential write on each unit still gets its own go-ahead.
-
-### Terminal receipt owed by every cut (review item 5)
-
-These modules are outside the required gate, so a green required run proves nothing about them. Each PR's description carries all of the following:
-
-1. **Consumer witnesses, run by name.** The cut's complete consumer roster, recomputed at the PR head with the census method below and included in full in the PR description. Each named witness is executed with `gunbc run` against the head, with binary path and build sha printed.
-2. **A same-path RED.** On the acceptance path the cut's witness actually runs, remove the binding the cut introduced (the `ManagedHost` row, the standing arm, the parameter) and show the named witness refusing. Then restore it and show it accepted. A RED reached by a different route does not count.
-3. **A corpus sweep.** `git grep` at the head for every deleted module name and symbol, across `.dag`, `.rs`, `.yml`, `docs/` and `artifacts/`. Every remaining hit is classified with the dispositions in the non-import census below.
-4. **No aliases.** No module re-exports, wraps or renames-through the deleted root, and no `mtcollins1_*` function is a one-line call into the generic one.
-
-## Non-import census (review item 4)
-
-These occurrences do not refuse through an import edge, so the import census above cannot see them. They are measured at `26e99a9c7f` and dispositioned by surface. **migrate** means the owning cut changes it. **receipt** means it is deliberately unit-named and stays. **residue** means it is historical prose and stays as written.
-
-| Surface | Population | Disposition |
-|---|---|---|
-| `.github/workflows/fleet-converge.yml` (projection of `gunbc.fleet_converge_workflow`) | 118 occurrences: 8 mode literals and about 30 step/job ids | **migrate**, cut 7 only, regenerated from the authority. Never hand-edited. |
-| `.github/workflows/mtcollins-canary.yml` | a hand-authored scaffold by its own header; `runs-on: [self-hosted, mtcollins]` | **migrate or retire** in cut 7, and only with the operator's ruling. The runner label is a live registration (`gunbc.runner_registration_labels`). |
-| `"mtcollins1_*"` string literals in `.dag` (mode names, step ids, effect rows) | 34 files. The largest are `gunbc.fleet_converge_workflow` (26), `gunbc.auth.privileged_effect_census` (11), `gunbc.ci_spec` (11), `mtcollins1_boot_run` (10), `mtcollins1_memory_census_observation` (10) | **migrate** in the cut that owns the named step. The privileged-effect rows follow cut 4c and 7. Unit-observation literals are **receipts**. |
-| Entry-path strings `"dag/gunbc/machine_intake/mtcollins…"` in `.dag` | `gunbc.non_fold_residue` (45), `gunbc.ci_spec` (11), `v2.workflow.floor_unimported_bare_provider_debt_roster` (4), and 5 single occurrences | **migrate**: every cut that moves a file updates these rows in the same PR. Each is a path a deletion does not refuse. |
-| `artifacts/bmc/mtcollins1-*` (17 files) | captured evidence; paths cited by unit observations | **receipt**: never renamed, because the content hashes bind the path. |
-| `docs/probes/mtcollins*` (12), `docs/rung-drops/*` (1), `docs/design-rung-drops.md` | dated observations and declared drops | **receipt**. |
-| `docs/plans/*` (14 files other than this one), `docs/recovered/*`, `ROADMAP.md` (2) | dated plans; the roadmap goal "Bring Mt. Collins unit 1 into service" is correctly unit-named | **residue / receipt**. Not edited by these cuts. |
-| `src/v1/stage0/src/cli_run.rs` (1) | a comment | **residue**. |
-| The IAM condition description string beginning `gunbc.auth.mtcollins1_boot_federation: the one version …` (kept by cut 4c in `gunbc.auth.managed_host_boot_federation`) | part of a **live** IAM binding condition | **receipt**: it must stay byte-identical until a deliberate re-provision. A name sweep must not "fix" it, although it names a deleted module. |
-
-Exact token `mtcollins1_boot`: 19 files at `26e99a9c7f`, all inside the populations above.
-
-## Census method: a one-off, re-run by each cut (not an instrument)
-
-No entry point in the tree derives an import-graph consumer roster, and building one is outside this program. So the census is a **one-off measurement** (DESIGN §6), and no snapshot of its output is the authority for anything.
-
-**Each cut re-runs it at its own PR head** over its own deleted roots, and puts the **complete** consumer roster in that PR's description, bound to that head sha. That roster is the §3 "enumerate the consumers by name before you delete" receipt for the cut, and it lives with the deletion it licenses, where it cannot go stale.
-
-The method:
-1. Walk `dag/` and `src/v2/` for `.dag` files.
-2. Read each `^module` and each `^import <name>`.
-3. The population is the modules whose name or text matches `mtcollins` (case-insensitive).
-4. Consumers are the reverse import edges.
-5. Gate membership is the transitive import closure from the modules matching `v2.workflow.required_floor` `required_gate_prefixes`.
-6. Imported unit symbols are the names inside each module's `import … { … }` lists that match `mtcollins|mt_collins|MtCollins`.
-
-It is a regex over source text, so it censuses *import shapes*. The terminal receipt's corpus sweep and the non-import census above cover what an import edge cannot see.
-
-## Census
-
-The layer is assigned per module from its subject.
-- **R** = mentions the unit only in prose or receipts.
-- **W** = witness.
-
-Consumers list production importers by name, truncated after six with a count, plus the number of witness importers. **This table is a dated reading aid at `26e99a9c7f`, used to plan the order. It is not a consumer receipt: each cut recomputes its own roster at its head (see Census method).**
-
-### Layer 3 — silicon (3 modules)
-
-| module | lines | refs | unit/platform constants imported | consumers (import census) | gate |
-|---|---|---|---|---|---|
-| `gunbc.machine_intake_ampere_dram_console_observation` | 314 | 2 | — | `gunbc.machine_intake_ampere_socket_console_observation`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle` · 1 witness | no |
-| `gunbc.machine_intake_ampere_socket_console_observation` | 503 | 2 | — | `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle` · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_smpro_observation` | 395 | 36 | `mtcollins1_endpoint` | `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.machine_intake_mtcollins1_boot_phase_timing`, `gunbc.machine_intake_mtcollins1_boot_run` · 3 witness | no |
-
-### Layer 5 — fleet procedure (53 modules)
-
-| module | lines | refs | unit/platform constants imported | consumers (import census) | gate |
-|---|---|---|---|---|---|
-| `extdeps.provisioning.ubuntu_seeded_install_media` | 196 | 1 | — | `extdeps.provisioning.ubuntu_seeded_install_media_remaster`, `gunbc.machine_intake_megarac_media_attach`, `gunbc.machine_intake_mtcollins1_boot_authorization`, `gunbc.machine_intake_mtcollins1_census_image`, `gunbc.machine_intake_mtcollins1_census_image_publish`, `gunbc.machine_intake_mtcollins1_census_medium_readback` +4 more · 7 witness | no |
-| `extdeps.tools.xorriso` | 151 | 1 | — | `extdeps.provisioning.ubuntu_seeded_install_media_remaster`, `extdeps.provisioning.ubuntu_seeded_install_media_toolchain`, `gunbc.host_effect_realize`, `gunbc.machine_intake_mtcollins1_census_member_readback` · 2 witness | no |
-| `gunbc.auth.fleet_secret_accessor_roster` | 95 | 6 | `mtcollins1_bmc_gunbc_secret_ref` | `gunbc.auth.approval_mac_key_provision`, `gunbc.spark.secret_access_ensure` · 1 witness | no |
-| `gunbc.auth.gcp_iam_converge` | 893 | 4 | `mtcollins1_boot_dedicated_federation` | `gunbc.auth.gcp_iam_converge_run`, `gunbc.fleet_converge_workflow` · 1 witness | no |
-| `gunbc.auth.gcp_iam_converge_federation` | 67 | 1 | — | `gunbc.auth.gcp_iam_converge`, `gunbc.fleet_converge_workflow` | no |
-| `gunbc.auth.heal_publisher_provision` | 500 | 1 | — | `gunbc.auth.gcp_iam_converge`, `gunbc.auth.mtcollins1_boot_federation_provision`, `gunbc.namecheap.federation_provision` · 2 witness | no |
-| `gunbc.auth.mtcollins1_boot_federation` | 157 | 43 | `mtcollins1_bmc_gunbc_secret_ref` | `gunbc.auth.gcp_iam_converge`, `gunbc.auth.mtcollins1_boot_federation_provision`, `gunbc.auth.privileged_effect_census`, `gunbc.fleet_converge_workflow` · 1 witness | no |
-| `gunbc.auth.mtcollins1_boot_federation_provision` | 39 | 28 | `mtcollins1_boot_secret_grants`, `mtcollins1_boot_service_account`, `mtcollins1_boot_service_account_display_name`, `mtcollins1_boot_service_account_id`, `mtcollins1_boot_service_account_member` … | `gunbc.auth.gcp_iam_converge` · 1 witness | no |
-| `gunbc.auth.privileged_effect_census` | 1060 | 54 | `mtcollins1_boot_service_account_member` | `gunbc.census_closure_frontier` · 3 witness | no |
-| `gunbc.fleet_converge_workflow` | 4446 | 271 | `gunbc_ci_mtcollins1_boot_admit_invoke`, `gunbc_ci_mtcollins1_boot_invoke`, `gunbc_ci_mtcollins1_boot_job_backstop_timeout_minutes`, `gunbc_ci_mtcollins1_census_image_publish_invoke`, `gunbc_ci_mtcollins1_census_image_step_timeout_minutes` … | `gunbc.generated_artifact_emit` · 11 witness | no |
-| `gunbc.fleet_workflow_steps` | 929 | 4 | — | `gunbc.fleet_converge_workflow` · 2 witness | no |
-| `gunbc.host_reset_return` | 1034 | 2 | — | `gunbc.ci_spec`, `gunbc.fleet_converge_workflow`, `gunbc.host_reset_return_run` · 2 witness | no |
-| `gunbc.host_reset_return_run` | 787 | 3 | — | `gunbc.ci_spec`, `gunbc.fleet_converge_workflow`, `gunbc.machine_intake_mtcollins1_boot_run` · 1 witness | no |
-| `gunbc.host_reset_subject_roster` | 140 | 22 | `mtcollins1_access_observation`, `mtcollins1_bmc_username`, `mtcollins1_capability_row`, `mtcollins1_cdrom_selection`, `mtcollins1_unit_hold_key` … | `gunbc.fleet_converge_workflow`, `gunbc.host_reset_return_run` | no |
-| `gunbc.hostname_allocation` | 111 | 3 | `operator_host_mtcollins1` | `gunbc.deployed_intent_v1`, `gunbc.host_reset_return_run`, `gunbc.network_identity_subsumption` | no |
-| `gunbc.machine_intake_host_capture_envelope` | 749 | 5 | — | `gunbc.machine_intake_host_capture_historical_binding`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.machine_intake_mtcollins1_boot_milestone`, `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_census_image` · 6 witness | no |
-| `gunbc.machine_intake_host_capture_historical_binding` | 348 | 14 | `mtcollins1_census_stages`, `mtcollins1_host_capture_artifact_path`, `mtcollins1_host_capture_byte_count`, `mtcollins1_host_capture_digest` | — · 2 witness | no |
-| `gunbc.machine_intake_host_resource_observation` | 403 | 4 | — | `gunbc.machine_intake_mtcollins1_topology_goal` · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_actuate` | 196 | 41 | `MtCollins1BootStart`, `mtcollins1_access_observation`, `mtcollins1_boot_start_of`, `mtcollins1_capability_row`, `mtcollins1_secured_account` … | `gunbc.host_reset_subject_roster`, `gunbc.machine_intake_mtcollins1_boot_authorization`, `gunbc.machine_intake_mtcollins1_boot_run` · 3 witness | no |
-| `gunbc.machine_intake_mtcollins1_boot_admission` | 52 | 15 | — | `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_kvm_observer_observe` · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_boot_artifact` | 58 | 5 | — | `gunbc.machine_intake_mtcollins1_boot_authorization`, `gunbc.machine_intake_mtcollins1_boot_image_fetch`, `gunbc.machine_intake_mtcollins1_census_image`, `gunbc.machine_intake_mtcollins1_census_image_publish`, `gunbc.machine_intake_mtcollins1_census_medium_readback`, `gunbc.machine_intake_mtcollins1_census_member_readback` +1 more · 2 witness | no |
-| `gunbc.machine_intake_mtcollins1_boot_authorization` | 105 | 61 | `mtcollins1_boot_export_dir`, `mtcollins1_boot_image_sha256`, `mtcollins1_cdrom_selection`, `mtcollins1_census_image_stem`, `mtcollins1_census_volume_id` … | `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_census_medium_readback`, `gunbc.machine_intake_mtcollins1_census_member_readback`, `gunbc.machine_intake_mtcollins1_media_attach` · 9 witness | no |
-| `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle` | 2204 | 214 | `MtCollins1BootPhaseTiming`, `mtcollins1_boot_ipmi_kill_after`, `mtcollins1_boot_ipmi_read_deadline`, `mtcollins1_boot_phase_timing_not_taken`, `mtcollins1_boot_phase_timing_text` … | `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_media_attach` · 8 witness | no |
-| `gunbc.machine_intake_mtcollins1_boot_dry_realization` | 730 | 100 | `mtcollins1_sol_notice_ready_suffix`, `mtcollins1_sol_notice_token_env`, `mtcollins1_sol_notice_watcher_path` | — · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_boot_image_fetch` | 119 | 37 | `mtcollins1_boot_export_dir`, `mtcollins1_diskless_image_name` | `gunbc.machine_intake_mtcollins1_boot_authorization` | no |
-| `gunbc.machine_intake_mtcollins1_boot_milestone` | 133 | 28 | `mtcollins1_nproc` | `gunbc.machine_intake_host_capture_historical_binding`, `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_census_image` · 4 witness | no |
-| `gunbc.machine_intake_mtcollins1_boot_phase_timing` | 255 | 92 | — | `gunbc.machine_intake_mtcollins1_actuate`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.machine_intake_mtcollins1_boot_run` · 2 witness | no |
-| `gunbc.machine_intake_mtcollins1_boot_run` | 2734 | 571 | `MtCollins1BootDiagnosticBundle`, `MtCollins1BootMedium`, `MtCollins1BootPhaseTiming`, `MtCollins1BootRoute`, `MtCollins1BootRunRecord` … | `gunbc.ci_spec`, `gunbc.fleet_converge_workflow`, `gunbc.machine_intake_mtcollins1_boot_dry_realization`, `gunbc.machine_intake_mtcollins1_sol_notice` · 8 witness | no |
-| `gunbc.machine_intake_mtcollins1_census_image` | 220 | 76 | `mtcollins1_boot_export_dir`, `mtcollins1_census_stages`, `mtcollins1_diskless_image_name` | `gunbc.machine_intake_mtcollins1_boot_authorization`, `gunbc.machine_intake_mtcollins1_census_image_publish`, `gunbc.machine_intake_mtcollins1_census_medium_readback`, `gunbc.machine_intake_mtcollins1_census_member_readback`, `gunbc.machine_intake_mtcollins1_media_attach` · 9 witness | no |
-| `gunbc.machine_intake_mtcollins1_census_image_publish` | 267 | 46 | `mtcollins1_boot_export_dir`, `mtcollins1_boot_export_host_target`, `mtcollins1_census_image`, `mtcollins1_census_image_stock_path`, `mtcollins1_census_pinned_image` | `gunbc.ci_spec`, `gunbc.fleet_converge_workflow` · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_census_medium_readback` | 260 | 74 | `MtCollins1BootMedium`, `MtCollins1CensusMedium`, `MtCollins1StockInstallerMedium`, `mtcollins1_boot_export_dir`, `mtcollins1_boot_export_host_target` … | `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_census_member_readback` · 3 witness | no |
-| `gunbc.machine_intake_mtcollins1_census_member_readback` | 483 | 34 | `MtCollins1BootMedium`, `MtCollins1CensusMedium`, `MtCollins1StockInstallerMedium`, `mtcollins1_boot_export_host_target`, `mtcollins1_boot_medium` … | `gunbc.ci_spec`, `gunbc.fleet_converge_workflow`, `gunbc.machine_intake_mtcollins1_census_image_publish` · 2 witness | no |
-| `gunbc.machine_intake_mtcollins1_census_qemu_host_observe` | 294 | 11 | — | `gunbc.ci_spec`, `gunbc.fleet_converge_workflow`, `gunbc.machine_intake_mtcollins1_census_qemu_toolchain_converge` · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_census_qemu_toolchain` | 172 | 1 | — | `gunbc.machine_intake_mtcollins1_census_qemu_host_observe`, `gunbc.machine_intake_mtcollins1_census_qemu_toolchain_converge` · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_census_qemu_toolchain_converge` | 41 | 8 | — | — | no |
-| `gunbc.machine_intake_mtcollins1_census_refusal_hypotheses` | 356 | 13 | — | — · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_diskless_boot_receipt` | 144 | 12 | — | — | no |
-| `gunbc.machine_intake_mtcollins1_handoff_probe` | 63 | 14 | `mtcollins1_access_observation`, `mtcollins1_capability_row`, `mtcollins1_firmware` | — | no |
-| `gunbc.machine_intake_mtcollins1_maintenance_hold` | 763 | 58 | `operator_host_mtcollins1` | `gunbc.fleet_converge_workflow`, `gunbc.host_reset_return_run`, `gunbc.host_reset_subject_roster`, `gunbc.machine_intake_mtcollins1_actuate`, `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_kvm_observer_observe` +2 more · 5 witness | no |
-| `gunbc.machine_intake_mtcollins1_media_attach` | 427 | 111 | `MtCollins1BootSubject`, `MtCollins1MediaAttachRecord`, `mtcollins1_boot_chassis_power`, `mtcollins1_boot_export_dir`, `mtcollins1_boot_ipmi_kill_after` … | `gunbc.machine_intake_mtcollins1_boot_run` · 4 witness | no |
-| `gunbc.machine_intake_mtcollins1_memory_census_observation` | 916 | 172 | `MtCollins1ControllerFruIdentity`, `mtcollins1_controller_fru_identity` | `gunbc.machine_intake_host_capture_historical_binding`, `gunbc.machine_intake_mtcollins1_bmc_secure_observation`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.machine_intake_mtcollins1_boot_milestone`, `gunbc.machine_intake_mtcollins1_topology_goal` · 3 witness | no |
-| `gunbc.machine_intake_mtcollins1_netboot_client_observation` | 73 | 11 | — | `gunbc.machine_intake_pre_os_capture_replay`, `gunbc.machine_intake_pre_os_observer`, `gunbc.site_uefi_arm64_pxe_edge` · 6 witness | no |
-| `gunbc.machine_intake_oob_boot_handoff` | 542 | 2 | — | `gunbc.host_reset_return_run`, `gunbc.host_reset_subject_roster`, `gunbc.machine_intake_mtcollins1_actuate`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.machine_intake_mtcollins1_boot_phase_timing`, `gunbc.machine_intake_mtcollins1_boot_run` +1 more · 5 witness | no |
-| `gunbc.machine_intake_pre_os_bringup_attempt` | 370 | 2 | — | `gunbc.machine_intake_mtcollins1_32dimm_bringup_observation`, `gunbc.machine_intake_mtcollins1_sixteen_module_restore_observation` · 1 witness | no |
-| `gunbc.machine_intake_pre_os_bringup_verdict` | 633 | 1 | — | `gunbc.machine_intake_mtcollins1_32dimm_bringup_observation`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_sixteen_module_restore_observation`, `gunbc.machine_intake_pre_os_capture_replay`, `gunbc.machine_intake_pre_os_observer` +2 more · 6 witness | no |
-| `gunbc.machine_intake_pre_os_capture_replay` | 175 | 27 | `mt_collins_channel_population_roles`, `mtcollins1_first_own_image_boot`, `mtcollins1_host_nic_mac`, `mtcollins_3ds_capture_path`, `mtcollins_3ds_capture_sha256` … | — · 2 witness | no |
-| `gunbc.machine_intake_pre_os_observer` | 139 | 1 | — | `gunbc.machine_intake_pre_os_capture_replay`, `gunbc.machine_intake_pre_os_inventory_assessment`, `gunbc.machine_intake_pre_os_timeline` · 3 witness | no |
-| `gunbc.machine_intake_pre_os_timeline` | 392 | 3 | `mtcollins_dram_cycle_start` | — · 1 witness | no |
-| `gunbc.machine_intake_sel_stimulus_listener` | 124 | 2 | — | `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.machine_intake_pre_os_capture_replay`, `gunbc.machine_intake_pre_os_replay` · 2 witness | no |
-| `gunbc.machine_intake_terminal_transcript` | 18 | 2 | — | `gunbc.machine_intake_host_capture_envelope`, `gunbc.machine_intake_pre_os_capture_replay`, `gunbc.machine_intake_pre_os_observer` · 1 witness | no |
-| `gunbc.seeded_install_media_policy` | 28 | 1 | — | `gunbc.machine_intake_mtcollins1_census_image`, `gunbc.srv3_seeded_install_media_artifact` | no |
-| `gunbc.site_uefi_arm64_pxe_edge` | 339 | 7 | `mtcollins1_host_nic_mac` | `gunbc.census_closure_frontier`, `gunbc.site_pxe_edge_converge` · 2 witness | no |
-| `gunbc.verified_archive_install` | 235 | 1 | — | `gunbc.machine_intake_mtcollins1_census_qemu_toolchain`, `gunbc.runner_browser_toolchain`, `gunbc.runner_microvm_host_ready` · 3 witness | no |
-
-### Layer 4 — BMC stack (22 modules)
-
-| module | lines | refs | unit/platform constants imported | consumers (import census) | gate |
-|---|---|---|---|---|---|
-| `extdeps.bmc.http` | 350 | 1 | — | `gunbc.fleet_health_observe`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.srv3_boot_once_cd`, `gunbc.tools.bmc_health_reader_converge`, `gunbc.tools.bmc_intake_first_contact`, `gunbc.tools.bmc_onboard` | no |
-| `extdeps.bmc.ipmi` | 410 | 1 | — | `ctl.pos_emit`, `ctl.pos_service`, `gunbc.machine_intake_bmc_fan_observation`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.machine_intake_mtcollins1_boot_dry_realization`, `gunbc.machine_intake_mtcollins1_boot_run` +4 more · 1 witness | no |
-| `extdeps.bmc.ipmi_sel` | 83 | 1 | — | `gunbc.machine_intake_mtcollins1_32dimm_bringup_observation`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.machine_intake_mtcollins1_sixteen_module_restore_observation`, `gunbc.machine_intake_pre_os_bringup_verdict`, `gunbc.machine_intake_sel_stimulus_listener` · 2 witness | no |
-| `extdeps.bmc.ipmitool_observed_output` | 67 | 6 | — | `gunbc.bmc_dry_realization`, `gunbc.machine_intake_mtcollins1_boot_dry_realization` | no |
-| `extdeps.bmc.megarac` | 664 | 5 | — | `extdeps.bmc.access_profile`, `extdeps.bmc.virtual_media`, `gunbc.bmc_implementation_dispatch`, `gunbc.bmc_megarac_web_adapter`, `gunbc.boot_artifact_delivery`, `gunbc.machine_intake_megarac_media_attach` +3 more · 7 witness | **yes** |
-| `extdeps.bmc.megarac_observed_output` | 73 | 1 | — | `gunbc.bmc_dry_realization` | no |
-| `extdeps.bmc.phosphor_fan_control` | 126 | 2 | — | — · 1 witness | no |
-| `extdeps.bmc.redfish_memory_inventory` | 459 | 2 | — | `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle` · 1 witness | no |
-| `gunbc.bmc_model` | 409 | 2 | — | `gunbc.bmc_dry_realization`, `gunbc.bmc_megarac_web_adapter`, `gunbc.machine_intake_mtcollins1_boot_dry_realization` · 5 witness | no |
-| `gunbc.machine_intake_bmc_fan_observation` | 519 | 2 | — | `gunbc.machine_intake_mtcollins1_fan_observe` · 1 witness | no |
-| `gunbc.machine_intake_bmc_rotation_route` | 117 | 1 | — | — · 1 witness | no |
-| `gunbc.machine_intake_megarac_media_attach` | 2107 | 9 | — | `gunbc.bmc_dry_realization`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_media_attach`, `gunbc.machine_intake_mtcollins1_ui_bundle_observe` · 5 witness | no |
-| `gunbc.machine_intake_megarac_served_ui_catalog_observation` | 20 | 2 | — | `gunbc.machine_intake_megarac_ui_features`, `gunbc.machine_intake_mtcollins1_ui_bundle_observe` · 3 witness | no |
-| `gunbc.machine_intake_megarac_ui_features` | 403 | 3 | — | `gunbc.machine_intake_megarac_media_attach`, `gunbc.machine_intake_mtcollins1_kvm_still` · 2 witness | no |
-| `gunbc.machine_intake_mtcollins1_bmc_secure_observation` | 275 | 92 | `mtcollins1_bmc_gunbc_secret_ref`, `mtcollins1_controller_fru_identity`, `mtcollins1_endpoint`, `mtcollins1_firmware`, `mtcollins1_subject_binding` | `gunbc.machine_intake_mtcollins1_actuate`, `gunbc.machine_intake_mtcollins1_fan_observe`, `gunbc.machine_intake_mtcollins1_kvm_observer_observe`, `gunbc.machine_intake_mtcollins1_media_attach`, `gunbc.machine_intake_mtcollins1_platform_observation`, `gunbc.machine_intake_mtcollins1_ui_bundle_observe` · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_bmc_sensor_observation` | 96 | 25 | — | `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle` · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_fan_observe` | 264 | 39 | `mtcollins1_endpoint`, `mtcollins1_secured_account` | `gunbc.ci_spec`, `gunbc.fleet_converge_workflow`, `gunbc.machine_intake_mtcollins1_kvm_observer_observe`, `gunbc.machine_intake_mtcollins1_ui_bundle_observe` | no |
-| `gunbc.machine_intake_mtcollins1_kvm_observer_observe` | 276 | 71 | `mtcollins1_bmc_firmware`, `mtcollins1_boot_host_admission`, `mtcollins1_endpoint`, `mtcollins1_fan_credential_path`, `mtcollins1_fan_credential_path_env` … | `gunbc.fleet_converge_workflow` · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_kvm_still` | 1180 | 43 | — | `gunbc.ci_spec`, `gunbc.fleet_converge_workflow`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle`, `gunbc.machine_intake_mtcollins1_boot_dry_realization`, `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_kvm_observer_observe` · 6 witness | no |
-| `gunbc.machine_intake_mtcollins1_sol_notice` | 438 | 52 | `mtcollins1_boot_sol_capture_path_env`, `mtcollins1_boot_sol_pid_path_env`, `mtcollins1_sol_client_diagnostic_path`, `mtcollins1_sol_delivery_suffix`, `mtcollins1_sol_incident_path` … | `gunbc.ci_spec` · 2 witness | no |
-| `gunbc.machine_intake_mtcollins1_ui_bundle_observe` | 364 | 61 | `mtcollins1_boot_ipmi_kill_after`, `mtcollins1_boot_ipmi_read_deadline`, `mtcollins1_endpoint`, `mtcollins1_fan_credential_path`, `mtcollins1_fan_credential_path_env` … | `gunbc.fleet_converge_workflow` · 1 witness | no |
-| `gunbc.machine_intake_sol_hold` | 344 | 17 | — | `gunbc.ci_spec`, `gunbc.machine_intake_mtcollins1_boot_dry_realization`, `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_sol_notice`, `gunbc.owned_process` · 2 witness | no |
-
-### Layer 2 — platform (16 modules)
-
-| module | lines | refs | unit/platform constants imported | consumers (import census) | gate |
-|---|---|---|---|---|---|
-| `extdeps.ampere.mt_collins_1u_product_brief.specifications` | 228 | 23 | `MtCollins1UPublicProductBrief`, `mt_collins_1u_brief_authority`, `mt_collins_1u_public_product_brief` | `gunbc.machine_intake_mtcollins1_expansion_attachment`, `gunbc.machine_intake_mtcollins1_expansion_candidates`, `gunbc.machine_intake_mtcollins1_expansion_observation` · 2 witness | no |
-| `extdeps.ampere.mt_collins_1u_product_brief.subject` | 102 | 8 | — | `extdeps.ampere.mt_collins_1u_product_brief.specifications` | no |
-| `extdeps.ampere.mt_collins_2u_user_guide.subject` | 68 | 7 | — | `gunbc.mt_collins_dimm_physical_identity`, `gunbc.specification_citation_read_provenance` · 1 witness | no |
-| `extdeps.ampere.mt_collins_getting_started_guide.dimm_layout` | 92 | 32 | `mt_collins_gsg_authority`, `mt_collins_gsg_model_scope` | `gunbc.machine_intake_mtcollins1_dimm_connector_observation`, `gunbc.machine_intake_mtcollins1_physical_orientation`, `gunbc.machine_intake_mtcollins1_socket1_investigation_observation`, `gunbc.mt_collins_dimm_physical_identity`, `gunbc.mtcollins_memory_placement` · 3 witness | no |
-| `extdeps.ampere.mt_collins_getting_started_guide.subject` | 92 | 3 | — | `extdeps.ampere.mt_collins_getting_started_guide.dimm_layout`, `extdeps.ampere.mt_collins_product_brief.memory_population`, `extdeps.ampere.mt_collins_product_brief.platform` · 1 witness | no |
-| `extdeps.ampere.mt_collins_product_brief.bmc` | 59 | 5 | `MtCollinsPublicProductBrief`, `mt_collins_public_product_brief` | — | no |
-| `extdeps.ampere.mt_collins_product_brief.memory_population` | 387 | 85 | `MtCollinsPublicProductBrief`, `mt_collins_gsg_authority`, `mt_collins_public_product_brief` | `gunbc.machine_intake_mtcollins1_dimm_connector_observation`, `gunbc.machine_intake_mtcollins1_physical_orientation`, `gunbc.machine_intake_mtcollins1_spare_screen_prediction`, `gunbc.machine_intake_pre_os_capture_replay`, `gunbc.memory_configuration_evaluation`, `gunbc.mt_collins_dimm_physical_identity` +3 more · 9 witness | no |
-| `extdeps.ampere.mt_collins_product_brief.platform` | 102 | 12 | `MtCollinsPublicProductBrief`, `mt_collins_gsg_authority`, `mt_collins_public_product_brief` | `gunbc.memory_provisioning` · 1 witness | no |
-| `extdeps.ampere.mt_collins_product_brief.subject` | 77 | 8 | — | `extdeps.ampere.mt_collins_product_brief.bmc`, `extdeps.ampere.mt_collins_product_brief.memory_population`, `extdeps.ampere.mt_collins_product_brief.platform` · 1 witness | no |
-| `extdeps.boards.types` | 89 | 1 | — | `extdeps.bmc.access_profile`, `extdeps.boards.asrock_rack`, `extdeps.boards.gigabyte`, `extdeps.cooling.dynatron`, `extdeps.cooling.types`, `extdeps.firmware.types` +13 more · 6 witness | **yes** |
-| `gunbc.machine_intake_mtcollins1_dimm_connector_observation` | 105 | 22 | `MtCollinsDimmDiagramLegend`, `MtCollinsDimmPopulationIdentity`, `MtCollinsDimmPopulationRow`, `mt_collins_population_16_dimms` | `gunbc.machine_intake_mtcollins1_expansion_candidates`, `gunbc.machine_intake_mtcollins1_expansion_observation`, `gunbc.machine_intake_mtcollins1_physical_orientation` · 2 witness | no |
-| `gunbc.machine_intake_mtcollins1_physical_orientation` | 856 | 293 | `MtCollins1ChassisEnd`, `MtCollins1CpuRelease`, `MtCollins1DiagnosisHypothesis`, `MtCollins1FirmwareSocketSummary`, `MtCollins1HypothesisStanding` … | — · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_platform_observation` | 225 | 33 | `mtcollins1_unit_key_standing` | — · 2 witness | no |
-| `gunbc.machine_intake_mtcollins1_topology_goal` | 18 | 7 | `mtcollins1_nproc` | — · 1 witness | no |
-| `gunbc.machine_intake_power_supply` | 25 | 1 | — | `gunbc.machine_intake_mtcollins1_platform_observation` · 1 witness | no |
-| `gunbc.mt_collins_dimm_physical_identity` | 173 | 44 | `MtCollins2uMemoryTopologyCitation`, `MtCollinsChannelConnectorPair`, `MtCollinsChassisFigureOrientation`, `MtCollinsDimmDiagramLegend`, `MtCollinsDimmFigureBank` … | `gunbc.machine_intake_mtcollins1_dimm_connector_observation`, `gunbc.machine_intake_mtcollins1_physical_orientation` · 1 witness | no |
-
-### Layer 1 — unit (17 modules)
-
-| module | lines | refs | unit/platform constants imported | consumers (import census) | gate |
-|---|---|---|---|---|---|
-| `gunbc.machine_intake_mtcollins1_32dimm_bringup_observation` | 695 | 114 | `AmpereMtCollins`, `mtcollins1_firmware`, `mtcollins_training_capture_path`, `mtcollins_training_capture_sha256` | `gunbc.machine_intake_mtcollins1_sixteen_module_restore_observation` · 3 witness | no |
-| `gunbc.machine_intake_mtcollins1_access_observation` | 294 | 45 | `AmpereMtCollins` | `gunbc.host_reset_subject_roster`, `gunbc.machine_intake_mtcollins1_32dimm_bringup_observation`, `gunbc.machine_intake_mtcollins1_actuate`, `gunbc.machine_intake_mtcollins1_bmc_secure_observation`, `gunbc.machine_intake_mtcollins1_boot_authorization`, `gunbc.machine_intake_mtcollins1_boot_diagnostic_bundle` +8 more · 3 witness | no |
-| `gunbc.machine_intake_mtcollins1_connectx4lx_observation` | 108 | 19 | `operator_host_mtcollins1` | `gunbc.machine_intake_mtcollins1_expansion_candidates` · 2 witness | no |
-| `gunbc.machine_intake_mtcollins1_expansion_attachment` | 112 | 6 | `MtCollinsUnitExpansionEvidence`, `mt_collins_1u_ocp_slot` | `gunbc.machine_intake_mtcollins1_expansion_candidates` · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_expansion_candidates` | 87 | 8 | `mt_collins_1u_ocp_slot` | — · 2 witness | no |
-| `gunbc.machine_intake_mtcollins1_expansion_observation` | 186 | 18 | `MtCollins1UExpansion`, `mt_collins_1u_expansion`, `mt_collins_1u_ocp_slot` | `gunbc.machine_intake_mtcollins1_expansion_attachment`, `gunbc.machine_intake_mtcollins1_expansion_candidates` · 2 witness | no |
-| `gunbc.machine_intake_mtcollins1_memory_prediction` | 156 | 8 | — | — · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_sixteen_module_restore_observation` | 304 | 44 | `mtcollins1_pre_os_capabilities`, `mtcollins1_sol_idle_capture`, `mtcollins1_sol_reading`, `mtcollins1_sol_session_banner_digest` | — · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_socket1_investigation_observation` | 389 | 139 | `MtCollinsDimmFigure` | `gunbc.machine_intake_mtcollins1_physical_orientation` · 1 witness | no |
-| `gunbc.machine_intake_mtcollins1_spare_screen_prediction` | 247 | 16 | `MtCollinsDimmPopulationRow`, `mt_collins_population_16_dimms` | — · 1 witness | no |
-| `gunbc.memory_configuration_evaluation` | 396 | 11 | `AmpereMtCollins`, `MtCollinsChannelPopulationRoleStanding`, `MtCollinsPopulationRoleRefusal`, `mt_collins_channel_population_roles`, `mt_collins_socket_dimm_sizes_supported` … | `gunbc.memory_change_evaluation`, `gunbc.memory_change_report` · 2 witness | no |
-| `gunbc.mtcollins_3ds_memory_change` | 132 | 59 | `MtCollinsChannelPopulationRole`, `MtCollinsPopulationRoleRefusal`, `mt_collins_channel_population_roles`, `mtcollins_dram_cycle_start`, `mtcollins_hynix_part` … | `gunbc.machine_intake_pre_os_capture_replay` · 1 witness | no |
-| `gunbc.mtcollins_memory_change` | 197 | 57 | `AmpereMtCollins`, `MtCollinsChannelPopulationRole`, `MtCollinsPopulationRoleRefusal`, `mt_collins_channel_population_roles`, `mt_collins_socket0_channel_pairs` … | `gunbc.machine_intake_mtcollins1_32dimm_bringup_observation`, `gunbc.machine_intake_pre_os_capture_replay`, `gunbc.machine_intake_pre_os_timeline`, `gunbc.mtcollins_3ds_memory_change` · 4 witness | no |
-| `gunbc.mtcollins_memory_placement` | 22 | 4 | `MtCollinsChannelPopulationRole` | `gunbc.memory_configuration_evaluation`, `gunbc.mtcollins_memory_change` · 2 witness | no |
-| `gunbc.rung_drop.mtcollins1_boot_accepts_socket1_absent` | 46 | 27 | — | `gunbc.rung_drop.roster` | no |
-| `gunbc.rung_drop.mtcollins1_boot_matrix_enrolment_dead_band_observed_only` | 44 | 15 | `mtcollins1_boot_matrix_enrolment_dead_band_observed_only`, `mtcollins1_boot_matrix_native_witness_capability` | `gunbc.rung_drop.roster` | no |
-| `gunbc.rung_drop.mtcollins1_boot_matrix_new_witness_eval_step_cost` | 58 | 11 | — | `gunbc.rung_drop.mtcollins1_boot_matrix_enrolment_dead_band_observed_only`, `gunbc.rung_drop.roster` | no |
-
-### Layer R — reference only (keeps prose/receipt; no layer move) (77 modules)
-
-| module | lines | refs | unit/platform constants imported | consumers (import census) | gate |
-|---|---|---|---|---|---|
-| `extdeps.linux.edac` | 214 | 1 | — | `gunbc.machine_intake_mtcollins1_memory_census_observation` · 2 witness | no |
-| `extdeps.linux.mlx5_core` | 33 | 1 | — | `gunbc.machine_intake_mtcollins1_connectx4lx_observation` · 1 witness | no |
-| `extdeps.network.dell_0r887v` | 23 | 1 | — | `gunbc.machine_intake_mtcollins1_expansion_candidates` | no |
-| `extdeps.network.ibm_01ft753` | 40 | 1 | — | `gunbc.machine_intake_mtcollins1_expansion_candidates` | no |
-| `extdeps.network.mcx4121a_acat` | 53 | 1 | — | `gunbc.machine_intake_mtcollins1_connectx4lx_observation`, `gunbc.machine_intake_mtcollins1_expansion_candidates` | no |
-| `extdeps.network.mcx4411a_acan` | 24 | 1 | — | `gunbc.machine_intake_mtcollins1_expansion_candidates` | no |
-| `extdeps.network.mcx4421a_acan` | 24 | 1 | — | `gunbc.machine_intake_mtcollins1_expansion_candidates` | no |
-| `extdeps.network.mcx4621a_acab` | 24 | 1 | — | `gunbc.machine_intake_mtcollins1_expansion_candidates` | no |
-| `extdeps.standards.nic_attachment` | 62 | 1 | — | `extdeps.ampere.mt_collins_1u_product_brief.specifications`, `extdeps.network.dell_0r887v`, `extdeps.network.ibm_01ft753`, `extdeps.network.mcx4121a_acat`, `extdeps.network.mcx4411a_acan`, `extdeps.network.mcx4421a_acan` +6 more · 3 witness | no |
-| `gunbc.ci_layer_roots` | 2236 | 3 | — | `dag.test.claim.offline_local_recipe_witness`, `gunbc.ci_spec`, `gunbc.commit_workflow`, `gunbc.contributor_onboarding_path`, `gunbc.decoder_execution_identity`, `gunbc.derived_obligation_row` +34 more · 9 witness | **yes** |
-| `gunbc.ci_spec` | 3825 | 194 | `mtcollins1_bmc_gunbc_secret_ref`, `mtcollins1_boot_sol_capture_path_env`, `mtcollins1_boot_sol_pid_path_env`, `mtcollins1_census_image_receipt_path`, `mtcollins1_fan_credential_path_env` … | `gunbc.compiler_gate_workflow`, `gunbc.fleet_converge_workflow`, `gunbc.fleet_release_bins_key`, `gunbc.fleet_workflow_steps`, `gunbc.generated_artifact_emit`, `gunbc.heal_publisher_workflow` +10 more · 10 witness | no |
-| `gunbc.doc_graph_roots` | 1757 | 3 | — | `v2.test.lens_doc_reachability.doc_reachability_test` · 3 witness | no |
-| `gunbc.durable_cas_file_store` | 856 | 1 | — | `gunbc.auth.approval_assertion_counter`, `gunbc.auth.approval_decision_store`, `gunbc.auth.approval_device_redemption`, `gunbc.auth.approval_keyring_converge`, `gunbc.auth.approval_store_receipt`, `gunbc.authorization_claim_slot` +9 more · 8 witness | **yes** |
-| `gunbc.durable_exclusive_hold_file_store` | 369 | 1 | — | `gunbc.fabric_control_plane`, `gunbc.fabric_required_build_cell`, `gunbc.machine_intake_mtcollins1_maintenance_hold`, `tools.fabric_control_plane_live_probe` · 7 witness | no |
-| `gunbc.fleet_intent_network` | 461 | 3 | — | `gunbc.approve_ios_project`, `gunbc.auth.approval_broker_endpoint`, `gunbc.auth.approval_device_enrolment_code_issue`, `gunbc.auth.approval_keyring_converge`, `gunbc.auth.approval_ntfy_deployment`, `gunbc.auth.approval_request_submission` +90 more · 101 witness | **yes** |
-| `gunbc.floor_demand` | 1870 | 1 | — | `gunbc.ci_floor_measurement`, `gunbc.fabric_control_plane`, `gunbc.fabric_floor_dispatch`, `gunbc.fabric_witness_run`, `gunbc.floor_cold_build_receipt`, `gunbc.floor_memory_demand` +5 more · 8 witness | **yes** |
-| `gunbc.guarantee_stall.pci_address_rendering_equivalence_stall` | 17 | 2 | — | `gunbc.guarantee_stall.roster` | no |
-| `gunbc.non_fold_residue` | 2029 | 55 | — | — · 1 witness | no |
-| `gunbc.owned_process` | 175 | 1 | — | `gunbc.bmc_megarac_web_transport`, `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_kvm_observer_observe`, `gunbc.machine_intake_mtcollins1_kvm_still` · 3 witness | no |
-| `gunbc.recurring_failure_mode.a_derivation_key_that_does_not_pin_bytes_across_build_hosts` | 26 | 4 | — | — | no |
-| `gunbc.recurring_failure_mode.a_pending_member_vanishes_from_a_terminal_refusal` | 28 | 3 | — | — | no |
-| `gunbc.recurring_failure_mode.a_termination_contract_is_met_by_a_trimming_transport` | 51 | 5 | — | — | no |
-| `gunbc.recurring_failure_mode.absent_reads_identically_to_never_looked` | 70 | 3 | — | — | no |
-| `gunbc.recurring_failure_mode.ad_hoc_hardware_probe_produces_no_receipt` | 26 | 1 | — | — | no |
-| `gunbc.recurring_failure_mode.an_unspawnable_program_aborts_the_run_instead_of_refusing` | 22 | 2 | — | — | no |
-| `gunbc.recurring_failure_mode.collector_armed_after_the_transition_it_observes` | 14 | 2 | — | — | no |
-| `gunbc.recurring_failure_mode.control_plane_acknowledgement_minted_as_effect` | 14 | 1 | — | — | no |
-| `gunbc.recurring_failure_mode.else_less_if_statement_has_no_lowered_form` | 28 | 2 | — | — | no |
-| `gunbc.recurring_failure_mode.empirical_association_promoted_to_decode` | 14 | 1 | — | — | no |
-| `gunbc.recurring_failure_mode.enforcement_gate_positioned_after_the_effect_it_guards` | 15 | 1 | — | — | no |
-| `gunbc.recurring_failure_mode.enrolment_dead_band_has_no_representable_standing` | 17 | 2 | — | — | no |
-| `gunbc.recurring_failure_mode.gunbc_run_pays_a_large_fixed_pre_entry_cost_per_invocation` | 23 | 4 | — | — | no |
-| `gunbc.recurring_failure_mode.identity_hashed_from_a_shared_mutable_path` | 44 | 2 | — | — | no |
-| `gunbc.recurring_failure_mode.rest_response_nested_from_key_ignored` | 32 | 2 | — | — | no |
-| `gunbc.recurring_failure_mode.subject_and_its_digest_as_independent_parameters` | 22 | 2 | — | — | no |
-| `gunbc.recurring_failure_mode.the_checker_admits_a_cast_the_evaluator_refuses` | 17 | 2 | — | — | no |
-| `gunbc.recurring_failure_mode.unbound_interpolation_in_service_argv_accepted_until_runtime` | 22 | 1 | — | — | no |
-| `gunbc.recurring_failure_mode.upstream_non_endorsement_consumed_as_physical_prohibition` | 17 | 3 | — | — | no |
-| `gunbc.recurring_failure_mode.wet_witness_keyed_to_the_runner_not_its_subject` | 28 | 1 | — | — | no |
-| `gunbc.roadmap_authority` | 5415 | 4 | — | `gunbc.floor_non_verdict_enrollment`, `gunbc.generated_artifact_emit`, `gunbc.roadmap_belt`, `gunbc.roadmap_belt_actuate`, `gunbc.roadmap_closing_contract_authoring`, `gunbc.roadmap_forecast` +11 more · 15 witness | **yes** |
-| `gunbc.rung_drop.roster` | 240 | 9 | `mtcollins1_boot_accepts_socket1_absent`, `mtcollins1_boot_matrix_enrolment_dead_band_observed_only_drop`, `mtcollins1_boot_matrix_new_witness_eval_step_cost` | `gunbc.design_ledgers`, `gunbc.jurisdiction_drop_accounting`, `gunbc.ledger_row_coherence`, `v2.workflow.floor_subject_seed_test` · 5 witness | no |
-| `gunbc.runner.runner_bound_attempt_receipt` | 184 | 4 | — | — | no |
-| `gunbc.runner.runner_cgroup_placement_receipt` | 169 | 1 | — | — | no |
-| `gunbc.runner.runner_checkout_receipt` | 109 | 1 | — | — | no |
-| `gunbc.runner.runner_first_job_receipt` | 237 | 3 | — | — | no |
-| `gunbc.runner.runner_guest_egress_attempt` | 209 | 1 | — | `gunbc.runner.runner_cgroup_placement_receipt`, `gunbc.runner.runner_cpu_bandwidth_receipt` | no |
-| `gunbc.runner.runner_guest_network_receipt` | 186 | 1 | — | — | no |
-| `gunbc.runner.runner_host_first_boot_receipt` | 127 | 5 | — | `gunbc.machine_intake_pre_os_capture_replay` · 2 witness | no |
-| `gunbc.runner.runner_host_hardware_observation` | 216 | 9 | — | — · 1 witness | no |
-| `gunbc.runner.runner_host_jailed_kvm_receipt` | 200 | 2 | — | — | no |
-| `gunbc.runner.runner_host_kvm_probe_receipt` | 122 | 5 | — | — | no |
-| `gunbc.runner.runner_host_media_independence_receipt` | 137 | 10 | — | — | no |
-| `gunbc.runner.runner_isolation_admission` | 292 | 2 | — | — · 1 witness | no |
-| `gunbc.runner.runner_live_census_receipt` | 185 | 1 | — | — | no |
-| `gunbc.runner.runner_observed_version_check` | 129 | 3 | — | — | no |
-| `gunbc.runner.runner_qualification_receipt` | 177 | 4 | — | — | no |
-| `gunbc.runner.runner_signed_envelope_receipt` | 114 | 3 | — | — | no |
-| `gunbc.runner.runner_two_attempt_receipt` | 180 | 3 | — | — | no |
-| `gunbc.runner_attempt_launch` | 1044 | 1 | — | `gunbc.runner_microvm_lifecycle`, `gunbc.runner_microvm_lifecycle_realize`, `gunbc.runner_microvm_slot_controller`, `gunbc.test.claim.runner.runner_microvm_lifecycle_witness_test` · 2 witness | no |
-| `gunbc.runner_browser_toolchain` | 1381 | 3 | — | `gunbc.machine_intake_mtcollins1_boot_run`, `gunbc.machine_intake_mtcollins1_kvm_observer_observe`, `gunbc.machine_intake_mtcollins1_kvm_still`, `gunbc.wet_host_premise_readback` · 8 witness | no |
-| `gunbc.runner_host_grants` | 479 | 5 | `mtcollins1_unit_hold_store_host` | `gunbc.fleet_converge_plan`, `gunbc.generated_artifact_emit`, `gunbc.host_credential_custody_converge`, `gunbc.runner_host_file_converge`, `gunbc.runner_microvm_network_apply`, `gunbc.runner_microvm_network_observe` · 4 witness | no |
-| `gunbc.runner_jit_mint` | 159 | 1 | — | `gunbc.runner.runner_jit_perform`, `gunbc.runner_attempt_launch` · 1 witness | no |
-| `gunbc.runner_registration_labels` | 94 | 1 | — | `gunbc.fleet_runner_connectivity`, `gunbc.runner_browser_toolchain`, `gunbc.runner_connectivity_recovery`, `gunbc.runner_unit_file` · 3 witness | **yes** |
-| `gunbc.runner_throughput_qualification` | 1027 | 2 | — | `gunbc.runner_throughput_qualification_route`, `gunbc.runner_throughput_selection`, `product.fabric.node_qualification` · 1 witness | **yes** |
-| `gunbc.runner_throughput_qualification_route` | 383 | 27 | `operator_host_mtcollins1` | — · 1 witness | no |
-| `gunbc.secret_provision` | 603 | 6 | — | `gunbc.auth.approval_decision_store`, `gunbc.auth.approval_device_redemption`, `gunbc.auth.approval_mac_key_provision`, `gunbc.auth.approval_ntfy_deployment`, `gunbc.auth.approval_request_submission`, `gunbc.auth.approval_store_receipt` +13 more · 8 witness | **yes** |
-| `gunbc.spark.pair_serving_d0_door` | 355 | 1 | — | `gunbc.fleet_converge_workflow` · 3 witness | no |
-| `tools.approval_store_live_probe` | 236 | 1 | — | — | no |
-| `v2.compiler.reference_conservation_census` | 816 | 1 | — | `v2.test.claim.namespace_xl0.reference_conservation_census` | no |
-| `v2.test.floor_enrolment_margin` | 717 | 4 | `mtcollins1_boot_matrix_enrolment_dead_band_observed_only` | — | no |
-| `v2.workflow.floor_cost_debt_admission` | 155 | 12 | — | `v2.workflow.floor_enrolment_margin` | no |
-| `v2.workflow.floor_enrolment_dead_band` | 97 | 15 | — | `gunbc.rung_drop.mtcollins1_boot_matrix_enrolment_dead_band_observed_only`, `v2.test.floor_enrolment_margin`, `v2.workflow.floor_enrolment_margin` | no |
-| `v2.workflow.floor_enrolment_margin` | 649 | 1 | — | `v2.test.floor_enrolment_margin` · 1 witness | no |
-| `v2.workflow.floor_eval_step_cost_drop` | 416 | 31 | — | `gunbc.rung_drop.app_attest_interpreted_crypto_new_witness_eval_step_cost`, `gunbc.rung_drop.app_attest_verifier_new_witness_eval_step_cost`, `gunbc.rung_drop.dag_emit_round_trip_new_witness_eval_step_cost`, `gunbc.rung_drop.fleet_build_job_membership_new_witness_eval_step_cost`, `gunbc.rung_drop.live_deploy_apply_render_new_witness_eval_step_cost`, `gunbc.rung_drop.live_deploy_dark_install_render_new_witness_eval_step_cost` +7 more · 1 witness | no |
-| `v2.workflow.floor_route_gap` | 1999 | 24 | — | `gunbc.native_frontier_ratchet`, `gunbc.witness_v2_native_route`, `v2.test.claim.local_repo_wet_terminal_test`, `v2.workflow.floor_terminal_ledger`, `v2.workflow.floor_terminal_ledger_wire`, `v2.workflow.floor_terminal_ledger_wire_test` +1 more · 1 witness | **yes** |
-| `v2.workflow.floor_unimported_bare_provider_debt_roster` | 2209 | 7 | — | `v2.test.claim.floor_unimported_bare_provider_debt`, `v2.workflow.floor_unimported_bare_provider_debt` | no |
-| `v2.workflow.local_repo_wet_terminal` | 2562 | 55 | — | `gunbc.wet_host_premise_readback`, `v2.test.claim.local_repo_wet_terminal_test`, `v2.workflow.required_floor`, `v2.workflow.witness_admission` · 1 witness | no |
-
-### Witnesses (81 modules)
-
-Each witness moves with the subject it imports; none is in the required gate except `test.claim.action_use_admission_witness` (3 prose refs only).
-
-`test.claim.action_use_admission_witness`, `test.claim.approval_request_submission_witness_test`, `test.claim.authorization_pattern_selection_witness`, `test.claim.boot_artifact_delivery_witness_test`, `test.claim.build_fulfillment_witness`, `test.claim.build_selection_witness`, `test.claim.durable_exclusive_hold_witness`, `test.claim.fan_policy_standing_witness`, `test.claim.fleet.fleet_converge_checkout_pin_witness_test`, `test.claim.fleet.site_pxe_edge_converge_witness`, `test.claim.gcp_secret_access_witness_test`, `test.claim.heal_publisher_provision_witness`, `test.claim.host_memory_qualification_witness_test`, `test.claim.host_reset_return_witness_test`, `test.claim.install_media_remaster_grub_cmdline_witness`, `test.claim.linux_edac_topology_authority_witness`, `test.claim.machine_intake.ampere_dram_console_observation_witness_test`, `test.claim.machine_intake.ampere_socket_console_observation_witness_test`, `test.claim.machine_intake.host_capture_sol_crlf_witness_test`, `test.claim.machine_intake.host_capture_sol_nul_fill_witness_test`, `test.claim.machine_intake.host_resource_observation_witness`, `test.claim.machine_intake.kernel_module_decompression_observation_witness_test`, `test.claim.machine_intake.megarac_media_convergence_witness_test`, `test.claim.machine_intake.megarac_ui_features_witness_test`, `test.claim.machine_intake.mtcollins1_bmc_sensor_observation_witness_test`, `test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test`, `test.claim.machine_intake.mtcollins1_boot_authorization_witness_test`, `test.claim.machine_intake.mtcollins1_boot_diagnostic_bundle_witness_test`, `test.claim.machine_intake.mtcollins1_boot_phase_timing_witness_test`, `test.claim.machine_intake.mtcollins1_boot_run_witness_test`, `test.claim.machine_intake.mtcollins1_census_image_publish_witness_test`, `test.claim.machine_intake.mtcollins1_census_medium_readback_witness_test`, `test.claim.machine_intake.mtcollins1_census_member_readback_witness_test`, `test.claim.machine_intake.mtcollins1_census_qemu_host_observe_witness_test`, `test.claim.machine_intake.mtcollins1_census_refusal_hypotheses_witness_test`, `test.claim.machine_intake.mtcollins1_kvm_observer_observe_witness_test`, `test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness`, `test.claim.machine_intake.mtcollins1_kvm_still_witness_test`, `test.claim.machine_intake.mtcollins1_maintenance_hold_witness_test`, `test.claim.machine_intake.mtcollins1_physical_orientation_witness`, `test.claim.machine_intake.mtcollins1_sixteen_module_restore_witness_test`, `test.claim.machine_intake.mtcollins1_smpro_observation_witness_test`, `test.claim.machine_intake.mtcollins1_stale_power_off_witness_test`, `test.claim.machine_intake.mtcollins1_ui_bundle_observe_witness_test`, `test.claim.machine_intake.mtcollins1_unit_hold_forged_probe_witness_test`, `test.claim.machine_intake.oob_power_action_witness`, `test.claim.machine_intake.pre_os_bringup_witness_test`, `test.claim.machine_intake.pre_os_sol_crlf_witness_test`, `test.claim.machine_intake.sol_hold_stdin_wet_witness`, `test.claim.machine_intake_ethernet_witness`, `test.claim.machine_intake_mtcollins1_bmc_secure_standing_witness_test`, `test.claim.machine_intake_predictive_claim_witness_test`, `test.claim.megarac_spx_ui_surface_artifact_integrity_witness`, `test.claim.memory_change_evaluation_witness`, `test.claim.memory_multiple_findings_witness`, `test.claim.micron_dram_module`, `test.claim.modeled_filesystem_witness_test`, `test.claim.mt_collins_dimm_physical_identity_witness`, `test.claim.mt_collins_population_role_witness`, `test.claim.mtcollins1_candidate_attachment_witness_test`, `test.claim.mtcollins1_census_image`, `test.claim.mtcollins1_census_image_local_wet`, `test.claim.mtcollins1_connectx4lx_observation_witness_test`, `test.claim.mtcollins1_expansion_witness_test`, `test.claim.mtcollins1_memory_census_witness_test`, `test.claim.mtjade1_access_witness`, `test.claim.nbd_proxy_virtual_media_install`, `test.claim.pci_identity_observation_witness`, `test.claim.pre_os_capture_replay_witness`, `test.claim.pre_os_observer_witness`, `test.claim.pre_os_replay_witness`, `test.claim.product.cohort_observation_witness`, `test.claim.refinement_cast_wall_witness_test`, `test.claim.runner_isolation_admission_witness`, `test.claim.runner_throughput_qualification_witness`, `test.claim.site_uefi_arm64_pxe_edge_witness`, `test.claim.srv3_os_install_actuate`, `test.claim.unit_hold_store_provision_witness`, `test.claim.workflow_dispatch_input_witness`, `test.claim.xorriso_path_list_witness`, `test.probe.unit_hold_proof_forged_probe`
diff --git a/docs/plans/micron-mta36ads2g72pz-identification.md b/docs/plans/micron-mta36ads2g72pz-identification.md
deleted file mode 100644
index ee15c525fa7..00000000000
--- a/docs/plans/micron-mta36ads2g72pz-identification.md
+++ /dev/null
@@ -1,209 +0,0 @@
-# MTA36ADS2G72PZ-2G1A1: what Micron says it is, and what the Ampere documents say about it
-
-Survey date: 2026-09-12. Lane: clever-heron-234, work item `node://adhoc-677e2a53-ae7`.
-Landed authority: `extdeps.memory.micron` (rows `mta36ads2g72pz_2g1a1_catalog`,
-`mta36asf2g72pz_2g1a2_catalog`), `extdeps.vendor.micron`, and the third value of
-`extdeps.memory.types` `DramDieStacking`. This document carries the reading; the rows carry the
-facts. Nothing observed on Mt. Collins unit 1 is authored into `extdeps`.
-
-## Verdict, in the brief's order
-
-1. **MTA36ADS2G72PZ-2G1A1 is a 16 GB, 2-rank, x4, DDR4-2133 CL15, ECC, registered,
-   VERY-LOW-PROFILE (18.75 mm) RDIMM built from 18 DUAL-DIE packages of two 4 Gb dies each.**
-   Every word of that is Micron's, from two documents (part-numbering decode and the SPD image
-   Micron publishes for the part), and the two agree at byte grain. Status: obsolete.
-2. **ADS versus ASF is `DS` = "VLP Dual-Die w/Temp Sensor" versus `SF` = "FBGA w/Temp
-   Sensor".** Micron's DDR4 Module Part Numbering System (Rev. 05-Dec-2018) defines the
-   module-options field as a two-letter code where the first letter is the PCB height class
-   (`S` standard, `D` VLP, `H` 2U, `L` 4U) and the second the DRAM package (`F` FBGA
-   single-die, `S` dual-die, `Q` quad-die, `E` octal-die). The letter difference IS the answer:
-   the ADS part is the VLP dual-die build of the same 36-die, 2 Gig x 72, RDIMM, -2G1 family.
-3. **"2DRx4" reads as "2 ranks, dual-die, x4", and that is verified, not adopted.** The
-   operator's hypothesis was that a VLP module needs dual-die packages to reach 16 GB with x4
-   devices in 18.75 mm. Micron's SPD byte 6 for the part is `0x91`: non-monolithic, 2 dies,
-   MULTI LOAD STACK, i.e. the JEDEC class a DDP belongs to. Byte 128 (`0x04`, nominal height
-   ≤ 19 mm) confirms the VLP outline. The catalogue's "Component Config: 2Gb x4" names the
-   8 Gb dual-die package; "Number of Components: 36" counts dies, matching the `36` in the
-   part number, whose field the numbering sheet labels "Number of Die".
-4. **Ampere publishes nothing that admits or refuses a dual-die (multi-load stack) RDIMM.**
-   Altra Rev A1 Datasheet Issue 1.55 §2.10 lists "RDIMMs, LRDIMMs, and Stacked (3DS) RDIMMs"
-   and "8 Gb and 16 Gb DRAM devices"; the words DDP, dual-die, multi-load and 4 Gb do not
-   appear in the document. Neither does the Mt. Collins GSG, the OCP Mt. Jade spec, or the
-   AVL say anything about package construction. The OCP Table 3 "Different DRAM DIES" = Yes
-   cells govern MIXING die types across modules; they do not say a given die construction is
-   supported, and this survey did not let them. Note also that the datasheet's device list
-   (8 Gb, 16 Gb) does not name the 4 Gb die that BOTH Micron quartets use, and the monolithic
-   quartet trained; so "unlisted device density" is a fact about both quartets and cannot be
-   what separates them. The corpus now models the DDP class as *not among the listed classes*
-   (`altra_admits_module_class` answers false for Registered × DualDiePackage) and the
-   controller module's own prose keeps that distinct from a withdrawal such as UDIMM's.
-5. **Neither part is on the Ampere Altra Family AVL Issue 1.15 (December 2025).** Table 3's
-   Micron rows are MTA18ASF2G72PDZ (16 GB 2Rx8), MTA18ASF2G72PZ-2G9E1 (16 GB 1Rx4),
-   MTA36ASF4G72PZ (32 GB 2Rx4, three suffixes) and MTA36ASF8G72PZ-3G2E1 (64 GB 2Rx4) — all
-   `SF`, all 8 Gb/16 Gb dies, all 2666 or faster. There is NO 16 GB 2Rx4 row from any vendor
-   and no 2133 row at all, so the AVL is equally silent about the ADS part and the ASF part
-   that trained. An AVL omission is not a prohibition and this survey does not read it as one.
-
-**Firmware corroboration, received from hw-first-host after this survey was drafted (SOL capture
-`artifacts/bmc/mtcollins1-sol-dram-training-2026-09-12.txt`, sha256 `e5044f71…8a4c`, on that
-lane's branch).** The Altra DRAM-init firmware prints the ADS part as
-`RDIMM[2c:80] 16GB 2133 ECC 2R x4 RCD[b3:80] 36ADS2G72PZ-2G1A1` — rank count 2, exactly as
-Micron's byte 12 says, the `D` being a package letter and not a rank — and refuses the mixed
-socket with `ERR: CHANNEL Mismatch Byte 6 SLOT0[00] EXP[91] @MCU[4]` followed by
-`ERROR: Non-identical DIMM mixture NOT supported!`. Two things follow, both about the observing
-layer and neither authored into `extdeps`: (a) the module's SPD byte 6 reads `0x91` on the
-board, agreeing with Micron's published image; (b) what the firmware enforces on that socket is
-**byte-6 agreement across the socket's channels**, i.e. a MIXING rule, so the failure with
-4 × ADS + 12 monolithic is a mixed-population refusal and says nothing about a uniform ADS
-population, which has not been run. The trained quartet's label reads `36ASF2G72PZ-2G1A2II`,
-matching the catalogue SKU carried here plus process code `II`. The firmware's `RCD[b3:80]` /
-`RCD[32:86]` per-module variation is the same variation Micron's record carries across process
-codes (bytes 133–135), which is why register vendor is not a field of the catalogue row.
-
-**Which of the three differing axes is operative — read carefully, because three bytes differ
-and only one is named.** The refusal quotes byte 6. Bytes 128 (height) and 130 (raw card)
-differ between the two parts just as much and are not mentioned. The strongest honest reading:
-the axis the firmware is known to compare is package type / die count / signal loading — the
-byte `DualDiePackage` is grounded on — and VLP height and raw card are not shown to matter.
-What the message does NOT establish is that they are unchecked: a comparator that stops at its
-first mismatch would print byte 6 whether or not it also compares 128 or 130 later in its
-order. So "VLP is a passenger" is the reading the evidence favours, at inference strength;
-proving it needs a population that differs at 128/130 but agrees at 6 (an `SS`/`DF`-coded part
-against a monolithic full-height one), which has not been run.
-
-**What Micron's data leaves as the only differences between the two quartets:** package
-construction (dual-die multi-load stack vs monolithic), PCB outline (18.75 vs 31.25 mm) and, with
-the outline, the JEDEC raw-card reference design (SPD byte 130 `0x08` vs `0x01`) and the
-module-attribute byte 131 (`0x05` vs `0x09`). Everything else — vendor, generation, capacity,
-speed bin, CAS latency, ECC, buffering, device width, package-rank count, die density, DRAM
-addressing — is byte-identical between the two SPD images. Which of those the Mt. Collins
-training outcome tracks is not decided by any document read here; the firmware line above
-names byte 6 directly, and that receipt belongs with the lane that ran the crossovers.
-
-## Documents read
-
-| Document | Revision | Locator | Digest / standing | What it establishes |
-|---|---|---|---|---|
-| Micron part catalogue record, MTA36ADS2G72PZ-2G1A1 | database record fetched 2026-09-12 | `www.micron.com/products/obsolete/obsolete-vlp-rdimm/part-catalog/part-detail/mta36ads2g72pz-2g1a1` (renders `…/_jcr_content.products.json/getproductinfo/-/-/-/en_US/-/mta36ads2g72pz-2g1a1`) | HTTP 200, no credentials, `"data-source": "DATABASE"`, `"sub-category": "obsolete-vlp-rdimm"` | Details table and full DDR4 SPD image (12 process codes JG/HK/JJ/JI/HG/HJ/II/HI/IG/IJ/IK/JK; they differ only at register-vendor bytes 133–135 and the bytes-128..253 CRC). |
-| Micron part catalogue record, MTA36ASF2G72PZ-2G1A2 | same | `www.micron.com/products/obsolete/obsolete-rdimm/part-catalog/part-detail/mta36asf2g72pz-2g1a2` | HTTP 200 | The control's details table and SPD (process codes KI/KJ/KK/KG/II/IG/IJ/IK). The bare `mta36asf2g72pz-2g1` record answers with no process codes. |
-| Micron DDR4 Module Part Numbering System | Rev. 05-Dec-2018 | `siewert-kau.info/micron/wp-content/uploads/2020/05/Nomenklatur_Micron.pdf` (distributor copy; `micron.com/numbering` → `assets.micron.com` answers "Request Rejected" to this session) | sha256 `7d52c2ad…5c6a2` | Field decode: family, die count, voltage, module options (`DS` = VLP Dual-Die w/Temp Sensor, `SF` = FBGA w/Temp Sensor), configuration, module type (`P` = 288-pin RDIMM), package code (`Z`), speed grade (`-2G1` = DDR4-2133, PC4-2133, 15-15-15, component -093E), die and PCB revision. |
-| Micron 288-Pin DDR4 RDIMM Core Product Description | Rev. B 12/2021, CCM005-341111752-10541 | `media.digikey.com/pdf/Data%20Sheets/Micron%20Technology%20Inc%20PDFs/DDR4_SDRAM_RDIMM_Core_RevB_Dec2021.pdf` (DigiKey copy of Micron's PDF; Micron's own host rejects) | sha256 `ea054b3d…8abc` | Figure 1 RDIMM 31.25 ± 0.15 mm; Figure 2 VLP RDIMM 18.75 ± 0.15 mm; Table 12 module ↔ component speed grades; C0–C2 pin text distinguishing "a traditional DDP package, which uses CS1_n, CKE1, and ODT1 to control the second die" from single-load 4H/8H stacks. It says the per-part organization lives in the MPN-specific addendum. |
-| Micron per-part addendum for MTA36ADS2G72PZ | — | **Not found.** Probed `…/data-sheet/modules/{vlp_rdimm,rdimm,parity_rdimm}/ads36a2gx72pz.pdf` and variants (404); search engines index no addendum for the ADS family; the catalogue page's download resource answers 404. | — | The SPD image is the strongest first-party organization statement reachable; the addendum would add placement and thermal figures, not organization. |
-| Ampere Altra Rev A1 Datasheet | Issue 1.55, 2025-04-08 | `extdeps.cpu.ampere` `ampere_altra_rev_a1_datasheet_authority` (v1.55 locator) | 90 pages, read as text | §2.10 feature list; no DDP / dual-die / multi-load / 4 Gb text anywhere in the document. |
-| Ampere Altra Family AVL | Issue 1.15, December 2025, AMP 2025-0116 | `extdeps.cpu.ampere` `ampere_altra_avl_authority` | sha256 `6199ae84…8d0d` (matches swift-bat-341's read) | Table 3 Micron rows listed above; no 16 GB 2Rx4 row; no 2133 row; §1.3 test suite is homogeneous 1DPC/2DPC. |
-| OCP Mt. Jade Motherboard Spec | Rev 1.0 | `extdeps.ocp.mt_jade.memory_mixing` | already modelled | Table 3 is a MIXING matrix; "Different DRAM DIES" = Yes is not a construction-support statement. |
-| swift-bat-341 survey | 2026-09-11 | [altra-cross-channel-rank-mixing-survey.md](altra-cross-channel-rank-mixing-survey.md) | — | Starting point for the AVL and the platform-guide reads; nothing there is contradicted here. |
-
-### Reading the two SPD images side by side
-
-| Byte | Meaning (JESD21-C Annex L) | ADS-2G1A1 | ASF-2G1A2 |
-|---|---|---|---|
-| 2 | DRAM device type | `0C` DDR4 | `0C` |
-| 3 | Module type | `01` RDIMM | `01` |
-| 4 | Density and banks | `84` 4 Gb/die, 4 BG × 4 banks | `84` |
-| 5 | Addressing | `21` 16 rows, 10 columns | `21` |
-| **6** | **SDRAM package type** | **`91` non-monolithic, 2 dies, multi-load stack** | **`00` monolithic** |
-| 12 | Module organization | `08` 2 package ranks, x4 | `08` |
-| 13 | Bus width | `0B` 64 + 8 ECC | `0B` |
-| 18 / 125 | tCKmin / fine offset | `08` / `C2` → 938 ps (2133) | same |
-| 24 | tAAmin | `6C` 13.5 ns → CL15 | same |
-| **128** | **Nominal height** | **`04` ≤ 19 mm** | **`11` ≤ 32 mm** |
-| 129 | Max thickness | `11` | `11` |
-| **130** | **Raw card** | **`08`** | **`01`** |
-| **131** | **RDIMM attributes** | **`05`** | **`09`** |
-| 329–349 | Part number | `36ADS2G72PZ-2G1A1` | `36ASF2G72PZ-2G1A2` |
-
-Raw card letters and bytes 131/133–135 are recorded as bytes, not decoded: the JEDEC raw-card
-letter table and the JEP106 register-vendor table are not authorities the corpus carries yet,
-and reading them from memory would be exactly the uncited transcription §4d forbids. A JEDEC
-SPD authority module (`extdeps.memory.jedec` currently carries only the generation ceilings) is
-the named follow-up that would make the decode above typed rather than prose.
-
-## The OEM SEL family (second half)
-
-Payloads observed on Mt. Collins unit 1, all manufacturer `3a cd 00`, record type `C0`, raw
-bytes preserved exactly as the brief carries them:
-
-```
-0fde7033ff10   0fde703bff10        2026-08-19, same timestamp, adjacent record IDs
-0fde70330102 (x19)   0fde70330502 (x2)
-0fde70331102         0fde703b1102
-```
-
-### What is public
-
-The only public serializer of a `3a cd 00` / `C0` OEM SEL record with this byte shape is
-Ampere's OpenBMC layer, `meta-ampere/meta-common/recipes-ampere/host/ac01-boot-progress/dimm_train_fail_log.sh`
-in `github.com/ampere-openbmc/openbmc` (read at `f68588807957ffbc07371634ed41e534e7b416c2`,
-2026-01-22; the script has three commits in its history and was created 2023-04-15 already
-carrying the constants below — there is no earlier revision with a different sensor number).
-It emits, via `IpmiSelAddOem` with OEM id `0x3a 0xcd 0x00` and SEL type bytes
-`0x00 0x00 0x00 0xC0`:
-
-```
-byte 0  SENSOR_TYPE_SYSTEM_FW_PROGRESS = 0x0F
-byte 1  SENSOR_BOOT_PROGRESS           = 235 = 0xEB
-byte 2  EVENT_DIR_ASSERTION | OEM_SENSOR_SPECIFIC = 0x00 | 0x70
-byte 3  (channel << 4) | (socket << 3) | BOOT_SYNDROME_DATA(=4)
-byte 4  syndrome bits 15:8   (the SoC-BMC "Boot Stage Error Syndrome" byte 1)
-byte 5  syndrome bits  7:0   (byte 0: [1:0] failure type, [4:2] physical rank, [7:5] syndrome 0)
-```
-
-The syndrome bytes it copies are defined by the Ampere Altra Family SoC-BMC Interface
-Specification, Issue 1.43 (2023-05-30), Table 16 registers `0xB4` (slot select) and `0xB5`
-(Boot Stage Error Syndrome): failure type 1 = PHY training, 2 = DIMM training; syndrome 0 for
-PHY = setup / write leveling / read gate leveling / read leveling / software training;
-syndrome 0 for DIMM = VREFDQ / LRDIMM DB / LRDIMM DB software; byte 1 for write leveling =
-slice number and per-nibble "no rising edge" bits. The specification is a `connect-admin`
-download that answered HTTP 200 without credentials (sha256 `34ccdcd2…`, 56 pages). The
-companion "Altra Family Monitoring Events" v0.60 (2023-06-05, sha256 `23d84c2c…`) is a
-Redfish message registry and defines no SEL byte layout.
-
-### What is not public, and therefore not decoded
-
-- **Sensor `0xde` (222) is not in any public Ampere source.** `ampere-openbmc/openbmc`,
-  `ampere-ipmi-oem`, and the Mt. Jade / Mt. Mitchell IPMI sensor YAMLs were searched; 222 and
-  235 appear there only as ordinary temperature/current sensor numbers unrelated to boot
-  progress. Mt. Collins runs AMI MegaRAC (`extdeps.ampere.mt_collins_product_brief.bmc`), not
-  this OpenBMC layer, and AMI's Ampere port is not published. So the `0xde` serializer is
-  **not found**.
-- **Byte 3's low nibble is `3` where the public schema writes `4`**, and the sensor number
-  differs, so the OpenBMC layout is a *related* schema and no byte of ours may be read through
-  it as a decode. Under that layout byte 3 = `0x33` would be channel 3, socket 0; `0x3b`
-  would be channel 3, socket 1 — which is consistent with the operator's inference that bit 3
-  moved with the socket holding the intervened population across the two crossovers, and is
-  still an inference: the companions moved with it.
-- **The tail is ambiguous even under the cousin schema**, and the ambiguity is why it is not
-  promoted. Reading `11 02` as `[syndrome hi][syndrome lo]` gives failure type 2 (DIMM
-  training), rank 0, syndrome0 = 0 with byte 1 = `0x11`; reading it as `[lo][hi]` gives failure
-  type 1 (PHY training), rank 4, syndrome0 = 0, byte 1 = `0x02` (write-leveling slice 2). The
-  two readings name different training steps and different ranks. Only a decode of register
-  `0xB5` on this platform, or the AMI serializer, settles it. The `ff 10` pair from 2026-08-19
-  reads as failure type 3 (Reserved) under one ordering and failure type 0 (N/A — no failure)
-  under the other, neither of which is a syndrome a training-failure record should carry, which
-  is further evidence that the `0xde` family is not simply the `0xeb` family under another
-  sensor number.
-
-So the payloads stay raw. `gunbc.host_memory_qualification` `TrainingEvidenceStanding` already
-has the right arms for what a receipt may claim: `AssociatedByIdenticalSignature` at best
-(signature = the raw six bytes, source = the meta-ampere script as the related schema), never
-`DecodedFromPlatformSyndrome`, until `0xB5` is read on the unit.
-
-## What this lane did not land, and why
-
-- **No `HostMemoryStanding` or `CausalExperimentReceipt` rows for the eight Mt. Collins
-  configurations.** The brief summarises them (durations, wattage, temperature, payloads) but
-  carries no instants, no DIMM masks, no slot locators; authoring receipts from a summary would
-  fabricate `observed_at` values and put prose in the mask field — the exact defect that module's
-  own notes record. The rows belong to the lane that holds the raw BMC log; they now have a
-  catalog row to bind to (`ObservedDimmCataloged { catalog: mta36ads2g72pz_2g1a1_catalog }`
-  reconciles, exercised by `test.claim.micron_dram_module`).
-- **No typed SEL/OEM-record carrier.** One night's payloads under an unpublished schema are
-  not an upstream authority. A carrier is warranted when either the AMI serializer or a `0xB5`
-  read exists to ground it.
-- **No `form_factor`/height field on `DramModuleCatalogRow`.** The VLP fact is carried in the
-  row's annotation and here; the field lands with its first consumer (a chassis DIMM-clearance
-  check), per §3c.
-- **The Micron-hosted locators.** Both Micron PDFs are cited through distributor copies with
-  digests because `assets.micron.com` rejects this session's fetches; re-cite to `micron.com`
-  when reachable. The catalogue records ARE Micron-hosted.
diff --git a/docs/plans/microvm-and-floor-wind-down-state.md b/docs/plans/microvm-and-floor-wind-down-state.md
deleted file mode 100644
index 34dcc0dc7c1..00000000000
--- a/docs/plans/microvm-and-floor-wind-down-state.md
+++ /dev/null
@@ -1,310 +0,0 @@
-# microVM and floor: wind-down state, 2026-09-21
-
-Written on operator instruction to wind down and record remaining items, so that v1
-performance and v2 migration can be prioritised. **This is a state record, not a plan**: it
-says what is true on `origin/main`, what is owed, and what is blocked, so that resuming any
-lane does not begin by re-deriving it.
-
-Every claim below was verified against `origin/main` at `7a145ef9ca` or read from the lane
-that produced it. Where a claim is **contested**, it is marked, and neither version is
-asserted — DESIGN §4d: a bet is typed as a bet, and the reader who consumes it as a fact is
-the defect.
-
-**Consumer, and a declared frontier (DESIGN §3c).** This page is cited by path from the two
-re-entry briefs that govern the parked programs, which is where a resuming session reads it.
-It is **not** linked from `DESIGN.md`, and it deliberately does not add a
-`gunbc.design_document` row to become so: it is a dated state record rather than a doctrine
-a DESIGN section governs, and editing that authority is not a wind-down act. It therefore
-joins the orphan population already rostered as `gunbc.guarantee_stall`
-`doc_graph_orphan_population_stall` (`current: OutsideTheLadder`), and this paragraph is the
-admission rather than a silent addition. **Trigger for the frontier:** whichever funded lane
-resumes a program named here either links this page from the section that governs its work,
-or supersedes it and deletes it. A wind-down record that outlives the wind-down is debt.
-
-**On the numbers below.** Where a figure is load-bearing it is stated with the producer that
-re-derives it (DESIGN §6: name the instrument, never transcribe its output). Where a figure
-is a lane's reported reading rather than a re-derivable instrument, it is attributed to that
-lane and marked as such — those are receipts of a past run, not facts a reader may refresh,
-and they are written so that staleness is visible rather than plausible.
-
----
-
-## 1. The floor reports SUCCESS over its own refusal — the highest-value open item
-
-`.github/workflows/witnesses.yml:67`:
-
-```
-if [ "$GUNBC_FLOOR_CLASS" = structural ] && [ "$GUNBC_FLOOR_EXIT" -eq 0 ]; then GUNBC_FLOOR_CLASS='none'
-```
-
-`claim_executor` **exits 0 over its own typed refusal**, so the class is downgraded to `none`
-and the job concludes success. A job can therefore report SUCCESS over a run that executed
-**zero witnesses**, with its own log saying `phases_failed=1`.
-
-**This is not merely a hidden defect — it admitted a new one.** #11731 landed a file that
-could not parse *because* the floor was refusing and reporting success. The hollow gate is
-upstream of the breakage, not downstream of it (§5: a failure arm must refuse, never widen;
-the downgrade is an absorbing fallback executed in YAML).
-
-**Current standing.** The parse class is **closed**: the indented-annotation census is 0
-corpus-wide and the floor selects and executes its full planned set, with `not_attempted=0`
-and `claims_failed=0`, where previously **zero** witnesses were selected. Closed by #11896,
-#11897, #11880, #11920, #11842. **Re-derive rather than trust this sentence:** the producer
-is the required floor itself — `claim_executor --required-ci --source-root dag
---source-root src/v2 --required-lane witnesses` — whose run prints its own
-`planned/executed/not_attempted/terminal/passed` summary line. The counts move with every
-landed witness, so a number copied here would rot within a day.
-
-**CONTESTED — do not propagate either reading.** Whether the downgrade swallows failures
-*per phase* is disputed by two lanes:
-
-| reading | source | consequence if true |
-|---|---|---|
-| per-phase: parse reds the job honestly, declarations passes | `nimble-swift-273` | once parse cleared, a **declarations defect is invisible** |
-| no such ordering | four run observations | the discriminator is unknown |
-
-The four observations: main `0de0b6137c7` 13 parse FAILs → **SUCCESS**; #11803 `70faed05501`
-340 → **SUCCESS**; #11842 343 → **FAILURE**; #11884 317 → **FAILURE**. No ordering by count,
-and parse failures did **not** always red the job. `eager-swift-412` independently reports
-the discriminator as **cannot-tell from the logs**.
-
-**The discriminating test nobody has run**, and it is cheap: read `$GUNBC_FLOOR_LOG` — a
-**file** the floor writes, *not* the job log, where every `class=` line is echoed script — or
-the classifier itself, on **one PASS and one FAIL of the same phase shape**. Counting
-signature strings in the GHA job log is **not** discriminating: a fired signature sets an env
-var rather than printing, so identical counts appear whether the hypothesis holds or not.
-
-**#11836 and #11829 are competing repairs. Only one should land.** Neither is owned.
-
-## 2. microVM: the part that decides is built; the part that acts is not
-
-`gunbc.runner_microvm_lifecycle_realize` **landed** (#11803) and has executed against real
-processes on srv1: the lane reported every claim group green at its landing head, including
-the wet receipt under `--wet` and the argv-binding wall. That is a **lane receipt of a past
-run**, not a standing fact — re-derive it with `claim_batch` over the module's witness
-modules at the current head before relying on it. #11677 closed both launch frontiers, so
-the JIT credential mint and jail staging are realized.
-
-**Five declared frontiers, all live in that one landed module.** Read them from the file,
-not from here.
-
-| # | frontier | status | what is missing |
-|---|---|---|---|
-| 1 | `controller_main_pid_consumer_frontier` | **dispatchable, start here** | **nothing calls `run_controller`.** Until a slot unit execs it as MainPID the module is a library, not a controller. Every other frontier is worth less until this clears. |
-| 2 | ~~`attempt_cleanup_realization_frontier`~~ | dissolved | `gunbc.runner_microvm_lifecycle_realize clean_attempt_resources` runs between the stop and the readbacks, only after a quiescent stop: it detaches every mount at or under the jail (deepest first, read from `/proc/self/mountinfo`), deletes the credential device, and removes the jail and attempt directory with `rm -rf --one-file-system`. It then runs the slot's own `runner_slot_teardown_flush_commands`. The existing absence readbacks and network lists stay the verdict, so an incomplete cleanup quarantines. |
-| 3 | ~~`guest_bring_up_channel_frontier`~~ | dissolved (channel); live half re-declared | The controller binds the console at launch: the unit's Environment must name this attempt's invocation_id, and the unit's systemd InvocationID is captured then. After the terminal trigger it reads only that invocation's journal entries (`journalctl -u … _SYSTEMD_INVOCATION_ID=…`) and advances GuestBooted / RunnerListening through `advance_bring_up`. The receipt carries the phase. Reading it live, to decide SERVING while the attempt runs, is `slot_serving_live_readiness_frontier`; its consumer is the deferred warm pool. |
-| 4 | `slot_network_readings_producer_frontier` | **BLOCKED — security** | no converged slot network on any host; every reading is `Unreadable`, which quarantines. |
-| 5 | `workflow_effect_sequencing_frontier` | **not a lane — a design question** | `std` carries **no** effect-sequencing authority. Bigger than microVM: every effect sequence in the corpus rests on the answer. |
-
-**The consequence that governs planning:** the module states it itself — *"no cell settles
-CellReady through this module today."* **A first full run quarantines by construction, and
-that is not a bug in the readbacks.** A warm pool is impossible until (4) clears.
-
-> Do not let anyone "fix" (4) by omitting `SlotNetworkQuiescent` from the required facts.
-> That is the empty-observation narrow `product.fabric.sanitation` exists to refuse.
-
-### Why (4) is blocked, stated so the reason survives
-
-**The converge principal IS the job principal.** Granting it install+restart over files it
-also *stages* is granting root: `install <grantee-writable-source> /etc/systemd/system/…`
-followed by `systemctl restart` is root-equivalence, however narrowly spelled. So
-`microvm_network_granted_operations` deliberately carries **readbacks only**.
-
-To unblock, an administrator principal must (1) own the staged source so the job user cannot
-write what root will install and execute; (2) install the nft loader unit and ruleset and
-`daemon-reload` + restart it; (3) set `ip_forward` and create the bridge; (4) create and
-destroy per-attempt taps — and be **unimpersonable by the job user**. That last is the whole
-point, and is why the frontier trigger names a *capability* rather than an artifact (§4b(3)).
-
-#11751 (`microvm_network_observe`) landed. It **installs nothing**, reads every fact with its
-own UNREAD arm, and mints `ConvergedNetwork` only when every fact was actually read. On every
-host today it will **refuse**, because nothing has installed a tap or the table — that is
-honest, not a failure.
-
-**It has now been run, and it refused exactly there.** fleet-converge run 35646413870, mode
-`microvm_network_observe`, host srv1, 2026-09-21: the whole receipt is
-`microvm-network-observe REFUSED: slot srv1-01: tap disable_ipv6 could not be read`. srv1
-carries no `gunbc-tap1`. That is the first end-to-end reading of the mode against a real host
-and it establishes the mode works and the host is unconverged; it is **not** a
-`ConvergedSlotNetwork` (that row stood until the converged run below).
-
-**The administrator principal has landed: `gunbc.runner_microvm_network_apply`.** It is the
-apply half of (4), a fleet-converge mode of its own (`microvm_network_apply`,
-`FleetSshKeyConsumed`), executing as `gunbc.fleet_bootstrap_principal`
-`executor_bootstrap_principal` over the fleet SSH edge — the same edge
-`gunbc.runner_host_file_converge` already uses for root-evaluated files. It refuses when that
-administrator IS the job user on the host; it refuses unless the dispatch names the revision
-the tree is checked out at, because the bytes it installs are rendered from that revision; it
-verifies **every ancestor** of the staging root root-only far-side before staging a byte; it
-writes each staged file `root:root 0600` through `converge_typed_remote_file` (stage, mode,
-atomic rename, far-side content comparison); it verifies the staged files' own ownership;
-then it runs the modeled install operations in order, stopping at the first failure, and
-reads the ruleset back. The staging root **moved out of the job user's own tree** in the same
-change — it was under `gunbc_fleet_converge_state_dir`, which `runner_host_grants` creates
-with `owner=job`, which is precisely what the frontier says does not satisfy it. The job-user
-grant roster is **unchanged**: the installs run under a different principal, and re-admitting
-them to the job user's sudoers because someone else performs them would grant exactly the
-pair the frontier refuses.
-
-**(4) has executed, and srv1's slot network is converged.** fleet-converge run 36043010087
-(`microvm_network_apply`, srv1, 2026-09-24) staged, installed and read the ruleset back under
-the administrator principal (listing digest `da7a00c5…9099`); run 36045264008
-(`microvm_network_observe`, srv1) then minted a `ConvergedSlotNetwork` at generation
-36045264008 carrying the same digest, fourteen taps with v6 disabled, and zero helpers.
-`microvm_network_host_mutation_principal_frontier`, `host_ruleset_installer_frontier` and
-`converged_slot_network_producer_frontier` were deleted on those receipts.
-
-**And the premise of this whole section is false on srv1 today, which is the finding that
-lane produced.** `/etc/sudoers.d/gunbc-deploy` — GENERATED by `gunbc.ci_deploy_sudoers` from a
-roster of bare binary paths — grants `ghrunner ALL=(ALL) NOPASSWD:` over `/usr/bin/install`,
-`/usr/bin/systemctl`, `/usr/bin/rm`, `/usr/sbin/visudo`, `/usr/sbin/usermod`,
-`/usr/sbin/useradd`, `/usr/bin/apt-get` and `/usr/bin/tailscale`, path-unrestricted (verified
-live, 2026-09-21). That is the install+systemctl pair the frontier refuses to grant, already
-held by the job user, unbounded. The job user is root-equivalent on srv1 **today**, and "CI
-jobs cannot become root" was an unrecorded false belief. Rostered as `gunbc.rung_drop`
-`the_job_user_holds_a_path_unrestricted_root_grant` and classed as
-`gunbc.recurring_failure_mode`
-`the_grant_a_frontier_refuses_is_already_held_from_another_authority`. It does not weaken the
-frontier — it means satisfying it is **necessary and not sufficient**. **Closing those grants
-is a separate, operator-gated item**, and it is what gates untrusted-PR qualification of the
-microVM host: legacy jobs on the host consume them today, so each needs a consumer census
-before it can be removed, and no lane may narrow them silently.
-
-### The floor's own job does not fit a cell
-
-**Update 2026-09-23 — the stall retired.** `runner_microvm_floor_fit_stall` was deleted when its
-trigger held: `gunbc.floor_demand`'s standing moved to `gunbc_floor_memory_stat_receipt_2026_09_23`
-(a run carrying gunbc#12081 and gunbc#12088), and `gunbc_runner_microvm_shape` now resolves on
-production inputs at the unchanged 26 GiB cell row. The executed evidence is
-`test.claim.runner_microvm_witness_test`
-`the_production_shape_resolves_on_the_memory_remainder_since_the_2026_09_23_receipt` and the
-either-state witness beside it. The paragraphs below are the state as it stood before that and are
-kept as history; the demand is a single warm run's sampled maximum, so a later receipt can move it
-back over the line, and the either-state witness is what would say so.
-
-Before 2026-09-23: `runner_microvm_floor_fit_stall` remained rostered: the floor's measured held-set
-peak exceeded `gunbc.runner_slot_desired` `gunbc_runner_slot_memory_max_bytes` less the
-realization reserve. Both sides are derivable rather than transcribed — the cap is that declaration, and
-the demand is produced by `gunbc.floor_memory_demand`, whose qualification against readable
-limits is what the stall cites. The stall row itself carries the figures it was written
-against; read them there, where they sit beside the reading that produced them.
-
-**Grounding it is an operator decision with a fleet cost**, not an engineering task: raise
-per-slot `MemoryMax` to ~28 GiB, which **lowers each host's memory-admitted width**, or
-reduce floor demand. The stall explicitly rules out deleting the allowance, reserve or
-receipt, and rules out using a fixture cell.
-
-### The milestone that would settle the cutover question
-
-**One cell settling `CellReady` once, on one host, after one real job.** Nothing before that
-is evidence. If that cannot be reached, the remaining work is unbounded.
-
-## 3. Dynamic per-VM memory — two compiling, unreconciled implementations
-
-Design ruled and approved by the side chat; **build parked**. Six items; item 1 is built
-**twice, independently, blind to each other**.
-
-**Neither branch is uncompiled.** The uncompiled attempts are the two *closed* PRs, #11849
-and #11850.
-
-| branch | sha | evidence | carries uniquely |
-|---|---|---|---|
-| `session/bright-ram-63` | `125659f70df` | lane-reported: all claims green under `claim_batch`, plus five mutation controls, tree restored green after each | the **executed** authority-token wall |
-| `session/royal-moth-544` | `80ec5065822` | lane-reported: all claims green under `claim_batch`, two mutation controls executed | `std.measure round_up_to_grain` (resolves the unowned rounder fork), ceiling-as-parameter, permit-in-provenance |
-
-The same three file paths exist on both with different contents, so **merging them is a
-textual conflict on every file, not a union.** Pick one base and port the other's evidence.
-
-**Both PRs (#11883, #11885) were found NON-DRAFT on 2026-09-21, although both lanes believed
-they had left them draft** — so a parked program was consuming CI and reviewer attention on
-every push. Both were converted back to draft at wind-down. Keep them draft while parked:
-ready buys coverage that was never approved. *The lesson is the gap itself* — "I left it
-draft" is a belief about a past action, and the dashboard opens PRs on a lane's behalf, so
-it must be re-read rather than remembered.
-
-**The defect, stated correctly** (it is a bypass, not an absence). All three verified against
-`origin/main`:
-
-- `CellReserved` holds exactly four fields — offer, slot_key, generation, account. **No
-  requirement, no grant, no envelope.**
-- `admit_executor_capacity` takes a whole `ExecutionRequirements` and reads exactly **one**
-  field, `requirements.capacity_class`. **Cell admission does not consider memory.**
-- `unmet_memory_axis` returns `[]` when `needed.envelope.memory` is `Absent`, so **unstated
-  memory is admitted** by the supply screen rather than refused.
-
-So memory *is* screened before reservation and the runner *does* read the requirement; what
-is missing is that memory is never converted into a **grant**, never **atomically reserved**
-against live host use, and never **carried on `CellReservation`**.
-
-`MemoryGrant` and `HostMemoryLedger` return **zero matches anywhere on main**, so items 3-6
-have no landed symbols to integrate against. The coordination hazard for item 4 (#11625,
-static-vs-dynamic `MemoryHigh`/`MemorySwapMax`) is still **open**, but its head has moved to
-`8e75da2aa48` — re-read it before item 4 rather than trusting any recorded sha.
-
-**Topology precondition, a gate rather than an item:** exact per-Work sizing is valid only
-where Work is bound **before** the VM boots. A generic prebooted GitHub runner does not know
-its eventual job. Do not let a guest discover its Work after boot and call that dynamic
-allocation.
-
-**Amendment worth not re-litigating:** a per-host **CAS-linearized** ledger is required.
-Per-cell records cannot conserve a host-wide sum — A and B each read 60 of 100 free, each
-reserve 30, both succeed, 120 committed. One CAS commits cell occupancy and memory claim
-together.
-
-## 4. Owed evidence
-
-**#11845's discriminating RED was never executed.** The repair is real and approved, and it
-lands on a green that is hollow for the two reasons in §1. Branch
-`verify/11845-red-mutation` (`2499194f4b2`) is pushed and is exactly one hunk off the merge
-head: the `test -e` defect put back inside the new classifier. **Both of its blockers have
-since cleared**, so the pair is now runnable — expect green at the merge head, red at
-`2499194f4b2` on `an_unread_path_reaches_unobservable_and_never_absent`. **If the mutation
-passes, the control does not discriminate and the repair needs a better one.** Delete that
-branch afterwards; `verify/11845-red-control` is plain main and can go now.
-
-**Two unowned repairs**, both one-liners, both real:
-
-- `v2.lens.reference_derived_residency_reading` has zero occurrences of
-  `construction_justification`, while its siblings import it from `v2.lens.common`.
-- `dag/test/claim/machine_intake/jade_first_contact_model_witness_test.dag:3` imports `Nat`
-  from `std.types`; `Nat` is declared in `dag/std/nat.dag`.
-
-**`required_gate_prefixes` has no `dag/test/claim/runner/` row**, so that file is never
-resolved by CI unless a diff touches it — a symbol deletion can strand it silently, as
-#11762 did. Likewise no row matches `test.claim.fabric.`, so the dynamic-memory witnesses are
-discovered and declined.
-
-## 5. The P0 that opened this session is contained but not closed
-
-srv2 still carries `ExitType=cgroup` in
-`/etc/systemd/system/actions-runner@.service.d/70-fleet-teardown.conf` — the configuration
-that left PID 56295 orphaned holding 16 GB for 2.7 days. srv1 and srv3 are converged to
-`ExitType=main`.
-
-**Residual risk, precisely.** srv2-01..05 are **masked**, so the P0 cannot recur on them
-today. But the drop-in lives in the **template** directory and the template is *not* masked,
-so any **new** instance (`actions-runner@srv2-06`) inherits `ExitType=cgroup`. The remedy is
-to run the modelled fleet converge on srv2; it has simply never run there.
-
-srv4 is off the reach chain (container → srv1 → srv2-lan → srv3) and `gunbc.fleet_reach`
-carries no row for it.
-
-## 6. Method findings worth keeping
-
-- **A suite of controls that invoke a pure decision with supplied values is blind to
-  everything after the decision** — the cleanup leg, the receipt the withheld arm writes —
-  and stays blind however many are added. Two post-sign-off findings on #11902 both lived in
-  that one gap. **38/38 is not route coverage.**
-- **A repair of a fail-open is a prime site for the same class one layer down.** #11902's
-  own (d) repair discarded the located cause on its withheld arm and wrote a constant. Grep
-  every declaration your repair *adds* for a call site before pushing, and re-read every new
-  refusal arm for whether it names which fact failed.
-- **At any power-of-two grain, a checked-add rounder and a subtraction rounder refuse the
-  same set**, because 2^63 is a multiple of the grain. A gibibyte-grain mutation control
-  stayed green under the mutation. Use a non-power-of-two grain (1000). Two authors asserted
-  the opposite from reasoning alone; both were wrong.
-- **A refusal-arm claim tests that the arm fires, not that the right inputs reach it.** That
-  is how two lanes and a reviewer converged on bounding by the maximum instead of by
-  representability.
-- **`claim_batch` exits 0 over its own refusal.** A `*Refused` line is a **non-answer** —
-  neither pass nor fail — and exit status must never be read as the verdict.
diff --git a/docs/plans/moa-memory-modeling.md b/docs/plans/moa-memory-modeling.md
deleted file mode 100644
index ad9df46b125..00000000000
--- a/docs/plans/moa-memory-modeling.md
+++ /dev/null
@@ -1,158 +0,0 @@
-# Mechanism-of-allocation memory modeling (owner directive 2026-09-25)
-
-Amends the serving proof doctrine. Reading: **MoA = mechanism of
-action/allocation** — which architectural feature allocates each byte, how that
-quantity scales, which ranks hold it, during which phase it exists. The MoA
-decomposition is the authority. Measurements serve only three purposes:
-
-1. validate a derived bound;
-2. fill a narrowly named term whose implementation exposes no derivation;
-3. falsify the model when observation falls outside its claimed interval.
-
-## The correction that prompted this
-
-`floor(1,805,689 / 262,144) = 6` was on its way to `FitProved`. Withdrawn:
-
-- The engine's printed "GPU KV cache size: N tokens" is a
-  **full-context-equivalent projection**, not a fungible token inventory.
-  `extdeps.vllm.kv_layout` already says so: hybrid layouts have
-  length-dependent groups (full attention scales, windowed groups cap) plus
-  fixed-per-sequence groups (KDA/Mamba state), and `cold_admission_blocks`
-  refuses to linearly rescale a full-context figure.
-- Six seats is therefore a **CacheCapacityCandidate**, not a proof. The cache
-  subclaim proves only by direct group fold:
-  `6 × cold_admission_blocks(exact_layout, 262144) ≤ allocator_blocks_on_limiting_rank`
-  and independently
-  `6 × cold_admission_bytes(exact_layout, 262144) ≤ admitted_kv_arena_bytes on EVERY rank`.
-- The result vocabulary splits: `CacheFitProved / CacheFitRefused /
-  CacheFitUnestablished`, and the whole arm stays `FitUnestablished` while any
-  other subproof (prefill transient, decode transient, load transient, static
-  residency, supply reserve) is open.
-
-## GLM-5.3-Flash's four scaling laws (the MoA)
-
-45-layer hybrid decoder: 34 KDA linear-attention layers + 11 sparse-attention
-layers (interleaved ~3:1); 64 KDA heads × dim 128; index_kpool = 4; 512-dim
-MLA latent; sparse MoE (~320B total, ~18B active — active-count is a COMPUTE
-fact, not a residency fact; all experts are resident unless expert offload or
-EP placement says otherwise).
-
-1. **Weights: static, placement-dependent.** Derive from checkpoint manifest ×
-   TP/EP/PP placement × loader transformation rules. The observed 77.0–81.6
-   GiB/rank spread says placement is not an even quarter — build the exact
-   rank-placement projection; do not enshrine measured constants.
-2. **KDA state: ∝ sequences, NOT ∝ length × sequences.** Mamba-style recurrent
-   state per layer per sequence per rank (illustratively 16 local heads ×
-   128×128 × 4B = 1 MiB → ~34 MiB over 34 layers, before conv state and
-   speculative additions). Six seats ≈ hundreds of MiB, not a linear rescale.
-3. **Sparse MLA + KPool index: token-dependent.** 11 sparse layers: MLA latent
-   cache (∝ tokens), KPool compressed index (∝ tokens/4), small per-request
-   tail state (fixed). Persistent cache law:
-   `seats × (KdaState + TailState) + seats × SparseMla(length) + seats × KPool(⌈length/4⌉) + allocatorGroupingAndPadding`.
-4. **Prefill/decode workspaces: phase-specific transients.** Derivable, not
-   discoverable: e.g. the upstream sparse-indexer prefill buffer carries 40
-   entries per model token × 132 bytes (128-dim FP8 vector + scale) → at
-   262,144 tokens ≈ 1.289 GiB per applicable rank — check against the exact
-   deployed revision. **Read the allocator formula; never learn it from OOMs.**
-
-## Admissibility of observations
-
-- A resident-demand component can never be negative. TP1's `−2.54 GiB` graph
-  figure is preserved raw but admitted as `GraphAttributionUnestablished`
-  (lower bound 0, upper open) — the profiler interval includes a release.
-  Never clamped silently, never a credit. A negative observation improving a
-  verdict violates weaker-evidence-cannot-improve-admission.
-- `weights + non-torch` is a COMPOSITE profile term (rank-specific
-  model/runtime residency at that experiment phase), NOT a checkpoint-
-  placement receipt. It does not separate checkpoint tensors from
-  runtime-fixed, allocator, communication, or other non-Torch allocations.
-- Measurement standings: `DerivedExact / DerivedConservativeInterval /
-  MeasuredUpperBound / ObservationOnly / ModelFalsified`. A point sample never
-  becomes MeasuredUpperBound merely by being the largest seen once.
-
-## The unified proof subject
-
-Every term binds to one exact qualified subject (qualified-subject-identity.md):
-
-```text
-MemoryProofSubject {
-  model:      model:zai/GLM-5.3-Flash@checkpoint-digest
-  runtime:    runtime:vllm@source-sha+image-digest
-  topology:   topology:fleet/group-b/tp4@host-census-revision
-  parallelism: parallelism:tp4/pp1/ep-policy/dcp-policy
-  allocator:  allocator:vllm/hybrid-kv@configuration-digest
-  workload:   workload:glm-serving/262144x6@intent-revision
-  generation: generation:group-b/<launch-generation>
-}
-```
-
-A 64K×1 receipt discharges only terms invariant across the move to 262K×6.
-
-Every memory term names its mechanism:
-
-```text
-MemoryTerm { component, placement_law, scaling_law, phase, lifetime, bound, derivation }
-```
-
-Whole verdict = conjunction of subproofs: `StaticResidencyFit`,
-`CacheCapacityFit`, `PrefillTransientFit`, `DecodeTransientFit`,
-`LoadTransientFit`, `SupplyReserveFit`. `FitProved` only when every applicable
-rank × phase proves.
-
-## The allocation-plan projection (the durable instrument)
-
-Patch or wrap the pinned engine to emit its allocation plan — introspection,
-not tuning:
-
-```text
-ResolvedKvAllocationPlan {
-  runtime revision / image digest, cache format, allocator block count,
-  groups: [ identity, spec kind, layer identities, block size, page size bytes,
-            tokens per state, max memory usage bytes,
-            blocks required at the requested sequence length ],
-  grouping/padding decision
-}
-```
-
-The plan must reproduce the engine's printed capacity as an independent
-control. Production admission then evaluates any workload point offline from
-the group roster; wet execution becomes falsification + compatibility check,
-not the sizing algorithm. (`kv_group_metadata` documented the emission gap:
-layer counts and page bytes absent — this closes it at the source.)
-
-## Discriminating controls (required witnesses)
-
-```text
-same arena bytes + different group roster      → different capacity
-same printed token figure + changed KDA count  → no proof reuse
-missing sparse-indexer tail group              → CacheFitUnestablished
-index_kpool 4 → 8                              → derived capacity changes
-TP4 receipt applied to TP2                     → refused
-64K×1 activation receipt applied to 262K×6     → refused
-negative component observation                 → cannot improve headroom
-all cache groups prove, prefill open           → CacheFitProved + ArmMemoryFitUnestablished
-```
-
-## What remains legitimately measured
-
-Foreign/host pool occupancy; driver allocations with no deterministic API;
-fragmentation with no conservative construction bound; backend workspaces with
-no formula nor sizing function; realized behavior that violates the model
-(falsification). Everything else derives.
-
-## Current honest standing (2026-09-25)
-
-```text
-Per-rank pool supply:                    observed
-Rank-specific composite residency:       observed (composite, not placement)
-KV arena by rank:                        observed
-Limiting rank:                           TP3 / srv11 (that launch)
-262K × 6 cache cost:                     CacheCapacityCandidate
-262K × 6 prefill transient:              unestablished
-Whole-arm verdict:                       FitUnestablished
-```
-
-262K is entirely plausible on this topology — the hybrid architecture exists
-precisely to avoid dense KV growth on all 45 layers — but the durable answer
-is an argument from architecture + pinned allocation laws + topology +
-workload, not a fitted line through one experiment.
diff --git a/docs/plans/model-realization-fork.md b/docs/plans/model-realization-fork.md
index e19c01c10a7..70a818080f3 100644
--- a/docs/plans/model-realization-fork.md
+++ b/docs/plans/model-realization-fork.md
@@ -31,7 +31,7 @@ Every primitive is **modeled** as a `.dag` coproduct and **realized** as a nativ
 | `eval_binop` Eq/Ne guard | `:1910-1922` | **FAIL-CLOSED** (raises `CrossRepresentationEquality` on numeric straddle) — landed |
 | `pattern_matches` | `:2276-2563` | RECONCILED (explicit per-variant arms) |
 | `value_hash` / `CanonKey::new` | `:344` / `:309` | RECONCILED / FAIL-CLOSED (reflexivity check rejects non-reflexive) |
-| `parse_table_memo` / `pure_call_memo` / `resolved_graph_cache` | (see lock-down §3) | reconciled-with-caveat → the under-keyed / lossy cache holes are this seam at the cache layer |
+| `parse_table_memo` (deleted with the parse memo carrier, operator ruling R2 2026-10-08) / `pure_call_memo` / `resolved_graph_cache` | (see lock-down §3) | reconciled-with-caveat → the under-keyed / lossy cache holes are this seam at the cache layer |
 
 `FreeMonoid` is the proof that compositional reconciliation is *possible* (one flatten, all ops). Every other primitive is per-site.
 
diff --git a/docs/plans/mt-collins-dimm-physical-identity.md b/docs/plans/mt-collins-dimm-physical-identity.md
deleted file mode 100644
index e5e95368eca..00000000000
--- a/docs/plans/mt-collins-dimm-physical-identity.md
+++ /dev/null
@@ -1,156 +0,0 @@
-# Mt. Collins DIMM physical identity: documentary findings
-
-Read 2026-09-11 for `node://adhoc-ca3ce4b5-182`. The upstream findings below use
-only publisher documents. No machine was accessed. A later operator report is
-carried separately in gunbc, as described below; it supplies no extdeps fact.
-The starting citations were `docs/plans/altra-cross-channel-rank-mixing-survey.md`.
-
-## What can be located without reading silkscreen
-
-Ampere's **Mt. Collins GSG Issue 1.05 Figure 9 (p.11)** labels all 32 connectors and
-places their banks around CPU0 and CPU1. **Figure 10 (p.13)** labels the processors
-Socket0 and Socket1 in a chassis photograph, with the NVMe backplane and six fans
-at the top and PCIe risers at the bottom. With that orientation, Socket0 is left
-and Socket1 is right. They are side by side, not front and back.
-
-The model carries the Figure 9 bank order in
-`extdeps.ampere.mt_collins_getting_started_guide.dimm_layout.dimm_figure_banks`.
-The processor grouping and channel identity are resolved by J-number against
-`extdeps.ampere.mt_collins_product_brief.memory_population.mt_collins_channel_connector_pairs`;
-no second channel table is authored. `gunbc.mt_collins_dimm_physical_identity.resolve_dimm_diagram_identity`
-refuses missing or repeated keys and disagreements in processor socket.
-
-The **document-derived positional reading** is: view from above with the front/backplane
-away from you and the rear/riser end toward you; then use Figure 9's order within
-each CPU's left and right banks. Joining that order with the existing Table 11
-16-DIMM row selects alternating connectors starting at the **outermost connector
-away from each CPU** on both sides. This is a spatial inference from Figures 9
-and 10 plus Table 11, not a vendor sentence instructing an installation order,
-a photograph of the operator's board, or a physical colour rule. The model exposes
-the source bank order and population join rather than minting this inference as
-an independently authored slot list.
-
-## Colour: three distinct facts
-
-1. **Drawing legend:** GSG Issue 1.05 Figure 8 (p.10), 1U User Guide Issue 1.00
-   Figure 10 (p.39), and 2U User Guide Issue 1.00 Figure 19 (p.52) all use **yellow
-   for slot#0, used at 1DPC**, and **blue for slot#1, added at 2DPC**. The numbered
-   J annotations agree with the existing odd-J 1DPC population. The model derives
-   each connector's legend role from the existing population-role join.
-2. **Photographed plastic:** GSG Issue 1.05 Figure 12 (p.36) visibly contains blue
-   and black connectors/latches. It is a cropped board-revision photograph, not
-   an annotated complete DIMM colour map. This visual fact is carried at its
-   actual grain in `motherboard_photo_colours`.
-3. **Meaning of physical colour:** **not found in the inspected documents.**
-   None establishes that physical blue means slot#0, slot#1, or the 1DPC set.
-   The drawing's blue cannot be translated into the chassis's blue. A readable
-   photograph identifying actual connector positions, or explicit vendor
-   documentation of the physical colour scheme, is still needed for that answer.
-
-This does not establish why a processor failed to train, and does not select a
-hypothesis about the running machine.
-
-## Silkscreen: not established for all connectors
-
-GSG Figure 9 supplies **diagram annotations** J1–J32, not a silkscreen view.
-Figures 10 and 12 show installed DIMMs and small/obscured board text. The 1U guide
-Figures 11 (p.40), 24–25 (pp.52–53), and the 2U guide Figures 20 (p.53), 42–43
-(pp.74–75) illustrate replacement without an all-connector readable silkscreen
-map. No inspected source establishes the literal text printed beside **each**
-DIMM connector. No row therefore claims that a connector's physical silkscreen
-reads its J-number. The old table-only comment saying connectors were named
-on the board is narrowed to what it actually knew: the guide's identifiers.
-
-## Mt. Jade is not a physical orientation substitute
-
-Mt. Jade GSG Issue 1.00 Figure 9 (p.10) explicitly marks chassis front/top and
-rear/bottom, with **Socket1 left and Socket0 right**; Figure 10 (p.12) repeats
-that grouping in a photograph. Its within-socket numbered bank pattern resembles
-Collins, but its processor placement is reversed. No Jade orientation or DIMM
-silkscreen spelling is imported into the Collins model. OCP Mt. Jade Rev 1.0 is
-already a separate platform authority in `extdeps.ocp.mt_jade.subject`; this
-change does not assert that a shared processor or channel topology makes their
-physical boards interchangeable.
-
-## Another figure boundary
-
-The right-side MCU/channel leader labels in the topology cartoon run 4,5,6,7
-against connector pairs displayed 16/15,14/13,12/11,10/9 (and the corresponding
-socket-1 keys). The existing GSG Tables 12–13 authority assigns those pairs
-MCU7,6,5,4. This change uses the cartoon only for its slot#0/slot#1 legend, and
-Figure 9 for connector positioning. It does **not** replace the established
-pair table with the cartoon's MCU labels. Resolving that upstream discrepancy
-is outside this physical-identity change.
-
-## Documents and bytes read
-
-All four publisher downloads returned PDF bytes without credentials. Full text
-was extracted with PyMuPDF; the cited topology, chassis and board-replacement
-figures were visually inspected. Figure 12's embedded 1220×1626 photograph was
-also inspected at native resolution. No document PDFs or photographs are committed.
-
-| Document | Revision/date | Location and inspection scope | SHA-256 |
-|---|---|---|---|
-| Mt. Collins DVT/PVT/MP Getting Started Guide, AMP 2021-00511 | Issue 1.05, 2026-07-20 | [Ampere publisher](https://connect-admin.amperecomputing.com/api/secure-file-download/download-regular/?file=Mt_Collins_DVT_PVT_MP_GSG_v1_05_20260720_52a0348e87.pdf&type=technical-document&documentId=z6zenr250qdpa8eq4irolgds); Figures 7–10 pp.9–13, Figure 11 p.32, Figures 12–13 pp.36–37; Tables 11–13 pp.11–12 | `1c41b4f088fa9c8b760d21d57ae93b0d1a68ee67a740d4eb7ac893753fc580b3` |
-| Mt. Collins 1U User Guide and Hardware Maintenance Manual | Issue 1.00, 2022-03-30 | [Ampere publisher](https://connect-admin.amperecomputing.com/api/secure-file-download/download-regular/?file=new-private-files/94/tech/Mt._Collins_1U_Users_Guide_v1.00_20220330.pdf&type=technical-document&doc_id=669); §4.2.7 Figures 10–11/Table 3 pp.39–40; Figures 24–25 pp.52–53 | `7f351cc3bf8a9e2d1e6809a9e5337e527feac61a8ff3c4e4d6514f5e59311e7c` |
-| Mt. Collins 2U User Guide and Hardware Maintenance Manual | Issue 1.00, 2022-03-30 | [Ampere publisher](https://connect-admin.amperecomputing.com/api/secure-file-download/download-regular/?file=new-private-files/94/tech/Mt._Collins_2U_Users_Guide_v1.00_20220330.pdf&type=technical-document&doc_id=649); §4.2.7 Figures 19–20/Table 6 pp.52–53; Figures 42–43 pp.74–75 | `a8102a2a661fca508c079ba460da2f701360216517ee090a036e533bbf078bbf` |
-| Same 2U guide, operator-supplied **third-party mirror** | Same printed issue/date | [Doslab Electronics mirror](https://repo.doslabelectronics.com/misc/Mt-Collins-2U-Users-Guide-v1-00-20220330.pdf); fetched with curl, HTTP 200, 16,148,131 bytes; byte-identical to Ampere's copy. Initial Python HTTP request returned 403; browser tool timed out. The successful download is the cited read, not those failed attempts. | `a8102a2a661fca508c079ba460da2f701360216517ee090a036e533bbf078bbf` |
-| Mt. Jade PVT/DVT (NVMe) Getting Started Guide | Issue 1.00, 2022-04-12 | [Ampere publisher](https://connect-admin.amperecomputing.com/api/secure-file-download/download-regular/?file=new-private-files/94/tech/Altra_Family_Mt._Jade_PVT_DVT_NVMe_GSG_v1.00_20220412.pdf&type=technical-document&doc_id=631); Figures 8–10 pp.8–12 | `f6528f70dec97b8838bd67413566287fc7c465addbf07182e9bdd1d48874c69f` |
-
-The 2U document has its own `extdeps.ampere.mt_collins_2u_user_guide.subject`
-authority, including its publisher URL, separately named mirror URL, issue,
-date, digest and Figure 19 citation. The two independent read receipts live in
-`gunbc.specification_citation_read_provenance`; the publisher uses the
-publisher-fetch arm and the live third-party mirror uses
-`DocumentMirrorLocatorFetchedAndTextIngested`. Its observation date is not an
-invented archive-capture date. `mt_collins_2u_citation_read_comparison` derives
-agreement from subject identity, response status, byte count and digest, and
-retains both receipts. Unread or wrong-subject records are incomparable;
-different recorded bytes/digests differ. No mirror read is called a publisher
-read, and no agreement is an authored boolean beside the DIMM join.
-
-## Consumption and remaining boundary
-
-`gunbc.mt_collins_dimm_physical_identity.sixteen_dimm_diagram_identity` is an
-executable inspection entry point into `population_diagram_identity`. It carries
-ordered banks, canonical channel identity, drawing legend, chassis orientation,
-2U guide citation/mirror provenance, and explicit physical identification gaps.
-Unknown/duplicate connector references, socket disagreements and invalid population
-rows refuse without returning partial slot instructions. The published 32-DIMM
-row still has 31 keys; the projection reports the mismatch rather than silently
-adding J32. The existing correction remains the authority for that separate inference.
-
-The later **Mt. Collins rack-facing DIMM population projection** is declared by
-`operator_projection_frontier` beside the join, including the capability required
-to close it. This change lands the documentary model and executable join, not a
-rack UI or a claim that physical identification gaps have been closed. That future
-projection must preserve the distinction between figure-based positioning and
-verified silkscreen/colour. A clear chassis photograph is the next evidence route
-when the operator cannot read the markings.
-
-## Later operator report: unit 1 only
-
-Dashboard message `msg_ecd92656-ea35-4746-9e3f-f67d12706ec5`, relayed by
-`eager-owl-205` on 2026-09-11, reports the operator's by-eye inspection of
-**unit 1, a Foxconn Mt. Collins 1U chassis**: physical blue connectors are the odd-J set used at
-1DPC; the silkscreen supplied no useful slot-identification information.
-No photograph accompanied the report to this session. We did not independently
-inspect the chassis, and the report is not an Ampere statement.
-
-`gunbc.machine_intake_mtcollins1_dimm_connector_observation.mtcollins1_blue_connector_observation`
-records that report, its date, observer, relay message and unit scope. The
-reported set references the canonical 16-DIMM population rather than repeating
-its J-number list. The upstream documentary findings above remain unchanged.
-
-`mtcollins1_colour_meaning_divergence` is the third fact: it joins the reported
-physical blue set to the documentary roles and finds that blue on this chassis
-has a different role from blue in the schematic legend. This is evidence that
-the diagram colour does not predict this chassis's colour, not a contradiction
-in a vendor physical-colour rule (none was found).
-
-`colour_evidence_for_unit` returns this evidence only for the existing unit-1
-intake subject. Another unit receives `NoColourObservationForUnit`, and the
-returned documentary projection still carries both upstream identification
-gaps. The later rack UI must preserve date and by-eye/report provenance; this
-receipt does not generalize to other units, the 2U chassis, or the fleet, and it
-does not explain or validate processor training.
diff --git a/docs/plans/mt-collins-gpu-augmentation-program.md b/docs/plans/mt-collins-gpu-augmentation-program.md
deleted file mode 100644
index 546c4dd30ae..00000000000
--- a/docs/plans/mt-collins-gpu-augmentation-program.md
+++ /dev/null
@@ -1,181 +0,0 @@
-# Mt. Collins GPU augmentation — program
-
-**Status: contract phase, no geometry authored.** This is a SECOND product program with its own
-authority (`product.mt_collins_gpu_augmentation`), deliberately not folded into
-`product.printed_chassis`. It pressures different parts of the model than the ALTRAD8UD cassette:
-mixed purchased and fabricated structure, a heavy high-value expansion card, PCIe signal integrity
-and cable strain, independent power and protective earth, two interacting airflow domains, sustained
-thermal evidence, and a prototype-material versus deployment-material distinction.
-
-The standing rule that **cable routing and grounding apply at every controlled layer** carries over
-unchanged.
-
-## Architecture ruling: companion bay first, hood second
-
-```
-MtCollinsGpuServingUnit
-├── original sealed 1U server (lid, fan wall, CPU/DIMM shrouds untouched)
-├── adjacent 1U GPU companion bay
-│     retention/load path · airflow · dedicated PSU unless the PDB is proven · PE bond
-├── purchased qualified PCIe riser/cable
-└── modeled cable, service and thermal interfaces
-```
-
-The companion bay is the better first experiment because it preserves the stock thermal system,
-keeps GPU weight off the riser connector, allows a dedicated PSU and independent intake/exhaust, is
-reversible, and separates the server's cooling result from the GPU enclosure's. A modified 2U lid or
-hood is a legitimate *comparison* candidate, not the starting point. **Card orientation is not yet
-admitted** — exact card dimensions and usable 2U geometry decide it, and a horizontal arrangement may
-be the only viable one for a full-height card.
-
-## Census ANSWERED — this program is experimental, not the critical path
-
-**~8 of the 28 boxes are at least 2U, some 4U, and take a GPU with no fabrication at all.** So the
-1U retrofit is an experiment to run if it is ever wanted, not the route to a served GPU. Everything
-below stands as the design if the retrofit is attempted; none of it is on the critical path, and the
-program should not consume printer time that the ALTRAD8UD cassette needs.
-
-The live question moved with it: not "how do we get a GPU into a 1U" but **"what changes in the
-ALTRAD8UD stackable chassis when one of its nodes carries a GPU"** — recorded in
-[printed-chassis-program.md](printed-chassis-program.md) under the GPU-bearing node, because that is
-a variant of the node contract rather than a second product.
-
-## The census, retained for the reasoning
-
-The brief's own MTC-GPU-5 lists "purpose-built 2U GPU server" as a comparison candidate. Per the
-operator's hardware discussion, **the 2U Gigabyte G242-P31 is the Ampere platform built for exactly
-this** — four dual-slot GPUs, front-to-back airflow, PSUs sized for it — while **a 1U Mt. Collins
-cannot take a dual-slot full-height card at all**; the 1Us are CI boxes.
-
-So the cheapest possible first action is an **exact-model inventory census of all 28 boxes**. If any
-are the 2U variant, the companion-bay program is not the cheapest route to a served GPU — it is a
-workaround for a chassis constraint that a machine already owned does not have. A program that can
-be deleted by one inventory query should face that query before any geometry is modeled.
-
-This is not a reason to discard the brief: the companion bay remains the answer if the fleet is
-all-1U, and the ruling's decomposition stands either way.
-
-## Design for the production process, from the first printed part
-
-The operator's stated intent is **prototype by printing, produce by manufacturing** — specifically
-laser-cut and bent sheet aluminium, which for a colo is worth more than its price: fire-rated by
-nature, grounds to the shelf, no tooling, ~$40-60 at 20-100 units. Printing does not scale into
-production here; it is the design loop.
-
-Two consequences bind the geometry **now**, before any part is modeled:
-
-- **Model bend-friendly, flat-ish panels** — uniform material thickness, bend reliefs, no geometry
-  that only survives because a printer tolerates it. *A print that only works because printing
-  tolerates anything is a prototype of nothing.*
-- **Freeze before you tool.** The readiness signal is not "it works" but "the last three revisions
-  were cosmetic."
-
-This also splits process qualification into **two targets**: the printer–spool process (what the
-hole-diameter coupon measures, for the prototype loop) and the sheet-metal vendor process (what the
-production parts are actually made by). These are different `ProcessQualificationIdentity` subjects
-and must not share one. The coupon program is not invalidated by this — it qualifies the loop that
-produces the prototypes — but it does not qualify a production part.
-
-## Phases
-
-| Phase | Terminal evidence |
-| --- | --- |
-| **MTC-GPU-0** contract | Exact GPU SKU, count, bay-vs-hood candidate, rack allocation, prototype-vs-deployment target, power architecture. No generic "Blackwell", "x16 riser" or "2U hood" stands in for a selected product. |
-| **MTC-GPU-1** measure | Chassis external/usable envelope; lid, shroud, riser, rear-slot geometry; GPU envelope, mass, bracket, connectors, airflow; PDB connectors and ratings; candidate PSU; rack depth and cable-service envelope — with uncertainty and provenance. |
-| **MTC-GPU-2** PLA cold-fit | Rear pass-through/blanking adapter, riser strain relief, bracket-location gauge, cradle prototype, duct prototype. Surrogate mass before the real card sits on printed retention. Fit only — no power or thermal claims. |
-| **MTC-GPU-3** powered bay | Independent card load path, admitted PSU, PE, fans/ducting, full cable routing. PCIe link trains at required width and generation, no relevant link errors, GPU idles safely. |
-| **MTC-GPU-4** thermal admission | The isolated matrix below. Combined load within exact product limits, no unexplained host regression, no printed-part thermal failure. |
-| **MTC-GPU-5** production verdict | Compare custom bay vs integrated hood vs commercial expansion chassis vs purpose-built 2U server on cost, rack occupancy, thermals, reliability, service time, fabrication effort. |
-
-## Load path — printed parts are never the retention
-
-The GPU's load terminates in the bay or rack, **never** in the PCIe edge connector, the riser card,
-the flexible cable, the printed duct, or the original server lid.
-
-```
-rack rails / metal bay shell -> metal GPU bracket -> metal or reinforced cradle
-                                                  -> optional printed alignment pads and duct
-```
-
-Printed: card-location adapters, anti-sag supports, blower intake ducting, cable strain relief,
-connector guards, fan mounts, blanking pieces, geometric identifiers.
-Metal: rack-width shell, primary retention, long beams, PSU enclosure, PE path, fire and impact
-containment. A rack-width enclosure is not one A1-mini print in any case — this is another
-"print the joints and ducts, buy or bend the straight metal" design.
-
-## Cable and grounding — independent modeled routes
-
-PCIe data (host riser slot → pass-through → cable → GPU edge) · GPU DC power (pod PSU or admitted PDB
-→ auxiliary connectors) · AC (rack supply → bay PSU) · cooling/control (fan power, PWM/tach) ·
-**protective earth** (AC PE → PSU enclosure → bay metal → rack bond) · functional/chassis reference,
-separate from PE.
-
-Each route carries endpoints, connector orientation, bend volume, moving/fixed classification, strain
-relief, hot-surface separation and disconnect order. **The PCIe cable is never retention, never
-chassis grounding, never an uncontrolled hinge, and never a service loop with an undefined bend
-radius.** The rear pass-through must preserve the host pressure boundary as far as practical — a
-large unblanked opening can disturb host airflow even with the lid on.
-
-## Thermal — two coupled domains
-
-```
-HostCoolingDomain   front fan wall -> CPU/DIMM shrouds -> rear exhaust
-GpuCoolingDomain    dedicated ambient intake -> GPU cooler/blower -> declared exhaust destination
-```
-
-Primary law: **`GpuCoolingDomain` must not materially impair `HostCoolingDomain`.**
-
-Test sequence, each change isolated: stock sealed 1U under CPU/DIMM load (host baseline) → bay
-installed, GPU unpowered (passive obstruction, recirculation) → GPU idle (fan/idle-air interaction) →
-GPU load only → combined load (terminal case) → declared fan degradation or elevated ambient
-(failure margin).
-
-Observed: CPU temps and throttle state, DIMM temps, BMC-available VRM/board sensors, host fan speeds,
-GPU core/hotspot/memory/fan/power/throttle reason, host inlet and exhaust, GPU inlet and exhaust,
-printed-part surface temperature at the hottest locations.
-
-Admission requires: no vendor limit exceeded ∧ no unexplained throttling ∧ host regression within a
-declared budget ∧ GPU sustained at target power ∧ printed material within its admitted service
-envelope ∧ no recirculation mode left unmeasured.
-
-## Material policy
-
-PLA **may** establish dimensional fit, card and bracket location, riser-cable path, interference and
-service clearance, room-temperature duct topology, fan and connector placement.
-
-PLA **may not** establish sustained structural retention near the GPU exhaust, long-term anti-sag,
-deployment thermal durability, flame behaviour, or colo suitability.
-
-A powered PLA prototype is defensible only when the PLA parts are not the sole card support, are not
-the mains enclosure or PE path, and are temperature- and deformation-monitored under supervision,
-with a secondary metal retention path if the plastic softens. **PETG is not automatically
-sufficient** — measure actual part temperatures first.
-
-## Facts that stay OPEN until measured
-
-Exact GPU SKU, dimensions, mass, slot width, power, connector locations, airflow direction · rear
-riser electrical width and generation · exact qualified riser cable and usable routing length
-(signal integrity is not inferable from "Gen4 x16 cable") · PDB GPU-power capability · stock
-lid/shroud thermal role · GPU-bay intake/exhaust relationship to server exhaust · available rack
-depth and rear service clearance · printed-part operating temperatures · colo/site rules.
-
-The 60-80 °C blower exhaust figure is a **hypothesis until measured** on the exact card and airflow
-arrangement, and "under 80 °C for an hour" is **not** the terminal rule — the exact GPU's vendor
-limits, throttle state, hotspot and memory limits, and the server's CPU/DIMM limits govern.
-
-## Workload model stays separate
-
-The KV-cache analysis is not mechanical authority. It determines a `SelectedGpuDeployment`
-(gpu_sku, gpu_count, target active session population, parked session population, storage tier)
-which this program **consumes**. The chassis program must not independently encode "two cards" or
-"64 sessions". The load-bearing distinction is that **parked-session capacity is not simultaneous
-active decoding capacity** — that may decide whether the augmentation is worth building at all, and
-it must not silently decide card count before the active-fraction requirement is selected.
-
-## Extraction discipline
-
-This becomes the **second real consumer** that could justify extracting generic facilities currently
-inside the ALTRAD8UD program — process qualification, model-to-CAD realization, generated-artifact
-materialization, spatial measurement, cable routing, protective earth, thermal observation,
-fabrication receipts. Extract when both products ask the **same typed question**, never because the
-names look reusable.
diff --git a/docs/plans/mtcollins1-boot-observe-publish-capacity.md b/docs/plans/mtcollins1-boot-observe-publish-capacity.md
deleted file mode 100644
index 3fbc02da2c9..00000000000
--- a/docs/plans/mtcollins1-boot-observe-publish-capacity.md
+++ /dev/null
@@ -1,96 +0,0 @@
-# mtcollins1 boot: observe and publish capacity; health separate from the boot verdict
-
-Status: APPROVED by eager-owl-205 (2026-09-26) with the frontier answer below; work item adhoc-0e07aa33-b20.
-Off the #12362 → publish → repin → boot critical path: nothing here lands before #12362.
-
-## The defect, read as a chain (DESIGN §6b)
-
-`gunbc.machine_intake_mtcollins1_boot_run` `mtcollins1_boot_qualifications` folds six
-qualifications into ONE terminal verdict: `nproc`, `numa`, `boot-media`, `edac-before`,
-`workload`, `edac-after`. Two of them (`nproc`, `numa`) compare the observation to an
-INTENDED topology (`gunbc.machine_intake_mtcollins1_boot_milestone`
-`mtcollins1_boot_topology_expectation`), so an intent mismatch is reported as "did not boot".
-The earliest unjustified boundary is not the 160/80 literal; it is that the verdict type answers
-four questions with one arm set. Patching the literal (the #12325 milestone + the rung drop
-`mtcollins1_boot_accepts_socket1_absent`) was the symptom-link patch: it kept the conflation and
-made the intended configuration a boot precondition.
-
-## The four questions and their homes (DESIGN §3b — inhabit, do not mint)
-
-| Question | Home (existing) | What changes |
-|---|---|---|
-| 1. Did it boot | `gunbc.machine_intake_mtcollins1_boot_run` terminal verdict | Verdict narrows to evidence the census image reached its interfaces: envelope closed/sections terminated, `boot-media` (the image we delivered is the one running). `nproc`/`numa`/`edac-*`/`workload` leave the verdict. |
-| 2. What is available | `gunbc.compute.host_capacity` (`HostMemoryObservation`, the host `Pool<Memory, Kibi>` over `product.capacity.pool`), `product.fabric.envelope` `ResourceEnvelope`, `product.fabric.work` `HardRequirements { threads: HardwareThreadCount }` | A capture-sourced observation reading of CPU set (count + per-NUMA-node CPUs), and MemTotal/MemAvailable and `/dev/shm` size, each field `Observed \| Unknown{cause}` — malformed never becomes zero. Published regardless of (3). No new capacity vocabulary: threads are `HardwareThreadCount`, memory `Kibibyte`, the pool is `product.capacity.pool`. |
-| 3. Health | `product.host_health` (`MemoryErrorCounters`, `CounterWindowStanding`, `HostHealthGoal`, assessed via `std.goal_assessment`) | EDAC before/after become a `CounterWindowStanding` over `MemoryErrorCounters`; workload digest stability a health signal; "observed topology vs intended (2 sockets × 80) and vs earlier observations" becomes a `GoalDiverged` deviation, never a boot refusal. Findings carry a consequence (restrict / quarantine), never delete the (2) observation. |
-| 4. Eligibility | `product.fabric.supply` `offer_covers_shape` / `unmet_*_axis`, `product.fabric.capacity_admission` | Requirements are judged against the (2) allocatable envelope plus a health policy input from (3). No mtcollins1-specific eligibility code. |
-
-Open question for the parent on (2): the capture is a BOOT-TIME observation on a machine not yet
-enrolled as a fabric host (no `HostDashboardInstance`). I propose the observation lands as a
-typed reading in machine_intake that is *shaped* as `ResourceEnvelope` + `HostMemoryObservation`
-so enrolment consumes it unchanged; the actual pool publication is a declared frontier (§3c)
-triggered by mtcollins1's fabric enrolment. If you want it published to a fabric partition now,
-I need the enrolment home named.
-
-## Memory test sizing (the #12362 residue)
-
-Sizing follows the observation, never socket count, under an explicit policy row:
-`reserve` (bytes held back from the test), `minimum_useful` (below which the test REFUSES as
-"not run", not "passed"), and the size attempted = min(MemAvailable − reserve, /dev/shm free).
-The receipt records exact bytes attempted and coverage = attempted / MemTotal. A bounded run is
-typed `BoundedCoverage { attempted, of }` and can never read as full qualification; full
-qualification is a separate arm requiring coverage at the declared threshold. The #12362
-"one-socket 16 GiB profile" dissolves into this policy once #12362 has landed.
-
-## The cut (DESIGN §3 replacement migration, delete-first)
-
-The root is `gunbc.machine_intake_mtcollins1_boot_milestone`. Its consumers, enumerated by name
-(this root is not in the required gate prefixes' blast radius alone, so named, not inferred):
-`gunbc.machine_intake_mtcollins1_boot_run`, `test.claim.machine_intake.mtcollins1_boot_run_witness_test`,
-`gunbc.rung_drop.mtcollins1_boot_accepts_socket1_absent` (+ `gunbc.rung_drop` roster,
-`docs/design-rung-drops.md` projection).
-
-One PR, one motion:
-1. DELETE `mtcollins1_boot_milestone.dag` and the `nproc`/`numa` qualifications and their causes
-   (`SocketPlacementMismatch`, `SocketPlacementUnread`, nproc mismatch) from the terminal verdict.
-2. RETIRE the rung drop by construction: its subject ("boot qualification accepts socket 1 absent")
-   no longer exists because the boot verdict no longer asks about sockets. The gate it lowered is
-   not lost — it moves UP to health, where an unexpected reduction is a `GoalDiverged` finding
-   against the intended 2-socket configuration. Nothing is weakened, so no new drop.
-3. KEEP `mtcollins1_nproc = 160` untouched: a true receipt about the census boot it was read on;
-   it becomes one of the "earlier observations" health compares against.
-4. The numa-line parser (`numa_node_cpus_line`) moves into the capacity observation, not copied.
-5. EDAC/workload move from verdict into the health assessment in `product.host_health`.
-
-Witnesses: an 80-CPU single-socket capture BOOTS, publishes 80 threads, and carries a health
-deviation; a malformed nproc section boots (if boot-media held) with threads `Unknown`, never 0;
-a capture missing boot-media does not boot; EDAC UE>0 boots but health restricts; the route claim
-exercises the real `mtcollins1_boot_terminal_verdict` path (§3 pairing obligation).
-
-No live hardware is touched.
-
-## Correction after reading the homes: in-band health is not `product.host_health`
-
-`product.host_health` is built on a standing rule that its signals are read OUT OF BAND ("a count
-the BMC does not expose is an unknown, never a host-OS read"). nproc, numactl and in-band EDAC
-from the census image are host-OS reads. So the topology health assessment is a sibling
-instance of the shared authority, `std.goal_assessment`, over an in-band subject, in
-`gunbc.machine_intake_host_resource_observation`. It is a stated divergence from
-`product.host_health`, not a silent fork. In-band EDAC follows the same route at the cut (below):
-`product.host_health` `MemoryErrorCounters` / `counter_window_standing` are reused as values,
-without the out-of-band epoch claim.
-
-## Staging (parent ruling: nothing touches the #12362 → publish → repin → boot path until that boot has run)
-
-- **PR 1 (this change).** Questions 2–4 as new modules:
-  `gunbc.machine_intake_host_resource_observation` (observation → `host_topology_assessment` →
-  `topology_health_admission` → `host_offered_shape` → `host_workload_eligibility` over
-  `product.fabric.supply` `unmet_shape_axes`), and `gunbc.machine_intake_mtcollins1_topology_goal`.
-  The numa reading has its own strict parser (node and CPU ids, duplicates refused). The milestone module's count-only parser is frozen and deleted at the cut.
-- **PR 2 (the cut), after the #12362 boot has run.** Delete the milestone module and the
-  nproc/numa verdict arms. Retire the rung drop. `mtcollins1_boot_run` feeds its envelope's
-  sections into `host_resource_observation`, so the boot run becomes the production consumer.
-  EDAC and workload move out of the verdict.
-- **PR 3, after #12362 lands.** Memory-test sizing policy.
-- **Declared frontier.** Pool publication into `product.capacity.pool` via
-  `gunbc.compute.host_capacity`. Trigger: mtcollins1's fabric enrolment (a `HostDashboardInstance`
-  naming it). No enrolment home is invented here.
diff --git a/docs/plans/namecheap-secret-manager.md b/docs/plans/namecheap-secret-manager.md
deleted file mode 100644
index d2063a4a638..00000000000
--- a/docs/plans/namecheap-secret-manager.md
+++ /dev/null
@@ -1,135 +0,0 @@
-# Namecheap credential custody
-
-The owner reports `projects/582015116396/secrets/namecheap-api-key` provisioned.
-The project number matches `fleet_secrets_project_number`; the project ID comes
-from `fleet_secrets_gcp_project` (`gunbai-secrets`). No new version is provisioned
-by this lane, and no key is requested in chat or in a persistent local file.
-
-The owner also supplied account `briansrls` and an API allowlist entry named `dev`
-for `96.224.201.7`. These are typed operator reports in
-`gunbc.namecheap.account`, not evidence of an authenticated API call or a
-permanent DNS-controller placement.
-
-`gunbc.namecheap.credential` binds the container once. Its `latest` reference identifies the
-container for IAM and is resolved once by the discovery observer, which records
-the returned numeric version. The numeric selector controls apply to future
-reviewed mutation consumers, not this discovery path: an approval over a DNS
-mutation must not silently switch credential generations through an alias. `gunbc.namecheap.credential_read` uses the existing
-`fetch_secret_ref_credential` with `WorkloadIdentityToken`; the shared reader
-checks the response resource against the requested project, secret and version.
-It does not print or persist the payload.
-
-The dedicated `namecheap-dns` federation joins `gcp_iam_converge_targets`. Its
-trust is pinned by the shared fleet job claim authority to this repository, the
-fleet-converge workflow at main, a dispatch on main, and the `namecheap-dns`
-environment. Its only secret grant is accessor on `namecheap-api-key`. The
-existing IAM workflow plans as iam-observe, files a request in the approval app,
-impersonates iam-converge only after approval, rechecks the approved plan, applies
-and independently reads back. Enrollment is not evidence of an applied grant.
-The new target also changes the resource-local bootstrap bindings needed by the
-IAM controller; those must be observed before running its apply.
-This preserves the repo's distinction between routine per-secret federated
-reads and operation-specific human approvals. For DNS mutations, the consumer
-must use the existing `approval_gate` and scoped authorization over the frozen
-zone plan; secret possession alone never authorizes a zone replacement. This
-increment does not yet connect that DNS mutation consumer.
-
-Live status: secret creation and the allowlist are operator-reported. No enabled
-version or applied IAM binding has been independently observed. This local shell
-has no WIF token or gcloud installation. No provider request, IAM write, key
-access, or DNS mutation has been executed. The `namecheap_observe` fleet mode now has a dedicated job that supplies WIF
-and records the exact secret version plus authenticated getHosts readback. It
-still must land on main and its federation must converge before a live dispatch
-can pass the provider's main-only claim pins.
-The earlier DNS model lives on `work/daily-end-to-end`; this lane is based on the
-current repository so it can reuse the landed approval app rather than copying
-its newer authorities into that older checkout. The previous local `api_key_file`
-onboarding proposal is superseded by this Secret Manager reference.
-
-Validation on the current main base: a combined full-root run evaluated all
-21 IAM convergence controls, five credential controls, 15 XML/provider controls,
-and four workflow controls successfully, then regenerated the workflow through
-`tools.generated_artifact_gate.main_wet_one`. Its receipt counts 46 because it
-also ran one redundant aggregate IAM check, subsequently removed; the retained
-45 controls all ran in that invocation. The generated YAML was independently
-parsed and checked for the dispatch mode, dedicated identity, event SHA checkout,
-SSH exclusion, and success-only receipt upload. The self-contained loopback
-transport harness passed and observed the fixture query arriving without the
-fixture key in curl's argv. These are local checks, not live GCP or Namecheap
-observations.
-
-
-## Read-only verification workflow
-
-`fleet-converge` mode `namecheap_observe` uses the selected fleet runner and the
-`namecheap-dns` environment. The build and observer both check out the event SHA;
-`expected_revision` cannot substitute another revision under the trusted WIF
-identity. The shared fleet job is excluded, and this job receives no SSH key.
-
-The entry checks public IPv4 egress against the owner-reported allowlist, fetches
-one Secret Manager version through the shared checked reader, and issues only
-`namecheap.domains.dns.getHosts`. The encoded query travels to curl via stdin,
-not argv or a persistent credential file. There is no setter or configurable
-command in this provider interface. Every read has a timeout. Transport and
-provider refusals omit raw response bodies, and a response that contains the
-credential is withheld before decoding; the decoded retained result and host
-attributes are checked again before the observation can reach the receipt.
-
-The XML subset reader refuses unsupported syntax and ambiguous envelopes rather
-than guessing: DTDs and external entities, duplicate attributes, extra documents,
-namespace overrides, malformed records, duplicate provider record IDs, and a
-response for another domain/command cannot yield an observation. It preserves
-all provider result and host attributes, including unknown ones. Unsupported XML features
-(including numeric character references) are a located read refusal; this is not
-a claim to implement every XML document.
-
-`target/namecheap-observation.json` records the run ID, attempt, revision, start
-time, exact credential version, account, observed public egress, domain and
-returned result and host fields. The job uploads it only after success, so failure cannot
-publish a previous run's receipt. `mail_mode=unobserved` and
-`write_authority=withheld` are deliberate: getHosts does not independently prove
-the console's mail mode, and this observer grants no DNS mutation authority.
-
-The remaining live sequence is: land the reviewed code on main; observe/update
-the existing IAM controller's resource-local bootstrap reach for the new target;
-run `gcp_iam_converge` and approve its exact plan in the existing app; then run
-`namecheap_observe` on a runner whose public egress is allowlisted. Secret
-possession, a modeled grant, and a pure witness are not substitutes for those
-readbacks. Full-zone DNS mutation, DNS-01 renewal coordination, and dashboard
-fleet cutover remain separate unfinished consumers of this observation.
-
-Provider authority: [Namecheap getHosts](https://www.namecheap.com/support/api/methods/domains-dns/get-hosts/).
-
-Landing boundary: the active main ruleset requires the `witnesses` status and
-merge queue. The IAM authority also requires reviewed main code; the feature
-branch cannot impersonate the dedicated main-pinned identity. A read-only query
-of the latest 100 fleet workflow dispatches found no `gcp_iam_converge` run. That
-is limited history, not proof that bootstrap never happened. The bootstrap
-reach and independent readback are still unverified.
-
-## Review 5331195485 corrections
-
-The writer, generated console display and artifact uploader now consume
-`gunbc.namecheap.observation_artifact.namecheap_observation_receipt_path`. The
-workflow shell control reproduces the original unmatched receipt read on the old
-generated YAML, then exercises the regenerated success path with only the
-declared JSON output. Its planted unmatched read must fail.
-
-The production client keeps the raw response exclusion and also checks all
-decoded retained result and host attribute names and values, including unknown
-fields, before returning an observation. Six publication controls cover raw,
-URI-encoded, and XML-entity-encoded echoes plus ordinary entity preservation.
-Disabling the decoded guard in an isolated test copy makes the three XML echo
-controls fail while raw/URI and ordinary-value controls still pass. Refusals
-contain no offending value and never claim a partially redacted snapshot.
-
-The previous head's CI floor identified bare algebra-provider references and an
-ambiguous shorthand `domain` binder. List operations now use their native method
-forms, and the observer uses an explicit binder. Uppercase `Host` remains unchanged.
-
-Correction validation: the combined full-root run passed 51 controls and
-regenerated the workflow. After the CI-reference corrections, all 15 parser and
-six publication controls passed again. The regenerated emitted shell passed the
-clean-root success control, left the exact upload artifact, and rejected the
-planted unmatched receipt read. `git diff --check` passed. Exact-head CI is the
-remaining repository-wide check; no live provider or IAM actuation was used.
diff --git a/docs/plans/namespace-cut-replacement-plan.md b/docs/plans/namespace-cut-replacement-plan.md
index cbd3d95bd22..d28f4ffe986 100644
--- a/docs/plans/namespace-cut-replacement-plan.md
+++ b/docs/plans/namespace-cut-replacement-plan.md
@@ -112,7 +112,7 @@ Standing census on the branch (2026-08-15, dated record): **5,531 hard diagnosti
 ## Step 2 — host and emit machinery
 
 - `src/v1/stage0/src/cli_run.rs` (**frozen file — surgical trims, never deletion**): `extract_import_paths` (the starts-with-import text scanner every host import fact builds on), `resolve_virtual_source_with_imports`, `source_declares_import_lines`, `import_module_paths_for_typed_module`, `emit_import_admission_list`; the closure-walk family (`build_import_adjacency`, `import_closure_from_adjacency`/`_from_facts`/`_live_paths`/`_live_paths_with_facts`, `reference_only_direct_import_paths`, `entry_file_touched_via_import_closure`, `import_closure_module_reaches_carrier_home`, `collect_import_closure_module_names_from_facts`, `roster_import_closure_nodes_pre_resolve`, `import_closure_files_from_graph`, `touched_file_in_import_closure`, `import_closure_repo_paths_for_entry`, `augment_closure_modules_from_import_facts`, `import_closure_dag_files`); the `declared_import_closure_*` compile family incl. `compile_entry_on_declared_import_closure_only` and `observe_declared_import_closure_symbol_binding`; the unlisted-import census family (`classify_unlisted_import_binding_source`, `compile_clean_unlisted_import_census`, `compile_clean_unlisted_import_use_blocks_from_policy`/`_cached`); the class-b import-closure gates
-- `src/v1/05_emit_rust.dag` (+ twin `v1_compiler_emit_rust.rs`): `emit_imports`, `emit_extract_import_paths_fn` — **this one prints the import scanner into generated stage0; cut it in the same pass or the seed regrows it on regen** — `augment_scoped_data_item_index_with_imports`, `module_imports_std_serialization_coproduct_wire_contract`, `record_lit_resolved_ctor_import_names`, `emit_specific_import_block`, `explicit_import_source_module_for_name`, `import_variant_parent_for_name`, `wildcard_import_pool_surface_names`, `import_module_enum_scope`
+- `src/v1/05_emit_rust.dag` (+ twin `v1_compiler_emit_rust.rs`): `emit_imports` — `emit_extract_import_paths_fn` was deleted (generated main already routes compile through `cli_run::compile_emission`; the stamp had no caller) — `augment_scoped_data_item_index_with_imports`, `module_imports_std_serialization_coproduct_wire_contract`, `record_lit_resolved_ctor_import_names`, `emit_specific_import_block`, `explicit_import_source_module_for_name`, `import_variant_parent_for_name`, `wildcard_import_pool_surface_names`, `import_module_enum_scope`
 - Whole-file deletions: `dag/gunbc/instruments/namespace_import_closure_behavioral_transport.dag` (its own dissolution trigger names this cut) · `dag/gunbc/class_b_import_closure_overlay.dag` · `dag/gunbc/declared_import_closure_binding.dag` · `dag/gunbc/instruments/dag_compile_clean_cli_floor_agreement.dag` · `dag/std/import.dag` (empty stub) · `src/v2/test/claim/long/dag_import_block_lexeme_stamp_test.dag` · `dag/test/claim/module_graph_edge_source_witness_test.dag`
 - Partial deletions: `dag/gunbc/compile_clean_diagnostic_policy.dag` (only the `UnlistedImportUse` enforcement declarations + dissolve rows) · `dag/gunbc/instruments/diagnostics_witness_transport.dag` (`diagnostics_import_resolution_suite`, `run_diagnostics_import_resolution_witness`)
 
diff --git a/docs/plans/native-route-parallel-realization.md b/docs/plans/native-route-parallel-realization.md
deleted file mode 100644
index dba126a842d..00000000000
--- a/docs/plans/native-route-parallel-realization.md
+++ /dev/null
@@ -1,70 +0,0 @@
-# Native-route parallel realization (Phase 1 model)
-
-Durable record of the Phase 1 model sent to `eager-raven-113` and accepted with four binding conditions (dashboard GO, 2026-09-14). This document is the artifact to keep. Implementation is not landed under operator wind-down.
-
-Independent program beside A (#11224, frozen, untouched) and B (#11217, royal-hawk owns B and the producer counts). Nothing here may make B's AFTER measurement harder to interpret. A's frozen subject is never altered or delayed.
-
-Gatekeeper: eager-raven-113. Host for later builds/experiments: srv1 (`ssh srv1-lan`; `systemd-run --user --scope -p MemoryMax=24G`; `CTRL_BUILD_MODE=local`). srv2 is reserved for A. Receipt class 3/4 (native driver/observer) → pre-landing exact-head receipt when a later change actually lands code.
-
-## Not credited
-
-Do not claim later:
-
-- `3x`
-- `five minutes`
-- the serial projection
-- semantic equivalence of fierce-lark's merged shard surface
-
-The shard experiment refuted identity volume, memory pressure, allocator return, and host-load tail as causes. The five-shard signature is not yet module-caused (rotation discriminator first; fierce-lark runs it on srv1).
-
-## Homes (cite, do not fork)
-
-Homes accepted as written, not forked:
-
-- `std.realization` — `Placement.LocalChildProcess` (fifth arm). Serial `SourceRootEvalDriver` remains `LocalInProcess`. A prepare worker is a local OS process with its own address space, not a filesystem cache, not a remote host, not an accelerator. Do not nickname Placement as `WorkerKind`. Do not put the arm in `gunbc.compute`. Worker `RealizedStep` = `ExecuteEffect` + `LocalChildProcess` + `Recompute`. Parent merge stays `LocalInProcess` plus `ReadEffect` over worker artifacts (condition 3). Slice 1 does not take a Share cache obligation across siblings.
-- `std.realization_width` — envelope is `process_memory_aware_spawn_width` (cores ∩ memory ∩ pids). This is the bound fold, not a second knob. Do not mint `NATIVE_SHARD_COUNT` / `--width`. `NATIVE_SHARD_INDEX` is an observation label only. **Precondition, fail-closed (landing side chat, 2026-09-15):** that helper is not the envelope on its own — it returns `conservative_fallback_width` when the memory or PID observation is zero, and clamps to one worker when the memory or PID budget fits none, so it can answer with a width outside the observed envelope or admit one worker when physical fit is zero. This realization may call it only after a fail-closed contract has established nonzero, readable CPU, memory and PID inputs and capacity for at least one worker; missing inputs or zero fit produce a named refusal (`NoFeasibleRealization`), and the helper's conservative-fallback and minimum-one arms are not admissible answers here. If a stricter existing operation with exactly those semantics is found at implementation time, bind that instead of wrapping this one.
-- `std.decision` — width *choice* is `select_realization` with a named `DecisionSubject` and the two funded axes from `width_fold_objective_goals` (wall, peak memory; both LowerIsBetter). A Pareto front is not a winner. Requested N above the envelope is `NoFeasibleRealization` (later named `PrepareWidthRefusedAboveEnvelope` in the prepare-shard contract), never a silent clamp. Width is not computed inside `std.goal_assessment` / `ensure`.
-- `gunbc.compute.work_request` / `work_provider_local` — **do not extend** `WorkOperation`. Prepare shards are native-driver work (`NativeTestContext` / `native_test_prepare_module`), not cargo `CompileEntry`.
-- Instrument authority = `scratch/deep-cat-655-span-bisect@5b41958d07d9` (`[native-module-residual]`). Reuse; do not re-derive. Do not retouch `[native-prepare-split]`. Named children subtracted from module parent: prepare, eval, row_accumulation, arm_exit, release, meter. Resolve and infer are reported and nested inside prepare; they are not subtracted. Residual uses checked arithmetic and refuses on negative / missing / duplicate / unmatched. Prepare parent = fixed + Σ module parents + residual; if parent is not nested, refuse.
-
-## Slice 1 construction (approved shape; not landed)
-
-One immutable context in the parent (`NativeTestContext` via `native_test_context_from_ingest`). Fork after this. Context is read-only for workers.
-
-Complete module manifest from that context + `universe.modules`. Assignment: **contiguous slices** over stable module-identity order (condition 4). The same function is used for W=1 and W=N.
-
-Each worker (`LocalChildProcess`) prepares only its assigned modules and writes one artifact.
-
-Named merge step: `prepare_shard_merge`. Law: bidirectional identity+payload join against serial (arm i). Added ∪ removed ∪ payload-changed ∪ duplicate ⇒ refuse the equivalence claim. Completeness is the join, not a count equality. Parent exclusive rows gain a named merge span; it is not stuffed into prepare residual.
-
-## Binding conditions (eager-raven-113 GO)
-
-1. **Acceptance is three arms, not two.** On one pinned quiet-host subject measure:
-   - (i) in-process serial (today's production `SourceRootEvalDriver`);
-   - (ii) W=1 via `LocalChildProcess` + `prepare_shard_merge` (placement price: fork, serialization, merge);
-   - (iii) W=N.
-   Report all three with total CPU, aggregate memory, process count, parent/worker partitions, merge span named. `(ii)−(i)` is the placement price; `(iii)−(ii)` is the width effect. Merge-law join runs against (i).
-2. **Compose on the row-set reshape (#11374).** Add one variant + one roster entry on the keyed exclusive-row collection. Do not add a field to the old literal `NativeDriverExclusiveRows` struct. Build on a branch that includes #11374's head; rebase when it lands on main.
-3. **Worker transport:** artifacts under `RUNNER_TEMP`, one file per worker, content-identified by digest; parent `ReadEffect`; missing / malformed / digest mismatch **refuses** (no partial merge). Digest join is part of the merge law.
-4. **Assignment:** contiguous slices over stable module-identity order (printable interval; rotation can move whole sets). Same function for W=1 and W=N.
-
-Everything else as in the model, including: no second width knob; `NATIVE_SHARD_INDEX` is an observation label; slice 2 declarations land with slice 1 but implementation waits on slice 1's green three-arm receipt; receipt class 3/4; srv1 only.
-
-RED list for a first implementation push (not this wind-down PR): merge-law added/removed/changed; residual refuse arms; width > envelope refuses; missing worker artifact refuses.
-
-## Slice 2 — modeled with slice 1, implemented after proof
-
-Context map/reduce: partition ingest reads by source-root file identity. Mappers produce partial fold state; reduce concatenates roots, merges indices fail-closed on duplicate module names, concatenates file_refusals. Placement: same `LocalChildProcess` arm. Width: same envelope + `select_realization`. Merge name: `context_shard_reduce`. The reduce is not a fallback to serial context. Implementation waits on slice 1's merge law + instrument + three-arm receipt existing and green.
-
-## Honesty vs a later implementation attempt
-
-A construct attempt existed on `session/crisp-hawk-831` / #11378 and is **not** the landed program. Known gap against this model: children that re-exec and rebuild context are not fork-after-context; `(ii)−(i)` would be contaminated until workers inherit the parent's context (COW fork or a serialized context artifact) without re-ingest.
-
-## Where bytes would live (when implementation is authorized again)
-
-- `dag/std/realization.dag` — `LocalChildProcess`
-- exhaustive `Placement` matches (accelerator demo and peers)
-- `std.compiler_entry` keyed exclusive roster — `ExclusivePrepareShardMerge` / wire name `prepare_shard_merge`
-- `gunbc.native_prepare_shard` — contract (envelope, selection, assignment, merge, artifacts, residual law, slice 2 standing)
-- `v1.compiler.emit_rust` `SourceRootEvalDriver` — production default remains in-process; child path is opt-in via placement + selected width (selection receipt, not a second knob)
-- witnesses: `dag/test/claim/native_prepare_shard_witness_test.dag` and exclusive-key exhaustive matches including `ExclusivePrepareShardMerge => 0`
diff --git a/docs/plans/native-scm-cas-fit-and-consumer-cut.md b/docs/plans/native-scm-cas-fit-and-consumer-cut.md
deleted file mode 100644
index c825dedd8c9..00000000000
--- a/docs/plans/native-scm-cas-fit-and-consumer-cut.md
+++ /dev/null
@@ -1,81 +0,0 @@
-# Native SCM: CAS semantic fit and first consumer cut
-
-Phase 0 ruling, 2026-09-13. This records the dependency contract for Phase 1; it declares no SCM carriers and implements no transition. The consumer is the Phase 1 implementation and its composition evidence. This record remains the semantic boundary for subsequent authoring and landing routes.
-
-## Shared authority and payload fit
-
-The leasing/locking home is `std.durable_compare_and_set`, realized by `gunbc.durable_cas_file_store::file_compare_and_set`. `CasOutcome<T>` needs no additional arm for stale generation, absent target, or unexpectedly occupied target:
-
-- `CasPreconditionFailed { expected: ExpectSlotGeneration { generation }, observed: CasReadableAbsent }` preserves a missing expected slot.
-- `CasPreconditionFailed { expected: ExpectSlotAbsent, observed: CasReadablePresent { version } }` preserves an unexpectedly occupied slot.
-- `CasPreconditionFailed { expected: ExpectSlotGeneration { generation }, observed: CasReadablePresent { version } }` preserves a generation disagreement. `CasSlotVersion` carries the observed generation, content hash, and value.
-
-The successful arm retains the committed version. `CasStoreRefused` retains `CasUnreadableSlot`, including malformed state, missing referenced content, and refused reading. `cas_decide` preserves the readable/unreadable distinction before evaluating the expectation. No SCM-local synonym sum may replace this authority.
-
-Exact native parent identity and slot generation are different facts. A generation expectation alone does not identify the native parent: the consumer must bind the proposed native transition to the parent held by the observed slot version. Git SHA, PR number, and CAS generation are not native commit identity.
-
-## Realization findings: payload sufficiency is not execution sufficiency
-
-Inspection of `file_compare_and_set` confirms that its initial eligibility branches preserve all three precondition cases above. `cas_probe_as_readable` supplies generation, recomputed content hash, and value for `ProbedHead`.
-
-The realization does **not** preserve the full refusal partition on every path:
-
-1. `cas_probe_from` treats every unsuccessful `Filesystem.Read` as the chain end. Permission or I/O refusal can therefore become absence or an earlier apparent head. Its comment names typed read failure as unavailable, but `extdeps.filesystem.filesystem_io::Filesystem.Read` now exposes `error_kind`, and `filesystem_exact_read` distinguishes absent, unreadable, and unrecognized failure kind. The adoption capability exists; this consumer has not adopted it.
-2. `cas_commit_at` maps every unsuccessful `Filesystem.WriteOwnerOnly` to `CasPreconditionFailed`. It does not establish that another writer won. An operational write refusal can therefore be mislabeled as a precondition failure, even when the re-observed state still satisfies the expectation.
-3. That same failed-write branch calls `cas_probe_as_readable`, whose `ProbedBeyondBound` arm deliberately returns `CasReadableAbsent` for its documented reporting use. The defect is consuming that projection to construct a decision payload without establishing a lost race. In contrast, the initial `file_compare_and_set` branch and `observe_cas_slot_state` preserve a bound refusal as `CasUnreadableMalformed`.
-
-These are defects in consumption of the existing authority, not evidence for a fourth CAS outcome. Phase 1 must repair the realization at its existing home and preserve transport refusal through the shared outcome. `WriteOwnerOnly` currently omits the host `error_kind` output that `Read` and `WriteCreateNew` expose; its consumer must obtain typed write classification without parsing error prose.
-
-No new wet execution was performed for this ruling. The findings above are source-contract findings, not a claimed rung or proof of durable publication. Exclusive creation must not be confused with atomic visibility of complete bytes or crash durability. The Phase 1 composition evidence must establish those publication properties before a mutable slot may name an immutable object.
-
-The transport distinction is concrete: `v1_compiler.v1_interpreter::write_file_owner_only` opens the final path exclusively and then writes its content. A post-open failure can leave partial bytes at the slot path. The adjacent create-new contract explicitly treats owner-only exclusion as incidental to permissions, whereas `extdeps.filesystem.filesystem_io::Filesystem.WriteCreateNew` promises create-only publication and its realization publishes complete content through a sibling file. Phase 1 must bind the CAS realization to contractual exclusive, complete publication and establish durability; correcting error classification alone is insufficient. The transport realization home is `extdeps.filesystem.rust_realization`, not an SCM-specific filesystem algorithm.
-
-## Read-back is a separate relation
-
-Independent read-back consumes a committed receipt and observes the same target. It cannot rewrite `CasCommitted` into a claim that the CAS did not commit. Store refusal, precondition failure, committed-with-read-back-unavailable, and committed-with-read-back-disagreement remain distinguishable. Only the last two require composition over a committed receipt; neither extends or replaces `CasOutcome`.
-
-A later target generation also cannot erase the receipt: read-back must distinguish subsequent advancement from disagreement about the committed version. A verified transition requires evidence bound to the exact committed subject. A caller-authored expected value is not independent observation.
-
-## Exact Phase 1 dependency and consumer cut
-
-Existing producer symbols to consume:
-
-Before either SCM slot consumer relies on the store, repair these prerequisites in order:
-
-1. Bind CAS to contractual exclusive, complete, durable publication at the existing homes `extdeps.filesystem.rust_realization` and `gunbc.durable_cas_file_store`. The finding is `gunbc.recurring_failure_mode.consumer_relies_on_incidental_realization_property::consumer_relies_on_incidental_realization_property`. An SCM-local safe-write helper would fork the existing authority. A correctly classified refusal over torn slot bytes is still unsafe, so this prerequisite comes first.
-2. Repair refusal-as-contention and unreadable-as-absence at `gunbc.durable_cas_file_store`, consuming the existing typed filesystem observations. The finding is `gunbc.recurring_failure_mode.store_refusal_reported_as_contention::store_refusal_reported_as_contention`.
-
-These are source-verified readings of contract mismatches, not executed reproductions. The repair lane owes the discriminating REDs. Both defects affect the existing compute control-plane consumer; absence of an SCM caller does not make them prospective.
-
-- `std.durable_compare_and_set::{CasAttempt, CasExpectation, CasGeneration, CasSlotVersion, CasOutcome, cas_attempt, cas_decide}`: the shared conditional-publication vocabulary and decision.
-- `gunbc.durable_cas_file_store::{admit_cas_attempt, VerifiedCasAttempt, file_compare_and_set, observe_cas_slot_state}`: verified attempt admission, store-owned conditional publication, and independent slot observation. `VerifiedCasAttempt` verifies the encoded payload/hash pair; it does not verify the transitive SCM objects named by that payload.
-- `extdeps.filesystem.filesystem_io::{filesystem_exact_read, filesystem_create_new}`: existing typed transport-result classification. Upstream filesystem facts remain at that authority, conforming to `extdeps.external_authority::ExternalModelScope`; SCM policy belongs downstream.
-- `gunbc.scm.object_store::{ScmObject, CorpusManifestObjectRef}` and `gunbc.scm.ancestry::RepositoryCommitRef`: existing SCM object and commit reference subjects. Their current locator semantics must not be silently promoted into durable cross-party content identity.
-
-The first consumer carriers to be declared **in Phase 1**, not here, are a repository-target generation slot and a workspace-scoped stage/base slot. These are semantic names for the cut, not claims that declarations already exist.
-
-The repository-target slot binds one repository and target to its native parent/commit reference and CAS version. Its conditional advance consumes the exact observed generation and a candidate bound to that parent. The workspace slot binds one independently mutable workspace to its selected base and staged manifest, with its own CAS version. Two workspaces share immutable objects and repository targets, but never one mutable stage/base slot. Workspace identity is independent of author identity.
-
-For each slot, the consuming route is immutable object put-if-absent publication, durable independent verification of the referenced closure, slot payload encoding, `admit_cas_attempt`, `file_compare_and_set`, independent read-back, then composed transition standing. Any unavailable capability refuses at its own boundary. The first two steps cannot be substituted with an in-memory object-table insertion.
-
-`gunbc.scm.repository_envelope::RepositoryEnvelope` currently carries one document's stage selection; it is not the multi-workspace slot authority. `gunbc.scm.repository_save::save_repository` persists a checked document unconditionally and must not become the conditional publisher. Phase 1 consumes the shared CAS home instead of cloning it or hiding mutable workspace selection inside that document.
-
-The cut closes only when wet evidence executes the entire object-to-verification-to-CAS-to-read-back composition for both slot subjects, including contention and independent workspaces. Re-proving the isolated linearizer, declaring these carriers, or landing a ticket does not satisfy that trigger.
-
-## Mandatory Phase 1 provider gate
-
-2A, publication integrity, precedes 2B, outcome fidelity. Success means one exclusively published final generation containing the complete proposed value. Failure before publication means no final generation path ever became visible. An occupied target leaves its existing complete generation untouched. `WriteCreateNew` is the nearest surviving construction, but fsync of a private staging file does **not** establish durability of the final directory entry: either the contract and implementation cover the publication metadata, or the claimed durability rung stays lower.
-
-For 2B, real occupancy or a genuine race yields `CasPreconditionFailed` with the re-observed winner. Permission, storage, IO, staging, sync, or publication failure yields `CasStoreRefused`. Error prose is never parsed to choose between them. Finding no readable winner on a second observation cannot widen a store refusal into contention.
-
-The repair lane owes these wet controls:
-
-- Inject failure after staging writes begin: no final generation exists.
-- Inject failure before publication completes: no committed CAS outcome is returned.
-- Race two eligible writers: exactly one commits; the other reports precondition failure naming the observed winner.
-- Cause a non-contention store refusal: preserve `CasStoreRefused`, never precondition failure.
-- Restart and independently read back: exact generation, content identity, and value agree.
-- Mutate the realization back to direct final-path open-then-write: the partial-publication control turns red.
-- Mutate the fold to classify every failed publication as contention: the store-refusal control turns red.
-
-Phase 1 may not declare the CAS realization suitable for native SCM until **both 2A and 2B pass their wet controls**. This gate is a prerequisite to SCM consumption, not an assumption its tests may make. The three discovery records remain source-verified findings, not executed closures.
diff --git a/docs/plans/native-scm-census-coverage.md b/docs/plans/native-scm-census-coverage.md
deleted file mode 100644
index bb64a61d809..00000000000
--- a/docs/plans/native-scm-census-coverage.md
+++ /dev/null
@@ -1,45 +0,0 @@
-# Native SCM census: discovery and coverage standing
-
-This is an incomplete, source-verified census and an unconnected terminal policy. It is not an executing required-lane import wall. No complete Git-use population, successful policy-control run, or Git-free SCM execution guarantee is claimed.
-
-The appendable use rows live under `gunbc.git_use_census`; `gunbc.git_use_census.roster::git_use_rows` supplies them to `gunbc.git_use_authority::git_import_authority_verdict` in the pure controls. Adding one use does not regenerate DESIGN. These six enrolled uses are all classified: three workspace/source-authority uses, two proposal/review/publication uses, and one history/diff/gate-observation use. There are zero enrolled bootstrap/import, deployment/fleet-identity, compatibility-projection, or unclassified rows. That does not mean those populations are empty. The Rust population currently has three named rows, and the configured-process population one; neither roster is complete.
-
-## Discovery is unfinished
-
-Read-only textual searches nominated candidates for source inspection. Those searches are not a closed discovery oracle, do not establish reachability, and do not authorize a clean census verdict. Each enrolled row was checked against its consuming declaration. Unexamined candidates have not been disguised as typed `UnclassifiedGitUse` refusals. That arm is reserved for an observed use whose role cannot be decided, with its reason recorded.
-
-The remaining population is **unknown for two of the three surfaces and DERIVABLE for the third**, and an earlier blanket "unknown" here was wrong. Rust uses and configured `.dag` process invocations have no producer that enumerates them, so their remainder is genuinely unbounded at this revision. But `ParsedDagGitDependency` — the one surface this policy covers — is derivable *from the same import fact the policy consumes*: the non-fixture `.dag` modules under `dag/` and `src/` carrying a direct module-level `import extdeps.git*` or `import extdeps.github*`, partitioned by whether the module is itself inside `dag/extdeps/` (the authority side) or outside it (the consumer side). That recipe is the instrument, and its output is deliberately not transcribed here: a count copied into prose is unreachable from the thing that owns it and rots without anyone touching either end (DESIGN §6). Standing the recipe up as an entry point that re-derives the consumer-side population, and joining it to this ledger at identity grain, is the first obligation of the census-completion lane — it is what turns this surface's remainder from an assertion into a closed identity join. The two surfaces without a producer keep their existing next-rung triggers.
-
-One reading worth recording because it is a positive result rather than a gap: **no module under `dag/gunbc/scm/` carries a direct `extdeps.git` or `extdeps.github` import**, by that same derivation. That is the wall's own subject measured clean today — and it is exactly as narrow as it sounds, since it says nothing about the configured-process bypass, which no import fact can see.
-
-The existing `v1_compiler.cli_run::run_dag_parse_sweep` discovers paths before parsing and refuses unreadable directories, directory entries, source reads, and parse diagnostics. Its existing parsed `DeclarationIndex` is the specified import producer; this ticket must not add a second scan or parse. However, `DagParseSweep` currently returns the index and a count, not the independent pre-parse source-path roster. The proposed policy input requires that roster separately from the parsed module records. `git_import_authority_verdict` joins their path identities in both directions; an omitted expected source or unexpected parsed source refuses, even when counts agree. An unavailable or explicitly incomplete producer also refuses. Copying successful module paths into both inputs would violate the producer contract, not establish completeness. These declarations do not prove that a producer currently supplies the independent input.
-
-The remaining capability is to carry the existing required walk's source identities through its parsed-index projection, preserving every failure, then execute the same policy on the required acceptance path. Hand-Rust projection/invocation remains subject to the pending external scaffold approval. No host wiring is authored here. The existing line scanner `v2.std.layer_import_scan::layer_import_facts_live` is expressly unsuitable: its unreadable-source omission is recorded separately under `gunbc.recurring_failure_mode`.
-
-## The wall's actual population
-
-The policy declaration itself names all three coverage populations:
-
-- Direct `.dag` Git/GitHub imports: policy coverage only today. After required-lane enrollment and discriminating controls, closure can be reported mechanically preventable; the forbidden import remains writable. The structural next capability is construction of source dependencies that cannot express a forbidden edge.
-- Rust Git/GitHub uses: unreached, reported as use-identity rows in the verdict. The next capability is a Node-derived dependency producer whose source scope includes Rust.
-- Configured or opaque `.dag` process invocation: a **KNOWN BYPASS** of the direct-import policy. `gunbc.roadmap.roadmap_event_carrier::carrier_exec` executes `layout.git_program` without a use-site Git import. Closing this bypass requires Node-derived process provenance through capability bindings and caller-supplied arguments. No claim is made that merely finding Nodes establishes that provenance analysis already executes.
-
-In particular, the policy refuses direct Git/GitHub imports in `gunbc.scm.*`; it does not establish absence of Git execution there. Roster growth approval is another subject: review diligence only, mitigatable, until externally originated approval evidence for the exact changed obligation set is verifiable at the gate. A row cannot attest its own approval.
-
-## Mode and landing construction
-
-`NativeAuthorityMode` and the row disposition pair are a declared consumption frontier; the selector that read them is NOT in this PR and lands with its consumer. Their planned consumer is `gunbc.git_use_census.report::report_git_uses`, to be supplied by the separate census-completion follow-up: read `git_use_rows`, select each row's disposition, and render it beside the use identity. That entry does not exist today. Its trigger is execution of the report for both modes on the enrolled population. The removed selector test merely compared each projection with its input field; it established no production consumption. The production authority route belongs to ticket 6, not Phase 1's CAS consumption. It does not make the existing `gunbc.native_scm_interaction_contract` Landed presentation unwritable without evidence. The missing capability is an independently observed exact Git merge/read-back and imported native baseline producer, bound to the candidate, with an exclusive bridge-landing mint. No validator is claimed as construction.
-
-Bridge publication must deterministically project an exact native candidate to one idempotently maintained PR, independently observe and read back the merge, and import the next native baseline before reporting native landing. A legacy GitHub-main advance imports explicit Git provenance and makes proposals on the previous baseline stale for mechanical re-evaluation. Native-authority landing is the native exact-parent advance; Git projection follows it, and an outage records projection repair pending without rollback or Git fallback. Native identities and Git identities are mapped, never equated. These are future route obligations, not implemented routes in this phase.
-
-## Evidence and remaining acceptance work
-
-The first recurring-failure row compiled in a targeted remote closure. The remote compiler build for the pure control suite succeeded, but execution refused with `HostBudgetUnreadable`: that worker exposed no enforceable cgroup memory limit. Thus there is no successful pure-control execution receipt, let alone a required-lane receipt. The targeted policy-closure compile completed with two blocking diagnostics: `bridge` and `native` were not found in scope. Source inspection locates the rejection in `v1.compiler.infer::infer_expr_body`: its local-callable branch uses nonempty parameter cardinality to recognize callability, rejecting the declared zero-argument function parameters. This is a substrate blocker, reported to the parent for repair at its authority; no selector spelling workaround is authored. The requested local control invocation also did not execute: the checkout has no built interpreter, and the shim refused to substitute another revision. No local compiler build or budget override was used. The CAS and producer findings are SOURCE-VERIFIED readings of contract mismatches, not executed reproductions.
-
-The exact-path controls still owed are forbidden-import refusal; legal adapter and rostered-legacy acceptance; refusal after withdrawing or misclassifying either authorization; incomplete/unavailable producer refusal; a host mutation ignoring the policy refusal detected by a control; and a policy mutation admitting the forbidden edge detected by a control. Pure fixture tests do not discharge those required-lane obligations. The full production census, adapter inventory, source identity producer, host connection, and these execution receipts remain unfinished.
-
-The CAS ruling and ordered Phase 1 producer/consumer cut are in `native-scm-cas-fit-and-consumer-cut.md`. Its provider repairs are prerequisites, not work implemented here.
-
-The parent amended the Phase 0 exit gate to land these six rows explicitly incomplete. Closing the production census population is a separate follow-up lane owned by the parent, not an implicit addition to Phase 1. Required-lane wall wiring remains a declared frontier; the present identity-join input contract is not a receipt from an independently populated executing producer.
-
-The data-versus-callable decision is separate from the inference defect. Each constant disposition already lives in a `data GitUseRow`. The generic selector accepts deferred computations so only the selected route is invoked; those parameters are not nullary declarations returning constants. Replacing them with result values would change selection-before-execution into selection between already supplied results. That is not the intended route contract even with a working compiler. The selector specimen remains unchanged and blocked on the parent's separately dispatched nullary-callable inference repair. That lane owns the root-cause fix, its execution evidence, and its failure-mode row.
diff --git a/docs/plans/native-succession-consumer-cutover.md b/docs/plans/native-succession-consumer-cutover.md
deleted file mode 100644
index 307cb896ed1..00000000000
--- a/docs/plans/native-succession-consumer-cutover.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# Native succession and operational cutover
-
-This is the L4 execution design, not an acceptance receipt. `v2.compiler.self_host.promotion_admission` owns promotion; `gunbc.v1_consumer_census` owns consumer relations and projects them into `gunbc.replacement_cut`. No generation has been promoted or consumer switched by this change. The native executable and compile interface are the L2 handoff, not assumed inputs that this document can supply.
-
-## Consumer trace
-
-The additional relations are produced by `gunbc.v1_consumer_census` `v1_native_cutover_selector_consumers` and `v1_release_pack_consumers`. Their discovery method and inspected revision/tree are carried by `producer_native_cutover_selectors`. The older producers retain their own pins. The pack relations derive from `gunbc.ci_release_bins` `ci_floor_required_artifact_names`; they are not a copied executable roster. That function enumerates required build/pack dependencies, which does **not** establish that each packaged executable runs.
-
-| Operational path | Existing selector / dispatch | Dependency that cutover must remove |
-| --- | --- | --- |
-| Cold CI and fleet builds | `gunbc.repo_self_build` `repo_self_build_package`, read by `repo_self_build_command` and `repo_self_build_all_bins_command` | Builds package `v1-compiler`; installing a native `gunbc` alone leaves this route live. |
-| Missing witness executable | `tools.host_prelude` `witness_bin_ensure_built_typed` → `witness_bin_build_args` | Builds the enrolled binary from `v1-compiler` when the release path is missing. A warm run does not exercise this branch. |
-| Claim dispatch | `tools.host_prelude` `run_gunbc_claims_ready` → `claim_batch` | The binary links the v1 interpreter. Required witness identities and their positive/refusal contracts must survive replacement. |
-| Required build and witness lanes | `gunbc.witness_floor_workflow` `build_lane_run_step`, `witness_floor_run_step` | Both execute `claim_executor`; these relations already existed in the census. |
-| Generated-artifact healing | `gunbc.witness_floor_workflow` `heal_regen_step`, `heal_repair_declaration_step`, `heal_repo_local_git_config_step` | Executes `gunbc run` for generation, agreement, pre-mutation repair observation and repository configuration. |
-| Ordinary CLI run | `v1_compiler.main` `run_verb` → `v1_compiler.v1_interpreter` `run_in_context_with_args` | Linked interpreter execution remains even if a separate native compiler handles `compile`. |
-| Required seed regeneration | `v1_compiler.required_regen_host` `compile_stage0` → `v1.compiler.compile` `compile_sources_selected` | Calls the v1 implementation in-process over the regeneration source population. |
-| Rebuilt-seed second pass | `v1_compiler.required_regen_host` `run_built_seed_regen` → rebuilt `claim_executor --required-regen` | The executable digest is checked, but the executable is still the seed. This route is not evidence for seed-independent G1→G2. |
-| Release pack, including product transports | `gunbc.ci_release_bins` `ci_floor_required_artifact_names` | Each target receives its own consumer relation. In particular, the Codex stdio transport's product contract cannot be retired as a compiler test. |
-| Git hooks | `gunbc.githooks_pre_commit_emit`, `gunbc.githooks_pre_push_emit`, `gunbc.generated_artifact_merge_driver` | Current pre-commit/pre-push scripts configure git and format; the merge driver refuses and prints a repair recipe. Printed regeneration commands are not an automatically executed compiler path. The existing historical recipe relation does not prove hook execution. |
-
-These are source-body and caller traces, not measurements of executed processes. The census remains `PopulationMeasuredLowerBound`. Three gaps remain explicit: unclassified DAG argv rows outside the selected roots; dependencies internal to the deletion set beyond the traced regeneration and workspace-member relations; and whole-repository reachability. Neither a missing lexical match nor a present pack member settles reachability. Historical `Retire` rows are not proof that the current corresponding path has disappeared.
-
-The census's lower-bound standing must survive the eventual promotion/cutover composition. An empty blocking set in an incomplete population is not terminal admission. Likewise, a live pack projection observed against a newer tree does not refresh the discovery pin: re-run the manifest and caller joins before using those relations as cutover evidence. The name-to-main mapping in `v1_release_bin_main` was checked against the manifest at the declared discovery pin; future manifest path changes require remeasurement.
-
-For the next census pass, start from actual entrypoints and follow both the present-artifact and missing-artifact branches. Join workflow argv to its emitting declaration, binary name to the Cargo target/path, target to linked implementation, and runtime dispatch to the invoked operation. Retain the witness or input selecting a conditional branch. Report unresolved dynamic invocations as unmeasured edges, never as absent consumers. Cargo targets outside the release pack also need their own demand/disposition evidence before the population can become complete. The manifest inspection found `carrier_realization_census` and `type_occurrence_binding_census` outside that pack; both link v1 and remain unclassified here. Their absence from the pack is not evidence that their capability obligations can be deleted.
-
-## Proposed seed-exclusion boundary
-
-The producer must establish unavailability, not report that a trace happened to contain no seed call. This design is not yet an implemented sandbox or a receipt.
-
-1. Materialize a disposable execution root from an explicit input manifest: the pinned authoritative source closure S, the exact native G1 artifact, and the declared external toolchain and system dependencies. Do not mount the repository checkout, seed executables, seed source/build workspaces, shared Cargo target outputs, host home, Docker socket, or the oracle's filesystem. Remove inherited descriptors and credentials, prohibit network access, and constrain filesystem/process access to this root. An empty PATH alone is insufficient: an absolute path, inherited descriptor or helper could still reach the seed.
-2. Build in a new isolated workspace/target directory using the emitted implementation. Join the complete Cargo dependency graph and every build-script/source input against the admitted build manifest. Refuse unknown dependencies and any retired implementation dependency. Package-name bans and `ldd` output alone cannot establish this: renamed packages, static linkage, or copied seed bodies evade them. The L1/L2 declaration-to-produced-source coverage and producer provenance are prerequisites for the claim that G1 itself contains the replacement implementation.
-3. Launch G1 on S inside that boundary to produce G2 source; build G2 under the same input restrictions. The seed oracle runs separately and supplies comparison observations only. It cannot be a build dependency, subprocess, service, or fallback available to G1/G2.
-4. Bind an enforceable memory cgroup for the launched process and its descendants and read the effective limit back before execution. A declared planning number is insufficient. The executor may be BuildBuddy or a CI runner; the capability, source pin and artifact provenance decide admission, not the venue. A sized BuildBuddy runner with a writable delegated child cgroup is an available realization to investigate, so no new required CI job is implied.
-5. Exercise the boundary with deliberate attempts to execute a seed path, open a seed artifact, resolve a seed Cargo dependency, and invoke a fallback. Require the expected located denial from each attempt beside a permitted native/toolchain control. A failing process without the denial observation is unavailable evidence, not proof that exclusion worked.
-
-The correctly hashed rebuilt-seed specimen is filed in `gunbc.recurring_failure_mode.authority_substitution`. Its distinguishing control is a candidate wrapper whose self-launch succeeds while its build still links the retired compiler; replacement admission must refuse that wrapper. This control complements the external-access denials, since an in-process seed makes no external call to deny.
-
-The general host isolation and launch operations must be modeled at their owning `std`/`extdeps` layer before implementing a transport. L4 must not put an unmodeled sandbox into hand-Rust and then bless it with a Bool.
-
-## Binding evidence to the launched artifact
-
-`BehavioralComparisonObservation` currently carries outcomes and a corpus, and its receipt projections accept a caller-supplied `GenerationIdentity`. That API alone cannot prove which executable ran. For native promotion, the execution observer must obtain identity from the immutable artifact it actually launches and carry the observed launch binding through receipt assembly.
-
-A candidate realization is a sealed executable object or an immutable content-store object held by the launcher. The same object is hashed using the existing observed artifact digest carrier and executed; hashing a pathname and later reopening it leaves a replacement race. The launcher owns this binding, captures process completion and case output, and rejects any mismatch with the declared artifact before producing receipts. A read-only mount is only sufficient if its backing object cannot be replaced or modified for the run's duration. Dynamic loaders and shared libraries belong in the admitted dependency manifest too. This is a proposed transport contract, not a claim that current `WitnessBin.Run` enforces it.
-
-The remaining generation axes come from the pinned production inputs: producer artifact, source closure, target model, toolchain and build configuration, including build location or a verified path-remapping policy. G2 provenance joins the exact G1 launch, exact S input, emitted population and resulting G2 artifact. The caller cannot turn an unrelated successful observation into evidence for this chain merely by naming G1 or G2 at assembly time.
-
-Behavioral evidence must join required **case identities and outcomes**, including positive cases and intentional refusals. Equal counts are insufficient, as the census's same-size substitution control demonstrates for consumer identities. Planted faults need a reported disagreement at the expected case; process failure alone is not detection. The corpus used for G1, G2 and the fault control must be the same admitted population. Consume `gunbc.explicit_witness_admission` `known_red_probe_execution_roster` through its existing self-host projection; expected-red quarantine for a missing required capability remains open. Consume `seed_retention_frontier_roster` for retained obligations. Discharge each through execution or an explicit changed contract; do not copy either population into an L4 backlog.
-
-Only after those observations exist can they feed `admit_promotion`, and only after named consumer executions select its admitted artifact and old operational routes are retired can the terminal cutover claim hold. Required generated-file byte agreement remains a separate live obligation throughout; behavioral promotion does not waive it.
diff --git a/docs/plans/nominal-type-declaration-plan.md b/docs/plans/nominal-type-declaration-plan.md
deleted file mode 100644
index 6a41a0fb660..00000000000
--- a/docs/plans/nominal-type-declaration-plan.md
+++ /dev/null
@@ -1,260 +0,0 @@
-# PLAN — nominal types as the first consumer of the coercion frontier; delete refinements
-
-**Status: PLAN, revision 5 — design only. Do not re-enqueue.** Revision 4's O3, O4 and O5 are RULED (2026-10-02); O1, O2 and C5 are recut here on the operator's ruling; O6/C4 is a separate lane. Earlier history: Revision 3 (one declaration modifier
-per point in the visibility plane, plus a `derives` list) was approved and then withdrawn by the
-operator on 2026-10-02: too many keywords, and the nominal question is really a coercion question.
-This revision recasts it as the **first consumer of the coercion frontier** that
-[v2 compiler architecture](v2-compiler-architecture.md) §1.4 and its frontier line ("Coercion and
-named conversions") name. §8 places revision 3 (option A) side by side with this model.
-
-Governing sections: DESIGN §4 (operations from inhabitance; the coercion ruling, `bool_indicator`),
-§3 (replacement migrations), §4b, §5; architecture plan §1 (completion law, residual addressees),
-§1.4.
-
-Every count is **provisional** — line greps at main `dd0614551b5`, not the census — and is not a size
-(DESIGN §6). M0, the resolved census (`gunbc.instruments.type_declaration_use_census`, being built by
-tidy-koi-264), is the only admissible size.
-
-> **PARKED (operator ruling, 2026-10-03).** M0 landed as an instrument
-> (`//gunbc/instruments:type-declaration-use-census`, gunbc#13093) with **no M2 sizing**. Its receipt,
-> instrument-dispatch run [37119024146](https://github.com/gunb-ai/gunbc/actions/runs/37119024146), is
-> no observation (exit 2): native resolve reaches only part of the corpus and decides no casts, so the
-> migration cannot be sized. The program resumes when a re-run of the instrument shows enough native
-> resolve and infer coverage. S1 and P1–P3 are moot until then. Re-run the instrument for any figure;
-> none is carried here.
->
-> **Open items from M0's census** (posted on gunbc#13024 by tidy-koi-264; to be settled when this
-> resumes):
->
-> 1. **Bodyless declarations that are not `nominal_opaque`** (`type MachineWidth<bits>` and similar)
->    have no row in the declaration table, and the census reports them as `BodylessUnclassified`. The
->    plan must say whether they are phantom/index types, abstractions with no view, or a further class.
->    Under rev 5's model they are the bodyless form, but whether every one of them needs modeled
->    operations (§3) is not decided.
-> 2. **Existing one-field records.** The census classes them as `UnconstrainedNominal`. Under rev 5 a
->    one-field record *is* a nominal (records are nominal), so that reading agrees with §2. Whether they
->    should still be reported as a separate row, so that authored brands and pre-existing records stay
->    distinguishable in the migration, is open.
-> 3. **Opaque's second disjunct** ("a nominal whose view no consumer outside its module reads") is not
->    computed. Only `nominal_opaque` decides `Opaque`. Computing it needs view-read evidence, a
->    representation read outside the declaring module. Rev 5's §3 relies on exactly that evidence
->    (`EffectivePosixPrincipalName` → record), so the generated cutover needs it.
-> 4. **`OperationWorkaround` for encoding** cannot be classed while encoding's capability home (S2) is
->    unnamed. Until then, encode-shaped strips go to the exception list with the callee named in their
->    evidence.
-
-## 1. What stays as ruled
-
-- `type X = Y` is a transparent alias: X and Y are the same type.
-- Refinements (`where <pred>`) are deleted. Every invariant becomes a checked construction one layer
-  down.
-- No typecase, and no conditional design for one. Matching is on constructors and closed sums.
-- M0, the resolved semantic census, sizes the migration.
-- The cutover is one atomic, generated PR that deletes `where`, `brand`, `nominal_opaque`, the v1
-  spelling matches and hand tables, `gunbc.where_refinement_predicate_vocabulary` with
-  `WherePredicateGrounding`, and #12506's parked row together (the full consumer list is revision 3 §6, commit 97dea7c55fd, and stands unchanged).
-- Checked construction returns `Result` residue plus a typed cause (`std.error_primitives` `Result`).
-
-## 2. The model: four forms, no new words
-
-> alias = equality · record = visible constructed data · bodyless = abstraction · functions = explicit progress
-
-| form | meaning | in | out | operations |
-|---|---|---|---|---|
-| `type X = Y` | alias; X and Y are the same type | — | — | Y's |
-| `type X { value: Y }` | a new type with visible data | its constructor (confinable by `sole_constructor` + `admit_callers`) | field projection | product inhabitance (§4) |
-| `type X` (bodyless) | an abstraction; the declaration is all a client sees | only by the module's modeled operations | only by the module's modeled operations | only modeled operations |
-| `fn` | explicit progress between any two types | — | — | — |
-
-The brand (`where brand("…")`), the refinement and `nominal_opaque` stop being declaration facts:
-
-| old mode | becomes |
-|---|---|
-| brand | one-field record, public constructor |
-| refinement | one-field record, `sole_constructor`, plus a public checked function `Y -> Result<X, R>` |
-| `nominal_opaque` | bodyless `type X` whose operations its module models (§3), or a record when the census shows nothing needed hiding (as for `EffectivePosixPrincipalName`, §3) |
-
-No crossing between a nominal and its representation is implicit (§5). A crossing is a residual
-addressed to the call site (O4, ruled: the addressee home is `v2.std.residual`), and the developer
-answers it with an ordinary function call (O5, ruled).
-
-**Routes are proven, never inferred from a signature (O1 as ruled).** A signature proves neither
-exactness nor injectivity: `id.value`, `concat("roadmap:", id.value)` and `sha256(id.value)` all have
-type `RoadmapNodeId -> String`. So every function remains a valid **explicit** conversion when it is
-called. A function becomes a **compiler-discoverable route** (one a residual may name as its answer,
-and one operations may be derived along) only when the compiler derives a structural homomorphism
-witness for its body:
-
-- `X -> Y` whose body projects the sole field;
-- `Y -> X` whose body applies the sole constructor;
-- `Y -> Result<X, R>` whose success arms construct `X` from the input by the sole constructor.
-
-Two proven routes for one crossing refuse as `AmbiguousTargetCandidate`. There is no keyword and no
-route table: the witness is the authority.
-
-## 3. Bodyless types, proved against every current `nominal_opaque` site
-
-The bodyless form already exists and is already the abstraction/target-realized form: `std.types`
-declares `type Unit`, `type Json` and `type Bytes` with no body, and `v2.std.type_binder` wraps a
-bodyless declaration (`type_opaque_wrapper`). There are two `nominal_opaque` declarations today.
-
-**`std.types` `Secret` (`nominal_opaque = String`).** Today it is opaque in name only. The corpus has
-`as Secret` casts in (M0 `NominalIntroduction` rows targeting `Secret`; most in `test.claim.*` fixtures; production mints in
-`extdeps.cloud.gcp.adc_document`, `extdeps.cloud.gcp.secret_manager`, `gunbc.spark.glm_canary_converge`),
-and `as String` casts out, e.g. `extdeps.cloud.gcp.secret_manager`
-`encode_sm_access_version_payload_wire` and `extdeps.cloud.gcp.secret_ref` (M0 counts
-them). Both directions are unconfined, so DESIGN §4b's "cosmetic until construction enforces it" is
-literally its state. As `type Secret` (bodyless) it needs:
-
-- **trusted construction**: the mints are upstream reads (secret-manager payload decode, the ADC
-  document, credential reads) plus test fixtures. Each becomes a call to a modeled operation of
-  `Secret`, e.g. `secret_of_upstream_text(s: String) -> Secret`, confined by `admit_callers` to the
-  named upstream decoders and the named fixture modules (precedent: `extdeps.apple.app_attest`
-  `attestation_verification_from_implementation` admits named test fixtures);
-- **trusted elimination**: the wire encoders and transports call a modeled `secret_wire_text(s: Secret)
-  -> String`, likewise confined;
-- **its target realization**: `gunbc.rust_source_type_bindings` already has a row binding `Secret` to
-  `std::string::String`. It is `StillBareNameDebt`, waiting on "the same threading capability as Bytes".
-
-**`extdeps.access.posix_effective_principal` `EffectivePosixPrincipalName` (`nominal_opaque = NonEmptyStr`).**
-It has one mint (`effective_posix_principal_observation`) and no read outside its module. Nothing is
-hidden from anyone, so it is a **record** with `sole_constructor`, not a bodyless type. M0 confirms
-there is no outside read before the cutover generates it.
-
-**The capability that does not exist yet: realized operations of an abstract type.** Today a
-bodyless type's operations are host seams: `std.bytes` `utf8_encode_bytes` and `bytes_octets` are
-self-calling bodies that the interpreter intercepts by **name**, and the Rust emitter realizes them from
-a name-keyed bridge table (`extdeps.languages.rust.emit`). `std.bytes` marks that arrangement itself as
-a `Scaffold` (`bytes_seam_host_realization_marker`). So `type Secret` has no trusted
-construction or operation support that is not a name-keyed seam. Per the ruling, that capability is
-what this program names and builds, rather than a word:
-
-> **AbstractOperationRealization:** an operation of a bodyless type is a function whose body is a
-> target-realization row keyed by the function's **declaration** (not its spelling), whose
-> mint and elimination are confined by `admit_callers`, and whose realization per required target
-> (interpreter and Rust today) is declared beside the type's own declaration-keyed binding row.
-
-It dissolves the `Bytes` seam scaffold and the `Secret` `StillBareNameDebt` row with one mechanism.
-It is also the "threading capability" that the row's restoration trigger already names. Its home is
-the existing realization-binding authority (`gunbc.rust_source_type_bindings` and its interpreter
-counterpart), extended by declaration key. It is not a new vocabulary.
-
-## 4. Operations: equality and hash from product inhabitance
-
-- A **record** has equality and hash when every field does. That is product inhabitance, so a
-  one-field record over `String` is comparable and hashable because `String` is
-  (`std.algebra` `algebra_profile_equality_extensional`; `std.content_hash` `HashFamily`).
-  `RoadmapNodeId == RoadmapNodeId` works, and `RoadmapNodeId` where `String` is declared still refuses:
-  the operation is derived, and the value does not cross.
-- A **proven embedding** (a route with a derived witness, §2) may also carry equality and hash. A
-  signature never does.
-- **Ordering never by default** (O3, ruled). It requires an operation the module writes.
-- A **bodyless** type gets only its modeled operations. `Secret` has no display, JSON or equality unless
-  its module models them. Constant-time comparison is a modeled operation, realized per target.
-
-No `derives` list exists in any form.
-
-## 5. What `v2.std.coercion` and `v2.std.inhabitance` must gain (model-first)
-
-What exists today: `CoercionResult { target, quality: Identity | Exact | Widened, witness }`;
-`CoercionMismatchKind = NoTargetCandidate | AmbiguousTargetCandidate | StructuralMismatch |
-WouldLoseInformation`; `find_witness` under `TargetSelectionPolicy`; `declared_type_inhabitance` over
-`DeclaredTypePosition`. `v2.std.refinement_widening_predicate` is representation value-set widening
-(`rust i32 → python int`). It is not the `where` machinery and is kept.
-
-1. **C1: residual addressee** in `v2.std.residual` (O4, ruled). It is minted once and consumed by
-   `v2.std.coercion` first, then by completion (architecture §1.5). Each `CoercionMismatchKind` maps
-   totally to its addressee.
-2. **C2: `ChangesInterpretation`**, a mismatch kind for an exact, lossless crossing that drops or adds
-   meaning (`RoadmapNodeId → String`, `true as Int`). Its addressee is the call site.
-3. **C3: proven route discovery.** It derives the §2 homomorphism witness from a function body
-   (sole-field projection, sole-constructor application, success-arm construction), reusing
-   `v2.std.witness` `HomomorphismWitness`. A residual names the proven routes as its answer. Two proven
-   routes give `AmbiguousTargetCandidate`.
-4. **C4: native `sole_constructor` minting and enforcement plus `admit_callers`.** This is **a separate
-   lane**, dispatched by sharp-raven-357 on 2026-10-03, closing both native drops
-   (`gunbc.rung_drop.admit_callers_discarded_on_the_native_route`, and `sole_constructor` neither minted
-   nor enforced natively). It is referenced, not built here.
-5. **C5: product inhabitance for equality and hash** in `v2.std.inhabitance`: a record inhabits
-   equality or hash when its fields do. A proven-embedding arm is second. There is no signature arm.
-6. **C6: AbstractOperationRealization** (§3), with `Secret` and `Bytes` as its first two consumers.
-7. **C7: the first instrument** named by the architecture frontier: one core module emitted to the
-   Rust and TypeScript targets, with the per-target mismatch list checked against M0's rows.
-
-The migration is then generated from M0: brand → one-field record; refinement → `sole_constructor`
-record plus checked function; `Secret` → bodyless with modeled operations; `EffectivePosixPrincipalName`
-→ `sole_constructor` record; aliases untouched; introduction casts → constructor or modeled-mint calls;
-workaround casts (strip to compare or hash) → the derived operation; true raw consumers → explicit
-projection or modeled elimination.
-
-## 6. Controls (expecting red first)
-
-The six arms of `test.claim.brand_nominal_identity_witness_test` are kept, re-spelled over records:
-COLLISION and MISMATCH refuse; CONSTRUCT, STRIP and DUAL accept; UNDECLARED_SITE refuses at parse.
-These controls are added:
-
-| control | expected after | today |
-|---|---|---|
-| `RoadmapNodeId` at a declared `String`, no call | residual `ChangesInterpretation`, call site, names the proven projection | no addressee: **red** |
-| `concat("roadmap:", id.value)` as a function of type `RoadmapNodeId -> String` | valid when called; **not** named as a route | **red** until C3 exists |
-| two proven `X -> Y` routes | `AmbiguousTargetCandidate` | **red** |
-| `Port { value: 0 }` outside the module | refuse on the v2 route | **red** (C4 lane's control) |
-| `port_of(n: 0)` / `port_of(n: 80)` | `Err` with residue and cause / advances, by execution | positive control |
-| `RoadmapNodeId == RoadmapNodeId` | accept by product inhabitance | M0 measures |
-| `s as Secret` for a String | refuse; only `secret_of_upstream_text` from an admitted caller | **red** (cast admitted today) |
-| `secret_of_upstream_text` from an unadmitted module | refuse | **red** |
-| `Secret` displayed, JSON-encoded or compared, nothing modeled | refuse | **red** |
-| `Secret` on the Rust target through the declaration-keyed row | emits and runs | **red** (`StillBareNameDebt`) |
-
-None of these retires (DESIGN §4b(4)).
-
-## 7. Rungs (DESIGN §4b) and §4's coercion law
-
-- **Identity:** structurally guaranteed. Records are nominal, and a bodyless declaration is its own type.
-- **Invariants and confinement:** **no invariant is called structural until both native drops in the
-  C4 lane are closed.** Until then the v2 route is mechanically preventable at best, stated per type.
-- **Secret:** structural only once C4 and C6 both hold. Before that it is cosmetic, as it is today.
-- **Coercion law:** unchanged. The only silent route is the alias's identity. Every nominal crossing is
-  an explicit call, and a missing one is a residual with an addressee.
-
-## 8. Revision 3 (option A) against this model
-
-Populations are M0's rows, named by class; none is transcribed here (DESIGN §6).
-
-| | option A (rev 3) | rev 5 |
-|---|---|---|
-| **new words** | `nominal`, `sealed`, `opaque`, `derives(…)` = 4 | 0. Bodyless, `sole_constructor` and `admit_callers` already exist |
-| **TrueAlias** | untouched | untouched |
-| **UnconstrainedNominal** (old brand) | `type T nominal = Y` | `type T { value: Y }` (constructor in, projection out) |
-| **CheckedConstructionStage** (old refinement) | `sealed` + checked ctor | `sole_constructor` record + checked function |
-| **Opaque** | `opaque` | bodyless `type X` + modeled operations (needs C6) |
-| **introduction sites** (M0 `NominalIntroduction` rows) | rewritten to a constructor call | same rewrite, generated; identical burden |
-| **projection sites** (M0 `NominalProjection` and `OperationWorkaround` rows) | rewritten to `.value` | rewritten to explicit projection; **workaround sites** (compare, hash) **vanish** under C5 product inhabitance instead of being rewritten, so this model's burden is lower by exactly M0's `OperationWorkaround` count |
-| **capabilities** | `derives(…)`: author-listed, a second vocabulary to keep in step with `std.algebra` | derived by product inhabitance; nothing listed; a bodyless type has only modeled operations |
-| **invariant rung** | structural once `sealed` is enforced | structural once the C4 lane closes both native drops: **the same precondition**, already modeled and with a seed implementation |
-| **`RoadmapNodeId` as `String`** | refuses; author projects `.value`, with no stated reason | residual to the call site naming the proven projection: the acknowledgment the operator asked for |
-| **needs that do not exist** | 3 modifiers + derives parser/infer, visibility semantics, capability derivation | C1 addressee, C2 kind, C3 proven routes, C5 product inhabitance, C6 AbstractOperationRealization (C4 is its own lane) |
-| **reusable beyond nominals** | no | yes: C1–C3 and C6 are frontiers the architecture plan already owes (`bool_indicator`, target emission mismatches) |
-
-The deciding row is the last one. Option A built a nominal-only mechanism next to an unfinished
-coercion model. Revisions 4–5 finish the coercion model, and nominals fall out of it. That is §2's
-test that net concepts must not grow by re-invention: `sealed` was a re-invention of
-`sole_constructor`, which the revision 3 DFS missed.
-
-## 9. Decisions
-
-Ruled (2026-10-02/03): O3 (no ordering by default), O4 (`v2.std.residual`), O5 (answer by function
-call); O1 recut to proven routes (§2); O2 recut to the bodyless form (§3); C5 recut to product
-inhabitance (§4); C4 a separate lane. Left for the operator:
-
-- **P1: AbstractOperationRealization's home.** Recommend: extend the existing declaration-keyed
-  realization binding (`gunbc.rust_source_type_bindings` and its interpreter counterpart) from types to
-  a bodyless type's operations. Do not open a new module.
-- **P2: Secret's fixture mints.** Most `as Secret` sites are `test.claim.*` fixtures. Either each test
-  module is listed in `secret_of_upstream_text`'s `admit_callers` (explicit and long), or a separate
-  confined `secret_fixture_of` operation admits a fixture prefix. Recommend: **per-module
-  `admit_callers`**, generated by the cutover from M0. A prefix is a policy hole any new test module
-  falls into silently.
-- **P3: sequencing.** C1 → C2 → C3 → C5 land model-first, beside the C4 lane. C6 lands after C4 (its
-  confinement needs C4). The generated cutover lands after all of them. M0 runs independently.
-  Recommend: as listed.
diff --git a/docs/plans/one-namespace-hierarchy.md b/docs/plans/one-namespace-hierarchy.md
deleted file mode 100644
index 503531d453d..00000000000
--- a/docs/plans/one-namespace-hierarchy.md
+++ /dev/null
@@ -1,67 +0,0 @@
-# One namespace hierarchy (owner direction 2026-09-25)
-
-## The ruling
-
-There is ONE hierarchy, and every context uses it.
-
-A node's position is its path in the namespace graph `x.y.z`. Walking that path
-from a node to the root yields every alignment level: the issue's own node,
-each named ancestor, the implied nodes (the repo level — "gunbc" — and every
-folder/namespace segment in between), up to the root.
-
-- **Alignment is the namespace walk.** Working an issue nested in the
-  hierarchy means aligning to each parent in turn, up from your own node. The
-  alignment ladder's chain (task → projects → root) becomes a derivation over
-  the namespace path, not a separately maintained relation.
-- **Implied nodes are first-class levels.** "gunbc" (the repo) and every
-  intermediate namespace segment exist as alignment levels even when no issue
-  or project row names them. A level's existence does not depend on a row;
-  rows attach to levels, levels come from the namespace.
-- **A project is an instantiation of a time-bounded namespace chunk of work** —
-  usually one touching a namespaced program (e.g. `gunbc.spark.*`). A project
-  is not a parallel tree; it is the namespace slice
-  `(subtree root, time window, work intent)`.
-- **Issue hierarchy is the same graph.** Upstream/downstream (parent/child)
-  relations between issues are contiguity in the namespace; a child issue's
-  default parent is its namespace parent. Blockers remain the SEPARATE
-  must-complete-before-start dimension (dependency edges, not hierarchy).
-
-## What this unifies (the three graphs we currently carry)
-
-1. The module/file namespace (`gunbc.roadmap.roadmap_page`, folder paths) —
-   today implicit.
-2. The alignment ladder's hand-maintained task→project→root rows
-   (`roadmap_alignment.dag`) — today a parallel relation.
-3. The issue tracker's parent/child fields (`extdeps.google.issue_tracker`) —
-   today a third relation.
-
-Target: one namespace graph; (2) and (3) become projections/annotations of it.
-
-## Consequences queued
-
-- The alignment chain derivation becomes: walk the node's namespace path,
-  materialize implied levels, overlay declared rows (projects/issues) at their
-  levels. `AlignmentChainRowUndeclared` then means "a row references a
-  namespace level that does not exist," and ambiguity means "two declared
-  owners for one level."
-- The issue hierarchy (nested tickets, tracker lane) derives its nesting from
-  the same walk — the nested-menu rendering is the namespace tree with issues
-  attached.
-- Dispatch alignment (the pending authority consolidation) consumes this:
-  the brief renders every level from the node to the root, each with its
-  alignment standing.
-- Witness discipline: one derivation, three projections — a change to the
-  namespace graph must move all three projections together; a projection that
-  can move independently is a derivation defect.
-
-## Open questions (owner, when convenient)
-
-- Namespace identity for implied levels: is `gunbc.spark` a first-class node
-  with its own standing/state, or only a waypoint that aggregates its
-  descendants' standing? (Affects the cadence math and the dashboard's tree.)
-- Do filesystem folders and dag module segments share one namespace by law,
-  or are they two namespaces with a declared mapping? (They are currently
-  close but not identical: `dag/gunbc/roadmap/` ↔ `gunbc.roadmap.*`.)
-- Project time-bounds: does a project's window attach to the namespace slice
-  itself, or to one instantiation row, allowing sequential instantiations of
-  the same slice?
diff --git a/docs/plans/org-admin-credential-acquisition.md b/docs/plans/org-admin-credential-acquisition.md
deleted file mode 100644
index 4576c11c741..00000000000
--- a/docs/plans/org-admin-credential-acquisition.md
+++ /dev/null
@@ -1,129 +0,0 @@
-# Org-admin credential acquisition, custody, and read path
-
-Status: modeled; no credential has been obtained, stored, or read. The storage-class and freshness
-ruling is from the parent relay of the 2026-08-30 pricing-study memo. Upstream capability and token
-facts are owned by `extdeps.github.org_admin_auth` and cite GitHub's documentation there.
-
-## Decision
-
-The terminal credential is a GitHub App installation access token. The durable secret is the app
-private key; the actuator mints a narrowly scoped installation token for each invocation and lets
-that token expire after one hour. This makes the broadly useful bearer token short-lived and
-programmatically renewable.
-
-The acceptable interim is a human-created fine-grained personal access token whose resource owner
-is the organization and whose permissions are organization `Self-hosted runners: write` and
-`Administration: write`. Store it with an explicit expiry and rotate-before date. A classic PAT
-with `admin:org` works but is broader than the fine-grained PAT. An OAuth App token also works after
-interactive web or device authorization, but is user-bound and long-lived by default; it adds an
-application and refresh lifecycle without improving this interim. Neither is selected.
-
-## Acquisition census
-
-| Shape | Converge access | Acquisition | Lifetime and rotation | Revocation |
-|---|---|---|---|---|
-| Fine-grained PAT | `organization_self_hosted_runners` read/write covers runner groups, selected repositories, and organization runner registration tokens; `organization_administration` read/write covers the organization Actions policy | Human creates it in GitHub's web UI; organization approval may be required | Configurable expiry; rotate before expiry and revalidate after replacement | Token settings, organization policy/approval, user removal, leak detection |
-| Classic PAT | `admin:org` covers the same organization endpoints (and more) | Human creates it in GitHub's web UI | User-selected expiry; GitHub may revoke on expiry, exposure, or prolonged non-use | User credential settings, OAuth authorization API, organization/enterprise incident controls |
-| GitHub App installation token | Installation with organization `Self-hosted runners: write` and `Administration: write` covers the converge surface | App registration/key and installation require an owner decision; each access token is then minted programmatically from the app key | Installation token expires after one hour; mint per invocation, never rotate a stored installation token | Suspend/uninstall the installation, reduce permissions/repositories, or revoke/rotate the app private key |
-| OAuth App user token | `admin:org` covers the organization endpoints while the authorizing user remains an org admin | Interactive authorization-code web flow or device flow | Long-lived by default; optional eight-hour access token plus refresh token | User revokes authorization, app owner revokes token/authorization, org/enterprise policy, user loses admin standing |
-
-The GitHub endpoint authorities are `extdeps.github.org_admin_auth.runner_groups_citation`,
-`actions_permissions_citation`, `installation_token_citation`, and `oauth_flow_citation`. The model
-does not bind any of them to `gh`: CLI, REST, and SDK are interchangeable realizations.
-
-## Custody and read path
-
-`gunbc.auth.org_admin_credential.SecretMaterial` is a custody descriptor, not secret bytes. It
-records one store, an allow-list of readers, rotation, credential standing, and the validation
-receipt. Actual bytes remain behind the existing
-`gunbc.auth.materialized_secret.with_materialized_secret` bracket; this plan does not create a
-parallel reader.
-
-For CI, use a GitHub Actions organization secret restricted to the repository and workflow lane
-that performs org observation/apply. A repository secret is an acceptable narrower placement when
-only one repository runs the actuator. For an operator session, use a named local credential-store
-profile and expose it to only the validation or converge process. Do not put a token in argv, a
-worktree file, committed configuration, a receipt, or this plan.
-
-Bytes-present and working-credential are intentionally different facts. `SecretMaterial.store` and
-`CredentialCustodyStanding` answer custody. `CredentialOperationStanding` answers whether an
-executed probe proves one exact capability on one target through the required horizon. A runner-
-groups read receipt never authorizes mutation. `admit_org_admin_credential` refuses absent or
-wrong-principal material, incomplete genealogy, a due probe, insufficient exact capability, and an
-expired operation horizon. No arm turns absence into a skip.
-
-## Acquisition genealogy and runtime dependency
-
-`CredentialAcquisitionTransaction` is multi-input over a closed `AcquisitionRequirement` sum:
-credential proofs, human authorization ceremonies, authority resources, grants, approvals,
-authenticator bindings, attestations, and custody use. `CredentialGenealogyStanding` is immutable
-audit history and is complete only with explicit roots, including the human ceremony and external
-account-recovery boundary for privileged GitHub bootstrap. A ceremony receipt records the
-authenticator classes GitHub accepted; it never records passwords/OTPs and never becomes current
-authentication merely because it is recent.
-
-Present use is a separate `CurrentUseRequires` graph with a typed
-`DependencyInvalidationEffect`; historical edges are `HistoricalOnly`, app-key loss can
-`BlocksFutureMinting`, and only provider-evidenced relationships `InvalidatesCurrentUse`.
-`RenewalRequires`, `CredentialRenewalCandidate`, and `CredentialContinuityStanding` form a third
-graph, so an operator renewal obligation is not confused with an outage. This prevents an expired
-browser session or revoked creation-time PAT from poisoning an otherwise usable app credential.
-
-## Fleet-converge consumer
-
-The existing `gunbc.fleet_converge_workflow.fleet_converge_job` owns the first consumer; there is no
-parallel workflow. Its `org_actions_observe` mode invokes
-`gunbc.fleet.org_actions_inspection.org_actions_inspect_wet`. The entry refuses a missing secret,
-then composes the read through `std.goal_assessment.inspect_goal`: the goal-blind observer
-`observe_org_actions` executes the read-only runner-groups call, strictly decodes the response and
-reads each group's selected repositories through `extdeps.github.org_actions.CliOrgRunnerGroups`;
-`gunbc.fleet.org_actions_standing.assess_org_actions` then compares the observed groups with the
-desired goal. A refused or malformed read, or a repository-read failure, is a
-typed observation refusal, and any desired-state divergence is a located `GoalDiverged`; each is a failing
-typed outcome. It never silently skips and it has no write/fix-divergence arm.
-
-The validation receipt is uploaded as a workflow artifact only after the probe and joined reads
-succeed, and it records the assessment verdict. The artifact contains identity, endpoint, organization,
-verdict and time—not a token, header,
-response body, or token fingerprint. Until the operator creates `GUNBC_ORG_ADMIN_TOKEN`, dispatching
-the mode witnesses the intended missing-credential refusal. Once the secret exists, the same route
-performs the live read without a code-path switch.
-
-## Interim human handoff
-
-**Superseded 2026-09-05, never taken.** The `org_actions_observe` step now mints a one-hour installation
-token in-run from the existing `gunbai-ci` App key (Secret Manager `ci-github-app-private-key`, read
-through the same WIF path as the fleet key), so no personal token is created and no Actions secret
-holds a credential. The steps below are kept as the record of the design that was replaced. What
-remains of the terminal migration is narrowing to a dedicated least-privilege App; the read path and
-custody contract are already the terminal ones.
-
-1. In GitHub's fine-grained token UI, the operator selects `gunb-ai` as resource owner, grants
-   organization `Self-hosted runners: write` and `Administration: write`, and chooses a bounded
-   expiry. No repository content permission is needed for the org-settings probe itself.
-2. The operator pastes the value directly into the chosen store: the restricted Actions secret for
-   CI, or the named local credential profile for a supervised session. The value is never pasted
-   into an issue, PR, shell history, command argument, or receipt.
-3. Before any converge depends on it, the validation lane materializes it as an environment-bound
-   secret and executes the read-only `GET /orgs/{org}/actions/runner-groups` probe (the
-   `ListOrganizationRunnerGroups` endpoint). A 2xx response proves organization subject and
-   self-hosted-runner read scope without changing the subject. The later actuator must separately
-   require the write grants declared by the credential shape; a successful read is not fabricated
-   proof of write access.
-4. The observer writes a `CredentialCapabilityProbeReceipt` containing only material identity,
-   credential kind, exact read capability, endpoint, organization, producer, effects, and
-   observation time. `CredentialOperationUsable` binds it to the target and validity horizon. It
-   contains no token, response body, headers, or recoverable token fingerprint.
-5. Expiry, revocation, owner change, scope change, a missing receipt, or a receipt outside its
-   horizon changes standing away from `CredentialOperationUsable`; observe and apply both refuse before
-   mutation. Rotation repeats steps 2–4 and then deletes/revokes the prior material according to
-   the selected store's deletion semantics.
-
-## Terminal migration
-
-Register and install a dedicated GitHub App with only organization `Self-hosted runners: write` and
-`Administration: write`. Store its private key using the same SecretMaterial custody contract and
-existing materialization bracket. Mint an installation token per invocation, record its returned
-expiry, run the same read-only probe, and discard it after use. Once that path has an executing
-positive receipt and absent/revoked negative controls, delete the interim PAT row and revoke the
-PAT; do not retain both as fallback authorities.
diff --git a/docs/plans/parse-grammar-choice-overlap-residue-finding.md b/docs/plans/parse-grammar-choice-overlap-residue-finding.md
deleted file mode 100644
index c7bc0af321d..00000000000
--- a/docs/plans/parse-grammar-choice-overlap-residue-finding.md
+++ /dev/null
@@ -1,90 +0,0 @@
-# `parse_grammar_choice_overlap_residue` — a named grammar deficiency nothing executes
-
-Status: finding, filed independently of the census that surfaced it. It outlives that census.
-
-**The unexecuted law and the unmeasured deficiency are the same fact seen twice.**
-
-Subject: `a6ca6882d18114b52532c0804dc89f97b441f493`.
-
----
-
-## The finding
-
-`v2.compiler.source_authority` `parse_dag_source_ast` refuses a large fraction of authored `.dag`
-source, always with one reason: `parse_grammar_choice_overlap_residue`.
-
-Measured with a positive control in the same run, so a harness fault could not masquerade as a
-finding:
-
-```text
-CONTROL_3LINE  the tree's own "module m / fn add" fixture      => ACCEPTED
-REAL_SMALL     dag/gunbc/bash_materialized_transport.dag       => ACCEPTED
-REAL           dag/extdeps/shell/exec.dag                      => REJECTED
-                                        reason = parse_grammar_choice_overlap_residue
-```
-
-Then a random 10-file sample of real corpus files:
-
-```text
-A  src/v2/std/constraint_satisfaction_predicate.dag
-R  dag/test/claim/filesystem_read_hermetic_witness.dag                parse_grammar_choice_overlap_residue
-R  dag/test/claim/wet_hermetic_equivalence_witness_test.dag           parse_grammar_choice_overlap_residue
-R  src/v2/test/claim/.../cargo_fmt_dead_param_test.dag                parse_grammar_choice_overlap_residue
-A  dag/test/fixture/sole_constructor_sealed/admitted_caller.dag
-A  dag/extdeps/transports/file.dag
-A  src/v2/workflow/host_discovered_owned_data_manifest.dag
-A  src/v2/lens/structural_similarity.dag
-R  src/v2/test/claim/round_trip/source_authority_contract_test.dag    parse_grammar_choice_overlap_residue
-A  dag/extdeps/cache/catalog_placement.dag
-
-6 accepted, 4 refused — all four the same reason
-```
-
-**The grouping is the finding, not the rate.** Ten files support no corpus refusal rate, and none is
-claimed. They do support that five refusals across two source roots — four sampled at random, plus
-`extdeps/shell/exec.dag` found independently — share one named cause: one grammar deficiency with
-many victims, not scattered file-specific problems. Group by *why*, not by where the fix would be typed.
-
-## Why it is invisible
-
-`parse_dag_source_ast` has **no consumer**. Its only two call sites are inside
-`canonical_dag_source_parse_print_law`, whose name occurs exactly once in the tree — its own
-definition. It has no callers.
-
-So the deficiency is not hiding; it is never asked, because the only path that would surface it is
-a law nothing executes — DESIGN §5's **specification-without-execution** class, in the compiler's
-own source authority: a parse/print round-trip law, written, typed, never run.
-
-The two halves are one fact: a law nobody runs cannot report the deficiency it would catch, and an
-unmeasured deficiency leaves the law looking healthy. Executing the law turned an unknown into a
-named reason with a file list.
-
-## Why this matters beyond the census that found it
-
-1. **The v2 self-host program depends on this path.** `parse_dag_source_ast_with_model` sits under
-   `semantic_ir_from_source_with_model` and the normalize/resolve chain — the same
-   tokenize→parse→normalize→resolve pipeline the `wave1_gate1` body-producer witnesses exercise on
-   fixtures. Those witnesses pass on hand-authored three-line modules. The refusal population lives
-   in *authored corpus source*, where self-host has to work.
-2. **Fixture-grain evidence is not corpus-grain evidence.** The gap between "parses `module m / fn
-   add`" and "parses `extdeps/shell/exec.dag`" is the gap between a green witness and a working
-   compiler; only the first is measured today.
-3. **It is a wall on any future consumer of the parse route**, not just this census — including the
-   corpus-parse alternative considered in the
-   [projection increment spec](parsed-body-projection-increment-spec.md), which this finding is
-   part of the reason to reject.
-
-## What is not claimed
-
-- No corpus refusal rate. Ten files is a sample that establishes a shared cause, not a proportion.
-- No root cause in the grammar. The reason symbol names a choice-overlap residue; which
-  productions overlap, and whether the fix is one rule or many, is not established here.
-- No claim that repairing it makes the parse route viable for corpus-grain work — the separate
-  memory measurement in the increment spec says it would not.
-
-## Next step
-
-Measure the refusal population properly — every file under both production roots, verdict and
-reason per file, as a structured artifact — and reduce the refusals to the grammar production(s) at
-fault: a bounded measurement on an existing route, no seed change. Repairing the grammar is
-downstream of knowing which productions overlap.
diff --git a/docs/plans/parsed-body-projection-increment-spec.md b/docs/plans/parsed-body-projection-increment-spec.md
deleted file mode 100644
index 0d614310555..00000000000
--- a/docs/plans/parsed-body-projection-increment-spec.md
+++ /dev/null
@@ -1,156 +0,0 @@
-# Parsed-body projection — increment spec (admission decision input)
-
-Status: **specification for an admission decision, not an implementation plan.** No work has
-started or may start until the operator rules, because part of the increment lands in the frozen
-v1 seed (§5).
-
-Audience: whoever decides admission. States what is broken, what would fix it, the evidence grade
-per claim, and — separately, as different admission questions — which parts are v1 seed changes
-and which are v2 `.dag` changes.
-
-Subject measured: `a6ca6882d18114b52532c0804dc89f97b441f493`.
-Evidence: → [projection blocker and derived shell seed](shell-dag-census-0a-projection-blocker.md).
-
----
-
-## 1. What breaks without it
-
-SHELL-DAG-CENSUS-0A must derive, from parsed bodies, every authored path that can attempt
-POSIX/Bash program interpretation, with a merge bar of **zero production parse refusals** and
-**zero unexplained unknown routes**. That bar is unreachable — not difficult — on today's fact
-surface, and the failure is silent.
-
-The sharpest statement is not the coverage percentage but this:
-
-> **A file that was never loaded reads identically to a file that carries no shell route.**
-
-No per-file `ParseRefused` row counts the difference, because non-import is not an event the
-surface reports. So a census here produces not an incomplete answer that announces itself but a
-clean, confident population that is silently wrong — DESIGN's **empty-observation narrow**, the
-exact artifact this cut was dispatched to prevent. Everything below is downstream of that.
-
-## 2. The six axes, with evidence grade
-
-Evidence grade is stated per axis: a code reading and an executed discriminating pair are not the
-same strength.
-
-| # | Axis | Remedy | Evidence grade |
-|---|---|---|---|
-| 1 | Service operations and transports are absent entirely — `ItemKind::ServiceItem` has no accessor | a `ServiceItem` accessor carrying operations, transport argv, and stdin channels | **Structural, verified independently.** The enum has six variants and exactly three have accessors; confirmed by the dispatching lane |
-| 2 | `FnArrowDecl.output` is a wiring-liveness skeleton — a bound-but-unused `let` RHS is dropped | a body projection total over statements: effect positions retained independently of return reachability | **Execution-proven** (discriminating fixture pair, §3) |
-| 3 | No named-argument edges — labels erased, literals hoisted to the call node | argument edges labelled with the authored argument name, positional index preserved | **Execution-proven** (same run, §3) |
-| 4 | No arm or occurrence identity | stable occurrence identity on body nodes; arm identity on match arms | Read from the marshal (`marshal_generic` emits undifferentiated positional children) |
-| 5 | Callee is an authored lexeme, not a resolved identity — a string literal and a constructor are the same atom | resolved declaration identity on callees; a node-kind discriminator separating literal / callee / constructor / variant | Read from the marshal (`atom_identity_node` is the single atom kind) |
-| 6 | The registry is the entry's import closure, not the corpus | a corpus-grain denominator that is an enumerated file set, not an import closure | **Execution-measured** (§4) |
-
-### 3. The execution proof for axes 2 and 3
-
-Two functions of identical shape, folded through `fn_arrow_decl_facts_live`, atom identities
-collected from each `output`:
-
-```text
-fn fixture_dead_let_shell() -> String {
-  let unused_result = fixture_sink(program: "echo DEADLETMARKER")
-  "returned-without-using-unused_result"
-}
-fn fixture_live_named_args() -> String {
-  fixture_sink2(program: "echo LIVEMARKER", args: "echo ARGSMARKER")
-}
-
-DECL probe.fixture.fixture_dead_let_shell   ATOMS: (empty)
-DECL probe.fixture.fixture_live_named_args  ATOMS: fixture_sink2 | echo LIVEMARKER | echo ARGSMARKER
-```
-
-The dead-let arm yields **nothing** — callee identity and program literal both absent; the live
-arm yields both. Same construct, opposite verdict, so the loss is the projection's, not the
-probe's. The live arm also demonstrates axis 3: three atoms in authored order with **no labels**,
-so nothing records which literal was `program:` and which `args:`.
-
-### 4. The measurement for axis 6, with its counting method stated
-
-A fold over `fn_arrow_decl_facts_live()` under `--source-root dag --source-root src/v2` reported
-**1,698** declarations.
-
-The denominator depends on the counting method, so it is stated:
-
-| method | count | note |
-|---|---|---|
-| line-start `fn` / `func` / `test fn` | **41,965** | the accessor's filter is `ItemKind::FnItem \|\| FuncItem`, and `ItemKind` has no separate test variant, so a `test fn` **is** an `FnItem` — this is the matching denominator |
-| line-start `fn` / `func`, excluding `test fn` | 30,851 | the same count with the 11,114 test declarations removed |
-
-The conclusion is invariant: **1,698 of 41,965 is 4.0%; of 30,851 it is 5.5%.** Either way the
-surface is a small single-digit fraction of the tree, and its content is whatever the entry
-happened to import.
-
-This is a declared frontier, already guarded: `v2.lens.affected_set.corpus_dependency_view` calls
-`fn_arrow_decl_substrate_is_whole_tree` and, when false, routes to a host refusal reading
-`corpus_dependency_view per-PR execution refused … (blocked-on-#6239)`. Fail-closed, correctly.
-**A census inherits that refusal**, which is why axis 6 is plausibly not new work — see §5.
-
-## 5. Which parts are v1 seed changes and which are v2 `.dag` changes
-
-Separated because they are different admission questions.
-
-| axis | v1 seed (`src/v1/stage0/src/coproduct_reflection.rs`) | v2 `.dag` | notes |
-|---|---|---|---|
-| 1 | **yes** — a new `eval_service_decl_facts_live` accessor | yes — the carrier type and its `.dag` surface | additive |
-| 2–5 | **yes** — a new non-lossy body marshal | yes — the carrier types | **additive, not a modification** (below) |
-| 6 | **probably none** | none | likely already-sanctioned pending work (below) |
-
-Two properties matter for admission:
-
-**Axes 2–5 are an additive second accessor, not an edit to the existing one.** The existing
-marshal's lossiness is not a defect — dropping a dead `let` RHS is exactly what
-`v2.lens.wiring_liveness` needs, and its comments say so; changing it would break that lens. The
-increment adds a second projection beside it, keeping the blast radius off every current consumer,
-so the freeze question is "may the seed grow a new accessor", not "may its existing semantics
-change".
-
-**Axis 6 is probably not this increment's to fix.** The whole-tree registry path exists, gated
-on #6239 with a typed refusal in place; if that lands, axis 6 closes without anything here.
-Listed for completeness, not as a request.
-
-## 6. The cost argument for doing it at ingestion rather than corpus-wide
-
-The alternative — a corpus-wide fold parsing source in `.dag` via `v2.compiler.source_authority`
-`parse_dag_source_ast` — was measured, and fails on **both** axes:
-
-- **Correctness.** Random 10-file corpus sample: 6 accepted, 4 refused, all four with the same
-  reason as the earlier `dag/extdeps/shell/exec.dag` refusal — `parse_grammar_choice_overlap_residue`.
-  One grammar deficiency, many victims. The refusal set contains the census's own seed file, and the
-  merge bar is zero production parse refusals. Filed separately: → [parse grammar choice overlap
-  residue](parse-grammar-choice-overlap-residue-finding.md).
-- **Cost.** 1 file / 63.1 s; 10 files / 67.5 s; 40 files / **`EXIT=137`, OOM-killed after 34 files**.
-  Marginal cost ≈0.49 s per file against ≈62.6 s fixed world-acquisition overhead, so time is not
-  the wall; memory is — and not from large files: the kill came at file ~34 of 40 with only
-  **94 KB** of source consumed, on ~7.8 KB files, the 212 KB outlier sorted last and never reached.
-  The mechanism (parse-tree retention vs interpreter heap growth) is **not** established or claimed.
-  What is established: the process cannot hold the result of parsing 34 small files, against a
-  subject of 3,733 files and 31.3 MiB.
-
-DESIGN §6 already rejected this shape: the corpus-wide censuses were deleted in #8140 because
-*"the unit of computation was the world, the unit of fact was one module's authorship, and the
-price was paid by every consumer that wanted a witness roster and nothing else."* Its declared
-next-rung trigger is exactly this increment's shape: a fact *"belongs on the module's own
-declaration, checked at ingestion where the module is parsed anyway — one module's facts from one
-module's source — rather than reconstructed corpus-wide by a consumer that wanted something
-else."*
-
-## 7. The admission question, stated without advocacy
-
-The v1 seed is frozen with an admission test of **purpose**: a change is admitted when it serves
-the v2 self-host program. This increment does not obviously pass, and the decision is not the
-requesting lane's. Both readings are recorded:
-
-**For admission.** A non-lossy body projection is the substrate capability *any* consumer needs to
-read real bodies rather than a wiring skeleton. The existing surface is why `v2.lens.effect_reach`
-classifies host-effect sinks by name equality against a remembered callee list — not a chosen weak
-principle, but a surface that cannot express a stronger one. Every future lens wanting real bodies
-inherits that ceiling.
-
-**Against admission.** The requesting program is a shell-migration census, not v2 self-host. Seed
-growth justified by a neighbouring program is how a freeze with an active-maintenance arm becomes
-absorbing, the standing danger `gunbc.v1_maintenance_standing` names.
-
-If admission is refused, the census stays blocked, honestly. Worse for this lane, correct for the
-repository, and preferable to a census whose population is confident and silently wrong.
diff --git a/docs/plans/planning-work-contract.md b/docs/plans/planning-work-contract.md
deleted file mode 100644
index 974ca2df457..00000000000
--- a/docs/plans/planning-work-contract.md
+++ /dev/null
@@ -1,77 +0,0 @@
-# The planning work contract (owner directive 2026-09-25)
-
-Supersedes the planning-ticket-type and Fabric·planner-role sketches from
-conversation (never landed). Do NOT add Planning to the issue-type vocabulary;
-do NOT introduce a second workflow role or principal.
-
-## The model
-
-**Planning is one first-class work contract**: a bounded effect envelope whose
-result is an `IssueRevisionCandidate`, an investigation report, or a comment
-response. It is the same generic work request assignment mints, with a
-different envelope — not a different kind of issue, agent, or principal.
-
-The durable invariants stay put:
-
-- the issue remains the durable problem/outcome;
-- component remains domain placement;
-- assignment remains accountability;
-- parent/child and blockers remain separate graph dimensions.
-
-## Issue changes are versioned candidates with CAS application
-
-Fabric may: comment, propose field changes, propose relation changes, propose
-draft children. Fabric may NOT: directly rewrite the target issue, or edit
-code, under a planning contract.
-
-```text
-IssueRevisionCandidate {
-    issue
-    base_issue_revision      -- the version it was derived against
-    proposed_field_changes
-    proposed_relation_changes
-    proposed_draft_children
-    author / work-request identity
-}
-
-apply(candidate, expected_revision = candidate.base_issue_revision)
-    → Applied { new_revision }
-    | RevisionConflict { current_revision }   -- CAS refusal
-    | CandidateRefused { cause }
-```
-
-A proposal never mutates the issue until accepted through the CAS route. The
-acceptor is the issue's accountable human (or a later explicit automation
-ruling) — the candidate mechanism itself grants no write path.
-
-## Comments are durable narrative events, never implicit commands
-
-Ordinary prose has no workflow effect. The explicit operation is:
-
-```text
-AskFabric { issue, referencing_comment, asker }
-    → mints the same generic work request assignment mints
-       (bounded planning envelope)
-    → the answer lands as a comment response in the thread
-```
-
-No mention-parsing, no prose-triggered turns: if it isn't an `AskFabric`
-event, nothing runs.
-
-## The ban
-
-No operational meaning may be encoded in: planning-flavored components,
-Planning issue types, labels, title prefixes, or role-encoded assignee aliases
-(e.g. "fabric-planner@…"). Structure carries meaning; names don't.
-
-Future recurring patterns are promoted only when they carry a DISTINCT effect
-envelope, deliverable, admission rule, verification, or application route —
-all five named, or it stays an ordinary work request.
-
-## Queue position
-
-Durable comments are already in flight (agent-52's vertical). This contract is
-the next vertical behind it: the versioned IssueRevisionCandidate + CAS
-application route, the AskFabric operation minting the generic work request,
-and the bounded planning envelope (comment/report/candidate results only) as
-the envelope vocabulary sibling of the execution envelope.
diff --git a/docs/plans/post-engine-pr-roadmap.md b/docs/plans/post-engine-pr-roadmap.md
index 111408b5c6e..272764fc58c 100644
--- a/docs/plans/post-engine-pr-roadmap.md
+++ b/docs/plans/post-engine-pr-roadmap.md
@@ -53,7 +53,7 @@ Eight parallel stage surveys, all reported; raw catalogs with full per-pass tabl
 | P5 | infer-core | `build_imported_variants` + `owner_of_exported_arm`/`exported_coproduct_item` (04_infer.dag:6079,6033,6056) | Full Disj-scan + re-export chain walk of the exporting module **per imported name per importer** — fires for every name incl. non-variants (common case scans and finds nothing). Part of the machinery this PR built; already ledgered as §A.8's sibling | **O(N·K·D·M_target)** — core imported by all N modules is re-scanned N·K times | Per-exporting-module `Map<arm→owner>` + `Map<enum→item>` computed once (re-exports baked in), stored on `TypedModule`; binder does O(1) `map_get` |
 | P6 | interpreter | `Env::extend` chain (v1_interpreter.rs:538-576, 1328, 5988) | `call_function` extends the **caller's** env, not a fixed base → chain depth = dynamic call depth d; every var/global read walks O(d) | **O(d²)** per depth-d recursion; multiplies every interpreted workload incl. all v2 stages (~100× constant on top) | Invoke top-level fn bodies against a fixed global base env (true lexical scoping) — chain depth becomes lexical nesting |
 | P7 | v2 translate/serialize | `06_translate.dag:3555→1270→397` facts lookup; `:814,931,1076` serialization | `InferredTree.facts.lookup` = linear scan over all entries, called per node (O(M²)); output built with `list_append(partial, …)` (O(L²)) | Two independent quadratics on the v2 emit path, ×100 interpreted | Index facts by `occurrence_id`; accumulate output reversed / join once |
-| P8 | v2 parse | packrat memo table (src/v2/compiler/02_parse.dag:744,774) | **Dead memo**: `let _memo = parse_table_insert(...)` — result discarded, table never threaded out, lookup always sees the empty table; position key recomputed via `length` O(T) per attempt | Exponential worst-case backtracking; every production re-parses at every position. The performance twin of the "inert lens" (coverage by illusion — the machinery exists, nothing flows through it) | Thread the updated table through `ParseExprResult` (state-monad); carry an integer cursor |
+| P8 | v2 parse | packrat memo table (src/v2/compiler/02_parse.dag:744,774; the memo was later deleted with the parse memo carrier, operator ruling R2 2026-10-08) | **Dead memo**: `let _memo = parse_table_insert(...)` — result discarded, table never threaded out, lookup always sees the empty table; position key recomputed via `length` O(T) per attempt | Exponential worst-case backtracking; every production re-parses at every position. The performance twin of the "inert lens" (coverage by illusion — the machinery exists, nothing flows through it) | Thread the updated table through `ParseExprResult` (state-monad); carry an integer cursor |
 | P9 | v2 resolve + infer | `03_resolve.dag:200,261` namespace closure-chain; `04_infer.dag:298→cardinality.dag:260` nested catamorphism | `Map` primitive is a closure chain → O(E) per atom lookup × A atoms = O(M²)/module (the resolver lesson verbatim, interpreted); termination-proof witness re-runs a full `fold_node` over each node's subtree = O(M²) | O(M²) per module, ×100 interpreted | Indexed map for `Namespace.bindings`; compute descent proofs compositionally inside the existing bottom-up fold |
 
 ### SUSPICIOUS tier (fix-worthy, lower share)
diff --git a/docs/plans/power-on-sequence-model.md b/docs/plans/power-on-sequence-model.md
deleted file mode 100644
index 62c83258e63..00000000000
--- a/docs/plans/power-on-sequence-model.md
+++ /dev/null
@@ -1,416 +0,0 @@
-# The Mt. Collins power-on account (power-on sequence model, Mt. Collins first)
-
-Status: PLAN. It encodes the side-chat rulings R1–R3 and Q1–Q2 and the corrections from the reviews of `e4e8a4a4d4` and `75f0bd113c`, all before any implementation. Owner: calm-lynx-884, under eager-gull-22 (hw-boot).
-
-## 0. The requirement
-
-Operator, 2026-10-03, verbatim: "take ALL of the information we've gotten today (and in our existing models) - and construct a monolithic 'this is what actually happens when you turn on the computer' workflow - meaning, our diagnostic process will be 'this is our best understanding of what happened' - basically, the end of the workflow (error, no error, any information we have) - and then, as we add more platforms (mt jade, x86), we will abstract the workflow and plug in the differing pieces as we need - this will give us an idea of how to onboard new platforms".
-
-The product is one **power-on account** per attempt: `gunbc.machine_intake_mtcollins1_power_on_account`. It covers success, degraded success, stated failure, repeated restarts, transport failure, partial observation and unresolved cause. It is never a pass/fail bit, and it never asserts past the evidence (DESIGN §4d, §5). It is monolithic for Mt. Collins. §9 records the seams for Mt. Jade and x86, and abstraction follows the second platform.
-
-## 1. Rulings this plan encodes
-
-- **R1 (side chat, decided): #13041 lands first, and slice A replaces it atomically.** Slice A deletes `gunbc.machine_intake_boot_outcome` `HostBootObservation` and its authored datum `mtcollins1_post_firmware_set_boot_2026_10_03`. In the same change, it makes firmware convergence (`gunbc.fleet.mtcollins_firmware_converge` `boot_verdict`) consume an operation-specific readback projected from the **whole** session (§6). Reaching UEFI is a milestone, not an ending, so the projection never reads the ending alone. The former slice E is folded into A.
-- **R2 (decided): the opaque `CP:` reader is public, and it establishes only an opaque sequence relation.** It may say "cycle C of capture S ended after token X; reference capture R (digest, firmware and configuration scope) contains X followed by Y". It may not establish `DdrTraining` or any other `AmpereBootStage`, may not call Y a stage success, and may not locate an ending "at DdrTraining @ X". Semantic attribution belongs to the gunbc-private refinement slice (§8).
-- **R3 (decided): the refused SMpro pair belongs to the secondary-join subject and is not decoded there.** Socket 1's `CUR_BOOTSTAGE 0x0001` / `BOOTSTAGE 0x03ff` is `extdeps.ampere.smpro_register` `SmproBootProgressRefused`. It licenses no "stuck at PMpro" claim, no DDR claim, and no other last-stage claim. It is carried inside `gunbc.machine_intake_mtcollins1_socket1_investigation_observation` `MtCollins1SecondaryJoinOutcome` (#13025, on main), which this plan reuses and does not re-derive. It also gets an open question on the join subject.
-- **Q1 (decided): a component-owned console line establishes only that component's console milestone.** Examples: AMI `Press <DEL> or <ESC>` gives `UefiConsolePromptObserved`; `UEFI Interactive Shell v2.2` gives the stronger `UefiShellObserved`; `GNU GRUB`, `EFI stub:` and `Linux version` give their exact component milestones. A milestone never establishes an `AmpereBootStage`, stage completion, health or a successful handoff. It carries the exact line and its parser, the cycle, the capture digest and its ordering evidence.
-- **Q2 (decided): the account consumes one frozen, attempt-bound `AttemptConfigurationReceipt` taken before power-on** (§3). Historical rows supply topology only, never current occupancy: `mtcollins1_slots` is the 2026-09-10/11 16-DIMM census, and the `mtcollins1_physical_orientation` CPU rows are a 2026-09-23 operator report.
-- **Fact correction.** **Socket 0's** CCIX record is GPI-pending (gated): in `smpro-err-20261003T005609Z`, slave 0x9E (socket 0) reads `GPI_RAS_ERR 0x7E = 0x0002` beside the ERR_CCIX_RCA_LINKUP_FAIL record (`0xA6 = 0x0074`, `0xA7 = 0x2244`). **Socket 1's** record is ungated per the retained hand read the side chat cites. In that capture, socket 1's (0x9C) error registers mostly refused (`rsp=0xff`), so the ungated reading rests on the hand read. The first draft had this reversed.
-
-## 2. What already exists and is reused (§3, §3b)
-
-| Concern | Owning authority (reused, never forked) |
-|---|---|
-| Firmware boot stages 0–9 | `extdeps.ampere.scp_diagnostic` `AmpereBootStage`, `AmpereBootStatus` |
-| SMpro register pair and its refusal rule | `extdeps.ampere.smpro_register` `smpro_boot_progress_of` → `SmproBootProgress` (`SmproBootProgressRead` / `SmproBootProgressRefused`) |
-| Per-socket SMpro reading | `gunbc.machine_intake_ampere_smpro_observation` `SmproSocketStage`, `SmproProbeOutcome`, read through `SmproPassObservation` |
-| Second socket's join | `gunbc.machine_intake_mtcollins1_socket1_investigation_observation` `MtCollins1SecondaryJoinReading`, `secondary_join_outcome` → `MtCollins1SecondaryJoinOutcome` |
-| SMpro/PMpro error records and GPI gate (#13058) | `extdeps.ampere.smpro_internal_error` `SmproInternalRecord`, `SmproRecordGate` |
-| DRAM console block and roster | `gunbc.machine_intake_ampere_dram_console_observation` `AmpereDramConsoleObservation` |
-| Firmware summary, inter-socket lines, CPER | `gunbc.machine_intake_ampere_socket_console_observation` `AmpereFirmwareSummaryObservation` |
-| NVPARAM dump (#13059) | `gunbc.machine_intake_ampere_nvparam_console_observation` |
-| Firmware console statements, SEL cycles | `gunbc.machine_intake_pre_os_bringup_verdict` `FirmwareConsoleReport`, `boot_cycles` |
-| SEL vocabulary, Ampere OEM SEL | `extdeps.bmc.ipmi_sel`, `extdeps.ampere.oem_sel` |
-| GRUB | `extdeps.bootloader.grub` `GrubConsoleReport` |
-| Kernel module refusals | `gunbc.machine_intake_kernel_module_decompression_observation` |
-| SOL collector, KVM, virtual media, handoff | `gunbc.machine_intake_sol_collector_observation`, `gunbc.machine_intake_mtcollins1_kvm_still`, the bundle's `MtCollins1MediaAttachRecord` / `MtCollins1HandoffMedia`, `extdeps.bmc.megarac` |
-| Harness phases | `gunbc.machine_intake_mtcollins1_boot_phase_timing` `MtCollins1BootPhase`. These are what our harness did, never firmware stages. |
-| Slot topology (J-label to socket/MC/slot), never current occupancy | `gunbc.machine_intake_mtcollins1_memory_census_observation` `mtcollins1_slots` (the 2026-09-10/11 census) |
-| Firmware versions | #13041 `gunbc.fleet.mtcollins_firmware_baseline` |
-| Authored outcome being replaced | #13041 `gunbc.machine_intake_boot_outcome` `HostBootObservation` |
-| The host | #13055 `gunbc.managed_host` `ManagedHost` |
-
-## 3. Shape: one attempt, three orthogonal standings, cycles of subjects
-
-These three things are independent, and none may stand in for another:
-
-1. **What the host did** (`HostAccount`): its cycles, and per cycle the standings of each subject.
-2. **What we observed** (`ObservationCoverage`): one standing per carrier, saying whether it was read, refused, empty, partial or not taken, and why. An empty SOL capture is a coverage gap, never SoC silence. A BMC authentication refusal is a coverage gap on the BMC carrier, never a failed "BMC came up" stage.
-3. **Whether our workflow worked** (`CollectionOutcome`): media attach and handoff, override consumption, power-after, bundle write, credential residue. A media-read failure or a bundle-write failure is a collection outcome, never a host ending.
-
-Beside these sits the **attempt configuration receipt** (`AttemptConfigurationReceipt`). It is frozen and bound to one attempt, it is taken before power-on, and the account consumes only it. The fold never queries mutable or historical global rows. The receipt separates:
-
-- **expected configuration and policy**: the expected topology this attempt is judged against;
-- **the requested stimulus** (for example "remove the socket-1 CPU", "J1 only", "firmware set 2026-10-02") **from the applied-stimulus receipt**. For manual CPU or DIMM work, the applied receipt is a human completion/inspection receipt the workflow consumes. A workflow-authored request is not evidence that the change happened;
-- **the current physical population** per socket and per slot, each field with its standing: `LiveObserved { source }`, `OperatorAttested { receipt }`, `Conflicted { readings }` or `NotRecorded { reason }`;
-- **live firmware readbacks** (BMC, SCP, UEFI, CPLD), taken after the physical configuration is set and before actuation;
-- **provenance**: subject (the `ManagedHost` row), attempt, timestamp, artifact and digest.
-
-Static slot and orientation modules may map a label such as `J1` to topology. They may never supply current occupancy. A question that needs a field whose standing is `NotRecorded` or `Conflicted` becomes an open question, never a default.
-
-### Cycles
-
-A power-on attempt is a **session of cycles**. The old firmware stopped on cycle 1 and reached UEFI on cycle 2 (run 37062170720). The new firmware repeats one stopped cycle 6 times (steps 1, 2 and 2b). One cycle can have socket 0 reaching Linux while socket 1 never joins. So:
-
-- **Cycle segmentation does not depend on reaching DRAM.**
-  - Cycle 1 opens on the admitted chassis-power-on effect.
-  - Each later cycle opens on typed restart/reset boundary evidence: SEL `System Boot Initiated` / `S5` records, power or reset observation, and console evidence.
-  - A `DRAM FW version` banner binds a console span to a cycle. It is not the sole authority that a cycle exists, because a host can stop in SMpro, PMpro or ATF before the banner, and an empty SOL can sit beside SEL and SMpro evidence of a boot.
-  - Each cycle carries its identity (index, boundary evidence, console span if any) and the capture digests.
-- **Within a cycle, standings are keyed by subject**, not by one total chain:
-  - `Platform`: the BMC and chassis power;
-  - `Socket { k }`: that socket's SMpro progress via `SmproBootProgress`, and its error records via #13058;
-  - `SecondaryJoin`: `MtCollins1SecondaryJoinOutcome`;
-  - `DramFirmware`: the console block, roster, and untrained sockets established only by a closed roster;
-  - `Uefi`: summary, NVPARAM, POST;
-  - `BootLoader`, `KernelStub`, `Kernel` and `Census`.
-
-### Stage attribution rule (R2 applied)
-
-A **firmware stage** (`AmpereBootStage`) is established only by a public `AmpereBootStage` reading, which is an SMpro register pair decoded by `smpro_boot_progress_of` (`SmproBootProgressRead`). Console output establishes **console milestones** (Q1): exact component-owned lines, such as the DRAM firmware block, the firmware summary, `UefiConsolePromptObserved`, `UefiShellObserved`, the GRUB banner, an EFI stub line, the kernel banner and the census marker. A milestone never implies an `AmpereBootStage`, completion, health or handoff. An opaque checkpoint token implies neither. This is structural: only the `Socket{k}` progress reading can carry `SmproBootProgressRead` and so an `AmpereBootStage`, while console subjects carry milestone readings that have no stage field (§5).
-
-## 4. Mt. Collins: subjects, carriers, and what success, failure and silence look like
-
-| Subject | Runs on | Carriers | Success | Stated failure | Silence or refusal |
-|---|---|---|---|---|---|
-| Platform: BMC | MegaRAC on standby | BMC reads, `mc info` | Answers. The reflash resets users and SEL (self-observed, 0.45.3). | Not applicable: a refused read is a coverage gap | Coverage gap |
-| Platform: chassis power | BMC → sequencer | Chassis read, SDR rails, SEL `Power Unit` | On, rails ok | Rail not ok (`mtcollins1_sensor_anomalies`) | Power never reads on |
-| Socket k: SMpro/PMpro progress | SMpro, PMpro | SMpro registers per pass | `SmproBootProgressRead` advancing | Reported status `Failed` | `SmproBootProgressRefused` is an open question, never a stage |
-| Socket k: error records | SMpro, PMpro | 0x7E, 0xA0–0xAD (#13058) | No pending record | Only a `PendingAndDecoded` record. On 2026-10-03, socket 0's `ERR_CCIX_RCA_LINKUP_FAIL` (loc 68, code 116) is the one current stated error | A matching payload under `GpiUnavailable` or ungated (socket 1 on 2026-10-03) is an anomalous raw record plus an open question. It is never a second `DecodedBootError` or `PendingErrorRecord` |
-| SecondaryJoin | PMpro, both sockets | Summary active sockets and inter-socket lines, socket-1 SMpro pair | `SecondaryJoined` | `SecondaryJoinTimeout` (a liveness finding, not a fault record) | `SecondaryJoinUnclassified { reason }` |
-| DramFirmware | DRAM firmware | Console block, roster, opaque `CP:` tokens | Roster closed with every populated slot listed (against the `AttemptConfigurationReceipt` population) | `FirmwareConsoleReport` training refusal | Last token followed by restart or silence (the ending rule, §5) |
-| Uefi | AMI Aptio | Summary, NVPARAM, POST, KVM | Summary printed, active sockets = expected | CPER/BERT records, summary mismatch | — |
-| BootLoader | GRUB from virtual media | Console | Kernel loaded | `GrubBootFailed` | `GrubStillTrying` |
-| KernelStub | Linux EFI stub | Console (`extdeps.linux.efi_stub`, v6.8) | Initrd loaded | `Failed to load initrd: 0x8000000000000001` (EFI_LOAD_ERROR, run 37069907299) | — |
-| Kernel | Linux | Console (`extdeps.linux.boot_console`, v6.8) | Banner, no panic | `Kernel panic - not syncing: …`, module refusal | — |
-| Census | Our workload | Host-capture markers | END marker | `TerminalRefused` | `TerminalPending` |
-
-### Self-observed facts the fixtures carry (public)
-
-- **The new-firmware loop.** Steps 1, 2 and 2b each ran 6 identical cycles. In each: last token `00001a0a`, only `SK0 MC0` in the roster, socket 1's SMpro B0 stuck at `0002`, zero console error lines (no `ERR:`, `fail`, `timeout` or window lines), SMpro unresponsive about 1.1 s after the last token while chassis power stays on, then a restart. The next cycle's SEL shows `S5/G2 soft-off` + `System Restart` plus Ampere OEM records (`c0`, manufacturer `00cd3a`). The observer-clock period was ~25.8 s. The mechanism is not public.
-- **Step 3, positive control.** With the socket-1 CPU removed (J1 only), the new firmware reaches the firmware summary (1 active socket) and the AMI UEFI shell, and stays stable for 8+ minutes. One earlier run restarted once after the summary, and that did not recur.
-- **Old firmware.** Run 37062170720: cycle 1 stops after `00001a0a`, cycle 2 continues to UEFI. Run 37069907299: reaches UEFI with 1 socket, GRUB, then initrd EFI_LOAD_ERROR and a VFS panic.
-- **The UEFI summary prints `Failsafe status : N` and `Reset status : N`.** They are carried as observed, undecoded summary fields (§7).
-
-## 5. The account's types
-
-```
-PowerOnAccount {
-  attempt: AttemptIdentity,                       // run id, capture digests
-  host: HostIdentity,                             // from ManagedHost (#13055); mtcollins1 is a row, not a constant
-  configuration: AttemptConfigurationReceipt,       // frozen before power-on; the only configuration the fold reads
-  account: HostAccount,
-  coverage: ObservationCoverage,
-  collection: CollectionOutcome,
-  open: List<OpenQuestion>,
-}
-
-HostAccount {
-  cycles: List<BootCycleAccount>,
-  milestones: List<MilestoneReached>,            // e.g. UEFI reached in cycle 2 -- a milestone, never an ending
-  ending: HostEnding,
-  degradations: List<Degradation>,               // orthogonal to the ending
-  errors: List<DecodedBootError>,                // every stated failure, with its cycle and subject
-}
-
-BootCycleAccount { index: Int, span: CaptureSpan, standings: List<SubjectStanding>, checkpoints: CheckpointObservation }
-
-SubjectStanding                                   // the reading's type is fixed by its subject, so no subject can carry another's evidence
-  = PlatformStanding { part: PlatformPart, reading: PlatformReading }
-  | SocketProgress { socket: Int, reading: SocketProgressReading }        // the ONLY carrier of an AmpereBootStage
-  | SocketErrorRecords { socket: Int, records: List<SocketRecordReading> }
-  | SecondaryJoinStanding { outcome: MtCollins1SecondaryJoinOutcome }
-  | ConsoleSubject { subject: ConsoleSubjectKind, reading: MilestoneReading }  // DramFirmware | Uefi | BootLoader | KernelStub | Kernel
-  | CensusStanding { reading: CensusReading }
-
-SocketProgressReading = ProgressRead { progress: SmproBootProgressRead, pass } | ProgressRefused { pair: SmproBootProgressRefused, pass }
-                      | ProgressStatedFailure { progress: SmproBootProgressRead } | ProgressNotRead { coverage_ref }
-SocketRecordReading = PendingDecoded { record: SmproInternalRecord }             // a stated error
-                    | UngatedRaw { raw, gate: SmproRecordGate }                  // anomaly + open question, never an error
-MilestoneReading = MilestoneObserved { milestone, line, parser, capture_sha256, order } | MilestoneStatedFailure { error, line }
-                 | MilestoneAnomalous { anomalies } | MilestoneNotObserved
-
-HostEnding                                       // what the HOST did last; says nothing about errors on the way
-  = ReachedCensus                                 // may coexist with errors and degradations
-  | StoppedWithStatedFailure { cycle, subject, error }
-  | RestartedRepeatedly { cycles: Int, last_cycle_ended_after: CheckpointRelation?, cadence: RestartCadence,
-                          console_errors: Nat, reset_cause: ResetCauseObservation }
-  | StoppedWithoutRestart { last_cycle_ended_after: CheckpointRelation?, console_errors: Nat }
-  | HostEndingNotEstablished                      // only when the remaining HOST evidence establishes no ending
-
-Degradation = SocketNotJoined{outcome: MtCollins1SecondaryJoinOutcome} | ActiveSocketsBelowExpected{active, expected}
-            | DimmNotTrained{slot}                                  // only against a receipt field LiveObserved/OperatorAttested
-            | PendingErrorRecord{socket, record: SmproInternalRecord}  // PendingAndDecoded only
-
-CheckpointObservation { capture_sha256, tokens: List<OpaqueToken>, malformed: List<String> }
-CheckpointRelation {                              // R2: an opaque relation, nothing more
-  cycle: Int, capture_sha256, last: OpaqueToken,
-  reference: ReferenceCapture { capture_sha256, firmware: FirmwareSnapshot, configuration: ConfigurationSnapshot },
-  continuation: ReferenceContinues{next: OpaqueToken, remaining: Nat} | ReferenceEndsThere | NotInReference | ReferenceUnread{detail}
-}
-
-ResetCauseObservation = ResetCauseUnobserved { searched } | ResetCauseObserved { raw: Word }   // decode is private
-RestartCadence = CadenceTimed { period: Second, cycles } | CadenceCounted { cycles }           // production SOL is not timestamped
-
-ObservationCoverage { carriers: List<CarrierCoverage> }
-CarrierCoverage { carrier: Carrier, standing: Read | ReadEmpty | Partial{detail} | Refused{cause} | NotTaken{reason} }
-Carrier = Sol | Kvm | SmproRegisters | SmproErrorRecords | Sel | Sdr | ChassisPower | RedfishInventory | VirtualMedia | HostCapture
-
-CollectionOutcome { media, handoff, override, power_after, bundle_write, credential, phases: MtCollins1BootPhaseTiming }
-
-OpenQuestion { subject: PowerOnSubject, question: OpenQuestionKind }
-OpenQuestionKind = ResetCauseNotPubliclyReadable | RetryStatePersistence | CheckpointMeaningNotPubliclyModeled
-                 | SmproPairRefused{socket} | RestartCadenceNotTimed | ConfigurationNotRecorded{field}
-                 | CarrierNotRead{carrier} | UngatedRecordUnexplained{socket} | ConfigurationConflicted{field}
-```
-
-Laws, each with a discriminating RED in slice A:
-
-1. **`ReachedCensus` is orthogonal to errors.** A GPI-pending CCIX record plus a one-socket census yields `ReachedCensus` with `degradations` (`SocketNotJoined`, `PendingErrorRecord`). It is never `StoppedWithStatedFailure`.
-2. **Cycles are preserved.** Run 37062170720's console yields two cycles: cycle 1 ended after `00001a0a`, cycle 2 has the milestone "UEFI reached". The ending reflects the last cycle, and the milestone survives.
-3. **Coverage and collection never choose the host ending.** An empty SOL, a BMC authentication refusal or a bundle-write failure is recorded in `coverage` or `collection` and nothing else. If another carrier establishes `ReachedCensus`, the UEFI shell or a reset, that host result stands beside the coverage defect. `HostEndingNotEstablished` applies only when the remaining host evidence establishes no ending. Converse RED: `SOL = ReadEmpty` with a valid host-capture END marker yields `ReachedCensus` plus an SOL coverage gap.
-4. **No stage from a token.** No law or arm takes an `AmpereBootStage` from a `CP:` token. Mutating the last token changes only `CheckpointRelation`.
-5. **The refused pair is not a stage.** `SmproBootProgressRefused` on socket 1 produces `SecondaryJoin` evidence and an `SmproPairRefused` open question, and no `Socket{1}` stage.
-6. **Configuration-dependent questions need the receipt.** If the receipt's DIMM population is `NotRecorded` or `Conflicted`, "every populated DIMM trained" is an open question, never assumed. A historical row never stands in: a step-3 attempt whose receipt says "socket 1 CPU absent, J1 only" is judged against that receipt, never against `mtcollins1_slots` or the 2026-09-23 orientation report.
-7. **A cycle exists without DRAM.** A chassis power-on plus SMpro progress or SEL boundary evidence, with no `DRAM FW version` banner, yields one partial cycle whose console span is absent. It never yields zero cycles or `HostEndingNotEstablished` on that ground alone.
-8. **Ungated is not stated.** A `GpiUnavailable` or ungated record with the same payload as a pending one is `UngatedRaw` plus `UngatedRecordUnexplained`. It adds nothing to `errors` or `degradations`.
-
-## 6. Consumption and the replacement migration (§3, §3c)
-
-**Firmware convergence (R1).** `gunbc.fleet.mtcollins_firmware_converge` `boot_verdict` stops taking `HostBootObservation?`. It takes `FirmwareSetBootReadback`, projected from the whole account by `firmware_set_boot_readback(account)`:
-- `BootReachedUefiAfterSet { cycle, milestone, ending: HostEnding, degradations, account_ref }`, when any cycle reached a UEFI milestone. The session ending and a reference to the whole account travel with it, so a UEFI milestone cannot erase a later `RestartedRepeatedly` ending. Convergence decides with both in hand.
-- `BootProgressLostAfterSet { relation: CheckpointRelation, cadence, reset_cause }`, when no cycle reached UEFI and the ending is `RestartedRepeatedly` or `StoppedWithoutRestart`.
-- `BootReadbackUnobservable { coverage }`, otherwise.
-
-`BootProgressLostAfterFirmwareSet` keeps its role as the convergence refusal and takes the relation instead of an authored checkpoint integer. `HostBootObservation`, `mtcollins1_post_firmware_set_boot_2026_10_03` and the `gunbc.machine_intake_boot_outcome` module are deleted in the same change. The authored 2026-10-03 datum is replaced by an account derived from the committed capture excerpt (step 1), which is that witness's fixture.
-
-**Consumer and semantic census for every deleted producer.** Each finding gets a typed destination or an explicit retirement:
-
-| Deleted | Consumers today | Destination |
-|---|---|---|
-| `…bundle` `mtcollins1_boot_bundle_findings` | bundle `mtcollins1_boot_bundle_text`, `mtcollins1_boot_outcome_after_bundle`; `…boot_run` `mtcollins1_boot_conclude` (`findings=` receipt line); bundle witness | The `PowerOnAccount` rendered through `std.observation` presentation. Receipt `findings=` becomes `account=` (one summary line) plus `coverage=` and `collection=` |
-| `…bundle` `mtcollins1_boot_outcome_with_findings` | `mtcollins1_boot_outcome_after_bundle`; bundle witness | Same role. It appends the account summary plus its errors and degradations to a refusal, and never flips the verdict (kept REDs) |
-| `bmc_all_failed_text` aggregate (the "unreachable" finding) | bundle findings | `coverage`: BMC carriers `Refused { cause }`. Retired as a host statement |
-| `processor_findings`, `memory_findings`, `socket_absent_finding` | bundle findings | `coverage` plus `Degradation` against the `AttemptConfigurationReceipt` (BMC's inventory view vs the expected topology) |
-| `sel_findings` | bundle findings | Per-cycle SEL events: memory/processor events go to `DramFirmware` / `Socket` anomalies, and restart records go to cycle segmentation |
-| `sensor_findings` → `…bmc_sensor_observation` `mtcollins1_sensor_findings` | bundle; sensor witness | `mtcollins1_sensor_anomalies` (typed, in the sensor module) on `Platform{ChassisPower}` |
-| `smpro_findings` → `gunbc.machine_intake_ampere_smpro_observation` `smpro_pass_findings` | bundle (3 passes); SMpro witness | `Socket{k}` standings via `smpro_boot_progress_of`, and `SecondaryJoin` via `secondary_join_outcome`. The "sockets differ" string is retired: the difference is now the two typed standings |
-| `console_findings`: `…dram_console_observation` `ampere_dram_findings` | bundle; DRAM witness | `ampere_dram_untrained_sockets` (closed-roster rule, in the DRAM module) feeds `DegradationDimmNotTrained` / `DramFirmware` anomalies; malformed rows become `DramFirmware` anomalies |
-| `console_findings`: `socket_summary_findings` | bundle | `SecondaryJoin` via `secondary_join_outcome`, and `ActiveSocketsBelowExpected` against the receipt's expected configuration |
-| `console_findings`: `…kernel_module_decompression_observation` `kernel_module_decompression_findings` | bundle; kernel-module witness | `Kernel` `StatedFailure { KernelModuleRefused }` |
-| `media_attach_findings`, `handoff_media_findings`, `override_findings`, `power_after_findings` | bundle; `megarac_media_convergence_witness_test` | `CollectionOutcome` (typed records, rendered once) |
-| credential-shred string | bundle findings | `CollectionOutcome.credential` |
-| `HostBootObservation` and its datum (#13041) | `mtcollins_firmware_converge` `boot_verdict`; its witness | `FirmwareSetBootReadback` (above) |
-
-**Consumers outside the required gate.** The production consumers are all in this closure: `mtcollins1_boot_run` (its fleet-converge entry) and the bundle. The test consumers are the witnesses of `mtcollins1_boot_diagnostic_bundle`, `ampere_smpro_observation`, `ampere_dram_console_observation`, `mtcollins1_bmc_sensor_observation`, `kernel_module_decompression_observation`, `megarac_media_convergence` and `mtcollins_firmware_converge`. Each one is migrated in slice A to the typed destination above, with each of its discriminating REDs kept. None is deleted without its claim moving.
-
-## 7. Reset cause, retry state and the summary's status lines
-
-The SCP keeps a reset-cause record, and no public register window reaches it: the full 0x00–0xFF SMpro sweep (`sweep-20261003T014255Z`) found none. So `ResetCauseObservation` is publicly `ResetCauseUnobserved { searched }`. `RetryStatePersistence` asks whether any failsafe or retry state survives the reset, which decides bounded retries versus an infinite loop. It is open on every `RestartedRepeatedly` ending. On cycles that reach UEFI, the summary's `Failsafe status` and `Reset status` fields are carried as raw observed values and cited as evidence on those two questions, never decoded publicly.
-
-## 8. The gunbc-private refinement slice (named)
-
-The private slice is **P: the Mt. Collins power-on account refinement**, in gunbc-private. It consumes the public `PowerOnAccount` and the private evidence (gunbc-private #202/#203: disassembly and SCP notes). It returns a private refinement that:
-- attributes `CP:` tokens to stages and sub-steps (e.g. the DDR training eye sweep);
-- names the restart mechanism (the SCP boot-complete wait and the watchdog);
-- decodes `ResetCauseObserved` and the summary's status fields;
-- answers `RetryStatePersistence` where the private evidence can.
-
-It imports the public account, the public repo never imports it, and nothing private flows back into public.
-
-## 9. Seams (noted, not abstracted)
-
-| Seam | Mt. Collins | Mt. Jade (#13065) | x86 |
-|---|---|---|---|
-| BMC family | AMI MegaRAC 0.45.3 | AMI MegaRAC, Ampere JADE LTS SPX12 | Varies |
-| Stage authority | `AmpereBootStage` via SMpro | Same silicon. To verify that the SMpro I2C route is exposed. | No SMpro: port-80/IPMI POST codes, a different authority |
-| Second socket | CCIX/2P, PMpro, `MtCollins1SecondaryJoinOutcome` | Same, needs its own join row | UPI/xGMI, MCA |
-| DRAM evidence | Ampere DRAM console block, opaque `CP:` | Likely the same, with references per platform | Vendor MRC messages |
-| Summary and NVPARAM | AMI Aptio on Ampere | Likely the same | None |
-| Console route | MegaRAC SOL (`DiesOnReset`) | MegaRAC SOL | Varies |
-
-The differences found when Mt. Jade lands become the onboarding checklist.
-
-## 10. Implementation slices
-
-1. **A (#13117): the power-on account, replacing every string finding and `HostBootObservation`, after #13041 lands.** Former slice B (#13058's error records) is folded in, and §10a records the decisions. It includes:
-   - the public readers: opaque `CP:` (`gunbc.machine_intake_ampere_checkpoint_console_observation`), and the EFI stub and kernel lines (`extdeps.linux.efi_stub`, `extdeps.linux.boot_console`, read by `gunbc.machine_intake_linux_boot_console_observation`);
-   - the `AttemptConfigurationReceipt` (frozen before power-on, including the human completion/inspection receipt for manual changes), and coverage;
-   - the account;
-   - the convergence readback;
-   - the bundle and receipt cutover;
-   - every census row in §6, plus the REDs of §5.
-
-   Fixtures are committed excerpts from the `mtcollins1-captures-2026-10-03` evidence branch, including step 3 as the new-firmware positive control, and the run 37062170720 / 37069907299 artifacts. A pre-review draft of the readers and a fold exists on `session/calm-lynx-884-slice-a-wip`. It predates these rulings (it uses a scalar ending, stage attribution from the DRAM banner, and its own SMpro pair rule) and will be reworked, not landed as-is.
-2. **B: the attempt-configuration receipt's live inputs**: the applied stimulus, current population and pre-power-on firmware readback (decided Q4). The error records originally planned as B landed in A.
-3. **C: NVPARAM** as UEFI-subject context, gated on #13059.
-4. **D: `ManagedHost`**, gated on #13055. If #13055 lands before A, it is folded into A.
-5. **P: the gunbc-private refinement slice** (§8).
-
-## 10a. Decisions taken while implementing slice A (#13117)
-
-These were settled while building slice A and through its side-chat reviews. Each one is enforced by a witness in #13117 and recorded here so this plan stays the authority.
-
-- **Cycles open only on typed boundary evidence.** Each SEL boot record gets a `SelBootBoundaryStanding` from an ordered fold with no look-ahead:
-  - the first record corroborates the confirmed power-on when it is a power-up;
-  - the first record is `BoundaryAmbiguous` when it is a restart after a confirmed power-on. It opens no cycle and becomes an open question, because this MegaRAC can log the power-on's own first boot as "System Restart" (step 1);
-  - every later record, including a second power-up, is a distinct boundary.
-
-  Console banners only bind spans to cycles, and only when the counts agree; otherwise the binding is `ConsoleSpansUnbound`. The BMC clock is never joined to ours.
-- **Stated failures are counted per occurrence.**
-  - Panics and initrd failures are read per printed line.
-  - Firmware statements, GRUB reports and module refusals are read by their owning readers over each console span's own lines.
-  - Each error carries its cycle. Only a failure in the last cycle can choose the ending, and the furthest one there wins. Earlier and unbound errors stay as history.
-- **A loop is distinguished from progress after a restart.** `RestartedRepeatedly` applies only when the last cycle got no further than an earlier one. Otherwise the ending is `StoppedWithoutRestart { restarts_before }`.
-- **Topology, population and absence are judged only against the receipt.**
-  - The expected topology is `ExpectedSockets`, or `ExpectedTopologyNotRecorded` (production today).
-  - Processors are checked once per expected socket: missing, duplicated, or unreadable socket ID.
-  - Memory is checked per socket, over the union of expected-populated and observed sockets, against `SlotRow { label, socket, populated }`.
-  - Sensor absence counts only for an expected socket.
-  - Health states reported by the BMC stay unconditional.
-- **SMpro.**
-  - Passes are reported per pass, not placed into cycles.
-  - #13058's records are placed by their gate (pending → stated error plus degradation; ungated → anomaly plus open question).
-  - Pending warnings are kept.
-  - The error-record registers have their own coverage carrier, separate from the boot-stage pair.
-- **Each milestone carries provenance.** It has its capture digest and a `DeclarationRef` to its reader. A one-variant nullary sum does not resolve in the substrate, so a declaration citation is used instead.
-- **Convergence refuses UEFI followed by a loop.** It reads the whole-account readback. A UEFI milestone followed by a `RestartedRepeatedly` ending refuses as `BootReachedUefiThenRestartedRepeatedly`.
-- **#13025's `secondary_checkpoints` is deleted (Q3).** The per-socket CP classification belongs to the private refinement slice.
-- **The receipt's live inputs are slice B (Q4).** Slice B adds the boot-workflow input for the applied stimulus (with a human inspection receipt through the operator-attested route), the current population, and the pre-power-on firmware readback. Until it lands, those fields are `NotRecorded` and every question needing them is open.
-
-## 11. Questions
-
-Q1 and Q2 were decided by the side chat on `75f0bd113c` and are encoded in §1, §3 and §5. Q3 (delete `secondary_checkpoints`) and Q4 (add the receipt inputs, as slice B) were decided during slice A (§10a). Q5 and Q6 are decided; none is open:
-- **Q5 (decided by eager-gull-22, 2026-10-03):** the plan and the inspection receipt are committed JSON under `artifacts/receipts/`, read from the checkout by a fail-closed typed reader that records the file's digest. One dispatch input names the file. Inline JSON in a dispatch input is refused.
-- **Q6 (decided, 2026-10-04):** add the `attempt_receipt` input to the fleet-converge `mtcollins1_boot` mode. It was operator escalation msg_1b57e749, approved by default after 15 minutes with no answer, and relayed by eager-gull-22.
-
-## 12. Slice B: the attempt receipt's live inputs (plan, for review before code)
-
-Slice B fills the `AttemptConfigurationReceipt` fields that slice A records as `NotRecorded` (decided Q4). The boot run takes its host as a `ManagedHost` / `ManagedHostBinding` (`gunbc.managed_host`), not as mtcollins1 constants; cut 4d of the managed-host untangle will re-root the rest of the run.
-
-**Two records, each minted only by its checks.**
-
-```
-AttemptConfigurationPlan (sole constructor) {
-  subject: ManagedHost, attempt: AttemptPlanId,
-  expected: ExpectedTopology, requested: StimulusRequest,   // expected and requested are stated ONCE, here
-  fixed_at: OperatorAttestedTime,
-}
-AttemptInspectionReceipt (sole constructor) {
-  plan: AttemptConfigurationPlan,
-  applied: StimulusApplication, cpus: PopulationReading<SocketCpuRow>, dimms: PopulationReading<SlotRow>,
-  completed_at: OperatorAttestedTime, evidence: ReceiptEvidence, witnessed_by: NonEmptyStr,
-}
-OperatorAttestedTime { rendering: NonEmptyStr, attested_by: NonEmptyStr }   // a time a person wrote, never an observer clock reading
-ReceiptEvidence { path, digest: Sha256FileDigest, commit }   // the committed file the run read
-```
-
-**The attempt identity comes from the dispatch, not from the artifact.** The current run's attempt identity is minted outside the receipt: it is the fleet-converge dispatch's existing `transaction_nonce`, which the operator mints and which the run name echoes. Admission runs before any pre-power read or actuation and joins `receipt.plan.attempt` to that identity. It then consumes the identity in a **create-once slot**:
-- The slot is keyed by (managed subject, `transaction_nonce`), in its own attempt-admission namespace, separate from the unit hold.
-- `Absent -> Consumed` is the only successful transition, done by compare-and-set against `Absent` (`std.durable_compare_and_set`).
-- No hold release or hold cleanup deletes or rewrites a slot.
-
-So a used identity stays used: it is not blocked by a later one, and it does not block one. A valid receipt authored for attempt A cannot be selected by attempt B, and A cannot be replayed after B.
-
-Controls, each an implementation RED:
-- the first A succeeds;
-- a concurrent or repeated A refuses;
-- B then succeeds;
-- A still refuses after B;
-- releasing the unit hold does not erase A's consumed standing.
-
-Implementation cut obligations:
-- The workflow's `transaction_nonce` description changes from "not consumed by any step" to its admission role.
-- A named receipt with an empty or absent `transaction_nonce` refuses.
-
-The run mints an `AttemptInspectionReceipt` only after every check passes, and each failed check refuses as its own typed cause:
-- the file's digest matches what was read;
-- the subject is the host this run's `ManagedHostBinding` bound;
-- the plan's attempt equals this dispatch's attempt identity;
-- the attempt identity was not already consumed;
-- the plan's identity is the one the receipt carries;
-- the attested ordering holds: `fixed_at` is at or before `completed_at`, as attested.
-
-**Times.** The plan's and receipt's times are what a person wrote, so they are `OperatorAttestedTime`, never `ObserverTimestamp`. They are ordered only among themselves. "Before the power write" is established STRUCTURALLY: admission is a step this run completes before it actuates. It is never established by comparing an attested time with an observer clock.
-
-**The absent-receipt rule (decided by eager-gull-22).**
-- **No receipt named:** the dispatch input is empty. The boot proceeds with the configuration `NotRecorded` and no topology judgement, as in slice A.
-- **A receipt named but refused:** a missing file, a digest or parse failure, an empty `transaction_nonce`, a subject, host, attempt or plan mismatch, a consumed identity, or an attested ordering violation. The boot REFUSES before any pre-power read or actuation, with that typed cause.
-- REDs, one per arm:
-  - an empty input reaches actuation with the configuration `NotRecorded`;
-  - a valid receipt for attempt A dispatched as attempt B refuses before actuation;
-  - a replayed identity refuses;
-  - a malformed file refuses.
-
-The pre-power-on firmware readback is bound to the same plan (`FirmwareReadBeforeActuation { plan, rows }`), so a readback from another attempt cannot fill this one. A receipt that is absent or refused leaves the fields `NotRecorded` or refused with their cause. The boot never proceeds on a guessed configuration.
-
-**The operator-attested route** follows `std.human_intervention`:
-- The inspection is a `HumanIntervention` step with `HumanSurfaceOnly`, because a physical change has no API.
-- Its `DischargedAt { evidence }` cites the evidence PRODUCER: the fail-closed reader that mints `AttemptInspectionReceipt` from the committed file, a `DeclarationRef` to that function. It does not cite a flag or a boolean standing.
-
-**The pre-power-on Redfish population read is not live by default.** A controller reading taken before power-on may be the BMC's cache from the last POST, so it is `PopulationControllerReading { freshness: FreshnessEstablished | CachePossible, rows }`:
-- It can corroborate the inspection or conflict with it. A conflict is `PopulationConflicted`, an open question, never resolved by preference.
-- Only `FreshnessEstablished` counts as a live reading. Nothing on main establishes that freshness today, so today's reading is `CachePossible`.
-
-**Field routes.**
-
-| Field | Route |
-|---|---|
-| expected topology and requested stimulus | the plan, stated once |
-| applied stimulus and population | the inspection receipt; the controller reading only corroborates or conflicts |
-| firmware | a new pre-power-on `hpm check` read through `extdeps.bmc.ipmi` (none exists on main; `gunbc.fleet.mtcollins_firmware_converge` only renders a dry argv), plus the SMpro version word where it answers, both bound to the plan |
-
-**Delivery (Q5, decided by eager-gull-22 on 2026-10-03).** The plan and the inspection receipt are committed JSON under `artifacts/receipts/`, reviewed and versioned like any change. eager-gull-22 authors them from what the operator reports about the physical change. One fleet-converge dispatch input names the receipt file, and the boot run reads it from the checkout with the fail-closed typed reader above. Inline JSON in a dispatch input is refused because it is not reviewable. Adding that input is Q6, decided.
-
-### 12a. Slice B1 as built
-
-Slice B1 is `gunbc.host_boot_attempt_admission`. It holds the plan and inspection records, the reader, the create-once attempt slot, and the projection into `AttemptConfigurationReceipt`. It is host-generic: mtcollins1 appears only as its route row (the receipt variables and the slot roster), in the `gunbc.host_maintenance_hold_reason` pattern. It returns one sealed `BootAttemptClearance`.
-
-**Placement** (agreed with warm-crane-577): the module sits beside the boot authorization. `mtcollins1_boot_under_live_unit_hold` calls `admit_boot_attempt(proof, revision)` right after `UnitHeld`, so admission runs under the hold and **before any controller read**.
-- **Baseline:** the SDR cache and SEL baseline (`mtcollins1_boot_baseline`) are taken only after clearance.
-- **Refused receipt:** the boot reads nothing from the controller, releases the hold, writes nothing, and fails with the typed cause. The matrix control is `a_refused_named_receipt_reads_no_baseline_and_writes_nothing`.
-- **Configuration record:** the frozen configuration travels on the attempt record into the bundle. Slice A's always-`NotRecorded` placeholder is deleted.
-- **Untangle cuts:** cuts 4a and 4d move the call site, and O2 carries its refusals.
-
-**The receipt is a tracked blob, digested.**
-- **Revision binding:** admission reads the receipt at the boot's bound revision, not from the worktree. `extdeps.git.inspect` `ListTreeEntryAtPath` finds the entry, decoded by the existing `gunbc.namespace_step0_subject_collector` ls-tree reader. `git show <rev>:<path>` reads the content.
-- **Refusals:** no entry is `ReceiptNotTracked`. A symlink, gitlink or directory is `ReceiptNotRegularFile`.
-- **Evidence:** `ReceiptEvidence { path, digest: Sha256FileDigest, commit }` carries the SHA-256 of exactly those bytes, from `extdeps.tools.sha256sum`.
-- **Follow-up:** the step0 decoder belongs in `extdeps.git`. Extracting it is left to the namespace lane rather than forked here.
-
-**Times** are admitted only as canonical UTC instants, using `gunbc.auth.approval_capability` `utc_instant_is_canonical`, which checks calendar-valid fields. They are ordered with `utc_instant_before`, and equal instants are admitted.
-
-**Populations join exactly, or the receipt refuses.**
-- **CPUs:** the CPU rows name exactly the plan's expected sockets.
-- **DIMMs:** the DIMM rows name exactly the host's slot roster. For Mt. Collins that is the Getting Started Guide's 32 connectors (`dimm_figure_banks`), labelled as the guide labels them (its `J` prefix and the connector number) and placed on their bank's socket. Every label must be known and on its roster socket, and every slot must appear, populated or not.
-- **Refusal causes:** a missing socket, an unknown label, a label on another socket, and an omitted slot each refuse with their own cause.
-
-**The slot store** is `/var/lib/gunbc/boot-attempts`, provisioned by `gunbc.runner_host_grants` `unit_hold_store_operations` beside the unit-hold store: same hosts, owner and mode. It is a separate directory, so a hold's release or recovery cannot reach it. Its executed control on the real store host is the first grant convergence followed by a receipt-carrying boot on srv1.
-
-Where the build differs from the plan above, with reasons:
-- **Slot key.** The key is `attempt-<len(host)>-<host>-<nonce>`, with the host and nonce admitted only over `[A-Za-z0-9_-]`. It is injective by construction and is not a hash: the corpus's `content_hash_of_value` is a 64-bit structural hash, which does not meet "collision-safe" against a chosen nonce.
-- **The plan's identity.** The inspection names its plan by `plan_subject` and `plan_attempt`. Because an attempt identity admits one boot, that pair identifies the plan.
-
-### 12b. Slice B2 as built (firmware), and B3 (controller population)
-
-Slice B2 adds one pre-power read, `mtcollins1_boot_pre_power`. It is taken after admission and before `mtcollins1_boot_actuate_held`, and `gunbc.host_boot_attempt_admission` `attempt_configuration_with_pre_power` joins it to the frozen configuration.
-- **The read.** `ipmitool hpm check` is a new `extdeps.bmc.ipmi` `HpmCheck` operation. It is parsed by `extdeps.bmc.ipmitool_hpm_check`, which landed with the CPLD route fix (#13254).
-- **The rows.** Each component's active cell is kept as rendered, because the auxiliary bytes have no public decode.
-- **Binding.** The readback is `FirmwareReadBeforeActuation { attempt, source, rows }`, where `attempt` is the attempt admission bound. An unread or refused table leaves firmware `NotRecorded` with its cause.
-- **The acceptance matrix.** The dry BMC (`gunbc.bmc_dry_realization`) answers `HpmCheck` with the retained BMC 0.32 capture, as a layout fixture.
-
-**B3: `PopulationControllerReading` (declared frontier).** B3 is the pre-power Redfish population read. It is labelled `CachePossible`, and is joined to the inspection as corroborated or conflicted per socket.
-- **Why it is not in B2:** its route dispatches `shell.Mktemp.Dir` and `shell.Remove.FileForce` (for the netrc) and `redfish.Http.GetResourceByPath`. The boot dry world does not model these, and no mtcollins1 Redfish response is retained to model them from.
-- **Trigger:** a retained mtcollins1 Redfish capture of the service root, Systems, the system, Processors and Memory. eager-gull-22's read-only probe takes it when the BMC is reachable.
-- **Caveat:** after the 2026-10-02 reflash, gunbc gets 401 on Redfish because its role is missing. If the capture is 401 bodies, the trigger also needs the login convergence to restore that role.
-- **Already written:** the join and folds are in WIP commit `16a67dfb99d` on `session/calm-lynx-884-slice-b2`.
\ No newline at end of file
diff --git a/docs/plans/precedence-climbing-tree-contract.md b/docs/plans/precedence-climbing-tree-contract.md
new file mode 100644
index 00000000000..fa8ab2c971c
--- /dev/null
+++ b/docs/plans/precedence-climbing-tree-contract.md
@@ -0,0 +1,500 @@
+# Precedence-climbing tree contract for v2 dag binary expressions — design plan
+
+Status: DESIGN ONLY (work item adhoc-2680a784-274, grammar program, manager stern-bear-500;
+reviewer sharp-raven-357). No code lands until this plan is approved. This file sits in a
+docs-only PR that will not be merged.
+
+## 0. The defect, re-derived (§6b)
+
+The slice is `v2.extdeps.languages.dag dag_grammar_binary_expr_expr` → `v2.compiler.parse`
+(`parse_expr_sequence`, `parse_expr_repeat`, `parse_expr_optional`) → the parse tree →
+`v2.compiler.body_lowering_fold` (the only reader of the tower's internal shape).
+
+- **What the grammar says.** `dag_grammar_binary_expr_expr` = `dag_grammar_pipe_expr_helper`.
+  It is seven inlined helpers (pipe → or → and → equality → comparison → additive →
+  multiplicative). Each is `Sequence(next_level, Repeat|Optional(Sequence(op_choice, next_level)))`
+  and bottoms out at `^dag_production_unary_expr`.
+- **What the parse establishes.** Every operand, even a bare `a`, passes through all seven levels.
+  At each level the parse tries the continuation, fails on the operator choice, and records the
+  failure in the tree. An empty Repeat goes through `parse_stamp_derived_repeat`, which mints an
+  occurrence id. An empty Optional becomes `grammar_empty_node`. Every level is also a
+  `parse_stamp_derived_conj` Conj with its own minted `DerivedBy` id.
+- **The result.** The tree has one node per precedence level per operand. Precedence (which
+  operator binds which operands) is encoded in how deep a node sits, not in any node of its own.
+- **What the only consumer actually needs.** It needs the operator applications, folded
+  left-associatively. `body_lowering_fold` throws the level structure away again:
+  - `body_lower_strip_operator_free_levels` peels `sequence(level, empty)`.
+  - `body_lower_fold_operator_tail` re-folds the Repeat spine.
+  - `body_lower_is_pipe_tower_root` decides at the root that `|>` is the outermost level.
+
+**The earliest unjustified boundary is the grammar's tree contract.** It states precedence as
+tree nesting, which no admitted consumer demands. The parse then does that work for every operand
+and stamps it as tree content, and lowering undoes it. This is §2's "work no admitted consumer
+demands", so the fix is to delete it. Caching, memoizing or batching the levels would only make
+it cheaper. #13244 already took the per-parse fixed cost (grammar preparation). What it left is
+exactly this per-operand slope.
+
+## 1. Proposal: one node per operator APPLICATION
+
+Add a precedence-climbing operator-table combinator to the grammar algebra, the one authority
+both directions read (DESIGN §4: one grammar, read in both directions).
+
+```
+// v2.std.grammar
+type InfixAssociativity = InfixLeft | InfixNonAssociative
+type InfixOperatorRow {
+  token_class: Symbol          // exactly one terminal class per row
+  binding_power: Int           // higher binds tighter
+  associativity: InfixAssociativity
+  guard: Optional<GrammarExpr> // a zero-width predicate run before the operator (§3 below)
+}
+GrammarExpr += InfixTable { operand: GrammarExpr, operators: List<InfixOperatorRow> }
+```
+
+**Forward (parse).** A new `v2.compiler.parse` `parse_expr_infix_table`, using precedence
+climbing (Pratt / binding-power):
+
+1. Parse one operand.
+2. Peek the next token's class and look it up in the table, keyed by class. The lookup is
+   prepared once in `prepare_grammar_expr` as `PreparedInfixTable` and indexed, like the
+   prepared choice plan.
+3. If no row matches, or the row's binding power is below the current minimum, return the operand
+   **unwrapped**. No continuation node is attempted or stamped.
+4. Otherwise run the row's guard, consume the operator, and recurse at
+   `binding_power + 1` (left associative).
+5. Stamp **one** application node per operator consumed:
+   `Conj { grammar_infix_left, grammar_infix_operator, grammar_infix_right }`, minting one
+   `DerivedBy` id from its three children.
+6. A `InfixNonAssociative` row refuses a second operator of the same binding power with a typed
+   `ParseRefusalReason` (proposed name `NonAssociativeOperatorChain`). The source stays
+   describable, but no accepted tree contains the chain: rung 3.
+
+**The production shell stays one per expression occurrence** (`parse_wrap_production_captured`
+for `dag_production_binary_expr`). Inside it, the captured child is either the bare unary operand
+or the root application node.
+
+**Backward (emit).** A new `v2.std.grammar` `grammar_emit_infix_table`:
+
+- An application node emits its left side, the operator terminal, then its right side.
+- A non-application node emits as the operand.
+- A tree that violates the table refuses: for example, an application whose left child is an
+  application of lower binding power, or an unknown operator class. Such a tree would print text
+  that reparses differently, so this refusal keeps the round trip honest rather than adding
+  parentheses. Parse trees never need parentheses inserted, because grouping is a primary of
+  their own.
+
+**Fold.** Add `GrammarExprFold.infix_table`. This is what keeps
+`body_lower_grammar_terminals` reading the operator set off the grammar rather than from a
+hand-written list (review 70545).
+
+**The dag rows.** `dag_grammar_binary_expr_expr` becomes
+`InfixTable { operand: Nonterminal(dag_production_unary_expr), operators: dag_infix_operators }`.
+The rows carry **v2's current precedence, unchanged**:
+
+| binding power | operators | associativity |
+|---|---|---|
+| 1 | `\|>` | left |
+| 2 | `\|\|` | left |
+| 3 | `&&` | left |
+| 4 | `==`, `!=` | non-associative (today an `Optional`) |
+| 5 | `<`, `>`, `<=`, `>=` | non-associative (today an `Optional`) |
+| 6 | `+`, `-` (guarded) | left |
+| 7 | `*`, `/`, `%` | left |
+
+**Why a grammar variant, and not a flat `unary (op unary)*` with precedence re-folded in
+lowering.** That flat alternative ("single-level operator-table production") was considered and
+is rejected:
+
+- It moves precedence out of the grammar into a lowering-side table, so the grammar would no
+  longer be the single authority on surface syntax.
+- It would accept `a < b < c` grammatically, so that refusal would happen later, in lowering.
+- The backward emitter could no longer tell a well-formed tree from a mis-associated one.
+
+The price of the variant is one new arm in every `GrammarExpr` consumer. Section 4 enumerates
+them.
+
+## 2. Readers, by symbol (git grep of every production and emitted identity)
+
+### The grammar (deleted, replaced by one table)
+
+All in `v2.extdeps.languages.dag`:
+
+- Deleted:
+  - the seven `dag_grammar_{pipe,or,and,equality,comparison,additive,multiplicative}_expr_helper`
+  - `dag_grammar_{multiplicative,additive,comparison,equality}_op_choice`
+  - `dag_grammar_additive_newline_minus_guard`, which becomes the `-` row's guard
+- Re-derived:
+  - `dag_grammar_binary_expr_expr`
+  - the explanatory block above `dag_grammar_arrow_lambda_name_head_expr`, whose
+    "pipe → or → … → multiplicative" derivation argument is restated over the table
+- Unchanged:
+  - `dag_grammar_unary_expr_expr` (already a single level)
+  - `dag_grammar_postfix_expr_expr`
+  - the `dag_grammar_root` production rows for binary, unary and postfix
+  - `dag_grammar_match_expr_expr`'s scrutinee nonterminal
+  - `dag_surface_operator_canonicalization_lookup` / `_member`, which read token classes, not
+    tree shape
+
+### Grammar algebra and parse (std / compiler): one new arm each
+
+- In `v2.std.grammar`:
+  - `GrammarExpr`, `GrammarExprFold` and `fold_grammar_expr`
+  - backward emit: `grammar_emit_expr` gains `grammar_emit_infix_table`
+  - `formal_grammar_symbol_to_grammar_expr` does not change, because there is no formal-symbol
+    form
+- In `v2.compiler.parse` (`02_parse.dag`):
+  - `prepare_grammar_expr`, which builds `PreparedInfixTable`
+  - `parse_expr_with_first` dispatch
+  - FIRST analysis: `compute_grammar_first_analysis_given`
+    - FIRST(table) = FIRST(operand)
+    - nullable(table) = nullable(operand)
+  - `compute_nullable_set`
+  - left recursion: `grammar_has_left_recursion_given`, where the table is left-recursive iff its
+    operand is
+  - `authored_choice_site_residue` / `flatten_choice_exprs`: no Choice site, so no roster row
+  - lookahead: `lookahead_site_overlaps` / `lookahead_alternatives_overlap` treat the table as
+    its operand followed by an optional infix suffix
+  - every exhaustive `match` over `PreparedGrammarExpr`. The listed `PreparedRepeat` arm sites are
+    the census, and the compiler refuses any that is missed.
+- Grammar validation (`grammar_validate_and_analyze`) gains a structural refusal: duplicate
+  `token_class` within one table (§3).
+
+### Lowering: the only reader of the tower's internal shape
+
+In `v2.compiler.body_lowering_fold`.
+
+Deleted (they exist only to undo the level encoding):
+
+- `body_lower_strip_operator_free_levels`
+- `body_lower_tail_has_binary_operator`
+- `body_lower_fold_operator_tail`
+- `body_lower_tail_element_pipes_into_fold`
+- `body_lower_tail_pipes_into_fold`
+- `body_lower_tail_starts_with_pipe`
+- `body_lower_node_is_pipe_token`
+- `body_lower_is_pipe_tower_root`
+- `body_lower_tower_pipes_into_fold`
+
+Re-derived over the application node:
+
+- `body_lower_read_operator_expression`: an application node lowers to
+  `lower_binary_infix(left, op, right)`, and a prefix operator still goes to
+  `lower_unary_prefix`.
+- `body_lower_operator_operand`
+- `body_lower_binary_apply` and `body_lower_piped_fold_optional`: "pipe into fold" becomes "an
+  application node whose operator is `|>` and whose right operand is a fold-family call". This
+  is decided at the node itself, so the root-detection apparatus and its census (#12550) go away.
+- `body_lower_try_infix_transform`
+- `body_lower_grammar_terminals`: one new algebra arm, collecting the table's token classes.
+- `body_lower_binary_operator_tokens` and the `data` row `body_lower_binary_operators`.
+
+Shell readers, unchanged because the production shells are unchanged:
+
+- `body_lower_is_pass_through_emitted`
+- `body_lower_find_core_substrate_first_hit_child`
+- `body_lower_reduce_emitted`
+- `body_lower_body_subtree_lower_from_binary` / `_from_postfix`
+- `body_lower_arm_operand_resolved_read`
+- `body_lower_postfix_expr`
+- `body_lower_primary_expr`
+- `body_lower_production_emitted`
+
+Two more, which only receive the lowered shape:
+
+- `v2.std.compilers.body_lowering` `lower_binary_infix` / `lower_unary_prefix` build the output.
+  Their input is unchanged.
+- `v2.lens.vacuity` `vacuity_bool_witness_fn_body_evidence` calls `body_lower_try_infix_transform`
+  and receives the same lowered result.
+
+### Normalize, resolve, infer, eval, emit: none read the parse shape
+
+- Normalize and resolve: no reader found.
+- `v2.compiler.occurrence_role` `dag_name_production_rows`: keyed on `dag_production_postfix_expr`.
+  That production is untouched, so names under postfix keep `NamesAreReferences`.
+- Infer:
+  - `v2.compiler.infer` (`04_infer.dag`): `infer_operator_is_plus_token`,
+    `infer_transform_binary_infix`, `infer_transform_is_binary_infix_algebra_shape`
+  - `v2.extdeps.runtimes.v2_evaluator` `v2_eval_transform_is_int_add`
+  - All read lowered operator atoms.
+- Emit: the Rust, TypeScript and dag-target emitters read `v2.std.compilers.target_model`
+  `InfixToken` over lowered nodes. The dag target's token emission (#13099 `TargetBindLetShape`,
+  #13113 `bound_tokens_source_text_with_transforms`) produces token lists from lowered core, not
+  parse trees.
+
+### Backward grammar emit and round trip (#12878, #13099, #13113)
+
+These re-run as controls; none needs re-derivation beyond the new arm:
+
+- `v2.std.grammar`: `grammar_emit_parse_tree`, `grammar_emit_sequence`, `grammar_emit_repeat`,
+  `grammar_emit_optional`, `grammar_emit_choice`
+- `v2.extdeps.languages.dag` `dag_emit_parse_tree` / `_with_root`, which read `dag_grammar_root`
+  and so pick up the table automatically
+- `gunbc.instruments.dag_emit_real_grammar_round_trips`
+- `v2.test.execution.dag_grammar_backward_round_trip`
+- `v2.test.execution.dag_emit_interface`
+- `v2.test.emit.dag_target_text_round_trip`
+
+### Lenses
+
+`v2.lens.text_string_importer_census` reads fixed-depth ancestor walks of identity strings:
+
+- `primary_is_argument` expects postfix → unary → binary → `dag_surface_expr`.
+- `value_prefix`, `value_is_argument`, `value_initializes_bare_string_annotation`,
+  `value_is_statement_or_arm`, `value_is_field_init`, `value_initializes_annotation` and
+  `value_is_right_plus_operand` / `site_kinds_at` (`dag_token_plus`) read positions w4 to w8.
+
+**What changes:**
+
+- Operands that stand alone keep the same walk, because the shells are unchanged and no level
+  nodes are named.
+- Operands *under* an application gain the application node in their walk.
+- The `+` operand reading must be re-derived from the application node's operator edge, not from
+  a sibling position.
+
+**The control** is the census output compared before and after **at identity grain**: same sites
+and same kinds, not the same count. The test `v2.test.text_string_importer_census` hard-codes
+about 108 walk strings (`tsil_*`). Those are re-derived; the expected *census result* is
+unchanged.
+
+Other lenses:
+
+- `v2.lens.complexity_accumulator_copy.analyze` `postfix_expr_capture` and the
+  `collect_value_identifiers` comment: re-read; postfix is unchanged.
+- `v2.workflow.floor_cost_debt_edit` (`removal_safe_follower`, `removal_operand_opener`,
+  `removal_walk_*`): token stream only, unaffected.
+
+### Tests that name the shape
+
+- `v2.test.manual.body_lowering_normalize_add`: `body_lowering_binary_infix_holds`,
+  `body_lowering_expr_infix_holds`.
+- `v2.test.body_lowering.reify_operand_refusal`: `ror_first_binary`.
+- `v2.test.parse.newline_dual_role_operator_parse`:
+  - `n_is_unary`, the unary-count route control from #13034. This survives, because unary is
+    unchanged.
+  - The comments citing the additive helper are re-pointed at the `-` row guard.
+- `v2.test.parse.block_expr_as_binary_operand_parse` and
+  `v2.test.parse.block_headed_operand_class_parse`: the derivation prose is re-pointed. Their
+  arms are part of the control set (§6).
+- `v2.test.manual.grammar_choice_ambiguity_audit`: the comment about "binary_expr's precedence
+  levels" yielding identical rows. Those rows are gone.
+- `dag/test/claim/long/dag_arrow_lambda_witness_test` `pre_repair_expr_expr`: a copy of the expr
+  grammar. It references the production, not the helpers, so it is unaffected; to be confirmed
+  by compiling it.
+- `layout_line_break_test`: a copy of the minus guard, re-read against the row guard.
+- Fixtures that only use operator token atoms are unaffected:
+  - `enclosing_expression_structure`, `fold_operand_structure`
+  - `rust_binop_emit`, `add_body_*`, `body_lowering_infix`
+  - `dag_bind_let_block_scoped`, `closure_parse_batch_two`, `variant_field_lowering`
+  - `dag_line_comment_annotation_channel`
+
+### Prose-only mentions (no consumer; re-pointed so they don't cite deleted symbols)
+
+- `gunbc.recurring_failure_mode`
+  `v2_lexer_carries_no_layout_so_a_newline_before_a_dual_role_operator_merges_silently`
+- `gunbc.recurring_failure_mode`
+  `data_initializer_match_reads_its_scrutinee_from_an_arm_at_v2_body_lowering`
+- `gunbc.compiler_frontend_program_status`
+- `v2.test.long.accumulator_copy_fold_analysis`
+
+### Other languages
+
+- `v2.extdeps.languages.kotlin` has its own named-production tower (`kotlin_grammar_binary_expr`
+  → equality → comparison → additive). It shares no symbol with the dag tower, so it is **not** a
+  consumer and is not changed in this transition. Once `InfixTable` exists it is the obvious next
+  inhabitant. That is a separate, later change, named here so it does not read as forgotten.
+- `swift.dag` uses one generic operator token and no levels. `rust.dag` and `java.dag` have no
+  tower.
+- No generated `*.rs` mirror names any of these identities.
+
+## 3. Overlap roster stays 0, by construction
+
+**The table contains no `Choice`.** The roster (`authored_choice_site_residue` over
+`flatten_choice_exprs`) has no site to inspect inside it. Operator selection is an *index lookup
+keyed by token class*, not an ordered alternative.
+
+**Disjointness is structural.** `grammar_validate_and_analyze` refuses a table whose rows repeat
+a `token_class`:
+
+- A duplicate row is writable in source, but no validated grammar contains one: rung 3.
+- Each row is exactly one terminal class, so "disjoint FIRST sets" is "distinct class symbols":
+  decidable and total.
+- There is no order among rows. The zero-ambiguity ruling (2026-10-02) holds because nothing is
+  left to order.
+
+**Prefix vs infix `-` are disjoint by position.** Infix `-` is consulted only *after* a complete
+operand. Prefix `-` lives only in `dag_grammar_unary_expr_expr`, at operand start. This is the
+same split #13034 relied on.
+
+**The newline-minus guard survives as the `-` row's `guard`.** The guard is
+`NotPredicate(RefuseOnMatch(AfterLineBreak(Terminal(minus))))`, exactly the expression #13034
+authored, moved from the additive helper's sequence onto the row. `parse_expr_infix_table` runs
+the guard before consuming the operator:
+
+- A line-break `-` raises `NewlineBeforeDualRoleOperator`. The refusal survives the predicate, as
+  in `parse_expr_not_predicate`.
+- A same-line `-` is subtraction.
+
+Its controls in `v2.test.parse.newline_dual_role_operator_parse`, both the refusal arm and the
+same-line subtraction route that counts unary layers, must stay green *unchanged*.
+
+**Relation to #13126 (still OPEN).** Whether or not it lands first, the table adds no row. If
+#13126 lands first, its required zero-count claim
+(`test.claim.parse_test_grammar_choice_overlap`) is part of this change's control set.
+
+## 4. Replacement migration order (DESIGN §3: delete-first, one authority transition)
+
+The parse tree is consumed by lowering inside the same compilation. That makes it a
+**gap-intolerant boundary**: no intermediate state can have the grammar emitting one contract
+while lowering reads the other. So the transition is **one PR**.
+
+1. **Delete the root.** Remove the seven helpers, the four `_op_choice` functions and the
+   standalone guard. `dag_grammar_binary_expr_expr` becomes the `InfixTable` row. This breaks
+   every reader loudly, and what breaks is the census in §2.
+2. **Add the algebra arm in `v2.std.grammar` and `v2.compiler.parse`.** The `GrammarExpr` /
+   `PreparedGrammarExpr` matches are exhaustive, so the compiler enumerates every site, and each
+   one gets its honest arm (§2). This includes the duplicate-class refusal and the
+   `NonAssociativeOperatorChain` reason in `v2.std.parse_refusal_reason`.
+3. **Re-derive lowering over the application node, and delete the tower readers outright.** No
+   reader understands both shapes, and nothing falls back to the old tower. The old tree may be
+   used only offline, from history, as the differential oracle in §6.
+4. **Re-derive the census lens and its walk strings**, the test fixtures, and the prose citations.
+5. **Re-measure the declared cost drops (§5).** Retire a drop only where its trigger is actually
+   met, never by assertion.
+
+**Root inside the required gate?** The parse/lowering route is exercised by required floor
+claims, so the deletion census is loud there. The lens (`text_string_importer_census`) and
+`kotlin.dag` are named explicitly above because a product-layer reader could stay quietly broken
+(§3: enumerate before deleting).
+
+## 5. Expected saving, retired drops, headroom
+
+**What wise-ant-549 measured (#13244)** for one operand `a` entering at each level: binary layer
+3,080 steps (about 440 per inlined level). Of that, an empty repeat stamp is 14 and memo
+bookkeeping about 110. For comparison: primary 1,348, postfix 860, unary 493, expr guard 1,665,
+arg guard 1,263.
+
+**Structural claims.** These must hold, and each falsifies the design if it doesn't:
+
+- **S1.** No Repeat or Optional continuation node is attempted or stamped for an operand with no
+  operator. Per operand, the binary layer does one peek plus one indexed lookup.
+- **S2.** The number of application nodes equals the number of operator tokens. Level nodes: 0.
+- **S3.** The lowered output (after `body_lowering_fold`) is node-identical for every control
+  expression, ignoring occurrence ids.
+
+**Magnitude estimate.** This is labelled as an estimate: missing it falsifies the estimate, not
+the diagnosis.
+
+- The binary layer drops from about 3,080 to about 150 steps per operand (one prepared-table
+  lookup at the cost of an indexed lookup, about 6.5, plus frame overhead). That saves **about
+  2.9k steps per operand position**.
+- An operator token adds one application stamp, about the cost of one sequence stamp, instead of
+  re-entering seven levels for its right operand.
+- Per *token*, the saving is about 2.9k × (operand positions / token). That fraction is around
+  0.4–0.5 in typical bodies, so **about 1.2–1.5k of today's 2.6–3k per-token slope**.
+- The rest of the slope is the expr and arg guards (1,665 + 1,263) and postfix/primary. Those are
+  out of scope here and are the next target.
+
+**Which drops retire.** Each is predicted, and each is retired only on measurement:
+
+- **`gunbc.rung_drop.dag_text_round_trip_nested_bind_new_witness_eval_step_cost`**, with
+  `floor_eval_step_cost_drop_dag_text_round_trip_rows` (Bind body 108,685; Bind value 106,590;
+  budget 72,300 = 100 ms × 723 steps/ms, from `required_floor_new_witness_envelope_ms` and
+  `floor_eval_step_calibration`).
+  - Its trigger names exactly this capability.
+  - **Honest prediction: this change alone probably does NOT bring them under budget.** The
+    two-Bind text has about 4–6 operand positions, so the expected saving is about 12–17k
+    against the 34–36k needed.
+  - The drop therefore stands until the measurement says otherwise. Its trigger already admits
+    "or parse claims evaluated on the native route" as the alternative capability.
+  - The plan will **not** reword the trigger to declare it met.
+- **`gunbc.rung_drop.dag_emit_round_trip_new_witness_eval_step_cost`**, with
+  `floor_eval_step_cost_drop_dag_emit_round_trip_rows`. A candidate; re-measured against its
+  "two parses of a one-line module" trigger.
+- **Headroom (not drops).** The four #13233 claims sitting just under budget gain about 3–6k
+  each: bare name 67,569, empty brace 67,713, minus-led 68,299, mixed conditional 46,473. So does
+  every gated parse claim, roughly in proportion to its operand count.
+
+The measured per-claim figures are re-derived by the floor run. Section 6 names the instrument
+rather than transcribing future numbers.
+
+## 6. Discriminating controls
+
+1. **Tree controls (before/after).** A representative set, parsed on the real route
+   (`dag_prepared_grammar`), with the tree printed both ways:
+   - `a`, `a + b`, `a + b * c`, `a * b + c`, `a - b - c` (left associativity)
+   - `!a && b`, `-a * b`
+   - `a && b || c`, `a == b`, `a < b`
+   - `xs |> fold(0, f)`, `a + b |> f`
+   - `match x { … } && b`, `if c then 1 else 2 + 3` (block-headed operands, #12817)
+   - `(a + b) * c`
+   - `x` then a line `-1` (refusal)
+
+   **Red arms:**
+   - `a < b < c` and `a == b != c` refuse with `NonAssociativeOperatorChain`. Today they fail
+     with the generic leftover-token reason. The change in reason is part of the diff and is
+     stated, not hidden.
+   - A grammar with a duplicated operator row refuses validation.
+   - A hand-built tree whose application violates binding power refuses backward emit.
+2. **Semantic equivalence after lowering.** For every expression above, and over the full corpus
+   on the native route, the `body_lowering_fold` output equals the pre-change output (S3).
+   - The oracle is the old grammar run from history as an offline differential: the pre-change
+     binary run on the same inputs, with no fallback in production.
+   - Corpus scope: `gunbc test //gunbc/instruments:self-host` plus the required floor.
+3. **Round trip.** `gunbc.instruments.dag_emit_real_grammar_round_trips`,
+   `v2.test.execution.dag_grammar_backward_round_trip` and `v2.test.emit.dag_target_text_round_trip`
+   stay green. Text → tree → text → tree must be a fixed point over the control set.
+4. **Overlap.** The roster count stays 0 (`v2.test.manual.grammar_choice_ambiguity_audit`, and
+   #13126's zero-count claim once it lands). The newline-minus controls of #13034 stay green
+   unchanged.
+5. **Step saving, measured.** wise-ant-549's #13244 per-level probe is re-run on the same
+   fragments (`x: 1`, `x: a + b + c`, the 15-token fragment), together with the floor run's
+   per-claim eval steps for the rows in §5.
+   - S1 and S2 must hold exactly. The magnitude estimate is reported against them with any miss
+     named.
+   - This needs the probe to be an entry point rather than a PR-body transcript. If it is not one
+     today, landing it is part of the change (§6, name the instrument).
+
+## 7. The v1 seed
+
+**v1 does not need to change.** `src/v1/02_parse.dag` already precedence-climbs:
+
+- `parse_expr_bp`, `infix_bp`, `find_operator_bp` / `find_operator_binop` over the
+  `OperatorSpec` rows of `dag/extdeps/languages/dag/syntax.dag` `dag_operators`
+- the newline refusal in `is_ambiguous_prefix_infix_newline_boundary`
+
+Nothing in v2 reads that table, and nothing in this change serves the self-host program through
+v1. So the v1-maintenance purpose test (`gunbc.v1_maintenance_standing v1_seed_standing`) admits
+no edit, and none is proposed.
+
+**This design does surface three seed/v2 divergences in the operator facts.** Per DESIGN §7, each
+is either a v2 regression or a seed defect. This plan preserves v2's current behaviour and does
+not decide them:
+
+- **`|>` precedence.**
+  - v1: binding power 17/18, the *tightest*, so `a + b |> f` = `a + (b |> f)`.
+  - v2: the *loosest* level, so `(a + b) |> f`.
+
+  This is a real semantic split on the same source text. **It needs a ruling** before the table's
+  row order is treated as settled.
+- **Chained comparison/equality.** v1 accepts `a == b == c` left-associatively; v2 refuses it.
+  This plan keeps v2's refusal, now typed, as the stronger rung. It should be confirmed as a seed
+  defect.
+- **`??` (`NullCoalesce`).** It is in the v1 table and absent from v2. That is out of scope here,
+  noted only so the table is not read as complete.
+
+**Two operator tables for one language.** After this change, the seed's `dag_operators` and v2's
+`dag_infix_operators` both describe dag infix precedence. That is not a new nickname. The seed
+table is the frozen X of the seed carve-out, and v2's row is the authority going forward. No v2
+code may read or derive from the seed table.
+
+## 8. Open questions for the reviewer
+
+1. **The `|>` precedence ruling (§7).** Recommendation: keep v2's loosest-pipe. It is what the
+   lowering's pipe-into-fold reading and the corpus are written against. Record the seed's
+   reading as the defect.
+2. **`InfixTable` as a new `GrammarExpr` variant** versus the flat single-level production with
+   precedence in lowering (§1). Recommendation: the variant.
+3. **The application node's representation.** Proposed: a `Conj` with three named projections
+   (`grammar_infix_left`, `grammar_infix_operator`, `grammar_infix_right`). The alternative is a
+   dedicated `TypeNode` connective. The `Conj` form reuses the parse's existing stamping and
+   emit's projection reading and adds no connective. Recommendation: `Conj`.
diff --git a/docs/plans/prepared-effect-input-carry.md b/docs/plans/prepared-effect-input-carry.md
deleted file mode 100644
index 55a41aa5f0c..00000000000
--- a/docs/plans/prepared-effect-input-carry.md
+++ /dev/null
@@ -1,205 +0,0 @@
-# Prepared effect input carried into nullary warm rows (PR two of the #10994 chain)
-
-ADJUDICATED AND IMPLEMENTED. The model below was sent to eager-raven-113, fierce-lark-661 and
-bright-boar-435 before any code was written; all three approved both decisions (2026-09-14), each
-with one condition, and every condition is discharged in the landed change:
-
-- the carried value's DISPOSITION is printed on the floor's phase line beside its content digest,
-  so a run whose carrier refused is diagnosable rather than silent (bright-boar's condition on
-  Decision 1);
-- `std.materialization_ladder` is cited IN SOURCE, not only here: the four obligations are typed
-  values in `v2.workflow.floor_prepared_effect_input_ladder`, decided by the ladder's own fold and
-  exercised by `v2.test.floor_prepared_effect_input_ladder` (the condition both fierce-lark and
-  eager-raven attached to Decision 2);
-- the binding's absence after the tier is cleared has its own control (eager-raven's condition b).
-
-Two things the evidence found that this document's first cut did not, recorded because both
-changed the implementation rather than the prose:
-
-1. `run_in_context` calls `call_function` DIRECTLY, reaching neither the cross-claim tier nor the
-   prepared-input binding. A control that evaluated the producer that way asserted a value
-   RECOMPUTE also produces — the decoration DESIGN section 4b names. The controls now evaluate
-   through an ordinary call site and assert an OBSERVED SERVE from the tier's own hit observer.
-2. With that fixed, the changed-carrier RED went red on the REAL implementation: the
-   producer-to-carry map held a CLONE of the carry, so re-binding the acquisition left the key
-   unchanged and the producer was served a value derived from the previous carrier. It now holds
-   the acquisition NODE and reads its current binding at every key derivation.
-
-## The gap, stated at the floor's own vocabulary
-
-`v2.workflow.floor_pure_producer_share` admits two fill dispositions and only two:
-
-- a WARM row is NULLARY and preparation-forceable — `install_pure_producer_share` evaluates it
-  once in a Hermetic frame over its own module scope and the fill is billed to preparation;
-- a CLAIM-FORCED row has claim-shaped arguments, so it fills inside the fold on first touch and
-  the paying claim carries the fill.
-
-A producer whose value depends on one effectful read of a committed carrier fits neither. It
-cannot be warmed as a nullary pure row, because `store_cross_claim_pure_memo` is keyed on
-(resolved fn node, portable argument row) and an effect-dispatching nullary call contributes
-NOTHING to that key — the read's content is invisible to the key, which is the ctx-blind homonym
-class in its content form: two different carrier contents would share one entry. And as a
-claim-forced row it re-derives per claim, which is the rostered
-`shared_precondition_re_derived_once_per_claim_frame`.
-
-The live instance: `gunbc.roadmap_authority.roadmap_authority_projection` — one
-`Filesystem.Read` of `dag/gunbc/roadmap/roadmap_acceptance_event_history.jsonl` (16 lines,
-~10 KB) followed by a pure ~186 ms fold, demanded by seven required-lane claims and by #10994,
-whose current blocker is an enrolment margin RED (306 ms then 279 ms against a 302 ms margin)
-sitting on top of exactly this shared precondition.
-
-## One fact that makes the carry legitimate rather than a memo of an effect
-
-Hermetic mode already classifies this read as INPUT ACCESS, not a host effect: the
-checkout-input carve-out in `v1_interpreter::eval_service_call` dispatches a readonly
-`Filesystem.Read`/`List` WET when `hermetic_checkout_input_disposition` confirms the path under
-the checkout root. The carrier is such a path. So the value is a function of the commit the run
-prepared — constant for the whole prepared subject — and carrying it once is not caching an
-effect, it is binding an input the run already holds fixed. Anything the disposition cannot
-confirm (out-of-root, `.git`/`target`, unresolvable) is refused by that existing wall and is
-therefore never carryable here either.
-
-## The model
-
-Two declarations in `v2.workflow.floor_pure_producer_share`, beside the two existing rosters.
-
-    type PreparedEffectInput {
-      // The nullary declaration whose evaluation ACQUIRES the input. Resolved to a fn node at
-      // preparation, exactly like every rostered producer — never admitted by bare name.
-      acquisition: String
-      // Why the acquisition is a run-constant checkout input rather than host state, and the
-      // consumers the carry serves. Evidence fields, same discipline as RefusedShareCandidate:
-      // name the instrument, never transcribe its output.
-      ground: String
-      measurement: String
-    }
-
-    type CarriedInputWarmRow {
-      producer: String     // the pure fold, resolved to its fn node
-      parameter: String    // the named parameter the carried value fills
-      input: String        // which PreparedEffectInput.acquisition supplies it
-      measurement: String
-    }
-
-    data floor_cross_claim_prepared_effect_inputs: List<PreparedEffectInput>
-    data floor_cross_claim_carried_input_warm_rows: List<CarriedInputWarmRow>
-
-### What preparation does
-
-`install_pure_producer_share` gains one phase, ordered BEFORE the existing warm loop:
-
-1. Resolve each `acquisition` to its fn node in a frame over the prepared subject (the existing
-   `floor_authority_frame`, unchanged — Hermetic). An unresolved spelling or a module outside the
-   subject is a stale row and STOPS THE LINE, exactly as a stale warm row does today.
-2. Refuse at install any acquisition whose declaration is not nullary: a carried input with
-   arguments is a different concept and must not be smuggled in under this one.
-3. Evaluate it ONCE, under `observe_shared_build`, so the acquisition is billed to preparation
-   and adjudicated by the same preparation refusal as every other shared build.
-4. Reify the value totally to `PortableValue` — the SAME total walk publication already performs
-   — and take its content identity as the structural digest over that form (`std.content_hash`
-   `Fnv1a64Structural`). Printed on the `[floor-phase]` line, so the receipt says WHICH content
-   was carried, not merely that something was.
-5. Bind (fn node → carried `Value`) for the run's prepared subject, cleared with the tier by
-   `clear_cross_claim_pure_memos`.
-
-Then, for each `CarriedInputWarmRow`, warm the producer with a ONE-ELEMENT argument row
-`[(parameter, carried value)]` instead of `[]`. Everything downstream is the existing mechanism
-untouched: the store keys on (producer fn node, portable argument row) and serves only after the
-full portable argument row verifies structurally equal.
-
-### What a claim does
-
-- A claim's call of the ACQUISITION declaration is served the carried value instead of
-  re-dispatching the read. This is the only genuinely new serve path, and it is deliberately NOT
-  the pure memo: the pure memo refuses any call that dispatched an effect (`effect_dispatch_count`
-  guard), and that refusal is correct and stays. Admission here is a separate, roster-declared
-  binding keyed on resolved fn-node identity, installed for one prepared subject.
-- A claim's call of the PRODUCER passes the same value it just received, so the portable argument
-  row equals the one preparation stored, and the existing cross-claim tier serves it — no new
-  keying, no new retention, no new lookup rule.
-
-### Why content identity is not a new mechanism
-
-The carried value IS the key material: a changed carrier content produces a different portable
-argument row, `cross_claim_portable_args_match` fails, and the claim recomputes. Stale serve is
-therefore unwritable rather than guarded — the §5 preference for construction over validation.
-Roster identity is the resolved fn node on both halves (acquisition and producer), so the
-bare-name homonym class stays closed exactly as review 57446 closed it.
-
-## Refusal arms (never an empty default)
-
-| state | disposition |
-|---|---|
-| acquisition module outside the prepared subject | `PreparedEffectInputModuleOutsideSubject` — line stop |
-| acquisition spelling resolves to no declaration | `PreparedEffectInputUnresolved` — line stop |
-| acquisition declaration is not nullary | `PreparedEffectInputNotNullary` — line stop |
-| acquisition evaluation errors (read refused, hermetic refusal, parse error in the fold) | `PreparedEffectInputAcquisitionFailed` — line stop, carrying the interpreter's own located error |
-| acquired value fails total reification | `PreparedEffectInputNotPortable` — line stop, with the located path/kind from the refusal itself |
-| carried-input warm row naming an unknown input | `CarriedInputWarmRowInputUnknown` — line stop |
-| warm evaluates but the store refuses it | the existing `PureProducerShareWarmNotStored` — line stop |
-
-One arm is deliberately NOT a floor refusal, and it is the one worth arguing about: when the
-acquisition SUCCEEDS and returns its domain type's own refusal arm (here
-`RoadmapAcceptanceEventHistoryLoadRefused`), the floor carries that value faithfully and every
-claim receives the identical typed refusal it would have computed for itself. The floor does not
-read domain types and must not decide that one variant of a caller's coproduct means "stop". The
-alternative — the floor stopping the line on a refusal arm — would require the floor to know
-`gunbc.roadmap_authority`'s vocabulary, which is the layer inversion §3 forbids. Stated here as a
-deliberate divergence so it is decided rather than discovered.
-
-## Home in the materialization domain (§3b), and one stated divergence
-
-This inhabits the materialization / carried-value home: a computation identity (the resolved
-declaration) joined to declared inputs (the carried value's content digest), a provider whose
-scope reaches the demands' least common visible ancestor (preparation, which is the LCA of the
-seven claims), a key representing every declared input the result depends on, and retention
-spanning exactly the obligated lifetime (one prepared floor run). §2's ordering is respected in
-the direction it demands: the demand graph is minimized FIRST — the repetition is authored
-duplication whose shared-state ancestor is preparation, so the repair is the CARRY, and the
-existing cross-claim tier is merely where the carried value is held.
-
-The divergence, stated: this does not mint a new `std.materialization_provider.ArtifactRequest`
-variant. `ArtifactRequest` keys durable, cross-run artifacts by identity digest with a realization
-receipt naming the provider; the carried input is an in-process value bound for the lifetime of
-one prepared subject, with no store, no path, and no cross-run reuse. Minting a variant there
-would put a run-scoped binding into the durable-artifact algebra. If the reviewers read that the
-other way, the alternative is a real one and this is the decision to take before code.
-
-## Evidence
-
-### Executed at fixture grain, through the real `install_pure_producer_share` path
-
-`cargo test --release -p v1-compiler --lib pure_producer_share` — 17 passed, 0 failed. Five of
-them are this change's:
-
-- the input is acquired ONCE and its producer warmed over it, with the producer then SERVED
-  (asserted from the tier's hit observer, not from the value);
-- **the discriminating RED**: a changed carrier content is not served the value derived from the
-  old one. Discrimination receipt — with `cross_claim_key_args` returning `None` (the
-  empty-argument-row implementation this control targets), this test FAILS; with the real
-  implementation all 17 pass;
-- the prepared-input binding is absent after the tier is cleared, and the producer answers for
-  itself again;
-- a carried row naming an input nobody prepares stops the line;
-- a non-nullary acquisition is refused.
-
-### Still owed at live grain (stated as owed, not as done)
-
-## Evidence plan (the live arm)
-
-1. **Identical verdict.** The seven required-lane claims plus #10994's forecast witness produce
-   the same verdicts with the rows enrolled as without. A carry that changes a verdict is a
-   defect, not a speedup.
-2. **Present-vs-absent, per row, on one tree.** Two `workflow_dispatch` runs on a branch ref
-   pinned to an exact sha (the corrected instrument recorded in the roster header: a pushed side
-   branch triggers nothing, and a PR pair measures two different merge refs), reading
-   `required_floor_claim_cost.tsv` and the `[floor-shared-fill]` ledger. Admission is
-   serve-below-recompute at identity grain; a row that does not clear it is withdrawn into
-   `floor_cross_claim_refused_candidates` rather than defended by a family aggregate.
-3. **No stale serve (the discriminating RED).** A control that mutates the carrier's content and
-   shows the previously carried value is NOT served: the portable argument row differs, the
-   producer recomputes, and the verdict follows the new content. Red goes green only by the key
-   actually carrying content identity — an entry keyed on the empty argument row passes the happy
-   path and fails this control.
-4. **Acquisition is dispatched once.** The effect-dispatch count over a floor run is 1 for the
-   carrier read with the rows enrolled, N without.
diff --git a/docs/plans/printed-chassis-program.md b/docs/plans/printed-chassis-program.md
deleted file mode 100644
index a26aead8415..00000000000
--- a/docs/plans/printed-chassis-program.md
+++ /dev/null
@@ -1,1363 +0,0 @@
-**Current execution queue:** [CAS-1–CAS-7](cassette-completion-tasks.md) tracks shared profiles, height-related rear cooling, integrated stacking, power/harness placement, qualification and print release.
-
-**Unified multi-platform design, 4 October 2026:** [cassette profiles and consolidation](cassette-platforms.md) defines one shared design for ALTRAD8UD, GH200 P4261, Mt. Collins and Mt. Jade. New platforms retain their native power/management assemblies where appropriate; no copied board-specific tray generators.
-
-# Printed node chassis — program plan
-
-**Current review: 4 October 2026.** The operator requested fewer screws and faster assembly.
-Revision 06 uses 17 printed pieces, four tray clamps, six fan/guard bolts and five broad-grip
-retaining pins. See [cassette joinery review](cassette-joinery-review.md). Earlier counts below
-are dated history. No further gauge sequence or cassette print is scheduled by this review.
-
-**Pinned plan. Progress reconciled 2026-10-03.** Printers are in use; the operator has the
-printed standoff gauge in hand. The operator reports that the existing gauge aligns with numbered holes 1 and 3.
-
-## Current progress — 2026-10-03
-
-Evidence: merged PRINT-N commit `b242faf7655` (#10680), current printed-chassis modules,
-and the operator's 2026-10-03 report. Historical execution results are not tests rerun today.
-This dated status supersedes the pre-arrival implementation narrative below.
-
-- **CAD bootstrap and measured export profile landed.** PRINT-N records CadQuery 2.8.0 running
-  through user-owned micromamba/conda-forge and measured tessellation observations in
-  `product.printed_chassis.export_profile`. The old kernel blocker is resolved. Full STEP/3MF
-  solid-readback acceptance is not established by that fact and remains to be audited.
-- **Physical printing reached.** PRINT-N records printer-02 reporting `RUNNING` on the gauge
-  project after FTPS delivery and MQTT start through the modeled path. The operator now confirms
-  the gauge is in hand. No authenticated printer operation has been performed in this session.
-- **Coupon feedback recorded.** `hole_fit_measurement.operator_ladder_reading_2026_09_04`
-  records M3 interference / tight / free at 3.00 / 3.10 / 3.20 mm nominal rungs. Printer attribution
-  remains absent; this is not universal hole compensation or qualification of both machines.
-- **Initial pair fit observed, 2026-10-03.** The operator reports that both gauge holes align
-  perfectly with numbered holes **1 and 3**, with the gauge underneath the motherboard and no
-  screws installed. The supplied annotated image identifies these as **F and C**. This is an
-  operator-reported alignment pass on that pair; it does not establish loaded support, exact
-  tolerances, the other holes or the full FIT milestone. One board is sufficient for this check.
-
-### Numbered reference and observed pair
-
-The repo already cited the operator's Drive image in
-`extdeps.boards.asrock_rack.asrock_altrad8ud_standoff_figure_authority`. A byte-for-byte local copy
-is now [ALTRAD8UD_standoff_grid.png](../extdeps/asrock_rack/ALTRAD8UD_standoff_grid.png), retrieved
-2026-10-03 from [the original Drive file](https://drive.google.com/file/d/1z36tmUWAwOwXWy6ASmaPWJNzKoZggBs8/view).
-Use the image's numbers in operator instructions. Its annotated decimal coordinates are a visual
-reference; they do not replace the standard's exact coordinate authority.
-
-| Image hole | Model location |
-|---|---|
-| 1 | F |
-| 2 | M |
-| 3 | C |
-| 4 | H |
-| 5 | L |
-| 6 | B |
-| 7 | R |
-
-**Observed:** 1–3 (F–C) aligns simultaneously underneath the board, without fasteners, per operator.
-**Next candidate:** 3–4 (C–H). Other prepared checks are 4–5, 5–2, 3–6 and 4–7.
-No new photo is required to identify the pair already reported against this reference.
-
-### Prepared follow-on experiments — 2026-10-03
-
-`product.printed_chassis.fit_gauges` selects five additional gauges using the existing standard
-location authority, gauge admission and CadQuery emitter. They are spacing experiments, not confirmed
-mounting locations or qualified structural parts. Start with C–H after the existing F–C check passes;
-the others extend coverage to the remaining inferred holes. Each is a separate part so it can be
-identified by its file and labeled before leaving the bed.
-
-| Pair | Question answered |
-|---|---|
-| C–H | Does the rear-to-middle spacing agree on the C/H/L column? |
-| H–L | Does the middle-to-front spacing agree on that column? |
-| L–M | Does the front-row spacing agree? |
-| C–B | Does the additional rear hole agree? |
-| H–R | Does the outboard middle hole agree? |
-
-J remains excluded and S remains unobserved. A connected set of pair distances does not fix every
-relative angle; the assembled adjustable fixture still must confirm the full map. Do not install
-extra standoffs merely because the standard has a named location.
-
-**Measurements to gather before a mounting fixture:**
-
-- Identify the seven candidate holes (F, C, B, H, R, L, M) on one physical board; record any absent
-  or unexpected hole and pair mismatch. No need to disassemble several boards for this step.
-- Actual standoff thread, height from support to board underside, and contact-pad/shoulder diameter;
-  identify the screws being used and their usable engagement. Do not infer these from the M3 coupon.
-- Highest underside protrusion and clearance around each support; note solder joints/components
-  near the front overhang where a possible support would touch.
-- Board edge dimensions and access around rear I/O, memory latches and power/storage connectors.
-
-**Measurements that can follow, before cassette geometry:** cooler model and total installed height;
-PSU model, actual envelope and mounting points; fan model and intended fasteners; intended drives and
-expansion cards; loaded node mass; cable connector bodies and the space needed to plug/unplug them;
-available deployment width/depth/height. Missing values stay open instead of becoming defaults. The current fleet inventory identifies Dynatron W1 coolers on srv3
-and srv4; that does not identify the cooler on the board being checked, and its catalog row supplies
-no measured installed envelope.
-
-**Recovered operator setup reports:** Creality PLA, white on printer-01 and black on printer-02,
-reported September 4–5; on October 3 the operator says both setups are identical. These reports are
-retained in `gunbc.fleet.printer_setup_reports`, with source timestamps and a read-only `main`
-projection. The historical AMS report did not name a printer. The operator explicitly confirmed AMS physical
-slot 1 on both machines on October 3; that now governs the print command.
-Nozzle/plate settings still need reconciliation against retained execution evidence. Recovered files disagree: `print-n/work/gauge_petg.3mf` specifies PETG with
-textured PEI; `printn-slice/gauge_container.3mf` specifies PLA with a cool plate. Preset metadata does not supersede the operator’s filament reports. Do not reuse their machine G-code blindly. Final slicing must also check
-placement including brim/skirt: the longest narrow gauge nearly spans the 180 mm bed. Keep model
-scale at 100%; resolve any placement conflict through explicit orientation/adhesion settings, not
-by shrinking a measuring instrument. The existing fan-mount experiment
-is optional after the actual fan and fasteners are identified; it does not gate motherboard FIT.
-
-### Preparation results — 2026-10-03
-
-Generated **C–B, C–H, H–L, L–M and H–R** as individual STL and STEP files under
-`/home/briansrls/print-prep-2026-10-03`. Generation ran through `fit_gauges.batch` with the
-compiler built from this worktree; the generated Python contains the modeled geometry and export
-settings. `geometry-readback.json` records hashes and executed results for all five parts:
-valid single solids, expected dimensions and cylindrical hole locations/radii, STEP round-trip
-agreement, closed manifold meshes, mesh bounds and volume agreement. These checks establish file
-conformance for these gauges only, not physical fit or printer/material qualification.
-
-The three `test.claim.fit_gauges_witness_test` checks executed and passed: every candidate fits
-the actual modeled printer envelope; none requests J/S; an unknown pair cannot emit a substitute.
-`witnesses.log` retains the run. No physical observation has been inferred from those software tests; the 1–3 fit is separately
-recorded from the operator above.
-
-**Ready for final slicing, not yet machine-ready G-code:** use C–H as the next candidate after the
-existing F–C result. Use the recovered PLA reports; reconcile nozzle, plate and adhesion settings before
-slicing. No upload or printer start was performed. Authenticated delivery/start was not revalidated;
-the old `printer_credential_migration_run` includes destructive secret migration and is not an
-appropriate routine readiness probe. A subsequent print must use an admitted credential path rather
-than rerun that migration merely because it previously started a job.
-
-### Requested two-printer batch — 2026-10-03
-
-The operator requests concurrent printing on both printers. Prepare **printer-01: holes 3–4
-(C–H)** and **printer-02: holes 4–5 (H–L)**. This checks two additional board spans; because the
-parts differ, it is not a printer-to-printer calibration comparison. Source-identical STL copies and
-hashes are staged under `/home/briansrls/print-prep-2026-10-03/two-printer-batch/`, one directory per
-printer. Material/colour reports are now modeled: Creality PLA, white on printer-01 and black on
-printer-02. Physical spool identity and current bed-clear state are not established by those reports.
-The selected slicing profile is the A1 mini 0.4 mm nozzle, Generic PLA and Textured PEI plate;
-this is a recorded process choice, not a claim of current printer telemetry.
-The routine workload-identity entry point is implemented in the migration below; its deployment
-remains pending. The operator-token batch route and live progress are recorded separately below.
-No printer start is implied by staging the files. Label the finished gauges 3–4 and 4–5 before removing them.
-
-### Printer authentication migration to the ntfy workflow
-
-The operator requested migration on 2026-10-03. `gunbc.fleet.printer_federation_provision`
-adds a dedicated `printer-lan` reader to the existing ntfy-approved GCP IAM estate. It requests
-access only to the two rostered printer secrets; the print worker cannot create, rotate or delete
-credentials or change IAM policy. The provider pins the repository, main workflow/ref, dispatch
-and `printer-lan` environment through the shared OIDC claim authority.
-
-`fleet-converge` mode `printer` has two operations:
-
-1. `observe` resolves a printer's existing credential once and writes its exact version identity
-   to a receipt. The receipt contains no access code. It performs no printer action.
-2. `print` requires the selected printer, staged project path on srv1, expected SHA-256, numeric
-   credential version and an explicit clear-bed report. It hashes a private copy before upload,
-   uses the same version for FTPS and MQTT, and refuses a workflow rerun. A successful receipt
-   means **start published**, not a claim that the machine reported RUNNING. Unknown outcomes
-   require observation, never automatic replay.
-
-The dedicated job runs on srv1, checks out the dispatch event SHA even if `expected_revision` is
-supplied, and serializes starts per printer without cancelling an in-flight operation. It uses
-`WorkloadIdentityToken`; no operator-token fallback and no destructive credential migration.
-`gunbc.fleet.printer_host_tools.converge` is administrator preparation for the MQTT tool, using
-the existing apt ensure and the tool's declared package. The worker checks the actual client
-version before any upload. Mosquitto identifies its version through the documented `--help`
-interface ([upstream manual](https://mosquitto.org/man/mosquitto_pub-1.html)).
-
-**Deployment standing:** source changes are not evidence of installed IAM grants or a dispatched
-print. The main-pinned workflow must land before it can federate. The existing IAM bootstrap must
-cover the new target resources so its observer can plan and its approved executor can apply those
-resource-local bindings. Then run the shared `gcp_iam_converge` workflow and approve its concrete
-diff through ntfy, prepare the srv1 MQTT tool, and run credential observation. Final sliced projects
-and live printer-state verification remain required before dispatching these gauges. The operator
-reported both beds clear during this session; do not carry that report to an unrelated later print.
-
-Validation: all seven printer workflow binding, admission, tool-version, OIDC, IAM approval and
-start-replay regression tests passed. The canonical artifact gate regenerated the workflow; YAML
-structure assertions and shell syntax checks passed. These are source checks, not live deployment
-or printer observations.
-
-### Operator-token batch execution — 2026-10-03
-
-The operator supplied a one-hour GCP token and asked to print before the migration lands. For this
-batch, `printer_operator_approval.run` uses the existing `OperatorSuppliedToken` capability and the
-shared signed ntfy approval gate. It does not relabel that token as WIF, invent an Actions run, or
-change IAM/secret versions. The permanent main-pinned GitHub route remains separate.
-
-The approval binds printer, project SHA-256, exact credential version and batch attempt. After the
-live approval it subscribes to a fresh report and requires IDLE/FINISH with zero print error, then
-creates a persistent per-printer start marker before upload/start. A refused or ambiguous start is
-never automatically replayed. `printer_report` reads telemetry through the same fleet identity,
-exact credential and pinned CA; its report is current-state evidence, not causal acknowledgement.
-
-Printer-01 credential version 1 was read successfully through the modeled client. Holes 3–4
-were sliced successfully by Orca 2.4.2, with ZIP and embedded G-code checksum checks, one plate,
-identity scaling, 15 layers/3 mm height, and bounds including the brim within 180 mm. Selected
-settings: PLA, 220 °C nozzle, 65 °C textured bed, 0.20 mm layers, 2 mm outer brim. Estimated
-19m22s and 6.99 g. Project SHA-256:
-`28a8700489cf908edb9ed59c0aa871fe6903b4d558c3b64de6a7636af701580e`.
-
-The isolated srv1 execution directory is `/home/briansrls/print-run-2026-10-03`; credentials live
-only in owner-only private staging files and are not repository artifacts. Holes 4–5 also sliced
-and passed the same checks: 15 layers, 13m48s, 3.67 g, SHA-256
-`a8f434e80014b6a316d30665b372bd0df3e858a68a2ff04a5fe4f50031d68535`.
-
-The shared approval client now follows the declared writer cutover to the approval broker on
-8085; the old roadmap endpoint refused writes as designed. Both requests were filed and reached
-approval polling. Four operator-route witnesses passed, including all three writer postures.
-Fresh read-only reports showed printer-01 IDLE/error 0 and printer-02 IDLE/error 83902511.
-Both reported PLA in AMS tray 0 (physical slot 1), while the existing start command selects the
-external spool. The initial executions were stopped before upload to resolve that mismatch.
-No start marker, physical start, or RUNNING observation was claimed at that point.
-
-### Local preparation environment
-
-The isolated worktree is `/home/briansrls/.worktrees/gunbc/3d-printing-2026-10-03`.
-Local preparation artifacts are in `/home/briansrls/print-prep-2026-10-03`:
-
-- `venv/`: CadQuery 2.8.0; resolved dependency versions in `requirements.lock`.
-- `target/debug/gunbc`: compiler built from this worktree. Invocation requires an enforced cgroup
-  memory budget; the preparation run uses a systemd scope with `MemoryMax=24G` and no swap.
-- `mounting-check-map.svg`: schematic from the checked-out standard-location rows; all physical
-  correspondences remain subject to the bench check.
-- `verify-generated-gauges.py`: reads the emitted literal geometry instructions, runs them in
-  CadQuery, checks the resulting solid and STEP round-trip dimensions/hole axes/volume, and checks
-  STL bounds, closed manifold edges and volume. Its result only concerns generated-file conformance.
-- `slicer-probe/DO_NOT_PRINT_old_settings.3mf`: tool-recovery probe using the old project settings;
-  deliberately excluded from the next-print candidates.
-
-The preserved OrcaSlicer 2.4.2 AppImage at `/tmp/orca.AppImage` matches the digest recorded in
-`extdeps.printing.orca_slicer`. Its extracted CLI at `/tmp/orcax/squashfs-root/AppRun` now launches
-after installing its missing OpenGL/WebKitGTK runtime dependencies. `--help` and model inspection
-work. The modeled probe now uses the supported `--help` interface. `with_verified_orca` copies
-and hashes the pinned AppImage in a private realization, runs probe and slice inside its callback,
-and removes the realization before returning. `slice_run.run` uses it to produce the gauge project;
-its success establishes slicing, not an observed physical print.
-
-### Gauge observations to collect today
-
-Record each board separately: stable label, model/revision, selected holes and gauge orientation.
-The gauge checks **LocF–LocC**, modeled as offsets of **157.48 mm along the rear edge and
-22.86 mm in depth**. These are model values, not measured dimensions of the printed part.
-Establish the physical hole correspondence before interpreting a result; say whether checking board
-holes directly or installed standoffs, since the latter also tests standoff placement.
-
-Report whether both locations align simultaneously with the gauge resting naturally; if not,
-which end aligns and the direction of the miss. Note obstructions or warp. Do not count alignment
-obtained by bending the gauge or drawing it into place with screws as a pass. Record measured
-values only when actually measured, with the instrument used. A photo can supplement the result.
-An F–C pass supports that pair on that board, not the full mounting map or underside clearance.
-
-### Next steps and dependencies
-
-| Order | Work | Dependency / completion evidence |
-|---|---|---|
-| 1 | Record each board's F–C result | Operator observations; retain disagreements and distinguish board-hole alignment from standoff fit |
-| 2 | Resolve misses; extend successful checks to remaining mounting locations | For a miss, distinguish orientation, printed-gauge dimensions and board/standoff placement before changing geometry. A pass permits additional pair gauges or an adjustable fixture, not freezing the entire map |
-| 3 | Audit CAD, slicing and print evidence | Can proceed during board checks: locate generated artifacts, profile/toolchain identity, printer/material/nozzle binding and outstanding solid-readback controls; close PRINT-7/8 only against their full criteria |
-| 4 | Complete process observations | Attribute the existing coupon only from retained evidence; otherwise print labeled replacements. Observe both printer/spool combinations independently and repeat attempts before claiming repeatability |
-| 5 | Build an unpowered adjustable fit fixture | Confirm remaining mounting positions, standoff thread/height, underside keep-outs and connector access. PLA can serve this experiment without qualifying structural or powered use |
-| 6 | Measure cassette inputs and choose joints/material | Can start now: actual cooler and PSU envelopes, node mass, drive requirement, fasteners, connector access and cable service space. Joint family and structural material precede their qualification prints |
-| 7 | Prototype one removable cassette and one fixed bay | Requires fit and structural-process evidence; then PSU/cables, airflow and powered thermal validation under standing requirements, followed by 2x2 service demonstration |
-
-The immediate milestone is a verified mounting map and an unpowered fit fixture. Full cassette
-geometry depends on measured hardware envelopes and structural-process qualification.
-
-
-Governing statement:
-
-> Build a low-cost, space-efficient, thermally intentional system of independently removable
-> ALTRAD8UD-1L2T server cartridges, using small-format printers for the custom geometry and
-> conventional materials only where they are structurally superior.
-
-The experiment succeeds when the model produces real printer artifacts, a board fits, a node runs, a
-middle node is removable without disturbing neighbours, and the cost/space/thermal receipts decide
-whether more printers are worth buying.
-
-## Original motivations (the spine — every decision answers to these)
-
-1. Cheaper than commodity chassis.
-2. More space-efficient — this is not a storage chassis.
-3. Deliberately directed airflow, not a case shaped for a different machine.
-4. Forcing pressure on the spatial/fabrication model. This is a first-class goal, not a side effect.
-
-## Fixed facts
-
-| Fact | Value | Authority |
-|---|---|---|
-| Node subject | ASRock Rack ALTRAD8UD-1L2T | `extdeps.boards.asrock_rack` |
-| Board outline | 267 x 244 mm | vendor manual §1.4, read first-party |
-| Intended nodes | 8 (srv1-4 + 4 inbound) | operator |
-| Printers | 2 x Bambu Lab A1 mini, scaling to N | operator order relay |
-| Build volume | 180 x 180 x 180 mm | A1 mini spec table, operator relay |
-| Fan form factor | 80 mm; **count derived**, not assumed | operator + derivation |
-| Rack unit | 2x2 block, composable | side-chat ruling |
-| Operator effort | Research component masses online; use explicit model/BOM ranges where needed. Do not request weighing or hardware disassembly for mass inputs. | operator direction, 4 October 2026; [mass assumptions](milk-crate-stack-design.md#mass-is-a-fold-over-components) |
-| Service law | Integrated corner-column stack; proposed temporary supports permit target-only removal, otherwise LIFO (4 October 2026, superseding R9) | operator ruling, [milk-crate stack design](milk-crate-stack-design.md) |
-| PSU placement | independent power cassettes assigned to node groups by usable wattage, port count and interface compatibility; mains stays in power cassettes (4 October 2026; supersedes one-per-column allocation) | operator ruling, [milk-crate stack design](milk-crate-stack-design.md) |
-| External bundle | 2 x Ethernet + 1 x protected, isolatable DC feed per node; AC at shared supply | operator acceptance, 4 October 2026 |
-
-## Standing laws
-
-- **Missing physical input policy: refuse.** No default, no nominal catalogue figure, no nearby standard.
-- **Hidden CAD geometry authority: refuse.** The model owns dimensions *and* geometry-selection laws.
-- **Printed polymer is never the mains enclosure and never a conductor in either grounding network.** Protective earth is bolted to metal and survives every removal the design invites; the board-to-chassis bond is functional only.
-- **MVP thermal fixture choice carries no authority over deployment layout.** Using the 4U cooler
-  first to reduce thermal uncertainty must not silently become the rack pitch.
-- **Bay pitch derives from measured millimetres.** "2U" and "4U" are catalogue labels, not lengths.
-
-
-## The numbered spine — PRINT-0 .. PRINT-15
-
-The six projects are the working-memory units; these are the executable steps. Zero-indexed per the
-RLM-N / MEMORY-0 convention already used in this directory. Each step names its terminal evidence,
-because a step without one cannot be said to be done.
-
-| Step | Project | Terminal evidence | State |
-|---|---|---|---|
-| **PRINT-0** | MEASURE | Board outline typed from the vendor manual (243.840 x 266.700 mm exact, axes corrected); micro-ATX lettered grid under its own standard authority; standoff placement derived from per-location evidence standings | **done** |
-| **PRINT-1** | TOOLCHAIN | Build envelope, filament classes, slicer platform claims as separate authorities, **and a concrete A1 mini product row that the coupon fit witness consumes** | **done** (binding mutation-verified) |
-| **PRINT-2** | MEASURE | Measurement authority: absent refuses, duplicate-key conflict refuses, precision budget enforced | **done** |
-| **PRINT-3** | CAL | Coupon authority: ladder as modeled experimental design, rungs and plate derived | **done** |
-| **PRINT-4** | TOOLCHAIN | Realization contract v0: contract derives its own rungs; a wrong-step handler is caught and located | **done** |
-| **PRINT-5** | TOOLCHAIN | Raw transport schema admission: unknown version, missing field and unknown operation all refuse before any geometry call | **done** |
-| **PRINT-6** | TOOLCHAIN | CadQuery handler + authority wall; sealed instruction plan; walls 1-3 execute, wall 4 (solid readback) is a declared boundary | handler/export profile landed; full readback closure unverified |
-| **PRINT-7** | TOOLCHAIN | STEP/3MF emitted and re-inspected; output conformance re-establishes envelope, holes, walls | kernel blocker resolved; full acceptance to verify |
-| **PRINT-8** | TOOLCHAIN | Slicer profile bound or refused; per-printer manifests; ProcessQualificationIdentity minted, not branded | live printing exercised; qualification closure to verify |
-| **PRINT-9** | CAL | Coupons printed on BOTH printers; each printer+spool admitted or refused **independently** | coupon feedback recorded; independent qualification and repeatability pending |
-| **PRINT-10** | FIT | Adjustable-standoff fixture; real board mounted unpowered; hole map measured back and frozen | gauge in hand; 1–3 (F–C) alignment pass reported; full fixture/map open |
-| **PRINT-11** | CASSETTE | Structural cassette: rails, tray, handle, latch; carries node mass; no seam in layer-separation tension | needs PETG decision |
-| **PRINT-12** | CASSETTE | Shared fixed-frame PSU/distribution and node harnesses; every connector insertable; nothing side-loaded; **PE continuous with board, standoffs and cassette all removed** | needs PSU envelope |
-| **PRINT-13** | CASSETTE | 80 mm fan carrier + replaceable duct; powered thermal admitted against a bench baseline | needs cooler choice |
-| **PRINT-14** | RACK | One fixed bay; cassette retained in service, removable after disconnect; empty bay structurally complete | |
-| **PRINT-15** | RACK | Management-node mount (Raspberry-Pi class) on the rack, carried as a bay peer rather than an accessory | |
-| **PRINT-16** | RACK | 2x2 block; an enclosed node extracted with neighbours untouched | |
-| **PRINT-17** | VERDICT | Cost, volume, print hours, labour, reprint rate, thermal, service time -> buy-more-printers decision | |
-
-**THE SEQUENCE IS INTEGERS, AND AN EARLIER REVISION BROKE THAT.** It carried PRINT-11b and PRINT-13b
-while still calling itself N = 15, so the spine had two numbering authorities at once and the count
-was wrong. Letter suffixes were how cable routing and the management mount got appended as
-afterthoughts instead of being placed. Renumbered; new work takes the next integer.
-
-**CABLE ROUTING IS NOT A STEP.** The operator's requirement is routing at EVERY controlled layer, so
-it is a property each cassette and rack step must satisfy to be called done, not one step of its own.
-It was PRINT-11b, which was exactly the bolt-on that requirement forbids. Every step from PRINT-11
-onward now carries the cable obligation in its own terminal evidence: endpoints, bend and service
-volume, clip positions, strain relief, moving-versus-fixed classification, and declared separation
-from blades and hot surfaces.
-
-**N = 17.** PRINT-0 through PRINT-6 are landed and executing. PRINT-1's reopening is CLOSED: the
-build envelope is owned by `extdeps.printing.bambu_lab_a1_mini` and the coupon fit witness reads
-`a1_mini_build_envelope` rather than an inline literal. That was verified by MUTATION rather than by
-reading the import — shrinking the product row's x from 180 mm to 50 mm flips
-`w_the_hole_ladder_coupon_fits_the_a1_mini` from green to red, so the binding is live and not
-nominal. The check was run because the module's own annotation asserted "changing this row is what
-moves that witness", and an annotation asserting a property the code does not have is exactly what
-#10119 had to repair four times.
-
-PRINT-5 and PRINT-6 landed with #10119. PRINT-N (#10680) subsequently resolved CAD bootstrap,
-added measured export-profile work, and exercised physical printing. PRINT-7/8 still require an
-evidence audit against their full criteria; job-start evidence alone does not close them.
-
-### What blocks what
-
-- **CAD bootstrap is resolved.** Full output-conformance and process-qualification evidence
-  remain to be reconciled.
-- **Joint family** (dovetail / tongue-and-groove / keyed slide / pin) gates the
-  ProductionInterfaceCoupon only — a later half of PRINT-8, not the MachineProcessCoupon.
-- **Structural material qualification** gates durable/powered cassette work. PLA can carry CAL
-  and unpowered FIT; no PLA-to-PETG receipt carry.
-- **Deployment envelope** gates PRINT-13..14 layout admission, nothing earlier.
-- **Drive count** gates PRINT-11 completion only.
-
-## The six projects
-
-| Project | Scope | Terminal evidence | State |
-|---|---|---|---|
-| **CONTRACT** | Goals, non-goals, authority graph, refusal law, MVP boundary | No assumption represented as a default | deferred — no consumer yet |
-| **MEASURE** | Board, cooler, PSU, fan, DIMM, cable, **deployment envelope**, uncertainty | Pack sufficient to generate CAL+FIT | **partial — coupon readings recorded; board-fit observations pending** |
-| **TOOLCHAIN** | Realization contract, CadQuery handler, authority wall, STEP/3MF, slicer env, printer nodes | Deterministic generation + executed no-parallel-authority controls | partial — CAD/export and live printing exercised; full conformance open |
-| **CAL+FIT** | Coupons, qualified tolerances, adjustable standoff fixture, real-board fit, hole-map feedback | One unpowered board fits; hole authority admitted | in progress — coupon feedback and gauge in hand |
-| **CASSETTE** | Structure -> PSU/cables -> airflow -> powered thermal | Removable node operates and is serviceable | not started |
-| **RACK+VERDICT** | One bay -> 2x2 block -> scale/economics | Middle-node service proven; buy-more-printers verdict | not started |
-
-Consolidation from eleven stages must not collapse the internal gates. CASSETTE keeps
-`structural -> PSU/cable -> airflow -> powered thermal`; RACK+VERDICT keeps
-`single bay -> populated 2x2 -> economic verdict`.
-
-## The CAD authority wall (TOOLCHAIN's load-bearing control)
-
-CadQuery is a **realization handler**. It may map modeled operations to kernel APIs, reorder
-provably-equivalent operations, heal representations, triangulate a determined solid, and implement
-a *modeled* derivation whose identity and inputs the model already fixed.
-
-It may **not** choose dimensions, offsets, clearances, wall thicknesses, radii, chamfers, feature
-presence, hole patterns, joint topology, rib placement, segmentation boundaries, print orientation,
-load-path geometry, duct path or cross-section, fallback values, or one construction algorithm over
-another where the physical result differs.
-
-A numeric-literal scan is **necessary but insufficient** — `fillet()` vs `chamfer()` carries no
-literal. The wall is four-part:
-
-- **A. Geometry-taint dataflow.** Any expression reaching a geometry-affecting call derives only
-  from the typed contract, a modeled operation, or a proved non-semantic toolchain constant.
-- **B. No-default completeness.** Unknown feature kinds, missing fields, unsupported derivations and
-  schema skew all refuse. No Python defaults for geometry-affecting fields.
-- **C. Realization trace.** Every realized feature maps to one modeled source; no unmodeled feature.
-- **D. Output conformance.** Re-inspect the emitted STEP/3MF for envelope, hole centres, wall
-  thickness, mating dimensions, clearances, build-envelope fit, collision/extraction envelopes.
-
-**Negative control:** hard-code a plausible wall thickness in the handler and prove the wall rejects
-it while the part still looks valid. A wall that never flips is a decoration.
-
-Duct curvature is the boundary case: inlet + outlet + envelope + airflow obligation do **not**
-determine a duct. The model must fix the family and the selection law (centerline derivation,
-minimum bend radius, wall thickness, transition rule); the handler may implement that law and may
-not choose it.
-
-## Landed so far
-
-- `extdeps.boards.asrock_rack` — typed 243840 x 266700 um outline, first-party manual read. The
-  extents are NOMINAL: `asrock_altrad8ud_board_depth_nominal_exact` is the exact ARITHMETIC
-  conversion of the vendor's published 9.6 x 10.5 in, not the as-built extent of any board here, and
-  the rename exists to stop "exact" being read as zero physical tolerance by a clearance derivation.
-  Mounting holes are a standard-location correspondence with a per-location standing, so an inferred
-  hole and a physically confirmed one are different facts; `asrock_altrad8ud_open_mounting_unknowns`
-  carries the five unmeasured ones with their discharge instrument.
-- `extdeps.standards.micro_atx` — the nine microATX mounting locations own their own authority
-  rather than sitting inside the ATX 2.2 module, which now carries only ATX 2.2 facts. Coordinate
-  provenance is `OperatorRelayedDocument` from the shared `DimensionEvidence` carrier, not a prose
-  string: a citation STATUS is a typed fact, and the string form was a nickname nothing could consume.
-  **One structural over-claim is recorded and deliberately not half-fixed** — `extdeps_model_scope`
-  cites the archived ATX 2.2 PDF as `first_citation` for the microATX locations, a machine-readable
-  claim the provenance row denies, because this session's extraction recovered that PDF's text layer
-  and not its mounting-location artwork. No microATX document is in hand, so the repair needs a
-  first-party read or an `ExternalAuthority` arm that can carry a relayed-with-no-document chain;
-  both are named as triggers rather than guessed at.
-- `extdeps.printing.bambu_lab_a1_mini` — the printer as a PRODUCT ROW: build envelope, nozzle
-  diameters, filament diameter, temperature ceilings, input voltage and frequency range, machine
-  extents, and a ten-row material suitability roster. The fit witness reads the envelope from here
-  instead of a literal it wrote itself, so it goes red if the printer authority vanishes.
-- `extdeps.vendor.bambu_lab`, `extdeps.printing.fdm` — agnostic FDM shapes; build-envelope fit that
-  reports every exceeded axis and never searches orientations.
-- `extdeps.printing.bambu_studio` — spec-sheet and release-artifact platform claims carried as two
-  authorities; the Linux disagreement modeled, not resolved.
-- `product.printed_chassis.measurement` — SPATIAL-1 binding; absent refuses, duplicate-key conflict
-  refuses with no precision or recency tie-break. Six witnesses green, two proven to flip.
-- Compile-clean: 0 blocking errors in these files; the 57 remaining are pre-existing on main.
-- `product.printed_chassis.coupon` — **TOOLCHAIN v0's first consumer.** The hole-diameter ladder as a
-  modeled experimental design: base, step and rung count are authored, every rung and the plate width
-  are DERIVED. `PlateDimensions` is its own type so a malformed plate has no zero-extent fallback to
-  return. Micrometre-to-millimetre conversion rounds UP, because truncation reports a 180.5 mm part
-  as fitting a 180 mm machine. Eight witnesses green; the conversion proven to flip in both the
-  arithmetic and the fit path. **V0 is now closed at one operation** (`OpThroughHole`) — see the v0
-  population section for why the second one was deleted rather than kept.
-- `product.printed_chassis.realization_contract` — the transport wall. Raw JSON from the CAD handler
-  is admitted through `decode_envelope`, which refuses an unsupported schema version, an unknown
-  operation kind, and an envelope carrying no operations, each with a typed cause naming what it
-  received. Conformance reports the EARLIEST divergence rather than the last, and a count mismatch is
-  its own outcome rather than a silent zip truncation.
-
-  **It compares WHOLE GEOMETRY, not the whole specimen, and the distinction is load-bearing for
-  PRINT-5.** Compared: plate on three axes, operation count, then every operation field. NOT compared:
-  specimen identity (carried, single-armed), revision (not a compared subject at all), and feature
-  identity — operation *i* is "the *i*-th rung" by LIST POSITION, not by an identity the operation
-  carries. A permutation is refused because position is compared, which is not the same as features
-  having identities, and the difference reappears the moment two features share a geometry. PRINT-5
-  must not read a conforming verdict as adjudicating identity or canonical ordering.
-
-  **The admitted value is unforgeable, and an earlier revision only CLAIMED it was.** That revision
-  put the geometry on the accepted arm (`EnvelopeDecodedV0 { plate, features }`) and argued admission
-  was unavoidable "because the refusal arms have no geometry to hand on" — a correct argument for an
-  insufficient conclusion, since it rules out the raw envelope bypassing the judge and says nothing
-  about a caller bypassing the raw envelope. A probe compiled the forgery from a foreign module.
-  `DecodedRealizationV0` is now `sole_constructor`, so only `decode_envelope` can mint one; a foreign
-  module may name the arm and cannot obtain a value to put in it.
-
-  **That wall now has an executing witness, and the claim that it could not have one was false.**
-  An earlier revision of this plan said the RED was a compile failure and so could not be enrolled in
-  a corpus that must compile, and named an expect-compile-refusal harness as the missing capability.
-  That was DESIGN §4b's own distinction misapplied: a state unauthorable in the ACCEPTED CORPUS may
-  still be perfectly authorable as SOURCE HANDED TO THE COMPILER BY A FIXTURE, and only the second
-  boundary decides whether a check's RED exists. The harness was already here —
-  `gunbc.compile_diagnostic_census`, whose `compile_dag_diagnostic_census` takes source as data and
-  returns either an observed diagnostic population or a typed `CensusNotRunnable`; the seven-form
-  precedent against a sealed fixture type is `test.claim.sole_constructor_completeness_audit_probe_test`.
-  The finding was routed by the side chat, which cited the precedent rather than the claim.
-
-  The witness is `test.claim.printed_chassis_admitted_realization_seal_witness_test`, built on the two
-  forms that module's own annotation names as exact: a count scoped to diagnostic class AND
-  `subject_name`, and a differential between two sources differing on one axis. It carries a red
-  source writing the `DecodedRealizationV0` record literal from a foreign module, a green source with
-  identical imports and no literal, and the red-minus-green subtraction as a third witness so the
-  shared imported closure cancels rather than being asserted away. The `CensusNotRunnable` arm answers
-  `-1`, so every assertion compares against a non-negative quantity and a harness that never ran
-  satisfies nothing — which is exactly the vacancy that produced the near-false-finding below.
-
-  **The refusal payload could carry a success, and the witnesses were where it showed.**
-  `RealizationVerdict`'s refusal arm was typed `RealizationRefusedAtWire { admission: EnvelopeAdmission }`,
-  and `EnvelopeAdmission` includes `EnvelopeDecodedV0`. No route produces that state —
-  `judge_realization` builds the refusal arm only on the three refusing branches — but reachability is
-  not occupancy, and the state was writable. The tell was not in the contract at all: four witnesses
-  carried a dead `EnvelopeDecodedV0 { admitted: _ } => false` arm purely to satisfy exhaustiveness over
-  a case the route cannot produce, which is what a coproduct too wide for its position looks like from
-  the consumer side. The refusal reasons are now their own closed coproduct `EnvelopeRefusal`, and
-  `EnvelopeAdmission = EnvelopeDecodedV0 | EnvelopeRefused { refusal: EnvelopeRefusal }`. The class
-  climbs from mechanically preventable to structurally impossible, and the four dead arms are deleted
-  with it — §4b(4) retires the redundant production handling while every discriminating witness stays
-  enrolled.
-
-  **The trusted-type boundary sat one step early, and the fix turned out to be the name.** The routed
-  review's objection was that the admitted carrier is minted before conformance runs. I pushed back
-  that decode-admitted and contract-conformant are two genuinely different facts and so the *stage*
-  was not wrong. That was true and beside the point: the defect was that an unqualified capability
-  name — "admitted" — was attached to the earlier fact, while it was also the only geometry-bearing
-  value a handler could obtain. Renamed `DecodedRealizationV0`. The stage stayed.
-
-  **What the pushback did surface is a second, real defect, deferred deliberately.** `judge_realization`
-  returns a verdict and no geometry, so a handler must obtain geometry elsewhere and associate it with
-  the verdict itself. That association is unbound: judge envelope A, retain envelope B's decoded
-  geometry, hand B to the handler under A's conforming verdict. Every honest caller passes the same
-  envelope twice and the invalid pairing stays writable — the same class as the refusal payload above,
-  one level out. The close is a second sealed type returned *from* the judgment that established
-  conformance, minted from the contract's own canonical specimen rather than from the transported
-  values that happened to compare equal, so what a handler cuts is the model's geometry and the wire is
-  reduced to an assertion that was checked. `AdmittedRealizationV0` is reserved for it and unspent.
-
-  It is not built in this revision because nothing actuates geometry yet: with no handler the pairing
-  has no site at which to go wrong, and minting a sealed carrier with zero consumers to hold a symbol
-  is what §2 prices as redundant. So it is declared as `realization_v0_open_obligations` — a typed
-  carrier and not an annotation, because PRINT-5 must not be able to reach a handler without answering
-  it, and no `Accepted` program can read a comment.
-
-  **The coupon could not be identified from its own geometry, and the fix is an authority change, not
-  a handler change.** The ladder steps 0.10 mm across eleven rungs, so end to end the holes differ by
-  1 mm and are visually interchangeable; rotated 180° the coupon reads as a valid coupon with its
-  ordinals reversed, and every measurement is attributed to the wrong rung. Routed review found it,
-  and also corrected its own first proposal — one obligation was doing two jobs:
-
-  - **orientation** — which end of *this* coupon is the 3.00 mm end. A property of the canonical
-    geometry, and now discharged by making that geometry asymmetric.
-  - **print-instance attribution** — which printer and spool made *this* piece of plastic. Two
-    correctly-oriented R1 coupons remain interchangeable. No geometry closes this, because the datum
-    must be *identical* on both coupons or the two processes stop sharing a subject. It stays open,
-    routed to the manufacturing manifest and a physical handling route.
-
-  Holding them as one obligation is why the earlier route fold was near-vacuous — a single arm whose
-  RED could not be authored. Splitting is what let one of them close. `HoleDiameterLadderR1` is the
-  coupon *design* identity and never the identity of a printed instance.
-
-  **The datum is its own field, not another entry in the feature list.** Appending one more
-  `OpThroughHole` and remembering the last one is the datum makes "which hole is the datum" a
-  positional convention — the class this module already deleted once — and it is worse here, because
-  the datum exists precisely to remove an ambiguous reading. `HoleDiameterCouponGeometry` carries
-  `plate`, a scalar `orientation_datum`, and `ladder_holes`, which makes four things structural: one
-  datum exactly (zero and two are unwritable, not refused), the datum cannot become a twelfth rung,
-  canonical geometry with no datum has no representation, and every consumer must name which
-  population it means. The wire splits the same way — two *different* populations, not two parallel
-  lists of one.
-
-  **The near-miss worth recording is inside the derivation.** A first cut read rung zero's x back off
-  the built feature list to make the correspondence structural. `.first()` returns an option, so it
-  forced an `Absent` arm for a ladder that cannot be empty — and the arm answered with a fabricated
-  datum at the margin. An absorbing fallback in miniature, inside the one function the whole
-  orientation guarantee rests on. It now reads `hole_ladder_margin`, the same row the ladder fold's
-  `i = 0` term reads: one row, two readers, no unreachable branch to fabricate in. The correspondence
-  is asserted by `w_the_datum_is_at_rung_zero` rather than constructed, which is honestly one rung
-  lower — mechanically preventable, not structurally impossible — with the trigger named.
-
-  **Evidence, and it discriminates.** Six controls: canonical datum conforms; datum at the far end
-  refuses naming `FieldCenterX` (the 180° reading itself); datum on the ladder centre-line refuses
-  naming `FieldCenterY` (right x, so it passes only if the y is compared); the datum stays out of the
-  measured population; it clears the ladder band and the plate edge; and it sits at rung zero's x.
-  A mutation that compares the modeled datum against itself turns the two refusal controls **RED**
-  while the positive control stays green — so they discriminate the wall rather than merely
-  exercising it.
-
-  **Probe discipline learned here, recorded because it nearly produced a false finding.** The first
-  forgery probe returned exactly the baseline error count — consistent with "forgery permitted" — from
-  a file the compiler had never read, because an added source root was silently ignored. Confirmation
-  and vacancy produce the same number. Only a deliberate must-fail control in the same file
-  distinguished them.
-
-### PRINT-5 — the handler, and the one thing it does not yet do
-
-The pairing discharge and the CadQuery handler both land: `AdmittedRealizationV0` is sealed and
-minted only inside `judge_realization` from the **canonical** specimen, and `realize_admitted` takes
-that capability and nothing else. Five witnesses green by execution — per-feature trace with the
-datum as a distinct subject, uncentred plate, whole-program equality against a model-rebuilt
-expectation, exact millimetre rendering on odd micrometres, and overtravel moving no measured
-dimension.
-
-**Actuation is registered but NOT materialized, and that is the honest state.**
-`CouponCadQueryProgramArtifact` is a `gunbc.generated_artifact` variant generated through
-`artifact_generate`, and it is `NotCommitted`. Since `main_wet` selects only committed artifacts,
-**nothing writes the `.py` to disk today.** The remaining work is a typed workspace materializer and
-a pinned CadQuery environment; using `main_wet` to keep an actuation claim alive would have been the
-claim outrunning the execution.
-
-The commit-policy question resolved against my first answer. I had registered it
-`CommitRequired { consumer: FabricationToolchain }`, reasoning that `RepoConsumer` already spanned
-more than git and CI. The correction, from review 5095012465: `RepoConsumer` answers the narrower
-question *why must these bytes persist in a git checkout*, and a CAD kernel reading a materialized
-workspace establishes no such requirement — one `FabricationToolchain` arm would have conflated the
-program consumer, the solid consumer, the mesh consumer, the slicer and the printer. The arm becomes
-justified only when a workflow requires an operator to obtain *this file* from a checkout, and then
-it is narrow (`FabricationWorkstationCheckout`) with a receipt.
-
-Committing it had already produced its own evidence: `.gitignore`'s blanket `*.py` swallowed the
-path, so an artifact declared `CommitRequired` could never be committed and the drift gate would
-have read an absent file indefinitely. A derived negation section in `gunbc.gitignore_emit` fixed
-that and has been reverted with the policy — with no such artifact it is machinery whose
-non-vacuity control names a path that no longer exists. **The latent class is real and now
-unwalled**: a `CommitRequired` artifact whose path matches a developer ignore pattern is silently
-uncommittable. Its trigger is the first such artifact; walling it before one exists would be a check
-whose RED is unauthorable.
-
-**Historical pre-PRINT-N state; the measured export profile subsequently landed.** Export was removed from the emitted program rather than profiled. The
-`cq.exporters.export(result, "…stl")` line chose five things the model never stated — STL over STEP
-or 3MF, a filename, a working-directory-relative destination, format-by-extension, and CadQuery's
-default tessellation policy. The last is not neutral: STL is a mesh format, so every modeled circle
-becomes a polygon whose fidelity is set by linear and angular tolerances, and the emitter was
-choosing how round the holes this coupon exists to *measure* come out. The program now builds
-`result` and stops. `CadQueryExportProfile` is a real obligation and is deliberately unauthored:
-with no kernel here its tolerance fields would be literals with no oracle.
-
-**Four defects the review found, three of which my own annotations had asserted away.** `zip_map`
-truncates (`Empty` on either side) while the comment claimed it refuses a length mismatch — the
-third appearance of the positional-parallel-list defect here, and the first where a comment supplied
-the false guarantee; replaced by one row per substitution, which deletes the correspondence. The
-capability wall leaked through `plate_line`/`cut_line`, callable on bare geometry, directly beneath a
-header claiming there was "not even a private one" — the emitters now destructure geometry inside
-the arms of a sealed `CadQueryInstructionV0` that only `cadquery_emission_plan` can mint.
-`AdmittedRealizationV0` had no seal evidence at all while a witness annotation asserted its seal
-held; its red/green/differential battery is now enrolled and green. And the overtravel annotation
-described a doubled-overtravel diff that no body ever performed — the claim is narrowed to what
-executes, with the solid readback recorded as an open obligation.
-
-The discharged `RealizationV0Obligation` vocabulary is deleted. Keeping an empty roster was argued
-on the grounds that it preserves a typed place for the next obligation, but nothing read it — no
-gate required emptiness — so the forcing did not exist, and the discharged property is carried where
-it executes, in the type of the accepting arm.
-
-**Historical bootstrap probe, superseded by PRINT-N conda-forge bootstrap.** Wall 4 — re-reading the produced *solid*
-for plate dimensions, datum location and the eleven ladder holes — is a §4b boundary obligation, not
-a rung. Its trigger was written as "a runner with cadquery importable", which was too vague to act
-on, so it was probed to termination:
-
-- CadQuery **does** install from PyPI on this arm64 container (wheels exist for aarch64); the
-  earlier note that this box has "no CAD kernel" was a missing-bootstrap observation, not an
-  architecture wall. `pip` bootstraps into a venv via `get-pip.py` (the system interpreter is
-  PEP-668 externally-managed, so `--user` refuses).
-- `import cadquery` then fails on **`libGL.so.1`**, which is satisfiable by extracting
-  `libgl1`/`libglx0`/`libglvnd0` plus the X client libs.
-- Past that, `casadi` requires **`GLIBCXX_3.4.32`**, and a libstdc++ carrying it requires
-  **`GLIBC_2.38`**. This container is **glibc 2.36**.
-
-The probe then incorrectly concluded the trigger was **a base image with glibc ≥ 2.38 (or an x86_64 runner), not a pip install** —
-and assembling one by hand-extracting `.deb`s onto `LD_LIBRARY_PATH` is where a probe turns into the
-workaround §5 names, so it was stopped there rather than pushed through. The environment wall 4 needs
-is a *pinned, identified* toolchain — Python version, CadQuery version, OCP closure, image digest,
-install method — which is the same identity the qualification receipt has to carry anyway.
-
-**What this costs tomorrow, stated plainly.** Without wall 4 the physical deviation measured on a
-printed coupon is the sum of model→source, kernel, tessellation, slicer and printer–spool terms, and
-the coupon exists to isolate the last. A print made before wall 4 closes therefore yields operational
-evidence (adhesion, gross scale, obvious defects) and a valid **A-vs-B differential** between the two
-printer–spool pairs — the upstream terms are common-mode across two prints of the same artifact and
-cancel in the comparison — but it **cannot issue an absolute process-qualification receipt** against
-the modeled nominal. Relative comparison survives; absolute qualification does not.
-
-## The two-day cut (printers arrive 2026-09-03)
-
-**Ruling: a CAL-driven vertical slice, not a general framework and not hand-authored coupon CAD.**
-
-```
-CalibrationCouponAuthority -> RealizationContract v0 -> four-part wall
-  -> CadQuery handler -> STEP/3MF conformance -> bound slicer profile
-  -> per-printer-node manifests -> physical coupon observations
-```
-
-The coupon is TOOLCHAIN's first real consumer. Governing rule:
-
-> **Generalize TOOLCHAIN only one consumer ahead.** CAL determines v0; FIT determines the next
-> expansion; CASSETTE the next. A new geometric operation arrives only with taint coverage,
-> refusal behaviour, trace coverage and output conformance.
-
-A wall with no handler is only a rule definition — the geometry-taint arm is not commissioned until
-it observes real geometry calls, passes the lawful ones and rejects mutations.
-
-### v0 operation population (closed; a feature belongs only if a chosen coupon consumes it)
-
-box/prism · cylindrical through-hole · slot · linear or grid repetition · male/female clearance pair ·
-wall or rib · rigid transforms · boolean union and subtraction
-
-**`part/revision datum marking` was in this list and has been REMOVED from it, deliberately.** As
-`OpDatumMark { text, at_x, at_y }` it fixed text and position and left FONT, GLYPH METRICS, STROKE
-WIDTH, ALIGNMENT, ORIENTATION, DEPTH and ENGRAVED-VERSUS-EMBOSSED to the handler — the §3 tell in its
-exact form, the handler choosing geometry the model had not fixed. It had already produced a silent
-falsehood: `specimen_extent` assumed the mark was engraved and so assumed it could not enlarge the
-plate, an assumption stated nowhere and enforced by nothing, and a handler that embossed would make
-the envelope-fit answer wrong in the unsafe direction. Determining it fully means modelling fonts,
-which is a domain rather than a field, imported to label a calibration coupon.
-
-The need behind it is real and is tracked, not dropped: several coupons will exist physically and
-must be told apart by hand. `coupon_v1_physical_identification_obligation` carries it as a V1
-obligation with the route that looks right — identify the coupon by GEOMETRY, a coded through-hole or
-notch pattern, which `OpThroughHole` already determines completely, checked by the same contract the
-holes already pass through.
-
-The ladder itself is a modeled experimental design. "It is only a calibration coupon" is not
-permission for Python to choose test dimensions.
-
-### CAL splits into two coupon classes
-
-- **`MachineProcessCoupon`** — X/Y deviation, hole and slot deviation, sliding clearance, thin wall
-  and rib, orientation anisotropy, first-layer behaviour, repeated-feature consistency. Depends on
-  **no** server or site measurement. This is the first print.
-- **`ProductionInterfaceCoupon`** — the exact joint family, insert/captive-nut geometry, fastener
-  clearance, rail fit. Needs no server dimensions but **does** need the joint family and purchased
-  hardware identities chosen. Do not invent an M3 pocket or dovetail angle to populate it.
-
-### The slicer is a SECOND authority boundary
-
-Scaling, dimensional compensation, line width, first-layer compensation, wall construction, layer
-height and orientation all change the physical result. A `.3mf` carrying hidden hand-edited
-compensation is as much a parallel authority as a Python literal. Qualification identity:
-
-```
-printer_node x firmware x material_product x material_spool x installed_nozzle
-  x slicer_identity x slicer_profile x orientation x support_policy
-  x coupon_revision x calibration_epoch
-```
-
-### Wall commissioning needs four negative controls, not one
-
-1. **Numeric/dataflow** — a plausible Python-derived wall thickness. Taint must reject.
-2. **Nonnumeric topology** — a fillet, chamfer or extra rib with no modeled feature identity. Trace
-   or taint must reject.
-3. **Default** — omit a required contract field and let a helper default take over. Completeness
-   must reject.
-4. **Output** — alter an exported hole or envelope after lawful realization. Conformance must reject.
-
-### Material: PLA does not carry to PETG
-
-No PLA-to-PETG receipt carry. Distinct admissions:
-`ToolchainSmokeAdmitted` · `FitPrototypeProcessQualified` · `StructuralProcessQualified` ·
-`ThermalServiceQualified`.
-
-So the PETG decision blocks the **durable/powered CASSETTE path**, not the first CAL print or the
-unpowered FIT fixture. Qualify each printer-spool combination independently; never infer that an
-observed difference is the printer alone.
-
-## Open decisions (operator) — structural and rack work
-
-- **Drive count** — a CASSETTE completion obligation. Does not block gauge checks or the unpowered fixture.
-- **PETG** — blocks structural/powered parts, not CAL or unpowered FIT.
-- **Deployment envelope** — **not on the pre-arrival critical path.** Its absence must refuse
-  rack-layout admission later, not block calibration now.
-
-## Next
-
-Follow the dated next-step table above. Board-specific gauge observations and remaining mounting
-checks lead to the unpowered fixture; toolchain-evidence reconciliation and cassette measurements
-can proceed independently. The former list predated the landed PRINT-N implementation.
-
-**Deferred as definition-only residue until each has a consumer:** `CONTRACT` (needs the generator),
-`DeploymentEnvelope` (needs the layout-comparison consumer). The design of both is pinned above.
-
-## Supply identity — RULED, and it unblocks the filament slice
-
-The open question was whether a spool is an inventory **lot** or a **PhysicalAsset instance**. Ruled:
-**one supply instance per physical spool, allocated at durable physical individuation, each retaining
-its source procurement lot.** The dependency runs one way only —
-
-```
-identity makes a later divergence attributable
-NOT: a later divergence earns the object an identity
-```
-
-so the two day-one spools are separate instances *before* either print begins, even though they came
-from one order, name one catalog product, and have no known difference. Waiting for measured
-divergence would leave the first divergence with nowhere truthful to live.
-
-Grains stay distinct rather than collapsing onto the lot: catalog product (what was sold),
-manufacturer batch (what the maker says), procurement lot (what was bought), supply instance (which
-spool fed this print), condition observation (instance x time). **One order is not one material
-batch** — `ProcurementLotIdentity` and manufacturer batch standing stay independent, since one order
-may span two production batches and two orders may share one. Moisture at print time is an
-instance-and-time observation; a drying cycle mints a new condition observation, never a new spool
-identity.
-
-RFID and operator label are both **evidence routes, not identity kinds**. They may coexist; an RFID
-read failure does not create a different spool, replacing a label does not create a different spool,
-and disagreement must refuse the attribution rather than letting either route silently win. The RFID
-UID is a machine-read manufacturer identifier, not a guaranteed globally unique spool serial, until
-something establishes that.
-
-The lot-to-spool relation must not be authored twice. The existing inventory event already relates
-installed assets to the lot whose stock moved, so day one is one install event per spool with
-`quantity: 1`. The generic rule refuses only when assets *exceed* quantity, which would admit
-`quantity 2, assets [spool_a]`; an attribution-critical supply needs the stronger local law
-`asset count == installed quantity AND the requested asset occurs exactly once`. The admitted supply
-may carry the derived source lot, and must never accept an independently authored `source_lot`
-without comparing it against the event.
-
-Catalog boundary: `PhysicalAsset` requires a catalog `DeclarationRef` while `ProcurementLot` may
-carry an unread catalog standing. Instance-per-spool must not force a fabricated exact filament
-product — where only a package description is known, keep the unresolved standing and limit the
-receipt to an end-to-end observation. Do not point a spool at the `Pla` polymer class as though a
-class were a particular commercial product.
-
-### Correction landed to the printer slice
-
-The manifest annotation said the roster is filled by **reading the serial off each machine**. That
-conflated two states the carrier already distinguishes: `PhysicalAsset.physical_serial` is optional,
-so a printer present on the bench with an unread serial and a printer that has not arrived are
-different facts, and collapsing them would report a machine the operator is standing in front of as
-absent. A row is allocated at receipt and durable individuation — an operator-applied label suffices
-— and the serial **corroborates** that binding rather than establishing it. If a serial is ever
-required before attribution, that is an admission refusal arm, visible and countable, never silence.
-
-### Two coupons per machine is two attempts, not two objects on one plate
-
-`A1/B1` then `A2/B2`, each pair consuming the same machine artifact, supplies and nozzle unchanged
-and no intervening calibration unless recorded. Two copies printed together answer **within-job /
-bed-position** variation; two executions answer **print-to-print** variation. Both are useful and
-they must not share one receipt name.
-
-## On arrival (2026-09-03)
-
-```
-printer setup and identity observation
-  -> same MachineProcessCoupon on each printer
-  -> measure without silently averaging contradictions
-  -> admit or refuse each process identity independently
-  -> derive qualified FIT clearances
-  -> generate adjustable FIT fixture
-  -> mount the real board unpowered
-```
-
-The duplicate-measurement repair already has the right semantics for this: lookup refuses
-contradiction. A future adjudication relation may supersede a measurement, but selection must never
-be smuggled into ordinary resolution.
-
-### The bench procedure, in the order it must physically happen
-
-Written out because the ordering is the whole content: two steps here capture facts that **no later
-measurement can reconstruct**, and both are cheap only while the parts are still on the machines.
-
-1. **Label both printers before either is powered on.** A physical label, applied by hand — `A` and
-   `B` is sufficient. This is the durable individuation the roster needs; the identity is allocated
-   here, not derived from anything read later. Record the machine each label went on.
-2. **Label both spools before either is loaded.** Same rule, `PLA-A` / `PLA-B`. Do this while they
-   are still sealed and distinguishable as objects rather than as "the one in the left printer".
-3. **Read the serials, if convenient — and do not wait on them.** The serial *corroborates* the
-   binding made in step 1; it does not establish it. If a serial is unreadable, the printer is still
-   registered. If an RFID tag reads, record it as evidence beside the label, never instead of it.
-   Label and tag disagreeing is a refusal to resolve later, not a coin flip.
-4. **Load spool A into printer A, spool B into printer B, and write down which went where.** This
-   pairing is the treatment variable of the entire experiment. It is not recoverable from the plastic.
-5. **Print the same coupon on both machines, concurrently.** Same generated artifact, same profile,
-   same nozzle. Concurrency matters: it holds ambient conditions roughly fixed across the pair.
-6. **Bind each coupon to its printer and spool BEFORE it leaves the bed.** Write on it, bag it and
-   label the bag, or photograph it in place — any durable mark. **This is the irreversible step.**
-   The two coupons are geometrically identical *by design*, so once both are off their beds and on
-   the same table, nothing measured afterwards can tell them apart. Getting this wrong does not
-   degrade the experiment; it voids it.
-7. **Then repeat as a second attempt: A2 and B2**, same supplies, same nozzle, same profile, no
-   intervening calibration unless it is recorded. A1/B1 versus A2/B2 answers *print-to-print*
-   variation. Two copies on one plate would instead answer *bed-position* variation — a different
-   question with a different receipt name, and conflating them is how a machine difference gets
-   attributed to a corner of a build plate.
-
-What is deliberately **not** on this list: any dimension read off a coupon, any compensation constant,
-any judgement about which machine is better. Those are measurements, and they are all still available
-tomorrow. Steps 1, 2, 4 and 6 are the only ones that expire.
-
-
-## The floor-budget cluster, and why this program did not take the coverage loss
-
-Adding this program's witnesses tipped a rotating subset of ten whole-corpus-reflection claims past
-the floor's 500ms per-claim ceiling — claims that already sat at 415-436ms on main and were already
-`[over-cost]` flagged. Two runs tipped DISJOINT subsets, so there was never a single slow witness to
-chase.
-
-The interim move was to lift those ten off the required floor into `test.claim.long.`, declared as a
-§4b(3) rung drop. That was reverted before it was pushed, and the reason is worth keeping: a child
-lane investigating the cause found `deduplicate_identities` building a COPIED ACCUMULATOR inside a
-quadratic fold, over a population that is the corpus — roughly 16s of the 19s that one reflection
-costs. Rewritten as a set-membership fold it drops the standing to ~4.8s.
-
-So the ceiling was never the problem and the ten witnesses were never really the subject. Taking
-them off the floor would have spent ten executing checks — including the one that EXECUTES the
-compile-phase ratchet — to work around a cost-shape defect that §6 says is always fixed regardless of
-realized n. The fix lands on main ahead of this program, and this program takes no drop.
-
-The transferable rule: when a budget refusal names your change as the trigger, the trigger and the
-cause are different questions. A rotating victim set is the tell that you have found neither.
-
-## Grounding — R14, and why it is TWO networks rather than one path
-
-**Corrected.** An earlier revision of this section said the earth connection is "part of the docking
-interface" and that the earth path runs through the standoffs. That is wrong, and wrong in the
-dangerous direction: it makes the safety path depend on a mechanism whose whole purpose is to be
-disconnected by hand, routinely, by design. The requirement below replaces it.
-
-There are two networks. They serve different purposes, they have different failure consequences, and
-conflating them is what produced the earlier error.
-
-**1. Protective earth (PE) — a safety network, and never load-bearing on anything removable.**
-From the AC inlet's earth pin, through the PSU's own vendor enclosure, to a dedicated bonding point
-on the rack's metal member, and from there to every accessible conductive part. It is bolted, not
-docked. The witness is stated as three simultaneous conditions, because any one of them alone is a
-state the rack will really be in:
-
-> PE continuity holds with the motherboard removed, AND with every motherboard standoff removed, AND
-> with the removable cassette undocked.
-
-If pulling a node can open the earth network, the design is wrong regardless of how good the contact
-is when it is seated.
-
-**2. Board-to-chassis bond — a functional network, for EMI and reference, not for safety.**
-Board mounting hole → metal standoff → cassette metal reference. This one legitimately breaks when
-the board is removed, because that is what it is for. It may be a return and reference path; it may
-never be the reason a chassis surface is safe to touch.
-
-The consequences for the build:
-
-- **Metal standoffs into a metal member.** The hybrid load path already buys aluminium extrusion or
-  threaded rod — that member is the natural bonding conductor and is present for structural reasons
-  anyway. It serves network 2, and is a *bonded branch of* network 1, not a segment of it.
-- **Printed polymer is never a conductor in either network, never the mains enclosure, and never the
-  sole earth path.** The PSU stays in its vendor enclosure.
-- **The docking interface carries no PE obligation.** A dock is a connector; PE is a bolt.
-
-The obligation this creates for MEASURE: the PSU's earth-stud or bonding-screw location, the rack
-member's bonding point, and the standoff material and thread. None is measured yet.
-
-The witness set, written now so the design is falsifiable before anything is printed:
-
-| # | Condition | Required outcome |
-|---|---|---|
-| G1 | Motherboard absent | All accessible rack metal remains PE-bonded |
-| G2 | Every motherboard standoff absent | PE continuity holds |
-| G3 | One cassette extracted | PE continuity holds for the remaining rack |
-| G4 | Board-hole bonding unknown | **No** board-to-chassis bond is claimed |
-| G5 | Any printed polymer segment | Never carries PE continuity |
-
-G4 is the one that is easy to skip: not knowing whether a mounting hole is bonded to board ground is
-a reason to make no claim, not a reason to assume the convenient answer. A dedicated bonding stud,
-conductor, terminal and tested connection are part of the rack design. Incidental contact through
-rails or mounting screws is never the bond.
-
-### The witnesses above are not sufficient, and the gap is a sequencing one
-
-G1-G3 prove that the REMAINING rack stays bonded after something is removed. They say nothing about
-whether the thing that was removed was correctly bonded while it was powered — a cassette can be
-live, unbonded, and still leave a perfectly continuous rack behind it. Two ordering relations close
-that, and both are about the service protocol rather than about geometry:
-
-- **Power admission requires the bond.** `NodePowerAdmitted -> EveryRequiredAccessibleMetalPartPeBonded`.
-  A node may not be energised unless every accessible conductive part it brings is already bonded.
-- **Bond removal requires the power to be gone.** `PeBondMayBeRemoved -> AcDisconnected AND HazardousEnergyAbsent`.
-  The earth connection is the last thing disconnected and the first thing connected.
-
-This is why the bond is a captive bolt in the connect/disconnect sequence even though the docking
-interface carries no PE obligation. "A dock is a connector, PE is a bolt" settles what the MECHANISM
-is; it does not settle WHEN the bolt is made and broken, and the second question is the one that
-decides whether a person servicing a live rack is safe.
-
-### Front-edge support — admitted only under all five conjuncts
-
-The 29.21 mm of board hanging past the last mounting row is a cassette input, not a description. A
-support there is a *candidate*, and it is admitted only when all of the following hold, because each
-one of them independently turns a helpful support into a defect:
-
-1. The underside keep-out at the contact region is known.
-2. The contact region is non-conductive.
-3. The support does not obstruct the extraction path (R-middle-node-removal).
-4. The support actually reacts connector insertion load — otherwise it is decoration.
-5. The support does not become an **unintended electrical bond**, which is where this requirement
-   meets the grounding correction above: a support that quietly bonds the board underside to the
-   cassette creates a path nobody modelled and nobody tests.
-
-## Cable routing — R12, at every layer
-
-Every run gets endpoints, an access envelope, a minimum bend and service allowance, fixed clip
-positions, strain relief, a moving-versus-fixed segment classification, and declared separation from
-fan blades and hot surfaces. The service witness stays structural: after disconnecting the declared
-external bundle and releasing the latch, the extraction path is collision-free and no neighbouring
-cable or node has to move.
-
-**PST changes the fan harness.** The ARCTIC P8 PWM PST carries a 4-pin connector AND a 4-pin socket,
-so fans daisy-chain and fan count is decoupled from the board's five headers. That is a cardinality
-fact only: a chain still owes admission against header continuous and startup current, connector and
-wire rating, maximum chain length, failure isolation, and tach semantics. At the published 0.09 A a
-three-fan chain draws 0.27 A and a five-fan chain 0.45 A steady — neither figure proves a chain safe,
-because the header rating and startup behaviour are unmeasured. Do not assume every chained fan is
-independently observable just because a downstream socket exists; tach forwarding needs manufacturer
-authority or an executed electrical observation.
-
-## The GPU-bearing node — how a card changes the cassette's structure
-
-A node carrying a full-height dual-slot card is a **variant of the node contract**, not a second
-product. What it changes is not "make it bigger": it converts two of the cassette's founding
-assumptions.
-
-**1. Distributed load becomes a concentrated cantilever.** The board is ~1 kg spread over standoffs;
-a dual-slot card is ~1.5-2.5 kg hanging off one slot at one end. The existing standoff model cannot
-carry it, and neither can the PCIe connector. The node needs a **second load termination** — a card
-support spanning to the cassette frame, with the printed part as an alignment pad rather than the
-retention. This is the same law the GPU augmentation program states, arriving inside the chassis:
-*printed parts locate, metal retains.*
-
-**2. The stack load path is sized by the heaviest node, not the average one.** "Remove a node from
-the middle without lifting the others" means every shell carries the stack above it through its own
-sidewalls. A GPU node is the heaviest member, so it sets the sidewall section for **every** node in a
-mixed stack — or the model must carry a per-node mass and refuse a stacking order whose lower
-members cannot carry what is above them. The second is the honest version and it is a real
-refusal the current model cannot express.
-
-**3. One airflow domain becomes two, and the second one exhausts sideways.** The cassette channels
-80 mm fan air across the DIMMs. A blower card pulls its own air and exhausts out the bracket — which
-in an OPEN, stacked chassis discharges into whatever is adjacent, including the intake of the
-neighbouring node. **Inter-node recirculation is a failure mode the single-node airflow model does
-not have.** It forces a declared exhaust destination per node and the rule that one node's exhaust is
-never another's intake — which in practice means a consistent front-intake/rear-exhaust convention
-and a duct from the blower to the rear face, even though the chassis is otherwise open.
-
-**4. Grounding gets materially harder, not incrementally.** The standing requirement is a ground for
-each board. A card bracket normally grounds through a metal chassis; in a printed, insulating
-cassette there is **no such path** unless one is modeled. The GPU does not create this gap, it
-exposes it — the bracket is simply the first component that assumes a conductive chassis and finds
-none.
-
-**5. Service becomes node-scoped.** A mid-stack node must extract with its card, cables and service
-loops intact, so disconnect order and bend volumes become properties of the node, not the rack.
-
-### The modeling consequence, and it is the operator's ruling applied
-
-The shared authority is the **logical** structure — where load goes, where air goes, where fasteners
-and interfaces sit. The **process** is an input to realization, not a fork of the design: PLA wants
-thicker walls and rewards ribs; sheet metal is one folded surface that forbids enclosed ribs and
-bosses and requires a bend radius and relief at every fold; molding wants uniform walls, draft and no
-undercuts. So the process-specific part is **more than thickness**, and the difference must live in a
-realization bound to a `FabricationProcess`, never in a hand-edited second model.
-
-That is the same shape `gunbc.product.printed_chassis.realization_contract` already has for CadQuery,
-and it says the emitter must not be forked per process: one logical model, N bound handlers, STL for
-the printer and DXF for the laser shop derived from **one** source. Forking the emitter per process
-is §3's fused-transport tell exactly.
-
-### Open facts this cannot proceed without
-
-Exact card envelope, mass, slot width and bracket geometry · blower exhaust direction and volume ·
-node pitch (which decides upright versus flat-on-riser, and the riser makes it a cable problem) ·
-aux power connector type and sustained draw against the node supply and stack distribution · whether
-a mixed stack is allowed at all, since a uniform GPU stack and a mixed stack have different sidewall
-answers.
-
-### Batch follow-up: AMS and printer-02 storage
-
-On 2026-10-03 the operator confirmed AMS physical slot 1 on both printers and identified
-printer-02 error 83902511 (0x0500402f) as a microSD error. The operator was unsure whether
-that card was in use. This LAN route uploads to SD storage and starts a `file:///sdcard/`
-project, so the error remains a start blocker; it is not suppressed. No formatting or deletion
-of printer storage is authorized or performed. The start payload now selects AMS and maps
-the single project filament to tray 0; the signed operator request includes this feed choice.
-
-The operator subsequently reported formatting printer-02’s card locally. A fresh no-error
-report is still required before its start. Remote formatting was requested as a future capability;
-the current modeled workflow has no format operation, and support on these printers is unverified.
-
-At 22:01 UTC printer-02's AMS request was approved. Its fresh report admitted IDLE/error 0,
-but FTPS upload returned curl exit 25 / server 550 before MQTT start. Its durable batch marker
-is retained; there is no automatic replay. Printer-01's approved attempt received a partial
-temperature-only report and correctly refused before upload. The observer now allows up to
-eight fresh messages to obtain state and error together, without inventing missing fields.
-
-The operator confirmed that printer-02 recovered and appeared functional after formatting.
-A separate after-format attempt retains the original failed upload marker and requests new
-approval. No MQTT start had been sent in the failed attempt. Status observation now subscribes
-before publishing a read-only `pushing.pushall` snapshot request with Mosquitto request/response;
-it still requires an explicit complete state/error report and cleans the private credential files.
-
-Correction at 22:12 UTC: the operator reports printer-02 still shows SD card “error” in
-settings despite clearing print_error. Stop its after-format attempt before actuation and
-prioritize printer-01. A zero print_error is not proof of usable storage.
-
-### Printer-01 start observed by operator
-
-At approximately 22:15 UTC the full-snapshot gate admitted printer-01 and its holes 3–4
-project uploaded successfully. MQTT publication did not return PUBACK. The operator then
-confirmed the machine was heating or calibrating. The publisher had already exited with
-connection-lost code 7 and cleaned its credential/CA directories before termination was attempted.
-The transport outcome is UNKNOWN; the batch marker is retained and no start replay is permitted.
-This is operator-observed preparation, not yet a telemetry-confirmed extrusion or completed print.
-The selected feed is AMS physical slot 1; slice estimate 19m22s. Printer-02 remains held for
-SD-card settings error, despite its zero print_error report.
-
-At 22:19 UTC a fresh authenticated snapshot confirmed printer-01 `RUNNING`, `print_error=0`,
-and subtask name `gunbc-28a8700489cf908edb9ed59c0aa871fe6903b4d558c3b64de6a7636af701580e.3mf`.
-It reported 4%, 18 minutes remaining, layer 0/15 (preparation), nozzle 176 °C and bed 62 °C.
-This reconciles the unknown MQTT transport result with observed execution of the intended gauge;
-it does not establish completed extrusion or a finished part. No duplicate start was sent.
-
-### Printer-02 recovery retry
-
-The operator subsequently reported printer-02's card working and requested another attempt,
-supplying a fresh one-hour token. The previously stopped after-format attempt had no start claim
-and had sent no printer command. At approximately 22:31 UTC its new signed approval was observed,
-the fresh full-state check admitted the printer, and the holes 4–5 file uploaded successfully.
-AMS physical slot 1 remains selected. MQTT publication is awaiting reconciliation; it is not
-replayed. The earlier FTP-550 attempt and its claim remain separate and retained.
-
-At approximately 22:36 UTC, fresh telemetry confirmed printer-02 RUNNING/error 0 with the
-expected `gunbc-a8f434e80014b6a316d30665b372bd0df3e858a68a2ff04a5fe4f50031d68535.3mf`
-subtask, 38%, layer 0/15, and 8 minutes remaining. The upload/start route now has physical
-execution evidence after the card recovery; this is not a long-term card-health qualification.
-
-The operator reported printer-01 finished the holes 3–4 gauge, both holes line up well,
-and the part was removed / bed cleared. Record C–H as an operator-reported alignment pass,
-without inferring load-bearing qualification. Prepare holes 3–6 (C–B) as printer-01's next gauge.
-
-The operator authorized the next printer-01 print after confirming C–H fit and a clear bed.
-Holes 3–6 (C–B) sliced through the verified Orca entry with the same selected profiles.
-Readback: SHA-256 `fb6d4bd1fcb23c07087b5575e6f5b20619f7ab8da03217828148d84cfcefc09f`,
-15 layers / 3 mm, identity scaling, one plate, valid embedded G-code MD5 and ZIP integrity,
-brim bounds [57.211684, 80.071684, 122.788316, 99.928316] mm, 12m10s / 2.59 g PLA.
-The slicer metadata carries `bed_temperature_too_high_than_filament` at the upstream Generic PLA
-textured-plate setting of 65 °C; this setting matches the successfully printed/aligned prior gauge.
-It is retained as an observed warning, not described as warning-free. The new request binds this
-project digest and a separate holes-3-6 attempt; printer-02's running job is not touched.
-
-The other remaining candidates are also sliced and validated under
-`/home/briansrls/print-prep-2026-10-03/next-batch/` (no start requested for either yet):
-
-| Gauge | SHA-256 | Estimate | PLA |
-|---|---|---|---|
-| 5–2 (L–M) | `607601f18602ae273472654c01b9d34ca1674b7f6f5356c7136a382af41f545b` | 19m34s | 7.10 g |
-| 4–7 (H–R) | `972ec6278c3334e070d4bd31884ce781211454c1c32296652e5f9a6ae4269252` | 13m26s | 3.42 g |
-
-Both passed ZIP/G-code checksum, one-plate, 15-layer/3-mm, identity-transform, A1 mini/PLA/0.4-mm
-profile, and 180-mm bed-bound checks. L–M including brim spans X=1.331684–178.668316 mm; no
-scaling was applied. Both retain the same 65 °C bed-temperature warning described above.
-
-### Operator direction: stop the pair-gauge sequence
-
-The operator requested stopping further gauge printing and moving toward chassis/rack parts.
-Do not enqueue the prepared 5–2 or 4–7 gauges. A fresh snapshot already confirmed the newly
-started printer-01 3–6 job RUNNING/error 0 with its exact digest filename and 12 minutes remaining;
-the operator explicitly chose to let that active print finish. No cancellation is requested.
-The operator expects the remaining positions to be accurate; retain that as an expectation, not
-a measured fit result. 1–3 and 3–4 have reported alignment passes.
-
-Repository inspection found no printable full chassis/cassette/rack-bay geometry. Existing concrete
-geometry covers coupons, standoff gauges and a fan-mount plate; rack_mount models occupancy of
-catalog hardware, not printable rack construction. The proposed next geometry is a segmented,
-adjustable motherboard carrier for unpowered assembly/fit, forming the first chassis prototype.
-Remaining mounting positions can stay adjustable rather than requiring more pair gauges. Actual
-standoff thread/height and underside clearance still determine the board-support interface;
-PSU/cooler envelopes, structural material and load/joint checks remain for the powered cassette.
-
-### Hosted concept workbench
-
-The operator accepted the requirements and requested a hosted site for iterating on the chassis,
-including independent 3D rotation of each piece. Published privately:
-[Altra Chassis Workbench](https://altra-chassis-workbench.briansrls448156.chatgpt.site).
-It contains an explicitly provisional four-panel carrier, segmented rails, handle and retaining
-tabs, with a 2×2 fixed-frame study. Individual isolation/orbit, explosion, withdrawal and design
-controls are available. There are no print controls or manufacturing exports.
-The missing hardware dimensions remain unknown; the geometry is a visual proposal, not an
-admitted fabrication result. Source project details are recorded in `sites/README.md`.
-Desktop/mobile rendering and the principal interactions were exercised successfully.
-All temporary copies of the operator's GCP token were removed after printing work ended.
-
-### Cassette hardware and airflow study — 4 October 2026
-
-Operator clarification: the target cooler is Dynatron (W1 in the preceding question), and PSUs
-must be interchangeable rather than tied to one model. Roughly 400–600 W was an example range,
-not a finalized electrical qualification. PSU compatibility must include accepted physical envelope,
-mounting adapters, connector requirements, intake/exhaust clearance and service access; wattage
-alone is insufficient. The inventory's unread PSU identities remain unread.
-
-Concept 02 adds a rear cassette-resident adjustable metal PSU cradle, a variable PSU envelope,
-Dynatron W1 geometry, DIMM clearance zones, one to three front 80 mm fans with individual carrier
-feet, side airflow guides, a schematic internal harness corridor and front-to-rear direction arrows.
-The operator proposed cassette-mounted fans. All these components travel with the cassette in the
-2×2 frame view. Three fans is a layout default, not an established cooling requirement.
-
-The [Dynatron manufacturer page](https://www.dynatron.co/product-page/w1), checked 4 October,
-publishes active dimensions 141.1 × 84 × 72 mm and passive dimensions 116 × 84 × 72 mm.
-The study depicts the active envelope with simplified fins/fan; active versus passive operation,
-actual socket position/orientation and installed offset are not established by that depiction.
-The P8 PWM PST uses its catalog 80 × 80 × 25 mm envelope; the existing 71.5 mm hole pitch and
-4.4 mm clearance remain convention-unverified. Fan count, ducting and header/PST-chain electrical
-admission still require evidence. Airflow arrows are not simulation results.
-
-PSU slider defaults (150 × 85 × 150 mm), DIMM zones, the 50 mm rear service gap, adjustable cradle
-interfaces and harness route are design proposals. They are not measured hardware or a claim that
-all 400–600 W PSUs fit. No drive or expansion-card configuration has been invented. A height check
-flags simple study-pitch conflicts; it does not prove full assembly clearance or powered suitability.
-
-Source commit: `8c944389c0dbcb25639d4c6069587863ae0d0fd5` in the separate Sites repository.
-Browser checks passed for selectable parts, PSU isolation, fan-count changes, height-conflict
-feedback, airflow visibility, orbit, rack withdrawal, requirements and mobile overflow.
-No additional gauge or chassis print was started.
-
-### Shared power accepted — supersedes cassette-resident PSU
-
-On 4 October 2026 the operator accepted shared power per four-node block. This replaces the earlier
-cassette-resident PSU requirement and its per-node AC bundle. Eight nodes comprise two independently
-powered four-node blocks. Each block has a fixed-frame 12 V supply system and four separately
-protected, isolatable and disconnectable node feeds. Cassettes retain their board, cooler and fans.
-The earlier roughly 400–600 W example concerned individual supplies and is not a shared-block rating.
-
-[ASRock manual §2.8](https://download.asrock.com/Manual/ALTRAD8UD-1L2T.pdf) documents direct +12 V
-DC input and distinguishes it from the ATX signal-adapter connection. This establishes a supported
-input mode, not a qualified multi-node distribution system. Required power connections, independent
-startup/shutdown behaviour, aggregate load/startup demand, branch fault protection, wire/connector
-ratings, voltage drop, protective-earth continuity and service isolation still require engineering.
-No connector pinout, fuse size, PSU wattage, redundancy or live hot-swap capability is selected here.
-A nonredundant shared supply is a four-node failure domain; redundancy remains an open decision.
-
-Concept 03 depicts one fixed top power shelf, one adjustable shared PSU space reservation, one
-four-branch distribution placeholder and stationary branch harnesses. A DC disconnect placeholder
-travels with each cassette. Withdrawal illustrates the node shut down and its branch isolated and
-disconnected first. Top-shelf placement and all distribution dimensions are visual proposals. Shared
-supply height is additional to the two node rows; cassette pitch is governed by cassette hardware.
-Older Concept 02 notes above are retained as history and are superseded for power topology.
-
-Concept 03 source: `7f77b6884f23af034fd1632e5918c3a21e988e5a` in the Sites repository.
-Browser checks passed: shared PSU isolation, no PSU on the cassette-only view, fan-count controls,
-height feedback, airflow visibility, rack withdrawal, requirements and mobile layout.
-
-### Rear exhaust and first fan-mount print — 4 October 2026
-
-The operator requested moving fans to the rear to keep hands at the front handle away from them,
-and authorized modeling/printing a first part. Rear cassette-mounted exhaust is the new layout;
-front-to-rear airflow remains. Rear I/O/cable access and a finger guard remain unresolved. Both
-beds were reported clear; printer-01 is selected with the previously confirmed PLA in AMS slot 1.
-
-The first real part reuses `fan_mount.arctic_p8_fan_mount`: 92 × 92 × 4 mm plate, 76 mm aperture,
-71.5 mm hole pitch and 4.4 mm mounting holes. This is a useful fan mounting plate for unpowered
-assembly fit, not another motherboard spacing gauge and not a complete cassette. Cassette
-attachment and guarding have not been fabricated. Hole-pattern evidence remains convention-unverified.
-`fan_mount_print.main` carries the existing admitted geometry through the existing CadQuery emitter
-and exercised STL export settings; there are no independently authored CAD coordinates.
-
-Generation and verification artifacts are in `/home/briansrls/print-prep-2026-10-04/rear-fan-mount`.
-CadQuery 2.8.0 checks passed for one valid solid, dimensions, all five hole axes/radii, analytic volume,
-STEP round-trip and a closed manifold STL. STL SHA-256:
-`2b0c7df7e8cf79dc772a33ee6f62a6ccf9e5568ef07e0309545313480e35b4f8`.
-Orca 2.4.2 sliced through `slice_run.run` at 0.20 mm, 20 layers, PLA/0.4 mm nozzle, 220 °C nozzle,
-65 °C textured bed and 2 mm outer brim. Estimate 28m41s, 11.40 g. ZIP/G-code checksum, one plate,
-identity scaling and 180 mm bed bounds passed; bounds including brim are 42.071684–137.928316 mm
-on both axes. The retained bed-temperature warning matches the previously exercised 65 °C setting.
-The slice_info first-layer-time metadata is malformed; G-code estimates 6m4s and that metadata is
-not an admission input. Project SHA-256:
-`71da943ff2ed73a6b47c54759ba288e82af7d084c269bf9a413d4d901cf5199c`.
-
-Concept 04 is published with rear fans and downloadable generated STL/STEP, source
-`c2a49273da70f20a23e2e044fe552dceb74b773f`. Browser interaction checks passed.
-The operator-token/ntfy route is being used because PR #13149 remains unmerged. The request binds
-printer-01, credential version 1, exact project digest and attempt `rear-fan-mount-20261004-01`.
-A start result must be observed separately; preparation is not evidence of printing.
-
-The first launch refused before submission because its submission-key environment variable was
-missing; it filed no approval and created no start marker. Corrected operator launches on srv1
-require these existing key paths (never their contents) plus the private token-file path:
-
-- `GUNBC_APPROVAL_SUBMISSION_MAC_KEY_FILE=/etc/gunbc-roadmap/approval-submission-mac-key`
-- `GUNBC_APPROVAL_CAPABILITY_MAC_KEY_FILE=/etc/gunbc-roadmap/approval-mac-key`
-- `GUNBC_APPROVAL_STORE_RECEIPT_MAC_KEY_FILE=/etc/gunbc-roadmap/approval-store-receipt-mac-key`
-- `RUNNER_TEMP` pointing to an owner-only staging directory.
-
-The refusal log is retained as `print-01-preflight-refusal.log` under the srv1 run directory.
-Retrying the same attempt before any request/start marker exists does not replay a printer start.
-
-The corrected run passed the signed approval gate, observed the printer ready, claimed its durable
-start marker, uploaded the exact project and sent one AMS-slot-1 start. MQTT publication lost its
-connection without acknowledgement after two minutes, so the effect was classified UNKNOWN and
-was not replayed. A separate modeled `printer_report.run` observation then returned RUNNING,
-print_error 0, exact digest filename `gunbc-71da943ff2ed73a6b47c54759ba288e82af7d084c269bf9a413d4d901cf5199c.3mf`,
-19% and 23 minutes remaining. This confirms the requested job active; layer_num was 0, so it is
-not yet evidence of deposited layers or completed fit. The snapshot is retained locally and on srv1.
-The operator independently reported probably heating. Printer-02 was not started. Temporary copies
-of the operator token were deleted from both hosts.
-
-### Complete logical cassette review — 4 October 2026
-
-The operator reports that the printed rear fan plate fits. Record this as a physical fit
-observation, not a caliper measurement or a promotion of the upstream conventional hole pattern.
-The operator requests the whole cassette model now, review of all pieces together, then the first
-cassette print. Stop the individual gauge sequence. No printer start is authorized by this review
-artifact generation alone; the next print follows assembly review and the existing print workflow.
-
-Review 05 replaces browser-authored mechanical geometry with `product.printed_chassis.cassette`
-and `rack_assembly`. `assembly_geometry` carries typed box/cylinder CSG, micrometre coordinates,
-part kind, fixed/moving scope, print orientation and mating-interface records. `cassette_review`
-emits the full manifest. `review_realization` emits the generic CadQuery host adapter; it chooses
-no mechanical dimensions and grants no fabrication admission. The old Site `concept.js` is removed.
-Vendor board outline, fan plate/pattern, W1 envelope and P8 depth resolve from their existing owners.
-
-One cassette has 49 printed instances / 29 distinct authored geometries: four vented tray panels,
-four panel splices, four rails, two rail splices, a handle, two retaining stops, two rear extension
-arms, two fan crossmember halves and a splice, three fitted-pattern fan plates, three feet, three
-guards, two side airflow guides, four guide spacers and twelve guard spacers. The tray is
-271.840 × 294.700 mm. Each piece fits the 180 mm A1 mini envelope in its declared orientation.
-The two-level block retains a 140 mm bay pitch; this is a custom frame, not a claim of standard
-2U/4U rack compliance. The fixed metal frame includes runner proposals. Shared 12 V supply,
-four protected/isolatable feeds and distribution space remain fixed when a cassette is extracted.
-Supply dimensions are explicitly space reservations; no supply wattage or circuit is selected.
-
-The guides initially intersected the rail flanges and outer fan feet. The corrected model raises
-the guide foot to 13 mm, adds front 8 mm / rear 4 mm spacers, and drills the outer foot for the shared
-rear bolt stack. The front rests on the panel; the rear rests on the outer fan foot. This clears
-the rail flange by 1 mm. Guard pads enclose the four fan fastener holes; upper 7 mm / lower 2 mm
-spacers account for the 5 mm fan foot. Guard protection, fan bolt length and engagement still need
-assembly review. All 56 distinct modeled fastener axes have a coaxial mate in another printed part.
-This is geometric alignment evidence, not a fastener strength or engagement test.
-
-Reproduction (from this worktree; use a memory-limited scope for the compiler):
-
-```sh
-systemd-run --user --scope -p MemoryMax=24G -p MemorySwapMax=0 gunbc run \
-  --source-root dag --source-root src/v2 \
-  --entry dag/gunbc/product/printed_chassis/cassette_review.dag --function main > model.json
-systemd-run --user --scope -p MemoryMax=24G -p MemorySwapMax=0 gunbc run \
-  --source-root dag --source-root src/v2 \
-  --entry dag/gunbc/product/printed_chassis/review_realization.dag --function main > realize-review.py
-python realize-review.py model.json fresh-output-directory
-```
-
-Use the exercised CadQuery 2.8.0 environment. Output includes bed-oriented STL for each printed
-instance, local-coordinate STEP, cassette assembly STEP, viewer meshes, a manifest with digests,
-parts/print-quantity/interface CSVs and one review ZIP. Generated artifacts and run logs are retained
-under `/home/briansrls/print-prep-2026-10-04/cassette-r05`; the Site carries the review package.
-The adapter refuses invalid/disconnected printed solids, cuts missing material, out-of-bed parts,
-nonmanifold STL, STEP/STL bounds or volume divergence, unmatched fastener bores, orphan interface
-members and intersections between printed parts. Kernel bounding boxes explicitly ignore cached
-triangulation, while STL bounds allow the modeled tessellation deflection.
-
-Remaining interfaces are deliberately represented as unresolved: board support thread/height and
-underside keep-outs, loaded rail/joint/material behavior, real cooler pose and rear cable access,
-fastener engagement, selected power/distribution hardware, thermal performance and unspecified
-storage/expansion. No invented standoffs are provided. The first cassette is an unpowered assembly
-fit, not a populated operational chassis. Review the complete parts and these interfaces together;
-do not restart a gauge-by-gauge process.
-
-Final exercised generation passed for all 49 printed pieces, 29 unique geometries, 56 matched
-fastener axes and zero printed-part intersections. Negative controls separately refused an oversized
-part, a disconnected solid, an unknown primitive, a displaced mating bore and an orphan interface.
-The emitted adapter was the code actually executed. Local browser checks passed with the final
-package; the Site shows the same generated mesh geometry as the downloadable CAD. No slicing,
-approval request or printer start was performed in this review step. Reuse the already fitted fan
-plate when scheduling quantities after review.
-
-Review 05 published successfully at the existing private workbench, Site source `a9658fd05d27e83220c611b5fb00ac4397b74739`.
diff --git a/docs/plans/qualified-subject-identity.md b/docs/plans/qualified-subject-identity.md
deleted file mode 100644
index 3aefce5d84a..00000000000
--- a/docs/plans/qualified-subject-identity.md
+++ /dev/null
@@ -1,122 +0,0 @@
-# Qualified subject identity (owner direction 2026-09-25)
-
-Sits under `one-namespace-hierarchy.md`: that ruling says there is one
-hierarchy; this one says every object in every context names itself with one
-construction. Together: one algebra, one graph, three+ projections.
-
-## The algebra
-
-```text
-QualifiedSubjectName
-  = authority
-  + namespace path
-  + local identity
-
-SubjectIncarnation
-  = QualifiedSubjectName
-  + revision / generation / invocation
-```
-
-This is NOT one flat namespace for every object. Every object uses the same
-construction while preserving its owning authority:
-
-```text
-buganizer:gunbc/issue/<issue-id>
-github:gunb-ai/gunbc/pr/12210
-github:gunb-ai/gunbc/pr/12210@52c56a8
-dag:gunb-ai/gunbc/test/<module>::<function>
-dag:gunb-ai/gunbc/test/<module>::<function>@52c56a8
-run:srv1/<invocation-id>
-compiler:gunbc-v2/diagnostic/match_arm_navigation_refused
-```
-
-At the .dag level: reuse the existing qualified-name/namespace carrier. Do NOT
-mint stringly per-kind identities (`BuganizerNodeName`, `PrNumber`,
-`TestLabel`, `RunName`). Kind-specific types may wrap one qualified identity;
-they must not reinvent its namespace semantics.
-
-The `SubjectIncarnation` half is load-bearing: it prevents the UI from
-attaching a result from main, an older PR head, or a stale run to the stable
-subject as though the subject were timeless. Every displayed runtime claim is
-bound to an exact incarnation.
-
-## The relation vocabulary (two issue-to-issue dimensions, never collapsed)
-
-| Relation                      | Meaning                        | Affects scheduling? |
-| ----------------------------- | ------------------------------ | ------------------: |
-| `UpstreamOf` / `DownstreamOf` | Issue decomposition or nesting |       Not inherently |
-| `Blocks` / `BlockedBy`        | Must complete first            |                 Yes |
-| `Implements`                  | Issue → PR                     |  No issue dependency |
-| `ValidatedBy`                 | Issue → test/claim             |                  No |
-| `ObservedBy`                  | Test/claim → exact run         |                  No |
-| `ReportedDiagnostic`          | Exact run → diagnostic         |                  No |
-| `BasedOn`                     | PR head → another PR head      |      Not automatically |
-
-Laws:
-
-- A stacked PR is `BasedOn`, not automatically `Blocks`. It becomes `Blocks`
-  only when the associated issue genuinely cannot complete independently.
-- A test is not automatically a child issue; a run is not a blocker node; a
-  diagnostic is not an issue dependency; a merge-queue state is not an issue
-  status; a numbered landing-order list is not a dependency graph.
-- Never use PR numbers as issue node IDs. Each pairing is an explicit
-  `BuganizerIssue --Implements--> GitHubPullRequest` link.
-- Common causes collapse: N affected tests with one shared refusal render as
-  ONE blocker plus an N-row impact population, never N independent blockers.
-
-## Execution-milestone state machine (acceptance tracking)
-
-```text
-ContextRefused → ContextResolved → BodyReached → BodyExecuted
-  → AssertionVerdictProduced → verdict
-```
-
-A population that has not reached its bodies is `BLOCKED`, not `FAIL`:
-
-```text
-Passed / Failed in body / Blocked before body / Not yet adjudicated
-```
-
-Milestones (e.g. `BodyReached`) are issue-local acceptance milestones, not
-synthetic dependency nodes and not new issues. Do not pre-create "unknown
-blocker" issues for failures not yet observed.
-
-## Presentation rules (enforced on the tracker surfaces)
-
-1. Never display a result without its incarnation (head sha / invocation id /
-   exact run).
-2. Distinct states: `PASS / FAIL / BLOCKED / NOT RUN / RUNNING / UNREADABLE` —
-   no red "failed" styling for pre-body refusal.
-3. Render a DAG, not an ordered prose list (independent branches proceed
-   independently).
-4. `Upstream / Downstream` and `Blocked by / Blocks` render in separate
-   sections even when one issue pair carries both.
-5. PRs, tests, runs, diagnostics attach to issue nodes through typed
-   relationships as evidence (Implementation / Verification sections); they
-   never masquerade as issue nodes.
-6. Collapse common causes (above).
-7. Never infer issue completion from PR state — "approved" / "merge queue" /
-   "checks running" are properties of the implementing PR incarnation; the
-   issue closes only by its own completion rule. Verification with unresolved
-   attribution reads `pending attribution`, never a blamed subject.
-
-## The invariant
-
-> Every displayed object has one authority-owned qualified subject name; every
-> runtime claim is bound to an exact incarnation; upstream/downstream expresses
-> issue nesting; blockers express must-complete-first ordering; PRs, tests,
-> runs, and diagnostics attach as evidence rather than silently becoming issue
-> nodes.
-
-## Where this binds current lanes
-
-- Tracker frontend (agent-48 + follow-ups): assignee/issue semantics, the
-  detail page's sections (Upstream/Downstream vs Blocked by/Blocks,
-  Implementation, Verification), state vocabulary, DAG rendering.
-- Issue-tracker extdeps model: the relation vocabulary above becomes the
-  typed relation set; the roster gains incarnation fields on any rendered
-  result.
-- Alignment consolidation: alignment walks the namespace path of the
-  QualifiedSubjectName; ambiguity/refusal uses the same carrier.
-- SCM/belt surfaces: captures, receipts, and verdicts already carry exact
-  heads — the display rule (1) makes that binding uniform on every surface.
diff --git a/docs/plans/realization-measurement-loop.md b/docs/plans/realization-measurement-loop.md
index 83af37d8e04..05999fac4e9 100644
--- a/docs/plans/realization-measurement-loop.md
+++ b/docs/plans/realization-measurement-loop.md
@@ -159,7 +159,7 @@ The work-item view of the phases above, ordered by dependency toward the accepta
 
 - **F1** scheduler gives heavy nodes the budgeted width — *#5421 merged* (= Phase 1 width landing).
 - **F2/F3** key-completeness lens (`ToolchainChange ∈ triggers ⟹ input ∈ inputs_considered`) + `resolved_graph` keyed by construction — *#5423, in review* (= the Phase 2 key-derivation axis, spec-level).
-- **P1 — honest keys, verified by execution** *(deps F2,F3)*: realizer-key lens (executed digest ⊇ declared `inputs_considered`, RED otherwise — would have caught the `from_utf8_lossy` collision); stable transform-id (reproducible source/commit/tree hash, not binary bytes); census parity for `parse_table_memo`. (= Phase 2 "converge key derivations".)
+- **P1 — honest keys, verified by execution** *(deps F2,F3)*: realizer-key lens (executed digest ⊇ declared `inputs_considered`, RED otherwise — would have caught the `from_utf8_lossy` collision); stable transform-id (reproducible source/commit/tree hash, not binary bytes); census parity for `parse_table_memo` (since deleted with the parse memo carrier, operator ruling R2 2026-10-08). (= Phase 2 "converge key derivations".)
 - **P2 — one door: caching by inhabitance** *(deps P1)*: `realize(subject)` as the sole API; eliminate raw bypass (`build_multi_entry_index`, hand-rolled `ParseTable` HashMap → inhabited via `realize`, DESIGN §6's own example). (= Phase 2 one-kernel/N-backends.)
 - **P3 — reach → layer + completeness fail-closed** *(deps P2)* — **the core ask / the acceptance gate**: reach analysis lens (consumer set + boundary → minimal sufficient `Placement`); completeness gate (subject realized below reach → ERROR; non-redundant transform with no supplier at reach → ERROR — **land the redundancy-only cut first**, cost half waits on §4); supplier provisioning + typed request.
 - **P4 — economic tier** *(deps Phase 0 measurement)*: per-transform measured cost (`PerformanceReceipt` → cost-aware reach); `Materialization` = `Recompute | Memoize | Share` chosen by measured cost.
diff --git a/docs/plans/receipts/allocation-state-custody-2026-09-29/README.md b/docs/plans/receipts/allocation-state-custody-2026-09-29/README.md
deleted file mode 100644
index 767c8ad35ed..00000000000
--- a/docs/plans/receipts/allocation-state-custody-2026-09-29/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Protected-state credential custody prerequisite
-
-This cut extracts only the storage credential row from allocation PR #12505 onto
-main `889312b928ae19593bb78e918bd2687c86e3db11`. It does not install the protected
-storage server, designate a workspace slot, or deploy the allocation stack.
-
-The existing host custody convergence resolves the pinned Secret Manager version,
-checks the administrator SSH subject, writes through the existing typed remote
-file authority, and reads back content, permissions, ancestors and staging cleanup.
-The state credential uses root:operator 0640 inside root:operator 0750, outside job
-and guest trees. Permission-bit readback is not an ACL or effective-open proof.
-The cloud accessor remains a row in the existing secret-accessor roster.
-
-After review and qualification, the bounded custody sequence is the existing
-`fleet-converge` mode `host_credential_custody_converge`, `credential=fabric_state_writer_key`,
-once for srv1 (storage/controller) and once for srv2 (the website). Use the merged
-reviewed source revision and the workflow's own WIF identity. No operator token,
-manual SCP, or fallback approval key is required. Read each run's custody receipt
-before advancing to storage service commissioning. Those runs have not occurred.
-
-The branch-local release build passed under 6 GiB/no swap (15m10s). The initial
-older-binary test and both branch-local full-root test/emission runs exited 137.
-Byte-identical dependency-only runs also exited 137: 1746 modules for custody
-controls, 2110 for the standard registry emitter. The latter reached some
-transitive typechecking but neither produced a qualification result or workflow
-output. No memory limit was increased.
-
-PR #12580 remains draft and unqualified for installation. The superseded PR run
-36510800728 was cancelled and supplies no qualification. The explicitly dispatched
-integrated run 36512302394 is pinned to 7768a9597efb03bd6729cda76beb85b8e9485544
-and remains outstanding at this checkpoint. The generated workflow option
-must be emitted and checked before landing. These failures are a significant
-local qualification blocker, not proof that the custody behavior passed or a
-claim that any specific source defect caused the process kills.
-
-Further bounded checks used the existing typed-module cache cap of one and
-`MALLOC_ARENA_MAX=2`, matching the CI allocator setting. Both custody controls
-(1746 original modules) and a direct call to the canonical fleet workflow
-generator (1822 original modules plus a harness) ended with systemd
-`Result=oom-kill`, before results. These were still 6 GiB/no swap; no further
-identical local retry is planned. The integrated CI run uses its existing budget.
-
-CI run 36512302394 passed floor, compiler, clippy and emit-build; generated
-projection drift remained. PR run 36513776136 regenerated and verified the
-workflow successfully. Its repair artifact intentionally excludes workflow files.
-The emitted YAML was therefore read from that exact unchanged CI source checkout
-over the modeled srv3 access path, checking HEAD before and after and requiring
-an empty dag/src/v2 diff. Only the credential dropdown changes. The emitted bytes
-and their provenance are now retained; the updated branch still needs its checks.
-No credential installation was performed.
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/README.md b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/README.md
deleted file mode 100644
index 2f40d3fcd70..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/README.md
+++ /dev/null
@@ -1,56 +0,0 @@
-# IAM bootstrap qualification and partial commissioning
-
-Source: `a23a0f99cbfe3f39da52cd40638eb44c85e76c6c`, based on main
-`2886b9e396d5ca6026c54212f27c52ea4113fba4`. Independent draft: #12565.
-
-The branch's own release build succeeded. Its binary passed all three focused
-controls, printed the exact bootstrap plan, and refused the missing-credential
-control with the expected reason before creating a started receipt. All commands
-ran under `MemoryMax=6G`, `MemorySwapMax=0`. `receipt.json` records binary and
-closure-manifest hashes. The runbook reproduces the byte-identical closure; this
-is not a full landing-suite result.
-
-## Cloud result: stopped before permissions were granted
-
-Attempt `20260928-a23a0f99c-1` submitted creation of the IAM job's pool, provider,
-and observer account, but immediate readback did not establish their readiness.
-It refused without reaching role or permission stages.
-
-Attempt `20260928-a23a0f99c-2` reread the same named resources, created the apply
-account and missing bare Namecheap pool/account, and completed the identity
-stage. Existing target resources were read, not replaced. It then created all
-seven exact role definitions and independently reread them.
-
-GCP refused the next stage's deny-policy creation with HTTP 403:
-`Permission iam.googleapis.com/denypolicies.create denied on resource
-cloudresourcemanager.googleapis.com/projects/582015116396`.
-
-No capability bindings or workflow impersonation bindings were applied by this
-bootstrap. No target provider was created. The privilege probes and real
-OIDC/approval workflow acceptance have not run. Existing unrelated identities and
-access were not removed. Roles are definitions, not grants to the new accounts.
-
-The operator-supplied token was read through a private temporary file, never a
-command argument. The launcher removed that file after each attempt. Receipt
-copies redact the temporary pathname and contain no token. The refusal is a
-missing permission, not an observed token-expiry error.
-
-## Resume
-
-An existing administrator credential or approved administrative workflow must
-supply the deny-policy authority on `gunbai-secrets`. The bootstrap never grants
-that authority to itself. Run the same modeled entry with a new receipt identity;
-completed named subjects and role definitions are reread before further effects.
-Later capability and impersonation checks may expose additional missing
-permissions; they have not been qualified by this partial run.
-
-Successful deny readback, capability reconciliation, observer/apply checks, and
-final workload trust must precede the real approval-workflow acceptance run.
-
-## Fresh-token retry
-
-Attempt `20260928-a23a0f99c-3` used a newly supplied operator token and reread
-the existing identities and seven role definitions. GCP again refused deny-policy
-creation with HTTP 403 for `iam.denypolicies.create`. Capability and workflow
-trust stages were not reached. Temporary credential removal was independently
-checked. Refreshing the token did not supply the missing IAM permission.
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/build.log b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/build.log
deleted file mode 100644
index 41e6e0db3b0..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/build.log
+++ /dev/null
@@ -1,114 +0,0 @@
-   Compiling proc-macro2 v1.0.106
-   Compiling quote v1.0.45
-   Compiling unicode-ident v1.0.24
-   Compiling syn v2.0.117
-   Compiling shlex v1.3.0
-   Compiling find-msvc-tools v0.1.9
-   Compiling cc v1.2.62
-   Compiling synstructure v0.13.2
-   Compiling version_check v0.9.5
-   Compiling serde_core v1.0.228
-   Compiling libc v0.2.186
-   Compiling zerofrom-derive v0.1.7
-   Compiling typenum v1.20.1
-   Compiling cfg-if v1.0.4
-   Compiling zerofrom v0.1.8
-   Compiling yoke-derive v0.8.2
-   Compiling serde v1.0.228
-   Compiling stable_deref_trait v1.2.1
-   Compiling yoke v0.8.2
-   Compiling serde_derive v1.0.228
-   Compiling object v0.37.3
-   Compiling zerovec-derive v0.11.3
-   Compiling memchr v2.8.0
-   Compiling zerovec v0.11.6
-   Compiling displaydoc v0.2.5
-   Compiling ar_archive_writer v0.5.1
-   Compiling zmij v1.0.21
-   Compiling psm v0.1.31
-   Compiling serde_json v1.0.149
-   Compiling tinystr v0.8.3
-   Compiling bitmaps v2.1.0
-   Compiling im v15.1.0
-   Compiling stacker v0.1.24
-   Compiling rand_core v0.6.4
-   Compiling litemap v0.8.2
-   Compiling writeable v0.6.3
-   Compiling itoa v1.0.18
-   Compiling icu_locale_core v2.2.0
-   Compiling rand_xoshiro v0.6.0
-   Compiling sized-chunks v0.6.5
-   Compiling zerotrie v0.2.4
-   Compiling potential_utf v0.1.5
-   Compiling generic-array v0.14.7
-   Compiling icu_properties_data v2.2.0
-   Compiling icu_normalizer_data v2.2.0
-   Compiling utf8_iter v1.0.4
-   Compiling icu_collections v2.2.0
-   Compiling icu_provider v2.2.0
-   Compiling ring v0.17.14
-   Compiling unicode-properties v0.1.4
-   Compiling zeroize v1.8.2
-   Compiling v1-stage0-runtime v0.1.0 (/home/briansrls/scratch-wt/gcp-iam-bootstrap/src/v1/stage0_runtime)
-   Compiling rustls-pki-types v1.14.1
-   Compiling subtle v2.6.1
-   Compiling smallvec v1.15.1
-   Compiling icu_normalizer v2.2.0
-   Compiling icu_properties v2.2.0
-   Compiling v1-stage0-std-core v0.1.0 (/home/briansrls/scratch-wt/gcp-iam-bootstrap/src/v1/stage0_std_core)
-   Compiling getrandom v0.2.17
-   Compiling untrusted v0.9.0
-   Compiling utf8parse v0.2.2
-   Compiling crc32fast v1.5.0
-   Compiling anstyle-parse v1.0.0
-   Compiling v1-stage0-std-surface v0.1.0 (/home/briansrls/scratch-wt/gcp-iam-bootstrap/src/v1/stage0_std_surface)
-   Compiling idna_adapter v1.2.2
-   Compiling crypto-common v0.1.7
-   Compiling block-buffer v0.10.4
-   Compiling adler2 v2.0.1
-   Compiling colorchoice v1.0.5
-   Compiling equivalent v1.0.2
-   Compiling percent-encoding v2.3.2
-   Compiling simd-adler32 v0.3.9
-   Compiling rustls v0.23.40
-   Compiling anstyle-query v1.1.5
-   Compiling hashbrown v0.17.1
-   Compiling is_terminal_polyfill v1.70.2
-   Compiling anstyle v1.0.14
-   Compiling anstream v1.0.0
-   Compiling indexmap v2.14.0
-   Compiling miniz_oxide v0.8.9
-   Compiling form_urlencoded v1.2.2
-   Compiling digest v0.10.7
-   Compiling idna v1.1.0
-   Compiling v1-stage0-extdeps-languages v0.1.0 (/home/briansrls/scratch-wt/gcp-iam-bootstrap/src/v1/stage0_extdeps_languages)
-   Compiling rustls-webpki v0.103.13
-   Compiling webpki-roots v1.0.7
-   Compiling toml_datetime v0.6.11
-   Compiling serde_spanned v0.6.9
-   Compiling strsim v0.11.1
-   Compiling winnow v0.7.15
-   Compiling heck v0.5.0
-   Compiling log v0.4.29
-   Compiling clap_lex v1.1.0
-   Compiling toml_write v0.1.2
-   Compiling once_cell v1.21.4
-   Compiling toml_edit v0.22.27
-   Compiling clap_builder v4.6.0
-   Compiling clap_derive v4.6.1
-   Compiling webpki-roots v0.26.11
-   Compiling flate2 v1.1.9
-   Compiling v1-stage0-v1-artifact v0.1.0 (/home/briansrls/scratch-wt/gcp-iam-bootstrap/src/v1/stage0_v1_artifact)
-   Compiling url v2.5.8
-   Compiling cpufeatures v0.2.17
-   Compiling base64 v0.22.1
-   Compiling v1-compiler v0.1.0 (/home/briansrls/scratch-wt/gcp-iam-bootstrap/src/v1/stage0)
-   Compiling ureq v2.12.1
-   Compiling sha2 v0.10.9
-   Compiling v1-stage0-v1-infer v0.1.0 (/home/briansrls/scratch-wt/gcp-iam-bootstrap/src/v1/stage0_v1_infer)
-   Compiling clap v4.6.1
-   Compiling toml v0.8.23
-   Compiling hmac v0.12.1
-   Compiling lazy_static v1.5.0
-   Compiling hex v0.4.3
-    Finished `release` profile [optimized] target(s) in 15m 29s
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/cloud-attempt-1.log b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/cloud-attempt-1.log
deleted file mode 100644
index 820189fcf42..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/cloud-attempt-1.log
+++ /dev/null
@@ -1,17 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 20 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-[file] read <private-temporary-token-file>
-[file] write_create_new target/gcp-iam-bootstrap-20260928-a23a0f99c-1-started.txt (54 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[file] write_create_new target/gcp-iam-bootstrap-20260928-a23a0f99c-1-identities.txt (114 bytes)
-gcp iam converge observe federation: named creation is not yet established by readback; no rights granted
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/cloud-attempt-2.log b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/cloud-attempt-2.log
deleted file mode 100644
index dc9ecc69f38..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/cloud-attempt-2.log
+++ /dev/null
@@ -1,91 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 23 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-[file] read <private-temporary-token-file>
-[file] write_create_new target/gcp-iam-bootstrap-20260928-a23a0f99c-2-started.txt (54 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[file] write_create_new target/gcp-iam-bootstrap-20260928-a23a0f99c-2-identities.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeCreate
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/roles
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeCreate
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeProvider
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/roles
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeProvider
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/roles
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/roles
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObservePool
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/roles
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObservePool
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveAccount
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/roles
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveAccount
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveSecret
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/roles
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveSecret
-[file] write_create_new target/gcp-iam-bootstrap-20260928-a23a0f99c-2-roles.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies/gunbc-iam-converge-boundary
-[rest] POST https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies
-[file] write_create_new target/gcp-iam-bootstrap-20260928-a23a0f99c-2-deny.txt (879 bytes)
-status 403: {
-  "error": {
-    "code": 403,
-    "message": "Permission iam.googleapis.com/denypolicies.create denied on resource cloudresourcemanager.googleapis.com/projects/582015116396",
-    "status": "PERMISSION_DENIED",
-    "details": [
-      {
-        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
-        "reason": "IAM_PERMISSION_DENIED",
-        "domain": "iam.googleapis.com",
-        "metadata": {
-          "permission": "iam.googleapis.com/denypolicies.create",
-          "resource": "projects/582015116396",
-          "error_info_id": "CiQwMWEwZWEwOS1lY2U1LTdmYTgtOGUyNi03NGQyNmM0MjRkODQSFXByb2plY3RzLzU4MjAxNTExNjM5Ng==",
-          "troubleshooter_url": "https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWEwOS1lY2U1LTdmYTgtOGUyNi03NGQyNmM0MjRkODQSFXByb2plY3RzLzU4MjAxNTExNjM5Ng%3D%3D"
-        }
-      }
-    ]
-  }
-}
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/cloud-attempt-3.log b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/cloud-attempt-3.log
deleted file mode 100644
index 0d7ec5449d0..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/cloud-attempt-3.log
+++ /dev/null
@@ -1,74 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 20 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-[file] read <private-temporary-token-file>
-[file] write_create_new target/gcp-iam-bootstrap-20260928-a23a0f99c-3-started.txt (54 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[file] write_create_new target/gcp-iam-bootstrap-20260928-a23a0f99c-3-identities.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeCreate
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeProvider
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObservePool
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveAccount
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveSecret
-[file] write_create_new target/gcp-iam-bootstrap-20260928-a23a0f99c-3-roles.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies/gunbc-iam-converge-boundary
-[rest] POST https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies
-[file] write_create_new target/gcp-iam-bootstrap-20260928-a23a0f99c-3-deny.txt (879 bytes)
-status 403: {
-  "error": {
-    "code": 403,
-    "message": "Permission iam.googleapis.com/denypolicies.create denied on resource cloudresourcemanager.googleapis.com/projects/582015116396",
-    "status": "PERMISSION_DENIED",
-    "details": [
-      {
-        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
-        "reason": "IAM_PERMISSION_DENIED",
-        "domain": "iam.googleapis.com",
-        "metadata": {
-          "permission": "iam.googleapis.com/denypolicies.create",
-          "error_info_id": "CiQwMWEwZWExMi1mMzBkLTdkMjUtOWYwZC1mMjNhNGJmYmFhNmQSFXByb2plY3RzLzU4MjAxNTExNjM5Ng==",
-          "resource": "projects/582015116396",
-          "troubleshooter_url": "https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWExMi1mMzBkLTdkMjUtOWYwZC1mMjNhNGJmYmFhNmQSFXByb2plY3RzLzU4MjAxNTExNjM5Ng%3D%3D"
-        }
-      }
-    ]
-  }
-}
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/controls.log b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/controls.log
deleted file mode 100644
index 7bff137e61b..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/controls.log
+++ /dev/null
@@ -1,7 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 20 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-PASS bootstrap_role_drift_never_authorizes_adoption
-PASS deny_exceptions_and_incomplete_readback_withhold_trust
-PASS workflow_trust_requires_completed_deny_and_privilege_readback
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-1-identities.txt b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-1-identities.txt
deleted file mode 100644
index 2522b49ad07..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-1-identities.txt
+++ /dev/null
@@ -1 +0,0 @@
-refused: gcp iam converge observe federation: named creation is not yet established by readback; no rights granted
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-1-started.txt b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-1-started.txt
deleted file mode 100644
index b286fc75b3e..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-1-started.txt
+++ /dev/null
@@ -1 +0,0 @@
-operator bootstrap started; not a convergence receipt
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-deny.txt b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-deny.txt
deleted file mode 100644
index bb00c5c4118..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-deny.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-refused: status 403: {
-  "error": {
-    "code": 403,
-    "message": "Permission iam.googleapis.com/denypolicies.create denied on resource cloudresourcemanager.googleapis.com/projects/582015116396",
-    "status": "PERMISSION_DENIED",
-    "details": [
-      {
-        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
-        "reason": "IAM_PERMISSION_DENIED",
-        "domain": "iam.googleapis.com",
-        "metadata": {
-          "permission": "iam.googleapis.com/denypolicies.create",
-          "resource": "projects/582015116396",
-          "error_info_id": "CiQwMWEwZWEwOS1lY2U1LTdmYTgtOGUyNi03NGQyNmM0MjRkODQSFXByb2plY3RzLzU4MjAxNTExNjM5Ng==",
-          "troubleshooter_url": "https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWEwOS1lY2U1LTdmYTgtOGUyNi03NGQyNmM0MjRkODQSFXByb2plY3RzLzU4MjAxNTExNjM5Ng%3D%3D"
-        }
-      }
-    ]
-  }
-}
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-identities.txt b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-identities.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-identities.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-roles.txt b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-roles.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-roles.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-started.txt b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-started.txt
deleted file mode 100644
index b286fc75b3e..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-2-started.txt
+++ /dev/null
@@ -1 +0,0 @@
-operator bootstrap started; not a convergence receipt
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-deny.txt b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-deny.txt
deleted file mode 100644
index 02019ed4fe0..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-deny.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-refused: status 403: {
-  "error": {
-    "code": 403,
-    "message": "Permission iam.googleapis.com/denypolicies.create denied on resource cloudresourcemanager.googleapis.com/projects/582015116396",
-    "status": "PERMISSION_DENIED",
-    "details": [
-      {
-        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
-        "reason": "IAM_PERMISSION_DENIED",
-        "domain": "iam.googleapis.com",
-        "metadata": {
-          "permission": "iam.googleapis.com/denypolicies.create",
-          "error_info_id": "CiQwMWEwZWExMi1mMzBkLTdkMjUtOWYwZC1mMjNhNGJmYmFhNmQSFXByb2plY3RzLzU4MjAxNTExNjM5Ng==",
-          "resource": "projects/582015116396",
-          "troubleshooter_url": "https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWExMi1mMzBkLTdkMjUtOWYwZC1mMjNhNGJmYmFhNmQSFXByb2plY3RzLzU4MjAxNTExNjM5Ng%3D%3D"
-        }
-      }
-    ]
-  }
-}
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-identities.txt b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-identities.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-identities.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-roles.txt b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-roles.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-roles.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-started.txt b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-started.txt
deleted file mode 100644
index b286fc75b3e..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/gcp-iam-bootstrap-20260928-a23a0f99c-3-started.txt
+++ /dev/null
@@ -1 +0,0 @@
-operator bootstrap started; not a convergence receipt
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/no-credential.log b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/no-credential.log
deleted file mode 100644
index 9a75d5f411d..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/no-credential.log
+++ /dev/null
@@ -1,5 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 24 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-no GUNBC_GCP_ACCESS_TOKEN_FILE in the environment: this entry needs a path to a file holding an access token
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/plan.log b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/plan.log
deleted file mode 100644
index 35135a13db7..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/plan.log
+++ /dev/null
@@ -1,52 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 23 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-Bootstrap stages: identities -> roles -> deny -> capabilities -> privilege-readback -> workflow-trust
-project gunbai-secrets
-workflow provider github-gcp-iam-converge-oidc
-workflow condition assertion.repository_id == '1143718943' && assertion.repository_owner_id == '244123794' && assertion.workflow_ref == 'gunb-ai/gunbc/.github/workflows/fleet-converge.yml@refs/heads/main' && assertion.ref == 'refs/heads/main' && assertion.event_name == 'workflow_dispatch' && assertion.environment == 'gcp-iam-converge'
-workflow principal set principalSet://iam.googleapis.com/projects/582015116396/locations/global/workloadIdentityPools/github-gcp-iam-converge/*
-deny policy gunbc-iam-converge-boundary
-deny principal serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com
-deny permissions secretmanager.googleapis.com/versions.access,secretmanager.googleapis.com/versions.add,iam.googleapis.com/serviceAccounts.actAs,iam.googleapis.com/serviceAccounts.getAccessToken,iam.googleapis.com/serviceAccounts.getOpenIdToken,iam.googleapis.com/serviceAccounts.implicitDelegation,iam.googleapis.com/serviceAccounts.signBlob,iam.googleapis.com/serviceAccounts.signJwt
-Target bootstrap creates only bare pools/accounts; target providers and workload trust remain approval-gated.
-role projects/gunbai-secrets/roles/gunbcIamConvergeCreate permissions=iam.workloadIdentityPools.create,iam.workloadIdentityPools.get,iam.serviceAccounts.create,iam.serviceAccounts.get
-role projects/gunbai-secrets/roles/gunbcIamConvergeProvider permissions=iam.workloadIdentityPoolProviders.create,iam.workloadIdentityPoolProviders.get,iam.workloadIdentityPoolProviders.list
-role projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy permissions=iam.serviceAccounts.get,iam.serviceAccounts.getIamPolicy,iam.serviceAccounts.setIamPolicy
-role projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy permissions=secretmanager.secrets.get,secretmanager.secrets.getIamPolicy,secretmanager.secrets.setIamPolicy
-role projects/gunbai-secrets/roles/gunbcIamObservePool permissions=iam.workloadIdentityPools.get,iam.workloadIdentityPoolProviders.get,iam.workloadIdentityPoolProviders.list
-role projects/gunbai-secrets/roles/gunbcIamObserveAccount permissions=iam.serviceAccounts.get,iam.serviceAccounts.getIamPolicy
-role projects/gunbai-secrets/roles/gunbcIamObserveSecret permissions=secretmanager.secrets.get,secretmanager.secrets.getIamPolicy
-binding projects/gunbai-secrets role:52:projects/gunbai-secrets/roles/gunbcIamConvergeCreate;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/locations/global/workloadIdentityPools/github-heal-publisher role:54:projects/gunbai-secrets/roles/gunbcIamConvergeProvider;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com role:59:projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/secrets/agent-github-app-private-key role:58:projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/locations/global/workloadIdentityPools/github-heal-publisher-private role:54:projects/gunbai-secrets/roles/gunbcIamConvergeProvider;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com role:59:projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/locations/global/workloadIdentityPools/github-mtcollins1-boot role:54:projects/gunbai-secrets/roles/gunbcIamConvergeProvider;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com role:59:projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/secrets/bmc-mtcollins1-gunbc role:58:projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/secrets/fleet-automation-ssh-key role:58:projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/locations/global/workloadIdentityPools/github-namecheap-dns role:54:projects/gunbai-secrets/roles/gunbcIamConvergeProvider;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com role:59:projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/secrets/namecheap-api-key role:58:projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/locations/global/workloadIdentityPools/github-heal-publisher role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com role:52:projects/gunbai-secrets/roles/gunbcIamObserveAccount;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/secrets/agent-github-app-private-key role:51:projects/gunbai-secrets/roles/gunbcIamObserveSecret;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/locations/global/workloadIdentityPools/github-heal-publisher-private role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com role:52:projects/gunbai-secrets/roles/gunbcIamObserveAccount;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/locations/global/workloadIdentityPools/github-mtcollins1-boot role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com role:52:projects/gunbai-secrets/roles/gunbcIamObserveAccount;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/secrets/bmc-mtcollins1-gunbc role:51:projects/gunbai-secrets/roles/gunbcIamObserveSecret;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/secrets/fleet-automation-ssh-key role:51:projects/gunbai-secrets/roles/gunbcIamObserveSecret;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/locations/global/workloadIdentityPools/github-namecheap-dns role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com role:52:projects/gunbai-secrets/roles/gunbcIamObserveAccount;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/secrets/namecheap-api-key role:51:projects/gunbai-secrets/roles/gunbcIamObserveSecret;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/locations/global/workloadIdentityPools/github-gcp-iam-converge role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com role:52:projects/gunbai-secrets/roles/gunbcIamObserveAccount;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/secrets/approval-submission-mac-key role:51:projects/gunbai-secrets/roles/gunbcIamObserveSecret;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com role:52:projects/gunbai-secrets/roles/gunbcIamObserveAccount;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-binding projects/582015116396/secrets/approval-submission-mac-key role:34:roles/secretmanager.secretAccessor;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition-title:54:gcp-iam-converge pinned approval-submission-mac-key v1;condition-expression:87:resource.name == "projects/582015116396/secrets/approval-submission-mac-key/versions/1";condition-description:96:gunbc.auth.gcp_iam_converge: the one version the gcp iam converge job reads, to sign its request;
-binding projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com role:30:roles/iam.workloadIdentityUser;member:120:principalSet://iam.googleapis.com/projects/582015116396/locations/global/workloadIdentityPools/github-gcp-iam-converge/*;condition:4:none;
-binding projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com role:30:roles/iam.workloadIdentityUser;member:120:principalSet://iam.googleapis.com/projects/582015116396/locations/global/workloadIdentityPools/github-gcp-iam-converge/*;condition:4:none;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/receipt.json b/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/receipt.json
deleted file mode 100644
index 192c58d5a66..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-2026-09-28/receipt.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "source_revision": "a23a0f99cbfe3f39da52cd40638eb44c85e76c6c",
-  "base_revision": "2886b9e396d5ca6026c54212f27c52ea4113fba4",
-  "binary_sha256": "179882133a4c03958a1bed8a8b444ea06e48c63a6c42263ff83694508825b415",
-  "closure_modules": 837,
-  "closure_manifest_sha256": "8b62fc4c64f5d76a879ae2c2fb7802e3a2aa5d53684431d7fa3276cd70d8d298",
-  "memory_max": "6G",
-  "memory_swap_max": 0,
-  "release_build_exit": 0,
-  "focused_controls": {
-    "passed": 3,
-    "failed": 0
-  },
-  "plan_exit": 0,
-  "missing_credential_exit": 1,
-  "missing_credential_exact_reason_verified": true,
-  "missing_credential_created_started_receipt": false,
-  "cloud_bootstrap": {
-    "status": "refused",
-    "attempts": 3,
-    "completed_stages": [
-      "identities",
-      "roles"
-    ],
-    "refused_stage": "deny",
-    "http_status": 403,
-    "missing_permission": "iam.denypolicies.create",
-    "capability_bindings_applied": false,
-    "workflow_trust_applied": false,
-    "temporary_credentials_removed": true,
-    "fresh_token_retry": "same HTTP 403 at deny-policy creation"
-  },
-  "full_landing_suite": "not run",
-  "oidc_approval_workflow_acceptance": "not run"
-}
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/README.md b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/README.md
deleted file mode 100644
index 10cf532a6c9..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/README.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Temporary bootstrap authority convergence receipt
-
-Source: `70009ad9d2c8f184153976576f5a1ec2211da1b3` on draft PR #12565.
-The branch binary passed 12 focused controls over 843 byte-identical modules,
-within 6 GiB with swap disabled. The full landing suite was not run.
-
-The organization-scoped run verified the operator subject and primary IAM email,
-verified project ancestry, granted the time-bounded Deny Admin cell, installed
-and read back the project deny policy, then removed the exact temporary grant
-and verified its absence. The retirement journal and sanitized execution log
-are included. Existing unrelated grants were outside the owned cell.
-
-The capabilities stage subsequently applied the project create-role binding,
-then stopped on a successful pool getIamPolicy response containing `{}` with
-neither a body etag nor an HTTP ETag. No pool policy write followed. Account
-privilege probes and workflow trust were not reached. The bootstrap as a whole
-is incomplete; no VM or fleet deployment acceptance is claimed.
-
-The earlier project-scoped attempt was rejected by GCP with HTTP 400: Deny Admin
-is grantable at organization scope. Its log and initial seven-control receipt
-are historical, not qualification of the final source. The new run also binds
-the verified stable subject to the actual primary email `brian@gunb.ai`.
-
-## Remaining dependency
-
-The pool's initial IAM policy needs an established safe publication contract.
-A successful empty read does not supply an optimistic-concurrency token. Do not
-replace this with an unconditional setIamPolicy or fabricate an etag. Google's
-[Policy contract](https://docs.cloud.google.com/iam/docs/reference/rest/v1/Policy)
-describes etag as the concurrency protection; the current required-etag wire
-shape reports this boundary as a decode refusal. A follow-up should model the
-missing publication prerequisite explicitly, including provider-supported
-initialization or established exclusive ownership, before enabling the write.
-
-The temporary credential file was removed by the launcher. No token is included.
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/controls.log b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/controls.log
deleted file mode 100644
index afefd6cdcf9..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/controls.log
+++ /dev/null
@@ -1,11 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 23 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-PASS bootstrap_role_drift_never_authorizes_adoption
-PASS deny_exceptions_and_incomplete_readback_withhold_trust
-PASS workflow_trust_requires_completed_deny_and_privilege_readback
-PASS authority_deadline_is_bounded_and_retry_does_not_renew_it
-PASS uncertain_publication_cannot_be_settled_from_an_absent_cell
-PASS unknown_policy_and_unowned_grants_never_authorize_changes
-PASS authority_retirement_preserves_existing_human_and_foreign_access
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
deleted file mode 100644
index 96c40eedfff..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
+++ /dev/null
@@ -1 +0,0 @@
-target-project:gunbai-secrets;authority-resource:organizations/266638272282;role:19:roles/iam.denyAdmin;member:18:user:brian@gunb.ai;condition-title:50:gunbc-bootstrap-deny-deny-bootstrap-org-20260928-1;condition-expression:48:request.time < timestamp('2026-09-28T23:15:00Z');condition-description:95:Temporary dependency for gunbc IAM deny-policy installation; cleanup remains owed after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
deleted file mode 100644
index 96c40eedfff..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
+++ /dev/null
@@ -1 +0,0 @@
-target-project:gunbai-secrets;authority-resource:organizations/266638272282;role:19:roles/iam.denyAdmin;member:18:user:brian@gunb.ai;condition-title:50:gunbc-bootstrap-deny-deny-bootstrap-org-20260928-1;condition-expression:48:request.time < timestamp('2026-09-28T23:15:00Z');condition-description:95:Temporary dependency for gunbc IAM deny-policy installation; cleanup remains owed after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
deleted file mode 100644
index 96c40eedfff..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
+++ /dev/null
@@ -1 +0,0 @@
-target-project:gunbai-secrets;authority-resource:organizations/266638272282;role:19:roles/iam.denyAdmin;member:18:user:brian@gunb.ai;condition-title:50:gunbc-bootstrap-deny-deny-bootstrap-org-20260928-1;condition-expression:48:request.time < timestamp('2026-09-28T23:15:00Z');condition-description:95:Temporary dependency for gunbc IAM deny-policy installation; cleanup remains owed after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
deleted file mode 100644
index 96c40eedfff..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
+++ /dev/null
@@ -1 +0,0 @@
-target-project:gunbai-secrets;authority-resource:organizations/266638272282;role:19:roles/iam.denyAdmin;member:18:user:brian@gunb.ai;condition-title:50:gunbc-bootstrap-deny-deny-bootstrap-org-20260928-1;condition-expression:48:request.time < timestamp('2026-09-28T23:15:00Z');condition-description:95:Temporary dependency for gunbc IAM deny-policy installation; cleanup remains owed after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-authority-cleanup.txt b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-authority-cleanup.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-authority-cleanup.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-capabilities.txt b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-capabilities.txt
deleted file mode 100644
index c897ef1e0af..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-capabilities.txt
+++ /dev/null
@@ -1 +0,0 @@
-refused: status 200 undecodable: HTTP 200 body did not inhabit the declared output (null at etag)
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-deny.txt b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-deny.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-deny.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-identities.txt b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-identities.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-identities.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-roles.txt b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-roles.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-roles.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-started.txt b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-started.txt
deleted file mode 100644
index b286fc75b3e..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/gcp-iam-bootstrap-20260928-organization-authority-1-started.txt
+++ /dev/null
@@ -1 +0,0 @@
-operator bootstrap started; not a convergence receipt
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/operator-userinfo-readback.json b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/operator-userinfo-readback.json
deleted file mode 100644
index 7d0a1f9a653..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/operator-userinfo-readback.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "endpoint": "https://openidconnect.googleapis.com/v1/userinfo",
-  "observation": "read-only authenticated API research; native convergence verifies before publication",
-  "sub": "116084671989231734979",
-  "email": "brian@gunb.ai",
-  "email_verified": true
-}
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/organization-apply.log b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/organization-apply.log
deleted file mode 100644
index 6b28875b530..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/organization-apply.log
+++ /dev/null
@@ -1,117 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 23 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-[file] read <private-temporary-token-file>
-[file] write_create_new target/gcp-iam-bootstrap-20260928-organization-authority-1-started.txt (54 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[file] write_create_new target/gcp-iam-bootstrap-20260928-organization-authority-1-identities.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeCreate
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeProvider
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObservePool
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveAccount
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveSecret
-[file] write_create_new target/gcp-iam-bootstrap-20260928-organization-authority-1-roles.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies/gunbc-iam-converge-boundary
-[rest] GET https://openidconnect.googleapis.com/v1/userinfo
-[rest] GET https://cloudresourcemanager.googleapis.com/v3/projects/gunbai-secrets
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt (397 bytes)
-◐ started Clock.Now
-✓ Clock.Now done in 1ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt (397 bytes)
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:setIamPolicy
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt (397 bytes)
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt (397 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[rest] GET https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies/gunbc-iam-converge-boundary
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[rest] POST https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies
-[rest] GET https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies/gunbc-iam-converge-boundary
-[file] write_create_new target/gcp-iam-bootstrap-20260928-organization-authority-1-deny.txt (78 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt (397 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:setIamPolicy
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt (397 bytes)
-[file] write_create_new target/gcp-iam-bootstrap-20260928-organization-authority-1-authority-cleanup.txt (78 bytes)
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:getIamPolicy
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:setIamPolicy
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[file] write_create_new target/gcp-iam-bootstrap-20260928-organization-authority-1-capabilities.txt (97 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt (397 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-status 200 undecodable: HTTP 200 body did not inhabit the declared output (null at etag)
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/organization-identity-controls.log b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/organization-identity-controls.log
deleted file mode 100644
index 29fdcef5d65..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/organization-identity-controls.log
+++ /dev/null
@@ -1,16 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 23 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-PASS bootstrap_role_drift_never_authorizes_adoption
-PASS deny_exceptions_and_incomplete_readback_withhold_trust
-PASS workflow_trust_requires_completed_deny_and_privilege_readback
-PASS authority_deadline_is_bounded_and_retry_does_not_renew_it
-PASS uncertain_publication_cannot_be_settled_from_an_absent_cell
-PASS unknown_policy_and_unowned_grants_never_authorize_changes
-PASS authority_retirement_preserves_existing_human_and_foreign_access
-PASS bootstrap_authority_requires_an_organization_resource
-PASS definite_publication_rejection_is_distinct_from_unknown_commit
-PASS deny_propagation_retry_requires_live_authority_and_a_remaining_budget
-PASS cleanup_dependency_does_not_wait_for_successful_deny_installation
-PASS authority_beneficiary_requires_the_verified_stable_google_subject
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/organization-receipt.json b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/organization-receipt.json
deleted file mode 100644
index 68ca89d3178..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/organization-receipt.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "source_revision": "70009ad9d2c8f184153976576f5a1ec2211da1b3",
-  "binary_sha256": "179882133a4c03958a1bed8a8b444ea06e48c63a6c42263ff83694508825b415",
-  "closure_modules": 843,
-  "closure_manifest_sha256": "73b2373809d4b41d22cf8d00db62dc996afd06042a28b676409e735b6b3653ca",
-  "memory_max": "6G",
-  "memory_swap_max": 0,
-  "focused_controls_passed": 12,
-  "authority_operation": "deny-bootstrap-org-20260928-1",
-  "authority_expires_at": "2026-09-28T23:15:00Z",
-  "organization": "organizations/266638272282",
-  "operator_subject": "116084671989231734979",
-  "operator_member": "user:brian@gunb.ai",
-  "cloud_status": "temporary authority granted and read back; deny policy installed and read back; temporary authority removed and absence verified; capabilities stopped at missing pool policy etag",
-  "full_landing_suite": "not run",
-  "workflow_trust": "not enabled",
-  "credential_file_removed": true,
-  "pool_policy_readback": {
-    "http": 200,
-    "etag_header": null,
-    "policy": {}
-  },
-  "remaining_dependency": "safe initial pool IAM policy publication with concurrency protection"
-}
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/project-ancestry-readback.json b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/project-ancestry-readback.json
deleted file mode 100644
index a8c927d63d3..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/project-ancestry-readback.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "endpoint": "https://cloudresourcemanager.googleapis.com/v3/projects/gunbai-secrets",
-  "observation": "read-only authenticated API research; native convergence rereads this before publication",
-  "name": "projects/582015116396",
-  "projectId": "gunbai-secrets",
-  "parent": "organizations/266638272282",
-  "state": "ACTIVE"
-}
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/project-scope-rejected.log b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/project-scope-rejected.log
deleted file mode 100644
index 68eee46624a..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/project-scope-rejected.log
+++ /dev/null
@@ -1,86 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 23 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-[file] read <private-temporary-token-file>
-[file] write_create_new target/gcp-iam-bootstrap-20260928-authority-1-started.txt (54 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[file] write_create_new target/gcp-iam-bootstrap-20260928-authority-1-identities.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeCreate
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeProvider
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObservePool
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveAccount
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveSecret
-[file] write_create_new target/gcp-iam-bootstrap-20260928-authority-1-roles.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies/gunbc-iam-converge-boundary
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:getIamPolicy
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-20260928-1-intent.txt (344 bytes)
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-20260928-1-publication-elected.txt (344 bytes)
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:setIamPolicy
-[file] write_create_new target/gcp-iam-bootstrap-20260928-authority-1-deny.txt (230 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-authority mutation not established; recovery remains owed: status 400: {
-  "error": {
-    "code": 400,
-    "message": "Role roles/iam.denyAdmin is not supported for this resource.",
-    "status": "INVALID_ARGUMENT"
-  }
-}
-; authority cleanup outstanding: authority dependency unresolved: expired, unowned, or publication may still commit; no grant retry or renewal
diff --git a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/receipt.json b/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/receipt.json
deleted file mode 100644
index ae232277a9b..00000000000
--- a/docs/plans/receipts/gcp-iam-bootstrap-authority-2026-09-28/receipt.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "source_revision": "e413906c2a71e3268ddf4b93d0327f3d1becf2d4",
-  "binary_sha256": "179882133a4c03958a1bed8a8b444ea06e48c63a6c42263ff83694508825b415",
-  "closure_modules": 842,
-  "closure_manifest_sha256": "6befe7f9b00c41861cdccb76e1a7c25868bde8a876ccbd083b52c31ea905a73d",
-  "memory_max": "6G",
-  "memory_swap_max": 0,
-  "focused_controls_passed": 7,
-  "authority_operation": "deny-bootstrap-20260928-1",
-  "authority_expires_at": "2026-09-28T23:00:00Z",
-  "cloud_status": "HTTP 400: Deny Admin is not grantable on a project; no grant applied",
-  "full_landing_suite": "not run",
-  "temporary_credentials_removed": true
-}
diff --git a/docs/plans/receipts/gcp-iam-pool-initialization-2026-09-29/README.md b/docs/plans/receipts/gcp-iam-pool-initialization-2026-09-29/README.md
deleted file mode 100644
index 1e751548a20..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-initialization-2026-09-29/README.md
+++ /dev/null
@@ -1,24 +0,0 @@
-# Exclusive pool initialization source qualification
-
-The operator confirmed on 2026-09-29 that no other administrator will update the
-pool policies during this bootstrap. The change models a one-off initial policy
-publication under that exclusivity assumption, then requires an observed etag for
-all normal updates. This is not provider-enforced CAS during initialization.
-
-All 15 focused controls passed under 6 GiB with no swap, using the branch release
-binary and 843 byte-identical dependency modules. Controls distinguish empty
-wire policies from update authority and reject nonempty unfenced policies,
-unsupported policy versions, existing audit configuration, undeclared pools,
-and incomplete or revisionless initialization readback.
-
-The complete bootstrap module typechecked in this closure. The new cloud-write
-path and interrupted-publication recovery have not been exercised against GCP.
-No live pool initialization or workflow credential-minting acceptance is claimed.
-The create-only publication journal stays in the same recovery workspace; an
-uncertain publication cannot be retried from a fresh workspace.
-
-An existing administrator credential is still needed for initial bootstrap. The
-normal approval workflow first authenticates as iam-observe through its dedicated
-pool, then requests approval and obtains iam-converge credentials. Its initial
-trust is not yet installed, so it cannot create that trust for itself. There is
-no usable gcloud installation, ADC file, or configured token file in this shell.
diff --git a/docs/plans/receipts/gcp-iam-pool-initialization-2026-09-29/controls.log b/docs/plans/receipts/gcp-iam-pool-initialization-2026-09-29/controls.log
deleted file mode 100644
index c0cc6807ad4..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-initialization-2026-09-29/controls.log
+++ /dev/null
@@ -1,19 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 20 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-PASS bootstrap_role_drift_never_authorizes_adoption
-PASS deny_exceptions_and_incomplete_readback_withhold_trust
-PASS workflow_trust_requires_completed_deny_and_privilege_readback
-PASS authority_deadline_is_bounded_and_retry_does_not_renew_it
-PASS uncertain_publication_cannot_be_settled_from_an_absent_cell
-PASS unknown_policy_and_unowned_grants_never_authorize_changes
-PASS authority_retirement_preserves_existing_human_and_foreign_access
-PASS bootstrap_authority_requires_an_organization_resource
-PASS definite_publication_rejection_is_distinct_from_unknown_commit
-PASS deny_propagation_retry_requires_live_authority_and_a_remaining_budget
-PASS cleanup_dependency_does_not_wait_for_successful_deny_installation
-PASS authority_beneficiary_requires_the_verified_stable_google_subject
-PASS empty_pool_policy_does_not_authorize_unconditional_publication
-PASS pool_initialization_rejects_existing_unfenced_bindings
-PASS pool_initialization_readback_requires_exact_cells_and_a_revision
diff --git a/docs/plans/receipts/gcp-iam-pool-initialization-2026-09-29/receipt.json b/docs/plans/receipts/gcp-iam-pool-initialization-2026-09-29/receipt.json
deleted file mode 100644
index a4206b1529a..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-initialization-2026-09-29/receipt.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "source_revision": "07c17deb9eba5a1b545d68e56fddbfacac1c94e4",
-  "binary_sha256": "179882133a4c03958a1bed8a8b444ea06e48c63a6c42263ff83694508825b415",
-  "closure_modules": 843,
-  "memory_max": "6G",
-  "memory_swap_max": 0,
-  "focused_controls_passed": 15,
-  "live_pool_initialization": "not executed",
-  "full_landing_suite": "not run",
-  "credential_dependency": "existing administrator credential; normal workflow initial federation still awaits bootstrap"
-}
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/apply.log b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/apply.log
deleted file mode 100644
index 320d988a0d7..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/apply.log
+++ /dev/null
@@ -1,244 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 23 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-[file] read <private-temporary-token-file>
-[file] write_create_new target/gcp-iam-bootstrap-20260929-pool-initialization-1-started.txt (54 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[file] write_create_new target/gcp-iam-bootstrap-20260929-pool-initialization-1-identities.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeCreate
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeProvider
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObservePool
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveAccount
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveSecret
-[file] write_create_new target/gcp-iam-bootstrap-20260929-pool-initialization-1-roles.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies/gunbc-iam-converge-boundary
-[file] write_create_new target/gcp-iam-bootstrap-20260929-pool-initialization-1-deny.txt (78 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt (397 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[file] write_create_new target/gcp-iam-bootstrap-20260929-pool-initialization-1-authority-cleanup.txt (78 bytes)
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] GET https://openidconnect.googleapis.com/v1/userinfo
-[file] write_create_new target/gcp-iam-pool-initialization-github-heal-publisher-elected.txt (438 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[file] write_create_new target/gcp-iam-pool-initialization-github-heal-publisher-closed.txt (438 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:setIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] GET https://openidconnect.googleapis.com/v1/userinfo
-[file] write_create_new target/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt (439 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[file] write_create_new target/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt (439 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:getIamPolicy
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:setIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:getIamPolicy
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:setIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] GET https://openidconnect.googleapis.com/v1/userinfo
-[file] write_create_new target/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt (437 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[file] write_create_new target/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt (437 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:getIamPolicy
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:setIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:setIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:getIamPolicy
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:setIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:getIamPolicy
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:setIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:getIamPolicy
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:setIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-gcp-iam-converge-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-gcp-iam-converge-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge:getIamPolicy
-[rest] GET https://openidconnect.googleapis.com/v1/userinfo
-[file] write_create_new target/gcp-iam-pool-initialization-github-gcp-iam-converge-elected.txt (282 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge:getIamPolicy
-[file] write_create_new target/gcp-iam-pool-initialization-github-gcp-iam-converge-closed.txt (282 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:getIamPolicy
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:setIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:getIamPolicy
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:setIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:getIamPolicy
-[file] write_create_new target/gcp-iam-bootstrap-20260929-pool-initialization-1-capabilities.txt (78 bytes)
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-[file] write_create_new target/gcp-iam-bootstrap-20260929-pool-initialization-1-privilege-readback.txt (1028 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt (397 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-apply-account readback credential unavailable; workflow trust withheld: status 403: {
-  "error": {
-    "code": 403,
-    "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist). Remediate access with this Troubleshooter URL or share it with your administrator - https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWE5My04Mzg0LTcwNzItYmI4OC04MjJiYWNlNzVkMGISAA%3D%3D .",
-    "status": "PERMISSION_DENIED",
-    "details": [
-      {
-        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
-        "reason": "IAM_PERMISSION_DENIED",
-        "domain": "iam.googleapis.com",
-        "metadata": {
-          "error_info_id": "CiQwMWEwZWE5My04Mzg0LTcwNzItYmI4OC04MjJiYWNlNzVkMGISAA==",
-          "permission": "iam.serviceAccounts.getAccessToken",
-          "troubleshooter_url": "https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWE5My04Mzg0LTcwNzItYmI4OC04MjJiYWNlNzVkMGISAA%3D%3D"
-        }
-      }
-    ]
-  }
-}
-
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-authority-cleanup.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-authority-cleanup.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-authority-cleanup.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-capabilities.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-capabilities.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-capabilities.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-deny.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-deny.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-deny.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-identities.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-identities.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-identities.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-privilege-readback.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-privilege-readback.txt
deleted file mode 100644
index 7b6068988cd..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-privilege-readback.txt
+++ /dev/null
@@ -1,19 +0,0 @@
-refused: apply-account readback credential unavailable; workflow trust withheld: status 403: {
-  "error": {
-    "code": 403,
-    "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist). Remediate access with this Troubleshooter URL or share it with your administrator - https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWE5My04Mzg0LTcwNzItYmI4OC04MjJiYWNlNzVkMGISAA%3D%3D .",
-    "status": "PERMISSION_DENIED",
-    "details": [
-      {
-        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
-        "reason": "IAM_PERMISSION_DENIED",
-        "domain": "iam.googleapis.com",
-        "metadata": {
-          "error_info_id": "CiQwMWEwZWE5My04Mzg0LTcwNzItYmI4OC04MjJiYWNlNzVkMGISAA==",
-          "permission": "iam.serviceAccounts.getAccessToken",
-          "troubleshooter_url": "https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWE5My04Mzg0LTcwNzItYmI4OC04MjJiYWNlNzVkMGISAA%3D%3D"
-        }
-      }
-    ]
-  }
-}
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-roles.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-roles.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-roles.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-started.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-started.txt
deleted file mode 100644
index b286fc75b3e..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-bootstrap-20260929-pool-initialization-1-started.txt
+++ /dev/null
@@ -1 +0,0 @@
-operator bootstrap started; not a convergence receipt
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-gcp-iam-converge-closed.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-gcp-iam-converge-closed.txt
deleted file mode 100644
index d87ad974c40..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-gcp-iam-converge-closed.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-exclusive-pool-policy-initialization-20260929
-projects/582015116396/locations/global/workloadIdentityPools/github-gcp-iam-converge
-role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-gcp-iam-converge-elected.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-gcp-iam-converge-elected.txt
deleted file mode 100644
index d87ad974c40..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-gcp-iam-converge-elected.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-exclusive-pool-policy-initialization-20260929
-projects/582015116396/locations/global/workloadIdentityPools/github-gcp-iam-converge
-role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-heal-publisher-closed.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-heal-publisher-closed.txt
deleted file mode 100644
index b195bdceb73..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-heal-publisher-closed.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-exclusive-pool-policy-initialization-20260929
-projects/582015116396/locations/global/workloadIdentityPools/github-heal-publisher
-role:54:projects/gunbai-secrets/roles/gunbcIamConvergeProvider;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-heal-publisher-elected.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-heal-publisher-elected.txt
deleted file mode 100644
index b195bdceb73..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-heal-publisher-elected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-exclusive-pool-policy-initialization-20260929
-projects/582015116396/locations/global/workloadIdentityPools/github-heal-publisher
-role:54:projects/gunbai-secrets/roles/gunbcIamConvergeProvider;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt
deleted file mode 100644
index f4d0845f19d..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-exclusive-pool-policy-initialization-20260929
-projects/582015116396/locations/global/workloadIdentityPools/github-mtcollins1-boot
-role:54:projects/gunbai-secrets/roles/gunbcIamConvergeProvider;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt
deleted file mode 100644
index f4d0845f19d..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-exclusive-pool-policy-initialization-20260929
-projects/582015116396/locations/global/workloadIdentityPools/github-mtcollins1-boot
-role:54:projects/gunbai-secrets/roles/gunbcIamConvergeProvider;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt
deleted file mode 100644
index ece3b479b8e..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-exclusive-pool-policy-initialization-20260929
-projects/582015116396/locations/global/workloadIdentityPools/github-namecheap-dns
-role:54:projects/gunbai-secrets/roles/gunbcIamConvergeProvider;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt
deleted file mode 100644
index ece3b479b8e..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-exclusive-pool-policy-initialization-20260929
-projects/582015116396/locations/global/workloadIdentityPools/github-namecheap-dns
-role:54:projects/gunbai-secrets/roles/gunbcIamConvergeProvider;member:66:serviceAccount:iam-converge@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
-role:49:projects/gunbai-secrets/roles/gunbcIamObservePool;member:65:serviceAccount:iam-observe@gunbai-secrets.iam.gserviceaccount.com;condition:4:none;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/receipt.json b/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/receipt.json
deleted file mode 100644
index b2159f7436f..00000000000
--- a/docs/plans/receipts/gcp-iam-pool-live-2026-09-29/receipt.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "source_revision": "be068166e93def4ab273b3d4cd11c5476a182e57",
-  "pool_initialization": "completed with readbacks and revision tokens",
-  "capabilities": "completed",
-  "privilege_readback": "refused: operator lacks iam.serviceAccounts.getAccessToken on iam-converge",
-  "workflow_trust": "not granted",
-  "temporary_deny_authority": "absence reverified",
-  "temporary_token_file": "removed",
-  "memory_max": "6G",
-  "memory_swap_max": 0
-}
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/apply.log b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/apply.log
deleted file mode 100644
index dcf9fd23b54..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/apply.log
+++ /dev/null
@@ -1,404 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 20 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-[file] read <private-temporary-token-file>
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-1-started.txt (54 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-1-identities.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeCreate
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeProvider
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObservePool
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveAccount
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveSecret
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/roles
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-1-roles.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies/gunbc-iam-converge-boundary
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-1-deny.txt (78 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt (397 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-1-authority-cleanup.txt (78 bytes)
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-gcp-iam-converge-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-gcp-iam-converge-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:getIamPolicy
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-1-capabilities.txt (78 bytes)
-[rest] GET https://openidconnect.googleapis.com/v1/userinfo
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt (427 bytes)
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt (427 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (427 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (427 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt (426 bytes)
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt (426 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (426 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (426 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-1-probe-authority.txt (78 bytes)
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 1ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 1ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 1ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 2 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-1-privilege-readback.txt (1028 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (427 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt (427 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (426 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt (426 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt (397 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-apply-account readback credential unavailable; workflow trust withheld: status 403: {
-  "error": {
-    "code": 403,
-    "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist). Remediate access with this Troubleshooter URL or share it with your administrator - https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWE5ZS05ODlkLTcwZjYtOTRiZS1hOTZmNWI2NjYwNjMSAA%3D%3D .",
-    "status": "PERMISSION_DENIED",
-    "details": [
-      {
-        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
-        "reason": "IAM_PERMISSION_DENIED",
-        "domain": "iam.googleapis.com",
-        "metadata": {
-          "troubleshooter_url": "https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWE5ZS05ODlkLTcwZjYtOTRiZS1hOTZmNWI2NjYwNjMSAA%3D%3D",
-          "permission": "iam.serviceAccounts.getAccessToken",
-          "error_info_id": "CiQwMWEwZWE5ZS05ODlkLTcwZjYtOTRiZS1hOTZmNWI2NjYwNjMSAA=="
-        }
-      }
-    ]
-  }
-}
-
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/controls.log b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/controls.log
deleted file mode 100644
index 6fdb2b3d97e..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/controls.log
+++ /dev/null
@@ -1,21 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 23 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-PASS bootstrap_role_drift_never_authorizes_adoption
-PASS deny_exceptions_and_incomplete_readback_withhold_trust
-PASS workflow_trust_requires_completed_deny_and_privilege_readback
-PASS authority_deadline_is_bounded_and_retry_does_not_renew_it
-PASS uncertain_publication_cannot_be_settled_from_an_absent_cell
-PASS unknown_policy_and_unowned_grants_never_authorize_changes
-PASS authority_retirement_preserves_existing_human_and_foreign_access
-PASS bootstrap_authority_requires_an_organization_resource
-PASS definite_publication_rejection_is_distinct_from_unknown_commit
-PASS deny_propagation_retry_requires_live_authority_and_a_remaining_budget
-PASS cleanup_dependency_does_not_wait_for_successful_deny_installation
-PASS authority_beneficiary_requires_the_verified_stable_google_subject
-PASS empty_pool_policy_does_not_authorize_unconditional_publication
-PASS pool_initialization_rejects_existing_unfenced_bindings
-PASS pool_initialization_readback_requires_exact_cells_and_a_revision
-PASS probe_authority_has_no_signing_or_policy_permission
-PASS probe_cleanup_is_required_for_trust_but_not_successful_probes
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-authority-cleanup.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-authority-cleanup.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-authority-cleanup.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-capabilities.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-capabilities.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-capabilities.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-deny.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-deny.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-deny.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-identities.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-identities.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-identities.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-privilege-readback.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-privilege-readback.txt
deleted file mode 100644
index 46c242cbff9..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-privilege-readback.txt
+++ /dev/null
@@ -1,19 +0,0 @@
-refused: apply-account readback credential unavailable; workflow trust withheld: status 403: {
-  "error": {
-    "code": 403,
-    "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist). Remediate access with this Troubleshooter URL or share it with your administrator - https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWE5ZS05ODlkLTcwZjYtOTRiZS1hOTZmNWI2NjYwNjMSAA%3D%3D .",
-    "status": "PERMISSION_DENIED",
-    "details": [
-      {
-        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
-        "reason": "IAM_PERMISSION_DENIED",
-        "domain": "iam.googleapis.com",
-        "metadata": {
-          "troubleshooter_url": "https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWEwZWE5ZS05ODlkLTcwZjYtOTRiZS1hOTZmNWI2NjYwNjMSAA%3D%3D",
-          "permission": "iam.serviceAccounts.getAccessToken",
-          "error_info_id": "CiQwMWEwZWE5ZS05ODlkLTcwZjYtOTRiZS1hOTZmNWI2NjYwNjMSAA=="
-        }
-      }
-    ]
-  }
-}
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-probe-authority.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-probe-authority.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-probe-authority.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-roles.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-roles.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-roles.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-started.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-started.txt
deleted file mode 100644
index b286fc75b3e..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-1-started.txt
+++ /dev/null
@@ -1 +0,0 @@
-operator bootstrap started; not a convergence receipt
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
deleted file mode 100644
index ed615588743..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-1;condition-expression:48:request.time < timestamp('2026-09-29T01:05:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
deleted file mode 100644
index ed615588743..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-1;condition-expression:48:request.time < timestamp('2026-09-29T01:05:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
deleted file mode 100644
index ed615588743..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-1;condition-expression:48:request.time < timestamp('2026-09-29T01:05:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
deleted file mode 100644
index ed615588743..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-1;condition-expression:48:request.time < timestamp('2026-09-29T01:05:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
deleted file mode 100644
index 10de7ae96f7..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-1;condition-expression:48:request.time < timestamp('2026-09-29T01:05:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
deleted file mode 100644
index 10de7ae96f7..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-1;condition-expression:48:request.time < timestamp('2026-09-29T01:05:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
deleted file mode 100644
index 10de7ae96f7..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-1;condition-expression:48:request.time < timestamp('2026-09-29T01:05:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
deleted file mode 100644
index 10de7ae96f7..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/gcp-iam-probe-probe-20260929-1-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-1;condition-expression:48:request.time < timestamp('2026-09-29T01:05:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/receipt.json b/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/receipt.json
deleted file mode 100644
index 5eec823bba3..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-authority-2026-09-29/receipt.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "source_revision": "da6f77d4bd3929d41c6ea4a58093420a6a4cb7d4",
-  "binary_sha256": "179882133a4c03958a1bed8a8b444ea06e48c63a6c42263ff83694508825b415",
-  "focused_controls_passed": 17,
-  "closure_modules": 843,
-  "memory_max": "6G",
-  "memory_swap_max": 0,
-  "probe_operation": "probe-20260929-1",
-  "probe_deadline": "2026-09-29T01:05:00Z",
-  "cloud_status": "both temporary probe grants installed and read back; token mint refused through bounded retry; both grants removed and absence verified; workflow trust withheld",
-  "full_landing_suite": "not run",
-  "temporary_token_file": "removed",
-  "mint_attempts": 30
-}
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/apply.log b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/apply.log
deleted file mode 100644
index f3988596a10..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/apply.log
+++ /dev/null
@@ -1,352 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 23 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-[file] read <private-temporary-token-file>
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-2-started.txt (54 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-2-identities.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeCreate
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeProvider
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObservePool
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveAccount
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveSecret
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-2-roles.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies/gunbc-iam-converge-boundary
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-2-deny.txt (78 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 1ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt (397 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-2-authority-cleanup.txt (78 bytes)
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-gcp-iam-converge-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-gcp-iam-converge-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:getIamPolicy
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-2-capabilities.txt (78 bytes)
-[rest] GET https://openidconnect.googleapis.com/v1/userinfo
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt (427 bytes)
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt (427 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (427 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (427 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt (426 bytes)
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt (426 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (426 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (426 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-2-probe-authority.txt (78 bytes)
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:testIamPermissions
-[file] write_create_new target/gcp-iam-bootstrap-20260929-probe-authority-2-privilege-readback.txt (1828 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (427 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt (427 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (426 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt (426 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt (397 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-status 403: {
-  "error": {
-    "code": 403,
-    "message": "Cloud Resource Manager API has not been used in project 582015116396 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudresourcemanager.googleapis.com/overview?project=582015116396 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
-    "status": "PERMISSION_DENIED",
-    "details": [
-      {
-        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
-        "reason": "SERVICE_DISABLED",
-        "domain": "googleapis.com",
-        "metadata": {
-          "containerInfo": "582015116396",
-          "service": "cloudresourcemanager.googleapis.com",
-          "consumer": "projects/582015116396",
-          "serviceTitle": "Cloud Resource Manager API",
-          "activationUrl": "https://console.developers.google.com/apis/api/cloudresourcemanager.googleapis.com/overview?project=582015116396"
-        }
-      },
-      {
-        "@type": "type.googleapis.com/google.rpc.LocalizedMessage",
-        "locale": "en-US",
-        "message": "Cloud Resource Manager API has not been used in project 582015116396 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudresourcemanager.googleapis.com/overview?project=582015116396 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry."
-      },
-      {
-        "@type": "type.googleapis.com/google.rpc.Help",
-        "links": [
-          {
-            "description": "Google developers console API activation",
-            "url": "https://console.developers.google.com/apis/api/cloudresourcemanager.googleapis.com/overview?project=582015116396"
-          }
-        ]
-      }
-    ]
-  }
-}
-
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-authority-cleanup.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-authority-cleanup.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-authority-cleanup.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-capabilities.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-capabilities.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-capabilities.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-deny.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-deny.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-deny.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-identities.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-identities.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-identities.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-privilege-readback.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-privilege-readback.txt
deleted file mode 100644
index ebc3b097d9f..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-privilege-readback.txt
+++ /dev/null
@@ -1,35 +0,0 @@
-refused: status 403: {
-  "error": {
-    "code": 403,
-    "message": "Cloud Resource Manager API has not been used in project 582015116396 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudresourcemanager.googleapis.com/overview?project=582015116396 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
-    "status": "PERMISSION_DENIED",
-    "details": [
-      {
-        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
-        "reason": "SERVICE_DISABLED",
-        "domain": "googleapis.com",
-        "metadata": {
-          "containerInfo": "582015116396",
-          "service": "cloudresourcemanager.googleapis.com",
-          "consumer": "projects/582015116396",
-          "serviceTitle": "Cloud Resource Manager API",
-          "activationUrl": "https://console.developers.google.com/apis/api/cloudresourcemanager.googleapis.com/overview?project=582015116396"
-        }
-      },
-      {
-        "@type": "type.googleapis.com/google.rpc.LocalizedMessage",
-        "locale": "en-US",
-        "message": "Cloud Resource Manager API has not been used in project 582015116396 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudresourcemanager.googleapis.com/overview?project=582015116396 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry."
-      },
-      {
-        "@type": "type.googleapis.com/google.rpc.Help",
-        "links": [
-          {
-            "description": "Google developers console API activation",
-            "url": "https://console.developers.google.com/apis/api/cloudresourcemanager.googleapis.com/overview?project=582015116396"
-          }
-        ]
-      }
-    ]
-  }
-}
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-probe-authority.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-probe-authority.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-probe-authority.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-roles.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-roles.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-roles.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-started.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-started.txt
deleted file mode 100644
index b286fc75b3e..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-bootstrap-20260929-probe-authority-2-started.txt
+++ /dev/null
@@ -1 +0,0 @@
-operator bootstrap started; not a convergence receipt
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
deleted file mode 100644
index 8157e104a58..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-2;condition-expression:48:request.time < timestamp('2026-09-29T01:15:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
deleted file mode 100644
index 8157e104a58..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-2;condition-expression:48:request.time < timestamp('2026-09-29T01:15:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
deleted file mode 100644
index 8157e104a58..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-2;condition-expression:48:request.time < timestamp('2026-09-29T01:15:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
deleted file mode 100644
index 8157e104a58..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-2;condition-expression:48:request.time < timestamp('2026-09-29T01:15:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
deleted file mode 100644
index d91803eb262..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-2;condition-expression:48:request.time < timestamp('2026-09-29T01:15:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
deleted file mode 100644
index d91803eb262..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-2;condition-expression:48:request.time < timestamp('2026-09-29T01:15:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
deleted file mode 100644
index d91803eb262..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-2;condition-expression:48:request.time < timestamp('2026-09-29T01:15:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
deleted file mode 100644
index d91803eb262..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/gcp-iam-probe-probe-20260929-2-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-2;condition-expression:48:request.time < timestamp('2026-09-29T01:15:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/receipt.json b/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/receipt.json
deleted file mode 100644
index 3583953c60c..00000000000
--- a/docs/plans/receipts/gcp-iam-probe-propagation-2026-09-29/receipt.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "source_revision": "1630eddc7",
-  "mint_attempts": 17,
-  "token_mint": "succeeded",
-  "positive_probe": "refused SERVICE_DISABLED cloudresourcemanager.googleapis.com for project 582015116396",
-  "temporary_grants": "both removed and absence read back",
-  "workflow_trust": "withheld",
-  "credential_file": "removed"
-}
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/README.md b/docs/plans/receipts/gcp-iam-services-2026-09-29/README.md
deleted file mode 100644
index 4bcaa3f7825..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/README.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# Successful GCP IAM bootstrap, 2026-09-29
-
-At source `85bdb4e19`, all ten modeled bootstrap stages completed with exit 0.
-Cloud Resource Manager was enabled and independently read back on the exact
-project; the other required APIs were already enabled. Resource-specific grants,
-positive and negative permission probes, and the observer estate read succeeded.
-The observer could read the pinned approval-submission credential; the writer
-received exact HTTP 403 reading that same known-readable credential.
-
-Both temporary exact-account probe grants were removed and absence verified
-before the final observer/apply workload-trust bindings were installed/read back.
-The earlier temporary organization Deny Admin grant was also verified absent.
-Issued probe tokens retain their original 600-second lifetime; grant removal is
-not revocation of already issued tokens. The operator credential file was removed.
-
-18 focused controls passed over 844 byte-identical modules under 6 GiB/no swap.
-The full landing suite was not run. This is bootstrap commissioning, not a VM
-allocation or a completed approval-workflow acceptance run.
-
-Workflow acceptance was separately dispatched on main as run `36505895733`,
-source `15b977d417c1a7de52eae96f48bcd3955fb1f94c`, mode `gcp_iam_converge`, host
-`srv1`. That run uses its own GitHub OIDC credentials, not the supplied operator
-token. Its success and approval delivery must be established independently.
-
-The acceptance run subsequently completed its release build and its observer
-GitHub OIDC authentication step successfully. The plan/file/wait step remains
-in progress; approval delivery, apply authentication, and apply/readback have
-not yet been established.
-
-Attempt 1 subsequently passed request approval and writer GitHub OIDC
-impersonation. Apply accepted a Namecheap provider creation, then refused because
-the created subject was not yet visible on immediate readback. No later effects
-were applied. This is a partial cloud change, not a successful estate convergence.
-
-Attempt 2 reruns the failed job on the same source, with a fresh run-attempt
-identity and a freshly observed plan. It has passed approval and writer OIDC
-impersonation and is executing apply/readback. No administrator token is involved.
-
-Attempt 2 completed successfully. The existing approval app admitted the fresh
-request; the apply identity was minted only afterward, and the existing workflow
-completed its approved effects and readback. Run: https://github.com/gunb-ai/gunbc/actions/runs/36505895733/attempts/2 .
-This closes the ordinary GCP IAM workflow acceptance case, not host credential
-custody, protected storage commissioning, or VM acceptance.
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/apply.log b/docs/plans/receipts/gcp-iam-services-2026-09-29/apply.log
deleted file mode 100644
index 2bd54d5da0f..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/apply.log
+++ /dev/null
@@ -1,410 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 23 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-[file] read <private-temporary-token-file>
-[file] write_create_new target/gcp-iam-bootstrap-20260929-services-and-probes-1-started.txt (54 bytes)
-[rest] GET https://serviceusage.googleapis.com/v1/projects/gunbai-secrets/services/iam.googleapis.com
-[rest] GET https://serviceusage.googleapis.com/v1/projects/gunbai-secrets/services/iamcredentials.googleapis.com
-[rest] GET https://serviceusage.googleapis.com/v1/projects/gunbai-secrets/services/cloudresourcemanager.googleapis.com
-[rest] POST https://serviceusage.googleapis.com/v1/projects/gunbai-secrets/services:batchEnable
-[rest] GET https://serviceusage.googleapis.com/v1/projects/gunbai-secrets/services/cloudresourcemanager.googleapis.com
-[rest] GET https://serviceusage.googleapis.com/v1/projects/gunbai-secrets/services/secretmanager.googleapis.com
-[rest] GET https://serviceusage.googleapis.com/v1/projects/gunbai-secrets/services/sts.googleapis.com
-[file] write_create_new target/gcp-iam-bootstrap-20260929-services-and-probes-1-services.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[file] write_create_new target/gcp-iam-bootstrap-20260929-services-and-probes-1-identities.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeCreate
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeProvider
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeAccountPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamConvergeSecretPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObservePool
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveAccount
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamObserveSecret
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken
-[file] write_create_new target/gcp-iam-bootstrap-20260929-services-and-probes-1-roles.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies/gunbc-iam-converge-boundary
-[file] write_create_new target/gcp-iam-bootstrap-20260929-services-and-probes-1-deny.txt (78 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt (397 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[file] write_create_new target/gcp-iam-bootstrap-20260929-services-and-probes-1-authority-cleanup.txt (78 bytes)
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-heal-publisher-private-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-mtcollins1-boot-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-namecheap-dns-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:getIamPolicy
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-gcp-iam-converge-elected.txt
-[file] list target
-[file] read target/gcp-iam-pool-initialization-github-gcp-iam-converge-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key:getIamPolicy
-[file] write_create_new target/gcp-iam-bootstrap-20260929-services-and-probes-1-capabilities.txt (78 bytes)
-[rest] GET https://openidconnect.googleapis.com/v1/userinfo
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt (427 bytes)
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt (427 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (427 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (427 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt (426 bytes)
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt (426 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (426 bytes)
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (426 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] write_create_new target/gcp-iam-bootstrap-20260929-services-and-probes-1-probe-authority.txt (78 bytes)
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 1ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 1ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 1ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-◐ started sleep.Delay.Seconds
-✓ sleep.Delay.Seconds done in 5 seconds
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-[rest] POST https://cloudresourcemanager.googleapis.com/v1/projects/gunbai-secrets:testIamPermissions
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher:testIamPermissions
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:testIamPermissions
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:testIamPermissions
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private:testIamPermissions
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:testIamPermissions
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot:testIamPermissions
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:testIamPermissions
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:testIamPermissions
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:testIamPermissions
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns:testIamPermissions
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:testIamPermissions
-[rest] POST https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:testIamPermissions
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:testIamPermissions
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:testIamPermissions
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-gcp-iam-converge:testIamPermissions
-[rest] POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:generateAccessToken
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-heal-publisher-private/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/heal-publisher-private@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/agent-github-app-private-key:getIamPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-mtcollins1-boot/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/mtcollins1-boot@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/bmc-mtcollins1-gunbc:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/fleet-automation-ssh-key:getIamPolicy
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/locations/global/workloadIdentityPools/github-namecheap-dns/providers
-[rest] GET https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/namecheap-dns@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/namecheap-api-key:getIamPolicy
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key/versions/1:access
-[rest] GET https://secretmanager.googleapis.com/v1/projects/gunbai-secrets/secrets/approval-submission-mac-key/versions/1:access
-[file] write_create_new target/gcp-iam-bootstrap-20260929-services-and-probes-1-privilege-readback.txt (78 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (427 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt (427 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt (426 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt (426 bytes)
-[file] write_create_new target/gcp-iam-bootstrap-20260929-services-and-probes-1-probe-cleanup.txt (78 bytes)
-[rest] GET https://iam.googleapis.com/v2/policies/cloudresourcemanager.googleapis.com%2Fprojects%2F582015116396/denypolicies/gunbc-iam-converge-boundary
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:setIamPolicy
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-[file] write_create_new target/gcp-iam-bootstrap-20260929-services-and-probes-1-workflow-trust.txt (78 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt (427 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[rest] POST https://iam.googleapis.com/v1/projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt (426 bytes)
-[file] list target
-[file] read target/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-intent.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-elected.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-publication-closed.txt
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
-[rest] POST https://cloudresourcemanager.googleapis.com/v3/organizations/266638272282:getIamPolicy
-◐ started Clock.Now
-✓ Clock.Now done in 2ms
-[file] write_create_new target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt (397 bytes)
-[file] list target
-[file] read target/gcp-iam-authority-deny-bootstrap-org-20260928-1-retired.txt
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/controls.log b/docs/plans/receipts/gcp-iam-services-2026-09-29/controls.log
deleted file mode 100644
index bcdab55c990..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/controls.log
+++ /dev/null
@@ -1,22 +0,0 @@
-[workspace-root] discovered /home/briansrls/scratch-wt/gcp-iam-bootstrap
-✓ typecheck v2.std.compilers.target_model done in 23 seconds
-✓ typecheck v2.compiler.target_serialize done in 2 seconds
-✓ typecheck v2.compiler.translate done in 3 seconds
-PASS bootstrap_role_drift_never_authorizes_adoption
-PASS deny_exceptions_and_incomplete_readback_withhold_trust
-PASS workflow_trust_requires_completed_deny_and_privilege_readback
-PASS authority_deadline_is_bounded_and_retry_does_not_renew_it
-PASS uncertain_publication_cannot_be_settled_from_an_absent_cell
-PASS unknown_policy_and_unowned_grants_never_authorize_changes
-PASS authority_retirement_preserves_existing_human_and_foreign_access
-PASS bootstrap_authority_requires_an_organization_resource
-PASS definite_publication_rejection_is_distinct_from_unknown_commit
-PASS deny_propagation_retry_requires_live_authority_and_a_remaining_budget
-PASS cleanup_dependency_does_not_wait_for_successful_deny_installation
-PASS authority_beneficiary_requires_the_verified_stable_google_subject
-PASS empty_pool_policy_does_not_authorize_unconditional_publication
-PASS pool_initialization_rejects_existing_unfenced_bindings
-PASS pool_initialization_readback_requires_exact_cells_and_a_revision
-PASS probe_authority_has_no_signing_or_policy_permission
-PASS probe_cleanup_is_required_for_trust_but_not_successful_probes
-PASS service_enablement_requires_enabled_state_on_the_exact_project
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-authority-cleanup.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-authority-cleanup.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-authority-cleanup.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-capabilities.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-capabilities.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-capabilities.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-deny.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-deny.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-deny.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-identities.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-identities.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-identities.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-privilege-readback.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-privilege-readback.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-privilege-readback.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-probe-authority.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-probe-authority.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-probe-authority.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-probe-cleanup.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-probe-cleanup.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-probe-cleanup.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-roles.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-roles.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-roles.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-services.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-services.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-services.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-started.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-started.txt
deleted file mode 100644
index b286fc75b3e..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-started.txt
+++ /dev/null
@@ -1 +0,0 @@
-operator bootstrap started; not a convergence receipt
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-workflow-trust.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-workflow-trust.txt
deleted file mode 100644
index 480da8f3ea6..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-bootstrap-20260929-services-and-probes-1-workflow-trust.txt
+++ /dev/null
@@ -1 +0,0 @@
-stage checks completed; see the stage authority for configuration/probe scope
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
deleted file mode 100644
index dc3646c20d9..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-intent.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-3;condition-expression:48:request.time < timestamp('2026-09-29T01:20:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
deleted file mode 100644
index dc3646c20d9..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-3;condition-expression:48:request.time < timestamp('2026-09-29T01:20:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
deleted file mode 100644
index dc3646c20d9..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-3;condition-expression:48:request.time < timestamp('2026-09-29T01:20:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
deleted file mode 100644
index dc3646c20d9..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-converge@gunbai-secrets.iam.gserviceaccount.com-retired.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-converge@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-3;condition-expression:48:request.time < timestamp('2026-09-29T01:20:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
deleted file mode 100644
index 384a398af82..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-intent.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-3;condition-expression:48:request.time < timestamp('2026-09-29T01:20:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
deleted file mode 100644
index 384a398af82..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-closed.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-3;condition-expression:48:request.time < timestamp('2026-09-29T01:20:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
deleted file mode 100644
index 384a398af82..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-publication-elected.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-3;condition-expression:48:request.time < timestamp('2026-09-29T01:20:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt b/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
deleted file mode 100644
index 384a398af82..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/gcp-iam-probe-probe-20260929-3-iam-observe@gunbai-secrets.iam.gserviceaccount.com-retired.txt
+++ /dev/null
@@ -1 +0,0 @@
-projects/gunbai-secrets/serviceAccounts/iam-observe@gunbai-secrets.iam.gserviceaccount.com;role:57:projects/gunbai-secrets/roles/gunbcIamBootstrapProbeToken;member:18:user:brian@gunb.ai;condition-title:38:gunbc-bootstrap-probe-probe-20260929-3;condition-expression:48:request.time < timestamp('2026-09-29T01:20:00Z');condition-description:83:Temporary exact-account bootstrap readback; physical cleanup required after expiry.;
\ No newline at end of file
diff --git a/docs/plans/receipts/gcp-iam-services-2026-09-29/receipt.json b/docs/plans/receipts/gcp-iam-services-2026-09-29/receipt.json
deleted file mode 100644
index 6e985b5b2a8..00000000000
--- a/docs/plans/receipts/gcp-iam-services-2026-09-29/receipt.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "source_revision": "85bdb4e19",
-  "binary_sha256": "179882133a4c03958a1bed8a8b444ea06e48c63a6c42263ff83694508825b415",
-  "focused_controls_passed": 18,
-  "closure_modules": 844,
-  "memory_max": "6G",
-  "memory_swap_max": 0,
-  "cloud_status": "all ten bootstrap stages completed; exit 0",
-  "probe_operation": "probe-20260929-3",
-  "probe_deadline": "2026-09-29T01:20:00Z",
-  "full_landing_suite": "not run",
-  "temporary_grants": "probe grants and prior deny grant absent on final independent readback",
-  "credential_file": "removed",
-  "newly_enabled_api": "cloudresourcemanager.googleapis.com",
-  "workflow_acceptance": {
-    "run_id": 36505895733,
-    "source_revision": "15b977d417c1a7de52eae96f48bcd3955fb1f94c",
-    "status": "dispatched; no success claimed"
-  }
-}
diff --git a/docs/plans/receipts/google-workspace-admin-api-2026-09-28.md b/docs/plans/receipts/google-workspace-admin-api-2026-09-28.md
deleted file mode 100644
index 089aa5a569c..00000000000
--- a/docs/plans/receipts/google-workspace-admin-api-2026-09-28.md
+++ /dev/null
@@ -1,41 +0,0 @@
-# Workspace administration API qualification — 2026-09-28
-
-This is documentation research, not a live organization readback. No credentials were
-provisioned and no Google-side setting was changed.
-
-| Control | Supported observation found | Mutation | Evidence |
-|---|---|---|---|
-| Auth Platform web client | Console readback | Manual console action | [Create clients](https://support.google.com/cloud/answer/15549257) |
-| Internal audience | Console readback | Manual console action | [Configure consent](https://developers.google.com/workspace/guides/configure-oauth-consent) |
-| This client's Specific Google data access | Console readback | Manual console action | [Control app access](https://support.google.com/a/answer/7281227) |
-| External directory sharing | Cloud Identity Policy API, `directory.external_directory_sharing` | API mutation unsupported; manual console action | [Supported settings](https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings), [admin control](https://knowledge.workspace.google.com/admin/users/let-third-party-apps-access-directory-data) |
-| Profile photo editing policy | Console readback | Manual console action | [Profile editing policy](https://knowledge.workspace.google.com/admin/users/allow-directory-users-to-change-their-profile-and-photo) |
-
-“No supported read found” is a dated qualification of these documented surfaces, not a claim
-that Google can never add an API. The Policy API inventory lists several global API-controls
-settings, but those are not the specific-client access control in row 3. The Directory API's
-user/photo operations are not an administration API for row 5. IAM `oauthClients` applies to
-[Workforce Identity Federation](https://docs.cloud.google.com/iam/docs/workforce-oauth-app),
-not the Auth Platform client in row 1.
-
-Row 4 values are `REQUESTER_BASIC_PROFILE_ONLY` and `ORGANIZATION_DIRECTORY_DATA`.
-Unspecified/unknown values are not evidence of either. The minimum desired value is the first;
-organization discovery requires an explicit rationale.
-
-A future supported observer uses [policies.list/get](https://docs.cloud.google.com/identity/docs/how-to/list-get-policies)
-with the separately approved `cloud-identity.policies.readonly` scope. Complete pagination and
-[effective-policy reduction](https://docs.cloud.google.com/identity/docs/concepts/policy-api-concepts)
-are required; a single raw policy is not necessarily the customer's effective policy. Unread
-OU/group overrides remain a refusal. Honor the documented quota and do not derive identity
-from the older SYSTEM-policy name/sort-order convention.
-
-The implementation's receipts bind customer/project/client/OU, typed setting, source,
-evidence reference, observation time and expiry. A receipt producer remains responsible for
-authenticating and durably retaining its evidence. The assessor is pure and cannot independently
-verify a screenshot or API response referenced by a caller. Fixture receipts are not deployment
-receipts. Matching scope/redirect lists are compared as sets, not presentation order.
-
-Validation: the focused Workspace claim suite uses a byte-identical import closure under the
-existing 6 GiB limit. It covers missing observations, mismatch, tenant isolation, reader admission,
-expiry/future timestamps, supported API setting identity, unresolved effective coverage and
-scope-order equivalence versus extra privilege. See the branch's validation receipt for results.
diff --git a/docs/plans/receipts/issue-cut1-command-boundary-2026-09-28.md b/docs/plans/receipts/issue-cut1-command-boundary-2026-09-28.md
deleted file mode 100644
index 5fc6c7b9b3e..00000000000
--- a/docs/plans/receipts/issue-cut1-command-boundary-2026-09-28.md
+++ /dev/null
@@ -1,47 +0,0 @@
-# Issue command boundary — 2026-09-28
-
-Base: `e286b29962c3b89904277c64d0e0c7cc25ddb2d0`, isolated branch
-`codex/issue-cut1-toposort`. The live checkout and authentication handlers are unchanged.
-
-The Git carrier now owns an isolated snapshot for each operation and publishes against the
-exact fetched remote ref. It checks the supplied issue-parent expectation in that snapshot,
-then publishes event and operation receipt in one commit. A remote movement refuses; it never
-silently rebases a stale command. This is a Git realization of revision CAS, not a migration
-to the held fabric-storage implementation.
-
-Operation identity binds node, authenticated principal, payload and original precondition.
-The committed receipt is checked before the current issue revision, so retry after another
-comment returns the original event/ordinal. Clock time is committed result data. Another
-operation with identical comment text is an intentional second comment. Native forms have
-server-minted keys and explicit empty-revision fields. Enhanced assignment preserves those
-keys; an inline lost-response retry retains the original command.
-
-The shared URL-encoded decoder handles native CRLF, Unicode, plus/percent encoding and
-field-looking multiline text without ambiguous newline framing. Duplicate decoded names,
-malformed percent escapes and invalid UTF-8 refuse. Missing expected revision is distinct
-from explicitly empty expected revision.
-
-Detail reads refuse unreadable/forked/incomplete issue history and derive standing, assignment
-and form revision from one event snapshot. The attempt observation is still not connected:
-the page explicitly reports that gap instead of claiming no attempts. Recents are suggestions
-and may degrade independently. This cut does not install a durable consumer for Fabric launch
-obligations; the existing first-time inline dispatch path remains. Retrying a committed command
-does not dispatch another worker.
-
-## Evidence and limits
-
-- Actual `.dag` command -> disposable Git remote -> readback: PASS, including same-key retry
-  after an intervening event, identical-body different command, stale revision and payload reuse.
-- Forced concurrent publication: PASS, exactly one event and one operation receipt committed.
-  Fixture receipt: `/tmp/gunbc-issue-command-yzokh_mx/receipt.json`.
-- Native Chromium POST fed into actual `.dag` decoder: PASS.
-- Emitted assignment client in Chromium with a lost response: PASS for native-form and inline
-  retry identity, including preventing a different inline payload from reusing a pending key.
-- Focused codec claims: 2 PASS. Focused carrier claims: 3 PASS.
-- Workspace administration claims are independent: 5 PASS.
-- Full serve witness closure: FAILED (exit 137 at the existing 6 GiB limit after serve typecheck).
-  This is not a passing integrated floor, merge approval or deployment receipt.
-
-All DAG executions use `MemoryMax=6G`, `MemorySwapMax=0`. Focused source closures are byte-identical
-copies with source hashes, not edited test substitutes. The checked-in wet/browser controls
-operate on disposable local fixtures, never production state. No memory ceiling was raised.
diff --git a/docs/plans/repo-stability-2026-08.md b/docs/plans/repo-stability-2026-08.md
deleted file mode 100644
index 048925cc365..00000000000
--- a/docs/plans/repo-stability-2026-08.md
+++ /dev/null
@@ -1,306 +0,0 @@
-# Repo stability plan — 2026-08-28 (living document)
-
-Working plan iterated with the operator. Subject: get the repository back to a
-stable place and keep it there. Maintained on branch
-`claude/repo-stability-priorities-frtsy4` until adopted.
-
-## Operator intent (recorded 2026-08-28)
-
-- CI required checks should take **~minutes at most**, not 40, not 100.
-- The desired mechanism is **minimal invocation** — affected-set / build-system-style
-  caching of test results between runs ("only run what changed").
-- **Witness rule:** every witness is a short, one-pass transformation contract.
-  Target budget per witness: **<5ms, eventually <1ms guaranteed**. Long
-  corpus-walk / integration / performance witnesses are POLICY VIOLATIONS —
-  the current 44 BUDGET-REFUSED rows are considered erroring/failing now,
-  not "budget too small".
-- The pattern to break: things reach "good enough" (e.g. 40-min CI) then spiral
-  (100 min) because nothing prices the derivative. v1 / reconcile / CI root work
-  keeps being avoided; it is admitted under the 2026-08-20 purpose ruling (in
-  support of v2 self-host; fixing issues is fine).
-
-## Measured state (2026-08-28, main @ e910a39)
-
-- `witnesses` required check: **red on every recent main run** with an
-  IDENTICAL set of 47 unexpected witness failures across runs (zero flake).
-  Latest measured: `planned=12949 executed=12949 passed=12615 known_red_held=33
-  failed=47 stale_quarantine=1 interrupted_before_verdict=44
-  completed_over_cost_requirement=2` (run 33145062452).
-- Wall: ~85–100 min/run (was ~30 min on 2026-08-22 at routed=10439).
-  `compile.reconcile` in strict-preparation: 22 min over 4187 modules
-  (15 min over 3892 on 2026-08-24 → superlinear; ~92% attributed to
-  `typecheck_with_census_extra`).
-- Roster growth: routed 10439 → 12949 in 6 days (+24%).
-- Queue: 26 main-push runs queued at once (main pushes never coalesce);
-  operator: not a priority right now.
-- srv1 belt/daily workspace: DOWN since 2026-08-20. `/opt/gunbc/gunbc` is
-  ~664 commits behind the admitted fleet revision; belt ticks exit 0 and
-  refuse to spawn (diagnosed in #9559). Convergence chain landed
-  (#9506 → #9555 → #9563 → #9576) but `fleet-converge.yml` is
-  workflow_dispatch-only and the apply has not been run.
-
-## Priorities
-
-### P1 — CI to ~minutes: minimal invocation + short witnesses
-
-The two whole-corpus terms (fold ~30 min, reconcile 22 min) reach minutes only
-by not redoing unchanged work, never by optimization. Plan:
-
-1. **Hoist corpus walks out of witnesses into run-once indexes**
-   (`declaration_index` pattern: the required parse sweep derives the facts
-   once; witnesses read the index in ms). Dominant violator families among
-   the 44 BUDGET-REFUSED rows: `grammar_coverage_*` (65–69s),
-   `enforcement_live_*` (52–60s), `cost_coverage_*` (54–62s),
-   `vocabulary_containment` (~30s), plus assorted 5s rows.
-   This fixes ~40 of 44 policy violations AND removes minutes of cold cost.
-2. **Closure-digest verdict store (the affected-set mechanism, done the
-   cache way).** Key: (witness identity, closure content digest, binary
-   identity). Hit ⇒ stored verdict replayed as this run's verdict; miss ⇒
-   execute, fail-closed. No git-diff observation exists in the mechanism —
-   this is identity-derived, not diff-derived, which is what distinguishes
-   it from the deleted affected-set machinery and its absorbing failure
-   arms. Hosted in the v1 seed now (admitted: it gates all v2 work); the
-   durable artifacts (digest definition via `std.content_hash`, store
-   schema) survive the v2 cutover. Same treatment per-module for reconcile.
-3. **Cold backstop cadence:** scheduled whole-corpus uncached run;
-   cached-vs-cold divergence is a typed line-stop (the doc's own purity
-   oracle). The cache is never trusted, only checked.
-4. **Witness budget wall:** once violators are hoisted, enforce the short-
-   witness rule as a hard refusal (existing budget machinery already
-   refuses; today its refusals are ignored). Ratchet the ceiling down
-   toward the 5ms/1ms target as the population complies.
-5. **Derivative gate:** required run holds its own cost against a declared
-   policy budget (a §5-legal oracle) so regrowth stops the line the day it
-   lands, not six weeks later.
-6. stage0 cargo build: sccache / runner image — ordinary work, separate.
-
-First artifact (measurement, before building the store): compute closure
-digests over the roster on the current tree, replay the last ~10 main
-commits, report would-have-been hit rate + residual per-push cost.
-
-### P2 — Main back to green: the 47 standing reds
-
-Identical across runs; grouped by module (run 33145062452):
-doc_reachability (x6, v1+v2 copies), sole_constructor audit probes (x6),
-lens_module_gate (x3), quarantine_probe_disposition (x3), ci_budget_tree
-(x3), cost_coverage (x3), compiler_closure ingest/emit (x4), guarantee
-probes (x5), and singletons. Plus 1 STALE-QUARANTINE
-(`duplicate_definition_binding_probe_test` passes; remove from
-`v2.workflow.floor_expected_red`). Triage by shared root, not row-by-row; several sit in P1.1's corpus-scan
-families and get cheap after the hoist. Dispositions must be honest: fix, or
-expected-red with typed reason + trigger — never quarantine-to-green.
-
-### P3 — srv1 / roadmap daily workspace
-
-Run the fleet-converge plan → apply with the landed convergence chain;
-verify by the belt's own evidence (next tick spawns; dispatch_preflight
-refused_axis_count 5 → 0; fresh provider-events capture). Then consider a
-scheduled convergence so a 664-commit drift can never silently accumulate again
-(it was invisible for 8+ days because the belt exits 0).
-
-### P4 — Repo cleanup pass ("pristine")
-
-Top-level census (2026-08-28) and dispositions to decide per item:
-
-| Path | Size | Standing | Proposed disposition |
-|---|---|---|---|
-| `dag/` (2962 .dag) | 40M | live corpus | keep; audit `dag/examples/` (6 demo dirs — likely stale/scaffold) and `dag/config/` (1 file) |
-| `src/v1` | 17M | frozen seed + 13M `stage0/` mirror | keep (seed); no growth |
-| `src/v2` | 14M (1346 .dag) | active | keep; `experimental/` dir needs a disposition |
-| `docs/plans/` | **20M, 250 files** | mostly stale/pre-cut | classify each: live / completed / superseded / bankrupt; delete-first for the dead (bulk of the 20M) |
-| `dag/gunbc/plans/` | 66 files | dual home with docs/plans | decide the ONE home for plans; migrate or delete |
-| `docs/briefs/` | 8 files, all 2026-08-24 | one-day lane briefs | likely bankrupt with the measurement corpus; delete or fold into carriers |
-| `docs/probes/` | 1 file | recreated after the 2026-08-24 bankruptcy deleted the dir whole | violates the bankruptcy ruling's spirit; model or delete |
-| `docs/runbooks/` | 5 files | hand-authored ops docs | §6 out-of-band-actuation tells; keep only with dissolution obligations |
-| `docs/extdeps/lotes_azifa072/` | 428K | vendor pad-array data (CSV/SVG) | verify cited by a `.dag` authority; else relocate/delete |
-| `tools/*.txt,*.tsv` (5 files, ~1.1M) | receipts/manifests at repo root of `tools/` | transcribed measurement output — the class the bankruptcy deleted; delete or model (`m1c_bulk0_residual.tsv` modified TODAY — find the writer first) |
-| `fixtures/`, `test/fixture_roots` | 196K/20K | fixture carriers | keep; confirm all reachable from witnesses |
-| `artifacts/bmc/` | 24K | committed artifacts? | verify generated-artifact registry covers or delete |
-| `provider-runtime/codex/` | 24K | ? | classify: live realization or residue |
-| `DESIGN.md` / `ROADMAP.md` | 160K/58K | generated projections | verified by `generated-artifact` phase; keep |
-
-Rule for the pass: every deletion goes through the delete-first census
-(what refuses tells us what was load-bearing); anything kept must name its
-consumer; transcribed measurement outputs are debt regardless of accuracy.
-
-### P5 — Plans content refresh
-
-After P4 shrinks the population: rewrite the surviving live plans (floor-cut,
-namespace-cut, guarantee-recovery gap analysis, replacement-migration doctrine)
-against the current tree, so plan prose stops seeding sessions with dead premises.
-
-## Open operator decisions
-
-1. Ruling wanted: identity-derived verdict caching (P1.2) is NOT the
-   deleted diff-derived affected-set machinery — confirm it may be built,
-   with the cold cadence as its honesty backstop.
-2. Where do plans live: `docs/plans/` vs `dag/gunbc/plans/` (one home).
-3. P3 apply touches a live host — dispatch when ready.
-4. Main-push queue coalescing: deferred by operator (not a priority).
-
-## Log
-
-- 2026-08-28: created; measured state recorded; priorities agreed in session.
-- 2026-08-28: P4 first cut — deleted 21 orphan docs (15 docs/plans, 5 docs/briefs,
-  1 more) after a full reference census. Remaining candidate classes recorded in
-  session discussion: 27 docs referenced only by other docs (islands to cut whole),
-  ~200 docs/plans referenced from dag/src carriers, tools/ receipts (consumer:
-  srv1_residue_rehearsal path strings only), docs/probes single file (referenced by
-  lotes_azifa072.dag), runbooks (referenced by roadmap/actuate carriers).
-- 2026-08-28: P4 second cut — deleted tools/ receipt dumps (5 files, operator:
-  derived data is never committed; only .dag derivation code), 33 more stale
-  off-topic plan docs (closure-safe: refs only from snapshot strings/each other),
-  and src/v2/experimental/ (empty quarantine, failed concept per operator).
-  DEFERRED: 112 old off-topic plans cited by live carriers (roadmap_authority
-  ~25, dag plan carriers, cli_run.rs, lens modules) — need carrier-row edits;
-  dag/examples/ (witness-consumed: declared_type_inhabitance, cost_estimate_float,
-  bootstrap_witness.rs); artifacts/bmc (bmc_fan_program carriers consume);
-  provider-runtime/codex (codex witnesses consume).
-- 2026-08-28: P4 third cut — deleted docs/plans/receipts (13M, 73 files) and
-  docs/plans/measurements (456K) whole: persisted measurement dumps, operator-ruled
-  garbage (derived data is never committed; only the derivation code is). Every
-  in-tree mention verified to be prose (comments, note strings, srv1 snapshot rows,
-  a roadmap handback sentence) — no executing consumer reads any of these paths.
-  Those prose pointers now reference history, same status as any receipt citation.
-- 2026-08-28: P4 fourth cut — deleted the 112 deferred stale plan docs; flipped
-  48 plan carriers to PlanIsAuthorityOnly (registry row is what made each deleted
-  .md expected on disk — the a295e17415 precedent); stripped 45 comment-channel
-  pointers to deleted docs (13 files). DEFERRED to P5: string-field citations in
-  roadmap_authority.dag (~46 lines) and stale plan-carrier bodies — editing those
-  requires regenerating ROADMAP.md alongside. FOUND & FIXED IN PASSING: main @
-  e910a39 (#9612) does not build — duplicate shared-artifact wall-fill definitions
-  re-added over #9609 (E0428 x3, cli_run.rs); deduped on this branch; main needs
-  the same fix (its CI runs were still queued when found). Parse sweep advisory
-  count unchanged vs main (164). NEXT CANDIDATE ROUND: delete the 48 stale
-  authority-only plan carriers themselves (imports/rosters/doc_graph edits), and
-  the docs/plans doc-to-doc islands.
-
-## Finding — per-invocation whole-tree pool tax (2026-08-28, CORRECTED same day)
-
-AN EARLIER REVISION OF THIS SECTION CLAIMED A CWD-GATED SWITCH (identical trees
-<0.5s outside a checkout) AND IS REPLACED WHOLE: those fast controls were
-PANICS — `repo_relative_path_normalized` aborts on roots outside the process
-workspace root, and the discarded stderr was misread as fast success — the
-fabricated-fast twin of execution-provenance loss. `git rev-parse` is workspace
-discovery only, not a heavy-work toggle.
-
-ESTABLISHED by succeeding runs (entry compiled, NoSuchFunction reached) over
-subset roots inside the workspace, entry `std/abi.dag` (imports nothing):
-140 modules 3.5s · 1637 39s · 2962 (dag) 63s · 4308 (dag+src/v2) 81–99s.
-LINEAR at ~20–25ms per POOL module, paid per process invocation, independent of
-the entry (widest closure 110s vs smallest 81s on the same roots).
-
-MECHANISM (gdb stacks + code read; all hand-Rust in src/v1/stage0/src/cli_run.rs):
-`resolve_entry_graph` routes every run through the process shared index
-(`try_process_shared_index_for_pool`); building it (`new_multi_entry_index_shell`)
-EAGERLY constructs `build_module_graph_facts_live` — a tolerant parse of EVERY
-pool module (`reference_resolution_facts`, `module_declaration_facts`, import +
-strict-reference adjacency at two tiers) — plus `build_module_path_index`,
-another whole-pool parse. Hot leaves: `v1_std_core::build_newline_index`
-(im::Vector push_back per element — plain-Vec shape) and `v1_std_core::intern`
-String clones in `pre_intern_tokens`.
-
-WHY THE FACTS EXIST (per the in-code comment block): loader-tier adjacency and
-selection-tier adjacency (affected-set selection). A single-entry run needs at
-most one entry's loader closure but pays both tiers over the whole pool. The
-facts ARE memoized (thread-local MODULE_GRAPH_FACTS_CACHE / PROCESS_RESOLVE_INDEX),
-so one process pays once — but every PROCESS pays cold, and CI phases,
-emit-compile entries, and belt ticks are one process per invocation.
-
-RELATION TO .dag: acknowledged hand-Rust area — 🟡 dissolve-on markers cite the
-cli-run hollowing plan (`dag/gunbc/plans/cli_run_hollowing_plan.dag`,
-`gunbc.cli_run_hand_rust_area_ledger`); `import_closure_live_paths` labels
-itself "Host realization of v2.lens.module_graph.import_closure_live"; path
-admission modeled by `gunbc.cli_run_repo_grant`. The MODEL is .dag; the
-execution that costs the time is hand-Rust.
-
-NOT ESTABLISHED: the floor's 22-min `compile.reconcile`
-(`typecheck_with_census_extra`, ~300ms/module) is a separate larger cost, not
-attributed here. REPRO: in-workspace subset roots (untracked dirs), success
-judged by the NoSuchFunction cause line, never by wall time with output
-discarded; gdb -p <pid> -batch -ex "thread apply all bt" during the slow window.
-
-## cli_run.rs decomposition (started 2026-08-28, branch claude/repo-stability-priorities-frtsy4)
-
-50,536 → 46,443 lines; 13 clusters moved to src/v1/stage0/src/cli_run/ submodules
-(pure code motion, build-verified, smoke-tested): test_migration, compile_clean,
-non_fold_residue, class_b_census, languages_census, external_authority,
-inert_carrier, witness_gates, emit_host, complexity_gates, doc_graph,
-declared_refs, census_heads. Mechanics: submodule carries `use super::*` + the
-parent's use-header; parent re-exports `pub(crate) use <mod>::*` (paths stable);
-bin-consumed fns get explicit `pub use`; private moved items widen to pub(crate);
-eight report/plan types widened for the private-interface lint (CI: -D warnings).
-lib.rs is generated and untouched — submodule declarations live in cli_run.rs,
-matching the existing pattern (declaration_index, phase_profile, ...).
-
-DELIBERATELY NOT MOVED YET, to avoid conflicting with in-flight operator work:
-the resolver/index core (resolve_entry_*, build_module_*, import_closure_*,
-whole_tree_*, the shared-index thread_locals — the pool-tax subject) and the
-floor runner (floor_*, run_required_*, budget/accounting). Move each in a quiet
-window; the extraction recipe is in the split commits' messages.
-- 2026-08-28 (later): the two deferred cores are moved with operator approval —
-  entry_resolve (75 items, ~2.5k lines: shared index, resolve store, module
-  graph facts, path index, typed-module cache) and required_floor_runner
-  (49 items, ~4.8k lines: run_required_floor, claim eval/measurement,
-  discovery, diff observation, resource sampling). cli_run.rs 50,536 → 38,636
-  lines, 26 submodules. Remainder: ~450 fns of mixed verbs/helpers plus ~350
-  embedded test fns; further carving is ordinary follow-up, no core left.
-
-## The dependency map (2026-08-29, standing — replaces re-deriving this in chat)
-
-The interpreter has four roles: R1 witness executor · R2 orchestration executor
-· R3 v2's executor (v2 stages are .dag, so v2 compiles by being interpreted) ·
-R4 the host-effect seam (builtin handlers). Emitting .dag→Rust does NOT need
-the interpreter (the v1 passes are native); interpretation is evaluation without
-emission. Three separable decisions:
-
-1. REALIZATION STORE (backport of v2.std.materialize's model into a v1-host
-   persistent content-keyed store; digest authority already shared via
-   std.content_hash/fnv1a64). No dependency on the interpreter either way —
-   the interpreter becomes a CLIENT. Gives fast interpreted execution, CI in
-   minutes, fast v2 compile loop. v2 SELF-HOST DEPENDS ON THIS AND NOT ON
-   DECISIONS 2-3.
-2. NATIVE PRODUCERS PER FAMILY (emit witnesses etc. into content-addressed
-   native bundles; store's producer flips per family; interpreter drains).
-   Optional per family; needs emitter perf + diagnostics work.
-3. DELETE THE EVAL LOOP (only after 2 completes everywhere; R4 survives as the
-   runtime library with a new caller; may never be worth taking to zero — a
-   bounded evaluator for bootstrap/dev is near-free).
-
-digest authority ──► store ──► fast interpreted execution ◄── v2 self-host
-                      ├──► native producers per family
-                      └──────────┴──► interpreter drains ──► (optional) delete
-                                        eval loop; keep effect runtime
-
-## The one execution test (anti-planning: build this, then judge the plan)
-
-SUBJECT: persist the process-shared index's derived facts across processes,
-keyed on content digest. Concretely: module path index + module graph facts
-(and optionally the typed-module cache) in cli_run/entry_resolve.rs get a
-disk-backed store under target/ keyed on (source file digests, binary identity).
-ACCEPTANCE, binary and pre-registered: on an unchanged tree, the SECOND
-`gunbc run --source-root dag --source-root src/v2 --entry dag/std/abi.dag`
-completes in <10s (cold today: ~81–99s), AND the warm facts are byte-identical
-to cold-derived facts (the §5 purity oracle, asserted by execution). A miss
-(any file changed) re-derives fail-closed. If the warm run is not <10s or the
-oracle disagrees, the store thesis as specified is refuted and the plan is
-rewritten before anything else is built on it.
-WHY THIS ONE: smallest end-to-end existence proof of the store (one producer,
-one consumer, one oracle); kills the measured entry-independent pool tax; the
-same mechanism CI-minutes and the v2 loop need; ~a day; pass/fail visible in
-one command run twice.
-- 2026-08-29: REGRESSION PINNED BY BISECT — main's converge actuator dies with
-  `trim expects a string argument, got Null`. First bad commit: 655f82a74
-  (#9344, "Carry occurrence identity on every semantic v1 Node"). Mechanics at
-  the crash site (dag/gunbc/repo/repo_local_git_config.dag observe_binding_at_repo):
-  the effect result of git.Core.ConfigLocalGetInRepo reads `.success` fine
-  (the branch is taken) but `.value` comes back Null — a record-field read on
-  an effect result resolving to Null post-#9344, so the suspect is field
-  lookup / effect-result decode interacting with the new occurrence identity.
-  Repro: build any commit >= 655f82a74, run
-  `gunbc run --source-root dag --source-root src/v2 --entry
-  dag/gunbc/repo/repo_local_git_config.dag --function converge`.
-  Likely blast radius: any interpreted entry reading effect-result fields
-  (belt, deploys, gates). Not fixed here — #9344 is the operator's own thread.
-  Also fixed forward on this branch: #9656 omitted TypeEnv.unit_variant_index
-  in six bin/infer_semantics_witness.rs literals (main's full build is red).
diff --git a/docs/plans/required-floor-in-flight-shared-fill-design.md b/docs/plans/required-floor-in-flight-shared-fill-design.md
deleted file mode 100644
index b348bc8b631..00000000000
--- a/docs/plans/required-floor-in-flight-shared-fill-design.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Required-floor in-flight shared-fill refusal design
-
-Status: implementation design, following
-`required-floor-in-flight-shared-fill-findings.md`.
-
-## Decision
-
-Keep the required floor's existing 500ms attempt-safety ceiling. When its CPU poll fires during
-an admitted cross-claim fill, classify the interruption as `FillBudgetExceeded` only when the
-claim's marginal CPU without that still-active fill remains within the ceiling. The refusal
-carries the claim entry, prospective producer, fill CPU lower bound, marginal CPU lower bound,
-and unchanged limit.
-
-This is not pre-publication fill credit. The clock still charges all uncommitted work and stops at
-the same point. The change repairs the subject of the refusal: first-touch order no longer appears
-as intrinsic claim cost when the active prospective fill is what crossed the bound.
-
-## Boundary and nesting
-
-`CrossClaimFillGuard` remains the one lifetime bracket. Its stack frame additionally retains the
-producer and CPU start. At a poll, the outermost active frame identifies the prospective artifact;
-its CPU is inclusive elapsed CPU less already-stored descendants. Those descendants remain netted
-by the existing committed-fill accumulator, exactly as before.
-
-If marginal CPU alone already exceeds the ceiling, the ordinary evaluation-budget refusal wins.
-If no admitted fill is active, behavior is unchanged. Store, abandon, fill receipts, completion
-accounting, wall accounting, memo admission, and memo serving are unchanged.
-
-## Safety and evidence
-
-The refusal does not make an over-budget fill pass, raise a ceiling, retry a row, or create an
-artifact receipt. Its stable cause token makes the population countable. A real evaluator-path
-test must force the poll while an admitted fill is active and assert the producer is carried; a
-matched unadmitted control must retain the ordinary evaluation-budget refusal. This instrument
-can provide evidence for a separately modeled fill envelope later, but creates no such policy.
diff --git a/docs/plans/restore-src-v1-required-floor-stall-finding.md b/docs/plans/restore-src-v1-required-floor-stall-finding.md
deleted file mode 100644
index cec22b631da..00000000000
--- a/docs/plans/restore-src-v1-required-floor-stall-finding.md
+++ /dev/null
@@ -1,40 +0,0 @@
-# RESTORE-stall finding: widening the required floor's source roots to admit `src/v1`
-
-Standalone finding, split out of triage prose per parent-session request (dashboard node `adhoc-9b80ec49-d63`, session `zesty-newt-828`, 2026-08-19). It is the receipt for the RESTORE disposition ruled out repo-wide across `v1_dead_witness_tree_triage_receipt`, `v1_dead_witness_tree_triage_receipt_remainder`, and `v1_dead_witness_tree_triage_receipt_emitter_ambiguous_variant_owner` (`dag/gunbc/ci/ci_layer_roots.dag`) — those receipts cite this finding rather than re-deriving it.
-
-## The question
-
-Could the dead-witness-tree population under `src/v1/tests/claim` be restored to execution by the cheap route — adding `--source-root src/v1` to the required floor's invocation (`claim_executor --required-floor --source-root dag --source-root src/v2`) — instead of migrating or retiring each file individually?
-
-## Local measurement (this session, prior window)
-
-- **Invocation:** `claim_executor --required-floor --source-root dag --source-root src/v2 --source-root src/v1` (the one-token addition of `--source-root src/v1` to the standing invocation).
-- **Head SHA at time of run:** not recorded in this session's surviving notes; the run was taken against this branch (`session/zesty-newt-828`) during the window that produced the 17-file triage, before either the emitter_ambiguous_variant_owner receipt or the remainder receipt existed. This is a named provenance gap. The qualitative result (stall, not slow-but-progressing) is not sensitive to the exact commit, since strict-preparation's cost is dominated by corpus size and import-graph shape, not by this triage's one-line prose edits — but no exact SHA is citable.
-- **Local vs. remote:** run locally in this session's container (not via `ctrl-build --remote`), predating the guidance that heavy whole-tree operations prefer remote dispatch. It is a single-shot diagnostic, not a build, and its result (stall before any phase progress) makes host contention an unlikely confound: a resource-starved run would still log *some* forward progress at a slower rate, not zero.
-- **Contention caveat:** the container's RAM cap is shared across `sessions.slice` with other sessions on the same host; a co-located heavy build could inflate wall-clock or add memory pressure. This cannot be fully ruled out for this run. It is addressed, not eliminated, by the corroboration below, measured on dedicated CI hardware with no co-tenant.
-- **Result:** the process stalled 8+ minutes inside `strict-preparation` (the whole-corpus typecheck phase preceding any witness execution), RSS plateaued at approximately 7.2GB with no further growth, and no phase-progress log line advanced past the point already reached without `src/v1`. The process was killed: a plateaued RSS with no progress is the signature of a stall (thrashing, or an unreachable fixed-point), not of a slow-but-advancing computation.
-
-## Independent corroboration (relayed by parent session smart-ram-730, CI run 32196317824)
-
-A CI run on a dedicated `srv4` runner (no co-tenant contention) measured the **ordinary floor, without `src/v1` added at all** — the ceiling this triage's population currently sits below, not the widened case:
-
-- `rss_kb=7078696` (~7.0GB)
-- `wall_s=540` (9 minutes) in `strict-preparation`, logged as `compile.reconcile done in 9 minutes`
-- heavy paging during the run: `pswpin=231511094`, `pgmajfault=169789103`
-
-This is the cost of `strict-preparation` **today, over `dag` + `src/v2` alone** — the baseline the required floor already pays before any witness runs. Both observations land independently in the same ~7GB / high-single-digit-minutes regime on the same phase, so the local stall was not primarily an artifact of `src/v1`'s weight pushing an otherwise-cheap phase over a threshold: `strict-preparation` is already expensive at the two-root baseline. Adding `src/v1` (52 non-test `.dag` modules plus the 15-17 test files, per `witness_fold_src_v1_coverage_gap_note`'s count) pushes an already near-ceiling phase further.
-
-**Second data point (relayed by parent session smart-ram-730, CI run 32204338777, dedicated runner, same unwidened floor):** `rss_kb` peaked at 9,816,820 (~9.8GB) in the same `strict-preparation` phase this triage's own PR (#8486) exercised — against the ~7.0GB from run 32196317824. Both runs measure the identical unwidened invocation (`dag` + `src/v2`, no `src/v1`) on dedicated hardware, so the ~2.8GB spread is not host contention or a `src/v1` effect — it is `strict-preparation`'s own run-to-run variance at the two-root baseline. The honest ceiling claim is therefore a **range** (~7.0–9.8GB observed so far), not a single figure; the headroom between that range and this host class's actual OOM/thrash threshold is narrower than either measurement alone suggests, which strengthens the conclusion that widening to `src/v1` is not the cheap route.
-
-## Stall vs. slow classification
-
-Both signatures point to **stall**, not **slow**:
-
-1. The local run showed RSS plateau with zero phase-progress advancement over 8+ minutes — a computation still progressing would show continuing RSS growth or advancing log lines, not both flat.
-2. The CI corroboration establishes that even the *unwidened* floor is already within single-digit minutes and ~7GB of whatever ceiling this host class enforces; paging activity (`pswpin`/`pgmajfault` in the hundreds of millions) is itself evidence of memory pressure at the baseline, before `src/v1`'s modules are added.
-
-Together, `--source-root src/v1` does not merely make `strict-preparation` *slower*; it very plausibly pushes an already-memory-pressured phase past a practical ceiling into OOM or genuine thrashing — the local kill preempted observing which. Re-running to distinguish "would eventually finish, slowly" from "would OOM or thrash indefinitely" was not attempted, since the practical consequence (RESTORE is not the cheap route the one-token diff suggested) is decided either way.
-
-## Conclusion
-
-RESTORE is ruled out for the whole `src/v1/tests/claim` population, repo-wide, on this evidence: a local stall (contention-caveated, but with a stall rather than slow-progress signature) independently corroborated by dedicated-hardware CI numbers showing the *unwidened* floor already runs close to whatever ceiling caused the local stall. This finding is the citation target for the RESTORE disposition in all three `v1_dead_witness_tree_triage_receipt*` rows; MIGRATE and RETIRE are the two remaining dispositions, applied per-file in those receipts.
diff --git a/docs/plans/review-instrument-observations.md b/docs/plans/review-instrument-observations.md
deleted file mode 100644
index b71839e3ced..00000000000
--- a/docs/plans/review-instrument-observations.md
+++ /dev/null
@@ -1,87 +0,0 @@
-# Review-instrument observations (not a census of this repository)
-
-Two findings about the **review and merge-readiness instrument**, recorded because they were each
-found by accident while doing other work and are the kind of thing that is otherwise rediscovered
-expensively. They are facts about the tooling, not about the seed or the `.dag` corpus, which is why
-they are here rather than in [seed-string-decode-census.md](seed-string-decode-census.md).
-
-Both were observed on `gunb-ai/gunbc#10180` and independently reproduced by a second session.
-
-## 1. `stale_provider_count` does not fire, even where both operands are local
-
-A single `dashboard-ops reviews 10180` payload carried **three different shas at once**:
-
-| field | value |
-|---|---|
-| `reviews[0].sha` (the approving review) | `60aefd9d3acb684e` |
-| `merge_criteria.head_sha` (the dashboard's own head) | `aff564ca8a7d2fc7` |
-| `gh pr view --json headRefOid` (actual) | `2c9c08a439b5b0c2` |
-
-and, in that same object: `stale_provider_count: 0`, `stale_providers: []`, `approvals: 1`,
-`meets_approval_rule: true`.
-
-**What is observed, stated before what explains it.** The approval sha differed from the dashboard's
-own `head_sha`, both fields present in one object, and `stale_provider_count` still read 0. A later
-payload on the same PR DID report `stale_provider_count: 1`, so the field is not simply inert.
-
-**Correction to an earlier reading.** This document first concluded "the comparison does not fire even
-when it has everything it needs". Two observations now constrain it better, and the second refutes
-that sentence as written:
-
-| observation | `head_sha` | provider's latest review sha | `stale_provider_count` |
-|---|---|---|---|
-| A | `aff564ca8a7` | claude @ `60aefd9d3ac` | **0** |
-| B | `dee613521e4` | claude @ `dee613521e4`, codex @ `c29a33ce28e` | **1** (codex) |
-
-In B the field fires correctly. **Hypothesis that fits both, and it is a hypothesis, not a
-measurement:** staleness is evaluated when a review is INGESTED, against the head known at that
-moment, and stored — while `head_sha` is read live at query time. Under that reading A is a stored
-verdict that was true when written and went false underneath, not a comparison that failed to run.
-Distinguishing it would take a payload sampled at a known ingest boundary, which has not been done.
-
-**The operative rule is unchanged either way**, which is why the correction does not disturb it: a
-stored-and-gone-stale verdict and a non-firing comparison are indistinguishable to a reader, and both
-report 0 on an approval that is not on the current head.
-
-**Consequence for any merge decision.** Comparing the dashboard's `head_sha` to `gh`'s `headRefOid` is
-NECESSARY BUT NOT SUFFICIENT — it catches the lag case and would have passed observation A the moment
-the dashboard caught up, with an approval three heads old. The sufficient check is computed by the
-reader:
-
-```
-gh pr view <N> --repo <owner/repo> --json headRefOid --jq .headRefOid
-dashboard-ops reviews <N>          # compare each reviews[].sha to that value yourself
-```
-
-`stale_provider_count` is not evidence of anything on its own — it is right in B and wrong in A, and
-nothing in the payload distinguishes the two cases for you.
-
-**The same applies to `request_changes_count` reaching 0.** On this PR a codex REQUEST_CHANGES on
-`c29a33ce28e` disappeared from the counter after the next push. The findings WERE addressed in that
-push — but the counter would read 0 either way, because a REQUEST_CHANGES is superseded by any push
-regardless of whether anything was fixed. The commit and the reply are the evidence that the findings
-were addressed; the zero is not.
-
-**A second, softer form.** An approval can also be superseded in PREMISE rather than in sha. #10180's
-approving review reasoned explicitly from *"census-only … no code, no `.dag`, no seed changes"*; a
-later commit added seed code. Even had the shas matched, the verdict's stated grounds no longer
-described the diff. Read what a review says it approved, not only what it approved.
-
-## 2. A refused review burns its sha slot, invisibly to the counters
-
-In the same payload, review `59066` carried `status: "failed"` with:
-
-```
-worktree freshness check failed: HEAD is 95ef0941… but PR #10180 head is 44efc6eb…
-— refusing to review a stale/wrong checkout
-```
-
-That refusal is correct behaviour: reviewing a checkout that is not the PR head would produce a verdict
-about a different object. But the slot is consumed — `44efc6eb` is never reviewed, and no retry occurs.
-A PR can therefore accumulate refused reviews that leave no trace in `approvals`,
-`request_changes`, or `stale_provider_count`; only the `reviews[].status` / `error` fields carry it.
-
-**The pairing is the finding.** One half of this system refuses to review unless its checkout matches
-the PR head EXACTLY; the other half reports staleness as 0 across a three-sha spread. One half is
-strict about precisely the question the other half does not ask. Classify a review by its `status` and
-`error` fields before reading any counter.
diff --git a/docs/plans/review-sheet-and-census-lane-handoff.md b/docs/plans/review-sheet-and-census-lane-handoff.md
deleted file mode 100644
index 8f346f3624e..00000000000
--- a/docs/plans/review-sheet-and-census-lane-handoff.md
+++ /dev/null
@@ -1,252 +0,0 @@
-# Review-sheet and census lane — state at wind-down
-
-Written 2026-09-20 by zesty-crane-846 on an operator instruction to wind down and record
-remaining items, so the system can prioritise v1 performance and v2 migration. Nothing here is
-in progress.
-
-**Read the census section before acting on any number in this lane's output.** The prospect rows
-that exist are historical prototype output and are NOT authority for runner occupancy, spend, or
-opportunity. That is the single most important thing this page carries.
-
-## What landed
-
-| PR | what |
-|---|---|
-| #11552 | the App-manifest acquisition MODEL and its route — **the flow is not executable end to end**, see below |
-| #11581 | three format-converge defects a live spreadsheet found that no witness could |
-| #11610 | the actuator consumes the plan's custody name instead of re-deriving it |
-| #11564 | GitHub observation record and bounded scan producer — incomplete; completed by #11656 |
-| #11669 | `gunbc.review_sheet_identity` — the review-sheet identity semantic kernel |
-| #11656 | the three repairs #11564 merged without, plus a sealed scan outcome and an admitted page size |
-
-**No external prerequisite of this lane is still open.** #11552, #11564, #11656, #11669, #11671,
-#11677 and #11679 are all merged. Earlier revisions of this page described #11656 as open and the
-census token as queued behind #11671 → #11677 → #11679; that is stale and the blockers are gone.
-
-### #11552 acquisition is modeled, not achieved
-
-`gunbc.github_app_acquisition` instructed the operator to "paste the manifest below into the
-form's manifest field, and submit". **That instruction was not executable.** GitHub's ordinary
-App-creation page carries no manifest field; the manifest protocol requires a form POST carrying
-a `manifest` parameter, and a GET renders the blank create page. This was observed live: the
-operator followed the step and reported a form with no such field.
-
-**The instruction is now an artifact.** `census_app_registration_instruction` renders an HTML
-document whose form POSTs to the registration endpoint, carries the declared manifest in a hidden
-field under the parameter name upstream reads it from
-(`extdeps.github.app app_manifest_form_parameter_name`), and carries the run's state nonce in its
-action URL; `census_app_registration_instruction_receipt` writes that document to
-`.gunbc/github-app-<name>-register.html` and refuses to print the instruction if the write failed.
-The human act left is pressing its button under an owner session, which is the consent GitHub
-requires and exposes no API for.
-
-**Four facts, kept apart.** REGISTRATION, INSTALLATION, CALLBACK CAPTURE and KEY CUSTODY are
-separately established and joined by `census_app_acquisition_standing`, which refuses at the
-earliest missing fact and names it. No later fact mints an earlier one: an installation reading
-and a private key on disk do not establish a registration, and an installation naming another
-App's id does not install this one. `census_app_acquisition_receipt` is the executing route —
-three independent readings (the public app record, `GET /app/installations`, the handoff file),
-exit zero only when all three hold. #11677's JWS/token route still consumes an App and an
-installation that have already been admitted; it creates neither.
-
-**The two browser acts are owed, and they are NOT sufficient on their own.** No receipt in this
-corpus establishes registration, installation or custody for the census App today, and the
-acquisition receipt says so in those words rather than reading as done. But an earlier wording of
-this paragraph said the browser acts were all that remained "in the model", and the diff it
-described contradicts it: `live_installation_population` returns `PopulationUnreadable` on *every*
-arm, including a successful decode, because this repository's REST transport models request headers
-only and GitHub states whether another page exists solely in the RFC 8288 `Link` header. A short or
-empty page is not closure. So after an operator submits the manifest, grants consent and places the
-pem, `census_app_acquisition_receipt` still exits non-zero with `InstallationReadingUnavailable`.
-
-**What is also owed is that transport capability**, and it is declared rather than described:
-`census_app_installation_population_frontier_rows` names it — a REST operation result carrying the
-response's `Link` header value, sufficient for admitting an installation over a population the
-authority itself closed, and explicitly NOT satisfied by a larger `per_page`, by stopping at a short
-or empty page, or by routing the read through a CLI whose credential a PAT could satisfy. That
-refusal is the honest state and should not be relaxed to make the runbook end green; the operator
-should know before they start that the browser acts leave the receipt refusing for a reason that is
-not theirs to fix.
-
-**Custody's second hop is pending a sibling lane.** The declared destination for the App private
-key is `census_app_private_key_custody` in Secret Manager. This process cannot write there, so
-`CustodyStanding` has exactly one established arm — `CustodyAtHandoffOnly` — and no constructor
-for "the key is at its destination". The key belongs as a ROW in the closed custody roster the
-`ntfy-publisher-token-onto-gcp-custody` node consolidates; minting a second delivery path here to
-close the fact sooner would fork that authority.
-
-**Authorization pattern.** The registration effect is rostered in
-`gunbc.auth.privileged_effect_census` and the selection lands on `HumanOnlyStep`: the surface is
-human-only (no API creates an App), so every API pattern fails the surface gate, and the effect is
-irreversible (the private key is returned once, and the App name is spent) so a witness is
-required — which the human step is.
-
-## The one fact everything else rests on
-
-An empty `appProperties` search establishes **"this OAuth client received no matching rows"**. It
-never establishes **"no legacy-marked file exists"**. `appProperties` are private to the
-*requesting application* — the OAuth client id the token was obtained with — and nothing in this
-corpus observes the application identity of its own token. A service-account principal is a
-different subject, so comparing service-account emails does not establish visibility.
-
-That distinction is the whole content of the identity kernel, and it is why the kernel has no
-"compatible empty search" arm at all.
-
-## Remaining: the review-sheet migration cuts
-
-The kernel landed in #11669. It does **not** repair the production converge; it provides the
-authority a future repair is written against. The remaining cuts were designed but not built, and
-they replace the approach in the closed #11596 rather than salvaging it — that PR decided the
-meaning of each reading inside effectful routing, which is why it took ten review rounds.
-
-- **Cut 2 (A)** — LANDED. The shared marker-query constructor is
-  `gunbc.review_sheet_drive_converge` `review_sheet_marker_query`, one shape over a field
-  parameter; the Drive superseded-marker producer and the subject-bound operator-declaration
-  reader are `gunbc.review_sheet_legacy_extent_producer`; the decision over a standing is
-  `gunbc.review_sheet_identity_converge` `ensure_review_spreadsheet_on_identity`, which REPLACED
-  the observation-only `ensure_review_spreadsheet` rather than landing beside it. The production
-  caller is `gunbc.review_sheet_spreadsheet_actuator` `converge_review_spreadsheet`, reached from
-  the argv-free `converge_drive_half_cli`. Two of the kernel's three frontier rows retired by
-  execution; `LegacyFileSelection` remains.
-  **The behaviour change worth knowing before the next live run:** a current-marked file beside an
-  unsettled superseded extent now REFUSES instead of adopting, and the discharge is an operator
-  declaration at `review_sheet_legacy_declaration_path` carrying the subject in its content.
-- **Cut 3 (C1)** — LANDED, as `gunbc.review_sheet_declared_id_admission`. `declared_id_candidacy`
-  reconciles a `LegacyFileSelection` against the intended subject, the standing and a contradicting
-  observation, in that order and before any request; `preflight_file_by_id` is a new
-  `drive.Files.GetFile` whose field mask names every required field of `DriveFile`, and
-  `admit_preflighted_file` binds the readback to the requested id rather than to the status.
-  `converge_review_spreadsheet` asks the admission first and reports
-  `SpreadsheetAdoptedByDeclaredId` for an admitted one. **The refusal that must not be widened:** a
-  selection beside an unresolved extent stays unresolved — the operator has said which file they
-  chose, not that no other lineage exists. The discharge is an `"absent"` declaration, which is a
-  statement about the world and has a kernel arm.
-  The operator declaration file now admits two `legacy_extent` values, `"absent"` and `"selected"`;
-  a `"selected"` one also carries `file_id`. Both carry all five subject members.
-- **Cut 4 (C2)** — `UpdateFileProperties` PATCH and the readback that asserts the patched file id
-  rather than a count. The field mask must name every required field of its declared response
-  type; `fields=id` against a `DriveFile` decodes short and reports a landed write as a transport
-  failure.
-- **Cut 5 (E)** — legacy-generation retirement.
-
-**Three standing constraints for whoever resumes this.** The closed #11596's combined migration
-route must not be executed. The operator's live sheet was repaired by hand, and the ordinary
-steady-state adoption path was exercised live — two GETs, zero writes, existing sheet adopted.
-And the marker must not be relocated again until the producer and admission cuts are resumed,
-because a second relocation with no producer is how the first duplicate was minted.
-
-## Remaining: the census API budget
-
-The census needs a GitHub App installation token to lift its rate limit. This is **not** a
-build — it is a reuse, settled across three lanes.
-
-- `#11677` already signs an App JWT: `extdeps.auth.jws` for the RFC 7515 signing input,
-  `extdeps.tools.openssl` as an enrolled host CLI, and `github.AppInstallationAccessTokens.Create`
-  for the exchange. The key is read from a file, the signing input enters on stdin, the signature
-  leaves on stdout; no key material reaches the evaluator or argv.
-- **PRIMITIVE-EGRESS-0 admits that route conditionally.** It bans *ambient* primitives — registry
-  names and interpreter arms realising pure computation the `.dag` could own. It does not ban a
-  modeled external tool whose subject is genuinely external. The condition: the subject must be
-  the **key custody boundary**, a signer interface over a key reference with openssl as one
-  handler. Modeled as "RSA is realized by openssl" it fails, as an ambient primitive wearing a CLI.
-- **Do not add an `rs256_sign` host primitive.** CRYPTO-0 is actively deleting host crypto
-  primitives; a new one would be a second authority landing against that program. RSA is not in
-  CRYPTO-0 wave 1 and a future modeled RSA is a different subject anyway — key inside the
-  evaluator — so a keystore-shaped interface survives it.
-- **The shape, from #11677's owner:** a second composed performer in `gunbc.github_effect_perform`,
-  not a second module. Factor the `clock → claims → jws → openssl → Create` prefix into one
-  function returning a `sole_constructor` installation-token carrier. Each performer consumes the
-  carrier inside its own call. Never return a bare `Secret`, and never introduce a second
-  environment-variable token a PAT could silently satisfy.
-- **The live control** should run with the PAT route unavailable, so a successful code-search page
-  is attributable only to the token producer rather than proving a token could be rendered.
-
-Not blocked. #11671, #11677 and #11679 are all merged, so the route this describes is available
-to build against today.
-
-## Remaining: ntfy publisher token onto GCP custody
-
-`gunbc.auth.approval_ntfy_deployment` `approval_ntfy_publisher_token_intervention` is a
-`HumanIntervention` — an operator creates the ntfy user and records its token where the unit can
-read it. The read side is already modeled. Delivery is not.
-
-The design is agreed across three lanes and is **a consolidation of #11679 after it lands**, not a
-sibling module: move it to a custody authority and make the controller key its first caller row.
-
-- One fleet-converge mode, with the credential a dispatch choice over a **closed roster of custody
-  rows**. One mode per credential grows a hand-enumerated roster — a known stall. A free-text
-  credential input would be a stringly selector.
-- Each row: `SecretRef`, path, owner principal, group principal, and a **mode arm**. `root:root
-  0400` becomes the controller key's row rather than a constant.
-- **The directory's owner/group/mode must be a row field too.** A `0640` token for a service group
-  needs a directory that group can traverse (`0750 root:<group>`); today's check refuses any group
-  bit.
-- Mode stays a **closed arm**, never a caller octal. Derive the exact-mode leg and the
-  forbidden-bits leg from the arm (`077` for 0400, `037` for 0640); the owner leg takes
-  `-user`/`-group` from the row.
-
-**A caveat that must not be lost.** A find-metadata readback establishes which principals *hold
-permission bits*. It does **not** establish that a non-writer cannot open the store — that needs an
-execution-as-another-user leg. `gunbc.rung_drop.approval_store_single_writer_by_agreement`'s
-restoration trigger requires the stronger observation, and its row has since been amended to name a
-permission-bits readback among the things that do *not* retire it. The custody work is
-necessary-but-not-sufficient for that trigger.
-
-Not blocked. #11679 is merged, so the custody authority this consolidates into exists today.
-
-**Landed as a consolidation** into `gunbc.host_credential_custody_converge` (the #11679 module,
-renamed because it no longer holds one key): fleet-converge mode `host_credential_custody_converge`
-with a `credential` choice over `host_custody_credential_roster` — `ControllerAppKey` first, then
-`ApprovalNtfyPublisherToken`. The delivery HumanIntervention is deleted; what stays human is the
-**mint** (`approval_ntfy_publisher_token_mint_intervention`): creating the ntfy user and adding its
-token to Secret Manager. Two operator acts remain before the first live receipt for the ntfy row:
-the mint, and ensuring `gunbc.auth.fleet_secret_accessor_roster`
-`approval_ntfy_publisher_token_accessor_row`.
-
-## Small, unblocked
-
-Seven unused imports across `gunbc.ci_workflow_scan_producer` (`CodeSearchPage`,
-`code_search_hits_read`, `GithubObservationRequest`, `ObservationBudgetStanding`) and its witness
-(`CodeSearchPageComplete`, `CodeSearchPageTruncated`, `ObservationCompleteness`). All predate
-#11656 and were deliberately left out of it to avoid widening a head-pinned repair. One small PR.
-
-## The census rows are historical prototype output, not an authority
-
-`gunbc-private:sheets-census` at `94fa118` holds `strategy.ci_prospect_census` — 57 rows carrying a
-17-column set matching the formatted sheet's schema, transcribed rather than derived.
-
-**Label them: historical prototype output; NOT current runner-occupancy, spend, or opportunity
-authority.** The economic readings attached to those rows were shown not to have the meanings
-assigned to them, and the specific errors are worth carrying because each is easy to repeat:
-
-- workflow **wall duration is not summed runner occupancy** — a run lasting an hour may occupy one
-  runner for a minute, or twenty runners concurrently;
-- workflow-run **admission delay is not runner queue delay** — they are different waits with
-  different causes;
-- a **provider declaration can outlive actual provider execution**, so a declared runner label does
-  not establish that provider ran the job;
-- **provider adoption does not establish positive spend** — a self-hosted or free-tier runner is
-  adoption with no bill.
-
-So the derived totals that prototype displayed — a runner-minutes-per-day figure and an ARM-tier
-economic projection — do not follow from what was observed, and the "five carry `CostOpportunity`"
-classification must not be quoted as a finding. Treat the 57 rows as a shape demonstration.
-
-**The bounded scan producer is necessary and NOT sufficient.** It yields a declared candidate
-population; it cannot reproduce these rows or establish any economic reading, because the facts
-those readings need are job-level and the scan is workflow-level. The minimal rebuilding route is
-job-level observation:
-
-```
-jobs?filter=all
-  → all pages and attempts
-  → actual runner / provider identity
-  → job occupancy
-  → pre-start observation
-  → cancelled occupancy
-  → provider execution standing
-  → private commercial projection
-  → operator-safe sheet rows
-```
-
-That arc is carried as its own roadmap item rather than left in this prose.
diff --git a/docs/plans/route-gap-dormant-observation.md b/docs/plans/route-gap-dormant-observation.md
deleted file mode 100644
index 9ce1fe57b84..00000000000
--- a/docs/plans/route-gap-dormant-observation.md
+++ /dev/null
@@ -1,199 +0,0 @@
-# Where the route-gap population drops out of the required run — finding, then proposed repair
-
-Lane: calm-koi-257 (claim-execution-route). Status: finding complete; repair BUILT and under review on
-PR #13376 (coordinator ack covered all four conditions; reviews 38602/76419/76431 addressed).
-
-## The population and the run
-
-`v2.workflow.floor_route_gap.floor_route_gap_roster` (authority: `src/v2/workflow/floor_route_gap.dag`)
-enrolls identities the floor executes and that reach a host effect the hermetic route has no arm for
-(`NoMockResponse` 420, `FilesystemRemoval` 10, `UnpublishedMockCase` 8 among the 425 typed rows; 100 more
-as bare identity strings in chunks 00–05). 525 distinct identities across 146 modules; every one currently
-resolves against the tree (verified per identity: module present, `test fn` tail present — zero stale rows
-on current main; an earlier count of 2 stale rows was an artifact of my worktree lagging main and was
-withdrawn).
-
-On required run 37236808750 (merge_group, pr-13305, floor job 111537440982):
-
-    [floor-cost-debt]     floor_route_gap: 5   enrolled identity(ies) suppressed (cost-debt roster withholds them)
-    [floor-required-gate] floor_route_gap: 536 enrolled identity(ies) suppressed (module outside the required gate, never loaded)
-    [floor-route-gap] roster carries 5 enrolled identity(ies)
-    [floor-route-gap] 5 enrolled identity(ies) held as route-gapped; 0 unenrolled route gap(s) reported
-
-Arithmetic: 546 decoded = 541 route-gap-roster rows + 5 gate-inside rows enrolled in the floor's
-grandfathered roster (`v2.workflow.floor_grandfathered_roster`). The route-gap source on the run's merge
-commit carried 421 typed rows + 120 legacy strings (= 541; current main carries 425 + 120); the 5 carried
-rows — `parse_test.parse_witness_floor_holds`, `parse_test.parse_witness_perf_holds`,
-`namespace_import_closure_witness.namespace_import_closure_receipt_holds`,
-`namespace_structural_root_exposure_generated_witness_test.namespace_structural_root_exposure_generated_witness_holds`,
-`v1_dag_parse_witness.v1_dag_parse_witnesses` — are not in the route-gap chunks at all; the floor's
-grandfathered roster declares them as gate-inside enrollments, and the runner decodes both sources into
-one 546-row roster before the gate split.
-
-## The chain, and the three drop points
-
-For an enrolled identity the required run promises (route-gap .dag header): execute → gap → held; or execute
-→ pass → stale-row red; or enrolled → did not execute → red. What actually happens for 541 of 546:
-
-1. **Discovery/import** — preparation ranges over the gate closure. The gate (`required_gate_prefixes`, 11
-   prefixes + seed modules, cut 2026-08-29, rung drop "Required gate reduced to the compiler floor") admits
-   only 5 of the 146 modules carrying enrollments. 536 rows sit in modules never loaded: no plan, no
-   execution, no receipt. *Declared* — the bankruptcy names the population per run in
-   `required_floor_disposition.tsv` (`declined_outside_gate_closure=26844`, `declined_outside_required_gate=696`
-   on this run; summary line `declared=28274 offered=1430 routed=704`).
-2. **Selection/admission** — the only mechanism asserting "enrolled ⇒ executed" is the route-gap join
-   (`required_floor_runner.rs`). `suppress_withheld` removes the 541 from the roster *before* the join, so the
-   join's universe is the 5 gate-inside rows. The suppressed list is produced **per identity with grounds** —
-   and then discarded: route-gap publishes only the two aggregate count lines above. Expected-red got the
-   per-identity treatment on 2026-09-01 (`v1_compiler_expected_red_roster_join.rs`: "THE DENOMINATOR IS THE
-   ENROLLED ROSTER, NOT THE SURVIVORS", suppressed rows recorded with their ground); route-gap never did.
-3. **Decision** — the run greens with "5 held; 0 unenrolled gaps". 541 enrollments are in no ledger the run
-   publishes: the claim-cost TSV carries only executed identities (704 rows, 5 `host_effect_refused` — the
-   carried ones: `test.claim.parse_test.parse_witness_floor_holds`, `...parse_witness_perf_holds`,
-   `test.claim.namespace_import_closure_witness.namespace_import_closure_receipt_holds`,
-   `test.claim.namespace_structural_root_exposure_generated_witness_test.namespace_structural_root_exposure_generated_witness_holds`,
-   `test.claim.v1_dag_parse_witness.v1_dag_parse_witnesses`); the measurement receipt carries only
-   `standing` + `blockers`; the disposition/join TSVs are written by the floor job but **not uploaded**.
-
-## The (a)/(b)/(c) split (sampled, identity grain)
-
-- **(a) Deliberately outside the supported guarantee** — the wet/service families: machine intake
-  (`test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.*`, 44 rows), fabric (31), spark
-  serving (74), runner (13), codex supervised turn (21), workspace storage — claims whose execution needs
-  service fabric the hermetic required run does not attach by design. Their route-gap rows were enrolled from
-  the pre-bankruptcy era; the bankruptcy (declared 2026-08-29) is the standing disposition for the family,
-  and `DeclinedNoCiWetLane`/`DeclinedOutsideRequiredGate` type the planning-level fact per identity. For
-  these, a per-identity suppressed record on a required run is **measurement, not closure** — closure for
-  them is the gate/wet-lane decision already declared in the rung drop.
-- **(b) Meant to support, unobserved** — the hermetic-adjacent families whose route gap is exactly the
-  missing mock arm the register exists to demand: filesystem/store mock arms (`artifact_store_fs_witness`,
-  `durable_exclusive_hold_file_store`, `materialization_store_local`, `effect_plan_bash`: operations Dir 127,
-  DirWithTemplate 130, DigestStdin 42, Run 46, Check 26) and the withdrawn `v2.test.execution.emit_on_demand_*`
-  family (probed 2026-10-01, amendment names the restoration trigger: "the restoration trigger above stands
-  whole"). The register's demand semantics — "a row leaves when a route is supplied" — require observation;
-  with no observing run, no arm gets built and the trigger cannot fire. The suppression comment's promise
-  ("observable again ... in the whole-corpus receipts run") is **a promise with no executor**: no workflow in
-  `.github/workflows/` (8 files, none scheduled for a corpus pass) runs it, and the rung-drop authority
-  itself rules the escape hatch out ("a receipt-only run outside the required path does NOT retire the row").
-  So for (b) the absence of that run is not merely a gap — it is the defect: the demand register's only
-  claimed observation point does not exist.
-- **(c) Defect (structural, live today at zero count)** — the class "enrollment the tree no longer declares".
-  The mechanism cannot see it: suppression counts it with the (a)/(b) rows, no arm refuses it, and the
-  roster header itself warns "an enrollment nothing observes is a row that can never ask to be removed".
-  Zero live rows today (audited); the class is one rename away, and nothing would notice. Also (c): the
-  route-gap contract's four-arm sentence still claims whole-roster observability and was never amended when
-  gate-bounded suppression landed (2026-08-29) — two authorities now disagree silently.
-
-## Proposed repair (one partition in the existing admission path)
-
-In `suppress_withheld` + the route-gap join in `required_floor_runner.rs`, partition the roster at identity
-grain — the cost-debt partition precedent (gunbc#9684) and the expected-red join-report precedent
-(2026-09-01), no new system, no new CI job:
-
-1. **Declared + gate-inside** → observed today, join as now (held / stale-red).
-2. **Declared + outside-gate (or cost-debt withheld)** → typed, located, per-identity suppressed row carried
-   into the outcome (like the expected-red join report) and named per identity on the existing stderr
-   channel (pattern: the cost-debt "kept as record" line), each with its ground
-   (`OutsideRequiredGate` / `CostDebtWithheld`). Label: for (a) this is measurement; for (b) it is the
-   explicit disposition that replaces the green absence.
-3. **Undeclared** (module absent from the discovery roots / identity tail absent) → **typed refusal**, red,
-   naming identity and roster. Fires on zero rows today; keeps it that way.
-4. **Text amendments**: the route-gap header's four-arm sentence and the suppression comment's
-   "whole-corpus receipts run" promise are amended to state the real standing (dormant until the gate
-   widens; no receipts run exists and none retires rows).
-
-Acceptance path: author a fresh claim in an out-of-gate module, enroll it in `floor_route_gap`, and the
-required run records it per identity with ground `OutsideRequiredGate` — or, if misnamed, refuses. Heavy
-runs remote/CI only.
-
-## Repair as approved and built (coordinator ack, conditions + single-implementation round)
-
-The partition decision is now **modeled on the .dag authority** —
-`v2.workflow.floor_route_gap.floor_route_gap_admission_partition` is the single implementation of the
-route-gap admission decision, membership judgment included; the Rust call site marshals the run's real
-values (suppressed identities with their declared ground arms, and the discovery walk's declared-identity
-index WHOLE as a keyed map) into it through `run_in_context_with_args`, and the relation performs the
-membership judgment itself with `map_contains_key` per row — the runner does no membership test, so
-refuse-if-undeclared is decided on the authority. An earlier Rust classifier
-(`route_gap_suppressed_undeclared`) was **deleted** rather than kept beside the call — one implementation,
-a net reduction of seed decision surface; the seed receipt counts **+4 hand items**, all in the runner: the
-shared entry name, the suppressed-row marshal, the declared-index marshal, and the shared production
-decode+enforce (`route_gap_admission_decode_and_enforce`) — extracted from `run_required_floor` so the
-pairing test drives the same function the run site executes, and the misnamed fixture produces the actual
-`REQUIRED-FLOOR REFUSAL cause=RouteGapEnrollmentUndeclared`, not just the relation's refusal arm. The declared index arrives as a keyed map so the judgment
-stays in .dag at one O(1) lookup per suppressed row: an earlier shape flattened the declared index for
-the .dag to linearly re-scan per suppressed row (541 x 28,274 ≈ 15M interpreted string comparisons per
-required run) — a cost-shape defect, fixed per DESIGN §6 rather than retired on "n is small here"; a
-per-row Boolean read in Rust was the intermediate shape, retired because a Rust-side `contains_key` IS
-the refuse-if-undeclared judgment. What would move even the marshal into the .dag is the self-emitted
-claim executor owning the discovery walk and feeding the relation directly; deliberately not built. The
-judgment could not have been expressed in .dag on its own earlier because the declared universe is
-discovery-walk knowledge (the roster decodes in a hermetic frame whose subject is the gate closure);
-modeling the RELATION and marshaling the index whole as a keyed map is the resolution of that.
-
-1. **The wall (closure)**: a refused row names an enrollment the tree does not declare (module or tail
-   absent from the discovery roots; the disposition index covers every declared witness identity,
-   gunbc#9684) and the run refuses with `cause=RouteGapEnrollmentUndeclared`, naming the identities and
-   the modeled entry that decided.
-2. **Single authority**: the route-gap .dag header contract states the gate-bounded amendment (the two
-   further arms) beside the original four; the `suppress_withheld` stderr line no longer promises a
-   whole-corpus receipts run — it states the true standing; and the membership test has exactly one
-   implementation, on the authority.
-3. **Measurement (labeled)**: every suppressed identity is named with the ground the modeled partition
-   returned for it, headed MEASUREMENT — for the (a) families this records declared dormancy and closes
-   nothing. The ground itself is a **declared coproduct** (round 3, per review 76626): `ground` carries
-   `v2.workflow.floor_route_gap`'s `FloorRouteGapSuppressionGround` (`OutsideRequiredGate |
-   WithheldCostDebt | DeclinedNoCiWetLane`, spelled arm-for-arm after the floor's suppression enum as
-   the seed realizes it — `v1.expected_red_roster_join`'s suppression ground, generated into the runner
-   as a Rust enum) instead of a free label; the marshal decodes the enum into the declared arm and the
-   run site refuses an arm the enum does not declare, so a fabricated ground can never pass as a label.
-   The arms cannot be shared by import because the eval universe's discovery roots are `dag` + `src/v2`
-   (no `src/v1`), so name-alignment is what keeps the two spellings one vocabulary.
-4. **Not closed here — class (b)**: unchanged from the section above; the named follow-ups are gate
-   admission of those modules, or a dispatch instrument row running a probe roster with the join armed.
-
-**Evidence, pinned on both sides of the boundary:**
-- **Floor-side route witness** — `test.claim.route_gap_partition_witness`, gate-admitted at exact module
-  grain in `required_gate_authored_modules` (the same mechanism and operator ruling as
-  `test.claim.discovery_census_witness` and `test.claim.seed_growth_admission_witness`): drives the
-  modeled relation over the shared fixture `src/v2/test/fixture/route_gap_admission_partition.dag` and
-  asserts both arms on the floor — the route, executed by a required run. Substrate inputs only
-  (constructed lists; no host effect, no service).
-- **Seed-side pairing witness** — `route_gap_admission_partition_tests` in `required_floor_runner.rs`
-  drives the SAME entry by the SAME constant through `run_in_context_with_args` (the real call path the
-  run site uses) and asserts both arms at identity grain; a second test pins the marshal shape (identity
-  and declared ground arm, nothing else). Runs via the required `rust-unit-tests` lane (see the wall's
-  standing below — `DESIGN.md` "Building & checks"; the lane returned required on 2026-09-30).
-- **One implementation**: with the Rust classifier deleted, the run site's route to the answer is the
-  modeled entry by construction; a run-path refusal names the entry that decided it.
-
-**The wall's real standing (corrected per review 76431 — an earlier revision of this paragraph claimed a
-shipped fixture; the fixture is gone, per review 38602, and this is what actually holds):**
-
-- **Green by execution on the required path:** the partition IS the run's own admission step — on every
-  required run it executes over the real roster, names every suppressed enrollment per identity with its
-  ground (the `[floor-route-gap]` suppressed lines), and the reverse join decides over the observable
-  remainder. The consumer is the fold itself; nothing about the green arm is test-only. A freshly authored
-  claim shaped like the dropped population (declared, out-of-gate, enrolled) gets the same typed, located
-  disposition on that run as the 536 do.
-- **Discriminating red: authored at unit grain AND enrolled on a required lane.** The misnamed-enrollment
-  control runs both ways this PR ships:
-  - **On the floor (REQUIRED, blocks merge):** the claim-home row in `v2.workflow.required_floor`
-    `required_gate_authored_modules` gate-admits `test.claim.route_gap_partition_witness`, whose third test
-    (`dag/test/claim/route_gap_partition_witness_test.dag`) drives the modeled partition over the shared
-    fixture and asserts the refused arm at identity grain — the wall's red executes on the `witnesses`
-    lane, which is a required merge gate, with substrate inputs only (constructed rows and the fixture's
-    keyed declared map; nothing shipped on the production roster, per review 38602's rejection).
-  - **At unit grain (REQUIRED):** the pairing witness in `route_gap_admission_partition_tests` drives
-    `run_in_context_with_args` — the real call path the run site takes — over the same fixture rows and
-    asserts both arms; it runs via `cargo test --release -p v1-compiler --lib`, which per `DESIGN.md`
-    "Building & checks" runs as the `rust_unit_tests` step of the required `rust-unit-tests` job, so a
-    unit-test red blocks a merge. (The doc previously cited a stale generated projection,
-    `docs/onboarding.md` line 175, saying the lane ran on no required step; the authority is `DESIGN.md`,
-    and `DESIGN.md` records the lane's 2026-09-30 return and the retirement of the
-    `rust_unit_tests_off_the_merge_path` drop.)
-  The standing caveat that remains is narrower: a *live roster* misname — a misnamed enrollment shipped
-  onto main's production roster — is not how the red is authored (rejected by review 38602: it would red
-  main forever and fabricate a gap the §5 oracle forbids); the red is authored from fixtures the claim
-  supplies. The (b) follow-up above — a dispatch instrument row that runs a probe roster with the join
-  armed — remains the path to authoring that red over the real production roster rather than a fixture.
diff --git a/docs/plans/runner-service-capacity-convergence.md b/docs/plans/runner-service-capacity-convergence.md
deleted file mode 100644
index 2bc7701cd9d..00000000000
--- a/docs/plans/runner-service-capacity-convergence.md
+++ /dev/null
@@ -1,213 +0,0 @@
-# Runner service capacity convergence
-
-**Status:** design, not implemented. Written 2026-08-25 from a live incident on srv1/srv3.
-
-## Why this exists
-
-Fleet convergence reported hosts converged while they served no traffic. srv1 held **50 slot
-directories and 5 running services**; srv3 went from 8 directories to 21 while its running count
-stayed at 5. Nothing in the pipeline could notice, because the convergence object is filesystem
-membership and the subject that matters is **service capacity**.
-
-Filesystem convergence is a legitimate *subordinate* family; the defect is that it was read as
-implying serving capacity.
-
-## The incident chain, in order, each blocker masking the next
-
-```
-1. ghrunner held no sudo grants        -> apply could not reach installation
-2. grants installed                    -> 13-16 runner trees could be materialized
-3. install path does not activate      -> directories existed, capacity unchanged
-4. units enabled/started by hand       -> pinned runner v2.334.0 reached GitHub
-5. GitHub refused fresh 2.334.0        -> systemd restarted unusable processes forever
-6. release replaced with v2.336.0      -> serving capacity finally rose
-```
-
-The privilege work was necessary and could never be sufficient: it proved the host could
-execute the installer, never that the provider would accept what was installed.
-
-## Three defects, all still open
-
-### 1. Membership is not incarnation-sensitive
-
-`runner_slot_member_value_eq` compares only `slot_dir`. A 2.334.0 tree and a 2.336.0 tree at the same
-path are the same member, so a release bump repairs nothing that already exists.
-
-**The receipt:** 29 slot directories were deleted by hand across srv1 and srv3 to force
-re-provisioning — replacement could only be induced by turning an existing member into an absence.
-
-`LocalRunnerSlotIncarnation` carries slot, unit, unit_active and registration_name -- not the
-installed artifact -- so it cannot express *same slot, same unit, same registration, different
-release*, which is exactly the state that hurt.
-
-### 2. The install path cannot activate — INTENT LANDED, NOTHING ACTIVATES YET
-
-The emitted `apply.sh` carried `daemon-reload` and `disable`. Enable count 0, start count 0.
-
-The two are separate transitions that must not be re-fused: `enable` is durable boot intent,
-`start` is immediate activity. Both consume the activation admission, because enabling authorizes a
-future reboot to start the broker under readiness conditions that may no longer hold.
-
-**What landed.** `gunbc.runner_service_activation` models the two transitions, admits each one
-separately against `admit_runner_activation`, and derives the emitted lines from
-`gunbc.executor_privileged_operation`'s new `SystemdEnableUnit` / `SystemdStartUnit` — so the
-sudoers grant and the executed command are one argv, and the fused `enable --now` the hand loop ran
-has no grant on any executor host. `fleet_converge_plan` carries an activation family beside the
-slot family, with its own line in `plan.txt` and its own refusal count.
-
-**What did NOT change — read this before quoting a green apply as converged capacity.** The
-admission is unreachable in production; two blockers sit **in series**: no host observation
-transaction exists, so every production caller supplies `ActivationReadinessUnobserved` and the
-admission is never asked; behind that, `admit_runner_activation` requires a `HostCompilePoolReady`
-whose producer answers `PoolNotDeclaredInTopology` fleet-wide under `CompilePoolInRunnerSlots`.
-Flipping the placement changes nothing observable while the first stands — the pool receipt is a
-field *inside* a readiness value that is never `Observed`. So both transitions refuse on every host
-today, `apply.sh` prints a typed located refusal for each, and serving capacity does not rise from
-apply alone.
-
-That state is a typed `GuaranteeStall` row — `runner_activation_reachable_green_stall` — not
-prose, per §4b: a gate whose only reachable state is refusal must say so, or a reader cannot tell a
-permanent structural refusal from a transient one. The row names the observation transaction as
-the immediate blocker and the placement behind it, in that order, because naming only the second
-yields a plan that does fleet-wide topology work and measures no change.
-
-**Unreachable in production is not inert.** §4b judges reachability against what a *fixture* may
-author, and `test.claim.runner_service_activation` authors `ActivationReadinessObserved` and drives
-the admitted enable/start path with it — so the emission has an authorable, exercised RED at the
-fixture boundary.
-
-**What the item bought,** without inflation: an invisible hand loop became a named,
-counted, located refusal. `enable count 0` was indistinguishable from a host with no activation
-work; `activation-refusals=2` with its cause is not.
-
-**The host boundary is mitigated, not structural, and the safety row says so.** The grants install
-the raw `systemctl enable <unit>` / `systemctl start <unit>` verbs for `ghrunner`, so the grantee can
-run them directly, outside the admission. Three claims must be kept apart: *enable and start
-are separately authorized* is structural (no derived sudoers line matches `enable --now`); *this
-emitter cannot activate without readiness* is structural inside the modeled call graph; *the host
-cannot activate without readiness* is **false**. `runner_activation_safety_guarantee` records
-`Mitigatable` with the next-rung trigger — the job user stops holding the verbs, via a root-owned
-helper that validates a receipt or a root-owned convergence service. A narrower sudoers match cannot
-climb it: any grant that lets the sanctioned path run the command lets the grantee run it too.
-
-**Next.** The host observation transaction — the shared blocker named below — and only then the
-placement flip, with a width decision re-derived per host from live `nproc`/`MemTotal` rather than
-from `gunbc_jobserver_token_override_note`, which is stale for srv1. Until both land, capacity
-increases stay manual, and the refusal in `apply.sh` says so.
-
-### 3. Provider admissibility is unmodeled
-
-Three different guarantees were collapsed into one pin:
-
-```
-ArtifactIntegrity      these are the exact bytes and digest we chose      HELD
-ArtifactAvailability   the vendor still publishes those bytes             HELD
-ProviderAdmissibility  the vendor's control plane still permits them      MISSING
-```
-
-An exact digest proved we faithfully installed the wrong operational version.
-
-`Listening for Jobs` is **not** acceptance -- the rejection arrives after that line.
-
-## Serving vs restartable capacity
-
-The distinction the incident exposed, worth carrying as a number rather than prose:
-
-```
-serving_count      members providing capacity now
-restartable_count  members whose fresh incarnation the provider still admits
-```
-
-Before the replacement srv3 was `ServingButNotRestartable`: five runners on pre-deprecation
-registrations, alive only until something restarted them. A fleet that meets load only while nothing
-restarts is not converged, and today no carrier can say so.
-
-## The layered object
-
-Independently observed families composing into one verdict -- not a single `runner healthy` Bool:
-
-```
-RunnerMaterializationStanding = Absent | CorrectIncarnation | WrongIncarnation | Unobserved
-RunnerEnablementStanding      = Enabled | Disabled | Unobserved
-RunnerActivityStanding        = Active | Inactive | Activating | Failed | Unobserved
-RunnerProviderStanding        = ExistingSessionServing | FreshMessageChannelAccepted
-                              | FreshJobAccepted | RejectedDeprecated | Unobserved
-```
-
-The host verdict is over the **exact desired GitHub identities**, never raw committed width -- srv3 is
-precisely where those differ, and a fabric identity must never inhabit the GitHub service family.
-
-## The shared blocker: there is no host observation transaction
-
-Both remaining repairs wait on the same missing seam. `fleet_converge_plan` observes directory
-membership and nothing else -- zero matches for `BuildCacheInstanceReady`, `HostCompilePoolReady` or
-`admit_runner_activation`. It cannot answer:
-
-```
-which release is installed in this slot?
-is the unit enabled? active? failed?
-does this exact cache / compile-pool receipt exist?
-does GitHub accept a fresh incarnation of this release?
-```
-
-The repair is a real observation transaction feeding several reconcilers -- **not** manufacturing the
-receipts in the planner, and not an activation action that permanently refuses.
-
-**Every sub-observation needs its own unavailable arm.** One failed `systemctl` read must not erase a
-successful installed-version observation, and one unavailable version read must not become
-`WrongIncarnation`.
-
-## The compatibility probe, and why it need not run a job
-
-Two questions hide inside "will GitHub hand work to it":
-
-1. will the broker accept this fresh runner version on its message channel?
-2. will the scheduler match and deliver an actual job?
-
-**Only the deprecation class is question 1**, and a no-job probe settles it. The runner opens a broker
-session then polls a message endpoint, sending `runnerVersion` among other fields; the broker maps
-`RunnerVersionTooOld` to exactly the access-denied failure observed on srv3. So a successful
-message-poll from a *fresh incarnation* is the discriminator. A canary job is only needed for
-question 2, which is not what deprecated us.
-
-Scope it per `release x architecture x scope` with a bounded validity age -- not per slot.
-
-## Do not make "latest" the authority
-
-That trades reproducibility for churn and is wrong during a progressive rollout or a bad release.
-Policy: a reviewed pinned candidate plus a compatibility receipt plus a declared maximum
-observation age. A new upstream release creates an *obligation* -- test, review the pin change, plan a
-rolling replacement -- never an automatic fleet mutation.
-
-## Rolling replacement, not restart
-
-When the desired artifact changes, per slot: stage the correct artifact, drain the old broker, replace
-the incarnation, start the new broker, prove fresh provider acceptance, then continue.
-
-**Do not restart the old runners first.** In this incident restart was exactly what converted latent
-old capacity into visible failure.
-
-## Sequencing
-
-```
-materialization plan/apply -> independent materialization readback
-fresh cache/pool observations -> activation admission -> enable -> start -> service readback
-provider compatibility readback -> serving/restartable capacity receipt
-```
-
-An installation plan minted before readiness must never later authorize starting a runner: activation
-needs a fresh subject and fresh observations.
-
-## Landed vs open
-
-**Landed** (PR #9152): one argv grounds both the executed command and its sudoers grant; run-as
-narrowed `ALL` -> `root`; wildcards eliminated; the bootstrap principal recorded as a typed row with a
-witness (`ubuntu`, not the deploy row's `ssh_target`); release bumped to 2.336.0.
-
-**Built, not landed** (`session/warm-tern-755-runner-activation`): the three-axis service standing with
-its 13-row truth table and mutation receipt. Split out for having no production consumer -- which is
-this document's shared blocker.
-
-**Open:** incarnation-sensitive membership; the host observation transaction; provider admissibility;
-serving/restartable counts; the compile-pool placement flip that gives the activation admission a
-reachable green.
diff --git a/docs/plans/scm-corpus-manifest-design.md b/docs/plans/scm-corpus-manifest-design.md
deleted file mode 100644
index 226f147d99a..00000000000
--- a/docs/plans/scm-corpus-manifest-design.md
+++ /dev/null
@@ -1,256 +0,0 @@
-# SCM `add`/`commit` — a commit freezes an authored corpus; a program is a projection of it
-
-Subject of gunbc#9891 finding 6, settled with the designated SCM reviewer before implementation.
-The governing sentence:
-
-> **A repository commit freezes an authored corpus manifest. A semantic program is a separately
-> bound ingestion projection of that corpus, not an alternative kind of commit subject.**
-
-## 1. The gap
-
-`gunbc.scm.cli` exposes `scm_log`, `scm_status`, `scm_init` — no `add`, no `commit`. `cli.dag`
-documents the consequence about itself: it passes `empty_proposal()` because "the entry does not
-carry what is staged", "a REAL limitation rather than a placeholder". So the kernel has no producer,
-which is the §5 specification-without-execution gap the SCM design note also names.
-
-## 2. Two corrections to this note's own earlier drafts
-
-**Ingestion is modeled, not absent.** An earlier draft asserted otherwise. It searched
-`dag/gunbc/scm`, found nothing, and let an empty subtree speak for the repository — *a partial
-observer returning the negative value of a total observer*, the class whose ledger was
-`gunbc.namespace_wave_admission`'s at this writing (that module was deleted with the
-wave-admission wall, operator ruling 2026-09-19). `src/v2/compiler` models `01_tokenize`, `02_parse`,
-`03_ingest`, `00_compile`.
-
-**Most of the proposed vocabulary exists.** `v2.compiler.source_authority` declares
-`SourceRef { path, source_root, content_hash }` and `SourceRootIngest`, with
-`source_root_ingest_build_from_source_refs`. Minting a manifest of `path -> content identity` would
-be a second name for it. Finding 6's *substance* stands; its proposed vocabulary does not.
-
-## 3. `semantic_root` does not belong in the manifest
-
-Finding 6 phrases the manifest as `path -> semantic_root -> authored_source_identity`. That is
-wrong for a deeper reason than present-day constructibility: **`semantic_root` is a derived
-ingestion result**, depending on the source object, corpus context and imports, the ingestion rule,
-language and rule versions, and possibly source-root and target configuration. Putting it in the
-manifest fuses an input with a realization result, and makes the manifest unauthorable for
-malformed or not-yet-ingested source — precisely the corpora a source-control system must still be
-able to freeze.
-
-The authored manifest is therefore only:
-
-    canonical corpus path -> exact authored-source target
-
-and the semantic relation lives in a separate carrier, whose load-bearing properties are that it
-names the manifest it is about, names the ingestion rule/version, keeps each per-file semantic
-result bound to the exact source identity, and derives the global program root rather than
-accepting one supplied beside the corpus:
-
-    type CorpusIngestionProjection { corpus, ingestion_rule, program_root, files }
-    type FileIngestionProjection   { path, source, semantic_root }
-
-This preserves the case that proves the split: a comment-only edit changes authored bytes, so
-manifest A ≠ manifest B, while the semantic root is unchanged.
-
-## 4. Object-store membership and edge admissibility are separate axes
-
-The manifest joins `ScmObject` **without** becoming a legal `StoredEdge` target:
-
-    type ScmObject = SemanticNodeObject(ObjectRecord)
-                   | AuthoredSourceObject(AuthoredSourceRecord)
-                   | CorpusManifestObject(CorpusManifestRecord)
-
-`StoredEdge.target` remains exactly `SemanticNodeTarget`, so #9891's distinction is untouched. Each
-kind gets its own target and its own three-way find outcome, so a walk cannot read one kind's
-absence as another's: the manifest walk follows only authored-source targets, a semantic node only
-semantic targets, an authored source nothing.
-
-`CommitClosure` is **not** silently widened — its subject is a semantic root. Either a separate
-corpus closure, or a parameterized mechanism whose exported outcomes still distinguish
-semantic-node requirements from authored-source requirements.
-
-## 5. `commit` must not refuse for want of ingestion
-
-This corrects an earlier proposal in this note that `commit` be withheld until ingestion is green.
-
-Freezing what was authored is **fully answerable today**: paths are known, bytes are known, source
-identities and the manifest identity derive from them, and the exact authored state is
-reconstructible. The missing fact appears only when a *semantic* question is asked — reconstruct the
-node, integrate role requirements, validate, produce semantic closure. Those answer
-`SemanticProjectionUnavailable { corpus }` or an ingestion refusal carrying real diagnostics.
-
-Refusing `commit` would fuse **recording state** with **establishing semantic validity**, which the
-SCM design keeps apart. An invalid corpus, or one this compiler cannot ingest, must still be
-committable if `commit` is to remain distinct from certification.
-
-So the canonical record becomes approximately:
-
-    type RepositoryCommit sole_constructor {
-      reference: RepositoryCommitRef
-      corpus: CorpusManifestObjectRef
-      message: String
-      ancestry: CommitAncestry
-    }
-
-Two repositories may differ in *projection availability* while agreeing entirely about the commit.
-Disagreement about which manifest a commit names stays forbidden; two projections under one
-`(manifest, ingestion rule)` key yielding different roots must refuse as an authority collision.
-
-Compatibility with the existing semantic-root format belongs in a **versioned decoder**, not in the
-canonical writer — and absent a measured durable population, root-migrate rather than keep a
-permanent legacy arm.
-
-## 6. A naming fork to close before both sides gain consumers
-
-`gunbc.scm.checkout` declares a bare `Commit`, which role-requirement integration returns; the
-repository record is `RepositoryCommit`. They currently meet on a semantic root. Once repository
-history is corpus-rooted they stop meaning the same thing, so the bare one becomes
-`SemanticCommit` / `ProgramRoot` before both gain production consumers — the same §3 fork this
-lane's previous PR closed for `merge`.
-
-## 7. Scope, stated no larger than it is
-
-`add`/`commit` makes load-bearing: the authored-source store, the manifest, repository history,
-persistence, `log`, `status`, and the ancestry spine.
-
-It does **not** make role-requirement integration load-bearing. That operation returns the separate
-semantic commit whose only content is a node root; it does not produce a `RepositoryCommit`.
-Joining those two worlds still needs ingestion, and eventually semantic-to-authored emission.
-
-## 8. Sequence
-
-1. **Model**: the manifest object, its ref and target, the three-way find outcome, the corpus
-   closure, `RepositoryCommit.corpus`, the `Commit` rename, the versioned decoder.
-2. **Verbs**: `add` (stage), `status` (report staged), `commit` (freeze the manifest).
-
-Pending state is not option B: a *committed* manifest must be reachable from the commit, while a
-*pending* one is intentionally not — `RepositoryEnvelope.checked_out` is already local workspace
-state rather than authoritative history.
-
-## 9. Where a manifest is wrong, and where it is merely present
-
-Adding a third arm to `ScmObject` forces every exhaustive match over it to answer for a manifest,
-including the commit-closure census and the v3 JSON encoder. Two of the three available answers are
-wrong for reasons worth recording, because each is a failure class this lane has already committed
-once.
-
-**Refusing when a manifest exists anywhere in the store** makes "serialize the semantic closure
-rooted at P" fail on unrelated repository inventory. A manifest is wrong **at a
-`SemanticNodeTarget`**; it is not wrong **in an `ObjectStore`**. That is the same
-membership-versus-admissibility split that keeps `StoredEdge.target` exactly `SemanticNodeTarget`,
-applied one layer up — and collapsing it is the absorbing fallback of §5, refusing a superset
-because the precise subject was not derived.
-
-**Bumping the closure format tag** was rejected here on the grounds that the wire schema was
-unchanged — and that reasoning was superseded by what the cut turned out to require. The v4 bump
-that landed is the OPPOSITE claim: the writer can no longer emit `{source}` and the reader refuses
-one, so the language got **narrower**, and holding a tag while the language shrinks is the same
-false claim as holding it while it grows. `gunbc-scm-commit-closure-v4`, `gunbc-scm-repository-v3`
-and `scm-object-identity-v2` are what shipped.
-
-> **Superseded in part.** The repository tag is now `gunbc-scm-repository-v4`: gunbc#10560 moved
-> `RepositoryCommit.root` from a semantic node to a corpus manifest, so the member spelled `root`
-> designates a different population while keeping its name — which is precisely why the tag had to
-> move. `gunbc-scm-repository-v3` is refused BY NAME as retired rather than folded into unrecognized,
-> and there is deliberately no v3 reader. The other two tags are unchanged, and that is the point of
-> versioning them on separate axes: the closure format has its own subject, and the identity rule did
-> not move because hashing did not. Read the tags from `gunbc.scm.repository_envelope`, not from this
-> sentence — a transcribed tag rots without anyone touching either end.
-
-The cut is neither of the two arms above. `commit_closure_json_v2` already declared the obligation
-this change discharges: every record the store holds is serialized, which it states is correct
-*while nothing produces unreachable objects*. `CorpusManifestObject` is exactly the event that makes
-that false, so the deferral's own dissolution trigger has fired.
-
-So the admitted carrier stops carrying the raw store and carries the **root-reachable semantic
-closure**. The design draft above proposed a two-armed `ClosureObject` with a
-`ClosureAuthoredSource` arm; that arm was found to be **uninhabited** during implementation, because
-no typed path reaches an authored source from a semantic root, and the reviewer's ruling changed to
-nodes only. What shipped is:
-
-- `WellKindedClosure { root: SemanticNodeTarget, nodes: List<ObjectRecord> }` — one kind, not a
-  coproduct, because there is nothing else to be reached;
-- the admission walks from the root; at each `SemanticNodeTarget` a node is included and recursed
-  through, an authored source and a manifest are each their own named wrong-kind population;
-- the encoder's parameter therefore cannot name a manifest at all: unconstructible rather than
-  validated — §4b rung 4 rather than a commented-over rung 3.
-
-Two consequences bind the implementation, and one more was found by review. First, **one derivation
-authority**: both `admit_well_kinded_closure` and the partial route must consume the same
-`derive_semantic_closure(store, root)` result. Second, `well_kinded_store` **loses its name**:
-returning a node list under a store-shaped name would say the carrier still holds a store.
-
-Third, and this is the one the draft missed: `sole_constructor` seals the record LITERAL, and `.dag`
-has no module privacy, so a public mint beside it re-opens everything. The module shipped
-`well_kinded_image(closure)`, which took an unchecked closure, discarded the derivation's census and
-returned encoder input anyway. **The mint is deleted**; the literal appears once, inside the
-else-branch of the census that authorizes it, and the admitted arm carries the unresolved population
-so nothing walks the closure twice to re-derive it.
-
-Unrelated authored sources leaving the document is a consequence, not a regression. "It happened to
-be in the repository store" was never semantic reachability.
-
-### The witness bar for this cut
-
-1. **Unrelated manifest control** — semantic root, valid node closure, an unrelated manifest in the
-   store: admission succeeds and the manifest is absent from the admitted closure.
-2. **Manifest-at-node RED** — a `SemanticNodeTarget` whose locator holds a `CorpusManifestObject`:
-   a named wrong-kind refusal, never `absent`.
-3. **Unrelated source control** — an authored source not reachable from the root is absent from the
-   emitted population.
-4. **Partial path parity** — the ordinary and partial routes derive the same population; mutating
-   either back to the raw store takes a manifest fixture red.
-
-## 10. What the corpus closure does *not* get yet
-
-`CorpusClosure` is **not** modelled. An earlier revision of this section said it was — naming its
-complete/partial/wrong-kind outcomes, its identity behaviour and its witnesses as landed — and no
-such carrier exists. What exists is `ManifestSourceCensus`, which answers the manifest-source
-reachability question over a finished store in three populations (absent, node-occupied,
-manifest-occupied) and is consumed by both the checked repository writer and the repository reader.
-That is the minimum the write-safety question needed; it is not a closure carrier and does not
-pretend to be one.
-
-It gets no JSON codec here either. A named codec earns an actual boundary, and nothing yet persists
-or transports a corpus closure; building one would add a representation with no consumer immediately
-before a lane whose stated purpose is to stop doing that.
-
-The deferral does not extend to the repository codec. The moment `add`/`commit` persists a
-repository holding manifest objects, commits naming them, or pending corpus state, the repository
-format necessarily advances and must encode manifests — and that lands atomically with the first
-path that saves such a repository, not before and not after. If the repository envelope turns out to
-be the only representation `add`/`commit` needs, a standalone corpus document should never be built
-at all.
-
-## 11. Corrections this document owes to its own earlier revisions
-
-Recorded here rather than silently rewritten, because a plan that quietly agrees with whatever
-shipped is not evidence of anything.
-
-- **The `SourceRef` duplication warning (§2) was about a different construction.** The manifest that
-  shipped holds `(path, AuthoredSourceTarget)` and mints no second source identity, so the warning
-  stands as a rule and does not describe this head.
-- **The manifest was specified as an ordered list and is now a function.** Ordered hashing made a
-  host directory traversal order part of the manifest identity, and admitted one path naming two
-  sources. Entries canonicalize by path and a duplicate path refuses.
-- **`ClosureAuthoredSource` was an uninhabited arm**, as above.
-- **The witness bar in §9 is met, with its second item widened.** A manifest at a semantic
-  requirement is a named wrong-kind refusal in the closure, the checked writer and the reader — the
-  draft only anticipated the closure.
-- **That last sentence overclaimed the reader for one revision, and this is where it did.** When it
-  was first written the reader adjudicated one subject: a MANIFEST ENTRY's authored source. A
-  SEMANTIC CHILD naming a manifest or a file by digest still reached `RepositoryDecoded`, so the
-  sentence was true of the writer and only half true of the reader. Both subjects are adjudicated
-  now, against the finished decoded table, and the discriminators for each occupying kind execute in
-  `test.claim.scm_repository_envelope_witness` — but the claim preceded its second half, which is
-  the failure this document is a ledger of.
-- **A wrong-kind requirement reached two different standings depending on how its reference was
-  spelled.** `uncontained` classified as `LoadRequirementAtWrongKind`; the same predicament reached
-  through a contained position classified as `LoadDocumentMalformed`, which is the one standing that
-  permits the supersession step. The predicament decides the standing now, and the paired claims run
-  the decoder, the classifier and the permission table rather than constructing standings by hand.
-- **A "the occupant arrives after the referrer" witness never presented that order.** It changed
-  store insertion order, but `emit_in_dependency_order` follows each reference through the
-  kind-agnostic `find_object` and emits the occupant first regardless, so both fixtures produced the
-  same bytes. The controlled version rewrites the encoded `objects` array and asserts the order took
-  effect before asserting the refusal.
diff --git a/docs/plans/scm-demo-cli-rebuild.md b/docs/plans/scm-demo-cli-rebuild.md
deleted file mode 100644
index a82ebb689d7..00000000000
--- a/docs/plans/scm-demo-cli-rebuild.md
+++ /dev/null
@@ -1,322 +0,0 @@
-# SCM demo CLI — rebuild plan and API inventory
-
-A working `gunbc scm` CLI existed and was lost with an uncommitted `/tmp` worktree. This doc is
-the durable record so the rebuild does not start from a survey again.
-
-It is a PLAN AND A HISTORICAL LEDGER, and the two are separated by section. Everything above
-`## LANDED` is the plan and the baseline survey, written BEFORE this work and describing main as
-it stood then; it claims nothing is built. `## LANDED` onward is the ledger, and it carries
-execution receipts for what has actually shipped. Read a present-tense statement in the plan half
-as a statement about the BASELINE, not about the tree today.
-
-## What already exists on main (verified by reading the modules)
-
-The read side is modelled and already reaches `CliWireResponse`:
-
-| module | symbol | shape |
-| --- | --- | --- |
-| `gunbc.scm.read_command` | `ScmReadResult<T>` | `ScmReadAnswered { path, answer }` \| `ScmReadRepositoryUnavailable { cause }` |
-| `gunbc.scm.render` | `scm_log_cli_response(result, target, capability)` | `-> CliWireResponse` |
-| `gunbc.scm.render` | `scm_status_cli_response(result, target, capability)` | `-> CliWireResponse` |
-| `gunbc.scm.render` | `scm_read_exit<T>(result)` | `-> ProcessExit` |
-| `gunbc.scm.log` | `repository_log(envelope)` | `-> CommitLog` |
-| `gunbc.scm.status` | `repository_status(envelope, pending)` | `-> RepositoryStatus` |
-| `gunbc.scm.repository_load` | `load_repository(path)` | `-> RepositoryLoad` |
-| `gunbc.scm.repository_load` | `repository_load_refusal_lines(cause)` | `-> List<String>` (takes `cause` ONLY, not `path`) |
-| `gunbc.scm.repository_save` | `save_repository(path, repo)` | `-> RepositorySave` |
-| `gunbc.scm.repository_envelope` | `empty_repository()` | `-> RepositoryEnvelope` |
-| `gunbc.scm.repository_envelope` | `mint_repository_commit(...)` | `-> RepositoryCommitMint` |
-| `gunbc.scm.repository_envelope` | `commit_at_reference(commits, reference)` | `-> RepositoryCommit?` |
-| `gunbc.scm.checkout` | `checkout_repository_at(repo, reference)` | `-> RepositoryCheckout` |
-| `gunbc.scm.authoring` | `empty_proposal()`, `author_requirement(proposal, requirement)` | `-> Proposal` |
-| `gunbc.scm.object_store` | `empty_store()`, `store_contains`, `find_object`, `store_object_count` | — |
-
-## The gap, stated precisely
-
-**This was the baseline gap, and this change closes it.** As of the survey above,
-`scm_log_cli_response` and `scm_status_cli_response` had NO consumer outside
-`dag/test/claim/scm/scm_render_witness_test.dag` — the unwired-renderer state
-`gunbc.cli_dispatch_surface` recorded: the answer computed and discarded because no host bound it.
-`gunbc.scm.cli` is that consumer, and the `LANDED` section below carries its receipts.
-
-`dag/gunbc/cli_dispatch_surface.dag` declares an `scm` verb with an operand and `--path`, marked
-`AbsentFromEmitMainRs`.
-
-## Two host shapes, and why the idiomatic one is not sufficient
-
-The corpus's established instrument shape is `fn check(subject) -> ProcessExit`, returning
-`exit_failure(reason: join(lines, "\n"))` — see `tools.dag_compile_clean_gate` and its siblings under `dag/gunbc/instruments/`. `gunbc run` prints
-that reason. **It can only emit text on FAILURE.** `log` and `status` must print on SUCCESS, so
-that shape cannot express them, and returning `CliWireResponse` from `gunbc run` refuses (its
-not-`ProcessExit` refusal prints the value, which is not a CLI).
-
-So the host binding is REQUIRED, and it is the piece to rebuild:
-
-1. DONE for read verbs. Still to do for WRITE verbs (`init`, `add`, `commit`, `checkout`):
-   they need `Document` builders, which only log and status have today, and `save_repository`
-   goes through `Filesystem.Write`, so they are host-effect entries rather than pure reads.
-   Original note: `dag/gunbc/scm/cli.dag` — one entry per verb returning `CliWireResponse`, composing
-   `load_repository` -> verb -> render, with a `RenderCapability { color: false, tier: Ascii,
-   cursor_addressable: false }` for a plain terminal. Write verbs (`init`, `add`, `commit`,
-   `checkout`) need their own `Document` builders; only log/status have them today.
-2. Host side. **NOT the shape that landed, and deliberately so — this bullet is a FUTURE
-   ERGONOMIC SURFACE, not unfinished work required by the binding that shipped.** The original
-   plan was a `Commands::Scm` variant in `src/v1/stage0/src/main.rs` plus a `scm_verb` evaluating
-   the entry and writing `CliWirePrintable { bytes, exit }` to stdout. What landed instead binds
-   `CliWireResponse` ONCE in the generic `run_verb` outcome seam, so EVERY wire-returning entry
-   becomes reachable rather than only the scm family — one binding instead of one per verb. A
-   dedicated `gunbc scm` subcommand would be a nicer surface over the same answer; it is not
-   needed for the answer to reach an operator, and it is not part of this change.
-
-## LANDED — the read side reaches an operator
-
-`dag/gunbc/scm/cli.dag` (`scm_log`, `scm_status`) plus the `run_verb` outcome-seam binding.
-Receipts, by execution against `dag/test/fixture/scm_repository_load/empty_repository.json`:
-
-    $ gunbc run --entry dag/gunbc/scm/cli.dag --function scm_log --arg path=<fixture>
-    no commits yet
-    exit 0
-
-    $ gunbc run --entry dag/gunbc/scm/cli.dag --function scm_status --arg path=<fixture>
-    nothing checked out
-    0 commits
-      nothing staged
-
-    $ gunbc run --entry dag/gunbc/scm/cli.dag --function scm_log --arg path=/tmp/no-such-repo
-    cannot read repository at /tmp/no-such-repo
-      No such file or directory (os error 2)
-    repository unavailable
-    exit 1
-
-The third is the load-bearing one: bytes printed AND a nonzero exit, the case an absorbing
-implementation turns into silence or a spurious 0.
-
-### `init` — LANDED separately, via the create-only write (#10026)
-
-**init was CUT from the log/status change and landed on its own, as gunbc#10026.** The receipts
-below were taken against the ORIGINAL prototype and are kept as its historical record; the shape
-that actually landed differs, and the differences are the point.
-
-Why it could not ride along: the prototype observed an absence and then called `save_repository`,
-which writes UNCONDITIONALLY. A racing actor between the observation and the write makes it
-truncate the very bytes it claims to refuse — a TOCTOU the four-arm fold does not close, because
-the fold decides on a fact that can stop being true before the write happens. Closing it needed an
-atomic create-only write (`O_CREAT|O_EXCL`) as a new modeled file-transport verb, which is why it
-became its own change with its own review.
-
-What #10026 landed, and what review then found still open in it: `Filesystem.WriteCreateNew` makes
-the existence test and the creation one syscall, and `create_repository` routes through it. Review
-`5089156132` then found six further defects in the init MODEL — among them that `ScmInitialized`
-could contain a FAILED save, and that the `FilesystemEstablishedAbsence` authorizing the write was
-matched as `_` and discarded while the actuation used an independently supplied path. Those are
-being repaired in the follow-up on the same branch; do not read this subsection as describing a
-finished init.
-
-`scm_init` takes a DIRECTORY and a NAME rather than a path, because presence is a fact about a
-directory listing and recovering the directory by splitting a string would be a second, positional
-naming scheme for something the caller already knows. It routes through
-`extdeps.filesystem.filesystem_io` `filesystem_file_observation`, so absence is established from a
-listing that succeeded and did not name the entry — never from a failed read, whose success channel
-cannot separate absent from unreadable. Only the established-absence arm reaches `save_repository`.
-
-Two earlier revisions were fail-open and both were caught by external review before merge: the first
-called `save_repository` unconditionally and NAMED the overwrite in a comment; the second proceeded
-on `RepositoryFileUnreadable`, which is a guess about the host's permission model — a file can be
-unreadable and perfectly truncatable — and again named the residual instead of refusing it
-(review 58060 on gunbc#9864).
-
-Receipts, one per arm, `gunbc run --entry dag/gunbc/scm/cli.dag --function scm_init --arg
-directory=<d> --arg name=repo.json`:
-
-    fresh directory       [file] list … / [file] read … / [file] write …/repo.json (166 bytes)
-                          initialized repository at /tmp/scminit/fresh/repo.json
-
-    repository present    refusing to initialize /tmp/scminit/existing/repo.json
-                            a repository is already there, and init would replace its whole history
-
-    foreign file present  refusing to initialize /tmp/scminit/foreign/repo.json
-                            a file is already there that is not a repository, and init would destroy it
-                          and the file read back afterwards still holds its original bytes
-
-    directory unlistable  refusing to initialize /tmp/scminit/nodir/repo.json
-                            the path could not be observed, so nothing about it is established --
-                            the directory /tmp/scminit/nodir could not be listed, so the absence of
-                            repo.json is not established -- Permission denied (os error 13)
-
-The fourth is the load-bearing one: an observation that could not be made refuses rather than
-widening to "nothing is there", which is the absorbing fallback DESIGN §5 names.
-
-Those init claims were hermetically enrolled in `test.claim.scm.scm_cli_witness` at the time — no
-init refusal rendering as a success exit, the three refusals rendering differently, the unobserved
-arm carrying the host's cause through. **They left with init and are NOT in this PR's witness**;
-they travel with `scm-init-create-only`. Verified: `scm_cli_witness` on this branch contains no
-init claim at all.
-
-### Evidence boundary, stated rather than implied
-
-Enrolled and executing in CI (`rust-unit-tests`, `cargo test -p v1-compiler --lib`): the five
-`cli_wire_outcome_tests` covering the total map — bytes with the response's own exit, a rendered
-answer that still fails, a renderer refusal not reading as empty success, the non-wire
-fall-through, and the inherited `ExitFailure { code: 0 }` refusal.
-
-NOT enrolled: the end-to-end runs above are a MANUAL receipt. An integration test that executes
-the binary would live in `src/v1/tests/`, which `clippy --all-targets` compiles and no CI step
-runs (DESIGN: no CI step executes test targets outside `--lib`). A `.dag` witness cannot stand in
-either — `scm_log` reads a file, and the SCM witnesses are `SubstrateInputsOnly`, refusing at the
-hermetic boundary. So the class is `mitigatable` on the e2e path and the next-rung trigger is a
-CI step that runs an integration target, not another test file.
-
-## Next increment: `add` and `commit`, and the one design step they need
-
-Still settled, because it is a fact about the HOST rather than about any object model:
-
-- **A host WRITE is permitted from `gunbc run`** — established by the init prototype above, which
-  created a file, and since confirmed by #10026 landing the create-only write. It is not a claim
-  that init's model is finished. The remaining write verbs are a modeling question, not a
-  permissions one.
-
-### SUPERSEDED BY #9891 — the recipe below is historical reasoning, not the current model
-
-**This section previously listed the following as "settled by execution". #9891 replaced the
-identity model underneath it, so the recipe is now WRONG at exactly the boundary add/commit needs,
-and it is kept only as the reasoning that led to the replacement.** It survived on main because a
-plan that says "settled" is read as an instruction; that is the failure this heading exists to
-stop.
-
-The superseded recipe said: content goes in via `store_node(store, n: Node) -> StoreOutcome`; a
-file is built as a synthetic semantic `Node` via `node_synthetic`; a runtime name becomes a
-`Symbol` with `symbol_intern_lexeme`; and
-`mint_repository_commit(repository, root: ObjectId, ...)` requires `store_contains(root)`, so `add`
-precedes `commit` and `commit` re-derives an added object's `ObjectId` by rebuilding the same node.
-
-**What #9891 changed, and why the recipe cannot survive it:**
-
-- Authored source is its OWN object arm, not a semantic node wearing a node costume. A file has
-  somewhere to live that is not a synthetic `Node`, which is the whole point of that change.
-- A semantic-node reference and an authored-source reference are DISTINCT, so "rebuild the same
-  node and re-derive its `ObjectId`" no longer identifies one thing.
-- `mint_repository_commit` takes a `SemanticNodeTarget`, not a bare `ObjectId`. Handing it an
-  authored-source identity is not a runtime refusal to be checked for — it does not typecheck.
-
-**SUPERSEDED — this paragraph became the dead recipe it warned about, and is corrected in place.**
-It said `add` and `commit` are blocked on building a `CorpusManifestObject` shaped
-`path → semantic_root → authored_source_identity`. Both halves are now false:
-
-- **The object exists.** `gunbc.scm.object_store` declares `CorpusManifestObject`,
-  `CorpusManifestRecord`, and `CorpusManifestEntry`, and `gunbc.scm.object_table_json` codes them.
-- **Its shape is `{ path, source }` — path to AUTHORED SOURCE, and deliberately not to a semantic
-  root.** `object_store` states why: a semantic root is a derived ingestion result, and fusing it
-  into the entry would make a manifest unauthorable for malformed or not-yet-ingested source, which
-  is precisely the corpus a source-control system must still freeze. #10522 §5 ruled the same
-  separation — the authored snapshot is authoritative, structural interpretation is a derived view.
-
-**The actual boundary** is a *pending authored-source snapshot* authority shared by three consumers:
-`add` updates it, `status` reads it, and `commit` consumes it. It is workspace-scoped and must
-survive between invocations; it need not live in the repository document.
-
-Two constraints that paragraph got right and one it got wrong. Right: immediate object-store
-insertion is not by itself the `add` model, and `ScmWriteOutcome` is still the right shape for the
-verb's result. Wrong: `add` is not blocked ON THE MANIFEST OBJECT, which is the specific dependency this
-paragraph asserted and which no longer exists. It remains blocked on real work — host acquisition of
-file bytes, path admission, a durable selection to persist into, and conditional update of that
-selection — and `status.dag`'s `StagedRole` is role-grain, so it is not that place. A removed
-dependency is not a finished verb.
-
-**`status` moves with this cut rather than being an unchanged downstream reader.** Today
-`scm_status` passes `empty_proposal()` and renders "nothing staged". Once source staging exists,
-leaving that path in place would report "nothing staged" while authored-source changes are staged —
-an observation correct about its input and wrong about the subject the user asked about. Paths must
-not be translated into `StagedRole` to keep the existing renderer.
-
-**Staging carries the same conditional-write obligation as publication.** One `add` can race
-another, and a `commit` can race a newer stage. Updates are conditional on the observed stage; a
-commit consumes the exact staged snapshot rather than re-reading working files; and clearing after
-commit consumes only the stage generation actually committed, so newer work is never erased. Under
-the no-rebase workflow a moved target is a named stale-base condition, never permission to apply an
-old stage to a different base. `save_repository` does not supply this — it checks encoding and then
-performs an unconditional `Filesystem.Write`.
-
-Two further distinctions the verbs owe: an established unchanged candidate is not the same as an
-unavailable or unreadable stage; and staged-versus-unstaged reporting needs a separate working-tree
-observation, because comparing the stage to its base says nothing about whether the working files
-changed again.
-
-### The design step — SUPERSEDED as a recipe; one principle survives
-
-**The composition below is no longer the instruction for the next increment, and the sketch under it
-is unsound. Both are kept visible rather than deleted, because the sketch is the more instructive
-half.**
-
-It said `add` composes `store_node` with `save_repository`, and `commit` composes
-`mint_repository_commit` with the same save, over one outcome coproduct:
-
-    type ScmWriteOutcome
-      = ScmWriteRepositoryUnavailable { cause: RepositoryLoadRefusal }
-      | ScmWriteRefusedByStore { collision: StoreOutcome }
-      | ScmWriteRefusedByMint { refusal: RepositoryCommitMint }
-      | ScmWritePersisted { save: RepositorySave }
-
-**Why the sketch is wrong: the outer classification and the inner payload can disagree.**
-`RepositorySave = RepositorySaved | RepositorySaveRefusedByCodec | RepositoryFileUnwritable |
-RepositoryWriteByteCountUnrepresentable`, so `ScmWritePersisted { save: RepositoryFileUnwritable {
-path: "repo.json", error: "permission denied" } }` is constructible — a renderer selecting on the
-outer `Persisted` arm announces persistence while its own payload says the file was unwritable. The
-inverse is equally expressible: `ScmWriteRefusedByMint` accepts the successful `RepositoryCommitMinted`
-arm. This is a fabricated-plausible-output shape, which makes it validation-where-construction-was-
-available rather than a modelling nicety.
-
-**The governing requirement instead:**
-
-> A success outcome carries established success evidence for that exact operation. A refusal carries
-> an actual refusal cause. Where publication cannot be established, that uncertainty remains an
-> explicit outcome rather than being resolved into either.
-
-**What survives** is only the original motivation: compose operation outcomes without positional
-ambiguity, so a renderer never encodes "which one failed" by argument position. **What does not
-survive** is this coproduct, and also the composition itself — `store_node` does not preserve
-authored source as authored source, and `save_repository`'s write is unconditional, so neither
-supplies the staging contract stated above. Narrowing the payload to a successful save would not fix
-that: an ordinary save and a *conditional* stage update are different guarantees.
-
-The shared result type is left undesigned here deliberately. A write-verb outcome invented at a call
-site is the anemic modelling this repository keeps paying for, and so is one certified in a plan
-before its operations have contracts.
-
-### `add` has no staging authority — SUPERSEDED, and its conclusion was the wrong branch
-
-This section's PREMISE stands and its CONCLUSION is withdrawn. The premise: `repository_status` takes
-`pending: Proposal` as a parameter because what is staged is not a fact the repository document
-carries, so a literal stage-now-commit-later has nowhere to persist to. That remains true, and it is
-why `status` moves as part of this cut.
-
-The conclusion — that `add` therefore writes an object into the store immediately, with no staging,
-and that this is "the honest reading of `add` for this substrate" — is **withdrawn**. It picked the
-branch that was cheapest to build rather than the one that answers the question, and immediate
-insertion is not staging: it cannot say which paths are selected for the next commit, and it cannot
-be revised or cleared. The other branch was the right one — a staging authority has to exist first —
-and it is workspace-scoped, not necessarily a repository-document member, so the premise never
-implied its absence.
-
-## Constraints learned the hard way
-
-- A runtime name becomes a `Symbol` via `symbol_intern_lexeme(lexeme: name)`
-  (`v2.std.compilers.lexing`). `name as Symbol` REFUSES; an earlier conclusion that runtime names
-  were inexpressible was wrong.
-- `RepositoryCommitRef` has no `ordinal` field. Read it with `minted_id_ordinal(id: ref.identity)`
-  and construct via `RepositoryCommitRef { identity: MintedId { ordinal } }`.
-- Annotations inside a declaration body are parse errors; hoist them above the declaration.
-  An indented `//` is also a parse error — annotations are module-item grain only.
-- There is no two-commit merge in the model. `gunbc.scm.role_requirement_integration`
-  (formerly `gunbc.scm.merge`, renamed because one spelling was carrying two materially different
-  contracts) integrates authored role requirements into ONE target commit; its vocabulary lives in
-  `gunbc.scm.proposal`. The operator's ask for practising merges/conflict resolution needs
-  commit-merge DESIGN first; it is not a wiring job.
-
-## Not in scope here
-
-Mirroring this repository's history through `gunbc scm` onto srv2 stays blocked on model work:
-`ScmObject = SemanticNodeObject | AuthoredSourceObject | CorpusManifestObject` with one content
-identity — **which now exists**; the manifest carries `{ path, source }` to authored source, NOT
-path + semantic_root + authored_source_identity as this sentence originally said (see the corrected
-boundary above) — and git correspondence confined to a mirror-layer
-`GitMirrorCursor { source_commit, native_commit }`.
diff --git a/docs/plans/scm-envelope-read-path-bounded-migration.md b/docs/plans/scm-envelope-read-path-bounded-migration.md
deleted file mode 100644
index f4838e64bd9..00000000000
--- a/docs/plans/scm-envelope-read-path-bounded-migration.md
+++ /dev/null
@@ -1,53 +0,0 @@
-# The envelope read path: bounded, and the one-time rebuild to v7
-
-Status: declared 2026-09-23. Authority: the production incident —
-`belt_integrate_one_cli` over the `shell-typed-invocation` project envelope
-(`attempt-state/projects/shell-typed-invocation.gunbc-repository.json`, a 104 MB
-`gunbc-scm-repository-v6` monolith) exceeded ninety minutes at ~100% CPU and was
-killed while reading; a rehearsal probe of the same read ran past two hours
-before it too was killed.
-
-## What was unbounded
-
-The monolith decode admitted the object table entry by entry through the
-per-object store verbs. `find_object` recomputes a content identity for every
-already-held object on every question, and the insert copies the object spine
-per append — so decoding an n-object table pays the square of n in interpreted
-identity compares. At the 7,051-object project envelope that is ~25M identity
-computations and the same again in spine copies; the read never completed. The
-2026-09-21 intake measurement pinned the same shape (~50M compares holding one
-belt tick inside a single seed commit for over an hour), and the JSON unescaper
-additionally paid the square of each large source token (a 15 KB source cost
-225 MB of accumulator copies) until the same day's span fix.
-
-## The fix
-
-One admission rule, two carriers. `gunbc.scm.object_store` now carries a
-fold-shaped `StoreAdmission` accumulator (digest-keyed map, prepend-and-reverse-
-once) beside `insert_admission`; the object-table decoder admits through the
-accumulator, so the table decode is O(n log n) with the same idempotence and the
-same collision arms. Object construction for sources, derived nodes, and
-manifests is split into constructors behind the sole_constructor wall, and the
-single-insert verbs are re-derived on them — one construction authority, one
-admission rule. The sharded (v7) read keeps its own two linear passes (per-shard
-decode, then `store_assemble_decoded`), now on the same accumulator.
-
-## The declared migration
-
-The production envelope is converted to the v7 sharded layout by the next
-successful integrate over it — the integrate's save is already sharded, so the
-conversion is a side effect of the first bounded run, not a separate tool, and
-no monolith writer remains to recreate it. After that run:
-
-- every load is the sharded read: the index plus ~110 shard reads at the current production
-  scale (7,051 objects at a batch of 64), each decoded and admitted in linear passes;
-- the v6 monolith reader stays in the tree for old documents and fixtures, but
-  it is no longer on any production path, so its remaining costs are bounded by
-  history, not by the read path this declaration governs.
-
-Rollback: the conversion writes the v7 index and shard files beside the
-monolith's path; the pre-conversion monolith is not deleted by the save (the
-sharded writer writes `<base>.object.<digest>.json` siblings and replaces the
-index document's contents), so the v6 bytes remain recoverable from backup
-state until the envelope's next writes settle. The load path dispatches on the
-`format` tag, so a restored v6 document reads exactly as today.
diff --git a/docs/plans/scm-merge-design.md b/docs/plans/scm-merge-design.md
deleted file mode 100644
index c3f004388f1..00000000000
--- a/docs/plans/scm-merge-design.md
+++ /dev/null
@@ -1,571 +0,0 @@
-# SCM merge: the design ruling, recorded before implementation
-
-This document settles what merge IS in `gunbc.scm` before any merge code exists. It is written
-first because a merge and publication consumer, once cut, fixes the vocabulary every nearby question is
-then answered in — and a vocabulary cut against an unproven correspondence contract is the §3
-replacement-migration trap.
-
-**An earlier revision of this document opened by saying §5 decides the shape of
-`CorpusManifestObject`. That was false and is corrected in §5:** that object already exists in
-`gunbc.scm.object_store`, its shape is already ruled there, and it is not gated by this document. The
-pending boundary is a consumer / commit-root cut, which is materially smaller.
-
-Nothing here is implemented. Where a question is open, it is marked open rather than resolved by
-plausible reasoning.
-
-## 0. The workflow being served, stated exactly
-
-The operator's goal is **not** "resemble git". Git terms are familiar vocabulary; the interface is a
-projection over the existing realizations (`gunbc.scm_compatibility.git` / `.mercurial` / `.pijul`).
-The workflow is:
-
-- **squash-merge into main**, so an integration is ONE commit;
-- **kill dev history after the merge** — the branch line is discarded, deliberately;
-- **never rebase**;
-- optimize for *simpler and faster merges*.
-
-Every ruling below is derived from that, and several of them differ from what a general two-parent
-merge would need. Where a general merge would want a capability this workflow never exercises, the
-capability is refused as authored redundancy (§2).
-
-## 1. What already exists, and must be consumed rather than duplicated
-
-**`gunbc.scm.ancestry`** supplies `ancestry_walk(start, history) -> AncestryWalk` with four arms:
-`AncestryTraced`, `AncestryBrokenAt`, `AncestryStartNotInHistory`, `AncestryRevisitsACommit`. That
-module deleted its own boolean ancestor predicate on the ground that `false` was answering for four
-different facts, and it names this document's subject as the intended consumer:
-
-> When a real consumer arrives — merge-base, ahead/behind, a publication decision — it derives its
-> answer from `ancestry_walk` and decides for itself what a broken chain means to IT.
-
-**So merge inherits an obligation, not just a function.** It must decide, per arm, what that arm
-means to a merge, and it may not collapse them into a Bool or into one refusal. §4 does that.
-
-**`gunbc.scm.supersession`** supplies `HeadSlot { slot: String, generation: ObjectId }`,
-`observe_generation`, and `supersede_head_slot` — a compare-and-swap whose evidence is minted from
-the slot and cannot be supplied alongside it. Its subject is the **repository document generation**,
-not a branch head. It is therefore a *precedent for the shape* of a named, CAS-guarded slot and
-**not a reusable authority for commit refs**. Saying otherwise would be a nickname (§3).
-
-**`gunbc.scm.checkout`** supplies `checkout(store, commit) -> CheckoutOutcome`, already modeled with
-its refusal population intact.
-
-## 2. RULING: no two-parent ancestry arm. A squash absorption is a receipt, not a parent.
-
-`CommitAncestry = RootCommit | DescendsFrom { parent }` is **already the correct shape** and must not
-gain a `MergedFrom { left, right }` arm.
-
-The derivation is mechanical rather than a preference. A squash merge produces one commit whose
-parent is the target's tip; the absorbed line is discarded by construction. So no commit this
-workflow can produce has two parents, and an arm with no producer is what §4b names *worse than
-absent* — it gets cited as a capability the model does not have.
-
-The stronger reason is that a second parent would be **actively wrong**, not merely unused.
-`ancestry_walk` follows parents. A `MergedFrom` arm would make the walk traverse into the very line
-the workflow exists to discard, so "kill dev history" would be false at exactly the layer that
-answers questions about history. The feature would reintroduce what the workflow deletes.
-
-**But discarding the line must not silently discard the FACT.** If the squash commit records nothing
-about what it absorbed, then "was this work merged?" is unanswerable, and an unanswerable question
-that gets guessed at is the fabricated-plausible-output failure. The resolution is a distinction the
-model can hold precisely:
-
-> A **parent** is a structural fact the ancestry walk follows.
-> An **absorption** is a historical receipt the walk must NOT follow.
-
-So a merge commit carries a `MergeAbsorption` receipt naming the absorbed tip (and the derived base,
-§4) as *data*, while its `CommitAncestry` stays `DescendsFrom { parent: <target tip> }`. History
-stays linear and traversal stays honest; the question "what did this absorb" becomes answerable
-without reviving the line.
-
-### D1. The receipt is only real if a QUERY consumes it
-
-A receipt nobody reads is data, not evidence. This document therefore fixes the consumer before the
-producer, because the producer's shape is determined by what the query must answer.
-
-**The query.** Given a source tip S and a target ref T: *does T's history contain a commit whose
-absorption receipt names S?* It is scoped two ways and both are load-bearing:
-
-- **exact source.** The receipt names a specific absorbed tip. "Some commit from that line" is a
-  different, weaker question, and answering it while claiming the strong one is fabrication.
-- **target lineage.** The answer is relative to T. A receipt sitting in a line T cannot reach does
-  not mean the work is in T. So the query walks T's ancestry (§4's arms apply, with the same per-arm
-  refusals) and inspects receipts along that chain — it does not scan the store.
-
-**Three facts stay distinct, and collapsing any two is the defect this section exists to prevent:**
-
-1. **Ancestry membership** — S is literally an ancestor of T. Under squash this is normally FALSE for
-   absorbed work, which is exactly why (2) exists.
-2. **A committed absorption receipt** — some commit reachable from T recorded absorbing S. This is a
-   historical claim about an act, and it is the only one the receipt itself supports.
-3. **Newly derived content comparison** — the content of S is present in T's current tree. This is a
-   fresh derivation over current state, not a receipt read.
-
-**(2) does not imply (3).** Work absorbed and later reverted still carries its receipt. So the query
-answers *"was this integrated?"* and never *"is this effective now?"*; a consumer needing the latter
-must derive it, and the outcome vocabulary must name which question it answered. Historical
-integration and current effect are separately reported, never one boolean.
-
-**Survival of collection.** The query must remain answerable after the absorbed objects are collected
-(the open question below). That is a constraint on the receipt's contents: it holds the absorbed tip's
-identity and the derived base's identity as VALUES, so answering never requires dereferencing the
-absorbed line. A query that needs the collected objects would make garbage collection silently
-destroy history's answers.
-
-**Refusals.** Not-found is `NoAbsorptionRecorded`, distinct from `TargetHistoryUnwalkable { cause }`
-carrying the §4 walk arm, distinct from `SourceNotInRepository`. "No" and "cannot tell" are different
-answers.
-
-**Open:** whether the absorbed commits' objects are retained in the store or become unreachable. This
-is a garbage-collection question with its own ruling, and it is deliberately not decided here. What
-IS decided: the receipt names the absorbed tip whether or not that tip's objects survive, because a
-receipt that silently becomes dangling is a worse artifact than one that names something collected.
-
-## 3. The minimum ref model, and why it is smaller than branches
-
-To merge, two lines must be designatable at once. Today `RepositoryEnvelope.checked_out` is a single
-optional `RepositoryCommitRef`, so checking out the target loses the pointer to the work.
-
-The workflow bounds how much is needed, but two of the bounds this section first drew were deductions
-the workflow does not license, and they are withdrawn rather than left to decide the model quietly:
-
-- **"Discarded at merge" does not mean "does not need to persist."** Retirement on success says nothing
-  about lifetime before success. A multi-command or resumable merge has a lifetime to preserve exactly
-  while it is unfinished, which is when the ref matters.
-- **"Exactly one checked out" erases the empty and unborn repository.** `checked_out` is
-  `RepositoryCommitRef?` today for a reason, and a ref model that cannot express a repository with no
-  commits has dropped a state the current model holds.
-
-What the workflow does bound: no remote tracking, no upstream, no reflog, no branch-of-branch, no
-rename.
-
-**Proposal:** the envelope holds a set of named commit refs, at most one of which is checked out —
-"at most", because the withdrawal above governs and an unborn repository has none —
-the minimum that lets two lines coexist. Naming is required (not merely a second anonymous slot)
-because the merge outcome, the refusal diagnostics and the CLI surface all need to say *which* line,
-and an anonymous "other slot" would force position to carry identity, which is the positional-naming
-defect §3 rules against.
-
-**Open, and genuinely undecided:** whether merge should take its two refs as *arguments* — leaving
-the ref set purely a CLI convenience — or whether merge should read them from the envelope. The
-argument form is smaller and testable without a ref model at all; the envelope form is what makes
-`merge <name>` expressible. My inclination is arguments for the operation and a ref set for the
-surface, so the merge model does not depend on the ref model. Flagged for ruling.
-
-## 4. Base derivation: four walk arms, two sides, and the outcomes they force
-
-**The absorption query runs FIRST, and it does not walk the source.** An earlier revision of this
-section put base derivation at the front, which left the §D1 counterexample alive at the consumer even
-though the query beside it was correct. After M is published with parent T and a receipt naming S, S is
-not on M's parent chain — so a re-request for S fell straight through to base derivation, and once S's
-objects were collected the mandatory source walk refused before the surviving receipt was ever read.
-**A correct query repairs nothing until the decision consumes it.**
-
-The ordering is therefore fixed:
-
-1. **Establish the target lineage and consult its committed exact-source absorption evidence, without
-   requiring the source objects.** This step needs the target's chain and the identity value carried in
-   each receipt; it dereferences nothing on the source side.
-2. **Only if fresh reconciliation is actually needed** does the operation require the live source and
-   derive a base — and only then do the walk arms below apply to the source side.
-
-Two refusals get their place from that ordering. `SourceNotInRepository` refuses a NEW operation that
-needs an unavailable source; it may never veto a historical receipt lookup merely because the source
-was collected. And `NoAbsorptionRecorded` is supported only by a COMPLETE target walk that found no
-matching receipt — an unwalkable target yields `TargetHistoryUnwalkable`, which is a different answer.
-
-**Identity continuity is a requirement, not a consequence of the bytes surviving.** Carrying the source
-identity as a value fixes dereferencing; it does not by itself establish that the value still denotes
-the same source. The receipt's subject is a source identity that is never reused for different content
-within the scope the query answers over. Physical collection scheduling may stay open; identity
-continuity may not be left to it.
-
-Step (2) is what the rest of this section specifies. `ancestry_walk` can answer four ways per side, and
-this module owes a decision for each rather than one collapsed refusal.
-
-| what the walk says | what it means to a merge |
-|---|---|
-| `AncestryStartNotInHistory` | **the caller's fact.** A ref that is not in this repository. Refuse, naming which side. |
-| `AncestryBrokenAt` | **damage.** The history is truncated; a base derived across a hole would be a guess. Refuse, naming the commit and its missing parent. |
-| `AncestryRevisitsACommit` | **a cycle.** Refuse; the substrate is bounded and forward. |
-| `AncestryTraced` (both sides) | a base can be derived from the two chains. |
-
-With both chains traced, the outcomes are:
-
-- **`SourceOnTargetParentChain`** — S is literally an ancestor of T. This is **ancestry membership,
-  and it is not receipt-backed absorption**; it is reported as its own fact. (`AlreadyAbsorbed` was
-  the earlier name and it was doing the work of two facts. Receipt-backed historical integration is
-  answered in step (1) above and never reaches this partition, so the four-outcome count here must
-  not be preserved by folding the receipt answer back in.) Both are also distinct from a
-  reconciliation that happens to compute an unchanged result, which is a **content** fact about a
-  fresh derivation and is evidence of no earlier integration whatever.
-  Neither answer silently suppresses an explicitly requested reapplication: a caller who asks to
-  reapply S after a revert is asking for step (2), and the historical receipt is not a refusal of it.
-- **`TargetIsAncestorOfSource`** — the target's tip is in the source's chain. The target has not
-  moved since the branch started, so no content reconciliation is required. **This is now RULED
-  rather than open, because leaving it open left a loophole that defeats §2.** If publication is
-  allowed to advance T onto S's tip, then S's development commits become part of T's history — the
-  dev history the workflow exists to kill — and, worse, no absorption receipt is written, so §D1's
-  query returns `NoAbsorptionRecorded` for work that WAS integrated. Cheap reconciliation was
-  silently converted into a different publication.
-  The ruling separates the two: **reconciliation may be trivial; publication is uniform.** Merge
-  reports that no reconciliation was needed, and publication still produces a new commit M whose
-  `CommitAncestry` is `DescendsFrom { parent: A }` — the exact observed target tip — carrying an
-  absorption receipt naming S. M's root may be identical in content to S's root; that is a content
-  fact and does not license an ancestry shortcut. Fast-forward as a HISTORY operation is therefore
-  not available in this workflow, and the outcome name says "no reconciliation needed", not
-  "fast-forward".
-- **`BaseDerived { base }`** — the lines diverged from a common ancestor. This is the real merge.
-- **`NoCommonAncestor`** — two unrelated histories. Refuse; this is not a conflict, it is the absence
-  of a base, and reporting it as a conflict would misname it.
-
-A boolean or a single `MergeFailed` here would rebuild exactly the collapse `ancestry.dag` deleted.
-
-**One consequence for `gunbc.scm.ancestry`.** That module currently names its next-rung trigger as the
-arrival of a consumer that merges two commits, on the expectation that such a consumer would force a
-several-parents arm. §2 rules that expectation false: the consumer arrived and it does NOT want the
-arm. That trigger is therefore superseded rather than satisfied, and it must be replaced rather than
-deleted — a trigger removed with nothing in its place is an untracked stall (§4b(2)). The replacement
-trigger this document proposes is the arrival of a workflow that must PRESERVE both integrated lines
-as traversable history; until then `DescendsFrom` is the ceiling, not a stall.
-
-## 5. CORRECTED: authored source stays authoritative. Structural interpretation is a derived view.
-
-**The first cut of this section was wrong, and it was wrong in the way this document exists to
-prevent.** It ruled that the merge subject is the semantic node graph and demoted
-`CorpusManifestObject` to "a projection for emission, not the authority a merge reads". That
-conclusion forked an authority this repository already holds, and it did so in a document whose
-stated purpose is avoiding exactly that. The correction is recorded in place rather than quietly
-rewritten, because a design note that hides its own reversal teaches the next reader nothing.
-
-**Two factual corrections come first, because the original section was reasoning from a false census.**
-
-1. `CorpusManifestObject` and `CorpusManifestEntry { path: NonEmptyStr, source: AuthoredSourceTarget }`
-   **already exist** in `gunbc.scm.object_store`, and `gunbc.scm.object_table_json` already encodes and
-   decodes them. This document's earlier framing of the manifest as unbuilt was wrong.
-2. What has NOT changed is `RepositoryCommit.root`, which is still `SemanticNodeObjectRef`. **So the
-   pending boundary is a consumer / commit-root cut, not the creation of a missing object kind** —
-   materially smaller than "build the keystone", and it means `add`/`commit` are nearer than this lane
-   previously reported.
-
-**And the model had already ruled on the question §5 tried to settle.** `object_store.dag` states that
-a manifest entry is path-to-authored-source *and deliberately nothing else*, because a semantic root is
-a DERIVED INGESTION RESULT whose value depends on the source object, the corpus and its imports, the
-ingestion rule, and language and rule versions. Carrying it in the entry would fuse an input with a
-realization result and would make a manifest **unauthorable for malformed or not-yet-ingested source
-— "precisely the corpora a source-control system must still be able to freeze."** That module names
-the same comment-only-edit case used against §5 below.
-
-### The counterexample is information loss, not algorithmic difficulty
-
-Two authored snapshots differ only in a comment. §4c erases annotations from the semantic projection,
-so **their semantic graphs are identical**. A merge handed only those graphs cannot determine which
-authored change occurred. No choice of three-way graph algorithm recovers the distinction, because the
-distinction was destroyed before the algorithm was reached.
-
-Authored placement adds a second obligation the graph cannot answer: where does a moved declaration
-belong in the output, and what happens when independent additions select the same destination. Source
-that cannot be ingested at all adds a third — it still needs an honest source-control disposition
-rather than vanishing because the structural view is unavailable.
-
-### The separation this document now rules
-
-> **The authored snapshot is authoritative for what was authored. Structural interpretation and
-> correspondence are DERIVED VIEWS used to reconcile changes. A merge produces a new authored
-> snapshot, and must not silently discard distinctions its semantic view cannot represent.**
-
-That is not two authorities for one fact. *What was authored* and *an interpretation of what was
-authored* are different questions, and §3's replacement-migration doctrine does not reach them: it
-applies when X and Y answer the SAME semantic question and X is intended to disappear. Neither holds
-here, and applying it anyway is what produced the error.
-
-Two consequences follow, and they are why the original binary was false:
-
-- **How a complete source snapshot is represented and frozen**, and **at what granularity changes are
-  compared and reconciled**, are INDEPENDENT choices. A path-to-source manifest can support structural
-  reconciliation; adopting a more conservative merge algorithm later does not inherently change the
-  manifest's shape.
-- **So the manifest is not blocked behind merge.** The ordering constraint is narrower than this
-  document first claimed: *do not make the permanent merge and publication consumer depend on an
-  unproven correspondence or source-reconstruction contract.* Preserve the complete authored subject,
-  establish a bounded structural capability over it, and cut the consumer against the demonstrated
-  contract.
-
-If a lossless authored representation derived from a semantic graph is ever proposed, it is a
-**materially different subject with a replacement proof to supply** — not something established by the
-phrase "semantic node graph".
-
-### One correction to this document's own git comparison
-
-The original section claimed per-path merging means "the same path changed on both sides". That is not
-git's general conflict predicate — git performs three-way merging of file *contents* and admits custom
-merge drivers. So "two edits to different functions in one file" is not by itself a differentiating
-demonstration, and it is withdrawn as one. The differentiator, if it exists, must be stated in terms of
-correspondence guarantees (§5a), not in terms of a strawman.
-
-## 5a. The tractability boundary is CORRESPONDENCE and COMPOSITION
-
-An earlier revision of this section argued that `EdgeLabel = Named { name } | Positional` partitions
-the merge problem, with named children alignable and positional children refused. That partition is
-real and is retained below, **but it is not sufficient, and presenting it as the tractability answer
-overstated it.** Alignment by label is one form of correspondence EVIDENCE; it is not correspondence.
-
-**`ObjectId` recognizes unchanged content. It does not identify one logical declaration across an
-edit.** Three counterexamples bound the claim:
-
-- **Changed ancestors.** One side edits `f`, the other edits `g`. Both change their function's digest
-  and every enclosing digest up to the root. At root grain *both sides diverged*, so digest comparison
-  alone reports a conflict for two edits that never touched each other. Descent requires a justified
-  correspondence between components first.
-- **Content identity is not occurrence identity.** Two logical occurrences may reference the same
-  stored subtree. Editing one must not edit the other, and a replacement keyed only on the old
-  subtree's content identity would hit both.
-- **Renames and moves.** A name is evidence and a position is evidence, but neither is a stable
-  identity across precisely the change that alters it.
-
-And structural disjointness does not establish independence: one side may delete a declaration while
-the other adds a caller, and two independently added declarations may collide on one name. The combined
-graph still needs binding and admission judgments. **Behavioral compatibility is an additional claim,
-never a corollary of touching different nodes.**
-
-### What the first capability must promise
-
-Deliberately narrower than arbitrary structural merge. **Once base-relative correspondence is
-established**, the ordinary cases are straightforward: equal target and source agree; a side unchanged
-from base yields to the changed side; otherwise descend only into components with an established
-composition rule, or return an explicit contention or unsupported-correspondence outcome. **Absence
-participates explicitly**, so deletion-versus-modification and competing additions cannot disappear
-into a default.
-
-Three interface obligations, which this document fixes and the algorithm design later discharges:
-
-1. **What evidence establishes that these are the corresponding logical components?**
-2. **What does the automatic arm guarantee about the combination it produces?**
-3. **What does it return when either answer is unavailable?**
-
-The answer to (3) is a **named inability to decide** — never a guessed rename, never an automatic side
-selection, and never a silent fallback to path-based merging. The `Positional` case above is one
-instance of (3), not a separate mechanism: position is the only identity such a child has, occurrence
-identity is deliberately outside content identity, and a sequence-alignment heuristic is what §4 rules
-out in a closed system.
-
-### The performance claim is withdrawn until it has a denominator
-
-This document earlier implied structural merge serves the "simpler and faster merges" goal. That is
-not established. The denominator is the whole operation — interpretation, correspondence and indexing,
-the merge, source reconstruction, and admission — and `object_store` records its own list-backed
-lookup and traversal as quadratic. **Content addressing does not by itself establish faster merging**,
-and no speed claim should be made until measured against that full path.
-
-Also recorded: reducing the number of reported conflicts is not evidence of improvement, because a more
-aggressive reconciliation can miss real conflicts. Any future claim here needs a discriminating
-oracle, not a lower count.
-
-## 6. What merge produces, and what it must refuse
-
-A merge is a **candidate then a commit**, not one step: the candidate carries the derived base, the
-absorbed tip, and — per §5's corrected output authority — the resulting authored snapshot, of which a
-resolved graph is a derived view rather than the product. D5 below states the full binding. Committing
-it is a separate act that advances the head. This
-mirrors the shape `supersession` already establishes — observe, then compare-and-swap — and keeps a
-merge from being authorized by anything other than the observation it rests on.
-
-Merge must refuse, never widen: an underivable base, a damaged history, an unrelated history, an
-unresolved conflict. In particular there is **no "take ours" or "take theirs" fallback** available to
-the merge itself. That is an escape hatch in §5's sense — a toggle whose only effect is to proceed as
-if the refusal had not fired — and a resolution supplied by an author is a different, named input,
-not a mode the merge can select on its own.
-
-### D5. The candidate is bound to the generation it observed
-
-"Observe, then compare-and-swap" is not enough on its own, because it does not say WHAT the swap
-compares. A candidate is derived against a specific target tip; if the target moves between derivation
-and publication, publishing the candidate silently discards whatever moved it — a lost update wearing
-the shape of a successful merge.
-
-**An earlier revision routed publication through `observe_generation` and `supersede_head_slot`. That
-was wrong at the level of the contract, not the field list, and it contradicted this document's own §1.**
-`gunbc.scm.supersession` is a **malformed-document replacement policy**: its `standing_permission_refusal`
-answers `none` for `LoadDocumentMalformed` **alone**, and returns `StandingDoesNotPermit` for every other
-standing including `LoadComplete`. So an ordinary merge into a healthy repository would have reached
-`StandingDoesNotPermit { standing: LoadComplete }` on that route — refused precisely in the normal case,
-regardless of whether the generation matched. `SupersessionApplied` also yields a modeled slot and a
-warrant; it does not install a commit or a receipt.
-
-**The policy must not be weakened to admit merge.** Its narrowness is the point. What `supersession`
-supplies here is the SHAPE — observe, bind the observation, conditionally write — which §1 already
-records as precedent, and merge publication owes its own admission contract over its own subject. Nearby
-primitives exist and none is promoted by name alone: `std.durable_compare_and_set` declares its own
-observation-to-slot binding boundary, and `save_repository` does checked encoding followed by an
-**unconditional** write. Citing either does not establish this contract; this document fixes the
-contract and does not implement the actuator.
-
-**The candidate binds the whole derivation, not a generation value.** A generation alone is not the
-relation. The candidate carries: the repository and target slot; the exact observed target commit and
-state; the source identity absorbed; the base evidence; the interpretation and rule inputs and any
-author-supplied resolution; and — per the corrected §5 — the resulting **authored snapshot**, which is
-the output authority, not a resolved graph alone.
-
-**Publication is conditional on that exact observed target**, and a mismatch refuses rather than
-publishing; the candidate is then not publishable and must be re-derived. A candidate is not a value
-that stays valid; it is a value indexed by the state it was computed from.
-
-**Successful publication binds the installed facts together.** The new commit M, its absorption receipt,
-and the target advance become coherently available or none of them does — an uninstalled candidate or
-receipt must never answer §D1's historical-integration query. Publication returns named success evidence,
-and that evidence is what retirement consumes.
-
-These outcomes stay separately named, because each demands a different action. **The obligations
-below govern, not their count** — `PublicationUnestablished` above is one of them, and publication-
-success and retirement carry their own:
-
-- **`PublicationFailed { cause }`** — publication is ESTABLISHED not to have applied. Only an outcome
-  that establishes that may carry this meaning; a realization that installs the state and then loses
-  its acknowledgement must return `PublicationUnestablished` instead, and be reconciled rather than
-  replayed. Either the realization guarantees the ambiguity cannot arise, or the unestablished outcome
-  is preserved. A further attempt stays conditional on the exact observed target — "retry" never means
-  blind replay.
-- **`TargetGenerationStale { observed, current }`** — the target moved. Re-derive; do NOT retry.
-- **`WrongTargetSlot { expected, actual }`** — publication was attempted against a slot other than
-  the one observed. This is a caller error and must not be absorbed into staleness.
-- **`SourceMovedSinceDerivation { observed_tip, current_tip }`** — the source line advanced after the
-  candidate was built. The candidate absorbs less than the caller now means by "the source".
-
-**Retirement checks the source AT RETIREMENT TIME.** Naming the absorbed source generation is necessary
-and not sufficient, because this ordering is possible: derive a candidate for S, publish M successfully,
-the source ref advances S → S₂, then retirement runs. Deletion is therefore conditional on that same
-source slot still naming S. Otherwise the operation discards S₂ after honestly publishing only S.
-
-The outcome when it does not hold is **`IntegrationCompletedRetirementWithheld { published, source_moved_to }`**
-— integration succeeded and the source moved — which is neither a deletion of newer work nor a claim
-that integration failed. Retirement also consumes the successful-publication evidence above and never a
-derived candidate: retiring on a candidate that then fails to publish destroys the line and integrates
-nothing. And later collection respects other live references — absorbing one line does not authorize
-deleting content something else still holds.
-
-## 7. The projection obligation
-
-`gunbc.scm_compatibility_shape` already carries what the operator asked for: opaque realization and
-target handles, honest capture fidelity, projection plus independent read-back, and — its own words —
-*"dispatch is a generic handler value, never `ScmKind` or a vendor switch. A fourth realization
-supplies one handler and does not edit this module."*
-
-So merge does not get to invent a second presentation path. Whatever merge exposes must project
-through that shape, or it becomes a parallel authority for "how this repository is presented to a
-foreign realization" — the §3 fork, in the one place the operator explicitly asked for a projection.
-
-## 8. Author and timestamp: a bounded metadata contract, neither absent nor nearly finished
-
-This section has now been wrong in **both** directions, and both errors are recorded because the pair
-is more instructive than either.
-
-**First error — claimed absence.** It said this repository has no modelled clock and no modelled
-process identity, and pointed the lane at acquiring them. False: `extdeps.clock` declares `Clock.Now`,
-`gunbc.clock_read` `clock_now_probed_at` consumes it, and `gunbc.worker_lifecycle`
-`ProcessIdentityEvidence = ProcessIdentityObserved { pid, started_at, owner } | ProcessIdentityUnobserved
-{ reason }` carries the other half. Directing work at re-inventing an available capability is the §2
-re-invention this project exists to prevent.
-
-**Second error — claimed the observation side was solved.** That was the same defect one level up.
-Finding an evidence type is not a solved observation capability, and the specific trap is visible in
-the helper: `probed_at_word` returns a `NonEmptyStr` on **both** arms, rendering absence as the word
-`clock-unreadable`. So **accepting a rendered nonempty value would not establish that an instant was
-observed.** That is not a defect in the helper — it is a display renderer doing its job — but it means
-display text is not admission input, and a clock read is not automatically a timestamp bound to this
-commit.
-
-### The bounded statement this section actually supports
-
-> Existing clock operations and adapters are reusable, and a process-identity evidence vocabulary
-> already exists. Commit metadata still requires **an applicable observation producer**, **binding to
-> the commit and its declared attribution role**, **a defined timestamp event**, and **an admission
-> policy for unavailable evidence**. This document does not establish that the complete
-> commit-attribution observation path exists, and does not direct the creation of another generic
-> clock or identity schema.
-
-`gunbc.scm.ancestry` carries the first error in its own note; this document relayed it rather than
-checking it, and both are corrected together. That annotation's retained conclusion — that modelling
-these fields here would mean *inventing two facts to fill fields* — is also corrected: an unavailable
-or unverified binding is a reason not to fabricate a value, and is not proof that modelling the fields
-over existing observation carriers inherently fabricates anything.
-
-### What the four open pieces mean, and their order
-
-Each is a real question, and **they are ordered**: the admission policy comes last because it cannot
-be decided before the field's subject and applicable evidence are.
-
-1. **Producer** — which operation observes the fact this commit's field claims, invoked where.
-2. **Binding** — that the observation attaches to *this* commit and to a declared attribution role.
-   Reusing an observation means retaining the operation's failure contract, not its rendered output.
-3. **Timestamp subject** — *which event* the field describes. Authoring, integration and publication
-   are different instants, and a commit that does not say which one it names is not carrying a fact.
-4. **Admission** — whether a commit is publishable with the evidence unavailable.
-
-On (4), this document withdraws its earlier lean. "A merge receipt with no author is weak" does not
-determine the policy: the existing source / base / target / result relationship already expresses a
-meaningful integration fact, and attribution and time support *additional* claims. A contract requiring
-an identified integrating actor should refuse when that actor cannot be established; a different
-contract could admit an explicitly absent attribution. **Neither may render absence as observed
-evidence** — that is the constraint, and it is the one `probed_at_word`'s two arms illustrate.
-
-One composition obligation with §D5: a missing-metadata check must run where it can refuse *before* a
-write, because a missing observation discovered after a write does not turn an applied publication into
-one established never to have applied.
-
-## 9. The evidence this design owes when it is built
-
-Stated now so the implementation cannot be declared done by typecheck (§5's
-specification-without-execution):
-
-- one control per `AncestryWalk` REFUSAL arm, per side — `AncestryStartNotInHistory`,
-  `AncestryBrokenAt`, `AncestryRevisitsACommit` — each reaching a distinct, named merge refusal;
-  `AncestryTraced` is the success arm, and the controls it owes are the four traced/traced outcomes
-  below rather than a refusal;
-- the traced/traced partition discriminated four ways: `SourceOnTargetParentChain`,
-  `TargetIsAncestorOfSource`, `BaseDerived`, `NoCommonAncestor` — each from a real merge and from each
-  other, and `SourceOnTargetParentChain` additionally discriminated from the step-(1) receipt answer,
-  since those are two facts and the earlier `AlreadyAbsorbed` name held both;
-- a merge whose result is asserted by CONTENT, not by "it succeeded" — the mutation that returns an
-  empty or unchanged graph must go red;
-- a refusal that stays a refusal: a conflict specimen with no author-supplied resolution must not
-  produce a commit;
-- the absorption receipt asserted to be present AND the ancestry asserted to remain single-parent,
-  because the whole ruling of §2 is that those two facts coexist;
-- **D1** — the receipt query answered on a target whose chain CONTAINS the absorbing commit and on one
-  whose chain does not, plus `NoAbsorptionRecorded` discriminated from `TargetHistoryUnwalkable` and
-  from `SourceNotInRepository`; and the absorbed-then-reverted specimen, which must report integrated
-  historically and not-present currently, since collapsing those two is the defect §D1 names;
-- **D2** — the no-reconciliation-needed case asserted to produce a commit with `DescendsFrom { parent:
-  A }` and an absorption receipt naming S; the mutation that advances the head onto S's tip must go
-  red, because that mutation is precisely the loophole;
-- **D4** — a comment-only-edit specimen whose semantic roots are equal and whose authored snapshots
-  differ, asserted to preserve the authored distinction; a changed-ancestors specimen (`f` and `g`
-  edited on opposite sides) asserted NOT to report a root-grain conflict; and a shared-subtree
-  specimen where editing one occurrence leaves the other unchanged. Each is a discriminating red for
-  a correspondence claim, not a demonstration that a merge algorithm exists;
-- **D1 at the DECISION, not only the query** — a repeated exact-source request after M is published,
-  asserted to answer from the receipt rather than proceeding to another base-derived merge; the same
-  with the source objects COLLECTED, which must still answer (the control that would have gone red on
-  the earlier ordering); the same source requested against a DIFFERENT target lineage; a never-absorbed
-  source whose fresh reconciliation happens to compute an unchanged result, asserted NOT to report
-  historical integration; and a later target commit asserted not to disturb either answer;
-- **D5** — a candidate published against a moved target asserted to refuse, discriminated from
-  `PublicationFailed`, `WrongTargetSlot` and `SourceMovedSinceDerivation`; **ordinary publication into a
-  HEALTHY repository asserted to succeed**, which is the control the superseded `supersede_head_slot`
-  route would have failed with `StandingDoesNotPermit { standing: LoadComplete }`; commit, receipt and
-  target advance asserted coherently available together, with an uninstalled receipt asserted not to
-  answer the D1 query; source movement AFTER publication but BEFORE retirement asserted to yield
-  `IntegrationCompletedRetirementWithheld` and to leave S₂ intact; and a failed publication asserted to
-  leave the source ref unretired.
-
-## 10. What this document does not claim
-
-It does not claim a structural merge algorithm is BUILT, and §5a's tractability finding is derived from the node model rather than demonstrated by a running merge. It does not settle the ref model (§3 open) or object retention for absorbed lines (§2 open), or author and
-timestamp (§8). It does not claim a bounded structural correspondence capability is feasible — §5a records that as an
-obligation to demonstrate, not a result. Its performance claim is withdrawn (§5a) rather than weakened.
-
-It does not authorize a merge implementation to be built. What it settles is the vocabulary those
-consumers must preserve. **It does not gate `CorpusManifestObject`**: that object exists today in
-`gunbc.scm.object_store`, this document's earlier claim to the contrary was false, and the ordering
-constraint §5 actually establishes reaches only the permanent merge and publication consumer — not the
-authored-source primitive, and not `add`/`commit`.
diff --git a/docs/plans/scope-rank-view-design.md b/docs/plans/scope-rank-view-design.md
deleted file mode 100644
index d4f8b79734a..00000000000
--- a/docs/plans/scope-rank-view-design.md
+++ /dev/null
@@ -1,248 +0,0 @@
-# The scope rank-view — resolve a scope instead of materializing one
-
-The seed builds a fresh set of name-keyed maps for every claim scope it enters. `[floor-scope-cost]`
-already names the correction in the tree, beside the number it prices: *"a scope that is a view
-rather than a rebuild costs nothing to enter."* This is the design for that view.
-
-It is a **replacement migration** (DESIGN §3): the per-scope materialized maps and the rank-view
-answer the same semantic question — *which declaration does this name resolve to, in this scope* —
-and one of them is intended to disappear. The model lands first, alone; the reader cutover follows
-in its own PR, at the root, with no interval in which both representations are live authorities.
-
-## 1. What is materialized today, and what of it is scope-dependent
-
-`cli_run` `claim_scope_for` computes the scope's module `order` (own module, then the compiler's
-precedence-ordered import closure, then the reference closure) and then builds two things over it:
-
-- the scope `item_registry` — a union of each scoped module's own registry, folded in `order`,
-  first write wins, with the authored-region rule deciding which collisions count as ambiguous;
-- `v1.interpreter` `build_scope_indexes_with_module_order` — `fn_nodes` (a bare slot per name and a
-  qualified slot per declaration), `ambiguous_bare_function_names`, `file_module_paths`,
-  `file_import_bindings`, `service_ops`.
-
-gunbc#9809 removed the module-local half of that derivation: `ModuleScopeFragment` derives each
-module's contribution once per prepared subject rather than once per scope containing it. What
-survives is exactly the **fold** — the part that is not module-local, because it applies the scope's
-precedence to fragments the subject already holds.
-
-The observation this lane rests on is that the surviving fold stores a *decision* that is cheaper to
-compute than to store. Each entry of each per-scope map is the answer to "of the modules declaring
-this key, which one does this scope rank first". That answer is a function of two things the process
-already has: the corpus-wide set of declarers, and the scope's own ordering of modules. Materializing
-it once per scope is DESIGN §2 redundancy in its plainest form — 660 copies of a table derived from
-one corpus and 660 short lists — and DESIGN §3's second-authority problem, because from that point on
-the map, not the order, is what a reader consults.
-
-## 2. The view
-
-Two carriers replace the maps.
-
-**Corpus-wide, one per prepared subject.** A `name -> declarers` index, each declarer carrying the
-declaring module's identity alongside the declaration node, in a stable corpus order. This is the
-fragment population of #9809 inverted from per-module lists into per-name lists; it introduces no
-new derivation and no new authority, only a different join order over facts the subject already
-carries.
-
-**Per scope.** A `module -> rank` map, where rank is the module's position in `order`, plus the
-`authored_region` boundary already computed there. Its size is the scope's module count (mean 427,
-max 878 at the measured run), not its item count.
-
-**Lookup.** Resolution intersects the two: take the key's declarers, keep those whose module has a
-rank in this scope, and select by the slot's polarity. Nothing is materialized at scope entry beyond
-the rank map, and every answer is derived at the ask.
-
-## 3. The polarity finding — the slots do not agree, and a uniform cutover is silently wrong
-
-The brief names the rule as "minimum rank". That is correct for the slot the prize is denominated in
-and **not uniform across the maps being replaced**, which is the first thing this model exists to
-record:
-
-| slot | seed rule | rank rule |
-|---|---|---|
-| `fn_nodes` bare | `or_insert` under `module_order` | lowest rank wins |
-| scope `item_registry` | first-write-wins over `order` | lowest rank wins |
-| `file_import_bindings` | `or_insert` over the fold | lowest rank wins (key is module-local, so no scope can discriminate) |
-| `fn_nodes` qualified | unconditional `insert` | exactly one declarer; **admission-gated** (§4) |
-| `file_module_paths` | unconditional `insert` | highest rank wins |
-| `service_ops` | unconditional `insert` | **highest rank wins** |
-
-`service_ops` is the inversion that matters: a service operation key claimed by two scoped modules is
-today the *last* module in precedence order, and a rank-view that resolved it by minimum rank would
-silently redispatch it. The tree already carries the receipt for why this key is dangerous — the
-`std.resources` `Filesystem` / `extdeps.filesystem` `Filesystem` pair, whose registry-merge collision
-once dropped a service's operations into "unknown service operation" at runtime.
-
-`file_module_paths` is last-write-wins over a key that is module-local in practice (one module per
-file), so no current input discriminates the polarity. The model files it at the seed's polarity
-rather than at the one a reader would guess, and names what would discriminate it, because "no input
-reaches it" is a ceiling to record, not a licence to pick either arm.
-
-## 4. The hard constraint, and the rung it puts at risk
-
-On record for this lane: *a scope's qualified `fn_nodes` must never resolve a name outside the
-scope's admitting closure — a claim must not call a module its closure never admitted.*
-
-Today that holds **by construction and incidentally**: the qualified slot exists only because a
-scoped module wrote it, so an out-of-scope declaration has no key in the map. The rank-view removes
-that construction. The corpus-wide index holds every declarer in the subject, so an unguarded
-qualified lookup would answer from a module the scope never admitted — a strictly new failure, and
-one that fails in the direction that looks like success.
-
-So the migration's obligation is not to add a filter but to keep the guarantee structural: resolution
-must have no arm that yields a declaration without having consulted the rank map, so an unadmitted
-answer has no constructor. Concretely, the resolver returns only a declarer obtained *through* rank
-membership; there is no accessor that reaches the corpus index and returns a node. DESIGN §3's rule
-for a replacement migration is the same point stated generally: the minimum Y is not the smallest
-thing that executes the happy path, it must preserve every required refusal.
-
-The model records this as a §4b subject with its previous rung, its target rung and the evidence that
-would establish either — not as prose, so that a cutover which reaches the prize while lowering the
-rung is a red row rather than an unnoticed regression.
-
-## 5. What the view does not make free — the enumerating readers
-
-Point lookups and membership tests become O(declarers of the key). Four readers instead **enumerate**
-the scope registry, and for them the rank-view trades a cheap iteration over a scope-sized map for an
-iteration over a corpus-sized one:
-
-- `v1.interpreter` `build_initial_env` — per claim, over data items;
-- `v1.interpreter` `eval_data_initializer_values` — over data items;
-- `v1.interpreter` `resolve_published_mock_keys` — over data items;
-- `cli_run` `roster_entry_registry_cache` — over every key.
-
-The first three filter to `DataItem` immediately, so the view serves them from a kind-partitioned
-corpus name list and iterates a fraction of the corpus rather than all of a scope. The fourth wants
-every in-scope name and is the one row where the view is not obviously cheaper; it is named here so
-the cutover measures it rather than discovering it, and its call frequency is the fact the migration
-PR must carry.
-
-This is the design's honest boundary: the prize is scope *entry*, and a reader that enumerates a
-scope pays at the ask what it no longer pays at entry. A cutover that quotes the entry saving without
-this column would be reporting half a ledger.
-
-## 5b. The migration census — every site, its demand, and its cut order
-
-The brief sizes the reader migration at "~126 `item_registry` sites". That is the grep count over the
-token across `src/`, and it is not the migration population: **most of those occurrences are a
-different carrier's field of the same name.** Filing them separately is the first thing the census
-does, because a cutover scoped to the grep would edit the typecheck layer and the emitter for no
-reason, and a cutover that ignored the difference would edit the wrong authority.
-
-### What is not in the population (112 of 126)
-
-| kind | where | count | why it is not the subject |
-|---|---|---|---|
-| `TypedModule.item_registry` | emitters, `coproduct_reflection`, `owned_data`, `data_initializer_identity`, `v1_compiler_compile` | ~18 | the per-module registry — the authority the corpus index is *derived from*, and the one the fragment population of #9809 already reads. Untouched. |
-| typecheck-layer `scope`/`fn_scope`/`lam_scope`/`local`/`state`/`dep_state`/`ctx` registries | `v1_compiler_infer` | ~30 | `v1_compiler_infer`'s own threaded registry at compile time. A different carrier with the same field name; it never sees a claim scope. |
-| field declarations | `v1_compiler_infer`, `v1_compiler_infer_items`, `v1_interpreter` | 8 | type declarations, not reads. |
-| empty-map struct initializers | test fixtures and empty contexts across 9 files | ~12 | `Rc::new(HashMap::new())`; nothing is read. |
-| `item_registry_keys` | `v1_compiler_artifact`, `v1_compiler_compile` | 5 | a different field: the serialized key list of an artifact. |
-| doc-comment mentions | `cli_run`, `v1_interpreter`, `coproduct_reflection` | ~9 | prose. |
-| `build_qualified_item_registry` and its duplicate marker | `v1_compiler_emit_rust` | ~10 | the emitter's own qualified overlay, with its own fail-closed refusal. A separate authority on a separate key. |
-
-### The population (14 readers, 4 construction sites)
-
-Demands, and the arm each falls in. The fourth arm is one the reader census did not originally
-carry and this sweep found:
-
-**Provenance test** — the reader looks the name up *in order to read `info.module_name`*, and decides
-a builtin dispatch from it. These are the sites where a polarity error does not surface as a missing
-name but as a **different function executing**, so they are the ones the qualified-admission RED and
-the ambiguity line must both be exercised against:
-
-| site | decides |
-|---|---|
-| `v1_compiler.v1_interpreter` `try_witness_evaluation_dispatch` | whether a call is the witness-evaluation authority's own |
-| `v1_compiler.v1_interpreter` `is_v4_bridge_family` | whether a name is one bridge family's, by declaring module |
-| `v1_compiler.v1_interpreter` `is_v2_std_collection_map_grounded_fn` | whether a call takes the primitive map grounding |
-| `v1_compiler.cli_run` `definer_module_for_name` | the declaring module of a name — on a `ResolvedGraph` argument, so whether it is in the population depends on which graph its callers pass, and that is the one row this census leaves open for the cutover to close |
-
-**Point lookup** — `v1_compiler.v1_interpreter` `eval_var` (the registry slow path behind the env
-lookup) and `eval_data_item_value`. Both already re-resolve through `lookup_fn_from` immediately
-after, so under the view they collapse into one resolution rather than two.
-
-**Membership test** — five sites, all `contains_key` guarding a call into a modeled function:
-`call_test_claim_fn_bool`, the three `call_floor_kernel_would_skip` / `call_floor_row_would_skip` /
-`call_floor_row_precompute_would_skip` guards, and `rerun_frontier_nodes_for_entry`. Each
-becomes `resolve(name).is_some()`.
-
-**Enumeration** — the four readers of §5.
-
-**Construction** — `v1_compiler.cli_run` `claim_scope_for`'s registry fold (with its `winner_of` /
-`ambiguous` bookkeeping) and `v1_compiler.v1_interpreter` `build_scope_indexes_with_module_order`.
-These are the root: they are deleted, not migrated.
-
-Plus one site that looked like the hardest and is not. `v1_compiler.v1_interpreter`
-`InterpContext::resolved_graph` hands out a whole `ResolvedGraph` built from the scope map, which
-would force materialization to survive the cut for any consumer of it. **It has no consumer** — no
-call site anywhere in `src/`. It is deleted with the maps rather than being the reason to keep them.
-
-### Cut order
-
-1. The resolver and the rank map land, and the **provenance tests and point lookups** move first —
-   they are the sites that read the winner rather than merely its presence, so they are where a
-   polarity or admission error is loudest, and moving them first means the discriminating REDs run
-   against the arm most likely to be wrong.
-2. The **membership tests**, which are the same resolution asked for less.
-3. The **kind-filtered enumerators**, which need the corpus kind partition to exist.
-4. `roster_entry_registry_cache`, last, and only after its call frequency is measured — it is the one
-   reader the view does not obviously make cheaper.
-5. The **construction sites and `resolved_graph`** are deleted in the same motion, which is what
-   makes this a root cut rather than a leaf-first refinement. Nothing in steps 1–4 may be merged with
-   the fold still standing: a surviving map is the attractor, and readers understanding both
-   representations is the parallel-authority state the migration exists to avoid.
-
-## 6. The scope population — 660 and 1,155 come from one instrument at two revisions
-
-The brief asks that the delta between 1,155 and 660 be reconciled rather than assumed. Both are
-readings of the **same instrument**: the required floor's
-`floor: N scope construction(s) for M distinct scope(s)` line, whose `M` is the distinct-scope count.
-
-- **660** is a current reading, from a named required-floor job on the #9809 branch, where
-  `[floor-scope-split] constructions=660` and `M=660` agree — constructions equal distinct scopes,
-  so the per-claim rebuild is already gone.
-- **1,155** is a *transcription* of an earlier reading of that same line, sitting in the
-  `PreparedScopeIndexes` doc comment in `v1.interpreter` inside the sentence that records the
-  per-claim-rebuild finding ("9,573 reconstructions of maps that only 1,155 distinct scopes can
-  differ in"). Its companion figure, 9,573 constructions, is the one that has since been repaired to
-  equal the distinct count.
-
-So the delta is not two instruments disagreeing and not a scope-universe difference: it is one
-instrument read at two revisions, with the older reading copied into prose. Whether `M` fell from
-1,155 to 660 because the corpus moved, because the claim manifest moved, or because an intervening
-lane narrowed the closure is **not decidable from either figure**, and this design does not guess —
-the question is settled by re-deriving `M` on the current tree, which is precisely the "before" half
-of §7's paired run. Naming that as the answer rather than picking one of the two numbers is DESIGN
-§6's rule applied to the reconciliation itself.
-
-The transcription is the mechanism that made a stale reading look like a rival present-tense
-measurement. **This PR deletes it**, replacing the literal pair in the `PreparedScopeIndexes` doc
-comment with the name of the line that produces it. The number is not updated — updating it
-re-commits the defect at a fresher value. The model keeps the row, because the reconciliation is a
-finding about how the two figures were produced and survives the comment that carried one of them.
-
-## 7. Acceptance
-
-Paired required-floor runs, before and after, same instruments:
-
-- identical claim population, results, verdict and digests;
-- identical scope identities (the `hash_combine` fold over `order` — the rank map is derived from the
-  same `order`, so a moved identity means the closure moved, not the view);
-- `[floor-bare-name-ambiguity]` **byte-identical between the pair**. The line moves if and only if
-  bare-name precedence forks, which is the exact failure a rank-view can introduce.
-- `[floor-scope-split]` as the prize measurement: the `indexes` and `registry` terms go to
-  approximately the rank-map build, and `order` is untouched.
-
-The oracle is the paired run, never a literal (DESIGN §5): the relayed figures for the ambiguity line
-were measured on a pre-#9809 corpus and are re-baselined by the "before" half of the pair, not
-asserted.
-
-## 8. Order of work
-
-1. **This PR — the model only.** `gunbc.scope_rank_view` and its executing claim. No reader moves.
-2. The rank-view carriers land beside the fold, with the equivalence law executing over a fixture
-   corpus whose two entries rank one colliding bare name oppositely — the discriminating RED that
-   `scope_fragment_memo_equivalence` established the shape of for #9809.
-3. The root cut: the materialized maps are deleted and every reader is fixed forward onto the view in
-   one motion. Not leaf-first — a surviving map is DESIGN §3's attractor, and readers that understand
-   both representations are the parallel-authority state the brief forbids.
diff --git a/docs/plans/seed-string-decode-census.md b/docs/plans/seed-string-decode-census.md
deleted file mode 100644
index acf26ecd6cf..00000000000
--- a/docs/plans/seed-string-decode-census.md
+++ /dev/null
@@ -1,608 +0,0 @@
-# Seed string-decode census — the authority/realization coupling is spelling-keyed
-
-**Subject.** The Rust seed reads values produced by `.dag` authorities through the interpreter and
-addresses them BY SPELLING: type name, variant name, field name and entry-function name are string
-literals in Rust. The seed and the authority share no Rust type, so a rename on the `.dag` side has
-NO COMPILE-TIME LINK to the decoder that depends on it. gunbc#9975 discovered this by accident when a
-migration renamed what `local_repo_wet_schedule` reads. This document reports the population, the
-mechanism, and the §4b ceiling. It repairs nothing and enrols nothing.
-
-> **SCOPE, BEFORE ANY NUMBER BELOW.** Every count in this document was discovered by MATCHING A
-> SPELLING, and the population it ranges over is defined by an ABSENCE — decode sites with no
-> compile-time link. A search cannot enumerate an absence: a site written in a spelling the search did
-> not anticipate is indistinguishable from a site that does not exist. **Every number here is an
-> ESTIMATE WITH NO KNOWN SIGN.** Re-derivation with a parser moved P4 by +68 (42 → 110) and moved P7
-> in BOTH directions at once (`--function` 35 → 30, `--entry` 6 → 8): a line-keyed instrument misses
-> what formatting separates and over-claims what proximity suggests. Per-primitive status — measured,
-> or unmeasured — is in the table's own column.
-
-**What this document turned out to be.** It began as a census of a seed defect. The P6 incident below
-— the class reproducing in a different language, against a different file, within the hour, on the
-author repairing it — shows that it is not seam-specific: the class needs only a substitution whose
-failure arm widens, and not the seed/authority seam at all. So what is measured here is ONE SEAM of a
-primitive that is not seam-specific, and the population below is a FLOOR rather than a ceiling.
-
-Per DESIGN §7 the finding is not "the seed is wrong" — a realization lagging its authority is the
-expected state. The finding is that the COUPLING is spelling-keyed, which is a safety property
-independent of how much seed remains.
-
-## Deriving the census
-
-Subject population: the 90 hand-written `.rs` files under `src/v1/stage0/src` — every file whose
-first line is not `// Generated by v1 compiler`. Generated mirrors are excluded on purpose: they are
-re-emitted from `.dag`, so a rename propagates into them and this class cannot arise there.
-
-Right-hand side of the join: declarations scanned out of the 4,617 `.dag` files under `dag/`,
-`src/v1`, `src/v2`, `tools/`, `test/`, `fixtures/`. **This is a declaration scanner, not the
-compiler's own namespace authority**, and it is keyed on the BARE name — so the authority attribution
-below is an upper bound wherever a name has several declarers (8 of 79 do: `Refused` ×7, `Failed` ×6,
-`Present` ×4, `Done` ×3, `ExitSuccess`/`None`/`Suppressed`/`Empty` ×2). 70 of 79 names have exactly
-one declaring module; those attributions are exact.
-
-## The decode primitives — seven, and each pass that widened the search found more
-
-The set of PRIMITIVES is much narrower than the set of call sites, and it is what makes the census
-closeable. **P1–P5 bottom out in four `InterpContext` methods** (`sym`, `sym_eq`, `field`, `resolve`),
-declared together in `v1_interpreter`. **P6 and P7 do not touch `InterpContext` at all** — P6 is a
-`str::replace` over file text and P7 is a subprocess argument vector — and that is precisely why they
-were missed: every earlier sweep was keyed on the interpreter surface, so a name crossing into `.dag`
-by any other route was outside the search by construction. The primitives are grouped by the ROUTE a
-name takes, not by a shared implementation.
-
-| # | primitive | shape | sites (hand `.rs`) | how counted |
-|---|---|---|---|---|
-| P1 | `ctx.sym_eq(sym, "Name")` | type/variant name test | 87 (79 distinct names) | **argument parser — gap measured, 0** |
-| P2 | `ctx.field(fields, "name")` | field lookup by literal | 110 (62 distinct names) | **argument parser — gap measured, +7 over the line regex** |
-| P3 | `ctx.resolve(sym).as_str()` matched against string-literal arms | rendered-name dispatch | 61 | line regex — LOWER BOUND, gap unmeasured (match arms rarely wrap, so the gap is likely small; that is a guess, not a measurement) |
-| P4 | `run_in_context(ctx, "entry_fn", …)` | call-by-name into the authority | **110 literal, of 135 call sites**; the other 27 are enumerated one-by-one below | **argument parser — gap measured, +68** |
-| P5 | file-local wrappers (`field_str`, `field_value`, `field_list`, `variant_field`) over P1–P3 | indirection layer | 29 over those four names | argument parser for those four names; the WRAPPER SET itself is a lower bound — wrappers were found by naming convention, so a wrapper named otherwise is invisible |
-| P6 | `str::replace` rewriting a live-HEAD `.dag` file's own text | spelling-keyed EDIT, not lookup | 5 (3 + 2, in 2 producer fns reached from 6 call sites) | read exhaustively in 1 file — complete FOR THAT FILE; `str::replace` over `.dag` text elsewhere is unswept |
-| P7 | subprocess ARGV: `--entry <path>` / `--function <name>` | call-by-name through a second door | **30 spelling-keyed `--function` (12 distinct), 8 spelling-keyed `--entry` (7 distinct)** — see the re-derivation below | **token scanner — gap measured, and it ran in BOTH directions**; the assembled-argv blind spot is closed by mechanism, not by a zero |
-
-**The set is SEVEN KNOWN, NOT PROVABLY CLOSED**, and the method matters more than the number.
-
-**P7 is the find that matters most.** Entry and function names cross into `.dag` through SUBPROCESS
-ARGV — 35 `--function` literals across `bin/interp_recorded_fixture_witness.rs`, `bin/claim_batch.rs`
-and `pre_push.rs`, 6 literal `--entry` `.dag` paths, 11 distinct names. It is the same coupling through
-a second door, it is larger than the primitive this census started from, and it is invisible to every
-`run_in_context`-keyed search. A reader would least expect this door, which is exactly why it went
-unmeasured.
-
-**Method, stated because it is the transferable part.** Each pass of this census was keyed on a
-SYNTAX, and each re-keying found more: a `sym_eq`-keyed sweep missed P3 and P5; a `run_in_context`-keyed
-sweep missed P6 and P7. Both misses were committed by this document's author AFTER being warned that a
-grep written from the known specimen returns only the specimen's shape. The pass that found the
-subprocess door was keyed differently — on **any route by which a name crosses from Rust into the
-`.dag` world**, not on a spelling of a call. That is the formulation any future sweep should use, and
-it is why the count above is reported as known-not-closed. The same error recurred inside the
-instrument at smaller scale: locating P7's names needed `test fn`, not `fn` — a declaration scanner
-keyed on one keyword misses a whole declaration form.
-
-**P6 was the only primitive in the set that could fail OPEN, and this PR repairs it.**
-`str::replace` returns its input unchanged when the pattern is absent, so an ordinary edit to the
-`.dag` literal made the scratch copy silently unrewritten. The two arms differed and only one was
-loud: a missed module-path rewrite produced a same-name duplicate that the module-path collision wall
-refuses, while a missed `/tmp` rewrite made the witness write to the SHARED path instead of its
-per-run scratch directory — unreported, with the damage landing as cross-run interference in some
-other session's witness. Being caught by a neighbouring wall is a property of that wall, not of this
-rewrite, so **all five substitutions now refuse** — three in `unique_fs_witness_entry` and two in
-`closure_scale_witness_entry`, the two producer functions reached from six call sites — not just the
-silent one. The
-refusal names the PATTERN and the SOURCE FILE, because whoever trips it will be editing the `.dag`
-with no reason to know a Rust harness depends on its literal text. Evidence: a discriminating RED
-(pattern edited out → refuses, asserting the refusal names both), a positive control (pattern present
-→ substitutes, so the refusal is not a function that refuses everything), and a **counterfactual**
-that runs bare `str::replace` on the identical input and asserts it answers with the source unchanged
-and no error — because `substituted` did not exist before the repair, the RED alone would show only
-that a function which refuses, refuses, and not that the mechanism it replaced failed open. All three
-in `substituted_refuses_on_absent_pattern`. Honest placement: these execute under
-`cargo test --workspace`, not under the required lane, which runs `--lib` only and merely compiles bin
-targets. The incident that produced the counterfactual is recorded in its own section below.
-
-**Mint side** — the same coupling in the opposite direction, where the seed CONSTRUCTS a value the
-`.dag` side then destructures: 262 `type_name:`/`variant_name: ctx.sym("Lit")` sites and 198
-`ctx.sym("field")` field-name sites, over 170 distinct minted type/variant names.
-
-### What my search covered, and what a decoder using some other primitive would look like
-
-The instrument is keyed on P1–P5, which are name-keyed. A decoder that avoided names entirely would
-have to be **positional** (`fields[0]`, `fields.get(0)`) or **shape-only** (matching `Value::Record`
-without inspecting `type_name`), or **textual** (`format_value`/`type_label_public` rendered and then
-substring-matched). I looked for all three:
-
-- positional: **2 sites**, both in one `#[cfg(test)]` block in `v1_interpreter.rs`, and both still
-  assert the resolved NAME beside the index. Not a live decode mechanism.
-- rendered-text: **0 sites** in hand `.rs` — `format_value` appears 38 times and `type_label_public`
-  46 times, all inside refusal messages, never as the discriminant.
-- shape-only: present, but it is a distinct class (order/arity coupling, not spelling) and is not
-  what this census is about.
-
-So the name-keyed primitives are the whole live population, and P3/P5 are exactly what a grep written
-from the #9975 specimen (`sym_eq`) would have missed: 97 further sites in 9 files.
-
-## The finding: a safety claim asserted BY SUBTRACTION over a population nobody enumerated
-
-The count correction below is the receipt. **This is the finding.**
-
-The first version of this census's P4 row read:
-
-> 42 literal (of 142 total; **the other 100 take the name from a `.dag`-supplied roster and are NOT
-> exposed**)
-
-That bolded clause is the sentence that says most of the surface is fine, and it was reached by
-arithmetic: 142 minus 42. **The 100 was never a set.** Nobody enumerated it, nobody inspected a
-member, and no property of any member was ever checked — yet it was handed an exculpatory property
-and it carried the weight of the whole primitive's safety.
-
-Both of its operands were also wrong. 142 was a raw textual grep that counted the `pub fn
-run_in_context` definitions and doc-comment mentions; the call-site count is 135. And 42 came from a
-regex requiring the literal on the same LINE as the callee, which missed 68 wrapped calls. So the
-subtraction produced a phantom population of 100 where the real complement is 27.
-
-**Why it passed.** A subtraction over an unenumerated complement *reads as arithmetic rather than as a
-claim.* It has no verb like "I checked" to interrogate, it inherits the authority of the two counts
-beside it, and both of those counts looked like measurements. It passed the author, it passed review,
-and it passed the manager who commissioned the census. Nothing in the sentence's shape invites the
-question "which 100?".
-
-**The rule.** A complement is not evidence. If a population is small enough to matter to a safety
-claim, it is small enough to enumerate — and if it cannot be enumerated, the honest disposition is
-*undetermined*, never *not exposed*.
-
-## The 27 non-literal P4 sites, enumerated
-
-Enumerated rather than subtracted, one row each, because replacing a subtraction over 100 with a
-subtraction over 27 would rebuild the same defect at a fifth of the scale.
-
-| site | second argument | disposition |
-|---|---|---|
-| `cli_run.rs:31408` | `CI_FLOOR_COMMIT_WITNESS_SCHEDULE_FN` | **RustLiteral** — a Rust `const` |
-| `cli_run.rs:21376` | `basis_constructor` | **RustLiteral one hop** — `let basis_constructor = match kind { … }` selecting between Rust literals |
-| `cli_run/witness_gates.rs:494` | `basis_constructor` | **RustLiteral one hop** — same value, passed in |
-| `cli_run.rs:21405` | `constructor` | **RustLiteral one hop** — `match` arms including `"witness_cost_seed_timed_out_event"` |
-| `cli_run.rs:4249` | `fn_name` | HelperParameter |
-| `cli_run.rs:17354` | `function` | HelperParameter (`run_witness_verdict_diagnostic`) |
-| `cli_run.rs:17460` | `fn_name` | HelperParameter (`eval_census_string_fn`) |
-| `cli_run.rs:18514` | `function` | HelperParameter (`run_value`) |
-| `cli_run.rs:23786` | `fn_name` | HelperParameter (`call_test_claim_fn_bool`) |
-| `cli_run/required_floor_runner.rs:345` | `function` | HelperParameter (`run_claim_failure_receipt`) |
-| `cli_run/required_floor_runner.rs:376` | `function` | HelperParameter |
-| `cli_run/required_floor_runner.rs:3331` | `qualified_name` | HelperParameter |
-| `pre_push.rs:110` | `function` | **HelperParameter, traced** — `eval_fn(plan, "pre_push_zero_sha_authority")`, `eval_fn(plan, "pre_push_source_roots")`: Rust literals |
-| `pre_push.rs:282` | `function` | HelperParameter (`eval_fmt_recipe`) |
-| `required_regen_host.rs:4027` | `function` | HelperParameter — a local closure `let call = \|function: &str\|` |
-| `required_regen_host.rs:7217` | `function` | HelperParameter — same shape |
-| `v1_interpreter.rs:2549`, `:2577`, `:2610` | `name` | HelperParameter, inside `#[cfg(test)]` |
-| `cli_run/required_floor_runner.rs:3013`, `:3043` | `&qualified` | **Computed** — `format!("v2.workflow.required_floor.{func}")`; the PREFIX is a Rust literal and is itself exposed |
-| `cli_run.rs:19378` | `&qualified_declaration` | **Computed** — `format!("{declaration_module}.{declaration_name}")` from `.dag`-supplied parts |
-| `cli_run.rs:19082` | `&function` | Undetermined |
-| `cli_run.rs:18659` | `projection` | Undetermined |
-| `cli_run/shared_fill.rs:542` | `&format!("fixture.tmshare.{entry}")` | **Computed over a synthetic fixture** — no live authority |
-| `v1_interpreter.rs:21175` | `&format!("fixture.{module}.total")` | **Computed over a synthetic fixture** — no live authority |
-| `v1_interpreter.rs:4864` | `entry_fn` | Not a call site — the internal delegation inside `run_in_context_with_args` |
-
-**Reading this table honestly.** *HelperParameter is not a safe disposition — it moves the question one
-stack frame up, it does not answer it.* Two were traced to Rust literals at their callers, and nothing
-suggests the others differ; but they were not traced, and a reader must not convert them to "safe".
-**Not one row in this table says "reads its name from a `.dag` roster and is therefore not exposed"** —
-the property the deleted sentence claimed for a hundred sites is claimed here for none, because it was
-never established for any.
-
-## What the spelling-to-parsing gap cost, measured
-
-Re-derived with a brace-aware parser that reads each call's actual argument list instead of matching a
-line:
-
-| primitive | line-keyed regex | argument parser | miss |
-|---|---|---|---|
-| P1 `sym_eq` | 87 | 87 | 0 |
-| P2 `ctx.field` | 103 | 110 | 7 |
-| **P4 `run_in_context`** | **42 (reported "of 142")** | **110, of 135 call sites** | **68** |
-
-**The blind spot is a function of FORMATTING, not of meaning**, which is why the miss rate is not
-uniform: a line-keyed pattern sees a call only when the literal lands on the same line as the callee,
-so the gap rises with argument count. `sym_eq(sym, "Name")` never wraps; `run_in_context_with_args(ctx,
-"name", &args, false)` is long enough that `rustfmt` breaks it at 68 sites. Those 68 are ordinary
-literal entries — `"generated_artifact_body_for_path"`, `"committed_generated_artifact_paths"`,
-`"live_read_selection_manifest_live"`, `"resolve_channel_policy"`, `"ci_batch_summary_text"` — 21 in
-`required_regen_host.rs`, 18 in `cli_run.rs`, 9 in `cli_run/required_floor_runner.rs`, the rest across
-six more files.
-
-P3, P5, P6 and P7 have NOT been re-derived this way; their status is in the primitive table's own
-column, and where the gap is unmeasured it says so rather than implying zero.
-
-## The class reproduced on the author, inside the repair, within the hour
-
-This is recorded as evidence rather than as an anecdote: it is the only observation in this document
-that shows the class arising rather than being inventoried, and it happened to the person writing the
-inventory.
-
-While adding the counterfactual test to the P6 repair — the repair whose entire subject is
-`str::replace` failing open on a missed pattern — the editing script used a Python `str.replace()`
-whose pattern did not match, because the escaping of `\n` and `\"` differed between the script and the
-file. Every signal available agreed with success:
-
-| signal | said | actual |
-|---|---|---|
-| `str.replace()` return | a string | the file, unchanged |
-| `cargo fmt` | "modified 1 file" | an unrelated reformat |
-| command exit code | `0` | the edit never applied |
-| remote `cargo test` | **green** | ran the two tests that already existed |
-| `test result: ok. 2 passed` | ok | the third test was never written |
-
-**The count was the only tell, and the colour was not.** `2 passed` where `3` was expected is the
-entire discriminating signal; it was caught by reading the run's test NAMES out of the log rather than
-its exit code, which was luck of habit and not of design.
-
-Three things follow, and none of them are about Python.
-
-1. **The primitive is not `.dag`- or seed-specific.** A silent no-op on a missed pattern reproduced in
-   a different language, against a different file, one hour after the paragraph explaining why it is
-   dangerous was written. That is the strongest available evidence that the population estimated above
-   is a floor rather than a ceiling: the class does not require the seed/authority seam to occur, only
-   a substitution whose failure arm widens.
-2. **Assert the pattern is PRESENT before replacing.** The edits in this PR that worked did exactly
-   that; the one that vanished did not. That is the whole difference between them.
-3. **A green run is not evidence that a test EXISTS.** A test run reports the tests that are there,
-   never the ones you meant to add — so a vanished edit and a passing suite are indistinguishable by
-   colour, exit code, or any single-number summary. Read names and counts. The same shape appears as a
-   vacuous `0 passed; 0 failed; N filtered out`, and both are caught by ARITHMETIC rather than by
-   suspicion.
-
-## Which authorities the seed decodes
-
-25 unambiguously-attributed `.dag` modules, by decoding site:
-
-| authority | names decoded | decoder |
-|---|---|---|
-| `v2.std.live_read` | 10 | `cli_run/live_read_decode.rs` |
-| `v2.workflow.floor_diff_observe` | 9 | `cli_run/required_floor_runner.rs` |
-| `gunbc.output_policy` | 6 | `cli_run.rs` |
-| `std.observation` | 5 | `cli_run.rs`, `cli_run/witness_gates.rs`, `cli_run/test_module_hygiene_bridge.rs` |
-| `gunbc.observation_seed_render` | 4 | `cli_run.rs` |
-| `tools.dag_compile_clean_scope` | 4 | `cli_run/compile_clean.rs` |
-| `gunbc.generated_artifact_emit` | 3 | `generated_artifact_boundary_host.rs`, `behavioral_receipt_host.rs` |
-| `gunbc.cli_wire`, `gunbc.test_module_hygiene`, `extdeps.render.terminal`, `std.process`, `v2.std.live_tree`, `v2.workflow.floor_discovery_producer` | 3 each | `cli_run.rs` (+ bridge) |
-| `gunbc.githooks_pre_push_plan` | 2 | `pre_push.rs` |
-| `v2.workflow.floor_terminal_ledger_wire` | 2 | `cli_run/terminal_ledger_publish.rs` |
-| `extdeps.transports.rest`, `std.access` | 2 each | `v1_interpreter.rs` |
-| `v2.workflow.wet_evidence`, `v2.workflow.floor2_prepared_subject`, `v2.workflow.floor_route_gap` | 1 each | `cli_run/required_floor_runner.rs` (the #9975 site) |
-| 9 further modules | 1 each | `cli_run.rs`, `v1_interpreter.rs` |
-
-**Load-bearing:** `required_floor_runner.rs`, `compile_clean.rs`, `witness_gates.rs`,
-`live_read_decode.rs`, `terminal_ledger_publish.rs`, `generated_artifact_boundary_host.rs` and
-`cli_run.rs` are all in the library the required lanes reach through `claim_executor --required-ci`.
-`pre_push.rs` is the local hook. I did NOT measure per-site execution coverage; reachability of the
-FILE is not execution of the SITE, and that gap is the census's main residue.
-
-## Instances: one confirmed, one retracted
-
-**1 — #9975 (`v2.workflow.wet_evidence`), known and standing.** Four spellings, all refused on the
-required path, no Rust compile failure. This remains the only confirmed instance.
-
-**2 — `roadmap_acceptance_event_history`: RETRACTED. Not a defect, and the retraction is the more
-useful finding.** `cli_run.rs` calls `run_in_context(&ctx, "roadmap_acceptance_event_history", true)`
-and no declaration of that name exists **at HEAD** — `gunbc.roadmap_authority` carries
-`roadmap_acceptance_event_history_load` instead. I reported that as a live break. It is not, and the
-reason is a defect in my own census METHOD rather than in the seed.
-
-That decoder's subject is **revision-addressed**, not HEAD. It is the one-time carrier-introduction
-bootstrap in `gunbc.roadmap_acceptance_history_observation`: it fires only when
-`git_show_path_absent_at_ref` reports the JSONL carrier ABSENT at the merge-base, and the text it
-decodes is `git.Core.Show(ref: baseline_sha, path: dag/gunbc/roadmap/roadmap_authority.dag)` — the
-merge-base revision's authority, not the worktree's.
-
-The two facts are complementary, and they were bound in a single commit. At `bfaaf3e4ee7^` (#7791)
-`fn roadmap_acceptance_event_history()` exists and the carrier is absent; at `bfaaf3e4ee7` the
-carrier exists and the function is gone. That commit both introduced
-`dag/gunbc/roadmap_acceptance_event_history.jsonl` and removed the function. So the arm's own guard —
-carrier absent at merge-base — implies the old spelling is present in the text it is about to read.
-The seed's spelling is correct for exactly the revision set in which the decoder can fire, and
-unreachable everywhere else.
-
-**The probe question, answered.** The `#[ignore]`d test pins
-`git show 9ce6526c528:dag/gunbc/roadmap_authority.dag`. `9ce6526c528` is an ancestor of
-`bfaaf3e4ee7^`, carries the function, and has no carrier — it is a faithful representative of the
-revision class this decoder serves. **The pin is legitimate and must stay.** A "live probe that goes
-red on a rename", which is the reflex repair, would be WRONG here: live resolution is not this
-decoder's subject, so such a probe would assert a property the code never claimed and would have to
-be deleted or exempted the moment it went red. The `#[ignore]` is separately declared (live-corpus,
-minutes per test) and is not what hid anything.
-
-**The class this actually names, and it is a census-method class:**
-*a spelling-keyed decode whose subject is a REVISION-ADDRESSED text must be joined against the
-revision it reads, not against HEAD.* Joining against HEAD reports every historically-correct
-spelling as a break. My scanner had no notion of the decoder's subject revision, so it could not
-distinguish "the seed lags the authority" from "the seed reads an older authority on purpose". Any
-future instrument over this class inherits that requirement: the join key is (name, subject
-revision), not name.
-
-**Consequence for the population above.** P4 is the only primitive whose sites can be
-revision-addressed in this way, and the attribution below shows exactly one such site — this one. The
-P1/P2/P3/P5 sites all decode values produced by the CURRENT resolved graph, so the HEAD join is the
-right join for them. The retraction therefore narrows to P4 and does not disturb the rest — but the
-census reports it because a reader who copies the method would repeat the error.
-
-**Mint-side residue:** 6 of 170 host-minted type/variant names have no `.dag` declaration at all —
-`EmitHostTransportResult`, `FilesystemReadResult`, `TargetModelish`, `PortLocus`, `OtherDiagnostics`,
-`UnrelatedDecision`. These are not rename victims; they are shapes the host owns with no corpus
-authority, which is the §3 half of the same coupling: nothing on either side can be renamed
-*together* because there is no other side.
-
-## P4 subject-revision attribution (second pass)
-
-The retraction above established that the join key is (name, subject revision).
-
-> **THE 68 ARE NOW ATTRIBUTED — see "Closing the 68" below.** The table in this section covers only
-> the 42 sites the line-keyed regex found, and its conclusion stays struck, because a conclusion is
-> not rescaled onto a population it was not derived over. The 68 were answered separately and by a
-> different question.
-
-The 42 sites the first pass found, attributed by reading each caller's context construction:
-
-| subject | sites | how established | files |
-|---|---|---|---|
-| **HEAD / live worktree** (ctx built from `default_source_roots()` / `workspace_root()`) | 17 | context construction reads the live source roots | `required_regen_host.rs` 4, `cli_run/required_floor_runner.rs` 4, `cli_run/materialization_provider_consumer.rs` 4, `cli_run.rs` 2, `cli_run/terminal_ledger_publish.rs` 1, `cli_run/test_module_hygiene_bridge.rs` 1, `derived_realization_schedule.rs` 1 |
-| **In-file synthetic source** (subject is the `r#"…"#` literal beside the call; no tree at all) | 24 | the module text and the entry name are authored together in the same expression | `bin/auth_declared_but_unwired_witness.rs` 10, `bin/interp_recorded_fixture_witness.rs` 4, `cli_run/shared_fill.rs` 4, `v1_interpreter.rs` 4, `compiler_tests.rs` 2 |
-| **Revision-addressed** (`git.Core.Show` of a merge-base ref) | 1 | `cli_run.rs:680`, the carrier-introduction bootstrap — the retracted candidate | `cli_run.rs` |
-
-**~~The residue is closed.~~ STRUCK.** Of the 42 attributed sites, exactly one is revision-addressed
-and it is the one already adjudicated; the 24 synthetic sites cannot drift against any tree, since
-their authority and their consumer are the same expression; and the 17 HEAD-subject names all resolve
-today. **All three statements are about 42 of 110 sites.** The remaining 68 have not been attributed,
-so the residue is OPEN: it is not known whether any of them is revision-addressed, and no claim is
-made that they are not.
-
-P7's 35 `--function` names are all HEAD-subject and all 11 distinct names resolve today
-(`filesystem_write_keystone_holds`, `witness_write_then_read_roundtrip`,
-`clock_freshness_keystone_holds`, `env_freshness_keystone_holds`, `diagnostic_redfish_keystone_holds`,
-`http_pilot_rest_keystone_holds`, `w_site_label_is_the_module_path_as_package`, and four others), each
-in a `dag/test/claim/*.dag` entry named as a literal `--entry` path beside it.
-
-So of the P4/P7 call-by-name axis, this section attributes 52 sites (HEAD-subject, 0 stale); the
-remaining 68 are answered in the next section by a different question, and none is revision-addressed.
-
-## Closing the 68: the question was re-shaped twice, and the first re-shaping was still a spelling
-
-The 68 unattributed P4 sites are closed. The method took two attempts, and the failed first attempt is
-kept because it is the same defect this document is about, committed for the third time, in the
-paragraph that claimed to be immune to it.
-
-**First re-shaping — right idea, wrong population.** A call site has no subject revision; the
-`InterpContext` it runs in does, and many sites share one context. So the question became *which
-context constructions are built from revision-addressed source text?* — and the population was given
-as "**86** `InterpContext::new` / `make_eval_context` constructions". **That population was itself
-discovered by grepping two constructor NAMES.** It is a spelling wearing a mechanism's clothes, and
-review 59276 refuted it with a positive hit: contexts are also constructed through
-`InterpContext::with_runtime_options` and `InterpContext::over_scope_indexes`. The 86 was a lower
-bound presented as a complete population — the exact move retracted twice above.
-
-**The remedy the review proposed is the weaker of the two available**, and this is the one place this
-correction does not simply take the reviewer's instruction. "Expand the census to all constructors"
-re-keys on a longer list of names, so a constructor added tomorrow escapes it again. The stable fix is
-to anchor on the CONSTRUCTION ITSELF.
-
-**Second re-shaping — anchor on the struct literals, of which there are three.**
-
-| carrier | struct-literal construction sites | consequence |
-|---|---|---|
-| `InterpContext` | **1** — inside `over_scope_indexes`, *derived by reading the constructor chain, not by grepping the brace: `InterpContext *{` returns 20 hits of which 19 are `fn … -> InterpContext {`, since a return type followed by its opening brace is textually identical to a construction* | `new`, `with_fixture_store` and `with_runtime_options` all funnel into it; so does every future constructor, because there is nowhere else to build one |
-| `PreparedScopeIndexes` (its only content-bearing input) | **1** — inside `build_scope_indexes_with_module_order`, which takes `graph: &ResolvedGraph` | every context's content therefore comes from a `ResolvedGraph` |
-| `ResolvedGraph` | 21, of which 13 are empty test graphs, 4 are the compile path, and **4 are the resolved-graph cache** | the cache is the only one whose bytes are read from disk rather than freshly compiled |
-
-**The cache is not a third route, and it is refused into that shape rather than assumed into it.** Its
-key is `subject_digest_for_closure(sources: &[Rc<SourceFile>])` — derived from the sources themselves —
-and a header whose stored subject differs from `expected_subject` is REJECTED
-(`CacheRejectReason::BackendKeyMalformed`), not served. So a cache hit is content-identical to the
-sources the caller already holds; it is a memo keyed on the subject, not an independent origin.
-
-**The closure, now anchored on constructions rather than on names.** Every context's decodable content
-reaches it through one struct literal, from one `PreparedScopeIndexes` literal, from a `ResolvedGraph`
-that is either freshly compiled from `SourceFile`s or restored from a cache keyed on those same
-`SourceFile`s. And `SourceFile`s arrive by exactly two routes:
-
-| route | how source text reaches a context | revision-addressed instances |
-|---|---|---|
-| a disk path under a `--source-root` | including `fs::write` of externally-obtained text into such a directory | **1** — the roadmap carrier-introduction overlay, already adjudicated |
-| in-memory `SourceFile { content: … }` / `single_source(…)` | | **0** |
-
-That one context's call is `cli_run.rs:680`, a single-line site counted in the original 42. **It is not
-among the 68, so none of the 68 is revision-addressed.**
-
-**ORIGIN IS IRRELEVANT, and that is the strength of the argument.** Git, a network fetch, an archive,
-synthesis — to be decoded, text must become a context's source, and every origin enters by one of the
-two routes above. A fetch composed with a write is not a third route; it is the first route with a
-different upstream.
-
-*An earlier revision bounded this with an observation instead: "no network fetch or archive extraction
-exists in this tree". That was FALSE — `v1_interpreter` carries a live `ureq` REST transport,
-dispatched by method — and it is the kind of false a reader trusts precisely because it was labelled an
-observation, and observations read as checked. It was deleted rather than repaired: it was a sentence
-that can rot, guarding a claim that cannot. Recorded rather than silently removed, because the weaker
-sentence was written to bound the stronger one and ended up being the only part that could be wrong.*
-
-**What remains genuinely unknown**, stated as unknown: whether any `.dag` program composes a fetch with
-a write into a directory later passed as a `--source-root`. Not found, not exhaustively searched. It
-does not affect the closure — that composition is the first route — but it matters to anyone reasoning
-about where a context's bytes originate.
-
-**Why the HEAD-vs-synthetic split within the 68 was NOT enumerated.** It changes no answer: both are
-HEAD-time, both are typed by the trigger identically, neither can drift against a revision. It would be
-the same completeness-priced-as-completeness declined for the 14 `HelperParameter` rows.
-
-## P7 re-derived: the line-keyed instrument's error was not one-signed
-
-P4's re-derivation found 68 sites a line-keyed regex had missed, and the obvious generalisation is
-"line regexes undercount." **That generalisation is wrong, and P7 is the counterexample.** Re-derived
-with a token scanner that reads the next token after each flag literal — skipping whitespace, commas
-and line comments, so wrapping is irrelevant:
-
-| flag | occurrences | literal next token | literal inside the adjacent expression | computed | spelling-keyed total | census had said |
-|---|---|---|---|---|---|---|
-| `--function` | 35 | 29 | 1 | 5 | **30** (12 distinct) | 35 (11 distinct) — **over** by 5 |
-| `--entry` | 41 | 3 | 5 | 33 | **8** (7 distinct) | 6 — **under** by 2 |
-
-**Over-counted on one flag, under-counted on the other, from the same instrument in the same pass.**
-`--function` was reported as 35 because 35 is the count of the FLAG, and every flag occurrence was
-assumed to carry a name; 5 of them take their name from a variable. `--entry` was reported as 6
-because the old query asked whether a `.dag` literal appeared on the following line, which conflates
-*adjacency* with *containment*: `ws.join("dag/test/claim/x.dag")` is not a literal next token but it
-does carry a spelling, and 5 such sites were missed while 3 truly-adjacent ones were counted.
-
-So the correct lesson from P4 is narrower than it looked: **a line-keyed instrument's error has no
-sign.** It misses what formatting separates and over-claims what proximity suggests, and which one
-dominates depends on the syntax at hand, not on the instrument.
-
-**The assembled-argv blind spot is closed by MECHANISM, not by a zero — and the closure is stated as
-ENTRY, not as origin.** The previous entry said argv built as a `Vec<String>` elsewhere would be
-invisible "in principle". That is true of the scanner, so the question was re-shaped the way the 68
-were.
-
-*A first attempt at that re-shaping was incomplete and is recorded rather than quietly replaced.* It
-argued that the flag string must be either a LITERAL (all 35 occurrences scanned above) or
-SYNTHESIZED (and there is no synthesis — the only `format!("--…` in the hand `.rs` set builds an error
-message). **That disjunction has a third arm: a string can be READ rather than written or built** —
-from an environment variable, a config file, a JSON or TOML payload, a recorded fixture, or argv
-forwarded into the process. Reading is neither a literal nor a synthesis and it leaves no `format!` to
-find, so the two-armed version was a closure with a hole in it.
-
-**The correct form is the one this document already uses one section earlier: ENTRY, NOT ORIGIN.**
-Every argv that reaches a subprocess is CONSTRUCTED at one of exactly two sites, and both are wholly
-inside the scanned population:
-
-| spawn site | argv construction | forwarded input |
-|---|---|---|
-| `pre_push.rs` `run_claim_batch` | `.arg()` chain: `--entry <entry> --function <function>`, then `for arg in suffix_args` | ONE caller, passing the literal array `&["--claim-run"]`; `entry` and `function` come from `ActiveGate::DocWitness` read out of the `.dag` plan |
-| `bin/interp_recorded_fixture_witness.rs` `run_claim_batch(args: &[&str])` | the caller's array, verbatim | 30 call sites, every one a literal `&[…]` array |
-
-So a value's ORIGIN — literal, synthesized, or read — does not matter. To become an argument it must be
-interpolated at one of those two constructions, where it appears as a non-literal and is classified as
-*computed* above. A zero from a grep would have established nothing; this establishes it, and it
-establishes it without needing to enumerate the ways a string can come into existence.
-
-**Two facts of different kinds hold this up, and they must not be read as one.** The ENTRY argument is
-STRUCTURAL: a value becomes an argument only by being interpolated at a construction, so it is visible
-there as a non-literal whatever anyone does tomorrow. The POPULATION reading is CONTINGENT: that
-`suffix_args` has one caller passing `&["--claim-run"]`, and that all 30 call sites of the other
-`run_claim_batch` pass literal arrays, is true of this tree TODAY. **A second caller forwarding a read
-string breaks the second half silently** — no test fails, no gate fires, and the sentence above stays
-green while it is false. Nothing enforces it. Stating the two in one breath would make a rung-1 fact
-wear a rung-4 argument's clothes, which is this document's own recurring defect in another costume;
-the typed-decoder trigger is what eventually makes the contingent half unnecessary.
-
-**The computed sites are not hidden spellings, and their origins are named rather than assumed.** The
-33 computed `--entry` values and 3 of the 5 computed `--function` values are the P6 scratch-copy paths
-built by `unique_fs_witness_entry` / `closure_scale_witness_entry`, whose `.dag` spellings are already
-counted under P6. `pre_push.rs`'s `entry` and `function` come from the `.dag` plan itself
-(`ActiveGate::DocWitness { entry, function }`, read out of `pre_push_active_kinds`) — **authority-supplied,
-so not a Rust spelling and not exposure.** That is the disposition the retracted P4 sentence claimed
-for a hundred sites without checking; here it is claimed for four, by reading them.
-
-## The identifier-preserving shape axis — a real, unmeasured sibling
-
-Ruled by the design authority and recorded here rather than discovered later. The class is not "every
-`.dag` rename silently breaks the seed"; it is **any change to a `.dag` schema element consumed
-reflectively by host code is a host↔dag ABI change with no compiler-enforced edge**. A rename is one
-trigger. The class also includes changing a qualified function name, changing a record tag, renaming
-or NESTING or ADDING or REMOVING or RETYPING a field read by name, adding an arm to a host-side closed
-match, changing a serialized wire spelling shared by `.dag` and Rust, and — decisively for this
-document — **changing optionality, cardinality or shape while preserving every identifier**.
-
-**Every primitive P1–P7 is NAME-keyed, so the identifier-preserving shape axis passes all seven and
-still breaks the decode. The population measured here is the NAME-KEYED SUBSET and nothing more.**
-This is not hypothetical: the one case examined closely in this census (§ instance 2) was half a shape
-change — the `.dag` side changed the result from `List<RoadmapAcceptanceEvent>` to a `Load` coproduct
-alongside the rename, and the seed's `Ok(Value::List(events))` arm would have been wrong even had the
-name matched.
-
-The ceiling below is unaffected, and that is the point: a generated typed decoder makes a shape change
-a type error exactly as it makes a rename one. **The ceiling is right; only the census is narrow.**
-
-## Rung and ceiling
-
-**Rung found at: 1 (mitigatable), and the honest reason is better than expected.** Every P1/P2 decode
-site I read fails CLOSED — the catch-all arm is a typed `Err` naming the expected type, not a
-default (`require_permitted_transport`, `discover_floor_corpus_rows_from_host_facts`,
-`expand_explicit_pairs_or_refuse`, the `live_read_decode` chain). So the class is NOT
-silent-wrong-answer. It is **silent at compile time and loud only where executed**, and #9975 is the
-evidence: four spellings refused on the required path with nothing failing to compile.
-
-That refinement changes what the class COSTS and therefore how it ranks. A silent-wrong-answer class
-is priced by the harm a fabricated output causes downstream; this one is priced by the delay between
-a rename landing and the first execution of the affected path — the cost is deferred detection, not
-corrupted output. It ranks above a merely cosmetic class and below a fail-open one.
-
-**Compiler-silent, not necessarily execution-silent.** It is loud and correct when the decoder
-actually runs. It becomes operationally silent by four routes: the path does not run; a fixture
-bypasses it; a default absorbs the mismatch; or a stale artifact answers instead. (Adopted from the
-design authority's ruling, which reached this independently of the code reading above.)
-
-A caution that falls out of the retraction above: because the class is loud-when-executed, the
-temptation is to hunt it by static join, and a static join over the WRONG subject manufactures
-findings. That happened once in this census, to me, in the space of one pass.
-
-**Attainable ceiling: 3, structurally guaranteed, and possibly 4.** The class is decidable and the
-authority already exists: the seed EMITS Rust mirrors from `.dag` today. If the decode consumed a
-generated mirror type instead of a spelling, a rename would be `rustc` E0433/E0599 — construction,
-not a check, and it climbs the mint side at the same time (a generated constructor cannot name a
-field the type does not have).
-
-**Next-rung trigger — the CAPABILITY, not an artifact:** *emission of a typed decoder
-(`Value` → mirror type) and a typed constructor for every `.dag` type the seed decodes or mints,
-sufficient to replace every P1–P7 and mint site above, and to make an identifier-preserving shape
-change a type error as well as a rename, such that no hand-written spelling of a `.dag`
-type, variant or field name survives in `src/v1/stage0/src`.* Partial emission does not retire the
-class: any site left on a spelling keeps its own exposure, so the trigger is stated over the
-population, not over one module.
-
-**The trigger needs an explicit version-boundary arm, and without it it is UNSATISFIABLE.** A
-generated decoder binds the type as it exists at HEAD. A site that decodes REVISION-ADDRESSED source
-text must read the shape that revision had, so typing it against HEAD is not safer — it is wrong, and
-it is wrong in the direction that produces a confident answer about the wrong schema. One such site
-exists (the roadmap carrier-introduction bootstrap) and the closure above establishes it is the only
-one, but one is enough: as originally worded, "no hand-written spelling survives" cannot be satisfied
-there, because there is no HEAD type to bind to.
-
-So the trigger carries a second arm: *for every revision-addressed decode, either a decoder bound to
-the revision's own schema, or a TYPED REFUSAL at the version boundary — never a HEAD-typed decoder
-applied to older text.* This matters more than its one-site population suggests, because §4b(3) makes
-the trigger the whole check: **an unsatisfiable trigger is worse than a weak one.** It can never be
-retired, so the class parks below its ceiling permanently behind a row that still reads live — which
-is rung inflation arriving by a different door than the usual one.
-
-**What is explicitly NOT the answer.** A lens or test that greps the seed for spellings and joins
-them to `.dag` declarations — i.e. an executable version of this document — is validation standing
-where construction is available, and it would additionally inherit the bare-name ambiguity noted
-above (`Refused` ×7). It belongs only as the interim mitigation if the emission capability is
-deferred, and then as a declared §4b(3) row, not as the climb.
-
-## Residue this census did not close
-
-- Per-site execution coverage. File reachability is not site execution; the P4 entry names refuse
-  loudly *when run*, and I did not establish which run. This is the residue that matters most: it is
-  what separates a spelling that is stale from a spelling that is merely unexercised.
-- **The identifier-preserving shape axis, in full.** Named above, deliberately not measured in this
-  pass. It is the largest single gap between this document and a closed answer.
-- **The transitive origin of the 16 `HelperParameter` rows** in the P4 enumeration. Two were traced;
-  the rest move the question one frame up and are not answered. DELIBERATELY not closed: the typed
-  decoder types literal-origin and `.dag`-origin names identically, so the distinction dissolves when
-  the trigger lands, and completing the inventory of a population scheduled to stop existing is
-  completeness priced as completeness.
-- **The HEAD-vs-synthetic split within the 68**, for the same reason — it changes no answer.
-- Whether any `.dag` program composes a fetch (the live `ureq` REST transport in `v1_interpreter`)
-  with a write into a directory later passed as a `--source-root`. Not found, not exhaustively
-  searched, and stated as unknown. It does not affect the closure — that composition is route A with a
-  different upstream — but it matters to anyone reasoning about where a context's bytes originate.
-- **P3 and P5 re-derivation.** P1, P2, P4 and P7 are done; P3 and P5 carry line-keyed counts and are
-  floors with an unmeasured gap — and after P7, "floor" is the wrong word: the gap has no known sign.
-- P6's fail-open arm is described but not sized beyond its 5 substitutions in 2 producers;
-  `str::replace` against `.dag` text elsewhere in the tree was not swept. Given the reframing above, the wider sweep is the
-  substitution-whose-failure-arm-widens class, not the `.dag`-text subset.
-- Two findings about the REVIEW instrument surfaced while this census was in flight and are recorded
-  separately, in [review-instrument-observations.md](review-instrument-observations.md), because they
-  are facts about the tooling rather than about the seed.
-- The `.dag` FILE-PATH axis: 420 distinct `"*.dag"` string literals in hand `.rs`, most synthetic
-  fixture paths. A path rename is the same spelling-keyed coupling in a different alphabet; I did not
-  separate the live paths from the synthetic ones.
-- The mirror-emitted files were excluded by construction. That exclusion is sound for THIS class and
-  is not evidence about any other.
diff --git a/docs/plans/service-interface-and-uses-carriers.md b/docs/plans/service-interface-and-uses-carriers.md
deleted file mode 100644
index 4c24cfe1588..00000000000
--- a/docs/plans/service-interface-and-uses-carriers.md
+++ /dev/null
@@ -1,150 +0,0 @@
-# XL-2: service interface, realization binding, and `uses` — carrier design
-
-Status: design only, no behaviour change. Owner: XL-2 (quiet-seal-543). Decisions recorded below were ruled by the XL-2 manager on 2026-10-01.
-Governs: `gunbc.recurring_failure_mode` `service_interface_member_has_no_carrier`, `gunbc.recurring_failure_mode` `uses_clause_has_no_carrier`, and the two `v2.workflow.compile_door_cause_ownership` rows for `body_lowering_reason_service_realization_unreachable` and `body_lowering_reason_uses_clause_unmodeled`.
-History: #12277 (declaration-grade service lowering), #12816 (`uses` parses and refuses at the clause).
-
-## The question
-
-Two refusals in `v2.compiler.body_lowering_fold` keep whole modules out of the XL-2 reference census, which reads the **full** normalize route, not census grade:
-
-- `body_lower_service_decl` refuses every service carrying a set-aside member as `body_lowering_reason_service_realization_unreachable`.
-- `body_lower_fn_uses_refusal_optional` refuses every fn carrying a `uses` clause as `body_lowering_reason_uses_clause_unmodeled`.
-
-For each member, this document asks what fact it is, who consumes it, and which existing authority already owns it. It then gives the smallest lowering change after which every member either lowers into its carrier or refuses at a located diagnostic. No member is dropped.
-
-## Population (measurement, to be re-derived)
-
-Measured by a source grep at the base of this change. This is a sizing, **not an oracle** (DESIGN §5). The authoritative population is the set of modules the CI census run refuses under each reason, re-measured after each PR below lands.
-
-| Subject | Modules | Note |
-| --- | --- | --- |
-| declares a `service` | 114 | all refuse whole on the full route today |
-| — with a realization member (`transport` / `config` / `exit` / `response` / `mock_response`) | 111 | |
-| — with only interface members (modifiers, io tails) | 3 | |
-| fn or pattern header carrying `uses alias: Type` | 30 (97 rows) | no overlap with the service modules; no row reads its alias in the body |
-
-**Consequence:** an operation-modifier carrier alone, the trigger the failure-mode row named, unblocks 3 modules. The service frontier is the realization members. The `compile_door_cause_ownership` flip trigger already said so, and this design adopts that sentence as the scope.
-
-## Inventory: what each member means
-
-### Service members
-
-| Member | Fact | Layer (DESIGN §3) | v1 semantics | Downstream consumer |
-| --- | --- | --- | --- | --- |
-| `operation Op { input {…} output {…} }` | an arrow of the interface | interface | operation signature | resolve (call targets), infer (call typing). **Lowered today.** |
-| io field `= default` | the value an omitted input takes | interface | `v1.compiler` `make_field_node` `default_value` | infer (call-site arity: a defaulted field may be omitted), eval |
-| `readonly` | a declared claim that the operation's effect shape is `ReadEffect` | interface (a claim about the arrow's effect) | `OperationModifier.Readonly` (`v1` `00_core` `field_init_operation_modifier`) | `std.effects` `check_modifier_vs_derivation`; effect_demand (a read never needs a write grant) |
-| `idempotent` | a declared claim that the effect shape is idempotent | interface | `OperationModifier.Idempotent` | `std.effects` `check_modifier_vs_derivation` / `is_idempotent_effect`; retry admission (DESIGN §4b names a non-idempotent effect under retry) |
-| `hermetic` | a declared claim that the operation is admissible on the hermetic execution mode | interface (execution-mode axis, not an effect shape) | `OperationModifier.Hermetic` | `std.execution_mode` `Hermetic`; effect_demand keys mode as part of the demand |
-| io field `from "key"` | which wire field fills a declared output | **realization** — a decode projection of one transport's observation | `field_node_from_key` | the transport's output projection (target_model / eval). It is not interface: another transport of the same shape need not have a wire key |
-| `transport shell {…}` / `rest {…}` / `file` / local | which handler realizes the operation | realization | `classify_transport` | `std.effect_grant` `HandlerBinding` (`RealTransport`) via `extdeps.transports.shell` `ShellTransportConfig` / `extdeps.transports.rest` `RestTransportConfig` |
-| `config {…}` | handler configuration at service grain | realization | service-level transport defaults | the same transport config, applied to each operation |
-| `exit {…}` / `response {…}` | how an observation (exit status, streams, body) projects onto declared outputs | realization | output projection of the observation | the interpreter's declared-output projection (`v2.std.operation_realization` feeds it a `TransportObservation`) |
-| `mock_response {…}` | one published response arm of one operation | realization (a hermetic-replay handler) | published mock | `std.hermetic_replay` `PublishedMockCase`, selected through `HandlerBinding.Replay` |
-
-### `uses alias: Type`
-
-| Fact | v1 semantics | Owning authority today |
-| --- | --- | --- |
-| the resources a fn's body demands | `v1` `04_items` `ResourceRequirement` (`binding_name`, `resource`), consumed by the Rust emitter's call-site binding | **D13** (`gunbc.plans.demand_engine_program`): for a transparent body, demand is DERIVED (`DependencyDemand`, produced once by resolution). Authored restatement rows are deleted (USES-0, `docs/plans/uses-occurrence-census.md`). Binder, opaque-contract and policy rows move to their own carriers. Derivation does not yet name Network (`gunbc.rung_drop` `network_requirement_unrepresented_after_uses_cut`) |
-
-## One carrier per fact
-
-### Interface: carried on the operation's Arrow and on its input binders (ruled 2026-10-01)
-
-The first draft of this section put modifiers as edges on the operation node and defaults on the payload field. Neither is admitted by the substrate: `v2.std.node` `arrow_signature_edges_conform` counts every Arrow named edge other than the body and the declared order as the one type-binder edge, and a payload field is a bare name-to-type edge with no slot for a default. The side-chat ruling (option A) places them:
-
-1. **Effect and execution-mode claims are Arrow contract edges, kept apart.** `readonly` and `idempotent` are effect claims, checked against the derived effect shape by `std.effects` `check_modifier_vs_derivation`. They lower onto `^arrow_effect_claims_edge`. `hermetic` is a `std.execution_mode` claim and lowers onto `^arrow_execution_mode_claim_edge`. The surface `OperationModifier` stays one syntax vocabulary, and lowering projects each arm to its semantic home. Arrow conformance enumerates the legal labels and target shapes. Duplicates and unknown labels refuse. Contract edges are not binders, and canonical identity is order-independent.
-2. **A default belongs to the binder, not to its type.** One binder representation (a required type, an optional single default, closed labels, one reader and builder) is reused by fn parameters, service io fields and record fields. Because that changes the existing name-to-type binder shape, it is a replacement migration (DESIGN §3): every producer and reader moves, and the two shapes never coexist.
-
-Once these carriers exist, `InterfaceMemberUnmodeled` has no producer for modifiers or defaults. Wire keys move to the realization carrier (below), so that set-aside kind is deleted, not left empty.
-
-### Realization: a sibling node, never inside the interface
-
-Per DESIGN §3, transport is one of N handlers bound to the interface shape, and "the dispatch that selects a realization is itself realization". So the realization members lower into a **sibling** of the service, never into its interface.
-
-**Correction (PR3a, 2026-10-02).** The first draft said `transport` / `config` lower "onto the transport's existing config record" (`ShellTransportConfig`, `RestTransportConfig`, `FileTransportConfig`). They cannot. Those records are the host's runtime configuration (working directory and environment; base URL, credentials and TLS posture; base path). No operation authors them, and none carries what an operation does author: shell `argv` / `stdin`, rest `method` / `path` / `query` / `headers` / `body`, file `path` / `verb`. Lowering onto them would be a meaning fork. `PublishedMockCase` is a key with no body. The rulings (XL-2 manager, 2026-10-02):
-
-1. PR3 splits into 3a (model), 3b (lowering) and 3c (cut).
-2. Declared bindings live per kind in `extdeps.transports.<kind>`, and the runtime configs are not forked.
-3. Infer typing of exit, response and mock arms against the declared outputs comes later. In PR3, infer refuses at the sibling under its own owned cause.
-4. The sibling attaches by **MIRROR**.
-
-**MIRROR.** Each service emits, beside its interface:
-
-```
-<realization> -> <namespace body> { shell -> <namespace body> { Find -> LEAF } }
-LEAF  = Conj { Run -> ENTRY, ..., <realization-config> -> CONFIG? }
-ENTRY = Conj { <realization-transport> -> TRANSPORT, <status-arms> -> ARMS?, <mock-arms> -> ARMS?, <projection> -> ROWS? }
-```
-
-- **The mirror keys each entry by the operation's path, structurally.** That is the same path `v2.std.operation_argv` `OperationRef` names at run time, so no second identity is minted.
-- **Prefix segments reuse the spine's marked namespace bodies.** Services sharing a prefix therefore merge through the spine's one merge rule, with no new graft rule.
-- **The root is unspellable, so no source can name an entry.** `v2.compiler.symbol_index_fill` indexes nothing beneath it, so an entry is not a declaration and can neither collide with nor shadow its operation (ruling condition 1).
-- **Each operation has at most one entry, and an entry names a declared operation** (ruling condition 2, enforced by the wall). That an operation authoring realization facts has an entry is the lowering's obligation (3b).
-
-**3a grounding: what each vocabulary reuses rather than mints.**
-
-| Fact | Home | Reused or added |
-| --- | --- | --- |
-| transport kind | `std.fidelity` `TransportClass` (`ShellLocal`, `RestNetwork`, `FileBoundary`, `LocalDirect`) | reused; `local` has no declared binding and refuses as unmodeled |
-| response status code | `std.types` `HttpStatus` (100–599) | reused |
-| response status class (`5xx`) | `extdeps.ietf.http_semantics` `HttpStatusClass`, RFC 9110 §15 | added beside `HttpMethod`; the IETF fact, not the transport's |
-| exit status | an integer (`extdeps.process.posix_exit` rows); `extdeps.transports.shell_declared` `ShellExitPattern` = `ShellExitCode { code }` \| `ShellExitNonzero` | an exit status is never passed through an HTTP type |
-| shell `from` key | `extdeps.transports.shell_declared` `ShellOutputChannel` | completed: it had no consumer and lacked `exit_code` (135 rows); transcribed from the seed's `ShellResultChannel` / `shell_result_channel_of_key` |
-| file `from` key | `extdeps.transports.file_declared` `FileOutputChannel` | added; transcribed from the seed's `FileResultChannel` / `file_result_channel_of_key` |
-| rest `from` key | open (RFC 8259 member names) | no closed vocabulary |
-| declared binding fields | `ShellBindingField`, `RestBindingField`, `FileBindingField` in each kind's module | added; closed by the corpus, and an unknown field refuses |
-| HTTP method | `extdeps.ietf.http_semantics` `HttpMethod` | reused |
-
-**What the full route does with the sibling.**
-- **Resolution** resolves its references, which is what puts them in the census.
-- **Each stage that cannot yet consume the sibling** refuses at it under its own cause. The old blanket `service_realization_unreachable` therefore becomes per-stage located causes, and once no member is set aside, `ServiceSetAside` and both set-aside reasons are deleted (3c).
-
-**3b depends on an unrecorded language gap**, now `gunbc.recurring_failure_mode` `string_interpolation_read_as_literal_text_by_v2`. Most transport strings interpolate an input (`"{repository_path}"`), and v2 reads that as literal text. Until v2 lowers interpolation, 3b refuses each interpolating transport string, located.
-
-### `uses`: no carrier (ruled: follow D13), with a prerequisite
-
-A v2 carrier for the authored row would be a second authority for `DependencyDemand`, the fact D13 rules DERIVED for every transparent body. **But D13's derivation is not yet complete for Network.** `gunbc.rung_drop` `network_requirement_unrepresented_after_uses_cut` records that derived demand (`ItemInfo.service_names`) names the services a Network effect reaches and never Network itself, and that earlier deletions of `uses net: Network` rows were a silent rung loss. The D13 follow-up audit found that nearly every live row binds Network. So a Network row is **not yet a restatement**, and deleting it now would repeat that loss.
-
-Resolution of this half:
-
-- **The refusal stays.** `body_lower_fn_uses_refusal_optional` keeps refusing at the clause. Until the prerequisite lands, the authored clause is the only carrier of a Network requirement, so a fn carrying one stays out of the census rather than lowering without its requirement.
-- **Prerequisite (the rung drop's restoration trigger):** D13's `DependencyDemand` carrier derives each resource requirement keyed on the resource declaration's identity (`std.resources.Network`), so that the derived demand of every function authoring `uses net: Network` names Network.
-- **Then** the restatement rows are retired under D13's criterion, measured by resolution, not grep.
-- What could survive is a named dependency binder (a distinct subject), an opaque contract (no body) or a policy envelope. Each moves to its own carrier when one first appears. The live corpus has none, so none is designed here.
-
-## The smallest lowering change, member by member
-
-| Member | Lowers into | Refuses (located) when |
-| --- | --- | --- |
-| `readonly` / `idempotent` | `^arrow_effect_claims_edge` on the operation's Arrow | repeated on one operation |
-| `hermetic` | `^arrow_execution_mode_claim_edge` on the operation's Arrow | repeated on one operation |
-| io `= default` | the input field's binder default (2b) | the value reader refuses the expression |
-| io `from "key"` | projection row in `^service_realization_binding` | the key is not a string literal |
-| `transport` / `config` | transport config record in the sibling | the transport kind has no config record |
-| `exit` / `response` | output projection in the sibling | the value reader refuses the expression |
-| `mock_response` | `PublishedMockCase` row in the sibling | the case has no operation it can key on |
-| any other member | — | `body_lowering_reason_service_member_unread` (unchanged) |
-| `uses` entry | — (no carrier) | always: `body_lowering_reason_uses_clause_unmodeled` (unchanged) |
-
-## Rollout
-
-| PR | Content | Unblocks | Behaviour change |
-| --- | --- | --- | --- |
-| 1 (this) | this document; `uses_clause_has_no_carrier` trigger amended to D13; DESIGN CLI-section sentence amended (separate hunk) | — | none |
-| 2a | Arrow contract edges (`^arrow_effect_claims_edge`, `^arrow_execution_mode_claim_edge`) and their conformance in `v2.std.node`. **DESIGN §3c declared frontier** (see below) | — | substrate only |
-| 2b | the one binder representation with an optional default: a replacement migration of every binder producer and reader, measured first | — | yes |
-| 2c | lowering of modifiers and io defaults onto 2a and 2b; discriminating red per refusal row above | the 3 interface-only services | yes |
-| 3a | the realization sibling's model: per-kind declared-binding vocabularies, `HttpStatusClass`, the MIRROR shape and its conformance wall (`v2.compiler.service_realization`), and the symbol-index arm. **DESIGN §3c declared frontier** (trigger: 3b) | — | substrate only |
-| 3b | lowering of transport / config / exit / response / mock_response / `from` into the sibling; the wall runs on every lowered service | the realization-bearing services whose strings do not interpolate, up to the next stage's refusal | yes |
-| 3c | delete `ServiceSetAside` and both set-aside reasons; per-stage located causes for any stage that cannot yet consume the sibling | — | yes |
-| 4 | flip `service_interface_member_has_no_carrier` and the cause-ownership rows; re-measure the census on the CI population | — | ledger only |
-| `uses` (separate lane) | first the resource-keyed `DependencyDemand` carrier (the rung drop's restoration trigger); only then retire restatement rows by D13's criterion, measured by resolution | up to 30 modules, and none before the carrier lands | carrier, then source rows deleted |
-
-No model lands in PR 1.
-
-**2a is a DESIGN §3c declared frontier, not dangling.** In 2a, its consumers by execution are the conformance wall itself (`v2.std.node` `arrow_signature_edges_conform`, reached by every `well_formed` check of an Arrow) and the discriminating test that exercises it. Its *production* consumer is 2c: the operation-modifier lowering in `v2.compiler.body_lowering_fold` `body_lower_operation` emits the two edges, and the resolve, infer and translate readers gain their metadata arms in the same change. **Transition trigger:** 2c lands. If 2c is abandoned, the two edges and their conformance are deleted, not left standing. 2a lands ahead of 2c because the ruling asked for the substrate change to be reviewable on its own. That separation is the stated reason for the frontier. A model with no consumer in its own change is dangling by DESIGN §3c.
-
-**Caveat, stated so it is not read as a promise.** No service has ever reached resolve or infer on the full route. PR 3 will surface new downstream refusals, located at the sibling or the operation under the consuming stage's cause. The count of services that reach the census is therefore re-measured on the CI population after PR 3, not inferred from the grep above.
diff --git a/docs/plans/serving-front-door.md b/docs/plans/serving-front-door.md
deleted file mode 100644
index fe93742f634..00000000000
--- a/docs/plans/serving-front-door.md
+++ /dev/null
@@ -1,93 +0,0 @@
-# Serving front door: closing the second door onto the serving groups
-
-Item 3 of [dogfood-route-manual-interventions](dogfood-route-manual-interventions.md). The decision home is `gunbc.serving.serving_front_door`. The redemption chain's home is `product.capacity.redemption`, realized in `gunbc.fabric_event_log`.
-
-## What landed in this change
-
-- **The permit** (`ServingSeatPermitClaims`). It holds the claims a successful `gunbc.harness.harness_seat` `harness_bind_seat` already has:
-  - the group, the exact seat partition and the co-tenancy class;
-  - the structured seat reference (`HarnessSeatReference`: attempt = work identity, offer key = launch, stamp, round, head);
-  - the `product.capacity.lease` grant identity and fence generation;
-  - the caller principal and the lease term.
-- **The signed representation is injective.** `serving_seat_permit_signing_input` length-prefixes every field, including the protocol, which is taken from the claim itself. As a result:
-  - No content in one field can move a boundary into its neighbour.
-  - A protocol rewritten after signing fails the MAC join.
-  - Issuance refuses an unexpected protocol.
-  - The permit header's decoder (owed under Proposal A) must consume exactly this encoding.
-- **The ledger join is on the exact seat pool.** The door is configured with `HarnessSeatPoolIdentity` values minted by the seat authority (`harness_seat_pool_identity`: group, class, partition, ceiling, root). It then checks, against the ledger:
-  1. The permit's partition equals the pool partition for its class. A prefix match is not accepted, so `group-b-not-a-seat` refuses. The selected pool must belong to the door's own group, and two configured pools for one class refuse rather than one being chosen.
-  2. Exactly one acquisition of the reference exists, for exactly one seat.
-  3. That acquisition was made by the grant event the permit names.
-  4. The fence generation equals the acquisition's position in the chain.
-  5. The partition folds under the pool's own root and ceiling.
-  6. The seat has not been released.
-  7. The recorded actor equals the authenticated caller.
-  8. The recorded acquisition time plus the recorded term is still in the future.
-- **Admission is a transition, not a read** (`product.capacity.redemption`):
-  - **Redeem.** A seat moves `Unredeemed → InFlight { request, holder } → UseEnded`. The front door appends the redemption to the seat's redemption chain, beside its pool partition on the same fabric event log, by compare-and-set (`gunbc.fabric_event_log` `fabric_grant_redeem`). Only an admitted redemption forwards.
-  - **Concurrent and replayed admissions.** A second admission of the same permit, concurrent or replayed, re-reads `InFlight` and refuses (`permit-already-redeemed`).
-  - **Release while in flight.** Every seat release passes the redemption gate in `release_retry`, so a sender's release while a request is in flight refuses.
-  - **Stream end.** The door ends the use (`fabric_grant_use_end`, exactly once per request) and then releases.
-  - **Recovery.** A door that dies after redeeming leaves `InFlight` standing. The seat stays held and is charged to the redeemed request and proxy. It is ended only on *observed* quiescence (`front_door_recover`), never by a timer. Recovery releases only `UseEnded`; a seat that was never redeemed (`Unredeemed`) is left with its holder.
-- **Minting.** `gunbc.harness.harness_cli` `harness_place_for` mints the permit after the seat is bound and records the principal it acts for as the acquisition actor; it no longer takes a free-text actor. If no permit can be minted, the seat is released and placement fails.
-- **Counting.** `front_door_tally` keeps one count per refusal cause, plus the number of forwarded requests.
-- **Router contract.** `gunbc.serving.router_realization` gains the forbidden arm `ForwardWithoutPermit`.
-- **Witnesses** are in `test.claim.serving.serving_front_door_witness_test` (35 claims). They include:
-  - the RED-first case;
-  - each pool-join red (non-seat partition, another group's partition, class/partition mismatch, unserved class, zero amount, duplicate acquisition, wrong fence generation);
-  - a protocol rewrite;
-  - the ruling's outer-field collision;
-  - all five redemption controls: two concurrent admissions give exactly one forward; a replay refuses; a sender release while the stream is in flight does not free the seat; stream end permits exactly one release; controller death leaves recoverable, charged state.
-
-  Mutation runs disabled each new wall in turn, and its witnesses went red: the separator-joined signing input, the unsigned protocol, partition equality, the amount check, redemption ignoring state, and in-flight release.
-
-## Proposal A: the forwarding realization (NOT applied; needs bold-bee-114's go)
-
-**Constraint.** The interpreter is never on the token stream. Admission, which includes the redemption, runs **once per request**, and the body then streams without interpretation.
-
-**Shape.** Use an auth-subrequest. A stock reverse proxy listens on the public `:30000`. For each request it makes one subrequest to a decision endpoint, which evaluates `front_door_admit_on_store` with the request's identity and the proxy's identity. Only a 2xx response streams to vLLM on loopback. The stream's end, whether complete, client-aborted or upstream-failed, must reach `front_door_stream_end` exactly once for that request. If the proxy cannot guarantee that hook, the seat stays `InFlight` and is recovered only on observed quiescence.
-
-**Owed before Proposal A can be applied:**
-1. **A measured admission latency budget.** Measure p50 and p99 of the decision endpoint, which now includes one compare-and-set, against group-b's time-to-first-token.
-2. **The permit header wire form and its decoder.** It must decode exactly the length-prefixed signing encoding.
-3. **The stream-end hook and the quiescence observation** that `front_door_recover` consumes. One candidate is vLLM's per-request state, observed through `gunbc.serving.engine_progress`.
-4. **Tally persistence.**
-
-**Consumption.** Until Proposal A lands, `front_door_admit_on_store`, `front_door_stream_end`, `front_door_recover` and `front_door_access_decision` have no production caller. This is a declared frontier, and its trigger is Proposal A's go. The redemption gate in `release_retry` *is* consumed today, by every harness release.
-
-## Proposal B: the host change (NOT applied; needs bold-bee-114's go, because it takes group-b's traffic)
-
-On each serving group's head (group-b: 192.168.1.236):
-- vLLM binds to `127.0.0.1`.
-- The front door takes `0.0.0.0:30000`.
-- The permit key is materialized at `serving_seat_permit_key_path`, readable only by the door and the placement authority.
-
-This is converged through the existing `gunbc.spark` serving deployment authority. The door and the loopback rebind move in one step.
-
-**Owed population before Proposal B (rollout correction from the ruling).** Only `harness_place_cli` mints a permit today. The probe, worker, reviewer, auditor and supervisor paths in `gunbc.harness.harness_cli` acquire a seat and then call `harness_run_turn` with the URL, ignoring the seat record. Their acquisition actors are free-text role identities (`worker:<worktree>`), not the authenticated principal the door requires. Moving vLLM to loopback before they change would refuse the factory's own harness traffic. Each of these paths must do one of two things:
-- **(a)** Mint and present a permit under a principal the door authenticates, record that principal as the actor, and end its use at the door.
-- **(b)** Use an explicitly modeled internal route that a bypasser cannot reach.
-
-Choosing between them is part of Proposal B's go.
-
-## Credential: the permit key
-
-- **Key id:** `serving-seat-permit-2026-10` (HMAC-SHA-256). With HMAC, the verifying key is also the issuing key, so custody is the boundary.
-- **The ledger and the redemption chain are the authority; the MAC only protects the claims.** A holder of the real key cannot forward by minting:
-  - A permit for a seat that does not exist, sits in another pool, belongs to another caller or another launch, claims another fence generation or stretches its own expiry is refused on what placement recorded.
-  - A permit for a seat it does hold forwards at most one request at a time.
-- **What the caller check can tell apart today.** There is one service principal (`principal:gunbc/workflows/fabric`). So the check separates humans from the service, but not one service sender from another. Per-sender principals are credential issuance, which belongs to the managed-identity row (#13068), and this change does not fork it.
-- **Issuance, rotation and revocation drill** are owned by `credential-lifecycle-revocation` (gunb-ai/gunbc#13068). This key is registered there as a member that row must cover.
-
-## Migration note: what the existing senders must change (stays manual)
-
-- **ctrl dashboard router.**
-  - Delete its load score and its host selection.
-  - Per request, call `harness_place_cli` and present the permit, in the header form fixed under Proposal A item 2.
-  - Do **not** release a seat that the door has redeemed. The door releases at stream end, and a sender release refuses while the request is in flight. A seat that was placed but never forwarded is still released with `harness_release_cli`.
-  - Authenticate as Fabric service evidence.
-- **ac-dialogue batch.**
-  - Stop POSTing raw requests.
-  - Take one seat per in-flight request and present that seat's permit.
-  - A batch wanting N concurrent requests holds N seats. A permit is redeemable once, so one permit cannot carry two requests.
-- **Which identities may request grants.** This stays an operator decision at placement.
diff --git a/docs/plans/shared-pool-byte-correction.md b/docs/plans/shared-pool-byte-correction.md
deleted file mode 100644
index 50acad00c97..00000000000
--- a/docs/plans/shared-pool-byte-correction.md
+++ /dev/null
@@ -1,151 +0,0 @@
-# The shared-pool byte correction (owner directive 2026-09-26)
-
-Amends docs/plans/moa-memory-modeling.md. The 738/1035 block result is
-coherent; the 125,010,432-byte result beside it was dimensionally wrong by
-~106× and is withdrawn (it becomes a RED control).
-
-## The defect
-
-The allocation-plan fold computed:
-
-```text
-per-seat bytes = Σ group.blocks_at_requested_length × group.page_size_bytes
-```
-
-But `spec.page_size_bytes` is the page represented by that cache-group
-specification — NOT the physical byte cost of taking one block ID from the
-shared pool. At the pinned revision vLLM derives a separate physical pool
-quantity (`_get_kv_cache_bytes_per_block`): for GLM-5.3-Flash the shared pool
-block size comes from the packed MLA and index pages; `num_blocks =
-available_memory // bytes_per_block`; the worker allocates one backing tensor
-of `bytes_per_block × num_blocks`, and cache groups OVERLAY that allocation —
-a block ID is owned by one group at a time. The check: 738/1035 blocks is
-71.30% of the pool; against TP3's 17.29 GiB arena that is ~12.33 GiB of
-block-equivalent capacity, not 0.116 GiB. The fold implied ~169 KB/block vs
-the ~17.1 MiB/block the arena and inventory imply.
-
-## The corrected model
-
-```text
-KvAllocatorCarve      — physical resident pool allocated at startup
-KvAdmissionDemand     — logical blocks required by the promised population
-```
-
-(Calling both "KV bytes" is what enabled the mistake.)
-
-The allocation plan must carry:
-
-```text
-allocator_blocks
-physical_pool_bytes_per_block
-allocated_pool_bytes
-```
-
-with the old per-group field renamed `group_spec_page_size_bytes` (and
-`group_blocks_per_max_request`) so it cannot be read as the shared pool block
-size. Conservation controls:
-
-```text
-allocated_pool_bytes == allocator_blocks × physical_pool_bytes_per_block
-allocated_pool_bytes <= every rank's admitted KV arena
-arena − allocated_pool_bytes < one physical pool block
-  (modulo block override, null-block reservation, profile rounding)
-
-request_blocks = Σ exact group blocks at requested length
-request_block_equivalent_bytes = request_blocks × physical_pool_bytes_per_block
-```
-
-The 125,010,432 result is a RED control: 738/1035 blocks cannot occupy <1%
-of the same pool.
-
-## The verdict structure
-
-The block wall is authoritative; the byte wall is a conservation CHECK on the
-pool's construction, not an independent capacity answer:
-
-```text
-PoolConstructionProved { physical_pool_block_bytes, allocator_blocks,
-                         allocated_pool_bytes, per-rank supply }
-RequestBlockCostProved { exact group roster, blocks_per_request }
-CacheAdmissionProved   { request_blocks <= usable_allocator_blocks }
-```
-
-`CacheFitProved` carries: limiting_rank, seats, length, blocks_per_seat,
-blocks_used, blocks_reserved, hard_ceiling. If bytes appear, they are named
-`block_equivalent_bytes` — never ordinary memory demand or physical headroom.
-
-## The cache frontier (block wall)
-
-| Seats | Blocks used | Blocks left | Reserve |
-|---:|---:|---:|---:|
-| 6 | 738 | 297 | 28.70% |
-| 7 | 861 | 174 | 16.81% |
-| 8 | 984 | 51 | 4.93% |
-| 9 | 1,107 | −72 | REFUSED |
-
-These are shares of the already-allocated block inventory, NOT additional
-process-memory allocations (vLLM allocates the whole pool at startup).
-
-## Reserve policy — hard ceiling ≠ guaranteed service
-
-```text
-CacheReservePolicy
-  = NoOperationalReserve
-  | ReserveBlocks { blocks }
-  | ReserveFullLengthSeats { seats }
-  | ReserveBasisPoints { basis_points }
-```
-
-Standings: hard cache ceiling 8; normal guaranteed seats selected by policy;
-burst/cache-only ceiling 8. First production policy candidate
-`ReserveFullLengthSeats { seats: 1 }` → **7 normal 262K seats**. Six remains
-the conservative restoration point (28.7% reserve). Eight is not advertised
-as normal guaranteed service until transient and SLO proofs support it.
-
-## Mixed-length service (beyond 8 sessions)
-
-The uniform "every seat may reach 262K" promise caps at 8. More ACTIVE
-sessions are possible when not every session reserves 262K:
-
-```text
-SeatClass { max_context_tokens, guaranteed_count }
-ServingCapacityIntent { guaranteed_classes, max_active_sequences,
-                        max_batched_tokens, cache_reserve_policy }
-```
-
-Admission prices the actual reservation population through the same
-allocation plan (fixed KDA per-sequence, length-growing MLA, pooled KPool,
-fixed tail, grouping/padding) — NO second seat calculator. Until a real
-request-admission boundary enforces the mixed budget, `max_num_seqs = N`
-exposes N slots that may ALL submit maximum-length requests, and the safe
-proof prices that maximum behavior.
-
-## Cache fit is still not the whole arm
-
-The bounded run established initialization + per-rank profiles + the plan; it
-did NOT execute six simultaneous 262K requests. Before promoting seven or
-eight: (1) pinned-source prefill derivation at the deployed revision;
-(2) profile-shape binding (a 6-seat activation/graph receipt does not prove
-an 8-seat profile); (3) a bounded falsification run at the derived worst
-legal prefill/decode shape; (4) service capacity/SLO evidence (throughput,
-latency, preemption, failure behavior). Final result shape:
-
-```text
-ServingCapacityPoint { workload_intent, cache_standing, prefill_standing,
-                       decode_standing, static_residency_standing,
-                       reserve_policy, slo_standing }
-```
-
-— a Pareto frontier, not one magic tuple.
-
-## Operational sequence (owner-set)
-
-1. Interrupt the byte-wall completion (done).
-2. Land the shared-pool byte correction + RED control.
-3. Recompute the exact cache frontier (6/7/8 by one fold).
-4. Close the 262K prefill obligation for six seats.
-5. Restore persistent serving at 262K × 6 with the planted-residue
-   convergence proof and exact readback.
-6. Evaluate 262K × 7 under one-full-seat reserve.
-7. Retain 262K × 8 as hard/burst ceiling until phase + SLO evidence.
-8. Add mixed-length token-weighted admission for stranded block capacity.
diff --git a/docs/plans/shell-dag-census-0a-brief.md b/docs/plans/shell-dag-census-0a-brief.md
deleted file mode 100644
index 52185585c32..00000000000
--- a/docs/plans/shell-dag-census-0a-brief.md
+++ /dev/null
@@ -1,694 +0,0 @@
-# SHELL-DAG-CENSUS-0A — dispatch brief (derived shell execution census)
-
-Status: dispatch brief for the next shell→dag cut. Authored 2026-08-20 against `4cec10f6`, corrected twice before dispatch (see "Corrections that produced this brief"). Not a design authority — the carriers it describes become the authority when they land.
-
-# Revised call
-
-The 0A contract changes in four material ways:
-
-1. **`36/1 at 4cec10f…` is a historical calibration receipt, not an oracle and not a permanent expected count.**
-2. **Every fact states its evidence grain.** Declared type, static reachability, interpreter semantics, and runtime observation are separate claims.
-3. **The argv representation-ambiguity repair is removed from scope.** #8549 already closed it at the seam.
-4. **Instrument validity includes formatting, subject identity, exact-token discrimination, and message integrity—not merely detector-logic mutations.**
-
-The dispatch precondition remains unmet. `main` is still `4cec10f66a3d84cbde631e20ca9feaa31457d88c`; #8652 remains open, #8653 is closed unmerged. Since your message, #8652’s body claims a clean two-generation fixed-point protocol was run, but its CI checkbox remains open and the repair is not on `main`. The prerequisite is unchanged: the merged `main` SHA itself must pass required regen, fixed point, and the full witnesses workflow. fileciteturn121file0L1-L7 fileciteturn114file0L4-L13 fileciteturn115file0L4-L13
-
-# The corrected historical calibration
-
-At the exact historical subject:
-
-```text
-subject SHA:
-4cec10f66a3d84cbde631e20ca9feaa31457d88c
-
-EmitArtifactThenThinRun occurrences:
-  1  variant declaration
- 36  production match arms across 14 modules
-  4  dag/test/claim occurrences
-----
- 41  total occurrences
-
-Production-arm body partition:
-  1  static shell-realizing route
- 35  no static shell route
-  0  unresolved/unknown
-```
-
-The sole static realizer is:
-
-```text
-gunbc.host_effect_realize.realize_converge_on_host
-  -> EmitArtifactThenThinRun
-  -> ExistingHostQuiescentReload
-  -> realize_converge_in_process
-  -> retained script execution
-```
-
-The number `36` must **not** be compiled into the detector as its expected current population. 0A must run the completed detector against a worktree pinned to that exact SHA and produce a dated calibration receipt, and separately run against its own branch head and publish the current population.
-
-A disagreement has this disposition:
-
-```text
-HistoricalCalibrationDisagrees {
-  historical_receipt
-  detector_result
-}
-```
-
-It is neither “the detector is wrong” nor “update the expected count”; it stops acceptance until the discrepancy is explained.
-
-The omitted Codex arm is now an explicit control. Its `EmitArtifactThenThinRun` branch returns `CodexSupervisedSessionApplyRefused`, but only a body read establishes that it performs no execution; the return variant’s name is not the evidence. fileciteturn120file0L2-L7
-
-# Evidence grain is part of every fact
-
-The prior brief used “reach” too loosely. Given the current refinement and coproduct construction gaps, 0A must not imply that a statically visible route is a successfully executable runtime route. Rename the central result from:
-
-```text
-MayReachShell
-```
-
-to:
-
-```text
-StaticShellRoute
-```
-
-and make the basis explicit.
-
-## Required grain vocabulary
-
-```dag
-type EvidenceGrain
-  = AuthoredSyntax
-  | DeclaredType
-  | StaticControlFlow
-  | StaticValueFlow
-  | InterpreterSemantics
-  | RuntimeObservation
-  | ConstructionGuarantee
-```
-
-A fact may cite more than one grain, but it may claim only what those grains establish.
-
-| Fact class | Evidence grain | What it may claim | What it must not claim |
-|---|---|---|---|
-| File/declaration/body inventory | `AuthoredSyntax` | This body or arm exists at this SHA | It executes in production |
-| Declared argument or return type | `DeclaredType` | The author declared `List<String>`, `String`, etc. | The runtime `Value` has that representation |
-| Call edge | `StaticControlFlow` | The body contains or transitively selects this call | The call is dynamically reached |
-| Value origin/path | `StaticValueFlow` | This authored expression can feed this parameter or channel | The runtime value satisfies its refinement or coproduct shape |
-| Shell-sink meaning | `InterpreterSemantics` | This operation/channel interprets bytes as a shell program when evaluated successfully | A valid carrier necessarily reaches the interpreter |
-| Shell route | `StaticControlFlow + StaticValueFlow + InterpreterSemantics` | An authored path can attempt shell interpretation | A shell process was spawned |
-| Runtime carrier shape | `RuntimeObservation` or `ConstructionGuarantee` | The observed/guaranteed runtime representation is this shape | Anything inferred solely from the declared type |
-| Runtime process execution | `RuntimeObservation` | This process actually executed with these channels | Whole-corpus coverage |
-| Final migration disposition | Reviewed classification in 0B | This static route belongs to runtime, foreign, bootstrap, or pending work | Completeness of the derived population |
-
-## Consequence for the detector
-
-The detector must not prune a route because:
-
-```text
-the declaration says List<String>
-the declaration says NonEmptyStr
-the declaration says a particular coproduct
-a refinement should hold
-an arm appears unconstructible from the declared type
-```
-
-At 0A grain, every syntactically authored branch remains part of the control-flow population unless a stronger construction wall is separately cited.
-
-The detector may report both:
-
-```dag
-type DeclaredCarrierShapeFact {
-  occurrence: OccurrenceId
-  declared_type: String
-  basis: DeclaredType
-}
-
-type RuntimeCarrierShapeReading
-  = RuntimeShapeUnobserved
-  | RuntimeShapeObserved {
-      shape: RuntimeValueShape
-      receipt: DeclarationRef
-    }
-  | RuntimeShapeGuaranteed {
-      shape: RuntimeValueShape
-      wall: DeclarationRef
-    }
-```
-
-Most 0A rows should carry:
-
-```text
-runtime_shape = RuntimeShapeUnobserved
-```
-
-That is not a defect in 0A; it is an honest statement of its static grain.
-
-The sharp-ant `258 operations / five declared argv shapes` measurement may be retained as a **declared-type side receipt**, but it is not an 0A acceptance condition and cannot establish that a runtime `Value` is a list, string, or `ProcessArgvExpansion`.
-
-# Class 1 is struck completely
-
-The reissued brief must contain no work item to repair `push_shell_argv_tokens`’ former list-versus-concatenated-string ambiguity.
-
-#8549 already made that position refuse with a typed, located diagnostic when the same free monoid admits both readings, preserving native list expansion, codepoint-monoid decoding, and the explicit `ProcessArgvExpansion` route. A completed prerequisite, not remaining SHELL-DAG work. fileciteturn119file0L4-L14
-
-For 0A, direct argv execution is simply a negative discrimination control:
-
-```text
-shell.Exec.RunArgv
-    -> direct process carrier
-    -> NOT a POSIX/Bash program sink
-```
-
-A malformed or unexpected runtime representation may cause a refusal; it does not turn direct process execution into shell interpretation.
-
-# Instrument robustness contract
-
-The five failures you identified become five independent controls — not one generic “bad grep” class, because each has a different remedy.
-
-| Failure observed | Required 0A control |
-|---|---|
-| Too narrow to contain the answer | Recursive full-body traversal fixture with the real sink more than ten nested nodes below the arm root |
-| Pointed at the wrong subject | Subject identity carrier: exact commit, roots, inventory digest, and an anchor file that must occur in the selected corpus |
-| Format-induced false zero | Surface-format invariance pair plus a nonzero control partition in the same run |
-| Over-broad token false positive | Exact parsed identity control: `words` must not match `keywords` |
-| Messenger altered the result | Structured receipt file with content digest and read-back; no count transmitted through shell interpolation or hand-transcribed prose |
-
-## 1. No source-text grep as the authority
-
-The production detector must consume parsed bodies or a typed body-fact projection.
-
-It must not classify routes using:
-
-```text
-grep
-regular expressions over source text
-line windows
-substring search
-file-name patterns
-variant-name patterns
-comment or prose matching
-```
-
-A text search may locate candidates during development; it may not produce the committed census.
-
-If current body projections cannot preserve callee identity, branch identity, and argument edges, the worker must stop and open a separate substrate projection increment, never fill the gap with a source-text approximation.
-
-## 2. Format-equivalence fixture
-
-Two fixture files should express the same semantic route with deliberately different formatting:
-
-```text
-fixture A:
-  ordinary one-line call and string layout
-
-fixture B:
-  calls split over lines
-  nested indentation
-  comments between syntax nodes
-  long strings using continuation/layout forms
-  arguments placed many lines below the callee
-```
-
-After normalizing fixture-specific path and occurrence identity, their derived facts must be equal:
-
-```text
-normalize(census(fixture_a))
-==
-normalize(census(fixture_b))
-```
-
-This is the direct control against the wrapped diagnostic-string false zero.
-
-## 3. Same-run dirty control
-
-Every production census invocation must also scan an isolated control partition containing exactly:
-
-```text
-1 known shell route
-1 direct-argv no-shell control
-1 substring near miss
-1 deeply nested route
-```
-
-The output remains partitioned:
-
-```text
-production_result
-control_result
-```
-
-A production result of zero is admitted only when the control partition reports its exact expected population in the **same process, with the same detector implementation and settings**.
-
-This encodes:
-
-> When a scan returns zero, the first hypothesis is the scan.
-
-## 4. Orthogonal observation
-
-At least one positive observation must not flow through the census fold.
-
-A suitable control is:
-
-```text
-directly parse one planted fixture
--> locate its exact callee node
--> locate the exact program-channel argument edge
--> assert both exist
-```
-
-This control may reuse the parser, but it must not call:
-
-```text
-shell_route_facts()
-shell_sink_facts()
-shell_producer_facts()
-```
-
-or their shared selection predicate.
-
-The historical `36/1` audit is a second, human-produced orthogonal calibration. Its earlier `24` error shows why it cannot be the authority; the corrected measurement remains useful as an independent comparison.
-
-## 5. Exact identity, never token substrings
-
-All operation, function, variant, and field matching must use parsed declaration or symbol identity.
-
-The fixture matrix must include:
-
-```text
-words       -> intended exact symbol hit
-keywords    -> no hit
-swordsmith  -> no hit
-```
-
-Likewise, `Run` must not match `RunArgv`, and `ShellCommand` in prose must not match a `ShellCommand` constructor.
-
-## 6. Receipt integrity
-
-The detector should emit a structured artifact, for example:
-
-```text
-target/shell-dag-census/<subject-sha>/facts.tsv
-target/shell-dag-census/<subject-sha>/summary.json
-```
-
-The summary must carry:
-
-```text
-subject commit
-source roots
-source inventory digest
-detector declaration or binary identity
-schema version
-files attempted
-files parsed
-parse refusals
-declarations
-bodies
-match arms
-sink occurrences
-static routes
-unknown routes
-facts artifact digest
-```
-
-A witness must read the artifact back and prove:
-
-```text
-reported row count == parsed artifact row count
-reported digest == content digest of artifact
-reported subject == requested subject
-```
-
-The PR body may quote that artifact but must not be the result's only home.
-
-No command may place report text containing backticks, dollar signs, braces, or shell metacharacters inside an interpolated shell string. The artifact path—not its content—is the handoff.
-
-# Revised result types
-
-```dag
-type StaticShellReachability
-  = NoStaticShellRoute
-  | StaticShellRoute {
-      route: ShellRouteFact
-    }
-  | StaticShellRouteUnknown {
-      cause: ShellCensusRefusal
-    }
-
-type ShellRouteFact {
-  root_consumer: DeclarationRef
-  owner: DeclarationRef
-  arm: BodyArmIdentity?
-  sink: ShellSinkFact
-  call_path: List<DeclarationRef>
-  branch_path: List<BodyBranchFact>
-  source: ShellProgramSourceReading
-  declared_carrier: DeclaredCarrierShapeFact?
-  runtime_carrier: RuntimeCarrierShapeReading
-  basis: List<EvidenceGrain>
-}
-
-type ShellSinkFact {
-  owner: DeclarationRef
-  occurrence: OccurrenceId
-  language: ShellLanguage
-  channel: ShellProgramChannel
-  interpreter_path: List<InterpreterStep>
-  basis: List<EvidenceGrain>
-}
-
-type ShellProgramSourceReading
-  = RawLiteralSource
-  | StaticStringCompositionSource {
-      producers: List<DeclarationRef>
-    }
-  | GrammarEmittedSource {
-      emitter: DeclarationRef
-    }
-  | MaterializedFileSource {
-      writers: List<DeclarationRef>
-      path_identity: FilePathIdentity
-    }
-  | ExternalSource
-  | MixedSource {
-      parts: List<ShellProgramSourceReading>
-    }
-  | SourceUnknown {
-      cause: ShellCensusRefusal
-    }
-```
-
-The names make the ceiling visible:
-
-```text
-StaticShellRoute
-```
-
-does not claim:
-
-```text
-RuntimeShellExecuted
-```
-
-A later wet receipt may add:
-
-```dag
-type RuntimeShellExecutionReading
-  = RuntimeShellExecutionUnobserved
-  | RuntimeShellExecutionObserved {
-      route_key: ShellRouteKey
-      receipt: DeclarationRef
-    }
-```
-
-That is not required to complete 0A.
-
-# Reissued dispatch brief
-
-> ## SHELL-DAG-CENSUS-0A — derive static shell-program routes from parsed bodies
->
-> **Precondition**
->
-> Do not branch until #8652 is merged and the resulting exact `main` SHA passes:
->
-> ```text
-> claim_executor --required-regen
-> claim_executor --required-regen-fixed-point
-> full witnesses workflow
-> ```
->
-> A branch-local claim or first-generation result is not sufficient. Record the exact first green `main` SHA as the census subject.
->
-> **Goal**
->
-> Derive, from parsed `.dag` bodies, every authored path that can attempt POSIX/Bash program interpretation. The population must be derived from the corpus and interpreter semantics, never from remembered bridge names, filenames, imports, variant names, refusal types, line windows, or source-text grep.
->
-> This is a **static may-route census**, not a runtime-execution guarantee.
->
-> **Required evidence grain**
->
-> Every fact carries one or more of:
->
-> ```text
-> AuthoredSyntax
-> DeclaredType
-> StaticControlFlow
-> StaticValueFlow
-> InterpreterSemantics
-> RuntimeObservation
-> ConstructionGuarantee
-> ```
->
-> A declared type may be recorded, but no runtime representation may be inferred from it. Do not prune routes using refinements, declared coproduct shape, or expected interpreter representation.
->
-> **Required corpus partitions**
->
-> Scan all authored `.dag` files under the declared production roots. Scan tests and fixtures too, but report them in separate partitions:
->
-> ```text
-> Production
-> Test
-> Fixture
-> ```
->
-> No file may disappear through exclusion. Each attempted file becomes either:
->
-> ```text
-> Parsed
-> ParseRefused { path, cause }
-> ```
->
-> **Required body population**
->
-> Enumerate:
->
-> ```text
-> fn bodies
-> func bodies
-> service operation bodies
-> data initializers that feed executable plans or function values
-> every nested if/match/loop/closure body
-> every match arm at occurrence identity
-> every direct call and service invocation
-> ```
->
-> A later realizing sub-arm makes the containing arm `StaticShellRoute` even when an earlier sibling or first branch refuses.
->
-> **Required shell channels**
->
-> Recognize shell interpretation through:
->
-> ```text
-> TransportScript/direct script arguments
-> sh or bash -c command arguments
-> sh or bash -s standard-input programs
-> wrapped forms such as sudo -S sh -s
-> remote command strings with modeled shell interpretation
-> materialized script files later executed
-> GitHub Actions run bodies
-> cron command bodies
-> git-hook programs
-> grammar-emitted Bash artifacts
-> ```
->
-> The semantic seed may identify what interprets bytes as shell. It may not enumerate current call sites.
->
-> **Required value flow**
->
-> Trace program values backward through:
->
-> ```text
-> bindings
-> parameters and returns
-> record fields and variant payloads
-> list/fold/map constructions
-> concat/join/interpolation
-> renderer calls
-> file write/read joins where identity is structural
-> transitive helper calls
-> recursive call-graph fixed points
-> ```
->
-> An unresolved relevant call or unjoinable file flow becomes `StaticShellRouteUnknown`, never `NoStaticShellRoute`.
->
-> **Required body law**
->
-> Return shape, variant name, reason-field name, comments, and prose are irrelevant.
->
-> The result is decided only from transitive body behavior:
->
-> ```text
-> NoStaticShellRoute
-> StaticShellRoute
-> StaticShellRouteUnknown
-> ```
->
-> Explicit controls must cover:
->
-> - a refusal represented as a success-valued record;
-> - a refusal represented as `HostnameSetCasApplyFailed { stderr: ... }`;
-> - `CodexSupervisedSessionApplyRefused` under `EmitArtifactThenThinRun`;
-> - a realizer behind an earlier refusing branch;
-> - a classifier returning `Bool` or a variant label with no execution.
->
-> **Historical calibration—not authority**
->
-> Run the finished detector against:
->
-> ```text
-> 4cec10f66a3d84cbde631e20ca9feaa31457d88c
-> ```
->
-> and publish a dated receipt reconciling:
->
-> ```text
-> 41 total EmitArtifactThenThinRun occurrences
->   1 declaration
->  36 production match arms across 14 modules
->   4 test occurrences
->
-> 36 production arms:
->   1 StaticShellRoute
->  35 NoStaticShellRoute
->   0 StaticShellRouteUnknown
-> ```
->
-> This measurement must not become a permanent hard-coded count. A disagreement blocks acceptance for investigation; it does not automatically indict the detector.
->
-> **Required live discoveries**
->
-> Without using their names as seeds, the detector must find:
->
-> - the one historical converge realizer above;
-> - all four `spark_managed_access_apply` script producers flowing through `stdin_payload` to `sudo -S sh -s`;
-> - every remaining `retained_*` route;
-> - direct `RunArgv` routes as no-shell controls;
-> - the Codex and hostname refusal disguises as no-shell arms.
->
-> **Instrument controls**
->
-> The same production implementation must pass:
->
-> 1. **Deep-body control:** the sink sits more than ten nested nodes below the matched arm.
-> 2. **Subject control:** output carries exact SHA, root set, inventory digest, and reaches a planted anchor under every intended root.
-> 3. **Format-invariance control:** semantically identical, differently formatted fixtures produce equivalent facts.
-> 4. **Exact-identity control:** `words` matches; `keywords` and other substring near misses do not.
-> 5. **Messenger-integrity control:** structured output round-trips with row count and digest unchanged.
-> 6. **Orthogonal anchor:** a direct parsed-node assertion sees one planted sink without invoking the census fold.
-> 7. **Same-run dirty control:** the control partition reports its exact nonzero population in every production census invocation.
->
-> A zero production count is inadmissible unless all seven hold in the same subject run.
->
-> **Class 1 status**
->
-> Do not modify `push_shell_argv_tokens` for the former free-monoid list/string ambiguity. #8549 already made that ambiguity a typed located refusal. Preserve it and use direct argv as a negative shell control.
->
-> **Deliverables**
->
-> ```text
-> typed sink, route, producer, arm, evidence-grain, and refusal carriers
-> corpus-derived producer
-> deterministic structured facts artifact
-> deterministic summary artifact
-> historical 4cec10f calibration receipt
-> current-head receipt
-> fixture and mutation-control suite
-> reconciliation predicates
-> ```
->
-> **Non-goals**
->
-> ```text
-> no shell migration
-> no bridge deletion
-> no route disposition table
-> no runtime-value guarantee from declared types
-> no CLI-AUTHORITY tool/argv census
-> no srv* survival decision
-> no build-cache wiring decision
-> no stage0 mirror edit
-> no grep-generated production population
-> ```
->
-> **Stop condition**
->
-> If the available parsed-body facts cannot preserve exact callee identity, argument edges, branch identity, or interprocedural value flow, stop. File the missing typed projection as a separate substrate increment. Do not substitute text scanning.
->
-> **Merge bar**
->
-> ```text
-> exact-base main green before branch
-> zero production parse refusals
-> zero unexplained StaticShellRouteUnknown rows
-> all corpus/count reconciliation laws hold
-> all instrument controls discriminate under mutation
-> historical 36/1 calibration reconciled or discrepancy explained
-> current-head receipt published
-> facts artifact deterministic on repeat
-> receipt row count and digest round-trip
-> full CI green
-> ```
-
-# Trust predicate
-
-The 0A result should expose a single predicate with no runtime overclaim:
-
-```text
-static_shell_census_trusted =
-    subject_identity_holds
-    && corpus_denominator_nonvacuous
-    && production_parse_refusals == 0
-    && unexplained_static_route_unknowns == 0
-    && control_partition_matches
-    && deep_body_control_holds
-    && format_invariance_holds
-    && exact_identity_control_holds
-    && orthogonal_anchor_holds
-    && messenger_integrity_holds
-    && route_sink_producer_arm_reconciliation_holds
-    && repeated_run_digest_equal
-```
-
-It should **not** be named:
-
-```text
-shell_execution_guaranteed
-shell_runtime_population_complete
-shell_migration_complete
-```
-
-The strongest honest conclusion from 0A is:
-
-> At this exact source subject, the parsed authored corpus contains this complete, non-vacuously derived population of static paths capable of attempting shell interpretation; every row states whether its carrier shape is merely declared, statically flowed, construction-guaranteed, or runtime-observed.
-
----
-
-## Corrections that produced this brief
-
-Recorded because each falsified an input the brief had already been written against, and a reader who finds only the final text would re-derive them.
-
-1. **The acceptance oracle was wrong.** An earlier revision required the detector to reconcile against a manual 24-arm `EmitArtifactThenThinRun` audit. Measuring that audit in order to pin it falsified it: at `4cec10f66a3d84cbde631e20ca9feaa31457d88c` the tree carries 41 occurrences — 1 variant declaration, **36 production match arms across 14 modules**, 4 under `dag/test/claim/`. Neither manual audit reached 36, and neither named `gunbc.host_effect_codex_supervised_turn`. The conclusion was unaffected — exactly one arm realizes — but with 24 pinned as the oracle, the first *correct* detector would have reported 36 and the reconciliation step would have read as a detector bug. Hence `HistoricalCalibrationDisagrees` stops acceptance for investigation rather than indicting either side.
-
-2. **Declared types constrain less than the brief assumed.** The argv reachability probe found 258 shell-transport operations whose argv elements resolve to five shapes, none typed `Map`, `Set`, `Record` or nullable. That is a *declared-type* result, and declared types are not construction-enforced here: 3939 `WhereRefinementUnenforced` across 612 files, and separately any coproduct in this tree can be constructed by naming the type with no variant tag, refused only at runtime by the interpreter. Hence the `EvidenceGrain` vocabulary and the rule that the detector may not prune a route because a declaration says `List<String>`.
-
-3. **A scoped repair was already closed.** The brief's original Class 1 item — the argv representation ambiguity — was closed on main before dispatch, by the lane about to be assigned it. It survives only as a negative control.
-
-4. **Prior art exists with the exact blind spot this census is built to avoid.** `v2.lens.effect_reach` classifies host-effect sinks and carries a `ShellExecRunSink` variant, but `sink_kind_for_callee` selects by name equality against a remembered callee-text list, everything else falling to `UnknownHostEffectSink`. It therefore cannot see `sh -c`, `sh -s` on stdin, or a `sudo -S sh -s` wrapper — the hole the hand census carried before `gunbc.spark.managed_access_apply` was found. Disposition: **supersede, not extend** — extending inherits its selection principle.
-
-## Where the instrument controls came from
-
-The seven controls are not theorized: each is a failure that occurred while producing this brief, and they are **not one class**:
-
-| control | the failure it encodes |
-| --- | --- |
-| deep-body | an instrument too narrow to contain the answer — a realizing sub-arm sat ten lines below anything the command could print |
-| subject | an instrument pointed at the wrong subject — a stale head, a mirror rather than its authority |
-| format-invariance | a **confident false zero**: a grep for a diagnostic string returned 0 on both refs while the author was looking at that sentence, because it wraps across a backslash continuation |
-| exact-identity | a **confident false positive**: a pattern containing `words` matched inside `keywords` and returned seven irrelevant maps |
-| messenger-integrity | the report of the previous item reached its recipient with the words deleted, because backticks inside a shell command were substituted away |
-| orthogonal anchor | every one of the above was caught only because an observation existed that did not come through the instrument |
-| same-run dirty partition | a zero is admissible only when something non-zero is proven visible in the same run |
-
-The generalization, and why a zero production count is inadmissible unless all seven hold: **when a scan returns zero, the first hypothesis is the scan.**
diff --git a/docs/plans/shell-dag-census-0a-projection-blocker.md b/docs/plans/shell-dag-census-0a-projection-blocker.md
deleted file mode 100644
index af5e5718136..00000000000
--- a/docs/plans/shell-dag-census-0a-projection-blocker.md
+++ /dev/null
@@ -1,369 +0,0 @@
-# SHELL-DAG-CENSUS-0A — projection blocker and derived shell-interpretation seed
-
-Status: finding. Produced under the stop condition in
-[shell-dag-census-0a-brief.md](shell-dag-census-0a-brief.md), which reads:
-
-> If the available parsed-body facts cannot preserve exact callee identity, argument edges,
-> branch identity, or interprocedural value flow, stop. File the missing typed projection as a
-> separate substrate increment. Do not substitute text scanning.
-
-Subject: `a6ca6882d18114b52532c0804dc89f97b441f493` (first `main` SHA satisfying the brief's
-precondition — #8652 merged, `witnesses` workflow SUCCESS on that exact SHA, run 32370279129).
-
-No detector was built; no text-scanning census was substituted. Below: (1) why the available
-fact surface cannot carry 0A, axis by axis, each with its remedy, and (2) the shell-interpretation
-seed derived from what actually interprets bytes as shell, needed under whichever remedy lands.
-
----
-
-## 1. The whole fact surface `.dag` can read
-
-`src/v1/stage0/src/coproduct_reflection.rs` exposes exactly three live-fact accessors:
-
-| accessor | item filter | `.dag` surface | payload |
-| --- | --- | --- | --- |
-| `eval_concept_decl_facts_live` | `ItemKind::TypeItem` | `v2.std.concept_index` `ConceptDecl` | `qualified_name`, `name`, `node` |
-| `eval_fn_arrow_decl_facts_live` | `ItemKind::FnItem \| ItemKind::FuncItem` | `v2.std.fn_index` `FnArrowDecl` | `qualified_name`, `name`, `output`, `params` |
-| `eval_data_init_decl_facts_live` | `ItemKind::DataItem` | `v2.std.data_index` `DataInitDecl` | `qualified_name`, `module`, `name`, `literal_fp` |
-
-That is the entire typed body-fact projection. `ItemKind::ServiceItem` exists in the seed's item
-vocabulary and has **no accessor**.
-
-The one prior art, `v2.lens.effect_reach`, reads that surface and carries a `ShellExecRunSink`
-variant — but `sink_kind_for_callee` decides by `string_eq` against a remembered callee-text list
-(`"Run"`, `"shell.Exec.Run"`, `"Exec.Run"`), everything else falling to `UnknownHostEffectSink`.
-The brief's disposition on it is *supersede, not extend*; the reason is in the table above, not
-in that function: the surface it reads cannot express the alternative.
-
-## 2. Six axes, six remedies
-
-### Axis 1 — service operations and transports are absent entirely
-
-The fact that decides what interprets bytes as shell lives in transport declarations:
-
-```dag
-service shell.Exec {
-  operation Run {
-    input { script: TransportScript }
-    transport shell { argv: ["bash", "-s"] stdin: script.body }
-  }
-}
-```
-
-`ItemKind::ServiceItem` has no accessor, so no `.dag` consumer can read the operation, the argv,
-or the stdin channel. The brief permits exactly one seed ("what INTERPRETS bytes as shell") and
-forbids the alternatives (a file list, a call-site roster, a variant-name list). In this tree the
-permitted seed is obtainable *only* from these declarations, so a census over the available
-surface cannot have a permitted seed at all.
-
-**Remedy:** a typed service/operation/transport declaration projection.
-
-### Axis 2 — `FnArrowDecl.output` is a wiring-liveness skeleton, not a body
-
-`marshal_stmt_sequence` folds statements right-to-left carrying a live-reference set back from
-the return, and grafts a `let b = rhs` **only** when `b` is referenced downstream by code that
-itself reaches the return. Its own comment states the intent: a parameter used only inside a dead
-`let` must be absent so it flags as a dead wire. Correct for wiring liveness; fatal here. A shell
-call whose result is bound and not consumed is **absent from the input**, so `NoStaticShellRoute`
-is returned for a body that contains a route.
-
-**Proven by execution, not by reading the marshal.** A fixture with two functions of identical
-shape — one binding the call and not using it, one returning it — folded through
-`fn_arrow_decl_facts_live`, atom identities collected from each `output`:
-
-```text
-fn fixture_dead_let_shell() -> String {
-  let unused_result = fixture_sink(program: "echo DEADLETMARKER")
-  "returned-without-using-unused_result"
-}
-fn fixture_live_named_args() -> String {
-  fixture_sink2(program: "echo LIVEMARKER", args: "echo ARGSMARKER")
-}
-
-DECL probe.fixture.fixture_dead_let_shell   ATOMS: (empty)
-DECL probe.fixture.fixture_live_named_args  ATOMS: fixture_sink2 | echo LIVEMARKER | echo ARGSMARKER
-```
-
-The dead-let arm yields **nothing** — callee identity and program literal both absent; the live
-arm yields both. Same construct, opposite verdict: the loss is the projection's, not the probe's.
-
-This is a structural false zero upstream of the detector. None of the brief's seven instrument
-controls can catch it: each is a control over the detector, and the loss has already happened in
-the detector's input.
-
-**Remedy:** a body projection whose fold is total over statements — effect positions retained
-independently of return reachability.
-
-### Axis 3 — no named-argument edges
-
-`marshal_generic` emits positional child edges plus string-literal atoms, and
-`hoist_call_arg_string_literal_edges` lifts literals from arbitrary depth up to the call node,
-discarding which argument they came from. Argument labels never appear. The brief requires "the
-exact program-channel argument edge", and §4 below shows why: in
-`["sh", "-c", "command -v \"$1\"", "sh", "{command}"]` the program is the *third* element and
-`{command}` is data, while in `["sh", "-c", "{command}"]` the same-named value *is* the program.
-Positionally-erased arguments cannot distinguish those.
-
-The same executed run shows it directly: `fixture_sink2(program: "echo LIVEMARKER", args: "echo
-ARGSMARKER")` projects to `fixture_sink2 | echo LIVEMARKER | echo ARGSMARKER` — three atoms in
-authored order with **no labels**. Nothing says which literal was `program:` and which `args:`;
-the ordering is an accident of authoring, not a carried fact.
-
-**Remedy:** argument edges labelled with the authored argument name, and positional index
-preserved, at each call.
-
-### Axis 4 — no arm or occurrence identity
-
-Match arms are undifferentiated positional children. Nothing in the surface can construct the
-brief's `BodyArmIdentity` or `OccurrenceId`. Beyond the missing field: the historical calibration
-is stated at arm grain (36 production arms across 14 modules, 1 realizing), so it is not
-reproducible against this surface at all — the detector could neither agree nor disagree with it.
-
-**Remedy:** stable occurrence identity on body nodes, and arm identity on match arms.
-
-### Axis 5 — callee is an authored lexeme, not a resolved identity
-
-Callee atoms, string literals, record-construction spellings and variant names all arrive as the
-same `atom_identity_node` kind. The brief's exact-identity control has two halves. The easy half
-passes: `words` and `keywords` are different atoms. The hard half fails: `"ShellCommand"` as a
-string literal and `ShellCommand` as a constructor are the same atom, so a prose or literal
-mention is indistinguishable from a use — the false-positive direction of the same control.
-
-**Remedy:** resolved declaration identity on callees, and a node-kind discriminator separating
-literal, callee, constructor and variant occurrences.
-
-### Axis 6 — the registry is the entry's import closure, not the corpus
-
-Measured, not read: a probe folding `fn_arrow_decl_facts_live()` under
-`--source-root dag --source-root src/v2` reported **1,698** fn/func declarations. The corpus
-declares **41,965**. The surface is the *entry's loaded-module closure* — about 4% of the tree,
-and its content is whatever that entry happened to import.
-
-This is a declared frontier, not a discovery. `v2.lens.affected_set.corpus_dependency_view`
-already guards it: `corpus_dependency_view_per_pr_substrate_ready` calls
-`fn_arrow_decl_substrate_is_whole_tree`, and when it is false
-`ensure_corpus_dependency_view_per_pr_substrate` routes to a host refusal reading
-`corpus_dependency_view per-PR execution refused ... (blocked-on-#6239)`. Fail-closed, correctly.
-A census over this surface inherits that refusal.
-
-It is fatal for 0A specifically because the brief's corpus requirement is a denominator claim —
-"Scan all authored `.dag` files under the declared production roots ... No file may disappear
-through exclusion" — and here files disappear through *non-import*, silently, with no per-file
-`ParseRefused` row to count them. That is DESIGN's empty-observation narrow: the population never
-loaded is indistinguishable from the population carrying no route.
-
-**Remedy:** a corpus-grain producer whose denominator is an enumerated file set, not an import
-closure.
-
-## 3. The worked proof — `gunbc.spark.managed_access_apply`
-
-The brief names four script producers reaching a host through `stdin_payload` behind
-`sudo -S sh -s`, and requires that a correct detector find them **without being told their
-names**. That chain proves the axes above are a capability gap, not an API preference: each hop
-is one of them.
-
-In `privileged_leg`:
-
-1. `portable_remote_words(raws: ["sudo", "-S", "sh", "-s"])` — the interpreter words are a list
-   literal in a **named argument** (axis 3).
-2. `match … { Present { value: words } => … }` — the words are bound by a **match-arm binder**
-   (axis 4; and the binder is not a fn parameter, so it is not even emitted as a
-   parameter-reference atom).
-3. `shape_fleet_ssh_exec(…, words: words)` then `ssh_session_exec_portable_words_with_stdin(client_args: …, stdin_payload: …)`
-   — interprocedural flow through **named arguments** into a **service operation** (axes 1, 3, 5).
-4. `ssh.Session.ExecPortableWordsWithStdin` declares `transport shell { argv: ["ssh", client_args] stdin: stdin_payload }`
-   — the shell program travels on the **transport stdin channel** (axis 1).
-
-No hop in that chain is visible to the available surface. A detector over it finds these four
-producers only by being told their names — the defect this cut exists to end.
-
-## 4. The derived shell-interpretation seed
-
-Whichever remedy lands, the census needs a vocabulary for what interprets bytes as shell, derived
-rather than remembered. The finding: the discriminator is **positional, not a program-name
-list**, and the shell-interpretation locus is **not only the `extdeps` declaration layer**.
-
-Corpus-wide (`dag/`, `src/v2/`) there are **262** `transport shell` declarations. The
-overwhelming majority are **direct execs** whose transport is merely *named* shell — `find`,
-`test`, `mv`, `chmod`, `uname`, `mktemp`, `systemctl`, `tmux`, `xorriso`, `jq`, `wc`, `whoami`,
-`true`. No byte of their argv is parsed as a shell program.
-
-**17** sites carry an argv literal whose word list names a shell interpreter, partitioned by
-*locus* — the load-bearing part:
-
-| locus | count | files |
-| --- | --- | --- |
-| `extdeps` `transport shell` declarations | 6 | `extdeps/shell/exec.dag` (2), `extdeps/shell.dag`, `extdeps/ssh/session.dag`, `extdeps/entropy/entropy.dag` (2) |
-| product **fn-body `ArgvCommand` record constructions** | 10 | `gunbc/fleet_probe_identity_observe.dag` (6), `gunbc/fleet_host_key_enrollment.dag` (4) |
-| test | 1 | `test/manual/command_runner_local_argv_receipt_test.dag` |
-
-The 10 product-body sites matter more than the 6 declarations: they are `ArgvCommand { argv:
-["sh", "-c", …] }` records built **inside fn bodies**, one with a *computed* program
-(`argv: ["sh", "-c", pin_cmd]` in `fleet_host_key_enrollment`). A projection covering only
-service declarations — axis 1 alone — would find the 6 and miss the 10, including the only
-computed-program site in the tree. Both the declaration seed and real bodies are required.
-
-Four structural rules fall out, none a name list:
-
-1. **The interpreter is at the program position, and some wrappers re-root that position — but
-   `--` does not tell you which.** 46 argv literals contain a `"--"` element. 41 are
-   `ssh`-prefixed, where `--` genuinely re-roots: the words after it are a fresh argv executed on
-   the far host, which is why `["ssh", "{host}", "bash", "-s"]` is a shell route and
-   `["sshpass", …, "--", "test", "-w", "{path}"]` is not. The other 5 are not one class:
-   `["systemd-run", "--unit={unit}", "--collect", "--", command_argv]` re-roots into a new program
-   (not a shell); `["cargo", "run", "-p", package, "--bin", bin, "--", args]` passes *arguments* to
-   an already-named program; `["git", "-C", "{repo}", "ls-files", "-u", "--", "{path}"]` is plain
-   POSIX end-of-options and re-roots nothing.
-
-   So `--` is overloaded three ways and no syntactic rule separates them. Which reading holds is a
-   fact about the *host program's* CLI contract — `ssh(1)`, `systemd-run(1)`, `cargo`, `git(1)` —
-   an `extdeps` citation duty (DESIGN §3), not something the census may infer from the token. The
-   census must consult a per-program re-root contract, and where none is modeled the honest answer
-   is `StaticShellRouteUnknown`. Treating `--` uniformly as "re-root" would read
-   `git ls-files -- {path}` as executing `{path}`; uniformly as "end of options" would miss every
-   remote route. This is the single place in the seed where a *new modeled authority* is owed
-   rather than a derivation.
-
-2. **The flag selects the channel.** `-c`/`-lc` puts the program in the *next argv element*; `-s`
-   puts it on **stdin**. These are different edges, and a census reading only argv misses every
-   `-s` route — including `shell.Exec.Run`, the tree's main script route.
-3. **A program-position value is not necessarily a program.** `shell.PosixCommand.Check` declares
-   `argv: ["sh", "-c", "command -v \"$1\"", "sh", "{command}"]`: the script is a *fixed literal*
-   owned by the declaration and the caller's value is bound to the shell's positional `$1`, so it
-   never enters the text parsed as shell. Reading `{command}` as a program source is a false
-   positive. Two of the `entropy.dag` routes are the same shape — fixed literal scripts with an
-   interpolated `head -c {count}` length. The discriminator is which argv slot a value occupies,
-   which is why axis 3 (argument edges) is not a nicety.
-4. **Some operations are undecidable at their declaration.** `ssh.Session.ExecPortableWords` and
-   `ExecPortableWordsWithStdin` declare `argv: ["ssh", client_args]` — the program position is
-   *inside* an opaque expansion. Whether they interpret shell depends entirely on what a caller
-   flows into `client_args`; the spark caller flows `["sudo", "-S", "sh", "-s"]` and makes it a
-   shell route. At the declaration these are `StaticShellRouteUnknown`, never
-   `NoStaticShellRoute`.
-
-Rule 4 is load-bearing for the increment: the seed alone is insufficient, and the census is
-necessarily *declaration seed joined with interprocedural value flow*. Neither half is optional,
-and the value-flow half is exactly what axes 2–5 remove.
-
-A fourth locus exists, named so it is not mistaken for absence: three test fixtures carry
-`service … transport shell { argv: [\"sh\", \"-lc\", \"{script}\"] }` inside **string
-literals** of `.dag` source (`pipeline_transport_emit_rest_shell_witness_test.dag`,
-`transport_script_wall_compile_red_test.dag`). Those are program text *about* shell transports,
-not declarations; they belong in the brief's Test partition, and are the exact false-positive
-shape axis 5 cannot discriminate.
-
-## 5. The full-fidelity route: measured, and it is a third outcome
-
-The full-fidelity route does exist in `.dag`: `v2.compiler.source_authority`
-`parse_dag_source_ast` takes a `Medium<String>` to `Outcome<DagSourceAst>` where
-`ParseTree = Node`, with `normalize`/`resolve` above it giving `ResolvedTree = Node`; and
-`Filesystem.List`/`Filesystem.Read` are callable from `.dag`
-(`v2.workflow.floor_discovery_producer` already walks scan dirs with both).
-
-But `parse_dag_source_ast` has **no consumer**. Its only two call sites are inside
-`canonical_dag_source_parse_print_law`, whose name occurs exactly once in the tree — its own
-definition. A parse/print law nothing executes: DESIGN §5's specification-without-execution
-class, in the compiler's own source authority. So "the route exists in `.dag`" was not evidence
-that it works, and it had to be measured. That specimen is worth a row wherever the
-enforcement-intent registry ends up, independent of this census.
-
-### Correctness: one named grammar class refuses a large fraction of the corpus
-
-Three arms in one run, the first a positive control so a refusal cannot be blamed on the harness:
-
-```text
-CONTROL_3LINE (the tree's own "module m / fn add" fixture)   => ACCEPTED
-REAL_SMALL    (dag/gunbc/bash_materialized_transport.dag)    => ACCEPTED
-REAL          (dag/extdeps/shell/exec.dag)                   => REJECTED
-                                                reason = parse_grammar_choice_overlap_residue
-```
-
-The route is real — it parses authored corpus source, not just fixtures — and its failure is a
-**located, typed refusal naming a specific grammar deficiency**, the fail-closed
-`ParseRefused { path, cause }` shape the brief anticipates.
-
-`extdeps/shell/exec.dag` is not a corner case. On a random 10-file sample of the real corpus:
-
-```text
-A  src/v2/std/constraint_satisfaction_predicate.dag
-R  dag/test/claim/filesystem_read_hermetic_witness.dag                    parse_grammar_choice_overlap_residue
-R  dag/test/claim/wet_hermetic_equivalence_witness_test.dag               parse_grammar_choice_overlap_residue
-R  src/v2/test/claim/.../cargo_fmt_dead_param_test.dag                    parse_grammar_choice_overlap_residue
-A  dag/test/fixture/sole_constructor_sealed/admitted_caller.dag
-A  dag/extdeps/transports/file.dag
-A  src/v2/workflow/host_discovered_owned_data_manifest.dag
-A  src/v2/lens/structural_similarity.dag
-R  src/v2/test/claim/round_trip/source_authority_contract_test.dag        parse_grammar_choice_overlap_residue
-A  dag/extdeps/cache/catalog_placement.dag
-
-6 accepted, 4 refused
-```
-
-The grouping is the finding, not the rate: **all four refusals, and the `shell/exec.dag` refusal,
-carry the same reason** — `parse_grammar_choice_overlap_residue`. One grammar deficiency with many
-victims, not scattered file-specific problems. That cuts both ways: the route is a single repair
-away from a much larger accepted population, and no census can run on it until that repair lands,
-because the brief's merge bar is *zero* production parse refusals and the refusal set includes the
-census's own seed file.
-
-### Affordability: measured, and it is the third outcome
-
-Correctness alone would send out a detector that cannot run, so accepts-or-refuses was the wrong
-frame. Three outcomes: refuses (substrate cut); accepts and is affordable at corpus grain
-(projection lands first, census rebases); and **accepts but is unaffordable at corpus grain**,
-which is neither. Measured on a random 40-file sample, ascending by size, one process per run:
-
-| files | source bytes | wall | exit |
-| --- | --- | --- | --- |
-| 1 | 372 | 63.1 s | returned `A` |
-| 10 | 5,332 | 67.5 s | returned 6 A / 4 R |
-| 40 | 388,527 | 187.3 s | **`EXIT=137` — OOM-killed after 34 files** |
-
-Two numbers fall out, pointing at different walls:
-
-- **Time is not the wall.** 63.1 s → 67.5 s for nine more files is ≈ **0.49 s marginal per file**
-  against ≈ **62.6 s fixed overhead** — paid to stand the whole corpus up before any question is
-  asked, which is itself the shape under discussion.
-- **Memory is the wall, and it is not about big files.** The kill came at file ~34 of 40 with only
-  **94 KB of source consumed**, on files of ~7.8 KB each — the 212 KB outlier sorts last and was
-  never reached. So ~94 KB of parsed source exhausted the runner's ≈1.6 GB budget. Whether that is
-  parse-tree retention, interpreter heap growth, or both is **not** established by this probe and
-  not claimed; what is established is that the process cannot hold the result of parsing 34 small
-  files, against a census subject of 3,733 files and 31.3 MiB.
-
-The census fold accumulated only a short result string, so the retention is not the probe's
-accumulator. A corpus-grain fold over this route does not fit in a process today.
-
-### The verdict: outcome 3, and DESIGN has already rejected this shape once
-
-Recorded because it converts a performance observation into a repository ruling. DESIGN §6's
-lens bullet records the deletion of the corpus-wide censuses in #8140 (2026-08-11) and states the
-defect in general terms: *"the unit of computation was the world, the unit of fact was one
-module's authorship, and the price was paid by every consumer that wanted a witness roster and
-nothing else."* Its declared next-rung trigger is the seed-side shape: an authorship fact
-*"belongs on the module's own declaration, checked at ingestion where the module is parsed
-anyway — one module's facts from one module's source — rather than reconstructed corpus-wide by a
-consumer that wanted something else."*
-
-That is axis 1's remedy with a precedent and a cost argument attached. A `ServiceItem` accessor
-plus a non-lossy body projection pays per module at the point the module is *already* being
-parsed; a corpus-wide parse fold re-parses the world on every run to answer a question about
-shell routes — 62.6 s of fixed world-acquisition before the first question, and an OOM before the
-34th file.
-
-The measurement lands on outcome 3: the corpus-parse route is the exact cost-shape defect this
-repository deleted machinery over, and it additionally fails the correctness axis today. **The
-recommended increment is therefore the ingestion-side projection, not a census-side fold**, and
-0A rebases onto it:
-
-1. a `ServiceItem` accessor carrying operations, transports, argv and stdin channels (axis 1);
-2. a non-lossy body projection — total over statements (axis 2), labelled argument edges (axis 3),
-   arm and occurrence identity (axis 4), resolved callee identity with a node-kind discriminator
-   (axis 5);
-3. a corpus-grain denominator that is an enumerated file set rather than an import closure
-   (axis 6).
-
-`parse_grammar_choice_overlap_residue` is worth filing separately whichever route wins: a single
-named grammar deficiency refusing a large fraction of authored source in the compiler's own
-parser, currently invisible because the only code path that would surface it —
-`canonical_dag_source_parse_print_law` — has no callers.
diff --git a/docs/plans/spark-fleet-hand-edit-gap-analysis.md b/docs/plans/spark-fleet-hand-edit-gap-analysis.md
deleted file mode 100644
index 3a9dea2a470..00000000000
--- a/docs/plans/spark-fleet-hand-edit-gap-analysis.md
+++ /dev/null
@@ -1,180 +0,0 @@
-# Spark fleet: hand-edited state with no modeled authority
-
-**Status 2026-09-02, corrected.** Every row below was established by reading the live
-hosts and comparing against the module named as its authority. The instrument for the
-desired side is `gunbc.spark.serving_unit_render spark_serving_desired_user_unit_text`;
-for the live side, the unit file and `/api/ps` on each host.
-
-## Correction, and it is the most important thing in this document
-
-**The first version of this analysis was measured against the wrong tree, and its two
-headline findings were false.** It was derived by running the renderer from a session
-branch based on `373b8d11`, and `main` had since advanced. Re-derived against
-`origin/main`:
-
-- **Context is NOT diverged.** `spark_serving_desired_context_length` is `1048576` on
-  main, matching the live hosts. The claimed `131072` was this branch's stale value; main's
-  own annotation records that exact number as the thing it replaced.
-- **`OLLAMA_NUM_PARALLEL` is NOT missing.** `extdeps.ollama.server_env` carries it as a
-  typed axis, `serving_desired` carries a `PositiveSlotCount` of 4, the renderer emits
-  `ollama_num_parallel_env_assignment`, and
-  `test.claim.spark.spark_serving_unit_render_witness_test` holds the renderer to it.
-
-So **the freeze recommendation that followed from those two rows is withdrawn.** On those
-axes a convergence run would not degrade the fleet; it would agree with it.
-
-The failure was mine and it is worth naming as its own class, because it is the exact
-defect this repository spends its review budget on: I ran a real instrument, got a real
-number, and read it as a fact about the fleet when it was a fact about **my branch**. A
-measurement is only as current as the tree it was taken from, and a session branch is not
-the authority. Re-derive against `origin/main` before reporting a divergence.
-
-## Why this document exists
-
-The fleet is being assembled by hand while the model that is supposed to own it is
-elsewhere. That is a legitimate way to move, but it has a specific failure mode worth
-stating up front, because it is already loaded and armed:
-
-**A convergence run today would degrade the fleet, silently and without failing.** The
-modeled desired unit differs from the live unit on both serving hosts in ways that all
-point the same direction — narrower context, no concurrency, a different model. Nothing
-in that path refuses; the unit rewrites, the service restarts, and it serves. The numbers
-every serving decision is currently reasoned from would be invalidated without a single
-error.
-
-So this is not a tidiness ledger. It is the list of things that must land before
-`gunbc.spark` convergence may be actuated against `srv5`/`srv6` again.
-
-## The divergences
-
-### 1. Context window — WITHDRAWN, see the correction above
-
-Main desires `1048576`, which is what the hosts serve. No divergence.
-
-### 2. Concurrency — WITHDRAWN, see the correction above
-
-Main models the slot count as a typed `PositiveSlotCount` of 4, renders it, and witnesses
-the rendering. No divergence.
-
-### 3. Served model — CLOSED
-
-`gunbc.spark.serving_desired` selected a gpt-oss build while both serving hosts ran
-DeepSeek-V4, and the two are not variants of one choice — different publisher, family,
-artifact and runtime footprint — so no evidence gathered against one answered for the
-other.
-
-`spark_serving_desired_manifest` now names the DeepSeek manifest, resolved through
-`gunbc.ollama_model_resolution` with the provenance arm that records it as locally
-materialized rather than upstream-published, and `gunbc.spark.serving_model_admission`
-requires an exact runtime version AND a manifest-identity match before a local artifact is
-admitted. The divergence INSIDE the model closed with it: the rendered `Description=` was a
-second, stale spelling of the model name and is now derived from
-`spark_serving_desired_model_ref` rather than authored beside it.
-
-What this did NOT close, and the reason the ordering below still starts here: the desired
-model is now correct, and reproducing that artifact from desired state remains impossible,
-which is carried as a declared §4b(3) rung drop rather than as silence.
-
-### 4. Residency: modeled and live both silent on `OLLAMA_KEEP_ALIVE`
-
-Neither the desired unit nor the live unit sets it, so a 94 GB model is evicted after the
-default idle period and the next request pays a full reload. Measured today: both `srv5`
-and `srv6` reported `none resident` minutes after serving a request. Any latency
-measurement that does not declare residency state is measuring two different things
-depending on when it ran.
-
-### 5. The second pair is entirely outside the model — AND IS NOT TWO SERVING HOSTS
-
-This section originally described the pair as two independent ollama serving hosts. That
-was the state when it was written and it is not the state now, and the difference is
-load-bearing rather than a refresh: `192.168.1.232` runs a **llama-server front door** on
-`:30000` whose weights live on `192.168.1.233` behind an `ggml-rpc-server` reached over the
-RoCE fabric. They are ONE serving unit split across two machines, not two of anything, and
-a roster that admits them as two serving cells would plan an 86.7 GB load onto the weights
-peer — which has roughly 16 GiB free and swap disabled, so the load is an OOM kill that
-takes the front door down with it.
-
-`gunbc.spark.serving_unit_observed` now carries that subject with the split as a
-constructor condition. The membership gap below is unchanged and is what remains open;
-what changed is what membership would have to mean.
-
-`spark-c2b1` (192.168.1.232) and `spark-ac79` (192.168.1.233) are provisioned, serving,
-and unknown to every authority that should own them:
-
-- no `SparkCellRoleAssignment` — `gunbc.spark.cell_role` knows only `srv5` and `srv6`
-- no fleet slot, so `gunbc.network_identity_subsumption` cannot bind them
-- their static DHCP reservations are refused by design by that same module, so they have
-  no modeled network identity even in principle
-- different service user (`briansrls`, not `gunbc-automation`)
-- different install root (`/usr/local/ollama`, not the install-paths authority's tree)
-- different unit name, and on `.232` not an ollama unit at all
-- `OLLAMA_KEEP_ALIVE=-1` on the ollama that `.233` still runs alongside its weights role,
-  which the modeled unit has no field for — and that ollama is itself the hazard in the
-  paragraph above, because it WILL accept a load the weights peer cannot survive
-
-The runtime itself is the one thing that IS aligned: the pinned `v0.32.9` arm64 asset was
-installed after verifying its SHA-256 against `extdeps.ollama.binary_release`, so the
-runtime materialization identity matches the first pair rather than drifting to `latest`.
-
-### 6. Credentials are hand-carried
-
-`gunbc.spark.credential_workflow` models a `spark-administrator-password` `SecretRef`
-resolving through `gunbc.auth.secret_ref_credential`, and its own note says wet entry
-points name attempt identity and host on argv and never plaintext passwords. The password
-in use today was passed in chat and now exists in at least two session transcripts. SSH
-keys were installed by hand on top of it.
-
-The modeled path exists and was bypassed. That is the §6 out-of-band actuation tell in its
-plainest form, and the credential should be rotated once the fleet is stable.
-
-### 7. ~~Runner configuration lives in the environment, and the identity model reads argv~~
-
-**CLOSED.** `gunbc.model.ollama_choice` no longer keys a realization on argv. The carrier
-is `ObservedOllamaLaunchConfiguration`, a closed projection of the two environment-backed
-causal axes — `server_default_context` and `serving_slots` — and
-`ExactRuntimeConfigurationIdentity` hashes the canonical wire those values render to
-through `ollama_context_length_env_assignment` and `ollama_num_parallel_env_assignment`.
-So the two runners this section said would collide now carry distinct identities.
-
-Three details of the closure are worth carrying forward, because they are not what this
-section asked for:
-
-- It was **replaced, not widened**. Argv was never the right subject; the authority for
-  what configures an Ollama server is `extdeps.ollama.server_env`, which already holds the
-  variables as typed axes.
-- The partition is **owned by the module, not supplied by the caller**. The predecessor
-  took a `varied_flags` list as an argument, which let any caller erase a causal axis from
-  the fixed mode and thereby authorize evidence transport across it.
-- Identity runs **typed values first, wire second** — the module never parses an observed
-  string, because a string-to-integer admission here would be a second numeric authority.
-
-The ruling this section asked for was given and is recorded at item 4 below.
-
-## What has to happen, in order
-
-1. ~~**Decide the served model in the model.**~~ CLOSED — see §3. The desired row names the
-   DeepSeek manifest and admission requires an identity match, not a name match.
-2. **Model residency.** `OLLAMA_KEEP_ALIVE` appears nowhere on main, so a 94 GB model
-   evicts on the default idle timer and every measurement silently depends on when it ran.
-3. **Admit the second pair** — cell roles, host identities, and whatever network identity
-   can be bound given that static reservations are refused by design. Admission must admit
-   ONE serving unit, not two serving cells; see §5.
-4. ~~**Widen the realization carrier to environment.**~~ CLOSED — see §7. The ruling was:
-   consume a runtime-owned closed projection of causal configuration, not the whole
-   process environment. `OLLAMA_CONTEXT_LENGTH` and `OLLAMA_NUM_PARALLEL` are
-   configuration; `OLLAMA_HOST` is deployment identity; `OLLAMA_MODELS` is
-   artifact-resolution provenance already subsumed once the artifact digest is joined.
-   It landed in #9897, and `ObservedOllamaLaunchConfiguration` carries exactly that
-   partition.
-5. **Route credentials through the modeled `SecretRef`** and rotate the current one.
-
-## The standing risk this document is really about
-
-After the correction, and after the served-model divergence closed, the remaining
-divergences are narrower still but they are the same class: residency, the second pair,
-and credentials are facts about the fleet that no authority owns. The danger is not that the model is wrong on
-those axes — it is that it is SILENT on them, so nothing refuses when they drift.
-
-The generalization worth keeping is the one the correction taught: a divergence report is
-a measurement, and a measurement is only as current as the tree it was taken from. This
-document was itself an instance of the failure it exists to catalogue.
diff --git a/docs/plans/srv1-sudoers-drift-observation.md b/docs/plans/srv1-sudoers-drift-observation.md
deleted file mode 100644
index 335c7ee0821..00000000000
--- a/docs/plans/srv1-sudoers-drift-observation.md
+++ /dev/null
@@ -1,86 +0,0 @@
-# srv1 sudoers drift — observation receipt (2026-09-07)
-
-Authority for the class: `gunbc.recurring_failure_mode.capability_arrives_outside_the_converged_path`,
-Specimen C. This file is the detail behind that row's specimen entry.
-
-**Why this file exists.** The observation was made on a live host while wiring the KVM applier that
-row calls for. If the host is converged, the observed state is gone — so the record has to outlive
-it. A chat message is not a record.
-
-**Handling constraint (operator ruling).** Grants are described by SHAPE — binary, run-as, whether an
-argument restriction is present — and never transcribed as copyable authorization lines. The point of
-this document is the *shape of the drift*, and a verbatim line would add nothing to that while making
-the file itself a liability.
-
-## What was observed
-
-On `srv1`, at the time of observation:
-
-- The **modeled** grant artifact for this host, `provisioning/srv1/gunbc-ghrunner.sudoers`, is
-  **absent from the host's sudoers directory**. It is not installed under any name.
-- An **untracked, hand-maintained file** stands in its place. It is not in this repository: no
-  authority row, no generator, no ignore rule, and no path that any modeled emission writes.
-- Its mtime was **the same day it was found**, so it is maintained, not vestigial. A backup file
-  beside it, dated some weeks earlier, lacks three of the grants present in the live file — so those
-  three were **added** in the interval.
-
-### The shape of the divergence
-
-| | modeled artifact | installed file |
-|---|---|---|
-| run-as | `root` | `ALL` |
-| argument restriction | **exact argv**, one line per permitted invocation | **none** — bare binary path |
-| population | per-path, per-unit, enumerated | seven binaries, unrestricted |
-
-Several of the seven binaries are ordinary root escalations when granted without argument
-restriction — this follows from each tool's own documented behaviour (editing the privileged
-configuration, altering account group membership, creating accounts, writing arbitrary
-root-owned files, running arbitrary units). **No escalation was attempted or tested.** The property
-is inherent to unrestricted-argument grants on those binaries and does not need demonstrating.
-
-The grantee is the account that **executes CI jobs** on this host. That is what makes this a live
-privilege boundary rather than only a provenance gap.
-
-## Why this blocked the work in flight
-
-The applier being wired runs one modeled argv — a supplementary-group grant for the KVM device.
-While an unrestricted grant for that binary stands, **that argv is admitted by the hole, not by the
-modeled line.** A success would therefore prove the over-broad grant works, not that convergence
-does: the instrument and the subject share a path. That is a corrupted instrument, not a deferred
-cleanup, which is why the work stopped here rather than proceeding and filing the finding.
-
-## The discriminator, fixed in advance
-
-**Stated in the authority row, not here.** The discriminating negative control, its positive
-control, and why neither alone is sufficient are carried by
-`gunbc.recurring_failure_mode.capability_arrives_outside_the_converged_path` — the row whose specimen
-this document details. It is written there because that is the carrier the class lives on, and
-restating it here would give one fact two independently editable homes.
-
-What this document adds is only the *occasion*: the discriminator was fixed **before** the evidence
-existed, because a post-convergence green is uninformative unless what would falsify it was named
-first.
-
-## A second, independent fact recorded at the same time
-
-Applying the group grant does **not** make the device usable by anything already running. The live
-runner listener process holds a fixed supplementary-group set that does not include the device group.
-`usermod -aG` edits the account database; it cannot alter the credentials of a running process. The
-executor acquires the group only in a **new session** — i.e. after the service restarts.
-
-This is why the reconciler models `applied, pending new session` as an outcome distinct from both
-`applied and now writable` and from failure. Collapsing them would report either a false success or a
-false failure; which one occurs is determined by re-observation, never assumed.
-
-## How to re-derive
-
-Read-only, from a shell on the host:
-
-- list the sudoers drop-in directory with a long listing (names, sizes, mtimes)
-- grep that directory for `NOPASSWD` to see each grant's run-as and whether an argument follows the
-  binary path
-- search the same directory for the modeled artifact's filename to confirm presence or absence
-- read the runner listener's `/proc/<pid>/status` `Groups:` line, and compare against the device
-  group's gid from `getent group`
-
-Nothing above modifies the host.
diff --git a/docs/plans/srv1-workspace-vm-bringup.md b/docs/plans/srv1-workspace-vm-bringup.md
new file mode 100644
index 00000000000..7b82f8de855
--- /dev/null
+++ b/docs/plans/srv1-workspace-vm-bringup.md
@@ -0,0 +1,585 @@
+# srv1 workspace VM bringup
+
+Scope: the operator-owned workspace on `srv1-13`, using the existing commissioning,
+allocation, controller and cleanup protocols. No customer create API, additional
+hosts, CI-runner migration, or automatic expiry scheduling is part of this change.
+
+Current status: the pinned image/controller, network receipt and slot resource
+boundary have passed live readback. srv1's running kernel cannot report attached
+TUN queues. Commissioning now models that capability dependency and derives a
+kernel installation/activation proposal in its existing convergence scope. Host
+maintenance actuation remains an explicit `AwaitingCapability` frontier; no kernel
+installation or reboot has been applied. No VM boot or authenticated guest SSH is
+yet proven. Guest access uses the dedicated key already on srv1.
+
+## Observed gaps
+
+The October 9, 2026 inspection found no successful workspace VM lifecycle receipt.
+The September 24 controller invocation `c0fceefc7d9643b0aaff0617907b1335`
+refused because it could not read the allocation store for `srv1-13`.
+[Run 36054790165](https://github.com/gunb-ai/gunbc/actions/runs/36054790165)
+collected that refusal; its green workflow conclusion is not a boot receipt.
+
+| Boundary | Observed state | Required change |
+| --- | --- | --- |
+| Deployment candidate | Compiler startup creates ignored `rung_drop/roster.dag`, which candidate admission rejects | Exclude that exact compiler-derived file alongside the existing failure-mode roster; preserve sibling and secret-file refusals |
+| Workflow dispatch | Main declares 28 inputs; GitHub accepts at most 25 | Keep printer selection separate and carry its five operation fields in one `printer_request` JSON input |
+| Guest image | Builder exists; no image delivery in controller install | Build under fakeroot, archive kernel/rootfs/digest receipt, pin the measured rootfs, verify installed bytes and custody |
+| Job selection | Controller install queues the shared credentialed job as well as its dedicated job | Derive shared job selection from the existing mode-to-job authority |
+| Network receipt | The historical TAP/firewall installation exists, but the controller receipt is absent and the workflow observer entry was overwritten | Restore the observer, publish a root-owned initial receipt from live reads, and keep later sanitation observation separate |
+| TAP IPv6 | Installed sysctl disables IPv6; networkd leaves it enabled on the live TAP | Disable networkd IPv6 autoconfiguration in the same generated TAP policy, then converge and read back |
+| Controller | Installed revision `cfb9ff80652fe0a74093f08cade64f59d9695266` | Install this PR through the existing controller installer |
+| Slot budget | `fabric-cell-srv1-13.slice` has no installed unit file | Converge the modeled execution-cell boundary; a synthesized systemd slice is not proof |
+| Cell inventory | Read-only plan `local-2026-10-09T03:18:35Z` refuses foreign `fabric-cell-zp444.slice` | Establish ownership before retiring it; the empty transient slice has no unit file or remaining journal, and is not silently ignored |
+| Commissioning | No commissioning or readiness record | Run reviewed commissioning plan/apply and verify its protected transaction |
+| Protected state service | Running revision `5b96cab749088aa5cec71ce9ad52e1857724d252` predates the authenticated state route | Converge fabric storage through its existing deployment path |
+| State-key custody | Key exists; operator can read it; `ghrunner` cannot | Preserve custody; exact installed helpers reconcile admitted intent and read the selected allocation |
+| SSH access | Guest enrollment reused the personal operator key and required gateway evidence even for a client on srv1 | Enroll a dedicated guest key on srv1; model host-local SSH explicitly and retain gateway proof for gateway clients |
+| Allocation dispatch | No workflow mode; release path came from an unrelated environment variable | Add `workspace_allocation_plan`, bind its installed release to the admitted run revision, reuse reviewed `apply` |
+| Operator lifecycle | Request producer exists; release/observation need CLI entries | Add generation-checked release and owner-scoped JSON receipts under operator authority |
+
+The historical refusal files are evidence. Do not delete them to manufacture an
+empty commissioning prestate. Do not restore the old CI reservation service:
+`srv1-13` is a workspace slot.
+
+## Operation
+
+1. Dispatch `fleet-converge`, `host=srv1`, `mode=workspace_image_build` at the
+   candidate revision. The `workspace-guest-image` artifact contains only the
+   kernel, rootfs and measured digest receipt. The filesystem build is not
+   reproducible: pin that build's measured digest in `workspace_artifact_policy`.
+2. Dispatch `microvm_controller_install` at the reviewed revision with
+   `workspace_image_run_id` naming that build. The run ID locates bytes; it does
+   not authorize them. The installer checks the reviewed kernel and rootfs pins
+   after copying into the root-owned release directory, then independently reads
+   back the image and installed executor.
+3. Converge the execution-cell boundary and authenticated state service. On srv1,
+   the local administrator can run `runner_microvm_network_plan_local_wet`,
+   review `target/microvm-network-local-plan.txt`, then run
+   `runner_microvm_network_apply_local_wet` from
+   `dag/gunbc/runner/runner_microvm_network_apply.dag`. Both require `host=srv1`,
+   `expected_revision` equal to the clean checkout's HEAD, and effective UID 0.
+   Run `runner_microvm_network_initialize_local_wet` from
+   `dag/gunbc/runner/runner_microvm_network_observe.dag` with those same arguments
+   to publish the controller receipt from live readback. This uses the installed
+   root-owned receipt directory and refuses replacement of a different generation.
+   These local entries require no SSH agent. Then run
+   `workspace_commissioning_plan` and its reviewed `apply` on srv1. The existing
+   operator-local fleet plan/apply path is available for pre-merge validation;
+   do not widen the main-only GCP login to run branch workflows.
+4. The installed operator enrollment uses a dedicated guest key whose private
+   file stays on srv1 at `/home/briansrls/.ssh/gunbc-workspace-srv1-13`, owned by
+   `briansrls` with mode `0600`. No agent forwarding is required. As the enrolled
+   operator on srv1, use `workspace_operator_request_wet` with
+   `GUNBC_WORKSPACE_REQUEST_KEY`, `GUNBC_WORKSPACE_REQUEST_PROFILE` and
+   `GUNBC_WORKSPACE_REQUEST_EXPIRES_AT`. Use a canonical UTC expiry within the
+   policy's one-hour lease. The owner and public key come from installed policy.
+5. Dispatch `workspace_allocation_plan` and review/apply its artifact. Observe
+   through `workspace_operator_observe_wet` with the same key. Each operator
+   command writes `target/workspace-operation.json`; a recorded request alone
+   is not evidence that the guest is usable.
+6. Authenticate SSH from srv1 using the allocation's connection data and verified
+   guest host key. The rendered command selects the dedicated identity file and
+   disables the agent and agent forwarding. Record the guest identity and a command
+   executed in the guest.
+7. Run `workspace_operator_release_wet` with the key and
+   `GUNBC_WORKSPACE_RELEASE_GENERATION` from `reservation.generation` in the
+   observation (not the owner-ledger generation). Reconcile with
+   another allocation plan/apply, and verify released state and absent guest.
+8. Request a second key, prove the same slot is reused with a new incarnation,
+   and let its short lease expire. Explicitly dispatch allocation plan/apply to
+   clean it up. No timer or scheduled expiry sweep is installed by this PR.
+
+Workflow jobs receive no state MAC key and no grant to create or release an
+operator request. Their installed helper can act only on already-admitted ledger
+intent. Apply re-reads the exact request and generation carried in the reviewed
+plan; it does not select the latest request again.
+
+## Acceptance evidence
+
+Keep the PR draft until all of the following have live receipts: image/controller
+readback, commissioned slot, ready allocation, authenticated SSH, explicit release,
+same-slot reuse with a new incarnation, expiry cleanup, and final released/ready
+state. Record run IDs, revisions, allocation IDs and generations here as they are
+observed. Never record private keys, tokens or signed state-request envelopes.
+
+The host-local SSH revision passes all 28 focused witnesses across access policy,
+owner enrollment, guest connection verification and allocation reconciliation.
+The full tree (8,268 source files) parses, and formatting checks pass. An independent
+`ssh -G` read on srv1 confirms the dedicated identity file, `IdentityAgent=none`,
+`IdentitiesOnly=yes` and `ForwardAgent=no`. This checks client selection; it is not
+a guest login receipt.
+
+Local validation of the preceding revision: 44 focused witnesses passed across allocation dispatch, lifecycle,
+launch directives, host offers, owner policy, gateway refresh, workflow dispatch and
+deployment candidate admission, including three deployment-readiness refusal controls and two cutover recovery/refusal controls. The generated compiler-pair build step was also executed with controlled compiler outcomes: both output streams were retained, and exit codes 0 and 37 were preserved. The image builder produced an ext4 image whose
+`/root` and `/usr/sbin/sshd` are owned by UID/GID 0. The fresh compiler parsed the
+full source tree, and full generated-artifact regeneration completed successfully.
+The combined workflow witness process needed a 24 GiB memory cap; its earlier
+16 GiB run was killed by the cgroup limit, then passed with the larger cap.
+
+[Image build 37878358778](https://github.com/gunb-ai/gunbc/actions/runs/37878358778)
+at revision `521085ab254290029f8dfbaa312a218f84a6be7b` built its compiler successfully,
+but packaging refused `BuildDiagnosticsMissing`: the compiler-pair build had not
+produced the log required by its pack. The build dispatch now uses the existing
+floor log-capture wrapper, preserving the compiler's exit status. [Retry 37882239644](https://github.com/gunb-ai/gunbc/actions/runs/37882239644)
+at revision `5504b52cd0001115afcfb47a98e98b16c44e199c` succeeded. The downloaded
+artifact's rootfs SHA-256 matches its receipt:
+`d15a55780a707ec832a09e3599306254b8d7c428ff25ff621b427b826eeb0b27`.
+That archived digest is now the reviewed image pin. The kernel matches
+`cb1291c66bca75bc11cb9c8357fcef9965bb1786dffcb42a60923c3e0e49f319`;
+independent ext4 inspection confirms `/root` and `/usr/sbin/sshd` belong to UID/GID 0.
+
+The operator identified `fabric-cell-zp444.slice` as a disposable test slice and
+authorized retirement. Immediately before stopping it, readback confirmed no unit
+file, drop-ins, child units or processes. Its unit and cgroup are now absent.
+Execution-cell plan `local-2026-10-09T03:37:32Z`, hash `76783579d393ed3d`,
+advanced generation 18 to 19. Apply `local-2026-10-09T03:47:17Z` completed
+`fully_applied`, receipt `34c5252f521bf5b3`. Independent systemd readback confirms
+active `fabric-cell-srv1-13.slice`, persistent limits of 28 GiB for MemoryMax and
+MemoryHigh, no swap, TasksMax 16384, and the modeled CPU settings. The cell and
+attempt directories have the modeled custody. Commissioning, allocation and VM
+boot remain unproven.
+
+The read-only deployment probe admitted clean candidate
+`19b12d88d6c0206c3f259cf85b0b664e65000b26` after the derived-roster repair. Its
+release-member plan is: install executable
+`sha256:5cbf98426843aebd1fad3c2f9cc52c6ba04ba6fbb71f6bbde1ea40eff8391543`,
+publish that source revision, write `gunbc-roadmap.service`, reload systemd and
+restart the roadmap service. The existing deployment additionally reinstalls its
+fabric-storage, approval-broker, tailnet-door and timer members, which do not yet
+have differential member identities. Consequently this prerequisite is a shared
+production deployment with service interruption, not a slot-only mutation.
+The operator approved this shared deployment, including temporary interruption.
+The first operator-local attempt installed the generated `ghrunner` sudoers but
+refused its exact `tailscale` grant probe under the operator account before other
+mutations. The operator's broad sudo grant does not satisfy this exact grant-list
+probe; the same probe admits the existing `ghrunner` grant. The retry uses the
+existing `live_deploy_apply_srv1_wet` entry as `ghrunner`, without expanding the
+operator grant roster. The failed attempt also exposed 720 unnecessary readiness
+waits after refusal. Readiness polling now requires a converged mutation; cutover
+recovery still runs so interrupted route changes can be rolled back.
+
+The dispatch transport repair preserves the printer's existing domain validation.
+Printer callers now supply `printer` and `printer_request`, for example
+`{"operation":"observe"}` or
+`{"operation":"print","project_path":"/absolute/project.3mf","project_sha256":"<reviewed digest>","credential_version":"<observed numeric version>","bed_clear":"true"}`.
+No printer action is performed by VM bringup.
+
+The approved deployment's tree sync and independent repository readback completed
+at revision `19b12d88d6c0206c3f259cf85b0b664e65000b26`. Dashboard, approval broker,
+tailnet door and fabric storage restarted between 04:11:48 and 04:12:04 UTC;
+dashboard readiness later passed through the existing HTTPS route. At 04:21 UTC the authenticated operator read returned `WorkspaceOperatorObserveRefused: request absent for operator`, proving the protected owner ledger is readable without creating an allocation. The preceding probe finished 19 seconds before the new storage listener opened and is not counted as acceptance.
+The nested deployment/readback interpreters peaked above the original 24 GiB
+scope bound, so that operation's cap was raised to 36 GiB with swap disabled.
+
+The operator selected SSH from srv1. A dedicated guest-only ED25519 key was
+created there, fingerprint `SHA256:sxhkzO98Tp3tSXi+nD2FJBfbRTnOYQn6QpuTlETnbQI`.
+Only its public key is enrolled in source. It is not authorized for fleet-host
+login or given to workflow jobs. Personal-agent forwarding was proposed earlier,
+then withdrawn; no forwarded personal agent was used. Host-local access and
+access through a gateway now have distinct policy and evidence types, so an
+observation on srv1 cannot assert gateway forwarding permission.
+
+The deployment installed its members but returned a cutover refusal: the existing
+`ghrunner` deployment entry cannot read the protected-state credential. Its final
+cutover gate therefore could not read the journal and performed no route effect.
+The dashboard's loopback `/healthz` independently reports revision `19b12d88d6c`;
+the existing tailnet root route still targets that loopback backend. The new
+parallel tailnet-door unit also failed binding `/opt/gunbc/tailnet-door.sock`:
+its service user cannot create entries in root-owned `/opt/gunbc`. These are
+shared-deployment gaps, not permission to distribute the state key or re-own the
+installation root. Full shared-deployment convergence is not claimed.
+
+During cold startup, the shared dashboard slice exceeded its 49 GiB memory-high
+threshold (53 GiB hard cap) and spent about 60% of wall time stalled. Publication
+and belt timers/helpers were temporarily stopped within the approved interruption
+window to let the services finish startup. Both timers were restored and read back active. The unused replacement
+tailnet-door service is stopped after its socket-permission failure; its failed
+cutover never changed the root route. An independent HTTPS `/healthz` read through
+that existing route returns the approved revision and surface identity
+`998c13f6282e889f`.
+
+Controller installation [37884238413](https://github.com/gunb-ai/gunbc/actions/runs/37884238413)
+was canceled before installation at `95037360ab1040b9de4efe4671bb53cad473cb34`
+when the operator selected host-local SSH. The verified image artifact from run
+`37882239644` remains the image to install. No commissioning or guest allocation
+has been performed yet.
+
+Controller installation [37887389027](https://github.com/gunb-ai/gunbc/actions/runs/37887389027)
+selects revision `a85cc481af5b07dc89f270925bb55bc6f025c8cd` and image build
+`37882239644`. Both srv1 operation checkouts have that revision. The first live
+readback before installation found no controller process or queued start, and both
+historical root-owned receipts are `ReservationNotObserved` refusals. They are
+preserved. Installation and commissioning remain in progress.
+
+The build job of `37887389027` succeeded. Its source tree is
+`5dcdc0feb191c93ac957850344c88796c5651a39`, with request key
+`release-bins-38e793db9ef32d629136be09416dabc9da34cdd3139f3541c9e025c146cb75a8`.
+The general converge job also queued for this dedicated mode, occupying its shared
+host-mutation concurrency key. Both queued jobs were canceled before starting;
+there was no installation effect from the workflow. The general job condition now derives
+from `fleet_converge_mode_job_id` to remove that second assignment.
+The successful build artifact was downloaded and verified on srv1 using the exact
+existing installer consumer script and the key recorded by the build job. All
+16 binaries passed verification, and the image/kernel hashes still match. The
+existing `microvm_controller_install_srv1_wet` entry is running as `ghrunner`
+under an operator-local 24 GiB/no-swap scope. No workflow identity was fabricated.
+
+The workflow-selection repair passes five focused witnesses. Regeneration succeeds,
+and an independent check of the emitted YAML finds exactly one consumer job for
+each of all 78 dispatch modes. The shared job selector is the only generated
+workflow field that changed. All 8,269 source files parse.
+
+The local `a85cc481af5` installation completed its mutations but returned
+`executor scripts or loaded unit failed exact readback`. The final read attempted
+to open root:root `0440` `/etc/sudoers.d/gunbc-workspace-commissioning` as
+`ghrunner`; that account has no read permission or read grant. `visudo` accepts the
+installed policy. Independent readback matches the compiler artifact's SHA-256
+`16f75c38f7b5a3eb7c3580dbe9f6bae59b5997630d808bd3cc3b39ad49dd9930`, both image pins,
+and the root-owned release/readiness/commissioning directories. The loaded slot
+unit selects `a85cc481af5` and has no running process. Installation convergence is
+not yet claimed: the readback needs an exact privileged read of its own policy.
+
+The repair derives that read's argv and permission from the same privileged
+operation, retaining root:root `0440` custody and exact content comparison. Seven
+focused dispatch/allocation witnesses pass, including the exact policy-file grant
+and the existing prohibition on workflow-created operator intent. The verified
+`a85cc481af5` compiler binary can interpret this DAG-only repair; its build identity
+remains `a85cc481af5`, separately from the new installed source revision. It is not
+represented as a rebuilt compiler pack for the new tree.
+
+
+The read-only commissioning preflight at `a85cc481af5` refused because
+`/var/lib/gunbc/microvm-network/converged-slot-network.txt` and its parent directory
+are absent. The network workflow still names `runner_microvm_network_observe_wet`,
+but that function was overwritten when the same module was repurposed for
+per-attempt sanitation. The previous implementation was recovered from source
+revision `34ac2fefab51e912e9499dd23aa92bb3ebdac824`; sanitation keeps its own current
+producer. The repair restores the workflow entry and adds an explicit local root
+initializer which observes the host, publishes once with create-only semantics,
+and verifies existing generations against fresh observations without overwriting.
+
+The live `gunbc-tap13` holds `172.30.13.1/30`, and the existing microVM nft service
+is active. However, `disable_ipv6` reads `0` despite the installed sysctl file
+requesting `1`. systemd 255's [link IPv6 decision](https://github.com/systemd/systemd/blob/v255/src/network/networkd-link.c)
+and [sysctl writer](https://github.com/systemd/systemd/blob/v255/src/network/networkd-sysctl.c)
+show why the generated `.network` file must also disable link-local IPv6:
+networkd re-enables IPv6 when its configuration calls for it. The local network
+plan/apply entries use the existing staged-file and ordered-operation producers,
+require root on the named host at the named revision, and use no forwarded agent.
+Network changes have not yet been applied.
+
+The `edad20b0ded` controller installer completed its mutations and installed the
+exact policy read grant. A real `ghrunner` invocation can now read that policy,
+and `visudo` accepts it, but exact adapter readback still refused. The next
+boundary diagnosis identified `bounded_shell_host_drain`'s `trim_end` capture contract:
+the final newline cannot survive a `cat` through that transport. Policy readback
+now compares the actual file's SHA-256 with a digest of the expected bytes. The
+exact grant becomes `sha256sum -- <policy path>`; it grants neither arbitrary
+file reads nor the protected-state credential. The focused validation passes all
+34 checks across network apply/convergence, observer production, policy readback
+and allocation dispatch. The final network-path retry passes its 12 checks after
+using the existing command executor and effective-UID reader. All 8,272 source
+files parse, and formatting checks pass. Live reinstallation and network
+convergence are next; no VM has been commissioned, allocated or booted.
+
+Controller installation at `682c32644e84da04dd4e73d334413057a659dbf3` now exits
+successfully, including exact executor/policy and guest-image readback. The network
+plan at that revision also succeeds. Comparison with the installed files finds
+only `LinkLocalAddressing=no` and `IPv6AcceptRA=no` added to the ten enrolled TAP
+configurations; firewall, TAP addresses and IPv4 forwarding remain identical.
+The reviewed apply refused before any network installation: its staging writer
+used exclusive creation against existing root-owned staging files. Network
+convergence is not yet claimed.
+
+Pre-commissioning review found the native executor started its bind interpreter
+alongside the controller in the same 24 GiB slice. The controller already binds
+its journal identity before commissioning effects. The executor now waits for
+that invocation to terminate before its independent bind/readback, keeping those
+two preparations sequential without changing the resource ceiling or recovery
+fences. This fixes the normal start overlap; recovery-path aggregate memory has
+not been measured. No live commissioning OOM is claimed.
+
+The manual transport experiment used `export_executor` from
+`dag/test/claim/workspace_commissioning_executor_witness_test.dag` and the local
+`target/srv1-bringup-evidence/executor-bind-order-controls.py` driver against
+`target/workspace-commissioning-executor.sh`. The Python driver is local dev
+tooling, excluded from the committed substrate by `gunbc.repo_workspace`; these
+results are not claimed as an ongoing CI regression gate.
+All eight revised-script cases pass: normal start, invocation replacement,
+surviving PID, refused finish, wait, settle, complete and drain. The optional
+`--reject-active-bind-script` control against the installed `682c32644e8`
+predecessor refuses its premature bind, distinguishing the two schedules.
+
+The local network staging writer now creates a private temporary inode in the
+verified directory, fills it, and atomically replaces the exact staged destination.
+The existing scope admission, root-custody checks and exact byte readback remain
+required. The manual native filesystem control
+`test.manual.runner_microvm_network_local_stage_probe.local_stage_replaces_owned_bytes_wet`
+passes creation, changed-content replacement, replay, 0600 mode, trailing-newline
+preservation, out-of-scope refusal and scratch cleanup. The out-of-scope control
+uses an existing allowed directory, so it distinguishes admission refusal from a
+missing-directory failure. It runs as an ordinary user in a fresh scratch directory;
+this is manual evidence, not an enrolled CI claim. The live network apply must
+still pass with the repaired writer before commissioning.
+
+Controller installation at `83dcbb4d6ab51e0e05a519dd930dc41ef0539eaa` passes
+its complete readback. The fresh network plan has identical staged bytes and
+operation argv to the reviewed `682c32644e8` plan. Network apply now passes,
+including replacement of existing staging files; its live nft digest is
+`da7a00c54f267b39227a02557ebef28c90282376673cef9c78784caca7479099`.
+Independent readback observes `gunbc-tap13.disable_ipv6=1`, IPv4 forwarding enabled,
+and both `gunbc-microvm-nft.service` and fabric storage active with successful
+results. The initializer passes and publishes root:root `0644`
+`/var/lib/gunbc/microvm-network/converged-slot-network.txt`, generation
+`local-83dcbb4d6ab51e0e05a519dd930dc41ef0539eaa-2026-10-09T07:45:19Z`.
+Its live readings cover all ten enrolled TAPs with IPv6 disabled and count zero
+helper attachments and expectations across all observed surfaces. The initial
+commissioning plan refused before writing an artifact; no commissioning effect or
+allocation has started. Its coordinator compiled in 451 seconds and its installed
+privileged observer in 327 seconds. The observer stopped immediately after reading
+the network receipt. The controller supplied `fabric_execution_slot_identities()`
+to the parser, which admits only slot 13 on srv1; the publisher's enrolled network
+population also contains TAPs 1 through 9. The reader now takes the host and derives
+the network population from the same deployment authority as the publisher.
+Workload admission remains a separate controller check. The regression fixture is
+the actual published ten-slot receipt, including the predecessor's rejecting parse.
+All three focused checks pass: the complete host population reaches the workspace
+consumer, another receipt host refuses, and an unenrolled network slot refuses.
+Commissioning diagnostics now retain the underlying network/sanitation refusal.
+
+Controller installation at `f99e440ce59874b10d0c9c65c27a3217a0a1cc3e` passes.
+Its commissioning preflight gets through the network receipt and sanitation reads,
+then refuses the installed cell boundary. Independent readback finds all five
+non-CPU limits correct, but `CPUQuotaPerSecUSec=infinity`; the persistent quota
+drop-in still dates to the initial cell apply at 03:47:23. The `MemberAdded` effect
+passed the fleet-wide unlimited quota instead of the slot's declared four-CPU quota.
+The earlier `FullyApplied` receipt therefore establishes successful commands,
+not full resource-boundary convergence. No VM or commissioning mutation ran.
+
+The add constructor now accepts only the slot and derives its own quota. Existing
+state repair admits only an enrolled workspace's unlimited CPU predecessor when
+all non-CPU limits already match and the target equals its declared boundary.
+`gunbc.change_realization` classifies the preserved address as `InPlaceUpdate`;
+the boundary effect emits only `CPUQuota=400%`. Other resource changes, finite predecessors,
+quota removal and changed addresses still refuse. This preserves the cell and
+its storage; it is not deletion/recreation to make drift look absent.
+All thirteen focused cell-effect and fleet-plan checks pass, including the actual
+slot-specific add path and the restricted repair. All 8,279 source files parse,
+and formatting checks pass. Live repair and commissioning remain outstanding.
+
+The read-only cell plan at `ce5bf60b507` records generation 20 and refuses
+`fabric-cell-srv1.slice`, the structural parent created by systemd for slot 13.
+It was not applied. The namespace census correctly observes both parent and child;
+the classifier lacked a subject for proper ancestors. Discovery now derives them
+from the local enrolled cell names through the existing systemd hierarchy authority
+and retains them without granting ownership or satisfying a cell address. Unrelated
+slices and ancestor-looking filesystem entries still refuse. The new controls use
+the actual srv1 two-unit census and production observation admission.
+
+Controller installation and full readback at `ce5bf60b507` pass. CI run
+[37903218933](https://github.com/gunb-ai/gunbc/actions/runs/37903218933) passes
+seed, emit-build and generated checks, but floor discovery refuses the manual
+filesystem probe's `*_test.dag` filename because it declares no enrolled test.
+It is renamed `runner_microvm_network_local_stage_probe.dag`; its manual entry and
+behavior are unchanged. The observer's first broader batch passes all six new
+ancestor controls and exposes four stale single-cell/unenrolled-slot fixtures:
+srv3 now enrolls slot 7 too. The isolated classification test now supplies only
+its selected slot's readback, and foreign-probe controls use slots 99 and 100.
+
+At `4fa60f7134239a58f91fced3e127e36a5861a303`, all 52 observer checks pass,
+all 8,280 source files parse, and formatting passes. Controller installation and
+full readback pass. The fresh cell plan `local-2026-10-09T09:17:53Z`, hash
+`e3dc463bbc6f76f8`, admits only `CPUQuota=400%`, a start of the existing slice,
+and the existing root-owned base-directory ensure. Its apply receipt
+`43cf1e08f8680971` records exit 0 and generation 19 → 20. Independent systemd
+readback confirms `CPUQuotaPerSecUSec=4s`, `MemoryHigh=MemoryMax=30064771072`,
+`MemorySwapMax=0`, `TasksMax=16384`, `CPUWeight=100`, and an active slice.
+The commissioning plan against this verified release refuses as detailed below;
+no VM boot or guest login is yet claimed. CI run
+[37910533190](https://github.com/gunb-ai/gunbc/actions/runs/37910533190) covers
+this pushed revision.
+
+The commissioning plan at `4fa60f71342` passes installed-runtime checks but
+refuses initial sanitation. Its TUN holder census invokes
+`ethtool --show-channels gunbc-tap13`, which returns `Operation not supported`
+on srv1's running `6.8.0-138-generic`. The installed `6.8.0-142-generic`
+System.map also lacks `tun_get_channels` (while naming `tun_fill_info` and
+`tun_ethtool_ops`), so the pending ordinary reboot does not establish this capability.
+The original refusal was hidden by three projections; the census cause, unproven
+sanitation fact and commissioning admission reason are now retained end to end.
+
+[Linux v6.8's TUN driver](https://github.com/torvalds/linux/blob/v6.8/drivers/net/tun.c)
+has no channel-count callback. [Linux v6.9's implementation](https://github.com/torvalds/linux/blob/v6.9/drivers/net/tun.c#L3442)
+reports the attached queue count. Descriptor sweeps alone cannot substitute for it,
+because file references can remain outside process descriptor tables. The v6.8
+netlink queue counters are emitted only for multi-queue devices; changing this TAP
+to multi-queue would not match [Firecracker v1.16.1's open flags](https://github.com/firecracker-microvm/firecracker/blob/v1.16.1/src/vmm/src/devices/virtio/net/tap.rs#L109).
+No refusal has been relaxed, no readiness record has been fabricated, and no VM
+has been commissioned or booted.
+
+### Host kernel dependency and maintenance
+
+The commissioning planner derives this proposal from the selected sanitation
+reader's `TunAttachedQueueRequirement`. Its observation now invokes Linux's
+`SIOCETHTOOL / ETHTOOL_GCHANNELS` ABI directly through the declared Python runtime
+boundary. Only numeric `EOPNOTSUPP` demands a provider. Permission failures,
+missing devices, malformed replies, a failed reader or multi-queue TAPs refuse;
+they cannot become a reason to upgrade. A successful count on a backported kernel
+needs no package lookup. A successful nonzero count establishes capability but
+still fails the unchanged sanitation census.
+
+The host policy in `gunbc.host_kernel_dependency` selects the Ubuntu provider;
+VM code does not select a version. Readback binds the proposal to host, source
+revision, interface, running release and boot identity. It checks the distribution,
+architecture, installed package identities, exact available candidate and a
+non-removing apt simulation. If the selected image/modules are already installed
+and their boot artifacts are readable, the proposal contains activation only.
+If the selected kernel already runs but the operation remains unsupported, it
+refuses instead of entering a reboot loop.
+
+The existing `workspace-slot-commissioning` plan carries the dependency, package
+simulation and continuation. It cannot mint a commissioning credential or initial
+readiness. Generic slot apply remains `AwaitingCapability` because a slot request
+alone does not authorize interruption of the shared host.
+
+`gunbc.host_kernel_dependency_apply` now supplies the administrator maintenance
+path for that exact canonical dependency. Its drain entry puts runtime masks on
+observed runner instances without stopping them, allowing their one current job
+to finish. Installation and activation require every instance inhibited, stopped,
+without a queued job, and with an empty or absent workload cgroup. The existing
+cgroup observer includes descendants. Unknown and foreign runner census rows,
+unreadable state, a live workspace controller, changed boot identity or changed
+package proposal refuse. Existing permanent masks are retained.
+
+The install entry uses the same exact, non-removing apt selection as planning,
+then reads package identities, boot image, initramfs and the TUN symbol back. An
+already installed target needs only activation. The separate activation entry
+checks srv1's observed GRUB default-zero realization, exact image/initramfs and
+absence of a pending boot override, then requests a normal OS reboot. The peer
+keeps the reviewed plan and invokes verification after SSH returns. Verification
+requires a new boot identity, the target release and the actual queue capability;
+commissioning must subsequently perform its full sanitation and readiness checks.
+
+These entries require root and are not included in the job-user commissioning
+sudo grant. They are the operator's explicitly approved maintenance action, not
+an unattended reboot policy. The BMC is the operator recovery fallback. Normal OS
+reboot does not require enrolling srv1 in the separate BMC-issued reset workflow
+(`host_reset_boot_selection`); treating that unrelated enrollment as a kernel
+installation dependency was an overly broad frontier in the earlier proposal.
+
+The four entries consume the planner's canonical JSON on stdin:
+`host_kernel_dependency_drain_cli`, `host_kernel_dependency_install_cli`,
+`host_kernel_dependency_activate_cli`, and `host_kernel_dependency_verify_cli`.
+An unfinished drain reports refusal and leaves its runtime masks in place; it
+never interrupts current jobs to force completion. Those masks disappear at
+reboot. If maintenance is abandoned before reboot, the operator removes only the
+runtime masks created by that attempt and starts those instances again, preserving
+previous permanent masks. The pre-maintenance unit census is retained as evidence.
+
+This is ordinary domain composition using the existing `ensure` decision and
+fleet plan, not a claim that the generic completion/elaboration engine proposed
+in `docs/plans/ensure-closure-design.md` has been implemented.
+
+The read-only package simulation on srv1 selects Ubuntu's arm64 HWE meta-package
+`linux-generic-hwe-24.04=7.0.0-38.38~24.04.4`. It adds eight packages, upgrades
+none and removes none: the image, modules, ZFS module package, header packages
+and HWE image/header meta-packages. This leaves the existing 6.8 kernels installed.
+The downloaded Ubuntu image/modules packages were inspected without installation.
+The modules package's `System.map-7.0.0-38-generic` contains `tun_get_channels`,
+`tun_fill_info` and `tun_ethtool_ops`; this checks the proposed binary's symbols,
+not merely its version. The install command whose simulation was reviewed is:
+
+```sh
+sudo env LC_ALL=C DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=l \
+  apt-get --yes --no-install-recommends --no-remove install \
+  linux-generic-hwe-24.04=7.0.0-38.38~24.04.4
+```
+
+The operator approved this shared-host maintenance on 2026-10-09 after the
+interruption was explained. The reboot
+interrupts srv1's twelve runner services, dashboard, fabric storage, approval
+broker, ntfy and container services. Before installing or rebooting, drain work,
+establish console/boot recovery, and recheck the package plan and disk capacity.
+GRUB currently boots entry 0 with a hidden, zero-second menu; keeping an old
+kernel alone is not automatic rollback. After reboot, require successful
+`ethtool --show-channels gunbc-tap13`, verify KVM, network and service recovery,
+then rerun the commissioning plan. A newer version string alone is insufficient.
+Local read-only IPMI device/chassis queries succeed and SOL reports enabled.
+The BMC's HTTPS endpoint is reachable from srv2, firmware selects Ubuntu, and the
+BMC reports no boot-device override. An authenticated remote console session has
+not been tested. Runner drain uses the actual local service/cgroup population,
+not an incomplete GitHub organization runner listing.
+
+The first production drain used source snapshot SHA-256
+`d2ef5ab2f7d3d11bda59d5773ffd9ca2a41c8f14578d41746f6ced41da544646`
+and the existing canonical dependency for installed release `4fa60f71342`.
+It placed twelve runtime masks and returned the expected awaiting-jobs refusal;
+the existing jobs remained active and permanent masks were unchanged. Evidence:
+`target/srv1-bringup-evidence/kernel-maintenance-drain-r1.log` and the before/masked
+runner censuses. Package installation and reboot remain pending at this receipt.
+
+The seven maintenance controls pass: canonical input, permitted install progress,
+boot/transaction drift, runner population inclusion/refusal, complete drain
+readback, and exact GRUB image selection with override refusal. The boot-selection
+control resolves only its pure reader and passes at 1,216 evaluation steps.
+All 8,291 source files parse; formatting and whitespace checks pass. Logs are
+`target/srv1-kernel-maintenance-tests-r3.log`,
+`target/srv1-kernel-maintenance-drain-tests.log`,
+`target/srv1-kernel-maintenance-boot-tests-leaf-r2.log`, and
+`target/srv1-kernel-maintenance-parse-r2.log`.
+
+The diagnostics repair at `0fd9f91c7b1` passes all 29 focused commissioning,
+network-producer, TUN-census and initial-sanitation witnesses in
+`target/srv1-commissioning-diagnostics-tests.log` (exit 0). All 8,281 source files
+parse; formatting and whitespace checks pass. The new controls require the actual
+queue-query cause and unobservable sanitation fact to survive refusal reporting.
+
+A read-only manual invocation of the production `workspace_dispatch_plan_cli`
+from clean source `0fd9f91c7b1`, using the installed root-owned interpreter and
+observing release `4fa60f71342`, exits 1 with the complete live cause:
+
+```text
+privileged commissioning observation refused: initial cell sanitation is incomplete; no initial readiness may be published: srv1-13: quarantined — slot-network-quiescent: unobservable — tap-unheld: TUN attached-queue count is unavailable: ethtool --show-channels exited nonzero
+```
+
+The captured log is `target/srv1-bringup-evidence/commissioning-readback-0fd9f91.log`.
+This validates refusal reporting against the installed release; it is not a new
+controller installation, commissioning apply or ongoing CI claim. Independent
+post-readback checks find no allocation, commissioning or readiness files, and
+the historical controller remains stopped with `MainPID=0` and no queued job.
+
+### Dependency observation evidence
+
+The production `workspace_dispatch_plan_cli`, run read-only against release
+`4fa60f71342` from source snapshot SHA-256
+`9aeb7a306baf7e08d7a6d81801a7b4ed02f3e04ef6869c105ef8754b30593b45`,
+returns exit 0 and a canonical `commissioning-kernel-dependency` response for
+`srv1 / gunbc-tap13`. The response binds running release `6.8.0-138-generic`,
+the observed boot ID and selected `7.0.0-38-generic` provider. Its live apt
+simulation reports eight new packages, zero upgrades and zero removals. This is
+a successful **plan observation**, not completed commissioning or an installation
+of the new source. The log and decoded response are
+`target/srv1-bringup-evidence/kernel-dependency-live-r2.{log,json}`.
+
+The Python ABI program rendered by `linux_ethtool_channels_program` was also run
+read-only on srv1. `gunbc-tap13` returned numeric errno 95; `gunbcnotap0` returned
+19; the physical `enP3p3s0f1` returned a combined count of 63, independently
+matching `ethtool --show-channels`. The receipt is
+`target/srv1-bringup-evidence/ethtool-ioctl-live.txt`. The declared wet witness
+executes the same native reader and distinguishes unsupported from missing.
+
+The initial success-reply decoder witness exposed the seed's already-recorded
+`optional_equality_answers_by_representation` defect. The consumer now eliminates
+the optional by a match, following that ledger's existing discipline; it does not
+claim to repair the interpreter. The dependency, wire binding, fleet admission,
+network producer and dispatch controls pass. The workflow test responsible for
+CI run `37915381374`'s failure previously constructed every unrelated step merely
+to inspect the job condition. The production envelope now accepts its step list;
+the witness supplies an empty list at that boundary and still checks the actual
+condition assignment. It passes at 3,142 evaluation steps, versus the failed
+run's 446,125, below the new-witness budget. Workflow behavior is unchanged.
+
+Post-observation readback still finds `6.8.0-138-generic` running, no allocation,
+commissioning or readiness files, and controller `MainPID=0` with no queued job.
diff --git a/docs/plans/t5b-closure-bearing-serde-debug-decision-2026-08-21.md b/docs/plans/t5b-closure-bearing-serde-debug-decision-2026-08-21.md
deleted file mode 100644
index 22574f76d97..00000000000
--- a/docs/plans/t5b-closure-bearing-serde-debug-decision-2026-08-21.md
+++ /dev/null
@@ -1,163 +0,0 @@
-# T5b decided: closure-bearing declarations split into two dispositions, not one repair
-
-**Session `tidy-dove-648`. Work item:** `node://adhoc-c3017faf-ad6` — "E0277 root T5b (35 sites,
-largest): serde/Debug is demanded over closure-bearing values and NO derive can be added — decide
-the modeling question, do not repair." This document is that decision. It does not touch
-`v1.trait_derive_emit`, `v1.04_emit_info`, `v1.05_emit_rust`, or `v2.std.compilers.target_model` —
-the repairs it hands off are named at the end, scoped but not implemented here.
-
-**Inputs.** Three prior receipts, re-verified against the live `.dag` declarations rather than
-trusted as transcribed numbers (§3's citation rule — symbols below are grep-checked by name, not
-carried as positions):
-
-- `docs/probes/e0277_partition_2026-08-21.md` (PR #8712, on `main`) — first framed root 1 ("serde/Debug
-  derive on a function-valued carrier") as impossible-to-derive and structural.
-- `docs/plans/self-host-cargo-refusal-root-partition.md` §11.19 and §11.23 (on `main`) — named the
-  same root T5b, attributed 44 sites to ~12 enclosing declarations, and posed the open question
-  verbatim: *"should a declaration whose value contains a function be serializable at all?"*
-- `docs/probes/e0277_root_partition_2026-08-21.md` (session `bright-moth-92`, PR #8731, **not yet
-  merged**) — re-measured T5b at E0277-only, site grain: **35 sites**, concentrated in
-  `v2_std_runtime.rs` (13), `v2_std_compilers_target_model.rs` (11), and three compiler-stage files
-  (11). Cited here as evidence, not as merged fact — its branch is `origin/session/bright-moth-92`.
-
-## The decision
-
-**T5b is not one modeling question with one answer. It is two populations that look identical at
-the trait-bound grain and require opposite treatment.** "Drop serde/Debug wherever a closure
-appears" is wrong for the second; "keep serde/Debug and find a wrapper" is wrong for the first.
-Distinguishing them is the modeling work this root needed.
-
-### Population 1 — process-local realization values: drop serde/Debug/PartialEq, keep Clone only
-
-`v2.std.runtime` `ValueInterpreter`, `TransformInterpreter`, `BranchInterpreter`, `LoopInterpreter`,
-`BindInterpreter`, `MatchInterpreter`; the `v2.std.runtime` `RuntimeBehaviorInterpreter` coproduct
-wrapping them; `v2.std.runtime` `InterpretationAlgebra`; `v2.compiler.01_tokenize`
-`CompiledLexRule`/`LexWalkAcc`; `std.algebra` `PartialFunction<K,V>`; and `v2.compiler.05_eval`
-`EffectIoEvalBundle` / `EffectIoEvalContext` / `EffectIoYieldOutcome` are, by construction,
-**evaluator plumbing that exists only inside one compile process.** None is written to disk, sent
-across a process boundary, or logged as a debug artifact — each is built from a live
-`EvaluationAlgebra`/handler table at run start and discarded at the end. `Serialize`/`Deserialize`/
-`Debug` on them was never a consumer need; it was the derive roster applied uniformly regardless of
-what the declaration is.
-
-**This is not a new call.** `v1.trait_derive_emit` `v1_emit_struct_derives` already special-cases
-`has_fn_fields` to emit `std.trait_derive_shape` `fn_field_derive_traits()` — Clone, nothing else —
-and `docs/plans/self-host-cargo-refusal-root-partition.md` §11.19 states it: *"`CompiledLexRule`
-emits `#[derive(Clone)]` and nothing else, because `fn_field_derive_traits()` is Clone-only —
-correctly, since `Rc<dyn Fn>` is not serializable and not `Debug`."* Population 1's decision:
-**apply that existing, correct rule consistently.** Per DESIGN §5, whether a declared type
-transitively reaches a function value is decidable and structural, so this is a construction wall,
-not per-declaration validation — one authority (reachability), derived once.
-
-**Why 32 of these 35 sites exist despite the correct rule: it is wired for structs but not
-coproducts, and the transitive walk cannot see through either.** Confirmed by reading
-`v1.04_emit_info`, not inferred from the site count:
-
-- `v1.05_emit_rust` `enum_derives` calls `v1.trait_derive_emit` `v1_emit_enum_derives` with **no
-  `has_fn_fields` parameter at all** — `v1_emit_struct_derives`'s `has_fn_fields` branch has no
-  enum counterpart, so a coproduct is never routed to `fn_field_derive_traits()` whatever its
-  variants carry. Hence `RuntimeBehaviorInterpreter`, a coproduct whose every variant wraps a
-  closure-bearing struct, still derives the full `payload_coproduct_derive_traits()` roster
-  (Debug/Clone/PartialEq/Serialize/Deserialize) — 18 of the 44 occurrences / a majority of the 35
-  E0277 sites by itself.
-- `v1.04_emit_info` `build_type_summary`'s enum branch hardcodes `field_type_map: empty_map()` for
-  every enum, where its struct branch populates `field_type_map` from the real fields.
-  `v1.04_emit_info` `type_summary_reaches_fn` walks exactly that map for transitive
-  closure-reachability, so enum variant payload types are **structurally invisible** to the
-  existing fixpoint (`v1.04_emit_info` `close_fn_fields`). `v2.std.runtime`
-  `InterpretationStructureWitness` (6 sites, holding only `Symbol` fields) is not a second modeling
-  case but this blind spot's collateral, most likely misattributed by the census's 200-line
-  proximity heuristic to a neighboring declaration that legitimately fails. It is expected to
-  dissolve once the two gaps above close — not a third disposition.
-
-**Handoff (repair, not modeling — do not do this in this PR):** thread `has_fn_fields` through
-`v1_emit_enum_derives` as `v1_emit_struct_derives` already consumes it, and populate
-`field_type_map` for enum variant payload fields so `type_summary_reaches_fn` sees through a
-coproduct as it does a struct. Both are decidable, mechanical, and covered by the existing fixpoint
-infrastructure — completing an existing wall, not authoring a new one.
-
-### Population 2 — dispatch fused into an interface record: split it out, don't strip the record
-
-`v2.std.compilers.target_model` `ProducedDeclSupport` is different in kind, not degree:
-
-```
-type ProducedDeclSupport
-  = ProducedDeclUnwired
-  | ProducedDeclWired {
-      render: fn(Node) -> Outcome<TargetBodiedArrowStatementScaffold>
-      scaffold_relation_rule_name: Symbol
-      scaffold_base_row: Node
-    }
-```
-
-`ProducedDeclSupport` is a field of `v2.std.compilers.target_model` `TargetModel`, which is not
-process-local plumbing but the **per-target-language configuration record** built once per
-language (`rust_target_model()`, `python_target_model()`, and eight more call sites across
-`src/v2/extdeps/languages/*.dag`, `src/v2/extdeps/{github,bmc}/*`, `src/v2/extdeps/formats/*`)
-and consumed pervasively through the emit pipeline. Stripping `Debug`/`Serialize`/`Deserialize`
-from `TargetModel` would be a real loss — comparing, inspecting, and (per the `06_translate`
-consumers) potentially persisting target-model facts is what this record exists for, unlike a
-`ValueInterpreter` closure table nobody prints. Population 1's answer does not transfer; this is
-where §11.23's "operator question" lives.
-
-**The field is redundant with a fact already on the same variant.** `ProducedDeclWired` already
-carries `scaffold_relation_rule_name: Symbol` — a named, resolvable identity for *which* rule
-renders the scaffold. Its `render` field is that rule's own dispatch, embedded a second time as a
-live closure beside the name that identifies it — the shape DESIGN §3 rules out: *"the dispatch
-that selects a realization is itself realization... A pure spec is dispatch-free; a `std`
-projection that matched over its realizations would have to name them, fusing dispatch back in."*
-`ProducedDeclWired` should be the *interface* fact (which rule, over which base row) that
-`TargetModel` carries as configuration; embedding the closure makes it carry the *realization*
-too, which is why it alone among its siblings cannot be part of a serializable record.
-
-**Decision: remove `render` from `ProducedDeclWired`.** The variant keeps
-`scaffold_relation_rule_name: Symbol` and `scaffold_base_row: Node` — plain data, derivable under
-the standard record roster. The `fn(Node) -> Outcome<TargetBodiedArrowStatementScaffold>` behavior
-moves to a peripheral, non-serialized dispatch table (a `Map<Symbol, fn(Node) -> Outcome<...>>` or
-equivalent registry) keyed by `scaffold_relation_rule_name`, resolved only where a scaffold is
-rendered — never carried inside `TargetModel`. This is the named-resolvable-reference answer from
-§11.23's three options, chosen over "drop serde/Debug" (wrong here — throws away a real
-requirement) and over "split into description + realization as two fields on the same record"
-(redundant — the description, the rule name, already exists; a second field beside it would
-nickname one identity twice, which DESIGN §3 forbids). With `render` gone, `ProducedDeclSupport`,
-`TargetModel`, and everything containing them keep full Debug/Clone/PartialEq/Serialize/Deserialize
-— the fix removes a misplaced fact, not the record's strength.
-
-**SUPERSEDED, AND IN THE SAME DIRECTION.** The `render` field is gone, but not into a peripheral
-registry keyed by `scaffold_relation_rule_name`: rendering is now DECLARED ROWS on the variant
-(`v2.std.compilers.target_model` `ProducedDeclRenderRows`, read by the single shared fold
-`produced_decl_render_from_rows`), and each target declares its own signature order as data
-(`v2.extdeps.languages.rust` `rust_produced_decl_render_rows`, `v2.extdeps.languages.c`
-`c_produced_decl_render_rows`). A registry would have kept the fn alive one indirection away — still
-origin-bound, which is exactly what blocked the required floor from sharing one evaluation of a
-target model across claim frames (`v2.workflow.floor_pure_producer_share`). Rows delete the fn
-outright, so `TargetModel` is a pure content value; the interface/realization split is preserved,
-the target still owns its order, and the compiler holds no per-target arm.
-
-**The other four `v2_std_compilers_target_model.rs` sites are very likely the same collateral
-pattern as `InterpretationStructureWitness`, not independent decisions.**
-`v2.std.compilers.target_model` `TargetDeriveSupplementalGenericBoundContractAuthority`,
-`TargetDeriveSupplementalGenericBoundContract`, `TargetCollectionRealization`, and
-`TargetRepresentationParameterSlot` — confirmed by source read to be **an empty struct**,
-`TargetRepresentationParameterSlot {}` — hold no function field directly or (by inspection of their
-declared fields) transitively. Their likeliest cause is proximity to `ProducedDeclSupport` within
-the same module/derive-refusal cluster — the 200-line-window attribution effect the prior receipt
-flagged for `InterpretationStructureWitness`. **Do not author a fix for these four independently.**
-Re-measure this file after the `render` removal lands; whatever remains is a real, distinct defect
-and gets its own row.
-
-## What this decision resolves and what it hands off
-
-| population | declarations | disposition | this document | handoff |
-|---|---|---|---|---|
-| 1 — realization values | `ValueInterpreter`+5 siblings, `RuntimeBehaviorInterpreter`, `InterpretationAlgebra`, `CompiledLexRule`, `LexWalkAcc`, `PartialFunction<K,V>`, `EffectIoEvalBundle`/`EvalContext`/`YieldOutcome` | Clone-only; serde/Debug never legitimate | decides + grounds the rule already implicit in `fn_field_derive_traits()` | wire `has_fn_fields` through `v1_emit_enum_derives`; populate enum `field_type_map` in `v1.04_emit_info` |
-| 1 (collateral) | `InterpretationStructureWitness` | expected to dissolve with population 1's repair | names it, does not fix it | re-measure after the repair, do not pre-emptively touch |
-| 2 — dispatch-in-interface | `ProducedDeclSupport`/`ProducedDeclWired` | drop the embedded `render`; dispatch by the existing `scaffold_relation_rule_name` in a peripheral registry | decides the split and which existing fact survives as the identity | remove the field, add the registry, rewire the ~10 `TargetModel` construction sites that build a `ProducedDeclWired` |
-| 2 (collateral, unconfirmed) | `TargetDeriveSupplementalGenericBoundContractAuthority`, `TargetDeriveSupplementalGenericBoundContract`, `TargetCollectionRealization`, `TargetRepresentationParameterSlot` | presumed collateral of population 2; not independently decided | names the four, declines to assume | re-measure after population 2's repair; triage what remains then |
-
-**What is not claimed.** This document does not re-run the probe, so it confirms neither that the
-35-site count drops to zero nor that population 2's four collateral declarations resolve on their
-own — both are expectations grounded in the reachability mechanism being fixed, not measured
-outcomes. Per DESIGN §16 of the shared partition doc, a site count measures where the compiler
-pointed; closing this decision is a repair PR's job, verified by re-running
-`docs/probes/curated_cargo_probe_one.sh` against the same entry set after both handoffs land.
diff --git a/docs/plans/the-emit-near-ceiling-family-is-not-a-defect.md b/docs/plans/the-emit-near-ceiling-family-is-not-a-defect.md
deleted file mode 100644
index 4bc28ea5b6d..00000000000
--- a/docs/plans/the-emit-near-ceiling-family-is-not-a-defect.md
+++ /dev/null
@@ -1,116 +0,0 @@
-# The emit near-ceiling family is not a defect
-
-*A negative result, filed so the next lane skips four plays that do not work. Produced by
-jolly-ferret-412 while owning the charge subject behind the required floor's 500ms per-claim CPU
-ceiling. Every figure below names the producer that re-derives it; where a number and a producer
-disagree, the producer is right.*
-
-## What this closes
-
-Three `v2.test.emit` identities refused the required floor on run `33695697323`. The question
-routed to this lane was whether the emit family carries a repairable cost defect. **It does not.**
-Four rows, two clusters, 292–350ms off the floor, none individually remarkable; what put two of
-them over 500ms is the run they landed in.
-
-That answer is only useful with the plays that were tried attached, because each looks obviously
-correct from the outside:
-
-| play | outcome | where it is recorded |
-| --- | --- | --- |
-| serve the shared producer across claim frames | **measured and refused**, three candidate rows, every one made its consumers worse | `v2.workflow.floor_pure_producer_share` `floor_cross_claim_refused_candidates` |
-| find the one dominant shared producer, as gunbc#10133 did | **refuted twice**, independently | `eval_steps` fingerprint in `docs/plans/floor-cost-distribution-near-the-ceiling.md`; and the present-vs-absent runs behind the refused rows above |
-| repair the worst row per-producer | **8ms**, against a question 87 rows deep | the top-down table in the same memo |
-| read the interrupted rows' printed cost as a margin | **not a cost at all** — an interrupted row reports the ceiling that interrupted it | `v2.workflow.required_floor`, and the in-band sentence the floor prints beside it |
-
-## The four rows, measured off the floor
-
-Two of the three refusing identities were `budget_interrupted`, so their cost was **unbounded
-above** — `required_floor_claim_cost.tsv` records them at 505/503 and 508/504, which is the
-interrupt point, not a measurement. A row with no upper bound cannot be ranked, cannot be compared,
-and cannot be shown to have improved by any repair, so the first step was to bound them.
-
-Instrument: `claim_batch --source-root dag --source-root src/v2 --entry <module test> --functions
-<identity>`, one entry per module, no floor and no budget.
-
-| identity | floor | off-floor |
-| --- | --- | --- |
-| `produced_decl_two_targets_render_own_order` | ≥503 interrupted | 346ms |
-| `rust_produced_decl_emits_named_add` | ≥504 interrupted | 294ms |
-| `rust_produced_decl_emits_named_add2` | 489 passed | 292ms |
-| `rust_produced_decl_name_discriminates` | 527 over-budget | 350ms |
-
-**No absolute figure crosses between those columns.** The off-floor arm is a different
-architecture and a different execution context; every conclusion here uses within-column ordering
-only, four rows measured under identical conditions in each column.
-
-## Two rows, two mechanisms
-
-`named_add` off the floor is 294ms against its sibling `named_add2` at 292ms — the same row within
-1% — while on the floor the sibling completed at 489 and it was interrupted. **Contention**, and
-three instruments that share no mechanism agree:
-
-1. µs/step from the floor artifact: 3.238 against the sibling's 2.990, 8.3% slower per unit of
-   work — derived from `cpu_ms` and `eval_steps`, which are sampled in consecutive statements after
-   `run_claim` returns and netted by the same shared-fill rule, so the ratio survives reordering.
-2. off-floor sibling parity, above.
-3. required multiple: both siblings needed ~1.70x to cross, above the measured p90, and exactly one
-   of them did.
-
-`two_targets` is the opposite. Its 188,416 steps at interrupt exceed every sibling's *completed*
-total, so it does more work — but off the floor it lands at 346ms beside `name_discriminates` at
-350ms. **Biggest in work, ordinary in time**, and time is what the ceiling adjudicates. A work
-bound is not a cost property; inferring one from the other is the error this row exists to
-document.
-
-## What the ceiling is actually adjudicating
-
-Eleven floor runs joined on claim identity: `33661252708`, `33664119594`, `33667640710`,
-`33671317370`, `33688140761`, `33695697323`, `33699325123`, `33699540412`, `33700216949`,
-`33700681714`, `33701938720`.
-
-**No identity crossed twice.** Four runs had crossings; not one identity recurs. Producer:
-`gunbc.floor_cost_distribution` `crossing_recurrence` and `recurring_crossers`, whose empty answer
-over single-run crossings is the finding rather than the absence of one — and whose positive
-control in `test.claim.floor_cost_distribution_witness` is what keeps the empty answer from being
-vacuous.
-
-**Crossings cluster by family within a run.** Run `33688140761`: ten crossers, all ten in
-`test.claim.self_host_compile_phase_live_gate_witness`. Run `33695697323`: three, all in the emit
-produced-decl family. A run tips a family; which identity inside it tips is arbitrary.
-
-**The run factor is large.** Over 296 identities present in all eleven runs with median cpu ≥100ms,
-taking each row's cross-run median as its own baseline, the per-run median factor runs
-0.858 … 1.154 — 1.35x best to worst on the *median* row, not a tail. The near-ceiling population
-tracks it: rows ≥350ms per run come out 3 on the 0.959 run and 36 on the 1.154 run. Producer:
-`identity_inflation_permille` composed with `permille_percentile`.
-
-So the run factor decides **whether** anything crosses; a row's baseline cost decides **which
-family** is exposed when it does. The line adjudicates a product of two things and attributes it to
-one.
-
-## The instrument that needs no control population
-
-`eval_steps` is host-independent and byte-identical for the large majority of identities across a
-run pair. For those rows the only thing that could have changed did not, so any cpu movement is
-inflation **by construction** — no normalisation, no control population to choose and defend.
-Producer: `identity_inflation_permille_at_equal_work`, which drops any row whose step count moved
-rather than smoothing it.
-
-Its reach must be reported beside it — `count` it against `identity_inflation_permille` — because a
-clean instrument over three rows is not a measurement of a corpus.
-
-## What is NOT claimed
-
-- **The vintage confound is load-bearing.** The eleven runs span different tree vintages, so "no
-  identity crossed twice" is confounded by repair: the ten `live_gate` crossers stopped recurring
-  partly because that family was fixed. This is not a pure contention result.
-- **Equal steps is equal EVALUATOR work, not equal host work.** A row whose time sits inside one
-  opaque host call reports few steps in both runs; `v2.workflow.required_floor` carries a declared
-  rung drop for that region.
-- **No safe-cost figure is derived here, and one was withdrawn.** A `500 / p90` derivation was
-  circulated by this lane and retracted: a p90 answers a per-row question while the ceiling refuses
-  the whole *run*, and the stratum quoted stopped one bucket short of the population that can
-  actually reach 500 — where inflation rises again rather than continuing to fall. Both errors ran
-  in the unsafe direction. The stratified table with n per bucket belongs with the decision-maker,
-  and the quantile choice is theirs.
-- **Nothing here is a recommendation about where the line should sit.**
diff --git a/docs/plans/throughput-qualified-convergence-design.md b/docs/plans/throughput-qualified-convergence-design.md
deleted file mode 100644
index f78f2e4fc44..00000000000
--- a/docs/plans/throughput-qualified-convergence-design.md
+++ /dev/null
@@ -1,255 +0,0 @@
-# Throughput-qualified convergence — one interface, one bound subject, one frontier
-
-Standing: a design under revision, not a landed capability and not yet enrolled in DESIGN. It has been
-through three review rounds (side-chat, 2026-09-17); the corrections are recorded in place rather than
-absorbed, because several of them are the kind of error this document exists to make harder.
-
-## The defect this exists to close
-
-**A convergence today verifies its CONFIGURATION and stops. Neither subject verifies the RATE the
-configuration was chosen to deliver.** The configuration is a proxy for the goal, and reading the goal
-off the proxy is the gap.
-
-Two live instances, each found by looking:
-
-- **Serving, Group B, 2026-09-17.** A converge reported success and was independently verified on four
-  hosts: image derived, pin correct, checkpoint loading, fp8 admission holding, KV law single-sourced.
-  Every one of those is true and none is about collective transport. The arm was running every NCCL
-  channel over `NET/Socket/0` with no IB device present, which the converge could report full
-  agreement through because transport was not in its comparison.
-- **CI.** `docs/plans/ci-humming.md` derives a runner-slot count from a memory budget across T0-T6 and
-  never measures jobs per hour afterwards. T1 carries the right instinct one level down — a cap is not
-  effective until the live cgroup is read back — and stops at configuration.
-
-## Convergence and qualification are two facts, not one (corrected)
-
-An earlier draft said "converged" should mean configuration agreed AND the rate was met. That is
-wrong, and the error is worth keeping: a realization can match its desired image, checkpoint, argv,
-transport plan, capabilities, devices and rank population exactly while missing a throughput floor.
-That is not configuration drift, and redefining convergence to cover it destroys a distinction the
-operator needs — *state agreement* and *service qualification* have different remedies.
-
-`std.goal_assessment` already owns the remedy-free relation between a caller-supplied goal and an
-independent observation, and deliberately keeps observation, assessment and remedy apart. So the
-shape is a composition, not a redefinition:
-
-    ConfigurationStanding = ConfigurationConverged | ConfigurationDiverged | ConfigurationIndeterminate
-    ThroughputAssessment  = GoalSatisfied | GoalDiverged | GoalIndeterminate | GoalAssessmentRefused
-    ConfigurationConvergedReceipt   -- mintable ONLY by matching ConfigurationConverged
-    ThroughputGoalSatisfiedReceipt  -- mintable ONLY by matching GoalSatisfied
-
-    type OperationalQualification sole_constructor
-      = RealizationQualified {
-          configuration: ConfigurationConvergedReceipt
-          throughput:    ThroughputGoalSatisfiedReceipt
-        }
-      | RealizationNotQualified {
-          configuration: ConfigurationStanding
-          throughput:    ThroughputAssessment
-        }
-
-**Two revisions of this carrier were wrong, in opposite directions, and both are worth keeping.** The
-first offered `ConfigurationNotConverged | ThroughputNotQualified` as alternative negative arms, which
-forces a reader to pick one when a realization can be configuration-diverged AND throughput-diverged
-at once -- so the negative arm now carries both complete standings, and no priority fold can lose
-evidence when both are non-positive.
-
-The second declared `RealizationQualified { configuration_receipt, throughput_assessment }` with the
-assessment typed as the whole coproduct. That field proves only that SOME assessment is present, so
-`RealizationQualified { throughput_assessment: GoalDiverged { .. } }` is constructible and the carrier
-certifies nothing. `sole_constructor` confines construction to one module; it does not refine which arm
-of a supplied coproduct is present. The refinement has to be in the TYPE: a receipt mintable only by
-matching the satisfied arm. That error is precisely the one §4b names -- *a brand, wrapper or
-`Validated<T>` is cosmetic until construction and acceptance enforce the distinction* -- committed in
-the paragraph that cites it.
-
-The structural rung is earned only when this implication holds by construction, and not before:
-
-    RealizationQualified  =>  ConfigurationConverged  AND  GoalSatisfied
-
-This also repairs the rung argument. A configuration convergence with no throughput result is a
-legitimate value, not a defect. The invalid state to remove is a `RealizationQualified` that does not
-imply both positives — and THAT is structurally impossible once the two receipts are refinement types,
-because no unsatisfied assessment can be carried into the positive arm. Enrolling every production
-route remains mechanically preventable. Two different rungs for two different claims, which is what
-§4b(1) asks for.
-
-## Why this is one interface (DESIGN §2, horizontal)
-
-"16 decode streams against a serving arm" and "N concurrent builds against a runner pool" share an
-interface: within a declared window, apply a declared workload to a subject, derive a rate from a
-counter the system itself keeps, and assess it against a floor that is not a copy of the last reading.
-
-The partition matters more than the sharing, and DESIGN §3b's fabric row already states it for
-capacity: **selection is shared; occupancy is not.**
-
-    shared:           observation and assessment interface, rate derivation, goal assessment
-    subject-specific: isolation acquisition, workload realization, counter producer,
-                      subject identity, occupancy and release mechanism
-
-So serving's termed `product.capacity.lease::LeaseGrant` is NOT the CI window's carrier. Compute
-occupancy is a timeless `LeaseIdentity` settled by `file_compare_and_set`. An earlier draft of this
-document cited `std.temporal_effect::HeldLease` for both, which carries an epoch and an observed state
-and **no deadline at all**; a later draft then cited `LeaseGrant` for both, which crosses the very
-boundary the roster draws. Each subject brings its own occupancy carrier.
-
-## The parts, each with the failure it prevents
-
-### 1. A quiet read is not a reserved window
-A CAS stops two probes believing they hold one claim. It does not stop a production request arriving
-after `num_requests_running == 0`, GitHub dispatching ordinary work after a queue check, or an
-already-admitted operation becoming active mid-measurement. Isolation is therefore a standing the
-subject-specific handler PRODUCES, not something the generic fold assumes:
-
-    ProbeWindowStanding
-      = WindowIsolated { grant, deadline, drain_receipt, exclusion_receipt }
-      | WindowSharedWithDeclaredTraffic { traffic_receipt }
-      | WindowIsolationUnread { cause }
-
-Serving realizes it by route withdrawal or a dedicated endpoint, a drain, and a fence against
-non-probe requests; CI by a dedicated runner population withdrawn from ordinary labels, drained, with
-probe-only dispatch. Without an exclusion receipt the reading is still useful production telemetry —
-it is simply not a controlled qualification, and must not be recorded as one.
-
-### 2. The offered load is a policy, and the receipt constrains it rather than manufacturing it
-Declaring the load is necessary; grounding the FIGURE is the rest. But an earlier correction here
-introduced circularity — "concurrency derived from the admitted policy, and the policy owes a capacity
-receipt" — which has the receipt manufacture the workload that then verifies it. The clean relation:
-
-    QualificationProtocol        declares the offered load (e.g. 16 concurrent)
-    ObservedCapacityReceipt      may admit or refuse that policy as safe or plausible
-    ThroughputObservation        establishes the delivered rate AT that load
-
-A contract may legitimately require 16 concurrent before anyone has found maximum capacity. And
-`max_num_seqs` is a **scheduler ceiling, not a workload authority**: a launch configured for 16 may be
-qualified at 8, 16 or another declared load depending on the contract being tested.
-
-### 3. Backlog is what is observed; saturation is an inference, and capacity a further one
-Two drafts got this wrong in opposite directions — first "queue depth > 0 means saturated", then "a
-sweep establishes it". vLLM's own metric definitions treat running as current execution and waiting as
-backpressure; neither defines a physical-saturation verdict. `16 running / 0 waiting` can be fully
-occupied, and `16 running / 5 waiting` can be waiting on `max_num_seqs` or KV admission with no
-hardware bottleneck identified. So:
-
-    queue > 0  does NOT establish saturation
-    queue == 0 does NOT establish unsaturation
-
-The reading names only what was observed — `BacklogObserved` | `NoBacklogObserved` | `BacklogUnread` —
-and a capacity inference is a separate operation with its own declared load progression and plateau
-criterion. **For an operating floor, capacity need not be inferred at all:** *under protocol P at
-offered load L, did the subject deliver at least floor F?* is answerable whether or not L saturated
-anything.
-
-*Correcting this document's own figures:* the 2026-09-17 socket readings retained no queue trace, so
-they are `BacklogUnread` and `CapacityUnestablished`. The 8-to-16 scaling argument (aggregate 27.31 to
-51.19 while per-stream moved 3.41 to 3.20) is useful causal reasoning and is **not** a queue
-observation; assigning `UnsaturatedAtOfferedLoad` from it, as an earlier draft did, was an inference
-reported as a reading.
-
-### 4. Subject equality alone does not make two rates comparable
-`serving_performance_subject` is a configuration fence, and its own source says launch identity is a
-separate boundary — several launches may share one subject. The observation therefore carries more
-than the subject:
-
-    ThroughputObservation<Subject, Protocol, Realization, RateUnit> {
-      subject            the effective configuration
-      protocol           concurrency, work identity, sizes, stopping rule, warmup and cache rules
-      realization        the exact serving incarnation or runner population
-      window_standing    isolated, shared under declared traffic, or unread
-      counter_producer   who kept the count
-      counter_span       before, after, and continuity across the interval
-      operation_ledger   every offered operation reached an admissible terminal outcome
-      raw_carrier        the bytes the reading was taken from
-      observed_at
-    }
-
-**Counter continuity** is its own field because a counter that reset, rebound or switched incarnation
-mid-window yields a delta that is arithmetic rather than a measurement.
-
-**Operations and rate units are different grains**, which an earlier draft conflated by counting
-"attempted, completed and refused tokens". For serving the operation is a request and the unit is a
-generated token — and a request can emit tokens and *then* fail, so the ledger cannot be denominated
-in tokens. For CI the operation is an exact Work/job and the unit a completed work occurrence; "jobs
-per hour" means something only over homogeneous work or a declared normalization, because a one-minute
-no-op and a fifteen-minute clean build are not interchangeable units.
-
-### 5. The rate is derived, never stored
-`gunbc.harness.harness_throughput` already states this law for its own stream — counts and interval
-are carried, the rate is a function of them, and storing it alongside would be a second representation
-free to disagree with its inputs. Cited, not re-coined.
-
-### 6. The floor is not a copy of the last reading
-DESIGN §5: a merge-blocking literal needs a controlled fixture, an external or versioned authority, an
-explicit policy budget, or a monotone debt contract. A floor pasted from this morning's run collapses
-to `measure() == measure()`. So the floor is a declared operating budget someone owns, or a monotone
-contract raised deliberately, with provenance either way. The verdict is `std.goal_assessment`.
-
-## Conformance (DESIGN §3b)
-
-Rows touched, with module names as the modules declare them (an earlier draft prefixed two of these
-with `gunbc.`, which is the file path and not the module):
-
-- **fabric / compute** — `product.capacity.lease::LeaseGrant`, `product.fabric.selection::select_supply`.
-  The row already states the partial sharing this design inherits: shared selection, separate
-  occupancy producers and linearizations.
-- **leasing / locking / grants** — the serving window as a termed grant; the CI window through
-  compute's own timeless identity. `std.durable_compare_and_set::CasExpectation` is the linearizer and
-  is not by itself an exclusion receipt.
-- **process observability / reporting** — `std.observation::ObservationEvent`,
-  `std.observation::RecordedObservation`.
-- **decision / selection** — deliberately NOT touched while the probe only assesses. The moment it
-  ranks configurations, `std.decision` is the home and §3d binds.
-
-## Evidence standing for readings already taken
-
-An earlier draft argued the socket readings qualify as a receipt BECAUSE the arm is gone and the
-question cannot be put again. That is wrong: irreproducibility establishes urgency to preserve
-evidence, never provenance for it. The honest standing follows what was retained:
-
-| retained | standing |
-|---|---|
-| exact subject, protocol, incarnation, raw counter and request traces, interval | subject-bound historical observation |
-| summarized numbers with no raw producer carrier | historical reported reading |
-| no queue trace | `BacklogUnread` |
-| successor moved transport AND other axes | no transport-only attribution |
-| no exact workload identity | protocol-unbound historical claim |
-
-The 2026-09-17 socket figures are a **historical reported reading**: summarized aggregate and
-per-stream rates, no retained raw carrier, no queue trace. They are worth recording as that, and they
-are not a `RecordedObservation`.
-
-The arm they were taken against was converged by a lane outside the modelled transaction, so a floor
-set from them grounds a claim about the SUBJECT and never about a transaction that did not run.
-`AdoptedOutOfBandRealization` is this document's PROPOSED name for that standing and has no home in
-the tree — it is used here in the indicative and is not yet vocabulary (review 67372). Its nearest
-neighbour is `docs/plans/scaffold-admission-doctrine.md`, which owns out-of-band ACTUATION, and the
-two are adjacent rather than the same question: that doctrine governs whether a hand-authored actuator
-may merge, while this standing labels how an OBSERVATION OF ITS RESULT may be cited. Either it is
-given a home when the design settles, or it is dropped in favour of whatever already answers that —
-and until one of those happens, naming it in the indicative here is a §3 nickname waiting to happen.
-
-## Staging
-
-1. **Record the socket figures at their honest standing** — historical reported reading, `BacklogUnread`,
-   `CapacityUnestablished`, `AdoptedOutOfBandRealization`.
-2. **The serving probe** — extdeps rows for the completions route and the metrics counters; window,
-   protocol, ledger, counter-span and rate folds; per-layer witnesses on supplied inputs with one
-   inhabitance claim that runs the real endpoint.
-3. **The CI subject is a FRONTIER, not a bound subject** — which is why this document's title says one
-   bound subject and one frontier. `ci-humming.md` is the June slot/cgroup program and carries the
-   older control/apply architecture; current main has a Firecracker/JIT runner-attempt planner working
-   through fabric identities and execution grants. Stage 3 therefore begins with a producer-and-consumer
-   census of the CURRENT tree, not the historical plan, covering at least: exact Work and source-tree
-   identity, runner image/kernel/rootfs, microVM shape, host class, slot count and memory envelope,
-   jobserver and resource controls, runner/JIT revision, toolchain revision, cache topology and cache
-   state, and dispatch policy. Which of those invalidate a prior rate is decided by that census.
-4. **The CI probe**, binding the same interface to dispatched builds.
-5. **Qualification** — `OperationalQualification` composed from the two standings, with
-   `RealizationQualified` unmintable without its assessment.
-
-## Not yet done, stated plainly
-
-This plan is **not enrolled in DESIGN**. DESIGN.md is generated from `gunbc.design_document` and is
-never hand-edited; a plan is linked from the section that governs it. A file existing under
-`docs/plans/` is not that linkage. Enrolment lands when the design settles, and until then this
-document governs nothing.
diff --git a/docs/plans/typed-module-cross-run-materialization.md b/docs/plans/typed-module-cross-run-materialization.md
deleted file mode 100644
index b00ca3a7baf..00000000000
--- a/docs/plans/typed-module-cross-run-materialization.md
+++ /dev/null
@@ -1,109 +0,0 @@
-# Typed-module materialization across runs
-
-> **Status:** DELETED (2026-10-03), after measurement. The measurement this file was written to
-> run was taken on BuildBuddy (a 65 GB runner, one `claim_batch --claim-run` process over 5 entries,
-> re-derived by arming `GUNBC_TYPED_STORE_PERSIST` against the same invocation unarmed): armed, the
-> cold run exceeded a 720 s cap against ~150 s unarmed without evaluating an entry, and wrote
-> ~7.3 GB in TWO entries; a second armed run also exceeded the cap and wrote nothing new. So each
-> entry was a multi-gigabyte snapshot rather than one module, the store was a large net loss, and
-> nothing bounded its root or cleaned it. The realization (`PersistentTypedStore`), its arming
-> switch, its `cli_run` call sites and the `gunbc.floor_materialization` provider row were deleted
-> in one change; the cross-process demands that row discharged are still declared there and now
-> refuse with no provider. Sections 1-4 below describe the deleted design and are kept only as the
-> record the open compiler-identity roadmap node still cites; nothing below is current behaviour.
-> The replacement is a `TypecheckModuleRequest` store realized through
-> `extdeps.realization.materialization_store_local`, encoded per module, bounded by a byte ceiling
-> with oldest-generation eviction, under a scoped root that cleans itself.
-> **Authority it answers to:** `DESIGN.md`; the ladder's admission rules in
-> `std.materialization_ladder`; the retention vocabulary in `std.cache_interface`.
-> **Framing:** relief during the v1 → v2 migration. Not a parallelism project.
-> **Supersedes the design landed in #11779**, which this file replaced in place, as that design's
-> own status line prescribed for acceptance. Three of its claims did not survive implementation and
-> are withdrawn rather than quietly dropped: the `SharedStateFrame` and `CasTier` choices (§5), the
-> statement that no content key existed, and the cross-push relief its key could not deliver (§2).
-> Its projected figures — 8.3 min → ~1 min, 32 min → ~20 min per push — were never measurements and
-> are not carried forward; §3 is what would establish them.
-
----
-
-## 1. What this is
-
-The typed-module snapshots the in-process tiers already produce now have a host-local,
-content-addressed backing, so the value survives the process that computed it. It is one ladder
-rung — a second provider over the identity `union-typecheck-store(dag,src/v2)` that the in-process
-provider already covers — and not a new cache: the byte transport, the content key and the seam
-are the ones that were already there, and only the backing changed.
-
-## 2. What it delivers, and what it does not
-
-**Delivered: same-build, cross-process reuse.** Two processes running ONE built binary over one
-corpus — the witness fold and the generated-artifact drift gate — each pay typecheck preparation
-in full today. The second one now reads the first one's results.
-
-**Not delivered: cross-push reuse.** The typed-module content key's compiler-identity term is
-`resolved_graph_cache::transform_content_digest()`, the content hash of the running binary, and
-`src/v1/stage0/build.rs` embeds `GUNBC_BUILD_IDENTITY` — the checkout's commit — into that binary
-through `cargo:rustc-env`. A rebuild at any new commit, INCLUDING a corpus-only `.dag` commit,
-therefore re-keys every entry. Any claim that an unchanged module survives a push is unsupported
-until compiler identity is derived from something invariant under a corpus-only commit, which is a
-change to that derivation and not to this store. **The design this file replaces asserted that
-relief; that assertion does not follow from the key it proposed, and is withdrawn.**
-
-The bound is also narrower than "preparation" within one run: a hit skips `collect_parent_envs`
-and the typecheck compute, which is where the preparation wall is spent, but the module is still
-parsed and resolved, because that is what derives the key. Parse is not relieved.
-
-## 3. The measurement that decides whether this was worth it
-
-Not yet run. It is three demonstrations, and the first two are what "working" means here:
-
-1. **Cold → warm, separate processes.** Run the fold and then the drift gate over one corpus under
-   one built binary with the store armed, against the same pair with it unarmed. Compare end-to-end
-   wall, peak RSS, and the fold's subject digest — which must be EQUAL, because a store that
-   changes a verdict is a defect and not a saving. Read the `[typed-store-persist]` line on the
-   floor receipt for hits, misses, rejections, refusals, throughput and LIVE OCCUPANCY.
-2. **An invalidation control.** Edit one module in the corpus and confirm that module and its
-   dependents miss while the rest hit, and that no obsolete result is served.
-3. **A failure control.** Point the store at an unwritable directory, truncate an entry, and fill
-   it past its ceiling. Each must produce a counted cold or refused path. A verification mismatch
-   must be reported as `persist_rejected`, never folded into an ordinary miss.
-
-The Rust-level evidence for (3) and for the store's own properties is
-`persistent_typed_store_tests` in `v1_compiler.shared_typecheck_store`, including the ceiling
-refusal, the truncation rejection, the key-mismatch rejection and the residency-versus-throughput
-distinction. Those are unit-level; (1) and (2) are the production-path receipt and are outstanding.
-
-## 4. How to arm it
-
-Off by default. Three environment variables, read once per process:
-
-- `GUNBC_TYPED_STORE_PERSIST=<dir>` — the host-local directory. Arming is naming it.
-- `GUNBC_TYPED_STORE_PERSIST_MAX_BYTES=<n>` — overrides the modeled ceiling
-  (`floor_typecheck_store_persist_cap_bytes`).
-
-The SOURCE-ROOT SET is not an environment variable: it is taken from the index that asks, because
-resolution is root-relative and the roots are a fact about the computation rather than an
-operator's assertion about it. A second root set inside one process refuses.
-
-## 5. The four operational choices, and why
-
-| Choice | Settled as | Why |
-|---|---|---|
-| Location and ownership | One host-local directory named by the operator, outside the checkout. No daemon, no network service. | The tier is `ArtifactTier`/`LocalFilesystem` by `tier_axes`; anything more is a different provider with a different correctness surface. |
-| Capacity and replacement | `ByteCapacity` with an exact limit, `RefuseNewStore`. | The ladder refuses `ReleasedNever` without a ceiling AND without observed occupancy, so both are obligations. `RefuseNewStore` over LRU because replacement is a second mechanism this bridge does not need: a full store declines, counts, and the run is merely cold. An entry-count bound over a variable-size payload establishes no byte bound. |
-| Warm-seeding | Ordinary runs populate it. No seeding workflow. | A seeding job is a standing cost defended by a benefit nobody has measured yet. |
-| Verification | The cold/warm procedure in §3, operator-invoked. | A scheduled job costs a full preparation by definition and is not a prerequisite for the first relief. |
-
-## 6. Deletion trigger
-
-This is a bridge over the v1 seed, and it ends with its consumer, not with a date: **when the
-authoritative native route replaces the v1 preparation this store sits behind, its persistence
-realization, its arming switch and its provider row are removed together.** v1 deletion does not
-wait for this optimization to become a general platform. The rows are all named
-`floor_typecheck_store_persist_*` in one module and the realization is one section of one file, so
-the removal is a deletion rather than an untangling.
-
-## 7. Non-goals
-
-Threading the resolver, re-sharding the fold, and moving the fold to a hosted runner are all out
-of scope. This change removes repeated work rather than distributing it.
diff --git a/docs/plans/unconsumed-module-census.md b/docs/plans/unconsumed-module-census.md
deleted file mode 100644
index 374f99356bb..00000000000
--- a/docs/plans/unconsumed-module-census.md
+++ /dev/null
@@ -1,1098 +0,0 @@
-# Corpus-wide unconsumed-module census
-
-**Execution record:** the disposition of this population -- what was deleted, and the typed
-reason every held row survived -- is
-[`unconsumed-module-residue-disposition.md`](unconsumed-module-residue-disposition.md).
-This document stays the authority on how the population is derived.
-
-**Status: census only. Nothing is deleted by this document.** It exists to be reviewed
-before any uprooting, per the dispatch: *"337 is too many to delete on one session's
-judgment."*
-
-Operator directive it serves (2026-08-21, verbatim): *"yes please make sure to clean up
-anything without consumers that we don't need, or get them actually consumed."* Both arms
-are live — a module that **should** be consumed and is not is a missing-consumer defect,
-not residue.
-
-## 1. The defensible number
-
-| quantity | value | unit |
-| --- | --- | --- |
-| `.dag` modules under `dag/` + `src/v2` | 3816 | DistinctModuleCount |
-| consumed by discovery, not by import (`/test/`, `*_test.dag`, `/lens/`, `/manual/`, `/fixture*`) | 1928 | DistinctModuleCount |
-| additional roots: named by an entry row (argv `--entry` or an `*entry*:` path field) | 48 | DistinctModuleCount |
-| additional roots: carrying a v1 seed mirror in `src/v1/stage0/src/<module_with_underscores>.rs` | 79 | DistinctModuleCount |
-| reachable from those roots through imports **and qualified calls** | 3518 | DistinctModuleCount |
-| **unreachable on imports, qualified calls, entry rows and seed mirrors** | **298** | DistinctModuleCount |
-| — of those, **consumed by bare-symbol whole-pool reference** (§2 defects 6 and 7, re-scored 2026-08-22) | **≥ 92** | DistinctModuleCount, `LowerBoundOnly` |
-| **unreachable after the re-score — the population as it now stands** | **≤ 206** | DistinctModuleCount, `LowerBoundOnly` |
-| — of those, **residue on every decoded surface** — what a deletion lane consumes (§4h) | **≤ 112** | DistinctModuleCount, `LowerBoundOnly` |
-
-**Every number in this table is a BOUND, not a measurement, and the inequality signs are
-load-bearing.** They sit in the cells because *a bounded number quoted without its boundary
-becomes an exact one in the next reader's hands* — which is how **298** left this document and
-became a deletion list. 206 and 112 are `LowerBoundOnly` for the same reason 298 was, and the
-named blind surfaces (§2: dynamically composed argv, host-side invocation naming neither path
-nor module, an entry row declared inside an unreachable module, and the service-namespace
-credit of §2 defect 7(e)) can only move modules **out** of both. A reader who decodes an
-eighth surface should expect both to fall again; that is the standing working, not failing.
-
-**The 298 is an over-count by at least 92 modules — roughly 31% — concentrated in the batch
-this document proposed to delete first.** It is in the headline table because the headline
-number is the one anyone acts on. **The two numbers answer different questions and must not be
-substituted:** ≤ 206 is the *unresolved population*; ≤ 112 is what a deletion lane may
-actually consume — the 94-module difference is `AMBIGUOUS-SHARED-ONLY` plus `MISSING-FILE`,
-rows unresolved at identity grain rather than proven residue. Method and buckets: §2 defect 6;
-residue list: §4h.
-
-Every number here carries its unit, and two are never interchangeable: a **DistinctFileCount**
-(how many files name a thing) and a **SourceOccurrenceCount** (how many times it is named).
-Reporting one as the other produced the false escalation in §4b; the discipline is cheap: name
-the unit.
-
-**298, not 337.** The inherited figure was an upper bound over a different question (*zero
-importers*), correctly labelled as such. Two independent corrections move it in opposite
-directions and do not cancel:
-
-- *Zero-importer is too narrow.* It cannot see an **island** — a cluster whose members import
-  each other and nothing outside imports any of them. `extdeps/colo/` is one: 18 of its 19
-  modules have zero importers, and the nineteenth (`extdeps.colo.types`) has eighteen, all
-  from inside the island. Reachability from roots catches all 19.
-- *Zero-importer is also too wide.* See the instrument defect in §2.
-
-Re-derived from scratch; the inherited number was not reused.
-
-## 2. Instrument: the universe it decodes, and the defects found in building it
-
-**One cause produced most of what follows.** Every defect below except 1 and 4 has the same
-shape: *a conclusion drawn without reading the surface that would settle it.* Defect 3 scored
-the accelerator family dead without reading qualified calls; defect 5 froze two `tools/` rows
-against a real re-add anchor without reading the `entry:` field surface, and ten more of that
-class turn out to be invoked (see the re-score below); defect 6 scored `module_refs` dead
-without reading bare-symbol resolution; defect 7 scored `pr_digests` dead without reading
-variant constructors, in an instrument built to catch exactly that. The sequencing inversion
-in §5 is the same failure applied to a decision. **In every instance the reasoning was locally
-valid and the missing surface was the whole error**, so the review question is not "was this
-argument sound" but "which surface settles this, and did you read it".
-
-**The rule that catches all of it, stronger than any defect below:** *a control derived from
-the measurement it controls does not discriminate that measurement's blind spot.* Defect 7 was
-invisible to every counter this census produces — the reachable count and the
-CONSUMED-DECISIVE count both come from the defective instrument, so they could not register
-the case it could not see, and read as reassurance *precisely because they stayed consistent*.
-What caught it was the **required floor**, an instrument sharing no method: it refused a
-deletion with `unresolved type MergeReadinessVerdict`. A census's own numbers are never its
-control; only an independent mechanism is.
-
-**This rule is self-demonstrating twice in its own filing.** Defect 7 was checked against this
-census *only* because an independent instrument refused on a different branch — nothing here
-prompted it, and the counters had been stable across every revision. And the three further
-defects inside its fix (generic headers, multi-line variant records, `operation` declarations)
-were found by **hand-reading individual rows before publishing a number**; no counter surfaced
-any of them, and the counters stayed consistent while all three were live. For anyone
-extending this document: **before publishing a count, read enough rows behind it to be wrong
-out loud** — and treat a number that has never disagreed with you as untested, not confirmed.
-
-A corollary governing how this document is read: **where a confidence label and an explicit
-standing disagree, the standing governs.** `RESIDUE-UNMENTIONED` reads as strong evidence of
-deadness; §6's `LowerBoundOnly` says no class in this population is blind-spot-free. The label
-sat on the thing being sequenced and the standing three sections away, so the label won and 13
-live-called modules went into the lead deletion slot. A sequencing decision citing a class
-name rather than the standing is unevidenced however reasonable the name sounds.
-
-The same disease one level down, in the mechanism layer, is what made finding **f** plausible:
-**a name that implies enrolment while the mechanism keys on something else.** Floor discovery
-keys on the **file suffix**; 200 modules are *named* `v2.test.*` without it, and 198 declare
-no test at all (§4h). The name asserts a test-hood nothing grants. Both corollaries are one
-rule — a word doing work only a mechanism can do — and the second is self-demonstrating: this
-census read those names as enrolment until the suffix was checked.
-
-**That rule has three independent sightings, which makes it a pattern**, found by three lanes
-on one night:
-
-1. **200 modules named `v2.test.*`** whose file is not `_test.dag`, of which 2 declare a
-   test (§4h). Named as tests, discovered as nothing.
-2. **`commit_closure_round_trip_probe`** (§4g): a carrier claiming its persistence is
-   *"verified by direct execution"* while the probe it names **is enrolled nowhere and nothing
-   executes it** — a §4b rung-honesty defect, volunteered by the module's own author, not
-   found by any census.
-3. **Vacuous witnesses** in the `spark` lane, reported separately.
-
-The variation says where to look next: the unread surface is **discovery** in (1),
-**enrolment** in (2), and **assertion content** in (3). Same shape, three mechanisms, and
-nothing could refuse any of them — which is why each survived. **A claim that no mechanism can
-refuse is not evidence, whatever it asserts about itself.**
-
-Attribution, because a lesson read as one session's mistakes gets discounted: **defects 1 and
-2 were the dispatching lane's, self-reported** in the brief that commissioned this census.
-**Defect 3 was in both instruments** — theirs and this one's first pass. **Defects 4 and 5
-were this census's own**, neither caught by its author: 4 by review of the first revision,
-after it had produced a false escalation (§4b); 5 by an architecture ruling asking which call
-surfaces the number covered. Two of five found by the measurer; three by someone reading the
-measurement.
-
-1. **Module name is not derivable from the path.** Names come from the declared `module`
-   line. All 3816 files carry one (checked; zero missing).
-2. **Test modules are consumed by discovery, not by imports.** Floor discovery is by
-   **file suffix**, not module prefix — `cli_run.rs` `floor_discovery` selects
-   `rel.ends_with("_test.dag")`. So the exclusion is by path/filename, and a module named
-   `v2.workflow.ci_materialization_emit_test` living in `ci_materialization_emit_test.dag`
-   *is* discovered even though its name is not under a `test.` namespace.
-3. **NEW — qualified calls are consumption without an import.** `.dag` admits a
-   fully-qualified call with no import statement:
-   `dag/test/claim/accelerator_demo_gpu_witness_test.dag` calls
-   `gunbc.accelerator_demo_gpu.witness_m5_gpu_execution_lane_count_grounded()` and never
-   imports the module. An import-line census scores that module dead. Adding
-   qualified-reference edges (over string- and annotation-stripped source, so prose mentions
-   create no false edges) moved the population 333 → 303 and returned the whole
-   `gunbc.accelerator_demo_*` family to *reachable*. **Any earlier orphan number in this repo
-   built from import lines alone over-reports by roughly 10%.**
-
-**No instrument is committed with this document, deliberately.** A hand-authored census script
-beside a substrate that already reads the module graph is the §6 manual-application tell — the
-durable form is a lens over the same `Node` tree, a separate, larger piece of work. The method
-is stated at the grain needed to re-derive the population independently, and §2's three
-defects are what a re-derivation must reproduce to agree.
-
-4. **NEW — a bare substring is not a reference, and one module name is a suffix of another.**
-   `v2.std.verification` *contains* `std.verification`, so a substring scan reported
-   `std.verification` as cited by 128 files; boundary-anchored (not preceded by
-   `[A-Za-z0-9_.]`, not followed by an identifier character) the true count is **6
-   occurrences, one of which is the module's own `module` line**. Same class as defect 3 from
-   the other side — an instrument reading text where it should read structure — and caught by
-   review, not by me. Every mention count in §3 and §6 is boundary-anchored; the census
-   document is excluded from its own scan, which is not pedantry: including it silently
-   reclassified 40 rows out of RESIDUE-UNMENTIONED by naming them. **Rule for whoever measures
-   next: never a bare substring for a module name.** Re-measuring the whole population this
-   way moved only 4 rows — a narrow class, but fatal on exactly the row the census had
-   escalated.
-
-5. **NEW — an entry row is not always spelled `--entry`.** The first revision decoded argv
-   `--entry` and a narrow `entry_file` form, not the `entry: "dag/…"` / `<name>_entry_file:
-   String = "…"` field rows that `gunbc.ci_spec` and the emitted workflows actually use — 764
-   SourceOccurrenceCount of that shape against 116 of the argv shape, so the undecoded surface
-   was the *larger* one. Decoding it moved the population 303 → 298 and returned three modules
-   to consumed, two of which this document had classified FROZEN-PENDING-RE-ADD on the
-   strength of a re-add anchor: `tools.floor_effect_gate_witness` and `tools.ci_heal_dispatch`
-   are not frozen, they are **invoked**. A carve-out argued from a named anchor was still
-   wrong, because the instrument had not read the settling surface.
-
-6. **NEW — whole-pool unqualified resolution is consumption with neither an import nor a
-   qualified name.** v2 resolves a bare symbol against the **whole module pool**, not a
-   containment scope, so a consumer may use a declaration while naming neither the declaring
-   module nor its file. `src/v2/lens/extdeps_shape_transport_policy/` `module_refs.dag` is the
-   worked case: **26 consumer files, all floor-discovered `*_test.dag`, and all 26 name
-   neither `v2.lens.extdeps_shape_transport_policy.module_refs` nor its path** — they write
-   `extdeps_cargo_build_module` bare and the resolver finds it. All 9 of the module's
-   declarations are consumed this way. **Scope of that 26, so a narrower probe's smaller
-   number is not reconciled by splitting the difference:** it counts consumers of *any* of the
-   module's 9 declarations. A probe of the single symbol `extdeps_cargo_build_module` returns
-   **13 consumer files, none naming the module or the path**. Both figures are correct at
-   their own scope; the class is identical. *One caveat, because it recurred:* run that probe
-   after this document names the module and it returns 14 with 1 naming it — the fourteenth is
-   **this file**. Defect 4's rule (the census is excluded from its own scan) is repeated at
-   the receipt because contamination arrives the moment the finding is written down. This
-   class is invisible to a module-name surface and a file-path surface **by construction**:
-   neither string occurs in any consumer. Defect 3 is its near neighbour and does not cover it
-   — a qualified call at least spells the module name, which is what makes defect 3 detectable
-   by a name scan and this one not.
-
-   *Direction, and what is NOT claimed.* Like every §2 surface this one can only move modules
-   **out** of the population. It was measured on one module, reached by re-deriving this
-   census independently; **the whole 298 has not been re-scored against it**, so how many rows
-   it moves is unmeasured and no estimate is offered — §6's `LowerBoundOnly` standing already
-   covers this and needs no revision here. **Rule for whoever measures next, beside the
-   defect-4 rule:** a bare declaration name is a reference too, and in `src/v2/lens/` it is
-   the *normal* one. Restrict such a scan to declaration names **unique corpus-wide**, or it
-   reports collisions on common words (`Stage`, `Review`, `Permission`) as consumption —
-   measured, and the reason this receipt counts unique-owner declarations only.
-
-### The defect-6 re-score of the whole population (2026-08-22)
-
-Defect 6 was found on one module, so the population was re-scored against it. **Method**, so
-it can be re-derived and disagreed with: for each of the 298, take its *declared symbols* —
-not its module name or path — and ask whether any other `.dag` file names one of them
-**bare**. Three restrictions, each removing a false-positive class that was **observed, not
-anticipated**:
-
-- **`.dag` consumers only.** Whole-pool resolution is a resolver behaviour; a mention in
-  `.md` or `.rs` is prose, not consumption.
-- **Comments and string literals stripped with a character scanner, not a regex.** The first
-  pass used `"(?:[^"\\]|\\.)*"` and *failed on real `.dag` strings* —
-  `dag/gunbc/plans/axiom_syllogism_lens.dag` embeds prose containing `\{` interpolation
-  escapes, the regex terminated the literal early, and the exposed prose scored
-  `std.syllogism` as consumed. Caught by hand-reading a sample, not by the instrument.
-- **Identifiers preceded by `.` or followed by `:` are not references.** The first excludes
-  a qualified call's tail (`extdeps.ebay.ebay.create_offer` must not score `create_offer`
-  as bare) and field projection; the second excludes record fields and parameter labels.
-
-**Each filter is reported with its cost, because the intermediate values let a reader judge
-them:** the raw pass scored **98**; excluding qualified-tail and field/label identifiers took
-it to **93**; the character-scanner string strip to **91**; defect 7's variant extraction and
-its three corrections to **93**; the (e)/(f) corrections below to **92**. A bare final number
-would hide that no single filter dominates — itself evidence that none is a fudge factor tuned
-to a target.
-
-**Attribution is by unique ownership, which makes a hit decisive.** A bare symbol declared by
-exactly one module attributes to that module alone. A symbol declared by several does not, and
-is never counted as consumption here.
-
-| bucket | count | meaning |
-| --- | --- | --- |
-| **CONSUMED-DECISIVE** | **92** | a uniquely-owned symbol named bare by a **reachable** `.dag` file. Consumed. |
-| DEAD-CONSUMER-ONLY | 34 | named bare only by other modules *inside* the 298 — the island shape of §4a, still residue. **Deletes as a group or not at all**, see below |
-| AMBIGUOUS-SHARED-ONLY | 93 | named bare only via symbols several modules declare; no attribution possible |
-| STILL-UNCONSUMED | 78 | no bare reference on any surface |
-| MISSING-FILE | 1 | appendix row whose path no longer exists |
-
-Verified by hand-reading the reference site, not by trusting the count:
-`extdeps.filesystem.posix` ← `posix_entry_kind(t: S_IFSOCK)`;
-`gunbc.host_runner_memory_cap_plan_emit` ← `expected_runner_memory_cap_apply_sheet(host:)`;
-`tools.infer_semantics_witness_transport` ← `run_infer_semantics_witness()`;
-`gunbc.install_media`, `gunbc.hostname_allocation`, `v2.extdeps.languages.wasm`. **Zero of
-the six import the module or qualify the name.**
-
-**Where the correction lands, which matters more than the total:**
-
-| disposition (§3) | population | consumed via defect 6 |
-| --- | --- | --- |
-| RESIDUE-EMPTY | 8 | **0** |
-| RESIDUE-UNMENTIONED | 67 | **12** |
-| RESIDUE-DOC-ONLY | 28 | 12 |
-| FROZEN-PENDING-RE-ADD | 13 | 10 |
-| PROSE-NAMED | 79 | 36 |
-| CITED-AUTHORITY | 103 | 22 |
-
-**RESIDUE-UNMENTIONED is the row to read.** §3 calls it *"Delete. Highest-confidence residue"*
-and §5 sequences it as batch B2 because it is *"least exposed to the blind spots, because a
-module named nowhere in any surface is not waiting on a surface to be decoded."* Sound
-reasoning, false premise: the surface it was waiting on had not been decoded, and **12 of
-those 67 are consumed by live callers**. The batch selected *because* it was safest carries
-the most concentrated risk of deleting working code. RESIDUE-EMPTY at 0 of 8 is the control
-showing the instrument is not finding consumption everywhere — a module declaring no symbols
-cannot be bare-referenced, and it scores zero.
-
-**FROZEN-PENDING-RE-ADD, 10 of 13, is the second correction and repeats §2 defect 5 exactly.**
-Those rows were frozen against a named re-add anchor; ten are *invoked now*, by live witnesses
-— `tools.infer_semantics_witness_transport` is called bare by
-`src/v2/test/claim/infer_semantics_witness_test.dag`. As with
-`tools.floor_effect_gate_witness` before them, the anchor was real and the conclusion still
-wrong, because the instrument had not read the settling surface.
-
-**The ambiguity is a finding, not only instrument noise.** 93 modules are unresolvable because
-their symbols are not uniquely owned, and the distribution is not uniform:
-`extdeps_external_authority_anchor` is declared by **102 modules** (the boilerplate citation
-anchor of §3's extdeps duty), `extdeps_model_scope` by 27, and `main` by 11. Under whole-pool
-resolution a bare `main` has 11 candidate declarers. **The repository already measures this
-class every run** — the floor prints `[floor-bare-name-ambiguity] scopes_affected=961 of 1339
-names_total=87040 worst_scope=125`, so 72% of scopes carry at least one ambiguous bare name.
-That line is the corroborating instrument for this bucket, independent of this census. For
-*this* document the meaning is narrow: those 93 rows are **unresolved, not consumed** — they
-stay in the population, and no deletion should read their ambiguity as evidence either way.
-
-**What this re-score does NOT claim.** Not that 206 is the true count: `DEAD-CONSUMER-ONLY`
-and `AMBIGUOUS-SHARED-ONLY` are both unresolved, the appendix rows were not individually
-re-read, and §6's `LowerBoundOnly` standing is unchanged and now applies to 206. It claims one
-thing, enough to block a deletion: **at least 92 of the 298 have a live caller.**
-206. It claims one thing, and it is enough to block a deletion: **at least 92 of the 298
-have a live caller.**
-
-7. **NEW — coproduct VARIANT CONSTRUCTORS are declared symbols, and declaration extraction
-   read only `fn`/`func`/`data`/`type`/`const`.** Defect 6 established that a bare symbol is a
-   reference; this is the same surface missed on its constructor half. `gunbc.pr_digests` owns
-   the type name `MergeReadinessVerdict` but its variants are `Ready` and `NotReady`, and
-   `gunbc.code_change_workflow` names `Ready` **bare, with no import**. Extraction that stops
-   at the `type` line does not own the variants, so `pr_digests` scored residue while
-   consumed. **Found by an independent instrument — the required floor, refusing a deletion
-   with `unresolved type MergeReadinessVerdict` and `8x undefined variable Ready` — not by
-   reasoning about the census.** Re-scoring with variants moves the population:
-   CONSUMED-DECISIVE 91 → **92**, STILL-UNCONSUMED 96 → **78**, and the §4h residue list 131 →
-   **112**.
-
-   *Three further defects were found inside the fix, all by hand-verifying rows before
-   publishing the number, each producing a **false** consumption claim:* (a) a **generic**
-   type header (`type UpsertDecision<P>`) defeated variant extraction, so
-   `std.upsert_decision` did not own `Apply` and `gunbc.apply` looked uniquely to own it; (b)
-   a **multi-line variant record** truncated the scan region, so `llvm_ir` did not own
-   `Select` and `extdeps.transports.sql` looked to own it; (c) `operation Parse {` and
-   `operation Delete {` are **declarations in the flat service namespace**, and were read as
-   references. Each created *false uniqueness* — the mechanism that turns a collision into a
-   confident wrong attribution. Filter costs across the whole re-score: **98 → 93 → 91**
-   (defect 6 filters), then **→ 93** with variants and the three corrections.
-
-   **A fourth extraction bug exists and this document's numbers postdate its fix; a fifth is a
-   real gap with measured zero exposure.** Both were found by the deletion lane running the
-   four discriminating cases published with the extractor — the argument for shipping
-   discriminators rather than bug descriptions, since the check found a bug its author did not
-   have. (d) **Same-line coproducts**: `type PrerequisiteKind = Capability | Credential | …`
-   puts every variant on the type line, so a scan anchored to lines *starting* with `=` or `|`
-   never sees them. A region-based extractor handles it, and all four cases pass on the
-   extractor that produced the counts above, so **every count in this document postdates (d)**
-   — re-verified, not assumed. (e) **`operation` / `service` / `resource` rows are
-   declarations** in the flat service namespace (338 / 8 / 5 in the corpus). This instrument
-   subtracts them from the *consuming* side but does not credit them to the *declaring* side,
-   so a module whose declarations were **only** operation rows would own nothing and could
-   score residue while consumed — the delete-a-live-module direction. **Measured exposure on
-   this population: zero.** No row of the 298 declares nothing-but-operations, and **not one
-   of the 20 operation-bearing rows sits in STILL-UNCONSUMED** (13 AMBIGUOUS, 5 CONSUMED, 2
-   DEAD-CONSUMER-ONLY) — the bucket where a false residue would be dangerous contains none.
-   Mechanism real, no victim here; a lane extending this instrument to another population must
-   credit them.
-
-   **(f) A generic type PARAMETER is a binder, not a reference — one false consumption
-   claim, found while implementing (e).** `type GraphInvariant<Projection> { … }` binds
-   `Projection`; it does not reference `v2.std.projection`, which was that module's *only*
-   link and had scored it CONSUMED-DECISIVE. Excluding the parameter list of a generic
-   declaration moves it to AMBIGUOUS and takes CONSUMED-DECISIVE 93 → **92**.
-
-   ***(f) has two halves, and the obvious fix reaches only one.*** (f1) is the parameter list
-   in the header; **(f2) is every use of the bound name inside that declaration's body** —
-   `type GraphInvariant<Projection> { projection: Projection … }`, where the field type on the
-   next line is a *second, independent* false reference that survives stripping the header.
-   Reported by the deletion lane, whose extractor still failed the discriminator after
-   implementing (f1) exactly as first described here.
-
-   **The tempting fix for (f2) is the delete-a-live-module direction — this document shipped
-   it.** The first implementation here shadowed the bound name **file-wide**, which is wrong:
-   a name bound as a parameter in one declaration may be **genuinely referenced in another**,
-   and removing those references moves a live module *into* residue. The shadow must be scoped
-   to the binding declaration's region — the region walk the variant extractor already
-   performs, run over the reference side. Correcting it **restored 5 real references and moved
-   5 modules out of STILL-UNCONSUMED**, taking the §4h residue list 117 → **112**. Each of
-   those five was a deletion candidate solely because of an over-broad fix to a false-positive
-   defect.
-
-   **The symmetry is three-way, not two.** One construct — a generic header — *defeats*
-   declaration extraction (bug (a)), *inflates* reference extraction in the header (f1), and
-   *inflates it again* in the body (f2); the body half survives the obvious fix for the header
-   half. A binder read as a reference is the representation-vs-subject error this document is
-   about, at the smallest grain the language has.
-
-   **(e) was implemented, and implementing it confirmed the zero.** Crediting
-   `operation`/`resource` names moved **zero** rows — the count-based prediction held. A first
-   cut also credited the service's own short name (`service gcp.Metadata` → `Metadata`), was
-   blamed for a **false** consumption claim on `extdeps.cloud.gcp.sts`, and was withdrawn.
-   **Both halves of that were wrong, and the correction is recorded rather than quietly
-   reverted.** The false claim was caused by **(f)** — the consumer named `Metadata` as a
-   generic type parameter — and the service credit merely stood next to it; with (f2) scoped,
-   restoring the credit moves **zero rows** and `gcp.sts` stays non-consumed. And the stated
-   reason ("no evidence any consumer names a service bare") was refuted by the deletion lane's
-   seventh discriminator: **`dag/extdeps/realization/artifact_store_fs.dag` writes
-   `Filesystem.Write`, `Filesystem.Read` and `Filesystem.Delete` with no import naming
-   `Filesystem`** — a consumer bare-resolving an undotted service through the whole-pool
-   namespace. Worse, withdrawing the credit is the *own-nothing* direction: `Filesystem` is
-   declared **twice** — `service Filesystem` in `extdeps/filesystem/filesystem_io.dag` and
-   `resource Filesystem` in `std/resources.dag` — so dropping the service credit hands
-   `std.resources` **false sole ownership** of a symbol another module visibly declares. The
-   credit is restored, justified by correctness of ownership since the measured effect is nil.
-   *Both wrong answers in this paragraph came from the fix, not the defect* — now the pattern
-   rather than the exception, and the reason every row that moves is read before a number is
-   published.
-
-   **Two non-equivalent fixes for (c), distinguished rather than reconciled.** Subtracting
-   declaration-keyword names from the *consumer's* reference set (this document) is more
-   precise; adding them to the *declaring* module's owned set (the deletion lane) is more
-   conservative, because it pushes a row to AMBIGUOUS where subtraction correctly leaves it in
-   STILL-UNCONSUMED. They disagree in a known direction, and **for a deletion lane the
-   conservative error is the right one** — so the implementations are deliberately not
-   unified: a residue *count* comes from the precise one, a deletion *set* from the
-   conservative one.
-
-   **Direction, and one row that went the other way.** At population level this defect can
-   only move modules *out* of residue. At *row* level it is not one-directional:
-   `extdeps.access.zanzibar` moved CONSUMED-DECISIVE → AMBIGUOUS, because counting variants
-   made a symbol it appeared to own uniquely into a shared one. Losing an attribution is a
-   correction too.
-
-**The universe the 298 is over.** Call surfaces decoded: `import` lines; fully-qualified
-`module.symbol` references (string- and annotation-stripped); argv `--entry` path literals;
-`*entry*:` path-field rows in `.dag`, `.yml`, `.rs`, `.md`, and shell; v1 seed mirrors by
-filename. Surfaces **not** decoded, each of which can only make the population smaller:
-
-- **Dynamically composed argv.** `gunbc.roadmap_serve` is invoked with
-  `--function ", svc.serve_function` — the function is a field read, not a literal. Any
-  entry whose *path* is likewise composed is invisible to this instrument.
-- **Host-side invocation in Rust that names neither the path nor the module.**
-- **An entry row declared inside a module that is itself unreachable** — admitted here as a
-  root, which over-admits consumption. `v2.workflow.product_receipt_stage` is rooted this
-  way by a dead declarer.
-
-**Controls, run on every pass** (a zero is readable only beside a nonzero):
-`v2.compiler.compile`, `gunbc.spark.serving_desired`, `gunbc.clock_read`, `v2.std.node`
-all score *reachable*; `gunbc.accelerator_demo_gpu` scores *reachable* only after defect 3
-was fixed, and it is retained as the standing discriminating control for that arm.
-
-**Known limits of this instrument, stated rather than left to be found.** It cannot see a
-module invoked by a path assembled at runtime, and it treats an `--entry` argv literal
-anywhere in the tree — including in a doc — as a root, deliberately generous: the census
-over-admits consumption, so the population is a floor, and every row still needs the §3
-mention check before deletion.
-
-## 3. Dispositions
-
-Assigned mechanically from evidence, then read. The rule for each class is stated so the
-row can be re-derived and disagreed with.
-
-| disposition | count | rule | what it means |
-| --- | --- | --- | --- |
-| RESIDUE-EMPTY | 8 | ≤5 lines — a `module` line and nothing else | Delete. No content to strand. |
-| CITED-AUTHORITY | 103 | declares an `ExternalAuthority` anchor | **Do not sweep.** The value may be the citation (DESIGN §3 extdeps duty), not a call. Needs a per-island decision, §4. |
-| PROSE-NAMED | 79 | named by live (reachable) `.dag`, `.rs`, or `.yml` source, boundary-anchored | Deleting strands a citation. Each needs the mention read before it moves: superseded, missing-consumer, or delete-with-citation-repair. |
-| FROZEN-PENDING-RE-ADD | 13 | the `.dag` side of a capability whose invoker a cut removed, where the re-add is named | **Not residue.** DESIGN §3 frozen-X: deleting these deletes what the re-add queue exists to re-attach. Each row names its anchor, §4d. |
-| RESIDUE-DOC-ONLY | 28 | named only in `.md`, receipts/TSVs, or other dead modules | Delete; repair the doc citation in the same diff. |
-| RESIDUE-UNMENTIONED | 67 | not named anywhere in the tree outside itself | Delete. Highest-confidence residue. |
-
-Per-module rows: appendix, §6.
-
-**ENTRY-INVOKED is zero here by construction.** The brief's first job was to build the entry
-index and subtract; it is built (48 entry-row roots + 79 seed mirrors) and subtracted *before*
-the population is formed, so every entry-invoked module is already outside the 298. The first
-revision's index was smaller (34 roots) because it decoded only the argv spelling; §2 defect 5
-is what that cost, and why this section reports the index by *surface* rather than as one
-number.
-
-## 4. Named findings
-
-These are the results worth a decision, as opposed to a row.
-
-**a. `extdeps/colo/` — a 19-module island, zero consumers.** Real colocation vendors (Equinix,
-CoreSite, Iron Mountain, QTS, …) with cited authority anchors, importing `extdeps.colo.types`
-and each other, consumed by nothing. One decision, not nineteen: does a siting consumer exist
-or is it planned? If not, the island is the largest single deletion in the census. Same shape,
-smaller: `extdeps/formats/elf/` (7), `extdeps/container/oci/` (5), `extdeps/boot/` (5),
-`extdeps/ebay/` (6), `extdeps/tcgplayer/` (5), `extdeps/llm/` (7).
-
-**b. `std.verification` — delete it; the escalation this census originally raised was an
-instrument artifact.** The first revision reported 120 citing files and asked for an operator
-decision. That count was a substring match against `v2.std.verification` (§2, defect 4).
-Boundary-anchored and verified independently of the review that caught it, the real citation
-surface is small and the deletion ordinary:
-
-- **5 genuine name references, in 2 files**, both plan carriers:
-  `gunbc.plans.resolver_type_name_collision_wall` and
-  `gunbc.plans.realization_measurement_loop`.
-- **1 path reference the name-based scan could not see** — `src/v2/test/fixture/`
-  `frontier_probe_elision_boundary_overlay.dag` pins `"dag/std/verification.dag"` by path
-  **with a content hash**. A fixture pinned by content hash is a consumer: the deletion must
-  move it, not just the prose. This site was not in the review's count either; a name-only
-  census would have found it during the deletion instead of before it.
-
-The second-authority half is measured, not inferred: `dag/std/verification.dag` is 604 bytes
-with 0 importers (`AssertKind`, `AssertionClaim`, `TestCase`); `src/v2/std/verification.dag`
-is 13,813 bytes with 118 importers (`TestgenTier`, `TestClassification`, …). Same name, same
-subject space, and the small one has no consumers — the §3 second-authority shape. Delete the
-604-byte module and repair all three sites in one PR: a plan claim still true points at
-`v2.std.verification`; one no longer true retires with the module. A pointer to a deleted
-authority is not an acceptable landing state.
-
-**c. `src/v2/extdeps/formatters/` (9) and `typecheckers/` (2) — cited config models, no
-consumer, no mention anywhere.** rustfmt, prettier, gofmt, black, ktfmt, clang-format,
-swift-format, google-java-format, lean4-format, mypy, pyright. Modeled upstream config
-surfaces with zero readers. Standing irony: DESIGN's fixed-point rule for the emitted mirror
-is *about* rustfmt, and `v2.extdeps.formatters.rustfmt` is not what implements it.
-Missing-consumer or residue — not a mechanical call.
-
-**d. `dag/gunbc/instruments/` — 13 FROZEN, 5 residue, 2 that turned out to be invoked, and the
-split is per-module.** These are the `.dag` sides of capabilities whose invokers the floor cut
-(2026-08-15) and the regen root cut (2026-08-18) removed. DESIGN's CI paragraph names a
-**re-add queue** with a restoration trigger, and a module the queue exists to re-attach is §3
-frozen-X, not residue — deleting it means re-authoring it worse from memory later. So the
-carve-out is granted **per module against a named anchor**, never to the group:
-
-- **Eight witness transports** — `parse`, `bootstrap`, `dag_collect_fingerprint`,
-  `infer_semantics`, `interp_recorded_fixture`, `effects_rest_transport`,
-  `auth_declared_but_unwired`, `v1_dag_parse`. Anchor: each wraps a Rust binary that
-  **`gunbc.ci_release_bins` (live, reachable) still declares as a CI release artifact**.
-  The binary is retained and the `.dag` invoker is the unattached half — the definition of
-  frozen.
-- **`tools.merge_admission_capture_transport`** and **`tools.merge_admission_current_context`**
-  (merge-admission stamping). Anchor: the gate is named on DESIGN's own unguarded list.
-- **NOT frozen after all: `tools.floor_effect_gate_witness` and `tools.ci_heal_dispatch`.**
-  The first revision froze them on the unguarded-list anchor. Decoding the `entry:` field
-  surface (§2, defect 5) shows both are named by live entry rows — **invoked**, never in the
-  population. Recorded rather than quietly dropped: an anchor can be real and the conclusion
-  still wrong when the instrument has not read the settling surface.
-- **`tools.dag_compile_clean_seam`, `_seam_transport`, `_shard_transport`.** Anchor: DESIGN's
-  compile-clean entry-point trigger — **the weakest of the three anchors, flagged as such**:
-  prose, no binary, no queue line. If that trigger is judged not a queue entry, these three
-  separate out as residue.
-
-**Not on any queue, therefore residue:** `tools.build`, `tools.readme`,
-`tools.roadmap_dispatch`, `tools.codegen` (empty), and `tools.gunbc_ci` — the last is
-**superseded**, not merely unreferenced: it shells out to the old `gunbc ci` generate-and-run
-script, and `gunbc.witness_floor_workflow` → `.github/workflows/witnesses.yml` is what runs CI
-now. That is the §3 second-authority find in this cluster.
-
-Related, and why this cluster is worth naming: **12 of the 298 declare `main()`** — an entry
-shape with no argv anywhere naming it. Four are in `tools/`; the rest are `examples/` and
-three `extdeps` witnesses. An entry that lost its invoker is exactly the residue a
-delete-first cut should surface loudly, and it did not, because nothing downstream could
-refuse.
-
-**e. Eight empty modules.** `std.list`, `std.containers`, `std.import`, `std.rational`,
-`tools.codegen`, `v2.bin.main`, `v2.std.inhabitant_bridge`,
-`v2.std.type_expr_projection_row_schema` — a `module` line and whitespace. `v2.bin.main`
-is the one to look at twice: an empty `main` is a name reserving a seat.
-
-**f. `src/v2/extdeps/language_model/` — 15 unmentioned rung modules** (`*_r2a`, `*_r2b`,
-`*_r3_external` across Go/Python/Rust/TypeScript) beside `*_r1_test.dag` siblings that
-*are* discovered. The `_test`-suffixed rungs run; their non-suffixed peers do not, and
-nothing names them. Likely a ladder that stopped being climbed — but "the rung above the
-one we execute" is a claim about intent, so it is flagged, not classified.
-
-**g. Three modules that landed AFTER this census and are unconsumed — none residue.** Surfaced
-by a second census run independently on 2026-08-22 (population: every `.dag` module scoring
-zero on module name *and* file path; the 14 it returned were 11 instrument artifacts of
-defects 3 and 6 plus these three). All three postdate #8803, which is why §6's appendix does
-not carry them. Dispositions, one per module:
-
-*Why a naive re-run disagrees with the 298, recorded so the next reader does not re-derive
-it.* That second run scored 14 modules unreachable; **none are in this document's 298**, and
-there is no contradiction. Eleven were reachable all along through surfaces this document
-already names: ten by fully-qualified reference (§2, defect 3 — the run required an *exact*
-match against the module name, so `extdeps.bmc.access.redfish_rbac_policy` matched nothing
-because the reference string is *longer* than the module name), and one, `module_refs`, by
-whole-pool resolution (§2, defect 6 — the surface that run contributed). The
-`gunbc.accelerator_demo_*` four-module cluster it returned is the family §2 defect 3 records
-as moved back to *reachable*, and `gunbc.accelerator_demo_gpu` is retained in §2's controls as
-the standing discriminator for that arm. The remaining three are the rows below. **The general
-shape, the part worth keeping:** an import-line or exact-name census over this corpus does not
-merely under-count, it reports a **structural zero indistinguishable from a true zero** —
-deleting `module_refs` on such a reading would have taken 26 live floor-discovered witnesses
-with it while the census showed nothing. Before building a census instrument, search
-`docs/plans` for the census.
-
-- **`gunbc.empty_decl_file_checkpoint_bypass`** (`183e50a3469`) and
-  **`gunbc.generic_binder_field_projection_deficit`** (`aecb1fed927`) — **KEEP; being
-  unconsumed is their correct state, not a defect.** Both are DESIGN §4b error-class filings:
-  declared rung found-at, ceiling with reason, next-rung trigger, dissolution condition.
-  §4b(2) *requires* a class below its ceiling to carry that row, and nothing in §4b makes a
-  code consumer part of the requirement — the row is the filing. Deleting them deletes the
-  safety ledger, and a future census scoring them residue is re-deriving a question this row
-  answers. **The ending event is each carrier's own stated dissolution condition, both bounded
-  events rather than an unbounded "later":** for the first, `lookup_checkpoint` refusing on an
-  empty `decl_file` with every production call site threading identity; for the second, v2
-  inference resolving a generic coproduct's type argument into the arm binder. For a reader
-  checking whether these should carry witnesses: `generic_binder_field_projection_deficit`
-  states in its own header why it does not — §5 construction-over-validation: its
-  discriminating RED was *refused at resolve* because the invalid state has no constructor, so
-  the predicate and its witness were deleted rather than kept as a green that cannot go red.
-
-- **`gunbc.scm.commit_closure_store`** (#8807) — **DELETE. Cause: staged orphan at the wrong
-  grain.** Answered by the `#8820` author (SCM lane, `gentle-eagle-360`), who disposed of it
-  *and* refuted both arms this row originally offered — recorded because a false cause
-  attached to a true deletion is exactly the class this document exists to catch, and this row
-  had asserted both arms as the live possibilities.
-
-  **Arm A ("the envelope grew its own save/load and this deletes with the grain it served")
-  was false.** `gunbc.scm.repository_envelope` contains **zero `Filesystem` operations and not
-  one `func`** (verified independently here) — a pure codec, `RepositoryEnvelope ↔ JsonValue`.
-  Nothing superseded this module, so "replaced by the envelope" would have been a false cause.
-
-  **Arm B ("the envelope should consume it") was false, and is the load-bearing half.** The
-  grains differ: this module persists **one root and its closure**, while a repository has an
-  empty initialized state with *no root*, several commits over one shared node population, and
-  a checked-out selection. Wiring the envelope to a carrier that demands a root would force
-  `init` to invent a phantom commit — a grain mismatch dressed as a fix.
-
-  So it was never wired, and the layer that will do this job is repository-grain and gets
-  written that way regardless. Deleted rather than frozen because **a surviving X is an
-  attractor** (DESIGN §3): while it stands, nearby persistence questions keep being answered
-  in a vocabulary already scheduled to die. *Citation for this row is `gentle-eagle-360`'s
-  disposition message, deliberately **not** a pointer into the module — the module is going
-  away, and a citation into it dies with it.*
-
-  **One defect surfaced with the disposition, volunteered by its author, not found by this
-  census.** The module's header claims its persistence is *"verified by direct execution in
-  Wet mode"* and names `commit_closure_round_trip_probe` as the executable subject. True when
-  it was run **by hand**; not true now. **The probe is enrolled nowhere and nothing executes
-  it** — verified here: no reference to it exists anywhere outside its own module, and the
-  file is not `_test.dag`, so floor discovery never sees it. A carrier asserting executed
-  evidence for a probe that does not run is a §4b **rung-honesty** defect — the reported rung
-  exceeds what executed evidence establishes — and that is why the claim survived
-  unchallenged: nothing could refuse it. The class is in §2's common cause, one sighting of
-  three.
-
-**h. The list the cleanup directive actually points at is 112, not 298 — and two rows in it
-are not what their names say.** Combining the re-score's buckets: **78 STILL-UNCONSUMED (no
-bare reference on any surface) + 34 DEAD-CONSUMER-ONLY (named bare only from *inside* the
-population — §4a's island shape, deleting as a group or not at all) = 112 modules that are
-residue on all three decoded surfaces.** That is the defensible starting point for the
-operator's *"clean up anything without consumers"* arm. The other 186 are not: 92 have live
-callers, and 93 are unresolvable at identity grain and need a per-row read first. **The list
-was 131 before defect 7, and 117 before (f2) below** — of the 19 that left it, only 2 became
-consumed; the rest moved to AMBIGUOUS, meaning no longer provably unconsumed rather than
-proven consumed. That distinction is why the ambiguous bucket exists.
-
-Two observations from reading that population, neither captured by the disposition classes:
-
-- **`v2.test.*` is a name, not an enrolment, and 22 of the 112 are the gap.** Floor discovery
-  is by **file suffix** (§2, defect 2), so a module *named* `v2.test.…` is discovered only if
-  its file ends `_test.dag`. Corpus-wide, **200 modules are named `v2.test.*` whose file does
-  not end `_test.dag`, and exactly 2 of those declare a `test fn`.** Most are ordinary support
-  modules consumed by real witnesses; the 22 here are consumed by nothing, and their names and
-  paths disagree — `v2.test.language_model.go_r1` lives at
-  `src/v2/extdeps/language_model/go_r1.dag`, `v2.test.algebra_laws.zip_eq_list_equality` at
-  `src/v2/std/algebra_laws/`. This subsumes and sharpens finding **f**: those language-model
-  rungs are not merely unclimbed; they are named as tests, declare no test, sit outside any
-  test path, and execute nowhere. **A name that implies enrolment while the mechanism keys on
-  something else is the more useful form of that finding** — the ladder metaphor invites
-  "climb it"; the measurement says "nothing here was ever wired to run."
-**The 35 island rows carry a constraint that is not a preference, and it belongs on the row
-rather than in a report.** A per-module verdict over a mutually-referencing island is
-incoherent: **each member looks consumed until its neighbours go**, so scoring them one at a
-time returns "consumed" for every one and the island never becomes eligible. They delete as a
-group or not at all, and the group is the connected component, not the directory. Otherwise
-the deletion lane meets this as a surprising refusal partway through a batch — the census
-working, but expensively.
-
-- **`gunbc.spark.provisioning`'s appendix row no longer resolves** — the path it names does
-  not exist. It was one of the two rows §5 excluded from every batch as `fierce-lynx-647`'s
-  area. The deletion was deliberate — ruled by the lane that commissioned this census, on the
-  grounds that the model predated knowledge of the real procedure — so the row, not the
-  deletion, is the defect. Recorded because an appendix row pointing at nothing is the
-  staleness class this document polices elsewhere, and a receipt that the population has a
-  clock on it.
-
-**A hazard for whoever measures next, cheap to hit and silent.** A fresh worktree can be
-**shallow-grafted** — the 2026-08-22 run found its clone rooted at a single 4608-file import
-commit dated six days earlier, so `git log <file>` reported that graft commit as the first
-commit of every older module. Any census arm asking *was this consumed until a recent cut*
-(the question separating a severed consumer from §6 experimental residue) silently answers
-from a truncated history. `git rev-parse --is-shallow-repository` before trusting a history
-claim; `git fetch --unshallow` fixes it.
-
-## 5. Proposed sequencing (for approval, not execution)
-
-One red in a 298-file deletion blocks everything, so: small coherent batches, each its own
-PR, each verified by `claim_executor --required-ci --source-root dag --source-root src/v2`
-with `failed=` read and PASS counted against the roster.
-
-1. **B1 — RESIDUE-EMPTY (8).** Nothing to strand; a pure control batch that proves the
-   deletion pipeline and the floor both behave.
-2. **B2 — RESIDUE-UNMENTIONED, non-extdeps (53 of 67). SUPERSEDED BY THE DEFECT-6 RE-SCORE —
-   do not run this batch as written.** The rationale was that an unmentioned module has no
-   citation to repair and is least exposed to a blind spot; the re-score (§2) found **12 of
-   the 67 consumed by live bare-symbol callers**, so this batch would delete working code, and
-   the ordering argument that put it first is what made that risk invisible. It becomes
-   eligible again only over the rows surviving the re-score, and B1 replaces it as the batch
-   to establish the mechanics on (RESIDUE-EMPTY scored 0 of 8 consumed — a module declaring no
-   symbols cannot be bare-referenced).
-3. **B3 — RESIDUE-DOC-ONLY (28).** Deletion plus the doc/receipt citation repair in the
-   same diff.
-4. **B4 — the five `tools/` rows NOT on the re-add queue (finding d)**, including the
-   superseded `tools.gunbc_ci`. The 13 FROZEN-PENDING-RE-ADD rows are in no batch: they stay
-   until their queued gate is re-derived, and their disposition is recorded here so a future
-   census does not re-derive the question and answer "residue".
-5. **B5 — `std.verification` (finding b)** alone: delete the module, repoint the two plan
-   carriers, and move the content-hash fixture pin, all in one PR.
-6. **B6+ — the extdeps islands (finding a, c)**, one island per PR, each gated on whether
-   the citation is the deliverable.
-
-PROSE-NAMED (79) gets no batch until each row's mention has been read; several will resolve to
-*missing consumer* and be wired up rather than deleted — the directive's second arm.
-
-**Excluded from every batch:** `dag/gunbc/spark/` — `fierce-lynx-647` owns that area and is
-mid-census there. Two of the 298 (`gunbc.spark.provisioning`,
-`gunbc.spark.managed_access_apply`) fall in it and are reported here for their benefit
-only. `gunbc.spark.provisioning` is a live instance of the dangling-annotation hazard:
-`extdeps/systems/nvidia_dgx_spark_setup.dag` names it as a fact's home.
-
-
-## 6. Completeness standing
-
-**`LowerBoundOnly`.** 298 resolved-unconsumed modules over the universe declared in §2. Not
-`CompleteForDeclaredUniverse`, and the difference is not modesty: three call surfaces are
-named undecoded in §2, and each can only *remove* modules from the population, never add. Two
-prior revisions each lost modules to a newly decoded surface (333 → 303 → 298) — the empirical
-case for the standing.
-
-What the instrument can support: *298 resolved consumers-of-none over universe U; standing
-LowerBoundOnly; blind spots as named.* What it cannot, and this document nowhere claims:
-*there are exactly 298 unconsumed modules.* The second sentence dies the moment someone
-decodes a fourth surface; the first survives it and says what would change it.
-
-This standing is why §5's batches are ordered as they are — and the 2026-08-22 re-score is the
-case study for why the standing exists. The original ordering argued RESIDUE-UNMENTIONED first
-because *"a module named nowhere in any surface is not waiting on a surface to be decoded."*
-Valid argument, false premise: a surface remained undecoded (§2, defect 6) and 12 of that
-batch had live callers. **A `LowerBoundOnly` standing is not compatible with treating any
-batch as blind-spot-free**, and the deletion order must follow from the standing rather than a
-class name: B1 (RESIDUE-EMPTY) leads because a module declaring no symbols is unreachable by
-*construction* on the bare-symbol surface, not because nobody has mentioned it.
-
-### Two broken entry strings, confirmed
-
-Decoding the entry-row surface also surfaced consumption that is *declared and broken* —
-neither consumed nor residue, invisible to the import graph. Confirmed by reading both sites,
-not by the count:
-
-- **`dag/gunbc/spark/grant_install.dag`** — `gunbc.ci_spec` `gunbc_ci_spark_grant_install_invoke`
-  names it as an entry with function `spark_grant_install_ci_wet`. **The file does not
-  exist.**
-- **`dag/gunbc/spark/serving_durability.dag`** with function
-  `"spark_serving_durability_ci_wet"` — named by `gunbc.ci_spec` *and* by
-  `.github/workflows/fleet-converge.yml`. The file exists; **that function is not in it**
-  (its `fn`s are `spark_serving_boot_id_probe_argv`, `..._from_probe`,
-  `spark_serving_reboot_transition`, `spark_serving_durability_verdict`, `..._is_proven`,
-  `..._wire`).
-
-Both are in `dag/gunbc/spark/`, `fierce-lynx-647`'s area — reported, not touched. A sibling
-lane found the same two independently: a second instrument agreeing, not a second report of
-one measurement.
-
-**Not defects, named so a future sweep does not "fix" them:** the raw scan also flags
-`dag/a.dag`, `dag/mini.dag`, `dag/gunbc/live_deploy/WRONG_ENTRY.dag`,
-`dag/test/claim/__no_such_entry_zzz.dag` and similar. Those are *deliberate negative controls*
-inside witness tests — an entry that must fail to resolve. An instrument reporting them is
-producing false positives, which is what §7's last case exists to catch.
-
-## 7. Calibration benchmark for the next audit instrument
-
-Today's failures, written as cases rather than prose, so a future instrument calibrates
-against a suite instead of rediscovering all five. Each case names a real subject in this
-tree, the wrong answer, and the honest answer.
-
-| # | case | subject | wrong answer | required answer |
-| --- | --- | --- | --- | --- |
-| 1 | **cardinality** | `std.verification` | one number for "how cited" | **both** units: SourceOccurrenceCount 6 **and** DistinctFileCount 3 — they are different questions |
-| 2 | **exact identity** | `std.verification` vs `v2.std.verification` | substring match folds them | boundary-anchored: the two stay separate, and the suffix relation never merges them |
-| 3 | **representation vs subject** | any modeled capability | "spelling absent ⟹ capability absent" | a typed model present with zero occurrences of its shell spelling means capability PRESENT, spelling ABSENT — **no absence conclusion** |
-| 4 | **qualified use** | `gunbc.accelerator_demo_gpu` ← `dag/test/claim/accelerator_demo_gpu_witness_test.dag` | orphan (no import line) | caller edge PRESENT; an import-line census must declare itself incomplete |
-| 5 | **string-bound entry** | `dag/gunbc/spark/serving_durability.dag` + `spark_serving_durability_ci_wet` | consumed (path resolves) | **resolution REFUSED** — path present, function absent; neither consumed nor residue |
-| 6 | **positive no-finding** | `dag/gunbc/live_deploy/WRONG_ENTRY.dag`, `dag/a.dag`, `__no_such_entry_zzz.dag`; and any healthy imported module | flagged as broken/orphaned | **no finding** — deliberate negative controls and ordinary live modules must come back clean |
-
-Case 6 is the one most likely to be skipped and the one that catches a broken audit: a suite
-built only from defects is passed by an instrument reporting *everything* as suspicious. Cases
-1, 2, 4, 5 each have a live specimen in this tree, so the suite is executable against the real
-corpus rather than a fixture someone must maintain.
-
-## 8. Appendix — the 298 rows
-
-### RESIDUE-EMPTY — 8 modules
-
-| module | path | lines | live-source mentions |
-| --- | --- | --- | --- |
-| `std.containers` | `dag/std/containers.dag` | 2 | —  |
-| `std.import` | `dag/std/import.dag` | 2 | {'dag': 1} `dag/gunbc/commit_workflow.dag` |
-| `std.list` | `dag/std/list.dag` | 3 | —  |
-| `std.rational` | `dag/std/rational.dag` | 5 | {'dag': 2} `dag/gunbc/doc_graph_roots.dag` `dag/gunbc/econ/acquisition.dag` |
-| `tools.codegen` | `dag/gunbc/instruments/codegen.dag` | 5 | —  |
-| `v2.bin.main` | `src/v2/bin/main.dag` | 4 | —  |
-| `v2.std.inhabitant_bridge` | `src/v2/std/inhabitant_bridge.dag` | 4 | —  |
-| `v2.std.type_expr_projection_row_schema` | `src/v2/std/type_expr_projection_row_schema.dag` | 4 | —  |
-
-### RESIDUE-UNMENTIONED — 67 modules
-
-| module | path | lines | live-source mentions |
-| --- | --- | --- | --- |
-| `config.codegen_paths` | `dag/config/codegen_paths.dag` | 20 | —  |
-| `examples.html_markup_smoke` | `dag/examples/html_markup_smoke/html_markup_smoke.dag` | 66 | —  |
-| `examples.js_site` | `dag/examples/js_site/js_site.dag` | 185 | —  |
-| `examples.js_site_emit` | `dag/examples/js_site/js_site_emit.dag` | 76 | —  |
-| `examples.nominal_distinctness_twin` | `dag/examples/nominal_distinctness_witness/twin.dag` | 15 | —  |
-| `examples.nominal_distinctness_witness` | `dag/examples/nominal_distinctness_witness/witness.dag` | 19 | —  |
-| `gunbc.assimilate.bmc_wif_canary_bootstrap` | `dag/gunbc/assimilate/bmc_wif_canary_bootstrap.dag` | 126 | —  |
-| `gunbc.ci_oom_reclassify` | `dag/gunbc/ci/ci_oom_reclassify.dag` | 87 | —  |
-| `gunbc.cursor_sdk_secure_api_key` | `dag/gunbc/cursor_sdk_secure_api_key.dag` | 73 | —  |
-| `gunbc.devboot.vertical_receipt` | `dag/gunbc/devboot/vertical_receipt.dag` | 68 | —  |
-| `gunbc.host_converge_delta` | `dag/gunbc/host/host_converge_delta.dag` | 119 | —  |
-| `gunbc.install_media` | `dag/gunbc/install_media.dag` | 43 | —  |
-| `gunbc.parse_allowlist` | `dag/gunbc/parse_allowlist.dag` | 20 | —  |
-| `gunbc.plans.wave2_prep_design` | `dag/gunbc/plans/wave2_prep_design.dag` | 205 | —  |
-| `gunbc.provider_standing_live_probes` | `dag/gunbc/provider_standing_live_probes.dag` | 194 | —  |
-| `gunbc.srv4_seeded_install_media_artifact` | `dag/gunbc/srv4_seeded_install_media_artifact.dag` | 47 | —  |
-| `gunbc.tools.bmc_onboard_validate` | `dag/gunbc/tools/bmc_onboard_validate.dag` | 22 | —  |
-| `gunbc.tools.ebay_listing` | `dag/gunbc/tools/ebay_listing.dag` | 143 | —  |
-| `gunbc.tools.roadmap_spawn_request` | `dag/gunbc/tools/roadmap_spawn_request.dag` | 36 | —  |
-| `std.binding` | `dag/std/binding.dag` | 7 | —  |
-| `std.syllogism` | `dag/std/syllogism.dag` | 82 | —  |
-| `tools.build` | `dag/gunbc/instruments/build.dag` | 34 | —  |
-| `tools.readme` | `dag/gunbc/instruments/readme.dag` | 70 | —  |
-| `tools.roadmap_dispatch` | `dag/gunbc/instruments/roadmap_dispatch.dag` | 17 | —  |
-| `v2.extdeps.formats.csv` | `src/v2/extdeps/formats/csv.dag` | 136 | —  |
-| `v2.extdeps.formats.openapi` | `src/v2/extdeps/formats/openapi.dag` | 459 | —  |
-| `v2.extdeps.formats.toml` | `src/v2/extdeps/formats/toml.dag` | 132 | —  |
-| `v2.extdeps.formatters.black` | `src/v2/extdeps/formatters/black.dag` | 87 | —  |
-| `v2.extdeps.formatters.clang_format` | `src/v2/extdeps/formatters/clang_format.dag` | 893 | —  |
-| `v2.extdeps.formatters.gofmt` | `src/v2/extdeps/formatters/gofmt.dag` | 14 | —  |
-| `v2.extdeps.formatters.google_java_format` | `src/v2/extdeps/formatters/google_java_format.dag` | 22 | —  |
-| `v2.extdeps.formatters.ktfmt` | `src/v2/extdeps/formatters/ktfmt.dag` | 81 | —  |
-| `v2.extdeps.formatters.lean4_format` | `src/v2/extdeps/formatters/lean4_format.dag` | 189 | —  |
-| `v2.extdeps.formatters.prettier` | `src/v2/extdeps/formatters/prettier.dag` | 191 | —  |
-| `v2.extdeps.formatters.rustfmt` | `src/v2/extdeps/formatters/rustfmt.dag` | 286 | —  |
-| `v2.extdeps.formatters.swift_format` | `src/v2/extdeps/formatters/swift_format.dag` | 110 | —  |
-| `v2.extdeps.typecheckers.mypy` | `src/v2/extdeps/typecheckers/mypy.dag` | 29 | —  |
-| `v2.extdeps.typecheckers.pyright` | `src/v2/extdeps/typecheckers/pyright.dag` | 47 | —  |
-| `v2.std.generic_instantiation` | `src/v2/std/generic_instantiation.dag` | 36 | —  |
-| `v2.std.projection` | `src/v2/std/projection.dag` | 19 | —  |
-| `v2.test.algebra_laws.is_prefix_of_prefix_check` | `src/v2/std/algebra_laws/is_prefix_of_prefix_check.dag` | 90 | —  |
-| `v2.test.algebra_laws.zip_eq_list_equality` | `src/v2/std/algebra_laws/zip_eq_list_equality.dag` | 93 | —  |
-| `v2.test.language_model.go_r1` | `src/v2/extdeps/language_model/go_r1.dag` | 59 | —  |
-| `v2.test.language_model.go_r2a` | `src/v2/extdeps/language_model/go_r2a.dag` | 59 | —  |
-| `v2.test.language_model.go_r2b` | `src/v2/extdeps/language_model/go_r2b.dag` | 59 | —  |
-| `v2.test.language_model.go_r3_external` | `src/v2/extdeps/language_model/go_r3_external.dag` | 59 | —  |
-| `v2.test.language_model.python_cross_runtime_drift` | `src/v2/extdeps/language_model/python_cross_runtime_drift.dag` | 49 | —  |
-| `v2.test.language_model.python_l2_cross_target_parity` | `src/v2/extdeps/language_model/python_l2_cross_target_parity.dag` | 81 | —  |
-| `v2.test.language_model.python_r2a` | `src/v2/extdeps/language_model/python_r2a.dag` | 58 | —  |
-| `v2.test.language_model.python_r2b` | `src/v2/extdeps/language_model/python_r2b.dag` | 53 | —  |
-| `v2.test.language_model.python_r3_external` | `src/v2/extdeps/language_model/python_r3_external.dag` | 58 | —  |
-| `v2.test.language_model.rust` | `src/v2/extdeps/language_model/rust.dag` | 256 | —  |
-| `v2.test.language_model.rust_r2a` | `src/v2/extdeps/language_model/rust_r2a.dag` | 57 | —  |
-| `v2.test.language_model.rust_r2b` | `src/v2/extdeps/language_model/rust_r2b.dag` | 75 | —  |
-| `v2.test.language_model.rust_r3_external` | `src/v2/extdeps/language_model/rust_r3_external.dag` | 57 | —  |
-| `v2.test.language_model.typescript_r2a` | `src/v2/extdeps/language_model/typescript_r2a.dag` | 58 | —  |
-| `v2.test.language_model.typescript_r2b` | `src/v2/extdeps/language_model/typescript_r2b.dag` | 54 | —  |
-| `v2.test.language_model.typescript_r3_external` | `src/v2/extdeps/language_model/typescript_r3_external.dag` | 58 | —  |
-| `v2.test.nat_semiring.rung_0_to_2_three_targets` | `src/v2/std/nat_semiring/rung_0_to_2_three_targets.dag` | 95 | —  |
-| `v2.test.nat_semiring.rung_l1_go_compiler_slice` | `src/v2/std/nat_semiring/rung_l1_go_compiler_slice.dag` | 58 | —  |
-| `v2.test.nat_semiring.rung_l1_python_runtime` | `src/v2/std/nat_semiring/rung_l1_python_runtime.dag` | 96 | —  |
-| `v2.test.qualified_name.from_node` | `src/v2/std/qualified_name/from_node.dag` | 222 | —  |
-| `v2.workflow.bmc_lifecycle_roundtrip` | `src/v2/workflow/bmc_lifecycle_roundtrip.dag` | 38 | —  |
-| `v2.workflow.ci_v1_compiler_test_targets_compile_gate_emit` | `src/v2/workflow/ci_v1_compiler_test_targets_compile_gate_emit.dag` | 110 | —  |
-| `v2.workflow.floor2_prepared_subject` | `src/v2/workflow/floor2_prepared_subject.dag` | 182 | —  |
-| `v2.workflow.gha_expression_fidelity` | `src/v2/workflow/gha_expression_fidelity.dag` | 22 | —  |
-| `v2.workflow.probe_selector_host_health` | `src/v2/workflow/probe_selector_host_health.dag` | 43 | —  |
-
-### RESIDUE-DOC-ONLY — 28 modules
-
-| module | path | lines | live-source mentions |
-| --- | --- | --- | --- |
-| `examples.cost_estimate` | `dag/examples/cost_estimate/cost_estimate.dag` | 29 | —  |
-| `examples.gunbhub_serve_program` | `dag/examples/gunbhub_serve_program/gunbhub_serve_program.dag` | 60 | —  |
-| `examples.interp_test` | `dag/examples/interp_test/interp_example.dag` | 40 | —  |
-| `gunbc.code_change_workflow` | `dag/gunbc/code_change_workflow.dag` | 371 | —  |
-| `gunbc.floor_resolve_realization` | `dag/gunbc/floor_resolve_realization.dag` | 28 | —  |
-| `gunbc.hand_lens_host_bridge_scaffold_watchdog` | `dag/gunbc/hand_lens_host_bridge_scaffold_watchdog.dag` | 46 | —  |
-| `gunbc.host_runner_memory_cap_plan_emit` | `dag/gunbc/host/host_runner_memory_cap_plan_emit.dag` | 110 | —  |
-| `gunbc.hostname_allocation` | `dag/gunbc/hostname_allocation.dag` | 148 | —  |
-| `gunbc.language_subject_scope_scaffold` | `dag/gunbc/language_subject_scope_scaffold.dag` | 10 | —  |
-| `gunbc.p3a1_self_fork_homonym_disposition` | `dag/gunbc/p3a1_self_fork_homonym_disposition.dag` | 10 | —  |
-| `gunbc.pr_digests` | `dag/gunbc/pr_digests.dag` | 72 | —  |
-| `gunbc.site.register_principles` | `dag/gunbc/site/register_principles.dag` | 12 | —  |
-| `gunbc.spark.managed_access_apply` | `dag/gunbc/spark/managed_access_apply.dag` | 453 | —  |
-| `gunbc.tools.card_intake` | `dag/gunbc/tools/card_intake.dag` | 216 | —  |
-| `gunbc.tools.cron_tag` | `dag/gunbc/tools/cron_tag.dag` | 67 | —  |
-| `gunbc.tools.grounding_confirm` | `dag/gunbc/tools/grounding_confirm.dag` | 115 | —  |
-| `gunbc.witness_family_fanout` | `dag/gunbc/witness_family_fanout.dag` | 65 | —  |
-| `shared.dag_util` | `dag/shared/dag_util.dag` | 44 | —  |
-| `std.exec_format` | `dag/std/exec_format.dag` | 37 | —  |
-| `std.patterns` | `dag/std/patterns.dag` | 24 | —  |
-| `v2.extdeps.bmc.lifecycle_fidelity` | `src/v2/extdeps/bmc/lifecycle_fidelity.dag` | 146 | —  |
-| `v2.extdeps.formats.json` | `src/v2/extdeps/formats/json.dag` | 52 | —  |
-| `v2.extdeps.formats.json_schema` | `src/v2/extdeps/formats/json_schema.dag` | 103 | —  |
-| `v2.extdeps.formats.yaml` | `src/v2/extdeps/formats/yaml.dag` | 85 | —  |
-| `v2.extdeps.github.expression_fidelity` | `src/v2/extdeps/github/expression_fidelity.dag` | 54 | —  |
-| `v2.std.rust_leaf_model_claim` | `src/v2/std/rust_leaf_model_claim.dag` | 61 | —  |
-| `v2.test.workflow.host_discovered_owned_data_manifest` | `src/v2/workflow/host_discovered_owned_data_manifest.dag` | 19 | —  |
-| `v2.workflow.ci_stage0_partition_compile_gate_emit` | `src/v2/workflow/ci_stage0_partition_compile_gate_emit.dag` | 103 | —  |
-
-### FROZEN-PENDING-RE-ADD — 13 modules
-
-| module | path | lines | re-add anchor |
-| --- | --- | --- | --- |
-| `tools.auth_declared_but_unwired_witness_transport` | `dag/gunbc/instruments/auth_declared_but_unwired_witness_transport.dag` | 12 | `auth_declared_but_unwired_witness` bin, still declared in `gunbc.ci_release_bins` |
-| `tools.bootstrap_witness_transport` | `dag/gunbc/instruments/bootstrap_witness_transport.dag` | 12 | `bootstrap_witness` bin, still declared in `gunbc.ci_release_bins` |
-| `tools.dag_collect_fingerprint_witness_transport` | `dag/gunbc/instruments/dag_collect_fingerprint_witness_transport.dag` | 12 | `dag_collect_fingerprint_witness` bin, still declared in `gunbc.ci_release_bins` |
-| `tools.dag_compile_clean_seam` | `dag/gunbc/instruments/dag_compile_clean_seam.dag` | 110 | compile-clean entry point — WEAKER ANCHOR: a prose restoration trigger in DESIGN, no bin and no queue line |
-| `tools.dag_compile_clean_seam_transport` | `dag/gunbc/instruments/dag_compile_clean_seam_transport.dag` | 124 | compile-clean entry point — WEAKER ANCHOR, as above |
-| `tools.dag_compile_clean_shard_transport` | `dag/gunbc/instruments/dag_compile_clean_shard_transport.dag` | 43 | compile-clean entry point — WEAKER ANCHOR, as above |
-| `tools.effects_rest_transport_witness_transport` | `dag/gunbc/instruments/effects_rest_transport_witness_transport.dag` | 12 | `effects_rest_transport_witness` bin, still declared in `gunbc.ci_release_bins` |
-| `tools.infer_semantics_witness_transport` | `dag/gunbc/instruments/infer_semantics_witness_transport.dag` | 12 | `infer_semantics_witness` bin, still declared in `gunbc.ci_release_bins` |
-| `tools.interp_recorded_fixture_witness_transport` | `dag/gunbc/instruments/interp_recorded_fixture_witness_transport.dag` | 13 | `interp_recorded_fixture_witness` bin, still declared in `gunbc.ci_release_bins` |
-| `tools.merge_admission_capture_transport` | `dag/gunbc/instruments/merge_admission_capture_transport.dag` | 32 | merge-admission stamping — named on DESIGN's unguarded list |
-| `tools.merge_admission_current_context` | `dag/gunbc/instruments/merge_admission_current_context.dag` | 134 | merge-admission stamping — named on DESIGN's unguarded list |
-| `tools.parse_witness_transport` | `dag/gunbc/instruments/parse_witness_transport.dag` | 20 | `parse_witness` bin, still declared in `gunbc.ci_release_bins` |
-| `tools.v1_dag_parse_transport` | `dag/gunbc/instruments/v1_dag_parse_transport.dag` | 12 | `v1_src_dag_parse` bin, still declared in `gunbc.ci_release_bins` |
-
-### PROSE-NAMED — 79 modules
-
-| module | path | lines | live-source mentions |
-| --- | --- | --- | --- |
-| `direct_rust_door_ingest_fixture` | `src/v2/compiler/self_host/direct_rust_door_ingest_fixture.dag` | 6 | {'dag': 1} `src/v2/compiler/self_host/direct_rust_door_fixture.dag` |
-| `examples.weather` | `dag/examples/weather/weather.dag` | 48 | {'rs': 1} `src/v1/stage0/src/bin/bootstrap_witness.rs` |
-| `extdeps.bmc.mock_corpus` | `dag/extdeps/bmc/mock_corpus.dag` | 71 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.cloud.gcp.mock_corpus` | `dag/extdeps/cloud/gcp/mock_corpus.dag` | 110 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.cron.mock_corpus` | `dag/extdeps/cron/mock_corpus.dag` | 22 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.diagnostic.mock_corpus` | `dag/extdeps/diagnostic_mock_corpus.dag` | 39 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.ebay.mock_corpus` | `dag/extdeps/ebay/mock_corpus.dag` | 79 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.filesystem.mock_corpus` | `dag/extdeps/filesystem/mock_corpus.dag` | 22 | {'dag': 2} `dag/gunbc/extdeps_scope_frontier.dag` `dag/gunbc/plans/m4_universal_hermetic_corpus.dag` |
-| `extdeps.git.mock_corpus` | `dag/extdeps/git/mock_corpus.dag` | 167 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.github.mock_corpus` | `dag/extdeps/github/mock_corpus.dag` | 71 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.linux.mock_corpus` | `dag/extdeps/linux/mock_corpus.dag` | 15 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.llm.mock_corpus` | `dag/extdeps/llm/mock_corpus.dag` | 55 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.sec.mock_corpus` | `dag/extdeps/sec/mock_corpus.dag` | 23 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.shell.mock_corpus` | `dag/extdeps/shell_mock_corpus.dag` | 31 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.tcgplayer.mock_corpus` | `dag/extdeps/tcgplayer/mock_corpus.dag` | 63 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `gunbc.apply` | `dag/gunbc/apply.dag` | 118 | {'dag': 2} `dag/gunbc/runner/runner_lifecycle.dag` `dag/gunbc/runner/runner_capacity_realize.dag` |
-| `gunbc.auth.credentials` | `dag/gunbc/auth/credentials.dag` | 89 | {'dag': 1, 'rs': 1} `dag/gunbc/tailscale_acl_phase2_credential.dag` `src/v1/stage0/src/bin/parse_witness.rs` |
-| `gunbc.auth.optional_impersonation` | `dag/gunbc/auth/optional_impersonation.dag` | 20 | {'dag': 2} `dag/test/claim/tailscale_acl_phase2_design_witness_test.dag` `dag/gunbc/tailscale_acl_phase2_credential.dag` |
-| `gunbc.auth.patterns` | `dag/gunbc/auth/patterns.dag` | 113 | {'rs': 1} `src/v1/stage0/src/cli_run.rs` |
-| `gunbc.bootstrap` | `dag/gunbc/bootstrap.dag` | 126 | {'dag': 2} `dag/gunbc/doc_graph_roots.dag` `src/v2/compiler/self_host/frontier_probe_types.dag` |
-| `gunbc.char_at_scaling_probe_support` | `dag/gunbc/char_at_scaling_probe_support.dag` | 58 | {'rs': 1} `src/v1/stage0/src/bin/char_at_scaling_probe.rs` |
-| `gunbc.ci_build_job_v1_compiler_unit_receipt` | `dag/gunbc/ci/ci_build_job_v1_compiler_unit_receipt.dag` | 21 | {'dag': 1} `dag/gunbc/ci/ci_spec.dag` |
-| `gunbc.ci_input_envelope` | `dag/gunbc/ci/ci_input_envelope.dag` | 86 | {'dag': 3} `dag/gunbc/doc_graph_roots.dag` `dag/gunbc/plans/bounded_input_cost_envelope_scheduling.dag` |
-| `gunbc.compile_source_model` | `dag/gunbc/compile_source_model.dag` | 65 | {'dag': 1} `dag/gunbc/plans/seed_debt_bundle_item_2.dag` |
-| `gunbc.deployed_intent_v0` | `dag/gunbc/deployed_intent_v0.dag` | 61 | {'dag': 2} `dag/gunbc/host/host_standup.dag` `dag/gunbc/host/host_identity_adopt.dag` |
-| `gunbc.deployed_intent_v1` | `dag/gunbc/deployed_intent_v1.dag` | 69 | {'dag': 1} `dag/gunbc/host/host_standup.dag` |
-| `gunbc.design_argument` | `dag/gunbc/design_argument.dag` | 93 | {'dag': 1} `dag/gunbc/plans/axiom_syllogism_lens.dag` |
-| `gunbc.githooks_pre_push_cli` | `dag/gunbc/githooks/githooks_pre_push_cli.dag` | 10 | {'dag': 2, 'rs': 2} `dag/std/emit_on_demand.dag` `dag/gunbc/githooks/githooks_pre_push_fmt_transport_scaffold.dag` |
-| `gunbc.host_authorized_keys_reconcile` | `dag/gunbc/host/host_authorized_keys_reconcile.dag` | 104 | {'dag': 1} `dag/gunbc/build_cache/build_cache_instance.dag` |
-| `gunbc.host_build_cache_provision` | `dag/gunbc/host/host_build_cache_provision.dag` | 335 | {'dag': 4} `dag/gunbc/build_cache/build_cache_instance.dag` `dag/gunbc/fleet/fleet_host_budget.dag` |
-| `gunbc.host_identity_assimilation` | `dag/gunbc/host/host_identity_assimilation.dag` | 266 | {'dag': 3} `dag/gunbc/host/host_standup.dag` `dag/gunbc/host/host_identity_adopt.dag` |
-| `gunbc.host_identity_converge` | `dag/gunbc/host/host_identity_converge.dag` | 250 | {'dag': 1} `dag/gunbc/host/host_standup.dag` |
-| `gunbc.host_identity_knob` | `dag/gunbc/host/host_identity_knob.dag` | 55 | {'dag': 1} `dag/gunbc/host/host_standup.dag` |
-| `gunbc.host_identity_observation` | `dag/gunbc/host/host_identity_observation.dag` | 89 | {'dag': 1} `dag/gunbc/host/host_standup.dag` |
-| `gunbc.host_network_diagnosis` | `dag/gunbc/host/host_network_diagnosis.dag` | 213 | {'dag': 1} `dag/gunbc/prose_row_frontier.dag` |
-| `gunbc.host_toolchain_components` | `dag/gunbc/host/host_toolchain_components.dag` | 195 | {'dag': 1} `dag/gunbc/prose_row_frontier.dag` |
-| `gunbc.interpreter_kernel_model` | `dag/gunbc/interpreter_kernel_model.dag` | 82 | {'dag': 1} `dag/gunbc/plans/interpreter_kernel_d.dag` |
-| `gunbc.namespace_census_receipt` | `dag/gunbc/namespace/namespace_census_receipt.dag` | 74 | {'dag': 1} `dag/gunbc/doc_graph_roots.dag` |
-| `gunbc.network_identity_subsumption` | `dag/gunbc/network_identity_subsumption.dag` | 134 | {'dag': 5} `dag/test/claim/dgx_spark_witness_test.dag` `dag/test/claim/host_phase_status_witness_test.dag` |
-| `gunbc.p1_retention_cohort_receipt` | `dag/gunbc/p1_retention_cohort_receipt.dag` | 8 | {'dag': 1} `dag/gunbc/doc_graph_roots.dag` |
-| `gunbc.plans.affected_set_self_confirmation` | `dag/gunbc/plans/affected_set_self_confirmation.dag` | 29 | {'rs': 1} `src/v1/stage0/src/cli_run.rs` |
-| `gunbc.plans.branch_merge_admission_model` | `dag/gunbc/plans/branch_merge_admission_model.dag` | 172 | {'dag': 2} `dag/test/claim/merge_lifecycle_interleaving_witness_test.dag` `dag/gunbc/merge_lifecycle.dag` |
-| `gunbc.plans.fleet_subsumption_manual_gaps` | `dag/gunbc/plans/fleet_subsumption_manual_gaps.dag` | 196 | {'dag': 12} `dag/test/claim/retained_shell_script_witness_test.dag` `dag/gunbc/build_cache/build_cache_instance.dag` |
-| `gunbc.plans.host_convergence_circuit_residue` | `dag/gunbc/plans/host_convergence_circuit_residue.dag` | 75 | {'dag': 1} `dag/gunbc/host/host_converge.dag` |
-| `gunbc.plans.merge_admission_gate_shape_proposal` | `dag/gunbc/plans/merge_admission_gate_shape_proposal.dag` | 78 | {'dag': 1} `dag/gunbc/merge_admission.dag` |
-| `gunbc.plans.transport_argv_anemia_dissolution` | `dag/gunbc/plans/transport_argv_anemia_dissolution.dag` | 89 | {'dag': 2} `dag/extdeps/git/git.dag` `dag/extdeps/exec/command.dag` |
-| `gunbc.process_algebra` | `dag/gunbc/process_algebra.dag` | 147 | {'dag': 3} `dag/gunbc/doc_graph_roots.dag` `dag/gunbc/plans/invert_hand_maintained.dag` |
-| `gunbc.runner_slot_enforcement` | `dag/gunbc/runner/runner_slot_enforcement.dag` | 129 | {'dag': 3} `dag/gunbc/host/host_standup.dag` `dag/gunbc/runner/runner_slot_allocation.dag` |
-| `gunbc.seed_closed_vocabulary_wildcard_census` | `dag/gunbc/seed_closed_vocabulary_wildcard_census.dag` | 175 | {'rs': 1} `src/v1/stage0/src/cli_run.rs` |
-| `gunbc.site.interaction` | `dag/gunbc/site/interaction.dag` | 14 | {'dag': 1} `dag/gunbc/design/interaction.dag` |
-| `gunbc.spark.provisioning` | `dag/gunbc/spark/provisioning.dag` | 543 | {'dag': 2} `dag/extdeps/systems/nvidia_dgx_spark_setup.dag` `dag/test/claim/spark_provisioning_witness_test.dag` |
-| `gunbc.srv3_os_install_diagnostic` | `dag/gunbc/srv3/srv3_os_install_diagnostic.dag` | 1410 | {'dag': 1} `dag/gunbc/non_fold_residue.dag` |
-| `gunbc.tailscale_acl_emit` | `dag/gunbc/tailscale_acl_emit.dag` | 52 | {'dag': 1} `dag/gunbc/host/host_standup.dag` |
-| `gunbc.test_node_wall_clock_ratchet` | `dag/gunbc/test_node_wall_clock_ratchet.dag` | 99 | {'dag': 1} `dag/gunbc/plans/structural_quadratic_wall_coverage_audit.dag` |
-| `gunbc.tools.review` | `dag/gunbc/tools/review.dag` | 187 | {'dag': 4} `dag/test/claim/workflow_default_field_projection_fold_witness_test.dag` `src/v2/lens/meta_exec_confinement.dag` |
-| `gunbc.tools.review_codex` | `dag/gunbc/tools/review_codex.dag` | 205 | {'dag': 2, 'rs': 1} `dag/test/claim/workflow_default_field_projection_fold_witness_test.dag` `dag/gunbc/roadmap/roadmap_belt_actuate.dag` |
-| `gunbc.v1_maintenance_standing` | `dag/gunbc/v1/v1_maintenance_standing.dag` | 83 | {'dag': 6, 'rs': 1} `dag/test/claim/match_arm_pattern_identity_emission_witness_test.dag` `dag/test/claim/documentary_refs_witness_test.dag` |
-| `gunbc.workflow.types` | `dag/gunbc/workflow/types.dag` | 311 | {'dag': 1} `dag/gunbc/plans/host_effect_orchestration.dag` |
-| `std.behavioral` | `dag/std/behavioral.dag` | 51 | {'rs': 1} `src/v1/stage0/src/bin/parse_witness.rs` |
-| `std.durable_compare_and_set` | `dag/std/durable_compare_and_set.dag` | 292 | {'dag': 1} `dag/test/claim/durable_compare_and_set_witness_test.dag` |
-| `std.methods` | `dag/std/methods.dag` | 67 | {'dag': 1, 'rs': 2} `src/v1/compiler_tests_rust.dag` `src/v1/stage0/src/v1_compiler_compiler_tests_rust.rs` |
-| `std.stack` | `dag/std/stack.dag` | 56 | {'dag': 1, 'rs': 1} `dag/gunbc/witness/witness_floor_workflow.dag` `src/v1/stage0/src/bin/parse_witness.rs` |
-| `std.verification` | `dag/std/verification.dag` | 34 | {'dag': 3} `dag/gunbc/plans/resolver_type_name_collision_wall.dag` `dag/gunbc/plans/realization_measurement_loop.dag` |
-| `tools.gunbc_ci` | `dag/gunbc/instruments/gunbc_ci.dag` | 25 | {'dag': 2, 'rs': 1} `dag/std/emit_on_demand.dag` `src/v2/test/claim/host_language_transport_script/corpus/wall_residue_live_test.dag` |
-| `v2.extdeps.languages.ecmascript` | `src/v2/extdeps/languages/ecmascript.dag` | 1340 | {'dag': 1} `dag/gunbc/language_target_registry.dag` |
-| `v2.extdeps.languages.machine_code` | `src/v2/extdeps/languages/machine_code.dag` | 559 | {'dag': 4} `dag/extdeps/languages/riscv/subject.dag` `dag/test/claim/language_target_registry_totality_test.dag` |
-| `v2.extdeps.languages.ptx` | `src/v2/extdeps/languages/ptx.dag` | 223 | {'dag': 1} `dag/gunbc/language_target_registry.dag` |
-| `v2.extdeps.languages.swift` | `src/v2/extdeps/languages/swift.dag` | 2366 | {'dag': 2} `dag/gunbc/language_target_registry.dag` `src/v2/test/claim/complexity/accumulator_copy_roster_gate_swift_test.dag` |
-| `v2.extdeps.languages.wasm` | `src/v2/extdeps/languages/wasm.dag` | 2019 | {'dag': 2} `dag/gunbc/language_target_registry.dag` `dag/gunbc/plans/language_target_self_host_frontier.dag` |
-| `v2.std.datetime` | `src/v2/std/datetime.dag` | 658 | {'dag': 2, 'rs': 1} `dag/extdeps/pin.dag` `src/v2/test/manual/parse_forensics_scaling_witness.dag` |
-| `v2.std.float` | `src/v2/std/float.dag` | 174 | {'dag': 1} `dag/gunbc/non_fold_residue.dag` |
-| `v2.std.probe_selector` | `src/v2/std/probe_selector.dag` | 674 | {'dag': 2} `dag/gunbc/non_fold_residue.dag` `dag/gunbc/plans/dag_v2_defork_audit.dag` |
-| `v2.test.workflow.glob_discovery_law` | `src/v2/workflow/glob_discovery_law.dag` | 113 | {'dag': 1} `src/v2/test/claim/complexity/accumulator_copy_roster_gate_test.dag` |
-| `v2.workflow.class_b_import_closure_transport` | `src/v2/workflow/class_b_import_closure_transport.dag` | 118 | {'dag': 2, 'rs': 1} `dag/test/claim/long/rust_test_fixtures_import_closure_witness_test.dag` `src/v2/workflow/class_b_import_closure_probe.dag` |
-| `v2.workflow.compile_door_ledger` | `src/v2/workflow/compile_door_ledger.dag` | 341 | {'dag': 1} `src/v2/test/claim/long/door_real_module_probe_test.dag` |
-| `v2.workflow.compiler_closure_ingest_transport` | `src/v2/workflow/compiler_closure_ingest_transport.dag` | 150 | {'dag': 4} `dag/gunbc/instruments/ci_gates.dag` `dag/gunbc/ci/ci_layer_roots.dag` |
-| `v2.workflow.phase_profile_proof_plan` | `src/v2/workflow/phase_profile_proof_plan.dag` | 22 | {'rs': 1} `src/v1/stage0/tests/phase_profile_claim_executor.rs` |
-| `v2.workflow.source_root_ingest_gate` | `src/v2/workflow/source_root_ingest_gate.dag` | 18 | {'dag': 3} `dag/test/claim/guarantee_stall_witness_test.dag` `dag/gunbc/instruments/ci_gates.dag` |
-| `v2.workflow.source_root_ingest_transport` | `src/v2/workflow/source_root_ingest_transport.dag` | 90 | {'dag': 2} `dag/gunbc/instruments/ci_gates.dag` `src/v2/test/claim/host_language_transport_script/corpus/migrated_transports_clean_test.dag` |
-
-### CITED-AUTHORITY — 103 modules
-
-| module | path | lines | live-source mentions |
-| --- | --- | --- | --- |
-| `extdeps.access.aws_iam` | `dag/extdeps/access/aws_iam.dag` | 45 | {'dag': 1} `dag/gunbc/principal_projection.dag` |
-| `extdeps.access.zanzibar` | `dag/extdeps/access/zanzibar.dag` | 62 | {'dag': 1} `dag/gunbc/principal_projection.dag` |
-| `extdeps.audit.cloudevents` | `dag/extdeps/audit/cloudevents.dag` | 58 | —  |
-| `extdeps.bmc.ipmi` | `dag/extdeps/bmc/ipmi.dag` | 48 | —  |
-| `extdeps.boot.emit` | `dag/extdeps/boot/emit.dag` | 127 | —  |
-| `extdeps.boot.framebuffer` | `dag/extdeps/boot/framebuffer.dag` | 15 | —  |
-| `extdeps.boot.freestanding_payload` | `dag/extdeps/boot/freestanding_payload.dag` | 19 | —  |
-| `extdeps.boot.freestanding_witness` | `dag/extdeps/boot/freestanding_witness.dag` | 198 | —  |
-| `extdeps.boot.linux_x86_boot` | `dag/extdeps/boot/linux_x86_boot.dag` | 37 | —  |
-| `extdeps.cloud.gcp.iam_admin` | `dag/extdeps/cloud/gcp/iam_admin.dag` | 114 | —  |
-| `extdeps.cloud.gcp.serviceusage` | `dag/extdeps/cloud/gcp/serviceusage.dag` | 51 | —  |
-| `extdeps.cloud.gcp.sts` | `dag/extdeps/cloud/gcp/sts.dag` | 111 | {'rs': 2} `src/v1/stage0/src/cli_run.rs` `src/v1/stage0/src/bin/effects_rest_transport_witness.rs` |
-| `extdeps.cloud_init.cloud_init` | `dag/extdeps/cloud_init/cloud_init.dag` | 58 | {'dag': 1} `dag/gunbc/prose_row_frontier.dag` |
-| `extdeps.colo.centersquare` | `dag/extdeps/colo/centersquare.dag` | 47 | —  |
-| `extdeps.colo.colocation_america` | `dag/extdeps/colo/colocation_america.dag` | 45 | —  |
-| `extdeps.colo.coresite` | `dag/extdeps/colo/coresite.dag` | 58 | —  |
-| `extdeps.colo.dataverge` | `dag/extdeps/colo/dataverge.dag` | 47 | —  |
-| `extdeps.colo.digital_realty` | `dag/extdeps/colo/digital_realty.dag` | 59 | —  |
-| `extdeps.colo.equinix` | `dag/extdeps/colo/equinix.dag` | 71 | —  |
-| `extdeps.colo.evocative` | `dag/extdeps/colo/evocative.dag` | 49 | —  |
-| `extdeps.colo.h5` | `dag/extdeps/colo/h5.dag` | 59 | —  |
-| `extdeps.colo.halsey_165` | `dag/extdeps/colo/halsey_165.dag` | 73 | —  |
-| `extdeps.colo.hivelocity` | `dag/extdeps/colo/hivelocity.dag` | 45 | —  |
-| `extdeps.colo.interserver` | `dag/extdeps/colo/interserver.dag` | 100 | —  |
-| `extdeps.colo.iron_mountain` | `dag/extdeps/colo/iron_mountain.dag` | 44 | —  |
-| `extdeps.colo.natcoweb` | `dag/extdeps/colo/natcoweb.dag` | 123 | —  |
-| `extdeps.colo.netrality` | `dag/extdeps/colo/netrality.dag` | 45 | —  |
-| `extdeps.colo.qts` | `dag/extdeps/colo/qts.dag` | 45 | —  |
-| `extdeps.colo.summit` | `dag/extdeps/colo/summit.dag` | 49 | —  |
-| `extdeps.colo.three_sixty_five` | `dag/extdeps/colo/three_sixty_five.dag` | 89 | —  |
-| `extdeps.colo.tierpoint` | `dag/extdeps/colo/tierpoint.dag` | 86 | —  |
-| `extdeps.colo.types` | `dag/extdeps/colo/types.dag` | 110 | —  |
-| `extdeps.container.oci.ctrl_session_witness` | `dag/extdeps/container/oci/ctrl_session_witness.dag` | 361 | —  |
-| `extdeps.container.oci.image_config` | `dag/extdeps/container/oci/image_config.dag` | 100 | —  |
-| `extdeps.container.oci.linux` | `dag/extdeps/container/oci/linux.dag` | 156 | —  |
-| `extdeps.container.oci.manifest` | `dag/extdeps/container/oci/manifest.dag` | 98 | —  |
-| `extdeps.container.oci.runtime_config` | `dag/extdeps/container/oci/runtime_config.dag` | 97 | —  |
-| `extdeps.currency.currency` | `dag/extdeps/currency/currency.dag` | 24 | {'dag': 1} `dag/gunbc/prose_row_frontier.dag` |
-| `extdeps.darwin.rusage` | `dag/extdeps/darwin/rusage.dag` | 31 | {'dag': 2, 'rs': 1} `dag/test/claim/peak_resident_measured_witness_test.dag` `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.darwin.sysctl` | `dag/extdeps/darwin/sysctl.dag` | 64 | {'dag': 3, 'rs': 1} `dag/gunbc/extdeps_scope_frontier.dag` `dag/gunbc/prose_row_frontier.dag` |
-| `extdeps.ebay.ebay` | `dag/extdeps/ebay/ebay.dag` | 94 | —  |
-| `extdeps.ebay.ebay_contracts` | `dag/extdeps/ebay/ebay_contracts.dag` | 34 | —  |
-| `extdeps.ebay.errors` | `dag/extdeps/ebay/errors.dag` | 61 | —  |
-| `extdeps.ebay.inventory` | `dag/extdeps/ebay/inventory.dag` | 468 | —  |
-| `extdeps.ebay.oauth` | `dag/extdeps/ebay/oauth.dag` | 151 | —  |
-| `extdeps.energy.nj_electricity` | `dag/extdeps/energy/nj_electricity.dag` | 61 | —  |
-| `extdeps.exec.xargs` | `dag/extdeps/exec/xargs.dag` | 31 | {'dag': 1} `dag/gunbc/prose_row_frontier.dag` |
-| `extdeps.filesystem.ntfs` | `dag/extdeps/filesystem/ntfs.dag` | 28 | —  |
-| `extdeps.filesystem.posix` | `dag/extdeps/filesystem/posix.dag` | 34 | —  |
-| `extdeps.formats.elf.encode` | `dag/extdeps/formats/elf/encode.dag` | 201 | —  |
-| `extdeps.formats.elf.hello_static_witness` | `dag/extdeps/formats/elf/hello_static_witness.dag` | 259 | —  |
-| `extdeps.formats.elf.primitives` | `dag/extdeps/formats/elf/primitives.dag` | 61 | —  |
-| `extdeps.formats.elf.relocation` | `dag/extdeps/formats/elf/relocation.dag` | 26 | —  |
-| `extdeps.formats.elf.sections` | `dag/extdeps/formats/elf/sections.dag` | 31 | —  |
-| `extdeps.formats.elf.segments` | `dag/extdeps/formats/elf/segments.dag` | 79 | —  |
-| `extdeps.formats.elf.types` | `dag/extdeps/formats/elf/types.dag` | 190 | —  |
-| `extdeps.git.versioning` | `dag/extdeps/git/versioning.dag` | 73 | —  |
-| `extdeps.github.auth` | `dag/extdeps/github/auth.dag` | 61 | {'rs': 1} `src/v1/stage0/src/bin/parse_witness.rs` |
-| `extdeps.github.ci` | `dag/extdeps/github/ci.dag` | 30 | {'dag': 1} `dag/gunbc/plans/realization_measurement_loop.dag` |
-| `extdeps.github.gists` | `dag/extdeps/github/gists.dag` | 76 | {'rs': 2} `src/v1/stage0/src/bin/parse_witness.rs` `src/v1/stage0/src/bin/effects_rest_transport_witness.rs` |
-| `extdeps.github.github_contracts` | `dag/extdeps/github/github_contracts.dag` | 15 | —  |
-| `extdeps.github.issues` | `dag/extdeps/github/issues.dag` | 202 | {'dag': 1, 'rs': 1} `dag/gunbc/extdeps_scope_frontier.dag` `src/v1/stage0/src/bin/effects_rest_transport_witness.rs` |
-| `extdeps.github.mergeable_state` | `dag/extdeps/github/mergeable_state.dag` | 39 | —  |
-| `extdeps.github.mergeable_state_contracts` | `dag/extdeps/github/mergeable_state_contracts.dag` | 18 | —  |
-| `extdeps.gitignore` | `dag/extdeps/git/gitignore.dag` | 36 | —  |
-| `extdeps.languages.go.module` | `dag/extdeps/languages/go/module.dag` | 144 | {'dag': 1} `dag/gunbc/commit_workflow.dag` |
-| `extdeps.languages.go.primitives` | `dag/extdeps/languages/go/primitives.dag` | 211 | {'dag': 1, 'rs': 1} `dag/std/checked_arithmetic.dag` `src/v1/stage0/src/std_checked_arithmetic.rs` |
-| `extdeps.languages.python.primitives` | `dag/extdeps/languages/python/primitives.dag` | 86 | —  |
-| `extdeps.languages.rust.primitives` | `dag/extdeps/languages/rust/primitives.dag` | 112 | {'dag': 2, 'rs': 2} `dag/extdeps/languages/rust/types.dag` `dag/std/checked_arithmetic.dag` |
-| `extdeps.languages.typescript.primitives` | `dag/extdeps/languages/typescript/primitives.dag` | 103 | —  |
-| `extdeps.linux.edac` | `dag/extdeps/linux/edac.dag` | 26 | —  |
-| `extdeps.linux.proc_meminfo` | `dag/extdeps/linux/proc_meminfo.dag` | 41 | {'dag': 1} `dag/extdeps/linux/procfs.dag` |
-| `extdeps.linux.rusage` | `dag/extdeps/linux/rusage.dag` | 31 | {'dag': 2, 'rs': 1} `dag/test/claim/peak_resident_measured_witness_test.dag` `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.llm.anthropic_errors` | `dag/extdeps/llm/anthropic_errors.dag` | 80 | —  |
-| `extdeps.llm.anthropic_rest` | `dag/extdeps/llm/anthropic_rest.dag` | 96 | {'rs': 1} `src/v1/stage0/src/bin/effects_rest_transport_witness.rs` |
-| `extdeps.llm.llm` | `dag/extdeps/llm/llm.dag` | 12 | —  |
-| `extdeps.llm.openai_contracts` | `dag/extdeps/llm/openai_contracts.dag` | 32 | —  |
-| `extdeps.llm.openai_errors` | `dag/extdeps/llm/openai_errors.dag` | 66 | —  |
-| `extdeps.llm.openai_rest` | `dag/extdeps/llm/openai_rest.dag` | 92 | {'rs': 1} `src/v1/stage0/src/bin/effects_rest_transport_witness.rs` |
-| `extdeps.netplan.netplan` | `dag/extdeps/netplan/netplan.dag` | 69 | {'dag': 1} `dag/gunbc/prose_row_frontier.dag` |
-| `extdeps.observability` | `dag/extdeps/observability.dag` | 49 | —  |
-| `extdeps.posix.rusage` | `dag/extdeps/posix/rusage.dag` | 66 | {'dag': 3, 'rs': 2} `dag/test/claim/peak_resident_measured_witness_test.dag` `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.provisioning.ubuntu_seeded_install_media_toolchain` | `dag/extdeps/provisioning/ubuntu_seeded_install_media_toolchain.dag` | 39 | —  |
-| `extdeps.realestate.nj_industrial` | `dag/extdeps/realestate/nj_industrial.dag` | 70 | —  |
-| `extdeps.render.surface` | `dag/extdeps/render/surface.dag` | 79 | {'rs': 2} `src/v1/stage0/src/cli_run.rs` `src/v1/stage0/src/v1_interpreter.rs` |
-| `extdeps.render.terminal_capability` | `dag/extdeps/render/terminal_capability.dag` | 60 | {'rs': 1} `src/v1/stage0/src/v1_interpreter.rs` |
-| `extdeps.runtime.api.darwin` | `dag/extdeps/runtime/api/darwin.dag` | 59 | —  |
-| `extdeps.runtime.api.windows` | `dag/extdeps/runtime/api/windows.dag` | 114 | —  |
-| `extdeps.runtime.local` | `dag/extdeps/runtime/local.dag` | 22 | —  |
-| `extdeps.sec.edgar_rest` | `dag/extdeps/sec/edgar_rest.dag` | 71 | {'dag': 2} `dag/extdeps/sec/edgar.dag` `dag/gunbc/prose_row_frontier.dag` |
-| `extdeps.shell.credentials` | `dag/extdeps/shell/credentials.dag` | 19 | —  |
-| `extdeps.tailscale.acl` | `dag/extdeps/tailscale/acl.dag` | 312 | {'dag': 2} `dag/test/claim/host_standup_spine_witness_test.dag` `dag/gunbc/host/host_standup.dag` |
-| `extdeps.tailscale.acl_api` | `dag/extdeps/tailscale/acl_api.dag` | 70 | —  |
-| `extdeps.tcgplayer.catalog` | `dag/extdeps/tcgplayer/catalog.dag` | 180 | —  |
-| `extdeps.tcgplayer.pricing` | `dag/extdeps/tcgplayer/pricing.dag` | 78 | —  |
-| `extdeps.tcgplayer.store` | `dag/extdeps/tcgplayer/store.dag` | 97 | —  |
-| `extdeps.tcgplayer.tcgplayer` | `dag/extdeps/tcgplayer/tcgplayer.dag` | 82 | —  |
-| `extdeps.tools.diffutils` | `dag/extdeps/tools/diffutils.dag` | 29 | {'dag': 1} `dag/extdeps/tools/gnu_coreutils.dag` |
-| `extdeps.transports.sql` | `dag/extdeps/transports/sql.dag` | 41 | {'dag': 1} `src/v2/test/fixture/frontier_probe_elision_boundary_overlay.dag` |
-| `extdeps.vendor.arm` | `dag/extdeps/vendor/arm.dag` | 31 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.vendor.qualcomm` | `dag/extdeps/vendor/qualcomm.dag` | 31 | {'dag': 1} `dag/gunbc/extdeps_scope_frontier.dag` |
-| `extdeps.version.pep440` | `dag/extdeps/version/pep440.dag` | 310 | —  |
-| `gunbc.hand_lens_host_bridge_scaffold_index` | `dag/gunbc/hand_lens_host_bridge_scaffold_index.dag` | 23 | —  |
\ No newline at end of file
diff --git a/docs/plans/unconsumed-module-residue-disposition.md b/docs/plans/unconsumed-module-residue-disposition.md
deleted file mode 100644
index 7dcb8c6000e..00000000000
--- a/docs/plans/unconsumed-module-residue-disposition.md
+++ /dev/null
@@ -1,805 +0,0 @@
-# Disposition of the unconsumed-module residue
-
-**This is the execution record for the population
-[`unconsumed-module-census.md`](unconsumed-module-census.md) measured. The census stays the
-authority on how the population is derived; this records what was done to it and, for every
-row not deleted, the typed reason it survived.** Separate facts on separate clocks: the census
-answers *what is unconsumed*, this answers *what was dispositioned, and what refused*.
-
-Operator directive both serve (2026-08-21, verbatim): *"yes please make sure to clean up
-anything without consumers that we don't need, or get them actually consumed."*
-
-## 1. What was deleted, and what the number is
-
-The census's reconciled cleanup list is **131 modules** -- 96 STILL-UNCONSUMED plus 35
-DEAD-CONSUMER-ONLY, the two buckets that are residue on all three decoded surfaces. Measured
-2026-08-22 against a tree that has since moved. **Re-deriving the instrument on this branch's
-base (`90986d19469`) reproduces it within the drift:**
-
-| bucket | census (2026-08-22) | re-derived here | delta |
-| --- | --- | --- | --- |
-| population (unreachable) | 298 | 302 | +4 |
-| CONSUMED-DECISIVE | 91 | 89 | -2 |
-| DEAD-CONSUMER-ONLY | 35 | 32 | -3 |
-| AMBIGUOUS-SHARED-ONLY | 75 | 74 | -1 |
-| STILL-UNCONSUMED | 96 | 107 | +11 |
-| **residue (the cleanup list)** | **131** | **139** | **+8** |
-
-The instrument is re-derived, not inherited, on purpose: the census records that the population
-*has a clock on it* -- one of its own appendix rows already pointed at a deleted file -- so a
-lane trusting a four-day-old row list deletes against a tree that no longer exists. Re-deriving
-also re-runs the census's controls: `v2.compiler.compile`, `gunbc.spark.serving_desired`,
-`gunbc.clock_read`, `v2.std.node` and `gunbc.accelerator_demo_gpu` all score reachable here,
-and RESIDUE-EMPTY again scores 0 consumed, so the instrument finds consumption neither
-everywhere nor nowhere.
-
-**Of the corrected 114-row residue, this change deletes 55.** The deleted rows carry no
-obligation to anything outside themselves, on every surface the instrument decodes *and* every
-surface it does not:
-
-- unreachable from every root -- discovery path, entry row, or v1 seed mirror;
-- no uniquely-owned symbol -- **including coproduct variant constructors and flat-namespace
-  `operation`/`service`/`resource` declarations**, see 4d -- named bare by any `.dag` file;
-- **no mention of the module name or its path in any `.dag`, `.rs`, `.yml`, `.yaml`,
-  `.toml`, `.sh` or `.txt` file** in the tree;
-- no `test fn` declared, so no assertion stops executing;
-- no `src/v1/stage0/src` mirror, so the seed population is unchanged;
-- **and its whole island is in the set** -- eligibility is computed as a fixed point over the
-  deletion set, not per module (4g).
-
-
-
-## 2. The deletion as the census
-
-DESIGN §3 says the deletion *is* the census. Measured against the corrected instrument (§4d),
-before and after the cut:
-
-| | before | after | delta |
-| --- | --- | --- | --- |
-| modules | 3851 | 3796 | -55 |
-| **reachable** | **3549** | **3549** | **0** |
-| population | 302 | 247 | -55 |
-| **CONSUMED-DECISIVE** | **91** | **91** | **0** |
-| AMBIGUOUS-SHARED-ONLY | 97 | 97 | 0 |
-| STILL-UNCONSUMED | 80 | 29 | -51 |
-| DEAD-CONSUMER-ONLY | 34 | 29 | -5 |
-
-Reachable, CONSUMED-DECISIVE and AMBIGUOUS are unchanged; the whole movement is inside the two
-residue buckets and equals the file count exactly.
-
-**These counters are necessary and NOT sufficient, and §4d is why.** An earlier revision offered
-this table as proof the cut was safe. It was computed by an instrument carrying an extraction
-defect, so it could not surface the case that defect was blind to -- and read as reassurance
-precisely because it was consistent. The table is retained because it still falsifies a whole
-class of error (a cut catching a *reachable* module would move the top row), and demoted because
-it cannot falsify the class that actually occurred. The independent instrument is the floor, §8.
-
-## 3. The one row the census deferred, now answered by its author -- and the cause it gave is not the cause the census guessed
-
-`gunbc.scm.commit_closure_store` was deleted by the batch rule, restored while the question
-was open, and is **deleted again** on the answer from `gentle-eagle-360`, who authored #8820.
-The verdict is recorded here rather than in the module, because a citation into a deleted
-module dies with it.
-
-**Both arms the census offered rest on a false premise, and the correction is load-bearing.**
-The census framed this as *the envelope grew save/load and superseded it* versus *the envelope
-should consume it as its persistence layer*.
-
-- *Not superseded.* `gunbc.scm.repository_envelope` contains **zero `Filesystem` operations
-  and not one `func`** -- a pure codec, `RepositoryEnvelope` to `JsonValue` and back. Nothing
-  took over this module's job; recording the deletion as "replaced by the envelope" would be
-  false.
-- *And the envelope should NOT consume it.* `commit_closure_store` persists **one root and
-  its closure**. A repository is a different subject: an empty initialized state with **no
-  root at all**, several commits over one shared node population, a checked-out selection.
-  Wiring the envelope to a carrier that demands a root would force `init` to invent a phantom
-  commit -- a grain mismatch dressed as a fix.
-
-**The correct disposition row: DELETE, cause = STAGED ORPHAN AT THE WRONG GRAIN.** Not
-superseded, not replaced, not merely unconsumed. It was never wired, and the layer that will
-do this job is repository-grain and will be written that way whether or not this module stands.
-
-**Why delete rather than hold it for that layer** -- the author's reasoning and DESIGN §3's: a
-surviving X is an **attractor**; while it stands, every nearby persistence question is answered
-in commit-closure vocabulary already scheduled to die. They declined to hold a lane open for a
-speculative "export one commit" operation with no consumer -- §6 experimental residue, applied
-by an author to their own module.
-
-**A rung-honesty defect in its own carrier, volunteered by that author, strengthens the
-warrant.** The module's header claims its persistence is *"verified by direct execution in Wet
-mode"* and points at `commit_closure_round_trip_probe`. True when run by hand, not now: the
-probe is **enrolled nowhere and nothing executes it**. The module carries an overclaim about
-its own evidence -- a stronger reason to delete than unreachability, and exactly the
-specification-without-execution shape DESIGN §5 names.
-
-**What must survive into the replacement, recorded because this deletion removes the prompt
-for it** (not this lane's to carry): the host's success/content/error triple folded into a
-coproduct **at** the boundary, so no downstream consumer picks which member to believe or reads
-content from a failed read; and encode adjudicated **before** the write, so a successful write
-cannot upgrade an encoding failure into `Saved`.
-
-## 4. One finding the deletion surfaced, and it is not a deletion
-
-**`gunbc.v1_maintenance_standing` is unreachable from every root and named bare by nothing,
-and DESIGN.md names it as an authority.** DESIGN's 3 standing rule on the v1 seed states:
-*"The authority is `gunbc.v1_maintenance_standing` `v1_seed_standing`"* -- the carrier for the
-semantics-frozen / maintenance-active reclassification, its admission test, and its five-class
-refusal vocabulary.
-
-It is held, not proposed for deletion. The finding runs the other way: **the carrier DESIGN
-designates as the authority for the v1 freeze standing executes nowhere and is reached by
-nothing.** Its four in-tree `.dag` mentions (`ci_layer_roots`, `documentary_refs`,
-`roadmap_serve`, `whole_corpus_compile_admission`, plus two witnesses) are string citations,
-not calls. Consistent with the standing's own declared rung -- *"is consumed by review
-diligence, not by any gate, so it sits at mitigatable"* -- and this measurement is its
-independent corroboration: not merely ungated, unreachable. Recorded as a rung-honesty datum
-for whoever climbs it, not as a disposition.
-
-## 4b. A strand that appeared, then dissolved when its module came back
-
-A record of the surface, not of a repair. Widening the mention scan past source extensions to
-`.txt` found `docs/probes/census_extra_excludes.txt` and its seeds file naming
-`dag/examples/gunbhub_serve_program/gunbhub_serve_program.dag`, which the first cut deleted.
-`v1_compiler.census_exclude_derive` loads both -- the seeds drive the derived exclude closure
-and the pinned oracle is its drift witness -- so a row naming a deleted path skews the
-symmetric diff toward *drift* rather than *staleness*.
-
-**Both the row removal and the two count literals it forced are reverted**, because
-`gunbhub_serve_program` left the deletion set in §4d's re-derivation and the row is correct
-again. **This PR touches no file under `src/v1`.**
-
-The reusable finding: **a source-extension mention scan is not a complete consumption
-surface.** Authored data files carry references, and this one was load-bearing. The census's
-decoded-surface list should include them. The check is now part of the §1 precondition and
-stays there whether or not any row trips it.
-
-## 4c. One deleted row was a committed copy of a DO-NOT-COMMIT artifact
-
-Raised by review as two surviving references to a deleted filename
-(`gunbc.ci_layer_roots`'s `WitnessExclusionRow` pattern and `discover_owned_data`'s
-`exclude_subpaths` default), cleared there as harmless string patterns. Correct -- and checking
-*why* turned up the sharper fact and reversed the tidy-up it invites.
-
-`v1_compiler.cli_run` `discover_owned_data_decls` **generates** a module named
-`v2.test.claim.workflow.host_discovered_owned_data_manifest` under
-`src/v2/test/claim/workflow/`, stamped `GENERATED by discover_owned_data -- ephemeral
-host transport. DO NOT COMMIT.` What this change deleted is
-`v2.test.workflow.host_discovered_owned_data_manifest` at `src/v2/workflow/` -- a
-**committed instance of that ephemeral artifact under a second module path, carrying all-zero
-counts**. A stale committed copy of a file the generator says must not be committed is a
-better reason to delete than unreachability.
-
-**And the two exclusion rows must stay.** `path_excluded` is a substring match over the full
-path, so `host_discovered_owned_data_manifest.dag` still matches the *generated* file whenever
-`discover_owned_data` produces it. They are live exclusions of an ephemeral artifact, not dead
-rows. Removing them as tidy-up -- what "a pattern that no longer matches anything" invites --
-would have re-admitted a generated transport into discovery.
-
-Recorded because the wrong reading is the natural one for the next person to grep these names.
-
-## 4e. One row restored on disposition, not on measurement
-
-`gunbc.generic_binder_field_projection_deficit` scores STILL-UNCONSUMED correctly and is
-restored anyway: dispositioned KEEP-WITH-REASON in #8851 as a DESIGN 4b **deficit filing** --
-a declared rung, a ceiling, a next-rung trigger.
-
-**An unconsumed deficit filing is 4b(2) working, not residue.** A class below its ceiling is
-*required* to name its trigger, and nothing consumes that filing by design; unreferenced is its
-normal state. Deleting it would remove a safety-ledger row and lower a rung with none of the
-reason, bounded population and restoration trigger 4b(3) demands. Its sibling
-`gunbc.empty_decl_file_checkpoint_bypass` carries the same disposition and was never in this
-batch.
-
-The general point, stated by the census and learned here twice: **unreachability is the wrong
-predicate for a row whose purpose is to be read by a human ledger.** This row and section 3's
-`commit_closure_store` are that shape; neither was caught by a mechanical rule -- both came
-from a per-row disposition someone had already written down.
-
-## 4d. Four extraction defects, one mechanism: under-extraction creates false uniqueness
-
-**The floor refused the first cut**, with `unresolved type 'MergeReadinessVerdict'` and eight
-`undefined variable 'Ready'` in `gunbc.code_change_workflow`. `gunbc.pr_digests` had been
-deleted and should not have been.
-
-The defect-6 re-score asks whether another `.dag` file names a candidate's declared symbol
-*bare*. That needs what a module **declares** -- and four ways of getting it wrong were found,
-all under-extraction, all with the same consequence:
-
-| # | defect | effect |
-| --- | --- | --- |
-| 7 | coproduct **variant constructors** not extracted (`= Ready \| NotReady`) | found here, by the floor |
-| a | a **generic header** `type X<P> = A \| B` skips the block | relayed by `silent-deer-368` |
-| b | a **multi-line variant record** truncates a start-of-line scan | relayed by `silent-deer-368` |
-| c | `operation`/`service`/`resource` are **declarations**, read as references | relayed by `silent-deer-368` |
-| d | a **same-line coproduct** `type X = A \| B` | found by their discriminator, in *my* extractor |
-
-**Why this direction is the dangerous one.** Under-extraction makes a module own fewer symbols
-than it does, so a *shared* name looks **uniquely owned** -- false uniqueness. A module whose
-declarations all sit behind an unparsed header owns nothing, so a live consumer naming its
-symbols bare is invisible and the module scores residue and **gets deleted**. The opposite
-direction from the `pr_digests` case, which merely kept a dead-looking module alive.
-
-**Fixed at the root, not per bug.** Adopted `silent-deer-368`'s region-based extractor: a
-type's region runs to the next top-level declaration (so (b) cannot truncate it), a leading
-`<...>` is stripped before testing for `=` (so (a) parses), and `operation`/`service`/
-`resource` names are declarations (so (c) does not misattribute). Verified against their four
-discriminators -- `Apply` in `std.upsert_decision`, `Select` in `v2.extdeps.languages.llvm_ir`,
-`Ready` in `gunbc.pr_digests`, `Capability` in `std.behavioral` -- **my extractor passed three
-and failed the fourth**, which is how (d) was found. Their (c) tell also passes:
-`extdeps.transports.sql` scores AMBIGUOUS rather than consumed-by-`filesystem_io`, which linked
-to it only through `operation Delete {`.
-
-**What re-deriving cost.** **13 modules left the deletion set** -- nine formatters, the
-`language_model` rust root, `generic_instantiation`, `roadmap_dispatch`,
-`gunbhub_serve_program` -- and **every one landed in AMBIGUOUS-SHARED-ONLY, not CONSUMED.**
-That distinction is why the bucket exists: they are *no longer provably unconsumed* and *not
-proven consumed*, so none may be deleted on this evidence, and reading the shrinking residue as
-"more live modules found" collapses exactly the gap the bucket holds.
-
-**The general lesson, which outlives every row above:**
-
-> **A control derived from the measurement it controls does not discriminate that
-> measurement's blind spot.**
-
-Both counters §2 offers came from the instrument carrying defect 7. The floor caught it because
-it is an independent instrument sharing none of the method. That is delete-first's actual
-mechanism (DESIGN §3): not that the rule is trustworthy, but that the substrate refuses on an
-authority the rule had no part in building. Defects (a)-(d) were found by **hand-reading rows**
-while counters stayed consistent throughout -- the same lesson from the other direction.
-
-## 4h. Six discriminators, and the count/set rule that resolves two instruments disagreeing
-
-The extraction defects were settled by **discriminating cases, not by descriptions**, and that
-is the reusable result. Bug *descriptions* relayed between lanes found one bug in this lane's
-extractor; the *test cases* that came with them found two more nobody had named -- and one of
-those still failed here after its own description had been implemented faithfully, which is
-(f2) below. **A discriminator travels; a description does not.**
-
-The roster, each failing on exactly the defect it names:
-
-| case | specimen | catches |
-| --- | --- | --- |
-| `Apply` | `std.upsert_decision` | (a) generic header |
-| `Select` | `v2.extdeps.languages.llvm_ir` | (b) multi-line variant record |
-| `Ready` | `gunbc.pr_digests` | defect 7, variant constructors |
-| `Capability` | `std.behavioral` | (d) same-line coproduct |
-| `Run` | `gunbc.cli_services` | (e) service-namespace-only module |
-| `v2.std.projection` NOT consumed by `v2.lens.common.graph_invariant` | (f) generic parameter counted as a reference |
-
-**(f) is the mirror of (a), with a second half the obvious fix does not reach.** A generic
-parameter is a **binder, not a reference**: `type GraphInvariant<Projection>` binds
-`Projection`, and `v2.lens.common.graph_invariant` imports no projection module at all. One
-construct yields two distinct false references:
-
-- **(f1)** the parameter list in the declaration header;
-- **(f2)** *uses of the bound name inside that declaration's body* -- `projection: Projection`
-  on the very next line.
-
-Implementing (f1) alone left `v2.std.projection` scoring CONSUMED-DECISIVE; only region-scoped
-shadowing of the bound name moved it to AMBIGUOUS. So the construct touches the instrument
-three ways in two directions: a generic header **defeats declaration extraction** in (a) and
-**inflates reference extraction** in (f1) and (f2).
-
-**The scoping is the safety-critical part.** Dropping the bound name file-wide is the obvious
-implementation and the *delete-a-live-module* direction: removing references moves a live
-module into the residue, so a name bound as a parameter in one declaration and genuinely
-referenced in another would silently lose its real reference. The shadow is scoped to the
-binding declaration's region.
-
-**The `service` short-name credit: dropped, then restored, and the second reason is the one
-that holds.** First dropped citing a false-consumption claim measured on the *other* lane's
-instrument -- never true here, since their specimen `service gcp.Metadata` is **dotted** and
-this lane's pattern never matched it. Then justified as *"no measured effect on this
-population"*, also wrong as a basis: a nil effect argues for either choice and settles nothing.
-
-**The basis that holds is correctness of ownership.** `extdeps.filesystem.filesystem_io`
-declares `service Filesystem`; an instrument saying otherwise is wrong whether or not a row
-moves today. And withholding the credit is not merely a missing fact -- `Filesystem` is declared
-**twice**, as a `service` there and as a `resource` in `std.resources`, so dropping the service
-side hands `std.resources` **false sole ownership** of a name two modules declare. That is
-*manufactured uniqueness*: the mechanism behind every confident wrong attribution in this
-chain, created by the fix meant to avoid it.
-
-The evidence is the seventh discriminator: `v2.extdeps.realization.artifact_store_fs` uses
-`Filesystem.Write`, `.Read` and `.Delete` as a qualifier with **no import of `Filesystem` in
-its import block**. A consumer does bare-resolve an undotted service short name through
-whole-pool resolution. Credited, dotted forms included by last segment (`service gcp.Metadata`
-declares `Metadata`); zero modules in this corpus own nothing without it, but the same basis
-applies, since under-extraction is the delete-a-live-module direction.
-
-**How the real cause was located, the transferable part.** This lane could not reproduce the
-other's false positive *at all* -- the patterns differ on dotted names. That **inability to
-reproduce, with a stated reason**, identified (f) as the actual cause and the service credit as
-merely adjacent. A cross-check that agrees tells you less than one that fails to reproduce and
-can say why.
-
-**Direction check, which is what makes (f) safe to have found late:** (f) and the service
-short-name credit both *inflate* consumption, so neither can cause a wrong deletion -- they can
-only hold a dead module. Both were fixed anyway; the deletion set did not move. That is also
-the count/set rule predicting which lane had to care about which defect before either
-measured it: an inflated-consumption defect moves a residue *count* and leaves a conservative
-deletion *set* alone.
-
-**(e) is contributed back and is the sharpest of the five**: its specimen's declared set is
-*empty* under an unfixed extractor rather than merely incomplete -- `gunbc.cli_services` is a
-`service` block with three `operation`s and **zero** `fn`/`data`/`type`/`const`. Owning nothing
-is the exact precondition for the delete-a-live-module failure. Measured exposure today: none
--- reported as that lane reported theirs, **in the bucket where it would be dangerous** rather
-than over the population: of the operation-bearing rows, none sits in STILL-UNCONSUMED.
-
-**The two lanes' (c) fixes are not equivalent, and reconciling them would be wrong.**
-`silent-deer-368` subtracts declaration-keyword names from the *consuming* file's reference
-set; this lane adds them to the *declaring* module's owned set, making the symbol
-non-uniquely-owned and parking the row in AMBIGUOUS instead of removing the reference.
-Subtraction is more precise; addition is more conservative. Their rule, verbatim, because it
-settles what looked like a discrepancy:
-
-> **A residue COUNT should come from the precise implementation, a deletion SET from the
-> conservative one. Our numbers disagreeing in a known direction is a property to state, not
-> a discrepancy to reconcile.**
-
-**Two independent populations, same skew -- the finding, not the bookkeeping.** 13 of this
-lane's 69 left the residue on re-derivation and 12 of 14 left theirs, in both cases **almost
-entirely to AMBIGUOUS and near-zero to CONSUMED**. The residue shrank far more than the
-consumption claim grew. That gap is the whole reason the ambiguous bucket exists, and the
-natural summary -- *"the residue shrank, so more modules are live"* -- is the reading that
-collapses it into unevidenced deletions.
-
-## 4g. Eligibility is a fixed point over the set, not a property of a module
-
-31 residue rows are named bare only from *inside* the population. A per-module verdict over a
-mutually-referencing island returns "consumed" for every member and the island never becomes
-eligible; splitting one across batches reds the first batch.
-
-So the deletion set is computed as a **fixed point**: repeatedly drop any module with a
-surviving in-population consumer until nothing drops. This ran twice for real, in both
-directions:
-
-- **A deletion created a violation.** The first cut deleted `gunbc.pr_digests` while keeping
-  `gunbc.code_change_workflow` -- one island, split. That is the row the floor refused on.
-- **A restore created one.** Putting the 13 AMBIGUOUS rows back re-created an in-population
-  consumer for `v2.std.rust_leaf_model_claim` (via `v2.test.language_model.rust`), eligible
-  until its neighbour returned.
-
-**This is why the change is one PR** and not six cluster PRs: the property is over the set, so
-six PRs merging in arbitrary order re-open this class unless each is re-derived against the
-others' merged state -- strictly more work and risk than keeping the set closed. The reviewer's
-seams are the commits.
-
-## 4f. A finding walked past while editing the pin, filed rather than fixed
-
-Repairing `census_extra_excludes.txt` meant moving two count literals in
-`v1_compiler.census_exclude_derive` (83 to 82, 27 to 26). **Those literals are a change
-detector, not a check**, and this lane can say so with a receipt rather than a style objection.
-
-A hand-maintained count beside a hand-maintained list measures whether someone remembered to
-update both. It has no independent referent: not a controlled fixture, not an external or
-versioned authority, not a policy budget, not a monotone debt contract over a closed universe
--- the four grounds DESIGN §5 admits for a numeric literal in a merge-blocking test. The
-section's review tell applies exactly: automating the literal's update collapses the assertion
-to `measure() == measure()`, so the manual update was the assertion's entire content.
-
-The receipt is this change: one row moved for an unrelated reason, both literals had to be
-hand-followed, and nothing about the list's *correctness* was checked by either. Had the row
-moved without them, the failure would have reported as a count mismatch rather than as what it
-was.
-
-**Filed, not fixed.** The pin belongs to the exclude-closure lane -- `census_exclude_derive`'s
-own header names its dissolution (the pin retires when strict whole-tree resolve greens without
-host fixed-point closure) -- and repairing an oracle inside a deletion PR would be this
-document's own §6 objection turned on itself. The person who paid the cost is the right person
-to report it and the wrong person to fix it.
-
-**Postscript: the edit that prompted this is reverted.** `gunbhub_serve_program` left the
-deletion set in §4d, so the pin's row is correct again and the literals return to 83 and 27.
-The finding stands on its own merits -- a property of the pin, not of this deletion.
-
-## 4i. The floor's second refusal, and it is the same module telling the truth again
-
-The required floor refused a second time, on one witness:
-`v2.test.lens_inert_carrier.inert_carrier_test.inert_carrier_no_unrostered_or_stale`. The cause
-is real, caused by this change, and is the census working rather than a defect.
-
-Deleting `v2.test.workflow.host_discovered_owned_data_manifest` (§4c -- the committed copy of a
-`DO NOT COMMIT` ephemeral artifact) removed the **only non-test reference** to
-`OwnedDataDiscoveryReceipt`, declared in `v2.compiler.discovery_enumeration`. Verified directly,
-not through any re-implementation: before the cut that carrier had two non-test `.dag`
-references, its own declaration and that manifest's construction of it; after, only its own
-declaration. It is self-tested by `discovery_enumeration_test`. Declared once, self-tested,
-zero consumers outside its own block is exactly the inert-carrier definition, so the lens
-refused.
-
-**Fixed by rostering it, not by restoring the module.** The roster is the declared frontier for
-precisely this state: the carrier's real consumer is *generated at runtime and deliberately
-never committed*, so in the committed corpus it is inert **by construction** and no corpus scan
-can see otherwise. Restoring the deleted module would re-commit a file its own generator stamps
-`DO NOT COMMIT` to satisfy a hygiene lens -- the tail wagging the dog.
-
-**How this was diagnosed, because the first attempt was the error this document keeps
-recording.** I re-implemented the inert-carrier rule from the Rust to locate the moved name.
-That re-implementation was **not faithful** -- its absolute output shared *zero* names with the
-live roster, twice, under two different test-predicate readings. Its *delta* was stable across
-both, which is suggestive and not evidence. The claim above rests on a direct, checkable
-observation about one symbol's references before and after. An unfaithful instrument does not
-become trustworthy because its delta looks stable.
-
-## 4j. A finding this change is a specimen of, and it is not about this change
-
-**A defect keyed on a specific `OccurrenceId` value stops reproducing under any change that
-perturbs occurrence allocation.** Stated as a property of the class, because the next such
-defect will have it and nobody will be watching.
-
-The specimen is this branch, usable *precisely because it contains no fix*:
-
-| | tree | failed | planned |
-| --- | --- | --- | --- |
-| base `90986d19469` | as-is | **16** | 10425 |
-| this branch | base minus 55 deleted modules | **1** (unrelated) | **10425** |
-
-The 16 are the `fold_lowering` / `body_lowering.statement_let_bind` family, every one
-reporting `non-exhaustive pattern match on: OccurrenceId { value: 79 }`. All 16 identities are
-absent -- passing -- on a tree that differs from their red base *only* by deleted modules. No
-test file was deleted, no lowering code touched, and both runs reported the same discovery
-figures (`offered=11798 routed=10425`).
-
-**That last control is weaker than an earlier revision of this section claimed.** It read
-*"`planned` is identical at 10425, which rules out roster change"*. Identical counts are
-consistent with an unchanged roster and do not establish one. Not a theoretical caveat: on the
-very next run, `offered` moved **11798 → 11812** and `routed` **10425 → 10439** across two
-commits that changed **only a markdown file and a single `inert_row` data row**, declines
-unchanged. Fourteen witnesses entered *discovery* with no corpus change, cause **not yet
-attributed**. So the discovered roster is not a pure function of the committed tree, and a
-matching count is weaker evidence than it looks.
-
-The comparison still stands as a controlled one -- base and post-deletion runs agree on every
-reported discovery figure, and the tree difference is exactly the 55 deletions -- but it is
-corroboration, not proof, and the isolated-variable claim is downgraded accordingly. The same
-failure this document records elsewhere, committed in its own write-up: **a count treated as a
-check.**
-
-**Consequence for method:** a bisect, or any before/after comparison, across trees of different
-module counts measures allocation luck rather than the defect. A green obtained that way is not
-evidence of a repair.
-
-**What this is NOT a claim about.** Not that this change fixed anything -- it plainly did not,
-and saying so would be the rung inflation DESIGN §4b names. Nor about the original defect's
-status: that was root-caused separately at the declaration (`v2.extdeps.languages.dag`'s
-int-literal constructors declared `OccurrenceId` while every caller passed
-`SyntheticOccurrence`, repaired with a 17-site caller census), and main is green on that
-repair. Two greens, two causes; this branch has the luck, main has the fix.
-
-## 4k. What the static instrument was actually worth, measured
-
-Across **seven instrument defects**, four extractor corrections, and a population that moved
-298 → 131 → 117 → 114, **the static census never once identified a live module.** It
-identified *unknowns*, correctly, and stopped this lane from acting on them. The one true
-positive -- `gunbc.pr_digests` -- was found by **one execution**, the required floor; no static
-bucket caught it.
-
-DESIGN §3 as a measurement rather than a doctrine: *in a fail-closed substrate the deletion is
-the census*, demonstrated against a static alternative that got four rounds of sharpening and
-still could not do the job.
-
-**The "zero near-misses" reading, stated so a later reader does not relax at it.** Of the 14
-rows that left the deletion set, **none became CONSUMED**. That reads as reassurance and is
-not. Thirteen went to AMBIGUOUS -- **unresolved**, neither proven consumed nor unconsumed --
-and **a live module among them would present exactly as they do; the bucket cannot distinguish
-it.** The honest statement is *thirteen rows of unknown status that I would have deleted*, and
-the near-miss count is **1, found by execution**.
-
-**The same standard applied to the 55 being deleted.** They are STILL-UNCONSUMED or
-island-closed DEAD-CONSUMER-ONLY: zero on three *decoded* surfaces whose declared standing is
-`LowerBoundOnly`. The best-evidenced set this instrument can produce. **It is not proof** --
-which is the argument *for* landing it and reading the refusals, not a risk run in spite of
-them.
-
-## 4l. Editing this set means re-running the fixed point, not adjusting the count
-
-`69 − 13 + 1 = 56` reconciled (a fourth term lands in §4m, making it 55) arithmetically **by
-the wrong route**: the 13 left on *evidential* grounds (the corrected extractor moved them to
-AMBIGUOUS) and the 14th, `v2.std.rust_leaf_model_claim`, on a *structural* one -- restoring
-`v2.test.language_model.rust` re-created its in-population consumer, so deleting it would have
-split an island the restore had just re-formed. It is still residue. Two unrelated mechanisms
-that happen to sum correctly: coincidence in the totals wearing the appearance of
-reconciliation -- a control derived from the measurement it controls, one level up.
-
-**So: anyone who later adds or removes a row from this set must RE-RUN THE FIXED POINT, not
-adjust the count.** Eligibility is a property of the set (§4g), a restore creates a violation
-as readily as a deletion, and the failure is silent -- the arithmetic keeps agreeing.
-
-## 4m. The merge was the third census, and it refused one module
-
-**`v2.workflow.floor2_prepared_subject` was deleted by this branch and is restored here.**
-Not because the measurement was wrong -- it was STILL-UNCONSUMED at base `90986d19469` on every
-decoded surface, and still is at that commit. It acquired a consumer *while this branch was
-open*: #8896 landed `src/v2/workflow/floor_terminal_ledger.dag`, which imports
-`WitnessIdentity` and `witness_identity_qualified_name` from it by name, as does its test.
-
-**Worth a section for the shape of the failure, which no measurement in this document could
-have had.** The two branches touch disjoint files: #8896 adds two files this branch never saw,
-this branch deletes one file #8896 never saw. **git merged them clean.** No textual conflict,
-no marker, no driver refusal -- and the merged tree does not compile. A three-way textual merge
-answers *did the same bytes change twice*; the deciding question is *does the merged tree still
-resolve*, which is not about bytes at all. **A merge preserves bytes, not measurements**: every
-count in this document is a statement about a tree, and the merge produced a tree none of them
-were measured against.
-
-The correction is the doctrine's own mechanism arriving one stage later than expected. §3 says
-the deletion is the census and the refusals are the instrument; here the refusal is a
-*merge-time* one, and the instrument that would have reported it is the floor on the merged
-tree -- which did not exist until the merge created it. **The re-score against the merged tree
-found exactly one**, and the §4l rule was followed rather than the count adjusted: the
-restore's own imports were checked for in-population consumers, the fixed point closed at one,
-no cascade followed.
-
-**The near-miss ledger now reads 2, both found by execution and neither by the census.**
-`gunbc.pr_digests` (defect 7, the floor refusing on an unread declaration surface) and this one
-(the merge refusing on a tree that did not exist when the surface was read). The same finding
-from two directions: **a static census is a statement about the tree it read, and both of its
-blind spots are trees -- the part it decoded wrongly, and the part not yet written.** The
-second is not fixable by improving the instrument.
-
-**And the arithmetic breaks the way §4l says it does, for a third unrelated reason.**
-`69 - 13 + 1 - 1 = 55` now reconciles, and the fourth term shares no mechanism with the other
-three: 13 evidential, 1 structural, 1 temporal. Anyone tempted to read that chain as a
-derivation should read §4l instead.
-
-
-### 4m.1 The rule this produced was wrong on its dangerous half, and the correction is unilateral
-
-**First statement of the consequence: "a PR that deletes a module and merges main cleanly is not
-verified by that clean merge, so deleters owe a resolve pass."** True, and it told a sibling
-lane it was clear when it was not. `bright-ferret-335` checked its subtree on that rule, found
-no deletion lanes -- #8877, #8909 and #8882 are purely additive -- and concluded it had nothing
-to check. #8909 adds three files that all import `v2.workflow.floor2_prepared_subject`, the
-module §4m restores.
-
-**The hazard is symmetric and the ADDER is the worse side.** A deleter that merges main
-discovers an added consumer in its own resolve. An adder that merges main is *already green*
-when the deletion lands later and breaks it -- and an additive PR feels safe by construction,
-so its author has no reason to ask whether anything it imports is scheduled for deletion in
-someone else's open branch. The party in danger is the party without a prompt.
-
-**The proposed repair was an intersection requiring publication** -- the deleter cannot see
-unmerged additions, the adder cannot see unmerged deletions, so one side publishes a list.
-**The first clause is false**, falsified by running it: open PR heads are on the remote,
-`gh pr list` enumerates them, `git fetch origin <sha>` retrieves them, and the intersection was
-run against all three sibling PRs from this side with no list. Zero real exposure: no qualified
-import of any of the 55, and of the 664 symbols declared solely by the 55 with no surviving
-declarer, one token hit -- `render_footer` in #8909, which declares its own and never depended
-on the deleted `tools.readme`. Deleting it *removes* a two-declarer whole-pool ambiguity rather
-than creating a break.
-
-**One result from that intersection has the opposite sign from a normal token hit, and is
-worth its own class.** `render_footer` read as a hazard -- a name declared by a module being
-deleted and used in an open PR -- and inverted on inspection: the consumer declares its own,
-and while `tools.readme` stands the name has TWO whole-pool declarers. It is AMBIGUOUS, and the
-deletion *removes* the ambiguity. **So a deletion can improve resolution safety, and the same
-intersection that finds breaks also finds these.** A reviewer reading every token hit as danger
-misclassifies this direction.
-
-It matters beyond one row because it is the ambient-pool defect in miniature: a name resolving
-by whole-pool uniqueness is **one deletion away from binding differently**, so its meaning is a
-function of the corpus denominator rather than of anything written at the declaration or the
-use. This deletion happens to move that name from two declarers to one. **Nothing structural
-guarantees the next one moves that way** -- the same mechanism can, elsewhere, silently rebind
-a use from one surviving declarer to another. That class is neither created nor closed by this
-change; it is visible from here because an intersection over deletions is one of the few
-operations that looks directly at it.
-
-**So the obligation is unilateral, which is the point of restating it.** A rule requiring
-publication requires coordination, which fails silently when a lane is busy, blocked or
-archived; a rule one party can execute alone has no such failure mode. **The deleter owes the
-intersection against every open PR head at merge time. The adder owes nothing but pushing.**
-That places the duty on the party that knows it is dangerous -- the sibling lane's own argument
-for why the adder cannot be trusted to look, one step further: an adder who cannot be expected
-to look cannot be expected to publish either.
-
-The residue is real but strictly smaller than the version needing coordination: this reaches
-*pushed* work only. Work in a never-pushed worktree is unreachable by any mechanism, and that
-alone is what publication would buy.
-
-## 5. The 55 deleted
-
-| module | path | bucket |
-| --- | --- | --- |
-| `gunbc.assimilate.bmc_wif_canary_bootstrap` | `dag/gunbc/assimilate/bmc_wif_canary_bootstrap.dag` | STILL-UNCONSUMED |
-| `gunbc.cursor_sdk_secure_api_key` | `dag/gunbc/cursor_sdk_secure_api_key.dag` | STILL-UNCONSUMED |
-| `gunbc.devboot.vertical_receipt` | `dag/gunbc/devboot/vertical_receipt.dag` | STILL-UNCONSUMED |
-| `gunbc.floor_resolve_realization` | `dag/gunbc/floor_resolve_realization.dag` | STILL-UNCONSUMED |
-| `gunbc.language_subject_scope_scaffold` | `dag/gunbc/language_subject_scope_scaffold.dag` | STILL-UNCONSUMED |
-| `gunbc.p3a1_self_fork_homonym_disposition` | `dag/gunbc/p3a1_self_fork_homonym_disposition.dag` | STILL-UNCONSUMED |
-| `gunbc.parse_allowlist` | `dag/gunbc/parse_allowlist.dag` | STILL-UNCONSUMED |
-| `gunbc.provider_standing_live_probes` | `dag/gunbc/provider_standing_live_probes.dag` | STILL-UNCONSUMED |
-| `gunbc.scm.commit_closure_store` | `dag/gunbc/scm/commit_closure_store.dag` | STILL-UNCONSUMED |
-| `gunbc.site.register_principles` | `dag/gunbc/site/register_principles.dag` | STILL-UNCONSUMED |
-| `gunbc.srv4_seeded_install_media_artifact` | `dag/gunbc/srv4_seeded_install_media_artifact.dag` | STILL-UNCONSUMED |
-| `gunbc.tools.bmc_onboard_validate` | `dag/gunbc/tools/bmc_onboard_validate.dag` | STILL-UNCONSUMED |
-| `gunbc.tools.grounding_confirm` | `dag/gunbc/tools/grounding_confirm.dag` | STILL-UNCONSUMED |
-| `gunbc.tools.roadmap_spawn_request` | `dag/gunbc/tools/roadmap_spawn_request.dag` | STILL-UNCONSUMED |
-| `gunbc.witness_family_fanout` | `dag/gunbc/witness_family_fanout.dag` | STILL-UNCONSUMED |
-| `shared.dag_util` | `dag/shared/dag_util.dag` | DEAD-CONSUMER-ONLY |
-| `std.binding` | `dag/std/binding.dag` | STILL-UNCONSUMED |
-| `std.containers` | `dag/std/containers.dag` | STILL-UNCONSUMED |
-| `std.list` | `dag/std/list.dag` | STILL-UNCONSUMED |
-| `tools.build` | `dag/gunbc/instruments/build.dag` | STILL-UNCONSUMED |
-| `tools.codegen` | `dag/gunbc/instruments/codegen.dag` | STILL-UNCONSUMED |
-| `tools.readme` | `dag/gunbc/instruments/readme.dag` | STILL-UNCONSUMED |
-| `v2.bin.main` | `src/v2/bin/main.dag` | STILL-UNCONSUMED |
-| `v2.extdeps.formats.csv` | `src/v2/extdeps/formats/csv.dag` | STILL-UNCONSUMED |
-| `v2.extdeps.formats.json_schema` | `src/v2/extdeps/formats/json_schema.dag` | DEAD-CONSUMER-ONLY |
-| `v2.extdeps.formats.openapi` | `src/v2/extdeps/formats/openapi.dag` | STILL-UNCONSUMED |
-| `v2.extdeps.formats.toml` | `src/v2/extdeps/formats/toml.dag` | STILL-UNCONSUMED |
-| `v2.extdeps.formats.yaml` | `src/v2/extdeps/formats/yaml.dag` | DEAD-CONSUMER-ONLY |
-| `v2.test.language_model.go_r1` | `src/v2/extdeps/language_model/go_r1.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.go_r2a` | `src/v2/extdeps/language_model/go_r2a.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.go_r2b` | `src/v2/extdeps/language_model/go_r2b.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.go_r3_external` | `src/v2/extdeps/language_model/go_r3_external.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.python_cross_runtime_drift` | `src/v2/extdeps/language_model/python_cross_runtime_drift.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.python_l2_cross_target_parity` | `src/v2/extdeps/language_model/python_l2_cross_target_parity.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.python_r2a` | `src/v2/extdeps/language_model/python_r2a.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.python_r2b` | `src/v2/extdeps/language_model/python_r2b.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.python_r3_external` | `src/v2/extdeps/language_model/python_r3_external.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.rust_r2a` | `src/v2/extdeps/language_model/rust_r2a.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.rust_r2b` | `src/v2/extdeps/language_model/rust_r2b.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.rust_r3_external` | `src/v2/extdeps/language_model/rust_r3_external.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.typescript_r2a` | `src/v2/extdeps/language_model/typescript_r2a.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.typescript_r2b` | `src/v2/extdeps/language_model/typescript_r2b.dag` | STILL-UNCONSUMED |
-| `v2.test.language_model.typescript_r3_external` | `src/v2/extdeps/language_model/typescript_r3_external.dag` | STILL-UNCONSUMED |
-| `v2.extdeps.typecheckers.mypy` | `src/v2/extdeps/typecheckers/mypy.dag` | STILL-UNCONSUMED |
-| `v2.extdeps.typecheckers.pyright` | `src/v2/extdeps/typecheckers/pyright.dag` | STILL-UNCONSUMED |
-| `v2.test.algebra_laws.zip_eq_list_equality` | `src/v2/std/algebra_laws/zip_eq_list_equality.dag` | STILL-UNCONSUMED |
-| `v2.std.inhabitant_bridge` | `src/v2/std/inhabitant_bridge.dag` | STILL-UNCONSUMED |
-| `v2.test.nat_semiring.rung_l1_go_compiler_slice` | `src/v2/std/nat_semiring/rung_l1_go_compiler_slice.dag` | STILL-UNCONSUMED |
-| `v2.test.nat_semiring.rung_l1_python_runtime` | `src/v2/std/nat_semiring/rung_l1_python_runtime.dag` | STILL-UNCONSUMED |
-| `v2.test.qualified_name.from_node` | `src/v2/std/qualified_name/from_node.dag` | STILL-UNCONSUMED |
-| `v2.std.type_expr_projection_row_schema` | `src/v2/std/type_expr_projection_row_schema.dag` | STILL-UNCONSUMED |
-| `v2.workflow.ci_stage0_partition_compile_gate_emit` | `src/v2/workflow/ci_stage0_partition_compile_gate_emit.dag` | STILL-UNCONSUMED |
-| `v2.workflow.ci_v1_compiler_test_targets_compile_gate_emit` | `src/v2/workflow/ci_v1_compiler_test_targets_compile_gate_emit.dag` | STILL-UNCONSUMED |
-| `v2.test.workflow.host_discovered_owned_data_manifest` | `src/v2/workflow/host_discovered_owned_data_manifest.dag` | STILL-UNCONSUMED |
-| `v2.workflow.probe_selector_host_health` | `src/v2/workflow/probe_selector_host_health.dag` | STILL-UNCONSUMED |
-
-## 6. The 58 held, with the reason each survived
-
-**Held is not keep.** Every row carries a typed reason and an owed next step; none is
-dispositioned as "consumed". The census's instruction is that a refusal is data, and 58
-refusals over a 114-row residue is the measurement this lane produces.
-
-Separately, **97 rows sit in AMBIGUOUS-SHARED-ONLY**, outside the residue entirely: not
-provably unconsumed, not proven consumed, each needing a per-row read. 13 arrived there from
-this lane's own re-derivation (§4d).
-
-### Residue, but named somewhere this cut would strand (35)
-
-Named by a live `.dag`, `.rs` or data file, or otherwise carrying an obligation the deletion precondition refuses to guess at. Weak evidence both ways: several are receipt prose and ordinary residue; at least one (`v2.workflow.product_receipt_stage`) is a live transport named via an `--entry` path held in a *variable*, the dynamically-composed-argv blind spot the census declares.
-
-| module | path | bucket |
-| --- | --- | --- |
-| `direct_rust_door_ingest_fixture` | `src/v2/compiler/self_host/direct_rust_door_ingest_fixture.dag` | STILL-UNCONSUMED |
-| `extdeps.bmc.mock_corpus` | `dag/extdeps/bmc/mock_corpus.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.ebay.mock_corpus` | `dag/extdeps/ebay/mock_corpus.dag` | STILL-UNCONSUMED |
-| `extdeps.linux.mock_corpus` | `dag/extdeps/linux/mock_corpus.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.tcgplayer.mock_corpus` | `dag/extdeps/tcgplayer/mock_corpus.dag` | STILL-UNCONSUMED |
-| `gunbc.auth.optional_impersonation` | `dag/gunbc/auth/optional_impersonation.dag` | STILL-UNCONSUMED |
-| `gunbc.auth.patterns` | `dag/gunbc/auth/patterns.dag` | STILL-UNCONSUMED |
-| `gunbc.char_at_scaling_probe_support` | `dag/gunbc/char_at_scaling_probe_support.dag` | STILL-UNCONSUMED |
-| `gunbc.ci_build_job_v1_compiler_unit_receipt` | `dag/gunbc/ci/ci_build_job_v1_compiler_unit_receipt.dag` | STILL-UNCONSUMED |
-| `gunbc.generic_binder_field_projection_deficit` | `dag/gunbc/generic_binder_field_projection_deficit.dag` | STILL-UNCONSUMED |
-| `gunbc.githooks_pre_push_cli` | `dag/gunbc/githooks/githooks_pre_push_cli.dag` | STILL-UNCONSUMED |
-| `gunbc.namespace_census_receipt` | `dag/gunbc/namespace/namespace_census_receipt.dag` | STILL-UNCONSUMED |
-| `gunbc.p1_retention_cohort_receipt` | `dag/gunbc/p1_retention_cohort_receipt.dag` | STILL-UNCONSUMED |
-| `gunbc.plans.affected_set_self_confirmation` | `dag/gunbc/plans/affected_set_self_confirmation.dag` | STILL-UNCONSUMED |
-| `gunbc.plans.fleet_subsumption_manual_gaps` | `dag/gunbc/plans/fleet_subsumption_manual_gaps.dag` | STILL-UNCONSUMED |
-| `gunbc.plans.host_convergence_circuit_residue` | `dag/gunbc/plans/host_convergence_circuit_residue.dag` | STILL-UNCONSUMED |
-| `gunbc.plans.transport_argv_anemia_dissolution` | `dag/gunbc/plans/transport_argv_anemia_dissolution.dag` | STILL-UNCONSUMED |
-| `gunbc.seed_closed_vocabulary_wildcard_census` | `dag/gunbc/seed_closed_vocabulary_wildcard_census.dag` | STILL-UNCONSUMED |
-| `gunbc.site.interaction` | `dag/gunbc/site/interaction.dag` | STILL-UNCONSUMED |
-| `gunbc.test_node_wall_clock_ratchet` | `dag/gunbc/test_node_wall_clock_ratchet.dag` | STILL-UNCONSUMED |
-| `gunbc.v1_maintenance_standing` | `dag/gunbc/v1/v1_maintenance_standing.dag` | STILL-UNCONSUMED |
-| `std.exec_format` | `dag/std/exec_format.dag` | DEAD-CONSUMER-ONLY |
-| `std.import` | `dag/std/import.dag` | STILL-UNCONSUMED |
-| `std.methods` | `dag/std/methods.dag` | STILL-UNCONSUMED |
-| `std.verification` | `dag/std/verification.dag` | STILL-UNCONSUMED |
-| `v2.std.datetime` | `src/v2/std/datetime.dag` | DEAD-CONSUMER-ONLY |
-| `v2.std.probe_selector` | `src/v2/std/probe_selector.dag` | DEAD-CONSUMER-ONLY |
-| `v2.std.rust_leaf_model_claim` | `src/v2/std/rust_leaf_model_claim.dag` | DEAD-CONSUMER-ONLY |
-| `v2.test.workflow.glob_discovery_law` | `src/v2/workflow/glob_discovery_law.dag` | STILL-UNCONSUMED |
-| `v2.workflow.class_b_import_closure_transport` | `src/v2/workflow/class_b_import_closure_transport.dag` | DEAD-CONSUMER-ONLY |
-| `v2.workflow.compiler_closure_ingest_transport` | `src/v2/workflow/compiler_closure_ingest_transport.dag` | DEAD-CONSUMER-ONLY |
-| `v2.workflow.phase_profile_proof_plan` | `src/v2/workflow/phase_profile_proof_plan.dag` | STILL-UNCONSUMED |
-| `v2.workflow.product_receipt_stage` | `src/v2/workflow/product_receipt_stage.dag` | STILL-UNCONSUMED |
-| `v2.workflow.source_root_ingest_gate` | `src/v2/workflow/source_root_ingest_gate.dag` | STILL-UNCONSUMED |
-| `v2.workflow.source_root_ingest_transport` | `src/v2/workflow/source_root_ingest_transport.dag` | DEAD-CONSUMER-ONLY |
-
-### Declares an `ExternalAuthority` anchor (21)
-
-DESIGN §3's extdeps citation duty: the value may be the citation, not a call, so unreachability is not evidence of residue. Mostly `DEAD-CONSUMER-ONLY` — the island shape — so they delete as connected components or not at all (census B6+, one island per PR, each gated on whether the citation is the deliverable).
-
-| module | path | bucket |
-| --- | --- | --- |
-| `extdeps.boot.emit` | `dag/extdeps/boot/emit.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.boot.framebuffer` | `dag/extdeps/boot/framebuffer.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.boot.freestanding_payload` | `dag/extdeps/boot/freestanding_payload.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.boot.linux_x86_boot` | `dag/extdeps/boot/linux_x86_boot.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.cloud.gcp.sts` | `dag/extdeps/cloud/gcp/sts.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.colo.types` | `dag/extdeps/colo/types.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.container.oci.image_config` | `dag/extdeps/container/oci/image_config.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.container.oci.linux` | `dag/extdeps/container/oci/linux.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.container.oci.manifest` | `dag/extdeps/container/oci/manifest.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.container.oci.runtime_config` | `dag/extdeps/container/oci/runtime_config.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.ebay.ebay_contracts` | `dag/extdeps/ebay/ebay_contracts.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.formats.elf.encode` | `dag/extdeps/formats/elf/encode.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.formats.elf.hello_static_witness` | `dag/extdeps/formats/elf/hello_static_witness.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.formats.elf.primitives` | `dag/extdeps/formats/elf/primitives.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.formats.elf.segments` | `dag/extdeps/formats/elf/segments.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.formats.elf.types` | `dag/extdeps/formats/elf/types.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.github.mergeable_state_contracts` | `dag/extdeps/github/mergeable_state_contracts.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.posix.rusage` | `dag/extdeps/posix/rusage.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.runtime.local` | `dag/extdeps/runtime/local.dag` | DEAD-CONSUMER-ONLY |
-| `extdeps.tcgplayer.tcgplayer` | `dag/extdeps/tcgplayer/tcgplayer.dag` | DEAD-CONSUMER-ONLY |
-| `gunbc.hand_lens_host_bridge_scaffold_index` | `dag/gunbc/hand_lens_host_bridge_scaffold_index.dag` | DEAD-CONSUMER-ONLY |
-
-### Frozen against a named re-add (2)
-
-DESIGN §3 frozen-X. Deleting these deletes what the re-add queue exists to re-attach.
-
-| module | path | bucket |
-| --- | --- | --- |
-| `tools.dag_compile_clean_seam_transport` | `dag/gunbc/instruments/dag_compile_clean_seam_transport.dag` | DEAD-CONSUMER-ONLY |
-| `tools.merge_admission_capture_transport` | `dag/gunbc/instruments/merge_admission_capture_transport.dag` | STILL-UNCONSUMED |
-
-## 7. What this change does NOT claim
-
-- **Not that 55 is the maximum safe cut.** It is the subset provable clean on every decoded
-  surface, islands closed. The 35 rows held for a per-row read are held on a *string mention*,
-  weak evidence in both directions.
-- **Not that the residue is now 58.** Five modules moved DEAD-CONSUMER-ONLY to
-  STILL-UNCONSUMED as their island neighbours went. **The residue is a fixed point reached by
-  iteration, not a set reached in one pass**, and a follow-on pass is owed.
-- **Not that the AMBIGUOUS bucket is cleared.** 97 rows are unresolvable at identity grain.
-  13 got there from this lane's own correction; reading that as "13 live modules found" would
-  be exactly wrong: they are *not proven consumed either*.
-- **Not that the extractor is now correct.** Four defects were found in it, three by someone
-  else hand-reading rows while every counter stayed consistent. The honest claim is that it
-  passes four discriminators it previously failed one of, not that a fifth defect does not
-  exist.
-- **Not that the directive's second arm was served.** Every row was deleted or held; **none
-  was wired up.** The candidates are the 21 `CITED-AUTHORITY` islands and the 22 modules the
-  census found named `v2.test.*` while declaring no test and sitting outside every test path
-  -- a name asserting enrolment that floor discovery, which keys on the file suffix, never
-  grants.
-
-## 8. Evidence
-
-The deletion's discriminating check is not "the tree still parses" -- 71 modules nothing
-imports would parse-clean whether or not they were load-bearing. It is the pair of counters in
-section 2 that must not move (`reachable`, `CONSUMED-DECISIVE`) beside the one that must
-(`population`, by exactly the number of files removed), plus the required run:
-
-`claim_executor --required-ci --source-root dag --source-root src/v2` -- the three-phase
-required mode (src/v1 `.dag` parse sweep, `--required-regen`, witness floor). Its result on
-this branch is reported on the PR.
-
-**The instrument is not committed, by repository rule:** `.gitignore` excludes `*.py`
-tree-wide, so the audit script that produced these numbers has no home here. It is fully
-specified instead -- the census's own section-2 method without deviation; the two arms that
-matter, exactly:
-
-- **Roots** are the discovery paths (`/test/`, `*_test.dag`, `/lens/`, `/manual/`,
-  `/fixture*`), every `--entry` argv literal and `*entry*:` path field found in any `.dag`,
-  `.rs`, `.md`, `.yml`, `.sh` or `.toml` file, and every module whose name-with-underscores
-  matches a `src/v1/stage0/src/*.rs` seed mirror. Edges are `import` lines plus
-  fully-qualified `module.symbol` references resolved by longest-prefix against the module
-  index. The population is what no root reaches.
-- **The defect-6 re-score** takes each population member's declared symbols -- not its name,
-  not its path -- keeps only those declared by exactly one module corpus-wide, and asks
-  whether any other `.dag` file names one bare. Comments and string literals are removed
-  with a character scanner, never a regex, because a regex terminates early on the `\{`
-  interpolation escapes real `.dag` prose contains. An identifier preceded by `.` or
-  followed by `:` is not a reference.
-
-That specification makes the numbers disagreeable: re-implementing it is a half-page, and any
-reader who does so and gets a different answer has found a defect in one of us. Beside it, the
-two counters in section 2 are checkable without the instrument -- `reachable` and
-`CONSUMED-DECISIVE` not moving is a claim about the tree, not about the
-script.
\ No newline at end of file
diff --git a/docs/plans/uses-occurrence-census.md b/docs/plans/uses-occurrence-census.md
deleted file mode 100644
index c9b81926ee6..00000000000
--- a/docs/plans/uses-occurrence-census.md
+++ /dev/null
@@ -1,364 +0,0 @@
-# USES-0 census: authored `uses` joined to body-derived demand
-
-Authority: operator D13 (2026-09-18), recorded in `gunbc.plans.demand_engine_program`. This analysis is the identity-grain join. It does not delete or add any `uses` row.
-
-## Method
-
-Two independently produced populations:
-
-1. **Authored `uses` rows** — every parsed function/pattern header clause `uses alias: Type` in committed `.dag` source (not AST field `uses:`, not GHA `uses:`, not comments). Identity is `(module file, declaration, alias, type)`.
-2. **Body-derived demand (session approximation of DependencyDemand)** — capitalized dotted operation references in the visible body that inhabit the authored resource, plus `file_compare_and_set` (Filesystem) and `clock_now_probed_at` (Clock); plus calls to other declarations that themselves author a `uses` of the same normalized resource (`Network` = `std.resources.Network`).
-
-A dotted call is **not** Network demand merely because it is a host operation. `Filesystem.*` is Filesystem. `shell.Mktemp`, `shell.Remove`, `shell.Move`, `shell.Env`, `os.Hostname`, and `git.Inspect` / `git.Core` are local and do not establish Network. Classifying `read_docker_hub_image_config_at_digest` as DirectRestatement from `shell.Mktemp` was that error (review 67467): the Network work is `docker_hub_bearer_token` → `http.Client.GetBounded` with no `uses` on those helpers, which is Unresolved.
-
-This is **not** the compiler `DependencyDemand` carrier. Whole-corpus resolve that would produce that carrier is CI-sized (the seed cannot hold the v2 closure under a session cap). Rows the source join cannot decide are `Unresolved` — that class is the CI-side remainder, not a count to close by hand. No cardinality is an oracle; membership is the table. A helper call that is not itself a `uses` declaration, and is not a known pure combinator, is insufficient call relation: class Unresolved, even if the body also shows a *different* resource.
-
-## Class dispositions (D13)
-
-| Class | When | Disposition |
-| --- | --- | --- |
-| DirectRestatement | body directly references a resolved operation of this resource | delete/derive |
-| TransitiveRestatement | body only calls another declaration that requires it | delete/derive over call relations |
-| NamedDependencyBinder | a distinct logical provider identity actually used in the body | move to dependency-subject or capability param |
-| OpaqueContract | no body; requirement not derivable | keep as contract |
-| PolicyEnvelope | constrains what may be used, not actual use | move to policy |
-| UnusedRequirement | no body path consumes this authored identity | delete/refuse |
-| Unresolved | identity/call relations insufficient (typically a helper without `uses` that still performs host work) | typed refusal until resolution names the relation |
-
-## Empty classes in the live parsed population
-
-- **OpaqueContract** — every live `uses` clause is followed by a visible body. The interesting inverse is `gunbc.clock_read` `clock_now_probed_at`, which calls `Clock.Now()` with **no** authored `uses`.
-- **PolicyEnvelope** — no header constrains a derived set (no may-not-use / upper-bound form exists in source).
-- **NamedDependencyBinder** — every live alias is the generic interface (`net: Network`, `fs: Filesystem`, `clock: Clock`). No row distinguishes `source_tree` from `output_tree`. Fixture strings that bind `net: EaNet` / `GewNet` / `ZpeNet` and read `net.id` are the binder-shaped specimens, listed separately.
-
-Likely outcome per the ruling: the function-level `uses` clause disappears for transparent bodies; what would survive is opaque/subject/policy, of which the live corpus currently has none.
-
-## DirectRestatement
-
-| File | Declaration | Alias | Authored type | Evidence |
-| --- | --- | --- | --- | --- |
-| `dag/gunbc/assimilate/bmc_bootstrap_provision.dag` | `bmc_bootstrap_provision_srv3` | `net` | `std.resources.Network` | ops shell.GCloud.AuthPrintAccessToken, gcp.ServiceUsage.BatchEnableServices, gcp.IamAdmin.CreateServiceAccount, gcp.SecretManager.GetSecretIamPolicy, gcp.SecretManager.SetSecretIamPolicy |
-| `dag/gunbc/auth/access_token_source.dag` | `ensure_access_token` | `net` | `Network` | ops shell.GCloud.AuthPrintAccessToken; local-ops shell.Env.Get |
-| `dag/gunbc/auth/credentials.dag` | `gcp_secret_credential` | `net` | `std.resources.Network` | ops shell.GCloud.AuthPrintAccessToken, gcp.SecretManager.AccessVersion |
-| `dag/gunbc/auth/credentials.dag` | `gcp_adc_token_from_credentials` | `net` | `std.resources.Network` | ops oauth2.Google.Refresh |
-| `dag/gunbc/auth/gcp_secret_access.dag` | `secret_access_ensure_for` | `net` | `Network` | ops gcp.SecretManager.GetSecretIamPolicy, gcp.SecretManager.SetSecretIamPolicy; callees ensure_access_token |
-| `dag/gunbc/auth/patterns.dag` | `credential_chain` | `net` | `std.resources.Network` | ops gcp.STS.Exchange, gcp.SecretManager.AccessVersion |
-| `dag/gunbc/auth/patterns.dag` | `github_oidc` | `net` | `std.resources.Network` | ops github.OIDC.GetToken; local-ops shell.Env.Get, shell.Env.Get |
-| `dag/gunbc/auth/patterns.dag` | `metadata_oidc` | `net` | `std.resources.Network` | ops gcp.Metadata.GetIdentityToken |
-| `dag/gunbc/auth/secret_ref_credential.dag` | `fetch_secret_ref_credential_with_token` | `net` | `Network` | ops gcp.SecretManager.AccessVersion |
-| `dag/gunbc/command_runner.dag` | `run_shell_command` | `net` | `Network` | ops shell.Exec.RunArgv |
-| `dag/gunbc/command_runner.dag` | `run_shell_command_observe` | `net` | `Network` | ops shell.Exec.RunArgv |
-| `dag/gunbc/host/host_reset_return_run.dag` | `host_is_reachable` | `net` | `std.resources.Network` | ops ssh.Session.Reachability |
-| `dag/gunbc/machine_intake/megarac_media_attach.dag` | `megarac_attach_remote_image` | `net` | `std.resources.Network` | ops megarac.Media.OpenSession; callees megarac_attach_then_release, megarac_release_unreadable_session |
-| `dag/gunbc/machine_intake/megarac_media_attach.dag` | `megarac_release_unreadable_session` | `net` | `std.resources.Network` | ops megarac.Media.CloseSession |
-| `dag/gunbc/machine_intake/megarac_media_attach.dag` | `megarac_attach_then_release` | `net` | `std.resources.Network` | ops megarac.Media.CloseSession; callees megarac_attach_with_token |
-| `dag/gunbc/machine_intake/megarac_media_attach.dag` | `megarac_attach_with_token` | `net` | `std.resources.Network` | ops megarac.Media.GetRemoteConfigurations, megarac.Media.GetRemoteImages; callees megarac_start_and_confirm |
-| `dag/gunbc/machine_intake/megarac_media_attach.dag` | `megarac_start_and_confirm` | `net` | `std.resources.Network` | ops megarac.Media.StartMedia, megarac.Media.GetRemoteConfigurations |
-| `dag/gunbc/machine_intake/oob_boot_handoff.dag` | `oob_power_cycle_after_confirmed_selection` | `net` | `std.resources.Network` | ops diagnostic.ipmi.Tool.ChassisPowerControl |
-| `dag/gunbc/machine_intake/oob_boot_handoff.dag` | `oob_boot_handoff` | `net` | `std.resources.Network` | ops diagnostic.ipmi.Tool.ChassisBootDev, diagnostic.ipmi.Tool.ChassisBootParamGet; callees oob_power_cycle_after_confirmed_selection |
-| `dag/gunbc/roadmap/roadmap_launch_deployment_cli.dag` | `rlm_predecessor_run` | `net` | `Network` | ops github.WorkflowRuns.GetRun |
-| `dag/gunbc/srv3/srv3_boot_once_cd.dag` | `srv3_boot_once_cd_gated` | `clock` | `std.resources.Clock` | ops clock_now_probed_at |
-| `dag/gunbc/srv3/srv3_boot_once_cd.dag` | `srv3_claim_boot_once_cd_authorization` | `fs` | `std.resources.Filesystem` | ops file_compare_and_set |
-| `dag/gunbc/srv3/srv3_boot_once_cd.dag` | `srv3_settle_boot_once_cd_claim` | `fs` | `std.resources.Filesystem` | ops file_compare_and_set |
-| `dag/gunbc/srv3/srv3_boot_once_cd.dag` | `srv3_boot_once_cd_resolved` | `net` | `std.resources.Network` | ops Filesystem.Write, redfish.Http.SetBootSourceOverride, Filesystem.Write, redfish.Http.ResetSystem; callees materialize_bmc_login_password; other-demand Filesystem |
-| `dag/gunbc/tools/bmc_first_contact.dag` | `bmc_first_contact` | `net` | `std.resources.Network` | ops redfish.Http.GetSystem; local-ops shell.Env.Get |
-| `dag/gunbc/tools/bmc_onboard.dag` | `bmc_rotate_credential` | `net` | `Network` | ops Filesystem.Write, redfish.Http.SetAccountPassword, redfish.Http.GetSystem; other-demand Filesystem |
-| `dag/gunbc/tools/bmc_onboard.dag` | `bmc_store_and_rotate` | `net` | `Network` | ops gcp.SecretManager.AddVersion, gcp.SecretManager.AccessVersion; callees ensure_access_token, bmc_rotate_credential |
-| `dag/gunbc/tools/bmc_onboard.dag` | `bmc_assimilate_credential` | `net` | `Network` | ops redfish.Http.GetServiceRoot, redfish.Http.GetSystem; callees bmc_store_and_rotate |
-| `dag/gunbc/tools/bmc_onboard.dag` | `bmc_probe_credential_phase` | `net` | `Network` | ops redfish.Http.GetSystem, gcp.SecretManager.AccessVersion, redfish.Http.GetSystem; callees ensure_access_token |
-| `dag/gunbc/tools/bmc_onboard.dag` | `bmc_converge_credential` | `net` | `Network` | ops redfish.Http.GetServiceRoot; callees bmc_store_and_rotate, bmc_probe_credential_phase |
-| `dag/gunbc/tools/bmc_read_telemetry.dag` | `bmc_read_telemetry` | `net` | `std.resources.Network` | ops redfish.Http.GetSystem, redfish.Http.GetChassisSensors; local-ops shell.Env.Get, shell.Env.Get |
-| `dag/test/ctl/pos_emit.dag` | `emits_a_service_call` | `net` | `std.resources.Network` | ops diagnostic.ipmi.Tool.SensorList |
-| `dag/test/ctl/pos_emit2.dag` | `emits_a_two_segment_call` | `net` | `std.resources.Network` | ops cargo.Build.Run |
-| `dag/test/ctl/pos_service.dag` | `call_three_segment` | `net` | `std.resources.Network` | ops diagnostic.ipmi.Tool.SensorList |
-
-## TransitiveRestatement
-
-| File | Declaration | Alias | Authored type | Evidence |
-| --- | --- | --- | --- | --- |
-| `dag/gunbc/auth/credentials.dag` | `gcp_oauth_access_token_via_adc_refresh` | `net` | `std.resources.Network` | ops Filesystem.Read; callees gcp_adc_token_from_credentials; other-demand Filesystem |
-| `dag/gunbc/auth/credentials.dag` | `gcp_oauth_access_token_adc_for_path` | `net` | `std.resources.Network` | callees gcp_oauth_access_token_via_adc_refresh |
-| `dag/gunbc/auth/secret_access_admission.dag` | `secret_access_ensure_admitted` | `net` | `Network` | callees secret_access_ensure_for |
-| `dag/gunbc/auth/secret_ref_credential.dag` | `fetch_secret_ref_credential` | `net` | `Network` | callees fetch_secret_ref_credential_with_token, ensure_access_token |
-| `dag/gunbc/bmc/bmc_fan_converge.dag` | `bmc_fan_run` | `net` | `Network` | callees fetch_secret_ref_credential |
-| `dag/gunbc/bmc/bmc_fan_converge.dag` | `srv3_bmc_fan_observe` | `net` | `Network` | callees bmc_fan_run |
-| `dag/gunbc/bmc/bmc_fan_converge.dag` | `srv3_bmc_fan_converge` | `net` | `Network` | callees bmc_fan_run |
-| `dag/gunbc/bmc/bmc_fan_converge.dag` | `srv4_bmc_fan_observe` | `net` | `Network` | callees bmc_fan_run |
-| `dag/gunbc/bmc/bmc_fan_converge.dag` | `srv4_bmc_fan_converge` | `net` | `Network` | callees bmc_fan_run |
-| `dag/gunbc/bmc/bmc_fan_converge.dag` | `srv4_bmc_fan_rollback_previous` | `net` | `Network` | callees bmc_fan_run |
-| `dag/gunbc/bmc/bmc_netboot_serve.dag` | `bmc_netboot_run_bmc` | `net` | `Network` | callees run_shell_command |
-| `dag/gunbc/bmc/bmc_netboot_serve.dag` | `bmc_netboot_put_path` | `net` | `Network` | callees run_shell_command |
-| `dag/gunbc/bmc/bmc_netboot_serve.dag` | `bmc_netboot_stage_file` | `net` | `Network` | callees bmc_netboot_stage_inline, bmc_netboot_put_path |
-| `dag/gunbc/bmc/bmc_netboot_serve.dag` | `bmc_netboot_stage_inline` | `net` | `Network` | ops Filesystem.Write; callees bmc_netboot_put_path; other-demand Filesystem |
-| `dag/gunbc/bmc/bmc_netboot_serve.dag` | `bmc_netboot_provision` | `net` | `Network` | callees bmc_netboot_run_bmc, bmc_netboot_stage_file |
-| `dag/gunbc/bmc/bmc_netboot_serve.dag` | `srv4_bmc_netboot_provision` | `net` | `Network` | callees bmc_netboot_provision |
-| `dag/gunbc/busybox_bmc_build.dag` | `busybox_bmc_build_run` | `net` | `Network` | callees run_shell_commands |
-| `dag/gunbc/command_runner.dag` | `run_shell_command_capture` | `net` | `Network` | callees run_shell_command_observe |
-| `dag/gunbc/command_runner.dag` | `run_shell_commands` | `net` | `Network` | callees run_shell_command |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_effective_user_wet` | `net` | `Network` | callees run_shell_command_capture |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_host_short_wet` | `net` | `Network` | callees run_shell_command_capture |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_timer_members_wet` | `net` | `Network` | callees run_shell_command_capture |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_fleet_converge_request_wet` | `net` | `Network` | callees observe_runner_unit_standings_wet, observe_slot_retirement_evidence_wet, observe_runner_slot_members_with_provenance_wet, observe_timer_members_wet, observe_cap_members_wet |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_slot_retirement_evidence_wet` | `net` | `Network` | callees observe_transition_retirement_evidence |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_runner_unit_standings_wet` | `net` | `Network` | callees observe_runner_unit_standing_wet |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `write_fleet_converge_plan_artifact_wet` | `net` | `Network` | ops Filesystem.Write, Filesystem.Write, Filesystem.Write, Filesystem.Write, Filesystem.Write; callees run_shell_commands; other-demand Filesystem |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `fleet_converge_allocation_store_plan_wet` | `net` | `Network` | callees write_fleet_converge_plan_artifact_wet, observe_generation_store_wet, observe_host_short_wet |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `fleet_converge_plan_wet` | `net` | `Network` | callees fleet_converge_scoped_plan_wet |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `fleet_converge_launch_environment_plan_wet` | `net` | `Network` | callees fleet_converge_scoped_plan_wet |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `fleet_converge_scoped_plan_wet` | `net` | `Network` | callees fleet_converge_plan_scoped_bound_wet |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `fleet_converge_plan_scoped_bound_wet` | `net` | `Network` | ops Filesystem.Write, Filesystem.Write, Filesystem.Write, Filesystem.Write, Filesystem.Write; callees run_shell_commands, observe_generation_store_wet, observe_host_short_wet, observe_fleet_converge_request_wet; other-demand Filesystem |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `fleet_converge_apply_wet` | `net` | `Network` | callees fleet_converge_apply_bound_wet |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `fleet_converge_apply_bound_wet` | `net` | `Network` | ops Filesystem.Read, Filesystem.Read, Filesystem.Read, Filesystem.Read, Filesystem.Read; callees run_shell_commands, observe_effective_user_wet, observe_host_short_wet, observe_fleet_converge_request_wet; other-demand Filesystem |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `fleet_converge_local_plan_wet` | `net` | `Network` | callees observe_host_short_wet, observe_operator_local_run_binding, fleet_converge_plan_scoped_bound_wet |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `fleet_converge_operator_cli_entry` | `net` | `Network` | ops Filesystem.Read, Filesystem.Write; callees fleet_converge_operator_cli_dispatch, observe_operator_local_run_binding; other-demand Filesystem |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `fleet_converge_operator_cli_dispatch` | `net` | `Network` | local-ops git.Core.CurrentBranch; callees fleet_converge_local_apply_wet, fleet_converge_local_plan_wet, observe_host_short_wet |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `fleet_converge_local_apply_wet` | `net` | `Network` | ops Filesystem.Read; callees observe_operator_local_run_binding, fleet_converge_apply_bound_wet; other-demand Filesystem |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_runner_slot_provenance_wet` | `net` | `Network` | callees run_shell_command_capture |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_runner_slot_members_with_provenance_wet` | `net` | `Network` | callees observe_runner_slot_provenance_wet, observe_runner_slot_members_wet |
-| `dag/gunbc/fleet/fleet_host_key_enrollment.dag` | `verify_enrollment_outcome` | `net` | `Network` | callees run_shell_command_capture |
-| `dag/gunbc/fleet/fleet_host_key_enrollment.dag` | `fleet_host_key_enroll_apply` | `net` | `Network` | ops Filesystem.Write; callees run_shell_commands, run_shell_command_capture; other-demand Filesystem |
-| `dag/gunbc/fleet/fleet_host_key_enrollment.dag` | `fleet_host_key_enroll_wet` | `net` | `Network` | ops Filesystem.Write; callees fleet_host_key_enroll_apply; other-demand Filesystem |
-| `dag/gunbc/fleet/fleet_host_key_enrollment.dag` | `fleet_authorized_key_self_enroll_wet` | `net` | `Network` | ops Filesystem.Write, Filesystem.Write; callees verify_enrollment_outcome, run_shell_command_capture; other-demand Filesystem |
-| `dag/gunbc/fleet/fleet_multi_principal_probe.dag` | `probe_agent_credential_verification` | `net` | `Network` | callees verify_fleet_ssh_agent_credential, materialize_agent_public_selector |
-| `dag/gunbc/fleet/fleet_multi_principal_probe.dag` | `fleet_multi_principal_probe_with_attempt` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees materialize_fleet_known_hosts_anchor, run_with_materialized_fleet_ssh_binding; other-demand Clock,Filesystem |
-| `dag/gunbc/fleet/fleet_multi_principal_probe.dag` | `spark_exact_grant_probe_wet` | `net` | `Network` | ops Filesystem.Write; callees materialize_fleet_known_hosts_anchor, run_with_materialized_fleet_ssh_binding; other-demand Filesystem |
-| `dag/gunbc/fleet/fleet_multi_principal_probe.dag` | `spark_managed_access_standing_for_attempt` | `net` | `Network` | callees spark_managed_access_standing_with_verified_credential, probe_agent_credential_verification |
-| `dag/gunbc/fleet/fleet_probe_identity_observe.dag` | `fleet_probe_identity_observe_wet` | `net` | `Network` | ops Filesystem.Write; callees run_shell_command_capture; other-demand Filesystem |
-| `dag/gunbc/fleet/fleet_ssh_credential_verify.dag` | `derive_identity_file_public_key_line` | `net` | `Network` | callees run_shell_command_capture |
-| `dag/gunbc/fleet/fleet_ssh_credential_verify.dag` | `verify_fleet_ssh_credential` | `net` | `Network` | callees derive_identity_file_public_key_line |
-| `dag/gunbc/fleet/fleet_ssh_credential_verify.dag` | `list_agent_identities` | `net` | `Network` | callees run_shell_command_capture |
-| `dag/gunbc/fleet/fleet_ssh_credential_verify.dag` | `verify_fleet_ssh_agent_credential` | `net` | `Network` | callees list_agent_identities |
-| `dag/gunbc/fleet/fleet_ssh_locus.dag` | `prepare_fleet_ssh_agent_context` | `net` | `Network` | callees fleet_ssh_context_from_verified_binding, verify_fleet_ssh_agent_credential, materialize_agent_public_selector |
-| `dag/gunbc/fleet/fleet_ssh_locus.dag` | `fleet_ssh_context_from_verified_binding` | `net` | `Network` | callees materialize_fleet_known_hosts_anchor |
-| `dag/gunbc/fleet/org_actions_converge.dag` | `org_admin_app_key_access_converge_with_supplied_token` | `net` | `Network` | callees secret_access_ensure_for |
-| `dag/gunbc/fleet/printer_job_start.dag` | `acquire_pinned_ca_bundle` | `net` | `Network` | local-ops shell.Mktemp.Dir; callees run_shell_command_capture |
-| `dag/gunbc/fleet/printer_job_start.dag` | `start_print_on_printer` | `net` | `Network` | callees publish_start_with_credential, fetch_secret_ref_credential |
-| `dag/gunbc/fleet/printer_job_start.dag` | `publish_start_with_credential` | `net` | `Network` | local-ops shell.Remove.RecursiveForce, shell.Remove.RecursiveForce, shell.Remove.RecursiveForce; callees acquire_pinned_ca_bundle, run_shell_command_capture |
-| `dag/gunbc/fleet/printer_project_delivery.dag` | `deliver_project_to_printer` | `net` | `Network` | local-ops shell.Remove.FileForce, shell.Remove.FileForce; callees fetch_secret_ref_credential, run_shell_command_capture |
-| `dag/gunbc/host/host_build_cache_provision.dag` | `provision_build_cache` | `net` | `Network` | callees host_toolchain_ensure |
-| `dag/gunbc/host/host_codex_runtime_provision.dag` | `provision_codex_runtime` | `net` | `Network` | callees host_toolchain_ensure |
-| `dag/gunbc/host/host_compile_pool_provision.dag` | `provision_compile_pool` | `net` | `Network` | callees host_toolchain_ensure |
-| `dag/gunbc/host/host_reset_return_run.dag` | `watch_step` | `net` | `std.resources.Network` | callees host_is_reachable |
-| `dag/gunbc/host/host_reset_return_run.dag` | `watch_for` | `net` | `std.resources.Network` | callees watch_step |
-| `dag/gunbc/host/host_reset_return_run.dag` | `observe_reset_return` | `net` | `std.resources.Network` | callees watch_for |
-| `dag/gunbc/host/host_reset_return_run.dag` | `subject_baseline` | `net` | `std.resources.Network` | callees host_is_reachable |
-| `dag/gunbc/host/host_reset_return_run.dag` | `host_reset_return_attempt` | `net` | `std.resources.Network` | callees host_reset_return_issue_and_watch, observer_self_corroboration, subject_baseline |
-| `dag/gunbc/host/host_reset_return_run.dag` | `host_reset_return_issue_and_watch` | `net` | `std.resources.Network` | callees oob_boot_handoff, observe_reset_return |
-| `dag/gunbc/host/host_reset_return_run.dag` | `host_reset_return_wet` | `net` | `std.resources.Network` | local-ops shell.Env.Get, shell.Env.Get; callees host_reset_return_exit, host_reset_return_attempt, host_reset_return_preflight_exit, host_reset_return_converge_route_read |
-| `dag/gunbc/instruments/pair_incumbent_identity_standing.dag` | `group_identity_standing` | `net` | `Network` | callees prepare_fleet_ssh_agent_context |
-| `dag/gunbc/instruments/pair_incumbent_identity_standing.dag` | `pair_incumbent_identity_standing` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees group_identity_standing; other-demand Clock,Filesystem |
-| `dag/gunbc/live_deploy/deployed_tree_report.dag` | `deployed_tree_report_ci_wet` | `net` | `Network` | callees deployed_tree_report_for_context, prepare_fleet_ssh_agent_context |
-| `dag/gunbc/machine_intake/boot_image_fetch.dag` | `fetch_verified_boot_image` | `net` | `std.resources.Network` | callees run_shell_command, verify_and_publish_boot_image |
-| `dag/gunbc/machine_intake/boot_image_fetch.dag` | `verify_and_publish_boot_image` | `net` | `std.resources.Network` | callees admit_then_publish_boot_image |
-| `dag/gunbc/machine_intake/boot_image_fetch.dag` | `admit_then_publish_boot_image` | `net` | `std.resources.Network` | callees publish_verified_boot_image |
-| `dag/gunbc/machine_intake/boot_image_fetch.dag` | `publish_verified_boot_image` | `net` | `std.resources.Network` | local-ops shell.Move.File; callees confirm_published_boot_image |
-| `dag/gunbc/machine_intake/mtcollins1_actuate.dag` | `mtcollins1_drive_handoff` | `net` | `std.resources.Network` | callees oob_boot_handoff |
-| `dag/gunbc/machine_intake/mtcollins1_actuate.dag` | `mtcollins1_netboot_handoff` | `net` | `std.resources.Network` | callees mtcollins1_drive_handoff |
-| `dag/gunbc/machine_intake/mtcollins1_actuate.dag` | `mtcollins1_cdrom_handoff` | `net` | `std.resources.Network` | callees mtcollins1_drive_handoff |
-| `dag/gunbc/machine_intake/mtcollins1_actuate.dag` | `mtcollins1_denied_admission_control` | `net` | `std.resources.Network` | callees mtcollins1_drive_handoff |
-| `dag/gunbc/machine_intake/mtcollins1_boot_image_fetch.dag` | `mtcollins1_fetch_boot_image` | `net` | `std.resources.Network` | callees fetch_verified_boot_image |
-| `dag/gunbc/machine_intake/mtcollins1_boot_image_fetch.dag` | `mtcollins1_fetch_boot_image_wrong_pin_control` | `net` | `std.resources.Network` | callees fetch_verified_boot_image |
-| `dag/gunbc/machine_intake/mtcollins1_boot_image_fetch.dag` | `mtcollins1_fetch_boot_image_unowned_export_control` | `net` | `std.resources.Network` | callees fetch_verified_boot_image |
-| `dag/gunbc/machine_intake/mtcollins1_media_attach.dag` | `mtcollins1_attach_absent_image_control` | `net` | `std.resources.Network` | callees megarac_attach_remote_image |
-| `dag/gunbc/machine_intake/mtcollins1_media_attach.dag` | `mtcollins1_attach_diskless_image` | `net` | `std.resources.Network` | callees megarac_attach_remote_image |
-| `dag/gunbc/product/printed_chassis/slicing_toolchain.dag` | `attempt_orca_execution` | `net` | `Network` | callees run_shell_command_capture |
-| `dag/gunbc/roadmap/roadmap_launch_deployment_cli.dag` | `persist_receipt` | `net` | `Network` | ops Filesystem.Write, Filesystem.Write, Filesystem.WriteOwnerOnly; callees run_shell_commands; other-demand Filesystem |
-| `dag/gunbc/roadmap/roadmap_launch_deployment_cli.dag` | `rlm_launch_deployment_receipt_wet` | `net` | `Network` | callees rlm_launch_deployment_receipt_bound, prepare_fleet_ssh_agent_context |
-| `dag/gunbc/roadmap/roadmap_launch_deployment_cli.dag` | `rlm_run_provenance_fact` | `net` | `Network` | callees rlm_predecessor_run |
-| `dag/gunbc/roadmap/roadmap_launch_deployment_cli.dag` | `rlm_launch_deployment_receipt_bound` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at_or_unknown; callees window_snapshot, observe_host_short_wet, rlm_run_provenance_fact, persist_receipt, unit_standing_fact; other-demand Clock,Filesystem |
-| `dag/gunbc/runner/runner_guest_image.dag` | `runner_guest_image_observe_wet` | `net` | `Network` | callees run_shell_commands |
-| `dag/gunbc/runner/runner_guest_image.dag` | `runner_guest_image_converge_wet` | `net` | `Network` | callees run_shell_commands |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `observe_runner_host_file` | `net` | `Network` | callees observe_runner_host_file_content, observe_runner_host_paths |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `apply_runner_host_file` | `net` | `Network` | callees observe_runner_host_paths |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `plan_runner_host_file` | `net` | `Network` | callees observe_runner_host_file |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `runner_host_manager_reload_step` | `net` | `Network` | callees reload_runner_host_manager |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `run_runner_host_files` | `net` | `Network` | callees apply_runner_host_file, plan_runner_host_file, observe_runner_slot_population, runner_host_manager_reload_step, observe_runner_host_administrator_privilege |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `runner_host_file_ci_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees prepare_fleet_ssh_agent_context, run_runner_host_files; other-demand Clock,Filesystem |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `runner_host_file_observe_ci_wet` | `net` | `Network` | callees runner_host_file_ci_wet |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `runner_host_file_converge_ci_wet` | `net` | `Network` | callees runner_host_file_ci_wet |
-| `dag/gunbc/runner/runner_host_kernel_config.dag` | `observe_built_kernel_config` | `net` | `Network` | callees run_shell_command_observe |
-| `dag/gunbc/runner/runner_host_kernel_config.dag` | `verify_built_kernel_config` | `net` | `Network` | callees observe_built_kernel_config |
-| `dag/gunbc/runner/runner_host_kernel_config.dag` | `verify_runner_host_kernel_config` | `net` | `Network` | callees verify_built_kernel_config |
-| `dag/gunbc/runner/runner_microvm_boot_probe.dag` | `runner_microvm_boot_probe_wet` | `net` | `Network` | ops Filesystem.Write; callees run_shell_commands, run_shell_command_observe, observe_firecracker_host_standing_wet; other-demand Filesystem |
-| `dag/gunbc/runner/runner_microvm_host_ready.dag` | `observe_firecracker_host_standing_wet` | `net` | `Network` | callees run_shell_command_capture |
-| `dag/gunbc/runner/runner_microvm_host_ready.dag` | `runner_microvm_host_observe_wet` | `net` | `Network` | ops Filesystem.Write; callees run_shell_commands, observe_firecracker_host_standing_wet; other-demand Filesystem |
-| `dag/gunbc/runner/runner_microvm_host_ready.dag` | `runner_microvm_host_converge_wet` | `net` | `Network` | ops Filesystem.Write; callees run_shell_commands, observe_firecracker_host_standing_wet; other-demand Filesystem |
-| `dag/gunbc/runner/runner_observed_version_check.dag` | `observe_captured_console` | `net` | `Network` | callees run_shell_command_observe |
-| `dag/gunbc/runner/runner_observed_version_check.dag` | `check_captured_console` | `net` | `Network` | callees observe_captured_console |
-| `dag/gunbc/runner/runner_observed_version_check.dag` | `verify_captured_console` | `net` | `Network` | callees check_captured_console |
-| `dag/gunbc/runner/runner_observed_version_check.dag` | `verify_bound_attempt_runner_version` | `net` | `Network` | callees verify_captured_console |
-| `dag/gunbc/runner/runner_observed_version_check.dag` | `verify_two_attempt_runner_version` | `net` | `Network` | callees verify_captured_console |
-| `dag/gunbc/runner/runner_observed_version_check.dag` | `verify_jit_absent_capture_lacks_runner_version` | `net` | `Network` | callees verify_captured_console |
-| `dag/gunbc/runner/runner_password_session_tool_converge.dag` | `runner_password_session_tool_converge_ci_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees prepare_fleet_ssh_agent_context; other-demand Clock,Filesystem |
-| `dag/gunbc/runner/runner_slot_provision.dag` | `observe_runner_slot_members_wet` | `net` | `Network` | callees run_shell_command_capture |
-| `dag/gunbc/spark/credential_workflow.dag` | `observe_spark_credential_consumer_evidence` | `net` | `Network` | callees fetch_secret_ref_credential |
-| `dag/gunbc/spark/credential_workflow.dag` | `run_with_materialized_fleet_ssh_binding` | `net` | `Network` | callees fetch_secret_ref_credential, verify_fleet_ssh_credential |
-| `dag/gunbc/spark/credential_workflow.dag` | `resolve_spark_administrator_credential` | `net` | `Network` | callees fetch_secret_ref_credential |
-| `dag/gunbc/spark/fabric_rail_apply.dag` | `fabric_rail_apply_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees materialize_fleet_known_hosts_anchor; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/fabric_reach.dag` | `observe_executor_reach` | `net` | `Network` | callees run_shell_command_capture |
-| `dag/gunbc/spark/glm_canary_converge.dag` | `glm_canary_cutover_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees materialize_fleet_known_hosts_anchor, observe_executor_reach; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/glm_canary_converge.dag` | `glm_canary_converge_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees materialize_fleet_known_hosts_anchor, observe_executor_reach; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/glm_group_b_relaunch_cli.dag` | `rank_startup_facet` | `net` | `Network` | callees observe_rank_vllm_revision |
-| `dag/gunbc/spark/glm_group_b_relaunch_cli.dag` | `observe_rank_report` | `net` | `Network` | callees observe_rank_container, rank_startup_facet, capture_rank_log |
-| `dag/gunbc/spark/glm_group_b_relaunch_cli.dag` | `glm_group_b_observe_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees with_group_b_access, observe_rank_report; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/glm_group_b_relaunch_cli.dag` | `glm_group_b_relaunch_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees relaunch_arm, with_group_b_access; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/glm_group_b_relaunch_cli.dag` | `with_group_b_access` | `net` | `Network` | callees materialize_fleet_known_hosts_anchor, observe_executor_reach |
-| `dag/gunbc/spark/managed_access_apply.dag` | `spark_managed_access_apply_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees resolve_spark_administrator_credential, run_with_materialized_fleet_ssh_binding; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/managed_access_apply.dag` | `spark_managed_access_bootstrap_ci_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees prepare_fleet_ssh_agent_context; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/managed_grant_install.dag` | `spark_grant_install_execute` | `net` | `Network` | callees run_remote_step_sequence, spark_grant_read_back, run_privileged_step |
-| `dag/gunbc/spark/managed_grant_install.dag` | `spark_grant_read_back` | `net` | `Network` | callees spark_grant_probe_outcome |
-| `dag/gunbc/spark/managed_grant_install.dag` | `spark_grant_install_host` | `net` | `Network` | callees spark_grant_probe_outcome, spark_grant_install_execute |
-| `dag/gunbc/spark/managed_grant_install.dag` | `spark_grant_install_ci_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees prepare_fleet_ssh_agent_context, spark_grant_install_host; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/pair_serving_apply.dag` | `spark_pair_serving_apply_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees observe_executor_reach, materialize_fleet_known_hosts_anchor; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/pinned_base_env_classification.dag` | `sparkrun_pinned_base_env_read` | `net` | `Network` | callees read_docker_hub_image_config_at_digest |
-| `dag/gunbc/spark/pinned_base_env_classification.dag` | `sparkrun_pinned_base_env_classification_wet` | `net` | `Network` | callees sparkrun_pinned_base_env_read |
-| `dag/gunbc/spark/remote_step_sequence.dag` | `remote_step_sequence_step` | `net` | `Network` | callees run_remote_operation |
-| `dag/gunbc/spark/remote_step_sequence.dag` | `run_remote_step_sequence` | `net` | `Network` | callees remote_step_sequence_step |
-| `dag/gunbc/spark/secret_access_ensure.dag` | `spark_secret_access_ensure` | `net` | `Network` | callees secret_access_ensure_for |
-| `dag/gunbc/spark/secret_access_ensure.dag` | `spark_secret_access_converge` | `net` | `Network` | callees spark_secret_access_ensure |
-| `dag/gunbc/spark/secret_access_ensure.dag` | `spark_secret_access_converge_with_supplied_token` | `net` | `Network` | callees spark_secret_access_ensure |
-| `dag/gunbc/spark/serving_rank_observe.dag` | `observe_container_presence` | `net` | `Network` | callees rank_leg |
-| `dag/gunbc/spark/serving_rank_observe.dag` | `observe_rank_container` | `net` | `Network` | callees observe_container_presence |
-| `dag/gunbc/spark/serving_rank_observe.dag` | `capture_rank_log` | `net` | `Network` | callees rank_leg |
-| `dag/gunbc/spark/serving_rank_observe.dag` | `observe_rank_transport` | `net` | `Network` | callees capture_rank_log |
-| `dag/gunbc/spark/serving_rank_observe.dag` | `observe_rank_vllm_revision` | `net` | `Network` | callees rank_leg |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `rollback_restart_incumbent` | `net` | `Network` | callees relaunch_leg |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `capture_rank` | `net` | `Network` | callees observe_rank_container, preserved_name_is_free, observe_rank_transport |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `preserved_name_is_free` | `net` | `Network` | callees observe_container_presence |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `capture_arm` | `net` | `Network` | callees capture_rank |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `advance_rank` | `net` | `Network` | callees relaunch_leg |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `stop_and_preserve_arm` | `net` | `Network` | callees advance_rank |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `create_and_start_arm` | `net` | `Network` | callees advance_rank |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `rollback_restore_names` | `net` | `Network` | callees rollback_restore_one |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `rollback_restore_one` | `net` | `Network` | callees rollback_rename_back, rollback_after_observing |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `rollback_after_observing` | `net` | `Network` | callees rollback_rename_back, observe_container_presence |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `rollback_rename_back` | `net` | `Network` | callees relaunch_leg |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `rollback_start_restored` | `net` | `Network` | callees rollback_start_one |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `rollback_start_one` | `net` | `Network` | callees rollback_restart_incumbent |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `rollback_arm` | `net` | `Network` | callees rollback_start_restored, rollback_restore_names |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `await_rank_announcement` | `net` | `Network` | callees observe_rank_container, observe_rank_transport, await_after_interval |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `await_after_interval` | `net` | `Network` | callees await_rank_announcement |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `verify_arm` | `net` | `Network` | callees await_rank_announcement |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `relaunch_arm` | `net` | `Network` | callees capture_arm, rollback_arm, stop_and_preserve_arm, create_and_start_arm, verify_arm |
-| `dag/gunbc/spark/v41_runtime_image_probe.dag` | `v41_published_image_probe_ci_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees materialize_fleet_known_hosts_anchor, observe_executor_reach, v41_probe_published_image; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/v41_source_patch_converge.dag` | `v41_observe_member` | `net` | `Network` | callees v41_check_applicable, v41_place_declared_patch |
-| `dag/gunbc/spark/v41_source_patch_converge.dag` | `v41_observe_members` | `net` | `Network` | callees v41_observe_member |
-| `dag/gunbc/spark/v41_source_patch_converge.dag` | `v41_observe_tree` | `net` | `Network` | callees v41_observe_members |
-| `dag/gunbc/spark/v41_source_patch_converge.dag` | `converge_vllm_source_with_patches` | `net` | `Network` | callees v41_observe_tree, converge_vllm_source_to_revision, v41_apply_plan |
-| `dag/gunbc/spark/v41_source_patch_converge.dag` | `converge_vllm_runtime_image_with_patches` | `net` | `Network` | callees converge_vllm_image_keyed, converge_vllm_source_with_patches |
-| `dag/gunbc/spark/v41_source_patch_converge_wet.dag` | `v41_patched_source_acquire_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees converge_vllm_source_with_patches, probe_agent_credential_verification, materialize_fleet_known_hosts_anchor; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `vllm_source_after_revision` | `net` | `Network` | callees vllm_source_tree_clean |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `converge_vllm_source_to_revision` | `net` | `Network` | callees vllm_source_after_revision |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `converge_vllm_source` | `net` | `Network` | callees converge_vllm_source_to_revision |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `converge_vllm_image` | `net` | `Network` | callees converge_vllm_image_keyed |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `converge_vllm_image_keyed` | `net` | `Network` | callees vllm_docker_leg |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `converge_vllm_runtime_image` | `net` | `Network` | callees converge_vllm_image, converge_vllm_source |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `vllm_runtime_image_build_ci_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees observe_executor_reach, materialize_fleet_known_hosts_anchor, converge_vllm_runtime_image, probe_agent_credential_verification; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `vllm_source_acquire_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees converge_vllm_source, probe_agent_credential_verification, materialize_fleet_known_hosts_anchor; other-demand Clock,Filesystem |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `spark_build_host_reachability_wet` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; callees materialize_fleet_known_hosts_anchor, probe_spark_host_reachability, probe_agent_credential_verification; other-demand Clock,Filesystem |
-| `dag/gunbc/srv3/srv3_bmc_credential_resolve.dag` | `materialize_bmc_login_password` | `net` | `Network` | callees fetch_secret_ref_credential |
-| `dag/gunbc/srv3/srv3_bmc_credential_resolve.dag` | `observe_and_resolve_srv3_bmc_credential` | `net` | `Network` | callees srv3_probe_credential_phase |
-| `dag/gunbc/srv3/srv3_boot_once_cd.dag` | `srv3_boot_once_cd` | `clock` | `std.resources.Clock` | callees srv3_boot_once_cd_gated |
-| `dag/gunbc/srv3/srv3_boot_once_cd.dag` | `srv3_boot_once_cd` | `net` | `std.resources.Network` | callees srv3_boot_once_cd_gated |
-| `dag/gunbc/srv3/srv3_boot_once_cd.dag` | `srv3_boot_once_cd_operator_approved` | `clock` | `std.resources.Clock` | callees srv3_boot_once_cd_gated |
-| `dag/gunbc/srv3/srv3_boot_once_cd.dag` | `srv3_boot_once_cd_operator_approved` | `net` | `std.resources.Network` | callees srv3_boot_once_cd_gated |
-| `dag/gunbc/srv3/srv3_boot_once_cd.dag` | `srv3_boot_once_cd_gated` | `net` | `std.resources.Network` | ops clock_now_probed_at; callees srv3_boot_once_cd_resolved, observe_and_resolve_srv3_bmc_credential; other-demand Clock |
-| `dag/gunbc/srv3/srv3_os_install_actuate.dag` | `srv3_bmcweb_session_login` | `net` | `std.resources.Network` | callees srv3_bmcweb_session_login_resolved, observe_and_resolve_srv3_bmc_credential |
-| `dag/gunbc/srv3/srv3_os_install_actuate.dag` | `srv3_bmcweb_session_login_resolved` | `net` | `std.resources.Network` | ops Filesystem.Write; callees materialize_bmc_login_password; other-demand Filesystem |
-| `dag/gunbc/srv3/srv3_os_install_actuator_toolchain_ensure.dag` | `srv3_os_install_actuator_toolchain_ensure` | `net` | `Network` | callees host_toolchain_ensure |
-| `dag/gunbc/tailscale_acl_phase2_credential.dag` | `tailscale_acl_operator_ephemeral_credential` | `net` | `std.resources.Network` | callees tailscale_acl_credential_with_operator_token |
-| `dag/gunbc/tailscale_acl_phase2_credential.dag` | `tailscale_acl_credential_with_operator_token` | `net` | `std.resources.Network` | callees gcp_secret_credential |
-| `dag/gunbc/tools/bmc_onboard.dag` | `srv3_probe_credential_phase` | `net` | `Network` | callees bmc_probe_credential_phase |
-| `dag/gunbc/tools/bmc_onboard.dag` | `srv3_converge_credential` | `net` | `Network` | callees bmc_converge_credential |
-| `dag/gunbc/tools/bmc_onboard.dag` | `srv4_converge_credential` | `net` | `Network` | callees bmc_converge_credential |
-| `dag/test/ctl/pos_emit.dag` | `forwards_to_a_service_call` | `net` | `std.resources.Network` | callees emits_a_service_call |
-
-## UnusedRequirement
-
-(empty in the live parsed population)
-
-## Unresolved
-
-| File | Declaration | Alias | Authored type | Evidence |
-| --- | --- | --- | --- | --- |
-| `dag/gunbc/container/registry_image_config.dag` | `read_docker_hub_image_config_at_digest` | `net` | `Network` | ops Filesystem.WriteOwnerOnly; local-ops shell.Mktemp.Dir, shell.Remove.RecursiveForce, shell.Remove.RecursiveForce, shell.Remove.RecursiveForce; other-demand Filesystem; calls check_sha256_hex, container_image_config_env_from_json, container_image_config_from_env, digest_hex_from_sha256_wire, docker_hub_bearer_token, docker_hub_blob_url, docker_hub_manifest_url, manifest_config_digest_wire |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_generation_store_wet` | `net` | `Network` | ops Filesystem.Read; other-demand Filesystem; calls fleet_converge_generation_admission, fleet_converge_generation_observation, fleet_converge_generation_store_path |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_cap_members_wet` | `net` | `Network` | ops Filesystem.List, Filesystem.Read; other-demand Filesystem; calls FilesystemFileAbsent, cap_members_observation, filesystem_file_observation, filesystem_listing_observation, filesystem_read_outcome |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_runner_unit_standing_wet` | `net` | `Network` | calls read_unit_property |
-| `dag/gunbc/fleet/fleet_converge_plan_cli.dag` | `observe_operator_local_run_binding` | `net` | `Network` | ops clock_now_probed_at; local-ops git.Inspect.HeadCommit; other-demand Clock; calls clock_now_probed_at, release_revision_text_valid |
-| `dag/gunbc/fleet/fleet_host_key_enrollment.dag` | `fleet_host_key_scan_wet` | `net` | `Network` | ops Filesystem.Write; other-demand Filesystem; calls scan_host_key_lines |
-| `dag/gunbc/fleet/fleet_known_hosts_anchor.dag` | `materialize_fleet_known_hosts_anchor` | `net` | `Network` | ops Filesystem.Read, Filesystem.Write, Filesystem.Read; other-demand Filesystem; calls compare_content_hash, content_hash_of_value, fleet_known_hosts_anchor_path, fleet_known_hosts_fragment, fleet_known_hosts_registry_identity, fleet_known_hosts_rows, host_key_provenance_label, known_hosts_anchor_seal |
-| `dag/gunbc/fleet/fleet_multi_principal_probe.dag` | `spark_managed_access_standing_wet` | `net` | `Network` | calls fleet_ssh_attempt_raw_from_env, spark_managed_access_standing_with_attempt |
-| `dag/gunbc/fleet/fleet_multi_principal_probe.dag` | `spark_managed_access_standing_with_verified_credential` | `net` | `Network` | ops Filesystem.Write, clock_now_probed_at; other-demand Clock,Filesystem; calls agent_backed_principal_observation, clock_now_probed_at, derive_spark_managed_access_standing, probed_at_word, serialize_content_hash, spark_authorization_lines, spark_standing_line, spark_standing_unobserved_host |
-| `dag/gunbc/fleet/fleet_ssh_credential_verify.dag` | `materialize_agent_public_selector` | `net` | `Network` | ops Filesystem.Read, Filesystem.Write, Filesystem.Read; other-demand Filesystem; calls agent_public_selector_content, agent_public_selector_path, agent_selector_file_seal, compare_content_hash, content_hash_of_value |
-| `dag/gunbc/host/host_codex_runtime_provision.dag` | `materialize_codex_runtime_on_local_host` | `net` | `Network` | calls codex_runtime_materialization_refusal_reason, committed_admitted_codex_runtime_source, materialize_codex_runtime_bundle, provider_runtime_placement_for_host |
-| `dag/gunbc/host/host_reset_return_run.dag` | `observer_self_corroboration` | `net` | `std.resources.Network` | local-ops os.Hostname.ReadShort; calls canonical_hostname_for_fleet_slot, observer_self_identity |
-| `dag/gunbc/host/host_reset_return_run.dag` | `host_reset_return_preflight_exit` | `net` | `std.resources.Network` | ops Filesystem.Write; other-demand Filesystem; calls reset_preflight_refusal_wire |
-| `dag/gunbc/host/host_reset_return_run.dag` | `host_reset_return_dispatch_admission_wet` | `net` | `std.resources.Network` | local-ops shell.Env.Get, shell.Env.Get; calls admit_reset_dispatch |
-| `dag/gunbc/host/host_reset_return_run.dag` | `host_reset_return_converge_route_read` | `net` | `std.resources.Network` | calls actions_variable_read |
-| `dag/gunbc/host/host_reset_return_run.dag` | `host_reset_return_exit` | `net` | `std.resources.Network` | ops Filesystem.Write; other-demand Filesystem; calls host_reset_return_receipt_line, reset_return_refusal_cause_wire |
-| `dag/gunbc/host/host_runner_memory_provision.dag` | `provision_runner_memory_caps` | `net` | `Network` | calls fleet_compute_host_for_identity, host_effect_apply_gated, host_toolchain_direct_access, runner_memory_converge_effect |
-| `dag/gunbc/host/host_toolchain_ensure.dag` | `host_toolchain_ensure` | `net` | `Network` | calls host_effect_apply_gated, host_toolchain_ensure_effect, host_toolchain_ensure_reach |
-| `dag/gunbc/live_deploy/deployed_tree_report.dag` | `deployed_tree_report_for_context` | `net` | `Network` | calls converge_target_revision, deployed_tree_locus, deployed_tree_report_emit, deployed_tree_standing, fleet_locus_ssh_target, observe_deployed_tree, observe_fleet_desired_revision |
-| `dag/gunbc/machine_intake/boot_image_fetch.dag` | `confirm_published_boot_image` | `net` | `std.resources.Network` | calls boot_image_digest_agrees, boot_image_observed_hex, sha256sum_file_digest_via_shell |
-| `dag/gunbc/roadmap/roadmap_launch_deployment_cli.dag` | `window_snapshot` | `net` | `Network` | calls active_instance_text_routed, deployed_tree_hexes, deployed_tree_locus, fleet_locus_ssh_target, observe_deployed_tree, read_desired_hex, read_remote_main_hex, remote_ref_text |
-| `dag/gunbc/roadmap/roadmap_launch_deployment_cli.dag` | `unit_standing_fact` | `net` | `Network` | calls deployment_belt_service_unit_name, deployment_belt_timer_unit_name, deployment_spec_srv1, live_deploy_belt_service_unit_file, live_deploy_belt_timer_unit_file, live_deploy_serve_unit_file, observe_belt_oneshot_standing, observe_belt_timer_standing |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `observe_runner_host_administrator_privilege` | `net` | `Network` | calls elevated_argv, typed_argv_exec_over_fleet_ssh |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `observe_runner_host_paths` | `net` | `Network` | calls classify_root_only_paths, runner_host_root_only_find_argv, typed_argv_exec_over_fleet_ssh |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `observe_runner_host_file_content` | `net` | `Network` | calls classify_host_file_presence, classify_typed_remote_file_comparison, runner_host_file_standing_of_report, runner_host_file_write_admission, typed_argv_exec_over_fleet_ssh, typed_remote_file_compare_argv, typed_remote_file_step |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `observe_runner_slot_population` | `net` | `Network` | calls classify_runner_slot_population, runner_slot_population_units, runner_slot_units_from_list_units, systemctl_list_all_service_units_argv, systemctl_show_properties_argv, typed_argv_exec_over_fleet_ssh |
-| `dag/gunbc/runner/runner_host_file_converge.dag` | `reload_runner_host_manager` | `net` | `Network` | calls elevated_argv, systemctl_daemon_reload_argv, typed_argv_exec_over_fleet_ssh |
-| `dag/gunbc/runner/runner_slot_population_census.dag` | `observe_slot_population_over_ssh` | `net` | `Network` | calls slot_census_from_command_outcome, systemctl_list_all_service_units_argv, typed_argv_exec_over_fleet_ssh |
-| `dag/gunbc/runner/runner_slot_retirement.dag` | `observe_transition_retirement_evidence` | `net` | `Network` | calls observe_retirement_standings, transition_required_retiring |
-| `dag/gunbc/spark/glm_canary_converge.dag` | `glm_canary_cutover` | `net` | `Network` | calls glm_canary_replace_container, glm_canary_run_argv |
-| `dag/gunbc/spark/grant_privileged_operation.dag` | `run_privileged_step` | `net` | `Network` | calls admitted_root_argv_words, exec_as_fleet_principal_with_stdin, fleet_probe_endpoint_for, portable_remote_words, read_bootstrap_credential, sudo_rejected_the_credential |
-| `dag/gunbc/spark/managed_grant_install.dag` | `spark_grant_probe_outcome` | `net` | `Network` | calls run_typed_argv_transport, spark_grant_install_transport |
-| `dag/gunbc/spark/remote_step_sequence.dag` | `run_remote_operation` | `net` | `Network` | calls SshShell, converge_typed_remote_file, run_typed_argv_transport |
-| `dag/gunbc/spark/serving_rank_observe.dag` | `rank_leg` | `net` | `Network` | calls argv_words, rank_observation_refusal, spark_remote_run |
-| `dag/gunbc/spark/serving_relaunch_transaction.dag` | `relaunch_leg` | `net` | `Network` | calls argv_words, relaunch_step_wire, spark_remote_run |
-| `dag/gunbc/spark/v41_runtime_image_probe.dag` | `v41_probe_published_image` | `net` | `Network` | calls docker_image_inspect_id_from_stdout, docker_image_inspect_names_no_such_image, image, spark_remote_run, v41_capability_reading, v41_privileged_outcome, v41_privileged_stdout, v41_probe_config_id_argv |
-| `dag/gunbc/spark/v41_source_patch_converge.dag` | `v41_place_declared_patch` | `net` | `Network` | ops Filesystem.Read; other-demand Filesystem; calls converge_typed_remote_file, filesystem_read_outcome, typed_remote_file_write_seal, v41_remote_declared_patch_path, vllm_build_root |
-| `dag/gunbc/spark/v41_source_patch_converge.dag` | `v41_check_applicable` | `net` | `Network` | calls git_apply_check_command, git_apply_reverse_check_command, v41_remote_declared_patch_path, vllm_image_leg_unchecked, vllm_source_dir |
-| `dag/gunbc/spark/v41_source_patch_converge.dag` | `v41_apply_plan` | `net` | `Network` | calls git_apply_command, v41_remote_declared_patch_path, vllm_image_leg, vllm_source_dir |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `vllm_docker_leg` | `net` | `Network` | calls argv_words, spark_remote_run |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `vllm_source_tree_clean` | `net` | `Network` | calls git_status_porcelain_command, vllm_image_leg, vllm_source_dir, vllm_source_is_clean |
-| `dag/gunbc/spark/vllm_runtime_image_build.dag` | `probe_spark_host_reachability` | `net` | `Network` | calls classify_reported_hostname, hostname_short_read_command, spark_reach_endpoint, vllm_image_leg |
-| `dag/gunbc/srv3/srv3_install_media_fetch.dag` | `srv3_install_media_fetch` | `net` | `Network` | calls srv3_apply_to_process_exit, srv3_install_media_fetch_apply |
-| `dag/gunbc/srv3/srv3_os_install_actuate.dag` | `srv3_nbd_proxy_serve` | `net` | `std.resources.Network` | calls srv3_apply_to_process_exit, srv3_nbd_proxy_serve_apply |
-| `dag/gunbc/srv3/srv3_seeded_install_media.dag` | `srv3_seeded_install_media_toolchain_ensure` | `net` | `std.resources.Network` | calls srv3_apply_to_process_exit, srv3_seeded_install_media_toolchain_ensure_apply |
-| `dag/gunbc/srv3/srv3_seeded_install_media.dag` | `srv3_seeded_install_media_remaster` | `net` | `std.resources.Network` | calls srv3_apply_to_process_exit, srv3_seeded_install_media_remaster_apply, srv3_seeded_install_media_toolchain_ensure_apply |
-
-## NamedDependencyBinder
-
-(empty in the live parsed population)
-
-## OpaqueContract
-
-(empty in the live parsed population)
-
-## PolicyEnvelope
-
-(empty in the live parsed population)
-
-## Fixture-string population (not live declarations)
-
-Witness modules embed programs as `data *_source: String`. Those `uses` rows are specimens, not production headers.
-
-| Host | Embedded decl data | Alias | Type | Class in the specimen |
-| --- | --- | --- | --- | --- |
-| `dag/test/claim/data_class_refusal_probe_witness_test.dag` | `durable_write_literal_control_source` | `net` | `Network` | `UnusedRequirement` |
-| `dag/test/claim/effectful_item_kind_collapse_witness_test.dag` | `efr_control_source` | `net` | `EfrNet` | `NamedDependencyBinder` |
-| `dag/test/claim/effectful_item_kind_collapse_witness_test.dag` | `efr_non_tail_source` | `net` | `EfrNet` | `NamedDependencyBinder` |
-| `dag/test/claim/effectful_item_kind_collapse_witness_test.dag` | `efr_tail_source` | `net` | `EfrNet` | `NamedDependencyBinder` |
-| `dag/test/claim/effectful_item_kind_collapse_witness_test.dag` | `zpe_reads_resource_source` | `net` | `ZpeNet` | `NamedDependencyBinder` |
-| `dag/test/claim/entry_authority_witness_test.dag` | `ea_one_entry_source` | `net` | `EaNet` | `NamedDependencyBinder` |
-| `dag/test/claim/entry_authority_witness_test.dag` | `ea_uses_library_source` | `net` | `EaNet` | `NamedDependencyBinder` |
-| `dag/test/claim/generic_effectful_declaration_wall_witness_test.dag` | `gew_generic_effectful_source` | `net` | `GewNet` | `UnusedRequirement` |
-| `dag/test/claim/generic_effectful_declaration_wall_witness_test.dag` | `gew_plain_effectful_source` | `net` | `GewNet2` | `NamedDependencyBinder` |
-
-## Inverse (derived demand without an authored `uses` on that declaration)
-
-Not a `uses` occurrence, so not a USES-0 class member. Named because D13 derives demand from operations: `gunbc.clock_read` `clock_now_probed_at` calls `Clock.Now()` with no header contract. Callers then restate `uses clock` transitively. That is the derive-once-carry gap: the Clock demand is produced at `Clock.Now` and should be carried, not re-authored up the chain.
-
-HOLD: no `uses` row added or deleted by this census.
-
diff --git a/docs/plans/v2-self-host-direct-path-2026-09-06.md b/docs/plans/v2-self-host-direct-path-2026-09-06.md
deleted file mode 100644
index 51e680ba943..00000000000
--- a/docs/plans/v2-self-host-direct-path-2026-09-06.md
+++ /dev/null
@@ -1,67 +0,0 @@
-# The direct path to a clean v2 self-host — orientation, sequencing, autonomy (2026-09-06)
-
-**What this file is.** An orientation and sequencing read, written at one point in time, plus the autonomy contract under which an agent executes it. It is **not** a work-item roster and not a second authority: every fact about what remains lives in the carriers named below and is re-derived by running the instruments named below, never by reading a number off this page (DESIGN §6 — name the instrument, never transcribe its output). When this file and a carrier disagree, the carrier is right and this file is stale.
-
-**The authorities this file defers to:**
-
-- DESIGN §7 — the goal itself, and the honesty boundary around it.
-- [v2-self-hosting.md](v2-self-hosting.md) — the operator-signed (2026-07-11) Weak → Strong Self Host program: four waves, dependency-gated exits, `src/v1` deleted only at the end of Wave 4. That is the plan from here to there; this file does not replace it.
-- `dag/gunbc/roadmap/roadmap_authority.dag` — the node chain with per-node boundary, first slice, RED control, exclusions, handback. Projected to `ROADMAP.md`; every node requires explicit manual acceptance.
-- The three self-host frontier carriers: `v2.compiler.self_host.seed_retention_frontier`, `v2.compiler.self_host.emit_coverage_frontier`, `v2.compiler.self_host.native_routing_frontier`.
-- `dag/gunbc/guarantee_stall/` — the typed stall roster; `self_host_candidate_generation_add_slice_stall` is the grounding-frontier row.
-- gunbc#9664 ("XL-N") — the native-closure burn-down program with go/no-go gates.
-
-## 1. What you actually get at the end
-
-In daily terms: **you edit `.dag` files, and the compiler that compiles them was itself compiled from `.dag` files.** The hand-written Rust seed is gone except a pinned, content-addressed bootstrap kernel (the wave doc sizes it at roughly 8–15k LOC); everything else the compiler does — reading source, resolving names, deriving types, translating, emitting — is emitted from the graph it compiles.
-
-The proof shape, per the roadmap nodes' own RED controls:
-
-- The generator builds itself **twice**; the second build is shown never to have reached the old compiler — run with the old one taken away, or with a receipt proving it was never called. Behaving the same is not accepted as proof of independence.
-- Every self-emitted module passes the same behavioral corpus as the seed it replaced, including the deliberately-broken controls that must still fail. Byte-identity with the seed is explicitly **not** the goal (operator, 2026-07-08) — the seed's warts are not reproduced.
-- Required CI runs `v2.test.*` through the native emitted crate; the interpreter survives only for `src/v1` regen until that too is gone.
-
-The payoff is DESIGN §7's: **language design opens up.** A new guarantee is a row, not a compiler fork; and because the substrate reads one grammar in both directions over many media, that row applies on top of an existing language through ingest — no adoption problem. This is the economic point of the whole exercise: today every improvement routes through the generator we are trying to delete.
-
-What you do **not** get (§7's honesty boundary): the compiler does not invent unstated intent, does not prove unmodeled external reality, and does not lift arbitrary predicates to proof. Runtime mechanisms — typed refusal, totality, rollback, budgets — remain real at honest boundaries.
-
-## 2. Where "here" is — by instrument
-
-Each line names the producer that re-derives the state. Run it; do not believe this sentence.
-
-- **Axis A — the real path, slice by slice.** The add slice (the `add` fn of `std.integer`) is green end-to-end on the dag path as of #10673: infer derives grounding by declared-inhabitant roster membership, and the ingest→compile round trip is byte-faithful. Instrument: `gunbc run --source-root dag --source-root src/v2 --entry src/v2/test/claim/execution/self_host_candidate_generation_stage_verdicts_test.dag --function add_slice_stage_verdicts_entry`. The **direct-rust-door** (roadmap `v2-emitter-direct-rust-door`) is **green by execution as of 2026-09-06**: the production walk reaches `ArtifactProduced`, all five leaf projections establish (source fidelity byte-equal to `direct_rust_door_expected_source`, producer identity, seed-emitter absence, `SourceProduced` qualification, missing-rule refusal), and the known-red admission row deleted per its own dissolution, promoting the group root to the lane's permanent regression wall. Instrument: `claim_batch --source-root dag --source-root src/v2 --entry src/v2/test/claim/long/direct_rust_door_production_group_test.dag --functions direct_rust_door_production_group_closing_expectation_holds` (a `long/` row — it reconstructs the pipeline per evaluation; the cost defect is declared in the test module's header).
-- **The grounding frontier.** The door specimen's frontier is closed, and the parse-product family followed on 2026-09-07: the declared-inhabitant roster-membership derivation widened from the dag roster to the closed ingest set (dag, python, typescript), closing the python and typescript fixtures' frontiers and greening the four same-language round-trips. The add-slice stall's trigger fired and it retired per §4b(4). The remaining frontier is counted, not transcribed: `v2.workflow.compile_door_cause_ownership` `node_grounding_frontier_retirement` names its causes, and `gunbc.witness_v2_native_route` `native_route_frontier_retirement_standing` joins them to the route's observed population.
-- **Axis B — the native closure (XL-N).** The XL-0 gate (`cargo check` = 0 on the emitted compiler closure) is **not satisfied**; the issue's own receipt table records that the closure reached complete rustc type checking for the first time at XL-0A and carries the honest error population there. gunbc#10266 (fabricated runtime panics on representation-identical casts) is filed as an independent compiler slice on this path. Instrument (the issue's own): `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag --target rust --output-dir /tmp/v2emit && cd /tmp/v2emit && cargo check --message-format short`.
-- **Axis C — the seed dissolves.** `v2.compiler.self_host.seed_retention_frontier` holds every retained seed file as a declared row; `undeclared_reason_rows()` is the prioritizable debt, and the census refuses unrostered retention in three directions. `v2.compiler.self_host.emit_coverage_frontier`'s `interpreter_retained_rows()` and `v2.compiler.self_host.native_routing_frontier`'s roster cover the witness-execution axes. The first InterpreterRetained → SelfEmittedNative promotion after classical_not landed 2026-09-07: the add family's row flipped when `emit_host_native_only_add_holds` (+ its wrong-octet broken control) landed in the file-grain-enrolled native-only verdict entry — the emitted add crate's stdout pinned to its expected octet with `eval()` never called, program-side discrimination staying with the family's equals_eval primitive-five/six pair. **The emit coverage frontier closed 2026-09-08: all fifteen roster rows are SelfEmittedNative, `interpreter_retained_rows()` is empty**, each row backed by a native-only verdict arm (positive + wrong-octet broken control) in the same enrolled entry, and the `retained_via_eval_agreement` row constructor was deleted with the last flip (DESIGN §3c). This closes axis (a) — witness-body-runs-native — only; it says nothing about which engine compiled the compiler itself (axis (b), the regen-grain flip, remains operator-gated below). Instrument: `claim_batch --source-root dag --source-root src/v2 --entry src/v2/test/claim/execution/long/emit_host_native_only_verdict_test.dag` (offline wet legs — real cargo build and native run per leg).
-- **Wave position.** Per the wave doc, Wave 1's four exit items all carry landed receipts; Wave 2 (first real flips — emit-surface tracks self-emit, behaviorally verify, and **replace** their v1 counterparts) is the open wave. The wave doc's header records that its roster carrier was deleted and per-module dispositions must be re-derived from the emitter — which is what the door-first sequence below does.
-
-## 3. The sequence from here
-
-Ordered by the roadmap chain; each step names its green condition as the node's own contract states it.
-
-1. **The door** (`v2-emitter-direct-rust-door`) — **LANDED 2026-09-06.** The loop's actual findings, for the record: not missing `TargetModel` rows. (a) The grounding frontier closed by six real derivation rules in `04_infer.dag` (see §2's frontier line). (b) Emission needed the right composition, not more rules: a resolved module is a module shell over named declarations, so the production path is `generate_rust_module_emission_candidate` — collect the produced-decl-shaped nodes, admit exactly one, emit through `v2.compiler.emit_produced` — while the raw whole-tree `generate_rust_emission_candidate` remains the fixture lane's composition with its own dissolution trigger. (c) One representation decode gap: resolution canonicalizes surface operators into canonical-operation wire nodes, so the translate value-expression projection decodes the operator position with `canonical_operation_from_wire_node` first and falls to the surface-token table only on a wire miss. Green condition met: the production observation reaches `ArtifactProduced`, all five leaf projections establish, the known-red expectation row deleted in the same change, and the group root promotes to permanent regression evidence (`v2_emitter_direct_rust_door_contract_dissolution_note`).
-2. **The parse-product grounding family** (the stall's named trigger) — **LANDED 2026-09-07.** The roster-membership derivation generalized from the dag language roster to the closed ingest set (dag, python, typescript): `infer_node_declared_in_language_inhabitants` returns the declaring authority's roster root as evidence, with deep subtree membership so a declared inhabitant's leaf fact atoms derive exactly as the inhabitant node itself does. Measured: the python fixture's 19-node frontier and the typescript fixture's 28-node frontier both close to zero; all four stall-population round-trip witnesses green; the python→typescript cross-language compile accepts, byte-identical to `ts_source_text`. One §4b(4) flip: `cross_language_compile_refuses_canonical_underived_holds` → `cross_language_compile_python_to_typescript_round_trip_holds` (the pipeline-level frontier guard became the permanent regression control for the acceptance). The add-slice stall's trigger fired, so it retired per §4b(4) — removed from `all_guarantee_stalls`, row file deleted, witnesses stay enrolled.
-3. **First behavioral module** (`v2-emitter-first-behavioral-module`). One already-tested module regenerated by the new generator; its existing tests — including the deliberately-broken one — pass unchanged, and the run is shown never to have reached the old generator. First-slice evidence landed 2026-09-07 at the coverage-frontier grain: the add family (fewest dependencies — integer literals plus one canonical operation) carries a native-only verdict witness, so its behavior is established by the emitted crate's own stdout with `eval()` unreachable, and its coverage row reads SelfEmittedNative. What remains for the node is the regen-grain flip — a corpus module's *production* switching generators — plus operator acceptance.
-4. **The XL-N milestones, in the issue's order** — arms → 0; emitter defects C, B → 0; crate compiles; native = interpreted with every divergence typed; swap. This is Wave 4's "pipeline runs on emitted Rust" executed as a burn-down, and its rules bind: fixes land in `.dag` and reach Rust via regen, and each closed class gets a `test.claim` fixture under the required gate. Its no-go gates are real: M2 stops if a fix needs a fact the inferred tree doesn't carry (an `04_infer` modeling gap — file it, don't grind); M3 re-plans if a class needs a language capability we don't have.
-5. **Native bootstrap, then fixed point** (`v2-emitter-native-bootstrap`, `v1-emitter-fixed-point`). The two-round self-build for the generator, then the same two-round test extended stage by stage to the rest of the compiler. Then `dag/gunbc/v1/v1_deletion_plan.dag` executes; the seed-retention roster drains as modules flip, and Wave 3's first obligation — a derived denominator for what the compiler consists of — is named in the wave doc.
-6. **Parallel track, not a wave gate:** the import-deletion ladder (wave doc §3) — B3's migration alongside Waves 2–3, B4's grammar deletion at Wave 4.
-
-## 4. The autonomy contract
-
-An agent can execute, end to end and without supervision, the per-slice loop: run the instrument → diagnose from the typed diagnostics → land the `.dag` fix → flip each affected witness per §4b(4) with per-witness justification → narrow the roster/stall rows in the same change → commit, push, open the PR, and iterate to green CI. #10673 is the worked example of that loop. Declaring seed-retention reasons, landing derivation rules, and burning XL-N error classes are all inside it.
-
-The operator gates that remain, each with its repo citation:
-
-- **Merges.** The agent never merges; every slice pauses at a green PR for human review.
-- **Roadmap node acceptance.** ROADMAP.md's header states every active row requires explicit manual acceptance; a green node is handed back, not self-accepted.
-- **CI job roster growth.** Closed without operator sign-off (DESIGN *Building & checks*, 2026-09-04 ruling). XL-N's M5 swap changes what required CI runs on — it is an operator decision by construction.
-- **Scaffold admission.** §5: approval is external to the diff; an author cannot self-approve a scaffold.
-- **Declared rung drops.** §4b(3): the agent can author the full declaration (previous rung, temporary rung, reason, population, restoration trigger); landing it is review-gated.
-- **Language-semantics rulings** that the tree cannot decide. The Atom-authority question is the template: surfaced de-jargoned, decided by the operator (2026-09-06: the namespacing rules answer it), recorded in the carrier. These are rare but real, and the agent's obligation is to stop and raise them rather than guess.
-
-## 5. What would make this plan wrong
-
-- An XL-N no-go gate firing (M2's modeling gap, M3's missing language capability) — re-plan at that gate, per the issue's own rule.
-- ~~The door's emission diagnostics turning out to be an `04_infer` modeling gap rather than `TargetModel` rows~~ — discharged 2026-09-06: the door is green; the gaps were derivation rules, one emission composition, and one operator-representation decode, none of them a modeling wall.
-- A Wave-2 flip surfacing behavioral divergence that re-sequences the module order — typed as emitter bug or interpreter bug either way, but the sequence absorbs it.
-- This file aging. It is a position read, not a carrier; the instruments in §2 are the standing truth.
diff --git a/docs/plans/wet-evidence-convergence-plan.md b/docs/plans/wet-evidence-convergence-plan.md
deleted file mode 100644
index c99f9cb2928..00000000000
--- a/docs/plans/wet-evidence-convergence-plan.md
+++ /dev/null
@@ -1,123 +0,0 @@
-# Wet-evidence convergence: the anti-collapse count, taken before the extraction
-
-Two authorities answer "did the wet evidence hold" for one fold. `v2.workflow.local_repo_wet_terminal`
-(landed via #9903) joins a co-resident execution's terminals against a scheduled roster;
-`v2.workflow.floor_wet_route` (proposed in #9725) validates a transported receipt envelope against
-a subject digest pair. `v2.workflow.floor_changed_witness` imports one of them and, under the union,
-would import both — the meaning fork DESIGN §3 forbids.
-
-This document exists for one reason: **a careless unification silently merges typed refusals**, and
-the tell is that the extracted join grows one generic "binding mismatch" cause where six real
-remedies used to live. A detail string is not a typed cause and cannot be joined on. So the union of
-both refusal vocabularies is counted HERE, BEFORE the extraction, and the integrated join must be
-able to emit at least as many.
-
-## The count: 18 distinct causes, deduplicated by REMEDY
-
-Where the two modules already agree on a remedy the row is listed once, naming both spellings.
-
-| # | cause | local_repo_wet_terminal | floor_wet_route |
-|---|---|---|---|
-| 1 | scheduled identity has no terminal | `TerminalMissing` | inside `ReceiptRosterInexact { detail }` |
-| 2 | two terminals claim one identity | `TerminalDuplicated { occurrences }` | Rust reader only, untyped in `.dag` |
-| 3 | terminal for an identity nobody scheduled | `TerminalUnscheduled` | inside `ReceiptRosterInexact { detail }` |
-| 4 | executed a different entry than scheduled | `TerminalForeignEntry { observed, required }` | inside `ReceiptContractMismatch { detail }` |
-| 5 | executed a different function than scheduled | `TerminalForeignFunction { observed, required }` | inside `ReceiptContractMismatch { detail }` |
-| 6 | observed verdict is not the expected one | `TerminalVerdictNotExpected` | `wet_receipt_unexpected_red_identities` |
-| 7a | co-resident: ran against a different prepared subject | `TerminalForeignCandidate { observed, required }` | — (meaningless for this route) |
-| 7b | transported: semantic subject digest differs | — | `ReceiptSubjectMismatch { axis, receipt, computed }` |
-| 7c | transported: executor contract digest differs | — | `ReceiptExecutorSnapshotDifferent { receipt, computed }` |
-| 8 | receipt aged past its staleness budget | — (meaningless for this route) | `ReceiptExpired { age_secs }` |
-| 9 | schema version is not the one this floor reads | — | inside `ReceiptContractMismatch { detail }` |
-| 10 | executed_at exceeds published_at | — | inside `ReceiptContractMismatch { detail }` |
-| 11 | published_at exceeds tree commit beyond declared skew | — | inside `ReceiptContractMismatch { detail }` |
-| 12 | outcome wire outside the closed vocabulary | — | Rust reader only, untyped in `.dag` |
-| 13 | envelope unreadable | — | Rust reader only |
-| 14 | projection missing or orphaned from its authority | — | Rust reader only |
-| 15 | projection is not the canonical projection (hand edit) | — | Rust reader only |
-| 16 | enrolled expected-red observed passing | — | `wet_receipt_now_passing_identities` |
-| 17 | no subject verdict reached | — | `wet_receipt_no_verdict_identities` |
-| 18 | completed past its line — a COST, not a defect | `LocalRepoWetCompletedOverBudget` | `wet_receipt_cost_debt_identities` |
-
-**Post-extraction obligation: the integrated join emits ≥ 18, and rows 7a/7b/7c stay three.**
-Collapsing them into one "binding mismatch" is the exact failure this count exists to catch.
-
-## What the count found, which was not the expected direction
-
-The collapse is in **floor_wet_route**, not in main's module. Rows 1, 3, 4, 5, 9, 10 and 11 are
-typed causes on one side and `detail: String` payloads on the other — seven remedies behind two
-string-carrying arms. Rows 2, 12, 13, 14 and 15 exist only in the Rust reader and have no `.dag`
-spelling at all.
-
-So the extraction WIDENS the transported route to main's grain. It does not narrow main's join to
-meet it, and any version of this work that reduces main's seven causes has failed rather than
-converged.
-
-## The vocabulary is not ours to mint: `floor_terminal_ledger` already owns it
-
-`v2.workflow.floor_terminal_ledger` already declares the raw attempt terminal
-(`ClaimAttemptTerminal`), observed-verdict versus unreadable-observation (`ClaimObservation`),
-expectation (`ClaimExpectation`), the row (`ClaimTerminalRow`), a binding (`LedgerBinding`), and
-thirteen derived dispositions. Neither wet module imports it. `floor_changed_witness` — the
-conflicted consumer — does.
-
-Its `claim_disposition` already maps a completed-past-limit terminal by expectation:
-`ExpectedToHold → PassedOverBudget`, `ExpectedRed → KnownRedNowPassing`. That is row 18 of the count
-above, derived independently in `local_repo_wet_terminal`, derived independently again in
-`floor_wet_route`, and owned all along by a module none of the three imported.
-
-**Three independent arrivals at one distinction is the proven coincidence DESIGN §6 asks for before
-unifying vocabulary** — a better argument for the shared terminal than any reasoning about elegance.
-So the terminal half of this convergence is REUSE, not extraction, and minting a third terminal type
-between the two would be the same fork wearing a new name.
-
-## What is genuinely new work
-
-`LedgerBinding` carries a repository snapshot and a prepared subject: the co-resident case. The
-transported case additionally needs the executor-contract digest, because a receipt produced by a
-different executor over the same tree is a different evidential fact. That is one typed widening of
-an existing type — two arms feeding one validation — and not a new authority:
-
-- co-resident prepared-subject binding
-- transported receipt-subject binding carrying semantic subject and executor contract
-
-Freshness and executor age are meaningless for an execution running inside the floor, so they do not
-move onto the local route; the local route's prepared-subject equality is meaningless for a receipt
-produced by another process, so it does not move onto the transported one. One interface and one
-exact join, two execution realizations, two route-owned roster policies.
-
-## Scope boundary
-
-This is an extraction. It changes no behavior of `local_repo_wet_terminal`: its join, its seven
-refusals, its deliberately single-armed expectation and its invocation wall come out intact and land
-back on the same population. Anything found wrong in that module during the lift is NAMED here and
-routed separately, never repaired under cover of a mechanical extraction.
-
-## What the migration step changed, recorded because the paragraph above no longer describes the head
-
-The scope boundary above is stated for the EXTRACTION, and it was true of it. The migration that
-followed is a different step with a different boundary, and leaving only the earlier paragraph would
-leave a reader with a sentence that reads as current and is not.
-
-At this head `local_repo_wet_terminal` no longer owns a join. Its verdict, expectation, scheduled,
-terminal and join types and its seven join refusals are DELETED; the module retains its roster, the
-requirement it derives, the co-resident executor and the invocation wall, and it reaches
-`wet_evidence_validate` for everything else. `floor_changed_witness` carries one route-neutral
-standing over `WetEvidenceValidation`.
-
-**All seven refusals remain emittable as typed causes**, six under their own names and
-`LocalRepoWetTerminalForeignCandidate { identity, observed, required }` as
-`WetBindingPreparedSubjectDiffers { identity, observed, required }` — the same three fields compared
-by the same equality, because the local requirement sets `prepared_subject` to the candidate. None
-became a detail string, which is the condition this plan set for the work to have succeeded rather
-than reduced.
-
-**One declared widening.** `wet_disposition_is_agreement` treats `KnownRedHeld` as agreement, which
-the deleted single-armed expectation could not express. No roster row constructs it, so no landed
-behaviour moves; it is recorded here because a widening discovered later reads as a defect.
-
-**Two refusals had no asserting witness** when the migration reached them —
-`WetTerminalForeignEntry` and `WetTerminalForeignFunction`, emittable by the shared validator and
-covered by the local route's old acceptance matrix. A refusal an authority can construct and no test
-discriminates can be deleted with nothing going red, so they are now asserted in
-`v2.test.wet_evidence` with both cross-negatives.
diff --git a/docs/plans/wet-witness-host-premise-census.md b/docs/plans/wet-witness-host-premise-census.md
deleted file mode 100644
index ccc4ff8fc30..00000000000
--- a/docs/plans/wet-witness-host-premise-census.md
+++ /dev/null
@@ -1,90 +0,0 @@
-# Wet-witness host-premise census (2026-09-29)
-
-Scope: every module on the local-repo wet schedule (`v2.workflow.local_repo_wet_terminal`
-`local_repo_wet_schedule`, 51 modules at this revision), classified per claim for **assumed host
-state** under `gunbc.recurring_failure_mode` `wet_witness_keyed_to_the_runner_not_its_subject` and
-`wet_witness_premise_read_from_the_runner_it_happens_to_land_on`. Hermetic claims reach no host
-effect and are out of scope. This is a read of the sources at the revision this file landed with,
-not an execution receipt; the dispositions below say which rows were executed by a fix PR.
-
-The runner pool: CI runners are fleet hosts. srv1 hosts several runner instances sharing one `/tmp`
-and one network namespace, and declares a dashboard instance; srv3/srv4 do not. User managers,
-memory headroom and installed tools vary.
-
-Severity: **RUNNER-KEYED** — the verdict flips by which runner dequeues the job. **LATENT** — the
-premise holds on every current runner but is neither created nor supplied by the claim.
-**CLEAN** — the premise is created by the claim (per-claim `shell.Mktemp`), supplied as data, or
-both arms are asserted.
-
-## Runner-keyed
-
-| witness | claim(s) | assumed premise | disposition |
-|---|---|---|---|
-| `test.claim.spark.fabric_capacity_standing_wet_witness`, `test.claim.spark.spark_pair_serving_apply_wet_witness` | all | executor is off-fleet (no dashboard instance) | repaired: #12478 supplied the premise, #12532 removed the live-log reads |
-| `test.claim.compute.manager_unaskable_wet_witness` | `a_host_without_a_user_manager_reaches_the_unavailable_arm_instead_of_aborting` | no user manager answers | repaired: #12456 asserts the route relation |
-| `test.claim.approval_ntfy_access_readback_wet_witness_test` | store-root claim | approval store root absent on the runner | repaired: #12614 asserts unchanged-by-the-verb |
-| `test.claim.mtcollins1_census_image_local_wet` | `a_failed_or_partial_or_disagreeing_workload_emits_no_token_by_real_execution`, `a_workload_larger_than_capacity_refuses_at_preflight_by_real_execution` | fixed `/tmp/gunbc-wl-counter`, `/tmp/gunbc-wl-dd-marker` writable by this runner user (shared `/tmp`, sticky bit) | open: #12467 (per-claim temp dir), covers both paths |
-| `test.claim.spark.pair_serving_d0_front_door_real_execution` | `a_vacated_port_reads_as_no_response_by_real_execution`, `a_failed_connect_fences_under_an_active_head_unit_and_suspends_only_under_a_quiet_one_by_real_execution`, `a_listener_behind_a_failed_connect_is_read_on_the_host_and_fences_by_real_execution` | a just-vacated loopback port stays unbound; `/proc/net/tcp` shows no other runner's listener on it | **owned by crisp-lynx-364** — not touched here |
-| `test.claim.fabric.fabric_storage_file_store_wet_witness` | `a_put_or_advance_by_a_principal_the_store_areas_do_not_admit_is_refused_by_the_real_file_store` | runner executes as a non-root uid (`shell.Chmod.RecursiveReadOnly` does not bind root) | #12658: uid→outcome relation plus an all-uid refusal claim |
-| `test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness` | `a_held_observer_is_admitted_and_its_triggered_still_is_hash_bound`, `a_busy_viewer_slot_refuses_the_observer_and_the_handoff`, `a_connection_lost_mid_boot_is_reported_and_no_still_is_claimed_after_it`, `an_unreadable_canvas_is_acquisition_failed_with_the_browsers_words`, `a_relative_observer_directory_is_resolved_once` | browser toolchain converged for the job user (`gunbc.runner_browser_toolchain` `runner_browser_toolchain_here_wet` reads Ready; observed false on srv1 where `runner_browser_toolchain_converge` had never run) | typed refusal: declared in `v2.workflow.local_repo_wet_terminal` `local_repo_wet_premise_roster`, read before invocation, refused as `WetTerminalHostPremiseUnmet` carrying the toolchain authority's words rather than `WetTerminalVerdictNotExpected`; claims unchanged and still refuse the lane. Restoration trigger: keen-pike-73's floor slot class makes toolchain convergence a floor-pool readiness property |
-
-## Latent — fixed
-
-| witness | claim(s) | assumed premise | disposition |
-|---|---|---|---|
-| `test.claim.compute.host_capacity_wet_witness` | `competing_reservations_cannot_over_reserve_and_a_release_returns_the_capacity`, `a_reused_reference_is_a_ledger_refusal_and_never_reported_as_a_full_pool`, `releasing_one_seat_twice_is_not_a_ledger_failure_and_charges_nothing` | runner has ≥2 GiB `MemAvailable` at that instant | #12652: reading supplied (`reserve_with_room`); real route kept by `the_real_reservation_route_admits_exactly_what_the_reading_backs` (relation to the reading) |
-| `test.claim.fabric.fabric_storage_file_store_wet_witness` | `a_put_or_advance_by_a_principal_the_store_areas_do_not_admit_is_refused_by_the_real_file_store` | runner uid ≠ 0 | #12658: uid→outcome relation; refusal route on every runner via `a_put_or_advance_into_store_areas_that_refuse_every_principal_is_a_typed_fault_by_real_execution` |
-| `test.claim.long.fleet_release_bins_key_witness` | positive/key claims reaching `fixture_env` | runner exports no `release_bins_credential_pattern` name; no ancestor of `$TMPDIR` holds `.cargo/config*` | #12703: fixture unsets those names, pins the temp root under `/tmp` |
-| `test.claim.machine_intake.sol_hold_stdin_wet_witness` | `the_collector_stdin_supplies_zero_bytes_and_no_eof_when_executed`, `a_launch_that_cannot_publish_its_pid_stops_the_child_it_created` | launch + `timeout 3` probe (or the supervisor's exit record) lands inside a fixed 5 s | #12704: bounded poll for the awaited line (`read_until_contains`) |
-
-## Latent — recorded, not fixed (operator decision via deep-ferret-305, 2026-09-29)
-
-Each row holds on every current runner, so no row flips a verdict by assignment today. "Flips when"
-names the runner condition that would make the claim red for a reason other than its subject. A row
-here is picked up when that condition is observed or planned for a runner class.
-
-| witness | claim | assumed premise | why latent | flips when |
-|---|---|---|---|---|
-| `test.claim.commit_writer_heal_admission_real_execution` | `clean_staged_index_admits_by_real_execution`, `unmerged_index_with_no_markers_refuses_by_real_execution`, `unclaimed_text_blob_with_markers_refuses_red_control_by_real_execution`, `space_and_tab_named_paths_admit_by_real_execution` | the runner user's global/system git config and inherited `GIT_*` env do not act on a temp repo (`seed_witness_repository` sets only `user.email`/`user.name` locally) | no runner user carries such config today | a runner user gains `commit.gpgsign=true`, a `core.hooksPath` whose hooks refuse, an `init.templateDir` with hooks, or exports `GIT_DIR`/`GIT_INDEX_FILE`/`GIT_CONFIG_*` |
-| `test.claim.contract_identity.required_ci_epoch_real_execution_witness` | `a_run_of_the_contract_at_another_epoch_refuses_naming_both_epochs_by_real_execution`, `a_run_of_the_contract_at_the_required_epoch_admits_by_real_execution`, `a_commit_that_is_not_in_the_repository_is_unreadable_not_absent_by_real_execution`, `a_readable_commit_without_the_workflow_is_path_absent_not_commit_unreadable_by_real_execution` | same git-config premise | same | same |
-| `test.claim.devboot_text_blob_real_execution` | `a_lease_claim_is_stored_as_exactly_its_bytes_in_the_bare_store_by_real_execution`, `a_staged_entry_is_stored_as_exactly_its_bytes_in_the_worktree_repository_by_real_execution`, `a_path_routed_hash_under_a_clobbered_path_publishes_the_empty_blob_red_control_by_real_execution` | same git-config premise (no local identity is set either, so `user.*` must resolve from global config or not be needed) | same | same, or a runner user with no resolvable git identity if a path commits |
-| `test.claim.generated_artifact_merge_driver_real_execution` | `divergent_generated_artifact_merge_refuses_by_real_execution`, `divergent_generated_artifact_merge_under_true_driver_silently_drops_theirs_red_control_by_real_execution`, `one_sided_generated_artifact_change_merges_clean_by_real_execution` | same git-config premise, plus no global `merge.*` driver or attribute file overriding the locally configured driver | same | same, or a global `core.attributesFile` / `merge.<name>.driver` naming the witnessed path |
-| `test.claim.effect_plan_bash_materialize_real_execution_witness` | `effect_plan_bash_fail_fast_prevents_later_operation_execution`, `effect_plan_bash_if_branch_fail_fast_stops_the_branch_and_the_plan` | `/gunbc-wave-a-definitely-absent` does not exist | nothing creates it | anything on the runner creates that root-level path |
-| `test.claim.effect_plan_bash_materialize_real_execution_witness` | `effect_plan_bash_metachar_and_newline_cannot_open_a_statement` | `/tmp/absent; printf PWN` and `/tmp/absent\nid -u` do not exist in shared `/tmp` | only a deliberate write creates them | another runner instance on a shared-`/tmp` host (srv1) leaves such a path behind |
-| `test.claim.fabric.fabric_storage_file_store_wet_witness` | `a_declared_entry_mode_is_the_published_mode_of_objects_and_heads` | the runner's umask leaves the undeclared mode ≠ `0444` | runners use the default umask 022/002 | a runner runs with umask `0333` or stricter |
-| `test.claim.approval_device_routes_wet_witness_test` | `a_bound_realization_passes_the_read_past_the_gate` | a read of the host-global approval store root answers (present, absent or unreadable) rather than aborting | the verdict accepts every answering state | a permission error on that root aborts the route instead of producing a typed body |
-| `test.claim.self_host_logic_behavioral_witness` | `self_host_logic_behavioral_receipt_holds` | cargo/rustc present, crates registry reachable or warm, memory and disk for a release build | every runner has the toolchain and a warm registry | a runner without network and a cold `~/.cargo`, or below the build's memory |
-| `test.claim.self_host_logic_seed_unavailable_witness` | `self_host_logic_seed_unavailable_receipt_holds` | same, plus `git` | same | same |
-| `test.claim.runner.runner_browser_toolchain_real_execution` | `the_library_readback_runs_ldd_and_reads_a_resolved_binary_by_real_execution` | `ldd` present and `/bin/sh` dynamically linked | glibc runners | a musl/static-shell runner, or one without `ldd` |
-| `test.claim.runner.runner_browser_toolchain_real_execution` | `a_verified_archive_installs_and_its_retained_bytes_read_back_verified_by_real_execution`, `a_sha256_mismatch_refuses_and_runs_no_install_by_real_execution`, `an_npm_integrity_mismatch_refuses_and_runs_no_install_by_real_execution`, `a_retained_archive_altered_after_install_reads_back_mismatched_by_real_execution` | `curl` on PATH | present everywhere | a runner without `curl` |
-| `test.claim.spark.pair_serving_authority_log_real_execution` | `a_release_needs_the_host_observed_quiet_by_real_execution` | `python3` and `pgrep` on PATH | present everywhere | a runner without either |
-| `test.claim.spark.spark_pair_head_unit_digest_witness`, `test.claim.spark.spark_serving_offer_route_witness_test` (the claims reaching `spark_pair_declared_head_digest`), `test.claim.spark.v41_row_store_encode_witness` `the_receipt_was_produced_by_the_rendered_program_the_mode_ships`, `test.claim.srv3_install_media_fetch_real_execution`, `test.claim.srv3_seeded_install_media_real_execution` `install_media_remaster_ensure_grub_cmdline_inserts_by_real_execution` | digest claims | `sha256sum` on PATH | coreutils everywhere | a runner without coreutils `sha256sum` |
-| `test.claim.spark.v41_engram_runtime_witness` (`the_live_storage_backed_patches_are_digestfile_of_committed_bytes`, `overlay_magic_cites_the_row_store_authority`), `test.claim.spark.v41_source_patch_converge_witness` `digestfile_inhabits_the_committed_patch_population` | committed-patch reads | cwd is the repo root | the wet executor runs from the checkout root | the executor's cwd changes |
-
-| `test.claim.machine_intake.sol_hold_stdin_wet_witness` | the watch, establishment, notice, release and publication claims #12434 added (`an_end_written_before_exit_is_judged_on_the_final_bytes`, `a_collector_gone_with_the_envelope_open_is_channel_lost_and_frozen`, `an_authentic_client_exit_is_classified_by_its_own_words`, `the_watcher_publishes_a_collector_exit_without_the_boot_watch`, `an_adopted_collector_needs_a_receipt_naming_its_instance`, `the_capture_watch_stops_when_its_observer_dies_and_waits_while_it_lives`, `the_release_signals_only_the_recorded_instance`, `a_publication_failure_stops_even_a_term_ignoring_child`, and the claims reaching `observer_alive` / `owned_release`) | a launched probe publishes its pid or reaches its state within a fixed 1–7 s sleep | runners start a `sh` probe in well under a second | a runner loaded enough that spawn + publication exceeds the fixed sleep; remedy is the bounded `read_until_contains` poll #12704 added for the two stdin claims |
-The spark/v41 rows are keyed to their subject (the committed tree) rather than to the runner; they
-are listed for completeness.
-
-## Clean
-
-`approval_assertion_counter_wet_witness_test`, `approval_device_enrolment_code_wet_witness_test`,
-`approval_ntfy_access_readback_wet_witness_test` (decode claim), `compute.attempt_lifecycle_wet_witness`,
-`durable_cas_fabric_storage_real_execution`, `durable_cas_file_store_wet_witness`,
-`durable_exclusive_hold_file_store_wet_witness`, `eval_model_probe`,
-`fabric.fabric_control_plane_wet_witness`, `fabric.fabric_event_log_wet_witness`,
-`fabric.fabric_partition_read_wet_witness` (these two leak their temp roots — hygiene, not verdict),
-`host_cli_dependency_wet_witness_test` (both arms accepted — vacuous, not keyed),
-`live_deploy.approval_broker_helper_readback_real_execution`, `materialization_store_local_wet_witness`,
-`megarac_spx_ui_surface_artifact_integrity_witness`, `memory_capture_real_execution_witness`,
-`pre_os_capture_replay_witness`, `provenance_calibration_report_real_execution`,
-`review_sheet_legacy_declaration_wet_witness`, `self_host_logic_seed_unavailable_check_fixture`,
-`serving.serving_availability_bind_wet_witness`, `shell_spawn_refused_real_execution_witness`,
-`spark.pair_incumbent_identity_wet_witness`, `spark.pair_serving_d0_authorization_witness`,
-`spark.pair_serving_d0_real_execution`, `spark_snapshot_verify_wrapper_local_wet`,
-`spark.v41_runtime_candidate_witness`.
-
-## Absorbing-fallback finding (not a host premise)
-
-`test.claim.fabric.fabric_storage_file_store_wet_witness` `fresh_store` drops a
-`FabricStorageRootRefused` and returns the root anyway. §5 names this an absorbing fallback; queued
-with the recorded rows; not scheduled.
diff --git a/docs/plans/witness-cost-first-touch-attribution.md b/docs/plans/witness-cost-first-touch-attribution.md
deleted file mode 100644
index e3e87c6a6ec..00000000000
--- a/docs/plans/witness-cost-first-touch-attribution.md
+++ /dev/null
@@ -1,892 +0,0 @@
-# The floor's per-row budget charges shared entry cost to whichever row touches it first
-
-Finding from the 2026-08-18 runaway census
-([measurement](measurements/floor-slow-rows-2026-08-18.md)). It changes what the
-six runaways are, and so what may be done about them.
-
-## The claim
-
-The budget attributes per row; much of the cost is INCURRED per entry: the first
-row to reach an expensive shared computation pays all of it, later rows pay
-nothing, and the ceiling refuses the first row for a cost not its own.
-
-## The receipt — two rows, same computation, 1ms apart
-
-`dag/test/claim/g2_data_reference_under_selection_witness_test.dag` declares a
-deliberate pair: both rows call the same `specimen_projection()`, both are
-enrolled, both EXECUTED in run 32172125816, and both are reported because both
-are expected-red (failures report regardless of duration):
-
-```
-18:59:48.653  specimen_classifies_as_runtime_read        FAILED in 12 seconds
-18:59:48.688  specimen_does_not_classify_as_local_read   FAILED in 31ms
-```
-
-12197ms and 31ms, 393x apart, same call, 35ms apart on the clock. The second row
-is not cheaper; it is free because the first already paid.
-
-Not the only instance: in `test.claim.extdeps_scope_placement_gate_loudness_witness`
-exactly one of seven rows is over the warn line at 71244ms; the siblings calling
-the same `scope_placement_membership_verdict` on the same fixture are all under
-100ms. That row is also the run's worst memory event, `grew rss by 1.00GB` — the
-shape of a corpus-scale structure built once, not work repeated per row.
-
-Precisely: the g2 pair shows directly that a SECOND call is free, which makes the
-first row's charge shared rather than its own. The extdeps_scope entry is
-consistent with that but does not independently establish it — the floor reports
-duration only for rows that fail or cross the warn line, so the six siblings are
-known under 100ms but their execution order relative to the runaway is not
-recorded, and this document does not assume it.
-
-## Why this matters for the lane
-
-The lane's framing is to decompose over-budget rows into small complete
-segments. For this class decomposition cannot work, and the repository says so:
-`gunbc.witness_row_cost` `witness_decomposition_does_not_reduce_entry_cost_note`
-(operator, 2026-08-05) rules that splitting a witness does not divide the entry's
-cost but amortizes it across more rows, so the per-row drop is an artifact of the
-split. This finding is that prediction observed: splitting one of these rows
-moves the charge to whichever fragment runs first and changes no real cost.
-
-The honest remedies are two, neither a split:
-
-1. Reduce what the shared computation reaches for — a real cost reduction,
-   which moves the entry total and not just the attribution.
-2. Attribute shared cost to the entry rather than its first row, so the ceiling
-   stops refusing a row for cost it did not incur — a change to the floor's
-   measurement, not to any witness.
-
-## What is NOT available, and why it is worth stating
-
-The third remedy the refusal text offers — "move it to a designated `long/`
-home that CI does not run" — is not available today, and taking it would be a
-coverage deletion, not a fix. No cadence executes the long home: the repository
-carries exactly two workflows, `witnesses.yml` and `fleet-converge.yml`, and the
-falsifier cadence was deleted in the floor cut. The 2026-08-04 operator ruling
-(DESIGN, "witness cost derives from purpose") names this exact move as its
-originating specimen — a witness relocated under `long/`, removed from discovery,
-no cadence row, executed by nothing, admission still green. Relocation would
-reproduce it.
-
-Two files' notes still claim a path-based exclusion that no longer exists.
-`required_floor.dag` excludes the long home by AUTHORED MODULE NAME
-(`long_home_prefixes`: `test.claim.long.`, `v2.test.long.`,
-`v2.test.claim.long.`), deliberately off path because a directory deciding
-admission was the defect. `test.claim.rust_test_fixtures_import_closure_witness`
-declares no long prefix and no `ReadsLiveTree`, so it is fully enrolled and pays
-50.4s per run while its note says it does not run;
-`v2.test.manual.grounding_lens_whole_tree` is enrolled the same way, its
-`v2.test.manual.` prefix not being excluded. The notes were corrected in
-gunbc#8430; the enrollment is real and is counted here.
-
-## Scope of this document
-
-A measured finding and its consequences; no mechanism changes. The attribution
-repair (remedy 2) belongs to whoever owns the floor's measurement and is not
-taken here.
-
-## Follow-up: the 71-second row is not expensive in isolation
-
-Measured because the row is 13% of all slow time alone, and "first-toucher or
-genuinely expensive?" decides whether paring it is aimed at anything.
-
-Same head, same two source roots CI uses (`--source-root dag --source-root
-src/v2`), `claim_batch` on that entry alone, reading the per-row `[witness]`
-CPU line — the quantity the floor's budget compares:
-
-```
-row run alone       red_seed_runner_failure_detail_projects_located_receipt   cpu=70ms
-cheap sibling alone red_membership_fixture_names_change_and_path              cpu=0ms
-both, in order      red_membership 0ms, then red_seed_runner 85ms
-```
-
-Against CI's `cost is exactly 71060ms against 1552ms` for the same row. Both are
-per-row CPU at the same head, so comparable: **70-85ms isolated, 71060ms on the
-floor — about a thousandfold.**
-
-The difference is evaluation context. The sandbox resolves this entry's own
-closure (67 modules, 1425 resolved items); the floor evaluates every row against
-one whole-corpus prepared subject (2376 modules). The row's cost is CONTRIBUTED
-BY THE CONTEXT, not by what the witness computes — it computes almost nothing,
-and the sibling reaching the same `scope_placement_membership_verdict` costs 0ms.
-
-Consequence for the lane: remedy 1, "reduce what the shared computation reaches
-for", has almost nothing to bite on here — paring would aim at 70ms of work to
-move a 71-second bill not made of it.
-
-A candidate mechanism, not asserted: this row reaches its companion by NAME
-through the seed runner (`run_claim_failure_receipt` → `run_in_context` →
-`ctx.lookup_fn`), and the prepared-floor scope is a flat whole-corpus namespace
-in which 378 helper names collide and bind last-write-wins (gunbc#8437). A
-name-keyed lookup is the one thing this row does that its cheap siblings do not.
-A lead for whoever holds the prepared-floor scope, untested here; the measurement
-stands without it.
-
-Sandbox caveat, so the number is not reused wrongly: single-entry `claim_batch`
-is fixed-cost dominated — its whole-tree graph-facts phase alone is 18-21s and
-its resolve-split load term ~25s — and the repository already rules that such a
-harness characterizes itself rather than the floor. Hence the comparison is on
-the per-row `[witness]` CPU line, not process wall. An earlier attempt compared
-process wall, made the cheap sibling look like an 82-second row, and established
-nothing.
-
-## The eight-sibling test: identity does not predict cost, position does
-
-`v2.test.claim.effect_reach_test` carries eight rows landing within a 346ms band
-just past the ceiling on the floor (1954-2122ms). Two obvious readings — one
-shared fill with seven free riders, or eight genuinely expensive witnesses —
-predict opposite things under isolation. Measured, with the order-reversal
-control that distinguishes them:
-
-```
-row                                             alone    fwd(pos)    rev(pos)
-path_data_init_derived_host_reading               246     252(1)     511(8)
-path_data_init_red_when_import_severed            217     441(2)     488(7)
-path_touch_selects_on_normalize_path              225     497(3)     459(6)
-unrelated_path_does_not_select                    244     517(4)     518(5)
-hermetic_fixture_stays_local                      241     589(5)     446(4)
-prose_string_path_does_not_classify               251     498(6)     421(3)
-concat_built_path_frontier_not_classified         247     496(7)     385(2)
-live_03_normalize_witness_derived_host_reading    234     514(8)     231(1)
-
-by position, mean of both orders:
-  pos 1: 242   pos 2: 413   pos 3: 459   pos 4: 482
-  pos 5: 554   pos 6: 478   pos 7: 492   pos 8: 512
-```
-
-**Neither reading is right.** Alone, all eight cost 217-251ms — a 34ms spread
-around a 238ms mean, as uniform as this harness measures — so not eight
-independently expensive witnesses. But the first row in a batch is the CHEAPEST,
-the opposite of a shared fill with free riders. Cost tracks position, not
-identity: `path_data_init_derived_host_reading` costs 252ms at position 1 and
-511ms at position 8; `live_03_normalize_witness_derived_host_reading` 514ms at
-position 8 and 231ms at position 1. Same rows, closure, head.
-
-### The step is a claim_batch artifact, not a floor cost — corrected
-
-An earlier revision called that step "a second attribution defect", implying the
-production path. It does not belong to the floor; three independent checks say so.
-
-**Source.** `claim_batch` `run_entry_group` builds ONE ctx per entry group, runs
-every function in the group against it, and calls `eval_call_memo_frame_exit`
-after each — position 1 meets a virgin context, positions 2..N one that has had
-an eviction pass. The floor's claim-evaluation fold in `cli_run.rs` builds
-`evaluation_frame` FRESH INSIDE the per-claim loop, stating why in source: claims
-sharing one immutable scope must not share a context's mutable evaluation caches.
-The floor deliberately lacks the mechanism that produces a once-off step.
-
-**Cross-entry measurement.** Batching two different entries shows no step — each
-row costs its alone figure in either order, since each entry gets its own ctx:
-
-```
-                              effect_reach row    root_d row
-alone                              239               1774
-batch [effect_reach, root_d]       229               1802
-batch [root_d, effect_reach]       219               1732
-```
-
-Within one entry the step reproduces (235ms then 396ms for two rows of one file),
-so the effect is bounded by the entry group — a property of the shared ctx,
-exactly where the source says.
-
-**Floor data.** With the same step, later rows within an entry would cost about
-twice the first. Across the 32 modules in this run with five or more uncensored
-slow rows, the mean rest-to-first ratio is **1.27**, spanning 0.75 to 3.48 —
-several modules have a first row MORE expensive than its siblings, the
-first-touch shape and the opposite of the step. A shared mechanism would cluster
-near 2.0. It does not reproduce.
-
-So the position step is a fact about `claim_batch` and says nothing about floor
-attribution; the additive-versus-multiplicative question it raises is not about
-the production path.
-
-### What this did establish: the first confirmed paring target
-
-`root_d_checkpoint_scalar_declared_arity_witness_holds` costs **1774ms of its
-own work** alone, in a closure of 5 modules and 160 resolved items — far too
-small for the cost to be context; it is the witness's own evaluation. The floor
-attributes 2792ms, so unlike every other row examined here the gap is modest —
-about 1.6x, not a thousandfold.
-
-It is the first row in this lane whose expense survives isolation, hence the
-first genuine subject for the operator's decomposition brief. It is also the
-most stable over-budget row across runs (2792 / 2849 / 2855, a 2.3% spread,
-against 22-30% for the large ones) — what a real cost looks like and an
-attribution artifact does not.
-
-## The stability screen: a sound negative filter, not a paring worklist
-
-`root_d`, the one row whose cost survived isolation, was also the most stable
-across runs (2.3% spread where the large rows swung 22-30%). That suggests a
-cheap screen over all 720 slow rows — rank by cross-run variance rather than
-magnitude — since a witness's own cost should not care what else ran, while
-context, fill and position costs vary with everything around them. Magnitude
-sorts mostly by who touched a cache first, so a principled screen would be the
-first way to build the paring worklist without 720 isolation runs.
-
-Built over four runs (32172125816, 32177951514, 32185058245, 32187164199),
-joined by identity, 650 rows with three or more usable observations.
-
-**Censoring rule, and it decides the result.** An observation is dropped when
-the row was explicitly interrupted (`cost is at least`) or sits in the
-poll-pinned band — those values are the deadline, not a cost. Budget-refused
-rows that COMPLETED are kept: they carry a real measurement. An earlier cut
-dropped every budget-refused row and thereby excluded `root_d`, the 71s row and
-all eight `effect_reach` rows — every row worth screening — which is over-broad
-censoring when the expensive population is exactly the refused one.
-
-**Validation.** Three rows with known ground truth from isolation:
-
-```
-row                            CV     mean      percentile   known truth
-root_d                        1.5%    2854ms        18       real own work (1774ms isolated)
-71s extdeps_scope row         7.8%   76988ms        86       context (70-85ms isolated)
-g2 specimen row               7.4%   13292ms        84       first-touch
-```
-
-Two of three land correctly: the context-dominated rows in the variable head,
-`root_d` in the stable tail.
-
-**But it fails the fourth case, and the failure is the finding.** The eight
-`effect_reach` rows come out STABLE — CV 1.9% to 6.4% around a ~2050ms mean —
-though isolation established they do about 238ms of their own work. A row can be
-highly stable and still carry an order of magnitude of cost not its own, because
-the context it carries is itself reproducible run to run.
-
-So the screen measures REPRODUCIBILITY, not ownership; only the second is what
-paring needs:
-
-- **Sound as a negative filter.** A high-variance row is certainly not measuring
-  its own work, so the variable head can be excluded from a paring worklist
-  without isolation — a real saving over 720 rows.
-- **Unsound as a positive test.** A low-variance row may be real work (`root_d`)
-  or stable context (`effect_reach`). Only isolation separates them; the screen
-  must not be presented as producing the worklist directly.
-
-The honest procedure is two-stage: screen out the variable head for free, then
-isolate the stable tail. The stable tail above 1000ms is small enough for that
-to be affordable — the actual saving on offer.
-
-## Cluster-tightness: also suggestive, also not decisive
-
-If N distinct witnesses — different names, assertions, modules — land within a
-few percent of each other, the figure looks like it belongs to something shared,
-since independent work has no reason to coincide. Over the four-run join, rows
-above 800ms fall into 19 clusters at 3% width; one is remarkable: **18
-identities across 4 unrelated modules** (roadmap static site, running-release
-identity, deploy readiness, site-surface readiness) inside a 2.3% band at
-1213-1242ms.
-
-It correctly flags the `effect_reach` six at 2016-2067ms, which isolation showed
-collapse to ~238ms — one confirmed true positive.
-
-**But the 18-row cluster does not collapse.** One member isolated from each of
-its four modules:
-
-```
-module                        floor    isolated   closure
-roadmap_static_site_witness    1213      888ms    -
-running_release_identity       1216      791ms    630 modules / 15657 items
-live_deploy.readiness          1218      819ms    632 modules / 15656 items
-roadmap_site_surface_readiness 1218      827ms    632 modules / 15640 items
-```
-
-Two-thirds of each floor figure survives isolation: not eighteen rows riding one
-fill — each still pays most of its cost alone. So cluster-tightness is a
-suggestive prior, not a decisive test — the same standing as the variance
-screen, for the same reason: both observe the SHAPE of a cost distribution, and
-neither can see whose work it is.
-
-**The run did surface a better discriminator than either.** Cost against closure
-size:
-
-```
-root_d                 1774ms over     160 resolved items      dense
-cluster members       ~820ms over   15,650 resolved items      sparse
-effect_reach            238ms over    2,694 resolved items      sparse
-```
-
-`root_d` does an order of magnitude more work per resolved item than anything
-else examined. That density — not magnitude, not stability — marks its cost as
-its own evaluation rather than its surroundings.
-
-**Not settled by this run, stated so it is not assumed:** whether the cluster's
-residual ~820ms is assertion work or per-process warm-up of a 15,650-item
-closure the single running row pays alone. Distinguishing them needs two rows of
-one module on a harness without `claim_batch`'s shared-ctx step, which does not
-exist today. Until then the honest reading is that ~820ms is *not shared across
-the eighteen* — not that it is assertion work.
-
-## root_d: the cost is one claim's fixture import, not the witness
-
-`root_d_checkpoint_scalar_declared_arity_witness_holds` is one `test fn`
-conjoining three claims, two calling `compile_dag_rust_emit_check` on a small
-virtual module. Measured by splitting them temporarily and running each in
-isolation (5 modules, 163 resolved items):
-
-```
-claim                                              verdict     cpu
-positive fixture (declared-arity leaf)               PASS      36ms
-arity-0 scalar still strips phantom arguments        PASS    1782ms
-authority answers for both fixtures                  PASS       0ms
-```
-
-**All three pass**, and one claim carries essentially the entire 1774ms. Two
-things follow; the first corrects a pre-measurement assumption.
-
-**The expensive claim is not the one carrying the defect.** The row is enrolled
-in `floor_expected_red`, inviting the reading that its positive fixture is red
-and expensive. It is neither: the positive fixture costs 36ms and passes. The
-row passes as a whole and is a stale quarantine, consistent with the floor's
-`stale_quarantine=5`.
-
-**The cost is an import in a fixture string, not an assertion.** Both
-expensive-looking claims call the same checker on a two-line module. The
-difference between 36ms and 1782ms is that the second fixture's source begins
-`import std.integer { Int8 }`, so the emit check compiles that closure, while
-the first declares its `Witness<C>` inline and imports nothing. The 1774ms is
-compiling `std.integer` inside a virtual fixture — not proving anything about
-checkpoint-scalar arity.
-
-**Why no split is proposed here.** Splitting would move the 1782ms onto a new
-identity not on the expected-red roster, turning a budget-refused quarantined
-row into an ordinary over-budget failure — worse than before. The decomposition
-is only correct together with the fixture fix, and that fix is a judgement
-about whether the arity-0 wall can be witnessed by a scalar that does not drag
-`std.integer` in — Root D's owner's call, not a cost lane's. Recorded with the
-measurement so that decision rests on facts, not the row's size.
-
-So the corpus's one row that survived every screen is also not a
-witness-decomposition subject: its expense is a fixture-authoring choice with a
-localised cause and a plausibly cheap fix.
-
-## Reconciled against the floor-path fill ledger (gunbc#8464)
-
-The shared-fill ledger instruments corpus caches on the floor path and reports,
-per fill, cost, payer, and readers. Its run 32192150969 (9425 claims, 19 fills)
-settles two of this document's rows at identity grain; one corrects a claim here.
-
-**First-touch, confirmed on the production path.** `unbound_dissolution_empty_literal_refuses`
-— one of the six runaways — paid a 51508ms `module_path_index` fill that **139
-claims across 29 modules** then read: 99.8% of the row's measured cost belongs to
-a computation twenty-nine other modules consume, observed on the floor rather
-than inferred from a sandbox. The g2 pair's shape at corpus scale, and the run's
-only shared fill.
-
-**But the 71-second row is the opposite, which refines what this document said.**
-It paid a 29017ms `module_graph_facts` fill and a 24965ms `reference_edges`
-fill, **both exclusive** — no other module reads either. Its cost is genuinely
-its own, and the earlier framing, "a cheap witness billed for the context it
-runs in", is not quite right.
-
-The measurements reconcile once the variable is named. Isolated in a 67-module
-closure the row costs 70-85ms; on the floor's 2376-module subject, 71s. The
-witness did not change — it asks for whole-corpus facts, so its bill is a
-function of corpus size. Neither a cheap row wearing someone else's cost nor an
-expensive assertion: a witness whose subject IS the corpus, small in isolation
-and large on the floor. Isolation missed this because shrinking the corpus is
-exactly what makes such a row look cheap.
-
-That distinction decides the remedy, and it inverts between the two rows:
-
-- the 51.5s `module_path_index` payer must NOT be quarantined — moving it
-  recovers ~112ms and hands 51.5s to whichever of the other 29 modules runs
-  first. The fix is to hoist that fill into preparation, where its consumers
-  already are in spirit and it stops being any witness's bill.
-- the 71s row's fills are wanted by nothing else, so moving or reducing it
-  recovers the whole amount.
-
-Per-row wall time does not distinguish these cases; nothing in this document's
-census does — the strongest argument that the ledger is the instrument the
-population needed, and the honest limit of a census built from timings alone.
-
-**And a floor of ~108s no paring can reach:** three fills — a 55392ms module
-graph, a 35060ms path index, a 17646ms reference-edge scan — are paid before any
-claim runs. Quarantining every witness would not move them.
-
-## Retraction: the variance screen measured four different trees
-
-External review on the subtree rollup caught a defect in the screen above,
-unchecked by author and reviewer, fatal to the statistic as stated.
-
-**The four runs have four different heads, on four different branches:**
-
-```
-32172125816   6aa80c79   work/last-two
-32177951514   59653f56   main
-32185058245   178db9ad   session/crisp-wren-479
-32187164199   ccf21913   floor/cost-is-not-a-defect
-```
-
-No pair is a repeat measurement of one subject. Repeatability requires the same
-subject digest, claim code, manifest and order, budget and poll policy, and
-source universe; these share none. So every coefficient of variation above is
-**agreement across four different worlds, not repeatability under identical
-input** — and this lane already established that changing the source population
-moves both instrument sensitivity and first-touch ownership, exactly the
-variable left uncontrolled.
-
-`root_d`'s 1.5% figure therefore did not establish what it was used for.
-Isolation vindicated the row independently; the statistic did not earn that
-agreement and should not be cited as if it had.
-
-**The negative direction fails too.** The screen was demoted to a "sound
-negative filter" after `effect_reach` came out stable. Review rejects that half
-as well: an intrinsically expensive claim can swing 20-30% from host scheduling
-and frequency variation, page-cache state, allocator behaviour, subprocess
-startup, lock contention, input-dependent branch and allocation shape, or a
-nested shared fill reached during otherwise genuine work. High variance does not
-establish context-only, and the variable head cannot be dropped for free.
-
-And stable context cost is not the accident this document treated it as. Claim
-order is deterministic, so the same identity always first-touches a given cache;
-corpus and cache key are deterministic; every process starts cold; the same host
-class recurs; a cooperative deadline pins observations near one polling boundary.
-Under those conditions a shared cost is *expected* to look stable.
-`effect_reach` is the normal case, not a freak counterexample.
-
-**What survives.** Variance is legitimate PRIORITISATION — high variance: investigate
-order and context sensitivity early; low variance: repeatable-cost candidate —
-and never evidence of ownership either way. The minimum evidence stack for
-ownership is three things together: an uncensored completion rather than an
-interrupt-point value, repeated runs on the SAME subject, and an order
-perturbation showing whether the charge moves to a different first toucher. The
-reversal control earlier in this document is the third; the second this lane has
-never performed.
-
-## The error bar on a single floor observation, measured
-
-The lane had never measured one subject twice. A GitHub re-run replays the
-pinned merge ref, so re-running a completed run yields two observations of one
-world — every row measured twice. Run 32182126916, attempts 1 and 2.
-
-**Same world, verified:** identical subject digest `b0eb3f2be1a200e0` and
-identical counters on both attempts (planned 9420, executed 9420, passed 8951,
-failed 0, budget_refused 102). *(Capture the log BEFORE triggering the re-run:
-GitHub serves only the latest attempt and the earlier archive is unrecoverable.
-This pair exists only because attempt 1 had been downloaded hours earlier for an
-unrelated check.)*
-
-**Paired per-identity delta**, on the 673 rows uncensored in both attempts —
-not marginal distributions, because opposing moves cancel and two histograms can
-look identical while every row moved:
-
-```
-median |delta|   3.8%
-p95    |delta|  12.7%
-p99    |delta|  16.4%
-largest moves   -5% on the 93.8s row, +12% on the 16.6s row
-```
-
-So a single floor observation carries a real error bar: about 4% typically, over
-12% at the tail, on an identical subject.
-
-**Crossings of the 1552ms ceiling: zero.** Spread and crossings are different
-facts; only the second is the enforcement question — a 200ms move on a 400ms row
-is irrelevant, at 1500ms it flips a build. Across 673 genuine rows measured
-twice, none changed sides.
-
-**Not because the instrument is precise — because the danger band is nearly
-empty.** Only **4** genuine rows sit within the p95 flip-radius (191ms) of the
-ceiling; the closest:
-
-```
-margin 29ms (1.9%)   1523 -> 1517   where_refinement_cast_literal_oci_other_digest_algorithm_accepts
-```
-
-That margin is **below the median noise** of 3.8%, so it is the corpus's one
-materially flip-prone identity. It is also, independently, the exact row
-sharp-raven-273 observed at 1505ms then 1274ms on a re-run of one frozen ref in
-the 1500ms-ceiling era — a 15.4% move, near this distribution's p99. Their flip
-is the predicted behaviour of the closest-to-threshold row, not an anomaly; two
-lanes located one identity by different routes.
-
-**What this settles.** The ceiling is enforceable as a per-run threshold on
-today's population: enforcement risk is concentrated in a handful of rows, not
-diffuse across the corpus. It is not safe in general — any row resting within
-~200ms of the ceiling inherits a pass/fail partly a property of the runner, and
-so does a single-run quarantine decision.
-
-**Caveat that changes the reading, nearly unstated.** The rows *closest* to the
-ceiling overall sit at 1553ms and did not move between attempts — poll-pinned
-censored values, not measurements, so they cannot cross by construction.
-Including them makes the instrument look far steadier than it is. Every figure
-above excludes them.
-
-### Rule, not caveat: exclude censored values before computing any distribution
-
-Three shapes of one class turned up in one day on this log — `cost is at least`
-vs `cost is exactly`, the `BUDGET-REFUSED` third channel, and the poll-pinned
-1553ms band inside a paired distribution. Each flatters: the instrument looks
-steadier, or the population smaller, than it is. So this is a standing step, not
-a thing to remember when suspicious: **before computing any statistic over floor
-timings, drop every right-censored value, say how many were dropped, and name
-the channel each value came from.** The channel is part of the datum because
-the three are not equally trustworthy and no field distinguishes them once the
-number is extracted:
-
-```
-BUDGET-REFUSED      an interrupt      -> right-censored, no upper bound
-cost is at least    an interrupt      -> right-censored, lower bound only
-cost is exactly     a completion      -> a measurement
-[floor-witness-slow] elapsed          -> a measurement (fires at the 100ms warn)
-a poll-pinned 1553ms with 1ms margin  -> neither; it cannot move by construction
-```
-
-(The first three spellings are the pre-#9599 rendering, kept because this
-document's figures were parsed from runs that emitted them. Current spelling:
-`cost=UNMEASURED` with a separate `interrupt_point=` field for an interrupt, and
-`cost={n}ms EXACT` for a completion — `ClaimOutcome::budget_figure_phrase`. That
-is this rule made structural: the bound no longer occupies a measurement's field,
-so it cannot be extracted as one.)
-
-(The channel refinement is sharp-raven-273's, and the right generalization: "how
-many were dropped" hides that the dropped rows failed in different ways.) An
-interrupt is not a measurement and a pinned value cannot move by construction,
-so neither answers a question about movement in either direction — they are
-unmeasured, a third state from pass and fail.
-
-## Is the noise relative or absolute? It is relative — so a flip radius scales
-
-Decides whether the 1552ms result transfers to a lower ceiling. Mean paired
-movement, bucketed by row magnitude over the 672 genuine rows:
-
-```
-magnitude      n     mean |rel|   mean |abs|
-100-250ms    391        4.9%         7.9ms
-250-500ms    142        5.4%        19.3ms
-500-1000ms   109        4.3%        29.7ms
-1000-2000ms   30        2.6%        30.4ms
-```
-
-Absolute movement grows nearly 4x across the range while relative movement stays
-flat. The noise is **proportional**, so a flip radius must be a fraction of the
-ceiling, not a fixed millisecond figure carried across. Carrying the 1552ms p95
-radius (210ms) down to a 500ms ceiling would overstate that band by more than 3x.
-
-## What each candidate ceiling costs, measured
-
-p95 relative movement is 13.5%, so the flip radius at ceiling C is 0.135*C.
-Over the 672 genuine paired rows:
-
-| ceiling | p95 radius | rows in band | CROSSINGS observed | rows already over |
-|---|---|---|---|---|
-| 500ms  | 67.7ms  | 53 | **11** | 139 |
-| 750ms  | 101.5ms | 40 | **9**  | 62 |
-| 1000ms | 135.3ms | 24 | **3**  | 30 |
-| 1552ms | 210.0ms |  4 | **0**  | 0 |
-
-Crossings are observed, not modelled: each is a row that landed on opposite
-sides of the ceiling in two runs of one identical subject.
-
-**Not scattered coin flips — they cluster by module.** Six of the eleven 500ms
-crossings are one module (`generic_item_clone_bound_witness`, every row
-476-491ms then 502-528ms), two more `where_refinement_enforcement_witness`, two
-the python round-trip pair. Rows in a module share a closure and move together:
-a ceiling in a crowded band refuses a whole module at a time on a runner's luck.
-
-**So a 500ms ceiling is not a marginal adjustment.** It refuses 139 rows on the
-first run for being over, and puts 53 more in a band where 11 were observed
-changing sides between two runs of one tree — a build's outcome partly a
-property of which runner picked it up. 1000ms is the first candidate where the
-band thins (24 rows, 3 crossings); 1552ms has no crossings at all.
-
-This does not say the corpus should stay slow — the ceiling cannot lead the cost
-work. Rows must leave the band before the ceiling descends onto it, the ordering
-#8470 demonstrated: the 45941ms row became 844ms by moving a shared fill into
-preparation, with no change to the ceiling.
-
-## Audit of the two quarantine-decision runs
-
-Both logs retrieved complete (terminal counter line present in each — not the
-CLI-truncation class):
-
-```
-run 32189985063  planned=8995 executed=8995 passed=8636 failed=1 budget_refused=0
-  FAIL  emitted_lib_rs_module_declaration_witness_test.small_crate_lib_rs_omits_unemitted_dispatch_module
-        cost is exactly 42545ms against 1552ms          (27.4x the ceiling)
-
-run 32193032348  planned=8997 executed=8997 passed=8638 failed=1 budget_refused=0
-  FAIL  emitter_nested_refinement_cast_witness_test.single_refinement_carrier_emits_no_unsupported_cast
-        cost is exactly 45826ms against 1552ms          (29.5x the ceiling)
-```
-
-Neither decision is marginal: flipping a 42545ms observation needs a 96.4% drop
-against a measured p99 of 17.7%. Both quarantines are clean on the evidence, and
-both rows are the first-touch fill carriers this note is about — the second is
-the row #8470 later brought to 844ms without touching the witness.
-
-One discrepancy recorded, not resolved: each run's terminal counters report
-`failed=1, budget_refused=0`, so these logs contain two measured verdicts, not
-the eight-plus-one this audit was scoped to. The remaining identities are not in
-these runs' counters; their provenance needs naming before they can be audited
-or cleared.
-
-## The ownership instrument now exists, and this document's whole method is superseded
-
-Everything above infers ownership from timings — variance screens, cluster
-tightness, isolation runs, order reversals — and concludes, correctly, that a
-census built from timings alone cannot see whose work a cost is. That limit is
-now lifted, and by an instrument the floor already emits on every required run.
-
-`claim_executor` turns `GUNBC_RECOMPUTE_TRACE` on unconditionally, and the
-required floor writes **`required_floor_cross_claim_demand.tsv`** beside
-`required_floor_claim_cost.tsv`. Its row is a producer identity with the count of
-claims that demanded it, the count of times it was actually evaluated, the
-modules it spans, and its declaration site. A producer with claims equal to evals
-was re-derived once per claim and shared with nobody — the question every screen
-in this document was a proxy for, answered directly and at identity grain rather
-than inferred from a distribution's shape.
-
-So the standing procedure for this class is: read the two artifacts, not the log
-and not a sandbox. Both are named in the log's own announcements, with their
-caveats in band — `[cross-claim-demand]` states that its cost column is
-inclusive of callees and must not be summed, and that its printed head is a
-preview ordered by recomputation rather than a candidate roster.
-
-**Both log renderings are capped at 25 rows and both say so in a trailer.** That
-trailer is load-bearing: on run 33668368846 the `[over-cost]` head carries 25
-rows while `required_floor_claim_cost.tsv` carries 295 over the 100ms line. A
-census taken from the log is the log's ranking read as the population —
-`instrument_output_read_as_subject_content`, observed twice on this lane.
-
-**And a third truncation lives in the ARTIFACT, not the log, which is why it is
-the dangerous one.** `required_floor_cross_claim_demand.tsv`'s `module_sample`
-column caps at **8 modules**; on run 33668368846, **1044 of 26317 rows** carry a
-`modules` count above that cap, so their consumer list is cut. Unlike the two
-print caps this one has no trailer — the row simply lists eight modules beside a
-`modules=71`, and a reader joining producers to consumer modules gets a silently
-partial answer.
-
-It bites exactly where the join matters: the producers whose sample is truncated
-are the WIDELY SHARED ones, which are precisely the producers most likely to
-explain why a whole module's rows cluster. So **a corpus-scale join from module
-to shared producer is not performable from this artifact today** — the per-module
-reading below is sound only where the join was performed by hand, one producer at
-a time, and a 73%-of-over-line-CPU classification reported off the step ratio
-alone is a step-cluster inference at that strength rather than an ownership
-result. Widening or inverting that column is named here as an obligation and
-deliberately not undertaken in this lane.
-
-Three truncated renderings on one lane is a pattern rather than three accidents,
-and the shape they share is the reusable part: **an instrument that caps a
-collection reports the cap honestly at the top level (`modules=71`) while the
-column a consumer actually reads silently answers for eight.** Check the cap
-against the count before joining on any list-valued column.
-
-### Eval steps, not milliseconds, is the within-module discriminator
-
-`required_floor_claim_cost.tsv` carries `eval_steps` beside the two clocks. Steps
-are deterministic where a millisecond is not, so a step figure cannot be explained
-by a quiet runner — which is exactly the confound that demoted the variance screen
-and the cluster-tightness prior above.
-
-**What `eval_steps` measures is WORK, and work is not OWNERSHIP.** Rows landing at
-near-identical step counts are not thereby shown to share a producer; that is a
-step-cluster inference, and the same total can arise from unrelated derivations of
-similar size. Ownership is established by the cross-claim demand artifact, which is
-keyed by PRODUCER IDENTITY and says which claims actually reach the same producer.
-The shared-derivation conclusion is a JOIN of the two instruments: demand identifies
-the shared producer, and `eval_steps` then characterises how much evaluation work
-the claims reaching it perform.
-
-Read that way on run 33668368846's over-line population, the majority of the CPU
-sits in modules where the demand artifact names a common producer AND the rows
-agree on steps to within a few percent: shared derivation, where
-splitting re-attributes the fold and changes no real cost
-(`witness_row_cost` `witness_decomposition_does_not_reduce_entry_cost_note`).
-
-The remedy for that bucket is enrolment on
-`v2.workflow.floor_pure_producer_share`, whose admission criterion is measured
-serve cost below measured recompute cost — the demand census answers only the
-recompute half, and a present-versus-absent join of `required_floor_claim_cost.tsv`
-across two runs answers the other. A row that fails the serve half comes back out;
-the roster's header already records one such exclusion with the capability that
-would retire it.
-
-### What this screening is worth, measured elsewhere and not by this document
-
-gunbc#10143 landed on `main` after this document's tested base and measures the population this
-screening ranks. Two of its results bound what any screening here can buy, so they belong beside
-the method rather than discovered after acting on it.
-
-**The band is dense and the tail is a plateau — there is no gap below the ceiling.** On its
-post-repair run, 5 rows sit at or above 500ms, 27 in 400–500, 55 in 300–400, against 3,174 below
-100ms. Repairing modules top-down, the first three buy 43ms and the next seven buy 61ms — roughly
-**10ms per module**, about one fiftieth of the ceiling. That is the treadmill, quantified. So a
-screening that surfaces the next-most-expensive producer is answering a question whose payoff is
-small by construction, and the document's own ordering — safety-relevant rows ahead of
-milliseconds — is the more defensible one for reasons that are now measured rather than argued.
-
-**And the crossers do not generally share a root.** gunbc#10143 records that the modules newly near
-the ceiling do NOT share a root the way gunbc#10133's three did. The shared-derivation bucket this
-document describes is therefore the exception rather than the common case, which sharpens the
-warning already stated above: splitting re-attributes a shared fold and changes no real cost, and
-the shared fold is not what most near-ceiling rows have.
-
-**A worked counterexample was claimed here and then REFUTED by this document's own discriminator,
-which is worth more than the example would have been.** The claim was that gunbc#10170 relocated
-five canonical fixtures out of a ~5k-line module and took four `rust_body_add_emit` rows from
-506/425/416/362ms to 180/174/172/168ms, with the spread collapsing 144ms → 12ms.
-
-Two floor artifacts refute it. Pre-relocation (run `33707763185`) and post-relocation (run
-`33711894017`), same four identities:
-
-| | cpu_ms | eval_steps |
-| --- | --- | --- |
-| pre | 314 · 305 · 290 · 318 | 171091 · 166669 · 162507 · 171124 |
-| post | 339 · 327 · 317 · 344 | 171052 · 166630 · 162468 · 171085 |
-
-**`eval_steps` moved 0.02%** — 39 steps out of 171091. The work did not change, so the relocation
-removed no evaluation work from these claims. CPU is *higher* after, which is within noise and makes
-the honest reading "no measured effect in either direction". The 506 baseline was a contended-run
-outlier: those rows were already at 314/305/290/318 with a spread of 28 before anything was touched,
-so both the "drop" and the "spread collapse" were artifacts of the baseline. And 180/174/172/168
-came from a targeted `claim_batch` — a fraction of the corpus, a different execution envelope, and
-not a floor result.
-
-**The mechanism that caught it is the one this section argues for.** Steps are deterministic where
-milliseconds are not; a cost story that milliseconds support and steps refute is the clock talking.
-The same discriminator that says work is not ownership says here that a millisecond drop is not a
-work reduction.
-
-The census does name where the family's cost sits, and it is worth recording which instrument found
-it: the cross-claim demand artifact keyed by PRODUCER IDENTITY reports
-`target_project_arrow_body_to_value_expression` at 95 claims / 117 evals, 4396ms total with
-**4350ms cross-claim** across the emit family including all four rows. That is a producer named by
-identity, not a cluster inferred from step totals.
-
-**It is NOT a candidate, and this document disqualifies it below.** That function carries
-`handle_transform: fn(Node, Node, TargetModel) -> …`, so it meets the fn-typed-parameter exclusion:
-reification refuses the argument, the key cannot be formed, and the store refuses AT PUBLICATION.
-A controlled present-versus-absent pair would measure noise against nothing, because the absent arm
-is the only arm — the row never stores. **The demand it names is real; the route to serving it is
-closed until the key can be formed.**
-
-Recorded rather than dropped because the reading is the useful part: the largest cross-claim
-producer in this family is unreachable by the serve mechanism, which is a fact about the mechanism's
-coverage and not a gap in the census.
-
-### Screening candidates from the census, by reading a declaration
-
-The demand census ranks by cost, and cost is the wrong sort key: three large
-classes on it cannot be shared at all, and one of them refuses at publication
-rather than losing a measurement. Screen with the signature before spending a
-controlled pair, because a row that never stores cannot have its serve measured —
-the resulting pair is noise, not a negative result.
-
-**The rule is a ratio, and it screens OUT — it never admits.** Serve cost scales
-with the size of the ARGUMENT plus the VALUE; recompute cost scales with the
-DERIVATION between them, so a candidate is worth measuring only when the
-derivation is large relative to what must be hashed and verified. That is a
-necessary condition and emphatically not a sufficient one: gunbc#10094 enrolled
-three candidates on exactly such reasoning and withdrew all three on measurement,
-and gunbc#10108's note withdraws a fourth — `compile_phase_frontier_standing`
-claim-forced at its general declaration — on single-authority grounds despite a
-measured win. Nothing below replaces the roster's present-vs-absent receipt.
-
-Three classes are disqualified without a run:
-
-- **A fn-typed parameter anywhere in the signature.** Reification refuses a
-  `Value::Fn` as `OriginBoundNode` and a `Value::Closure` as `Closure`, and
-  arguments are reified on the same path as values
-  (`v1_interpreter::portable_args_from_ctx` → `CrossClaimStoreOutcome::RefusedArgsNotPortable`),
-  so the key cannot be formed and the store refuses at publication. This is the
-  class that excluded the two rust target models, met on the argument side rather
-  than the value side. *e.g.* `target_project_arrow_body_to_value_expression` and
-  `target_project_match`, both carrying
-  `handle_transform: fn(Node, Node, TargetModel) -> …`.
-- **A hot utility — evals far exceeding claims.** A function called many times
-  per claim is not one derivation shared across claims; per-argument keys with
-  little reuse are cache population, which is why `formal_production_for_lhs_exact`
-  was removed from the roster after a run measured 1,635 fills against 113
-  consumer claims. *e.g.* `bind_outcome`, `zip_eq`, `fold_grammar_expr`,
-  `emit_host_list_map`. **claims ≈ evals is the shape that SURVIVES this
-  exclusion screen** — it is worth measuring, which is not the same as admitted.
-- **A constructor.** Its census cost is call volume plus inclusive callees, not a
-  derivation, so there is nothing to serve. *e.g.* `decl_ref`,
-  `effect_demand_key`, `formal_productions_catalog_to_node`.
-
-A fourth shape survives the screen but is usually a loss: a large argument reduced to a
-small value with little work between, such as
-`target_catalog_contains_node_shape(slot: Node, catalog_targets: List<Node>) -> Bool`,
-where hashing and verifying the node list per serve costs more than the fold it
-replaces. That one is the ratio rule applied, not a separate exclusion.
-
-Applied to the census, these three classes account for every remaining producer
-above a second outside the emit family. The emit family is **not** available, and
-the reason is stronger than it was: the roster's re-enrol trigger — a serve that
-does not walk the value per consuming frame — HAS FIRED (gunbc#10094 made a serve
-O(1) by handing over the reified value), the family was re-measured against that
-new serve, and it is still out. All three candidates regressed, showed no effect,
-or improved a family total while the rows nearest the ceiling got worse. The
-remaining cost is deliberately left unidentified there rather than given a
-plausible story.
-
-Two lessons from that run belong here because they bound this whole method.
-**The subject is the per-claim row, not a total** — the ceiling is per claim, so a
-family that improves on aggregate while its rows nearest the line get worse is a
-loss. And **a discharged capability makes re-enrolment testable, never decided**:
-inferring admission from "the serve is cheaper now" is the
-specification-without-execution DESIGN §5 names, and it was wrong three times.
-
-Whether that capability also lifts the fn-in-key limitation is **open and should
-not be assumed either way**: one is about the cost of moving a portable value,
-the other about whether an origin-bound reference can be represented in one at
-all.
-
-### The rows nearest the deadline are the ones whose refusals are being silenced
-
-Recorded because it reorders the population by something other than milliseconds.
-Observed on main run 33671815204 (head 20caf4eb): the two rows the 500ms CPU
-deadline preempted there were not incidental — they were
-`self_host_compile_phase_live_gate_witness`'s
-discriminating REDs — the planted-identity refusal and the equal-cardinality swap
-refusal. A preempted row is not a slow row that still answered; it is a refusal
-that did not execute, which is why the floor refuses to call the run green. So
-cost work on this population is not traded against safety. Measured: sharing the
-fold under those rows (a roster row later withdrawn on gunbc#10108's
-single-authority grounds, so the cost figures are not carried here) took the run
-to `cpu_deadline=0` and both refusals executed. Whoever makes that fold cheap by
-whatever route gets the same effect, because the mechanism is the row reaching a
-verdict rather than any particular repair.
-
-**Prioritise this population ahead of milliseconds — but the safety RANKING it
-would need does not exist yet, and this document does not supply one.** A
-preempted row is a strong candidate regardless of where it sits in a cost
-ranking. What is observable is only the VICTIM IDENTITY: `cpu_deadline` counts
-how many rows were cut off, `required_floor_claim_cost.tsv` carries each of them
-with `verdict_reached=false`, and both name WHICH claim was preempted.
-
-Neither names what that claim exists to PROVE. The two rows above are refusal
-probes because their source was read and verified one at a time, not because any
-instrument said so — and reading names off a diagnostic does not generalise to a
-corpus-wide procedure. `std.witness_purpose` is explicit that purpose is
-AUTHORED, NOT INFERRED FROM IMPLEMENTATION, and it presently carries no per-row
-declarations at all: zero declarers, zero consumers.
-
-So the honest statement of the method is three separate claims, and only the
-first two are discharged here: victim identity is observable; these two victims
-were independently verified as refusal probes; ranking the population by safety
-relevance REMAINS BLOCKED until an authored purpose can be joined against
-`verdict_reached`. Treating the second as if it were the third is how a class
-acquires a rung it did not earn.
-
-**The repair for this class has to travel through the gate the class refuses.**
-Recorded because it is a structural property and not a queue accident, and
-because it decides what "prioritise the fix" can and cannot buy. A preemption is
-runner-dependent — the same rows measure anywhere from ~100ms to over 500ms on
-one tree — so any PR can draw a refusal from two rows that are not broken, and
-that includes the PR carrying the repair. Observed in situ: a 138-line
-documentation-only change with no `.dag`, no Rust and no workflow was refused by
-`a_live_tree_that_gained_an_identity_refuses_and_names_it` at
-`cpu_at_least=501ms/500ms`, while the consolidation that would make that fold
-cheap sat open with its own required floor lane running.
-
-The tempting exit is a re-run, and it is the one move this document's evidence
-forbids most specifically. A re-run does not make the row cheaper; it redraws the
-runner. What it buys is a green **over refusals that did not execute** — the
-`interrupted_before_verdict` rows are the discriminating REDs themselves, so the
-mark asserts a verdict for exactly the claims that were preempted. That is worse
-than a slow build, and it is why `cpu_deadline` must be read as a safety counter
-rather than a performance one.
diff --git a/docs/plans/witness-execution-closure.md b/docs/plans/witness-execution-closure.md
deleted file mode 100644
index b2e30331a4b..00000000000
--- a/docs/plans/witness-execution-closure.md
+++ /dev/null
@@ -1,337 +0,0 @@
-# Witness execution closure: 778 identities discovered, declined, and never run
-
-**Found and closed 2026-08-20 (`nimble-wolf-645`).** The required floor discovered 778 witness
-identities every run, declined all at file grain, and executed none — and since the 2026-08-15
-floor cut left `claim_executor --required-floor` as the tree's only witness-executing consumer,
-"declined by the floor" and "not run anywhere" became one fact.
-
-This document is the finding and the receipt; the change is in `v2.workflow.required_floor`,
-`v2.workflow.floor_route_gap`, and the seed's site projection.
-
----
-
-## The measurement
-
-Counted with the floor's former Rust scanner (a column-zero
-`test fn `, and a column-zero `data … LiveTreeDisposition … ReadsLiveTree`), on `4cec10f66a3`:
-
-| population | identities | files |
-|---|---|---|
-| discovered `test fn` sites | 11,115 | — |
-| `DeclinedLongModule` (authored `long.` module name) | 538 | 97 |
-| `DeclinedLiveTree` | 782 | 112 |
-| routed and executed | remainder | — |
-
-The floor's own run receipt agrees and is the citable number: `gunbc#8638`, run `32337765205`
-against `32333231183` at the same base, reported `claims=9782 declined_long=538 declined_live=778`
-on the base — the brief's 778 exactly. Quoted in
-`dag/test/claim/seed_mirror_constant_lens_witness_test.dag` by a session that had just added four
-rows to the declined population and measured the delta.
-
----
-
-## Three defects, and only the third is about cost
-
-### 1. The decline rested on a premise that had stopped being true
-
-`DeclinedLiveTree` excluded any identity whose FILE declared
-`data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree`, on the premise that reaching
-the live tree implies "cannot run in the hermetic frame this floor folds".
-
-That premise had been false for some time. Hermetic mode carries the **checkout-input carve-out**
-(`v1_interpreter`, the readonly `Filesystem.Read|List` arm guarded by
-`hermetic_checkout_input_disposition`): a readonly filesystem operation whose path the disposition
-*confirms* sits under the checkout root, with no `.git` or `target` component below it,
-**dispatches to real input access** — the commit is the run's deterministic input, so this is
-input access, not a host effect. Reading committed `.dag` and `.rs` sources is exactly that case,
-and is what most of the 778 do.
-
-So the floor ran a **file-grain prediction of an answer the interpreter already decides exactly,
-per identity, at the effect boundary** — and predicted it wrong, in the direction that silently
-removed coverage.
-
-Independent confirmation: another session reached the opposite conclusion in writing one day
-earlier — *"the required floor folds one hermetic prepared subject, so a live-tree reader cannot
-participate by construction"* — followed by a §4b rung drop to *mitigatable* whose next-rung
-trigger was *"an executing consumer for the declined-live population"*. The trigger needed no new
-lane, only the stale prediction deleted.
-
-### 2. One fact, two computations, in one binary
-
-`reads_live_tree` was derived twice, by methods that cannot agree except by coincidence:
-
-- the former `cli_run` floor scanner — a **syntactic text scan** for the declaration line.
-- `cli_run` `reads_live_tree_effective` — reads the same declaration, then falls through to
-  `effect_reach_derived_reads_live_tree_for_entry`, a **semantic effect-reachability derivation**
-  over the entry's import closure.
-
-These disagree as a function of the import graph (DESIGN §3). The resolution is not to pick one:
-the two consumers asked **different questions**, and only one was entitled to the name.
-Affected-set selection asks *does this entry's result depend on live tree state* —
-`reads_live_tree_effective` keeps that question, untouched. The floor asked *can this identity
-execute*, which no authored file-level boolean can answer. The floor's copy is deleted; nothing
-replaces it, because execution answers it.
-
-### 3. The run's own honesty check could not see what it dropped
-
-`claims_planned` was the **post-decline** number. The terminal invariant
-(`ClaimIdentityCountsDisagree`) compares `planned == executed == receipted`, all measured *after*
-the projection dropped whatever it dropped: a projection declining a thousand identities and one
-declining none produce identical healthy triples.
-
-And the per-identity receipt (`RequiredFloorDispositionRow` TSV) was gated on
-`GUNBC_REQUIRED_FLOOR_DISPOSITION`, which `witnesses.yml` did not set — so on CI the whole
-declined population was two integers in a `[floor-phase]` line.
-
----
-
-## The measurement, and what it settles
-
-The decline arm was deleted on a branch and the whole population executed — floor run
-**32345970386**, sha `c812b9fb6d0`, the first run in which every discovered identity was routed:
-
-```
-offered=11103 routed=10565 declined_long=538      (partition exact)
-planned=10565 executed=10565 terminal=10565 passed=10116
-known_red_held=207 failed=36 route_gap=157
-interrupted_before_verdict=47 completed_over_cost_requirement=2
-```
-
-**Of ~783 identities admitted, 626 pass.** 157 route-gap, naming exactly the operations this
-corpus's exclusion notes have named in prose for months — `Mktemp.Dir` 54, `IsExecutable` 26,
-`Run` 17, `emit_host_native_cache_evict` 10, `Check` 10, `Write` 8, `git.Inspect.HeadCommit` 5,
-then a tail. **Not one is a committed-source read.** The premise was stale for the large majority
-of the excluded population, not an interesting minority.
-
-The cost worry did not materialise: 49 of 783 in the cost tail (~6%), 32 minutes wall against a
-180-minute timeout.
-
-### The finding nobody was looking for: a third of the expected-red roster was never red
-
-That run carried **308** enrolled expected-red identities and held **207**. The difference is
-**101** — and the 101 enrolled identities that route-gapped are *precisely* that set, by
-intersection, not by count coincidence.
-
-Those 101 were already executing on main every run and already reaching a hermetic refusal. Since
-that refusal arrived as a `TypeError` carrying prose, `ExpectedRedArm` could only read it as an
-ordinary failure and **held it as agreement**. The debt ledger recorded "this witness runs and
-fails and someone is fixing it" about 101 rows that never reached their subject; nothing was
-fixing them because there was nothing to fix: **they needed a route, not a repair.**
-
-This is the state-space conflation §5 names, inside the mechanism whose job is making debt
-visible. It also means main's `passed=8702 / known_red_held=306` counted something narrower than
-executed coverage, by 101 identities, independently of the 778.
-
-### The cost tail is two mechanisms, not one budget
-
-The CPU histogram over the 49 is bimodal with a **14.4-second empty gap**:
-
-| band | rows |
-|---|---|
-| 5001–5013 ms | 23 |
-| 6682 ms | 1 |
-| *(nothing from 6.7s to 21.1s)* | 0 |
-| 21109–53301 ms | 25 |
-
-A 12ms spread across 23 rows is **the interrupt firing**, not 23 witnesses each needing five
-seconds — and an interrupted claim's cost is a *lower bound*, so those rows' true cost is
-**unmeasured**. The low mode cannot argue the budget is too tight.
-
-24 of the high-mode 25 are *also* interrupted, having accrued 21–53s against a 5000ms deadline —
-only possible where the stride poll cannot land: `ClaimPreemptionReachability::OpaqueHostCallUnbounded`,
-already modeled in `v2.workflow.required_floor`. **Exactly one of the 25 is the known member** of
-`opaque_host_call_grandfather_population()`, which declares itself *exhaustive at one member* and
-"grows only when a DIFFERENT operation is found to share this shape, which is a new finding, not
-a declaration." This is that finding: the other 24 reach host-fed `*_live` builtins in
-`enforcement_live`, `cost_coverage`, `grammar_coverage`, `lifecycle_survivor_corpus_census`, and
-`realization_vocabulary_containment`. The "bounded population" was bounded by what anyone had
-observed on a floor not executing the population where the others live.
-
-## What replaced it
-
-**Delete-first at the root** (DESIGN §3 replacement migration). `DeclinedLiveTree` and the text
-scan feeding it are gone; no intermediate representation was built beside them.
-
-- **One execution route per identity.** Every non-long identity is routed and executed. The route
-  is `RequiredFloorClaim.execution_mode`, already per-claim — no new vocabulary restates it.
-- **The interpreter's refusal is the classifier, and it is typed.**
-  `InterpError::HermeticHostEffectRefused { operation, ground }` replaces three
-  `TypeError`-with-prose sites and reaches the floor as `ClaimOutcome::HostEffectRefused` — the
-  precedent `TimedOut` and `HostToolUnresolved` set against substring-matching prose. A route gap
-  is **not a verdict**: the witness never reached its subject, so it is neither pass nor failure,
-  and is reported apart from both because its remedy is a route.
-- **`HermeticEffectGround` is closed and names the remedy**: `UnpublishedMockCase`,
-  `NoMockResponse`, `FilesystemRemoval`. One `String` would have collapsed three fixes into one
-  sentence.
-- **The offered population is checked, not just reported.** `SitePartitionInexact` refuses
-  unless `offered == routed + declined_long`, stated at the loop that could violate it.
-- **The residue is identity-grain debt, not a category.** `v2.workflow.floor_route_gap` reuses
-  the `floor_expected_red` contract rather than re-coining it: enrolled-and-gapped is agreement,
-  unenrolled-and-gapped reds, enrolled-and-did-not-gap reds as stale, enrolled-and-did-not-execute
-  reds. Monotone, identity grain, over an independently discovered closed universe — the four
-  conditions DESIGN §5's 2026-08-01 oracle ruling requires of a debt contract. No count assertion
-  anywhere.
-- **The receipts are emitted on CI**, unconditionally: the disposition TSV and the long-home
-  storage agreement TSV are named in `gunbc.witness_floor_workflow`.
-
-Nothing gets a wet route — no live shell, write, or network. That is a separate lane with its own
-admission question, deliberately not opened here.
-
----
-
-## What landed here, and what is staged
-
-This change carries the **mechanism** and the **101 reclassification**; it does **not** delete
-the decline arm.
-
-The seam is exact, not chosen: the full-closure run surfaced **55 blockers — 6 witnesses that do
-not RESOLVE** (`undefined variable`, `no such function`; never caught because nothing evaluated
-them) **and 49 in the cost tail — all 55 newly-admitted, none previously routed.** So the
-blocker-free part is a complete change that happens to be smaller, not a partial one. The 101
-route-gap on main today and need nothing deleted to be reclassified.
-
-Staged behind their owners: the 6 broken artifacts (route to author or delete — enrolling a
-non-resolving witness as expected-red would assert it runs and fails, re-minting the conflation
-this change removes), and the cost-tail policy call, which the histogram says is two questions.
-
-## What is NOT claimed
-
-The `long.` decline is untouched: an operator-ruled cost quarantine on a different axis, with
-538 identities and no executing consumer — the *other* half of the hidden population, not closed
-here.
-
-## The adjacent residue, named rather than left to be rediscovered
-
-`run_required_floor` consults `floor_prepared_subject_exclusions()` **and nothing else** — the
-`witness_exclusion_frontier` rosters have no consumer on this path, which that function's own
-comment records after a session added rows to them and measured `modules_excluded=2` unchanged.
-
-Three of its five entries exist for **exactly the route-gap reason** — an operation with no
-`mock_response`, so "the hermetic floor refuses it and one refusing member fails the run." The
-same defect this change removes, one layer over: a **file-grain, uncounted exclusion** where an
-identity-grain typed disposition belongs. Strictly worse than a route gap: an excluded module
-leaves the prepared subject entirely (not even typechecked), whereas a route-gapped identity
-stays, executes, and reports.
-
-Converting those entries into `floor_route_gap` rows is the obvious next step and is deliberately
-**not** here: it should follow, not precede, the measurement proving the route-gap mechanism
-behaves as designed on its own population.
-
----
-
-## The same failure one level up: the projection's denominator (2026-08-29, `nimble-ibex-902`)
-
-The population above was lost *inside* the projection — discovered, declined, never run. The
-sequel is the population lost *before* it: identities that never reached the projection, so no
-partition over "offered" could speak for them.
-
-### The two mechanisms that removed them
-
-`assemble_prepared_subject_closure` drops modules two ways, and a witness declared in a dropped
-module was neither planned nor declined:
-
-- **the exclusion substrings**, whose entry-grain receipt (`collect_deferred_discovery_rows`)
-  existed but was never joined to the disposition population at identity grain; and
-- **the gate closure** introduced by the 2026-08-29 gate cut (§4b rung drop *Required gate
-  reduced to the compiler floor*). Only modules in the transitive closure of the gate seeds are
-  prepared, so `declined_outside_required_gate` — which reads two figures — can only ever speak
-  for modules that *reached* the index.
-
-### The subject universe, measured
-
-Counted with the floor's own rule (a column-zero `test fn ` / `test data `) over `dag/` and
-`src/v2`: **13,975 distinct declared identities** in 1,759 files, **zero** duplicate identities,
-**zero** module-name collisions. So the gap between the declared corpus and the floor's `offered`
-was never duplication but two silent removals. The live figures are the run's own:
-`required-floor: declared=… offered=… declined_outside_gate_closure=…`.
-
-### What changed
-
-**Hand-Rust receipt.** The receipt is a roster row, not this paragraph:
-`gunbc.floor_population_projection_seed_growth`, enrolled in
-`gunbc.seed_growth_admission seed_growth_justification_roster` — item delta, admitted
-modifications, owning lane (`v1-hand-queue-drain`), dissolution trigger, and boundary chain live
-there, where the census reads them. **Full-index retention (review 57430):** the discovery fold
-consumes the prepared full-index views by value inside its own phase (the intermediate
-`FloorDiscoverySource` vector is deleted), and the phase's completion line prints
-`full_inventory_release_rss_kb_before` / `_trim_reclaimed_kb` / `_rss_kb_after` through the
-floor's existing statm/malloc_trim instruments, so the run itself states that outside-closure
-bytes end with the phase rather than surviving into claim execution.
-
-1. **The universe is the declared population, answered by one authority.** The floor folds
-   `v2.workflow.floor_discovery_producer` (`discover_floor_rows_for_source`) over preparation's
-   FULL module index rather than over the prepared closure alone, and classifies each returned
-   identity against the prepared closure and the exclusion map: an identity whose module
-   preparation dropped carries `DeclinedOutsideGateClosure` or
-   `DeclinedDiscoveryExcluded { matched_substring }` — two arms on the existing authority, not
-   a second status vocabulary. No Rust rescan stands beside the producer; gunbc#9685's
-   single-discovery-authority cut holds for the whole corpus, not only the prepared subject. The
-   gate-closure population keeps its own arm rather than folding into
-   `DeclinedOutsideRequiredGate`: the two are removed by different mechanisms, restored by
-   different triggers, differ by two orders of magnitude, and the first is the rung drop's subject.
-
-   **The consequence, stated now:** the producer's per-file refusals — misplaced `test` decl,
-   barren sidecar, misplaced wire contract, malformed `live_tree_disposition` row — now stop the
-   required floor for ANY module under the source roots, not only one the gate closure admitted.
-   A real widening of what this lane refuses over, survivable today because the corpus carries
-   none of those violations (measured 2026-08-29: zero `test`-marked decls outside a `*_test.dag`
-   sidecar, zero barren sidecars); the first violation authored anywhere in the tree will red
-   this lane rather than the one owning the file.
-2. **The partition is an identity join, not a count equality.** The old check was
-   `offered == routed + declined_long + declined_fixture + declined_outside_gate +
-   declined_cost_debt`, which DESIGN §5 names by shape: green over a projection that drops one
-   identity and writes another twice, since every count still agrees. It is now the terminal
-   ledger's own reconciliation, through the same function (`reconcile_identity_population`),
-   refusing as `FloorDispositionJoinInexact` with the offending identities named. Its calibration
-   pair is enrolled beside the terminal-ledger one.
-3. **The counters are derived from the rows** instead of accumulated beside them, and duplicate
-   detection moved from the *planned* subset to the *whole declared* population — a duplicate
-   whose first site declined used to pass unnoticed.
-4. **The artifact carries two axes, never folded.** The disposition TSV gains an `outcome`
-   column, joined from the terminal ledger through `claim_disposition`; an identity that never
-   ran reads `not_executed` — a statement, not a blank.
-
-### Two axes deliberately NOT built, and what each needs first
-
-Both were in the commissioning brief and both would have meant *authoring* the authority they
-claim to join to (§3), so they are named as triggers rather than improvised:
-
-- **semantic producer / retire-with-producer.** No authority in the tree maps a witness identity
-  to the producer whose behavior it witnesses. Trigger: a modeled producer binding on the witness
-  carrier itself, at which point the join is a lookup rather than a classification.
-- **the Rust `#[ignore]` roster.** A different universe with no roster authority and no identity
-  grain shared with `.dag` witnesses. Trigger: an enumerated, typed roster of ignored Rust tests
-  with a stated reason per row — the same shape `floor_cost_debt` already has for its population.
-
-### One inert wall found on the way
-
-`gunbc.discovery_census` claims, twice and in prose, that its wildcard-free matches make a new
-`RequiredFloorDisposition` arm *fail to compile*. `DeclinedOutsideRequiredGate` had been added
-without either match acquiring an arm, and nothing refused — the module's own witness is outside
-the gate closure, so no executing path typechecks it. The arms are added here and the claim
-restated at its honest rung, with the trigger recorded in the module.
-
-### A false specification selected out of the nonexecuting population (2026-09-02, gunbc#10092)
-
-The changed-witness sublane selected
-`test.claim.discovery_census_witness.w_unrostered_sibling_in_the_same_module_is_planned`, an
-identity the ordinary required floor did not execute. The claim called
-`required_floor_site_disposition` with module path
-`dag.test.claim.lifecycle_survivor_corpus_census` and asserted `Planned`, although that path
-matches none of `required_gate_prefixes` and the function therefore answers
-`DeclinedOutsideRequiredGate`. The specification was false and stayed green because it did not
-run — this document's class at one identity, not a new failure class.
-
-Run `33656005986` is the discriminating receipt. Its identity-grain changed-witness ledger reports
-the claim as `planned-without-terminal-verdict`, `outcome=failed`; the aggregate reports
-`changed_witnesses=12 changed_witness_blocking=1
-changed_witness_declined_in_declared_nonexecuting_root=0`, so the row executed rather than being
-declined again. The same run measured the containing universe as 15,383 declared identities,
-3,499 routed and 11,277 declined outside the gate closure, and ended with exactly one semantic
-failure and zero interrupted verdicts. Those population figures are bound to that run and tree:
-declared, offered and routed populations move with the tree, so figures from another head are
-neither approximations of nor superseded by this receipt. The repair renames the claim to
-`w_unrostered_sibling_in_the_same_module_reaches_the_gate_decline` and asserts the disposition its
-own input entails; direct claim execution then passes. The reusable fact is not the spelling fix:
-selection of a normally nonexecuting identity is an executable falsifier for specifications that
-ordinary floor green cannot adjudicate.
diff --git a/docs/plans/workspace-control-plane.md b/docs/plans/workspace-control-plane.md
deleted file mode 100644
index a29b6f8cce1..00000000000
--- a/docs/plans/workspace-control-plane.md
+++ /dev/null
@@ -1,179 +0,0 @@
-# Workspace control plane: off-rack, serverless, queue-driven
-
-Design for the off-rack control plane of the recoverable workspace. Status: **design only. Nothing here is built, and no store is minted.**
-
-The plan rows it serves live in the private `strategy.year_end_plan`:
-
-- `control-plane-state-store` (its recovery half)
-- `volume-durability-contract` (the one global epoch authority)
-- `checkpointed-workspace`
-- `instance-host-evacuation`
-- `instance-reconciliation`
-- `instance-endpoint-continuity`
-
-The demo that exercises it is the private `docs/plans/2026-10-02-recoverable-workspace-demo.md`, stages 2–5. The state machine it realizes is the private `docs/plans/2026-09-25-fabric-architecture.md` §2 `resume(instance, target)`. The storage interface it stands on is [fabric-storage](fabric-storage.md), steps 4–5.
-
-Operator rulings taken as inputs, not reopened here:
-
-1. The off-rack control plane is serverless and low-QPS, with a queue.
-2. Rack loss is a placement failure: restart elsewhere from the last committed revision.
-3. Overflow is ordinary fabric placement by cost. Owned capacity has zero marginal cost and wins; OCI is the probable overflow target; work moves back when owned capacity returns.
-4. R2 and B2 are fabric options.
-5. CPU and memory are requested independently.
-6. The operator is in the US northeast.
-
-Claims are stated as **requirement and confidence**, never as dates. Every external figure carries its standing in the sense of DESIGN §4d (`extdeps.external_authority` `CitedFigureStanding`). A figure marked *transcribed* was copied from the vendor page named beside it, at authoring time, and owes a re-read before any decision is priced on it.
-
-## 1. The state the control plane carries, and its existing homes
-
-The control plane holds five kinds of fact. Every one already has a home in the corpus. The design adds **realizations and placements of those homes, not new vocabulary** (DESIGN §3b conformance: each row below conforms or names its divergence).
-
-| State | Meaning | Home authority | Conformance |
-| --- | --- | --- | --- |
-| **Intent** | The desired instance: class, CPU and memory requested independently, volume quota, endpoint name, placement constraints. | Requirements: `product.fabric.work` `ExecutionRequirements`. The desired record is a `std.fabric_storage` object under a per-instance head. | Conforms. Intent is an immutable object; "the current intent" is a head. No second desired-state table. |
-| **Writer epoch** | Which realization may advance the workspace head and serve the endpoint. A monotone integer per workspace. | `std.temporal_effect` `LeaseEpoch` (`generation` = epoch, `owner_fingerprint` = realization). **The epoch is not a separate record:** it is carried by the `WorkspaceFence` entries on the workspace head, in `std.checkpointed_workspace` (still-dove-673, branch `workspace-revision-model`). | Conforms. There is no second epoch store. Consumer: `std.checkpointed_workspace` `workspace_commit_classify` (§3). |
-| **Committed revision head** | The last committed checkpoint of the workspace, as a chain of `WorkspaceRevision` and `WorkspaceFence` entries. | `std.fabric_storage` `FabricHeadReading` / `FabricHeadAdvance`, as **one head per workspace**, `workspace.<id>.committed`. Its R2 realization is fabric-storage step 4B (ETag-conditioned put), stacked on gunbc#13080 `gunbc.cloudflare.r2_staged_transfer`. | Conforms. No per-epoch head namespace: a per-epoch namespace would make a stale commit unreadable but still *acknowledged* (§3). |
-| **Host lease** | Which host holds a realization, until when, and as observed. | `std.temporal_effect` `HeldLease` (`HeldLeaseObservedState`: `LeaseAbsent` / `LeaseRunningExpected` / `LeaseRunningStale` / `LeasePortForeign` / `LeaseInaccessible`). The cell hold is `gunbc.fabric_control_plane` `CellReservation` / `reserve_selected_cell` / `end_cell_hold` over `std.durable_exclusive_hold`. | Conforms. The reconciler's observation *is* `HeldLeaseObservedState`, so detection reuses its verdict fold (`held_lease_observed_verdict`, `plan_for_held_lease_observation`). |
-| **Endpoint binding** | Which realization the workspace's stable name routes to, and at which epoch. | No consumed home yet: the private rows `fabric-network-contract` and `instance-endpoint-continuity` own it. | **Modeling obligation (§6), not a conformance row.** This design only requires that the binding carry the epoch it was bound at (§3). Consumer: the overlay's route programming, named in `instance-endpoint-continuity`. |
-| **Credentials per epoch** | Scoped storage write credential and overlay identity for one realization. | `std.effect_grant` `Grant` / `Envelope` (verb `Write`, namespace position = the epoch's chunk prefix). The minting pattern follows `gunbc.auth.authorization_pattern_selection`. | Conforms. **This is a cost and blast-radius control, not the fence.** Chunk writes go under `workspace/<id>/e<N>/`, so a revoked epoch-N grant stops a stale writer from spending money. Correctness never depends on revocation. |
-| **Placement choice** | Where a realization goes and why. | `product.fabric.selection` `select_supply` → `std.decision` `SelectionReceipt`. | Conforms (§4). |
-
-No parallel store: intent, epochs, heads and leases are all **objects and heads in one `std.fabric_storage` realization**. The control-plane service that §5 chooses is that realization's *linearization point for heads*. It is not a second database beside it.
-
-## 2. The reconciler: level-triggered and idempotent
-
-The reconciler is one pure fold, `reconcile(desired, observed) -> List<Action>`. It is wrapped by one effectful step that reads, decides, applies **at most one CAS-guarded transition**, and returns.
-
-- **Level-triggered.** Its input is the whole current desired state and the whole current observation for one instance (heads plus `HeldLeaseObservedState` plus endpoint binding). It is never the event that woke it. A queue message carries only an instance id ("look at X"), so losing, duplicating or reordering messages costs latency and never correctness. A periodic sweep enqueues every instance, which bounds detection by the sweep period even if every edge-triggered message is lost.
-- **Idempotent.** Each action is guarded by the expectation it was computed against:
-  - an epoch bump is a CAS from `generation = N` to `N+1`;
-  - a placement is a `CellReservation` keyed by `(instance, epoch)`, via `fabric_cell_allocation_key`;
-  - an endpoint rebind names its target epoch.
-
-  A retried or duplicated run observes the transition already made and computes `Noop`. This is `ensure` (DESIGN §3d): Noop, Apply or Refuse over a caller-supplied requirement, with independent readback. Selection happens before it, never inside it.
-- **One transition per run.** `resume` from fabric-architecture §2 is driven as a sequence of states, not one long transaction:
-
-  `Placed(e) → Fencing(e→e+1) → Fenced(e+1) → Restoring(e+1, target) → Realized(e+1) → Bound(e+1)`
-
-  The current state is a function of the heads, never a flag. Each step is one queue delivery. A worker that dies mid-step leaves the heads unchanged or advanced, and the next delivery continues from what it reads. The receipt chain is `std.temporal_effect` `EffectStepReceipt` / `plan_next_step_from_prior_receipt_and_lease`. Stall detection is `EffectStallBudget`, which escalates as a typed outcome rather than retrying forever (DESIGN §5: refuse, never widen).
-- **Detection.** A host lease reads as `LeaseRunningStale` or `LeaseInaccessible` past the lease term. That reading plus the instance's intent "should be running" yields `Fence`. There is no failure detector beyond lease expiry. A partitioned host that still runs is handled by fencing (§3), not by trying to tell "dead" from "unreachable". That is why the demo's harder case, rack alive but unreachable, needs no special arm.
-
-## 3. Epoch fencing: a stale writer can neither commit nor receive traffic
-
-**Requirement:** after the epoch authority records epoch N+1 for a volume, no action by a holder of epoch N reaches durable state or a client. **Confidence:** high for commit; medium for traffic, until the endpoint binding has a home.
-
-**The fence is the same compare-and-set as the commit.** There is no separate epoch record read before the head advance. With "read record == N, then advance `e<N>/head`", a writer fenced *between* the two steps commits after the bump. If restore had already read that head, the stale commit returns success to the guest, an acknowledged barrier, and is then silently lost. A per-epoch namespace makes such a commit unreadable, not unacknowledged, and that breaks the contract's strongest promise.
-
-The model, `std.checkpointed_workspace` (still-dove-673):
-
-1. **One head per workspace:** `workspace.<id>.committed`.
-2. **A fence is a head entry.** An epoch transition is the reconciler advancing that head to a `WorkspaceFence { epoch: N+1, parent: <last revision> }`. It does so through the same `FabricHeadAdvance` every writer uses, **before** any restore starts.
-3. **Every commit expects the entry it built on.** A writer at epoch N advances with `ExpectHeadAt { object: <entry it built on> }`. If a fence landed in between, the advance is `FabricHeadMoved`. `workspace_commit_classify` classifies that as `WorkspaceCommitStaleEpoch` (observed entry epoch > writer epoch), and the guest never sees success. The fence and the commit linearize on one compare-and-set, so the gap no longer exists.
-4. **Attach** reads the head and refuses unless the newest fence names this realization's epoch.
-5. **Restore** walks the chain from the head past any fences to the last `WorkspaceRevision`, then advances from there under the new epoch.
-6. **Coverage invariant.** The contract (private `volume-durability-contract`) sells one arm, the asynchronous checkpointed workspace: guest `fsync` is acknowledged locally, and durability is the manifest commit. `oldest_uncommitted_write_age` stays under the published window. A commit refused for unreachable storage is not retried silently: once the oldest uncommitted write would exceed the window, the instance enters the **declared storage outage** and refuses writes. An idle workspace is never refused. A commit refused as `WorkspaceCommitStaleEpoch` makes the realization quarantine itself.
-
-Two defense-in-depth lines stand beside the fence; neither is the fence:
-
-- **Per-epoch credentials** (state table): revocation is best-effort at a provider and bounds cost and blast radius only.
-- **Traffic follows the binding.** The endpoint binding names `(instance, epoch)`, and the overlay routes only to the realization carrying the bound epoch. Its per-epoch overlay credential is revoked at the fence. A returning rack (demo stage 5) finds its binding gone, its grants dead, and its next commit `WorkspaceCommitStaleEpoch`; it quarantines, and the instance is destroyed.
-
-**Can R2 conditional puts alone be the epoch authority? Yes.** The epoch authority *is* the workspace head, so R2 `If-Match` on that one object is the only linearization needed: commits and fences both use it, and creation is `If-None-Match: *`. Multi-provider placement does not break this, provided **B2, or any second backend, holds chunks only**, which are immutable and replicate freely. **The head stays in one place.** The fabric-architecture §2 hazard, a partitioned writer advancing a second provider's own head, arises only if a second provider holds a live head, so that is refused by design rather than fenced.
-
-The residual requirement is to verify R2's conditional put as a strong read-after-write CAS against the cited doc (https://developers.cloudflare.com/r2/api/s3/extensions/ and the conditional-operations reference). Confidence is medium until verified.
-
-A Durable Object is not needed for fencing. It stays as the fallback **only** if that verification fails, or if one transition must change the head and the endpoint binding atomically.
-
-## 4. Cost-based placement and move-back
-
-Placement is `product.fabric.selection` `select_supply` over a candidate field built from:
-
-- owned cells (`gunbc.fabric_control_plane` `fabric_cell_roster_candidates`) at zero marginal cost;
-- overflow offers (OCI Ampere drafted; AWS Graviton the alternative), as priced `CandidateOffer`s.
-
-`ExecutionRequirements` carries CPU and memory as **independent** requirements. A target is admissible when both fit, never by a bundled shape. The result is a `SelectionReceipt`. A different field (rack lost, rack back) is a different decision, so staleness is mechanical (DESIGN §3d).
-
-- **Rack loss** removes every owned candidate from the field, and selection lands on overflow. Same `resume`, a different target adapter.
-- **Move-back** is not a special path. The sweep re-runs selection for every running instance. When the receipt's selected candidate differs from the current placement and the cost delta exceeds the move cost (the restore transfer plus the endpoint downtime, as a `delay_valuation`), the reconciler plans a planned `resume` to the cheaper target.
-- **Thrash guard:** a move is planned only when the delta covers the move cost over a declared hold horizon (`GrantDuration`). This is a selection policy input, not a timer in the reconciler.
-- **Overflow quota** is a candidate's availability observation (`AvailabilityObservation`). An unverified quota is `SelectionNeedsEvidence`, never an assumed admit. This follows the demo's "overflow quota" risk.
-
-## 5. Realization choice
-
-The load is tiny: one record per instance, transitions on failure or move, and a sweep. The figures below decide which choices are admissible, not which is cheapest; at this QPS every option costs a few dollars a month.
-
-### (a) Cloudflare Workers + Durable Objects + Queues, beside R2
-
-- **Consistency:**
-  - A Durable Object is a single-threaded actor with transactional, strongly consistent storage. One DO per instance (or per volume) makes every epoch transition serial by construction, and the CAS is a plain read-compare-write inside the object.
-  - Location hints (`enam`, eastern North America) place it near the operator.
-  - Docs: https://developers.cloudflare.com/durable-objects/ ; https://developers.cloudflare.com/durable-objects/reference/data-location/
-- **Queues:**
-  - Delivery is at-least-once, which is what a level-triggered reconciler wants.
-  - Consumers are Workers, and there are dead-letter queues.
-  - Docs: https://developers.cloudflare.com/queues/reference/delivery-guarantees/
-- **R2 is the same vendor and the same account.** The credential scope and the step 4B realization are already modeled in `extdeps.cloudflare.r2` / gunbc#13080. There is no egress charge from R2 (https://developers.cloudflare.com/r2/pricing/).
-- **Price** (*transcribed*; owes a re-read of https://developers.cloudflare.com/workers/platform/pricing/, https://developers.cloudflare.com/durable-objects/platform/pricing/, https://developers.cloudflare.com/queues/platform/pricing/):
-  - Workers Paid is $5/month, which includes Workers, DO and Queues allowances: about 10M Worker requests, 1M DO requests and 1M Queue operations per month.
-  - This load sits inside the included tier.
-- **Weakness:**
-  - A DO's storage lives in one location. A Cloudflare-wide or DO-wide outage takes the control plane down; see §6 for what survives.
-  - Single vendor for objects and control. That couples their failures, but either one down already stops commits, because the head lives in R2.
-
-### (b) AWS Lambda + DynamoDB conditional writes + SQS
-
-- **Consistency:**
-  - DynamoDB `PutItem`/`UpdateItem` with a `ConditionExpression` is a linearizable per-item CAS: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Expressions.ConditionExpressions.html
-  - Strongly consistent reads within a region. Global tables are multi-region but **last-writer-wins**, so they are *not* a CAS across regions: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/V2globaltables_HowItWorks.html
-  - The fence therefore lives in one region (us-east-1 or us-east-2, for the operator).
-- **SQS** standard queues are at-least-once; there is a Lambda event source and DLQs. Docs: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/standard-queues.html
-- **Price** (*transcribed*; owes a re-read of https://aws.amazon.com/dynamodb/pricing/on-demand/, https://aws.amazon.com/lambda/pricing/, https://aws.amazon.com/sqs/pricing/):
-  - On-demand writes are on the order of a dollar per million (reduced in late 2024; re-read).
-  - Lambda's free tier is 1M requests per month, and SQS's is 1M requests per month.
-  - This load is near zero.
-- **Weakness:**
-  - A second vendor, a second credential pattern (`gunbc.auth` would need an AWS WIF row) and a second extdeps surface to model, for no consistency gain over a DO.
-  - Egress from R2 is free, but every control-plane call crosses vendors.
-  - Its real advantage, independence from Cloudflare, is worth only what §6 says survives anyway.
-
-### Recommendation
-
-**Confidence:** medium.
-
-- **Phase 1 (minimal):** one head per workspace as an R2 object under step-4B conditional puts, carrying commits and fences alike (§3). One Cloudflare Worker is the reconciler, Cloudflare Queues carries "look at X", and a Cron Trigger runs the sweep. No DO and no new store.
-- **Phase 2, only if needed:** a Durable Object per workspace holding the head. It is needed if R2's conditional-put semantics fail verification as a strong CAS, or if transitions need multi-key atomicity (epoch + binding in one step).
-
-Prefer (a) over (b): it puts the control plane on the same vendor whose object store is already the commit dependency. Its correlated failure adds no new outage mode beyond "R2 down", which already stops commits.
-
-## 6. When the control plane itself is down
-
-**Requirement:** a control-plane outage degrades to "no *changes* of placement", never to data loss, split brain or a silent wrong answer.
-
-| Still works | Stops |
-| --- | --- |
-| Running instances keep running and serving at their bound endpoint (bindings are programmed into the overlay, not looked up per packet). | Detection and recovery: a host that dies during the outage is not re-placed until the control plane returns. Stated in the guarantee set as a compound outage, never hidden. |
-| Manifest commits continue **iff** R2 is up: the commit *is* the head compare-and-set and needs no reconciler. | With R2 unreachable, manifest commits refuse. `oldest_uncommitted_write_age` then grows, and at the window the instance enters the declared storage outage. Commits never proceed unchecked. |
-| — | A host lost during that outage loses its pending writes. That is receipted as the contract's typed **compound failure** (sole volatile copy lost while coverage could not be kept), never as an ordinary recovery. |
-| Restore by hand is possible from the last committed head, because heads and objects are plain storage. | Move-back and overflow placement. Cost drift accumulates; correctness does not. |
-| Nothing can split brain: no actor except the reconciler bumps epochs, and it is down. | New instance creation. |
-
-The rule is the fabric-storage rule applied one layer up: **an unreachable linearization point refuses, it does not fail over.** There is no "proceed without the fence" arm (DESIGN §5, no escape hatches).
-
-## 7. Consumers and frontier
-
-Every model named here is consumed by a named row; none lands before its consumer:
-
-- **Fence-as-head-entry and stale-commit classification:** `std.checkpointed_workspace` `workspace_commit_classify` (still-dove-673). Rows: `checkpointed-workspace`, `instance-reconciliation`, `volume-durability-contract` (demo stages 1 and 5).
-- **Per-epoch chunk credential prefix:** the storage grant minting under `instance-reconciliation`.
-- **Reconciler fold over `HeldLeaseObservedState`** → `instance-host-evacuation` (demo stage 2).
-- **Epoch-carrying endpoint binding** → `instance-endpoint-continuity` (demo stages 2, 5).
-- **Overflow candidates in `select_supply`** → `alternate-target-adapter` (demo stage 4).
-
-## 8. Open decisions (operator)
-
-1. **Realization:** (a) Cloudflare Workers + Queues (+ DO later), recommended; or (b) AWS Lambda + DynamoDB + SQS.
-2. **Epoch authority.** The recommendation is the workspace head itself, on R2 `If-Match`. This is minimal, but R2's availability bounds every commit. The alternative is a Durable Object holding the head. Gated on verifying R2's conditional put as a strong CAS.
-3. **Where the epoch is checked:** settled by the model, not open. Fences and commits are the one head CAS; attach reads the head. Nothing is checked on guest `fsync`. (Kept as a numbered item so the list keeps its numbering.)
-4. **Sweep period and lease term.** Together they bound detection time, and the demo receipts it. Drafted as same order as the published 60 s window, pending stage 0.
-5. **Move-back hold horizon:** how long a cheaper owned slot must be expected to persist before a planned move is worth its downtime.
-6. **Second storage provider (B2) timing.** B2 can join as a chunk replica at any time. It never holds a live head, so promotion means moving the one head, which is a planned operator action and not a failover.
diff --git a/docs/probes/mtcollins1_bmc_observation_capability_2026-09-12.md b/docs/probes/mtcollins1_bmc_observation_capability_2026-09-12.md
deleted file mode 100644
index 7d01cc7f5a4..00000000000
--- a/docs/probes/mtcollins1_bmc_observation_capability_2026-09-12.md
+++ /dev/null
@@ -1,113 +0,0 @@
-# Mt. Collins BMC — what this controller can and cannot do, read from its own UI source
-
-Answers two questions that were being guessed at: whether UEFI settings are reachable, and
-whether any mechanical console capture exists. All from the controller's own `source.min.js`,
-not from probing endpoint names.
-
-A THIRD QUESTION WAS ASKED HERE AND SHOULD NOT HAVE BEEN: "why is SOL silent". It presupposed its
-own answer. SOL was never silent — a broken collector was — so the section that answered it is
-withdrawn below rather than revised, and nothing in this document may be read as establishing a
-cause for an absence that did not exist.
-
-## Provenance
-
-`https://192.168.1.228/source.min.js`, fetched 2026-09-12, 6,597,873 bytes,
-sha256 `8b5ef64f5bf1df88a0f497887540d198a677e7a6f63f1bc8fc9bbc79e4f54fcd`.
-255 distinct `api/` paths extracted to `artifacts/bmc/mtcollins1-megarac-api-surface.txt`,
-sha256 `4fc53fea3fe49bc3ed3b967511654223578d59d963546117ab524df11b419bcd`.
-
-This is the file whose ABSENCE forced a retraction on 2026-09-11: a `redirection_status` decoder
-was read from it and then withdrawn from the receipt because the bytes were never committed. The
-bytes are now committed, so any future reading of this controller's behaviour has a resolvable
-source.
-
-## SOL IS NOT SILENT — the collector was, and this section's original claim is withdrawn
-
-**SUPERSEDED BY MEASUREMENT.** This section was headed "Why SOL is silent — not a BMC defect" and
-stated flatly that "the cause is host-side console routing". Both the premise and the cause are
-withdrawn. SOL on this controller delivers host console bytes: a repaired collector captured 3764
-bytes of firmware output across a failing DRAM training boot, including a 16-row per-DIMM table and
-typed failure lines. Review 64316 found that this section contradicted the ledger row added in the
-same change, and it was right — the corpus cannot answer "what causes SOL silence" two ways.
-
-**THE MEASURED CAUSE, which is not this one.** The collector ran `ipmitool sol activate` with stdin
-not a terminal, which warns, then its receive loop reached stdin EOF and it exited `rc=0` after
-roughly three seconds of a four-hundred-and-twenty second window, while the wrapper slept out the
-remainder and reported the unchanged file. Eight captures across eight hardware configurations were
-86 bytes of the instrument's own warning and banner, seven of them byte-identical. Held under a pty
-with stdin open, the same client stayed connected 645 seconds and captured host output on the first
-attempt. Authority: `gunbc.recurring_failure_mode` `empty_capture_read_as_clean_result`, seventh
-instance.
-
-**WHAT SURVIVES, AT ITS ACTUAL STRENGTH.** The BMC-side readings stand and were never in dispute:
-`sol info` reports `Enabled: true`, 115.2 kbps volatile and non-volatile, channel 1, port 623, and
-sessions establish and accept keystrokes. The boot-parameter readback also stands as a READING —
-every actuation carried `Console Redirection control : Console redirection occurs per BIOS
-configuration setting`, i.e. request byte `00`, defer to BIOS.
-
-What does NOT follow from that reading is that it explains anything, because there was no silence
-to explain. "The BIOS evidently routes console to video" was an inference consumed as a cause
-(DESIGN section 4d), built to account for an absence that the instrument manufactured. It is
-withdrawn, not merely softened: byte `00` is consistent with a console that prints over SOL
-perfectly well, which is what was subsequently observed while that byte's successor was in effect.
-
-IPMI boot parameter 5 data byte 3, bits 1:0 control this: `00` defer, `01` suppress, `10`
-request enabled. Set to `0x02` and verified: the readback now renders
-`Request console redirection be enabled`. Whether the firmware HONOURS the request is untested
-and is a separate fact from the BMC being able to ask.
-
-## UEFI / BIOS settings — NOT REACHABLE
-
-Across all 255 endpoints the only BIOS-adjacent ones are
-`maintenance/firmware/upgrade`, `maintenance/hpm/getbiosversions`,
-`maintenance/ValidBootfwSignImage` — flashing and version reads. There is no settings surface.
-`/redfish/v1/` returns 404; this controller serves no Redfish at all.
-
-CONSEQUENCE FOR CONVERGENCE: UEFI configuration on this platform is reachable ONLY through an
-interactive console. Any workflow step requiring a firmware setting is a human-attended barrier
-on Mt. Collins, not an automatable action, and should be modelled as one rather than assumed.
-
-## The mechanical console capture that existed all along
-
-```
-settings/video/triggers        settings/video/sol-triggers
-settings/video/pre-event       settings/sol-recorded-video
-logs/video   logs/video-data   logs/video-log   logs/video-log/delete
-sol/session  settings/javasol  remote_control/get/kvm/launch
-```
-
-Every trigger was `0` on arrival — the feature shipped disabled and had never been used. The
-controller can record the host console ITSELF on events, which survives the resets that kill a
-live `ipmitool sol activate` session. That is the difference between an instrument that needs a
-babysitter and one that does not.
-
-ARMED 2026-09-12, verified by readback on both objects:
-- video and SOL recording: chassis power-on, chassis reset, critical, non-recoverable, watchdog
-- `video/pre-event`: enable 1, fps 1, duration 10
-
-TWO RECORDERS, DIFFERENT SUBJECTS, and the distinction is load-bearing:
-- `video/*` records the FRAMEBUFFER — the content the KVM renders, which works today
-- `sol-triggers` records the SOL STREAM — empty until console redirection actually takes effect
-
-So video capture is useful immediately; SOL capture becomes useful only if the firmware honours
-the redirection request.
-
-## The observability lesson this session paid for
-
-SOL returned an identical 86-byte banner across eight configurations, four power states and
-every reset, while the KVM rendered real output throughout. Inferences were drawn from that
-silence — including that failures occurred before console initialisation. THE INSTRUMENT WAS
-POINTED ELSEWHERE. A capability model that records `sol_stream: present` without recording
-`delivering: no` will mislead the next platform the same way.
-
-## What a 20-unit intake needs before it starts
-
-1. Console capture that does not depend on a live session — now armed here, and it should be
-   part of unit bring-up rather than discovered per unit.
-2. A diagnostic image whose output does NOT depend on the console. Tonight's census image
-   reports over serial only; it produced nothing retrievable because it died at initrd load and
-   because serial carries nothing. The NFS share it boots from is writable and was empty.
-3. Console redirection requested explicitly at every actuation, not deferred to BIOS.
-4. Per-unit capability observation, because none of this is uniform: this controller serves no
-   Redfish, exposes no BIOS settings, no per-DIMM telemetry, and cannot decode its own OEM SEL
-   records.
diff --git a/docs/probes/mtcollins1_memory_census_and_boot_delivery_2026-09-11.md b/docs/probes/mtcollins1_memory_census_and_boot_delivery_2026-09-11.md
index 63a96beb633..65ec67d6616 100644
--- a/docs/probes/mtcollins1_memory_census_and_boot_delivery_2026-09-11.md
+++ b/docs/probes/mtcollins1_memory_census_and_boot_delivery_2026-09-11.md
@@ -350,13 +350,8 @@ brief said "PXE netboot" and I took it literally.
 
 ## 8. Controller-side observations
 
-**The decoded status enum and the readiness rule that were here have been removed.** They
-reconstructed the complete MegaRAC state machine from `source.min.js` as served by this
-controller — and that file **is not a committed artifact**. This document opens by claiming
-every number is artifact-backed or re-derived, so a table whose source was never preserved
-was the one thing in here that could not honour that claim. It was also reusable protocol
-policy, which belongs to `extdeps.bmc.megarac` keyed to a firmware identity, not to a probe
-record.
+**No decoded status enum or readiness rule is carried here.** Protocol policy belongs to
+`extdeps.bmc.megarac` keyed to a firmware identity, not to a probe record.
 
 What survives is what was measured against the live controller and is backed by this
 session's own observations:
@@ -384,8 +379,8 @@ difference I could find. I could not explain the variation and did not invent a
 **The readback comparator is the entire verdict**; the HTTP status is diagnostic only.
 
 Also observed: `start-media` requests without the undocumented key `image_redirection: 1`
-were refused with errors 13410/13460; the requests carrying it were accepted. How far that
-generalizes is the status/API catalog's to say, not this record's.
+were refused; the requests carrying it were accepted. How far that generalizes is not this
+record's to say.
 
 ### BMC controller reset timings (3 resets, consistent)
 
diff --git a/fixtures/algebra_length_homonym/probe.dag b/fixtures/algebra_length_homonym/probe.dag
new file mode 100644
index 00000000000..76c634ea902
--- /dev/null
+++ b/fixtures/algebra_length_homonym/probe.dag
@@ -0,0 +1,13 @@
+module algebra_length_homonym_probe
+
+import std.types { String, Int }
+
+// A user `length` whose leaf is the algebra op's leaf and whose owner is not v2.std.algebra.
+// Lives under fixtures/ so the accepted corpus (dag + src/v2) never grows a second `fn length`
+// (floor: every bare `length` would then be an unimported two-declarer). Compiled only by
+// test.claim.infer_algebra_length_homonym_witness.
+fn length(xs: String) -> Int { 99 }
+
+fn probe() -> Int {
+  length(xs: "abc")
+}
diff --git a/fixtures/native_cli_door/door_probe.dag b/fixtures/native_cli_door/dag/door_probe.dag
similarity index 94%
rename from fixtures/native_cli_door/door_probe.dag
rename to fixtures/native_cli_door/dag/door_probe.dag
index c441246f4f7..7c20b4831c5 100644
--- a/fixtures/native_cli_door/door_probe.dag
+++ b/fixtures/native_cli_door/dag/door_probe.dag
@@ -7,7 +7,7 @@ module fixture.native_cli_door.door_probe
 // walked through, which DESIGN section 5 names as specification-without-execution: a green that
 // establishes the closure typechecks and nothing about whether the program runs. This file is the
 // argv the built binary is handed so that it does run: `emit --entry
-// fixture.native_cli_door.door_probe --source-root fixtures/native_cli_door`.
+// fixture.native_cli_door.door_probe --source-root fixtures/native_cli_door/dag`.
 //
 // IT HAS NO IMPORTS, for the same reason `fixture.closure.rustc_green_probe` has none: the
 // admission's subject resolves against the validated roots the ingest produced, so a module whose
@@ -17,7 +17,8 @@ module fixture.native_cli_door.door_probe
 //
 // IT IS ITS OWN DIRECTORY AND NOT A FILE IN AN EXISTING FIXTURE ROOT, because the CLI's source
 // root is walked RECURSIVELY for every `.dag` file under it; sharing a directory would make the
-// control's ingest a function of what some other fixture's author adds next to it.
+// control's ingest a function of what some other fixture's author adds next to it. The walk
+// argument is the dag tree (`.../dag`), not a parent of mixed trees.
 //
 // THE DECLARATION'S NAME AND VALUE ARE WHAT THE CONTROL READS. v2 lowers this `data` declaration to
 // a named member whose body is the literal, and the door renders it through the Rust target's
diff --git a/fixtures/native_ingest_copied_single_root/dag/copied_dag.dag b/fixtures/native_ingest_copied_single_root/dag/copied_dag.dag
new file mode 100644
index 00000000000..8d779e29278
--- /dev/null
+++ b/fixtures/native_ingest_copied_single_root/dag/copied_dag.dag
@@ -0,0 +1,3 @@
+module fixture.native_ingest.copied_dag
+
+data native_ingest_copied_dag_value: Int = 1
diff --git a/fixtures/native_ingest_copied_single_root/src/v2/copied_v2.dag b/fixtures/native_ingest_copied_single_root/src/v2/copied_v2.dag
new file mode 100644
index 00000000000..4d259ce7c09
--- /dev/null
+++ b/fixtures/native_ingest_copied_single_root/src/v2/copied_v2.dag
@@ -0,0 +1,3 @@
+module fixture.native_ingest.copied_v2
+
+data native_ingest_copied_v2_value: Int = 2
diff --git a/fixtures/native_ingest_duplicate_module/dag/collision_a.dag b/fixtures/native_ingest_duplicate_module/dag/collision_a.dag
new file mode 100644
index 00000000000..1538ef552a1
--- /dev/null
+++ b/fixtures/native_ingest_duplicate_module/dag/collision_a.dag
@@ -0,0 +1,3 @@
+module fixture.native_ingest.collision
+
+data native_ingest_collision_a_value: Int = 1
diff --git a/fixtures/native_ingest_duplicate_module/dag/collision_b.dag b/fixtures/native_ingest_duplicate_module/dag/collision_b.dag
new file mode 100644
index 00000000000..6e4a6710d0f
--- /dev/null
+++ b/fixtures/native_ingest_duplicate_module/dag/collision_b.dag
@@ -0,0 +1,3 @@
+module fixture.native_ingest.collision
+
+data native_ingest_collision_b_value: Int = 2
diff --git a/fixtures/native_ingest_src_in_dag/dag/pkg/src/leaf.dag b/fixtures/native_ingest_src_in_dag/dag/pkg/src/leaf.dag
new file mode 100644
index 00000000000..9761f2f9c71
--- /dev/null
+++ b/fixtures/native_ingest_src_in_dag/dag/pkg/src/leaf.dag
@@ -0,0 +1,3 @@
+module fixture.native_ingest.src_in_dag
+
+data native_ingest_src_in_dag_value: Int = 1
diff --git a/fixtures/native_ingest_two_roots/dag/dag_entry.dag b/fixtures/native_ingest_two_roots/dag/dag_entry.dag
new file mode 100644
index 00000000000..1e2fd471527
--- /dev/null
+++ b/fixtures/native_ingest_two_roots/dag/dag_entry.dag
@@ -0,0 +1,3 @@
+module fixture.native_ingest.dag_entry
+
+data native_ingest_dag_entry_value: Int = 1
diff --git a/fixtures/native_ingest_two_roots/src/v2/v2_other.dag b/fixtures/native_ingest_two_roots/src/v2/v2_other.dag
new file mode 100644
index 00000000000..69338a89ba1
--- /dev/null
+++ b/fixtures/native_ingest_two_roots/src/v2/v2_other.dag
@@ -0,0 +1,3 @@
+module fixture.native_ingest.v2_other
+
+data native_ingest_v2_other_value: Int = 2
diff --git a/provisioning/srv1/gunbc-ghrunner.sudoers b/provisioning/srv1/gunbc-ghrunner.sudoers
index b816df1ea36..16db6e36df0 100644
--- a/provisioning/srv1/gunbc-ghrunner.sudoers
+++ b/provisioning/srv1/gunbc-ghrunner.sudoers
@@ -72,6 +72,8 @@ ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv1-07
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv1-08
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv1-09
+ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv1-10
+ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv1-11
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv1-01.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv1-01.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv1-02.service
@@ -90,6 +92,10 @@ ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv1-08.s
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv1-08.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv1-09.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv1-09.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv1-10.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv1-10.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv1-11.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv1-11.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o root -g root /opt/fabric-cells
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o root -g root /opt/fabric-cells/srv1-13
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/fabric-cells/srv1-13/attempts
@@ -118,3 +124,33 @@ ghrunner ALL=(root) NOPASSWD: /usr/sbin/nft list ruleset
 ghrunner ALL=(root) NOPASSWD: /usr/sbin/iptables-legacy-save
 ghrunner ALL=(root) NOPASSWD: /usr/sbin/nfct helper list
 ghrunner ALL=(root) NOPASSWD: /usr/sbin/conntrack -L expect
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/dispatch-worktrees
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/attempt-state
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /home/briansrls/.codex@gunbc-roadmap
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/auth-sessions
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/auth-login-transactions
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/auth-jwks
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/auth-profiles
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/issue-view-preferences
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/roadmap-events
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/compute
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/fabric-storage
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/fabric-storage/objects
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/fabric-storage/heads
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/fabric-storage/state
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/fabric-storage/state/objects
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/fabric-storage/state/heads
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/fabric-storage-door
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /var/lib/gunbc/artifacts.git
+ghrunner ALL=(root) NOPASSWD: /usr/bin/stat -c %F|%U|%G|%a -- /opt/gunbc/provider-runtime/codex
+ghrunner ALL=(root) NOPASSWD: /usr/bin/ls -1A -- /opt/gunbc
+ghrunner ALL=(root) NOPASSWD: /usr/bin/ls -1A -- /opt
+ghrunner ALL=(root) NOPASSWD: /usr/bin/ls -1A -- /
+ghrunner ALL=(root) NOPASSWD: /usr/bin/ls -1A -- /home/briansrls
+ghrunner ALL=(root) NOPASSWD: /usr/bin/ls -1A -- /home
+ghrunner ALL=(root) NOPASSWD: /usr/bin/ls -1A -- /opt/gunbc/fabric-storage
+ghrunner ALL=(root) NOPASSWD: /usr/bin/ls -1A -- /opt/gunbc/fabric-storage/state
+ghrunner ALL=(root) NOPASSWD: /usr/bin/ls -1A -- /var/lib/gunbc
+ghrunner ALL=(root) NOPASSWD: /usr/bin/ls -1A -- /var/lib
+ghrunner ALL=(root) NOPASSWD: /usr/bin/ls -1A -- /var
+ghrunner ALL=(root) NOPASSWD: /usr/bin/ls -1A -- /opt/gunbc/provider-runtime
diff --git a/provisioning/srv3/gunbc-ghrunner.sudoers b/provisioning/srv3/gunbc-ghrunner.sudoers
index 2c0d77642be..4d5f6178e2d 100644
--- a/provisioning/srv3/gunbc-ghrunner.sudoers
+++ b/provisioning/srv3/gunbc-ghrunner.sudoers
@@ -78,6 +78,10 @@ ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv3-15
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv3-16
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv3-17
+ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv3-18
+ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv3-19
+ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv3-20
+ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv3-21
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv3-01.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv3-01.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv3-02.service
@@ -108,21 +112,29 @@ ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv3-16.s
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv3-16.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv3-17.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv3-17.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv3-18.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv3-18.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv3-19.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv3-19.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv3-20.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv3-20.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv3-21.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv3-21.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o root -g root /opt/fabric-cells
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o root -g root /opt/fabric-cells/srv3-06
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/fabric-cells/srv3-06/attempts
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-06.slice MemoryMax\=27917287424
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-06.slice MemoryHigh\=26843545600
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-06.slice MemorySwapMax\=34359738368
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-06.slice MemoryMax\=23622320128
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-06.slice MemoryHigh\=22548578304
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-06.slice MemorySwapMax\=0
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-06.slice TasksMax\=16384
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-06.slice CPUWeight\=100
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-06.slice CPUQuota\=
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start fabric-cell-srv3-06.slice
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o root -g root /opt/fabric-cells/srv3-07
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/fabric-cells/srv3-07/attempts
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-07.slice MemoryMax\=27917287424
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-07.slice MemoryHigh\=26843545600
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-07.slice MemorySwapMax\=34359738368
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-07.slice MemoryMax\=23622320128
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-07.slice MemoryHigh\=22548578304
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-07.slice MemorySwapMax\=0
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-07.slice TasksMax\=16384
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-07.slice CPUWeight\=100
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv3-07.slice CPUQuota\=
diff --git a/provisioning/srv4/gunbc-ghrunner.sudoers b/provisioning/srv4/gunbc-ghrunner.sudoers
index e36ce15cdce..2a2924ffd82 100644
--- a/provisioning/srv4/gunbc-ghrunner.sudoers
+++ b/provisioning/srv4/gunbc-ghrunner.sudoers
@@ -78,6 +78,10 @@ ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv4-15
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv4-16
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv4-17
+ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv4-18
+ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv4-19
+ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv4-20
+ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/actions-runner/srv4-21
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv4-01.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv4-01.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv4-02.service
@@ -108,21 +112,29 @@ ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv4-16.s
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv4-16.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv4-17.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv4-17.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv4-18.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv4-18.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv4-19.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv4-19.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv4-20.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv4-20.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl enable actions-runner@srv4-21.service
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start actions-runner@srv4-21.service
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o root -g root /opt/fabric-cells
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o root -g root /opt/fabric-cells/srv4-06
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/fabric-cells/srv4-06/attempts
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-06.slice MemoryMax\=27917287424
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-06.slice MemoryHigh\=26843545600
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-06.slice MemorySwapMax\=34359738368
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-06.slice MemoryMax\=23622320128
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-06.slice MemoryHigh\=22548578304
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-06.slice MemorySwapMax\=0
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-06.slice TasksMax\=16384
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-06.slice CPUWeight\=100
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-06.slice CPUQuota\=
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl start fabric-cell-srv4-06.slice
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o root -g root /opt/fabric-cells/srv4-07
 ghrunner ALL=(root) NOPASSWD: /usr/bin/install -d -m 755 -o ghrunner -g ghrunner /opt/fabric-cells/srv4-07/attempts
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-07.slice MemoryMax\=27917287424
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-07.slice MemoryHigh\=26843545600
-ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-07.slice MemorySwapMax\=34359738368
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-07.slice MemoryMax\=23622320128
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-07.slice MemoryHigh\=22548578304
+ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-07.slice MemorySwapMax\=0
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-07.slice TasksMax\=16384
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-07.slice CPUWeight\=100
 ghrunner ALL=(root) NOPASSWD: /usr/bin/systemctl set-property fabric-cell-srv4-07.slice CPUQuota\=
diff --git a/src/v1/00_core.dag b/src/v1/00_core.dag
index c0c3bd7f0da..d610428f065 100644
--- a/src/v1/00_core.dag
+++ b/src/v1/00_core.dag
@@ -432,6 +432,7 @@ type CompilerDiagnostic
   | EffectfulSelfRecursionUnrealized { name: String, span: SourceSpan }
   | ModuleFilenameCollision { filename: String, modules: List<String>, span: SourceSpan }
   | EmittedSymbolCollision { symbol: String, identities: List<String>, span: SourceSpan }
+  | NativeEffectRealizationRefused { entry: String, refusals: List<String>, span: SourceSpan }
   | EffectSummaryIncompleteAtFunctionValue { caller: String, span: SourceSpan }
   | EffectSummaryIncompleteAtLocalBinding { caller: String, name: String, span: SourceSpan }
   | CallArgumentNameUnknown { callee: String, argument: String, declared: List<String>, span: SourceSpan }
@@ -666,6 +667,7 @@ fn diagnostic_to_span(d: CompilerDiagnostic) -> SourceSpan {
     EffectfulSelfRecursionUnrealized { name: _, span: s } => s
     ModuleFilenameCollision { filename: _, modules: _, span: s } => s
     EmittedSymbolCollision { symbol: _, identities: _, span: s } => s
+    NativeEffectRealizationRefused { entry: _, refusals: _, span: s } => s
     EffectSummaryIncompleteAtFunctionValue { caller: _, span: s } => s
     EffectSummaryIncompleteAtLocalBinding { caller: _, name: _, span: s } => s
     CallArgumentNameUnknown { callee: _, argument: _, declared: _, span: s } => s
@@ -776,6 +778,7 @@ fn diagnostic_to_message(d: CompilerDiagnostic) -> String {
     EffectfulSelfRecursionUnrealized { name: n, span: _ } => concat("effectful declaration '", n, "' calls itself outside tail position: the Rust realization lowers tail calls to a loop, but non-tail async recursion has no realization. Put the recursive call in tail position or move it into a pure helper.")
     ModuleFilenameCollision { filename: f, modules: ms, span: _ } => concat("module filename collision: ", to_string(value: ms |> count), " modules render one emitted file name '", f, "': ", join(ms, separator: ", "), " — module_to_filename maps '.' to '_', so these names are indistinguishable at the emitted path; rename one module segment")
     EmittedSymbolCollision { symbol: s, identities: ids, span: _ } => concat("emitted symbol collision: ", to_string(value: ids |> count), " authored identities render one emitted symbol '", s, "': ", join(ids, separator: ", "), " — two authored identities one emitted scope cannot hold apart (an undotted service with a type's name, a type spelled with `__`, dotted services differing only in first-letter case or in a segment's leading or trailing `_`); rename one")
+    NativeEffectRealizationRefused { entry: e, refusals: rs, span: _ } => concat("native effect realization refused for entry '", e, "': ", join(rs, separator: "; "), " (v1.compiler.emit NativeEffectRealizationAdmission: the rendered main binds only admitted handlers, so an unadmitted effect refuses here rather than failing to build or link)")
     EffectSummaryIncompleteAtFunctionValue { caller: c, span: _ } => concat("effect summary incomplete: ", c, " calls through a function value, whose callee is chosen at runtime, so its effects are unknown rather than empty — the caller's summary is a lower bound, not the answer")
     EffectSummaryIncompleteAtLocalBinding { caller: c, name: n, span: _ } => concat(concat(concat(concat("effect summary incomplete: ", c), " calls the local binding '"), n), "', whose effects this pass cannot join through the registry, so the caller's summary is a lower bound rather than the answer")
     CallArgumentNameUnknown { callee: c, argument: a, declared: ds, span: _ } =>
@@ -922,6 +925,7 @@ fn diagnostic_disposition(d: CompilerDiagnostic) -> DiagnosticDisposition {
     EffectfulSelfRecursionUnrealized { name: _, span: _ } => DiagnosticDisposition { severity: SeverityError, gate: GateBlocking }
     ModuleFilenameCollision { filename: _, modules: _, span: _ } => DiagnosticDisposition { severity: SeverityError, gate: GateBlocking }
     EmittedSymbolCollision { symbol: _, identities: _, span: _ } => DiagnosticDisposition { severity: SeverityError, gate: GateBlocking }
+    NativeEffectRealizationRefused { entry: _, refusals: _, span: _ } => DiagnosticDisposition { severity: SeverityError, gate: GateBlocking }
     EffectSummaryIncompleteAtFunctionValue { caller: _, span: _ } => DiagnosticDisposition { severity: SeverityNonError, gate: GateAdvisoryTypecheck }
     EffectSummaryIncompleteAtLocalBinding { caller: _, name: _, span: _ } => DiagnosticDisposition { severity: SeverityNonError, gate: GateAdvisoryTypecheck }
     CallArgumentNameUnknown { callee: _, argument: _, declared: _, span: _ } => DiagnosticDisposition { severity: SeverityError, gate: GateBlocking }
diff --git a/src/v1/04_emit_info.dag b/src/v1/04_emit_info.dag
index bd401957bea..136db9577ce 100644
--- a/src/v1/04_emit_info.dag
+++ b/src/v1/04_emit_info.dag
@@ -21,7 +21,9 @@ import v1.std.core {
 }
 import std.decl_ref { DeclarationRef, WholeDeclaration, NamedField, TypeParameter }
 import std.types { is_kernel_type }
-import v1.compiler.infer_env { TypeEnv, SymbolIndex, empty_symbol_index, empty_type_env, symbol_index_lookup }
+import std.literal_elaboration { kernel_mint_declaration_for, KernelMintDeclarationFound, KernelMintDeclarationAbsent, KernelMintDeclarationAmbiguous }
+import gunbc.structural_realization_bindings { kernel_mint_declaration_rows }
+import v1.compiler.infer_env { TypeEnv, SymbolIndex, empty_symbol_index, empty_type_env, symbol_index_lookup, BareOccurrenceBinding, BareOccurrenceDeclaredInItsFile, BareOccurrenceImportedByName, BareOccurrenceIsKernelName, BareOccurrenceUndecided, bare_occurrence_binding }
 import v1.compiler.infer_types {
   TextJudgment, TextJudgedIn, TextNotAsked, TextNotAskedInVariantFieldSummary, TextNotAskedForCallableComponentResidue,
   normalize_access_type_node, resolved_type,
@@ -40,6 +42,7 @@ type TypeRepr = StructRepr | EnumRepr { unit_only: Bool }
 
 type TypeSummary {
   name: String
+  key: String
   repr: TypeRepr
   field_summaries: Map<String, FieldSummary>
   field_type_map: Map<String, String>
@@ -49,6 +52,122 @@ type TypeSummary {
   has_fn_fields: Bool
 }
 
+// THE TYPE SUMMARIES, KEYED BY DECLARATION. A summary is stored under its declaration's identity
+// (type_decl_identity: owner module and declared name, the key TypeDeclIndex uses), and a
+// variant-payload summary under `<identity>::<Variant>`. The leaf-keyed map this replaces kept ONE
+// summary per leaf -- whichever module was folded last -- so a second `Optional` anywhere in a
+// closure replaced std.optional's summary for every reader in every module
+// (gunbc.recurring_failure_mode emitter_index_keyed_on_a_type_leaf_takes_the_last_declarer).
+type TypeSummaryIndex {
+  by_key: Map<String, TypeSummary>
+  keys_by_leaf: Map<String, List<String>>
+}
+
+// A NAME HOLDER'S ANSWER HAS THREE ARMS, as TypeDeclResolution's does: a key (an identity, or an
+// identity-qualified variant key) is exact; a bare leaf one declaration owns resolves to it; a bare
+// leaf two declarations own is TypeSummaryLeafAmbiguous and names neither.
+type TypeSummaryLookup
+  = TypeSummaryFound { summary: TypeSummary }
+  | TypeSummaryLeafAmbiguous { leaf: String }
+  | TypeSummaryNotDeclared
+
+fn empty_type_summary_index() -> TypeSummaryIndex {
+  TypeSummaryIndex { by_key: empty_map(), keys_by_leaf: empty_map() }
+}
+
+fn type_summary_index_insert(index: TypeSummaryIndex, key: String, leaf: String, summary: TypeSummary) -> TypeSummaryIndex {
+  TypeSummaryIndex {
+    by_key: map_insert(index.by_key, key, summary),
+    keys_by_leaf: map_insert(index.keys_by_leaf, leaf, type_decl_leaf_identities_with(prior: map_get(index.keys_by_leaf, leaf), identity: key))
+  }
+}
+
+fn type_summary_keys_of_leaf(index: TypeSummaryIndex, leaf: String) -> List<String> {
+  match map_get(index.keys_by_leaf, leaf) {
+    Present { value: keys } => keys
+    Absent => []
+  }
+}
+
+fn type_summary_at_key(index: TypeSummaryIndex, key: String) -> TypeSummaryLookup {
+  match map_get(index.by_key, key) {
+    Present { value: summary } => TypeSummaryFound { summary: summary }
+    Absent => TypeSummaryNotDeclared
+  }
+}
+
+fn type_summary_by_leaf(index: TypeSummaryIndex, leaf: String) -> TypeSummaryLookup {
+  let keys = type_summary_keys_of_leaf(index: index, leaf: leaf)
+  if (keys |> count) == 1 {
+    keys |> fold(init: TypeSummaryNotDeclared, f: (_acc, key) => type_summary_at_key(index: index, key: key))
+  } else if (keys |> count) > 1 {
+    TypeSummaryLeafAmbiguous { leaf: leaf }
+  } else {
+    TypeSummaryNotDeclared
+  }
+}
+
+// A string key, as the readers that hold only a name hand it over: an exact key first (an identity,
+// or `<identity>::<Variant>`), then a leaf-qualified variant key (`Enum::Variant`, whose enum part
+// resolves by its leaf), then a bare leaf. A dotted name that is no key is not resolved by spelling.
+fn type_summary_lookup(index: TypeSummaryIndex, key: String) -> TypeSummaryLookup {
+  match map_get(index.by_key, key) {
+    Present { value: summary } => TypeSummaryFound { summary: summary }
+    Absent =>
+      if contains(key, "::") {
+        let parts = key |> split(delimiter: "::")
+        let enum_part = parts |> take((parts |> count) - 1) |> join(separator: "::")
+        let variant_part = match parts |> last {
+          Present { value: v } => v
+          Absent => ""
+        }
+        match type_summary_lookup(index: index, key: enum_part) {
+          TypeSummaryFound { summary: owner } => type_summary_at_key(index: index, key: variant_summary_key(enum_name: owner.key, variant_name: variant_part))
+          TypeSummaryLeafAmbiguous { leaf: l } => TypeSummaryLeafAmbiguous { leaf: l }
+          TypeSummaryNotDeclared => TypeSummaryNotDeclared
+        }
+      } else if contains(key, ".") {
+        TypeSummaryNotDeclared
+      } else {
+        type_summary_by_leaf(index: index, leaf: key)
+      }
+  }
+}
+
+// A reader holding a type REFERENCE resolves it the way every emitter reader of a declaration does
+// (resolve_type_decl_reference: carried identity, declaring span, the counted interim arms, then the
+// spelling), and reads the summary stored under that identity.
+fn type_summary_of_reference(index: TypeSummaryIndex, decls: TypeDeclIndex, type_expr: Node, source_indices: Map<String, NewlineIndex>) -> TypeSummaryLookup {
+  match resolve_type_decl_reference(index: decls, type_expr: type_expr, source_indices: source_indices) {
+    TypeDeclResolved { identity: identity, decl: _ } => type_summary_at_key(index: index, key: identity)
+    TypeDeclLeafAmbiguous { leaf: l } => TypeSummaryLeafAmbiguous { leaf: l }
+    TypeDeclKernelSpellingUndecided { leaf: l } => TypeSummaryLeafAmbiguous { leaf: l }
+    TypeDeclNotDeclared => TypeSummaryNotDeclared
+  }
+}
+
+// THE OPTIONAL PROJECTION, for readers that hold only a NAME and ask which summary it denotes in order
+// to collect use-surfaces or read a field map. It answers a summary only when the name decides one
+// (an exact key, or a leaf one declaration owns); a leaf two declarations own answers Absent and no
+// summary is picked for it -- the leaf-keyed map this replaces answered with the LAST declarer here.
+// The readers that consume it collect names for import lines or check a repr, so an undecided name
+// contributes nothing and the item it would have served refuses at rustc, located at its use.
+// RESIDUE, declared: these name-holding readers dissolve when the names they hold are keys -- a
+// TypeSummary's field_type_map and field_import_surface_names store the field type's declaration
+// identity rather than its spelling -- on gunbc.recurring_failure_mode
+// emitter_index_keyed_on_a_type_leaf_takes_the_last_declarer's trigger.
+fn type_summary_decided(index: TypeSummaryIndex, key: String) -> TypeSummary? {
+  match type_summary_lookup(index: index, key: key) {
+    TypeSummaryFound { summary: summary } => Present { value: summary }
+    TypeSummaryLeafAmbiguous { leaf: _ } => none
+    TypeSummaryNotDeclared => none
+  }
+}
+
+fn type_summary_values(index: TypeSummaryIndex) -> List<TypeSummary> {
+  map_values(index.by_key)
+}
+
 type FieldTypeMapBuild {
   field_types: Map<String, String>
   import_surface_names: List<String>
@@ -158,6 +277,15 @@ type TypeDeclIndex {
   qualified_names: SymbolIndex
 }
 
+// WHAT A BARE LEAF DENOTES AT ONE OCCURRENCE: v1.compiler.infer_env bare_occurrence_binding (own file,
+// then named import, then kernel -- the typechecker's lookup_binding order), joined here to the
+// declaration identity this index keys on.
+type TypeDeclOccurrenceBinding
+  = OccurrenceDeclaredHere { identity: String }
+  | OccurrenceImported { identity: String }
+  | OccurrenceIsKernelName
+  | OccurrenceUndecided
+
 // TypeDeclKernelSpellingUndecided IS ITS OWN ARM BECAUSE IT IS A DIFFERENT FACT FROM AMBIGUITY.
 // `String` and `Int` are kernel spellings (std.types is_kernel_type), and resolve leaves a
 // kernel-spelled reference unstamped on purpose (v1.compiler.infer_resolve
@@ -263,6 +391,8 @@ type TypeDeclReferenceRoute
   | RouteDeclaringSpan
   | RouteReferencingModuleDeclarer
   | RouteQualifiedSpelling
+  | RouteReferencingModuleImport
+  | RouteKernelMint
   | RouteLeafSpelling
 
 type TypeDeclRoutedResolution {
@@ -292,13 +422,15 @@ fn resolve_type_decl_routed(index: TypeDeclIndex, type_expr: Node, source_indice
           let leaf = qualified_last_segment(name: authored)
           let by_spelling = resolve_type_decl_leaf(index: index, leaf: leaf)
           let referencing_module_identity = match by_spelling {
-            TypeDeclLeafAmbiguous { leaf: l } => if authored == l { type_decl_referencing_module_declarer(index: index, leaf: l, reference: type_expr) } else { type_decl_qualifier_declarer(index: index, authored: authored) }
+            TypeDeclLeafAmbiguous { leaf: l } =>
+              if authored == l { type_decl_occurrence_identity(index: index, leaf: l, reference: type_expr) }
+              else { type_decl_qualifier_declarer(index: index, authored: authored) }
             TypeDeclResolved { identity: _, decl: _ } => none
             TypeDeclKernelSpellingUndecided { leaf: _ } => none
             TypeDeclNotDeclared => none
           }
           match referencing_module_identity {
-            Present { value: identity } => TypeDeclRoutedResolution { route: if authored == leaf { RouteReferencingModuleDeclarer } else { RouteQualifiedSpelling }, resolution: type_decl_resolution_at_identity(index: index, identity: identity) }
+            Present { value: identity } => TypeDeclRoutedResolution { route: type_decl_spelling_route(index: index, authored: authored, leaf: leaf, reference: type_expr), resolution: type_decl_resolution_at_identity(index: index, identity: identity) }
             Absent => TypeDeclRoutedResolution { route: RouteLeafSpelling, resolution: by_spelling }
           }
       }
@@ -341,22 +473,84 @@ fn type_decl_qualifier_declarer(index: TypeDeclIndex, authored: String) -> Strin
   }
 }
 
-fn type_decl_index_with_qualified_names(index: TypeDeclIndex, qualified_names: SymbolIndex) -> TypeDeclIndex {
-  TypeDeclIndex { by_identity: index.by_identity, identity_by_declaring_span: index.identity_by_declaring_span, leaf_owners: index.leaf_owners, identities_by_leaf: index.identities_by_leaf, qualified_names: qualified_names }
+// THE KERNEL MINT'S DECLARER. Which corpus declaration the kernel type IS is a modeled fact
+// (gunbc.structural_realization_bindings kernel_mint_declaration_rows, the row the pattern side reads
+// through kernel_mint_ownership), but that answers WHICH declaration a mint stands for, not WHETHER an
+// occurrence denotes it. So this arm is reached only from type_decl_occurrence_identity, and only when
+// the occurrence is on the kernel arm of the resolver's order (v1.compiler.infer_env bare_occurrence_binding). A spelling no row mints, or two rows
+// mint, stays LeafAmbiguous and refuses. Counted as kernel_mint; interim under
+// referencing_module_declarer_route_dissolves_on.
+fn type_decl_kernel_mint_declarer(index: TypeDeclIndex, leaf: String) -> String? {
+  match kernel_mint_declaration_for(rows: kernel_mint_declaration_rows, minted_name: leaf) {
+    KernelMintDeclarationFound { declaration: d } =>
+      let identity = type_decl_identity(owner_module: d.module_path as String, decl_name: d.decl_name as String)
+      match map_get(index.by_identity, identity) {
+        Present { value: _ } => Present { value: identity }
+        Absent => none
+      }
+    KernelMintDeclarationAbsent => none
+    KernelMintDeclarationAmbiguous { row_count: _ } => none
+  }
 }
 
-data referencing_module_declarer_route_dissolves_on: DissolutionCondition = unbound_dissolution(description: "RouteReferencingModuleDeclarer and RouteQualifiedSpelling dissolve when the type environment's declaration bodies carry Node.declaration on every member type reference, stamped by v1.compiler.infer_resolve reference_with_declaration in the DECLARING module's scope, so a bare reference resolved through lookup_type_for hands the emitter stamped members: v1.tests.claim.carrier_realization_census reports zero emitter_decl_route referencing_module_declarer or qualified_spelling rows over the self-host and dag closures. Stamping one declaration, or one closure, is not that capability. Then both arms, type_decl_referencing_module_declarer and type_decl_qualifier_declarer are deleted and such a reference refuses unless carried.")
-
-fn type_decl_referencing_module_declarer(index: TypeDeclIndex, leaf: String, reference: Node) -> String? {
-  let local = type_decl_identities_of_leaf(index: index, leaf: leaf) |> filter(identity =>
-    match map_get(index.by_identity, identity) {
-      Present { value: decl } => decl.span.file == reference.span.file
-      Absent => false
+fn type_decl_spelling_route(index: TypeDeclIndex, authored: String, leaf: String, reference: Node) -> TypeDeclReferenceRoute {
+  if authored != leaf { RouteQualifiedSpelling }
+  else {
+    match type_decl_occurrence_binding(index: index, leaf: leaf, reference: reference) {
+      OccurrenceDeclaredHere { identity: _ } => RouteReferencingModuleDeclarer
+      OccurrenceIsKernelName => RouteKernelMint
+      OccurrenceImported { identity: _ } => RouteReferencingModuleImport
+      OccurrenceUndecided => RouteLeafSpelling
     }
-  )
-  if (local |> fold(init: 0, f: (n, _identity) => n + 1)) == 1 { local |> fold(init: none, f: (acc, identity) => Present { value: identity }) } else { none }
+  }
+}
+
+// THE IDENTITY A BARE AMBIGUOUS LEAF DENOTES AT THIS OCCURRENCE, or none (it stays LeafAmbiguous and
+// refuses). The kernel mint is consulted only on the kernel arm of the resolver's order.
+fn type_decl_occurrence_identity(index: TypeDeclIndex, leaf: String, reference: Node) -> String? {
+  match type_decl_occurrence_binding(index: index, leaf: leaf, reference: reference) {
+    OccurrenceDeclaredHere { identity: identity } => Present { value: identity }
+    OccurrenceIsKernelName => type_decl_kernel_mint_declarer(index: index, leaf: leaf)
+    OccurrenceImported { identity: identity } => Present { value: identity }
+    OccurrenceUndecided => none
+  }
+}
+
+fn type_decl_occurrence_binding(index: TypeDeclIndex, leaf: String, reference: Node) -> TypeDeclOccurrenceBinding {
+  match bare_occurrence_binding(index: index.qualified_names, name: leaf, reference: reference) {
+    BareOccurrenceDeclaredInItsFile { declaration: decl } =>
+      match type_decl_identity_of_declaration(index: index, decl: decl) {
+        Present { value: identity } => OccurrenceDeclaredHere { identity: identity }
+        Absent => OccurrenceUndecided
+      }
+    BareOccurrenceImportedByName { module_path: from_module, declaration: decl } =>
+      match type_decl_identity_of_declaration(index: index, decl: decl) {
+        Present { value: identity } => OccurrenceImported { identity: identity }
+        Absent =>
+          let imported = type_decl_identity(owner_module: from_module, decl_name: leaf)
+          match map_get(index.by_identity, imported) {
+            Present { value: _ } => OccurrenceImported { identity: imported }
+            Absent => OccurrenceUndecided
+          }
+      }
+    BareOccurrenceIsKernelName => OccurrenceIsKernelName
+    BareOccurrenceUndecided => OccurrenceUndecided
+  }
+}
+
+fn type_decl_identity_of_declaration(index: TypeDeclIndex, decl: Node) -> String? {
+  match decl.ident_span {
+    Present { value: sp } => map_get(index.identity_by_declaring_span, declaring_span_key(sp: sp))
+    Absent => none
+  }
+}
+
+fn type_decl_index_with_qualified_names(index: TypeDeclIndex, qualified_names: SymbolIndex) -> TypeDeclIndex {
+  TypeDeclIndex { by_identity: index.by_identity, identity_by_declaring_span: index.identity_by_declaring_span, leaf_owners: index.leaf_owners, identities_by_leaf: index.identities_by_leaf, qualified_names: qualified_names }
 }
 
+data referencing_module_declarer_route_dissolves_on: DissolutionCondition = unbound_dissolution(description: "RouteReferencingModuleDeclarer, RouteReferencingModuleImport, RouteQualifiedSpelling and RouteKernelMint dissolve when the type environment's declaration bodies carry Node.declaration on every member type reference, stamped by v1.compiler.infer_resolve reference_with_declaration in the DECLARING module's scope, so a bare reference resolved through lookup_type_for hands the emitter stamped members: v1.tests.claim.carrier_realization_census reports zero emitter_decl_route referencing_module_declarer, referencing_module_import, qualified_spelling or kernel_mint rows over the self-host and dag closures. Stamping one declaration, or one closure, is not that capability. Then type_decl_occurrence_binding and type_decl_qualifier_declarer are deleted and such a reference refuses unless carried.")
+
 fn resolve_type_decl_reference(index: TypeDeclIndex, type_expr: Node, source_indices: Map<String, NewlineIndex>) -> TypeDeclResolution {
   resolve_type_decl_routed(index: index, type_expr: type_expr, source_indices: source_indices).resolution
 }
@@ -368,6 +562,8 @@ fn type_decl_routed_resolution_label(routed: TypeDeclRoutedResolution) -> String
     RouteDeclaringSpan => "declaring_span"
     RouteReferencingModuleDeclarer => "referencing_module_declarer"
     RouteQualifiedSpelling => "qualified_spelling"
+    RouteReferencingModuleImport => "referencing_module_import"
+    RouteKernelMint => "kernel_mint"
     RouteLeafSpelling => "leaf_spelling"
   }
   match routed.resolution {
@@ -379,7 +575,7 @@ fn type_decl_routed_resolution_label(routed: TypeDeclRoutedResolution) -> String
 }
 
 type EmitGraphInfo {
-  type_summaries: Map<String, TypeSummary>
+  type_summaries: TypeSummaryIndex
   type_decl_items: TypeDeclIndex
   data_variant_wire_spellings: Map<String, DataVariantWireSpelling>
   fn_decl_items: Map<String, Node>
@@ -409,7 +605,7 @@ type EmitGraphInfo {
 }
 
 type EmitInfoBuildState {
-  type_summaries: Map<String, TypeSummary>
+  type_summaries: TypeSummaryIndex
   type_decl_items: TypeDeclIndex
   fn_decl_items: Map<String, Node>
   structural_alias_fn_surface_names: Map<String, List<String>>
@@ -419,7 +615,7 @@ type EmitInfoBuildState {
 fn empty_emit_graph_info() -> EmitGraphInfo {
   EmitGraphInfo {
     item_leaf_owner_modules: empty_map(),
-    type_summaries: empty_map(),
+    type_summaries: empty_type_summary_index(),
     type_decl_items: empty_type_decl_index(),
     data_variant_wire_spellings: empty_map(),
     fn_decl_items: empty_map(),
@@ -540,7 +736,34 @@ fn variant_summary_key(enum_name: String, variant_name: String) -> String {
 }
 
 fn lookup_emit_type_summary(emit_info: EmitGraphInfo, type_name: String) -> TypeSummary? {
-  map_get(emit_info.type_summaries, type_name)
+  type_summary_decided(index: emit_info.type_summaries, key: type_name)
+}
+
+// A YES/NO QUESTION ABOUT A NAME. Unanimous answers from every declaration of a leaf are decided.
+// Disagreement is not "no": collapsing it to false made `is this an enum?` emit the non-enum arm
+// for a name two declarations own, which rustc can accept. NotDeclared is a separate arm so a
+// missing name is not an ambiguous one.
+type TypeSummaryQuestion
+  = QuestionDecided { value: Bool }
+  | QuestionNameAmbiguous { leaf: String }
+  | QuestionNotDeclared
+
+fn type_summary_answer(index: TypeSummaryIndex, key: String, question: fn(TypeSummary) -> Bool) -> TypeSummaryQuestion {
+  match type_summary_lookup(index: index, key: key) {
+    TypeSummaryFound { summary: summary } => QuestionDecided { value: question(summary) }
+    TypeSummaryNotDeclared => QuestionNotDeclared
+    TypeSummaryLeafAmbiguous { leaf: leaf } =>
+      let answers = type_summary_keys_of_leaf(index: index, leaf: leaf) |> fold(init: [], f: (acc, k) =>
+        match map_get(index.by_key, k) {
+          Present { value: summary } => list_push(acc, question(summary))
+          Absent => acc
+        }
+      )
+      if (answers |> count) == 0 { QuestionNotDeclared }
+      else if answers |> all(a => a) { QuestionDecided { value: true } }
+      else if answers |> all(a => !a) { QuestionDecided { value: false } }
+      else { QuestionNameAmbiguous { leaf: leaf } }
+  }
 }
 
 fn emit_graph_records_type_decl(item: Node, source_indices: Map<String, NewlineIndex>) -> Bool {
@@ -565,14 +788,17 @@ fn emit_graph_records_fn_decl(item: Node) -> Bool {
   item.module_item_kind == ModuleItemFunction
 }
 
-fn derive_variant_to_enum(type_summaries: Map<String, TypeSummary>) -> Map<String, String> {
-  map_values(type_summaries) |> fold(init: empty_map(), f: (acc, summary) =>
+// variant leaf -> the KEY of the enum that declares it, or "" when two enums declare that variant.
+// The value is the owner's identity, not its leaf: two same-leaf enums own different variants, and a
+// leaf value would send every reader back through the ambiguous spelling.
+fn derive_variant_to_enum(type_summaries: TypeSummaryIndex) -> Map<String, String> {
+  type_summary_values(index: type_summaries) |> fold(init: empty_map(), f: (acc, summary) =>
     match summary.repr {
       EnumRepr { unit_only: _ } =>
         fold(map_keys(summary.variant_name_set), init: acc, f: (inner, vn) =>
           match map_get(inner, vn) {
             Present { value: _ } => map_insert(inner, vn, "")
-            Absent => map_insert(inner, vn, summary.name)
+            Absent => map_insert(inner, vn, summary.key)
           }
         )
       _ => acc
@@ -580,41 +806,48 @@ fn derive_variant_to_enum(type_summaries: Map<String, TypeSummary>) -> Map<Strin
   )
 }
 
-fn is_known_variant(type_summaries: Map<String, TypeSummary>, name: String) -> Bool {
-  map_values(type_summaries) |> any(summary =>
-    match summary.repr {
-      EnumRepr { unit_only: _ } => emit_map_has(m: summary.variant_name_set, key: name)
-      _ => false
-    }
-  )
+fn is_known_variant(variant_to_enum: Map<String, String>, name: String) -> Bool {
+  map_contains_key(variant_to_enum, name)
 }
 
-fn variant_belongs_to_enum(type_summaries: Map<String, TypeSummary>, variant_name: String, enum_name: String) -> Bool {
-  match map_get(type_summaries, enum_name) {
-    Present { value: summary } =>
-      match summary.repr {
-        EnumRepr { unit_only: _ } =>
-          emit_map_has(m: summary.variant_name_set, key: variant_name)
-        _ => false
-      }
-    Absent => false
+fn summary_is_enum_with_variant(summary: TypeSummary, variant_name: String) -> Bool {
+  match summary.repr {
+    EnumRepr { unit_only: _ } => emit_map_has(m: summary.variant_name_set, key: variant_name)
+    _ => false
   }
 }
 
-fn is_enum_in_summaries(type_summaries: Map<String, TypeSummary>, type_name: String) -> Bool {
-  match map_get(type_summaries, type_name) {
-    Present { value: summary } => match summary.repr {
-      EnumRepr { unit_only: _ } => true
-      _ => false
-    }
-    Absent => false
+fn summary_is_enum(summary: TypeSummary) -> Bool {
+  match summary.repr {
+    EnumRepr { unit_only: _ } => true
+    _ => false
   }
 }
 
-fn find_variant_parent(type_summaries: Map<String, TypeSummary>, variant_name: String, scope_enums: List<String>) -> String? {
-  scope_enums |> filter(en =>
-    variant_belongs_to_enum(type_summaries: type_summaries, variant_name: variant_name, enum_name: en)
-  ) |> first
+fn variant_belongs_to_enum(type_summaries: TypeSummaryIndex, variant_name: String, enum_name: String) -> TypeSummaryQuestion {
+  type_summary_answer(index: type_summaries, key: enum_name, question: summary => summary_is_enum_with_variant(summary: summary, variant_name: variant_name))
+}
+
+fn is_enum_in_summaries(type_summaries: TypeSummaryIndex, type_name: String) -> TypeSummaryQuestion {
+  type_summary_answer(index: type_summaries, key: type_name, question: summary => summary_is_enum(summary: summary))
+}
+
+fn find_variant_parent(type_summaries: TypeSummaryIndex, variant_name: String, scope_enums: List<String>) -> String? {
+  if scope_enums |> any(en =>
+    match variant_belongs_to_enum(type_summaries: type_summaries, variant_name: variant_name, enum_name: en) {
+      QuestionNameAmbiguous { leaf: _ } => true
+      _ => false
+    }
+  ) {
+    none
+  } else {
+    scope_enums |> filter(en =>
+      match variant_belongs_to_enum(type_summaries: type_summaries, variant_name: variant_name, enum_name: en) {
+        QuestionDecided { value: v } => v
+        _ => false
+      }
+    ) |> first
+  }
 }
 
 fn field_value_shape_from_type_node(type_node: Node) -> FieldValueShape {
@@ -735,6 +968,7 @@ fn build_type_summary(item: Node, source_indices: Map<String, NewlineIndex>) ->
     let field_types = build_field_type_map(children: item.children, source_indices: source_indices)
     Present { value: TypeSummary {
       name: authored_name_at(source_indices: source_indices, node: item),
+      key: "",
       repr: StructRepr,
       field_summaries: build_struct_field_summaries(parent: item, source_indices: source_indices),
       field_type_map: field_types.field_types,
@@ -747,6 +981,7 @@ fn build_type_summary(item: Node, source_indices: Map<String, NewlineIndex>) ->
     let unit_only = item.children |> all(child => child.children |> count == 0)
     Present { value: TypeSummary {
       name: authored_name_at(source_indices: source_indices, node: item),
+      key: "",
       repr: EnumRepr { unit_only: unit_only },
       field_summaries: build_enum_field_summaries(variants: item.children, source_indices: source_indices),
       field_type_map: empty_map(),
@@ -805,15 +1040,26 @@ type FnReachRound {
   grew: Bool
 }
 
-fn fn_reach_holds_directly(name: String, summaries: Map<String, TypeSummary>, structural_alias_direct_fn_names: Set<String>) -> Bool {
-  match map_get(summaries, name) {
+// The walk is over summary KEYS. A field names its type by spelling, so a target resolves to the
+// key it names exactly, or to EVERY declarer of that leaf: reachability is then an over-approximation
+// computed as the answer (a type reaching a function value through either same-leaf declaration is
+// marked), and the spelling itself is kept for the structural aliases, which this index does not hold.
+fn fn_reach_target_keys(index: TypeSummaryIndex, target: String) -> List<String> {
+  match map_get(index.by_key, target) {
+    Present { value: _ } => [target]
+    Absent => concat(type_summary_keys_of_leaf(index: index, leaf: target), [target])
+  }
+}
+
+fn fn_reach_holds_directly(name: String, summaries: TypeSummaryIndex, structural_alias_direct_fn_names: Set<String>) -> Bool {
+  match map_get(summaries.by_key, name) {
     Present { value: s } => s.has_fn_fields
     Absent => set_contains(structural_alias_direct_fn_names, name)
   }
 }
 
-fn fn_reach_targets(name: String, summaries: Map<String, TypeSummary>, structural_alias_fn_surface_names: Map<String, List<String>>) -> List<String> {
-  match map_get(summaries, name) {
+fn fn_reach_targets(name: String, summaries: TypeSummaryIndex, structural_alias_fn_surface_names: Map<String, List<String>>) -> List<String> {
+  let spelled = match map_get(summaries.by_key, name) {
     Present { value: s } => concat(map_values(s.field_type_map), s.field_import_surface_names)
     Absent =>
       match map_get(structural_alias_fn_surface_names, name) {
@@ -821,9 +1067,10 @@ fn fn_reach_targets(name: String, summaries: Map<String, TypeSummary>, structura
         Absent => []
       }
   }
+  spelled |> fold(init: [], f: (acc, t) => concat(acc, fn_reach_target_keys(index: summaries, target: t)))
 }
 
-fn fn_reaching_names_fixpoint(candidates: List<String>, summaries: Map<String, TypeSummary>, structural_alias_fn_surface_names: Map<String, List<String>>, structural_alias_direct_fn_names: Set<String>, reached: Set<String>) -> Set<String> {
+fn fn_reaching_names_fixpoint(candidates: List<String>, summaries: TypeSummaryIndex, structural_alias_fn_surface_names: Map<String, List<String>>, structural_alias_direct_fn_names: Set<String>, reached: Set<String>) -> Set<String> {
   let round = fold(candidates, init: FnReachRound { reached: reached, grew: false }, f: (acc, name) =>
     if set_contains(acc.reached, name) { acc }
     else if fn_reach_holds_directly(name: name, summaries: summaries, structural_alias_direct_fn_names: structural_alias_direct_fn_names)
@@ -837,9 +1084,9 @@ fn fn_reaching_names_fixpoint(candidates: List<String>, summaries: Map<String, T
   } else { round.reached }
 }
 
-fn fn_reaching_names(summaries: Map<String, TypeSummary>, structural_alias_fn_surface_names: Map<String, List<String>>, structural_alias_direct_fn_names: Set<String>) -> Set<String> {
+fn fn_reaching_names(summaries: TypeSummaryIndex, structural_alias_fn_surface_names: Map<String, List<String>>, structural_alias_direct_fn_names: Set<String>) -> Set<String> {
   fn_reaching_names_fixpoint(
-    candidates: concat(map_keys(summaries), map_keys(structural_alias_fn_surface_names)),
+    candidates: concat(map_keys(summaries.by_key), map_keys(structural_alias_fn_surface_names)),
     summaries: summaries,
     structural_alias_fn_surface_names: structural_alias_fn_surface_names,
     structural_alias_direct_fn_names: structural_alias_direct_fn_names,
@@ -847,26 +1094,30 @@ fn fn_reaching_names(summaries: Map<String, TypeSummary>, structural_alias_fn_su
   )
 }
 
-fn close_fn_fields(summaries: Map<String, TypeSummary>, structural_alias_fn_surface_names: Map<String, List<String>>, structural_alias_direct_fn_names: Set<String>) -> Map<String, TypeSummary> {
+fn close_fn_fields(summaries: TypeSummaryIndex, structural_alias_fn_surface_names: Map<String, List<String>>, structural_alias_direct_fn_names: Set<String>) -> TypeSummaryIndex {
   let reaching = fn_reaching_names(summaries: summaries, structural_alias_fn_surface_names: structural_alias_fn_surface_names, structural_alias_direct_fn_names: structural_alias_direct_fn_names)
-  fold(map_keys(summaries), init: summaries, f: (acc, name) =>
-    match map_get(summaries, name) {
-      Present { value: s } =>
-        if !s.has_fn_fields && set_contains(reaching, name) {
-          map_insert(acc, name, TypeSummary {
-            name: s.name,
-            repr: s.repr,
-            field_summaries: s.field_summaries,
-            field_type_map: s.field_type_map,
-            field_import_surface_names: s.field_import_surface_names,
-            variant_name_set: s.variant_name_set,
-            generic_param_names: s.generic_param_names,
-            has_fn_fields: true
-          })
-        } else { acc }
-      Absent => acc
-    }
-  )
+  TypeSummaryIndex {
+    by_key: fold(map_keys(summaries.by_key), init: summaries.by_key, f: (acc, key) =>
+      match map_get(summaries.by_key, key) {
+        Present { value: s } =>
+          if !s.has_fn_fields && set_contains(reaching, key) {
+            map_insert(acc, key, TypeSummary {
+              name: s.name,
+              key: s.key,
+              repr: s.repr,
+              field_summaries: s.field_summaries,
+              field_type_map: s.field_type_map,
+              field_import_surface_names: s.field_import_surface_names,
+              variant_name_set: s.variant_name_set,
+              generic_param_names: s.generic_param_names,
+              has_fn_fields: true
+            })
+          } else { acc }
+        Absent => acc
+      }
+    ),
+    keys_by_leaf: summaries.keys_by_leaf
+  }
 }
 
 fn structural_alias_direct_fn_names_with(names: Set<String>, name: String, include: Bool) -> Set<String> {
@@ -912,7 +1163,9 @@ fn add_emit_item_summary(state: EmitInfoBuildState, module_name: String, item: N
     state
   }
   match build_type_summary(item: item, source_indices: source_indices) {
-    Present { value: summary } =>
+    Present { value: built } =>
+      let key = type_decl_identity(owner_module: module_name, decl_name: built.name)
+      let summary = type_summary_with_key(summary: built, key: key)
       let with_variants = match summary.repr {
         EnumRepr { unit_only: _ } =>
           fold(item.children, init: state.type_summaries, f: (acc, variant) =>
@@ -925,9 +1178,11 @@ fn add_emit_item_summary(state: EmitInfoBuildState, module_name: String, item: N
               )
               let vname = authored_name_at(source_indices: source_indices, node: variant)
               let qualified_vname = variant_summary_key(enum_name: summary.name, variant_name: vname)
+              let variant_key = variant_summary_key(enum_name: key, variant_name: vname)
               let variant_field_types = build_field_type_map(children: variant.children, source_indices: source_indices)
-              map_insert(acc, qualified_vname, TypeSummary {
+              type_summary_index_insert(index: acc, key: variant_key, leaf: qualified_vname, summary: TypeSummary {
                 name: qualified_vname,
+                key: variant_key,
                 repr: StructRepr,
                 field_summaries: build_struct_field_summaries(parent: variant, source_indices: source_indices),
                 field_type_map: variant_field_types.field_types,
@@ -940,7 +1195,7 @@ fn add_emit_item_summary(state: EmitInfoBuildState, module_name: String, item: N
           )
         _ => state.type_summaries
       }
-      let next_summaries = map_insert(with_variants, summary.name, summary)
+      let next_summaries = type_summary_index_insert(index: with_variants, key: key, leaf: summary.name, summary: summary)
       EmitInfoBuildState {
         type_summaries: next_summaries,
         type_decl_items: state.type_decl_items,
@@ -952,4 +1207,18 @@ fn add_emit_item_summary(state: EmitInfoBuildState, module_name: String, item: N
   }
 }
 
+fn type_summary_with_key(summary: TypeSummary, key: String) -> TypeSummary {
+  TypeSummary {
+    name: summary.name,
+    key: key,
+    repr: summary.repr,
+    field_summaries: summary.field_summaries,
+    field_type_map: summary.field_type_map,
+    field_import_surface_names: summary.field_import_surface_names,
+    variant_name_set: summary.variant_name_set,
+    generic_param_names: summary.generic_param_names,
+    has_fn_fields: summary.has_fn_fields
+  }
+}
+
 data emit_dependency_registration_dissolve_on_note: DissolutionCondition = unbound_dissolution(description: "dissolve-on (FreeMonoid pass 2026-07-20): collect emitted cross-module type/path refs during emit into one authority; derive (a) use-lines via build_shared_types + reference_derived_use_line_plan and (b) closure pub-mod membership via emit_lib_rs_from_paths from that set. Instance-patch interim: closure projections (v1.compiler.closure_stub_v2_std_text_rust and closure_stub_v2_std_integer_rust) when refs exist but the real v2.std.text or v2.std.integer module is absent from narrow typed.modules — projections are NOT parallel modeling authorities (see each stub module dissolve_on_note); they dissolve when the ref set includes the real module in the closure.")
diff --git a/src/v1/04_env.dag b/src/v1/04_env.dag
index 2ea38c63c13..7aa1acaedf6 100644
--- a/src/v1/04_env.dag
+++ b/src/v1/04_env.dag
@@ -186,7 +186,7 @@ data global_bare_fallback_invariant: String = "Corpus-wide bare-name census, res
 // lookup_binding_by_name after global_bare; v1 patterns: lookup_variant_in_type routes dotted
 // variant names through symbol_index_lookup. build_symbol_index_census materializes declared-module
 // item paths plus module-unique Disj variant aliases (qualified path always; corpus-unique variants
-// also enter global_bare — mirrors v2 symbol_index_fill_unique_variant_aliases);
+// also enter global_bare — mirrors v2 symbol_index_fill_containment_node's alias arm);
 // lookup_qualified_module_projection runs only when the reference carries a dot (fail-closed on
 // miss — never widens to field-access semantics).
 
@@ -226,6 +226,8 @@ type SymbolIndex {
   services: Map<String, ServiceCensusEntry>
   transparent_alias_rep: Map<String, String>
   type_head_exposures: Map<String, TypeHeadExposure>
+  file_modules: Map<String, String>
+  module_named_imports: Map<String, Map<String, String>>
 }
 
 type Scope {
@@ -233,7 +235,7 @@ type Scope {
 }
 
 fn empty_symbol_index() -> SymbolIndex {
-  SymbolIndex { entries: empty_map(), global_bare: empty_map(), services: empty_map(), transparent_alias_rep: empty_map(), type_head_exposures: empty_map() }
+  SymbolIndex { entries: empty_map(), global_bare: empty_map(), services: empty_map(), transparent_alias_rep: empty_map(), type_head_exposures: empty_map(), file_modules: empty_map(), module_named_imports: empty_map() }
 }
 
 fn empty_type_env() -> TypeEnv {
@@ -259,6 +261,97 @@ fn symbol_index_lookup(index: SymbolIndex, qualified_name: String) -> Node? {
   map_get(index.entries, qualified_name)
 }
 
+// THE KERNEL NAMES NO IMPORT OVERRIDES: the resolver's scope layer for the kernel sits positionally
+// above imports (v1.compiler.infer direct_import_export_precedence_note: locals > kernel >
+// direct-selected > transitive). It lives here, beside the occurrence decision below, so the
+// resolver's overlay and the emitter's unstamped-occurrence route read one predicate.
+fn overlay_skips_kernel_name(name: String) -> Bool {
+  is_kernel_type(name: name)
+    || is_container_type(name: name)
+    || name == "Unit"
+    || name == "Optional"
+    || name == "Present"
+    || name == "Absent"
+}
+
+// WHAT A BARE NAME DENOTES AT ONE UNSTAMPED OCCURRENCE, in the order the typechecker binds a
+// declaration-field type: lookup_type_for reaches lookup_binding, which answers from the module's own
+// env.bindings -- its declarations and the names it imports BY NAME -- before lookup_binding_by_name
+// reaches the overlay where the kernel layer sits above imports (overlay_skips_kernel_name). So: a
+// declaration in the occurrence's own file, then the file's named import, then the kernel. That the
+// overlay's order (v1.compiler.infer direct_import_export_precedence_note) disagrees for an imported
+// kernel-named declaration that has no mint row is the residual class
+// (gunbc.recurring_failure_mode.an_imported_name_shadowed_by_a_kernel_name); this decision mirrors the
+// binding the typechecker actually uses. It is the emitter's COPY of that order for references that
+// arrive with no resolution fact -- type-environment declaration bodies whose members were never
+// stamped -- and a counted route, not a second authority: v1.compiler.infer_emit_info
+// resolve_type_decl_routed and v1.compiler.emit_rust is_host_optional_carrier_type read it, and it is
+// deleted when those bodies carry Node.declaration stamped in the DECLARING scope
+// (v1.compiler.infer_emit_info referencing_module_declarer_route_dissolves_on).
+type BareOccurrenceBinding
+  = BareOccurrenceDeclaredInItsFile { declaration: Node }
+  | BareOccurrenceImportedByName { module_path: String, declaration: Node }
+  | BareOccurrenceIsKernelName
+  | BareOccurrenceUndecided
+
+fn symbol_index_bare_declarations(index: SymbolIndex, name: String) -> List<Node> {
+  match map_get(index.global_bare, name) {
+    Present { value: GlobalBareUniqueBinding { module_path: _, binding: b } } => [b.resolved]
+    Present { value: GlobalBareAmbiguousBinding { candidates: cs } } => cs |> map(c => c.binding.resolved)
+    Absent => []
+  }
+}
+
+// A NAMED IMPORT is followed the way lookup_binding follows it: a module that itself imports the name
+// by name re-exports it (v2.std.collection imports std.optional { Optional }), so the chain is
+// walked to the module that DECLARES the name. A chain that ends in a module holding no such
+// declaration, or that does not end within the bound, is Undecided and refuses; it never falls
+// through to the kernel.
+fn bare_occurrence_import(index: SymbolIndex, name: String, reference: Node) -> BareOccurrenceBinding? {
+  match map_get(index.file_modules, reference.span.file) {
+    Absent => none
+    Present { value: referencing_module } =>
+      match symbol_index_named_import_source(index: index, module_path: referencing_module, name: name) {
+        Absent => none
+        Present { value: from_module } => Present { value: bare_occurrence_import_terminal(index: index, module_path: from_module, name: name, fuel: 16) }
+      }
+  }
+}
+
+fn symbol_index_named_import_source(index: SymbolIndex, module_path: String, name: String) -> String? {
+  match map_get(index.module_named_imports, module_path) {
+    Absent => none
+    Present { value: named } => map_get(named, name)
+  }
+}
+
+fn bare_occurrence_import_terminal(index: SymbolIndex, module_path: String, name: String, fuel: Int) -> BareOccurrenceBinding {
+  if fuel == 0 { BareOccurrenceUndecided }
+  else {
+    match symbol_index_named_import_source(index: index, module_path: module_path, name: name) {
+      Present { value: next } => bare_occurrence_import_terminal(index: index, module_path: next, name: name, fuel: fuel - 1)
+      Absent =>
+        match symbol_index_lookup(index: index, qualified_name: concat(module_path, ".", name)) {
+          Present { value: decl } => BareOccurrenceImportedByName { module_path: module_path, declaration: decl }
+          Absent => BareOccurrenceUndecided
+        }
+    }
+  }
+}
+
+fn bare_occurrence_binding(index: SymbolIndex, name: String, reference: Node) -> BareOccurrenceBinding {
+  let local = symbol_index_bare_declarations(index: index, name: name) |> filter(d => d.span.file == reference.span.file)
+  let local_count = local |> fold(init: 0, f: (n, _d) => n + 1)
+  if local_count == 1 { local |> fold(init: BareOccurrenceUndecided, f: (acc, d) => BareOccurrenceDeclaredInItsFile { declaration: d }) }
+  else if local_count > 1 { BareOccurrenceUndecided }
+  else {
+    match bare_occurrence_import(index: index, name: name, reference: reference) {
+      Present { value: imported } => imported
+      Absent => if overlay_skips_kernel_name(name: name) { BareOccurrenceIsKernelName } else { BareOccurrenceUndecided }
+    }
+  }
+}
+
 fn global_bare_candidates_contain(candidates: List<GlobalBareCandidate>, resolved: Node) -> Bool {
   candidates |> any(c => c.binding.resolved == resolved)
 }
@@ -298,7 +391,9 @@ fn symbol_index_insert(index: SymbolIndex, qualified_name: String, resolved: Nod
     global_bare: index.global_bare,
     services: index.services,
     transparent_alias_rep: index.transparent_alias_rep,
-    type_head_exposures: index.type_head_exposures
+    type_head_exposures: index.type_head_exposures,
+    file_modules: index.file_modules,
+    module_named_imports: index.module_named_imports
   }
 }
 
@@ -308,7 +403,9 @@ fn symbol_index_insert_decl(index: SymbolIndex, module_path: String, binding: Ty
     global_bare: symbol_index_track_global_bare(global_bare: index.global_bare, module_path: module_path, binding: binding),
     services: index.services,
     transparent_alias_rep: index.transparent_alias_rep,
-    type_head_exposures: index.type_head_exposures
+    type_head_exposures: index.type_head_exposures,
+    file_modules: index.file_modules,
+    module_named_imports: index.module_named_imports
   }
 }
 
@@ -318,7 +415,9 @@ fn symbol_index_insert_service(index: SymbolIndex, name: String, module_path: St
     global_bare: index.global_bare,
     services: map_insert(index.services, name, ServiceCensusEntry { module_path: module_path, item: item }),
     transparent_alias_rep: index.transparent_alias_rep,
-    type_head_exposures: index.type_head_exposures
+    type_head_exposures: index.type_head_exposures,
+    file_modules: index.file_modules,
+    module_named_imports: index.module_named_imports
   }
 }
 
diff --git a/src/v1/04_infer.dag b/src/v1/04_infer.dag
index 0fc07cbcaeb..ed6e2c4706b 100644
--- a/src/v1/04_infer.dag
+++ b/src/v1/04_infer.dag
@@ -124,7 +124,7 @@ import v1.compiler.infer_method {
 }
 import v1.compiler.infer_cycle { detect_type_cycles_kahn }
 import v1.compiler.coercion { provenance_realizes_natively }
-import v1.compiler.infer_env {
+import v1.compiler.infer_env { overlay_skips_kernel_name,
   text_representation_by_identity, text_crossing_by_identity, host_text_into_structural_sequence, text_representations_cross, text_representation_is_text_arm, text_representation_is_unidentified,
   TypeEnv, TypeBinding, TypeEnvCache, empty_type_env_cache, merge_type_env_cache,
   merge_type_env_cache_guarded, GuardedTypeEnvCacheMerge, TypeEnvCacheMergeConflict,
@@ -189,7 +189,7 @@ import v1.compiler.infer_sigs {
 }
 import v1.compiler.infer_emit_info {
   TypeRepr, StructRepr, EnumRepr,
-  TypeSummary, EmitGraphInfo, EmitInfoBuildState,
+  TypeSummary, EmitGraphInfo, EmitInfoBuildState, TypeSummaryIndex, TypeSummaryLookup, TypeSummaryFound, TypeSummaryLeafAmbiguous, TypeSummaryNotDeclared, TypeSummaryQuestion, QuestionDecided, QuestionNameAmbiguous, QuestionNotDeclared, type_summary_lookup, empty_type_summary_index, is_enum_in_summaries,
   empty_emit_graph_info, empty_type_env, lookup_emit_type_summary,
   build_struct_field_summaries, build_enum_field_summaries,
   add_emit_item_summary, derive_variant_to_enum, close_fn_fields, empty_type_decl_index, type_decl_index_with_qualified_names
@@ -746,7 +746,7 @@ fn variant_reference_inferred_node(expected: Node?, name: String, owner_name: St
 
 // THE IDENTITY OF AN ARM WHOSE OWNER IS A KERNEL MINT. A mint that a
 // gunbc.structural_realization_bindings kernel_mint_declaration_rows row binds to a corpus
-// declaration answers with THAT declaration (the kernel Optional is v2.std.optional Optional), so
+// declaration answers with THAT declaration (the kernel Optional is std.optional Optional), so
 // the arm has one identity whether it was reached through `T?` or through an import. A mint with
 // no row is a kernel type or it is unrecovered, as before.
 fn kernel_mint_parent_identity(minted_name: String) -> VariantParentIdentity {
@@ -1853,6 +1853,39 @@ fn record_lit_expanded_from_expected(type_name: String?, expected: Node?, scope:
   }
 }
 
+// A VARIANT LITERAL OF A GENERIC OWNER IS AN APPLICATION OF THAT OWNER WHEN ITS CONTEXT SAYS WHICH.
+// The arm above widens a variant literal to its owner DECLARATION: the expansion that still carries
+// the declaration's formals as params (`Result<ok, err>`). The expected type -- a declared return, a
+// typed let, a fold init whose fold sits in result position -- is the authored APPLICATION of the
+// same declaration (`Result<List<DnsLabel>, DomainNameParseError>`), and every reader before this
+// one dropped its arguments by resolving it back to the declaration (record_lit_expected_coproduct).
+// So the literal typed as an uninstantiated declaration, and each consumer downstream compensated
+// or failed: fold_accumulator_is_unapplied_generic re-derives an accumulator from the step's
+// return, which is itself such a literal, and extdeps.dns.domain_name parse_dns_label_list's
+// `labels |> list_push(label)` reached the emitter with `labels` typed by the formal `ok`
+// (gunbc native broker, E0599). The application is admitted only when the expected's head resolves
+// to the SAME binding as the owner (rc identity, never a spelling comparison) and the owner is
+// generic; anything else answers none and the literal keeps the declaration exactly as before.
+// ONLY A COPRODUCT OWNER. A struct literal never takes this arm: its fields are instantiated from
+// the expected type by record_lit_instantiated_fields, and its type stays the declaration, which
+// the Rust emitter's shared-carrier decision reads by the declaration's name. Measured: admitting a
+// generic STRUCT here (v2.std.artifact generated_artifact_validation, a Validation<Artifact> data
+// row) dropped its Rc carrier and was the one new error on the v2 self-host closure (E0308).
+fn variant_literal_expected_application(owner: Node, expected: Node?, scope: InferScope) -> Node? {
+  if (owner.params |> count) == 0 || owner.connective != Disj { return none }
+  match expected {
+    Present { value: exp } =>
+      if exp.connective != NoConnective || (exp.children |> count) == 0 { none }
+      else {
+        match lookup_type_for(env: scope.type_env, node: exp) {
+          Present { value: head } => if rc_ptr_eq(head, owner) { Present { value: with_required_cardinality(n: exp) } } else { none }
+          Absent => none
+        }
+      }
+    Absent => none
+  }
+}
+
 fn record_lit_expected_coproduct(expected: Node?, scope: InferScope) -> Node? {
   match expected {
     Present { value: exp } =>
@@ -7066,16 +7099,15 @@ type UnresolvedMethodFrontierRow {
   dissolution: DissolutionCondition
 }
 
+// THE extdeps.dns.domain_name list_push ROW IS DELETED, observed 0 (an equality, so it is deleted,
+// not lowered), and its recorded cause was a misattribution corrected here rather than carried:
+// `ok` was not the variant's name but the owner's FORMAL. The payload `labels` was bound out of an
+// accumulator typed as the uninstantiated declaration Result<ok, err>, because the fold's
+// constructor init `Ok { value: .. }` widened to its owner declaration and dropped the expected
+// application. variant_literal_expected_application types that literal as the declared return's
+// application, so the receiver is List<DnsLabel> and the method resolves at tier0.
 fn unresolved_method_frontier() -> List<UnresolvedMethodFrontierRow> {
   [
-    {
-      module_name: "extdeps.dns.domain_name",
-      method: "list_push",
-      occurrences: 1,
-      receiver_shape: "Primitive(ok)",
-      cause: "receiver is a coproduct payload bound by pattern destructuring, which arrives typed as the VARIANT name rather than the field type.",
-      dissolution: unbound_dissolution(description: "coproduct payload binding typed as the field type, at which point the receiver is List and DECIDABLE")
-    },
     {
       module_name: "v1.compiler.trace",
       method: "map",
@@ -7231,7 +7263,7 @@ fn validate_cast(source_inferred: InferredNode?, target_name: String, span: Sour
 // with the absence intact, so it is left to validate_cast.
 //
 // WAS `source_name == "Optional"`, and a BARE-SPELLING comparison is the defect: authored
-// names reach here qualified as often as not, so a source typed `v2.std.optional.Optional`
+// names reach here qualified as often as not, so a source typed `std.optional.Optional`
 // was not recognised as optional at all and its cast escaped OptionalCastNotEliminated
 // entirely. qualified_last_segment is the authority this file already uses for exactly this
 // question (nominal_call_arg_brand_mismatch, is_set_collection); asking it here is using the
@@ -11195,7 +11227,12 @@ fn infer_record_lit_structural(occurrence_identity: NodeOccurrenceIdentity, type
     }
     let expected_optional_parent = Present { value: "Optional" }
     let is_present_ctor = type_name.value == "Present" && local_variant_parent == expected_optional_parent
-    let resolved_node = if is_present_ctor {
+    let applied_expected_owner = if is_present_ctor { none } else {
+      variant_literal_expected_application(owner: raw_resolved, expected: expected, scope: scope)
+    }
+    let resolved_node = if applied_expected_owner != none {
+      applied_expected_owner.value
+    } else if is_present_ctor {
       let val_field = fi_infer_results |> filter(fir => field_init_node_name_at(n: fir.typed_field, source_indices: scope.type_env.source_indices) == "value") |> first
       match val_field {
         Present { value: val_fir } => with_optional_cardinality(n: resolved_type(n: val_fir.infer_result.typed))
@@ -14970,6 +15007,15 @@ fn transparent_alias_identity_agrees(index: SymbolIndex, left: String, right: St
     }
 }
 
+// A MODULE'S NAMED IMPORTS, leaf -> the module it is imported from, read from its import nodes: the
+// import half of v1.compiler.infer_env bare_occurrence_binding.
+fn file_named_imports_of(module_node: Node, source_indices: Map<String, NewlineIndex>) -> Map<String, String> {
+  module_imports(n: module_node) |> filter(imp => !import_is_all(n: imp)) |> fold(init: empty_map(), f: (acc, imp) =>
+    let from_module = import_module_path_at(imp: imp, source_indices: source_indices)
+    import_specific_names_at(n: imp, source_indices: source_indices) |> fold(init: acc, f: (inner, name) => map_insert(inner, name, from_module))
+  )
+}
+
 fn build_symbol_index_census_raw_nodes(module_nodes: List<Node>, source_indices: Map<String, NewlineIndex>) -> SymbolIndex {
   let corpus_variant_counts = corpus_disj_variant_name_counts_nodes(module_nodes: module_nodes, source_indices: source_indices)
   let corpus_item_counts = corpus_item_name_counts_nodes(module_nodes: module_nodes, source_indices: source_indices)
@@ -14999,7 +15045,11 @@ fn build_symbol_index_census_raw_nodes(module_nodes: List<Node>, source_indices:
     services: folded.services,
     transparent_alias_rep: transparent_alias_representatives(
       module_nodes: module_nodes, source_indices: source_indices, item_counts: corpus_item_counts),
-    type_head_exposures: type_head_exposure_census(module_nodes: module_nodes, source_indices: source_indices)
+    type_head_exposures: type_head_exposure_census(module_nodes: module_nodes, source_indices: source_indices),
+    file_modules: module_nodes |> fold(init: empty_map(), f: (acc, module_node) =>
+      map_insert(acc, module_node.span.file, authored_name_at(source_indices: source_indices, node: module_node))),
+    module_named_imports: module_nodes |> fold(init: empty_map(), f: (acc, module_node) =>
+      map_insert(acc, authored_name_at(source_indices: source_indices, node: module_node), file_named_imports_of(module_node: module_node, source_indices: source_indices)))
   }
 }
 
@@ -15209,7 +15259,7 @@ fn census_bare_fill_with_resolved_fn_sigs(index: SymbolIndex, source_indices: Ma
       Absent => acc
     }
   )
-  SymbolIndex { entries: index.entries, global_bare: global2, services: services2, transparent_alias_rep: index.transparent_alias_rep, type_head_exposures: index.type_head_exposures }
+  SymbolIndex { entries: index.entries, global_bare: global2, services: services2, transparent_alias_rep: index.transparent_alias_rep, type_head_exposures: index.type_head_exposures, file_modules: index.file_modules, module_named_imports: index.module_named_imports }
 }
 
 fn census_with_resolved_fn_sigs(index: SymbolIndex, source_indices: Map<String, NewlineIndex>) -> SymbolIndex {
@@ -15228,7 +15278,7 @@ fn census_with_resolved_fn_sigs(index: SymbolIndex, source_indices: Map<String,
     }
   )
   let fill = census_bare_fill_with_resolved_fn_sigs(index: index, source_indices: source_indices)
-  SymbolIndex { entries: entries2, global_bare: fill.global_bare, services: fill.services, transparent_alias_rep: fill.transparent_alias_rep, type_head_exposures: fill.type_head_exposures }
+  SymbolIndex { entries: entries2, global_bare: fill.global_bare, services: fill.services, transparent_alias_rep: fill.transparent_alias_rep, type_head_exposures: fill.type_head_exposures, file_modules: fill.file_modules, module_named_imports: fill.module_named_imports }
 }
 
 fn build_symbol_index_census(modules: List<ResolvedModule>, source_indices: Map<String, NewlineIndex>) -> SymbolIndex {
@@ -15268,7 +15318,9 @@ fn symbol_index_with_bare_fill(closure: SymbolIndex, tree: SymbolIndex) -> Symbo
   SymbolIndex {
     entries: closure.entries, global_bare: global2, services: services2,
     transparent_alias_rep: map_merge(tree.transparent_alias_rep, closure.transparent_alias_rep),
-    type_head_exposures: map_merge(tree.type_head_exposures, closure.type_head_exposures)
+    type_head_exposures: map_merge(tree.type_head_exposures, closure.type_head_exposures),
+    file_modules: map_merge(tree.file_modules, closure.file_modules),
+    module_named_imports: map_merge(tree.module_named_imports, closure.module_named_imports)
   }
 }
 
@@ -15307,20 +15359,14 @@ fn symbol_index_with_qualified_fill(closure: SymbolIndex, fill: SymbolIndex) ->
   SymbolIndex {
     entries: entries2, global_bare: closure.global_bare, services: closure.services,
     transparent_alias_rep: map_merge(fill.transparent_alias_rep, closure.transparent_alias_rep),
-    type_head_exposures: map_merge(fill.type_head_exposures, closure.type_head_exposures)
+    type_head_exposures: map_merge(fill.type_head_exposures, closure.type_head_exposures),
+    file_modules: map_merge(fill.file_modules, closure.file_modules),
+    module_named_imports: map_merge(fill.module_named_imports, closure.module_named_imports)
   }
 }
 
 data direct_import_export_precedence_note: String = "Direct-selected exports beat transitive leaks (2026-07-16, the #6663 x #6686 main-red). The ancestry union folds each direct import's WHOLE flattened cache (its own exports AND everything it inherited), so a later import's transitively-leaked homonym could overlay an earlier import's OWN export that this module's import statement explicitly selects - import v2.std.algebra { Monoid } lost 'Monoid' to dag-root std.algebra riding v2.std.node's ancestry via std.types, and #6663's field-presence wall read the wrong shape at 28 sites. This overlay re-applies, in import order, each direct import's OWN export surface (interface.env.str_bindings - locals only, never its ancestry) restricted to the names the import statement makes visible (specific_names; is_all = the parent's whole local surface, type-variable names filtered per the std.types precedent). Winner semantics: direct-selected vs transitive leak = direct wins (lexical nearest-wins, the containment ruling one hop out - the sanctioned 1c universe is own declarations UNION direct import lists); direct vs direct = unchanged import-order overlay-wins (the ledgered peer-fork ruling, 2026-07-11: later import wins, conflict stays LEDGERED on binding_forks); leak vs leak = unchanged union winner; KERNEL names are never overridden (overlay_skips_kernel_name: kernel_type_set, the container_type_arity names List/Set/Map/Witness, plus Unit/Optional/Present/Absent) - the kernel scope layer stays positionally above imports per the same ruling, because builtin typing (first, skip, string ops) grounds on kernel identities and the v2 substrate models of those concepts (v2.std.collection List=FreeMonoid, Optional; v2.std.text String) are the known dual-representation debt, resolved corpus-wide by kernel-wins today. KERNEL INSTALLATION IS INDEPENDENT OF IMPORT CARDINALITY (build_ancestry_precedence, 2026-08-31): the kernel overlay applies unconditionally over the import union and both type-env builders consume the one producer - the former shape skipped the overlay when a module had exactly one import, so kernel identity won or lost by ancestry occupancy (a leak-dependent regime: identical imports, different realizations). Full precedence, nearest first: locals > kernel > direct-selected > transitive union. The fork LEDGER is untouched - rows still record every union conflict; this layer only corrects which binding serves lookups. DISSOLVES WHEN namespace Rule-1 lands (containment tree is the naming authority; imports become parse errors) - the union leak itself disappears and this overlay with it. Receipt: direct_import_precedence_over_transitive_leak_test (green arm = selected name resolves the selected module's shape regardless of import order; red control = the field wall still refuses the true shape's missing fields, with that arm's modules placed so the homonym is census-UNAMBIGUOUS by containment (realleaf under the consumer's own parent, leakleaf under a sibling parent) - a census-ambiguous name stands the wall down BY DESIGN (presence_check_census_gate_note), so without that placement the control asserts a diagnostic the gate exists to suppress and silently measures the gate instead of the overlay; ledger arm = the fork row is still recorded)."
 
-fn overlay_skips_kernel_name(name: String) -> Bool {
-  is_kernel_type(name: name)
-    || is_container_type(name: name)
-    || name == "Unit"
-    || name == "Optional"
-    || name == "Present"
-    || name == "Absent"
-}
 
 fn overlay_direct_import_exports(ancestry_str_bindings: Map<String, TypeBinding>, resolved_imports: List<ResolvedImport>, parent_index: Map<String, TypedModule>) -> Map<String, TypeBinding> {
   fold(resolved_imports, init: ancestry_str_bindings, f: (acc, imp) =>
@@ -15384,7 +15430,7 @@ fn build_ancestry_precedence(resolved_imports: List<ResolvedImport>, parent_inde
 
 // THE SEED'S ONE MINT OF THE OPTIONAL COPRODUCT. `T?` resolves to this node in every kernel scope
 // this module builds; it was written out three times, once per builder. It is a mint and not the
-// declaration: a module that uses `T?` need not hold v2.std.optional in its closure. Which
+// declaration: a module that uses `T?` need not hold std.optional in its closure. Which
 // declaration it stands for is gunbc.structural_realization_bindings kernel_mint_declaration_rows,
 // and kernel_mint_shape_diagnostics refuses if the two stop agreeing.
 fn kernel_optional_type_node() -> Node {
@@ -17326,16 +17372,12 @@ type EnumVariantShapeSets {
   positional_payload: Set<String>
 }
 
-fn enum_variant_shape_sets_for_item(acc: EnumVariantShapeSets, item: Node, si: Map<String, NewlineIndex>, type_summaries: Map<String, TypeSummary>) -> EnumVariantShapeSets {
+fn enum_variant_shape_sets_for_item(acc: EnumVariantShapeSets, item: Node, si: Map<String, NewlineIndex>, type_summaries: TypeSummaryIndex) -> EnumVariantShapeSets {
   let item_name = authored_name_at(source_indices: si, node: item)
-  let is_enum = match map_get(type_summaries, item_name) {
-    Present { value: summary } => match summary.repr {
-      EnumRepr { unit_only: _ } => true
-      _ => false
-    }
-    Absent => false
-  }
-  if is_enum {
+  if match is_enum_in_summaries(type_summaries: type_summaries, type_name: item_name) {
+    QuestionDecided { value: v } => v
+    _ => false
+  } {
     item.children |> fold(init: acc, f: (vacc, variant) =>
       let qualified = concat(item_name, "::", authored_name_at(source_indices: si, node: variant))
       let is_positional_payload = variant_has_positional_payload_shape(variant: variant, source_indices: si)
@@ -17351,7 +17393,7 @@ fn enum_variant_shape_sets_for_item(acc: EnumVariantShapeSets, item: Node, si: M
   } else { acc }
 }
 
-fn build_enum_variant_shape_sets(modules: List<TypedModule>, type_summaries: Map<String, TypeSummary>) -> EnumVariantShapeSets {
+fn build_enum_variant_shape_sets(modules: List<TypedModule>, type_summaries: TypeSummaryIndex) -> EnumVariantShapeSets {
   modules |> fold(init: EnumVariantShapeSets { fielded: empty_set(), positional_payload: empty_set() }, f: (acc, m) =>
     m.items |> fold(init: acc, f: (inner, item) =>
       enum_variant_shape_sets_for_item(acc: inner, item: item, si: m.type_env.source_indices, type_summaries: type_summaries)
@@ -17435,7 +17477,7 @@ fn build_emit_graph_info(modules: List<TypedModule>, registry: Map<String, ItemI
     Absent => empty_symbol_index()
   }
   let init = EmitInfoBuildState {
-    type_summaries: empty_map(),
+    type_summaries: empty_type_summary_index(),
     type_decl_items: type_decl_index_with_qualified_names(index: empty_type_decl_index(), qualified_names: qualified_names),
     fn_decl_items: empty_map(),
     structural_alias_fn_surface_names: empty_map(),
diff --git a/src/v1/04_method.dag b/src/v1/04_method.dag
index 0b422320ffb..c9e94d41d3d 100644
--- a/src/v1/04_method.dag
+++ b/src/v1/04_method.dag
@@ -85,8 +85,12 @@ fn pair_declared_names(names: List<String>, templates: List<AlgebraTypeTemplate>
     })
 }
 
-// THE RETURN IS DERIVED TOO, where std.algebra names it by a plain type name. count and length
-// return std.nat.Nat there, and the free-call surface must not restate it: a restated return is a
+// THE RETURN IS DERIVED TOO, where std.algebra names it by a plain type name. count and length do
+// NOT share one return there: the free monoid's count (collection_count_shape) states Int, a declared
+// departure (gunbc.rung_drop collection_count_result_stated_int_until_declared_results_are_judged),
+// while the other count/length rows state std.nat.Nat. Free-call typing here still takes
+// FinitePowerSet's row first, so a free count call is typed Nat. Either way the free-call surface must
+// not restate the return: a restated return is a
 // second authority that one row can drift from while the other stays green -- which is what a
 // mutation of the restated count row showed, with every claim still passing. A template whose
 // return is not a named type has no row here that reads it, and answers error_type so a future
diff --git a/src/v1/05_emit.dag b/src/v1/05_emit.dag
index eb51b348425..2c7619db16e 100644
--- a/src/v1/05_emit.dag
+++ b/src/v1/05_emit.dag
@@ -1,5 +1,10 @@
 module v1.compiler.emit
 
+import std.decl_ref { DeclarationRef, decl_ref }
+import std.compiler_entry {
+  CompilerEntryDriver, RetainedHostCliKernel, DirectIngestDriver, SourceRootEvalDriver, NativeCliDriver, NativeClaimDriver, NativeServeDriver,
+  NativeEffectClass, NativeEffectDeclaration, NativeOutgoingHttp, NativeEffectScope, NativeAdmitAllExcept, NativeAdmitOnly, NativeEffectDenominator
+}
 import std.occurrence_identity { OccurrenceSynthetic, OccurrenceMinted, OccurrencePending, OccurrenceProjected, OccurrenceId, NodeOccurrenceIdentity, occurrence_id_eq }
 
 import std.coercion { TypeRealizationDecision }
@@ -34,13 +39,15 @@ import v1.std.core {
   is_file_transport, is_local_transport, TransportKind, RestTransport, ShellTransport,
   FileTransport, LocalTransport, classify_transport, transport_verb, transport_base_path, transport_has_auth, field_init_operation_modifier,
   operation_modifier_name, with_required_cardinality, tuple_type_name, find_child_named,
-  Connective, Conj, Disj, NoConnective, Arrow, CardOptional
+  Connective, Conj, Disj, NoConnective, Arrow, Required, CardOptional
 }
 
-import v1.compiler.infer_env { TypeEnv, TypeBinding, authored_name, lookup_type_for, GlobalBareLookupState, empty_symbol_index }
+import v1.compiler.infer_env { TypeEnv, TypeBinding, authored_name, lookup_type_for, GlobalBareLookupState, empty_symbol_index, type_reference_declaration_reading, TypeReferenceNamesDeclaration }
 
 import std.induction { InductiveField, SubValueUnknown }
 
+import std.decl_ref { DeclarationRef, decl_ref, declaration_ref_eq }
+
 import v1.compiler.infer_types { resolved_type, is_product_type, child_type_node, emit_map_has, node_is_collection, node_is_keyed_collection, node_is_element_collection, normalize_access_type_node, for_each_element_type_node, is_unit_like, is_declared_container_alias_spelling }
 
 import std.types { is_container_type }
@@ -64,7 +71,8 @@ import v1.compiler.infer_lookup { lookup_func_sig }
 
 import v1.compiler.infer {
   InferScope, is_where_refinement_type,
-  build_params_scope, extend_scope, call_param_caller_labels
+  build_params_scope, extend_scope, call_param_caller_labels,
+  resolved_type_name
 }
 
 import v1.compiler.infer_emit_info { TypeSummary, EmitGraphInfo }
@@ -492,6 +500,49 @@ fn emit_data_fields_json(value: Node, source_indices: Map<String, NewlineIndex>,
   )
 }
 
+// A DATA ROW DECLARED `T?` IS SPELLED AS THE TARGET'S NATIVE OPTION, selected by the row's DECLARED
+// cardinality -- never by the spelling of a variant's parent. Every target realizes `T?` natively
+// (Rust Option, Python None, Go nil), and each one's JSON reading of it is transparent: absent is
+// `null`, present is the payload itself. The caller (v1.compiler.emit_rust emit_data_def_body) asks
+// this only for a row whose declared type carries CardOptional, so an unrelated coproduct that happens
+// to be NAMED Optional keeps its own wire policy (review on gunbc#13202: a leaf-name test here was a
+// second, unrostered authority that would have serialized such a coproduct as null or a bare payload).
+// Within an optional row, a variant literal whose parent IS the declared inner type is a bare T under
+// T?: an implicit lift no declared coercion admits. That arm REFUSES, and it is the refusal exhaustive
+// matching requires -- NOT coverage. It is unreachable: v1.compiler.infer refuses a bare T data
+// initializer under a declared T? (the C5 wall, optional_at_required_obligation_diags at
+// PositionDataInitializer), and an accepted row of that shape takes the typed-expression path, never
+// this serializer (measured on gunbc#13202). Any other one-field variant literal is the option's
+// present arm and is unwrapped to its payload. Control: gunbc.instruments.native_emission_controls optional_data_row_cases
+// -- the present and absent rows. A coproduct merely NAMED Optional
+// cannot be emitted at all today (type rendering decides host-option by leaf name); that case is
+// lane 2K's RED, not covered here. Neither refusal arm (a bare inner-type literal, a present literal
+// with more than one field) is coverage of anything; both exist only so the match is exhaustive.
+fn emit_declared_optional_row_json(value: Node, inner_type_name: String, source_indices: Map<String, NewlineIndex>, variant_wire: Map<String, DataVariantWireSpelling>) -> EmitterOutcome {
+  match value.expr_data {
+    ExprLiteral { value: LitNull } => Emitted { json: "null" }
+    ExprRecordLit { parent_enum: pe } =>
+      match pe {
+        Present { value: parent } =>
+          if qualified_last_segment(name: parent) == qualified_last_segment(name: inner_type_name) {
+            Refused { reason: concat("a data row declared ", inner_type_name, "? is initialized with a bare ", inner_type_name, " literal: no declared coercion lifts T into T? (DESIGN 4, 2026-09-26), so spell it Present { value: .. } or none") }
+          } else {
+            match value.children |> first {
+              Absent => Emitted { json: "null" }
+              Present { value: payload_field } =>
+                if (value.children |> count) == 1 {
+                  emit_data_value_json(value: field_init_node_value(n: payload_field), source_indices: source_indices, variant_wire: variant_wire)
+                } else {
+                  Refused { reason: concat("an optional row's present literal carries ", to_string(value.children |> count), " fields; the option's present arm carries exactly its payload") }
+                }
+            }
+          }
+        Absent => emit_data_value_json(value: value, source_indices: source_indices, variant_wire: variant_wire)
+      }
+    _ => emit_data_value_json(value: value, source_indices: source_indices, variant_wire: variant_wire)
+  }
+}
+
 fn emit_data_value_json(value: Node, source_indices: Map<String, NewlineIndex>, variant_wire: Map<String, DataVariantWireSpelling>) -> EmitterOutcome {
   match value.expr_data {
     ExprLiteral { value: v } => match v {
@@ -1327,6 +1378,7 @@ type ShellResultField {
 type ShellEmissionRefusal
   = ShellOutputKeyNotModeled { key: String }
   | ShellChannelNotRealizedByTarget { key: String, target_name: String }
+  | ShellCapturePolicyInputAbsent { key: String }
 
 // The single authority for which declared output keys the shell realization can
 // answer. Read by the binding; there is no second list.
@@ -1336,17 +1388,11 @@ type ShellEmissionRefusal
 // when no `from` key is authored -- so the two directions of the one procedure
 // (DESIGN section 4) read the same rule rather than agreeing by coincidence.
 //
-// NOT MODELED, named rather than left to be inferred, because each names a fact
-// the emitted realization cannot honestly produce:
-//
-//   the byte-accounting and truncation channels -- stdout/stderr_total_bytes,
-//   _retained_bytes and _truncated. An operation declaring them also declares a
-//   capture policy (gunbc.WitnessBin.Run carries a WitnessStderrCapturePolicy
-//   input), and the emitted `std::process::Command` body implements no policy at
-//   all. Answering `false` and a raw length would not be a conservative default,
-//   it would assert that the declared policy ran and did not truncate. The
-//   next-rung trigger is the emitted realization implementing the declared
-//   capture policy; until then these refuse as a counted capability gap.
+// The byte-accounting and truncation channels are modeled. The rust handler
+// answers them from the declared WitnessStderrCapturePolicy (concurrent drain).
+// Answering `false` and a raw length without running that policy is still
+// forbidden; python and go refuse the three channels until they bind the same
+// handler fact.
 //
 //   the digest channels -- stdout/stderr_digest_hex, which the interpreter
 //   answers and the emitted realization has no digest facility for. The
@@ -1381,23 +1427,36 @@ fn shell_result_channel_key(c: ShellResultChannel) -> String {
 // WHETHER A TARGET CAN REALIZE A CHANNEL IS A FACT ABOUT THE TARGET, and keeping
 // it here rather than in the roster is the whole point of the split.
 //
-// The three capture-accounting channels are REAL shell channels -- the interpreter
-// answers all three from the declared WitnessStderrCapturePolicy -- and no emitted
-// realization implements a capture policy at all. The emitted `Command` body
-// captures whole streams, so `truncated` would always be false and total would
-// always equal retained: not a conservative default but an assertion that the
-// declared policy ran and did not truncate.
-//
-// NEXT-RUNG TRIGGER, at capability grain: the emitted realization implementing the
-// declared capture policy, sufficient to answer truncation and both byte counts
-// from the policy the operation declares. Until then every realizing target
-// refuses these three, and the refusal is LOCATED AT THE FIELD.
-fn shell_channel_realized_by_target(c: ShellResultChannel, target: RenderTarget) -> Bool {
+// The three capture-accounting channels are REAL shell channels. The rust
+// realization handler (v1.compiler.emit_rust emit_shell_call) implements the
+// declared WitnessStderrCapturePolicy: concurrent drain, BoundedTail retains a
+// tail, Complete retains within the host budget
+// (`v1_rt::read_host_budget_bytes` over `v1_rt::resolve_host_budget_join`,
+// the one composer `memory_governor::resolve_host_budget` also calls) or
+// refuses. Python and go still realize no capture policy, so they refuse these
+// three at field grain rather than answering false / raw length (that answer
+// would assert the declared policy ran).
+fn shell_channel_is_capture_accounting(c: ShellResultChannel) -> Bool {
   match c {
-    ShellChanStderrTruncated => false
-    ShellChanStderrTotalBytes => false
-    ShellChanStderrRetainedBytes => false
-    _ => target_renders_shell_transport(target: target)
+    ShellChanStderrTruncated => true
+    ShellChanStderrTotalBytes => true
+    ShellChanStderrRetainedBytes => true
+    _ => false
+  }
+}
+
+fn shell_channel_realized_by_target(c: ShellResultChannel, target: RenderTarget) -> Bool {
+  if shell_channel_is_capture_accounting(c: c) {
+    target_is_rust(target: target)
+  } else {
+    target_renders_shell_transport(target: target)
+  }
+}
+
+fn target_is_rust(target: RenderTarget) -> Bool {
+  match target {
+    Rust => true
+    _ => false
   }
 }
 
@@ -1416,6 +1475,9 @@ fn shell_emission_refusal_fact(refusal: ShellEmissionRefusal) -> String {
     ShellChannelNotRealizedByTarget { key: k, target_name: tn } =>
       concat("shell output channel '", k, "' is a modeled channel that target ", tn,
         " cannot realize -- the emitted realization implements no stderr capture policy, so answering it would assert that the declared policy ran")
+    ShellCapturePolicyInputAbsent { key: k } =>
+      concat("shell output channel '", k,
+        "' is a capture-accounting channel and this operation does not declare a required scalar stderr_capture: WitnessStderrCapturePolicy -- answering it would apply a policy nobody declared")
   }
 }
 
@@ -1531,6 +1593,201 @@ fn bind_operation_transport(t: Node, op_node: Node, source_indices: Map<String,
   }
 }
 
+// ── NATIVE EFFECT REALIZATION ADMISSION ────────────────────────────────────────────────────────
+// docs/plans/demand-engine-program.md section 2.9, GAP A, carrier E3. A native entry (a
+// NativeCliDriver or NativeServeDriver main) hands its entry function one handle per effect the
+// function demands: a reference per `uses` resource and per service it reaches (the parameter list
+// v1.compiler.emit_rust emit_func_params renders). Before this verdict existed the rendered main
+// wrote those handles by hand, and an effect it did not write was found by rustc at the handler
+// call -- or, for a resource trait with no implementor, by the linker -- which is evidence of the
+// gap, not a refusal. This is the refusal: each demanded effect is admitted once, and the rendered
+// main binds exactly the handlers this verdict names and nothing else.
+//
+// SCOPE (two rulings, cited): the operator's 2026-09-16 ruling (plan D11) kept Clock, Network,
+// Entropy and AuthContext out of the native COMPILER route. gentle-dove-36's 2026-10-04 ruling
+// extends it for native SERVICE entries: a NativeServeDriver entry (first consumer, the approval
+// broker) needs a clock reading and outgoing HTTP. That extension adds NO transport. The broker's
+// clock is extdeps.clock Clock, a service bound to the existing shell transport, and its outgoing
+// HTTP is a `transport rest` service bound to the existing REST lowering (RestResult). So a service
+// is admitted when every operation binds through bind_operation_transport, and the handler it names
+// is that binding -- one handler per effect, never a second transport.
+// An effect is identified by the declaration its demand resolves to (module and name), never by a
+// leaf spelling, so a renamed or homonymous service cannot slip out of a denominator.
+type NativeEffectContract
+  = NativeServiceEffect { declaration: DeclarationRef }
+  | NativeResourceEffect { binding: String, declaration: DeclarationRef }
+
+// A resource with no capability is a capability token: it is rendered as a unit struct, and every
+// effect performed under it goes through a service. A resource with capabilities is a trait.
+type NativeEffectHandler
+  = NativeTransportHandler { transports: List<TransportKind> }
+  | NativeCapabilityToken
+
+type NativeEffectUnavailableCause
+  = NativeOperationBindingRefused { operation: String, refusal: TransportBindingRefusal }
+  | NativeResourceTraitHasNoImplementor { capability_count: Int }
+  | NativeEffectDeclarationAbsent
+  | NativeEffectDeclarationAmbiguous { candidates: Int }
+
+type NativeEffectRealizationAdmission
+  = NativeEffectHandlerBound { effect_contract: NativeEffectContract, handler_identity: NativeEffectHandler }
+  | NativeEffectOutsideProductionDenominator { effect_contract: NativeEffectContract, denominator: NativeEffectDenominator }
+  | NativeEffectRealizationUnavailable { effect_contract: NativeEffectContract, cause: NativeEffectUnavailableCause }
+
+// The demanded effect's resolved declaration, or why there is none. A name that resolves to no
+// declaration in the closure, or to more than one, is refused rather than guessed.
+type NativeEffectDeclSite {
+  item: Node
+  module_name: String
+}
+
+type NativeEffectResolution
+  = NativeEffectResolved { site: NativeEffectDeclSite }
+  | NativeEffectUnresolved { cause: NativeEffectUnavailableCause }
+
+fn native_effect_resolution(sites: List<NativeEffectDeclSite>) -> NativeEffectResolution {
+  match sites |> first {
+    Absent => NativeEffectUnresolved { cause: NativeEffectDeclarationAbsent }
+    Present { value: site } =>
+      if (sites |> count) == 1 { NativeEffectResolved { site: site } }
+      else { NativeEffectUnresolved { cause: NativeEffectDeclarationAmbiguous { candidates: sites |> count } } }
+  }
+}
+
+fn native_effect_class_matches(class: NativeEffectClass, declaration: DeclarationRef, transports: List<TransportKind>) -> Bool {
+  match class {
+    NativeEffectDeclaration { declaration: d } =>
+      (d.module_path as String) == (declaration.module_path as String) && (d.decl_name as String) == (declaration.decl_name as String)
+    NativeOutgoingHttp => transports |> any(t => t == RestTransport)
+  }
+}
+
+fn native_effect_outside_denominator(denominator: NativeEffectDenominator, declaration: DeclarationRef, transports: List<TransportKind>) -> Bool {
+  match denominator.scope {
+    NativeAdmitAllExcept { excluded: xs } => xs |> any(x => native_effect_class_matches(class: x, declaration: declaration, transports: transports))
+    NativeAdmitOnly { admitted: xs } => (xs |> any(x => native_effect_class_matches(class: x, declaration: declaration, transports: transports))) == false
+  }
+}
+
+fn bound_operation_transport_kind(bound: BoundOperation) -> TransportKind? {
+  match bound {
+    RestBound { transport: _ } => Present { value: RestTransport }
+    ShellBound { transport: _, result_fields: _ } => Present { value: ShellTransport }
+    FileBound { verb: _, path_template: _, result_fields: _ } => Present { value: FileTransport }
+    LocalBound => Present { value: LocalTransport }
+    BindingRefused { cause: _ } => none
+  }
+}
+
+fn native_transport_kinds_insert(kinds: List<TransportKind>, kind: TransportKind) -> List<TransportKind> {
+  if kinds |> any(k => k == kind) { kinds } else { concat(kinds, [kind]) }
+}
+
+type BoundOperationAt {
+  operation: String
+  bound: BoundOperation
+}
+
+fn native_service_bound_operations(svc: Node, source_indices: Map<String, NewlineIndex>) -> List<BoundOperationAt> {
+  let fallback = service_fallback_transport(item: svc)
+  svc.children |> map(op => BoundOperationAt {
+    operation: authored_name_at(source_indices: source_indices, node: op),
+    bound: bind_operation_transport(t: effective_operation_transport(op_node: op, fallback: fallback), op_node: op, source_indices: source_indices)
+  })
+}
+
+// A service is admitted when every operation binds through bind_operation_transport, and the handler
+// it names is that binding. Whether the route admits it at all is asked first, of the resolved
+// declaration and the transports it binds.
+fn admit_native_service_effect(service: String, resolution: NativeEffectResolution, denominator: NativeEffectDenominator, source_indices: Map<String, NewlineIndex>) -> NativeEffectRealizationAdmission {
+  match resolution {
+    NativeEffectUnresolved { cause: cz } =>
+      NativeEffectRealizationUnavailable { effect_contract: NativeServiceEffect { declaration: decl_ref(module_path: "<unresolved>", decl_name: service) }, cause: cz }
+    NativeEffectResolved { site: site } => {
+      let declaration = decl_ref(module_path: site.module_name, decl_name: service)
+      let contract = NativeServiceEffect { declaration: declaration }
+      let bounds = native_service_bound_operations(svc: site.item, source_indices: source_indices)
+      let transports = bounds |> fold(init: [], f: (acc, b) =>
+        match bound_operation_transport_kind(bound: b.bound) {
+          Present { value: k } => native_transport_kinds_insert(kinds: acc, kind: k)
+          Absent => acc
+        })
+      if native_effect_outside_denominator(denominator: denominator, declaration: declaration, transports: transports) {
+        NativeEffectOutsideProductionDenominator { effect_contract: contract, denominator: denominator }
+      } else {
+        match bounds |> filter(b => bound_operation_transport_kind(bound: b.bound) == none) |> first {
+          Present { value: r } => match r.bound {
+            BindingRefused { cause: cz } => NativeEffectRealizationUnavailable { effect_contract: contract, cause: NativeOperationBindingRefused { operation: r.operation, refusal: cz } }
+            _ => NativeEffectRealizationUnavailable { effect_contract: contract, cause: NativeEffectDeclarationAbsent }
+          }
+          Absent => NativeEffectHandlerBound { effect_contract: contract, handler_identity: NativeTransportHandler { transports: transports } }
+        }
+      }
+    }
+  }
+}
+
+fn admit_native_resource_effect(binding: String, resource: String, resolution: NativeEffectResolution, denominator: NativeEffectDenominator) -> NativeEffectRealizationAdmission {
+  match resolution {
+    NativeEffectUnresolved { cause: cz } =>
+      NativeEffectRealizationUnavailable { effect_contract: NativeResourceEffect { binding: binding, declaration: decl_ref(module_path: "<unresolved>", decl_name: resource) }, cause: cz }
+    NativeEffectResolved { site: site } => {
+      let declaration = decl_ref(module_path: site.module_name, decl_name: resource)
+      let contract = NativeResourceEffect { binding: binding, declaration: declaration }
+      let capability_count = site.item.children |> count
+      if native_effect_outside_denominator(denominator: denominator, declaration: declaration, transports: []) {
+        NativeEffectOutsideProductionDenominator { effect_contract: contract, denominator: denominator }
+      } else if capability_count == 0 {
+        NativeEffectHandlerBound { effect_contract: contract, handler_identity: NativeCapabilityToken }
+      } else {
+        NativeEffectRealizationUnavailable { effect_contract: contract, cause: NativeResourceTraitHasNoImplementor { capability_count: capability_count } }
+      }
+    }
+  }
+}
+
+fn native_declaration_label(d: DeclarationRef) -> String {
+  concat(d.module_path as String, concat(" ", d.decl_name as String))
+}
+
+fn native_effect_contract_label(c: NativeEffectContract) -> String {
+  match c {
+    NativeServiceEffect { declaration: d } => concat("service ", native_declaration_label(d: d))
+    NativeResourceEffect { binding: b, declaration: d } => concat("resource ", concat(native_declaration_label(d: d), concat(" (uses ", concat(b, ")"))))
+  }
+}
+
+fn native_route_label(route: CompilerEntryDriver) -> String {
+  match route {
+    NativeCliDriver => "NativeCliDriver"
+    NativeClaimDriver => "NativeClaimDriver"
+    NativeServeDriver => "NativeServeDriver"
+    SourceRootEvalDriver => "SourceRootEvalDriver"
+    DirectIngestDriver => "DirectIngestDriver"
+    RetainedHostCliKernel => "RetainedHostCliKernel"
+  }
+}
+
+// The refusal text for an admission that is not bound; none for a bound one.
+fn native_effect_admission_refusal(a: NativeEffectRealizationAdmission) -> String? {
+  match a {
+    NativeEffectHandlerBound { effect_contract: _, handler_identity: _ } => none
+    NativeEffectOutsideProductionDenominator { effect_contract: c, denominator: d } =>
+      Present { value: concat(native_effect_contract_label(c: c), concat(" is outside the ", concat(native_route_label(route: d.route), concat(" denominator (ruling: ", concat(native_declaration_label(d: d.ruling), ")"))))) }
+    NativeEffectRealizationUnavailable { effect_contract: c, cause: cz } =>
+      Present { value: concat(native_effect_contract_label(c: c), concat(" has no native realization: ", native_effect_unavailable_fact(cause: cz))) }
+  }
+}
+
+fn native_effect_unavailable_fact(cause: NativeEffectUnavailableCause) -> String {
+  match cause {
+    NativeOperationBindingRefused { operation: op, refusal: r } => concat("operation '", concat(op, concat("' binds no transport: ", transport_binding_refusal_fact(cause: r))))
+    NativeResourceTraitHasNoImplementor { capability_count: n } => concat("it is a resource trait with ", concat(to_string(value: n), " capabilities and no native implementor"))
+    NativeEffectDeclarationAbsent => "its declaration is not in the emitted closure"
+    NativeEffectDeclarationAmbiguous { candidates: n } => concat(to_string(value: n), " declarations in the closure carry its name, so which one it demands is not decided")
+  }
+}
+
 // Target selection, and ONLY target selection -- the Go/Python twin of the Rust
 // `emit_transport_call`. Both consume a BoundOperation decided once; neither
 // classifies a transport, and neither asks what the operation means.
@@ -2577,6 +2834,31 @@ fn file_operation_has_content_input(op_node: Node, source_indices: Map<String, N
   file_operation_has_input(op_node: op_node, name: "content", source_indices: source_indices)
 }
 
+fn required_stderr_capture_policy_declaration() -> DeclarationRef {
+  decl_ref(module_path: "std.shell_stream_capture", decl_name: "WitnessStderrCapturePolicy")
+}
+
+fn param_type_is_stderr_capture_policy_declaration(p: Node, env: TypeEnv) -> Bool {
+  match type_reference_declaration_reading(n: param_node_type_expr(n: p), source_indices: env.source_indices, env: env) {
+    TypeReferenceNamesDeclaration { declaration: d } =>
+      declaration_ref_eq(a: d, b: required_stderr_capture_policy_declaration())
+    _ => false
+  }
+}
+
+fn param_is_required_stderr_capture_policy(p: Node, env: TypeEnv) -> Bool {
+  let ty = param_node_type_expr(n: p)
+  param_node_name_at(n: p, source_indices: env.source_indices) == "stderr_capture"
+    && p.return_cardinality == Required
+    && ty.return_cardinality == Required
+    && !node_is_collection(n: ty, source_indices: env.source_indices)
+    && param_type_is_stderr_capture_policy_declaration(p: p, env: env)
+}
+
+fn operation_declares_required_stderr_capture_policy(op_node: Node, env: TypeEnv) -> Bool {
+  op_node.params |> any(p => param_is_required_stderr_capture_policy(p: p, env: env))
+}
+
 // The channels the interpreter's map_file_outputs answers, read back as the emitter's obligation.
 // Emission and interpretation are one decision procedure run in two directions (DESIGN §4), so
 // this list is the emitted side of that map and diverging from it is a behavioral fork.
@@ -2816,7 +3098,24 @@ fn unmodeled_shell_transport_operation_diagnostics(tm: TypedModule, item: Node,
                 },
                 module_name: module_name)] }
             Present { value: c } =>
-              if shell_channel_realized_by_target(c: c, target: target) { [] }
+              if shell_channel_is_capture_accounting(c: c)
+                && target_is_rust(target: target)
+                && !operation_declares_required_stderr_capture_policy(op_node: op_node, env: env)
+              {
+                [make_error_node(
+                  diagnostic: TransportEmissionNotModeled {
+                    transport_kind: "shell",
+                    service: service_name,
+                    operation: authored_name(env: env, node: op_node),
+                    declaring_module: module_name,
+                    target: render_target_name(target: target),
+                    missing_realization_fact: shell_emission_refusal_fact(refusal: ShellCapturePolicyInputAbsent {
+                      key: shell_result_channel_key(c: c)
+                    }),
+                    span: ch.span
+                  },
+                  module_name: module_name)]
+              } else if shell_channel_realized_by_target(c: c, target: target) { [] }
               else { [make_error_node(
                 diagnostic: TransportEmissionNotModeled {
                   transport_kind: "shell",
diff --git a/src/v1/05_emit_core_support.dag b/src/v1/05_emit_core_support.dag
index 2cb12d4b4a6..7cf39ce937e 100644
--- a/src/v1/05_emit_core_support.dag
+++ b/src/v1/05_emit_core_support.dag
@@ -11,6 +11,7 @@ import v1.std.core {
 
 import v1.compiler.artifact { RenderTarget }
 import gunbc.rust_emitted_edge { EmittedEdge, module_to_filename }
+import gunbc.rust_emitted_crate { EmittedRustCrate }
 
 import v1.compiler.infer_items { ResolvedGraph, TypedModule, leaf_owner_modules_from_registry }
 
@@ -31,6 +32,7 @@ type EmitResult {
   files: List<TextFile>
   diagnostics: List<ErrorNode>
   emitted_edges: List<EmittedEdge>
+  rust_crates: List<EmittedRustCrate>
 }
 
 type TestProjection {
diff --git a/src/v1/05_emit_go.dag b/src/v1/05_emit_go.dag
index f1f31600187..b5d312ff358 100644
--- a/src/v1/05_emit_go.dag
+++ b/src/v1/05_emit_go.dag
@@ -118,11 +118,11 @@ fn go_v2rt_import_path() -> String {
 fn emit_go(typed: ResolvedGraph) -> EmitResult {
   let filename_collisions = module_filename_collision_diagnostics(typed: typed)
   if filename_collisions |> count > 0 {
-    return EmitResult { files: [], diagnostics: filename_collisions, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: filename_collisions, emitted_edges: [], rust_crates: [] }
   }
   let symbol_collisions = emitted_symbol_collision_diagnostics(typed: typed)
   if symbol_collisions |> count > 0 {
-    return EmitResult { files: [], diagnostics: symbol_collisions, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: symbol_collisions, emitted_edges: [], rust_crates: [] }
   }
   let registry = typed.item_registry
   let test_projections = extract_test_projections(typed: typed)
@@ -135,7 +135,7 @@ fn emit_go(typed: ResolvedGraph) -> EmitResult {
   let go_mod = emit_go_mod(module_name: go_emit_module_root())
   let v2rt_file = emit_go_v2rt_module()
   let files = concat([go_mod, v2rt_file], module_files, test_files)
-  EmitResult { files: files, diagnostics: [], emitted_edges: [] }
+  EmitResult { files: files, diagnostics: [], emitted_edges: [], rust_crates: [] }
 }
 
 fn emit_go_v2rt_module() -> TextFile {
diff --git a/src/v1/05_emit_python.dag b/src/v1/05_emit_python.dag
index fc27416a61d..82849e8749f 100644
--- a/src/v1/05_emit_python.dag
+++ b/src/v1/05_emit_python.dag
@@ -109,11 +109,11 @@ import v1.compiler.emit_core_support {
 fn emit_python(typed: ResolvedGraph) -> EmitResult {
   let filename_collisions = module_filename_collision_diagnostics(typed: typed)
   if filename_collisions |> count > 0 {
-    return EmitResult { files: [], diagnostics: filename_collisions, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: filename_collisions, emitted_edges: [], rust_crates: [] }
   }
   let symbol_collisions = emitted_symbol_collision_diagnostics(typed: typed)
   if symbol_collisions |> count > 0 {
-    return EmitResult { files: [], diagnostics: symbol_collisions, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: symbol_collisions, emitted_edges: [], rust_crates: [] }
   }
   let registry = typed.item_registry
   let test_projections = extract_test_projections(typed: typed)
@@ -126,7 +126,7 @@ fn emit_python(typed: ResolvedGraph) -> EmitResult {
   let init_file = emit_init_py(modules: typed.modules)
   let requirements = emit_requirements_txt(has_services: has_service_items(typed: typed))
   let files = concat([requirements, init_file], module_files, test_files)
-  EmitResult { files: files, diagnostics: [], emitted_edges: [] }
+  EmitResult { files: files, diagnostics: [], emitted_edges: [], rust_crates: [] }
 }
 
 fn py_derive_attribute() -> String {
diff --git a/src/v1/05_emit_rust.dag b/src/v1/05_emit_rust.dag
index b5477ac289f..9f298ff07d1 100644
--- a/src/v1/05_emit_rust.dag
+++ b/src/v1/05_emit_rust.dag
@@ -15,7 +15,8 @@ import std.repair_input_origin {
 import std.primitive_projection {
   primitive_identity_runtime_name, primitive_projection_row_for_declaration
 }
-import gunbc.rust_emitted_edge { EmittedEdge, rust_module_emit_filename, rust_prelude_emitted_edges, emitted_edge_target_module, semantic_source_reference_edge, RuntimePrelude, ReexportFacade }
+import gunbc.rust_emitted_crate { EmittedRustCrate, EmittedCrateDependencyDemand }
+import gunbc.rust_emitted_edge { EmittedEdge, rust_module_emit_filename, rust_prelude_emitted_edges, emitted_edge_target_module, semantic_source_reference_edge, declared_import_edge, inline_path_reference_edge, service_runtime_surface_edge, RuntimePrelude, ReexportFacade }
 import gunbc.reference_derived_candidate {
   ReferenceDerivedCandidateDisposition,
   CandidateSurvived,
@@ -55,7 +56,7 @@ import v1.std.core { Unmarked,
   PlainMethodSemantics, AlgebraMethodSemantics, ServiceMethodSemantics, MatchPattern,
   field_binding_pattern, TextFile, ErrorNode, make_error_node, InternalError,
   is_error_diagnostic,
-  UnlistedImportUse, ReferenceDerivedImportProviderUnknown, ReferenceDerivedImportExportUnproven, AmbiguousAnonymousRecordLiteral, EffectfulSelfRecursionUnrealized, AmbiguousReference, SourceSpan, resource_use_resource, UnaryOpKind, Neg, unaryop_operand, StringPart, Text,
+  UnlistedImportUse, ReferenceDerivedImportProviderUnknown, ReferenceDerivedImportExportUnproven, NativeEffectRealizationRefused, AmbiguousAnonymousRecordLiteral, EffectfulSelfRecursionUnrealized, AmbiguousReference, SourceSpan, resource_use_resource, UnaryOpKind, Neg, unaryop_operand, StringPart, Text,
   Interpolation, transport_base_url, transport_has_auth, transport_auth_token,
   transport_auth_header_name, transport_headers, transport_env, transport_method,
   transport_path_template, transport_query, transport_request_body, transport_stdin,
@@ -76,6 +77,7 @@ import v1.std.core { Unmarked,
   LeafOwner, SingleOwner, LeafAmbiguous
 }
 
+import std.compiler_entry { NativeEffectDenominator, native_compiler_route_denominator, native_service_route_denominator, native_claim_route_denominator }
 import v1.compiler.artifact { RenderTarget, Rust, RustModuleRenderSelection, RenderEveryModule, RenderSelectedMirrors }
 import extdeps.languages.rust.emit {
   rust_trait_derive_attr_from_traits,
@@ -184,7 +186,7 @@ import std.types { is_container_type, is_kernel_type, container_template_algebra
 import std.serialization { CoproductWireContract, VariantEncoding, VariantNaming }
 import v1.compiler.infer_env {
   lookup_unit_variant_phantom_type, UnitVariantPhantomPresent, UnitVariantPhantomAbsent, UnitVariantPhantomEvidenceUnavailable,
-  TypeEnv, TypeBinding, authored_name, lookup_type_by_name, lookup_binding_by_name, lookup_type_for, GlobalBareLookupState, GlobalBareUniqueBinding, GlobalBareAmbiguousBinding, empty_symbol_index, binding_declares_span, type_reference_declaration_ref }
+  TypeEnv, TypeBinding, authored_name, lookup_type_by_name, lookup_binding_by_name, lookup_type_for, GlobalBareLookupState, GlobalBareUniqueBinding, GlobalBareAmbiguousBinding, empty_symbol_index, empty_type_env, declaration_ref_of_declaration_node, bare_occurrence_binding, BareOccurrenceBinding, BareOccurrenceDeclaredInItsFile, BareOccurrenceImportedByName, BareOccurrenceIsKernelName, BareOccurrenceUndecided, binding_declares_span, type_reference_declaration_ref }
 import std.operator_realization {
   OperatorRealization, HostOperator, StructuralEquality, StructuralComparison, OperatorRealizationRefused,
   OperandRealization, HostNumericOperand, StructuralOperand, OperandIdentityUnavailable,
@@ -196,7 +198,7 @@ import std.operator_realization {
 }
 import gunbc.structural_realization_bindings { structural_ordering_rows, kernel_grounding_rows, kernel_mint_declaration_rows, kernel_optional_mint_name }
 import gunbc.rust_source_type_bindings { rust_host_option_carrier_declarations }
-import std.literal_elaboration { KernelIntLiteral, kernel_grounding_for, KernelGroundingFound, KernelGroundingAbsent, KernelGroundingAmbiguous, kernel_mint_ownership, DeclarationOwnsTheMint, DeclarationDoesNotOwnTheMint, KernelMintOwnershipAmbiguous }
+import std.literal_elaboration { KernelIntLiteral, kernel_grounding_for, KernelGroundingFound, KernelGroundingAbsent, KernelGroundingAmbiguous, kernel_mint_ownership, DeclarationOwnsTheMint, DeclarationDoesNotOwnTheMint, KernelMintOwnershipAmbiguous, kernel_mint_declaration_for, KernelMintDeclarationFound, KernelMintDeclarationAbsent, KernelMintDeclarationAmbiguous }
 import v1.compiler.infer_types {
   resolved_type, normalize_access_type_node, for_each_element_type_node,
   child_type_node, emit_map_has,
@@ -231,9 +233,9 @@ import v1.compiler.infer {
   caller_resource_requirements, established_resource_binding
 }
 import v1.compiler.infer_emit_info {
-  EmitGraphInfo, TypeSummary, StructRepr, EnumRepr,
+  EmitGraphInfo, TypeSummary, StructRepr, EnumRepr, TypeSummaryIndex, TypeSummaryLookup, TypeSummaryFound, TypeSummaryLeafAmbiguous, TypeSummaryNotDeclared, TypeSummaryQuestion, QuestionDecided, QuestionNameAmbiguous, QuestionNotDeclared, type_summary_lookup, type_summary_values, type_summary_of_reference, type_summary_answer, type_summary_decided, summary_is_enum_with_variant, type_summary_keys_of_leaf,
   lookup_emit_type_summary, empty_emit_graph_info,
-  TypeDeclIndex, type_decl_identity,
+  TypeDeclIndex, type_decl_identity, type_decl_identities_of_leaf,
   TypeDeclResolved, TypeDeclLeafAmbiguous, TypeDeclKernelSpellingUndecided, TypeDeclNotDeclared, resolve_type_decl_reference,
   emit_info_with_fn_type_context, emit_info_with_fn_return, emit_info_with_expected_type,
   is_enum_in_summaries, find_variant_parent, is_known_variant,
@@ -256,7 +258,7 @@ import v1.compiler.emit {
   emit_lambda_params, emit_null_coalesce, emit_list_lit_expr, emit_shared_expr,
   emit_typed_cast_shared, emit_string_literal, emit_simple_expr, escape_rust_interp_text,
   module_emit_scope, scope_after_expr, lookup_item_by_identity, has_nested_records_node,
-  emit_data_value_json, EmitterOutcome, Emitted, Refused, is_null_coalesce, has_service_items,
+  emit_data_value_json, emit_declared_optional_row_json, EmitterOutcome, Emitted, Refused, is_null_coalesce, has_service_items,
   order_typed_call_args_from_semantics, is_tco_eligible, is_self_recursive, emit_shared_tco_expr,
   tco_reassign_core, shared_tco_reassign, tco_loop_slot_name, tco_loop_iteration_lets, service_fallback_transport,
   effective_operation_transport, ServiceFieldSet, compute_service_fields, service_field_decls,
@@ -267,8 +269,12 @@ import v1.compiler.emit {
   ShellResultField, ShellResultChannel, ShellChanStdout, ShellChanStderr,
   ShellChanExitSuccess, ShellChanExitCode, ShellChanStdoutLines,
   ShellChanStderrTruncated, ShellChanStderrTotalBytes, ShellChanStderrRetainedBytes,
-  ShellChannelNotRealizedByTarget, shell_emission_refusal_fact, shell_result_channel_key,
+  ShellChannelNotRealizedByTarget, ShellCapturePolicyInputAbsent, shell_emission_refusal_fact, shell_result_channel_key,
+  shell_channel_is_capture_accounting, operation_declares_required_stderr_capture_policy,
   bind_operation_transport, transport_binding_refusal_fact,
+  NativeEffectRealizationAdmission, NativeEffectHandlerBound, NativeEffectOutsideProductionDenominator, NativeEffectRealizationUnavailable,
+  NativeServiceEffect, NativeResourceEffect, NativeTransportHandler, NativeCapabilityToken, NativeEffectDeclSite, native_effect_resolution,
+  admit_native_service_effect, admit_native_resource_effect, native_effect_admission_refusal,
   FileVerb, FileRead, FileWrite, FileWriteOwnerOnly, FileWriteCreateNew, FileWriteCreateNewWithMode, FileLinkCreateNew, FileDelete, FileList,
   FileResultField, FileResultChannel, FileChanSuccess, FileChanByteCount,
   FileChanPath, FileChanError, FileChanErrorKind, FileChanContent
@@ -300,7 +306,7 @@ fn render_rust_applied_via_emit_info(n: Node, shared_types: Set<String>, source_
 
 fn render_rust_type(n: Node, shared_types: Set<String>, source_indices: Map<String, NewlineIndex>, emit_info: EmitGraphInfo) -> String {
   if is_host_text_carrier_type(n: n, source_indices: source_indices) { return rust_carrier_optional_wrap(n: n, rendered: "String") }
-  if is_host_optional_carrier_type(n: n, source_indices: source_indices) {
+  if is_host_optional_carrier_type(n: n, source_indices: source_indices, env: emit_info.fn_type_env) {
     return render_rust_optional_carrier_applied(n: n, generic_param_names: emit_info.fn_generic_param_names, shared_types: shared_types, source_indices: source_indices, variant_to_enum: emit_info.variant_to_enum, env: emit_info.fn_type_env)
   }
   if is_host_diagnostics_carrier_type(n: n, source_indices: source_indices) {
@@ -308,7 +314,7 @@ fn render_rust_type(n: Node, shared_types: Set<String>, source_indices: Map<Stri
   }
   match n.inferred {
     Present { value: TypeVariable { id: tv } } =>
-      if type_var_in_fn_generic_scope(id: tv, generic_param_names: emit_info.fn_generic_param_names) { to_pascal(name: tv) } else { "_" }
+      if type_var_in_fn_generic_scope(id: tv, generic_param_names: emit_info.fn_generic_param_names) { rust_carrier_optional_wrap(n: n, rendered: to_pascal(name: tv)) } else { "_" }
     _ =>
       match find_property(props: n.properties, prop_name: "__applied_type_args", source_indices: source_indices) {
         Present { value: applied } =>
@@ -395,7 +401,7 @@ fn render_rust_arrow_type_in_scope(n: Node, generic_param_names: List<String>, s
 // documented unresolved-reference shape), so every identity-keyed arm ahead of this one answers
 // about the wrong declaration. Rendering the bare name can only bind where the emitted module
 // declares or imports that name, and for the String spelling neither holds: kernel names are never
-// overridden by imports (#9813, v1.compiler.infer overlay_skips_kernel_name), so the use-line that
+// overridden by imports (#9813, v1.compiler.infer_env overlay_skips_kernel_name), so the use-line that
 // would bind the alias is dropped by import_name_resolves_to_host_realized_kernel_scalar and the
 // bare token binds the prelude String -- while every value position renders the same carrier
 // Rc<Vec<i64>>. That is the v2_compiler_tokenize.rs E0308 family on the XL-N board (41 of 72),
@@ -430,7 +436,7 @@ fn rust_overlayless_alias_leaf_requires_peel(env: TypeEnv, n: Node) -> Bool {
 
 fn render_rust_type_without_applied_binding(n: Node, shared_types: Set<String>, source_indices: Map<String, NewlineIndex>, emit_info: EmitGraphInfo) -> String {
   if is_host_text_carrier_type(n: n, source_indices: source_indices) { return rust_carrier_optional_wrap(n: n, rendered: "String") }
-  if is_host_optional_carrier_type(n: n, source_indices: source_indices) {
+  if is_host_optional_carrier_type(n: n, source_indices: source_indices, env: emit_info.fn_type_env) {
     return render_rust_optional_carrier_applied(n: n, generic_param_names: emit_info.fn_generic_param_names, shared_types: shared_types, source_indices: source_indices, variant_to_enum: emit_info.variant_to_enum, env: emit_info.fn_type_env)
   }
   if is_host_diagnostics_carrier_type(n: n, source_indices: source_indices) {
@@ -544,10 +550,6 @@ fn is_host_freemonoid_vec_alias(name: String) -> Bool {
   name == "FreeMonoid"
 }
 
-fn is_host_optional_carrier_alias(name: String) -> Bool {
-  name == kernel_optional_mint_name
-}
-
 // THE NAME PROJECTION OF ONE ROW, not a second table. Which declarations the Rust target realizes
 // as its host option is gunbc.rust_source_type_bindings rust_host_option_carrier_declarations; the
 // sites that still hold only a type's NAME (type rendering, and pattern arms inference did not
@@ -558,12 +560,39 @@ fn is_host_diagnostics_carrier_alias(name: String) -> Bool {
   rust_host_option_carrier_declarations |> any(d => (d.decl_name as String) == name)
 }
 
-fn is_grounded_coproduct_native_alias(name: String) -> Bool {
-  is_host_freemonoid_vec_alias(name: name)
-    || is_host_optional_carrier_alias(name: name)
-    || is_host_diagnostics_carrier_alias(name: name)
+// WHETHER A DECLARATION IS REALIZED AS A HOST CARRIER (Vec for FreeMonoid, Option for the kernel
+// optional and the diagnostics carrier) is a fact about the declaration: whether this declaration is realized as a host carrier is a fact about it, so a coproduct
+// a module declares as `Optional` is not the host option (declaration_owns_host_option).
+fn declaration_is_grounded_coproduct_native_alias(module_path: String, decl_name: String) -> Bool {
+  if contains(decl_name, ".") {
+    let segments = decl_name |> split(delimiter: ".")
+    declaration_is_grounded_coproduct_native_alias(module_path: segments |> take((segments |> count) - 1) |> join(separator: "."), decl_name: qualified_last_segment(name: decl_name))
+  } else {
+  is_host_freemonoid_vec_alias(name: decl_name)
+    || declaration_owns_host_option(module_path: module_path, decl_name: decl_name)
+    || declaration_ref_in_list(target: decl_ref(module_path: module_path, decl_name: decl_name), refs: rust_host_option_carrier_declarations)
+  }
+}
+
+// A parent named only by its leaf, reached through a module that may re-export rather than declare
+// it: it is a host carrier when every declaration of that leaf in the closure is one. Nothing is
+// chosen, so nothing is guessed; where declarations disagree the reader keeps its own declaring-module
+// check.
+fn every_declarer_is_grounded_coproduct_native_alias(decls: TypeDeclIndex, name: String) -> Bool {
+  let identities = type_decl_identities_of_leaf(index: decls, leaf: qualified_last_segment(name: name))
+  (identities |> count) > 0 && identities |> all(identity =>
+    declaration_is_grounded_coproduct_native_alias(module_path: "", decl_name: identity)
+  )
+}
+
+// A TypeSummary key is `<module>.<name>`: the identity type_decl_identity minted for it.
+fn summary_declares_grounded_coproduct_native_alias(summary: TypeSummary) -> Bool {
+  let segments = summary.key |> split(delimiter: ".")
+  let module_path = segments |> take((segments |> count) - 1) |> join(separator: ".")
+  declaration_is_grounded_coproduct_native_alias(module_path: module_path, decl_name: summary.name)
 }
 
+
 // A COPRODUCT THE CORPUS BINDS NATIVELY (gunbc.rust_source_type_bindings, keyed on the declaration)
 // REALIZES ONLY AS ITS HOST SPELLING: no enum is emitted for it, so there is no enum to glob-import
 // and no bridge to convert from. Its arms reach the target as the carrier's values
@@ -579,8 +608,69 @@ fn rust_declaration_realizes_as_native_alias(module_path: String, decl_name: Str
   }
 }
 
-fn is_host_optional_carrier_type(n: Node, source_indices: Map<String, NewlineIndex>) -> Bool {
-  authored_name_at(source_indices: source_indices, node: n) == "Optional" && n.children |> count > 0
+// WHICH DECLARATION IS THE HOST OPTION is a fact about the declaration, read from the one row that
+// binds it: the declaration the kernel optional mint stands for
+// (gunbc.structural_realization_bindings kernel_mint_declaration_rows), the same reading
+// host_option_arm_reading makes for a pattern arm. A declaration that is not that one is not the host
+// option, whatever it is named: a coproduct a module declares as `Optional` emits as its own enum.
+// Two rows binding the kernel optional decide no declaration, and none is answered as the host
+// option here (the pattern side refuses that state, HostOptionArmBindingAmbiguous).
+fn declaration_owns_host_option(module_path: String, decl_name: String) -> Bool {
+  match kernel_mint_ownership(rows: kernel_mint_declaration_rows, minted_name: kernel_optional_mint_name, declaration: decl_ref(module_path: module_path, decl_name: decl_name)) {
+    DeclarationOwnsTheMint => true
+    DeclarationDoesNotOwnTheMint => false
+    KernelMintOwnershipAmbiguous { row_count: _ } => false
+  }
+}
+
+// A type reference that carries the declaration it names is decided by that declaration. A reference
+// resolved to a declaration's STRUCTURE (lookup_type_for hands the emitter the declaration node itself,
+// unstamped) is decided by WHICH declaration it is, read through the join every emitter reader of a
+// declaration node uses (v1.compiler.infer_env declaration_ref_of_declaration_node: the declaring span
+// against the corpus symbol index), so a coproduct another module declares as `Optional` is never read
+// as the host option. A reference that is neither is decided by unstamped_reference_is_host_option.
+// AN UNSTAMPED REFERENCE is decided by the one occurrence decision the type-declaration router reads
+// (v1.compiler.infer_env bare_occurrence_binding: own file, then named import, then kernel -- the
+// typechecker's lookup_binding order): the declaration that arm names, or on the kernel arm the
+// declaration the kernel mint names. No leaf comparison stands in for any of them.
+fn unstamped_reference_is_host_option(n: Node, source_indices: Map<String, NewlineIndex>, env: TypeEnv) -> Bool {
+  let leaf = authored_name_at(source_indices: source_indices, node: n)
+  match bare_occurrence_binding(index: env.symbol_index, name: leaf, reference: n) {
+    BareOccurrenceDeclaredInItsFile { declaration: decl } => declaration_node_owns_host_option(decl: decl, source_indices: source_indices, env: env)
+    BareOccurrenceImportedByName { module_path: from_module, declaration: decl } =>
+      declaration_owns_host_option(module_path: from_module, decl_name: leaf) || declaration_node_owns_host_option(decl: decl, source_indices: source_indices, env: env)
+    BareOccurrenceIsKernelName =>
+      match kernel_mint_declaration_for(rows: kernel_mint_declaration_rows, minted_name: leaf) {
+        KernelMintDeclarationFound { declaration: d } => declaration_owns_host_option(module_path: d.module_path as String, decl_name: d.decl_name as String)
+        KernelMintDeclarationAbsent => false
+        KernelMintDeclarationAmbiguous { row_count: _ } => false
+      }
+    BareOccurrenceUndecided => false
+  }
+}
+
+fn declaration_node_owns_host_option(decl: Node, source_indices: Map<String, NewlineIndex>, env: TypeEnv) -> Bool {
+  match declaration_ref_of_declaration_node(decl: decl, source_indices: source_indices, env: env) {
+    Present { value: d } => declaration_owns_host_option(module_path: d.module_path as String, decl_name: d.decl_name as String)
+    Absent => false
+  }
+}
+
+fn is_host_optional_carrier_type(n: Node, source_indices: Map<String, NewlineIndex>, env: TypeEnv) -> Bool {
+  match n.declaration {
+    Present { value: d } =>
+      match d.field {
+        WholeDeclaration => declaration_owns_host_option(module_path: d.module_path as String, decl_name: d.decl_name as String)
+        _ => false
+      }
+    Absent =>
+      let is_declaration_structure = (n.module_item_kind == ModuleItemTypeDeclaration || n.connective == Disj) && n.ident_span != none
+      let declared = if is_declaration_structure { declaration_ref_of_declaration_node(decl: n, source_indices: source_indices, env: env) } else { none }
+      match declared {
+        Present { value: d } => declaration_owns_host_option(module_path: d.module_path as String, decl_name: d.decl_name as String)
+        Absent => unstamped_reference_is_host_option(n: n, source_indices: source_indices, env: env)
+      }
+  }
 }
 
 fn is_host_diagnostics_carrier_type(n: Node, source_indices: Map<String, NewlineIndex>) -> Bool {
@@ -1441,7 +1531,7 @@ fn render_rust_applied_type_arg(n: Node, generic_param_names: List<String>, shar
   } else {
     match n.inferred {
       Present { value: TypeVariable { id: tv } } =>
-        if type_var_in_fn_generic_scope(id: tv, generic_param_names: generic_param_names) { to_pascal(name: tv) } else { "_" }
+        if type_var_in_fn_generic_scope(id: tv, generic_param_names: generic_param_names) { rust_carrier_optional_wrap(n: n, rendered: to_pascal(name: tv)) } else { "_" }
       _ =>
         match rust_render_checkpoint_scalar_bare(n: n, source_indices: source_indices, shared_types: shared_types, env: env) {
           Present { value: scalar } => scalar
@@ -1453,7 +1543,7 @@ fn render_rust_applied_type_arg(n: Node, generic_param_names: List<String>, shar
 
 fn render_rust_applied_type(n: Node, generic_param_names: List<String>, shared_types: Set<String>, source_indices: Map<String, NewlineIndex>, variant_to_enum: Map<String, String>, env: TypeEnv) -> String {
   if is_host_text_carrier_type(n: n, source_indices: source_indices) { return rust_carrier_optional_wrap(n: n, rendered: "String") }
-  if is_host_optional_carrier_type(n: n, source_indices: source_indices) {
+  if is_host_optional_carrier_type(n: n, source_indices: source_indices, env: env) {
     return render_rust_optional_carrier_applied(n: n, generic_param_names: generic_param_names, shared_types: shared_types, source_indices: source_indices, variant_to_enum: variant_to_enum, env: env)
   }
   if is_host_diagnostics_carrier_type(n: n, source_indices: source_indices) {
@@ -1644,7 +1734,7 @@ fn render_rust_decl_type(n: Node, generic_param_names: List<String>, shared_type
     return render_rust_arrow_type_in_scope(n: n, generic_param_names: generic_param_names, shared_types: shared_types, source_indices: source_indices, variant_to_enum: variant_to_enum, env: env)
   }
   if is_host_text_carrier_type(n: n, source_indices: source_indices) { return rust_carrier_optional_wrap(n: n, rendered: "String") }
-  if is_host_optional_carrier_type(n: n, source_indices: source_indices) {
+  if is_host_optional_carrier_type(n: n, source_indices: source_indices, env: env) {
     return render_rust_optional_carrier_applied(n: n, generic_param_names: generic_param_names, shared_types: shared_types, source_indices: source_indices, variant_to_enum: variant_to_enum, env: env)
   }
   if is_host_diagnostics_carrier_type(n: n, source_indices: source_indices) {
@@ -1683,7 +1773,7 @@ fn render_rust_decl_type(n: Node, generic_param_names: List<String>, shared_type
         Present { value: exact } => rust_carrier_optional_wrap(n: n, rendered: exact)
         Absent =>
       if n.connective == NoConnective && n.children |> count == 0 && (generic_param_names |> any(g => g == name)) {
-        to_pascal(name: name)
+        rust_carrier_optional_wrap(n: n, rendered: to_pascal(name: name))
       } else if bare_native_alias != none {
         rust_carrier_optional_wrap(n: n, rendered: bare_native_alias.value)
       } else if n.connective == NoConnective && n.children |> count == 0 && applied_prop == none && is_host_text_carrier_type(n: n, source_indices: source_indices) {
@@ -1755,6 +1845,12 @@ fn rust_fn_sig_preserves_authored_alias_leaf(name: String, decision: TypeRealiza
   }
 }
 
+// A TYPE PARAMETER CARRIES ITS OWN CARDINALITY, AND EVERY ARM THAT SPELLS ONE WRAPS IT HERE. `K?` on a
+// declared parameter is a leaf whose return_cardinality is CardOptional. The four arms that spell a
+// type parameter -- the declared-generic leaf in render_rust_decl_type and in
+// render_rust_alias_rhs_type, and the TypeVariable arms of render_rust_type and render_rust_applied_type_arg
+// -- returned the bare name, so `get: K?` in a generic record emitted `K`: an absent value had no
+// representation (gunbc.recurring_failure_mode optional_type_parameter_emitted_without_its_cardinality).
 fn rust_carrier_optional_wrap(n: Node, rendered: String) -> String {
   let is_optional = n.return_cardinality == CardOptional
   if is_optional {
@@ -1766,7 +1862,7 @@ fn rust_carrier_optional_wrap(n: Node, rendered: String) -> String {
 
 fn render_rust_fn_sig_type(n: Node, generic_param_names: List<String>, shared_types: Set<String>, source_indices: Map<String, NewlineIndex>, variant_to_enum: Map<String, String>, env: TypeEnv) -> String {
   if is_host_text_carrier_type(n: n, source_indices: source_indices) { return rust_carrier_optional_wrap(n: n, rendered: "String") }
-  if is_host_optional_carrier_type(n: n, source_indices: source_indices) {
+  if is_host_optional_carrier_type(n: n, source_indices: source_indices, env: env) {
     return render_rust_optional_carrier_applied(n: n, generic_param_names: generic_param_names, shared_types: shared_types, source_indices: source_indices, variant_to_enum: variant_to_enum, env: env)
   }
   if is_host_diagnostics_carrier_type(n: n, source_indices: source_indices) {
@@ -1928,7 +2024,7 @@ fn render_rust_alias_rhs_type(n: Node, generic_param_names: List<String>, shared
   }
   let name = authored_name_at(source_indices: source_indices, node: n)
   if n.connective == NoConnective && n.children |> count == 0 && (generic_param_names |> any(g => g == name)) {
-    to_pascal(name: name)
+    rust_carrier_optional_wrap(n: n, rendered: to_pascal(name: name))
   } else if n.connective == NoConnective && n.children |> count == 0 {
     match rust_exact_reference_spelling(n: n, source_indices: source_indices, env: scope.type_env) {
       Present { value: exact } => exact
@@ -3138,7 +3234,7 @@ fn emit_rust_init_block_stmts(remaining: List<Node>, text: List<String>,
 fn rust_qualify_type_leaf_name(name: String, variant_to_enum: Map<String, String>) -> String {
   match map_get(variant_to_enum, name) {
     Present { value: parent } =>
-      if parent != "" { rust_variant_path(parent: parent, rust_name: name) } else { name }
+      if parent != "" { rust_variant_path(parent: qualified_last_segment(name: parent), rust_name: name) } else { name }
     Absent => name
   }
 }
@@ -3246,7 +3342,7 @@ fn maybe_mark_shared_type(acc: Set<String>, summary: TypeSummary, recursive_type
     StructRepr => true
     EnumRepr { unit_only: unit_only } => unit_only == false
   }
-  if is_grounded_coproduct_native_alias(name: summary.name) {
+  if summary_declares_grounded_coproduct_native_alias(summary: summary) {
     acc
   } else if needs_sharing && !is_type_constant(summary: summary, recursive_type_set: recursive_type_set) {
     set_insert(acc, summary.name)
@@ -3255,11 +3351,30 @@ fn maybe_mark_shared_type(acc: Set<String>, summary: TypeSummary, recursive_type
   }
 }
 
-fn build_shared_types(type_summaries: Map<String, TypeSummary>, recursive_type_set: Set<String>, target: RenderTarget) -> Set<String> {
+// THE SHARED SET IS KEYED BY SPELLING, and the declaration and every use of a type read it by that
+// spelling, so what keeps an emission consistent is that one spelling has one answer. A spelling two
+// declarations own is shared only when EVERY declaration of it would be: a coproduct a module
+// declares as `Optional` beside the host option (which is never shared) is then unshared at its
+// declaration and at every use alike, and the host Option is not wrapped because a same-leaf type
+// elsewhere needs sharing. The set is one of the indexes
+// gunbc.recurring_failure_mode emitter_index_keyed_on_a_type_leaf_takes_the_last_declarer still
+// names as leaf-keyed; this rule is what makes its leaf answer independent of fold order.
+fn shared_by_every_declarer(type_summaries: TypeSummaryIndex, name: String, recursive_type_set: Set<String>, target_needs_sharing: Bool) -> Bool {
+  type_summary_keys_of_leaf(index: type_summaries, leaf: name) |> all(key =>
+    match type_summary_decided(index: type_summaries, key: key) {
+      Present { value: summary } => set_contains(maybe_mark_shared_type(acc: empty_set(), summary: summary, recursive_type_set: recursive_type_set, target_needs_sharing: target_needs_sharing), name)
+      Absent => true
+    }
+  )
+}
+
+fn build_shared_types(type_summaries: TypeSummaryIndex, recursive_type_set: Set<String>, target: RenderTarget) -> Set<String> {
 
   let sharing = sharing_for_target(target: target)
-  let user_shared = map_values(type_summaries) |> fold(init: empty_set(), f: (acc, summary) =>
-    maybe_mark_shared_type(acc: acc, summary: summary, recursive_type_set: recursive_type_set, target_needs_sharing: sharing.needs_sharing)
+  let user_shared = type_summary_values(index: type_summaries) |> fold(init: empty_set(), f: (acc, summary) =>
+    if shared_by_every_declarer(type_summaries: type_summaries, name: summary.name, recursive_type_set: recursive_type_set, target_needs_sharing: sharing.needs_sharing) {
+      maybe_mark_shared_type(acc: acc, summary: summary, recursive_type_set: recursive_type_set, target_needs_sharing: sharing.needs_sharing)
+    } else { acc }
   )
 
   let collection_keys = sorted_map_keys(rust_container_templates)
@@ -3585,19 +3700,19 @@ fn emit_rust_selected(typed: ResolvedGraph, selection: RustModuleRenderSelection
   let shared_types = emit_info.shared_types
   let anonymous_record_diags = ctx.anonymous_record_diags
   if anonymous_record_diags |> count > 0 {
-    return EmitResult { files: [], diagnostics: anonymous_record_diags, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: anonymous_record_diags, emitted_edges: [], rust_crates: [] }
   }
   let effectful_recursion_diags = ctx.effectful_recursion_diags
   if effectful_recursion_diags |> count > 0 {
-    return EmitResult { files: [], diagnostics: effectful_recursion_diags, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: effectful_recursion_diags, emitted_edges: [], rust_crates: [] }
   }
   let filename_collisions = module_filename_collision_diagnostics(typed: typed)
   if filename_collisions |> count > 0 {
-    return EmitResult { files: [], diagnostics: filename_collisions, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: filename_collisions, emitted_edges: [], rust_crates: [] }
   }
   let symbol_collisions = emitted_symbol_collision_diagnostics(typed: typed)
   if symbol_collisions |> count > 0 {
-    return EmitResult { files: [], diagnostics: symbol_collisions, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: symbol_collisions, emitted_edges: [], rust_crates: [] }
   }
   let test_projections = ctx.test_projections
   let module_emissions = typed.modules
@@ -3630,13 +3745,19 @@ fn emit_rust_selected(typed: ResolvedGraph, selection: RustModuleRenderSelection
   let has_services = has_service_items(typed: typed)
   let has_pipeline = compiler_pipeline_entry_is_retained_host(modules: typed.modules)
   let crate_name = if has_pipeline { "v1_compiler" } else { "v1_compiled" }
-  let cargo = emit_cargo_toml(
+  let rust_crate = EmittedRustCrate {
     crate_name: crate_name,
     demand: EmittedCrateDependencyDemand {
       renders_clap_cli: has_pipeline,
       renders_async_services: has_services || closure_renders_async_trait_resource(typed: typed)
-    })
-  let main_file = emit_main_rs(modules: typed.modules, has_services: has_services, crate_name: crate_name, registry: ctx.registry)
+    }
+  }
+  let native_effects = native_entry_effects(modules: typed.modules, registry: ctx.registry)
+  let native_effect_refusals = native_entry_effect_diagnostics(effects: native_effects, modules: typed.modules)
+  if native_effect_refusals |> count > 0 {
+    return EmitResult { files: [], diagnostics: native_effect_refusals, emitted_edges: [], rust_crates: [] }
+  }
+  let main_file = emit_main_rs(modules: typed.modules, has_services: has_services, crate_name: crate_name, effects: native_effects)
   let cli_dispatch_file = if has_pipeline { [emit_gunbc_cli_dispatch_generated(crate_name: crate_name)] } else { [] }
   let rt_file = emit_v2_rt_module()
   let compiler_tests_file = if has_pipeline { [emit_compiler_tests_module()] } else { [] }
@@ -3667,15 +3788,59 @@ fn emit_rust_selected(typed: ResolvedGraph, selection: RustModuleRenderSelection
   )
   let lib_file = emit_lib_rs_from_paths(all_module_paths: all_mod_paths, has_compiler_tests: has_pipeline)
   let emitted_paths = concat(
-    [cargo.path, lib_file.path, main_file.path],
+    [lib_file.path, main_file.path],
     all_mod_paths,
     compiler_tests_file |> map(f => f.path),
     test_file_paths
   )
   let population_manifest = emit_emitted_population_manifest(paths: emitted_paths)
-  let emitted_files = concat([cargo, lib_file, main_file], all_mod_files, compiler_tests_file, test_files)
+  let emitted_files = concat([lib_file, main_file], all_mod_files, compiler_tests_file, test_files)
   let files = concat(emitted_files, [population_manifest])
-  EmitResult { files: files, diagnostics: module_refusals, emitted_edges: published_module_emissions |> flat_map(e => e.emitted_edges) }
+  let module_files_with_tests = concat(all_mod_files, compiler_tests_file)
+  let module_basenames = module_files_with_tests |> fold(init: empty_map(), f: (acc, f) => map_insert(acc, rust_emitted_module_basename(path: f.path), true))
+  let inline_edges = module_files_with_tests |> flat_map(f => emitted_inline_path_edges(file: f, module_basenames: module_basenames))
+  EmitResult {
+    files: files,
+    diagnostics: module_refusals,
+    emitted_edges: concat(published_module_emissions |> flat_map(e => e.emitted_edges), inline_edges),
+    rust_crates: [rust_crate]
+  }
+}
+
+fn rust_emitted_module_basename(path: String) -> String {
+  replace(replace(path, rust_source_root(), ""), rust_source_ext(), "")
+}
+
+fn rust_line_is_use_declaration(line: String) -> Bool {
+  starts_with(s: line, prefix: "use ") || starts_with(s: line, prefix: "pub use ") || starts_with(s: line, prefix: "pub(crate) use ")
+}
+
+// THE INLINE PATHS AN EMITTED MODULE'S CODE WRITES, RETURNED AS SOURCE EDGES. The renderers write a
+// resolved reference to another module's declaration as `crate::<module>::<item>` (emit_typed_call,
+// qualified types and values, rust_declaration_path) and return only the text, so the edge is read
+// back off the code they wrote: every `crate::<segment>` whose segment is a module of this emission.
+// That is the population rustc resolves, so a reference the source never imported -- and a
+// synthesized stub's paths -- reach the partition like any other. Comment lines and string literals
+// are not code (gunbc.recurring_failure_mode a_string_literal_attests_an_emitted_reference); use
+// declarations are excluded because they are returned with their own provenance, and the
+// reverse-edge refusal must keep judging them as emitter edges. NEXT RUNG: the renderers return the
+// edges they write (gunbc.guarantee_stall emitted_inline_crate_path_edges_unreturned_stall), and this
+// reading of the text dissolves.
+fn emitted_inline_path_edges(file: TextFile, module_basenames: Map<String, Bool>) -> List<EmittedEdge> {
+  let from = rust_emitted_module_basename(path: file.path)
+  let code = rust_code_outside_string_literals(s: file.content
+    |> split(delimiter: "\n")
+    |> filter(line => {
+      let t = trim(line)
+      !starts_with(s: t, prefix: "//") && !rust_line_is_use_declaration(line: t)
+    })
+    |> join(separator: "\n"))
+  let targets = rust_identifier_tokens(s: replace(code, "crate::", " @crate@"))
+    |> filter(t => starts_with(s: t, prefix: "@crate@"))
+    |> map(t => replace(t, "@crate@", ""))
+  unique_strings(items: targets)
+    |> filter(t => t != from && emit_map_has(m: module_basenames, key: t))
+    |> map(t => inline_path_reference_edge(from: from, to_module: t))
 }
 
 // A MODULE'S EMITTED PATH, read by the renderer and by every population-denominated aggregate that
@@ -4159,7 +4324,7 @@ fn emit_inferred_type_leaf_name(n: Node, source_indices: Map<String, NewlineInde
   }
 }
 
-fn anonymous_record_lit_surface_name(n: Node, source_indices: Map<String, NewlineIndex>, type_summaries: Map<String, TypeSummary>) -> String {
+fn anonymous_record_lit_surface_name(n: Node, source_indices: Map<String, NewlineIndex>, type_summaries: TypeSummaryIndex) -> String {
   let lit_field_names = n.children |> map(f => field_init_node_name_at(n: f, source_indices: source_indices))
   let field_type_hints = fold(n.children, init: empty_map(), f: (acc, f) =>
     let fname = field_init_node_name_at(n: f, source_indices: source_indices)
@@ -4178,12 +4343,12 @@ fn anonymous_record_lit_surface_name(n: Node, source_indices: Map<String, Newlin
         Absent =>
           let rt = resolved_type(n: n)
           let rt_name = authored_name_at(source_indices: source_indices, node: rt)
-          if rt.ident_span != none && map_contains_key(type_summaries, rt_name) { rt_name } else { "" }
+          if rt.ident_span != none && (type_summary_decided(index: type_summaries, key: rt_name) != none) { rt_name } else { "" }
       }
   }
 }
 
-fn record_lit_variant_payload_struct_surfaces(n: Node, source_indices: Map<String, NewlineIndex>, type_summaries: Map<String, TypeSummary>, variant_to_enum: Map<String, String>) -> List<String> {
+fn record_lit_variant_payload_struct_surfaces(n: Node, source_indices: Map<String, NewlineIndex>, type_summaries: TypeSummaryIndex, variant_to_enum: Map<String, String>) -> List<String> {
   let variant_name = match record_lit_type_name_at(texpr: n, source_indices: source_indices) {
     Present { value: v } => v
     Absent => authored_name_at(source_indices: source_indices, node: n)
@@ -4194,10 +4359,10 @@ fn record_lit_variant_payload_struct_surfaces(n: Node, source_indices: Map<Strin
       Absent => ""
     }
     if enum_name == "" { [] } else {
-      match map_get(type_summaries, variant_summary_key(enum_name: enum_name, variant_name: variant_name)) {
+      match type_summary_decided(index: type_summaries, key: variant_summary_key(enum_name: enum_name, variant_name: variant_name)) {
         Present { value: summary } =>
           map_values(summary.field_type_map) |> filter(ft =>
-            ft != "" && match map_get(type_summaries, ft) {
+            ft != "" && match type_summary_decided(index: type_summaries, key: ft) {
               Present { value: fts } =>
                 match fts.repr {
                   StructRepr => true
@@ -4224,7 +4389,7 @@ fn record_lit_field_type_hints(n: Node, source_indices: Map<String, NewlineIndex
   )
 }
 
-fn record_lit_resolved_ctor_import_names(type_name: String, n: Node, type_summaries: Map<String, TypeSummary>, source_indices: Map<String, NewlineIndex>) -> List<String> {
+fn record_lit_resolved_ctor_import_names(type_name: String, n: Node, type_summaries: TypeSummaryIndex, source_indices: Map<String, NewlineIndex>) -> List<String> {
   let from_template = match container_template_algebra(name: type_name) {
     Present { value: algebra } => if algebra != "" && algebra != type_name { [algebra] } else { [] }
     Absent => []
@@ -4244,7 +4409,7 @@ fn record_lit_resolved_ctor_import_names(type_name: String, n: Node, type_summar
   unique_strings(items: concat(from_template, from_fields))
 }
 
-fn record_lit_ref_names(n: Node, source_indices: Map<String, NewlineIndex>, type_summaries: Map<String, TypeSummary>, variant_to_enum: Map<String, String>) -> List<String> {
+fn record_lit_ref_names(n: Node, source_indices: Map<String, NewlineIndex>, type_summaries: TypeSummaryIndex, variant_to_enum: Map<String, String>) -> List<String> {
   match n.expr_data {
     ExprRecordLit { parent_enum: pe } =>
       let tn_list = match record_lit_type_name_at(texpr: n, source_indices: source_indices) {
@@ -4286,14 +4451,14 @@ fn record_lit_ref_names(n: Node, source_indices: Map<String, NewlineIndex>, type
 // the text gate declares (P2a candidate-producer / BoundReferenceProvider deriving use-lines from
 // bound-reference structure).
 
-fn collect_anonymous_record_lit_heads(n: Node, source_indices: Map<String, NewlineIndex>, type_summaries: Map<String, TypeSummary>) -> List<String> {
+fn collect_anonymous_record_lit_heads(n: Node, source_indices: Map<String, NewlineIndex>, type_summaries: TypeSummaryIndex) -> List<String> {
   let self_head = match n.expr_data {
     ExprRecordLit { parent_enum: _ } =>
       match record_lit_type_name_at(texpr: n, source_indices: source_indices) {
         Present { value: _ } => []
         Absent =>
           let inferred = emit_inferred_type_leaf_name(n: n, source_indices: source_indices)
-          if inferred != "" && map_contains_key(type_summaries, inferred) { [inferred] } else {
+          if inferred != "" && (type_summary_decided(index: type_summaries, key: inferred) != none) { [inferred] } else {
             let anon = anonymous_record_lit_surface_name(n: n, source_indices: source_indices, type_summaries: type_summaries)
             if anon != "" { [anon] } else { [] }
           }
@@ -4335,13 +4500,13 @@ fn collect_items_field_import_surface_names(surface_names: List<String>, emit_in
   let variant_to_enum = emit_info.variant_to_enum
   unique_strings(items: surface_names
       |> flat_map(type_name =>
-        let summary_lookup = match map_get(type_summaries, type_name) {
+        let summary_lookup = match type_summary_decided(index: type_summaries, key: type_name) {
           Present { value: summary } => Present { value: summary }
           Absent =>
             match map_get(variant_to_enum, type_name) {
               Present { value: enum_name } =>
                 if enum_name == "" { none } else {
-                  map_get(type_summaries, variant_summary_key(enum_name: enum_name, variant_name: type_name))
+                  type_summary_decided(index: type_summaries, key: variant_summary_key(enum_name: enum_name, variant_name: type_name))
                 }
               Absent => none
             }
@@ -4349,7 +4514,7 @@ fn collect_items_field_import_surface_names(surface_names: List<String>, emit_in
         match summary_lookup {
           Present { value: summary } =>
             summary.field_import_surface_names |> filter(field_type =>
-              field_type != "" && match map_get(type_summaries, field_type) {
+              field_type != "" && match type_summary_decided(index: type_summaries, key: field_type) {
                 Present { value: ft } =>
                   match ft.repr {
                     StructRepr => true
@@ -4370,7 +4535,7 @@ fn collect_items_field_import_surface_names(surface_names: List<String>, emit_in
 // scrutinee type available at collection time the parent is resolved only when
 // unique_variant_parent finds exactly one owner, so a homonym variant proposes nothing rather
 // than guessing an enum (the candidate set may under-propose; it must never fabricate).
-fn collect_pattern_ref_names(pattern: MatchPattern, type_summaries: Map<String, TypeSummary>) -> List<String> {
+fn collect_pattern_ref_names(pattern: MatchPattern, type_summaries: TypeSummaryIndex) -> List<String> {
   match pattern {
     VariantPattern { name: n, parent_enum: parent_enum, field_bindings: fbs, parent_identity: _ } =>
       let own = match pattern_parent_enum(name: qualified_last_segment(name: n), parent_enum: parent_enum, scrut_type: "", type_summaries: type_summaries) {
@@ -4382,7 +4547,7 @@ fn collect_pattern_ref_names(pattern: MatchPattern, type_summaries: Map<String,
   }
 }
 
-fn collect_value_ref_names(n: Node, source_indices: Map<String, NewlineIndex>, type_summaries: Map<String, TypeSummary>, variant_to_enum: Map<String, String>) -> List<String> {
+fn collect_value_ref_names(n: Node, source_indices: Map<String, NewlineIndex>, type_summaries: TypeSummaryIndex, variant_to_enum: Map<String, String>) -> List<String> {
   let self_name = match n.expr_data {
     ExprVar { binding_kind: bk } =>
       match bk {
@@ -4459,7 +4624,7 @@ fn emit_scrutinee_type_name(scrutinee: Node, source_indices: Map<String, Newline
   emit_inferred_type_leaf_name(n: scrutinee, source_indices: source_indices)
 }
 
-fn collect_pattern_rc_prelude_parent_enums(pattern: MatchPattern, scrut_type: String, type_summaries: Map<String, TypeSummary>) -> List<String> {
+fn collect_pattern_rc_prelude_parent_enums(pattern: MatchPattern, scrut_type: String, type_summaries: TypeSummaryIndex) -> List<String> {
   match pattern {
     VariantPattern { name: n, parent_enum: parent_enum, field_bindings: _, parent_identity: _ } =>
       let bare_n = qualified_last_segment(name: n)
@@ -4544,7 +4709,7 @@ fn variant_record_lit_summary_key(n: Node, source_indices: Map<String, NewlineIn
   }
 }
 
-fn collect_record_lit_field_struct_surfaces(parent: Node, field_init: Node, source_indices: Map<String, NewlineIndex>, type_summaries: Map<String, TypeSummary>, variant_to_enum: Map<String, String>) -> List<String> {
+fn collect_record_lit_field_struct_surfaces(parent: Node, field_init: Node, source_indices: Map<String, NewlineIndex>, type_summaries: TypeSummaryIndex, variant_to_enum: Map<String, String>) -> List<String> {
   let field_name = field_init_node_name_at(n: field_init, source_indices: source_indices)
   if field_name == "" { [] } else {
     let field_value = field_init_node_value(n: field_init)
@@ -4552,11 +4717,11 @@ fn collect_record_lit_field_struct_surfaces(parent: Node, field_init: Node, sour
       ExprRecordLit { parent_enum: _ } =>
         let summary_key = variant_record_lit_summary_key(n: parent, source_indices: source_indices, variant_to_enum: variant_to_enum)
         if summary_key == "" { [] } else {
-          match map_get(type_summaries, summary_key) {
+          match type_summary_decided(index: type_summaries, key: summary_key) {
             Present { value: summary } =>
               match map_get(summary.field_type_map, field_name) {
                 Present { value: ft } =>
-                  if ft != "" && match map_get(type_summaries, ft) {
+                  if ft != "" && match type_summary_decided(index: type_summaries, key: ft) {
                     Present { value: fts } =>
                       match fts.repr {
                         StructRepr => true
@@ -4591,7 +4756,7 @@ fn collect_value_emit_type_surface_names(n: Node, source_indices: Map<String, Ne
       }
       let nm = authored_name_at(source_indices: source_indices, node: n)
       let from_variant = match map_get(variant_to_enum, nm) {
-        Present { value: parent } => if parent != "" { [parent] } else { [] }
+        Present { value: parent } => if parent != "" { [qualified_last_segment(name: parent)] } else { [] }
         Absent => []
       }
       unique_strings(items: concat(from_inferred_list, from_variant))
@@ -4652,15 +4817,15 @@ fn imported_names_in_use_line(line: String) -> List<String> {
 
 data reference_derived_use_lines_note: String = "emit_import_closure_root (§5). emit_imports wires a per-module use-line only for names in an authored import list. Namespace-only resolution (post-PR 6848) references cross-module names WITHOUT importing them, so the ref is KNOWN but the use-line is declined (advisory UnlistedImportUse, is_error_diagnostic=false) — a §5 fail-open (⊤-as-ignorance) that emits invalid Rust (E0422/E0433/E0425 downstream). This pass derives the missing use-lines from the SAME resolver signal, split by reference kind onto its precise authority (§2 Realization: one closure, two consumers): (1) TYPE refs come from the resolver's UnlistedImportUse diagnostics (04_resolve.dag resolve_node, masked && not-in-SVN at type positions) threaded through ResolvedGraph.diagnostics — zero-drift by construction, the resolver already applied its SVN mask AT RESOLVE TIME; (2) VALUE-position refs come from collect_value_ref_names, a NARROW walk that structurally excludes the type over-collection classes (container heads, field labels, deep-inferred type names): fn/data refs (FunctionValueBinding ExprVar + ExprCall callee names) AND record-literal type constructions (ExprRecordLit type name + its parent_enum) — the latter matter because a GENERIC user type constructed as `T{..}` (e.g. RealizedStep<Nano>) is grounded by resolve_node (masked flips false into the defining-module descent) so it NEVER fires UnlistedImportUse, yet its bare `T` still needs a use-line; (3) TYPE-surface refs on item signatures come from collect_item_emit_surface_names (collect_item_type_surface_names + collect_value_emit_type_surface_names over data bodies) over each item's type_annotation, param types, inferred Resolved return/signature, AND value-position record-literal / variant-parent-enum surfaces the emitter will qualify (e.g. UriScheme::Https in a data anchor) — covering masked-at-resolve TYPE positions (e.g. partial-import return type PilotWidget) that never enter UnlistedImportUse and are not ExprVar/ExprCall harvests. Registry cross-module resolve + is_known_variant fallback keep variant constructors routed through their parent's import. CONSTRUCTION WALL (ROOT 3, §5): a candidate that registry-resolves to a provider module MUST also pass provider_proven_exports_symbol (name_in_transitive_export_surface) before any use-line is synthesized — never a plausible guess from the bare-name registry alone (the v1_rt::member fabrication class: registry homonym without export proof). NOTE the SVN authority is resolve-time-only: env.source_visible_names is built in 04_infer's unresolved_env and consumed by resolve_node, but is NOT persisted onto TypedModule.type_env (emit reads empty_map), so emit MUST NOT re-apply an SVN filter — it would be a no-op that (worse, when non-empty) diverges from the resolve-time mask. The union is instead already-imported filtered (a name already carried by an authored import / prelude / carrier use-line is skipped — this is what keeps a fully-imported SEED module zero-drift: its refs are all in an import line) and kernel filtered (no E0252 against the runtime prelude), then LOCAL-DECL filtered (any name the module itself declares — local_decl_names from authored_name_at over items, plus local_type_names aliases/phantoms — is never an import candidate: the containment tree binds a bare ref to the module's own declaration before any cross-module lookup, and the bare-name registry is last-write-wins, so a dual-tree homonym — dag/std List/Map/GroupCompletion vs their src/v2/std twins — steals the registry row and would otherwise synthesize a SELF-COLLIDING pub-use, the E0255 std_dup class measured on the 2026-07-22 curated 4-module baseline), then cross-module registry-resolved (a ref the registry maps to this same module is skipped), then reuses emit_specific_import_block for variant/reexport correctness with a §5 direct-emit fallback (arm (c): the name resolved via registry to provider AND export-proven). A candidate that registry-resolves to nothing, or resolves but fails export proof, is left unsynthesized, and it never fabricates a use-line. STEP 2 HAS LANDED: the reason is no longer silent. Each such candidate carries a ReferenceDerivedCandidateDisposition -- CandidateRegistryAbsent or CandidateExportProofFailed, distinct because the remedies are opposite -- and CandidateExportProofFailed emits the typed, located, counted ReferenceDerivedImportExportUnproven. THE EMISSION IS NOT REFUSED, and the distinction matters because a reader of the phrase typed refusal will otherwise expect one: the diagnostic is ADVISORY, so emission completes and produces its files beside it. Measured on the required build lane at this branch head, entry:src/v2/compiler/00_compile.dag: emitted=175 blocking=0 -- so what step 2 closed is the SILENCE, not the emission. Whether the line stops is the severity question, and v1.compiler.core reference_derived_import_refusal_severity_note owns it, including why the blocking flip was executed and then falsified by its own first run over a second closure. SCOPE (emit_module_full): import-free modules run the full union (TYPE unlisted + VALUE refs) — the namespace-resolution case the post-PR-6848 regression is about. SUPERSEDED-MECHANISM, THIS CUT (eager-deer-389): the two sentences that follow describe the corpus_repr_is_faithful / HostNative gate, which NO LONGER EXISTS -- RustCorpusRepr and both its variants are deleted and the gate is gone, so import-bearing modules are no longer split by corpus mode. They are retained as the history of WHY the walk was gated at all (the spurious-use-line and seed zero-drift hazards below are real and still constrain any future gating), not as a live description; reference_use_lines_representation_invariant_note in this module carries the post-cut statement. Read them as quarry. AS WRITTEN BEFORE THE CUT: Import-bearing modules run reference_derived_use_lines ONLY when corpus_repr_is_faithful (FaithfulFreeMonoid / v2 namespace corpus): a partial-import namespace module (e.g. v2.std.node_query importing Outcome but calling outcome_with_diagnostics, or importing Outcome but annotating NamedEdgeTargetLookup) must synthesize BOTH the missing fn-value use-line AND the missing type use-line without duplicating names emit_imports already owns. HostNative import-bearing modules (v1 seed) get [] — running the walk there adds spurious/wrong use-lines (registry homonyms like kernel_span/is_type_variable) and breaks zero-drift seed regen."
 
-fn expand_variant_payload_struct_imports(names: List<String>, type_summaries: Map<String, TypeSummary>, variant_to_enum: Map<String, String>) -> List<String> {
+fn expand_variant_payload_struct_imports(names: List<String>, type_summaries: TypeSummaryIndex, variant_to_enum: Map<String, String>) -> List<String> {
   names |> flat_map(n =>
     match map_get(variant_to_enum, n) {
       Present { value: enum_name } =>
         if enum_name == "" { [] } else {
-          match map_get(type_summaries, variant_summary_key(enum_name: enum_name, variant_name: n)) {
+          match type_summary_decided(index: type_summaries, key: variant_summary_key(enum_name: enum_name, variant_name: n)) {
             Present { value: summary } =>
               map_values(summary.field_type_map) |> filter(ft =>
-                ft != "" && match map_get(type_summaries, ft) {
+                ft != "" && match type_summary_decided(index: type_summaries, key: ft) {
                   Present { value: fts } =>
                     match fts.repr {
                       StructRepr => true
@@ -4716,14 +4881,14 @@ fn reference_is_host_realized_builtin(name: String) -> Bool {
 // fabricate. This arm carries no dissolution condition of its own — it dissolves with the text gate
 // it corrects, on the trigger reference_derived_authored_source_gate_note already declares.
 
-fn reference_derived_variant_induced_parent_spelled(module_source: String, enum_name: String, type_summaries: Map<String, TypeSummary>, variant_to_enum: Map<String, String>) -> Bool {
-  match map_get(type_summaries, enum_name) {
+fn reference_derived_variant_induced_parent_spelled(module_source: String, enum_name: String, type_summaries: TypeSummaryIndex, variant_to_enum: Map<String, String>) -> Bool {
+  match type_summary_decided(index: type_summaries, key: enum_name) {
     Present { value: summary } =>
       match summary.repr {
         EnumRepr { unit_only: _ } =>
           sorted_map_keys(summary.variant_name_set) |> any(vn =>
             match map_get(variant_to_enum, vn) {
-              Present { value: parent } => parent == enum_name && reference_derived_candidate_spelled_in_module(module_source: module_source, name: vn)
+              Present { value: parent } => parent != "" && qualified_last_segment(name: parent) == qualified_last_segment(name: enum_name) && reference_derived_candidate_spelled_in_module(module_source: module_source, name: vn)
               Absent => false
             }
           )
@@ -4733,7 +4898,7 @@ fn reference_derived_variant_induced_parent_spelled(module_source: String, enum_
   }
 }
 
-fn reference_derived_candidate_authored(module_source: String, name: String, type_summaries: Map<String, TypeSummary>, variant_to_enum: Map<String, String>) -> Bool {
+fn reference_derived_candidate_authored(module_source: String, name: String, type_summaries: TypeSummaryIndex, variant_to_enum: Map<String, String>) -> Bool {
   reference_derived_candidate_spelled_in_module(module_source: module_source, name: name)
     || reference_derived_variant_induced_parent_spelled(module_source: module_source, enum_name: name, type_summaries: type_summaries, variant_to_enum: variant_to_enum)
 }
@@ -5010,12 +5175,12 @@ fn local_coproduct_variant_names(items: List<Node>, source_indices: Map<String,
 // emitted before; the census takes the same rows and counts them. Byte-identity of the emitted crate
 // is therefore STRUCTURAL rather than asserted: the emitted use-lines cannot move unless this
 // function's answer moves, because there is no second copy of the decision to drift from.
-fn reference_derived_candidate_disposition(name: String, this_module_name: String, emit_info: EmitGraphInfo, registry: Map<String, ItemInfo>, export_sets: Map<String, Map<String, Bool>>, typed_modules: List<TypedModule>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex, type_summaries: Map<String, TypeSummary>, variant_to_enum: Map<String, String>, in_type_position: Bool) -> ReferenceDerivedCandidateDisposition {
-  if is_known_variant(type_summaries: type_summaries, name: name) && !in_type_position {
+fn reference_derived_candidate_disposition(name: String, this_module_name: String, emit_info: EmitGraphInfo, registry: Map<String, ItemInfo>, export_sets: Map<String, Map<String, Bool>>, typed_modules: List<TypedModule>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex, type_summaries: TypeSummaryIndex, variant_to_enum: Map<String, String>, in_type_position: Bool) -> ReferenceDerivedCandidateDisposition {
+  if is_known_variant(variant_to_enum: variant_to_enum, name: name) && !in_type_position {
     match map_get(variant_to_enum, name) {
       Present { value: parent } =>
         if parent == "" { CandidateVariantParentUnresolved }
-        else { CandidateVariantDelegatedToParent { parent_enum: parent } }
+        else { CandidateVariantDelegatedToParent { parent_enum: qualified_last_segment(name: parent) } }
       Absent => CandidateVariantParentUnresolved
     }
   } else {
@@ -5059,7 +5224,7 @@ fn reference_derived_candidate_disposition(name: String, this_module_name: Strin
 //                       vocabulary, so Vec and BTreeSet -- the Rust spellings of List and Set --
 //                       slip a filter built to remove exactly this.
 //   (b) OUT-OF-CLOSURE  empty_map 33, Optional 25, and Optional's VARIANTS Present 47 and Absent 13
-//                       -- REAL .dag declarations in v2.std.collection and v2.std.optional whose
+//                       -- REAL .dag declarations in v2.std.collection and std.optional whose
 //                       providers were not selected into the measured closure. Movable, and
 //                       precisely the closure-conditioned class this change exists to surface.
 //
@@ -5328,7 +5493,7 @@ fn canonical_string_set(items: List<String>) -> List<String> {
 
 fn reference_derived_use_line_plan(items: List<Node>, unlisted_type_names: List<String>, this_module_name: String, emit_info: EmitGraphInfo, registry: Map<String, ItemInfo>, local_type_names: List<String>, already_imported_names: List<String>, export_sets: Map<String, Map<String, Bool>>, typed_modules: List<TypedModule>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex, shared_types: Set<String>, emitted_source: String) -> ReferenceDerivedUseLinePlan {
   {
-    let module_source = match typed_modules |> filter(tm => authored_name_at(source_indices: source_indices, node: tm.module) == this_module_name) |> first {
+    let module_source = match typed_module_by_name(module_name: this_module_name, typed_modules: typed_modules, source_indices: source_indices, module_index: module_index) {
       Present { value: tm } => module_authored_source_text(module: tm.module, source_indices: source_indices)
       Absent => ""
     }
@@ -5401,7 +5566,7 @@ fn reference_derived_use_line_plan(items: List<Node>, unlisted_type_names: List<
       let block_lines = emit_specific_import_use_lines(import_module: provider, mod_name: module_to_filename(name: provider), filtered_names: names, type_position_names: applied_type_argument_names, emit_info: emit_info, registry: registry, local_names: local_type_names, export_sets: export_sets, typed_modules: typed_modules, source_indices: source_indices, module_index: module_index, module_env: plan_module_env)
       let emitted_here = block_lines |> flat_map(l => imported_names_in_use_line(line: l.text))
       let fallback = names |> flat_map(nm =>
-        if (emitted_here |> any(e => e == nm)) || (is_known_variant(type_summaries: emit_info.type_summaries, name: nm) && !emit_map_has(m: type_position_set, key: nm)) {
+        if (emitted_here |> any(e => e == nm)) || (is_known_variant(variant_to_enum: emit_info.variant_to_enum, name: nm) && !emit_map_has(m: type_position_set, key: nm)) {
           []
         } else if provider_proven_exports_symbol(name: nm, provider_module: provider, export_sets: export_sets, typed_modules: typed_modules, source_indices: source_indices, module_index: module_index) {
           [RustUseLine { target_module: module_to_filename(name: provider), text: concat(rust_visibility_prefix(), concat("use crate::", concat(module_to_filename(name: provider), concat("::", concat(emit_import_name(owner_module: provider, n: nm, registry: registry), ";"))))) }]
@@ -5415,7 +5580,7 @@ fn reference_derived_use_line_plan(items: List<Node>, unlisted_type_names: List<
     let names_already_in_lines = lines |> flat_map(l => imported_names_in_use_line(line: l))
     let qualified_rows = qualified_type_reference_rows(emit_info: emit_info, names: qualified_item_emit_surface_compatibility_names(candidates: origin_candidates) |> filter(nm => emit_map_has(m: emitted_source_token_set, key: qualified_last_segment(name: nm))), this_module_name: this_module_name, already: already, names_already_in_lines: names_already_in_lines, registry: registry, export_sets: export_sets, typed_modules: typed_modules, source_indices: source_indices, module_index: module_index)
     let qualified_lines = qualified_type_reference_use_lines(rows: qualified_rows, registry: registry)
-    let this_module_filename = module_to_filename(name: this_module_name)
+    let this_module_filename = rust_module_emit_filename(module_name: this_module_name)
     ReferenceDerivedUseLinePlan {
       lines: concat(lines, qualified_lines |> map(l => l.text)),
       rows: concat(rows, qualified_rows),
@@ -5618,7 +5783,7 @@ fn emit_module_full(typed_module: TypedModule, registry: Map<String, ItemInfo>,
     |> map(item => emit_typed_item(item: item, module_name: authored_name(env: scope.type_env, node: m), registry: registry, scope: scope, shared_types: shared_types, emit_info: emit_info, wire_contract_item: wire_contract_item, data_items: scoped_data_items, module_items: wire_context_items, imports: wire_context_imports, export_sets: export_sets, typed_modules: typed_modules, module_index: module_index))
     |> join(separator: "\n\n")
   let prelude = emit_prelude(module_name: this_module_name)
-  let rendered_imports = emit_imports(imports: module_imports(n: m), emit_info: emit_info, registry: registry, local_names: local_type_names, export_sets: export_sets, typed_modules: typed_modules, source_indices: scope.type_env.source_indices, module_index: module_index, supplement_items: typed_module.items, module_env: Present { value: scope.type_env }, from_module: module_to_filename(name: this_module_name))
+  let rendered_imports = emit_imports(imports: module_imports(n: m), emit_info: emit_info, registry: registry, local_names: local_type_names, export_sets: export_sets, typed_modules: typed_modules, source_indices: scope.type_env.source_indices, module_index: module_index, supplement_items: typed_module.items, module_env: Present { value: scope.type_env }, from_module: rust_module_emit_filename(module_name: this_module_name))
   let imports_str = rendered_imports.text
   let dag_import_lines = if imports_str == "" { [] } else { imports_str |> split(delimiter: "\n") }
   let already_imported_names = concat(
@@ -5645,6 +5810,7 @@ fn emit_module_full(typed_module: TypedModule, registry: Map<String, ItemInfo>,
   let merged_imports = merged_import_lines |> join(separator: "\n")
   let imports_section = if merged_imports == "" { "" } else { concat("\n", merged_imports) }
   let this_mod_filename = module_to_filename(name: authored_name(env: scope.type_env, node: m))
+  let this_mod_endpoint = rust_module_emit_filename(module_name: authored_name(env: scope.type_env, node: m))
   let all_svc_names = typed_module.items |> flat_map(item =>
     match lookup_item_by_identity(registry: registry, id: DeclaredCallableIdentity { owner_module_path: authored_name(env: scope.type_env, node: m), decl_name: authored_name(env: scope.type_env, node: item) }) {
       Present { value: info } => info.service_names
@@ -5666,7 +5832,7 @@ fn emit_module_full(typed_module: TypedModule, registry: Map<String, ItemInfo>,
     else { concat("\n", uncovered_svc_imports |> join(separator: "\n")) }
   let local_enum_uses = typed_module.items
     |> filter(item => is_type_def_item(item: item) && is_coproduct_type(n: item)
-      && !is_grounded_coproduct_native_alias(name: authored_name(env: scope.type_env, node: item))
+      && !declaration_is_grounded_coproduct_native_alias(module_path: scope.type_env.module_path, decl_name: authored_name(env: scope.type_env, node: item))
       && !rust_declaration_realizes_as_native_alias(module_path: authored_name(env: scope.type_env, node: m), decl_name: authored_name(env: scope.type_env, node: item))
       && rust_kernel_grounded_type_decl(module_name: scope.module_name, item_text: authored_name(env: scope.type_env, node: item)) == none)
     |> map(item => concat("use self::", authored_name(env: scope.type_env, node: item), "::*;"))
@@ -5691,9 +5857,11 @@ fn emit_module_full(typed_module: TypedModule, registry: Map<String, ItemInfo>,
     file: TextFile { path: module_emit_path, content: content },
     reference_rows: reference_plan.rows,
     emitted_edges: concat(
-      rust_prelude_emitted_edges(module: this_mod_filename),
+      rust_prelude_emitted_edges(module: this_mod_endpoint),
+      declared_import_edges(from: this_mod_endpoint, imports: module_imports(n: m), source_indices: scope.type_env.source_indices, module_index: module_index),
+      if typed_module.items |> any(item => item.module_item_kind == ModuleItemService) { [service_runtime_surface_edge(from: this_mod_endpoint)] } else { [] },
       rust_use_line_edges_surviving(
-        edges: concat(rendered_imports.edges, reference_plan.edges, rust_use_line_edges(from: this_mod_filename, lines: uncovered_svc_use_lines)),
+        edges: concat(rendered_imports.edges, reference_plan.edges, rust_use_line_edges(from: this_mod_endpoint, lines: uncovered_svc_use_lines)),
         final_lines: concat(merged_import_lines, uncovered_svc_imports)
       )
     ),
@@ -5733,7 +5901,7 @@ fn graph_type_import_module_path(name: String, import_module: String, mod_name:
   }
 }
 
-fn is_import_graph_type_name(name: String, import_module: String, typed_modules: List<TypedModule>, registry: Map<String, ItemInfo>, export_sets: Map<String, Map<String, Bool>>, type_summaries: Map<String, TypeSummary>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex) -> Bool {
+fn is_import_graph_type_name(name: String, import_module: String, typed_modules: List<TypedModule>, registry: Map<String, ItemInfo>, export_sets: Map<String, Map<String, Bool>>, type_summaries: TypeSummaryIndex, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex, variant_to_enum: Map<String, String>) -> Bool {
   if has_physical_type_def_in_module_filename(rhs_name: name, mod_filename: module_to_filename(name: import_module), typed_modules: typed_modules, source_indices: source_indices, module_index: module_index) {
     true
   } else if match reexport_source_module_name(name: name, import_module: import_module, typed_modules: typed_modules, export_sets: export_sets, source_indices: source_indices, module_index: module_index) {
@@ -5741,9 +5909,13 @@ fn is_import_graph_type_name(name: String, import_module: String, typed_modules:
     Absent => false
   } {
     true
-  } else if is_enum_in_summaries(type_summaries: type_summaries, type_name: name) {
+  } else if match is_enum_in_summaries(type_summaries: type_summaries, type_name: name) {
+    QuestionDecided { value: v } => v
+    QuestionNameAmbiguous { leaf: _ } => false
+    QuestionNotDeclared => false
+  } {
     false
-  } else if is_known_variant(type_summaries: type_summaries, name: name) {
+  } else if is_known_variant(variant_to_enum: variant_to_enum, name: name) {
     false
   } else {
     match map_get(export_sets, import_module) {
@@ -6033,13 +6205,17 @@ fn reexport_source_module_name_with_visited(name: String, import_module: String,
   }
 }
 
-fn import_module_enum_scope(import_module: String, registry: Map<String, ItemInfo>, type_summaries: Map<String, TypeSummary>, export_sets: Map<String, Map<String, Bool>>, typed_modules: List<TypedModule>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex) -> List<String> {
+fn import_module_enum_scope(import_module: String, registry: Map<String, ItemInfo>, type_summaries: TypeSummaryIndex, export_sets: Map<String, Map<String, Bool>>, typed_modules: List<TypedModule>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex, variant_to_enum: Map<String, String>) -> List<String> {
   let physical = enum_names_in_module(module_name: import_module, typed_modules: typed_modules, source_indices: source_indices, module_index: module_index)
   let reexport_parents = match map_get(export_sets, import_module) {
     Present { value: exported } =>
       sorted_map_keys(exported) |> filter(n =>
-        is_known_variant(type_summaries: type_summaries, name: n)
-        && is_enum_in_summaries(type_summaries: type_summaries, type_name: n) == false
+        is_known_variant(variant_to_enum: variant_to_enum, name: n)
+        && match is_enum_in_summaries(type_summaries: type_summaries, type_name: n) {
+          QuestionDecided { value: v } => v == false
+          QuestionNotDeclared => true
+          QuestionNameAmbiguous { leaf: _ } => false
+        }
       ) |> map(n =>
         match reexport_variant_parent_in_import_module(
           variant_name: n,
@@ -6224,7 +6400,7 @@ fn explicit_import_source_module_for_name(name: String, import_module: String, t
   }
 }
 
-fn reexport_variant_parent_in_import_module(variant_name: String, import_module: String, registry: Map<String, ItemInfo>, type_summaries: Map<String, TypeSummary>, typed_modules: List<TypedModule>, export_sets: Map<String, Map<String, Bool>>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex) -> String? {
+fn reexport_variant_parent_in_import_module(variant_name: String, import_module: String, registry: Map<String, ItemInfo>, type_summaries: TypeSummaryIndex, typed_modules: List<TypedModule>, export_sets: Map<String, Map<String, Bool>>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex) -> String? {
   match reexport_source_module_name(name: variant_name, import_module: import_module, typed_modules: typed_modules, export_sets: export_sets, source_indices: source_indices, module_index: module_index) {
     Absent => Absent
     Present { value: src_mod } =>
@@ -6574,8 +6750,8 @@ fn is_emittable_parametric_type_alias_item(item: Node, item_text: String, source
   }
 }
 
-fn import_variant_parent_for_name(n: String, import_module: String, registry: Map<String, ItemInfo>, type_summaries: Map<String, TypeSummary>, typed_modules: List<TypedModule>, export_sets: Map<String, Map<String, Bool>>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex, imported_enums: List<String>, import_module_enums: List<String>) -> String {
-  if is_import_graph_type_name(name: n, import_module: import_module, typed_modules: typed_modules, registry: registry, export_sets: export_sets, type_summaries: type_summaries, source_indices: source_indices, module_index: module_index) {
+fn import_variant_parent_for_name(n: String, import_module: String, registry: Map<String, ItemInfo>, type_summaries: TypeSummaryIndex, typed_modules: List<TypedModule>, export_sets: Map<String, Map<String, Bool>>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex, imported_enums: List<String>, import_module_enums: List<String>, variant_to_enum: Map<String, String>) -> String {
+  if is_import_graph_type_name(name: n, import_module: import_module, typed_modules: typed_modules, registry: registry, export_sets: export_sets, type_summaries: type_summaries, source_indices: source_indices, module_index: module_index, variant_to_enum: variant_to_enum) {
     ""
   } else if import_module_enums |> any(e => e == n) {
     ""
@@ -6718,6 +6894,17 @@ fn authored_import_binds_provider_declaration(name: String, import_module: Strin
 // emitted file takes -- measured as EmitterReverseEdge std_content_hash -> v2_std_node over the
 // v2.compiler.compile closure, with no such line in std_content_hash.rs. The edge keeps its typed
 // provenance; this only removes the ones whose target no surviving line names.
+// ONE EDGE PER AUTHORED IMPORT OF AN EMITTED MODULE, NOT FILTERED BY SURVIVING USE-LINES
+// (gunbc.rust_emitted_edge DeclaredImport). An import naming a module outside the emitted closure
+// has no file to path into and returns no edge.
+fn declared_import_edges(from: String, imports: List<Node>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex) -> List<EmittedEdge> {
+  unique_strings(items: imports |> map(imp => authored_name_at(source_indices: source_indices, node: imp)))
+    |> filter(name => match map_get(module_index.by_name, name) { Present { value: _ } => true  Absent => false })
+    |> map(name => rust_module_emit_filename(module_name: name))
+    |> filter(target => target != from)
+    |> map(target => declared_import_edge(from: from, to_module: target))
+}
+
 fn rust_use_line_edges_surviving(edges: List<EmittedEdge>, final_lines: List<String>) -> List<EmittedEdge> {
   let named = final_lines
     |> map(l => rust_use_after_crate(line: l))
@@ -6760,11 +6947,11 @@ fn emit_specific_import_use_lines(import_module: String, mod_name: String, filte
   if deduped_names |> count == 0 {
     []
   } else {
-    let import_module_enums = import_module_enum_scope(import_module: import_module, registry: registry, type_summaries: type_summaries, export_sets: export_sets, typed_modules: typed_modules, source_indices: source_indices, module_index: module_index)
+    let import_module_enums = import_module_enum_scope(import_module: import_module, registry: registry, type_summaries: type_summaries, export_sets: export_sets, typed_modules: typed_modules, source_indices: source_indices, module_index: module_index, variant_to_enum: emit_info.variant_to_enum)
     let top_level = non_marker_names |> filter(n =>
-      if is_import_graph_type_name(name: n, import_module: import_module, typed_modules: typed_modules, registry: registry, export_sets: export_sets, type_summaries: type_summaries, source_indices: source_indices, module_index: module_index) {
+      if is_import_graph_type_name(name: n, import_module: import_module, typed_modules: typed_modules, registry: registry, export_sets: export_sets, type_summaries: type_summaries, source_indices: source_indices, module_index: module_index, variant_to_enum: emit_info.variant_to_enum) {
         true
-      } else if is_known_variant(type_summaries: type_summaries, name: n) {
+      } else if is_known_variant(variant_to_enum: emit_info.variant_to_enum, name: n) {
         import_module_enums |> any(e => e == n)
       } else if imported_name_is_non_emittable_type(name: n, import_module: import_module, typed_modules: typed_modules, registry: registry, export_sets: export_sets, source_indices: source_indices, module_index: module_index) {
         false
@@ -6774,13 +6961,13 @@ fn emit_specific_import_use_lines(import_module: String, mod_name: String, filte
     )
     let imported_enums = non_marker_names |> filter(n => import_module_enums |> any(e => e == n))
     let all_parents = non_marker_names |> map(n =>
-      import_variant_parent_for_name(n: n, import_module: import_module, registry: registry, type_summaries: type_summaries, typed_modules: typed_modules, export_sets: export_sets, source_indices: source_indices, module_index: module_index, imported_enums: imported_enums, import_module_enums: import_module_enums)
+      import_variant_parent_for_name(n: n, import_module: import_module, registry: registry, type_summaries: type_summaries, typed_modules: typed_modules, export_sets: export_sets, source_indices: source_indices, module_index: module_index, imported_enums: imported_enums, import_module_enums: import_module_enums, variant_to_enum: emit_info.variant_to_enum)
     ) |> filter(p => p != "")
     let parent_list = unique_strings(items: all_parents)
     let non_variant_top = top_level |> filter(n =>
-      if import_variant_parent_for_name(n: n, import_module: import_module, registry: registry, type_summaries: type_summaries, typed_modules: typed_modules, export_sets: export_sets, source_indices: source_indices, module_index: module_index, imported_enums: imported_enums, import_module_enums: import_module_enums) != "" {
+      if import_variant_parent_for_name(n: n, import_module: import_module, registry: registry, type_summaries: type_summaries, typed_modules: typed_modules, export_sets: export_sets, source_indices: source_indices, module_index: module_index, imported_enums: imported_enums, import_module_enums: import_module_enums, variant_to_enum: emit_info.variant_to_enum) != "" {
         false
-      } else if is_known_variant(type_summaries: type_summaries, name: n)
+      } else if is_known_variant(variant_to_enum: emit_info.variant_to_enum, name: n)
         && authored_import_binds_provider_declaration(name: n, import_module: import_module, module_env: module_env, typed_modules: typed_modules, export_sets: export_sets, source_indices: source_indices, module_index: module_index) == false {
         import_module_enums |> any(e => e == n)
       } else { true }
@@ -6818,10 +7005,10 @@ fn emit_specific_import_use_lines(import_module: String, mod_name: String, filte
     )
     let merged_direct_names = unique_strings(items: concat(direct_names, local_parent_names))
     let type_direct_names = merged_direct_names |> filter(n =>
-      is_import_graph_type_name(name: n, import_module: import_module, typed_modules: typed_modules, registry: registry, export_sets: export_sets, type_summaries: type_summaries, source_indices: source_indices, module_index: module_index)
+      is_import_graph_type_name(name: n, import_module: import_module, typed_modules: typed_modules, registry: registry, export_sets: export_sets, type_summaries: type_summaries, source_indices: source_indices, module_index: module_index, variant_to_enum: emit_info.variant_to_enum)
     )
     let other_direct_names = merged_direct_names |> filter(n =>
-      is_import_graph_type_name(name: n, import_module: import_module, typed_modules: typed_modules, registry: registry, export_sets: export_sets, type_summaries: type_summaries, source_indices: source_indices, module_index: module_index) == false
+      is_import_graph_type_name(name: n, import_module: import_module, typed_modules: typed_modules, registry: registry, export_sets: export_sets, type_summaries: type_summaries, source_indices: source_indices, module_index: module_index, variant_to_enum: emit_info.variant_to_enum) == false
     )
     let type_direct_mods = unique_strings(items: type_direct_names |> map(n =>
       graph_type_import_module_filename(name: n, import_module: import_module, mod_name: mod_name, typed_modules: typed_modules, export_sets: export_sets, source_indices: source_indices, module_index: module_index)
@@ -6884,11 +7071,11 @@ fn emit_specific_import_use_lines(import_module: String, mod_name: String, filte
     )
     let main_lines = concat(direct_lines, parent_main_lines)
     let variant_lines = parent_list |> flat_map(parent =>
-      if is_grounded_coproduct_native_alias(name: parent) || rust_declaration_realizes_as_native_alias(module_path: import_module, decl_name: parent) { [] } else {
+      if declaration_is_grounded_coproduct_native_alias(module_path: import_module, decl_name: parent) || every_declarer_is_grounded_coproduct_native_alias(decls: emit_info.type_decl_items, name: parent) || rust_declaration_realizes_as_native_alias(module_path: import_module, decl_name: parent) { [] } else {
       let variants = deduped_names |> filter(n =>
         if n == "None" || n == "Some" {
           false
-        } else if is_import_graph_type_name(name: n, import_module: import_module, typed_modules: typed_modules, registry: registry, export_sets: export_sets, type_summaries: type_summaries, source_indices: source_indices, module_index: module_index) {
+        } else if is_import_graph_type_name(name: n, import_module: import_module, typed_modules: typed_modules, registry: registry, export_sets: export_sets, type_summaries: type_summaries, source_indices: source_indices, module_index: module_index, variant_to_enum: emit_info.variant_to_enum) {
           false
         } else if import_module_enums |> any(e => e == n) {
           false
@@ -6918,7 +7105,7 @@ fn emit_specific_import_use_lines(import_module: String, mod_name: String, filte
     let final_imported_enums = top_level |> filter(n => import_module_enums |> any(e => e == n))
     let wildcard_enum_lines = final_imported_enums
       |> filter(en => parent_list |> any(p => p == en) == false
-        && !is_grounded_coproduct_native_alias(name: en)
+        && !declaration_is_grounded_coproduct_native_alias(module_path: import_module, decl_name: en)
         && !rust_declaration_realizes_as_native_alias(module_path: import_module, decl_name: en)
         && rust_kernel_grounded_type_decl(module_name: import_module, item_text: en) == none)
       |> map(en => RustUseLine { target_module: mod_name, text: concat("use crate::", mod_name, "::", en, "::*;") })
@@ -7281,7 +7468,7 @@ The predicate was `has_physical_type_def_in_module_filename` — field type PHYS
 
 INCREMENT 2 (generic-argument axis, #6986): build_field_type_map also walks the resolved field-type NODE TREE via collect_type_node_import_surface_names (04_emit_info.dag), populating TypeSummary.field_import_surface_names; this synth consumes that list so List<CacheEvidence> admits CacheEvidence (field_type_map still maps field→HEAD for lookup). Witness: field_import_surface_generic_arg_test. Re-probe 2026-07-21: materialization_carriers CacheEvidence E0422 cleared; first error advanced to E0425 cannot find value extdeps (namespace/dotted-path class — distinct blocker)."
 
-fn module_data_field_struct_import_names(items: List<Node>, type_summaries: Map<String, TypeSummary>, import_module: String, export_sets: Map<String, Map<String, Bool>>, typed_modules: List<TypedModule>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex) -> List<String> {
+fn module_data_field_struct_import_names(items: List<Node>, type_summaries: TypeSummaryIndex, import_module: String, export_sets: Map<String, Map<String, Bool>>, typed_modules: List<TypedModule>, source_indices: Map<String, NewlineIndex>, module_index: ModuleIndex) -> List<String> {
   unique_strings(items: items
     |> filter(item => item.module_item_kind == ModuleItemDataValue)
     |> flat_map(item => {
@@ -7292,12 +7479,12 @@ fn module_data_field_struct_import_names(items: List<Node>, type_summaries: Map<
       if type_name == "" {
         []
       } else {
-        match map_get(type_summaries, type_name) {
+        match type_summary_decided(index: type_summaries, key: type_name) {
           Present { value: summary } =>
             summary.field_import_surface_names |> filter(field_type =>
               field_type != ""
               && name_in_transitive_export_surface(name: field_type, module_name: import_module, visited: [], export_sets: export_sets, typed_modules: typed_modules, source_indices: source_indices, module_index: module_index)
-              && match map_get(type_summaries, field_type) {
+              && match type_summary_decided(index: type_summaries, key: field_type) {
                 Present { value: ft } =>
                   match ft.repr {
                     StructRepr => true
@@ -7853,7 +8040,7 @@ fn emit_type_def_from_connective(item: Node, recursive_types: Set<String>, share
     let clone_bound_refusal = emit_item_clone_bound_refusal(item: item, item_name: item_text, emit_info: emit_info, source_indices: env.source_indices)
     let struct_text = emit_struct_from_children(name: item_text, type_params: type_params, generic_param_names: generic_param_names, header_clone_param_names: header_clone_param_names, children: item.children, recursive_types: recursive_types, shared_types: shared_types, sealed: sealed, deserialize_forbidden: deserialize_forbidden, env: env, emit_info: emit_info)
     if clone_bound_refusal == "" { struct_text } else { concat(clone_bound_refusal, "\n", struct_text) }
-  } else if is_host_optional_carrier_alias(name: item_text) {
+  } else if declaration_owns_host_option(module_path: env.module_path, decl_name: item_text) {
     let type_params = emit_type_params(params: item.params, source_indices: env.source_indices)
     let elem_csv = item.params |> map(p => to_pascal(name: generic_param_name_at(n: p, source_indices: env.source_indices))) |> join(separator: ", ")
     concat(rust_visibility_prefix(), "type ", item_text, type_params, " = Option<", elem_csv, ">;")
@@ -7941,7 +8128,7 @@ fn rust_phantom_marker_inner(unused: List<String>) -> String {
 fn rust_phantom_field_name() -> String { "_phantom" }
 
 fn type_has_fn_fields(name: String, emit_info: EmitGraphInfo) -> Bool {
-  match map_get(emit_info.type_summaries, name) {
+  match type_summary_decided(index: emit_info.type_summaries, key: name) {
     Present { value: ts } => ts.has_fn_fields
     Absent => false
   }
@@ -8576,33 +8763,47 @@ fn v1_fn_body_derived_clone_param_names(params: List<Node>, inferred: Node, body
     type_decl_items: emit_info.type_decl_items,
     source_indices: si
   )
-  let rc_match_clone_param_names = match body.expr_data {
+  let rc_match_clone_param_names = v1_fn_body_rc_match_clone_bound_param_names(body: body, generic_param_names: generic_param_names, shared_types: shared_types, emit_info: emit_info, source_indices: si)
+  v1_union_bound_param_names(
+    base: derived_clone_param_names,
+    extra: rc_match_clone_param_names
+  )
+}
+
+// EVERY MATCH WHOSE Rc SCRUTINEE IS DEREFERENCED AND CLONED OWES Clone ON THE GENERICS IT CARRIES,
+// wherever the match sits. This walk is the next-rung trigger BoundedToDirectTopLevelMatchBody
+// named, firing on its specimen: gunbc.product.data_class admit_data_effect<C, T> clones the
+// accumulator `acc: DataEffectAdmission<C, T>` it matches on INSIDE a fold step, so the match is a
+// lambda's body, not the fn's, and the top-level-only reading emitted a bare `<C, T>` that rustc
+// refused (E0599, `clone` exists for DataEffectAdmission<C, T> but its trait bounds were not
+// satisfied). The traversal is generous and the predicate exact, as in the equality walker below:
+// analyze_rc_match still decides whether this match derefs, and the pure core still keeps only the
+// scrutinee's type arguments that are this fn's own generics.
+fn v1_fn_body_rc_match_clone_bound_param_names(body: Node, generic_param_names: List<String>, shared_types: Set<String>, emit_info: EmitGraphInfo, source_indices: Map<String, NewlineIndex>) -> List<String> {
+  let here = match body.expr_data {
     ExprMatch =>
       let scrutinee = match_scrutinee(texpr: body)
       match scrutinee.inferred {
         Present { value: Resolved { node: rt } } =>
-          let scrut_type = authored_name_at(source_indices: si, node: rt)
-          let arms = match_arm_nodes(texpr: body)
           let rc_match = analyze_rc_match(
             scrutinee: scrutinee,
-            arms: arms,
-            scrut_type: scrut_type,
+            arms: match_arm_nodes(texpr: body),
+            scrut_type: authored_name_at(source_indices: source_indices, node: rt),
             shared_types: shared_types,
             emit_info: emit_info,
-            source_indices: si
+            source_indices: source_indices
           )
           v1_rc_match_scrutinee_clone_bound_param_names(
             generic_param_names: generic_param_names,
-            scrutinee_type_arg_names: rt.children |> map(c => authored_name_at(source_indices: si, node: c)),
+            scrutinee_type_arg_names: rt.children |> map(c => authored_name_at(source_indices: source_indices, node: c)),
             rc_match_needs_deref: rc_match.needs_deref
           )
         _ => []
       }
     _ => []
   }
-  v1_union_bound_param_names(
-    base: derived_clone_param_names,
-    extra: rc_match_clone_param_names
+  body.children |> fold(init: here, f: (acc, child) =>
+    v1_union_bound_param_names(base: acc, extra: v1_fn_body_rc_match_clone_bound_param_names(body: child, generic_param_names: generic_param_names, shared_types: shared_types, emit_info: emit_info, source_indices: source_indices))
   )
 }
 
@@ -8675,8 +8876,8 @@ fn v1_fn_signature_map_key_param_names(value_params: List<Node>, ret: Node, gene
 // lives there, the Node walk lives at the call site, and reversing that would close an
 // emit_rust -> trait_bound_witness -> emit_rust cycle.
 //
-// This is the RECURSIVE BODY WALKER that BoundedToDirectTopLevelMatchBody and
-// BoundedToDirectSingleCallLambdaBody both name as their next-rung trigger. Unlike those two it
+// This is the RECURSIVE BODY WALKER that the retired BoundedToDirectTopLevelMatchBody and
+// BoundedToDirectSingleCallLambdaBody scopes both named as their next-rung trigger. Unlike those two it
 // declares no depth boundary: the specimen that motivated it puts the earning comparison inside a
 // lambda, inside any(), inside a pipeline, inside the && of another lambda inside another any().
 //
@@ -10177,25 +10378,32 @@ fn emit_pattern(pattern: MatchPattern, path_prefix: List<String>, shared_types:
   }
 }
 
-fn pattern_parent_enum(name: String, parent_enum: String?, scrut_type: String, type_summaries: Map<String, TypeSummary>) -> String? {
-  let scrut_is_known_enum = scrut_type != "" && is_enum_type_name(type_name: scrut_type, type_summaries: type_summaries)
+fn rust_ambiguous_type_name_refusal(leaf: String) -> String {
+  concat("compile_error!(\"ambiguous type name '", leaf, "': declarations disagree\")")
+}
+
+fn pattern_parent_enum(name: String, parent_enum: String?, scrut_type: String, type_summaries: TypeSummaryIndex) -> String? {
   if parent_enum != none {
     parent_enum
-  } else if scrut_is_known_enum {
-    Present { value: scrut_type }
-  } else {
+  } else if scrut_type == "" {
     unique_variant_parent(type_summaries: type_summaries, variant_name: name)
+  } else {
+    match is_enum_type_name(type_name: scrut_type, type_summaries: type_summaries) {
+      QuestionDecided { value: true } => Present { value: scrut_type }
+      QuestionNameAmbiguous { leaf: leaf } => Present { value: rust_ambiguous_type_name_refusal(leaf: leaf) }
+      _ => unique_variant_parent(type_summaries: type_summaries, variant_name: name)
+    }
   }
 }
 
-fn unique_variant_parent(type_summaries: Map<String, TypeSummary>, variant_name: String) -> String? {
-  let parent_matches = sorted_map_keys(type_summaries)
-    |> filter(type_name =>
-      is_enum_type_name(type_name: type_name, type_summaries: type_summaries) &&
-      variant_belongs_to_enum(type_summaries: type_summaries, variant_name: variant_name, enum_name: type_name)
-    )
+fn unique_variant_parent(type_summaries: TypeSummaryIndex, variant_name: String) -> String? {
+  let parent_matches = type_summary_values(index: type_summaries)
+    |> filter(summary => summary_is_enum_with_variant(summary: summary, variant_name: variant_name))
   if parent_matches |> count == 1 {
-    parent_matches |> first
+    match parent_matches |> first {
+      Present { value: summary } => Present { value: summary.name }
+      Absent => none
+    }
   } else {
     none
   }
@@ -10215,8 +10423,19 @@ fn is_optional_variant_name(name: String) -> Bool {
   name == "Present" || name == "Absent" || name == "Some" || name == "None"
 }
 
+// A parent arrives as a bare name, or -- from variant_to_enum, whose values are owners' identities --
+// as `<module>.<name>`. An identity is decided by the declaration it names (the kernel optional's
+// mint row and rust_host_option_carrier_declarations); only a bare name keeps the spelling rule.
 fn is_optional_like_parent_name(name: String) -> Bool {
-  name == kernel_optional_mint_name || is_host_diagnostics_carrier_alias(name: name)
+  if contains(name, ".") {
+    let segments = name |> split(delimiter: ".")
+    let module_path = segments |> take((segments |> count) - 1) |> join(separator: ".")
+    let decl_name = qualified_last_segment(name: name)
+    declaration_owns_host_option(module_path: module_path, decl_name: decl_name)
+      || declaration_ref_in_list(target: decl_ref(module_path: module_path, decl_name: decl_name), refs: rust_host_option_carrier_declarations)
+  } else {
+    name == kernel_optional_mint_name || is_host_diagnostics_carrier_alias(name: name)
+  }
 }
 
 fn is_some_like_variant_name(name: String) -> Bool {
@@ -10565,7 +10784,7 @@ fn analyze_rc_pattern(pattern: MatchPattern, scrut_type: String, shared_types: S
         let matches_rc_variant = match resolved_parent {
           Present { value: enum_name } => set_contains(shared_types, enum_name)
           Absent =>
-            match map_get(emit_info.type_summaries, bare_n) {
+            match type_summary_decided(index: emit_info.type_summaries, key: bare_n) {
               Present { value: _ } => set_contains(shared_types, bare_n)
               Absent => false
             }
@@ -10931,7 +11150,7 @@ fn rust_as_ref_let_is_irrefutable(pattern: MatchPattern, emit_info: EmitGraphInf
         let resolved = pattern_parent_enum(name: qualified_last_segment(name: n), parent_enum: parent, scrut_type: "", type_summaries: emit_info.type_summaries)
         match resolved {
           Present { value: enum_name } =>
-            match map_get(emit_info.type_summaries, enum_name) {
+            match type_summary_decided(index: emit_info.type_summaries, key: enum_name) {
               Present { value: summary } => (sorted_map_keys(summary.variant_name_set) |> count) <= 1
               Absent => false
             }
@@ -11096,7 +11315,7 @@ fn freemonoid_empty_from_variant_parent(leaf_name: String, enum_name: String) ->
 
 fn freemonoid_empty_from_emit_info(leaf_name: String, emit_info: EmitGraphInfo) -> Bool {
   leaf_name == "Empty" && match map_get(emit_info.variant_to_enum, "Empty") {
-    Present { value: p } => p == "FreeMonoid"
+    Present { value: p } => qualified_last_segment(name: p) == "FreeMonoid"
     Absent => false
   }
 }
@@ -11111,7 +11330,10 @@ fn emit_freemonoid_empty_variant_body() -> String {
 
 fn effective_variant_parent_from_enum_lookup(leaf_name: String, rt: Node, binding_kind: VarBindingKind?, emit_info: EmitGraphInfo, source_indices: Map<String, NewlineIndex>) -> String? {
   let rt_name = authored_name_at(source_indices: source_indices, node: rt)
-  if rt.ident_span != none && rt_name != leaf_name && variant_belongs_to_enum(type_summaries: emit_info.type_summaries, variant_name: leaf_name, enum_name: rt_name) {
+  if rt.ident_span != none && rt_name != leaf_name && match variant_belongs_to_enum(type_summaries: emit_info.type_summaries, variant_name: leaf_name, enum_name: rt_name) {
+    QuestionDecided { value: v } => v
+    _ => false
+  } {
     Present { value: rt_name }
   } else {
     variant_parent_from_binding_kind(binding_kind: binding_kind)
@@ -11129,7 +11351,7 @@ fn effective_variant_parent_from_resolved(leaf_name: String, rt: Node, binding_k
 fn effective_variant_parent(name: String, binding_kind: VarBindingKind?, resolved_type: InferredNode?, emit_info: EmitGraphInfo, source_indices: Map<String, NewlineIndex>) -> String? {
   let leaf_name = value_ref_qualified_leaf(name: name)
   let cached = match map_get(emit_info.variant_to_enum, leaf_name) {
-    Present { value: p } => if p != "" { Present { value: p } } else { none }
+    Present { value: p } => if p != "" { Present { value: qualified_last_segment(name: p) } } else { none }
     Absent => none
   }
   match cached {
@@ -12055,11 +12277,15 @@ fn emit_rust_expr_record_lit(expr: Node, registry: Map<String, ItemInfo>, scope:
       let variant_name = match tn { Present { value: n } => n  Absent => "" }
 
       let concrete_peel_would_erase_optional_ctor = is_optional_variant_name(name: variant_name)
-        && !variant_belongs_to_enum(
+        && match variant_belongs_to_enum(
           type_summaries: emit_info.type_summaries,
           variant_name: variant_name,
           enum_name: authored_name_at(source_indices: si, node: expanded_rt)
-        )
+        ) {
+          QuestionDecided { value: v } => v == false
+          QuestionNotDeclared => true
+          QuestionNameAmbiguous { leaf: _ } => false
+        }
       let peeled_type_name = if parent_enum == none && expanded_rt.connective == Conj && expanded_rt.ident_span != none && !concrete_peel_would_erase_optional_ctor {
         let concrete = authored_name_at(source_indices: si, node: expanded_rt)
         if concrete != "" && concrete != variant_name { Present { value: concrete } } else { tn }
@@ -12273,13 +12499,16 @@ fn emit_cloned_arg(texpr: Node, registry: Map<String, ItemInfo>, scope: InferSco
   emit_typed_expr(texpr: texpr, registry: registry, scope: scope, depth: depth, shared_types: shared_types, emit_info: emit_info, fuel: 1024)
 }
 
-fn is_enum_type_name(type_name: String, type_summaries: Map<String, TypeSummary>) -> Bool {
+fn is_enum_type_name(type_name: String, type_summaries: TypeSummaryIndex) -> TypeSummaryQuestion {
   is_enum_in_summaries(type_summaries: type_summaries, type_name: type_name)
 }
 
 fn contextual_variant_parent_from_type_name(variant_name: String, resolved_type: Node, emit_info: EmitGraphInfo, source_indices: Map<String, NewlineIndex>) -> String? {
   let rt_name = authored_name_at(source_indices: source_indices, node: resolved_type)
-  if resolved_type.ident_span != none && rt_name != variant_name && variant_belongs_to_enum(type_summaries: emit_info.type_summaries, variant_name: variant_name, enum_name: rt_name) {
+  if resolved_type.ident_span != none && rt_name != variant_name && match variant_belongs_to_enum(type_summaries: emit_info.type_summaries, variant_name: variant_name, enum_name: rt_name) {
+    QuestionDecided { value: v } => v
+    _ => false
+  } {
     Present { value: rt_name }
   } else {
     none
@@ -12297,7 +12526,10 @@ fn contextual_variant_parent_absent(variant_name: String, resolved_type: Node, e
 fn contextual_variant_parent(variant_name: String, parent_enum: String?, resolved_type: Node, emit_info: EmitGraphInfo, source_indices: Map<String, NewlineIndex>) -> String? {
   match parent_enum {
     Present { value: explicit_parent } =>
-      if variant_belongs_to_enum(type_summaries: emit_info.type_summaries, variant_name: variant_name, enum_name: explicit_parent) {
+      if match variant_belongs_to_enum(type_summaries: emit_info.type_summaries, variant_name: variant_name, enum_name: explicit_parent) {
+        QuestionDecided { value: v } => v
+        _ => false
+      } {
         Present { value: explicit_parent }
       } else { none }
     Absent => contextual_variant_parent_absent(variant_name: variant_name, resolved_type: resolved_type, emit_info: emit_info, source_indices: source_indices)
@@ -12334,7 +12566,7 @@ fn discriminant_zero_field_variant_tag(arg: Node, scope: InferScope, emit_info:
         match record_lit_type_name_at(texpr: arg, source_indices: scope.type_env.source_indices) {
           Present { value: tn } =>
             let last = qualified_last_segment(name: tn)
-            if last != "" && is_known_variant(type_summaries: emit_info.type_summaries, name: last) {
+            if last != "" && is_known_variant(variant_to_enum: emit_info.variant_to_enum, name: last) {
               Present { value: last }
             } else { none }
           Absent => none
@@ -12471,7 +12703,7 @@ fn rust_call_arg_fail_closed_unwrap(arg_str: String, arg: Node, callee: ItemInfo
       match function_value_params(params: info.params) |> skip(idx) |> first {
         Present { value: param } =>
           let param_type = param_node_type_expr(n: param)
-          let param_required = param_type.return_cardinality != CardOptional && !is_host_optional_carrier_type(n: param_type, source_indices: source_indices) && !rust_param_type_is_type_variable(param_type: param_type, source_indices: source_indices)
+          let param_required = param_type.return_cardinality != CardOptional && !is_host_optional_carrier_type(n: param_type, source_indices: source_indices, env: empty_type_env()) && !rust_param_type_is_type_variable(param_type: param_type, source_indices: source_indices)
           let arg_optional = resolved_type(n: arg).return_cardinality == CardOptional && !rust_call_arg_is_function_value(arg: arg)
           if param_required && arg_optional {
             concat(arg_str, ".expect(\"fail-closed: an optional value flowed into non-optional parameter ", to_string(value: idx), " of ", func, " (empty Optional at runtime)\")")
@@ -12629,6 +12861,52 @@ fn lambda_argument_scope(arg: Node, scope: InferScope) -> InferScope {
 // emit_func_def names the declaration it renders on the body scope (caller_decl_name) so that read
 // has a subject.
 
+// ONE HOST-TEXT DISCRIMINATOR FOR BOTH SPELLINGS. AlgebraMethodSemantics remaps `.length` on a
+// host-string receiver to `string_length`; the function form `v2.std.algebra` `length` over
+// `FreeMonoid<Char>` is that operation spelled as a call. Kernel `String` inhabits the monoid, so
+// `length(xs: s)` is legal source. Emitting it as the generic FreeMonoid body (`Rc<Vec<T>>`) is
+// E0308 against the host `String` at `request_field`. `v2.std.text.String` is the other carrier:
+// the structural alias `FreeMonoid<Char>` (`Rc<Vec<i64>>` here). Rewriting THAT call (or
+// `.length` on it) to `v1_rt::string_length` is E0308 the other way (self-host `v2_std_text.rs`
+// `string_split_step`). Both arms ask `is_host_text_typed_expr` — leaf name `String` is not enough.
+// THE CALLEE IS THE DECLARATION, NOT THE LEAF. A call spelled `length` that resolves to another
+// module's function (or a local) must emit that function; rewriting by the authored name would
+// replace a byte-count or a constant with a scalar count and answer wrongly in silence.
+fn rust_call_target_is_v2_algebra_length(target: CallTargetIdentity) -> Bool {
+  match rust_call_target_declared_length(target: target) {
+    Absent => false
+    Present { value: id } =>
+      id.decl_name == "length" && id.owner_module_path == "v2.std.algebra"
+  }
+}
+
+fn rust_call_target_declared_length(target: CallTargetIdentity) -> DeclaredCallableIdentity? {
+  match target {
+    SourceDeclarationCall { owner_module_path: owner, decl_name: decl } =>
+      Present { value: DeclaredCallableIdentity { owner_module_path: owner, decl_name: decl } }
+    RuntimePrimitiveCall { primitive_name: _, projected_from: projected } => projected
+    LocallyBoundCall { name: _ } => none
+    CallableTargetUndetermined => none
+  }
+}
+
+fn rust_emit_length_on_host_string(call_target: CallTargetIdentity, func: String, args: List<Node>, call_semantics: CallSemantics?, registry: Map<String, ItemInfo>, scope: InferScope, depth: Int, shared_types: Set<String>, emit_info: EmitGraphInfo) -> String? {
+  if rust_call_target_is_v2_algebra_length(target: call_target) == false { none } else {
+    let length_args = order_typed_call_args_from_semantics(args: args, func: func, call_semantics: call_semantics, scope: scope)
+    match length_args |> first {
+      Absent => none
+      Present { value: xs_arg } =>
+        if is_host_text_typed_expr(e: arg_value(n: xs_arg), source_indices: scope.type_env.source_indices) {
+          Present { value: concat(
+            "v1_rt::string_length(&",
+            emit_typed_expr_base(texpr: arg_value(n: xs_arg), registry: registry, scope: scope, depth: depth, shared_types: shared_types, emit_info: emit_info),
+            ")"
+          ) }
+        } else { none }
+    }
+  }
+}
+
 fn emit_typed_call(func: String, args: List<Node>, inferred: InferredNode?, call_semantics: CallSemantics?, callee_is_function_value: Bool, call_target: CallTargetIdentity, registry: Map<String, ItemInfo>, scope: InferScope, depth: Int, shared_types: Set<String>, emit_info: EmitGraphInfo) -> String {
   if callee_is_function_value {
     return emit_typed_function_value_call(func: func, args: args, registry: registry, scope: scope, depth: depth, shared_types: shared_types, emit_info: emit_info)
@@ -12709,6 +12987,10 @@ fn emit_typed_call(func: String, args: List<Node>, inferred: InferredNode?, call
     }
     return disc_result
   }
+  match rust_emit_length_on_host_string(call_target: call_target, func: func, args: args, call_semantics: call_semantics, registry: registry, scope: scope, depth: depth, shared_types: shared_types, emit_info: emit_info) {
+    Present { value: lowered } => return lowered
+    Absent => {}
+  }
   let ordered_args = order_typed_call_args_from_semantics(args: args, func: func, call_semantics: call_semantics, scope: scope)
   let application_plan = call_semantics_supplied_application_plan(cs: call_semantics)
   let callee = match call_target {
@@ -13565,7 +13847,7 @@ fn emit_rust_first_method_call(receiver: Node, registry: Map<String, ItemInfo>,
         let skip_args = method_arg_nodes(texpr: receiver)
         let recv_str = emit_typed_expr(texpr: skip_recv, registry: registry, scope: scope, depth: depth, shared_types: shared_types, emit_info: emit_info, fuel: 1024)
         let n_str = emit_typed_first_arg(args: skip_args, registry: registry, scope: scope, depth: depth, shared_types: shared_types, emit_info: emit_info)
-        concat(recv_str, ".iter().cloned().skip(", n_str, " as usize).next()")
+        concat(recv_str, ".get((", n_str, ") as usize).cloned()")
       } else {
         let recv_str = emit_typed_expr(texpr: receiver, registry: registry, scope: scope, depth: depth, shared_types: shared_types, emit_info: emit_info, fuel: 1024)
         concat(recv_str, ".first().cloned()")
@@ -13695,7 +13977,7 @@ fn emit_typed_method_call(method_call_node: Node, receiver: Node, method: String
 
       let method_name_raw = authored_name_at(source_indices: scope.type_env.source_indices, node: method_def)
       let method_name = if method_name_raw == "length" {
-        if is_string_typed_expr(e: receiver, source_indices: scope.type_env.source_indices) { "string_length" } else { "count" }
+        if is_host_text_typed_expr(e: receiver, source_indices: scope.type_env.source_indices) { "string_length" } else { "count" }
       } else { method_name_raw }
       let algebra_field_call = rust_callable_field_method_call(method_name: method_name, receiver: receiver, args: args, registry: registry, scope: scope, depth: depth, shared_types: shared_types, emit_info: emit_info)
       if algebra_field_call != none {
@@ -13787,7 +14069,7 @@ fn freemonoid_match_arm_for(arms: List<Node>, variant: String) -> Node? {
   }) |> first
 }
 
-fn arm_resolved_parent_enum(arm: Node, scrut_type: String, type_summaries: Map<String, TypeSummary>) -> String? {
+fn arm_resolved_parent_enum(arm: Node, scrut_type: String, type_summaries: TypeSummaryIndex) -> String? {
   match arm_pattern(n: arm) {
     VariantPattern { name: n, parent_enum: pe, field_bindings: _, parent_identity: _ } =>
       pattern_parent_enum(name: qualified_last_segment(name: n), parent_enum: pe, scrut_type: scrut_type, type_summaries: type_summaries)
@@ -13814,7 +14096,7 @@ fn freemonoid_catchall_arm(arms: List<Node>) -> Node? {
   }) |> first
 }
 
-fn arms_are_freemonoid_coproduct(arms: List<Node>, scrut_type: String, type_summaries: Map<String, TypeSummary>) -> Bool {
+fn arms_are_freemonoid_coproduct(arms: List<Node>, scrut_type: String, type_summaries: TypeSummaryIndex) -> Bool {
   let has_empty = match freemonoid_match_arm_for(arms: arms, variant: "Empty") { Present { value: _ } => true  Absent => false }
   let has_cons = match freemonoid_match_arm_for(arms: arms, variant: "Cons") { Present { value: _ } => true  Absent => false }
   let empty_is_fm = match freemonoid_match_arm_for(arms: arms, variant: "Empty") {
@@ -14925,7 +15207,10 @@ fn emit_field_value_with_context(field_value: Node, struct_node: Node, outer_typ
           }
           let corrected_parent = match expected_type {
             Present { value: et } =>
-              if variant_belongs_to_enum(type_summaries: emit_info.type_summaries, variant_name: variant_name, enum_name: et) {
+              if match variant_belongs_to_enum(type_summaries: emit_info.type_summaries, variant_name: variant_name, enum_name: et) {
+                QuestionDecided { value: v } => v
+                _ => false
+              } {
                 Present { value: et }
               } else { pe }
             Absent => pe
@@ -14969,10 +15254,10 @@ fn record_field_expected_type(struct_node: Node, outer_type_name: String?, field
 // struct per anonymous record literal. The count needs no order, so it reads the keys unsorted. The
 // literal's names are unique (02_parse refuses a repeated field init), so presence plus equal count
 // is exactly set equality, as before.
-fn struct_candidates_by_field_names(field_names: List<String>, type_summaries: Map<String, TypeSummary>) -> List<TypeSummary> {
+fn struct_candidates_by_field_names(field_names: List<String>, type_summaries: TypeSummaryIndex) -> List<TypeSummary> {
   let n_fields = field_names |> count
   if n_fields == 0 { return [] }
-  map_values(type_summaries) |> filter(summary =>
+  type_summary_values(index: type_summaries) |> filter(summary =>
     match summary.repr {
       StructRepr =>
         field_names |> all(fn_name => map_contains_key(summary.field_type_map, fn_name))
@@ -15026,7 +15311,7 @@ fn effectful_self_recursion_diagnostics(tm: TypedModule, registry: Map<String, I
 // source language; the target compiler is never counted as part of this guarantee.
 
 
-fn anonymous_record_struct_candidates(field_names: List<String>, field_type_hints: Map<String, String>, type_summaries: Map<String, TypeSummary>) -> List<TypeSummary> {
+fn anonymous_record_struct_candidates(field_names: List<String>, field_type_hints: Map<String, String>, type_summaries: TypeSummaryIndex) -> List<TypeSummary> {
   let candidates = struct_candidates_by_field_names(field_names: field_names, type_summaries: type_summaries)
   if candidates |> count <= 1 { candidates }
   else {
@@ -15046,7 +15331,7 @@ fn anonymous_record_struct_candidates(field_names: List<String>, field_type_hint
   }
 }
 
-fn ambiguous_anonymous_record_literal_diagnostics(n: Node, type_summaries: Map<String, TypeSummary>, source_indices: Map<String, NewlineIndex>, module_name: String) -> List<ErrorNode> {
+fn ambiguous_anonymous_record_literal_diagnostics(n: Node, type_summaries: TypeSummaryIndex, source_indices: Map<String, NewlineIndex>, module_name: String) -> List<ErrorNode> {
   let current = match n.expr_data {
     ExprRecordLit { parent_enum: _ } =>
       match record_lit_type_name_at(texpr: n, source_indices: source_indices) {
@@ -15077,7 +15362,7 @@ fn ambiguous_anonymous_record_literal_diagnostics(n: Node, type_summaries: Map<S
   concat(current, concat(direct, concat(indirect, optional_nodes)))
 }
 
-fn find_struct_name_by_fields(field_names: List<String>, field_type_hints: Map<String, String>, type_summaries: Map<String, TypeSummary>) -> String? {
+fn find_struct_name_by_fields(field_names: List<String>, field_type_hints: Map<String, String>, type_summaries: TypeSummaryIndex) -> String? {
   let candidates = anonymous_record_struct_candidates(field_names: field_names, field_type_hints: field_type_hints, type_summaries: type_summaries)
   if candidates |> count == 1 {
     match candidates |> first {
@@ -15087,7 +15372,7 @@ fn find_struct_name_by_fields(field_names: List<String>, field_type_hints: Map<S
   } else { none }
 }
 
-fn find_unique_struct_name_by_fields(field_names: List<String>, type_summaries: Map<String, TypeSummary>) -> String? {
+fn find_unique_struct_name_by_fields(field_names: List<String>, type_summaries: TypeSummaryIndex) -> String? {
   let candidates = struct_candidates_by_field_names(field_names: field_names, type_summaries: type_summaries)
   if candidates |> count == 1 {
     match candidates |> first {
@@ -15108,7 +15393,7 @@ fn emit_typed_record_lit(type_name: String?, fields: List<Node>, parent_enum: St
     Present { value: sn } => Present { value: sn }
     Absent =>
       let rt_name = authored_name_at(source_indices: scope.type_env.source_indices, node: resolved_type)
-      if resolved_type.ident_span != none && map_contains_key(emit_info.type_summaries, rt_name) {
+      if resolved_type.ident_span != none && (type_summary_decided(index: emit_info.type_summaries, key: rt_name) != none) {
         Present { value: rt_name }
       } else { none }
   }
@@ -15193,7 +15478,7 @@ fn emit_typed_record_lit(type_name: String?, fields: List<Node>, parent_enum: St
       if keyed_container_has_target_inhabitant(container_name: tn, target: Rust) {
         return "panic!(\"record-shaped carrier has no realization in the selected Rust target inhabitant\")"
       }
-      let tn_is_known_struct = map_contains_key(emit_info.type_summaries, tn)
+      let tn_is_known_struct = (type_summary_decided(index: emit_info.type_summaries, key: tn) != none)
       let ctor_name = if tn_is_known_struct { tn }
         else {
           let resolved_struct = resolve_node(n: resolved_type, env: scope.type_env, module_name: scope.module_name).resolved
@@ -15214,7 +15499,10 @@ fn emit_typed_record_lit(type_name: String?, fields: List<Node>, parent_enum: St
           let rt_name = qualified_last_segment(name: authored_name_at(source_indices: si, node: resolved_type))
 
           if resolved_type.ident_span != none && rt_name != variant_surface_name && !rt_is_type_var && rt_name != "Error"
-            && variant_belongs_to_enum(type_summaries: emit_info.type_summaries, variant_name: variant_surface_name, enum_name: rt_name) {
+            && match variant_belongs_to_enum(type_summaries: emit_info.type_summaries, variant_name: variant_surface_name, enum_name: rt_name) {
+              QuestionDecided { value: v } => v
+              _ => false
+            } {
             Present { value: rt_name }
           } else {
             bare_parent_enum
@@ -15774,6 +16062,16 @@ fn is_string_typed_expr(e: Node, source_indices: Map<String, NewlineIndex>) -> B
   }
 }
 
+fn is_host_text_typed_expr(e: Node, source_indices: Map<String, NewlineIndex>) -> Bool {
+  match e.inferred {
+    Present { value: Resolved { node: rt } } =>
+      let is_optional = rt.return_cardinality == CardOptional
+      let inner = if is_optional { with_required_cardinality(n: rt) } else { rt }
+      is_host_text_carrier_type(n: inner, source_indices: source_indices)
+    _ => false
+  }
+}
+
 fn emit_typed_string_interp(parts: List<StringPart>, registry: Map<String, ItemInfo>, scope: InferScope, depth: Int, shared_types: Set<String>, emit_info: EmitGraphInfo) -> String {
   let has_interpolations = parts |> any(p => match p { Interpolation { expr: _ } => true  _ => false })
   let fmt_parts = parts |> map(p => typed_interp_format_part(part: p, registry: registry, scope: scope, depth: depth, shared_types: shared_types, emit_info: emit_info, has_interpolations: has_interpolations))
@@ -16341,7 +16639,7 @@ fn emit_dry_run_branch_from_props(op_name: String, inferred: Node, mock_props: L
 fn emit_transport_call(bound: BoundOperation, op_name: String, registry: Map<String, ItemInfo>, depth: Int, service_item: Node, op_node: Node, source_indices: Map<String, NewlineIndex>, shared_types: Set<String>, env: TypeEnv) -> String {
   match bound {
     RestBound { transport: t } => emit_rest_call(op_name: op_name, transport: t, registry: registry, depth: depth, service_item: service_item, op_node: op_node, source_indices: source_indices, shared_types: shared_types, env: env)
-    ShellBound { transport: t, result_fields: rsf } => emit_shell_call(op_name: op_name, transport: t, registry: registry, depth: depth, result_fields: rsf, op_node: op_node, source_indices: source_indices)
+    ShellBound { transport: t, result_fields: rsf } => emit_shell_call(op_name: op_name, transport: t, registry: registry, depth: depth, result_fields: rsf, op_node: op_node, source_indices: source_indices, env: env)
     FileBound { verb: v, path_template: pt, result_fields: fs } =>
       emit_file_call(verb: v, path_template: pt, result_fields: fs, source_indices: source_indices)
     LocalBound => emit_local_call(op_name: op_name)
@@ -16871,7 +17169,7 @@ fn emit_exit_code_handling(op_node: Node, result_fields: List<ShellResultField>,
     let has_nonzero = exit_props |> any(p => field_init_node_name_at(n: p, source_indices: source_indices) == "exit_nonzero")
     let exit_arms = exit_props |> map(p => emit_exit_arm(prop: p, result_fields: result_fields, source_indices: source_indices))
     let default_arm = if has_nonzero { "" }
-      else { concat("\n    _ => { ", shell_stderr_binding_line, " ", emit_rust_boxed_error_return(message_expr: "stderr"), " },") }
+      else { concat("\n    _ => { ", shell_error_stderr_binding(result_fields: result_fields), " ", emit_rust_boxed_error_return(message_expr: "stderr"), " },") }
     concat(
       "let exit_code = output.status.code().unwrap_or(-1);\n",
       "match exit_code {\n",
@@ -16890,7 +17188,7 @@ fn emit_exit_arm(prop: Node, result_fields: List<ShellResultField>, source_indic
   if is_success {
     concat("    ", pattern, " => { ", emit_shell_return(result_fields: result_fields), " },")
   } else {
-    concat("    ", pattern, " => { ", shell_stderr_binding_line, " ", emit_rust_boxed_error_return(message_expr: "stderr"), " },")
+    concat("    ", pattern, " => { ", shell_error_stderr_binding(result_fields: result_fields), " ", emit_rust_boxed_error_return(message_expr: "stderr"), " },")
   }
 }
 
@@ -16900,7 +17198,10 @@ fn emit_exit_arm(prop: Node, result_fields: List<ShellResultField>, source_indic
 // replace one loud stop with another whose red this route cannot adjudicate (an emitted panic
 // COMPILES, so the fixture pairs beside this change would report it green). Only the LATER elements
 // admit both shapes; see shell_argv_element_is_word_list.
-fn emit_shell_call(op_name: String, transport: Node, registry: Map<String, ItemInfo>, depth: Int, result_fields: List<ShellResultField>, op_node: Node, source_indices: Map<String, NewlineIndex>) -> String {
+// Capture order: bind/validate the authored policy BEFORE spawn; start both drains
+// immediately; write stdin concurrently; join; then project BoundedTail or refuse
+// Complete overflow.
+fn emit_shell_call(op_name: String, transport: Node, registry: Map<String, ItemInfo>, depth: Int, result_fields: List<ShellResultField>, op_node: Node, source_indices: Map<String, NewlineIndex>, env: TypeEnv) -> String {
   let argv = transport.children
   let optional_params = op_node.params
     |> filter(p => param_node_type_expr(n: p).return_cardinality == CardOptional)
@@ -16912,7 +17213,8 @@ fn emit_shell_call(op_name: String, transport: Node, registry: Map<String, ItemI
     Present { value: _ } => true
     Absent => false
   }
-  let let_kw = if has_stdin { "let mut output" } else { "let output" }
+  let needs_capture = shell_needs_capture_accounting(result_fields: result_fields)
+  let let_kw = if has_stdin || needs_capture { "let mut output" } else { "let output" }
   let cmd_line = if argv |> count > 0 {
     match argv |> first {
       Present { value: first_arg } => concat(let_kw, " = std::process::Command::new(",
@@ -16938,7 +17240,24 @@ fn emit_shell_call(op_name: String, transport: Node, registry: Map<String, ItemI
     concat("    .env(\"", field_init_node_name_at(n: e, source_indices: source_indices), "\", ", emit_simple_expr(expr: field_init_node_value(n: e), target: Rust, source_indices: source_indices), ")")
   )
   let wd_line = "    .current_dir(self.working_dir.as_deref().unwrap_or(\".\"))"
-  if has_stdin {
+  let return_line = emit_exit_code_handling(op_node: op_node, result_fields: result_fields, source_indices: source_indices)
+  if needs_capture {
+    let policy_bind = emit_shell_stderr_policy_binding(op_node: op_node, env: env)
+    let spawn_line = "    .stdin(std::process::Stdio::piped())\n    .stdout(std::process::Stdio::piped())\n    .stderr(std::process::Stdio::piped())"
+    let spawn_exec = "    .spawn()?;"
+    let stdin_thread = if has_stdin {
+      let stdin_expr = transport_stdin(t: transport, source_indices: source_indices).value
+      let stdin_var = match stdin_expr.expr_data {
+        ExprVar { binding_kind: _ } => emit_ident(name: expr_var_name_at(texpr: stdin_expr, source_indices: source_indices), target: Rust)
+        _ => emit_simple_expr(expr: stdin_expr, target: Rust, source_indices: source_indices)
+      }
+      concat("let mut stdin_pipe = output.stdin.take();\nlet __stdin_thread = std::thread::spawn(move || -> std::io::Result<()> {\n    use std::io::Write;\n    if let Some(mut stdin) = stdin_pipe {\n        stdin.write_all(", stdin_var, ".as_bytes())?;\n    }\n    Ok(())\n});\n")
+    } else {
+      "let mut stdin_pipe = output.stdin.take();\nlet __stdin_thread = std::thread::spawn(move || -> std::io::Result<()> {\n    drop(stdin_pipe);\n    Ok(())\n});\n"
+    }
+    let capture_lines = concat(shell_capture_drain_start, stdin_thread, shell_capture_join_project)
+    concat([policy_bind, cmd_line], arg_lines, env_lines, [wd_line, spawn_line, spawn_exec, capture_lines, return_line]) |> join(separator: "\n")
+  } else if has_stdin {
     let stdin_expr = transport_stdin(t: transport, source_indices: source_indices).value
     let stdin_var = match stdin_expr.expr_data {
       ExprVar { binding_kind: _ } => emit_ident(name: expr_var_name_at(texpr: stdin_expr, source_indices: source_indices), target: Rust)
@@ -16949,15 +17268,11 @@ fn emit_shell_call(op_name: String, transport: Node, registry: Map<String, ItemI
     let write_block = concat("{\n    use std::io::Write;\n    if let Some(mut stdin) = output.stdin.take() {\n        stdin.write_all(", stdin_var, ".as_bytes())?;\n    }\n}")
     let wait_line = "let output = output.wait_with_output()?;"
     let check_line = "let stdout = String::from_utf8_lossy(&output.stdout).to_string();"
-    let return_line = emit_exit_code_handling(op_node: op_node, result_fields: result_fields, source_indices: source_indices)
-    let all_lines = concat([cmd_line], arg_lines, env_lines, [wd_line, spawn_line, spawn_exec, write_block, wait_line, check_line, return_line])
-    all_lines |> join(separator: "\n")
+    concat([cmd_line], arg_lines, env_lines, [wd_line, spawn_line, spawn_exec, write_block, wait_line, check_line, return_line]) |> join(separator: "\n")
   } else {
     let output_line = "    .output()?;"
     let check_line = "let stdout = String::from_utf8_lossy(&output.stdout).to_string();"
-    let return_line = emit_exit_code_handling(op_node: op_node, result_fields: result_fields, source_indices: source_indices)
-    let all_lines = concat([cmd_line], arg_lines, env_lines, [wd_line, output_line, check_line, return_line])
-    all_lines |> join(separator: "\n")
+    concat([cmd_line], arg_lines, env_lines, [wd_line, output_line, check_line, return_line]) |> join(separator: "\n")
   }
 }
 
@@ -17065,6 +17380,48 @@ fn emit_shell_argv_element(arg: Node, optional_params: Map<String, Bool>, source
 // error.
 data shell_stderr_binding_line: String = "let stderr = String::from_utf8_lossy(&output.stderr).to_string();"
 
+fn shell_needs_capture_accounting(result_fields: List<ShellResultField>) -> Bool {
+  result_fields |> any(f => shell_channel_is_capture_accounting(c: f.channel))
+}
+
+fn shell_error_stderr_binding(result_fields: List<ShellResultField>) -> String {
+  if shell_needs_capture_accounting(result_fields: result_fields) { "" } else { concat(shell_stderr_binding_line, " ") }
+}
+
+fn emit_shell_stderr_policy_binding(op_node: Node, env: TypeEnv) -> String {
+  if operation_declares_required_stderr_capture_policy(op_node: op_node, env: env) {
+    concat(
+      "let (__stderr_complete_limit, __stderr_complete_source): (Option<usize>, String) = match &*stderr_capture {\n",
+      "    crate::std_shell_stream_capture::WitnessStderrCapturePolicy::Complete => {\n",
+      "        match v1_rt::read_host_budget_bytes() {\n",
+      "            (Some(n), source) => (Some(n as usize), source),\n",
+      "            (None, source) => return Err(format!(\"WitnessStderrCaptureCompleteBudgetUnreadable: Complete stderr capture requires the active host budget authority ({})\", source).into()),\n",
+      "        }\n",
+      "    }\n",
+      "    crate::std_shell_stream_capture::WitnessStderrCapturePolicy::BoundedTail { bytes } => {\n",
+      "        let n = crate::std_measure::byte_size_count(bytes.clone());\n",
+      "        if n < 0 { return Err(\"WitnessStderrCapturePolicy.BoundedTail bytes must be non-negative\".into()); }\n",
+      "        (None, String::new())\n",
+      "    }\n",
+      "};\n",
+      "let __stderr_tail_bytes: usize = match &*stderr_capture {\n",
+      "    crate::std_shell_stream_capture::WitnessStderrCapturePolicy::BoundedTail { bytes } => crate::std_measure::byte_size_count(bytes.clone()) as usize,\n",
+      "    crate::std_shell_stream_capture::WitnessStderrCapturePolicy::Complete => 0,\n",
+      "};\n"
+    )
+  } else {
+    concat(
+      "return Err(\"",
+      shell_emission_refusal_fact(refusal: ShellCapturePolicyInputAbsent { key: "stderr_truncated" }),
+      "\".into());\n"
+    )
+  }
+}
+
+data shell_capture_drain_start: String = "let mut stdout_pipe = output.stdout.take();\nlet mut stderr_pipe = output.stderr.take();\nlet stdout_thread = std::thread::spawn(move || -> std::io::Result<Vec<u8>> {\n    let mut buf = Vec::new();\n    if let Some(ref mut reader) = stdout_pipe {\n        std::io::Read::read_to_end(reader, &mut buf)?;\n    }\n    Ok(buf)\n});\nlet stderr_thread = std::thread::spawn(move || -> std::io::Result<(Vec<u8>, u64, bool)> {\n    let mut reader = match stderr_pipe {\n        Some(r) => r,\n        None => return Ok((Vec::new(), 0, false)),\n    };\n    let mut chunk = [0u8; 65536];\n    let mut total: u64 = 0;\n    if let Some(max_bytes) = __stderr_complete_limit {\n        let mut retained = Vec::new();\n        loop {\n            let n = std::io::Read::read(&mut reader, &mut chunk)?;\n            if n == 0 { break; }\n            total += n as u64;\n            if total <= max_bytes as u64 { retained.extend_from_slice(&chunk[..n]); }\n        }\n        let truncated = total > max_bytes as u64;\n        return Ok((if truncated { Vec::new() } else { retained }, total, truncated));\n    }\n    let cap = __stderr_tail_bytes;\n    let mut ring = Vec::with_capacity(cap);\n    let mut start = 0usize;\n    loop {\n        let n = std::io::Read::read(&mut reader, &mut chunk)?;\n        if n == 0 { break; }\n        total += n as u64;\n        for &b in &chunk[..n] {\n            if cap == 0 { continue; }\n            if ring.len() < cap {\n                ring.push(b);\n            } else {\n                ring[start] = b;\n                start = (start + 1) % cap;\n            }\n        }\n    }\n    let retained = if ring.len() < cap || cap == 0 {\n        ring\n    } else {\n        let mut out = Vec::with_capacity(cap);\n        for i in 0..cap { out.push(ring[(start + i) % cap]); }\n        out\n    };\n    let retained_len = retained.len() as u64;\n    Ok((retained, total, total > retained_len))\n});\n"
+
+data shell_capture_join_project: String = "let status = output.wait()?;\n__stdin_thread.join().map_err(|_| std::io::Error::new(std::io::ErrorKind::Other, \"stdin write thread panicked\"))??;\nlet stdout_bytes = stdout_thread.join().map_err(|_| std::io::Error::new(std::io::ErrorKind::Other, \"stdout drain thread panicked\"))??;\nlet (stderr_bytes, stderr_total_u64, stderr_truncated) = stderr_thread.join().map_err(|_| std::io::Error::new(std::io::ErrorKind::Other, \"stderr drain thread panicked\"))??;\nif let Some(max_bytes) = __stderr_complete_limit {\n    if stderr_total_u64 > max_bytes as u64 {\n        return Err(format!(\"WitnessStderrCaptureCompleteBudgetExceeded: stderr total {} exceeds host budget {} ({})\", stderr_total_u64, max_bytes, __stderr_complete_source).into());\n    }\n}\nlet stderr_total_bytes = stderr_total_u64 as i64;\nlet stderr_retained_bytes = stderr_bytes.len() as i64;\nlet stdout = String::from_utf8_lossy(&stdout_bytes).to_string();\nlet stderr = String::from_utf8_lossy(&stderr_bytes).trim_end().to_string();\nlet output = std::process::Output { status, stdout: stdout_bytes, stderr: stderr_bytes };\n"
+
 // Answers the declared fields in declared order, from the projection the binding
 // resolved, as the method's SUCCESS value.
 //
@@ -17103,11 +17460,14 @@ fn shell_projection_value(result_fields: List<ShellResultField>) -> String {
 // `stderr` is captured only when a declared field asks for it, so an operation
 // that does not is not handed an unused binding.
 fn shell_stderr_prelude(result_fields: List<ShellResultField>) -> String {
-  let needs_stderr = result_fields |> any(f => match f.channel {
-    ShellChanStderr => true
-    _ => false
-  })
-  if needs_stderr { concat(shell_stderr_binding_line, "\n") } else { "" }
+  if shell_needs_capture_accounting(result_fields: result_fields) { "" }
+  else {
+    let needs_stderr = result_fields |> any(f => match f.channel {
+      ShellChanStderr => true
+      _ => false
+    })
+    if needs_stderr { concat(shell_stderr_binding_line, "\n") } else { "" }
+  }
 }
 
 // TOTAL BY CONSTRUCTION over the channels the binding resolves. The `stdout`
@@ -17125,9 +17485,9 @@ fn emit_shell_channel_expr(channel: ShellResultChannel, is_optional: Bool) -> St
     ShellChanExitCode => "(output.status.code().unwrap_or(-1) as i64)"
     ShellChanStdoutLines =>
       rust_shared_wrap_ctor(inner_expr: "stdout.lines().filter(|l| !l.is_empty()).map(|l| l.trim().to_string()).collect()")
-    ShellChanStderrTruncated => emit_unrealizable_shell_channel(channel: channel)
-    ShellChanStderrTotalBytes => emit_unrealizable_shell_channel(channel: channel)
-    ShellChanStderrRetainedBytes => emit_unrealizable_shell_channel(channel: channel)
+    ShellChanStderrTruncated => "stderr_truncated"
+    ShellChanStderrTotalBytes => "stderr_total_bytes"
+    ShellChanStderrRetainedBytes => "stderr_retained_bytes"
   }
   if is_optional { concat("Some(", base, ")") } else { base }
 }
@@ -17432,6 +17792,13 @@ fn data_def_annotation_is_named_refinement(annotation: Node, source_indices: Map
 // declared type decided by the carrier and its wrap decided by the spelling, and needs_rc is
 // threaded into emit_data_def_body, so the value took the same answer as the signature. Routed to
 // the carrier authority; the spelling key is deleted rather than kept beside it.
+// A NAMED REFINEMENT ROW KEEPS ITS DECLARED `?`. A where-refinement such as std.types NonEmptyStr
+// resolves to a Conj carrying its base as one child, so it fails preserves_declared_brand's
+// childless test and is rendered by the named-refinement arm -- the one arm that rendered through
+// coerce_primitive_type without rust_carrier_optional_wrap. gunbc.fleet_tailnet
+// fleet_tailnet_domain (`NonEmptyStr? = Present { .. }`) was emitted `-> NonEmptyStr` and its
+// consumer refused E0308. The control is gunbc.instruments.native_emission_controls
+// optional_data_row_cases.
 fn emit_data_def(name: String, type_node: Node, value: Node, registry: Map<String, ItemInfo>, scope: InferScope, depth: Int, shared_types: Set<String>, emit_info: EmitGraphInfo) -> String {
   let ambiguous_annotation_head = v1_type_exprs_ambiguous_declared_head(type_exprs: [type_node], type_decl_items: emit_info.type_decl_items, source_indices: scope.type_env.source_indices)
   if ambiguous_annotation_head != "" {
@@ -17453,7 +17820,7 @@ fn emit_data_def(name: String, type_node: Node, value: Node, registry: Map<Strin
   let raw_ty_str = if preserves_declared_brand {
     rust_ground_opaque_kernel_type_name(name: ann_name)
   } else if data_def_annotation_is_named_refinement(annotation: annotation_type_node, source_indices: scope.type_env.source_indices) {
-    coerce_primitive_type(decision: type_reference_realization(n: annotation_type_node, dag_name: authored_name_at(source_indices: scope.type_env.source_indices, node: annotation_type_node), target: Rust), dag_name: authored_name_at(source_indices: scope.type_env.source_indices, node: annotation_type_node))
+    rust_carrier_optional_wrap(n: annotation_type_node, rendered: coerce_primitive_type(decision: type_reference_realization(n: annotation_type_node, dag_name: authored_name_at(source_indices: scope.type_env.source_indices, node: annotation_type_node), target: Rust), dag_name: authored_name_at(source_indices: scope.type_env.source_indices, node: annotation_type_node)))
   } else {
     render_rust_type_with_applied_binding(n: render_type_node, shared_types: shared_types, source_indices: scope.type_env.source_indices, env: scope.type_env)
   }
@@ -17521,6 +17888,11 @@ fn data_row_type_forbids_deserialize(type_node: Node, emit_info: EmitGraphInfo,
   type_expr_reaches_sealed_carrier(n: type_node, emit_info: emit_info, source_indices: source_indices, seen: empty_map())
 }
 
+// Named rather than inlined because `if x == Variant {` parses as a record literal in .dag.
+fn data_row_declares_optional(type_node: Node) -> Bool {
+  type_node.return_cardinality == CardOptional
+}
+
 fn emit_data_def_body(type_node: Node, value: Node, registry: Map<String, ItemInfo>, scope: InferScope, depth: Int, shared_types: Set<String>, emit_info: EmitGraphInfo, needs_rc: Bool) -> String {
   let raw_ty_str = render_rust_type(n: type_node, shared_types: shared_types, source_indices: scope.type_env.source_indices, emit_info: emit_info)
   let type_name = authored_name_at(source_indices: scope.type_env.source_indices, node: type_node)
@@ -17579,7 +17951,12 @@ fn emit_data_def_body(type_node: Node, value: Node, registry: Map<String, ItemIn
   } else if match value.expr_data { ExprElaboratedLiteral { value: _, elaboration: _ } => true _ => false } {
     concat("            ", emit_typed_expr(texpr: value, registry: registry, scope: scope, depth: depth, shared_types: shared_types, emit_info: emit_info, fuel: 1024))
   } else if has_nested_records_node(n: type_node, source_indices: scope.type_env.source_indices) && data_value_is_json_literal_tree(value: value) && !data_row_type_forbids_deserialize(type_node: type_node, emit_info: emit_info, source_indices: scope.type_env.source_indices) {
-    match emit_data_value_json(value: value, source_indices: scope.type_env.source_indices, variant_wire: emit_info.data_variant_wire_spellings) {
+    let row_json = if data_row_declares_optional(type_node: type_node) {
+      emit_declared_optional_row_json(value: value, inner_type_name: authored_name_at(source_indices: scope.type_env.source_indices, node: type_node), source_indices: scope.type_env.source_indices, variant_wire: emit_info.data_variant_wire_spellings)
+    } else {
+      emit_data_value_json(value: value, source_indices: scope.type_env.source_indices, variant_wire: emit_info.data_variant_wire_spellings)
+    }
+    match row_json {
       Refused { reason: r } => concat("            compile_error!(\"", escape_string_literal_body(s: r), "\")")
       Emitted { json: json_str } => concat("            serde_json::from_str(\"", escape_string_literal_body(s: json_str), "\")\n",
         "                .expect(\"valid data definition\")")
@@ -17704,62 +18081,6 @@ fn emit_cargo_dep_no_default_features(name: String, version: String, features: L
   concat(name, " = { version = \"", version, "\", default-features = false, features = [", feat_strs |> join(separator: ", "), "] }\n")
 }
 
-// WHAT THE EMITTED CRATE DEPENDS ON IS DERIVED FROM WHAT WAS EMITTED, NOT DECLARED BESIDE IT.
-//
-// A fixed dependency list is a SECOND AUTHORITY for the crate's dependencies, free to disagree
-// with the sources the same run just wrote. It did disagree: `clap` was declared unconditionally
-// while the one thing that renders `use clap` -- the generated pipeline dispatch -- is selected by
-// the emission itself, so every crate emitted without it declared a dependency no emitted line
-// referenced. (A derived CLI over "workflow" functions was the second clap renderer; it is deleted.) DESIGN
-// section 5 prefers construction over validation, and the construction here is to make the demand
-// a FIELD THE EMISSION FILLS rather than a literal a reader must check against the output.
-//
-// THE RESIDUE IS NAMED RATHER THAN CLAIMED CLOSED. `ureq` sits in the base list on the same
-// footing `clap` used to: it is referenced only when a corpus reaches the HTTP extdep, and nothing
-// in this function's inputs says whether it did. It is not conditioned here because inventing a
-// predicate from the emitted TEXT would be a scan standing where a structural fact belongs.
-// NEXT-RUNG TRIGGER: an emission-level demand fact per external crate -- the renderer that emits a
-// `ureq` call recording that it did -- at which point this carrier gains one field per dependency
-// and the base list holds only what every emitted crate genuinely links.
-type EmittedCrateDependencyDemand {
-  renders_clap_cli: Bool
-  renders_async_services: Bool
-}
-
-fn emitted_crate_dependency_lines(demand: EmittedCrateDependencyDemand) -> List<String> {
-  let base_deps = [
-    emit_cargo_dep(name: "im", version: "15.1", features: ["serde"]),
-    emit_cargo_dep(name: "unicode-ident", version: "1", features: []),
-    emit_cargo_dep(name: "unicode-properties", version: "0.1", features: ["emoji"]),
-    emit_cargo_dep(name: "serde", version: "1", features: ["derive", "rc"]),
-    emit_cargo_dep(name: "serde_json", version: "1", features: []),
-    emit_cargo_dep(name: "libc", version: "0.2", features: []),
-    emit_cargo_dep(name: "stacker", version: "0.1", features: []),
-    emit_cargo_dep(name: "lazy_static", version: "1", features: []),
-    emit_cargo_dep(name: "ureq", version: "2", features: ["json"])
-  ]
-  let cli_deps = if demand.renders_clap_cli {
-    [emit_cargo_dep(name: "clap", version: "4", features: ["derive"])]
-  } else { [] }
-  let async_deps = if demand.renders_async_services {
-    [
-      emit_cargo_dep(name: "tokio", version: "1", features: ["full"]),
-      emit_cargo_dep_no_default_features(name: "reqwest", version: "0.12", features: ["json", "rustls-tls", "http2", "charset"]),
-      emit_cargo_dep(name: "async-trait", version: "0.1", features: [])
-    ]
-  } else { [] }
-  concat(base_deps, concat(cli_deps, async_deps))
-}
-
-// The emitted crate always carries v1_rt.rs, so its manifest declares the runtime's features.
-fn emit_cargo_toml(crate_name: String, demand: EmittedCrateDependencyDemand) -> TextFile {
-  let header = concat(render_cargo_package_header_prefix(name: crate_name), "\nedition = \"2021\"\n")
-  let workspace = "\n[workspace]\n"
-  let all_deps = emitted_crate_dependency_lines(demand: demand)
-  let features = emit_cargo_features_section(features: rust_runtime_cargo_features())
-  TextFile { path: "Cargo.toml", content: concat(header, workspace, features, "\n[dependencies]\n", all_deps |> join(separator: "")) }
-}
-
 fn emit_cargo_feature(feature: CargoFeature) -> String {
   if (feature.dependencies |> count) == 0 {
     concat(feature.name, " = []\n")
@@ -18179,7 +18500,152 @@ fn emit_gunbc_cli_dispatch_generated(crate_name: String) -> TextFile {
 // a library: its main is the typed entry-point-absent refusal. The derived "workflow" CLI that used
 // to answer below the pipeline arms -- one clap subcommand per function carrying `uses` or reaching
 // a service -- is deleted: it renamed the effect axis an entry role, and no built closure reached it.
-fn emit_main_rs(modules: List<TypedModule>, has_services: Bool, crate_name: String, registry: Map<String, ItemInfo>) -> TextFile {
+// ── THE NATIVE ENTRY'S EFFECT HANDLES, FROM ONE VERDICT ────────────────────────────────────
+// v1.compiler.emit NativeEffectRealizationAdmission is computed here once per native entry, in the
+// order emit_func_params renders the entry function's effect parameters (its `uses` resources, then
+// the services it reaches), and BOTH consumers read that one list: the emission refusal below, and
+// the rendered main, which binds exactly the bound handlers. No main writes a handle by hand.
+type NativeEntryEffects {
+  entry_module: String
+  entry_function: String
+  admissions: List<NativeEffectRealizationAdmission>
+}
+
+fn native_entry_function_name(modules: List<TypedModule>) -> String? {
+  if compiler_pipeline_entry_is_native_serve(modules: modules) { Present { value: native_serve_entry_function } }
+  else if compiler_pipeline_entry_is_native_cli(modules: modules) { Present { value: native_cli_entry_function } }
+  else if compiler_pipeline_entry_is_native_claim(modules: modules) { Present { value: native_claim_entry_function } }
+  else { none }
+}
+
+data native_serve_entry_function: String = "native_serve_handle"
+data native_cli_entry_function: String = "v2_cli_main"
+data native_claim_entry_function: String = "native_claim_report"
+
+fn native_effect_decl_sites(modules: List<TypedModule>, kind: ParsedModuleItemKind, name: String) -> List<NativeEffectDeclSite> {
+  modules |> flat_map(tm => {
+    let si = tm.type_env.source_indices
+    let module_name = authored_name_at(source_indices: si, node: tm.module)
+    tm.items
+      |> filter(item => item.module_item_kind == kind && authored_name_at(source_indices: si, node: item) == name)
+      |> map(item => NativeEffectDeclSite { item: item, module_name: module_name })
+  })
+}
+
+fn native_entry_denominator(modules: List<TypedModule>) -> NativeEffectDenominator {
+  if compiler_pipeline_entry_is_native_serve(modules: modules) { native_service_route_denominator }
+  else if compiler_pipeline_entry_is_native_claim(modules: modules) { native_claim_route_denominator }
+  else { native_compiler_route_denominator }
+}
+
+fn native_entry_effects(modules: List<TypedModule>, registry: Map<String, ItemInfo>) -> NativeEntryEffects? {
+  match native_entry_function_name(modules: modules) {
+    Absent => none
+    Present { value: entry_fn } => {
+      let entry_module = compiler_pipeline_entry_module_name(modules: modules)
+      let denominator = native_entry_denominator(modules: modules)
+      let entry_si = modules
+        |> filter(tm => authored_name_at(source_indices: tm.type_env.source_indices, node: tm.module) == entry_module)
+        |> map(tm => tm.type_env.source_indices)
+        |> first
+      let si = match entry_si { Present { value: x } => x  Absent => empty_map() }
+      let info = lookup_item_by_identity(registry: registry, id: DeclaredCallableIdentity { owner_module_path: entry_module, decl_name: entry_fn })
+      let resources = match info { Present { value: i } => i.resource_requirements  Absent => [] }
+      let services = match info { Present { value: i } => i.service_names  Absent => [] }
+      let resource_admissions = resources |> map(r => {
+        let rname = type_leaf_name_for_collapse(n: r.resource, source_indices: si)
+        admit_native_resource_effect(binding: r.binding_name, resource: rname,
+          resolution: native_effect_resolution(sites: native_effect_decl_sites(modules: modules, kind: ModuleItemResource, name: rname)),
+          denominator: denominator)
+      })
+      let service_admissions = services |> map(sn =>
+        admit_native_service_effect(service: sn,
+          resolution: native_effect_resolution(sites: native_effect_decl_sites(modules: modules, kind: ModuleItemService, name: sn)),
+          denominator: denominator, source_indices: si)
+      )
+      Present { value: NativeEntryEffects {
+        entry_module: entry_module,
+        entry_function: entry_fn,
+        admissions: concat(resource_admissions, service_admissions)
+      } }
+    }
+  }
+}
+
+fn native_entry_effect_diagnostics(effects: NativeEntryEffects?, modules: List<TypedModule>) -> List<ErrorNode> {
+  match effects {
+    Absent => []
+    Present { value: e } => {
+      let refusals = e.admissions |> flat_map(a => match native_effect_admission_refusal(a: a) {
+        Present { value: r } => [r]
+        Absent => []
+      })
+      if (refusals |> count) == 0 { [] } else {
+        let span = modules
+          |> filter(tm => authored_name_at(source_indices: tm.type_env.source_indices, node: tm.module) == e.entry_module)
+          |> map(tm => tm.module.span)
+          |> first
+        match span {
+          Present { value: sp } => [make_error_node(
+            diagnostic: NativeEffectRealizationRefused { entry: concat(e.entry_module, concat(".", e.entry_function)), refusals: refusals, span: sp },
+            module_name: e.entry_module)]
+          Absent => [make_error_node(
+            diagnostic: NativeEffectRealizationRefused { entry: concat(e.entry_module, concat(".", e.entry_function)), refusals: concat(refusals, ["the entry module is not in the closure"]), span: no_span() },
+            module_name: e.entry_module)]
+        }
+      }
+    }
+  }
+}
+
+// The rendered binding of one admitted handler: the `let` that constructs it and the argument that
+// lends it to the entry function. Only a bound admission renders; the refusal above has already
+// stopped emission for any other arm, so nothing here guesses.
+type NativeEffectBindingText {
+  var: String
+  type_path: String
+  binding_line: String
+  argument: String
+}
+
+fn native_effect_binding_of(var: String, type_path: String, constructor: String) -> NativeEffectBindingText {
+  NativeEffectBindingText {
+    var: var,
+    type_path: type_path,
+    binding_line: concat("    let ", var, " = ", constructor, ";\n"),
+    argument: concat("&", var)
+  }
+}
+
+fn native_effect_binding_text(a: NativeEffectRealizationAdmission, crate_name: String) -> NativeEffectBindingText? {
+  match a {
+    NativeEffectHandlerBound { effect_contract: c, handler_identity: _ } => match c {
+      NativeServiceEffect { declaration: d } => {
+        let sn = d.decl_name as String
+        let path = concat(crate_name, "::", module_to_filename(name: d.module_path as String), "::", sanitize_service_name(name: sn))
+        Present { value: native_effect_binding_of(var: service_var_name(service_name: sn), type_path: path, constructor: concat(path, "::new(Default::default())")) }
+      }
+      NativeResourceEffect { binding: b, declaration: d } => {
+        let path = concat(crate_name, "::", module_to_filename(name: d.module_path as String), "::", d.decl_name as String)
+        Present { value: native_effect_binding_of(var: emit_ident(name: b, target: Rust), type_path: path, constructor: path) }
+      }
+    }
+    _ => none
+  }
+}
+
+fn native_effect_bindings(effects: NativeEntryEffects?, crate_name: String) -> List<NativeEffectBindingText> {
+  match effects {
+    Absent => []
+    Present { value: e } => e.admissions |> flat_map(a =>
+      match native_effect_binding_text(a: a, crate_name: crate_name) {
+        Present { value: t } => [t]
+        Absent => []
+      })
+  }
+}
+
+fn emit_main_rs(modules: List<TypedModule>, has_services: Bool, crate_name: String, effects: NativeEntryEffects?) -> TextFile {
   let retained_host_pipeline = compiler_pipeline_entry_is_retained_host(modules: modules)
   let pipeline_module = compiler_pipeline_entry_module_name(modules: modules)
   if compiler_pipeline_entry_is_ambiguous(modules: modules) {
@@ -18198,17 +18664,13 @@ fn emit_main_rs(modules: List<TypedModule>, has_services: Bool, crate_name: Stri
       return emit_source_root_eval_driver_main_rs(crate_name: crate_name, pipeline_module: pipeline_module)
     }
     if compiler_pipeline_entry_is_native_cli(modules: modules) {
-      return emit_native_cli_driver_main_rs(crate_name: crate_name, pipeline_module: pipeline_module)
+      return emit_native_cli_driver_main_rs(crate_name: crate_name, pipeline_module: pipeline_module, bindings: native_effect_bindings(effects: effects, crate_name: crate_name))
     }
     if compiler_pipeline_entry_is_native_claim(modules: modules) {
-      return emit_native_claim_driver_main_rs(
-        crate_name: crate_name,
-        pipeline_module: pipeline_module,
-        demand: native_claim_report_effect_demand(registry: registry, pipeline_module: pipeline_module)
-      )
+      return emit_native_claim_driver_main_rs(crate_name: crate_name, pipeline_module: pipeline_module, bindings: native_effect_bindings(effects: effects, crate_name: crate_name))
     }
     if compiler_pipeline_entry_is_native_serve(modules: modules) {
-      return emit_native_serve_driver_main_rs(crate_name: crate_name, pipeline_module: pipeline_module)
+      return emit_native_serve_driver_main_rs(crate_name: crate_name, pipeline_module: pipeline_module, bindings: native_effect_bindings(effects: effects, crate_name: crate_name))
     }
     if compiler_pipeline_entry_is_direct_ingest(modules: modules) {
       return emit_direct_ingest_driver_main_rs(crate_name: crate_name, pipeline_module: pipeline_module)
@@ -18335,8 +18797,12 @@ fn emit_host_source_root_read_rs(crate_name: String) -> String {
     "    let observed = runtime.block_on(", crate_name, "::gunbc_source_root_read::source_root_read(Rc::new(source_roots.iter().cloned().collect()), &filesystem));\n",
     "    match observed {\n",
     "        Ok(files) => match &*files {\n",
-    "            ", crate_name, "::gunbc_source_root_read::SourceRootFiles::SourceRootFilesRead { files } =>\n",
-    "                ", crate_name, "::v2_compiler_source_authority::source_root_ingest_from_files(files.clone()).iter().cloned().collect(),\n",
+    "            ", crate_name, "::gunbc_source_root_read::SourceRootFiles::SourceRootFilesRead { files } => match &*", crate_name, "::v2_compiler_source_authority::source_root_ingest_from_files(files.clone()) {\n",
+    "                ", crate_name, "::v2_compiler_source_authority::SourceRootIngestFromFiles::SourceRootIngestFromFilesBuilt { ingest } => ingest.iter().cloned().collect(),\n",
+    "                ", crate_name, "::v2_compiler_source_authority::SourceRootIngestFromFiles::SourceRootIngestFromFilesUnrecognizedRoot { argument, path } => {\n",
+    "                    eprintln!(\"REFUSED: source root is not a dag or src/v2 tree: {} (file {})\", argument, path); std::process::exit(2);\n",
+    "                }\n",
+    "            },\n",
     "            ", crate_name, "::gunbc_source_root_read::SourceRootFiles::SourceRootFilesRefused { path, kind, cause } => {\n",
     "                eprintln!(\"REFUSED: could not read source root at {} [{}]: {}\", path, kind, cause); std::process::exit(2);\n",
     "            }\n",
@@ -18353,37 +18819,18 @@ fn emit_host_source_root_read_rs(crate_name: String) -> String {
 // gunbc test reads (0 held, 1 not held, 2 no observation). No code is taken from the program, so no
 // program can reach a fourth status or a failure spelled as 0. The reason goes to stderr so the case
 // rows on stdout stay the whole observation a reader joins by identity.
-// WHAT THE REPORT DEMANDS OF ITS HOST, read from the one effect authority (item_is_effectful_callee
-// over the registry row the report's declaration produces), never from the entry module's imports.
-// The declared resource set of a NativeClaimDriver is {Filesystem}: a pure report gets the sync main
-// below unchanged, a report whose only demand is the Filesystem service gets that service bound to
-// the existing filesystem_io handler -- the binding NativeCliDriver's main already performs -- and
-// anything else is a typed refusal in place of a main, because binding an effect this driver does
-// not declare would be a transport no row admitted.
-type NativeClaimEffectDemand
-  = NativeClaimPure
-  | NativeClaimFilesystem
-  | NativeClaimUndeclaredEffect { detail: String }
-
-fn native_claim_report_effect_demand(registry: Map<String, ItemInfo>, pipeline_module: String) -> NativeClaimEffectDemand {
-  match lookup_item_by_identity(registry: registry, id: DeclaredCallableIdentity { owner_module_path: pipeline_module, decl_name: "native_claim_report" }) {
-    Present { value: info } =>
-      if !item_is_effectful_callee(info: info) { NativeClaimPure }
-      else if (item_resource_names(info: info) |> count) == 0 && (info.service_names |> count) == 1 && (info.service_names |> all(sn => service_var_name(service_name: sn) == "filesystem")) { NativeClaimFilesystem }
-      else { NativeClaimUndeclaredEffect { detail: concat("services [", concat(info.service_names |> join(separator: ", "), concat("] resources [", concat(item_resource_names(info: info) |> join(separator: ", "), "]")))) } }
-    Absent => NativeClaimUndeclaredEffect { detail: "native_claim_report has no registry row" }
-  }
-}
-
-fn emit_native_claim_driver_main_rs(crate_name: String, pipeline_module: String, demand: NativeClaimEffectDemand) -> TextFile {
+// WHAT THE REPORT DEMANDS OF ITS HOST is v1.compiler.emit NativeEffectRealizationAdmission, the one
+// verdict every native main reads (native_entry_effects, under native_claim_route_denominator: the
+// declared resource set {Filesystem}). A pure report gets the sync main below unchanged; a report that
+// demands effects gets the handlers the verdict admitted -- today only the existing filesystem_io
+// handler, the binding NativeCliDriver's main performs -- and any other demand has already refused
+// emission with NativeEffectRealizationAdmission's typed diagnostic, so no main is rendered for it.
+fn emit_native_claim_driver_main_rs(crate_name: String, pipeline_module: String, bindings: List<NativeEffectBindingText>) -> TextFile {
   let pipeline_mod = module_to_filename(name: pipeline_module)
-  match demand {
-    NativeClaimPure => emit_native_claim_driver_pure_main_rs(crate_name: crate_name, pipeline_mod: pipeline_mod)
-    NativeClaimFilesystem => emit_native_claim_driver_filesystem_main_rs(crate_name: crate_name, pipeline_mod: pipeline_mod)
-    NativeClaimUndeclaredEffect { detail } => TextFile {
-      path: concat(rust_source_root(), "main", rust_source_ext()),
-      content: concat("// Generated by v1 compiler -- do not edit.\n\ncompile_error!(\"REFUSED: a NativeClaimDriver report may demand only the Filesystem service; ", concat(escape_string_literal_body(s: detail), "\");\n"))
-    }
+  if (bindings |> count) == 0 {
+    emit_native_claim_driver_pure_main_rs(crate_name: crate_name, pipeline_mod: pipeline_mod)
+  } else {
+    emit_native_claim_driver_effect_main_rs(crate_name: crate_name, pipeline_mod: pipeline_mod, bindings: bindings)
   }
 }
 
@@ -18404,9 +18851,11 @@ fn native_claim_terminal_exit_lines() -> String {
       "    \}", "\n")
 }
 
-// A transport error out of the bound handler is no observation (2), never a held or not-held case:
+// A transport error out of a bound handler is no observation (2), never a held or not-held case:
 // the report did not finish deciding.
-fn emit_native_claim_driver_filesystem_main_rs(crate_name: String, pipeline_mod: String) -> TextFile {
+fn emit_native_claim_driver_effect_main_rs(crate_name: String, pipeline_mod: String, bindings: List<NativeEffectBindingText>) -> TextFile {
+  let binding_lines = bindings |> map(b => b.binding_line) |> join(separator: "")
+  let effect_args = bindings |> map(b => b.argument) |> join(separator: ", ")
   TextFile {
     path: concat(rust_source_root(), "main", rust_source_ext()),
     content: concat(
@@ -18419,10 +18868,10 @@ fn emit_native_claim_driver_filesystem_main_rs(crate_name: String, pipeline_mod:
       "\n",
       "#[tokio::main(flavor = \"current_thread\")]", "\n",
       "async fn main() \{", "\n",
-      "    let filesystem = ", crate_name, "::extdeps_filesystem_filesystem_io::Filesystem::new(Default::default());", "\n",
-      "    let report = match native_claim_report(&filesystem).await \{", "\n",
+      binding_lines,
+      "    let report = match native_claim_report(", effect_args, ").await \{", "\n",
       "        Ok(report) => report,", "\n",
-      "        Err(cause) => \{ eprintln!(\"NO OBSERVATION: native filesystem transport: \{\}\", cause); std::process::exit(2); \}", "\n",
+      "        Err(cause) => \{ eprintln!(\"NO OBSERVATION: native effect transport: \{\}\", cause); std::process::exit(2); \}", "\n",
       "    \};", "\n",
       native_claim_terminal_exit_lines(),
       "\}", "\n")
@@ -18471,8 +18920,41 @@ fn emit_native_claim_driver_pure_main_rs(crate_name: String, pipeline_mod: Strin
 // also runs during unwinding, so an abandoned worker uncounts itself exactly once however it ends. Every value -- deadline,
 // ceiling, both bodies, the exit code -- is gunbc.native_serve's; the worker sends back only owned
 // plain parts because the handler's values are reference-counted and stay on its thread.
-fn emit_native_serve_driver_main_rs(crate_name: String, pipeline_module: String) -> TextFile {
+//
+// THE EFFECT WORKER, BY GENERATION. An entry with effects is an async function returning Result
+// (emit_func_def); one without is a pure function returning the response. The admitted bindings decide
+// which, so the call shape and the handles come from the same verdict. Every handler call runs on ONE
+// worker generation: a thread that realizes the current-thread executor and every admitted handle
+// once, reports ready or not before the service announces, and is reused after each answered call. A
+// generation that misses the deadline (counted stuck, exactly as above) or panics is abandoned -- it
+// keeps only its own executor and handles -- and a replacement is realized. A generation that cannot
+// be realized is a process-level refusal, never native_serve_effect_failed (which is a handler's
+// transport error): at startup the main refuses before announcing, so /livez is never answered by a
+// process that cannot serve; a failed replacement ends the process with
+// native_serve_worker_replacement_exit_code once the request in hand is answered.
+fn emit_native_serve_driver_main_rs(crate_name: String, pipeline_module: String, bindings: List<NativeEffectBindingText>) -> TextFile {
   let pipeline_mod = module_to_filename(name: pipeline_module)
+  let effectful = (bindings |> count) > 0
+  let binding_lines = bindings |> map(b => b.binding_line) |> join(separator: "")
+  let handler_effect_args = bindings |> map(b => concat(", ", b.argument)) |> join(separator: "")
+  let effect_failed_import = if effectful { " native_serve_effect_failed," } else { "" }
+  let worker_realize = if effectful {
+    concat(
+      "        let runtime = match tokio::runtime::Builder::new_current_thread().enable_all().build() \{", "\n",
+      "            Ok(runtime) => runtime,", "\n",
+      "            Err(cause) => \{ let _ = ready.send(Err(format!(\"native effect executor: \{\}\", cause))); return; \}", "\n",
+      "        \};", "\n",
+      binding_lines)
+  } else { "" }
+  let worker_call = if effectful {
+    concat(
+      "            let response = match runtime.block_on(native_serve_handle(call.method, call.path, call.body, call.tailscale_identity, call.release_revision", handler_effect_args, ")) \{", "\n",
+      "                Ok(response) => response,", "\n",
+      "                Err(cause) => native_serve_effect_failed(cause.to_string()),", "\n",
+      "            \};", "\n")
+  } else {
+    "            let response = native_serve_handle(call.method, call.path, call.body, call.tailscale_identity, call.release_revision);\n"
+  }
   TextFile {
     path: concat(rust_source_root(), "main", rust_source_ext()),
     content: concat(
@@ -18486,8 +18968,9 @@ fn emit_native_serve_driver_main_rs(crate_name: String, pipeline_module: String)
       "use ", crate_name, "::extdeps_http_server::ServeWireResponse;", "\n",
       "use ", crate_name, "::std_measure::\{byte_size_count, millisecond_count\};", "\n",
       "use ", crate_name, "::gunbc_native_serve::\{", "\n",
-      "    native_serve_announcement, native_serve_frame, native_serve_handler_name, native_serve_read_refused,", "\n",
+      "    native_serve_announcement,", effect_failed_import, " native_serve_frame, native_serve_handler_name, native_serve_read_refused,", "\n",
       "    native_serve_admission, native_serve_deadline_refused, native_serve_handler_failed, native_serve_outgoing, native_serve_route,", "\n",
+      "    native_serve_worker_replacement_exit_code, native_serve_worker_unrealized,", "\n",
       "    native_serve_start, NativeServeAdmission, NativeServeContract, NativeServeFrame, NativeServeOutgoing,", "\n",
       "    NativeServeRoute, NativeServeStart,", "\n",
       "\};", "\n",
@@ -18564,6 +19047,39 @@ fn emit_native_serve_driver_main_rs(crate_name: String, pipeline_module: String)
       "    release_revision: String,", "\n",
       "\}", "\n",
       "\n",
+      "// One worker generation: the thread that owns the effect executor and every admitted handle and runs", "\n",
+      "// handler calls one at a time. Its state is the WorkerGuard protocol above; an abandoned generation", "\n",
+      "// finishes the call in hand (if it ever does) and ends, uncounting itself.", "\n",
+      "struct Generation \{", "\n",
+      "    calls: std::sync::mpsc::Sender<(HandlerCall, std::sync::mpsc::Sender<WireParts>)>,", "\n",
+      "    state: std::sync::Arc<std::sync::Mutex<u8>>,", "\n",
+      "\}", "\n",
+      "", "\n",
+      "fn realize_generation(stuck: &std::sync::Arc<std::sync::Mutex<usize>>, ready_within: std::time::Duration) -> Result<Generation, String> \{", "\n",
+      "    let (calls, inbox) = std::sync::mpsc::channel::<(HandlerCall, std::sync::mpsc::Sender<WireParts>)>();", "\n",
+      "    let (ready, readiness) = std::sync::mpsc::channel::<Result<(), String>>();", "\n",
+      "    let state = std::sync::Arc::new(std::sync::Mutex::new(WORKER_WAITING));", "\n",
+      "    let guard = WorkerGuard \{ state: state.clone(), stuck: stuck.clone() \};", "\n",
+      "    let worker_state = state.clone();", "\n",
+      "    std::thread::spawn(move || \{", "\n",
+      "        let _guard = guard;", "\n",
+      worker_realize,
+      "        let _ = ready.send(Ok(()));", "\n",
+      "        while let Ok((call, reply)) = inbox.recv() \{", "\n",
+      worker_call,
+      "            let _ = reply.send(wire_parts(&native_serve_outgoing(response)));", "\n",
+      "            if *lock_state(&worker_state) == WORKER_ABANDONED \{", "\n",
+      "                return;", "\n",
+      "            \}", "\n",
+      "        \}", "\n",
+      "    \});", "\n",
+      "    match readiness.recv_timeout(ready_within) \{", "\n",
+      "        Ok(Ok(())) => Ok(Generation \{ calls, state \}),", "\n",
+      "        Ok(Err(cause)) => Err(cause),", "\n",
+      "        Err(_) => Err(\"the worker ended or did not report ready within the request deadline\".to_string()),", "\n",
+      "    \}", "\n",
+      "\}", "\n",
+      "", "\n",
       "fn read_line(reader: &mut impl BufRead, budget: &mut usize) -> Result<Option<String>, String> \{", "\n",
       "    let mut bytes = Vec::new();", "\n",
       "    match reader.read_until(b'\\n', &mut bytes) \{", "\n",
@@ -18647,10 +19163,17 @@ fn emit_native_serve_driver_main_rs(crate_name: String, pipeline_module: String)
       "    \};", "\n",
       "    let bound_host = bound.ip().to_string();", "\n",
       "    let bound_port = bound.port() as i64;", "\n",
-      "    eprintln!(\"\{\}\", native_serve_announcement(contract.clone(), bound_host.clone(), bound_port));", "\n",
-      "    let timeout = std::time::Duration::from_millis(millisecond_count(contract.read_timeout.clone()) as u64);", "\n",
       "    let deadline = std::time::Duration::from_millis(millisecond_count(contract.request_deadline.clone()) as u64);", "\n",
       "    let stuck = std::sync::Arc::new(std::sync::Mutex::new(0usize));", "\n",
+      "    let mut generation = match realize_generation(&stuck, deadline) \{", "\n",
+      "        Ok(generation) => generation,", "\n",
+      "        Err(cause) => \{", "\n",
+      "            eprintln!(\"REFUSED: \{\}\", native_serve_worker_unrealized(cause));", "\n",
+      "            std::process::exit(2);", "\n",
+      "        \}", "\n",
+      "    \};", "\n",
+      "    eprintln!(\"\{\}\", native_serve_announcement(contract.clone(), bound_host.clone(), bound_port));", "\n",
+      "    let timeout = std::time::Duration::from_millis(millisecond_count(contract.read_timeout.clone()) as u64);", "\n",
       "    for accepted in listener.incoming() \{", "\n",
       "        let mut stream = match accepted \{", "\n",
       "            Ok(stream) => stream,", "\n",
@@ -18671,29 +19194,41 @@ fn emit_native_serve_driver_main_rs(crate_name: String, pipeline_module: String)
       "                        std::process::exit(*exit_code as i32);", "\n",
       "                    \}", "\n",
       "                    NativeServeAdmission::NativeServeAdmitWorker => \{", "\n",
-      "                        let (sender, receiver) = std::sync::mpsc::channel::<WireParts>();", "\n",
-      "                        let state = std::sync::Arc::new(std::sync::Mutex::new(WORKER_WAITING));", "\n",
-      "                        let guard = WorkerGuard \{ state: state.clone(), stuck: stuck.clone() \};", "\n",
-      "                        std::thread::spawn(move || \{", "\n",
-      "                            let _guard = guard;", "\n",
-      "                            let response = native_serve_handle(call.method, call.path, call.body, call.tailscale_identity, call.release_revision);", "\n",
-      "                            let _ = sender.send(wire_parts(&native_serve_outgoing(response)));", "\n",
-      "                        \});", "\n",
-      "                        match receiver.recv_timeout(deadline) \{", "\n",
-      "                            Ok(parts) => write_parts(&mut stream, &parts),", "\n",
-      "                            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => \{", "\n",
-      "                                write_response(&mut stream, &native_serve_outgoing(native_serve_handler_failed()));", "\n",
-      "                            \}", "\n",
-      "                            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => \{", "\n",
-      "                                \{", "\n",
-      "                                    let mut s = lock_state(&state);", "\n",
-      "                                    if *s != WORKER_DONE \{", "\n",
-      "                                        *s = WORKER_ABANDONED;", "\n",
-      "                                        *lock_state(&stuck) += 1;", "\n",
+      "                        let (reply, answer) = std::sync::mpsc::channel::<WireParts>();", "\n",
+      "                        let replace = if generation.calls.send((call, reply)).is_err() \{", "\n",
+      "                            write_response(&mut stream, &native_serve_outgoing(native_serve_handler_failed()));", "\n",
+      "                            true", "\n",
+      "                        \} else \{", "\n",
+      "                            match answer.recv_timeout(deadline) \{", "\n",
+      "                                Ok(parts) => \{", "\n",
+      "                                    write_parts(&mut stream, &parts);", "\n",
+      "                                    false", "\n",
+      "                                \}", "\n",
+      "                                Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => \{", "\n",
+      "                                    write_response(&mut stream, &native_serve_outgoing(native_serve_handler_failed()));", "\n",
+      "                                    true", "\n",
+      "                                \}", "\n",
+      "                                Err(std::sync::mpsc::RecvTimeoutError::Timeout) => \{", "\n",
+      "                                    \{", "\n",
+      "                                        let mut s = lock_state(&generation.state);", "\n",
+      "                                        if *s != WORKER_DONE \{", "\n",
+      "                                            *s = WORKER_ABANDONED;", "\n",
+      "                                            *lock_state(&stuck) += 1;", "\n",
+      "                                        \}", "\n",
       "                                    \}", "\n",
+      "                                    write_response(&mut stream, &native_serve_outgoing(native_serve_deadline_refused(contract.clone())));", "\n",
+      "                                    true", "\n",
       "                                \}", "\n",
-      "                                write_response(&mut stream, &native_serve_outgoing(native_serve_deadline_refused(contract.clone())));", "\n",
       "                            \}", "\n",
+      "                        \};", "\n",
+      "                        if replace \{", "\n",
+      "                            generation = match realize_generation(&stuck, deadline) \{", "\n",
+      "                                Ok(generation) => generation,", "\n",
+      "                                Err(cause) => \{", "\n",
+      "                                    eprintln!(\"REFUSED: \{\}\", native_serve_worker_unrealized(cause));", "\n",
+      "                                    std::process::exit(native_serve_worker_replacement_exit_code() as i32);", "\n",
+      "                                \}", "\n",
+      "                            \};", "\n",
       "                        \}", "\n",
       "                    \}", "\n",
       "                \}", "\n",
@@ -18705,10 +19240,14 @@ fn emit_native_serve_driver_main_rs(crate_name: String, pipeline_module: String)
   }
 }
 
-// Bind the existing file transport once. v2_cli_main owns parse, acquisition and compilation;
-// the host supplies argv and realizes output and ProcessExit, with no source-root walk.
-fn emit_native_cli_driver_main_rs(crate_name: String, pipeline_module: String) -> TextFile {
+// Bind the handlers NativeEffectRealizationAdmission admitted for v2_cli_main (today the existing
+// file transport, extdeps.filesystem.filesystem_io Filesystem) and nothing else. v2_cli_main owns
+// parse, acquisition and compilation; the host supplies argv and realizes output and ProcessExit,
+// with no source-root walk.
+fn emit_native_cli_driver_main_rs(crate_name: String, pipeline_module: String, bindings: List<NativeEffectBindingText>) -> TextFile {
   let pipeline_mod = module_to_filename(name: pipeline_module)
+  let binding_lines = bindings |> map(b => b.binding_line) |> join(separator: "")
+  let effect_args = bindings |> map(b => concat(", ", b.argument)) |> join(separator: "")
   TextFile {
     path: concat(rust_source_root(), "main", rust_source_ext()),
     content: concat(
@@ -18726,10 +19265,10 @@ fn emit_native_cli_driver_main_rs(crate_name: String, pipeline_module: String) -
       "#[tokio::main(flavor = \"current_thread\")]", "\n",
       "async fn main() \{", "\n",
       "    let argv: Vec<String> = std::env::args().skip(1).collect();", "\n",
-      "    let filesystem = ", crate_name, "::extdeps_filesystem_filesystem_io::Filesystem::new(Default::default());", "\n",
-      "    let outcome = match v2_cli_main(Rc::new(argv.into()), &filesystem).await {", "\n",
+      binding_lines,
+      "    let outcome = match v2_cli_main(Rc::new(argv.into())", effect_args, ").await {", "\n",
       "        Ok(outcome) => outcome,", "\n",
-      "        Err(cause) => { eprintln!(\"REFUSED: native filesystem transport: {}\", cause); std::process::exit(2); }", "\n",
+      "        Err(cause) => { eprintln!(\"REFUSED: native effect transport: {}\", cause); std::process::exit(2); }", "\n",
       "    };", "\n",
       "    let text = v2_cli_outcome_text(outcome.clone());", "\n",
       "    print!(\"\{text\}\");", "\n",
@@ -18861,6 +19400,8 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "use ", crate_name, "::", pipeline_mod, "::\{", "\n",
       "    native_census_module_completeness, native_census_module_resolution, native_census_modules,", "\n",
       "    native_census_module_inference, native_census_infer_type_contribution,", "\n",
+      "    native_census_infer_completeness, native_census_cause_groups_add_infer_module, native_census_module_paths,", "\n",
+      "    native_census_subject_closure, native_census_root_subject_membership, native_census_subject_label,", "\n",
       "    native_census_residual_rows,", "\n",
       "    native_census_cause_groups_add_module, native_census_cause_groups_from_file_refusals,", "\n",
       "    native_census_cause_group_rows, native_census_closure_index, native_census_roots_ranked,", "\n",
@@ -18873,7 +19414,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "    native_test_front_end_prepare,", "\n",
       "    native_driver_parse, native_driver_plan_exit, native_driver_plan_source_roots,", "\n",
       "    NativeDriverPlan, NativeDriverVerb,", "\n",
-      "    NativeCensusModuleOutcome,", "\n",
+      "    NativeCensusModuleOutcome, NativeInferCensusOutcome,", "\n",
       "    NativeLaneHostFacts,", "\n",
       "    NativeRouteMemberRow,", "\n",
       "    native_demand_eval_nanos, native_demand_eval_samples,", "\n",
@@ -18888,12 +19429,10 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "    native_demand_tested_tree_input,", "\n",
       "\};", "\n",
       "use ", crate_name, "::v2_compiler_program_assembly::\{", "\n",
-      "    program_assembly_measured_outcome, program_assembly_memo_hits,", "\n",
-      "    program_assembly_memo_lookup_calls, program_assembly_memo_misses,", "\n",
-      "    program_assembly_allocator_next, program_assembly_measured_alloc,", "\n",
+      "    program_assembly_allocator_next, program_assembly_parsed_alloc,", "\n",
       "    program_assembly_phase_normalize_seeded, program_assembly_normalized_outcome,", "\n",
       "    program_assembly_normalized_alloc, program_assembly_normalized_spans, program_assembly_ingest_scope_outcome,", "\n",
-      "    program_assembly_phase_parse_measured_seeded,", "\n",
+      "    program_assembly_phase_parse_seeded,", "\n",
       "    program_assembly_phase_token_count, program_assembly_phase_tokenize,", "\n",
       "\};", "\n",
       "use ", crate_name, "::gunbc_witness_v2_native_route::\{", "\n",
@@ -19125,7 +19664,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "    // fan-out -- and take each module as it is resolved: a cascade member once under its root,", "\n",
       "    // any other refusal per chain (v2.compiler.compile native_census_cause_groups_add_module).", "\n",
       "    let closure = native_census_closure_index(context.clone(), refusal_index.clone(), modules.clone());", "\n",
-      "    let mut groups = native_census_cause_groups_from_file_refusals(context.file_refusals.clone(), closure, true);", "\n",
+      "    let mut groups = native_census_cause_groups_from_file_refusals(context.file_refusals.clone(), closure.clone(), true);", "\n",
       "    let mut resolve_total_nanos: u128 = 0;", "\n",
       "    let mut resolve_samples: Vec<u128> = Vec::new();", "\n",
       "    let mut resolved_ok: u64 = 0;", "\n",
@@ -19145,7 +19684,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "        context = step.context.clone();", "\n",
       "        let outcome = step.outcome.clone();", "\n",
       "        let module_resolve_nanos = span_nanos(resolve_started);", "\n",
-      "        groups = native_census_cause_groups_add_module(groups.clone(), entry.clone(), step.clone());", "\n",
+      "        groups = native_census_cause_groups_add_module(groups.clone(), closure.clone(), entry.clone(), step.clone());", "\n",
       "        let outcome_label = match &*outcome \{", "\n",
       "            NativeCensusModuleOutcome::NativeCensusModuleFileRefused => \{", "\n",
       "                file_refused += 1;", "\n",
@@ -19256,6 +19795,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "        std::process::exit(2);", "\n",
       "    \}", "\n",
       "    let reads = read_ingest(source_roots);", "\n",
+      "    let corpus_reads = reads.len();", "\n",
       "    let ingest = Rc::new(im::vector::Vector::from(reads));", "\n",
       "    let mut context = match &*native_test_context_from_ingest(ingest.clone()) \{", "\n",
       "        Outcome::Accepted \{ value, .. \} => value.clone(),", "\n",
@@ -19264,26 +19804,100 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "            std::process::exit(2);", "\n",
       "        \}", "\n",
       "    \};", "\n",
+      "    // THE FRONT-END POPULATION IS PRINTED IN THE SHAPE census-resolve PRINTS IT: the same context fact.", "\n",
+      "    for refusal in context.file_refusals.iter() \{", "\n",
+      "        println!(\"{}\", serde_json::json!(\{ \"file_refusal\": refusal \}));", "\n",
+      "    \}", "\n",
+      "    for advised in context.accepted_file_advisories.iter() \{", "\n",
+      "        println!(\"{}\", serde_json::json!(\{ \"accepted_file_advisories\": advised \}));", "\n",
+      "    \}", "\n",
+      "    let file_refusals = context.file_refusals.len();", "\n",
+      "    let advised_files = context.accepted_file_advisories.len();", "\n",
       "    let refusal_index = native_lane_file_refusal_index(context.file_refusals.clone());", "\n",
       "    let modules = native_census_modules(ingest.clone());", "\n",
+      "    // THE INFER CENSUS'S GROUPS START FROM THE FRONT-END ROOTS, as census-resolve's do, and take each", "\n",
+      "    // module's step through ONE fold (v2.compiler.compile native_census_cause_groups_add_infer_module):", "\n",
+      "    // a resolve refusal filed as census-resolve files it, an infer refusal as one Infer-stage row.", "\n",
+      "    let closure = native_census_closure_index(context.clone(), refusal_index.clone(), modules.clone());", "\n",
+      "    let module_paths = native_census_module_paths(modules.clone());", "\n",
+      "    let mut groups = native_census_cause_groups_from_file_refusals(context.file_refusals.clone(), closure.clone(), true);", "\n",
       "    let mut run = type_census_run_empty();", "\n",
+      "    let mut file_refused: u64 = 0;", "\n",
+      "    let mut resolve_refused: u64 = 0;", "\n",
+      "    let mut residual_rows: u64 = 0;", "\n",
+      "    let mut inferred: u64 = 0;", "\n",
+      "    let mut infer_refused: u64 = 0;", "\n",
       "    for entry in modules.iter() \{", "\n",
       "        let started = Instant::now();", "\n",
       "        let step = native_census_module_inference(context.clone(), refusal_index.clone(), entry.clone());", "\n",
       "        context = step.context.clone();", "\n",
+      "        groups = native_census_cause_groups_add_infer_module(groups.clone(), closure.clone(), module_paths.clone(), entry.clone(), step.clone());", "\n",
+      "        let outcome_label = match &*step.outcome \{", "\n",
+      "            NativeInferCensusOutcome::NativeInferCensusFileRefused => \{ file_refused += 1; \"file_refused\" \}", "\n",
+      "            NativeInferCensusOutcome::NativeInferCensusResolveRefused \{ first, rest, .. \} => \{", "\n",
+      "                resolve_refused += 1;", "\n",
+      "                for row in native_census_residual_rows(entry.clone(), first.clone(), rest.clone()).iter() \{", "\n",
+      "                    residual_rows += 1;", "\n",
+      "                    println!(\"{}\", serde_json::json!(\{ \"census_residual\": row \}));", "\n",
+      "                \}", "\n",
+      "                \"resolve_refused\"", "\n",
+      "            \}", "\n",
+      "            NativeInferCensusOutcome::NativeInferCensusInferred \{ .. \} => \{ inferred += 1; \"inferred\" \}", "\n",
+      "            NativeInferCensusOutcome::NativeInferCensusInferRefused \{ .. \} => \{ infer_refused += 1; \"infer_refused\" \}", "\n",
+      "        \};", "\n",
       "        let contribution = native_census_infer_type_contribution(context.clone(), entry.clone(), step.outcome.clone());", "\n",
       "        run = type_census_run_add(run, contribution);", "\n",
-      "        eprintln!(\"[native-census-infer] \{\}\", serde_json::json!(\{ \"module\": entry.module.clone(), \"nanos\": span_nanos(started) \}));", "\n",
+      "        eprintln!(\"[native-census-infer] \{\}\", serde_json::json!(\{", "\n",
+      "            \"module\": entry.module.clone(),", "\n",
+      "            \"path\": entry.path.clone(),", "\n",
+      "            \"nanos\": span_nanos(started),", "\n",
+      "            \"outcome\": outcome_label,", "\n",
+      "            \"occurrence_completeness\": native_census_infer_completeness(step.outcome.clone()),", "\n",
+      "        \}));", "\n",
+      "    \}", "\n",
+      "    let cause_groups = native_census_cause_group_rows(groups.clone());", "\n",
+      "    for group in cause_groups.iter() \{", "\n",
+      "        println!(\"{}\", serde_json::json!(\{ \"cause_group\": group \}));", "\n",
+      "    \}", "\n",
+      "    let roots = native_census_roots_ranked(cause_groups.clone());", "\n",
+      "    // EACH ROOT IS MARKED AGAINST THE NATIVE TEST TARGET'S CLOSURE (v2.compiler.compile", "\n",
+      "    // native_census_subject_closure): derived from the label, never from a list.", "\n",
+      "    let subject = native_census_subject_closure(closure.clone(), modules.clone(), native_census_subject_label());", "\n",
+      "    println!(\"{}\", serde_json::json!(\{ \"census_subject\": subject.clone() \}));", "\n",
+      "    for root in roots.iter() \{", "\n",
+      "        println!(\"{}\", serde_json::json!(\{ \"census_root\": root, \"subject_closure\": native_census_root_subject_membership(subject.clone(), root.clone()) \}));", "\n",
       "    \}", "\n",
+      "    // THE TYPE-DECLARATION CENSUS'S LINES SHARE THIS STDOUT AND KEEP THEIR OWN LINE KIND (design 2a).", "\n",
       "    let receipt = type_census_receipt(run);", "\n",
       "    for line in receipt.lines.iter() \{", "\n",
       "        println!(\"\{\}\", line);", "\n",
       "    \}", "\n",
+      "    // THE WALK COMPLETED, SO THE TERMINAL IS PRINTED WHATEVER THE TYPE CENSUS DECIDES: the refusal", "\n",
+      "    // census and the type census are two facts, and the type census's verdict is the exit status alone.", "\n",
+      "    let type_census = match &*receipt.terminal \{", "\n",
+      "        NativeClaimTerminal::NativeClaimHeld => \"held\",", "\n",
+      "        NativeClaimTerminal::NativeClaimNotHeld \{ .. \} => \"not_held\",", "\n",
+      "        NativeClaimTerminal::NativeClaimNoObservation \{ .. \} => \"no_observation\",", "\n",
+      "    \};", "\n",
+      "    println!(\"\{\}\", serde_json::json!(\{", "\n",
+      "        \"_terminal\": \"complete\",", "\n",
+      "        \"mode\": \"census-infer\",", "\n",
+      "        \"corpus_reads\": corpus_reads,", "\n",
+      "        \"modules\": modules.len(),", "\n",
+      "        \"file_refusals\": file_refusals,", "\n",
+      "        \"advised_files\": advised_files,", "\n",
+      "        \"file_refused\": file_refused,", "\n",
+      "        \"resolve_refused\": resolve_refused,", "\n",
+      "        \"residual_rows\": residual_rows,", "\n",
+      "        \"inferred\": inferred,", "\n",
+      "        \"infer_refused\": infer_refused,", "\n",
+      "        \"cause_groups\": cause_groups.len(),", "\n",
+      "        \"roots\": roots.len(),", "\n",
+      "        \"type_census\": type_census,", "\n",
+      "        \"peak_rss_bytes\": proc_status_kib(\"VmHWM\").map(|kib| kib * 1024),", "\n",
+      "    \}));", "\n",
       "    match &*receipt.terminal \{", "\n",
-      "        NativeClaimTerminal::NativeClaimHeld => \{", "\n",
-      "            println!(\"\{\}\", serde_json::json!(\{ \"_terminal\": \"complete\", \"mode\": \"census-infer\", \"modules\": modules.len(), \"peak_rss_bytes\": proc_status_kib(\"VmHWM\").map(|kib| kib * 1024) \}));", "\n",
-      "            std::process::exit(0);", "\n",
-      "        \}", "\n",
+      "        NativeClaimTerminal::NativeClaimHeld => std::process::exit(0),", "\n",
       "        NativeClaimTerminal::NativeClaimNotHeld \{ reason \} => \{", "\n",
       "            eprintln!(\"NOT HELD: \{reason\}\");", "\n",
       "            std::process::exit(1);", "\n",
@@ -19507,7 +20121,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "    // CANNOT go red -- the composition is defined as the phase chain -- so the honest answer is", "\n",
       "    // the row and its trigger (a realization seam that yields per-phase spans FROM a modeled", "\n",
       "    // fold), not a green check. Reordering these calls or dropping the merge that", "\n",
-      "    // program_assembly_phase_parse_measured_seeded performs would change the context with", "\n",
+      "    // program_assembly_phase_parse_seeded performs would change the context with", "\n",
       "    // nothing red.", "\n",
       "    let context_started = cpu_mark();", "\n",
       "    // THE ONCE-PER-FOLD INVARIANT IS PAID ONCE, HERE, AND CARRIED INTO EVERY FILE. A second", "\n",
@@ -19538,9 +20152,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "    let mut absorb_nanos: u128 = 0;", "\n",
       "    let mut phase_calls: u64 = 0;", "\n",
       "    let mut token_total: u64 = 0;", "\n",
-      "    let mut memo_hits_total: u64 = 0;", "\n",
-      "    let mut memo_misses_total: u64 = 0;", "\n",
-      "    let mut memo_lookups_total: u64 = 0;", "\n",
+
       "    let mut byte_total: u64 = 0;", "\n",
       "    let mut context_file_samples: Vec<u128> = Vec::new();", "\n",
       "    for read in closure_ingest.iter() \{", "\n",
@@ -19559,29 +20171,18 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "        // respelling has to thread it explicitly or it keeps the reset the fold no longer has.", "\n",
       "        let file_seed = context_state.alloc.clone();", "\n",
       "        let file_seed_reported = file_seed.clone();", "\n",
-      "        let measured = program_assembly_phase_parse_measured_seeded(", "\n",
+      "        let parsed = program_assembly_phase_parse_seeded(", "\n",
       "            tokens.clone(),", "\n",
       "            front_end.prepared.clone(),", "\n",
-      "            // The residue field is an Optional whose inner type rides a recursion cycle, so the", "\n",
-      "            // emitted record BOXES it while the phase takes the option by value. Deref the box", "\n",
-      "            // rather than clone it; the sibling fields above are Rc and clone correctly.", "\n",
-      "            (*front_end.residue).clone(),", "\n",
       "            file_seed.clone(),", "\n",
       "        );", "\n",
       "        let file_parse_nanos = cpu_span_nanos(parse_started);", "\n",
-      "        // The memo accounting rides BESIDE the outcome, so it reports on a refusal too --", "\n",
-      "        // which is the expensive case this instrument exists to read. Counted outside every", "\n",
-      "        // phase span so it prices none of them.", "\n",
-      "        let file_memo_hits = program_assembly_memo_hits(measured.clone());", "\n",
-      "        let file_memo_misses = program_assembly_memo_misses(measured.clone());", "\n",
-      "        let file_memo_lookups = program_assembly_memo_lookup_calls(measured.clone());", "\n",
-      "        // Read BEFORE program_assembly_measured_outcome consumes `measured`. On a refused parse", "\n",
+      "        // On a refused parse", "\n",
       "        // this returns the seed unchanged. Not because nothing was minted -- a refused parse", "\n",
       "        // HAS minted ids -- but because ParseExprRejected carries no provenance state, so the", "\n",
       "        // mark the attempt reached is not recoverable. See the precondition on", "\n",
       "        // v2.compiler.compile native_test_context_absorb.", "\n",
-      "        let file_alloc = program_assembly_measured_alloc(measured.clone(), file_seed);", "\n",
-      "        let parsed = program_assembly_measured_outcome(measured);", "\n",
+      "        let file_alloc = program_assembly_parsed_alloc(parsed.clone(), file_seed);", "\n",
       "        let normalize_started = cpu_mark();", "\n",
       "        // NORMALIZE ADVANCES THE ALLOCATOR: lowering allocates every image member an id, so the", "\n",
       "        // next file seeds from the mark normalize reached, not the one parse reached.", "\n",
@@ -19604,9 +20205,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "        absorb_nanos += file_absorb_nanos;", "\n",
       "        phase_calls += 1;", "\n",
       "        token_total += file_tokens.max(0) as u64;", "\n",
-      "        memo_hits_total += file_memo_hits.max(0) as u64;", "\n",
-      "        memo_misses_total += file_memo_misses.max(0) as u64;", "\n",
-      "        memo_lookups_total += file_memo_lookups.max(0) as u64;", "\n",
+
       "        let file_bytes = read.source.carried.len() as u64;", "\n",
       "        byte_total += file_bytes;", "\n",
       "        context_file_samples.push(file_nanos);", "\n",
@@ -19622,9 +20221,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "                \"normalize_nanos\": file_normalize_nanos,", "\n",
       "                \"absorb_nanos\": file_absorb_nanos,", "\n",
       "                \"file_nanos\": file_nanos,", "\n",
-      "                \"memo_hits\": file_memo_hits,", "\n",
-      "                \"memo_misses\": file_memo_misses,", "\n",
-      "                \"memo_lookup_calls\": file_memo_lookups,", "\n",
+
       "                // THE THREADING, MADE OBSERVABLE. occurrence_seed is the mark this file was", "\n",
       "                // handed and occurrence_next the mark it reached, so a multi-file run shows", "\n",
       "                // one sequence continuing across files instead of each file restarting at 0.", "\n",
@@ -19662,9 +20259,7 @@ fn emit_source_root_eval_driver_main_rs(crate_name: String, pipeline_module: Str
       "            \"absorb_calls\": phase_calls,", "\n",
       "            \"front_end_prepare_calls\": 1,", "\n",
       "            \"tokens\": token_total,", "\n",
-      "            \"memo_hits\": memo_hits_total,", "\n",
-      "            \"memo_misses\": memo_misses_total,", "\n",
-      "            \"memo_lookup_calls\": memo_lookups_total,", "\n",
+
       "            \"bytes\": byte_total,", "\n",
       "            \"file_refusals\": context.file_refusals.len(),", "\n",
       "            \"file_p50_nanos\": native_cost_quantile_nanos(&context_file_samples, 1, 2),", "\n",
@@ -20245,9 +20840,7 @@ fn emit_main_pipeline_fns(crate_name: String, pipeline_module: String) -> String
   concat(
     emit_collect_dag_files_fn(),
     emit_extract_module_path_fn(),
-    emit_extract_import_paths_fn(),
     emit_dep_pool_type_and_fns(),
-    emit_resolve_transitively_fn(crate_name: crate_name, pipeline_mod: pipeline_mod),
     emit_compile_target_helpers(crate_name: crate_name, pipeline_mod: pipeline_mod, artifact_mod: artifact_mod))
 }
 
@@ -20369,25 +20962,6 @@ fn emit_extract_module_path_fn() -> String {
     "}\n\n")
 }
 
-fn emit_extract_import_paths_fn() -> String {
-  concat(
-    "/// Extract import module paths from a .dag file's import declarations.\n",
-    "fn extract_import_paths(content: &str) -> Vec<String> {\n",
-    "    let mut imports = Vec::new();\n",
-    "    for line in content.lines() {\n",
-    "        let trimmed = line.trim();\n",
-    "        if trimmed.starts_with(\"import \") {\n",
-    "            let rest = trimmed[\"import \".len()..].trim();\n",
-    "            let module_path = rest.split('{').next().unwrap_or(rest).trim();\n",
-    "            if !module_path.is_empty() {\n",
-    "                imports.push(module_path.to_string());\n",
-    "            }\n",
-    "        }\n",
-    "    }\n",
-    "    imports\n",
-    "}\n\n")
-}
-
 fn emit_dep_pool_type_and_fns() -> String {
   concat(
     "#[derive(Clone, Copy, PartialEq, Eq)]\nenum DependencyPoolIndex {\n    Strict,\n    PrimaryPrecedence,\n}\n\n",
@@ -20460,46 +21034,6 @@ fn emit_dep_pool_type_and_fns() -> String {
     "}\n\n")
 }
 
-fn emit_resolve_transitively_fn(crate_name: String, pipeline_mod: String) -> String {
-  concat(
-    "/// Resolve imports transitively from entry modules.\n",
-    "/// Fail-closed: panics on unreadable imported files.\n",
-    "/// Returns sources sorted by path for deterministic fixed-point convergence.\n",
-    "fn resolve_transitively_with_seen(\n",
-    "    entry_sources: Vec<(String, String)>,\n",
-    "    index: &HashMap<String, std::path::PathBuf>,\n",
-    "    mut seen: HashMap<String, Rc<", crate_name, "::", pipeline_mod, "::SourceFile>>,\n",
-    ") -> Vec<Rc<", crate_name, "::", pipeline_mod, "::SourceFile>> {\n",
-    "    let mut queue: Vec<(String, String)> = entry_sources;\n",
-    "\n",
-    "    while let Some((_path, content)) = queue.pop() {\n",
-    "        let imports = extract_import_paths(&content);\n",
-    "        for module_path in imports {\n",
-    "            if seen.contains_key(&module_path) {\n",
-    "                continue;\n",
-    "            }\n",
-    "            if let Some(file_path) = index.get(&module_path) {\n",
-    "                let file_content = std::fs::read_to_string(file_path)\n",
-    "                    .unwrap_or_else(|e| panic!(\"failed to read imported module '{}' at {:?}: {}\",\n",
-    "                        module_path, file_path, e));\n",
-    "                let rel_path = file_path.to_string_lossy().to_string();\n",
-    "                let source = Rc::new(", crate_name, "::", pipeline_mod, "::SourceFile {\n",
-    "                    path: rel_path.clone(),\n",
-    "                    content: file_content.clone(),\n",
-    "                });\n",
-    "                seen.insert(module_path, source);\n",
-    "                queue.push((rel_path, file_content));\n",
-    "            }\n",
-    "            // If not found in index, the compiler's resolve stage will report the error.\n",
-    "        }\n",
-    "    }\n",
-    "\n",
-    "    let mut result: Vec<_> = seen.into_iter().map(|(_, v)| v).collect();\n",
-    "    result.sort_by(|a, b| a.path.cmp(&b.path));\n",
-    "    result\n",
-    "}\n\n")
-}
-
 fn emit_main_diagnostic_fns(crate_name: String) -> String {
   let core_mod = module_to_filename(name: "v1.std.core")
   concat(
diff --git a/src/v1/compile.dag b/src/v1/compile.dag
index 3379e277f7b..c7091e48f69 100644
--- a/src/v1/compile.dag
+++ b/src/v1/compile.dag
@@ -73,6 +73,7 @@ import v1.compiler.infer { reconcile, reconcile_with_census_extra }
 import v1.compiler.infer_types { algebra_field_kind_name }
 
 import v1.compiler.emit_core_support { EmitResult, escape_json_string }
+import gunbc.rust_emitted_crate { EmittedRustCrate }
 import gunbc.rust_emitted_edge { EmittedEdge }
 import v1.compiler.emit { unmodeled_file_transport_diagnostics, unmodeled_shell_transport_diagnostics, unmodeled_rest_transport_diagnostics }
 
@@ -123,6 +124,7 @@ type PipelineResult {
   artifact_plan: ArtifactPlan
   newline_indices: List<NewlineIndex>
   emitted_edges: List<EmittedEdge>
+  rust_crates: List<EmittedRustCrate>
 }
 
 // The authored source annotation graph rides beside the semantic result rather than inside it.
@@ -642,7 +644,7 @@ fn emit_artifact(typed: ResolvedGraph, artifact: Artifact) -> EmitResult {
     unmodeled_shell_transport_diagnostics(typed: typed, target: artifact.target),
     unmodeled_rest_transport_diagnostics(typed: typed, target: artifact.target))
   if unmodeled_transports |> count > 0 {
-    return EmitResult { files: [], diagnostics: unmodeled_transports, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: unmodeled_transports, emitted_edges: [], rust_crates: [] }
   }
   match artifact.target {
     Rust => emit_rust_selected(typed: typed, selection: artifact.module_selection)
@@ -1356,13 +1358,13 @@ fn emit_dag_artifact(typed: ResolvedGraph) -> EmitResult {
   let collected = collect_dag_nodes(typed: typed)
   let _ = trace_mark("compile.emit.dag.collect.done")
   if collected.collision_errors |> count > 0 {
-    return EmitResult { files: [], diagnostics: collected.collision_errors, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: collected.collision_errors, emitted_edges: [], rust_crates: [] }
   }
   let order = collected.order
   let key_to_id = build_dag_key_to_id(order: order)
   let ref_errors = dag_emit_ref_errors(order: order, key_to_id: key_to_id)
   if ref_errors |> count > 0 {
-    return EmitResult { files: [], diagnostics: ref_errors, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: ref_errors, emitted_edges: [], rust_crates: [] }
   }
   let source_indices = dag_graph_source_indices(typed: typed)
   let nodes_json = serialize_dag_nodes_table(order: order, source_indices: source_indices, key_to_id: key_to_id)
@@ -1380,7 +1382,8 @@ fn emit_dag_artifact(typed: ResolvedGraph) -> EmitResult {
   EmitResult {
     files: [TextFile { path: "dag-artifact.json", content: json }],
     diagnostics: [],
-    emitted_edges: []
+    emitted_edges: [],
+    rust_crates: []
   }
 }
 
@@ -1425,17 +1428,18 @@ fn emit_from_artifact_plan(emittable: EmittableGraph, artifact_plan: ArtifactPla
     return EmitResult {
       files: [],
       diagnostics: [compile_bundle_error(message: "compile_sources planned no artifacts")],
-      emitted_edges: []
+      emitted_edges: [],
+      rust_crates: []
     }
   }
   let boundary_diags = validate_boundaries(plan: artifact_plan)
   if boundary_diags |> count > 0 {
-    return EmitResult { files: [], diagnostics: boundary_diags, emitted_edges: [] }
+    return EmitResult { files: [], diagnostics: boundary_diags, emitted_edges: [], rust_crates: [] }
   }
   let results = artifact_plan.artifacts |> map(artifact => emit_artifact(typed: typed, artifact: artifact))
   let all_files = results |> flat_map(r => r.files)
   let all_diags = results |> flat_map(r => r.diagnostics)
-  EmitResult { files: all_files, diagnostics: all_diags, emitted_edges: results |> flat_map(r => r.emitted_edges) }
+  EmitResult { files: all_files, diagnostics: all_diags, emitted_edges: results |> flat_map(r => r.emitted_edges), rust_crates: results |> flat_map(r => r.rust_crates) }
 }
 
 fn collect_diagnostics(parse_results: List<ParseResult>) -> List<ErrorNode> {
@@ -1966,7 +1970,8 @@ fn emit_resolved_for_target_selected(resolved: ResolvedPipelineResult, target: R
         ownership: resolved.ownership,
         artifact_plan: empty_artifact_plan(),
         newline_indices: resolved.newline_indices,
-        emitted_edges: []
+        emitted_edges: [],
+        rust_crates: []
       }
     Present { value: emittable } => {
       let typed = emittable.graph
@@ -1989,7 +1994,8 @@ fn emit_resolved_for_target_selected(resolved: ResolvedPipelineResult, target: R
         ownership: resolved.ownership,
         artifact_plan: artifact_plan,
         newline_indices: resolved.newline_indices,
-        emitted_edges: if emit_errors |> count > 0 { [] } else { emit_result.emitted_edges }
+        emitted_edges: if emit_errors |> count > 0 { [] } else { emit_result.emitted_edges },
+        rust_crates: if emit_errors |> count > 0 { [] } else { emit_result.rust_crates }
       }
     }
   }
diff --git a/src/v1/compiler_tests_rust.dag b/src/v1/compiler_tests_rust.dag
index 340dda11f6b..5cc3700b9c2 100644
--- a/src/v1/compiler_tests_rust.dag
+++ b/src/v1/compiler_tests_rust.dag
@@ -70,26 +70,35 @@ fn ct_file_discovery_helpers() -> String {
     "        root: &std::path::Path,\n",
     "        out: &mut Vec<(String, String)>,\n",
     "    ) {\n",
-    "        crate::cli_run::derived_row_roster::ensure_if_row_dir_or_panic(dir);\n",
     "        if let Ok(entries) = std::fs::read_dir(dir) {\n",
+    "            let mut here = Vec::new();\n",
     "            for entry in entries.flatten() {\n",
     "                let path = entry.path();\n",
     "                if path.is_dir() {\n",
     "                    collect_dag_recursive(&path, root, out);\n",
     "                } else if path.extension().map_or(false, |e| e == \"dag\") {\n",
-    "                    let rel = path\n",
-    "                        .strip_prefix(root)\n",
-    "                        .unwrap()\n",
-    "                        .to_string_lossy()\n",
-    "                        .to_string();\n",
-    "                    // Test fixtures (e.g. fact_cardinality_split_brace.dag) are not modules.\n",
-    "                    if rel.contains(\"/tests/\") {\n",
-    "                        continue;\n",
-    "                    }\n",
-    "                    let content = std::fs::read_to_string(&path)\n",
-    "                        .unwrap_or_else(|e| panic!(\"failed to read {}: {}\", path.display(), e));\n",
-    "                    out.push((rel, content));\n",
+    "                    here.push(path);\n",
+    "                }\n",
+    "            }\n",
+    "            // Admitted per directory, so a ledger row directory contributes its derived roster\n",
+    "            // in memory (`derived_row_roster::acquire_dir_files`) rather than as a written file.\n",
+    "            let acquired = crate::cli_run::derived_row_roster::acquire_dir_files(dir, here)\n",
+    "                .unwrap_or_else(|e| panic!(\"{}\", e));\n",
+    "            for source in acquired {\n",
+    "                let path = source.path();\n",
+    "                let rel = path\n",
+    "                    .strip_prefix(root)\n",
+    "                    .unwrap()\n",
+    "                    .to_string_lossy()\n",
+    "                    .to_string();\n",
+    "                // Test fixtures (e.g. fact_cardinality_split_brace.dag) are not modules.\n",
+    "                if rel.contains(\"/tests/\") {\n",
+    "                    continue;\n",
     "                }\n",
+    "                let content = source\n",
+    "                    .read()\n",
+    "                    .unwrap_or_else(|e| panic!(\"failed to read {}: {}\", path.display(), e));\n",
+    "                out.push((rel, content));\n",
     "            }\n",
     "        }\n",
     "    }\n\n")
@@ -1706,6 +1715,101 @@ fn ct_unbound_reference_to_a_twice_declared_leaf_refuses_test() -> String {
   )
 }
 
+// A same-leaf declaration in one module does not change what another module emits.
+fn ct_a_coproduct_named_optional_emits_as_its_own_enum_test() -> String {
+  [
+    "    // A COPRODUCT NAMED Optional EMITS AS ITS OWN ENUM. still-raven-321's fixture,\n",
+    "    // fixtures/native_emission_controls_optional_collision.dag, is a non-kernel declaration that shares\n",
+    "    // the kernel mint's leaf. Host-Option is decided by declaration (v1.compiler.emit_rust\n",
+    "    // declaration_owns_host_option over gunbc.structural_realization_bindings kernel_mint_declaration_rows),\n",
+    "    // so its positions name its own enum. THE RED is the leaf rule this replaced: every position rendered\n",
+    "    // as Option<..> and the variants were never emitted (E0425 cannot find CollisionWrapped). The fixture\n",
+    "    // lives outside the source roots, because a second Optional in the accepted corpus is a leaf-name fork,\n",
+    "    // so it is compiled here, from its file, beside a kernel std.optional. Its one import line names a\n",
+    "    // kernel type and is dropped so the pair compiles standalone.\n",
+    "    #[test]\n",
+    "    fn a_coproduct_named_optional_emits_as_its_own_enum() {\n",
+    "        use crate::v1_compiler_compile::SourceFile;\n",
+    "        let collision = read_dag(\"fixtures/native_emission_controls_optional_collision.dag\").replace(\"import std.types \{ Int \}\\n\", \"\");\n",
+    "        let sources = vec![\n",
+    "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/optional.dag\".to_string(), content: \"module std.optional\\n\\ntype Optional<T>\\n  = Present { value: T }\\n  | Absent\\n\".to_string() }),\n",
+    "            std::rc::Rc::new(SourceFile { path: \"fixtures/native_emission_controls_optional_collision.dag\".to_string(), content: collision }),\n",
+    "        ];\n",
+    "        let result = crate::v1_compiler_compile::compile_sources(std::rc::Rc::new(sources.into()), crate::v1_compiler_artifact::RenderTarget::Rust);\n",
+    "        let emitted = result.files.iter().find(|f| f.path.contains(\"native_emission_controls_optional_collision\")).map(|f| f.content.clone()).unwrap_or_default();\n",
+    "        assert!(emitted.contains(\"pub enum Optional\") && emitted.contains(\"CollisionWrapped\"), \"the collision coproduct must emit as its own enum:\\n\{emitted}\");\n",
+    "        assert!(!emitted.contains(\"Option<\") && !emitted.contains(\"compile_error!\"), \"no position of the collision coproduct may realize as the host Option:\\n\{emitted}\");\n",
+    "    }\n",
+    "\n",
+  ] |> join(separator: "")
+}
+
+fn ct_unstamped_bare_optional_follows_the_lookup_binding_order_test() -> String {
+  [
+    "    // AN UNSTAMPED BARE `Optional` FOLLOWS THE TYPECHECKER'S lookup_binding ORDER: own file, then\n",
+    "    // the file's named import (followed through re-exports), then the kernel\n",
+    "    // (v1.compiler.infer_env bare_occurrence_binding). The member references of a coproduct body reach\n",
+    "    // the emitter from the type environment's copy with no Node.declaration, so the census route is\n",
+    "    // the emitter's own decision. THE RED is the importer: with the kernel ahead of the named import\n",
+    "    // (the order direct_import_export_precedence_note states) its payload routes kernel_mint to\n",
+    "    // std.optional, measured on gunbc#13454 at 57551c4b. The control keeps a module that names\n",
+    "    // Optional without importing it on the kernel arm.\n",
+    "    #[test]\n",
+    "    fn unstamped_bare_optional_follows_the_lookup_binding_order() {\n",
+    "        use crate::v1_compiler_compile::SourceFile;\n",
+    "        let sources = vec![\n",
+    "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/optional.dag\".to_string(), content: \"module std.optional\\n\\ntype Optional<T>\\n  = Present { value: T }\\n  | Absent\\n\".to_string() }),\n",
+    "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/collision.dag\".to_string(), content: \"module hom.collision\\n\\ntype Optional\\n  = CollisionWrapped { value: Int }\\n  | CollisionEmpty\\n\".to_string() }),\n",
+    "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/importer.dag\".to_string(), content: \"module hom.importer\\n\\nimport hom.collision { Optional }\\n\\ntype HeldChoice\\n  = HeldOptional { held: Optional }\\n  | HeldNothing\\n\".to_string() }),\n",
+    "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/plain.dag\".to_string(), content: \"module hom.plain\\n\\ntype PlainChoice\\n  = PlainHeld { held: Optional<Int> }\\n  | PlainNothing\\n\".to_string() }),\n",
+    "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/user.dag\".to_string(), content: \"module hom.user\\n\\nimport hom.importer { HeldChoice }\\nimport hom.plain { PlainChoice }\\n\\nfn pick(h: HeldChoice, p: PlainChoice) -> Int {\\n  1\\n}\\n\".to_string() }),\n",
+    "        ];\n",
+    "        let receipt = crate::v1_tests_claim_carrier_realization_census::typed_census_from_sources(std::rc::Rc::new(sources.into()));\n",
+    "        assert!(!receipt.starts_with(\"REFUSED\"), \"\{receipt}\");\n",
+    "        let routes = |enclosing: &str| -> Vec<String> {\n",
+    "            receipt.lines().skip(1).map(|l| l.split('\\t').collect::<Vec<_>>())\n",
+    "                .filter(|c| c[1] == enclosing && c[2] == \"declaration_field\" && c[3] == \"Optional\")\n",
+    "                .map(|c| c[13].to_string()).collect()\n",
+    "        };\n",
+    "        let held = routes(\"HeldChoice\");\n",
+    "        assert!(!held.is_empty() && held.iter().all(|r| r == \"referencing_module_import:Resolved:hom.collision.Optional\"), \"the imported Optional must route to the import, never the kernel mint:\\n\{receipt}\");\n",
+    "        let plain = routes(\"PlainChoice\");\n",
+    "        assert!(!plain.is_empty() && plain.iter().all(|r| r == \"kernel_mint:Resolved:std.optional.Optional\"), \"an unimported Optional is the kernel's:\\n\{receipt}\");\n",
+    "        assert!(!receipt.contains(\"LeafAmbiguous:Optional\"), \"\{receipt}\");\n",
+    "    }\n",
+    "\n",
+  ] |> join(separator: "")
+}
+
+fn ct_same_leaf_type_elsewhere_leaves_other_modules_emission_unchanged_test() -> String {
+  concat(
+    "    // A SAME-LEAF TYPE ANYWHERE MUST NOT CHANGE ANOTHER MODULE'S EMISSION. hom.user returns the kernel\n",
+    "    // optional's Absent; hom.edge declares an unrelated enum that also has an Absent variant. With the\n",
+    "    // leaf-keyed type summaries, adding hom.coll (a coproduct it declares as Optional) replaced the\n",
+    "    // kernel Optional's summary, so Absent stopped being an Optional variant and hom.user emitted\n",
+    "    // Rc::new(Lookup::Absent) where it had emitted None. Keyed by declaration, both summaries stand:\n",
+    "    // hom.user's file is byte-identical with and without hom.coll, and its Absent is the host None.\n",
+    "    #[test]\n",
+    "    fn same_leaf_type_elsewhere_leaves_other_modules_emission_unchanged() {\n",
+    "        use crate::v1_compiler_compile::SourceFile;\n",
+    "        let src = |path: &str, content: &str| std::rc::Rc::new(SourceFile { path: path.to_string(), content: content.to_string() });\n",
+    "        let optional = || src(\"fixtures/same_leaf_optional/optional.dag\", \"module std.optional\\n\\ntype Optional<T>\\n  = Present { value: T }\\n  | Absent\\n\");\n",
+    "        let edge = || src(\"fixtures/same_leaf_optional/edge.dag\", \"module hom.edge\\n\\ntype Lookup\\n  = Found { at: Int }\\n  | Absent\\n\");\n",
+    "        let user = || src(\"fixtures/same_leaf_optional/user.dag\", \"module hom.user\\nimport std.optional { Optional, Present, Absent }\\n\\nfn nothing_here(x: Int) -> Optional<Int> {\\n  Absent\\n}\\n\");\n",
+    "        let coll = || src(\"fixtures/same_leaf_optional/coll.dag\", \"module hom.coll\\n\\ntype Optional\\n  = CollisionWrapped { value: Int }\\n  | CollisionEmpty\\n\");\n",
+    "        let emitted_user = |sources: Vec<std::rc::Rc<SourceFile>>| -> String {\n",
+    "            let result = crate::v1_compiler_compile::compile_sources(std::rc::Rc::new(sources.into()), crate::v1_compiler_artifact::RenderTarget::Rust);\n",
+    "            result.files.iter().find(|f| f.path.contains(\"hom_user\")).map(|f| f.content.clone()).unwrap_or_default()\n",
+    "        };\n",
+    "        let without = emitted_user(vec![optional(), edge(), user()]);\n",
+    "        let with = emitted_user(vec![optional(), edge(), user(), coll()]);\n",
+    "        assert!(without.contains(\"None\") && !without.contains(\"Lookup::Absent\"), \"the control: hom.user's Absent is the host None:\\n\{without}\");\n",
+    "        assert_eq!(with, without, \"adding a same-leaf Optional elsewhere changed hom.user's emission\");\n",
+    "    }\n",
+    "\n"
+  )
+}
+
 // The referencing-module arm admits only a bare spelling: a qualified reference to another module's
 // declaration, arriving unstamped, is not decided by the referencing module's own same-leaf one.
 fn ct_qualified_reference_is_not_decided_by_the_local_declarer_test() -> String {
@@ -1713,7 +1817,7 @@ fn ct_qualified_reference_is_not_decided_by_the_local_declarer_test() -> String
     "    // A QUALIFIED REFERENCE IS NOT DECIDED BY THE LOCAL DECLARER. hom.local declares its own Slot\n",
     "    // and ALSO names no.such.module.Slot, which resolve cannot bind, so the reference reaches the\n",
     "    // emitter unstamped while two modules declare Slot. The referencing-module arm\n",
-    "    // (v1.compiler.infer_emit_info type_decl_referencing_module_declarer) would pick the LOCAL Slot:\n",
+    "    // (v1.compiler.infer_emit_info type_decl_occurrence_binding) would pick the LOCAL Slot:\n",
     "    // the wrong-declarer class itself. It is admitted only for a bare spelling, so this refuses.\n",
     "    // THE CONTROL is the same module without the second declarer: the spelling names a sole\n",
     "    // declarer, and nothing refuses.\n",
@@ -1889,6 +1993,9 @@ fn ct_coercion_tests() -> String {
     ct_same_leaf_type_declarations_emit_by_identity_test(),
     ct_unbound_reference_to_a_twice_declared_leaf_refuses_test(),
     ct_qualified_reference_is_not_decided_by_the_local_declarer_test(),
+    ct_same_leaf_type_elsewhere_leaves_other_modules_emission_unchanged_test(),
+    ct_unstamped_bare_optional_follows_the_lookup_binding_order_test(),
+    ct_a_coproduct_named_optional_emits_as_its_own_enum_test(),
     ct_duplicate_type_parameter_refuses_test(),
     ct_resource_item_is_not_a_type_item_test())
 }
@@ -2317,7 +2424,11 @@ fn ct_diagnostics_carrier_grounding_test() -> String {
     "    fn diagnostics_carrier_grounds_to_native_option() {\n",
     "        assert!(crate::v1_compiler_emit_rust::is_host_diagnostics_carrier_alias(\"Diagnostics\".to_string()));\n",
     "        assert!(!crate::v1_compiler_emit_rust::is_host_diagnostics_carrier_alias(\"Optional\".to_string()));\n",
-    "        assert!(crate::v1_compiler_emit_rust::is_grounded_coproduct_native_alias(\"Diagnostics\".to_string()));\n",
+    "        assert!(crate::v1_compiler_emit_rust::declaration_is_grounded_coproduct_native_alias(\"v2.std.diagnostic\".to_string(), \"Diagnostics\".to_string()));\n",
+    "        // The host option is a DECLARATION, not a name: the kernel optional's declaration is it, and a\n",
+    "        // coproduct another module declares as Optional is not.\n",
+    "        assert!(crate::v1_compiler_emit_rust::declaration_is_grounded_coproduct_native_alias(\"std.optional\".to_string(), \"Optional\".to_string()));\n",
+    "        assert!(!crate::v1_compiler_emit_rust::declaration_is_grounded_coproduct_native_alias(\"gunbc.instruments.native_emission_controls_optional_collision\".to_string(), \"Optional\".to_string()));\n",
     "        let empty_shared = std::rc::Rc::new(im::OrdSet::new());\n",
     "        assert_eq!(\n",
     "            crate::v1_compiler_emit_rust::render_rust_diagnostics_carrier_applied(empty_shared.clone()),\n",
@@ -4404,7 +4515,7 @@ fn ct_method_existence_wall_witness_test() -> String {
     "                // row, and the call is STILL refused, because the receiver does not\n",
     "                // fail to resolve in the way the row was measured on. A (module, method)\n",
     "                // key passed this input; that is the fail-open the third component closes.\n",
-    "                let listed_wrong_shape = compile_one(\"listed.dag\", frontier_src(\"extdeps.dns.domain_name\", \"list_push\"));\n",
+    "                let listed_wrong_shape = compile_one(\"listed.dag\", frontier_src(\"v1.compiler.trace\", \"map\"));\n",
     "                assert!(\n",
     "                    listed_wrong_shape.diagnostics.iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodExistenceUndecided { .. })),\n",
     "                    \"a declared row must NOT admit a new call in the same module on a receiver whose shape it was never measured on, got: {:?}\",\n",
@@ -5117,7 +5228,7 @@ fn ct_function_value_adapter_bound_alignment_control_test() -> String {
     "\n")
 }
 
-// THE PROBE UNDER emit_entry_point_absent_main_rs AND emitted_crate_dependency_lines, AND THE
+// THE PROBE UNDER emit_entry_point_absent_main_rs AND v1.compiler.stage0_crates emitted_crate_dependencies, AND THE
 // PATH IT DOES NOT EXECUTE ON.
 //
 // THIS BLOCK CALLED ITSELF A WALL "ENROLLED WHERE IT ACTUALLY EXECUTES" AND THE STEP IT NAMED DOES
@@ -5193,13 +5304,14 @@ fn ct_entry_point_absent_refusal_test() -> String {
     "                    \"the refusal must leave a nonzero exit status; got: {:?}\",\n",
     "                    main_rs.content\n",
     "                );\n",
-    "                let cargo_toml = result.files.iter()\n",
-    "                    .find(|f| f.path == \"Cargo.toml\")\n",
-    "                    .expect(\"emission must produce Cargo.toml\");\n",
     "                assert!(\n",
-    "                    !cargo_toml.content.contains(\"clap\"),\n",
-    "                    \"a crate whose emitted sources reference clap nowhere must not declare it; got: {:?}\",\n",
-    "                    cargo_toml.content\n",
+    "                    !result.files.iter().any(|f| f.path == \"Cargo.toml\"),\n",
+    "                    \"the emission owns no manifest -- the crate partition realizes its layout\"\n",
+    "                );\n",
+    "                assert!(\n",
+    "                    result.rust_crates.iter().all(|c| !c.demand.renders_clap_cli),\n",
+    "                    \"a crate whose emitted sources reference clap nowhere must not demand it; got: {:?}\",\n",
+    "                    result.rust_crates\n",
     "                );\n",
     "            })\n",
     "            .expect(\"failed to spawn thread\")\n",
@@ -5208,25 +5320,25 @@ fn ct_entry_point_absent_refusal_test() -> String {
     "    }\n\n",
     "    #[test]\n",
     "    fn the_clap_dependency_follows_the_emitted_cli_demand_in_both_directions() {\n",
-    "        let with_cli = crate::v1_compiler_emit_rust::emitted_crate_dependency_lines(\n",
-    "            crate::v1_compiler_emit_rust::EmittedCrateDependencyDemand {\n",
+    "        let with_cli = crate::v1_compiler_stage0_crates::emitted_crate_dependencies(\n",
+    "            crate::gunbc_rust_emitted_crate::EmittedCrateDependencyDemand {\n",
     "                renders_clap_cli: true,\n",
     "                renders_async_services: false,\n",
     "            },\n",
     "        );\n",
-    "        let without_cli = crate::v1_compiler_emit_rust::emitted_crate_dependency_lines(\n",
-    "            crate::v1_compiler_emit_rust::EmittedCrateDependencyDemand {\n",
+    "        let without_cli = crate::v1_compiler_stage0_crates::emitted_crate_dependencies(\n",
+    "            crate::gunbc_rust_emitted_crate::EmittedCrateDependencyDemand {\n",
     "                renders_clap_cli: false,\n",
     "                renders_async_services: false,\n",
     "            },\n",
     "        );\n",
     "        assert!(\n",
-    "            with_cli.iter().any(|line| line.starts_with(\"clap = \")),\n",
+    "            with_cli.iter().any(|dep| dep.name == \"clap\"),\n",
     "            \"a crate that renders a clap CLI must declare clap; got: {:?}\",\n",
     "            with_cli\n",
     "        );\n",
     "        assert!(\n",
-    "            !without_cli.iter().any(|line| line.starts_with(\"clap = \")),\n",
+    "            !without_cli.iter().any(|dep| dep.name == \"clap\"),\n",
     "            \"a crate that renders no clap CLI must not declare clap; got: {:?}\",\n",
     "            without_cli\n",
     "        );\n",
diff --git a/src/v1/emitted_workspace.dag b/src/v1/emitted_workspace.dag
new file mode 100644
index 00000000000..21c6e046181
--- /dev/null
+++ b/src/v1/emitted_workspace.dag
@@ -0,0 +1,245 @@
+module v1.compiler.emitted_workspace
+
+import std.types { Bool, Int, List, String }
+import std.optional { Absent, Optional, Present }
+import v1.std.core { TextFile }
+import extdeps.cargo { CargoDependency }
+import gunbc.rust_emitted_edge { EmittedEdge }
+import gunbc.rust_emitted_crate { EmittedRustCrate }
+import gunbc.stage0_crate_partition_generated { GeneratedPartitionCrateRow }
+import v1.compiler.emit_rust {
+  emit_emitted_population_manifest,
+  emitted_population_manifest_path,
+  rust_emitted_module_basename,
+  rust_source_ext,
+  rust_source_root,
+  string_without_suffix
+}
+import v1.compiler.stage0_crates {
+  Stage0CrateBoundaryEmitOk,
+  Stage0CrateBoundaryEmitRefused,
+  emitted_crate_dependencies,
+  partition_crate_boundary_emit_outcome_over,
+  stage0_crate_boundary_emit_refusal_message
+}
+import gunbc.emitted_crate_workspace {
+  EmittedWorkspaceBuild,
+  EmittedWorkspaceRedDrop,
+  EmittedWorkspaceRedPlanned,
+  EmittedWorkspaceRedRefused,
+  emitted_workspace_red_over,
+  EmittedWorkspaceBuildPlanned,
+  EmittedWorkspaceBuildRefused,
+  EmittedWorkspaceRefusal,
+  emitted_workspace_build,
+  emitted_workspace_refusal_message,
+  emitted_workspace_root_crate_dir
+}
+
+// AN EMISSION, REALIZED AS THE COMPLETE FILE POPULATION OF ITS CARGO WORKSPACE. The emitter returns
+// its files, its edges and the crate it names; gunbc.emitted_crate_workspace
+// emitted_workspace_build decides the layout from those alone; v1.compiler.stage0_crates renders the
+// manifests and crate roots. This function composes the three and places every emitted file, so
+// the writer, the population manifest and any identity over the workspace read ONE list -- the
+// files that will exist, at the paths they will exist at -- and none keeps its own idea of the
+// layout.
+//
+// The plan is compiled here rather than interpreted by the host: it is pure over the emission, so
+// laying out a program reads no source tree, which is what lets `gunbc compile` run from any
+// directory.
+//
+// EVERY EMITTED FILE IS PLACED OR REFUSED, NEVER DROPPED. The module files go where the partition
+// crates include them from; the entry goes where Cargo finds the binary the caller names; the
+// generated tests go to the top package's `tests/`, which sits at the workspace root. Two files of
+// the single-package assembly are SUPERSEDED by name -- its crate root, replaced by the facade
+// crate's, and its population manifest, re-rendered over the realized paths -- and anything else
+// refuses, so a new kind of emitted artifact cannot vanish from a build that reports success.
+
+// Where the partition crates' lib.rs files include module bodies from: every crate dir is
+// `src/v1/<package>` (gunbc.emitted_crate_workspace emitted_workspace_crate_dir), and its
+// includes reach `../../stage0/src/<module>.rs` (v1.compiler.stage0_crates stage0_crate_mod_include).
+data emitted_workspace_module_dir: String = "src/v1/stage0/src"
+
+type EmittedWorkspaceRealizationRefusal
+  = EmittedWorkspaceCrateNotUnique { count: Int }
+  | EmittedWorkspaceEntryAbsent
+  | EmittedWorkspaceFileUnplaced { path: String }
+  | EmittedWorkspacePlanRefused { cause: EmittedWorkspaceRefusal }
+  | EmittedWorkspaceRenderRefused { message: String }
+
+// `files` is every file of the workspace, by path relative to its root, the population manifest
+// included.
+type EmittedWorkspaceRealized {
+  files: List<TextFile>
+  build: EmittedWorkspaceBuild
+  module_dir: String
+  registry_dependencies: List<CargoDependency>
+}
+
+type EmittedWorkspaceRealization
+  = EmittedWorkspaceRealizedOk { workspace: EmittedWorkspaceRealized }
+  | EmittedWorkspaceRealizationRefused { cause: EmittedWorkspaceRealizationRefusal }
+
+type EmittedFilePlacement
+  = PlacedModule { basename: String, file: TextFile }
+  | PlacedEntry { content: String }
+  | PlacedTest { file: TextFile }
+  | PlacedSuperseded
+  | PlacedNowhere { path: String }
+
+fn emitted_workspace_entry_path() -> String {
+  concat(rust_source_root(), "main", rust_source_ext())
+}
+
+fn emitted_workspace_crate_root_path() -> String {
+  concat(rust_source_root(), "lib", rust_source_ext())
+}
+
+fn emitted_file_placement(file: TextFile) -> EmittedFilePlacement {
+  let path = file.path
+  if path == emitted_workspace_entry_path() {
+    PlacedEntry { content: file.content }
+  } else if path == emitted_workspace_crate_root_path() || path == emitted_population_manifest_path() {
+    PlacedSuperseded
+  } else if starts_with(s: path, prefix: "tests/") && (string_without_suffix(value: path, suffix: rust_source_ext()) != none) {
+    PlacedTest { file: file }
+  } else if starts_with(s: path, prefix: rust_source_root()) && (string_without_suffix(value: path, suffix: rust_source_ext()) != none)
+    && !string_contains(s: rust_emitted_module_basename(path: path), pattern: "/") {
+    let basename = rust_emitted_module_basename(path: path)
+    PlacedModule {
+      basename: basename,
+      file: TextFile { path: concat(emitted_workspace_module_dir, "/", basename, rust_source_ext()), content: file.content }
+    }
+  } else {
+    PlacedNowhere { path: path }
+  }
+}
+
+fn emitted_workspace_relative_path(path: String) -> String {
+  if starts_with(s: path, prefix: "./") { replace(path, "./", "") } else { path }
+}
+
+// The workspace section names every crate beneath the root. The top package sits AT the root, so it
+// is the workspace's root package and the section is appended to its manifest.
+fn emitted_workspace_section(rows: List<GeneratedPartitionCrateRow>) -> String {
+  let members = rows
+    |> filter(r => r.crate_dir != emitted_workspace_root_crate_dir)
+    |> map(r => concat("    \"", r.crate_dir, "\","))
+    |> join(separator: "\n")
+  concat("\n[workspace]\nresolver = \"2\"\nmembers = [\n", members, "\n]\n")
+}
+
+fn emitted_workspace_with_section(files: List<TextFile>, rows: List<GeneratedPartitionCrateRow>) -> List<TextFile> {
+  files |> map(f =>
+    if f.path == "Cargo.toml" { TextFile { path: f.path, content: concat(f.content, emitted_workspace_section(rows: rows)) } }
+    else { f }
+  )
+}
+
+fn emitted_workspace_realization(
+  files: List<TextFile>,
+  edges: List<EmittedEdge>,
+  rust_crates: List<EmittedRustCrate>,
+  bin_name: String
+) -> EmittedWorkspaceRealization {
+  match rust_crates |> first {
+    Absent => EmittedWorkspaceRealizationRefused { cause: EmittedWorkspaceCrateNotUnique { count: 0 } }
+    Present { value: rust_crate } =>
+      if (rust_crates |> count) != 1 {
+        EmittedWorkspaceRealizationRefused { cause: EmittedWorkspaceCrateNotUnique { count: rust_crates |> count } }
+      } else {
+        emitted_workspace_realization_of(files: files, edges: edges, rust_crate: rust_crate, bin_name: bin_name)
+      }
+  }
+}
+
+fn emitted_workspace_realization_of(
+  files: List<TextFile>,
+  edges: List<EmittedEdge>,
+  rust_crate: EmittedRustCrate,
+  bin_name: String
+) -> EmittedWorkspaceRealization {
+  let placements = files |> map(f => emitted_file_placement(file: f))
+  let unplaced = placements |> flat_map(p => match p { PlacedNowhere { path: path } => [path]  _ => [] })
+  let entries = placements |> flat_map(p => match p { PlacedEntry { content: c } => [c]  _ => [] })
+  let modules = placements |> flat_map(p => match p { PlacedModule { basename: _, file: f } => [f]  _ => [] })
+  let basenames = placements |> flat_map(p => match p { PlacedModule { basename: b, file: _ } => [b]  _ => [] })
+  let tests = placements |> flat_map(p => match p { PlacedTest { file: f } => [f]  _ => [] })
+  match unplaced |> first {
+    Present { value: path } => EmittedWorkspaceRealizationRefused { cause: EmittedWorkspaceFileUnplaced { path: path } }
+    Absent =>
+      match entries |> first {
+        Absent => EmittedWorkspaceRealizationRefused { cause: EmittedWorkspaceEntryAbsent }
+        Present { value: entry } =>
+          match emitted_workspace_build(emitted_basenames: basenames, edges: edges, crate_name: rust_crate.crate_name, bin_name: bin_name) {
+            EmittedWorkspaceBuildRefused { cause: c } => EmittedWorkspaceRealizationRefused { cause: EmittedWorkspacePlanRefused { cause: c } }
+            EmittedWorkspaceBuildPlanned { build: build } => {
+              let registry_dependencies = emitted_crate_dependencies(demand: rust_crate.demand)
+              match partition_crate_boundary_emit_outcome_over(rows: build.rows, registry_dependencies: registry_dependencies) {
+                Stage0CrateBoundaryEmitRefused { cause: cause } =>
+                  EmittedWorkspaceRealizationRefused { cause: EmittedWorkspaceRenderRefused { message: stage0_crate_boundary_emit_refusal_message(cause: cause) } }
+                Stage0CrateBoundaryEmitOk { files: rendered } => {
+                  let crate_files = emitted_workspace_with_section(
+                    files: rendered |> map(f => TextFile { path: emitted_workspace_relative_path(path: f.path), content: f.content }),
+                    rows: build.rows
+                  )
+                  let realized = concat(
+                    crate_files,
+                    modules,
+                    [TextFile { path: build.bin_source_path, content: entry }],
+                    tests
+                  )
+                  EmittedWorkspaceRealizedOk {
+                    workspace: EmittedWorkspaceRealized {
+                      files: concat(realized, [emit_emitted_population_manifest(paths: realized |> map(f => f.path))]),
+                      build: build,
+                      module_dir: emitted_workspace_module_dir,
+                      registry_dependencies: registry_dependencies
+                    }
+                  }
+                }
+              }
+            }
+          }
+      }
+  }
+}
+
+fn emitted_workspace_realization_refusal_message(cause: EmittedWorkspaceRealizationRefusal) -> String {
+  match cause {
+    EmittedWorkspaceCrateNotUnique { count: n } => concat("EmittedCrateNotUnique: the emission names ", to_string(value: n), " Rust crates, not one")
+    EmittedWorkspaceEntryAbsent => "EntryFileAbsent: the emission wrote no src/main.rs for the binary"
+    EmittedWorkspaceFileUnplaced { path: path } => concat("EmittedFileUnplaced: the workspace has no place for emitted file ", path)
+    EmittedWorkspacePlanRefused { cause: c } => concat("PlanRefused: ", emitted_workspace_refusal_message(cause: c))
+    EmittedWorkspaceRenderRefused { message: m } => concat("RenderRefused: ", m)
+  }
+}
+
+// THE INSTRUMENT'S RED OVER THE PRODUCTION LAYOUT: the realized workspace with one irredundant
+// crate dependency dropped (gunbc.emitted_crate_workspace emitted_workspace_red_over). Only the
+// crate manifests and roots change, so the RED is those files re-rendered over the red rows plus the
+// unchanged top package; the writer lays them over the green tree.
+type EmittedWorkspaceRedRealization
+  = EmittedWorkspaceRedRealized { red: EmittedWorkspaceRedDrop, files: List<TextFile> }
+  | EmittedWorkspaceRedRealizationRefused { message: String }
+
+fn emitted_workspace_red_realization(workspace: EmittedWorkspaceRealized) -> EmittedWorkspaceRedRealization {
+  match emitted_workspace_red_over(plan: workspace.build.layout) {
+    EmittedWorkspaceRedRefused { cause: c } => EmittedWorkspaceRedRealizationRefused { message: emitted_workspace_refusal_message(cause: c) }
+    EmittedWorkspaceRedPlanned { red: red, red_rows: red_rows } => {
+      let rows = concat(red_rows, workspace.build.rows |> filter(r => r.crate_dir == emitted_workspace_root_crate_dir))
+      match partition_crate_boundary_emit_outcome_over(rows: rows, registry_dependencies: workspace.registry_dependencies) {
+        Stage0CrateBoundaryEmitRefused { cause: cause } =>
+          EmittedWorkspaceRedRealizationRefused { message: stage0_crate_boundary_emit_refusal_message(cause: cause) }
+        Stage0CrateBoundaryEmitOk { files: rendered } =>
+          EmittedWorkspaceRedRealized {
+            red: red,
+            files: emitted_workspace_with_section(
+              files: rendered |> map(f => TextFile { path: emitted_workspace_relative_path(path: f.path), content: f.content }),
+              rows: rows
+            )
+          }
+      }
+    }
+  }
+}
diff --git a/src/v1/runtime_rust.dag b/src/v1/runtime_rust.dag
index 5129153804f..ced1aeadd94 100644
--- a/src/v1/runtime_rust.dag
+++ b/src/v1/runtime_rust.dag
@@ -255,6 +255,118 @@ fn rt_collection_ops() -> String {
     "pub fn map_values<K, V: Clone>(m: &HashMap<K, V>) -> Vec<V> { m.values().cloned().collect() }\n\n",
     "pub fn list_concat<T: Clone>(mut a: Vec<T>, b: Vec<T>) -> Vec<T> { a.append(b); a }\n\n",
     "pub fn list_push<T: Clone>(mut list: Vec<T>, item: T) -> Vec<T> { list.push_back(item); list }\n\n",
+    "/// std.primitives skip_contract on the persistent carrier: the suffix after `n` members,\n",
+    "/// sharing the receiver's tree in O(log n) instead of copying the remainder, so a walk that\n",
+    "/// slices by offset is O(n log n) rather than quadratic. A negative `n` skips every member, as\n",
+    "/// the copying form's saturating `n as usize` did.\n",
+    "pub fn list_skip<T: Clone>(items: &Vec<T>, n: i64) -> Vec<T> \{\n",
+    "    let k = if n < 0 \{\n",
+    "        items.len()\n",
+    "    \} else \{\n",
+    "        (n as usize).min(items.len())\n",
+    "    \};\n",
+    "    items.skip(k)\n",
+    "\}\n",
+    "\n",
+    "/// std.primitives take_contract on the persistent carrier: the first `n` members, sharing\n",
+    "/// the receiver's tree. A negative `n` keeps every member, as the copying form did.\n",
+    "pub fn list_take<T: Clone>(items: &Vec<T>, n: i64) -> Vec<T> \{\n",
+    "    let k = if n < 0 \{\n",
+    "        items.len()\n",
+    "    \} else \{\n",
+    "        (n as usize).min(items.len())\n",
+    "    \};\n",
+    "    items.take(k)\n",
+    "\}\n",
+    "\n",
+    "#[cfg(test)]\n",
+    "mod list_slice_tests \{\n",
+    "    use super::*;\n",
+    "\n",
+    "    thread_local! \{\n",
+    "        static CLONES: Cell<u64> = const \{ Cell::new(0) \};\n",
+    "    \}\n",
+    "\n",
+    "    /// A code point whose every copy is counted, so a slice's cost is read off the carrier's\n",
+    "    /// own work rather than a clock.\n",
+    "    #[derive(Debug, PartialEq)]\n",
+    "    struct CountedCodePoint(u32);\n",
+    "\n",
+    "    impl Clone for CountedCodePoint \{\n",
+    "        fn clone(&self) -> Self \{\n",
+    "            CLONES.with(|c| c.set(c.get() + 1));\n",
+    "            CountedCodePoint(self.0)\n",
+    "        \}\n",
+    "    \}\n",
+    "\n",
+    "    fn clones_during<R>(f: impl FnOnce() -> R) -> (R, u64) \{\n",
+    "        let before = CLONES.with(|c| c.get());\n",
+    "        let r = f();\n",
+    "        (r, CLONES.with(|c| c.get()) - before)\n",
+    "    \}\n",
+    "\n",
+    "    // Non-ASCII on purpose: emitted char_at / substring over a bare &str are O(offset) here,\n",
+    "    // which is the walk the code-point slice replaces.\n",
+    "    fn non_ascii_code_points(n: usize) -> Vec<CountedCodePoint> \{\n",
+    "        [0xe9u32, 0x4e2d, 0x1f600, 0x61]\n",
+    "            .iter()\n",
+    "            .cycle()\n",
+    "            .take(n)\n",
+    "            .map(|cp| CountedCodePoint(*cp))\n",
+    "            .collect()\n",
+    "    \}\n",
+    "\n",
+    "    const N: usize = 200_000;\n",
+    "    // im's RRB split copies at most one boundary chunk per tree level; this is that bound with\n",
+    "    // headroom, and three orders of magnitude below N.\n",
+    "    const SLICE_COPY_BUDGET: u64 = 2_048;\n",
+    "\n",
+    "    #[test]\n",
+    "    fn a_slice_from_the_middle_copies_only_boundary_chunks() \{\n",
+    "        let cps = Rc::new(non_ascii_code_points(N));\n",
+    "        let (slice, copied) = clones_during(|| list_take(&list_skip(&cps, (N / 2) as i64), 7));\n",
+    "        assert!(\n",
+    "            copied <= SLICE_COPY_BUDGET,\n",
+    "            \"skip+take copied \{\} members of \{\}\",\n",
+    "            copied,\n",
+    "            N\n",
+    "        );\n",
+    "        let expected: std::vec::Vec<u32> = cps.iter().skip(N / 2).take(7).map(|c| c.0).collect();\n",
+    "        assert_eq!(\n",
+    "            slice.iter().map(|c| c.0).collect::<std::vec::Vec<_>>(),\n",
+    "            expected\n",
+    "        );\n",
+    "    \}\n",
+    "\n",
+    "    // THE RED CONTROL: the extdeps.languages.rust.emit skip / take templates this runtime pair\n",
+    "    // replaced, spelled as they emitted, on the same input and bound. It must exceed the budget,\n",
+    "    // or the budget does not discriminate the quadratic.\n",
+    "    #[test]\n",
+    "    fn the_copying_template_form_exceeds_the_budget() \{\n",
+    "        let cps = Rc::new(non_ascii_code_points(N));\n",
+    "        let (_, copied) = clones_during(|| \{\n",
+    "            let rest = cps.iter().cloned().skip(N / 2).collect::<Vec<_>>();\n",
+    "            rest.iter().cloned().take(7).collect::<Vec<_>>()\n",
+    "        \});\n",
+    "        assert!(\n",
+    "            copied > SLICE_COPY_BUDGET,\n",
+    "            \"copying form copied only \{\}\",\n",
+    "            copied\n",
+    "        );\n",
+    "    \}\n",
+    "\n",
+    "    #[test]\n",
+    "    fn negative_and_overlong_counts_keep_the_copying_forms_reading() \{\n",
+    "        let xs: Vec<i64> = (0..10).collect();\n",
+    "        for n in [-3i64, 0, 4, 10, 11, i64::MAX] \{\n",
+    "            let copying_skip = xs.iter().cloned().skip(n as usize).collect::<Vec<_>>();\n",
+    "            let copying_take = xs.iter().cloned().take(n as usize).collect::<Vec<_>>();\n",
+    "            assert_eq!(list_skip(&xs, n), copying_skip, \"skip \{\}\", n);\n",
+    "            assert_eq!(list_take(&xs, n), copying_take, \"take \{\}\", n);\n",
+    "        \}\n",
+    "    \}\n",
+    "\}\n",
+    "\n",
     "pub fn append<T: Clone>(list: Rc<Vec<T>>, item: T) -> Vec<T> {\n",
     "    let mut v = (*list).clone();\n",
     "    v.push_back(item);\n",
@@ -1303,7 +1415,201 @@ fn rust_runtime_source() -> String {
     rt_filesystem(),
     rt_checked_int_ops(),
     rt_realization_measurement(),
-    rt_accelerator_demo_kernel())
+    rt_accelerator_demo_kernel(),
+    rt_host_budget())
+}
+
+fn rt_host_budget() -> String {
+  concat(
+    "/// The one host-budget precedence. `read_host_budget_bytes` and\n",
+    "/// `memory_governor::resolve_host_budget` both call `resolve_host_budget_join`.\n",
+    "#[derive(Clone, Debug, PartialEq, Eq)]\n",
+    "pub enum HostBudgetJoinSource \{\n",
+    "    CgroupMemoryHigh \{ cgroup_dir: String \},\n",
+    "    CgroupMemoryMax \{ cgroup_dir: String \},\n",
+    "    CgroupV1HierarchicalMemoryLimit \{ cgroup_dir: String \},\n",
+    "    DarwinPhysicalMemory,\n",
+    "\}\n\n",
+    "impl HostBudgetJoinSource \{\n",
+    "    pub fn label(&self) -> String \{\n",
+    "        match self \{\n",
+    "            HostBudgetJoinSource::CgroupMemoryHigh \{ cgroup_dir \} => format!(\"cgroup memory.high (\{\})\", cgroup_dir),\n",
+    "            HostBudgetJoinSource::CgroupMemoryMax \{ cgroup_dir \} => format!(\"cgroup memory.max (\{\})\", cgroup_dir),\n",
+    "            HostBudgetJoinSource::CgroupV1HierarchicalMemoryLimit \{ cgroup_dir \} => format!(\"cgroup v1 memory.stat hierarchical_memory_limit (\{\})\", cgroup_dir),\n",
+    "            HostBudgetJoinSource::DarwinPhysicalMemory => \"sysctl hw.memsize\".to_string(),\n",
+    "        \}\n",
+    "    \}\n",
+    "\}\n\n",
+    "#[derive(Clone, Debug, PartialEq, Eq)]\n",
+    "pub enum HostBudgetJoin \{\n",
+    "    Resolved \{ effective_bytes: u64, requested_bytes: Option<u64>, source: HostBudgetJoinSource, observed_bytes: u64 \},\n",
+    "    DeclaredUnverified \{ requested_bytes: u64, reason: String \},\n",
+    "    Unreadable \{ reason: String \},\n",
+    "\}\n\n",
+    "impl HostBudgetJoin \{\n",
+    "    pub fn bytes(&self) -> Option<u64> \{\n",
+    "        match self \{\n",
+    "            HostBudgetJoin::Resolved \{ effective_bytes, .. \} => Some(*effective_bytes),\n",
+    "            HostBudgetJoin::DeclaredUnverified \{ requested_bytes, .. \} => Some(*requested_bytes),\n",
+    "            HostBudgetJoin::Unreadable \{ .. \} => None,\n",
+    "        \}\n",
+    "    \}\n",
+    "    pub fn label(&self) -> String \{\n",
+    "        match self \{\n",
+    "            HostBudgetJoin::Resolved \{ effective_bytes, requested_bytes, source, observed_bytes \} => match requested_bytes \{\n",
+    "                Some(requested) => format!(\"effective planning minimum \{\} bytes (env request \{\}; observed \{\}=\{\} bytes)\", effective_bytes, requested, source.label(), observed_bytes),\n",
+    "                None => source.label(),\n",
+    "            \},\n",
+    "            HostBudgetJoin::Unreadable \{ reason \} => format!(\"unreadable: \{\}\", reason),\n",
+    "            HostBudgetJoin::DeclaredUnverified \{ requested_bytes, reason \} => format!(\"declared-unverified: env GUNBC_MEMORY_BUDGET_BYTES=\{\}; \{\}\", requested_bytes, reason),\n",
+    "        \}\n",
+    "    \}\n",
+    "\}\n\n",
+    "pub fn resolve_host_budget_join(env_override: Option<u64>, cgroup_high: Option<(String, u64)>, cgroup_max: Option<(String, u64)>, cgroup_v1_limit: Option<(String, HostBudgetCgroupV1)>, darwin_physical: Option<u64>) -> HostBudgetJoin \{\n",
+    "    let cgroup_v1_limit = match cgroup_v1_limit \{\n",
+    "        Some((dir, HostBudgetCgroupV1::Unparseable(body))) => \{\n",
+    "            return HostBudgetJoin::Unreadable \{ reason: format!(\"cgroup v1 memory hierarchy at \{\} holds this process but its hierarchical_memory_limit is unreadable (\{\}); a bound that may be the tightest cannot be replaced by another reading\", dir, body) \};\n",
+    "        \}\n",
+    "        Some((dir, HostBudgetCgroupV1::Limited(bytes))) => Some((dir, bytes)),\n",
+    "        Some((_, HostBudgetCgroupV1::Unlimited)) | None => None,\n",
+    "    \};\n",
+    "    let observation = [\n",
+    "        cgroup_high.map(|(cgroup_dir, b)| (HostBudgetJoinSource::CgroupMemoryHigh \{ cgroup_dir \}, b)),\n",
+    "        cgroup_max.map(|(cgroup_dir, b)| (HostBudgetJoinSource::CgroupMemoryMax \{ cgroup_dir \}, b)),\n",
+    "        cgroup_v1_limit.map(|(cgroup_dir, b)| (HostBudgetJoinSource::CgroupV1HierarchicalMemoryLimit \{ cgroup_dir \}, b)),\n",
+    "    ].into_iter().flatten().fold(None::<(HostBudgetJoinSource, u64)>, |best, cand| match best \{ Some(cur) if cur.1 <= cand.1 => Some(cur), _ => Some(cand) \});\n",
+    "    if let Some((source, observed_bytes)) = observation \{\n",
+    "        return HostBudgetJoin::Resolved \{ effective_bytes: env_override.map(|requested| requested.min(observed_bytes)).unwrap_or(observed_bytes), requested_bytes: env_override, source, observed_bytes \};\n",
+    "    \}\n",
+    "    if let Some(bytes) = darwin_physical \{\n",
+    "        return HostBudgetJoin::Resolved \{ effective_bytes: env_override.map(|requested| requested.min(bytes)).unwrap_or(bytes), requested_bytes: env_override, source: HostBudgetJoinSource::DarwinPhysicalMemory, observed_bytes: bytes \};\n",
+    "    \}\n",
+    "    if let Some(requested_bytes) = env_override \{\n",
+    "        return HostBudgetJoin::DeclaredUnverified \{ requested_bytes, reason: \"no observed private memory.high, memory.max or v1 hierarchical_memory_limit verifies the executor allowance; the declaration is a planning request, not an enforced process limit\".to_string() \};\n",
+    "    \}\n",
+    "    HostBudgetJoin::Unreadable \{ reason: format!(\"no cgroup memory.high, memory.max or v1 hierarchical_memory_limit binds this process and GUNBC_MEMORY_BUDGET_BYTES cannot verify one (target_os=\{\}), so the planning allowance is UNKNOWN. Refusing rather than admitting against the widest signal available: a host-shared reading is a number about the MACHINE, not about this slot, and admitting against one is the rc=137 SIGKILL this arm exists to prevent (BuildBuddy receipt 2026-08-30, gunbc.host_budget_source host_budget_source_seed_mirror_disposition). The executor must expose an enforceable limit; GUNBC_MEMORY_BUDGET_BYTES may only request a lower planning ceiling.\", std::env::consts::OS) \}\n",
+    "\}\n\n",
+    "pub fn read_host_budget_bytes() -> (Option<u64>, String) \{\n",
+    "    let join = resolve_host_budget_join(\n",
+    "        std::env::var(\"GUNBC_MEMORY_BUDGET_BYTES\").ok().and_then(|s| s.trim().parse::<u64>().ok()),\n",
+    "        host_budget_tightest_cgroup(\"memory.high\"),\n",
+    "        host_budget_tightest_cgroup(\"memory.max\"),\n",
+    "        host_budget_cgroup_v1(),\n",
+    "        host_budget_darwin_physical(),\n",
+    "    );\n",
+    "    (join.bytes(), join.label())\n",
+    "\}\n\n",
+    "#[derive(Clone)]\n",
+    "pub enum HostBudgetCgroupV1 \{\n",
+    "    Limited(u64),\n",
+    "    Unlimited,\n",
+    "    Unparseable(String),\n",
+    "\}\n\n",
+    "pub fn host_budget_tightest_cgroup_under(self_cg: &str, root: &std::path::Path, limit_file: &str) -> Option<(String, u64)> \{\n",
+    "    let rel = self_cg\n",
+    "        .lines()\n",
+    "        .find_map(|l| l.strip_prefix(\"0::\"))\n",
+    "        .map(|p| p.trim().trim_start_matches('/').to_string())?;\n",
+    "    let mut dir = root.join(&rel);\n",
+    "    let mut best: Option<(u64, std::path::PathBuf)> = None;\n",
+    "    loop \{\n",
+    "        if let Ok(s) = std::fs::read_to_string(dir.join(limit_file)) \{\n",
+    "            let s = s.trim();\n",
+    "            if s != \"max\" \{\n",
+    "                if let Ok(v) = s.parse::<u64>() \{\n",
+    "                    let take = best.as_ref().map(|(cur, _)| v < *cur).unwrap_or(true);\n",
+    "                    if take \{\n",
+    "                        best = Some((v, dir.clone()));\n",
+    "                    \}\n",
+    "                \}\n",
+    "            \}\n",
+    "        \}\n",
+    "        if dir == root || !dir.pop() \{\n",
+    "            break;\n",
+    "        \}\n",
+    "    \}\n",
+    "    best.map(|(v, d)| (d.display().to_string(), v))\n",
+    "\}\n\n",
+    "pub fn host_budget_tightest_cgroup(limit_file: &str) -> Option<(String, u64)> \{\n",
+    "    let self_cg = std::fs::read_to_string(\"/proc/self/cgroup\").ok()?;\n",
+    "    host_budget_tightest_cgroup_under(&self_cg, std::path::Path::new(\"/sys/fs/cgroup\"), limit_file)\n",
+    "\}\n\n",
+    "pub fn host_budget_cgroup_v1_unlimited_bytes(page_size: u64) -> u64 \{\n",
+    "    (i64::MAX as u64 / page_size) * page_size\n",
+    "\}\n\n",
+    "pub fn host_budget_cgroup_v1() -> Option<(String, HostBudgetCgroupV1)> \{\n",
+    "    let self_cg = std::fs::read_to_string(\"/proc/self/cgroup\").ok()?;\n",
+    "    let mountinfo = std::fs::read_to_string(\"/proc/self/mountinfo\").ok()?;\n",
+    "    let page_size = unsafe \{ libc::sysconf(libc::_SC_PAGESIZE) \};\n",
+    "    if page_size <= 0 \{\n",
+    "        return Some((\n",
+    "            \"/proc/self/mountinfo\".to_string(),\n",
+    "            HostBudgetCgroupV1::Unparseable(\"sysconf(_SC_PAGESIZE) unreadable\".to_string()),\n",
+    "        ));\n",
+    "    \}\n",
+    "    host_budget_cgroup_v1_under(std::path::Path::new(\"/\"), &self_cg, &mountinfo, page_size as u64)\n",
+    "\}\n\n",
+    "pub fn host_budget_cgroup_v1_under(fs_root: &std::path::Path, self_cg: &str, mountinfo: &str, page_size: u64) -> Option<(String, HostBudgetCgroupV1)> \{\n",
+    "    let dir = host_budget_cgroup_v1_memory_dir(self_cg, mountinfo)?;\n",
+    "    let dir_path = std::path::Path::new(&dir);\n",
+    "    let joined = fs_root.join(dir_path.strip_prefix(\"/\").unwrap_or(dir_path));\n",
+    "    let value = match std::fs::read_to_string(joined.join(\"memory.stat\")) \{\n",
+    "        Ok(stat) => host_budget_cgroup_v1_from_stat(&stat, page_size),\n",
+    "        Err(e) => HostBudgetCgroupV1::Unparseable(format!(\"memory.stat: \{\}\", e)),\n",
+    "    \};\n",
+    "    Some((joined.display().to_string(), value))\n",
+    "\}\n\n",
+    "pub fn host_budget_cgroup_v1_memory_dir(self_cg: &str, mountinfo: &str) -> Option<String> \{\n",
+    "    let (mount_root, mount_point) = mountinfo.lines().find_map(|line| \{\n",
+    "        let fields: Vec<&str> = line.split(' ').collect();\n",
+    "        let dash = fields.iter().position(|f| *f == \"-\")?;\n",
+    "        let fstype = fields.get(dash + 1)?;\n",
+    "        let super_opts = fields.get(dash + 3)?;\n",
+    "        if *fstype == \"cgroup\" && super_opts.split(',').any(|o| o == \"memory\") \{\n",
+    "            Some((fields.get(3)?.to_string(), fields.get(4)?.to_string()))\n",
+    "        \} else \{\n",
+    "            None\n",
+    "        \}\n",
+    "    \})?;\n",
+    "    let path = self_cg.lines().find_map(|l| \{\n",
+    "        let mut parts = l.splitn(3, ':');\n",
+    "        let (_id, controllers, path) = (parts.next()?, parts.next()?, parts.next()?);\n",
+    "        controllers.split(',').any(|c| c == \"memory\").then(|| path.trim().to_string())\n",
+    "    \})?;\n",
+    "    let rel = if mount_root == \"/\" \{\n",
+    "        path.as_str()\n",
+    "    \} else \{\n",
+    "        let rest = path.strip_prefix(mount_root.as_str())?;\n",
+    "        if !(rest.is_empty() || rest.starts_with('/')) \{ return None; \}\n",
+    "        rest\n",
+    "    \};\n",
+    "    Some(std::path::Path::new(&mount_point).join(rel.trim_start_matches('/')).display().to_string())\n",
+    "\}\n\n",
+    "pub fn host_budget_cgroup_v1_from_stat(memory_stat: &str, page_size: u64) -> HostBudgetCgroupV1 \{\n",
+    "    let hits: std::vec::Vec<&str> = memory_stat.lines().filter_map(|l| l.trim().strip_prefix(\"hierarchical_memory_limit \")).collect();\n",
+    "    let [body] = hits.as_slice() else \{ return HostBudgetCgroupV1::Unparseable(memory_stat.to_string()); \};\n",
+    "    let unlimited = host_budget_cgroup_v1_unlimited_bytes(page_size);\n",
+    "    match body.trim().parse::<i128>() \{\n",
+    "        Ok(n) if n < 0 => HostBudgetCgroupV1::Unparseable(body.to_string()),\n",
+    "        Ok(n) if n >= unlimited as i128 => HostBudgetCgroupV1::Unlimited,\n",
+    "        Ok(n) => HostBudgetCgroupV1::Limited(n as u64),\n",
+    "        Err(_) => HostBudgetCgroupV1::Unparseable(body.to_string()),\n",
+    "    \}\n",
+    "\}\n\n",
+    "/// Darwin `hw.memsize` via `sysctlbyname`. Authority: `extdeps.darwin.sysctl` `HwMemsize`.\n",
+    "pub fn host_budget_darwin_physical() -> Option<u64> \{\n",
+    "    #[cfg(target_os = \"macos\")]\n",
+    "    \{\n",
+    "        let name = std::ffi::CStr::from_bytes_with_nul(b\"hw.memsize\\0\").ok()?;\n",
+    "        let mut value: u64 = 0;\n",
+    "        let mut len: libc::size_t = std::mem::size_of::<u64>() as libc::size_t;\n",
+    "        let rc = unsafe \{ libc::sysctlbyname(name.as_ptr(), (&mut value as *mut u64).cast::<libc::c_void>(), &mut len, std::ptr::null_mut(), 0) \};\n",
+    "        if rc == 0 && value > 0 \{ Some(value) \} else \{ None \}\n",
+    "    \}\n",
+    "    #[cfg(not(target_os = \"macos\"))]\n",
+    "    \{ None \}\n",
+    "\}\n"
+  )
 }
 
 fn rt_accelerator_demo_kernel() -> String {
diff --git a/src/v1/stage0/src/bin/auth_declared_but_unwired_witness.rs b/src/v1/stage0/src/bin/auth_declared_but_unwired_witness.rs
index f1c55bc9610..399cc0426dd 100644
--- a/src/v1/stage0/src/bin/auth_declared_but_unwired_witness.rs
+++ b/src/v1/stage0/src/bin/auth_declared_but_unwired_witness.rs
@@ -1,6 +1,5 @@
 #![allow(clippy::disallowed_macros)]
 
-use im::HashMap;
 use std::process::ExitCode;
 use std::rc::Rc;
 
@@ -8,8 +7,7 @@ use v1_compiler::cli_run::workspace_root;
 use v1_compiler::v1_compiler_compile::{compile_to_resolved, ResolvedPipelineResult, SourceFile};
 use v1_compiler::v1_interpreter::{self, AuthResolution, ExecutionMode, InterpError};
 
-type ModuleIndex = HashMap<String, std::path::PathBuf>;
-type WitnessCase = (&'static str, fn(&ModuleIndex));
+type WitnessCase = (&'static str, fn());
 
 const SERVICE_AUTH_BEARER_NO_SOURCE: &str = r#"module auth_unwired_t1
 
@@ -259,108 +257,23 @@ fn source_roots() -> [std::path::PathBuf; 2] {
     [ws.join("src/v1"), ws.join("dag")]
 }
 
-fn extract_module_declaration(path: &std::path::Path) -> Option<String> {
-    let content = std::fs::read_to_string(path).ok()?;
-    for line in content.lines() {
-        let trimmed = line.trim();
-        if trimmed.is_empty() || trimmed.starts_with("//") {
-            continue;
-        }
-        return trimmed
-            .strip_prefix("module ")
-            .and_then(|rest| rest.split_whitespace().next())
-            .filter(|s| !s.is_empty())
-            .map(|s| s.to_string());
-    }
-    None
-}
-
-fn scan_dag_files(dir: &std::path::Path, index: &mut ModuleIndex) {
-    let Ok(entries) = std::fs::read_dir(dir) else {
-        return;
-    };
-    for entry in entries.flatten() {
-        let path = entry.path();
-        if path.is_dir() {
-            scan_dag_files(&path, index);
-        } else if path.extension().map(|e| e == "dag").unwrap_or(false) {
-            if let Some(module_path) = extract_module_declaration(&path) {
-                index.insert(module_path, path);
-            }
-        }
-    }
-}
-
-fn build_module_index() -> ModuleIndex {
-    let mut index = HashMap::new();
-    for root in source_roots() {
-        if root.exists() {
-            scan_dag_files(&root, &mut index);
-        }
-    }
-    index
-}
-
-fn extract_imports(source: &str) -> Vec<String> {
-    let tokens = v1_compiler::v1_compiler_tokenize::tokenize(
-        source.to_string(),
-        "test.dag".to_string(),
-        v1_compiler::extdeps_languages_dag_syntax::dag_parse_environment(),
-    );
-    let source_index =
-        v1_compiler::v1_std_core::build_newline_index("test.dag".to_string(), source.to_string());
-    let mut source_indices = HashMap::new();
-    source_indices.insert("test.dag".to_string(), source_index);
-    let result = v1_compiler::v1_compiler_parse::parse(tokens, Rc::new(source_indices));
-    match &result.module {
-        Some(module) => v1_compiler::v1_std_core::module_imports(module.clone())
-            .iter()
-            .map(|imp| imp.name.clone())
-            .collect(),
-        None => vec![],
-    }
+fn pool_root_strings() -> Vec<String> {
+    source_roots()
+        .iter()
+        .map(|p| p.to_string_lossy().into_owned())
+        .collect()
 }
 
-fn resolve_imports_transitively(
-    entry_path: &str,
-    entry_content: &str,
-    module_index: &ModuleIndex,
-) -> Vec<Rc<SourceFile>> {
-    let ws = workspace_root();
-    let mut seen: HashMap<String, Rc<SourceFile>> = HashMap::new();
-    let mut queue = vec![(entry_path.to_string(), entry_content.to_string())];
-
-    while let Some((_path, content)) = queue.pop() {
-        for module_path in extract_imports(&content) {
-            if seen.contains_key(&module_path) {
-                continue;
-            }
-            if let Some(file_path) = module_index.get(&module_path) {
-                if let Ok(file_content) = std::fs::read_to_string(file_path) {
-                    let rel_path = file_path
-                        .strip_prefix(&ws)
-                        .unwrap_or(file_path)
-                        .to_string_lossy()
-                        .to_string();
-                    seen.insert(
-                        module_path.clone(),
-                        Rc::new(SourceFile {
-                            path: rel_path.clone(),
-                            content: file_content.clone(),
-                        }),
-                    );
-                    queue.push((rel_path, file_content));
-                }
-            }
-        }
-    }
-
-    let mut sources: Vec<Rc<SourceFile>> = seen.into_iter().map(|(_, v)| v).collect();
-    sources.push(Rc::new(SourceFile {
-        path: entry_path.to_string(),
-        content: entry_content.to_string(),
-    }));
-    sources
+/// Compile-subject closure of a witness entry. Not an import-line BFS.
+fn resolve_imports_transitively(entry_path: &str, entry_content: &str) -> Vec<Rc<SourceFile>> {
+    v1_compiler::cli_run::resolve_seeded_compile_closure(
+        vec![Rc::new(SourceFile {
+            path: entry_path.to_string(),
+            content: entry_content.to_string(),
+        })],
+        &pool_root_strings(),
+    )
+    .unwrap_or_else(|e| panic!("witness compile-subject closure: {e}"))
 }
 
 // A hard error is what the diagnostic disposition authority says blocks the interpreter;
@@ -381,15 +294,15 @@ fn assert_resolved_no_hard_errors(result: &ResolvedPipelineResult) {
     );
 }
 
-fn resolve(module_index: &ModuleIndex, src: &str) -> Rc<ResolvedPipelineResult> {
-    let sources = resolve_imports_transitively("test.dag", src, module_index);
+fn resolve(src: &str) -> Rc<ResolvedPipelineResult> {
+    let sources = resolve_imports_transitively("test.dag", src);
     let resolved = compile_to_resolved(Rc::new(sources.into()));
     assert_resolved_no_hard_errors(&resolved);
     resolved
 }
 
-fn auth_declared_no_source_fails_closed_pre_send(module_index: &ModuleIndex) {
-    let resolved = resolve(module_index, SERVICE_AUTH_BEARER_NO_SOURCE);
+fn auth_declared_no_source_fails_closed_pre_send() {
+    let resolved = resolve(SERVICE_AUTH_BEARER_NO_SOURCE);
     let graph = resolved.graph.as_ref().expect("graph");
     let ctx = v1_interpreter::InterpContext::new(
         graph,
@@ -410,8 +323,8 @@ fn auth_declared_no_source_fails_closed_pre_send(module_index: &ModuleIndex) {
     }
 }
 
-fn endpoint_by_reference_resolves_to_its_value(module_index: &ModuleIndex) {
-    let resolved = resolve(module_index, SERVICE_ENDPOINT_BY_REFERENCE);
+fn endpoint_by_reference_resolves_to_its_value() {
+    let resolved = resolve(SERVICE_ENDPOINT_BY_REFERENCE);
     let graph = resolved.graph.as_ref().expect("graph");
     let ctx = v1_interpreter::InterpContext::new(
         graph,
@@ -435,8 +348,8 @@ fn endpoint_by_reference_resolves_to_its_value(module_index: &ModuleIndex) {
     }
 }
 
-fn endpoint_resolving_empty_refuses(module_index: &ModuleIndex) {
-    let resolved = resolve(module_index, SERVICE_ENDPOINT_RESOLVES_EMPTY);
+fn endpoint_resolving_empty_refuses() {
+    let resolved = resolve(SERVICE_ENDPOINT_RESOLVES_EMPTY);
     let graph = resolved.graph.as_ref().expect("graph");
     let ctx = v1_interpreter::InterpContext::new(
         graph,
@@ -461,8 +374,8 @@ fn endpoint_resolving_empty_refuses(module_index: &ModuleIndex) {
     }
 }
 
-fn endpoint_resolving_non_string_refuses(module_index: &ModuleIndex) {
-    let resolved = resolve(module_index, SERVICE_ENDPOINT_RESOLVES_NON_STRING);
+fn endpoint_resolving_non_string_refuses() {
+    let resolved = resolve(SERVICE_ENDPOINT_RESOLVES_NON_STRING);
     let graph = resolved.graph.as_ref().expect("graph");
     let ctx = v1_interpreter::InterpContext::new(
         graph,
@@ -488,8 +401,8 @@ fn endpoint_resolving_non_string_refuses(module_index: &ModuleIndex) {
     }
 }
 
-fn endpoint_absent_refuses(module_index: &ModuleIndex) {
-    let resolved = resolve(module_index, SERVICE_ENDPOINT_ABSENT);
+fn endpoint_absent_refuses() {
+    let resolved = resolve(SERVICE_ENDPOINT_ABSENT);
     let graph = resolved.graph.as_ref().expect("graph");
     let ctx = v1_interpreter::InterpContext::new(
         graph,
@@ -514,8 +427,8 @@ fn endpoint_absent_refuses(module_index: &ModuleIndex) {
     }
 }
 
-fn auth_input_empty_fails_closed_pre_send(module_index: &ModuleIndex) {
-    let resolved = resolve(module_index, SERVICE_AUTH_INPUT_NOT_PROVIDED);
+fn auth_input_empty_fails_closed_pre_send() {
+    let resolved = resolve(SERVICE_AUTH_INPUT_NOT_PROVIDED);
     let graph = resolved.graph.as_ref().expect("graph");
     let ctx = v1_interpreter::InterpContext::new(
         graph,
@@ -528,8 +441,8 @@ fn auth_input_empty_fails_closed_pre_send(module_index: &ModuleIndex) {
     }
 }
 
-fn no_auth_declared_does_not_fire_guard(module_index: &ModuleIndex) {
-    let resolved = resolve(module_index, SERVICE_NO_AUTH);
+fn no_auth_declared_does_not_fire_guard() {
+    let resolved = resolve(SERVICE_NO_AUTH);
     let graph = resolved.graph.as_ref().expect("graph");
     let ctx = v1_interpreter::InterpContext::new(
         graph,
@@ -546,14 +459,14 @@ fn no_auth_declared_does_not_fire_guard(module_index: &ModuleIndex) {
     }
 }
 
-fn resolve_auth_three_way_split_matches_dispatch_behavior(module_index: &ModuleIndex) {
+fn resolve_auth_three_way_split_matches_dispatch_behavior() {
     let cases: &[(&str, &str, bool)] = &[
         ("Bearer + no source", SERVICE_AUTH_BEARER_NO_SOURCE, true),
         ("auth_input empty", SERVICE_AUTH_INPUT_NOT_PROVIDED, true),
         ("no auth declared", SERVICE_NO_AUTH, false),
     ];
     for (label, src, expect_unwired) in cases {
-        let resolved = resolve(module_index, src);
+        let resolved = resolve(src);
         let graph = resolved.graph.as_ref().expect("graph");
         let ctx = v1_interpreter::InterpContext::new(
             graph,
@@ -571,10 +484,10 @@ fn resolve_auth_three_way_split_matches_dispatch_behavior(module_index: &ModuleI
 
 // Regression guard: dual-declare (auth_input + auth_source), api_key empty but env var present →
 // must fall through to auth_source and NOT raise AuthDeclaredButUnwired.
-fn dual_declare_env_var_fallback_resolves_when_input_empty(module_index: &ModuleIndex) {
+fn dual_declare_env_var_fallback_resolves_when_input_empty() {
     // Set a synthetic env var the service fixture reads.
     std::env::set_var("TEST_AUTH_GUARD_DUAL_FALLBACK_VAR", "test-token-sentinel");
-    let resolved = resolve(module_index, SERVICE_DUAL_DECLARE);
+    let resolved = resolve(SERVICE_DUAL_DECLARE);
     let graph = resolved.graph.as_ref().expect("graph");
     let ctx = v1_interpreter::InterpContext::new(
         graph,
@@ -594,9 +507,9 @@ fn dual_declare_env_var_fallback_resolves_when_input_empty(module_index: &Module
 }
 
 // Dual-declare, api_key empty AND env var absent → guard must still fire (fail-closed).
-fn dual_declare_both_empty_fails_closed(module_index: &ModuleIndex) {
+fn dual_declare_both_empty_fails_closed() {
     std::env::remove_var("TEST_AUTH_GUARD_DUAL_FALLBACK_VAR");
-    let resolved = resolve(module_index, SERVICE_DUAL_DECLARE);
+    let resolved = resolve(SERVICE_DUAL_DECLARE);
     let graph = resolved.graph.as_ref().expect("graph");
     let ctx = v1_interpreter::InterpContext::new(
         graph,
@@ -614,7 +527,7 @@ fn dual_declare_both_empty_fails_closed(module_index: &ModuleIndex) {
 
 // Pub-API smoke: confirms the 3 variants are reachable from outside v1_compiler.
 // Execution discrimination lives in the wet-dispatch tests above.
-fn auth_resolution_enum_is_pub_and_discriminable(_module_index: &ModuleIndex) {
+fn auth_resolution_enum_is_pub_and_discriminable() {
     let _ = AuthResolution::NoAuthDeclared;
     let _ = AuthResolution::Resolved {
         header: "Authorization".to_string(),
@@ -626,8 +539,6 @@ fn auth_resolution_enum_is_pub_and_discriminable(_module_index: &ModuleIndex) {
 }
 
 fn main() -> ExitCode {
-    let module_index = build_module_index();
-
     let tests: Vec<WitnessCase> = vec![
         (
             "auth_declared_no_source_fails_closed_pre_send",
@@ -673,8 +584,7 @@ fn main() -> ExitCode {
     ];
 
     for (name, test) in tests {
-        let index = module_index.clone();
-        let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| test(&index)));
+        let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(test));
         if result.is_err() {
             return fail(format!("{name} panicked"));
         }
diff --git a/src/v1/stage0/src/bin/bootstrap_witness.rs b/src/v1/stage0/src/bin/bootstrap_witness.rs
index a67982f4aec..b8d69b613bc 100644
--- a/src/v1/stage0/src/bin/bootstrap_witness.rs
+++ b/src/v1/stage0/src/bin/bootstrap_witness.rs
@@ -1,6 +1,5 @@
 #![allow(clippy::disallowed_macros)]
 
-use im::HashMap;
 use std::process::ExitCode;
 use std::rc::Rc;
 
@@ -53,127 +52,23 @@ where
     cold.output().expect("failed to spawn cargo cold retry")
 }
 
-fn tokenize_for_parse(source: &str) -> Rc<im::Vector<Rc<v1_compiler::v1_std_core::Token>>> {
-    v1_compiler::v1_compiler_tokenize::tokenize(
-        source.to_string(),
-        "test.dag".to_string(),
-        v1_compiler::extdeps_languages_dag_syntax::dag_parse_environment(),
-    )
-}
-
-fn parse_source(source: &str) -> Rc<v1_compiler::v1_compiler_parse::ParseResult> {
-    let tokens = tokenize_for_parse(source);
-    let source_index =
-        v1_compiler::v1_std_core::build_newline_index("test.dag".to_string(), source.to_string());
-    let mut source_indices = HashMap::new();
-    source_indices.insert("test.dag".to_string(), source_index);
-    v1_compiler::v1_compiler_parse::parse(tokens, Rc::new(source_indices))
-}
-
-fn build_module_index_for_roots(
-    roots: &[std::path::PathBuf],
-) -> HashMap<String, std::path::PathBuf> {
-    let mut index = HashMap::new();
-    for root in roots {
-        if root.exists() {
-            scan_dag_files(root, &mut index);
-        }
-    }
-    index
-}
-
-fn build_module_index() -> HashMap<String, std::path::PathBuf> {
-    build_module_index_for_roots(&source_roots())
-}
-
-fn scan_dag_files(dir: &std::path::Path, index: &mut HashMap<String, std::path::PathBuf>) {
-    let Ok(entries) = std::fs::read_dir(dir) else {
-        return;
-    };
-    for entry in entries.flatten() {
-        let path = entry.path();
-        if path.is_dir() {
-            scan_dag_files(&path, index);
-        } else if path.extension().map(|e| e == "dag").unwrap_or(false) {
-            if let Some(module_path) = extract_module_declaration(&path) {
-                index.insert(module_path, path);
-            }
-        }
-    }
-}
-
-fn extract_module_declaration(path: &std::path::Path) -> Option<String> {
-    let content = std::fs::read_to_string(path).ok()?;
-    for line in content.lines() {
-        let trimmed = line.trim();
-        if trimmed.is_empty() || trimmed.starts_with("//") {
-            continue;
-        }
-        return trimmed
-            .strip_prefix("module ")
-            .and_then(|rest| rest.split_whitespace().next())
-            .filter(|s| !s.is_empty())
-            .map(|s| s.to_string());
-    }
-    None
-}
-
-fn extract_imports(source: &str) -> Vec<String> {
-    let result = parse_source(source);
-    match &result.module {
-        Some(module) => v1_compiler::v1_std_core::module_imports(module.clone())
-            .iter()
-            .map(|imp| imp.name.clone())
-            .collect(),
-        None => vec![],
-    }
-}
-
-fn resolve_imports_transitively_with_index(
-    entry_path: &str,
-    entry_content: &str,
-    module_index: &HashMap<String, std::path::PathBuf>,
-) -> Vec<Rc<SourceFile>> {
-    let ws = workspace_root();
-    let mut seen: HashMap<String, Rc<SourceFile>> = HashMap::new();
-    let mut queue: Vec<(String, String)> = Vec::new();
-
-    queue.push((entry_path.to_string(), entry_content.to_string()));
-
-    while let Some((_path, content)) = queue.pop() {
-        let imports = extract_imports(&content);
-        for module_path in imports {
-            if seen.contains_key(&module_path) {
-                continue;
-            }
-            if let Some(file_path) = module_index.get(&module_path) {
-                if let Ok(file_content) = std::fs::read_to_string(file_path) {
-                    let rel_path = file_path
-                        .strip_prefix(&ws)
-                        .unwrap_or(file_path)
-                        .to_string_lossy()
-                        .to_string();
-                    let source = Rc::new(SourceFile {
-                        path: rel_path.clone(),
-                        content: file_content.clone(),
-                    });
-                    seen.insert(module_path.clone(), source);
-                    queue.push((rel_path, file_content));
-                }
-            }
-        }
-    }
-
-    let mut sources: Vec<Rc<SourceFile>> = seen.into_iter().map(|(_, v)| v).collect();
-    sources.push(Rc::new(SourceFile {
-        path: entry_path.to_string(),
-        content: entry_content.to_string(),
-    }));
-    sources
+fn pool_root_strings() -> Vec<String> {
+    source_roots()
+        .iter()
+        .map(|p| p.to_string_lossy().into_owned())
+        .collect()
 }
 
+/// Compile-subject closure of a witness entry. Not an import-line BFS.
 fn resolve_imports_transitively(entry_path: &str, entry_content: &str) -> Vec<Rc<SourceFile>> {
-    resolve_imports_transitively_with_index(entry_path, entry_content, &build_module_index())
+    v1_compiler::cli_run::resolve_seeded_compile_closure(
+        vec![Rc::new(SourceFile {
+            path: entry_path.to_string(),
+            content: entry_content.to_string(),
+        })],
+        &pool_root_strings(),
+    )
+    .unwrap_or_else(|e| panic!("witness compile-subject closure: {e}"))
 }
 
 fn compile_dag_named(filename: &str, source: &str, target: RenderTarget) -> Rc<PipelineResult> {
diff --git a/src/v1/stage0/src/bin/diagnostics_witness.rs b/src/v1/stage0/src/bin/diagnostics_witness.rs
index 4ea5d568a58..2a538b679c1 100644
--- a/src/v1/stage0/src/bin/diagnostics_witness.rs
+++ b/src/v1/stage0/src/bin/diagnostics_witness.rs
@@ -18,8 +18,7 @@ use v1_compiler::v1_std_core::{
     CompilerDiagnostic, ErrorNode,
 };
 
-type ModuleIndex = HashMap<String, std::path::PathBuf>;
-type WitnessCase = (&'static str, fn(&ModuleIndex));
+type WitnessCase = (&'static str, fn());
 
 const SUITE_IMPORT_RESOLUTION: &str = "import_resolution";
 const SUITE_REEXPORT_SURFACE: &str = "reexport_surface";
@@ -39,114 +38,37 @@ fn source_roots() -> [std::path::PathBuf; 2] {
     [ws.join("src/v1"), ws.join("dag")]
 }
 
-fn extract_module_declaration(path: &std::path::Path) -> Option<String> {
-    let content = std::fs::read_to_string(path).ok()?;
-    for line in content.lines() {
-        let trimmed = line.trim();
-        if trimmed.is_empty() || trimmed.starts_with("//") {
-            continue;
-        }
-        return trimmed
-            .strip_prefix("module ")
-            .and_then(|rest| rest.split_whitespace().next())
-            .filter(|s| !s.is_empty())
-            .map(|s| s.to_string());
-    }
-    None
-}
-
-fn scan_dag_files(dir: &std::path::Path, index: &mut ModuleIndex) {
-    let Ok(entries) = std::fs::read_dir(dir) else {
-        return;
-    };
-    for entry in entries.flatten() {
-        let path = entry.path();
-        if path.is_dir() {
-            scan_dag_files(&path, index);
-        } else if path.extension().map(|e| e == "dag").unwrap_or(false) {
-            if let Some(module_path) = extract_module_declaration(&path) {
-                index.insert(module_path, path);
-            }
-        }
-    }
-}
-
-fn build_module_index() -> ModuleIndex {
-    let mut index = HashMap::new();
-    for root in source_roots() {
-        if root.exists() {
-            scan_dag_files(&root, &mut index);
-        }
-    }
-    index
-}
-
-fn extract_imports(source: &str) -> Vec<String> {
-    let tokens = v1_compiler::v1_compiler_tokenize::tokenize(
-        source.to_string(),
-        "test.dag".to_string(),
-        v1_compiler::extdeps_languages_dag_syntax::dag_parse_environment(),
-    );
-    let source_index =
-        v1_compiler::v1_std_core::build_newline_index("test.dag".to_string(), source.to_string());
-    let mut source_indices = HashMap::new();
-    source_indices.insert("test.dag".to_string(), source_index);
-    let result = v1_compiler::v1_compiler_parse::parse(tokens, Rc::new(source_indices));
-    match &result.module {
-        Some(module) => v1_compiler::v1_std_core::module_imports(module.clone())
-            .iter()
-            .map(|imp| imp.name.clone())
-            .collect(),
-        None => vec![],
-    }
+fn pool_root_strings() -> Vec<String> {
+    source_roots()
+        .iter()
+        .map(|p| p.to_string_lossy().into_owned())
+        .collect()
 }
 
-fn resolve_imports_transitively(
+/// Compile-subject closure of a witness entry. Not an import-line BFS.
+fn resolve_over_roots(
     entry_path: &str,
     entry_content: &str,
-    module_index: &ModuleIndex,
+    pool_roots: &[String],
 ) -> Vec<Rc<SourceFile>> {
-    let ws = workspace_root();
-    let mut seen: HashMap<String, Rc<SourceFile>> = HashMap::new();
-    let mut queue = vec![(entry_path.to_string(), entry_content.to_string())];
-
-    while let Some((_path, content)) = queue.pop() {
-        for module_path in extract_imports(&content) {
-            if seen.contains_key(&module_path) {
-                continue;
-            }
-            if let Some(file_path) = module_index.get(&module_path) {
-                if let Ok(file_content) = std::fs::read_to_string(file_path) {
-                    let rel_path = file_path
-                        .strip_prefix(&ws)
-                        .unwrap_or(file_path)
-                        .to_string_lossy()
-                        .to_string();
-                    seen.insert(
-                        module_path.clone(),
-                        Rc::new(SourceFile {
-                            path: rel_path.clone(),
-                            content: file_content.clone(),
-                        }),
-                    );
-                    queue.push((rel_path, file_content));
-                }
-            }
-        }
-    }
+    v1_compiler::cli_run::resolve_seeded_compile_closure(
+        vec![Rc::new(SourceFile {
+            path: entry_path.to_string(),
+            content: entry_content.to_string(),
+        })],
+        pool_roots,
+    )
+    .unwrap_or_else(|e| panic!("witness compile-subject closure: {e}"))
+}
 
-    let mut sources: Vec<Rc<SourceFile>> = seen.into_iter().map(|(_, v)| v).collect();
-    sources.push(Rc::new(SourceFile {
-        path: entry_path.to_string(),
-        content: entry_content.to_string(),
-    }));
-    sources
+fn resolve_imports_transitively(entry_path: &str, entry_content: &str) -> Vec<Rc<SourceFile>> {
+    resolve_over_roots(entry_path, entry_content, &pool_root_strings())
 }
 
-fn compile_multi(module_index: &ModuleIndex, files: &[(&str, &str)]) -> Rc<PipelineResult> {
+fn compile_multi(files: &[(&str, &str)]) -> Rc<PipelineResult> {
     let mut all_sources: HashMap<String, Rc<SourceFile>> = HashMap::new();
     for (path, content) in files {
-        let resolved = resolve_imports_transitively(path, content, module_index);
+        let resolved = resolve_imports_transitively(path, content);
         for src in resolved {
             all_sources.entry(src.path.clone()).or_insert(src);
         }
@@ -170,7 +92,7 @@ fn type_mismatch_count(result: &PipelineResult) -> usize {
         .count()
 }
 
-fn establishment_report(module_index: &ModuleIndex) {
+fn establishment_report() {
     let probes: &[(&str, &str, &str)] = &[
         (
             "distinct_record_at_arg",
@@ -229,7 +151,7 @@ fn establishment_report(module_index: &ModuleIndex) {
         ),
     ];
     for (label, path, source) in probes {
-        let result = compile_multi(module_index, &[(path, source)]);
+        let result = compile_multi(&[(path, source)]);
         eprintln!(
             "establishment {label}: type_mismatch={} total_diags={}",
             type_mismatch_count(&result),
@@ -265,13 +187,11 @@ fn first_arity_mismatch_message(result: &PipelineResult) -> Option<String> {
 
 /// Golden: MissingExport names export/module/importer and span points at the missing name.
 /// Also covers UnresolvedImport variant + grounded message.
-fn import_resolution_variants_and_span(module_index: &ModuleIndex) {
+fn import_resolution_variants_and_span() {
     let provider = "module provider\ntype User { name: String }\n";
     let missing_export = "module consumer\nimport provider { NonExistent }\n";
-    let missing_result = compile_multi(
-        module_index,
-        &[("provider.dag", provider), ("consumer.dag", missing_export)],
-    );
+    let missing_result =
+        compile_multi(&[("provider.dag", provider), ("consumer.dag", missing_export)]);
     assert_eq!(missing_result.diagnostics.len(), 1);
     let missing = &missing_result.diagnostics[0];
     assert!(
@@ -303,7 +223,7 @@ fn import_resolution_variants_and_span(module_index: &ModuleIndex) {
     );
 
     let unresolved = "module consumer\nimport nonexistent { Thing }\n";
-    let unresolved_result = compile_multi(module_index, &[("consumer.dag", unresolved)]);
+    let unresolved_result = compile_multi(&[("consumer.dag", unresolved)]);
     assert!(
         !unresolved_result.diagnostics.is_empty(),
         "expected UnresolvedImport diagnostic"
@@ -323,7 +243,7 @@ fn import_resolution_variants_and_span(module_index: &ModuleIndex) {
 }
 
 /// Golden: variant not re-exported through a type-only import surface.
-fn reexport_surface_missing_variant(module_index: &ModuleIndex) {
+fn reexport_surface_missing_variant() {
     let files = &[
         ("def.dag", "module self_gen8_def\ntype E = A | B\n"),
         (
@@ -335,7 +255,7 @@ fn reexport_surface_missing_variant(module_index: &ModuleIndex) {
             "module self_gen8_use\nimport self_gen8_proxy { B }\n",
         ),
     ];
-    let result = compile_multi(module_index, files);
+    let result = compile_multi(files);
     assert_eq!(result.diagnostics.len(), 1);
     let d = &result.diagnostics[0];
     assert!(
@@ -350,9 +270,9 @@ fn reexport_surface_missing_variant(module_index: &ModuleIndex) {
 
 /// Golden: UnresolvedType names the unknown type; ArityMismatch fires on bare containers
 /// but not on parameterized std containers or user-defined types.
-fn type_and_arity_discrimination(module_index: &ModuleIndex) {
+fn type_and_arity_discrimination() {
     let unresolved_source = "module types\ntype Wrapper { inner: Bogus }\n";
-    let unresolved_result = compile_multi(module_index, &[("types.dag", unresolved_source)]);
+    let unresolved_result = compile_multi(&[("types.dag", unresolved_source)]);
     let unresolved: Vec<_> = unresolved_result
         .diagnostics
         .iter()
@@ -367,7 +287,7 @@ fn type_and_arity_discrimination(module_index: &ModuleIndex) {
     assert!(unresolved_msg.contains("Bogus"), "{unresolved_msg}");
 
     let bare = "module bare\nimport std.types { List }\ntype Foo { items: List }\n";
-    let bare_result = compile_multi(module_index, &[("bare.dag", bare)]);
+    let bare_result = compile_multi(&[("bare.dag", bare)]);
     assert!(
         has_arity_mismatch(&bare_result),
         "bare List should trigger ArityMismatch, got: {:?}",
@@ -377,7 +297,7 @@ fn type_and_arity_discrimination(module_index: &ModuleIndex) {
     assert!(bare_msg.contains("List"), "ArityMismatch should name List");
 
     let parameterized = "module param\nimport std.types { List }\ntype Foo { items: List<Int> }\n";
-    let parameterized_result = compile_multi(module_index, &[("param.dag", parameterized)]);
+    let parameterized_result = compile_multi(&[("param.dag", parameterized)]);
     assert!(
         !has_arity_mismatch(&parameterized_result),
         "parameterized List<Int> should not trigger ArityMismatch, got: {:?}",
@@ -385,7 +305,7 @@ fn type_and_arity_discrimination(module_index: &ModuleIndex) {
     );
 
     let user_defined = "module custom\ntype Widget { label: String }\ntype Bag { item: Widget }\n";
-    let user_defined_result = compile_multi(module_index, &[("custom.dag", user_defined)]);
+    let user_defined_result = compile_multi(&[("custom.dag", user_defined)]);
     assert!(
         !has_arity_mismatch(&user_defined_result),
         "user-defined type should not trigger ArityMismatch, got: {:?}",
@@ -394,9 +314,9 @@ fn type_and_arity_discrimination(module_index: &ModuleIndex) {
 }
 
 /// Golden: empty list literal fails without collection context; succeeds with List<T> context.
-fn empty_list_literal_context(module_index: &ModuleIndex) {
+fn empty_list_literal_context() {
     let wrong = "module elist\nfn make_stuff() -> String {\n  []\n}\n";
-    let wrong_result = compile_multi(module_index, &[("elist.dag", wrong)]);
+    let wrong_result = compile_multi(&[("elist.dag", wrong)]);
     let wrong_diags: Vec<_> = wrong_result
         .diagnostics
         .iter()
@@ -418,7 +338,7 @@ fn empty_list_literal_context(module_index: &ModuleIndex) {
 
     let ok =
         "module elist_ok\nimport std.types { List }\nfn make_list() -> List<String> {\n  []\n}\n";
-    let ok_result = compile_multi(module_index, &[("elist_ok.dag", ok)]);
+    let ok_result = compile_multi(&[("elist_ok.dag", ok)]);
     let ok_diags: Vec<_> = ok_result
         .diagnostics
         .iter()
@@ -444,13 +364,13 @@ fn empty_list_literal_context(module_index: &ModuleIndex) {
 /// deleted expected-type pick) must now raise VariantCollision. RED control:
 /// an unbound constructor literal must raise UnresolvedType. GREEN control:
 /// a sole-owner arm constructs clean.
-fn constructor_owner_ruling_walls(module_index: &ModuleIndex) {
+fn constructor_owner_ruling_walls() {
     let collided = "module test.claim.variant_owner_expected_type\n\
         import std.logic { Bool }\n\
         type AEarlyOwner = SharedVariant | AOnlyVariant\n\
         type ZLaterOwner = SharedVariant | ZOnlyVariant\n\
         fn make_z_variant() -> ZLaterOwner { SharedVariant }\n";
-    let collided_result = compile_multi(module_index, &[("variant_owner.dag", collided)]);
+    let collided_result = compile_multi(&[("variant_owner.dag", collided)]);
     assert!(
         collided_result.diagnostics.iter().any(|d| matches!(
             &*d.diagnostic,
@@ -462,7 +382,7 @@ fn constructor_owner_ruling_walls(module_index: &ModuleIndex) {
 
     let unbound = "module test.claim.unbound_ctor\n\
         fn mk() -> Int { let g = GhostArm { x: 1 } 2 }\n";
-    let unbound_result = compile_multi(module_index, &[("unbound_ctor.dag", unbound)]);
+    let unbound_result = compile_multi(&[("unbound_ctor.dag", unbound)]);
     assert!(
         unbound_result.diagnostics.iter().any(|d| matches!(
             &*d.diagnostic,
@@ -475,7 +395,7 @@ fn constructor_owner_ruling_walls(module_index: &ModuleIndex) {
     let sole = "module test.claim.sole_owner\n\
         type OnlyOwner = SoleArm | OtherArm\n\
         fn mk() -> OnlyOwner { SoleArm }\n";
-    let sole_result = compile_multi(module_index, &[("sole_owner.dag", sole)]);
+    let sole_result = compile_multi(&[("sole_owner.dag", sole)]);
     let sole_hard: Vec<String> = diagnostic_messages(&sole_result)
         .into_iter()
         .filter(|m| !m.starts_with("complexity: "))
@@ -526,13 +446,13 @@ fn suite_cases(suite: &str) -> Result<Vec<WitnessCase>, String> {
 /// value cannot fill a differently-named declared formal (TypeMismatch) — in record
 /// fields and direct call args alike. Greens pin the sanctioned skips: optional
 /// fields and dag_can_cast pairs (Int->Float).
-fn record_literal_field_walls(module_index: &ModuleIndex) {
+fn record_literal_field_walls() {
     // RED: omitted required field on a record literal
     let missing = "module fieldwall_missing\n\
         type Ev = EvA | EvB { n: Int, m: Int }\n\
         type Prov { id: String, ev: Ev }\n\
         data p: Prov = Prov { id: \"x\" }\n";
-    let missing_result = compile_multi(module_index, &[("fieldwall_missing.dag", missing)]);
+    let missing_result = compile_multi(&[("fieldwall_missing.dag", missing)]);
     let missing_diags: Vec<_> = missing_result
         .diagnostics
         .iter()
@@ -551,7 +471,7 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
     let variant_missing = "module fieldwall_variant\n\
         type Ev = EvA | EvB { n: Int, m: Int }\n\
         data v: Ev = EvB { n: 1 }\n";
-    let variant_result = compile_multi(module_index, &[("fieldwall_variant.dag", variant_missing)]);
+    let variant_result = compile_multi(&[("fieldwall_variant.dag", variant_missing)]);
     let variant_diags: Vec<_> = variant_result
         .diagnostics
         .iter()
@@ -568,7 +488,7 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
         type Ev = EvA | EvB { n: Int, m: Int }\n\
         type Prov { id: String, ev: Ev }\n\
         data q: Prov = Prov { id: \"x\", ev: 42 }\n";
-    let wrong_result = compile_multi(module_index, &[("fieldwall_wrongtype.dag", wrong_typed)]);
+    let wrong_result = compile_multi(&[("fieldwall_wrongtype.dag", wrong_typed)]);
     let wrong_diags: Vec<_> = wrong_result
         .diagnostics
         .iter()
@@ -584,7 +504,7 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
     let kernel_kernel = "module fieldwall_kernel\n\
         type Prov2 { id: String }\n\
         data k: Prov2 = Prov2 { id: 7 }\n";
-    let kernel_result = compile_multi(module_index, &[("fieldwall_kernel.dag", kernel_kernel)]);
+    let kernel_result = compile_multi(&[("fieldwall_kernel.dag", kernel_kernel)]);
     assert!(
         kernel_result
             .diagnostics
@@ -600,8 +520,7 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
         type Box { label: String }\n\
         fn takes_node(n: Node) -> Bool { true }\n\
         fn bad_node_arg() -> Bool { takes_node(n: Box { label: \"x\" }) }\n";
-    let node_arg_result =
-        compile_multi(module_index, &[("fieldwall_node_arg.dag", record_at_node)]);
+    let node_arg_result = compile_multi(&[("fieldwall_node_arg.dag", record_at_node)]);
     assert!(
         node_arg_result
             .diagnostics
@@ -617,10 +536,7 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
         type Box { label: String }\n\
         type Prov { id: String, ev: Ev }\n\
         data r: Prov = Prov { id: \"x\", ev: Box { label: \"y\" } }\n";
-    let record_union_result = compile_multi(
-        module_index,
-        &[("fieldwall_record_at_union.dag", record_at_union)],
-    );
+    let record_union_result = compile_multi(&[("fieldwall_record_at_union.dag", record_at_union)]);
     assert!(
         record_union_result
             .diagnostics
@@ -636,10 +552,7 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
         type Other = OtherA | OtherB { k: Int }\n\
         type Prov { id: String, ev: Ev }\n\
         data w: Prov = Prov { id: \"x\", ev: OtherA { k: 1 } }\n";
-    let wrong_variant_result = compile_multi(
-        module_index,
-        &[("fieldwall_wrong_variant.dag", wrong_variant)],
-    );
+    let wrong_variant_result = compile_multi(&[("fieldwall_wrong_variant.dag", wrong_variant)]);
     assert!(
         wrong_variant_result
             .diagnostics
@@ -660,13 +573,10 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
           dissolves_to: Terminal { reason: \"phantom-mechanism\" },\n\
           bind: \"anchor\",\n\
         }\n";
-    let missing_variant_mechanism_result = compile_multi(
-        module_index,
-        &[(
-            "fieldwall_missing_variant_mechanism.dag",
-            missing_variant_mechanism,
-        )],
-    );
+    let missing_variant_mechanism_result = compile_multi(&[(
+        "fieldwall_missing_variant_mechanism.dag",
+        missing_variant_mechanism,
+    )]);
     assert!(
         missing_variant_mechanism_result
             .diagnostics
@@ -686,13 +596,10 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
           dissolves_to: SingleAuthority,\n\
           bind: \"anchor\",\n\
         }\n";
-    let missing_variant_mechanism_green_result = compile_multi(
-        module_index,
-        &[(
-            "fieldwall_missing_variant_mechanism_green.dag",
-            missing_variant_mechanism_green,
-        )],
-    );
+    let missing_variant_mechanism_green_result = compile_multi(&[(
+        "fieldwall_missing_variant_mechanism_green.dag",
+        missing_variant_mechanism_green,
+    )]);
     assert!(
         !missing_variant_mechanism_green_result
             .diagnostics
@@ -707,7 +614,7 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
         type Ev = EvA | EvB { n: Int, m: Int }\n\
         fn wants(e: Ev) -> Int { 7 }\n\
         fn call_bad() -> Int { wants(e: 9) }\n";
-    let call_result = compile_multi(module_index, &[("fieldwall_callarg.dag", call_arg)]);
+    let call_result = compile_multi(&[("fieldwall_callarg.dag", call_arg)]);
     assert!(
         call_result
             .diagnostics
@@ -722,7 +629,7 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
         type Ev = EvA | EvB { n: Int, m: Int }\n\
         type Prov { id: String, ev: Ev }\n\
         data g: Prov = Prov { id: \"x\", ev: EvA }\n";
-    let complete_result = compile_multi(module_index, &[("fieldwall_green.dag", complete)]);
+    let complete_result = compile_multi(&[("fieldwall_green.dag", complete)]);
     assert!(
         !complete_result.diagnostics.iter().any(|d| matches!(
             &*d.diagnostic,
@@ -737,13 +644,10 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
         type Payload { n: Int }\n\
         type Holder { value: Payload? }\n\
         data h: Holder = Holder { value: Present { value: Payload { n: 1 } } }\n";
-    let optional_wrapper_green_result = compile_multi(
-        module_index,
-        &[(
-            "fieldwall_optional_wrapper_green.dag",
-            optional_wrapper_green,
-        )],
-    );
+    let optional_wrapper_green_result = compile_multi(&[(
+        "fieldwall_optional_wrapper_green.dag",
+        optional_wrapper_green,
+    )]);
     assert!(
         !optional_wrapper_green_result
             .diagnostics
@@ -764,10 +668,8 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
             }\n\
           }\n\
         }\n";
-    let optional_wrapper_red_result = compile_multi(
-        module_index,
-        &[("fieldwall_optional_wrapper_red.dag", optional_wrapper_red)],
-    );
+    let optional_wrapper_red_result =
+        compile_multi(&[("fieldwall_optional_wrapper_red.dag", optional_wrapper_red)]);
     assert!(
         optional_wrapper_red_result
             .diagnostics
@@ -781,7 +683,7 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
     let optional = "module fieldwall_opt\n\
         type Opt { a: Int, b: Int? }\n\
         data o: Opt = Opt { a: 1 }\n";
-    let optional_result = compile_multi(module_index, &[("fieldwall_opt.dag", optional)]);
+    let optional_result = compile_multi(&[("fieldwall_opt.dag", optional)]);
     assert!(
         !optional_result
             .diagnostics
@@ -795,7 +697,7 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
     let cast_ok = "module fieldwall_cast\n\
         type Fl { x: Float }\n\
         data f: Fl = Fl { x: 3 }\n";
-    let cast_result = compile_multi(module_index, &[("fieldwall_cast.dag", cast_ok)]);
+    let cast_result = compile_multi(&[("fieldwall_cast.dag", cast_ok)]);
     assert!(
         !cast_result
             .diagnostics
@@ -806,10 +708,9 @@ fn record_literal_field_walls(module_index: &ModuleIndex) {
     );
 }
 
-fn run_suite(module_index: &ModuleIndex, suite: &str) -> Result<(), String> {
+fn run_suite(suite: &str) -> Result<(), String> {
     for (name, test) in suite_cases(suite)? {
-        let index = module_index.clone();
-        if std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| test(&index))).is_err() {
+        if std::panic::catch_unwind(std::panic::AssertUnwindSafe(test)).is_err() {
             return Err(format!("{name} panicked"));
         }
     }
@@ -823,8 +724,7 @@ fn main() -> ExitCode {
         return fail("usage: diagnostics_witness <suite>");
     }
 
-    let module_index = build_module_index();
-    match run_suite(&module_index, suite) {
+    match run_suite(suite) {
         Ok(()) => ExitCode::SUCCESS,
         Err(msg) => fail(msg),
     }
diff --git a/src/v1/stage0/src/bin/infer_semantics_witness.rs b/src/v1/stage0/src/bin/infer_semantics_witness.rs
index e0e79713b8a..30cf3619e0a 100644
--- a/src/v1/stage0/src/bin/infer_semantics_witness.rs
+++ b/src/v1/stage0/src/bin/infer_semantics_witness.rs
@@ -4,7 +4,6 @@ use im::HashMap;
 use im::{vector as vec, Vector as Vec};
 use std::process::ExitCode;
 use std::rc::Rc;
-use v1_compiler::v1_rt::VecCompat;
 
 use v1_compiler::cli_run::workspace_root;
 use v1_compiler::std_induction::SubValueRelation;
@@ -45,119 +44,33 @@ fn source_roots() -> [std::path::PathBuf; 2] {
     [ws.join("src/v1"), ws.join("dag")]
 }
 
-fn extract_module_declaration(path: &std::path::Path) -> Option<String> {
-    let content = std::fs::read_to_string(path).ok()?;
-    for line in content.lines() {
-        let trimmed = line.trim();
-        if trimmed.is_empty() || trimmed.starts_with("//") {
-            continue;
-        }
-        return trimmed
-            .strip_prefix("module ")
-            .and_then(|rest| rest.split_whitespace().next())
-            .filter(|s| !s.is_empty())
-            .map(|s| s.to_string());
-    }
-    None
-}
-
-fn scan_dag_files(dir: &std::path::Path, index: &mut HashMap<String, std::path::PathBuf>) {
-    let Ok(entries) = std::fs::read_dir(dir) else {
-        return;
-    };
-    for entry in entries.flatten() {
-        let path = entry.path();
-        if path.is_dir() {
-            scan_dag_files(&path, index);
-        } else if path.extension().map(|e| e == "dag").unwrap_or(false) {
-            if let Some(module_path) = extract_module_declaration(&path) {
-                index.insert(module_path, path);
-            }
-        }
-    }
-}
-
-fn build_module_index() -> HashMap<String, std::path::PathBuf> {
-    let mut index = HashMap::new();
-    for root in source_roots() {
-        if root.exists() {
-            scan_dag_files(&root, &mut index);
-        }
-    }
-    index
-}
-
-fn extract_imports(source: &str) -> Vec<String> {
-    let tokens = v1_compiler::v1_compiler_tokenize::tokenize(
-        source.to_string(),
-        "test.dag".to_string(),
-        v1_compiler::extdeps_languages_dag_syntax::dag_parse_environment(),
-    );
-    let source_index =
-        v1_compiler::v1_std_core::build_newline_index("test.dag".to_string(), source.to_string());
-    let mut source_indices = HashMap::new();
-    source_indices.insert("test.dag".to_string(), source_index);
-    let result = v1_compiler::v1_compiler_parse::parse(tokens, Rc::new(source_indices));
-    match &result.module {
-        Some(module) => v1_compiler::v1_std_core::module_imports(module.clone())
-            .iter()
-            .map(|imp| imp.name.clone())
-            .collect(),
-        None => vec![],
-    }
+fn pool_root_strings() -> std::vec::Vec<String> {
+    source_roots()
+        .iter()
+        .map(|p| p.to_string_lossy().into_owned())
+        .collect()
 }
 
-fn resolve_imports_transitively(
-    entry_path: &str,
-    entry_content: &str,
-    module_index: &HashMap<String, std::path::PathBuf>,
-) -> Vec<Rc<SourceFile>> {
-    let ws = workspace_root();
-    let mut seen: HashMap<String, Rc<SourceFile>> = HashMap::new();
-    let mut queue = vec![(entry_path.to_string(), entry_content.to_string())];
-
-    while let Some((_path, content)) = queue.pop_back() {
-        for module_path in extract_imports(&content) {
-            if seen.contains_key(&module_path) {
-                continue;
-            }
-            if let Some(file_path) = module_index.get(&module_path) {
-                if let Ok(file_content) = std::fs::read_to_string(file_path) {
-                    let rel_path = file_path
-                        .strip_prefix(&ws)
-                        .unwrap_or(file_path)
-                        .to_string_lossy()
-                        .to_string();
-                    seen.insert(
-                        module_path.clone(),
-                        Rc::new(SourceFile {
-                            path: rel_path.clone(),
-                            content: file_content.clone(),
-                        }),
-                    );
-                    queue.push((rel_path, file_content));
-                }
-            }
-        }
-    }
-
-    let mut sources: Vec<Rc<SourceFile>> = seen.into_iter().map(|(_, v)| v).collect();
-    sources.push(Rc::new(SourceFile {
-        path: entry_path.to_string(),
-        content: entry_content.to_string(),
-    }));
-    sources
+/// Compile-subject closure of a witness entry. Not an import-line BFS.
+fn resolve_imports_transitively(entry_path: &str, entry_content: &str) -> Vec<Rc<SourceFile>> {
+    v1_compiler::cli_run::resolve_seeded_compile_closure(
+        std::vec![Rc::new(SourceFile {
+            path: entry_path.to_string(),
+            content: entry_content.to_string(),
+        })],
+        &pool_root_strings(),
+    )
+    .unwrap_or_else(|e| panic!("witness compile-subject closure: {e}"))
+    .into()
 }
 
 fn compile_dag(source: &str) -> Rc<PipelineResult> {
-    let module_index = build_module_index();
-    let sources = resolve_imports_transitively("test.dag", source, &module_index);
+    let sources = resolve_imports_transitively("test.dag", source);
     compile_sources(Rc::new(sources), RenderTarget::Rust)
 }
 
 fn compile_dag_resolved(source: &str) -> Rc<ResolvedPipelineResult> {
-    let module_index = build_module_index();
-    let sources = resolve_imports_transitively("test.dag", source, &module_index);
+    let sources = resolve_imports_transitively("test.dag", source);
     compile_to_resolved(Rc::new(sources))
 }
 
diff --git a/src/v1/stage0/src/cli_run.rs b/src/v1/stage0/src/cli_run.rs
index e8fd87d1520..15ca7bf578c 100644
--- a/src/v1/stage0/src/cli_run.rs
+++ b/src/v1/stage0/src/cli_run.rs
@@ -50,7 +50,7 @@ use crate::module_path_index::{
 };
 use crate::std_node::compiler_recursive_types;
 use crate::std_syntax::LiteralValue;
-use crate::std_types::{kernel_type_set, SourceSpan};
+use crate::std_types::{is_kernel_type, kernel_type_set, SourceSpan};
 use crate::v1_compiler_compile;
 use crate::v1_compiler_infer;
 use crate::v1_compiler_infer_env::{
@@ -77,9 +77,9 @@ use crate::v1_std_core::{
     has_child_named, inferred_to_node, intern, is_error_diagnostic,
     is_interpreter_blocking_diagnostic, let_binding_name_at, let_value, make_error_node,
     match_arm_nodes, match_scrutinee, method_arg_nodes, method_receiver, module_items, no_span,
-    param_node_name_at, param_node_type_expr, Cardinality, CompilerDiagnostic, Connective,
-    ErrorNode, ExprData, ExprErrorKind, InferredNode, InternTable, LeafOwner, MatchPattern,
-    NewlineIndex, Node,
+    param_node_name_at, param_node_type_expr, type_reference_identity, Cardinality,
+    CompilerDiagnostic, Connective, ErrorNode, ExprData, ExprErrorKind, InferredNode, InternTable,
+    LeafOwner, MatchPattern, NewlineIndex, Node, TypeDeclarationProvenance, TypeReferenceIdentity,
 };
 use serde::Serialize;
 
@@ -101,6 +101,7 @@ pub mod rostered_row_join;
 pub mod scope_rank_view;
 mod serve_budget_refusal;
 pub use emitted_crate_workspace_host::{run_emitted_crate_workspace, EmittedCrateWorkspaceHeld};
+pub use emitted_crate_workspace_host::{write_emitted_workspace, EmittedWorkspace};
 pub use native_lane_runner::{
     emitted_build_not_clean_cause, run_native_claim_program, run_native_serve_program,
     run_required_v2_native, run_self_host, run_type_declaration_use_census_runs,
@@ -329,19 +330,16 @@ pub(crate) fn is_cargo_target_output_dir(
 
 pub(crate) fn collect_dag_files_result(
     dir: &std::path::Path,
-    files: &mut Vec<std::path::PathBuf>,
+    files: &mut Vec<derived_row_roster::AcquiredDag>,
 ) -> Result<(), String> {
-    derived_row_roster::ensure_if_row_dir(dir).map_err(|e| {
-        format!(
-            "failed to derive recurring_failure_mode roster in {:?}: {}",
-            dir, e
-        )
-    })?;
     let mut entries: Vec<_> = std::fs::read_dir(dir)
         .map_err(|e| format!("failed to read dir {:?}: {}", dir, e))?
         .map(|e| e.map_err(|e| format!("failed to read dir entry in {:?}: {}", dir, e)))
         .collect::<Result<Vec<_>, String>>()?;
     entries.sort_by_key(|e| e.file_name());
+    // This directory's own `.dag` files are admitted as one listing, so a ledger row directory
+    // contributes its derived roster from the same bytes (`derived_row_roster::acquire_dir_files`).
+    let mut here = Vec::new();
     for entry in entries {
         let path = entry.path();
         if path.is_dir() {
@@ -350,13 +348,14 @@ pub(crate) fn collect_dag_files_result(
             }
             collect_dag_files_result(&path, files)?;
         } else if path.extension().map(|e| e == "dag").unwrap_or(false) {
-            files.push(path);
+            here.push(path);
         }
     }
+    files.extend(derived_row_roster::acquire_dir_files(dir, here)?);
     Ok(())
 }
 
-fn collect_dag_files(dir: &std::path::Path, files: &mut Vec<std::path::PathBuf>) {
+fn collect_dag_files(dir: &std::path::Path, files: &mut Vec<derived_row_roster::AcquiredDag>) {
     collect_dag_files_result(dir, files).unwrap_or_else(|e| panic!("{e}"));
 }
 
@@ -405,8 +404,9 @@ fn moduleless_dag_entry_paths_under_root(root_prefix: &str) -> Result<Vec<String
         format!("cannot walk {root_prefix} while taking the module-less population: {cause}")
     })?;
     let mut entry_files: Vec<(String, String)> = Vec::new();
-    for path in paths {
-        let content = std::fs::read_to_string(&path).map_err(|error| {
+    for source in paths {
+        let path = source.path();
+        let content = source.read().map_err(|error| {
             format!(
                 "cannot read {} while taking the module-less population under {root_prefix}: \
                  {error} (the population exists to report which files were dropped from the \
@@ -3239,16 +3239,52 @@ mod process_workspace_root_tests {
 /// fixture spellings. Witness: `dag/test/claim/cli_run_repo_grant_hand_rust_equivalence_witness_test.dag`.
 #[cfg(test)]
 mod cli_run_arg_channel_tests {
-    use super::parse_run_args;
-    use crate::v1_interpreter::Value;
+    use super::{
+        bind_run_arg_specs_against_admissions, bind_run_args_for_entry, parse_run_arg_specs,
+        CliArgAdmission,
+    };
+    use crate::v1_compiler_compile::{compile_to_resolved, SourceFile};
+    use crate::v1_interpreter::{run_in_context_with_args, ExecutionMode, InterpContext, Value};
+    use std::rc::Rc;
 
     fn spec(items: &[&str]) -> Vec<String> {
         items.iter().map(|s| s.to_string()).collect()
     }
 
+    fn admission(label: &str) -> CliArgAdmission {
+        match label {
+            "String" => CliArgAdmission::String,
+            "Int" => CliArgAdmission::Int,
+            "Bool" => CliArgAdmission::Bool,
+            "NonEmptyStr" => CliArgAdmission::RefinedString {
+                display: "NonEmptyStr".to_string(),
+                predicates: vec!["string_non_empty".to_string()],
+            },
+            other => CliArgAdmission::Unsupported {
+                display: other.to_string(),
+            },
+        }
+    }
+
+    fn declared(pairs: &[(&str, &str)]) -> Vec<(String, CliArgAdmission)> {
+        pairs
+            .iter()
+            .map(|(n, t)| (n.to_string(), admission(t)))
+            .collect()
+    }
+
+    fn bind(
+        function: &str,
+        declared: &[(String, CliArgAdmission)],
+        specs: &[(String, String)],
+    ) -> Result<Vec<(Option<String>, Value)>, String> {
+        bind_run_arg_specs_against_admissions(function, declared, specs)
+    }
+
     #[test]
     fn named_arg_parses_to_a_named_string_value() {
-        let got = parse_run_args(&spec(&["node_id=roadmap-7"])).expect("well-formed --arg");
+        let specs = parse_run_arg_specs(&spec(&["node_id=roadmap-7"])).expect("well-formed --arg");
+        let got = bind("entry", &declared(&[("node_id", "String")]), &specs).expect("String bind");
         assert_eq!(got.len(), 1);
         assert_eq!(got[0].0.as_deref(), Some("node_id"));
         assert!(matches!(&got[0].1, Value::Str(s) if s.as_ref() == "roadmap-7"));
@@ -3256,13 +3292,16 @@ mod cli_run_arg_channel_tests {
 
     #[test]
     fn value_may_contain_further_equals_signs() {
-        let got = parse_run_args(&spec(&["diff=a=b=c"])).expect("split on the first `=` only");
+        let specs =
+            parse_run_arg_specs(&spec(&["diff=a=b=c"])).expect("split on the first `=` only");
+        let got = bind("entry", &declared(&[("diff", "String")]), &specs).expect("String bind");
         assert!(matches!(&got[0].1, Value::Str(s) if s.as_ref() == "a=b=c"));
     }
 
     #[test]
     fn empty_value_is_admitted_and_distinct_from_absent() {
-        let got = parse_run_args(&spec(&["flag="])).expect("empty value is a value");
+        let specs = parse_run_arg_specs(&spec(&["flag="])).expect("empty value is a value");
+        let got = bind("entry", &declared(&[("flag", "String")]), &specs).expect("String bind");
         assert!(matches!(&got[0].1, Value::Str(s) if s.is_empty()));
     }
 
@@ -3271,7 +3310,7 @@ mod cli_run_arg_channel_tests {
     // into one.
     #[test]
     fn bare_token_without_equals_refuses() {
-        let err = parse_run_args(&spec(&["node_id"])).expect_err("no `=` must refuse");
+        let err = parse_run_arg_specs(&spec(&["node_id"])).expect_err("no `=` must refuse");
         assert!(
             err.contains("name=value"),
             "diagnostic names the form: {err}"
@@ -3280,7 +3319,7 @@ mod cli_run_arg_channel_tests {
 
     #[test]
     fn empty_parameter_name_refuses() {
-        let err = parse_run_args(&spec(&["=orphan"])).expect_err("empty name must refuse");
+        let err = parse_run_arg_specs(&spec(&["=orphan"])).expect_err("empty name must refuse");
         assert!(
             err.contains("empty parameter name"),
             "diagnostic locates the fault: {err}"
@@ -3290,10 +3329,275 @@ mod cli_run_arg_channel_tests {
     #[test]
     fn one_malformed_spec_refuses_the_whole_list() {
         assert!(
-            parse_run_args(&spec(&["ok=1", "broken", "also_ok=2"])).is_err(),
+            parse_run_arg_specs(&spec(&["ok=1", "broken", "also_ok=2"])).is_err(),
             "a partial parse would silently drop a caller's argument"
         );
     }
+
+    #[test]
+    fn int_parameter_given_non_numeric_refuses() {
+        let err = bind(
+            "belt_scm_corrective_integrate_cli",
+            &declared(&[("supersedes", "Int")]),
+            &[("supersedes".into(), "stale".into())],
+        )
+        .expect_err("non-numeric Int must refuse");
+        assert!(
+            err.contains("supersedes") && err.contains("Int") && err.contains("stale"),
+            "diagnostic names parameter, type, and value: {err}"
+        );
+    }
+
+    #[test]
+    fn int_parameter_given_decimal_two_is_int_two() {
+        let got = bind(
+            "belt_scm_corrective_integrate_cli",
+            &declared(&[("supersedes", "Int")]),
+            &[("supersedes".into(), "2".into())],
+        )
+        .expect("decimal Int");
+        assert!(
+            matches!(got[0].1, Value::Int(2)),
+            "specimen: `--arg supersedes=2` must inhabit Int 2, not Str(\"2\")"
+        );
+    }
+
+    #[test]
+    fn unsupported_declared_type_refuses() {
+        let err = bind(
+            "entry",
+            &declared(&[("source", "List<String>")]),
+            &[("source".into(), "a".into())],
+        )
+        .expect_err("unsupported type must refuse");
+        assert!(
+            err.contains("List<String>") && err.contains("cannot inhabit"),
+            "diagnostic names the unsupported type: {err}"
+        );
+    }
+
+    #[test]
+    fn qualified_or_branded_int_label_refuses_rather_than_matching_the_leaf() {
+        for label in ["foo.Int", "std.integer.Int"] {
+            let err = bind(
+                "entry",
+                &declared(&[("source", label)]),
+                &[("source".into(), "2".into())],
+            )
+            .expect_err("leaf-name agreement must not inhabit a different type");
+            assert!(
+                err.contains(label) && err.contains("cannot inhabit"),
+                "diagnostic names the authored type {label}: {err}"
+            );
+        }
+    }
+
+    #[test]
+    fn nonemptystr_non_empty_binds_as_string() {
+        let got = bind(
+            "fci1_assert_checkpoint_token",
+            &declared(&[("token", "NonEmptyStr")]),
+            &[("token".into(), "none".into())],
+        )
+        .expect("non-empty NonEmptyStr inhabits");
+        assert!(matches!(&got[0].1, Value::Str(s) if s.as_ref() == "none"));
+    }
+
+    #[test]
+    fn nonemptystr_empty_refuses_naming_the_parameter() {
+        let err = bind(
+            "fci1_assert_checkpoint_token",
+            &declared(&[("token", "NonEmptyStr")]),
+            &[("token".into(), "".into())],
+        )
+        .expect_err("empty NonEmptyStr must refuse");
+        assert!(
+            err.contains("token")
+                && err.contains("NonEmptyStr")
+                && err.contains("string_non_empty"),
+            "diagnostic names parameter, type, and admission: {err}"
+        );
+    }
+
+    #[test]
+    fn bool_parameter_accepts_true_false_only() {
+        let got = bind(
+            "entry",
+            &declared(&[("flag", "Bool")]),
+            &[("flag".into(), "true".into())],
+        )
+        .expect("Bool true");
+        assert!(matches!(got[0].1, Value::Bool(true)));
+        let err = bind(
+            "entry",
+            &declared(&[("flag", "Bool")]),
+            &[("flag".into(), "yes".into())],
+        )
+        .expect_err("non-canonical Bool must refuse");
+        assert!(err.contains("true") && err.contains("false"), "{err}");
+    }
+
+    fn compile_ctx(files: Vec<Rc<SourceFile>>) -> InterpContext {
+        let result = compile_to_resolved(Rc::new(files.into()));
+        let graph = result
+            .graph
+            .as_ref()
+            .unwrap_or_else(|| panic!("fixture must resolve: {:?}", result.diagnostics));
+        InterpContext::new(
+            graph,
+            result.source_indices.clone(),
+            ExecutionMode::Hermetic,
+        )
+    }
+
+    fn source(path: &str, content: &str) -> Rc<SourceFile> {
+        Rc::new(SourceFile {
+            path: path.to_string(),
+            content: content.to_string(),
+        })
+    }
+
+    fn kernel_int_entry_ctx() -> InterpContext {
+        compile_ctx(vec![source(
+            "probe_cli_arg_int.dag",
+            "module probe.cli_arg_int\nfn bind_probe(n: Int) -> Int { n }\n",
+        )])
+    }
+
+    fn std_types_nonempty_entry_ctx() -> InterpContext {
+        compile_ctx(vec![
+            source(
+                "std_types.dag",
+                "module std.types\n\
+                 type NonEmptyStr = String where string_non_empty\n\
+                 fn string_non_empty(value: String) -> Bool { value.length() > 0 }\n",
+            ),
+            source(
+                "probe_cli_arg_nes.dag",
+                "module probe.cli_arg_nes\n\
+                 import std.types { NonEmptyStr }\n\
+                 fn bind_token(token: NonEmptyStr) -> String { token }\n",
+            ),
+        ])
+    }
+
+    #[test]
+    fn bind_run_args_for_entry_int_executes_as_int_two() {
+        let ctx = kernel_int_entry_ctx();
+        let bound =
+            bind_run_args_for_entry(&ctx, "bind_probe", &[("n".to_string(), "2".to_string())])
+                .expect("kernel Int --arg n=2 must bind");
+        let got = run_in_context_with_args(&ctx, "bind_probe", &bound, false)
+            .expect("bound Int 2 must execute");
+        assert!(
+            matches!(got, Value::Int(2)),
+            "specimen: execute bind_probe after --arg n=2 must yield Int 2, got {got:?}"
+        );
+    }
+
+    #[test]
+    fn bind_run_args_for_entry_std_types_nonemptystr_inhabits_and_empty_refuses() {
+        let ctx = std_types_nonempty_entry_ctx();
+        let got = bind_run_args_for_entry(
+            &ctx,
+            "bind_token",
+            &[("token".to_string(), "none".to_string())],
+        )
+        .expect("std.types NonEmptyStr must inhabit through its declaration");
+        assert!(matches!(&got[0].1, Value::Str(s) if s.as_ref() == "none"));
+        let err =
+            bind_run_args_for_entry(&ctx, "bind_token", &[("token".to_string(), "".to_string())])
+                .expect_err("empty std.types NonEmptyStr must refuse");
+        assert!(
+            err.contains("token")
+                && err.contains("NonEmptyStr")
+                && err.contains("string_non_empty"),
+            "diagnostic names parameter, std.types alias, and declared predicate: {err}"
+        );
+    }
+
+    #[test]
+    fn isolated_std_types_nonemptystr_whose_string_is_int_refuses() {
+        let ctx = compile_ctx(vec![source(
+            "std_types.dag",
+            "module std.types\n\
+             type String = Int\n\
+             fn string_non_empty(value: String) -> Bool { true }\n\
+             type NonEmptyStr = String where string_non_empty\n\
+             fn bind_probe(n: NonEmptyStr) -> Int { n }\n",
+        )]);
+        let err = bind_run_args_for_entry(
+            &ctx,
+            "bind_probe",
+            &[("n".to_string(), "2".to_string())],
+        )
+        .expect_err(
+            "std.types NonEmptyStr whose ground is not kernel String must refuse, not Str(\"2\")",
+        );
+        assert!(
+            err.contains("cannot inhabit"),
+            "isolated std.types with type String = Int must refuse inhabitance: {err}"
+        );
+    }
+
+    #[test]
+    fn same_spelling_user_int_or_nonemptystr_refuses() {
+        let int_ctx = compile_ctx(vec![source(
+            "probe_shadow_int.dag",
+            "module probe.shadow_int\n\
+             type Int = String\n\
+             fn shadow_int(n: Int) -> String { n }\n",
+        )]);
+        let int_err = bind_run_args_for_entry(
+            &int_ctx,
+            "shadow_int",
+            &[("n".to_string(), "2".to_string())],
+        )
+        .expect_err("a user type spelled Int must not bind as kernel Int");
+        assert!(
+            int_err.contains("cannot inhabit"),
+            "user Int must refuse inhabitance: {int_err}"
+        );
+
+        let nes_ctx = compile_ctx(vec![source(
+            "probe_shadow_nes.dag",
+            "module probe.shadow_nes\n\
+             type NonEmptyStr = String where string_non_empty\n\
+             fn shadow_nes(token: NonEmptyStr) -> String { token }\n",
+        )]);
+        let nes_err = bind_run_args_for_entry(
+            &nes_ctx,
+            "shadow_nes",
+            &[("token".to_string(), "none".to_string())],
+        )
+        .expect_err("a user type spelled NonEmptyStr must not bind as std.types");
+        assert!(
+            nes_err.contains("cannot inhabit"),
+            "user NonEmptyStr must refuse inhabitance: {nes_err}"
+        );
+    }
+
+    #[test]
+    fn bind_run_args_for_entry_duplicate_or_unknown_name_refuses() {
+        let ctx = kernel_int_entry_ctx();
+        let dup = bind_run_args_for_entry(
+            &ctx,
+            "bind_probe",
+            &[
+                ("n".to_string(), "1".to_string()),
+                ("n".to_string(), "2".to_string()),
+            ],
+        )
+        .expect_err("duplicate --arg name must refuse on the production loop");
+        assert!(dup.contains("more than once"), "{dup}");
+        let unknown =
+            bind_run_args_for_entry(&ctx, "bind_probe", &[("nope".to_string(), "1".to_string())])
+                .expect_err("unknown --arg name must refuse on the production loop");
+        assert!(
+            unknown.contains("nope") && unknown.contains("declared:"),
+            "{unknown}"
+        );
+    }
 }
 
 #[cfg(test)]
@@ -3511,14 +3815,15 @@ fn for_each_parsed_module_binding(
         let root_path = Path::new(&anchored_root);
         let mut dag_files = Vec::new();
         collect_dag_files(root_path, &mut dag_files);
-        for path in dag_files {
-            let content = std::fs::read_to_string(&path).unwrap_or_else(|e| {
+        for source in dag_files {
+            let path = source.path();
+            let content = source.read().unwrap_or_else(|e| {
                 panic!(
                     "for_each_parsed_module_binding: failed to read {:?}: {}",
                     path, e
                 )
             });
-            let binding = match parse_module_binding(&path, &content) {
+            let binding = match parse_module_binding(path, &content) {
                 Ok(ModuleBindingOutcome::Bound(binding)) => binding,
                 Ok(ModuleBindingOutcome::ModuleBindingUnclassified) => continue,
                 // Fail-closed, but the line stops with a TYPED, LOCATED refusal
@@ -3531,7 +3836,7 @@ fn for_each_parsed_module_binding(
                     continue;
                 }
             };
-            visit(root_idx, &path, binding);
+            visit(root_idx, path, binding);
         }
     }
     refuse_unparseable_module_sources(&refusals);
@@ -3607,29 +3912,29 @@ fn collect_module_binding_manifest_rows(source_roots: &[String]) -> Vec<ModuleBi
     rows
 }
 
-/// The closure an in-memory (not-on-disk) fixture entry compiles against: the corpus modules its
-/// authored `import` lines name, read from the workspace through `module_index`, CLOSED BY THE
-/// ONE CLOSURE AUTHORITY (`extend_sources_to_both_closure_fixpoint`), then the entry itself.
-///
-/// WHY NOT THE IMPORT EDGES ALONE (DESIGN §3, §6b). This walker used to stop at `import` lines,
-/// a fourth closure rule beside the one the gate, the witness loader and regen share. An `import`
-/// line, a qualified reference and a bare reference are the same dependency edge, so the
-/// import-only walk was not a narrower closure but a blind one: `std.syllogism` reaches
-/// `std.graph` by the bare name `GraphEdge` and `v2.std.artifact` reaches `v2.std.refinement` by
-/// qualified reference, so a fixture whose imports reached either compiled it WITHOUT its
-/// provider and reported `unresolved type` / `undefined variable 'v2'` against a module that
-/// resolves in every closure the corpus authority builds. #13195's union render made that
-/// fork refuse the floor (46 such diagnostics on #13420's run, none in its own modules).
-///
-/// The extension is seeded from the corpus modules only. The entry is the fixture's subject,
-/// authored with an explicit import manifest a witness may be probing (an unlisted use, a
-/// refused import), so its own spelling stays exactly what it declares; every module it reaches
-/// is closed as the corpus closes it. An extension failure is returned, never widened past.
-pub(crate) fn resolve_virtual_source_with_imports(
-    entry_path: &str,
+/// Scratch index for one fixture-closure extension. Same `source_files` as the process-shared
+/// slot; own caches, dropped with the loader. Reads fall through to the shared slot; writes stay
+/// on the scratch (MegaRAC rows never land on the fold's index and do not outlive the compile).
+/// parse_cache is not underlaid: those rows are intern-paired with the slot that parsed them.
+/// RFM `fixture_compile_retained_on_the_process_shared_index`.
+fn scratch_index_for_fixture_closure_extension() -> Result<MultiEntryIndex, String> {
+    let layers = witness_layer_roots();
+    let shared = entry_resolve::try_process_shared_index(&layers)?;
+    let scratch = entry_resolve::new_multi_entry_index_scratch_over(
+        shared.source_files.clone(),
+        &shared.source_roots,
+    );
+    *scratch.scratch_underlay.borrow_mut() = Some(shared);
+    Ok(scratch)
+}
+
+/// Authored-import seeds of an in-memory fixture: the corpus modules its `import` lines name,
+/// read through `module_index`. The both-closure fixpoint is applied by the caller on a chosen
+/// index, so GREEN (scratch) and RED (process-shared) differ only by that index.
+fn fixture_imported_corpus_sources(
     entry_content: &str,
     module_index: &HashMap<String, String>,
-) -> Result<Vec<Rc<v1_compiler_compile::SourceFile>>, String> {
+) -> Vec<Rc<v1_compiler_compile::SourceFile>> {
     let ws = process_workspace_root();
     let mut seen: HashMap<String, Rc<v1_compiler_compile::SourceFile>> = HashMap::new();
     let mut queue: Vec<String> = vec![entry_content.to_string()];
@@ -3653,28 +3958,80 @@ pub(crate) fn resolve_virtual_source_with_imports(
             }
         }
     }
-    let imported: Vec<Rc<v1_compiler_compile::SourceFile>> =
-        seen.into_iter().map(|(_, v)| v).collect();
+    seen.into_iter().map(|(_, v)| v).collect()
+}
+
+fn close_fixture_imported_corpus(
+    imported: Vec<Rc<v1_compiler_compile::SourceFile>>,
+    index: &MultiEntryIndex,
+) -> Result<Vec<Rc<v1_compiler_compile::SourceFile>>, String> {
+    if imported.is_empty() {
+        return Ok(imported);
+    }
+    Ok(extend_sources_to_both_closure_fixpoint(imported, index)?
+        .into_iter()
+        // One spelling per file: the index may carry a pulled module under its absolute
+        // path, and a recorder keyed by path must not see one file as two members.
+        .map(|source| {
+            let rel = workspace_relative_repo_path(&source.path);
+            if rel == source.path {
+                source
+            } else {
+                Rc::new(v1_compiler_compile::SourceFile {
+                    path: rel,
+                    content: source.content.clone(),
+                })
+            }
+        })
+        .collect())
+}
+
+/// THE PRE-FIX LOADER, test-only: the same import seeds and closure authority as
+/// `resolve_virtual_source_with_imports`, on `try_index_for_run_or_owned_pool` over the layer
+/// roots. That is the slot the claim fold reads. The only difference from production is the
+/// index. RFM `fixture_compile_retained_on_the_process_shared_index`.
+#[cfg(test)]
+pub(crate) fn extend_fixture_imports_on_process_shared_index(
+    entry_content: &str,
+    module_index: &HashMap<String, String>,
+) -> Result<Vec<Rc<v1_compiler_compile::SourceFile>>, String> {
+    let imported = fixture_imported_corpus_sources(entry_content, module_index);
+    let layers = witness_layer_roots();
+    let index = entry_resolve::try_index_for_run_or_owned_pool(&layers)?;
+    close_fixture_imported_corpus(imported, &index)
+}
+
+/// The closure an in-memory (not-on-disk) fixture entry compiles against: the corpus modules its
+/// authored `import` lines name, read from the workspace through `module_index`, CLOSED BY THE
+/// ONE CLOSURE AUTHORITY (`extend_sources_to_both_closure_fixpoint`), then the entry itself.
+///
+/// WHY NOT THE IMPORT EDGES ALONE (DESIGN §3, §6b). This walker used to stop at `import` lines,
+/// a fourth closure rule beside the one the gate, the witness loader and regen share. An `import`
+/// line, a qualified reference and a bare reference are the same dependency edge, so the
+/// import-only walk was not a narrower closure but a blind one: `std.syllogism` reaches
+/// `std.graph` by the bare name `GraphEdge` and `v2.std.artifact` reaches `v2.std.refinement` by
+/// qualified reference, so a fixture whose imports reached either compiled it WITHOUT its
+/// provider and reported `unresolved type` / `undefined variable 'v2'` against a module that
+/// resolves in every closure the corpus authority builds. #13195's union render made that
+/// fork refuse the floor (46 such diagnostics on #13420's run, none in its own modules).
+///
+/// The extension is seeded from the corpus modules only. The entry is the fixture's subject,
+/// authored with an explicit import manifest a witness may be probing (an unlisted use, a
+/// refused import), so its own spelling stays exactly what it declares; every module it reaches
+/// is closed as the corpus closes it. An extension failure is returned, never widened past.
+/// The fixpoint mutates a scratch index (dropped with the loader), never the process-shared
+/// slot the claim fold reads.
+pub(crate) fn resolve_virtual_source_with_imports(
+    entry_path: &str,
+    entry_content: &str,
+    module_index: &HashMap<String, String>,
+) -> Result<Vec<Rc<v1_compiler_compile::SourceFile>>, String> {
+    let imported = fixture_imported_corpus_sources(entry_content, module_index);
     let mut sources = if imported.is_empty() {
         imported
     } else {
-        let index = entry_resolve::try_index_for_run_or_owned_pool(&witness_layer_roots())?;
-        extend_sources_to_both_closure_fixpoint(imported, &index)?
-            .into_iter()
-            // One spelling per file: the index may carry a pulled module under its absolute
-            // path, and a recorder keyed by path must not see one file as two members.
-            .map(|source| {
-                let rel = workspace_relative_repo_path(&source.path);
-                if rel == source.path {
-                    source
-                } else {
-                    Rc::new(v1_compiler_compile::SourceFile {
-                        path: rel,
-                        content: source.content.clone(),
-                    })
-                }
-            })
-            .collect()
+        let index = scratch_index_for_fixture_closure_extension()?;
+        close_fixture_imported_corpus(imported, &index)?
     };
     sources.sort_by(|a, b| a.path.cmp(&b.path));
     sources.dedup_by(|a, b| a.path == b.path);
@@ -4521,9 +4878,11 @@ fn regen_input_sources_over_roots(
 
     // Seed: every `.dag` under the entry root that declares a module path.
     let mut seeds: Vec<Rc<v1_compiler_compile::SourceFile>> = Vec::new();
-    for path in &entry_paths {
-        let content =
-            std::fs::read_to_string(path).map_err(|e| format!("read {}: {e}", path.display()))?;
+    for source in &entry_paths {
+        let path = source.path();
+        let content = source
+            .read()
+            .map_err(|e| format!("read {}: {e}", path.display()))?;
         let rel = workspace_relative_repo_path(&path.to_string_lossy());
         if extract_module_path(&content).is_some() {
             seeds.push(Rc::new(v1_compiler_compile::SourceFile {
@@ -4624,12 +4983,13 @@ pub(crate) fn is_test_dag(path: &str) -> bool {
 pub(crate) fn corpus_dag_files() -> Vec<(String, String)> {
     let mut paths = Vec::new();
     for root in witness_layer_roots() {
-        collect_dag_files_tolerant(&Path::new(&anchor_source_root(&root)), &mut paths);
+        collect_dag_files_tolerant(&Path::new(&anchor_source_root(&root)), &mut paths)
+            .unwrap_or_else(|cause| panic!("corpus walk over {root}: {cause}"));
     }
     let mut out = Vec::new();
     for p in paths {
-        let rel = repo_rel(&p);
-        if let Ok(content) = std::fs::read_to_string(&p) {
+        let rel = repo_rel(p.path());
+        if let Ok(content) = p.read() {
             out.push((rel, content));
         }
     }
@@ -4701,11 +5061,13 @@ fn try_build_module_index(source_roots: &[String]) -> Result<ModuleSourceIndex,
         }
         let mut dag_files = Vec::new();
         collect_dag_files_result(root_path, &mut dag_files)?;
-        for path in dag_files {
-            let content = std::fs::read_to_string(&path)
+        for source in dag_files {
+            let path = source.path();
+            let content = source
+                .read()
                 .map_err(|e| format!("failed to read {}: {e}", path.display()))?;
             if let Some(module_path) = extract_module_path(&content) {
-                let rel_path = module_index_path_key(&path);
+                let rel_path = module_index_path_key(path);
                 let rel_forward = rel_path.clone();
                 if manifest_stub_superseded_by_overlay(&rel_forward, source_roots, root_idx) {
                     continue;
@@ -4820,11 +5182,13 @@ fn try_index_source_root_into_module_index(
     let mut dag_files = Vec::new();
     collect_dag_files_result(root_path, &mut dag_files)?;
     let mut within_root: HashMap<String, String> = HashMap::new();
-    for path in dag_files {
-        let content = std::fs::read_to_string(&path)
+    for source in dag_files {
+        let path = source.path();
+        let content = source
+            .read()
             .map_err(|e| format!("failed to read {}: {e}", path.display()))?;
         if let Some(module_path) = extract_module_path(&content) {
-            let rel_path = module_index_path_key(&path);
+            let rel_path = module_index_path_key(path);
             if pool_fill_only {
                 if index.contains_key(&module_path) {
                     continue;
@@ -4868,14 +5232,16 @@ fn load_compile_clean_entry_sources(
     if first_root.is_dir() {
         let mut dag_paths = Vec::new();
         collect_dag_files(first_root, &mut dag_paths);
-        for path in dag_paths {
+        for source in dag_paths {
+            let path = source.path();
             let rel = workspace_relative_repo_path(&path.to_string_lossy());
             if let Some(filter) = entry_path_filter {
                 if !filter.contains(&rel) {
                     continue;
                 }
             }
-            let content = std::fs::read_to_string(&path)
+            let content = source
+                .read()
                 .unwrap_or_else(|e| panic!("failed to read {:?}: {}", path, e));
             entry_files.push((path.to_string_lossy().to_string(), content));
         }
@@ -5356,8 +5722,8 @@ pub const RUN_CLASS_B_GATE_INPUT_CLOSURE_FAILED_LABEL: &str =
 /// deleted; the index stays, because which file declares a module is what any import walk needs.
 fn dag_module_index(
     roots: &[PathBuf],
-) -> Result<std::collections::HashMap<String, Vec<PathBuf>>, String> {
-    let mut index: std::collections::HashMap<String, Vec<PathBuf>> =
+) -> Result<std::collections::HashMap<String, Vec<derived_row_roster::AcquiredDag>>, String> {
+    let mut index: std::collections::HashMap<String, Vec<derived_row_roster::AcquiredDag>> =
         std::collections::HashMap::new();
     for root in roots {
         if !root.exists() {
@@ -5365,11 +5731,12 @@ fn dag_module_index(
         }
         let mut dag_paths = Vec::new();
         collect_dag_files(root, &mut dag_paths);
-        for path in dag_paths {
-            let content = std::fs::read_to_string(&path)
-                .map_err(|e| format!("read {}: {e}", path.display()))?;
+        for source in dag_paths {
+            let content = source
+                .read()
+                .map_err(|e| format!("read {}: {e}", source.path().display()))?;
             if let Some(module_path) = extract_module_path(&content) {
-                index.entry(module_path).or_default().push(path);
+                index.entry(module_path).or_default().push(source);
             }
         }
     }
@@ -8348,6 +8715,11 @@ fn parsed_file_references_of(
     if let Some(hit) = index.parsed_references.borrow().get(&file) {
         return hit.clone();
     }
+    if let Some(base) = index.scratch_underlay.borrow().as_ref() {
+        if let Some(hit) = base.parsed_references.borrow().get(&file) {
+            return hit.clone();
+        }
+    }
     let module_names = pool_module_names(index);
     let self_module = extract_module_path(&sf.content).unwrap_or_default();
     index
@@ -8717,6 +9089,11 @@ fn admit_bare_references_of_file(
     if let Some(verdict) = index.bare_reference_admission.borrow().get(&file) {
         return verdict.clone();
     }
+    if let Some(base) = index.scratch_underlay.borrow().as_ref() {
+        if let Some(verdict) = base.bare_reference_admission.borrow().get(&file) {
+            return verdict.clone();
+        }
+    }
     let verdict = if source_declares_import_lines(&source.content) {
         Ok(())
     } else {
@@ -9244,6 +9621,13 @@ fn build_both_closure_edge_index(
             return Ok(hit.clone());
         }
     }
+    if let Some(base) = index.scratch_underlay.borrow().as_ref() {
+        if let Some(hit) = base.both_closure_edges.borrow().as_ref() {
+            if hit.ref_out.contains_key(&file) {
+                return Ok(hit.clone());
+            }
+        }
+    }
     let ref_started = std::time::Instant::now();
     let ref_paths = reference_pull_paths_for_source(source, index)?;
     resolve_stage_slot_add(|st| st.edge_index_ref_half += ref_started.elapsed().as_nanos());
@@ -9838,6 +10222,128 @@ mod closure_edge_demand_tests {
         );
     }
 
+    /// Inhabitance: `load_sources_for_entry_with_pool` already binds by the ancestor chain.
+    /// The sibling plant is nearer by prefix and must not enter the compile closure.
+    #[test]
+    fn load_sources_binds_the_on_chain_ancestor_not_the_sibling_plant() {
+        let fixture = Fixture::new(&[
+            (
+                "parent.dag",
+                "module frontier\nfn duplicated() -> Int { 1 }\n",
+            ),
+            (
+                "plant.dag",
+                "module frontier.child.plant\nfn duplicated() -> Int { 99 }\n",
+            ),
+            (
+                "consumer.dag",
+                "module frontier.child.consumer\nfn read() -> Int { duplicated() }\n",
+            ),
+        ]);
+        let index = fixture.index();
+        let sources = load_sources_for_entry_with_pool(
+            &index,
+            &fixture.0.join("consumer.dag").to_string_lossy(),
+        )
+        .unwrap();
+        let modules: BTreeSet<String> = sources
+            .iter()
+            .map(|s| extract_module_path(&s.content).unwrap())
+            .collect();
+        assert!(modules.contains("frontier"), "{modules:?}");
+        assert!(!modules.contains("frontier.child.plant"), "{modules:?}");
+        assert!(modules.contains("frontier.child.consumer"), "{modules:?}");
+    }
+
+    /// Unique off-chain declarer: UniqueBinding still accepts, so UniqueBare must emit
+    /// (dropping it is an undercount) and the real resolve path must succeed.
+    #[test]
+    fn unique_off_chain_bare_name_compiles_and_keeps_its_uniquebare_edge() {
+        let fixture = Fixture::new(&[
+            (
+                "decl.dag",
+                "module test.decl\nfn shared_fn() -> Int { 1 }\n",
+            ),
+            (
+                "user.dag",
+                "module test.user\nfn use_it() -> Int { shared_fn() }\n",
+            ),
+        ]);
+        let index = fixture.index();
+        let sources =
+            load_sources_for_entry_with_pool(&index, &fixture.0.join("user.dag").to_string_lossy())
+                .expect("UniqueBinding pulls the census-unique off-chain provider");
+        let compiled = v1_compiler_compile::compile_sources(
+            Rc::new(sources.iter().cloned().collect()),
+            crate::v1_compiler_artifact::RenderTarget::Dag,
+        );
+        assert!(
+            !compiled
+                .diagnostics
+                .iter()
+                .any(|d| { is_interpreter_blocking_diagnostic(d.diagnostic.clone()) }),
+            "resolver-accepted UniqueBinding must compile: {:?}",
+            compiled.diagnostics
+        );
+        let roots = vec![fixture.0.to_string_lossy().into_owned()];
+        let facts = dependency_resolution_facts(&roots, &roots, &[]);
+        assert!(
+            facts
+                .iter()
+                .any(|f| f.path.contains("user.dag") && f.import_module == "test.decl"),
+            "resolver-accepted UniqueBinding must remain a UniqueBare edge: {facts:?}"
+        );
+    }
+
+    /// Two off-chain homonyms, none on the consumer's chain: proximity UniqueBare is gone,
+    /// and the real resolve path refuses rather than silently picking a neighbor.
+    #[test]
+    fn off_chain_homonym_with_no_lexical_binder_is_refused_on_the_resolve_path() {
+        let fixture = Fixture::new(&[
+            ("a.dag", "module aa.one\nfn shared() -> Int { 1 }\n"),
+            ("b.dag", "module bb.two\nfn shared() -> Int { 2 }\n"),
+            (
+                "user.dag",
+                "module cc.user\nfn use_it() -> Int { shared() }\n",
+            ),
+        ]);
+        let index = fixture.index();
+        let sources =
+            load_sources_for_entry_with_pool(&index, &fixture.0.join("user.dag").to_string_lossy())
+                .expect("admission does not fabricate a proximity provider");
+        let compiled = v1_compiler_compile::compile_sources(
+            Rc::new(sources.iter().cloned().collect()),
+            crate::v1_compiler_artifact::RenderTarget::Dag,
+        );
+        let msgs: Vec<String> = compiled
+            .diagnostics
+            .iter()
+            .filter(|d| is_interpreter_blocking_diagnostic(d.diagnostic.clone()))
+            .map(|d| format!("{:?}", d.diagnostic))
+            .collect();
+        let joined = msgs.join("\n");
+        assert!(
+            !msgs.is_empty()
+                && joined.contains("shared")
+                && (joined.contains("undefined")
+                    || joined.contains("not found in scope")
+                    || joined.contains("AMBIGUOUS")
+                    || joined.contains("unresolved")),
+            "refusal must name the bare identifier: {joined:?}"
+        );
+        let roots = vec![fixture.0.to_string_lossy().into_owned()];
+        let facts = dependency_resolution_facts(&roots, &roots, &[]);
+        let user_targets: Vec<&str> = facts
+            .iter()
+            .filter(|f| f.path.contains("user.dag"))
+            .map(|f| f.import_module.as_str())
+            .collect();
+        assert!(
+            user_targets.is_empty(),
+            "no UniqueBare to a proximity winner: {user_targets:?}"
+        );
+    }
+
     /// ONE PARSE PER FILE ON THE ENTRY ROUTE. A module reached only by a dotted reference is
     /// pulled by the fixpoint's reference half, which reads the index's shared parse; the
     /// per-entry module-path scan (`extend_with_reference_closure`, timed as
@@ -10587,6 +11093,18 @@ fn entry_source_from_index_or_disk(
     entry_path: &str,
 ) -> Result<Rc<v1_compiler_compile::SourceFile>, String> {
     let path = std::path::Path::new(entry_path);
+    // A DERIVED LEDGER ROSTER HAS NO FILE: it is contributed to the index in memory by source
+    // acquisition (`derived_row_roster::acquire_dir_files`), so an entry naming it is answered from
+    // the index the loader built, never from a file that would have to be written first.
+    if !path.exists() && derived_row_roster::is_derived_roster_path(entry_path) {
+        let wanted = workspace_relative_repo_path(entry_path);
+        if let Some(indexed) = index
+            .values()
+            .find(|s| workspace_relative_repo_path(&s.path) == wanted)
+        {
+            return Ok(indexed.clone());
+        }
+    }
     if !path.is_file() {
         return Err(format!(
             "entry file does not exist or is not a file: {}",
@@ -12568,6 +13086,8 @@ pub struct MultiEntryIndex {
     live_read_manifest: RefCell<Option<Result<Rc<LiveReadSelectionManifest>, String>>>,
     /// Only produced rows; consumers needing every row call whole_pool_closure_edge_index.
     both_closure_edges: RefCell<Option<Rc<BothClosureEdgeIndex>>>,
+    /// Fixture-scratch read-through: the process-shared index. Writes stay on this index.
+    scratch_underlay: RefCell<Option<Rc<MultiEntryIndex>>>,
     /// Admission and edge selection need declaration heads, not resolved signatures.
     /// None identifies the whole-pool name census; Some(root) the existing tree/import view.
     closure_name_censuses: RefCell<HashMap<Option<String>, Rc<SymbolIndex>>>,
@@ -12933,11 +13453,20 @@ fn next_index_generation() -> u64 {
 /// One `MultiEntryIndex` construction: the module-name set it indexes (as a digest over the sorted
 /// module paths, with its size) and the first caller outside the `#[track_caller]` chain of index
 /// builders that demanded it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum MultiEntryIndexBuildKind {
+    /// One demand for a module-name set. Two of these with one digest refuse.
+    NameSetIndex,
+    /// Isolated caches over an already-indexed name set. Countable, not a second index.
+    ScratchCachesOverExistingSet,
+}
+
 #[derive(Clone, Debug)]
 pub(crate) struct MultiEntryIndexBuild {
     pub(crate) name_set_digest: u64,
     pub(crate) modules: usize,
     pub(crate) site: String,
+    pub(crate) kind: MultiEntryIndexBuildKind,
 }
 
 static MULTI_ENTRY_INDEX_BUILDS: std::sync::Mutex<Vec<MultiEntryIndexBuild>> =
@@ -12946,6 +13475,7 @@ static MULTI_ENTRY_INDEX_BUILDS: std::sync::Mutex<Vec<MultiEntryIndexBuild>> =
 pub(crate) fn record_multi_entry_index_site(
     site: &std::panic::Location<'_>,
     source_files: &ModuleSourceIndex,
+    kind: MultiEntryIndexBuildKind,
 ) {
     use std::hash::{Hash, Hasher};
     // The POOL, not only its names: two scratch pools declaring one module path at different
@@ -12962,6 +13492,7 @@ pub(crate) fn record_multi_entry_index_site(
             name_set_digest: hasher.finish(),
             modules: pool.len(),
             site: format!("{}:{}", site.file(), site.line()),
+            kind,
         });
     }
 }
@@ -12973,15 +13504,18 @@ pub(crate) fn multi_entry_index_builds() -> Vec<MultiEntryIndexBuild> {
         .unwrap_or_default()
 }
 
-/// ONE INDEX PER MODULE-NAME SET. An index is a pure function of the name set it covers, so two
-/// constructions over one set are one demand built twice, and every file each serves is parsed
-/// again per index. Refuses with the sites of every set built more than once; distinct sets are
-/// distinct demands and are not limited.
+/// ONE NAME-SET INDEX PER MODULE-NAME SET. Two `NameSetIndex` constructions over one set are one
+/// demand built twice. `ScratchCachesOverExistingSet` is recorded (countable) and is not a second
+/// index of that set. Refuses with the sites of every set indexed more than once; distinct sets
+/// are distinct demands and are not limited.
 pub(crate) fn multi_entry_index_sharing_control(
     builds: &[MultiEntryIndexBuild],
 ) -> Result<usize, String> {
     let mut by_set: BTreeMap<u64, Vec<&MultiEntryIndexBuild>> = BTreeMap::new();
     for build in builds {
+        if build.kind != MultiEntryIndexBuildKind::NameSetIndex {
+            continue;
+        }
         by_set.entry(build.name_set_digest).or_default().push(build);
     }
     let repeated: Vec<String> = by_set
@@ -17456,7 +17990,7 @@ pub fn run_dag_parse_sweep(workspace: &Path, roots: &[&str]) -> Result<DagParseS
     if roots.is_empty() {
         return Err(vec!["parse sweep called with no roots".to_string()]);
     }
-    let mut dag_paths: Vec<std::path::PathBuf> = Vec::new();
+    let mut dag_paths: Vec<derived_row_roster::AcquiredDag> = Vec::new();
     // PER-ROOT, so the empty-walk refusal below is per root: one root going missing must not
     // be absorbed by another root's files (the empty-observation narrow, DESIGN §5).
     for root in roots {
@@ -17464,14 +17998,11 @@ pub fn run_dag_parse_sweep(workspace: &Path, roots: &[&str]) -> Result<DagParseS
         let before = dag_paths.len();
         let mut stack: Vec<std::path::PathBuf> = vec![root_dir.clone()];
         while let Some(dir) = stack.pop() {
-            // Derive gitignored `gunbc.recurring_failure_mode.roster` before this directory's
-            // listing, so the required-CI index contains the module the parse join reads.
-            derived_row_roster::ensure_if_row_dir(&dir).map_err(|e| {
-                vec![format!(
-                    "failed to derive recurring_failure_mode roster in {}: {e}",
-                    dir.display()
-                )]
-            })?;
+            // This directory's `.dag` files are admitted as one listing after the walk of its
+            // entries, so a ledger row directory contributes its derived roster IN MEMORY and the
+            // required-CI index contains the module the parse join reads -- with nothing written
+            // under the root.
+            let mut here: Vec<std::path::PathBuf> = Vec::new();
             let read_dir = match std::fs::read_dir(&dir) {
                 Ok(d) => d,
                 Err(e) => return Err(vec![format!("read_dir {}: {e}", dir.display())]),
@@ -17511,9 +18042,11 @@ pub fn run_dag_parse_sweep(workspace: &Path, roots: &[&str]) -> Result<DagParseS
                     }
                     stack.push(path);
                 } else if path.extension().map(|ext| ext == "dag").unwrap_or(false) {
-                    dag_paths.push(path);
+                    here.push(path);
                 }
             }
+            dag_paths
+                .extend(derived_row_roster::acquire_dir_files(&dir, here).map_err(|e| vec![e])?);
         }
 
         // AN EMPTY WALK REFUSES, PER ROOT. Zero files found is not zero errors — it is the
@@ -17526,7 +18059,7 @@ pub fn run_dag_parse_sweep(workspace: &Path, roots: &[&str]) -> Result<DagParseS
             )]);
         }
     }
-    dag_paths.sort();
+    dag_paths.sort_by(|a, b| a.path().cmp(b.path()));
 
     let errors: Arc<Mutex<Vec<String>>> = Arc::new(Mutex::new(Vec::new()));
     let count = Arc::new(AtomicUsize::new(0));
@@ -17537,13 +18070,13 @@ pub fn run_dag_parse_sweep(workspace: &Path, roots: &[&str]) -> Result<DagParseS
     // Each file gets its own `Rc<HashMap>` — no shared parse state — so parsing is
     // embarrassingly parallel. Thread panics propagate via scope (fail-closed).
     std::thread::scope(|scope| {
-        for path in &dag_paths {
+        for source in &dag_paths {
             let errors = Arc::clone(&errors);
             let count = Arc::clone(&count);
             let records = Arc::clone(&records);
-            let path = path.clone();
+            let path = source.path().to_path_buf();
             scope.spawn(move || {
-                let content = match std::fs::read_to_string(&path) {
+                let content = match source.read() {
                     Ok(c) => c,
                     Err(e) => {
                         errors
@@ -18326,10 +18859,14 @@ fn module_emit_repr_fingerprint(
 ) -> Result<String, String> {
     use crate::v1_compiler_infer_emit_info::TypeSummary;
 
+    // Summaries are keyed by declaration identity (`<module>.<name>`), so a module's own types are
+    // read under its own path and never under a same-leaf declaration elsewhere in the closure.
+    let module_path = authored_name_at(source_indices.clone(), module.module.clone());
     let type_names = module_defined_type_names(module, source_indices);
     let mut type_summaries = BTreeMap::<String, TypeSummary>::new();
     for name in type_names {
-        if let Some(summary) = emit_info.type_summaries.get(&name) {
+        let key = format!("{module_path}.{name}");
+        if let Some(summary) = emit_info.type_summaries.by_key.get(&key) {
             type_summaries.insert(name, summary.as_ref().clone());
         }
     }
@@ -19735,23 +20272,18 @@ pub fn handle_pre_push() -> std::process::ExitCode {
 /// after a `dag run` entry returns -- the periodic dump alone races the
 /// process's natural completion and under-reports on fast runs.
 
-/// Parse repeated `--arg name=value` into the interpreter's named-argument
-/// channel (`run_in_context_with_args`, v1_interpreter.rs:1564 — already the
-/// channel `claim_executor` uses internally; `Commands::Run` simply never grew
-/// the flag, which is why every parameter-shaped value reached `.dag` entries
-/// through the process environment instead).
+/// Parse repeated `--arg name=value` into named text pairs.
 ///
 /// Named-only by construction: a `.dag` entry's parameters are named, so
 /// positional order across the CLI boundary would be an unchecked coincidence.
-/// A missing `=` refuses (§5) rather than guessing a position. Values enter as
-/// `Value::Str` — no coercion is fabricated here; a parameter wanting another
-/// type is the typed-argument follow-on, not a silent conversion.
-fn parse_run_args(raw: &[String]) -> Result<Vec<(Option<String>, v1_interpreter::Value)>, String> {
+/// A missing `=` refuses (§5) rather than guessing a position. The pairs stay
+/// text until [`bind_run_args_for_entry`], which is the typed binder: argv is
+/// always text (`CliTextValue` on the run verb); inhabiting the declared
+/// parameter type is a later, located decision — never a silent `String`.
+pub fn parse_run_arg_specs(raw: &[String]) -> Result<Vec<(String, String)>, String> {
     raw.iter()
         .map(|spec| match spec.split_once('=') {
-            Some((name, value)) if !name.is_empty() => {
-                Ok((Some(name.to_string()), str_value(value.to_string())))
-            }
+            Some((name, value)) if !name.is_empty() => Ok((name.to_string(), value.to_string())),
             Some(_) => Err(format!("--arg `{spec}`: empty parameter name before `=`")),
             None => Err(format!(
                 "--arg `{spec}`: expected `name=value` (named arguments only)"
@@ -19760,6 +20292,303 @@ fn parse_run_args(raw: &[String]) -> Result<Vec<(Option<String>, v1_interpreter:
         .collect()
 }
 
+fn parse_cli_decimal_int(text: &str) -> Option<i64> {
+    if text.is_empty() {
+        return None;
+    }
+    let digits = match text.as_bytes() {
+        [b'-', rest @ ..] | [b'+', rest @ ..] => rest,
+        rest => rest,
+    };
+    if digits.is_empty() || !digits.iter().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    text.parse().ok()
+}
+
+/// Admission derived from a parameter's resolved type (or supplied in tests).
+#[derive(Clone, Debug)]
+pub enum CliArgAdmission {
+    String,
+    Int,
+    Bool,
+    RefinedString {
+        display: String,
+        predicates: Vec<String>,
+    },
+    Unsupported {
+        display: String,
+    },
+}
+
+fn cli_arg_no_inhabitance_route(function: &str, param: &str, type_label: &str) -> String {
+    format!(
+        "--arg `{param}`: function `{function}` declares `{param}: {type_label}`, \
+         which `gunbc run --arg` cannot inhabit; only kernel String, Int, Bool, \
+         and std.types NonEmptyStr are admitted"
+    )
+}
+
+/// Bind one `--arg` text value against a resolved admission.
+pub fn bind_cli_arg_text(
+    function: &str,
+    param: &str,
+    admission: &CliArgAdmission,
+    text: &str,
+) -> Result<v1_interpreter::Value, String> {
+    match admission {
+        CliArgAdmission::String => Ok(str_value(text)),
+        CliArgAdmission::Int => bind_cli_int(function, param, "Int", text),
+        CliArgAdmission::Bool => match text {
+            "true" => Ok(Value::Bool(true)),
+            "false" => Ok(Value::Bool(false)),
+            _ => Err(format!(
+                "--arg `{param}`: function `{function}` declares `{param}: Bool`, \
+                 but `{text}` is not `true` or `false`"
+            )),
+        },
+        CliArgAdmission::RefinedString {
+            display,
+            predicates,
+        } => {
+            for pred in predicates {
+                match v1_compiler_infer::decidable_where_string_predicate_holds(
+                    pred.clone(),
+                    text.to_string(),
+                ) {
+                    Some(true) => {}
+                    Some(false) => {
+                        return Err(format!(
+                            "--arg `{param}`: function `{function}` declares `{param}: {display}`, \
+                             but the value fails `{pred}`"
+                        ));
+                    }
+                    None => {
+                        return Err(cli_arg_no_inhabitance_route(function, param, display));
+                    }
+                }
+            }
+            Ok(str_value(text))
+        }
+        CliArgAdmission::Unsupported { display } => {
+            Err(cli_arg_no_inhabitance_route(function, param, display))
+        }
+    }
+}
+
+fn bind_cli_int(
+    function: &str,
+    param: &str,
+    type_label: &str,
+    text: &str,
+) -> Result<v1_interpreter::Value, String> {
+    match parse_cli_decimal_int(text) {
+        Some(n) => Ok(Value::Int(n)),
+        None => Err(format!(
+            "--arg `{param}`: function `{function}` declares `{param}: {type_label}`, \
+             but `{text}` is not a decimal integer"
+        )),
+    }
+}
+
+fn cli_arg_resolved_type_node(type_expr: Rc<Node>) -> Rc<Node> {
+    match type_expr.inferred.as_deref() {
+        Some(InferredNode::Resolved { node }) => node.clone(),
+        _ => type_expr,
+    }
+}
+
+fn type_nodes_name_the_same_declaration(a: &Rc<Node>, b: &Rc<Node>) -> bool {
+    Rc::ptr_eq(a, b)
+        || match (&a.ident_span, &b.ident_span) {
+            (Some(left), Some(right)) => left.file == right.file && left.start == right.start,
+            _ => false,
+        }
+}
+
+fn std_types_nonempty_str_item(ctx: &v1_interpreter::InterpContext) -> Option<Rc<Node>> {
+    let tm = ctx.typed_module_for_authored_path("std.types")?;
+    tm.items
+        .iter()
+        .find(|item| authored_name_at(ctx.source_indices.clone(), (*item).clone()) == "NonEmptyStr")
+        .cloned()
+}
+
+fn nonempty_str_predicates_from_decl(
+    ctx: &v1_interpreter::InterpContext,
+    decl: &Rc<Node>,
+) -> Option<Vec<String>> {
+    let mut ty = v1_interpreter::type_declaration_rhs(decl)?;
+    let mut preds = Vec::new();
+    for _ in 0..8 {
+        if !v1_compiler_infer::is_where_refinement_type(ty.clone()) {
+            break;
+        }
+        for pred in v1_compiler_infer::type_expr_where_refinement_predicates(ty.clone())
+            .iter()
+            .cloned()
+        {
+            let pname = v1_compiler_infer::where_predicate_name_at(
+                pred.clone(),
+                ctx.source_indices.clone(),
+            );
+            if pname.is_empty()
+                || v1_compiler_infer::where_refinement_is_deferred_predicate(pname.clone())
+                || !v1_compiler_infer::where_refinement_is_string_literal_predicate(pname.clone())
+            {
+                return None;
+            }
+            preds.push(pname);
+        }
+        ty = ty.children.iter().next().cloned()?;
+    }
+    let kernel_string = match type_reference_identity(ty.clone()).as_ref() {
+        TypeReferenceIdentity::ReferenceResolvedToDeclaration { provenance }
+        | TypeReferenceIdentity::ReferenceIsTheDeclaration { provenance } => {
+            matches!(
+                provenance.as_ref(),
+                TypeDeclarationProvenance::KernelMinted { minted_name } if minted_name == "String"
+            )
+        }
+        TypeReferenceIdentity::ReferenceIsTypeVariableBinder { .. }
+        | TypeReferenceIdentity::ReferenceIdentityUnavailable { .. } => false,
+    };
+    if kernel_string && preds == ["string_non_empty".to_string()] {
+        Some(preds)
+    } else {
+        None
+    }
+}
+
+/// Admission from the parameter's resolved type identity (DESIGN §4): kernel
+/// String/Int/Bool, or the exact `std.types` `NonEmptyStr` declaration and its
+/// `string_non_empty` refinement. Leaf names do not authorize conversion.
+fn cli_arg_admission_from_type_expr(
+    ctx: &v1_interpreter::InterpContext,
+    type_expr: Rc<Node>,
+) -> CliArgAdmission {
+    let display = v1_compiler_infer::type_node_label(type_expr.clone(), ctx.source_indices.clone());
+    match type_reference_identity(type_expr.clone()).as_ref() {
+        TypeReferenceIdentity::ReferenceResolvedToDeclaration { provenance }
+        | TypeReferenceIdentity::ReferenceIsTheDeclaration { provenance } => {
+            match provenance.as_ref() {
+                TypeDeclarationProvenance::KernelMinted { minted_name } => {
+                    return cli_arg_admission_for_kernel(minted_name, display);
+                }
+                TypeDeclarationProvenance::CorpusDeclared { .. }
+                | TypeDeclarationProvenance::DeclarationIdentityAbsent => {}
+            }
+        }
+        TypeReferenceIdentity::ReferenceIsTypeVariableBinder { .. }
+        | TypeReferenceIdentity::ReferenceIdentityUnavailable { .. } => {}
+    }
+    std_types_nonempty_str_admission(ctx, type_expr, display)
+}
+
+fn refers_to_std_types_nonempty_str(
+    ctx: &v1_interpreter::InterpContext,
+    type_expr: Rc<Node>,
+    decl: &Rc<Node>,
+) -> bool {
+    let resolved = cli_arg_resolved_type_node(type_expr.clone());
+    if type_nodes_name_the_same_declaration(&resolved, decl) {
+        return true;
+    }
+    let decl_id =
+        v1_compiler_infer::node_declaration_identity(decl.clone(), ctx.source_indices.clone());
+    let ref_id = v1_compiler_infer::type_reference_identity(type_expr, ctx.source_indices.clone());
+    !decl_id.is_empty() && ref_id == decl_id
+}
+
+fn std_types_nonempty_str_admission(
+    ctx: &v1_interpreter::InterpContext,
+    type_expr: Rc<Node>,
+    display: String,
+) -> CliArgAdmission {
+    let Some(decl) = std_types_nonempty_str_item(ctx) else {
+        return CliArgAdmission::Unsupported { display };
+    };
+    if !refers_to_std_types_nonempty_str(ctx, type_expr, &decl) {
+        return CliArgAdmission::Unsupported { display };
+    }
+    match nonempty_str_predicates_from_decl(ctx, &decl) {
+        Some(predicates) => CliArgAdmission::RefinedString {
+            display,
+            predicates,
+        },
+        None => CliArgAdmission::Unsupported { display },
+    }
+}
+
+fn cli_arg_admission_for_kernel(ground: &str, display: String) -> CliArgAdmission {
+    match ground {
+        "String" => CliArgAdmission::String,
+        "Int" => CliArgAdmission::Int,
+        "Bool" => CliArgAdmission::Bool,
+        _ => CliArgAdmission::Unsupported { display },
+    }
+}
+
+/// Bind `--arg` specs against caller-supplied admissions (unit tests).
+pub fn bind_run_arg_specs_against_admissions(
+    function: &str,
+    declared: &[(String, CliArgAdmission)],
+    specs: &[(String, String)],
+) -> Result<Vec<(Option<String>, v1_interpreter::Value)>, String> {
+    let mut seen = HashSet::new();
+    let mut bound = Vec::with_capacity(specs.len());
+    for (name, text) in specs {
+        if !seen.insert(name.clone()) {
+            return Err(format!(
+                "--arg `{name}`: supplied more than once for function `{function}`"
+            ));
+        }
+        let admission = match declared.iter().find(|(n, _)| n == name) {
+            Some((_, a)) => a,
+            None => {
+                let known: Vec<&str> = declared.iter().map(|(n, _)| n.as_str()).collect();
+                return Err(format!(
+                    "--arg `{name}`: function `{function}` has no parameter `{name}` \
+                     (declared: {})",
+                    if known.is_empty() {
+                        "(none)".to_string()
+                    } else {
+                        known.join(", ")
+                    }
+                ));
+            }
+        };
+        bound.push((
+            Some(name.clone()),
+            bind_cli_arg_text(function, name, admission, text)?,
+        ));
+    }
+    Ok(bound)
+}
+
+/// Bind `--arg` text against `entry_fn`'s resolved parameter types.
+///
+/// No `.dag` binder exists: `gunbc.cli_dispatch_surface` owns the option as
+/// `CliTextValue` (argv is text). This seed function derives admissions from
+/// the resolved where-chain, then the one bind loop in
+/// [`bind_run_arg_specs_against_admissions`].
+pub fn bind_run_args_for_entry(
+    ctx: &v1_interpreter::InterpContext,
+    entry_fn: &str,
+    specs: &[(String, String)],
+) -> Result<Vec<(Option<String>, v1_interpreter::Value)>, String> {
+    if specs.is_empty() {
+        return Ok(Vec::new());
+    }
+    let declared = v1_interpreter::declared_parameter_type_exprs(ctx, entry_fn)
+        .ok_or_else(|| format!("--arg: function `{entry_fn}` is not in the loaded entry"))?;
+    let admissions: Vec<(String, CliArgAdmission)> = declared
+        .into_iter()
+        .map(|(name, ty)| (name, cli_arg_admission_from_type_expr(ctx, ty)))
+        .collect();
+    bind_run_arg_specs_against_admissions(entry_fn, &admissions, specs)
+}
+
 struct ScopedRunObservation {
     ctx: v1_interpreter::InterpContext,
     entry_file: String,
@@ -22226,27 +23055,396 @@ fn extract_bool_witness_transport(
     (entry, function)
 }
 
-fn defining_module_for_resolved_type(
-    graph: &ResolvedGraph,
-    source_indices: &HashMap<String, Rc<NewlineIndex>>,
+fn module_from_qualified_identity(identity: &str) -> Option<String> {
+    let (module, name) = identity.rsplit_once('.')?;
+    if module.is_empty() || name.is_empty() {
+        None
+    } else {
+        Some(module.to_string())
+    }
+}
+
+fn defining_module_for_variant(
     variant_to_enum: &im::HashMap<String, String>,
-    type_name: &str,
+    variant_name: &str,
 ) -> Option<String> {
-    let si = Rc::new(source_indices.clone());
-    for tm in graph.modules.iter() {
-        let mod_name = authored_name_at(si.clone(), tm.module.clone());
-        if lookup_type_by_name(tm.type_env.clone(), type_name.to_string()).is_some() {
-            return Some(mod_name);
+    // variant_to_enum is keyed by VARIANT leaf. Values are owner identities `<module>.<name>`.
+    // No row, the collision sentinel "", or an unqualified identity has no module part:
+    // return None so the caller refuses. Do not scan type environments for a leaf match.
+    let parent_enum = variant_to_enum.get(variant_name)?;
+    module_from_qualified_identity(parent_enum)
+}
+
+fn defining_module_for_type_identity(
+    type_summaries: &Rc<crate::v1_compiler_infer_emit_info::TypeSummaryIndex>,
+    identity: &str,
+) -> Option<String> {
+    // Exact declaration key only. type_summary_lookup / type_summary_by_leaf are leaf scans.
+    if !identity.contains('.') {
+        return None;
+    }
+    match (*crate::v1_compiler_infer_emit_info::type_summary_at_key(
+        type_summaries.clone(),
+        identity.to_string(),
+    ))
+    .clone()
+    {
+        crate::v1_compiler_infer_emit_info::TypeSummaryLookup::TypeSummaryFound { summary } => {
+            module_from_qualified_identity(&summary.key)
         }
+        _ => None,
     }
-    let parent_enum = variant_to_enum.get(type_name).cloned()?;
-    for tm in graph.modules.iter() {
-        let mod_name = authored_name_at(si.clone(), tm.module.clone());
-        if lookup_type_by_name(tm.type_env.clone(), parent_enum.clone()).is_some() {
-            return Some(mod_name);
+}
+
+fn defining_module_for_type_expr(
+    type_summaries: &Rc<crate::v1_compiler_infer_emit_info::TypeSummaryIndex>,
+    type_decls: &Rc<crate::v1_compiler_infer_emit_info::TypeDeclIndex>,
+    source_indices: &HashMap<String, Rc<NewlineIndex>>,
+    type_expr: &Rc<Node>,
+) -> Option<String> {
+    match (*crate::v1_compiler_infer_emit_info::type_summary_of_reference(
+        type_summaries.clone(),
+        type_decls.clone(),
+        type_expr.clone(),
+        Rc::new(source_indices.clone()),
+    ))
+    .clone()
+    {
+        crate::v1_compiler_infer_emit_info::TypeSummaryLookup::TypeSummaryFound { summary } => {
+            module_from_qualified_identity(&summary.key)
         }
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod defining_module_lookup_tests {
+    use super::*;
+
+    #[test]
+    fn bool_witness_claim_variant_resolves_to_verification_module() {
+        let mut variant_to_enum = im::HashMap::new();
+        variant_to_enum.insert(
+            "BoolWitnessClaim".to_string(),
+            "v2.std.verification.UnifiedTestClaim".to_string(),
+        );
+        variant_to_enum.insert(
+            "NodeCorpus".to_string(),
+            "v2.std.verification.UnifiedTestClaim".to_string(),
+        );
+        assert_eq!(
+            defining_module_for_variant(&variant_to_enum, "BoolWitnessClaim"),
+            Some("v2.std.verification".to_string()),
+            "the owned-data BoolWitnessClaim path keys variant_to_enum by the variant leaf"
+        );
+        assert_eq!(
+            defining_module_for_variant(&variant_to_enum, "UnifiedTestClaim"),
+            None,
+            "the coproduct leaf is not a variant key"
+        );
+    }
+
+    #[test]
+    fn unqualified_or_sentinel_variant_identity_refuses() {
+        let mut variant_to_enum = im::HashMap::new();
+        variant_to_enum.insert("NoDot".to_string(), "UnifiedTestClaim".to_string());
+        variant_to_enum.insert("Sentinel".to_string(), "".to_string());
+        assert_eq!(defining_module_for_variant(&variant_to_enum, "NoDot"), None);
+        assert_eq!(
+            defining_module_for_variant(&variant_to_enum, "Sentinel"),
+            None
+        );
+        assert_eq!(
+            defining_module_for_variant(&variant_to_enum, "Missing"),
+            None
+        );
+    }
+
+    #[test]
+    fn type_identity_uses_exact_summary_key_not_a_leaf() {
+        use crate::v1_compiler_infer_emit_info::{
+            empty_type_summary_index, type_summary_index_insert, TypeRepr, TypeSummary,
+        };
+        let summary = Rc::new(TypeSummary {
+            name: "UnifiedTestClaim".to_string(),
+            key: "v2.std.verification.UnifiedTestClaim".to_string(),
+            repr: Rc::new(TypeRepr::EnumRepr { unit_only: false }),
+            field_summaries: crate::v1_rt::rc_empty_map(),
+            field_type_map: crate::v1_rt::rc_empty_map(),
+            field_import_surface_names: Rc::new(im::Vector::new()),
+            variant_name_set: crate::v1_rt::rc_empty_map(),
+            generic_param_names: Rc::new(im::Vector::new()),
+            has_fn_fields: false,
+        });
+        let index = type_summary_index_insert(
+            empty_type_summary_index(),
+            "v2.std.verification.UnifiedTestClaim".to_string(),
+            "UnifiedTestClaim".to_string(),
+            summary,
+        );
+        assert_eq!(
+            defining_module_for_type_identity(&index, "v2.std.verification.UnifiedTestClaim"),
+            Some("v2.std.verification".to_string())
+        );
+        assert_eq!(
+            defining_module_for_type_identity(&index, "UnifiedTestClaim"),
+            None,
+            "a bare type leaf must not scan keys_by_leaf"
+        );
+    }
+
+    #[test]
+    fn user_type_named_like_a_known_variant_keeps_its_module() {
+        use crate::v1_compiler_infer_emit_info::{
+            empty_type_decl_index, empty_type_summary_index, type_summary_index_insert, TypeRepr,
+            TypeSummary,
+        };
+        let mut variant_to_enum = im::HashMap::new();
+        variant_to_enum.insert(
+            "BoolWitnessClaim".to_string(),
+            "v2.std.verification.UnifiedTestClaim".to_string(),
+        );
+        let summary = Rc::new(TypeSummary {
+            name: "BoolWitnessClaim".to_string(),
+            key: "owner.types.BoolWitnessClaim".to_string(),
+            repr: Rc::new(TypeRepr::StructRepr),
+            field_summaries: crate::v1_rt::rc_empty_map(),
+            field_type_map: crate::v1_rt::rc_empty_map(),
+            field_import_surface_names: Rc::new(im::Vector::new()),
+            variant_name_set: crate::v1_rt::rc_empty_map(),
+            generic_param_names: Rc::new(im::Vector::new()),
+            has_fn_fields: false,
+        });
+        let index = type_summary_index_insert(
+            empty_type_summary_index(),
+            "owner.types.BoolWitnessClaim".to_string(),
+            "BoolWitnessClaim".to_string(),
+            summary,
+        );
+        let source_indices = HashMap::new();
+        let decls = empty_type_decl_index();
+        assert_eq!(
+            defining_module_for_inferred_result(
+                &variant_to_enum,
+                &index,
+                &decls,
+                &source_indices,
+                None,
+                "owner.types.BoolWitnessClaim",
+            ),
+            Some("owner.types".to_string()),
+            "a user type identity named like a variant leaf is not routed to v2.std.verification"
+        );
+        assert_eq!(
+            defining_module_for_variant(&variant_to_enum, "BoolWitnessClaim"),
+            Some("v2.std.verification".to_string()),
+            "the variant map still answers the record-lit arm"
+        );
+    }
+
+    fn synthetic_named_node(name: &str) -> Rc<Node> {
+        let span = no_span();
+        Rc::new(Node {
+            occurrence_identity: Rc::new(
+                crate::std_occurrence_identity::NodeOccurrenceIdentity::OccurrenceSynthetic,
+            ),
+            name: name.to_string(),
+            ident: None,
+            span: span.clone(),
+            ident_span: Some(span),
+            children: Rc::new(im::Vector::new()),
+            connective: Connective::NoConnective,
+            params: Rc::new(im::Vector::new()),
+            inferred: None,
+            return_cardinality: Cardinality::Required,
+            uses: Rc::new(im::Vector::new()),
+            body: None,
+            transport: None,
+            properties: Rc::new(im::Vector::new()),
+            type_annotation: None,
+            is_self_recursive: false,
+            has_non_tail_self_call: false,
+            match_pattern: None,
+            module_item_kind: crate::v1_std_core::ParsedModuleItemKind::NotAModuleItem,
+            declaration_marker: crate::v1_std_core::DeclarationMarker::Unmarked,
+            declaration: None,
+            expr_data: Rc::new(ExprData::NoExprData),
+        })
+    }
+
+    #[test]
+    fn inferred_user_bool_witness_claim_keeps_its_module_at_initializer_ref() {
+        use crate::std_decl_ref::decl_ref;
+        use crate::v1_compiler_infer_emit_info::{
+            empty_emit_graph_info, empty_type_decl_index, empty_type_summary_index,
+            type_decl_index_insert, type_summary_index_insert, TypeRepr, TypeSummary,
+        };
+
+        let mut variant_to_enum = im::HashMap::new();
+        variant_to_enum.insert(
+            "BoolWitnessClaim".to_string(),
+            "v2.std.verification.UnifiedTestClaim".to_string(),
+        );
+
+        let mut type_node = (*synthetic_named_node("BoolWitnessClaim")).clone();
+        type_node.declaration = Some(decl_ref(
+            "owner.types".to_string(),
+            "BoolWitnessClaim".to_string(),
+        ));
+        let type_node = Rc::new(type_node);
+
+        let decl_item = type_node.clone();
+        let decls = type_decl_index_insert(
+            empty_type_decl_index(),
+            "owner.types".to_string(),
+            "BoolWitnessClaim".to_string(),
+            decl_item,
+        );
+        let summary = Rc::new(TypeSummary {
+            name: "BoolWitnessClaim".to_string(),
+            key: "owner.types.BoolWitnessClaim".to_string(),
+            repr: Rc::new(TypeRepr::StructRepr),
+            field_summaries: crate::v1_rt::rc_empty_map(),
+            field_type_map: crate::v1_rt::rc_empty_map(),
+            field_import_surface_names: Rc::new(im::Vector::new()),
+            variant_name_set: crate::v1_rt::rc_empty_map(),
+            generic_param_names: Rc::new(im::Vector::new()),
+            has_fn_fields: false,
+        });
+        let summaries = type_summary_index_insert(
+            empty_type_summary_index(),
+            "owner.types.BoolWitnessClaim".to_string(),
+            "BoolWitnessClaim".to_string(),
+            summary,
+        );
+
+        let mut emit_info = (*empty_emit_graph_info()).clone();
+        emit_info.variant_to_enum = Rc::new(variant_to_enum);
+        emit_info.type_summaries = summaries;
+        emit_info.type_decl_items = decls;
+
+        let mut body = (*synthetic_named_node("")).clone();
+        body.inferred = Some(Rc::new(InferredNode::Resolved { node: type_node }));
+        let body = Rc::new(body);
+
+        let graph = ResolvedGraph {
+            modules: Rc::new(im::Vector::new()),
+            item_registry: Rc::new(im::HashMap::new()),
+            item_leaf_owner_modules: Rc::new(im::HashMap::new()),
+            diagnostics: Rc::new(im::Vector::new()),
+        };
+        let source_indices = HashMap::new();
+        let resolved =
+            resolved_initializer_decl_ref(&graph, &source_indices, &emit_info, &body, None)
+                .expect("initializer ref must resolve the carried user declaration");
+        assert_eq!(
+            resolved.module, "owner.types",
+            "carried BoolWitnessClaim declaration must beat variant_to_enum UnifiedTestClaim"
+        );
+        assert_eq!(resolved.name, "BoolWitnessClaim");
+    }
+
+    #[test]
+    fn ambiguous_enum_name_is_not_answered_false() {
+        use crate::v1_compiler_infer_emit_info::{
+            empty_type_summary_index, is_enum_in_summaries, type_summary_index_insert, TypeRepr,
+            TypeSummary, TypeSummaryQuestion,
+        };
+        let enum_summary = Rc::new(TypeSummary {
+            name: "SharedName".to_string(),
+            key: "owner.enums.SharedName".to_string(),
+            repr: Rc::new(TypeRepr::EnumRepr { unit_only: false }),
+            field_summaries: crate::v1_rt::rc_empty_map(),
+            field_type_map: crate::v1_rt::rc_empty_map(),
+            field_import_surface_names: Rc::new(im::Vector::new()),
+            variant_name_set: crate::v1_rt::rc_empty_map(),
+            generic_param_names: Rc::new(im::Vector::new()),
+            has_fn_fields: false,
+        });
+        let struct_summary = Rc::new(TypeSummary {
+            name: "SharedName".to_string(),
+            key: "owner.types.SharedName".to_string(),
+            repr: Rc::new(TypeRepr::StructRepr),
+            field_summaries: crate::v1_rt::rc_empty_map(),
+            field_type_map: crate::v1_rt::rc_empty_map(),
+            field_import_surface_names: Rc::new(im::Vector::new()),
+            variant_name_set: crate::v1_rt::rc_empty_map(),
+            generic_param_names: Rc::new(im::Vector::new()),
+            has_fn_fields: false,
+        });
+        let index = type_summary_index_insert(
+            type_summary_index_insert(
+                empty_type_summary_index(),
+                "owner.enums.SharedName".to_string(),
+                "SharedName".to_string(),
+                enum_summary,
+            ),
+            "owner.types.SharedName".to_string(),
+            "SharedName".to_string(),
+            struct_summary,
+        );
+        assert!(
+            matches!(
+                (*is_enum_in_summaries(index, "SharedName".to_string())).clone(),
+                TypeSummaryQuestion::QuestionNameAmbiguous { leaf } if leaf == "SharedName"
+            ),
+            "disagreement must not collapse to a decided non-enum"
+        );
+    }
+
+    #[test]
+    fn ambiguous_enum_name_refuses_instead_of_non_enum_emission() {
+        use crate::v1_compiler_infer_emit_info::{
+            empty_type_summary_index, type_summary_index_insert, TypeRepr, TypeSummary,
+        };
+        let enum_summary = Rc::new(TypeSummary {
+            name: "SharedName".to_string(),
+            key: "owner.enums.SharedName".to_string(),
+            repr: Rc::new(TypeRepr::EnumRepr { unit_only: false }),
+            field_summaries: crate::v1_rt::rc_empty_map(),
+            field_type_map: crate::v1_rt::rc_empty_map(),
+            field_import_surface_names: Rc::new(im::Vector::new()),
+            variant_name_set: crate::v1_rt::rc_empty_map(),
+            generic_param_names: Rc::new(im::Vector::new()),
+            has_fn_fields: false,
+        });
+        let struct_summary = Rc::new(TypeSummary {
+            name: "SharedName".to_string(),
+            key: "owner.types.SharedName".to_string(),
+            repr: Rc::new(TypeRepr::StructRepr),
+            field_summaries: crate::v1_rt::rc_empty_map(),
+            field_type_map: crate::v1_rt::rc_empty_map(),
+            field_import_surface_names: Rc::new(im::Vector::new()),
+            variant_name_set: crate::v1_rt::rc_empty_map(),
+            generic_param_names: Rc::new(im::Vector::new()),
+            has_fn_fields: false,
+        });
+        let index = type_summary_index_insert(
+            type_summary_index_insert(
+                empty_type_summary_index(),
+                "owner.enums.SharedName".to_string(),
+                "SharedName".to_string(),
+                enum_summary,
+            ),
+            "owner.types.SharedName".to_string(),
+            "SharedName".to_string(),
+            struct_summary,
+        );
+        let parent = crate::v1_compiler_emit_rust::pattern_parent_enum(
+            "Arm".to_string(),
+            None,
+            "SharedName".to_string(),
+            index,
+        );
+        let refusal = crate::v1_compiler_emit_rust::rust_ambiguous_type_name_refusal(
+            "SharedName".to_string(),
+        );
+        assert_eq!(
+            parent,
+            Some(refusal),
+            "an ambiguous enum name must emit the typed refusal, not a non-enum parent"
+        );
     }
-    None
 }
 
 fn lookup_resolved_type_node(graph: &ResolvedGraph, type_name: &str) -> Option<Rc<Node>> {
@@ -22271,27 +23469,53 @@ fn declared_type_name_from_annotation(
     }
 }
 
-fn resolved_decl_ref_from_type_name(
-    graph: &ResolvedGraph,
+fn defining_module_for_inferred_result(
+    variant_to_enum: &im::HashMap<String, String>,
+    type_summaries: &Rc<crate::v1_compiler_infer_emit_info::TypeSummaryIndex>,
+    type_decls: &Rc<crate::v1_compiler_infer_emit_info::TypeDeclIndex>,
     source_indices: &HashMap<String, Rc<NewlineIndex>>,
+    inferred_node: Option<&Rc<Node>>,
+    name: &str,
+) -> Option<String> {
+    // Type declaration identity first. A user type whose leaf matches a known variant
+    // (BoolWitnessClaim) must not be stolen by variant_to_enum spelling.
+    inferred_node
+        .and_then(|node| {
+            defining_module_for_type_expr(type_summaries, type_decls, source_indices, node)
+        })
+        .or_else(|| defining_module_for_type_identity(type_summaries, name))
+        .or_else(|| defining_module_for_variant(variant_to_enum, name))
+}
+
+fn resolved_decl_ref_from_type_name(
     variant_to_enum: &im::HashMap<String, String>,
+    type_summaries: &Rc<crate::v1_compiler_infer_emit_info::TypeSummaryIndex>,
     name: &str,
 ) -> Result<ResolvedDeclRef, String> {
-    let module = defining_module_for_resolved_type(graph, source_indices, variant_to_enum, name)
+    let module = defining_module_for_type_identity(type_summaries, name)
+        .or_else(|| defining_module_for_variant(variant_to_enum, name))
         .ok_or_else(|| format!("no defining module for resolved type '{}'", name))?;
+    let stored_name = crate::v1_std_core::qualified_last_segment(name.to_string());
     Ok(ResolvedDeclRef {
         module,
-        name: name.to_string(),
+        name: if stored_name.is_empty() {
+            name.to_string()
+        } else {
+            stored_name
+        },
     })
 }
 
 fn resolved_initializer_decl_ref(
     graph: &ResolvedGraph,
     source_indices: &HashMap<String, Rc<NewlineIndex>>,
-    variant_to_enum: &im::HashMap<String, String>,
+    emit_info: &crate::v1_compiler_infer_emit_info::EmitGraphInfo,
     body: &Rc<Node>,
     type_annotation: Option<&Rc<Node>>,
 ) -> Result<ResolvedDeclRef, String> {
+    let variant_to_enum = emit_info.variant_to_enum.as_ref();
+    let type_summaries = &emit_info.type_summaries;
+    let type_decls = &emit_info.type_decl_items;
     let si = Rc::new(source_indices.clone());
     if let ExprData::ExprRecordLit { parent_enum } = &*body.expr_data {
         if let Some(parent_name) = parent_enum.as_deref() {
@@ -22321,18 +23545,13 @@ fn resolved_initializer_decl_ref(
                     variant_name, parent_name
                 ));
             }
-            let module = defining_module_for_resolved_type(
-                graph,
-                source_indices,
-                variant_to_enum,
-                parent_name,
-            )
-            .ok_or_else(|| {
-                format!(
-                    "no defining module for resolved coproduct '{}'",
-                    parent_name
-                )
-            })?;
+            let module =
+                defining_module_for_variant(variant_to_enum, &variant_name).ok_or_else(|| {
+                    format!(
+                        "no defining module for resolved coproduct variant '{}'",
+                        variant_name
+                    )
+                })?;
             return Ok(ResolvedDeclRef {
                 module,
                 name: variant_name,
@@ -22361,11 +23580,38 @@ fn resolved_initializer_decl_ref(
         None => None,
     };
     if let Some(name) = inferred_name {
-        return resolved_decl_ref_from_type_name(graph, source_indices, variant_to_enum, &name);
+        let inferred_node = match body.inferred.as_deref() {
+            Some(InferredNode::Resolved { node }) => Some(node),
+            _ => None,
+        };
+        if let Some(module) = defining_module_for_inferred_result(
+            variant_to_enum,
+            type_summaries,
+            type_decls,
+            source_indices,
+            inferred_node,
+            &name,
+        ) {
+            return Ok(ResolvedDeclRef {
+                module,
+                name: crate::v1_std_core::qualified_last_segment(name),
+            });
+        }
+        return Err(format!("no defining module for resolved type '{}'", name));
     }
     if let Some(ann) = type_annotation {
+        if let Some(module) =
+            defining_module_for_type_expr(type_summaries, type_decls, source_indices, ann)
+        {
+            let name = declared_type_name_from_annotation(source_indices, ann)
+                .unwrap_or_else(|| "type".to_string());
+            return Ok(ResolvedDeclRef {
+                module,
+                name: crate::v1_std_core::qualified_last_segment(name),
+            });
+        }
         if let Some(name) = declared_type_name_from_annotation(source_indices, ann) {
-            return resolved_decl_ref_from_type_name(graph, source_indices, variant_to_enum, &name);
+            return resolved_decl_ref_from_type_name(variant_to_enum, type_summaries, &name);
         }
     }
     Err(
@@ -22502,7 +23748,7 @@ pub fn discover_owned_data_decls(
 
     let mut files = Vec::new();
     collect_dag_files(scan_path, &mut files);
-    files.retain(|p| !path_excluded(p, exclude_subpaths));
+    files.retain(|p| !path_excluded(p.path(), exclude_subpaths));
 
     // The process-shared index, so every entry's reference closure reads the one parse per file
     // the floor's other closure walks already hold.
@@ -22512,9 +23758,11 @@ pub fn discover_owned_data_decls(
     let mut groups: Vec<DiscoveryResolveGroup> = Vec::new();
     let mut group_split_collisions: Vec<String> = Vec::new();
     let mut entry_count = 0usize;
-    for path in files {
+    for source in files {
+        let path = source.path();
         let entry = path.to_string_lossy().to_string();
-        let content = std::fs::read_to_string(&path)
+        let content = source
+            .read()
             .map_err(|e| format!("failed to read {:?}: {}", path, e))?;
         if !entry_likely_has_unified_claim_owned_data(&content) {
             continue;
@@ -22585,15 +23833,13 @@ pub fn discover_owned_data_decls(
         // THE ONE READER OF variant_to_enum BUILDS IT, once per group graph, through the builder
         // emission uses: the resolve no longer carries EmitGraphInfo (v1.compiler.infer_items
         // ResolvedGraph), and owned-data discovery is the consumer that demands this projection.
-        let variant_to_enum = v1_compiler_infer::build_emit_graph_info(
+        let emit_info = v1_compiler_infer::build_emit_graph_info(
             graph.modules.clone(),
             graph.item_registry.clone(),
-        )
-        .variant_to_enum
-        .clone();
+        );
         for (entry, entry_module, marker_count) in group.entries {
             let records =
-                owned_data_decls_for_entry(&graph, &si, &variant_to_enum, &entry, &entry_module)?;
+                owned_data_decls_for_entry(&graph, &si, &emit_info, &entry, &entry_module)?;
             if records.len() != marker_count {
                 return Err(format!(
                     "{}: merged-resolve discovery found {} owned unified_claim record(s) but the entry declares {} top-level `data unified_claim_` marker(s)",
@@ -24297,25 +25543,31 @@ pub(crate) fn dag_tree_holds_any_file(dir: &Path) -> bool {
     false
 }
 
-pub(crate) fn collect_dag_files_tolerant(dir: &Path, out: &mut Vec<PathBuf>) {
-    // This walk swallows unreadable directories. Write failure here must not abort it;
-    // `run_dag_parse_sweep` is the loud required-CI writer.
-    let _ = derived_row_roster::ensure_if_row_dir(dir);
+/// Tolerant of unreadable DIRECTORIES (they are skipped), never of a ledger row directory whose
+/// roster cannot be derived: a legacy physical roster or an unreadable row file is returned as a
+/// located refusal, because swallowing it would hand the caller a short or stale roster.
+pub(crate) fn collect_dag_files_tolerant(
+    dir: &Path,
+    out: &mut Vec<derived_row_roster::AcquiredDag>,
+) -> Result<(), String> {
     let entries = match std::fs::read_dir(dir) {
         Ok(e) => e,
-        Err(_) => return,
+        Err(_) => return Ok(()),
     };
+    let mut here = Vec::new();
     for entry in entries.flatten() {
         let path = entry.path();
         if path.is_dir() {
             if is_cargo_target_output_dir(dir, &path) {
                 continue;
             }
-            collect_dag_files_tolerant(&path, out);
+            collect_dag_files_tolerant(&path, out)?;
         } else if path.extension().and_then(|e| e.to_str()) == Some("dag") {
-            out.push(path);
+            here.push(path);
         }
     }
+    out.extend(derived_row_roster::acquire_dir_files(dir, here)?);
+    Ok(())
 }
 
 fn scan_test_decl_names(content: &str) -> Vec<String> {
@@ -25168,11 +26420,13 @@ pub fn construction_authority_graph_unresolved(
         std::collections::HashMap::new();
     let mut authorities: Vec<(String, String, String)> = Vec::new();
     for root in source_roots {
-        let mut dag_files: Vec<PathBuf> = Vec::new();
-        collect_dag_files_tolerant(Path::new(root), &mut dag_files);
+        let mut dag_files = Vec::new();
+        collect_dag_files_tolerant(Path::new(root), &mut dag_files)?;
         dag_files.sort();
-        for path in dag_files {
-            let content = std::fs::read_to_string(&path)
+        for source in dag_files {
+            let path = source.path();
+            let content = source
+                .read()
                 .map_err(|e| format!("read {}: {e}", path.display()))?;
             let file = path.to_string_lossy().into_owned();
             for (module_path, decl_name) in wall_now_authority_refs(&content) {
@@ -29151,12 +30405,14 @@ pub fn discover_source_root_reads(
     let mut dag_files = Vec::new();
     collect_dag_files(scan_path, &mut dag_files);
 
-    for path in dag_files {
+    for source in dag_files {
+        let path = source.path();
         let rel_forward = path.to_string_lossy().replace('\\', "/");
         if path_matches_any_subpath(&rel_forward, exclude_subpaths) {
             continue;
         }
-        let content = std::fs::read_to_string(&path)
+        let content = source
+            .read()
             .map_err(|e| format!("failed to read {:?}: {}", path, e))?;
         let module_path = extract_module_path(&content).ok_or_else(|| {
             format!(
@@ -29971,10 +31227,11 @@ fn collect_layer_import_scoped_paths(roots: &[String]) -> HashSet<String> {
         if !root_path.is_dir() {
             continue;
         }
-        let mut dag_files: Vec<PathBuf> = Vec::new();
-        collect_dag_files_tolerant(root_path, &mut dag_files);
+        let mut dag_files = Vec::new();
+        collect_dag_files_tolerant(root_path, &mut dag_files)
+            .unwrap_or_else(|cause| panic!("layer-import scope over {root}: {cause}"));
         for file in dag_files {
-            scoped.insert(rel_path_for_layer_import(&file));
+            scoped.insert(rel_path_for_layer_import(file.path()));
         }
     }
     scoped
@@ -29992,10 +31249,11 @@ fn importer_roots_have_importless_dag_files(roots: &[String]) -> bool {
         if !root_path.is_dir() {
             continue;
         }
-        let mut dag_files: Vec<PathBuf> = Vec::new();
-        collect_dag_files_tolerant(root_path, &mut dag_files);
+        let mut dag_files = Vec::new();
+        collect_dag_files_tolerant(root_path, &mut dag_files)
+            .unwrap_or_else(|cause| panic!("importless preflight over {root}: {cause}"));
         for file in dag_files {
-            let content = match std::fs::read_to_string(&file) {
+            let content = match file.read() {
                 Ok(c) => c,
                 Err(_) => continue,
             };
@@ -30023,18 +31281,19 @@ fn project_layer_import_syntax_facts(
     if !root_path.is_dir() {
         return;
     }
-    let mut dag_files: Vec<PathBuf> = Vec::new();
-    collect_dag_files_tolerant(root_path, &mut dag_files);
+    let mut dag_files = Vec::new();
+    collect_dag_files_tolerant(root_path, &mut dag_files)
+        .unwrap_or_else(|cause| panic!("[layer-import] declared root {root}: {cause}"));
     dag_files.sort();
     for file in dag_files {
-        let content = match std::fs::read_to_string(&file) {
+        let content = match file.read() {
             Ok(c) => c,
             Err(_) => continue,
         };
         if extract_import_paths(&content).is_empty() {
             continue;
         }
-        let rel = rel_path_for_layer_import(&file);
+        let rel = rel_path_for_layer_import(file.path());
         let importer = extract_module_path(&content).unwrap_or_default();
         let layer = layer_prefix_from_dotted_module(&importer);
         for import_module in extract_import_paths(&content) {
@@ -31247,12 +32506,45 @@ fn collect_node_refs_inner(
     bound.truncate(restore_to);
 }
 
-/// Count of shared leading dot-separated segments between two module paths (containment proximity).
-fn module_prefix_shared_len(a: &str, b: &str) -> usize {
-    a.split('.')
-        .zip(b.split('.'))
-        .take_while(|(x, y)| x == y)
-        .count()
+/// Declarers on the referencing module's ancestor chain, sorted for a stable AmbiguousBare dump.
+/// Containment is `type_ref_module_path_is_containment_prefix` (segment LCP), the same
+/// predicate `global_bare_chain_candidates` applies to each candidate — not a second rule.
+fn on_chain_declarers<'a>(
+    referencing_module: &str,
+    declarers: impl IntoIterator<Item = &'a String>,
+) -> Vec<&'a String> {
+    let mut out: Vec<&'a String> = declarers
+        .into_iter()
+        .filter(|m| {
+            crate::v1_compiler_infer_env::type_ref_module_path_is_containment_prefix(
+                (*m).clone(),
+                referencing_module.to_string(),
+            )
+        })
+        .collect();
+    out.sort();
+    out
+}
+
+/// Import-less UniqueBare pick: on-chain unique, else the census-unique declarer the
+/// resolver UniqueBinding-accepts, else nothing (never nearest-prefix among homonyms).
+enum ImportlessBarePick<'a> {
+    Unique(&'a String),
+    Ambiguous(Vec<&'a String>),
+    None,
+}
+
+fn pick_importless_bare<'a>(
+    referencing_module: &str,
+    mods: &'a std::collections::BTreeSet<String>,
+) -> ImportlessBarePick<'a> {
+    let on_chain = on_chain_declarers(referencing_module, mods.iter());
+    match on_chain.len() {
+        1 => ImportlessBarePick::Unique(on_chain[0]),
+        n if n > 1 => ImportlessBarePick::Ambiguous(on_chain),
+        _ if mods.len() == 1 => ImportlessBarePick::Unique(mods.iter().next().unwrap()),
+        _ => ImportlessBarePick::None,
+    }
 }
 
 /// Longest module-path prefix of a qualified chain that names a declared module.
@@ -31328,7 +32620,7 @@ pub struct BareRefReachability {
 
 #[cfg(test)]
 mod reference_edge_producer_tests {
-    use super::reference_resolution_facts;
+    use super::*;
 
     fn fixture_root(tag: &str) -> std::path::PathBuf {
         // Under the workspace `target/` (gitignored): `rel_path_for_layer_import` fail-closes on
@@ -31387,8 +32679,8 @@ mod reference_edge_producer_tests {
         let emits_any = |from_sub: &str| edges.iter().any(|e| e.path.contains(from_sub));
 
         assert!(
-            has_edge("refless.dag", "test.decl"),
-            "import-less file referencing shared_fn must yield an edge to its declaring module"
+            !has_edge("refless.dag", "test.decl"),
+            "test.decl and test.reflocal both declare shared_fn; neither is on test.refless's chain, so UniqueBare/AmbiguousBare must not pick a neighbor"
         );
         assert!(
             !emits_any("reflocal.dag"),
@@ -31401,6 +32693,82 @@ mod reference_edge_producer_tests {
         let _ = std::fs::remove_dir_all(&root);
     }
 
+    /// THE IMPORT-LESS WRONG-EDGE RED on the real `dependency_resolution_facts` union
+    /// (`reference_edges_for_file` inside it — not a mutant of the producer).
+    ///
+    /// `frontier.child.consumer` calls `duplicated`. The lexical binder is the ancestor
+    /// `frontier`. A sibling `frontier.child.plant` also declares the spelling and shares a
+    /// longer module-path prefix, so proximity UniqueBare-binds the plant. After the climb the
+    /// edge is the ancestor, never the sibling.
+    #[test]
+    fn proximity_must_not_bind_an_importless_bare_name_to_a_sibling_homonym() {
+        let root = fixture_root("proximity-wrong-edge");
+        let _ = std::fs::remove_dir_all(&root);
+        write(
+            &root,
+            "parent.dag",
+            "module frontier\nfn duplicated() -> Int { 1 }\n",
+        );
+        write(
+            &root,
+            "plant.dag",
+            "module frontier.child.plant\nfn duplicated() -> Int { 99 }\n",
+        );
+        write(
+            &root,
+            "consumer.dag",
+            "module frontier.child.consumer\nfn read() -> Int { duplicated() }\n",
+        );
+        let roots = vec![root.to_string_lossy().into_owned()];
+        let facts = super::dependency_resolution_facts(&roots, &roots, &[]);
+        let consumer_targets: Vec<&str> = facts
+            .iter()
+            .filter(|f| f.path.contains("consumer.dag"))
+            .map(|f| f.import_module.as_str())
+            .collect();
+        assert!(
+            !consumer_targets.contains(&"frontier.child.plant"),
+            "proximity UniqueBare bound the sibling plant: {consumer_targets:?}"
+        );
+        assert!(
+            consumer_targets.contains(&"frontier"),
+            "the on-chain ancestor must remain the UniqueBare target: {consumer_targets:?}"
+        );
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// Positive control: an import-less bare name whose only declarer is an ancestor still
+    /// produces a UniqueBare edge (lexical binding, not pool uniqueness).
+    #[test]
+    fn an_importless_bare_name_on_the_ancestor_chain_still_resolves() {
+        let root = fixture_root("lexical-on-chain");
+        let _ = std::fs::remove_dir_all(&root);
+        write(
+            &root,
+            "parent.dag",
+            "module frontier\nfn duplicated() -> Int { 1 }\n",
+        );
+        write(
+            &root,
+            "consumer.dag",
+            "module frontier.child.consumer\nfn read() -> Int { duplicated() }\n",
+        );
+        write(
+            &root,
+            "unrelated.dag",
+            "module other.real\nfn unused() -> Int { 0 }\n",
+        );
+        let roots = vec![root.to_string_lossy().into_owned()];
+        let facts = super::dependency_resolution_facts(&roots, &roots, &[]);
+        let consumer_targets: Vec<&str> = facts
+            .iter()
+            .filter(|f| f.path.contains("consumer.dag"))
+            .map(|f| f.import_module.as_str())
+            .collect();
+        assert_eq!(consumer_targets, vec!["frontier"]);
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
     fn str_list_value(items: &[String]) -> crate::v1_interpreter::Value {
         super::list_value_from_vec(
             items
@@ -36417,9 +37785,10 @@ mod import_closure_equivalence_tests {
         let mut entries = BTreeSet::new();
         for root in default_source_roots() {
             let mut dag_files = Vec::new();
-            super::collect_dag_files_tolerant(Path::new(&root), &mut dag_files);
+            super::collect_dag_files_tolerant(Path::new(&root), &mut dag_files)
+                .expect("acquire witness layer root");
             for path in dag_files {
-                let rel = workspace_relative_repo_path(&path.to_string_lossy());
+                let rel = workspace_relative_repo_path(&path.path().to_string_lossy());
                 if !rel.ends_with("_test.dag") || floor_discovery_path_excluded(&rel) {
                     continue;
                 }
@@ -36542,12 +37911,18 @@ mod peel_alias_fixpoint_termination {
                     },
                 ),
             );
+            // No files in this probe: the peel tree is synthetic, module_path is empty.
+            // file_modules / module_named_imports therefore come from empty_symbol_index,
+            // the same constructor every other empty SymbolIndex uses.
+            let empty_index = crate::v1_compiler_infer_env::empty_symbol_index();
             let symbol_index = std::rc::Rc::new(crate::v1_compiler_infer_env::SymbolIndex {
-                entries: crate::v1_rt::rc_empty_map(),
+                entries: empty_index.entries.clone(),
                 global_bare,
-                services: crate::v1_rt::rc_empty_map(),
-                transparent_alias_rep: crate::v1_rt::rc_empty_map(),
-                type_head_exposures: crate::v1_rt::rc_empty_map(),
+                services: empty_index.services.clone(),
+                transparent_alias_rep: empty_index.transparent_alias_rep.clone(),
+                type_head_exposures: empty_index.type_head_exposures.clone(),
+                file_modules: empty_index.file_modules.clone(),
+                module_named_imports: empty_index.module_named_imports.clone(),
             });
             let env = std::rc::Rc::new(crate::v1_compiler_infer_env::TypeEnv {
                 module_path: "".to_string(),
@@ -37638,13 +39013,14 @@ mod import_bearing_reference_edges {
         assert!(!t.contains(&"test.fixture.planted".to_string()), "{t:?}");
     }
 
-    /// Control: the same bare name in an IMPORT-LESS file still resolves by proximity (unchanged),
-    /// and a qualified reference in an import-bearing file is still an edge (the other test).
+    /// After the proximity climb: neither homonym is on `test.claim.a`'s ancestor chain, so
+    /// the import-less file must not UniqueBare-bind the nearer planted fixture.
     #[test]
-    fn the_same_bare_name_without_the_import_still_resolves() {
+    fn the_same_bare_name_without_the_import_does_not_proximity_bind() {
         let src = "module test.claim.a\nfn g() -> Int { Present }\n";
         let t = homonym_edges(src);
-        assert!(t.contains(&"test.fixture.planted".to_string()), "{t:?}");
+        assert!(!t.contains(&"test.fixture.planted".to_string()), "{t:?}");
+        assert!(!t.contains(&"std.optional".to_string()), "{t:?}");
     }
 }
 
@@ -38407,6 +39783,7 @@ pub fn prepare_repository_from_corpus(
 ///
 /// So the repository holds a projection with the cache emptied. The resolve is a fresh compile
 /// with no process-level memo, so the original modules drop here and their caches with them.
+///
 /// Every other field is the same `Rc`, so no evaluated value changes.
 fn prepared_graph_without_typecheck_caches(
     graph: &Rc<v1_compiler_compile::ResolvedGraph>,
@@ -39089,20 +40466,16 @@ pub fn reference_targets_of(index: &ReferenceClosureIndex, module: &str) -> Vec<
         if mods.contains(module) {
             continue;
         }
-        let mut best_len = 0usize;
-        let mut winners: Vec<&String> = Vec::new();
-        for m in mods.iter() {
-            let shared = module_prefix_shared_len(module, m);
-            if winners.is_empty() || shared > best_len {
-                best_len = shared;
-                winners.clear();
-                winners.push(m);
-            } else if shared == best_len {
-                winners.push(m);
+        match pick_importless_bare(module, mods) {
+            ImportlessBarePick::None => {}
+            ImportlessBarePick::Unique(w) => {
+                out.insert(w.clone());
+            }
+            ImportlessBarePick::Ambiguous(winners) => {
+                for w in winners {
+                    out.insert(w.clone());
+                }
             }
-        }
-        for w in winners {
-            out.insert(w.clone());
         }
     }
     out.into_iter().collect()
@@ -42619,13 +43992,25 @@ mod reference_closure_single_parse_differential {
 
 #[cfg(test)]
 mod multi_entry_index_sharing_control_tests {
-    use super::{multi_entry_index_sharing_control, MultiEntryIndexBuild};
+    use super::{
+        multi_entry_index_sharing_control, MultiEntryIndexBuild, MultiEntryIndexBuildKind,
+    };
 
     fn build(digest: u64, site: &str) -> MultiEntryIndexBuild {
         MultiEntryIndexBuild {
             name_set_digest: digest,
             modules: 7,
             site: site.to_string(),
+            kind: MultiEntryIndexBuildKind::NameSetIndex,
+        }
+    }
+
+    fn scratch(digest: u64, site: &str) -> MultiEntryIndexBuild {
+        MultiEntryIndexBuild {
+            name_set_digest: digest,
+            modules: 7,
+            site: site.to_string(),
+            kind: MultiEntryIndexBuildKind::ScratchCachesOverExistingSet,
         }
     }
 
@@ -42653,6 +44038,18 @@ mod multi_entry_index_sharing_control_tests {
             "{err}"
         );
     }
+
+    #[test]
+    fn scratch_kind_does_not_count_as_a_second_name_set_index() {
+        assert_eq!(
+            multi_entry_index_sharing_control(&[
+                build(1, "a:1"),
+                scratch(1, "s:1"),
+                scratch(1, "s:2"),
+            ]),
+            Ok(1)
+        );
+    }
 }
 
 #[cfg(test)]
diff --git a/src/v1/stage0/src/cli_run/compile_clean.rs b/src/v1/stage0/src/cli_run/compile_clean.rs
index 53b67d4e8d4..5c3d456c6f3 100644
--- a/src/v1/stage0/src/cli_run/compile_clean.rs
+++ b/src/v1/stage0/src/cli_run/compile_clean.rs
@@ -1107,6 +1107,7 @@ pub fn compile_clean_diagnostic_class_specimen() -> Vec<CompilerDiagnostic> {
         EffectfulSelfRecursionUnrealized { name: s(), span: no_span() },
         ModuleFilenameCollision { filename: s(), modules: istrings(), span: no_span() },
         EmittedSymbolCollision { symbol: s(), identities: istrings(), span: no_span() },
+        NativeEffectRealizationRefused { entry: s(), refusals: istrings(), span: no_span() },
         EffectSummaryIncompleteAtFunctionValue { caller: s(), span: no_span() },
         EffectSummaryIncompleteAtLocalBinding { caller: s(), name: s(), span: no_span() },
         CallArgumentNameUnknown { callee: s(), argument: s(), declared: istrings(), span: no_span() },
@@ -1599,6 +1600,9 @@ pub fn compile_clean_diagnostic_histogram_key(d: &Rc<ErrorNode>) -> (String, Str
         }
         CompilerDiagnostic::ModuleFilenameCollision { .. } => "ModuleFilenameCollision",
         CompilerDiagnostic::EmittedSymbolCollision { .. } => "EmittedSymbolCollision",
+        CompilerDiagnostic::NativeEffectRealizationRefused { .. } => {
+            "NativeEffectRealizationRefused"
+        }
         CompilerDiagnostic::EffectSummaryIncompleteAtFunctionValue { .. } => {
             "EffectSummaryIncompleteAtFunctionValue"
         }
@@ -1717,6 +1721,12 @@ pub fn compile_clean_diagnostic_histogram_key(d: &Rc<ErrorNode>) -> (String, Str
         CompilerDiagnostic::EffectfulSelfRecursionUnrealized { name, .. } => name.clone(),
         CompilerDiagnostic::ModuleFilenameCollision { filename, .. } => filename.clone(),
         CompilerDiagnostic::EmittedSymbolCollision { symbol, .. } => symbol.clone(),
+        CompilerDiagnostic::NativeEffectRealizationRefused {
+            entry, refusals, ..
+        } => format!(
+            "{entry}: {}",
+            refusals.iter().cloned().collect::<Vec<_>>().join("; ")
+        ),
         CompilerDiagnostic::EffectSummaryIncompleteAtFunctionValue { caller, .. } => caller.clone(),
         CompilerDiagnostic::EffectSummaryIncompleteAtLocalBinding { caller, .. } => caller.clone(),
         CompilerDiagnostic::CallArgumentNameUnknown { argument, .. } => argument.clone(),
diff --git a/src/v1/stage0/src/cli_run/derived_row_roster.rs b/src/v1/stage0/src/cli_run/derived_row_roster.rs
index c46bbb189c5..abfeafa9eff 100644
--- a/src/v1/stage0/src/cli_run/derived_row_roster.rs
+++ b/src/v1/stage0/src/cli_run/derived_row_roster.rs
@@ -13,31 +13,36 @@
 //! `rostered_row_join` reads the compiled declaration population, and a `RowType` row the selector
 //! missed refuses there as `DeclaredNotRostered`. The two disagree only loudly.
 //!
-//! THIS IS NOT CALLED FROM EVERY DIRECTORY WALK. It is invoked from the collect sites
-//! (`collect_dag_files_result`, `collect_dag_files_tolerant`, `main.rs` `collect_dag_files`,
-//! `compiler_tests` `collect_dag_recursive`) and from `run_dag_parse_sweep`, which is the
-//! required-CI parse phase. That last site is load-bearing: modules import each roster
-//! (`gunbc.design_ledgers`, `gunbc.ledger_row_coherence`, and for rung drops
-//! `gunbc.rung_drop.standing` and its readers), and the parse join reads that module from the
-//! sweep index. A checkout with no committed roster must derive it before the
-//! sweep lists `.dag` files, or the join reports `RosterModuleAbsent` on the intended steady
-//! state. The collect sites are convenience for other compilers; they are not the merge-path
-//! writer.
+//! THE ROSTER IS CONTRIBUTED TO THE COMPILER'S INPUT IN MEMORY; NOTHING IS WRITTEN. Every walk
+//! that acquires a source population (`collect_dag_files_result`, `collect_dag_files_tolerant`,
+//! `main.rs` `collect_dag_files`, `compiler_tests` `collect_dag_recursive`, and
+//! `run_dag_parse_sweep`, the required-CI parse phase) hands each directory's listing to
+//! `acquire_dir_files`, which returns `AcquiredDag` sources: the listed files, plus -- for a row
+//! directory -- the roster rendered from the sibling contents that same call read. So
+//! `compiler_sources = acquired_sources + derive_rosters(acquired_sources)`, from one read of the
+//! rows, and the parse sweep, the module indexes and entry lookup see one population. The parse
+//! sweep is load-bearing: modules import each roster (`gunbc.design_ledgers`,
+//! `gunbc.ledger_row_coherence`, and for rung drops `gunbc.rung_drop.standing` and its readers),
+//! and the parse join reads that module from the sweep index, or reports `RosterModuleAbsent`.
+//!
+//! An earlier realization wrote a gitignored `roster.dag` into the row directory on every walk.
+//! That made every invocation dirty its own checkout, so deploy candidate admission refused the
+//! checkout the deploy was about to admit. A physical file at the reserved identity now REFUSES,
+//! located; it is never consumed, overridden or deleted by the loader.
+//!
 //! An empty list is a different state — a present `= []` — and only arises if the directory
-//! contains no sibling row files. A `read_dir` or dirent error refuses the collect; a `.dag`
-//! file whose stem is not utf-8 refuses rather than being dropped from the list. If a listed
-//! row file is compiled as `RecurringFailureMode` and the derived list omits it, the parse
-//! join reports `DeclaredNotRostered`. Neither arm is a silent zero.
+//! contains no sibling row files. A `read_dir` or dirent error refuses the collect; an unreadable
+//! row file or a `.dag` file whose stem is not utf-8 refuses rather than being dropped from the
+//! list. If a listed row file is compiled as the row type and the derived list omits it, the
+//! parse join reports `DeclaredNotRostered`. Neither arm is a silent zero.
 //!
-//! The compiler writes this gitignored file as a realization of a capability the substrate
-//! lacks (directory enumeration sufficient to bind each sibling as a typed value). That
-//! write is a read-path side effect; a failed write refuses the collect rather than proceeding
-//! with a missing module. Dissolution: declaration-value binding over the declared population,
-//! same grounding as `gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall`.
+//! This host fold realizes a capability the substrate lacks (directory enumeration sufficient to
+//! bind each sibling as a typed value). Dissolution: declaration-value binding over the declared
+//! population, same grounding as `gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall`.
 
 use std::fs;
 use std::io;
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 pub const ROSTER_BASENAME: &str = "roster.dag";
 
@@ -52,7 +57,7 @@ pub const ROSTER_BASENAME: &str = "roster.dag";
 /// ONE SPELLING, BECAUSE `rostered_row_join` LOOKS THE ROSTER MODULE UP BY NAME.
 /// `ENROLLED_ROW_TYPES` carries each roster's module identity from this table and
 /// `run_rostered_row_join` resolves it with `index_get(index, enrolled.roster_module)` against the
-/// module header `render_roster` WRITES. A divergence fails closed as the typed, located
+/// module header `render_roster` RENDERS. A divergence fails closed as the typed, located
 /// `RosterModuleAbsent` finding.
 ///
 /// THOSE ASSERTIONS ARE NOT A WALL, AND THE RUNG IS 1 -- MITIGATION. They are `#[cfg(test)]` under
@@ -96,7 +101,7 @@ pub const ROW_DIR_REL: &str = RECURRING_FAILURE_MODE.row_dir_rel;
 /// Which derived roster, if any, `rel` IS -- under any sweep root.
 ///
 /// THE ROSTER HAS NO BASE SIDE IN A DIFF, WHICH IS THE WHOLE REASON THIS PREDICATE EXISTS.
-/// The file is gitignored and written on the read path, so it never appears in
+/// The module has no file -- it is contributed in memory on the read path -- so it never appears in
 /// `git diff --name-status` — and a baseline reconstructed by dropping only the paths the diff
 /// TOUCHED therefore inherits the HEAD's roster bytes as the BASE's. That inheritance made a
 /// row append report a binding the base already spelled (`base {} -> head {row}` on a key
@@ -122,7 +127,7 @@ pub fn roster_root_prefix(rel: &str) -> Option<&str> {
 }
 
 /// The roster that `roster_rel` would derive from an ARBITRARY path listing rather than from the
-/// filesystem — the base tree's answer, rendered by the SAME function the writer uses, so there is
+/// filesystem — the base tree's answer, rendered by the SAME function the head acquisition uses, so there is
 /// one authority for the roster's bytes and not a second reconstruction beside it.
 ///
 /// `paths` is a repo-relative listing (`git ls-tree -r --name-only <base>`) and `read` returns a
@@ -179,79 +184,114 @@ fn row_dir_roster(dir: &Path) -> Option<&'static DerivedRowRoster> {
         .find(|roster| dir.ends_with(Path::new(roster.row_dir_rel)))
 }
 
-pub fn ensure_if_row_dir(dir: &Path) -> io::Result<()> {
-    match row_dir_roster(dir) {
-        Some(roster) => ensure_derived_roster(roster, dir),
-        None => Ok(()),
-    }
+/// One `.dag` source admitted into a compiler input population.
+///
+/// A walk over a source root yields these rather than bare paths, because one member of the
+/// population -- each derived ledger roster -- has NO FILE: it is contributed in memory from the
+/// sibling row contents the same walk acquired. A bare `PathBuf` for it would be a phantom that a
+/// consumer's `read_to_string` turns into a missing-file error (or, worse, into whatever stale file
+/// an older binary left there). So there is deliberately no `Deref<Target = Path>`: every consumer
+/// reads through `read`, and the compiler refuses to build a consumer that reaches for the disk.
+///
+/// `content` is `Some` for every file this walk already had to read (the row-directory siblings
+/// whose declared type selects membership) and for the derived roster, so the roster and the
+/// compiler consume the SAME bytes; it is `None` for an ordinary file, read on demand.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct AcquiredDag {
+    path: PathBuf,
+    content: Option<String>,
+    derived: bool,
 }
 
-pub fn ensure_if_row_dir_or_panic(dir: &Path) {
-    if let Err(e) = ensure_if_row_dir(dir) {
-        panic!("failed to derive row roster in {:?}: {}", dir, e);
+impl AcquiredDag {
+    pub fn on_disk(path: PathBuf) -> Self {
+        AcquiredDag {
+            path,
+            content: None,
+            derived: false,
+        }
     }
-}
 
-pub fn ensure_derived_roster(roster: &DerivedRowRoster, dir: &Path) -> io::Result<()> {
-    let names = row_stems(roster, dir)?;
-    let body = render_roster(roster, &names);
-    let path = dir.join(ROSTER_BASENAME);
-    match fs::read(&path) {
-        Ok(existing) if existing == body.as_bytes() => Ok(()),
-        _ => write_atomically(&path, body.as_bytes()),
+    /// The module's location in the source tree. For a derived roster this is the reserved
+    /// identity `<row dir>/roster.dag`, which no file occupies (`acquire_dir_files` refuses one).
+    pub fn path(&self) -> &Path {
+        &self.path
     }
-}
 
-fn write_atomically(path: &Path, body: &[u8]) -> io::Result<()> {
-    let nanos = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|d| d.as_nanos())
-        .unwrap_or(0);
-    let tmp = path.with_file_name(format!(
-        "roster.dag.{}.{}.deriving",
-        std::process::id(),
-        nanos
-    ));
-    fs::write(&tmp, body)?;
-    match fs::rename(&tmp, path) {
-        Ok(()) => Ok(()),
-        Err(e) => {
-            let _ = fs::remove_file(&tmp);
-            Err(e)
+    pub fn is_derived(&self) -> bool {
+        self.derived
+    }
+
+    pub fn read(&self) -> io::Result<String> {
+        match &self.content {
+            Some(content) => Ok(content.clone()),
+            None => fs::read_to_string(&self.path),
         }
     }
 }
 
-fn row_stems(roster: &DerivedRowRoster, dir: &Path) -> io::Result<Vec<String>> {
+/// Admit ONE directory's `.dag` files -- the walker's own listing of `dir`, any order -- into the
+/// compiler input population, contributing the derived roster when `dir` is a ledger row
+/// directory.
+///
+/// THIS NEVER WRITES. The roster is `render_roster` over the sibling rows' declared types, read
+/// from the bytes this call acquired and handed to the compiler in the same population. Source
+/// roots may be read-only; a second invocation sees the same tree the first one did.
+///
+/// A PHYSICAL FILE AT THE RESERVED IDENTITY REFUSES. Older binaries wrote `roster.dag` into the
+/// row directory. Such a file is never consumed (it may be stale against the rows), never silently
+/// overridden by the derived module (two sources for one module identity), and never deleted here
+/// (source loading performs no cleanup) -- the refusal names it and its retirement.
+/// An unreadable sibling or a non-utf8 stem also refuses, located, rather than shortening the list.
+pub fn acquire_dir_files(dir: &Path, files: Vec<PathBuf>) -> Result<Vec<AcquiredDag>, String> {
+    let Some(roster) = row_dir_roster(dir) else {
+        return Ok(files.into_iter().map(AcquiredDag::on_disk).collect());
+    };
+    let mut out = Vec::with_capacity(files.len() + 1);
     let mut names = Vec::new();
-    let entries = fs::read_dir(dir)?;
-    for entry in entries {
-        let entry = entry?;
-        let path = entry.path();
-        if path.extension().and_then(|e| e.to_str()) != Some("dag") {
-            continue;
-        }
-        let stem = match path.file_stem().and_then(|n| n.to_str()) {
-            Some(s) => s,
-            None => {
-                return Err(io::Error::new(
-                    io::ErrorKind::InvalidData,
-                    format!(
-                        "{} row file {:?} has a non-utf8 stem; refusing to derive a shortened roster",
-                        roster.row_module, path
-                    ),
-                ));
-            }
-        };
-        if stem == "roster" {
-            continue;
+    for path in files {
+        let stem = path.file_stem().and_then(|n| n.to_str()).ok_or_else(|| {
+            format!(
+                "{}: {} row file has a non-utf8 stem; refusing to derive a shortened roster",
+                path.display(),
+                roster.row_module
+            )
+        })?;
+        if path.file_name().and_then(|n| n.to_str()) == Some(ROSTER_BASENAME) {
+            return Err(format!(
+                "{}: a physical file occupies the reserved derived-roster module identity {} -- \
+                 the roster is derived in memory from the sibling {} rows, so a file there is \
+                 never consumed and never overridden. It is a legacy artifact of an older gunbc \
+                 that wrote rosters into the checkout; retire it (remove the file) and re-run",
+                path.display(),
+                roster.roster_module,
+                roster.row_type
+            ));
         }
-        if declares_row(&fs::read_to_string(&path)?, stem, roster.row_type) {
+        let content = fs::read_to_string(&path).map_err(|e| {
+            format!(
+                "{}: cannot read {} row file ({e}); refusing to derive a shortened {}",
+                path.display(),
+                roster.row_module,
+                roster.roster_module
+            )
+        })?;
+        if declares_row(&content, stem, roster.row_type) {
             names.push(stem.to_string());
         }
+        out.push(AcquiredDag {
+            path,
+            content: Some(content),
+            derived: false,
+        });
     }
     names.sort();
-    Ok(names)
+    out.push(AcquiredDag {
+        path: dir.join(ROSTER_BASENAME),
+        content: Some(render_roster(roster, &names)),
+        derived: true,
+    });
+    Ok(out)
 }
 
 pub fn render_roster(roster: &DerivedRowRoster, names: &[String]) -> String {
@@ -454,4 +494,200 @@ mod tests {
             );
         }
     }
+
+    // ---- In-memory acquisition (`acquire_dir_files`) and its real consumer, the parse sweep. ----
+
+    fn scratch_workspace(tag: &str) -> std::path::PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "gunbc-derived-roster-{tag}-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .map(|d| d.as_nanos())
+                .unwrap_or(0)
+        ));
+        std::fs::create_dir_all(dir.join("dag/gunbc/rung_drop")).unwrap();
+        dir
+    }
+
+    fn author(ws: &std::path::Path, rel: &str, body: &str) {
+        let path = ws.join(rel);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(path, body).unwrap();
+    }
+
+    fn drop_row(stem: &str) -> String {
+        format!("module gunbc.rung_drop.{stem}\n\ndata {stem}: RungDrop = RungDrop {{ name: \"{stem}\" }}\n")
+    }
+
+    /// Every file under `root`, so "nothing was written" is a statement about the tree, not about
+    /// one expected path.
+    fn tree(root: &std::path::Path) -> Vec<std::path::PathBuf> {
+        let mut out = Vec::new();
+        let mut stack = vec![root.to_path_buf()];
+        while let Some(dir) = stack.pop() {
+            for entry in std::fs::read_dir(&dir).unwrap() {
+                let path = entry.unwrap().path();
+                if path.is_dir() {
+                    stack.push(path.clone());
+                }
+                out.push(path);
+            }
+        }
+        out.sort();
+        out
+    }
+
+    fn rung_drop_fixture(tag: &str) -> std::path::PathBuf {
+        let ws = scratch_workspace(tag);
+        author(&ws, "dag/gunbc/rung_drop/beta.dag", &drop_row("beta"));
+        author(&ws, "dag/gunbc/rung_drop/alpha.dag", &drop_row("alpha"));
+        author(
+            &ws,
+            "dag/gunbc/rung_drop/standing.dag",
+            "module gunbc.rung_drop.standing\n\ndata standing_note: Int = 1\n",
+        );
+        ws
+    }
+
+    fn acquire_rung_drop_dir(ws: &std::path::Path) -> Result<Vec<super::AcquiredDag>, String> {
+        let mut files = Vec::new();
+        crate::cli_run::collect_dag_files_result(&ws.join("dag"), &mut files)?;
+        Ok(files)
+    }
+
+    fn derived_roster_body(files: &[super::AcquiredDag]) -> String {
+        let derived: Vec<_> = files.iter().filter(|f| f.is_derived()).collect();
+        assert_eq!(
+            derived.len(),
+            1,
+            "exactly one derived module per row directory"
+        );
+        derived[0].read().expect("derived content is in memory")
+    }
+
+    #[test]
+    fn acquisition_contributes_the_roster_in_memory_and_writes_nothing() {
+        let ws = rung_drop_fixture("contributes");
+        let before = tree(&ws);
+        let files = acquire_rung_drop_dir(&ws).expect("acquire");
+        let body = derived_roster_body(&files);
+        assert!(body.contains("data rung_drop_roster: List<RungDrop> = [\n  alpha,\n  beta,\n]\n"));
+        assert!(
+            !body.contains("standing"),
+            "a helper module is never a member"
+        );
+        let roster = files.iter().find(|f| f.is_derived()).unwrap();
+        assert_eq!(roster.path(), ws.join("dag/gunbc/rung_drop/roster.dag"));
+        assert!(!roster.path().exists(), "the derived module has no file");
+        // A second invocation sees, and leaves, the identical tree.
+        let again = acquire_rung_drop_dir(&ws).expect("acquire again");
+        assert_eq!(derived_roster_body(&again), body);
+        assert_eq!(
+            tree(&ws),
+            before,
+            "acquisition never writes under a source root"
+        );
+        let _ = std::fs::remove_dir_all(&ws);
+    }
+
+    #[test]
+    fn adding_and_removing_a_row_file_changes_the_roster() {
+        let ws = rung_drop_fixture("membership");
+        author(&ws, "dag/gunbc/rung_drop/gamma.dag", &drop_row("gamma"));
+        let body = derived_roster_body(&acquire_rung_drop_dir(&ws).unwrap());
+        assert!(body.contains("  alpha,\n  beta,\n  gamma,\n]"));
+        std::fs::remove_file(ws.join("dag/gunbc/rung_drop/alpha.dag")).unwrap();
+        let body = derived_roster_body(&acquire_rung_drop_dir(&ws).unwrap());
+        assert!(body.contains("= [\n  beta,\n  gamma,\n]"));
+        assert!(!body.contains("alpha"));
+        let _ = std::fs::remove_dir_all(&ws);
+    }
+
+    #[test]
+    fn a_legacy_physical_roster_refuses_located_and_is_neither_consumed_nor_deleted() {
+        let ws = rung_drop_fixture("legacy");
+        let legacy = ws.join("dag/gunbc/rung_drop/roster.dag");
+        std::fs::write(&legacy, "module gunbc.rung_drop.roster\n\nSTALE\n").unwrap();
+        let err = acquire_rung_drop_dir(&ws).expect_err("a physical roster must refuse");
+        assert!(
+            err.contains(&legacy.display().to_string()),
+            "located: {err}"
+        );
+        assert!(
+            err.contains("gunbc.rung_drop.roster"),
+            "names the identity: {err}"
+        );
+        assert_eq!(
+            std::fs::read_to_string(&legacy).unwrap(),
+            "module gunbc.rung_drop.roster\n\nSTALE\n",
+            "the loader performs no cleanup"
+        );
+        // The tolerant walk refuses identically rather than swallowing it.
+        let mut files = Vec::new();
+        assert!(crate::cli_run::collect_dag_files_tolerant(&ws.join("dag"), &mut files).is_err());
+        let _ = std::fs::remove_dir_all(&ws);
+    }
+
+    #[test]
+    fn an_unreadable_row_input_refuses_rather_than_shortening_the_roster() {
+        let ws = rung_drop_fixture("unreadable");
+        let dir = ws.join("dag/gunbc/rung_drop");
+        // A listed row input whose bytes cannot be read (here: listed, then gone before the read).
+        let bad = dir.join("broken.dag");
+        let err = super::acquire_dir_files(
+            &dir,
+            vec![dir.join("alpha.dag"), bad.clone(), dir.join("beta.dag")],
+        )
+        .err();
+        let err = err.expect("an unreadable listed row refuses");
+        assert!(err.contains(&bad.display().to_string()), "located: {err}");
+        let _ = std::fs::remove_dir_all(&ws);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn acquisition_works_over_read_only_source_roots() {
+        use std::os::unix::fs::PermissionsExt;
+        let ws = rung_drop_fixture("readonly");
+        let dir = ws.join("dag/gunbc/rung_drop");
+        let set = |mode: u32| {
+            for d in [ws.join("dag"), ws.join("dag/gunbc"), dir.clone()] {
+                std::fs::set_permissions(&d, std::fs::Permissions::from_mode(mode)).unwrap();
+            }
+        };
+        set(0o555);
+        let result = acquire_rung_drop_dir(&ws);
+        set(0o755);
+        let body = derived_roster_body(&result.expect("read-only roots acquire"));
+        assert!(body.contains("  alpha,\n  beta,\n]"));
+        assert!(!dir.join("roster.dag").exists());
+        let _ = std::fs::remove_dir_all(&ws);
+    }
+
+    /// THE PRODUCER -> CONSUMER WITNESS: the required-CI parse sweep, over unchanged source roots,
+    /// indexes the derived roster module from the in-memory contribution and leaves the tree as
+    /// it found it.
+    #[test]
+    fn the_parse_sweep_indexes_the_derived_roster_without_writing_it() {
+        let ws = rung_drop_fixture("sweep");
+        let before = tree(&ws);
+        let sweep = crate::cli_run::run_dag_parse_sweep(&ws, &["dag"]).expect("sweep parses");
+        let record =
+            crate::cli_run::declaration_index::index_get(&sweep.index, "gunbc.rung_drop.roster")
+                .expect("the derived roster module is in the sweep index");
+        assert_eq!(record.rel_path, "dag/gunbc/rung_drop/roster.dag");
+        assert!(record.declared.contains("rung_drop_roster"));
+        assert!(crate::cli_run::declaration_index::index_get(
+            &sweep.index,
+            "gunbc.rung_drop.standing"
+        )
+        .is_some());
+        assert_eq!(
+            tree(&ws),
+            before,
+            "the sweep writes nothing under its roots"
+        );
+        let _ = std::fs::remove_dir_all(&ws);
+    }
 }
diff --git a/src/v1/stage0/src/cli_run/emit_host.rs b/src/v1/stage0/src/cli_run/emit_host.rs
index 915ca8dfec5..8bf1ed91d95 100644
--- a/src/v1/stage0/src/cli_run/emit_host.rs
+++ b/src/v1/stage0/src/cli_run/emit_host.rs
@@ -51,7 +51,7 @@ use std::io::Write;
 use std::path::{Path, PathBuf};
 use std::rc::Rc;
 use std::sync::atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering};
-use std::sync::{Arc, Mutex, OnceLock, RwLock};
+use std::sync::{Arc, Mutex, RwLock};
 
 use crate::coproduct_reflection::{decl_facts_corpus_walk, DeclFactRaw};
 use crate::module_path_index::{
@@ -3123,12 +3123,21 @@ pub(crate) fn fixture_closure_union_digest(members: &BTreeMap<String, String>) -
 ///     is the compile's list followed by the emitter's (`emit_resolved_for_target_selected`), so
 ///     the suffix past the compile's length is exactly what the emitter added.
 ///
-/// Unmodeled rust stderr-capture channels (`gunbc.rung_drop`
-/// `fixture_closure_union_unmodeled_stderr_capture`) are a typed exclusion, not this refusal:
-/// those services are stripped from the emit graph and listed on the observation. A sibling
-/// unmodeled key or any other emit error still refuses.
+/// Rust realizes the three capture-accounting channels. An unmodeled sibling key or any
+/// other emit error still refuses. The retired drop
+/// `fixture_closure_union_unmodeled_stderr_capture` no longer strips a service.
 pub(crate) fn fixture_closure_union_emit_receipt(
     union: &FixtureClosureUnion,
+) -> Result<FixtureClosureUnionObserved, String> {
+    fixture_closure_union_emit_receipt_staged(union, &|_, _, _| {})
+}
+
+/// The receipt with a stage observer: `on_stage(stage, members, wall_ms)` is called as each stage
+/// completes, BEFORE the next stage's work starts, so a run cancelled inside the phase still
+/// names the stage that was running. The caller owns the printing (a library crate may not).
+pub(crate) fn fixture_closure_union_emit_receipt_staged(
+    union: &FixtureClosureUnion,
+    on_stage: &dyn Fn(&str, usize, u128),
 ) -> Result<FixtureClosureUnionObserved, String> {
     let digest = fixture_closure_union_digest(&union.members);
     let refuse = |cause: &str, what: String| {
@@ -3172,7 +3181,16 @@ pub(crate) fn fixture_closure_union_emit_receipt(
             })
         })
         .collect();
+    let stage_started = std::time::Instant::now();
+    let stage_line = |stage: &str| {
+        on_stage(
+            stage,
+            union.members.len(),
+            stage_started.elapsed().as_millis(),
+        );
+    };
     let resolved = v1_compiler_compile::compile_to_resolved(Rc::new(sources.into()));
+    stage_line("compile-done");
     let located = |d: &Rc<ErrorNode>| {
         format!(
             "module={} reason=`{}`",
@@ -3198,12 +3216,13 @@ pub(crate) fn fixture_closure_union_emit_receipt(
             ),
         ));
     }
-    let (resolved, excluded) = union_emit_graph_excluding_unmodeled_stderr_capture(resolved);
     let compile_diagnostics = resolved.diagnostics.len();
+    stage_line("exclusion-done");
     let rendered = v1_compiler_compile::emit_resolved_for_target(
         resolved,
         crate::v1_compiler_artifact::RenderTarget::Rust,
     );
+    stage_line("emit-done");
     let emitted: Vec<&Rc<ErrorNode>> = rendered
         .diagnostics
         .iter()
@@ -3229,369 +3248,10 @@ pub(crate) fn fixture_closure_union_emit_receipt(
         digest,
         files: rendered.files.len(),
         emit_diagnostics: emitted.len(),
-        excluded,
-    })
-}
-
-/// Deleting either the drop row or its typed carrier fails this compile. The union compiles
-/// the carrier through `compile_to_resolved` and evaluates `exclusion` (review 77125).
-const STDERR_CAPTURE_GAP_CARRIER_SOURCE: &str =
-    include_str!("../../../../../dag/gunbc/stderr_capture_gap_exclusion.dag");
-const STDERR_CAPTURE_POLICY_DROP_SOURCE: &str = include_str!(
-    "../../../../../dag/gunbc/rung_drop/fixture_closure_union_unmodeled_stderr_capture.dag"
-);
-
-struct CaptureGapExclusion {
-    drop_identity: String,
-    declaring_module: String,
-    service: String,
-    operation_qualified: String,
-    operation_bare: String,
-}
-
-fn record_field_string(
-    ctx: &crate::v1_interpreter::InterpContext,
-    fields: &[(crate::v1_interpreter::Symbol, crate::v1_interpreter::Value)],
-    name: &str,
-) -> Result<String, String> {
-    use crate::v1_interpreter::Value;
-    match fields
-        .iter()
-        .find(|(sym, _)| ctx.sym_eq(*sym, name))
-        .map(|(_, v)| v)
-    {
-        Some(Value::Str(s)) => Ok(s.to_string()),
-        Some(other) => Err(format!(
-            "cause=CaptureGapExclusionFieldNotString field={name} value={other:?}"
-        )),
-        None => Err(format!(
-            "cause=CaptureGapExclusionFieldMissing field={name}"
-        )),
-    }
-}
-
-fn load_capture_gap_exclusion() -> Result<CaptureGapExclusion, String> {
-    let _drop_row_tether = STDERR_CAPTURE_POLICY_DROP_SOURCE;
-    let files = vec![Rc::new(v1_compiler_compile::SourceFile {
-        path: "dag/gunbc/stderr_capture_gap_exclusion.dag".to_string(),
-        content: STDERR_CAPTURE_GAP_CARRIER_SOURCE.to_string(),
-    })];
-    let resolved = v1_compiler_compile::compile_to_resolved(Rc::new(files.into()));
-    let located = |d: &Rc<ErrorNode>| {
-        format!(
-            "module={} reason=`{}`",
-            d.module_name,
-            crate::v1_std_core::diagnostic_to_message(d.diagnostic.clone())
-        )
-    };
-    if v1_compiler_compile::emittable_graph(resolved.clone()).is_none() {
-        let blocking: Vec<String> = resolved
-            .diagnostics
-            .iter()
-            .filter(|d| {
-                crate::v1_std_core::is_interpreter_blocking_diagnostic(d.diagnostic.clone())
-            })
-            .map(located)
-            .collect();
-        return Err(format!(
-            "cause=CaptureGapExclusionUncompilable drop_row_bytes={} diagnostics={}",
-            _drop_row_tether.len(),
-            blocking.join(" | ")
-        ));
-    }
-    let Some(graph) = resolved.graph.clone() else {
-        return Err(format!(
-            "cause=CaptureGapExclusionUncompilable drop_row_bytes={} -- resolved graph is none",
-            _drop_row_tether.len()
-        ));
-    };
-    let ctx = make_eval_context(
-        &graph,
-        resolved.source_indices.clone(),
-        crate::v1_interpreter::ExecutionMode::Hermetic,
-    );
-    let val = crate::v1_interpreter::with_active_context(&ctx, || {
-        match crate::v1_interpreter::eval_data_item_value(&ctx, "exclusion") {
-            Ok(Some(v)) => Ok(Some(v)),
-            Ok(None) => crate::v1_interpreter::eval_data_item_value(
-                &ctx,
-                "gunbc.stderr_capture_gap_exclusion.exclusion",
-            ),
-            Err(e) => Err(e),
-        }
-    })
-    .map_err(|e| format!("cause=CaptureGapExclusionEvalFailed error={e}"))?
-    .ok_or_else(|| "cause=CaptureGapExclusionDataMissing name=exclusion".to_string())?;
-    let crate::v1_interpreter::Value::Record {
-        ref fields,
-        type_name,
-    } = val
-    else {
-        return Err(format!("cause=CaptureGapExclusionNotRecord value={val:?}"));
-    };
-    if !ctx.sym_eq(type_name, "StderrCaptureGapExclusion")
-        && !ctx.sym_eq(
-            type_name,
-            "gunbc.stderr_capture_gap_exclusion.StderrCaptureGapExclusion",
-        )
-    {
-        return Err(format!(
-            "cause=CaptureGapExclusionUnexpectedType type={}",
-            ctx.resolve(type_name)
-        ));
-    }
-    Ok(CaptureGapExclusion {
-        drop_identity: record_field_string(&ctx, fields.as_slice(), "drop_identity")?,
-        declaring_module: record_field_string(&ctx, fields.as_slice(), "declaring_module")?,
-        service: record_field_string(&ctx, fields.as_slice(), "service")?,
-        operation_qualified: record_field_string(&ctx, fields.as_slice(), "operation_qualified")?,
-        operation_bare: record_field_string(&ctx, fields.as_slice(), "operation_bare")?,
-    })
-}
-
-fn capture_gap_exclusion() -> Result<&'static CaptureGapExclusion, &'static str> {
-    static GAP: OnceLock<Result<CaptureGapExclusion, String>> = OnceLock::new();
-    match GAP.get_or_init(load_capture_gap_exclusion) {
-        Ok(gap) => Ok(gap),
-        Err(e) => Err(e.as_str()),
-    }
-}
-
-/// Facts `v1.compiler.emit` `shell_emission_refusal_fact` renders for
-/// `ShellChannelNotRealizedByTarget` on the three stderr-accounting channels the drop names.
-/// Not every channel `shell_channel_realized_by_target` currently returns false for: a later
-/// unrealized stdout-side channel must still refuse the union (review 77034).
-fn rust_stderr_capture_channel_not_realized_facts() -> &'static BTreeSet<String> {
-    static FACTS: OnceLock<BTreeSet<String>> = OnceLock::new();
-    FACTS.get_or_init(|| {
-        use crate::v1_compiler_artifact::RenderTarget;
-        use crate::v1_compiler_emit::{
-            render_target_name, shell_channel_realized_by_target, shell_emission_refusal_fact,
-            shell_result_channel_key, ShellEmissionRefusal, ShellResultChannel,
-        };
-        let target = RenderTarget::Rust;
-        let target_name = render_target_name(target);
-        [
-            ShellResultChannel::ShellChanStderrTruncated,
-            ShellResultChannel::ShellChanStderrTotalBytes,
-            ShellResultChannel::ShellChanStderrRetainedBytes,
-        ]
-        .into_iter()
-        .filter(|channel| !shell_channel_realized_by_target(*channel, target))
-        .map(|channel| {
-            shell_emission_refusal_fact(Rc::new(
-                ShellEmissionRefusal::ShellChannelNotRealizedByTarget {
-                    key: shell_result_channel_key(channel),
-                    target_name: target_name.clone(),
-                },
-            ))
-        })
-        .collect()
-    })
-}
-
-/// The drop population: rust shell TransportEmissionNotModeled on exactly
-/// `extdeps.gunbc` `WitnessBin.Run` whose fact equals a ShellChannelNotRealizedByTarget
-/// fact for an unrealized rust channel. Any other module, service, or operation stays rendered.
-fn stderr_capture_policy_gap_service(d: &Rc<ErrorNode>) -> Option<(String, String)> {
-    let Ok(gap) = capture_gap_exclusion() else {
-        return None;
-    };
-    match &*d.diagnostic {
-        crate::v1_std_core::CompilerDiagnostic::TransportEmissionNotModeled {
-            transport_kind,
-            service,
-            operation,
-            declaring_module,
-            target,
-            missing_realization_fact,
-            ..
-        } if transport_kind == "shell"
-            && target == "rust"
-            && declaring_module.as_str() == gap.declaring_module
-            && service.as_str() == gap.service
-            && is_drop_run_operation(operation)
-            && rust_stderr_capture_channel_not_realized_facts()
-                .contains(missing_realization_fact) =>
-        {
-            Some((declaring_module.clone(), service.clone()))
-        }
-        _ => None,
-    }
-}
-
-fn is_drop_run_operation(operation: &str) -> bool {
-    let Ok(gap) = capture_gap_exclusion() else {
-        return false;
-    };
-    operation == gap.operation_bare || operation == gap.operation_qualified
-}
-
-fn transport_emission_run(d: &Rc<ErrorNode>) -> Option<(String, String)> {
-    match &*d.diagnostic {
-        crate::v1_std_core::CompilerDiagnostic::TransportEmissionNotModeled {
-            service,
-            operation,
-            declaring_module,
-            ..
-        } if is_drop_run_operation(operation) => Some((declaring_module.clone(), service.clone())),
-        _ => None,
-    }
-}
-
-/// The selection fold: among supplied unmodeled-transport rows, keep `(module, service)`
-/// only when every Run row for that pair is a capture-gap fact. Production feeds it the
-/// three emit diagnostic streams; tests supply rows.
-fn select_run_operations_excluded_for_stderr_capture_gap(
-    unmodeled: &[Rc<ErrorNode>],
-) -> BTreeSet<(String, String)> {
-    let mut gap_runs: BTreeSet<(String, String)> = BTreeSet::new();
-    for d in unmodeled {
-        if let Some(key) = stderr_capture_policy_gap_service(d) {
-            gap_runs.insert(key);
-        }
-    }
-    gap_runs
-        .into_iter()
-        .filter(|key| {
-            unmodeled
-                .iter()
-                .filter(|d| transport_emission_run(d).as_ref() == Some(key))
-                .all(|d| stderr_capture_policy_gap_service(d).is_some())
-        })
-        .collect()
-}
-
-/// `extdeps.gunbc` `gunbc.WitnessBin.Run` when that operation's unmodeled-transport refusals
-/// are solely the rust stderr-capture gap. Other operations on the same service are not members.
-fn run_operations_excluded_for_stderr_capture_gap(
-    typed: &Rc<crate::v1_compiler_infer_items::ResolvedGraph>,
-) -> BTreeSet<(String, String)> {
-    let target = crate::v1_compiler_artifact::RenderTarget::Rust;
-    let mut unmodeled = Vec::new();
-    unmodeled.extend(
-        crate::v1_compiler_emit::unmodeled_file_transport_diagnostics(typed.clone(), target)
-            .iter()
-            .cloned(),
-    );
-    unmodeled.extend(
-        crate::v1_compiler_emit::unmodeled_shell_transport_diagnostics(typed.clone(), target)
-            .iter()
-            .cloned(),
-    );
-    unmodeled.extend(
-        crate::v1_compiler_emit::unmodeled_rest_transport_diagnostics(typed.clone(), target)
-            .iter()
-            .cloned(),
-    );
-    select_run_operations_excluded_for_stderr_capture_gap(&unmodeled)
-}
-
-fn strip_excluded_run_operations(
-    typed: Rc<crate::v1_compiler_infer_items::ResolvedGraph>,
-    excluded: &BTreeSet<(String, String)>,
-) -> Rc<crate::v1_compiler_infer_items::ResolvedGraph> {
-    if excluded.is_empty() {
-        return typed;
-    }
-    let modules = Rc::new(
-        typed
-            .modules
-            .iter()
-            .map(|tm| {
-                let module_name = crate::v1_compiler_infer_env::authored_name(
-                    tm.type_env.clone(),
-                    tm.module.clone(),
-                );
-                let items = Rc::new(
-                    tm.items
-                        .iter()
-                        .filter_map(|item| {
-                            if item.module_item_kind
-                                != crate::v1_std_core::ParsedModuleItemKind::ModuleItemService
-                            {
-                                return Some((*item).clone());
-                            }
-                            let service = crate::v1_compiler_infer_env::authored_name(
-                                tm.type_env.clone(),
-                                (*item).clone(),
-                            );
-                            if !excluded.contains(&(module_name.clone(), service)) {
-                                return Some((*item).clone());
-                            }
-                            let kept: im::Vector<_> = item
-                                .children
-                                .iter()
-                                .filter(|op| {
-                                    !is_drop_run_operation(
-                                        &crate::v1_compiler_infer_env::authored_name(
-                                            tm.type_env.clone(),
-                                            (*op).clone(),
-                                        ),
-                                    )
-                                })
-                                .cloned()
-                                .collect();
-                            if kept.is_empty() {
-                                return None;
-                            }
-                            Some(Rc::new({
-                                let mut node = (**item).clone();
-                                node.children = Rc::new(kept);
-                                node
-                            }))
-                        })
-                        .collect::<im::Vector<_>>(),
-                );
-                Rc::new(crate::v1_compiler_infer_items::TypedModule {
-                    items,
-                    ..(**tm).clone()
-                })
-            })
-            .collect::<im::Vector<_>>(),
-    );
-    Rc::new(crate::v1_compiler_infer_items::ResolvedGraph {
-        modules,
-        ..(*typed).clone()
+        excluded: Vec::new(),
     })
 }
 
-/// Compile stays the full closure. Emit strips only `gunbc.WitnessBin.Run` when its rust
-/// refusals are solely the capture-policy gap. Other operations on that service stay.
-fn union_emit_graph_excluding_unmodeled_stderr_capture(
-    resolved: Rc<v1_compiler_compile::ResolvedPipelineResult>,
-) -> (Rc<v1_compiler_compile::ResolvedPipelineResult>, Vec<String>) {
-    let Some(typed) = resolved.graph.clone() else {
-        return (resolved, Vec::new());
-    };
-    let excluded_keys = run_operations_excluded_for_stderr_capture_gap(&typed);
-    if excluded_keys.is_empty() {
-        return (resolved, Vec::new());
-    }
-    let Ok(gap) = capture_gap_exclusion() else {
-        return (resolved, Vec::new());
-    };
-    let excluded: Vec<String> = excluded_keys
-        .iter()
-        .map(|(module, service)| {
-            format!(
-                "module={module} service={service} operation={} \
-                 cause=ShellChannelNotRealizedByTarget \
-                 fact=stderr_capture_policy_unrealized drop={}",
-                gap.operation_qualified, gap.drop_identity,
-            )
-        })
-        .collect();
-    let graph = strip_excluded_run_operations(typed, &excluded_keys);
-    (
-        Rc::new(v1_compiler_compile::ResolvedPipelineResult {
-            graph: Some(graph),
-            ..(*resolved).clone()
-        }),
-        excluded,
-    )
-}
-
 /// The red control's member: a non-tail effectful self-call, which the rust emitter refuses
 /// (`EffectfulSelfRecursionUnrealized`, the derived form exercised by
 /// `test.claim.effectful_item_kind_collapse_witness_test`).
@@ -3708,8 +3368,8 @@ pub(crate) fn fixture_closure_union_controls() -> Result<(u128, u128), String> {
             )))
         }
     }
-    // A fixture whose closure reaches extdeps.gunbc is admitted with the typed capture-policy
-    // exclusion, not as FixtureClosureUnionEmitRefused (the #13420 floor after #13437).
+    // A fixture whose closure reaches extdeps.gunbc is admitted by rust emit: WitnessBin.Run
+    // is realized, and the retired capture-gap strip is gone (review 77726).
     let gunbc_observed = fixture_closure_union_emit_receipt(
         &fixture_closure_union_control_union(FIXTURE_CLOSURE_GUNBC_REACH_MEMBER)
             .map_err(&refuse)?,
@@ -3719,21 +3379,13 @@ pub(crate) fn fixture_closure_union_controls() -> Result<(u128, u128), String> {
             "a fixture whose closure reaches extdeps.gunbc refused: {refusal}"
         ))
     })?;
-    if !gunbc_observed.excluded.iter().any(|row| {
-        let Ok(gap) = capture_gap_exclusion() else {
-            return false;
-        };
-        row.contains(&format!("module={}", gap.declaring_module))
-            && row.contains(&format!("operation={}", gap.operation_qualified))
-            && row.contains("cause=ShellChannelNotRealizedByTarget")
-            && row.contains(&gap.drop_identity)
-    }) {
+    if !gunbc_observed.excluded.is_empty() {
         return Err(refuse(format!(
-            "a fixture whose closure reaches extdeps.gunbc was admitted without the typed exclusion: {gunbc_observed:?}"
+            "the retired capture-gap strip must not still exclude a member: {gunbc_observed:?}"
         )));
     }
     // A real emit error in a member the union still renders still refuses, even when the same
-    // closure also reaches the excluded service.
+    // closure also reaches extdeps.gunbc.
     match fixture_closure_union_emit_receipt(
         &fixture_closure_union_control_union(FIXTURE_CLOSURE_GUNBC_AND_REAL_EMIT_ERROR)
             .map_err(&refuse)?,
@@ -3748,7 +3400,7 @@ pub(crate) fn fixture_closure_union_controls() -> Result<(u128, u128), String> {
         }
         Ok(observed) => {
             return Err(refuse(format!(
-                "a real emit error beside the excluded gunbc service did not refuse the union: {observed:?}"
+                "a real emit error beside a gunbc-reaching closure did not refuse the union: {observed:?}"
             )))
         }
     }
@@ -3778,10 +3430,6 @@ mod fixture_closure_union_tests {
     /// The recorder and the union are process-wide; tests that touch them run one at a time.
     static UNION_TEST_LOCK: Mutex<()> = Mutex::new(());
 
-    fn gap_excl() -> &'static CaptureGapExclusion {
-        capture_gap_exclusion().unwrap_or_else(|e| panic!("{e}"))
-    }
-
     /// An empty union is a bypassed recording seam and refuses (review 76399).
     #[test]
     fn an_empty_union_refuses() {
@@ -3886,340 +3534,477 @@ mod fixture_closure_union_tests {
         assert!(union.conflicts.contains("dag/a.dag"));
     }
 
+    const STDERR_CAPTURE_MEMBER: &str = "module efr_member\nimport std.shell_stream_capture { WitnessStderrCapturePolicy, BoundedTail }\nimport std.measure { byte_size }\nservice Bin {\n  operation Run {\n    input {\n      bin_path: String\n      stderr_capture: WitnessStderrCapturePolicy = BoundedTail { bytes: byte_size(count: 16) }\n    }\n    output {\n      success: Bool from \"exit_success\"\n      stderr_truncated: Bool from \"stderr_truncated\"\n      stderr_total_bytes: Int from \"stderr_total_bytes\"\n      stderr_retained_bytes: Int from \"stderr_retained_bytes\"\n    }\n    transport shell { argv: [\"{bin_path}\"] }\n  }\n}\n";
+
+    const STDERR_CAPTURE_UNMODELED_SIBLING: &str = "module efr_member\nimport std.shell_stream_capture { WitnessStderrCapturePolicy, BoundedTail }\nimport std.measure { byte_size }\nservice Bin {\n  operation Run {\n    input {\n      bin_path: String\n      stderr_capture: WitnessStderrCapturePolicy = BoundedTail { bytes: byte_size(count: 16) }\n    }\n    output {\n      success: Bool from \"exit_success\"\n      stderr_truncated: Bool from \"stderr_truncated\"\n      stderr_total_bytes: Int from \"stderr_total_bytes\"\n      stderr_retained_bytes: Int from \"stderr_retained_bytes\"\n    }\n    transport shell { argv: [\"{bin_path}\"] }\n  }\n  operation Weird {\n    input { bin_path: String }\n    output { digest: String from \"stderr_digest_hex\" }\n    transport shell { argv: [\"{bin_path}\"] }\n  }\n}\n";
+
+    const STDERR_CAPTURE_WITHOUT_POLICY: &str = "module efr_member\nservice Bin {\n  operation Run {\n    input { bin_path: String }\n    output {\n      success: Bool from \"exit_success\"\n      stderr_truncated: Bool from \"stderr_truncated\"\n    }\n    transport shell { argv: [\"{bin_path}\"] }\n  }\n}\n";
+
+    const STDERR_CAPTURE_STRING_POLICY: &str = "module efr_member\nservice Bin {\n  operation Run {\n    input {\n      bin_path: String\n      stderr_capture: String\n    }\n    output {\n      success: Bool from \"exit_success\"\n      stderr_truncated: Bool from \"stderr_truncated\"\n    }\n    transport shell { argv: [\"{bin_path}\"] }\n  }\n}\n";
+
+    const STDERR_CAPTURE_OPTIONAL_POLICY: &str = "module efr_member\nimport std.shell_stream_capture { WitnessStderrCapturePolicy }\nservice Bin {\n  operation Run {\n    input {\n      bin_path: String\n      stderr_capture: WitnessStderrCapturePolicy?\n    }\n    output {\n      success: Bool from \"exit_success\"\n      stderr_truncated: Bool from \"stderr_truncated\"\n    }\n    transport shell { argv: [\"{bin_path}\"] }\n  }\n}\n";
+
+    const STDERR_CAPTURE_COLLECTION_POLICY: &str = "module efr_member\nimport std.shell_stream_capture { WitnessStderrCapturePolicy }\nservice Bin {\n  operation Run {\n    input {\n      bin_path: String\n      stderr_capture: List<WitnessStderrCapturePolicy>\n    }\n    output {\n      success: Bool from \"exit_success\"\n      stderr_truncated: Bool from \"stderr_truncated\"\n    }\n    transport shell { argv: [\"{bin_path}\"] }\n  }\n}\n";
+
+    const STDERR_CAPTURE_HOMONYM_POLICY: &str = "module efr_member\ntype WitnessStderrCapturePolicy { mark: String }\nservice Bin {\n  operation Run {\n    input {\n      bin_path: String\n      stderr_capture: WitnessStderrCapturePolicy\n    }\n    output {\n      success: Bool from \"exit_success\"\n      stderr_truncated: Bool from \"stderr_truncated\"\n    }\n    transport shell { argv: [\"{bin_path}\"] }\n  }\n}\n";
+
+    const GUNBC_MODULE_REACH_MEMBER: &str =
+        "module efr_member\nimport extdeps.gunbc { packages }\nfn ignore() -> Int { 0 }\n";
+
+    /// RED: extending a fixture through the process-shared index left that fixture's
+    /// both-closure in the caches the claim fold reads. GREEN: the same walk still
+    /// closes (syllogism reaches its reference provider) and the shared typed cache
+    /// and both-closure edge map do not grow.
     #[test]
-    fn capture_gap_keys_on_shell_channel_not_realized_fact_equality() {
-        use crate::v1_compiler_emit::{shell_emission_refusal_fact, ShellEmissionRefusal};
-        use crate::v1_std_core::{make_error_node, CompilerDiagnostic};
-        let span = crate::v1_std_core::kernel_span("probe".to_string());
-        let mk = |fact: String| {
-            let gap = gap_excl();
-            make_error_node(
-                Rc::new(CompilerDiagnostic::TransportEmissionNotModeled {
-                    transport_kind: "shell".to_string(),
-                    service: gap.service.to_string(),
-                    operation: gap.operation_qualified.to_string(),
-                    declaring_module: gap.declaring_module.to_string(),
-                    target: "rust".to_string(),
-                    missing_realization_fact: fact,
-                    span: span.clone(),
-                }),
-                gap.declaring_module.to_string(),
-            )
-        };
-        let gap = shell_emission_refusal_fact(Rc::new(
-            ShellEmissionRefusal::ShellChannelNotRealizedByTarget {
-                key: "stderr_truncated".to_string(),
-                target_name: "rust".to_string(),
-            },
-        ));
-        let unmodeled_key =
-            shell_emission_refusal_fact(Rc::new(ShellEmissionRefusal::ShellOutputKeyNotModeled {
-                key: "not_a_channel".to_string(),
-            }));
-        let substring_poison =
-            "unmodeled key 'not_a_channel' implements no stderr capture policy".to_string();
-        let stdout_unrealized = shell_emission_refusal_fact(Rc::new(
-            ShellEmissionRefusal::ShellChannelNotRealizedByTarget {
-                key: "stdout".to_string(),
-                target_name: "rust".to_string(),
-            },
-        ));
-        assert!(stderr_capture_policy_gap_service(&mk(gap.clone())).is_some());
-        assert!(stderr_capture_policy_gap_service(&mk(unmodeled_key)).is_none());
-        assert!(stderr_capture_policy_gap_service(&mk(substring_poison)).is_none());
-        assert!(stderr_capture_policy_gap_service(&mk(stdout_unrealized)).is_none());
-        let other_module = make_error_node(
-            Rc::new(CompilerDiagnostic::TransportEmissionNotModeled {
-                transport_kind: "shell".to_string(),
-                service: gap_excl().service.to_string(),
-                operation: gap_excl().operation_qualified.to_string(),
-                declaring_module: "extdeps.other".to_string(),
-                target: "rust".to_string(),
-                missing_realization_fact: gap,
-                span: span.clone(),
-            }),
-            "extdeps.other".to_string(),
+    fn fixture_closure_extension_does_not_populate_the_process_shared_index() {
+        let _serial = UNION_TEST_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let layers = crate::cli_run::witness_layer_roots();
+        let shared = super::entry_resolve::try_process_shared_index(&layers)
+            .unwrap_or_else(|e| panic!("process-shared index is the subject of this control: {e}"));
+        let typed_before = shared.typed_module_cache.borrow().len();
+        let edges_before = shared
+            .both_closure_edges
+            .borrow()
+            .as_ref()
+            .map(|e| e.ref_out.len())
+            .unwrap_or(0);
+        let admissions_before = shared.bare_reference_admission.borrow().len();
+        let module_index = crate::cli_run::build_module_path_index_from_witness_roots();
+        let sources = crate::cli_run::resolve_virtual_source_with_imports(
+            FIXTURE_SOURCE_PATH,
+            FIXTURE_CLOSURE_REFERENCE_REACH_MEMBER,
+            &module_index,
+        )
+        .unwrap_or_else(|e| panic!("fixture closure must still close: {e}"));
+        assert!(
+            sources.len() > 1,
+            "the syllogism specimen must pull its provider, got {}",
+            sources.len()
+        );
+        let typed_after = shared.typed_module_cache.borrow().len();
+        let edges_after = shared
+            .both_closure_edges
+            .borrow()
+            .as_ref()
+            .map(|e| e.ref_out.len())
+            .unwrap_or(0);
+        let admissions_after = shared.bare_reference_admission.borrow().len();
+        assert_eq!(
+            typed_before, typed_after,
+            "fixture closure must not admit typed-cache rows on the process-shared index"
+        );
+        assert_eq!(
+            edges_before, edges_after,
+            "fixture closure must not grow both_closure_edges on the process-shared index"
+        );
+        assert_eq!(
+            admissions_before, admissions_after,
+            "fixture closure must not grow bare-reference admission on the process-shared index"
         );
-        assert!(stderr_capture_policy_gap_service(&other_module).is_none());
-    }
-
-    fn gap_fact() -> String {
-        use crate::v1_compiler_emit::{shell_emission_refusal_fact, ShellEmissionRefusal};
-        shell_emission_refusal_fact(Rc::new(
-            ShellEmissionRefusal::ShellChannelNotRealizedByTarget {
-                key: "stderr_truncated".to_string(),
-                target_name: "rust".to_string(),
-            },
-        ))
     }
 
-    fn transport_row(
-        module: &str,
-        service: &str,
-        operation: &str,
-        fact: String,
-    ) -> Rc<crate::v1_std_core::ErrorNode> {
-        crate::v1_std_core::make_error_node(
-            Rc::new(
-                crate::v1_std_core::CompilerDiagnostic::TransportEmissionNotModeled {
-                    transport_kind: "shell".to_string(),
-                    service: service.to_string(),
-                    operation: operation.to_string(),
-                    declaring_module: module.to_string(),
-                    target: "rust".to_string(),
-                    missing_realization_fact: fact,
-                    span: crate::v1_std_core::kernel_span("probe".to_string()),
-                },
-            ),
-            module.to_string(),
+    /// THE DISCRIMINATING RED of the class: the pre-fix loader
+    /// (`try_index_for_run_or_owned_pool` over the layer roots) grows `both_closure_edges`
+    /// on the process-shared index. If this greens, the green control above has no red.
+    #[test]
+    fn fixture_closure_extension_via_shared_index_grows_both_closure_edges() {
+        let _serial = UNION_TEST_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let layers = crate::cli_run::witness_layer_roots();
+        let shared = super::entry_resolve::try_process_shared_index(&layers)
+            .unwrap_or_else(|e| panic!("process-shared index is the subject of this control: {e}"));
+        let edges_before = shared
+            .both_closure_edges
+            .borrow()
+            .as_ref()
+            .map(|e| e.ref_out.len())
+            .unwrap_or(0);
+        let module_index = crate::cli_run::build_module_path_index_from_witness_roots();
+        let sources = crate::cli_run::extend_fixture_imports_on_process_shared_index(
+            FIXTURE_CLOSURE_REFERENCE_REACH_MEMBER,
+            &module_index,
         )
+        .unwrap_or_else(|e| panic!("pre-fix shared-index extension must still close: {e}"));
+        assert!(
+            sources.len() > 1,
+            "the syllogism specimen must pull its provider, got {}",
+            sources.len()
+        );
+        let edges_after = shared
+            .both_closure_edges
+            .borrow()
+            .as_ref()
+            .map(|e| e.ref_out.len())
+            .unwrap_or(0);
+        assert!(
+            edges_after > edges_before,
+            "the pre-fix route must grow both_closure_edges (before={edges_before} after={edges_after})"
+        );
     }
 
+    /// PLAN-TIME CLOSURE of the forged-probe witness module (the changed-witness seed), not
+    /// the in-memory probe string. If MegaRAC production paths appear, planning that witness
+    /// compiled the string's imports as both-closure edges and the pin at fold-start is that
+    /// increment. If they do not, the increment is the typed graph of this module itself.
     #[test]
-    fn selection_fold_allows_only_run_capture_rows_and_vetoes_mixed_refusal() {
-        let gap = gap_fact();
-        let gap_row = gap_excl();
-        let allowed = transport_row(
-            &gap_row.declaring_module,
-            &gap_row.service,
-            &gap_row.operation_qualified,
-            gap.clone(),
+    fn forged_probe_witness_module_both_closure_excludes_string_literal_imports() {
+        let _serial = UNION_TEST_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let layers = crate::cli_run::witness_layer_roots();
+        let shared = super::entry_resolve::try_process_shared_index(&layers)
+            .unwrap_or_else(|e| panic!("process-shared index is the subject of this control: {e}"));
+        let scratch = super::entry_resolve::new_multi_entry_index_scratch_over(
+            shared.source_files.clone(),
+            &shared.source_roots,
         );
-        let selected = select_run_operations_excluded_for_stderr_capture_gap(&[allowed]);
-        assert_eq!(
-            selected.iter().cloned().collect::<Vec<_>>(),
-            vec![(
-                gap_row.declaring_module.to_string(),
-                gap_row.service.to_string()
-            )]
+        let rel = "dag/test/claim/host/megarac_managed_host_forged_probe_witness_test.dag";
+        let content = std::fs::read_to_string(process_workspace_root().join(rel))
+            .unwrap_or_else(|e| panic!("read {rel}: {e}"));
+        let source = Rc::new(v1_compiler_compile::SourceFile {
+            path: rel.to_string(),
+            content,
+        });
+        let closed =
+            crate::cli_run::extend_sources_to_both_closure_fixpoint(vec![source.clone()], &scratch)
+                .unwrap_or_else(|e| panic!("witness-module closure must close: {e}"));
+        let megarac: Vec<String> = closed
+            .iter()
+            .map(|s| s.path.replace('\\', "/"))
+            .filter(|p| p.contains("megarac") && p != rel)
+            .collect();
+        assert!(
+            megarac.is_empty(),
+            "planning the witness must not both-close MegaRAC production named only inside \
+             forged_probe_source; pulled {megarac:?} (closure_len={})",
+            closed.len()
         );
+    }
 
-        let mixed_key = crate::v1_compiler_emit::shell_emission_refusal_fact(Rc::new(
-            crate::v1_compiler_emit::ShellEmissionRefusal::ShellOutputKeyNotModeled {
-                key: "not_a_channel".to_string(),
-            },
-        ));
-        let mixed = vec![
-            transport_row(
-                &gap_row.declaring_module,
-                &gap_row.service,
-                &gap_row.operation_qualified,
-                gap.clone(),
-            ),
-            transport_row(
-                &gap_row.declaring_module,
-                &gap_row.service,
-                &gap_row.operation_qualified,
-                mixed_key,
-            ),
-        ];
-        assert!(select_run_operations_excluded_for_stderr_capture_gap(&mixed).is_empty());
-
-        let wrong_module = transport_row(
-            "extdeps.other",
-            &gap_row.service,
-            &gap_row.operation_qualified,
-            gap.clone(),
+    /// Scratch over an already-indexed name set is recorded as `ScratchCachesOverExistingSet`
+    /// and must not refuse as a second `NameSetIndex`.
+    #[test]
+    fn fixture_scratch_shell_is_not_a_second_index_of_the_name_set() {
+        let _serial = UNION_TEST_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let layers = crate::cli_run::witness_layer_roots();
+        let shared = super::entry_resolve::try_process_shared_index(&layers)
+            .unwrap_or_else(|e| panic!("process-shared index is the subject of this control: {e}"));
+        let before = crate::cli_run::multi_entry_index_builds();
+        let _ = super::entry_resolve::new_multi_entry_index_scratch_over(
+            shared.source_files.clone(),
+            &shared.source_roots,
         );
-        assert!(select_run_operations_excluded_for_stderr_capture_gap(&[wrong_module]).is_empty());
+        let _ = super::entry_resolve::new_multi_entry_index_scratch_over(
+            shared.source_files.clone(),
+            &shared.source_roots,
+        );
+        let after = crate::cli_run::multi_entry_index_builds();
+        assert_eq!(
+            after.len(),
+            before.len() + 2,
+            "scratches are countable constructions"
+        );
+        crate::cli_run::multi_entry_index_sharing_control(&after).unwrap_or_else(|e| {
+            panic!("scratch kind must not refuse as a second name-set index: {e}")
+        });
+    }
 
-        let nonmember = transport_row(&gap_row.declaring_module, &gap_row.service, "Sibling", gap);
-        assert!(select_run_operations_excluded_for_stderr_capture_gap(&[nonmember]).is_empty());
+    #[test]
+    fn declared_stderr_capture_channels_do_not_refuse_the_union() {
+        let union = fixture_closure_union_control_union(STDERR_CAPTURE_MEMBER)
+            .expect("capture member resolves");
+        fixture_closure_union_emit_receipt(&union)
+            .expect("the rust shell handler realizes the declared capture channels");
     }
 
-    fn kernel_named(
-        name: &str,
-        kind: crate::v1_std_core::ParsedModuleItemKind,
-        children: im::Vector<Rc<crate::v1_std_core::Node>>,
-    ) -> Rc<crate::v1_std_core::Node> {
-        let mut node = (*crate::v1_std_core::leaf_node_with_span(
-            Rc::new(crate::std_occurrence_identity::NodeOccurrenceIdentity::OccurrenceSynthetic),
-            name.to_string(),
-            crate::v1_std_core::kernel_span(name.to_string()),
-        ))
-        .clone();
-        node.module_item_kind = kind;
-        node.children = Rc::new(children);
-        Rc::new(node)
+    #[test]
+    fn an_unmodeled_shell_channel_still_refuses_the_union() {
+        let union = fixture_closure_union_control_union(STDERR_CAPTURE_UNMODELED_SIBLING)
+            .expect("mixed member resolves");
+        let refusal = fixture_closure_union_emit_receipt(&union)
+            .expect_err("unmodeled stderr_digest_hex must still refuse");
+        assert!(
+            refusal.contains("cause=FixtureClosureUnionEmitRefused")
+                && refusal.contains("stderr_digest_hex"),
+            "{refusal}"
+        );
     }
 
-    fn supplied_graph_with_run_and_sibling() -> Rc<crate::v1_compiler_infer_items::ResolvedGraph> {
-        use crate::v1_compiler_infer_items::{
-            ModuleInterface, ModuleTypecheckProgress, ResolvedGraph, TypedModule,
-        };
-        use crate::v1_std_core::ParsedModuleItemKind;
-        let env = crate::v1_compiler_infer_env::empty_type_env();
-        let cache = crate::v1_compiler_infer_env::empty_type_env_cache();
-        let gap = gap_excl();
-        let run = kernel_named(
-            &gap.operation_bare,
-            ParsedModuleItemKind::NotAModuleItem,
-            im::vector![],
+    #[test]
+    fn capture_channels_without_stderr_capture_input_refuse_the_union() {
+        // Real absent-policy route: rust emit refuses at
+        // `unmodeled_shell_transport_operation_diagnostics` /
+        // `ShellCapturePolicyInputAbsent` before any program is emitted.
+        // `emit_shell_stderr_policy_binding`'s else-arm is not reachable from
+        // this harness (the wall fires first; the generated bind fn is not on
+        // this mirror). The rustc-decoy that compiled a hand-built `return Err`
+        // before spawn was deleted (review 78366).
+        let union = fixture_closure_union_control_union(STDERR_CAPTURE_WITHOUT_POLICY)
+            .expect("member without policy input resolves");
+        let refusal = fixture_closure_union_emit_receipt(&union)
+            .expect_err("a capture channel without stderr_capture must refuse");
+        assert!(
+            refusal.contains("cause=FixtureClosureUnionEmitRefused")
+                && refusal.contains("stderr_capture")
+                && refusal.contains("transport emission is not modeled"),
+            "{refusal}"
         );
-        let sibling = kernel_named(
-            "Sibling",
-            ParsedModuleItemKind::NotAModuleItem,
-            im::vector![],
+    }
+
+    fn capture_channels_refuse_unless_stderr_capture_is_the_required_scalar_policy(
+        source: &str,
+        label: &str,
+    ) {
+        let union = fixture_closure_union_control_union(source).unwrap_or_else(|e| {
+            panic!("{label} must resolve so emit can refuse the typed policy: {e}")
+        });
+        let refusal = fixture_closure_union_emit_receipt(&union)
+            .expect_err("wrong stderr_capture shape must refuse at emit, not rustc");
+        assert!(
+            refusal.contains("cause=FixtureClosureUnionEmitRefused")
+                && refusal.contains("transport emission is not modeled")
+                && refusal.contains("stderr_capture"),
+            "{label}: {refusal}"
         );
-        let other_fn = kernel_named(
-            "unrelated_fn",
-            ParsedModuleItemKind::ModuleItemFunction,
-            im::vector![],
+        assert!(
+            !refusal.contains("error[E") && !refusal.contains("mismatched types"),
+            "typed emission must refuse before rustc: {label}: {refusal}"
         );
-        let service = kernel_named(
-            &gap.service,
-            ParsedModuleItemKind::ModuleItemService,
-            im::vector![run, sibling],
+    }
+
+    #[test]
+    fn capture_channels_with_string_stderr_capture_refuse_the_union() {
+        capture_channels_refuse_unless_stderr_capture_is_the_required_scalar_policy(
+            STDERR_CAPTURE_STRING_POLICY,
+            "String",
         );
-        let module = kernel_named(
-            &gap.declaring_module,
-            ParsedModuleItemKind::NotAModuleItem,
-            im::vector![],
+    }
+
+    #[test]
+    fn capture_channels_with_optional_stderr_capture_refuse_the_union() {
+        capture_channels_refuse_unless_stderr_capture_is_the_required_scalar_policy(
+            STDERR_CAPTURE_OPTIONAL_POLICY,
+            "optional",
         );
-        let other_module_node = kernel_named(
-            "other.mod",
-            ParsedModuleItemKind::NotAModuleItem,
-            im::vector![],
+    }
+
+    #[test]
+    fn capture_channels_with_collection_stderr_capture_refuse_the_union() {
+        capture_channels_refuse_unless_stderr_capture_is_the_required_scalar_policy(
+            STDERR_CAPTURE_COLLECTION_POLICY,
+            "collection",
         );
-        let other_item = kernel_named(
-            "KeepMe",
-            ParsedModuleItemKind::ModuleItemFunction,
-            im::vector![],
+    }
+
+    #[test]
+    fn capture_channels_with_homonym_stderr_capture_refuse_the_union() {
+        capture_channels_refuse_unless_stderr_capture_is_the_required_scalar_policy(
+            STDERR_CAPTURE_HOMONYM_POLICY,
+            "homonym",
         );
-        let interface = |e: Rc<crate::v1_compiler_infer_env::TypeEnv>,
-                         c: Rc<crate::v1_compiler_infer_env::TypeEnvCache>,
-                         path: &str| {
-            Rc::new(ModuleInterface {
-                summary: Rc::new(crate::std_interface_summary::InterfaceSummary {
-                    module_path: path.to_string(),
-                    exports: Rc::new(im::vector![]),
-                    interface_hash: crate::std_interface_summary::interface_summary_rollup(
-                        Rc::new(im::vector![]),
+    }
+
+    /// Drain fragments from `v1.compiler.emit_rust` (`shell_capture_drain_start`,
+    /// `shell_capture_join_project`). These tests inhabit those strings.
+    ///
+    /// `__stderr_complete_limit` is planted in the specimen. The production
+    /// Complete bind (`emit_shell_stderr_policy_binding` →
+    /// `v1_rt::read_host_budget_bytes()`) is not compiled here: a standalone
+    /// rustc specimen cannot link the crate, and this harness does not call that
+    /// function. Deleting the bind's `read_host_budget_bytes` call does not turn
+    /// these tests red. That host-budget route is uncovered (review 78366,
+    /// review 78373).
+    fn rustc_and_run_emitted_capture(
+        stem: &str,
+        complete_limit: Option<usize>,
+        tail_bytes: usize,
+        stderr_payload: &str,
+        stdin_payload: Option<&str>,
+    ) -> std::process::Output {
+        let limit = match complete_limit {
+            Some(n) => format!("Some({n})"),
+            None => "None".to_string(),
+        };
+        let (script, stdin_prelude) = match stdin_payload {
+            Some(stdin) => {
+                let n = stderr_payload.len();
+                let combined = format!("{}{}", stderr_payload, stdin);
+                (
+                    format!("head -c {n} 1>&2; cat >/dev/null"),
+                    format!(
+                        "let __stdin_bytes: Vec<u8> = ({:?}).as_bytes().to_vec();\n\
+                         let mut stdin_pipe = output.stdin.take();\n\
+                         let __stdin_thread = std::thread::spawn(move || -> std::io::Result<()> {{\n\
+                             use std::io::Write;\n\
+                             if let Some(mut stdin) = stdin_pipe {{\n\
+                                 stdin.write_all(&__stdin_bytes)?;\n\
+                             }}\n\
+                             Ok(())\n\
+                         }});\n",
+                        combined
                     ),
-                }),
-                env: e,
-                cache: c,
-            })
+                )
+            }
+            None => (
+                "printf %s '{payload}' 1>&2".to_string(),
+                "let mut stdin_pipe = output.stdin.take();\n\
+                 let __stdin_thread = std::thread::spawn(move || -> std::io::Result<()> {\n\
+                     drop(stdin_pipe);\n\
+                     Ok(())\n\
+                 });\n"
+                    .to_string(),
+            ),
         };
-        let tm = Rc::new(TypedModule {
-            module,
-            items: Rc::new(im::vector![service, other_fn]),
-            progress: ModuleTypecheckProgress::ItemsChecked,
-            type_env: env.clone(),
-            type_env_cache: cache.clone(),
-            interface: interface(env.clone(), cache.clone(), &gap.declaring_module),
-            func_env: Rc::new(crate::v1_compiler_infer_sigs::ResolvedFuncEnv {
-                name: gap.declaring_module.to_string(),
-                local: crate::v1_rt::rc_empty_map(),
-                parents: Rc::new(im::vector![]),
-            }),
-            item_registry: crate::v1_rt::rc_empty_map(),
-            occurrence_transport: None,
-        });
-        let other = Rc::new(TypedModule {
-            module: other_module_node,
-            items: Rc::new(im::vector![other_item]),
-            progress: ModuleTypecheckProgress::ItemsChecked,
-            type_env: env.clone(),
-            type_env_cache: cache.clone(),
-            interface: interface(env, cache, "other.mod"),
-            func_env: Rc::new(crate::v1_compiler_infer_sigs::ResolvedFuncEnv {
-                name: "other.mod".to_string(),
-                local: crate::v1_rt::rc_empty_map(),
-                parents: Rc::new(im::vector![]),
-            }),
-            item_registry: crate::v1_rt::rc_empty_map(),
-            occurrence_transport: None,
-        });
-        Rc::new(ResolvedGraph {
-            modules: Rc::new(im::vector![tm, other]),
-            item_registry: crate::v1_rt::rc_empty_map(),
-            item_leaf_owner_modules: crate::v1_rt::rc_empty_map(),
-            diagnostics: Rc::new(im::vector![]),
-        })
+        let drain = format!(
+            "{}{}{}",
+            crate::v1_compiler_emit_rust::shell_capture_drain_start(),
+            stdin_prelude,
+            crate::v1_compiler_emit_rust::shell_capture_join_project()
+        );
+        let program = format!(
+            "fn main() -> Result<(), Box<dyn std::error::Error>> {{\n\
+             let __stderr_complete_limit: Option<usize> = {limit};\n\
+             let __stderr_complete_source: String = {source};\n\
+             let __stderr_tail_bytes: usize = {tail};\n\
+             let mut output = std::process::Command::new(\"sh\")\n\
+             .args([\"-c\", \"{script}\"])\n\
+             .stdin(std::process::Stdio::piped())\n\
+             .stdout(std::process::Stdio::piped())\n\
+             .stderr(std::process::Stdio::piped())\n\
+             .spawn()?;\n\
+             {drain}\n\
+             print!(\"{{stderr_truncated}}|{{stderr_total_bytes}}|{{stderr_retained_bytes}}|{{stderr}}\");\n\
+             Ok(())\n\
+             }}\n",
+            script = script.replace("{payload}", stderr_payload),
+            limit = limit,
+            source = if complete_limit.is_some() {
+                "\"planted complete limit\".to_string()".to_string()
+            } else {
+                "String::new()".to_string()
+            },
+            tail = tail_bytes,
+            drain = drain,
+        );
+        let root = std::env::temp_dir().join(format!(
+            "gunbc-emitted-capture-{}-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos(),
+            stem
+        ));
+        std::fs::create_dir_all(&root).expect("scratch dir");
+        let src = root.join("main.rs");
+        let exe = root.join("specimen");
+        std::fs::write(&src, program).expect("write emitted capture harness");
+        let compiled = std::process::Command::new("rustc")
+            .args(["--edition=2021", "-o"])
+            .arg(&exe)
+            .arg(&src)
+            .output()
+            .expect("invoke rustc");
+        assert!(
+            compiled.status.success(),
+            "emitted capture body refused to compile: {}",
+            String::from_utf8_lossy(&compiled.stderr)
+        );
+        let run = std::process::Command::new(&exe)
+            .output()
+            .expect("run emitted capture specimen");
+        let _ = std::fs::remove_dir_all(&root);
+        run
     }
 
-    fn service_op_names(
-        graph: &crate::v1_compiler_infer_items::ResolvedGraph,
-        module: &str,
-        service: &str,
-    ) -> Vec<String> {
-        let env = crate::v1_compiler_infer_env::empty_type_env();
-        graph
-            .modules
-            .iter()
-            .find(|tm| {
-                crate::v1_compiler_infer_env::authored_name(tm.type_env.clone(), tm.module.clone())
-                    == module
-            })
-            .into_iter()
-            .flat_map(|tm| tm.items.iter())
-            .filter(|item| {
-                item.module_item_kind == crate::v1_std_core::ParsedModuleItemKind::ModuleItemService
-                    && crate::v1_compiler_infer_env::authored_name(env.clone(), (*item).clone())
-                        == service
-            })
-            .flat_map(|item| {
-                item.children
-                    .iter()
-                    .map(|op| crate::v1_compiler_infer_env::authored_name(env.clone(), op.clone()))
-            })
-            .collect()
+    #[test]
+    fn emitted_bounded_tail_truncates_and_keeps_the_tail() {
+        let run = rustc_and_run_emitted_capture(
+            "over-tail",
+            None,
+            16,
+            "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",
+            None,
+        );
+        assert!(
+            run.status.success(),
+            "over-tail specimen failed: {}",
+            String::from_utf8_lossy(&run.stderr)
+        );
+        assert_eq!(
+            String::from_utf8_lossy(&run.stdout),
+            "true|36|16|UVWXYZ0123456789"
+        );
     }
 
     #[test]
-    fn strip_removes_only_run_and_keeps_sibling_and_unrelated_items() {
-        let gap = gap_excl();
-        let graph = supplied_graph_with_run_and_sibling();
-        let mut excluded = BTreeSet::new();
-        excluded.insert((gap.declaring_module.to_string(), gap.service.to_string()));
-        let stripped = strip_excluded_run_operations(graph.clone(), &excluded);
+    fn emitted_bounded_tail_under_cap_is_complete() {
+        let run = rustc_and_run_emitted_capture("under-cap", None, 16, "abcdefghij", None);
+        assert!(
+            run.status.success(),
+            "under-cap specimen failed: {}",
+            String::from_utf8_lossy(&run.stderr)
+        );
         assert_eq!(
-            service_op_names(&stripped, &gap.declaring_module, &gap.service),
-            vec!["Sibling".to_string()]
+            String::from_utf8_lossy(&run.stdout),
+            "false|10|10|abcdefghij"
         );
-        let env = crate::v1_compiler_infer_env::empty_type_env();
-        let gunbc_item_names: Vec<String> = stripped
-            .modules
-            .iter()
-            .find(|tm| {
-                crate::v1_compiler_infer_env::authored_name(tm.type_env.clone(), tm.module.clone())
-                    == gap.declaring_module
-            })
-            .unwrap()
-            .items
-            .iter()
-            .map(|item| crate::v1_compiler_infer_env::authored_name(env.clone(), item.clone()))
-            .collect();
+    }
+
+    #[test]
+    fn emitted_complete_over_budget_refuses() {
+        let run =
+            rustc_and_run_emitted_capture("complete-over", Some(8), 0, "abcdefghijklmnop", None);
+        assert!(
+            !run.status.success(),
+            "Complete overflow must refuse, got stdout {:?}",
+            String::from_utf8_lossy(&run.stdout)
+        );
+        let err = String::from_utf8_lossy(&run.stderr);
+        assert!(
+            err.contains("WitnessStderrCaptureCompleteBudgetExceeded")
+                && err.contains("16")
+                && err.contains("8"),
+            "{err}"
+        );
+    }
+
+    #[test]
+    fn emitted_complete_under_budget_retains_all() {
+        let run = rustc_and_run_emitted_capture("complete-under", Some(64), 0, "abcdefghij", None);
         assert!(
-            gunbc_item_names.contains(&"unrelated_fn".to_string()),
-            "{gunbc_item_names:?}"
+            run.status.success(),
+            "under-budget Complete failed: {}",
+            String::from_utf8_lossy(&run.stderr)
         );
-        assert_eq!(stripped.modules.len(), 2, "unrelated module must remain");
-        let empty = strip_excluded_run_operations(graph, &BTreeSet::new());
         assert_eq!(
-            service_op_names(&empty, &gap.declaring_module, &gap.service),
-            vec![gap.operation_bare.to_string(), "Sibling".to_string()]
+            String::from_utf8_lossy(&run.stdout),
+            "false|10|10|abcdefghij"
         );
     }
 
     #[test]
-    fn capture_gap_exclusion_reads_typed_fields_from_the_drop_module() {
-        let gap = gap_excl();
-        assert!(!gap.drop_identity.is_empty());
-        assert!(!gap.declaring_module.is_empty());
-        assert!(!gap.service.is_empty());
-        assert!(!gap.operation_bare.is_empty());
+    fn emitted_stdin_and_long_stderr_does_not_deadlock() {
+        let stderr = "Y".repeat(80_000);
+        let stdin = "X".repeat(80_000);
+        let run =
+            rustc_and_run_emitted_capture("stdin-long-stderr", None, 16, &stderr, Some(&stdin));
         assert!(
-            gap.operation_qualified == gap.operation_bare
-                || gap
-                    .operation_qualified
-                    .ends_with(&format!(".{}", gap.operation_bare)),
-            "qualified={} bare={}",
-            gap.operation_qualified,
-            gap.operation_bare
+            run.status.success(),
+            "stdin+stderr specimen deadlocked or failed: {}",
+            String::from_utf8_lossy(&run.stderr)
+        );
+        assert_eq!(
+            String::from_utf8_lossy(&run.stdout),
+            format!("true|80000|16|{}", "Y".repeat(16))
         );
     }
+
+    #[test]
+    fn reaching_extdeps_gunbc_does_not_refuse_the_union_for_capture_channels() {
+        let union = fixture_closure_union_control_union(GUNBC_MODULE_REACH_MEMBER)
+            .expect("extdeps.gunbc reach resolves");
+        fixture_closure_union_emit_receipt(&union).unwrap_or_else(|refusal| {
+            panic!("a compile-probe reach of extdeps.gunbc must emit: {refusal}");
+        });
+    }
 }
 
 #[cfg(test)]
diff --git a/src/v1/stage0/src/cli_run/emitted_crate_workspace_host.rs b/src/v1/stage0/src/cli_run/emitted_crate_workspace_host.rs
index 5dda5de4de4..15ec519f9de 100644
--- a/src/v1/stage0/src/cli_run/emitted_crate_workspace_host.rs
+++ b/src/v1/stage0/src/cli_run/emitted_crate_workspace_host.rs
@@ -1,15 +1,16 @@
 //! THE EMITTED CLOSURE, BUILT AS A MULTI-CRATE CARGO WORKSPACE (Pkg7e), with its discriminating red.
 //!
-//! `//gunbc/instruments:emitted-crate-workspace`. The seed emits `v2.compiler.compile`'s closure
-//! once; `v2.workflow.emitted_crate_workspace` `emitted_workspace_plan` partitions it into crate
-//! rows from the derived module DAG, the emission's own returned edges and the transitive unit
-//! dependencies; `v1.compiler.stage0_crates` `partition_crate_boundary_emit_outcome_over` renders
-//! those rows with the one partition renderer; this host writes the tree and runs cargo.
+//! Two callers share one realization. `write_emitted_workspace` is the writer every emitted-Rust
+//! route uses: `v1.compiler.emitted_workspace` `emitted_workspace_realization` -- compiled into the
+//! seed, not interpreted -- turns an emission into the complete file population of its workspace
+//! (layout from `gunbc.emitted_crate_workspace` `emitted_workspace_build`, manifests and crate
+//! roots from `v1.compiler.stage0_crates`, every emitted file placed or refused), and this file
+//! writes those files. `//gunbc/instruments:emitted-crate-workspace` emits `v2.compiler.compile`,
+//! writes it through the same realization, builds it, then lays the RED over it
+//! (`emitted_workspace_red_realization`) and builds again.
 //!
-//! WHAT THIS FILE DECIDES: nothing about the partition. Every row, dependency and the dropped edge
-//! come from the `.dag` plan; the manifests and lib.rs files come from the stage0 renderer. What is
-//! here is the effect boundary -- the emission, the file writes, the two cargo runs -- plus the
-//! transport that carries the emission's edges into the plan and the plan's rows back out.
+//! WHAT THIS FILE DECIDES: nothing about the workspace. Every path and byte comes from the `.dag`
+//! realization; what is here is the effect boundary -- the emission, the file writes, the cargo runs.
 //!
 //! THE RED IS A DROPPED DERIVED DEPENDENCY THE GLOB FACADE CANNOT RE-EXPORT BY ANOTHER ROAD. The
 //! plan picks a unit dep edge in the transitive reduction that the emitter also wrote as a use-line;
@@ -20,13 +21,13 @@
 use std::path::Path;
 use std::rc::Rc;
 
-use crate::gunbc_stage0_crate_partition_generated::{
-    GeneratedPartitionCrateKind, GeneratedPartitionCrateRow,
+use crate::v1_compiler_emitted_workspace::{
+    emitted_workspace_realization, emitted_workspace_realization_refusal_message,
+    emitted_workspace_red_realization, EmittedWorkspaceRealization, EmittedWorkspaceRealized,
+    EmittedWorkspaceRedRealization,
 };
-use crate::v1_interpreter::{self, ExecutionMode, Value};
 
 const WORKSPACE_ENTRY: &str = "src/v2/compiler/00_compile.dag";
-const PLAN_MODULE: &str = "src/v2/workflow/emitted_crate_workspace.dag";
 
 pub struct EmittedCrateWorkspaceHeld {
     pub head: String,
@@ -43,231 +44,15 @@ pub struct EmittedCrateWorkspaceHeld {
     pub red_diagnostic: String,
 }
 
-struct PlanRows {
-    rows: Vec<GeneratedPartitionCrateRow>,
-    red_rows: Vec<GeneratedPartitionCrateRow>,
-    red_package: String,
-    red_dropped_package: String,
-    red_from_module: String,
-    red_to_module: String,
-    module_count: i64,
-    crate_count: i64,
-    facade_is_whole_closure: bool,
-}
-
 fn refusal(cause: &str, detail: impl std::fmt::Display) -> String {
     format!("EMITTED-WORKSPACE REFUSAL cause={cause} — {detail}")
 }
 
-fn field<'a>(
-    ctx: &v1_interpreter::InterpContext,
-    fields: &'a [(v1_interpreter::Symbol, Value)],
-    name: &str,
-) -> Result<&'a Value, String> {
-    fields
-        .iter()
-        .find(|(sym, _)| ctx.sym_eq(*sym, name))
-        .map(|(_, v)| v)
-        .ok_or_else(|| refusal("PlanShapeUnexpected", format!("no field `{name}`")))
-}
-
-fn as_str(v: &Value, what: &str) -> Result<String, String> {
-    match v {
-        Value::Str(s) => Ok(s.to_string()),
-        other => Err(refusal(
-            "PlanShapeUnexpected",
-            format!("{what} is {} not a String", other.type_label_public()),
-        )),
-    }
-}
-
-fn as_int(v: &Value, what: &str) -> Result<i64, String> {
-    match v {
-        Value::Int(i) => Ok(*i),
-        other => Err(refusal(
-            "PlanShapeUnexpected",
-            format!("{what} is {} not an Int", other.type_label_public()),
-        )),
-    }
-}
-
-fn as_bool(v: &Value, what: &str) -> Result<bool, String> {
-    match v {
-        Value::Bool(b) => Ok(*b),
-        other => Err(refusal(
-            "PlanShapeUnexpected",
-            format!("{what} is {} not a Bool", other.type_label_public()),
-        )),
-    }
-}
-
-fn as_str_list(v: &Value, what: &str) -> Result<Vec<String>, String> {
-    match v {
-        Value::List(items) => items.iter().map(|i| as_str(i, what)).collect(),
-        other => Err(refusal(
-            "PlanShapeUnexpected",
-            format!("{what} is {} not a List", other.type_label_public()),
-        )),
-    }
-}
-
-fn str_list(xs: &[String]) -> Value {
-    Value::List(Rc::new(
-        xs.iter()
-            .map(|s| v1_interpreter::str_value(s))
-            .collect::<Vec<Value>>()
-            .into(),
-    ))
-}
-
-fn row_from_value(
-    ctx: &v1_interpreter::InterpContext,
-    v: &Value,
-) -> Result<GeneratedPartitionCrateRow, String> {
-    let Value::Record { fields, .. } = v else {
-        return Err(refusal(
-            "PlanShapeUnexpected",
-            "a crate row is not a record",
-        ));
-    };
-    let kind = match field(ctx, fields, "kind")? {
-        Value::Variant { variant_name, .. }
-            if ctx.sym_eq(*variant_name, "GeneratedFoundationCrate") =>
-        {
-            GeneratedPartitionCrateKind::GeneratedFoundationCrate
-        }
-        Value::Variant { variant_name, .. }
-            if ctx.sym_eq(*variant_name, "GeneratedLayeredCoreCrate") =>
-        {
-            GeneratedPartitionCrateKind::GeneratedLayeredCoreCrate
-        }
-        other => {
-            return Err(refusal(
-                "PlanShapeUnexpected",
-                format!(
-                "a crate row's kind is {} — the plan derives foundation and layered crates only",
-                other.type_label_public()
-            ),
-            ))
-        }
-    };
-    Ok(GeneratedPartitionCrateRow {
-        package_name: as_str(field(ctx, fields, "package_name")?, "package_name")?,
-        crate_dir: as_str(field(ctx, fields, "crate_dir")?, "crate_dir")?,
-        kind,
-        modules: Rc::new(
-            as_str_list(field(ctx, fields, "modules")?, "modules")?
-                .into_iter()
-                .collect(),
-        ),
-        reexport_packages: Rc::new(
-            as_str_list(
-                field(ctx, fields, "reexport_packages")?,
-                "reexport_packages",
-            )?
-            .into_iter()
-            .collect(),
-        ),
-        carries_non_empty_wrappers: as_bool(
-            field(ctx, fields, "carries_non_empty_wrappers")?,
-            "carries_non_empty_wrappers",
-        )?,
-    })
-}
-
-fn rows_from_value(
-    ctx: &v1_interpreter::InterpContext,
-    v: &Value,
-    what: &str,
-) -> Result<Vec<GeneratedPartitionCrateRow>, String> {
-    match v {
-        Value::List(items) => items.iter().map(|i| row_from_value(ctx, i)).collect(),
-        other => Err(refusal(
-            "PlanShapeUnexpected",
-            format!("{what} is {} not a List", other.type_label_public()),
-        )),
-    }
-}
-
-/// Evaluate `emitted_workspace_plan` over the emission's basenames and edges. The plan derives the
-/// module DAG from the live dependency facts itself, so the corpus it reads is the source roots.
-fn evaluate_plan(
-    source_roots: &[String],
-    emitted_basenames: &[String],
-    edge_froms: &[String],
-    edge_tos: &[String],
-    edge_provenances: &[String],
-) -> Result<PlanRows, String> {
-    let index = super::process_shared_index(source_roots);
-    let (graph, indices) = super::resolve_entry_with_index(&index, PLAN_MODULE)
-        .map_err(|e| refusal("PlanModuleUnresolved", format!("{PLAN_MODULE}: {e}")))?;
-    let ctx = super::make_eval_context(&graph, indices, ExecutionMode::Wet);
-    let args = vec![
-        (
-            Some("emitted_basenames".to_string()),
-            str_list(emitted_basenames),
-        ),
-        (Some("edge_froms".to_string()), str_list(edge_froms)),
-        (Some("edge_tos".to_string()), str_list(edge_tos)),
-        (
-            Some("edge_provenances".to_string()),
-            str_list(edge_provenances),
-        ),
-    ];
-    let outcome = v1_interpreter::with_active_context(&ctx, || {
-        v1_interpreter::run_in_context_with_args(&ctx, "emitted_workspace_plan", &args, false)
-    })
-    .map_err(|e| refusal("PlanNotEvaluated", e))?;
-    let Value::Variant {
-        variant_name,
-        fields,
-        ..
-    } = &outcome
-    else {
-        return Err(refusal(
-            "PlanShapeUnexpected",
-            "the plan outcome is not a variant",
-        ));
-    };
-    if !ctx.sym_eq(*variant_name, "EmittedWorkspacePlanned") {
-        return Err(refusal("PlanRefused", format!("{outcome:?}")));
-    }
-    let Value::Record { fields: plan, .. } = field(&ctx, fields, "plan")? else {
-        return Err(refusal("PlanShapeUnexpected", "plan is not a record"));
-    };
-    let Value::Record { fields: red, .. } = field(&ctx, plan, "red")? else {
-        return Err(refusal("PlanShapeUnexpected", "red is not a record"));
-    };
-    Ok(PlanRows {
-        rows: rows_from_value(&ctx, field(&ctx, plan, "rows")?, "rows")?,
-        red_rows: rows_from_value(&ctx, field(&ctx, plan, "red_rows")?, "red_rows")?,
-        red_package: as_str(field(&ctx, red, "package")?, "red.package")?,
-        red_dropped_package: as_str(field(&ctx, red, "dropped_package")?, "red.dropped_package")?,
-        red_from_module: as_str(field(&ctx, red, "from_module")?, "red.from_module")?,
-        red_to_module: as_str(field(&ctx, red, "to_module")?, "red.to_module")?,
-        module_count: as_int(field(&ctx, plan, "module_count")?, "module_count")?,
-        crate_count: as_int(field(&ctx, plan, "crate_count")?, "crate_count")?,
-        facade_is_whole_closure: as_bool(
-            field(&ctx, plan, "facade_is_whole_closure")?,
-            "facade_is_whole_closure",
-        )?,
-    })
-}
-
-/// Render rows through the one partition renderer and write them, with the workspace manifest that
-/// lists exactly those crates. The emitted module files sit where the renderer's includes expect
-/// them (`src/v1/stage0/src`).
-fn write_workspace(root: &Path, rows: &[GeneratedPartitionCrateRow]) -> Result<(), String> {
-    let rows_value = Rc::new(rows.iter().cloned().map(Rc::new).collect());
-    let files = match &*crate::v1_compiler_stage0_crates::partition_crate_boundary_emit_outcome_over(rows_value) {
-        crate::v1_compiler_stage0_crates::Stage0CrateBoundaryEmitOutcome::Stage0CrateBoundaryEmitOk { files } => files.clone(),
-        crate::v1_compiler_stage0_crates::Stage0CrateBoundaryEmitOutcome::Stage0CrateBoundaryEmitRefused { cause } => {
-            return Err(refusal(
-                "RenderRefused",
-                crate::v1_compiler_stage0_crates::stage0_crate_boundary_emit_refusal_message(cause.clone()),
-            ))
-        }
-    };
+/// Write realized files under `root`, each at its workspace-relative path.
+fn write_files(
+    root: &Path,
+    files: &im::Vector<Rc<crate::v1_std_core::TextFile>>,
+) -> Result<(), String> {
     for file in files.iter() {
         let path = root.join(&*file.path);
         if let Some(parent) = path.parent() {
@@ -278,16 +63,7 @@ fn write_workspace(root: &Path, rows: &[GeneratedPartitionCrateRow]) -> Result<(
         std::fs::write(&path, &*file.content)
             .map_err(|e| refusal("WorkspaceNotWritten", format!("{}: {e}", path.display())))?;
     }
-    let members = rows
-        .iter()
-        .map(|r| format!("    \"{}\",", r.crate_dir))
-        .collect::<Vec<_>>()
-        .join("\n");
-    std::fs::write(
-        root.join("Cargo.toml"),
-        format!("[workspace]\nresolver = \"2\"\nmembers = [\n{members}\n]\n"),
-    )
-    .map_err(|e| refusal("WorkspaceNotWritten", format!("root manifest: {e}")))
+    Ok(())
 }
 
 /// The receipt names the revision it measured; an unreadable head refuses rather than printing a
@@ -346,72 +122,49 @@ pub fn run_emitted_crate_workspace(
         .iter()
         .find(|e| e.target_name == "rust")
         .ok_or_else(|| refusal("EmissionRefused", "no rust target"))?;
+    let bin_name = emission
+        .result
+        .rust_crates
+        .front()
+        .map(|c| c.crate_name.to_string())
+        .ok_or_else(|| refusal("EmissionRefused", "the emission names no Rust crate"))?;
 
-    // The module files the emission wrote, by basename; the crate root, entry file and population
-    // manifest are the single-crate assembly's and have no place in a partition crate.
     let root = probe_root.target_dir().join("emitted_crate_workspace");
     let _ = std::fs::remove_dir_all(&root);
-    let module_dir = root.join("src/v1/stage0/src");
-    std::fs::create_dir_all(&module_dir).map_err(|e| refusal("WorkspaceNotWritten", e))?;
-    let mut emitted_basenames = Vec::new();
-    for file in emission.result.files.iter() {
-        let Some(basename) = file
-            .path
-            .strip_prefix("src/")
-            .and_then(|p| p.strip_suffix(".rs"))
-        else {
-            continue;
-        };
-        if basename.contains('/') || matches!(basename, "lib" | "main" | "emitted_population") {
-            continue;
-        }
-        std::fs::write(module_dir.join(format!("{basename}.rs")), &*file.content)
-            .map_err(|e| refusal("WorkspaceNotWritten", format!("{basename}: {e}")))?;
-        emitted_basenames.push(basename.to_string());
-    }
-    let (mut froms, mut tos, mut provenances) = (Vec::new(), Vec::new(), Vec::new());
-    for edge in emission.result.emitted_edges.iter() {
-        froms.push(edge.from.clone());
-        tos.push(match &*edge.to {
-            crate::gunbc_rust_emitted_edge::EmittedEdgeTarget::EmittedModuleTarget { module } => {
-                module.clone()
-            }
-            crate::gunbc_rust_emitted_edge::EmittedEdgeTarget::EmittedCrateRootTarget => {
-                String::new()
-            }
-        });
-        provenances.push(
-            crate::gunbc_stage0_emitted_edge_admission::stage0_emitted_edge_provenance_name(
-                edge.provenance.clone(),
-            ),
-        );
-    }
-    eprintln!(
-        "emitted-crate-workspace: emitted {} module files and {} edges; evaluating the partition plan",
-        emitted_basenames.len(),
-        froms.len()
-    );
+    let realized = realize(
+        &emission.result.files,
+        &emission.result.emitted_edges,
+        &emission.result.rust_crates,
+        &bin_name,
+    )?;
     drop(run);
     let _ = super::trim_retained_heap();
-
-    let plan = evaluate_plan(source_roots, &emitted_basenames, &froms, &tos, &provenances)?;
+    let layout = &realized.build.layout;
+    let red_realized = match &*emitted_workspace_red_realization(realized.clone()) {
+        EmittedWorkspaceRedRealization::EmittedWorkspaceRedRealized { red, files } => {
+            (red.clone(), files.clone())
+        }
+        EmittedWorkspaceRedRealization::EmittedWorkspaceRedRealizationRefused { message } => {
+            return Err(refusal("RedRefused", message))
+        }
+    };
+    let (red, red_files) = red_realized;
     eprintln!(
         "emitted-crate-workspace: plan modules={} crates={} facade_is_whole_closure={} red={} drops {} ({} -> {})",
-        plan.module_count, plan.crate_count, plan.facade_is_whole_closure, plan.red_package, plan.red_dropped_package,
-        plan.red_from_module, plan.red_to_module
+        layout.module_count, layout.crate_count, layout.facade_is_whole_closure, red.package, red.dropped_package,
+        red.from_module, red.to_module
     );
 
     let target_dir = probe_root
         .target_dir()
         .join("emitted_crate_workspace_target");
+    // POSITIVE CONTROL: the production layout builds. The files land first: the compiler
+    // identity is asked from the crate's own directory, which must exist to spawn in.
+    write_files(&root, &realized.files)?;
     let invocation =
         super::emitted_closure_compile_host::probe_cargo_invocation(&root, &target_dir)
             .map_err(|c| refusal("CargoNotResolved", c))?;
-
-    // POSITIVE CONTROL: the derived partition builds.
-    write_workspace(&root, &plan.rows)?;
-    let green =
-        super::emitted_closure_compile_host::run_cargo(&root, &target_dir, &plan.red_to_module);
+    let green = super::emitted_closure_compile_host::run_cargo(&root, &target_dir, &red.to_module);
     let (green_exit_status, green_warning_count) = match &green {
         super::emitted_closure_compile_host::CargoVerdict::Completed {
             status,
@@ -431,38 +184,40 @@ pub fn run_emitted_crate_workspace(
         invocation.rustc_identity
     );
 
+    let held = |red_diagnostic: String| EmittedCrateWorkspaceHeld {
+        head: head.clone(),
+        closure_modules: layout.module_count,
+        crate_count: layout.crate_count,
+        facade_is_whole_closure: layout.facade_is_whole_closure,
+        rustc_identity: invocation.rustc_identity.clone(),
+        green_exit_status,
+        green_warning_count,
+        red_package: red.package.to_string(),
+        red_dropped_package: red.dropped_package.to_string(),
+        red_from_module: red.from_module.to_string(),
+        red_to_module: red.to_module.to_string(),
+        red_diagnostic,
+    };
+
     if green_exit_status != 0 {
         // The positive control did not build, so there is no clean baseline for a red to be read
         // against. That is the observation not holding, reported with cargo's own tail; the red is
         // not attempted rather than reported as refused.
-        return Ok(EmittedCrateWorkspaceHeld {
-            head,
-            closure_modules: plan.module_count,
-            crate_count: plan.crate_count,
-            facade_is_whole_closure: plan.facade_is_whole_closure,
-            rustc_identity: invocation.rustc_identity,
-            green_exit_status,
-            green_warning_count,
-            red_package: plan.red_package,
-            red_dropped_package: plan.red_dropped_package,
-            red_from_module: plan.red_from_module,
-            red_to_module: plan.red_to_module,
-            red_diagnostic: format!(
-                "not attempted: the positive control did not build — {}",
-                super::emitted_closure_compile_host::cargo_verdict_summary(&green)
-            ),
-        });
+        return Ok(held(format!(
+            "not attempted: the positive control did not build — {}",
+            super::emitted_closure_compile_host::cargo_verdict_summary(&green)
+        )));
     }
 
     // RED: the same tree with one derived dependency dropped from one crate.
-    write_workspace(&root, &plan.red_rows)?;
-    let red =
-        super::emitted_closure_compile_host::run_cargo(&root, &target_dir, &plan.red_to_module);
-    let red_diagnostic = match &red {
+    write_files(&root, &red_files)?;
+    let red_build =
+        super::emitted_closure_compile_host::run_cargo(&root, &target_dir, &red.to_module);
+    let red_diagnostic = match &red_build {
         super::emitted_closure_compile_host::CargoVerdict::Completed { status, .. } if *status != 0 => {
             match (
-                super::emitted_closure_compile_host::cargo_verdict_probe_diagnostic(&red),
-                super::emitted_closure_compile_host::cargo_verdict_probe_line(&red),
+                super::emitted_closure_compile_host::cargo_verdict_probe_diagnostic(&red_build),
+                super::emitted_closure_compile_host::cargo_verdict_probe_line(&red_build),
             ) {
                 (Some(diag), Some(line)) => format!("{diag} @ {line}"),
                 _ => {
@@ -470,8 +225,8 @@ pub fn run_emitted_crate_workspace(
                         "RedNotAttributed",
                         format!(
                             "the red build failed but no error names {} — {}",
-                            plan.red_to_module,
-                            super::emitted_closure_compile_host::cargo_verdict_summary(&red)
+                            red.to_module,
+                            super::emitted_closure_compile_host::cargo_verdict_summary(&red_build)
                         ),
                     ))
                 }
@@ -482,28 +237,329 @@ pub fn run_emitted_crate_workspace(
                 "RedBuiltGreen",
                 format!(
                     "dropping {} from {} still built — the facade re-exports it by another road, or cargo never read the tree",
-                    plan.red_dropped_package, plan.red_package
+                    red.dropped_package, red.package
                 ),
             ))
         }
         other => return Err(refusal("RedBuildNotCompleted", super::emitted_closure_compile_host::cargo_verdict_summary(other))),
     };
     eprintln!("emitted-crate-workspace: RED refused as required — {red_diagnostic}");
-    // Leave the tree as the green plan rendered it, so the directory describes the positive control.
-    write_workspace(&root, &plan.rows)?;
-
-    Ok(EmittedCrateWorkspaceHeld {
-        head,
-        closure_modules: plan.module_count,
-        crate_count: plan.crate_count,
-        facade_is_whole_closure: plan.facade_is_whole_closure,
-        rustc_identity: invocation.rustc_identity,
-        green_exit_status,
-        green_warning_count,
-        red_package: plan.red_package,
-        red_dropped_package: plan.red_dropped_package,
-        red_from_module: plan.red_from_module,
-        red_to_module: plan.red_to_module,
-        red_diagnostic,
+    // Leave the tree as the green realization wrote it, so the directory describes the positive control.
+    write_files(&root, &realized.files)?;
+    Ok(held(red_diagnostic))
+}
+
+/// AN EMITTED CLOSURE, WRITTEN AS THE CARGO WORKSPACE ITS REALIZATION DERIVES. The one writer every
+/// emitted-Rust build route uses. Every path and byte is `v1.compiler.emitted_workspace`
+/// `emitted_workspace_realization`'s; what is here is the file writes.
+pub struct EmittedWorkspace {
+    /// The workspace root: the directory whose Cargo.toml `run_cargo` builds.
+    pub root: std::path::PathBuf,
+    /// Where the emitted module files are, by basename.
+    pub module_dir: std::path::PathBuf,
+    /// The modules the top package re-exports -- the closure the binary links.
+    pub modules: Vec<String>,
+    pub crate_count: usize,
+    /// Every file the workspace holds, by path relative to `root`, in the realization's order --
+    /// the one population a completeness check or an identity over the workspace reads.
+    pub files: Vec<String>,
+}
+
+fn realize(
+    files: &Rc<im::Vector<Rc<crate::v1_std_core::TextFile>>>,
+    edges: &Rc<im::Vector<Rc<crate::gunbc_rust_emitted_edge::EmittedEdge>>>,
+    rust_crates: &Rc<im::Vector<Rc<crate::gunbc_rust_emitted_crate::EmittedRustCrate>>>,
+    bin_name: &str,
+) -> Result<Rc<EmittedWorkspaceRealized>, String> {
+    match &*emitted_workspace_realization(
+        files.clone(),
+        edges.clone(),
+        rust_crates.clone(),
+        bin_name.to_string(),
+    ) {
+        EmittedWorkspaceRealization::EmittedWorkspaceRealizedOk { workspace } => {
+            Ok(workspace.clone())
+        }
+        EmittedWorkspaceRealization::EmittedWorkspaceRealizationRefused { cause } => Err(refusal(
+            "WorkspaceNotRealized",
+            emitted_workspace_realization_refusal_message(cause.clone()),
+        )),
+    }
+}
+
+pub fn write_emitted_workspace(
+    files: &Rc<im::Vector<Rc<crate::v1_std_core::TextFile>>>,
+    edges: &Rc<im::Vector<Rc<crate::gunbc_rust_emitted_edge::EmittedEdge>>>,
+    rust_crates: &Rc<im::Vector<Rc<crate::gunbc_rust_emitted_crate::EmittedRustCrate>>>,
+    root: &Path,
+    bin_name: &str,
+) -> Result<EmittedWorkspace, String> {
+    let realized = realize(files, edges, rust_crates, bin_name)?;
+    write_files(root, &realized.files)?;
+    let top_package = realized.build.top_package.to_string();
+    let modules = realized
+        .build
+        .rows
+        .iter()
+        .find(|r| *r.package_name == *top_package)
+        .map(|r| r.modules.iter().map(|m| m.to_string()).collect())
+        .ok_or_else(|| refusal("TopPackageAbsent", format!("no row names {top_package}")))?;
+    Ok(EmittedWorkspace {
+        root: root.to_path_buf(),
+        module_dir: root.join(&*realized.module_dir),
+        modules,
+        crate_count: realized.build.rows.len(),
+        files: realized.files.iter().map(|f| f.path.to_string()).collect(),
     })
 }
+
+#[cfg(test)]
+mod tests {
+    //! The seed's workspace functions are v1 `.dag` compiled into this crate, so their claims run
+    //! here, against the compiled functions, rather than in a `.dag` witness whose source roots
+    //! cannot import a v1 module. Inputs are supplied; the real emission reaching them is the
+    //! v2-native-cli and self-host instruments' build.
+    use std::rc::Rc;
+
+    use crate::gunbc_rust_emitted_crate::{EmittedCrateDependencyDemand, EmittedRustCrate};
+    use crate::gunbc_rust_emitted_edge::{
+        declared_import_edge, rust_module_emit_filename, rust_prelude_emitted_edges, EmittedEdge,
+        EmittedEdgeProvenance, EmittedEdgeTarget,
+    };
+    use crate::v1_compiler_emitted_workspace::{
+        emitted_workspace_realization, EmittedWorkspaceRealization,
+        EmittedWorkspaceRealizationRefusal,
+    };
+    use crate::v1_std_core::TextFile;
+
+    fn text(path: &str, content: &str) -> Rc<TextFile> {
+        Rc::new(TextFile {
+            path: path.to_string(),
+            content: content.to_string(),
+        })
+    }
+
+    fn demand(services: bool) -> EmittedCrateDependencyDemand {
+        EmittedCrateDependencyDemand {
+            renders_clap_cli: false,
+            renders_async_services: services,
+        }
+    }
+
+    fn edges(modules: &[&str], extra: Vec<Rc<EmittedEdge>>) -> Vec<Rc<EmittedEdge>> {
+        let mut all: Vec<Rc<EmittedEdge>> = std::iter::once("v1_rt")
+            .chain(modules.iter().copied())
+            .flat_map(|m| {
+                rust_prelude_emitted_edges(m.to_string())
+                    .iter()
+                    .cloned()
+                    .collect::<Vec<_>>()
+            })
+            .collect();
+        all.extend(extra);
+        all
+    }
+
+    fn base_files(extra: Vec<Rc<TextFile>>) -> Vec<Rc<TextFile>> {
+        let mut files = vec![
+            text("src/lib.rs", "pub mod fx_a;\n"),
+            text("src/main.rs", "fn main() {}\n"),
+            text("src/emitted_population.rs", "// src/lib.rs\n"),
+            text("src/v1_rt.rs", "// runtime\n"),
+            text("src/fx_a.rs", "pub fn a() {}\n"),
+        ];
+        files.extend(extra);
+        files
+    }
+
+    fn realize(
+        files: Vec<Rc<TextFile>>,
+        edges: Vec<Rc<EmittedEdge>>,
+        services: bool,
+    ) -> Rc<EmittedWorkspaceRealization> {
+        emitted_workspace_realization(
+            Rc::new(files.into_iter().collect()),
+            Rc::new(edges.into_iter().collect()),
+            Rc::new(
+                std::iter::once(Rc::new(EmittedRustCrate {
+                    crate_name: "fx_app".to_string(),
+                    demand: demand(services),
+                }))
+                .collect(),
+            ),
+            "fx_app".to_string(),
+        )
+    }
+
+    fn realized_files(outcome: &EmittedWorkspaceRealization) -> Vec<(String, String)> {
+        match outcome {
+            EmittedWorkspaceRealization::EmittedWorkspaceRealizedOk { workspace } => workspace
+                .files
+                .iter()
+                .map(|f| (f.path.to_string(), f.content.to_string()))
+                .collect(),
+            EmittedWorkspaceRealization::EmittedWorkspaceRealizationRefused { cause } => {
+                panic!("realization refused: {cause:?}")
+            }
+        }
+    }
+
+    fn content_of<'a>(files: &'a [(String, String)], path: &str) -> &'a str {
+        files
+            .iter()
+            .find(|(p, _)| p == path)
+            .map(|(_, c)| c.as_str())
+            .unwrap_or_else(|| {
+                panic!(
+                    "{path} not realized; have {:?}",
+                    files.iter().map(|f| &f.0).collect::<Vec<_>>()
+                )
+            })
+    }
+
+    /// Every emitted file has a place: modules where the partition crates include them from, the
+    /// entry at Cargo's binary path, generated tests in the top package's `tests/`, and a population
+    /// manifest over the realized paths. The single-package crate root is superseded by the
+    /// facade's, so `src/lib.rs` appears once.
+    #[test]
+    fn every_emitted_file_lands_at_its_workspace_path_and_tests_are_kept() {
+        let outcome = realize(
+            base_files(vec![text("tests/fx_a_test.rs", "#[test] fn t() {}\n")]),
+            edges(&["fx_a"], vec![]),
+            false,
+        );
+        let files = realized_files(&outcome);
+        for path in [
+            "src/v1/stage0/src/fx_a.rs",
+            "src/v1/stage0/src/v1_rt.rs",
+            "src/main.rs",
+            "tests/fx_a_test.rs",
+            "Cargo.toml",
+            "src/emitted_population.rs",
+        ] {
+            content_of(&files, path);
+        }
+        assert_eq!(files.iter().filter(|(p, _)| p == "src/lib.rs").count(), 1);
+        let population = content_of(&files, "src/emitted_population.rs");
+        assert!(
+            population.contains("tests/fx_a_test.rs")
+                && population.contains("src/v1/stage0/src/fx_a.rs")
+        );
+        assert!(content_of(&files, "Cargo.toml").contains("[workspace]"));
+    }
+
+    #[test]
+    fn an_emitted_file_with_no_workspace_place_refuses_by_path() {
+        let outcome = realize(
+            base_files(vec![text("assets/logo.svg", "<svg/>")]),
+            edges(&["fx_a"], vec![]),
+            false,
+        );
+        match &*outcome {
+            EmittedWorkspaceRealization::EmittedWorkspaceRealizationRefused { cause } => {
+                match &**cause {
+                    EmittedWorkspaceRealizationRefusal::EmittedWorkspaceFileUnplaced { path } => {
+                        assert_eq!(path.as_str(), "assets/logo.svg")
+                    }
+                    other => panic!("refused for the wrong reason: {other:?}"),
+                }
+            }
+            EmittedWorkspaceRealization::EmittedWorkspaceRealizedOk { .. } => {
+                panic!("an unplaceable file was dropped from a successful realization")
+            }
+        }
+    }
+
+    /// A source module named `main` is written as `main_mod.rs` beside the binary's `main.rs`, and
+    /// its edges name it by that basename, so the plan finds every endpoint among the modules.
+    #[test]
+    fn a_module_named_main_realizes_under_its_emitted_basename() {
+        let main_mod = rust_module_emit_filename("main".to_string());
+        assert_eq!(main_mod, "main_mod");
+        let outcome = realize(
+            base_files(vec![text("src/main_mod.rs", "pub fn run() {}\n")]),
+            edges(
+                &["fx_a", "main_mod"],
+                vec![declared_import_edge(main_mod.clone(), "fx_a".to_string())],
+            ),
+            false,
+        );
+        content_of(&realized_files(&outcome), "src/v1/stage0/src/main_mod.rs");
+    }
+
+    /// v1_rt gates on `text_lookup_work_counter`; the crate that owns it must declare the feature
+    /// or `-D warnings` refuses every cfg site as unexpected (paired with test.claim
+    /// .emitted_manifest_runtime_features emitted_runtime_gates_on_the_declared_feature).
+    #[test]
+    fn the_runtime_crate_manifest_declares_the_runtime_gated_feature() {
+        let files = realized_files(&realize(
+            base_files(vec![]),
+            edges(&["fx_a"], vec![]),
+            false,
+        ));
+        let manifest = content_of(&files, "src/v1/v2-emitted-runtime/Cargo.toml");
+        assert!(manifest.contains("[features]"), "{manifest}");
+        assert!(
+            manifest.contains("text_lookup_work_counter = []"),
+            "{manifest}"
+        );
+    }
+
+    /// An emission that renders async services links reqwest over Rustls with the native-tls
+    /// default switched off; one that renders none does not link reqwest at all.
+    #[test]
+    fn a_service_emission_links_reqwest_over_rustls_without_default_features() {
+        let with = realized_files(&realize(base_files(vec![]), edges(&["fx_a"], vec![]), true));
+        let top = content_of(&with, "Cargo.toml");
+        assert!(
+            top.contains("reqwest")
+                && top.contains("rustls-tls")
+                && top.contains("default-features = false"),
+            "{top}"
+        );
+        let without = realized_files(&realize(
+            base_files(vec![]),
+            edges(&["fx_a"], vec![]),
+            false,
+        ));
+        assert!(!content_of(&without, "Cargo.toml").contains("reqwest"));
+    }
+
+    fn inline_targets(content: &str) -> Vec<String> {
+        let modules: im::HashMap<String, bool> = ["fx_a", "fx_b", "fx_c", "fx_d", "fx_e"]
+            .iter()
+            .map(|m| (m.to_string(), true))
+            .collect();
+        crate::v1_compiler_emit_rust::emitted_inline_path_edges(
+            text("src/fx_a.rs", content),
+            Rc::new(modules),
+        )
+        .iter()
+        .filter(|e| matches!(e.provenance, EmittedEdgeProvenance::InlinePathReference))
+        .filter_map(|e| match &*e.to {
+            EmittedEdgeTarget::EmittedModuleTarget { module } => Some(module.to_string()),
+            EmittedEdgeTarget::EmittedCrateRootTarget => None,
+        })
+        .collect()
+    }
+
+    /// A call by path is an edge; a comment, a string literal, a `use` line (returned with its own
+    /// provenance) and the module's own path are not.
+    #[test]
+    fn a_call_by_path_is_an_edge_and_prose_strings_and_use_lines_are_not() {
+        let targets = inline_targets(concat!(
+            "use crate::fx_e::Thing;\n",
+            "// calls crate::fx_c::nothing\n",
+            "pub fn a() -> i64 { let s = \"crate::fx_d::f\"; crate::fx_b::b() + crate::fx_a::own() }\n"
+        ));
+        assert_eq!(targets, vec!["fx_b".to_string()]);
+    }
+
+    #[test]
+    fn a_path_into_a_name_that_is_no_module_of_the_emission_is_not_an_edge() {
+        assert!(
+            inline_targets("pub fn a() { crate::NonEmptyVec::new(); crate::fx_zz::f(); }\n")
+                .is_empty()
+        );
+    }
+}
diff --git a/src/v1/stage0/src/cli_run/entry_resolve.rs b/src/v1/stage0/src/cli_run/entry_resolve.rs
index 380d45bb3b4..8570ec5ff15 100644
--- a/src/v1/stage0/src/cli_run/entry_resolve.rs
+++ b/src/v1/stage0/src/cli_run/entry_resolve.rs
@@ -364,12 +364,14 @@ fn broken() -> Int { no_such_function_anywhere() }\n";
                 let Some(candidates) = index.get(&module_path) else {
                     continue;
                 };
-                for path in candidates {
+                for source in candidates {
+                    let path = source.path();
                     let rel = normalize_repo_path(&module_index_path_key(path));
                     if !seen.insert(rel) {
                         continue;
                     }
-                    let file_content = std::fs::read_to_string(path)
+                    let file_content = source
+                        .read()
                         .map_err(|e| format!("read imported module {}: {e}", path.display()))?;
                     queue.push(file_content);
                 }
@@ -521,12 +523,14 @@ fn broken() -> Int { no_such_function_anywhere() }\n";
                 let Some(candidates) = index.get(&module_path) else {
                     continue;
                 };
-                for path in candidates {
+                for source in candidates {
+                    let path = source.path();
                     let rel = normalize_repo_path(&module_index_path_key(path));
                     if seen.contains_key(&rel) {
                         continue;
                     }
-                    let file_content = std::fs::read_to_string(path)
+                    let file_content = source
+                        .read()
                         .map_err(|e| format!("read imported module {}: {e}", path.display()))?;
                     seen.insert(
                         rel.clone(),
@@ -1008,7 +1012,7 @@ pub fn resolve_entry_graph(
     // wave 1) an entry's dependencies are name-derived, and the old
     // `load_sources_for_entry_with_index` walk only follows import edges — a
     // stripped fixed entry (e.g. the floor runner) failed to resolve at all.
-    let index = process_shared_index(source_roots);
+    let index = try_process_shared_index(source_roots)?;
     resolve_entry_with_index(&index, entry_file)
 }
 
@@ -1499,12 +1503,39 @@ pub fn resolved_graph_memo_keys_for_test(index: &MultiEntryIndex) -> Vec<String>
     index.resolved_graph_memo.borrow().keys().cloned().collect()
 }
 
+/// Empty caches over an already-indexed `source_files` map. Recorded as
+/// `ScratchCachesOverExistingSet` so the sharing control can count it without treating it as a
+/// second `NameSetIndex` (`MultiEntryIndexBuiltTwiceForOneNameSet` remains two name-set indexes).
+#[track_caller]
+pub(crate) fn new_multi_entry_index_scratch_over(
+    source_files: ModuleSourceIndex,
+    source_roots: &[String],
+) -> MultiEntryIndex {
+    record_multi_entry_index_site(
+        std::panic::Location::caller(),
+        &source_files,
+        MultiEntryIndexBuildKind::ScratchCachesOverExistingSet,
+    );
+    multi_entry_index_shell_body(source_files, source_roots)
+}
+
 #[track_caller]
 pub(crate) fn new_multi_entry_index_shell(
     source_files: ModuleSourceIndex,
     source_roots: &[String],
 ) -> MultiEntryIndex {
-    record_multi_entry_index_site(std::panic::Location::caller(), &source_files);
+    record_multi_entry_index_site(
+        std::panic::Location::caller(),
+        &source_files,
+        MultiEntryIndexBuildKind::NameSetIndex,
+    );
+    multi_entry_index_shell_body(source_files, source_roots)
+}
+
+fn multi_entry_index_shell_body(
+    source_files: ModuleSourceIndex,
+    source_roots: &[String],
+) -> MultiEntryIndex {
     MultiEntryIndex {
         generation: next_index_generation(),
         source_files,
@@ -1532,6 +1563,7 @@ pub(crate) fn new_multi_entry_index_shell(
         pool_bare_census: RefCell::new(None),
         entry_closure_sources: RefCell::new(HashMap::new()),
         both_closure_edges: RefCell::new(None),
+        scratch_underlay: RefCell::new(None),
         closure_name_censuses: RefCell::new(HashMap::new()),
         bare_reference_admission: RefCell::new(HashMap::new()),
         pool_module_names: std::cell::OnceCell::new(),
@@ -2894,16 +2926,19 @@ pub(crate) fn import_resolution_facts_with_observation(
         if !root_path.is_dir() {
             continue;
         }
-        let mut dag_files: Vec<PathBuf> = Vec::new();
-        collect_dag_files_tolerant(root_path, &mut dag_files);
+        let mut dag_files = Vec::new();
+        if let Err(cause) = collect_dag_files_tolerant(root_path, &mut dag_files) {
+            read_refusals.push((workspace_relative_repo_path(root), cause));
+            continue;
+        }
         dag_files.sort();
         for file in dag_files {
-            let rel = rel_path_for_layer_import(&file);
+            let rel = rel_path_for_layer_import(file.path());
             if is_excluded_import_path(&rel, exclude_substrings) {
                 continue;
             }
             observed_paths.insert(workspace_relative_repo_path(&rel));
-            let content = match std::fs::read_to_string(&file) {
+            let content = match file.read() {
                 Ok(c) => c,
                 Err(e) => {
                     read_refusals.push((workspace_relative_repo_path(&rel), e.to_string()));
@@ -3136,12 +3171,14 @@ pub(crate) fn reference_pool_names(pool_roots: &[String]) -> Rc<ReferencePoolNam
         if !root_path.is_dir() {
             continue;
         }
-        let mut files: Vec<PathBuf> = Vec::new();
-        collect_dag_files_tolerant(root_path, &mut files);
+        let mut files = Vec::new();
+        // A ledger row directory whose roster cannot be derived is not a tolerable read miss:
+        // a short pool-name set would silently drop the roster module's names.
+        collect_dag_files_tolerant(root_path, &mut files).unwrap_or_else(|cause| panic!("{cause}"));
         files.sort();
         for file in files {
-            let rel = rel_path_for_layer_import(&file);
-            let Ok(content) = std::fs::read_to_string(&file) else {
+            let rel = rel_path_for_layer_import(file.path());
+            let Ok(content) = file.read() else {
                 continue;
             };
             let Some(module_name) = extract_module_path(&content) else {
@@ -3583,8 +3620,8 @@ pub(crate) fn reference_edges_for_file_on_demand<
         // declaration or a name the file imports (the import edge already carries that), so
         // guessing a pool declarer for it is a heuristic the closed substrate never needs. It
         // manufactured a phantom edge from `std.optional { Present }` importers to a fixture that
-        // merely declares the same spelling. The proximity tier below stays for import-less files,
-        // where it already applied.
+        // merely declares the same spelling. Import-less files use the same on-chain UniqueBare
+        // rule below — not a leftover proximity rank.
         if !imports.is_empty() {
             continue;
         }
@@ -3597,29 +3634,14 @@ pub(crate) fn reference_edges_for_file_on_demand<
             if mods.contains(&self_module) {
                 continue;
             }
-            // Proximity disambiguation (namespace-only "nearest in the containment tree"):
-            // among declarers, prefer the one sharing the longest module-path prefix with the
-            // referencing module. A single nearest → UniqueBare; a tie at the nearest depth →
-            // AmbiguousBare (a genuine homonym the source must qualify — the bright-cat lane).
-            let mut best_len = 0usize;
-            let mut winners: Vec<&String> = Vec::new();
-            for m in mods.iter() {
-                let shared = module_prefix_shared_len(&self_module, m);
-                if winners.is_empty() || shared > best_len {
-                    best_len = shared;
-                    winners.clear();
-                    winners.push(m);
-                } else if shared == best_len {
-                    winners.push(m);
-                }
-            }
-            match winners.len() {
-                0 => {}
-                1 => upgrade(winners[0].clone(), RefEdgeResolution::UniqueBare),
-                _ => {
-                    // Homonym-qualification worklist dump (bright-cat lane (c) seed): each
-                    // AmbiguousBare is a bare ref, in a file that does not declare it, whose
-                    // nearest declarers tie — the definitive "needs qualification" site.
+            // On-chain unique → UniqueBare. Census-unique off-chain → UniqueBare, because
+            // UniqueBinding still accepts that name on the compile path (dropping it is an
+            // undercount). Homonyms with no unique on-chain binder → no UniqueBare (proximity
+            // deleted); two or more on-chain → AmbiguousBare.
+            match pick_importless_bare(&self_module, mods) {
+                ImportlessBarePick::None => {}
+                ImportlessBarePick::Unique(m) => upgrade(m.clone(), RefEdgeResolution::UniqueBare),
+                ImportlessBarePick::Ambiguous(winners) => {
                     if std::env::var("REFAMBIG_DUMP").is_ok() {
                         let is_witness = rel.contains("/test/") || rel.ends_with("_test.dag");
                         let cands: Vec<String> = winners.iter().map(|s| (*s).clone()).collect();
@@ -3681,15 +3703,21 @@ pub fn reference_resolution_facts(
         if !root_path.is_dir() {
             continue;
         }
-        let mut files: Vec<PathBuf> = Vec::new();
-        collect_dag_files_tolerant(root_path, &mut files);
+        let mut files = Vec::new();
+        if let Err(cause) = collect_dag_files_tolerant(root_path, &mut files) {
+            unaccounted.push(ReferenceAccountingRefusal {
+                path: cause,
+                cause: "the pool root's ledger roster could not be derived",
+            });
+            continue;
+        }
         files.sort();
         for file in files {
-            let rel = rel_path_for_layer_import(&file);
+            let rel = rel_path_for_layer_import(file.path());
             if is_excluded_import_path(&rel, exclude_substrings) {
                 continue;
             }
-            let content = std::fs::read_to_string(&file).ok();
+            let content = file.read().ok();
             match reference_edges_for_file(&rel, content.as_deref(), &names) {
                 FileReferenceEdges::Edges(file_edges) => edges.extend(file_edges),
                 FileReferenceEdges::Unaccounted(cause) => {
diff --git a/src/v1/stage0/src/cli_run/floor_memory_supervisor.rs b/src/v1/stage0/src/cli_run/floor_memory_supervisor.rs
index 18b92376a6a..115f464bee2 100644
--- a/src/v1/stage0/src/cli_run/floor_memory_supervisor.rs
+++ b/src/v1/stage0/src/cli_run/floor_memory_supervisor.rs
@@ -229,6 +229,31 @@ pub fn read_cgroup_memory(dir: &Path) -> Result<CgroupMemoryRead, QualificationR
     })
 }
 
+/// The swap half of a cgroup's envelope (extdeps.linux.cgroup_v2_memory MemorySwapMax,
+/// MemorySwapCurrent, MemorySwapPeak): `memory.swap.max` as written (`max` when unlimited -- a third
+/// state, not a large number), `memory.swap.current` (resident swap, an instantaneous gauge) and
+/// `memory.swap.peak` (the lifetime maximum, ABSENT on kernels that predate it -- reported as absent,
+/// never as zero, because a reader that cannot see the peak must say so rather than report no rise).
+/// An unreadable max or gauge is a refusal like every other file here.
+pub struct CgroupSwapRead {
+    pub swap_max: String,
+    pub swap_current: u64,
+    pub swap_peak: Option<u64>,
+}
+
+pub fn read_cgroup_swap(dir: &Path) -> Result<CgroupSwapRead, QualificationRefusal> {
+    let swap_peak = if dir.join("memory.swap.peak").is_file() {
+        Some(read_count(dir, "memory.swap.peak")?)
+    } else {
+        None
+    };
+    Ok(CgroupSwapRead {
+        swap_max: read_file(dir, "memory.swap.max")?,
+        swap_current: read_count(dir, "memory.swap.current")?,
+        swap_peak,
+    })
+}
+
 /// Locate the cgroup whose counters this invocation may honestly report, BEFORE the child starts.
 /// Refusing here rather than after a 35-minute run is the same discipline the failure-mode row
 /// `suppressed_precondition_failure_runs_the_workload_unconstrained` states: verify the
diff --git a/src/v1/stage0/src/cli_run/native_lane_runner.rs b/src/v1/stage0/src/cli_run/native_lane_runner.rs
index 08060f2d008..80dab6990a1 100644
--- a/src/v1/stage0/src/cli_run/native_lane_runner.rs
+++ b/src/v1/stage0/src/cli_run/native_lane_runner.rs
@@ -52,6 +52,17 @@ use std::process::Command;
 const FAULT_EXPERIMENT_ENV: &str = "GUNBC_NATIVE_FAULT_EXPERIMENT";
 const FAULT_EXPERIMENT_SKIP_VALUE: &str = "skip_pull_request";
 
+/// THE PRODUCT-REUSE INPUT, joined to `gunbc.emitted_subject_build_gate`
+/// `native_product_reuse_env_name` / `native_product_reuse_fresh_value` by the same witness.
+/// `fresh` (operator ruling 2026-10-09: the required job "requires fresh emission/build of both
+/// retained products and refuses a restored final-product hit; ordinary Cargo reuse may remain")
+/// means the native product store is NOT consulted for serving: the closure is emitted and built
+/// here, and a run that binds a store root while asking for `fresh` is REFUSED rather than served
+/// -- two inputs that contradict each other are a defect in the invocation, never a quiet miss.
+/// Absent or any other value keeps the store's own behaviour (consulted only when a root is bound).
+const PRODUCT_REUSE_ENV: &str = "GUNBC_NATIVE_PRODUCT_REUSE";
+const PRODUCT_REUSE_FRESH_VALUE: &str = "fresh";
+
 /// The compiler entry whose closure becomes the lane's emitted-native compiler. Its
 /// `compiler_pipeline_entry` is `SourceRootEvalDriver`, so the emitted crate's `main.rs` is the
 /// whole-source-root Eval driver this lane exists to route through — and, since the admission
@@ -80,8 +91,9 @@ const MALFORMED_SPECIMEN_COMMITTED: &str = "fixtures/native_lane_malformed/poiso
 /// workspace-relative like every path this harness hands the binary (its working directory is
 /// the workspace root). The receipt records the observed refusal path; the admission authority
 /// requires it non-empty, and this harness requires it to name the materialized specimen.
-const MALFORMED_CONTROL_ROOT: &str = "target/v2-native-lane/malformed-control-root";
-const MALFORMED_MATERIALIZED_PATH: &str = "target/v2-native-lane/malformed-control-root/poison.dag";
+const MALFORMED_CONTROL_ROOT: &str = "target/v2-native-lane/malformed-control-root/dag";
+const MALFORMED_MATERIALIZED_PATH: &str =
+    "target/v2-native-lane/malformed-control-root/dag/poison.dag";
 
 /// THE TWO DOORS' CONTROL INPUTS, AS THE THREE FACTS THEIR ARGV IS BUILT FROM.
 ///
@@ -101,7 +113,12 @@ const MALFORMED_MATERIALIZED_PATH: &str = "target/v2-native-lane/malformed-contr
 /// the text not Rust (gunbc.recurring_failure_mode closure_emit_renders_an_arrow_without_its_body).
 /// So an exit 0 now has to carry the declaration's NAME and its VALUE in text a Rust compiler
 /// ACCEPTS; anything less is that class returning, not an emission.
-const WELL_FORMED_CONTROL_ROOT: &str = "fixtures/native_cli_door";
+const WELL_FORMED_CONTROL_ROOT: &str = "fixtures/native_cli_door/dag";
+const NATIVE_INGEST_COPIED_SINGLE_ROOT: &str = "fixtures/native_ingest_copied_single_root";
+const NATIVE_INGEST_SRC_IN_DAG_ROOT: &str = "fixtures/native_ingest_src_in_dag/dag";
+const NATIVE_INGEST_TWO_ROOTS_DAG: &str = "fixtures/native_ingest_two_roots/dag";
+const NATIVE_INGEST_TWO_ROOTS_V2: &str = "fixtures/native_ingest_two_roots/src/v2";
+const NATIVE_INGEST_DUPLICATE_MODULE_ROOT: &str = "fixtures/native_ingest_duplicate_module/dag";
 const CLI_DOOR_ENTRY_MODULE: &str = "fixture.native_cli_door.door_probe";
 const CLI_DOOR_EMITTED_WITNESS: &str = "native_cli_door_probe_value";
 const CLI_DOOR_EMITTED_VALUE: &str = "606060";
@@ -282,28 +299,23 @@ fn sha256_file(path: &Path) -> Result<String, String> {
     Ok(format!("{:x}", sha2::Sha256::digest(&bytes)))
 }
 
-/// The emitted closure's identity: one digest over the crate's emitted sources, path and
-/// content in sorted order, so the receipt names WHAT was compiled, not merely that something
-/// was.
-fn emitted_closure_identity(crate_dir: &Path) -> Result<String, String> {
+/// The emitted closure's identity: one digest over EVERY file the realized workspace holds --
+/// module sources, the binary's entry, each crate's manifest and root -- path relative to the
+/// workspace root and content, in sorted path order. The population is the realization's own
+/// (`EmittedWorkspace::files`), so the identity names what was compiled and does not depend on
+/// where the workspace was written.
+fn emitted_closure_identity(emitted: &super::EmittedWorkspace) -> Result<String, String> {
     use sha2::Digest;
-    let src_dir = crate_dir.join("src");
-    let mut files: Vec<PathBuf> = std::fs::read_dir(&src_dir)
-        .map_err(|e| format!("could not list {}: {e}", src_dir.display()))?
-        .filter_map(|entry| entry.ok().map(|e| e.path()))
-        .filter(|path| path.extension().map(|ext| ext == "rs").unwrap_or(false))
-        .collect();
-    files.sort();
+    let mut paths: Vec<&String> = emitted.files.iter().collect();
+    paths.sort();
     let mut hasher = sha2::Sha256::new();
-    for path in &files {
+    for relative in paths {
+        let path = emitted.root.join(relative);
         let bytes =
-            std::fs::read(path).map_err(|e| format!("could not read {}: {e}", path.display()))?;
-        hasher.update(
-            path.file_name()
-                .map(|n| n.to_string_lossy().into_owned())
-                .unwrap_or_default()
-                .as_bytes(),
-        );
+            std::fs::read(&path).map_err(|e| format!("could not read {}: {e}", path.display()))?;
+        hasher.update(relative.as_bytes());
+        hasher.update([0u8]);
+        hasher.update((bytes.len() as u64).to_le_bytes());
         hasher.update(&bytes);
     }
     Ok(format!("{:x}", hasher.finalize()))
@@ -359,7 +371,32 @@ fn prepare_emitted_compiler_for_entry(
     // anything is emitted. A verified hit stands in for reconcile + emit + build + the red that
     // admitted the entry; the caller's door and refusal controls then run against the reused
     // executable exactly as they would against a fresh one.
-    let store = super::native_product_cache::store_root();
+    //
+    // UNLESS THE CALLER ASKED FOR A FRESH PRODUCT (`PRODUCT_REUSE_ENV`): then no store is consulted
+    // and nothing is committed, and a bound store root is a contradiction the run refuses.
+    let fresh_required =
+        std::env::var(PRODUCT_REUSE_ENV).ok().as_deref() == Some(PRODUCT_REUSE_FRESH_VALUE);
+    let store = if fresh_required {
+        if let Some(root) = super::native_product_cache::store_root() {
+            return Err(format!(
+                "V2-NATIVE REFUSAL cause=NativeProductReuseRefused — {PRODUCT_REUSE_ENV}={PRODUCT_REUSE_FRESH_VALUE} \
+                 requires this run to emit and build {entry} itself, yet GUNBC_NATIVE_CACHE_ROOT binds a native \
+                 product store at {}; a restored final product may not stand in for the build this run owes, so \
+                 unbind the store or withdraw the input",
+                root.display()
+            ));
+        }
+        eprintln!(
+            "v2-native-route: FRESH PRODUCT REQUIRED — {PRODUCT_REUSE_ENV}={PRODUCT_REUSE_FRESH_VALUE}: the native \
+             product store is not consulted and nothing is committed; {entry} is emitted and built by this run"
+        );
+        None
+    } else {
+        super::native_product_cache::store_root()
+    };
+    // Under `fresh` NO key is derived: `derive_key` re-ingests the corpus index and reloads the
+    // closure only to hash it, which the emission below does again -- the same work twice (DESIGN
+    // section 2) for a receipt that can be written from what this run already computes.
     let product_key = match &store {
         Some(_) => Some(
             super::native_product_cache::derive_key(source_roots, entry, &workspace)
@@ -509,10 +546,11 @@ fn prepare_emitted_compiler_for_entry(
             ))
         }
     }
-    let (crate_dir, written) =
-        super::emitted_closure_compile_host::write_probe_crate(&run, &probe_root, entry)
-            .map_err(|cause| format!("V2-NATIVE REFUSAL cause=EmittedCrateNotWritten — {cause}"))?;
-    let closure_identity = emitted_closure_identity(&crate_dir)?;
+    let emitted = super::emitted_closure_compile_host::write_probe_crate(&run, &probe_root, entry)
+        .map_err(|cause| format!("V2-NATIVE REFUSAL cause=EmittedCrateNotWritten — {cause}"))?;
+    let crate_dir = emitted.root.clone();
+    let written = emitted.files.len();
+    let closure_identity = emitted_closure_identity(&emitted)?;
     // THE BUILD'S PEAK MUST NOT STACK ON THE EMISSION'S RETAINED ARENA. The emission's resolved
     // graph died inside `compile_entry_emission` and the emitted file texts die with `run` here,
     // but glibc retains the freed arena — and the cargo build below needs gigabytes beside this
@@ -624,6 +662,28 @@ fn prepare_emitted_compiler_for_entry(
     let seed_identity = sha256_file(&std::env::current_exe().map_err(|e| {
         format!("V2-NATIVE REFUSAL cause=SeedIdentityUnreadable — current_exe: {e}")
     })?)?;
+    // THE FRESH-PRODUCT RECEIPT (operator ruling 2026-10-09): one line per product stating that THIS
+    // run realized it, with the identities a reader needs to tie the executable to its inputs: the
+    // source tree the run judged (GITHUB_SHA where a workflow set it; the receipt says so when it
+    // did not), the emitted closure, the seed executable, the toolchain and build configuration
+    // (the same two helpers the product key hashes), and the built executable. Printed only under
+    // `fresh`, because only then is `realization=fresh` a fact this run owns. Nothing here is
+    // computed for the receipt alone.
+    if fresh_required {
+        let source_tree = std::env::var("GITHUB_SHA")
+            .ok()
+            .filter(|s| !s.trim().is_empty())
+            .unwrap_or_else(|| "unset(GITHUB_SHA absent: an operator-local run)".to_string());
+        let toolchain = super::emitted_closure_compile_host::probe_toolchain_identity_for_key()?;
+        let build_configuration =
+            super::emitted_closure_compile_host::probe_build_configuration_for_key();
+        eprintln!(
+            "v2-native-route: FRESH PRODUCT RECEIPT entry={entry} realization=fresh \
+             source_tree={source_tree} closure_identity={closure_identity} \
+             seed_sha256={seed_identity} toolchain={toolchain} \
+             build_configuration={build_configuration} executable_sha256={binary_identity}"
+        );
+    }
     eprintln!(
         "v2-native-route: emitted compiler at {} (sha256 {binary_identity})",
         binary_path.display()
@@ -670,7 +730,7 @@ fn prepare_emitted_compiler_for_entry(
     } else {
         eprintln!("v2-native-route: establishing the discriminating red on {entry_module}");
         let mutation = super::emitted_closure_compile_host::establish_discriminating_red(
-            &crate_dir,
+            &emitted,
             &probe_root.target_dir(),
             &entry_module,
         );
@@ -884,10 +944,9 @@ fn materialize_malformed_specimen(workspace: &Path) -> Result<String, String> {
 /// census run's only consumed output.
 struct NativeFileRefusalObserved {
     path: String,
-    /// The FIRST diagnostic of the file's chain -- often an advisory that rode along (the
-    /// grammar-construction residue `parse_grammar_choice_overlap_residue` heads every file,
-    /// clean ones included). Carried so the summary can show it AS the head, beside the cause,
-    /// rather than leaving a reader to mistake it for one.
+    /// The FIRST diagnostic of the file's chain -- possibly a non-fatal advisory that
+    /// `rejected_with_pending` prepended. Carried so the summary can show it AS the head, beside
+    /// the cause, rather than leaving a reader to mistake it for one.
     head_reason: String,
     fatal_reason: String,
     /// Where the FATAL link points, rendered from the row's `chain`
@@ -2065,8 +2124,7 @@ struct CliRefusalRendering {
 ///
 /// `v2.cli.compile_cli` renders `REFUSED: the closure did not emit; diagnostic chain: <links> |
 /// FATAL AT <locus>`, and `diagnostics_fatal` folds the chain to its LAST link -- that module's
-/// annotation states why: the head answers `parse_grammar_choice_overlap_residue` for every entry
-/// tried, a grammar-global ADVISORY that is never the fatal.
+/// annotation states why: a head can be a non-fatal advisory, and the fatal is the last link.
 ///
 /// EVERY LINK IS NOW LOCATED, AND THIS DECODER DID NOT KNOW THAT. gunbc#11965/#11985 moved the chain
 /// to `lens_verdict_diagnostics_located_chain_text`, so a link is
@@ -2568,11 +2626,129 @@ fn walk_cli_door(
         }
     }
     eprintln!("v2-native-cli: filesystem controls refused absent root and unreadable source with typed, located causes");
+    walk_native_ingest_layout_controls(binary, workspace)?;
     let refusal_status = i64::from(refused.status.unwrap_or_default());
     eprintln!("v2-native-cli: door refused as cli_no_entry — exit {refusal_status}");
     Ok((door_exit_status, emitted_bytes, refusal_status))
 }
 
+/// THE LAYOUT REDS THE PARENT ASKED THE NATIVE DOOR TO EXECUTE. Claims over `v2_cli_run` supply
+/// ingest at that fold; these walks are the inhabitance that the discovering --source-root, not
+/// the file spelling, tags the tree — deleting any of the four fixture roots makes this control
+/// fail.
+///
+/// SEED DELTA (ctrl hand-Rust receipt): extend `walk_cli_door`; no new production route and no
+/// deleted scaffold. Accounted on `gunbc.source_root_eval_driver_seed_growth`
+/// `source_root_eval_driver_seed_growth_justification` (lane `v1-hand-queue-drain`). Net seed is
+/// this inhabitance walk over existing `run_cli_door`.
+fn walk_native_ingest_layout_controls(binary: &Path, workspace: &Path) -> Result<(), String> {
+    let copied = workspace.join(NATIVE_INGEST_COPIED_SINGLE_ROOT);
+    let src_in_dag = workspace.join(NATIVE_INGEST_SRC_IN_DAG_ROOT);
+    let two_dag = workspace.join(NATIVE_INGEST_TWO_ROOTS_DAG);
+    let two_v2 = workspace.join(NATIVE_INGEST_TWO_ROOTS_V2);
+    let dup = workspace.join(NATIVE_INGEST_DUPLICATE_MODULE_ROOT);
+    for (label, path) in [
+        ("copied-single-root", copied.as_path()),
+        ("src-in-dag", src_in_dag.as_path()),
+        ("two-roots-dag", two_dag.as_path()),
+        ("two-roots-v2", two_v2.as_path()),
+        ("duplicate-module", dup.as_path()),
+    ] {
+        if !path.is_dir() {
+            return Err(format!(
+                "V2-NATIVE REFUSAL cause=NativeIngestLayoutRootAbsent — {label} {} is not a directory",
+                path.display()
+            ));
+        }
+    }
+
+    let copied_obs = run_cli_door(
+        binary,
+        &[
+            "emit".into(),
+            "--entry".into(),
+            "fixture.native_ingest.copied_dag".into(),
+            "--source-root".into(),
+            copied.display().to_string(),
+        ],
+    )?;
+    if copied_obs.status != Some(CLI_DOOR_USAGE_REFUSAL_EXIT)
+        || !copied_obs.stdout.is_empty()
+        || !copied_obs
+            .stderr
+            .contains("source root is not a dag or src/v2 tree")
+        || !copied_obs.stderr.contains(&copied.display().to_string())
+    {
+        return Err(format!(
+            "V2-NATIVE REFUSAL cause=NativeIngestCopiedRootNotUnrecognized — status={:?} stderr={}",
+            copied_obs.status,
+            copied_obs.stderr.trim()
+        ));
+    }
+
+    let src_obs = run_cli_door(
+        binary,
+        &[
+            "emit".into(),
+            "--entry".into(),
+            "fixture.native_ingest.src_in_dag".into(),
+            "--source-root".into(),
+            src_in_dag.display().to_string(),
+        ],
+    )?;
+    if src_obs.status != Some(0) || src_obs.stdout.is_empty() {
+        return Err(format!(
+            "V2-NATIVE REFUSAL cause=NativeIngestSrcInDagPathMisclassified — status={:?} stderr={}",
+            src_obs.status,
+            src_obs.stderr.trim()
+        ));
+    }
+
+    let two_obs = run_cli_door(
+        binary,
+        &[
+            "emit".into(),
+            "--entry".into(),
+            "fixture.native_ingest.dag_entry".into(),
+            "--source-root".into(),
+            two_dag.display().to_string(),
+            "--source-root".into(),
+            two_v2.display().to_string(),
+        ],
+    )?;
+    if two_obs.status != Some(0) || two_obs.stdout.is_empty() {
+        return Err(format!(
+            "V2-NATIVE REFUSAL cause=NativeIngestTwoRootsDidNotEmit — status={:?} stderr={}",
+            two_obs.status,
+            two_obs.stderr.trim()
+        ));
+    }
+
+    let dup_obs = run_cli_door(
+        binary,
+        &[
+            "emit".into(),
+            "--entry".into(),
+            "fixture.native_ingest.collision".into(),
+            "--source-root".into(),
+            dup.display().to_string(),
+        ],
+    )?;
+    if dup_obs.status != Some(CLI_DOOR_REFUSAL_EXIT)
+        || !dup_obs.stderr.contains("closure_census_duplicate_module")
+        || !dup_obs.stderr.contains("collision_a.dag")
+        || !dup_obs.stderr.contains("collision_b.dag")
+    {
+        return Err(format!(
+            "V2-NATIVE REFUSAL cause=NativeIngestDuplicateDidNotNameBothFiles — status={:?} stderr={}",
+            dup_obs.status,
+            dup_obs.stderr.trim()
+        ));
+    }
+    eprintln!("v2-native-cli: native-ingest layout controls held (unrecognized copied root, /src/ under dag, two roots, both-files duplicate)");
+    Ok(())
+}
+
 /// THE GENERATION-ONE EXECUTABLE OUTLIVES THE RUN, because generation two is that executable
 /// emitting `v2.compiler.compile` and nothing else may stand in for it. The probe root is NOT
 /// retained: once the executable is copied out and its copy re-hashes to the identity the run
@@ -2723,6 +2899,8 @@ pub struct NativeServeProgramRun {
     pub seed_identity: String,
     pub warning_count: i64,
     pub announcement: String,
+    pub peer_announcement: String,
+    pub peer_port: i64,
     pub responses: Vec<String>,
     pub refused_status: Option<i32>,
     pub refused_stderr: String,
@@ -2815,9 +2993,8 @@ pub fn run_native_serve_program(
     release_revision: &str,
     refused_revision: &str,
     request_deadline_ms: &str,
-    requests: &[String],
+    requests_for_peer_port: &dyn Fn(i64) -> Result<Vec<String>, String>,
 ) -> Result<NativeServeProgramRun, String> {
-    use std::io::{BufRead, Read};
     let prepared = prepare_emitted_compiler_for_entry(source_roots, entry)?;
     eprintln!(
         "native-serve: {entry} built (closure {}) -- starting {}",
@@ -2826,7 +3003,132 @@ pub fn run_native_serve_program(
     );
     let (refused_status, refused_stderr) =
         native_serve_refused_launch(&prepared.binary_path, refused_revision, request_deadline_ms)?;
-    let mut child = Command::new(&prepared.binary_path)
+    // The PEER is a second instance of the same entry: the local server the entry's bound REST
+    // handler is pointed at, so the answered arm is produced by a real exchange. Its port is the
+    // one fact only it can publish, so the reader module is asked for the requests only after it.
+    let mut peer = native_serve_start(
+        &prepared.binary_path,
+        entry,
+        release_revision,
+        request_deadline_ms,
+    )?;
+    let peer_port = match peer
+        .address
+        .as_deref()
+        .and_then(|address| address.rsplit(':').next())
+        .and_then(|port| port.parse::<i64>().ok())
+    {
+        Some(port) => port,
+        None => {
+            let peer_stderr = peer.stop();
+            return Err(format!(
+                "NATIVE-SERVE REFUSAL cause=PeerUnannounced entry={entry} announcement={:?} — the peer instance printed no bound address, so no request can name its port{}",
+                peer.announcement,
+                if peer_stderr.is_empty() { String::new() } else { format!(" (stderr: {})", peer_stderr.trim_end()) }
+            ));
+        }
+    };
+    let requests = match requests_for_peer_port(peer_port) {
+        Ok(requests) => requests,
+        Err(cause) => {
+            peer.stop();
+            return Err(cause);
+        }
+    };
+    let mut subject = match native_serve_start(
+        &prepared.binary_path,
+        entry,
+        release_revision,
+        request_deadline_ms,
+    ) {
+        Ok(subject) => subject,
+        Err(cause) => {
+            peer.stop();
+            return Err(cause);
+        }
+    };
+    let responses = match &subject.address {
+        Some(address) => requests
+            .iter()
+            .map(|request| native_serve_exchange(address, request))
+            .collect(),
+        None => Vec::new(),
+    };
+    // The last case drives the subject past its stuck-worker ceiling, after which it exits by
+    // itself; wait for that (bounded) and carry the status to the reader unjudged. Only a process
+    // still running at the deadline is killed, and it reports no status. The peer serves no budget
+    // case and is stopped.
+    let (served_exit_status, stderr) = subject.await_exit();
+    let peer_stderr = peer.stop();
+    Ok(NativeServeProgramRun {
+        closure_identity: prepared.closure_identity,
+        binary_identity: prepared.binary_identity,
+        seed_identity: prepared.seed_identity,
+        warning_count: prepared.build.warning_count,
+        announcement: subject.announcement,
+        peer_announcement: peer.announcement,
+        peer_port,
+        responses,
+        refused_status,
+        refused_stderr,
+        served_exit_status,
+        stderr: format!("{stderr}{peer_stderr}"),
+    })
+}
+
+/// One started instance of a served entry: its announcement, the address read off it, and the
+/// process to stop. The host reads the address because the service binds port 0.
+struct NativeServeInstance {
+    child: std::process::Child,
+    reader: Option<std::thread::JoinHandle<String>>,
+    announcement: String,
+    address: Option<String>,
+}
+
+impl NativeServeInstance {
+    /// Wait up to the run deadline for the instance to exit by itself, killing it only past that;
+    /// the status is None when it had to be killed.
+    fn await_exit(&mut self) -> (Option<i32>, String) {
+        let started = std::time::Instant::now();
+        let status = loop {
+            match self.child.try_wait() {
+                Ok(Some(status)) => break status.code(),
+                Ok(None) if started.elapsed() < NATIVE_SERVE_DEADLINE => {
+                    std::thread::sleep(std::time::Duration::from_millis(20))
+                }
+                _ => {
+                    let _ = self.child.kill();
+                    let _ = self.child.wait();
+                    break None;
+                }
+            }
+        };
+        let stderr = self
+            .reader
+            .take()
+            .and_then(|reader| reader.join().ok())
+            .unwrap_or_default();
+        (status, stderr)
+    }
+
+    fn stop(&mut self) -> String {
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+        self.reader
+            .take()
+            .and_then(|reader| reader.join().ok())
+            .unwrap_or_default()
+    }
+}
+
+fn native_serve_start(
+    binary: &Path,
+    entry: &str,
+    release_revision: &str,
+    request_deadline_ms: &str,
+) -> Result<NativeServeInstance, String> {
+    use std::io::{BufRead, Read};
+    let mut child = Command::new(binary)
         .args(native_serve_launch_args(
             release_revision,
             request_deadline_ms,
@@ -2837,10 +3139,14 @@ pub fn run_native_serve_program(
         .map_err(|cause| {
             format!("NATIVE-SERVE REFUSAL cause=SpawnFailed entry={entry} — {cause}")
         })?;
-    let pipe = child
-        .stderr
-        .take()
-        .ok_or("NATIVE-SERVE REFUSAL cause=NoStderrPipe")?;
+    let pipe = match child.stderr.take() {
+        Some(pipe) => pipe,
+        None => {
+            let _ = child.kill();
+            let _ = child.wait();
+            return Err("NATIVE-SERVE REFUSAL cause=NoStderrPipe".to_string());
+        }
+    };
     let (lines, announced) = std::sync::mpsc::channel::<String>();
     let reader = std::thread::spawn(move || {
         let mut pipe = std::io::BufReader::new(pipe);
@@ -2858,42 +3164,11 @@ pub fn run_native_serve_program(
         .strip_prefix("native-serve listening on ")
         .and_then(|rest| rest.split(' ').next())
         .map(str::to_string);
-    let responses = match &address {
-        Some(address) => requests
-            .iter()
-            .map(|request| native_serve_exchange(address, request))
-            .collect(),
-        None => Vec::new(),
-    };
-    // The last case drives the service past its stuck-worker ceiling, after which it exits by
-    // itself; wait for that (bounded) and carry the status to the reader unjudged. Only a process
-    // still running at the deadline is killed, and it reports no status.
-    let started = std::time::Instant::now();
-    let served_exit_status = loop {
-        match child.try_wait() {
-            Ok(Some(status)) => break status.code(),
-            Ok(None) if started.elapsed() < NATIVE_SERVE_DEADLINE => {
-                std::thread::sleep(std::time::Duration::from_millis(20))
-            }
-            _ => {
-                let _ = child.kill();
-                let _ = child.wait();
-                break None;
-            }
-        }
-    };
-    let stderr = reader.join().unwrap_or_default();
-    Ok(NativeServeProgramRun {
-        closure_identity: prepared.closure_identity,
-        binary_identity: prepared.binary_identity,
-        seed_identity: prepared.seed_identity,
-        warning_count: prepared.build.warning_count,
+    Ok(NativeServeInstance {
+        child,
+        reader: Some(reader),
         announcement,
-        responses,
-        refused_status,
-        refused_stderr,
-        served_exit_status,
-        stderr,
+        address,
     })
 }
 
@@ -2983,19 +3258,60 @@ pub fn run_v2_native_frontier(
 /// carries the terminal marker's counts and decides nothing about them.
 pub struct NativeCensusRun {
     pub cause_groups: u64,
+    pub roots: u64,
     pub file_refusals: u64,
     pub residual_rows: u64,
     pub modules: u64,
     pub advised_files: u64,
+    pub inferred: u64,
+    pub infer_refused: u64,
+    pub type_census: TypeCensusVerdictWord,
 }
 
-/// `gunbc test //gunbc/instruments:v2-native-census`: the emitted compiler's `census-resolve` verb
-/// over the given roots. The child's stdout -- one `file_refusal`, `accepted_file_advisories`, `census_residual` and
-/// `cause_group` line per row, then the terminal -- is relayed whole, because those rows ARE the
+/// THE TYPE CENSUS'S VERDICT AS THE TERMINAL CARRIES IT: one of the three words the rendered main
+/// writes from `std.compiler_entry` `NativeClaimTerminal`, and nothing else. Any other value refuses
+/// rather than being copied into the receipt.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum TypeCensusVerdictWord {
+    Held,
+    NotHeld,
+    NoObservation,
+}
+
+impl TypeCensusVerdictWord {
+    fn decode(word: &str) -> Option<Self> {
+        match word {
+            "held" => Some(Self::Held),
+            "not_held" => Some(Self::NotHeld),
+            "no_observation" => Some(Self::NoObservation),
+            _ => None,
+        }
+    }
+
+    pub fn word(self) -> &'static str {
+        match self {
+            Self::Held => "held",
+            Self::NotHeld => "not_held",
+            Self::NoObservation => "no_observation",
+        }
+    }
+}
+
+/// `gunbc test //gunbc/instruments:v2-native-census`: the emitted compiler's `census-infer` verb
+/// over the given roots (census part 2: front-end, resolve and infer refusals in one carrier, one
+/// walk shared with the type-declaration census). The child's stdout -- one `file_refusal`,
+/// `accepted_file_advisories`, `census_residual`, `cause_group` and `census_root` line per row, the
+/// type census's own lines, then the terminal -- is relayed whole, because those rows ARE the
 /// census; only the terminal is decoded, and every field it must carry is required, none defaulted.
+/// The child's exit status is the TYPE census's verdict, a different fact, so it is carried in the
+/// terminal's `type_census` field and never read as this census's standing.
 pub fn run_v2_native_census(source_roots: &[String]) -> Result<NativeCensusRun, String> {
+    eprintln!(
+        "{}",
+        host_memory_budget_receipt_line(&crate::memory_governor::read_host_budget_resolution())
+    );
     let preparation = prepare_emitted_compiler(source_roots)?;
-    let mut args = vec!["census-resolve".to_string()];
+    let mut args = vec!["census-infer".to_string()];
     args.extend(source_roots.iter().cloned());
     let mut command = Command::new(&preparation.binary_path);
     command.args(&args);
@@ -3011,6 +3327,41 @@ pub fn run_v2_native_census(source_roots: &[String]) -> Result<NativeCensusRun,
     decode_native_census_output(&stdout, output.status.code())
 }
 
+/// WHERE THE RUN'S MEMORY BUDGET CAME FROM, IN THE RECEIPT. A whole-tree census is admitted against a
+/// declared demand (`gunbc.instrument_dispatch_workflow` `instrument_dispatch_memory_demands`), and
+/// the budget this process actually runs under is a separate fact. A receipt that does not say
+/// which source answered cannot tell an observed cgroup bound from an operator's unverified
+/// declaration, or from no bound at all. The line renders the one typed resolution
+/// (`memory_governor::read_host_budget_resolution`) and adds no precedence of its own.
+fn host_memory_budget_receipt_line(
+    resolution: &crate::memory_governor::HostBudgetResolution,
+) -> String {
+    use crate::memory_governor::HostBudgetResolution;
+    match resolution {
+        HostBudgetResolution::Resolved {
+            effective_bytes,
+            requested_bytes,
+            observation,
+        } => format!(
+            "[v2-native-census] host_memory_budget source=observed observed_by=\"{}\" \
+             bounds_this_process={} effective_bytes={effective_bytes} declared_bytes={}",
+            observation.source.label(),
+            observation.source.bounds_this_process(),
+            requested_bytes.map_or("none".to_string(), |b| b.to_string())
+        ),
+        HostBudgetResolution::DeclaredUnverified {
+            requested_bytes,
+            reason,
+        } => format!(
+            "[v2-native-census] host_memory_budget source=declared_unverified \
+             declared_bytes={requested_bytes} reason=\"{reason}\""
+        ),
+        HostBudgetResolution::Unreadable { reason } => {
+            format!("[v2-native-census] host_memory_budget source=unreadable reason=\"{reason}\"")
+        }
+    }
+}
+
 /// THE CHILD'S STREAMS, RELAYED AS IT WRITES THEM AND STILL COLLECTED WHOLE. `Command::output()`
 /// forwarded nothing until the child exited, so a multi-hour census was silent throughout and a
 /// cancelled run lost every row it had already printed (run 37229309848: 3h48m, empty stdout).
@@ -3053,7 +3404,7 @@ fn run_relaying_as_it_runs(mut command: Command) -> std::io::Result<std::process
     })
 }
 
-/// The census-resolve stdout, decoded. Only the terminal's counts are carried out, but the
+/// The census-infer stdout, decoded. Only the terminal's counts are carried out, but the
 /// advisory population is checked against its rows: `advised_files` is required, and a count the
 /// printed `accepted_file_advisories` rows do not match refuses, so a receipt saved from this
 /// stdout cannot claim an advisory population it does not carry.
@@ -3072,7 +3423,7 @@ fn decode_native_census_output(stdout: &str, exit: Option<i32>) -> Result<Native
             )
         })?;
     if terminal.get("_terminal").and_then(|t| t.as_str()) != Some("complete")
-        || terminal.get("mode").and_then(|m| m.as_str()) != Some("census-resolve")
+        || terminal.get("mode").and_then(|m| m.as_str()) != Some("census-infer")
     {
         return Err(format!(
             "V2-NATIVE-CENSUS REFUSAL cause=TerminalNotComplete — {terminal}"
@@ -3097,12 +3448,29 @@ fn decode_native_census_output(stdout: &str, exit: Option<i32>) -> Result<Native
     }
     advised_files_agree(advised_files, &advisory_rows)
         .map_err(|c| format!("V2-NATIVE-CENSUS REFUSAL cause=AdvisoryRowsDisagree — {c}"))?;
+    let type_census = terminal
+        .get("type_census")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| {
+            format!("V2-NATIVE-CENSUS REFUSAL cause=TerminalFieldMissing — no type_census: {terminal}")
+        })
+        .and_then(|word| {
+            TypeCensusVerdictWord::decode(word).ok_or_else(|| {
+                format!(
+                    "V2-NATIVE-CENSUS REFUSAL cause=TypeCensusWordUnknown — {word:?} is not held, not_held or no_observation: {terminal}"
+                )
+            })
+        })?;
     Ok(NativeCensusRun {
         cause_groups: need_u64("cause_groups")?,
+        roots: need_u64("roots")?,
         file_refusals: need_u64("file_refusals")?,
         residual_rows: need_u64("residual_rows")?,
         modules: need_u64("modules")?,
         advised_files,
+        inferred: need_u64("inferred")?,
+        infer_refused: need_u64("infer_refused")?,
+        type_census,
     })
 }
 
@@ -3341,6 +3709,66 @@ fn run_required_v2_native_inner(
 mod tests {
     use super::*;
 
+    /// THE IDENTITY IS THE WORKSPACE'S FILES, NOT ITS MODULE DIRECTORY. Relocating identical files
+    /// keeps it; changing only the binary's entry, or only a crate root outside the module
+    /// directory, changes it. The last two are what an identity over the module directory alone
+    /// could not see.
+    #[test]
+    fn the_closure_identity_covers_the_entry_and_crate_roots_and_ignores_location() {
+        let base = std::env::temp_dir().join(format!("nlr-identity-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+        let files = [
+            ("Cargo.toml", "[package]\nname = \"fx\"\n"),
+            ("src/lib.rs", "pub mod a { pub use fx_a::a::*; }\n"),
+            ("src/main.rs", "fn main() {}\n"),
+            ("src/v1/stage0/src/a.rs", "pub fn a() {}\n"),
+        ];
+        let workspace =
+            |name: &str, overrides: &[(&str, &str)]| -> super::super::EmittedWorkspace {
+                let root = base.join(name);
+                for (path, content) in files.iter() {
+                    let content = overrides
+                        .iter()
+                        .find(|(p, _)| p == path)
+                        .map(|(_, c)| *c)
+                        .unwrap_or(content);
+                    let full = root.join(path);
+                    std::fs::create_dir_all(full.parent().expect("parent")).expect("mkdir");
+                    std::fs::write(&full, content).expect("write");
+                }
+                super::super::EmittedWorkspace {
+                    root: root.clone(),
+                    module_dir: root.join("src/v1/stage0/src"),
+                    modules: vec!["a".to_string()],
+                    crate_count: 2,
+                    files: files.iter().map(|(p, _)| p.to_string()).collect(),
+                }
+            };
+        let here = emitted_closure_identity(&workspace("here", &[])).expect("identity");
+        let there = emitted_closure_identity(&workspace("there", &[])).expect("identity");
+        let entry = emitted_closure_identity(&workspace(
+            "entry",
+            &[("src/main.rs", "fn main() { 1; }\n")],
+        ))
+        .expect("identity");
+        let facade =
+            emitted_closure_identity(&workspace("facade", &[("src/lib.rs", "pub mod b {}\n")]))
+                .expect("identity");
+        let _ = std::fs::remove_dir_all(&base);
+        assert_eq!(
+            here, there,
+            "relocating identical files changed the identity"
+        );
+        assert_ne!(
+            here, entry,
+            "changing only the entry left the identity unchanged"
+        );
+        assert_ne!(
+            here, facade,
+            "changing only the facade left the identity unchanged"
+        );
+    }
+
     /// A HEAD SHARED BY EVERY FILE IS NOT THE CAUSE. The old summary was `file_refusals=2` and
     /// named neither file; this control reds on any rendering that drops a path, leads with the
     /// head, or tallies heads instead of fatal causes.
@@ -3353,15 +3781,10 @@ mod tests {
             fatal_at: at.to_string(),
         };
         let summary = native_file_refusal_summary(&[
-            row(
-                "a.dag",
-                "parse_grammar_choice_overlap_residue",
-                "parse_g0_tokens_remain",
-                "12:5",
-            ),
+            row("a.dag", "advisory_head_x", "parse_g0_tokens_remain", "12:5"),
             row(
                 "b.dag",
-                "parse_grammar_choice_overlap_residue",
+                "advisory_head_x",
                 "body_lowering_reason_x",
                 "<unresolved-node>",
             ),
@@ -3384,13 +3807,13 @@ mod tests {
             summary.contains("fatal_cause 1x body_lowering_reason_x"),
             "{summary}"
         );
-        assert!(!summary.contains("fatal_cause 2x parse_grammar_choice_overlap_residue"));
+        assert!(!summary.contains("fatal_cause 2x advisory_head_x"));
         // EVERY SUPPLIED FILE, EXACTLY ONCE, AS ITS WHOLE LINE. Asserting a and c alone let a
         // rendering that dropped b pass (review on #13005); the expected line is derived per row,
         // so the head appears only where it differs from the cause.
         let expected = [
-            "  refused a.dag at=12:5 fatal=parse_g0_tokens_remain head(advisory)=parse_grammar_choice_overlap_residue",
-            "  refused b.dag at=<unresolved-node> fatal=body_lowering_reason_x head(advisory)=parse_grammar_choice_overlap_residue",
+            "  refused a.dag at=12:5 fatal=parse_g0_tokens_remain head(advisory)=advisory_head_x",
+            "  refused b.dag at=<unresolved-node> fatal=body_lowering_reason_x head(advisory)=advisory_head_x",
             "  refused c.dag at=<whole-file> fatal=parse_g0_tokens_remain",
         ];
         assert_eq!(
@@ -3703,15 +4126,12 @@ mod tests {
     fn a_file_refusal_row_decodes_its_fatal_line_and_byte_column() {
         let marker = "{\"_terminal\":\"complete\",\"mode\":\"adjudicate\",\"rows\":0,\"universe\":0,\"file_refusals\":1,\"advised_files\":0,\"admitted\":false,\"summary\":\"s\",\"frontier\":\"held\"}";
         let located = format!(
-            "{{\"file_refusal\":{{\"path\":\"a.dag\",\"module\":{{\"_variant\":\"Absent\"}},\"chain\":{{\"head\":{{\"reason\":\"parse_grammar_choice_overlap_residue\",\"at\":{{\"_variant\":\"FileRefusalAtInvariant\",\"invariant\":\"grammar_choice_overlap\"}}}},\"tail\":[{{\"reason\":\"parse_g0_tokens_remain\",\"at\":{{\"_variant\":\"FileRefusalAtLine\",\"line\":12,\"byte_column\":{{\"value\":5}}}}}}]}}}}}}\n{marker}\n"
+            "{{\"file_refusal\":{{\"path\":\"a.dag\",\"module\":{{\"_variant\":\"Absent\"}},\"chain\":{{\"head\":{{\"reason\":\"advisory_head_x\",\"at\":{{\"_variant\":\"FileRefusalAtInvariant\",\"invariant\":\"grammar_choice_overlap\"}}}},\"tail\":[{{\"reason\":\"parse_g0_tokens_remain\",\"at\":{{\"_variant\":\"FileRefusalAtLine\",\"line\":12,\"byte_column\":{{\"value\":5}}}}}}]}}}}}}\n{marker}\n"
         );
         let parsed = parse_native_run_output(&located).expect("a located row parses");
         assert_eq!(parsed.file_refusals[0].fatal_at, "12:5");
         // Both reasons are DERIVED from the chain: the head link's and the last link's.
-        assert_eq!(
-            parsed.file_refusals[0].head_reason,
-            "parse_grammar_choice_overlap_residue"
-        );
+        assert_eq!(parsed.file_refusals[0].head_reason, "advisory_head_x");
         assert_eq!(
             parsed.file_refusals[0].fatal_reason,
             "parse_g0_tokens_remain"
@@ -3773,27 +4193,51 @@ mod tests {
     }
 
     #[test]
-    fn census_resolve_advisory_rows_reach_the_receipt() {
-        let terminal = "{\"_terminal\":\"complete\",\"mode\":\"census-resolve\",\"modules\":3,\
-                        \"file_refusals\":0,\"advised_files\":1,\"residual_rows\":0,\"cause_groups\":0}\n";
+    fn census_infer_advisory_rows_reach_the_receipt() {
+        let terminal = "{\"_terminal\":\"complete\",\"mode\":\"census-infer\",\"modules\":3,\
+                        \"file_refusals\":0,\"advised_files\":1,\"residual_rows\":0,\"cause_groups\":0,\
+                        \"roots\":0,\"inferred\":3,\"infer_refused\":0,\"type_census\":\"held\"}\n";
         let with_row = format!(
             "{{\"accepted_file_advisories\":{{\"path\":\"a.dag\",\"head\":\"r\",\"tail\":[]}}}}\n{terminal}"
         );
         let run = decode_native_census_output(&with_row, Some(0)).expect("rows match the count");
         assert_eq!(run.advised_files, 1);
-        // DISCRIMINATING: the same terminal without its row -- the receipt census-resolve wrote
+        // DISCRIMINATING: the same terminal without its row -- the receipt the census verb wrote
         // before it printed advisories -- refuses rather than carrying a count with no population.
         let cause = decode_native_census_output(terminal, Some(0))
             .err()
             .expect("must refuse");
         assert!(cause.contains("AdvisoryRowsDisagree"), "got: {cause}");
         // And a terminal with no advised_files at all (the old verb's marker) refuses too.
-        let old = "{\"_terminal\":\"complete\",\"mode\":\"census-resolve\",\"modules\":3,\
+        let old = "{\"_terminal\":\"complete\",\"mode\":\"census-infer\",\"modules\":3,\
                    \"file_refusals\":0,\"residual_rows\":0,\"cause_groups\":0}\n";
         let cause = decode_native_census_output(old, Some(0))
             .err()
             .expect("must refuse");
         assert!(cause.contains("no advised_files"), "got: {cause}");
+        // DISCRIMINATING: a census-resolve terminal is part 1's grain, not this census, and refuses.
+        let resolve_grain = terminal.replace("census-infer", "census-resolve");
+        let with_row = format!(
+            "{{\"accepted_file_advisories\":{{\"path\":\"a.dag\",\"head\":\"r\",\"tail\":[]}}}}\n{resolve_grain}"
+        );
+        let cause = decode_native_census_output(&with_row, Some(0))
+            .err()
+            .expect("must refuse");
+        assert!(cause.contains("TerminalNotComplete"), "got: {cause}");
+        // DISCRIMINATING: a type_census word outside the three the main writes refuses.
+        let odd = with_row
+            .replace("census-resolve", "census-infer")
+            .replace("\"held\"", "\"hold\"");
+        let cause = decode_native_census_output(&odd, Some(0))
+            .err()
+            .expect("must refuse");
+        assert!(cause.contains("TypeCensusWordUnknown"), "got: {cause}");
+        let run = decode_native_census_output(
+            &with_row.replace("census-resolve", "census-infer"),
+            Some(0),
+        )
+        .expect("a known word decodes");
+        assert_eq!(run.type_census, TypeCensusVerdictWord::Held);
         // A malformed row refuses here exactly as it does under `census`: one decoder.
         let malformed =
             format!("{{\"accepted_file_advisories\":{{\"path\":\"a.dag\"}}}}\n{terminal}");
@@ -3803,6 +4247,46 @@ mod tests {
         assert!(cause.contains("AdvisoryRowMalformed"), "got: {cause}");
     }
 
+    /// THE THREE BUDGET SOURCES RENDER AS THREE DIFFERENT RECEIPT WORDS: a declared ceiling is never
+    /// printed as an observed one, and an unreadable budget never as a number.
+    #[test]
+    fn host_memory_budget_receipt_line_names_its_source() {
+        use crate::memory_governor::{
+            HostBudgetObservation, HostBudgetResolution, HostBudgetSource,
+        };
+        let observed = host_memory_budget_receipt_line(&HostBudgetResolution::Resolved {
+            effective_bytes: 7,
+            requested_bytes: None,
+            observation: HostBudgetObservation {
+                source: HostBudgetSource::CgroupMemoryMax {
+                    cgroup_dir: "/x".to_string(),
+                },
+                bytes: 7,
+            },
+        });
+        assert!(observed.contains("source=observed"), "got: {observed}");
+        assert!(
+            observed.contains("cgroup memory.max (/x)"),
+            "got: {observed}"
+        );
+        let declared = host_memory_budget_receipt_line(&HostBudgetResolution::DeclaredUnverified {
+            requested_bytes: 9,
+            reason: "no cgroup".to_string(),
+        });
+        assert!(
+            declared.contains("source=declared_unverified declared_bytes=9"),
+            "got: {declared}"
+        );
+        let unreadable = host_memory_budget_receipt_line(&HostBudgetResolution::Unreadable {
+            reason: "none".to_string(),
+        });
+        assert!(
+            unreadable.contains("source=unreadable"),
+            "got: {unreadable}"
+        );
+        assert!(!unreadable.contains("bytes="), "got: {unreadable}");
+    }
+
     /// THE MARKER'S COUNT AND THE ROWS MUST AGREE. A run that reports more advised files than it
     /// printed rows dropped some, and the decode refuses rather than reporting the short list.
     #[test]
@@ -4099,6 +4583,7 @@ mod cli_emit_probe_tests {
         let main = crate::v1_compiler_emit_rust::emit_native_cli_driver_main_rs(
             "crate_x".to_string(),
             "pipeline_x".to_string(),
+            std::rc::Rc::new(im::Vector::new()),
         );
         let source = main.content.as_str();
         let write = "print!(\"{text}\");";
@@ -4323,9 +4808,11 @@ mod run_relaying_as_it_runs_tests {
     // same counts as the same bytes decoded directly.
     #[test]
     fn a_relayed_census_stdout_decodes_to_the_same_verdict() {
-        let out = "{\"accepted_file_advisories\":{\"path\":\"a.dag\",\"head\":\"r\",\"tail\":[]}}\n\
-                   {\"_terminal\":\"complete\",\"mode\":\"census-resolve\",\"modules\":3,\
-                   \"file_refusals\":0,\"advised_files\":1,\"residual_rows\":0,\"cause_groups\":0}\n";
+        let out =
+            "{\"accepted_file_advisories\":{\"path\":\"a.dag\",\"head\":\"r\",\"tail\":[]}}\n\
+                   {\"_terminal\":\"complete\",\"mode\":\"census-infer\",\"modules\":3,\
+                   \"file_refusals\":0,\"advised_files\":1,\"residual_rows\":0,\"cause_groups\":0,\
+                   \"roots\":0,\"inferred\":3,\"infer_refused\":0,\"type_census\":\"held\"}\n";
         let mut c = Command::new("printf");
         c.arg("%s").arg(out);
         let relayed = run_relaying_as_it_runs(c).expect("spawn");
diff --git a/src/v1/stage0/src/cli_run/owned_data.rs b/src/v1/stage0/src/cli_run/owned_data.rs
index 4a5fc1c67b1..2d9f07f72b6 100644
--- a/src/v1/stage0/src/cli_run/owned_data.rs
+++ b/src/v1/stage0/src/cli_run/owned_data.rs
@@ -96,20 +96,15 @@ use serde::Serialize;
 pub(crate) fn owned_data_initializer_from_body(
     graph: &ResolvedGraph,
     source_indices: &HashMap<String, Rc<NewlineIndex>>,
-    variant_to_enum: &im::HashMap<String, String>,
+    emit_info: &crate::v1_compiler_infer_emit_info::EmitGraphInfo,
     entry_path: &str,
     decl_name: &str,
     body: &Rc<Node>,
     type_annotation: Option<&Rc<Node>>,
 ) -> Result<OwnedDataDeclInitializer, String> {
-    let resolved_initializer = resolved_initializer_decl_ref(
-        graph,
-        source_indices,
-        variant_to_enum,
-        body,
-        type_annotation,
-    )
-    .map_err(|e| format!("{entry_path}: owned data '{decl_name}': {e}"))?;
+    let resolved_initializer =
+        resolved_initializer_decl_ref(graph, source_indices, emit_info, body, type_annotation)
+            .map_err(|e| format!("{entry_path}: owned data '{decl_name}': {e}"))?;
     if is_resolved_bool_witness_claim(&resolved_initializer) {
         let (witness_entry, witness_function) =
             extract_bool_witness_transport(body, source_indices);
@@ -135,7 +130,7 @@ pub(crate) fn owned_data_initializer_from_body(
 pub fn owned_data_decls_for_entry(
     graph: &ResolvedGraph,
     source_indices: &HashMap<String, Rc<NewlineIndex>>,
-    variant_to_enum: &im::HashMap<String, String>,
+    emit_info: &crate::v1_compiler_infer_emit_info::EmitGraphInfo,
     entry_path: &str,
     entry_module: &str,
 ) -> Result<Vec<OwnedDataDeclRecord>, String> {
@@ -195,7 +190,7 @@ pub fn owned_data_decls_for_entry(
         let initializer = owned_data_initializer_from_body(
             graph,
             source_indices,
-            variant_to_enum,
+            emit_info,
             entry_path,
             &decl_name,
             body,
diff --git a/src/v1/stage0/src/cli_run/required_floor_runner.rs b/src/v1/stage0/src/cli_run/required_floor_runner.rs
index 415badd7f77..8a6ecaadd46 100644
--- a/src/v1/stage0/src/cli_run/required_floor_runner.rs
+++ b/src/v1/stage0/src/cli_run/required_floor_runner.rs
@@ -13875,9 +13875,26 @@ pub fn run_required_floor(
         "[floor-receipt] receipt=fixture-closure-union-controls state=held red_wall_ms={control_red_ms} \
          clean_wall_ms={control_clean_ms}"
     );
+    // Printed BEFORE the compile so a run cancelled inside the phase still names the union's size
+    // and its identity join against the prepared subject (a censored run otherwise has no members).
+    eprintln!(
+        "[floor-phase] phase=fixture-closure-union-emit state=begin members={} \
+         outside_prepared={outside_prepared} prepared_paths={} fixture_compiles={}",
+        union.members.len(),
+        prepared_source_paths.len(),
+        union.fixture_compiles
+    );
     let union_started = std::time::Instant::now();
     let union_cpu_started = v1_interpreter::thread_cpu_nanos();
-    let union_observed = crate::cli_run::fixture_closure_union_emit_receipt(&union)?;
+    let union_observed = crate::cli_run::fixture_closure_union_emit_receipt_staged(
+        &union,
+        &|stage, members, wall_ms| {
+            eprintln!(
+                "[floor-phase] phase=fixture-closure-union-emit stage={stage} members={members} \
+                 wall_ms={wall_ms}"
+            );
+        },
+    )?;
     eprintln!(
         "[floor-phase] phase=fixture-closure-union-emit state=held fixture_compiles={} \
          memo_hits={} members={} digest={} outside_prepared={outside_prepared} files={} emit_diagnostics={} \
diff --git a/src/v1/stage0/src/cli_run/rostered_row_join.rs b/src/v1/stage0/src/cli_run/rostered_row_join.rs
index 17b0490d8c5..ab651956543 100644
--- a/src/v1/stage0/src/cli_run/rostered_row_join.rs
+++ b/src/v1/stage0/src/cli_run/rostered_row_join.rs
@@ -376,19 +376,31 @@ fn unaccounted_sources(accounted: &[(String, String)]) -> Vec<JoinFinding> {
     let mut out = Vec::new();
     for root in JOIN_POOL_ROOTS {
         let mut files = Vec::new();
-        crate::cli_run::collect_dag_files_tolerant(&ws.join(root), &mut files);
+        if let Err(cause) = crate::cli_run::collect_dag_files_tolerant(&ws.join(root), &mut files) {
+            out.push(JoinFinding {
+                kind: JoinFindingKind::SourceUnaccounted,
+                row_type: "(no row type — the pool root could not be acquired)".to_string(),
+                subject: root.to_string(),
+                detail: format!(
+                    "acquiring this pool root refused ({cause}), so no source under it can be \
+                     joined to the declared population"
+                ),
+            });
+            continue;
+        }
         files.sort();
         for file in files {
             let rel = file
+                .path()
                 .strip_prefix(&ws)
-                .unwrap_or(&file)
+                .unwrap_or(file.path())
                 .to_string_lossy()
                 .replace('\\', "/");
             if accounted_paths.contains(rel.as_str()) {
                 continue;
             }
-            let digest = match std::fs::read(&file) {
-                Ok(bytes) => content_digest(&bytes),
+            let digest = match file.read() {
+                Ok(text) => content_digest(text.as_bytes()),
                 Err(e) => format!("unreadable: {e}"),
             };
             out.push(JoinFinding {
@@ -408,7 +420,8 @@ fn unaccounted_sources(accounted: &[(String, String)]) -> Vec<JoinFinding> {
 }
 
 /// File stems under `dag/gunbc/recurring_failure_mode/` versus roster member names.
-/// Independent of `derived_row_roster::row_stems`: a skip in the writer must still refuse here.
+/// Independent of `derived_row_roster::acquire_dir_files`' row selection: a skip in the derivation
+/// must still refuse here.
 fn join_recurring_failure_mode_files_to_roster(
     rostered_names: &BTreeSet<String>,
 ) -> Vec<JoinFinding> {
@@ -692,9 +705,9 @@ pub fn run_rostered_row_join(index: &DeclarationIndex) -> Result<JoinReport, Str
                     enrolled.roster_module,
                     enrolled.roster_declaration,
                     if enrolled.variant == "RecurringFailureModeRows" {
-                        " — for this roster that can mean the derived writer skipped the file \
-                         (for example an unlistable name), not a missing hand-edited list \
-                         entry in gitignored roster.dag"
+                        " — for this roster that can mean the in-memory derivation skipped the \
+                         file (for example a declaration the line-shape selector missed), not a \
+                         missing hand-edited list entry"
                     } else {
                         ""
                     }
diff --git a/src/v1/stage0/src/compiler_tests.rs b/src/v1/stage0/src/compiler_tests.rs
index a774f21fc38..86a8127353b 100644
--- a/src/v1/stage0/src/compiler_tests.rs
+++ b/src/v1/stage0/src/compiler_tests.rs
@@ -39,26 +39,35 @@ mod compiler_tests {
         root: &std::path::Path,
         out: &mut Vec<(String, String)>,
     ) {
-        crate::cli_run::derived_row_roster::ensure_if_row_dir_or_panic(dir);
         if let Ok(entries) = std::fs::read_dir(dir) {
+            let mut here = Vec::new();
             for entry in entries.flatten() {
                 let path = entry.path();
                 if path.is_dir() {
                     collect_dag_recursive(&path, root, out);
                 } else if path.extension().map_or(false, |e| e == "dag") {
-                    let rel = path
-                        .strip_prefix(root)
-                        .unwrap()
-                        .to_string_lossy()
-                        .to_string();
-                    // Test fixtures (e.g. fact_cardinality_split_brace.dag) are not modules.
-                    if rel.contains("/tests/") {
-                        continue;
-                    }
-                    let content = std::fs::read_to_string(&path)
-                        .unwrap_or_else(|e| panic!("failed to read {}: {}", path.display(), e));
-                    out.push((rel, content));
+                    here.push(path);
+                }
+            }
+            // Admitted per directory, so a ledger row directory contributes its derived roster
+            // in memory (`derived_row_roster::acquire_dir_files`) rather than as a written file.
+            let acquired = crate::cli_run::derived_row_roster::acquire_dir_files(dir, here)
+                .unwrap_or_else(|e| panic!("{}", e));
+            for source in acquired {
+                let path = source.path();
+                let rel = path
+                    .strip_prefix(root)
+                    .unwrap()
+                    .to_string_lossy()
+                    .to_string();
+                // Test fixtures (e.g. fact_cardinality_split_brace.dag) are not modules.
+                if rel.contains("/tests/") {
+                    continue;
                 }
+                let content = source
+                    .read()
+                    .unwrap_or_else(|e| panic!("failed to read {}: {}", path.display(), e));
+                out.push((rel, content));
             }
         }
     }
@@ -876,13 +885,14 @@ mod compiler_tests {
                     "the refusal must leave a nonzero exit status; got: {:?}",
                     main_rs.content
                 );
-                let cargo_toml = result.files.iter()
-                    .find(|f| f.path == "Cargo.toml")
-                    .expect("emission must produce Cargo.toml");
                 assert!(
-                    !cargo_toml.content.contains("clap"),
-                    "a crate whose emitted sources reference clap nowhere must not declare it; got: {:?}",
-                    cargo_toml.content
+                    !result.files.iter().any(|f| f.path == "Cargo.toml"),
+                    "the emission owns no manifest -- the crate partition realizes its layout"
+                );
+                assert!(
+                    result.rust_crates.iter().all(|c| !c.demand.renders_clap_cli),
+                    "a crate whose emitted sources reference clap nowhere must not demand it; got: {:?}",
+                    result.rust_crates
                 );
             })
             .expect("failed to spawn thread")
@@ -894,25 +904,25 @@ mod compiler_tests {
 
     #[test]
     fn the_clap_dependency_follows_the_emitted_cli_demand_in_both_directions() {
-        let with_cli = crate::v1_compiler_emit_rust::emitted_crate_dependency_lines(
-            crate::v1_compiler_emit_rust::EmittedCrateDependencyDemand {
+        let with_cli = crate::v1_compiler_stage0_crates::emitted_crate_dependencies(
+            crate::gunbc_rust_emitted_crate::EmittedCrateDependencyDemand {
                 renders_clap_cli: true,
                 renders_async_services: false,
             },
         );
-        let without_cli = crate::v1_compiler_emit_rust::emitted_crate_dependency_lines(
-            crate::v1_compiler_emit_rust::EmittedCrateDependencyDemand {
+        let without_cli = crate::v1_compiler_stage0_crates::emitted_crate_dependencies(
+            crate::gunbc_rust_emitted_crate::EmittedCrateDependencyDemand {
                 renders_clap_cli: false,
                 renders_async_services: false,
             },
         );
         assert!(
-            with_cli.iter().any(|line| line.starts_with("clap = ")),
+            with_cli.iter().any(|dep| dep.name == "clap"),
             "a crate that renders a clap CLI must declare clap; got: {:?}",
             with_cli
         );
         assert!(
-            !without_cli.iter().any(|line| line.starts_with("clap = ")),
+            !without_cli.iter().any(|dep| dep.name == "clap"),
             "a crate that renders no clap CLI must not declare clap; got: {:?}",
             without_cli
         );
@@ -2698,7 +2708,7 @@ mod compiler_tests {
                 // row, and the call is STILL refused, because the receiver does not
                 // fail to resolve in the way the row was measured on. A (module, method)
                 // key passed this input; that is the fail-open the third component closes.
-                let listed_wrong_shape = compile_one("listed.dag", frontier_src("extdeps.dns.domain_name", "list_push"));
+                let listed_wrong_shape = compile_one("listed.dag", frontier_src("v1.compiler.trace", "map"));
                 assert!(
                     listed_wrong_shape.diagnostics.iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodExistenceUndecided { .. })),
                     "a declared row must NOT admit a new call in the same module on a receiver whose shape it was never measured on, got: {:?}",
@@ -4332,10 +4342,25 @@ mod compiler_tests {
             )
         );
         assert!(
-            crate::v1_compiler_emit_rust::is_grounded_coproduct_native_alias(
+            crate::v1_compiler_emit_rust::declaration_is_grounded_coproduct_native_alias(
+                "v2.std.diagnostic".to_string(),
                 "Diagnostics".to_string()
             )
         );
+        // The host option is a DECLARATION, not a name: the kernel optional's declaration is it, and a
+        // coproduct another module declares as Optional is not.
+        assert!(
+            crate::v1_compiler_emit_rust::declaration_is_grounded_coproduct_native_alias(
+                "std.optional".to_string(),
+                "Optional".to_string()
+            )
+        );
+        assert!(
+            !crate::v1_compiler_emit_rust::declaration_is_grounded_coproduct_native_alias(
+                "gunbc.instruments.native_emission_controls_optional_collision".to_string(),
+                "Optional".to_string()
+            )
+        );
         let empty_shared = std::rc::Rc::new(im::OrdSet::new());
         assert_eq!(
             crate::v1_compiler_emit_rust::render_rust_diagnostics_carrier_applied(
@@ -5353,7 +5378,7 @@ mod compiler_tests {
     // A QUALIFIED REFERENCE IS NOT DECIDED BY THE LOCAL DECLARER. hom.local declares its own Slot
     // and ALSO names no.such.module.Slot, which resolve cannot bind, so the reference reaches the
     // emitter unstamped while two modules declare Slot. The referencing-module arm
-    // (v1.compiler.infer_emit_info type_decl_referencing_module_declarer) would pick the LOCAL Slot:
+    // (v1.compiler.infer_emit_info type_decl_occurrence_binding) would pick the LOCAL Slot:
     // the wrong-declarer class itself. It is admitted only for a bare spelling, so this refuses.
     // THE CONTROL is the same module without the second declarer: the spelling names a sole
     // declarer, and nothing refuses.
@@ -5388,6 +5413,154 @@ mod compiler_tests {
         );
     }
 
+    // A SAME-LEAF TYPE ANYWHERE MUST NOT CHANGE ANOTHER MODULE'S EMISSION. hom.user returns the kernel
+    // optional's Absent; hom.edge declares an unrelated enum that also has an Absent variant. With the
+    // leaf-keyed type summaries, adding hom.coll (a coproduct it declares as Optional) replaced the
+    // kernel Optional's summary, so Absent stopped being an Optional variant and hom.user emitted
+    // Rc::new(Lookup::Absent) where it had emitted None. Keyed by declaration, both summaries stand:
+    // hom.user's file is byte-identical with and without hom.coll, and its Absent is the host None.
+    #[test]
+    fn same_leaf_type_elsewhere_leaves_other_modules_emission_unchanged() {
+        use crate::v1_compiler_compile::SourceFile;
+        let src = |path: &str, content: &str| {
+            std::rc::Rc::new(SourceFile {
+                path: path.to_string(),
+                content: content.to_string(),
+            })
+        };
+        let optional = || {
+            src(
+                "fixtures/same_leaf_optional/optional.dag",
+                "module std.optional\n\ntype Optional<T>\n  = Present { value: T }\n  | Absent\n",
+            )
+        };
+        let edge = || {
+            src(
+                "fixtures/same_leaf_optional/edge.dag",
+                "module hom.edge\n\ntype Lookup\n  = Found { at: Int }\n  | Absent\n",
+            )
+        };
+        let user = || {
+            src("fixtures/same_leaf_optional/user.dag", "module hom.user\nimport std.optional { Optional, Present, Absent }\n\nfn nothing_here(x: Int) -> Optional<Int> {\n  Absent\n}\n")
+        };
+        let coll = || {
+            src("fixtures/same_leaf_optional/coll.dag", "module hom.coll\n\ntype Optional\n  = CollisionWrapped { value: Int }\n  | CollisionEmpty\n")
+        };
+        let emitted_user = |sources: Vec<std::rc::Rc<SourceFile>>| -> String {
+            let result = crate::v1_compiler_compile::compile_sources(
+                std::rc::Rc::new(sources.into()),
+                crate::v1_compiler_artifact::RenderTarget::Rust,
+            );
+            result
+                .files
+                .iter()
+                .find(|f| f.path.contains("hom_user"))
+                .map(|f| f.content.clone())
+                .unwrap_or_default()
+        };
+        let without = emitted_user(vec![optional(), edge(), user()]);
+        let with = emitted_user(vec![optional(), edge(), user(), coll()]);
+        assert!(
+            without.contains("None") && !without.contains("Lookup::Absent"),
+            "the control: hom.user's Absent is the host None:\n{without}"
+        );
+        assert_eq!(
+            with, without,
+            "adding a same-leaf Optional elsewhere changed hom.user's emission"
+        );
+    }
+
+    // AN UNSTAMPED BARE `Optional` FOLLOWS THE TYPECHECKER'S lookup_binding ORDER: own file, then
+    // the file's named import (followed through re-exports), then the kernel
+    // (v1.compiler.infer_env bare_occurrence_binding). The member references of a coproduct body reach
+    // the emitter from the type environment's copy with no Node.declaration, so the census route is
+    // the emitter's own decision. THE RED is the importer: with the kernel ahead of the named import
+    // (the order direct_import_export_precedence_note states) its payload routes kernel_mint to
+    // std.optional, measured on gunbc#13454 at 57551c4b. The control keeps a module that names
+    // Optional without importing it on the kernel arm.
+    #[test]
+    fn unstamped_bare_optional_follows_the_lookup_binding_order() {
+        use crate::v1_compiler_compile::SourceFile;
+        let sources = vec![
+            std::rc::Rc::new(SourceFile { path: "fixtures/kernel_shadow/optional.dag".to_string(), content: "module std.optional\n\ntype Optional<T>\n  = Present { value: T }\n  | Absent\n".to_string() }),
+            std::rc::Rc::new(SourceFile { path: "fixtures/kernel_shadow/collision.dag".to_string(), content: "module hom.collision\n\ntype Optional\n  = CollisionWrapped { value: Int }\n  | CollisionEmpty\n".to_string() }),
+            std::rc::Rc::new(SourceFile { path: "fixtures/kernel_shadow/importer.dag".to_string(), content: "module hom.importer\n\nimport hom.collision { Optional }\n\ntype HeldChoice\n  = HeldOptional { held: Optional }\n  | HeldNothing\n".to_string() }),
+            std::rc::Rc::new(SourceFile { path: "fixtures/kernel_shadow/plain.dag".to_string(), content: "module hom.plain\n\ntype PlainChoice\n  = PlainHeld { held: Optional<Int> }\n  | PlainNothing\n".to_string() }),
+            std::rc::Rc::new(SourceFile { path: "fixtures/kernel_shadow/user.dag".to_string(), content: "module hom.user\n\nimport hom.importer { HeldChoice }\nimport hom.plain { PlainChoice }\n\nfn pick(h: HeldChoice, p: PlainChoice) -> Int {\n  1\n}\n".to_string() }),
+        ];
+        let receipt = crate::v1_tests_claim_carrier_realization_census::typed_census_from_sources(
+            std::rc::Rc::new(sources.into()),
+        );
+        assert!(!receipt.starts_with("REFUSED"), "{receipt}");
+        let routes = |enclosing: &str| -> Vec<String> {
+            receipt
+                .lines()
+                .skip(1)
+                .map(|l| l.split('\t').collect::<Vec<_>>())
+                .filter(|c| c[1] == enclosing && c[2] == "declaration_field" && c[3] == "Optional")
+                .map(|c| c[13].to_string())
+                .collect()
+        };
+        let held = routes("HeldChoice");
+        assert!(
+            !held.is_empty()
+                && held
+                    .iter()
+                    .all(|r| r == "referencing_module_import:Resolved:hom.collision.Optional"),
+            "the imported Optional must route to the import, never the kernel mint:\n{receipt}"
+        );
+        let plain = routes("PlainChoice");
+        assert!(
+            !plain.is_empty()
+                && plain
+                    .iter()
+                    .all(|r| r == "kernel_mint:Resolved:std.optional.Optional"),
+            "an unimported Optional is the kernel's:\n{receipt}"
+        );
+        assert!(!receipt.contains("LeafAmbiguous:Optional"), "{receipt}");
+    }
+
+    // A COPRODUCT NAMED Optional EMITS AS ITS OWN ENUM. still-raven-321's fixture,
+    // fixtures/native_emission_controls_optional_collision.dag, is a non-kernel declaration that shares
+    // the kernel mint's leaf. Host-Option is decided by declaration (v1.compiler.emit_rust
+    // declaration_owns_host_option over gunbc.structural_realization_bindings kernel_mint_declaration_rows),
+    // so its positions name its own enum. THE RED is the leaf rule this replaced: every position rendered
+    // as Option<..> and the variants were never emitted (E0425 cannot find CollisionWrapped). The fixture
+    // lives outside the source roots, because a second Optional in the accepted corpus is a leaf-name fork,
+    // so it is compiled here, from its file, beside a kernel std.optional. Its one import line names a
+    // kernel type and is dropped so the pair compiles standalone.
+    #[test]
+    fn a_coproduct_named_optional_emits_as_its_own_enum() {
+        use crate::v1_compiler_compile::SourceFile;
+        let collision = read_dag("fixtures/native_emission_controls_optional_collision.dag")
+            .replace("import std.types { Int }\n", "");
+        let sources = vec![
+            std::rc::Rc::new(SourceFile { path: "fixtures/kernel_shadow/optional.dag".to_string(), content: "module std.optional\n\ntype Optional<T>\n  = Present { value: T }\n  | Absent\n".to_string() }),
+            std::rc::Rc::new(SourceFile { path: "fixtures/native_emission_controls_optional_collision.dag".to_string(), content: collision }),
+        ];
+        let result = crate::v1_compiler_compile::compile_sources(
+            std::rc::Rc::new(sources.into()),
+            crate::v1_compiler_artifact::RenderTarget::Rust,
+        );
+        let emitted = result
+            .files
+            .iter()
+            .find(|f| {
+                f.path
+                    .contains("native_emission_controls_optional_collision")
+            })
+            .map(|f| f.content.clone())
+            .unwrap_or_default();
+        assert!(
+            emitted.contains("pub enum Optional") && emitted.contains("CollisionWrapped"),
+            "the collision coproduct must emit as its own enum:\n{emitted}"
+        );
+        assert!(
+            !emitted.contains("Option<") && !emitted.contains("compile_error!"),
+            "no position of the collision coproduct may realize as the host Option:\n{emitted}"
+        );
+    }
+
     // A REPEATED TYPE PARAMETER IN ONE HEADER REFUSES, LOCATED, AND SAYS WHICH NAME. The refusal
     // predates this row. Its message once blamed a value parameter and called a type a fn, so the
     // row asserts the NAME and the OWNER, not merely that some diagnostic fired. The control header
diff --git a/src/v1/stage0/src/coproduct_reflection.rs b/src/v1/stage0/src/coproduct_reflection.rs
index a8183fab4ea..9db4ed78f83 100644
--- a/src/v1/stage0/src/coproduct_reflection.rs
+++ b/src/v1/stage0/src/coproduct_reflection.rs
@@ -585,10 +585,38 @@ fn decls_parse_only_from_disk(
     }
     modules.sort();
     let module_count = modules.len();
+    // THE ACQUIRED POPULATION, so a module the index names but no file holds -- a derived ledger
+    // roster, contributed in memory by `derived_row_roster::acquire_dir_files` -- is parsed from
+    // the bytes acquisition contributed rather than from a path that has no file behind it.
+    let mut acquired: std::collections::HashMap<
+        PathBuf,
+        crate::cli_run::derived_row_roster::AcquiredDag,
+    > = std::collections::HashMap::new();
+    for root in roots {
+        let root_path = ws.join(root);
+        if root_path.is_dir() {
+            let mut files = Vec::new();
+            collect_dag_files_tolerant(&root_path, &mut files)
+                .map_err(|cause| format!("{caller}: acquiring {root}: {cause}"))?;
+            for file in files {
+                acquired.insert(file.path().to_path_buf(), file);
+            }
+        }
+    }
     let mut out = Vec::new();
     for (module_path, rel_path) in modules {
         let abs = ws.join(&rel_path);
-        let parsed = parse_dag_file(&abs).ok_or_else(|| {
+        let parsed = match acquired.get(&abs) {
+            Some(source) => {
+                let content = source.read().map_err(|e| {
+                    format!("{caller}: read `{rel_path}`: {e} (fail-closed; no silent skip)")
+                })?;
+                let filename = abs.file_name().and_then(|s| s.to_str()).unwrap_or("?");
+                parse_dag_content(&content, filename)
+            }
+            None => parse_dag_file(&abs),
+        }
+        .ok_or_else(|| {
             format!("{caller}: failed to parse `{rel_path}` (fail-closed; no silent skip)")
         })?;
         let si = parsed.source_indices;
@@ -624,9 +652,11 @@ fn dag_files_under_abs_roots(abs_roots: &[String]) -> Vec<PathBuf> {
     for root in abs_roots {
         let root_path = PathBuf::from(root);
         if root_path.is_dir() {
-            collect_dag_files_tolerant(&root_path, &mut files);
+            collect_dag_files_tolerant(&root_path, &mut files)
+                .unwrap_or_else(|cause| panic!("acquiring {root}: {cause}"));
         }
     }
+    let mut files: Vec<PathBuf> = files.iter().map(|f| f.path().to_path_buf()).collect();
     files.sort();
     files
 }
@@ -1764,13 +1794,16 @@ pub fn pool_root_refusal_message(
     )
 }
 
-fn corpus_dag_files_for_roots(roots: &[String]) -> Vec<PathBuf> {
+fn corpus_dag_files_for_roots(
+    roots: &[String],
+) -> Vec<crate::cli_run::derived_row_roster::AcquiredDag> {
     let ws = workspace_root();
     let mut files = Vec::new();
     for root in roots {
         let root_path = ws.join(root);
         if root_path.is_dir() {
-            collect_dag_files_tolerant(&root_path, &mut files);
+            collect_dag_files_tolerant(&root_path, &mut files)
+                .unwrap_or_else(|cause| panic!("acquiring {root}: {cause}"));
         }
     }
     files.sort();
@@ -1797,17 +1830,25 @@ pub fn decl_facts_corpus_walk(pool_roots: &[String]) -> DeclFactsCorpusWalk {
     let mut files_scanned = 0usize;
     let mut files_parsed = 0usize;
     for file in corpus_dag_files_for_roots(pool_roots) {
-        let rel = repo_rel(&file);
+        let rel = repo_rel(file.path());
         if is_test_dag(&rel) {
             continue;
         }
         files_scanned += 1;
-        let content = std::fs::read_to_string(&file).ok();
+        let content = file.read().ok();
         let module_path = content
             .as_ref()
             .and_then(|c| extract_module_path(c))
             .unwrap_or_default();
-        let Some(parsed) = parse_dag_file(&file) else {
+        // The acquired bytes, not a second read of the path: a derived roster has no file.
+        let filename = file
+            .path()
+            .file_name()
+            .and_then(|s| s.to_str())
+            .unwrap_or("?");
+        let Some(parsed) = content.as_deref().and_then(|c| {
+            crate::module_path_index::parsed_dag_file::parse_dag_content(c, filename)
+        }) else {
             continue;
         };
         files_parsed += 1;
diff --git a/src/v1/stage0/src/cssl_seed_linked_closure_assembly.rs b/src/v1/stage0/src/cssl_seed_linked_closure_assembly.rs
index e4cc714de70..db7dc0318c9 100644
--- a/src/v1/stage0/src/cssl_seed_linked_closure_assembly.rs
+++ b/src/v1/stage0/src/cssl_seed_linked_closure_assembly.rs
@@ -163,18 +163,12 @@ pub fn assemble_seed_linked_closure(out_dir: &Path, entry_dag: &Path) -> Result<
     let src_dir = out_dir.join("src");
     let manifest_path = src_dir.join(emitted_population_manifest_basename());
     let entry_mod = dag_entry_rust_module(entry_dag)?;
-    let entry_file = src_dir.join(format!("{entry_mod}.rs"));
 
-    if !entry_file.is_file() {
-        return Err(AssemblyError::MissingEntryFile { path: entry_file });
-    }
     if !manifest_path.is_file() {
         return Err(AssemblyError::MissingPopulationManifest {
             path: manifest_path,
         });
     }
-
-    let entry_hash_before = sha256_hex(&entry_file)?;
     let declared = declared_emitted_paths(&manifest_path)?;
     if declared.is_empty() {
         return Err(AssemblyError::EmptyPopulationManifest {
@@ -182,6 +176,29 @@ pub fn assemble_seed_linked_closure(out_dir: &Path, entry_dag: &Path) -> Result<
         });
     }
 
+    // THE ENTRY IS FOUND WHERE THE POPULATION SAYS IT IS. The workspace realization
+    // (`v1.compiler.emitted_workspace`) places module files where the partition crates include
+    // them from, and renders this manifest over those realized paths, so the manifest is the one
+    // authority for where `<entry>.rs` lives; a fixed `src/<entry>.rs` would be a second one.
+    let entry_name = format!("{entry_mod}.rs");
+    let entry_file = declared
+        .iter()
+        .find(|path| {
+            Path::new(path)
+                .file_name()
+                .map(|n| n == entry_name.as_str())
+                .unwrap_or(false)
+        })
+        .map(|path| out_dir.join(path))
+        .ok_or_else(|| AssemblyError::MissingEntryFile {
+            path: src_dir.join(&entry_name),
+        })?;
+    if !entry_file.is_file() {
+        return Err(AssemblyError::MissingEntryFile { path: entry_file });
+    }
+
+    let entry_hash_before = sha256_hex(&entry_file)?;
+
     for declared_path in declared {
         // Whole-closure default (cssl_closure_assembly_note): every declared member is
         // emit-retained, byte-untouched -- v2_std_*, std_*, v1_rt, v2_extdeps_*, v2_lens_*,
diff --git a/src/v1/stage0/src/declaration_index.rs b/src/v1/stage0/src/declaration_index.rs
index 144f733d1f0..2f88bb06e68 100644
--- a/src/v1/stage0/src/declaration_index.rs
+++ b/src/v1/stage0/src/declaration_index.rs
@@ -3519,13 +3519,14 @@ mod import_binding_authority_tests {
 
     /// The declaration must sit in a PARENT env: `callable_lookup_over_candidates` checks
     /// `func_env.local` first and returns immediately on a hit, so a local declaration never
-    /// reaches the authored-membership branch. `v2.std.collection` / `map_get` is not an arbitrary
+    /// reaches the authored-membership branch. `v2.std.collection` / `map_get_checked` is not an arbitrary
     /// choice -- it is the specimen carrying `DivergentProjection` fidelity, which is the condition
     /// `declared_candidate_rivals_the_builtin` requires.
-    fn parent_env_declaring_map_get() -> Rc<crate::v1_compiler_infer_sigs::ResolvedFuncEnv> {
+    fn parent_env_declaring_map_get_checked() -> Rc<crate::v1_compiler_infer_sigs::ResolvedFuncEnv>
+    {
         use crate::v1_compiler_infer_sigs::{ResolvedFormals, ResolvedFuncEnv, ResolvedFuncSig};
         let sig = Rc::new(ResolvedFuncSig {
-            name: "map_get".to_string(),
+            name: "map_get_checked".to_string(),
             params: crate::v1_std_core::empty_node_list(),
             // This synthetic declaration deliberately has no parameters. Its empty formal
             // population is kernel-grounded, not awaiting a module-context resolution pass.
@@ -3540,7 +3541,7 @@ mod import_binding_authority_tests {
             name: "v2.std.collection".to_string(),
             local: Rc::new(crate::v1_rt::map_insert(
                 crate::v1_rt::empty_map(),
-                "map_get".to_string(),
+                "map_get_checked".to_string(),
                 sig,
             )),
             parents: Rc::new(im::Vector::new()),
@@ -3565,7 +3566,7 @@ mod import_binding_authority_tests {
     /// That is an OBSERVATION-BOUNDARY defect, not a bad fixture spelling.
     ///
     /// AND IT DOES NOT MEAN THE POLICY IS DEAD. That convenient reading is refuted by a specimen in
-    /// the tree: `map_get` is declared at `v2.std.collection` with `DivergentProjection` fidelity in
+    /// the tree: `map_get_checked` is declared at `v2.std.collection` with `DivergentProjection` fidelity in
     /// `std.primitive_projection`, which is exactly the condition
     /// `declared_candidate_rivals_the_builtin` tests. So the collision is real, reachable from
     /// authored source, and already witnessed by `callable_candidate_ambiguity_witness_test`.
@@ -3577,16 +3578,16 @@ mod import_binding_authority_tests {
     #[test]
     fn authored_membership_alone_decides_the_callable_verdict() {
         use crate::v1_compiler_infer_lookup::callable_lookup_over_candidates;
-        use crate::v1_compiler_infer_sigs::{CallableIdentity, FuncSigLookup};
+        use crate::v1_compiler_infer_sigs::FuncSigLookup;
 
-        let env = parent_env_declaring_map_get();
+        let env = parent_env_declaring_map_get_checked();
 
         let named = callable_lookup_over_candidates(
             env.clone(),
-            type_env_with_authored(&["map_get"]),
-            "map_get".to_string(),
+            type_env_with_authored(&["map_get_checked"]),
+            "map_get_checked".to_string(),
         );
-        let omitted = callable_lookup_over_candidates(
+        let bare = callable_lookup_over_candidates(
             env,
             type_env_with_authored(&["cut_unrelated_marker"]),
             "map_get".to_string(),
@@ -3598,7 +3599,7 @@ mod import_binding_authority_tests {
         match &*named {
             FuncSigLookup::FuncSigResolved { declared, .. } => {
                 assert_eq!(declared.owner_module_path, "v2.std.collection");
-                assert_eq!(declared.decl_name, "map_get");
+                assert_eq!(declared.decl_name, "map_get_checked");
             }
             other => panic!(
                 "naming the callable must suppress the builtin co-candidate and resolve to the \
@@ -3606,38 +3607,112 @@ mod import_binding_authority_tests {
             ),
         }
 
-        // AND THE AMBIGUOUS ARM IS CHECKED BY ITS EXACT IDENTITY SET, never by a count and never by
-        // list order. A count would pass on a substitution, and an order-sensitive comparison would
-        // make candidate ordering -- which nothing declares to be semantic -- part of the assertion.
-        match &*omitted {
-            FuncSigLookup::FuncSigAmbiguous { candidates, .. } => {
-                let mut observed: Vec<String> = candidates
-                    .iter()
-                    .map(|c| match &*c.identity {
-                        CallableIdentity::DeclaredCallable { identity } => format!(
-                            "declared:{}:{}",
-                            identity.owner_module_path, identity.decl_name
-                        ),
-                        CallableIdentity::BuiltinCallable { primitive_name } => {
-                            format!("builtin:{primitive_name}")
-                        }
-                    })
-                    .collect();
-                observed.sort();
-                observed.dedup();
-                assert_eq!(
-                    observed,
-                    vec![
-                        "builtin:map_get".to_string(),
-                        "declared:v2.std.collection:map_get".to_string(),
-                    ],
-                    "the two rival authorities must both be present, and only those two"
-                );
-            }
+        // THE OLD map_get FORK IS DISSOLVED, AND THIS ARM IS ITS PERMANENT REGRESSION CONTROL,
+        // checked by its exact identity set rather than a count or list order. Before the rename,
+        // omitting the declaration from the authored list while calling the bare name minted TWO
+        // rival authorities -- `builtin:map_get` and `declared:v2.std.collection:map_get` -- and
+        // went ambiguous. The rename moved the declaration to `map_get_checked`, so the bare
+        // spelling now has no declared candidate at all: only the builtin remains, which this
+        // route leaves unresolved (builtins reach inference through the method path).
+        //
+        // HONESTY ABOUT WHAT THIS ARM CAN AND CANNOT SEE ANY MORE (review 77428). The former
+        // rival-join -- a rival declaration omitted from the authored list joining the builtin
+        // into FuncSigAmbiguous -- is NOT reachable at this seam any more, and that absence is
+        // the repair, not a hole: the only DivergentProjection row in the compiled roster
+        // (std_primitive_projection.rs) answers to the declaration `map_get_checked`, which is
+        // not a primitive-registry key, while the registry keys the primitive as `map_get`
+        // (v1_compiler_infer_method.rs). parent_closure_callable_candidates takes the declared
+        // identity's decl_name from the LOOKUP KEY, so no lookup name can carry both a rival
+        // declaration and a builtin co-candidate; a synthetic fixture that "declares map_get"
+        // mints the identity (v2.std.collection, map_get), which the roster does not cover. A
+        // re-widening that reclaimed the bare spelling under a registry-keyed name would
+        // re-ambient the join, but THIS arm would still green until a lookup name carried both
+        // authorities -- so the rival predicate's own discriminating control
+        // (declared_candidate_rivals_the_builtin_discriminates_by_row_fidelity, below) stays
+        // enrolled as the executing evidence for the mechanism, per DESIGN 4b(4), and the census
+        // wall w_projection_census_declares_no_divergent_shared_spelling holds the no-shared-
+        // spelling fact at the tree grain.
+        match &*bare {
+            FuncSigLookup::FuncSigUnresolved => {}
+            FuncSigLookup::FuncSigAmbiguous { candidates } => panic!(
+                "the dissolved map_get fork must not return: the bare spelling minted rivals \
+                 {:?}",
+                candidates
+            ),
             other => panic!(
-                "omitting it from a NONEMPTY authored list must admit the builtin rival and go \
-                 ambiguous, got {other:?}"
+                "the dissolved map_get fork must leave the bare spelling a single builtin \
+                 authority -- no declared candidate, never ambiguous -- got {other:?}"
             ),
         }
     }
+
+    /// THE RIVAL PREDICATE'S OWN DISCRIMINATING CONTROL, ENROLLED AFTER THE RENAME DISSOLVED THE
+    /// SEAM'S SHARED SPELLING (review 77428; DESIGN 4b(4): the class's executing evidence stays
+    /// enrolled). Checked against the COMPILED roster's actual rows, so a row that loses its
+    /// DivergentProjection fidelity, a predicate that stops consulting the roster, or a roster
+    /// that stops carrying the divergent specimen all fail here. The identity values are the
+    /// mechanism's own data: the divergent declaration must rival, a modeled projection must
+    /// not, an unprojected declaration must not, and a builtin candidate is never a rival to
+    /// itself.
+    #[test]
+    fn declared_candidate_rivals_the_builtin_discriminates_by_row_fidelity() {
+        use crate::v1_compiler_infer_lookup::declared_candidate_rivals_the_builtin;
+        use crate::v1_compiler_infer_sigs::CallableIdentity::{BuiltinCallable, DeclaredCallable};
+        use crate::v1_compiler_infer_sigs::{CallableCandidate, DeclaredCallableIdentity};
+
+        let candidate_for = |owner: &str, decl: &str| {
+            Rc::new(CallableCandidate {
+                identity: Rc::new(DeclaredCallable {
+                    identity: Rc::new(DeclaredCallableIdentity {
+                        owner_module_path: owner.to_string(),
+                        decl_name: decl.to_string(),
+                    }),
+                }),
+                sig: parent_env_declaring_map_get_checked()
+                    .parents
+                    .iter()
+                    .next()
+                    .expect("fixture parent")
+                    .local
+                    .values()
+                    .next()
+                    .expect("fixture signature")
+                    .clone(),
+            })
+        };
+
+        // The compiled roster's one DivergentProjection row: the declaration must rival.
+        assert!(declared_candidate_rivals_the_builtin(candidate_for(
+            "v2.std.collection",
+            "map_get_checked"
+        )));
+        // A modeled projection is a faithful alias, never a rival.
+        assert!(!declared_candidate_rivals_the_builtin(candidate_for(
+            "v2.std.collection",
+            "empty_map"
+        )));
+        // An unprojected declaration is never a rival.
+        assert!(!declared_candidate_rivals_the_builtin(candidate_for(
+            "cut.unrelated.module",
+            "map_get_checked"
+        )));
+        // A builtin candidate is never a rival to itself.
+        assert!(!declared_candidate_rivals_the_builtin(Rc::new(
+            CallableCandidate {
+                identity: Rc::new(BuiltinCallable {
+                    primitive_name: "map_get".to_string(),
+                }),
+                sig: parent_env_declaring_map_get_checked()
+                    .parents
+                    .iter()
+                    .next()
+                    .expect("fixture parent")
+                    .local
+                    .values()
+                    .next()
+                    .expect("fixture signature")
+                    .clone(),
+            }
+        )));
+    }
 }
diff --git a/src/v1/stage0/src/emitted_closure_compile_host.rs b/src/v1/stage0/src/emitted_closure_compile_host.rs
index 62b3f13107c..77d34b2de72 100644
--- a/src/v1/stage0/src/emitted_closure_compile_host.rs
+++ b/src/v1/stage0/src/emitted_closure_compile_host.rs
@@ -30,7 +30,7 @@
 //! in-memory `.dag` source shape a witness already hands `compile_dag_rust_emit_check`, emitted
 //! through the same `compile_sources`, written by the same crate writer, handed to the same cargo
 //! invocation. It exists because a substring oracle over emitted TEXT cannot see a meaning-level
-//! emitter defect, and rustc can. The two routes share `write_probe_crate_files`, `probe_manifest`
+//! emitter defect, and rustc can. The two routes share `write_probe_crate_files`
 //! and `run_cargo` deliberately: a separately authored fixture harness would make a green here and
 //! a green there two facts about two crates.
 //!
@@ -416,19 +416,11 @@ mod entry_own_subject {
     /// what this function used to do, making every roster verdict a statement about the shared
     /// core (see `MutationSubject`).
     pub fn mutation_subject(
-        crate_dir: &Path,
+        module_dir: &Path,
+        declared: &[String],
         entry_module: &str,
     ) -> Result<MutationSubject, MutationSubjectRefusal> {
-        let lib_rs = crate_dir.join("src/lib.rs");
-        let declared = match super::closure_modules(&lib_rs) {
-            Ok(modules) => modules,
-            Err(detail) => {
-                return Err(MutationSubjectRefusal::ClosureManifestUnreadable {
-                    lib_rs: lib_rs.display().to_string(),
-                    detail,
-                })
-            }
-        };
+        let declared = declared.to_vec();
         // DECLARED AND WRITTEN ARE TWO FACTS AND BOTH ARE REQUIRED. A `pub mod` with no file does
         // not compile; a file no `pub mod` reaches is not in the closure. Checking one would admit
         // a subject cargo did not compile, and the fault would prove nothing.
@@ -438,7 +430,7 @@ mod entry_own_subject {
                 declared,
             });
         }
-        let path = crate_dir.join(format!("src/{entry_module}.rs"));
+        let path = module_dir.join(format!("{entry_module}.rs"));
         if !path.is_file() {
             return Err(MutationSubjectRefusal::EntryModuleFileMissing {
                 entry_module: entry_module.to_string(),
@@ -475,10 +467,6 @@ pub fn mutation_subject_name(_subject: &MutationSubject) -> &'static str {
 /// directly, so its RED is authorable (DESIGN 4b).
 #[derive(Debug, Clone)]
 pub enum MutationSubjectRefusal {
-    ClosureManifestUnreadable {
-        lib_rs: String,
-        detail: String,
-    },
     EntryModuleNotDeclared {
         entry_module: String,
         declared: Vec<String>,
@@ -491,11 +479,6 @@ pub enum MutationSubjectRefusal {
 
 pub fn mutation_subject_refusal_summary(refusal: &MutationSubjectRefusal) -> String {
     match refusal {
-        MutationSubjectRefusal::ClosureManifestUnreadable { lib_rs, detail } => format!(
-            "EntryModuleAbsent/ClosureManifestUnreadable lib_rs={lib_rs} detail={detail} — the \
-             emitted crate's own module list could not be read, so the entry's own module can \
-             neither be found nor ruled out; nothing else may carry the fault in its place"
-        ),
         MutationSubjectRefusal::EntryModuleNotDeclared {
             entry_module,
             declared,
@@ -589,6 +572,8 @@ pub enum EmitCompileOutcome {
     Measured {
         entry: String,
         crate_dir: String,
+        /// Where the emitted module files are inside the workspace at `crate_dir`.
+        module_dir: String,
         emitted_files: usize,
         baseline: CargoVerdict,
         mutation: MutationVerdict,
@@ -627,6 +612,7 @@ pub fn emit_compile_outcome_summary(outcome: &EmitCompileOutcome) -> String {
             emitted_files,
             baseline,
             mutation,
+            ..
         } => format!(
             "{entry} Measured files={emitted_files} crate={crate_dir} baseline=[{}] mutation=[{}]",
             cargo_verdict_summary(baseline),
@@ -635,39 +621,6 @@ pub fn emit_compile_outcome_summary(outcome: &EmitCompileOutcome) -> String {
     }
 }
 
-/// Consume the emission's manifest, preserving its dependency and feature demand. The old
-/// foundation-runtime roster omitted dependencies of emitted service drivers (Tokio), so a
-/// successful emission became an unbuildable probe. The host changes only the per-entry package
-/// identity and preserves the emitted crate's original library name for generated main.rs.
-fn probe_manifest(entry: &str, emitted: &str) -> Result<String, String> {
-    let mut manifest: toml::Value =
-        toml::from_str(emitted).map_err(|e| format!("invalid emitted Cargo.toml: {e}"))?;
-    let package = manifest
-        .get_mut("package")
-        .and_then(toml::Value::as_table_mut)
-        .ok_or_else(|| "emitted Cargo.toml has no package table".to_string())?;
-    let original_name = package
-        .get("name")
-        .and_then(toml::Value::as_str)
-        .ok_or_else(|| "emitted Cargo.toml has no package name".to_string())?
-        .to_string();
-    package.insert(
-        "name".to_string(),
-        toml::Value::String(probe_package_name(entry)),
-    );
-    let table = manifest
-        .as_table_mut()
-        .expect("package table belongs to a manifest table");
-    let lib = table
-        .entry("lib")
-        .or_insert_with(|| toml::Value::Table(Default::default()))
-        .as_table_mut()
-        .ok_or_else(|| "emitted Cargo.toml lib is not a table".to_string())?;
-    lib.entry("name")
-        .or_insert(toml::Value::String(original_name.replace('-', "_")));
-    toml::to_string(&manifest).map_err(|e| format!("serialize probe Cargo.toml: {e}"))
-}
-
 /// Where one entry's probe crate is written. Outside the repository: a crate under the workspace
 /// root is inferred into the workspace and would need its own `[workspace]` to escape — a manifest
 /// fact invented to work around its location.
@@ -848,73 +801,58 @@ fn probe_crate_dir(probe_root: &PrivateProbeRoot, entry: &str) -> PathBuf {
     probe_root.join(slug)
 }
 
-/// Write the emitted Rust files plus a manifest, and return the crate directory.
+/// Write the emission as its partitioned Cargo workspace (`cli_run::emitted_crate_workspace_host`
+/// `write_emitted_workspace`, the one writer every emitted-Rust route uses), named for the entry.
 ///
 /// `pub(crate)` for the required-v2-native lane's harness (cli_run::native_lane_runner), which
 /// prepares the emitted-native compiler through this same writer rather than growing a second
-/// one beside it (DESIGN §2 — the note on `write_probe_crate_files` is the argument).
+/// one beside it (DESIGN §2).
 pub(crate) fn write_probe_crate(
     run: &CompileRun,
     probe_root: &PrivateProbeRoot,
     entry: &str,
-) -> Result<(PathBuf, usize), String> {
+) -> Result<crate::cli_run::EmittedWorkspace, String> {
     let emission = run
         .emissions
         .iter()
         .find(|emission| emission.target_name == "rust")
         .ok_or_else(|| "the emission carries no rust target".to_string())?;
-    write_probe_crate_files(&emission.result.files, probe_root, entry)
+    write_probe_crate_files(
+        &emission.result.files,
+        &emission.result.emitted_edges,
+        &emission.result.rust_crates,
+        probe_root,
+        entry,
+    )
 }
 
-/// The crate writer both routes share: emitted files in, a written crate directory out.
+/// The writer both routes share: an emission in, a written workspace out.
 ///
 /// ONE WRITER, TWO CALLERS, AND THE SHARING IS THE POINT (DESIGN §2). The required phase reaches
-/// it through a `CompileRun`'s rust emission; the fixture route reaches it with the files a
-/// virtual source's `compile_sources` produced. A second writer beside this one would let the two
-/// routes disagree about what "the emitted crate" is -- manifest, stale-tree removal, or the
-/// `src/lib.rs` requirement -- so a green on one would stop being evidence about the other.
+/// it through a `CompileRun`'s rust emission; the fixture route reaches it with what a virtual
+/// source's `compile_sources` produced. The workspace directory is per entry and the binary is
+/// named `probe_package_name(entry)`, so entries sharing one target directory never share a binary
+/// path.
 fn write_probe_crate_files(
-    files: &im::Vector<std::rc::Rc<crate::v1_std_core::TextFile>>,
+    files: &std::rc::Rc<im::Vector<std::rc::Rc<crate::v1_std_core::TextFile>>>,
+    edges: &std::rc::Rc<im::Vector<std::rc::Rc<crate::gunbc_rust_emitted_edge::EmittedEdge>>>,
+    rust_crates: &std::rc::Rc<
+        im::Vector<std::rc::Rc<crate::gunbc_rust_emitted_crate::EmittedRustCrate>>,
+    >,
     probe_root: &PrivateProbeRoot,
     entry: &str,
-) -> Result<(PathBuf, usize), String> {
-    let manifests: Vec<_> = files
-        .iter()
-        .filter(|file| file.path == "Cargo.toml")
-        .collect();
-    if manifests.len() != 1 {
-        return Err(format!(
-            "emission must carry exactly one Cargo.toml, observed {}",
-            manifests.len()
-        ));
-    }
-    let manifest = probe_manifest(entry, &manifests[0].content)?;
+) -> Result<crate::cli_run::EmittedWorkspace, String> {
     let dir = probe_crate_dir(probe_root, entry);
     // A STALE TREE IS NOT A SUBJECT. A previous run's bytes under the same slug would let a module
     // deleted from the closure keep compiling, so the directory is removed, not written over.
     let _ = std::fs::remove_dir_all(&dir);
-    std::fs::create_dir_all(dir.join("src"))
-        .map_err(|e| format!("creating {}: {e}", dir.display()))?;
-    let mut written = 0usize;
-    for file in files.iter() {
-        let path = dir.join(&*file.path);
-        if let Some(parent) = path.parent() {
-            std::fs::create_dir_all(parent)
-                .map_err(|e| format!("creating {}: {e}", parent.display()))?;
-        }
-        std::fs::write(&path, &*file.content)
-            .map_err(|e| format!("writing {}: {e}", path.display()))?;
-        written += 1;
-    }
-    if !dir.join("src/lib.rs").is_file() {
-        return Err(format!(
-            "the emission wrote no src/lib.rs into {} — there is no crate root to compile",
-            dir.display()
-        ));
-    }
-    std::fs::write(dir.join("Cargo.toml"), manifest)
-        .map_err(|e| format!("writing the manifest into {}: {e}", dir.display()))?;
-    Ok((dir, written))
+    crate::cli_run::write_emitted_workspace(
+        files,
+        edges,
+        rust_crates,
+        &dir,
+        &probe_package_name(entry),
+    )
 }
 
 /// Run cargo over the probe crate.
@@ -1358,7 +1296,9 @@ pub(crate) fn run_cargo(
     }
 }
 
-/// The rust module basenames the emitted `lib.rs` declares, in its own order.
+/// The rust module basenames the emitted `lib.rs` declares, in its own order -- public or not: a
+/// private `mod` (the host shell's `#[cfg(test)] mod compiler_tests;`) is a module of the crate as
+/// much as a `pub mod` is, and an edge from it is covered by this crate.
 ///
 /// AN UNREADABLE MANIFEST IS RETURNED, NOT RENDERED AS AN EMPTY CLOSURE. An empty vector reads as
 /// `this crate declares no modules`, so a caller would answer `entry module not declared` for a
@@ -1369,8 +1309,9 @@ pub(crate) fn closure_modules(lib_rs: &Path) -> Result<Vec<String>, String> {
     Ok(content
         .lines()
         .filter_map(|line| {
-            line.trim()
-                .strip_prefix("pub mod ")
+            let line = line.trim();
+            line.strip_prefix("pub mod ")
+                .or_else(|| line.strip_prefix("mod "))
                 .and_then(|rest| rest.strip_suffix(';'))
                 .map(|m| m.trim().to_string())
         })
@@ -1399,17 +1340,20 @@ fn unattributed_fault_refusal(red: &CargoVerdict) -> MutationVerdict {
 /// the second control. Several things changing at once would show cargo responds to damage, not
 /// that this instrument reads this closure.
 pub(crate) fn establish_discriminating_red(
-    crate_dir: &Path,
+    workspace: &crate::cli_run::EmittedWorkspace,
     target_dir: &Path,
     entry_module: &str,
 ) -> MutationVerdict {
+    let crate_dir = workspace.root.as_path();
     // NO FALLBACK ARM. A closure missing its own entry module is the finding -- substituting
     // another member would yield `Discriminated` over precisely the broken tree.
-    let subject = match mutation_subject(crate_dir, entry_module) {
+    let subject = match mutation_subject(&workspace.module_dir, &workspace.modules, entry_module) {
         Ok(subject) => subject,
         Err(refusal) => return MutationVerdict::SubjectRefused { refusal },
     };
-    let path = crate_dir.join(format!("src/{}.rs", mutation_subject_rust_module(&subject)));
+    let path = workspace
+        .module_dir
+        .join(format!("{}.rs", mutation_subject_rust_module(&subject)));
     let original = match std::fs::read_to_string(&path) {
         Ok(bytes) => bytes,
         Err(e) => {
@@ -1595,8 +1539,8 @@ pub fn run_emit_compile_entry(
         CompileDisposition::Completed { .. } => {}
     }
 
-    let (crate_dir, emitted_files) = match write_probe_crate(&run, probe_root, entry) {
-        Ok(pair) => pair,
+    let emitted = match write_probe_crate(&run, probe_root, entry) {
+        Ok(emitted) => emitted,
         Err(cause) => {
             return EmitCompileOutcome::CrateNotWritten {
                 entry: entry.to_string(),
@@ -1614,8 +1558,11 @@ pub fn run_emit_compile_entry(
         }
     };
 
+    let crate_dir = emitted.root.clone();
+    let emitted_files = emitted.files.len();
     eprintln!(
-        "emit-compile: {entry} emitted {emitted_files} file(s) into {} — cargo baseline",
+        "emit-compile: {entry} emitted {emitted_files} file(s) into {} crate(s) under {} — cargo baseline",
+        emitted.crate_count,
         crate_dir.display()
     );
     let baseline = run_cargo(&crate_dir, &probe_root.target_dir(), MUTATION_PROBE_SYMBOL);
@@ -1627,7 +1574,7 @@ pub fn run_emit_compile_entry(
     // tree goes red under the fault for a reason the fault did not cause -- a green control
     // wearing a red one's clothes.
     let mutation = if cargo_verdict_compiled(&baseline) {
-        establish_discriminating_red(&crate_dir, &probe_root.target_dir(), &entry_module)
+        establish_discriminating_red(&emitted, &probe_root.target_dir(), &entry_module)
     } else {
         MutationVerdict::NotAttempted {
             reason: format!(
@@ -1641,6 +1588,7 @@ pub fn run_emit_compile_entry(
     EmitCompileOutcome::Measured {
         entry: entry.to_string(),
         crate_dir: crate_dir.display().to_string(),
+        module_dir: emitted.module_dir.display().to_string(),
         emitted_files,
         baseline,
         mutation,
@@ -1843,11 +1791,18 @@ pub(crate) fn fixture_closure_rustc_verdict(
     // The crate slug is the fixture's own emitted module, so two fixtures never share a package
     // name in the shared target directory — the fingerprint-aliasing fail-open `probe_package_name`
     // records for the entry route applies identically here.
-    let (crate_dir, emitted_files) =
-        match write_probe_crate_files(&result.files, probe_root, &rust_module) {
-            Ok(pair) => pair,
-            Err(cause) => return FixtureClosureOutcome::CrateNotWritten { cause },
-        };
+    let emitted = match write_probe_crate_files(
+        &result.files,
+        &result.emitted_edges,
+        &result.rust_crates,
+        probe_root,
+        &rust_module,
+    ) {
+        Ok(emitted) => emitted,
+        Err(cause) => return FixtureClosureOutcome::CrateNotWritten { cause },
+    };
+    let crate_dir = emitted.root.clone();
+    let emitted_files = emitted.files.len();
     eprintln!(
         "fixture-closure: {rust_module} emitted {emitted_files} file(s) into {} — cargo",
         crate_dir.display()
@@ -2421,23 +2376,14 @@ pub(crate) fn fixture_arm_diagnostic_lines(
 /// from its own closure, so an emit-stage diagnostic reachable only from ITS entry is invisible.
 /// Splitting the two numerators is strictly better and not done here.
 pub fn emit_compile_modules_reached(outcomes: &[EmitCompileOutcome]) -> usize {
-    // `src/lib.rs` IS NOT DEDUPLICABLE BY NAME, AND UNIONING IT WOULD UNDER-COUNT. Each entry's
-    // root module is written as `lib.rs` (the compiler refuses a crate without one), so every
-    // entry contributes a DIFFERENT root under the SAME name; unioning would collapse N roots into
-    // one, a numerator shrinking as the cover grows. Roots are counted per measured entry and
-    // dependency modules unioned by name.
+    // Every emitted module, the entry's own included, is a file named for its module in the
+    // workspace's module directory, so modules are unioned by name across entries.
     let mut reached: Vec<String> = Vec::new();
-    let mut roots = 0usize;
     for outcome in outcomes {
-        if let EmitCompileOutcome::Measured { crate_dir, .. } = outcome {
-            let src = std::path::Path::new(crate_dir).join("src");
-            if let Ok(entries) = std::fs::read_dir(&src) {
-                roots += 1;
+        if let EmitCompileOutcome::Measured { module_dir, .. } = outcome {
+            if let Ok(entries) = std::fs::read_dir(module_dir) {
                 for entry in entries.flatten() {
                     if let Some(name) = entry.file_name().to_str() {
-                        if name == "lib.rs" {
-                            continue;
-                        }
                         reached.push(name.to_string());
                     }
                 }
@@ -2446,7 +2392,7 @@ pub fn emit_compile_modules_reached(outcomes: &[EmitCompileOutcome]) -> usize {
     }
     reached.sort();
     reached.dedup();
-    reached.len() + roots
+    reached.len()
 }
 
 /// THE SELECTION, WITH ITS REMAINDER CARRIED AT IDENTITY GRAIN.
@@ -2480,9 +2426,10 @@ pub fn emit_compile_selection(source_roots: &[String]) -> EmitCompileSelection {
     let mut universe: Vec<String> = Vec::new();
     for root in source_roots {
         let mut files = Vec::new();
-        super::collect_dag_files_tolerant(std::path::Path::new(root), &mut files);
+        super::collect_dag_files_tolerant(std::path::Path::new(root), &mut files)
+            .unwrap_or_else(|cause| panic!("emit compile selection over {root}: {cause}"));
         for file in files {
-            universe.push(file.to_string_lossy().to_string());
+            universe.push(file.path().to_string_lossy().to_string());
         }
     }
     universe.sort();
@@ -3150,63 +3097,26 @@ mod tests {
         assert_eq!(cargo_verdict_summary(&green), "Completed status=0");
     }
 
-    #[test]
-    fn manifest_preserves_emitted_dependency_demand() {
-        use crate::v1_compiler_emit_rust::{emit_cargo_toml, EmittedCrateDependencyDemand};
-        for asynchronous in [false, true] {
-            let emitted = emit_cargo_toml(
-                "v1_compiled".to_string(),
-                EmittedCrateDependencyDemand {
-                    renders_clap_cli: false,
-                    renders_async_services: asynchronous,
-                },
-            );
-            let manifest = probe_manifest("dag/std/logic.dag", &emitted.content).expect("manifest");
-            let original: toml::Value = toml::from_str(&emitted.content).unwrap();
-            let probe: toml::Value = toml::from_str(&manifest).unwrap();
-            assert_eq!(probe["dependencies"], original["dependencies"]);
-            assert_eq!(probe["features"], original["features"]);
-            assert_eq!(probe["package"]["version"], original["package"]["version"]);
-            assert_eq!(
-                probe["package"]["name"].as_str(),
-                Some("gunbc-emitted-closure-dag-std-logic-dag")
-            );
-            assert_eq!(probe["lib"]["name"].as_str(), Some("v1_compiled"));
-            assert_eq!(probe["dependencies"].get("tokio").is_some(), asynchronous);
-            assert!(probe["dependencies"].get("v1-compiler").is_none());
-            assert!(!manifest.contains("src/v1"));
-        }
-    }
-
-    #[test]
-    fn manifest_refuses_missing_or_malformed_package_identity() {
-        for manifest in [
-            "",
-            "[dependencies]",
-            "[package]",
-            "[package]\nname = 42",
-            "not toml",
-        ] {
-            assert!(probe_manifest("entry.dag", manifest).is_err());
-        }
-    }
-
-    /// One emitted crate on disk, authored by the caller, so each test states the shape it means.
-    fn probe_tree(tag: &str, lib_rs: &str, files: &[&str]) -> PathBuf {
+    /// One emitted module directory on disk, authored by the caller, so each test states the
+    /// shape it means: the modules the workspace's top package declares, and the files written.
+    fn probe_tree(tag: &str, files: &[&str]) -> PathBuf {
         let dir = std::env::temp_dir().join(format!(
             "emit_compile_{tag}_{}_{:?}",
             std::process::id(),
             std::thread::current().id()
         ));
         let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(dir.join("src")).expect("src");
-        std::fs::write(dir.join("src/lib.rs"), lib_rs).expect("lib");
+        std::fs::create_dir_all(&dir).expect("module dir");
         for file in files {
-            std::fs::write(dir.join(format!("src/{file}.rs")), "// emitted\n").expect("member");
+            std::fs::write(dir.join(format!("{file}.rs")), "// emitted\n").expect("member");
         }
         dir
     }
 
+    fn declared(modules: &[&str]) -> Vec<String> {
+        modules.iter().map(|m| m.to_string()).collect()
+    }
+
     /// THE SUBJECT IS THE ENTRY'S OWN MODULE EVEN WHEN A SHARED MEMBER IS DECLARED FIRST.
     ///
     /// The measured shape of 7 of the 8 rostered entries: shared-core member first, entry
@@ -3214,12 +3124,12 @@ mod tests {
     /// -- a verdict about the shared core wearing this entry's name.
     #[test]
     fn the_subject_is_the_entry_own_module_past_a_leading_shared_member() {
+        let decl = declared(&["std_error_primitives", "v2_std_node", "v1_rt"]);
         let dir = probe_tree(
             "shared_first",
-            "pub mod std_error_primitives;\npub mod v2_std_node;\npub mod v1_rt;\n",
             &["std_error_primitives", "v2_std_node", "v1_rt"],
         );
-        let subject = mutation_subject(&dir, "v2_std_node").expect("the entry's own module");
+        let subject = mutation_subject(&dir, &decl, "v2_std_node").expect("the entry's own module");
         assert_eq!(mutation_subject_rust_module(&subject), "v2_std_node");
         assert_eq!(mutation_subject_name(&subject), "EntryOwnModule");
         let _ = std::fs::remove_dir_all(&dir);
@@ -3230,12 +3140,9 @@ mod tests {
     /// module -- picks `v1_rt`, the emitted runtime, in all 8, strictly more shared.
     #[test]
     fn the_subject_is_the_entry_own_module_when_it_is_declared_first() {
-        let dir = probe_tree(
-            "entry_first",
-            "pub mod std_logic;\npub mod v1_rt;\n",
-            &["std_logic", "v1_rt"],
-        );
-        let subject = mutation_subject(&dir, "std_logic").expect("the entry's own module");
+        let decl = declared(&["std_logic", "v1_rt"]);
+        let dir = probe_tree("entry_first", &["std_logic", "v1_rt"]);
+        let subject = mutation_subject(&dir, &decl, "std_logic").expect("the entry's own module");
         assert_eq!(mutation_subject_rust_module(&subject), "std_logic");
         let _ = std::fs::remove_dir_all(&dir);
     }
@@ -3247,12 +3154,9 @@ mod tests {
     /// dependency of the missing root and nothing references it back.
     #[test]
     fn an_entry_module_missing_from_the_closure_refuses_rather_than_substituting() {
-        let dir = probe_tree(
-            "entry_dropped",
-            "pub mod std_error_primitives;\npub mod v1_rt;\n",
-            &["std_error_primitives", "v1_rt"],
-        );
-        let refusal = mutation_subject(&dir, "v2_std_node").expect_err("no substitution");
+        let decl = declared(&["std_error_primitives", "v1_rt"]);
+        let dir = probe_tree("entry_dropped", &["std_error_primitives", "v1_rt"]);
+        let refusal = mutation_subject(&dir, &decl, "v2_std_node").expect_err("no substitution");
         match &refusal {
             MutationSubjectRefusal::EntryModuleNotDeclared {
                 entry_module,
@@ -3275,12 +3179,9 @@ mod tests {
     /// defect, not an emission one, and it gets its own refusal for that reason.
     #[test]
     fn an_entry_module_declared_without_a_file_refuses_as_a_write_defect() {
-        let dir = probe_tree(
-            "entry_unwritten",
-            "pub mod v2_std_node;\npub mod v1_rt;\n",
-            &["v1_rt"],
-        );
-        let refusal = mutation_subject(&dir, "v2_std_node").expect_err("no substitution");
+        let decl = declared(&["v2_std_node", "v1_rt"]);
+        let dir = probe_tree("entry_unwritten", &["v1_rt"]);
+        let refusal = mutation_subject(&dir, &decl, "v2_std_node").expect_err("no substitution");
         assert!(matches!(
             refusal,
             MutationSubjectRefusal::EntryModuleFileMissing { .. }
@@ -3288,26 +3189,6 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
-    /// AN UNREADABLE MANIFEST IS NOT AN EMPTY CLOSURE. Rendering it as one reports the EMISSION
-    /// arm -- `the entry's own module is not declared` -- for a crate nobody read, sending the
-    /// reader to the emitter over a filesystem fault.
-    #[test]
-    fn an_unreadable_closure_manifest_refuses_on_its_own_cause() {
-        let dir = std::env::temp_dir().join(format!(
-            "emit_compile_no_manifest_{}_{:?}",
-            std::process::id(),
-            std::thread::current().id()
-        ));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(dir.join("src")).expect("src");
-        let refusal = mutation_subject(&dir, "v2_std_node").expect_err("no manifest, no subject");
-        assert!(matches!(
-            refusal,
-            MutationSubjectRefusal::ClosureManifestUnreadable { .. }
-        ));
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
     /// AN ENTRY THE RUN NEVER REACHED IS NOT A PASS. The terminal-restore arm gives "not reached"
     /// its own spelling; if it could pass, ending early would silently green every later entry.
     #[test]
@@ -3409,21 +3290,6 @@ mod tests {
             std::thread::current().id()
         ));
         let _ = std::fs::remove_dir_all(&base);
-        let tree = |marker: &str| -> im::Vector<std::rc::Rc<crate::v1_std_core::TextFile>> {
-            im::vector![
-                std::rc::Rc::new(crate::v1_std_core::TextFile {
-                    path: "src/lib.rs".to_string(),
-                    content: format!("// emitted by run {marker}\n"),
-                }),
-                crate::v1_compiler_emit_rust::emit_cargo_toml(
-                    "v1_compiled".to_string(),
-                    crate::v1_compiler_emit_rust::EmittedCrateDependencyDemand {
-                        renders_clap_cli: false,
-                        renders_async_services: false,
-                    }
-                )
-            ]
-        };
         let first = create_private_probe_root(&base).expect("the first run creates its root");
         let second = create_private_probe_root(&base).expect("the second run creates its root");
         assert_ne!(
@@ -3437,12 +3303,18 @@ mod tests {
             "two runs must not build, hash or spawn one executable path"
         );
 
-        let (first_crate, _) = write_probe_crate_files(&tree("A"), &first, "v2.compiler.compile")
-            .expect("the first run writes its tree");
-        write_probe_crate_files(&tree("B"), &second, "v2.compiler.compile")
-            .expect("the second run writes its tree");
+        // Each run writes its tree where the writer names an entry's workspace in its own root.
+        let write = |root: &PrivateProbeRoot, marker: &str| -> PathBuf {
+            let dir = probe_crate_dir(root, "v2.compiler.compile");
+            std::fs::create_dir_all(&dir).expect("the run creates its workspace");
+            std::fs::write(dir.join("marker"), format!("// emitted by run {marker}\n"))
+                .expect("the run writes its tree");
+            dir
+        };
+        let first_crate = write(&first, "A");
+        write(&second, "B");
         assert_eq!(
-            std::fs::read_to_string(first_crate.join("src/lib.rs")).expect("read back"),
+            std::fs::read_to_string(first_crate.join("marker")).expect("read back"),
             "// emitted by run A\n",
             "the first run must read the tree it wrote, not the second run's"
         );
@@ -3658,6 +3530,7 @@ error: could not compile `probe` (lib) due to 1 previous error
             let outcome = EmitCompileOutcome::Measured {
                 entry: "e.dag".to_string(),
                 crate_dir: "/tmp/x".to_string(),
+                module_dir: "/tmp/x/src/v1/stage0/src".to_string(),
                 emitted_files: 1,
                 baseline: green.clone(),
                 mutation,
@@ -3673,11 +3546,13 @@ error: could not compile `probe` (lib) due to 1 previous error
         // privacy boundary turned that into a COMPILE ERROR (`E0451: field rust_module is
         // private`) -- executed evidence the wall is structural, since module-scoped privacy
         // beside the constructor would have left the literal compiling.
-        let dir = probe_tree("passing_subject", "pub mod std_logic;\n", &["std_logic"]);
-        let subject = mutation_subject(&dir, "std_logic").expect("the entry's own module");
+        let decl = declared(&["std_logic"]);
+        let dir = probe_tree("passing_subject", &["std_logic"]);
+        let subject = mutation_subject(&dir, &decl, "std_logic").expect("the entry's own module");
         let discriminated = EmitCompileOutcome::Measured {
             entry: "e.dag".to_string(),
             crate_dir: "/tmp/x".to_string(),
+            module_dir: "/tmp/x/src/v1/stage0/src".to_string(),
             emitted_files: 1,
             baseline: green,
             mutation: MutationVerdict::Discriminated {
diff --git a/src/v1/stage0/src/emitted_population.rs b/src/v1/stage0/src/emitted_population.rs
index 6ad1317e987..2ca43f8f2a4 100644
--- a/src/v1/stage0/src/emitted_population.rs
+++ b/src/v1/stage0/src/emitted_population.rs
@@ -1,4 +1,3 @@
-// Cargo.toml
 // src/compiler_tests.rs
 // src/emitted_population.rs
 // src/extdeps_cargo.rs
@@ -34,10 +33,13 @@
 // src/extdeps_version_semver.rs
 // src/gunbc_cli_dispatch_generated.rs
 // src/gunbc_cli_dispatch_surface.rs
+// src/gunbc_crate_partition.rs
+// src/gunbc_emitted_crate_workspace.rs
 // src/gunbc_namespace_reference_derived_closure_admission.rs
 // src/gunbc_reference_derived_candidate.rs
 // src/gunbc_rust_crate_package_ident.rs
 // src/gunbc_rust_decl_type_overlay.rs
+// src/gunbc_rust_emitted_crate.rs
 // src/gunbc_rust_emitted_edge.rs
 // src/gunbc_rust_source_type_bindings.rs
 // src/gunbc_stage0_crate_layout_generated.rs
@@ -114,6 +116,7 @@
 // src/v1_compiler_emit_go.rs
 // src/v1_compiler_emit_python.rs
 // src/v1_compiler_emit_rust.rs
+// src/v1_compiler_emitted_workspace.rs
 // src/v1_compiler_expected_red_roster_join.rs
 // src/v1_compiler_frontend_observation.rs
 // src/v1_compiler_infer.rs
diff --git a/src/v1/stage0/src/extdeps_cargo.rs b/src/v1/stage0/src/extdeps_cargo.rs
index 9d650980d18..c380b635f3b 100644
--- a/src/v1/stage0/src/extdeps_cargo.rs
+++ b/src/v1/stage0/src/extdeps_cargo.rs
@@ -12,7 +12,7 @@ pub use crate::extdeps_cargo_version::{
 pub use crate::extdeps_external_authority::ExternalAuthority;
 use crate::extdeps_uri::UriScheme::Https;
 pub use crate::extdeps_uri::{Uri, UriScheme};
-pub use crate::std_types::{FilePathParts, List, NonEmptyStr};
+pub use crate::std_types::{Bool, FilePathParts, List, NonEmptyStr};
 use crate::std_workspace_artifact::FootprintProvenance::CitedUpstream;
 use crate::std_workspace_artifact::IgnoreReason::{LocalCacheState, RegenerableFromSource};
 pub use crate::std_workspace_artifact::{
@@ -91,6 +91,7 @@ pub struct CargoPackage {
 pub enum CargoDepSource {
     RegistryDep {
         version: CargoVersionRequirement,
+        default_features: bool,
         features: Rc<Vec<String>>,
     },
     LocalPathDep {
diff --git a/src/v1/stage0/src/extdeps_container_oci_digest.rs b/src/v1/stage0/src/extdeps_container_oci_digest.rs
index 60344d27275..71788f3a266 100644
--- a/src/v1/stage0/src/extdeps_container_oci_digest.rs
+++ b/src/v1/stage0/src/extdeps_container_oci_digest.rs
@@ -259,7 +259,7 @@ pub fn oci_wire_digest_parts(raw: String) -> Option<Rc<OciWireDigestParts>> {
             std::option::Option::None
         } else {
             match parts.clone().first().cloned() {
-                Some(algorithm) => match parts.clone().iter().cloned().skip(1 as usize).next() {
+                Some(algorithm) => match parts.clone().get((1) as usize).cloned() {
                     Some(encoded) => Some(oci_wire_digest_parts_from_split(
                         algorithm.clone(),
                         encoded.clone(),
diff --git a/src/v1/stage0/src/extdeps_filesystem_rust_realization.rs b/src/v1/stage0/src/extdeps_filesystem_rust_realization.rs
index cb09924b5d8..ec7f3a0d39f 100644
--- a/src/v1/stage0/src/extdeps_filesystem_rust_realization.rs
+++ b/src/v1/stage0/src/extdeps_filesystem_rust_realization.rs
@@ -1,6 +1,7 @@
 // Generated by v1 compiler -- do not edit.
 // Source module: extdeps.filesystem.rust_realization
 
+pub use crate::std_integer::int_to_decimal_string;
 use crate::v1_rt;
 use crate::v1_rt::{VecCompat, VecJoin};
 use crate::NonEmptyBTreeSet;
@@ -16,7 +17,9 @@ pub fn rust_file_create_staging_candidate_attempt_limit_def() -> String {
     v1_rt::concat(
         v1_rt::concat(
             "pub const GUNBC_CREATE_STAGING_CANDIDATE_ATTEMPT_LIMIT: u32 = ".to_string(),
-            format!("{}", rust_file_create_staging_candidate_attempt_limit()),
+            crate::std_integer::int_to_decimal_string(
+                rust_file_create_staging_candidate_attempt_limit(),
+            ),
         ),
         ";\n".to_string(),
     )
diff --git a/src/v1/stage0/src/extdeps_languages_rust_emit.rs b/src/v1/stage0/src/extdeps_languages_rust_emit.rs
index 0ec6134ed39..edcdd4fdc23 100644
--- a/src/v1/stage0/src/extdeps_languages_rust_emit.rs
+++ b/src/v1/stage0/src/extdeps_languages_rust_emit.rs
@@ -90,7 +90,7 @@ pub fn rust_container_templates() -> Rc<HashMap<String, String>> {
 pub fn rust_simple_method_specs() -> Rc<Vec<Rc<SimpleMethodSpec>>> {
     thread_local! {
         static CACHED: Rc<Vec<Rc<SimpleMethodSpec>>> = {
-            serde_json::from_str("[{\"method_name\": \"count\", \"template\": \"({recv}.len() as i64)\", \"wraps_result\": false}, {\"method_name\": \"join\", \"template\": \"{recv}.join(&{arg})\", \"wraps_result\": false}, {\"method_name\": \"split\", \"template\": \"{recv}.split(&{arg}).map(|s| s.to_string()).collect::<Vec<_>>()\", \"wraps_result\": true}, {\"method_name\": \"last\", \"template\": \"{recv}.last().cloned()\", \"wraps_result\": false}, {\"method_name\": \"first\", \"template\": \"{recv}.first().cloned()\", \"wraps_result\": false}, {\"method_name\": \"enumerate\", \"template\": \"{recv}.iter().cloned().enumerate().map(|(i, v)| (i as i64, v)).collect::<Vec<_>>()\", \"wraps_result\": true}, {\"method_name\": \"chars\", \"template\": \"{recv}.chars().map(|c| c as i64).collect::<Vec<_>>()\", \"wraps_result\": true}, {\"method_name\": \"skip\", \"template\": \"{recv}.iter().cloned().skip({arg} as usize).collect::<Vec<_>>()\", \"wraps_result\": true}, {\"method_name\": \"take\", \"template\": \"{recv}.iter().cloned().take({arg} as usize).collect::<Vec<_>>()\", \"wraps_result\": true}, {\"method_name\": \"is_empty\", \"template\": \"{recv}.is_empty()\", \"wraps_result\": false}]")
+            serde_json::from_str("[{\"method_name\": \"count\", \"template\": \"({recv}.len() as i64)\", \"wraps_result\": false}, {\"method_name\": \"join\", \"template\": \"{recv}.join(&{arg})\", \"wraps_result\": false}, {\"method_name\": \"split\", \"template\": \"{recv}.split(&{arg}).map(|s| s.to_string()).collect::<Vec<_>>()\", \"wraps_result\": true}, {\"method_name\": \"last\", \"template\": \"{recv}.last().cloned()\", \"wraps_result\": false}, {\"method_name\": \"first\", \"template\": \"{recv}.first().cloned()\", \"wraps_result\": false}, {\"method_name\": \"enumerate\", \"template\": \"{recv}.iter().cloned().enumerate().map(|(i, v)| (i as i64, v)).collect::<Vec<_>>()\", \"wraps_result\": true}, {\"method_name\": \"chars\", \"template\": \"{recv}.chars().map(|c| c as i64).collect::<Vec<_>>()\", \"wraps_result\": true}, {\"method_name\": \"skip\", \"template\": \"v1_rt::list_skip(&{recv}, {arg})\", \"wraps_result\": true}, {\"method_name\": \"take\", \"template\": \"v1_rt::list_take(&{recv}, {arg})\", \"wraps_result\": true}, {\"method_name\": \"is_empty\", \"template\": \"{recv}.is_empty()\", \"wraps_result\": false}]")
                 .expect("valid data definition")
         };
     }
diff --git a/src/v1/stage0/src/extdeps_uri.rs b/src/v1/stage0/src/extdeps_uri.rs
index 303138dbac4..919c2a4bb70 100644
--- a/src/v1/stage0/src/extdeps_uri.rs
+++ b/src/v1/stage0/src/extdeps_uri.rs
@@ -118,18 +118,15 @@ pub fn uri_from_wire(url: String) -> Option<Rc<Uri>> {
             ParsedHrefScheme::UnknownHref => std::option::Option::None,
             ParsedHrefScheme::HrefScheme { scheme: scheme, .. } => {
                 let prefix = uri_scheme_wire(scheme.clone());
-                let locator = Rc::new(
-                    Rc::new(
+                let locator = Rc::new(v1_rt::list_skip(
+                    &Rc::new(
                         s.clone()
                             .split(&prefix.clone())
                             .map(|s| s.to_string())
                             .collect::<Vec<_>>(),
-                    )
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .collect::<Vec<_>>(),
-                )
+                    ),
+                    1,
+                ))
                 .join(&prefix.clone());
                 if (v1_rt::starts_with(s.clone(), prefix.clone())
                     && !(locator.clone() == "".to_string()))
diff --git a/src/v1/stage0/src/extdeps_uri_path.rs b/src/v1/stage0/src/extdeps_uri_path.rs
index 1c6f7ff7508..83385bc9570 100644
--- a/src/v1/stage0/src/extdeps_uri_path.rs
+++ b/src/v1/stage0/src/extdeps_uri_path.rs
@@ -176,13 +176,7 @@ pub fn parse_segment_tokens(seg: String) -> Rc<PathSegmentTokensResult> {
                     })
                 }
             };
-            let after_open = match before_and_rest
-                .clone()
-                .iter()
-                .cloned()
-                .skip(1 as usize)
-                .next()
-            {
+            let after_open = match before_and_rest.clone().get((1) as usize).cloned() {
                 Some(r) => r.clone(),
                 std::option::Option::None => {
                     return Rc::new(PathSegmentTokensResult::MalformedPathSegment {
@@ -216,13 +210,7 @@ pub fn parse_segment_tokens(seg: String) -> Rc<PathSegmentTokensResult> {
                     })
                 }
             };
-            let suffix = match name_and_suffix
-                .clone()
-                .iter()
-                .cloned()
-                .skip(1 as usize)
-                .next()
-            {
+            let suffix = match name_and_suffix.clone().get((1) as usize).cloned() {
                 Some(s) => s.clone(),
                 std::option::Option::None => {
                     return Rc::new(PathSegmentTokensResult::MalformedPathSegment {
@@ -304,14 +292,7 @@ pub fn match_path_segments(path_only: String) -> Rc<Vec<String>> {
             match raw_segs.clone().first().cloned() {
                 Some(lead) => {
                     if (lead.clone() == "".to_string()) {
-                        Rc::new(
-                            raw_segs
-                                .clone()
-                                .iter()
-                                .cloned()
-                                .skip(1 as usize)
-                                .collect::<Vec<_>>(),
-                        )
+                        Rc::new(v1_rt::list_skip(&raw_segs.clone(), 1))
                     } else {
                         raw_segs.clone()
                     }
@@ -337,21 +318,8 @@ pub fn match_path_tokens(
             Some(tok) => match segs.clone().first().cloned() {
                 std::option::Option::None => Rc::new(PathTemplateMatch::PathNotMatched),
                 Some(seg) => match (*match_path_tokens(
-                    Rc::new(
-                        tokens
-                            .clone()
-                            .iter()
-                            .cloned()
-                            .skip(1 as usize)
-                            .collect::<Vec<_>>(),
-                    ),
-                    Rc::new(
-                        segs.clone()
-                            .iter()
-                            .cloned()
-                            .skip(1 as usize)
-                            .collect::<Vec<_>>(),
-                    ),
+                    Rc::new(v1_rt::list_skip(&tokens.clone(), 1)),
+                    Rc::new(v1_rt::list_skip(&segs.clone(), 1)),
                 ))
                 .clone()
                 {
@@ -461,51 +429,48 @@ pub fn parse_path_template(raw: String) -> Rc<PathTemplateParseResult> {
                     tokens: first_tokens,
                     ..
                 } => {
-                    let parsed = Rc::new(
-                        segments
-                            .clone()
-                            .iter()
-                            .cloned()
-                            .skip(1 as usize)
-                            .collect::<Vec<_>>(),
-                    )
-                    .iter()
-                    .cloned()
-                    .fold(
-                        Rc::new(PathTemplateParseResult::ParsedPathTemplate {
-                            template: Rc::new(PathTemplate {
-                                tokens: first_tokens.clone(),
-                            }),
-                        }),
-                        |acc: Rc<PathTemplateParseResult>, seg: String| match (*acc.clone()).clone()
-                        {
-                            PathTemplateParseResult::MalformedPathTemplate { .. } => acc.clone(),
-                            PathTemplateParseResult::ParsedPathTemplate {
-                                template: path, ..
-                            } => match (*parse_segment_tokens(seg.clone())).clone() {
-                                PathSegmentTokensResult::MalformedPathSegment {
-                                    segment: s,
-                                    reason: r,
-                                    ..
-                                } => Rc::new(PathTemplateParseResult::MalformedPathTemplate {
-                                    raw: raw.clone(),
-                                    segment: s.clone(),
-                                    reason: r.clone(),
+                    let parsed = Rc::new(v1_rt::list_skip(&segments.clone(), 1))
+                        .iter()
+                        .cloned()
+                        .fold(
+                            Rc::new(PathTemplateParseResult::ParsedPathTemplate {
+                                template: Rc::new(PathTemplate {
+                                    tokens: first_tokens.clone(),
                                 }),
-                                PathSegmentTokensResult::ParsedSegmentTokens {
-                                    tokens: seg_tokens,
+                            }),
+                            |acc: Rc<PathTemplateParseResult>, seg: String| match (*acc.clone())
+                                .clone()
+                            {
+                                PathTemplateParseResult::MalformedPathTemplate { .. } => {
+                                    acc.clone()
+                                }
+                                PathTemplateParseResult::ParsedPathTemplate {
+                                    template: path,
                                     ..
-                                } => Rc::new(PathTemplateParseResult::ParsedPathTemplate {
-                                    template: Rc::new(PathTemplate {
-                                        tokens: v1_rt::concat(
-                                            path.tokens.clone(),
-                                            seg_tokens.clone(),
-                                        ),
+                                } => match (*parse_segment_tokens(seg.clone())).clone() {
+                                    PathSegmentTokensResult::MalformedPathSegment {
+                                        segment: s,
+                                        reason: r,
+                                        ..
+                                    } => Rc::new(PathTemplateParseResult::MalformedPathTemplate {
+                                        raw: raw.clone(),
+                                        segment: s.clone(),
+                                        reason: r.clone(),
                                     }),
-                                }),
+                                    PathSegmentTokensResult::ParsedSegmentTokens {
+                                        tokens: seg_tokens,
+                                        ..
+                                    } => Rc::new(PathTemplateParseResult::ParsedPathTemplate {
+                                        template: Rc::new(PathTemplate {
+                                            tokens: v1_rt::concat(
+                                                path.tokens.clone(),
+                                                seg_tokens.clone(),
+                                            ),
+                                        }),
+                                    }),
+                                },
                             },
-                        },
-                    );
+                        );
                     parsed
                 }
             },
@@ -520,10 +485,8 @@ pub fn uri_query_string(path: String) -> String {
             .map(|s| s.to_string())
             .collect::<Vec<_>>(),
     )
-    .iter()
+    .get((1) as usize)
     .cloned()
-    .skip(1 as usize)
-    .next()
     {
         Some(q) => q.clone(),
         std::option::Option::None => "".to_string(),
@@ -560,10 +523,8 @@ pub fn uri_query_param(path: String, key: String) -> String {
                         .map(|s| s.to_string())
                         .collect::<Vec<_>>(),
                 )
-                .iter()
+                .get((1) as usize)
                 .cloned()
-                .skip(1 as usize)
-                .next()
                 {
                     Some(x) => x.clone(),
                     std::option::Option::None => "".to_string(),
diff --git a/src/v1/stage0/src/extdeps_version.rs b/src/v1/stage0/src/extdeps_version.rs
index c9fc71c64fc..66f7b5c8ee8 100644
--- a/src/v1/stage0/src/extdeps_version.rs
+++ b/src/v1/stage0/src/extdeps_version.rs
@@ -1,6 +1,8 @@
 // Generated by v1 compiler -- do not edit.
 // Source module: extdeps.version
 
+use self::ComparisonSide::*;
+use self::VersionComparison::*;
 pub use crate::extdeps_external_authority::ExternalAuthority;
 use crate::extdeps_uri::UriScheme::Https;
 pub use crate::extdeps_uri::{Uri, UriScheme};
@@ -31,9 +33,36 @@ pub fn extdeps_external_authority_anchor() -> Rc<ExternalAuthority> {
 
 pub type VersionIdentity = String;
 
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
+)]
+#[serde(tag = "_variant")]
+pub enum ComparisonSide {
+    LeftOperand,
+    RightOperand,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum VersionComparison {
+    VersionCompared {
+        ordering: Ordering,
+    },
+    VersionComparisonRefused {
+        side: ComparisonSide,
+        identity: String,
+        cause: String,
+    },
+}
+
 #[derive(Clone)]
 pub struct VersionScheme {
-    pub compare: Rc<dyn Fn(VersionIdentity, VersionIdentity) -> Ordering>,
+    pub compare: Rc<dyn Fn(VersionIdentity, VersionIdentity) -> Rc<VersionComparison>>,
 }
 
 pub type VersionConstraint = String;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct LeftOperand;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct RightOperand;
diff --git a/src/v1/stage0/src/extdeps_version_semver.rs b/src/v1/stage0/src/extdeps_version_semver.rs
index da6901c2ac6..962a3df984c 100644
--- a/src/v1/stage0/src/extdeps_version_semver.rs
+++ b/src/v1/stage0/src/extdeps_version_semver.rs
@@ -5,13 +5,15 @@ use self::SemVerIdentifier::*;
 pub use crate::extdeps_external_authority::ExternalAuthority;
 use crate::extdeps_uri::UriScheme::Https;
 pub use crate::extdeps_uri::{Uri, UriScheme};
-pub use crate::extdeps_version::{VersionConstraint, VersionIdentity, VersionScheme};
+use crate::extdeps_version::ComparisonSide::{LeftOperand, RightOperand};
+use crate::extdeps_version::VersionComparison::{VersionCompared, VersionComparisonRefused};
+pub use crate::extdeps_version::{
+    ComparisonSide, VersionComparison, VersionConstraint, VersionIdentity, VersionScheme,
+};
 pub use crate::std_algebra::trim;
 pub use crate::std_algebra::Ordering;
 use crate::std_algebra::Ordering::{Equal, Greater, Less};
-pub use crate::std_checked_arithmetic::checked_int_to_nat;
 pub use crate::std_integer::NonNegativeInt;
-pub use crate::std_nat::nat_compare;
 pub use crate::std_types::{List, NonEmptyStr};
 use crate::v1_rt;
 use crate::v1_rt::{VecCompat, VecJoin};
@@ -38,37 +40,140 @@ pub type SemVerIdentity = NonEmptyStr;
 
 pub type SemVerConstraint = NonEmptyStr;
 
-#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[derive(Debug, Clone, PartialEq, serde::Serialize)]
+pub struct SemVerNumericField {
+    digits: Rc<Vec<i64>>,
+}
+impl SemVerNumericField {
+    pub fn digits(&self) -> Rc<Vec<i64>> {
+        self.digits.clone()
+    }
+}
+
+pub fn semver_numeric_field(cps: Rc<Vec<i64>>) -> Option<Rc<SemVerNumericField>> {
+    if ((cps.clone().len() as i64) == 0) {
+        std::option::Option::None
+    } else {
+        if !{
+            let mut __all = true;
+            for cp in cps.iter().cloned() {
+                if !((cp.clone() >= 48) && (cp.clone() <= 57)) {
+                    __all = false;
+                    break;
+                }
+            }
+            __all
+        } {
+            std::option::Option::None
+        } else {
+            if ((cps.clone().len() as i64) > 1) {
+                match cps.clone().first().cloned() {
+                    Some(48) => std::option::Option::None,
+                    Some(_) => Some(Rc::new(SemVerNumericField {
+                        digits: cps.clone(),
+                    })),
+                    std::option::Option::None => std::option::Option::None,
+                }
+            } else {
+                Some(Rc::new(SemVerNumericField {
+                    digits: cps.clone(),
+                }))
+            }
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize)]
 #[serde(tag = "_variant")]
 pub enum SemVerIdentifier {
-    SemVerNumericIdentifier { value: NonNegativeInt },
+    SemVerNumericIdentifier { digits: Rc<SemVerNumericField> },
     SemVerAlphanumericIdentifier { label: NonEmptyStr },
 }
 
-#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[derive(Debug, Clone, PartialEq, serde::Serialize)]
 pub struct SemVerVersion {
-    pub major: NonNegativeInt,
-    pub minor: NonNegativeInt,
-    pub patch: NonNegativeInt,
+    pub major: Rc<SemVerNumericField>,
+    pub minor: Rc<SemVerNumericField>,
+    pub patch: Rc<SemVerNumericField>,
     pub pre_release: Rc<Vec<Rc<SemVerIdentifier>>>,
     pub build: Rc<Vec<Rc<SemVerIdentifier>>>,
 }
 
-pub fn semver_compare_non_negative_int(a: NonNegativeInt, b: NonNegativeInt) -> Ordering {
-    crate::std_nat::nat_compare(a.clone(), b.clone())
+pub fn semver_compare_numeric_digits(
+    a: Rc<SemVerNumericField>,
+    b: Rc<SemVerNumericField>,
+) -> Ordering {
+    semver_compare_digit_runs(a.digits(), b.digits())
+}
+
+pub fn semver_compare_digit_runs(a: Rc<Vec<i64>>, b: Rc<Vec<i64>>) -> Ordering {
+    if ((a.clone().len() as i64) < (b.clone().len() as i64)) {
+        Ordering::Less
+    } else {
+        if ((a.clone().len() as i64) > (b.clone().len() as i64)) {
+            Ordering::Greater
+        } else {
+            semver_compare_digits_lexical(a.clone(), b.clone())
+        }
+    }
+}
+
+pub fn semver_compare_digits_lexical(
+    mut __tco_loop_a: Rc<Vec<i64>>,
+    mut __tco_loop_b: Rc<Vec<i64>>,
+) -> Ordering {
+    loop {
+        #[allow(unused_mut)]
+        let mut a = __tco_loop_a;
+        #[allow(unused_mut)]
+        let mut b = __tco_loop_b;
+        if ((a.clone().len() as i64) == 0) {
+            break Ordering::Equal;
+        } else {
+            match a.clone().first().cloned() {
+                Some(ac) => match b.clone().first().cloned() {
+                    Some(bc) => {
+                        if (ac.clone() < bc.clone()) {
+                            break Ordering::Less;
+                        } else {
+                            if (ac.clone() > bc.clone()) {
+                                break Ordering::Greater;
+                            } else {
+                                {
+                                    let __tco_0 = Rc::new(v1_rt::list_skip(&a, 1));
+                                    let __tco_1 = Rc::new(v1_rt::list_skip(&b, 1));
+                                    __tco_loop_a = __tco_0;
+                                    __tco_loop_b = __tco_1;
+                                    continue;
+                                }
+                            }
+                        }
+                    }
+                    std::option::Option::None => {
+                        break Ordering::Greater;
+                    }
+                },
+                std::option::Option::None => {
+                    break Ordering::Less;
+                }
+            }
+        }
+    }
 }
 
 pub fn semver_compare_identifier(a: Rc<SemVerIdentifier>, b: Rc<SemVerIdentifier>) -> Ordering {
     match (*a.clone()).clone() {
-        SemVerIdentifier::SemVerNumericIdentifier { value: av, .. } => match (*b.clone()).clone() {
-            SemVerIdentifier::SemVerNumericIdentifier { value: bv, .. } => {
-                semver_compare_non_negative_int(av.clone(), bv.clone())
+        SemVerIdentifier::SemVerNumericIdentifier { digits: ad, .. } => {
+            match (*b.clone()).clone() {
+                SemVerIdentifier::SemVerNumericIdentifier { digits: bd, .. } => {
+                    semver_compare_numeric_digits(ad.clone(), bd.clone())
+                }
+                SemVerIdentifier::SemVerAlphanumericIdentifier { label: _, .. } => Ordering::Less,
             }
-            SemVerIdentifier::SemVerAlphanumericIdentifier { label: _, .. } => Ordering::Less,
-        },
+        }
         SemVerIdentifier::SemVerAlphanumericIdentifier { label: al, .. } => {
             match (*b.clone()).clone() {
-                SemVerIdentifier::SemVerNumericIdentifier { value: _, .. } => Ordering::Greater,
+                SemVerIdentifier::SemVerNumericIdentifier { digits: _, .. } => Ordering::Greater,
                 SemVerIdentifier::SemVerAlphanumericIdentifier { label: bl, .. } => {
                     if (al.clone() < bl.clone()) {
                         Ordering::Less
@@ -107,12 +212,8 @@ pub fn semver_compare_identifiers(
                         Some(ah) => match b.clone().first().cloned() {
                             Some(bh) => match semver_compare_identifier(ah.clone(), bh.clone()) {
                                 Ordering::Equal => {
-                                    let __tco_0 = Rc::new(
-                                        a.iter().cloned().skip(1 as usize).collect::<Vec<_>>(),
-                                    );
-                                    let __tco_1 = Rc::new(
-                                        b.iter().cloned().skip(1 as usize).collect::<Vec<_>>(),
-                                    );
+                                    let __tco_0 = Rc::new(v1_rt::list_skip(&a, 1));
+                                    let __tco_1 = Rc::new(v1_rt::list_skip(&b, 1));
                                     __tco_loop_a = __tco_0;
                                     __tco_loop_b = __tco_1;
                                     continue;
@@ -155,20 +256,18 @@ pub fn semver_compare_pre_release(
 }
 
 pub fn semver_compare(a: Rc<SemVerVersion>, b: Rc<SemVerVersion>) -> Ordering {
-    match semver_compare_non_negative_int(a.major.clone(), b.major.clone()) {
-        Ordering::Equal => {
-            match semver_compare_non_negative_int(a.minor.clone(), b.minor.clone()) {
-                Ordering::Equal => {
-                    match semver_compare_non_negative_int(a.patch.clone(), b.patch.clone()) {
-                        Ordering::Equal => {
-                            semver_compare_pre_release(a.pre_release.clone(), b.pre_release.clone())
-                        }
-                        other => other.clone(),
+    match semver_compare_numeric_digits(a.major.clone(), b.major.clone()) {
+        Ordering::Equal => match semver_compare_numeric_digits(a.minor.clone(), b.minor.clone()) {
+            Ordering::Equal => {
+                match semver_compare_numeric_digits(a.patch.clone(), b.patch.clone()) {
+                    Ordering::Equal => {
+                        semver_compare_pre_release(a.pre_release.clone(), b.pre_release.clone())
                     }
+                    other => other.clone(),
                 }
-                other => other.clone(),
             }
-        }
+            other => other.clone(),
+        },
         other => other.clone(),
     }
 }
@@ -190,13 +289,21 @@ pub fn semver_core_of_dotted(text: String) -> Option<Rc<SemVerVersion>> {
                     std::option::Option::None => std::option::Option::None,
                     Some(minor) => {
                         if ((parts.clone().len() as i64) == 2) {
-                            Some(Rc::new(SemVerVersion {
-                                major: major.clone(),
-                                minor: minor.clone(),
-                                patch: 0,
-                                pre_release: Rc::new(vec![]),
-                                build: Rc::new(vec![]),
-                            }))
+                            match semver_numeric_field(Rc::new(
+                                "0".to_string()
+                                    .chars()
+                                    .map(|c| c as i64)
+                                    .collect::<Vec<_>>(),
+                            )) {
+                                std::option::Option::None => std::option::Option::None,
+                                Some(zero) => Some(Rc::new(SemVerVersion {
+                                    major: major.clone(),
+                                    minor: minor.clone(),
+                                    patch: zero.clone(),
+                                    pre_release: Rc::new(vec![]),
+                                    build: Rc::new(vec![]),
+                                })),
+                            }
                         } else {
                             match semver_dotted_part(parts.clone(), 2) {
                                 std::option::Option::None => std::option::Option::None,
@@ -216,19 +323,12 @@ pub fn semver_core_of_dotted(text: String) -> Option<Rc<SemVerVersion>> {
     }
 }
 
-pub fn semver_dotted_part(parts: Rc<Vec<String>>, index: i64) -> Option<NonNegativeInt> {
-    match parts
-        .clone()
-        .iter()
-        .cloned()
-        .skip(index.clone() as usize)
-        .next()
-    {
+pub fn semver_dotted_part(parts: Rc<Vec<String>>, index: i64) -> Option<Rc<SemVerNumericField>> {
+    match parts.clone().get((index.clone()) as usize).cloned() {
         std::option::Option::None => std::option::Option::None,
-        Some(w) => match v1_rt::parse_int(w.clone()) {
-            std::option::Option::None => std::option::Option::None,
-            Some(n) => crate::std_checked_arithmetic::checked_int_to_nat(n.clone()),
-        },
+        Some(w) => semver_numeric_field(Rc::new(
+            w.clone().chars().map(|c| c as i64).collect::<Vec<_>>(),
+        )),
     }
 }
 
@@ -245,7 +345,9 @@ pub fn semver_minimum_of_constraint(constraint: NonEmptyStr) -> Option<Rc<SemVer
 
 pub fn semver_identifier_label(id: Rc<SemVerIdentifier>) -> String {
     match (*id.clone()).clone() {
-        SemVerIdentifier::SemVerNumericIdentifier { value: v, .. } => format!("{}", v.clone()),
+        SemVerIdentifier::SemVerNumericIdentifier { digits: d, .. } => {
+            semver_label_from_code_points(d.digits())
+        }
         SemVerIdentifier::SemVerAlphanumericIdentifier { label: s, .. } => s.clone(),
     }
 }
@@ -264,12 +366,15 @@ pub fn semver_identifiers_label(ids: Rc<Vec<Rc<SemVerIdentifier>>>) -> String {
 pub fn semver_version_label(v: Rc<SemVerVersion>) -> String {
     {
         let core = v1_rt::concat(
-            (v.major.clone()).to_string(),
+            semver_label_from_code_points(v.major.clone().digits()),
             v1_rt::concat(
                 ".".to_string(),
                 v1_rt::concat(
-                    (v.minor.clone()).to_string(),
-                    v1_rt::concat(".".to_string(), (v.patch.clone()).to_string()),
+                    semver_label_from_code_points(v.minor.clone().digits()),
+                    v1_rt::concat(
+                        ".".to_string(),
+                        semver_label_from_code_points(v.patch.clone().digits()),
+                    ),
                 ),
             ),
         );
@@ -299,15 +404,320 @@ pub fn semver_to_version_identity(v: Rc<SemVerVersion>) -> NonEmptyStr {
     semver_version_label(v.clone())
 }
 
-pub fn semver_identity_compare(a: NonEmptyStr, b: NonEmptyStr) -> Ordering {
-    if (a.clone() == b.clone()) {
-        Ordering::Equal
+pub fn semver_identity_compare(a: NonEmptyStr, b: NonEmptyStr) -> Rc<VersionComparison> {
+    match semver_identity_parse(a.clone()) {
+    Some(av) => match semver_identity_parse(b.clone()) {
+    Some(bv) => Rc::new(VersionComparison::VersionCompared {
+    ordering: semver_compare(av.clone(), bv.clone()),
+}),
+    std::option::Option::None => Rc::new(VersionComparison::VersionComparisonRefused {
+    side: ComparisonSide::RightOperand,
+    identity: b.clone(),
+    cause: "label does not satisfy the SemVer 2.0.0 version grammar, so section 11 precedence is undefined for it".to_string(),
+}),
+},
+    std::option::Option::None => Rc::new(VersionComparison::VersionComparisonRefused {
+    side: ComparisonSide::LeftOperand,
+    identity: a.clone(),
+    cause: "label does not satisfy the SemVer 2.0.0 version grammar, so section 11 precedence is undefined for it".to_string(),
+}),
+}
+}
+
+pub fn semver_identity_code_points(label: NonEmptyStr) -> Rc<Vec<i64>> {
+    Rc::new(label.clone().chars().map(|c| c as i64).collect::<Vec<_>>())
+}
+
+pub fn semver_is_ascii_digit(cp: i64) -> bool {
+    ((cp.clone() >= 48) && (cp.clone() <= 57))
+}
+
+pub fn semver_is_ascii_letter(cp: i64) -> bool {
+    (((cp.clone() >= 65) && (cp.clone() <= 90)) || ((cp.clone() >= 97) && (cp.clone() <= 122)))
+}
+
+pub fn semver_is_identifier_char(cp: i64) -> bool {
+    ((semver_is_ascii_digit(cp.clone()) || semver_is_ascii_letter(cp.clone()))
+        || (cp.clone() == 45))
+}
+
+pub fn semver_index_of(cp: i64, cps: Rc<Vec<i64>>) -> Option<i64> {
+    stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, || {
+        if ((cps.clone().len() as i64) == 0) {
+            std::option::Option::None
+        } else {
+            match cps.clone().first().cloned() {
+                Some(h) => {
+                    if (h.clone() == cp.clone()) {
+                        Some(0)
+                    } else {
+                        match semver_index_of(
+                            cp.clone(),
+                            Rc::new(v1_rt::list_skip(&cps.clone(), 1)),
+                        ) {
+                            Some(k) => Some(v1_rt::int_add(k.clone(), 1)),
+                            std::option::Option::None => std::option::Option::None,
+                        }
+                    }
+                }
+                std::option::Option::None => std::option::Option::None,
+            }
+        }
+    })
+}
+
+pub fn semver_split_on(
+    mut __tco_loop_cp: i64,
+    mut __tco_loop_cps: Rc<Vec<i64>>,
+    mut __tco_loop_acc: Rc<Vec<Rc<Vec<i64>>>>,
+) -> Rc<Vec<Rc<Vec<i64>>>> {
+    loop {
+        #[allow(unused_mut)]
+        let mut cp = __tco_loop_cp;
+        #[allow(unused_mut)]
+        let mut cps = __tco_loop_cps;
+        #[allow(unused_mut)]
+        let mut acc = __tco_loop_acc;
+        match semver_index_of(cp.clone(), cps.clone()) {
+            Some(i) => {
+                let __tco_0 = cp;
+                let __tco_1 = Rc::new(v1_rt::list_skip(&cps.clone(), v1_rt::int_add(i.clone(), 1)));
+                let __tco_2 = v1_rt::concat(
+                    acc,
+                    Rc::new(vec![Rc::new(v1_rt::list_take(&cps.clone(), i.clone()))]),
+                );
+                __tco_loop_cp = __tco_0;
+                __tco_loop_cps = __tco_1;
+                __tco_loop_acc = __tco_2;
+                continue;
+            }
+            std::option::Option::None => {
+                break v1_rt::concat(acc.clone(), Rc::new(vec![cps.clone()]));
+            }
+        }
+    }
+}
+
+pub fn semver_all_digits(cps: Rc<Vec<i64>>) -> bool {
+    (((cps.clone().len() as i64) > 0) && {
+        let mut __all = true;
+        for cp in cps.iter().cloned() {
+            if !(semver_is_ascii_digit(cp.clone())) {
+                __all = false;
+                break;
+            }
+        }
+        __all
+    })
+}
+
+pub fn semver_numeric_run_without_leading_zero(cps: Rc<Vec<i64>>) -> bool {
+    if !semver_all_digits(cps.clone()) {
+        false
     } else {
-        if (a.clone() < b.clone()) {
-            Ordering::Less
+        match cps.clone().first().cloned() {
+            Some(h) => (((cps.clone().len() as i64) == 1) || (h.clone() != 48)),
+            std::option::Option::None => false,
+        }
+    }
+}
+
+pub fn semver_label_from_code_points(cps: Rc<Vec<i64>>) -> String {
+    Rc::new({
+        let mut __result = Vec::new();
+        for cp in cps.iter().cloned() {
+            __result.push(v1_rt::from_code_point(cp.clone()));
+        }
+        __result
+    })
+    .join(&"".to_string())
+}
+
+pub fn semver_core_fields_parse(
+    cps: Rc<Vec<i64>>,
+    remaining: i64,
+) -> Option<Rc<Vec<Rc<SemVerNumericField>>>> {
+    stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, || {
+        if (remaining.clone() == 0) {
+            if ((cps.clone().len() as i64) == 0) {
+                Some(Rc::new(vec![]))
+            } else {
+                std::option::Option::None
+            }
         } else {
-            Ordering::Greater
+            if (remaining.clone() == 1) {
+                match semver_numeric_field(cps.clone()) {
+                    std::option::Option::None => std::option::Option::None,
+                    Some(v) => Some(Rc::new(vec![v.clone()])),
+                }
+            } else {
+                match semver_index_of(46, cps.clone()) {
+                    Some(i) => match semver_numeric_field(Rc::new(v1_rt::list_take(
+                        &cps.clone(),
+                        i.clone(),
+                    ))) {
+                        std::option::Option::None => std::option::Option::None,
+                        Some(v) => match semver_core_fields_parse(
+                            Rc::new(v1_rt::list_skip(&cps.clone(), v1_rt::int_add(i.clone(), 1))),
+                            v1_rt::int_sub(remaining.clone(), 1),
+                        ) {
+                            std::option::Option::None => std::option::Option::None,
+                            Some(rest) => {
+                                Some(v1_rt::concat(Rc::new(vec![v.clone()]), rest.clone()))
+                            }
+                        },
+                    },
+                    std::option::Option::None => std::option::Option::None,
+                }
+            }
         }
+    })
+}
+
+pub fn semver_core_parse(cps: Rc<Vec<i64>>) -> Option<Rc<SemVerVersion>> {
+    match semver_core_fields_parse(cps.clone(), 3) {
+        std::option::Option::None => std::option::Option::None,
+        Some(fields) => {
+            if ((fields.clone().len() as i64) != 3) {
+                std::option::Option::None
+            } else {
+                match fields.clone().first().cloned() {
+                    std::option::Option::None => std::option::Option::None,
+                    Some(major) => match fields.clone().get((1) as usize).cloned() {
+                        std::option::Option::None => std::option::Option::None,
+                        Some(minor) => match fields.clone().get((2) as usize).cloned() {
+                            std::option::Option::None => std::option::Option::None,
+                            Some(patch) => Some(Rc::new(SemVerVersion {
+                                major: major.clone(),
+                                minor: minor.clone(),
+                                patch: patch.clone(),
+                                pre_release: Rc::new(vec![]),
+                                build: Rc::new(vec![]),
+                            })),
+                        },
+                    },
+                }
+            }
+        }
+    }
+}
+
+pub fn semver_identifier_parse(
+    cps: Rc<Vec<i64>>,
+    strict_numeric: bool,
+) -> Option<Rc<SemVerIdentifier>> {
+    if ((cps.clone().len() as i64) == 0) {
+        std::option::Option::None
+    } else {
+        if !{
+            let mut __all = true;
+            for cp in cps.iter().cloned() {
+                if !(semver_is_identifier_char(cp.clone())) {
+                    __all = false;
+                    break;
+                }
+            }
+            __all
+        } {
+            std::option::Option::None
+        } else {
+            if semver_numeric_run_without_leading_zero(cps.clone()) {
+                match semver_numeric_field(cps.clone()) {
+                    Some(f) => Some(Rc::new(SemVerIdentifier::SemVerNumericIdentifier {
+                        digits: f.clone(),
+                    })),
+                    std::option::Option::None => std::option::Option::None,
+                }
+            } else {
+                if (strict_numeric.clone() && semver_all_digits(cps.clone())) {
+                    std::option::Option::None
+                } else {
+                    Some(Rc::new(SemVerIdentifier::SemVerAlphanumericIdentifier {
+                        label: semver_label_from_code_points(cps.clone()),
+                    }))
+                }
+            }
+        }
+    }
+}
+
+pub fn semver_identifier_list_parse(
+    segments: Rc<Vec<Rc<Vec<i64>>>>,
+    strict_numeric: bool,
+) -> Option<Rc<Vec<Rc<SemVerIdentifier>>>> {
+    segments
+        .iter()
+        .cloned()
+        .fold(Some(Rc::new(vec![])), |st: _, seg: Rc<Vec<i64>>| {
+            match st.clone() {
+                std::option::Option::None => std::option::Option::None,
+                Some(acc) => match semver_identifier_parse(seg.clone(), strict_numeric.clone()) {
+                    std::option::Option::None => std::option::Option::None,
+                    Some(id) => Some(v1_rt::concat(acc.clone(), Rc::new(vec![id.clone()]))),
+                },
+            }
+        })
+}
+
+pub fn semver_pre_release_parse(cps: Rc<Vec<i64>>) -> Option<Rc<Vec<Rc<SemVerIdentifier>>>> {
+    semver_identifier_list_parse(semver_split_on(46, cps.clone(), Rc::new(vec![])), true)
+}
+
+pub fn semver_build_parse(cps: Rc<Vec<i64>>) -> Option<Rc<Vec<Rc<SemVerIdentifier>>>> {
+    semver_identifier_list_parse(semver_split_on(46, cps.clone(), Rc::new(vec![])), false)
+}
+
+pub fn semver_identity_head_parse(
+    cps: Rc<Vec<i64>>,
+    build: Rc<Vec<Rc<SemVerIdentifier>>>,
+) -> Option<Rc<SemVerVersion>> {
+    match semver_index_of(45, cps.clone()) {
+        Some(pi) => match semver_core_parse(Rc::new(v1_rt::list_take(&cps.clone(), pi.clone()))) {
+            std::option::Option::None => std::option::Option::None,
+            Some(core) => match semver_pre_release_parse(Rc::new(v1_rt::list_skip(
+                &cps.clone(),
+                v1_rt::int_add(pi.clone(), 1),
+            ))) {
+                std::option::Option::None => std::option::Option::None,
+                Some(pre) => Some(Rc::new(SemVerVersion {
+                    major: core.major.clone(),
+                    minor: core.minor.clone(),
+                    patch: core.patch.clone(),
+                    pre_release: pre.clone(),
+                    build: build.clone(),
+                })),
+            },
+        },
+        std::option::Option::None => match semver_core_parse(cps.clone()) {
+            std::option::Option::None => std::option::Option::None,
+            Some(core) => Some(Rc::new(SemVerVersion {
+                major: core.major.clone(),
+                minor: core.minor.clone(),
+                patch: core.patch.clone(),
+                pre_release: Rc::new(vec![]),
+                build: build.clone(),
+            })),
+        },
+    }
+}
+
+pub fn semver_identity_parse(label: NonEmptyStr) -> Option<Rc<SemVerVersion>> {
+    semver_version_parse(semver_identity_code_points(label.clone()))
+}
+
+pub fn semver_version_parse(cps: Rc<Vec<i64>>) -> Option<Rc<SemVerVersion>> {
+    match semver_index_of(43, cps.clone()) {
+        Some(bi) => match semver_build_parse(Rc::new(v1_rt::list_skip(
+            &cps.clone(),
+            v1_rt::int_add(bi.clone(), 1),
+        ))) {
+            std::option::Option::None => std::option::Option::None,
+            Some(build) => semver_identity_head_parse(
+                Rc::new(v1_rt::list_take(&cps.clone(), bi.clone())),
+                build.clone(),
+            ),
+        },
+        std::option::Option::None => semver_identity_head_parse(cps.clone(), Rc::new(vec![])),
     }
 }
 
diff --git a/src/v1/stage0/src/gunbc_cli_dispatch_generated.rs b/src/v1/stage0/src/gunbc_cli_dispatch_generated.rs
index d837f9e9a8d..6c5b7b12fd2 100644
--- a/src/v1/stage0/src/gunbc_cli_dispatch_generated.rs
+++ b/src/v1/stage0/src/gunbc_cli_dispatch_generated.rs
@@ -62,7 +62,7 @@ pub enum Commands {
         #[arg(long)]
         claim_run: bool,
         /// Named argument for the entry function, repeatable: `--arg name=value`.
-        /// Values enter as String; a missing `=` refuses rather than guessing.
+        /// Bound against the parameter's resolved type identity: kernel String, Int, and Bool, and std.types NonEmptyStr (String where string_non_empty). Other types refuse.
         #[arg(long = "arg")]
         args: Vec<String>,
     },
@@ -93,11 +93,11 @@ pub enum Commands {
         /// Fnv1a64Structural bundle digest printed by the plan; required for --mode apply
         #[arg(long, default_value = "")]
         plan_hash: String,
-        /// Spark target host (srv5 | srv6); required for scope:spark-serving, refused elsewhere
+        /// Spark target host; required for scope:spark-serving, refused elsewhere
         #[arg(long, default_value = "")]
         target: String,
-        /// Branch the checkout must be on for --mode deploy; the candidate is HEAD of this checkout
-        #[arg(long, default_value = "main")]
+        /// If set, the checkout must be on this branch for --mode deploy; empty admits HEAD's branch
+        #[arg(long, default_value = "")]
         candidate_branch: String,
     },
     /// Long-running HTTP server: compile once, then answer each request by
diff --git a/src/v1/stage0/src/gunbc_cli_dispatch_surface.rs b/src/v1/stage0/src/gunbc_cli_dispatch_surface.rs
index 74b95589a8f..89af1c6eb3b 100644
--- a/src/v1/stage0/src/gunbc_cli_dispatch_surface.rs
+++ b/src/v1/stage0/src/gunbc_cli_dispatch_surface.rs
@@ -563,7 +563,7 @@ pub fn gunbc_cli_subcommands() -> Rc<Vec<Rc<CliSubcommandRow>>> {
     text_default: std::option::Option::None,
 }),
     arity: CliOptionArity::CliRepeated,
-    doc: Rc::new(vec!["Named argument for the entry function, repeatable: `--arg name=value`.".to_string(), "Values enter as String; a missing `=` refuses rather than guessing.".to_string()]),
+    doc: Rc::new(vec!["Named argument for the entry function, repeatable: `--arg name=value`.".to_string(), "Bound against the parameter's resolved type identity: kernel String, Int, and Bool, and std.types NonEmptyStr (String where string_non_empty). Other types refuse.".to_string()]),
     emission: CliSurfaceEmission::CarriedByGeneratedDispatch,
 })]),
     realization: Rc::new(CliArmRealization::CliDelegatesToHostFn {
@@ -644,16 +644,16 @@ pub fn gunbc_cli_subcommands() -> Rc<Vec<Rc<CliSubcommandRow>>> {
     text_default: Some("".to_string()),
 }),
     arity: CliOptionArity::CliRequired,
-    doc: Rc::new(vec!["Spark target host (srv5 | srv6); required for scope:spark-serving, refused elsewhere".to_string()]),
+    doc: Rc::new(vec!["Spark target host; required for scope:spark-serving, refused elsewhere".to_string()]),
     emission: CliSurfaceEmission::CarriedByGeneratedDispatch,
 }), Rc::new(CliOptionRow {
     field: "candidate_branch".to_string(),
     long: "candidate-branch".to_string(),
     value: Rc::new(CliOptionValue::CliTextValue {
-    text_default: Some("main".to_string()),
+    text_default: Some("".to_string()),
 }),
     arity: CliOptionArity::CliRequired,
-    doc: Rc::new(vec!["Branch the checkout must be on for --mode deploy; the candidate is HEAD of this checkout".to_string()]),
+    doc: Rc::new(vec!["If set, the checkout must be on this branch for --mode deploy; empty admits HEAD's branch".to_string()]),
     emission: CliSurfaceEmission::CarriedByGeneratedDispatch,
 })]),
     realization: Rc::new(CliArmRealization::CliInvokesBootstrapDagOperation {
diff --git a/src/v1/stage0/src/gunbc_crate_partition.rs b/src/v1/stage0/src/gunbc_crate_partition.rs
new file mode 100644
index 00000000000..33e992a34e7
--- /dev/null
+++ b/src/v1/stage0/src/gunbc_crate_partition.rs
@@ -0,0 +1,1016 @@
+// Generated by v1 compiler -- do not edit.
+// Source module: gunbc.crate_partition
+
+use self::DerivedDepPackages::*;
+use self::EmittedEdgeRefusal::*;
+use self::EmittedEdgesMerge::*;
+use self::PartitionFoldRefusalCause::*;
+use self::PartitionParameter::*;
+use self::PartitionProvenance::*;
+use self::PartitionR4ValidityCause::*;
+use self::PartitionR4ValidityVerdict::*;
+use self::ResolvePartitionOutcome::*;
+use self::ResolvePartitionRefusalCause::*;
+use self::Stage0PartitionCrateKind::*;
+use crate::gunbc_rust_emitted_edge::EmittedEdgeProvenance::*;
+use crate::gunbc_rust_emitted_edge::EmittedEdgeTarget::{
+    EmittedCrateRootTarget, EmittedModuleTarget,
+};
+pub use crate::gunbc_rust_emitted_edge::{EmittedEdge, EmittedEdgeProvenance, EmittedEdgeTarget};
+use crate::std_decl_ref::DeclField::WholeDeclaration;
+pub use crate::std_decl_ref::{DeclField, DeclarationRef};
+pub use crate::std_graph::{
+    graph_has_multi_node_scc, graph_reverse_reachable_members, graph_strongly_connected_components,
+};
+pub use crate::std_graph::{CallGraph, GraphEdge};
+pub use crate::std_optional::optional_present;
+pub use crate::std_optional::Optional;
+pub use crate::std_types::brand;
+pub use crate::std_types::{Bool, List, NonEmptyStr};
+use crate::v1_rt;
+use crate::v1_rt::{VecCompat, VecJoin};
+use crate::NonEmptyBTreeSet;
+use crate::NonEmptyVec;
+use im::{vector as vec, HashMap, OrdSet as BTreeSet, Vector as Vec};
+use std::rc::Rc;
+
+pub type ModuleId = String;
+
+pub type CompilationUnitId = String;
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct ModuleDagEdge {
+    pub from: ModuleId,
+    pub to: ModuleId,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum PartitionProvenance {
+    HandExplicit,
+    PolicyDerived { policy: Rc<DeclarationRef> },
+}
+impl PartitionProvenance {
+    pub fn policy(&self) -> Rc<DeclarationRef> {
+        match self {
+            PartitionProvenance::HandExplicit => panic!("no policy on unit variant"),
+            PartitionProvenance::PolicyDerived { policy: __val, .. } => __val.clone(),
+        }
+    }
+}
+
+pub fn partition_provenance_hand_explicit() -> Rc<PartitionProvenance> {
+    Rc::new(PartitionProvenance::HandExplicit)
+}
+
+pub fn partition_provenance_policy_derived(policy: Rc<DeclarationRef>) -> Rc<PartitionProvenance> {
+    Rc::new(PartitionProvenance::PolicyDerived {
+        policy: policy.clone(),
+    })
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum PartitionFoldRefusalCause {
+    InterfaceClosureUnreachedFixpoint { unit_id: CompilationUnitId },
+    ModuleDagExportsLookupRejected { module: ModuleId },
+    ModuleDagTypeDefinitionsLookupRejected { module: ModuleId },
+    ModuleAssignmentLookupRejected { module: ModuleId },
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum PartitionR4ValidityCause {
+    SccSplit {
+        detail: String,
+    },
+    UnitGraphCycle {
+        detail: String,
+    },
+    LinkageCycle {
+        detail: String,
+    },
+    ByValueTypeCycle {
+        detail: String,
+    },
+    PartitionInputRejected {
+        cause: Rc<PartitionFoldRefusalCause>,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum PartitionR4ValidityVerdict {
+    PartitionR4Valid,
+    PartitionR4Refused { cause: Rc<PartitionR4ValidityCause> },
+}
+impl PartitionR4ValidityVerdict {
+    pub fn cause(&self) -> Rc<PartitionR4ValidityCause> {
+        match self {
+            PartitionR4ValidityVerdict::PartitionR4Valid => panic!("no cause on unit variant"),
+            PartitionR4ValidityVerdict::PartitionR4Refused { cause: __val, .. } => __val.clone(),
+        }
+    }
+}
+
+pub fn list_unique_sorted_ids(items: Rc<Vec<NonEmptyStr>>) -> Rc<Vec<NonEmptyStr>> {
+    Rc::new({
+        let mut __sorted: Vec<_> = items.iter().cloned().collect();
+        __sorted.sort_by(|a: &NonEmptyStr, b: &NonEmptyStr| {
+            let __ka = (|id: NonEmptyStr| id.clone())(a.clone());
+            let __kb = (|id: NonEmptyStr| id.clone())(b.clone());
+            v1_rt::canonical_key_cmp(&__ka, &__kb)
+        });
+        __sorted
+    })
+    .iter()
+    .cloned()
+    .fold(
+        Rc::new(vec![]),
+        |unique: Rc<Vec<NonEmptyStr>>, item: NonEmptyStr| match unique.clone().last().cloned() {
+            Some(prior) => {
+                if (prior.clone() == item.clone()) {
+                    unique.clone()
+                } else {
+                    v1_rt::rc_list_push(unique.clone(), item.clone())
+                }
+            }
+            std::option::Option::None => Rc::new(vec![item.clone()]),
+        },
+    )
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct PartitionPolicy {
+    pub target_crate_count: i64,
+}
+
+pub fn crate_partition_declared_core_target() -> i64 {
+    7
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct ExplicitPartition {
+    pub assignment: Rc<HashMap<ModuleId, CompilationUnitId>>,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum PartitionParameter {
+    ExplicitPartitionParam { partition: Rc<ExplicitPartition> },
+    PolicyPartitionParam { policy: PartitionPolicy },
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum EmittedEdgeRefusal {
+    EmitterReverseEdge {
+        from: ModuleId,
+        to: ModuleId,
+        provenance: EmittedEdgeProvenance,
+    },
+    EmittedEdgeEndpointOutsideDag {
+        from: String,
+        to: String,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum ResolvePartitionRefusalCause {
+    PolicyTargetCountNotPositive { policy: PartitionPolicy },
+    AssignmentOmitsModule { module_id: ModuleId },
+    AssignmentNamesModuleOutsideDag { module_id: ModuleId },
+    PartitionRustAdmissibilityRefused { cause: Rc<PartitionR4ValidityCause> },
+    PartitionEmittedEdgeRefused { cause: Rc<EmittedEdgeRefusal> },
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum ResolvePartitionOutcome {
+    ResolvePartitionOk {
+        assignment: Rc<HashMap<ModuleId, CompilationUnitId>>,
+        provenance: Rc<PartitionProvenance>,
+    },
+    ResolvePartitionRefused {
+        cause: Rc<ResolvePartitionRefusalCause>,
+    },
+}
+
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
+)]
+#[serde(tag = "_variant")]
+pub enum Stage0PartitionCrateKind {
+    Stage0FoundationCrate,
+    Stage0LayeredCoreCrate,
+    Stage0EmitCoreCrate,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct Stage0PartitionCrateRow {
+    pub unit_id: CompilationUnitId,
+    pub package_name: String,
+    pub crate_dir: String,
+    pub kind: Stage0PartitionCrateKind,
+    pub modules: Rc<Vec<String>>,
+    pub reexport_packages: Rc<Vec<String>>,
+    pub carries_non_empty_wrappers: bool,
+}
+
+pub fn stage0_module_id(basename: String) -> NonEmptyStr {
+    basename.clone()
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum EmittedEdgesMerge {
+    EmittedEdgesMerged { edges: Rc<Vec<Rc<ModuleDagEdge>>> },
+    EmittedEdgesRefused { cause: Rc<EmittedEdgeRefusal> },
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct EmittedEdgeMergeFold {
+    pub edges: Rc<Vec<Rc<ModuleDagEdge>>>,
+    pub present: Rc<HashMap<String, bool>>,
+    pub refusal: Option<Rc<EmittedEdgeRefusal>>,
+}
+
+pub fn module_dag_edge_key(from: String, to: String) -> String {
+    v1_rt::concat(from.clone(), v1_rt::concat(" -> ".to_string(), to.clone()))
+}
+
+pub fn string_member(set: Rc<HashMap<String, bool>>, key: String) -> bool {
+    match v1_rt::map_get(&set, key.clone()) {
+        Some(_) => true,
+        std::option::Option::None => false,
+    }
+}
+
+pub fn reached_set(
+    names: Rc<Vec<String>>,
+    graph: Rc<CallGraph>,
+    start: String,
+) -> Rc<HashMap<String, bool>> {
+    crate::std_graph::graph_reverse_reachable_members(names.clone(), graph.clone(), start.clone())
+        .iter()
+        .cloned()
+        .fold(
+            v1_rt::rc_empty_map::<String, bool>(),
+            |reached: Rc<HashMap<String, bool>>, member: String| {
+                v1_rt::rc_map_insert(reached, member.clone(), true)
+            },
+        )
+}
+
+pub fn emitted_target_reach(
+    modules: Rc<Vec<NonEmptyStr>>,
+    edges: Rc<Vec<Rc<ModuleDagEdge>>>,
+    emitted: Rc<Vec<Rc<EmittedEdge>>>,
+) -> Rc<HashMap<String, Rc<HashMap<String, bool>>>> {
+    {
+        let names = Rc::new({
+            let mut __result = Vec::new();
+            for module_id in modules.iter().cloned() {
+                __result.push(module_id.clone());
+            }
+            __result
+        });
+        let forward_as_reverse = Rc::new(CallGraph {
+            edges: Rc::new({
+                let mut __result = Vec::new();
+                for edge in edges.iter().cloned() {
+                    __result.push(Rc::new(GraphEdge {
+                        caller: edge.to.clone(),
+                        callee: edge.from.clone(),
+                    }));
+                }
+                __result
+            }),
+        });
+        emitted.iter().cloned().fold(
+            v1_rt::rc_empty_map::<String, Rc<HashMap<String, bool>>>(),
+            |acc: Rc<HashMap<String, Rc<HashMap<String, bool>>>>, edge: Rc<EmittedEdge>| {
+                match (*edge.to.clone()).clone() {
+                    EmittedEdgeTarget::EmittedCrateRootTarget => acc.clone(),
+                    EmittedEdgeTarget::EmittedModuleTarget { module: target, .. } => {
+                        match v1_rt::map_get(&acc, target.clone()) {
+                            Some(_) => acc.clone(),
+                            std::option::Option::None => v1_rt::rc_map_insert(
+                                acc.clone(),
+                                target.clone(),
+                                reached_set(
+                                    names.clone(),
+                                    forward_as_reverse.clone(),
+                                    target.clone(),
+                                ),
+                            ),
+                        }
+                    }
+                }
+            },
+        )
+    }
+}
+
+pub fn emitted_edge_merge_step(
+    acc: Rc<EmittedEdgeMergeFold>,
+    edge: Rc<EmittedEdge>,
+    module_set: Rc<HashMap<String, bool>>,
+    reach: Rc<HashMap<String, Rc<HashMap<String, bool>>>>,
+) -> Rc<EmittedEdgeMergeFold> {
+    match acc.refusal.clone() {
+        Some(_) => acc.clone(),
+        std::option::Option::None => match (*edge.to.clone()).clone() {
+            EmittedEdgeTarget::EmittedCrateRootTarget => acc.clone(),
+            EmittedEdgeTarget::EmittedModuleTarget { module: target, .. } => {
+                if (edge.from.clone() == target.clone()) {
+                    acc.clone()
+                } else {
+                    if (!string_member(module_set.clone(), edge.from.clone())
+                        || !string_member(module_set.clone(), target.clone()))
+                    {
+                        Rc::new(EmittedEdgeMergeFold {
+                            edges: acc.edges.clone(),
+                            present: acc.present.clone(),
+                            refusal: crate::std_optional::optional_present(Rc::new(
+                                EmittedEdgeRefusal::EmittedEdgeEndpointOutsideDag {
+                                    from: edge.from.clone(),
+                                    to: target.clone(),
+                                },
+                            )),
+                        })
+                    } else {
+                        {
+                            let target_reaches_source = match v1_rt::map_get(&reach, target.clone())
+                            {
+                                Some(reached) => string_member(reached.clone(), edge.from.clone()),
+                                std::option::Option::None => false,
+                            };
+                            if target_reaches_source.clone() {
+                                Rc::new(EmittedEdgeMergeFold {
+                                    edges: acc.edges.clone(),
+                                    present: acc.present.clone(),
+                                    refusal: crate::std_optional::optional_present(Rc::new(
+                                        EmittedEdgeRefusal::EmitterReverseEdge {
+                                            from: stage0_module_id(edge.from.clone()),
+                                            to: stage0_module_id(target.clone()),
+                                            provenance: edge.provenance.clone(),
+                                        },
+                                    )),
+                                })
+                            } else {
+                                if string_member(
+                                    acc.present.clone(),
+                                    module_dag_edge_key(edge.from.clone(), target.clone()),
+                                ) {
+                                    acc.clone()
+                                } else {
+                                    Rc::new(EmittedEdgeMergeFold {
+                                        edges: v1_rt::rc_list_push(
+                                            acc.edges.clone(),
+                                            Rc::new(ModuleDagEdge {
+                                                from: stage0_module_id(edge.from.clone()),
+                                                to: stage0_module_id(target.clone()),
+                                            }),
+                                        ),
+                                        present: v1_rt::rc_map_insert(
+                                            acc.present.clone(),
+                                            module_dag_edge_key(edge.from.clone(), target.clone()),
+                                            true,
+                                        ),
+                                        refusal: std::option::Option::None,
+                                    })
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+    }
+}
+
+pub fn merge_emitted_edges(
+    modules: Rc<Vec<NonEmptyStr>>,
+    edges: Rc<Vec<Rc<ModuleDagEdge>>>,
+    emitted: Rc<Vec<Rc<EmittedEdge>>>,
+) -> Rc<EmittedEdgesMerge> {
+    {
+        let module_set = modules.iter().cloned().fold(
+            v1_rt::rc_empty_map::<String, bool>(),
+            |acc: Rc<HashMap<String, bool>>, module_id: NonEmptyStr| {
+                v1_rt::rc_map_insert(acc, module_id.clone(), true)
+            },
+        );
+        let present = edges.iter().cloned().fold(
+            v1_rt::rc_empty_map::<String, bool>(),
+            |acc: Rc<HashMap<String, bool>>, edge: Rc<ModuleDagEdge>| {
+                v1_rt::rc_map_insert(
+                    acc,
+                    module_dag_edge_key(edge.from.clone(), edge.to.clone()),
+                    true,
+                )
+            },
+        );
+        let reach = emitted_target_reach(modules.clone(), edges.clone(), emitted.clone());
+        let folded = emitted.iter().cloned().fold(
+            Rc::new(EmittedEdgeMergeFold {
+                edges: edges.clone(),
+                present: present.clone(),
+                refusal: std::option::Option::None,
+            }),
+            |acc: _, edge: Rc<EmittedEdge>| {
+                emitted_edge_merge_step(acc, edge.clone(), module_set.clone(), reach.clone())
+            },
+        );
+        match folded.refusal.clone() {
+            Some(cause) => Rc::new(EmittedEdgesMerge::EmittedEdgesRefused {
+                cause: cause.clone(),
+            }),
+            std::option::Option::None => Rc::new(EmittedEdgesMerge::EmittedEdgesMerged {
+                edges: folded.edges.clone(),
+            }),
+        }
+    }
+}
+
+pub fn resolve_partition_over(
+    parameter: Rc<PartitionParameter>,
+    modules: Rc<Vec<NonEmptyStr>>,
+    edges: Rc<Vec<Rc<ModuleDagEdge>>>,
+) -> Rc<ResolvePartitionOutcome> {
+    {
+        let components = partition_components_dependencies_first(modules.clone(), edges.clone());
+        match (*parameter.clone()).clone() {
+            PartitionParameter::ExplicitPartitionParam {
+                partition: explicit,
+                ..
+            } => admit_partition_assignment(
+                modules.clone(),
+                edges.clone(),
+                components.clone(),
+                explicit.assignment.clone(),
+                partition_provenance_hand_explicit(),
+            ),
+            PartitionParameter::PolicyPartitionParam { policy: policy, .. } => {
+                if (policy.target_crate_count.clone() < 1) {
+                    Rc::new(ResolvePartitionOutcome::ResolvePartitionRefused {
+                        cause: Rc::new(
+                            ResolvePartitionRefusalCause::PolicyTargetCountNotPositive {
+                                policy: policy.clone(),
+                            },
+                        ),
+                    })
+                } else {
+                    admit_partition_assignment(
+                        modules.clone(),
+                        edges.clone(),
+                        components.clone(),
+                        policy_partition_assignment_over(
+                            modules.clone(),
+                            components.clone(),
+                            policy.clone(),
+                        ),
+                        partition_provenance_policy_derived(policy_partition_resolver_ref()),
+                    )
+                }
+            }
+        }
+    }
+}
+
+pub fn policy_partition_resolver_ref() -> Rc<DeclarationRef> {
+    Rc::new(DeclarationRef {
+        module_path: "gunbc.crate_partition".to_string(),
+        decl_name: "policy_partition_assignment_over".to_string(),
+        field: Rc::new(DeclField::WholeDeclaration),
+    })
+}
+
+pub fn partition_call_graph(edges: Rc<Vec<Rc<ModuleDagEdge>>>) -> Rc<CallGraph> {
+    Rc::new(CallGraph {
+        edges: Rc::new({
+            let mut __result = Vec::new();
+            for edge in edges.iter().cloned() {
+                __result.push(Rc::new(GraphEdge {
+                    caller: edge.from.clone(),
+                    callee: edge.to.clone(),
+                }));
+            }
+            __result
+        }),
+    })
+}
+
+pub fn partition_components_dependencies_first(
+    modules: Rc<Vec<NonEmptyStr>>,
+    edges: Rc<Vec<Rc<ModuleDagEdge>>>,
+) -> Rc<Vec<Rc<Vec<String>>>> {
+    v1_rt::reverse(crate::std_graph::graph_strongly_connected_components(
+        Rc::new({
+            let mut __result = Vec::new();
+            for module_id in modules.iter().cloned() {
+                __result.push(module_id.clone());
+            }
+            __result
+        }),
+        partition_call_graph(edges.clone()),
+    ))
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct PolicyPartitionFill {
+    pub assignment: Rc<HashMap<ModuleId, CompilationUnitId>>,
+    pub unit_index: i64,
+    pub filled: i64,
+}
+
+pub fn policy_partition_unit_id(unit_index: i64) -> NonEmptyStr {
+    v1_rt::concat("policy-unit-".to_string(), (unit_index.clone()).to_string())
+}
+
+pub fn policy_partition_assignment_over(
+    modules: Rc<Vec<NonEmptyStr>>,
+    components: Rc<Vec<Rc<Vec<String>>>>,
+    policy: PartitionPolicy,
+) -> Rc<HashMap<NonEmptyStr, NonEmptyStr>> {
+    {
+        let quota = v1_rt::int_div(
+            v1_rt::int_sub(
+                v1_rt::int_add(
+                    (modules.clone().len() as i64),
+                    policy.target_crate_count.clone(),
+                ),
+                1,
+            ),
+            policy.target_crate_count.clone(),
+        );
+        let filled = components.iter().cloned().fold(
+            Rc::new(PolicyPartitionFill {
+                assignment: v1_rt::rc_empty_map::<NonEmptyStr, NonEmptyStr>(),
+                unit_index: 0,
+                filled: 0,
+            }),
+            |acc: Rc<PolicyPartitionFill>, component: Rc<Vec<String>>| {
+                let opens_next_unit = ((acc.filled.clone() >= quota.clone())
+                    && (v1_rt::int_add(acc.unit_index.clone(), 1)
+                        < policy.target_crate_count.clone()));
+                let unit_index = if opens_next_unit.clone() {
+                    v1_rt::int_add(acc.unit_index.clone(), 1)
+                } else {
+                    acc.unit_index.clone()
+                };
+                let already = if opens_next_unit.clone() {
+                    0
+                } else {
+                    acc.filled.clone()
+                };
+                let unit_id = policy_partition_unit_id(unit_index.clone());
+                Rc::new(PolicyPartitionFill {
+                    assignment: component.iter().cloned().fold(
+                        acc.assignment.clone(),
+                        |inner: Rc<HashMap<NonEmptyStr, NonEmptyStr>>, member: String| {
+                            v1_rt::rc_map_insert(inner, member.clone(), unit_id.clone())
+                        },
+                    ),
+                    unit_index: unit_index.clone(),
+                    filled: v1_rt::int_add(already.clone(), (component.clone().len() as i64)),
+                })
+            },
+        );
+        filled.assignment.clone()
+    }
+}
+
+pub fn assignment_owner(
+    assignment: Rc<HashMap<NonEmptyStr, NonEmptyStr>>,
+    module_id: NonEmptyStr,
+) -> Option<NonEmptyStr> {
+    v1_rt::map_get(&assignment, module_id.clone())
+}
+
+pub fn assignment_first_omitted_module(
+    modules: Rc<Vec<NonEmptyStr>>,
+    assignment: Rc<HashMap<NonEmptyStr, NonEmptyStr>>,
+) -> Option<NonEmptyStr> {
+    modules.iter().cloned().fold(
+        std::option::Option::None,
+        |acc: _, module_id: NonEmptyStr| match acc.clone() {
+            Some(_) => acc.clone(),
+            std::option::Option::None => {
+                match assignment_owner(assignment.clone(), module_id.clone()) {
+                    Some(_) => std::option::Option::None,
+                    std::option::Option::None => Some(module_id.clone()),
+                }
+            }
+        },
+    )
+}
+
+pub fn assignment_first_stranger(
+    modules: Rc<Vec<NonEmptyStr>>,
+    assignment: Rc<HashMap<NonEmptyStr, NonEmptyStr>>,
+) -> Option<NonEmptyStr> {
+    {
+        let known = modules.iter().cloned().fold(
+            v1_rt::rc_empty_map::<NonEmptyStr, bool>(),
+            |acc: Rc<HashMap<NonEmptyStr, bool>>, module_id: NonEmptyStr| {
+                v1_rt::rc_map_insert(acc, module_id.clone(), true)
+            },
+        );
+        Rc::new(v1_rt::sorted_map_keys(&assignment))
+            .iter()
+            .cloned()
+            .fold(
+                std::option::Option::None,
+                |acc: _, module_id: ModuleId| match acc.clone() {
+                    Some(_) => acc.clone(),
+                    std::option::Option::None => match v1_rt::map_get(&known, module_id.clone()) {
+                        Some(_) => std::option::Option::None,
+                        std::option::Option::None => Some(module_id.clone()),
+                    },
+                },
+            )
+    }
+}
+
+pub fn admit_partition_assignment(
+    modules: Rc<Vec<NonEmptyStr>>,
+    edges: Rc<Vec<Rc<ModuleDagEdge>>>,
+    components: Rc<Vec<Rc<Vec<String>>>>,
+    assignment: Rc<HashMap<NonEmptyStr, NonEmptyStr>>,
+    provenance: Rc<PartitionProvenance>,
+) -> Rc<ResolvePartitionOutcome> {
+    match assignment_first_omitted_module(modules.clone(), assignment.clone()) {
+        Some(module_id) => Rc::new(ResolvePartitionOutcome::ResolvePartitionRefused {
+            cause: Rc::new(ResolvePartitionRefusalCause::AssignmentOmitsModule {
+                module_id: module_id.clone(),
+            }),
+        }),
+        std::option::Option::None => {
+            match assignment_first_stranger(modules.clone(), assignment.clone()) {
+                Some(module_id) => Rc::new(ResolvePartitionOutcome::ResolvePartitionRefused {
+                    cause: Rc::new(
+                        ResolvePartitionRefusalCause::AssignmentNamesModuleOutsideDag {
+                            module_id: module_id.clone(),
+                        },
+                    ),
+                }),
+                std::option::Option::None => match (*validate_partition_r4_over(
+                    edges.clone(),
+                    components.clone(),
+                    assignment.clone(),
+                ))
+                .clone()
+                {
+                    PartitionR4ValidityVerdict::PartitionR4Refused { cause: cause, .. } => {
+                        Rc::new(ResolvePartitionOutcome::ResolvePartitionRefused {
+                            cause: Rc::new(
+                                ResolvePartitionRefusalCause::PartitionRustAdmissibilityRefused {
+                                    cause: cause.clone(),
+                                },
+                            ),
+                        })
+                    }
+                    PartitionR4ValidityVerdict::PartitionR4Valid => {
+                        Rc::new(ResolvePartitionOutcome::ResolvePartitionOk {
+                            assignment: assignment.clone(),
+                            provenance: provenance.clone(),
+                        })
+                    }
+                },
+            }
+        }
+    }
+}
+
+pub fn assignment_has_scc_split(
+    components: Rc<Vec<Rc<Vec<String>>>>,
+    assignment: Rc<HashMap<NonEmptyStr, NonEmptyStr>>,
+) -> bool {
+    {
+        let mut __found = false;
+        for component in components.iter().cloned() {
+            if {
+                let owners = component.iter().cloned().fold(
+                    Rc::new(vec![]),
+                    |acc: Rc<Vec<NonEmptyStr>>, member: String| match assignment_owner(
+                        assignment.clone(),
+                        member.clone(),
+                    ) {
+                        Some(owner) => {
+                            if {
+                                let mut __found = false;
+                                for seen in acc.iter().cloned() {
+                                    if (seen.clone() == owner.clone()) {
+                                        __found = true;
+                                        break;
+                                    }
+                                }
+                                __found
+                            } {
+                                acc.clone()
+                            } else {
+                                v1_rt::rc_list_push(acc.clone(), owner.clone())
+                            }
+                        }
+                        std::option::Option::None => acc.clone(),
+                    },
+                );
+                ((owners.clone().len() as i64) > 1)
+            } {
+                __found = true;
+                break;
+            }
+        }
+        __found
+    }
+}
+
+pub fn assignment_unit_graph_has_cycle(
+    edges: Rc<Vec<Rc<ModuleDagEdge>>>,
+    assignment: Rc<HashMap<NonEmptyStr, NonEmptyStr>>,
+) -> bool {
+    {
+        let unit_edges = Rc::new({
+            let mut __result = Vec::new();
+            for e in assignment_unit_dep_edges_over(edges.clone(), assignment.clone())
+                .iter()
+                .cloned()
+            {
+                __result.push(Rc::new(GraphEdge {
+                    caller: e.from.clone(),
+                    callee: e.to.clone(),
+                }));
+            }
+            __result
+        });
+        crate::std_graph::graph_has_multi_node_scc(
+            Rc::new(v1_rt::map_values(&assignment))
+                .iter()
+                .cloned()
+                .fold(
+                    Rc::new(vec![]),
+                    |acc: Rc<Vec<String>>, unit: NonEmptyStr| {
+                        if {
+                            let mut __found = false;
+                            for seen in acc.iter().cloned() {
+                                if (seen.clone() == unit.clone()) {
+                                    __found = true;
+                                    break;
+                                }
+                            }
+                            __found
+                        } {
+                            acc.clone()
+                        } else {
+                            v1_rt::rc_list_push(acc.clone(), unit.clone())
+                        }
+                    },
+                ),
+            Rc::new(CallGraph {
+                edges: unit_edges.clone(),
+            }),
+        )
+    }
+}
+
+pub fn validate_partition_r4_over(
+    edges: Rc<Vec<Rc<ModuleDagEdge>>>,
+    components: Rc<Vec<Rc<Vec<String>>>>,
+    assignment: Rc<HashMap<NonEmptyStr, NonEmptyStr>>,
+) -> Rc<PartitionR4ValidityVerdict> {
+    if assignment_has_scc_split(components.clone(), assignment.clone()) {
+        Rc::new(PartitionR4ValidityVerdict::PartitionR4Refused {
+            cause: Rc::new(PartitionR4ValidityCause::SccSplit {
+                detail:
+                    "Rust R4: mutually dependent modules assigned to different compilation units"
+                        .to_string(),
+            }),
+        })
+    } else {
+        if assignment_unit_graph_has_cycle(edges.clone(), assignment.clone()) {
+            Rc::new(PartitionR4ValidityVerdict::PartitionR4Refused {
+                cause: Rc::new(PartitionR4ValidityCause::UnitGraphCycle {
+                    detail: "Rust R4: compilation-unit dependency graph is cyclic".to_string(),
+                }),
+            })
+        } else {
+            Rc::new(PartitionR4ValidityVerdict::PartitionR4Valid)
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct UnitDepEdge {
+    pub from: CompilationUnitId,
+    pub to: CompilationUnitId,
+}
+
+pub fn assignment_unit_dep_edges_over(
+    edges: Rc<Vec<Rc<ModuleDagEdge>>>,
+    assignment: Rc<HashMap<NonEmptyStr, NonEmptyStr>>,
+) -> Rc<Vec<Rc<UnitDepEdge>>> {
+    edges.iter().cloned().fold(
+        Rc::new(vec![]),
+        |acc: Rc<Vec<Rc<UnitDepEdge>>>, edge: Rc<ModuleDagEdge>| match assignment_owner(
+            assignment.clone(),
+            edge.from.clone(),
+        ) {
+            std::option::Option::None => acc.clone(),
+            Some(from_unit) => match assignment_owner(assignment.clone(), edge.to.clone()) {
+                std::option::Option::None => acc.clone(),
+                Some(to_unit) => {
+                    if (from_unit.clone() == to_unit.clone()) {
+                        acc.clone()
+                    } else {
+                        if {
+                            let mut __found = false;
+                            for e in acc.iter().cloned() {
+                                if ((e.from.clone() == from_unit.clone())
+                                    && (e.to.clone() == to_unit.clone()))
+                                {
+                                    __found = true;
+                                    break;
+                                }
+                            }
+                            __found
+                        } {
+                            acc.clone()
+                        } else {
+                            v1_rt::rc_list_push(
+                                acc.clone(),
+                                Rc::new(UnitDepEdge {
+                                    from: from_unit.clone(),
+                                    to: to_unit.clone(),
+                                }),
+                            )
+                        }
+                    }
+                }
+            },
+        },
+    )
+}
+
+pub fn unit_direct_deps(
+    edges: Rc<Vec<Rc<UnitDepEdge>>>,
+    unit_id: NonEmptyStr,
+) -> Rc<Vec<NonEmptyStr>> {
+    edges.iter().cloned().fold(
+        Rc::new(vec![]),
+        |acc: Rc<Vec<NonEmptyStr>>, e: Rc<UnitDepEdge>| {
+            if ((e.from.clone() == unit_id.clone())
+                && !{
+                    let mut __found = false;
+                    for seen in acc.iter().cloned() {
+                        if (seen.clone() == e.to.clone()) {
+                            __found = true;
+                            break;
+                        }
+                    }
+                    __found
+                })
+            {
+                v1_rt::rc_list_push(acc.clone(), e.to.clone())
+            } else {
+                acc.clone()
+            }
+        },
+    )
+}
+
+pub fn unit_dep_closure_step(
+    edges: Rc<Vec<Rc<UnitDepEdge>>>,
+    acc: Rc<Vec<NonEmptyStr>>,
+) -> Rc<Vec<NonEmptyStr>> {
+    acc.clone().iter().cloned().fold(
+        acc.clone(),
+        |outer: Rc<Vec<NonEmptyStr>>, uid: NonEmptyStr| {
+            unit_direct_deps(edges.clone(), uid.clone())
+                .iter()
+                .cloned()
+                .fold(outer, |inner: Rc<Vec<NonEmptyStr>>, dep: NonEmptyStr| {
+                    if {
+                        let mut __found = false;
+                        for seen in inner.iter().cloned() {
+                            if (seen.clone() == dep.clone()) {
+                                __found = true;
+                                break;
+                            }
+                        }
+                        __found
+                    } {
+                        inner.clone()
+                    } else {
+                        v1_rt::rc_list_push(inner.clone(), dep.clone())
+                    }
+                })
+        },
+    )
+}
+
+pub fn unit_dep_closure(
+    mut __tco_loop_edges: Rc<Vec<Rc<UnitDepEdge>>>,
+    mut __tco_loop_acc: Rc<Vec<NonEmptyStr>>,
+    mut __tco_loop_fuel: i64,
+) -> Rc<Vec<NonEmptyStr>> {
+    loop {
+        #[allow(unused_mut)]
+        let mut edges = __tco_loop_edges;
+        #[allow(unused_mut)]
+        let mut acc = __tco_loop_acc;
+        #[allow(unused_mut)]
+        let mut fuel = __tco_loop_fuel;
+        if (fuel.clone() <= 0) {
+            break acc.clone();
+        } else {
+            let grown = unit_dep_closure_step(edges.clone(), acc.clone());
+            if ((grown.clone().len() as i64) == (acc.clone().len() as i64)) {
+                break acc.clone();
+            } else {
+                {
+                    let __tco_0 = edges;
+                    let __tco_1 = grown.clone();
+                    let __tco_2 = v1_rt::int_sub(fuel, 1);
+                    __tco_loop_edges = __tco_0;
+                    __tco_loop_acc = __tco_1;
+                    __tco_loop_fuel = __tco_2;
+                    continue;
+                }
+            }
+        }
+    }
+}
+
+pub fn unit_package_name(
+    rows: Rc<Vec<Rc<Stage0PartitionCrateRow>>>,
+    unit_id: NonEmptyStr,
+) -> Option<String> {
+    rows.iter().cloned().fold(
+        std::option::Option::None,
+        |acc: _, row: Rc<Stage0PartitionCrateRow>| match acc.clone() {
+            Some(_) => acc.clone(),
+            std::option::Option::None => {
+                if (row.unit_id.clone() == unit_id.clone()) {
+                    crate::std_optional::optional_present(row.package_name.clone())
+                } else {
+                    std::option::Option::None
+                }
+            }
+        },
+    )
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum DerivedDepPackages {
+    DerivedDepPackagesOk { packages: Rc<Vec<String>> },
+    DerivedDepPackagesUnitHasNoRow { unit_id: CompilationUnitId },
+}
+
+pub fn derived_dep_packages(
+    edges: Rc<Vec<Rc<UnitDepEdge>>>,
+    rows: Rc<Vec<Rc<Stage0PartitionCrateRow>>>,
+    row: Rc<Stage0PartitionCrateRow>,
+) -> Rc<DerivedDepPackages> {
+    unit_dep_closure(
+        edges.clone(),
+        unit_direct_deps(edges.clone(), row.unit_id.clone()),
+        v1_rt::int_add((edges.clone().len() as i64), 1),
+    )
+    .iter()
+    .cloned()
+    .fold(
+        Rc::new(DerivedDepPackages::DerivedDepPackagesOk {
+            packages: Rc::new(vec![]),
+        }),
+        |acc: Rc<DerivedDepPackages>, dep: NonEmptyStr| match (*acc).clone() {
+            DerivedDepPackages::DerivedDepPackagesUnitHasNoRow {
+                unit_id: unit_id, ..
+            } => Rc::new(DerivedDepPackages::DerivedDepPackagesUnitHasNoRow {
+                unit_id: unit_id.clone(),
+            }),
+            DerivedDepPackages::DerivedDepPackagesOk {
+                packages: packages, ..
+            } => match unit_package_name(rows.clone(), dep.clone()) {
+                Some(pkg) => Rc::new(DerivedDepPackages::DerivedDepPackagesOk {
+                    packages: v1_rt::rc_list_push(packages.clone(), pkg.clone()),
+                }),
+                std::option::Option::None => {
+                    Rc::new(DerivedDepPackages::DerivedDepPackagesUnitHasNoRow {
+                        unit_id: dep.clone(),
+                    })
+                }
+            },
+        },
+    )
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct Stage0FoundationCrate;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct Stage0LayeredCoreCrate;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct Stage0EmitCoreCrate;
diff --git a/src/v1/stage0/src/gunbc_emitted_crate_workspace.rs b/src/v1/stage0/src/gunbc_emitted_crate_workspace.rs
new file mode 100644
index 00000000000..d0efc6f3cfd
--- /dev/null
+++ b/src/v1/stage0/src/gunbc_emitted_crate_workspace.rs
@@ -0,0 +1,816 @@
+// Generated by v1 compiler -- do not edit.
+// Source module: gunbc.emitted_crate_workspace
+
+use self::DerivedRowsBuild::*;
+use self::EmittedWorkspaceBuildOutcome::*;
+use self::EmittedWorkspaceOutcome::*;
+use self::EmittedWorkspaceRedOutcome::*;
+use self::EmittedWorkspaceRefusal::*;
+pub use crate::extdeps_cargo::cargo_target_source_path;
+pub use crate::extdeps_cargo::CargoTarget;
+use crate::extdeps_cargo::CargoTarget::Bin;
+use crate::gunbc_crate_partition::DerivedDepPackages::{
+    DerivedDepPackagesOk, DerivedDepPackagesUnitHasNoRow,
+};
+use crate::gunbc_crate_partition::EmittedEdgeRefusal::{
+    EmittedEdgeEndpointOutsideDag, EmitterReverseEdge,
+};
+use crate::gunbc_crate_partition::EmittedEdgesMerge::{EmittedEdgesMerged, EmittedEdgesRefused};
+use crate::gunbc_crate_partition::PartitionParameter::PolicyPartitionParam;
+use crate::gunbc_crate_partition::ResolvePartitionOutcome::{
+    ResolvePartitionOk, ResolvePartitionRefused,
+};
+use crate::gunbc_crate_partition::ResolvePartitionRefusalCause::{
+    AssignmentNamesModuleOutsideDag, AssignmentOmitsModule, PartitionEmittedEdgeRefused,
+    PartitionRustAdmissibilityRefused, PolicyTargetCountNotPositive,
+};
+use crate::gunbc_crate_partition::Stage0PartitionCrateKind::{
+    Stage0FoundationCrate, Stage0LayeredCoreCrate,
+};
+pub use crate::gunbc_crate_partition::{
+    assignment_unit_dep_edges_over, crate_partition_declared_core_target, derived_dep_packages,
+    list_unique_sorted_ids, merge_emitted_edges, resolve_partition_over, unit_dep_closure,
+    unit_direct_deps,
+};
+pub use crate::gunbc_crate_partition::{
+    CompilationUnitId, DerivedDepPackages, EmittedEdgeRefusal, EmittedEdgesMerge, ModuleDagEdge,
+    ModuleId, PartitionParameter, PartitionPolicy, ResolvePartitionOutcome,
+    ResolvePartitionRefusalCause, Stage0PartitionCrateKind, Stage0PartitionCrateRow, UnitDepEdge,
+};
+use crate::gunbc_rust_emitted_edge::EmittedEdgeProvenance::{
+    DeclaredImport, InlinePathReference, ReexportFacade, RuntimePrelude, SemanticSourceReference,
+    ServiceRuntimeSurface,
+};
+use crate::gunbc_rust_emitted_edge::EmittedEdgeTarget::{
+    EmittedCrateRootTarget, EmittedModuleTarget,
+};
+pub use crate::gunbc_rust_emitted_edge::{rust_module_emit_filename, rust_runtime_prelude_module};
+pub use crate::gunbc_rust_emitted_edge::{EmittedEdge, EmittedEdgeProvenance, EmittedEdgeTarget};
+use crate::gunbc_stage0_crate_partition_generated::GeneratedPartitionCrateKind::{
+    GeneratedFacadeCrate, GeneratedFoundationCrate, GeneratedLayeredCoreCrate,
+};
+pub use crate::gunbc_stage0_crate_partition_generated::{
+    GeneratedPartitionCrateKind, GeneratedPartitionCrateRow,
+};
+pub use crate::std_optional::optional_present;
+pub use crate::std_optional::Optional;
+pub use crate::std_types::{Bool, List, NonEmptyStr};
+use crate::v1_rt;
+use crate::v1_rt::{VecCompat, VecJoin};
+use crate::NonEmptyBTreeSet;
+use crate::NonEmptyVec;
+use im::{vector as vec, HashMap, OrdSet as BTreeSet, Vector as Vec};
+use std::rc::Rc;
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum EmittedWorkspaceRefusal {
+    EmittedWorkspaceEdgeMergeRefused {
+        cause: Rc<EmittedEdgeRefusal>,
+    },
+    EmittedWorkspacePartitionRefused {
+        cause: Rc<ResolvePartitionRefusalCause>,
+    },
+    EmittedWorkspaceUnitHasNoRow {
+        unit_id: CompilationUnitId,
+    },
+    EmittedWorkspaceNoDiscriminatingEdge,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct EmittedWorkspaceRedDrop {
+    pub package: String,
+    pub dropped_package: String,
+    pub from_module: String,
+    pub to_module: String,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct EmittedWorkspacePlan {
+    pub rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+    pub red: Option<Rc<EmittedWorkspaceRedDrop>>,
+    pub module_count: i64,
+    pub crate_count: i64,
+    pub facade_is_whole_closure: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum EmittedWorkspaceRedOutcome {
+    EmittedWorkspaceRedPlanned {
+        red: Rc<EmittedWorkspaceRedDrop>,
+        red_rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+    },
+    EmittedWorkspaceRedRefused {
+        cause: Rc<EmittedWorkspaceRefusal>,
+    },
+}
+
+pub fn emitted_workspace_red_over(
+    plan: Rc<EmittedWorkspacePlan>,
+) -> Rc<EmittedWorkspaceRedOutcome> {
+    match plan.red.clone() {
+        std::option::Option::None => {
+            Rc::new(EmittedWorkspaceRedOutcome::EmittedWorkspaceRedRefused {
+                cause: Rc::new(EmittedWorkspaceRefusal::EmittedWorkspaceNoDiscriminatingEdge),
+            })
+        }
+        Some(red) => Rc::new(EmittedWorkspaceRedOutcome::EmittedWorkspaceRedPlanned {
+            red: red.clone(),
+            red_rows: emitted_workspace_red_rows(plan.rows.clone(), red.clone()),
+        }),
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum EmittedWorkspaceOutcome {
+    EmittedWorkspacePlanned { plan: Rc<EmittedWorkspacePlan> },
+    EmittedWorkspaceRefused { cause: Rc<EmittedWorkspaceRefusal> },
+}
+
+pub fn emitted_workspace_runtime_package() -> String {
+    thread_local! {
+        static CACHED: String = {
+            "v2-emitted-runtime".to_string()
+        };
+    }
+    CACHED.with(|c: &String| c.clone())
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct EmittedModuleGraph {
+    pub modules: Rc<Vec<ModuleId>>,
+    pub edges: Rc<Vec<Rc<ModuleDagEdge>>>,
+}
+
+pub fn emitted_workspace_package(unit_id: NonEmptyStr) -> String {
+    v1_rt::concat("v2-emitted-".to_string(), unit_id.clone())
+}
+
+pub fn emitted_workspace_crate_dir(package: String) -> String {
+    v1_rt::concat("src/v1/".to_string(), package.clone())
+}
+
+pub fn emitted_workspace_lookup(m: Rc<HashMap<String, String>>, key: String) -> Option<String> {
+    v1_rt::map_get(&m, key.clone())
+}
+
+pub fn emitted_workspace_without_runtime(graph: Rc<EmittedModuleGraph>) -> Rc<EmittedModuleGraph> {
+    Rc::new(EmittedModuleGraph {
+        modules: Rc::new({
+            let mut __result = Vec::new();
+            for m in graph.modules.clone().iter().cloned() {
+                if (m.clone() != rust_runtime_prelude_module()) {
+                    __result.push(m);
+                }
+            }
+            __result
+        }),
+        edges: Rc::new({
+            let mut __result = Vec::new();
+            for e in graph.edges.clone().iter().cloned() {
+                if ((e.from.clone() != rust_runtime_prelude_module())
+                    && (e.to.clone() != rust_runtime_prelude_module()))
+                {
+                    __result.push(e);
+                }
+            }
+            __result
+        }),
+    })
+}
+
+pub fn emitted_workspace_unit_rows(
+    modules: Rc<Vec<NonEmptyStr>>,
+    assignment: Rc<HashMap<NonEmptyStr, NonEmptyStr>>,
+    unit_ids: Rc<Vec<NonEmptyStr>>,
+) -> Rc<Vec<Rc<Stage0PartitionCrateRow>>> {
+    Rc::new({
+        let mut __result = Vec::new();
+        for unit_id in unit_ids.iter().cloned() {
+            __result.push({
+                let package = emitted_workspace_package(unit_id.clone());
+                Rc::new(Stage0PartitionCrateRow {
+                    unit_id: unit_id.clone(),
+                    package_name: package.clone(),
+                    crate_dir: emitted_workspace_crate_dir(package.clone()),
+                    kind: Stage0PartitionCrateKind::Stage0LayeredCoreCrate,
+                    modules: Rc::new({
+                        let mut __sorted: Vec<_> = Rc::new({
+                            let mut __result = Vec::new();
+                            for m in Rc::new({
+                                let mut __result = Vec::new();
+                                for m in modules.iter().cloned() {
+                                    if match v1_rt::map_get(&assignment, m.clone()) {
+                                        Some(u) => (u.clone() == unit_id.clone()),
+                                        std::option::Option::None => false,
+                                    } {
+                                        __result.push(m);
+                                    }
+                                }
+                                __result
+                            })
+                            .iter()
+                            .cloned()
+                            {
+                                __result.push(m.clone());
+                            }
+                            __result
+                        })
+                        .iter()
+                        .cloned()
+                        .collect();
+                        __sorted.sort_by(|a: &String, b: &String| {
+                            let __ka = (|m: String| m.clone())(a.clone());
+                            let __kb = (|m: String| m.clone())(b.clone());
+                            v1_rt::canonical_key_cmp(&__ka, &__kb)
+                        });
+                        __sorted
+                    }),
+                    reexport_packages: Rc::new(vec![]),
+                    carries_non_empty_wrappers: false,
+                })
+            });
+        }
+        __result
+    })
+}
+
+pub fn emitted_workspace_generated_row(
+    row: Rc<Stage0PartitionCrateRow>,
+    reexports: Rc<Vec<String>>,
+) -> Rc<GeneratedPartitionCrateRow> {
+    Rc::new(GeneratedPartitionCrateRow {
+        package_name: row.package_name.clone(),
+        crate_dir: row.crate_dir.clone(),
+        kind: GeneratedPartitionCrateKind::GeneratedLayeredCoreCrate,
+        modules: row.modules.clone(),
+        reexport_packages: reexports.clone(),
+        carries_non_empty_wrappers: false,
+    })
+}
+
+pub fn emitted_workspace_runtime_row() -> Rc<GeneratedPartitionCrateRow> {
+    Rc::new(GeneratedPartitionCrateRow {
+        package_name: emitted_workspace_runtime_package(),
+        crate_dir: emitted_workspace_crate_dir(emitted_workspace_runtime_package()),
+        kind: GeneratedPartitionCrateKind::GeneratedFoundationCrate,
+        modules: Rc::new(vec![rust_runtime_prelude_module()]),
+        reexport_packages: Rc::new(vec![]),
+        carries_non_empty_wrappers: true,
+    })
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum DerivedRowsBuild {
+    DerivedRowsOk {
+        rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+    },
+    DerivedRowsRefused {
+        cause: Rc<EmittedWorkspaceRefusal>,
+    },
+}
+
+pub fn emitted_workspace_derived_rows(
+    unit_rows: Rc<Vec<Rc<Stage0PartitionCrateRow>>>,
+    unit_edges: Rc<Vec<Rc<UnitDepEdge>>>,
+) -> Rc<DerivedRowsBuild> {
+    unit_rows.clone().iter().cloned().fold(
+        Rc::new(DerivedRowsBuild::DerivedRowsOk {
+            rows: Rc::new(vec![emitted_workspace_runtime_row()]),
+        }),
+        |acc: Rc<DerivedRowsBuild>, row: Rc<Stage0PartitionCrateRow>| match (*acc).clone() {
+            DerivedRowsBuild::DerivedRowsRefused { cause: c, .. } => {
+                Rc::new(DerivedRowsBuild::DerivedRowsRefused { cause: c.clone() })
+            }
+            DerivedRowsBuild::DerivedRowsOk { rows: rows, .. } => {
+                match (*crate::gunbc_crate_partition::derived_dep_packages(
+                    unit_edges.clone(),
+                    unit_rows.clone(),
+                    row.clone(),
+                ))
+                .clone()
+                {
+                    DerivedDepPackages::DerivedDepPackagesUnitHasNoRow { unit_id: u, .. } => {
+                        Rc::new(DerivedRowsBuild::DerivedRowsRefused {
+                            cause: Rc::new(EmittedWorkspaceRefusal::EmittedWorkspaceUnitHasNoRow {
+                                unit_id: u.clone(),
+                            }),
+                        })
+                    }
+                    DerivedDepPackages::DerivedDepPackagesOk {
+                        packages: packages, ..
+                    } => Rc::new(DerivedRowsBuild::DerivedRowsOk {
+                        rows: v1_rt::rc_list_push(
+                            rows.clone(),
+                            emitted_workspace_generated_row(
+                                row.clone(),
+                                v1_rt::concat(
+                                    Rc::new(vec![emitted_workspace_runtime_package()]),
+                                    Rc::new({
+                                        let mut __sorted: Vec<_> =
+                                            packages.iter().cloned().collect();
+                                        __sorted.sort_by(|a: &String, b: &String| {
+                                            let __ka = (|p: String| p.clone())(a.clone());
+                                            let __kb = (|p: String| p.clone())(b.clone());
+                                            v1_rt::canonical_key_cmp(&__ka, &__kb)
+                                        });
+                                        __sorted
+                                    }),
+                                ),
+                            ),
+                        ),
+                    }),
+                }
+            }
+        },
+    )
+}
+
+pub fn emitted_workspace_unit_of(
+    assignment: Rc<HashMap<NonEmptyStr, NonEmptyStr>>,
+    module: String,
+) -> Option<NonEmptyStr> {
+    v1_rt::map_get(&assignment, module.clone())
+}
+
+pub fn emitted_workspace_edge_is_irredundant(
+    unit_edges: Rc<Vec<Rc<UnitDepEdge>>>,
+    from_unit: NonEmptyStr,
+    to_unit: NonEmptyStr,
+) -> bool {
+    {
+        let others = Rc::new({
+            let mut __result = Vec::new();
+            for d in crate::gunbc_crate_partition::unit_direct_deps(
+                unit_edges.clone(),
+                from_unit.clone(),
+            )
+            .iter()
+            .cloned()
+            {
+                if (d.clone() != to_unit.clone()) {
+                    __result.push(d);
+                }
+            }
+            __result
+        });
+        !{
+            let mut __found = false;
+            for u in crate::gunbc_crate_partition::unit_dep_closure(
+                unit_edges.clone(),
+                others.clone(),
+                v1_rt::int_add((unit_edges.clone().len() as i64), 1),
+            )
+            .iter()
+            .cloned()
+            {
+                if (u.clone() == to_unit.clone()) {
+                    __found = true;
+                    break;
+                }
+            }
+            __found
+        }
+    }
+}
+
+pub fn emitted_workspace_red(
+    edges: Rc<Vec<Rc<EmittedEdge>>>,
+    assignment: Rc<HashMap<NonEmptyStr, NonEmptyStr>>,
+    unit_edges: Rc<Vec<Rc<UnitDepEdge>>>,
+) -> Option<Rc<EmittedWorkspaceRedDrop>> {
+    edges.iter().cloned().fold(
+        std::option::Option::None,
+        |acc: _, edge: Rc<EmittedEdge>| match acc.clone() {
+            Some(_) => acc.clone(),
+            std::option::Option::None => match edge.provenance.clone() {
+                EmittedEdgeProvenance::SemanticSourceReference => {
+                    match (*edge.to.clone()).clone() {
+                        EmittedEdgeTarget::EmittedCrateRootTarget => std::option::Option::None,
+                        EmittedEdgeTarget::EmittedModuleTarget {
+                            module: to_module, ..
+                        } => match emitted_workspace_unit_of(assignment.clone(), edge.from.clone())
+                        {
+                            std::option::Option::None => std::option::Option::None,
+                            Some(from_unit) => match emitted_workspace_unit_of(
+                                assignment.clone(),
+                                to_module.clone(),
+                            ) {
+                                std::option::Option::None => std::option::Option::None,
+                                Some(to_unit) => {
+                                    if ((from_unit.clone() != to_unit.clone())
+                                        && emitted_workspace_edge_is_irredundant(
+                                            unit_edges.clone(),
+                                            from_unit.clone(),
+                                            to_unit.clone(),
+                                        ))
+                                    {
+                                        crate::std_optional::optional_present(Rc::new(
+                                            EmittedWorkspaceRedDrop {
+                                                package: emitted_workspace_package(
+                                                    from_unit.clone(),
+                                                ),
+                                                dropped_package: emitted_workspace_package(
+                                                    to_unit.clone(),
+                                                ),
+                                                from_module: edge.from.clone(),
+                                                to_module: to_module.clone(),
+                                            },
+                                        ))
+                                    } else {
+                                        std::option::Option::None
+                                    }
+                                }
+                            },
+                        },
+                    }
+                }
+                EmittedEdgeProvenance::RuntimePrelude => std::option::Option::None,
+                EmittedEdgeProvenance::ReexportFacade => std::option::Option::None,
+                EmittedEdgeProvenance::DeclaredImport => std::option::Option::None,
+                EmittedEdgeProvenance::InlinePathReference => std::option::Option::None,
+                EmittedEdgeProvenance::ServiceRuntimeSurface => std::option::Option::None,
+            },
+        },
+    )
+}
+
+pub fn emitted_workspace_red_rows(
+    rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+    red: Rc<EmittedWorkspaceRedDrop>,
+) -> Rc<Vec<Rc<GeneratedPartitionCrateRow>>> {
+    Rc::new({
+        let mut __result = Vec::new();
+        for row in rows.iter().cloned() {
+            __result.push(if (row.package_name.clone() == red.package.clone()) {
+                Rc::new(GeneratedPartitionCrateRow {
+                    package_name: row.package_name.clone(),
+                    crate_dir: row.crate_dir.clone(),
+                    kind: row.kind.clone(),
+                    modules: row.modules.clone(),
+                    reexport_packages: Rc::new({
+                        let mut __result = Vec::new();
+                        for p in row.reexport_packages.clone().iter().cloned() {
+                            if (p.clone() != red.dropped_package.clone()) {
+                                __result.push(p);
+                            }
+                        }
+                        __result
+                    }),
+                    carries_non_empty_wrappers: row.carries_non_empty_wrappers.clone(),
+                })
+            } else {
+                row.clone()
+            });
+        }
+        __result
+    })
+}
+
+pub fn emitted_workspace_facade_is_whole_closure(
+    rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+) -> bool {
+    {
+        let layered = Rc::new({
+            let mut __result = Vec::new();
+            for r in rows.iter().cloned() {
+                if (r.package_name.clone() != emitted_workspace_runtime_package()) {
+                    __result.push(r);
+                }
+            }
+            __result
+        });
+        {
+            let mut __all = true;
+            for r in layered.iter().cloned() {
+                if !((r.reexport_packages.clone().len() as i64)
+                    == v1_rt::int_sub((rows.clone().len() as i64), 1))
+                {
+                    __all = false;
+                    break;
+                }
+            }
+            __all
+        }
+    }
+}
+
+pub fn emitted_workspace_is_source_edge(edge: Rc<EmittedEdge>) -> bool {
+    match edge.provenance.clone() {
+        EmittedEdgeProvenance::DeclaredImport => true,
+        EmittedEdgeProvenance::InlinePathReference => true,
+        EmittedEdgeProvenance::RuntimePrelude => false,
+        EmittedEdgeProvenance::ReexportFacade => false,
+        EmittedEdgeProvenance::SemanticSourceReference => false,
+        EmittedEdgeProvenance::ServiceRuntimeSurface => false,
+    }
+}
+
+pub fn emitted_workspace_emission_graph(
+    emitted_basenames: Rc<Vec<String>>,
+) -> Rc<EmittedModuleGraph> {
+    Rc::new(EmittedModuleGraph {
+        modules: Rc::new({
+            let mut __result = Vec::new();
+            for b in emitted_basenames.iter().cloned() {
+                __result.push(b.clone());
+            }
+            __result
+        }),
+        edges: Rc::new(vec![]),
+    })
+}
+
+pub fn emitted_workspace_plan_from_emission(
+    emitted_basenames: Rc<Vec<String>>,
+    edges: Rc<Vec<Rc<EmittedEdge>>>,
+    target_crate_count: i64,
+) -> Rc<EmittedWorkspaceOutcome> {
+    emitted_workspace_plan_over_graph(
+        emitted_workspace_emission_graph(emitted_basenames.clone()),
+        edges.clone(),
+        target_crate_count.clone(),
+    )
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct EmittedWorkspaceBuild {
+    pub layout: Rc<EmittedWorkspacePlan>,
+    pub rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+    pub top_package: String,
+    pub bin_name: String,
+    pub bin_source_path: String,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum EmittedWorkspaceBuildOutcome {
+    EmittedWorkspaceBuildPlanned { build: Rc<EmittedWorkspaceBuild> },
+    EmittedWorkspaceBuildRefused { cause: Rc<EmittedWorkspaceRefusal> },
+}
+
+pub fn emitted_workspace_root_crate_dir() -> String {
+    thread_local! {
+        static CACHED: String = {
+            ".".to_string()
+        };
+    }
+    CACHED.with(|c: &String| c.clone())
+}
+
+pub fn emitted_workspace_top_row(
+    crate_name: String,
+    layout_rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+) -> Rc<GeneratedPartitionCrateRow> {
+    Rc::new(GeneratedPartitionCrateRow {
+        package_name: crate_name.clone(),
+        crate_dir: emitted_workspace_root_crate_dir(),
+        kind: GeneratedPartitionCrateKind::GeneratedFacadeCrate,
+        modules: Rc::new({
+            let mut __result = Vec::new();
+            for r in layout_rows.iter().cloned() {
+                __result.extend((*r.modules.clone()).iter().cloned());
+            }
+            __result
+        }),
+        reexport_packages: Rc::new(vec![]),
+        carries_non_empty_wrappers: false,
+    })
+}
+
+pub fn emitted_workspace_build_from_emission(
+    emitted_basenames: Rc<Vec<String>>,
+    edges: Rc<Vec<Rc<EmittedEdge>>>,
+    target_crate_count: i64,
+    crate_name: String,
+    bin_name: String,
+) -> Rc<EmittedWorkspaceBuildOutcome> {
+    match (*emitted_workspace_plan_from_emission(
+        emitted_basenames.clone(),
+        edges.clone(),
+        target_crate_count.clone(),
+    ))
+    .clone()
+    {
+        EmittedWorkspaceOutcome::EmittedWorkspaceRefused { cause: c, .. } => {
+            Rc::new(EmittedWorkspaceBuildOutcome::EmittedWorkspaceBuildRefused { cause: c.clone() })
+        }
+        EmittedWorkspaceOutcome::EmittedWorkspacePlanned { plan: layout, .. } => {
+            let top = emitted_workspace_top_row(crate_name.clone(), layout.rows.clone());
+            Rc::new(EmittedWorkspaceBuildOutcome::EmittedWorkspaceBuildPlanned {
+                build: Rc::new(EmittedWorkspaceBuild {
+                    layout: layout.clone(),
+                    rows: v1_rt::concat(layout.rows.clone(), Rc::new(vec![top.clone()])),
+                    top_package: crate_name.clone(),
+                    bin_name: bin_name.clone(),
+                    bin_source_path: crate::extdeps_cargo::cargo_target_source_path(
+                        Rc::new(CargoTarget::Bin {
+                            name: bin_name.clone(),
+                        }),
+                        crate_name.clone(),
+                    )
+                    .segments
+                    .clone()
+                    .join(&"/".to_string()),
+                }),
+            })
+        }
+    }
+}
+
+pub fn emitted_workspace_merged_edges(
+    graph: Rc<EmittedModuleGraph>,
+    edges: Rc<Vec<Rc<EmittedEdge>>>,
+) -> Rc<EmittedEdgesMerge> {
+    match (*crate::gunbc_crate_partition::merge_emitted_edges(
+        graph.modules.clone(),
+        Rc::new(vec![]),
+        Rc::new({
+            let mut __result = Vec::new();
+            for e in edges.iter().cloned() {
+                if emitted_workspace_is_source_edge(e.clone()) {
+                    __result.push(e);
+                }
+            }
+            __result
+        }),
+    ))
+    .clone()
+    {
+        EmittedEdgesMerge::EmittedEdgesRefused { cause: c, .. } => {
+            Rc::new(EmittedEdgesMerge::EmittedEdgesRefused { cause: c.clone() })
+        }
+        EmittedEdgesMerge::EmittedEdgesMerged {
+            edges: source_edges,
+            ..
+        } => crate::gunbc_crate_partition::merge_emitted_edges(
+            graph.modules.clone(),
+            source_edges.clone(),
+            Rc::new({
+                let mut __result = Vec::new();
+                for e in edges.iter().cloned() {
+                    if !emitted_workspace_is_source_edge(e.clone()) {
+                        __result.push(e);
+                    }
+                }
+                __result
+            }),
+        ),
+    }
+}
+
+pub fn emitted_workspace_plan_over_graph(
+    graph: Rc<EmittedModuleGraph>,
+    edges: Rc<Vec<Rc<EmittedEdge>>>,
+    target_crate_count: i64,
+) -> Rc<EmittedWorkspaceOutcome> {
+    match (*emitted_workspace_merged_edges(graph.clone(), edges.clone())).clone() {
+        EmittedEdgesMerge::EmittedEdgesRefused { cause: c, .. } => {
+            Rc::new(EmittedWorkspaceOutcome::EmittedWorkspaceRefused {
+                cause: Rc::new(EmittedWorkspaceRefusal::EmittedWorkspaceEdgeMergeRefused {
+                    cause: c.clone(),
+                }),
+            })
+        }
+        EmittedEdgesMerge::EmittedEdgesMerged {
+            edges: merged_edges,
+            ..
+        } => {
+            let closure = emitted_workspace_without_runtime(Rc::new(EmittedModuleGraph {
+                modules: graph.modules.clone(),
+                edges: merged_edges.clone(),
+            }));
+            match (*crate::gunbc_crate_partition::resolve_partition_over(
+                Rc::new(PartitionParameter::PolicyPartitionParam {
+                    policy: PartitionPolicy {
+                        target_crate_count: target_crate_count.clone(),
+                    },
+                }),
+                closure.modules.clone(),
+                closure.edges.clone(),
+            ))
+            .clone()
+            {
+                ResolvePartitionOutcome::ResolvePartitionRefused { cause: c, .. } => {
+                    Rc::new(EmittedWorkspaceOutcome::EmittedWorkspaceRefused {
+                        cause: Rc::new(EmittedWorkspaceRefusal::EmittedWorkspacePartitionRefused {
+                            cause: c.clone(),
+                        }),
+                    })
+                }
+                ResolvePartitionOutcome::ResolvePartitionOk { assignment, .. } => {
+                    let unit_ids = crate::gunbc_crate_partition::list_unique_sorted_ids(Rc::new(
+                        v1_rt::map_values(&assignment),
+                    ));
+                    let unit_edges = crate::gunbc_crate_partition::assignment_unit_dep_edges_over(
+                        closure.edges.clone(),
+                        assignment.clone(),
+                    );
+                    match (*emitted_workspace_derived_rows(
+                        emitted_workspace_unit_rows(
+                            closure.modules.clone(),
+                            assignment.clone(),
+                            unit_ids.clone(),
+                        ),
+                        unit_edges.clone(),
+                    ))
+                    .clone()
+                    {
+                        DerivedRowsBuild::DerivedRowsRefused { cause: c, .. } => {
+                            Rc::new(EmittedWorkspaceOutcome::EmittedWorkspaceRefused {
+                                cause: c.clone(),
+                            })
+                        }
+                        DerivedRowsBuild::DerivedRowsOk { rows: rows, .. } => {
+                            Rc::new(EmittedWorkspaceOutcome::EmittedWorkspacePlanned {
+                                plan: Rc::new(EmittedWorkspacePlan {
+                                    rows: rows.clone(),
+                                    red: emitted_workspace_red(
+                                        edges.clone(),
+                                        assignment.clone(),
+                                        unit_edges.clone(),
+                                    ),
+                                    module_count: (closure.modules.clone().len() as i64),
+                                    crate_count: (rows.clone().len() as i64),
+                                    facade_is_whole_closure:
+                                        emitted_workspace_facade_is_whole_closure(rows.clone()),
+                                }),
+                            })
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+pub fn emitted_workspace_build(
+    emitted_basenames: Rc<Vec<String>>,
+    edges: Rc<Vec<Rc<EmittedEdge>>>,
+    crate_name: String,
+    bin_name: String,
+) -> Rc<EmittedWorkspaceBuildOutcome> {
+    emitted_workspace_build_from_emission(
+        emitted_basenames.clone(),
+        edges.clone(),
+        crate_partition_declared_core_target(),
+        crate_name.clone(),
+        bin_name.clone(),
+    )
+}
+
+pub fn emitted_workspace_edge_refusal_message(cause: Rc<EmittedEdgeRefusal>) -> String {
+    match (*cause.clone()).clone() {
+        EmittedEdgeRefusal::EmitterReverseEdge { from: f, to: t, .. } => v1_rt::concat(
+            v1_rt::concat(
+                v1_rt::concat("EmitterReverseEdge ".to_string(), f.clone()),
+                " -> ".to_string(),
+            ),
+            t.clone(),
+        ),
+        EmittedEdgeRefusal::EmittedEdgeEndpointOutsideDag { from: f, to: t, .. } => v1_rt::concat(
+            v1_rt::concat(
+                v1_rt::concat("EmittedEdgeEndpointOutsideDag ".to_string(), f.clone()),
+                " -> ".to_string(),
+            ),
+            t.clone(),
+        ),
+    }
+}
+
+pub fn emitted_workspace_refusal_message(cause: Rc<EmittedWorkspaceRefusal>) -> String {
+    match (*cause.clone()).clone() {
+        EmittedWorkspaceRefusal::EmittedWorkspaceEdgeMergeRefused { cause: c, .. } => {
+            emitted_workspace_edge_refusal_message(c.clone())
+        }
+        EmittedWorkspaceRefusal::EmittedWorkspacePartitionRefused { cause: c, .. } => match (*c
+            .clone())
+        .clone()
+        {
+            ResolvePartitionRefusalCause::PolicyTargetCountNotPositive { policy: _, .. } => {
+                "PolicyTargetCountNotPositive".to_string()
+            }
+            ResolvePartitionRefusalCause::AssignmentOmitsModule { module_id: m, .. } => {
+                v1_rt::concat("AssignmentOmitsModule ".to_string(), m.clone())
+            }
+            ResolvePartitionRefusalCause::AssignmentNamesModuleOutsideDag {
+                module_id: m, ..
+            } => v1_rt::concat("AssignmentNamesModuleOutsideDag ".to_string(), m.clone()),
+            ResolvePartitionRefusalCause::PartitionRustAdmissibilityRefused {
+                cause: _, ..
+            } => "PartitionRustAdmissibilityRefused".to_string(),
+            ResolvePartitionRefusalCause::PartitionEmittedEdgeRefused { cause: e, .. } => {
+                emitted_workspace_edge_refusal_message(e.clone())
+            }
+        },
+        EmittedWorkspaceRefusal::EmittedWorkspaceUnitHasNoRow { unit_id: u, .. } => {
+            v1_rt::concat("UnitHasNoRow ".to_string(), u.clone())
+        }
+        EmittedWorkspaceRefusal::EmittedWorkspaceNoDiscriminatingEdge => {
+            "NoDiscriminatingEdge".to_string()
+        }
+    }
+}
diff --git a/src/v1/stage0/src/gunbc_rust_emitted_crate.rs b/src/v1/stage0/src/gunbc_rust_emitted_crate.rs
new file mode 100644
index 00000000000..99db3fc74c5
--- /dev/null
+++ b/src/v1/stage0/src/gunbc_rust_emitted_crate.rs
@@ -0,0 +1,22 @@
+// Generated by v1 compiler -- do not edit.
+// Source module: gunbc.rust_emitted_crate
+
+pub use crate::std_types::Bool;
+use crate::v1_rt;
+use crate::v1_rt::{VecCompat, VecJoin};
+use crate::NonEmptyBTreeSet;
+use crate::NonEmptyVec;
+use im::{vector as vec, HashMap, OrdSet as BTreeSet, Vector as Vec};
+use std::rc::Rc;
+
+#[derive(Debug, Clone, Copy, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct EmittedCrateDependencyDemand {
+    pub renders_clap_cli: bool,
+    pub renders_async_services: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct EmittedRustCrate {
+    pub crate_name: String,
+    pub demand: EmittedCrateDependencyDemand,
+}
diff --git a/src/v1/stage0/src/gunbc_rust_emitted_edge.rs b/src/v1/stage0/src/gunbc_rust_emitted_edge.rs
index aea43fe5e24..388d244e77d 100644
--- a/src/v1/stage0/src/gunbc_rust_emitted_edge.rs
+++ b/src/v1/stage0/src/gunbc_rust_emitted_edge.rs
@@ -19,6 +19,9 @@ pub enum EmittedEdgeProvenance {
     RuntimePrelude,
     ReexportFacade,
     SemanticSourceReference,
+    DeclaredImport,
+    InlinePathReference,
+    ServiceRuntimeSurface,
 }
 
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
@@ -73,15 +76,6 @@ pub fn rust_runtime_prelude_module() -> String {
     CACHED.with(|c: &String| c.clone())
 }
 
-pub fn rust_emit_only_basenames() -> Rc<Vec<String>> {
-    thread_local! {
-        static CACHED: Rc<Vec<String>> = {
-            Rc::new(vec!["dry_run".to_string()])
-        };
-    }
-    CACHED.with(|c: &Rc<Vec<String>>| c.clone())
-}
-
 pub fn rust_prelude_emitted_edges(module: String) -> Rc<Vec<Rc<EmittedEdge>>> {
     if (module.clone() == rust_runtime_prelude_module()) {
         Rc::new(vec![Rc::new(EmittedEdge {
@@ -117,6 +111,45 @@ pub fn semantic_source_reference_edge(from: String, to_module: String) -> Rc<Emi
     })
 }
 
+pub fn declared_import_edge(from: String, to_module: String) -> Rc<EmittedEdge> {
+    Rc::new(EmittedEdge {
+        from: from.clone(),
+        to: Rc::new(EmittedEdgeTarget::EmittedModuleTarget {
+            module: to_module.clone(),
+        }),
+        provenance: EmittedEdgeProvenance::DeclaredImport,
+    })
+}
+
+pub fn inline_path_reference_edge(from: String, to_module: String) -> Rc<EmittedEdge> {
+    Rc::new(EmittedEdge {
+        from: from.clone(),
+        to: Rc::new(EmittedEdgeTarget::EmittedModuleTarget {
+            module: to_module.clone(),
+        }),
+        provenance: EmittedEdgeProvenance::InlinePathReference,
+    })
+}
+
+pub fn rust_service_runtime_module() -> String {
+    thread_local! {
+        static CACHED: String = {
+            "dry_run".to_string()
+        };
+    }
+    CACHED.with(|c: &String| c.clone())
+}
+
+pub fn service_runtime_surface_edge(from: String) -> Rc<EmittedEdge> {
+    Rc::new(EmittedEdge {
+        from: from.clone(),
+        to: Rc::new(EmittedEdgeTarget::EmittedModuleTarget {
+            module: rust_service_runtime_module(),
+        }),
+        provenance: EmittedEdgeProvenance::ServiceRuntimeSurface,
+    })
+}
+
 pub fn emitted_edge_target_module(edge: Rc<EmittedEdge>) -> Rc<Vec<String>> {
     match (*edge.to.clone()).clone() {
         EmittedEdgeTarget::EmittedModuleTarget { module: target, .. } => {
@@ -132,3 +165,9 @@ pub struct RuntimePrelude;
 pub struct ReexportFacade;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct SemanticSourceReference;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct DeclaredImport;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct InlinePathReference;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct ServiceRuntimeSurface;
diff --git a/src/v1/stage0/src/gunbc_rust_source_type_bindings.rs b/src/v1/stage0/src/gunbc_rust_source_type_bindings.rs
index 2627adc50ca..98256d0f36e 100644
--- a/src/v1/stage0/src/gunbc_rust_source_type_bindings.rs
+++ b/src/v1/stage0/src/gunbc_rust_source_type_bindings.rs
@@ -135,7 +135,7 @@ pub fn checkpoint_row_migration_rows() -> Rc<Vec<Rc<CheckpointRowMigration>>> {
 }), Rc::new(CheckpointRowMigration {
     dag_name: "String".to_string(),
     disposition: Rc::new(CheckpointRowDisposition::ProvenUniqueKernelBinding {
-    proof: "The kernel string_type is minted by v1.compiler.types for every string literal and carries no declaration; both .dag declarations of the spelling (v2.std.text, std.string_type) are gated structural by v1.compiler.coercion structural_declaration_modules_for and never reach this row. THE VERDICT STANDS AND ITS ORIGINAL ARGUMENT WAS EXACTLY INVERTED, corrected here rather than softened because the inverted form would justify the wrong things if reused. It read: the bare spelling cannot be captured because the only import that could shadow it binds the SAME token, so in a module importing v2.std.text String every `String` reference IS the text carrier and the kernel spelling is unreachable there. The opposite is true. KERNEL NAMES ARE NEVER OVERRIDDEN BY IMPORTS (v1.compiler.infer direct_import_export_precedence_note, overlay_skips_kernel_name), so in such a module the import does not shadow at all and a bare `String` is ALWAYS the kernel -- the spelling the old argument called unreachable is the only one you reach. Three routes exist and all three are sound for this row: a bare reference in an importing module resolves to the kernel and IS this row's binding; a bare reference INSIDE v2.std.text resolves LOCALLY (locals beat kernel) and is gated structural, never reaching the row; and a QUALIFIED v2.std.text.String resolves through the alias to the dotted name std.algebra.FreeMonoid, which matches no bare row. Symbol was captured precisely because its token differed from its spelling, and that clause survives unchanged. ESTABLISHED BY EXECUTION, not by reading precedence -- AND THE SUBJECT NAMED HERE IS CORRECTED: this sentence previously said the census was run over A FIXTURE MODULE importing both v2.std.text String and v2.std.node Node. IT WAS NOT. The receipts carry no fixture rows at all; the subjects were LIVE CORPUS MODULES, and naming a subject that was not run is the same citation defect this row exists to correct. What v1.tests.claim.carrier_realization_census actually reports: in std.algebra, a module that imports the spelling, a bare String carries the kernel identity at declaration_field AND at fn_signature_param; inside v2.std.text the same spelling carries its own declaring module and diverges with exact identity, which is route 2 executed rather than argued; and v2.std.node Node carries its real declaring module at both position kinds as the positive control. RE-DERIVATION IS POSITION-KIND SENSITIVE AND THE OBVIOUS INSTRUCTION IS A TRAP. Running that census over a closure re-derives routes 1 and 2 soundly. It does NOT re-derive route 3: at fn_signature_param the census resolves a QUALIFIED v2.std.text.String through the alias onto the alias declaration's own name, which is the spelling String, and attributes it to <kernel:String> -- confidently naming the very carrier the qualification was written to move away from. That is measured by vivid-deer-102 and filed as recurring failure mode alias_resolution_collides_with_kernel_spelling (gunbc#9939); the same instrument is correct for qualified aliases at declaration_field. ROUTE 3 THEREFORE RESTS ON STRUCTURAL RESOLUTION PLUS A RUSTC MEASUREMENT -- the emitted crate carries an E0308 on the bare arm and not on the qualified one -- and explicitly NOT on this census, which cannot answer at that position. The instrument is named rather than its rows transcribed (DESIGN section 6). SINCE gunbc#12760 THE KERNEL HOST TEXT HAS A DECLARATION: v2.std.node String, opaque, with its own exact row above (RustStdString). So the kernel spelling now has one declaration, and this bare row and that exact row render the same carrier, std::string::String; the uniqueness this row proves is unchanged.".to_string(),
+    proof: "The kernel string_type is minted by v1.compiler.types for every string literal and carries no declaration; both .dag declarations of the spelling (v2.std.text, std.string_type) are gated structural by v1.compiler.coercion structural_declaration_modules_for and never reach this row. THE VERDICT STANDS AND ITS ORIGINAL ARGUMENT WAS EXACTLY INVERTED, corrected here rather than softened because the inverted form would justify the wrong things if reused. It read: the bare spelling cannot be captured because the only import that could shadow it binds the SAME token, so in a module importing v2.std.text String every `String` reference IS the text carrier and the kernel spelling is unreachable there. The opposite is true. KERNEL NAMES ARE NEVER OVERRIDDEN BY IMPORTS (v1.compiler.infer direct_import_export_precedence_note; v1.compiler.infer_env overlay_skips_kernel_name), so in such a module the import does not shadow at all and a bare `String` is ALWAYS the kernel -- the spelling the old argument called unreachable is the only one you reach. Three routes exist and all three are sound for this row: a bare reference in an importing module resolves to the kernel and IS this row's binding; a bare reference INSIDE v2.std.text resolves LOCALLY (locals beat kernel) and is gated structural, never reaching the row; and a QUALIFIED v2.std.text.String resolves through the alias to the dotted name std.algebra.FreeMonoid, which matches no bare row. Symbol was captured precisely because its token differed from its spelling, and that clause survives unchanged. ESTABLISHED BY EXECUTION, not by reading precedence -- AND THE SUBJECT NAMED HERE IS CORRECTED: this sentence previously said the census was run over A FIXTURE MODULE importing both v2.std.text String and v2.std.node Node. IT WAS NOT. The receipts carry no fixture rows at all; the subjects were LIVE CORPUS MODULES, and naming a subject that was not run is the same citation defect this row exists to correct. What v1.tests.claim.carrier_realization_census actually reports: in std.algebra, a module that imports the spelling, a bare String carries the kernel identity at declaration_field AND at fn_signature_param; inside v2.std.text the same spelling carries its own declaring module and diverges with exact identity, which is route 2 executed rather than argued; and v2.std.node Node carries its real declaring module at both position kinds as the positive control. RE-DERIVATION IS POSITION-KIND SENSITIVE AND THE OBVIOUS INSTRUCTION IS A TRAP. Running that census over a closure re-derives routes 1 and 2 soundly. It does NOT re-derive route 3: at fn_signature_param the census resolves a QUALIFIED v2.std.text.String through the alias onto the alias declaration's own name, which is the spelling String, and attributes it to <kernel:String> -- confidently naming the very carrier the qualification was written to move away from. That is measured by vivid-deer-102 and filed as recurring failure mode alias_resolution_collides_with_kernel_spelling (gunbc#9939); the same instrument is correct for qualified aliases at declaration_field. ROUTE 3 THEREFORE RESTS ON STRUCTURAL RESOLUTION PLUS A RUSTC MEASUREMENT -- the emitted crate carries an E0308 on the bare arm and not on the qualified one -- and explicitly NOT on this census, which cannot answer at that position. The instrument is named rather than its rows transcribed (DESIGN section 6). SINCE gunbc#12760 THE KERNEL HOST TEXT HAS A DECLARATION: v2.std.node String, opaque, with its own exact row above (RustStdString). So the kernel spelling now has one declaration, and this bare row and that exact row render the same carrier, std::string::String; the uniqueness this row proves is unchanged.".to_string(),
 }),
 }), Rc::new(CheckpointRowMigration {
     dag_name: "Int".to_string(),
diff --git a/src/v1/stage0/src/gunbc_stage0_crate_partition_generated.rs b/src/v1/stage0/src/gunbc_stage0_crate_partition_generated.rs
index bb3cd103676..32d5af2bd56 100644
--- a/src/v1/stage0/src/gunbc_stage0_crate_partition_generated.rs
+++ b/src/v1/stage0/src/gunbc_stage0_crate_partition_generated.rs
@@ -18,6 +18,7 @@ pub enum GeneratedPartitionCrateKind {
     GeneratedFoundationCrate,
     GeneratedLayeredCoreCrate,
     GeneratedEmitCoreCrate,
+    GeneratedFacadeCrate,
 }
 
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
@@ -53,7 +54,7 @@ pub fn generated_partition_crate_rows() -> Rc<Vec<Rc<GeneratedPartitionCrateRow>
         package_name: "v1-stage0-std-core".to_string(),
         crate_dir: "src/v1/stage0_std_core".to_string(),
         kind: GeneratedPartitionCrateKind::GeneratedLayeredCoreCrate,
-        modules: Rc::new(vec!["std_content_hash".to_string(), "std_coercion".to_string(), "extdeps_currency_currency".to_string(), "std_decl_ref".to_string(), "std_keyed_row".to_string(), "std_keyed_roster".to_string(), "std_roster_frontier".to_string(), "std_dissolution".to_string(), "std_disposition".to_string(), "std_error_primitives".to_string(), "std_emit_model".to_string(), "std_measure".to_string(), "std_types".to_string(), "std_unicode_types".to_string(), "std_optional".to_string(), "std_algebra".to_string(), "std_nat".to_string(), "std_node".to_string(), "std_syntax".to_string(), "std_computation".to_string(), "std_termination".to_string(), "std_checked_arithmetic".to_string(), "std_induction".to_string(), "std_graph".to_string(), "extdeps_uri".to_string(), "extdeps_external_authority".to_string(), "extdeps_posix_clock_gettime".to_string(), "extdeps_ietf_http_semantics".to_string(), "std_process_termination".to_string(), "std_primitive_projection".to_string(), "extdeps_container_oci_digest".to_string(), "extdeps_units_dimensionless".to_string(), "extdeps_units_iec_80000_13".to_string(), "extdeps_units_iso8601".to_string(), "extdeps_units_iso_80000_3".to_string(), "std_occurrence_identity".to_string(), "std_source_annotation".to_string(), "std_kernel_type_name".to_string(), "std_target_representation".to_string(), "std_literal_elaboration".to_string(), "std_operator_realization".to_string(), "std_import".to_string(), "v1_std_core".to_string(), "gunbc_rust_emitted_edge".to_string()]),
+        modules: Rc::new(vec!["std_content_hash".to_string(), "std_coercion".to_string(), "extdeps_currency_currency".to_string(), "std_decl_ref".to_string(), "std_keyed_row".to_string(), "std_keyed_roster".to_string(), "std_roster_frontier".to_string(), "std_dissolution".to_string(), "std_disposition".to_string(), "std_error_primitives".to_string(), "std_emit_model".to_string(), "std_measure".to_string(), "std_types".to_string(), "std_unicode_types".to_string(), "std_optional".to_string(), "std_algebra".to_string(), "std_nat".to_string(), "std_node".to_string(), "std_syntax".to_string(), "std_computation".to_string(), "std_termination".to_string(), "std_checked_arithmetic".to_string(), "std_induction".to_string(), "std_graph".to_string(), "extdeps_uri".to_string(), "extdeps_external_authority".to_string(), "extdeps_posix_clock_gettime".to_string(), "extdeps_ietf_http_semantics".to_string(), "std_process_termination".to_string(), "std_primitive_projection".to_string(), "extdeps_container_oci_digest".to_string(), "extdeps_units_dimensionless".to_string(), "extdeps_units_iec_80000_13".to_string(), "extdeps_units_iso8601".to_string(), "extdeps_units_iso_80000_3".to_string(), "std_occurrence_identity".to_string(), "std_source_annotation".to_string(), "std_kernel_type_name".to_string(), "std_target_representation".to_string(), "std_literal_elaboration".to_string(), "std_operator_realization".to_string(), "std_import".to_string(), "v1_std_core".to_string(), "gunbc_rust_emitted_edge".to_string(), "gunbc_rust_emitted_crate".to_string()]),
         reexport_packages: Rc::new(vec!["v1-stage0-runtime".to_string()]),
         carries_non_empty_wrappers: false,
     }), Rc::new(GeneratedPartitionCrateRow {
@@ -88,7 +89,7 @@ pub fn generated_partition_crate_rows() -> Rc<Vec<Rc<GeneratedPartitionCrateRow>
         package_name: "v1-stage0-emit-core".to_string(),
         crate_dir: "src/v1/stage0_emit_core".to_string(),
         kind: GeneratedPartitionCrateKind::GeneratedEmitCoreCrate,
-        modules: Rc::new(vec!["gunbc_rust_emitted_edge".to_string(), "v1_compiler_artifact".to_string(), "v1_compiler_infer_env".to_string(), "v1_compiler_infer_items".to_string(), "v1_compiler_infer_service".to_string(), "v1_compiler_infer_types".to_string(), "v1_compiler_languages".to_string(), "v1_compiler_parse".to_string(), "v1_rt".to_string(), "v1_std_core".to_string()]),
+        modules: Rc::new(vec!["gunbc_rust_emitted_crate".to_string(), "gunbc_rust_emitted_edge".to_string(), "v1_compiler_artifact".to_string(), "v1_compiler_infer_env".to_string(), "v1_compiler_infer_items".to_string(), "v1_compiler_infer_service".to_string(), "v1_compiler_infer_types".to_string(), "v1_compiler_languages".to_string(), "v1_compiler_parse".to_string(), "v1_rt".to_string(), "v1_std_core".to_string()]),
         reexport_packages: Rc::new(vec![]),
         carries_non_empty_wrappers: false,
     })])
@@ -103,3 +104,5 @@ pub struct GeneratedFoundationCrate;
 pub struct GeneratedLayeredCoreCrate;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct GeneratedEmitCoreCrate;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct GeneratedFacadeCrate;
diff --git a/src/v1/stage0/src/gunbc_stage0_emitted_edge_admission.rs b/src/v1/stage0/src/gunbc_stage0_emitted_edge_admission.rs
index 751aae23e83..8ce61250c71 100644
--- a/src/v1/stage0/src/gunbc_stage0_emitted_edge_admission.rs
+++ b/src/v1/stage0/src/gunbc_stage0_emitted_edge_admission.rs
@@ -4,7 +4,8 @@
 use self::Stage0EmittedEdgeAdmission::*;
 use self::Stage0EmittedModuleOwner::*;
 use crate::gunbc_rust_emitted_edge::EmittedEdgeProvenance::{
-    ReexportFacade, RuntimePrelude, SemanticSourceReference,
+    DeclaredImport, InlinePathReference, ReexportFacade, RuntimePrelude, SemanticSourceReference,
+    ServiceRuntimeSurface,
 };
 use crate::gunbc_rust_emitted_edge::EmittedEdgeTarget::{
     EmittedCrateRootTarget, EmittedModuleTarget,
@@ -430,6 +431,9 @@ pub fn stage0_emitted_edge_provenance_name(provenance: EmittedEdgeProvenance) ->
         EmittedEdgeProvenance::RuntimePrelude => "runtime-prelude".to_string(),
         EmittedEdgeProvenance::ReexportFacade => "reexport-facade".to_string(),
         EmittedEdgeProvenance::SemanticSourceReference => "semantic-source-reference".to_string(),
+        EmittedEdgeProvenance::DeclaredImport => "declared-import".to_string(),
+        EmittedEdgeProvenance::InlinePathReference => "inline-path-reference".to_string(),
+        EmittedEdgeProvenance::ServiceRuntimeSurface => "service-runtime-surface".to_string(),
     }
 }
 
diff --git a/src/v1/stage0/src/gunbc_stage0_partition_package_graph.rs b/src/v1/stage0/src/gunbc_stage0_partition_package_graph.rs
index 6c5627b08b8..3892bf39698 100644
--- a/src/v1/stage0/src/gunbc_stage0_partition_package_graph.rs
+++ b/src/v1/stage0/src/gunbc_stage0_partition_package_graph.rs
@@ -3,7 +3,8 @@
 
 pub use crate::gunbc_stage0_crate_partition_generated::generated_partition_crate_rows;
 use crate::gunbc_stage0_crate_partition_generated::GeneratedPartitionCrateKind::{
-    GeneratedEmitCoreCrate, GeneratedFoundationCrate, GeneratedLayeredCoreCrate,
+    GeneratedEmitCoreCrate, GeneratedFacadeCrate, GeneratedFoundationCrate,
+    GeneratedLayeredCoreCrate,
 };
 pub use crate::gunbc_stage0_crate_partition_generated::{
     GeneratedPartitionCrateKind, GeneratedPartitionCrateRow,
@@ -23,6 +24,7 @@ use std::rc::Rc;
 pub fn stage0_partition_row_is_module_bearing_package(row: Rc<GeneratedPartitionCrateRow>) -> bool {
     match row.kind.clone() {
         GeneratedPartitionCrateKind::GeneratedEmitCoreCrate => false,
+        GeneratedPartitionCrateKind::GeneratedFacadeCrate => false,
         GeneratedPartitionCrateKind::GeneratedFoundationCrate => true,
         GeneratedPartitionCrateKind::GeneratedLayeredCoreCrate => true,
     }
@@ -71,6 +73,9 @@ pub fn partition_package_dependency_names_over(
         GeneratedPartitionCrateKind::GeneratedEmitCoreCrate => {
             partition_module_bearing_package_names_over(rows.clone())
         }
+        GeneratedPartitionCrateKind::GeneratedFacadeCrate => {
+            partition_module_bearing_package_names_over(rows.clone())
+        }
     }
 }
 
diff --git a/src/v1/stage0/src/gunbc_structural_realization_bindings.rs b/src/v1/stage0/src/gunbc_structural_realization_bindings.rs
index 7b3cf231f9b..816fabcd2c6 100644
--- a/src/v1/stage0/src/gunbc_structural_realization_bindings.rs
+++ b/src/v1/stage0/src/gunbc_structural_realization_bindings.rs
@@ -111,6 +111,8 @@ pub fn kernel_grounding_rows() -> Rc<Vec<Rc<KernelGrounding>>> {
                 Rc::new(vec![Rc::new(KernelGrounding {
         source_kind: LiteralSourceKind::KernelIntLiteral,
         carrier: crate::std_decl_ref::decl_ref("std.nat".to_string(), "Nat".to_string()),
+        min: Some(0),
+        max: std::option::Option::None,
     })])
             };
         }
diff --git a/src/v1/stage0/src/lib.rs b/src/v1/stage0/src/lib.rs
index c43efec98d3..721c78cff9b 100644
--- a/src/v1/stage0/src/lib.rs
+++ b/src/v1/stage0/src/lib.rs
@@ -125,6 +125,28 @@ pub mod gunbc_cli_dispatch_surface;
     suspicious_double_ref_op,
     clippy::all
 )]
+pub mod gunbc_crate_partition;
+#[allow(
+    unused_imports,
+    unused_variables,
+    unused_mut,
+    unused_parens,
+    dead_code,
+    non_shorthand_field_patterns,
+    suspicious_double_ref_op,
+    clippy::all
+)]
+pub mod gunbc_emitted_crate_workspace;
+#[allow(
+    unused_imports,
+    unused_variables,
+    unused_mut,
+    unused_parens,
+    dead_code,
+    non_shorthand_field_patterns,
+    suspicious_double_ref_op,
+    clippy::all
+)]
 pub mod gunbc_namespace_reference_derived_closure_admission;
 #[allow(
     unused_imports,
@@ -488,6 +510,17 @@ pub mod v1_compiler_emit_rust;
     suspicious_double_ref_op,
     clippy::all
 )]
+pub mod v1_compiler_emitted_workspace;
+#[allow(
+    unused_imports,
+    unused_variables,
+    unused_mut,
+    unused_parens,
+    dead_code,
+    non_shorthand_field_patterns,
+    suspicious_double_ref_op,
+    clippy::all
+)]
 pub mod v1_compiler_expected_red_roster_join;
 #[allow(
     unused_imports,
diff --git a/src/v1/stage0/src/main.rs b/src/v1/stage0/src/main.rs
index afe2583a7e3..bc397edfea0 100644
--- a/src/v1/stage0/src/main.rs
+++ b/src/v1/stage0/src/main.rs
@@ -73,7 +73,7 @@ enum RetainedCommands {
         #[arg(long)]
         claim_run: bool,
         /// Named argument for the entry function, repeatable: `--arg name=value`.
-        /// Values enter as String; a missing `=` refuses rather than guessing.
+        /// Bound against the parameter's resolved type identity: kernel String, Int, and Bool, and std.types NonEmptyStr (String where string_non_empty). Other types refuse.
         #[arg(long = "arg")]
         args: Vec<String>,
     },
@@ -147,13 +147,16 @@ fn is_cargo_target_output_dir(parent: &std::path::Path, child: &std::path::Path)
 /// RUNG, HONESTLY: this restores a guard, it does not prove a live bug -- `find target -name
 /// '*.dag'` returns 0 in this worktree today. The hazard is evidenced by the deleted code's own
 /// comment naming its case: a corpus copy under `target/func_env_semantic_baseline_corpus/dag/**`.
-fn collect_dag_files(dir: &std::path::Path, files: &mut Vec<std::path::PathBuf>) {
-    cli_run::derived_row_roster::ensure_if_row_dir_or_panic(dir);
+fn collect_dag_files(
+    dir: &std::path::Path,
+    files: &mut Vec<cli_run::derived_row_roster::AcquiredDag>,
+) {
     let mut entries: Vec<_> = std::fs::read_dir(dir)
         .unwrap_or_else(|e| panic!("failed to read dir {:?}: {}", dir, e))
         .map(|e| e.unwrap_or_else(|e| panic!("failed to read dir entry in {:?}: {}", dir, e)))
         .collect();
     entries.sort_by_key(|e| e.file_name());
+    let mut here = Vec::new();
     for entry in entries {
         let path = entry.path();
         if path.is_dir() {
@@ -162,9 +165,12 @@ fn collect_dag_files(dir: &std::path::Path, files: &mut Vec<std::path::PathBuf>)
             }
             collect_dag_files(&path, files);
         } else if path.extension().map(|e| e == "dag").unwrap_or(false) {
-            files.push(path);
+            here.push(path);
         }
     }
+    files.extend(
+        cli_run::derived_row_roster::acquire_dir_files(dir, here).unwrap_or_else(|e| panic!("{e}")),
+    );
 }
 
 #[derive(Clone, Copy, PartialEq, Eq)]
@@ -272,6 +278,11 @@ enum OutputWriteRefusal {
         path: String,
         cause: String,
     },
+    /// A Rust emission is written as its partitioned Cargo workspace, and the writer refused.
+    WorkspaceNotWritten {
+        path: String,
+        cause: String,
+    },
 }
 
 impl std::fmt::Display for OutputWriteRefusal {
@@ -293,6 +304,12 @@ impl std::fmt::Display for OutputWriteRefusal {
             Self::FileNotWritten { path, cause } => {
                 write!(f, "could not write {path}: {cause}")
             }
+            Self::WorkspaceNotWritten { path, cause } => {
+                write!(
+                    f,
+                    "could not write the emitted Rust workspace at {path}: {cause}"
+                )
+            }
         }
     }
 }
@@ -323,6 +340,29 @@ fn write_output_files(
     output_dir: &str,
     result: &v1_compiler::v1_compiler_compile::PipelineResult,
 ) -> Result<(), OutputWriteRefusal> {
+    // A RUST EMISSION NAMES ITS CRATE AND OWNS NO MANIFEST: its layout is the partition plan's,
+    // written by the one workspace writer every emitted-Rust route uses. The top package sits at
+    // `output_dir`, so a reader finds Cargo.toml, src/lib.rs and src/main.rs where a crate is.
+    if let (1, Some(rust_crate)) = (result.rust_crates.len(), result.rust_crates.front()) {
+        if let Err(e) = std::fs::create_dir_all(output_dir) {
+            return Err(OutputWriteRefusal::OutputDirectoryNotCreated {
+                path: output_dir.to_string(),
+                cause: e.to_string(),
+            });
+        }
+        return v1_compiler::cli_run::write_emitted_workspace(
+            &result.files,
+            &result.emitted_edges,
+            &result.rust_crates,
+            std::path::Path::new(output_dir),
+            &rust_crate.crate_name,
+        )
+        .map(|_| ())
+        .map_err(|cause| OutputWriteRefusal::WorkspaceNotWritten {
+            path: output_dir.to_string(),
+            cause,
+        });
+    }
     let src_dir = format!("{}/src", output_dir);
     if let Err(e) = std::fs::create_dir_all(&src_dir) {
         return Err(OutputWriteRefusal::OutputDirectoryNotCreated {
@@ -656,8 +696,10 @@ fn retained_dispatch(command: RetainedCommands, dry_run: bool) -> ! {
                 let mut dag_paths = Vec::new();
                 collect_dag_files(std::path::Path::new(&dir), &mut dag_paths);
                 let mut sources = Vec::new();
-                for path in &dag_paths {
-                    let content = std::fs::read_to_string(path)
+                for source in &dag_paths {
+                    let path = source.path();
+                    let content = source
+                        .read()
                         .unwrap_or_else(|e| panic!("failed to read {:?}: {}", path, e));
                     let filename = path.file_name().unwrap().to_string_lossy().to_string();
                     sources.push(Rc::new(v1_compiler_compile::SourceFile {
@@ -1048,21 +1090,8 @@ mod tests {
 /// driver's subject.
 /// A missing `=` REFUSES with the offending spec rather than guessing a positional —
 /// the deleted handler's own rule, kept because it is right, not because it was there.
-fn decode_run_args(
-    raw: &[String],
-) -> Result<Vec<(Option<String>, v1_compiler::v1_interpreter::Value)>, String> {
-    raw.iter()
-        .map(|spec| match spec.split_once('=') {
-            Some((name, value)) if !name.is_empty() => Ok((
-                Some(name.to_string()),
-                v1_compiler::v1_interpreter::str_value(value),
-            )),
-            _ => Err(format!(
-                "--arg expects name=value, got `{spec}` (a missing `=` is refused, not \
-                 interpreted as a positional argument)"
-            )),
-        })
-        .collect()
+fn decode_run_args(raw: &[String]) -> Result<Vec<(String, String)>, String> {
+    cli_run::parse_run_arg_specs(raw)
 }
 
 /// `gunbc run` -- argv -> modeled intent -> the RETAINED resolve/eval engine -> exit code.
@@ -1422,11 +1451,19 @@ fn run_one_function(
     ctx: &v1_compiler::v1_interpreter::InterpContext,
     function: &str,
     entry_file: &str,
-    run_args: &[(Option<String>, v1_compiler::v1_interpreter::Value)],
+    run_args: &[(String, String)],
     claim_run: bool,
 ) -> Verdict {
-    match v1_compiler::v1_interpreter::run_in_context_with_args(ctx, function, run_args, !claim_run)
-    {
+    let bound = match cli_run::bind_run_args_for_entry(ctx, function, run_args) {
+        Ok(bound) => bound,
+        Err(message) => {
+            return Verdict {
+                status: 2,
+                message: Some(format!("error: {message}")),
+            };
+        }
+    };
+    match v1_compiler::v1_interpreter::run_in_context_with_args(ctx, function, &bound, !claim_run) {
         // A claim run's Bool is the verdict: false is a FAILED claim, exit 1. Outside a
         // claim run a Bool is an ordinary value and says nothing about success.
         Ok(v1_compiler::v1_interpreter::Value::Bool(false)) if claim_run => Verdict {
diff --git a/src/v1/stage0/src/memory_governor.rs b/src/v1/stage0/src/memory_governor.rs
index 3f38f189c31..bc9eadf2827 100644
--- a/src/v1/stage0/src/memory_governor.rs
+++ b/src/v1/stage0/src/memory_governor.rs
@@ -1218,17 +1218,10 @@ pub fn host_budget_unreadable_reason() -> String {
     )
 }
 
-/// Resolve the host budget from OBSERVATIONS, so every arm — including the refusal — is
-/// reachable from a test on any machine. `read_host_budget_resolution` is this function
-/// applied to the real reads; nothing else composes the precedence.
-///
-/// The effective planning ceiling is the minimum of the operator request and every observed
-/// applicable cgroup line. An operator request alone is `DeclaredUnverified`: an integer in an
-/// environment variable constrains no allocation and is not evidence of executor provisioning.
-/// There is no meminfo arm: MemAvailable and MemTotal describe a MACHINE, and
-/// on a kernel that can express a private limit, substituting one for the limit this process
-/// failed to read is DESIGN §5's absorbing fallback (answering with a superset). Authority:
-/// `gunbc.host_budget_source` `host_budget_source_admissible_as_bound_on_kernel`.
+/// Typed view of `v1_rt::resolve_host_budget_join`. That function is the one composer
+/// (`gunbc.host_budget_source`); this maps its result onto `HostBudgetResolution` so
+/// existing governor consumers keep a typed source. Tests plant observations here
+/// and still exercise the runtime join.
 pub fn resolve_host_budget(
     env_override: Option<u64>,
     cgroup_high: Option<(String, u64)>,
@@ -1236,99 +1229,94 @@ pub fn resolve_host_budget(
     cgroup_v1_limit: Option<(String, CgroupV1MemoryLimitValue)>,
     darwin_physical: Option<u64>,
 ) -> HostBudgetResolution {
-    // A v1 memory hierarchy holds this process but its limit could not be read: that limit may
-    // be the tightest one, so no other observation may stand in for it (DESIGN §5).
-    let cgroup_v1_limit = match cgroup_v1_limit {
-        Some((dir, CgroupV1MemoryLimitValue::Unparseable(body))) => {
-            return HostBudgetResolution::Unreadable {
-                reason: format!(
-                    "cgroup v1 memory hierarchy at {dir} holds this process but its \
-                     hierarchical_memory_limit is unreadable ({body}); a bound that may be the \
-                     tightest cannot be replaced by another reading"
-                ),
-            };
-        }
-        Some((dir, CgroupV1MemoryLimitValue::Limited(bytes))) => Some((dir, bytes)),
-        Some((_, CgroupV1MemoryLimitValue::Unlimited)) | None => None,
-    };
-    // Every observed process-scoped line is a candidate; the tightest one is the planning
-    // ceiling. On a hybrid host the unified hierarchy carries no memory files, so the v2 and
-    // v1 readings do not normally coexist; when they do, the minimum is still the honest bound.
-    let observation = [
-        cgroup_high.map(|(cgroup_dir, b)| (HostBudgetSource::CgroupMemoryHigh { cgroup_dir }, b)),
-        cgroup_max.map(|(cgroup_dir, b)| (HostBudgetSource::CgroupMemoryMax { cgroup_dir }, b)),
-        cgroup_v1_limit.map(|(cgroup_dir, b)| {
-            (
-                HostBudgetSource::CgroupV1HierarchicalMemoryLimit { cgroup_dir },
-                b,
-            )
-        }),
-    ]
-    .into_iter()
-    .flatten()
-    .fold(None::<(HostBudgetSource, u64)>, |best, cand| match best {
-        Some(cur) if cur.1 <= cand.1 => Some(cur),
-        _ => Some(cand),
+    let v1 = cgroup_v1_limit.map(|(dir, v)| {
+        (
+            dir,
+            match v {
+                CgroupV1MemoryLimitValue::Limited(bytes) => {
+                    crate::v1_rt::HostBudgetCgroupV1::Limited(bytes)
+                }
+                CgroupV1MemoryLimitValue::Unlimited => crate::v1_rt::HostBudgetCgroupV1::Unlimited,
+                CgroupV1MemoryLimitValue::Unparseable(body) => {
+                    crate::v1_rt::HostBudgetCgroupV1::Unparseable(body)
+                }
+            },
+        )
     });
-    if let Some((source, observed_bytes)) = observation {
-        return HostBudgetResolution::Resolved {
-            effective_bytes: env_override
-                .map(|requested| requested.min(observed_bytes))
-                .unwrap_or(observed_bytes),
-            requested_bytes: env_override,
+    match crate::v1_rt::resolve_host_budget_join(
+        env_override,
+        cgroup_high,
+        cgroup_max,
+        v1,
+        darwin_physical,
+    ) {
+        crate::v1_rt::HostBudgetJoin::Resolved {
+            effective_bytes,
+            requested_bytes,
+            source,
+            observed_bytes,
+        } => HostBudgetResolution::Resolved {
+            effective_bytes,
+            requested_bytes,
             observation: HostBudgetObservation {
-                source,
+                source: match source {
+                    crate::v1_rt::HostBudgetJoinSource::CgroupMemoryHigh { cgroup_dir } => {
+                        HostBudgetSource::CgroupMemoryHigh { cgroup_dir }
+                    }
+                    crate::v1_rt::HostBudgetJoinSource::CgroupMemoryMax { cgroup_dir } => {
+                        HostBudgetSource::CgroupMemoryMax { cgroup_dir }
+                    }
+                    crate::v1_rt::HostBudgetJoinSource::CgroupV1HierarchicalMemoryLimit {
+                        cgroup_dir,
+                    } => HostBudgetSource::CgroupV1HierarchicalMemoryLimit { cgroup_dir },
+                    crate::v1_rt::HostBudgetJoinSource::DarwinPhysicalMemory => {
+                        HostBudgetSource::DarwinPhysicalMemory
+                    }
+                },
                 bytes: observed_bytes,
             },
-        };
-    }
-    // Darwin only. `darwin_physical_memory_bytes` is `None` on every other target, so this
-    // arm cannot be reached on a kernel that has cgroups — which is precisely the wall
-    // `host_budget_source_admissible_as_bound_on_kernel` states: a host-shared reading may
-    // serve as the budget only where no private-limit mechanism exists.
-    if let Some(bytes) = darwin_physical {
-        return HostBudgetResolution::Resolved {
-            effective_bytes: env_override
-                .map(|requested| requested.min(bytes))
-                .unwrap_or(bytes),
-            requested_bytes: env_override,
-            observation: HostBudgetObservation {
-                source: HostBudgetSource::DarwinPhysicalMemory,
-                bytes,
-            },
-        };
-    }
-    if let Some(requested_bytes) = env_override {
-        return HostBudgetResolution::DeclaredUnverified {
+        },
+        crate::v1_rt::HostBudgetJoin::DeclaredUnverified {
             requested_bytes,
-            reason: "no observed private memory.high or memory.max verifies the executor allowance; the declaration is a planning request, not an enforced process limit".to_string(),
-        };
-    }
-    HostBudgetResolution::Unreadable {
-        reason: host_budget_unreadable_reason(),
+            reason,
+        } => HostBudgetResolution::DeclaredUnverified {
+            requested_bytes,
+            reason,
+        },
+        crate::v1_rt::HostBudgetJoin::Unreadable { reason } => {
+            HostBudgetResolution::Unreadable { reason }
+        }
     }
 }
 
-/// The host memory planning ceiling, as a typed resolution. It does not cap RSS. Single authority shared
-/// by the MemoryGovernor (which SCHEDULES against it), the typed-module cache cap (which
-/// bounds an estimated ENTRY COUNT with it) and the P4 realize advisory (which PREDICTS against it) — no
-/// consumer may re-read a partial version of this precedence (§3 single authority).
+/// The host memory planning ceiling, as a typed resolution. Live observations and
+/// precedence are `v1_rt::resolve_host_budget_join`; this is the typed wrapper.
 pub fn read_host_budget_resolution() -> HostBudgetResolution {
     let env_override = std::env::var("GUNBC_MEMORY_BUDGET_BYTES")
         .ok()
         .and_then(|s| s.trim().parse::<u64>().ok());
-    let cgroup_high = binding_high_cgroup_dir().and_then(|dir| {
-        read_cgroup_u64(&dir, "memory.high").map(|v| (dir.display().to_string(), v))
-    });
-    let cgroup_max = binding_cap_cgroup_dir().and_then(|dir| {
-        read_cgroup_u64(&dir, "memory.max").map(|v| (dir.display().to_string(), v))
+    let cgroup_high = crate::v1_rt::host_budget_tightest_cgroup("memory.high");
+    let cgroup_max = crate::v1_rt::host_budget_tightest_cgroup("memory.max");
+    let cgroup_v1_limit = crate::v1_rt::host_budget_cgroup_v1().map(|(dir, v)| {
+        (
+            dir,
+            match v {
+                crate::v1_rt::HostBudgetCgroupV1::Limited(bytes) => {
+                    CgroupV1MemoryLimitValue::Limited(bytes)
+                }
+                crate::v1_rt::HostBudgetCgroupV1::Unlimited => CgroupV1MemoryLimitValue::Unlimited,
+                crate::v1_rt::HostBudgetCgroupV1::Unparseable(body) => {
+                    CgroupV1MemoryLimitValue::Unparseable(body)
+                }
+            },
+        )
     });
     resolve_host_budget(
         env_override,
         cgroup_high,
         cgroup_max,
-        read_cgroup_v1_hierarchical_limit(),
-        darwin_physical_memory_bytes(),
+        cgroup_v1_limit,
+        crate::v1_rt::host_budget_darwin_physical(),
     )
 }
 
@@ -1387,29 +1375,8 @@ pub fn tightest_cgroup_dir_for(limit_file: &str) -> Option<PathBuf> {
 /// `tightest_cgroup_dir_for` over supplied `/proc/self/cgroup` content and unified mount root,
 /// so a fixture hierarchy exercises the same walk.
 pub fn tightest_cgroup_dir_under(self_cg: &str, root: &Path, limit_file: &str) -> Option<PathBuf> {
-    let rel = self_cg
-        .lines()
-        .find_map(|l| l.strip_prefix("0::"))
-        .map(|p| p.trim().trim_start_matches('/').to_string())?;
-    let mut dir = root.join(&rel);
-    let mut best: Option<(u64, PathBuf)> = None;
-    loop {
-        if let Ok(s) = std::fs::read_to_string(dir.join(limit_file)) {
-            let s = s.trim();
-            if s != "max" {
-                if let Ok(v) = s.parse::<u64>() {
-                    let take = best.as_ref().map(|(cur, _)| v < *cur).unwrap_or(true);
-                    if take {
-                        best = Some((v, dir.clone()));
-                    }
-                }
-            }
-        }
-        if dir == root || !dir.pop() {
-            break;
-        }
-    }
-    best.map(|(_, d)| d)
+    crate::v1_rt::host_budget_tightest_cgroup_under(self_cg, root, limit_file)
+        .map(|(dir, _)| PathBuf::from(dir))
 }
 
 /// The process's own deepest (leaf) cgroup from `/proc/self/cgroup`.
@@ -1453,41 +1420,13 @@ pub fn memory_pressure_some_avg10(content: &str) -> Option<String> {
 /// mounted, the process has no line on it, or its path is outside the mounted subtree — each of
 /// which leaves the budget to the other sources or to `Unreadable`, never to a guess.
 pub fn cgroup_v1_memory_dir(self_cg: &str, mountinfo: &str) -> Option<PathBuf> {
-    let (mount_root, mount_point) = mountinfo.lines().find_map(|line| {
-        let fields: Vec<&str> = line.split(' ').collect();
-        let dash = fields.iter().position(|f| *f == "-")?;
-        let fstype = fields.get(dash + 1)?;
-        let super_opts = fields.get(dash + 3)?;
-        if *fstype == "cgroup" && super_opts.split(',').any(|o| o == "memory") {
-            Some((fields.get(3)?.to_string(), fields.get(4)?.to_string()))
-        } else {
-            None
-        }
-    })?;
-    let path = self_cg.lines().find_map(|l| {
-        let mut parts = l.splitn(3, ':');
-        let (_id, controllers, path) = (parts.next()?, parts.next()?, parts.next()?);
-        controllers
-            .split(',')
-            .any(|c| c == "memory")
-            .then(|| path.trim().to_string())
-    })?;
-    let rel = if mount_root == "/" {
-        path.as_str()
-    } else {
-        let rest = path.strip_prefix(mount_root.as_str())?;
-        if !(rest.is_empty() || rest.starts_with('/')) {
-            return None;
-        }
-        rest
-    };
-    Some(Path::new(&mount_point).join(rel.trim_start_matches('/')))
+    crate::v1_rt::host_budget_cgroup_v1_memory_dir(self_cg, mountinfo).map(PathBuf::from)
 }
 
 /// Mirror of `extdeps.linux.cgroup_v1_memory` `cgroup_v1_unlimited_bytes`: the kernel's
 /// PAGE_COUNTER_MAX (LONG_MAX / PAGE_SIZE) reported in bytes, so the sentinel follows the page size.
 pub fn cgroup_v1_unlimited_bytes(page_size: u64) -> u64 {
-    (i64::MAX as u64 / page_size) * page_size
+    crate::v1_rt::host_budget_cgroup_v1_unlimited_bytes(page_size)
 }
 
 /// Mirror of `extdeps.linux.cgroup_v1_memory` `CgroupV1MemoryLimitValue`: three states, because
@@ -1504,20 +1443,14 @@ pub fn cgroup_v1_hierarchical_limit_from_stat(
     memory_stat: &str,
     page_size: u64,
 ) -> CgroupV1MemoryLimitValue {
-    let hits: Vec<&str> = memory_stat
-        .lines()
-        .filter_map(|l| l.trim().strip_prefix("hierarchical_memory_limit "))
-        .collect();
-    let [body] = hits.as_slice() else {
-        return CgroupV1MemoryLimitValue::Unparseable(memory_stat.to_string());
-    };
-    match body.trim().parse::<i128>() {
-        Ok(n) if n < 0 => CgroupV1MemoryLimitValue::Unparseable(body.to_string()),
-        Ok(n) if n >= cgroup_v1_unlimited_bytes(page_size) as i128 => {
-            CgroupV1MemoryLimitValue::Unlimited
+    match crate::v1_rt::host_budget_cgroup_v1_from_stat(memory_stat, page_size) {
+        crate::v1_rt::HostBudgetCgroupV1::Limited(bytes) => {
+            CgroupV1MemoryLimitValue::Limited(bytes)
+        }
+        crate::v1_rt::HostBudgetCgroupV1::Unlimited => CgroupV1MemoryLimitValue::Unlimited,
+        crate::v1_rt::HostBudgetCgroupV1::Unparseable(body) => {
+            CgroupV1MemoryLimitValue::Unparseable(body)
         }
-        Ok(n) => CgroupV1MemoryLimitValue::Limited(n as u64),
-        Err(_) => CgroupV1MemoryLimitValue::Unparseable(body.to_string()),
     }
 }
 
@@ -1531,27 +1464,41 @@ pub fn cgroup_v1_hierarchical_limit_under(
     mountinfo: &str,
     page_size: u64,
 ) -> Option<(String, CgroupV1MemoryLimitValue)> {
-    let dir = cgroup_v1_memory_dir(self_cg, mountinfo)?;
-    let dir = fs_root.join(dir.strip_prefix("/").unwrap_or(&dir));
-    let value = match std::fs::read_to_string(dir.join("memory.stat")) {
-        Ok(stat) => cgroup_v1_hierarchical_limit_from_stat(&stat, page_size),
-        Err(e) => CgroupV1MemoryLimitValue::Unparseable(format!("memory.stat: {e}")),
-    };
-    Some((dir.display().to_string(), value))
+    crate::v1_rt::host_budget_cgroup_v1_under(fs_root, self_cg, mountinfo, page_size).map(
+        |(dir, v)| {
+            (
+                dir,
+                match v {
+                    crate::v1_rt::HostBudgetCgroupV1::Limited(bytes) => {
+                        CgroupV1MemoryLimitValue::Limited(bytes)
+                    }
+                    crate::v1_rt::HostBudgetCgroupV1::Unlimited => {
+                        CgroupV1MemoryLimitValue::Unlimited
+                    }
+                    crate::v1_rt::HostBudgetCgroupV1::Unparseable(body) => {
+                        CgroupV1MemoryLimitValue::Unparseable(body)
+                    }
+                },
+            )
+        },
+    )
 }
 
 pub fn read_cgroup_v1_hierarchical_limit() -> Option<(String, CgroupV1MemoryLimitValue)> {
-    let self_cg = std::fs::read_to_string("/proc/self/cgroup").ok()?;
-    let mountinfo = std::fs::read_to_string("/proc/self/mountinfo").ok()?;
-    // SAFETY: sysconf has no preconditions.
-    let page_size = unsafe { libc::sysconf(libc::_SC_PAGESIZE) };
-    if page_size <= 0 {
-        return Some((
-            "/proc/self/mountinfo".to_string(),
-            CgroupV1MemoryLimitValue::Unparseable("sysconf(_SC_PAGESIZE) unreadable".to_string()),
-        ));
-    }
-    cgroup_v1_hierarchical_limit_under(Path::new("/"), &self_cg, &mountinfo, page_size as u64)
+    crate::v1_rt::host_budget_cgroup_v1().map(|(dir, v)| {
+        (
+            dir,
+            match v {
+                crate::v1_rt::HostBudgetCgroupV1::Limited(bytes) => {
+                    CgroupV1MemoryLimitValue::Limited(bytes)
+                }
+                crate::v1_rt::HostBudgetCgroupV1::Unlimited => CgroupV1MemoryLimitValue::Unlimited,
+                crate::v1_rt::HostBudgetCgroupV1::Unparseable(body) => {
+                    CgroupV1MemoryLimitValue::Unparseable(body)
+                }
+            },
+        )
+    })
 }
 
 pub fn read_cgroup_u64(dir: &Path, file: &str) -> Option<u64> {
@@ -1575,32 +1522,8 @@ pub fn read_cgroup_raw(dir: &Path, file: &str) -> Option<String> {
 ///
 /// Exists because the governor previously had NO source on Darwin and fell back to the most
 /// permissive cap it could name; macOS's memory facts were never asked for.
-#[cfg(target_os = "macos")]
-pub fn darwin_physical_memory_bytes() -> Option<u64> {
-    let name = c"hw.memsize";
-    let mut value: u64 = 0;
-    let mut len: libc::size_t = std::mem::size_of::<u64>() as libc::size_t;
-    // SAFETY: `name` is a NUL-terminated literal, `value`/`len` are live locals sized to
-    // match, and `newp`/`newlen` are null/0 for a read-only query per sysctl(3).
-    let rc = unsafe {
-        libc::sysctlbyname(
-            name.as_ptr(),
-            (&mut value as *mut u64).cast::<libc::c_void>(),
-            &mut len,
-            std::ptr::null_mut(),
-            0,
-        )
-    };
-    if rc == 0 && value > 0 {
-        Some(value)
-    } else {
-        None
-    }
-}
-
-#[cfg(not(target_os = "macos"))]
 pub fn darwin_physical_memory_bytes() -> Option<u64> {
-    None
+    crate::v1_rt::host_budget_darwin_physical()
 }
 
 /// The bind request an executor may carry, read from `GUNBC_BIND_MEMORY_CGROUP_BYTES`.
diff --git a/src/v1/stage0/src/namespace_baseline.rs b/src/v1/stage0/src/namespace_baseline.rs
index 7484ba98df1..2608a225e9f 100644
--- a/src/v1/stage0/src/namespace_baseline.rs
+++ b/src/v1/stage0/src/namespace_baseline.rs
@@ -1390,10 +1390,11 @@ pub(crate) fn reconstruct_base_index(
 
     // A DERIVED ARTIFACT IS NEVER IN THE DIFF, SO IT MUST NOT BE INHERITED FROM THE HEAD.
     // The baseline is reconstructed by carrying every head record the diff did not touch and
-    // re-reading the rest from the base tree. `roster.dag` is gitignored and written on the read
-    // path, so the diff can never name it — and carrying it made the HEAD's roster stand as the
-    // BASE's. Its base side is not read from git either (the tree does not carry it); it is
-    // DERIVED from the base tree's row membership, below, by the same renderer the writer uses.
+    // re-reading the rest from the base tree. The roster module has no file -- source acquisition
+    // contributes it in memory -- so the diff can never name it, and carrying it made the HEAD's
+    // roster stand as the BASE's. Its base side is not read from git either (the tree does not carry
+    // it, unless the base predates the derived fold); it is DERIVED from the base tree's row
+    // membership, below, by the same renderer head acquisition uses.
     //
     // CARRYING UNTOUCHED HEAD RECORDS IS VALID ONLY WHILE THE GRAMMARS AGREE. The reconstruction
     // below keeps every head record the diff did not touch, which assumes an untouched FILE has an
@@ -1531,7 +1532,7 @@ pub(crate) fn reconstruct_base_index(
     let _ = std::fs::remove_dir_all(&base_tree);
 
     // THE DERIVED ROSTER'S BASE SIDE, from the base tree's row membership. `base_paths` is the
-    // authoritative listing already in hand, so this asks the same question the writer asks of a
+    // authoritative listing already in hand, so this asks the same question head acquisition asks of a
     // directory. A base tree carrying no row files under that root has no roster module at all,
     // and `roster_from_path_listing` answers `None` rather than fabricating a present empty list.
     let base_path_refs: Vec<&str> = base_paths.iter().map(|p| p.as_str()).collect();
@@ -1547,7 +1548,7 @@ pub(crate) fn reconstruct_base_index(
             continue;
         }
         // Membership is selected by declared type, so the base side reads each listed row file's
-        // content at the base -- the same question the writer asks of the head's files.
+        // content at the base -- the same question head acquisition asks of the head's files.
         let content = match crate::cli_run::derived_row_roster::roster_from_path_listing(
             &record.rel_path,
             base_path_refs.iter().copied(),
@@ -1561,7 +1562,7 @@ pub(crate) fn reconstruct_base_index(
             Err(reason) => return Ok(BaselineReconstruction::NotEvaluated { reason }),
         };
         // SYNTHESIZED BY THE CURRENT RENDERER, SO PARSED UNDER THE CURRENT GRAMMAR. This content is
-        // not bytes read from the base tree; it is new source the head's roster writer produced from
+        // not bytes read from the base tree; it is new source the head's roster renderer produced from
         // the base tree's path membership. The base environment is reserved for bytes that actually
         // came out of the base revision -- sending renderer output through an older grammar could
         // refuse text no historical source ever carried.
diff --git a/src/v1/stage0/src/required_regen_host.rs b/src/v1/stage0/src/required_regen_host.rs
index 6a089b2999c..a5606ab5ef5 100644
--- a/src/v1/stage0/src/required_regen_host.rs
+++ b/src/v1/stage0/src/required_regen_host.rs
@@ -2979,6 +2979,8 @@ pub struct RegenRoundCostOutcome {
 }
 
 pub const REGEN_ROUND_COST_RECEIPT_REL: &str = "target/stage0-regen-round-cost.txt";
+/// Set on the single re-exec after the seed build replaced the running executable.
+const REGEN_ROUND_COST_REEXEC_ENV: &str = "GUNBC_REGEN_ROUND_COST_REEXEC";
 const REGEN_ROUND_COST_PRODUCER: &str = "claim_executor --regen-round-cost";
 const REGEN_ROUND_COST_ENTRY_UNDER_ROOT: &str = "gunbc/regen_round_cost.dag";
 
@@ -3699,6 +3701,235 @@ fn journal_stage0_paths_for_subject(
     fs::write(&manifest_path, bytes).map_err(|e| format!("write {}: {e}", manifest_path.display()))
 }
 
+/// The seed build's cost as observed by one process image.
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct SeedBuildCost {
+    compiled_crates: u64,
+    wall_ms: u64,
+    /// `None` is `gunbc.regen_round_cost` `CpuUnreadable`, never zero.
+    cpu_ms: Option<u64>,
+}
+
+/// What the replaced image hands to the built one: its seed-build cost, the source identity it
+/// built (HEAD plus the digest of the uncommitted tracked diff: a dirty tree stays legal, a
+/// same-commit source change is visible), and the digest of the artifact it built.
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct SeedHandoff {
+    cost: SeedBuildCost,
+    source: String,
+    built_exe: String,
+}
+
+/// Why the seed handoff refuses. Standing: runtime mitigation (guarantee-ladder rung 1) -- a
+/// typed refusal at the point the invalid state is observed; the invalid state stays writable.
+#[derive(Clone, Debug, PartialEq, Eq)]
+enum SeedHandoffRefusal {
+    /// The built image was replaced by another path replacement after the handoff. Claims
+    /// nothing about idempotence: only that the executable changed again.
+    ExecutableReplacedAfterHandoff {
+        before: String,
+        after: String,
+    },
+    /// The source the first image built is not the source this image sees (another commit, or
+    /// the same commit with a different uncommitted tracked diff).
+    SourceChangedAcrossHandoff {
+        carried: String,
+        observed: String,
+    },
+    /// The descriptor opened for the exec holds other bytes than the build produced.
+    OpenedTargetNotBuildOutput {
+        built: String,
+        opened: String,
+    },
+    /// This image is not the artifact the first image built.
+    WrongArtifactAcrossHandoff {
+        built: String,
+        running: String,
+    },
+    /// The composed ledger holds other than exactly one `round.seed_build` measurement, so the
+    /// carried cost cannot be added exactly once.
+    SeedBuildMeasurementCount {
+        found: usize,
+    },
+    /// The carried observation does not decode.
+    HandoffUndecodable {
+        value: String,
+    },
+    ReExecFailed {
+        path: String,
+        cause: String,
+    },
+}
+
+impl std::fmt::Display for SeedHandoffRefusal {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let p = REGEN_ROUND_COST_PRODUCER;
+        match self {
+            Self::ExecutableReplacedAfterHandoff { before, after } => write!(
+                f,
+                "refusal: ExecutableReplacedAfterHandoff: {p}: the seed build replaced the \
+                 running executable again after the one handoff ({before} -> {after}); the tree \
+                 is the carried one, so another path is replacing the executable"
+            ),
+            Self::SourceChangedAcrossHandoff { carried, observed } => write!(
+                f,
+                "refusal: SourceChangedAcrossHandoff: {p}: first image built source {carried}, \
+                 this image sees {observed}"
+            ),
+            Self::OpenedTargetNotBuildOutput { built, opened } => write!(
+                f,
+                "refusal: OpenedTargetNotBuildOutput: {p}: the build produced {built} but the \
+                 descriptor opened for the exec holds {opened}"
+            ),
+            Self::WrongArtifactAcrossHandoff { built, running } => write!(
+                f,
+                "refusal: WrongArtifactAcrossHandoff: {p}: first image built {built}, this \
+                 image is {running}"
+            ),
+            Self::SeedBuildMeasurementCount { found } => write!(
+                f,
+                "refusal: SeedBuildMeasurementCount: {p}: expected exactly one round.seed_build \
+                 measurement to receive the carried cost, found {found}"
+            ),
+            Self::HandoffUndecodable { value } => write!(
+                f,
+                "refusal: HandoffUndecodable: {p}: {REGEN_ROUND_COST_REEXEC_ENV}={value:?}"
+            ),
+            Self::ReExecFailed { path, cause } => write!(
+                f,
+                "refusal: ReExecFailed: {p}: the seed build replaced the running executable and \
+                 re-exec of {path} failed: {cause}"
+            ),
+        }
+    }
+}
+
+enum SeedHandoffDecision {
+    Proceed,
+    ReExec(SeedHandoff),
+}
+
+impl SeedHandoff {
+    fn encode(&self) -> String {
+        let cpu = self
+            .cost
+            .cpu_ms
+            .map_or("unreadable".to_string(), |c| c.to_string());
+        format!(
+            "crates={};wall_ms={};cpu_ms={};source={};built_exe={}",
+            self.cost.compiled_crates, self.cost.wall_ms, cpu, self.source, self.built_exe
+        )
+    }
+
+    fn decode(value: &str) -> Result<Self, SeedHandoffRefusal> {
+        let bad = || SeedHandoffRefusal::HandoffUndecodable {
+            value: value.to_string(),
+        };
+        let mut it = value.split(';').map(|kv| kv.split_once('='));
+        let mut field = |key: &str| -> Result<String, SeedHandoffRefusal> {
+            match it.next() {
+                Some(Some((k, v))) if k == key => Ok(v.to_string()),
+                _ => Err(bad()),
+            }
+        };
+        let compiled_crates = field("crates")?.parse::<u64>().map_err(|_| bad())?;
+        let wall_ms = field("wall_ms")?.parse::<u64>().map_err(|_| bad())?;
+        let cpu = field("cpu_ms")?;
+        let cpu_ms = if cpu == "unreadable" {
+            None
+        } else {
+            Some(cpu.parse::<u64>().map_err(|_| bad())?)
+        };
+        let source = field("source")?;
+        let built_exe = field("built_exe")?;
+        Ok(SeedHandoff {
+            cost: SeedBuildCost {
+                compiled_crates,
+                wall_ms,
+                cpu_ms,
+            },
+            source,
+            built_exe,
+        })
+    }
+
+    fn from_env() -> Result<Option<Self>, SeedHandoffRefusal> {
+        match std::env::var(REGEN_ROUND_COST_REEXEC_ENV) {
+            Ok(v) => Self::decode(&v).map(Some),
+            Err(std::env::VarError::NotPresent) => Ok(None),
+            Err(std::env::VarError::NotUnicode(v)) => Err(SeedHandoffRefusal::HandoffUndecodable {
+                value: v.to_string_lossy().into_owned(),
+            }),
+        }
+    }
+}
+
+fn decide_seed_handoff(
+    incoming: Option<&SeedHandoff>,
+    exe_before: &str,
+    exe_after: &str,
+    source: &str,
+    cost: &SeedBuildCost,
+) -> Result<SeedHandoffDecision, SeedHandoffRefusal> {
+    if let Some(h) = incoming {
+        if h.source != source {
+            return Err(SeedHandoffRefusal::SourceChangedAcrossHandoff {
+                carried: h.source.clone(),
+                observed: source.to_string(),
+            });
+        }
+        if h.built_exe != exe_before {
+            return Err(SeedHandoffRefusal::WrongArtifactAcrossHandoff {
+                built: h.built_exe.clone(),
+                running: exe_before.to_string(),
+            });
+        }
+        if exe_before != exe_after {
+            return Err(SeedHandoffRefusal::ExecutableReplacedAfterHandoff {
+                before: exe_before.to_string(),
+                after: exe_after.to_string(),
+            });
+        }
+        return Ok(SeedHandoffDecision::Proceed);
+    }
+    if exe_before == exe_after {
+        return Ok(SeedHandoffDecision::Proceed);
+    }
+    Ok(SeedHandoffDecision::ReExec(SeedHandoff {
+        cost: cost.clone(),
+        source: source.to_string(),
+        built_exe: exe_after.to_string(),
+    }))
+}
+
+/// Compose the carried pre-handoff seed build into this image's observation: crate count and
+/// the `round.seed_build` ledger row, summed exactly once. A carried CPU that is unreadable
+/// makes the composed CPU unreadable, never zero.
+fn compose_seed_build_cost(
+    carried: Option<&SeedBuildCost>,
+    this_image_crates: u64,
+    mut marks: std::vec::Vec<v1_rt::TraceLedgerRow>,
+) -> Result<(u64, std::vec::Vec<v1_rt::TraceLedgerRow>), SeedHandoffRefusal> {
+    let Some(c) = carried else {
+        return Ok((this_image_crates, marks));
+    };
+    let found = marks
+        .iter()
+        .filter(|r| r.label == "round.seed_build")
+        .count();
+    if found != 1 {
+        return Err(SeedHandoffRefusal::SeedBuildMeasurementCount { found });
+    }
+    for row in marks.iter_mut().filter(|r| r.label == "round.seed_build") {
+        row.wall_ms += c.wall_ms;
+        row.cpu_ms = match (row.cpu_ms, c.cpu_ms) {
+            (Some(a), Some(b)) => Some(a + b),
+            _ => None,
+        };
+    }
+    Ok((this_image_crates + c.compiled_crates, marks))
+}
+
 fn seed_cargo_build(workspace: &Path, label: &str) -> Result<CargoBuildObservation, String> {
     v1_rt::trace_mark(format!("{label}.begin"));
     let output = Command::new("cargo")
@@ -3752,12 +3983,103 @@ fn current_exe_on_disk() -> Result<PathBuf, String> {
     ))
 }
 
+/// Open the path ONCE and digest the bytes read through that descriptor. The returned file is
+/// the exec target: `/proc/self/fd/N` names this inode, so a later replacement of the path
+/// cannot make the executed image differ from the hashed one.
+fn open_exec_target(path: &Path) -> Result<(fs::File, String), String> {
+    let mut file = fs::File::open(path).map_err(|e| format!("open {}: {e}", path.display()))?;
+    let digest = digest_open_file(&mut file)?;
+    Ok((file, digest))
+}
+
+/// Admit the exec target: the carry keeps the BUILD-OUTPUT digest, and the opened descriptor's
+/// digest must equal it. Never overwrites the carry from the open.
+fn admit_exec_target(
+    carry: SeedHandoff,
+    opened_digest: &str,
+) -> Result<SeedHandoff, SeedHandoffRefusal> {
+    if carry.built_exe != opened_digest {
+        return Err(SeedHandoffRefusal::OpenedTargetNotBuildOutput {
+            built: carry.built_exe,
+            opened: opened_digest.to_string(),
+        });
+    }
+    Ok(carry)
+}
+
+/// Digest of the bytes of an open file, read from its start.
+fn digest_open_file(file: &mut fs::File) -> Result<String, String> {
+    use std::io::{Read, Seek};
+    file.rewind().map_err(|e| format!("rewind: {e}"))?;
+    let mut bytes = std::vec::Vec::new();
+    file.read_to_end(&mut bytes)
+        .map_err(|e| format!("read: {e}"))?;
+    Ok(bytes_digest(&bytes))
+}
+
+/// The RUNNING image: `/proc/self/exe` opened directly, no installed-pathname reopen and no
+/// ` (deleted)` strip. Three identities stay separate: the build output (`current_exe_digest`,
+/// the installed path), the opened exec target (`open_exec_target`, carried as `built_exe`),
+/// and this one.
+fn running_image_digest() -> Result<String, String> {
+    let mut file =
+        fs::File::open("/proc/self/exe").map_err(|e| format!("open /proc/self/exe: {e}"))?;
+    digest_open_file(&mut file)
+}
+
 fn current_exe_digest() -> Result<String, String> {
     let on_disk = current_exe_on_disk()?;
     let bytes = fs::read(&on_disk).map_err(|e| format!("read {}: {e}", on_disk.display()))?;
     Ok(bytes_digest(&bytes))
 }
 
+/// HEAD, the digest of the uncommitted tracked diff, and path+content digests of untracked,
+/// non-ignored files (a new module or source the build consumes).
+fn source_identity(workspace: &Path, head: &str) -> Result<String, String> {
+    let run = |args: &[&str]| -> Result<Vec<u8>, String> {
+        let output = Command::new("git")
+            .args(args)
+            .current_dir(workspace)
+            .output()
+            .map_err(|e| format!("git {}: {e}", args.join(" ")))?;
+        if !output.status.success() {
+            return Err(String::from_utf8_lossy(&output.stderr).to_string());
+        }
+        Ok(output.stdout)
+    };
+    let diff = run(&["diff", "HEAD", "--binary"])?;
+    let listing = run(&["ls-files", "--others", "--exclude-standard", "-z"])?;
+    let mut untracked = std::vec::Vec::new();
+    for rel in listing.split(|b| *b == 0).filter(|p| !p.is_empty()) {
+        use std::os::unix::ffi::OsStrExt;
+        let full = workspace.join(std::ffi::OsStr::from_bytes(rel));
+        let content = fs::read(&full).map_err(|e| format!("read {}: {e}", full.display()))?;
+        untracked.push((rel.to_vec(), content));
+    }
+    Ok(compose_source_identity(head, &diff, &mut untracked))
+}
+
+fn compose_source_identity(
+    head: &str,
+    tracked_diff: &[u8],
+    untracked: &mut [(std::vec::Vec<u8>, std::vec::Vec<u8>)],
+) -> String {
+    untracked.sort_by(|a, b| a.0.cmp(&b.0));
+    // Length-prefixed raw path bytes: no filename byte (`=`, newline, NUL) can move a
+    // boundary between entries.
+    let mut payload = std::vec::Vec::new();
+    for (path, content) in untracked.iter() {
+        payload.extend_from_slice(&(path.len() as u64).to_le_bytes());
+        payload.extend_from_slice(path);
+        payload.extend_from_slice(bytes_digest(content).as_bytes());
+    }
+    format!(
+        "{head}+{}+{}",
+        bytes_digest(tracked_diff),
+        bytes_digest(&payload)
+    )
+}
+
 fn git_tree_dirty(workspace: &Path) -> Result<bool, String> {
     let output = Command::new("git")
         .args(["status", "--porcelain", "--untracked-files=no"])
@@ -4350,8 +4672,8 @@ fn assembled_seed_modules(
             GeneratedFoundationCrate | GeneratedLayeredCoreCrate => {
                 host_shell_modules.extend(row.modules.iter().cloned());
             }
-            // Emit-core is a consumer/re-export, not a module-bearing assembly owner.
-            GeneratedEmitCoreCrate => {}
+            // Emit-core and facade crates are consumers/re-exports, not module-bearing assembly owners.
+            GeneratedEmitCoreCrate | GeneratedFacadeCrate => {}
         }
     }
     host_shell_modules
@@ -5467,22 +5789,67 @@ pub fn run_regen_round_cost(
     let host = host_name();
     let tree = git_head_sha(&workspace)?;
     let tree_dirty = git_tree_dirty(&workspace)?;
-    let exe_before = current_exe_digest()?;
+    let source_identity = source_identity(&workspace, &tree)?;
+    let exe_before = running_image_digest()?;
 
     // Recover an interrupted transaction before attempting to build or observe a new subject.
     restore_regen_convergence_journal(&workspace)?;
 
     v1_rt::trace_ledger_arm();
     let rustfmt_spawns_before = rustfmt_spawn_count();
+    let seed_cpu_before = v1_rt::trace_process_tree_cpu_ms();
+    let seed_wall_before = std::time::Instant::now();
     let seed_build = seed_cargo_build(&workspace, "round.seed_build")?;
+    let seed_build_wall_ms = seed_wall_before.elapsed().as_millis() as u64;
+    let seed_build_cpu_ms = match (seed_cpu_before, v1_rt::trace_process_tree_cpu_ms()) {
+        (Some(b), Some(a)) => Some(a.saturating_sub(b)),
+        _ => None,
+    };
     let exe_after = current_exe_digest()?;
-    if exe_before != exe_after {
-        return Err(format!(
-            "refusal: the seed build replaced the running executable ({exe_before} -> \
-             {exe_after}), so an emit from this process would measure a seed the build did not \
-             produce. Re-run {REGEN_ROUND_COST_PRODUCER} so the emitting seed is the built one."
-        ));
+    let handoff_in = SeedHandoff::from_env().map_err(|cause| cause.to_string())?;
+    let seed_build_cost = SeedBuildCost {
+        compiled_crates: seed_build.compiled_crates,
+        wall_ms: seed_build_wall_ms,
+        cpu_ms: seed_build_cpu_ms,
+    };
+    match decide_seed_handoff(
+        handoff_in.as_ref(),
+        &exe_before,
+        &exe_after,
+        &source_identity,
+        &seed_build_cost,
+    )
+    .map_err(|cause| cause.to_string())?
+    {
+        SeedHandoffDecision::Proceed => {}
+        SeedHandoffDecision::ReExec(carry) => {
+            // ROOT CAUSE: the build's output path IS this process's image path, so a build that
+            // relinks replaces the executable that is running it. The emit below runs in this
+            // process, so it must be the built seed: hand the observation to the built binary,
+            // which composes it into the receipt exactly once.
+            use std::os::fd::AsRawFd;
+            use std::os::unix::process::CommandExt;
+            let on_disk = current_exe_on_disk()?;
+            // `carry.built_exe` is the build-output digest; the descriptor we exec must match
+            // it before the exec, and the carry is never re-identified from the open.
+            let (target, target_digest) = open_exec_target(&on_disk)?;
+            let carry =
+                admit_exec_target(carry, &target_digest).map_err(|cause| cause.to_string())?;
+            let err = Command::new(format!("/proc/self/fd/{}", target.as_raw_fd()))
+                .arg0(&on_disk)
+                .args(std::env::args_os().skip(1))
+                .env(REGEN_ROUND_COST_REEXEC_ENV, carry.encode())
+                .exec();
+            return Err(SeedHandoffRefusal::ReExecFailed {
+                path: on_disk.display().to_string(),
+                cause: err.to_string(),
+            }
+            .to_string());
+        }
     }
+    // Pre-handoff cost joins this image's no-op rebuild: summed once, here, before the
+    // ledger rows and the crate count reach the receipt.
+    let carried_cost = handoff_in.as_ref().map(|h| h.cost.clone());
 
     let (
         basename_to_module,
@@ -5775,13 +6142,19 @@ pub fn run_regen_round_cost(
 
     // The runtime's `Vec` is the persistent vector its emitted programs use; the receipt
     // renderer takes a slice, so the rows are collected once here.
-    let marks: std::vec::Vec<v1_rt::TraceLedgerRow> = v1_rt::trace_ledger_drain()
+    let drained_marks: std::vec::Vec<v1_rt::TraceLedgerRow> = v1_rt::trace_ledger_drain()
         .ok_or_else(|| {
             "refusal: the trace ledger was not armed, so no phase was recorded".to_string()
         })?
         .iter()
         .cloned()
         .collect();
+    let (seed_build_crates_total, marks) = compose_seed_build_cost(
+        carried_cost.as_ref(),
+        seed_build.compiled_crates,
+        drained_marks,
+    )
+    .map_err(|cause| cause.to_string())?;
     let host_shell_modules =
         super::emitted_closure_compile_host::closure_modules(&stage0_src.join("lib.rs"))?;
     let rendered = render_round_cost_receipt(
@@ -5789,7 +6162,7 @@ pub fn run_regen_round_cost(
         &host,
         &tree,
         tree_dirty,
-        seed_build.compiled_crates,
+        seed_build_crates_total,
         rebuild_compiled_crates,
         rustfmt_spawn_count() - rustfmt_spawns_before,
         &marks,
@@ -5818,6 +6191,280 @@ pub fn run_regen_round_cost(
 mod regen_round_cost_tests {
     use super::*;
 
+    fn cost(crates: u64, wall: u64, cpu: Option<u64>) -> SeedBuildCost {
+        SeedBuildCost {
+            compiled_crates: crates,
+            wall_ms: wall,
+            cpu_ms: cpu,
+        }
+    }
+
+    fn row(label: &str, wall: u64, cpu: Option<u64>) -> v1_rt::TraceLedgerRow {
+        v1_rt::TraceLedgerRow {
+            label: label.to_string(),
+            wall_ms: wall,
+            cpu_ms: cpu,
+        }
+    }
+
+    /// P1 discriminator: a supplied nonzero pre-handoff cost and crate count survive the
+    /// production composition and the production render, once.
+    #[test]
+    fn pre_handoff_seed_build_cost_is_composed_exactly_once_into_the_receipt() {
+        let carried = cost(655, 180_000, Some(170_000));
+        let marks = vec![
+            row("round.seed_build", 96, Some(100)),
+            row("corpus_load", 7, Some(7)),
+        ];
+        let (crates, composed) = compose_seed_build_cost(Some(&carried), 0, marks.clone()).unwrap();
+        assert_eq!(crates, 655);
+        assert_eq!(composed[0].wall_ms, 180_096);
+        assert_eq!(composed[0].cpu_ms, Some(170_100));
+        assert_eq!(composed[1].wall_ms, 7, "other phases are untouched");
+        // no carried cost: identity (no omission invented, nothing added)
+        let (c0, m0) = compose_seed_build_cost(None, 3, marks.clone()).unwrap();
+        assert_eq!((c0, m0[0].wall_ms), (3, 96));
+        // unreadable carried CPU is unreadable, never zero
+        let (_, un) = compose_seed_build_cost(Some(&cost(1, 1, None)), 0, marks.clone()).unwrap();
+        assert_eq!(un[0].cpu_ms, None);
+        // zero rows: the carried duration would vanish while the crates stayed
+        assert!(matches!(
+            compose_seed_build_cost(Some(&carried), 0, vec![row("corpus_load", 7, Some(7))]),
+            Err(SeedHandoffRefusal::SeedBuildMeasurementCount { found: 0 })
+        ));
+        // two rows: the carried duration would be counted twice
+        let two = vec![
+            row("round.seed_build", 96, Some(1)),
+            row("round.seed_build", 4, Some(1)),
+        ];
+        assert!(matches!(
+            compose_seed_build_cost(Some(&carried), 0, two),
+            Err(SeedHandoffRefusal::SeedBuildMeasurementCount { found: 2 })
+        ));
+
+        let workspace = workspace_root();
+        let roots = vec![
+            workspace.join("dag").display().to_string(),
+            workspace.join("src/v2").display().to_string(),
+        ];
+        let rendered = render_round_cost_receipt(
+            &roots,
+            "h",
+            "t",
+            false,
+            crates,
+            0,
+            0,
+            &composed,
+            &[],
+            &[],
+            &[],
+            &[],
+            &[],
+            "e",
+            "c",
+        )
+        .expect("the production renderer accepts the composed rows");
+        assert!(
+            rendered.contains("seed_build_compiled_crates=655"),
+            "{rendered}"
+        );
+        assert!(
+            rendered.contains("phase=seed_build wall_ms=180096"),
+            "{rendered}"
+        );
+        assert_eq!(rendered.matches("seed_build_compiled_crates=").count(), 1);
+    }
+
+    #[test]
+    fn source_identity_sees_untracked_files() {
+        let mut none: Vec<(Vec<u8>, Vec<u8>)> = vec![];
+        let base = compose_source_identity("H", b"d", &mut none);
+        let mut added = vec![(b"new.dag".to_vec(), b"x".to_vec())];
+        let with_new = compose_source_identity("H", b"d", &mut added);
+        let mut edited = vec![(b"new.dag".to_vec(), b"y".to_vec())];
+        let edited_id = compose_source_identity("H", b"d", &mut edited);
+        assert_ne!(
+            base, with_new,
+            "an added untracked file changes the identity"
+        );
+        assert_ne!(
+            with_new, edited_id,
+            "an edited untracked file changes the identity"
+        );
+        let c = cost(1, 1, None);
+        let carry = match decide_seed_handoff(None, "a", "b", &with_new, &c).unwrap() {
+            SeedHandoffDecision::ReExec(h) => h,
+            SeedHandoffDecision::Proceed => panic!(),
+        };
+        assert!(matches!(
+            decide_seed_handoff(Some(&carry), "b", "b", &edited_id, &c),
+            Err(SeedHandoffRefusal::SourceChangedAcrossHandoff { .. })
+        ));
+    }
+
+    #[test]
+    fn untracked_framing_distinguishes_ambiguous_populations() {
+        let c = cost(1, 1, None);
+        // old framing: path '=' digest '\n'. Two files vs one file whose NAME embeds the
+        // first file's entry.
+        let mut two = vec![
+            (b"a.dag".to_vec(), b"x".to_vec()),
+            (b"b.dag".to_vec(), b"y".to_vec()),
+        ];
+        let forged = format!("a.dag={}\nb.dag", bytes_digest(b"x")).into_bytes();
+        let mut one = vec![(forged, b"y".to_vec())];
+        let id_two = compose_source_identity("H", b"d", &mut two);
+        let id_one = compose_source_identity("H", b"d", &mut one);
+        assert_ne!(id_two, id_one);
+        let carry = match decide_seed_handoff(None, "a", "b", &id_two, &c).unwrap() {
+            SeedHandoffDecision::ReExec(h) => h,
+            SeedHandoffDecision::Proceed => panic!(),
+        };
+        assert!(matches!(
+            decide_seed_handoff(Some(&carry), "b", "b", &id_one, &c),
+            Err(SeedHandoffRefusal::SourceChangedAcrossHandoff { .. })
+        ));
+        assert!(matches!(
+            decide_seed_handoff(Some(&carry), "b", "b", &id_two, &c),
+            Ok(SeedHandoffDecision::Proceed)
+        ));
+    }
+
+    #[test]
+    fn exec_target_digest_is_of_the_opened_inode_not_the_path() {
+        let dir = std::env::temp_dir().join(format!("rrc-exec-target-{}", std::process::id()));
+        fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("img");
+        fs::write(&path, b"built").unwrap();
+        let (file, digest) = open_exec_target(&path).unwrap();
+        // the path is replaced after the open: the descriptor still names the hashed bytes
+        fs::remove_file(&path).unwrap();
+        fs::write(&path, b"replaced").unwrap();
+        use std::io::{Read, Seek};
+        let mut f = file;
+        f.rewind().unwrap();
+        let mut got = std::vec::Vec::new();
+        f.read_to_end(&mut got).unwrap();
+        assert_eq!(got, b"built");
+        assert_eq!(digest, bytes_digest(b"built"));
+        assert_ne!(digest, current_digest_of(&path));
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    fn current_digest_of(p: &Path) -> String {
+        bytes_digest(&fs::read(p).unwrap())
+    }
+
+    #[test]
+    fn exec_target_admission_compares_with_the_build_output_and_never_overwrites() {
+        let c = cost(1, 1, None);
+        // production decision: build output B is what the carry names
+        let carry = match decide_seed_handoff(None, "old", "B", "S", &c).unwrap() {
+            SeedHandoffDecision::ReExec(h) => h,
+            SeedHandoffDecision::Proceed => panic!(),
+        };
+        assert_eq!(carry.built_exe, "B");
+        // build=B, install replaced with C before the open: opened=C refuses
+        assert!(matches!(
+            admit_exec_target(carry.clone(), "C"),
+            Err(SeedHandoffRefusal::OpenedTargetNotBuildOutput { .. })
+        ));
+        // build=B, opened=B (a byte-identical replacement included): proceeds, carry intact
+        let admitted = admit_exec_target(carry.clone(), "B").unwrap();
+        assert_eq!(admitted, carry);
+        // and the receiver still proceeds on the admitted carry
+        assert!(matches!(
+            decide_seed_handoff(Some(&admitted), "B", "B", "S", &c),
+            Ok(SeedHandoffDecision::Proceed)
+        ));
+    }
+
+    #[test]
+    fn running_image_is_read_from_proc_self_exe_not_the_installed_path() {
+        let direct = bytes_digest(&fs::read("/proc/self/exe").unwrap());
+        assert_eq!(running_image_digest().unwrap(), direct);
+    }
+
+    #[test]
+    fn modify_after_verify_and_installed_running_mismatch_refuse() {
+        let c = cost(1, 1, None);
+        // the first image hashed inode I = B and carried it; another writer then rewrote I
+        let dir = std::env::temp_dir().join(format!("rrc-mav-{}", std::process::id()));
+        fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("img");
+        fs::write(&path, b"B").unwrap();
+        let (_target, built) = open_exec_target(&path).unwrap();
+        let carry = SeedHandoff {
+            cost: c.clone(),
+            source: "S".into(),
+            built_exe: built.clone(),
+        };
+        // rewrite the same inode, then put B back at the installed path
+        let mut rewritten = fs::OpenOptions::new().write(true).open(&path).unwrap();
+        use std::io::Write as _;
+        rewritten.write_all(b"C").unwrap();
+        let running = digest_open_file(&mut fs::File::open(&path).unwrap()).unwrap();
+        assert_ne!(
+            running, built,
+            "the rewrite is visible through the running inode"
+        );
+        // receiver: running image C, installed path B again -> the old path-reopen said Proceed
+        assert!(matches!(
+            decide_seed_handoff(Some(&carry), &running, &built, "S", &c),
+            Err(SeedHandoffRefusal::WrongArtifactAcrossHandoff { .. })
+        ));
+        // installed/running mismatch with the carried artifact running
+        assert!(matches!(
+            decide_seed_handoff(Some(&carry), &built, &running, "S", &c),
+            Err(SeedHandoffRefusal::ExecutableReplacedAfterHandoff { .. })
+        ));
+        // same artifact everywhere proceeds
+        assert!(matches!(
+            decide_seed_handoff(Some(&carry), &built, &built, "S", &c),
+            Ok(SeedHandoffDecision::Proceed)
+        ));
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn handoff_decisions_are_typed_and_round_trip() {
+        let c = cost(4, 5, Some(6));
+        let carry = match decide_seed_handoff(None, "a", "b", "T", &c).unwrap() {
+            SeedHandoffDecision::ReExec(h) => h,
+            SeedHandoffDecision::Proceed => panic!("replaced exe must hand off"),
+        };
+        assert_eq!(carry.built_exe, "b", "the carry names the built artifact");
+        assert_eq!(SeedHandoff::decode(&carry.encode()).unwrap(), carry);
+        assert!(matches!(
+            decide_seed_handoff(None, "a", "a", "T", &c),
+            Ok(SeedHandoffDecision::Proceed)
+        ));
+        // positive: the re-exec'd image is the built artifact, same source, build is a no-op
+        assert!(matches!(
+            decide_seed_handoff(Some(&carry), "b", "b", "T", &c),
+            Ok(SeedHandoffDecision::Proceed)
+        ));
+        assert!(matches!(
+            decide_seed_handoff(Some(&carry), "b", "c", "T", &c),
+            Err(SeedHandoffRefusal::ExecutableReplacedAfterHandoff { .. })
+        ));
+        // same commit, different uncommitted source
+        assert!(matches!(
+            decide_seed_handoff(Some(&carry), "b", "b", "T-other-diff", &c),
+            Err(SeedHandoffRefusal::SourceChangedAcrossHandoff { .. })
+        ));
+        // wrong artifact: running image is not the one the first image built
+        assert!(matches!(
+            decide_seed_handoff(Some(&carry), "z", "z", "T", &c),
+            Err(SeedHandoffRefusal::WrongArtifactAcrossHandoff { .. })
+        ));
+        assert!(matches!(
+            SeedHandoff::decode("garbage"),
+            Err(SeedHandoffRefusal::HandoffUndecodable { .. })
+        ));
+    }
+
     #[test]
     fn assembled_seed_includes_foundation_and_layered_partitions_not_emit_consumer() {
         let workspace = workspace_root();
diff --git a/src/v1/stage0/src/std_algebra.rs b/src/v1/stage0/src/std_algebra.rs
index 56450a05e83..63bb4332cf7 100644
--- a/src/v1/stage0/src/std_algebra.rs
+++ b/src/v1/stage0/src/std_algebra.rs
@@ -627,6 +627,19 @@ pub fn collection_concat_shape() -> Rc<AlgebraFieldTemplate> {
     })
 }
 
+pub fn collection_count_shape() -> Rc<AlgebraFieldTemplate> {
+    Rc::new(AlgebraFieldTemplate {
+        name: "count".to_string(),
+        param_types: Rc::new(vec![Rc::new(AlgebraTypeTemplate::ReceiverSelf)]),
+        return_type: Rc::new(AlgebraTypeTemplate::NamedTemplate {
+            name: "Int".to_string(),
+        }),
+        size_effect: std::option::Option::None,
+        cost_shape: Some(CostShape::ShapeLinearScan),
+        callback_element_position: std::option::Option::None,
+    })
+}
+
 pub fn collection_sort_by_shape() -> Rc<AlgebraFieldTemplate> {
     Rc::new(AlgebraFieldTemplate {
         name: "sort_by".to_string(),
@@ -1839,16 +1852,7 @@ pub fn free_monoid_collection_templates() -> Rc<Vec<Rc<AlgebraFieldTemplate>>> {
         collection_fold_shape(),
         collection_any_shape(),
         collection_all_shape(),
-        Rc::new(AlgebraFieldTemplate {
-            name: "count".to_string(),
-            param_types: Rc::new(vec![Rc::new(AlgebraTypeTemplate::ReceiverSelf)]),
-            return_type: Rc::new(AlgebraTypeTemplate::NamedTemplate {
-                name: "std.nat.Nat".to_string(),
-            }),
-            size_effect: std::option::Option::None,
-            cost_shape: Some(CostShape::ShapeLinearScan),
-            callback_element_position: std::option::Option::None,
-        }),
+        collection_count_shape(),
         Rc::new(AlgebraFieldTemplate {
             name: "first".to_string(),
             param_types: Rc::new(vec![Rc::new(AlgebraTypeTemplate::ReceiverSelf)]),
diff --git a/src/v1/stage0/src/std_compiler_entry.rs b/src/v1/stage0/src/std_compiler_entry.rs
index 875b1f1704b..0f30d0a9015 100644
--- a/src/v1/stage0/src/std_compiler_entry.rs
+++ b/src/v1/stage0/src/std_compiler_entry.rs
@@ -7,6 +7,10 @@ use self::NativeDriverChildStanding::*;
 use self::NativeDriverCostAccounting::*;
 use self::NativeDriverCostRowStanding::*;
 use self::NativeDriverExclusiveRowKey::*;
+use self::NativeEffectClass::*;
+use self::NativeEffectScope::*;
+pub use crate::std_decl_ref::decl_ref;
+pub use crate::std_decl_ref::DeclarationRef;
 pub use crate::std_measure::Nanosecond;
 pub use crate::std_measure::{
     millisecond, millisecond_to_nanosecond, nanosecond, nanosecond_count,
@@ -54,6 +58,92 @@ pub enum CompilerEntryDriver {
     NativeServeDriver,
 }
 
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum NativeEffectClass {
+    NativeEffectDeclaration { declaration: Rc<DeclarationRef> },
+    NativeOutgoingHttp,
+}
+impl NativeEffectClass {
+    pub fn declaration(&self) -> Rc<DeclarationRef> {
+        match self {
+            NativeEffectClass::NativeEffectDeclaration {
+                declaration: __val, ..
+            } => __val.clone(),
+            NativeEffectClass::NativeOutgoingHttp => panic!("no declaration on unit variant"),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum NativeEffectScope {
+    NativeAdmitAllExcept {
+        excluded: Rc<Vec<Rc<NativeEffectClass>>>,
+    },
+    NativeAdmitOnly {
+        admitted: Rc<Vec<Rc<NativeEffectClass>>>,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct NativeEffectDenominator {
+    pub route: CompilerEntryDriver,
+    pub ruling: Rc<DeclarationRef>,
+    pub scope: Rc<NativeEffectScope>,
+}
+
+pub fn native_effect_declared(module_path: String, decl_name: String) -> Rc<NativeEffectClass> {
+    Rc::new(NativeEffectClass::NativeEffectDeclaration {
+        declaration: crate::std_decl_ref::decl_ref(module_path.clone(), decl_name.clone()),
+    })
+}
+
+pub fn native_compiler_route_denominator() -> Rc<NativeEffectDenominator> {
+    thread_local! {
+            static CACHED: Rc<NativeEffectDenominator> = {
+                Rc::new(NativeEffectDenominator {
+        route: CompilerEntryDriver::NativeCliDriver,
+        ruling: crate::std_decl_ref::decl_ref("gunbc.plans.demand_engine_program".to_string(), "demand_engine_program_plan".to_string()),
+        scope: Rc::new(NativeEffectScope::NativeAdmitAllExcept {
+        excluded: Rc::new(vec![native_effect_declared("std.resources".to_string(), "Clock".to_string()), native_effect_declared("std.resources".to_string(), "Network".to_string()), native_effect_declared("std.resources".to_string(), "Entropy".to_string()), native_effect_declared("std.resources".to_string(), "AuthContext".to_string()), native_effect_declared("extdeps.clock".to_string(), "Clock".to_string()), Rc::new(NativeEffectClass::NativeOutgoingHttp)]),
+    }),
+    })
+            };
+        }
+    CACHED.with(|c: &Rc<NativeEffectDenominator>| c.clone())
+}
+
+pub fn native_service_route_denominator() -> Rc<NativeEffectDenominator> {
+    thread_local! {
+            static CACHED: Rc<NativeEffectDenominator> = {
+                Rc::new(NativeEffectDenominator {
+        route: CompilerEntryDriver::NativeServeDriver,
+        ruling: crate::std_decl_ref::decl_ref("gunbc.plans.demand_engine_program".to_string(), "demand_engine_program_plan".to_string()),
+        scope: Rc::new(NativeEffectScope::NativeAdmitAllExcept {
+        excluded: Rc::new(vec![native_effect_declared("std.resources".to_string(), "Entropy".to_string()), native_effect_declared("std.resources".to_string(), "AuthContext".to_string())]),
+    }),
+    })
+            };
+        }
+    CACHED.with(|c: &Rc<NativeEffectDenominator>| c.clone())
+}
+
+pub fn native_claim_route_denominator() -> Rc<NativeEffectDenominator> {
+    thread_local! {
+            static CACHED: Rc<NativeEffectDenominator> = {
+                Rc::new(NativeEffectDenominator {
+        route: CompilerEntryDriver::NativeClaimDriver,
+        ruling: crate::std_decl_ref::decl_ref("std.compiler_entry".to_string(), "NativeClaimDriver".to_string()),
+        scope: Rc::new(NativeEffectScope::NativeAdmitOnly {
+        admitted: Rc::new(vec![native_effect_declared("extdeps.filesystem.filesystem_io".to_string(), "Filesystem".to_string())]),
+    }),
+    })
+            };
+        }
+    CACHED.with(|c: &Rc<NativeEffectDenominator>| c.clone())
+}
+
 #[derive(
     Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
 )]
diff --git a/src/v1/stage0/src/std_graph.rs b/src/v1/stage0/src/std_graph.rs
index a813e4db5eb..12b3c64d336 100644
--- a/src/v1/stage0/src/std_graph.rs
+++ b/src/v1/stage0/src/std_graph.rs
@@ -371,13 +371,7 @@ pub fn is_lexicographic_descent(mut __tco_loop_evidence: Rc<Vec<DescentEvidence>
                     break true;
                 }
                 DescentEvidence::NonIncreasing => {
-                    let __tco_0 = Rc::new(
-                        evidence
-                            .iter()
-                            .cloned()
-                            .skip(1 as usize)
-                            .collect::<Vec<_>>(),
-                    );
+                    let __tco_0 = Rc::new(v1_rt::list_skip(&evidence, 1));
                     __tco_loop_evidence = __tco_0;
                     continue;
                 }
diff --git a/src/v1/stage0/src/std_integer.rs b/src/v1/stage0/src/std_integer.rs
index bbdca20220c..acf393dc55c 100644
--- a/src/v1/stage0/src/std_integer.rs
+++ b/src/v1/stage0/src/std_integer.rs
@@ -11,7 +11,10 @@ pub use crate::std_induction::int_pow_bounded;
 pub use crate::std_machine_constraints::PointerWidth;
 pub use crate::std_machine_constraints::{Compose, MachineWidth};
 pub use crate::std_measure::{bit_width, bit_width_count, bits_per_byte};
-pub use crate::std_nat::Nat;
+use crate::std_nat::DecimalDigit::{D0, D1, D2, D3, D4, D5, D6, D7, D8, D9};
+use crate::std_nat::DecimalDigitSuccessor::{DecimalDigitCarry, DecimalDigitNext};
+pub use crate::std_nat::{decimal_digit_glyph, decimal_digit_successor, decimal_digit_value};
+pub use crate::std_nat::{DecimalDigit, DecimalDigitSuccessor, Nat};
 pub use crate::std_optional::Optional;
 pub use crate::std_types::gt_zero;
 pub use crate::std_types::List;
@@ -129,13 +132,7 @@ pub fn first_uint8_out_of_range(mut __tco_loop_remaining: Rc<Vec<i64>>) -> Optio
                     break Some(o.clone());
                 }
                 UInt8Result::UInt8Ready { value: _, .. } => {
-                    let __tco_0 = Rc::new(
-                        remaining
-                            .iter()
-                            .cloned()
-                            .skip(1 as usize)
-                            .collect::<Vec<_>>(),
-                    );
+                    let __tco_0 = Rc::new(v1_rt::list_skip(&remaining, 1));
                     __tco_loop_remaining = __tco_0;
                     continue;
                 }
@@ -201,6 +198,61 @@ pub fn uint8_channel_inclusive_max_value_derived() -> Option<Int> {
     }
 }
 
+pub fn decimal_digit_of_units(value: Int) -> DecimalDigit {
+    stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, || {
+        if (value.clone() >= 10) {
+            decimal_digit_of_units(v1_rt::int_sub(value.clone(), 10))
+        } else {
+            if (value.clone() < v1_rt::int_neg(9)) {
+                decimal_digit_of_units(v1_rt::int_add(value.clone(), 10))
+            } else {
+                if (value.clone() < 0) {
+                    decimal_digit_of_units(v1_rt::int_sub(0, value.clone()))
+                } else {
+                    if (value.clone() == 0) {
+                        DecimalDigit::D0
+                    } else {
+                        decimal_digit_advance(decimal_digit_of_units(v1_rt::int_sub(
+                            value.clone(),
+                            1,
+                        )))
+                    }
+                }
+            }
+        }
+    })
+}
+
+pub fn decimal_digit_advance(d: DecimalDigit) -> DecimalDigit {
+    match (*crate::std_nat::decimal_digit_successor(d.clone())).clone() {
+        DecimalDigitSuccessor::DecimalDigitNext { digit: next, .. } => next.clone(),
+        DecimalDigitSuccessor::DecimalDigitCarry => DecimalDigit::D0,
+    }
+}
+
+pub fn int_to_decimal_string(value: Int) -> String {
+    if (value.clone() < 0) {
+        v1_rt::concat("-".to_string(), int_digits_to_decimal_string(value.clone()))
+    } else {
+        int_digits_to_decimal_string(value.clone())
+    }
+}
+
+pub fn int_digits_to_decimal_string(value: Int) -> String {
+    stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, || {
+        let rest = v1_rt::int_div(value.clone(), 10);
+        let digit = crate::std_nat::decimal_digit_glyph(decimal_digit_of_units(v1_rt::int_sub(
+            value.clone(),
+            v1_rt::int_mul(rest.clone(), 10),
+        )));
+        if (rest.clone() == 0) {
+            digit.clone()
+        } else {
+            v1_rt::concat(int_digits_to_decimal_string(rest.clone()), digit.clone())
+        }
+    })
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct Signed;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
diff --git a/src/v1/stage0/src/std_literal_elaboration.rs b/src/v1/stage0/src/std_literal_elaboration.rs
index 36ffd1bd1f1..5fa1242b1f0 100644
--- a/src/v1/stage0/src/std_literal_elaboration.rs
+++ b/src/v1/stage0/src/std_literal_elaboration.rs
@@ -10,10 +10,11 @@ use self::LiteralElaborationRefusal::*;
 use self::LiteralHomomorphismLookup::*;
 use self::LiteralSourceKind::*;
 use self::LiteralUnfolding::*;
+pub use crate::std_decl_ref::declaration_ref_eq;
 pub use crate::std_decl_ref::DeclarationRef;
-pub use crate::std_decl_ref::{decl_ref, declaration_ref_eq};
 pub use crate::std_syntax::LiteralValue;
 use crate::std_syntax::LiteralValue::{LitBool, LitFloat, LitInt, LitNull, LitStr, LitSymbol};
+pub use crate::std_types::range;
 pub use crate::std_types::{Bool, List, NonEmptyStr};
 use crate::v1_rt;
 use crate::v1_rt::{VecCompat, VecJoin};
@@ -266,6 +267,12 @@ pub fn elaborate_literal_at(
 pub struct KernelGrounding {
     pub source_kind: LiteralSourceKind,
     pub carrier: Rc<DeclarationRef>,
+    pub min: Option<i64>,
+    pub max: Option<i64>,
+}
+
+pub fn kernel_grounding_admits(row: Rc<KernelGrounding>, value: i64) -> bool {
+    crate::std_types::range(value.clone(), row.min.clone(), row.max.clone())
 }
 
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
diff --git a/src/v1/stage0/src/std_nat.rs b/src/v1/stage0/src/std_nat.rs
index 3e6fb80fef5..c3e30d34d0b 100644
--- a/src/v1/stage0/src/std_nat.rs
+++ b/src/v1/stage0/src/std_nat.rs
@@ -1,6 +1,8 @@
 // Generated by v1 compiler -- do not edit.
 // Source module: std.nat
 
+use self::DecimalDigit::*;
+use self::DecimalDigitSuccessor::*;
 use self::NatDivision::*;
 use self::NatSubtraction::*;
 use crate::std_algebra::Ordering::{Equal, Greater, Less};
@@ -241,3 +243,184 @@ pub fn nat_range_accumulate(
         }
     }
 }
+
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
+)]
+#[serde(tag = "_variant")]
+pub enum DecimalDigit {
+    D0,
+    D1,
+    D2,
+    D3,
+    D4,
+    D5,
+    D6,
+    D7,
+    D8,
+    D9,
+}
+
+pub fn decimal_digit_value(d: DecimalDigit) -> i64 {
+    match d.clone() {
+        DecimalDigit::D0 => 0,
+        DecimalDigit::D1 => 1,
+        DecimalDigit::D2 => 2,
+        DecimalDigit::D3 => 3,
+        DecimalDigit::D4 => 4,
+        DecimalDigit::D5 => 5,
+        DecimalDigit::D6 => 6,
+        DecimalDigit::D7 => 7,
+        DecimalDigit::D8 => 8,
+        DecimalDigit::D9 => 9,
+    }
+}
+
+pub fn decimal_digit_nat(d: DecimalDigit) -> Nat {
+    match d.clone() {
+        DecimalDigit::D0 => 0,
+        DecimalDigit::D1 => 1,
+        DecimalDigit::D2 => 2,
+        DecimalDigit::D3 => 3,
+        DecimalDigit::D4 => 4,
+        DecimalDigit::D5 => 5,
+        DecimalDigit::D6 => 6,
+        DecimalDigit::D7 => 7,
+        DecimalDigit::D8 => 8,
+        DecimalDigit::D9 => 9,
+    }
+}
+
+pub fn decimal_digit_glyph(d: DecimalDigit) -> String {
+    match d.clone() {
+        DecimalDigit::D0 => "0".to_string(),
+        DecimalDigit::D1 => "1".to_string(),
+        DecimalDigit::D2 => "2".to_string(),
+        DecimalDigit::D3 => "3".to_string(),
+        DecimalDigit::D4 => "4".to_string(),
+        DecimalDigit::D5 => "5".to_string(),
+        DecimalDigit::D6 => "6".to_string(),
+        DecimalDigit::D7 => "7".to_string(),
+        DecimalDigit::D8 => "8".to_string(),
+        DecimalDigit::D9 => "9".to_string(),
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum DecimalDigitSuccessor {
+    DecimalDigitNext { digit: DecimalDigit },
+    DecimalDigitCarry,
+}
+impl DecimalDigitSuccessor {
+    pub fn digit(&self) -> DecimalDigit {
+        match self {
+            DecimalDigitSuccessor::DecimalDigitNext { digit: __val, .. } => __val.clone(),
+            DecimalDigitSuccessor::DecimalDigitCarry => panic!("no digit on unit variant"),
+        }
+    }
+}
+
+pub fn decimal_digit_successor(d: DecimalDigit) -> Rc<DecimalDigitSuccessor> {
+    match d.clone() {
+        DecimalDigit::D0 => Rc::new(DecimalDigitSuccessor::DecimalDigitNext {
+            digit: DecimalDigit::D1,
+        }),
+        DecimalDigit::D1 => Rc::new(DecimalDigitSuccessor::DecimalDigitNext {
+            digit: DecimalDigit::D2,
+        }),
+        DecimalDigit::D2 => Rc::new(DecimalDigitSuccessor::DecimalDigitNext {
+            digit: DecimalDigit::D3,
+        }),
+        DecimalDigit::D3 => Rc::new(DecimalDigitSuccessor::DecimalDigitNext {
+            digit: DecimalDigit::D4,
+        }),
+        DecimalDigit::D4 => Rc::new(DecimalDigitSuccessor::DecimalDigitNext {
+            digit: DecimalDigit::D5,
+        }),
+        DecimalDigit::D5 => Rc::new(DecimalDigitSuccessor::DecimalDigitNext {
+            digit: DecimalDigit::D6,
+        }),
+        DecimalDigit::D6 => Rc::new(DecimalDigitSuccessor::DecimalDigitNext {
+            digit: DecimalDigit::D7,
+        }),
+        DecimalDigit::D7 => Rc::new(DecimalDigitSuccessor::DecimalDigitNext {
+            digit: DecimalDigit::D8,
+        }),
+        DecimalDigit::D8 => Rc::new(DecimalDigitSuccessor::DecimalDigitNext {
+            digit: DecimalDigit::D9,
+        }),
+        DecimalDigit::D9 => Rc::new(DecimalDigitSuccessor::DecimalDigitCarry),
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct NatDecimalSplit {
+    pub quotient: i64,
+    pub units: DecimalDigit,
+}
+
+pub fn nat_decimal_split(value: Nat) -> Rc<NatDecimalSplit> {
+    stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, || {
+        if (value.clone() == 0) {
+            Rc::new(NatDecimalSplit {
+                quotient: 0,
+                units: DecimalDigit::D0,
+            })
+        } else {
+            {
+                let p = v1_rt::int_sub(value.clone(), 1);
+                nat_decimal_split_advance(nat_decimal_split(p.clone()))
+            }
+        }
+    })
+}
+
+pub fn nat_decimal_split_advance(s: Rc<NatDecimalSplit>) -> Rc<NatDecimalSplit> {
+    match (*decimal_digit_successor(s.units.clone())).clone() {
+        DecimalDigitSuccessor::DecimalDigitNext { digit: d, .. } => Rc::new(NatDecimalSplit {
+            quotient: s.quotient.clone(),
+            units: d.clone(),
+        }),
+        DecimalDigitSuccessor::DecimalDigitCarry => Rc::new(NatDecimalSplit {
+            quotient: v1_rt::int_add(s.quotient.clone(), 1),
+            units: DecimalDigit::D0,
+        }),
+    }
+}
+
+pub fn nat_to_decimal_string(value: Nat) -> String {
+    stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, || {
+        let q = nat_div_rem_by_succ(value.clone(), 9);
+        let digit = decimal_digit_glyph(nat_decimal_split(q.remainder.clone()).units.clone());
+        {
+            let __kernel_grounded_subject = q.quotient.clone();
+            if (__kernel_grounded_subject.clone() == 0) {
+                digit.clone()
+            } else {
+                v1_rt::concat(nat_to_decimal_string(q.quotient.clone()), digit.clone())
+            }
+        }
+    })
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct D0;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct D1;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct D2;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct D3;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct D4;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct D5;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct D6;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct D7;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct D8;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct D9;
diff --git a/src/v1/stage0/src/std_occurrence_identity.rs b/src/v1/stage0/src/std_occurrence_identity.rs
index 299c52ca17a..454b38f5d1b 100644
--- a/src/v1/stage0/src/std_occurrence_identity.rs
+++ b/src/v1/stage0/src/std_occurrence_identity.rs
@@ -549,14 +549,10 @@ pub fn occurrence_id_list_is_prefix_of(
                         Some(head) => {
                             if occurrence_id_eq(head.clone(), expected.clone()) {
                                 Rc::new(OccurrenceIdListPrefixAcc {
-                                    path_remaining: Rc::new(
-                                        acc.path_remaining
-                                            .clone()
-                                            .iter()
-                                            .cloned()
-                                            .skip(1 as usize)
-                                            .collect::<Vec<_>>(),
-                                    ),
+                                    path_remaining: Rc::new(v1_rt::list_skip(
+                                        &acc.path_remaining.clone(),
+                                        1,
+                                    )),
                                     ok: true,
                                 })
                             } else {
diff --git a/src/v1/stage0/src/std_primitive_projection.rs b/src/v1/stage0/src/std_primitive_projection.rs
index 7f23a1abc04..0dde8b18b5d 100644
--- a/src/v1/stage0/src/std_primitive_projection.rs
+++ b/src/v1/stage0/src/std_primitive_projection.rs
@@ -422,7 +422,7 @@ pub fn primitive_projection_roster() -> Rc<Vec<Rc<PrimitiveProjection>>> {
         primitive_projection_row(
             primitive_map_get(),
             "v2.std.collection".to_string(),
-            "map_get".to_string(),
+            "map_get_checked".to_string(),
             Rc::new(ProjectionFidelity::DivergentProjection {
                 divergence:
                     "declared return Outcome<Optional<V>> against the primitive's Optional<V>"
diff --git a/src/v1/stage0/src/std_realization_schedule.rs b/src/v1/stage0/src/std_realization_schedule.rs
index 452e02181d4..8f1847f187c 100644
--- a/src/v1/stage0/src/std_realization_schedule.rs
+++ b/src/v1/stage0/src/std_realization_schedule.rs
@@ -831,10 +831,8 @@ pub fn string_list_eq(
                     break false;
                 } else {
                     {
-                        let __tco_0 =
-                            Rc::new(left.iter().cloned().skip(1 as usize).collect::<Vec<_>>());
-                        let __tco_1 =
-                            Rc::new(right.iter().cloned().skip(1 as usize).collect::<Vec<_>>());
+                        let __tco_0 = Rc::new(v1_rt::list_skip(&left, 1));
+                        let __tco_1 = Rc::new(v1_rt::list_skip(&right, 1));
                         __tco_loop_left = __tco_0;
                         __tco_loop_right = __tco_1;
                         continue;
@@ -867,12 +865,8 @@ pub fn schedule_witness_entry_list_eq(
                                 break false;
                             } else {
                                 {
-                                    let __tco_0 = Rc::new(
-                                        left.iter().cloned().skip(1 as usize).collect::<Vec<_>>(),
-                                    );
-                                    let __tco_1 = Rc::new(
-                                        right.iter().cloned().skip(1 as usize).collect::<Vec<_>>(),
-                                    );
+                                    let __tco_0 = Rc::new(v1_rt::list_skip(&left, 1));
+                                    let __tco_1 = Rc::new(v1_rt::list_skip(&right, 1));
                                     __tco_loop_left = __tco_0;
                                     __tco_loop_right = __tco_1;
                                     continue;
@@ -980,12 +974,8 @@ pub fn runnable_batch_eq(
                                 break false;
                             } else {
                                 {
-                                    let __tco_0 = Rc::new(
-                                        left.iter().cloned().skip(1 as usize).collect::<Vec<_>>(),
-                                    );
-                                    let __tco_1 = Rc::new(
-                                        right.iter().cloned().skip(1 as usize).collect::<Vec<_>>(),
-                                    );
+                                    let __tco_0 = Rc::new(v1_rt::list_skip(&left, 1));
+                                    let __tco_1 = Rc::new(v1_rt::list_skip(&right, 1));
                                     __tco_loop_left = __tco_0;
                                     __tco_loop_right = __tco_1;
                                     continue;
@@ -1024,12 +1014,8 @@ pub fn schedule_eq(mut __tco_loop_left: Schedule, mut __tco_loop_right: Schedule
                                 break false;
                             } else {
                                 {
-                                    let __tco_0 = Rc::new(
-                                        left.iter().cloned().skip(1 as usize).collect::<Vec<_>>(),
-                                    );
-                                    let __tco_1 = Rc::new(
-                                        right.iter().cloned().skip(1 as usize).collect::<Vec<_>>(),
-                                    );
+                                    let __tco_0 = Rc::new(v1_rt::list_skip(&left, 1));
+                                    let __tco_1 = Rc::new(v1_rt::list_skip(&right, 1));
                                     __tco_loop_left = __tco_0;
                                     __tco_loop_right = __tco_1;
                                     continue;
diff --git a/src/v1/stage0/src/std_repair_input_origin.rs b/src/v1/stage0/src/std_repair_input_origin.rs
index 283034fcc6e..e49ccbd854c 100644
--- a/src/v1/stage0/src/std_repair_input_origin.rs
+++ b/src/v1/stage0/src/std_repair_input_origin.rs
@@ -95,14 +95,10 @@ pub fn candidate_spelling_from_text(name: String) -> Rc<CandidateSpelling> {
         );
         if ((segments.clone().len() as i64) > 1) {
             Rc::new(CandidateSpelling::QualifiedCandidate {
-                authored_qualifier: Rc::new(
-                    segments
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .take(v1_rt::int_sub((segments.clone().len() as i64), 1) as usize)
-                        .collect::<Vec<_>>(),
-                )
+                authored_qualifier: Rc::new(v1_rt::list_take(
+                    &segments.clone(),
+                    v1_rt::int_sub((segments.clone().len() as i64), 1),
+                ))
                 .join(&".".to_string()),
                 member: match segments.clone().last().cloned() {
                     Some(member) => member.clone(),
diff --git a/src/v1/stage0/src/std_source_annotation.rs b/src/v1/stage0/src/std_source_annotation.rs
index 64e9feefea5..687ac4e8be5 100644
--- a/src/v1/stage0/src/std_source_annotation.rs
+++ b/src/v1/stage0/src/std_source_annotation.rs
@@ -141,15 +141,7 @@ pub fn admit_annotations(result: Rc<AnnotationAttachmentResult>) -> Rc<Annotatio
         Some(head) => Rc::new(AnnotationAdmission::AnnotationsRefused {
             refusals: Rc::new(FreeSemigroup {
                 head: head.clone(),
-                tail: Rc::new(
-                    result
-                        .refusals
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                ),
+                tail: Rc::new(v1_rt::list_skip(&result.refusals.clone(), 1)),
                 _phantom: std::marker::PhantomData,
             }),
         }),
@@ -407,14 +399,7 @@ pub fn keyed_annotation_rows_agree(
                     agreed: false,
                 }),
                 Some(other) => Rc::new(KeyedAnnotationRowWalk {
-                    rest: Rc::new(
-                        acc.rest
-                            .clone()
-                            .iter()
-                            .cloned()
-                            .skip(1 as usize)
-                            .collect::<Vec<_>>(),
-                    ),
+                    rest: Rc::new(v1_rt::list_skip(&acc.rest.clone(), 1)),
                     agreed: ((acc.agreed.clone()
                         && (row.subject_key.clone() == other.subject_key.clone()))
                         && (row.text.clone() == other.text.clone())),
diff --git a/src/v1/stage0/src/target_invocation_host.rs b/src/v1/stage0/src/target_invocation_host.rs
index 30c0268b5f5..c9ac1e7bf5b 100644
--- a/src/v1/stage0/src/target_invocation_host.rs
+++ b/src/v1/stage0/src/target_invocation_host.rs
@@ -248,7 +248,7 @@ pub fn parse_target_pattern(text: &str) -> Result<TargetPattern, TargetPatternRe
 /// `gunbc.target_binding` `V2NativeCensusReading`: which census verb and reader a native-census row takes.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum V2NativeCensusReading {
-    ResolveRefusal,
+    RefusalCensus,
     TypeDeclarationUse,
 }
 
@@ -358,7 +358,7 @@ fn instrument_registry() -> Vec<(Label, TargetProducer)> {
         (
             instrument_label("v2-native-census"),
             TargetProducer::V2NativeCensus {
-                reading: V2NativeCensusReading::ResolveRefusal,
+                reading: V2NativeCensusReading::RefusalCensus,
             },
         ),
         (
@@ -847,7 +847,7 @@ fn run_producer(producer: TargetProducer) -> InvocationOutcome {
         TargetProducer::V2NativeCli => run_v2_native_cli(&v2_native_cli_source_roots()),
         TargetProducer::V2NativeFrontier => run_v2_native_frontier(&self_host_source_roots()),
         TargetProducer::V2NativeCensus {
-            reading: V2NativeCensusReading::ResolveRefusal,
+            reading: V2NativeCensusReading::RefusalCensus,
         } => run_v2_native_census(&self_host_source_roots()),
         TargetProducer::V2NativeCensus {
             reading: V2NativeCensusReading::TypeDeclarationUse,
@@ -1230,12 +1230,18 @@ fn run_v2_native_census(source_roots: &[String]) -> InvocationOutcome {
             termination: Termination::ObservationHeld,
             message: format!(
                 "v2-native-census: modules={} file_refusals={} advised_files={} residual_rows={} \
-                 cause_groups={}; the rows grouped by fatal reason are the cause_group lines above",
+                 inferred={} infer_refused={} cause_groups={} roots={} type_census={}; the rows \
+                 grouped by fatal reason are the cause_group lines above, ranked by closure fan-out \
+                 in the census_root lines",
                 run.modules,
                 run.file_refusals,
                 run.advised_files,
                 run.residual_rows,
-                run.cause_groups
+                run.inferred,
+                run.infer_refused,
+                run.cause_groups,
+                run.roots,
+                run.type_census.word()
             ),
         },
         Err(cause) => InvocationOutcome {
@@ -1646,23 +1652,39 @@ fn run_native_serve_program(entry: &'static str) -> InvocationOutcome {
             _ => None,
         }
     };
-    let plan = (|| -> Result<(Vec<String>, String, String, String), String> {
-        let requests = match &read("native_serve_probe_requests")? {
+    // The requests depend on the peer's bound port, which only exists once the peer is up, so they
+    // are read from the reader module with that port as its argument -- still every byte there.
+    let requests_for_peer_port = |peer_port: i64| -> Result<Vec<String>, String> {
+        let value = crate::v1_interpreter::run_in_context_with_args(
+            &ctx,
+            "native_serve_probe_requests",
+            &[(
+                Some("peer_port".to_string()),
+                crate::v1_interpreter::Value::Int(peer_port),
+            )],
+            true,
+        )
+        .map_err(|cause| {
+            format!("{label_name}: {READER} native_serve_probe_requests failed: {cause}")
+        })?;
+        match &value {
             crate::v1_interpreter::Value::List(items) => items
                 .iter()
                 .map(|item| text(item).ok_or("a request is not a String".to_string()))
-                .collect::<Result<Vec<String>, String>>()?,
-            _ => return Err("native_serve_probe_requests is not a List".to_string()),
-        };
+                .collect::<Result<Vec<String>, String>>(),
+            _ => Err("native_serve_probe_requests is not a List".to_string()),
+        }
+    };
+    let plan = (|| -> Result<(String, String, String), String> {
         let release = text(&read("native_serve_probe_release_revision")?)
             .ok_or("the release revision is not a String")?;
         let refused = text(&read("native_serve_probe_refused_revision")?)
             .ok_or("the refused revision is not a String")?;
         let deadline = text(&read("native_serve_probe_request_deadline_ms")?)
             .ok_or("the request deadline is not a String")?;
-        Ok((requests, release, refused, deadline))
+        Ok((release, refused, deadline))
     })();
-    let (requests, release, refused, deadline) = match plan {
+    let (release, refused, deadline) = match plan {
         Ok(plan) => plan,
         Err(cause) => {
             return InvocationOutcome {
@@ -1677,7 +1699,7 @@ fn run_native_serve_program(entry: &'static str) -> InvocationOutcome {
         &release,
         &refused,
         &deadline,
-        &requests,
+        &requests_for_peer_port,
     ) {
         Ok(run) => run,
         Err(cause) => {
@@ -1693,6 +1715,14 @@ fn run_native_serve_program(entry: &'static str) -> InvocationOutcome {
             Some("announcement".to_string()),
             crate::v1_interpreter::Value::Str(run.announcement.clone().into()),
         ),
+        (
+            Some("peer_announcement".to_string()),
+            crate::v1_interpreter::Value::Str(run.peer_announcement.clone().into()),
+        ),
+        (
+            Some("peer_port".to_string()),
+            crate::v1_interpreter::Value::Int(run.peer_port),
+        ),
         (
             Some("responses".to_string()),
             crate::v1_interpreter::Value::List(std::rc::Rc::new(
@@ -2502,7 +2532,537 @@ fn observe_binary_inputs() -> BinaryInputObservation {
 /// (`gunbc.target_invocation` `assess_binary_freshness`), then route. Kept beside `test_verb`
 /// rather than inside it so the routing tests stay a function of the operand alone.
 pub fn test_verb_checked(operand: &str) -> InvocationOutcome {
-    test_verb_after(operand, &assess_binary_freshness(&observe_binary_inputs()))
+    // THE SECOND ACT, BEFORE ANY PRODUCER: bind this process to a kernel memory limit when the
+    // invocation asked for one (`GUNBC_BIND_MEMORY_CGROUP_BYTES`, gunbc.memory_cgroup_binding --
+    // the same bind claim_executor and claim_batch take) at gunbc.emitted_subject_build_gate
+    // native_step_memory_trip, the slot's MemoryHigh less a declared headroom. The required
+    // `witnesses` job passes that input only where a job owns a bounded cgroup
+    // (gunbc.runner_slot_desired gunbc_runner_slot_job_cgroup_ownership decides; today a fleet job
+    // is the deprivileged job user under a root unit and the governor's leaf lives at the cgroup
+    // root, and the climb is gunbc.guarantee_stall native_step_trip_awaits_fleet_job_cgroup_stall).
+    // A refused bind stops the line: the run asked to be bounded and is not.
+    let bind = crate::memory_governor::apply_memory_cgroup_bind();
+    eprintln!("{}", crate::memory_governor::cgroup_bind_note(&bind));
+    if let Some(diagnostic) = crate::memory_governor::cgroup_bind_refusal_diagnostic(&bind) {
+        return InvocationOutcome {
+            termination: Termination::Refused,
+            message: diagnostic,
+        };
+    }
+    // THE THIRD ACT: what bounds this run, decided and READ before the producer. The required job
+    // passes `GUNBC_MEMORY_ENVELOPE_REQUIRED=slot` on every subject step
+    // (gunbc.emitted_subject_build_gate native_step_memory_envelope_env_name): a cgroup memory.max
+    // must already bind the step -- the fleet slot's -- and a run none binds is refused, because a
+    // required step that cannot say what bounded it is not the measurement the gate names
+    // (operator ruling 2026-10-09: a fixed hard maximum, swap refused, a peak-and-swap receipt,
+    // no larger-runner retry).
+    let envelope = match memory_envelope_requirement(&bind) {
+        Ok(envelope) => envelope,
+        Err(refusal) => {
+            eprintln!("{refusal}");
+            return InvocationOutcome {
+                termination: Termination::Refused,
+                message: refusal,
+            };
+        }
+    };
+    let outcome = test_verb_after(operand, &assess_binary_freshness(&observe_binary_inputs()));
+    // THE PEAK-AND-SWAP RECEIPT, after the producer and whatever it spawned have run: read from
+    // the cgroup that bounds the step (every child process was charged to it), against the
+    // reading taken before the producer, so a cgroup that outlives the step -- the slot's --
+    // reports what THIS step added. A violated envelope -- an OOM kill, swap charged, or a swap
+    // counter that cannot be read -- is a refusal even over a producer that held, because "no
+    // thrashing, ever" is part of the verdict.
+    match memory_envelope_receipt(&envelope) {
+        None => outcome,
+        Some(Ok(receipt)) => {
+            eprintln!("{receipt}");
+            outcome
+        }
+        Some(Err(violation)) => {
+            eprintln!("{violation}");
+            InvocationOutcome {
+                termination: Termination::Refused,
+                message: format!("{}\n{violation}", outcome.message),
+            }
+        }
+    }
+}
+
+/// Authority: `gunbc.emitted_subject_build_gate` `native_step_memory_envelope_env_name` and
+/// `native_step_memory_envelope_slot_value` (the latter the projection of `gunbc.memory_envelope`
+/// `EnvelopeSlotRequired`), pinned by `test.claim.compiler_gate_emit_build_lane_witness_test`
+/// `the_seed_envelope_requirement_inputs_are_the_dag_rows`.
+const MEMORY_ENVELOPE_REQUIRED_ENV: &str = "GUNBC_MEMORY_ENVELOPE_REQUIRED";
+const MEMORY_ENVELOPE_SLOT_VALUE: &str = "slot";
+
+/// Authority: `gunbc.memory_envelope` `MemoryEnvelopeRequirement`. Absent and unreadable are
+/// different answers, exactly as for the bind request.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum MemoryEnvelopeRequirement {
+    NotRequested,
+    SlotRequired,
+    Unreadable { raw: String },
+}
+
+/// Authority: `gunbc.memory_envelope` `MemoryEnvelopeGrain` / `memory_envelope_grain_label`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum MemoryEnvelopeGrain {
+    Leaf,
+    Existing,
+    Slot,
+}
+
+impl MemoryEnvelopeGrain {
+    fn label(self) -> &'static str {
+        match self {
+            MemoryEnvelopeGrain::Leaf => "leaf",
+            MemoryEnvelopeGrain::Existing => "existing",
+            MemoryEnvelopeGrain::Slot => "slot",
+        }
+    }
+}
+
+/// Authority: `gunbc.memory_envelope` `MemoryEnvelopeRefusalCause`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum MemoryEnvelopeRefusalCause {
+    GrainUnknown { raw: String },
+    Absent { grain: MemoryEnvelopeGrain },
+}
+
+/// Authority: `gunbc.memory_envelope` `MemoryEnvelopeDecision`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum MemoryEnvelopeDecision {
+    NotRequired,
+    Bounded { grain: MemoryEnvelopeGrain },
+    Refused { cause: MemoryEnvelopeRefusalCause },
+}
+
+/// Mirror of `gunbc.memory_envelope` `memory_envelope_requirement_from_text`.
+fn memory_envelope_requirement_from_text(raw: Option<&str>) -> MemoryEnvelopeRequirement {
+    match raw {
+        None => MemoryEnvelopeRequirement::NotRequested,
+        Some(v) if v == MEMORY_ENVELOPE_SLOT_VALUE => MemoryEnvelopeRequirement::SlotRequired,
+        Some(v) => MemoryEnvelopeRequirement::Unreadable { raw: v.to_string() },
+    }
+}
+
+/// THE PURE DECISION, mirroring `gunbc.memory_envelope` `memory_envelope_decision` arm for arm:
+/// every input is a parameter so the discriminating cases -- above all a slot requirement over a
+/// process no numeric memory.max binds, which must refuse -- are reachable from a test on any
+/// machine. `numeric_max_binds` is the governor's `binding_cap_cgroup_dir` walk, read once by the
+/// shell below; a body of `max` is no limit.
+fn memory_envelope_decision(
+    bind: &crate::memory_governor::CgroupBindDecision,
+    requirement: &MemoryEnvelopeRequirement,
+    numeric_max_binds: bool,
+) -> MemoryEnvelopeDecision {
+    use crate::memory_governor::CgroupBindDecision as Bind;
+    let bounded_or_absent = |grain: MemoryEnvelopeGrain| {
+        if numeric_max_binds {
+            MemoryEnvelopeDecision::Bounded { grain }
+        } else {
+            MemoryEnvelopeDecision::Refused {
+                cause: MemoryEnvelopeRefusalCause::Absent { grain },
+            }
+        }
+    };
+    match requirement {
+        MemoryEnvelopeRequirement::Unreadable { raw } => MemoryEnvelopeDecision::Refused {
+            cause: MemoryEnvelopeRefusalCause::GrainUnknown { raw: raw.clone() },
+        },
+        MemoryEnvelopeRequirement::NotRequested => match bind {
+            Bind::Applicable { .. } => bounded_or_absent(MemoryEnvelopeGrain::Leaf),
+            Bind::UnnecessaryLimitAlreadyBinds { .. } => {
+                bounded_or_absent(MemoryEnvelopeGrain::Existing)
+            }
+            Bind::NotRequested => MemoryEnvelopeDecision::NotRequired,
+            Bind::Refused { .. } => MemoryEnvelopeDecision::Refused {
+                cause: MemoryEnvelopeRefusalCause::Absent {
+                    grain: MemoryEnvelopeGrain::Leaf,
+                },
+            },
+        },
+        MemoryEnvelopeRequirement::SlotRequired => match bind {
+            Bind::Applicable { .. } => bounded_or_absent(MemoryEnvelopeGrain::Leaf),
+            Bind::UnnecessaryLimitAlreadyBinds { .. } => {
+                bounded_or_absent(MemoryEnvelopeGrain::Existing)
+            }
+            Bind::NotRequested => bounded_or_absent(MemoryEnvelopeGrain::Slot),
+            Bind::Refused { .. } => MemoryEnvelopeDecision::Refused {
+                cause: MemoryEnvelopeRefusalCause::Absent {
+                    grain: MemoryEnvelopeGrain::Leaf,
+                },
+            },
+        },
+    }
+}
+
+/// THE PURE VERDICT, mirroring `gunbc.memory_envelope` `memory_envelope_verdict`: violated on any
+/// OOM kill the step added, any swap resident at exit, an unreadable swap gauge, a swap peak that
+/// rose during the step, or a swap peak that could not be observed (`None`: no memory.swap.peak on
+/// this kernel) under a cgroup whose memory.swap.max is not zero -- unobservable is not "did not
+/// rise", and only a zero swap limit makes the missing counter moot.
+fn memory_envelope_violated(
+    oom_kills_delta: u64,
+    swap_current: Option<u64>,
+    swap_peak_rose: Option<bool>,
+    swap_max_zero: bool,
+) -> bool {
+    let swap_rose_or_unobservable = match swap_peak_rose {
+        Some(rose) => rose,
+        None => !swap_max_zero,
+    };
+    oom_kills_delta > 0 || swap_current.map(|v| v > 0).unwrap_or(true) || swap_rose_or_unobservable
+}
+
+/// What bounds this run's memory, decided before any producer, with the readings taken at the
+/// start so the receipt can report what this step added to a cgroup that outlives it.
+enum MemoryEnvelope {
+    NotRequired,
+    Bounded {
+        grain: MemoryEnvelopeGrain,
+        dir: std::path::PathBuf,
+        start: cli_run::floor_memory_supervisor::CgroupMemoryRead,
+        start_swap: cli_run::floor_memory_supervisor::CgroupSwapRead,
+    },
+}
+
+/// The effectful shell: read the requirement and the one host fact the decision needs, decide
+/// through the mirror, and take the start readings of the cgroup the decision named.
+fn memory_envelope_requirement(
+    bind: &crate::memory_governor::CgroupBindDecision,
+) -> Result<MemoryEnvelope, String> {
+    use crate::memory_governor::CgroupBindDecision as Bind;
+    let raw = std::env::var(MEMORY_ENVELOPE_REQUIRED_ENV).ok();
+    let requirement = memory_envelope_requirement_from_text(raw.as_deref());
+    // THE ONE HOST FACT: which cgroup carries the numeric memory.max that binds this process. The
+    // governor's walk is the authority (DESIGN section 3) and reads `max` as unset; the peak locator
+    // the first version used answers where counters may be read, never whether anything bounds them.
+    let binding_dir = crate::memory_governor::binding_cap_cgroup_dir();
+    let required_by = match (&requirement, bind) {
+        (MemoryEnvelopeRequirement::SlotRequired, Bind::NotRequested) => {
+            format!("{MEMORY_ENVELOPE_REQUIRED_ENV}={MEMORY_ENVELOPE_SLOT_VALUE}")
+        }
+        (MemoryEnvelopeRequirement::SlotRequired, _) => format!(
+            "{MEMORY_ENVELOPE_REQUIRED_ENV}={MEMORY_ENVELOPE_SLOT_VALUE} and the bind {}",
+            crate::memory_governor::BIND_MEMORY_CGROUP_ENV
+        ),
+        (_, _) => format!(
+            "the bind {} ({MEMORY_ENVELOPE_REQUIRED_ENV} unset)",
+            crate::memory_governor::BIND_MEMORY_CGROUP_ENV
+        ),
+    };
+    match memory_envelope_decision(bind, &requirement, binding_dir.is_some()) {
+        MemoryEnvelopeDecision::NotRequired => Ok(MemoryEnvelope::NotRequired),
+        MemoryEnvelopeDecision::Refused {
+            cause: MemoryEnvelopeRefusalCause::GrainUnknown { raw },
+        } => Err(format!(
+            "gunbc test: MEMORY ENVELOPE REFUSED cause=MemoryEnvelopeGrainUnknown — \
+             {MEMORY_ENVELOPE_REQUIRED_ENV}={raw:?} names no envelope grain this binary knows \
+             (it knows {MEMORY_ENVELOPE_SLOT_VALUE:?}); a run that asked to be bounded with a \
+             value the binary cannot read proceeds nowhere"
+        )),
+        MemoryEnvelopeDecision::Refused {
+            cause: MemoryEnvelopeRefusalCause::Absent { grain },
+        } => Err(format!(
+            "gunbc test: MEMORY ENVELOPE REFUSED cause=MemoryEnvelopeAbsent — {required_by} \
+             requires a cgroup memory.max to bind this process (grain {}), and no cgroup on its \
+             path to the root carries a numeric memory.max: a body of `max` is no limit \
+             (extdeps.linux.cgroup_v2_memory CgroupMemoryUnlimited), and an unconverged slot is \
+             refused rather than receipted as a bound",
+            grain.label()
+        )),
+        MemoryEnvelopeDecision::Bounded { grain } => {
+            let Some(dir) = binding_dir else {
+                return Err(
+                    "gunbc test: MEMORY ENVELOPE REFUSED cause=MemoryEnvelopeAbsent — the decision \
+                     bounded this run but the governor's walk found no binding cgroup; refusing \
+                     rather than reading an unnamed one"
+                        .to_string(),
+                );
+            };
+            let start =
+                cli_run::floor_memory_supervisor::read_cgroup_memory(&dir).map_err(|refusal| {
+                    format!(
+                        "gunbc test: MEMORY RECEIPT REFUSED cause=MemoryReceiptUnreadable — {}",
+                        refusal.render()
+                    )
+                })?;
+            let start_swap =
+                cli_run::floor_memory_supervisor::read_cgroup_swap(&dir).map_err(|refusal| {
+                    format!(
+                        "gunbc test: MEMORY RECEIPT REFUSED cause=MemoryReceiptUnreadable — {}",
+                        refusal.render()
+                    )
+                })?;
+            Ok(MemoryEnvelope::Bounded {
+                grain,
+                dir,
+                start,
+                start_swap,
+            })
+        }
+    }
+}
+
+/// `None` when nothing bounds the run by request (an operator-local run measures nothing);
+/// otherwise the receipt line, or the violation that refuses the run. The counters are the
+/// cgroup's own, read through the floor memory supervisor's readers so a missing key is never a
+/// zero; the event counters are reported as the DIFFERENCE from the start reading, because a slot
+/// cgroup outlives this step; and the peak is labelled by whether it ROSE during the step, because
+/// memory.peak is a lifetime maximum and the bind leaf is reused across runs.
+fn memory_envelope_receipt(envelope: &MemoryEnvelope) -> Option<Result<String, String>> {
+    let MemoryEnvelope::Bounded {
+        grain,
+        dir,
+        start,
+        start_swap,
+    } = envelope
+    else {
+        return None;
+    };
+    let unreadable = |refusal: cli_run::floor_memory_supervisor::QualificationRefusal| {
+        format!(
+            "gunbc test: MEMORY RECEIPT REFUSED cause=MemoryReceiptUnreadable — {}",
+            refusal.render()
+        )
+    };
+    let end = match cli_run::floor_memory_supervisor::read_cgroup_memory(dir) {
+        Ok(read) => read,
+        Err(refusal) => return Some(Err(unreadable(refusal))),
+    };
+    let end_swap = match cli_run::floor_memory_supervisor::read_cgroup_swap(dir) {
+        Ok(read) => read,
+        Err(refusal) => return Some(Err(unreadable(refusal))),
+    };
+    let oom_kills_delta = end.oom_kills.saturating_sub(start.oom_kills);
+    let max_events_delta = end.max_events.saturating_sub(start.max_events);
+    let high_events_delta = end.high_events.saturating_sub(start.high_events);
+    let (swap_peak_rose, swap_peak_text) = match (start_swap.swap_peak, end_swap.swap_peak) {
+        (Some(before), Some(after)) => (
+            Some(after > before),
+            after.saturating_sub(before).to_string(),
+        ),
+        _ => (
+            None,
+            "unobservable (no memory.swap.peak on this kernel)".to_string(),
+        ),
+    };
+    let swap_max_zero = end_swap.swap_max.trim() == "0";
+    let peak_scope = if end.peak > start.peak {
+        format!("rose from {} during this step", start.peak)
+    } else {
+        format!(
+            "prior history of the cgroup: memory.peak stood at {} before the producer and did not rise",
+            start.peak
+        )
+    };
+    let line = format!(
+        "gunbc test: MEMORY RECEIPT grain={} cgroup={} limit_max={} limit_high={} swap_max={} \
+         peak_bytes={} (peak: {peak_scope}) high_events_delta={high_events_delta} \
+         max_events_delta={max_events_delta} oom_kills_delta={oom_kills_delta} \
+         swap_current_bytes={} swap_peak_delta={swap_peak_text}",
+        grain.label(),
+        end.dir,
+        end.limit_max,
+        end.limit_high,
+        end_swap.swap_max,
+        end.peak,
+        end_swap.swap_current
+    );
+    if memory_envelope_violated(
+        oom_kills_delta,
+        Some(end_swap.swap_current),
+        swap_peak_rose,
+        swap_max_zero,
+    ) {
+        Some(Err(format!(
+            "gunbc test: MEMORY ENVELOPE VIOLATED cause=MemoryEnvelopeViolated — an OOM kill this \
+             step added, swap resident at exit, a swap peak that rose during the step, or a swap peak \
+             this kernel cannot show under a cgroup that permits swap, inside the bounding cgroup; the \
+             run is refused even if its producer held. {line}"
+        )))
+    } else {
+        Some(Ok(line))
+    }
+}
+
+#[cfg(test)]
+mod memory_envelope_tests {
+    use super::*;
+    use crate::memory_governor::{
+        CgroupBindDecision as Bind, CgroupBindRefusalCause, HostBudgetSource,
+    };
+
+    fn existing() -> Bind {
+        Bind::UnnecessaryLimitAlreadyBinds {
+            source: HostBudgetSource::CgroupMemoryMax {
+                cgroup_dir: "/sys/fs/cgroup/system.slice/actions-runner@srv4-15.service"
+                    .to_string(),
+            },
+        }
+    }
+
+    #[test]
+    fn requirement_reads_absent_slot_and_anything_else_as_three_answers() {
+        assert_eq!(
+            memory_envelope_requirement_from_text(None),
+            MemoryEnvelopeRequirement::NotRequested
+        );
+        assert_eq!(
+            memory_envelope_requirement_from_text(Some("slot")),
+            MemoryEnvelopeRequirement::SlotRequired
+        );
+        assert_eq!(
+            memory_envelope_requirement_from_text(Some("leaf")),
+            MemoryEnvelopeRequirement::Unreadable {
+                raw: "leaf".to_string()
+            }
+        );
+    }
+
+    #[test]
+    #[allow(non_snake_case)]
+    fn RED_a_slot_requirement_with_no_numeric_max_refuses_as_absent() {
+        let d = memory_envelope_decision(
+            &Bind::NotRequested,
+            &MemoryEnvelopeRequirement::SlotRequired,
+            false,
+        );
+        assert_eq!(
+            d,
+            MemoryEnvelopeDecision::Refused {
+                cause: MemoryEnvelopeRefusalCause::Absent {
+                    grain: MemoryEnvelopeGrain::Slot
+                }
+            }
+        );
+    }
+
+    #[test]
+    fn a_slot_requirement_under_a_numeric_max_is_bounded_at_the_slot() {
+        assert_eq!(
+            memory_envelope_decision(
+                &Bind::NotRequested,
+                &MemoryEnvelopeRequirement::SlotRequired,
+                true
+            ),
+            MemoryEnvelopeDecision::Bounded {
+                grain: MemoryEnvelopeGrain::Slot
+            }
+        );
+    }
+
+    #[test]
+    fn no_requirement_and_no_bind_is_not_required_whatever_the_host() {
+        for binds in [true, false] {
+            assert_eq!(
+                memory_envelope_decision(
+                    &Bind::NotRequested,
+                    &MemoryEnvelopeRequirement::NotRequested,
+                    binds
+                ),
+                MemoryEnvelopeDecision::NotRequired
+            );
+        }
+    }
+
+    #[test]
+    fn binds_are_bounded_at_their_own_grains() {
+        assert_eq!(
+            memory_envelope_decision(
+                &Bind::Applicable { bound: 1 },
+                &MemoryEnvelopeRequirement::NotRequested,
+                true
+            ),
+            MemoryEnvelopeDecision::Bounded {
+                grain: MemoryEnvelopeGrain::Leaf
+            }
+        );
+        assert_eq!(
+            memory_envelope_decision(&existing(), &MemoryEnvelopeRequirement::SlotRequired, true),
+            MemoryEnvelopeDecision::Bounded {
+                grain: MemoryEnvelopeGrain::Existing
+            }
+        );
+    }
+
+    #[test]
+    #[allow(non_snake_case)]
+    fn RED_a_refused_bind_and_an_unknown_value_refuse() {
+        let refused = Bind::Refused {
+            cause: CgroupBindRefusalCause::CgroupTreeNotWritable,
+        };
+        assert!(matches!(
+            memory_envelope_decision(&refused, &MemoryEnvelopeRequirement::SlotRequired, true),
+            MemoryEnvelopeDecision::Refused {
+                cause: MemoryEnvelopeRefusalCause::Absent {
+                    grain: MemoryEnvelopeGrain::Leaf
+                }
+            }
+        ));
+        assert!(matches!(
+            memory_envelope_decision(
+                &Bind::Applicable { bound: 1 },
+                &MemoryEnvelopeRequirement::Unreadable {
+                    raw: "leaf".to_string()
+                },
+                true
+            ),
+            MemoryEnvelopeDecision::Refused {
+                cause: MemoryEnvelopeRefusalCause::GrainUnknown { .. }
+            }
+        ));
+    }
+
+    #[test]
+    fn the_verdict_holds_only_on_a_clean_pair_of_readings() {
+        assert!(!memory_envelope_violated(0, Some(0), Some(false), false));
+        assert!(!memory_envelope_violated(0, Some(0), None, true));
+        assert!(memory_envelope_violated(1, Some(0), Some(false), false));
+        assert!(memory_envelope_violated(0, Some(1), Some(false), false));
+        assert!(memory_envelope_violated(0, None, Some(false), false));
+        assert!(memory_envelope_violated(0, Some(0), Some(true), false));
+    }
+
+    #[test]
+    #[allow(non_snake_case)]
+    fn RED_an_unobservable_swap_peak_refuses_unless_the_swap_limit_is_zero() {
+        assert!(memory_envelope_violated(0, Some(0), None, false));
+        assert!(!memory_envelope_violated(0, Some(0), None, true));
+    }
+
+    #[test]
+    #[allow(non_snake_case)]
+    fn RED_an_applied_or_existing_bind_over_no_numeric_max_refuses_at_its_grain() {
+        assert!(matches!(
+            memory_envelope_decision(
+                &Bind::Applicable { bound: 1 },
+                &MemoryEnvelopeRequirement::NotRequested,
+                false
+            ),
+            MemoryEnvelopeDecision::Refused {
+                cause: MemoryEnvelopeRefusalCause::Absent {
+                    grain: MemoryEnvelopeGrain::Leaf
+                }
+            }
+        ));
+        assert!(matches!(
+            memory_envelope_decision(&existing(), &MemoryEnvelopeRequirement::NotRequested, false),
+            MemoryEnvelopeDecision::Refused {
+                cause: MemoryEnvelopeRefusalCause::Absent {
+                    grain: MemoryEnvelopeGrain::Existing
+                }
+            }
+        ));
+        assert!(matches!(
+            memory_envelope_decision(&existing(), &MemoryEnvelopeRequirement::NotRequested, true),
+            MemoryEnvelopeDecision::Bounded {
+                grain: MemoryEnvelopeGrain::Existing
+            }
+        ));
+    }
 }
 
 fn test_verb_after(operand: &str, freshness: &BinaryFreshness) -> InvocationOutcome {
@@ -3651,7 +4211,7 @@ fn run_interpolation_hole_census(source_roots: &[String]) -> InvocationOutcome {
     for line in standing.lines() {
         println!("interpolation-hole-census: {line}");
     }
-    let mut paths: Vec<std::path::PathBuf> = Vec::new();
+    let mut paths = Vec::new();
     for root in source_roots {
         if let Err(detail) =
             cli_run::collect_dag_files_result(std::path::Path::new(root), &mut paths)
@@ -3660,9 +4220,9 @@ fn run_interpolation_hole_census(source_roots: &[String]) -> InvocationOutcome {
         }
     }
     let mut corpus: Vec<Rc<SourceFile>> = Vec::new();
-    for path in &paths {
-        let path = path.to_string_lossy().to_string();
-        match std::fs::read_to_string(&path) {
+    for source in &paths {
+        let path = source.path().to_string_lossy().to_string();
+        match source.read() {
             Ok(content) => corpus.push(Rc::new(SourceFile { path, content })),
             Err(err) => return unreached(format!("corpus file {path}: {err}")),
         }
diff --git a/src/v1/stage0/src/v1_compiler_compile.rs b/src/v1/stage0/src/v1_compiler_compile.rs
index d58499e2e97..a1df5111f45 100644
--- a/src/v1/stage0/src/v1_compiler_compile.rs
+++ b/src/v1/stage0/src/v1_compiler_compile.rs
@@ -6,6 +6,7 @@ use self::CensusModuleRetention::*;
 use self::CorpusScope::*;
 use self::TestReferenceRowScope::*;
 pub use crate::extdeps_languages_dag_syntax::dag_parse_environment;
+pub use crate::gunbc_rust_emitted_crate::EmittedRustCrate;
 pub use crate::gunbc_rust_emitted_edge::EmittedEdge;
 pub use crate::std_compiler_entry::CompilerEntryDriver;
 use crate::std_compiler_entry::CompilerEntryDriver::RetainedHostCliKernel;
@@ -160,6 +161,7 @@ pub struct PipelineResult {
     pub artifact_plan: Rc<ArtifactPlan>,
     pub newline_indices: Rc<Vec<Rc<NewlineIndex>>>,
     pub emitted_edges: Rc<Vec<Rc<EmittedEdge>>>,
+    pub rust_crates: Rc<Vec<Rc<EmittedRustCrate>>>,
 }
 
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
@@ -1357,6 +1359,7 @@ pub fn emit_artifact(typed: Rc<ResolvedGraph>, artifact: Rc<Artifact>) -> Rc<Emi
                 files: Rc::new(vec![]),
                 diagnostics: unmodeled_transports.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         match artifact.target.clone() {
@@ -3275,6 +3278,7 @@ pub fn emit_dag_artifact(typed: Rc<ResolvedGraph>) -> Rc<EmitResult> {
                 files: Rc::new(vec![]),
                 diagnostics: collected.collision_errors.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let order = collected.order.clone();
@@ -3285,6 +3289,7 @@ pub fn emit_dag_artifact(typed: Rc<ResolvedGraph>) -> Rc<EmitResult> {
                 files: Rc::new(vec![]),
                 diagnostics: ref_errors.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let source_indices = dag_graph_source_indices(typed.clone());
@@ -3352,6 +3357,7 @@ pub fn emit_dag_artifact(typed: Rc<ResolvedGraph>) -> Rc<EmitResult> {
             })]),
             diagnostics: Rc::new(vec![]),
             emitted_edges: Rc::new(vec![]),
+            rust_crates: Rc::new(vec![]),
         })
     }
 }
@@ -3458,6 +3464,7 @@ pub fn emit_from_artifact_plan(
                     "compile_sources planned no artifacts".to_string(),
                 )]),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let boundary_diags = validate_boundaries(artifact_plan.clone());
@@ -3466,6 +3473,7 @@ pub fn emit_from_artifact_plan(
                 files: Rc::new(vec![]),
                 diagnostics: boundary_diags.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let results = Rc::new({
@@ -3499,6 +3507,13 @@ pub fn emit_from_artifact_plan(
                 }
                 __result
             }),
+            rust_crates: Rc::new({
+                let mut __result = Vec::new();
+                for r in results.iter().cloned() {
+                    __result.extend((*r.rust_crates.clone()).iter().cloned());
+                }
+                __result
+            }),
         })
     }
 }
@@ -4207,6 +4222,7 @@ pub fn emit_resolved_for_target_selected(
             artifact_plan: empty_artifact_plan(),
             newline_indices: resolved.newline_indices.clone(),
             emitted_edges: Rc::new(vec![]),
+            rust_crates: Rc::new(vec![]),
         }),
         Some(emittable) => {
             let typed = emittable.graph();
@@ -4255,6 +4271,11 @@ pub fn emit_resolved_for_target_selected(
                 } else {
                     emit_result.emitted_edges.clone()
                 },
+                rust_crates: if ((emit_errors.clone().len() as i64) > 0) {
+                    Rc::new(vec![])
+                } else {
+                    emit_result.rust_crates.clone()
+                },
             })
         }
     }
diff --git a/src/v1/stage0/src/v1_compiler_compiler_tests_rust.rs b/src/v1/stage0/src/v1_compiler_compiler_tests_rust.rs
index c5c5b0b9a60..045da00c90a 100644
--- a/src/v1/stage0/src/v1_compiler_compiler_tests_rust.rs
+++ b/src/v1/stage0/src/v1_compiler_compiler_tests_rust.rs
@@ -33,7 +33,7 @@ pub fn ct_workspace_helpers() -> String {
 }
 
 pub fn ct_file_discovery_helpers() -> String {
-    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    /// Discover all .dag files under a directory, returning (relative_path, content) pairs.\n".to_string(), "    /// The relative path is relative to the workspace root.\n".to_string()), "    fn discover_dag_files(dir: &str) -> Vec<(String, String)> {\n".to_string()), "        let root = workspace_root();\n".to_string()), "        let base = root.join(dir);\n".to_string()), "        let mut results = Vec::new();\n".to_string()), "        collect_dag_recursive(&base, &root, &mut results);\n".to_string()), "        results.sort_by(|a, b| a.0.cmp(&b.0));\n".to_string()), "        results\n".to_string()), "    }\n\n".to_string()), "    fn collect_dag_recursive(\n".to_string()), "        dir: &std::path::Path,\n".to_string()), "        root: &std::path::Path,\n".to_string()), "        out: &mut Vec<(String, String)>,\n".to_string()), "    ) {\n".to_string()), "        crate::cli_run::derived_row_roster::ensure_if_row_dir_or_panic(dir);\n".to_string()), "        if let Ok(entries) = std::fs::read_dir(dir) {\n".to_string()), "            for entry in entries.flatten() {\n".to_string()), "                let path = entry.path();\n".to_string()), "                if path.is_dir() {\n".to_string()), "                    collect_dag_recursive(&path, root, out);\n".to_string()), "                } else if path.extension().map_or(false, |e| e == \"dag\") {\n".to_string()), "                    let rel = path\n".to_string()), "                        .strip_prefix(root)\n".to_string()), "                        .unwrap()\n".to_string()), "                        .to_string_lossy()\n".to_string()), "                        .to_string();\n".to_string()), "                    // Test fixtures (e.g. fact_cardinality_split_brace.dag) are not modules.\n".to_string()), "                    if rel.contains(\"/tests/\") {\n".to_string()), "                        continue;\n".to_string()), "                    }\n".to_string()), "                    let content = std::fs::read_to_string(&path)\n".to_string()), "                        .unwrap_or_else(|e| panic!(\"failed to read {}: {}\", path.display(), e));\n".to_string()), "                    out.push((rel, content));\n".to_string()), "                }\n".to_string()), "            }\n".to_string()), "        }\n".to_string()), "    }\n\n".to_string())
+    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    /// Discover all .dag files under a directory, returning (relative_path, content) pairs.\n".to_string(), "    /// The relative path is relative to the workspace root.\n".to_string()), "    fn discover_dag_files(dir: &str) -> Vec<(String, String)> {\n".to_string()), "        let root = workspace_root();\n".to_string()), "        let base = root.join(dir);\n".to_string()), "        let mut results = Vec::new();\n".to_string()), "        collect_dag_recursive(&base, &root, &mut results);\n".to_string()), "        results.sort_by(|a, b| a.0.cmp(&b.0));\n".to_string()), "        results\n".to_string()), "    }\n\n".to_string()), "    fn collect_dag_recursive(\n".to_string()), "        dir: &std::path::Path,\n".to_string()), "        root: &std::path::Path,\n".to_string()), "        out: &mut Vec<(String, String)>,\n".to_string()), "    ) {\n".to_string()), "        if let Ok(entries) = std::fs::read_dir(dir) {\n".to_string()), "            let mut here = Vec::new();\n".to_string()), "            for entry in entries.flatten() {\n".to_string()), "                let path = entry.path();\n".to_string()), "                if path.is_dir() {\n".to_string()), "                    collect_dag_recursive(&path, root, out);\n".to_string()), "                } else if path.extension().map_or(false, |e| e == \"dag\") {\n".to_string()), "                    here.push(path);\n".to_string()), "                }\n".to_string()), "            }\n".to_string()), "            // Admitted per directory, so a ledger row directory contributes its derived roster\n".to_string()), "            // in memory (`derived_row_roster::acquire_dir_files`) rather than as a written file.\n".to_string()), "            let acquired = crate::cli_run::derived_row_roster::acquire_dir_files(dir, here)\n".to_string()), "                .unwrap_or_else(|e| panic!(\"{}\", e));\n".to_string()), "            for source in acquired {\n".to_string()), "                let path = source.path();\n".to_string()), "                let rel = path\n".to_string()), "                    .strip_prefix(root)\n".to_string()), "                    .unwrap()\n".to_string()), "                    .to_string_lossy()\n".to_string()), "                    .to_string();\n".to_string()), "                // Test fixtures (e.g. fact_cardinality_split_brace.dag) are not modules.\n".to_string()), "                if rel.contains(\"/tests/\") {\n".to_string()), "                    continue;\n".to_string()), "                }\n".to_string()), "                let content = source\n".to_string()), "                    .read()\n".to_string()), "                    .unwrap_or_else(|e| panic!(\"failed to read {}: {}\", path.display(), e));\n".to_string()), "                out.push((rel, content));\n".to_string()), "            }\n".to_string()), "        }\n".to_string()), "    }\n\n".to_string())
 }
 
 pub fn ct_source_builders() -> String {
@@ -152,8 +152,20 @@ pub fn ct_unbound_reference_to_a_twice_declared_leaf_refuses_test() -> String {
     v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    // A REFERENCE NO ARM RESOLVES REFUSES, AND SAYS WHICH LEAF. hom.third names Slot through a\n".to_string(), "    // qualifier no module answers to, so resolve binds nothing and stamps nothing; two modules\n".to_string()), "    // declare Slot, so the spelling does not decide either. The leaf-keyed index took whichever Slot\n".to_string()), "    // was folded last. THE CONTROL is the same reference in a closure with ONE Slot: the spelling\n".to_string()), "    // then names a sole declarer and the holder emits with that declaration's bound.\n".to_string()), "    #[test]\n".to_string()), "    fn unbound_reference_to_a_twice_declared_leaf_refuses() {\n".to_string()), "        use crate::v1_compiler_compile::SourceFile;\n".to_string()), "        let wide = || std::rc::Rc::new(SourceFile { path: \"fixtures/same_leaf_refusal/wide.dag\".to_string(), content: \"module hom.wide\\n\\ntype Inner<C> {\\n  value: C\\n}\\n\\ntype Slot<A, B> {\\n  first: Inner<A>\\n  second: Inner<B>\\n}\\n\".to_string() });\n".to_string()), "        let narrow = || std::rc::Rc::new(SourceFile { path: \"fixtures/same_leaf_refusal/narrow.dag\".to_string(), content: \"module hom.narrow\\n\\ntype Slot<T> {\\n  held: T\\n}\\n\".to_string() });\n".to_string()), "        let third = || std::rc::Rc::new(SourceFile { path: \"fixtures/same_leaf_refusal/third.dag\".to_string(), content: \"module hom.third\\n\\ntype Odd<K> {\\n  slot: no.such.module.Slot<K>\\n}\\n\".to_string() });\n".to_string()), "        let emitted = |sources: Vec<std::rc::Rc<SourceFile>>| -> String {\n".to_string()), "            let result = crate::v1_compiler_compile::compile_sources(std::rc::Rc::new(sources.into()), crate::v1_compiler_artifact::RenderTarget::Rust);\n".to_string()), "            result.files.iter().find(|f| f.path.contains(\"hom_third\")).map(|f| f.content.clone()).unwrap_or_default()\n".to_string()), "        };\n".to_string()), "        let red = emitted(vec![wide(), narrow(), third()]);\n".to_string()), "        assert!(red.contains(\"compile_error!\") && red.contains(\"item 'Odd' references type 'Slot', which more than one module of this closure declares\"), \"two declarers and no identity must refuse, naming the leaf:\\n{red}\");\n".to_string()), "        let control = emitted(vec![narrow(), third()]);\n".to_string()), "        assert!(control.contains(\"pub struct Odd<K: Clone>\") && !control.contains(\"more than one module of this closure declares\"), \"a sole declarer resolves by spelling:\\n{control}\");\n".to_string()), "    }\n\n".to_string())
 }
 
+pub fn ct_a_coproduct_named_optional_emits_as_its_own_enum_test() -> String {
+    Rc::new(vec!["    // A COPRODUCT NAMED Optional EMITS AS ITS OWN ENUM. still-raven-321's fixture,\n".to_string(), "    // fixtures/native_emission_controls_optional_collision.dag, is a non-kernel declaration that shares\n".to_string(), "    // the kernel mint's leaf. Host-Option is decided by declaration (v1.compiler.emit_rust\n".to_string(), "    // declaration_owns_host_option over gunbc.structural_realization_bindings kernel_mint_declaration_rows),\n".to_string(), "    // so its positions name its own enum. THE RED is the leaf rule this replaced: every position rendered\n".to_string(), "    // as Option<..> and the variants were never emitted (E0425 cannot find CollisionWrapped). The fixture\n".to_string(), "    // lives outside the source roots, because a second Optional in the accepted corpus is a leaf-name fork,\n".to_string(), "    // so it is compiled here, from its file, beside a kernel std.optional. Its one import line names a\n".to_string(), "    // kernel type and is dropped so the pair compiles standalone.\n".to_string(), "    #[test]\n".to_string(), "    fn a_coproduct_named_optional_emits_as_its_own_enum() {\n".to_string(), "        use crate::v1_compiler_compile::SourceFile;\n".to_string(), "        let collision = read_dag(\"fixtures/native_emission_controls_optional_collision.dag\").replace(\"import std.types { Int }\\n\", \"\");\n".to_string(), "        let sources = vec![\n".to_string(), "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/optional.dag\".to_string(), content: \"module std.optional\\n\\ntype Optional<T>\\n  = Present { value: T }\\n  | Absent\\n\".to_string() }),\n".to_string(), "            std::rc::Rc::new(SourceFile { path: \"fixtures/native_emission_controls_optional_collision.dag\".to_string(), content: collision }),\n".to_string(), "        ];\n".to_string(), "        let result = crate::v1_compiler_compile::compile_sources(std::rc::Rc::new(sources.into()), crate::v1_compiler_artifact::RenderTarget::Rust);\n".to_string(), "        let emitted = result.files.iter().find(|f| f.path.contains(\"native_emission_controls_optional_collision\")).map(|f| f.content.clone()).unwrap_or_default();\n".to_string(), "        assert!(emitted.contains(\"pub enum Optional\") && emitted.contains(\"CollisionWrapped\"), \"the collision coproduct must emit as its own enum:\\n{emitted}\");\n".to_string(), "        assert!(!emitted.contains(\"Option<\") && !emitted.contains(\"compile_error!\"), \"no position of the collision coproduct may realize as the host Option:\\n{emitted}\");\n".to_string(), "    }\n".to_string(), "\n".to_string()]).join(&"".to_string())
+}
+
+pub fn ct_unstamped_bare_optional_follows_the_lookup_binding_order_test() -> String {
+    Rc::new(vec!["    // AN UNSTAMPED BARE `Optional` FOLLOWS THE TYPECHECKER'S lookup_binding ORDER: own file, then\n".to_string(), "    // the file's named import (followed through re-exports), then the kernel\n".to_string(), "    // (v1.compiler.infer_env bare_occurrence_binding). The member references of a coproduct body reach\n".to_string(), "    // the emitter from the type environment's copy with no Node.declaration, so the census route is\n".to_string(), "    // the emitter's own decision. THE RED is the importer: with the kernel ahead of the named import\n".to_string(), "    // (the order direct_import_export_precedence_note states) its payload routes kernel_mint to\n".to_string(), "    // std.optional, measured on gunbc#13454 at 57551c4b. The control keeps a module that names\n".to_string(), "    // Optional without importing it on the kernel arm.\n".to_string(), "    #[test]\n".to_string(), "    fn unstamped_bare_optional_follows_the_lookup_binding_order() {\n".to_string(), "        use crate::v1_compiler_compile::SourceFile;\n".to_string(), "        let sources = vec![\n".to_string(), "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/optional.dag\".to_string(), content: \"module std.optional\\n\\ntype Optional<T>\\n  = Present { value: T }\\n  | Absent\\n\".to_string() }),\n".to_string(), "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/collision.dag\".to_string(), content: \"module hom.collision\\n\\ntype Optional\\n  = CollisionWrapped { value: Int }\\n  | CollisionEmpty\\n\".to_string() }),\n".to_string(), "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/importer.dag\".to_string(), content: \"module hom.importer\\n\\nimport hom.collision { Optional }\\n\\ntype HeldChoice\\n  = HeldOptional { held: Optional }\\n  | HeldNothing\\n\".to_string() }),\n".to_string(), "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/plain.dag\".to_string(), content: \"module hom.plain\\n\\ntype PlainChoice\\n  = PlainHeld { held: Optional<Int> }\\n  | PlainNothing\\n\".to_string() }),\n".to_string(), "            std::rc::Rc::new(SourceFile { path: \"fixtures/kernel_shadow/user.dag\".to_string(), content: \"module hom.user\\n\\nimport hom.importer { HeldChoice }\\nimport hom.plain { PlainChoice }\\n\\nfn pick(h: HeldChoice, p: PlainChoice) -> Int {\\n  1\\n}\\n\".to_string() }),\n".to_string(), "        ];\n".to_string(), "        let receipt = crate::v1_tests_claim_carrier_realization_census::typed_census_from_sources(std::rc::Rc::new(sources.into()));\n".to_string(), "        assert!(!receipt.starts_with(\"REFUSED\"), \"{receipt}\");\n".to_string(), "        let routes = |enclosing: &str| -> Vec<String> {\n".to_string(), "            receipt.lines().skip(1).map(|l| l.split('\\t').collect::<Vec<_>>())\n".to_string(), "                .filter(|c| c[1] == enclosing && c[2] == \"declaration_field\" && c[3] == \"Optional\")\n".to_string(), "                .map(|c| c[13].to_string()).collect()\n".to_string(), "        };\n".to_string(), "        let held = routes(\"HeldChoice\");\n".to_string(), "        assert!(!held.is_empty() && held.iter().all(|r| r == \"referencing_module_import:Resolved:hom.collision.Optional\"), \"the imported Optional must route to the import, never the kernel mint:\\n{receipt}\");\n".to_string(), "        let plain = routes(\"PlainChoice\");\n".to_string(), "        assert!(!plain.is_empty() && plain.iter().all(|r| r == \"kernel_mint:Resolved:std.optional.Optional\"), \"an unimported Optional is the kernel's:\\n{receipt}\");\n".to_string(), "        assert!(!receipt.contains(\"LeafAmbiguous:Optional\"), \"{receipt}\");\n".to_string(), "    }\n".to_string(), "\n".to_string()]).join(&"".to_string())
+}
+
+pub fn ct_same_leaf_type_elsewhere_leaves_other_modules_emission_unchanged_test() -> String {
+    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    // A SAME-LEAF TYPE ANYWHERE MUST NOT CHANGE ANOTHER MODULE'S EMISSION. hom.user returns the kernel\n".to_string(), "    // optional's Absent; hom.edge declares an unrelated enum that also has an Absent variant. With the\n".to_string()), "    // leaf-keyed type summaries, adding hom.coll (a coproduct it declares as Optional) replaced the\n".to_string()), "    // kernel Optional's summary, so Absent stopped being an Optional variant and hom.user emitted\n".to_string()), "    // Rc::new(Lookup::Absent) where it had emitted None. Keyed by declaration, both summaries stand:\n".to_string()), "    // hom.user's file is byte-identical with and without hom.coll, and its Absent is the host None.\n".to_string()), "    #[test]\n".to_string()), "    fn same_leaf_type_elsewhere_leaves_other_modules_emission_unchanged() {\n".to_string()), "        use crate::v1_compiler_compile::SourceFile;\n".to_string()), "        let src = |path: &str, content: &str| std::rc::Rc::new(SourceFile { path: path.to_string(), content: content.to_string() });\n".to_string()), "        let optional = || src(\"fixtures/same_leaf_optional/optional.dag\", \"module std.optional\\n\\ntype Optional<T>\\n  = Present { value: T }\\n  | Absent\\n\");\n".to_string()), "        let edge = || src(\"fixtures/same_leaf_optional/edge.dag\", \"module hom.edge\\n\\ntype Lookup\\n  = Found { at: Int }\\n  | Absent\\n\");\n".to_string()), "        let user = || src(\"fixtures/same_leaf_optional/user.dag\", \"module hom.user\\nimport std.optional { Optional, Present, Absent }\\n\\nfn nothing_here(x: Int) -> Optional<Int> {\\n  Absent\\n}\\n\");\n".to_string()), "        let coll = || src(\"fixtures/same_leaf_optional/coll.dag\", \"module hom.coll\\n\\ntype Optional\\n  = CollisionWrapped { value: Int }\\n  | CollisionEmpty\\n\");\n".to_string()), "        let emitted_user = |sources: Vec<std::rc::Rc<SourceFile>>| -> String {\n".to_string()), "            let result = crate::v1_compiler_compile::compile_sources(std::rc::Rc::new(sources.into()), crate::v1_compiler_artifact::RenderTarget::Rust);\n".to_string()), "            result.files.iter().find(|f| f.path.contains(\"hom_user\")).map(|f| f.content.clone()).unwrap_or_default()\n".to_string()), "        };\n".to_string()), "        let without = emitted_user(vec![optional(), edge(), user()]);\n".to_string()), "        let with = emitted_user(vec![optional(), edge(), user(), coll()]);\n".to_string()), "        assert!(without.contains(\"None\") && !without.contains(\"Lookup::Absent\"), \"the control: hom.user's Absent is the host None:\\n{without}\");\n".to_string()), "        assert_eq!(with, without, \"adding a same-leaf Optional elsewhere changed hom.user's emission\");\n".to_string()), "    }\n".to_string()), "\n".to_string())
+}
+
 pub fn ct_qualified_reference_is_not_decided_by_the_local_declarer_test() -> String {
-    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    // A QUALIFIED REFERENCE IS NOT DECIDED BY THE LOCAL DECLARER. hom.local declares its own Slot\n".to_string(), "    // and ALSO names no.such.module.Slot, which resolve cannot bind, so the reference reaches the\n".to_string()), "    // emitter unstamped while two modules declare Slot. The referencing-module arm\n".to_string()), "    // (v1.compiler.infer_emit_info type_decl_referencing_module_declarer) would pick the LOCAL Slot:\n".to_string()), "    // the wrong-declarer class itself. It is admitted only for a bare spelling, so this refuses.\n".to_string()), "    // THE CONTROL is the same module without the second declarer: the spelling names a sole\n".to_string()), "    // declarer, and nothing refuses.\n".to_string()), "    #[test]\n".to_string()), "    fn qualified_reference_is_not_decided_by_the_local_declarer() {\n".to_string()), "        use crate::v1_compiler_compile::SourceFile;\n".to_string()), "        let wide = || std::rc::Rc::new(SourceFile { path: \"fixtures/same_leaf_qualified/wide.dag\".to_string(), content: \"module hom.wide\\n\\ntype Inner<C> {\\n  value: C\\n}\\n\\ntype Slot<A, B> {\\n  first: Inner<A>\\n  second: Inner<B>\\n}\\n\".to_string() });\n".to_string()), "        let local = || std::rc::Rc::new(SourceFile { path: \"fixtures/same_leaf_qualified/local.dag\".to_string(), content: \"module hom.local\\n\\ntype Slot<T> {\\n  held: T\\n}\\n\\ntype Odd<K> {\\n  slot: no.such.module.Slot<K>\\n}\\n\".to_string() });\n".to_string()), "        let emitted = |sources: Vec<std::rc::Rc<SourceFile>>| -> String {\n".to_string()), "            let result = crate::v1_compiler_compile::compile_sources(std::rc::Rc::new(sources.into()), crate::v1_compiler_artifact::RenderTarget::Rust);\n".to_string()), "            result.files.iter().find(|f| f.path.contains(\"hom_local\")).map(|f| f.content.clone()).unwrap_or_default()\n".to_string()), "        };\n".to_string()), "        let red = emitted(vec![wide(), local()]);\n".to_string()), "        assert!(red.contains(\"compile_error!\") && red.contains(\"item 'Odd' references type 'Slot', which more than one module of this closure declares\"), \"a qualified unstamped reference must refuse, not take the local Slot:\\n{red}\");\n".to_string()), "        let control = emitted(vec![local()]);\n".to_string()), "        assert!(control.contains(\"pub struct Odd<K: Clone>\") && !control.contains(\"more than one module of this closure declares\"), \"a sole declarer resolves by spelling:\\n{control}\");\n".to_string()), "    }\n\n".to_string())
+    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    // A QUALIFIED REFERENCE IS NOT DECIDED BY THE LOCAL DECLARER. hom.local declares its own Slot\n".to_string(), "    // and ALSO names no.such.module.Slot, which resolve cannot bind, so the reference reaches the\n".to_string()), "    // emitter unstamped while two modules declare Slot. The referencing-module arm\n".to_string()), "    // (v1.compiler.infer_emit_info type_decl_occurrence_binding) would pick the LOCAL Slot:\n".to_string()), "    // the wrong-declarer class itself. It is admitted only for a bare spelling, so this refuses.\n".to_string()), "    // THE CONTROL is the same module without the second declarer: the spelling names a sole\n".to_string()), "    // declarer, and nothing refuses.\n".to_string()), "    #[test]\n".to_string()), "    fn qualified_reference_is_not_decided_by_the_local_declarer() {\n".to_string()), "        use crate::v1_compiler_compile::SourceFile;\n".to_string()), "        let wide = || std::rc::Rc::new(SourceFile { path: \"fixtures/same_leaf_qualified/wide.dag\".to_string(), content: \"module hom.wide\\n\\ntype Inner<C> {\\n  value: C\\n}\\n\\ntype Slot<A, B> {\\n  first: Inner<A>\\n  second: Inner<B>\\n}\\n\".to_string() });\n".to_string()), "        let local = || std::rc::Rc::new(SourceFile { path: \"fixtures/same_leaf_qualified/local.dag\".to_string(), content: \"module hom.local\\n\\ntype Slot<T> {\\n  held: T\\n}\\n\\ntype Odd<K> {\\n  slot: no.such.module.Slot<K>\\n}\\n\".to_string() });\n".to_string()), "        let emitted = |sources: Vec<std::rc::Rc<SourceFile>>| -> String {\n".to_string()), "            let result = crate::v1_compiler_compile::compile_sources(std::rc::Rc::new(sources.into()), crate::v1_compiler_artifact::RenderTarget::Rust);\n".to_string()), "            result.files.iter().find(|f| f.path.contains(\"hom_local\")).map(|f| f.content.clone()).unwrap_or_default()\n".to_string()), "        };\n".to_string()), "        let red = emitted(vec![wide(), local()]);\n".to_string()), "        assert!(red.contains(\"compile_error!\") && red.contains(\"item 'Odd' references type 'Slot', which more than one module of this closure declares\"), \"a qualified unstamped reference must refuse, not take the local Slot:\\n{red}\");\n".to_string()), "        let control = emitted(vec![local()]);\n".to_string()), "        assert!(control.contains(\"pub struct Odd<K: Clone>\") && !control.contains(\"more than one module of this closure declares\"), \"a sole declarer resolves by spelling:\\n{control}\");\n".to_string()), "    }\n\n".to_string())
 }
 
 pub fn ct_duplicate_type_parameter_refuses_test() -> String {
@@ -174,7 +186,7 @@ pub fn ct_coercion_tests() -> String {
             }
             __result
         });
-        v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    // =========================================================================\n".to_string(), "    // Coercion registry tests (auto-generated from data declarations)\n".to_string()), "    // =========================================================================\n\n".to_string()), test_fns.clone().join(&"\n".to_string())), ct_rust_btree_set_ord_eligibility_test()), ct_unresolved_variant_pattern_refuses_test()), ct_diagnostics_carrier_grounding_test()), ct_std_nat_realization_agreement_test()), ct_std_nat_operators_refuse_overflow_test()), ct_render_rust_applied_type_qualified_base_test()), ct_measure_unit_variant_exact_one_test()), ct_renderer_hop_identity_keying_test()), ct_generic_param_declines_fail_closed_unwrap_test()), ct_witness_carrier_declines_non_witness_expected_type_test()), ct_kernel_identity_single_authority_test()), ct_type_reference_identity_split_test()), ct_declaration_field_reference_identity_test()), ct_same_leaf_type_declarations_emit_by_identity_test()), ct_unbound_reference_to_a_twice_declared_leaf_refuses_test()), ct_qualified_reference_is_not_decided_by_the_local_declarer_test()), ct_duplicate_type_parameter_refuses_test()), ct_resource_item_is_not_a_type_item_test())
+        v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    // =========================================================================\n".to_string(), "    // Coercion registry tests (auto-generated from data declarations)\n".to_string()), "    // =========================================================================\n\n".to_string()), test_fns.clone().join(&"\n".to_string())), ct_rust_btree_set_ord_eligibility_test()), ct_unresolved_variant_pattern_refuses_test()), ct_diagnostics_carrier_grounding_test()), ct_std_nat_realization_agreement_test()), ct_std_nat_operators_refuse_overflow_test()), ct_render_rust_applied_type_qualified_base_test()), ct_measure_unit_variant_exact_one_test()), ct_renderer_hop_identity_keying_test()), ct_generic_param_declines_fail_closed_unwrap_test()), ct_witness_carrier_declines_non_witness_expected_type_test()), ct_kernel_identity_single_authority_test()), ct_type_reference_identity_split_test()), ct_declaration_field_reference_identity_test()), ct_same_leaf_type_declarations_emit_by_identity_test()), ct_unbound_reference_to_a_twice_declared_leaf_refuses_test()), ct_qualified_reference_is_not_decided_by_the_local_declarer_test()), ct_same_leaf_type_elsewhere_leaves_other_modules_emission_unchanged_test()), ct_unstamped_bare_optional_follows_the_lookup_binding_order_test()), ct_a_coproduct_named_optional_emits_as_its_own_enum_test()), ct_duplicate_type_parameter_refuses_test()), ct_resource_item_is_not_a_type_item_test())
     }
 }
 
@@ -207,7 +219,7 @@ pub fn ct_std_nat_operators_refuse_overflow_test() -> String {
 }
 
 pub fn ct_diagnostics_carrier_grounding_test() -> String {
-    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    #[test]\n".to_string(), "    fn diagnostics_carrier_grounds_to_native_option() {\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_host_diagnostics_carrier_alias(\"Diagnostics\".to_string()));\n".to_string()), "        assert!(!crate::v1_compiler_emit_rust::is_host_diagnostics_carrier_alias(\"Optional\".to_string()));\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_grounded_coproduct_native_alias(\"Diagnostics\".to_string()));\n".to_string()), "        let empty_shared = std::rc::Rc::new(im::OrdSet::new());\n".to_string()), "        assert_eq!(\n".to_string()), "            crate::v1_compiler_emit_rust::render_rust_diagnostics_carrier_applied(empty_shared.clone()),\n".to_string()), "            \"Option<NonEmptyDiagnostics>\"\n".to_string()), "        );\n".to_string()), "        let mut shared_ned_inner = im::OrdSet::new();\n".to_string()), "        shared_ned_inner.insert(\"NonEmptyDiagnostics\".to_string());\n".to_string()), "        let shared_ned = std::rc::Rc::new(shared_ned_inner);\n".to_string()), "        assert_eq!(\n".to_string()), "            crate::v1_compiler_emit_rust::render_rust_diagnostics_carrier_applied(shared_ned),\n".to_string()), "            \"Option<Rc<NonEmptyDiagnostics>>\"\n".to_string()), "        );\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_some_like_variant_name(\"Some\".to_string()));\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_some_like_variant_name(\"Present\".to_string()));\n".to_string()), "        assert!(!crate::v1_compiler_emit_rust::is_some_like_variant_name(\"None\".to_string()));\n".to_string()), "        assert!(!crate::v1_compiler_emit_rust::is_some_like_variant_name(\"Absent\".to_string()));\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_optional_like_parent_name(\"Diagnostics\".to_string()));\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_optional_like_parent_name(\"Optional\".to_string()));\n".to_string()), "        assert!(!crate::v1_compiler_emit_rust::is_optional_like_parent_name(\"Witness\".to_string()));\n".to_string()), "        let diagnostics_node = named_type_node(\"Diagnostics\");\n".to_string()), "        let source_indices = std::rc::Rc::new(HashMap::new());\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_host_diagnostics_carrier_type(diagnostics_node.clone(), source_indices.clone()));\n".to_string()), "        let empty_emit = crate::v1_compiler_infer_emit_info::empty_emit_graph_info();\n".to_string()), "        assert_eq!(\n".to_string()), "            crate::v1_compiler_emit_rust::render_rust_type(\n".to_string()), "                diagnostics_node,\n".to_string()), "                empty_shared,\n".to_string()), "                source_indices,\n".to_string()), "                empty_emit\n".to_string()), "            ),\n".to_string()), "            \"Option<NonEmptyDiagnostics>\"\n".to_string()), "        );\n".to_string()), "    }\n\n".to_string())
+    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    #[test]\n".to_string(), "    fn diagnostics_carrier_grounds_to_native_option() {\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_host_diagnostics_carrier_alias(\"Diagnostics\".to_string()));\n".to_string()), "        assert!(!crate::v1_compiler_emit_rust::is_host_diagnostics_carrier_alias(\"Optional\".to_string()));\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::declaration_is_grounded_coproduct_native_alias(\"v2.std.diagnostic\".to_string(), \"Diagnostics\".to_string()));\n".to_string()), "        // The host option is a DECLARATION, not a name: the kernel optional's declaration is it, and a\n".to_string()), "        // coproduct another module declares as Optional is not.\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::declaration_is_grounded_coproduct_native_alias(\"std.optional\".to_string(), \"Optional\".to_string()));\n".to_string()), "        assert!(!crate::v1_compiler_emit_rust::declaration_is_grounded_coproduct_native_alias(\"gunbc.instruments.native_emission_controls_optional_collision\".to_string(), \"Optional\".to_string()));\n".to_string()), "        let empty_shared = std::rc::Rc::new(im::OrdSet::new());\n".to_string()), "        assert_eq!(\n".to_string()), "            crate::v1_compiler_emit_rust::render_rust_diagnostics_carrier_applied(empty_shared.clone()),\n".to_string()), "            \"Option<NonEmptyDiagnostics>\"\n".to_string()), "        );\n".to_string()), "        let mut shared_ned_inner = im::OrdSet::new();\n".to_string()), "        shared_ned_inner.insert(\"NonEmptyDiagnostics\".to_string());\n".to_string()), "        let shared_ned = std::rc::Rc::new(shared_ned_inner);\n".to_string()), "        assert_eq!(\n".to_string()), "            crate::v1_compiler_emit_rust::render_rust_diagnostics_carrier_applied(shared_ned),\n".to_string()), "            \"Option<Rc<NonEmptyDiagnostics>>\"\n".to_string()), "        );\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_some_like_variant_name(\"Some\".to_string()));\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_some_like_variant_name(\"Present\".to_string()));\n".to_string()), "        assert!(!crate::v1_compiler_emit_rust::is_some_like_variant_name(\"None\".to_string()));\n".to_string()), "        assert!(!crate::v1_compiler_emit_rust::is_some_like_variant_name(\"Absent\".to_string()));\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_optional_like_parent_name(\"Diagnostics\".to_string()));\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_optional_like_parent_name(\"Optional\".to_string()));\n".to_string()), "        assert!(!crate::v1_compiler_emit_rust::is_optional_like_parent_name(\"Witness\".to_string()));\n".to_string()), "        let diagnostics_node = named_type_node(\"Diagnostics\");\n".to_string()), "        let source_indices = std::rc::Rc::new(HashMap::new());\n".to_string()), "        assert!(crate::v1_compiler_emit_rust::is_host_diagnostics_carrier_type(diagnostics_node.clone(), source_indices.clone()));\n".to_string()), "        let empty_emit = crate::v1_compiler_infer_emit_info::empty_emit_graph_info();\n".to_string()), "        assert_eq!(\n".to_string()), "            crate::v1_compiler_emit_rust::render_rust_type(\n".to_string()), "                diagnostics_node,\n".to_string()), "                empty_shared,\n".to_string()), "                source_indices,\n".to_string()), "                empty_emit\n".to_string()), "            ),\n".to_string()), "            \"Option<NonEmptyDiagnostics>\"\n".to_string()), "        );\n".to_string()), "    }\n\n".to_string())
 }
 
 pub fn ct_rendered_leaf_occurrence_identity_test() -> String {
@@ -271,7 +283,7 @@ pub fn first_or_empty(items: Rc<Vec<String>>) -> String {
 }
 
 pub fn second_or_empty(items: Rc<Vec<String>>) -> String {
-    match items.clone().iter().cloned().skip(1 as usize).next() {
+    match items.clone().get((1) as usize).cloned() {
         Some(v) => v.clone(),
         std::option::Option::None => "".to_string(),
     }
@@ -390,7 +402,7 @@ pub fn ct_function_value_field_method_known_hole_probe_test() -> String {
 }
 
 pub fn ct_method_existence_wall_witness_test() -> String {
-    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    #[test]\n".to_string(), "    fn method_existence_wall_witness() {\n".to_string()), "        // DISCRIMINATING RED for method_existence_wall_note. Before the wall an\n".to_string()), "        // unresolved method inherited the RECEIVER's type with no diagnostic, so\n".to_string()), "        // `xs |> filter_map(..)` on List<Int> typed as List<Int>, compiled clean, and\n".to_string()), "        // died at InterpError::Unimplemented in live dispatch (#7479, HTTP 500).\n".to_string()), "        let result = std::thread::Builder::new()\n".to_string()), "            .stack_size(8 * 1024 * 1024)\n".to_string()), "            .spawn(|| {\n".to_string()), "                let red = std::rc::Rc::new(crate::v1_compiler_compile::SourceFile {\n".to_string()), "                    path: \"red.dag\".to_string(),\n".to_string()), "                    content: \"module red\\nfn f(xs: List<Int>) -> List<Int> { xs |> filter_map(x => x) }\\nfn g(xs: List<Int>) -> Bool { xs |> starts_with(\\\"x\\\") }\\nfn h(xs: List<Int>) -> String { xs |> to_upper() }\\n\".to_string(),\n".to_string()), "                });\n".to_string()), "                let red_result = crate::v1_compiler_compile::compile_sources(\n".to_string()), "                    std::rc::Rc::new(im::vector![red]),\n".to_string()), "                    crate::v1_compiler_artifact::RenderTarget::Rust,\n".to_string()), "                );\n".to_string()), "                let missing: Vec<_> = red_result.diagnostics.iter()\n".to_string()), "                    .filter(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodNotFound { .. }))\n".to_string()), "                    .collect();\n".to_string()), "                assert!(\n".to_string()), "                    missing.len() >= 3,\n".to_string()), "                    \"expected MethodNotFound for the unresolved method AND for rostered names on a receiver that does not offer them (starts_with / to_upper on List<Int> — codex review 45327: a name-grain predicate admitted these), got: {:?}\",\n".to_string()), "                    red_result.diagnostics\n".to_string()), "                );\n".to_string()), "                // POSITIVE CONTROLS the wall must not touch: algebra method templates\n".to_string()), "                // resolve at tier0, and `count` is in the declared std.methods roster\n".to_string()), "                // even though free_monoid_scalar_templates omits it (the measured fork).\n".to_string()), "                let green = std::rc::Rc::new(crate::v1_compiler_compile::SourceFile {\n".to_string()), "                    path: \"green.dag\".to_string(),\n".to_string()), "                    content: \"module green\\nfn p(xs: List<Int>) -> List<Int> { xs |> filter(x => x > 1) |> map(x => x + 1) }\\nfn q(xs: List<Int>) -> Int { xs |> fold(0, (a, x) => a + x) }\\nfn r(s: String) -> Int { s |> count }\\n\".to_string(),\n".to_string()), "                });\n".to_string()), "                let green_result = crate::v1_compiler_compile::compile_sources(\n".to_string()), "                    std::rc::Rc::new(im::vector![green]),\n".to_string()), "                    crate::v1_compiler_artifact::RenderTarget::Rust,\n".to_string()), "                );\n".to_string()), "                // The positive control asserts ZERO diagnostics, not merely no\n".to_string()), "                // MethodNotFound. Filtering to the blocking variant let an ADVISORY\n".to_string()), "                // MethodExistenceUndecided pass unnoticed, which is how `String |> count`\n".to_string()), "                // was reported as a passing control while it was actually resolving\n".to_string()), "                // through the non-blocking arm (codex review 45357).\n".to_string()), "                assert!(\n".to_string()), "                    green_result.diagnostics.is_empty(),\n".to_string()), "                    \"legitimate methods must resolve with NO diagnostic of any severity — an advisory here means the call is not actually resolving, got: {:?}\",\n".to_string()), "                    green_result.diagnostics\n".to_string()), "                );\n".to_string()), "                // DISCRIMINATING RED for the declared frontier (codex reviews 45357,\n".to_string()), "                // 45383). An undecided method existence must BLOCK, so the graph is\n".to_string()), "                // never emitted on an unestablished judgment; the only non-blocking\n".to_string()), "                // path is a DECLARED frontier row, which is countable and carries its\n".to_string()), "                // own dissolution trigger. The two halves must be discriminated by\n".to_string()), "                // MODULE NAME on otherwise identical source — an admission that fires\n".to_string()), "                // for any module is an escape hatch, not a frontier.\n".to_string()), "                let frontier_src = |module: &str, method: &str| {\n".to_string()), "                    format!(\"module {}\\ntype T {{ a: Int }}\\nfn f(t: T) -> Int {{ t |> {}(1) }}\\n\", module, method)\n".to_string()), "                };\n".to_string()), "                let compile_one = |path: &str, content: String| {\n".to_string()), "                    crate::v1_compiler_compile::compile_sources(\n".to_string()), "                        std::rc::Rc::new(im::vector![std::rc::Rc::new(\n".to_string()), "                            crate::v1_compiler_compile::SourceFile {\n".to_string()), "                                path: path.to_string(),\n".to_string()), "                                content,\n".to_string()), "                            }\n".to_string()), "                        )]),\n".to_string()), "                        crate::v1_compiler_artifact::RenderTarget::Rust,\n".to_string()), "                    )\n".to_string()), "                };\n".to_string()), "                let unlisted = compile_one(\"unlisted.dag\", frontier_src(\"unlisted.module\", \"list_push\"));\n".to_string()), "                let undecided: Vec<_> = unlisted.diagnostics.iter()\n".to_string()), "                    .filter(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodExistenceUndecided { .. }))\n".to_string()), "                    .collect();\n".to_string()), "                assert!(\n".to_string()), "                    !undecided.is_empty(),\n".to_string()), "                    \"a method whose existence is undecided in a module with NO declared frontier row must refuse, got: {:?}\",\n".to_string()), "                    unlisted.diagnostics\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    undecided.iter().all(|d| crate::v1_std_core::is_error_diagnostic(d.diagnostic.clone())\n".to_string()), "                        && crate::v1_std_core::is_interpreter_blocking_diagnostic(d.diagnostic.clone())),\n".to_string()), "                    \"MethodExistenceUndecided must BLOCK both typecheck and the interpreter — a non-blocking undecided judgment is exactly the fail-open the wall exists to close\"\n".to_string()), "                );\n".to_string()), "                // The SHAPE is part of the key, and this is the half that answers\n".to_string()), "                // codex review 45398: the module and the method both match a declared\n".to_string()), "                // row, and the call is STILL refused, because the receiver does not\n".to_string()), "                // fail to resolve in the way the row was measured on. A (module, method)\n".to_string()), "                // key passed this input; that is the fail-open the third component closes.\n".to_string()), "                let listed_wrong_shape = compile_one(\"listed.dag\", frontier_src(\"extdeps.dns.domain_name\", \"list_push\"));\n".to_string()), "                assert!(\n".to_string()), "                    listed_wrong_shape.diagnostics.iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodExistenceUndecided { .. })),\n".to_string()), "                    \"a declared row must NOT admit a new call in the same module on a receiver whose shape it was never measured on, got: {:?}\",\n".to_string()), "                    listed_wrong_shape.diagnostics\n".to_string()), "                );\n".to_string()), "                // The admission half, checked against the frontier data itself rather\n".to_string()), "                // than a synthetic source, because the residual shapes (an unnamed\n".to_string()), "                // lambda-parameter receiver, a coproduct payload typed as its variant)\n".to_string()), "                // are upstream resolution defects that cannot be conjured on demand.\n".to_string()), "                // Every declared row must be admitted by its own exact key, and\n".to_string()), "                // perturbing ANY of the three components must withdraw the admission.\n".to_string()), "                let rows = crate::v1_compiler_infer::unresolved_method_frontier();\n".to_string()), "                assert!(!rows.is_empty(), \"the frontier must be a declared, countable roster\");\n".to_string()), "                for r in rows.iter() {\n".to_string()), "                    assert!(\n".to_string()), "                        crate::v1_compiler_infer::unresolved_method_frontier_trigger(\n".to_string()), "                            r.module_name.clone(), r.method.clone(), r.receiver_shape.clone()).is_some(),\n".to_string()), "                        \"row {}/{}/{} must be admitted by its own key\", r.module_name, r.method, r.receiver_shape\n".to_string()), "                    );\n".to_string()), "                    for perturbed in [\n".to_string()), "                        (format!(\"{}.other\", r.module_name), r.method.clone(), r.receiver_shape.clone()),\n".to_string()), "                        (r.module_name.clone(), format!(\"{}_other\", r.method), r.receiver_shape.clone()),\n".to_string()), "                        (r.module_name.clone(), r.method.clone(), format!(\"Product(Other{})\", r.receiver_shape.len())),\n".to_string()), "                    ] {\n".to_string()), "                        assert!(\n".to_string()), "                            crate::v1_compiler_infer::unresolved_method_frontier_trigger(\n".to_string()), "                                perturbed.0.clone(), perturbed.1.clone(), perturbed.2.clone()).is_none(),\n".to_string()), "                            \"perturbing the key to {:?} must WITHDRAW the admission — each component is load-bearing\", perturbed\n".to_string()), "                        );\n".to_string()), "                    }\n".to_string()), "                }\n".to_string()), "                // DISCRIMINATING RED for where_refinement_receiver_peel_note. A\n".to_string()), "                // where-refinement alias reached method lookup as Product(<alias>)\n".to_string()), "                // because resolve_method_receiver_type short-circuits on Conj, so the\n".to_string()), "                // base's algebra profile was never consulted. The peel must make the\n".to_string()), "                // receiver decidable in BOTH directions on the SAME alias — a green\n".to_string()), "                // that only proves the refusal stopped is indistinguishable from\n".to_string()), "                // deleting the wall.\n".to_string()), "                let peel_src = |call: &str| {\n".to_string()), "                    format!(\"module peel\\ntype Tight = String where string_non_empty\\nfn f(s: Tight) -> Int {{ s |> {} }}\\n\", call)\n".to_string()), "                };\n".to_string()), "                let peel_green = compile_one(\"peel_green.dag\", peel_src(\"count\"));\n".to_string()), "                assert!(\n".to_string()), "                    peel_green.diagnostics.is_empty(),\n".to_string()), "                    \"a method on the refinement's String base must RESOLVE once the base is peeled — no diagnostic of any severity, got: {:?}\",\n".to_string()), "                    peel_green.diagnostics\n".to_string()), "                );\n".to_string()), "                // DISCRIMINATING RED for the two special-case arms (codex review\n".to_string()), "                // 45430). The wall was reached only from the FINAL else, so an\n".to_string()), "                // unresolved map_keys / map_values still returned the RECEIVER type\n".to_string()), "                // with an empty diagnostic list — the exact success-shaped fallback\n".to_string()), "                // this PR deletes, surviving in the two branches that ran before it.\n".to_string()), "                let special = compile_one(\"special.dag\",\n".to_string()), "                    \"module special\\nfn f(xs: List<Int>) -> List<Int> {{ xs |> map_keys }}\\nfn g(xs: List<Int>) -> List<Int> {{ xs |> map_values }}\\n\".replace(\"{{\", \"{\").replace(\"}}\", \"}\"));\n".to_string()), "                let special_missing: Vec<_> = special.diagnostics.iter()\n".to_string()), "                    .filter(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodNotFound { .. }))\n".to_string()), "                    .collect();\n".to_string()), "                assert!(\n".to_string()), "                    special_missing.len() >= 2,\n".to_string()), "                    \"map_keys and map_values must route through the SAME refusal as every other method when the receiver is not a keyed collection — a wall reachable only from the final else is not a wall, got: {:?}\",\n".to_string()), "                    special.diagnostics\n".to_string()), "                );\n".to_string()), "                // ReceiverTypeUnestablished CLASSIFICATION control. The behavioural\n".to_string()), "                // evidence for this class is the corpus census, not a synthetic\n".to_string()), "                // source: 18 sites whole-tree, counted as advisories with the gate at\n".to_string()), "                // zero blocking diagnostics. A synthetic reproducer WAS attempted --\n".to_string()), "                // an untyped lambda parameter inside a record-field fn, the shape the\n".to_string()), "                // real sites have -- and it produced no diagnostic at all, so it did\n".to_string()), "                // not reproduce the shape and is not asserted here as though it did.\n".to_string()), "                // ADMISSION is roster-gated, not automatic: an anonymous receiver is\n".to_string()), "                // admitted only where a declared row names (module, method,\n".to_string()), "                // Primitive()), and the perturbation loop above proves that gate for\n".to_string()), "                // every row. Admitting on the CAUSE alone was the earlier version and\n".to_string()), "                // was an unbounded green path — sound about decidability, wrong about\n".to_string()), "                // admission, since it made every future anonymous-receiver call pass\n".to_string()), "                // including one whose method does not exist (codex review 45459).\n".to_string()), "                // What THIS control pins is the remaining half, the classification of\n".to_string()), "                // an admitted one: COUNTED and NON-BLOCKING. Blocking it fabricates a\n".to_string()), "                // refusal over the 18 measured sites; dropping it restores #7479 silence.\n".to_string()), "                let unestablished_diag = std::rc::Rc::new(\n".to_string()), "                    crate::v1_std_core::CompilerDiagnostic::ReceiverTypeUnestablished {\n".to_string()), "                        method: \"probe\".to_string(),\n".to_string()), "                        span: std::rc::Rc::new(crate::std_types::SourceSpan {\n".to_string()), "                            file: \"probe.dag\".to_string(), start: 0, end: 0,\n".to_string()), "                        }),\n".to_string()), "                    });\n".to_string()), "                assert!(\n".to_string()), "                    !crate::v1_std_core::is_error_diagnostic(unestablished_diag.clone())\n".to_string()), "                        && !crate::v1_std_core::is_interpreter_blocking_diagnostic(unestablished_diag.clone()),\n".to_string()), "                    \"ReceiverTypeUnestablished must not block — the receiver's type is an upstream deficit, so refusing here fabricates a refusal over correct code\"\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    crate::v1_std_core::is_discovery_corpus_advisory_typecheck_diagnostic(unestablished_diag.clone()),\n".to_string()), "                    \"...and it must be a COUNTED advisory, never absent — an uncounted degradation is the absorbing fallback DESIGN §5 forbids\"\n".to_string()), "                );\n".to_string()), "                // DISCRIMINATING CONTROL for the occurrence ratchet (codex reviews\n".to_string()), "                // 45464 and 45491). A (module, method, receiver_shape) key bounds\n".to_string()), "                // WHERE an unresolved call may live but not HOW MANY, and the rows\n".to_string()), "                // need not be singletons (the multi-occurrence rows this once named\n".to_string()), "                // were deleted at zero observed — see frontier_occurrence_budget_note —\n".to_string()), "                // so the control takes whichever row survives and counts against\n".to_string()), "                // its declared receiver shape rather than against Primitive()).\n".to_string()), "                // The comparison is EQUALITY, not a ceiling: a ceiling lets seven\n".to_string()), "                // shrink to six and a seventh come back silently, which is a static\n".to_string()), "                // limit rather than a ratchet. Equality is safe because the check runs\n".to_string()), "                // per MODULE, and every occurrence in a module is present whenever\n".to_string()), "                // that module is typechecked at all — a closure that omits the module\n".to_string()), "                // never runs its rows. Exercised at the mechanism so the boundary is\n".to_string()), "                // exact on both sides.\n".to_string()), "                let budget_row = rows.iter()\n".to_string()), "                    .next()\n".to_string()), "                    .expect(\"the frontier must hold at least one row to bound\");\n".to_string()), "                let probe_span = || std::rc::Rc::new(crate::std_types::SourceSpan {\n".to_string()), "                    file: \"probe.dag\".to_string(), start: 0, end: 0,\n".to_string()), "                });\n".to_string()), "                let unestablished_at = |n: usize| {\n".to_string()), "                    std::rc::Rc::new((0..n).map(|_| std::rc::Rc::new(crate::v1_std_core::ErrorNode {\n".to_string()), "                        diagnostic: std::rc::Rc::new(crate::v1_std_core::CompilerDiagnostic::MethodExistenceFrontierAdmitted {\n".to_string()), "                            method: budget_row.method.clone(),\n".to_string()), "                            receiver_type: budget_row.receiver_shape.clone(),\n".to_string()), "                            trigger: String::new(),\n".to_string()), "                            span: probe_span(),\n".to_string()), "                        }),\n".to_string()), "                        module_name: budget_row.module_name.clone(),\n".to_string()), "                    })).collect::<im::Vector<_>>())\n".to_string()), "                };\n".to_string()), "                let budget_at = |n: usize| crate::v1_compiler_infer::frontier_occurrence_budget_diags(\n".to_string()), "                    budget_row.module_name.clone(), probe_span(), unestablished_at(n));\n".to_string()), "                assert!(\n".to_string()), "                    budget_at(budget_row.occurrences as usize).is_empty(),\n".to_string()), "                    \"exactly the declared occurrence count must pass\"\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    budget_at(budget_row.occurrences as usize + 1).iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::FrontierOccurrenceBudgetExceeded { .. })),\n".to_string()), "                    \"one MORE than the declared count must refuse — otherwise the row bounds where an unresolved call may live but not how many\"\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    budget_at(budget_row.occurrences as usize + 1).iter().all(|d| crate::v1_std_core::is_error_diagnostic(d.diagnostic.clone())),\n".to_string()), "                    \"...and that refusal must BLOCK, or the ratchet is decorative\"\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    budget_at(0).iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::FrontierOccurrenceBudgetExceeded { .. })),\n".to_string()), "                    \"FEWER than declared must ALSO refuse, and this is the half that makes it a ratchet rather than a ceiling: fixing a call forces the declared count DOWN, so a later reintroduction has no headroom to slip back into (codex review 45491)\"\n".to_string()), "                );\n".to_string()), "                // DISCRIMINATING PAIR for the early-return walk. An early return is a\n".to_string()), "                // second exit from the same declaration and must meet its declared\n".to_string()), "                // type; a return inside a nested LAMBDA belongs to the lambda's own\n".to_string()), "                // callable return, so checking it against the enclosing declaration\n".to_string()), "                // fabricates a refusal — the mirror image of the hole the walk closes\n".to_string()), "                // (codex reviews 45472 and 45481, both confirmed by execution).\n".to_string()), "                let early_return = compile_one(\"early_return.dag\",\n".to_string()), "                    \"module early_return\\nfn f(cond: Bool) -> Int { if cond { return \\\"wrong\\\" } 1 }\\n\".to_string());\n".to_string()), "                assert!(\n".to_string()), "                    early_return.diagnostics.iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::TypeMismatch { .. })),\n".to_string()), "                    \"an early return of the wrong type must refuse — the trailing expression conforming says nothing about the other exit, got: {:?}\",\n".to_string()), "                    early_return.diagnostics\n".to_string()), "                );\n".to_string()), "                let lambda_return = compile_one(\"lambda_return.dag\",\n".to_string()), "                    \"module lambda_return\\nfn apply_it(g: fn(Int) -> String, v: Int) -> String { g(v) }\\nfn outer(v: Int) -> Int { apply_it(g: x => { return \\\"inner\\\" }, v: v) 1 }\\n\".to_string());\n".to_string()), "                assert!(\n".to_string()), "                    lambda_return.diagnostics.iter().all(|d| !matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::TypeMismatch { .. })),\n".to_string()), "                    \"a return inside a nested lambda belongs to the LAMBDA's declared return, not the enclosing function's — checking it here fabricates a refusal, got: {:?}\",\n".to_string()), "                    lambda_return.diagnostics\n".to_string()), "                );\n".to_string()), "                let peel_red = compile_one(\"peel_red.dag\", peel_src(\"filter_map(x => x)\"));\n".to_string()), "                assert!(\n".to_string()), "                    peel_red.diagnostics.iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodNotFound { .. })),\n".to_string()), "                    \"peeling must make the receiver DECIDABLE, not merely quiet: a method absent from the peeled base must refuse as MethodNotFound rather than resting in the frontier, got: {:?}\",\n".to_string()), "                    peel_red.diagnostics\n".to_string()), "                );\n".to_string()), "            })\n".to_string()), "            .expect(\"failed to spawn thread\")\n".to_string()), "            .join();\n".to_string()), "        result.expect(\"method_existence_wall_witness panicked\");\n".to_string()), "    }\n\n".to_string())
+    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    #[test]\n".to_string(), "    fn method_existence_wall_witness() {\n".to_string()), "        // DISCRIMINATING RED for method_existence_wall_note. Before the wall an\n".to_string()), "        // unresolved method inherited the RECEIVER's type with no diagnostic, so\n".to_string()), "        // `xs |> filter_map(..)` on List<Int> typed as List<Int>, compiled clean, and\n".to_string()), "        // died at InterpError::Unimplemented in live dispatch (#7479, HTTP 500).\n".to_string()), "        let result = std::thread::Builder::new()\n".to_string()), "            .stack_size(8 * 1024 * 1024)\n".to_string()), "            .spawn(|| {\n".to_string()), "                let red = std::rc::Rc::new(crate::v1_compiler_compile::SourceFile {\n".to_string()), "                    path: \"red.dag\".to_string(),\n".to_string()), "                    content: \"module red\\nfn f(xs: List<Int>) -> List<Int> { xs |> filter_map(x => x) }\\nfn g(xs: List<Int>) -> Bool { xs |> starts_with(\\\"x\\\") }\\nfn h(xs: List<Int>) -> String { xs |> to_upper() }\\n\".to_string(),\n".to_string()), "                });\n".to_string()), "                let red_result = crate::v1_compiler_compile::compile_sources(\n".to_string()), "                    std::rc::Rc::new(im::vector![red]),\n".to_string()), "                    crate::v1_compiler_artifact::RenderTarget::Rust,\n".to_string()), "                );\n".to_string()), "                let missing: Vec<_> = red_result.diagnostics.iter()\n".to_string()), "                    .filter(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodNotFound { .. }))\n".to_string()), "                    .collect();\n".to_string()), "                assert!(\n".to_string()), "                    missing.len() >= 3,\n".to_string()), "                    \"expected MethodNotFound for the unresolved method AND for rostered names on a receiver that does not offer them (starts_with / to_upper on List<Int> — codex review 45327: a name-grain predicate admitted these), got: {:?}\",\n".to_string()), "                    red_result.diagnostics\n".to_string()), "                );\n".to_string()), "                // POSITIVE CONTROLS the wall must not touch: algebra method templates\n".to_string()), "                // resolve at tier0, and `count` is in the declared std.methods roster\n".to_string()), "                // even though free_monoid_scalar_templates omits it (the measured fork).\n".to_string()), "                let green = std::rc::Rc::new(crate::v1_compiler_compile::SourceFile {\n".to_string()), "                    path: \"green.dag\".to_string(),\n".to_string()), "                    content: \"module green\\nfn p(xs: List<Int>) -> List<Int> { xs |> filter(x => x > 1) |> map(x => x + 1) }\\nfn q(xs: List<Int>) -> Int { xs |> fold(0, (a, x) => a + x) }\\nfn r(s: String) -> Int { s |> count }\\n\".to_string(),\n".to_string()), "                });\n".to_string()), "                let green_result = crate::v1_compiler_compile::compile_sources(\n".to_string()), "                    std::rc::Rc::new(im::vector![green]),\n".to_string()), "                    crate::v1_compiler_artifact::RenderTarget::Rust,\n".to_string()), "                );\n".to_string()), "                // The positive control asserts ZERO diagnostics, not merely no\n".to_string()), "                // MethodNotFound. Filtering to the blocking variant let an ADVISORY\n".to_string()), "                // MethodExistenceUndecided pass unnoticed, which is how `String |> count`\n".to_string()), "                // was reported as a passing control while it was actually resolving\n".to_string()), "                // through the non-blocking arm (codex review 45357).\n".to_string()), "                assert!(\n".to_string()), "                    green_result.diagnostics.is_empty(),\n".to_string()), "                    \"legitimate methods must resolve with NO diagnostic of any severity — an advisory here means the call is not actually resolving, got: {:?}\",\n".to_string()), "                    green_result.diagnostics\n".to_string()), "                );\n".to_string()), "                // DISCRIMINATING RED for the declared frontier (codex reviews 45357,\n".to_string()), "                // 45383). An undecided method existence must BLOCK, so the graph is\n".to_string()), "                // never emitted on an unestablished judgment; the only non-blocking\n".to_string()), "                // path is a DECLARED frontier row, which is countable and carries its\n".to_string()), "                // own dissolution trigger. The two halves must be discriminated by\n".to_string()), "                // MODULE NAME on otherwise identical source — an admission that fires\n".to_string()), "                // for any module is an escape hatch, not a frontier.\n".to_string()), "                let frontier_src = |module: &str, method: &str| {\n".to_string()), "                    format!(\"module {}\\ntype T {{ a: Int }}\\nfn f(t: T) -> Int {{ t |> {}(1) }}\\n\", module, method)\n".to_string()), "                };\n".to_string()), "                let compile_one = |path: &str, content: String| {\n".to_string()), "                    crate::v1_compiler_compile::compile_sources(\n".to_string()), "                        std::rc::Rc::new(im::vector![std::rc::Rc::new(\n".to_string()), "                            crate::v1_compiler_compile::SourceFile {\n".to_string()), "                                path: path.to_string(),\n".to_string()), "                                content,\n".to_string()), "                            }\n".to_string()), "                        )]),\n".to_string()), "                        crate::v1_compiler_artifact::RenderTarget::Rust,\n".to_string()), "                    )\n".to_string()), "                };\n".to_string()), "                let unlisted = compile_one(\"unlisted.dag\", frontier_src(\"unlisted.module\", \"list_push\"));\n".to_string()), "                let undecided: Vec<_> = unlisted.diagnostics.iter()\n".to_string()), "                    .filter(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodExistenceUndecided { .. }))\n".to_string()), "                    .collect();\n".to_string()), "                assert!(\n".to_string()), "                    !undecided.is_empty(),\n".to_string()), "                    \"a method whose existence is undecided in a module with NO declared frontier row must refuse, got: {:?}\",\n".to_string()), "                    unlisted.diagnostics\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    undecided.iter().all(|d| crate::v1_std_core::is_error_diagnostic(d.diagnostic.clone())\n".to_string()), "                        && crate::v1_std_core::is_interpreter_blocking_diagnostic(d.diagnostic.clone())),\n".to_string()), "                    \"MethodExistenceUndecided must BLOCK both typecheck and the interpreter — a non-blocking undecided judgment is exactly the fail-open the wall exists to close\"\n".to_string()), "                );\n".to_string()), "                // The SHAPE is part of the key, and this is the half that answers\n".to_string()), "                // codex review 45398: the module and the method both match a declared\n".to_string()), "                // row, and the call is STILL refused, because the receiver does not\n".to_string()), "                // fail to resolve in the way the row was measured on. A (module, method)\n".to_string()), "                // key passed this input; that is the fail-open the third component closes.\n".to_string()), "                let listed_wrong_shape = compile_one(\"listed.dag\", frontier_src(\"v1.compiler.trace\", \"map\"));\n".to_string()), "                assert!(\n".to_string()), "                    listed_wrong_shape.diagnostics.iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodExistenceUndecided { .. })),\n".to_string()), "                    \"a declared row must NOT admit a new call in the same module on a receiver whose shape it was never measured on, got: {:?}\",\n".to_string()), "                    listed_wrong_shape.diagnostics\n".to_string()), "                );\n".to_string()), "                // The admission half, checked against the frontier data itself rather\n".to_string()), "                // than a synthetic source, because the residual shapes (an unnamed\n".to_string()), "                // lambda-parameter receiver, a coproduct payload typed as its variant)\n".to_string()), "                // are upstream resolution defects that cannot be conjured on demand.\n".to_string()), "                // Every declared row must be admitted by its own exact key, and\n".to_string()), "                // perturbing ANY of the three components must withdraw the admission.\n".to_string()), "                let rows = crate::v1_compiler_infer::unresolved_method_frontier();\n".to_string()), "                assert!(!rows.is_empty(), \"the frontier must be a declared, countable roster\");\n".to_string()), "                for r in rows.iter() {\n".to_string()), "                    assert!(\n".to_string()), "                        crate::v1_compiler_infer::unresolved_method_frontier_trigger(\n".to_string()), "                            r.module_name.clone(), r.method.clone(), r.receiver_shape.clone()).is_some(),\n".to_string()), "                        \"row {}/{}/{} must be admitted by its own key\", r.module_name, r.method, r.receiver_shape\n".to_string()), "                    );\n".to_string()), "                    for perturbed in [\n".to_string()), "                        (format!(\"{}.other\", r.module_name), r.method.clone(), r.receiver_shape.clone()),\n".to_string()), "                        (r.module_name.clone(), format!(\"{}_other\", r.method), r.receiver_shape.clone()),\n".to_string()), "                        (r.module_name.clone(), r.method.clone(), format!(\"Product(Other{})\", r.receiver_shape.len())),\n".to_string()), "                    ] {\n".to_string()), "                        assert!(\n".to_string()), "                            crate::v1_compiler_infer::unresolved_method_frontier_trigger(\n".to_string()), "                                perturbed.0.clone(), perturbed.1.clone(), perturbed.2.clone()).is_none(),\n".to_string()), "                            \"perturbing the key to {:?} must WITHDRAW the admission — each component is load-bearing\", perturbed\n".to_string()), "                        );\n".to_string()), "                    }\n".to_string()), "                }\n".to_string()), "                // DISCRIMINATING RED for where_refinement_receiver_peel_note. A\n".to_string()), "                // where-refinement alias reached method lookup as Product(<alias>)\n".to_string()), "                // because resolve_method_receiver_type short-circuits on Conj, so the\n".to_string()), "                // base's algebra profile was never consulted. The peel must make the\n".to_string()), "                // receiver decidable in BOTH directions on the SAME alias — a green\n".to_string()), "                // that only proves the refusal stopped is indistinguishable from\n".to_string()), "                // deleting the wall.\n".to_string()), "                let peel_src = |call: &str| {\n".to_string()), "                    format!(\"module peel\\ntype Tight = String where string_non_empty\\nfn f(s: Tight) -> Int {{ s |> {} }}\\n\", call)\n".to_string()), "                };\n".to_string()), "                let peel_green = compile_one(\"peel_green.dag\", peel_src(\"count\"));\n".to_string()), "                assert!(\n".to_string()), "                    peel_green.diagnostics.is_empty(),\n".to_string()), "                    \"a method on the refinement's String base must RESOLVE once the base is peeled — no diagnostic of any severity, got: {:?}\",\n".to_string()), "                    peel_green.diagnostics\n".to_string()), "                );\n".to_string()), "                // DISCRIMINATING RED for the two special-case arms (codex review\n".to_string()), "                // 45430). The wall was reached only from the FINAL else, so an\n".to_string()), "                // unresolved map_keys / map_values still returned the RECEIVER type\n".to_string()), "                // with an empty diagnostic list — the exact success-shaped fallback\n".to_string()), "                // this PR deletes, surviving in the two branches that ran before it.\n".to_string()), "                let special = compile_one(\"special.dag\",\n".to_string()), "                    \"module special\\nfn f(xs: List<Int>) -> List<Int> {{ xs |> map_keys }}\\nfn g(xs: List<Int>) -> List<Int> {{ xs |> map_values }}\\n\".replace(\"{{\", \"{\").replace(\"}}\", \"}\"));\n".to_string()), "                let special_missing: Vec<_> = special.diagnostics.iter()\n".to_string()), "                    .filter(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodNotFound { .. }))\n".to_string()), "                    .collect();\n".to_string()), "                assert!(\n".to_string()), "                    special_missing.len() >= 2,\n".to_string()), "                    \"map_keys and map_values must route through the SAME refusal as every other method when the receiver is not a keyed collection — a wall reachable only from the final else is not a wall, got: {:?}\",\n".to_string()), "                    special.diagnostics\n".to_string()), "                );\n".to_string()), "                // ReceiverTypeUnestablished CLASSIFICATION control. The behavioural\n".to_string()), "                // evidence for this class is the corpus census, not a synthetic\n".to_string()), "                // source: 18 sites whole-tree, counted as advisories with the gate at\n".to_string()), "                // zero blocking diagnostics. A synthetic reproducer WAS attempted --\n".to_string()), "                // an untyped lambda parameter inside a record-field fn, the shape the\n".to_string()), "                // real sites have -- and it produced no diagnostic at all, so it did\n".to_string()), "                // not reproduce the shape and is not asserted here as though it did.\n".to_string()), "                // ADMISSION is roster-gated, not automatic: an anonymous receiver is\n".to_string()), "                // admitted only where a declared row names (module, method,\n".to_string()), "                // Primitive()), and the perturbation loop above proves that gate for\n".to_string()), "                // every row. Admitting on the CAUSE alone was the earlier version and\n".to_string()), "                // was an unbounded green path — sound about decidability, wrong about\n".to_string()), "                // admission, since it made every future anonymous-receiver call pass\n".to_string()), "                // including one whose method does not exist (codex review 45459).\n".to_string()), "                // What THIS control pins is the remaining half, the classification of\n".to_string()), "                // an admitted one: COUNTED and NON-BLOCKING. Blocking it fabricates a\n".to_string()), "                // refusal over the 18 measured sites; dropping it restores #7479 silence.\n".to_string()), "                let unestablished_diag = std::rc::Rc::new(\n".to_string()), "                    crate::v1_std_core::CompilerDiagnostic::ReceiverTypeUnestablished {\n".to_string()), "                        method: \"probe\".to_string(),\n".to_string()), "                        span: std::rc::Rc::new(crate::std_types::SourceSpan {\n".to_string()), "                            file: \"probe.dag\".to_string(), start: 0, end: 0,\n".to_string()), "                        }),\n".to_string()), "                    });\n".to_string()), "                assert!(\n".to_string()), "                    !crate::v1_std_core::is_error_diagnostic(unestablished_diag.clone())\n".to_string()), "                        && !crate::v1_std_core::is_interpreter_blocking_diagnostic(unestablished_diag.clone()),\n".to_string()), "                    \"ReceiverTypeUnestablished must not block — the receiver's type is an upstream deficit, so refusing here fabricates a refusal over correct code\"\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    crate::v1_std_core::is_discovery_corpus_advisory_typecheck_diagnostic(unestablished_diag.clone()),\n".to_string()), "                    \"...and it must be a COUNTED advisory, never absent — an uncounted degradation is the absorbing fallback DESIGN §5 forbids\"\n".to_string()), "                );\n".to_string()), "                // DISCRIMINATING CONTROL for the occurrence ratchet (codex reviews\n".to_string()), "                // 45464 and 45491). A (module, method, receiver_shape) key bounds\n".to_string()), "                // WHERE an unresolved call may live but not HOW MANY, and the rows\n".to_string()), "                // need not be singletons (the multi-occurrence rows this once named\n".to_string()), "                // were deleted at zero observed — see frontier_occurrence_budget_note —\n".to_string()), "                // so the control takes whichever row survives and counts against\n".to_string()), "                // its declared receiver shape rather than against Primitive()).\n".to_string()), "                // The comparison is EQUALITY, not a ceiling: a ceiling lets seven\n".to_string()), "                // shrink to six and a seventh come back silently, which is a static\n".to_string()), "                // limit rather than a ratchet. Equality is safe because the check runs\n".to_string()), "                // per MODULE, and every occurrence in a module is present whenever\n".to_string()), "                // that module is typechecked at all — a closure that omits the module\n".to_string()), "                // never runs its rows. Exercised at the mechanism so the boundary is\n".to_string()), "                // exact on both sides.\n".to_string()), "                let budget_row = rows.iter()\n".to_string()), "                    .next()\n".to_string()), "                    .expect(\"the frontier must hold at least one row to bound\");\n".to_string()), "                let probe_span = || std::rc::Rc::new(crate::std_types::SourceSpan {\n".to_string()), "                    file: \"probe.dag\".to_string(), start: 0, end: 0,\n".to_string()), "                });\n".to_string()), "                let unestablished_at = |n: usize| {\n".to_string()), "                    std::rc::Rc::new((0..n).map(|_| std::rc::Rc::new(crate::v1_std_core::ErrorNode {\n".to_string()), "                        diagnostic: std::rc::Rc::new(crate::v1_std_core::CompilerDiagnostic::MethodExistenceFrontierAdmitted {\n".to_string()), "                            method: budget_row.method.clone(),\n".to_string()), "                            receiver_type: budget_row.receiver_shape.clone(),\n".to_string()), "                            trigger: String::new(),\n".to_string()), "                            span: probe_span(),\n".to_string()), "                        }),\n".to_string()), "                        module_name: budget_row.module_name.clone(),\n".to_string()), "                    })).collect::<im::Vector<_>>())\n".to_string()), "                };\n".to_string()), "                let budget_at = |n: usize| crate::v1_compiler_infer::frontier_occurrence_budget_diags(\n".to_string()), "                    budget_row.module_name.clone(), probe_span(), unestablished_at(n));\n".to_string()), "                assert!(\n".to_string()), "                    budget_at(budget_row.occurrences as usize).is_empty(),\n".to_string()), "                    \"exactly the declared occurrence count must pass\"\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    budget_at(budget_row.occurrences as usize + 1).iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::FrontierOccurrenceBudgetExceeded { .. })),\n".to_string()), "                    \"one MORE than the declared count must refuse — otherwise the row bounds where an unresolved call may live but not how many\"\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    budget_at(budget_row.occurrences as usize + 1).iter().all(|d| crate::v1_std_core::is_error_diagnostic(d.diagnostic.clone())),\n".to_string()), "                    \"...and that refusal must BLOCK, or the ratchet is decorative\"\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    budget_at(0).iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::FrontierOccurrenceBudgetExceeded { .. })),\n".to_string()), "                    \"FEWER than declared must ALSO refuse, and this is the half that makes it a ratchet rather than a ceiling: fixing a call forces the declared count DOWN, so a later reintroduction has no headroom to slip back into (codex review 45491)\"\n".to_string()), "                );\n".to_string()), "                // DISCRIMINATING PAIR for the early-return walk. An early return is a\n".to_string()), "                // second exit from the same declaration and must meet its declared\n".to_string()), "                // type; a return inside a nested LAMBDA belongs to the lambda's own\n".to_string()), "                // callable return, so checking it against the enclosing declaration\n".to_string()), "                // fabricates a refusal — the mirror image of the hole the walk closes\n".to_string()), "                // (codex reviews 45472 and 45481, both confirmed by execution).\n".to_string()), "                let early_return = compile_one(\"early_return.dag\",\n".to_string()), "                    \"module early_return\\nfn f(cond: Bool) -> Int { if cond { return \\\"wrong\\\" } 1 }\\n\".to_string());\n".to_string()), "                assert!(\n".to_string()), "                    early_return.diagnostics.iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::TypeMismatch { .. })),\n".to_string()), "                    \"an early return of the wrong type must refuse — the trailing expression conforming says nothing about the other exit, got: {:?}\",\n".to_string()), "                    early_return.diagnostics\n".to_string()), "                );\n".to_string()), "                let lambda_return = compile_one(\"lambda_return.dag\",\n".to_string()), "                    \"module lambda_return\\nfn apply_it(g: fn(Int) -> String, v: Int) -> String { g(v) }\\nfn outer(v: Int) -> Int { apply_it(g: x => { return \\\"inner\\\" }, v: v) 1 }\\n\".to_string());\n".to_string()), "                assert!(\n".to_string()), "                    lambda_return.diagnostics.iter().all(|d| !matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::TypeMismatch { .. })),\n".to_string()), "                    \"a return inside a nested lambda belongs to the LAMBDA's declared return, not the enclosing function's — checking it here fabricates a refusal, got: {:?}\",\n".to_string()), "                    lambda_return.diagnostics\n".to_string()), "                );\n".to_string()), "                let peel_red = compile_one(\"peel_red.dag\", peel_src(\"filter_map(x => x)\"));\n".to_string()), "                assert!(\n".to_string()), "                    peel_red.diagnostics.iter().any(|d| matches!(*d.diagnostic, crate::v1_std_core::CompilerDiagnostic::MethodNotFound { .. })),\n".to_string()), "                    \"peeling must make the receiver DECIDABLE, not merely quiet: a method absent from the peeled base must refuse as MethodNotFound rather than resting in the frontier, got: {:?}\",\n".to_string()), "                    peel_red.diagnostics\n".to_string()), "                );\n".to_string()), "            })\n".to_string()), "            .expect(\"failed to spawn thread\")\n".to_string()), "            .join();\n".to_string()), "        result.expect(\"method_existence_wall_witness panicked\");\n".to_string()), "    }\n\n".to_string())
 }
 
 pub fn ct_declared_type_conformance_witness_test() -> String {
@@ -418,7 +430,7 @@ pub fn ct_function_value_adapter_bound_alignment_control_test() -> String {
 }
 
 pub fn ct_entry_point_absent_refusal_test() -> String {
-    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    #[test]\n".to_string(), "    fn a_corpus_with_no_entry_point_emits_a_refusing_main_and_declares_no_clap() {\n".to_string()), "        let result = std::thread::Builder::new()\n".to_string()), "            .stack_size(16 * 1024 * 1024)\n".to_string()), "            .spawn(|| {\n".to_string()), "                let source = std::rc::Rc::new(crate::v1_compiler_compile::SourceFile {\n".to_string()), "                    path: \"entry_point_absent.dag\".to_string(),\n".to_string()), "                    content: \"module entry.point.absent\\nfn add(a: Int, b: Int) -> Int { a + b }\\n\".to_string(),\n".to_string()), "                });\n".to_string()), "                let result = crate::v1_compiler_compile::compile_sources(std::rc::Rc::new(im::vector![source]), crate::v1_compiler_artifact::RenderTarget::Rust);\n".to_string()), "                let main_rs = result.files.iter()\n".to_string()), "                    .find(|f| f.path == \"src/main.rs\")\n".to_string()), "                    .expect(\"emission must produce src/main.rs\");\n".to_string()), "                let marker = crate::v1_compiler_emit_rust::entry_point_absent_refusal_marker();\n".to_string()), "                assert!(\n".to_string()), "                    main_rs.content.contains(&marker),\n".to_string()), "                    \"a corpus with no workflow function and no pipeline module must emit a main that REFUSES, carrying {:?}; got: {:?}\",\n".to_string()), "                    marker, main_rs.content\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    !main_rs.content.contains(\"fn main() {}\"),\n".to_string()), "                    \"the fabricating empty-body entry point must not be emitted -- it builds, runs, exits zero and does nothing; got: {:?}\",\n".to_string()), "                    main_rs.content\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    main_rs.content.contains(\"std::process::exit(2)\"),\n".to_string()), "                    \"the refusal must leave a nonzero exit status; got: {:?}\",\n".to_string()), "                    main_rs.content\n".to_string()), "                );\n".to_string()), "                let cargo_toml = result.files.iter()\n".to_string()), "                    .find(|f| f.path == \"Cargo.toml\")\n".to_string()), "                    .expect(\"emission must produce Cargo.toml\");\n".to_string()), "                assert!(\n".to_string()), "                    !cargo_toml.content.contains(\"clap\"),\n".to_string()), "                    \"a crate whose emitted sources reference clap nowhere must not declare it; got: {:?}\",\n".to_string()), "                    cargo_toml.content\n".to_string()), "                );\n".to_string()), "            })\n".to_string()), "            .expect(\"failed to spawn thread\")\n".to_string()), "            .join();\n".to_string()), "        result.expect(\"a_corpus_with_no_entry_point_emits_a_refusing_main_and_declares_no_clap panicked\");\n".to_string()), "    }\n\n".to_string()), "    #[test]\n".to_string()), "    fn the_clap_dependency_follows_the_emitted_cli_demand_in_both_directions() {\n".to_string()), "        let with_cli = crate::v1_compiler_emit_rust::emitted_crate_dependency_lines(\n".to_string()), "            crate::v1_compiler_emit_rust::EmittedCrateDependencyDemand {\n".to_string()), "                renders_clap_cli: true,\n".to_string()), "                renders_async_services: false,\n".to_string()), "            },\n".to_string()), "        );\n".to_string()), "        let without_cli = crate::v1_compiler_emit_rust::emitted_crate_dependency_lines(\n".to_string()), "            crate::v1_compiler_emit_rust::EmittedCrateDependencyDemand {\n".to_string()), "                renders_clap_cli: false,\n".to_string()), "                renders_async_services: false,\n".to_string()), "            },\n".to_string()), "        );\n".to_string()), "        assert!(\n".to_string()), "            with_cli.iter().any(|line| line.starts_with(\"clap = \")),\n".to_string()), "            \"a crate that renders a clap CLI must declare clap; got: {:?}\",\n".to_string()), "            with_cli\n".to_string()), "        );\n".to_string()), "        assert!(\n".to_string()), "            !without_cli.iter().any(|line| line.starts_with(\"clap = \")),\n".to_string()), "            \"a crate that renders no clap CLI must not declare clap; got: {:?}\",\n".to_string()), "            without_cli\n".to_string()), "        );\n".to_string()), "    }\n\n".to_string())
+    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    #[test]\n".to_string(), "    fn a_corpus_with_no_entry_point_emits_a_refusing_main_and_declares_no_clap() {\n".to_string()), "        let result = std::thread::Builder::new()\n".to_string()), "            .stack_size(16 * 1024 * 1024)\n".to_string()), "            .spawn(|| {\n".to_string()), "                let source = std::rc::Rc::new(crate::v1_compiler_compile::SourceFile {\n".to_string()), "                    path: \"entry_point_absent.dag\".to_string(),\n".to_string()), "                    content: \"module entry.point.absent\\nfn add(a: Int, b: Int) -> Int { a + b }\\n\".to_string(),\n".to_string()), "                });\n".to_string()), "                let result = crate::v1_compiler_compile::compile_sources(std::rc::Rc::new(im::vector![source]), crate::v1_compiler_artifact::RenderTarget::Rust);\n".to_string()), "                let main_rs = result.files.iter()\n".to_string()), "                    .find(|f| f.path == \"src/main.rs\")\n".to_string()), "                    .expect(\"emission must produce src/main.rs\");\n".to_string()), "                let marker = crate::v1_compiler_emit_rust::entry_point_absent_refusal_marker();\n".to_string()), "                assert!(\n".to_string()), "                    main_rs.content.contains(&marker),\n".to_string()), "                    \"a corpus with no workflow function and no pipeline module must emit a main that REFUSES, carrying {:?}; got: {:?}\",\n".to_string()), "                    marker, main_rs.content\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    !main_rs.content.contains(\"fn main() {}\"),\n".to_string()), "                    \"the fabricating empty-body entry point must not be emitted -- it builds, runs, exits zero and does nothing; got: {:?}\",\n".to_string()), "                    main_rs.content\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    main_rs.content.contains(\"std::process::exit(2)\"),\n".to_string()), "                    \"the refusal must leave a nonzero exit status; got: {:?}\",\n".to_string()), "                    main_rs.content\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    !result.files.iter().any(|f| f.path == \"Cargo.toml\"),\n".to_string()), "                    \"the emission owns no manifest -- the crate partition realizes its layout\"\n".to_string()), "                );\n".to_string()), "                assert!(\n".to_string()), "                    result.rust_crates.iter().all(|c| !c.demand.renders_clap_cli),\n".to_string()), "                    \"a crate whose emitted sources reference clap nowhere must not demand it; got: {:?}\",\n".to_string()), "                    result.rust_crates\n".to_string()), "                );\n".to_string()), "            })\n".to_string()), "            .expect(\"failed to spawn thread\")\n".to_string()), "            .join();\n".to_string()), "        result.expect(\"a_corpus_with_no_entry_point_emits_a_refusing_main_and_declares_no_clap panicked\");\n".to_string()), "    }\n\n".to_string()), "    #[test]\n".to_string()), "    fn the_clap_dependency_follows_the_emitted_cli_demand_in_both_directions() {\n".to_string()), "        let with_cli = crate::v1_compiler_stage0_crates::emitted_crate_dependencies(\n".to_string()), "            crate::gunbc_rust_emitted_crate::EmittedCrateDependencyDemand {\n".to_string()), "                renders_clap_cli: true,\n".to_string()), "                renders_async_services: false,\n".to_string()), "            },\n".to_string()), "        );\n".to_string()), "        let without_cli = crate::v1_compiler_stage0_crates::emitted_crate_dependencies(\n".to_string()), "            crate::gunbc_rust_emitted_crate::EmittedCrateDependencyDemand {\n".to_string()), "                renders_clap_cli: false,\n".to_string()), "                renders_async_services: false,\n".to_string()), "            },\n".to_string()), "        );\n".to_string()), "        assert!(\n".to_string()), "            with_cli.iter().any(|dep| dep.name == \"clap\"),\n".to_string()), "            \"a crate that renders a clap CLI must declare clap; got: {:?}\",\n".to_string()), "            with_cli\n".to_string()), "        );\n".to_string()), "        assert!(\n".to_string()), "            !without_cli.iter().any(|dep| dep.name == \"clap\"),\n".to_string()), "            \"a crate that renders no clap CLI must not declare clap; got: {:?}\",\n".to_string()), "            without_cli\n".to_string()), "        );\n".to_string()), "    }\n\n".to_string())
 }
 
 pub fn ct_test_marker_item_kind_test() -> String {
diff --git a/src/v1/stage0/src/v1_compiler_complexity.rs b/src/v1/stage0/src/v1_compiler_complexity.rs
index fcbdbcfd653..7d32976ba45 100644
--- a/src/v1/stage0/src/v1_compiler_complexity.rs
+++ b/src/v1/stage0/src/v1_compiler_complexity.rs
@@ -358,12 +358,7 @@ pub fn iteration_element_name(
     {
         let params = crate::v1_std_core::lambda_param_names_at(lambda.clone(), si.clone());
         match method_callback_element_position(method_semantics.clone()) {
-            Some(pos) => params
-                .clone()
-                .iter()
-                .cloned()
-                .skip(pos.clone() as usize)
-                .next(),
+            Some(pos) => params.clone().get((pos.clone()) as usize).cloned(),
             std::option::Option::None => std::option::Option::None,
         }
     }
@@ -710,14 +705,10 @@ pub fn parser_block_state_progress(
     match stmts.clone().last().cloned() {
         std::option::Option::None => DescentEvidence::DescentUnknown,
         Some(last_stmt) => {
-            let leading = Rc::new(
-                stmts
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .take(v1_rt::int_sub((stmts.clone().len() as i64), 1) as usize)
-                    .collect::<Vec<_>>(),
-            );
+            let leading = Rc::new(v1_rt::list_take(
+                &stmts.clone(),
+                v1_rt::int_sub((stmts.clone().len() as i64), 1),
+            ));
             let final_env = leading.iter().cloned().fold(
                 env.clone(),
                 |acc_env: Rc<ParserProgressEnv>, stmt: Rc<Node>| match (*stmt.expr_data.clone())
@@ -1364,13 +1355,10 @@ pub fn parser_success_progress(
                 }
             }
             ExprData::ExprBlock => {
-                let prefix = v1_rt::reverse(Rc::new(
-                    v1_rt::reverse(expr.children.clone())
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                ));
+                let prefix = v1_rt::reverse(Rc::new(v1_rt::list_skip(
+                    &v1_rt::reverse(expr.children.clone()),
+                    1,
+                )));
                 let acc = prefix.iter().cloned().fold(
                     Rc::new(ParserProgressAcc {
                         edges: Rc::new(vec![]),
@@ -1486,14 +1474,7 @@ pub fn infer_parser_always_advancing_members_worklist(
         let mut si = __tco_loop_si;
         match queue.clone().first().cloned() {
             Some(name) => {
-                let rest = Rc::new(
-                    queue
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                );
+                let rest = Rc::new(v1_rt::list_skip(&queue.clone(), 1));
                 if set_has(proven.clone(), name.clone()) {
                     {
                         let __tco_0 = rest.clone();
@@ -10220,10 +10201,8 @@ pub fn merge_param_evidence(
         DescentEvidence::Strict,
         |acc: DescentEvidence, call_evidence: Rc<Vec<Rc<SubValueRelation>>>| match call_evidence
             .clone()
-            .iter()
+            .get((param_index.clone()) as usize)
             .cloned()
-            .skip(param_index.clone() as usize)
-            .next()
         {
             Some(rel) => crate::std_termination::descent_evidence_lattice_meet(
                 acc.clone(),
@@ -10246,10 +10225,8 @@ pub fn extract_shrink_factor(
             std::option::Option::None => std::option::Option::None,
             Some(prev) => match call_evidence
                 .clone()
-                .iter()
+                .get((param_index.clone()) as usize)
                 .cloned()
-                .skip(param_index.clone() as usize)
-                .next()
             {
                 Some(rel) => match (*rel.clone()).clone() {
                     SubValueRelation::StrictSubValue { factor: f, .. } => {
@@ -10301,10 +10278,8 @@ pub fn max_path_descending(
                     match de.clone() {
                         Some(evidence) => match evidence
                             .clone()
-                            .iter()
+                            .get((param_index.clone()) as usize)
                             .cloned()
-                            .skip(param_index.clone() as usize)
-                            .next()
                         {
                             Some(rel) => match (*rel.clone()).clone() {
                                 SubValueRelation::StrictSubValue { .. } => 1,
@@ -10420,10 +10395,8 @@ pub fn distinct_descended_fields(
             |acc: Rc<HashMap<String, bool>>, call_evidence: Rc<Vec<Rc<SubValueRelation>>>| {
                 match call_evidence
                     .clone()
-                    .iter()
+                    .get((param_index.clone()) as usize)
                     .cloned()
-                    .skip(param_index.clone() as usize)
-                    .next()
                 {
                     Some(rel) => match (*rel.clone()).clone() {
                         SubValueRelation::StrictSubValue { field: f, .. } => {
diff --git a/src/v1/stage0/src/v1_compiler_emit.rs b/src/v1/stage0/src/v1_compiler_emit.rs
index 7700517388f..c0bf7f72bff 100644
--- a/src/v1/stage0/src/v1_compiler_emit.rs
+++ b/src/v1/stage0/src/v1_compiler_emit.rs
@@ -9,6 +9,11 @@ use self::FileResultChannel::*;
 use self::FileVerb::*;
 use self::FuncBodyShape::*;
 use self::JsonFragmentsAccum::*;
+use self::NativeEffectContract::*;
+use self::NativeEffectHandler::*;
+use self::NativeEffectRealizationAdmission::*;
+use self::NativeEffectResolution::*;
+use self::NativeEffectUnavailableCause::*;
 use self::ShellEmissionRefusal::*;
 use self::ShellResultChannel::*;
 use self::TargetEmissionMode::*;
@@ -21,6 +26,17 @@ pub use crate::std_coercion::TypeDeclarationProvenance;
 use crate::std_coercion::TypeDeclarationProvenance::DeclarationIdentityAbsent;
 pub use crate::std_coercion::TypeRealizationDecision;
 use crate::std_coercion::TypeRealizationDecision::*;
+use crate::std_compiler_entry::CompilerEntryDriver::{
+    DirectIngestDriver, NativeClaimDriver, NativeCliDriver, NativeServeDriver,
+    RetainedHostCliKernel, SourceRootEvalDriver,
+};
+use crate::std_compiler_entry::NativeEffectClass::{NativeEffectDeclaration, NativeOutgoingHttp};
+use crate::std_compiler_entry::NativeEffectScope::{NativeAdmitAllExcept, NativeAdmitOnly};
+pub use crate::std_compiler_entry::{
+    CompilerEntryDriver, NativeEffectClass, NativeEffectDenominator, NativeEffectScope,
+};
+pub use crate::std_decl_ref::DeclarationRef;
+pub use crate::std_decl_ref::{decl_ref, declaration_ref_eq};
 use crate::std_induction::SubValueRelation::SubValueUnknown;
 pub use crate::std_induction::{InductiveField, SubValueRelation};
 pub use crate::std_occurrence_identity::occurrence_id_eq;
@@ -55,6 +71,7 @@ pub use crate::v1_compiler_emit_core_support::{EmitResult, TestProjection};
 pub use crate::v1_compiler_infer::InferScope;
 pub use crate::v1_compiler_infer::{
     build_params_scope, call_param_caller_labels, extend_scope, is_where_refinement_type,
+    resolved_type_name,
 };
 use crate::v1_compiler_infer_emit_info::DataVariantWireSpelling::{
     DataVariantBareString, DataVariantInternalTagged, DataVariantSpellingRefused,
@@ -62,9 +79,14 @@ use crate::v1_compiler_infer_emit_info::DataVariantWireSpelling::{
 };
 pub use crate::v1_compiler_infer_emit_info::{DataVariantWireSpelling, EmitGraphInfo, TypeSummary};
 use crate::v1_compiler_infer_env::GlobalBareLookupState::*;
+use crate::v1_compiler_infer_env::TypeReferenceDeclarationReading::TypeReferenceNamesDeclaration;
 pub use crate::v1_compiler_infer_env::UnitVariantContribution;
-pub use crate::v1_compiler_infer_env::{authored_name, empty_symbol_index, lookup_type_for};
-pub use crate::v1_compiler_infer_env::{GlobalBareLookupState, TypeBinding, TypeEnv};
+pub use crate::v1_compiler_infer_env::{
+    authored_name, empty_symbol_index, lookup_type_for, type_reference_declaration_reading,
+};
+pub use crate::v1_compiler_infer_env::{
+    GlobalBareLookupState, TypeBinding, TypeEnv, TypeReferenceDeclarationReading,
+};
 pub use crate::v1_compiler_infer_items::{item_is_effectful_callee, item_resource_names};
 pub use crate::v1_compiler_infer_items::{ItemInfo, ResolvedGraph, TypedModule};
 pub use crate::v1_compiler_infer_lookup::lookup_func_sig;
@@ -110,7 +132,7 @@ use crate::v1_std_core::CallSemantics::ResolvedDirectCallSemantics;
 use crate::v1_std_core::CallTargetIdentity::{
     CallableTargetUndetermined, LocallyBoundCall, RuntimePrimitiveCall, SourceDeclarationCall,
 };
-use crate::v1_std_core::Cardinality::CardOptional;
+use crate::v1_std_core::Cardinality::{CardOptional, Required};
 use crate::v1_std_core::CompilerDiagnostic::TransportEmissionNotModeled;
 use crate::v1_std_core::Connective::{Arrow, Conj, Disj, NoConnective};
 use crate::v1_std_core::ExprData::{
@@ -840,16 +862,12 @@ pub fn order_typed_call_args_from_semantics(
             for app in plan.iter().cloned() {
                 __result.extend(
                     (*match app.matched_argument_index.clone() {
-                        Some(argument_index) => match args
-                            .clone()
-                            .iter()
-                            .cloned()
-                            .skip(argument_index.clone() as usize)
-                            .next()
-                        {
-                            Some(arg) => Rc::new(vec![arg.clone()]),
-                            std::option::Option::None => Rc::new(vec![]),
-                        },
+                        Some(argument_index) => {
+                            match args.clone().get((argument_index.clone()) as usize).cloned() {
+                                Some(arg) => Rc::new(vec![arg.clone()]),
+                                std::option::Option::None => Rc::new(vec![]),
+                            }
+                        }
                         std::option::Option::None => Rc::new(vec![]),
                     })
                     .iter()
@@ -895,7 +913,7 @@ pub fn has_nested_records_node(
                     source_indices.clone(),
                 );
                 if is_map.clone() {
-                    match n.children.clone().iter().cloned().skip(1 as usize).next() {
+                    match n.children.clone().get((1) as usize).cloned() {
                         Some(val_child) => {
                             let __tco_0 =
                                 crate::v1_compiler_infer_types::child_type_node(val_child.clone());
@@ -1026,6 +1044,64 @@ pub fn emit_data_fields_json(
     )
 }
 
+pub fn emit_declared_optional_row_json(
+    value: Rc<Node>,
+    inner_type_name: String,
+    source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+    variant_wire: Rc<HashMap<String, Rc<DataVariantWireSpelling>>>,
+) -> Rc<EmitterOutcome> {
+    match (*value.expr_data.clone()).clone() {
+        ExprData::ExprLiteral { ref value, .. }
+            if matches!(value.as_ref(), LiteralValue::LitNull) =>
+        {
+            let LiteralValue::LitNull = value.as_ref() else {
+                unreachable!()
+            };
+            Rc::new(EmitterOutcome::Emitted {
+                json: "null".to_string(),
+            })
+        }
+        ExprData::ExprRecordLit {
+            parent_enum: pe, ..
+        } => match pe.clone() {
+            Some(parent) => {
+                if (crate::v1_std_core::qualified_last_segment(parent.clone())
+                    == crate::v1_std_core::qualified_last_segment(inner_type_name.clone()))
+                {
+                    Rc::new(EmitterOutcome::Refused {
+    reason: v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("a data row declared ".to_string(), inner_type_name.clone()), "? is initialized with a bare ".to_string()), inner_type_name.clone()), " literal: no declared coercion lifts T into T? (DESIGN 4, 2026-09-26), so spell it Present { value: .. } or none".to_string()),
+})
+                } else {
+                    match value.children.clone().first().cloned() {
+                        std::option::Option::None => Rc::new(EmitterOutcome::Emitted {
+                            json: "null".to_string(),
+                        }),
+                        Some(payload_field) => {
+                            if ((value.children.clone().len() as i64) == 1) {
+                                emit_data_value_json(
+                                    crate::v1_std_core::field_init_node_value(
+                                        payload_field.clone(),
+                                    ),
+                                    source_indices.clone(),
+                                    variant_wire.clone(),
+                                )
+                            } else {
+                                Rc::new(EmitterOutcome::Refused {
+    reason: v1_rt::concat(v1_rt::concat("an optional row's present literal carries ".to_string(), crate::v1_compiler_emit_core_support::to_string((value.children.clone().len() as i64))), " fields; the option's present arm carries exactly its payload".to_string()),
+})
+                            }
+                        }
+                    }
+                }
+            }
+            std::option::Option::None => {
+                emit_data_value_json(value.clone(), source_indices.clone(), variant_wire.clone())
+            }
+        },
+        _ => emit_data_value_json(value.clone(), source_indices.clone(), variant_wire.clone()),
+    }
+}
+
 pub fn emit_data_value_json(
     value: Rc<Node>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
@@ -1964,29 +2040,26 @@ pub fn render_node_type(
                             }
                             std::option::Option::None => "_".to_string(),
                         };
-                        let second_child =
-                            match n.children.clone().iter().cloned().skip(1 as usize).next() {
-                                Some(c) => {
-                                    if (c.inferred.clone() != std::option::Option::None) {
-                                        render_node_type(
-                                            crate::v1_compiler_infer_types::resolved_type(
-                                                c.clone(),
-                                            ),
-                                            target.clone(),
-                                            shared_types.clone(),
-                                            source_indices.clone(),
-                                        )
-                                    } else {
-                                        render_node_type(
-                                            c.clone(),
-                                            target.clone(),
-                                            shared_types.clone(),
-                                            source_indices.clone(),
-                                        )
-                                    }
+                        let second_child = match n.children.clone().get((1) as usize).cloned() {
+                            Some(c) => {
+                                if (c.inferred.clone() != std::option::Option::None) {
+                                    render_node_type(
+                                        crate::v1_compiler_infer_types::resolved_type(c.clone()),
+                                        target.clone(),
+                                        shared_types.clone(),
+                                        source_indices.clone(),
+                                    )
+                                } else {
+                                    render_node_type(
+                                        c.clone(),
+                                        target.clone(),
+                                        shared_types.clone(),
+                                        source_indices.clone(),
+                                    )
                                 }
-                                std::option::Option::None => "_".to_string(),
-                            };
+                            }
+                            std::option::Option::None => "_".to_string(),
+                        };
                         let tuple_str = render_tuple_parts(
                             Rc::new(vec![first_child.clone(), second_child.clone()]),
                             target.clone(),
@@ -2144,7 +2217,7 @@ pub fn render_node_type(
                     ),
                     std::option::Option::None => "_".to_string(),
                 };
-                let v = match n.children.clone().iter().cloned().skip(1 as usize).next() {
+                let v = match n.children.clone().get((1) as usize).cloned() {
                     Some(vn) => render_node_type(
                         crate::v1_compiler_infer_types::child_type_node(vn.clone()),
                         target.clone(),
@@ -2271,7 +2344,7 @@ pub fn render_tuple_parts(parts: Rc<Vec<String>>, target: RenderTarget) -> Strin
         if ((parts.clone().len() as i64) > 0) {
             if ((parts.clone().len() as i64) == 2) {
                 match parts.clone().first().cloned() {
-                    Some(p0) => match parts.clone().iter().cloned().skip(1 as usize).next() {
+                    Some(p0) => match parts.clone().get((1) as usize).cloned() {
                         Some(p1) => crate::v1_compiler_emit_core_support::apply_type_template2(
                             ts.pair_template.clone(),
                             p0.clone(),
@@ -2827,6 +2900,7 @@ pub struct ShellResultField {
 pub enum ShellEmissionRefusal {
     ShellOutputKeyNotModeled { key: String },
     ShellChannelNotRealizedByTarget { key: String, target_name: String },
+    ShellCapturePolicyInputAbsent { key: String },
 }
 impl ShellEmissionRefusal {
     pub fn key(&self) -> String {
@@ -2835,6 +2909,7 @@ impl ShellEmissionRefusal {
             ShellEmissionRefusal::ShellChannelNotRealizedByTarget { key: __val, .. } => {
                 __val.clone()
             }
+            ShellEmissionRefusal::ShellCapturePolicyInputAbsent { key: __val, .. } => __val.clone(),
         }
     }
 }
@@ -2891,12 +2966,27 @@ pub fn shell_result_channel_key(c: ShellResultChannel) -> String {
     }
 }
 
-pub fn shell_channel_realized_by_target(c: ShellResultChannel, target: RenderTarget) -> bool {
+pub fn shell_channel_is_capture_accounting(c: ShellResultChannel) -> bool {
     match c.clone() {
-        ShellResultChannel::ShellChanStderrTruncated => false,
-        ShellResultChannel::ShellChanStderrTotalBytes => false,
-        ShellResultChannel::ShellChanStderrRetainedBytes => false,
-        _ => target_renders_shell_transport(target.clone()),
+        ShellResultChannel::ShellChanStderrTruncated => true,
+        ShellResultChannel::ShellChanStderrTotalBytes => true,
+        ShellResultChannel::ShellChanStderrRetainedBytes => true,
+        _ => false,
+    }
+}
+
+pub fn shell_channel_realized_by_target(c: ShellResultChannel, target: RenderTarget) -> bool {
+    if shell_channel_is_capture_accounting(c.clone()) {
+        target_is_rust(target.clone())
+    } else {
+        target_renders_shell_transport(target.clone())
+    }
+}
+
+pub fn target_is_rust(target: RenderTarget) -> bool {
+    match target.clone() {
+        RenderTarget::Rust => true,
+        _ => false,
     }
 }
 
@@ -2911,6 +3001,7 @@ pub fn shell_emission_refusal_fact(refusal: Rc<ShellEmissionRefusal>) -> String
     match (*refusal.clone()).clone() {
     ShellEmissionRefusal::ShellOutputKeyNotModeled { key: k, .. } => v1_rt::concat(v1_rt::concat("shell transport output key '".to_string(), k.clone()), "' has no modeled channel -- the modeled channels are stdout, stderr, exit_success, success, exists, exit_code, stdout_lines, stderr_truncated, stderr_total_bytes and stderr_retained_bytes".to_string()),
     ShellEmissionRefusal::ShellChannelNotRealizedByTarget { key: k, target_name: tn, .. } => v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("shell output channel '".to_string(), k.clone()), "' is a modeled channel that target ".to_string()), tn.clone()), " cannot realize -- the emitted realization implements no stderr capture policy, so answering it would assert that the declared policy ran".to_string()),
+    ShellEmissionRefusal::ShellCapturePolicyInputAbsent { key: k, .. } => v1_rt::concat(v1_rt::concat("shell output channel '".to_string(), k.clone()), "' is a capture-accounting channel and this operation does not declare a required scalar stderr_capture: WitnessStderrCapturePolicy -- answering it would apply a policy nobody declared".to_string()),
 }
 }
 
@@ -3077,6 +3168,531 @@ pub fn bind_operation_transport(
     }
 }
 
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum NativeEffectContract {
+    NativeServiceEffect {
+        declaration: Rc<DeclarationRef>,
+    },
+    NativeResourceEffect {
+        binding: String,
+        declaration: Rc<DeclarationRef>,
+    },
+}
+impl NativeEffectContract {
+    pub fn declaration(&self) -> Rc<DeclarationRef> {
+        match self {
+            NativeEffectContract::NativeServiceEffect {
+                declaration: __val, ..
+            } => __val.clone(),
+            NativeEffectContract::NativeResourceEffect {
+                declaration: __val, ..
+            } => __val.clone(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum NativeEffectHandler {
+    NativeTransportHandler { transports: Rc<Vec<TransportKind>> },
+    NativeCapabilityToken,
+}
+impl NativeEffectHandler {
+    pub fn transports(&self) -> Rc<Vec<TransportKind>> {
+        match self {
+            NativeEffectHandler::NativeTransportHandler {
+                transports: __val, ..
+            } => __val.clone(),
+            NativeEffectHandler::NativeCapabilityToken => panic!("no transports on unit variant"),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum NativeEffectUnavailableCause {
+    NativeOperationBindingRefused {
+        operation: String,
+        refusal: Rc<TransportBindingRefusal>,
+    },
+    NativeResourceTraitHasNoImplementor {
+        capability_count: i64,
+    },
+    NativeEffectDeclarationAbsent,
+    NativeEffectDeclarationAmbiguous {
+        candidates: i64,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum NativeEffectRealizationAdmission {
+    NativeEffectHandlerBound {
+        effect_contract: Rc<NativeEffectContract>,
+        handler_identity: Rc<NativeEffectHandler>,
+    },
+    NativeEffectOutsideProductionDenominator {
+        effect_contract: Rc<NativeEffectContract>,
+        denominator: Rc<NativeEffectDenominator>,
+    },
+    NativeEffectRealizationUnavailable {
+        effect_contract: Rc<NativeEffectContract>,
+        cause: Rc<NativeEffectUnavailableCause>,
+    },
+}
+impl NativeEffectRealizationAdmission {
+    pub fn effect_contract(&self) -> Rc<NativeEffectContract> {
+        match self {
+            NativeEffectRealizationAdmission::NativeEffectHandlerBound {
+                effect_contract: __val,
+                ..
+            } => __val.clone(),
+            NativeEffectRealizationAdmission::NativeEffectOutsideProductionDenominator {
+                effect_contract: __val,
+                ..
+            } => __val.clone(),
+            NativeEffectRealizationAdmission::NativeEffectRealizationUnavailable {
+                effect_contract: __val,
+                ..
+            } => __val.clone(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct NativeEffectDeclSite {
+    pub item: Rc<Node>,
+    pub module_name: String,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum NativeEffectResolution {
+    NativeEffectResolved {
+        site: Rc<NativeEffectDeclSite>,
+    },
+    NativeEffectUnresolved {
+        cause: Rc<NativeEffectUnavailableCause>,
+    },
+}
+
+pub fn native_effect_resolution(
+    sites: Rc<Vec<Rc<NativeEffectDeclSite>>>,
+) -> Rc<NativeEffectResolution> {
+    match sites.clone().first().cloned() {
+        std::option::Option::None => Rc::new(NativeEffectResolution::NativeEffectUnresolved {
+            cause: Rc::new(NativeEffectUnavailableCause::NativeEffectDeclarationAbsent),
+        }),
+        Some(site) => {
+            if ((sites.clone().len() as i64) == 1) {
+                Rc::new(NativeEffectResolution::NativeEffectResolved { site: site.clone() })
+            } else {
+                Rc::new(NativeEffectResolution::NativeEffectUnresolved {
+                    cause: Rc::new(
+                        NativeEffectUnavailableCause::NativeEffectDeclarationAmbiguous {
+                            candidates: (sites.clone().len() as i64),
+                        },
+                    ),
+                })
+            }
+        }
+    }
+}
+
+pub fn native_effect_class_matches(
+    class: Rc<NativeEffectClass>,
+    declaration: Rc<DeclarationRef>,
+    transports: Rc<Vec<TransportKind>>,
+) -> bool {
+    match (*class.clone()).clone() {
+        NativeEffectClass::NativeEffectDeclaration { declaration: d, .. } => {
+            ((d.module_path.clone() == declaration.module_path.clone())
+                && (d.decl_name.clone() == declaration.decl_name.clone()))
+        }
+        NativeEffectClass::NativeOutgoingHttp => {
+            let mut __found = false;
+            for t in transports.iter().cloned() {
+                if (t.clone() == TransportKind::RestTransport) {
+                    __found = true;
+                    break;
+                }
+            }
+            __found
+        }
+    }
+}
+
+pub fn native_effect_outside_denominator(
+    denominator: Rc<NativeEffectDenominator>,
+    declaration: Rc<DeclarationRef>,
+    transports: Rc<Vec<TransportKind>>,
+) -> bool {
+    match (*denominator.scope.clone()).clone() {
+        NativeEffectScope::NativeAdmitAllExcept { excluded: xs, .. } => {
+            let mut __found = false;
+            for x in xs.iter().cloned() {
+                if native_effect_class_matches(x.clone(), declaration.clone(), transports.clone()) {
+                    __found = true;
+                    break;
+                }
+            }
+            __found
+        }
+        NativeEffectScope::NativeAdmitOnly { admitted: xs, .. } => {
+            ({
+                let mut __found = false;
+                for x in xs.iter().cloned() {
+                    if native_effect_class_matches(
+                        x.clone(),
+                        declaration.clone(),
+                        transports.clone(),
+                    ) {
+                        __found = true;
+                        break;
+                    }
+                }
+                __found
+            } == false)
+        }
+    }
+}
+
+pub fn bound_operation_transport_kind(bound: Rc<BoundOperation>) -> Option<TransportKind> {
+    match (*bound.clone()).clone() {
+        BoundOperation::RestBound { transport: _, .. } => Some(TransportKind::RestTransport),
+        BoundOperation::ShellBound { .. } => Some(TransportKind::ShellTransport),
+        BoundOperation::FileBound { .. } => Some(TransportKind::FileTransport),
+        BoundOperation::LocalBound => Some(TransportKind::LocalTransport),
+        BoundOperation::BindingRefused { cause: _, .. } => std::option::Option::None,
+    }
+}
+
+pub fn native_transport_kinds_insert(
+    kinds: Rc<Vec<TransportKind>>,
+    kind: TransportKind,
+) -> Rc<Vec<TransportKind>> {
+    if {
+        let mut __found = false;
+        for k in kinds.iter().cloned() {
+            if (k.clone() == kind.clone()) {
+                __found = true;
+                break;
+            }
+        }
+        __found
+    } {
+        kinds.clone()
+    } else {
+        v1_rt::concat(kinds.clone(), Rc::new(vec![kind.clone()]))
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct BoundOperationAt {
+    pub operation: String,
+    pub bound: Rc<BoundOperation>,
+}
+
+pub fn native_service_bound_operations(
+    svc: Rc<Node>,
+    source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+) -> Rc<Vec<Rc<BoundOperationAt>>> {
+    {
+        let fallback = service_fallback_transport(svc.clone());
+        Rc::new({
+            let mut __result = Vec::new();
+            for op in svc.children.clone().iter().cloned() {
+                __result.push(Rc::new(BoundOperationAt {
+                    operation: crate::v1_std_core::authored_name_at(
+                        source_indices.clone(),
+                        op.clone(),
+                    ),
+                    bound: bind_operation_transport(
+                        effective_operation_transport(op.clone(), fallback.clone()),
+                        op.clone(),
+                        source_indices.clone(),
+                    ),
+                }));
+            }
+            __result
+        })
+    }
+}
+
+pub fn admit_native_service_effect(
+    service: String,
+    resolution: Rc<NativeEffectResolution>,
+    denominator: Rc<NativeEffectDenominator>,
+    source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+) -> Rc<NativeEffectRealizationAdmission> {
+    match (*resolution.clone()).clone() {
+        NativeEffectResolution::NativeEffectUnresolved { cause: cz, .. } => Rc::new(
+            NativeEffectRealizationAdmission::NativeEffectRealizationUnavailable {
+                effect_contract: Rc::new(NativeEffectContract::NativeServiceEffect {
+                    declaration: crate::std_decl_ref::decl_ref(
+                        "<unresolved>".to_string(),
+                        service.clone(),
+                    ),
+                }),
+                cause: cz.clone(),
+            },
+        ),
+        NativeEffectResolution::NativeEffectResolved { site: site, .. } => {
+            let declaration =
+                crate::std_decl_ref::decl_ref(site.module_name.clone(), service.clone());
+            let contract = Rc::new(NativeEffectContract::NativeServiceEffect {
+                declaration: declaration.clone(),
+            });
+            let bounds = native_service_bound_operations(site.item.clone(), source_indices.clone());
+            let transports = bounds.iter().cloned().fold(
+                Rc::new(vec![]),
+                |acc: Rc<Vec<TransportKind>>, b: Rc<BoundOperationAt>| {
+                    match bound_operation_transport_kind(b.bound.clone()) {
+                        Some(k) => native_transport_kinds_insert(acc.clone(), k.clone()),
+                        std::option::Option::None => acc.clone(),
+                    }
+                },
+            );
+            if native_effect_outside_denominator(
+                denominator.clone(),
+                declaration.clone(),
+                transports.clone(),
+            ) {
+                Rc::new(
+                    NativeEffectRealizationAdmission::NativeEffectOutsideProductionDenominator {
+                        effect_contract: contract.clone(),
+                        denominator: denominator.clone(),
+                    },
+                )
+            } else {
+                match Rc::new({
+                    let mut __result = Vec::new();
+                    for b in bounds.iter().cloned() {
+                        if (bound_operation_transport_kind(b.bound.clone())
+                            == std::option::Option::None)
+                        {
+                            __result.push(b);
+                        }
+                    }
+                    __result
+                })
+                .first()
+                .cloned()
+                {
+                    Some(r) => match (*r.bound.clone()).clone() {
+                        BoundOperation::BindingRefused { cause: cz, .. } => Rc::new(
+                            NativeEffectRealizationAdmission::NativeEffectRealizationUnavailable {
+                                effect_contract: contract.clone(),
+                                cause: Rc::new(
+                                    NativeEffectUnavailableCause::NativeOperationBindingRefused {
+                                        operation: r.operation.clone(),
+                                        refusal: cz.clone(),
+                                    },
+                                ),
+                            },
+                        ),
+                        _ => Rc::new(
+                            NativeEffectRealizationAdmission::NativeEffectRealizationUnavailable {
+                                effect_contract: contract.clone(),
+                                cause: Rc::new(
+                                    NativeEffectUnavailableCause::NativeEffectDeclarationAbsent,
+                                ),
+                            },
+                        ),
+                    },
+                    std::option::Option::None => {
+                        Rc::new(NativeEffectRealizationAdmission::NativeEffectHandlerBound {
+                            effect_contract: contract.clone(),
+                            handler_identity: Rc::new(
+                                NativeEffectHandler::NativeTransportHandler {
+                                    transports: transports.clone(),
+                                },
+                            ),
+                        })
+                    }
+                }
+            }
+        }
+    }
+}
+
+pub fn admit_native_resource_effect(
+    binding: String,
+    resource: String,
+    resolution: Rc<NativeEffectResolution>,
+    denominator: Rc<NativeEffectDenominator>,
+) -> Rc<NativeEffectRealizationAdmission> {
+    match (*resolution.clone()).clone() {
+        NativeEffectResolution::NativeEffectUnresolved { cause: cz, .. } => Rc::new(
+            NativeEffectRealizationAdmission::NativeEffectRealizationUnavailable {
+                effect_contract: Rc::new(NativeEffectContract::NativeResourceEffect {
+                    binding: binding.clone(),
+                    declaration: crate::std_decl_ref::decl_ref(
+                        "<unresolved>".to_string(),
+                        resource.clone(),
+                    ),
+                }),
+                cause: cz.clone(),
+            },
+        ),
+        NativeEffectResolution::NativeEffectResolved { site: site, .. } => {
+            let declaration =
+                crate::std_decl_ref::decl_ref(site.module_name.clone(), resource.clone());
+            let contract = Rc::new(NativeEffectContract::NativeResourceEffect {
+                binding: binding.clone(),
+                declaration: declaration.clone(),
+            });
+            let capability_count = (site.item.clone().children.clone().len() as i64);
+            if native_effect_outside_denominator(
+                denominator.clone(),
+                declaration.clone(),
+                Rc::new(vec![]),
+            ) {
+                Rc::new(
+                    NativeEffectRealizationAdmission::NativeEffectOutsideProductionDenominator {
+                        effect_contract: contract.clone(),
+                        denominator: denominator.clone(),
+                    },
+                )
+            } else {
+                if (capability_count.clone() == 0) {
+                    Rc::new(NativeEffectRealizationAdmission::NativeEffectHandlerBound {
+                        effect_contract: contract.clone(),
+                        handler_identity: Rc::new(NativeEffectHandler::NativeCapabilityToken),
+                    })
+                } else {
+                    Rc::new(
+                        NativeEffectRealizationAdmission::NativeEffectRealizationUnavailable {
+                            effect_contract: contract.clone(),
+                            cause: Rc::new(
+                                NativeEffectUnavailableCause::NativeResourceTraitHasNoImplementor {
+                                    capability_count: capability_count.clone(),
+                                },
+                            ),
+                        },
+                    )
+                }
+            }
+        }
+    }
+}
+
+pub fn native_declaration_label(d: Rc<DeclarationRef>) -> String {
+    v1_rt::concat(
+        d.module_path.clone(),
+        v1_rt::concat(" ".to_string(), d.decl_name.clone()),
+    )
+}
+
+pub fn native_effect_contract_label(c: Rc<NativeEffectContract>) -> String {
+    match (*c.clone()).clone() {
+        NativeEffectContract::NativeServiceEffect { declaration: d, .. } => {
+            v1_rt::concat("service ".to_string(), native_declaration_label(d.clone()))
+        }
+        NativeEffectContract::NativeResourceEffect {
+            binding: b,
+            declaration: d,
+            ..
+        } => v1_rt::concat(
+            "resource ".to_string(),
+            v1_rt::concat(
+                native_declaration_label(d.clone()),
+                v1_rt::concat(
+                    " (uses ".to_string(),
+                    v1_rt::concat(b.clone(), ")".to_string()),
+                ),
+            ),
+        ),
+    }
+}
+
+pub fn native_route_label(route: CompilerEntryDriver) -> String {
+    match route.clone() {
+        CompilerEntryDriver::NativeCliDriver => "NativeCliDriver".to_string(),
+        CompilerEntryDriver::NativeClaimDriver => "NativeClaimDriver".to_string(),
+        CompilerEntryDriver::NativeServeDriver => "NativeServeDriver".to_string(),
+        CompilerEntryDriver::SourceRootEvalDriver => "SourceRootEvalDriver".to_string(),
+        CompilerEntryDriver::DirectIngestDriver => "DirectIngestDriver".to_string(),
+        CompilerEntryDriver::RetainedHostCliKernel => "RetainedHostCliKernel".to_string(),
+    }
+}
+
+pub fn native_effect_admission_refusal(a: Rc<NativeEffectRealizationAdmission>) -> Option<String> {
+    match (*a.clone()).clone() {
+        NativeEffectRealizationAdmission::NativeEffectHandlerBound { .. } => {
+            std::option::Option::None
+        }
+        NativeEffectRealizationAdmission::NativeEffectOutsideProductionDenominator {
+            effect_contract: c,
+            denominator: d,
+            ..
+        } => Some(v1_rt::concat(
+            native_effect_contract_label(c.clone()),
+            v1_rt::concat(
+                " is outside the ".to_string(),
+                v1_rt::concat(
+                    native_route_label(d.route.clone()),
+                    v1_rt::concat(
+                        " denominator (ruling: ".to_string(),
+                        v1_rt::concat(native_declaration_label(d.ruling.clone()), ")".to_string()),
+                    ),
+                ),
+            ),
+        )),
+        NativeEffectRealizationAdmission::NativeEffectRealizationUnavailable {
+            effect_contract: c,
+            cause: cz,
+            ..
+        } => Some(v1_rt::concat(
+            native_effect_contract_label(c.clone()),
+            v1_rt::concat(
+                " has no native realization: ".to_string(),
+                native_effect_unavailable_fact(cz.clone()),
+            ),
+        )),
+    }
+}
+
+pub fn native_effect_unavailable_fact(cause: Rc<NativeEffectUnavailableCause>) -> String {
+    match (*cause.clone()).clone() {
+        NativeEffectUnavailableCause::NativeOperationBindingRefused {
+            operation: op,
+            refusal: r,
+            ..
+        } => v1_rt::concat(
+            "operation '".to_string(),
+            v1_rt::concat(
+                op.clone(),
+                v1_rt::concat(
+                    "' binds no transport: ".to_string(),
+                    transport_binding_refusal_fact(r.clone()),
+                ),
+            ),
+        ),
+        NativeEffectUnavailableCause::NativeResourceTraitHasNoImplementor {
+            capability_count: n,
+            ..
+        } => v1_rt::concat(
+            "it is a resource trait with ".to_string(),
+            v1_rt::concat(
+                crate::v1_compiler_emit_core_support::to_string(n.clone()),
+                " capabilities and no native implementor".to_string(),
+            ),
+        ),
+        NativeEffectUnavailableCause::NativeEffectDeclarationAbsent => {
+            "its declaration is not in the emitted closure".to_string()
+        }
+        NativeEffectUnavailableCause::NativeEffectDeclarationAmbiguous {
+            candidates: n, ..
+        } => v1_rt::concat(
+            crate::v1_compiler_emit_core_support::to_string(n.clone()),
+            " declarations in the closure carry its name, so which one it demands is not decided"
+                .to_string(),
+        ),
+    }
+}
+
 pub fn emit_unified_transport_dispatch(
     bound: Rc<BoundOperation>,
     op_name: String,
@@ -3474,14 +4090,10 @@ pub fn block_stmts_init(stmts: Rc<Vec<Rc<Node>>>) -> Rc<Vec<Rc<Node>>> {
     if ((stmts.clone().len() as i64) <= 1) {
         Rc::new(vec![])
     } else {
-        Rc::new(
-            stmts
-                .clone()
-                .iter()
-                .cloned()
-                .take(v1_rt::int_sub((stmts.clone().len() as i64), 1) as usize)
-                .collect::<Vec<_>>(),
-        )
+        Rc::new(v1_rt::list_take(
+            &stmts.clone(),
+            v1_rt::int_sub((stmts.clone().len() as i64), 1),
+        ))
     }
 }
 
@@ -5407,6 +6019,62 @@ pub fn file_operation_has_content_input(
     )
 }
 
+pub fn required_stderr_capture_policy_declaration() -> Rc<DeclarationRef> {
+    crate::std_decl_ref::decl_ref(
+        "std.shell_stream_capture".to_string(),
+        "WitnessStderrCapturePolicy".to_string(),
+    )
+}
+
+pub fn param_type_is_stderr_capture_policy_declaration(p: Rc<Node>, env: Rc<TypeEnv>) -> bool {
+    match (*crate::v1_compiler_infer_env::type_reference_declaration_reading(
+        crate::v1_std_core::param_node_type_expr(p.clone()),
+        env.source_indices.clone(),
+        env.clone(),
+    ))
+    .clone()
+    {
+        TypeReferenceDeclarationReading::TypeReferenceNamesDeclaration {
+            declaration: d, ..
+        } => crate::std_decl_ref::declaration_ref_eq(
+            d.clone(),
+            required_stderr_capture_policy_declaration(),
+        ),
+        _ => false,
+    }
+}
+
+pub fn param_is_required_stderr_capture_policy(p: Rc<Node>, env: Rc<TypeEnv>) -> bool {
+    {
+        let ty = crate::v1_std_core::param_node_type_expr(p.clone());
+        (((((crate::v1_std_core::param_node_name_at(p.clone(), env.source_indices.clone())
+            == "stderr_capture".to_string())
+            && (p.return_cardinality.clone() == Cardinality::Required))
+            && (ty.return_cardinality.clone() == Cardinality::Required))
+            && !crate::v1_compiler_infer_types::node_is_collection(
+                ty.clone(),
+                env.source_indices.clone(),
+            ))
+            && param_type_is_stderr_capture_policy_declaration(p.clone(), env.clone()))
+    }
+}
+
+pub fn operation_declares_required_stderr_capture_policy(
+    op_node: Rc<Node>,
+    env: Rc<TypeEnv>,
+) -> bool {
+    {
+        let mut __found = false;
+        for p in op_node.params.clone().iter().cloned() {
+            if param_is_required_stderr_capture_policy(p.clone(), env.clone()) {
+                __found = true;
+                break;
+            }
+        }
+        __found
+    }
+}
+
 pub fn is_modeled_file_output_channel(key: String) -> bool {
     match file_result_channel_of_key(key.clone()) {
         Some(_) => true,
@@ -5732,21 +6400,35 @@ match crate::v1_std_core::classify_transport(t.clone(), si.clone()) {
     span: ch.span.clone(),
 }), module_name.clone())])
             },
-    Some(c) => if shell_channel_realized_by_target(c.clone(), target.clone()) {
-                Rc::new(vec![])
-            } else {
+    Some(c) => if ((shell_channel_is_capture_accounting(c.clone()) && target_is_rust(target.clone())) && !operation_declares_required_stderr_capture_policy(op_node.clone(), env.clone())) {
                 Rc::new(vec![crate::v1_std_core::make_error_node(Rc::new(CompilerDiagnostic::TransportEmissionNotModeled {
     transport_kind: "shell".to_string(),
     service: service_name.clone(),
     operation: crate::v1_compiler_infer_env::authored_name(env.clone(), op_node.clone()),
     declaring_module: module_name.clone(),
     target: render_target_name(target.clone()),
+    missing_realization_fact: shell_emission_refusal_fact(Rc::new(ShellEmissionRefusal::ShellCapturePolicyInputAbsent {
+    key: shell_result_channel_key(c.clone()),
+})),
+    span: ch.span.clone(),
+}), module_name.clone())])
+            } else {
+                if shell_channel_realized_by_target(c.clone(), target.clone()) {
+                    Rc::new(vec![])
+                } else {
+                    Rc::new(vec![crate::v1_std_core::make_error_node(Rc::new(CompilerDiagnostic::TransportEmissionNotModeled {
+    transport_kind: "shell".to_string(),
+    service: service_name.clone(),
+    operation: crate::v1_compiler_infer_env::authored_name(env.clone(), op_node.clone()),
+    declaring_module: module_name.clone(),
+    target: render_target_name(target.clone()),
     missing_realization_fact: shell_emission_refusal_fact(Rc::new(ShellEmissionRefusal::ShellChannelNotRealizedByTarget {
     key: shell_result_channel_key(c.clone()),
     target_name: render_target_name(target.clone()),
 })),
     span: ch.span.clone(),
 }), module_name.clone())])
+                }
             },
 }).iter().cloned()); } __result }),
     _ => Rc::new(vec![]),
@@ -6816,13 +7498,7 @@ pub fn emit_block_stmts_shared(
                 };
                 let next_scope = scope_after_expr(stmt.clone(), scope.clone());
                 {
-                    let __tco_0 = Rc::new(
-                        remaining
-                            .iter()
-                            .cloned()
-                            .skip(1 as usize)
-                            .collect::<Vec<_>>(),
-                    );
+                    let __tco_0 = Rc::new(v1_rt::list_skip(&remaining, 1));
                     let __tco_1 = v1_rt::rc_list_push(text, line.clone());
                     let __tco_2 = next_scope.clone();
                     let __tco_3 = depth;
@@ -6870,14 +7546,7 @@ pub fn emit_init_block_stmts_shared(
                 });
             }
             Some(stmt) => {
-                let rest = Rc::new(
-                    remaining
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                );
+                let rest = Rc::new(v1_rt::list_skip(&remaining.clone(), 1));
                 match rest.clone().first().cloned() {
                     std::option::Option::None => {
                         break Rc::new(BlockEmitState {
@@ -8620,13 +9289,7 @@ pub fn emit_typed_tco_reassign_shared(
             let mut __result = Vec::new();
             for pair in pairs.iter().cloned() {
                 __result.push({
-                    let av = match arg_values
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(pair.0.clone() as usize)
-                        .next()
-                    {
+                    let av = match arg_values.clone().get((pair.0.clone()) as usize).cloned() {
                         Some(v) => v.clone(),
                         std::option::Option::None => pair.1.clone(),
                     };
diff --git a/src/v1/stage0/src/v1_compiler_emit_core_support.rs b/src/v1/stage0/src/v1_compiler_emit_core_support.rs
index cd3986c091a..5540bbc440e 100644
--- a/src/v1/stage0/src/v1_compiler_emit_core_support.rs
+++ b/src/v1/stage0/src/v1_compiler_emit_core_support.rs
@@ -1,6 +1,7 @@
 // Generated by v1 compiler -- do not edit.
 // Source module: v1.compiler.emit_core_support
 
+pub use crate::gunbc_rust_emitted_crate::EmittedRustCrate;
 pub use crate::gunbc_rust_emitted_edge::module_to_filename;
 pub use crate::gunbc_rust_emitted_edge::EmittedEdge;
 pub use crate::v1_compiler_artifact::RenderTarget;
@@ -35,6 +36,7 @@ pub struct EmitResult {
     pub files: Rc<Vec<Rc<TextFile>>>,
     pub diagnostics: Rc<Vec<Rc<ErrorNode>>>,
     pub emitted_edges: Rc<Vec<Rc<EmittedEdge>>>,
+    pub rust_crates: Rc<Vec<Rc<EmittedRustCrate>>>,
 }
 
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
@@ -552,13 +554,7 @@ pub fn apply_named_template_nested(
         match keys.clone().first().cloned() {
             std::option::Option::None => template.clone(),
             Some(key) => {
-                let rest = Rc::new(
-                    keys.clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                );
+                let rest = Rc::new(v1_rt::list_skip(&keys.clone(), 1));
                 let placeholder =
                     v1_rt::concat(v1_rt::concat("{".to_string(), key.clone()), "}".to_string());
                 match v1_rt::map_get(&bindings, key.clone()) {
diff --git a/src/v1/stage0/src/v1_compiler_emit_go.rs b/src/v1/stage0/src/v1_compiler_emit_go.rs
index ee733f053ee..aa0b58d4803 100644
--- a/src/v1/stage0/src/v1_compiler_emit_go.rs
+++ b/src/v1/stage0/src/v1_compiler_emit_go.rs
@@ -126,6 +126,7 @@ pub fn emit_go(typed: Rc<ResolvedGraph>) -> Rc<EmitResult> {
                 files: Rc::new(vec![]),
                 diagnostics: filename_collisions.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let symbol_collisions =
@@ -137,6 +138,7 @@ pub fn emit_go(typed: Rc<ResolvedGraph>) -> Rc<EmitResult> {
                 files: Rc::new(vec![]),
                 diagnostics: symbol_collisions.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let registry = typed.item_registry.clone();
@@ -199,6 +201,7 @@ pub fn emit_go(typed: Rc<ResolvedGraph>) -> Rc<EmitResult> {
             files: files.clone(),
             diagnostics: Rc::new(vec![]),
             emitted_edges: Rc::new(vec![]),
+            rust_crates: Rc::new(vec![]),
         })
     }
 }
diff --git a/src/v1/stage0/src/v1_compiler_emit_python.rs b/src/v1/stage0/src/v1_compiler_emit_python.rs
index f9f6a03e0e4..e08ca294bea 100644
--- a/src/v1/stage0/src/v1_compiler_emit_python.rs
+++ b/src/v1/stage0/src/v1_compiler_emit_python.rs
@@ -114,6 +114,7 @@ pub fn emit_python(typed: Rc<ResolvedGraph>) -> Rc<EmitResult> {
                 files: Rc::new(vec![]),
                 diagnostics: filename_collisions.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let symbol_collisions =
@@ -125,6 +126,7 @@ pub fn emit_python(typed: Rc<ResolvedGraph>) -> Rc<EmitResult> {
                 files: Rc::new(vec![]),
                 diagnostics: symbol_collisions.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let registry = typed.item_registry.clone();
@@ -188,6 +190,7 @@ pub fn emit_python(typed: Rc<ResolvedGraph>) -> Rc<EmitResult> {
             files: files.clone(),
             diagnostics: Rc::new(vec![]),
             emitted_edges: Rc::new(vec![]),
+            rust_crates: Rc::new(vec![]),
         })
     }
 }
diff --git a/src/v1/stage0/src/v1_compiler_emit_rust.rs b/src/v1/stage0/src/v1_compiler_emit_rust.rs
index e28b0327929..8bd51099f84 100644
--- a/src/v1/stage0/src/v1_compiler_emit_rust.rs
+++ b/src/v1/stage0/src/v1_compiler_emit_rust.rs
@@ -7,7 +7,6 @@ use self::FmArmAnalysis::*;
 use self::FmLoweringRefusal::*;
 use self::HostOptionArmReading::*;
 use self::IterOwnedReceiverCloneDisposition::*;
-use self::NativeClaimEffectDemand::*;
 use self::SealReading::*;
 use self::WitnessCtorPathVerdict::*;
 pub use crate::extdeps_cargo::CargoFeature;
@@ -51,10 +50,12 @@ pub use crate::gunbc_reference_derived_candidate::{
     ReferenceDerivedCandidateDisposition, ReferenceDerivedCandidateRow,
 };
 pub use crate::gunbc_rust_decl_type_overlay::rust_decl_type_container_overlay_is_admitted;
+pub use crate::gunbc_rust_emitted_crate::{EmittedCrateDependencyDemand, EmittedRustCrate};
 use crate::gunbc_rust_emitted_edge::EmittedEdgeProvenance::{ReexportFacade, RuntimePrelude};
 pub use crate::gunbc_rust_emitted_edge::{
-    emitted_edge_target_module, rust_module_emit_filename, rust_prelude_emitted_edges,
-    semantic_source_reference_edge,
+    declared_import_edge, emitted_edge_target_module, inline_path_reference_edge,
+    rust_module_emit_filename, rust_prelude_emitted_edges, semantic_source_reference_edge,
+    service_runtime_surface_edge,
 };
 pub use crate::gunbc_rust_emitted_edge::{EmittedEdge, EmittedEdgeProvenance};
 pub use crate::gunbc_rust_source_type_bindings::rust_host_option_carrier_declarations;
@@ -78,6 +79,11 @@ use crate::std_coercion::TypeDeclarationProvenance::{
 };
 use crate::std_coercion::TypeRealizationDecision::*;
 pub use crate::std_coercion::{TypeDeclarationProvenance, TypeRealizationDecision};
+pub use crate::std_compiler_entry::NativeEffectDenominator;
+pub use crate::std_compiler_entry::{
+    native_claim_route_denominator, native_compiler_route_denominator,
+    native_service_route_denominator,
+};
 use crate::std_decl_ref::DeclField::WholeDeclaration;
 pub use crate::std_decl_ref::{decl_ref, declaration_ref_in_list};
 pub use crate::std_decl_ref::{DeclField, DeclarationRef};
@@ -86,13 +92,18 @@ pub use crate::std_induction::{InductiveField, SubValueRelation};
 use crate::std_literal_elaboration::KernelGroundingLookup::{
     KernelGroundingAbsent, KernelGroundingAmbiguous, KernelGroundingFound,
 };
+use crate::std_literal_elaboration::KernelMintDeclarationLookup::{
+    KernelMintDeclarationAbsent, KernelMintDeclarationAmbiguous, KernelMintDeclarationFound,
+};
 use crate::std_literal_elaboration::KernelMintOwnership::{
     DeclarationDoesNotOwnTheMint, DeclarationOwnsTheMint, KernelMintOwnershipAmbiguous,
 };
 use crate::std_literal_elaboration::LiteralSourceKind::KernelIntLiteral;
-pub use crate::std_literal_elaboration::{kernel_grounding_for, kernel_mint_ownership};
 pub use crate::std_literal_elaboration::{
-    KernelGroundingLookup, KernelMintOwnership, LiteralSourceKind,
+    kernel_grounding_for, kernel_mint_declaration_for, kernel_mint_ownership,
+};
+pub use crate::std_literal_elaboration::{
+    KernelGroundingLookup, KernelMintDeclarationLookup, KernelMintOwnership, LiteralSourceKind,
 };
 pub use crate::std_measure::millisecond_count;
 pub use crate::std_occurrence_identity::NodeOccurrenceIdentity;
@@ -178,31 +189,43 @@ use crate::v1_compiler_emit::FileVerb::{
     FileDelete, FileLinkCreateNew, FileList, FileRead, FileWrite, FileWriteCreateNew,
     FileWriteCreateNewWithMode, FileWriteOwnerOnly,
 };
-use crate::v1_compiler_emit::ShellEmissionRefusal::ShellChannelNotRealizedByTarget;
+use crate::v1_compiler_emit::NativeEffectContract::{NativeResourceEffect, NativeServiceEffect};
+use crate::v1_compiler_emit::NativeEffectHandler::{NativeCapabilityToken, NativeTransportHandler};
+use crate::v1_compiler_emit::NativeEffectRealizationAdmission::{
+    NativeEffectHandlerBound, NativeEffectOutsideProductionDenominator,
+    NativeEffectRealizationUnavailable,
+};
+use crate::v1_compiler_emit::ShellEmissionRefusal::{
+    ShellCapturePolicyInputAbsent, ShellChannelNotRealizedByTarget,
+};
 use crate::v1_compiler_emit::ShellResultChannel::{
     ShellChanExitCode, ShellChanExitSuccess, ShellChanStderr, ShellChanStderrRetainedBytes,
     ShellChanStderrTotalBytes, ShellChanStderrTruncated, ShellChanStdout, ShellChanStdoutLines,
 };
 pub use crate::v1_compiler_emit::{
-    bind_operation_transport, child_from_key, compute_service_fields,
-    effective_operation_transport, emit_bin_op_symbol, emit_container, emit_data_value_json,
-    emit_error_expr, emit_ident, emit_keyed_container_type, emit_keyword, emit_lambda,
-    emit_lambda_params, emit_let_binding, emit_let_binding_annotated, emit_list_lit_expr,
-    emit_literal, emit_node_type, emit_null_coalesce, emit_return, emit_shared_expr,
-    emit_shared_tco_expr, emit_simple_expr, emit_string_literal, emit_typed_cast_shared,
-    emit_typed_if_shared, emit_typed_let_shared, emit_unary_op, escape_rust_interp_text,
-    extract_modifier_names, has_nested_records_node, has_service_items, is_null_coalesce,
-    is_self_recursive, is_tco_eligible, keyed_container_has_target_inhabitant,
-    lookup_item_by_identity, module_emit_scope, order_typed_call_args_from_semantics,
+    admit_native_resource_effect, admit_native_service_effect, bind_operation_transport,
+    child_from_key, compute_service_fields, effective_operation_transport, emit_bin_op_symbol,
+    emit_container, emit_data_value_json, emit_declared_optional_row_json, emit_error_expr,
+    emit_ident, emit_keyed_container_type, emit_keyword, emit_lambda, emit_lambda_params,
+    emit_let_binding, emit_let_binding_annotated, emit_list_lit_expr, emit_literal, emit_node_type,
+    emit_null_coalesce, emit_return, emit_shared_expr, emit_shared_tco_expr, emit_simple_expr,
+    emit_string_literal, emit_typed_cast_shared, emit_typed_if_shared, emit_typed_let_shared,
+    emit_unary_op, escape_rust_interp_text, extract_modifier_names, has_nested_records_node,
+    has_service_items, is_null_coalesce, is_self_recursive, is_tco_eligible,
+    keyed_container_has_target_inhabitant, lookup_item_by_identity, module_emit_scope,
+    native_effect_admission_refusal, native_effect_resolution,
+    operation_declares_required_stderr_capture_policy, order_typed_call_args_from_semantics,
     render_node_type, render_tuple_parts, rust_literal_for_pattern, scope_after_expr,
     seed_bindings, service_fallback_transport, service_field_ctors, service_field_decls,
-    shared_tco_reassign, shell_emission_refusal_fact, shell_result_channel_key,
-    tco_loop_iteration_lets, tco_loop_slot_name, tco_reassign_core, transport_binding_refusal_fact,
+    shared_tco_reassign, shell_channel_is_capture_accounting, shell_emission_refusal_fact,
+    shell_result_channel_key, tco_loop_iteration_lets, tco_loop_slot_name, tco_reassign_core,
+    transport_binding_refusal_fact,
 };
 pub use crate::v1_compiler_emit::{
     BlockEmitState, BoundOperation, EmitterOutcome, FileResultChannel, FileResultField, FileVerb,
-    InterpPart, ServiceFieldSet, ShellEmissionRefusal, ShellResultChannel, ShellResultField,
-    TcoFrame, TcoReassignInput,
+    InterpPart, NativeEffectContract, NativeEffectDeclSite, NativeEffectHandler,
+    NativeEffectRealizationAdmission, ServiceFieldSet, ShellEmissionRefusal, ShellResultChannel,
+    ShellResultField, TcoFrame, TcoReassignInput,
 };
 pub use crate::v1_compiler_emit_core_support::{
     apply_named_template, apply_type_template1, apply_type_template2, apply_type_template3,
@@ -227,15 +250,28 @@ use crate::v1_compiler_infer_emit_info::TypeDeclResolution::{
     TypeDeclKernelSpellingUndecided, TypeDeclLeafAmbiguous, TypeDeclNotDeclared, TypeDeclResolved,
 };
 use crate::v1_compiler_infer_emit_info::TypeRepr::{EnumRepr, StructRepr};
+use crate::v1_compiler_infer_emit_info::TypeSummaryLookup::{
+    TypeSummaryFound, TypeSummaryLeafAmbiguous, TypeSummaryNotDeclared,
+};
+use crate::v1_compiler_infer_emit_info::TypeSummaryQuestion::{
+    QuestionDecided, QuestionNameAmbiguous, QuestionNotDeclared,
+};
 pub use crate::v1_compiler_infer_emit_info::{
     collect_type_node_import_surface_names, collect_type_node_import_surface_occurrences,
     emit_info_with_expected_type, emit_info_with_fn_return, emit_info_with_fn_type_context,
     empty_emit_graph_info, find_variant_parent, is_enum_in_summaries, is_known_variant,
-    lookup_emit_type_summary, resolve_type_decl_reference, type_decl_identity,
+    lookup_emit_type_summary, resolve_type_decl_reference, summary_is_enum_with_variant,
+    type_decl_identities_of_leaf, type_decl_identity, type_summary_answer, type_summary_decided,
+    type_summary_keys_of_leaf, type_summary_lookup, type_summary_of_reference, type_summary_values,
     variant_belongs_to_enum, variant_summary_key,
 };
 pub use crate::v1_compiler_infer_emit_info::{
-    EmitGraphInfo, TypeDeclIndex, TypeDeclResolution, TypeRepr, TypeSummary, TypeSurfaceOccurrence,
+    EmitGraphInfo, TypeDeclIndex, TypeDeclResolution, TypeRepr, TypeSummary, TypeSummaryIndex,
+    TypeSummaryLookup, TypeSummaryQuestion, TypeSurfaceOccurrence,
+};
+use crate::v1_compiler_infer_env::BareOccurrenceBinding::{
+    BareOccurrenceDeclaredInItsFile, BareOccurrenceImportedByName, BareOccurrenceIsKernelName,
+    BareOccurrenceUndecided,
 };
 use crate::v1_compiler_infer_env::GlobalBareLookupState::{
     GlobalBareAmbiguousBinding, GlobalBareUniqueBinding,
@@ -244,12 +280,13 @@ use crate::v1_compiler_infer_env::UnitVariantPhantomLookup::{
     UnitVariantPhantomAbsent, UnitVariantPhantomEvidenceUnavailable, UnitVariantPhantomPresent,
 };
 pub use crate::v1_compiler_infer_env::{
-    authored_name, binding_declares_span, empty_symbol_index, lookup_binding_by_name,
-    lookup_type_by_name, lookup_type_for, lookup_unit_variant_phantom_type,
+    authored_name, bare_occurrence_binding, binding_declares_span,
+    declaration_ref_of_declaration_node, empty_symbol_index, empty_type_env,
+    lookup_binding_by_name, lookup_type_by_name, lookup_type_for, lookup_unit_variant_phantom_type,
     type_reference_declaration_ref,
 };
 pub use crate::v1_compiler_infer_env::{
-    GlobalBareLookupState, TypeBinding, TypeEnv, UnitVariantPhantomLookup,
+    BareOccurrenceBinding, GlobalBareLookupState, TypeBinding, TypeEnv, UnitVariantPhantomLookup,
 };
 use crate::v1_compiler_infer_items::ItemKind::{DataItem, OtherItem, TypeItem};
 use crate::v1_compiler_infer_items::ItemLookup::{ItemFound, ItemLeafAmbiguous, ItemNotFound};
@@ -311,8 +348,8 @@ use crate::v1_std_core::CallTargetIdentity::{
 use crate::v1_std_core::Cardinality::{CardOptional, Required};
 use crate::v1_std_core::CompilerDiagnostic::{
     AmbiguousAnonymousRecordLiteral, AmbiguousReference, EffectfulSelfRecursionUnrealized,
-    InternalError, ReferenceDerivedImportExportUnproven, ReferenceDerivedImportProviderUnknown,
-    UnlistedImportUse,
+    InternalError, NativeEffectRealizationRefused, ReferenceDerivedImportExportUnproven,
+    ReferenceDerivedImportProviderUnknown, UnlistedImportUse,
 };
 use crate::v1_std_core::Connective::{Arrow, Conj, Disj, NoConnective};
 use crate::v1_std_core::DeclarationMarker::Unmarked;
@@ -404,7 +441,11 @@ pub fn render_rust_type(
         if is_host_text_carrier_type(n.clone(), source_indices.clone()) {
             return rust_carrier_optional_wrap(n.clone(), "String".to_string());
         }
-        if is_host_optional_carrier_type(n.clone(), source_indices.clone()) {
+        if is_host_optional_carrier_type(
+            n.clone(),
+            source_indices.clone(),
+            emit_info.fn_type_env.clone(),
+        ) {
             return render_rust_optional_carrier_applied(
                 n.clone(),
                 emit_info.fn_generic_param_names.clone(),
@@ -423,7 +464,10 @@ pub fn render_rust_type(
                     tv.clone(),
                     emit_info.fn_generic_param_names.clone(),
                 ) {
-                    crate::v1_compiler_emit_core_support::to_pascal(tv.clone())
+                    rust_carrier_optional_wrap(
+                        n.clone(),
+                        crate::v1_compiler_emit_core_support::to_pascal(tv.clone()),
+                    )
                 } else {
                     "_".to_string()
                 }
@@ -588,7 +632,11 @@ pub fn render_rust_type_without_applied_binding(
         if is_host_text_carrier_type(n.clone(), source_indices.clone()) {
             return rust_carrier_optional_wrap(n.clone(), "String".to_string());
         }
-        if is_host_optional_carrier_type(n.clone(), source_indices.clone()) {
+        if is_host_optional_carrier_type(
+            n.clone(),
+            source_indices.clone(),
+            emit_info.fn_type_env.clone(),
+        ) {
             return render_rust_optional_carrier_applied(
                 n.clone(),
                 emit_info.fn_generic_param_names.clone(),
@@ -688,14 +736,7 @@ pub fn render_rust_type_without_applied_binding(
                                 let key_node = crate::v1_compiler_infer_types::child_type_node(
                                     key_child.clone(),
                                 );
-                                let val_node = match n
-                                    .children
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .next()
-                                {
+                                let val_node = match n.children.clone().get((1) as usize).cloned() {
                                     Some(val_child) => {
                                         if rust_type_node_is_arrow(val_child.clone()) {
                                             val_child.clone()
@@ -897,10 +938,6 @@ pub fn is_host_freemonoid_vec_alias(name: String) -> bool {
     (name.clone() == "FreeMonoid".to_string())
 }
 
-pub fn is_host_optional_carrier_alias(name: String) -> bool {
-    (name.clone() == kernel_optional_mint_name())
-}
-
 pub fn is_host_diagnostics_carrier_alias(name: String) -> bool {
     {
         let mut __found = false;
@@ -914,9 +951,87 @@ pub fn is_host_diagnostics_carrier_alias(name: String) -> bool {
     }
 }
 
-pub fn is_grounded_coproduct_native_alias(name: String) -> bool {
-    ((is_host_freemonoid_vec_alias(name.clone()) || is_host_optional_carrier_alias(name.clone()))
-        || is_host_diagnostics_carrier_alias(name.clone()))
+pub fn declaration_is_grounded_coproduct_native_alias(
+    mut __tco_loop_module_path: String,
+    mut __tco_loop_decl_name: String,
+) -> bool {
+    loop {
+        #[allow(unused_mut)]
+        let mut module_path = __tco_loop_module_path;
+        #[allow(unused_mut)]
+        let mut decl_name = __tco_loop_decl_name;
+        if v1_rt::contains(decl_name.clone(), ".".to_string()) {
+            let segments = Rc::new(
+                decl_name
+                    .clone()
+                    .split(&".".to_string())
+                    .map(|s| s.to_string())
+                    .collect::<Vec<_>>(),
+            );
+            {
+                let __tco_0 = Rc::new(v1_rt::list_take(
+                    &segments.clone(),
+                    v1_rt::int_sub((segments.clone().len() as i64), 1),
+                ))
+                .join(&".".to_string());
+                let __tco_1 = crate::v1_std_core::qualified_last_segment(decl_name);
+                __tco_loop_module_path = __tco_0;
+                __tco_loop_decl_name = __tco_1;
+                continue;
+            }
+        } else {
+            break ((is_host_freemonoid_vec_alias(decl_name.clone())
+                || declaration_owns_host_option(module_path.clone(), decl_name.clone()))
+                || crate::std_decl_ref::declaration_ref_in_list(
+                    crate::std_decl_ref::decl_ref(module_path.clone(), decl_name.clone()),
+                    rust_host_option_carrier_declarations(),
+                ));
+        }
+    }
+}
+
+pub fn every_declarer_is_grounded_coproduct_native_alias(
+    decls: Rc<TypeDeclIndex>,
+    name: String,
+) -> bool {
+    {
+        let identities = crate::v1_compiler_infer_emit_info::type_decl_identities_of_leaf(
+            decls.clone(),
+            crate::v1_std_core::qualified_last_segment(name.clone()),
+        );
+        (((identities.clone().len() as i64) > 0) && {
+            let mut __all = true;
+            for identity in identities.iter().cloned() {
+                if !(declaration_is_grounded_coproduct_native_alias(
+                    "".to_string(),
+                    identity.clone(),
+                )) {
+                    __all = false;
+                    break;
+                }
+            }
+            __all
+        })
+    }
+}
+
+pub fn summary_declares_grounded_coproduct_native_alias(summary: Rc<TypeSummary>) -> bool {
+    {
+        let segments = Rc::new(
+            summary
+                .key
+                .clone()
+                .split(&".".to_string())
+                .map(|s| s.to_string())
+                .collect::<Vec<_>>(),
+        );
+        let module_path = Rc::new(v1_rt::list_take(
+            &segments.clone(),
+            v1_rt::int_sub((segments.clone().len() as i64), 1),
+        ))
+        .join(&".".to_string());
+        declaration_is_grounded_coproduct_native_alias(module_path.clone(), summary.name.clone())
+    }
 }
 
 pub fn rust_declaration_realizes_as_native_alias(module_path: String, decl_name: String) -> bool {
@@ -934,13 +1049,125 @@ pub fn rust_declaration_realizes_as_native_alias(module_path: String, decl_name:
     }
 }
 
+pub fn declaration_owns_host_option(module_path: String, decl_name: String) -> bool {
+    match (*crate::std_literal_elaboration::kernel_mint_ownership(
+        kernel_mint_declaration_rows(),
+        kernel_optional_mint_name(),
+        crate::std_decl_ref::decl_ref(module_path.clone(), decl_name.clone()),
+    ))
+    .clone()
+    {
+        KernelMintOwnership::DeclarationOwnsTheMint => true,
+        KernelMintOwnership::DeclarationDoesNotOwnTheMint => false,
+        KernelMintOwnership::KernelMintOwnershipAmbiguous { row_count: _, .. } => false,
+    }
+}
+
+pub fn unstamped_reference_is_host_option(
+    n: Rc<Node>,
+    source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+    env: Rc<TypeEnv>,
+) -> bool {
+    {
+        let leaf = crate::v1_std_core::authored_name_at(source_indices.clone(), n.clone());
+        match (*crate::v1_compiler_infer_env::bare_occurrence_binding(
+            env.symbol_index.clone(),
+            leaf.clone(),
+            n.clone(),
+        ))
+        .clone()
+        {
+            BareOccurrenceBinding::BareOccurrenceDeclaredInItsFile {
+                declaration: decl, ..
+            } => {
+                declaration_node_owns_host_option(decl.clone(), source_indices.clone(), env.clone())
+            }
+            BareOccurrenceBinding::BareOccurrenceImportedByName {
+                module_path: from_module,
+                declaration: decl,
+                ..
+            } => {
+                (declaration_owns_host_option(from_module.clone(), leaf.clone())
+                    || declaration_node_owns_host_option(
+                        decl.clone(),
+                        source_indices.clone(),
+                        env.clone(),
+                    ))
+            }
+            BareOccurrenceBinding::BareOccurrenceIsKernelName => {
+                match (*crate::std_literal_elaboration::kernel_mint_declaration_for(
+                    kernel_mint_declaration_rows(),
+                    leaf.clone(),
+                ))
+                .clone()
+                {
+                    KernelMintDeclarationLookup::KernelMintDeclarationFound {
+                        declaration: d,
+                        ..
+                    } => declaration_owns_host_option(d.module_path.clone(), d.decl_name.clone()),
+                    KernelMintDeclarationLookup::KernelMintDeclarationAbsent => false,
+                    KernelMintDeclarationLookup::KernelMintDeclarationAmbiguous {
+                        row_count: _,
+                        ..
+                    } => false,
+                }
+            }
+            BareOccurrenceBinding::BareOccurrenceUndecided => false,
+        }
+    }
+}
+
+pub fn declaration_node_owns_host_option(
+    decl: Rc<Node>,
+    source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+    env: Rc<TypeEnv>,
+) -> bool {
+    match crate::v1_compiler_infer_env::declaration_ref_of_declaration_node(
+        decl.clone(),
+        source_indices.clone(),
+        env.clone(),
+    ) {
+        Some(d) => declaration_owns_host_option(d.module_path.clone(), d.decl_name.clone()),
+        std::option::Option::None => false,
+    }
+}
+
 pub fn is_host_optional_carrier_type(
     n: Rc<Node>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+    env: Rc<TypeEnv>,
 ) -> bool {
-    ((crate::v1_std_core::authored_name_at(source_indices.clone(), n.clone())
-        == "Optional".to_string())
-        && ((n.children.clone().len() as i64) > 0))
+    match n.declaration.clone() {
+        Some(d) => match (*d.field.clone()).clone() {
+            DeclField::WholeDeclaration => {
+                declaration_owns_host_option(d.module_path.clone(), d.decl_name.clone())
+            }
+            _ => false,
+        },
+        std::option::Option::None => {
+            let is_declaration_structure = (((n.module_item_kind.clone()
+                == ParsedModuleItemKind::ModuleItemTypeDeclaration)
+                || (n.connective.clone() == Connective::Disj))
+                && (n.ident_span.clone() != std::option::Option::None));
+            let declared = if is_declaration_structure.clone() {
+                crate::v1_compiler_infer_env::declaration_ref_of_declaration_node(
+                    n.clone(),
+                    source_indices.clone(),
+                    env.clone(),
+                )
+            } else {
+                std::option::Option::None
+            };
+            match declared.clone() {
+                Some(d) => declaration_owns_host_option(d.module_path.clone(), d.decl_name.clone()),
+                std::option::Option::None => unstamped_reference_is_host_option(
+                    n.clone(),
+                    source_indices.clone(),
+                    env.clone(),
+                ),
+            }
+        }
+    }
 }
 
 pub fn is_host_diagnostics_carrier_type(
@@ -2311,7 +2538,10 @@ pub fn render_rust_applied_type_arg(
                 match n.inferred.clone().as_deref().cloned() {
                     Some(InferredNode::TypeVariable { id: tv, .. }) => {
                         if type_var_in_fn_generic_scope(tv.clone(), generic_param_names.clone()) {
-                            crate::v1_compiler_emit_core_support::to_pascal(tv.clone())
+                            rust_carrier_optional_wrap(
+                                n.clone(),
+                                crate::v1_compiler_emit_core_support::to_pascal(tv.clone()),
+                            )
                         } else {
                             "_".to_string()
                         }
@@ -2350,7 +2580,7 @@ pub fn render_rust_applied_type(
         if is_host_text_carrier_type(n.clone(), source_indices.clone()) {
             return rust_carrier_optional_wrap(n.clone(), "String".to_string());
         }
-        if is_host_optional_carrier_type(n.clone(), source_indices.clone()) {
+        if is_host_optional_carrier_type(n.clone(), source_indices.clone(), env.clone()) {
             return render_rust_optional_carrier_applied(
                 n.clone(),
                 generic_param_names.clone(),
@@ -2617,7 +2847,7 @@ pub fn render_rust_decl_type(
         if is_host_text_carrier_type(n.clone(), source_indices.clone()) {
             return rust_carrier_optional_wrap(n.clone(), "String".to_string());
         }
-        if is_host_optional_carrier_type(n.clone(), source_indices.clone()) {
+        if is_host_optional_carrier_type(n.clone(), source_indices.clone(), env.clone()) {
             return render_rust_optional_carrier_applied(
                 n.clone(),
                 generic_param_names.clone(),
@@ -2770,7 +3000,10 @@ pub fn render_rust_decl_type(
                                 __found
                             })
                         {
-                            crate::v1_compiler_emit_core_support::to_pascal(name.clone())
+                            rust_carrier_optional_wrap(
+                                n.clone(),
+                                crate::v1_compiler_emit_core_support::to_pascal(name.clone()),
+                            )
                         } else {
                             if (bare_native_alias.clone() != std::option::Option::None) {
                                 rust_carrier_optional_wrap(
@@ -2880,7 +3113,7 @@ if peel.clone() {
                                                             } else {
                                                                 if crate::v1_compiler_infer_types::node_is_keyed_collection(n.clone(), source_indices.clone()) {
                                                     match arg_list.clone().first().cloned() {
-    Some(k) => match arg_list.clone().iter().cloned().skip(1 as usize).next() {
+    Some(k) => match arg_list.clone().get((1) as usize).cloned() {
     Some(v) => crate::v1_compiler_emit::emit_keyed_container_type(name.clone(), k.clone(), v.clone(), base.clone(), RenderTarget::Rust),
     std::option::Option::None => v1_rt::concat(v1_rt::concat(v1_rt::concat(base.clone(), "<".to_string()), arg_list.clone().join(&", ".to_string())), ">".to_string()),
 },
@@ -2980,7 +3213,7 @@ pub fn render_rust_fn_sig_type(
         if is_host_text_carrier_type(n.clone(), source_indices.clone()) {
             return rust_carrier_optional_wrap(n.clone(), "String".to_string());
         }
-        if is_host_optional_carrier_type(n.clone(), source_indices.clone()) {
+        if is_host_optional_carrier_type(n.clone(), source_indices.clone(), env.clone()) {
             return render_rust_optional_carrier_applied(
                 n.clone(),
                 generic_param_names.clone(),
@@ -3295,7 +3528,7 @@ pub fn rust_alias_rhs_applied_container_or_base(
 ) -> String {
     if crate::v1_compiler_infer_types::node_is_keyed_collection(n.clone(), source_indices.clone()) {
         match arg_list.clone().first().cloned() {
-            Some(k) => match arg_list.clone().iter().cloned().skip(1 as usize).next() {
+            Some(k) => match arg_list.clone().get((1) as usize).cloned() {
                 Some(v) => crate::v1_compiler_emit::emit_keyed_container_type(
                     leaf.clone(),
                     k.clone(),
@@ -3461,7 +3694,10 @@ pub fn render_rust_alias_rhs_type(
                 __found
             })
         {
-            break crate::v1_compiler_emit_core_support::to_pascal(name.clone());
+            break rust_carrier_optional_wrap(
+                n.clone(),
+                crate::v1_compiler_emit_core_support::to_pascal(name.clone()),
+            );
         } else {
             if ((n.connective.clone() == Connective::NoConnective)
                 && ((n.children.clone().len() as i64) == 0))
@@ -5951,13 +6187,7 @@ pub fn emit_rust_block_stmts(
                 let next_scope =
                     crate::v1_compiler_emit::scope_after_expr(stmt.clone(), scope.clone());
                 {
-                    let __tco_0 = Rc::new(
-                        remaining
-                            .iter()
-                            .cloned()
-                            .skip(1 as usize)
-                            .collect::<Vec<_>>(),
-                    );
+                    let __tco_0 = Rc::new(v1_rt::list_skip(&remaining, 1));
                     let __tco_1 = v1_rt::rc_list_push(text, line.clone());
                     let __tco_2 = next_scope.clone();
                     let __tco_3 = registry;
@@ -6010,14 +6240,7 @@ pub fn emit_rust_init_block_stmts(
                 });
             }
             Some(stmt) => {
-                let rest = Rc::new(
-                    remaining
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                );
+                let rest = Rc::new(v1_rt::list_skip(&remaining.clone(), 1));
                 match rest.clone().first().cloned() {
                     std::option::Option::None => {
                         break Rc::new(BlockEmitState {
@@ -6077,7 +6300,10 @@ pub fn rust_qualify_type_leaf_name(
     match v1_rt::map_get(&variant_to_enum, name.clone()) {
         Some(parent) => {
             if (parent.clone() != "".to_string()) {
-                rust_variant_path(parent.clone(), name.clone())
+                rust_variant_path(
+                    crate::v1_std_core::qualified_last_segment(parent.clone()),
+                    name.clone(),
+                )
             } else {
                 name.clone()
             }
@@ -6368,7 +6594,7 @@ pub fn maybe_mark_shared_type(
                     ..
                 } => (unit_only.clone() == false),
             });
-        if is_grounded_coproduct_native_alias(summary.name.clone()) {
+        if summary_declares_grounded_coproduct_native_alias(summary.clone()) {
             acc.clone()
         } else {
             if (needs_sharing.clone()
@@ -6382,27 +6608,75 @@ pub fn maybe_mark_shared_type(
     }
 }
 
+pub fn shared_by_every_declarer(
+    type_summaries: Rc<TypeSummaryIndex>,
+    name: String,
+    recursive_type_set: Rc<BTreeSet<String>>,
+    target_needs_sharing: bool,
+) -> bool {
+    {
+        let mut __all = true;
+        for key in crate::v1_compiler_infer_emit_info::type_summary_keys_of_leaf(
+            type_summaries.clone(),
+            name.clone(),
+        )
+        .iter()
+        .cloned()
+        {
+            if !(match crate::v1_compiler_infer_emit_info::type_summary_decided(
+                type_summaries.clone(),
+                key.clone(),
+            ) {
+                Some(summary) => v1_rt::set_contains(
+                    &maybe_mark_shared_type(
+                        v1_rt::rc_empty_set::<String>(),
+                        summary.clone(),
+                        recursive_type_set.clone(),
+                        target_needs_sharing.clone(),
+                    ),
+                    name.clone(),
+                ),
+                std::option::Option::None => true,
+            }) {
+                __all = false;
+                break;
+            }
+        }
+        __all
+    }
+}
+
 pub fn build_shared_types(
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     recursive_type_set: Rc<BTreeSet<String>>,
     target: RenderTarget,
 ) -> Rc<BTreeSet<String>> {
     {
         let sharing = crate::v1_compiler_languages::sharing_for_target(target.clone());
-        let user_shared = Rc::new(v1_rt::map_values(&type_summaries))
-            .iter()
-            .cloned()
-            .fold(
-                v1_rt::rc_empty_set::<String>(),
-                |acc: Rc<BTreeSet<String>>, summary: Rc<TypeSummary>| {
-                    maybe_mark_shared_type(
-                        acc,
-                        summary.clone(),
-                        recursive_type_set.clone(),
-                        sharing.needs_sharing.clone(),
-                    )
-                },
-            );
+        let user_shared =
+            crate::v1_compiler_infer_emit_info::type_summary_values(type_summaries.clone())
+                .iter()
+                .cloned()
+                .fold(
+                    v1_rt::rc_empty_set::<String>(),
+                    |acc: Rc<BTreeSet<String>>, summary: Rc<TypeSummary>| {
+                        if shared_by_every_declarer(
+                            type_summaries.clone(),
+                            summary.name.clone(),
+                            recursive_type_set.clone(),
+                            sharing.needs_sharing.clone(),
+                        ) {
+                            maybe_mark_shared_type(
+                                acc.clone(),
+                                summary.clone(),
+                                recursive_type_set.clone(),
+                                sharing.needs_sharing.clone(),
+                            )
+                        } else {
+                            acc.clone()
+                        }
+                    },
+                );
         let collection_keys = Rc::new({
             let mut __result = Vec::new();
             for k in Rc::new(v1_rt::sorted_map_keys(&rust_container_templates()))
@@ -6909,6 +7183,7 @@ pub fn emit_rust_selected(
                 files: Rc::new(vec![]),
                 diagnostics: anonymous_record_diags.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let effectful_recursion_diags = ctx.effectful_recursion_diags.clone();
@@ -6917,6 +7192,7 @@ pub fn emit_rust_selected(
                 files: Rc::new(vec![]),
                 diagnostics: effectful_recursion_diags.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let filename_collisions =
@@ -6928,6 +7204,7 @@ pub fn emit_rust_selected(
                 files: Rc::new(vec![]),
                 diagnostics: filename_collisions.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let symbol_collisions =
@@ -6939,6 +7216,7 @@ pub fn emit_rust_selected(
                 files: Rc::new(vec![]),
                 diagnostics: symbol_collisions.clone(),
                 emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
             });
         }
         let test_projections = ctx.test_projections.clone();
@@ -7151,19 +7429,30 @@ pub fn emit_rust_selected(
         } else {
             "v1_compiled".to_string()
         };
-        let cargo = emit_cargo_toml(
-            crate_name.clone(),
-            EmittedCrateDependencyDemand {
+        let rust_crate = Rc::new(EmittedRustCrate {
+            crate_name: crate_name.clone(),
+            demand: EmittedCrateDependencyDemand {
                 renders_clap_cli: has_pipeline.clone(),
                 renders_async_services: (has_services.clone()
                     || closure_renders_async_trait_resource(typed.clone())),
             },
-        );
+        });
+        let native_effects = native_entry_effects(typed.modules.clone(), ctx.registry.clone());
+        let native_effect_refusals =
+            native_entry_effect_diagnostics(native_effects.clone(), typed.modules.clone());
+        if ((native_effect_refusals.clone().len() as i64) > 0) {
+            return Rc::new(EmitResult {
+                files: Rc::new(vec![]),
+                diagnostics: native_effect_refusals.clone(),
+                emitted_edges: Rc::new(vec![]),
+                rust_crates: Rc::new(vec![]),
+            });
+        }
         let main_file = emit_main_rs(
             typed.modules.clone(),
             has_services.clone(),
             crate_name.clone(),
-            ctx.registry.clone(),
+            native_effects.clone(),
         );
         let cli_dispatch_file = if has_pipeline.clone() {
             Rc::new(vec![emit_gunbc_cli_dispatch_generated(crate_name.clone())])
@@ -7256,11 +7545,7 @@ pub fn emit_rust_selected(
         let emitted_paths = v1_rt::concat(
             v1_rt::concat(
                 v1_rt::concat(
-                    Rc::new(vec![
-                        cargo.path.clone(),
-                        lib_file.path.clone(),
-                        main_file.path.clone(),
-                    ]),
+                    Rc::new(vec![lib_file.path.clone(), main_file.path.clone()]),
                     all_mod_paths.clone(),
                 ),
                 Rc::new({
@@ -7277,7 +7562,7 @@ pub fn emit_rust_selected(
         let emitted_files = v1_rt::concat(
             v1_rt::concat(
                 v1_rt::concat(
-                    Rc::new(vec![cargo.clone(), lib_file.clone(), main_file.clone()]),
+                    Rc::new(vec![lib_file.clone(), main_file.clone()]),
                     all_mod_files.clone(),
                 ),
                 compiler_tests_file.clone(),
@@ -7288,16 +7573,145 @@ pub fn emit_rust_selected(
             emitted_files.clone(),
             Rc::new(vec![population_manifest.clone()]),
         );
+        let module_files_with_tests =
+            v1_rt::concat(all_mod_files.clone(), compiler_tests_file.clone());
+        let module_basenames = module_files_with_tests.iter().cloned().fold(
+            v1_rt::rc_empty_map::<String, bool>(),
+            |acc: Rc<HashMap<String, bool>>, f: Rc<TextFile>| {
+                v1_rt::rc_map_insert(acc, rust_emitted_module_basename(f.path.clone()), true)
+            },
+        );
+        let inline_edges = Rc::new({
+            let mut __result = Vec::new();
+            for f in module_files_with_tests.iter().cloned() {
+                __result.extend(
+                    (*emitted_inline_path_edges(f.clone(), module_basenames.clone()))
+                        .iter()
+                        .cloned(),
+                );
+            }
+            __result
+        });
         Rc::new(EmitResult {
             files: files.clone(),
             diagnostics: module_refusals.clone(),
-            emitted_edges: Rc::new({
+            emitted_edges: v1_rt::concat(
+                Rc::new({
+                    let mut __result = Vec::new();
+                    for e in published_module_emissions.iter().cloned() {
+                        __result.extend((*e.emitted_edges.clone()).iter().cloned());
+                    }
+                    __result
+                }),
+                inline_edges.clone(),
+            ),
+            rust_crates: Rc::new(vec![rust_crate.clone()]),
+        })
+    }
+}
+
+pub fn rust_emitted_module_basename(path: String) -> String {
+    v1_rt::replace(
+        v1_rt::replace(path.clone(), rust_source_root(), "".to_string()),
+        rust_source_ext(),
+        "".to_string(),
+    )
+}
+
+pub fn rust_line_is_use_declaration(line: String) -> bool {
+    ((v1_rt::starts_with(line.clone(), "use ".to_string())
+        || v1_rt::starts_with(line.clone(), "pub use ".to_string()))
+        || v1_rt::starts_with(line.clone(), "pub(crate) use ".to_string()))
+}
+
+pub fn emitted_inline_path_edges(
+    file: Rc<TextFile>,
+    module_basenames: Rc<HashMap<String, bool>>,
+) -> Rc<Vec<Rc<EmittedEdge>>> {
+    {
+        let from = rust_emitted_module_basename(file.path.clone());
+        let code = rust_code_outside_string_literals(
+            Rc::new({
                 let mut __result = Vec::new();
-                for e in published_module_emissions.iter().cloned() {
-                    __result.extend((*e.emitted_edges.clone()).iter().cloned());
+                for line in Rc::new(
+                    file.content
+                        .clone()
+                        .split(&"\n".to_string())
+                        .map(|s| s.to_string())
+                        .collect::<Vec<_>>(),
+                )
+                .iter()
+                .cloned()
+                {
+                    if {
+                        let t = crate::std_algebra::trim(line.clone());
+                        (!v1_rt::starts_with(t.clone(), "//".to_string())
+                            && !rust_line_is_use_declaration(t.clone()))
+                    } {
+                        __result.push(line);
+                    }
                 }
                 __result
-            }),
+            })
+            .join(&"\n".to_string()),
+        );
+        let targets = Rc::new({
+            let mut __result = Vec::new();
+            for t in Rc::new({
+                let mut __result = Vec::new();
+                for t in rust_identifier_tokens(v1_rt::replace(
+                    code.clone(),
+                    "crate::".to_string(),
+                    " @crate@".to_string(),
+                ))
+                .iter()
+                .cloned()
+                {
+                    if v1_rt::starts_with(t.clone(), "@crate@".to_string()) {
+                        __result.push(t);
+                    }
+                }
+                __result
+            })
+            .iter()
+            .cloned()
+            {
+                __result.push(v1_rt::replace(
+                    t.clone(),
+                    "@crate@".to_string(),
+                    "".to_string(),
+                ));
+            }
+            __result
+        });
+        Rc::new({
+            let mut __result = Vec::new();
+            for t in Rc::new({
+                let mut __result = Vec::new();
+                for t in crate::v1_compiler_emit_core_support::unique_strings(targets.clone())
+                    .iter()
+                    .cloned()
+                {
+                    if ((t.clone() != from.clone())
+                        && crate::v1_compiler_infer_types::emit_map_has(
+                            module_basenames.clone(),
+                            t.clone(),
+                        ))
+                    {
+                        __result.push(t);
+                    }
+                }
+                __result
+            })
+            .iter()
+            .cloned()
+            {
+                __result.push(crate::gunbc_rust_emitted_edge::inline_path_reference_edge(
+                    from.clone(),
+                    t.clone(),
+                ));
+            }
+            __result
         })
     }
 }
@@ -7966,7 +8380,7 @@ pub fn emit_inferred_type_leaf_name(
 pub fn anonymous_record_lit_surface_name(
     n: Rc<Node>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> String {
     {
         let lit_field_names = Rc::new({
@@ -8016,7 +8430,10 @@ pub fn anonymous_record_lit_surface_name(
                     let rt_name =
                         crate::v1_std_core::authored_name_at(source_indices.clone(), rt.clone());
                     if ((rt.ident_span.clone() != std::option::Option::None)
-                        && v1_rt::map_contains_key(&type_summaries, rt_name.clone()))
+                        && (crate::v1_compiler_infer_emit_info::type_summary_decided(
+                            type_summaries.clone(),
+                            rt_name.clone(),
+                        ) != std::option::Option::None))
                     {
                         rt_name.clone()
                     } else {
@@ -8031,7 +8448,7 @@ pub fn anonymous_record_lit_surface_name(
 pub fn record_lit_variant_payload_struct_surfaces(
     n: Rc<Node>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     variant_to_enum: Rc<HashMap<String, String>>,
 ) -> Rc<Vec<String>> {
     {
@@ -8053,8 +8470,8 @@ pub fn record_lit_variant_payload_struct_surfaces(
                 if (enum_name.clone() == "".to_string()) {
                     Rc::new(vec![])
                 } else {
-                    match v1_rt::map_get(
-                        &type_summaries,
+                    match crate::v1_compiler_infer_emit_info::type_summary_decided(
+                        type_summaries.clone(),
                         crate::v1_compiler_infer_emit_info::variant_summary_key(
                             enum_name.clone(),
                             variant_name.clone(),
@@ -8066,17 +8483,13 @@ pub fn record_lit_variant_payload_struct_surfaces(
                                 .iter()
                                 .cloned()
                             {
-                                if ((ft.clone() != "".to_string())
-                                    && match v1_rt::map_get(&type_summaries, ft.clone()) {
-                                        Some(fts) => match (*fts.repr.clone()).clone() {
-                                            TypeRepr::StructRepr => true,
-                                            _ => false,
-                                        },
-                                        std::option::Option::None => false,
-                                    })
-                                {
-                                    __result.push(ft);
-                                }
+                                if ((ft.clone() != "".to_string()) && match crate::v1_compiler_infer_emit_info::type_summary_decided(type_summaries.clone(), ft.clone()) {
+    Some(fts) => match (*fts.repr.clone()).clone() {
+    TypeRepr::StructRepr => true,
+    _ => false,
+},
+    std::option::Option::None => false,
+}) { __result.push(ft); }
                             }
                             __result
                         }),
@@ -8115,7 +8528,7 @@ pub fn record_lit_field_type_hints(
 pub fn record_lit_resolved_ctor_import_names(
     type_name: String,
     n: Rc<Node>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
 ) -> Rc<Vec<String>> {
     {
@@ -8184,7 +8597,7 @@ pub fn record_lit_resolved_ctor_import_names(
 pub fn record_lit_ref_names(
     n: Rc<Node>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     variant_to_enum: Rc<HashMap<String, String>>,
 ) -> Rc<Vec<String>> {
     match (*n.expr_data.clone()).clone() {
@@ -8269,7 +8682,7 @@ pub fn record_lit_ref_names(
 pub fn collect_anonymous_record_lit_heads(
     n: Rc<Node>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> Rc<Vec<String>> {
     stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, || {
         let self_head = match (*n.expr_data.clone()).clone() {
@@ -8281,7 +8694,10 @@ pub fn collect_anonymous_record_lit_heads(
                         let inferred =
                             emit_inferred_type_leaf_name(n.clone(), source_indices.clone());
                         if ((inferred.clone() != "".to_string())
-                            && v1_rt::map_contains_key(&type_summaries, inferred.clone()))
+                            && (crate::v1_compiler_infer_emit_info::type_summary_decided(
+                                type_summaries.clone(),
+                                inferred.clone(),
+                            ) != std::option::Option::None))
                         {
                             Rc::new(vec![inferred.clone()])
                         } else {
@@ -8415,19 +8831,19 @@ pub fn collect_items_field_import_surface_names(
             let mut __result = Vec::new();
             for type_name in surface_names.iter().cloned() {
                 __result.extend((*{
-            let summary_lookup = match v1_rt::map_get(&type_summaries, type_name.clone()) {
+            let summary_lookup = match crate::v1_compiler_infer_emit_info::type_summary_decided(type_summaries.clone(), type_name.clone()) {
     Some(summary) => Some(summary.clone()),
     std::option::Option::None => match v1_rt::map_get(&variant_to_enum, type_name.clone()) {
     Some(enum_name) => if (enum_name.clone() == "".to_string()) {
                 std::option::Option::None
             } else {
-                v1_rt::map_get(&type_summaries, crate::v1_compiler_infer_emit_info::variant_summary_key(enum_name.clone(), type_name.clone()))
+                crate::v1_compiler_infer_emit_info::type_summary_decided(type_summaries.clone(), crate::v1_compiler_infer_emit_info::variant_summary_key(enum_name.clone(), type_name.clone()))
             },
     std::option::Option::None => std::option::Option::None,
 },
 };
 match summary_lookup.clone() {
-    Some(summary) => Rc::new({ let mut __result = Vec::new(); for field_type in summary.field_import_surface_names.clone().iter().cloned() { if ((field_type.clone() != "".to_string()) && match v1_rt::map_get(&type_summaries, field_type.clone()) {
+    Some(summary) => Rc::new({ let mut __result = Vec::new(); for field_type in summary.field_import_surface_names.clone().iter().cloned() { if ((field_type.clone() != "".to_string()) && match crate::v1_compiler_infer_emit_info::type_summary_decided(type_summaries.clone(), field_type.clone()) {
     Some(ft) => match (*ft.repr.clone()).clone() {
     TypeRepr::StructRepr => true,
     _ => false,
@@ -8445,7 +8861,7 @@ match summary_lookup.clone() {
 
 pub fn collect_pattern_ref_names(
     pattern: Rc<MatchPattern>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> Rc<Vec<String>> {
     stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, || {
         match (*pattern.clone()).clone() {
@@ -8496,7 +8912,7 @@ pub fn collect_pattern_ref_names(
 pub fn collect_value_ref_names(
     n: Rc<Node>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     variant_to_enum: Rc<HashMap<String, String>>,
 ) -> Rc<Vec<String>> {
     stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, || {
@@ -8759,7 +9175,7 @@ pub fn emit_scrutinee_type_name(
 pub fn collect_pattern_rc_prelude_parent_enums(
     pattern: Rc<MatchPattern>,
     scrut_type: String,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> Rc<Vec<String>> {
     match (*pattern.clone()).clone() {
         MatchPattern::VariantPattern {
@@ -9018,7 +9434,7 @@ pub fn collect_record_lit_field_struct_surfaces(
     parent: Rc<Node>,
     field_init: Rc<Node>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     variant_to_enum: Rc<HashMap<String, String>>,
 ) -> Rc<Vec<String>> {
     {
@@ -9039,30 +9455,23 @@ pub fn collect_record_lit_field_struct_surfaces(
                         if (summary_key.clone() == "".to_string()) {
                             Rc::new(vec![])
                         } else {
-                            match v1_rt::map_get(&type_summaries, summary_key.clone()) {
-                                Some(summary) => match v1_rt::map_get(
-                                    &summary.field_type_map.clone(),
-                                    field_name.clone(),
-                                ) {
-                                    Some(ft) => {
-                                        if ((ft.clone() != "".to_string())
-                                            && match v1_rt::map_get(&type_summaries, ft.clone()) {
-                                                Some(fts) => match (*fts.repr.clone()).clone() {
-                                                    TypeRepr::StructRepr => true,
-                                                    _ => false,
-                                                },
-                                                std::option::Option::None => false,
-                                            })
-                                        {
-                                            Rc::new(vec![ft.clone()])
-                                        } else {
-                                            Rc::new(vec![])
-                                        }
-                                    }
-                                    std::option::Option::None => Rc::new(vec![]),
-                                },
-                                std::option::Option::None => Rc::new(vec![]),
-                            }
+                            match crate::v1_compiler_infer_emit_info::type_summary_decided(type_summaries.clone(), summary_key.clone()) {
+    Some(summary) => match v1_rt::map_get(&summary.field_type_map.clone(), field_name.clone()) {
+    Some(ft) => if ((ft.clone() != "".to_string()) && match crate::v1_compiler_infer_emit_info::type_summary_decided(type_summaries.clone(), ft.clone()) {
+    Some(fts) => match (*fts.repr.clone()).clone() {
+    TypeRepr::StructRepr => true,
+    _ => false,
+},
+    std::option::Option::None => false,
+}) {
+                            Rc::new(vec![ft.clone()])
+                        } else {
+                            Rc::new(vec![])
+                        },
+    std::option::Option::None => Rc::new(vec![]),
+},
+    std::option::Option::None => Rc::new(vec![]),
+}
                         }
                     }
                     _ => Rc::new(vec![]),
@@ -9113,7 +9522,9 @@ pub fn collect_value_emit_type_surface_names(
                 let from_variant = match v1_rt::map_get(&variant_to_enum, nm.clone()) {
                     Some(parent) => {
                         if (parent.clone() != "".to_string()) {
-                            Rc::new(vec![parent.clone()])
+                            Rc::new(vec![crate::v1_std_core::qualified_last_segment(
+                                parent.clone(),
+                            )])
                         } else {
                             Rc::new(vec![])
                         }
@@ -9377,55 +9788,29 @@ pub fn reference_derived_use_lines_note() -> String {
 
 pub fn expand_variant_payload_struct_imports(
     names: Rc<Vec<String>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     variant_to_enum: Rc<HashMap<String, String>>,
 ) -> Rc<Vec<String>> {
     Rc::new({
         let mut __result = Vec::new();
         for n in names.iter().cloned() {
-            __result.extend(
-                (*match v1_rt::map_get(&variant_to_enum, n.clone()) {
-                    Some(enum_name) => {
-                        if (enum_name.clone() == "".to_string()) {
-                            Rc::new(vec![])
-                        } else {
-                            match v1_rt::map_get(
-                                &type_summaries,
-                                crate::v1_compiler_infer_emit_info::variant_summary_key(
-                                    enum_name.clone(),
-                                    n.clone(),
-                                ),
-                            ) {
-                                Some(summary) => Rc::new({
-                                    let mut __result = Vec::new();
-                                    for ft in
-                                        Rc::new(v1_rt::map_values(&summary.field_type_map.clone()))
-                                            .iter()
-                                            .cloned()
-                                    {
-                                        if ((ft.clone() != "".to_string())
-                                            && match v1_rt::map_get(&type_summaries, ft.clone()) {
-                                                Some(fts) => match (*fts.repr.clone()).clone() {
-                                                    TypeRepr::StructRepr => true,
-                                                    _ => false,
-                                                },
-                                                std::option::Option::None => false,
-                                            })
-                                        {
-                                            __result.push(ft);
-                                        }
-                                    }
-                                    __result
-                                }),
-                                std::option::Option::None => Rc::new(vec![]),
-                            }
-                        }
-                    }
-                    std::option::Option::None => Rc::new(vec![]),
-                })
-                .iter()
-                .cloned(),
-            );
+            __result.extend((*match v1_rt::map_get(&variant_to_enum, n.clone()) {
+    Some(enum_name) => if (enum_name.clone() == "".to_string()) {
+        Rc::new(vec![])
+    } else {
+        match crate::v1_compiler_infer_emit_info::type_summary_decided(type_summaries.clone(), crate::v1_compiler_infer_emit_info::variant_summary_key(enum_name.clone(), n.clone())) {
+    Some(summary) => Rc::new({ let mut __result = Vec::new(); for ft in Rc::new(v1_rt::map_values(&summary.field_type_map.clone())).iter().cloned() { if ((ft.clone() != "".to_string()) && match crate::v1_compiler_infer_emit_info::type_summary_decided(type_summaries.clone(), ft.clone()) {
+    Some(fts) => match (*fts.repr.clone()).clone() {
+    TypeRepr::StructRepr => true,
+    _ => false,
+},
+    std::option::Option::None => false,
+}) { __result.push(ft); } } __result }),
+    std::option::Option::None => Rc::new(vec![]),
+}
+    },
+    std::option::Option::None => Rc::new(vec![]),
+}).iter().cloned());
         }
         __result
     })
@@ -9477,10 +9862,13 @@ pub fn reference_is_host_realized_builtin(name: String) -> bool {
 pub fn reference_derived_variant_induced_parent_spelled(
     module_source: String,
     enum_name: String,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     variant_to_enum: Rc<HashMap<String, String>>,
 ) -> bool {
-    match v1_rt::map_get(&type_summaries, enum_name.clone()) {
+    match crate::v1_compiler_infer_emit_info::type_summary_decided(
+        type_summaries.clone(),
+        enum_name.clone(),
+    ) {
         Some(summary) => match (*summary.repr.clone()).clone() {
             TypeRepr::EnumRepr { unit_only: _, .. } => {
                 let mut __found = false;
@@ -9490,7 +9878,11 @@ pub fn reference_derived_variant_induced_parent_spelled(
                 {
                     if match v1_rt::map_get(&variant_to_enum, vn.clone()) {
                         Some(parent) => {
-                            ((parent.clone() == enum_name.clone())
+                            (((parent.clone() != "".to_string())
+                                && (crate::v1_std_core::qualified_last_segment(parent.clone())
+                                    == crate::v1_std_core::qualified_last_segment(
+                                        enum_name.clone(),
+                                    )))
                                 && reference_derived_candidate_spelled_in_module(
                                     module_source.clone(),
                                     vn.clone(),
@@ -9513,7 +9905,7 @@ pub fn reference_derived_variant_induced_parent_spelled(
 pub fn reference_derived_candidate_authored(
     module_source: String,
     name: String,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     variant_to_enum: Rc<HashMap<String, String>>,
 ) -> bool {
     (reference_derived_candidate_spelled_in_module(module_source.clone(), name.clone())
@@ -9812,11 +10204,11 @@ pub fn reference_derived_candidate_disposition(
     typed_modules: Rc<Vec<Rc<TypedModule>>>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
     module_index: Rc<ModuleIndex>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     variant_to_enum: Rc<HashMap<String, String>>,
     in_type_position: bool,
 ) -> Rc<ReferenceDerivedCandidateDisposition> {
-    if (crate::v1_compiler_infer_emit_info::is_known_variant(type_summaries.clone(), name.clone())
+    if (crate::v1_compiler_infer_emit_info::is_known_variant(variant_to_enum.clone(), name.clone())
         && !in_type_position.clone())
     {
         match v1_rt::map_get(&variant_to_enum, name.clone()) {
@@ -9826,7 +10218,7 @@ pub fn reference_derived_candidate_disposition(
                 } else {
                     Rc::new(
                         ReferenceDerivedCandidateDisposition::CandidateVariantDelegatedToParent {
-                            parent_enum: parent.clone(),
+                            parent_enum: crate::v1_std_core::qualified_last_segment(parent.clone()),
                         },
                     )
                 }
@@ -10126,20 +10518,12 @@ pub fn reference_derived_use_line_plan(
     emitted_source: String,
 ) -> Rc<ReferenceDerivedUseLinePlan> {
     {
-        let module_source = match Rc::new({
-            let mut __result = Vec::new();
-            for tm in typed_modules.iter().cloned() {
-                if (crate::v1_std_core::authored_name_at(source_indices.clone(), tm.module.clone())
-                    == this_module_name.clone())
-                {
-                    __result.push(tm);
-                }
-            }
-            __result
-        })
-        .first()
-        .cloned()
-        {
+        let module_source = match typed_module_by_name(
+            this_module_name.clone(),
+            typed_modules.clone(),
+            source_indices.clone(),
+            module_index.clone(),
+        ) {
             Some(tm) => module_authored_source_text(tm.module.clone(), source_indices.clone()),
             std::option::Option::None => "".to_string(),
         };
@@ -10471,7 +10855,7 @@ let plan_module_env = match v1_rt::map_get(&module_index.by_name.clone(), this_m
 };
 let block_lines = emit_specific_import_use_lines(provider.clone(), crate::gunbc_rust_emitted_edge::module_to_filename(provider.clone()), names.clone(), applied_type_argument_names.clone(), emit_info.clone(), registry.clone(), local_type_names.clone(), export_sets.clone(), typed_modules.clone(), source_indices.clone(), module_index.clone(), plan_module_env.clone());
 let emitted_here = Rc::new({ let mut __result = Vec::new(); for l in block_lines.iter().cloned() { __result.extend((*imported_names_in_use_line(l.text.clone())).iter().cloned()); } __result });
-let fallback = Rc::new({ let mut __result = Vec::new(); for nm in names.iter().cloned() { __result.extend((*if ({ let mut __found = false; for e in emitted_here.iter().cloned() { if (e.clone() == nm.clone()) { __found = true; break; } } __found } || (crate::v1_compiler_infer_emit_info::is_known_variant(emit_info.type_summaries.clone(), nm.clone()) && !crate::v1_compiler_infer_types::emit_map_has(type_position_set.clone(), nm.clone()))) {
+let fallback = Rc::new({ let mut __result = Vec::new(); for nm in names.iter().cloned() { __result.extend((*if ({ let mut __found = false; for e in emitted_here.iter().cloned() { if (e.clone() == nm.clone()) { __found = true; break; } } __found } || (crate::v1_compiler_infer_emit_info::is_known_variant(emit_info.variant_to_enum.clone(), nm.clone()) && !crate::v1_compiler_infer_types::emit_map_has(type_position_set.clone(), nm.clone()))) {
                 Rc::new(vec![])
             } else {
                 if provider_proven_exports_symbol(nm.clone(), provider.clone(), export_sets.clone(), typed_modules.clone(), source_indices.clone(), module_index.clone()) {
@@ -10534,7 +10918,7 @@ v1_rt::concat(block_lines.clone(), fallback.clone())
         let qualified_lines =
             qualified_type_reference_use_lines(qualified_rows.clone(), registry.clone());
         let this_module_filename =
-            crate::gunbc_rust_emitted_edge::module_to_filename(this_module_name.clone());
+            crate::gunbc_rust_emitted_edge::rust_module_emit_filename(this_module_name.clone());
         Rc::new(ReferenceDerivedUseLinePlan {
             lines: v1_rt::concat(
                 lines.clone(),
@@ -10589,16 +10973,10 @@ pub fn qualified_type_reference_rows(
                                     .map(|s| s.to_string())
                                     .collect::<Vec<_>>(),
                             );
-                            let qualifier = Rc::new(
-                                segments
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .take(
-                                        v1_rt::int_sub((segments.clone().len() as i64), 1) as usize
-                                    )
-                                    .collect::<Vec<_>>(),
-                            )
+                            let qualifier = Rc::new(v1_rt::list_take(
+                                &segments.clone(),
+                                v1_rt::int_sub((segments.clone().len() as i64), 1),
+                            ))
                             .join(&".".to_string());
                             if ((((qualifier.clone() == this_module_name.clone())
                                 || crate::v1_compiler_infer_types::emit_map_has(
@@ -10796,8 +11174,8 @@ pub fn qualified_type_reference_use_lines(
             .cloned()
             {
                 __result.extend(
-                    (*Rc::new(
-                        Rc::new({
+                    (*Rc::new(v1_rt::list_take(
+                        &Rc::new({
                             let mut __result = Vec::new();
                             for l in typed.iter().cloned() {
                                 if (l.text.clone() == text.clone()) {
@@ -10805,12 +11183,9 @@ pub fn qualified_type_reference_use_lines(
                                 }
                             }
                             __result
-                        })
-                        .iter()
-                        .cloned()
-                        .take(1 as usize)
-                        .collect::<Vec<_>>(),
-                    ))
+                        }),
+                        1,
+                    )))
                     .iter()
                     .cloned(),
                 );
@@ -11062,7 +11437,7 @@ pub fn emit_module_full(
             module_index.clone(),
             typed_module.items.clone(),
             Some(scope.type_env.clone()),
-            crate::gunbc_rust_emitted_edge::module_to_filename(this_module_name.clone()),
+            crate::gunbc_rust_emitted_edge::rust_module_emit_filename(this_module_name.clone()),
         );
         let imports_str = rendered_imports.text.clone();
         let dag_import_lines = if (imports_str.clone() == "".to_string()) {
@@ -11127,6 +11502,9 @@ pub fn emit_module_full(
         let this_mod_filename = crate::gunbc_rust_emitted_edge::module_to_filename(
             crate::v1_compiler_infer_env::authored_name(scope.type_env.clone(), m.clone()),
         );
+        let this_mod_endpoint = crate::gunbc_rust_emitted_edge::rust_module_emit_filename(
+            crate::v1_compiler_infer_env::authored_name(scope.type_env.clone(), m.clone()),
+        );
         let all_svc_names = Rc::new({
             let mut __result = Vec::new();
             for item in typed_module.items.clone().iter().cloned() {
@@ -11217,7 +11595,8 @@ pub fn emit_module_full(
                 for item in typed_module.items.clone().iter().cloned() {
                     if ((((crate::v1_compiler_emit_core_support::is_type_def_item(item.clone())
                         && crate::v1_compiler_infer_types::is_coproduct_type(item.clone()))
-                        && !is_grounded_coproduct_native_alias(
+                        && !declaration_is_grounded_coproduct_native_alias(
+                            scope.type_env.clone().module_path.clone(),
                             crate::v1_compiler_infer_env::authored_name(
                                 scope.type_env.clone(),
                                 item.clone(),
@@ -11335,14 +11714,44 @@ pub fn emit_module_full(
             }),
             reference_rows: reference_plan.rows.clone(),
             emitted_edges: v1_rt::concat(
-                crate::gunbc_rust_emitted_edge::rust_prelude_emitted_edges(
-                    this_mod_filename.clone(),
+                v1_rt::concat(
+                    v1_rt::concat(
+                        crate::gunbc_rust_emitted_edge::rust_prelude_emitted_edges(
+                            this_mod_endpoint.clone(),
+                        ),
+                        declared_import_edges(
+                            this_mod_endpoint.clone(),
+                            crate::v1_std_core::module_imports(m.clone()),
+                            scope.type_env.clone().source_indices.clone(),
+                            module_index.clone(),
+                        ),
+                    ),
+                    if {
+                        let mut __found = false;
+                        for item in typed_module.items.clone().iter().cloned() {
+                            if (item.module_item_kind.clone()
+                                == ParsedModuleItemKind::ModuleItemService)
+                            {
+                                __found = true;
+                                break;
+                            }
+                        }
+                        __found
+                    } {
+                        Rc::new(vec![
+                            crate::gunbc_rust_emitted_edge::service_runtime_surface_edge(
+                                this_mod_endpoint.clone(),
+                            ),
+                        ])
+                    } else {
+                        Rc::new(vec![])
+                    },
                 ),
                 rust_use_line_edges_surviving(
                     v1_rt::concat(
                         v1_rt::concat(rendered_imports.edges.clone(), reference_plan.edges.clone()),
                         rust_use_line_edges(
-                            this_mod_filename.clone(),
+                            this_mod_endpoint.clone(),
                             uncovered_svc_use_lines.clone(),
                         ),
                     ),
@@ -11419,9 +11828,10 @@ pub fn is_import_graph_type_name(
     typed_modules: Rc<Vec<Rc<TypedModule>>>,
     registry: Rc<HashMap<String, Rc<ItemInfo>>>,
     export_sets: Rc<HashMap<String, Rc<HashMap<String, bool>>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
     module_index: Rc<ModuleIndex>,
+    variant_to_enum: Rc<HashMap<String, String>>,
 ) -> bool {
     if has_physical_type_def_in_module_filename(
         name.clone(),
@@ -11453,14 +11863,20 @@ pub fn is_import_graph_type_name(
         } {
             true
         } else {
-            if crate::v1_compiler_infer_emit_info::is_enum_in_summaries(
+            if match (*crate::v1_compiler_infer_emit_info::is_enum_in_summaries(
                 type_summaries.clone(),
                 name.clone(),
-            ) {
+            ))
+            .clone()
+            {
+                TypeSummaryQuestion::QuestionDecided { value: v, .. } => v.clone(),
+                TypeSummaryQuestion::QuestionNameAmbiguous { leaf: _, .. } => false,
+                TypeSummaryQuestion::QuestionNotDeclared => false,
+            } {
                 false
             } else {
                 if crate::v1_compiler_infer_emit_info::is_known_variant(
-                    type_summaries.clone(),
+                    variant_to_enum.clone(),
                     name.clone(),
                 ) {
                     false
@@ -12098,11 +12514,12 @@ continue;
 pub fn import_module_enum_scope(
     import_module: String,
     registry: Rc<HashMap<String, Rc<ItemInfo>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     export_sets: Rc<HashMap<String, Rc<HashMap<String, bool>>>>,
     typed_modules: Rc<Vec<Rc<TypedModule>>>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
     module_index: Rc<ModuleIndex>,
+    variant_to_enum: Rc<HashMap<String, String>>,
 ) -> Rc<Vec<String>> {
     {
         let physical = enum_names_in_module(
@@ -12112,56 +12529,20 @@ pub fn import_module_enum_scope(
             module_index.clone(),
         );
         let reexport_parents = match v1_rt::map_get(&export_sets, import_module.clone()) {
-            Some(exported) => Rc::new({
-                let mut __result = Vec::new();
-                for p in Rc::new({
+            Some(exported) => {
+                Rc::new({
                     let mut __result = Vec::new();
-                    for n in Rc::new({
-                        let mut __result = Vec::new();
-                        for n in Rc::new(v1_rt::sorted_map_keys(&exported)).iter().cloned() {
-                            if (crate::v1_compiler_infer_emit_info::is_known_variant(
-                                type_summaries.clone(),
-                                n.clone(),
-                            ) && (crate::v1_compiler_infer_emit_info::is_enum_in_summaries(
-                                type_summaries.clone(),
-                                n.clone(),
-                            ) == false))
-                            {
-                                __result.push(n);
-                            }
-                        }
-                        __result
-                    })
-                    .iter()
-                    .cloned()
-                    {
-                        __result.push(
-                            match reexport_variant_parent_in_import_module(
-                                n.clone(),
-                                import_module.clone(),
-                                registry.clone(),
-                                type_summaries.clone(),
-                                typed_modules.clone(),
-                                export_sets.clone(),
-                                source_indices.clone(),
-                                module_index.clone(),
-                            ) {
-                                Some(parent) => parent.clone(),
-                                std::option::Option::None => "".to_string(),
-                            },
-                        );
-                    }
+                    for p in Rc::new({ let mut __result = Vec::new(); for n in Rc::new({ let mut __result = Vec::new(); for n in Rc::new(v1_rt::sorted_map_keys(&exported)).iter().cloned() { if (crate::v1_compiler_infer_emit_info::is_known_variant(variant_to_enum.clone(), n.clone()) && match (*crate::v1_compiler_infer_emit_info::is_enum_in_summaries(type_summaries.clone(), n.clone())).clone() {
+    TypeSummaryQuestion::QuestionDecided { value: v, .. } => (v.clone() == false),
+    TypeSummaryQuestion::QuestionNotDeclared => true,
+    TypeSummaryQuestion::QuestionNameAmbiguous { leaf: _, .. } => false,
+}) { __result.push(n); } } __result }).iter().cloned() { __result.push(match reexport_variant_parent_in_import_module(n.clone(), import_module.clone(), registry.clone(), type_summaries.clone(), typed_modules.clone(), export_sets.clone(), source_indices.clone(), module_index.clone()) {
+    Some(parent) => parent.clone(),
+    std::option::Option::None => "".to_string(),
+}); } __result }).iter().cloned() { if (p.clone() != "".to_string()) { __result.push(p); } }
                     __result
                 })
-                .iter()
-                .cloned()
-                {
-                    if (p.clone() != "".to_string()) {
-                        __result.push(p);
-                    }
-                }
-                __result
-            }),
+            }
             std::option::Option::None => Rc::new(vec![]),
         };
         crate::v1_compiler_emit_core_support::unique_strings(v1_rt::concat(
@@ -12645,7 +13026,7 @@ pub fn reexport_variant_parent_in_import_module(
     mut __tco_loop_variant_name: String,
     mut __tco_loop_import_module: String,
     mut __tco_loop_registry: Rc<HashMap<String, Rc<ItemInfo>>>,
-    mut __tco_loop_type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    mut __tco_loop_type_summaries: Rc<TypeSummaryIndex>,
     mut __tco_loop_typed_modules: Rc<Vec<Rc<TypedModule>>>,
     mut __tco_loop_export_sets: Rc<HashMap<String, Rc<HashMap<String, bool>>>>,
     mut __tco_loop_source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
@@ -13534,13 +13915,14 @@ pub fn import_variant_parent_for_name(
     n: String,
     import_module: String,
     registry: Rc<HashMap<String, Rc<ItemInfo>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     typed_modules: Rc<Vec<Rc<TypedModule>>>,
     export_sets: Rc<HashMap<String, Rc<HashMap<String, bool>>>>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
     module_index: Rc<ModuleIndex>,
     imported_enums: Rc<Vec<String>>,
     import_module_enums: Rc<Vec<String>>,
+    variant_to_enum: Rc<HashMap<String, String>>,
 ) -> String {
     if is_import_graph_type_name(
         n.clone(),
@@ -13551,6 +13933,7 @@ pub fn import_variant_parent_for_name(
         type_summaries.clone(),
         source_indices.clone(),
         module_index.clone(),
+        variant_to_enum.clone(),
     ) {
         "".to_string()
     } else {
@@ -13760,6 +14143,72 @@ pub fn authored_import_binds_provider_declaration(
     }
 }
 
+pub fn declared_import_edges(
+    from: String,
+    imports: Rc<Vec<Rc<Node>>>,
+    source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+    module_index: Rc<ModuleIndex>,
+) -> Rc<Vec<Rc<EmittedEdge>>> {
+    Rc::new({
+        let mut __result = Vec::new();
+        for target in Rc::new({
+            let mut __result = Vec::new();
+            for target in Rc::new({
+                let mut __result = Vec::new();
+                for name in Rc::new({
+                    let mut __result = Vec::new();
+                    for name in crate::v1_compiler_emit_core_support::unique_strings(Rc::new({
+                        let mut __result = Vec::new();
+                        for imp in imports.iter().cloned() {
+                            __result.push(crate::v1_std_core::authored_name_at(
+                                source_indices.clone(),
+                                imp.clone(),
+                            ));
+                        }
+                        __result
+                    }))
+                    .iter()
+                    .cloned()
+                    {
+                        if match v1_rt::map_get(&module_index.by_name.clone(), name.clone()) {
+                            Some(_) => true,
+                            std::option::Option::None => false,
+                        } {
+                            __result.push(name);
+                        }
+                    }
+                    __result
+                })
+                .iter()
+                .cloned()
+                {
+                    __result.push(crate::gunbc_rust_emitted_edge::rust_module_emit_filename(
+                        name.clone(),
+                    ));
+                }
+                __result
+            })
+            .iter()
+            .cloned()
+            {
+                if (target.clone() != from.clone()) {
+                    __result.push(target);
+                }
+            }
+            __result
+        })
+        .iter()
+        .cloned()
+        {
+            __result.push(crate::gunbc_rust_emitted_edge::declared_import_edge(
+                from.clone(),
+                target.clone(),
+            ));
+        }
+        __result
+    })
+}
+
 pub fn rust_use_line_edges_surviving(
     edges: Rc<Vec<Rc<EmittedEdge>>>,
     final_lines: Rc<Vec<String>>,
@@ -14004,6 +14453,7 @@ pub fn emit_specific_import_use_lines(
                     typed_modules.clone(),
                     source_indices.clone(),
                     module_index.clone(),
+                    emit_info.variant_to_enum.clone(),
                 );
                 let top_level = Rc::new({
                     let mut __result = Vec::new();
@@ -14017,11 +14467,12 @@ pub fn emit_specific_import_use_lines(
                             type_summaries.clone(),
                             source_indices.clone(),
                             module_index.clone(),
+                            emit_info.variant_to_enum.clone(),
                         ) {
                             true
                         } else {
                             if crate::v1_compiler_infer_emit_info::is_known_variant(
-                                type_summaries.clone(),
+                                emit_info.variant_to_enum.clone(),
                                 n.clone(),
                             ) {
                                 {
@@ -14093,6 +14544,7 @@ pub fn emit_specific_import_use_lines(
                                 module_index.clone(),
                                 imported_enums.clone(),
                                 import_module_enums.clone(),
+                                emit_info.variant_to_enum.clone(),
                             ));
                         }
                         __result
@@ -14122,12 +14574,13 @@ pub fn emit_specific_import_use_lines(
                             module_index.clone(),
                             imported_enums.clone(),
                             import_module_enums.clone(),
+                            emit_info.variant_to_enum.clone(),
                         ) != "".to_string())
                         {
                             false
                         } else {
                             if (crate::v1_compiler_infer_emit_info::is_known_variant(
-                                type_summaries.clone(),
+                                emit_info.variant_to_enum.clone(),
                                 n.clone(),
                             ) && (authored_import_binds_provider_declaration(
                                 n.clone(),
@@ -14275,6 +14728,7 @@ pub fn emit_specific_import_use_lines(
                             type_summaries.clone(),
                             source_indices.clone(),
                             module_index.clone(),
+                            emit_info.variant_to_enum.clone(),
                         ) {
                             __result.push(n);
                         }
@@ -14293,6 +14747,7 @@ pub fn emit_specific_import_use_lines(
                             type_summaries.clone(),
                             source_indices.clone(),
                             module_index.clone(),
+                            emit_info.variant_to_enum.clone(),
                         ) == false)
                         {
                             __result.push(n);
@@ -14527,14 +14982,14 @@ Rc::new(vec![Rc::new(RustUseLine {
                 let variant_lines = Rc::new({
                     let mut __result = Vec::new();
                     for parent in parent_list.iter().cloned() {
-                        __result.extend((*if (is_grounded_coproduct_native_alias(parent.clone()) || rust_declaration_realizes_as_native_alias(import_module.clone(), parent.clone())) {
+                        __result.extend((*if ((declaration_is_grounded_coproduct_native_alias(import_module.clone(), parent.clone()) || every_declarer_is_grounded_coproduct_native_alias(emit_info.type_decl_items.clone(), parent.clone())) || rust_declaration_realizes_as_native_alias(import_module.clone(), parent.clone())) {
                     Rc::new(vec![])
                 } else {
                     {
                         let variants = Rc::new({ let mut __result = Vec::new(); for n in deduped_names.iter().cloned() { if if ((n.clone() == "None".to_string()) || (n.clone() == "Some".to_string())) {
                             false
                         } else {
-                            if is_import_graph_type_name(n.clone(), import_module.clone(), typed_modules.clone(), registry.clone(), export_sets.clone(), type_summaries.clone(), source_indices.clone(), module_index.clone()) {
+                            if is_import_graph_type_name(n.clone(), import_module.clone(), typed_modules.clone(), registry.clone(), export_sets.clone(), type_summaries.clone(), source_indices.clone(), module_index.clone(), emit_info.variant_to_enum.clone()) {
                                 false
                             } else {
                                 if { let mut __found = false; for e in import_module_enums.iter().cloned() { if (e.clone() == n.clone()) { __found = true; break; } } __found } {
@@ -14600,7 +15055,10 @@ Rc::new(vec![Rc::new(RustUseLine {
                                 }
                                 __found
                             } == false)
-                                && !is_grounded_coproduct_native_alias(en.clone()))
+                                && !declaration_is_grounded_coproduct_native_alias(
+                                    import_module.clone(),
+                                    en.clone(),
+                                ))
                                 && !rust_declaration_realizes_as_native_alias(
                                     import_module.clone(),
                                     en.clone(),
@@ -14667,10 +15125,8 @@ pub fn rust_use_after_crate(line: String) -> String {
                     .map(|s| s.to_string())
                     .collect::<Vec<_>>(),
             )
-            .iter()
+            .get((1) as usize)
             .cloned()
-            .skip(1 as usize)
-            .next()
             {
                 Some(rest) => rest.clone(),
                 std::option::Option::None => "".to_string(),
@@ -14815,10 +15271,8 @@ pub fn rust_pub_use_braced_names(line: String) -> Rc<Vec<String>> {
                 .map(|s| s.to_string())
                 .collect::<Vec<_>>(),
         )
-        .iter()
+        .get((1) as usize)
         .cloned()
-        .skip(1 as usize)
-        .next()
         {
             Some(rest) => match Rc::new(
                 rest.clone()
@@ -15014,10 +15468,8 @@ pub fn rust_use_bound_symbol(entry: String) -> String {
             .map(|s| s.to_string())
             .collect::<Vec<_>>(),
     )
-    .iter()
+    .get((1) as usize)
     .cloned()
-    .skip(1 as usize)
-    .next()
     {
         Some(bound_name) => bound_name.clone(),
         std::option::Option::None => entry.clone(),
@@ -15395,7 +15847,7 @@ pub fn data_field_struct_import_provider_note() -> String {
 
 pub fn module_data_field_struct_import_names(
     items: Rc<Vec<Rc<Node>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     import_module: String,
     export_sets: Rc<HashMap<String, Rc<HashMap<String, bool>>>>,
     typed_modules: Rc<Vec<Rc<TypedModule>>>,
@@ -15416,54 +15868,26 @@ pub fn module_data_field_struct_import_names(
         .iter()
         .cloned()
         {
-            __result.extend(
-                (*{
-                    let type_name = match item.type_annotation.clone() {
-                        Some(ta) => {
-                            crate::v1_std_core::authored_name_at(source_indices.clone(), ta.clone())
-                        }
-                        std::option::Option::None => "".to_string(),
-                    };
-                    if (type_name.clone() == "".to_string()) {
-                        Rc::new(vec![])
-                    } else {
-                        match v1_rt::map_get(&type_summaries, type_name.clone()) {
-                            Some(summary) => Rc::new({
-                                let mut __result = Vec::new();
-                                for field_type in
-                                    summary.field_import_surface_names.clone().iter().cloned()
-                                {
-                                    if (((field_type.clone() != "".to_string())
-                                        && name_in_transitive_export_surface(
-                                            field_type.clone(),
-                                            import_module.clone(),
-                                            Rc::new(vec![]),
-                                            export_sets.clone(),
-                                            typed_modules.clone(),
-                                            source_indices.clone(),
-                                            module_index.clone(),
-                                        ))
-                                        && match v1_rt::map_get(&type_summaries, field_type.clone())
-                                        {
-                                            Some(ft) => match (*ft.repr.clone()).clone() {
-                                                TypeRepr::StructRepr => true,
-                                                _ => false,
-                                            },
-                                            std::option::Option::None => false,
-                                        })
-                                    {
-                                        __result.push(field_type);
-                                    }
-                                }
-                                __result
-                            }),
-                            std::option::Option::None => Rc::new(vec![]),
-                        }
-                    }
-                })
-                .iter()
-                .cloned(),
-            );
+            __result.extend((*{
+        let type_name = match item.type_annotation.clone() {
+    Some(ta) => crate::v1_std_core::authored_name_at(source_indices.clone(), ta.clone()),
+    std::option::Option::None => "".to_string(),
+};
+if (type_name.clone() == "".to_string()) {
+            Rc::new(vec![])
+        } else {
+            match crate::v1_compiler_infer_emit_info::type_summary_decided(type_summaries.clone(), type_name.clone()) {
+    Some(summary) => Rc::new({ let mut __result = Vec::new(); for field_type in summary.field_import_surface_names.clone().iter().cloned() { if (((field_type.clone() != "".to_string()) && name_in_transitive_export_surface(field_type.clone(), import_module.clone(), Rc::new(vec![]), export_sets.clone(), typed_modules.clone(), source_indices.clone(), module_index.clone())) && match crate::v1_compiler_infer_emit_info::type_summary_decided(type_summaries.clone(), field_type.clone()) {
+    Some(ft) => match (*ft.repr.clone()).clone() {
+    TypeRepr::StructRepr => true,
+    _ => false,
+},
+    std::option::Option::None => false,
+}) { __result.push(field_type); } } __result }),
+    std::option::Option::None => Rc::new(vec![]),
+}
+        }
+}).iter().cloned());
         }
         __result
     }))
@@ -16429,7 +16853,7 @@ pub fn emit_type_def_from_connective(
                 }
             }
         } else {
-            if is_host_optional_carrier_alias(item_text.clone()) {
+            if declaration_owns_host_option(env.module_path.clone(), item_text.clone()) {
                 {
                     let type_params =
                         emit_type_params(item.params.clone(), env.source_indices.clone());
@@ -16731,7 +17155,10 @@ pub fn rust_phantom_field_name() -> String {
 }
 
 pub fn type_has_fn_fields(name: String, emit_info: Rc<EmitGraphInfo>) -> bool {
-    match v1_rt::map_get(&emit_info.type_summaries.clone(), name.clone()) {
+    match crate::v1_compiler_infer_emit_info::type_summary_decided(
+        emit_info.type_summaries.clone(),
+        name.clone(),
+    ) {
         Some(ts) => ts.has_fn_fields.clone(),
         std::option::Option::None => false,
     }
@@ -18575,34 +19002,67 @@ pub fn v1_fn_body_derived_clone_param_names(
                 emit_info.type_decl_items.clone(),
                 si.clone(),
             );
-        let rc_match_clone_param_names = match (*body.expr_data.clone()).clone() {
+        let rc_match_clone_param_names = v1_fn_body_rc_match_clone_bound_param_names(
+            body.clone(),
+            generic_param_names.clone(),
+            shared_types.clone(),
+            emit_info.clone(),
+            si.clone(),
+        );
+        crate::v1_compiler_trait_bound_witness::v1_union_bound_param_names(
+            derived_clone_param_names.clone(),
+            rc_match_clone_param_names.clone(),
+        )
+    }
+}
+
+pub fn v1_fn_body_rc_match_clone_bound_param_names(
+    body: Rc<Node>,
+    generic_param_names: Rc<Vec<String>>,
+    shared_types: Rc<BTreeSet<String>>,
+    emit_info: Rc<EmitGraphInfo>,
+    source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+) -> Rc<Vec<String>> {
+    stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, || {
+        let here = match (*body.expr_data.clone()).clone() {
             ExprData::ExprMatch => {
                 let scrutinee = crate::v1_std_core::match_scrutinee(body.clone());
                 match scrutinee.inferred.clone().as_deref().cloned() {
                     Some(InferredNode::Resolved { node: rt, .. }) => {
-                        let scrut_type =
-                            crate::v1_std_core::authored_name_at(si.clone(), rt.clone());
-                        let arms = crate::v1_std_core::match_arm_nodes(body.clone());
                         let rc_match = analyze_rc_match(
                             scrutinee.clone(),
-                            arms.clone(),
-                            scrut_type.clone(),
+                            crate::v1_std_core::match_arm_nodes(body.clone()),
+                            crate::v1_std_core::authored_name_at(
+                                source_indices.clone(),
+                                rt.clone(),
+                            ),
                             shared_types.clone(),
                             emit_info.clone(),
-                            si.clone(),
+                            source_indices.clone(),
                         );
-                        crate::v1_compiler_trait_bound_witness::v1_rc_match_scrutinee_clone_bound_param_names(generic_param_names.clone(), Rc::new({ let mut __result = Vec::new(); for c in rt.children.clone().iter().cloned() { __result.push(crate::v1_std_core::authored_name_at(si.clone(), c.clone())); } __result }), rc_match.needs_deref.clone())
+                        crate::v1_compiler_trait_bound_witness::v1_rc_match_scrutinee_clone_bound_param_names(generic_param_names.clone(), Rc::new({ let mut __result = Vec::new(); for c in rt.children.clone().iter().cloned() { __result.push(crate::v1_std_core::authored_name_at(source_indices.clone(), c.clone())); } __result }), rc_match.needs_deref.clone())
                     }
                     _ => Rc::new(vec![]),
                 }
             }
             _ => Rc::new(vec![]),
         };
-        crate::v1_compiler_trait_bound_witness::v1_union_bound_param_names(
-            derived_clone_param_names.clone(),
-            rc_match_clone_param_names.clone(),
+        body.children.clone().iter().cloned().fold(
+            here.clone(),
+            |acc: Rc<Vec<String>>, child: Rc<Node>| {
+                crate::v1_compiler_trait_bound_witness::v1_union_bound_param_names(
+                    acc,
+                    v1_fn_body_rc_match_clone_bound_param_names(
+                        child.clone(),
+                        generic_param_names.clone(),
+                        shared_types.clone(),
+                        emit_info.clone(),
+                        source_indices.clone(),
+                    ),
+                )
+            },
         )
-    }
+    })
 }
 
 pub fn v1_fn_bounds_by_param(
@@ -19013,20 +19473,8 @@ pub fn v1_record_decl_slot_arg_name(
                         );
                     } else {
                         {
-                            let __tco_0 = Rc::new(
-                                decl_params
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            );
-                            let __tco_1 = Rc::new(
-                                type_args
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            );
+                            let __tco_0 = Rc::new(v1_rt::list_skip(&decl_params, 1));
+                            let __tco_1 = Rc::new(v1_rt::list_skip(&type_args, 1));
                             let __tco_2 = slot_name;
                             let __tco_3 = source_indices;
                             __tco_loop_decl_params = __tco_0;
@@ -19100,22 +19548,8 @@ pub fn v1_positional_bound_forwarded_names(
                     v1_rt::concat(
                         here.clone(),
                         v1_positional_bound_forwarded_names(
-                            Rc::new(
-                                callee_names
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
-                            Rc::new(
-                                wrapper_names
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
+                            Rc::new(v1_rt::list_skip(&callee_names.clone(), 1)),
+                            Rc::new(v1_rt::list_skip(&wrapper_names.clone(), 1)),
                             callee_bound_param_names.clone(),
                             wrapper_generic_param_names.clone(),
                         ),
@@ -21548,52 +21982,67 @@ pub fn emit_pattern(
     }
 }
 
+pub fn rust_ambiguous_type_name_refusal(leaf: String) -> String {
+    v1_rt::concat(
+        v1_rt::concat(
+            "compile_error!(\"ambiguous type name '".to_string(),
+            leaf.clone(),
+        ),
+        "': declarations disagree\")".to_string(),
+    )
+}
+
 pub fn pattern_parent_enum(
     name: String,
     parent_enum: Option<String>,
     scrut_type: String,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> Option<String> {
-    {
-        let scrut_is_known_enum = ((scrut_type.clone() != "".to_string())
-            && is_enum_type_name(scrut_type.clone(), type_summaries.clone()));
-        if (parent_enum.clone() != std::option::Option::None) {
-            parent_enum.clone()
+    if (parent_enum.clone() != std::option::Option::None) {
+        parent_enum.clone()
+    } else {
+        if (scrut_type.clone() == "".to_string()) {
+            unique_variant_parent(type_summaries.clone(), name.clone())
         } else {
-            if scrut_is_known_enum.clone() {
-                Some(scrut_type.clone())
-            } else {
-                unique_variant_parent(type_summaries.clone(), name.clone())
+            match (*is_enum_type_name(scrut_type.clone(), type_summaries.clone())).clone() {
+                TypeSummaryQuestion::QuestionDecided { value: true, .. } => {
+                    Some(scrut_type.clone())
+                }
+                TypeSummaryQuestion::QuestionNameAmbiguous { leaf: leaf, .. } => {
+                    Some(rust_ambiguous_type_name_refusal(leaf.clone()))
+                }
+                _ => unique_variant_parent(type_summaries.clone(), name.clone()),
             }
         }
     }
 }
 
 pub fn unique_variant_parent(
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     variant_name: String,
 ) -> Option<String> {
     {
         let parent_matches = Rc::new({
             let mut __result = Vec::new();
-            for type_name in Rc::new(v1_rt::sorted_map_keys(&type_summaries))
-                .iter()
-                .cloned()
+            for summary in
+                crate::v1_compiler_infer_emit_info::type_summary_values(type_summaries.clone())
+                    .iter()
+                    .cloned()
             {
-                if (is_enum_type_name(type_name.clone(), type_summaries.clone())
-                    && crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
-                        type_summaries.clone(),
-                        variant_name.clone(),
-                        type_name.clone(),
-                    ))
-                {
-                    __result.push(type_name);
+                if crate::v1_compiler_infer_emit_info::summary_is_enum_with_variant(
+                    summary.clone(),
+                    variant_name.clone(),
+                ) {
+                    __result.push(summary);
                 }
             }
             __result
         });
         if ((parent_matches.clone().len() as i64) == 1) {
-            parent_matches.clone().first().cloned()
+            match parent_matches.clone().first().cloned() {
+                Some(summary) => Some(summary.name.clone()),
+                std::option::Option::None => std::option::Option::None,
+            }
         } else {
             std::option::Option::None
         }
@@ -21615,8 +22064,30 @@ pub fn is_optional_variant_name(name: String) -> bool {
 }
 
 pub fn is_optional_like_parent_name(name: String) -> bool {
-    ((name.clone() == kernel_optional_mint_name())
-        || is_host_diagnostics_carrier_alias(name.clone()))
+    if v1_rt::contains(name.clone(), ".".to_string()) {
+        {
+            let segments = Rc::new(
+                name.clone()
+                    .split(&".".to_string())
+                    .map(|s| s.to_string())
+                    .collect::<Vec<_>>(),
+            );
+            let module_path = Rc::new(v1_rt::list_take(
+                &segments.clone(),
+                v1_rt::int_sub((segments.clone().len() as i64), 1),
+            ))
+            .join(&".".to_string());
+            let decl_name = crate::v1_std_core::qualified_last_segment(name.clone());
+            (declaration_owns_host_option(module_path.clone(), decl_name.clone())
+                || crate::std_decl_ref::declaration_ref_in_list(
+                    crate::std_decl_ref::decl_ref(module_path.clone(), decl_name.clone()),
+                    rust_host_option_carrier_declarations(),
+                ))
+        }
+    } else {
+        ((name.clone() == kernel_optional_mint_name())
+            || is_host_diagnostics_carrier_alias(name.clone()))
+    }
 }
 
 pub fn is_some_like_variant_name(name: String) -> bool {
@@ -22285,13 +22756,15 @@ pub fn analyze_rc_pattern(
                             Some(enum_name) => {
                                 v1_rt::set_contains(&shared_types, enum_name.clone())
                             }
-                            std::option::Option::None => match v1_rt::map_get(
-                                &emit_info.type_summaries.clone(),
-                                bare_n.clone(),
-                            ) {
-                                Some(_) => v1_rt::set_contains(&shared_types, bare_n.clone()),
-                                std::option::Option::None => false,
-                            },
+                            std::option::Option::None => {
+                                match crate::v1_compiler_infer_emit_info::type_summary_decided(
+                                    emit_info.type_summaries.clone(),
+                                    bare_n.clone(),
+                                ) {
+                                    Some(_) => v1_rt::set_contains(&shared_types, bare_n.clone()),
+                                    std::option::Option::None => false,
+                                }
+                            }
                         };
                         let ref_bound_fields = Rc::new({
                             let mut __result = Vec::new();
@@ -23310,7 +23783,10 @@ pub fn rust_as_ref_let_is_irrefutable(
                 );
                 match resolved.clone() {
                     Some(enum_name) => {
-                        match v1_rt::map_get(&emit_info.type_summaries.clone(), enum_name.clone()) {
+                        match crate::v1_compiler_infer_emit_info::type_summary_decided(
+                            emit_info.type_summaries.clone(),
+                            enum_name.clone(),
+                        ) {
                             Some(summary) => {
                                 ((Rc::new(v1_rt::sorted_map_keys(&summary.variant_name_set.clone()))
                                     .len() as i64)
@@ -23708,7 +24184,9 @@ pub fn freemonoid_empty_from_variant_parent(leaf_name: String, enum_name: String
 pub fn freemonoid_empty_from_emit_info(leaf_name: String, emit_info: Rc<EmitGraphInfo>) -> bool {
     ((leaf_name.clone() == "Empty".to_string())
         && match v1_rt::map_get(&emit_info.variant_to_enum.clone(), "Empty".to_string()) {
-            Some(p) => (p.clone() == "FreeMonoid".to_string()),
+            Some(p) => {
+                (crate::v1_std_core::qualified_last_segment(p.clone()) == "FreeMonoid".to_string())
+            }
             std::option::Option::None => false,
         })
 }
@@ -23732,11 +24210,16 @@ pub fn effective_variant_parent_from_enum_lookup(
         let rt_name = crate::v1_std_core::authored_name_at(source_indices.clone(), rt.clone());
         if (((rt.ident_span.clone() != std::option::Option::None)
             && (rt_name.clone() != leaf_name.clone()))
-            && crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
+            && match (*crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
                 emit_info.type_summaries.clone(),
                 leaf_name.clone(),
                 rt_name.clone(),
             ))
+            .clone()
+            {
+                TypeSummaryQuestion::QuestionDecided { value: v, .. } => v.clone(),
+                _ => false,
+            })
         {
             Some(rt_name.clone())
         } else {
@@ -23788,7 +24271,7 @@ pub fn effective_variant_parent(
         let cached = match v1_rt::map_get(&emit_info.variant_to_enum.clone(), leaf_name.clone()) {
             Some(p) => {
                 if (p.clone() != "".to_string()) {
-                    Some(p.clone())
+                    Some(crate::v1_std_core::qualified_last_segment(p.clone()))
                 } else {
                     std::option::Option::None
                 }
@@ -24775,14 +25258,7 @@ pub fn rust_empty_map_value_type_str(
     shared_types: Rc<BTreeSet<String>>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
 ) -> String {
-    match map_type
-        .children
-        .clone()
-        .iter()
-        .cloned()
-        .skip(1 as usize)
-        .next()
-    {
+    match map_type.children.clone().get((1) as usize).cloned() {
         Some(value_child) => {
             let rendered = render_rust_type(
                 crate::v1_compiler_infer_types::child_type_node(value_child.clone()),
@@ -25443,11 +25919,19 @@ pub fn emit_rust_expr_record_lit(
             };
             let concrete_peel_would_erase_optional_ctor =
                 (is_optional_variant_name(variant_name.clone())
-                    && !crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
+                    && match (*crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
                         emit_info.type_summaries.clone(),
                         variant_name.clone(),
                         crate::v1_std_core::authored_name_at(si.clone(), expanded_rt.clone()),
-                    ));
+                    ))
+                    .clone()
+                    {
+                        TypeSummaryQuestion::QuestionDecided { value: v, .. } => {
+                            (v.clone() == false)
+                        }
+                        TypeSummaryQuestion::QuestionNotDeclared => true,
+                        TypeSummaryQuestion::QuestionNameAmbiguous { leaf: _, .. } => false,
+                    });
             let peeled_type_name = if ((((parent_enum.clone() == std::option::Option::None)
                 && (expanded_rt.connective.clone() == Connective::Conj))
                 && (expanded_rt.ident_span.clone() != std::option::Option::None))
@@ -26141,8 +26625,8 @@ pub fn emit_cloned_arg(
 
 pub fn is_enum_type_name(
     type_name: String,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
-) -> bool {
+    type_summaries: Rc<TypeSummaryIndex>,
+) -> Rc<TypeSummaryQuestion> {
     crate::v1_compiler_infer_emit_info::is_enum_in_summaries(
         type_summaries.clone(),
         type_name.clone(),
@@ -26160,11 +26644,16 @@ pub fn contextual_variant_parent_from_type_name(
             crate::v1_std_core::authored_name_at(source_indices.clone(), resolved_type.clone());
         if (((resolved_type.ident_span.clone() != std::option::Option::None)
             && (rt_name.clone() != variant_name.clone()))
-            && crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
+            && match (*crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
                 emit_info.type_summaries.clone(),
                 variant_name.clone(),
                 rt_name.clone(),
             ))
+            .clone()
+            {
+                TypeSummaryQuestion::QuestionDecided { value: v, .. } => v.clone(),
+                _ => false,
+            })
         {
             Some(rt_name.clone())
         } else {
@@ -26210,11 +26699,16 @@ pub fn contextual_variant_parent(
 ) -> Option<String> {
     match parent_enum.clone() {
         Some(explicit_parent) => {
-            if crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
+            if match (*crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
                 emit_info.type_summaries.clone(),
                 variant_name.clone(),
                 explicit_parent.clone(),
-            ) {
+            ))
+            .clone()
+            {
+                TypeSummaryQuestion::QuestionDecided { value: v, .. } => v.clone(),
+                _ => false,
+            } {
                 Some(explicit_parent.clone())
             } else {
                 std::option::Option::None
@@ -26274,7 +26768,7 @@ pub fn discriminant_zero_field_variant_tag(
                         let last = crate::v1_std_core::qualified_last_segment(tn.clone());
                         if ((last.clone() != "".to_string())
                             && crate::v1_compiler_infer_emit_info::is_known_variant(
-                                emit_info.type_summaries.clone(),
+                                emit_info.variant_to_enum.clone(),
                                 last.clone(),
                             ))
                         {
@@ -26542,16 +27036,18 @@ pub fn rust_call_arg_fail_closed_unwrap(
 ) -> String {
     match callee.clone() {
         Some(info) => match function_value_params(info.params.clone())
-            .iter()
+            .get((idx.clone()) as usize)
             .cloned()
-            .skip(idx.clone() as usize)
-            .next()
         {
             Some(param) => {
                 let param_type = crate::v1_std_core::param_node_type_expr(param.clone());
                 let param_required = (((param_type.return_cardinality.clone()
                     != Cardinality::CardOptional)
-                    && !is_host_optional_carrier_type(param_type.clone(), source_indices.clone()))
+                    && !is_host_optional_carrier_type(
+                        param_type.clone(),
+                        source_indices.clone(),
+                        crate::v1_compiler_infer_env::empty_type_env(),
+                    ))
                     && !rust_param_type_is_type_variable(
                         param_type.clone(),
                         source_indices.clone(),
@@ -26589,10 +27085,8 @@ pub fn rust_call_arg_function_value_adapt(
         }
         match callee.clone() {
             Some(info) => match function_value_params(info.params.clone())
-                .iter()
+                .get((idx.clone()) as usize)
                 .cloned()
-                .skip(idx.clone() as usize)
-                .next()
             {
                 Some(param) => {
                     let arity = (crate::v1_std_core::param_node_type_expr(param.clone())
@@ -26702,19 +27196,94 @@ pub fn lambda_argument_scope(arg: Rc<Node>, scope: Rc<InferScope>) -> Rc<InferSc
                 arg.clone(),
                 scope.type_env.clone().source_indices.clone(),
             ),
-            Rc::new(
-                arg.children
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .collect::<Vec<_>>(),
-            ),
+            Rc::new(v1_rt::list_skip(&arg.children.clone(), 1)),
         ),
         _ => scope.clone(),
     }
 }
 
+pub fn rust_call_target_is_v2_algebra_length(target: Rc<CallTargetIdentity>) -> bool {
+    match rust_call_target_declared_length(target.clone()) {
+        std::option::Option::None => false,
+        Some(id) => {
+            ((id.decl_name.clone() == "length".to_string())
+                && (id.owner_module_path.clone() == "v2.std.algebra".to_string()))
+        }
+    }
+}
+
+pub fn rust_call_target_declared_length(
+    target: Rc<CallTargetIdentity>,
+) -> Option<Rc<DeclaredCallableIdentity>> {
+    match (*target.clone()).clone() {
+        CallTargetIdentity::SourceDeclarationCall {
+            owner_module_path: owner,
+            decl_name: decl,
+            ..
+        } => Some(Rc::new(DeclaredCallableIdentity {
+            owner_module_path: owner.clone(),
+            decl_name: decl.clone(),
+        })),
+        CallTargetIdentity::RuntimePrimitiveCall {
+            projected_from: projected,
+            ..
+        } => projected.clone(),
+        CallTargetIdentity::LocallyBoundCall { name: _, .. } => std::option::Option::None,
+        CallTargetIdentity::CallableTargetUndetermined => std::option::Option::None,
+    }
+}
+
+pub fn rust_emit_length_on_host_string(
+    call_target: Rc<CallTargetIdentity>,
+    func: String,
+    args: Rc<Vec<Rc<Node>>>,
+    call_semantics: Option<Rc<CallSemantics>>,
+    registry: Rc<HashMap<String, Rc<ItemInfo>>>,
+    scope: Rc<InferScope>,
+    depth: i64,
+    shared_types: Rc<BTreeSet<String>>,
+    emit_info: Rc<EmitGraphInfo>,
+) -> Option<String> {
+    if (rust_call_target_is_v2_algebra_length(call_target.clone()) == false) {
+        std::option::Option::None
+    } else {
+        {
+            let length_args = crate::v1_compiler_emit::order_typed_call_args_from_semantics(
+                args.clone(),
+                func.clone(),
+                call_semantics.clone(),
+                scope.clone(),
+            );
+            match length_args.clone().first().cloned() {
+                std::option::Option::None => std::option::Option::None,
+                Some(xs_arg) => {
+                    if is_host_text_typed_expr(
+                        crate::v1_std_core::arg_value(xs_arg.clone()),
+                        scope.type_env.clone().source_indices.clone(),
+                    ) {
+                        Some(v1_rt::concat(
+                            v1_rt::concat(
+                                "v1_rt::string_length(&".to_string(),
+                                emit_typed_expr_base(
+                                    crate::v1_std_core::arg_value(xs_arg.clone()),
+                                    registry.clone(),
+                                    scope.clone(),
+                                    depth.clone(),
+                                    shared_types.clone(),
+                                    emit_info.clone(),
+                                ),
+                            ),
+                            ")".to_string(),
+                        ))
+                    } else {
+                        std::option::Option::None
+                    }
+                }
+            }
+        }
+    }
+}
+
 pub fn emit_typed_call(
     func: String,
     args: Rc<Vec<Rc<Node>>>,
@@ -26750,7 +27319,7 @@ pub fn emit_typed_call(
                     scope.clone(),
                 );
                 let get_list = get_args.clone().first().cloned();
-                let get_idx = get_args.clone().iter().cloned().skip(1 as usize).next();
+                let get_idx = get_args.clone().get((1) as usize).cloned();
                 let get_result = match get_list.clone() {
                     Some(list_arg) => match get_idx.clone() {
                         Some(idx_arg) => {
@@ -26814,10 +27383,8 @@ pub fn emit_typed_call(
                 let update_arg = crate::v1_std_core::arg_value(
                     with_args
                         .clone()
-                        .iter()
+                        .get((1) as usize)
                         .cloned()
-                        .skip(1 as usize)
-                        .next()
                         .clone()
                         .unwrap(),
                 );
@@ -26994,6 +27561,20 @@ pub fn emit_typed_call(
                 return disc_result;
             }
         }
+        match rust_emit_length_on_host_string(
+            call_target.clone(),
+            func.clone(),
+            args.clone(),
+            call_semantics.clone(),
+            registry.clone(),
+            scope.clone(),
+            depth.clone(),
+            shared_types.clone(),
+            emit_info.clone(),
+        ) {
+            Some(lowered) => return lowered.clone(),
+            std::option::Option::None => {}
+        }
         let ordered_args = crate::v1_compiler_emit::order_typed_call_args_from_semantics(
             args.clone(),
             func.clone(),
@@ -27054,10 +27635,8 @@ pub fn emit_typed_call(
                     let a = pair.1.clone();
                     let arg_emit_info = match application_plan
                         .clone()
-                        .iter()
+                        .get((idx.clone()) as usize)
                         .cloned()
-                        .skip(idx.clone() as usize)
-                        .next()
                     {
                         Some(application) => {
                             crate::v1_compiler_infer_emit_info::emit_info_with_expected_type(
@@ -27511,13 +28090,7 @@ pub fn emit_nested_rt_concat(
                     )
                 };
                 {
-                    let __tco_0 = Rc::new(
-                        remaining
-                            .iter()
-                            .cloned()
-                            .skip(1 as usize)
-                            .collect::<Vec<_>>(),
-                    );
+                    let __tco_0 = Rc::new(v1_rt::list_skip(&remaining, 1));
                     let __tco_1 = next_acc.clone();
                     let __tco_2 = shared_types;
                     __tco_loop_remaining = __tco_0;
@@ -27892,13 +28465,7 @@ pub fn lambda_scope_from_children(
     .fold(scope.clone(), |acc: Rc<InferScope>, pair: (i64, String)| {
         let idx = pair.0.clone();
         let param_name = pair.1.clone();
-        let param_type = match param_nodes
-            .clone()
-            .iter()
-            .cloned()
-            .skip(idx.clone() as usize)
-            .next()
-        {
+        let param_type = match param_nodes.clone().get((idx.clone()) as usize).cloned() {
             Some(pn) => match pn.inferred.clone().as_deref().cloned() {
                 Some(InferredNode::Resolved {
                     node: resolved_type,
@@ -27947,13 +28514,7 @@ pub fn lambda_param_type_strs(
                 let inferred_type = if (fold_acc_uses_fallback.clone() && (idx.clone() == 0)) {
                     std::option::Option::None
                 } else {
-                    match param_nodes
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(idx.clone() as usize)
-                        .next()
-                    {
+                    match param_nodes.clone().get((idx.clone()) as usize).cloned() {
                         Some(pn) => match pn.inferred.clone().as_deref().cloned() {
                             Some(InferredNode::Resolved {
                                 node: param_type, ..
@@ -28008,16 +28569,11 @@ pub fn lambda_param_type_strs(
                         std::option::Option::None => std::option::Option::None,
                     }
                 };
-                let fallback_type = match fallback_types
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .skip(idx.clone() as usize)
-                    .next()
-                {
-                    Some(ty) => ty.clone(),
-                    std::option::Option::None => "_".to_string(),
-                };
+                let fallback_type =
+                    match fallback_types.clone().get((idx.clone()) as usize).cloned() {
+                        Some(ty) => ty.clone(),
+                        std::option::Option::None => "_".to_string(),
+                    };
                 let spec = crate::v1_compiler_emit_core_support::language_spec(RenderTarget::Rust);
                 let ident =
                     crate::v1_compiler_emit::emit_ident(param_name.clone(), RenderTarget::Rust);
@@ -28057,15 +28613,7 @@ pub fn emit_typed_collection_lambda(
                 scope.type_env.clone().source_indices.clone(),
             );
             let bd = crate::v1_std_core::lambda_body(lambda_expr.clone());
-            let pn = Rc::new(
-                lambda_expr
-                    .children
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .collect::<Vec<_>>(),
-            );
+            let pn = Rc::new(v1_rt::list_skip(&lambda_expr.children.clone(), 1));
             let param_strs = lambda_param_type_strs(
                 ps.clone(),
                 pn.clone(),
@@ -28136,15 +28684,7 @@ pub fn emit_typed_fold_lambda(
                 scope.type_env.clone().source_indices.clone(),
             );
             let bd = crate::v1_std_core::lambda_body(lambda_expr.clone());
-            let pn = Rc::new(
-                lambda_expr
-                    .children
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .collect::<Vec<_>>(),
-            );
+            let pn = Rc::new(v1_rt::list_skip(&lambda_expr.children.clone(), 1));
             let safe_acc_type = rust_fold_safe_acc_type(acc_type_str.clone());
             let fallback_types = Rc::new({
                 let mut __result = Vec::new();
@@ -28406,7 +28946,7 @@ pub fn emit_rust_fold_method_call(
             scope.type_env.clone().source_indices.clone(),
             acc_type_node.clone(),
         );
-        let fold_lambda_node = match args.clone().iter().cloned().skip(1 as usize).next() {
+        let fold_lambda_node = match args.clone().get((1) as usize).cloned() {
             Some(a) => crate::v1_std_core::arg_value(a.clone()),
             std::option::Option::None => type_variable_node("".to_string()),
         };
@@ -28700,7 +29240,7 @@ pub fn emit_rust_fold_method_call(
         let sharing = crate::v1_compiler_emit_core_support::language_spec(RenderTarget::Rust)
             .sharing
             .clone();
-        let elem_unused = match args.clone().iter().cloned().skip(1 as usize).next() {
+        let elem_unused = match args.clone().get((1) as usize).cloned() {
             Some(a) => fold_lambda_element_unused(
                 crate::v1_std_core::arg_value(a.clone()),
                 scope.type_env.clone().source_indices.clone(),
@@ -28720,7 +29260,7 @@ pub fn emit_rust_fold_method_call(
             iter_template.clone(),
             recv_str.clone(),
         );
-        let step_awaits = match args.clone().iter().cloned().skip(1 as usize).next() {
+        let step_awaits = match args.clone().get((1) as usize).cloned() {
             Some(a) => rust_expr_reaches_awaited_call(
                 crate::v1_std_core::arg_value(a.clone()),
                 registry.clone(),
@@ -28742,7 +29282,7 @@ pub fn emit_rust_fold_method_call(
             )
         } else {
             {
-                let fold_fn = match args.clone().iter().cloned().skip(1 as usize).next() {
+                let fold_fn = match args.clone().get((1) as usize).cloned() {
                     Some(a) => emit_typed_fold_lambda(
                         crate::v1_std_core::arg_value(a.clone()),
                         lambda_acc_type_str.clone(),
@@ -28791,13 +29331,13 @@ pub fn emit_rust_effectful_fold_loop(
     ExprData::ExprLambda => {
         let si = scope.type_env.clone().source_indices.clone();
 let ps = crate::v1_std_core::lambda_param_names_at(lambda_expr.clone(), si.clone());
-let pn = Rc::new(lambda_expr.children.clone().iter().cloned().skip(1 as usize).collect::<Vec<_>>());
+let pn = Rc::new(v1_rt::list_skip(&lambda_expr.children.clone(), 1));
 let acc_param_type = rust_fold_safe_acc_type(acc_type_str.clone());
 let acc_name = match ps.clone().first().cloned() {
     Some(n) => n.clone(),
     std::option::Option::None => "_".to_string(),
 };
-let elem_name = match ps.clone().iter().cloned().skip(1 as usize).next() {
+let elem_name = match ps.clone().get((1) as usize).cloned() {
     Some(n) => n.clone(),
     std::option::Option::None => "_".to_string(),
 };
@@ -28898,7 +29438,7 @@ pub fn fold_lambda_element_unused(
                 lambda_expr.clone(),
                 source_indices.clone(),
             );
-            match ps.clone().iter().cloned().skip(1 as usize).next() {
+            match ps.clone().get((1) as usize).cloned() {
                 Some(elem_name) => (elem_name.clone() == "_".to_string()),
                 std::option::Option::None => false,
             }
@@ -29111,15 +29651,10 @@ pub fn emit_rust_map_method_call(
                         let lambda_scope = lambda_scope_from_children(
                             scope.clone(),
                             ps.clone(),
-                            Rc::new(
-                                crate::v1_std_core::arg_value(a.clone())
-                                    .children
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
+                            Rc::new(v1_rt::list_skip(
+                                &crate::v1_std_core::arg_value(a.clone()).children.clone(),
+                                1,
+                            )),
                         );
                         let body_str = emit_typed_expr(
                             bd.clone(),
@@ -29210,15 +29745,10 @@ pub fn emit_rust_map_method_call(
                             let lambda_scope = lambda_scope_from_children(
                                 scope.clone(),
                                 ps.clone(),
-                                Rc::new(
-                                    crate::v1_std_core::arg_value(a.clone())
-                                        .children
-                                        .clone()
-                                        .iter()
-                                        .cloned()
-                                        .skip(1 as usize)
-                                        .collect::<Vec<_>>(),
-                                ),
+                                Rc::new(v1_rt::list_skip(
+                                    &crate::v1_std_core::arg_value(a.clone()).children.clone(),
+                                    1,
+                                )),
                             );
                             let body_str = emit_typed_expr(
                                 bd.clone(),
@@ -29334,15 +29864,10 @@ pub fn emit_rust_higher_order_method(
                         let lambda_scope = lambda_scope_from_children(
                             scope.clone(),
                             ps.clone(),
-                            Rc::new(
-                                crate::v1_std_core::arg_value(a.clone())
-                                    .children
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
+                            Rc::new(v1_rt::list_skip(
+                                &crate::v1_std_core::arg_value(a.clone()).children.clone(),
+                                1,
+                            )),
                         );
                         let body_str = emit_typed_expr(
                             bd.clone(),
@@ -29654,10 +30179,10 @@ pub fn emit_rust_first_method_call(
                     );
                     v1_rt::concat(
                         v1_rt::concat(
-                            v1_rt::concat(recv_str.clone(), ".iter().cloned().skip(".to_string()),
+                            v1_rt::concat(recv_str.clone(), ".get((".to_string()),
                             n_str.clone(),
                         ),
-                        " as usize).next()".to_string(),
+                        ") as usize).cloned()".to_string(),
                     )
                 }
             } else {
@@ -30044,7 +30569,7 @@ pub fn emit_typed_method_call(
                     method_def.clone(),
                 );
                 let method_name = if (method_name_raw.clone() == "length".to_string()) {
-                    if is_string_typed_expr(
+                    if is_host_text_typed_expr(
                         receiver.clone(),
                         scope.type_env.clone().source_indices.clone(),
                     ) {
@@ -30438,7 +30963,7 @@ pub fn freemonoid_match_arm_for(arms: Rc<Vec<Rc<Node>>>, variant: String) -> Opt
 pub fn arm_resolved_parent_enum(
     arm: Rc<Node>,
     scrut_type: String,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> Option<String> {
     match (*crate::v1_std_core::arm_pattern(arm.clone())).clone() {
         MatchPattern::VariantPattern {
@@ -30485,7 +31010,7 @@ pub fn freemonoid_catchall_arm(arms: Rc<Vec<Rc<Node>>>) -> Option<Rc<Node>> {
 pub fn arms_are_freemonoid_coproduct(
     arms: Rc<Vec<Rc<Node>>>,
     scrut_type: String,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> bool {
     {
         let has_empty = match freemonoid_match_arm_for(arms.clone(), "Empty".to_string()) {
@@ -33088,11 +33613,16 @@ pub fn emit_field_value_with_context(
                     };
                     let corrected_parent = match expected_type.clone() {
                         Some(et) => {
-                            if crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
+                            if match (*crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
                                 emit_info.type_summaries.clone(),
                                 variant_name.clone(),
                                 et.clone(),
-                            ) {
+                            ))
+                            .clone()
+                            {
+                                TypeSummaryQuestion::QuestionDecided { value: v, .. } => v.clone(),
+                                _ => false,
+                            } {
                                 Some(et.clone())
                             } else {
                                 pe.clone()
@@ -33202,7 +33732,7 @@ pub fn record_field_expected_type(
 
 pub fn struct_candidates_by_field_names(
     field_names: Rc<Vec<String>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> Rc<Vec<Rc<TypeSummary>>> {
     {
         let n_fields = (field_names.clone().len() as i64);
@@ -33211,7 +33741,11 @@ pub fn struct_candidates_by_field_names(
         }
         Rc::new({
             let mut __result = Vec::new();
-            for summary in Rc::new(v1_rt::map_values(&type_summaries)).iter().cloned() {
+            for summary in
+                crate::v1_compiler_infer_emit_info::type_summary_values(type_summaries.clone())
+                    .iter()
+                    .cloned()
+            {
                 if match (*summary.repr.clone()).clone() {
                     TypeRepr::StructRepr => {
                         ({
@@ -33317,7 +33851,7 @@ pub fn effectful_self_recursion_diagnostics(
 pub fn anonymous_record_struct_candidates(
     field_names: Rc<Vec<String>>,
     field_type_hints: Rc<HashMap<String, String>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> Rc<Vec<Rc<TypeSummary>>> {
     {
         let candidates =
@@ -33368,7 +33902,7 @@ pub fn anonymous_record_struct_candidates(
 
 pub fn ambiguous_anonymous_record_literal_diagnostics(
     n: Rc<Node>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
     module_name: String,
 ) -> Rc<Vec<Rc<ErrorNode>>> {
@@ -33551,7 +34085,7 @@ pub fn ambiguous_anonymous_record_literal_diagnostics(
 pub fn find_struct_name_by_fields(
     field_names: Rc<Vec<String>>,
     field_type_hints: Rc<HashMap<String, String>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> Option<String> {
     {
         let candidates = anonymous_record_struct_candidates(
@@ -33572,7 +34106,7 @@ pub fn find_struct_name_by_fields(
 
 pub fn find_unique_struct_name_by_fields(
     field_names: Rc<Vec<String>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> Option<String> {
     {
         let candidates =
@@ -33614,7 +34148,10 @@ pub fn emit_typed_record_lit(
                     resolved_type.clone(),
                 );
                 if ((resolved_type.ident_span.clone() != std::option::Option::None)
-                    && v1_rt::map_contains_key(&emit_info.type_summaries.clone(), rt_name.clone()))
+                    && (crate::v1_compiler_infer_emit_info::type_summary_decided(
+                        emit_info.type_summaries.clone(),
+                        rt_name.clone(),
+                    ) != std::option::Option::None))
                 {
                     Some(rt_name.clone())
                 } else {
@@ -33895,8 +34432,10 @@ pub fn emit_typed_record_lit(
                 ) {
                     return "panic!(\"record-shaped carrier has no realization in the selected Rust target inhabitant\")".to_string();
                 }
-                let tn_is_known_struct =
-                    v1_rt::map_contains_key(&emit_info.type_summaries.clone(), tn.clone());
+                let tn_is_known_struct = (crate::v1_compiler_infer_emit_info::type_summary_decided(
+                    emit_info.type_summaries.clone(),
+                    tn.clone(),
+                ) != std::option::Option::None);
                 let ctor_name = if tn_is_known_struct.clone() {
                     tn.clone()
                 } else {
@@ -33963,11 +34502,16 @@ pub fn emit_typed_record_lit(
                             && (rt_name.clone() != variant_surface_name.clone()))
                             && !rt_is_type_var.clone())
                             && (rt_name.clone() != "Error".to_string()))
-                            && crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
+                            && match (*crate::v1_compiler_infer_emit_info::variant_belongs_to_enum(
                                 emit_info.type_summaries.clone(),
                                 variant_surface_name.clone(),
                                 rt_name.clone(),
                             ))
+                            .clone()
+                            {
+                                TypeSummaryQuestion::QuestionDecided { value: v, .. } => v.clone(),
+                                _ => false,
+                            })
                         {
                             Some(rt_name.clone())
                         } else {
@@ -35283,6 +35827,24 @@ pub fn is_string_typed_expr(
     }
 }
 
+pub fn is_host_text_typed_expr(
+    e: Rc<Node>,
+    source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+) -> bool {
+    match e.inferred.clone().as_deref().cloned() {
+        Some(InferredNode::Resolved { node: rt, .. }) => {
+            let is_optional = (rt.return_cardinality.clone() == Cardinality::CardOptional);
+            let inner = if is_optional.clone() {
+                crate::v1_std_core::with_required_cardinality(rt.clone())
+            } else {
+                rt.clone()
+            };
+            is_host_text_carrier_type(inner.clone(), source_indices.clone())
+        }
+        _ => false,
+    }
+}
+
 pub fn emit_typed_string_interp(
     parts: Rc<Vec<Rc<StringPart>>>,
     registry: Rc<HashMap<String, Rc<ItemInfo>>>,
@@ -35487,14 +36049,7 @@ pub fn emit_tco_init_block_stmts(
                 });
             }
             Some(stmt) => {
-                let rest = Rc::new(
-                    remaining
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                );
+                let rest = Rc::new(v1_rt::list_skip(&remaining.clone(), 1));
                 match rest.clone().first().cloned() {
                     std::option::Option::None => {
                         break Rc::new(BlockEmitState {
@@ -36679,13 +37234,7 @@ pub fn emit_typed_tco_reassign(
             let mut __result = Vec::new();
             for pair in pairs.iter().cloned() {
                 __result.push({
-                    let av = match arg_values
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(pair.0.clone() as usize)
-                        .next()
-                    {
+                    let av = match arg_values.clone().get((pair.0.clone()) as usize).cloned() {
                         Some(v) => v.clone(),
                         std::option::Option::None => pair.1.clone(),
                     };
@@ -37468,6 +38017,7 @@ pub fn emit_transport_call(
             rsf.clone(),
             op_node.clone(),
             source_indices.clone(),
+            env.clone(),
         ),
         BoundOperation::FileBound {
             verb: v,
@@ -38823,7 +39373,7 @@ pub fn emit_exit_code_handling(
                             v1_rt::concat(
                                 v1_rt::concat(
                                     "\n    _ => { ".to_string(),
-                                    shell_stderr_binding_line(),
+                                    shell_error_stderr_binding(result_fields.clone()),
                                 ),
                                 " ".to_string(),
                             ),
@@ -38885,7 +39435,7 @@ pub fn emit_exit_arm(
                                 v1_rt::concat("    ".to_string(), pattern.clone()),
                                 " => { ".to_string(),
                             ),
-                            shell_stderr_binding_line(),
+                            shell_error_stderr_binding(result_fields.clone()),
                         ),
                         " ".to_string(),
                     ),
@@ -38905,6 +39455,7 @@ pub fn emit_shell_call(
     result_fields: Rc<Vec<Rc<ShellResultField>>>,
     op_node: Rc<Node>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+    env: Rc<TypeEnv>,
 ) -> String {
     {
         let argv = transport.children.clone();
@@ -38959,7 +39510,8 @@ pub fn emit_shell_call(
                 Some(_) => true,
                 std::option::Option::None => false,
             };
-        let let_kw = if has_stdin.clone() {
+        let needs_capture = shell_needs_capture_accounting(result_fields.clone());
+        let let_kw = if (has_stdin.clone() || needs_capture.clone()) {
             "let mut output".to_string()
         } else {
             "let output".to_string()
@@ -39003,16 +39555,7 @@ pub fn emit_shell_call(
         let arg_lines = if ((argv.clone().len() as i64) > 1) {
             Rc::new({
                 let mut __result = Vec::new();
-                for arg in Rc::new(
-                    argv.clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                )
-                .iter()
-                .cloned()
-                {
+                for arg in Rc::new(v1_rt::list_skip(&argv.clone(), 1)).iter().cloned() {
                     __result.push(
                         if shell_argv_element_is_word_list(
                             arg.clone(),
@@ -39078,79 +39621,136 @@ pub fn emit_shell_call(
             __result
         });
         let wd_line = "    .current_dir(self.working_dir.as_deref().unwrap_or(\".\"))".to_string();
-        if has_stdin.clone() {
+        let return_line = emit_exit_code_handling(
+            op_node.clone(),
+            result_fields.clone(),
+            source_indices.clone(),
+        );
+        if needs_capture.clone() {
             {
-                let stdin_expr =
-                    crate::v1_std_core::transport_stdin(transport.clone(), source_indices.clone())
+                let policy_bind = emit_shell_stderr_policy_binding(op_node.clone(), env.clone());
+                let spawn_line = "    .stdin(std::process::Stdio::piped())\n    .stdout(std::process::Stdio::piped())\n    .stderr(std::process::Stdio::piped())".to_string();
+                let spawn_exec = "    .spawn()?;".to_string();
+                let stdin_thread = if has_stdin.clone() {
+                    {
+                        let stdin_expr = crate::v1_std_core::transport_stdin(
+                            transport.clone(),
+                            source_indices.clone(),
+                        )
                         .clone()
                         .unwrap();
-                let stdin_var = match (*stdin_expr.expr_data.clone()).clone() {
-                    ExprData::ExprVar {
-                        binding_kind: _, ..
-                    } => crate::v1_compiler_emit::emit_ident(
-                        crate::v1_std_core::expr_var_name_at(
-                            stdin_expr.clone(),
-                            source_indices.clone(),
-                        ),
-                        RenderTarget::Rust,
-                    ),
-                    _ => crate::v1_compiler_emit::emit_simple_expr(
-                        stdin_expr.clone(),
-                        RenderTarget::Rust,
-                        source_indices.clone(),
-                    ),
+                        let stdin_var = match (*stdin_expr.expr_data.clone()).clone() {
+                            ExprData::ExprVar {
+                                binding_kind: _, ..
+                            } => crate::v1_compiler_emit::emit_ident(
+                                crate::v1_std_core::expr_var_name_at(
+                                    stdin_expr.clone(),
+                                    source_indices.clone(),
+                                ),
+                                RenderTarget::Rust,
+                            ),
+                            _ => crate::v1_compiler_emit::emit_simple_expr(
+                                stdin_expr.clone(),
+                                RenderTarget::Rust,
+                                source_indices.clone(),
+                            ),
+                        };
+                        v1_rt::concat(v1_rt::concat("let mut stdin_pipe = output.stdin.take();\nlet __stdin_thread = std::thread::spawn(move || -> std::io::Result<()> {\n    use std::io::Write;\n    if let Some(mut stdin) = stdin_pipe {\n        stdin.write_all(".to_string(), stdin_var.clone()), ".as_bytes())?;\n    }\n    Ok(())\n});\n".to_string())
+                    }
+                } else {
+                    "let mut stdin_pipe = output.stdin.take();\nlet __stdin_thread = std::thread::spawn(move || -> std::io::Result<()> {\n    drop(stdin_pipe);\n    Ok(())\n});\n".to_string()
                 };
-                let spawn_line = "    .stdin(std::process::Stdio::piped())\n    .stdout(std::process::Stdio::piped())\n    .stderr(std::process::Stdio::piped())".to_string();
-                let spawn_exec = "    .spawn()?;".to_string();
-                let write_block = v1_rt::concat(v1_rt::concat("{\n    use std::io::Write;\n    if let Some(mut stdin) = output.stdin.take() {\n        stdin.write_all(".to_string(), stdin_var.clone()), ".as_bytes())?;\n    }\n}".to_string());
-                let wait_line = "let output = output.wait_with_output()?;".to_string();
-                let check_line =
-                    "let stdout = String::from_utf8_lossy(&output.stdout).to_string();".to_string();
-                let return_line = emit_exit_code_handling(
-                    op_node.clone(),
-                    result_fields.clone(),
-                    source_indices.clone(),
+                let capture_lines = v1_rt::concat(
+                    v1_rt::concat(shell_capture_drain_start(), stdin_thread.clone()),
+                    shell_capture_join_project(),
                 );
-                let all_lines = v1_rt::concat(
+                v1_rt::concat(
                     v1_rt::concat(
-                        v1_rt::concat(Rc::new(vec![cmd_line.clone()]), arg_lines.clone()),
+                        v1_rt::concat(
+                            Rc::new(vec![policy_bind.clone(), cmd_line.clone()]),
+                            arg_lines.clone(),
+                        ),
                         env_lines.clone(),
                     ),
                     Rc::new(vec![
                         wd_line.clone(),
                         spawn_line.clone(),
                         spawn_exec.clone(),
-                        write_block.clone(),
-                        wait_line.clone(),
-                        check_line.clone(),
+                        capture_lines.clone(),
                         return_line.clone(),
                     ]),
-                );
-                all_lines.clone().join(&"\n".to_string())
+                )
+                .join(&"\n".to_string())
             }
         } else {
-            {
-                let output_line = "    .output()?;".to_string();
-                let check_line =
-                    "let stdout = String::from_utf8_lossy(&output.stdout).to_string();".to_string();
-                let return_line = emit_exit_code_handling(
-                    op_node.clone(),
-                    result_fields.clone(),
-                    source_indices.clone(),
-                );
-                let all_lines = v1_rt::concat(
+            if has_stdin.clone() {
+                {
+                    let stdin_expr = crate::v1_std_core::transport_stdin(
+                        transport.clone(),
+                        source_indices.clone(),
+                    )
+                    .clone()
+                    .unwrap();
+                    let stdin_var = match (*stdin_expr.expr_data.clone()).clone() {
+                        ExprData::ExprVar {
+                            binding_kind: _, ..
+                        } => crate::v1_compiler_emit::emit_ident(
+                            crate::v1_std_core::expr_var_name_at(
+                                stdin_expr.clone(),
+                                source_indices.clone(),
+                            ),
+                            RenderTarget::Rust,
+                        ),
+                        _ => crate::v1_compiler_emit::emit_simple_expr(
+                            stdin_expr.clone(),
+                            RenderTarget::Rust,
+                            source_indices.clone(),
+                        ),
+                    };
+                    let spawn_line = "    .stdin(std::process::Stdio::piped())\n    .stdout(std::process::Stdio::piped())\n    .stderr(std::process::Stdio::piped())".to_string();
+                    let spawn_exec = "    .spawn()?;".to_string();
+                    let write_block = v1_rt::concat(v1_rt::concat("{\n    use std::io::Write;\n    if let Some(mut stdin) = output.stdin.take() {\n        stdin.write_all(".to_string(), stdin_var.clone()), ".as_bytes())?;\n    }\n}".to_string());
+                    let wait_line = "let output = output.wait_with_output()?;".to_string();
+                    let check_line =
+                        "let stdout = String::from_utf8_lossy(&output.stdout).to_string();"
+                            .to_string();
                     v1_rt::concat(
-                        v1_rt::concat(Rc::new(vec![cmd_line.clone()]), arg_lines.clone()),
-                        env_lines.clone(),
-                    ),
-                    Rc::new(vec![
-                        wd_line.clone(),
-                        output_line.clone(),
-                        check_line.clone(),
-                        return_line.clone(),
-                    ]),
-                );
-                all_lines.clone().join(&"\n".to_string())
+                        v1_rt::concat(
+                            v1_rt::concat(Rc::new(vec![cmd_line.clone()]), arg_lines.clone()),
+                            env_lines.clone(),
+                        ),
+                        Rc::new(vec![
+                            wd_line.clone(),
+                            spawn_line.clone(),
+                            spawn_exec.clone(),
+                            write_block.clone(),
+                            wait_line.clone(),
+                            check_line.clone(),
+                            return_line.clone(),
+                        ]),
+                    )
+                    .join(&"\n".to_string())
+                }
+            } else {
+                {
+                    let output_line = "    .output()?;".to_string();
+                    let check_line =
+                        "let stdout = String::from_utf8_lossy(&output.stdout).to_string();"
+                            .to_string();
+                    v1_rt::concat(
+                        v1_rt::concat(
+                            v1_rt::concat(Rc::new(vec![cmd_line.clone()]), arg_lines.clone()),
+                            env_lines.clone(),
+                        ),
+                        Rc::new(vec![
+                            wd_line.clone(),
+                            output_line.clone(),
+                            check_line.clone(),
+                            return_line.clone(),
+                        ]),
+                    )
+                    .join(&"\n".to_string())
+                }
             }
         }
     }
@@ -39334,6 +39934,66 @@ pub fn shell_stderr_binding_line() -> String {
     CACHED.with(|c: &String| c.clone())
 }
 
+pub fn shell_needs_capture_accounting(result_fields: Rc<Vec<Rc<ShellResultField>>>) -> bool {
+    {
+        let mut __found = false;
+        for f in result_fields.iter().cloned() {
+            if crate::v1_compiler_emit::shell_channel_is_capture_accounting(f.channel.clone()) {
+                __found = true;
+                break;
+            }
+        }
+        __found
+    }
+}
+
+pub fn shell_error_stderr_binding(result_fields: Rc<Vec<Rc<ShellResultField>>>) -> String {
+    if shell_needs_capture_accounting(result_fields.clone()) {
+        "".to_string()
+    } else {
+        v1_rt::concat(shell_stderr_binding_line(), " ".to_string())
+    }
+}
+
+pub fn emit_shell_stderr_policy_binding(op_node: Rc<Node>, env: Rc<TypeEnv>) -> String {
+    if crate::v1_compiler_emit::operation_declares_required_stderr_capture_policy(
+        op_node.clone(),
+        env.clone(),
+    ) {
+        v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("let (__stderr_complete_limit, __stderr_complete_source): (Option<usize>, String) = match &*stderr_capture {\n".to_string(), "    crate::std_shell_stream_capture::WitnessStderrCapturePolicy::Complete => {\n".to_string()), "        match v1_rt::read_host_budget_bytes() {\n".to_string()), "            (Some(n), source) => (Some(n as usize), source),\n".to_string()), "            (None, source) => return Err(format!(\"WitnessStderrCaptureCompleteBudgetUnreadable: Complete stderr capture requires the active host budget authority ({})\", source).into()),\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "    crate::std_shell_stream_capture::WitnessStderrCapturePolicy::BoundedTail { bytes } => {\n".to_string()), "        let n = crate::std_measure::byte_size_count(bytes.clone());\n".to_string()), "        if n < 0 { return Err(\"WitnessStderrCapturePolicy.BoundedTail bytes must be non-negative\".into()); }\n".to_string()), "        (None, String::new())\n".to_string()), "    }\n".to_string()), "};\n".to_string()), "let __stderr_tail_bytes: usize = match &*stderr_capture {\n".to_string()), "    crate::std_shell_stream_capture::WitnessStderrCapturePolicy::BoundedTail { bytes } => crate::std_measure::byte_size_count(bytes.clone()) as usize,\n".to_string()), "    crate::std_shell_stream_capture::WitnessStderrCapturePolicy::Complete => 0,\n".to_string()), "};\n".to_string())
+    } else {
+        v1_rt::concat(
+            v1_rt::concat(
+                "return Err(\"".to_string(),
+                crate::v1_compiler_emit::shell_emission_refusal_fact(Rc::new(
+                    ShellEmissionRefusal::ShellCapturePolicyInputAbsent {
+                        key: "stderr_truncated".to_string(),
+                    },
+                )),
+            ),
+            "\".into());\n".to_string(),
+        )
+    }
+}
+
+pub fn shell_capture_drain_start() -> String {
+    thread_local! {
+        static CACHED: String = {
+            "let mut stdout_pipe = output.stdout.take();\nlet mut stderr_pipe = output.stderr.take();\nlet stdout_thread = std::thread::spawn(move || -> std::io::Result<Vec<u8>> {\n    let mut buf = Vec::new();\n    if let Some(ref mut reader) = stdout_pipe {\n        std::io::Read::read_to_end(reader, &mut buf)?;\n    }\n    Ok(buf)\n});\nlet stderr_thread = std::thread::spawn(move || -> std::io::Result<(Vec<u8>, u64, bool)> {\n    let mut reader = match stderr_pipe {\n        Some(r) => r,\n        None => return Ok((Vec::new(), 0, false)),\n    };\n    let mut chunk = [0u8; 65536];\n    let mut total: u64 = 0;\n    if let Some(max_bytes) = __stderr_complete_limit {\n        let mut retained = Vec::new();\n        loop {\n            let n = std::io::Read::read(&mut reader, &mut chunk)?;\n            if n == 0 { break; }\n            total += n as u64;\n            if total <= max_bytes as u64 { retained.extend_from_slice(&chunk[..n]); }\n        }\n        let truncated = total > max_bytes as u64;\n        return Ok((if truncated { Vec::new() } else { retained }, total, truncated));\n    }\n    let cap = __stderr_tail_bytes;\n    let mut ring = Vec::with_capacity(cap);\n    let mut start = 0usize;\n    loop {\n        let n = std::io::Read::read(&mut reader, &mut chunk)?;\n        if n == 0 { break; }\n        total += n as u64;\n        for &b in &chunk[..n] {\n            if cap == 0 { continue; }\n            if ring.len() < cap {\n                ring.push(b);\n            } else {\n                ring[start] = b;\n                start = (start + 1) % cap;\n            }\n        }\n    }\n    let retained = if ring.len() < cap || cap == 0 {\n        ring\n    } else {\n        let mut out = Vec::with_capacity(cap);\n        for i in 0..cap { out.push(ring[(start + i) % cap]); }\n        out\n    };\n    let retained_len = retained.len() as u64;\n    Ok((retained, total, total > retained_len))\n});\n".to_string()
+        };
+    }
+    CACHED.with(|c: &String| c.clone())
+}
+
+pub fn shell_capture_join_project() -> String {
+    thread_local! {
+        static CACHED: String = {
+            "let status = output.wait()?;\n__stdin_thread.join().map_err(|_| std::io::Error::new(std::io::ErrorKind::Other, \"stdin write thread panicked\"))??;\nlet stdout_bytes = stdout_thread.join().map_err(|_| std::io::Error::new(std::io::ErrorKind::Other, \"stdout drain thread panicked\"))??;\nlet (stderr_bytes, stderr_total_u64, stderr_truncated) = stderr_thread.join().map_err(|_| std::io::Error::new(std::io::ErrorKind::Other, \"stderr drain thread panicked\"))??;\nif let Some(max_bytes) = __stderr_complete_limit {\n    if stderr_total_u64 > max_bytes as u64 {\n        return Err(format!(\"WitnessStderrCaptureCompleteBudgetExceeded: stderr total {} exceeds host budget {} ({})\", stderr_total_u64, max_bytes, __stderr_complete_source).into());\n    }\n}\nlet stderr_total_bytes = stderr_total_u64 as i64;\nlet stderr_retained_bytes = stderr_bytes.len() as i64;\nlet stdout = String::from_utf8_lossy(&stdout_bytes).to_string();\nlet stderr = String::from_utf8_lossy(&stderr_bytes).trim_end().to_string();\nlet output = std::process::Output { status, stdout: stdout_bytes, stderr: stderr_bytes };\n".to_string()
+        };
+    }
+    CACHED.with(|c: &String| c.clone())
+}
+
 pub fn emit_shell_return(result_fields: Rc<Vec<Rc<ShellResultField>>>) -> String {
     v1_rt::concat(
         v1_rt::concat(
@@ -39383,24 +40043,28 @@ pub fn shell_projection_value(result_fields: Rc<Vec<Rc<ShellResultField>>>) -> S
 }
 
 pub fn shell_stderr_prelude(result_fields: Rc<Vec<Rc<ShellResultField>>>) -> String {
-    {
-        let needs_stderr = {
-            let mut __found = false;
-            for f in result_fields.iter().cloned() {
-                if match f.channel.clone() {
-                    ShellResultChannel::ShellChanStderr => true,
-                    _ => false,
-                } {
-                    __found = true;
-                    break;
+    if shell_needs_capture_accounting(result_fields.clone()) {
+        "".to_string()
+    } else {
+        {
+            let needs_stderr = {
+                let mut __found = false;
+                for f in result_fields.iter().cloned() {
+                    if match f.channel.clone() {
+                        ShellResultChannel::ShellChanStderr => true,
+                        _ => false,
+                    } {
+                        __found = true;
+                        break;
+                    }
                 }
+                __found
+            };
+            if needs_stderr.clone() {
+                v1_rt::concat(shell_stderr_binding_line(), "\n".to_string())
+            } else {
+                "".to_string()
             }
-            __found
-        };
-        if needs_stderr.clone() {
-            v1_rt::concat(shell_stderr_binding_line(), "\n".to_string())
-        } else {
-            "".to_string()
         }
     }
 }
@@ -39418,15 +40082,9 @@ pub fn emit_shell_channel_expr(channel: ShellResultChannel, is_optional: bool) -
                 "stdout.lines().filter(|l| !l.is_empty()).map(|l| l.trim().to_string()).collect()"
                     .to_string(),
             ),
-            ShellResultChannel::ShellChanStderrTruncated => {
-                emit_unrealizable_shell_channel(channel.clone())
-            }
-            ShellResultChannel::ShellChanStderrTotalBytes => {
-                emit_unrealizable_shell_channel(channel.clone())
-            }
-            ShellResultChannel::ShellChanStderrRetainedBytes => {
-                emit_unrealizable_shell_channel(channel.clone())
-            }
+            ShellResultChannel::ShellChanStderrTruncated => "stderr_truncated".to_string(),
+            ShellResultChannel::ShellChanStderrTotalBytes => "stderr_total_bytes".to_string(),
+            ShellResultChannel::ShellChanStderrRetainedBytes => "stderr_retained_bytes".to_string(),
         };
         if is_optional.clone() {
             v1_rt::concat(
@@ -40085,18 +40743,21 @@ pub fn emit_data_def(
                 annotation_type_node.clone(),
                 scope.type_env.clone().source_indices.clone(),
             ) {
-                crate::v1_compiler_coercion::coerce_primitive_type(
-                    crate::v1_compiler_coercion::type_reference_realization(
-                        annotation_type_node.clone(),
+                rust_carrier_optional_wrap(
+                    annotation_type_node.clone(),
+                    crate::v1_compiler_coercion::coerce_primitive_type(
+                        crate::v1_compiler_coercion::type_reference_realization(
+                            annotation_type_node.clone(),
+                            crate::v1_std_core::authored_name_at(
+                                scope.type_env.clone().source_indices.clone(),
+                                annotation_type_node.clone(),
+                            ),
+                            RenderTarget::Rust,
+                        ),
                         crate::v1_std_core::authored_name_at(
                             scope.type_env.clone().source_indices.clone(),
                             annotation_type_node.clone(),
                         ),
-                        RenderTarget::Rust,
-                    ),
-                    crate::v1_std_core::authored_name_at(
-                        scope.type_env.clone().source_indices.clone(),
-                        annotation_type_node.clone(),
                     ),
                 )
             } else {
@@ -40251,6 +40912,10 @@ pub fn data_row_type_forbids_deserialize(
     )
 }
 
+pub fn data_row_declares_optional(type_node: Rc<Node>) -> bool {
+    (type_node.return_cardinality.clone() == Cardinality::CardOptional)
+}
+
 pub fn emit_data_def_body(
     type_node: Rc<Node>,
     value: Rc<Node>,
@@ -40437,10 +41102,29 @@ pub fn emit_data_def_body(
                         scope.type_env.clone().source_indices.clone(),
                     ))
                 {
-                    match (*crate::v1_compiler_emit::emit_data_value_json(value.clone(), scope.type_env.clone().source_indices.clone(), emit_info.data_variant_wire_spellings.clone())).clone() {
+                    {
+                        let row_json = if data_row_declares_optional(type_node.clone()) {
+                            crate::v1_compiler_emit::emit_declared_optional_row_json(
+                                value.clone(),
+                                crate::v1_std_core::authored_name_at(
+                                    scope.type_env.clone().source_indices.clone(),
+                                    type_node.clone(),
+                                ),
+                                scope.type_env.clone().source_indices.clone(),
+                                emit_info.data_variant_wire_spellings.clone(),
+                            )
+                        } else {
+                            crate::v1_compiler_emit::emit_data_value_json(
+                                value.clone(),
+                                scope.type_env.clone().source_indices.clone(),
+                                emit_info.data_variant_wire_spellings.clone(),
+                            )
+                        };
+                        match (*row_json.clone()).clone() {
     EmitterOutcome::Refused { reason: r, .. } => v1_rt::concat(v1_rt::concat("            compile_error!(\"".to_string(), crate::v1_compiler_emit_core_support::escape_string_literal_body(r.clone())), "\")".to_string()),
     EmitterOutcome::Emitted { json: json_str, .. } => v1_rt::concat(v1_rt::concat(v1_rt::concat("            serde_json::from_str(\"".to_string(), crate::v1_compiler_emit_core_support::escape_string_literal_body(json_str.clone())), "\")\n".to_string()), "                .expect(\"valid data definition\")".to_string()),
 }
+                    }
                 } else {
                     {
                         let is_map = crate::v1_compiler_infer_types::node_is_keyed_collection(
@@ -40863,114 +41547,6 @@ pub fn emit_cargo_dep_no_default_features(
     }
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, serde::Serialize, serde::Deserialize)]
-pub struct EmittedCrateDependencyDemand {
-    pub renders_clap_cli: bool,
-    pub renders_async_services: bool,
-}
-
-pub fn emitted_crate_dependency_lines(demand: EmittedCrateDependencyDemand) -> Rc<Vec<String>> {
-    {
-        let base_deps = Rc::new(vec![
-            emit_cargo_dep(
-                "im".to_string(),
-                "15.1".to_string(),
-                Rc::new(vec!["serde".to_string()]),
-            ),
-            emit_cargo_dep(
-                "unicode-ident".to_string(),
-                "1".to_string(),
-                Rc::new(vec![]),
-            ),
-            emit_cargo_dep(
-                "unicode-properties".to_string(),
-                "0.1".to_string(),
-                Rc::new(vec!["emoji".to_string()]),
-            ),
-            emit_cargo_dep(
-                "serde".to_string(),
-                "1".to_string(),
-                Rc::new(vec!["derive".to_string(), "rc".to_string()]),
-            ),
-            emit_cargo_dep("serde_json".to_string(), "1".to_string(), Rc::new(vec![])),
-            emit_cargo_dep("libc".to_string(), "0.2".to_string(), Rc::new(vec![])),
-            emit_cargo_dep("stacker".to_string(), "0.1".to_string(), Rc::new(vec![])),
-            emit_cargo_dep("lazy_static".to_string(), "1".to_string(), Rc::new(vec![])),
-            emit_cargo_dep(
-                "ureq".to_string(),
-                "2".to_string(),
-                Rc::new(vec!["json".to_string()]),
-            ),
-        ]);
-        let cli_deps = if demand.renders_clap_cli.clone() {
-            Rc::new(vec![emit_cargo_dep(
-                "clap".to_string(),
-                "4".to_string(),
-                Rc::new(vec!["derive".to_string()]),
-            )])
-        } else {
-            Rc::new(vec![])
-        };
-        let async_deps = if demand.renders_async_services.clone() {
-            Rc::new(vec![
-                emit_cargo_dep(
-                    "tokio".to_string(),
-                    "1".to_string(),
-                    Rc::new(vec!["full".to_string()]),
-                ),
-                emit_cargo_dep_no_default_features(
-                    "reqwest".to_string(),
-                    "0.12".to_string(),
-                    Rc::new(vec![
-                        "json".to_string(),
-                        "rustls-tls".to_string(),
-                        "http2".to_string(),
-                        "charset".to_string(),
-                    ]),
-                ),
-                emit_cargo_dep(
-                    "async-trait".to_string(),
-                    "0.1".to_string(),
-                    Rc::new(vec![]),
-                ),
-            ])
-        } else {
-            Rc::new(vec![])
-        };
-        v1_rt::concat(
-            base_deps.clone(),
-            v1_rt::concat(cli_deps.clone(), async_deps.clone()),
-        )
-    }
-}
-
-pub fn emit_cargo_toml(crate_name: String, demand: EmittedCrateDependencyDemand) -> Rc<TextFile> {
-    {
-        let header = v1_rt::concat(
-            crate::extdeps_cargo_version::render_cargo_package_header_prefix(crate_name.clone()),
-            "\nedition = \"2021\"\n".to_string(),
-        );
-        let workspace = "\n[workspace]\n".to_string();
-        let all_deps = emitted_crate_dependency_lines(demand.clone());
-        let features = emit_cargo_features_section(
-            crate::v1_compiler_runtime_rust::rust_runtime_cargo_features(),
-        );
-        Rc::new(TextFile {
-            path: "Cargo.toml".to_string(),
-            content: v1_rt::concat(
-                v1_rt::concat(
-                    v1_rt::concat(
-                        v1_rt::concat(header.clone(), workspace.clone()),
-                        features.clone(),
-                    ),
-                    "\n[dependencies]\n".to_string(),
-                ),
-                all_deps.clone().join(&"".to_string()),
-            ),
-        })
-    }
-}
-
 pub fn emit_cargo_feature(feature: Rc<CargoFeature>) -> String {
     if ((feature.dependencies.clone().len() as i64) == 0) {
         v1_rt::concat(feature.name.clone(), " = []\n".to_string())
@@ -41547,11 +42123,417 @@ pub fn emit_gunbc_cli_dispatch_generated(crate_name: String) -> Rc<TextFile> {
     )
 }
 
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct NativeEntryEffects {
+    pub entry_module: String,
+    pub entry_function: String,
+    pub admissions: Rc<Vec<Rc<NativeEffectRealizationAdmission>>>,
+}
+
+pub fn native_entry_function_name(modules: Rc<Vec<Rc<TypedModule>>>) -> Option<String> {
+    if compiler_pipeline_entry_is_native_serve(modules.clone()) {
+        Some(native_serve_entry_function())
+    } else {
+        if compiler_pipeline_entry_is_native_cli(modules.clone()) {
+            Some(native_cli_entry_function())
+        } else {
+            if compiler_pipeline_entry_is_native_claim(modules.clone()) {
+                Some(native_claim_entry_function())
+            } else {
+                std::option::Option::None
+            }
+        }
+    }
+}
+
+pub fn native_serve_entry_function() -> String {
+    thread_local! {
+        static CACHED: String = {
+            "native_serve_handle".to_string()
+        };
+    }
+    CACHED.with(|c: &String| c.clone())
+}
+
+pub fn native_cli_entry_function() -> String {
+    thread_local! {
+        static CACHED: String = {
+            "v2_cli_main".to_string()
+        };
+    }
+    CACHED.with(|c: &String| c.clone())
+}
+
+pub fn native_claim_entry_function() -> String {
+    thread_local! {
+        static CACHED: String = {
+            "native_claim_report".to_string()
+        };
+    }
+    CACHED.with(|c: &String| c.clone())
+}
+
+pub fn native_effect_decl_sites(
+    modules: Rc<Vec<Rc<TypedModule>>>,
+    kind: ParsedModuleItemKind,
+    name: String,
+) -> Rc<Vec<Rc<NativeEffectDeclSite>>> {
+    Rc::new({
+        let mut __result = Vec::new();
+        for tm in modules.iter().cloned() {
+            __result.extend(
+                (*{
+                    let si = tm.type_env.clone().source_indices.clone();
+                    let module_name =
+                        crate::v1_std_core::authored_name_at(si.clone(), tm.module.clone());
+                    Rc::new({
+                        let mut __result = Vec::new();
+                        for item in Rc::new({
+                            let mut __result = Vec::new();
+                            for item in tm.items.clone().iter().cloned() {
+                                if ((item.module_item_kind.clone() == kind.clone())
+                                    && (crate::v1_std_core::authored_name_at(
+                                        si.clone(),
+                                        item.clone(),
+                                    ) == name.clone()))
+                                {
+                                    __result.push(item);
+                                }
+                            }
+                            __result
+                        })
+                        .iter()
+                        .cloned()
+                        {
+                            __result.push(Rc::new(NativeEffectDeclSite {
+                                item: item.clone(),
+                                module_name: module_name.clone(),
+                            }));
+                        }
+                        __result
+                    })
+                })
+                .iter()
+                .cloned(),
+            );
+        }
+        __result
+    })
+}
+
+pub fn native_entry_denominator(modules: Rc<Vec<Rc<TypedModule>>>) -> Rc<NativeEffectDenominator> {
+    if compiler_pipeline_entry_is_native_serve(modules.clone()) {
+        native_service_route_denominator()
+    } else {
+        if compiler_pipeline_entry_is_native_claim(modules.clone()) {
+            native_claim_route_denominator()
+        } else {
+            native_compiler_route_denominator()
+        }
+    }
+}
+
+pub fn native_entry_effects(
+    modules: Rc<Vec<Rc<TypedModule>>>,
+    registry: Rc<HashMap<String, Rc<ItemInfo>>>,
+) -> Option<Rc<NativeEntryEffects>> {
+    match native_entry_function_name(modules.clone()) {
+        std::option::Option::None => std::option::Option::None,
+        Some(entry_fn) => {
+            let entry_module = compiler_pipeline_entry_module_name(modules.clone());
+            let denominator = native_entry_denominator(modules.clone());
+            let entry_si = Rc::new({
+                let mut __result = Vec::new();
+                for tm in Rc::new({
+                    let mut __result = Vec::new();
+                    for tm in modules.iter().cloned() {
+                        if (crate::v1_std_core::authored_name_at(
+                            tm.type_env.clone().source_indices.clone(),
+                            tm.module.clone(),
+                        ) == entry_module.clone())
+                        {
+                            __result.push(tm);
+                        }
+                    }
+                    __result
+                })
+                .iter()
+                .cloned()
+                {
+                    __result.push(tm.type_env.clone().source_indices.clone());
+                }
+                __result
+            })
+            .first()
+            .cloned();
+            let si = match entry_si.clone() {
+                Some(x) => x.clone(),
+                std::option::Option::None => v1_rt::rc_empty_map::<String, Rc<NewlineIndex>>(),
+            };
+            let info = crate::v1_compiler_emit::lookup_item_by_identity(
+                registry.clone(),
+                Rc::new(DeclaredCallableIdentity {
+                    owner_module_path: entry_module.clone(),
+                    decl_name: entry_fn.clone(),
+                }),
+            );
+            let resources = match info.clone() {
+                Some(i) => i.resource_requirements.clone(),
+                std::option::Option::None => Rc::new(vec![]),
+            };
+            let services = match info.clone() {
+                Some(i) => i.service_names.clone(),
+                std::option::Option::None => Rc::new(vec![]),
+            };
+            let resource_admissions = Rc::new({
+                let mut __result = Vec::new();
+                for r in resources.iter().cloned() {
+                    __result.push({
+                        let rname = type_leaf_name_for_collapse(r.resource.clone(), si.clone());
+                        crate::v1_compiler_emit::admit_native_resource_effect(
+                            r.binding_name.clone(),
+                            rname.clone(),
+                            crate::v1_compiler_emit::native_effect_resolution(
+                                native_effect_decl_sites(
+                                    modules.clone(),
+                                    ParsedModuleItemKind::ModuleItemResource,
+                                    rname.clone(),
+                                ),
+                            ),
+                            denominator.clone(),
+                        )
+                    });
+                }
+                __result
+            });
+            let service_admissions = Rc::new({
+                let mut __result = Vec::new();
+                for sn in services.iter().cloned() {
+                    __result.push(crate::v1_compiler_emit::admit_native_service_effect(
+                        sn.clone(),
+                        crate::v1_compiler_emit::native_effect_resolution(
+                            native_effect_decl_sites(
+                                modules.clone(),
+                                ParsedModuleItemKind::ModuleItemService,
+                                sn.clone(),
+                            ),
+                        ),
+                        denominator.clone(),
+                        si.clone(),
+                    ));
+                }
+                __result
+            });
+            Some(Rc::new(NativeEntryEffects {
+                entry_module: entry_module.clone(),
+                entry_function: entry_fn.clone(),
+                admissions: v1_rt::concat(resource_admissions.clone(), service_admissions.clone()),
+            }))
+        }
+    }
+}
+
+pub fn native_entry_effect_diagnostics(
+    effects: Option<Rc<NativeEntryEffects>>,
+    modules: Rc<Vec<Rc<TypedModule>>>,
+) -> Rc<Vec<Rc<ErrorNode>>> {
+    match effects.clone() {
+        std::option::Option::None => Rc::new(vec![]),
+        Some(e) => {
+            let refusals = Rc::new({
+                let mut __result = Vec::new();
+                for a in e.admissions.clone().iter().cloned() {
+                    __result.extend(
+                        (*match crate::v1_compiler_emit::native_effect_admission_refusal(a.clone())
+                        {
+                            Some(r) => Rc::new(vec![r.clone()]),
+                            std::option::Option::None => Rc::new(vec![]),
+                        })
+                        .iter()
+                        .cloned(),
+                    );
+                }
+                __result
+            });
+            if ((refusals.clone().len() as i64) == 0) {
+                Rc::new(vec![])
+            } else {
+                {
+                    let span = Rc::new({
+                        let mut __result = Vec::new();
+                        for tm in Rc::new({
+                            let mut __result = Vec::new();
+                            for tm in modules.iter().cloned() {
+                                if (crate::v1_std_core::authored_name_at(
+                                    tm.type_env.clone().source_indices.clone(),
+                                    tm.module.clone(),
+                                ) == e.entry_module.clone())
+                                {
+                                    __result.push(tm);
+                                }
+                            }
+                            __result
+                        })
+                        .iter()
+                        .cloned()
+                        {
+                            __result.push(tm.module.clone().span.clone());
+                        }
+                        __result
+                    })
+                    .first()
+                    .cloned();
+                    match span.clone() {
+                        Some(sp) => Rc::new(vec![crate::v1_std_core::make_error_node(
+                            Rc::new(CompilerDiagnostic::NativeEffectRealizationRefused {
+                                entry: v1_rt::concat(
+                                    e.entry_module.clone(),
+                                    v1_rt::concat(".".to_string(), e.entry_function.clone()),
+                                ),
+                                refusals: refusals.clone(),
+                                span: sp.clone(),
+                            }),
+                            e.entry_module.clone(),
+                        )]),
+                        std::option::Option::None => {
+                            Rc::new(vec![crate::v1_std_core::make_error_node(
+                                Rc::new(CompilerDiagnostic::NativeEffectRealizationRefused {
+                                    entry: v1_rt::concat(
+                                        e.entry_module.clone(),
+                                        v1_rt::concat(".".to_string(), e.entry_function.clone()),
+                                    ),
+                                    refusals: v1_rt::concat(
+                                        refusals.clone(),
+                                        Rc::new(vec![
+                                            "the entry module is not in the closure".to_string()
+                                        ]),
+                                    ),
+                                    span: crate::v1_std_core::no_span(),
+                                }),
+                                e.entry_module.clone(),
+                            )])
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct NativeEffectBindingText {
+    pub var: String,
+    pub type_path: String,
+    pub binding_line: String,
+    pub argument: String,
+}
+
+pub fn native_effect_binding_of(
+    var: String,
+    type_path: String,
+    constructor: String,
+) -> Rc<NativeEffectBindingText> {
+    Rc::new(NativeEffectBindingText {
+        var: var.clone(),
+        type_path: type_path.clone(),
+        binding_line: v1_rt::concat(
+            v1_rt::concat(
+                v1_rt::concat(
+                    v1_rt::concat("    let ".to_string(), var.clone()),
+                    " = ".to_string(),
+                ),
+                constructor.clone(),
+            ),
+            ";\n".to_string(),
+        ),
+        argument: v1_rt::concat("&".to_string(), var.clone()),
+    })
+}
+
+pub fn native_effect_binding_text(
+    a: Rc<NativeEffectRealizationAdmission>,
+    crate_name: String,
+) -> Option<Rc<NativeEffectBindingText>> {
+    match (*a.clone()).clone() {
+        NativeEffectRealizationAdmission::NativeEffectHandlerBound {
+            effect_contract: c, ..
+        } => match (*c.clone()).clone() {
+            NativeEffectContract::NativeServiceEffect { declaration: d, .. } => {
+                let sn = d.decl_name.clone();
+                let path = v1_rt::concat(
+                    v1_rt::concat(
+                        v1_rt::concat(
+                            v1_rt::concat(crate_name.clone(), "::".to_string()),
+                            crate::gunbc_rust_emitted_edge::module_to_filename(
+                                d.module_path.clone(),
+                            ),
+                        ),
+                        "::".to_string(),
+                    ),
+                    crate::v1_compiler_emit_core_support::sanitize_service_name(sn.clone()),
+                );
+                Some(native_effect_binding_of(
+                    crate::v1_compiler_emit_core_support::service_var_name(sn.clone()),
+                    path.clone(),
+                    v1_rt::concat(path.clone(), "::new(Default::default())".to_string()),
+                ))
+            }
+            NativeEffectContract::NativeResourceEffect {
+                binding: b,
+                declaration: d,
+                ..
+            } => {
+                let path = v1_rt::concat(
+                    v1_rt::concat(
+                        v1_rt::concat(
+                            v1_rt::concat(crate_name.clone(), "::".to_string()),
+                            crate::gunbc_rust_emitted_edge::module_to_filename(
+                                d.module_path.clone(),
+                            ),
+                        ),
+                        "::".to_string(),
+                    ),
+                    d.decl_name.clone(),
+                );
+                Some(native_effect_binding_of(
+                    crate::v1_compiler_emit::emit_ident(b.clone(), RenderTarget::Rust),
+                    path.clone(),
+                    path.clone(),
+                ))
+            }
+        },
+        _ => std::option::Option::None,
+    }
+}
+
+pub fn native_effect_bindings(
+    effects: Option<Rc<NativeEntryEffects>>,
+    crate_name: String,
+) -> Rc<Vec<Rc<NativeEffectBindingText>>> {
+    match effects.clone() {
+        std::option::Option::None => Rc::new(vec![]),
+        Some(e) => Rc::new({
+            let mut __result = Vec::new();
+            for a in e.admissions.clone().iter().cloned() {
+                __result.extend(
+                    (*match native_effect_binding_text(a.clone(), crate_name.clone()) {
+                        Some(t) => Rc::new(vec![t.clone()]),
+                        std::option::Option::None => Rc::new(vec![]),
+                    })
+                    .iter()
+                    .cloned(),
+                );
+            }
+            __result
+        }),
+    }
+}
+
 pub fn emit_main_rs(
     modules: Rc<Vec<Rc<TypedModule>>>,
     has_services: bool,
     crate_name: String,
-    registry: Rc<HashMap<String, Rc<ItemInfo>>>,
+    effects: Option<Rc<NativeEntryEffects>>,
 ) -> Rc<TextFile> {
     {
         let retained_host_pipeline = compiler_pipeline_entry_is_retained_host(modules.clone());
@@ -41581,22 +42563,21 @@ pub fn emit_main_rs(
                     return emit_native_cli_driver_main_rs(
                         crate_name.clone(),
                         pipeline_module.clone(),
+                        native_effect_bindings(effects.clone(), crate_name.clone()),
                     );
                 }
                 if compiler_pipeline_entry_is_native_claim(modules.clone()) {
                     return emit_native_claim_driver_main_rs(
                         crate_name.clone(),
                         pipeline_module.clone(),
-                        native_claim_report_effect_demand(
-                            registry.clone(),
-                            pipeline_module.clone(),
-                        ),
+                        native_effect_bindings(effects.clone(), crate_name.clone()),
                     );
                 }
                 if compiler_pipeline_entry_is_native_serve(modules.clone()) {
                     return emit_native_serve_driver_main_rs(
                         crate_name.clone(),
                         pipeline_module.clone(),
+                        native_effect_bindings(effects.clone(), crate_name.clone()),
                     );
                 }
                 if compiler_pipeline_entry_is_direct_ingest(modules.clone()) {
@@ -41674,107 +42655,26 @@ pub fn emit_direct_ingest_driver_main_rs(
 }
 
 pub fn emit_host_source_root_read_rs(crate_name: String) -> String {
-    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("fn read_ingest(source_roots: &[String]) -> Vec<Rc<DagSourceReadWitness>> {\n".to_string(), "    let filesystem = ".to_string()), crate_name.clone()), "::extdeps_filesystem_filesystem_io::Filesystem::new(Default::default());\n".to_string()), "    let runtime = match tokio::runtime::Builder::new_current_thread().build() { Ok(runtime) => runtime, Err(cause) => { eprintln!(\"REFUSED: native filesystem executor: {}\", cause); std::process::exit(2); } };\n".to_string()), "    let observed = runtime.block_on(".to_string()), crate_name.clone()), "::gunbc_source_root_read::source_root_read(Rc::new(source_roots.iter().cloned().collect()), &filesystem));\n".to_string()), "    match observed {\n".to_string()), "        Ok(files) => match &*files {\n".to_string()), "            ".to_string()), crate_name.clone()), "::gunbc_source_root_read::SourceRootFiles::SourceRootFilesRead { files } =>\n".to_string()), "                ".to_string()), crate_name.clone()), "::v2_compiler_source_authority::source_root_ingest_from_files(files.clone()).iter().cloned().collect(),\n".to_string()), "            ".to_string()), crate_name.clone()), "::gunbc_source_root_read::SourceRootFiles::SourceRootFilesRefused { path, kind, cause } => {\n".to_string()), "                eprintln!(\"REFUSED: could not read source root at {} [{}]: {}\", path, kind, cause); std::process::exit(2);\n".to_string()), "            }\n".to_string()), "        },\n".to_string()), "        Err(cause) => { eprintln!(\"REFUSED: native filesystem transport: {}\", cause); std::process::exit(2); }\n".to_string()), "    }\n".to_string()), "}\n".to_string())
-}
-
-#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
-#[serde(tag = "_variant")]
-pub enum NativeClaimEffectDemand {
-    NativeClaimPure,
-    NativeClaimFilesystem,
-    NativeClaimUndeclaredEffect { detail: String },
-}
-impl NativeClaimEffectDemand {
-    pub fn detail(&self) -> String {
-        match self {
-            NativeClaimEffectDemand::NativeClaimPure => panic!("no detail on unit variant"),
-            NativeClaimEffectDemand::NativeClaimFilesystem => panic!("no detail on unit variant"),
-            NativeClaimEffectDemand::NativeClaimUndeclaredEffect { detail: __val, .. } => {
-                __val.clone()
-            }
-        }
-    }
-}
-
-pub fn native_claim_report_effect_demand(
-    registry: Rc<HashMap<String, Rc<ItemInfo>>>,
-    pipeline_module: String,
-) -> Rc<NativeClaimEffectDemand> {
-    match crate::v1_compiler_emit::lookup_item_by_identity(
-        registry.clone(),
-        Rc::new(DeclaredCallableIdentity {
-            owner_module_path: pipeline_module.clone(),
-            decl_name: "native_claim_report".to_string(),
-        }),
-    ) {
-        Some(info) => {
-            if !crate::v1_compiler_infer_items::item_is_effectful_callee(info.clone()) {
-                Rc::new(NativeClaimEffectDemand::NativeClaimPure)
-            } else {
-                if ((((crate::v1_compiler_infer_items::item_resource_names(info.clone()).len()
-                    as i64)
-                    == 0)
-                    && ((info.service_names.clone().len() as i64) == 1))
-                    && {
-                        let mut __all = true;
-                        for sn in info.service_names.clone().iter().cloned() {
-                            if !(crate::v1_compiler_emit_core_support::service_var_name(sn.clone())
-                                == "filesystem".to_string())
-                            {
-                                __all = false;
-                                break;
-                            }
-                        }
-                        __all
-                    })
-                {
-                    Rc::new(NativeClaimEffectDemand::NativeClaimFilesystem)
-                } else {
-                    Rc::new(NativeClaimEffectDemand::NativeClaimUndeclaredEffect {
-                        detail: v1_rt::concat(
-                            "services [".to_string(),
-                            v1_rt::concat(
-                                info.service_names.clone().join(&", ".to_string()),
-                                v1_rt::concat(
-                                    "] resources [".to_string(),
-                                    v1_rt::concat(
-                                        crate::v1_compiler_infer_items::item_resource_names(
-                                            info.clone(),
-                                        )
-                                        .join(&", ".to_string()),
-                                        "]".to_string(),
-                                    ),
-                                ),
-                            ),
-                        ),
-                    })
-                }
-            }
-        }
-        std::option::Option::None => {
-            Rc::new(NativeClaimEffectDemand::NativeClaimUndeclaredEffect {
-                detail: "native_claim_report has no registry row".to_string(),
-            })
-        }
-    }
+    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("fn read_ingest(source_roots: &[String]) -> Vec<Rc<DagSourceReadWitness>> {\n".to_string(), "    let filesystem = ".to_string()), crate_name.clone()), "::extdeps_filesystem_filesystem_io::Filesystem::new(Default::default());\n".to_string()), "    let runtime = match tokio::runtime::Builder::new_current_thread().build() { Ok(runtime) => runtime, Err(cause) => { eprintln!(\"REFUSED: native filesystem executor: {}\", cause); std::process::exit(2); } };\n".to_string()), "    let observed = runtime.block_on(".to_string()), crate_name.clone()), "::gunbc_source_root_read::source_root_read(Rc::new(source_roots.iter().cloned().collect()), &filesystem));\n".to_string()), "    match observed {\n".to_string()), "        Ok(files) => match &*files {\n".to_string()), "            ".to_string()), crate_name.clone()), "::gunbc_source_root_read::SourceRootFiles::SourceRootFilesRead { files } => match &*".to_string()), crate_name.clone()), "::v2_compiler_source_authority::source_root_ingest_from_files(files.clone()) {\n".to_string()), "                ".to_string()), crate_name.clone()), "::v2_compiler_source_authority::SourceRootIngestFromFiles::SourceRootIngestFromFilesBuilt { ingest } => ingest.iter().cloned().collect(),\n".to_string()), "                ".to_string()), crate_name.clone()), "::v2_compiler_source_authority::SourceRootIngestFromFiles::SourceRootIngestFromFilesUnrecognizedRoot { argument, path } => {\n".to_string()), "                    eprintln!(\"REFUSED: source root is not a dag or src/v2 tree: {} (file {})\", argument, path); std::process::exit(2);\n".to_string()), "                }\n".to_string()), "            },\n".to_string()), "            ".to_string()), crate_name.clone()), "::gunbc_source_root_read::SourceRootFiles::SourceRootFilesRefused { path, kind, cause } => {\n".to_string()), "                eprintln!(\"REFUSED: could not read source root at {} [{}]: {}\", path, kind, cause); std::process::exit(2);\n".to_string()), "            }\n".to_string()), "        },\n".to_string()), "        Err(cause) => { eprintln!(\"REFUSED: native filesystem transport: {}\", cause); std::process::exit(2); }\n".to_string()), "    }\n".to_string()), "}\n".to_string())
 }
 
 pub fn emit_native_claim_driver_main_rs(
     crate_name: String,
     pipeline_module: String,
-    demand: Rc<NativeClaimEffectDemand>,
+    bindings: Rc<Vec<Rc<NativeEffectBindingText>>>,
 ) -> Rc<TextFile> {
     {
         let pipeline_mod =
             crate::gunbc_rust_emitted_edge::module_to_filename(pipeline_module.clone());
-        match (*demand.clone()).clone() {
-    NativeClaimEffectDemand::NativeClaimPure => emit_native_claim_driver_pure_main_rs(crate_name.clone(), pipeline_mod.clone()),
-    NativeClaimEffectDemand::NativeClaimFilesystem => emit_native_claim_driver_filesystem_main_rs(crate_name.clone(), pipeline_mod.clone()),
-    NativeClaimEffectDemand::NativeClaimUndeclaredEffect { detail: detail, .. } => Rc::new(TextFile {
-    path: v1_rt::concat(v1_rt::concat(rust_source_root(), "main".to_string()), rust_source_ext()),
-    content: v1_rt::concat("// Generated by v1 compiler -- do not edit.\n\ncompile_error!(\"REFUSED: a NativeClaimDriver report may demand only the Filesystem service; ".to_string(), v1_rt::concat(crate::v1_compiler_emit_core_support::escape_string_literal_body(detail.clone()), "\");\n".to_string())),
-}),
-}
+        if ((bindings.clone().len() as i64) == 0) {
+            emit_native_claim_driver_pure_main_rs(crate_name.clone(), pipeline_mod.clone())
+        } else {
+            emit_native_claim_driver_effect_main_rs(
+                crate_name.clone(),
+                pipeline_mod.clone(),
+                bindings.clone(),
+            )
+        }
     }
 }
 
@@ -41782,14 +42682,33 @@ pub fn native_claim_terminal_exit_lines() -> String {
     v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("    print!(\"{}\", report.stdout);".to_string(), "\n".to_string()), "    match &*report.terminal {".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimHeld => std::process::exit(0),".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimNotHeld { reason } => {".to_string()), "\n".to_string()), "            eprintln!(\"NOT HELD: {reason}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimNoObservation { reason } => {".to_string()), "\n".to_string()), "            eprintln!(\"NO OBSERVATION: {reason}\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string())
 }
 
-pub fn emit_native_claim_driver_filesystem_main_rs(
+pub fn emit_native_claim_driver_effect_main_rs(
     crate_name: String,
     pipeline_mod: String,
+    bindings: Rc<Vec<Rc<NativeEffectBindingText>>>,
 ) -> Rc<TextFile> {
-    Rc::new(TextFile {
+    {
+        let binding_lines = Rc::new({
+            let mut __result = Vec::new();
+            for b in bindings.iter().cloned() {
+                __result.push(b.binding_line.clone());
+            }
+            __result
+        })
+        .join(&"".to_string());
+        let effect_args = Rc::new({
+            let mut __result = Vec::new();
+            for b in bindings.iter().cloned() {
+                __result.push(b.argument.clone());
+            }
+            __result
+        })
+        .join(&", ".to_string());
+        Rc::new(TextFile {
     path: v1_rt::concat(v1_rt::concat(rust_source_root(), "main".to_string()), rust_source_ext()),
-    content: v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("// Generated by v1 compiler -- do not edit.".to_string(), "\n".to_string()), "\n".to_string()), "#![allow(unused_parens, clippy::all, clippy::disallowed_macros)]".to_string()), "\n".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_compiler_entry::NativeClaimTerminal;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::".to_string()), pipeline_mod.clone()), "::native_claim_report;".to_string()), "\n".to_string()), "\n".to_string()), "#[tokio::main(flavor = \"current_thread\")]".to_string()), "\n".to_string()), "async fn main() {".to_string()), "\n".to_string()), "    let filesystem = ".to_string()), crate_name.clone()), "::extdeps_filesystem_filesystem_io::Filesystem::new(Default::default());".to_string()), "\n".to_string()), "    let report = match native_claim_report(&filesystem).await {".to_string()), "\n".to_string()), "        Ok(report) => report,".to_string()), "\n".to_string()), "        Err(cause) => { eprintln!(\"NO OBSERVATION: native filesystem transport: {}\", cause); std::process::exit(2); }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), native_claim_terminal_exit_lines()), "}".to_string()), "\n".to_string()),
+    content: v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("// Generated by v1 compiler -- do not edit.".to_string(), "\n".to_string()), "\n".to_string()), "#![allow(unused_parens, clippy::all, clippy::disallowed_macros)]".to_string()), "\n".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_compiler_entry::NativeClaimTerminal;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::".to_string()), pipeline_mod.clone()), "::native_claim_report;".to_string()), "\n".to_string()), "\n".to_string()), "#[tokio::main(flavor = \"current_thread\")]".to_string()), "\n".to_string()), "async fn main() {".to_string()), "\n".to_string()), binding_lines.clone()), "    let report = match native_claim_report(".to_string()), effect_args.clone()), ").await {".to_string()), "\n".to_string()), "        Ok(report) => report,".to_string()), "\n".to_string()), "        Err(cause) => { eprintln!(\"NO OBSERVATION: native effect transport: {}\", cause); std::process::exit(2); }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), native_claim_terminal_exit_lines()), "}".to_string()), "\n".to_string()),
 })
+    }
 }
 
 pub fn emit_native_claim_driver_pure_main_rs(
@@ -41805,24 +42724,77 @@ pub fn emit_native_claim_driver_pure_main_rs(
 pub fn emit_native_serve_driver_main_rs(
     crate_name: String,
     pipeline_module: String,
+    bindings: Rc<Vec<Rc<NativeEffectBindingText>>>,
 ) -> Rc<TextFile> {
     {
         let pipeline_mod =
             crate::gunbc_rust_emitted_edge::module_to_filename(pipeline_module.clone());
+        let effectful = ((bindings.clone().len() as i64) > 0);
+        let binding_lines = Rc::new({
+            let mut __result = Vec::new();
+            for b in bindings.iter().cloned() {
+                __result.push(b.binding_line.clone());
+            }
+            __result
+        })
+        .join(&"".to_string());
+        let handler_effect_args = Rc::new({
+            let mut __result = Vec::new();
+            for b in bindings.iter().cloned() {
+                __result.push(v1_rt::concat(", ".to_string(), b.argument.clone()));
+            }
+            __result
+        })
+        .join(&"".to_string());
+        let effect_failed_import = if effectful.clone() {
+            " native_serve_effect_failed,".to_string()
+        } else {
+            "".to_string()
+        };
+        let worker_realize = if effectful.clone() {
+            v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("        let runtime = match tokio::runtime::Builder::new_current_thread().enable_all().build() {".to_string(), "\n".to_string()), "            Ok(runtime) => runtime,".to_string()), "\n".to_string()), "            Err(cause) => { let _ = ready.send(Err(format!(\"native effect executor: {}\", cause))); return; }".to_string()), "\n".to_string()), "        };".to_string()), "\n".to_string()), binding_lines.clone())
+        } else {
+            "".to_string()
+        };
+        let worker_call = if effectful.clone() {
+            v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("            let response = match runtime.block_on(native_serve_handle(call.method, call.path, call.body, call.tailscale_identity, call.release_revision".to_string(), handler_effect_args.clone()), ")) {".to_string()), "\n".to_string()), "                Ok(response) => response,".to_string()), "\n".to_string()), "                Err(cause) => native_serve_effect_failed(cause.to_string()),".to_string()), "\n".to_string()), "            };".to_string()), "\n".to_string())
+        } else {
+            "            let response = native_serve_handle(call.method, call.path, call.body, call.tailscale_identity, call.release_revision);\n".to_string()
+        };
         Rc::new(TextFile {
     path: v1_rt::concat(v1_rt::concat(rust_source_root(), "main".to_string()), rust_source_ext()),
-    content: v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("// Generated by v1 compiler -- do not edit.".to_string(), "\n".to_string()), "\n".to_string()), "#![allow(unused_parens, clippy::all, clippy::disallowed_macros)]".to_string()), "\n".to_string()), "\n".to_string()), "use std::io::{BufRead, Read, Write};".to_string()), "\n".to_string()), "use std::rc::Rc;".to_string()), "\n".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::extdeps_http_server::ServeWireResponse;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_measure::{byte_size_count, millisecond_count};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::gunbc_native_serve::{".to_string()), "\n".to_string()), "    native_serve_announcement, native_serve_frame, native_serve_handler_name, native_serve_read_refused,".to_string()), "\n".to_string()), "    native_serve_admission, native_serve_deadline_refused, native_serve_handler_failed, native_serve_outgoing, native_serve_route,".to_string()), "\n".to_string()), "    native_serve_start, NativeServeAdmission, NativeServeContract, NativeServeFrame, NativeServeOutgoing,".to_string()), "\n".to_string()), "    NativeServeRoute, NativeServeStart,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::".to_string()), pipeline_mod.clone()), "::native_serve_handle;".to_string()), "\n".to_string()), "\n".to_string()), "// What a worker hands back across the thread boundary: owned plain values, because the compiled".to_string()), "\n".to_string()), "// handler's values are reference-counted and stay on the worker's thread.".to_string()), "\n".to_string()), "struct WireParts {".to_string()), "\n".to_string()), "    status: i64,".to_string()), "\n".to_string()), "    content_type_label: String,".to_string()), "\n".to_string()), "    header_lines: Vec<String>,".to_string()), "\n".to_string()), "    body: String,".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn wire_parts(response: &NativeServeOutgoing) -> WireParts {".to_string()), "\n".to_string()), "    WireParts {".to_string()), "\n".to_string()), "        status: response.status,".to_string()), "\n".to_string()), "        content_type_label: response.content_type_label.clone(),".to_string()), "\n".to_string()), "        header_lines: response.header_lines.iter().cloned().collect(),".to_string()), "\n".to_string()), "        body: response.body.clone(),".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn write_parts(stream: &mut std::net::TcpStream, response: &WireParts) {".to_string()), "\n".to_string()), "    let mut head = format!(".to_string()), "\n".to_string()), "        \"HTTP/1.1 {} \\r\\nContent-Type: {}\\r\\nContent-Length: {}\\r\\nConnection: close\\r\\n\",".to_string()), "\n".to_string()), "        response.status, response.content_type_label, response.body.len()".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    for line in response.header_lines.iter() { head.push_str(line); head.push_str(\"\\r\\n\"); }".to_string()), "\n".to_string()), "    head.push_str(\"\\r\\n\");".to_string()), "\n".to_string()), "    if let Err(cause) = stream.write_all(head.as_bytes()).and_then(|_| stream.write_all(response.body.as_bytes())) {".to_string()), "\n".to_string()), "        eprintln!(\"native-serve: write error: {}\", cause);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn write_response(stream: &mut std::net::TcpStream, response: &NativeServeOutgoing) {".to_string()), "\n".to_string()), "    write_parts(stream, &wire_parts(response));".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "// A worker's state, shared with the loop: whether the loop stopped waiting for it. The loop counts a".to_string()), "\n".to_string()), "// worker as stuck only when it abandons it, and the worker uncounts itself when it finally returns,".to_string()), "\n".to_string()), "// under one lock, so the count is exact whichever side gets there first.".to_string()), "\n".to_string()), "const WORKER_WAITING: u8 = 0;".to_string()), "\n".to_string()), "const WORKER_ABANDONED: u8 = 1;".to_string()), "\n".to_string()), "const WORKER_DONE: u8 = 2;".to_string()), "\n".to_string()), "\n".to_string()), "fn lock_state<T>(m: &std::sync::Mutex<T>) -> std::sync::MutexGuard<'_, T> {".to_string()), "\n".to_string()), "    m.lock().unwrap_or_else(|e| e.into_inner())".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "// The worker's cleanup, run when its guard drops: on return AND during a panic's unwind. A worker the".to_string()), "\n".to_string()), "// loop abandoned uncounts itself here, exactly once; every worker ends DONE.".to_string()), "\n".to_string()), "struct WorkerGuard {".to_string()), "\n".to_string()), "    state: std::sync::Arc<std::sync::Mutex<u8>>,".to_string()), "\n".to_string()), "    stuck: std::sync::Arc<std::sync::Mutex<usize>>,".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "impl Drop for WorkerGuard {".to_string()), "\n".to_string()), "    fn drop(&mut self) {".to_string()), "\n".to_string()), "        let mut s = lock_state(&self.state);".to_string()), "\n".to_string()), "        if *s == WORKER_ABANDONED {".to_string()), "\n".to_string()), "            let mut n = lock_state(&self.stuck);".to_string()), "\n".to_string()), "            *n = n.saturating_sub(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        *s = WORKER_DONE;".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "struct HandlerCall {".to_string()), "\n".to_string()), "    method: String,".to_string()), "\n".to_string()), "    path: String,".to_string()), "\n".to_string()), "    body: String,".to_string()), "\n".to_string()), "    tailscale_identity: String,".to_string()), "\n".to_string()), "    release_revision: String,".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn read_line(reader: &mut impl BufRead, budget: &mut usize) -> Result<Option<String>, String> {".to_string()), "\n".to_string()), "    let mut bytes = Vec::new();".to_string()), "\n".to_string()), "    match reader.read_until(b'\\n', &mut bytes) {".to_string()), "\n".to_string()), "        Ok(0) => return Ok(None),".to_string()), "\n".to_string()), "        Ok(n) if n > *budget => return Err(\"the request head exceeds the serve head limit\".to_string()),".to_string()), "\n".to_string()), "        Ok(n) => *budget -= n,".to_string()), "\n".to_string()), "        Err(cause) if bytes.is_empty() && matches!(cause.kind(), std::io::ErrorKind::WouldBlock | std::io::ErrorKind::TimedOut) => return Ok(None),".to_string()), "\n".to_string()), "        Err(cause) => return Err(format!(\"read: {}\", cause)),".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    if bytes.ends_with(b\"\\n\") { bytes.pop(); }".to_string()), "\n".to_string()), "    if bytes.ends_with(b\"\\r\") { bytes.pop(); }".to_string()), "\n".to_string()), "    String::from_utf8(bytes).map(Some).map_err(|_| \"the request head is not utf-8\".to_string())".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "enum Exchange {".to_string()), "\n".to_string()), "    Idle,".to_string()), "\n".to_string()), "    Answer(Rc<ServeWireResponse>),".to_string()), "\n".to_string()), "    Handle(HandlerCall),".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn exchange(stream: &std::net::TcpStream, contract: &Rc<NativeServeContract>, bound_host: &str, bound_port: i64) -> Exchange {".to_string()), "\n".to_string()), "    let limit = (byte_size_count(contract.head_limit.clone()) + byte_size_count(contract.body_limit.clone())) as u64;".to_string()), "\n".to_string()), "    let mut reader = std::io::BufReader::new(stream.take(limit));".to_string()), "\n".to_string()), "    let mut budget = byte_size_count(contract.head_limit.clone()) as usize;".to_string()), "\n".to_string()), "    let request_line = match read_line(&mut reader, &mut budget) {".to_string()), "\n".to_string()), "        Ok(Some(line)) => line,".to_string()), "\n".to_string()), "        Ok(None) => return Exchange::Idle,".to_string()), "\n".to_string()), "        Err(reason) => return Exchange::Answer(native_serve_read_refused(reason)),".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let mut header_lines = Vec::new();".to_string()), "\n".to_string()), "    loop {".to_string()), "\n".to_string()), "        match read_line(&mut reader, &mut budget) {".to_string()), "\n".to_string()), "            Ok(Some(line)) if line.is_empty() => break,".to_string()), "\n".to_string()), "            Ok(Some(line)) => header_lines.push(line),".to_string()), "\n".to_string()), "            Ok(None) => return Exchange::Answer(native_serve_read_refused(\"connection closed before end of headers\".to_string())),".to_string()), "\n".to_string()), "            Err(reason) => return Exchange::Answer(native_serve_read_refused(reason)),".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let head = match &*native_serve_frame(contract.clone(), request_line, Rc::new(header_lines.into())) {".to_string()), "\n".to_string()), "        NativeServeFrame::NativeServeFrameRefused { response } => return Exchange::Answer(response.clone()),".to_string()), "\n".to_string()), "        NativeServeFrame::NativeServeFramed { head, body_length } => {".to_string()), "\n".to_string()), "            let mut body = vec![0u8; *body_length as usize];".to_string()), "\n".to_string()), "            if let Err(cause) = reader.read_exact(&mut body) {".to_string()), "\n".to_string()), "                return Exchange::Answer(native_serve_read_refused(format!(\"read body: {}\", cause)));".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "            match String::from_utf8(body) {".to_string()), "\n".to_string()), "                Ok(text) => (head.clone(), text),".to_string()), "\n".to_string()), "                Err(_) => return Exchange::Answer(native_serve_read_refused(\"the body is not utf-8\".to_string())),".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let (head, body) = head;".to_string()), "\n".to_string()), "    match &*native_serve_route(contract.clone(), head.clone(), native_serve_handler_name(), bound_host.to_string(), bound_port) {".to_string()), "\n".to_string()), "        NativeServeRoute::NativeServeAnswered { response } => Exchange::Answer(response.clone()),".to_string()), "\n".to_string()), "        NativeServeRoute::NativeServeToHandler => Exchange::Handle(HandlerCall {".to_string()), "\n".to_string()), "            method: head.method.clone(),".to_string()), "\n".to_string()), "            path: head.target.clone(),".to_string()), "\n".to_string()), "            body,".to_string()), "\n".to_string()), "            tailscale_identity: head.tailscale_identity.clone(),".to_string()), "\n".to_string()), "            release_revision: contract.release_revision.clone(),".to_string()), "\n".to_string()), "        }),".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn main() {".to_string()), "\n".to_string()), "    let argv: Vec<String> = std::env::args().skip(1).collect();".to_string()), "\n".to_string()), "    let contract = match &*native_serve_start(Rc::new(argv.into())) {".to_string()), "\n".to_string()), "        NativeServeStart::NativeServeListen { contract } => contract.clone(),".to_string()), "\n".to_string()), "        NativeServeStart::NativeServeStartRefused { reason } => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: {}\", reason);".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let listener = match std::net::TcpListener::bind((contract.host.as_str(), contract.port as u16)) {".to_string()), "\n".to_string()), "        Ok(listener) => listener,".to_string()), "\n".to_string()), "        Err(cause) => { eprintln!(\"REFUSED: failed to bind {}:{}: {}\", contract.host, contract.port, cause); std::process::exit(2); }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let bound = match listener.local_addr() {".to_string()), "\n".to_string()), "        Ok(addr) => addr,".to_string()), "\n".to_string()), "        Err(cause) => { eprintln!(\"REFUSED: bound but could not read the bound address: {}\", cause); std::process::exit(2); }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let bound_host = bound.ip().to_string();".to_string()), "\n".to_string()), "    let bound_port = bound.port() as i64;".to_string()), "\n".to_string()), "    eprintln!(\"{}\", native_serve_announcement(contract.clone(), bound_host.clone(), bound_port));".to_string()), "\n".to_string()), "    let timeout = std::time::Duration::from_millis(millisecond_count(contract.read_timeout.clone()) as u64);".to_string()), "\n".to_string()), "    let deadline = std::time::Duration::from_millis(millisecond_count(contract.request_deadline.clone()) as u64);".to_string()), "\n".to_string()), "    let stuck = std::sync::Arc::new(std::sync::Mutex::new(0usize));".to_string()), "\n".to_string()), "    for accepted in listener.incoming() {".to_string()), "\n".to_string()), "        let mut stream = match accepted {".to_string()), "\n".to_string()), "            Ok(stream) => stream,".to_string()), "\n".to_string()), "            Err(cause) => { eprintln!(\"native-serve: accept error: {}\", cause); continue; }".to_string()), "\n".to_string()), "        };".to_string()), "\n".to_string()), "        if let Err(cause) = stream.set_read_timeout(Some(timeout)) {".to_string()), "\n".to_string()), "            eprintln!(\"native-serve: set_read_timeout: {}\", cause);".to_string()), "\n".to_string()), "            continue;".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        match exchange(&stream, &contract, &bound_host, bound_port) {".to_string()), "\n".to_string()), "            Exchange::Idle => {}".to_string()), "\n".to_string()), "            Exchange::Answer(response) => write_response(&mut stream, &native_serve_outgoing(response)),".to_string()), "\n".to_string()), "            Exchange::Handle(call) => {".to_string()), "\n".to_string()), "                let stuck_now = *lock_state(&stuck) as i64;".to_string()), "\n".to_string()), "                match &*native_serve_admission(contract.clone(), stuck_now) {".to_string()), "\n".to_string()), "                    NativeServeAdmission::NativeServeRefuseStuck { response, exit_code } => {".to_string()), "\n".to_string()), "                        write_response(&mut stream, &native_serve_outgoing(response.clone()));".to_string()), "\n".to_string()), "                        std::process::exit(*exit_code as i32);".to_string()), "\n".to_string()), "                    }".to_string()), "\n".to_string()), "                    NativeServeAdmission::NativeServeAdmitWorker => {".to_string()), "\n".to_string()), "                        let (sender, receiver) = std::sync::mpsc::channel::<WireParts>();".to_string()), "\n".to_string()), "                        let state = std::sync::Arc::new(std::sync::Mutex::new(WORKER_WAITING));".to_string()), "\n".to_string()), "                        let guard = WorkerGuard { state: state.clone(), stuck: stuck.clone() };".to_string()), "\n".to_string()), "                        std::thread::spawn(move || {".to_string()), "\n".to_string()), "                            let _guard = guard;".to_string()), "\n".to_string()), "                            let response = native_serve_handle(call.method, call.path, call.body, call.tailscale_identity, call.release_revision);".to_string()), "\n".to_string()), "                            let _ = sender.send(wire_parts(&native_serve_outgoing(response)));".to_string()), "\n".to_string()), "                        });".to_string()), "\n".to_string()), "                        match receiver.recv_timeout(deadline) {".to_string()), "\n".to_string()), "                            Ok(parts) => write_parts(&mut stream, &parts),".to_string()), "\n".to_string()), "                            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {".to_string()), "\n".to_string()), "                                write_response(&mut stream, &native_serve_outgoing(native_serve_handler_failed()));".to_string()), "\n".to_string()), "                            }".to_string()), "\n".to_string()), "                            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {".to_string()), "\n".to_string()), "                                {".to_string()), "\n".to_string()), "                                    let mut s = lock_state(&state);".to_string()), "\n".to_string()), "                                    if *s != WORKER_DONE {".to_string()), "\n".to_string()), "                                        *s = WORKER_ABANDONED;".to_string()), "\n".to_string()), "                                        *lock_state(&stuck) += 1;".to_string()), "\n".to_string()), "                                    }".to_string()), "\n".to_string()), "                                }".to_string()), "\n".to_string()), "                                write_response(&mut stream, &native_serve_outgoing(native_serve_deadline_refused(contract.clone())));".to_string()), "\n".to_string()), "                            }".to_string()), "\n".to_string()), "                        }".to_string()), "\n".to_string()), "                    }".to_string()), "\n".to_string()), "                }".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()),
+    content: v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("// Generated by v1 compiler -- do not edit.".to_string(), "\n".to_string()), "\n".to_string()), "#![allow(unused_parens, clippy::all, clippy::disallowed_macros)]".to_string()), "\n".to_string()), "\n".to_string()), "use std::io::{BufRead, Read, Write};".to_string()), "\n".to_string()), "use std::rc::Rc;".to_string()), "\n".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::extdeps_http_server::ServeWireResponse;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_measure::{byte_size_count, millisecond_count};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::gunbc_native_serve::{".to_string()), "\n".to_string()), "    native_serve_announcement,".to_string()), effect_failed_import.clone()), " native_serve_frame, native_serve_handler_name, native_serve_read_refused,".to_string()), "\n".to_string()), "    native_serve_admission, native_serve_deadline_refused, native_serve_handler_failed, native_serve_outgoing, native_serve_route,".to_string()), "\n".to_string()), "    native_serve_worker_replacement_exit_code, native_serve_worker_unrealized,".to_string()), "\n".to_string()), "    native_serve_start, NativeServeAdmission, NativeServeContract, NativeServeFrame, NativeServeOutgoing,".to_string()), "\n".to_string()), "    NativeServeRoute, NativeServeStart,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::".to_string()), pipeline_mod.clone()), "::native_serve_handle;".to_string()), "\n".to_string()), "\n".to_string()), "// What a worker hands back across the thread boundary: owned plain values, because the compiled".to_string()), "\n".to_string()), "// handler's values are reference-counted and stay on the worker's thread.".to_string()), "\n".to_string()), "struct WireParts {".to_string()), "\n".to_string()), "    status: i64,".to_string()), "\n".to_string()), "    content_type_label: String,".to_string()), "\n".to_string()), "    header_lines: Vec<String>,".to_string()), "\n".to_string()), "    body: String,".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn wire_parts(response: &NativeServeOutgoing) -> WireParts {".to_string()), "\n".to_string()), "    WireParts {".to_string()), "\n".to_string()), "        status: response.status,".to_string()), "\n".to_string()), "        content_type_label: response.content_type_label.clone(),".to_string()), "\n".to_string()), "        header_lines: response.header_lines.iter().cloned().collect(),".to_string()), "\n".to_string()), "        body: response.body.clone(),".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn write_parts(stream: &mut std::net::TcpStream, response: &WireParts) {".to_string()), "\n".to_string()), "    let mut head = format!(".to_string()), "\n".to_string()), "        \"HTTP/1.1 {} \\r\\nContent-Type: {}\\r\\nContent-Length: {}\\r\\nConnection: close\\r\\n\",".to_string()), "\n".to_string()), "        response.status, response.content_type_label, response.body.len()".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    for line in response.header_lines.iter() { head.push_str(line); head.push_str(\"\\r\\n\"); }".to_string()), "\n".to_string()), "    head.push_str(\"\\r\\n\");".to_string()), "\n".to_string()), "    if let Err(cause) = stream.write_all(head.as_bytes()).and_then(|_| stream.write_all(response.body.as_bytes())) {".to_string()), "\n".to_string()), "        eprintln!(\"native-serve: write error: {}\", cause);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn write_response(stream: &mut std::net::TcpStream, response: &NativeServeOutgoing) {".to_string()), "\n".to_string()), "    write_parts(stream, &wire_parts(response));".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "// A worker's state, shared with the loop: whether the loop stopped waiting for it. The loop counts a".to_string()), "\n".to_string()), "// worker as stuck only when it abandons it, and the worker uncounts itself when it finally returns,".to_string()), "\n".to_string()), "// under one lock, so the count is exact whichever side gets there first.".to_string()), "\n".to_string()), "const WORKER_WAITING: u8 = 0;".to_string()), "\n".to_string()), "const WORKER_ABANDONED: u8 = 1;".to_string()), "\n".to_string()), "const WORKER_DONE: u8 = 2;".to_string()), "\n".to_string()), "\n".to_string()), "fn lock_state<T>(m: &std::sync::Mutex<T>) -> std::sync::MutexGuard<'_, T> {".to_string()), "\n".to_string()), "    m.lock().unwrap_or_else(|e| e.into_inner())".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "// The worker's cleanup, run when its guard drops: on return AND during a panic's unwind. A worker the".to_string()), "\n".to_string()), "// loop abandoned uncounts itself here, exactly once; every worker ends DONE.".to_string()), "\n".to_string()), "struct WorkerGuard {".to_string()), "\n".to_string()), "    state: std::sync::Arc<std::sync::Mutex<u8>>,".to_string()), "\n".to_string()), "    stuck: std::sync::Arc<std::sync::Mutex<usize>>,".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "impl Drop for WorkerGuard {".to_string()), "\n".to_string()), "    fn drop(&mut self) {".to_string()), "\n".to_string()), "        let mut s = lock_state(&self.state);".to_string()), "\n".to_string()), "        if *s == WORKER_ABANDONED {".to_string()), "\n".to_string()), "            let mut n = lock_state(&self.stuck);".to_string()), "\n".to_string()), "            *n = n.saturating_sub(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        *s = WORKER_DONE;".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "struct HandlerCall {".to_string()), "\n".to_string()), "    method: String,".to_string()), "\n".to_string()), "    path: String,".to_string()), "\n".to_string()), "    body: String,".to_string()), "\n".to_string()), "    tailscale_identity: String,".to_string()), "\n".to_string()), "    release_revision: String,".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "// One worker generation: the thread that owns the effect executor and every admitted handle and runs".to_string()), "\n".to_string()), "// handler calls one at a time. Its state is the WorkerGuard protocol above; an abandoned generation".to_string()), "\n".to_string()), "// finishes the call in hand (if it ever does) and ends, uncounting itself.".to_string()), "\n".to_string()), "struct Generation {".to_string()), "\n".to_string()), "    calls: std::sync::mpsc::Sender<(HandlerCall, std::sync::mpsc::Sender<WireParts>)>,".to_string()), "\n".to_string()), "    state: std::sync::Arc<std::sync::Mutex<u8>>,".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "fn realize_generation(stuck: &std::sync::Arc<std::sync::Mutex<usize>>, ready_within: std::time::Duration) -> Result<Generation, String> {".to_string()), "\n".to_string()), "    let (calls, inbox) = std::sync::mpsc::channel::<(HandlerCall, std::sync::mpsc::Sender<WireParts>)>();".to_string()), "\n".to_string()), "    let (ready, readiness) = std::sync::mpsc::channel::<Result<(), String>>();".to_string()), "\n".to_string()), "    let state = std::sync::Arc::new(std::sync::Mutex::new(WORKER_WAITING));".to_string()), "\n".to_string()), "    let guard = WorkerGuard { state: state.clone(), stuck: stuck.clone() };".to_string()), "\n".to_string()), "    let worker_state = state.clone();".to_string()), "\n".to_string()), "    std::thread::spawn(move || {".to_string()), "\n".to_string()), "        let _guard = guard;".to_string()), "\n".to_string()), worker_realize.clone()), "        let _ = ready.send(Ok(()));".to_string()), "\n".to_string()), "        while let Ok((call, reply)) = inbox.recv() {".to_string()), "\n".to_string()), worker_call.clone()), "            let _ = reply.send(wire_parts(&native_serve_outgoing(response)));".to_string()), "\n".to_string()), "            if *lock_state(&worker_state) == WORKER_ABANDONED {".to_string()), "\n".to_string()), "                return;".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    });".to_string()), "\n".to_string()), "    match readiness.recv_timeout(ready_within) {".to_string()), "\n".to_string()), "        Ok(Ok(())) => Ok(Generation { calls, state }),".to_string()), "\n".to_string()), "        Ok(Err(cause)) => Err(cause),".to_string()), "\n".to_string()), "        Err(_) => Err(\"the worker ended or did not report ready within the request deadline\".to_string()),".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "fn read_line(reader: &mut impl BufRead, budget: &mut usize) -> Result<Option<String>, String> {".to_string()), "\n".to_string()), "    let mut bytes = Vec::new();".to_string()), "\n".to_string()), "    match reader.read_until(b'\\n', &mut bytes) {".to_string()), "\n".to_string()), "        Ok(0) => return Ok(None),".to_string()), "\n".to_string()), "        Ok(n) if n > *budget => return Err(\"the request head exceeds the serve head limit\".to_string()),".to_string()), "\n".to_string()), "        Ok(n) => *budget -= n,".to_string()), "\n".to_string()), "        Err(cause) if bytes.is_empty() && matches!(cause.kind(), std::io::ErrorKind::WouldBlock | std::io::ErrorKind::TimedOut) => return Ok(None),".to_string()), "\n".to_string()), "        Err(cause) => return Err(format!(\"read: {}\", cause)),".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    if bytes.ends_with(b\"\\n\") { bytes.pop(); }".to_string()), "\n".to_string()), "    if bytes.ends_with(b\"\\r\") { bytes.pop(); }".to_string()), "\n".to_string()), "    String::from_utf8(bytes).map(Some).map_err(|_| \"the request head is not utf-8\".to_string())".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "enum Exchange {".to_string()), "\n".to_string()), "    Idle,".to_string()), "\n".to_string()), "    Answer(Rc<ServeWireResponse>),".to_string()), "\n".to_string()), "    Handle(HandlerCall),".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn exchange(stream: &std::net::TcpStream, contract: &Rc<NativeServeContract>, bound_host: &str, bound_port: i64) -> Exchange {".to_string()), "\n".to_string()), "    let limit = (byte_size_count(contract.head_limit.clone()) + byte_size_count(contract.body_limit.clone())) as u64;".to_string()), "\n".to_string()), "    let mut reader = std::io::BufReader::new(stream.take(limit));".to_string()), "\n".to_string()), "    let mut budget = byte_size_count(contract.head_limit.clone()) as usize;".to_string()), "\n".to_string()), "    let request_line = match read_line(&mut reader, &mut budget) {".to_string()), "\n".to_string()), "        Ok(Some(line)) => line,".to_string()), "\n".to_string()), "        Ok(None) => return Exchange::Idle,".to_string()), "\n".to_string()), "        Err(reason) => return Exchange::Answer(native_serve_read_refused(reason)),".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let mut header_lines = Vec::new();".to_string()), "\n".to_string()), "    loop {".to_string()), "\n".to_string()), "        match read_line(&mut reader, &mut budget) {".to_string()), "\n".to_string()), "            Ok(Some(line)) if line.is_empty() => break,".to_string()), "\n".to_string()), "            Ok(Some(line)) => header_lines.push(line),".to_string()), "\n".to_string()), "            Ok(None) => return Exchange::Answer(native_serve_read_refused(\"connection closed before end of headers\".to_string())),".to_string()), "\n".to_string()), "            Err(reason) => return Exchange::Answer(native_serve_read_refused(reason)),".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let head = match &*native_serve_frame(contract.clone(), request_line, Rc::new(header_lines.into())) {".to_string()), "\n".to_string()), "        NativeServeFrame::NativeServeFrameRefused { response } => return Exchange::Answer(response.clone()),".to_string()), "\n".to_string()), "        NativeServeFrame::NativeServeFramed { head, body_length } => {".to_string()), "\n".to_string()), "            let mut body = vec![0u8; *body_length as usize];".to_string()), "\n".to_string()), "            if let Err(cause) = reader.read_exact(&mut body) {".to_string()), "\n".to_string()), "                return Exchange::Answer(native_serve_read_refused(format!(\"read body: {}\", cause)));".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "            match String::from_utf8(body) {".to_string()), "\n".to_string()), "                Ok(text) => (head.clone(), text),".to_string()), "\n".to_string()), "                Err(_) => return Exchange::Answer(native_serve_read_refused(\"the body is not utf-8\".to_string())),".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let (head, body) = head;".to_string()), "\n".to_string()), "    match &*native_serve_route(contract.clone(), head.clone(), native_serve_handler_name(), bound_host.to_string(), bound_port) {".to_string()), "\n".to_string()), "        NativeServeRoute::NativeServeAnswered { response } => Exchange::Answer(response.clone()),".to_string()), "\n".to_string()), "        NativeServeRoute::NativeServeToHandler => Exchange::Handle(HandlerCall {".to_string()), "\n".to_string()), "            method: head.method.clone(),".to_string()), "\n".to_string()), "            path: head.target.clone(),".to_string()), "\n".to_string()), "            body,".to_string()), "\n".to_string()), "            tailscale_identity: head.tailscale_identity.clone(),".to_string()), "\n".to_string()), "            release_revision: contract.release_revision.clone(),".to_string()), "\n".to_string()), "        }),".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn main() {".to_string()), "\n".to_string()), "    let argv: Vec<String> = std::env::args().skip(1).collect();".to_string()), "\n".to_string()), "    let contract = match &*native_serve_start(Rc::new(argv.into())) {".to_string()), "\n".to_string()), "        NativeServeStart::NativeServeListen { contract } => contract.clone(),".to_string()), "\n".to_string()), "        NativeServeStart::NativeServeStartRefused { reason } => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: {}\", reason);".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let listener = match std::net::TcpListener::bind((contract.host.as_str(), contract.port as u16)) {".to_string()), "\n".to_string()), "        Ok(listener) => listener,".to_string()), "\n".to_string()), "        Err(cause) => { eprintln!(\"REFUSED: failed to bind {}:{}: {}\", contract.host, contract.port, cause); std::process::exit(2); }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let bound = match listener.local_addr() {".to_string()), "\n".to_string()), "        Ok(addr) => addr,".to_string()), "\n".to_string()), "        Err(cause) => { eprintln!(\"REFUSED: bound but could not read the bound address: {}\", cause); std::process::exit(2); }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let bound_host = bound.ip().to_string();".to_string()), "\n".to_string()), "    let bound_port = bound.port() as i64;".to_string()), "\n".to_string()), "    let deadline = std::time::Duration::from_millis(millisecond_count(contract.request_deadline.clone()) as u64);".to_string()), "\n".to_string()), "    let stuck = std::sync::Arc::new(std::sync::Mutex::new(0usize));".to_string()), "\n".to_string()), "    let mut generation = match realize_generation(&stuck, deadline) {".to_string()), "\n".to_string()), "        Ok(generation) => generation,".to_string()), "\n".to_string()), "        Err(cause) => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: {}\", native_serve_worker_unrealized(cause));".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    eprintln!(\"{}\", native_serve_announcement(contract.clone(), bound_host.clone(), bound_port));".to_string()), "\n".to_string()), "    let timeout = std::time::Duration::from_millis(millisecond_count(contract.read_timeout.clone()) as u64);".to_string()), "\n".to_string()), "    for accepted in listener.incoming() {".to_string()), "\n".to_string()), "        let mut stream = match accepted {".to_string()), "\n".to_string()), "            Ok(stream) => stream,".to_string()), "\n".to_string()), "            Err(cause) => { eprintln!(\"native-serve: accept error: {}\", cause); continue; }".to_string()), "\n".to_string()), "        };".to_string()), "\n".to_string()), "        if let Err(cause) = stream.set_read_timeout(Some(timeout)) {".to_string()), "\n".to_string()), "            eprintln!(\"native-serve: set_read_timeout: {}\", cause);".to_string()), "\n".to_string()), "            continue;".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        match exchange(&stream, &contract, &bound_host, bound_port) {".to_string()), "\n".to_string()), "            Exchange::Idle => {}".to_string()), "\n".to_string()), "            Exchange::Answer(response) => write_response(&mut stream, &native_serve_outgoing(response)),".to_string()), "\n".to_string()), "            Exchange::Handle(call) => {".to_string()), "\n".to_string()), "                let stuck_now = *lock_state(&stuck) as i64;".to_string()), "\n".to_string()), "                match &*native_serve_admission(contract.clone(), stuck_now) {".to_string()), "\n".to_string()), "                    NativeServeAdmission::NativeServeRefuseStuck { response, exit_code } => {".to_string()), "\n".to_string()), "                        write_response(&mut stream, &native_serve_outgoing(response.clone()));".to_string()), "\n".to_string()), "                        std::process::exit(*exit_code as i32);".to_string()), "\n".to_string()), "                    }".to_string()), "\n".to_string()), "                    NativeServeAdmission::NativeServeAdmitWorker => {".to_string()), "\n".to_string()), "                        let (reply, answer) = std::sync::mpsc::channel::<WireParts>();".to_string()), "\n".to_string()), "                        let replace = if generation.calls.send((call, reply)).is_err() {".to_string()), "\n".to_string()), "                            write_response(&mut stream, &native_serve_outgoing(native_serve_handler_failed()));".to_string()), "\n".to_string()), "                            true".to_string()), "\n".to_string()), "                        } else {".to_string()), "\n".to_string()), "                            match answer.recv_timeout(deadline) {".to_string()), "\n".to_string()), "                                Ok(parts) => {".to_string()), "\n".to_string()), "                                    write_parts(&mut stream, &parts);".to_string()), "\n".to_string()), "                                    false".to_string()), "\n".to_string()), "                                }".to_string()), "\n".to_string()), "                                Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {".to_string()), "\n".to_string()), "                                    write_response(&mut stream, &native_serve_outgoing(native_serve_handler_failed()));".to_string()), "\n".to_string()), "                                    true".to_string()), "\n".to_string()), "                                }".to_string()), "\n".to_string()), "                                Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {".to_string()), "\n".to_string()), "                                    {".to_string()), "\n".to_string()), "                                        let mut s = lock_state(&generation.state);".to_string()), "\n".to_string()), "                                        if *s != WORKER_DONE {".to_string()), "\n".to_string()), "                                            *s = WORKER_ABANDONED;".to_string()), "\n".to_string()), "                                            *lock_state(&stuck) += 1;".to_string()), "\n".to_string()), "                                        }".to_string()), "\n".to_string()), "                                    }".to_string()), "\n".to_string()), "                                    write_response(&mut stream, &native_serve_outgoing(native_serve_deadline_refused(contract.clone())));".to_string()), "\n".to_string()), "                                    true".to_string()), "\n".to_string()), "                                }".to_string()), "\n".to_string()), "                            }".to_string()), "\n".to_string()), "                        };".to_string()), "\n".to_string()), "                        if replace {".to_string()), "\n".to_string()), "                            generation = match realize_generation(&stuck, deadline) {".to_string()), "\n".to_string()), "                                Ok(generation) => generation,".to_string()), "\n".to_string()), "                                Err(cause) => {".to_string()), "\n".to_string()), "                                    eprintln!(\"REFUSED: {}\", native_serve_worker_unrealized(cause));".to_string()), "\n".to_string()), "                                    std::process::exit(native_serve_worker_replacement_exit_code() as i32);".to_string()), "\n".to_string()), "                                }".to_string()), "\n".to_string()), "                            };".to_string()), "\n".to_string()), "                        }".to_string()), "\n".to_string()), "                    }".to_string()), "\n".to_string()), "                }".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()),
 })
     }
 }
 
-pub fn emit_native_cli_driver_main_rs(crate_name: String, pipeline_module: String) -> Rc<TextFile> {
+pub fn emit_native_cli_driver_main_rs(
+    crate_name: String,
+    pipeline_module: String,
+    bindings: Rc<Vec<Rc<NativeEffectBindingText>>>,
+) -> Rc<TextFile> {
     {
         let pipeline_mod =
             crate::gunbc_rust_emitted_edge::module_to_filename(pipeline_module.clone());
+        let binding_lines = Rc::new({
+            let mut __result = Vec::new();
+            for b in bindings.iter().cloned() {
+                __result.push(b.binding_line.clone());
+            }
+            __result
+        })
+        .join(&"".to_string());
+        let effect_args = Rc::new({
+            let mut __result = Vec::new();
+            for b in bindings.iter().cloned() {
+                __result.push(v1_rt::concat(", ".to_string(), b.argument.clone()));
+            }
+            __result
+        })
+        .join(&"".to_string());
         Rc::new(TextFile {
     path: v1_rt::concat(v1_rt::concat(rust_source_root(), "main".to_string()), rust_source_ext()),
-    content: v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("// Generated by v1 compiler -- do not edit.".to_string(), "\n".to_string()), "\n".to_string()), "#![allow(unused_parens, clippy::all, clippy::disallowed_macros)]".to_string()), "\n".to_string()), "\n".to_string()), "use std::rc::Rc;".to_string()), "\n".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_process::ProcessExit;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::".to_string()), pipeline_mod.clone()), "::{".to_string()), "\n".to_string()), "    v2_cli_exit, v2_cli_outcome_text, v2_cli_main,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "\n".to_string()), "#[tokio::main(flavor = \"current_thread\")]".to_string()), "\n".to_string()), "async fn main() {".to_string()), "\n".to_string()), "    let argv: Vec<String> = std::env::args().skip(1).collect();".to_string()), "\n".to_string()), "    let filesystem = ".to_string()), crate_name.clone()), "::extdeps_filesystem_filesystem_io::Filesystem::new(Default::default());".to_string()), "\n".to_string()), "    let outcome = match v2_cli_main(Rc::new(argv.into()), &filesystem).await {".to_string()), "\n".to_string()), "        Ok(outcome) => outcome,".to_string()), "\n".to_string()), "        Err(cause) => { eprintln!(\"REFUSED: native filesystem transport: {}\", cause); std::process::exit(2); }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let text = v2_cli_outcome_text(outcome.clone());".to_string()), "\n".to_string()), "    print!(\"{text}\");".to_string()), "\n".to_string()), "    match &*v2_cli_exit(outcome) {".to_string()), "\n".to_string()), "        ProcessExit::ExitSuccess => {".to_string()), "\n".to_string()), "            std::process::exit(0);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        ProcessExit::ExitFailure { code, reason } => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: {reason}\");".to_string()), "\n".to_string()), "            std::process::exit(*code as i32);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()),
+    content: v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("// Generated by v1 compiler -- do not edit.".to_string(), "\n".to_string()), "\n".to_string()), "#![allow(unused_parens, clippy::all, clippy::disallowed_macros)]".to_string()), "\n".to_string()), "\n".to_string()), "use std::rc::Rc;".to_string()), "\n".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_process::ProcessExit;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::".to_string()), pipeline_mod.clone()), "::{".to_string()), "\n".to_string()), "    v2_cli_exit, v2_cli_outcome_text, v2_cli_main,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "\n".to_string()), "#[tokio::main(flavor = \"current_thread\")]".to_string()), "\n".to_string()), "async fn main() {".to_string()), "\n".to_string()), "    let argv: Vec<String> = std::env::args().skip(1).collect();".to_string()), "\n".to_string()), binding_lines.clone()), "    let outcome = match v2_cli_main(Rc::new(argv.into())".to_string()), effect_args.clone()), ").await {".to_string()), "\n".to_string()), "        Ok(outcome) => outcome,".to_string()), "\n".to_string()), "        Err(cause) => { eprintln!(\"REFUSED: native effect transport: {}\", cause); std::process::exit(2); }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let text = v2_cli_outcome_text(outcome.clone());".to_string()), "\n".to_string()), "    print!(\"{text}\");".to_string()), "\n".to_string()), "    match &*v2_cli_exit(outcome) {".to_string()), "\n".to_string()), "        ProcessExit::ExitSuccess => {".to_string()), "\n".to_string()), "            std::process::exit(0);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        ProcessExit::ExitFailure { code, reason } => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: {reason}\");".to_string()), "\n".to_string()), "            std::process::exit(*code as i32);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()),
 })
     }
 }
@@ -41836,7 +42808,7 @@ pub fn emit_source_root_eval_driver_main_rs(
             crate::gunbc_rust_emitted_edge::module_to_filename(pipeline_module.clone());
         Rc::new(TextFile {
     path: v1_rt::concat(v1_rt::concat(rust_source_root(), "main".to_string()), rust_source_ext()),
-    content: v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("// Generated by v1 compiler -- do not edit.".to_string(), "\n".to_string()), "\n".to_string()), "#![allow(unused_parens, clippy::all, clippy::disallowed_macros)]".to_string()), "\n".to_string()), "\n".to_string()), "use std::rc::Rc;".to_string()), "\n".to_string()), "use std::time::Instant;".to_string()), "\n".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::gunbc_witness_v2_native_route::{NativeRouteEmittedBuild, NativeRouteMalformedControl, NativeRouteOldRouteControl};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::".to_string()), pipeline_mod.clone()), "::{".to_string()), "\n".to_string()), "    native_census_module_completeness, native_census_module_resolution, native_census_modules,".to_string()), "\n".to_string()), "    native_census_module_inference, native_census_infer_type_contribution,".to_string()), "\n".to_string()), "    native_census_residual_rows,".to_string()), "\n".to_string()), "    native_census_cause_groups_add_module, native_census_cause_groups_from_file_refusals,".to_string()), "\n".to_string()), "    native_census_cause_group_rows, native_census_closure_index, native_census_roots_ranked,".to_string()), "\n".to_string()), "    native_demand_census_output,".to_string()), "\n".to_string()), "    native_lane_controls, native_lane_file_refusal_index,".to_string()), "\n".to_string()), "    native_lane_closure_ingest, native_lane_closure_modules, native_lane_closure_round_budget,".to_string()), "\n".to_string()), "    native_lane_ingest_matches_closure, native_lane_ingest_receipt, native_lane_receipt,".to_string()), "\n".to_string()), "    native_lane_source_facts, native_lane_universe_of_facts, native_test_context_absorb,".to_string()), "\n".to_string()), "    native_test_context_finish, native_test_context_from_ingest, native_test_context_state_empty,".to_string()), "\n".to_string()), "    native_test_front_end_prepare,".to_string()), "\n".to_string()), "    native_driver_parse, native_driver_plan_exit, native_driver_plan_source_roots,".to_string()), "\n".to_string()), "    NativeDriverPlan, NativeDriverVerb,".to_string()), "\n".to_string()), "    NativeCensusModuleOutcome,".to_string()), "\n".to_string()), "    NativeLaneHostFacts,".to_string()), "\n".to_string()), "    NativeRouteMemberRow,".to_string()), "\n".to_string()), "    native_demand_eval_nanos, native_demand_eval_samples,".to_string()), "\n".to_string()), "    native_demand_prepare_nanos, native_demand_prepare_samples,".to_string()), "\n".to_string()), "    native_demand_prepare_ok, native_demand_prepare_refused,".to_string()), "\n".to_string()), "    native_demand_scheduling_nanos,".to_string()), "\n".to_string()), "    native_demand_occurrence_census_lines, native_demand_occurrence_census_nanos,".to_string()), "\n".to_string()), "    native_demand_run_demand_count, native_demand_run_readiness_derivations,".to_string()), "\n".to_string()), "    native_demand_run_receipt_lines, native_demand_run_rows,".to_string()), "\n".to_string()), "    native_demand_observation_progressed,".to_string()), "\n".to_string()), "    native_demand_run_transition_count, native_demand_schedule_universe,".to_string()), "\n".to_string()), "    native_demand_tested_tree_input,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::v2_compiler_program_assembly::{".to_string()), "\n".to_string()), "    program_assembly_measured_outcome, program_assembly_memo_hits,".to_string()), "\n".to_string()), "    program_assembly_memo_lookup_calls, program_assembly_memo_misses,".to_string()), "\n".to_string()), "    program_assembly_allocator_next, program_assembly_measured_alloc,".to_string()), "\n".to_string()), "    program_assembly_phase_normalize_seeded, program_assembly_normalized_outcome,".to_string()), "\n".to_string()), "    program_assembly_normalized_alloc, program_assembly_normalized_spans, program_assembly_ingest_scope_outcome,".to_string()), "\n".to_string()), "    program_assembly_phase_parse_measured_seeded,".to_string()), "\n".to_string()), "    program_assembly_phase_token_count, program_assembly_phase_tokenize,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::gunbc_witness_v2_native_route::{".to_string()), "\n".to_string()), "    native_route_admission, native_route_admission_summary, native_route_admitted,".to_string()), "\n".to_string()), "    native_route_file_refusal_tally, native_route_member_row_text,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::gunbc_native_frontier_ratchet::{".to_string()), "\n".to_string()), "    native_frontier_proposal_file_lines, native_frontier_report_lines, native_frontier_verdict,".to_string()), "\n".to_string()), "    native_frontier_verdict_word,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::v2_compiler_native_test_vocabulary::NativeTestVerdict;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::v2_compiler_source_authority::DagSourceReadWitness;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::v2_std_diagnostic::Outcome;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_process::ProcessExit;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::extdeps_bazel_target_pattern::TargetPattern;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_compiler_entry::{".to_string()), "\n".to_string()), "    native_driver_cost_account, native_driver_cost_remainder_tolerance_nanos,".to_string()), "\n".to_string()), "    native_driver_exclusive_sum, NativeDriverCostAccounting,".to_string()), "\n".to_string()), "    native_driver_exclusive_rows, native_driver_exclusive_row_name,".to_string()), "\n".to_string()), "    NativeDriverExclusiveRowKey,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_measure::{nanosecond, nanosecond_count};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::v1_rt::observed_thread_cpu_nanos;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::gunbc_instruments_type_declaration_use_census::{type_census_receipt, type_census_run_add, type_census_run_empty};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_compiler_entry::NativeClaimTerminal;".to_string()), "\n".to_string()), "\n".to_string()), emit_host_source_root_read_rs(crate_name.clone())), "fn host_fact(facts: &std::collections::HashMap<String, String>, key: &str) -> String {".to_string()), "\n".to_string()), "    match facts.get(key) {".to_string()), "\n".to_string()), "        Some(value) => value.clone(),".to_string()), "\n".to_string()), "        None => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: host facts file carries no {key} row\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn host_fact_int(facts: &std::collections::HashMap<String, String>, key: &str) -> i64 {".to_string()), "\n".to_string()), "    let value = host_fact(facts, key);".to_string()), "\n".to_string()), "    match value.parse::<i64>() {".to_string()), "\n".to_string()), "        Ok(parsed) => parsed,".to_string()), "\n".to_string()), "        Err(cause) => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: host fact {key} is not an integer: {value:?} ({cause})\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn read_host_facts(path: &str) -> NativeLaneHostFacts {".to_string()), "\n".to_string()), "    let text = match std::fs::read_to_string(path) {".to_string()), "\n".to_string()), "        Ok(text) => text,".to_string()), "\n".to_string()), "        Err(cause) => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: could not read host facts file {path}: {cause}\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let mut facts: std::collections::HashMap<String, String> = std::collections::HashMap::new();".to_string()), "\n".to_string()), "    for line in text.lines() {".to_string()), "\n".to_string()), "        if line.is_empty() {".to_string()), "\n".to_string()), "            continue;".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        match line.split_once('\\t') {".to_string()), "\n".to_string()), "            Some((key, value)) if !key.is_empty() => {".to_string()), "\n".to_string()), "                if facts.insert(key.to_string(), value.to_string()).is_some() {".to_string()), "\n".to_string()), "                    eprintln!(\"REFUSED: duplicate host fact row: {key}\");".to_string()), "\n".to_string()), "                    std::process::exit(2);".to_string()), "\n".to_string()), "                }".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "            _ => {".to_string()), "\n".to_string()), "                eprintln!(\"REFUSED: malformed host fact line (expected key<TAB>value): {line}\");".to_string()), "\n".to_string()), "                std::process::exit(2);".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let malformed_path = host_fact(&facts, \"malformed_control_path\");".to_string()), "\n".to_string()), "    let malformed_reason = host_fact(&facts, \"malformed_control_reason\");".to_string()), "\n".to_string()), "    let malformed_control = if malformed_path.is_empty() {".to_string()), "\n".to_string()), "        NativeRouteMalformedControl::MalformedSpecimenAccepted".to_string()), "\n".to_string()), "    } else {".to_string()), "\n".to_string()), "        NativeRouteMalformedControl::MalformedSpecimenRefused {".to_string()), "\n".to_string()), "            path: malformed_path,".to_string()), "\n".to_string()), "            reason: malformed_reason,".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let old_route_disposition = host_fact(&facts, \"old_route_disposition\");".to_string()), "\n".to_string()), "    let old_route_executable = host_fact(&facts, \"old_route_executable\");".to_string()), "\n".to_string()), "    let old_route_control = match old_route_disposition.as_str() {".to_string()), "\n".to_string()), "        \"withdrawn\" => NativeRouteOldRouteControl::OldRouteWithdrawn {".to_string()), "\n".to_string()), "            withdrawn_executable: old_route_executable,".to_string()), "\n".to_string()), "        },".to_string()), "\n".to_string()), "        \"not_present_at_window\" => NativeRouteOldRouteControl::OldRouteNotPresentAtWindow {".to_string()), "\n".to_string()), "            expected_executable: old_route_executable,".to_string()), "\n".to_string()), "        },".to_string()), "\n".to_string()), "        other => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: old_route_disposition names no control this route can record: {other} -- expected withdrawn or not_present_at_window\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    // The emitted build is the host's observation of the cargo spawn this binary is the".to_string()), "\n".to_string()), "    // product of: six rows, the argv as one row per word under a length row. A count that".to_string()), "\n".to_string()), "    // does not parse, or an index row it promises that is missing, refuses like any other".to_string()), "\n".to_string()), "    // missing fact; nothing is defaulted.".to_string()), "\n".to_string()), "    let cargo_argv_len = host_fact_int(&facts, \"cargo_argv_len\");".to_string()), "\n".to_string()), "    let mut cargo_argv: Vec<String> = Vec::new();".to_string()), "\n".to_string()), "    for index in 0..cargo_argv_len {".to_string()), "\n".to_string()), "        cargo_argv.push(host_fact(&facts, &format!(\"cargo_argv_{index}\")));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let emitted_build = NativeRouteEmittedBuild {".to_string()), "\n".to_string()), "        cargo_argv: Rc::new(cargo_argv.into()),".to_string()), "\n".to_string()), "        rustflags: host_fact(&facts, \"rustflags\"),".to_string()), "\n".to_string()), "        compiler_path: host_fact(&facts, \"compiler_path\"),".to_string()), "\n".to_string()), "        rustc_identity: host_fact(&facts, \"rustc_identity\"),".to_string()), "\n".to_string()), "        exit_status: host_fact_int(&facts, \"exit_status\"),".to_string()), "\n".to_string()), "        warning_count: host_fact_int(&facts, \"warning_count\"),".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    NativeLaneHostFacts {".to_string()), "\n".to_string()), "        tested_tree: host_fact(&facts, \"tested_tree\"),".to_string()), "\n".to_string()), "        preparation_seed_identity: host_fact(&facts, \"preparation_seed_identity\"),".to_string()), "\n".to_string()), "        emitted_closure_identity: host_fact(&facts, \"emitted_closure_identity\"),".to_string()), "\n".to_string()), "        executable_path: host_fact(&facts, \"executable_path\"),".to_string()), "\n".to_string()), "        executable_identity: host_fact(&facts, \"executable_identity\"),".to_string()), "\n".to_string()), "        old_route_control: Rc::new(old_route_control),".to_string()), "\n".to_string()), "        malformed_control: Rc::new(malformed_control),".to_string()), "\n".to_string()), "        emitted_build: Rc::new(emitted_build),".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn run_census(source_roots: &[String]) {".to_string()), "\n".to_string()), "    if source_roots.is_empty() {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: no source roots given\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let reads = read_ingest(source_roots);".to_string()), "\n".to_string()), "    let ingest = Rc::new(im::vector::Vector::from(reads));".to_string()), "\n".to_string()), "    let context = match &*native_test_context_from_ingest(ingest.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CONTEXT-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    for refusal in context.file_refusals.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"file_refusal\": refusal }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for advised in context.accepted_file_advisories.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"accepted_file_advisories\": advised }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // GROUPED BY THE FATAL REASON, BY THE FOLD THAT OWNS THE GROUPING".to_string()), "\n".to_string()), "    // (v2.compiler.compile native_census_cause_groups_add); this main only prints the groups.".to_string()), "\n".to_string()), "    // Each root carries its closure fan-out (v2.compiler.compile native_census_closure_index);".to_string()), "\n".to_string()), "    // this mode does not resolve, so no root claims an observed resolve refusal.".to_string()), "\n".to_string()), "    let closure = native_census_closure_index(".to_string()), "\n".to_string()), "        context.clone(),".to_string()), "\n".to_string()), "        native_lane_file_refusal_index(context.file_refusals.clone()),".to_string()), "\n".to_string()), "        native_census_modules(ingest.clone()),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    let groups = native_census_cause_groups_from_file_refusals(context.file_refusals.clone(), closure, false);".to_string()), "\n".to_string()), "    let cause_groups = native_census_cause_group_rows(groups.clone());".to_string()), "\n".to_string()), "    for group in cause_groups.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"cause_group\": group }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let roots = native_census_roots_ranked(cause_groups.clone());".to_string()), "\n".to_string()), "    for root in roots.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"census_root\": root }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    println!(\"{}\", serde_json::json!({ \"_terminal\": \"complete\", \"mode\": \"census\", \"file_refusals\": context.file_refusals.len(), \"advised_files\": context.accepted_file_advisories.len(), \"cause_groups\": cause_groups.len(), \"roots\": roots.len() }));".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "// THE THIRD MODE: THE WHOLE TREE, RESOLVED PER MODULE.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// WHY IT IS NOT A FLAG ON `census`. That mode has a live consumer -- the malformed control,".to_string()), "\n".to_string()), "// which the host runner spawns over a ONE-FILE scratch root and reads one per-file refusal".to_string()), "\n".to_string()), "// from -- and teaching it to resolve would make that control pay a whole-tree resolve to".to_string()), "\n".to_string()), "// learn a fact the front end already answered. Two modes because they are two subjects: a".to_string()), "\n".to_string()), "// roster of front-end refusals, and a roster of resolve refusals over every ingested module.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// WHY IT IS NOT THE `adjudicate` LOOP WIDENED. That loop walks `universe.modules` -- the".to_string()), "\n".to_string()), "// v2.test.* modules discovery enrolled rows for -- over a context folded from the import".to_string()), "\n".to_string()), "// CLOSURE of those modules. Both narrowings are correct for what adjudication asks and wrong".to_string()), "\n".to_string()), "// for a census: a residual reported over the closure of the test corpus is not a residual over".to_string()), "\n".to_string()), "// the tree, and the absence of a refusal in a population that was never resolved establishes".to_string()), "\n".to_string()), "// nothing about the dependents outside it.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// THE RESOLVED TREE IS NOT KEPT. NativeCensusModuleOutcome carries the diagnostics of a refusal".to_string()), "\n".to_string()), "// and nothing on the accepted arm, so each module's tree dies with the call that made it. The".to_string()), "\n".to_string()), "// adjudicating loop drops its tree explicitly because it must hold one to infer from; this loop".to_string()), "\n".to_string()), "// never holds one, which is the property that makes the whole-tree grain affordable at all.".to_string()), "\n".to_string()), "fn run_census_resolve(source_roots: &[String]) {".to_string()), "\n".to_string()), "    if source_roots.is_empty() {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: no source roots given\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let load_started = Instant::now();".to_string()), "\n".to_string()), "    let reads = read_ingest(source_roots);".to_string()), "\n".to_string()), "    let corpus_reads = reads.len();".to_string()), "\n".to_string()), "    let ingest = Rc::new(im::vector::Vector::from(reads));".to_string()), "\n".to_string()), "    let load_nanos = span_nanos(load_started);".to_string()), "\n".to_string()), "    let context_started = Instant::now();".to_string()), "\n".to_string()), "    // MUTABLE BECAUSE IT IS THREADED: each module's resolution returns the context it ended".to_string()), "\n".to_string()), "    // with, carrying the module namespace provider (v2.compiler.name_resolve ResolutionContext".to_string()), "\n".to_string()), "    // namespaces), and the next module is resolved over that one -- a namespace is produced at".to_string()), "\n".to_string()), "    // most once per ingest only for a loop that binds what it gets back.".to_string()), "\n".to_string()), "    let mut context = match &*native_test_context_from_ingest(ingest.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CONTEXT-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let context_nanos = span_nanos(context_started);".to_string()), "\n".to_string()), "    // The front-end refusals are reported in the same shape `census` reports them, because they".to_string()), "\n".to_string()), "    // are the same fact read from the same context: a module whose file the context refused is".to_string()), "\n".to_string()), "    // attributed there and is NOT re-reported below as a resolve refusal it never reached.".to_string()), "\n".to_string()), "    for refusal in context.file_refusals.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"file_refusal\": refusal }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // THE ADVISORY POPULATION IS THE SAME CONTEXT FACT `census` REPORTS, printed in the same".to_string()), "\n".to_string()), "    // shape, so a saved whole-tree receipt carries it without a second pass. Its count is taken".to_string()), "\n".to_string()), "    // here, from the context that produced the rows, not from the threaded one at the end.".to_string()), "\n".to_string()), "    for advised in context.accepted_file_advisories.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"accepted_file_advisories\": advised }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let advised_files = context.accepted_file_advisories.len();".to_string()), "\n".to_string()), "    let refusal_index = native_lane_file_refusal_index(context.file_refusals.clone());".to_string()), "\n".to_string()), "    let roster_started = Instant::now();".to_string()), "\n".to_string()), "    let modules = native_census_modules(ingest.clone());".to_string()), "\n".to_string()), "    let roster_nanos = span_nanos(roster_started);".to_string()), "\n".to_string()), "    // THE CAUSE GROUPS START FROM THE FRONT-END REFUSALS -- each a root carrying its closure".to_string()), "\n".to_string()), "    // fan-out -- and take each module as it is resolved: a cascade member once under its root,".to_string()), "\n".to_string()), "    // any other refusal per chain (v2.compiler.compile native_census_cause_groups_add_module).".to_string()), "\n".to_string()), "    let closure = native_census_closure_index(context.clone(), refusal_index.clone(), modules.clone());".to_string()), "\n".to_string()), "    let mut groups = native_census_cause_groups_from_file_refusals(context.file_refusals.clone(), closure, true);".to_string()), "\n".to_string()), "    let mut resolve_total_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut resolve_samples: Vec<u128> = Vec::new();".to_string()), "\n".to_string()), "    let mut resolved_ok: u64 = 0;".to_string()), "\n".to_string()), "    let mut file_refused: u64 = 0;".to_string()), "\n".to_string()), "    let mut resolve_refused: u64 = 0;".to_string()), "\n".to_string()), "    let mut residual_rows: u64 = 0;".to_string()), "\n".to_string()), "    // THE PER-MODULE LINE IS ALSO THE RUN'S PROGRESS: `index` of `of`, so a reader of a multi-hour".to_string()), "\n".to_string()), "    // census can tell a slow run from a hung one while it runs.".to_string()), "\n".to_string()), "    let census_modules_total = modules.len();".to_string()), "\n".to_string()), "    for (census_module_index, entry) in modules.iter().enumerate() {".to_string()), "\n".to_string()), "        let resolve_started = Instant::now();".to_string()), "\n".to_string()), "        let step = native_census_module_resolution(".to_string()), "\n".to_string()), "            context.clone(),".to_string()), "\n".to_string()), "            refusal_index.clone(),".to_string()), "\n".to_string()), "            entry.clone(),".to_string()), "\n".to_string()), "        );".to_string()), "\n".to_string()), "        context = step.context.clone();".to_string()), "\n".to_string()), "        let outcome = step.outcome.clone();".to_string()), "\n".to_string()), "        let module_resolve_nanos = span_nanos(resolve_started);".to_string()), "\n".to_string()), "        groups = native_census_cause_groups_add_module(groups.clone(), entry.clone(), step.clone());".to_string()), "\n".to_string()), "        let outcome_label = match &*outcome {".to_string()), "\n".to_string()), "            NativeCensusModuleOutcome::NativeCensusModuleFileRefused => {".to_string()), "\n".to_string()), "                file_refused += 1;".to_string()), "\n".to_string()), "                \"file_refused\"".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "            NativeCensusModuleOutcome::NativeCensusModuleResolved => {".to_string()), "\n".to_string()), "                resolved_ok += 1;".to_string()), "\n".to_string()), "                \"resolved\"".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "            NativeCensusModuleOutcome::NativeCensusModuleResolveRefused { first, rest, .. } => {".to_string()), "\n".to_string()), "                resolve_refused += 1;".to_string()), "\n".to_string()), "                // ONE ROW PER FAILURE CHAIN, WHICH IS ONE ROW PER REFUSED OCCURRENCE. The rows are".to_string()), "\n".to_string()), "                // written as they are decided rather than accumulated: the census is over the".to_string()), "\n".to_string()), "                // whole tree, and a population held to the end is a second corpus-sized".to_string()), "\n".to_string()), "                // allocation beside the context that produced it.".to_string()), "\n".to_string()), "                for row in native_census_residual_rows(entry.clone(), first.clone(), rest.clone()).iter() {".to_string()), "\n".to_string()), "                    residual_rows += 1;".to_string()), "\n".to_string()), "                    println!(\"{}\", serde_json::json!({ \"census_residual\": row }));".to_string()), "\n".to_string()), "                }".to_string()), "\n".to_string()), "                \"resolve_refused\"".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        };".to_string()), "\n".to_string()), "        resolve_total_nanos += module_resolve_nanos;".to_string()), "\n".to_string()), "        resolve_samples.push(module_resolve_nanos);".to_string()), "\n".to_string()), "        eprintln!(".to_string()), "\n".to_string()), "            \"[native-census-resolve] {}\",".to_string()), "\n".to_string()), "            serde_json::json!({".to_string()), "\n".to_string()), "                \"producer\": \"std.compiler_entry.SourceRootEvalDriver\",".to_string()), "\n".to_string()), "                \"module\": entry.module.clone(),".to_string()), "\n".to_string()), "                \"path\": entry.path.clone(),".to_string()), "\n".to_string()), "                \"resolve_nanos\": module_resolve_nanos,".to_string()), "\n".to_string()), "                \"outcome\": outcome_label,".to_string()), "\n".to_string()), "                \"occurrence_completeness\": native_census_module_completeness(outcome.clone()),".to_string()), "\n".to_string()), "                \"index\": census_module_index + 1,".to_string()), "\n".to_string()), "                \"of\": census_modules_total,".to_string()), "\n".to_string()), "            }),".to_string()), "\n".to_string()), "        );".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    resolve_samples.sort_unstable();".to_string()), "\n".to_string()), "    let cause_groups = native_census_cause_group_rows(groups.clone());".to_string()), "\n".to_string()), "    for group in cause_groups.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"cause_group\": group }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // THE ROOTS, RANKED BY CLOSURE FAN-OUT (v2.compiler.compile native_census_roots_ranked).".to_string()), "\n".to_string()), "    let roots = native_census_roots_ranked(cause_groups.clone());".to_string()), "\n".to_string()), "    for root in roots.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"census_root\": root }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // THE TERMINAL LINE CARRIES THE COST AND THE POPULATION TOGETHER, because the reading this".to_string()), "\n".to_string()), "    // mode exists to support is whether a whole-tree resolve is affordable at all, and a residual".to_string()), "\n".to_string()), "    // count without the wall and the peak beside it cannot answer that.".to_string()), "\n".to_string()), "    println!(".to_string()), "\n".to_string()), "        \"{}\",".to_string()), "\n".to_string()), "        serde_json::json!({".to_string()), "\n".to_string()), "            \"_terminal\": \"complete\",".to_string()), "\n".to_string()), "            \"mode\": \"census-resolve\",".to_string()), "\n".to_string()), "            \"corpus_reads\": corpus_reads,".to_string()), "\n".to_string()), "            \"modules\": modules.len(),".to_string()), "\n".to_string()), "            \"file_refusals\": context.file_refusals.len(),".to_string()), "\n".to_string()), "            \"advised_files\": advised_files,".to_string()), "\n".to_string()), "            \"resolved\": resolved_ok,".to_string()), "\n".to_string()), "            \"file_refused\": file_refused,".to_string()), "\n".to_string()), "            \"resolve_refused\": resolve_refused,".to_string()), "\n".to_string()), "            \"residual_rows\": residual_rows,".to_string()), "\n".to_string()), "            \"cause_groups\": cause_groups.len(),".to_string()), "\n".to_string()), "            \"roots\": roots.len(),".to_string()), "\n".to_string()), "            \"load_nanos\": load_nanos,".to_string()), "\n".to_string()), "            \"context_nanos\": context_nanos,".to_string()), "\n".to_string()), "            \"roster_nanos\": roster_nanos,".to_string()), "\n".to_string()), "            \"resolve_total_nanos\": resolve_total_nanos,".to_string()), "\n".to_string()), "            \"resolve_p50_nanos\": native_cost_quantile_nanos(&resolve_samples, 1, 2),".to_string()), "\n".to_string()), "            \"resolve_p95_nanos\": native_cost_quantile_nanos(&resolve_samples, 19, 20),".to_string()), "\n".to_string()), "            \"resolve_max_nanos\": resolve_samples.last().copied().unwrap_or(0),".to_string()), "\n".to_string()), "            \"peak_rss_bytes\": proc_status_kib(\"VmHWM\").map(|kib| kib * 1024),".to_string()), "\n".to_string()), "        }),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "// THE FOURTH MODE: D13's DEPENDENCY-DEMAND CENSUS (v2.compiler.compile native_demand_census_output).".to_string()), "\n".to_string()), "// The fold decides every line and the exit -- 0 held, 1 a census whose rows do not account for".to_string()), "\n".to_string()), "// every uses fn, 2 no observation -- and this function only reads the ingest, prints and exits.".to_string()), "\n".to_string()), "fn run_demand_census(source_roots: &[String]) {".to_string()), "\n".to_string()), "    if source_roots.is_empty() {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: no source roots given\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let reads = read_ingest(source_roots);".to_string()), "\n".to_string()), "    let ingest = Rc::new(im::vector::Vector::from(reads));".to_string()), "\n".to_string()), "    let output = native_demand_census_output(ingest);".to_string()), "\n".to_string()), "    for line in output.lines.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    std::process::exit(output.exit as i32);".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// THE FIFTH MODE: THE WHOLE TREE, RESOLVED AND INFERRED PER MODULE (`census-infer`).".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// Every decision is a .dag fold: the per-module step (v2.compiler.compile".to_string()), "\n".to_string()), "// native_census_module_inference), the type-declaration census's contribution from it".to_string()), "\n".to_string()), "// (native_census_infer_type_contribution), the run it accumulates into and the receipt and".to_string()), "\n".to_string()), "// terminal that run decides (gunbc.instruments.type_declaration_use_census). This loop reads the".to_string()), "\n".to_string()), "// roots, threads the context, prints and sets the status -- the operations no fold can. A module's".to_string()), "\n".to_string()), "// trees live for one step; what is kept is the census's rows, not the trees.".to_string()), "\n".to_string()), "fn run_census_infer(source_roots: &[String]) {".to_string()), "\n".to_string()), "    if source_roots.is_empty() {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: no source roots given\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let reads = read_ingest(source_roots);".to_string()), "\n".to_string()), "    let ingest = Rc::new(im::vector::Vector::from(reads));".to_string()), "\n".to_string()), "    let mut context = match &*native_test_context_from_ingest(ingest.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CONTEXT-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let refusal_index = native_lane_file_refusal_index(context.file_refusals.clone());".to_string()), "\n".to_string()), "    let modules = native_census_modules(ingest.clone());".to_string()), "\n".to_string()), "    let mut run = type_census_run_empty();".to_string()), "\n".to_string()), "    for entry in modules.iter() {".to_string()), "\n".to_string()), "        let started = Instant::now();".to_string()), "\n".to_string()), "        let step = native_census_module_inference(context.clone(), refusal_index.clone(), entry.clone());".to_string()), "\n".to_string()), "        context = step.context.clone();".to_string()), "\n".to_string()), "        let contribution = native_census_infer_type_contribution(context.clone(), entry.clone(), step.outcome.clone());".to_string()), "\n".to_string()), "        run = type_census_run_add(run, contribution);".to_string()), "\n".to_string()), "        eprintln!(\"[native-census-infer] {}\", serde_json::json!({ \"module\": entry.module.clone(), \"nanos\": span_nanos(started) }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let receipt = type_census_receipt(run);".to_string()), "\n".to_string()), "    for line in receipt.lines.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    match &*receipt.terminal {".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimHeld => {".to_string()), "\n".to_string()), "            println!(\"{}\", serde_json::json!({ \"_terminal\": \"complete\", \"mode\": \"census-infer\", \"modules\": modules.len(), \"peak_rss_bytes\": proc_status_kib(\"VmHWM\").map(|kib| kib * 1024) }));".to_string()), "\n".to_string()), "            std::process::exit(0);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimNotHeld { reason } => {".to_string()), "\n".to_string()), "            eprintln!(\"NOT HELD: {reason}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimNoObservation { reason } => {".to_string()), "\n".to_string()), "            eprintln!(\"NO OBSERVATION: {reason}\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn native_cost_quantile_nanos(sorted: &[u128], numer: usize, denom: usize) -> u128 {".to_string()), "\n".to_string()), "    if sorted.is_empty() { return 0; }".to_string()), "\n".to_string()), "    let idx = (sorted.len() - 1) * numer / denom;".to_string()), "\n".to_string()), "    sorted[idx]".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// A SPAN IS READ ONCE, THROUGH A READER THAT REFUSES A CLOCK THAT WENT BACKWARDS.".to_string()), "\n".to_string()), "// Instant::elapsed is Instant::now().duration_since(earlier), and duration_since SATURATES:".to_string()), "\n".to_string()), "// a monotonic clock that is not actually monotonic -- which happens on some virtualised and".to_string()), "\n".to_string()), "// migrated hosts -- yields Duration::ZERO rather than an error. That is the fabricated zero".to_string()), "\n".to_string()), "// this receipt forbids, arriving by a quieter route than the saturating_sub it replaced: a".to_string()), "\n".to_string()), "// phase would report as having taken no time and the partition would balance for the wrong".to_string()), "\n".to_string()), "// reason. checked_duration_since returns None instead, so the impossible reading is".to_string()), "\n".to_string()), "// REPRESENTABLE and can be refused.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// AN EARLIER REVISION OF THIS FILE CLAIMED THE CLASS WAS STRUCTURALLY IMPOSSIBLE ONCE THE".to_string()), "\n".to_string()), "// subtraction was gone. That was wrong and is corrected rather than softened: deleting the".to_string()), "\n".to_string()), "// explicit subtraction removed the visible clamp, not the saturation underneath it. The".to_string()), "\n".to_string()), "// honest rung is MITIGATED BY A TYPED REFUSAL at a declared boundary -- the host clock is".to_string()), "\n".to_string()), "// external reality, which DESIGN section 4b keeps off the ladder rather than on its top rung.".to_string()), "\n".to_string()), "fn span_nanos(started: Instant) -> u128 {".to_string()), "\n".to_string()), "    match Instant::now().checked_duration_since(started) {".to_string()), "\n".to_string()), "        Some(d) => d.as_nanos(),".to_string()), "\n".to_string()), "        None => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: the monotonic clock went backwards between two reads, so no span is measurable\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// THE PARTITION IS JUDGED ON THREAD CPU, AND THIS IS ITS SPAN (std.realization_measurement".to_string()), "\n".to_string()), "// ObserveThreadCpuAtSubject; extdeps.posix.clock_gettime ClockThreadCputimeId). The law".to_string()), "\n".to_string()), "// native_driver_cost_account enforces is that the phases partition the DRIVER'S OWN WORK. A".to_string()), "\n".to_string()), "// wall span also holds every interval the host descheduled this thread -- another tenant's".to_string()), "\n".to_string()), "// build, page-fault service, a lock wait -- none of which any phase performed, so on a wall".to_string()), "\n".to_string()), "// clock that time fell into the residual and the verdict tracked host load -- the same subject".to_string()), "\n".to_string()), "// reconciled on a quiet runner and refused on a contended one. The thread".to_string()), "\n".to_string()), "// CPU clock advances only while this thread runs, so the residual is uninstrumented driver".to_string()), "\n".to_string()), "// work and nothing else. The wall is still read once, around the whole run, and printed as an".to_string()), "\n".to_string()), "// observation; it is never an input to the verdict. The driver is single-threaded, so the".to_string()), "\n".to_string()), "// thread clock is the driver's whole CPU. An unsupported clock refuses inside the runtime".to_string()), "\n".to_string()), "// read; there is no wall fallback.".to_string()), "\n".to_string()), "#[derive(Clone, Copy)]".to_string()), "\n".to_string()), "struct CpuMark(u128);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "fn cpu_mark() -> CpuMark {".to_string()), "\n".to_string()), "    CpuMark(observed_thread_cpu_nanos(String::new()) as u128)".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "fn cpu_span_nanos(started: CpuMark) -> u128 {".to_string()), "\n".to_string()), "    let finished = cpu_mark();".to_string()), "\n".to_string()), "    if finished.0 < started.0 {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: the thread CPU clock went backwards between two reads, so no span is measurable\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    finished.0 - started.0".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// A SPAN THAT DOES NOT FIT REFUSES RATHER THAN SATURATING (review 64474 control). This was".to_string()), "\n".to_string()), "// i64::try_from(n).unwrap_or(i64::MAX), which turns a failed conversion into a FIGURE -- and a".to_string()), "\n".to_string()), "// fabricated figure on a receipt is the state DESIGN section 5 forbids outright, whether the".to_string()), "\n".to_string()), "// invented number is a zero that reports a phase as instant or a maximum that reports it as".to_string()), "\n".to_string()), "// three centuries. The saturating arm also chose the direction that hides best: i64::MAX would".to_string()), "\n".to_string()), "// push the exclusive sum past the parent and surface as NativeDriverCostOverAttributed, a cost".to_string()), "\n".to_string()), "// verdict naming the wrong cause.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// ON REACHABILITY, STATED RATHER THAN LEFT AS AN IMPLIED CLAIM: i64 nanoseconds is about 292".to_string()), "\n".to_string()), "// years, so no span this driver measures reaches it, and the refusal below is not expected to".to_string()), "\n".to_string()), "// fire. It is written because the alternative is not silence but a LIE -- the arm has to answer".to_string()), "\n".to_string()), "// something, and the only honest answers are a real number or a refusal.".to_string()), "\n".to_string()), "fn native_cost_i64(n: u128) -> i64 {".to_string()), "\n".to_string()), "    match i64::try_from(n) {".to_string()), "\n".to_string()), "        Ok(v) => v,".to_string()), "\n".to_string()), "        Err(cause) => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: a measured span does not fit the cost carrier, so no partition can be reported: {n} ({cause})\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// AN UNREADABLE /proc IS ABSENT, NOT ZERO (review 64181). A zero here was printed as".to_string()), "\n".to_string()), "// peak_rss_bytes / rss_bytes and read as a measurement: a run on a host without /proc, or with".to_string()), "\n".to_string()), "// the key renamed, reported a process using no memory. Absence is carried as None and rendered".to_string()), "\n".to_string()), "// as JSON null, so the receipt says it does not know instead of inventing a figure. This is".to_string()), "\n".to_string()), "// telemetry on no receipt field, so it is the one place an Absent is carried rather than".to_string()), "\n".to_string()), "// refused: the run is still a valid observation of everything else.".to_string()), "\n".to_string()), "fn proc_status_kib(key: &str) -> Option<u64> {".to_string()), "\n".to_string()), "    let text = std::fs::read_to_string(\"/proc/self/status\").ok()?;".to_string()), "\n".to_string()), "    for line in text.lines() {".to_string()), "\n".to_string()), "        if let Some(rest) = line.strip_prefix(key) {".to_string()), "\n".to_string()), "            return rest".to_string()), "\n".to_string()), "                .trim_start_matches(':')".to_string()), "\n".to_string()), "                .trim()".to_string()), "\n".to_string()), "                .split_whitespace()".to_string()), "\n".to_string()), "                .next()".to_string()), "\n".to_string()), "                .and_then(|n| n.parse::<u64>().ok());".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    None".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// ONE CLOCK FOR THE VERDICT, AND IT IS THE THREAD CPU ONE (see cpu_span_nanos). Every exclusive".to_string()), "\n".to_string()), "// phase span and the parent span are read from it, so the partition compares readings from a".to_string()), "\n".to_string()), "// single source; the wall Instant around the run is an observation only. The history below is".to_string()), "\n".to_string()), "// why one source matters (review 64474), and it applied to the monotonic clock first.".to_string()), "\n".to_string()), "// They were split before this: the parent came from Instant while the phase spans came from".to_string()), "\n".to_string()), "// SystemTime, which is the wall clock and is free to step backwards under NTP or an operator".to_string()), "\n".to_string()), "// adjustment. A step between two phase reads could then push the exclusive sum past a parent".to_string()), "\n".to_string()), "// span that never moved, and the driver would refuse with NativeDriverCostOverAttributed --".to_string()), "\n".to_string()), "// a cost refusal whose real cause was the clock. That is a fabricated attribution: the numbers".to_string()), "\n".to_string()), "// would be wrong while the receipt read as a measurement.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// THE SUBTRACTION IS GONE RATHER THAN GUARDED, which is the point. A span used to be an".to_string()), "\n".to_string()), "// explicit saturating_sub of two readings, so a backwards step clamped the difference to zero".to_string()), "\n".to_string()), "// and reported a phase as having taken NO TIME -- the exact state the annotation beside it".to_string()), "\n".to_string()), "// forbade, reached by the arm meant to prevent it. Instant::elapsed cannot return a negative".to_string()), "\n".to_string()), "// duration, so there is no difference to clamp and no clamp to review: DESIGN section 5".to_string()), "\n".to_string()), "// construction over validation, and the class climbs from mitigated to structurally".to_string()), "\n".to_string()), "// impossible. The pre-epoch refusal that guarded the old wall-clock read is DELETED with it,".to_string()), "\n".to_string()), "// because the hazard it named cannot arise on this clock -- production handling dissolves on".to_string()), "\n".to_string()), "// the climb (DESIGN section 4b(4)); no evidence is retired here, since that arm had none.".to_string()), "\n".to_string()), "fn run_adjudication(facts_path: &str, pattern: Rc<TargetPattern>, source_roots: &[String]) {".to_string()), "\n".to_string()), "    let driver_start = cpu_mark();".to_string()), "\n".to_string()), "    let driver_wall_start = Instant::now();".to_string()), "\n".to_string()), "    // A MISSING GITHUB_SHA IS ABSENT, NOT \"local\" (review 64181). The receipt line carries this".to_string()), "\n".to_string()), "    // as the tree the measurement describes; the literal \"local\" is a plausible identity that".to_string()), "\n".to_string()), "    // no reader can distinguish from a tree actually named local.".to_string()), "\n".to_string()), "    let head: Option<String> = std::env::var(\"GITHUB_SHA\").ok();".to_string()), "\n".to_string()), "    let facts = read_host_facts(facts_path);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // the load row: reading the declared roots off disk. Its own exclusive row rather than a".to_string()), "\n".to_string()), "    // field on another phase, so the IO is never mixed into a fold's number.".to_string()), "\n".to_string()), "    let load_started = cpu_mark();".to_string()), "\n".to_string()), "    if source_roots.is_empty() {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: no source roots given\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let reads = read_ingest(source_roots);".to_string()), "\n".to_string()), "    let corpus_reads = reads.len();".to_string()), "\n".to_string()), "    let ingest = Rc::new(im::vector::Vector::from(reads));".to_string()), "\n".to_string()), "    let load_nanos = cpu_span_nanos(load_started);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // universe_derivation: the floor's own per-file discovery fold plus the module-header and".to_string()), "\n".to_string()), "    // import scans, over EVERY read -- discovery is a corpus-wide question -- and then the".to_string()), "\n".to_string()), "    // import closure of the universe's modules, which is all the front end is given.".to_string()), "\n".to_string()), "    let universe_started = cpu_mark();".to_string()), "\n".to_string()), "    let source_facts = native_lane_source_facts(ingest.clone());".to_string()), "\n".to_string()), "    // The universe is derived FROM THE FACTS ALREADY BOUND, not from the ingest again:".to_string()), "\n".to_string()), "    // the ingest-taking entry would re-run the whole-corpus discovery fold the line above".to_string()), "\n".to_string()), "    // just paid for, and that fold is the phase the pattern does NOT narrow. See".to_string()), "\n".to_string()), "    // v2.compiler.compile native_lane_universe_of_facts -- the pattern is threaded, so this".to_string()), "\n".to_string()), "    // is the same entry a narrower pattern reaches, never a filter over a default universe.".to_string()), "\n".to_string()), "    let universe = match &*native_lane_universe_of_facts(source_facts.clone(), pattern.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"DERIVATION-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    // The walk's budget exhausting is a refusal of the whole derivation, never a truncated".to_string()), "\n".to_string()), "    // closure: a narrowed ingest would surface only as unexplained resolve refusals later.".to_string()), "\n".to_string()), "    let closure = match &*native_lane_closure_modules(".to_string()), "\n".to_string()), "        source_facts.clone(),".to_string()), "\n".to_string()), "        universe.clone(),".to_string()), "\n".to_string()), "        native_lane_closure_round_budget(),".to_string()), "\n".to_string()), "    ) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CLOSURE-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let closure_ingest = native_lane_closure_ingest(ingest.clone(), source_facts.clone(), closure.clone());".to_string()), "\n".to_string()), "    let closure_reads = closure_ingest.len();".to_string()), "\n".to_string()), "    // The ingest receipt's identity join, asked by the route: every ingested source declares a".to_string()), "\n".to_string()), "    // closure module and every closure module some source declares was ingested. A miss is the".to_string()), "\n".to_string()), "    // hidden prepass (or a hidden narrowing) this receipt exists to refuse.".to_string()), "\n".to_string()), "    let ingest_receipt = native_lane_ingest_receipt(source_facts.clone(), closure.clone(), closure_ingest.clone());".to_string()), "\n".to_string()), "    // The join answers a typed refusal naming the offending identity, so the counts below are".to_string()), "\n".to_string()), "    // context for it rather than the whole diagnostic: a reader gets the module and the path,".to_string()), "\n".to_string()), "    // not a pair of totals to re-derive the offender from.".to_string()), "\n".to_string()), "    match &*native_lane_ingest_matches_closure(source_facts.clone(), ingest_receipt.clone(), closure_ingest.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { .. } => {}".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(".to_string()), "\n".to_string()), "                \"INGEST-CLOSURE-REFUSED: {:#?} (scanned={} ingested={} closure_modules={})\",".to_string()), "\n".to_string()), "                diagnostics,".to_string()), "\n".to_string()), "                ingest_receipt.scanned_paths.len(),".to_string()), "\n".to_string()), "                ingest_receipt.ingested_paths.len(),".to_string()), "\n".to_string()), "                ingest_receipt.closure_modules.len(),".to_string()), "\n".to_string()), "            );".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let universe_nanos = cpu_span_nanos(universe_started);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // the context row: the front-end fold over the CLOSURE only, entered ONE PHASE AT A TIME.".to_string()), "\n".to_string()), "    // The driver owns the clock, so it is the only place a phase span can be read; the phases".to_string()), "\n".to_string()), "    // themselves are v2.compiler.program_assembly declarations and each binds the previous".to_string()), "\n".to_string()), "    // phase's Outcome, so each phase BODY is single-authored and only the ORDER and the".to_string()), "\n".to_string()), "    // inter-phase diagnostic merge exist twice -- here and in the modeled composition".to_string()), "\n".to_string()), "    // program_assembly_read_to_normalized_root_seeded. (It named the UNSEEDED composition".to_string()), "\n".to_string()), "    // until that one was deleted for having no caller; the seeded producer is now the single".to_string()), "\n".to_string()), "    // modeled per-file front end, and this loop is still its second spelling.)".to_string()), "\n".to_string()), "    //".to_string()), "\n".to_string()), "    // THAT SECOND SPELLING IS ADMITTED DEBT AND IS FILED, NOT ASSERTED AWAY (review 65068):".to_string()), "\n".to_string()), "    // gunbc.recurring_failure_mode.realization_respells_a_modeled_folds_sequencing_to_instrument_it.".to_string()), "\n".to_string()), "    // An earlier revision of this comment claimed the two are the same computation. Nothing".to_string()), "\n".to_string()), "    // executes that claim, and a .dag witness comparing the composition against its own phases".to_string()), "\n".to_string()), "    // CANNOT go red -- the composition is defined as the phase chain -- so the honest answer is".to_string()), "\n".to_string()), "    // the row and its trigger (a realization seam that yields per-phase spans FROM a modeled".to_string()), "\n".to_string()), "    // fold), not a green check. Reordering these calls or dropping the merge that".to_string()), "\n".to_string()), "    // program_assembly_phase_parse_measured_seeded performs would change the context with".to_string()), "\n".to_string()), "    // nothing red.".to_string()), "\n".to_string()), "    let context_started = cpu_mark();".to_string()), "\n".to_string()), "    // THE ONCE-PER-FOLD INVARIANT IS PAID ONCE, HERE, AND CARRIED INTO EVERY FILE. A second".to_string()), "\n".to_string()), "    // dag_language_model() or prepare_grammar() call inside the loop would re-introduce at the".to_string()), "\n".to_string()), "    // realization layer exactly the per-file recompute the fold hoisted out.".to_string()), "\n".to_string()), "    let front_end = match &*native_test_front_end_prepare() {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CONTEXT-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let front_end_nanos = cpu_span_nanos(context_started);".to_string()), "\n".to_string()), "    // THE INGEST'S OCCURRENCE SCOPE, computed once: every projected occurrence the loop's".to_string()), "\n".to_string()), "    // normalize allocates states its cause in it (v2.compiler.program_assembly".to_string()), "\n".to_string()), "    // program_assembly_ingest_scope).".to_string()), "\n".to_string()), "    let ingest_scope = match &*program_assembly_ingest_scope_outcome(closure_ingest.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CONTEXT-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let mut context_state = native_test_context_state_empty();".to_string()), "\n".to_string()), "    let mut tokenize_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut parse_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut normalize_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut absorb_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut phase_calls: u64 = 0;".to_string()), "\n".to_string()), "    let mut token_total: u64 = 0;".to_string()), "\n".to_string()), "    let mut memo_hits_total: u64 = 0;".to_string()), "\n".to_string()), "    let mut memo_misses_total: u64 = 0;".to_string()), "\n".to_string()), "    let mut memo_lookups_total: u64 = 0;".to_string()), "\n".to_string()), "    let mut byte_total: u64 = 0;".to_string()), "\n".to_string()), "    let mut context_file_samples: Vec<u128> = Vec::new();".to_string()), "\n".to_string()), "    for read in closure_ingest.iter() {".to_string()), "\n".to_string()), "        let file_started = cpu_mark();".to_string()), "\n".to_string()), "        let tokenize_started = cpu_mark();".to_string()), "\n".to_string()), "        let tokens = program_assembly_phase_tokenize(read.clone(), front_end.lex.clone());".to_string()), "\n".to_string()), "        let file_tokenize_nanos = cpu_span_nanos(tokenize_started);".to_string()), "\n".to_string()), "        // The COUNT the time is read against: a span alone cannot separate a large file from a".to_string()), "\n".to_string()), "        // per-file constant. Counted outside every phase span so it prices none of them.".to_string()), "\n".to_string()), "        let file_tokens = program_assembly_phase_token_count(tokens.clone());".to_string()), "\n".to_string()), "        let parse_started = cpu_mark();".to_string()), "\n".to_string()), "        // SEEDED FROM THE MARK THE CONTEXT HAS REACHED, because this loop IS a source graph:".to_string()), "\n".to_string()), "        // std.occurrence_identity occurrence_identity_scope_law requires one allocator threaded".to_string()), "\n".to_string()), "        // across every parsed source, and a per-file reset makes two files' occurrence #N the".to_string()), "\n".to_string()), "        // same value with different meanings. The modeled fold threads it internally; this".to_string()), "\n".to_string()), "        // respelling has to thread it explicitly or it keeps the reset the fold no longer has.".to_string()), "\n".to_string()), "        let file_seed = context_state.alloc.clone();".to_string()), "\n".to_string()), "        let file_seed_reported = file_seed.clone();".to_string()), "\n".to_string()), "        let measured = program_assembly_phase_parse_measured_seeded(".to_string()), "\n".to_string()), "            tokens.clone(),".to_string()), "\n".to_string()), "            front_end.prepared.clone(),".to_string()), "\n".to_string()), "            // The residue field is an Optional whose inner type rides a recursion cycle, so the".to_string()), "\n".to_string()), "            // emitted record BOXES it while the phase takes the option by value. Deref the box".to_string()), "\n".to_string()), "            // rather than clone it; the sibling fields above are Rc and clone correctly.".to_string()), "\n".to_string()), "            (*front_end.residue).clone(),".to_string()), "\n".to_string()), "            file_seed.clone(),".to_string()), "\n".to_string()), "        );".to_string()), "\n".to_string()), "        let file_parse_nanos = cpu_span_nanos(parse_started);".to_string()), "\n".to_string()), "        // The memo accounting rides BESIDE the outcome, so it reports on a refusal too --".to_string()), "\n".to_string()), "        // which is the expensive case this instrument exists to read. Counted outside every".to_string()), "\n".to_string()), "        // phase span so it prices none of them.".to_string()), "\n".to_string()), "        let file_memo_hits = program_assembly_memo_hits(measured.clone());".to_string()), "\n".to_string()), "        let file_memo_misses = program_assembly_memo_misses(measured.clone());".to_string()), "\n".to_string()), "        let file_memo_lookups = program_assembly_memo_lookup_calls(measured.clone());".to_string()), "\n".to_string()), "        // Read BEFORE program_assembly_measured_outcome consumes `measured`. On a refused parse".to_string()), "\n".to_string()), "        // this returns the seed unchanged. Not because nothing was minted -- a refused parse".to_string()), "\n".to_string()), "        // HAS minted ids -- but because ParseExprRejected carries no provenance state, so the".to_string()), "\n".to_string()), "        // mark the attempt reached is not recoverable. See the precondition on".to_string()), "\n".to_string()), "        // v2.compiler.compile native_test_context_absorb.".to_string()), "\n".to_string()), "        let file_alloc = program_assembly_measured_alloc(measured.clone(), file_seed);".to_string()), "\n".to_string()), "        let parsed = program_assembly_measured_outcome(measured);".to_string()), "\n".to_string()), "        let normalize_started = cpu_mark();".to_string()), "\n".to_string()), "        // NORMALIZE ADVANCES THE ALLOCATOR: lowering allocates every image member an id, so the".to_string()), "\n".to_string()), "        // next file seeds from the mark normalize reached, not the one parse reached.".to_string()), "\n".to_string()), "        let normalized = program_assembly_phase_normalize_seeded(parsed.clone(), file_alloc.clone(), ingest_scope.clone());".to_string()), "\n".to_string()), "        let root = program_assembly_normalized_outcome(normalized.clone());".to_string()), "\n".to_string()), "        let file_spans = program_assembly_normalized_spans(normalized.clone());".to_string()), "\n".to_string()), "        let file_alloc = program_assembly_normalized_alloc(normalized);".to_string()), "\n".to_string()), "        let file_alloc_reported = file_alloc.clone();".to_string()), "\n".to_string()), "        let file_normalize_nanos = cpu_span_nanos(normalize_started);".to_string()), "\n".to_string()), "        // qualified-name read plus source-root index insertion: the half of the per-file step".to_string()), "\n".to_string()), "        // that is not the front end, timed separately because a quadratic accumulator would".to_string()), "\n".to_string()), "        // live here and nowhere else in this loop.".to_string()), "\n".to_string()), "        let absorb_started = cpu_mark();".to_string()), "\n".to_string()), "        context_state = native_test_context_absorb(context_state.clone(), read.clone(), root.clone(), file_alloc, file_spans);".to_string()), "\n".to_string()), "        let file_absorb_nanos = cpu_span_nanos(absorb_started);".to_string()), "\n".to_string()), "        let file_nanos = cpu_span_nanos(file_started);".to_string()), "\n".to_string()), "        tokenize_nanos += file_tokenize_nanos;".to_string()), "\n".to_string()), "        parse_nanos += file_parse_nanos;".to_string()), "\n".to_string()), "        normalize_nanos += file_normalize_nanos;".to_string()), "\n".to_string()), "        absorb_nanos += file_absorb_nanos;".to_string()), "\n".to_string()), "        phase_calls += 1;".to_string()), "\n".to_string()), "        token_total += file_tokens.max(0) as u64;".to_string()), "\n".to_string()), "        memo_hits_total += file_memo_hits.max(0) as u64;".to_string()), "\n".to_string()), "        memo_misses_total += file_memo_misses.max(0) as u64;".to_string()), "\n".to_string()), "        memo_lookups_total += file_memo_lookups.max(0) as u64;".to_string()), "\n".to_string()), "        let file_bytes = read.source.carried.len() as u64;".to_string()), "\n".to_string()), "        byte_total += file_bytes;".to_string()), "\n".to_string()), "        context_file_samples.push(file_nanos);".to_string()), "\n".to_string()), "        eprintln!(".to_string()), "\n".to_string()), "            \"[native-context-split] {}\",".to_string()), "\n".to_string()), "            serde_json::json!({".to_string()), "\n".to_string()), "                \"producer\": \"std.compiler_entry.SourceRootEvalDriver\",".to_string()), "\n".to_string()), "                \"path\": read.compilation_unit.clone(),".to_string()), "\n".to_string()), "                \"bytes\": file_bytes,".to_string()), "\n".to_string()), "                \"tokens\": file_tokens,".to_string()), "\n".to_string()), "                \"tokenize_nanos\": file_tokenize_nanos,".to_string()), "\n".to_string()), "                \"parse_nanos\": file_parse_nanos,".to_string()), "\n".to_string()), "                \"normalize_nanos\": file_normalize_nanos,".to_string()), "\n".to_string()), "                \"absorb_nanos\": file_absorb_nanos,".to_string()), "\n".to_string()), "                \"file_nanos\": file_nanos,".to_string()), "\n".to_string()), "                \"memo_hits\": file_memo_hits,".to_string()), "\n".to_string()), "                \"memo_misses\": file_memo_misses,".to_string()), "\n".to_string()), "                \"memo_lookup_calls\": file_memo_lookups,".to_string()), "\n".to_string()), "                // THE THREADING, MADE OBSERVABLE. occurrence_seed is the mark this file was".to_string()), "\n".to_string()), "                // handed and occurrence_next the mark it reached, so a multi-file run shows".to_string()), "\n".to_string()), "                // one sequence continuing across files instead of each file restarting at 0.".to_string()), "\n".to_string()), "                // A REFUSED file reports next == seed. That is the mark it was HANDED, not a".to_string()), "\n".to_string()), "                // claim that nothing was minted: a refused parse mints ids that the refusal".to_string()), "\n".to_string()), "                // discards unrecoverably. The next file continues from the seed rather than".to_string()), "\n".to_string()), "                // rewinding to zero.".to_string()), "\n".to_string()), "                \"occurrence_seed\": program_assembly_allocator_next(file_seed_reported),".to_string()), "\n".to_string()), "                \"occurrence_next\": program_assembly_allocator_next(file_alloc_reported),".to_string()), "\n".to_string()), "            }),".to_string()), "\n".to_string()), "        );".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let context = native_test_context_finish(context_state, front_end.clone(), closure_ingest.clone());".to_string()), "\n".to_string()), "    let context_nanos = cpu_span_nanos(context_started);".to_string()), "\n".to_string()), "    context_file_samples.sort_unstable();".to_string()), "\n".to_string()), "    let context_phase_sum = front_end_nanos + tokenize_nanos + parse_nanos + normalize_nanos + absorb_nanos;".to_string()), "\n".to_string()), "    eprintln!(".to_string()), "\n".to_string()), "        \"[native-context-partition] {}\",".to_string()), "\n".to_string()), "        serde_json::json!({".to_string()), "\n".to_string()), "            \"producer\": \"std.compiler_entry.SourceRootEvalDriver\",".to_string()), "\n".to_string()), "            \"basis\": \"context_span\",".to_string()), "\n".to_string()), "            \"basis_note\": \"exclusive phase rows partition context_nanos; residual is loop overhead and the eprintln per file\",".to_string()), "\n".to_string()), "            \"context_nanos\": context_nanos,".to_string()), "\n".to_string()), "            \"front_end_prepare_nanos\": front_end_nanos,".to_string()), "\n".to_string()), "            \"tokenize_nanos\": tokenize_nanos,".to_string()), "\n".to_string()), "            \"parse_nanos\": parse_nanos,".to_string()), "\n".to_string()), "            \"normalize_nanos\": normalize_nanos,".to_string()), "\n".to_string()), "            \"absorb_nanos\": absorb_nanos,".to_string()), "\n".to_string()), "            \"sum_phase_nanos\": context_phase_sum,".to_string()), "\n".to_string()), "            \"residual_nanos\": context_nanos.saturating_sub(context_phase_sum),".to_string()), "\n".to_string()), "            \"files\": phase_calls,".to_string()), "\n".to_string()), "            \"tokenize_calls\": phase_calls,".to_string()), "\n".to_string()), "            \"parse_calls\": phase_calls,".to_string()), "\n".to_string()), "            \"normalize_calls\": phase_calls,".to_string()), "\n".to_string()), "            \"absorb_calls\": phase_calls,".to_string()), "\n".to_string()), "            \"front_end_prepare_calls\": 1,".to_string()), "\n".to_string()), "            \"tokens\": token_total,".to_string()), "\n".to_string()), "            \"memo_hits\": memo_hits_total,".to_string()), "\n".to_string()), "            \"memo_misses\": memo_misses_total,".to_string()), "\n".to_string()), "            \"memo_lookup_calls\": memo_lookups_total,".to_string()), "\n".to_string()), "            \"bytes\": byte_total,".to_string()), "\n".to_string()), "            \"file_refusals\": context.file_refusals.len(),".to_string()), "\n".to_string()), "            \"file_p50_nanos\": native_cost_quantile_nanos(&context_file_samples, 1, 2),".to_string()), "\n".to_string()), "            \"file_p95_nanos\": native_cost_quantile_nanos(&context_file_samples, 19, 20),".to_string()), "\n".to_string()), "            \"file_max_nanos\": context_file_samples.last().copied().unwrap_or(0),".to_string()), "\n".to_string()), "        }),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // the prepare and eval rows, entered separately per module so the number the profile".to_string()), "\n".to_string()), "    // lane prices -- the eval row -- is the sum of native_lane_identity_row".to_string()), "\n".to_string()), "    // and nothing else: not ingest, not resolve, not infer.".to_string()), "\n".to_string()), "    let mut population: Vec<Rc<NativeRouteMemberRow>> = Vec::new();".to_string()), "\n".to_string()), "    let mut prepare_total_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut evaluate_total_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut prepare_samples: Vec<u128> = Vec::new();".to_string()), "\n".to_string()), "    let mut eval_samples: Vec<u128> = Vec::new();".to_string()), "\n".to_string()), "    // ExclusiveModuleRelease IS NOW STRUCTURALLY ZERO, AND THAT IS A REAL CHANGE RATHER".to_string()), "\n".to_string()), "    // THAN A TIDY-UP. The displaced loop dropped each module's resolved tree inside a span,".to_string()), "\n".to_string()), "    // because dropping at iteration end paid time no exclusive row covered. The engine holds".to_string()), "\n".to_string()), "    // every settled demand's value in its entries for the whole run, so there is no per-module".to_string()), "\n".to_string()), "    // release point to time -- resolved trees now accumulate where they used to be released.".to_string()), "\n".to_string()), "    // The row stays in the partition reporting zero rather than being deleted: a key removed".to_string()), "\n".to_string()), "    // here vanishes from the sum and the serialized line at once, silently, and the residual".to_string()), "\n".to_string()), "    // it used to carry would be absorbed into the tolerance rather than reported. Retention is".to_string()), "\n".to_string()), "    // std.materialization_ladder's question and the cut that answers it owns this row.".to_string()), "\n".to_string()), "    let module_release_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut relay_emit_nanos: u128 = 0;".to_string()), "\n".to_string()), "    // The per-path refusal index is built ONCE here rather than per module: this loop is the".to_string()), "\n".to_string()), "    // only place that knows a loop is about to happen, and the join it feeds was O(modules x".to_string()), "\n".to_string()), "    // refusals) when each module scanned the refusal list for itself.".to_string()), "\n".to_string()), "    let refusal_index = native_lane_file_refusal_index(context.file_refusals.clone());".to_string()), "\n".to_string()), "    // ═══════════════════════════════════════════════════════════════════════════════════════".to_string()), "\n".to_string()), "    // THE SCHEDULE IS THE ENGINE'S. THIS LOOP HOLDS THE CLOCK AND NOTHING ELSE.".to_string()), "\n".to_string()), "    // ═══════════════════════════════════════════════════════════════════════════════════════".to_string()), "\n".to_string()), "    //".to_string()), "\n".to_string()), "    // What stood here was `for entry in universe.modules` with `for declaration in".to_string()), "\n".to_string()), "    // entry.declarations` nested inside it -- a dependency structure written as control flow, and".to_string()), "\n".to_string()), "    // the last place in the native route that decided WHAT RUNS NEXT. It is deleted. The order now".to_string()), "\n".to_string()), "    // comes from v2.std.demand_engine's one ready queue, over a graph".to_string()), "\n".to_string()), "    // v2.compiler.native_demand_schedule DERIVES from the same universe roster this loop walked.".to_string()), "\n".to_string()), "    //".to_string()), "\n".to_string()), "    // WHY A LOOP REMAINS AT ALL, and why it is not the old one wearing a new name: a .dag fold".to_string()), "\n".to_string()), "    // cannot read a clock, and the native cost partition is an EXHAUSTIVE exclusive sum over".to_string()), "\n".to_string()), "    // parent_span with a 50ms tolerance arm. Replacing the walk with one opaque call would have".to_string()), "\n".to_string()), "    // dissolved the prepare and eval rows into an unattributed remainder and made that arm fire --".to_string()), "\n".to_string()), "    // so the driver asks the engine for the next admissible demand and spans the step. It supplies".to_string()), "\n".to_string()), "    // no ordering, no module iteration and no declaration iteration; remove the spans and the body".to_string()), "\n".to_string()), "    // is a drain.".to_string()), "\n".to_string()), "    //".to_string()), "\n".to_string()), "    // THE SEAT COUNT IS THE CALLER'S. One seat here, which is what makes this cut a pure authority".to_string()), "\n".to_string()), "    // move: same demands, same order, same single execution at a time. Multi-seat realization binds".to_string()), "\n".to_string()), "    // a different offer to the same drain and changes nothing else.".to_string()), "\n".to_string()), "    // THE DRIVER'S OWN INPUT CONSTRUCTION, charged to prepare as it was before the engine landed:".to_string()), "\n".to_string()), "    // it runs before any demand and is not the scheduler's bookkeeping, which the engine measures".to_string()), "\n".to_string()), "    // for itself.".to_string()), "\n".to_string()), "    let tested_tree_started = cpu_mark();".to_string()), "\n".to_string()), "    let tested_tree_input = native_demand_tested_tree_input(head.clone().unwrap_or_default());".to_string()), "\n".to_string()), "    prepare_total_nanos += cpu_span_nanos(tested_tree_started);".to_string()), "\n".to_string()), "    // ONE CALL. The driver does not drain the graph, does not decide readiness and does not".to_string()), "\n".to_string()), "    // classify a demand's stage -- those are the engine's and the plan's decisions, and a".to_string()), "\n".to_string()), "    // rendered-main loop that made them was a second consumer of the engine's admission".to_string()), "\n".to_string()), "    // vocabulary living in generated Rust, where no .dag check reaches.".to_string()), "\n".to_string()), "    //".to_string()), "\n".to_string()), "    // IT USED TO HOLD A LOOP FOR THE CLOCK, AND THAT REASON WAS WRONG. Each step now takes".to_string()), "\n".to_string()), "    // its own span through observed_thread_cpu_nanos -- an ordinary builtin with no resource".to_string()), "\n".to_string()), "    // requirement, modelled by std.realization_measurement as ObserveThreadCpuAtSubject's".to_string()), "\n".to_string()), "    // realization seam -- so the exclusive prepare and eval rows survive with the spans taken".to_string()), "\n".to_string()), "    // where the work is instead of around it.".to_string()), "\n".to_string()), "    // THE ENGINE CALL IS ONE MEASURED SPAN (std.compiler_entry ExclusiveDemandScheduling). Its".to_string()), "\n".to_string()), "    // demand windows are the prepare and eval rows; everything else the call spends is the".to_string()), "\n".to_string()), "    // scheduler's, including the work between the engine's own bookkeeping spans that no row".to_string()), "\n".to_string()), "    // timed when this row was the sum of those spans.".to_string()), "\n".to_string()), "    let schedule_started = cpu_mark();".to_string()), "\n".to_string()), "    let run = native_demand_schedule_universe(".to_string()), "\n".to_string()), "        universe.modules.clone(),".to_string()), "\n".to_string()), "        context.clone(),".to_string()), "\n".to_string()), "        refusal_index.clone(),".to_string()), "\n".to_string()), "        tested_tree_input.clone(),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    let schedule_span_nanos = cpu_span_nanos(schedule_started);".to_string()), "\n".to_string()), "    // driver_collection: the driver's own work after the engine returned -- rows into the".to_string()), "\n".to_string()), "    // population, the samples, the counters. Named for what it is, not folded into scheduling.".to_string()), "\n".to_string()), "    let collection_started = cpu_mark();".to_string()), "\n".to_string()), "    for row in native_demand_run_rows(run.clone()).iter() {".to_string()), "\n".to_string()), "        population.push(row.clone());".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let engine_prepare_nanos = native_demand_prepare_nanos(run.clone()).max(0) as u128;".to_string()), "\n".to_string()), "    let engine_eval_nanos = native_demand_eval_nanos(run.clone()).max(0) as u128;".to_string()), "\n".to_string()), "    // OBSERVATION ONLY (v2.compiler.compile native_demand_occurrence_census_lines): the census is its".to_string()), "\n".to_string()), "    // own demand kind, so its cost is the engine-reported ExclusiveOccurrenceCensus row, not a host span.".to_string()), "\n".to_string()), "    let occurrence_census_nanos = native_demand_occurrence_census_nanos(run.clone()).max(0) as u128;".to_string()), "\n".to_string()), "    prepare_total_nanos += engine_prepare_nanos;".to_string()), "\n".to_string()), "    evaluate_total_nanos += engine_eval_nanos;".to_string()), "\n".to_string()), "    // The engine's own bookkeeping sum stays an observation on the schedule line; it is not the row.".to_string()), "\n".to_string()), "    let engine_bookkeeping_nanos = native_demand_scheduling_nanos(run.clone()).max(0) as u128;".to_string()), "\n".to_string()), "    // Every demand window the engine attributes -- prepare, eval and the occurrence census -- is a row".to_string()), "\n".to_string()), "    // of its own, so the scheduling row is the call span minus all three. Leaving the census out would".to_string()), "\n".to_string()), "    // count its windows twice. An engine that attributed more than its call took is incoherent; refuse".to_string()), "\n".to_string()), "    // rather than clamp the scheduling row to zero.".to_string()), "\n".to_string()), "    let attributed_in_call = engine_prepare_nanos + engine_eval_nanos + occurrence_census_nanos;".to_string()), "\n".to_string()), "    if attributed_in_call > schedule_span_nanos {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: native driver cost OverAttributed inside the engine call {{ attributed_nanos: {}, schedule_span_nanos: {} }}\", attributed_in_call, schedule_span_nanos);".to_string()), "\n".to_string()), "        std::process::exit(1);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let demand_scheduling_nanos = schedule_span_nanos - attributed_in_call;".to_string()), "\n".to_string()), "    for line in native_demand_occurrence_census_lines(run.clone(), universe.modules.len() as i64).iter() {".to_string()), "\n".to_string()), "        eprintln!(\"{}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for n in native_demand_prepare_samples(run.clone()).iter() {".to_string()), "\n".to_string()), "        prepare_samples.push((*n).max(0) as u128);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for n in native_demand_eval_samples(run.clone()).iter() {".to_string()), "\n".to_string()), "        eval_samples.push((*n).max(0) as u128);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let prepare_ok: u64 = native_demand_prepare_ok(run.clone()).max(0) as u64;".to_string()), "\n".to_string()), "    let prepare_refused: u64 = native_demand_prepare_refused(run.clone()).max(0) as u64;".to_string()), "\n".to_string()), "    let driver_collection_nanos = cpu_span_nanos(collection_started);".to_string()), "\n".to_string()), "    // THE DRIVER REFUSES A RUN WHOSE CLOCK NEVER ADVANCED rather than reporting its zeros. A".to_string()), "\n".to_string()), "    // realization whose body returns a constant zero leaves every transition CLASSIFIED and".to_string()), "\n".to_string()), "    // VALIDLY OBSERVED, so completeness answers true over totals that are all zero, and the".to_string()), "\n".to_string()), "    // emitted-body membership check cannot see it either -- that check establishes a bridge HAS".to_string()), "\n".to_string()), "    // a body, never that the body measures. Reporting those zeros would be a fabricated".to_string()), "\n".to_string()), "    // measurement presented as an observation, so the line stops here with a located cause.".to_string()), "\n".to_string()), "    if !native_demand_observation_progressed(run.clone()) {".to_string()), "\n".to_string()), "        eprintln!(".to_string()), "\n".to_string()), "            \"[native-demand-schedule] REFUSED: transitions={} executed and the elapsed observation accumulated no span; the emitted monotonic clock is not advancing\",".to_string()), "\n".to_string()), "            native_demand_run_transition_count(run.clone()),".to_string()), "\n".to_string()), "        );".to_string()), "\n".to_string()), "        std::process::exit(1);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // THE EVENT TRACE, SEPARATE FROM THE RESULT. One line per admission in admission order, each".to_string()), "\n".to_string()), "    // naming the demand key and the state it settled into. It is the schedule's receipt and it is".to_string()), "\n".to_string()), "    // deliberately not the population: two runs agreeing on rows while disagreeing on order is a".to_string()), "\n".to_string()), "    // real difference, and a receipt that carried only rows could not report it.".to_string()), "\n".to_string()), "    let relay_started = cpu_mark();".to_string()), "\n".to_string()), "    for line in native_demand_run_receipt_lines(run.clone()).iter() {".to_string()), "\n".to_string()), "        eprintln!(\"[native-demand-transition] {}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    eprintln!(".to_string()), "\n".to_string()), "        \"[native-demand-schedule] demands={} admitted={} readiness_derivations={} schedule_span_nanos={} engine_bookkeeping_nanos={}\",".to_string()), "\n".to_string()), "        native_demand_run_demand_count(run.clone()),".to_string()), "\n".to_string()), "        native_demand_run_transition_count(run.clone()),".to_string()), "\n".to_string()), "        native_demand_run_readiness_derivations(run.clone()),".to_string()), "\n".to_string()), "        schedule_span_nanos,".to_string()), "\n".to_string()), "        engine_bookkeeping_nanos,".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    relay_emit_nanos += cpu_span_nanos(relay_started);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // receipt_admission: minting the receipt and evaluating the authority's admission and summary".to_string()), "\n".to_string()), "    // over it. The controls are executed here because they are receipt inputs, not universe members.".to_string()), "\n".to_string()), "    let admission_started = cpu_mark();".to_string()), "\n".to_string()), "    let receipt = native_lane_receipt(".to_string()), "\n".to_string()), "        context.clone(),".to_string()), "\n".to_string()), "        universe.clone(),".to_string()), "\n".to_string()), "        Rc::new(population.clone().into()),".to_string()), "\n".to_string()), "        native_lane_controls(context.clone()),".to_string()), "\n".to_string()), "        Rc::new(facts),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    let admission = native_route_admission(receipt.clone());".to_string()), "\n".to_string()), "    let summary = native_route_admission_summary(admission.clone());".to_string()), "\n".to_string()), "    let file_refusal_tally: Vec<serde_json::Value> = native_route_file_refusal_tally(receipt.clone())".to_string()), "\n".to_string()), "        .iter()".to_string()), "\n".to_string()), "        .map(|row| serde_json::json!(row))".to_string()), "\n".to_string()), "        .collect();".to_string()), "\n".to_string()), "    let admitted = native_route_admitted(admission.clone());".to_string()), "\n".to_string()), "    // THE FRONTIER RATCHET, OVER THE SAME RECEIPT AND INSIDE THE SAME SPAN: the verdict is".to_string()), "\n".to_string()), "    // gunbc.native_frontier_ratchet's, and this main only carries its word to the terminal marker".to_string()), "\n".to_string()), "    // and its lines to stderr. It is measured under receipt_admission because it is judgement of".to_string()), "\n".to_string()), "    // the receipt, the row that span already names.".to_string()), "\n".to_string()), "    let frontier = native_frontier_verdict(receipt.clone(), admission.clone(), pattern.clone());".to_string()), "\n".to_string()), "    let frontier_word = native_frontier_verdict_word(frontier.clone());".to_string()), "\n".to_string()), "    let admission_nanos = cpu_span_nanos(admission_started);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // row_serialization: SERIALIZING THE OBSERVATIONS AND WRITING THEM, MEASURED (review".to_string()), "\n".to_string()), "    // 64181 named this span; #11105 made leaving it unattributed fatal). Every row the".to_string()), "\n".to_string()), "    // population carries is turned into JSON here and written to stdout, which is real work".to_string()), "\n".to_string()), "    // no other row covers -- eval is the identity fold and nothing else. It is TIMED, never".to_string()), "\n".to_string()), "    // derived as parent minus the others: a row defined as the remainder would force the".to_string()), "\n".to_string()), "    // residual to zero and make the tolerance arm unfireable by construction.".to_string()), "\n".to_string()), "    let serialization_started = cpu_mark();".to_string()), "\n".to_string()), "    for refusal in receipt.file_refusals.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"file_refusal\": refusal }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for advised in context.accepted_file_advisories.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"accepted_file_advisories\": advised }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for row in population.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::to_string(row).unwrap());".to_string()), "\n".to_string()), "        // THE OPERATOR'S LINE, BESIDE THE PERSISTED ROW. The JSON above is the receipt; this is".to_string()), "\n".to_string()), "        // the same value rendered by the authority for a reader of the command's output, so a".to_string()), "\n".to_string()), "        // row that did not pass names its subject, stage, cause and position without anyone".to_string()), "\n".to_string()), "        // re-deriving them from the bytes just written. Passing rows print nothing here: the".to_string()), "\n".to_string()), "        // terminal marker carries their count. EXHAUSTIVE ON PURPOSE -- a verdict arm added to".to_string()), "\n".to_string()), "        // the vocabulary must decide here whether it is operator-visible.".to_string()), "\n".to_string()), "        match &*row.verdict {".to_string()), "\n".to_string()), "            NativeTestVerdict::NativeTestPassed => {}".to_string()), "\n".to_string()), "            NativeTestVerdict::NativeTestReturnedFalse".to_string()), "\n".to_string()), "            | NativeTestVerdict::NativeTestReturnedOther".to_string()), "\n".to_string()), "            | NativeTestVerdict::NativeTestRefused { .. } => {".to_string()), "\n".to_string()), "                eprintln!(\"[native-verdict] {}\", native_route_member_row_text(row.clone()));".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for line in native_frontier_report_lines(frontier.clone()).iter() {".to_string()), "\n".to_string()), "        eprintln!(\"[native-frontier] {}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for line in native_frontier_proposal_file_lines(receipt.clone(), frontier.clone()).iter() {".to_string()), "\n".to_string()), "        eprintln!(\"[native-frontier-roster] {}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let row_serialization_nanos = cpu_span_nanos(serialization_started);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // THE PARTITION, THROUGH THE ONE LAW. The rows are the row set std.compiler_entry owns and".to_string()), "\n".to_string()), "    // verdict is native_driver_cost_account over them -- not a second reconcile. The two rows".to_string()), "\n".to_string()), "    // this route pays that a driver handed a universe file does not (universe_derivation,".to_string()), "\n".to_string()), "    // receipt_admission) are members of the same exclusive sum, so an over-attribution through".to_string()), "\n".to_string()), "    // either is caught here rather than by a check of its own.".to_string()), "\n".to_string()), "    prepare_samples.sort_unstable();".to_string()), "\n".to_string()), "    eval_samples.sort_unstable();".to_string()), "\n".to_string()), "    let parent_span_nanos = cpu_span_nanos(driver_start);".to_string()), "\n".to_string()), "    let parent_wall_nanos = span_nanos(driver_wall_start);".to_string()), "\n".to_string()), "    // THE DRIVER IS EXHAUSTIVE OVER THE KEY WITH NO WILDCARD, deliberately: a row added to".to_string()), "\n".to_string()), "    // std.compiler_entry makes THIS match refuse to compile until the driver says what".to_string()), "\n".to_string()), "    // measures it. A wildcard here would answer zero for a span nobody wired up, which is".to_string()), "\n".to_string()), "    // the absorbing arm DESIGN section 5 forbids -- and it is what the old record literal".to_string()), "\n".to_string()), "    // did silently, three folds running.".to_string()), "\n".to_string()), "    let exclusive = native_driver_exclusive_rows(move |k| match k {".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveLoad => nanosecond(native_cost_i64(load_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveUniverseDerivation => nanosecond(native_cost_i64(universe_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveContext => nanosecond(native_cost_i64(context_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusivePrepare => nanosecond(native_cost_i64(prepare_total_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveEval => nanosecond(native_cost_i64(evaluate_total_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveReceiptAdmission => nanosecond(native_cost_i64(admission_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveRowSerialization => nanosecond(native_cost_i64(row_serialization_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveDemandScheduling => nanosecond(native_cost_i64(demand_scheduling_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveDriverCollection => nanosecond(native_cost_i64(driver_collection_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveOccurrenceCensus => nanosecond(native_cost_i64(occurrence_census_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveModuleRelease => nanosecond(native_cost_i64(module_release_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveRelayEmit => nanosecond(native_cost_i64(relay_emit_nanos)),".to_string()), "\n".to_string()), "    });".to_string()), "\n".to_string()), "    let exclusive_sum = nanosecond_count(native_driver_exclusive_sum(exclusive.clone())) as u128;".to_string()), "\n".to_string()), "    let tolerance_nanos = nanosecond_count(native_driver_cost_remainder_tolerance_nanos()) as u128;".to_string()), "\n".to_string()), "    let accounting = native_driver_cost_account(".to_string()), "\n".to_string()), "        nanosecond(native_cost_i64(parent_span_nanos)),".to_string()), "\n".to_string()), "        exclusive.clone(),".to_string()), "\n".to_string()), "        native_driver_cost_remainder_tolerance_nanos(),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    // The remainder is the residual the accounting itself returns, never parent minus sum: on".to_string()), "\n".to_string()), "    // over-attributed arm there IS no remainder, and a clamped zero there would be a".to_string()), "\n".to_string()), "    // plausible number standing where the measurement is incoherent.".to_string()), "\n".to_string()), "    let (verdict, remainder_nanos) = match accounting.as_ref() {".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostOverAttributed { .. } =>".to_string()), "\n".to_string()), "            (r#\"NativeDriverCostOverAttributed\"#, serde_json::Value::Null),".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostRemainderExceedsTolerance { residual, .. } =>".to_string()), "\n".to_string()), "            (r#\"NativeDriverCostRemainderExceedsTolerance\"#, serde_json::json!(nanosecond_count(residual.clone()))),".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostReconciled { residual, .. } =>".to_string()), "\n".to_string()), "            (r#\"NativeDriverCostReconciled\"#, serde_json::json!(nanosecond_count(residual.clone()))),".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let identities = universe.identities.len() as u64;".to_string()), "\n".to_string()), "    let eval_mean = if eval_samples.is_empty() { 0 } else { evaluate_total_nanos / eval_samples.len() as u128 };".to_string()), "\n".to_string()), "    let prepare_mean = if prepare_samples.is_empty() { 0 } else { prepare_total_nanos / prepare_samples.len() as u128 };".to_string()), "\n".to_string()), "    // THE ROWS ARE PROJECTED FROM THE VALUE, NOT RE-LISTED (review 64181). The field names".to_string()), "\n".to_string()), "    // were written once to build NativeDriverExclusiveRows and again to render it, which is the".to_string()), "\n".to_string()), "    // second spelling this file warns about for prose, applied to the emitted object: a driver".to_string()), "\n".to_string()), "    // gaining a phase would have updated the struct and left the receipt short. Serializing the".to_string()), "\n".to_string()), "    // value carries the row set from the type, so the JSON cannot disagree with the fold. The".to_string()), "\n".to_string()), "    // rows therefore render as std.measure Nanosecond objects rather than bare integers -- the".to_string()), "\n".to_string()), "    // unit travels with the number, which is the point of the type.".to_string()), "\n".to_string()), "    // A NON-RECONCILED ARM IS A PROCESS REFUSAL (#11105, review 63891). The receipt is".to_string()), "\n".to_string()), "    // printed first so the numbers that caused the refusal are on the wire, and THEN the".to_string()), "\n".to_string()), "    // line stops: a verdict string with exit 0 is the inert lens DESIGN section 6 names.".to_string()), "\n".to_string()), "    // The full-N run of this route refused here on 158600186 ns against a 50000000 ns".to_string()), "\n".to_string()), "    // tolerance before row_serialization was a measured row, which is what put that row on".to_string()), "\n".to_string()), "    // the type rather than a wider tolerance on this arm.".to_string()), "\n".to_string()), "    eprintln!(\"[native-cost-partition] {}\", serde_json::json!({".to_string()), "\n".to_string()), "        \"basis\": \"native_driver_thread_cpu\",".to_string()), "\n".to_string()), "        \"basis_note\": \"single-threaded SourceRootEvalDriver thread CPU (CLOCK_THREAD_CPUTIME_ID); exclusive rows partition parent_span_nanos; parent_wall_nanos is an observation, never judged\",".to_string()), "\n".to_string()), "        \"producer\": \"std.compiler_entry.SourceRootEvalDriver\",".to_string()), "\n".to_string()), "        \"head\": head,".to_string()), "\n".to_string()), "        \"mode\": \"adjudicate\",".to_string()), "\n".to_string()), "        \"verdict\": verdict,".to_string()), "\n".to_string()), "        \"tolerance_nanos\": tolerance_nanos,".to_string()), "\n".to_string()), "        \"parent_span_nanos\": parent_span_nanos,".to_string()), "\n".to_string()), "        \"parent_wall_nanos\": parent_wall_nanos,".to_string()), "\n".to_string()), "        \"exclusive\": exclusive.rows.iter().map(|r| (".to_string()), "\n".to_string()), "            native_driver_exclusive_row_name(r.key.clone()),".to_string()), "\n".to_string()), "            serde_json::json!(r.nanos),".to_string()), "\n".to_string()), "        )).collect::<serde_json::Map<String, serde_json::Value>>(),".to_string()), "\n".to_string()), "        \"sum_exclusive_nanos\": exclusive_sum,".to_string()), "\n".to_string()), "        \"remainder_nanos\": remainder_nanos,".to_string()), "\n".to_string()), "        \"corpus_reads\": corpus_reads,".to_string()), "\n".to_string()), "        \"closure_reads\": closure_reads,".to_string()), "\n".to_string()), "        \"scanned_paths\": ingest_receipt.scanned_paths.len(),".to_string()), "\n".to_string()), "        \"ingested_paths\": ingest_receipt.ingested_paths.len(),".to_string()), "\n".to_string()), "        \"closure_modules\": closure.len(),".to_string()), "\n".to_string()), "        \"identities\": identities,".to_string()), "\n".to_string()), "        \"unique_modules\": universe.modules.len(),".to_string()), "\n".to_string()), "        \"file_refusals\": receipt.file_refusals.len(),".to_string()), "\n".to_string()), "        \"prepare_ok\": prepare_ok,".to_string()), "\n".to_string()), "        \"prepare_refused\": prepare_refused,".to_string()), "\n".to_string()), "        \"prepare_mean_nanos\": prepare_mean,".to_string()), "\n".to_string()), "        \"prepare_p50_nanos\": native_cost_quantile_nanos(&prepare_samples, 1, 2),".to_string()), "\n".to_string()), "        \"prepare_p95_nanos\": native_cost_quantile_nanos(&prepare_samples, 19, 20),".to_string()), "\n".to_string()), "        \"prepare_max_nanos\": prepare_samples.last().copied().unwrap_or(0),".to_string()), "\n".to_string()), "        \"eval_mean_nanos\": eval_mean,".to_string()), "\n".to_string()), "        \"eval_p50_nanos\": native_cost_quantile_nanos(&eval_samples, 1, 2),".to_string()), "\n".to_string()), "        \"eval_p95_nanos\": native_cost_quantile_nanos(&eval_samples, 19, 20),".to_string()), "\n".to_string()), "        \"eval_max_nanos\": eval_samples.last().copied().unwrap_or(0),".to_string()), "\n".to_string()), "        \"peak_rss_bytes\": proc_status_kib(\"VmHWM\").map(|kib| kib * 1024),".to_string()), "\n".to_string()), "        \"rss_bytes\": proc_status_kib(\"VmRSS\").map(|kib| kib * 1024),".to_string()), "\n".to_string()), "    }));".to_string()), "\n".to_string()), "    match accounting.as_ref() {".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostReconciled { .. } => {}".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostOverAttributed { sum_exclusive, parent_span } => {".to_string()), "\n".to_string()), "            eprintln!(".to_string()), "\n".to_string()), "                \"REFUSED: native driver cost OverAttributed {{ sum_exclusive_nanos: {}, parent_span_nanos: {} }}\",".to_string()), "\n".to_string()), "                nanosecond_count(sum_exclusive.clone()) as u128,".to_string()), "\n".to_string()), "                nanosecond_count(parent_span.clone()) as u128".to_string()), "\n".to_string()), "            );".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostRemainderExceedsTolerance { residual, tolerance } => {".to_string()), "\n".to_string()), "            eprintln!(".to_string()), "\n".to_string()), "                \"REFUSED: native driver cost RemainderExceedsTolerance {{ residual_nanos: {}, tolerance_nanos: {} }} -- unattributed driver work; name the span, do not widen the tolerance\",".to_string()), "\n".to_string()), "                nanosecond_count(residual.clone()) as u128,".to_string()), "\n".to_string()), "                nanosecond_count(tolerance.clone()) as u128".to_string()), "\n".to_string()), "            );".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    println!(".to_string()), "\n".to_string()), "        \"{}\",".to_string()), "\n".to_string()), "        serde_json::json!({".to_string()), "\n".to_string()), "            \"_terminal\": \"complete\",".to_string()), "\n".to_string()), "            \"mode\": \"adjudicate\",".to_string()), "\n".to_string()), "            \"rows\": population.len(),".to_string()), "\n".to_string()), "            \"universe\": universe.identities.len(),".to_string()), "\n".to_string()), "            \"file_refusals\": receipt.file_refusals.len(),".to_string()), "\n".to_string()), "            \"file_refusal_tally\": file_refusal_tally,".to_string()), "\n".to_string()), "            \"advised_files\": context.accepted_file_advisories.len(),".to_string()), "\n".to_string()), "            \"admitted\": admitted,".to_string()), "\n".to_string()), "            \"summary\": summary,".to_string()), "\n".to_string()), "            \"frontier\": frontier_word,".to_string()), "\n".to_string()), "        })".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    if admitted {".to_string()), "\n".to_string()), "        std::process::exit(0);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    std::process::exit(1);".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "fn main() {".to_string()), "\n".to_string()), "    let argv: Vec<String> = std::env::args().skip(1).collect();".to_string()), "\n".to_string()), "    let plan = native_driver_parse(Rc::new(argv.into()));".to_string()), "\n".to_string()), "    if let ProcessExit::ExitFailure { code, reason } = &*native_driver_plan_exit(plan.clone()) {".to_string()), "\n".to_string()), "        eprintln!(\"{reason}\");".to_string()), "\n".to_string()), "        std::process::exit(*code as i32);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let source_roots: Vec<String> = native_driver_plan_source_roots(plan.clone()).iter().cloned().collect();".to_string()), "\n".to_string()), "    match &*plan {".to_string()), "\n".to_string()), "        NativeDriverPlan::NativeDriverPlanRefused { reason, detail } => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: native driver plan refused ({reason:?}) but its exit was success -- {detail}\");".to_string()), "\n".to_string()), "            std::process::exit(70);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        NativeDriverPlan::NativeDriverPlanned { verb } => {".to_string()), "\n".to_string()), "            let verb: &NativeDriverVerb = verb;".to_string()), "\n".to_string()), "            match verb {".to_string()), "\n".to_string()), "                NativeDriverVerb::NativeDriverCensus { .. } => run_census(&source_roots),".to_string()), "\n".to_string()), "                NativeDriverVerb::NativeDriverCensusResolve { .. } => run_census_resolve(&source_roots),".to_string()), "\n".to_string()), "                NativeDriverVerb::NativeDriverCensusInfer { .. } => run_census_infer(&source_roots),".to_string()), "\n".to_string()), "                NativeDriverVerb::NativeDriverDemandCensus { .. } => run_demand_census(&source_roots),".to_string()), "\n".to_string()), "                NativeDriverVerb::NativeDriverAdjudicate { facts_path, pattern, .. } => run_adjudication(facts_path, Rc::new(TargetPattern::clone(pattern)), &source_roots),".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()),
+    content: v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("// Generated by v1 compiler -- do not edit.".to_string(), "\n".to_string()), "\n".to_string()), "#![allow(unused_parens, clippy::all, clippy::disallowed_macros)]".to_string()), "\n".to_string()), "\n".to_string()), "use std::rc::Rc;".to_string()), "\n".to_string()), "use std::time::Instant;".to_string()), "\n".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::gunbc_witness_v2_native_route::{NativeRouteEmittedBuild, NativeRouteMalformedControl, NativeRouteOldRouteControl};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::".to_string()), pipeline_mod.clone()), "::{".to_string()), "\n".to_string()), "    native_census_module_completeness, native_census_module_resolution, native_census_modules,".to_string()), "\n".to_string()), "    native_census_module_inference, native_census_infer_type_contribution,".to_string()), "\n".to_string()), "    native_census_infer_completeness, native_census_cause_groups_add_infer_module, native_census_module_paths,".to_string()), "\n".to_string()), "    native_census_subject_closure, native_census_root_subject_membership, native_census_subject_label,".to_string()), "\n".to_string()), "    native_census_residual_rows,".to_string()), "\n".to_string()), "    native_census_cause_groups_add_module, native_census_cause_groups_from_file_refusals,".to_string()), "\n".to_string()), "    native_census_cause_group_rows, native_census_closure_index, native_census_roots_ranked,".to_string()), "\n".to_string()), "    native_demand_census_output,".to_string()), "\n".to_string()), "    native_lane_controls, native_lane_file_refusal_index,".to_string()), "\n".to_string()), "    native_lane_closure_ingest, native_lane_closure_modules, native_lane_closure_round_budget,".to_string()), "\n".to_string()), "    native_lane_ingest_matches_closure, native_lane_ingest_receipt, native_lane_receipt,".to_string()), "\n".to_string()), "    native_lane_source_facts, native_lane_universe_of_facts, native_test_context_absorb,".to_string()), "\n".to_string()), "    native_test_context_finish, native_test_context_from_ingest, native_test_context_state_empty,".to_string()), "\n".to_string()), "    native_test_front_end_prepare,".to_string()), "\n".to_string()), "    native_driver_parse, native_driver_plan_exit, native_driver_plan_source_roots,".to_string()), "\n".to_string()), "    NativeDriverPlan, NativeDriverVerb,".to_string()), "\n".to_string()), "    NativeCensusModuleOutcome, NativeInferCensusOutcome,".to_string()), "\n".to_string()), "    NativeLaneHostFacts,".to_string()), "\n".to_string()), "    NativeRouteMemberRow,".to_string()), "\n".to_string()), "    native_demand_eval_nanos, native_demand_eval_samples,".to_string()), "\n".to_string()), "    native_demand_prepare_nanos, native_demand_prepare_samples,".to_string()), "\n".to_string()), "    native_demand_prepare_ok, native_demand_prepare_refused,".to_string()), "\n".to_string()), "    native_demand_scheduling_nanos,".to_string()), "\n".to_string()), "    native_demand_occurrence_census_lines, native_demand_occurrence_census_nanos,".to_string()), "\n".to_string()), "    native_demand_run_demand_count, native_demand_run_readiness_derivations,".to_string()), "\n".to_string()), "    native_demand_run_receipt_lines, native_demand_run_rows,".to_string()), "\n".to_string()), "    native_demand_observation_progressed,".to_string()), "\n".to_string()), "    native_demand_run_transition_count, native_demand_schedule_universe,".to_string()), "\n".to_string()), "    native_demand_tested_tree_input,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::v2_compiler_program_assembly::{".to_string()), "\n".to_string()), "    program_assembly_allocator_next, program_assembly_parsed_alloc,".to_string()), "\n".to_string()), "    program_assembly_phase_normalize_seeded, program_assembly_normalized_outcome,".to_string()), "\n".to_string()), "    program_assembly_normalized_alloc, program_assembly_normalized_spans, program_assembly_ingest_scope_outcome,".to_string()), "\n".to_string()), "    program_assembly_phase_parse_seeded,".to_string()), "\n".to_string()), "    program_assembly_phase_token_count, program_assembly_phase_tokenize,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::gunbc_witness_v2_native_route::{".to_string()), "\n".to_string()), "    native_route_admission, native_route_admission_summary, native_route_admitted,".to_string()), "\n".to_string()), "    native_route_file_refusal_tally, native_route_member_row_text,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::gunbc_native_frontier_ratchet::{".to_string()), "\n".to_string()), "    native_frontier_proposal_file_lines, native_frontier_report_lines, native_frontier_verdict,".to_string()), "\n".to_string()), "    native_frontier_verdict_word,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::v2_compiler_native_test_vocabulary::NativeTestVerdict;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::v2_compiler_source_authority::DagSourceReadWitness;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::v2_std_diagnostic::Outcome;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_process::ProcessExit;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::extdeps_bazel_target_pattern::TargetPattern;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_compiler_entry::{".to_string()), "\n".to_string()), "    native_driver_cost_account, native_driver_cost_remainder_tolerance_nanos,".to_string()), "\n".to_string()), "    native_driver_exclusive_sum, NativeDriverCostAccounting,".to_string()), "\n".to_string()), "    native_driver_exclusive_rows, native_driver_exclusive_row_name,".to_string()), "\n".to_string()), "    NativeDriverExclusiveRowKey,".to_string()), "\n".to_string()), "};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_measure::{nanosecond, nanosecond_count};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::v1_rt::observed_thread_cpu_nanos;".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::gunbc_instruments_type_declaration_use_census::{type_census_receipt, type_census_run_add, type_census_run_empty};".to_string()), "\n".to_string()), "use ".to_string()), crate_name.clone()), "::std_compiler_entry::NativeClaimTerminal;".to_string()), "\n".to_string()), "\n".to_string()), emit_host_source_root_read_rs(crate_name.clone())), "fn host_fact(facts: &std::collections::HashMap<String, String>, key: &str) -> String {".to_string()), "\n".to_string()), "    match facts.get(key) {".to_string()), "\n".to_string()), "        Some(value) => value.clone(),".to_string()), "\n".to_string()), "        None => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: host facts file carries no {key} row\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn host_fact_int(facts: &std::collections::HashMap<String, String>, key: &str) -> i64 {".to_string()), "\n".to_string()), "    let value = host_fact(facts, key);".to_string()), "\n".to_string()), "    match value.parse::<i64>() {".to_string()), "\n".to_string()), "        Ok(parsed) => parsed,".to_string()), "\n".to_string()), "        Err(cause) => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: host fact {key} is not an integer: {value:?} ({cause})\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn read_host_facts(path: &str) -> NativeLaneHostFacts {".to_string()), "\n".to_string()), "    let text = match std::fs::read_to_string(path) {".to_string()), "\n".to_string()), "        Ok(text) => text,".to_string()), "\n".to_string()), "        Err(cause) => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: could not read host facts file {path}: {cause}\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let mut facts: std::collections::HashMap<String, String> = std::collections::HashMap::new();".to_string()), "\n".to_string()), "    for line in text.lines() {".to_string()), "\n".to_string()), "        if line.is_empty() {".to_string()), "\n".to_string()), "            continue;".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        match line.split_once('\\t') {".to_string()), "\n".to_string()), "            Some((key, value)) if !key.is_empty() => {".to_string()), "\n".to_string()), "                if facts.insert(key.to_string(), value.to_string()).is_some() {".to_string()), "\n".to_string()), "                    eprintln!(\"REFUSED: duplicate host fact row: {key}\");".to_string()), "\n".to_string()), "                    std::process::exit(2);".to_string()), "\n".to_string()), "                }".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "            _ => {".to_string()), "\n".to_string()), "                eprintln!(\"REFUSED: malformed host fact line (expected key<TAB>value): {line}\");".to_string()), "\n".to_string()), "                std::process::exit(2);".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let malformed_path = host_fact(&facts, \"malformed_control_path\");".to_string()), "\n".to_string()), "    let malformed_reason = host_fact(&facts, \"malformed_control_reason\");".to_string()), "\n".to_string()), "    let malformed_control = if malformed_path.is_empty() {".to_string()), "\n".to_string()), "        NativeRouteMalformedControl::MalformedSpecimenAccepted".to_string()), "\n".to_string()), "    } else {".to_string()), "\n".to_string()), "        NativeRouteMalformedControl::MalformedSpecimenRefused {".to_string()), "\n".to_string()), "            path: malformed_path,".to_string()), "\n".to_string()), "            reason: malformed_reason,".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let old_route_disposition = host_fact(&facts, \"old_route_disposition\");".to_string()), "\n".to_string()), "    let old_route_executable = host_fact(&facts, \"old_route_executable\");".to_string()), "\n".to_string()), "    let old_route_control = match old_route_disposition.as_str() {".to_string()), "\n".to_string()), "        \"withdrawn\" => NativeRouteOldRouteControl::OldRouteWithdrawn {".to_string()), "\n".to_string()), "            withdrawn_executable: old_route_executable,".to_string()), "\n".to_string()), "        },".to_string()), "\n".to_string()), "        \"not_present_at_window\" => NativeRouteOldRouteControl::OldRouteNotPresentAtWindow {".to_string()), "\n".to_string()), "            expected_executable: old_route_executable,".to_string()), "\n".to_string()), "        },".to_string()), "\n".to_string()), "        other => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: old_route_disposition names no control this route can record: {other} -- expected withdrawn or not_present_at_window\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    // The emitted build is the host's observation of the cargo spawn this binary is the".to_string()), "\n".to_string()), "    // product of: six rows, the argv as one row per word under a length row. A count that".to_string()), "\n".to_string()), "    // does not parse, or an index row it promises that is missing, refuses like any other".to_string()), "\n".to_string()), "    // missing fact; nothing is defaulted.".to_string()), "\n".to_string()), "    let cargo_argv_len = host_fact_int(&facts, \"cargo_argv_len\");".to_string()), "\n".to_string()), "    let mut cargo_argv: Vec<String> = Vec::new();".to_string()), "\n".to_string()), "    for index in 0..cargo_argv_len {".to_string()), "\n".to_string()), "        cargo_argv.push(host_fact(&facts, &format!(\"cargo_argv_{index}\")));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let emitted_build = NativeRouteEmittedBuild {".to_string()), "\n".to_string()), "        cargo_argv: Rc::new(cargo_argv.into()),".to_string()), "\n".to_string()), "        rustflags: host_fact(&facts, \"rustflags\"),".to_string()), "\n".to_string()), "        compiler_path: host_fact(&facts, \"compiler_path\"),".to_string()), "\n".to_string()), "        rustc_identity: host_fact(&facts, \"rustc_identity\"),".to_string()), "\n".to_string()), "        exit_status: host_fact_int(&facts, \"exit_status\"),".to_string()), "\n".to_string()), "        warning_count: host_fact_int(&facts, \"warning_count\"),".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    NativeLaneHostFacts {".to_string()), "\n".to_string()), "        tested_tree: host_fact(&facts, \"tested_tree\"),".to_string()), "\n".to_string()), "        preparation_seed_identity: host_fact(&facts, \"preparation_seed_identity\"),".to_string()), "\n".to_string()), "        emitted_closure_identity: host_fact(&facts, \"emitted_closure_identity\"),".to_string()), "\n".to_string()), "        executable_path: host_fact(&facts, \"executable_path\"),".to_string()), "\n".to_string()), "        executable_identity: host_fact(&facts, \"executable_identity\"),".to_string()), "\n".to_string()), "        old_route_control: Rc::new(old_route_control),".to_string()), "\n".to_string()), "        malformed_control: Rc::new(malformed_control),".to_string()), "\n".to_string()), "        emitted_build: Rc::new(emitted_build),".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn run_census(source_roots: &[String]) {".to_string()), "\n".to_string()), "    if source_roots.is_empty() {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: no source roots given\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let reads = read_ingest(source_roots);".to_string()), "\n".to_string()), "    let ingest = Rc::new(im::vector::Vector::from(reads));".to_string()), "\n".to_string()), "    let context = match &*native_test_context_from_ingest(ingest.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CONTEXT-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    for refusal in context.file_refusals.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"file_refusal\": refusal }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for advised in context.accepted_file_advisories.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"accepted_file_advisories\": advised }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // GROUPED BY THE FATAL REASON, BY THE FOLD THAT OWNS THE GROUPING".to_string()), "\n".to_string()), "    // (v2.compiler.compile native_census_cause_groups_add); this main only prints the groups.".to_string()), "\n".to_string()), "    // Each root carries its closure fan-out (v2.compiler.compile native_census_closure_index);".to_string()), "\n".to_string()), "    // this mode does not resolve, so no root claims an observed resolve refusal.".to_string()), "\n".to_string()), "    let closure = native_census_closure_index(".to_string()), "\n".to_string()), "        context.clone(),".to_string()), "\n".to_string()), "        native_lane_file_refusal_index(context.file_refusals.clone()),".to_string()), "\n".to_string()), "        native_census_modules(ingest.clone()),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    let groups = native_census_cause_groups_from_file_refusals(context.file_refusals.clone(), closure, false);".to_string()), "\n".to_string()), "    let cause_groups = native_census_cause_group_rows(groups.clone());".to_string()), "\n".to_string()), "    for group in cause_groups.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"cause_group\": group }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let roots = native_census_roots_ranked(cause_groups.clone());".to_string()), "\n".to_string()), "    for root in roots.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"census_root\": root }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    println!(\"{}\", serde_json::json!({ \"_terminal\": \"complete\", \"mode\": \"census\", \"file_refusals\": context.file_refusals.len(), \"advised_files\": context.accepted_file_advisories.len(), \"cause_groups\": cause_groups.len(), \"roots\": roots.len() }));".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "// THE THIRD MODE: THE WHOLE TREE, RESOLVED PER MODULE.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// WHY IT IS NOT A FLAG ON `census`. That mode has a live consumer -- the malformed control,".to_string()), "\n".to_string()), "// which the host runner spawns over a ONE-FILE scratch root and reads one per-file refusal".to_string()), "\n".to_string()), "// from -- and teaching it to resolve would make that control pay a whole-tree resolve to".to_string()), "\n".to_string()), "// learn a fact the front end already answered. Two modes because they are two subjects: a".to_string()), "\n".to_string()), "// roster of front-end refusals, and a roster of resolve refusals over every ingested module.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// WHY IT IS NOT THE `adjudicate` LOOP WIDENED. That loop walks `universe.modules` -- the".to_string()), "\n".to_string()), "// v2.test.* modules discovery enrolled rows for -- over a context folded from the import".to_string()), "\n".to_string()), "// CLOSURE of those modules. Both narrowings are correct for what adjudication asks and wrong".to_string()), "\n".to_string()), "// for a census: a residual reported over the closure of the test corpus is not a residual over".to_string()), "\n".to_string()), "// the tree, and the absence of a refusal in a population that was never resolved establishes".to_string()), "\n".to_string()), "// nothing about the dependents outside it.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// THE RESOLVED TREE IS NOT KEPT. NativeCensusModuleOutcome carries the diagnostics of a refusal".to_string()), "\n".to_string()), "// and nothing on the accepted arm, so each module's tree dies with the call that made it. The".to_string()), "\n".to_string()), "// adjudicating loop drops its tree explicitly because it must hold one to infer from; this loop".to_string()), "\n".to_string()), "// never holds one, which is the property that makes the whole-tree grain affordable at all.".to_string()), "\n".to_string()), "fn run_census_resolve(source_roots: &[String]) {".to_string()), "\n".to_string()), "    if source_roots.is_empty() {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: no source roots given\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let load_started = Instant::now();".to_string()), "\n".to_string()), "    let reads = read_ingest(source_roots);".to_string()), "\n".to_string()), "    let corpus_reads = reads.len();".to_string()), "\n".to_string()), "    let ingest = Rc::new(im::vector::Vector::from(reads));".to_string()), "\n".to_string()), "    let load_nanos = span_nanos(load_started);".to_string()), "\n".to_string()), "    let context_started = Instant::now();".to_string()), "\n".to_string()), "    // MUTABLE BECAUSE IT IS THREADED: each module's resolution returns the context it ended".to_string()), "\n".to_string()), "    // with, carrying the module namespace provider (v2.compiler.name_resolve ResolutionContext".to_string()), "\n".to_string()), "    // namespaces), and the next module is resolved over that one -- a namespace is produced at".to_string()), "\n".to_string()), "    // most once per ingest only for a loop that binds what it gets back.".to_string()), "\n".to_string()), "    let mut context = match &*native_test_context_from_ingest(ingest.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CONTEXT-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let context_nanos = span_nanos(context_started);".to_string()), "\n".to_string()), "    // The front-end refusals are reported in the same shape `census` reports them, because they".to_string()), "\n".to_string()), "    // are the same fact read from the same context: a module whose file the context refused is".to_string()), "\n".to_string()), "    // attributed there and is NOT re-reported below as a resolve refusal it never reached.".to_string()), "\n".to_string()), "    for refusal in context.file_refusals.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"file_refusal\": refusal }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // THE ADVISORY POPULATION IS THE SAME CONTEXT FACT `census` REPORTS, printed in the same".to_string()), "\n".to_string()), "    // shape, so a saved whole-tree receipt carries it without a second pass. Its count is taken".to_string()), "\n".to_string()), "    // here, from the context that produced the rows, not from the threaded one at the end.".to_string()), "\n".to_string()), "    for advised in context.accepted_file_advisories.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"accepted_file_advisories\": advised }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let advised_files = context.accepted_file_advisories.len();".to_string()), "\n".to_string()), "    let refusal_index = native_lane_file_refusal_index(context.file_refusals.clone());".to_string()), "\n".to_string()), "    let roster_started = Instant::now();".to_string()), "\n".to_string()), "    let modules = native_census_modules(ingest.clone());".to_string()), "\n".to_string()), "    let roster_nanos = span_nanos(roster_started);".to_string()), "\n".to_string()), "    // THE CAUSE GROUPS START FROM THE FRONT-END REFUSALS -- each a root carrying its closure".to_string()), "\n".to_string()), "    // fan-out -- and take each module as it is resolved: a cascade member once under its root,".to_string()), "\n".to_string()), "    // any other refusal per chain (v2.compiler.compile native_census_cause_groups_add_module).".to_string()), "\n".to_string()), "    let closure = native_census_closure_index(context.clone(), refusal_index.clone(), modules.clone());".to_string()), "\n".to_string()), "    let mut groups = native_census_cause_groups_from_file_refusals(context.file_refusals.clone(), closure.clone(), true);".to_string()), "\n".to_string()), "    let mut resolve_total_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut resolve_samples: Vec<u128> = Vec::new();".to_string()), "\n".to_string()), "    let mut resolved_ok: u64 = 0;".to_string()), "\n".to_string()), "    let mut file_refused: u64 = 0;".to_string()), "\n".to_string()), "    let mut resolve_refused: u64 = 0;".to_string()), "\n".to_string()), "    let mut residual_rows: u64 = 0;".to_string()), "\n".to_string()), "    // THE PER-MODULE LINE IS ALSO THE RUN'S PROGRESS: `index` of `of`, so a reader of a multi-hour".to_string()), "\n".to_string()), "    // census can tell a slow run from a hung one while it runs.".to_string()), "\n".to_string()), "    let census_modules_total = modules.len();".to_string()), "\n".to_string()), "    for (census_module_index, entry) in modules.iter().enumerate() {".to_string()), "\n".to_string()), "        let resolve_started = Instant::now();".to_string()), "\n".to_string()), "        let step = native_census_module_resolution(".to_string()), "\n".to_string()), "            context.clone(),".to_string()), "\n".to_string()), "            refusal_index.clone(),".to_string()), "\n".to_string()), "            entry.clone(),".to_string()), "\n".to_string()), "        );".to_string()), "\n".to_string()), "        context = step.context.clone();".to_string()), "\n".to_string()), "        let outcome = step.outcome.clone();".to_string()), "\n".to_string()), "        let module_resolve_nanos = span_nanos(resolve_started);".to_string()), "\n".to_string()), "        groups = native_census_cause_groups_add_module(groups.clone(), closure.clone(), entry.clone(), step.clone());".to_string()), "\n".to_string()), "        let outcome_label = match &*outcome {".to_string()), "\n".to_string()), "            NativeCensusModuleOutcome::NativeCensusModuleFileRefused => {".to_string()), "\n".to_string()), "                file_refused += 1;".to_string()), "\n".to_string()), "                \"file_refused\"".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "            NativeCensusModuleOutcome::NativeCensusModuleResolved => {".to_string()), "\n".to_string()), "                resolved_ok += 1;".to_string()), "\n".to_string()), "                \"resolved\"".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "            NativeCensusModuleOutcome::NativeCensusModuleResolveRefused { first, rest, .. } => {".to_string()), "\n".to_string()), "                resolve_refused += 1;".to_string()), "\n".to_string()), "                // ONE ROW PER FAILURE CHAIN, WHICH IS ONE ROW PER REFUSED OCCURRENCE. The rows are".to_string()), "\n".to_string()), "                // written as they are decided rather than accumulated: the census is over the".to_string()), "\n".to_string()), "                // whole tree, and a population held to the end is a second corpus-sized".to_string()), "\n".to_string()), "                // allocation beside the context that produced it.".to_string()), "\n".to_string()), "                for row in native_census_residual_rows(entry.clone(), first.clone(), rest.clone()).iter() {".to_string()), "\n".to_string()), "                    residual_rows += 1;".to_string()), "\n".to_string()), "                    println!(\"{}\", serde_json::json!({ \"census_residual\": row }));".to_string()), "\n".to_string()), "                }".to_string()), "\n".to_string()), "                \"resolve_refused\"".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        };".to_string()), "\n".to_string()), "        resolve_total_nanos += module_resolve_nanos;".to_string()), "\n".to_string()), "        resolve_samples.push(module_resolve_nanos);".to_string()), "\n".to_string()), "        eprintln!(".to_string()), "\n".to_string()), "            \"[native-census-resolve] {}\",".to_string()), "\n".to_string()), "            serde_json::json!({".to_string()), "\n".to_string()), "                \"producer\": \"std.compiler_entry.SourceRootEvalDriver\",".to_string()), "\n".to_string()), "                \"module\": entry.module.clone(),".to_string()), "\n".to_string()), "                \"path\": entry.path.clone(),".to_string()), "\n".to_string()), "                \"resolve_nanos\": module_resolve_nanos,".to_string()), "\n".to_string()), "                \"outcome\": outcome_label,".to_string()), "\n".to_string()), "                \"occurrence_completeness\": native_census_module_completeness(outcome.clone()),".to_string()), "\n".to_string()), "                \"index\": census_module_index + 1,".to_string()), "\n".to_string()), "                \"of\": census_modules_total,".to_string()), "\n".to_string()), "            }),".to_string()), "\n".to_string()), "        );".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    resolve_samples.sort_unstable();".to_string()), "\n".to_string()), "    let cause_groups = native_census_cause_group_rows(groups.clone());".to_string()), "\n".to_string()), "    for group in cause_groups.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"cause_group\": group }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // THE ROOTS, RANKED BY CLOSURE FAN-OUT (v2.compiler.compile native_census_roots_ranked).".to_string()), "\n".to_string()), "    let roots = native_census_roots_ranked(cause_groups.clone());".to_string()), "\n".to_string()), "    for root in roots.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"census_root\": root }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // THE TERMINAL LINE CARRIES THE COST AND THE POPULATION TOGETHER, because the reading this".to_string()), "\n".to_string()), "    // mode exists to support is whether a whole-tree resolve is affordable at all, and a residual".to_string()), "\n".to_string()), "    // count without the wall and the peak beside it cannot answer that.".to_string()), "\n".to_string()), "    println!(".to_string()), "\n".to_string()), "        \"{}\",".to_string()), "\n".to_string()), "        serde_json::json!({".to_string()), "\n".to_string()), "            \"_terminal\": \"complete\",".to_string()), "\n".to_string()), "            \"mode\": \"census-resolve\",".to_string()), "\n".to_string()), "            \"corpus_reads\": corpus_reads,".to_string()), "\n".to_string()), "            \"modules\": modules.len(),".to_string()), "\n".to_string()), "            \"file_refusals\": context.file_refusals.len(),".to_string()), "\n".to_string()), "            \"advised_files\": advised_files,".to_string()), "\n".to_string()), "            \"resolved\": resolved_ok,".to_string()), "\n".to_string()), "            \"file_refused\": file_refused,".to_string()), "\n".to_string()), "            \"resolve_refused\": resolve_refused,".to_string()), "\n".to_string()), "            \"residual_rows\": residual_rows,".to_string()), "\n".to_string()), "            \"cause_groups\": cause_groups.len(),".to_string()), "\n".to_string()), "            \"roots\": roots.len(),".to_string()), "\n".to_string()), "            \"load_nanos\": load_nanos,".to_string()), "\n".to_string()), "            \"context_nanos\": context_nanos,".to_string()), "\n".to_string()), "            \"roster_nanos\": roster_nanos,".to_string()), "\n".to_string()), "            \"resolve_total_nanos\": resolve_total_nanos,".to_string()), "\n".to_string()), "            \"resolve_p50_nanos\": native_cost_quantile_nanos(&resolve_samples, 1, 2),".to_string()), "\n".to_string()), "            \"resolve_p95_nanos\": native_cost_quantile_nanos(&resolve_samples, 19, 20),".to_string()), "\n".to_string()), "            \"resolve_max_nanos\": resolve_samples.last().copied().unwrap_or(0),".to_string()), "\n".to_string()), "            \"peak_rss_bytes\": proc_status_kib(\"VmHWM\").map(|kib| kib * 1024),".to_string()), "\n".to_string()), "        }),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "// THE FOURTH MODE: D13's DEPENDENCY-DEMAND CENSUS (v2.compiler.compile native_demand_census_output).".to_string()), "\n".to_string()), "// The fold decides every line and the exit -- 0 held, 1 a census whose rows do not account for".to_string()), "\n".to_string()), "// every uses fn, 2 no observation -- and this function only reads the ingest, prints and exits.".to_string()), "\n".to_string()), "fn run_demand_census(source_roots: &[String]) {".to_string()), "\n".to_string()), "    if source_roots.is_empty() {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: no source roots given\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let reads = read_ingest(source_roots);".to_string()), "\n".to_string()), "    let ingest = Rc::new(im::vector::Vector::from(reads));".to_string()), "\n".to_string()), "    let output = native_demand_census_output(ingest);".to_string()), "\n".to_string()), "    for line in output.lines.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    std::process::exit(output.exit as i32);".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// THE FIFTH MODE: THE WHOLE TREE, RESOLVED AND INFERRED PER MODULE (`census-infer`).".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// Every decision is a .dag fold: the per-module step (v2.compiler.compile".to_string()), "\n".to_string()), "// native_census_module_inference), the type-declaration census's contribution from it".to_string()), "\n".to_string()), "// (native_census_infer_type_contribution), the run it accumulates into and the receipt and".to_string()), "\n".to_string()), "// terminal that run decides (gunbc.instruments.type_declaration_use_census). This loop reads the".to_string()), "\n".to_string()), "// roots, threads the context, prints and sets the status -- the operations no fold can. A module's".to_string()), "\n".to_string()), "// trees live for one step; what is kept is the census's rows, not the trees.".to_string()), "\n".to_string()), "fn run_census_infer(source_roots: &[String]) {".to_string()), "\n".to_string()), "    if source_roots.is_empty() {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: no source roots given\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let reads = read_ingest(source_roots);".to_string()), "\n".to_string()), "    let corpus_reads = reads.len();".to_string()), "\n".to_string()), "    let ingest = Rc::new(im::vector::Vector::from(reads));".to_string()), "\n".to_string()), "    let mut context = match &*native_test_context_from_ingest(ingest.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CONTEXT-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    // THE FRONT-END POPULATION IS PRINTED IN THE SHAPE census-resolve PRINTS IT: the same context fact.".to_string()), "\n".to_string()), "    for refusal in context.file_refusals.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"file_refusal\": refusal }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for advised in context.accepted_file_advisories.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"accepted_file_advisories\": advised }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let file_refusals = context.file_refusals.len();".to_string()), "\n".to_string()), "    let advised_files = context.accepted_file_advisories.len();".to_string()), "\n".to_string()), "    let refusal_index = native_lane_file_refusal_index(context.file_refusals.clone());".to_string()), "\n".to_string()), "    let modules = native_census_modules(ingest.clone());".to_string()), "\n".to_string()), "    // THE INFER CENSUS'S GROUPS START FROM THE FRONT-END ROOTS, as census-resolve's do, and take each".to_string()), "\n".to_string()), "    // module's step through ONE fold (v2.compiler.compile native_census_cause_groups_add_infer_module):".to_string()), "\n".to_string()), "    // a resolve refusal filed as census-resolve files it, an infer refusal as one Infer-stage row.".to_string()), "\n".to_string()), "    let closure = native_census_closure_index(context.clone(), refusal_index.clone(), modules.clone());".to_string()), "\n".to_string()), "    let module_paths = native_census_module_paths(modules.clone());".to_string()), "\n".to_string()), "    let mut groups = native_census_cause_groups_from_file_refusals(context.file_refusals.clone(), closure.clone(), true);".to_string()), "\n".to_string()), "    let mut run = type_census_run_empty();".to_string()), "\n".to_string()), "    let mut file_refused: u64 = 0;".to_string()), "\n".to_string()), "    let mut resolve_refused: u64 = 0;".to_string()), "\n".to_string()), "    let mut residual_rows: u64 = 0;".to_string()), "\n".to_string()), "    let mut inferred: u64 = 0;".to_string()), "\n".to_string()), "    let mut infer_refused: u64 = 0;".to_string()), "\n".to_string()), "    for entry in modules.iter() {".to_string()), "\n".to_string()), "        let started = Instant::now();".to_string()), "\n".to_string()), "        let step = native_census_module_inference(context.clone(), refusal_index.clone(), entry.clone());".to_string()), "\n".to_string()), "        context = step.context.clone();".to_string()), "\n".to_string()), "        groups = native_census_cause_groups_add_infer_module(groups.clone(), closure.clone(), module_paths.clone(), entry.clone(), step.clone());".to_string()), "\n".to_string()), "        let outcome_label = match &*step.outcome {".to_string()), "\n".to_string()), "            NativeInferCensusOutcome::NativeInferCensusFileRefused => { file_refused += 1; \"file_refused\" }".to_string()), "\n".to_string()), "            NativeInferCensusOutcome::NativeInferCensusResolveRefused { first, rest, .. } => {".to_string()), "\n".to_string()), "                resolve_refused += 1;".to_string()), "\n".to_string()), "                for row in native_census_residual_rows(entry.clone(), first.clone(), rest.clone()).iter() {".to_string()), "\n".to_string()), "                    residual_rows += 1;".to_string()), "\n".to_string()), "                    println!(\"{}\", serde_json::json!({ \"census_residual\": row }));".to_string()), "\n".to_string()), "                }".to_string()), "\n".to_string()), "                \"resolve_refused\"".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "            NativeInferCensusOutcome::NativeInferCensusInferred { .. } => { inferred += 1; \"inferred\" }".to_string()), "\n".to_string()), "            NativeInferCensusOutcome::NativeInferCensusInferRefused { .. } => { infer_refused += 1; \"infer_refused\" }".to_string()), "\n".to_string()), "        };".to_string()), "\n".to_string()), "        let contribution = native_census_infer_type_contribution(context.clone(), entry.clone(), step.outcome.clone());".to_string()), "\n".to_string()), "        run = type_census_run_add(run, contribution);".to_string()), "\n".to_string()), "        eprintln!(\"[native-census-infer] {}\", serde_json::json!({".to_string()), "\n".to_string()), "            \"module\": entry.module.clone(),".to_string()), "\n".to_string()), "            \"path\": entry.path.clone(),".to_string()), "\n".to_string()), "            \"nanos\": span_nanos(started),".to_string()), "\n".to_string()), "            \"outcome\": outcome_label,".to_string()), "\n".to_string()), "            \"occurrence_completeness\": native_census_infer_completeness(step.outcome.clone()),".to_string()), "\n".to_string()), "        }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let cause_groups = native_census_cause_group_rows(groups.clone());".to_string()), "\n".to_string()), "    for group in cause_groups.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"cause_group\": group }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let roots = native_census_roots_ranked(cause_groups.clone());".to_string()), "\n".to_string()), "    // EACH ROOT IS MARKED AGAINST THE NATIVE TEST TARGET'S CLOSURE (v2.compiler.compile".to_string()), "\n".to_string()), "    // native_census_subject_closure): derived from the label, never from a list.".to_string()), "\n".to_string()), "    let subject = native_census_subject_closure(closure.clone(), modules.clone(), native_census_subject_label());".to_string()), "\n".to_string()), "    println!(\"{}\", serde_json::json!({ \"census_subject\": subject.clone() }));".to_string()), "\n".to_string()), "    for root in roots.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"census_root\": root, \"subject_closure\": native_census_root_subject_membership(subject.clone(), root.clone()) }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // THE TYPE-DECLARATION CENSUS'S LINES SHARE THIS STDOUT AND KEEP THEIR OWN LINE KIND (design 2a).".to_string()), "\n".to_string()), "    let receipt = type_census_receipt(run);".to_string()), "\n".to_string()), "    for line in receipt.lines.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // THE WALK COMPLETED, SO THE TERMINAL IS PRINTED WHATEVER THE TYPE CENSUS DECIDES: the refusal".to_string()), "\n".to_string()), "    // census and the type census are two facts, and the type census's verdict is the exit status alone.".to_string()), "\n".to_string()), "    let type_census = match &*receipt.terminal {".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimHeld => \"held\",".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimNotHeld { .. } => \"not_held\",".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimNoObservation { .. } => \"no_observation\",".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    println!(\"{}\", serde_json::json!({".to_string()), "\n".to_string()), "        \"_terminal\": \"complete\",".to_string()), "\n".to_string()), "        \"mode\": \"census-infer\",".to_string()), "\n".to_string()), "        \"corpus_reads\": corpus_reads,".to_string()), "\n".to_string()), "        \"modules\": modules.len(),".to_string()), "\n".to_string()), "        \"file_refusals\": file_refusals,".to_string()), "\n".to_string()), "        \"advised_files\": advised_files,".to_string()), "\n".to_string()), "        \"file_refused\": file_refused,".to_string()), "\n".to_string()), "        \"resolve_refused\": resolve_refused,".to_string()), "\n".to_string()), "        \"residual_rows\": residual_rows,".to_string()), "\n".to_string()), "        \"inferred\": inferred,".to_string()), "\n".to_string()), "        \"infer_refused\": infer_refused,".to_string()), "\n".to_string()), "        \"cause_groups\": cause_groups.len(),".to_string()), "\n".to_string()), "        \"roots\": roots.len(),".to_string()), "\n".to_string()), "        \"type_census\": type_census,".to_string()), "\n".to_string()), "        \"peak_rss_bytes\": proc_status_kib(\"VmHWM\").map(|kib| kib * 1024),".to_string()), "\n".to_string()), "    }));".to_string()), "\n".to_string()), "    match &*receipt.terminal {".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimHeld => std::process::exit(0),".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimNotHeld { reason } => {".to_string()), "\n".to_string()), "            eprintln!(\"NOT HELD: {reason}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        NativeClaimTerminal::NativeClaimNoObservation { reason } => {".to_string()), "\n".to_string()), "            eprintln!(\"NO OBSERVATION: {reason}\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()), "fn native_cost_quantile_nanos(sorted: &[u128], numer: usize, denom: usize) -> u128 {".to_string()), "\n".to_string()), "    if sorted.is_empty() { return 0; }".to_string()), "\n".to_string()), "    let idx = (sorted.len() - 1) * numer / denom;".to_string()), "\n".to_string()), "    sorted[idx]".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// A SPAN IS READ ONCE, THROUGH A READER THAT REFUSES A CLOCK THAT WENT BACKWARDS.".to_string()), "\n".to_string()), "// Instant::elapsed is Instant::now().duration_since(earlier), and duration_since SATURATES:".to_string()), "\n".to_string()), "// a monotonic clock that is not actually monotonic -- which happens on some virtualised and".to_string()), "\n".to_string()), "// migrated hosts -- yields Duration::ZERO rather than an error. That is the fabricated zero".to_string()), "\n".to_string()), "// this receipt forbids, arriving by a quieter route than the saturating_sub it replaced: a".to_string()), "\n".to_string()), "// phase would report as having taken no time and the partition would balance for the wrong".to_string()), "\n".to_string()), "// reason. checked_duration_since returns None instead, so the impossible reading is".to_string()), "\n".to_string()), "// REPRESENTABLE and can be refused.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// AN EARLIER REVISION OF THIS FILE CLAIMED THE CLASS WAS STRUCTURALLY IMPOSSIBLE ONCE THE".to_string()), "\n".to_string()), "// subtraction was gone. That was wrong and is corrected rather than softened: deleting the".to_string()), "\n".to_string()), "// explicit subtraction removed the visible clamp, not the saturation underneath it. The".to_string()), "\n".to_string()), "// honest rung is MITIGATED BY A TYPED REFUSAL at a declared boundary -- the host clock is".to_string()), "\n".to_string()), "// external reality, which DESIGN section 4b keeps off the ladder rather than on its top rung.".to_string()), "\n".to_string()), "fn span_nanos(started: Instant) -> u128 {".to_string()), "\n".to_string()), "    match Instant::now().checked_duration_since(started) {".to_string()), "\n".to_string()), "        Some(d) => d.as_nanos(),".to_string()), "\n".to_string()), "        None => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: the monotonic clock went backwards between two reads, so no span is measurable\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// THE PARTITION IS JUDGED ON THREAD CPU, AND THIS IS ITS SPAN (std.realization_measurement".to_string()), "\n".to_string()), "// ObserveThreadCpuAtSubject; extdeps.posix.clock_gettime ClockThreadCputimeId). The law".to_string()), "\n".to_string()), "// native_driver_cost_account enforces is that the phases partition the DRIVER'S OWN WORK. A".to_string()), "\n".to_string()), "// wall span also holds every interval the host descheduled this thread -- another tenant's".to_string()), "\n".to_string()), "// build, page-fault service, a lock wait -- none of which any phase performed, so on a wall".to_string()), "\n".to_string()), "// clock that time fell into the residual and the verdict tracked host load -- the same subject".to_string()), "\n".to_string()), "// reconciled on a quiet runner and refused on a contended one. The thread".to_string()), "\n".to_string()), "// CPU clock advances only while this thread runs, so the residual is uninstrumented driver".to_string()), "\n".to_string()), "// work and nothing else. The wall is still read once, around the whole run, and printed as an".to_string()), "\n".to_string()), "// observation; it is never an input to the verdict. The driver is single-threaded, so the".to_string()), "\n".to_string()), "// thread clock is the driver's whole CPU. An unsupported clock refuses inside the runtime".to_string()), "\n".to_string()), "// read; there is no wall fallback.".to_string()), "\n".to_string()), "#[derive(Clone, Copy)]".to_string()), "\n".to_string()), "struct CpuMark(u128);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "fn cpu_mark() -> CpuMark {".to_string()), "\n".to_string()), "    CpuMark(observed_thread_cpu_nanos(String::new()) as u128)".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "fn cpu_span_nanos(started: CpuMark) -> u128 {".to_string()), "\n".to_string()), "    let finished = cpu_mark();".to_string()), "\n".to_string()), "    if finished.0 < started.0 {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: the thread CPU clock went backwards between two reads, so no span is measurable\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    finished.0 - started.0".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// A SPAN THAT DOES NOT FIT REFUSES RATHER THAN SATURATING (review 64474 control). This was".to_string()), "\n".to_string()), "// i64::try_from(n).unwrap_or(i64::MAX), which turns a failed conversion into a FIGURE -- and a".to_string()), "\n".to_string()), "// fabricated figure on a receipt is the state DESIGN section 5 forbids outright, whether the".to_string()), "\n".to_string()), "// invented number is a zero that reports a phase as instant or a maximum that reports it as".to_string()), "\n".to_string()), "// three centuries. The saturating arm also chose the direction that hides best: i64::MAX would".to_string()), "\n".to_string()), "// push the exclusive sum past the parent and surface as NativeDriverCostOverAttributed, a cost".to_string()), "\n".to_string()), "// verdict naming the wrong cause.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// ON REACHABILITY, STATED RATHER THAN LEFT AS AN IMPLIED CLAIM: i64 nanoseconds is about 292".to_string()), "\n".to_string()), "// years, so no span this driver measures reaches it, and the refusal below is not expected to".to_string()), "\n".to_string()), "// fire. It is written because the alternative is not silence but a LIE -- the arm has to answer".to_string()), "\n".to_string()), "// something, and the only honest answers are a real number or a refusal.".to_string()), "\n".to_string()), "fn native_cost_i64(n: u128) -> i64 {".to_string()), "\n".to_string()), "    match i64::try_from(n) {".to_string()), "\n".to_string()), "        Ok(v) => v,".to_string()), "\n".to_string()), "        Err(cause) => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: a measured span does not fit the cost carrier, so no partition can be reported: {n} ({cause})\");".to_string()), "\n".to_string()), "            std::process::exit(2);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// AN UNREADABLE /proc IS ABSENT, NOT ZERO (review 64181). A zero here was printed as".to_string()), "\n".to_string()), "// peak_rss_bytes / rss_bytes and read as a measurement: a run on a host without /proc, or with".to_string()), "\n".to_string()), "// the key renamed, reported a process using no memory. Absence is carried as None and rendered".to_string()), "\n".to_string()), "// as JSON null, so the receipt says it does not know instead of inventing a figure. This is".to_string()), "\n".to_string()), "// telemetry on no receipt field, so it is the one place an Absent is carried rather than".to_string()), "\n".to_string()), "// refused: the run is still a valid observation of everything else.".to_string()), "\n".to_string()), "fn proc_status_kib(key: &str) -> Option<u64> {".to_string()), "\n".to_string()), "    let text = std::fs::read_to_string(\"/proc/self/status\").ok()?;".to_string()), "\n".to_string()), "    for line in text.lines() {".to_string()), "\n".to_string()), "        if let Some(rest) = line.strip_prefix(key) {".to_string()), "\n".to_string()), "            return rest".to_string()), "\n".to_string()), "                .trim_start_matches(':')".to_string()), "\n".to_string()), "                .trim()".to_string()), "\n".to_string()), "                .split_whitespace()".to_string()), "\n".to_string()), "                .next()".to_string()), "\n".to_string()), "                .and_then(|n| n.parse::<u64>().ok());".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    None".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "// ONE CLOCK FOR THE VERDICT, AND IT IS THE THREAD CPU ONE (see cpu_span_nanos). Every exclusive".to_string()), "\n".to_string()), "// phase span and the parent span are read from it, so the partition compares readings from a".to_string()), "\n".to_string()), "// single source; the wall Instant around the run is an observation only. The history below is".to_string()), "\n".to_string()), "// why one source matters (review 64474), and it applied to the monotonic clock first.".to_string()), "\n".to_string()), "// They were split before this: the parent came from Instant while the phase spans came from".to_string()), "\n".to_string()), "// SystemTime, which is the wall clock and is free to step backwards under NTP or an operator".to_string()), "\n".to_string()), "// adjustment. A step between two phase reads could then push the exclusive sum past a parent".to_string()), "\n".to_string()), "// span that never moved, and the driver would refuse with NativeDriverCostOverAttributed --".to_string()), "\n".to_string()), "// a cost refusal whose real cause was the clock. That is a fabricated attribution: the numbers".to_string()), "\n".to_string()), "// would be wrong while the receipt read as a measurement.".to_string()), "\n".to_string()), "//".to_string()), "\n".to_string()), "// THE SUBTRACTION IS GONE RATHER THAN GUARDED, which is the point. A span used to be an".to_string()), "\n".to_string()), "// explicit saturating_sub of two readings, so a backwards step clamped the difference to zero".to_string()), "\n".to_string()), "// and reported a phase as having taken NO TIME -- the exact state the annotation beside it".to_string()), "\n".to_string()), "// forbade, reached by the arm meant to prevent it. Instant::elapsed cannot return a negative".to_string()), "\n".to_string()), "// duration, so there is no difference to clamp and no clamp to review: DESIGN section 5".to_string()), "\n".to_string()), "// construction over validation, and the class climbs from mitigated to structurally".to_string()), "\n".to_string()), "// impossible. The pre-epoch refusal that guarded the old wall-clock read is DELETED with it,".to_string()), "\n".to_string()), "// because the hazard it named cannot arise on this clock -- production handling dissolves on".to_string()), "\n".to_string()), "// the climb (DESIGN section 4b(4)); no evidence is retired here, since that arm had none.".to_string()), "\n".to_string()), "fn run_adjudication(facts_path: &str, pattern: Rc<TargetPattern>, source_roots: &[String]) {".to_string()), "\n".to_string()), "    let driver_start = cpu_mark();".to_string()), "\n".to_string()), "    let driver_wall_start = Instant::now();".to_string()), "\n".to_string()), "    // A MISSING GITHUB_SHA IS ABSENT, NOT \"local\" (review 64181). The receipt line carries this".to_string()), "\n".to_string()), "    // as the tree the measurement describes; the literal \"local\" is a plausible identity that".to_string()), "\n".to_string()), "    // no reader can distinguish from a tree actually named local.".to_string()), "\n".to_string()), "    let head: Option<String> = std::env::var(\"GITHUB_SHA\").ok();".to_string()), "\n".to_string()), "    let facts = read_host_facts(facts_path);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // the load row: reading the declared roots off disk. Its own exclusive row rather than a".to_string()), "\n".to_string()), "    // field on another phase, so the IO is never mixed into a fold's number.".to_string()), "\n".to_string()), "    let load_started = cpu_mark();".to_string()), "\n".to_string()), "    if source_roots.is_empty() {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: no source roots given\");".to_string()), "\n".to_string()), "        std::process::exit(2);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let reads = read_ingest(source_roots);".to_string()), "\n".to_string()), "    let corpus_reads = reads.len();".to_string()), "\n".to_string()), "    let ingest = Rc::new(im::vector::Vector::from(reads));".to_string()), "\n".to_string()), "    let load_nanos = cpu_span_nanos(load_started);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // universe_derivation: the floor's own per-file discovery fold plus the module-header and".to_string()), "\n".to_string()), "    // import scans, over EVERY read -- discovery is a corpus-wide question -- and then the".to_string()), "\n".to_string()), "    // import closure of the universe's modules, which is all the front end is given.".to_string()), "\n".to_string()), "    let universe_started = cpu_mark();".to_string()), "\n".to_string()), "    let source_facts = native_lane_source_facts(ingest.clone());".to_string()), "\n".to_string()), "    // The universe is derived FROM THE FACTS ALREADY BOUND, not from the ingest again:".to_string()), "\n".to_string()), "    // the ingest-taking entry would re-run the whole-corpus discovery fold the line above".to_string()), "\n".to_string()), "    // just paid for, and that fold is the phase the pattern does NOT narrow. See".to_string()), "\n".to_string()), "    // v2.compiler.compile native_lane_universe_of_facts -- the pattern is threaded, so this".to_string()), "\n".to_string()), "    // is the same entry a narrower pattern reaches, never a filter over a default universe.".to_string()), "\n".to_string()), "    let universe = match &*native_lane_universe_of_facts(source_facts.clone(), pattern.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"DERIVATION-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    // The walk's budget exhausting is a refusal of the whole derivation, never a truncated".to_string()), "\n".to_string()), "    // closure: a narrowed ingest would surface only as unexplained resolve refusals later.".to_string()), "\n".to_string()), "    let closure = match &*native_lane_closure_modules(".to_string()), "\n".to_string()), "        source_facts.clone(),".to_string()), "\n".to_string()), "        universe.clone(),".to_string()), "\n".to_string()), "        native_lane_closure_round_budget(),".to_string()), "\n".to_string()), "    ) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CLOSURE-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let closure_ingest = native_lane_closure_ingest(ingest.clone(), source_facts.clone(), closure.clone());".to_string()), "\n".to_string()), "    let closure_reads = closure_ingest.len();".to_string()), "\n".to_string()), "    // The ingest receipt's identity join, asked by the route: every ingested source declares a".to_string()), "\n".to_string()), "    // closure module and every closure module some source declares was ingested. A miss is the".to_string()), "\n".to_string()), "    // hidden prepass (or a hidden narrowing) this receipt exists to refuse.".to_string()), "\n".to_string()), "    let ingest_receipt = native_lane_ingest_receipt(source_facts.clone(), closure.clone(), closure_ingest.clone());".to_string()), "\n".to_string()), "    // The join answers a typed refusal naming the offending identity, so the counts below are".to_string()), "\n".to_string()), "    // context for it rather than the whole diagnostic: a reader gets the module and the path,".to_string()), "\n".to_string()), "    // not a pair of totals to re-derive the offender from.".to_string()), "\n".to_string()), "    match &*native_lane_ingest_matches_closure(source_facts.clone(), ingest_receipt.clone(), closure_ingest.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { .. } => {}".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(".to_string()), "\n".to_string()), "                \"INGEST-CLOSURE-REFUSED: {:#?} (scanned={} ingested={} closure_modules={})\",".to_string()), "\n".to_string()), "                diagnostics,".to_string()), "\n".to_string()), "                ingest_receipt.scanned_paths.len(),".to_string()), "\n".to_string()), "                ingest_receipt.ingested_paths.len(),".to_string()), "\n".to_string()), "                ingest_receipt.closure_modules.len(),".to_string()), "\n".to_string()), "            );".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let universe_nanos = cpu_span_nanos(universe_started);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // the context row: the front-end fold over the CLOSURE only, entered ONE PHASE AT A TIME.".to_string()), "\n".to_string()), "    // The driver owns the clock, so it is the only place a phase span can be read; the phases".to_string()), "\n".to_string()), "    // themselves are v2.compiler.program_assembly declarations and each binds the previous".to_string()), "\n".to_string()), "    // phase's Outcome, so each phase BODY is single-authored and only the ORDER and the".to_string()), "\n".to_string()), "    // inter-phase diagnostic merge exist twice -- here and in the modeled composition".to_string()), "\n".to_string()), "    // program_assembly_read_to_normalized_root_seeded. (It named the UNSEEDED composition".to_string()), "\n".to_string()), "    // until that one was deleted for having no caller; the seeded producer is now the single".to_string()), "\n".to_string()), "    // modeled per-file front end, and this loop is still its second spelling.)".to_string()), "\n".to_string()), "    //".to_string()), "\n".to_string()), "    // THAT SECOND SPELLING IS ADMITTED DEBT AND IS FILED, NOT ASSERTED AWAY (review 65068):".to_string()), "\n".to_string()), "    // gunbc.recurring_failure_mode.realization_respells_a_modeled_folds_sequencing_to_instrument_it.".to_string()), "\n".to_string()), "    // An earlier revision of this comment claimed the two are the same computation. Nothing".to_string()), "\n".to_string()), "    // executes that claim, and a .dag witness comparing the composition against its own phases".to_string()), "\n".to_string()), "    // CANNOT go red -- the composition is defined as the phase chain -- so the honest answer is".to_string()), "\n".to_string()), "    // the row and its trigger (a realization seam that yields per-phase spans FROM a modeled".to_string()), "\n".to_string()), "    // fold), not a green check. Reordering these calls or dropping the merge that".to_string()), "\n".to_string()), "    // program_assembly_phase_parse_seeded performs would change the context with".to_string()), "\n".to_string()), "    // nothing red.".to_string()), "\n".to_string()), "    let context_started = cpu_mark();".to_string()), "\n".to_string()), "    // THE ONCE-PER-FOLD INVARIANT IS PAID ONCE, HERE, AND CARRIED INTO EVERY FILE. A second".to_string()), "\n".to_string()), "    // dag_language_model() or prepare_grammar() call inside the loop would re-introduce at the".to_string()), "\n".to_string()), "    // realization layer exactly the per-file recompute the fold hoisted out.".to_string()), "\n".to_string()), "    let front_end = match &*native_test_front_end_prepare() {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CONTEXT-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let front_end_nanos = cpu_span_nanos(context_started);".to_string()), "\n".to_string()), "    // THE INGEST'S OCCURRENCE SCOPE, computed once: every projected occurrence the loop's".to_string()), "\n".to_string()), "    // normalize allocates states its cause in it (v2.compiler.program_assembly".to_string()), "\n".to_string()), "    // program_assembly_ingest_scope).".to_string()), "\n".to_string()), "    let ingest_scope = match &*program_assembly_ingest_scope_outcome(closure_ingest.clone()) {".to_string()), "\n".to_string()), "        Outcome::Accepted { value, .. } => value.clone(),".to_string()), "\n".to_string()), "        Outcome::Rejected { diagnostics } => {".to_string()), "\n".to_string()), "            eprintln!(\"CONTEXT-REFUSED: {diagnostics:#?}\");".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let mut context_state = native_test_context_state_empty();".to_string()), "\n".to_string()), "    let mut tokenize_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut parse_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut normalize_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut absorb_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut phase_calls: u64 = 0;".to_string()), "\n".to_string()), "    let mut token_total: u64 = 0;".to_string()), "\n".to_string()), "    let mut byte_total: u64 = 0;".to_string()), "\n".to_string()), "    let mut context_file_samples: Vec<u128> = Vec::new();".to_string()), "\n".to_string()), "    for read in closure_ingest.iter() {".to_string()), "\n".to_string()), "        let file_started = cpu_mark();".to_string()), "\n".to_string()), "        let tokenize_started = cpu_mark();".to_string()), "\n".to_string()), "        let tokens = program_assembly_phase_tokenize(read.clone(), front_end.lex.clone());".to_string()), "\n".to_string()), "        let file_tokenize_nanos = cpu_span_nanos(tokenize_started);".to_string()), "\n".to_string()), "        // The COUNT the time is read against: a span alone cannot separate a large file from a".to_string()), "\n".to_string()), "        // per-file constant. Counted outside every phase span so it prices none of them.".to_string()), "\n".to_string()), "        let file_tokens = program_assembly_phase_token_count(tokens.clone());".to_string()), "\n".to_string()), "        let parse_started = cpu_mark();".to_string()), "\n".to_string()), "        // SEEDED FROM THE MARK THE CONTEXT HAS REACHED, because this loop IS a source graph:".to_string()), "\n".to_string()), "        // std.occurrence_identity occurrence_identity_scope_law requires one allocator threaded".to_string()), "\n".to_string()), "        // across every parsed source, and a per-file reset makes two files' occurrence #N the".to_string()), "\n".to_string()), "        // same value with different meanings. The modeled fold threads it internally; this".to_string()), "\n".to_string()), "        // respelling has to thread it explicitly or it keeps the reset the fold no longer has.".to_string()), "\n".to_string()), "        let file_seed = context_state.alloc.clone();".to_string()), "\n".to_string()), "        let file_seed_reported = file_seed.clone();".to_string()), "\n".to_string()), "        let parsed = program_assembly_phase_parse_seeded(".to_string()), "\n".to_string()), "            tokens.clone(),".to_string()), "\n".to_string()), "            front_end.prepared.clone(),".to_string()), "\n".to_string()), "            file_seed.clone(),".to_string()), "\n".to_string()), "        );".to_string()), "\n".to_string()), "        let file_parse_nanos = cpu_span_nanos(parse_started);".to_string()), "\n".to_string()), "        // On a refused parse".to_string()), "\n".to_string()), "        // this returns the seed unchanged. Not because nothing was minted -- a refused parse".to_string()), "\n".to_string()), "        // HAS minted ids -- but because ParseExprRejected carries no provenance state, so the".to_string()), "\n".to_string()), "        // mark the attempt reached is not recoverable. See the precondition on".to_string()), "\n".to_string()), "        // v2.compiler.compile native_test_context_absorb.".to_string()), "\n".to_string()), "        let file_alloc = program_assembly_parsed_alloc(parsed.clone(), file_seed);".to_string()), "\n".to_string()), "        let normalize_started = cpu_mark();".to_string()), "\n".to_string()), "        // NORMALIZE ADVANCES THE ALLOCATOR: lowering allocates every image member an id, so the".to_string()), "\n".to_string()), "        // next file seeds from the mark normalize reached, not the one parse reached.".to_string()), "\n".to_string()), "        let normalized = program_assembly_phase_normalize_seeded(parsed.clone(), file_alloc.clone(), ingest_scope.clone());".to_string()), "\n".to_string()), "        let root = program_assembly_normalized_outcome(normalized.clone());".to_string()), "\n".to_string()), "        let file_spans = program_assembly_normalized_spans(normalized.clone());".to_string()), "\n".to_string()), "        let file_alloc = program_assembly_normalized_alloc(normalized);".to_string()), "\n".to_string()), "        let file_alloc_reported = file_alloc.clone();".to_string()), "\n".to_string()), "        let file_normalize_nanos = cpu_span_nanos(normalize_started);".to_string()), "\n".to_string()), "        // qualified-name read plus source-root index insertion: the half of the per-file step".to_string()), "\n".to_string()), "        // that is not the front end, timed separately because a quadratic accumulator would".to_string()), "\n".to_string()), "        // live here and nowhere else in this loop.".to_string()), "\n".to_string()), "        let absorb_started = cpu_mark();".to_string()), "\n".to_string()), "        context_state = native_test_context_absorb(context_state.clone(), read.clone(), root.clone(), file_alloc, file_spans);".to_string()), "\n".to_string()), "        let file_absorb_nanos = cpu_span_nanos(absorb_started);".to_string()), "\n".to_string()), "        let file_nanos = cpu_span_nanos(file_started);".to_string()), "\n".to_string()), "        tokenize_nanos += file_tokenize_nanos;".to_string()), "\n".to_string()), "        parse_nanos += file_parse_nanos;".to_string()), "\n".to_string()), "        normalize_nanos += file_normalize_nanos;".to_string()), "\n".to_string()), "        absorb_nanos += file_absorb_nanos;".to_string()), "\n".to_string()), "        phase_calls += 1;".to_string()), "\n".to_string()), "        token_total += file_tokens.max(0) as u64;".to_string()), "\n".to_string()), "        let file_bytes = read.source.carried.len() as u64;".to_string()), "\n".to_string()), "        byte_total += file_bytes;".to_string()), "\n".to_string()), "        context_file_samples.push(file_nanos);".to_string()), "\n".to_string()), "        eprintln!(".to_string()), "\n".to_string()), "            \"[native-context-split] {}\",".to_string()), "\n".to_string()), "            serde_json::json!({".to_string()), "\n".to_string()), "                \"producer\": \"std.compiler_entry.SourceRootEvalDriver\",".to_string()), "\n".to_string()), "                \"path\": read.compilation_unit.clone(),".to_string()), "\n".to_string()), "                \"bytes\": file_bytes,".to_string()), "\n".to_string()), "                \"tokens\": file_tokens,".to_string()), "\n".to_string()), "                \"tokenize_nanos\": file_tokenize_nanos,".to_string()), "\n".to_string()), "                \"parse_nanos\": file_parse_nanos,".to_string()), "\n".to_string()), "                \"normalize_nanos\": file_normalize_nanos,".to_string()), "\n".to_string()), "                \"absorb_nanos\": file_absorb_nanos,".to_string()), "\n".to_string()), "                \"file_nanos\": file_nanos,".to_string()), "\n".to_string()), "                // THE THREADING, MADE OBSERVABLE. occurrence_seed is the mark this file was".to_string()), "\n".to_string()), "                // handed and occurrence_next the mark it reached, so a multi-file run shows".to_string()), "\n".to_string()), "                // one sequence continuing across files instead of each file restarting at 0.".to_string()), "\n".to_string()), "                // A REFUSED file reports next == seed. That is the mark it was HANDED, not a".to_string()), "\n".to_string()), "                // claim that nothing was minted: a refused parse mints ids that the refusal".to_string()), "\n".to_string()), "                // discards unrecoverably. The next file continues from the seed rather than".to_string()), "\n".to_string()), "                // rewinding to zero.".to_string()), "\n".to_string()), "                \"occurrence_seed\": program_assembly_allocator_next(file_seed_reported),".to_string()), "\n".to_string()), "                \"occurrence_next\": program_assembly_allocator_next(file_alloc_reported),".to_string()), "\n".to_string()), "            }),".to_string()), "\n".to_string()), "        );".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let context = native_test_context_finish(context_state, front_end.clone(), closure_ingest.clone());".to_string()), "\n".to_string()), "    let context_nanos = cpu_span_nanos(context_started);".to_string()), "\n".to_string()), "    context_file_samples.sort_unstable();".to_string()), "\n".to_string()), "    let context_phase_sum = front_end_nanos + tokenize_nanos + parse_nanos + normalize_nanos + absorb_nanos;".to_string()), "\n".to_string()), "    eprintln!(".to_string()), "\n".to_string()), "        \"[native-context-partition] {}\",".to_string()), "\n".to_string()), "        serde_json::json!({".to_string()), "\n".to_string()), "            \"producer\": \"std.compiler_entry.SourceRootEvalDriver\",".to_string()), "\n".to_string()), "            \"basis\": \"context_span\",".to_string()), "\n".to_string()), "            \"basis_note\": \"exclusive phase rows partition context_nanos; residual is loop overhead and the eprintln per file\",".to_string()), "\n".to_string()), "            \"context_nanos\": context_nanos,".to_string()), "\n".to_string()), "            \"front_end_prepare_nanos\": front_end_nanos,".to_string()), "\n".to_string()), "            \"tokenize_nanos\": tokenize_nanos,".to_string()), "\n".to_string()), "            \"parse_nanos\": parse_nanos,".to_string()), "\n".to_string()), "            \"normalize_nanos\": normalize_nanos,".to_string()), "\n".to_string()), "            \"absorb_nanos\": absorb_nanos,".to_string()), "\n".to_string()), "            \"sum_phase_nanos\": context_phase_sum,".to_string()), "\n".to_string()), "            \"residual_nanos\": context_nanos.saturating_sub(context_phase_sum),".to_string()), "\n".to_string()), "            \"files\": phase_calls,".to_string()), "\n".to_string()), "            \"tokenize_calls\": phase_calls,".to_string()), "\n".to_string()), "            \"parse_calls\": phase_calls,".to_string()), "\n".to_string()), "            \"normalize_calls\": phase_calls,".to_string()), "\n".to_string()), "            \"absorb_calls\": phase_calls,".to_string()), "\n".to_string()), "            \"front_end_prepare_calls\": 1,".to_string()), "\n".to_string()), "            \"tokens\": token_total,".to_string()), "\n".to_string()), "            \"bytes\": byte_total,".to_string()), "\n".to_string()), "            \"file_refusals\": context.file_refusals.len(),".to_string()), "\n".to_string()), "            \"file_p50_nanos\": native_cost_quantile_nanos(&context_file_samples, 1, 2),".to_string()), "\n".to_string()), "            \"file_p95_nanos\": native_cost_quantile_nanos(&context_file_samples, 19, 20),".to_string()), "\n".to_string()), "            \"file_max_nanos\": context_file_samples.last().copied().unwrap_or(0),".to_string()), "\n".to_string()), "        }),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // the prepare and eval rows, entered separately per module so the number the profile".to_string()), "\n".to_string()), "    // lane prices -- the eval row -- is the sum of native_lane_identity_row".to_string()), "\n".to_string()), "    // and nothing else: not ingest, not resolve, not infer.".to_string()), "\n".to_string()), "    let mut population: Vec<Rc<NativeRouteMemberRow>> = Vec::new();".to_string()), "\n".to_string()), "    let mut prepare_total_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut evaluate_total_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut prepare_samples: Vec<u128> = Vec::new();".to_string()), "\n".to_string()), "    let mut eval_samples: Vec<u128> = Vec::new();".to_string()), "\n".to_string()), "    // ExclusiveModuleRelease IS NOW STRUCTURALLY ZERO, AND THAT IS A REAL CHANGE RATHER".to_string()), "\n".to_string()), "    // THAN A TIDY-UP. The displaced loop dropped each module's resolved tree inside a span,".to_string()), "\n".to_string()), "    // because dropping at iteration end paid time no exclusive row covered. The engine holds".to_string()), "\n".to_string()), "    // every settled demand's value in its entries for the whole run, so there is no per-module".to_string()), "\n".to_string()), "    // release point to time -- resolved trees now accumulate where they used to be released.".to_string()), "\n".to_string()), "    // The row stays in the partition reporting zero rather than being deleted: a key removed".to_string()), "\n".to_string()), "    // here vanishes from the sum and the serialized line at once, silently, and the residual".to_string()), "\n".to_string()), "    // it used to carry would be absorbed into the tolerance rather than reported. Retention is".to_string()), "\n".to_string()), "    // std.materialization_ladder's question and the cut that answers it owns this row.".to_string()), "\n".to_string()), "    let module_release_nanos: u128 = 0;".to_string()), "\n".to_string()), "    let mut relay_emit_nanos: u128 = 0;".to_string()), "\n".to_string()), "    // The per-path refusal index is built ONCE here rather than per module: this loop is the".to_string()), "\n".to_string()), "    // only place that knows a loop is about to happen, and the join it feeds was O(modules x".to_string()), "\n".to_string()), "    // refusals) when each module scanned the refusal list for itself.".to_string()), "\n".to_string()), "    let refusal_index = native_lane_file_refusal_index(context.file_refusals.clone());".to_string()), "\n".to_string()), "    // ═══════════════════════════════════════════════════════════════════════════════════════".to_string()), "\n".to_string()), "    // THE SCHEDULE IS THE ENGINE'S. THIS LOOP HOLDS THE CLOCK AND NOTHING ELSE.".to_string()), "\n".to_string()), "    // ═══════════════════════════════════════════════════════════════════════════════════════".to_string()), "\n".to_string()), "    //".to_string()), "\n".to_string()), "    // What stood here was `for entry in universe.modules` with `for declaration in".to_string()), "\n".to_string()), "    // entry.declarations` nested inside it -- a dependency structure written as control flow, and".to_string()), "\n".to_string()), "    // the last place in the native route that decided WHAT RUNS NEXT. It is deleted. The order now".to_string()), "\n".to_string()), "    // comes from v2.std.demand_engine's one ready queue, over a graph".to_string()), "\n".to_string()), "    // v2.compiler.native_demand_schedule DERIVES from the same universe roster this loop walked.".to_string()), "\n".to_string()), "    //".to_string()), "\n".to_string()), "    // WHY A LOOP REMAINS AT ALL, and why it is not the old one wearing a new name: a .dag fold".to_string()), "\n".to_string()), "    // cannot read a clock, and the native cost partition is an EXHAUSTIVE exclusive sum over".to_string()), "\n".to_string()), "    // parent_span with a 50ms tolerance arm. Replacing the walk with one opaque call would have".to_string()), "\n".to_string()), "    // dissolved the prepare and eval rows into an unattributed remainder and made that arm fire --".to_string()), "\n".to_string()), "    // so the driver asks the engine for the next admissible demand and spans the step. It supplies".to_string()), "\n".to_string()), "    // no ordering, no module iteration and no declaration iteration; remove the spans and the body".to_string()), "\n".to_string()), "    // is a drain.".to_string()), "\n".to_string()), "    //".to_string()), "\n".to_string()), "    // THE SEAT COUNT IS THE CALLER'S. One seat here, which is what makes this cut a pure authority".to_string()), "\n".to_string()), "    // move: same demands, same order, same single execution at a time. Multi-seat realization binds".to_string()), "\n".to_string()), "    // a different offer to the same drain and changes nothing else.".to_string()), "\n".to_string()), "    // THE DRIVER'S OWN INPUT CONSTRUCTION, charged to prepare as it was before the engine landed:".to_string()), "\n".to_string()), "    // it runs before any demand and is not the scheduler's bookkeeping, which the engine measures".to_string()), "\n".to_string()), "    // for itself.".to_string()), "\n".to_string()), "    let tested_tree_started = cpu_mark();".to_string()), "\n".to_string()), "    let tested_tree_input = native_demand_tested_tree_input(head.clone().unwrap_or_default());".to_string()), "\n".to_string()), "    prepare_total_nanos += cpu_span_nanos(tested_tree_started);".to_string()), "\n".to_string()), "    // ONE CALL. The driver does not drain the graph, does not decide readiness and does not".to_string()), "\n".to_string()), "    // classify a demand's stage -- those are the engine's and the plan's decisions, and a".to_string()), "\n".to_string()), "    // rendered-main loop that made them was a second consumer of the engine's admission".to_string()), "\n".to_string()), "    // vocabulary living in generated Rust, where no .dag check reaches.".to_string()), "\n".to_string()), "    //".to_string()), "\n".to_string()), "    // IT USED TO HOLD A LOOP FOR THE CLOCK, AND THAT REASON WAS WRONG. Each step now takes".to_string()), "\n".to_string()), "    // its own span through observed_thread_cpu_nanos -- an ordinary builtin with no resource".to_string()), "\n".to_string()), "    // requirement, modelled by std.realization_measurement as ObserveThreadCpuAtSubject's".to_string()), "\n".to_string()), "    // realization seam -- so the exclusive prepare and eval rows survive with the spans taken".to_string()), "\n".to_string()), "    // where the work is instead of around it.".to_string()), "\n".to_string()), "    // THE ENGINE CALL IS ONE MEASURED SPAN (std.compiler_entry ExclusiveDemandScheduling). Its".to_string()), "\n".to_string()), "    // demand windows are the prepare and eval rows; everything else the call spends is the".to_string()), "\n".to_string()), "    // scheduler's, including the work between the engine's own bookkeeping spans that no row".to_string()), "\n".to_string()), "    // timed when this row was the sum of those spans.".to_string()), "\n".to_string()), "    let schedule_started = cpu_mark();".to_string()), "\n".to_string()), "    let run = native_demand_schedule_universe(".to_string()), "\n".to_string()), "        universe.modules.clone(),".to_string()), "\n".to_string()), "        context.clone(),".to_string()), "\n".to_string()), "        refusal_index.clone(),".to_string()), "\n".to_string()), "        tested_tree_input.clone(),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    let schedule_span_nanos = cpu_span_nanos(schedule_started);".to_string()), "\n".to_string()), "    // driver_collection: the driver's own work after the engine returned -- rows into the".to_string()), "\n".to_string()), "    // population, the samples, the counters. Named for what it is, not folded into scheduling.".to_string()), "\n".to_string()), "    let collection_started = cpu_mark();".to_string()), "\n".to_string()), "    for row in native_demand_run_rows(run.clone()).iter() {".to_string()), "\n".to_string()), "        population.push(row.clone());".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let engine_prepare_nanos = native_demand_prepare_nanos(run.clone()).max(0) as u128;".to_string()), "\n".to_string()), "    let engine_eval_nanos = native_demand_eval_nanos(run.clone()).max(0) as u128;".to_string()), "\n".to_string()), "    // OBSERVATION ONLY (v2.compiler.compile native_demand_occurrence_census_lines): the census is its".to_string()), "\n".to_string()), "    // own demand kind, so its cost is the engine-reported ExclusiveOccurrenceCensus row, not a host span.".to_string()), "\n".to_string()), "    let occurrence_census_nanos = native_demand_occurrence_census_nanos(run.clone()).max(0) as u128;".to_string()), "\n".to_string()), "    prepare_total_nanos += engine_prepare_nanos;".to_string()), "\n".to_string()), "    evaluate_total_nanos += engine_eval_nanos;".to_string()), "\n".to_string()), "    // The engine's own bookkeeping sum stays an observation on the schedule line; it is not the row.".to_string()), "\n".to_string()), "    let engine_bookkeeping_nanos = native_demand_scheduling_nanos(run.clone()).max(0) as u128;".to_string()), "\n".to_string()), "    // Every demand window the engine attributes -- prepare, eval and the occurrence census -- is a row".to_string()), "\n".to_string()), "    // of its own, so the scheduling row is the call span minus all three. Leaving the census out would".to_string()), "\n".to_string()), "    // count its windows twice. An engine that attributed more than its call took is incoherent; refuse".to_string()), "\n".to_string()), "    // rather than clamp the scheduling row to zero.".to_string()), "\n".to_string()), "    let attributed_in_call = engine_prepare_nanos + engine_eval_nanos + occurrence_census_nanos;".to_string()), "\n".to_string()), "    if attributed_in_call > schedule_span_nanos {".to_string()), "\n".to_string()), "        eprintln!(\"REFUSED: native driver cost OverAttributed inside the engine call {{ attributed_nanos: {}, schedule_span_nanos: {} }}\", attributed_in_call, schedule_span_nanos);".to_string()), "\n".to_string()), "        std::process::exit(1);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let demand_scheduling_nanos = schedule_span_nanos - attributed_in_call;".to_string()), "\n".to_string()), "    for line in native_demand_occurrence_census_lines(run.clone(), universe.modules.len() as i64).iter() {".to_string()), "\n".to_string()), "        eprintln!(\"{}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for n in native_demand_prepare_samples(run.clone()).iter() {".to_string()), "\n".to_string()), "        prepare_samples.push((*n).max(0) as u128);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for n in native_demand_eval_samples(run.clone()).iter() {".to_string()), "\n".to_string()), "        eval_samples.push((*n).max(0) as u128);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let prepare_ok: u64 = native_demand_prepare_ok(run.clone()).max(0) as u64;".to_string()), "\n".to_string()), "    let prepare_refused: u64 = native_demand_prepare_refused(run.clone()).max(0) as u64;".to_string()), "\n".to_string()), "    let driver_collection_nanos = cpu_span_nanos(collection_started);".to_string()), "\n".to_string()), "    // THE DRIVER REFUSES A RUN WHOSE CLOCK NEVER ADVANCED rather than reporting its zeros. A".to_string()), "\n".to_string()), "    // realization whose body returns a constant zero leaves every transition CLASSIFIED and".to_string()), "\n".to_string()), "    // VALIDLY OBSERVED, so completeness answers true over totals that are all zero, and the".to_string()), "\n".to_string()), "    // emitted-body membership check cannot see it either -- that check establishes a bridge HAS".to_string()), "\n".to_string()), "    // a body, never that the body measures. Reporting those zeros would be a fabricated".to_string()), "\n".to_string()), "    // measurement presented as an observation, so the line stops here with a located cause.".to_string()), "\n".to_string()), "    if !native_demand_observation_progressed(run.clone()) {".to_string()), "\n".to_string()), "        eprintln!(".to_string()), "\n".to_string()), "            \"[native-demand-schedule] REFUSED: transitions={} executed and the elapsed observation accumulated no span; the emitted monotonic clock is not advancing\",".to_string()), "\n".to_string()), "            native_demand_run_transition_count(run.clone()),".to_string()), "\n".to_string()), "        );".to_string()), "\n".to_string()), "        std::process::exit(1);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    // THE EVENT TRACE, SEPARATE FROM THE RESULT. One line per admission in admission order, each".to_string()), "\n".to_string()), "    // naming the demand key and the state it settled into. It is the schedule's receipt and it is".to_string()), "\n".to_string()), "    // deliberately not the population: two runs agreeing on rows while disagreeing on order is a".to_string()), "\n".to_string()), "    // real difference, and a receipt that carried only rows could not report it.".to_string()), "\n".to_string()), "    let relay_started = cpu_mark();".to_string()), "\n".to_string()), "    for line in native_demand_run_receipt_lines(run.clone()).iter() {".to_string()), "\n".to_string()), "        eprintln!(\"[native-demand-transition] {}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    eprintln!(".to_string()), "\n".to_string()), "        \"[native-demand-schedule] demands={} admitted={} readiness_derivations={} schedule_span_nanos={} engine_bookkeeping_nanos={}\",".to_string()), "\n".to_string()), "        native_demand_run_demand_count(run.clone()),".to_string()), "\n".to_string()), "        native_demand_run_transition_count(run.clone()),".to_string()), "\n".to_string()), "        native_demand_run_readiness_derivations(run.clone()),".to_string()), "\n".to_string()), "        schedule_span_nanos,".to_string()), "\n".to_string()), "        engine_bookkeeping_nanos,".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    relay_emit_nanos += cpu_span_nanos(relay_started);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // receipt_admission: minting the receipt and evaluating the authority's admission and summary".to_string()), "\n".to_string()), "    // over it. The controls are executed here because they are receipt inputs, not universe members.".to_string()), "\n".to_string()), "    let admission_started = cpu_mark();".to_string()), "\n".to_string()), "    let receipt = native_lane_receipt(".to_string()), "\n".to_string()), "        context.clone(),".to_string()), "\n".to_string()), "        universe.clone(),".to_string()), "\n".to_string()), "        Rc::new(population.clone().into()),".to_string()), "\n".to_string()), "        native_lane_controls(context.clone()),".to_string()), "\n".to_string()), "        Rc::new(facts),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    let admission = native_route_admission(receipt.clone());".to_string()), "\n".to_string()), "    let summary = native_route_admission_summary(admission.clone());".to_string()), "\n".to_string()), "    let file_refusal_tally: Vec<serde_json::Value> = native_route_file_refusal_tally(receipt.clone())".to_string()), "\n".to_string()), "        .iter()".to_string()), "\n".to_string()), "        .map(|row| serde_json::json!(row))".to_string()), "\n".to_string()), "        .collect();".to_string()), "\n".to_string()), "    let admitted = native_route_admitted(admission.clone());".to_string()), "\n".to_string()), "    // THE FRONTIER RATCHET, OVER THE SAME RECEIPT AND INSIDE THE SAME SPAN: the verdict is".to_string()), "\n".to_string()), "    // gunbc.native_frontier_ratchet's, and this main only carries its word to the terminal marker".to_string()), "\n".to_string()), "    // and its lines to stderr. It is measured under receipt_admission because it is judgement of".to_string()), "\n".to_string()), "    // the receipt, the row that span already names.".to_string()), "\n".to_string()), "    let frontier = native_frontier_verdict(receipt.clone(), admission.clone(), pattern.clone());".to_string()), "\n".to_string()), "    let frontier_word = native_frontier_verdict_word(frontier.clone());".to_string()), "\n".to_string()), "    let admission_nanos = cpu_span_nanos(admission_started);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // row_serialization: SERIALIZING THE OBSERVATIONS AND WRITING THEM, MEASURED (review".to_string()), "\n".to_string()), "    // 64181 named this span; #11105 made leaving it unattributed fatal). Every row the".to_string()), "\n".to_string()), "    // population carries is turned into JSON here and written to stdout, which is real work".to_string()), "\n".to_string()), "    // no other row covers -- eval is the identity fold and nothing else. It is TIMED, never".to_string()), "\n".to_string()), "    // derived as parent minus the others: a row defined as the remainder would force the".to_string()), "\n".to_string()), "    // residual to zero and make the tolerance arm unfireable by construction.".to_string()), "\n".to_string()), "    let serialization_started = cpu_mark();".to_string()), "\n".to_string()), "    for refusal in receipt.file_refusals.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"file_refusal\": refusal }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for advised in context.accepted_file_advisories.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::json!({ \"accepted_file_advisories\": advised }));".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for row in population.iter() {".to_string()), "\n".to_string()), "        println!(\"{}\", serde_json::to_string(row).unwrap());".to_string()), "\n".to_string()), "        // THE OPERATOR'S LINE, BESIDE THE PERSISTED ROW. The JSON above is the receipt; this is".to_string()), "\n".to_string()), "        // the same value rendered by the authority for a reader of the command's output, so a".to_string()), "\n".to_string()), "        // row that did not pass names its subject, stage, cause and position without anyone".to_string()), "\n".to_string()), "        // re-deriving them from the bytes just written. Passing rows print nothing here: the".to_string()), "\n".to_string()), "        // terminal marker carries their count. EXHAUSTIVE ON PURPOSE -- a verdict arm added to".to_string()), "\n".to_string()), "        // the vocabulary must decide here whether it is operator-visible.".to_string()), "\n".to_string()), "        match &*row.verdict {".to_string()), "\n".to_string()), "            NativeTestVerdict::NativeTestPassed => {}".to_string()), "\n".to_string()), "            NativeTestVerdict::NativeTestReturnedFalse".to_string()), "\n".to_string()), "            | NativeTestVerdict::NativeTestReturnedOther".to_string()), "\n".to_string()), "            | NativeTestVerdict::NativeTestRefused { .. } => {".to_string()), "\n".to_string()), "                eprintln!(\"[native-verdict] {}\", native_route_member_row_text(row.clone()));".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for line in native_frontier_report_lines(frontier.clone()).iter() {".to_string()), "\n".to_string()), "        eprintln!(\"[native-frontier] {}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    for line in native_frontier_proposal_file_lines(receipt.clone(), frontier.clone()).iter() {".to_string()), "\n".to_string()), "        eprintln!(\"[native-frontier-roster] {}\", line);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let row_serialization_nanos = cpu_span_nanos(serialization_started);".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "    // THE PARTITION, THROUGH THE ONE LAW. The rows are the row set std.compiler_entry owns and".to_string()), "\n".to_string()), "    // verdict is native_driver_cost_account over them -- not a second reconcile. The two rows".to_string()), "\n".to_string()), "    // this route pays that a driver handed a universe file does not (universe_derivation,".to_string()), "\n".to_string()), "    // receipt_admission) are members of the same exclusive sum, so an over-attribution through".to_string()), "\n".to_string()), "    // either is caught here rather than by a check of its own.".to_string()), "\n".to_string()), "    prepare_samples.sort_unstable();".to_string()), "\n".to_string()), "    eval_samples.sort_unstable();".to_string()), "\n".to_string()), "    let parent_span_nanos = cpu_span_nanos(driver_start);".to_string()), "\n".to_string()), "    let parent_wall_nanos = span_nanos(driver_wall_start);".to_string()), "\n".to_string()), "    // THE DRIVER IS EXHAUSTIVE OVER THE KEY WITH NO WILDCARD, deliberately: a row added to".to_string()), "\n".to_string()), "    // std.compiler_entry makes THIS match refuse to compile until the driver says what".to_string()), "\n".to_string()), "    // measures it. A wildcard here would answer zero for a span nobody wired up, which is".to_string()), "\n".to_string()), "    // the absorbing arm DESIGN section 5 forbids -- and it is what the old record literal".to_string()), "\n".to_string()), "    // did silently, three folds running.".to_string()), "\n".to_string()), "    let exclusive = native_driver_exclusive_rows(move |k| match k {".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveLoad => nanosecond(native_cost_i64(load_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveUniverseDerivation => nanosecond(native_cost_i64(universe_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveContext => nanosecond(native_cost_i64(context_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusivePrepare => nanosecond(native_cost_i64(prepare_total_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveEval => nanosecond(native_cost_i64(evaluate_total_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveReceiptAdmission => nanosecond(native_cost_i64(admission_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveRowSerialization => nanosecond(native_cost_i64(row_serialization_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveDemandScheduling => nanosecond(native_cost_i64(demand_scheduling_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveDriverCollection => nanosecond(native_cost_i64(driver_collection_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveOccurrenceCensus => nanosecond(native_cost_i64(occurrence_census_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveModuleRelease => nanosecond(native_cost_i64(module_release_nanos)),".to_string()), "\n".to_string()), "        NativeDriverExclusiveRowKey::ExclusiveRelayEmit => nanosecond(native_cost_i64(relay_emit_nanos)),".to_string()), "\n".to_string()), "    });".to_string()), "\n".to_string()), "    let exclusive_sum = nanosecond_count(native_driver_exclusive_sum(exclusive.clone())) as u128;".to_string()), "\n".to_string()), "    let tolerance_nanos = nanosecond_count(native_driver_cost_remainder_tolerance_nanos()) as u128;".to_string()), "\n".to_string()), "    let accounting = native_driver_cost_account(".to_string()), "\n".to_string()), "        nanosecond(native_cost_i64(parent_span_nanos)),".to_string()), "\n".to_string()), "        exclusive.clone(),".to_string()), "\n".to_string()), "        native_driver_cost_remainder_tolerance_nanos(),".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    // The remainder is the residual the accounting itself returns, never parent minus sum: on".to_string()), "\n".to_string()), "    // over-attributed arm there IS no remainder, and a clamped zero there would be a".to_string()), "\n".to_string()), "    // plausible number standing where the measurement is incoherent.".to_string()), "\n".to_string()), "    let (verdict, remainder_nanos) = match accounting.as_ref() {".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostOverAttributed { .. } =>".to_string()), "\n".to_string()), "            (r#\"NativeDriverCostOverAttributed\"#, serde_json::Value::Null),".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostRemainderExceedsTolerance { residual, .. } =>".to_string()), "\n".to_string()), "            (r#\"NativeDriverCostRemainderExceedsTolerance\"#, serde_json::json!(nanosecond_count(residual.clone()))),".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostReconciled { residual, .. } =>".to_string()), "\n".to_string()), "            (r#\"NativeDriverCostReconciled\"#, serde_json::json!(nanosecond_count(residual.clone()))),".to_string()), "\n".to_string()), "    };".to_string()), "\n".to_string()), "    let identities = universe.identities.len() as u64;".to_string()), "\n".to_string()), "    let eval_mean = if eval_samples.is_empty() { 0 } else { evaluate_total_nanos / eval_samples.len() as u128 };".to_string()), "\n".to_string()), "    let prepare_mean = if prepare_samples.is_empty() { 0 } else { prepare_total_nanos / prepare_samples.len() as u128 };".to_string()), "\n".to_string()), "    // THE ROWS ARE PROJECTED FROM THE VALUE, NOT RE-LISTED (review 64181). The field names".to_string()), "\n".to_string()), "    // were written once to build NativeDriverExclusiveRows and again to render it, which is the".to_string()), "\n".to_string()), "    // second spelling this file warns about for prose, applied to the emitted object: a driver".to_string()), "\n".to_string()), "    // gaining a phase would have updated the struct and left the receipt short. Serializing the".to_string()), "\n".to_string()), "    // value carries the row set from the type, so the JSON cannot disagree with the fold. The".to_string()), "\n".to_string()), "    // rows therefore render as std.measure Nanosecond objects rather than bare integers -- the".to_string()), "\n".to_string()), "    // unit travels with the number, which is the point of the type.".to_string()), "\n".to_string()), "    // A NON-RECONCILED ARM IS A PROCESS REFUSAL (#11105, review 63891). The receipt is".to_string()), "\n".to_string()), "    // printed first so the numbers that caused the refusal are on the wire, and THEN the".to_string()), "\n".to_string()), "    // line stops: a verdict string with exit 0 is the inert lens DESIGN section 6 names.".to_string()), "\n".to_string()), "    // The full-N run of this route refused here on 158600186 ns against a 50000000 ns".to_string()), "\n".to_string()), "    // tolerance before row_serialization was a measured row, which is what put that row on".to_string()), "\n".to_string()), "    // the type rather than a wider tolerance on this arm.".to_string()), "\n".to_string()), "    eprintln!(\"[native-cost-partition] {}\", serde_json::json!({".to_string()), "\n".to_string()), "        \"basis\": \"native_driver_thread_cpu\",".to_string()), "\n".to_string()), "        \"basis_note\": \"single-threaded SourceRootEvalDriver thread CPU (CLOCK_THREAD_CPUTIME_ID); exclusive rows partition parent_span_nanos; parent_wall_nanos is an observation, never judged\",".to_string()), "\n".to_string()), "        \"producer\": \"std.compiler_entry.SourceRootEvalDriver\",".to_string()), "\n".to_string()), "        \"head\": head,".to_string()), "\n".to_string()), "        \"mode\": \"adjudicate\",".to_string()), "\n".to_string()), "        \"verdict\": verdict,".to_string()), "\n".to_string()), "        \"tolerance_nanos\": tolerance_nanos,".to_string()), "\n".to_string()), "        \"parent_span_nanos\": parent_span_nanos,".to_string()), "\n".to_string()), "        \"parent_wall_nanos\": parent_wall_nanos,".to_string()), "\n".to_string()), "        \"exclusive\": exclusive.rows.iter().map(|r| (".to_string()), "\n".to_string()), "            native_driver_exclusive_row_name(r.key.clone()),".to_string()), "\n".to_string()), "            serde_json::json!(r.nanos),".to_string()), "\n".to_string()), "        )).collect::<serde_json::Map<String, serde_json::Value>>(),".to_string()), "\n".to_string()), "        \"sum_exclusive_nanos\": exclusive_sum,".to_string()), "\n".to_string()), "        \"remainder_nanos\": remainder_nanos,".to_string()), "\n".to_string()), "        \"corpus_reads\": corpus_reads,".to_string()), "\n".to_string()), "        \"closure_reads\": closure_reads,".to_string()), "\n".to_string()), "        \"scanned_paths\": ingest_receipt.scanned_paths.len(),".to_string()), "\n".to_string()), "        \"ingested_paths\": ingest_receipt.ingested_paths.len(),".to_string()), "\n".to_string()), "        \"closure_modules\": closure.len(),".to_string()), "\n".to_string()), "        \"identities\": identities,".to_string()), "\n".to_string()), "        \"unique_modules\": universe.modules.len(),".to_string()), "\n".to_string()), "        \"file_refusals\": receipt.file_refusals.len(),".to_string()), "\n".to_string()), "        \"prepare_ok\": prepare_ok,".to_string()), "\n".to_string()), "        \"prepare_refused\": prepare_refused,".to_string()), "\n".to_string()), "        \"prepare_mean_nanos\": prepare_mean,".to_string()), "\n".to_string()), "        \"prepare_p50_nanos\": native_cost_quantile_nanos(&prepare_samples, 1, 2),".to_string()), "\n".to_string()), "        \"prepare_p95_nanos\": native_cost_quantile_nanos(&prepare_samples, 19, 20),".to_string()), "\n".to_string()), "        \"prepare_max_nanos\": prepare_samples.last().copied().unwrap_or(0),".to_string()), "\n".to_string()), "        \"eval_mean_nanos\": eval_mean,".to_string()), "\n".to_string()), "        \"eval_p50_nanos\": native_cost_quantile_nanos(&eval_samples, 1, 2),".to_string()), "\n".to_string()), "        \"eval_p95_nanos\": native_cost_quantile_nanos(&eval_samples, 19, 20),".to_string()), "\n".to_string()), "        \"eval_max_nanos\": eval_samples.last().copied().unwrap_or(0),".to_string()), "\n".to_string()), "        \"peak_rss_bytes\": proc_status_kib(\"VmHWM\").map(|kib| kib * 1024),".to_string()), "\n".to_string()), "        \"rss_bytes\": proc_status_kib(\"VmRSS\").map(|kib| kib * 1024),".to_string()), "\n".to_string()), "    }));".to_string()), "\n".to_string()), "    match accounting.as_ref() {".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostReconciled { .. } => {}".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostOverAttributed { sum_exclusive, parent_span } => {".to_string()), "\n".to_string()), "            eprintln!(".to_string()), "\n".to_string()), "                \"REFUSED: native driver cost OverAttributed {{ sum_exclusive_nanos: {}, parent_span_nanos: {} }}\",".to_string()), "\n".to_string()), "                nanosecond_count(sum_exclusive.clone()) as u128,".to_string()), "\n".to_string()), "                nanosecond_count(parent_span.clone()) as u128".to_string()), "\n".to_string()), "            );".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        NativeDriverCostAccounting::NativeDriverCostRemainderExceedsTolerance { residual, tolerance } => {".to_string()), "\n".to_string()), "            eprintln!(".to_string()), "\n".to_string()), "                \"REFUSED: native driver cost RemainderExceedsTolerance {{ residual_nanos: {}, tolerance_nanos: {} }} -- unattributed driver work; name the span, do not widen the tolerance\",".to_string()), "\n".to_string()), "                nanosecond_count(residual.clone()) as u128,".to_string()), "\n".to_string()), "                nanosecond_count(tolerance.clone()) as u128".to_string()), "\n".to_string()), "            );".to_string()), "\n".to_string()), "            std::process::exit(1);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    println!(".to_string()), "\n".to_string()), "        \"{}\",".to_string()), "\n".to_string()), "        serde_json::json!({".to_string()), "\n".to_string()), "            \"_terminal\": \"complete\",".to_string()), "\n".to_string()), "            \"mode\": \"adjudicate\",".to_string()), "\n".to_string()), "            \"rows\": population.len(),".to_string()), "\n".to_string()), "            \"universe\": universe.identities.len(),".to_string()), "\n".to_string()), "            \"file_refusals\": receipt.file_refusals.len(),".to_string()), "\n".to_string()), "            \"file_refusal_tally\": file_refusal_tally,".to_string()), "\n".to_string()), "            \"advised_files\": context.accepted_file_advisories.len(),".to_string()), "\n".to_string()), "            \"admitted\": admitted,".to_string()), "\n".to_string()), "            \"summary\": summary,".to_string()), "\n".to_string()), "            \"frontier\": frontier_word,".to_string()), "\n".to_string()), "        })".to_string()), "\n".to_string()), "    );".to_string()), "\n".to_string()), "    if admitted {".to_string()), "\n".to_string()), "        std::process::exit(0);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    std::process::exit(1);".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "".to_string()), "\n".to_string()), "fn main() {".to_string()), "\n".to_string()), "    let argv: Vec<String> = std::env::args().skip(1).collect();".to_string()), "\n".to_string()), "    let plan = native_driver_parse(Rc::new(argv.into()));".to_string()), "\n".to_string()), "    if let ProcessExit::ExitFailure { code, reason } = &*native_driver_plan_exit(plan.clone()) {".to_string()), "\n".to_string()), "        eprintln!(\"{reason}\");".to_string()), "\n".to_string()), "        std::process::exit(*code as i32);".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "    let source_roots: Vec<String> = native_driver_plan_source_roots(plan.clone()).iter().cloned().collect();".to_string()), "\n".to_string()), "    match &*plan {".to_string()), "\n".to_string()), "        NativeDriverPlan::NativeDriverPlanRefused { reason, detail } => {".to_string()), "\n".to_string()), "            eprintln!(\"REFUSED: native driver plan refused ({reason:?}) but its exit was success -- {detail}\");".to_string()), "\n".to_string()), "            std::process::exit(70);".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "        NativeDriverPlan::NativeDriverPlanned { verb } => {".to_string()), "\n".to_string()), "            let verb: &NativeDriverVerb = verb;".to_string()), "\n".to_string()), "            match verb {".to_string()), "\n".to_string()), "                NativeDriverVerb::NativeDriverCensus { .. } => run_census(&source_roots),".to_string()), "\n".to_string()), "                NativeDriverVerb::NativeDriverCensusResolve { .. } => run_census_resolve(&source_roots),".to_string()), "\n".to_string()), "                NativeDriverVerb::NativeDriverCensusInfer { .. } => run_census_infer(&source_roots),".to_string()), "\n".to_string()), "                NativeDriverVerb::NativeDriverDemandCensus { .. } => run_demand_census(&source_roots),".to_string()), "\n".to_string()), "                NativeDriverVerb::NativeDriverAdjudicate { facts_path, pattern, .. } => run_adjudication(facts_path, Rc::new(TargetPattern::clone(pattern)), &source_roots),".to_string()), "\n".to_string()), "            }".to_string()), "\n".to_string()), "        }".to_string()), "\n".to_string()), "    }".to_string()), "\n".to_string()), "}".to_string()), "\n".to_string()), "\n".to_string()),
 })
     }
 }
@@ -42206,14 +43178,8 @@ pub fn emit_main_pipeline_fns(crate_name: String, pipeline_module: String) -> St
             crate::gunbc_rust_emitted_edge::module_to_filename("v1.compiler.artifact".to_string());
         v1_rt::concat(
             v1_rt::concat(
-                v1_rt::concat(
-                    v1_rt::concat(
-                        v1_rt::concat(emit_collect_dag_files_fn(), emit_extract_module_path_fn()),
-                        emit_extract_import_paths_fn(),
-                    ),
-                    emit_dep_pool_type_and_fns(),
-                ),
-                emit_resolve_transitively_fn(crate_name.clone(), pipeline_mod.clone()),
+                v1_rt::concat(emit_collect_dag_files_fn(), emit_extract_module_path_fn()),
+                emit_dep_pool_type_and_fns(),
             ),
             emit_compile_target_helpers(
                 crate_name.clone(),
@@ -42240,18 +43206,10 @@ pub fn emit_extract_module_path_fn() -> String {
     v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("/// Extract the `module x.y.z` declaration from a .dag file's first lines.\n".to_string(), "fn extract_module_path(content: &str) -> Option<String> {\n".to_string()), "    for line in content.lines() {\n".to_string()), "        let trimmed = line.trim();\n".to_string()), "        if trimmed.starts_with(\"module \") {\n".to_string()), "            return Some(trimmed[\"module \".len()..].trim().to_string());\n".to_string()), "        }\n".to_string()), "        if !trimmed.is_empty() && !trimmed.starts_with(\"//\") {\n".to_string()), "            break;\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "    None\n".to_string()), "}\n\n".to_string())
 }
 
-pub fn emit_extract_import_paths_fn() -> String {
-    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("/// Extract import module paths from a .dag file's import declarations.\n".to_string(), "fn extract_import_paths(content: &str) -> Vec<String> {\n".to_string()), "    let mut imports = Vec::new();\n".to_string()), "    for line in content.lines() {\n".to_string()), "        let trimmed = line.trim();\n".to_string()), "        if trimmed.starts_with(\"import \") {\n".to_string()), "            let rest = trimmed[\"import \".len()..].trim();\n".to_string()), "            let module_path = rest.split('{').next().unwrap_or(rest).trim();\n".to_string()), "            if !module_path.is_empty() {\n".to_string()), "                imports.push(module_path.to_string());\n".to_string()), "            }\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "    imports\n".to_string()), "}\n\n".to_string())
-}
-
 pub fn emit_dep_pool_type_and_fns() -> String {
     v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("#[derive(Clone, Copy, PartialEq, Eq)]\nenum DependencyPoolIndex {\n    Strict,\n    PrimaryPrecedence,\n}\n\n".to_string(), "fn parse_dependency_pool_index(value: &str) -> DependencyPoolIndex {\n".to_string()), "    match value {\n".to_string()), "        \"strict\" => DependencyPoolIndex::Strict,\n".to_string()), "        \"primary-precedence\" => DependencyPoolIndex::PrimaryPrecedence,\n".to_string()), "        other => {\n".to_string()), "            eprintln!(\"unknown --dependency-pool-index: {} (expected strict | primary-precedence)\", other);\n".to_string()), "            std::process::exit(1);\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "}\n\n".to_string()), "fn insert_module_path(\n".to_string()), "    index: &mut HashMap<String, std::path::PathBuf>,\n".to_string()), "    module_path: String,\n".to_string()), "    path: std::path::PathBuf,\n".to_string()), "    within_root: &mut HashMap<String, std::path::PathBuf>,\n".to_string()), ") {\n".to_string()), "    if let Some(existing) = within_root.get(&module_path) {\n".to_string()), "        panic!(\"duplicate module path '{}' within source root: declared in both {:?} and {:?}\", module_path, existing, path);\n".to_string()), "    }\n".to_string()), "    within_root.insert(module_path.clone(), path.clone());\n".to_string()), "    index.insert(module_path, path);\n".to_string()), "}\n\n".to_string()), "fn index_source_root(root: &str, index: &mut HashMap<String, std::path::PathBuf>, pool_fill_only: bool) {\n".to_string()), "    let root_path = std::path::Path::new(root);\n".to_string()), "    if !root_path.exists() {\n".to_string()), "        panic!(\"source root does not exist: {}\", root);\n".to_string()), "    }\n".to_string()), "    let mut dag_files = Vec::new();\n".to_string()), "    collect_dag_files(root_path, &mut dag_files);\n".to_string()), "    let mut within_root = HashMap::new();\n".to_string()), "    for path in dag_files {\n".to_string()), "        let content = std::fs::read_to_string(&path)\n".to_string()), "            .unwrap_or_else(|e| panic!(\"failed to read {:?}: {}\", path, e));\n".to_string()), "        if let Some(module_path) = extract_module_path(&content) {\n".to_string()), "            if pool_fill_only {\n".to_string()), "                if index.contains_key(&module_path) {\n".to_string()), "                    continue;\n".to_string()), "                }\n".to_string()), "                insert_module_path(index, module_path, path, &mut within_root);\n".to_string()), "            } else if let Some(existing) = index.get(&module_path) {\n".to_string()), "                panic!(\"duplicate module path '{}': declared in both {:?} and {:?}\", module_path, existing, path);\n".to_string()), "            } else {\n".to_string()), "                insert_module_path(index, module_path, path, &mut within_root);\n".to_string()), "            }\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "}\n\n".to_string()), "fn build_module_index(source_roots: &[String], pool_index: DependencyPoolIndex) -> HashMap<String, std::path::PathBuf> {\n".to_string()), "    let mut index = HashMap::new();\n".to_string()), "    if source_roots.is_empty() {\n".to_string()), "        return index;\n".to_string()), "    }\n".to_string()), "    match pool_index {\n".to_string()), "        DependencyPoolIndex::Strict => {\n".to_string()), "            for root in source_roots {\n".to_string()), "                index_source_root(root, &mut index, false);\n".to_string()), "            }\n".to_string()), "        }\n".to_string()), "        DependencyPoolIndex::PrimaryPrecedence => {\n".to_string()), "            index_source_root(&source_roots[0], &mut index, false);\n".to_string()), "            for root in &source_roots[1..] {\n".to_string()), "                index_source_root(root, &mut index, true);\n".to_string()), "            }\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "    index\n".to_string()), "}\n\n".to_string())
 }
 
-pub fn emit_resolve_transitively_fn(crate_name: String, pipeline_mod: String) -> String {
-    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("/// Resolve imports transitively from entry modules.\n".to_string(), "/// Fail-closed: panics on unreadable imported files.\n".to_string()), "/// Returns sources sorted by path for deterministic fixed-point convergence.\n".to_string()), "fn resolve_transitively_with_seen(\n".to_string()), "    entry_sources: Vec<(String, String)>,\n".to_string()), "    index: &HashMap<String, std::path::PathBuf>,\n".to_string()), "    mut seen: HashMap<String, Rc<".to_string()), crate_name.clone()), "::".to_string()), pipeline_mod.clone()), "::SourceFile>>,\n".to_string()), ") -> Vec<Rc<".to_string()), crate_name.clone()), "::".to_string()), pipeline_mod.clone()), "::SourceFile>> {\n".to_string()), "    let mut queue: Vec<(String, String)> = entry_sources;\n".to_string()), "\n".to_string()), "    while let Some((_path, content)) = queue.pop() {\n".to_string()), "        let imports = extract_import_paths(&content);\n".to_string()), "        for module_path in imports {\n".to_string()), "            if seen.contains_key(&module_path) {\n".to_string()), "                continue;\n".to_string()), "            }\n".to_string()), "            if let Some(file_path) = index.get(&module_path) {\n".to_string()), "                let file_content = std::fs::read_to_string(file_path)\n".to_string()), "                    .unwrap_or_else(|e| panic!(\"failed to read imported module '{}' at {:?}: {}\",\n".to_string()), "                        module_path, file_path, e));\n".to_string()), "                let rel_path = file_path.to_string_lossy().to_string();\n".to_string()), "                let source = Rc::new(".to_string()), crate_name.clone()), "::".to_string()), pipeline_mod.clone()), "::SourceFile {\n".to_string()), "                    path: rel_path.clone(),\n".to_string()), "                    content: file_content.clone(),\n".to_string()), "                });\n".to_string()), "                seen.insert(module_path, source);\n".to_string()), "                queue.push((rel_path, file_content));\n".to_string()), "            }\n".to_string()), "            // If not found in index, the compiler's resolve stage will report the error.\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "\n".to_string()), "    let mut result: Vec<_> = seen.into_iter().map(|(_, v)| v).collect();\n".to_string()), "    result.sort_by(|a, b| a.path.cmp(&b.path));\n".to_string()), "    result\n".to_string()), "}\n\n".to_string())
-}
-
 pub fn emit_main_diagnostic_fns(crate_name: String) -> String {
     {
         let core_mod =
diff --git a/src/v1/stage0/src/v1_compiler_emitted_workspace.rs b/src/v1/stage0/src/v1_compiler_emitted_workspace.rs
new file mode 100644
index 00000000000..baf2f6e107f
--- /dev/null
+++ b/src/v1/stage0/src/v1_compiler_emitted_workspace.rs
@@ -0,0 +1,527 @@
+// Generated by v1 compiler -- do not edit.
+// Source module: v1.compiler.emitted_workspace
+
+use self::EmittedFilePlacement::*;
+use self::EmittedWorkspaceRealization::*;
+use self::EmittedWorkspaceRealizationRefusal::*;
+use self::EmittedWorkspaceRedRealization::*;
+pub use crate::extdeps_cargo::CargoDependency;
+use crate::gunbc_emitted_crate_workspace::EmittedWorkspaceBuildOutcome::{
+    EmittedWorkspaceBuildPlanned, EmittedWorkspaceBuildRefused,
+};
+use crate::gunbc_emitted_crate_workspace::EmittedWorkspaceRedOutcome::{
+    EmittedWorkspaceRedPlanned, EmittedWorkspaceRedRefused,
+};
+use crate::gunbc_emitted_crate_workspace::EmittedWorkspaceRefusal::*;
+pub use crate::gunbc_emitted_crate_workspace::{
+    emitted_workspace_build, emitted_workspace_red_over, emitted_workspace_refusal_message,
+    emitted_workspace_root_crate_dir,
+};
+pub use crate::gunbc_emitted_crate_workspace::{
+    EmittedWorkspaceBuild, EmittedWorkspaceBuildOutcome, EmittedWorkspaceRedDrop,
+    EmittedWorkspaceRedOutcome, EmittedWorkspaceRefusal,
+};
+pub use crate::gunbc_rust_emitted_crate::EmittedRustCrate;
+pub use crate::gunbc_rust_emitted_edge::EmittedEdge;
+pub use crate::gunbc_stage0_crate_partition_generated::GeneratedPartitionCrateRow;
+pub use crate::std_optional::Optional;
+pub use crate::std_types::{Bool, List};
+pub use crate::v1_compiler_emit_rust::{
+    emit_emitted_population_manifest, emitted_population_manifest_path,
+    rust_emitted_module_basename, rust_source_ext, rust_source_root, string_without_suffix,
+};
+pub use crate::v1_compiler_stage0_crates::Stage0CrateBoundaryEmitOutcome;
+use crate::v1_compiler_stage0_crates::Stage0CrateBoundaryEmitOutcome::{
+    Stage0CrateBoundaryEmitOk, Stage0CrateBoundaryEmitRefused,
+};
+pub use crate::v1_compiler_stage0_crates::{
+    emitted_crate_dependencies, partition_crate_boundary_emit_outcome_over,
+    stage0_crate_boundary_emit_refusal_message,
+};
+use crate::v1_rt;
+use crate::v1_rt::{VecCompat, VecJoin};
+pub use crate::v1_std_core::TextFile;
+use crate::NonEmptyBTreeSet;
+use crate::NonEmptyVec;
+use im::{vector as vec, HashMap, OrdSet as BTreeSet, Vector as Vec};
+use std::rc::Rc;
+
+pub fn emitted_workspace_module_dir() -> String {
+    thread_local! {
+        static CACHED: String = {
+            "src/v1/stage0/src".to_string()
+        };
+    }
+    CACHED.with(|c: &String| c.clone())
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum EmittedWorkspaceRealizationRefusal {
+    EmittedWorkspaceCrateNotUnique { count: i64 },
+    EmittedWorkspaceEntryAbsent,
+    EmittedWorkspaceFileUnplaced { path: String },
+    EmittedWorkspacePlanRefused { cause: Rc<EmittedWorkspaceRefusal> },
+    EmittedWorkspaceRenderRefused { message: String },
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct EmittedWorkspaceRealized {
+    pub files: Rc<Vec<Rc<TextFile>>>,
+    pub build: Rc<EmittedWorkspaceBuild>,
+    pub module_dir: String,
+    pub registry_dependencies: Rc<Vec<Rc<CargoDependency>>>,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum EmittedWorkspaceRealization {
+    EmittedWorkspaceRealizedOk {
+        workspace: Rc<EmittedWorkspaceRealized>,
+    },
+    EmittedWorkspaceRealizationRefused {
+        cause: Rc<EmittedWorkspaceRealizationRefusal>,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum EmittedFilePlacement {
+    PlacedModule {
+        basename: String,
+        file: Rc<TextFile>,
+    },
+    PlacedEntry {
+        content: String,
+    },
+    PlacedTest {
+        file: Rc<TextFile>,
+    },
+    PlacedSuperseded,
+    PlacedNowhere {
+        path: String,
+    },
+}
+
+pub fn emitted_workspace_entry_path() -> String {
+    v1_rt::concat(
+        v1_rt::concat(
+            crate::v1_compiler_emit_rust::rust_source_root(),
+            "main".to_string(),
+        ),
+        crate::v1_compiler_emit_rust::rust_source_ext(),
+    )
+}
+
+pub fn emitted_workspace_crate_root_path() -> String {
+    v1_rt::concat(
+        v1_rt::concat(
+            crate::v1_compiler_emit_rust::rust_source_root(),
+            "lib".to_string(),
+        ),
+        crate::v1_compiler_emit_rust::rust_source_ext(),
+    )
+}
+
+pub fn emitted_file_placement(file: Rc<TextFile>) -> Rc<EmittedFilePlacement> {
+    {
+        let path = file.path.clone();
+        if (path.clone() == emitted_workspace_entry_path()) {
+            Rc::new(EmittedFilePlacement::PlacedEntry {
+                content: file.content.clone(),
+            })
+        } else {
+            if ((path.clone() == emitted_workspace_crate_root_path())
+                || (path.clone()
+                    == crate::v1_compiler_emit_rust::emitted_population_manifest_path()))
+            {
+                Rc::new(EmittedFilePlacement::PlacedSuperseded)
+            } else {
+                if (v1_rt::starts_with(path.clone(), "tests/".to_string())
+                    && (crate::v1_compiler_emit_rust::string_without_suffix(
+                        path.clone(),
+                        crate::v1_compiler_emit_rust::rust_source_ext(),
+                    ) != std::option::Option::None))
+                {
+                    Rc::new(EmittedFilePlacement::PlacedTest { file: file.clone() })
+                } else {
+                    if ((v1_rt::starts_with(
+                        path.clone(),
+                        crate::v1_compiler_emit_rust::rust_source_root(),
+                    ) && (crate::v1_compiler_emit_rust::string_without_suffix(
+                        path.clone(),
+                        crate::v1_compiler_emit_rust::rust_source_ext(),
+                    ) != std::option::Option::None))
+                        && !v1_rt::string_contains(
+                            &crate::v1_compiler_emit_rust::rust_emitted_module_basename(
+                                path.clone(),
+                            ),
+                            "/".to_string(),
+                        ))
+                    {
+                        {
+                            let basename =
+                                crate::v1_compiler_emit_rust::rust_emitted_module_basename(
+                                    path.clone(),
+                                );
+                            Rc::new(EmittedFilePlacement::PlacedModule {
+                                basename: basename.clone(),
+                                file: Rc::new(TextFile {
+                                    path: v1_rt::concat(
+                                        v1_rt::concat(
+                                            v1_rt::concat(
+                                                emitted_workspace_module_dir(),
+                                                "/".to_string(),
+                                            ),
+                                            basename.clone(),
+                                        ),
+                                        crate::v1_compiler_emit_rust::rust_source_ext(),
+                                    ),
+                                    content: file.content.clone(),
+                                }),
+                            })
+                        }
+                    } else {
+                        Rc::new(EmittedFilePlacement::PlacedNowhere { path: path.clone() })
+                    }
+                }
+            }
+        }
+    }
+}
+
+pub fn emitted_workspace_relative_path(path: String) -> String {
+    if v1_rt::starts_with(path.clone(), "./".to_string()) {
+        v1_rt::replace(path.clone(), "./".to_string(), "".to_string())
+    } else {
+        path.clone()
+    }
+}
+
+pub fn emitted_workspace_section(rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>) -> String {
+    {
+        let members = Rc::new({
+            let mut __result = Vec::new();
+            for r in Rc::new({
+                let mut __result = Vec::new();
+                for r in rows.iter().cloned() {
+                    if (r.crate_dir.clone() != emitted_workspace_root_crate_dir()) {
+                        __result.push(r);
+                    }
+                }
+                __result
+            })
+            .iter()
+            .cloned()
+            {
+                __result.push(v1_rt::concat(
+                    v1_rt::concat("    \"".to_string(), r.crate_dir.clone()),
+                    "\",".to_string(),
+                ));
+            }
+            __result
+        })
+        .join(&"\n".to_string());
+        v1_rt::concat(
+            v1_rt::concat(
+                "\n[workspace]\nresolver = \"2\"\nmembers = [\n".to_string(),
+                members.clone(),
+            ),
+            "\n]\n".to_string(),
+        )
+    }
+}
+
+pub fn emitted_workspace_with_section(
+    files: Rc<Vec<Rc<TextFile>>>,
+    rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+) -> Rc<Vec<Rc<TextFile>>> {
+    Rc::new({
+        let mut __result = Vec::new();
+        for f in files.iter().cloned() {
+            __result.push(if (f.path.clone() == "Cargo.toml".to_string()) {
+                Rc::new(TextFile {
+                    path: f.path.clone(),
+                    content: v1_rt::concat(
+                        f.content.clone(),
+                        emitted_workspace_section(rows.clone()),
+                    ),
+                })
+            } else {
+                f.clone()
+            });
+        }
+        __result
+    })
+}
+
+pub fn emitted_workspace_realization(
+    files: Rc<Vec<Rc<TextFile>>>,
+    edges: Rc<Vec<Rc<EmittedEdge>>>,
+    rust_crates: Rc<Vec<Rc<EmittedRustCrate>>>,
+    bin_name: String,
+) -> Rc<EmittedWorkspaceRealization> {
+    match rust_crates.clone().first().cloned() {
+        std::option::Option::None => Rc::new(
+            EmittedWorkspaceRealization::EmittedWorkspaceRealizationRefused {
+                cause: Rc::new(
+                    EmittedWorkspaceRealizationRefusal::EmittedWorkspaceCrateNotUnique { count: 0 },
+                ),
+            },
+        ),
+        Some(rust_crate) => {
+            if ((rust_crates.clone().len() as i64) != 1) {
+                Rc::new(
+                    EmittedWorkspaceRealization::EmittedWorkspaceRealizationRefused {
+                        cause: Rc::new(
+                            EmittedWorkspaceRealizationRefusal::EmittedWorkspaceCrateNotUnique {
+                                count: (rust_crates.clone().len() as i64),
+                            },
+                        ),
+                    },
+                )
+            } else {
+                emitted_workspace_realization_of(
+                    files.clone(),
+                    edges.clone(),
+                    rust_crate.clone(),
+                    bin_name.clone(),
+                )
+            }
+        }
+    }
+}
+
+pub fn emitted_workspace_realization_of(
+    files: Rc<Vec<Rc<TextFile>>>,
+    edges: Rc<Vec<Rc<EmittedEdge>>>,
+    rust_crate: Rc<EmittedRustCrate>,
+    bin_name: String,
+) -> Rc<EmittedWorkspaceRealization> {
+    {
+        let placements = Rc::new({
+            let mut __result = Vec::new();
+            for f in files.iter().cloned() {
+                __result.push(emitted_file_placement(f.clone()));
+            }
+            __result
+        });
+        let unplaced = Rc::new({
+            let mut __result = Vec::new();
+            for p in placements.iter().cloned() {
+                __result.extend(
+                    (*match (*p.clone()).clone() {
+                        EmittedFilePlacement::PlacedNowhere { path: path, .. } => {
+                            Rc::new(vec![path.clone()])
+                        }
+                        _ => Rc::new(vec![]),
+                    })
+                    .iter()
+                    .cloned(),
+                );
+            }
+            __result
+        });
+        let entries = Rc::new({
+            let mut __result = Vec::new();
+            for p in placements.iter().cloned() {
+                __result.extend(
+                    (*match (*p.clone()).clone() {
+                        EmittedFilePlacement::PlacedEntry { content: c, .. } => {
+                            Rc::new(vec![c.clone()])
+                        }
+                        _ => Rc::new(vec![]),
+                    })
+                    .iter()
+                    .cloned(),
+                );
+            }
+            __result
+        });
+        let modules = Rc::new({
+            let mut __result = Vec::new();
+            for p in placements.iter().cloned() {
+                __result.extend(
+                    (*match (*p.clone()).clone() {
+                        EmittedFilePlacement::PlacedModule { file: f, .. } => {
+                            Rc::new(vec![f.clone()])
+                        }
+                        _ => Rc::new(vec![]),
+                    })
+                    .iter()
+                    .cloned(),
+                );
+            }
+            __result
+        });
+        let basenames = Rc::new({
+            let mut __result = Vec::new();
+            for p in placements.iter().cloned() {
+                __result.extend(
+                    (*match (*p.clone()).clone() {
+                        EmittedFilePlacement::PlacedModule { basename: b, .. } => {
+                            Rc::new(vec![b.clone()])
+                        }
+                        _ => Rc::new(vec![]),
+                    })
+                    .iter()
+                    .cloned(),
+                );
+            }
+            __result
+        });
+        let tests = Rc::new({
+            let mut __result = Vec::new();
+            for p in placements.iter().cloned() {
+                __result.extend(
+                    (*match (*p.clone()).clone() {
+                        EmittedFilePlacement::PlacedTest { file: f, .. } => {
+                            Rc::new(vec![f.clone()])
+                        }
+                        _ => Rc::new(vec![]),
+                    })
+                    .iter()
+                    .cloned(),
+                );
+            }
+            __result
+        });
+        match unplaced.clone().first().cloned() {
+    Some(path) => Rc::new(EmittedWorkspaceRealization::EmittedWorkspaceRealizationRefused {
+    cause: Rc::new(EmittedWorkspaceRealizationRefusal::EmittedWorkspaceFileUnplaced {
+    path: path.clone(),
+}),
+}),
+    std::option::Option::None => match entries.clone().first().cloned() {
+    std::option::Option::None => Rc::new(EmittedWorkspaceRealization::EmittedWorkspaceRealizationRefused {
+    cause: Rc::new(EmittedWorkspaceRealizationRefusal::EmittedWorkspaceEntryAbsent),
+}),
+    Some(entry) => match (*crate::gunbc_emitted_crate_workspace::emitted_workspace_build(basenames.clone(), edges.clone(), rust_crate.crate_name.clone(), bin_name.clone())).clone() {
+    EmittedWorkspaceBuildOutcome::EmittedWorkspaceBuildRefused { cause: c, .. } => Rc::new(EmittedWorkspaceRealization::EmittedWorkspaceRealizationRefused {
+    cause: Rc::new(EmittedWorkspaceRealizationRefusal::EmittedWorkspacePlanRefused {
+    cause: c.clone(),
+}),
+}),
+    EmittedWorkspaceBuildOutcome::EmittedWorkspaceBuildPlanned { build: build, .. } => {
+            let registry_dependencies = crate::v1_compiler_stage0_crates::emitted_crate_dependencies(rust_crate.demand.clone());
+match (*crate::v1_compiler_stage0_crates::partition_crate_boundary_emit_outcome_over(build.rows.clone(), registry_dependencies.clone())).clone() {
+    Stage0CrateBoundaryEmitOutcome::Stage0CrateBoundaryEmitRefused { cause: cause, .. } => Rc::new(EmittedWorkspaceRealization::EmittedWorkspaceRealizationRefused {
+    cause: Rc::new(EmittedWorkspaceRealizationRefusal::EmittedWorkspaceRenderRefused {
+    message: crate::v1_compiler_stage0_crates::stage0_crate_boundary_emit_refusal_message(cause.clone()),
+}),
+}),
+    Stage0CrateBoundaryEmitOutcome::Stage0CrateBoundaryEmitOk { files: rendered, .. } => {
+                let crate_files = emitted_workspace_with_section(Rc::new({ let mut __result = Vec::new(); for f in rendered.iter().cloned() { __result.push(Rc::new(TextFile {
+    path: emitted_workspace_relative_path(f.path.clone()),
+    content: f.content.clone(),
+})); } __result }), build.rows.clone());
+let realized = v1_rt::concat(v1_rt::concat(v1_rt::concat(crate_files.clone(), modules.clone()), Rc::new(vec![Rc::new(TextFile {
+    path: build.bin_source_path.clone(),
+    content: entry.clone(),
+})])), tests.clone());
+Rc::new(EmittedWorkspaceRealization::EmittedWorkspaceRealizedOk {
+    workspace: Rc::new(EmittedWorkspaceRealized {
+    files: v1_rt::concat(realized.clone(), Rc::new(vec![crate::v1_compiler_emit_rust::emit_emitted_population_manifest(Rc::new({ let mut __result = Vec::new(); for f in realized.iter().cloned() { __result.push(f.path.clone()); } __result }))])),
+    build: build.clone(),
+    module_dir: emitted_workspace_module_dir(),
+    registry_dependencies: registry_dependencies.clone(),
+}),
+})
+},
+}
+},
+},
+},
+}
+    }
+}
+
+pub fn emitted_workspace_realization_refusal_message(
+    cause: Rc<EmittedWorkspaceRealizationRefusal>,
+) -> String {
+    match (*cause.clone()).clone() {
+        EmittedWorkspaceRealizationRefusal::EmittedWorkspaceCrateNotUnique { count: n, .. } => {
+            v1_rt::concat(
+                v1_rt::concat(
+                    "EmittedCrateNotUnique: the emission names ".to_string(),
+                    (n.clone()).to_string(),
+                ),
+                " Rust crates, not one".to_string(),
+            )
+        }
+        EmittedWorkspaceRealizationRefusal::EmittedWorkspaceEntryAbsent => {
+            "EntryFileAbsent: the emission wrote no src/main.rs for the binary".to_string()
+        }
+        EmittedWorkspaceRealizationRefusal::EmittedWorkspaceFileUnplaced { path: path, .. } => {
+            v1_rt::concat(
+                "EmittedFileUnplaced: the workspace has no place for emitted file ".to_string(),
+                path.clone(),
+            )
+        }
+        EmittedWorkspaceRealizationRefusal::EmittedWorkspacePlanRefused { cause: c, .. } => {
+            v1_rt::concat(
+                "PlanRefused: ".to_string(),
+                crate::gunbc_emitted_crate_workspace::emitted_workspace_refusal_message(c.clone()),
+            )
+        }
+        EmittedWorkspaceRealizationRefusal::EmittedWorkspaceRenderRefused {
+            message: m, ..
+        } => v1_rt::concat("RenderRefused: ".to_string(), m.clone()),
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum EmittedWorkspaceRedRealization {
+    EmittedWorkspaceRedRealized {
+        red: Rc<EmittedWorkspaceRedDrop>,
+        files: Rc<Vec<Rc<TextFile>>>,
+    },
+    EmittedWorkspaceRedRealizationRefused {
+        message: String,
+    },
+}
+
+pub fn emitted_workspace_red_realization(
+    workspace: Rc<EmittedWorkspaceRealized>,
+) -> Rc<EmittedWorkspaceRedRealization> {
+    match (*crate::gunbc_emitted_crate_workspace::emitted_workspace_red_over(
+        workspace.build.clone().layout.clone(),
+    ))
+    .clone()
+    {
+        EmittedWorkspaceRedOutcome::EmittedWorkspaceRedRefused { cause: c, .. } => Rc::new(
+            EmittedWorkspaceRedRealization::EmittedWorkspaceRedRealizationRefused {
+                message: crate::gunbc_emitted_crate_workspace::emitted_workspace_refusal_message(
+                    c.clone(),
+                ),
+            },
+        ),
+        EmittedWorkspaceRedOutcome::EmittedWorkspaceRedPlanned { red, red_rows, .. } => {
+            let rows = v1_rt::concat(
+                red_rows.clone(),
+                Rc::new({
+                    let mut __result = Vec::new();
+                    for r in workspace.build.clone().rows.clone().iter().cloned() {
+                        if (r.crate_dir.clone() == emitted_workspace_root_crate_dir()) {
+                            __result.push(r);
+                        }
+                    }
+                    __result
+                }),
+            );
+            match (*crate::v1_compiler_stage0_crates::partition_crate_boundary_emit_outcome_over(rows.clone(), workspace.registry_dependencies.clone())).clone() {
+    Stage0CrateBoundaryEmitOutcome::Stage0CrateBoundaryEmitRefused { cause: cause, .. } => Rc::new(EmittedWorkspaceRedRealization::EmittedWorkspaceRedRealizationRefused {
+    message: crate::v1_compiler_stage0_crates::stage0_crate_boundary_emit_refusal_message(cause.clone()),
+}),
+    Stage0CrateBoundaryEmitOutcome::Stage0CrateBoundaryEmitOk { files: rendered, .. } => Rc::new(EmittedWorkspaceRedRealization::EmittedWorkspaceRedRealized {
+    red: red.clone(),
+    files: emitted_workspace_with_section(Rc::new({ let mut __result = Vec::new(); for f in rendered.iter().cloned() { __result.push(Rc::new(TextFile {
+    path: emitted_workspace_relative_path(f.path.clone()),
+    content: f.content.clone(),
+})); } __result }), rows.clone()),
+}),
+}
+        }
+    }
+}
diff --git a/src/v1/stage0/src/v1_compiler_infer.rs b/src/v1/stage0/src/v1_compiler_infer.rs
index 1b84f5114e5..5d272177451 100644
--- a/src/v1/stage0/src/v1_compiler_infer.rs
+++ b/src/v1/stage0/src/v1_compiler_infer.rs
@@ -121,13 +121,21 @@ pub use crate::v1_compiler_infer_cycle::detect_type_cycles_kahn;
 pub use crate::v1_compiler_infer_emit_info::DataVariantWireSpelling;
 use crate::v1_compiler_infer_emit_info::DataVariantWireSpelling::*;
 use crate::v1_compiler_infer_emit_info::TypeRepr::{EnumRepr, StructRepr};
+use crate::v1_compiler_infer_emit_info::TypeSummaryLookup::{
+    TypeSummaryFound, TypeSummaryLeafAmbiguous, TypeSummaryNotDeclared,
+};
+use crate::v1_compiler_infer_emit_info::TypeSummaryQuestion::{
+    QuestionDecided, QuestionNameAmbiguous, QuestionNotDeclared,
+};
 pub use crate::v1_compiler_infer_emit_info::{
     add_emit_item_summary, build_enum_field_summaries, build_struct_field_summaries,
     close_fn_fields, derive_variant_to_enum, empty_emit_graph_info, empty_type_decl_index,
-    empty_type_env, lookup_emit_type_summary, type_decl_index_with_qualified_names,
+    empty_type_env, empty_type_summary_index, is_enum_in_summaries, lookup_emit_type_summary,
+    type_decl_index_with_qualified_names, type_summary_lookup,
 };
 pub use crate::v1_compiler_infer_emit_info::{
-    EmitGraphInfo, EmitInfoBuildState, TypeRepr, TypeSummary,
+    EmitGraphInfo, EmitInfoBuildState, TypeRepr, TypeSummary, TypeSummaryIndex, TypeSummaryLookup,
+    TypeSummaryQuestion,
 };
 use crate::v1_compiler_infer_env::GlobalBareLookupState::{
     GlobalBareAmbiguousBinding, GlobalBareUniqueBinding,
@@ -143,11 +151,11 @@ pub use crate::v1_compiler_infer_env::{
     is_recursive_type_by_name, listed_import_required_bare_call_blocked, lookup_binding_by_name,
     lookup_binding_on_chain, lookup_type, lookup_type_by_name, lookup_type_for,
     merge_inductive_fields, merge_type_env_cache, merge_type_env_cache_guarded, node_with_children,
-    node_with_inferred, put_inductive_field, put_inductive_field_cross, qualified_all_but_last,
-    qualify_borrowed_inferred, qualify_borrowed_type_names, qualify_decl_reference_positions,
-    str_bindings_from_bindings, symbol_index_insert, symbol_index_insert_decl,
-    symbol_index_insert_service, symbol_index_lookup, text_crossing_by_identity,
-    text_representation_by_identity, text_representation_is_text_arm,
+    node_with_inferred, overlay_skips_kernel_name, put_inductive_field, put_inductive_field_cross,
+    qualified_all_but_last, qualify_borrowed_inferred, qualify_borrowed_type_names,
+    qualify_decl_reference_positions, str_bindings_from_bindings, symbol_index_insert,
+    symbol_index_insert_decl, symbol_index_insert_service, symbol_index_lookup,
+    text_crossing_by_identity, text_representation_by_identity, text_representation_is_text_arm,
     text_representation_is_unidentified, text_representations_cross, type_reference_declaration,
     type_reference_declaration_ref, unit_variant_index_shadow_insert,
 };
@@ -481,13 +489,7 @@ pub fn infer_block_stmts(
                 let next_scope =
                     scope_after_stmt_node(stmt.clone(), stmt_rt.clone(), scope.clone());
                 {
-                    let __tco_0 = Rc::new(
-                        remaining
-                            .iter()
-                            .cloned()
-                            .skip(1 as usize)
-                            .collect::<Vec<_>>(),
-                    );
+                    let __tco_0 = Rc::new(v1_rt::list_skip(&remaining, 1));
                     let __tco_1 = v1_rt::int_sub(remaining_count, 1);
                     let __tco_2 = next_scope.clone();
                     let __tco_3 = v1_rt::rc_list_push(typed_stmts, stmt_typed.clone());
@@ -638,13 +640,7 @@ Rc::new(InferScopeComponents {
             }
         });
                         {
-                            let __tco_0 = Rc::new(
-                                remaining
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            );
+                            let __tco_0 = Rc::new(v1_rt::list_skip(&remaining, 1));
                             let __tco_1 = parent_index;
                             let __tco_2 = env;
                             let __tco_3 = parent_result.svc_registry.clone();
@@ -658,13 +654,7 @@ Rc::new(InferScopeComponents {
                         }
                     }
                     std::option::Option::None => {
-                        let __tco_0 = Rc::new(
-                            remaining
-                                .iter()
-                                .cloned()
-                                .skip(1 as usize)
-                                .collect::<Vec<_>>(),
-                        );
+                        let __tco_0 = Rc::new(v1_rt::list_skip(&remaining, 1));
                         let __tco_1 = parent_index;
                         let __tco_2 = env;
                         let __tco_3 = svc_registry;
@@ -737,10 +727,8 @@ pub fn classify_field_recursion(
                     let value_type = match type_expr
                         .children
                         .clone()
-                        .iter()
+                        .get((value_index.clone()) as usize)
                         .cloned()
-                        .skip(value_index.clone() as usize)
-                        .next()
                     {
                         Some(t) => {
                             crate::v1_std_core::authored_name_at(source_indices.clone(), t.clone())
@@ -2692,6 +2680,44 @@ pub fn record_lit_expanded_from_expected(
     }
 }
 
+pub fn variant_literal_expected_application(
+    owner: Rc<Node>,
+    expected: Option<Rc<Node>>,
+    scope: Rc<InferScope>,
+) -> Option<Rc<Node>> {
+    {
+        if (((owner.params.clone().len() as i64) == 0)
+            || (owner.connective.clone() != Connective::Disj))
+        {
+            return std::option::Option::None;
+        }
+        match expected.clone() {
+            Some(exp) => {
+                if ((exp.connective.clone() != Connective::NoConnective)
+                    || ((exp.children.clone().len() as i64) == 0))
+                {
+                    std::option::Option::None
+                } else {
+                    match crate::v1_compiler_infer_env::lookup_type_for(
+                        scope.type_env.clone(),
+                        exp.clone(),
+                    ) {
+                        Some(head) => {
+                            if v1_rt::rc_ptr_eq(head.clone(), owner.clone()) {
+                                Some(crate::v1_std_core::with_required_cardinality(exp.clone()))
+                            } else {
+                                std::option::Option::None
+                            }
+                        }
+                        std::option::Option::None => std::option::Option::None,
+                    }
+                }
+            }
+            std::option::Option::None => std::option::Option::None,
+        }
+    }
+}
+
 pub fn record_lit_expected_coproduct(
     expected: Option<Rc<Node>>,
     scope: Rc<InferScope>,
@@ -2891,7 +2917,7 @@ pub fn record_lit_instantiated_fields(
                                             Some(template_fields) => {
                                                 let subst = Rc::new(decl.params.clone().iter().cloned().enumerate().map(|(i, v)| (i as i64, v)).collect::<Vec<_>>()).iter().cloned().fold(v1_rt::rc_empty_map::<String, Rc<Node>>(), |acc: Rc<HashMap<String, Rc<Node>>>, pair: (i64, Rc<Node>)| {
                         let slot = crate::v1_std_core::authored_name_at(si.clone(), pair.1.clone());
-match exp.children.clone().iter().cloned().skip(pair.0.clone() as usize).next() {
+match exp.children.clone().get((pair.0.clone()) as usize).cloned() {
     Some(arg) => v1_rt::rc_map_insert(acc.clone(), slot.clone(), crate::v1_compiler_infer_types::child_type_node(arg.clone())),
     std::option::Option::None => acc.clone(),
 }
@@ -4414,16 +4440,9 @@ pub fn list_literal_optional_member_diags(
             let head_type = crate::v1_compiler_infer_types::resolved_type(head.clone());
             Rc::new({
                 let mut __result = Vec::new();
-                for te in Rc::new(
-                    typed_elements
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                )
-                .iter()
-                .cloned()
+                for te in Rc::new(v1_rt::list_skip(&typed_elements.clone(), 1))
+                    .iter()
+                    .cloned()
                 {
                     __result.extend(
                         (*optional_at_required_obligation_diags(
@@ -6926,20 +6945,8 @@ pub fn coproduct_applied_type_arguments_conflict_scan(
                         break true;
                     } else {
                         {
-                            let __tco_0 = Rc::new(
-                                declared_args
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            );
-                            let __tco_1 = Rc::new(
-                                produced_args
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            );
+                            let __tco_0 = Rc::new(v1_rt::list_skip(&declared_args, 1));
+                            let __tco_1 = Rc::new(v1_rt::list_skip(&produced_args, 1));
                             let __tco_2 = scope;
                             __tco_loop_declared_args = __tco_0;
                             __tco_loop_produced_args = __tco_1;
@@ -7079,20 +7086,8 @@ pub fn applied_type_arguments_conflict_scan(
                         break true;
                     } else {
                         {
-                            let __tco_0 = Rc::new(
-                                declared_args
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            );
-                            let __tco_1 = Rc::new(
-                                produced_args
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            );
+                            let __tco_0 = Rc::new(v1_rt::list_skip(&declared_args, 1));
+                            let __tco_1 = Rc::new(v1_rt::list_skip(&produced_args, 1));
                             let __tco_2 = scope;
                             __tco_loop_declared_args = __tco_0;
                             __tco_loop_produced_args = __tco_1;
@@ -7970,14 +7965,14 @@ pub fn call_argument_formal_at_position(
         }
         __result
     })
-    .iter()
+    .get(
+        (call_argument_positional_rank(
+            arguments.clone(),
+            argument_index.clone(),
+            source_indices.clone(),
+        )) as usize,
+    )
     .cloned()
-    .skip(call_argument_positional_rank(
-        arguments.clone(),
-        argument_index.clone(),
-        source_indices.clone(),
-    ) as usize)
-    .next()
     {
         Some(positional) => Rc::new(CallArgumentFormalSelection::CallArgumentFormalSelected {
             formal_index: positional.0.clone(),
@@ -8106,13 +8101,7 @@ pub fn build_call_application_plan(
             .cloned()
             {
                 __result.extend(
-                    (*match formals
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(pair.0.clone() as usize)
-                        .next()
-                    {
+                    (*match formals.clone().get((pair.0.clone()) as usize).cloned() {
                         Some(carried) => Rc::new(vec![Rc::new(ResolvedCallFormal {
                             formal_index: pair.0.clone(),
                             formal: Rc::new(ResolvedFormal {
@@ -8190,7 +8179,7 @@ pub fn direct_call_structured_application_mismatch_diags(
             let formal_subst = app.formal.clone().declared_type.clone();
 let formal = app.formal.clone().declaration_bound_conformance.clone();
 match app.matched_argument_index.clone() {
-    Some(arg_index) => match typed_args.clone().iter().cloned().skip(arg_index.clone() as usize).next() {
+    Some(arg_index) => match typed_args.clone().get((arg_index.clone()) as usize).cloned() {
     Some(ta) => {
                 let actual_expr = crate::v1_std_core::arg_value(ta.clone());
 let host_into_sequence = (!type_node_is_callable(formal.clone()) && crate::v1_compiler_infer_env::host_text_into_structural_sequence(formal.clone(), crate::v1_compiler_infer_resolve::peel_nominal_alias_identity(crate::v1_compiler_infer_types::resolved_type(actual_expr.clone()), type_env.clone(), module_name.clone()), crate::v1_compiler_infer_types::resolved_type(actual_expr.clone()), type_env.clone()));
@@ -8274,7 +8263,7 @@ pub fn sibling_effect_order_diags(
                 Some(x) => x.clone(),
                 std::option::Option::None => "".to_string(),
             };
-            let b = match effectful.clone().iter().cloned().skip(1 as usize).next() {
+            let b = match effectful.clone().get((1) as usize).cloned() {
                 Some(x) => x.clone(),
                 std::option::Option::None => "".to_string(),
             };
@@ -8338,10 +8327,8 @@ pub fn direct_call_argument_inhabitance_diags(
                 (*match app.matched_argument_index.clone() {
                     Some(arg_index) => match typed_args
                         .clone()
-                        .iter()
+                        .get((arg_index.clone()) as usize)
                         .cloned()
-                        .skip(arg_index.clone() as usize)
-                        .next()
                     {
                         Some(ta) => {
                             if type_node_is_callable(app.formal.clone().declared_type.clone()) {
@@ -8395,13 +8382,13 @@ pub fn direct_call_generic_type_argument_inhabitance_diags(
             let mut __result = Vec::new();
             for app in plan.iter().cloned() {
                 __result.extend((*match app.matched_argument_index.clone() {
-    Some(arg_index) => match typed_args.clone().iter().cloned().skip(arg_index.clone() as usize).next() {
+    Some(arg_index) => match typed_args.clone().get((arg_index.clone()) as usize).cloned() {
     Some(ta) => {
             let actual_expr = crate::v1_std_core::arg_value(ta.clone());
 let actual = crate::v1_compiler_infer_types::resolved_type(actual_expr.clone());
 if ((((exposure_is_application(exposure_view_for_node(app.formal.clone().declared_type.clone(), source_indices.clone())) && exposure_is_application(exposure_view_for_node(actual.clone(), source_indices.clone()))) && ((app.formal.clone().declared_type.clone().children.clone().len() as i64) > 0)) && ((app.formal.clone().declared_type.clone().children.clone().len() as i64) == (actual.children.clone().len() as i64))) && (crate::v1_std_core::authored_name_at(source_indices.clone(), app.formal.clone().declared_type.clone()) == crate::v1_std_core::authored_name_at(source_indices.clone(), actual.clone()))) {
-                Rc::new({ let mut __result = Vec::new(); for declared_pair in Rc::new(app.formal.clone().declared_type.clone().children.clone().iter().cloned().enumerate().map(|(i, v)| (i as i64, v)).collect::<Vec<_>>()).iter().cloned() { __result.extend((*match app.formal.clone().substitution_basis.clone().children.clone().iter().cloned().skip(declared_pair.0.clone() as usize).next() {
-    Some(raw_declared_child) => match actual.children.clone().iter().cloned().skip(declared_pair.0.clone() as usize).next() {
+                Rc::new({ let mut __result = Vec::new(); for declared_pair in Rc::new(app.formal.clone().declared_type.clone().children.clone().iter().cloned().enumerate().map(|(i, v)| (i as i64, v)).collect::<Vec<_>>()).iter().cloned() { __result.extend((*match app.formal.clone().substitution_basis.clone().children.clone().get((declared_pair.0.clone()) as usize).cloned() {
+    Some(raw_declared_child) => match actual.children.clone().get((declared_pair.0.clone()) as usize).cloned() {
     Some(produced_child) => if (applied_type_argument_identity_known(crate::v1_std_core::authored_name_at(source_indices.clone(), crate::v1_compiler_infer_types::child_type_node(raw_declared_child.clone())), scope.clone()) && applied_type_argument_identity_known(crate::v1_std_core::authored_name_at(source_indices.clone(), crate::v1_compiler_infer_types::child_type_node(produced_child.clone())), scope.clone())) {
                     declared_type_obligation_diags(Rc::new(DeclaredTypeObligation {
     position: DeclaredTypePosition::PositionGenericTypeArgument,
@@ -8615,10 +8602,8 @@ pub fn callable_signature_substitution(
             acc.clone(),
             |st: Rc<HashMap<String, Rc<Node>>>, pair: (i64, Rc<Node>)| match a_params
                 .clone()
-                .iter()
+                .get((pair.0.clone()) as usize)
                 .cloned()
-                .skip(pair.0.clone() as usize)
-                .next()
             {
                 Some(ap) => callable_leaf_substitution(
                     callable_param_type(pair.1.clone()),
@@ -8739,13 +8724,7 @@ pub fn callable_arrow_mismatch(
                     .iter()
                     .cloned()
                     {
-                        if match a_params
-                            .clone()
-                            .iter()
-                            .cloned()
-                            .skip(pair.0.clone() as usize)
-                            .next()
-                        {
+                        if match a_params.clone().get((pair.0.clone()) as usize).cloned() {
                             Some(ap) => callable_component_ground_mismatch(
                                 callable_param_type(pair.1.clone()),
                                 callable_param_type(ap.clone()),
@@ -8830,16 +8809,9 @@ pub fn expression_value_type(e: Rc<Node>) -> Rc<Node> {
         resolved_callable_type(
             Rc::new({
                 let mut __result = Vec::new();
-                for lp in Rc::new(
-                    e.children
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                )
-                .iter()
-                .cloned()
+                for lp in Rc::new(v1_rt::list_skip(&e.children.clone(), 1))
+                    .iter()
+                    .cloned()
                 {
                     __result.push(lambda_arrow_param(lp.clone()));
                 }
@@ -9068,12 +9040,9 @@ pub fn borrowed_callable_call_type(
                         .cloned()
                         {
                             Some(named_ta) => Some(named_ta.clone()),
-                            std::option::Option::None => typed_args
-                                .clone()
-                                .iter()
-                                .cloned()
-                                .skip(pair.0.clone() as usize)
-                                .next(),
+                            std::option::Option::None => {
+                                typed_args.clone().get((pair.0.clone()) as usize).cloned()
+                            }
                         };
                         match matched_arg.clone() {
                             Some(ta) => unify_generics(
@@ -9158,14 +9127,10 @@ pub fn call_arg_bound_param_at(
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
     positionally_eligible_names: Rc<Vec<String>>,
 ) -> Option<String> {
-    Rc::new(
-        typed_args
-            .clone()
-            .iter()
-            .cloned()
-            .take(v1_rt::int_add(idx.clone(), 1) as usize)
-            .collect::<Vec<_>>(),
-    )
+    Rc::new(v1_rt::list_take(
+        &typed_args.clone(),
+        v1_rt::int_add(idx.clone(), 1),
+    ))
     .iter()
     .cloned()
     .fold(
@@ -9184,10 +9149,8 @@ pub fn call_arg_bound_param_at(
             std::option::Option::None => Rc::new(CallArgBoundParamAccum {
                 bound: positionally_eligible_names
                     .clone()
-                    .iter()
-                    .cloned()
-                    .skip(acc.pos.clone() as usize)
-                    .next(),
+                    .get((acc.pos.clone()) as usize)
+                    .cloned(),
                 pos: v1_rt::int_add(acc.pos.clone(), 1),
             }),
         },
@@ -9406,10 +9369,8 @@ pub fn direct_call_shape_diags(
             if ((positional_args.clone().len() as i64) > positional_capacity.clone()) {
                 match positional_args
                     .clone()
-                    .iter()
+                    .get((positional_capacity.clone()) as usize)
                     .cloned()
-                    .skip(positional_capacity.clone() as usize)
-                    .next()
                 {
                     Some(overflow) => Rc::new(vec![crate::v1_std_core::make_error_node(
                         Rc::new(CompilerDiagnostic::CallPositionalSurplus {
@@ -9613,10 +9574,8 @@ pub fn function_value_call_named_arg_diags(
                     if (supplied.clone() > param_count.clone()) {
                         match typed_args
                             .clone()
-                            .iter()
+                            .get((param_count.clone()) as usize)
                             .cloned()
-                            .skip(param_count.clone() as usize)
-                            .next()
                         {
                             Some(overflow) => Rc::new(vec![crate::v1_std_core::make_error_node(
                                 Rc::new(CompilerDiagnostic::CallPositionalSurplus {
@@ -9715,7 +9674,7 @@ pub fn direct_call_arg_mismatch_diags(
                 __result.extend((*{
             let formal = app.formal.clone().declaration_bound_conformance.clone();
 match app.matched_argument_index.clone() {
-    Some(arg_index) => match typed_args.clone().iter().cloned().skip(arg_index.clone() as usize).next() {
+    Some(arg_index) => match typed_args.clone().get((arg_index.clone()) as usize).cloned() {
     Some(ta) => {
                 let actual_expr = crate::v1_std_core::arg_value(ta.clone());
 if match (*actual_expr.expr_data.clone()).clone() {
@@ -9802,7 +9761,7 @@ pub fn builtin_text_argument_crossing_diags(
                     let arg = pair.1.clone();
 let bound_name = match crate::v1_std_core::arg_name_at(arg.clone(), scope.type_env.clone().source_indices.clone()) {
     Some(label) => label.clone(),
-    std::option::Option::None => match formal_names.clone().iter().cloned().skip(pair.0.clone() as usize).next() {
+    std::option::Option::None => match formal_names.clone().get((pair.0.clone()) as usize).cloned() {
     Some(n) => n.clone(),
     std::option::Option::None => "".to_string(),
 },
@@ -10019,7 +9978,7 @@ pub fn infer_tier2b_builtin_with_kernel_diags(
                             let operand_elem = if ((func_name.clone() == "set_insert".to_string())
                                 || (func_name.clone() == "set_contains".to_string()))
                             {
-                                match typed_args.clone().iter().cloned().skip(1 as usize).next() {
+                                match typed_args.clone().get((1) as usize).cloned() {
                                     Some(insert_arg) => {
                                         match crate::v1_std_core::arg_value(insert_arg.clone())
                                             .inferred
@@ -10036,7 +9995,7 @@ pub fn infer_tier2b_builtin_with_kernel_diags(
                                     std::option::Option::None => std::option::Option::None,
                                 }
                             } else {
-                                match typed_args.clone().iter().cloned().skip(1 as usize).next() {
+                                match typed_args.clone().get((1) as usize).cloned() {
     Some(other_arg) => match crate::v1_std_core::arg_value(other_arg.clone()).inferred.clone().as_deref().cloned() {
     Some(InferredNode::Resolved { node: other_type, .. }) => match crate::v1_compiler_infer_lookup::set_element_type_in_env(other_type.clone(), scope.type_env.clone()) {
     Some(elem_slot) => Some(crate::v1_compiler_infer_types::child_type_node(elem_slot.clone())),
@@ -10055,7 +10014,7 @@ pub fn infer_tier2b_builtin_with_kernel_diags(
                             };
                             let union_other_bad = if (func_name.clone() == "set_union".to_string())
                             {
-                                match typed_args.clone().iter().cloned().skip(1 as usize).next() {
+                                match typed_args.clone().get((1) as usize).cloned() {
                                     Some(other_arg) => set_union_other_operand_is_resolved_non_set(
                                         other_arg.clone(),
                                         scope.clone(),
@@ -10423,13 +10382,6 @@ pub struct UnresolvedMethodFrontierRow {
 
 pub fn unresolved_method_frontier() -> Rc<Vec<Rc<UnresolvedMethodFrontierRow>>> {
     Rc::new(vec![Rc::new(UnresolvedMethodFrontierRow {
-    module_name: "extdeps.dns.domain_name".to_string(),
-    method: "list_push".to_string(),
-    occurrences: 1,
-    receiver_shape: "Primitive(ok)".to_string(),
-    cause: "receiver is a coproduct payload bound by pattern destructuring, which arrives typed as the VARIANT name rather than the field type.".to_string(),
-    dissolution: crate::std_dissolution::unbound_dissolution("coproduct payload binding typed as the field type, at which point the receiver is List and DECIDABLE".to_string()),
-}), Rc::new(UnresolvedMethodFrontierRow {
     module_name: "v1.compiler.trace".to_string(),
     method: "map".to_string(),
     occurrences: 1,
@@ -11743,7 +11695,7 @@ Rc::new(ArgInferResult {
     diagnostics: v1_rt::concat(ar.diagnostics.clone(), Rc::new(vec![contract_diag.clone()])),
 })
 },
-    DeclaredArgContract::ContractKnown { types: declared_types, .. } => match declared_types.clone().iter().cloned().skip(idx.clone() as usize).next() {
+    DeclaredArgContract::ContractKnown { types: declared_types, .. } => match declared_types.clone().get((idx.clone()) as usize).cloned() {
     Some(declared_type) => infer_arg_with_element_type(a.clone(), declared_type.clone(), nf_scope.clone()),
     std::option::Option::None => {
                             let ar = infer_expr(nf_lam_value.clone(), nf_scope.clone(), std::option::Option::None);
@@ -12006,10 +11958,8 @@ pub fn infer_call_arguments_generic_pass(
                     formal_index, ..
                 } => match formals
                     .clone()
-                    .iter()
+                    .get((formal_index.clone()) as usize)
                     .cloned()
-                    .skip(formal_index.clone() as usize)
-                    .next()
                 {
                     Some(carried) => carried.substitution_basis.clone(),
                     std::option::Option::None => error_type(),
@@ -12040,10 +11990,8 @@ pub fn infer_call_arguments_generic_pass(
                     formal_index, ..
                 } => match formals
                     .clone()
-                    .iter()
+                    .get((formal_index.clone()) as usize)
                     .cloned()
-                    .skip(formal_index.clone() as usize)
-                    .next()
                 {
                     Some(carried) => substitute_generics(
                         carried.declaration_bound_conformance.clone(),
@@ -12061,10 +12009,8 @@ pub fn infer_call_arguments_generic_pass(
                     formal_index, ..
                 } => match formals
                     .clone()
-                    .iter()
+                    .get((formal_index.clone()) as usize)
                     .cloned()
-                    .skip(formal_index.clone() as usize)
-                    .next()
                 {
                     Some(carried) => {
                         formal_code_point_view(carried.clone(), scope.type_env.clone())
@@ -13304,14 +13250,7 @@ Rc::new(InferResult {
                             }
                             __found
                         };
-                        let call_method_args = Rc::new(
-                            call_args
-                                .clone()
-                                .iter()
-                                .cloned()
-                                .skip(1 as usize)
-                                .collect::<Vec<_>>(),
-                        );
+                        let call_method_args = Rc::new(v1_rt::list_skip(&call_args.clone(), 1));
                         let call_method_name = Some(func_name.clone());
                         let call_fold_info = extract_fold_init_info(
                             call_method_name.clone(),
@@ -13739,14 +13678,8 @@ Rc::new(InferResult {
                                 {
                                     {
                                         let receiver = method_receiver.clone();
-                                        let remaining = Rc::new(
-                                            typed_args
-                                                .clone()
-                                                .iter()
-                                                .cloned()
-                                                .skip(1 as usize)
-                                                .collect::<Vec<_>>(),
-                                        );
+                                        let remaining =
+                                            Rc::new(v1_rt::list_skip(&typed_args.clone(), 1));
                                         let rest_result = rest_operation_result_type(
                                             method_resolution.clone(),
                                             texpr.span.clone(),
@@ -14613,23 +14546,16 @@ crate::v1_compiler_infer_types::resolve_type_variables_from_template(t.clone(),
                 },
             };
             let unified_arm_type = match arm_body_types.clone().first().cloned() {
-                Some(first_type) => Rc::new(
-                    arm_body_types
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                )
-                .iter()
-                .cloned()
-                .fold(first_type.clone(), |acc: _, t: Rc<Node>| {
-                    crate::v1_compiler_infer_types::prefer_specific_type(
-                        acc,
-                        t.clone(),
-                        scope.type_env.clone().source_indices.clone(),
-                    )
-                }),
+                Some(first_type) => Rc::new(v1_rt::list_skip(&arm_body_types.clone(), 1))
+                    .iter()
+                    .cloned()
+                    .fold(first_type.clone(), |acc: _, t: Rc<Node>| {
+                        crate::v1_compiler_infer_types::prefer_specific_type(
+                            acc,
+                            t.clone(),
+                            scope.type_env.clone().source_indices.clone(),
+                        )
+                    }),
                 std::option::Option::None => scrut_rt.clone(),
             };
             let arm_infer_results = if crate::v1_compiler_infer_types::is_fully_resolved(
@@ -15411,15 +15337,7 @@ crate::v1_compiler_infer_types::resolve_type_variables_from_template(t.clone(),
                 texpr.clone(),
                 scope.type_env.clone().source_indices.clone(),
             );
-            let lam_param_nodes = Rc::new(
-                texpr
-                    .children
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .collect::<Vec<_>>(),
-            );
+            let lam_param_nodes = Rc::new(v1_rt::list_skip(&texpr.children.clone(), 1));
             let elem_prov =
                 match v1_rt::map_get(&scope.lambda_param_provenance.clone(), "elem".to_string()) {
                     Some(p) => p.clone(),
@@ -15450,14 +15368,7 @@ crate::v1_compiler_infer_types::resolve_type_variables_from_template(t.clone(),
                                 } else {
                                     Rc::new(SubValueRelation::SubValueUnknown)
                                 };
-                                match exp
-                                    .params
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(pair.0.clone() as usize)
-                                    .next()
-                                {
+                                match exp.params.clone().get((pair.0.clone()) as usize).cloned() {
                                     Some(cp) => {
                                         let cpt =
                                             crate::v1_std_core::param_node_type_expr(cp.clone());
@@ -15615,16 +15526,11 @@ crate::v1_compiler_infer_types::resolve_type_variables_from_template(t.clone(),
                 {
                     __result.push({
                         let pn = pair.1.clone();
-                        let param_name = match lam_params
-                            .clone()
-                            .iter()
-                            .cloned()
-                            .skip(pair.0.clone() as usize)
-                            .next()
-                        {
-                            Some(n) => n.clone(),
-                            std::option::Option::None => "".to_string(),
-                        };
+                        let param_name =
+                            match lam_params.clone().get((pair.0.clone()) as usize).cloned() {
+                                Some(n) => n.clone(),
+                                std::option::Option::None => "".to_string(),
+                            };
                         let param_type =
                             match v1_rt::map_get(&lam_scope.locals.clone(), param_name.clone()) {
                                 Some(binding) => Some(Rc::new(InferredNode::Resolved {
@@ -16529,13 +16435,7 @@ pub fn alias_chain_type_arg_subst(
                             pair.1.clone(),
                             env.source_indices.clone(),
                         );
-                        match type_args
-                            .clone()
-                            .iter()
-                            .cloned()
-                            .skip(pair.0.clone() as usize)
-                            .next()
-                        {
+                        match type_args.clone().get((pair.0.clone()) as usize).cloned() {
                             Some(arg) => v1_rt::rc_map_insert(
                                 acc.clone(),
                                 slot.clone(),
@@ -17034,14 +16934,7 @@ pub fn infer_map_literal(
     scope: Rc<InferScope>,
 ) -> Rc<InferResult> {
     {
-        let value_expected = match map_node
-            .children
-            .clone()
-            .iter()
-            .cloned()
-            .skip(1 as usize)
-            .next()
-        {
+        let value_expected = match map_node.children.clone().get((1) as usize).cloned() {
             Some(v) => Some(v.clone()),
             std::option::Option::None => std::option::Option::None,
         };
@@ -18097,34 +17990,48 @@ Rc::new(FieldInferResult {
                 let is_present_ctor = ((type_name.clone().unwrap() == "Present".to_string())
                     && (local_variant_parent.clone().as_deref()
                         == expected_optional_parent.clone().as_deref()));
-                let resolved_node = if is_present_ctor.clone() {
-                    {
-                        let val_field = Rc::new({
-                            let mut __result = Vec::new();
-                            for fir in fi_infer_results.iter().cloned() {
-                                if (crate::v1_std_core::field_init_node_name_at(
-                                    fir.typed_field.clone(),
-                                    scope.type_env.clone().source_indices.clone(),
-                                ) == "value".to_string())
-                                {
-                                    __result.push(fir);
+                let applied_expected_owner = if is_present_ctor.clone() {
+                    std::option::Option::None
+                } else {
+                    variant_literal_expected_application(
+                        raw_resolved.clone(),
+                        expected.clone(),
+                        scope.clone(),
+                    )
+                };
+                let resolved_node = if (applied_expected_owner.clone() != std::option::Option::None)
+                {
+                    applied_expected_owner.clone().unwrap()
+                } else {
+                    if is_present_ctor.clone() {
+                        {
+                            let val_field = Rc::new({
+                                let mut __result = Vec::new();
+                                for fir in fi_infer_results.iter().cloned() {
+                                    if (crate::v1_std_core::field_init_node_name_at(
+                                        fir.typed_field.clone(),
+                                        scope.type_env.clone().source_indices.clone(),
+                                    ) == "value".to_string())
+                                    {
+                                        __result.push(fir);
+                                    }
                                 }
-                            }
-                            __result
-                        })
-                        .first()
-                        .cloned();
-                        match val_field.clone() {
-                            Some(val_fir) => crate::v1_std_core::with_optional_cardinality(
-                                crate::v1_compiler_infer_types::resolved_type(
-                                    val_fir.infer_result.clone().typed.clone(),
+                                __result
+                            })
+                            .first()
+                            .cloned();
+                            match val_field.clone() {
+                                Some(val_fir) => crate::v1_std_core::with_optional_cardinality(
+                                    crate::v1_compiler_infer_types::resolved_type(
+                                        val_fir.infer_result.clone().typed.clone(),
+                                    ),
                                 ),
-                            ),
-                            std::option::Option::None => raw_resolved.clone(),
+                                std::option::Option::None => raw_resolved.clone(),
+                            }
                         }
+                    } else {
+                        raw_resolved.clone()
                     }
-                } else {
-                    raw_resolved.clone()
                 };
                 let type_diags = match effective_lookup.clone() {
                     Some(_) => Rc::new(vec![]),
@@ -18555,10 +18462,8 @@ pub fn maybe_insert_output_field_relation(
         let composed = match sig
             .output_provenance
             .clone()
-            .iter()
+            .get((idx.clone()) as usize)
             .cloned()
-            .skip(idx.clone() as usize)
-            .next()
         {
             Some(param_map) => {
                 classify_call_via_provenance(val.clone(), param_map.clone(), ctx.clone())
@@ -19549,21 +19454,15 @@ pub fn classify_call_arg_provenance(
 pub fn merge_argument_relations(rels: Rc<Vec<Rc<SubValueRelation>>>) -> Rc<SubValueRelation> {
     match rels.clone().first().cloned() {
         std::option::Option::None => Rc::new(SubValueRelation::SubValueUnknown),
-        Some(first_rel) => Rc::new(
-            rels.clone()
-                .iter()
-                .cloned()
-                .skip(1 as usize)
-                .collect::<Vec<_>>(),
-        )
-        .iter()
-        .cloned()
-        .fold(
-            first_rel.clone(),
-            |acc: Rc<SubValueRelation>, rel: Rc<SubValueRelation>| {
-                crate::std_induction::meet_sub_value(acc, rel.clone())
-            },
-        ),
+        Some(first_rel) => Rc::new(v1_rt::list_skip(&rels.clone(), 1))
+            .iter()
+            .cloned()
+            .fold(
+                first_rel.clone(),
+                |acc: Rc<SubValueRelation>, rel: Rc<SubValueRelation>| {
+                    crate::std_induction::meet_sub_value(acc, rel.clone())
+                },
+            ),
     }
 }
 
@@ -20112,10 +20011,8 @@ pub fn build_call_evidence(
                         }
                         std::option::Option::None => match positional_args
                             .clone()
-                            .iter()
+                            .get((def_idx.clone()) as usize)
                             .cloned()
-                            .skip(def_idx.clone() as usize)
-                            .next()
                         {
                             Some(arg_val) => {
                                 read_arg_provenance(arg_val.clone(), pname.clone(), ctx.clone())
@@ -20273,7 +20170,7 @@ let p1 = match lparams.clone().first().cloned() {
     Some(n) => n.clone(),
     std::option::Option::None => "".to_string(),
 };
-let p2 = match lparams.clone().iter().cloned().skip(1 as usize).next() {
+let p2 = match lparams.clone().get((1) as usize).cloned() {
     Some(n) => n.clone(),
     std::option::Option::None => "".to_string(),
 };
@@ -21027,10 +20924,8 @@ Rc::new(BlockAnnotateAcc {
                                 );
                                 lparams
                                     .clone()
-                                    .iter()
+                                    .get((elem_position.clone().unwrap()) as usize)
                                     .cloned()
-                                    .skip(elem_position.clone().unwrap() as usize)
-                                    .next()
                             }
                             std::option::Option::None => std::option::Option::None,
                         };
@@ -22118,12 +22013,7 @@ pub fn meet_per_field_results(
                                         let mut __result = Vec::new();
                                         for r in results.iter().cloned() {
                                             __result.push(
-                                                match r
-                                                    .clone()
-                                                    .iter()
-                                                    .cloned()
-                                                    .skip(idx.clone() as usize)
-                                                    .next()
+                                                match r.clone().get((idx.clone()) as usize).cloned()
                                                 {
                                                     Some(m) => m.clone(),
                                                     std::option::Option::None => empty_prov_map(),
@@ -22153,23 +22043,16 @@ pub fn meet_body_provenance_maps(
 ) -> Rc<HashMap<String, Rc<SubValueRelation>>> {
     match provs.clone().first().cloned() {
         std::option::Option::None => empty_prov_map(),
-        Some(first_prov) => Rc::new(
-            provs
-                .clone()
-                .iter()
-                .cloned()
-                .skip(1 as usize)
-                .collect::<Vec<_>>(),
-        )
-        .iter()
-        .cloned()
-        .fold(
-            first_prov.clone(),
-            |acc: Rc<HashMap<String, Rc<SubValueRelation>>>,
-             prov: Rc<HashMap<String, Rc<SubValueRelation>>>| {
-                intersect_prov_maps(acc, prov.clone())
-            },
-        ),
+        Some(first_prov) => Rc::new(v1_rt::list_skip(&provs.clone(), 1))
+            .iter()
+            .cloned()
+            .fold(
+                first_prov.clone(),
+                |acc: Rc<HashMap<String, Rc<SubValueRelation>>>,
+                 prov: Rc<HashMap<String, Rc<SubValueRelation>>>| {
+                    intersect_prov_maps(acc, prov.clone())
+                },
+            ),
     }
 }
 
@@ -22655,14 +22538,10 @@ if ((Rc::new(v1_rt::map_keys(&composed_field_map)).len() as i64) > 0) {
                     acc.clone()
                 } else {
                     {
-                        let final_lp = Rc::new(
-                            stmts
-                                .clone()
-                                .iter()
-                                .cloned()
-                                .take(v1_rt::int_sub(stmt_count.clone(), 1) as usize)
-                                .collect::<Vec<_>>(),
-                        )
+                        let final_lp = Rc::new(v1_rt::list_take(
+                            &stmts.clone(),
+                            v1_rt::int_sub(stmt_count.clone(), 1),
+                        ))
                         .iter()
                         .cloned()
                         .fold(
@@ -22693,10 +22572,8 @@ if ((Rc::new(v1_rt::map_keys(&composed_field_map)).len() as i64) > 0) {
                         );
                         match stmts
                             .clone()
-                            .iter()
+                            .get((v1_rt::int_sub(stmt_count.clone(), 1)) as usize)
                             .cloned()
-                            .skip(v1_rt::int_sub(stmt_count.clone(), 1) as usize)
-                            .next()
                         {
                             Some(last) => collect_variant_constructors(
                                 last.clone(),
@@ -24007,15 +23884,7 @@ pub fn unify_callable_generics(
 
 pub fn lambda_callable_type(lambda: Rc<Node>) -> Rc<Node> {
     crate::v1_compiler_infer_types::make_callable_type(
-        Rc::new(
-            lambda
-                .children
-                .clone()
-                .iter()
-                .cloned()
-                .skip(1 as usize)
-                .collect::<Vec<_>>(),
-        ),
+        Rc::new(v1_rt::list_skip(&lambda.children.clone(), 1)),
         crate::v1_compiler_infer_types::resolved_type(lambda.clone()),
     )
 }
@@ -24041,10 +23910,8 @@ pub fn unify_callable_param_pairs(
         match formals.clone().first().cloned() {
             Some(f) => match actuals.clone().first().cloned() {
                 Some(a) => {
-                    let __tco_0 =
-                        Rc::new(formals.iter().cloned().skip(1 as usize).collect::<Vec<_>>());
-                    let __tco_1 =
-                        Rc::new(actuals.iter().cloned().skip(1 as usize).collect::<Vec<_>>());
+                    let __tco_0 = Rc::new(v1_rt::list_skip(&formals, 1));
+                    let __tco_1 = Rc::new(v1_rt::list_skip(&actuals, 1));
                     let __tco_2 = generic_names.clone();
                     let __tco_3 = source_indices.clone();
                     let __tco_4 = unify_generics(
@@ -24548,30 +24415,23 @@ pub fn union_parent_type_env_caches(
                 cache: crate::v1_compiler_infer_env::empty_type_env_cache(),
                 conflicts: Rc::new(vec![]),
             }),
-            Some(head) => Rc::new(
-                parent_caches
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .collect::<Vec<_>>(),
-            )
-            .iter()
-            .cloned()
-            .fold(
-                Rc::new(GuardedTypeEnvCacheMerge {
-                    cache: head.cache.clone(),
-                    conflicts: Rc::new(vec![]),
-                }),
-                |acc: Rc<GuardedTypeEnvCacheMerge>, row: Rc<ParentCacheRow>| {
-                    crate::v1_compiler_infer_env::merge_type_env_cache_guarded(
-                        acc.cache.clone(),
-                        row.cache.clone(),
-                        row.import_path.clone(),
-                        acc.conflicts.clone(),
-                    )
-                },
-            ),
+            Some(head) => Rc::new(v1_rt::list_skip(&parent_caches.clone(), 1))
+                .iter()
+                .cloned()
+                .fold(
+                    Rc::new(GuardedTypeEnvCacheMerge {
+                        cache: head.cache.clone(),
+                        conflicts: Rc::new(vec![]),
+                    }),
+                    |acc: Rc<GuardedTypeEnvCacheMerge>, row: Rc<ParentCacheRow>| {
+                        crate::v1_compiler_infer_env::merge_type_env_cache_guarded(
+                            acc.cache.clone(),
+                            row.cache.clone(),
+                            row.import_path.clone(),
+                            acc.conflicts.clone(),
+                        )
+                    },
+                ),
         }
     }
 }
@@ -25478,32 +25338,84 @@ pub fn symbol_index_insert_unique_disj_variant_aliases(
 ) -> Rc<SymbolIndex> {
     {
         let counts = disj_variant_name_counts(items.clone(), source_indices.clone());
-        items.iter().cloned().fold(index.clone(), |acc: Rc<SymbolIndex>, item: Rc<Node>| match item.connective.clone() {
-    Connective::Disj => {
-            let tname = crate::v1_std_core::authored_name_at(source_indices.clone(), item.clone());
-item.children.clone().iter().cloned().fold(acc.clone(), |a2: Rc<SymbolIndex>, child: Rc<Node>| {
-                let vname = crate::v1_std_core::authored_name_at(source_indices.clone(), child.clone());
-let a2_qualified = crate::v1_compiler_infer_env::symbol_index_insert(a2, v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(module_path.clone(), ".".to_string()), tname.clone()), ".".to_string()), vname.clone()), item.clone());
-match v1_rt::map_get(&counts, vname.clone()) {
-    Some(1) => match v1_rt::map_get(&corpus_variant_counts, vname.clone()) {
-    Some(1) => if ((v1_rt::map_get(&corpus_item_counts, vname.clone()) != std::option::Option::None) || overlay_skips_kernel_name(vname.clone())) {
-                    crate::v1_compiler_infer_env::symbol_index_insert(a2_qualified.clone(), v1_rt::concat(v1_rt::concat(module_path.clone(), ".".to_string()), vname.clone()), item.clone())
-                } else {
-                    crate::v1_compiler_infer_env::symbol_index_insert_decl(a2_qualified.clone(), module_path.clone(), Rc::new(TypeBinding {
-    name: vname.clone(),
-    resolved: item.clone(),
-    provenance: Rc::new(SubValueRelation::SubValueUnknown),
-    alias_rhs: std::option::Option::None,
-}))
-                },
-    _ => crate::v1_compiler_infer_env::symbol_index_insert(a2_qualified.clone(), v1_rt::concat(v1_rt::concat(module_path.clone(), ".".to_string()), vname.clone()), item.clone()),
-},
-    _ => a2_qualified.clone(),
-}
-})
-},
-    _ => acc.clone(),
-})
+        items.iter().cloned().fold(
+            index.clone(),
+            |acc: Rc<SymbolIndex>, item: Rc<Node>| match item.connective.clone() {
+                Connective::Disj => {
+                    let tname =
+                        crate::v1_std_core::authored_name_at(source_indices.clone(), item.clone());
+                    item.children.clone().iter().cloned().fold(
+                        acc.clone(),
+                        |a2: Rc<SymbolIndex>, child: Rc<Node>| {
+                            let vname = crate::v1_std_core::authored_name_at(
+                                source_indices.clone(),
+                                child.clone(),
+                            );
+                            let a2_qualified = crate::v1_compiler_infer_env::symbol_index_insert(
+                                a2,
+                                v1_rt::concat(
+                                    v1_rt::concat(
+                                        v1_rt::concat(
+                                            v1_rt::concat(module_path.clone(), ".".to_string()),
+                                            tname.clone(),
+                                        ),
+                                        ".".to_string(),
+                                    ),
+                                    vname.clone(),
+                                ),
+                                item.clone(),
+                            );
+                            match v1_rt::map_get(&counts, vname.clone()) {
+                                Some(1) => match v1_rt::map_get(
+                                    &corpus_variant_counts,
+                                    vname.clone(),
+                                ) {
+                                    Some(1) => if ((v1_rt::map_get(
+                                        &corpus_item_counts,
+                                        vname.clone(),
+                                    ) != std::option::Option::None)
+                                        || crate::v1_compiler_infer_env::overlay_skips_kernel_name(
+                                            vname.clone(),
+                                        )) {
+                                        crate::v1_compiler_infer_env::symbol_index_insert(
+                                            a2_qualified.clone(),
+                                            v1_rt::concat(
+                                                v1_rt::concat(module_path.clone(), ".".to_string()),
+                                                vname.clone(),
+                                            ),
+                                            item.clone(),
+                                        )
+                                    } else {
+                                        crate::v1_compiler_infer_env::symbol_index_insert_decl(
+                                            a2_qualified.clone(),
+                                            module_path.clone(),
+                                            Rc::new(TypeBinding {
+                                                name: vname.clone(),
+                                                resolved: item.clone(),
+                                                provenance: Rc::new(
+                                                    SubValueRelation::SubValueUnknown,
+                                                ),
+                                                alias_rhs: std::option::Option::None,
+                                            }),
+                                        )
+                                    },
+                                    _ => crate::v1_compiler_infer_env::symbol_index_insert(
+                                        a2_qualified.clone(),
+                                        v1_rt::concat(
+                                            v1_rt::concat(module_path.clone(), ".".to_string()),
+                                            vname.clone(),
+                                        ),
+                                        item.clone(),
+                                    ),
+                                },
+                                _ => a2_qualified.clone(),
+                            }
+                        },
+                    )
+                }
+                _ => acc.clone(),
+            },
+        )
     }
 }
 
@@ -25965,6 +25877,38 @@ pub fn transparent_alias_identity_agrees(
     }
 }
 
+pub fn file_named_imports_of(
+    module_node: Rc<Node>,
+    source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+) -> Rc<HashMap<String, String>> {
+    Rc::new({
+        let mut __result = Vec::new();
+        for imp in crate::v1_std_core::module_imports(module_node.clone())
+            .iter()
+            .cloned()
+        {
+            if !crate::v1_std_core::import_is_all(imp.clone()) {
+                __result.push(imp);
+            }
+        }
+        __result
+    })
+    .iter()
+    .cloned()
+    .fold(
+        v1_rt::rc_empty_map::<String, String>(),
+        |acc: Rc<HashMap<String, String>>, imp: Rc<Node>| {
+            let from_module = import_module_path_at(imp.clone(), source_indices.clone());
+            crate::v1_std_core::import_specific_names_at(imp.clone(), source_indices.clone())
+                .iter()
+                .cloned()
+                .fold(acc, |inner: Rc<HashMap<String, String>>, name: String| {
+                    v1_rt::rc_map_insert(inner, name.clone(), from_module.clone())
+                })
+        },
+    )
+}
+
 pub fn build_symbol_index_census_raw_nodes(
     module_nodes: Rc<Vec<Rc<Node>>>,
     source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
@@ -26017,6 +25961,32 @@ pub fn build_symbol_index_census_raw_nodes(
                 module_nodes.clone(),
                 source_indices.clone(),
             ),
+            file_modules: module_nodes.iter().cloned().fold(
+                v1_rt::rc_empty_map::<String, String>(),
+                |acc: Rc<HashMap<String, String>>, module_node: Rc<Node>| {
+                    v1_rt::rc_map_insert(
+                        acc,
+                        module_node.span.clone().file.clone(),
+                        crate::v1_std_core::authored_name_at(
+                            source_indices.clone(),
+                            module_node.clone(),
+                        ),
+                    )
+                },
+            ),
+            module_named_imports: module_nodes.iter().cloned().fold(
+                v1_rt::rc_empty_map::<String, Rc<HashMap<String, String>>>(),
+                |acc: Rc<HashMap<String, Rc<HashMap<String, String>>>>, module_node: Rc<Node>| {
+                    v1_rt::rc_map_insert(
+                        acc,
+                        crate::v1_std_core::authored_name_at(
+                            source_indices.clone(),
+                            module_node.clone(),
+                        ),
+                        file_named_imports_of(module_node.clone(), source_indices.clone()),
+                    )
+                },
+            ),
         })
     }
 }
@@ -26581,6 +26551,8 @@ pub fn census_bare_fill_with_resolved_fn_sigs(
             services: services2.clone(),
             transparent_alias_rep: index.transparent_alias_rep.clone(),
             type_head_exposures: index.type_head_exposures.clone(),
+            file_modules: index.file_modules.clone(),
+            module_named_imports: index.module_named_imports.clone(),
         })
     }
 }
@@ -26625,6 +26597,8 @@ pub fn census_with_resolved_fn_sigs(
             services: fill.services.clone(),
             transparent_alias_rep: fill.transparent_alias_rep.clone(),
             type_head_exposures: fill.type_head_exposures.clone(),
+            file_modules: fill.file_modules.clone(),
+            module_named_imports: fill.module_named_imports.clone(),
         })
     }
 }
@@ -26668,6 +26642,14 @@ pub fn symbol_index_with_bare_fill(
                 tree.type_head_exposures.clone(),
                 closure.type_head_exposures.clone(),
             ),
+            file_modules: v1_rt::rc_map_merge(
+                tree.file_modules.clone(),
+                closure.file_modules.clone(),
+            ),
+            module_named_imports: v1_rt::rc_map_merge(
+                tree.module_named_imports.clone(),
+                closure.module_named_imports.clone(),
+            ),
         })
     }
 }
@@ -26753,6 +26735,14 @@ pub fn symbol_index_with_qualified_fill(
                 fill.type_head_exposures.clone(),
                 closure.type_head_exposures.clone(),
             ),
+            file_modules: v1_rt::rc_map_merge(
+                fill.file_modules.clone(),
+                closure.file_modules.clone(),
+            ),
+            module_named_imports: v1_rt::rc_map_merge(
+                fill.module_named_imports.clone(),
+                closure.module_named_imports.clone(),
+            ),
         })
     }
 }
@@ -26766,15 +26756,6 @@ pub fn direct_import_export_precedence_note() -> String {
     CACHED.with(|c: &String| c.clone())
 }
 
-pub fn overlay_skips_kernel_name(name: String) -> bool {
-    (((((crate::std_types::is_kernel_type(name.clone())
-        || crate::std_types::is_container_type(name.clone()))
-        || (name.clone() == "Unit".to_string()))
-        || (name.clone() == "Optional".to_string()))
-        || (name.clone() == "Present".to_string()))
-        || (name.clone() == "Absent".to_string()))
-}
-
 pub fn overlay_direct_import_exports(
     ancestry_str_bindings: Rc<HashMap<String, Rc<TypeBinding>>>,
     resolved_imports: Rc<Vec<Rc<ResolvedImport>>>,
@@ -26810,7 +26791,7 @@ pub fn overlay_direct_import_exports(
                 selected.iter().cloned().fold(
                     acc.clone(),
                     |bacc: Rc<HashMap<String, Rc<TypeBinding>>>, name: String| {
-                        if overlay_skips_kernel_name(name.clone()) {
+                        if crate::v1_compiler_infer_env::overlay_skips_kernel_name(name.clone()) {
                             bacc.clone()
                         } else {
                             match v1_rt::map_get(&export_surface.str_bindings.clone(), name.clone())
@@ -27547,25 +27528,18 @@ pub fn build_type_env(
             source_indices.clone(),
         );
         let parent_inductive_fields = match scope_parents.clone().first().cloned() {
-            Some(head_parent) => Rc::new(
-                scope_parents
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .collect::<Vec<_>>(),
-            )
-            .iter()
-            .cloned()
-            .fold(
-                head_parent.inductive_fields.clone(),
-                |acc: Rc<HashMap<String, Rc<Vec<Rc<InductiveField>>>>>, parent: Rc<TypeEnv>| {
-                    crate::v1_compiler_infer_env::merge_inductive_fields(
-                        acc,
-                        parent.inductive_fields.clone(),
-                    )
-                },
-            ),
+            Some(head_parent) => Rc::new(v1_rt::list_skip(&scope_parents.clone(), 1))
+                .iter()
+                .cloned()
+                .fold(
+                    head_parent.inductive_fields.clone(),
+                    |acc: Rc<HashMap<String, Rc<Vec<Rc<InductiveField>>>>>, parent: Rc<TypeEnv>| {
+                        crate::v1_compiler_infer_env::merge_inductive_fields(
+                            acc,
+                            parent.inductive_fields.clone(),
+                        )
+                    },
+                ),
             std::option::Option::None => {
                 v1_rt::rc_empty_map::<String, Rc<Vec<Rc<InductiveField>>>>()
             }
@@ -28161,25 +28135,18 @@ pub fn build_type_env_unresolved(
             source_indices.clone(),
         );
         let parent_inductive_fields = match scope_parents.clone().first().cloned() {
-            Some(head_parent) => Rc::new(
-                scope_parents
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .collect::<Vec<_>>(),
-            )
-            .iter()
-            .cloned()
-            .fold(
-                head_parent.inductive_fields.clone(),
-                |acc: Rc<HashMap<String, Rc<Vec<Rc<InductiveField>>>>>, parent: Rc<TypeEnv>| {
-                    crate::v1_compiler_infer_env::merge_inductive_fields(
-                        acc,
-                        parent.inductive_fields.clone(),
-                    )
-                },
-            ),
+            Some(head_parent) => Rc::new(v1_rt::list_skip(&scope_parents.clone(), 1))
+                .iter()
+                .cloned()
+                .fold(
+                    head_parent.inductive_fields.clone(),
+                    |acc: Rc<HashMap<String, Rc<Vec<Rc<InductiveField>>>>>, parent: Rc<TypeEnv>| {
+                        crate::v1_compiler_infer_env::merge_inductive_fields(
+                            acc,
+                            parent.inductive_fields.clone(),
+                        )
+                    },
+                ),
             std::option::Option::None => {
                 v1_rt::rc_empty_map::<String, Rc<Vec<Rc<InductiveField>>>>()
             }
@@ -28511,13 +28478,7 @@ pub fn fold_module_contributions(
                     std::option::Option::None => svc_locals.clone(),
                 };
                 {
-                    let __tco_0 = Rc::new(
-                        remaining
-                            .iter()
-                            .cloned()
-                            .skip(1 as usize)
-                            .collect::<Vec<_>>(),
-                    );
+                    let __tco_0 = Rc::new(v1_rt::list_skip(&remaining, 1));
                     let __tco_1 =
                         v1_rt::rc_list_push(resolved_items, contribution.resolved_item.clone());
                     let __tco_2 = next_func_sigs.clone();
@@ -31639,18 +31600,19 @@ pub fn enum_variant_shape_sets_for_item(
     acc: Rc<EnumVariantShapeSets>,
     item: Rc<Node>,
     si: Rc<HashMap<String, Rc<NewlineIndex>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> Rc<EnumVariantShapeSets> {
     {
         let item_name = crate::v1_std_core::authored_name_at(si.clone(), item.clone());
-        let is_enum = match v1_rt::map_get(&type_summaries, item_name.clone()) {
-            Some(summary) => match (*summary.repr.clone()).clone() {
-                TypeRepr::EnumRepr { unit_only: _, .. } => true,
-                _ => false,
-            },
-            std::option::Option::None => false,
-        };
-        if is_enum.clone() {
+        if match (*crate::v1_compiler_infer_emit_info::is_enum_in_summaries(
+            type_summaries.clone(),
+            item_name.clone(),
+        ))
+        .clone()
+        {
+            TypeSummaryQuestion::QuestionDecided { value: v, .. } => v.clone(),
+            _ => false,
+        } {
             item.children.clone().iter().cloned().fold(
                 acc,
                 |vacc: Rc<EnumVariantShapeSets>, variant: Rc<Node>| {
@@ -31692,7 +31654,7 @@ pub fn enum_variant_shape_sets_for_item(
 
 pub fn build_enum_variant_shape_sets(
     modules: Rc<Vec<Rc<TypedModule>>>,
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
 ) -> Rc<EnumVariantShapeSets> {
     modules.iter().cloned().fold(
         Rc::new(EnumVariantShapeSets {
@@ -31817,7 +31779,7 @@ pub fn build_emit_graph_info(
             std::option::Option::None => crate::v1_compiler_infer_env::empty_symbol_index(),
         };
         let init = Rc::new(EmitInfoBuildState {
-            type_summaries: v1_rt::rc_empty_map::<String, Rc<TypeSummary>>(),
+            type_summaries: crate::v1_compiler_infer_emit_info::empty_type_summary_index(),
             type_decl_items:
                 crate::v1_compiler_infer_emit_info::type_decl_index_with_qualified_names(
                     crate::v1_compiler_infer_emit_info::empty_type_decl_index(),
diff --git a/src/v1/stage0/src/v1_compiler_infer_access.rs b/src/v1/stage0/src/v1_compiler_infer_access.rs
index 135f7d12523..c22068e6c1a 100644
--- a/src/v1/stage0/src/v1_compiler_infer_access.rs
+++ b/src/v1/stage0/src/v1_compiler_infer_access.rs
@@ -86,7 +86,7 @@ pub fn keyed_collection_parts(
         && ((n.children.clone().len() as i64) >= 2))
     {
         match n.children.clone().first().cloned() {
-            Some(key_child) => match n.children.clone().iter().cloned().skip(1 as usize).next() {
+            Some(key_child) => match n.children.clone().get((1) as usize).cloned() {
                 Some(value_child) => Some(Rc::new(KeyedCollectionParts {
                     key_type: crate::v1_compiler_infer_types::resolved_type(key_child.clone()),
                     value_type: crate::v1_compiler_infer_types::resolved_type(value_child.clone()),
diff --git a/src/v1/stage0/src/v1_compiler_infer_emit_info.rs b/src/v1/stage0/src/v1_compiler_infer_emit_info.rs
index fc2047dca7a..fd2695c6877 100644
--- a/src/v1/stage0/src/v1_compiler_infer_emit_info.rs
+++ b/src/v1/stage0/src/v1_compiler_infer_emit_info.rs
@@ -2,21 +2,36 @@
 // Source module: v1.compiler.infer_emit_info
 
 use self::DataVariantWireSpelling::*;
+use self::TypeDeclOccurrenceBinding::*;
 use self::TypeDeclReferenceRoute::*;
 use self::TypeDeclResolution::*;
 use self::TypeRepr::*;
+use self::TypeSummaryLookup::*;
+use self::TypeSummaryQuestion::*;
+pub use crate::gunbc_structural_realization_bindings::kernel_mint_declaration_rows;
 use crate::std_decl_ref::DeclField::{NamedField, TypeParameter, WholeDeclaration};
 pub use crate::std_decl_ref::{DeclField, DeclarationRef};
 pub use crate::std_dissolution::DissolutionCondition;
 use crate::std_dissolution::DissolutionCondition::*;
 pub use crate::std_dissolution::{dissolution_description, unbound_dissolution};
+pub use crate::std_literal_elaboration::kernel_mint_declaration_for;
+pub use crate::std_literal_elaboration::KernelMintDeclarationLookup;
+use crate::std_literal_elaboration::KernelMintDeclarationLookup::{
+    KernelMintDeclarationAbsent, KernelMintDeclarationAmbiguous, KernelMintDeclarationFound,
+};
 pub use crate::std_types::is_kernel_type;
 pub use crate::std_types::SourceSpan;
 pub use crate::v1_compiler_artifact::RenderTarget;
 use crate::v1_compiler_artifact::RenderTarget::Rust;
 pub use crate::v1_compiler_coercion::{declaration_realization, realized_checkpoint};
-pub use crate::v1_compiler_infer_env::{empty_symbol_index, empty_type_env, symbol_index_lookup};
-pub use crate::v1_compiler_infer_env::{SymbolIndex, TypeEnv};
+use crate::v1_compiler_infer_env::BareOccurrenceBinding::{
+    BareOccurrenceDeclaredInItsFile, BareOccurrenceImportedByName, BareOccurrenceIsKernelName,
+    BareOccurrenceUndecided,
+};
+pub use crate::v1_compiler_infer_env::{
+    bare_occurrence_binding, empty_symbol_index, empty_type_env, symbol_index_lookup,
+};
+pub use crate::v1_compiler_infer_env::{BareOccurrenceBinding, SymbolIndex, TypeEnv};
 use crate::v1_compiler_infer_types::TextJudgment::{TextJudgedIn, TextNotAsked};
 use crate::v1_compiler_infer_types::TextNotAskedReason::{
     TextNotAskedForCallableComponentResidue, TextNotAskedInVariantFieldSummary,
@@ -77,6 +92,7 @@ impl TypeRepr {
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
 pub struct TypeSummary {
     pub name: String,
+    pub key: String,
     pub repr: Rc<TypeRepr>,
     pub field_summaries: Rc<HashMap<String, Rc<FieldSummary>>>,
     pub field_type_map: Rc<HashMap<String, String>>,
@@ -86,6 +102,173 @@ pub struct TypeSummary {
     pub has_fn_fields: bool,
 }
 
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct TypeSummaryIndex {
+    pub by_key: Rc<HashMap<String, Rc<TypeSummary>>>,
+    pub keys_by_leaf: Rc<HashMap<String, Rc<Vec<String>>>>,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum TypeSummaryLookup {
+    TypeSummaryFound { summary: Rc<TypeSummary> },
+    TypeSummaryLeafAmbiguous { leaf: String },
+    TypeSummaryNotDeclared,
+}
+
+pub fn empty_type_summary_index() -> Rc<TypeSummaryIndex> {
+    Rc::new(TypeSummaryIndex {
+        by_key: v1_rt::rc_empty_map::<String, Rc<TypeSummary>>(),
+        keys_by_leaf: v1_rt::rc_empty_map::<String, Rc<Vec<String>>>(),
+    })
+}
+
+pub fn type_summary_index_insert(
+    index: Rc<TypeSummaryIndex>,
+    key: String,
+    leaf: String,
+    summary: Rc<TypeSummary>,
+) -> Rc<TypeSummaryIndex> {
+    Rc::new(TypeSummaryIndex {
+        by_key: v1_rt::rc_map_insert(index.by_key.clone(), key.clone(), summary.clone()),
+        keys_by_leaf: v1_rt::rc_map_insert(
+            index.keys_by_leaf.clone(),
+            leaf.clone(),
+            type_decl_leaf_identities_with(
+                v1_rt::map_get(&index.keys_by_leaf.clone(), leaf.clone()),
+                key.clone(),
+            ),
+        ),
+    })
+}
+
+pub fn type_summary_keys_of_leaf(index: Rc<TypeSummaryIndex>, leaf: String) -> Rc<Vec<String>> {
+    match v1_rt::map_get(&index.keys_by_leaf.clone(), leaf.clone()) {
+        Some(keys) => keys.clone(),
+        std::option::Option::None => Rc::new(vec![]),
+    }
+}
+
+pub fn type_summary_at_key(index: Rc<TypeSummaryIndex>, key: String) -> Rc<TypeSummaryLookup> {
+    match v1_rt::map_get(&index.by_key.clone(), key.clone()) {
+        Some(summary) => Rc::new(TypeSummaryLookup::TypeSummaryFound {
+            summary: summary.clone(),
+        }),
+        std::option::Option::None => Rc::new(TypeSummaryLookup::TypeSummaryNotDeclared),
+    }
+}
+
+pub fn type_summary_by_leaf(index: Rc<TypeSummaryIndex>, leaf: String) -> Rc<TypeSummaryLookup> {
+    {
+        let keys = type_summary_keys_of_leaf(index.clone(), leaf.clone());
+        if ((keys.clone().len() as i64) == 1) {
+            keys.iter().cloned().fold(
+                Rc::new(TypeSummaryLookup::TypeSummaryNotDeclared),
+                |_acc: Rc<TypeSummaryLookup>, key: String| {
+                    type_summary_at_key(index.clone(), key.clone())
+                },
+            )
+        } else {
+            if ((keys.clone().len() as i64) > 1) {
+                Rc::new(TypeSummaryLookup::TypeSummaryLeafAmbiguous { leaf: leaf.clone() })
+            } else {
+                Rc::new(TypeSummaryLookup::TypeSummaryNotDeclared)
+            }
+        }
+    }
+}
+
+pub fn type_summary_lookup(index: Rc<TypeSummaryIndex>, key: String) -> Rc<TypeSummaryLookup> {
+    stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, || {
+        match v1_rt::map_get(&index.by_key.clone(), key.clone()) {
+            Some(summary) => Rc::new(TypeSummaryLookup::TypeSummaryFound {
+                summary: summary.clone(),
+            }),
+            std::option::Option::None => {
+                if v1_rt::contains(key.clone(), "::".to_string()) {
+                    {
+                        let parts = Rc::new(
+                            key.clone()
+                                .split(&"::".to_string())
+                                .map(|s| s.to_string())
+                                .collect::<Vec<_>>(),
+                        );
+                        let enum_part = Rc::new(v1_rt::list_take(
+                            &parts.clone(),
+                            v1_rt::int_sub((parts.clone().len() as i64), 1),
+                        ))
+                        .join(&"::".to_string());
+                        let variant_part = match parts.clone().last().cloned() {
+                            Some(v) => v.clone(),
+                            std::option::Option::None => "".to_string(),
+                        };
+                        match (*type_summary_lookup(index.clone(), enum_part.clone())).clone() {
+                            TypeSummaryLookup::TypeSummaryFound { summary: owner, .. } => {
+                                type_summary_at_key(
+                                    index.clone(),
+                                    variant_summary_key(owner.key.clone(), variant_part.clone()),
+                                )
+                            }
+                            TypeSummaryLookup::TypeSummaryLeafAmbiguous { leaf: l, .. } => {
+                                Rc::new(TypeSummaryLookup::TypeSummaryLeafAmbiguous {
+                                    leaf: l.clone(),
+                                })
+                            }
+                            TypeSummaryLookup::TypeSummaryNotDeclared => {
+                                Rc::new(TypeSummaryLookup::TypeSummaryNotDeclared)
+                            }
+                        }
+                    }
+                } else {
+                    if v1_rt::contains(key.clone(), ".".to_string()) {
+                        Rc::new(TypeSummaryLookup::TypeSummaryNotDeclared)
+                    } else {
+                        type_summary_by_leaf(index.clone(), key.clone())
+                    }
+                }
+            }
+        }
+    })
+}
+
+pub fn type_summary_of_reference(
+    index: Rc<TypeSummaryIndex>,
+    decls: Rc<TypeDeclIndex>,
+    type_expr: Rc<Node>,
+    source_indices: Rc<HashMap<String, Rc<NewlineIndex>>>,
+) -> Rc<TypeSummaryLookup> {
+    match (*resolve_type_decl_reference(decls.clone(), type_expr.clone(), source_indices.clone()))
+        .clone()
+    {
+        TypeDeclResolution::TypeDeclResolved { identity, .. } => {
+            type_summary_at_key(index.clone(), identity.clone())
+        }
+        TypeDeclResolution::TypeDeclLeafAmbiguous { leaf: l, .. } => {
+            Rc::new(TypeSummaryLookup::TypeSummaryLeafAmbiguous { leaf: l.clone() })
+        }
+        TypeDeclResolution::TypeDeclKernelSpellingUndecided { leaf: l, .. } => {
+            Rc::new(TypeSummaryLookup::TypeSummaryLeafAmbiguous { leaf: l.clone() })
+        }
+        TypeDeclResolution::TypeDeclNotDeclared => {
+            Rc::new(TypeSummaryLookup::TypeSummaryNotDeclared)
+        }
+    }
+}
+
+pub fn type_summary_decided(index: Rc<TypeSummaryIndex>, key: String) -> Option<Rc<TypeSummary>> {
+    match (*type_summary_lookup(index.clone(), key.clone())).clone() {
+        TypeSummaryLookup::TypeSummaryFound {
+            summary: summary, ..
+        } => Some(summary.clone()),
+        TypeSummaryLookup::TypeSummaryLeafAmbiguous { leaf: _, .. } => std::option::Option::None,
+        TypeSummaryLookup::TypeSummaryNotDeclared => std::option::Option::None,
+    }
+}
+
+pub fn type_summary_values(index: Rc<TypeSummaryIndex>) -> Rc<Vec<Rc<TypeSummary>>> {
+    Rc::new(v1_rt::map_values(&index.by_key.clone()))
+}
+
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
 pub struct FieldTypeMapBuild {
     pub field_types: Rc<HashMap<String, String>>,
@@ -231,6 +414,31 @@ pub struct TypeDeclIndex {
     pub qualified_names: Rc<SymbolIndex>,
 }
 
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum TypeDeclOccurrenceBinding {
+    OccurrenceDeclaredHere { identity: String },
+    OccurrenceImported { identity: String },
+    OccurrenceIsKernelName,
+    OccurrenceUndecided,
+}
+impl TypeDeclOccurrenceBinding {
+    pub fn identity(&self) -> String {
+        match self {
+            TypeDeclOccurrenceBinding::OccurrenceDeclaredHere {
+                identity: __val, ..
+            } => __val.clone(),
+            TypeDeclOccurrenceBinding::OccurrenceImported {
+                identity: __val, ..
+            } => __val.clone(),
+            TypeDeclOccurrenceBinding::OccurrenceIsKernelName => {
+                panic!("no identity on unit variant")
+            }
+            TypeDeclOccurrenceBinding::OccurrenceUndecided => panic!("no identity on unit variant"),
+        }
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
 #[serde(tag = "_variant")]
 pub enum TypeDeclResolution {
@@ -401,6 +609,8 @@ pub enum TypeDeclReferenceRoute {
     RouteDeclaringSpan,
     RouteReferencingModuleDeclarer,
     RouteQualifiedSpelling,
+    RouteReferencingModuleImport,
+    RouteKernelMint,
     RouteLeafSpelling,
 }
 
@@ -465,7 +675,7 @@ pub fn resolve_type_decl_routed(
                     let referencing_module_identity = match (*by_spelling.clone()).clone() {
                         TypeDeclResolution::TypeDeclLeafAmbiguous { leaf: l, .. } => {
                             if (authored.clone() == l.clone()) {
-                                type_decl_referencing_module_declarer(
+                                type_decl_occurrence_identity(
                                     index.clone(),
                                     l.clone(),
                                     type_expr.clone(),
@@ -482,11 +692,12 @@ pub fn resolve_type_decl_routed(
                     };
                     match referencing_module_identity.clone() {
                         Some(identity) => Rc::new(TypeDeclRoutedResolution {
-                            route: if (authored.clone() == leaf.clone()) {
-                                TypeDeclReferenceRoute::RouteReferencingModuleDeclarer
-                            } else {
-                                TypeDeclReferenceRoute::RouteQualifiedSpelling
-                            },
+                            route: type_decl_spelling_route(
+                                index.clone(),
+                                authored.clone(),
+                                leaf.clone(),
+                                type_expr.clone(),
+                            ),
                             resolution: type_decl_resolution_at_identity(
                                 index.clone(),
                                 identity.clone(),
@@ -519,6 +730,136 @@ pub fn type_decl_qualifier_declarer(index: Rc<TypeDeclIndex>, authored: String)
     }
 }
 
+pub fn type_decl_kernel_mint_declarer(index: Rc<TypeDeclIndex>, leaf: String) -> Option<String> {
+    match (*crate::std_literal_elaboration::kernel_mint_declaration_for(
+        kernel_mint_declaration_rows(),
+        leaf.clone(),
+    ))
+    .clone()
+    {
+        KernelMintDeclarationLookup::KernelMintDeclarationFound { declaration: d, .. } => {
+            let identity = type_decl_identity(d.module_path.clone(), d.decl_name.clone());
+            match v1_rt::map_get(&index.by_identity.clone(), identity.clone()) {
+                Some(_) => Some(identity.clone()),
+                std::option::Option::None => std::option::Option::None,
+            }
+        }
+        KernelMintDeclarationLookup::KernelMintDeclarationAbsent => std::option::Option::None,
+        KernelMintDeclarationLookup::KernelMintDeclarationAmbiguous { row_count: _, .. } => {
+            std::option::Option::None
+        }
+    }
+}
+
+pub fn type_decl_spelling_route(
+    index: Rc<TypeDeclIndex>,
+    authored: String,
+    leaf: String,
+    reference: Rc<Node>,
+) -> TypeDeclReferenceRoute {
+    if (authored.clone() != leaf.clone()) {
+        TypeDeclReferenceRoute::RouteQualifiedSpelling
+    } else {
+        match (*type_decl_occurrence_binding(index.clone(), leaf.clone(), reference.clone()))
+            .clone()
+        {
+            TypeDeclOccurrenceBinding::OccurrenceDeclaredHere { identity: _, .. } => {
+                TypeDeclReferenceRoute::RouteReferencingModuleDeclarer
+            }
+            TypeDeclOccurrenceBinding::OccurrenceIsKernelName => {
+                TypeDeclReferenceRoute::RouteKernelMint
+            }
+            TypeDeclOccurrenceBinding::OccurrenceImported { identity: _, .. } => {
+                TypeDeclReferenceRoute::RouteReferencingModuleImport
+            }
+            TypeDeclOccurrenceBinding::OccurrenceUndecided => {
+                TypeDeclReferenceRoute::RouteLeafSpelling
+            }
+        }
+    }
+}
+
+pub fn type_decl_occurrence_identity(
+    index: Rc<TypeDeclIndex>,
+    leaf: String,
+    reference: Rc<Node>,
+) -> Option<String> {
+    match (*type_decl_occurrence_binding(index.clone(), leaf.clone(), reference.clone())).clone() {
+        TypeDeclOccurrenceBinding::OccurrenceDeclaredHere {
+            identity: identity, ..
+        } => Some(identity.clone()),
+        TypeDeclOccurrenceBinding::OccurrenceIsKernelName => {
+            type_decl_kernel_mint_declarer(index.clone(), leaf.clone())
+        }
+        TypeDeclOccurrenceBinding::OccurrenceImported {
+            identity: identity, ..
+        } => Some(identity.clone()),
+        TypeDeclOccurrenceBinding::OccurrenceUndecided => std::option::Option::None,
+    }
+}
+
+pub fn type_decl_occurrence_binding(
+    index: Rc<TypeDeclIndex>,
+    leaf: String,
+    reference: Rc<Node>,
+) -> Rc<TypeDeclOccurrenceBinding> {
+    match (*crate::v1_compiler_infer_env::bare_occurrence_binding(
+        index.qualified_names.clone(),
+        leaf.clone(),
+        reference.clone(),
+    ))
+    .clone()
+    {
+        BareOccurrenceBinding::BareOccurrenceDeclaredInItsFile {
+            declaration: decl, ..
+        } => match type_decl_identity_of_declaration(index.clone(), decl.clone()) {
+            Some(identity) => Rc::new(TypeDeclOccurrenceBinding::OccurrenceDeclaredHere {
+                identity: identity.clone(),
+            }),
+            std::option::Option::None => Rc::new(TypeDeclOccurrenceBinding::OccurrenceUndecided),
+        },
+        BareOccurrenceBinding::BareOccurrenceImportedByName {
+            module_path: from_module,
+            declaration: decl,
+            ..
+        } => match type_decl_identity_of_declaration(index.clone(), decl.clone()) {
+            Some(identity) => Rc::new(TypeDeclOccurrenceBinding::OccurrenceImported {
+                identity: identity.clone(),
+            }),
+            std::option::Option::None => {
+                let imported = type_decl_identity(from_module.clone(), leaf.clone());
+                match v1_rt::map_get(&index.by_identity.clone(), imported.clone()) {
+                    Some(_) => Rc::new(TypeDeclOccurrenceBinding::OccurrenceImported {
+                        identity: imported.clone(),
+                    }),
+                    std::option::Option::None => {
+                        Rc::new(TypeDeclOccurrenceBinding::OccurrenceUndecided)
+                    }
+                }
+            }
+        },
+        BareOccurrenceBinding::BareOccurrenceIsKernelName => {
+            Rc::new(TypeDeclOccurrenceBinding::OccurrenceIsKernelName)
+        }
+        BareOccurrenceBinding::BareOccurrenceUndecided => {
+            Rc::new(TypeDeclOccurrenceBinding::OccurrenceUndecided)
+        }
+    }
+}
+
+pub fn type_decl_identity_of_declaration(
+    index: Rc<TypeDeclIndex>,
+    decl: Rc<Node>,
+) -> Option<String> {
+    match decl.ident_span.clone() {
+        Some(sp) => v1_rt::map_get(
+            &index.identity_by_declaring_span.clone(),
+            declaring_span_key(sp.clone()),
+        ),
+        std::option::Option::None => std::option::Option::None,
+    }
+}
+
 pub fn type_decl_index_with_qualified_names(
     index: Rc<TypeDeclIndex>,
     qualified_names: Rc<SymbolIndex>,
@@ -535,53 +876,12 @@ pub fn type_decl_index_with_qualified_names(
 pub fn referencing_module_declarer_route_dissolves_on() -> Rc<DissolutionCondition> {
     thread_local! {
         static CACHED: Rc<DissolutionCondition> = {
-            crate::std_dissolution::unbound_dissolution("RouteReferencingModuleDeclarer and RouteQualifiedSpelling dissolve when the type environment's declaration bodies carry Node.declaration on every member type reference, stamped by v1.compiler.infer_resolve reference_with_declaration in the DECLARING module's scope, so a bare reference resolved through lookup_type_for hands the emitter stamped members: v1.tests.claim.carrier_realization_census reports zero emitter_decl_route referencing_module_declarer or qualified_spelling rows over the self-host and dag closures. Stamping one declaration, or one closure, is not that capability. Then both arms, type_decl_referencing_module_declarer and type_decl_qualifier_declarer are deleted and such a reference refuses unless carried.".to_string())
+            crate::std_dissolution::unbound_dissolution("RouteReferencingModuleDeclarer, RouteReferencingModuleImport, RouteQualifiedSpelling and RouteKernelMint dissolve when the type environment's declaration bodies carry Node.declaration on every member type reference, stamped by v1.compiler.infer_resolve reference_with_declaration in the DECLARING module's scope, so a bare reference resolved through lookup_type_for hands the emitter stamped members: v1.tests.claim.carrier_realization_census reports zero emitter_decl_route referencing_module_declarer, referencing_module_import, qualified_spelling or kernel_mint rows over the self-host and dag closures. Stamping one declaration, or one closure, is not that capability. Then type_decl_occurrence_binding and type_decl_qualifier_declarer are deleted and such a reference refuses unless carried.".to_string())
         };
     }
     CACHED.with(|c: &Rc<DissolutionCondition>| c.clone())
 }
 
-pub fn type_decl_referencing_module_declarer(
-    index: Rc<TypeDeclIndex>,
-    leaf: String,
-    reference: Rc<Node>,
-) -> Option<String> {
-    {
-        let local = Rc::new({
-            let mut __result = Vec::new();
-            for identity in type_decl_identities_of_leaf(index.clone(), leaf.clone())
-                .iter()
-                .cloned()
-            {
-                if match v1_rt::map_get(&index.by_identity.clone(), identity.clone()) {
-                    Some(decl) => {
-                        (decl.span.clone().file.clone() == reference.span.clone().file.clone())
-                    }
-                    std::option::Option::None => false,
-                } {
-                    __result.push(identity);
-                }
-            }
-            __result
-        });
-        if (local
-            .iter()
-            .cloned()
-            .fold(0, |n: i64, _identity: String| v1_rt::int_add(n, 1))
-            == 1)
-        {
-            local
-                .iter()
-                .cloned()
-                .fold(std::option::Option::None, |acc: _, identity: String| {
-                    Some(identity.clone())
-                })
-        } else {
-            std::option::Option::None
-        }
-    }
-}
-
 pub fn resolve_type_decl_reference(
     index: Rc<TypeDeclIndex>,
     type_expr: Rc<Node>,
@@ -602,6 +902,10 @@ pub fn type_decl_routed_resolution_label(routed: Rc<TypeDeclRoutedResolution>) -
                 "referencing_module_declarer".to_string()
             }
             TypeDeclReferenceRoute::RouteQualifiedSpelling => "qualified_spelling".to_string(),
+            TypeDeclReferenceRoute::RouteReferencingModuleImport => {
+                "referencing_module_import".to_string()
+            }
+            TypeDeclReferenceRoute::RouteKernelMint => "kernel_mint".to_string(),
             TypeDeclReferenceRoute::RouteLeafSpelling => "leaf_spelling".to_string(),
         };
         match (*routed.resolution.clone()).clone() {
@@ -628,7 +932,7 @@ pub fn type_decl_routed_resolution_label(routed: Rc<TypeDeclRoutedResolution>) -
 
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
 pub struct EmitGraphInfo {
-    pub type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    pub type_summaries: Rc<TypeSummaryIndex>,
     pub type_decl_items: Rc<TypeDeclIndex>,
     pub data_variant_wire_spellings: Rc<HashMap<String, Rc<DataVariantWireSpelling>>>,
     pub fn_decl_items: Rc<HashMap<String, Rc<Node>>>,
@@ -654,7 +958,7 @@ pub struct EmitGraphInfo {
 
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
 pub struct EmitInfoBuildState {
-    pub type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    pub type_summaries: Rc<TypeSummaryIndex>,
     pub type_decl_items: Rc<TypeDeclIndex>,
     pub fn_decl_items: Rc<HashMap<String, Rc<Node>>>,
     pub structural_alias_fn_surface_names: Rc<HashMap<String, Rc<Vec<String>>>>,
@@ -664,7 +968,7 @@ pub struct EmitInfoBuildState {
 pub fn empty_emit_graph_info() -> Rc<EmitGraphInfo> {
     Rc::new(EmitGraphInfo {
         item_leaf_owner_modules: v1_rt::rc_empty_map::<String, Rc<LeafOwner>>(),
-        type_summaries: v1_rt::rc_empty_map::<String, Rc<TypeSummary>>(),
+        type_summaries: empty_type_summary_index(),
         type_decl_items: empty_type_decl_index(),
         data_variant_wire_spellings: v1_rt::rc_empty_map::<String, Rc<DataVariantWireSpelling>>(),
         fn_decl_items: v1_rt::rc_empty_map::<String, Rc<Node>>(),
@@ -804,7 +1108,80 @@ pub fn lookup_emit_type_summary(
     emit_info: Rc<EmitGraphInfo>,
     type_name: String,
 ) -> Option<Rc<TypeSummary>> {
-    v1_rt::map_get(&emit_info.type_summaries.clone(), type_name.clone())
+    type_summary_decided(emit_info.type_summaries.clone(), type_name.clone())
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum TypeSummaryQuestion {
+    QuestionDecided { value: bool },
+    QuestionNameAmbiguous { leaf: String },
+    QuestionNotDeclared,
+}
+
+pub fn type_summary_answer(
+    index: Rc<TypeSummaryIndex>,
+    key: String,
+    question: impl Fn(Rc<TypeSummary>) -> bool + Clone,
+) -> Rc<TypeSummaryQuestion> {
+    match (*type_summary_lookup(index.clone(), key.clone())).clone() {
+        TypeSummaryLookup::TypeSummaryFound {
+            summary: summary, ..
+        } => Rc::new(TypeSummaryQuestion::QuestionDecided {
+            value: question(summary.clone()),
+        }),
+        TypeSummaryLookup::TypeSummaryNotDeclared => {
+            Rc::new(TypeSummaryQuestion::QuestionNotDeclared)
+        }
+        TypeSummaryLookup::TypeSummaryLeafAmbiguous { leaf: leaf, .. } => {
+            let answers = type_summary_keys_of_leaf(index.clone(), leaf.clone())
+                .iter()
+                .cloned()
+                .fold(
+                    Rc::new(vec![]),
+                    |acc: Rc<Vec<bool>>, k: String| match v1_rt::map_get(
+                        &index.by_key.clone(),
+                        k.clone(),
+                    ) {
+                        Some(summary) => {
+                            v1_rt::rc_list_push(acc.clone(), question(summary.clone()))
+                        }
+                        std::option::Option::None => acc.clone(),
+                    },
+                );
+            if ((answers.clone().len() as i64) == 0) {
+                Rc::new(TypeSummaryQuestion::QuestionNotDeclared)
+            } else {
+                if {
+                    let mut __all = true;
+                    for a in answers.iter().cloned() {
+                        if !(a.clone()) {
+                            __all = false;
+                            break;
+                        }
+                    }
+                    __all
+                } {
+                    Rc::new(TypeSummaryQuestion::QuestionDecided { value: true })
+                } else {
+                    if {
+                        let mut __all = true;
+                        for a in answers.iter().cloned() {
+                            if !(!a.clone()) {
+                                __all = false;
+                                break;
+                            }
+                        }
+                        __all
+                    } {
+                        Rc::new(TypeSummaryQuestion::QuestionDecided { value: false })
+                    } else {
+                        Rc::new(TypeSummaryQuestion::QuestionNameAmbiguous { leaf: leaf.clone() })
+                    }
+                }
+            }
+        }
+    }
 }
 
 pub fn emit_graph_records_type_decl(
@@ -826,10 +1203,8 @@ pub fn emit_graph_records_fn_decl(item: Rc<Node>) -> bool {
     (item.module_item_kind.clone() == ParsedModuleItemKind::ModuleItemFunction)
 }
 
-pub fn derive_variant_to_enum(
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
-) -> Rc<HashMap<String, String>> {
-    Rc::new(v1_rt::map_values(&type_summaries))
+pub fn derive_variant_to_enum(type_summaries: Rc<TypeSummaryIndex>) -> Rc<HashMap<String, String>> {
+    type_summary_values(type_summaries.clone())
         .iter()
         .cloned()
         .fold(
@@ -855,7 +1230,7 @@ pub fn derive_variant_to_enum(
                                 std::option::Option::None => v1_rt::rc_map_insert(
                                     inner.clone(),
                                     vn.clone(),
-                                    summary.name.clone(),
+                                    summary.key.clone(),
                                 ),
                             },
                         )
@@ -865,78 +1240,93 @@ pub fn derive_variant_to_enum(
         )
 }
 
-pub fn is_known_variant(
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
-    name: String,
-) -> bool {
-    {
-        let mut __found = false;
-        for summary in Rc::new(v1_rt::map_values(&type_summaries)).iter().cloned() {
-            if match (*summary.repr.clone()).clone() {
-                TypeRepr::EnumRepr { unit_only: _, .. } => {
-                    crate::v1_compiler_infer_types::emit_map_has(
-                        summary.variant_name_set.clone(),
-                        name.clone(),
-                    )
-                }
-                _ => false,
-            } {
-                __found = true;
-                break;
-            }
-        }
-        __found
+pub fn is_known_variant(variant_to_enum: Rc<HashMap<String, String>>, name: String) -> bool {
+    v1_rt::map_contains_key(&variant_to_enum, name.clone())
+}
+
+pub fn summary_is_enum_with_variant(summary: Rc<TypeSummary>, variant_name: String) -> bool {
+    match (*summary.repr.clone()).clone() {
+        TypeRepr::EnumRepr { unit_only: _, .. } => crate::v1_compiler_infer_types::emit_map_has(
+            summary.variant_name_set.clone(),
+            variant_name.clone(),
+        ),
+        _ => false,
+    }
+}
+
+pub fn summary_is_enum(summary: Rc<TypeSummary>) -> bool {
+    match (*summary.repr.clone()).clone() {
+        TypeRepr::EnumRepr { unit_only: _, .. } => true,
+        _ => false,
     }
 }
 
 pub fn variant_belongs_to_enum(
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     variant_name: String,
     enum_name: String,
-) -> bool {
-    match v1_rt::map_get(&type_summaries, enum_name.clone()) {
-        Some(summary) => match (*summary.repr.clone()).clone() {
-            TypeRepr::EnumRepr { unit_only: _, .. } => {
-                crate::v1_compiler_infer_types::emit_map_has(
-                    summary.variant_name_set.clone(),
-                    variant_name.clone(),
-                )
-            }
-            _ => false,
-        },
-        std::option::Option::None => false,
-    }
+) -> Rc<TypeSummaryQuestion> {
+    type_summary_answer(type_summaries.clone(), enum_name.clone(), |summary| {
+        summary_is_enum_with_variant(summary.clone(), variant_name.clone())
+    })
 }
 
 pub fn is_enum_in_summaries(
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     type_name: String,
-) -> bool {
-    match v1_rt::map_get(&type_summaries, type_name.clone()) {
-        Some(summary) => match (*summary.repr.clone()).clone() {
-            TypeRepr::EnumRepr { unit_only: _, .. } => true,
-            _ => false,
-        },
-        std::option::Option::None => false,
-    }
+) -> Rc<TypeSummaryQuestion> {
+    type_summary_answer(type_summaries.clone(), type_name.clone(), |summary| {
+        summary_is_enum(summary.clone())
+    })
 }
 
 pub fn find_variant_parent(
-    type_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    type_summaries: Rc<TypeSummaryIndex>,
     variant_name: String,
     scope_enums: Rc<Vec<String>>,
 ) -> Option<String> {
-    Rc::new({
-        let mut __result = Vec::new();
+    if {
+        let mut __found = false;
         for en in scope_enums.iter().cloned() {
-            if variant_belongs_to_enum(type_summaries.clone(), variant_name.clone(), en.clone()) {
-                __result.push(en);
+            if match (*variant_belongs_to_enum(
+                type_summaries.clone(),
+                variant_name.clone(),
+                en.clone(),
+            ))
+            .clone()
+            {
+                TypeSummaryQuestion::QuestionNameAmbiguous { leaf: _, .. } => true,
+                _ => false,
+            } {
+                __found = true;
+                break;
             }
         }
-        __result
-    })
-    .first()
-    .cloned()
+        __found
+    } {
+        std::option::Option::None
+    } else {
+        Rc::new({
+            let mut __result = Vec::new();
+            for en in scope_enums.iter().cloned() {
+                if match (*variant_belongs_to_enum(
+                    type_summaries.clone(),
+                    variant_name.clone(),
+                    en.clone(),
+                ))
+                .clone()
+                {
+                    TypeSummaryQuestion::QuestionDecided { value: v, .. } => v.clone(),
+                    _ => false,
+                } {
+                    __result.push(en);
+                }
+            }
+            __result
+        })
+        .first()
+        .cloned()
+    }
 }
 
 pub fn field_value_shape_from_type_node(type_node: Rc<Node>) -> FieldValueShape {
@@ -1264,6 +1654,7 @@ pub fn build_type_summary(
                         source_indices.clone(),
                         item.clone(),
                     ),
+                    key: "".to_string(),
                     repr: Rc::new(TypeRepr::StructRepr),
                     field_summaries: build_struct_field_summaries(
                         item.clone(),
@@ -1293,6 +1684,7 @@ pub fn build_type_summary(
                         source_indices.clone(),
                         item.clone(),
                     ),
+                    key: "".to_string(),
                     repr: Rc::new(TypeRepr::EnumRepr {
                         unit_only: unit_only.clone(),
                     }),
@@ -1380,12 +1772,22 @@ pub struct FnReachRound {
     pub grew: bool,
 }
 
+pub fn fn_reach_target_keys(index: Rc<TypeSummaryIndex>, target: String) -> Rc<Vec<String>> {
+    match v1_rt::map_get(&index.by_key.clone(), target.clone()) {
+        Some(_) => Rc::new(vec![target.clone()]),
+        std::option::Option::None => v1_rt::concat(
+            type_summary_keys_of_leaf(index.clone(), target.clone()),
+            Rc::new(vec![target.clone()]),
+        ),
+    }
+}
+
 pub fn fn_reach_holds_directly(
     name: String,
-    summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    summaries: Rc<TypeSummaryIndex>,
     structural_alias_direct_fn_names: Rc<BTreeSet<String>>,
 ) -> bool {
-    match v1_rt::map_get(&summaries, name.clone()) {
+    match v1_rt::map_get(&summaries.by_key.clone(), name.clone()) {
         Some(s) => s.has_fn_fields.clone(),
         std::option::Option::None => {
             v1_rt::set_contains(&structural_alias_direct_fn_names, name.clone())
@@ -1395,26 +1797,34 @@ pub fn fn_reach_holds_directly(
 
 pub fn fn_reach_targets(
     name: String,
-    summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    summaries: Rc<TypeSummaryIndex>,
     structural_alias_fn_surface_names: Rc<HashMap<String, Rc<Vec<String>>>>,
 ) -> Rc<Vec<String>> {
-    match v1_rt::map_get(&summaries, name.clone()) {
-        Some(s) => v1_rt::concat(
-            Rc::new(v1_rt::map_values(&s.field_type_map.clone())),
-            s.field_import_surface_names.clone(),
-        ),
-        std::option::Option::None => {
-            match v1_rt::map_get(&structural_alias_fn_surface_names, name.clone()) {
-                Some(targets) => targets.clone(),
-                std::option::Option::None => Rc::new(vec![]),
+    {
+        let spelled = match v1_rt::map_get(&summaries.by_key.clone(), name.clone()) {
+            Some(s) => v1_rt::concat(
+                Rc::new(v1_rt::map_values(&s.field_type_map.clone())),
+                s.field_import_surface_names.clone(),
+            ),
+            std::option::Option::None => {
+                match v1_rt::map_get(&structural_alias_fn_surface_names, name.clone()) {
+                    Some(targets) => targets.clone(),
+                    std::option::Option::None => Rc::new(vec![]),
+                }
             }
-        }
+        };
+        spelled
+            .iter()
+            .cloned()
+            .fold(Rc::new(vec![]), |acc: Rc<Vec<String>>, t: String| {
+                v1_rt::concat(acc, fn_reach_target_keys(summaries.clone(), t.clone()))
+            })
     }
 }
 
 pub fn fn_reaching_names_fixpoint(
     mut __tco_loop_candidates: Rc<Vec<String>>,
-    mut __tco_loop_summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    mut __tco_loop_summaries: Rc<TypeSummaryIndex>,
     mut __tco_loop_structural_alias_fn_surface_names: Rc<HashMap<String, Rc<Vec<String>>>>,
     mut __tco_loop_structural_alias_direct_fn_names: Rc<BTreeSet<String>>,
     mut __tco_loop_reached: Rc<BTreeSet<String>>,
@@ -1497,13 +1907,13 @@ pub fn fn_reaching_names_fixpoint(
 }
 
 pub fn fn_reaching_names(
-    summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    summaries: Rc<TypeSummaryIndex>,
     structural_alias_fn_surface_names: Rc<HashMap<String, Rc<Vec<String>>>>,
     structural_alias_direct_fn_names: Rc<BTreeSet<String>>,
 ) -> Rc<BTreeSet<String>> {
     fn_reaching_names_fixpoint(
         v1_rt::concat(
-            Rc::new(v1_rt::map_keys(&summaries)),
+            Rc::new(v1_rt::map_keys(&summaries.by_key.clone())),
             Rc::new(v1_rt::map_keys(&structural_alias_fn_surface_names)),
         ),
         summaries.clone(),
@@ -1514,45 +1924,56 @@ pub fn fn_reaching_names(
 }
 
 pub fn close_fn_fields(
-    summaries: Rc<HashMap<String, Rc<TypeSummary>>>,
+    summaries: Rc<TypeSummaryIndex>,
     structural_alias_fn_surface_names: Rc<HashMap<String, Rc<Vec<String>>>>,
     structural_alias_direct_fn_names: Rc<BTreeSet<String>>,
-) -> Rc<HashMap<String, Rc<TypeSummary>>> {
+) -> Rc<TypeSummaryIndex> {
     {
         let reaching = fn_reaching_names(
             summaries.clone(),
             structural_alias_fn_surface_names.clone(),
             structural_alias_direct_fn_names.clone(),
         );
-        Rc::new(v1_rt::map_keys(&summaries)).iter().cloned().fold(
-            summaries.clone(),
-            |acc: Rc<HashMap<String, Rc<TypeSummary>>>, name: String| match v1_rt::map_get(
-                &summaries,
-                name.clone(),
-            ) {
-                Some(s) => {
-                    if (!s.has_fn_fields.clone() && v1_rt::set_contains(&reaching, name.clone())) {
-                        v1_rt::rc_map_insert(
-                            acc.clone(),
-                            name.clone(),
-                            Rc::new(TypeSummary {
-                                name: s.name.clone(),
-                                repr: s.repr.clone(),
-                                field_summaries: s.field_summaries.clone(),
-                                field_type_map: s.field_type_map.clone(),
-                                field_import_surface_names: s.field_import_surface_names.clone(),
-                                variant_name_set: s.variant_name_set.clone(),
-                                generic_param_names: s.generic_param_names.clone(),
-                                has_fn_fields: true,
-                            }),
-                        )
-                    } else {
-                        acc.clone()
-                    }
-                }
-                std::option::Option::None => acc.clone(),
-            },
-        )
+        Rc::new(TypeSummaryIndex {
+            by_key: Rc::new(v1_rt::map_keys(&summaries.by_key.clone()))
+                .iter()
+                .cloned()
+                .fold(
+                    summaries.by_key.clone(),
+                    |acc: Rc<HashMap<String, Rc<TypeSummary>>>, key: String| match v1_rt::map_get(
+                        &summaries.by_key.clone(),
+                        key.clone(),
+                    ) {
+                        Some(s) => {
+                            if (!s.has_fn_fields.clone()
+                                && v1_rt::set_contains(&reaching, key.clone()))
+                            {
+                                v1_rt::rc_map_insert(
+                                    acc.clone(),
+                                    key.clone(),
+                                    Rc::new(TypeSummary {
+                                        name: s.name.clone(),
+                                        key: s.key.clone(),
+                                        repr: s.repr.clone(),
+                                        field_summaries: s.field_summaries.clone(),
+                                        field_type_map: s.field_type_map.clone(),
+                                        field_import_surface_names: s
+                                            .field_import_surface_names
+                                            .clone(),
+                                        variant_name_set: s.variant_name_set.clone(),
+                                        generic_param_names: s.generic_param_names.clone(),
+                                        has_fn_fields: true,
+                                    }),
+                                )
+                            } else {
+                                acc.clone()
+                            }
+                        }
+                        std::option::Option::None => acc.clone(),
+                    },
+                ),
+            keys_by_leaf: summaries.keys_by_leaf.clone(),
+        })
     }
 }
 
@@ -1651,13 +2072,15 @@ pub fn add_emit_item_summary(
             state.clone()
         };
         match build_type_summary(item.clone(), source_indices.clone()) {
-            Some(summary) => {
+            Some(built) => {
+                let key = type_decl_identity(module_name.clone(), built.name.clone());
+                let summary = type_summary_with_key(built.clone(), key.clone());
                 let with_variants =
                     match (*summary.repr.clone()).clone() {
                         TypeRepr::EnumRepr { unit_only: _, .. } => {
                             item.children.clone().iter().cloned().fold(
                                 state.type_summaries.clone(),
-                                |acc: Rc<HashMap<String, Rc<TypeSummary>>>, variant: Rc<Node>| {
+                                |acc: Rc<TypeSummaryIndex>, variant: Rc<Node>| {
                                     if ((variant.children.clone().len() as i64) > 0) {
                                         {
                                             let v_has_fn = {
@@ -1688,15 +2111,19 @@ pub fn add_emit_item_summary(
                                                 summary.name.clone(),
                                                 vname.clone(),
                                             );
+                                            let variant_key =
+                                                variant_summary_key(key.clone(), vname.clone());
                                             let variant_field_types = build_field_type_map(
                                                 variant.children.clone(),
                                                 source_indices.clone(),
                                             );
-                                            v1_rt::rc_map_insert(
+                                            type_summary_index_insert(
                                                 acc.clone(),
+                                                variant_key.clone(),
                                                 qualified_vname.clone(),
                                                 Rc::new(TypeSummary {
                                                     name: qualified_vname.clone(),
+                                                    key: variant_key.clone(),
                                                     repr: Rc::new(TypeRepr::StructRepr),
                                                     field_summaries: build_struct_field_summaries(
                                                         variant.clone(),
@@ -1726,8 +2153,9 @@ pub fn add_emit_item_summary(
                         }
                         _ => state.type_summaries.clone(),
                     };
-                let next_summaries = v1_rt::rc_map_insert(
+                let next_summaries = type_summary_index_insert(
                     with_variants.clone(),
+                    key.clone(),
                     summary.name.clone(),
                     summary.clone(),
                 );
@@ -1748,6 +2176,20 @@ pub fn add_emit_item_summary(
     }
 }
 
+pub fn type_summary_with_key(summary: Rc<TypeSummary>, key: String) -> Rc<TypeSummary> {
+    Rc::new(TypeSummary {
+        name: summary.name.clone(),
+        key: key.clone(),
+        repr: summary.repr.clone(),
+        field_summaries: summary.field_summaries.clone(),
+        field_type_map: summary.field_type_map.clone(),
+        field_import_surface_names: summary.field_import_surface_names.clone(),
+        variant_name_set: summary.variant_name_set.clone(),
+        generic_param_names: summary.generic_param_names.clone(),
+        has_fn_fields: summary.has_fn_fields.clone(),
+    })
+}
+
 pub fn emit_dependency_registration_dissolve_on_note() -> Rc<DissolutionCondition> {
     thread_local! {
         static CACHED: Rc<DissolutionCondition> = {
@@ -1768,4 +2210,8 @@ pub struct RouteReferencingModuleDeclarer;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct RouteQualifiedSpelling;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct RouteReferencingModuleImport;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct RouteKernelMint;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct RouteLeafSpelling;
diff --git a/src/v1/stage0/src/v1_compiler_infer_env.rs b/src/v1/stage0/src/v1_compiler_infer_env.rs
index 3732f70645d..aa3df4f5f50 100644
--- a/src/v1/stage0/src/v1_compiler_infer_env.rs
+++ b/src/v1/stage0/src/v1_compiler_infer_env.rs
@@ -1,6 +1,7 @@
 // Generated by v1 compiler -- do not edit.
 // Source module: v1.compiler.infer_env
 
+use self::BareOccurrenceBinding::*;
 use self::GlobalBareLookupState::*;
 use self::TypeNodeDeclarationReading::*;
 use self::TypeNodeUnidentifiedCause::*;
@@ -351,6 +352,8 @@ pub struct SymbolIndex {
     pub services: Rc<HashMap<String, Rc<ServiceCensusEntry>>>,
     pub transparent_alias_rep: Rc<HashMap<String, String>>,
     pub type_head_exposures: Rc<HashMap<String, Rc<TypeHeadExposure>>>,
+    pub file_modules: Rc<HashMap<String, String>>,
+    pub module_named_imports: Rc<HashMap<String, Rc<HashMap<String, String>>>>,
 }
 
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
@@ -365,6 +368,8 @@ pub fn empty_symbol_index() -> Rc<SymbolIndex> {
         services: v1_rt::rc_empty_map::<String, Rc<ServiceCensusEntry>>(),
         transparent_alias_rep: v1_rt::rc_empty_map::<String, String>(),
         type_head_exposures: v1_rt::rc_empty_map::<String, Rc<TypeHeadExposure>>(),
+        file_modules: v1_rt::rc_empty_map::<String, String>(),
+        module_named_imports: v1_rt::rc_empty_map::<String, Rc<HashMap<String, String>>>(),
     })
 }
 
@@ -395,6 +400,210 @@ pub fn symbol_index_lookup(index: Rc<SymbolIndex>, qualified_name: String) -> Op
     v1_rt::map_get(&index.entries.clone(), qualified_name.clone())
 }
 
+pub fn overlay_skips_kernel_name(name: String) -> bool {
+    (((((crate::std_types::is_kernel_type(name.clone())
+        || crate::std_types::is_container_type(name.clone()))
+        || (name.clone() == "Unit".to_string()))
+        || (name.clone() == "Optional".to_string()))
+        || (name.clone() == "Present".to_string()))
+        || (name.clone() == "Absent".to_string()))
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "_variant")]
+pub enum BareOccurrenceBinding {
+    BareOccurrenceDeclaredInItsFile {
+        declaration: Rc<Node>,
+    },
+    BareOccurrenceImportedByName {
+        module_path: String,
+        declaration: Rc<Node>,
+    },
+    BareOccurrenceIsKernelName,
+    BareOccurrenceUndecided,
+}
+impl BareOccurrenceBinding {
+    pub fn declaration(&self) -> Rc<Node> {
+        match self {
+            BareOccurrenceBinding::BareOccurrenceDeclaredInItsFile {
+                declaration: __val, ..
+            } => __val.clone(),
+            BareOccurrenceBinding::BareOccurrenceImportedByName {
+                declaration: __val, ..
+            } => __val.clone(),
+            BareOccurrenceBinding::BareOccurrenceIsKernelName => {
+                panic!("no declaration on unit variant")
+            }
+            BareOccurrenceBinding::BareOccurrenceUndecided => {
+                panic!("no declaration on unit variant")
+            }
+        }
+    }
+}
+
+pub fn symbol_index_bare_declarations(index: Rc<SymbolIndex>, name: String) -> Rc<Vec<Rc<Node>>> {
+    match v1_rt::map_get(&index.global_bare.clone(), name.clone())
+        .as_deref()
+        .cloned()
+    {
+        Some(GlobalBareLookupState::GlobalBareUniqueBinding { binding: b, .. }) => {
+            Rc::new(vec![b.resolved.clone()])
+        }
+        Some(GlobalBareLookupState::GlobalBareAmbiguousBinding { candidates: cs, .. }) => {
+            Rc::new({
+                let mut __result = Vec::new();
+                for c in cs.iter().cloned() {
+                    __result.push(c.binding.clone().resolved.clone());
+                }
+                __result
+            })
+        }
+        std::option::Option::None => Rc::new(vec![]),
+    }
+}
+
+pub fn bare_occurrence_import(
+    index: Rc<SymbolIndex>,
+    name: String,
+    reference: Rc<Node>,
+) -> Option<Rc<BareOccurrenceBinding>> {
+    match v1_rt::map_get(
+        &index.file_modules.clone(),
+        reference.span.clone().file.clone(),
+    ) {
+        std::option::Option::None => std::option::Option::None,
+        Some(referencing_module) => match symbol_index_named_import_source(
+            index.clone(),
+            referencing_module.clone(),
+            name.clone(),
+        ) {
+            std::option::Option::None => std::option::Option::None,
+            Some(from_module) => Some(bare_occurrence_import_terminal(
+                index.clone(),
+                from_module.clone(),
+                name.clone(),
+                16,
+            )),
+        },
+    }
+}
+
+pub fn symbol_index_named_import_source(
+    index: Rc<SymbolIndex>,
+    module_path: String,
+    name: String,
+) -> Option<String> {
+    match v1_rt::map_get(&index.module_named_imports.clone(), module_path.clone()) {
+        std::option::Option::None => std::option::Option::None,
+        Some(named) => v1_rt::map_get(&named, name.clone()),
+    }
+}
+
+pub fn bare_occurrence_import_terminal(
+    mut __tco_loop_index: Rc<SymbolIndex>,
+    mut __tco_loop_module_path: String,
+    mut __tco_loop_name: String,
+    mut __tco_loop_fuel: i64,
+) -> Rc<BareOccurrenceBinding> {
+    loop {
+        #[allow(unused_mut)]
+        let mut index = __tco_loop_index;
+        #[allow(unused_mut)]
+        let mut module_path = __tco_loop_module_path;
+        #[allow(unused_mut)]
+        let mut name = __tco_loop_name;
+        #[allow(unused_mut)]
+        let mut fuel = __tco_loop_fuel;
+        if (fuel.clone() == 0) {
+            break Rc::new(BareOccurrenceBinding::BareOccurrenceUndecided);
+        } else {
+            match symbol_index_named_import_source(index.clone(), module_path.clone(), name.clone())
+            {
+                Some(next) => {
+                    let __tco_0 = index;
+                    let __tco_1 = next.clone();
+                    let __tco_2 = name;
+                    let __tco_3 = v1_rt::int_sub(fuel, 1);
+                    __tco_loop_index = __tco_0;
+                    __tco_loop_module_path = __tco_1;
+                    __tco_loop_name = __tco_2;
+                    __tco_loop_fuel = __tco_3;
+                    continue;
+                }
+                std::option::Option::None => {
+                    match symbol_index_lookup(
+                        index.clone(),
+                        v1_rt::concat(
+                            v1_rt::concat(module_path.clone(), ".".to_string()),
+                            name.clone(),
+                        ),
+                    ) {
+                        Some(decl) => {
+                            break Rc::new(BareOccurrenceBinding::BareOccurrenceImportedByName {
+                                module_path: module_path.clone(),
+                                declaration: decl.clone(),
+                            });
+                        }
+                        std::option::Option::None => {
+                            break Rc::new(BareOccurrenceBinding::BareOccurrenceUndecided);
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+pub fn bare_occurrence_binding(
+    index: Rc<SymbolIndex>,
+    name: String,
+    reference: Rc<Node>,
+) -> Rc<BareOccurrenceBinding> {
+    {
+        let local = Rc::new({
+            let mut __result = Vec::new();
+            for d in symbol_index_bare_declarations(index.clone(), name.clone())
+                .iter()
+                .cloned()
+            {
+                if (d.span.clone().file.clone() == reference.span.clone().file.clone()) {
+                    __result.push(d);
+                }
+            }
+            __result
+        });
+        let local_count = local
+            .iter()
+            .cloned()
+            .fold(0, |n: i64, _d: Rc<Node>| v1_rt::int_add(n, 1));
+        if (local_count.clone() == 1) {
+            local.iter().cloned().fold(
+                Rc::new(BareOccurrenceBinding::BareOccurrenceUndecided),
+                |acc: Rc<BareOccurrenceBinding>, d: Rc<Node>| {
+                    Rc::new(BareOccurrenceBinding::BareOccurrenceDeclaredInItsFile {
+                        declaration: d.clone(),
+                    })
+                },
+            )
+        } else {
+            if (local_count.clone() > 1) {
+                Rc::new(BareOccurrenceBinding::BareOccurrenceUndecided)
+            } else {
+                match bare_occurrence_import(index.clone(), name.clone(), reference.clone()) {
+                    Some(imported) => imported.clone(),
+                    std::option::Option::None => {
+                        if overlay_skips_kernel_name(name.clone()) {
+                            Rc::new(BareOccurrenceBinding::BareOccurrenceIsKernelName)
+                        } else {
+                            Rc::new(BareOccurrenceBinding::BareOccurrenceUndecided)
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
 pub fn global_bare_candidates_contain(
     candidates: Rc<Vec<Rc<GlobalBareCandidate>>>,
     resolved: Rc<Node>,
@@ -493,6 +702,8 @@ pub fn symbol_index_insert(
         services: index.services.clone(),
         transparent_alias_rep: index.transparent_alias_rep.clone(),
         type_head_exposures: index.type_head_exposures.clone(),
+        file_modules: index.file_modules.clone(),
+        module_named_imports: index.module_named_imports.clone(),
     })
 }
 
@@ -518,6 +729,8 @@ pub fn symbol_index_insert_decl(
         services: index.services.clone(),
         transparent_alias_rep: index.transparent_alias_rep.clone(),
         type_head_exposures: index.type_head_exposures.clone(),
+        file_modules: index.file_modules.clone(),
+        module_named_imports: index.module_named_imports.clone(),
     })
 }
 
@@ -540,6 +753,8 @@ pub fn symbol_index_insert_service(
         ),
         transparent_alias_rep: index.transparent_alias_rep.clone(),
         type_head_exposures: index.type_head_exposures.clone(),
+        file_modules: index.file_modules.clone(),
+        module_named_imports: index.module_named_imports.clone(),
     })
 }
 
@@ -1144,14 +1359,7 @@ pub fn segment_lcp_len(a: Rc<Vec<String>>, b: Rc<Vec<String>>) -> i64 {
                         Some(bh) => {
                             if (bh.clone() == seg.clone()) {
                                 Rc::new(SegmentLcpScan {
-                                    remaining: Rc::new(
-                                        acc.remaining
-                                            .clone()
-                                            .iter()
-                                            .cloned()
-                                            .skip(1 as usize)
-                                            .collect::<Vec<_>>(),
-                                    ),
+                                    remaining: Rc::new(v1_rt::list_skip(&acc.remaining.clone(), 1)),
                                     matched: v1_rt::int_add(acc.matched.clone(), 1),
                                     live: true,
                                 })
@@ -1635,13 +1843,10 @@ pub fn qualified_all_but_last(name: String) -> String {
             "".to_string()
         } else {
             {
-                let scan = Rc::new(
-                    segs.clone()
-                        .iter()
-                        .cloned()
-                        .take(v1_rt::int_sub(seg_count.clone(), 1) as usize)
-                        .collect::<Vec<_>>(),
-                )
+                let scan = Rc::new(v1_rt::list_take(
+                    &segs.clone(),
+                    v1_rt::int_sub(seg_count.clone(), 1),
+                ))
                 .iter()
                 .cloned()
                 .fold("".to_string(), |acc: String, seg: String| {
diff --git a/src/v1/stage0/src/v1_compiler_infer_lookup.rs b/src/v1/stage0/src/v1_compiler_infer_lookup.rs
index 2dc2196ddc6..f35b3584317 100644
--- a/src/v1/stage0/src/v1_compiler_infer_lookup.rs
+++ b/src/v1/stage0/src/v1_compiler_infer_lookup.rs
@@ -1003,10 +1003,8 @@ pub fn lookup_field_type_node(
                                             let value_child = match n
                                                 .children
                                                 .clone()
-                                                .iter()
+                                                .get((1) as usize)
                                                 .cloned()
-                                                .skip(1 as usize)
-                                                .next()
                                             {
                                                 Some(child) => {
                                                     crate::v1_compiler_infer_types::child_type_node(
@@ -1272,14 +1270,7 @@ pub fn map_value_type_in_env(type_node: Rc<Node>, env: Rc<TypeEnv>) -> Option<Rc
             env.source_indices.clone(),
         ) && ((map_type.children.clone().len() as i64) >= 2))
         {
-            match map_type
-                .children
-                .clone()
-                .iter()
-                .cloned()
-                .skip(1 as usize)
-                .next()
-            {
+            match map_type.children.clone().get((1) as usize).cloned() {
                 Some(value_type) => Some(value_type.clone()),
                 std::option::Option::None => std::option::Option::None,
             }
@@ -1641,14 +1632,7 @@ pub fn declared_arg_types_for_method(
                         std::option::Option::None => false,
                     };
                     let non_receiver_templates = if first_is_self.clone() {
-                        Rc::new(
-                            t.param_types
-                                .clone()
-                                .iter()
-                                .cloned()
-                                .skip(1 as usize)
-                                .collect::<Vec<_>>(),
-                        )
+                        Rc::new(v1_rt::list_skip(&t.param_types.clone(), 1))
                     } else {
                         t.param_types.clone()
                     };
diff --git a/src/v1/stage0/src/v1_compiler_infer_patterns.rs b/src/v1/stage0/src/v1_compiler_infer_patterns.rs
index e2ab2807ad2..5e999c27c36 100644
--- a/src/v1/stage0/src/v1_compiler_infer_patterns.rs
+++ b/src/v1/stage0/src/v1_compiler_infer_patterns.rs
@@ -75,10 +75,8 @@ pub fn generic_use_slot_bindings(
                 match scrut_node
                     .children
                     .clone()
-                    .iter()
+                    .get((pair.0.clone()) as usize)
                     .cloned()
-                    .skip(pair.0.clone() as usize)
-                    .next()
                 {
                     Some(arg) => v1_rt::rc_map_insert(acc.clone(), slot.clone(), arg.clone()),
                     std::option::Option::None => acc.clone(),
@@ -1065,13 +1063,7 @@ pub fn specialize_pattern_row(
 ) -> Rc<Vec<Rc<Vec<Rc<MatchPattern>>>>> {
     {
         let head = pattern_row_head(row.clone());
-        let rest = Rc::new(
-            row.clone()
-                .iter()
-                .cloned()
-                .skip(1 as usize)
-                .collect::<Vec<_>>(),
-        );
+        let rest = Rc::new(v1_rt::list_skip(&row.clone(), 1));
         if crate::v1_std_core::match_pattern_is_irrefutable(head.clone()) {
             Rc::new(vec![v1_rt::concat(
                 Rc::new({
@@ -1142,10 +1134,8 @@ pub fn render_constructor_witness(
             Rc::new(vec![]),
             |acc: _, pair: (i64, Rc<ConstructorField>)| match cells
                 .clone()
-                .iter()
+                .get((pair.0.clone()) as usize)
                 .cloned()
-                .skip(pair.0.clone() as usize)
-                .next()
             {
                 Some(cell) => {
                     if (cell.clone() == "_".to_string()) {
@@ -1210,13 +1200,7 @@ pub fn default_pattern_rows(
         .iter()
         .cloned()
         {
-            __result.push(Rc::new(
-                r.clone()
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .collect::<Vec<_>>(),
-            ));
+            __result.push(Rc::new(v1_rt::list_skip(&r.clone(), 1)));
         }
         __result
     })
@@ -1240,14 +1224,7 @@ pub fn exhaustiveness_witnesses(
                 }
             }
             Some(head_type) => {
-                let rest_columns = Rc::new(
-                    columns
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                );
+                let rest_columns = Rc::new(v1_rt::list_skip(&columns.clone(), 1));
                 match (*constructor_roster_for(head_type.clone(), env.clone())).clone() {
                     ConstructorRoster::ConstructorsOpen => {
                         let defaulted = default_pattern_rows(rows.clone());
@@ -1376,24 +1353,15 @@ pub fn exhaustiveness_witnesses(
                                                         Rc::new(vec![render_constructor_witness(
                                                             c.clone(),
                                                             fields.clone(),
-                                                            Rc::new(
-                                                                w.cells
-                                                                    .clone()
-                                                                    .iter()
-                                                                    .cloned()
-                                                                    .take(field_count.clone()
-                                                                        as usize)
-                                                                    .collect::<Vec<_>>(),
-                                                            ),
+                                                            Rc::new(v1_rt::list_take(
+                                                                &w.cells.clone(),
+                                                                field_count.clone(),
+                                                            )),
                                                         )]),
-                                                        Rc::new(
-                                                            w.cells
-                                                                .clone()
-                                                                .iter()
-                                                                .cloned()
-                                                                .skip(field_count.clone() as usize)
-                                                                .collect::<Vec<_>>(),
-                                                        ),
+                                                        Rc::new(v1_rt::list_skip(
+                                                            &w.cells.clone(),
+                                                            field_count.clone(),
+                                                        )),
                                                     ),
                                                 }));
                                             }
diff --git a/src/v1/stage0/src/v1_compiler_infer_resolve.rs b/src/v1/stage0/src/v1_compiler_infer_resolve.rs
index 868d3fc403a..af5f2911654 100644
--- a/src/v1/stage0/src/v1_compiler_infer_resolve.rs
+++ b/src/v1/stage0/src/v1_compiler_infer_resolve.rs
@@ -101,7 +101,7 @@ pub fn type_param_kind_diagnostics(
         {
             __result.extend((*match crate::v1_std_core::find_property(pair.1.clone().properties.clone(), crate::v1_std_core::type_param_kind_property_name(), env.source_indices.clone()) {
     std::option::Option::None => Rc::new(vec![]),
-    Some(kind_node) => match carrier.children.clone().iter().cloned().skip(pair.0.clone() as usize).next() {
+    Some(kind_node) => match carrier.children.clone().get((pair.0.clone()) as usize).cloned() {
     std::option::Option::None => Rc::new(vec![]),
     Some(arg) => {
         let kind_name = crate::v1_compiler_infer_env::authored_name(env.clone(), kind_node.clone());
@@ -1775,17 +1775,11 @@ Rc::new(NodeResolveResult {
                                     Some(k) => k.clone(),
                                     std::option::Option::None => unit_type(),
                                 };
-                                let val_child_node = match n
-                                    .children
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .next()
-                                {
-                                    Some(v) => v.clone(),
-                                    std::option::Option::None => unit_type(),
-                                };
+                                let val_child_node =
+                                    match n.children.clone().get((1) as usize).cloned() {
+                                        Some(v) => v.clone(),
+                                        std::option::Option::None => unit_type(),
+                                    };
                                 let key_type = crate::v1_compiler_infer_types::child_type_node(
                                     key_child_node.clone(),
                                 );
@@ -3034,25 +3028,20 @@ pub fn resolve_expr_types(
                                                     })
                                                 }
                                             };
-                                            let body_r = match arm_ch
-                                                .clone()
-                                                .iter()
-                                                .cloned()
-                                                .skip(1 as usize)
-                                                .next()
-                                            {
-                                                Some(b) => resolve_expr_types(
-                                                    b.clone(),
-                                                    env.clone(),
-                                                    module_name.clone(),
-                                                ),
-                                                std::option::Option::None => {
-                                                    Rc::new(ExprResolveResult {
-                                                        expr: child.clone(),
-                                                        diagnostics: Rc::new(vec![]),
-                                                    })
-                                                }
-                                            };
+                                            let body_r =
+                                                match arm_ch.clone().get((1) as usize).cloned() {
+                                                    Some(b) => resolve_expr_types(
+                                                        b.clone(),
+                                                        env.clone(),
+                                                        module_name.clone(),
+                                                    ),
+                                                    std::option::Option::None => {
+                                                        Rc::new(ExprResolveResult {
+                                                            expr: child.clone(),
+                                                            diagnostics: Rc::new(vec![]),
+                                                        })
+                                                    }
+                                                };
                                             Rc::new(ExprResolveResult {
                                                 expr: crate::v1_std_core::make_arm_node(
                                                     child.occurrence_identity.clone(),
@@ -3144,14 +3133,14 @@ pub fn resolve_expr_types(
                         diagnostics: Rc::new(vec![]),
                     }),
                 };
-                let tr = match ch.clone().iter().cloned().skip(1 as usize).next() {
+                let tr = match ch.clone().get((1) as usize).cloned() {
                     Some(t) => resolve_expr_types(t.clone(), env.clone(), module_name.clone()),
                     std::option::Option::None => Rc::new(ExprResolveResult {
                         expr: texpr.clone(),
                         diagnostics: Rc::new(vec![]),
                     }),
                 };
-                let er = match ch.clone().iter().cloned().skip(2 as usize).next() {
+                let er = match ch.clone().get((2) as usize).cloned() {
                     Some(e) => Some(resolve_expr_types(
                         e.clone(),
                         env.clone(),
@@ -3189,7 +3178,7 @@ pub fn resolve_expr_types(
                         diagnostics: Rc::new(vec![]),
                     }),
                 };
-                let br = match ch.clone().iter().cloned().skip(1 as usize).next() {
+                let br = match ch.clone().get((1) as usize).cloned() {
                     Some(bd) => Some(resolve_expr_types(
                         bd.clone(),
                         env.clone(),
@@ -3395,7 +3384,7 @@ pub fn resolve_expr_types(
                         diagnostics: Rc::new(vec![]),
                     }),
                 };
-                let rr = match ch.clone().iter().cloned().skip(1 as usize).next() {
+                let rr = match ch.clone().get((1) as usize).cloned() {
                     Some(r) => resolve_expr_types(r.clone(), env.clone(), module_name.clone()),
                     std::option::Option::None => Rc::new(ExprResolveResult {
                         expr: texpr.clone(),
@@ -3437,15 +3426,7 @@ pub fn resolve_expr_types(
                 })
             }
             ExprData::ExprLambda => {
-                let lam_param_nodes = Rc::new(
-                    texpr
-                        .children
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                );
+                let lam_param_nodes = Rc::new(v1_rt::list_skip(&texpr.children.clone(), 1));
                 let r = match texpr.children.clone().first().cloned() {
                     Some(b) => resolve_expr_types(b.clone(), env.clone(), module_name.clone()),
                     std::option::Option::None => Rc::new(ExprResolveResult {
@@ -3571,7 +3552,7 @@ pub fn resolve_expr_types(
                         diagnostics: Rc::new(vec![]),
                     }),
                 };
-                let tr = match ch.clone().iter().cloned().skip(1 as usize).next() {
+                let tr = match ch.clone().get((1) as usize).cloned() {
                     Some(target) => resolve_node(target.clone(), env.clone(), module_name.clone()),
                     std::option::Option::None => Rc::new(NodeResolveResult {
                         resolved: unit_type(),
@@ -3598,7 +3579,7 @@ pub fn resolve_expr_types(
                         diagnostics: Rc::new(vec![]),
                     }),
                 };
-                let br = match ch.clone().iter().cloned().skip(1 as usize).next() {
+                let br = match ch.clone().get((1) as usize).cloned() {
                     Some(b) => resolve_expr_types(b.clone(), env.clone(), module_name.clone()),
                     std::option::Option::None => Rc::new(ExprResolveResult {
                         expr: texpr.clone(),
@@ -3632,7 +3613,7 @@ pub fn resolve_expr_types(
                         diagnostics: Rc::new(vec![]),
                     }),
                 };
-                let ir = match ch.clone().iter().cloned().skip(1 as usize).next() {
+                let ir = match ch.clone().get((1) as usize).cloned() {
                     Some(index) => {
                         resolve_expr_types(index.clone(), env.clone(), module_name.clone())
                     }
@@ -3663,7 +3644,7 @@ pub fn resolve_expr_types(
                         diagnostics: Rc::new(vec![]),
                     }),
                 };
-                let sr = match ch.clone().iter().cloned().skip(1 as usize).next() {
+                let sr = match ch.clone().get((1) as usize).cloned() {
                     Some(start) => {
                         resolve_expr_types(start.clone(), env.clone(), module_name.clone())
                     }
@@ -3672,7 +3653,7 @@ pub fn resolve_expr_types(
                         diagnostics: Rc::new(vec![]),
                     }),
                 };
-                let er = match ch.clone().iter().cloned().skip(2 as usize).next() {
+                let er = match ch.clone().get((2) as usize).cloned() {
                     Some(end_e) => {
                         resolve_expr_types(end_e.clone(), env.clone(), module_name.clone())
                     }
@@ -3775,14 +3756,10 @@ pub fn first_duplicate_type_param_name(names: Rc<Vec<String>>) -> Option<String>
             {
                 if {
                     let mut __found = false;
-                    for other in Rc::new(
-                        names
-                            .clone()
-                            .iter()
-                            .cloned()
-                            .skip(v1_rt::int_add(pair.0.clone(), 1) as usize)
-                            .collect::<Vec<_>>(),
-                    )
+                    for other in Rc::new(v1_rt::list_skip(
+                        &names.clone(),
+                        v1_rt::int_add(pair.0.clone(), 1),
+                    ))
                     .iter()
                     .cloned()
                     {
@@ -3968,15 +3945,7 @@ pub fn reference_param_with_declaration(
                     binders.clone(),
                     env.clone(),
                 )]),
-                Rc::new(
-                    param
-                        .children
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                ),
+                Rc::new(v1_rt::list_skip(&param.children.clone(), 1)),
             ),
             param.params.clone(),
             param.inferred.clone(),
@@ -4150,15 +4119,7 @@ pub fn binder_marked_param(
                     binders.clone(),
                     env.clone(),
                 )]),
-                Rc::new(
-                    param
-                        .children
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                ),
+                Rc::new(v1_rt::list_skip(&param.children.clone(), 1)),
             ),
             param.params.clone(),
             param.inferred.clone(),
diff --git a/src/v1/stage0/src/v1_compiler_infer_types.rs b/src/v1/stage0/src/v1_compiler_infer_types.rs
index 04ee1a3e91b..f9dc4f910d1 100644
--- a/src/v1/stage0/src/v1_compiler_infer_types.rs
+++ b/src/v1/stage0/src/v1_compiler_infer_types.rs
@@ -1487,14 +1487,7 @@ pub fn unify_template(
                     }
                     std::option::Option::None => subst.clone(),
                 };
-                match concrete
-                    .children
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .next()
-                {
+                match concrete.children.clone().get((1) as usize).cloned() {
                     Some(v) => {
                         if (v1_rt::map_get(&s1, "__value__".to_string())
                             != std::option::Option::None)
@@ -1613,14 +1606,7 @@ pub fn unify_template(
                     ),
                     std::option::Option::None => subst.clone(),
                 };
-                match concrete
-                    .children
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .next()
-                {
+                match concrete.children.clone().get((1) as usize).cloned() {
                     Some(c) => unify_template(
                         st.clone(),
                         child_type_node(c.clone()),
@@ -1656,14 +1642,7 @@ pub fn build_type_substitution(
             std::option::Option::None => false,
         };
         let non_receiver_templates = if first_is_self.clone() {
-            Rc::new(
-                param_templates
-                    .clone()
-                    .iter()
-                    .cloned()
-                    .skip(1 as usize)
-                    .collect::<Vec<_>>(),
-            )
+            Rc::new(v1_rt::list_skip(&param_templates.clone(), 1))
         } else {
             param_templates.clone()
         };
@@ -1897,46 +1876,41 @@ pub fn apply_type_substitution(
                     }
                 },
             },
-            AlgebraTypeTemplate::ReceiverValue => match receiver
-                .children
-                .clone()
-                .iter()
-                .cloned()
-                .skip(1 as usize)
-                .next()
-            {
-                Some(child) => Rc::new(KernelTypeBuild {
-                    ty: child_type_node(child.clone()),
-                    diagnostics: Rc::new(vec![]),
-                }),
-                std::option::Option::None => {
-                    match v1_rt::map_get(&subst, "__value__".to_string()) {
-                        Some(val) => Rc::new(KernelTypeBuild {
-                            ty: val.clone(),
-                            diagnostics: Rc::new(vec![]),
-                        }),
-                        std::option::Option::None => {
-                            let rname =
-                                container_kind_canonical(crate::v1_std_core::authored_name_at(
-                                    source_indices.clone(),
-                                    receiver.clone(),
-                                ));
-                            match crate::std_types::container_param_name(rname.clone(), 1) {
-                                Some(n) => Rc::new(KernelTypeBuild {
-                                    ty: type_variable_node(n.clone()),
-                                    diagnostics: Rc::new(vec![]),
-                                }),
-                                std::option::Option::None => Rc::new(KernelTypeBuild {
-                                    ty: missing_kernel_container_profile_type(rname.clone()),
-                                    diagnostics: Rc::new(vec![
-                                        kernel_container_profile_miss_diagnostic(rname.clone()),
-                                    ]),
-                                }),
+            AlgebraTypeTemplate::ReceiverValue => {
+                match receiver.children.clone().get((1) as usize).cloned() {
+                    Some(child) => Rc::new(KernelTypeBuild {
+                        ty: child_type_node(child.clone()),
+                        diagnostics: Rc::new(vec![]),
+                    }),
+                    std::option::Option::None => {
+                        match v1_rt::map_get(&subst, "__value__".to_string()) {
+                            Some(val) => Rc::new(KernelTypeBuild {
+                                ty: val.clone(),
+                                diagnostics: Rc::new(vec![]),
+                            }),
+                            std::option::Option::None => {
+                                let rname =
+                                    container_kind_canonical(crate::v1_std_core::authored_name_at(
+                                        source_indices.clone(),
+                                        receiver.clone(),
+                                    ));
+                                match crate::std_types::container_param_name(rname.clone(), 1) {
+                                    Some(n) => Rc::new(KernelTypeBuild {
+                                        ty: type_variable_node(n.clone()),
+                                        diagnostics: Rc::new(vec![]),
+                                    }),
+                                    std::option::Option::None => Rc::new(KernelTypeBuild {
+                                        ty: missing_kernel_container_profile_type(rname.clone()),
+                                        diagnostics: Rc::new(vec![
+                                            kernel_container_profile_miss_diagnostic(rname.clone()),
+                                        ]),
+                                    }),
+                                }
                             }
                         }
                     }
                 }
-            },
+            }
             AlgebraTypeTemplate::NamedTemplate { name: n, .. } => Rc::new(KernelTypeBuild {
                 ty: nominal_type_ref(n.clone()),
                 diagnostics: Rc::new(vec![]),
@@ -2221,13 +2195,7 @@ pub fn node_type_shape_argument_list(
         match args.clone().first().cloned() {
             Some(a) => {
                 let head = node_type_shape(child_type_node(a.clone()), source_indices.clone());
-                let rest = Rc::new(
-                    args.clone()
-                        .iter()
-                        .cloned()
-                        .skip(1 as usize)
-                        .collect::<Vec<_>>(),
-                );
+                let rest = Rc::new(v1_rt::list_skip(&args.clone(), 1));
                 if ((rest.clone().len() as i64) == 0) {
                     head.clone()
                 } else {
@@ -2830,14 +2798,7 @@ pub fn callable_signatures_agree(
                 .iter()
                 .cloned()
                 {
-                    if !(match right
-                        .params
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .skip(pair.0.clone() as usize)
-                        .next()
-                    {
+                    if !(match right.params.clone().get((pair.0.clone()) as usize).cloned() {
                         Some(right_param) => agree(
                             crate::v1_std_core::param_node_type_expr(pair.1.clone()),
                             crate::v1_std_core::param_node_type_expr(right_param.clone()),
@@ -2940,10 +2901,8 @@ pub fn node_type_equals_core(
                                             if !(match right
                                                 .children
                                                 .clone()
-                                                .iter()
+                                                .get((pair.0.clone()) as usize)
                                                 .cloned()
-                                                .skip(pair.0.clone() as usize)
-                                                .next()
                                             {
                                                 Some(right_child) => node_type_equals(
                                                     pair.1.clone(),
@@ -3026,18 +2985,14 @@ pub fn node_type_equals_core(
                                                             Some(right_first) => match left
                                                                 .children
                                                                 .clone()
-                                                                .iter()
+                                                                .get((1) as usize)
                                                                 .cloned()
-                                                                .skip(1 as usize)
-                                                                .next()
                                                             {
                                                                 Some(left_second) => match right
                                                                     .children
                                                                     .clone()
-                                                                    .iter()
+                                                                    .get((1) as usize)
                                                                     .cloned()
-                                                                    .skip(1 as usize)
-                                                                    .next()
                                                                 {
                                                                     Some(right_second) => {
                                                                         (node_type_equals(
@@ -3241,14 +3196,7 @@ pub fn method_receiver_element_node(
     {
         let normed = normalize_access_type_node(receiver_type.clone());
         let maybe_element = if node_is_keyed_collection(normed.clone(), source_indices.clone()) {
-            match normed
-                .children
-                .clone()
-                .iter()
-                .cloned()
-                .skip(1 as usize)
-                .next()
-            {
+            match normed.children.clone().get((1) as usize).cloned() {
                 Some(ch) => Some(child_type_node(ch.clone())),
                 std::option::Option::None => std::option::Option::None,
             }
@@ -3362,13 +3310,7 @@ pub fn first_matching_algebra_field(
                     }
                     std::option::Option::None => {
                         let __tco_0 = n;
-                        let __tco_1 = Rc::new(
-                            candidates
-                                .iter()
-                                .cloned()
-                                .skip(1 as usize)
-                                .collect::<Vec<_>>(),
-                        );
+                        let __tco_1 = Rc::new(v1_rt::list_skip(&candidates, 1));
                         let __tco_2 = source_indices;
                         __tco_loop_n = __tco_0;
                         __tco_loop_candidates = __tco_1;
diff --git a/src/v1/stage0/src/v1_compiler_ownership.rs b/src/v1/stage0/src/v1_compiler_ownership.rs
index 12959c145bd..a69c4f25071 100644
--- a/src/v1/stage0/src/v1_compiler_ownership.rs
+++ b/src/v1/stage0/src/v1_compiler_ownership.rs
@@ -296,14 +296,10 @@ pub fn merge_branch_usages(
             let mut __result = Vec::new();
             for b in branches.iter().cloned() {
                 __result.extend(
-                    (*Rc::new(
-                        b.fold_call_nodes
-                            .clone()
-                            .iter()
-                            .cloned()
-                            .skip(base_fold_count.clone() as usize)
-                            .collect::<Vec<_>>(),
-                    ))
+                    (*Rc::new(v1_rt::list_skip(
+                        &b.fold_call_nodes.clone(),
+                        base_fold_count.clone(),
+                    )))
                     .iter()
                     .cloned(),
                 );
@@ -1294,7 +1290,7 @@ pub fn analyze_single_fold(
             Some(a) => crate::v1_std_core::arg_value(a.clone()),
             std::option::Option::None => method_call.clone(),
         };
-        let fold_lambda_node = match args.clone().iter().cloned().skip(1 as usize).next() {
+        let fold_lambda_node = match args.clone().get((1) as usize).cloned() {
             Some(a) => crate::v1_std_core::arg_value(a.clone()),
             std::option::Option::None => method_call.clone(),
         };
diff --git a/src/v1/stage0/src/v1_compiler_parse.rs b/src/v1/stage0/src/v1_compiler_parse.rs
index 6203bf1f162..1e73153d17c 100644
--- a/src/v1/stage0/src/v1_compiler_parse.rs
+++ b/src/v1/stage0/src/v1_compiler_parse.rs
@@ -723,8 +723,7 @@ pub fn mint_parsed_string_part_nodes(
                     }
                 };
                 {
-                    let __tco_0 =
-                        Rc::new(parts.iter().cloned().skip(1 as usize).collect::<Vec<_>>());
+                    let __tco_0 = Rc::new(v1_rt::list_skip(&parts, 1));
                     let __tco_1 = minted.ctx.clone();
                     let __tco_2 = span;
                     let __tco_3 = v1_rt::rc_list_push(acc, node.clone());
@@ -3240,14 +3239,7 @@ pub fn stamp_parsed_node_list_with_head_role(
             } else {
                 {
                     let stamped_tail = stamp_parsed_node_list(
-                        Rc::new(
-                            nodes
-                                .clone()
-                                .iter()
-                                .cloned()
-                                .skip(1 as usize)
-                                .collect::<Vec<_>>(),
-                        ),
+                        Rc::new(v1_rt::list_skip(&nodes.clone(), 1)),
                         ancestors.clone(),
                         stamped_head.ctx.clone(),
                         tail_role.clone(),
diff --git a/src/v1/stage0/src/v1_compiler_runtime_rust.rs b/src/v1/stage0/src/v1_compiler_runtime_rust.rs
index 38d49cab731..9681af4d227 100644
--- a/src/v1/stage0/src/v1_compiler_runtime_rust.rs
+++ b/src/v1/stage0/src/v1_compiler_runtime_rust.rs
@@ -76,7 +76,7 @@ pub fn rt_string_ops() -> String {
 }
 
 pub fn rt_collection_ops() -> String {
-    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("pub fn lookup<K: std::cmp::Eq + std::hash::Hash, V: Clone>(m: &HashMap<K, V>, key: K) -> Option<V> {\n".to_string(), "    m.get(&key).cloned()\n".to_string()), "}\n\n".to_string()), "pub fn list_get_optional<T: Clone>(items: &Vec<T>, index: i64) -> Option<T> {\n".to_string()), "    if index < 0 { None } else { items.get(index as usize).cloned() }\n".to_string()), "}\n\n".to_string()), "pub fn index_by<V: Clone, F: Fn(&V) -> String>(list: Vec<V>, key_fn: F) -> HashMap<String, V> {\n".to_string()), "    let mut map = HashMap::new();\n".to_string()), "    for item in list { let key = key_fn(&item); map.insert(key, item); }\n".to_string()), "    map\n".to_string()), "}\n\n".to_string()), "pub fn empty_map<K: std::cmp::Eq + std::hash::Hash, V>() -> HashMap<K, V> { HashMap::new() }\n\n".to_string()), "pub fn map_insert<K: std::cmp::Eq + std::hash::Hash + Clone, V: Clone>(mut map: HashMap<K, V>, key: K, value: V) -> HashMap<K, V> {\n".to_string()), "    map.insert(key, value); map\n".to_string()), "}\n\n".to_string()), "pub fn map_merge<K: std::cmp::Eq + std::hash::Hash + Clone, V: Clone>(mut base: HashMap<K, V>, overlay: HashMap<K, V>) -> HashMap<K, V> {\n".to_string()), "    base.extend(overlay); base\n".to_string()), "}\n\n".to_string()), "pub fn map_get<K: std::cmp::Eq + std::hash::Hash, V: Clone>(m: &HashMap<K, V>, key: K) -> Option<V> {\n".to_string()), "    m.get(&key).cloned()\n".to_string()), "}\n\n".to_string()), "pub fn map_keys<K: Clone, V>(m: &HashMap<K, V>) -> Vec<K> { m.keys().cloned().collect() }\n\n".to_string()), "// THE EMITTED ORDERING-KEY ADMISSION: the counterpart of the interpreter's admit_emitted_ord_keys.\n".to_string()), "// Only String, i64 and bool (and their aliases) are admitted, because on exactly those kinds the\n".to_string()), "// native Ord IS the canonical content order (std.algebra TotalOrder). Any other key type -- a\n".to_string()), "// derived-Ord record or enum (declaration order), or f64 (no total Ord) -- fails to compile here,\n".to_string()), "// at the call, rather than sorting in an order the interpreter would not produce.\n".to_string()), "#[diagnostic::on_unimplemented(message = \"EMIT REFUSED: `{Self}` is not an admitted ordering key; sorted_map_keys and sort_by admit only String, Int and Bool keys, whose order is the canonical content order in both realizations\", label = \"ordering key of a type with no canonical emitted order\")]\n".to_string()), "pub trait CanonicalOrdKey: Ord {}\n".to_string()), "impl CanonicalOrdKey for String {}\n".to_string()), "impl CanonicalOrdKey for RcStr {}\n".to_string()), "impl CanonicalOrdKey for i64 {}\n".to_string()), "impl CanonicalOrdKey for bool {}\n\n".to_string()), "pub fn canonical_key_cmp<K: CanonicalOrdKey>(a: &K, b: &K) -> std::cmp::Ordering { a.cmp(b) }\n\n".to_string()), "pub fn sorted_map_keys<K: CanonicalOrdKey + Clone, V>(m: &HashMap<K, V>) -> Vec<K> { let mut keys = map_keys(m); keys.sort(); keys }\n\n".to_string()), "pub fn map_is_empty<K, V>(m: &HashMap<K, V>) -> bool { m.is_empty() }\n\n".to_string()), "// Sound identity hint (see 04_infer.dag substitute_generics): returns true =>\n".to_string()), "// the two are structurally equal. The compiled realization answers with pointer\n".to_string()), "// identity (conservative: may say false when equal); never true-when-unequal, so\n".to_string()), "// callers that return the original on true preserve output structure. Owned Rc\n".to_string()), "// args (cheap refcount bump) keep the inner element pointers, so ptr_eq on the\n".to_string()), "// clones equals ptr_eq on the originals -- lets the .dag pass args by value and\n".to_string()), "// emit through the normal clone path (no all-args-by-ref emit rule needed).\n".to_string()), "pub fn rc_ptr_eq<T>(a: Rc<T>, b: Rc<T>) -> bool { Rc::ptr_eq(&a, &b) }\n\n".to_string()), "pub fn rc_vec_ptr_eq<T>(a: Rc<Vec<Rc<T>>>, b: Rc<Vec<Rc<T>>>) -> bool {\n".to_string()), "    a.len() == b.len() && a.iter().zip(b.iter()).all(|(x, y)| Rc::ptr_eq(x, y))\n".to_string()), "}\n\n".to_string()), "pub fn map_values<K, V: Clone>(m: &HashMap<K, V>) -> Vec<V> { m.values().cloned().collect() }\n\n".to_string()), "pub fn list_concat<T: Clone>(mut a: Vec<T>, b: Vec<T>) -> Vec<T> { a.append(b); a }\n\n".to_string()), "pub fn list_push<T: Clone>(mut list: Vec<T>, item: T) -> Vec<T> { list.push_back(item); list }\n\n".to_string()), "pub fn append<T: Clone>(list: Rc<Vec<T>>, item: T) -> Vec<T> {\n".to_string()), "    let mut v = (*list).clone();\n".to_string()), "    v.push_back(item);\n".to_string()), "    v\n".to_string()), "}\n\n".to_string()), "pub fn chars_to_string(chars: &Rc<Vec<i64>>, start: i64, end: i64) -> String {\n".to_string()), "    let len = chars.len();\n".to_string()), "    let start = (start.max(0) as usize).min(len);\n".to_string()), "    let end = (end.max(0) as usize).min(len).max(start);\n".to_string()), "    let units = (end.saturating_sub(start)) as u64;\n".to_string()), "    record_source_chars_slice_walked(units);\n".to_string()), "    // Focus caches the current RRB chunk, so per-char access is contiguous-slice\n".to_string()), "    // speed; a plain iter().skip(start) walks O(start) per call, which summed\n".to_string()), "    // quadratically across a tokenize pass (profiled 2026-07-06).\n".to_string()), "    let mut focus = chars.focus();\n".to_string()), "    let mut out = String::with_capacity(end - start);\n".to_string()), "    for i in start..end {\n".to_string()), "        if let Some(ch) = char::from_u32(*focus.index(i) as u32) {\n".to_string()), "            out.push(ch);\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "    out\n".to_string()), "}\n\n".to_string()), "pub fn parse_int(s: String) -> Option<i64> { s.parse::<i64>().ok() }\n\n".to_string()), "pub fn map_contains_key<K: std::cmp::Eq + std::hash::Hash, V>(m: &HashMap<K, V>, key: K) -> bool {\n".to_string()), "    m.contains_key(&key)\n".to_string()), "}\n\n".to_string()), "pub fn map_has<K: std::cmp::Eq + std::hash::Hash, V>(m: &HashMap<K, V>, key: K) -> bool {\n".to_string()), "    m.contains_key(&key)\n".to_string()), "}\n\n".to_string()), "pub fn rc_empty_set<T: Ord>() -> Rc<BTreeSet<T>> {\n".to_string()), "    Rc::new(BTreeSet::new())\n".to_string()), "}\n\n".to_string()), "pub fn rc_set_insert<T: Ord + Clone>(mut s: Rc<BTreeSet<T>>, x: T) -> Rc<BTreeSet<T>> {\n".to_string()), "    Rc::make_mut(&mut s).insert(x);\n".to_string()), "    s\n".to_string()), "}\n\n".to_string()), "pub fn rc_set_union<T: Ord + Clone>(a: Rc<BTreeSet<T>>, b: Rc<BTreeSet<T>>) -> Rc<BTreeSet<T>> {\n".to_string()), "    let mut out = a;\n".to_string()), "    for x in b.iter().cloned() {\n".to_string()), "        Rc::make_mut(&mut out).insert(x);\n".to_string()), "    }\n".to_string()), "    out\n".to_string()), "}\n\n".to_string()), "pub fn set_contains<T: Ord, S: AsRef<BTreeSet<T>>>(s: S, x: T) -> bool {\n".to_string()), "    s.as_ref().contains(&x)\n".to_string()), "}\n\n".to_string()), "pub fn reverse<T: Clone>(list: Rc<Vec<T>>) -> Rc<Vec<T>> {\n".to_string()), "    Rc::new(list.iter().cloned().rev().collect())\n".to_string()), "}\n\n".to_string()), "pub fn replace(s: String, from: String, to: String) -> String {\n".to_string()), "    s.replace(&from, &to)\n".to_string()), "}\n\n".to_string())
+    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("pub fn lookup<K: std::cmp::Eq + std::hash::Hash, V: Clone>(m: &HashMap<K, V>, key: K) -> Option<V> {\n".to_string(), "    m.get(&key).cloned()\n".to_string()), "}\n\n".to_string()), "pub fn list_get_optional<T: Clone>(items: &Vec<T>, index: i64) -> Option<T> {\n".to_string()), "    if index < 0 { None } else { items.get(index as usize).cloned() }\n".to_string()), "}\n\n".to_string()), "pub fn index_by<V: Clone, F: Fn(&V) -> String>(list: Vec<V>, key_fn: F) -> HashMap<String, V> {\n".to_string()), "    let mut map = HashMap::new();\n".to_string()), "    for item in list { let key = key_fn(&item); map.insert(key, item); }\n".to_string()), "    map\n".to_string()), "}\n\n".to_string()), "pub fn empty_map<K: std::cmp::Eq + std::hash::Hash, V>() -> HashMap<K, V> { HashMap::new() }\n\n".to_string()), "pub fn map_insert<K: std::cmp::Eq + std::hash::Hash + Clone, V: Clone>(mut map: HashMap<K, V>, key: K, value: V) -> HashMap<K, V> {\n".to_string()), "    map.insert(key, value); map\n".to_string()), "}\n\n".to_string()), "pub fn map_merge<K: std::cmp::Eq + std::hash::Hash + Clone, V: Clone>(mut base: HashMap<K, V>, overlay: HashMap<K, V>) -> HashMap<K, V> {\n".to_string()), "    base.extend(overlay); base\n".to_string()), "}\n\n".to_string()), "pub fn map_get<K: std::cmp::Eq + std::hash::Hash, V: Clone>(m: &HashMap<K, V>, key: K) -> Option<V> {\n".to_string()), "    m.get(&key).cloned()\n".to_string()), "}\n\n".to_string()), "pub fn map_keys<K: Clone, V>(m: &HashMap<K, V>) -> Vec<K> { m.keys().cloned().collect() }\n\n".to_string()), "// THE EMITTED ORDERING-KEY ADMISSION: the counterpart of the interpreter's admit_emitted_ord_keys.\n".to_string()), "// Only String, i64 and bool (and their aliases) are admitted, because on exactly those kinds the\n".to_string()), "// native Ord IS the canonical content order (std.algebra TotalOrder). Any other key type -- a\n".to_string()), "// derived-Ord record or enum (declaration order), or f64 (no total Ord) -- fails to compile here,\n".to_string()), "// at the call, rather than sorting in an order the interpreter would not produce.\n".to_string()), "#[diagnostic::on_unimplemented(message = \"EMIT REFUSED: `{Self}` is not an admitted ordering key; sorted_map_keys and sort_by admit only String, Int and Bool keys, whose order is the canonical content order in both realizations\", label = \"ordering key of a type with no canonical emitted order\")]\n".to_string()), "pub trait CanonicalOrdKey: Ord {}\n".to_string()), "impl CanonicalOrdKey for String {}\n".to_string()), "impl CanonicalOrdKey for RcStr {}\n".to_string()), "impl CanonicalOrdKey for i64 {}\n".to_string()), "impl CanonicalOrdKey for bool {}\n\n".to_string()), "pub fn canonical_key_cmp<K: CanonicalOrdKey>(a: &K, b: &K) -> std::cmp::Ordering { a.cmp(b) }\n\n".to_string()), "pub fn sorted_map_keys<K: CanonicalOrdKey + Clone, V>(m: &HashMap<K, V>) -> Vec<K> { let mut keys = map_keys(m); keys.sort(); keys }\n\n".to_string()), "pub fn map_is_empty<K, V>(m: &HashMap<K, V>) -> bool { m.is_empty() }\n\n".to_string()), "// Sound identity hint (see 04_infer.dag substitute_generics): returns true =>\n".to_string()), "// the two are structurally equal. The compiled realization answers with pointer\n".to_string()), "// identity (conservative: may say false when equal); never true-when-unequal, so\n".to_string()), "// callers that return the original on true preserve output structure. Owned Rc\n".to_string()), "// args (cheap refcount bump) keep the inner element pointers, so ptr_eq on the\n".to_string()), "// clones equals ptr_eq on the originals -- lets the .dag pass args by value and\n".to_string()), "// emit through the normal clone path (no all-args-by-ref emit rule needed).\n".to_string()), "pub fn rc_ptr_eq<T>(a: Rc<T>, b: Rc<T>) -> bool { Rc::ptr_eq(&a, &b) }\n\n".to_string()), "pub fn rc_vec_ptr_eq<T>(a: Rc<Vec<Rc<T>>>, b: Rc<Vec<Rc<T>>>) -> bool {\n".to_string()), "    a.len() == b.len() && a.iter().zip(b.iter()).all(|(x, y)| Rc::ptr_eq(x, y))\n".to_string()), "}\n\n".to_string()), "pub fn map_values<K, V: Clone>(m: &HashMap<K, V>) -> Vec<V> { m.values().cloned().collect() }\n\n".to_string()), "pub fn list_concat<T: Clone>(mut a: Vec<T>, b: Vec<T>) -> Vec<T> { a.append(b); a }\n\n".to_string()), "pub fn list_push<T: Clone>(mut list: Vec<T>, item: T) -> Vec<T> { list.push_back(item); list }\n\n".to_string()), "/// std.primitives skip_contract on the persistent carrier: the suffix after `n` members,\n".to_string()), "/// sharing the receiver's tree in O(log n) instead of copying the remainder, so a walk that\n".to_string()), "/// slices by offset is O(n log n) rather than quadratic. A negative `n` skips every member, as\n".to_string()), "/// the copying form's saturating `n as usize` did.\n".to_string()), "pub fn list_skip<T: Clone>(items: &Vec<T>, n: i64) -> Vec<T> {\n".to_string()), "    let k = if n < 0 {\n".to_string()), "        items.len()\n".to_string()), "    } else {\n".to_string()), "        (n as usize).min(items.len())\n".to_string()), "    };\n".to_string()), "    items.skip(k)\n".to_string()), "}\n".to_string()), "\n".to_string()), "/// std.primitives take_contract on the persistent carrier: the first `n` members, sharing\n".to_string()), "/// the receiver's tree. A negative `n` keeps every member, as the copying form did.\n".to_string()), "pub fn list_take<T: Clone>(items: &Vec<T>, n: i64) -> Vec<T> {\n".to_string()), "    let k = if n < 0 {\n".to_string()), "        items.len()\n".to_string()), "    } else {\n".to_string()), "        (n as usize).min(items.len())\n".to_string()), "    };\n".to_string()), "    items.take(k)\n".to_string()), "}\n".to_string()), "\n".to_string()), "#[cfg(test)]\n".to_string()), "mod list_slice_tests {\n".to_string()), "    use super::*;\n".to_string()), "\n".to_string()), "    thread_local! {\n".to_string()), "        static CLONES: Cell<u64> = const { Cell::new(0) };\n".to_string()), "    }\n".to_string()), "\n".to_string()), "    /// A code point whose every copy is counted, so a slice's cost is read off the carrier's\n".to_string()), "    /// own work rather than a clock.\n".to_string()), "    #[derive(Debug, PartialEq)]\n".to_string()), "    struct CountedCodePoint(u32);\n".to_string()), "\n".to_string()), "    impl Clone for CountedCodePoint {\n".to_string()), "        fn clone(&self) -> Self {\n".to_string()), "            CLONES.with(|c| c.set(c.get() + 1));\n".to_string()), "            CountedCodePoint(self.0)\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "\n".to_string()), "    fn clones_during<R>(f: impl FnOnce() -> R) -> (R, u64) {\n".to_string()), "        let before = CLONES.with(|c| c.get());\n".to_string()), "        let r = f();\n".to_string()), "        (r, CLONES.with(|c| c.get()) - before)\n".to_string()), "    }\n".to_string()), "\n".to_string()), "    // Non-ASCII on purpose: emitted char_at / substring over a bare &str are O(offset) here,\n".to_string()), "    // which is the walk the code-point slice replaces.\n".to_string()), "    fn non_ascii_code_points(n: usize) -> Vec<CountedCodePoint> {\n".to_string()), "        [0xe9u32, 0x4e2d, 0x1f600, 0x61]\n".to_string()), "            .iter()\n".to_string()), "            .cycle()\n".to_string()), "            .take(n)\n".to_string()), "            .map(|cp| CountedCodePoint(*cp))\n".to_string()), "            .collect()\n".to_string()), "    }\n".to_string()), "\n".to_string()), "    const N: usize = 200_000;\n".to_string()), "    // im's RRB split copies at most one boundary chunk per tree level; this is that bound with\n".to_string()), "    // headroom, and three orders of magnitude below N.\n".to_string()), "    const SLICE_COPY_BUDGET: u64 = 2_048;\n".to_string()), "\n".to_string()), "    #[test]\n".to_string()), "    fn a_slice_from_the_middle_copies_only_boundary_chunks() {\n".to_string()), "        let cps = Rc::new(non_ascii_code_points(N));\n".to_string()), "        let (slice, copied) = clones_during(|| list_take(&list_skip(&cps, (N / 2) as i64), 7));\n".to_string()), "        assert!(\n".to_string()), "            copied <= SLICE_COPY_BUDGET,\n".to_string()), "            \"skip+take copied {} members of {}\",\n".to_string()), "            copied,\n".to_string()), "            N\n".to_string()), "        );\n".to_string()), "        let expected: std::vec::Vec<u32> = cps.iter().skip(N / 2).take(7).map(|c| c.0).collect();\n".to_string()), "        assert_eq!(\n".to_string()), "            slice.iter().map(|c| c.0).collect::<std::vec::Vec<_>>(),\n".to_string()), "            expected\n".to_string()), "        );\n".to_string()), "    }\n".to_string()), "\n".to_string()), "    // THE RED CONTROL: the extdeps.languages.rust.emit skip / take templates this runtime pair\n".to_string()), "    // replaced, spelled as they emitted, on the same input and bound. It must exceed the budget,\n".to_string()), "    // or the budget does not discriminate the quadratic.\n".to_string()), "    #[test]\n".to_string()), "    fn the_copying_template_form_exceeds_the_budget() {\n".to_string()), "        let cps = Rc::new(non_ascii_code_points(N));\n".to_string()), "        let (_, copied) = clones_during(|| {\n".to_string()), "            let rest = cps.iter().cloned().skip(N / 2).collect::<Vec<_>>();\n".to_string()), "            rest.iter().cloned().take(7).collect::<Vec<_>>()\n".to_string()), "        });\n".to_string()), "        assert!(\n".to_string()), "            copied > SLICE_COPY_BUDGET,\n".to_string()), "            \"copying form copied only {}\",\n".to_string()), "            copied\n".to_string()), "        );\n".to_string()), "    }\n".to_string()), "\n".to_string()), "    #[test]\n".to_string()), "    fn negative_and_overlong_counts_keep_the_copying_forms_reading() {\n".to_string()), "        let xs: Vec<i64> = (0..10).collect();\n".to_string()), "        for n in [-3i64, 0, 4, 10, 11, i64::MAX] {\n".to_string()), "            let copying_skip = xs.iter().cloned().skip(n as usize).collect::<Vec<_>>();\n".to_string()), "            let copying_take = xs.iter().cloned().take(n as usize).collect::<Vec<_>>();\n".to_string()), "            assert_eq!(list_skip(&xs, n), copying_skip, \"skip {}\", n);\n".to_string()), "            assert_eq!(list_take(&xs, n), copying_take, \"take {}\", n);\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "}\n".to_string()), "\n".to_string()), "pub fn append<T: Clone>(list: Rc<Vec<T>>, item: T) -> Vec<T> {\n".to_string()), "    let mut v = (*list).clone();\n".to_string()), "    v.push_back(item);\n".to_string()), "    v\n".to_string()), "}\n\n".to_string()), "pub fn chars_to_string(chars: &Rc<Vec<i64>>, start: i64, end: i64) -> String {\n".to_string()), "    let len = chars.len();\n".to_string()), "    let start = (start.max(0) as usize).min(len);\n".to_string()), "    let end = (end.max(0) as usize).min(len).max(start);\n".to_string()), "    let units = (end.saturating_sub(start)) as u64;\n".to_string()), "    record_source_chars_slice_walked(units);\n".to_string()), "    // Focus caches the current RRB chunk, so per-char access is contiguous-slice\n".to_string()), "    // speed; a plain iter().skip(start) walks O(start) per call, which summed\n".to_string()), "    // quadratically across a tokenize pass (profiled 2026-07-06).\n".to_string()), "    let mut focus = chars.focus();\n".to_string()), "    let mut out = String::with_capacity(end - start);\n".to_string()), "    for i in start..end {\n".to_string()), "        if let Some(ch) = char::from_u32(*focus.index(i) as u32) {\n".to_string()), "            out.push(ch);\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "    out\n".to_string()), "}\n\n".to_string()), "pub fn parse_int(s: String) -> Option<i64> { s.parse::<i64>().ok() }\n\n".to_string()), "pub fn map_contains_key<K: std::cmp::Eq + std::hash::Hash, V>(m: &HashMap<K, V>, key: K) -> bool {\n".to_string()), "    m.contains_key(&key)\n".to_string()), "}\n\n".to_string()), "pub fn map_has<K: std::cmp::Eq + std::hash::Hash, V>(m: &HashMap<K, V>, key: K) -> bool {\n".to_string()), "    m.contains_key(&key)\n".to_string()), "}\n\n".to_string()), "pub fn rc_empty_set<T: Ord>() -> Rc<BTreeSet<T>> {\n".to_string()), "    Rc::new(BTreeSet::new())\n".to_string()), "}\n\n".to_string()), "pub fn rc_set_insert<T: Ord + Clone>(mut s: Rc<BTreeSet<T>>, x: T) -> Rc<BTreeSet<T>> {\n".to_string()), "    Rc::make_mut(&mut s).insert(x);\n".to_string()), "    s\n".to_string()), "}\n\n".to_string()), "pub fn rc_set_union<T: Ord + Clone>(a: Rc<BTreeSet<T>>, b: Rc<BTreeSet<T>>) -> Rc<BTreeSet<T>> {\n".to_string()), "    let mut out = a;\n".to_string()), "    for x in b.iter().cloned() {\n".to_string()), "        Rc::make_mut(&mut out).insert(x);\n".to_string()), "    }\n".to_string()), "    out\n".to_string()), "}\n\n".to_string()), "pub fn set_contains<T: Ord, S: AsRef<BTreeSet<T>>>(s: S, x: T) -> bool {\n".to_string()), "    s.as_ref().contains(&x)\n".to_string()), "}\n\n".to_string()), "pub fn reverse<T: Clone>(list: Rc<Vec<T>>) -> Rc<Vec<T>> {\n".to_string()), "    Rc::new(list.iter().cloned().rev().collect())\n".to_string()), "}\n\n".to_string()), "pub fn replace(s: String, from: String, to: String) -> String {\n".to_string()), "    s.replace(&from, &to)\n".to_string()), "}\n\n".to_string())
 }
 
 pub fn rt_string_carrier() -> String {
@@ -135,39 +135,47 @@ pub fn rust_runtime_source() -> String {
                                                     v1_rt::concat(
                                                         v1_rt::concat(
                                                             v1_rt::concat(
-                                                                rt_header(),
-                                                                rt_text_lookup_work_counter(),
+                                                                v1_rt::concat(
+                                                                    rt_header(),
+                                                                    rt_text_lookup_work_counter(),
+                                                                ),
+                                                                rt_resolution_silent_pick_telemetry(
+                                                                ),
                                                             ),
-                                                            rt_resolution_silent_pick_telemetry(),
+                                                            rt_concat_trait(),
                                                         ),
-                                                        rt_concat_trait(),
+                                                        rt_string_ops(),
                                                     ),
-                                                    rt_string_ops(),
+                                                    rt_string_carrier(),
                                                 ),
-                                                rt_string_carrier(),
+                                                rt_collection_ops(),
                                             ),
-                                            rt_collection_ops(),
+                                            rt_rc_container_ops(),
                                         ),
-                                        rt_rc_container_ops(),
+                                        rt_scanner_ops(),
                                     ),
-                                    rt_scanner_ops(),
+                                    rt_unicode_ops(),
                                 ),
-                                rt_unicode_ops(),
+                                rt_freemonoid_host_ops(),
                             ),
-                            rt_freemonoid_host_ops(),
+                            rt_hash_ops(),
                         ),
-                        rt_hash_ops(),
+                        rt_filesystem(),
                     ),
-                    rt_filesystem(),
+                    rt_checked_int_ops(),
                 ),
-                rt_checked_int_ops(),
+                rt_realization_measurement(),
             ),
-            rt_realization_measurement(),
+            rt_accelerator_demo_kernel(),
         ),
-        rt_accelerator_demo_kernel(),
+        rt_host_budget(),
     )
 }
 
+pub fn rt_host_budget() -> String {
+    v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("/// The one host-budget precedence. `read_host_budget_bytes` and\n".to_string(), "/// `memory_governor::resolve_host_budget` both call `resolve_host_budget_join`.\n".to_string()), "#[derive(Clone, Debug, PartialEq, Eq)]\n".to_string()), "pub enum HostBudgetJoinSource {\n".to_string()), "    CgroupMemoryHigh { cgroup_dir: String },\n".to_string()), "    CgroupMemoryMax { cgroup_dir: String },\n".to_string()), "    CgroupV1HierarchicalMemoryLimit { cgroup_dir: String },\n".to_string()), "    DarwinPhysicalMemory,\n".to_string()), "}\n\n".to_string()), "impl HostBudgetJoinSource {\n".to_string()), "    pub fn label(&self) -> String {\n".to_string()), "        match self {\n".to_string()), "            HostBudgetJoinSource::CgroupMemoryHigh { cgroup_dir } => format!(\"cgroup memory.high ({})\", cgroup_dir),\n".to_string()), "            HostBudgetJoinSource::CgroupMemoryMax { cgroup_dir } => format!(\"cgroup memory.max ({})\", cgroup_dir),\n".to_string()), "            HostBudgetJoinSource::CgroupV1HierarchicalMemoryLimit { cgroup_dir } => format!(\"cgroup v1 memory.stat hierarchical_memory_limit ({})\", cgroup_dir),\n".to_string()), "            HostBudgetJoinSource::DarwinPhysicalMemory => \"sysctl hw.memsize\".to_string(),\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "}\n\n".to_string()), "#[derive(Clone, Debug, PartialEq, Eq)]\n".to_string()), "pub enum HostBudgetJoin {\n".to_string()), "    Resolved { effective_bytes: u64, requested_bytes: Option<u64>, source: HostBudgetJoinSource, observed_bytes: u64 },\n".to_string()), "    DeclaredUnverified { requested_bytes: u64, reason: String },\n".to_string()), "    Unreadable { reason: String },\n".to_string()), "}\n\n".to_string()), "impl HostBudgetJoin {\n".to_string()), "    pub fn bytes(&self) -> Option<u64> {\n".to_string()), "        match self {\n".to_string()), "            HostBudgetJoin::Resolved { effective_bytes, .. } => Some(*effective_bytes),\n".to_string()), "            HostBudgetJoin::DeclaredUnverified { requested_bytes, .. } => Some(*requested_bytes),\n".to_string()), "            HostBudgetJoin::Unreadable { .. } => None,\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "    pub fn label(&self) -> String {\n".to_string()), "        match self {\n".to_string()), "            HostBudgetJoin::Resolved { effective_bytes, requested_bytes, source, observed_bytes } => match requested_bytes {\n".to_string()), "                Some(requested) => format!(\"effective planning minimum {} bytes (env request {}; observed {}={} bytes)\", effective_bytes, requested, source.label(), observed_bytes),\n".to_string()), "                None => source.label(),\n".to_string()), "            },\n".to_string()), "            HostBudgetJoin::Unreadable { reason } => format!(\"unreadable: {}\", reason),\n".to_string()), "            HostBudgetJoin::DeclaredUnverified { requested_bytes, reason } => format!(\"declared-unverified: env GUNBC_MEMORY_BUDGET_BYTES={}; {}\", requested_bytes, reason),\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "}\n\n".to_string()), "pub fn resolve_host_budget_join(env_override: Option<u64>, cgroup_high: Option<(String, u64)>, cgroup_max: Option<(String, u64)>, cgroup_v1_limit: Option<(String, HostBudgetCgroupV1)>, darwin_physical: Option<u64>) -> HostBudgetJoin {\n".to_string()), "    let cgroup_v1_limit = match cgroup_v1_limit {\n".to_string()), "        Some((dir, HostBudgetCgroupV1::Unparseable(body))) => {\n".to_string()), "            return HostBudgetJoin::Unreadable { reason: format!(\"cgroup v1 memory hierarchy at {} holds this process but its hierarchical_memory_limit is unreadable ({}); a bound that may be the tightest cannot be replaced by another reading\", dir, body) };\n".to_string()), "        }\n".to_string()), "        Some((dir, HostBudgetCgroupV1::Limited(bytes))) => Some((dir, bytes)),\n".to_string()), "        Some((_, HostBudgetCgroupV1::Unlimited)) | None => None,\n".to_string()), "    };\n".to_string()), "    let observation = [\n".to_string()), "        cgroup_high.map(|(cgroup_dir, b)| (HostBudgetJoinSource::CgroupMemoryHigh { cgroup_dir }, b)),\n".to_string()), "        cgroup_max.map(|(cgroup_dir, b)| (HostBudgetJoinSource::CgroupMemoryMax { cgroup_dir }, b)),\n".to_string()), "        cgroup_v1_limit.map(|(cgroup_dir, b)| (HostBudgetJoinSource::CgroupV1HierarchicalMemoryLimit { cgroup_dir }, b)),\n".to_string()), "    ].into_iter().flatten().fold(None::<(HostBudgetJoinSource, u64)>, |best, cand| match best { Some(cur) if cur.1 <= cand.1 => Some(cur), _ => Some(cand) });\n".to_string()), "    if let Some((source, observed_bytes)) = observation {\n".to_string()), "        return HostBudgetJoin::Resolved { effective_bytes: env_override.map(|requested| requested.min(observed_bytes)).unwrap_or(observed_bytes), requested_bytes: env_override, source, observed_bytes };\n".to_string()), "    }\n".to_string()), "    if let Some(bytes) = darwin_physical {\n".to_string()), "        return HostBudgetJoin::Resolved { effective_bytes: env_override.map(|requested| requested.min(bytes)).unwrap_or(bytes), requested_bytes: env_override, source: HostBudgetJoinSource::DarwinPhysicalMemory, observed_bytes: bytes };\n".to_string()), "    }\n".to_string()), "    if let Some(requested_bytes) = env_override {\n".to_string()), "        return HostBudgetJoin::DeclaredUnverified { requested_bytes, reason: \"no observed private memory.high, memory.max or v1 hierarchical_memory_limit verifies the executor allowance; the declaration is a planning request, not an enforced process limit\".to_string() };\n".to_string()), "    }\n".to_string()), "    HostBudgetJoin::Unreadable { reason: format!(\"no cgroup memory.high, memory.max or v1 hierarchical_memory_limit binds this process and GUNBC_MEMORY_BUDGET_BYTES cannot verify one (target_os={}), so the planning allowance is UNKNOWN. Refusing rather than admitting against the widest signal available: a host-shared reading is a number about the MACHINE, not about this slot, and admitting against one is the rc=137 SIGKILL this arm exists to prevent (BuildBuddy receipt 2026-08-30, gunbc.host_budget_source host_budget_source_seed_mirror_disposition). The executor must expose an enforceable limit; GUNBC_MEMORY_BUDGET_BYTES may only request a lower planning ceiling.\", std::env::consts::OS) }\n".to_string()), "}\n\n".to_string()), "pub fn read_host_budget_bytes() -> (Option<u64>, String) {\n".to_string()), "    let join = resolve_host_budget_join(\n".to_string()), "        std::env::var(\"GUNBC_MEMORY_BUDGET_BYTES\").ok().and_then(|s| s.trim().parse::<u64>().ok()),\n".to_string()), "        host_budget_tightest_cgroup(\"memory.high\"),\n".to_string()), "        host_budget_tightest_cgroup(\"memory.max\"),\n".to_string()), "        host_budget_cgroup_v1(),\n".to_string()), "        host_budget_darwin_physical(),\n".to_string()), "    );\n".to_string()), "    (join.bytes(), join.label())\n".to_string()), "}\n\n".to_string()), "#[derive(Clone)]\n".to_string()), "pub enum HostBudgetCgroupV1 {\n".to_string()), "    Limited(u64),\n".to_string()), "    Unlimited,\n".to_string()), "    Unparseable(String),\n".to_string()), "}\n\n".to_string()), "pub fn host_budget_tightest_cgroup_under(self_cg: &str, root: &std::path::Path, limit_file: &str) -> Option<(String, u64)> {\n".to_string()), "    let rel = self_cg\n".to_string()), "        .lines()\n".to_string()), "        .find_map(|l| l.strip_prefix(\"0::\"))\n".to_string()), "        .map(|p| p.trim().trim_start_matches('/').to_string())?;\n".to_string()), "    let mut dir = root.join(&rel);\n".to_string()), "    let mut best: Option<(u64, std::path::PathBuf)> = None;\n".to_string()), "    loop {\n".to_string()), "        if let Ok(s) = std::fs::read_to_string(dir.join(limit_file)) {\n".to_string()), "            let s = s.trim();\n".to_string()), "            if s != \"max\" {\n".to_string()), "                if let Ok(v) = s.parse::<u64>() {\n".to_string()), "                    let take = best.as_ref().map(|(cur, _)| v < *cur).unwrap_or(true);\n".to_string()), "                    if take {\n".to_string()), "                        best = Some((v, dir.clone()));\n".to_string()), "                    }\n".to_string()), "                }\n".to_string()), "            }\n".to_string()), "        }\n".to_string()), "        if dir == root || !dir.pop() {\n".to_string()), "            break;\n".to_string()), "        }\n".to_string()), "    }\n".to_string()), "    best.map(|(v, d)| (d.display().to_string(), v))\n".to_string()), "}\n\n".to_string()), "pub fn host_budget_tightest_cgroup(limit_file: &str) -> Option<(String, u64)> {\n".to_string()), "    let self_cg = std::fs::read_to_string(\"/proc/self/cgroup\").ok()?;\n".to_string()), "    host_budget_tightest_cgroup_under(&self_cg, std::path::Path::new(\"/sys/fs/cgroup\"), limit_file)\n".to_string()), "}\n\n".to_string()), "pub fn host_budget_cgroup_v1_unlimited_bytes(page_size: u64) -> u64 {\n".to_string()), "    (i64::MAX as u64 / page_size) * page_size\n".to_string()), "}\n\n".to_string()), "pub fn host_budget_cgroup_v1() -> Option<(String, HostBudgetCgroupV1)> {\n".to_string()), "    let self_cg = std::fs::read_to_string(\"/proc/self/cgroup\").ok()?;\n".to_string()), "    let mountinfo = std::fs::read_to_string(\"/proc/self/mountinfo\").ok()?;\n".to_string()), "    let page_size = unsafe { libc::sysconf(libc::_SC_PAGESIZE) };\n".to_string()), "    if page_size <= 0 {\n".to_string()), "        return Some((\n".to_string()), "            \"/proc/self/mountinfo\".to_string(),\n".to_string()), "            HostBudgetCgroupV1::Unparseable(\"sysconf(_SC_PAGESIZE) unreadable\".to_string()),\n".to_string()), "        ));\n".to_string()), "    }\n".to_string()), "    host_budget_cgroup_v1_under(std::path::Path::new(\"/\"), &self_cg, &mountinfo, page_size as u64)\n".to_string()), "}\n\n".to_string()), "pub fn host_budget_cgroup_v1_under(fs_root: &std::path::Path, self_cg: &str, mountinfo: &str, page_size: u64) -> Option<(String, HostBudgetCgroupV1)> {\n".to_string()), "    let dir = host_budget_cgroup_v1_memory_dir(self_cg, mountinfo)?;\n".to_string()), "    let dir_path = std::path::Path::new(&dir);\n".to_string()), "    let joined = fs_root.join(dir_path.strip_prefix(\"/\").unwrap_or(dir_path));\n".to_string()), "    let value = match std::fs::read_to_string(joined.join(\"memory.stat\")) {\n".to_string()), "        Ok(stat) => host_budget_cgroup_v1_from_stat(&stat, page_size),\n".to_string()), "        Err(e) => HostBudgetCgroupV1::Unparseable(format!(\"memory.stat: {}\", e)),\n".to_string()), "    };\n".to_string()), "    Some((joined.display().to_string(), value))\n".to_string()), "}\n\n".to_string()), "pub fn host_budget_cgroup_v1_memory_dir(self_cg: &str, mountinfo: &str) -> Option<String> {\n".to_string()), "    let (mount_root, mount_point) = mountinfo.lines().find_map(|line| {\n".to_string()), "        let fields: Vec<&str> = line.split(' ').collect();\n".to_string()), "        let dash = fields.iter().position(|f| *f == \"-\")?;\n".to_string()), "        let fstype = fields.get(dash + 1)?;\n".to_string()), "        let super_opts = fields.get(dash + 3)?;\n".to_string()), "        if *fstype == \"cgroup\" && super_opts.split(',').any(|o| o == \"memory\") {\n".to_string()), "            Some((fields.get(3)?.to_string(), fields.get(4)?.to_string()))\n".to_string()), "        } else {\n".to_string()), "            None\n".to_string()), "        }\n".to_string()), "    })?;\n".to_string()), "    let path = self_cg.lines().find_map(|l| {\n".to_string()), "        let mut parts = l.splitn(3, ':');\n".to_string()), "        let (_id, controllers, path) = (parts.next()?, parts.next()?, parts.next()?);\n".to_string()), "        controllers.split(',').any(|c| c == \"memory\").then(|| path.trim().to_string())\n".to_string()), "    })?;\n".to_string()), "    let rel = if mount_root == \"/\" {\n".to_string()), "        path.as_str()\n".to_string()), "    } else {\n".to_string()), "        let rest = path.strip_prefix(mount_root.as_str())?;\n".to_string()), "        if !(rest.is_empty() || rest.starts_with('/')) { return None; }\n".to_string()), "        rest\n".to_string()), "    };\n".to_string()), "    Some(std::path::Path::new(&mount_point).join(rel.trim_start_matches('/')).display().to_string())\n".to_string()), "}\n\n".to_string()), "pub fn host_budget_cgroup_v1_from_stat(memory_stat: &str, page_size: u64) -> HostBudgetCgroupV1 {\n".to_string()), "    let hits: std::vec::Vec<&str> = memory_stat.lines().filter_map(|l| l.trim().strip_prefix(\"hierarchical_memory_limit \")).collect();\n".to_string()), "    let [body] = hits.as_slice() else { return HostBudgetCgroupV1::Unparseable(memory_stat.to_string()); };\n".to_string()), "    let unlimited = host_budget_cgroup_v1_unlimited_bytes(page_size);\n".to_string()), "    match body.trim().parse::<i128>() {\n".to_string()), "        Ok(n) if n < 0 => HostBudgetCgroupV1::Unparseable(body.to_string()),\n".to_string()), "        Ok(n) if n >= unlimited as i128 => HostBudgetCgroupV1::Unlimited,\n".to_string()), "        Ok(n) => HostBudgetCgroupV1::Limited(n as u64),\n".to_string()), "        Err(_) => HostBudgetCgroupV1::Unparseable(body.to_string()),\n".to_string()), "    }\n".to_string()), "}\n\n".to_string()), "/// Darwin `hw.memsize` via `sysctlbyname`. Authority: `extdeps.darwin.sysctl` `HwMemsize`.\n".to_string()), "pub fn host_budget_darwin_physical() -> Option<u64> {\n".to_string()), "    #[cfg(target_os = \"macos\")]\n".to_string()), "    {\n".to_string()), "        let name = std::ffi::CStr::from_bytes_with_nul(b\"hw.memsize\\0\").ok()?;\n".to_string()), "        let mut value: u64 = 0;\n".to_string()), "        let mut len: libc::size_t = std::mem::size_of::<u64>() as libc::size_t;\n".to_string()), "        let rc = unsafe { libc::sysctlbyname(name.as_ptr(), (&mut value as *mut u64).cast::<libc::c_void>(), &mut len, std::ptr::null_mut(), 0) };\n".to_string()), "        if rc == 0 && value > 0 { Some(value) } else { None }\n".to_string()), "    }\n".to_string()), "    #[cfg(not(target_os = \"macos\"))]\n".to_string()), "    { None }\n".to_string()), "}\n".to_string())
+}
+
 pub fn rt_accelerator_demo_kernel() -> String {
     v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("fn int_relu(x: i64) -> i64 {\n".to_string(), "    if x > 0 { x } else { 0 }\n".to_string()), "}\n\n".to_string()), "/// Opcode wire authority: `extdeps.languages.simd.kernel.relu_mul_add_wire_op_codes`.\n".to_string()), "/// Scaffold regen-sync: see `host_kernel_relu_mul_add_op_codes_scaffold_note` until feature:dag-kernel-realization-handler.\n".to_string()), "const RELU_MUL_ADD_OP_CODES: [i64; 3] = [1, 2, 3];\n\n".to_string()), "fn assert_relu_mul_add_op_codes(op_codes: &[i64], _handler: &str) {\n".to_string()), "    if op_codes != RELU_MUL_ADD_OP_CODES {\n".to_string()), "        panic!(\"unsupported op_codes in accelerator demo kernel\");\n".to_string()), "    }\n".to_string()), "}\n\n".to_string()), "/// Host bridge: `.dag` passes `std.numerical_contract.FmaContractionPolicy`; interpreter maps to 0/1 until target_model emit.\n".to_string()), "pub fn contiguous_loop_elementwise_float_kernel(\n".to_string()), "    op_codes: &[i64],\n".to_string()), "    fma_contraction_policy: i64,\n".to_string()), "    a: &[f64],\n".to_string()), "    b: &[f64],\n".to_string()), "    c: &[f64],\n".to_string()), ") -> Vec<f64> {\n".to_string()), "    assert_relu_mul_add_op_codes(op_codes, \"contiguous_loop_elementwise_float_kernel\");\n".to_string()), "    assert_eq!(a.len(), b.len());\n".to_string()), "    assert_eq!(b.len(), c.len());\n".to_string()), "    let mut out = Vec::with_capacity(a.len());\n".to_string()), "    for i in 0..a.len() {\n".to_string()), "        let elem = match fma_contraction_policy {\n".to_string()), "            0 => {\n".to_string()), "                let prod = a[i] * b[i];\n".to_string()), "                prod + c[i]\n".to_string()), "            },\n".to_string()), "            1 => a[i].mul_add(b[i], c[i]),\n".to_string()), "            _ => panic!(\"unknown fma_contraction_policy\"),\n".to_string()), "        };\n".to_string()), "        out.push(if elem > 0.0 { elem } else { 0.0 });\n".to_string()), "    }\n".to_string()), "    out\n".to_string()), "}\n\n".to_string()), "/// Integer oracle authority: `gunbc.accelerator_demo_eval` via interpreter `Int` binops (`*`/`+`).\n".to_string()), "/// Host kernel uses `wrapping_*` to mirror release interpreter overflow semantics; demo fixtures\n".to_string()), "/// stay in-range under `IntegerExact` — out-of-range inputs are outside the bit-exact bar.\n".to_string()), "pub fn contiguous_loop_elementwise_kernel(\n".to_string()), "    op_codes: &[i64],\n".to_string()), "    a: &[i64],\n".to_string()), "    b: &[i64],\n".to_string()), "    c: &[i64],\n".to_string()), ") -> Vec<i64> {\n".to_string()), "    assert_relu_mul_add_op_codes(op_codes, \"contiguous_loop_elementwise_kernel\");\n".to_string()), "    assert_eq!(a.len(), b.len());\n".to_string()), "    assert_eq!(b.len(), c.len());\n".to_string()), "    let mut out = Vec::with_capacity(a.len());\n".to_string()), "    for i in 0..a.len() {\n".to_string()), "        let tmp = a[i].wrapping_mul(b[i]).wrapping_add(c[i]);\n".to_string()), "        out.push(int_relu(tmp));\n".to_string()), "    }\n".to_string()), "    out\n".to_string()), "}\n".to_string())
 }
diff --git a/src/v1/stage0/src/v1_compiler_stage0_crates.rs b/src/v1/stage0/src/v1_compiler_stage0_crates.rs
index 0161f01a0bf..69b8807052a 100644
--- a/src/v1/stage0/src/v1_compiler_stage0_crates.rs
+++ b/src/v1/stage0/src/v1_compiler_stage0_crates.rs
@@ -28,9 +28,11 @@ pub use crate::gunbc_rust_crate_package_ident::{
 pub use crate::gunbc_rust_crate_package_ident::{
     PackageIdentBinding, PackageIdentRefusalCause, PackageIdentSetOutcome,
 };
+pub use crate::gunbc_rust_emitted_crate::EmittedCrateDependencyDemand;
 pub use crate::gunbc_stage0_crate_partition_generated::generated_partition_crate_rows;
 use crate::gunbc_stage0_crate_partition_generated::GeneratedPartitionCrateKind::{
-    GeneratedEmitCoreCrate, GeneratedFoundationCrate, GeneratedLayeredCoreCrate,
+    GeneratedEmitCoreCrate, GeneratedFacadeCrate, GeneratedFoundationCrate,
+    GeneratedLayeredCoreCrate,
 };
 pub use crate::gunbc_stage0_crate_partition_generated::{
     GeneratedPartitionCrateKind, GeneratedPartitionCrateRow,
@@ -41,8 +43,8 @@ pub use crate::std_dissolution::unbound_dissolution;
 pub use crate::std_dissolution::DissolutionCondition;
 use crate::std_dissolution::DissolutionCondition::*;
 pub use crate::v1_compiler_emit_rust::{
-    emit_cargo_dep, emit_cargo_features_section, emit_non_empty_wrappers,
-    generated_rust_lint_relaxations,
+    emit_cargo_dep, emit_cargo_dep_no_default_features, emit_cargo_features_section,
+    emit_non_empty_wrappers, generated_rust_lint_relaxations,
 };
 pub use crate::v1_compiler_runtime_rust::rust_runtime_cargo_features;
 use crate::v1_rt;
@@ -61,6 +63,7 @@ pub enum Stage0CrateKind {
     FoundationCrate,
     LayeredCoreCrate,
     EmitCoreCrate,
+    FacadeCrate,
 }
 
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
@@ -148,6 +151,14 @@ pub fn stage0_crate_dir_to_sibling_dep_path(crate_dir: String) -> String {
     v1_rt::replace(crate_dir.clone(), "src/v1/".to_string(), "../".to_string())
 }
 
+pub fn partition_crate_dep_path(from_crate_dir: String, to_crate_dir: String) -> String {
+    if (from_crate_dir.clone() == ".".to_string()) {
+        to_crate_dir.clone()
+    } else {
+        stage0_crate_dir_to_sibling_dep_path(to_crate_dir.clone())
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
 #[serde(tag = "_variant")]
 pub enum Stage0ModuleOwnerRefusalCause {
@@ -418,12 +429,108 @@ pub fn stage0_crate_boundary_emit_refusal_message(
 }
 }
 
+pub fn emitted_crate_registry_dep(
+    name: String,
+    version: String,
+    features: Rc<Vec<String>>,
+) -> Rc<CargoDependency> {
+    Rc::new(CargoDependency {
+        name: name.clone(),
+        source: Rc::new(CargoDepSource::RegistryDep {
+            version: version.clone(),
+            default_features: true,
+            features: features.clone(),
+        }),
+    })
+}
+
+pub fn emitted_crate_dependencies(
+    demand: EmittedCrateDependencyDemand,
+) -> Rc<Vec<Rc<CargoDependency>>> {
+    {
+        let base_deps = Rc::new(vec![
+            emitted_crate_registry_dep(
+                "im".to_string(),
+                "15.1".to_string(),
+                Rc::new(vec!["serde".to_string()]),
+            ),
+            emitted_crate_registry_dep(
+                "unicode-ident".to_string(),
+                "1".to_string(),
+                Rc::new(vec![]),
+            ),
+            emitted_crate_registry_dep(
+                "unicode-properties".to_string(),
+                "0.1".to_string(),
+                Rc::new(vec!["emoji".to_string()]),
+            ),
+            emitted_crate_registry_dep(
+                "serde".to_string(),
+                "1".to_string(),
+                Rc::new(vec!["derive".to_string(), "rc".to_string()]),
+            ),
+            emitted_crate_registry_dep("serde_json".to_string(), "1".to_string(), Rc::new(vec![])),
+            emitted_crate_registry_dep("libc".to_string(), "0.2".to_string(), Rc::new(vec![])),
+            emitted_crate_registry_dep("stacker".to_string(), "0.1".to_string(), Rc::new(vec![])),
+            emitted_crate_registry_dep("lazy_static".to_string(), "1".to_string(), Rc::new(vec![])),
+            emitted_crate_registry_dep(
+                "ureq".to_string(),
+                "2".to_string(),
+                Rc::new(vec!["json".to_string()]),
+            ),
+        ]);
+        let cli_deps = if demand.renders_clap_cli.clone() {
+            Rc::new(vec![emitted_crate_registry_dep(
+                "clap".to_string(),
+                "4".to_string(),
+                Rc::new(vec!["derive".to_string()]),
+            )])
+        } else {
+            Rc::new(vec![])
+        };
+        let async_deps = if demand.renders_async_services.clone() {
+            Rc::new(vec![
+                emitted_crate_registry_dep(
+                    "tokio".to_string(),
+                    "1".to_string(),
+                    Rc::new(vec!["full".to_string()]),
+                ),
+                Rc::new(CargoDependency {
+                    name: "reqwest".to_string(),
+                    source: Rc::new(CargoDepSource::RegistryDep {
+                        version: "0.12".to_string(),
+                        default_features: false,
+                        features: Rc::new(vec![
+                            "json".to_string(),
+                            "rustls-tls".to_string(),
+                            "http2".to_string(),
+                            "charset".to_string(),
+                        ]),
+                    }),
+                }),
+                emitted_crate_registry_dep(
+                    "async-trait".to_string(),
+                    "0.1".to_string(),
+                    Rc::new(vec![]),
+                ),
+            ])
+        } else {
+            Rc::new(vec![])
+        };
+        v1_rt::concat(
+            base_deps.clone(),
+            v1_rt::concat(cli_deps.clone(), async_deps.clone()),
+        )
+    }
+}
+
 pub fn stage0_foundation_runtime_dependencies() -> Rc<Vec<Rc<CargoDependency>>> {
     Rc::new(vec![
         Rc::new(CargoDependency {
             name: "stacker".to_string(),
             source: Rc::new(CargoDepSource::RegistryDep {
                 version: "0.1".to_string(),
+                default_features: true,
                 features: Rc::new(vec![]),
             }),
         }),
@@ -431,6 +538,7 @@ pub fn stage0_foundation_runtime_dependencies() -> Rc<Vec<Rc<CargoDependency>>>
             name: "im".to_string(),
             source: Rc::new(CargoDepSource::RegistryDep {
                 version: "15.1".to_string(),
+                default_features: true,
                 features: Rc::new(vec!["serde".to_string()]),
             }),
         }),
@@ -438,6 +546,7 @@ pub fn stage0_foundation_runtime_dependencies() -> Rc<Vec<Rc<CargoDependency>>>
             name: "libc".to_string(),
             source: Rc::new(CargoDepSource::RegistryDep {
                 version: "0.2".to_string(),
+                default_features: true,
                 features: Rc::new(vec![]),
             }),
         }),
@@ -445,6 +554,7 @@ pub fn stage0_foundation_runtime_dependencies() -> Rc<Vec<Rc<CargoDependency>>>
             name: "serde".to_string(),
             source: Rc::new(CargoDepSource::RegistryDep {
                 version: "1".to_string(),
+                default_features: true,
                 features: Rc::new(vec!["derive".to_string(), "rc".to_string()]),
             }),
         }),
@@ -452,6 +562,7 @@ pub fn stage0_foundation_runtime_dependencies() -> Rc<Vec<Rc<CargoDependency>>>
             name: "serde_json".to_string(),
             source: Rc::new(CargoDepSource::RegistryDep {
                 version: "1".to_string(),
+                default_features: true,
                 features: Rc::new(vec![]),
             }),
         }),
@@ -459,6 +570,7 @@ pub fn stage0_foundation_runtime_dependencies() -> Rc<Vec<Rc<CargoDependency>>>
             name: "unicode-ident".to_string(),
             source: Rc::new(CargoDepSource::RegistryDep {
                 version: "1".to_string(),
+                default_features: true,
                 features: Rc::new(vec![]),
             }),
         }),
@@ -466,6 +578,7 @@ pub fn stage0_foundation_runtime_dependencies() -> Rc<Vec<Rc<CargoDependency>>>
             name: "unicode-properties".to_string(),
             source: Rc::new(CargoDepSource::RegistryDep {
                 version: "0.1".to_string(),
+                default_features: true,
                 features: Rc::new(vec!["emoji".to_string()]),
             }),
         }),
@@ -473,6 +586,7 @@ pub fn stage0_foundation_runtime_dependencies() -> Rc<Vec<Rc<CargoDependency>>>
 }
 
 pub fn stage0_reexport_path_dependencies_outcome(
+    from_crate_dir: String,
     reexport_packages: Rc<Vec<String>>,
     rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
 ) -> Rc<Stage0ReexportPathDepsOutcome> {
@@ -499,7 +613,10 @@ pub fn stage0_reexport_path_dependencies_outcome(
                             Rc::new(vec![Rc::new(CargoDependency {
                                 name: pkg.clone(),
                                 source: Rc::new(CargoDepSource::LocalPathDep {
-                                    path: stage0_crate_dir_to_sibling_dep_path(crate_dir.clone()),
+                                    path: partition_crate_dep_path(
+                                        from_crate_dir.clone(),
+                                        crate_dir.clone(),
+                                    ),
                                 }),
                             })]),
                         ),
@@ -523,6 +640,7 @@ pub fn stage0_partition_row_kind(row: Rc<GeneratedPartitionCrateRow>) -> Stage0C
         GeneratedPartitionCrateKind::GeneratedFoundationCrate => Stage0CrateKind::FoundationCrate,
         GeneratedPartitionCrateKind::GeneratedLayeredCoreCrate => Stage0CrateKind::LayeredCoreCrate,
         GeneratedPartitionCrateKind::GeneratedEmitCoreCrate => Stage0CrateKind::EmitCoreCrate,
+        GeneratedPartitionCrateKind::GeneratedFacadeCrate => Stage0CrateKind::FacadeCrate,
     }
 }
 
@@ -531,14 +649,17 @@ pub fn stage0_partition_row_header_doc(row: Rc<GeneratedPartitionCrateRow>) -> S
         GeneratedPartitionCrateKind::GeneratedFoundationCrate => stage0_foundation_header_doc(),
         GeneratedPartitionCrateKind::GeneratedLayeredCoreCrate => stage0_layered_core_header_doc(),
         GeneratedPartitionCrateKind::GeneratedEmitCoreCrate => stage0_emit_core_header_doc(),
+        GeneratedPartitionCrateKind::GeneratedFacadeCrate => partition_facade_header_doc(),
     }
 }
 
 pub fn stage0_partition_row_dependencies_outcome(
     row: Rc<GeneratedPartitionCrateRow>,
     rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+    registry_dependencies: Rc<Vec<Rc<CargoDependency>>>,
 ) -> Rc<Stage0PartitionRowDepsOutcome> {
     match (*stage0_reexport_path_dependencies_outcome(
+        row.crate_dir.clone(),
         crate::gunbc_stage0_partition_package_graph::partition_package_dependency_names_over(
             row.clone(),
             rows.clone(),
@@ -550,7 +671,7 @@ pub fn stage0_partition_row_dependencies_outcome(
         Stage0ReexportPathDepsOutcome::Stage0ReexportPathDepsOk {
             deps: path_deps, ..
         } => Rc::new(Stage0PartitionRowDepsOutcome::Stage0PartitionRowDepsOk {
-            deps: v1_rt::concat(stage0_foundation_runtime_dependencies(), path_deps.clone()),
+            deps: v1_rt::concat(registry_dependencies.clone(), path_deps.clone()),
         }),
         Stage0ReexportPathDepsOutcome::Stage0ReexportPathDepsRefused { cause: cause, .. } => {
             Rc::new(
@@ -571,6 +692,7 @@ pub fn stage0_features_for_crate_kind(
         }
         GeneratedPartitionCrateKind::GeneratedLayeredCoreCrate => Rc::new(vec![]),
         GeneratedPartitionCrateKind::GeneratedEmitCoreCrate => Rc::new(vec![]),
+        GeneratedPartitionCrateKind::GeneratedFacadeCrate => Rc::new(vec![]),
     }
 }
 
@@ -584,8 +706,15 @@ pub fn stage0_partition_row_to_spec_outcome(
     row: Rc<GeneratedPartitionCrateRow>,
     package_idents: Rc<Vec<Rc<PackageIdentBinding>>>,
     rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+    registry_dependencies: Rc<Vec<Rc<CargoDependency>>>,
 ) -> Rc<Stage0PartitionRowSpecOutcome> {
-    match (*stage0_partition_row_dependencies_outcome(row.clone(), rows.clone())).clone() {
+    match (*stage0_partition_row_dependencies_outcome(
+        row.clone(),
+        rows.clone(),
+        registry_dependencies.clone(),
+    ))
+    .clone()
+    {
         Stage0PartitionRowDepsOutcome::Stage0PartitionRowDepsRefused { cause: cause, .. } => {
             Rc::new(
                 Stage0PartitionRowSpecOutcome::Stage0PartitionRowSpecRefused {
@@ -616,12 +745,25 @@ pub fn stage0_partition_row_to_spec_outcome(
 pub fn render_stage0_crate_dep(dep: Rc<CargoDependency>) -> String {
     match (*dep.source.clone()).clone() {
         CargoDepSource::RegistryDep {
-            version, features, ..
-        } => crate::v1_compiler_emit_rust::emit_cargo_dep(
-            dep.name.clone(),
-            version.clone(),
-            features.clone(),
-        ),
+            version,
+            default_features,
+            features,
+            ..
+        } => {
+            if default_features.clone() {
+                crate::v1_compiler_emit_rust::emit_cargo_dep(
+                    dep.name.clone(),
+                    version.clone(),
+                    features.clone(),
+                )
+            } else {
+                crate::v1_compiler_emit_rust::emit_cargo_dep_no_default_features(
+                    dep.name.clone(),
+                    version.clone(),
+                    features.clone(),
+                )
+            }
+        }
         CargoDepSource::LocalPathDep { path: path, .. } => v1_rt::concat(
             v1_rt::concat(
                 v1_rt::concat(dep.name.clone(), " = { path = \"".to_string()),
@@ -940,6 +1082,120 @@ pub fn render_stage0_emit_core_lib_outcome(
 }
 }
 
+pub fn partition_facade_header_doc() -> String {
+    Rc::new(vec!["//! Generated by the emitted crate workspace (gunbc.emitted_crate_workspace) -- do not edit.".to_string(), "//!".to_string(), "//! Facade crate: re-exports every module of the partition from the crate that owns it.".to_string()]).join(&"\n".to_string())
+}
+
+pub fn render_partition_facade_lib_outcome(
+    spec: Rc<Stage0CrateSpec>,
+) -> Rc<Stage0CrateLibEmitOutcome> {
+    match (*stage0_emit_shell_module_reexports_outcome(
+        spec.modules.clone(),
+        spec.package_idents.clone(),
+        spec.partition_rows.clone(),
+    ))
+    .clone()
+    {
+        Stage0EmitShellReexportsOutcome::Stage0EmitShellReexportsRefused {
+            cause: cause, ..
+        } => Rc::new(Stage0CrateLibEmitOutcome::Stage0CrateLibEmitRefused {
+            cause: cause.clone(),
+        }),
+        Stage0EmitShellReexportsOutcome::Stage0EmitShellReexportsIdentUnbound {
+            package_name: package_name,
+            ..
+        } => Rc::new(Stage0CrateLibEmitOutcome::Stage0CrateLibEmitIdentUnbound {
+            package_name: package_name.clone(),
+        }),
+        Stage0EmitShellReexportsOutcome::Stage0EmitShellReexportsOk { lines: lines, .. } => {
+            match (*partition_facade_wrapper_reexports_outcome(spec.clone())).clone() {
+                Stage0ReexportLinesOutcome::Stage0ReexportLinesIdentUnbound {
+                    package_name: package_name,
+                    ..
+                } => Rc::new(Stage0CrateLibEmitOutcome::Stage0CrateLibEmitIdentUnbound {
+                    package_name: package_name.clone(),
+                }),
+                Stage0ReexportLinesOutcome::Stage0ReexportLinesOk {
+                    lines: wrapper_lines,
+                    ..
+                } => Rc::new(Stage0CrateLibEmitOutcome::Stage0CrateLibEmitOk {
+                    file: Rc::new(TextFile {
+                        path: v1_rt::concat(spec.crate_dir.clone(), "/src/lib.rs".to_string()),
+                        content: v1_rt::concat(
+                            v1_rt::concat(
+                                v1_rt::concat(
+                                    v1_rt::concat(
+                                        v1_rt::concat(spec.header_doc.clone(), "\n\n".to_string()),
+                                        stage0_crate_allow_block(),
+                                    ),
+                                    "\n\n".to_string(),
+                                ),
+                                v1_rt::concat(wrapper_lines.clone(), lines.clone())
+                                    .join(&"\n\n".to_string()),
+                            ),
+                            "\n".to_string(),
+                        ),
+                    }),
+                }),
+            }
+        }
+    }
+}
+
+pub fn partition_facade_wrapper_reexports_outcome(
+    spec: Rc<Stage0CrateSpec>,
+) -> Rc<Stage0ReexportLinesOutcome> {
+    Rc::new({
+        let mut __result = Vec::new();
+        for row in spec.partition_rows.clone().iter().cloned() {
+            if row.carries_non_empty_wrappers.clone() {
+                __result.push(row);
+            }
+        }
+        __result
+    })
+    .iter()
+    .cloned()
+    .fold(
+        Rc::new(Stage0ReexportLinesOutcome::Stage0ReexportLinesOk {
+            lines: Rc::new(vec![]),
+        }),
+        |acc: Rc<Stage0ReexportLinesOutcome>, row: Rc<GeneratedPartitionCrateRow>| match (*acc)
+            .clone()
+        {
+            Stage0ReexportLinesOutcome::Stage0ReexportLinesIdentUnbound {
+                package_name: missing,
+                ..
+            } => Rc::new(
+                Stage0ReexportLinesOutcome::Stage0ReexportLinesIdentUnbound {
+                    package_name: missing.clone(),
+                },
+            ),
+            Stage0ReexportLinesOutcome::Stage0ReexportLinesOk { lines: lines, .. } => {
+                match crate::gunbc_rust_crate_package_ident::package_ident_bound(
+                    spec.package_idents.clone(),
+                    row.package_name.clone(),
+                ) {
+                    std::option::Option::None => Rc::new(
+                        Stage0ReexportLinesOutcome::Stage0ReexportLinesIdentUnbound {
+                            package_name: row.package_name.clone(),
+                        },
+                    ),
+                    Some(ident) => Rc::new(Stage0ReexportLinesOutcome::Stage0ReexportLinesOk {
+                        lines: v1_rt::concat(
+                            lines.clone(),
+                            Rc::new(vec![v1_rt::concat(
+                                v1_rt::concat("pub use ".to_string(), ident.clone()),
+                                "::{NonEmptyBTreeSet, NonEmptyVec};".to_string(),
+                            )]),
+                        ),
+                    }),
+                }
+            }
+        },
+    )
+}
+
 pub fn stage0_partition_lookups_valid() -> bool {
     match (*stage0_crate_boundary_emit_outcome()).clone() {
         Stage0CrateBoundaryEmitOutcome::Stage0CrateBoundaryEmitOk { files: _, .. } => true,
@@ -959,15 +1215,20 @@ pub fn emit_stage0_crate_lib_outcome(spec: Rc<Stage0CrateSpec>) -> Rc<Stage0Crat
         }
         Stage0CrateKind::LayeredCoreCrate => render_stage0_layered_core_lib_outcome(spec.clone()),
         Stage0CrateKind::EmitCoreCrate => render_stage0_emit_core_lib_outcome(spec.clone()),
+        Stage0CrateKind::FacadeCrate => render_partition_facade_lib_outcome(spec.clone()),
     }
 }
 
 pub fn stage0_crate_plan_outcome() -> Rc<Stage0CratePlanOutcome> {
-    partition_crate_plan_outcome_over(generated_partition_crate_rows())
+    partition_crate_plan_outcome_over(
+        generated_partition_crate_rows(),
+        stage0_foundation_runtime_dependencies(),
+    )
 }
 
 pub fn partition_crate_plan_outcome_over(
     rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+    registry_dependencies: Rc<Vec<Rc<CargoDependency>>>,
 ) -> Rc<Stage0CratePlanOutcome> {
     match (*crate::gunbc_rust_crate_package_ident::rust_crate_package_idents(Rc::new({
         let mut __result = Vec::new();
@@ -985,13 +1246,18 @@ pub fn partition_crate_plan_outcome_over(
         }
         PackageIdentSetOutcome::PackageIdentSetOk {
             bindings: bindings, ..
-        } => stage0_crate_plan_from_admitted_rows(bindings.clone(), rows.clone()),
+        } => stage0_crate_plan_from_admitted_rows(
+            bindings.clone(),
+            rows.clone(),
+            registry_dependencies.clone(),
+        ),
     }
 }
 
 pub fn stage0_crate_plan_from_admitted_rows(
     package_idents: Rc<Vec<Rc<PackageIdentBinding>>>,
     rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+    registry_dependencies: Rc<Vec<Rc<CargoDependency>>>,
 ) -> Rc<Stage0CratePlanOutcome> {
     rows.clone().iter().cloned().fold(
         Rc::new(Stage0CratePlanOutcome::Stage0CratePlanOk {
@@ -1016,6 +1282,7 @@ pub fn stage0_crate_plan_from_admitted_rows(
                     row.clone(),
                     package_idents.clone(),
                     rows.clone(),
+                    registry_dependencies.clone(),
                 ))
                 .clone()
                 {
@@ -1064,13 +1331,17 @@ pub fn emit_stage0_crate_boundary_files_outcome(
 }
 
 pub fn stage0_crate_boundary_emit_outcome() -> Rc<Stage0CrateBoundaryEmitOutcome> {
-    partition_crate_boundary_emit_outcome_over(generated_partition_crate_rows())
+    partition_crate_boundary_emit_outcome_over(
+        generated_partition_crate_rows(),
+        stage0_foundation_runtime_dependencies(),
+    )
 }
 
 pub fn partition_crate_boundary_emit_outcome_over(
     rows: Rc<Vec<Rc<GeneratedPartitionCrateRow>>>,
+    registry_dependencies: Rc<Vec<Rc<CargoDependency>>>,
 ) -> Rc<Stage0CrateBoundaryEmitOutcome> {
-    match (*partition_crate_plan_outcome_over(rows.clone())).clone() {
+    match (*partition_crate_plan_outcome_over(rows.clone(), registry_dependencies.clone())).clone() {
     Stage0CratePlanOutcome::Stage0CratePlanRefused { cause: cause, .. } => Rc::new(Stage0CrateBoundaryEmitOutcome::Stage0CrateBoundaryEmitRefused {
     cause: stage0_map_package_dir_refusal_to_boundary(cause.clone()),
 }),
@@ -1098,3 +1369,5 @@ pub struct FoundationCrate;
 pub struct LayeredCoreCrate;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct EmitCoreCrate;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct FacadeCrate;
diff --git a/src/v1/stage0/src/v1_compiler_trace.rs b/src/v1/stage0/src/v1_compiler_trace.rs
index 1637cff79ed..a86f63edfb6 100644
--- a/src/v1/stage0/src/v1_compiler_trace.rs
+++ b/src/v1/stage0/src/v1_compiler_trace.rs
@@ -98,15 +98,10 @@ pub fn trace_pop_frame(trace: Rc<Trace>) -> Rc<Trace> {
         } else {
             Rc::new(Trace {
                 events: trace.events.clone(),
-                stack: Rc::new(
-                    trace
-                        .stack
-                        .clone()
-                        .iter()
-                        .cloned()
-                        .take(v1_rt::int_sub(n.clone(), 1) as usize)
-                        .collect::<Vec<_>>(),
-                ),
+                stack: Rc::new(v1_rt::list_take(
+                    &trace.stack.clone(),
+                    v1_rt::int_sub(n.clone(), 1),
+                )),
             })
         }
     }
diff --git a/src/v1/stage0/src/v1_compiler_trait_bound_witness.rs b/src/v1/stage0/src/v1_compiler_trait_bound_witness.rs
index 645e5e50b4c..149ffd3b5f3 100644
--- a/src/v1/stage0/src/v1_compiler_trait_bound_witness.rs
+++ b/src/v1/stage0/src/v1_compiler_trait_bound_witness.rs
@@ -1,7 +1,6 @@
 // Generated by v1 compiler -- do not edit.
 // Source module: v1.compiler.trait_bound_witness
 
-use self::TraitBoundWitnessScope::*;
 use crate::v1_rt;
 use crate::v1_rt::{VecCompat, VecJoin};
 use crate::NonEmptyBTreeSet;
@@ -9,14 +8,6 @@ use crate::NonEmptyVec;
 use im::{vector as vec, HashMap, OrdSet as BTreeSet, Vector as Vec};
 use std::rc::Rc;
 
-#[derive(
-    Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
-)]
-#[serde(tag = "_variant")]
-pub enum TraitBoundWitnessScope {
-    BoundedToDirectTopLevelMatchBody,
-}
-
 pub fn v1_rc_match_scrutinee_clone_bound_param_names(
     generic_param_names: Rc<Vec<String>>,
     scrutinee_type_arg_names: Rc<Vec<String>>,
@@ -205,6 +196,3 @@ pub fn v1_equality_bound_param_name(
         }
     }
 }
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-pub struct BoundedToDirectTopLevelMatchBody;
diff --git a/src/v1/stage0/src/v1_compiler_trait_derive_emit.rs b/src/v1/stage0/src/v1_compiler_trait_derive_emit.rs
index 4f1778fa883..e022f34832a 100644
--- a/src/v1/stage0/src/v1_compiler_trait_derive_emit.rs
+++ b/src/v1/stage0/src/v1_compiler_trait_derive_emit.rs
@@ -2106,22 +2106,8 @@ pub fn v1_ord_propagated_zip_loop(
                     (here.clone()
                         || v1_ord_propagated_zip_loop(
                             param_name.clone(),
-                            Rc::new(
-                                decl_params
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
-                            Rc::new(
-                                type_args
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
+                            Rc::new(v1_rt::list_skip(&decl_params.clone(), 1)),
+                            Rc::new(v1_rt::list_skip(&type_args.clone(), 1)),
                             decl_set_affected_names.clone(),
                             source_indices.clone(),
                         ))
@@ -2775,22 +2761,8 @@ pub fn v1_declared_type_app_mentions_param_non_phantom_loop(
                     (here.clone()
                         || v1_declared_type_app_mentions_param_non_phantom_loop(
                             param_name.clone(),
-                            Rc::new(
-                                decl_params
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
-                            Rc::new(
-                                type_args
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
+                            Rc::new(v1_rt::list_skip(&decl_params.clone(), 1)),
+                            Rc::new(v1_rt::list_skip(&type_args.clone(), 1)),
                             phantom_slot_names.clone(),
                             bounds.clone(),
                             type_decl_items.clone(),
@@ -3652,22 +3624,8 @@ pub fn v1_declared_type_app_clone_impl_needs_param_loop(
                     (here.clone()
                         || v1_declared_type_app_clone_impl_needs_param_loop(
                             param_name.clone(),
-                            Rc::new(
-                                decl_params
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
-                            Rc::new(
-                                type_args
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
+                            Rc::new(v1_rt::list_skip(&decl_params.clone(), 1)),
+                            Rc::new(v1_rt::list_skip(&type_args.clone(), 1)),
                             phantom_slot_names.clone(),
                             bounds.clone(),
                             type_decl_items.clone(),
@@ -3735,22 +3693,8 @@ pub fn v1_declared_arg_positions_need_clone_param(
                     (here.clone()
                         || v1_declared_arg_positions_need_clone_param(
                             param_name.clone(),
-                            Rc::new(
-                                decl_params
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
-                            Rc::new(
-                                type_args
-                                    .clone()
-                                    .iter()
-                                    .cloned()
-                                    .skip(1 as usize)
-                                    .collect::<Vec<_>>(),
-                            ),
+                            Rc::new(v1_rt::list_skip(&decl_params.clone(), 1)),
+                            Rc::new(v1_rt::list_skip(&type_args.clone(), 1)),
                             bound_params.clone(),
                             bounds.clone(),
                             type_decl_items.clone(),
diff --git a/src/v1/stage0/src/v1_interpreter.rs b/src/v1/stage0/src/v1_interpreter.rs
index 6ed58544e37..a18e57618cc 100644
--- a/src/v1/stage0/src/v1_interpreter.rs
+++ b/src/v1/stage0/src/v1_interpreter.rs
@@ -68,11 +68,11 @@ use crate::v1_std_core::{
     index_base, index_expr, is_file_transport, is_rest_transport, is_shell_transport, lambda_body,
     lambda_param_names_at, let_binding_name_at, let_body, let_value, match_arm_nodes,
     match_scrutinee, method_arg_nodes, method_receiver, param_node_default_value,
-    param_node_name_at, qualified_last_segment, record_lit_type_name_at, return_value, slice_base,
-    slice_end, slice_start, transport_stdin, type_name_compatible, unaryop_operand, CallSemantics,
-    Cardinality, Connective, ErrorNode, ExprData, FieldAccessStyle, FieldSummary, FieldValueShape,
-    InferredNode, MatchPattern, MethodSemantics, NewlineIndex, Node, SourceSpan, StringPart,
-    UnaryOpKind, VarBindingKind,
+    param_node_name_at, param_node_type_expr, qualified_last_segment, record_lit_type_name_at,
+    return_value, slice_base, slice_end, slice_start, transport_stdin, type_name_compatible,
+    unaryop_operand, CallSemantics, Cardinality, Connective, ErrorNode, ExprData, FieldAccessStyle,
+    FieldSummary, FieldValueShape, InferredNode, MatchPattern, MethodSemantics, NewlineIndex, Node,
+    SourceSpan, StringPart, UnaryOpKind, VarBindingKind,
 };
 
 #[path = "bounded_shell_host_drain.rs"]
@@ -1100,16 +1100,74 @@ fn value_eq_calls() -> u64 {
 /// onto a heap worklist and dropped from there with its own children already detached. Shared
 /// children (`Rc` strong count above one) are left in place; their last owner detaches them.
 /// Class: gunbc.recurring_failure_mode recursion_over_value_depth_uncounted_by_the_call_limit.
+///
+/// A PERSISTENT CARRIER IS DETACHED ONLY ONCE DROP NESTING IS DEEP. A List or Map is an RRB / HAMT
+/// tree whose nodes may be shared with other values -- a `skip` or `map_insert` result shares
+/// all but a logarithmic boundary with its source -- and consuming one into the worklist clones
+/// every member out of the shared nodes, so dropping a slice cost its source's length and a walk
+/// that slices by offset was quadratic in the drop alone. Detaching exists for host-stack depth,
+/// and depth only accrues where one carrier's drop nests another's: below
+/// `VALUE_DROP_INLINE_DEPTH` nested drops the carrier is released by its own drop, which frees
+/// shared nodes by reference count and runs each member's `Value::drop` (itself iterative over
+/// Variant / Record depth); at or beyond it the carrier is detached as before, so a list nested
+/// to any depth still drops in bounded host stack (`value_depth_walker_tests::a_deep_list_drops`).
 impl Drop for Value {
     fn drop(&mut self) {
+        let depth = VALUE_DROP_DEPTH
+            .try_with(|d| {
+                let depth = d.get();
+                d.set(depth + 1);
+                depth
+            })
+            .unwrap_or(VALUE_DROP_INLINE_DEPTH);
+        let detach_carriers = depth >= VALUE_DROP_INLINE_DEPTH;
         let mut pending: Vec<Value> = Vec::new();
-        detach_owned_children(self, &mut pending);
+        detach_owned_children(self, &mut pending, detach_carriers);
         while let Some(mut child) = pending.pop() {
-            detach_owned_children(&mut child, &mut pending);
+            detach_owned_children(&mut child, &mut pending, detach_carriers);
         }
+        // A carrier left attached is released HERE, while the depth is raised: drop glue would
+        // release it only after this function returns and the depth is restored, and a nested
+        // carrier's members would then never see the depth they are at.
+        match self {
+            Value::List(items) => drop(std::mem::replace(items, empty_list_carrier())),
+            Value::Map(entries) => drop(std::mem::replace(entries, empty_map_carrier())),
+            _ => {}
+        }
+        let _ = VALUE_DROP_DEPTH.try_with(|d| d.set(depth));
     }
 }
 
+thread_local! {
+    static EMPTY_LIST_CARRIER: Rc<RrbVector<Value>> = Rc::new(RrbVector::new());
+    static EMPTY_MAP_CARRIER: Rc<HamtMap<CanonKey, Value>> = Rc::new(HamtMap::new());
+}
+
+fn empty_list_carrier() -> Rc<RrbVector<Value>> {
+    EMPTY_LIST_CARRIER
+        .try_with(Rc::clone)
+        .unwrap_or_else(|_| Rc::new(RrbVector::new()))
+}
+
+fn empty_map_carrier() -> Rc<HamtMap<CanonKey, Value>> {
+    EMPTY_MAP_CARRIER
+        .try_with(Rc::clone)
+        .unwrap_or_else(|_| Rc::new(HamtMap::new()))
+}
+
+const VALUE_DROP_INLINE_DEPTH: u32 = 64;
+
+thread_local! {
+    static VALUE_DROP_DEPTH: std::cell::Cell<u32> = const { std::cell::Cell::new(0) };
+}
+
+// TEST-ONLY WORK OBSERVATION: members moved out of a persistent carrier by drop, so the drop's
+// cost contract is observed as work rather than time.
+#[cfg(test)]
+thread_local! {
+    static DROP_DETACHED_CARRIER_MEMBERS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
+}
+
 /// The portable form is a plain tree with no sharing, so it is as deep as the value it was taken
 /// from and needs the same iterative drop (`impl Drop for Value`): a recursive drop of a deep
 /// portable chain aborted the process (stack overflow) in
@@ -1141,15 +1199,19 @@ fn detach_portable_children(value: &mut PortableValue, pending: &mut Vec<Portabl
     }
 }
 
-fn detach_owned_children(value: &mut Value, pending: &mut Vec<Value>) {
+fn detach_owned_children(value: &mut Value, pending: &mut Vec<Value>, detach_carriers: bool) {
     match value {
-        Value::List(items) => {
+        Value::List(items) if detach_carriers => {
             if let Some(items) = Rc::get_mut(items) {
+                #[cfg(test)]
+                DROP_DETACHED_CARRIER_MEMBERS.with(|c| c.set(c.get() + items.len() as u64));
                 pending.extend(std::mem::take(items));
             }
         }
-        Value::Map(entries) => {
+        Value::Map(entries) if detach_carriers => {
             if let Some(entries) = Rc::get_mut(entries) {
+                #[cfg(test)]
+                DROP_DETACHED_CARRIER_MEMBERS.with(|c| c.set(c.get() + entries.len() as u64));
                 pending.extend(std::mem::take(entries).into_iter().map(|(_, v)| v));
             }
         }
@@ -5530,12 +5592,6 @@ mod cross_claim_memo_tests {
     }
 }
 
-#[derive(Default)]
-struct ParseTableMemo {
-    map: HashMap<(String, String, i64, Symbol), Value>,
-    keepalive: Vec<Value>,
-}
-
 // Recompute-trace ledger (diagnostic READ mode: reports, never gates — DESIGN §5 stopped-line
 // audit). Counts evaluations of pure named fns (empty `uses` row) per (fn identity, argument
 // identity). Keying is SOUND-ONLY: an argument without a cheap sound identity (composite
@@ -6518,7 +6574,6 @@ pub struct InterpContext {
     cast_source_name_cache: std::cell::RefCell<HashMap<usize, String>>,
     cast_source_name_cache_keepalive: std::cell::RefCell<Vec<Rc<Node>>>,
     pure_call_memo: std::cell::RefCell<PureCallMemo>,
-    parse_table_memo: std::cell::RefCell<ParseTableMemo>,
     eval_recompute_trace: std::cell::RefCell<EvalRecomputeTrace>,
     eval_call_memo: std::cell::RefCell<EvalCallMemo>,
     // Effect-dispatch odometer, incremented per service-operation dispatch. The eval-call memo
@@ -6944,7 +6999,6 @@ impl InterpContext {
             cast_source_name_cache: std::cell::RefCell::new(HashMap::new()),
             cast_source_name_cache_keepalive: std::cell::RefCell::new(Vec::new()),
             pure_call_memo: std::cell::RefCell::new(PureCallMemo::default()),
-            parse_table_memo: std::cell::RefCell::new(ParseTableMemo::default()),
             eval_recompute_trace: std::cell::RefCell::new(EvalRecomputeTrace::default()),
             eval_call_memo: std::cell::RefCell::new(EvalCallMemo::default()),
             effect_dispatch_count: std::cell::Cell::new(0),
@@ -7366,6 +7420,26 @@ pub fn declared_parameter_names(ctx: &InterpContext, entry_fn: &str) -> Option<V
     )
 }
 
+/// Authored `(name, type-expr)` pairs `entry_fn` declares, in declaration order.
+pub fn declared_parameter_type_exprs(
+    ctx: &InterpContext,
+    entry_fn: &str,
+) -> Option<Vec<(String, Rc<Node>)>> {
+    let fn_node = ctx.lookup_fn(entry_fn)?;
+    Some(
+        fn_node
+            .params
+            .iter()
+            .map(|p| {
+                (
+                    authored_name_at(ctx.si(), p.clone()),
+                    param_node_type_expr(p.clone()),
+                )
+            })
+            .collect(),
+    )
+}
+
 /// Peak parent-chain depth observed across `call_function` frames in the last
 /// `run_in_context*` invocation (test witness for lexical-base scoping).
 #[cfg(any(test, feature = "interp_test_witness"))]
@@ -8463,7 +8537,24 @@ fn eval_expr_inner(node: &Rc<Node>, env: &Rc<Env>, ctx: &InterpContext) -> Inter
             ),
         }),
 
-        ExprData::NoExprData => Ok(Value::Unit),
+        ExprData::NoExprData => {
+            // A List/Set type node (make_container_type) is NoExprData. Evaluating it as
+            // [] was a fabricated default (review 77868, DESIGN §5/§6b). Empty list
+            // values keep ExprListLit and evaluate in that arm. A type used as a value
+            // refuses.
+            let ty = match node.inferred.as_deref() {
+                Some(InferredNode::Resolved { node: t, .. }) => t.clone(),
+                _ => node.clone(),
+            };
+            if crate::v1_compiler_infer_types::node_is_element_collection(ty, ctx.si()) {
+                Err(InterpError::TypeError {
+                    msg: "type node used as a value (empty list must remain ExprListLit)"
+                        .to_string(),
+                })
+            } else {
+                Ok(Value::Unit)
+            }
+        }
     }
 }
 
@@ -11232,10 +11323,6 @@ fn eval_call(node: &Rc<Node>, env: &Rc<Env>, ctx: &InterpContext) -> InterpResul
         return result;
     }
 
-    if let Some(result) = try_parse_table_memo_dispatch(ctx, &func_name, &fn_node, &args, env)? {
-        return Ok(result);
-    }
-
     if let Some(key) = pure_call_memo_key(&fn_node, &func_name, &args) {
         if let Some(v) = pure_call_memo_get(ctx, &key) {
             return Ok(v);
@@ -11461,14 +11548,6 @@ fn eval_fold_list_right_native(
     Ok(acc)
 }
 
-fn witness_holds(value: Value, ctx: &InterpContext) -> Value {
-    Value::Variant {
-        type_name: ctx.sym("Witness"),
-        variant_name: ctx.sym("Holds"),
-        fields: Rc::new(vec![(ctx.sym("value"), value)]),
-    }
-}
-
 fn witness_violates(diagnostic: Value, ctx: &InterpContext) -> Value {
     Value::Variant {
         type_name: ctx.sym("Witness"),
@@ -11477,133 +11556,6 @@ fn witness_violates(diagnostic: Value, ctx: &InterpContext) -> Value {
     }
 }
 
-fn parse_table_materialization_allows_memo(ctx: &InterpContext, table: &Value) -> bool {
-    // SCAFFOLD (§7 seed-retained): extdeps/realization/parse_table_memo.dag
-    // parse_table_memo_seed_handler_dissolution_trigger (Disposition Scaffold) — seed
-    // try_parse_table_memo_dispatch gates ParseTableMemo map insert/serve on Memoize;
-    // .dag authority: v2.compiler.materialization_allows_memo_store.
-    let table_fields = match table {
-        Value::Record { fields, .. } | Value::Variant { fields, .. } => fields,
-        _ => return false,
-    };
-    let Some(mat) = ctx.field(table_fields, "materialization") else {
-        return false;
-    };
-    match mat {
-        Value::Variant { variant_name, .. } => resolve_sym(*variant_name) == "Memoize",
-        _ => false,
-    }
-}
-
-fn parse_table_memo_scope_and_key(
-    ctx: &InterpContext,
-    table: &Value,
-    key: &Value,
-) -> Option<(String, String, i64, Symbol)> {
-    if !parse_table_materialization_allows_memo(ctx, table) {
-        return None;
-    }
-    let table_fields = match table {
-        Value::Record { fields, .. } | Value::Variant { fields, .. } => fields,
-        _ => return None,
-    };
-    let grammar_digest = match ctx.field(table_fields, "grammar_digest")? {
-        Value::Str(s) => s.to_string(),
-        _ => return None,
-    };
-    let token_stream_digest = match ctx.field(table_fields, "token_stream_digest")? {
-        Value::Str(s) => s.to_string(),
-        _ => return None,
-    };
-    let key_fields = match key {
-        Value::Record { fields, .. } | Value::Variant { fields, .. } => fields,
-        _ => return None,
-    };
-    let position = match fields_get(key_fields, ctx.sym("position")) {
-        Some(Value::Int(n)) => *n,
-        _ => return None,
-    };
-    let production = match fields_get(key_fields, ctx.sym("production")) {
-        Some(Value::Str(s)) => ctx.sym(s.as_ref()),
-        _ => return None,
-    };
-    Some((grammar_digest, token_stream_digest, position, production))
-}
-
-/// Handler bodies for parse-table memo dispatch. Roster authority is
-/// `v1_interpreter_authored_roster_arms()`; generated lookup routes spellings
-/// before this macro matches on the generated enum variant.
-macro_rules! v1_parse_table_arms {
-    ($cb:ident, $func_name:ident, $ctx:ident, $fn_node:ident, $args:ident, $env:ident) => {
-        $cb! {
-            $func_name, $ctx, $fn_node, $args, $env;
-                arm "parse_table_memo.parse_table_lookup" { "parse_table_lookup" } => {
-                    let positional: Vec<&Value> = $args.iter().map(|(_, v)| v).collect();
-                    let [table, key] = match positional.as_slice() {
-                        [table, key] => [table, key],
-                        _ => return Ok(None),
-                    };
-                    let Some(memo_key) = parse_table_memo_scope_and_key($ctx, table, key) else {
-                        return Ok(None);
-                    };
-                    let allows_memo = parse_table_materialization_allows_memo($ctx, table);
-                    let mut st = $ctx.parse_table_memo.borrow_mut();
-                    if allows_memo {
-                        if let Some(v) = st.map.get(&memo_key).cloned() {
-                            drop(st);
-                            record_parse_memo_lookup(&memo_key, true);
-                            return Ok(Some(witness_holds(v, $ctx)));
-                        }
-                    }
-                    drop(st);
-                    record_parse_memo_lookup(&memo_key, false);
-                    let result = call_function($ctx, $fn_node, $args, $env)?;
-                    Ok(Some(result))
-                },
-                arm "parse_table_memo.parse_table_insert" { "parse_table_insert" } => {
-                    let positional: Vec<&Value> = $args.iter().map(|(_, v)| v).collect();
-                    let [table, key, value] = match positional.as_slice() {
-                        [table, key, value] => [table, key, value],
-                        _ => return Ok(None),
-                    };
-                    let result = call_function($ctx, $fn_node, $args, $env)?;
-                    if parse_table_materialization_allows_memo($ctx, table) {
-                        if let Some(memo_key) = parse_table_memo_scope_and_key($ctx, table, key) {
-                            let mut st = $ctx.parse_table_memo.borrow_mut();
-                            st.keepalive.push((*table).clone());
-                            st.keepalive.push((*key).clone());
-                            st.keepalive.push((*value).clone());
-                            st.map.insert(memo_key, (*value).clone());
-                        }
-                    }
-                    Ok(Some(result))
-                },
-        }
-    };
-}
-
-/// Expansion 1: the dispatch.
-macro_rules! v1_parse_table_dispatch {
-    ($f:ident, $c:ident, $n:ident, $a:ident, $e:ident; $(arm $id:tt { $lit:literal } => $body:expr ,)*) => {
-        match $crate::v1_interpreter_dispatch_generated::lookup_try_parse_table_memo_dispatch(&$f) {
-            Some(arm) => match arm {
-                $( try_parse_table_memo_dispatch_arm!($id) => $body , )*
-            },
-            None => Ok(None),
-        }
-    };
-}
-
-fn try_parse_table_memo_dispatch(
-    ctx: &InterpContext,
-    func_name: &str,
-    fn_node: &Rc<Node>,
-    args: &[(Option<String>, Value)],
-    env: &Rc<Env>,
-) -> InterpResult<Option<Value>> {
-    v1_parse_table_arms!(v1_parse_table_dispatch, func_name, ctx, fn_node, args, env)
-}
-
 fn is_structural_pure_fn(name: &str) -> bool {
     matches!(
         name,
@@ -13395,6 +13347,17 @@ fn lookup_type_item_across_modules(ctx: &InterpContext, type_name: &str) -> Opti
     ctx.indexes.type_items.get(type_name).cloned()
 }
 
+/// RHS of a type declaration, when the item is an alias or resolved target.
+pub fn type_declaration_rhs(item: &Rc<Node>) -> Option<Rc<Node>> {
+    if let Some(rhs) = item.children.iter().next().cloned() {
+        return Some(rhs);
+    }
+    match item.inferred.as_deref() {
+        Some(InferredNode::Resolved { node }) => Some(node.clone()),
+        _ => None,
+    }
+}
+
 #[cfg(test)]
 mod cast_scope_index_tests {
     use super::*;
@@ -14229,17 +14192,13 @@ macro_rules! v1_algebra_method_arms {
             arm "method_call.skip" { "skip" } => {
                 let items = expect_list(&$receiver, "skip")?;
                 let n = expect_int($args.first(), "skip")?;
-                Ok(list_value(
-                    items.iter().skip(n as usize).cloned().collect::<Vec<_>>(),
-                ))
+                Ok(Value::List(Rc::new(rrb_skip(&items, n))))
             },
 
             arm "method_call.take" { "take" } => {
                 let items = expect_list(&$receiver, "take")?;
                 let n = expect_int($args.first(), "take")?;
-                Ok(list_value(
-                    items.iter().take(n as usize).cloned().collect::<Vec<_>>(),
-                ))
+                Ok(Value::List(Rc::new(rrb_take(&items, n))))
             },
 
             arm "method_call.enumerate" { "enumerate" } => {
@@ -18076,7 +18035,7 @@ fn dispatch_shell(
             let (budget, source) = crate::memory_governor::read_host_budget_bytes();
             Some(budget.ok_or_else(|| InterpError::TypeError {
                 msg: format!(
-                    "WitnessStderrCaptureCompleteBudgetUnreadable: Complete stderr capture requires the active GUNBC_MEMORY_BUDGET_BYTES authority ({source})"
+                    "WitnessStderrCaptureCompleteBudgetUnreadable: Complete stderr capture requires the active host budget authority ({source})"
                 ),
             })? as usize)
         }
@@ -23604,7 +23563,7 @@ macro_rules! v1_builtin_arms {
 
             arm "free_call.chars_to_string" { "chars_to_string" } => {
                 let cps = match $positional.first().copied() {
-                    Some(v) => free_monoid_to_vec(v).ok_or_else(|| InterpError::TypeError {
+                    Some(v) => free_monoid_items(v).ok_or_else(|| InterpError::TypeError {
                         msg: "chars_to_string expects a list of code points".to_string(),
                     })?,
                     None => {
@@ -23621,7 +23580,9 @@ macro_rules! v1_builtin_arms {
                     .max(0)
                     .min(len)
                     .max(start);
-                let s: String = cps[start as usize..end as usize]
+                let s: String = cps
+                    .skip(start as usize)
+                    .take((end - start) as usize)
                     .iter()
                     .filter_map(|v| match v {
                         Value::Int(cp) => char::from_u32(*cp as u32),
@@ -23632,6 +23593,10 @@ macro_rules! v1_builtin_arms {
             },
 
             arm "free_call.get" { "get" } => match $positional.as_slice() {
+                [Value::List(items), idx_val] => {
+                    let idx = expect_int(Some(idx_val), "get")?;
+                    Ok(Some(list_get_at_or_null(items, idx)))
+                }
                 [list_val, idx_val] if free_monoid_to_vec(list_val).is_some() => {
                     let items = expect_list(list_val, "get")?;
                     let idx = expect_int(Some(idx_val), "get")?;
@@ -23712,6 +23677,7 @@ macro_rules! v1_builtin_arms {
             },
 
             arm "free_call.count" { "count" } => match $positional.first() {
+                Some(Value::List(items)) => Ok(Some(Value::Int(items.len() as i64))),
                 Some(v) => match free_monoid_to_vec(v) {
                     Some(items) => Ok(Some(Value::Int(items.len() as i64))),
                     None => Ok(None),
@@ -25735,45 +25701,6 @@ static CALL_FREQUENCY_WATCHLIST: std::sync::Mutex<
     Option<std::collections::HashMap<&'static str, u64>>,
 > = std::sync::Mutex::new(None);
 
-/// adhoc-c328b166-bca memo-effectiveness discriminator: distinct (grammar_digest,
-/// token_stream_digest, position, production) keys ever looked up vs total lookups/hits.
-/// `lookups >> distinct` with `hits == 0` is the smoking gun for "memo never serves a
-/// re-attempted span"; `lookups == distinct` is the benign "every position visited once"
-/// signature. Global (not per-InterpContext) so the periodic dump thread
-/// (GUNBC_FLATTEN_SITE_DUMP_SECS), which never enters with_active_context, can read it --
-/// survives a DNF, unlike ctx-scoped stats.
-static PARSE_MEMO_LOOKUPS: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
-static PARSE_MEMO_HITS: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
-static PARSE_MEMO_DISTINCT_KEYS: std::sync::Mutex<
-    Option<std::collections::HashSet<(String, String, i64, Symbol)>>,
-> = std::sync::Mutex::new(None);
-
-fn record_parse_memo_lookup(key: &(String, String, i64, Symbol), hit: bool) {
-    if !residual_hunt_forensics_enabled() {
-        return;
-    }
-    PARSE_MEMO_LOOKUPS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-    if hit {
-        PARSE_MEMO_HITS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-    }
-    let mut guard = PARSE_MEMO_DISTINCT_KEYS.lock().unwrap();
-    guard
-        .get_or_insert_with(std::collections::HashSet::new)
-        .insert(key.clone());
-}
-
-pub fn parse_memo_global_snapshot() -> (u64, u64, u64) {
-    let lookups = PARSE_MEMO_LOOKUPS.load(std::sync::atomic::Ordering::Relaxed);
-    let hits = PARSE_MEMO_HITS.load(std::sync::atomic::Ordering::Relaxed);
-    let distinct = PARSE_MEMO_DISTINCT_KEYS
-        .lock()
-        .unwrap()
-        .as_ref()
-        .map(|s| s.len() as u64)
-        .unwrap_or(0);
-    (lookups, hits, distinct)
-}
-
 fn record_call_frequency(func_name: &str) {
     if !residual_hunt_forensics_enabled() {
         return;
@@ -25797,17 +25724,10 @@ fn record_call_frequency(func_name: &str) {
         "parse_expr_sequence",
         "parse_expr_choice",
         "parse_expr_optional",
-        "parse_production_memo_stats",
         "filter",
         "upsert_production_first_row",
         "parse_current_position",
-        "parse_nonterminal_memoized",
-        "parse_nonterminal_memoized_core",
-        "parse_table_record_lookup_call",
-        "parse_table_record_hit",
-        "parse_table_record_miss",
-        "parse_table_lookup",
-        "parse_table_insert",
+        "parse_nonterminal",
         "parse_choice_plan",
         "parse_choice_ordered_backtrack",
         "uri_percent_encode_scalar_fragment",
@@ -26486,6 +26406,183 @@ fn value_to_list_carrier(val: &Value) -> Option<(Rc<RrbVector<Value>>, u64)> {
     }
 }
 
+/// The members of a code-point (or any FreeMonoid) value as the persistent carrier, sharing a
+/// `Value::List`'s tree rather than flattening it. `free_monoid_to_vec` copies all n members, so a
+/// consumer that reads a slice through it pays O(n) per read and O(n^2) over a walk; this reads the
+/// list form in O(1) and flattens only the Str and Cons forms, which have no shared tree to borrow.
+fn free_monoid_items(val: &Value) -> Option<Rc<RrbVector<Value>>> {
+    match val {
+        Value::List(items) => Some(Rc::clone(items)),
+        other => free_monoid_to_vec(other).map(|items| Rc::new(RrbVector::from(items))),
+    }
+}
+
+/// std.primitives skip_contract on the persistent carrier: the suffix after `n` members, sharing
+/// the receiver's tree, O(log n) rather than a copy of the remainder. A negative `n` keeps the
+/// reading the copying form had (`n as usize` saturates past the end), which skips everything.
+pub(crate) fn rrb_skip<T: Clone>(items: &RrbVector<T>, n: i64) -> RrbVector<T> {
+    let k = if n < 0 {
+        items.len()
+    } else {
+        (n as usize).min(items.len())
+    };
+    items.skip(k)
+}
+
+/// std.primitives take_contract on the persistent carrier: the first `n` members, sharing the
+/// receiver's tree. A negative `n` keeps every member, as the copying form's saturating cast did.
+pub(crate) fn rrb_take<T: Clone>(items: &RrbVector<T>, n: i64) -> RrbVector<T> {
+    let k = if n < 0 {
+        items.len()
+    } else {
+        (n as usize).min(items.len())
+    };
+    items.take(k)
+}
+
+#[cfg(test)]
+mod slice_cost_tests {
+    use super::*;
+    use std::cell::Cell;
+
+    thread_local! {
+        static CLONES: Cell<u64> = const { Cell::new(0) };
+    }
+
+    /// A code point whose every copy is counted, so a slice's cost is read off the carrier's
+    /// own work rather than a clock.
+    #[derive(Debug, PartialEq)]
+    struct CountedCodePoint(u32);
+
+    impl Clone for CountedCodePoint {
+        fn clone(&self) -> Self {
+            CLONES.with(|c| c.set(c.get() + 1));
+            CountedCodePoint(self.0)
+        }
+    }
+
+    fn clones_during<R>(f: impl FnOnce() -> R) -> (R, u64) {
+        let before = CLONES.with(|c| c.get());
+        let r = f();
+        (r, CLONES.with(|c| c.get()) - before)
+    }
+
+    // Non-ASCII on purpose: the interpreter's string carrier is O(1) per index only on ASCII,
+    // which is the case a byte-offset decode is NOT linear on.
+    fn non_ascii_code_points(n: usize) -> RrbVector<CountedCodePoint> {
+        "\u{e9}\u{4e2d}\u{1f600}a"
+            .chars()
+            .cycle()
+            .take(n)
+            .map(|c| CountedCodePoint(c as u32))
+            .collect()
+    }
+
+    const N: usize = 200_000;
+    // im's RRB split copies at most one boundary chunk per tree level; this is that bound with
+    // headroom, and three orders of magnitude below N.
+    const SLICE_COPY_BUDGET: u64 = 2_048;
+
+    #[test]
+    fn a_slice_from_the_middle_copies_only_boundary_chunks() {
+        let cps = non_ascii_code_points(N);
+        let (slice, copied) = clones_during(|| rrb_take(&rrb_skip(&cps, (N / 2) as i64), 7));
+        assert!(
+            copied <= SLICE_COPY_BUDGET,
+            "skip+take copied {copied} members of {N}"
+        );
+        let expected: Vec<u32> = cps.iter().skip(N / 2).take(7).map(|c| c.0).collect();
+        assert_eq!(slice.iter().map(|c| c.0).collect::<Vec<_>>(), expected);
+    }
+
+    // THE RED CONTROL: the copying form these arms had, on the same input and bound. It must
+    // exceed the budget, or the budget does not discriminate the quadratic.
+    #[test]
+    fn the_copying_slice_form_exceeds_the_budget() {
+        let cps = non_ascii_code_points(N);
+        let (_, copied) = clones_during(|| {
+            let rest: RrbVector<_> = cps.iter().skip(N / 2).cloned().collect();
+            rest.iter().take(7).cloned().collect::<RrbVector<_>>()
+        });
+        assert!(
+            copied > SLICE_COPY_BUDGET,
+            "copying form copied only {copied}"
+        );
+    }
+
+    #[test]
+    fn negative_and_overlong_counts_keep_the_copying_forms_reading() {
+        let cps: RrbVector<i64> = (0..10).collect();
+        let copying_skip = |n: i64| {
+            cps.iter()
+                .skip(n as usize)
+                .cloned()
+                .collect::<RrbVector<_>>()
+        };
+        let copying_take = |n: i64| {
+            cps.iter()
+                .take(n as usize)
+                .cloned()
+                .collect::<RrbVector<_>>()
+        };
+        for n in [-3, 0, 4, 10, 11, i64::MAX] {
+            assert_eq!(rrb_skip(&cps, n), copying_skip(n), "skip {n}");
+            assert_eq!(rrb_take(&cps, n), copying_take(n), "take {n}");
+        }
+    }
+
+    fn detached() -> u64 {
+        DROP_DETACHED_CARRIER_MEMBERS.with(|c| c.get())
+    }
+
+    // The slice's drop is part of the slice's cost: a walk drops one slice per step. Below the
+    // nesting threshold the RRB tree releases its nodes by reference count, so dropping a slice
+    // of a shared list moves no member; the copying drop moved the whole suffix.
+    #[test]
+    fn dropping_a_slice_of_a_shared_list_moves_no_member() {
+        let base = list_value((0..N as i64).map(Value::Int).collect::<Vec<_>>());
+        let Value::List(items) = &base else {
+            unreachable!("list_value builds a list")
+        };
+        let slice = Value::List(Rc::new(rrb_skip(items, (N / 2) as i64)));
+        let before = detached();
+        drop(slice);
+        assert_eq!(detached() - before, 0, "dropping a shared slice walked it");
+        assert_eq!(items.len(), N, "the source survives its slice's drop");
+    }
+
+    // THE RED CONTROL: the same drop once nesting is past the threshold, which is the detaching
+    // path every list drop used to take. It moves the slice's members, so the counter discriminates.
+    #[test]
+    fn the_detaching_drop_moves_the_slice_members() {
+        let base = list_value((0..N as i64).map(Value::Int).collect::<Vec<_>>());
+        let Value::List(items) = &base else {
+            unreachable!("list_value builds a list")
+        };
+        let mut slice = Value::List(Rc::new(rrb_skip(items, (N / 2) as i64)));
+        let before = detached();
+        let mut pending = Vec::new();
+        detach_owned_children(&mut slice, &mut pending, true);
+        assert_eq!(detached() - before, (N - N / 2) as u64);
+    }
+
+    #[test]
+    fn reading_a_list_value_does_not_flatten_it() {
+        let list = list_value((0..N as i64).map(Value::Int).collect::<Vec<_>>());
+        let before = flatten_counters_snapshot();
+        let items = free_monoid_items(&list).expect("a list is a free monoid");
+        assert_eq!(items.len(), N);
+        assert_eq!(
+            flatten_counters_snapshot(),
+            before,
+            "free_monoid_items flattened a Value::List"
+        );
+        // RED CONTROL: the flattening read the get / count / chars_to_string arms used.
+        free_monoid_to_vec(&list).expect("a list is a free monoid");
+        assert_eq!(flatten_counters_snapshot().1 - before.1, N as u64);
+    }
+}
+
 fn list_get_at_or_null(items: &RrbVector<Value>, idx: i64) -> Value {
     items.get(idx as usize).cloned().unwrap_or(Value::Null)
 }
diff --git a/src/v1/stage0/src/v1_interpreter_dispatch_generated.rs b/src/v1/stage0/src/v1_interpreter_dispatch_generated.rs
index 84c11837dc2..24bc0bcb70c 100644
--- a/src/v1/stage0/src/v1_interpreter_dispatch_generated.rs
+++ b/src/v1/stage0/src/v1_interpreter_dispatch_generated.rs
@@ -743,24 +743,3 @@ macro_rules! eval_call_native_intercept_arm {
     ("native_intercept.fold_list") => { $crate::v1_interpreter_dispatch_generated::EvalCallNativeInterceptArm::NativeInterceptFoldList };
     ("native_intercept.fold_list_right") => { $crate::v1_interpreter_dispatch_generated::EvalCallNativeInterceptArm::NativeInterceptFoldListRight };
 }
-#[rustfmt::skip]
-#[derive(Copy, Clone, Debug, PartialEq, Eq)]
-pub enum TryParseTableMemoDispatchArm {
-    ParseTableMemoParseTableLookup,
-    ParseTableMemoParseTableInsert,
-}
-
-#[rustfmt::skip]
-pub fn lookup_try_parse_table_memo_dispatch(spelling: &str) -> Option<TryParseTableMemoDispatchArm> {
-    match spelling {
-        "parse_table_lookup" => Some(TryParseTableMemoDispatchArm::ParseTableMemoParseTableLookup),
-        "parse_table_insert" => Some(TryParseTableMemoDispatchArm::ParseTableMemoParseTableInsert),
-        _ => None,
-    }
-}
-
-#[rustfmt::skip]
-macro_rules! try_parse_table_memo_dispatch_arm {
-    ("parse_table_memo.parse_table_lookup") => { $crate::v1_interpreter_dispatch_generated::TryParseTableMemoDispatchArm::ParseTableMemoParseTableLookup };
-    ("parse_table_memo.parse_table_insert") => { $crate::v1_interpreter_dispatch_generated::TryParseTableMemoDispatchArm::ParseTableMemoParseTableInsert };
-}
diff --git a/src/v1/stage0/src/v1_rt.rs b/src/v1/stage0/src/v1_rt.rs
index 7204701cdf4..5a77c89eb7a 100644
--- a/src/v1/stage0/src/v1_rt.rs
+++ b/src/v1/stage0/src/v1_rt.rs
@@ -758,6 +758,118 @@ pub fn list_push<T: Clone>(mut list: Vec<T>, item: T) -> Vec<T> {
     list
 }
 
+/// std.primitives skip_contract on the persistent carrier: the suffix after `n` members,
+/// sharing the receiver's tree in O(log n) instead of copying the remainder, so a walk that
+/// slices by offset is O(n log n) rather than quadratic. A negative `n` skips every member, as
+/// the copying form's saturating `n as usize` did.
+pub fn list_skip<T: Clone>(items: &Vec<T>, n: i64) -> Vec<T> {
+    let k = if n < 0 {
+        items.len()
+    } else {
+        (n as usize).min(items.len())
+    };
+    items.skip(k)
+}
+
+/// std.primitives take_contract on the persistent carrier: the first `n` members, sharing
+/// the receiver's tree. A negative `n` keeps every member, as the copying form did.
+pub fn list_take<T: Clone>(items: &Vec<T>, n: i64) -> Vec<T> {
+    let k = if n < 0 {
+        items.len()
+    } else {
+        (n as usize).min(items.len())
+    };
+    items.take(k)
+}
+
+#[cfg(test)]
+mod list_slice_tests {
+    use super::*;
+
+    thread_local! {
+        static CLONES: Cell<u64> = const { Cell::new(0) };
+    }
+
+    /// A code point whose every copy is counted, so a slice's cost is read off the carrier's
+    /// own work rather than a clock.
+    #[derive(Debug, PartialEq)]
+    struct CountedCodePoint(u32);
+
+    impl Clone for CountedCodePoint {
+        fn clone(&self) -> Self {
+            CLONES.with(|c| c.set(c.get() + 1));
+            CountedCodePoint(self.0)
+        }
+    }
+
+    fn clones_during<R>(f: impl FnOnce() -> R) -> (R, u64) {
+        let before = CLONES.with(|c| c.get());
+        let r = f();
+        (r, CLONES.with(|c| c.get()) - before)
+    }
+
+    // Non-ASCII on purpose: emitted char_at / substring over a bare &str are O(offset) here,
+    // which is the walk the code-point slice replaces.
+    fn non_ascii_code_points(n: usize) -> Vec<CountedCodePoint> {
+        [0xe9u32, 0x4e2d, 0x1f600, 0x61]
+            .iter()
+            .cycle()
+            .take(n)
+            .map(|cp| CountedCodePoint(*cp))
+            .collect()
+    }
+
+    const N: usize = 200_000;
+    // im's RRB split copies at most one boundary chunk per tree level; this is that bound with
+    // headroom, and three orders of magnitude below N.
+    const SLICE_COPY_BUDGET: u64 = 2_048;
+
+    #[test]
+    fn a_slice_from_the_middle_copies_only_boundary_chunks() {
+        let cps = Rc::new(non_ascii_code_points(N));
+        let (slice, copied) = clones_during(|| list_take(&list_skip(&cps, (N / 2) as i64), 7));
+        assert!(
+            copied <= SLICE_COPY_BUDGET,
+            "skip+take copied {} members of {}",
+            copied,
+            N
+        );
+        let expected: std::vec::Vec<u32> = cps.iter().skip(N / 2).take(7).map(|c| c.0).collect();
+        assert_eq!(
+            slice.iter().map(|c| c.0).collect::<std::vec::Vec<_>>(),
+            expected
+        );
+    }
+
+    // THE RED CONTROL: the extdeps.languages.rust.emit skip / take templates this runtime pair
+    // replaced, spelled as they emitted, on the same input and bound. It must exceed the budget,
+    // or the budget does not discriminate the quadratic.
+    #[test]
+    fn the_copying_template_form_exceeds_the_budget() {
+        let cps = Rc::new(non_ascii_code_points(N));
+        let (_, copied) = clones_during(|| {
+            let rest = cps.iter().cloned().skip(N / 2).collect::<Vec<_>>();
+            rest.iter().cloned().take(7).collect::<Vec<_>>()
+        });
+        assert!(
+            copied > SLICE_COPY_BUDGET,
+            "copying form copied only {}",
+            copied
+        );
+    }
+
+    #[test]
+    fn negative_and_overlong_counts_keep_the_copying_forms_reading() {
+        let xs: Vec<i64> = (0..10).collect();
+        for n in [-3i64, 0, 4, 10, 11, i64::MAX] {
+            let copying_skip = xs.iter().cloned().skip(n as usize).collect::<Vec<_>>();
+            let copying_take = xs.iter().cloned().take(n as usize).collect::<Vec<_>>();
+            assert_eq!(list_skip(&xs, n), copying_skip, "skip {}", n);
+            assert_eq!(list_take(&xs, n), copying_take, "take {}", n);
+        }
+    }
+}
+
 pub fn append<T: Clone>(list: Rc<Vec<T>>, item: T) -> Vec<T> {
     let mut v = (*list).clone();
     v.push_back(item);
@@ -1614,3 +1726,323 @@ pub fn contiguous_loop_elementwise_kernel(
     }
     out
 }
+/// The one host-budget precedence. `read_host_budget_bytes` and
+/// `memory_governor::resolve_host_budget` both call `resolve_host_budget_join`.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum HostBudgetJoinSource {
+    CgroupMemoryHigh { cgroup_dir: String },
+    CgroupMemoryMax { cgroup_dir: String },
+    CgroupV1HierarchicalMemoryLimit { cgroup_dir: String },
+    DarwinPhysicalMemory,
+}
+
+impl HostBudgetJoinSource {
+    pub fn label(&self) -> String {
+        match self {
+            HostBudgetJoinSource::CgroupMemoryHigh { cgroup_dir } => {
+                format!("cgroup memory.high ({})", cgroup_dir)
+            }
+            HostBudgetJoinSource::CgroupMemoryMax { cgroup_dir } => {
+                format!("cgroup memory.max ({})", cgroup_dir)
+            }
+            HostBudgetJoinSource::CgroupV1HierarchicalMemoryLimit { cgroup_dir } => format!(
+                "cgroup v1 memory.stat hierarchical_memory_limit ({})",
+                cgroup_dir
+            ),
+            HostBudgetJoinSource::DarwinPhysicalMemory => "sysctl hw.memsize".to_string(),
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum HostBudgetJoin {
+    Resolved {
+        effective_bytes: u64,
+        requested_bytes: Option<u64>,
+        source: HostBudgetJoinSource,
+        observed_bytes: u64,
+    },
+    DeclaredUnverified {
+        requested_bytes: u64,
+        reason: String,
+    },
+    Unreadable {
+        reason: String,
+    },
+}
+
+impl HostBudgetJoin {
+    pub fn bytes(&self) -> Option<u64> {
+        match self {
+            HostBudgetJoin::Resolved {
+                effective_bytes, ..
+            } => Some(*effective_bytes),
+            HostBudgetJoin::DeclaredUnverified {
+                requested_bytes, ..
+            } => Some(*requested_bytes),
+            HostBudgetJoin::Unreadable { .. } => None,
+        }
+    }
+    pub fn label(&self) -> String {
+        match self {
+            HostBudgetJoin::Resolved {
+                effective_bytes,
+                requested_bytes,
+                source,
+                observed_bytes,
+            } => match requested_bytes {
+                Some(requested) => format!(
+                    "effective planning minimum {} bytes (env request {}; observed {}={} bytes)",
+                    effective_bytes,
+                    requested,
+                    source.label(),
+                    observed_bytes
+                ),
+                None => source.label(),
+            },
+            HostBudgetJoin::Unreadable { reason } => format!("unreadable: {}", reason),
+            HostBudgetJoin::DeclaredUnverified {
+                requested_bytes,
+                reason,
+            } => format!(
+                "declared-unverified: env GUNBC_MEMORY_BUDGET_BYTES={}; {}",
+                requested_bytes, reason
+            ),
+        }
+    }
+}
+
+pub fn resolve_host_budget_join(
+    env_override: Option<u64>,
+    cgroup_high: Option<(String, u64)>,
+    cgroup_max: Option<(String, u64)>,
+    cgroup_v1_limit: Option<(String, HostBudgetCgroupV1)>,
+    darwin_physical: Option<u64>,
+) -> HostBudgetJoin {
+    let cgroup_v1_limit = match cgroup_v1_limit {
+        Some((dir, HostBudgetCgroupV1::Unparseable(body))) => {
+            return HostBudgetJoin::Unreadable { reason: format!("cgroup v1 memory hierarchy at {} holds this process but its hierarchical_memory_limit is unreadable ({}); a bound that may be the tightest cannot be replaced by another reading", dir, body) };
+        }
+        Some((dir, HostBudgetCgroupV1::Limited(bytes))) => Some((dir, bytes)),
+        Some((_, HostBudgetCgroupV1::Unlimited)) | None => None,
+    };
+    let observation = [
+        cgroup_high
+            .map(|(cgroup_dir, b)| (HostBudgetJoinSource::CgroupMemoryHigh { cgroup_dir }, b)),
+        cgroup_max.map(|(cgroup_dir, b)| (HostBudgetJoinSource::CgroupMemoryMax { cgroup_dir }, b)),
+        cgroup_v1_limit.map(|(cgroup_dir, b)| {
+            (
+                HostBudgetJoinSource::CgroupV1HierarchicalMemoryLimit { cgroup_dir },
+                b,
+            )
+        }),
+    ]
+    .into_iter()
+    .flatten()
+    .fold(
+        None::<(HostBudgetJoinSource, u64)>,
+        |best, cand| match best {
+            Some(cur) if cur.1 <= cand.1 => Some(cur),
+            _ => Some(cand),
+        },
+    );
+    if let Some((source, observed_bytes)) = observation {
+        return HostBudgetJoin::Resolved {
+            effective_bytes: env_override
+                .map(|requested| requested.min(observed_bytes))
+                .unwrap_or(observed_bytes),
+            requested_bytes: env_override,
+            source,
+            observed_bytes,
+        };
+    }
+    if let Some(bytes) = darwin_physical {
+        return HostBudgetJoin::Resolved {
+            effective_bytes: env_override
+                .map(|requested| requested.min(bytes))
+                .unwrap_or(bytes),
+            requested_bytes: env_override,
+            source: HostBudgetJoinSource::DarwinPhysicalMemory,
+            observed_bytes: bytes,
+        };
+    }
+    if let Some(requested_bytes) = env_override {
+        return HostBudgetJoin::DeclaredUnverified { requested_bytes, reason: "no observed private memory.high, memory.max or v1 hierarchical_memory_limit verifies the executor allowance; the declaration is a planning request, not an enforced process limit".to_string() };
+    }
+    HostBudgetJoin::Unreadable { reason: format!("no cgroup memory.high, memory.max or v1 hierarchical_memory_limit binds this process and GUNBC_MEMORY_BUDGET_BYTES cannot verify one (target_os={}), so the planning allowance is UNKNOWN. Refusing rather than admitting against the widest signal available: a host-shared reading is a number about the MACHINE, not about this slot, and admitting against one is the rc=137 SIGKILL this arm exists to prevent (BuildBuddy receipt 2026-08-30, gunbc.host_budget_source host_budget_source_seed_mirror_disposition). The executor must expose an enforceable limit; GUNBC_MEMORY_BUDGET_BYTES may only request a lower planning ceiling.", std::env::consts::OS) }
+}
+
+pub fn read_host_budget_bytes() -> (Option<u64>, String) {
+    let join = resolve_host_budget_join(
+        std::env::var("GUNBC_MEMORY_BUDGET_BYTES")
+            .ok()
+            .and_then(|s| s.trim().parse::<u64>().ok()),
+        host_budget_tightest_cgroup("memory.high"),
+        host_budget_tightest_cgroup("memory.max"),
+        host_budget_cgroup_v1(),
+        host_budget_darwin_physical(),
+    );
+    (join.bytes(), join.label())
+}
+
+#[derive(Clone)]
+pub enum HostBudgetCgroupV1 {
+    Limited(u64),
+    Unlimited,
+    Unparseable(String),
+}
+
+pub fn host_budget_tightest_cgroup_under(
+    self_cg: &str,
+    root: &std::path::Path,
+    limit_file: &str,
+) -> Option<(String, u64)> {
+    let rel = self_cg
+        .lines()
+        .find_map(|l| l.strip_prefix("0::"))
+        .map(|p| p.trim().trim_start_matches('/').to_string())?;
+    let mut dir = root.join(&rel);
+    let mut best: Option<(u64, std::path::PathBuf)> = None;
+    loop {
+        if let Ok(s) = std::fs::read_to_string(dir.join(limit_file)) {
+            let s = s.trim();
+            if s != "max" {
+                if let Ok(v) = s.parse::<u64>() {
+                    let take = best.as_ref().map(|(cur, _)| v < *cur).unwrap_or(true);
+                    if take {
+                        best = Some((v, dir.clone()));
+                    }
+                }
+            }
+        }
+        if dir == root || !dir.pop() {
+            break;
+        }
+    }
+    best.map(|(v, d)| (d.display().to_string(), v))
+}
+
+pub fn host_budget_tightest_cgroup(limit_file: &str) -> Option<(String, u64)> {
+    let self_cg = std::fs::read_to_string("/proc/self/cgroup").ok()?;
+    host_budget_tightest_cgroup_under(&self_cg, std::path::Path::new("/sys/fs/cgroup"), limit_file)
+}
+
+pub fn host_budget_cgroup_v1_unlimited_bytes(page_size: u64) -> u64 {
+    (i64::MAX as u64 / page_size) * page_size
+}
+
+pub fn host_budget_cgroup_v1() -> Option<(String, HostBudgetCgroupV1)> {
+    let self_cg = std::fs::read_to_string("/proc/self/cgroup").ok()?;
+    let mountinfo = std::fs::read_to_string("/proc/self/mountinfo").ok()?;
+    let page_size = unsafe { libc::sysconf(libc::_SC_PAGESIZE) };
+    if page_size <= 0 {
+        return Some((
+            "/proc/self/mountinfo".to_string(),
+            HostBudgetCgroupV1::Unparseable("sysconf(_SC_PAGESIZE) unreadable".to_string()),
+        ));
+    }
+    host_budget_cgroup_v1_under(
+        std::path::Path::new("/"),
+        &self_cg,
+        &mountinfo,
+        page_size as u64,
+    )
+}
+
+pub fn host_budget_cgroup_v1_under(
+    fs_root: &std::path::Path,
+    self_cg: &str,
+    mountinfo: &str,
+    page_size: u64,
+) -> Option<(String, HostBudgetCgroupV1)> {
+    let dir = host_budget_cgroup_v1_memory_dir(self_cg, mountinfo)?;
+    let dir_path = std::path::Path::new(&dir);
+    let joined = fs_root.join(dir_path.strip_prefix("/").unwrap_or(dir_path));
+    let value = match std::fs::read_to_string(joined.join("memory.stat")) {
+        Ok(stat) => host_budget_cgroup_v1_from_stat(&stat, page_size),
+        Err(e) => HostBudgetCgroupV1::Unparseable(format!("memory.stat: {}", e)),
+    };
+    Some((joined.display().to_string(), value))
+}
+
+pub fn host_budget_cgroup_v1_memory_dir(self_cg: &str, mountinfo: &str) -> Option<String> {
+    let (mount_root, mount_point) = mountinfo.lines().find_map(|line| {
+        let fields: Vec<&str> = line.split(' ').collect();
+        let dash = fields.iter().position(|f| *f == "-")?;
+        let fstype = fields.get(dash + 1)?;
+        let super_opts = fields.get(dash + 3)?;
+        if *fstype == "cgroup" && super_opts.split(',').any(|o| o == "memory") {
+            Some((fields.get(3)?.to_string(), fields.get(4)?.to_string()))
+        } else {
+            None
+        }
+    })?;
+    let path = self_cg.lines().find_map(|l| {
+        let mut parts = l.splitn(3, ':');
+        let (_id, controllers, path) = (parts.next()?, parts.next()?, parts.next()?);
+        controllers
+            .split(',')
+            .any(|c| c == "memory")
+            .then(|| path.trim().to_string())
+    })?;
+    let rel = if mount_root == "/" {
+        path.as_str()
+    } else {
+        let rest = path.strip_prefix(mount_root.as_str())?;
+        if !(rest.is_empty() || rest.starts_with('/')) {
+            return None;
+        }
+        rest
+    };
+    Some(
+        std::path::Path::new(&mount_point)
+            .join(rel.trim_start_matches('/'))
+            .display()
+            .to_string(),
+    )
+}
+
+pub fn host_budget_cgroup_v1_from_stat(memory_stat: &str, page_size: u64) -> HostBudgetCgroupV1 {
+    let hits: std::vec::Vec<&str> = memory_stat
+        .lines()
+        .filter_map(|l| l.trim().strip_prefix("hierarchical_memory_limit "))
+        .collect();
+    let [body] = hits.as_slice() else {
+        return HostBudgetCgroupV1::Unparseable(memory_stat.to_string());
+    };
+    let unlimited = host_budget_cgroup_v1_unlimited_bytes(page_size);
+    match body.trim().parse::<i128>() {
+        Ok(n) if n < 0 => HostBudgetCgroupV1::Unparseable(body.to_string()),
+        Ok(n) if n >= unlimited as i128 => HostBudgetCgroupV1::Unlimited,
+        Ok(n) => HostBudgetCgroupV1::Limited(n as u64),
+        Err(_) => HostBudgetCgroupV1::Unparseable(body.to_string()),
+    }
+}
+
+/// Darwin `hw.memsize` via `sysctlbyname`. Authority: `extdeps.darwin.sysctl` `HwMemsize`.
+pub fn host_budget_darwin_physical() -> Option<u64> {
+    #[cfg(target_os = "macos")]
+    {
+        let name = std::ffi::CStr::from_bytes_with_nul(b"hw.memsize\0").ok()?;
+        let mut value: u64 = 0;
+        let mut len: libc::size_t = std::mem::size_of::<u64>() as libc::size_t;
+        let rc = unsafe {
+            libc::sysctlbyname(
+                name.as_ptr(),
+                (&mut value as *mut u64).cast::<libc::c_void>(),
+                &mut len,
+                std::ptr::null_mut(),
+                0,
+            )
+        };
+        if rc == 0 && value > 0 {
+            Some(value)
+        } else {
+            None
+        }
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        None
+    }
+}
diff --git a/src/v1/stage0/src/v1_std_core.rs b/src/v1/stage0/src/v1_std_core.rs
index cabb658e176..6373b9b0b0c 100644
--- a/src/v1/stage0/src/v1_std_core.rs
+++ b/src/v1/stage0/src/v1_std_core.rs
@@ -837,6 +837,11 @@ pub enum CompilerDiagnostic {
         identities: Rc<Vec<String>>,
         span: Rc<SourceSpan>,
     },
+    NativeEffectRealizationRefused {
+        entry: String,
+        refusals: Rc<Vec<String>>,
+        span: Rc<SourceSpan>,
+    },
     EffectSummaryIncompleteAtFunctionValue {
         caller: String,
         span: Rc<SourceSpan>,
@@ -1078,6 +1083,7 @@ pub fn diagnostic_to_span(d: Rc<CompilerDiagnostic>) -> Rc<SourceSpan> {
         CompilerDiagnostic::EffectfulSelfRecursionUnrealized { span: s, .. } => s.clone(),
         CompilerDiagnostic::ModuleFilenameCollision { span: s, .. } => s.clone(),
         CompilerDiagnostic::EmittedSymbolCollision { span: s, .. } => s.clone(),
+        CompilerDiagnostic::NativeEffectRealizationRefused { span: s, .. } => s.clone(),
         CompilerDiagnostic::EffectSummaryIncompleteAtFunctionValue { span: s, .. } => s.clone(),
         CompilerDiagnostic::EffectSummaryIncompleteAtLocalBinding { span: s, .. } => s.clone(),
         CompilerDiagnostic::CallArgumentNameUnknown { span: s, .. } => s.clone(),
@@ -1160,6 +1166,7 @@ pub fn diagnostic_to_message(d: Rc<CompilerDiagnostic>) -> String {
     CompilerDiagnostic::EffectfulSelfRecursionUnrealized { name: n, .. } => v1_rt::concat(v1_rt::concat("effectful declaration '".to_string(), n.clone()), "' calls itself outside tail position: the Rust realization lowers tail calls to a loop, but non-tail async recursion has no realization. Put the recursive call in tail position or move it into a pure helper.".to_string()),
     CompilerDiagnostic::ModuleFilenameCollision { filename: f, modules: ms, .. } => v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("module filename collision: ".to_string(), ((ms.clone().len() as i64)).to_string()), " modules render one emitted file name '".to_string()), f.clone()), "': ".to_string()), ms.clone().join(&", ".to_string())), " — module_to_filename maps '.' to '_', so these names are indistinguishable at the emitted path; rename one module segment".to_string()),
     CompilerDiagnostic::EmittedSymbolCollision { symbol: s, identities: ids, .. } => v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("emitted symbol collision: ".to_string(), ((ids.clone().len() as i64)).to_string()), " authored identities render one emitted symbol '".to_string()), s.clone()), "': ".to_string()), ids.clone().join(&", ".to_string())), " — two authored identities one emitted scope cannot hold apart (an undotted service with a type's name, a type spelled with `__`, dotted services differing only in first-letter case or in a segment's leading or trailing `_`); rename one".to_string()),
+    CompilerDiagnostic::NativeEffectRealizationRefused { entry: e, refusals: rs, .. } => v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("native effect realization refused for entry '".to_string(), e.clone()), "': ".to_string()), rs.clone().join(&"; ".to_string())), " (v1.compiler.emit NativeEffectRealizationAdmission: the rendered main binds only admitted handlers, so an unadmitted effect refuses here rather than failing to build or link)".to_string()),
     CompilerDiagnostic::EffectSummaryIncompleteAtFunctionValue { caller: c, .. } => v1_rt::concat(v1_rt::concat("effect summary incomplete: ".to_string(), c.clone()), " calls through a function value, whose callee is chosen at runtime, so its effects are unknown rather than empty — the caller's summary is a lower bound, not the answer".to_string()),
     CompilerDiagnostic::EffectSummaryIncompleteAtLocalBinding { caller: c, name: n, .. } => v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("effect summary incomplete: ".to_string(), c.clone()), " calls the local binding '".to_string()), n.clone()), "', whose effects this pass cannot join through the registry, so the caller's summary is a lower bound rather than the answer".to_string()),
     CompilerDiagnostic::CallArgumentNameUnknown { callee: c, argument: a, declared: ds, .. } => v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat(v1_rt::concat("call shape mismatch calling '".to_string(), c.clone()), "': no parameter named '".to_string()), a.clone()), "' (declared: [".to_string()), ds.clone().join(&", ".to_string())), "])".to_string()),
@@ -1447,6 +1454,10 @@ pub fn diagnostic_disposition(d: Rc<CompilerDiagnostic>) -> Rc<DiagnosticDisposi
     CompilerDiagnostic::EmittedSymbolCollision { .. } => Rc::new(DiagnosticDisposition {
     severity: DiagnosticSeverity::SeverityError,
     gate: Rc::new(DiagnosticGateDisposition::GateBlocking),
+}),
+    CompilerDiagnostic::NativeEffectRealizationRefused { .. } => Rc::new(DiagnosticDisposition {
+    severity: DiagnosticSeverity::SeverityError,
+    gate: Rc::new(DiagnosticGateDisposition::GateBlocking),
 }),
     CompilerDiagnostic::EffectSummaryIncompleteAtFunctionValue { .. } => Rc::new(DiagnosticDisposition {
     severity: DiagnosticSeverity::SeverityNonError,
@@ -2221,7 +2232,7 @@ pub fn param_node_type_expr(n: Rc<Node>) -> Rc<Node> {
 
 pub fn param_node_default_value(n: Rc<Node>) -> Option<Rc<Node>> {
     if ((n.children.clone().len() as i64) > 1) {
-        n.children.clone().iter().cloned().skip(1 as usize).next()
+        n.children.clone().get((1) as usize).cloned()
     } else {
         std::option::Option::None
     }
@@ -2298,7 +2309,7 @@ pub fn field_node_cardinality(n: Rc<Node>) -> Cardinality {
 
 pub fn field_node_default_value(n: Rc<Node>) -> Option<Rc<Node>> {
     if ((n.children.clone().len() as i64) > 1) {
-        n.children.clone().iter().cloned().skip(1 as usize).next()
+        n.children.clone().get((1) as usize).cloned()
     } else {
         std::option::Option::None
     }
@@ -2570,10 +2581,8 @@ pub fn expr_child_at(texpr: Rc<Node>, index: i64, role: String) -> Rc<Node> {
     match texpr
         .children
         .clone()
-        .iter()
+        .get((index.clone()) as usize)
         .cloned()
-        .skip(index.clone() as usize)
-        .next()
     {
         Some(v) => v.clone(),
         std::option::Option::None => make_expr_error_node(
@@ -2831,13 +2840,7 @@ pub fn if_then_branch(texpr: Rc<Node>) -> Rc<Node> {
 }
 
 pub fn if_else_branch(texpr: Rc<Node>) -> Option<Rc<Node>> {
-    texpr
-        .children
-        .clone()
-        .iter()
-        .cloned()
-        .skip(2 as usize)
-        .next()
+    texpr.children.clone().get((2) as usize).cloned()
 }
 
 pub fn match_scrutinee(texpr: Rc<Node>) -> Rc<Node> {
@@ -2845,15 +2848,7 @@ pub fn match_scrutinee(texpr: Rc<Node>) -> Rc<Node> {
 }
 
 pub fn match_arm_nodes(texpr: Rc<Node>) -> Rc<Vec<Rc<Node>>> {
-    Rc::new(
-        texpr
-            .children
-            .clone()
-            .iter()
-            .cloned()
-            .skip(1 as usize)
-            .collect::<Vec<_>>(),
-    )
+    Rc::new(v1_rt::list_skip(&texpr.children.clone(), 1))
 }
 
 pub fn binop_left(texpr: Rc<Node>) -> Rc<Node> {
@@ -2953,15 +2948,7 @@ pub fn method_receiver(texpr: Rc<Node>) -> Rc<Node> {
 }
 
 pub fn method_arg_nodes(texpr: Rc<Node>) -> Rc<Vec<Rc<Node>>> {
-    Rc::new(
-        texpr
-            .children
-            .clone()
-            .iter()
-            .cloned()
-            .skip(1 as usize)
-            .collect::<Vec<_>>(),
-    )
+    Rc::new(v1_rt::list_skip(&texpr.children.clone(), 1))
 }
 
 pub fn expr_method_name_at(
@@ -2991,17 +2978,9 @@ pub fn lambda_param_names_at(
 ) -> Rc<Vec<String>> {
     Rc::new({
         let mut __result = Vec::new();
-        for n in Rc::new(
-            texpr
-                .children
-                .clone()
-                .iter()
-                .cloned()
-                .skip(1 as usize)
-                .collect::<Vec<_>>(),
-        )
-        .iter()
-        .cloned()
+        for n in Rc::new(v1_rt::list_skip(&texpr.children.clone(), 1))
+            .iter()
+            .cloned()
         {
             __result.push(authored_name_at(source_indices.clone(), n.clone()));
         }
@@ -3014,13 +2993,7 @@ pub fn let_value(texpr: Rc<Node>) -> Rc<Node> {
 }
 
 pub fn let_body(texpr: Rc<Node>) -> Option<Rc<Node>> {
-    texpr
-        .children
-        .clone()
-        .iter()
-        .cloned()
-        .skip(1 as usize)
-        .next()
+    texpr.children.clone().get((1) as usize).cloned()
 }
 
 pub fn let_binding_name_at(
@@ -5107,10 +5080,8 @@ pub fn byte_to_line_col(index: Rc<NewlineIndex>, offset: i64) -> LineCol {
             match index
                 .offsets
                 .clone()
-                .iter()
+                .get((v1_rt::int_sub(line.clone(), 2)) as usize)
                 .cloned()
-                .skip(v1_rt::int_sub(line.clone(), 2) as usize)
-                .next()
             {
                 Some(o) => v1_rt::int_add(o.clone(), 1),
                 std::option::Option::None => 0,
@@ -5133,10 +5104,8 @@ pub fn source_line_at(index: Rc<NewlineIndex>, line: i64) -> String {
             match index
                 .offsets
                 .clone()
-                .iter()
+                .get((v1_rt::int_sub(line.clone(), 2)) as usize)
                 .cloned()
-                .skip(v1_rt::int_sub(line.clone(), 2) as usize)
-                .next()
             {
                 Some(o) => v1_rt::int_add(o.clone(), 1),
                 std::option::Option::None => src_len.clone(),
@@ -5145,10 +5114,8 @@ pub fn source_line_at(index: Rc<NewlineIndex>, line: i64) -> String {
         let line_end = match index
             .offsets
             .clone()
-            .iter()
+            .get((v1_rt::int_sub(line.clone(), 1)) as usize)
             .cloned()
-            .skip(v1_rt::int_sub(line.clone(), 1) as usize)
-            .next()
         {
             Some(o) => o.clone(),
             std::option::Option::None => src_len.clone(),
diff --git a/src/v1/stage0/src/v1_tests_claim_generic_identity_census.rs b/src/v1/stage0/src/v1_tests_claim_generic_identity_census.rs
index 5ad0c3b241f..bc8bf680a15 100644
--- a/src/v1/stage0/src/v1_tests_claim_generic_identity_census.rs
+++ b/src/v1/stage0/src/v1_tests_claim_generic_identity_census.rs
@@ -1576,15 +1576,7 @@ pub fn gi_owner_argument_arms_discriminate(
                                 xs_param.clone(),
                                 v1_rt::concat(
                                     Rc::new(vec![minted.clone()]),
-                                    Rc::new(
-                                        xs_param
-                                            .children
-                                            .clone()
-                                            .iter()
-                                            .cloned()
-                                            .skip(1 as usize)
-                                            .collect::<Vec<_>>(),
-                                    ),
+                                    Rc::new(v1_rt::list_skip(&xs_param.children.clone(), 1)),
                                 ),
                             );
                             (((gi_foreign_label_under_owner(
diff --git a/src/v1/stage0/src/v1_tests_claim_interpolation_hole_census.rs b/src/v1/stage0/src/v1_tests_claim_interpolation_hole_census.rs
index 642898b05bf..9de31d86589 100644
--- a/src/v1/stage0/src/v1_tests_claim_interpolation_hole_census.rs
+++ b/src/v1/stage0/src/v1_tests_claim_interpolation_hole_census.rs
@@ -418,16 +418,9 @@ pub fn ihc_template_holes(ctx: Rc<HoleWalkContext>, template: Rc<Node>) -> Rc<Ve
             .cloned()
             {
                 __result.extend(
-                    (*Rc::new(
-                        p.children
-                            .clone()
-                            .iter()
-                            .cloned()
-                            .take(1 as usize)
-                            .collect::<Vec<_>>(),
-                    ))
-                    .iter()
-                    .cloned(),
+                    (*Rc::new(v1_rt::list_take(&p.children.clone(), 1)))
+                        .iter()
+                        .cloned(),
                 );
             }
             __result
diff --git a/src/v1/stage0/src/v1_tests_claim_reference_derived_disposition_census_witness_test.rs b/src/v1/stage0/src/v1_tests_claim_reference_derived_disposition_census_witness_test.rs
index 892eefcb3fe..ed8fa600c3e 100644
--- a/src/v1/stage0/src/v1_tests_claim_reference_derived_disposition_census_witness_test.rs
+++ b/src/v1/stage0/src/v1_tests_claim_reference_derived_disposition_census_witness_test.rs
@@ -17,9 +17,11 @@ pub use crate::v1_compiler_emit_rust::{
     reference_derived_candidate_disposition, reference_derived_census,
     reference_derived_disposition_name, reference_derived_row_diagnostics,
 };
-pub use crate::v1_compiler_infer_emit_info::empty_emit_graph_info;
 use crate::v1_compiler_infer_emit_info::TypeRepr::EnumRepr;
-pub use crate::v1_compiler_infer_emit_info::{TypeRepr, TypeSummary};
+pub use crate::v1_compiler_infer_emit_info::{
+    empty_emit_graph_info, empty_type_summary_index, type_summary_index_insert,
+};
+pub use crate::v1_compiler_infer_emit_info::{TypeRepr, TypeSummary, TypeSummaryIndex};
 use crate::v1_compiler_infer_items::ItemKind::FnItem;
 pub use crate::v1_compiler_infer_items::{ItemInfo, ItemKind};
 use crate::v1_rt;
@@ -91,7 +93,7 @@ pub fn fixture_disposition(
                 Rc::new(vec![]),
                 v1_rt::rc_empty_map::<String, Rc<LeafOwner>>(),
             ),
-            v1_rt::rc_empty_map::<String, Rc<TypeSummary>>(),
+            crate::v1_compiler_infer_emit_info::empty_type_summary_index(),
             v1_rt::rc_empty_map::<String, String>(),
             false,
         ),
@@ -132,7 +134,7 @@ pub fn cross_module_candidate_with_export_proof_survives() -> bool {
             Rc::new(vec![]),
             v1_rt::rc_empty_map::<String, Rc<LeafOwner>>(),
         ),
-        v1_rt::rc_empty_map::<String, Rc<TypeSummary>>(),
+        crate::v1_compiler_infer_emit_info::empty_type_summary_index(),
         v1_rt::rc_empty_map::<String, String>(),
         false,
     ) == Rc::new(ReferenceDerivedCandidateDisposition::CandidateSurvived {
@@ -219,12 +221,14 @@ pub fn variant_arm_red_note() -> String {
     CACHED.with(|c: &String| c.clone())
 }
 
-pub fn fixture_variant_type_summaries() -> Rc<HashMap<String, Rc<TypeSummary>>> {
-    v1_rt::rc_map_insert(
-        v1_rt::rc_empty_map::<String, Rc<TypeSummary>>(),
+pub fn fixture_variant_type_summaries() -> Rc<TypeSummaryIndex> {
+    crate::v1_compiler_infer_emit_info::type_summary_index_insert(
+        crate::v1_compiler_infer_emit_info::empty_type_summary_index(),
+        "fixture.E".to_string(),
         "E".to_string(),
         Rc::new(TypeSummary {
             name: "E".to_string(),
+            key: "fixture.E".to_string(),
             repr: Rc::new(TypeRepr::EnumRepr { unit_only: true }),
             field_summaries: v1_rt::rc_empty_map::<String, Rc<FieldSummary>>(),
             field_type_map: v1_rt::rc_empty_map::<String, String>(),
@@ -257,7 +261,7 @@ pub fn known_variant_is_delegated_to_its_parent_not_registry_absent() -> bool {
         v1_rt::rc_map_insert(
             v1_rt::rc_empty_map::<String, String>(),
             "V".to_string(),
-            "E".to_string(),
+            "fixture.E".to_string(),
         ),
         false,
     ) == Rc::new(
@@ -276,12 +280,14 @@ pub fn ambiguous_parent_red_note() -> String {
     CACHED.with(|c: &String| c.clone())
 }
 
-pub fn fixture_colliding_variant_type_summaries() -> Rc<HashMap<String, Rc<TypeSummary>>> {
-    v1_rt::rc_map_insert(
+pub fn fixture_colliding_variant_type_summaries() -> Rc<TypeSummaryIndex> {
+    crate::v1_compiler_infer_emit_info::type_summary_index_insert(
         fixture_variant_type_summaries(),
+        "fixture.F".to_string(),
         "F".to_string(),
         Rc::new(TypeSummary {
             name: "F".to_string(),
+            key: "fixture.F".to_string(),
             repr: Rc::new(TypeRepr::EnumRepr { unit_only: true }),
             field_summaries: v1_rt::rc_empty_map::<String, Rc<FieldSummary>>(),
             field_type_map: v1_rt::rc_empty_map::<String, String>(),
@@ -338,7 +344,7 @@ pub fn a_known_variant_spelling_in_a_type_position_takes_the_registry_arm() -> b
             v1_rt::rc_map_insert(
                 v1_rt::rc_empty_map::<String, String>(),
                 "V".to_string(),
-                "E".to_string(),
+                "fixture.E".to_string(),
             ),
             true,
         ),
@@ -369,7 +375,7 @@ pub fn non_variant_name_still_answers_registry_absent() -> bool {
             v1_rt::rc_map_insert(
                 v1_rt::rc_empty_map::<String, String>(),
                 "V".to_string(),
-                "E".to_string(),
+                "fixture.E".to_string(),
             ),
             false,
         ),
diff --git a/src/v1/stage0/tests/interpreter_dispatch_authority.rs b/src/v1/stage0/tests/interpreter_dispatch_authority.rs
index 7018f061943..0981a7dc537 100644
--- a/src/v1/stage0/tests/interpreter_dispatch_authority.rs
+++ b/src/v1/stage0/tests/interpreter_dispatch_authority.rs
@@ -7,9 +7,8 @@
 
 use v1_compiler::v1_interpreter_dispatch_generated::{
     lookup_eval_algebra_method_inner, lookup_eval_builtin_inner, lookup_eval_call_bridge_std_node,
-    lookup_eval_call_native_intercept, lookup_try_parse_table_memo_dispatch,
-    lookup_try_v2_std_collection_map_primitive_grounding, EvalAlgebraMethodArm, EvalBuiltinArm,
-    EvalCallBridgeStdNodeArm, EvalCallNativeInterceptArm, TryParseTableMemoDispatchArm,
+    lookup_eval_call_native_intercept, lookup_try_v2_std_collection_map_primitive_grounding,
+    EvalAlgebraMethodArm, EvalBuiltinArm, EvalCallBridgeStdNodeArm, EvalCallNativeInterceptArm,
     TryV2StdCollectionMapPrimitiveGroundingArm,
 };
 
@@ -56,7 +55,6 @@ fn generated_lookup_covers_representative_spellings_per_site() {
             .is_some()
     );
     assert!(lookup_eval_call_native_intercept("fold_list").is_some());
-    assert!(lookup_try_parse_table_memo_dispatch("parse_table_lookup").is_some());
 }
 
 #[test]
@@ -81,8 +79,4 @@ fn generated_enums_are_copy_and_distinct() {
         EvalCallNativeInterceptArm::NativeInterceptFoldList,
         EvalCallNativeInterceptArm::NativeInterceptFoldListRight
     );
-    assert_ne!(
-        TryParseTableMemoDispatchArm::ParseTableMemoParseTableInsert,
-        TryParseTableMemoDispatchArm::ParseTableMemoParseTableLookup
-    );
 }
diff --git a/src/v1/stage0_crates.dag b/src/v1/stage0_crates.dag
index ff8ef4109be..8b97ececbf3 100644
--- a/src/v1/stage0_crates.dag
+++ b/src/v1/stage0_crates.dag
@@ -3,9 +3,10 @@ module v1.compiler.stage0_crates
 import std.dissolution { DissolutionCondition, unbound_dissolution }
 
 import v1.std.core { TextFile }
-import v1.compiler.emit_rust { emit_non_empty_wrappers, emit_cargo_dep, emit_cargo_features_section, generated_rust_lint_relaxations }
+import v1.compiler.emit_rust { emit_non_empty_wrappers, emit_cargo_dep, emit_cargo_dep_no_default_features, emit_cargo_features_section, generated_rust_lint_relaxations }
 import v1.compiler.runtime_rust { rust_runtime_cargo_features }
 import extdeps.cargo { CargoDependency, CargoFeature, RegistryDep, LocalPathDep }
+import gunbc.rust_emitted_crate { EmittedCrateDependencyDemand }
 import extdeps.cargo_version { render_cargo_package_header_prefix }
 import gunbc.rust_crate_package_ident {
   PackageIdentBinding,
@@ -22,6 +23,7 @@ import gunbc.stage0_partition_package_graph {
 import gunbc.stage0_emitted_edge_admission { partition_module_owner_packages_over }
 import gunbc.stage0_crate_partition_generated {
   GeneratedEmitCoreCrate,
+  GeneratedFacadeCrate,
   GeneratedFoundationCrate,
   GeneratedLayeredCoreCrate,
   GeneratedPartitionCrateKind,
@@ -33,6 +35,7 @@ type Stage0CrateKind
   = FoundationCrate
   | LayeredCoreCrate
   | EmitCoreCrate
+  | FacadeCrate
 
 type Stage0CrateSpec {
   package_name: String
@@ -126,10 +129,17 @@ fn stage0_emit_core_header_doc() -> String {
   ] |> join(separator: "\n")
 }
 
+// A path dependency is written relative to the DEPENDENT crate's directory. Partition crates sit
+// side by side under src/v1/, so one reaches another as a sibling; a package at the workspace root
+// (crate_dir ".", the top package of an emitted workspace) reaches each by its own crate_dir.
 fn stage0_crate_dir_to_sibling_dep_path(crate_dir: String) -> String {
   replace(crate_dir, "src/v1/", "../")
 }
 
+fn partition_crate_dep_path(from_crate_dir: String, to_crate_dir: String) -> String {
+  if from_crate_dir == "." { to_crate_dir } else { stage0_crate_dir_to_sibling_dep_path(crate_dir: to_crate_dir) }
+}
+
 type Stage0ModuleOwnerRefusalCause
   = Stage0ModuleOwnerMissing { module_basename: String }
 
@@ -253,19 +263,56 @@ fn stage0_crate_boundary_emit_refusal_message(
   }
 }
 
+// THE REGISTRY DEPENDENCIES AN EMITTED CLOSURE DEMANDS (gunbc.rust_emitted_crate
+// EmittedCrateDependencyDemand), as the rows every crate of its workspace lists. Moved here with the
+// single-package manifest's deletion: the demand is the emission's fact, and turning it into Cargo
+// dependency rows is this renderer's.
+fn emitted_crate_registry_dep(name: String, version: String, features: List<String>) -> CargoDependency {
+  CargoDependency { name: name, source: RegistryDep { version: version, default_features: true, features: features } }
+}
+
+fn emitted_crate_dependencies(demand: EmittedCrateDependencyDemand) -> List<CargoDependency> {
+  let base_deps = [
+    emitted_crate_registry_dep(name: "im", version: "15.1", features: ["serde"]),
+    emitted_crate_registry_dep(name: "unicode-ident", version: "1", features: []),
+    emitted_crate_registry_dep(name: "unicode-properties", version: "0.1", features: ["emoji"]),
+    emitted_crate_registry_dep(name: "serde", version: "1", features: ["derive", "rc"]),
+    emitted_crate_registry_dep(name: "serde_json", version: "1", features: []),
+    emitted_crate_registry_dep(name: "libc", version: "0.2", features: []),
+    emitted_crate_registry_dep(name: "stacker", version: "0.1", features: []),
+    emitted_crate_registry_dep(name: "lazy_static", version: "1", features: []),
+    emitted_crate_registry_dep(name: "ureq", version: "2", features: ["json"])
+  ]
+  let cli_deps = if demand.renders_clap_cli {
+    [emitted_crate_registry_dep(name: "clap", version: "4", features: ["derive"])]
+  } else { [] }
+  let async_deps = if demand.renders_async_services {
+    [
+      emitted_crate_registry_dep(name: "tokio", version: "1", features: ["full"]),
+      CargoDependency {
+        name: "reqwest",
+        source: RegistryDep { version: "0.12", default_features: false, features: ["json", "rustls-tls", "http2", "charset"] }
+      },
+      emitted_crate_registry_dep(name: "async-trait", version: "0.1", features: [])
+    ]
+  } else { [] }
+  concat(base_deps, concat(cli_deps, async_deps))
+}
+
 fn stage0_foundation_runtime_dependencies() -> List<CargoDependency> {
   [
-    CargoDependency { name: "stacker", source: RegistryDep { version: "0.1", features: [] } },
-    CargoDependency { name: "im", source: RegistryDep { version: "15.1", features: ["serde"] } },
-    CargoDependency { name: "libc", source: RegistryDep { version: "0.2", features: [] } },
-    CargoDependency { name: "serde", source: RegistryDep { version: "1", features: ["derive", "rc"] } },
-    CargoDependency { name: "serde_json", source: RegistryDep { version: "1", features: [] } },
-    CargoDependency { name: "unicode-ident", source: RegistryDep { version: "1", features: [] } },
-    CargoDependency { name: "unicode-properties", source: RegistryDep { version: "0.1", features: ["emoji"] } }
+    CargoDependency { name: "stacker", source: RegistryDep { version: "0.1", default_features: true, features: [] } },
+    CargoDependency { name: "im", source: RegistryDep { version: "15.1", default_features: true, features: ["serde"] } },
+    CargoDependency { name: "libc", source: RegistryDep { version: "0.2", default_features: true, features: [] } },
+    CargoDependency { name: "serde", source: RegistryDep { version: "1", default_features: true, features: ["derive", "rc"] } },
+    CargoDependency { name: "serde_json", source: RegistryDep { version: "1", default_features: true, features: [] } },
+    CargoDependency { name: "unicode-ident", source: RegistryDep { version: "1", default_features: true, features: [] } },
+    CargoDependency { name: "unicode-properties", source: RegistryDep { version: "0.1", default_features: true, features: ["emoji"] } }
   ]
 }
 
 fn stage0_reexport_path_dependencies_outcome(
+  from_crate_dir: String,
   reexport_packages: List<String>,
   rows: List<GeneratedPartitionCrateRow>
 ) -> Stage0ReexportPathDepsOutcome {
@@ -282,7 +329,7 @@ fn stage0_reexport_path_dependencies_outcome(
                   CargoDependency {
                     name: pkg,
                     source: LocalPathDep {
-                      path: stage0_crate_dir_to_sibling_dep_path(crate_dir: crate_dir)
+                      path: partition_crate_dep_path(from_crate_dir: from_crate_dir, to_crate_dir: crate_dir)
                     }
                   }
                 ])
@@ -299,6 +346,7 @@ fn stage0_partition_row_kind(row: GeneratedPartitionCrateRow) -> Stage0CrateKind
     GeneratedFoundationCrate => FoundationCrate
     GeneratedLayeredCoreCrate => LayeredCoreCrate
     GeneratedEmitCoreCrate => EmitCoreCrate
+    GeneratedFacadeCrate => FacadeCrate
   }
 }
 
@@ -307,6 +355,7 @@ fn stage0_partition_row_header_doc(row: GeneratedPartitionCrateRow) -> String {
     GeneratedFoundationCrate => stage0_foundation_header_doc()
     GeneratedLayeredCoreCrate => stage0_layered_core_header_doc()
     GeneratedEmitCoreCrate => stage0_emit_core_header_doc()
+    GeneratedFacadeCrate => partition_facade_header_doc()
   }
 }
 
@@ -318,15 +367,17 @@ fn stage0_partition_row_header_doc(row: GeneratedPartitionCrateRow) -> String {
 // is what having one graph means.
 fn stage0_partition_row_dependencies_outcome(
   row: GeneratedPartitionCrateRow,
-  rows: List<GeneratedPartitionCrateRow>
+  rows: List<GeneratedPartitionCrateRow>,
+  registry_dependencies: List<CargoDependency>
 ) -> Stage0PartitionRowDepsOutcome {
   match stage0_reexport_path_dependencies_outcome(
+    from_crate_dir: row.crate_dir,
     reexport_packages: partition_package_dependency_names_over(row: row, rows: rows),
     rows: rows
   ) {
     Stage0ReexportPathDepsOk { deps: path_deps } =>
       Stage0PartitionRowDepsOk {
-        deps: stage0_foundation_runtime_dependencies() |> concat(path_deps)
+        deps: registry_dependencies |> concat(path_deps)
       }
     Stage0ReexportPathDepsRefused { cause: cause } =>
       Stage0PartitionRowDepsRefused { cause: cause }
@@ -345,6 +396,7 @@ fn stage0_features_for_crate_kind(kind: GeneratedPartitionCrateKind) -> List<Car
     GeneratedFoundationCrate => rust_runtime_cargo_features()
     GeneratedLayeredCoreCrate => []
     GeneratedEmitCoreCrate => []
+    GeneratedFacadeCrate => []
   }
 }
 
@@ -355,9 +407,10 @@ fn stage0_partition_row_features(row: GeneratedPartitionCrateRow) -> List<CargoF
 fn stage0_partition_row_to_spec_outcome(
   row: GeneratedPartitionCrateRow,
   package_idents: List<PackageIdentBinding>,
-  rows: List<GeneratedPartitionCrateRow>
+  rows: List<GeneratedPartitionCrateRow>,
+  registry_dependencies: List<CargoDependency>
 ) -> Stage0PartitionRowSpecOutcome {
-  match stage0_partition_row_dependencies_outcome(row: row, rows: rows) {
+  match stage0_partition_row_dependencies_outcome(row: row, rows: rows, registry_dependencies: registry_dependencies) {
     Stage0PartitionRowDepsRefused { cause: cause } =>
       Stage0PartitionRowSpecRefused { cause: cause }
     Stage0PartitionRowDepsOk { deps: deps } =>
@@ -381,8 +434,12 @@ fn stage0_partition_row_to_spec_outcome(
 
 fn render_stage0_crate_dep(dep: CargoDependency) -> String {
   match dep.source {
-    RegistryDep { version: version, features: features } =>
-      emit_cargo_dep(name: dep.name, version: version, features: features)
+    RegistryDep { version: version, default_features: default_features, features: features } =>
+      if default_features {
+        emit_cargo_dep(name: dep.name, version: version, features: features)
+      } else {
+        emit_cargo_dep_no_default_features(name: dep.name, version: version, features: features)
+      }
     LocalPathDep { path: path } =>
       concat(dep.name, " = { path = \"", path, "\" }\n")
   }
@@ -528,6 +585,65 @@ fn render_stage0_emit_core_lib_outcome(spec: Stage0CrateSpec) -> Stage0CrateLibE
   }
 }
 
+// THE FACADE OF A PARTITION: one `pub mod m { pub use <owner>::m::*; }` per module it names, so a
+// reader that paths through the package by module -- an emitted main's `<crate_name>::m::` --
+// reaches each module where its owning crate put it. It hosts no module and copies no semantics;
+// unlike the stage0 emit shell it names no stage0 package and includes no seed file, so any
+// partition's row set can carry one (gunbc.emitted_crate_workspace emitted_workspace_top_row).
+fn partition_facade_header_doc() -> String {
+  [
+    "//! Generated by the emitted crate workspace (gunbc.emitted_crate_workspace) -- do not edit.",
+    "//!",
+    "//! Facade crate: re-exports every module of the partition from the crate that owns it."
+  ] |> join(separator: "\n")
+}
+
+fn render_partition_facade_lib_outcome(spec: Stage0CrateSpec) -> Stage0CrateLibEmitOutcome {
+  match stage0_emit_shell_module_reexports_outcome(modules: spec.modules, package_idents: spec.package_idents, rows: spec.partition_rows) {
+    Stage0EmitShellReexportsRefused { cause: cause } =>
+      Stage0CrateLibEmitRefused { cause: cause }
+    Stage0EmitShellReexportsIdentUnbound { package_name: package_name } =>
+      Stage0CrateLibEmitIdentUnbound { package_name: package_name }
+    Stage0EmitShellReexportsOk { lines: lines } =>
+      match partition_facade_wrapper_reexports_outcome(spec: spec) {
+        Stage0ReexportLinesIdentUnbound { package_name: package_name } =>
+          Stage0CrateLibEmitIdentUnbound { package_name: package_name }
+        Stage0ReexportLinesOk { lines: wrapper_lines } =>
+          Stage0CrateLibEmitOk {
+            file: TextFile {
+              path: concat(spec.crate_dir, "/src/lib.rs"),
+              content: concat(
+                spec.header_doc, "\n\n",
+                stage0_crate_allow_block(), "\n\n",
+                concat(wrapper_lines, lines) |> join(separator: "\n\n"), "\n"
+              )
+            }
+          }
+      }
+  }
+}
+
+// THE WRAPPERS ARE THE RUNTIME CRATE'S, RE-EXPORTED, NEVER REDEFINED. Emitted code and harness
+// drivers address `<crate>::NonEmptyVec`, and a second definition in the facade would be a different
+// Rust type from the one the module crates construct. So the facade re-exports them from each row
+// that carries them (emit_non_empty_wrappers), by that row's package ident.
+fn partition_facade_wrapper_reexports_outcome(spec: Stage0CrateSpec) -> Stage0ReexportLinesOutcome {
+  spec.partition_rows
+    |> filter(row => row.carries_non_empty_wrappers)
+    |> fold(init: Stage0ReexportLinesOk { lines: [] }, f: fn(acc, row) {
+      match acc {
+        Stage0ReexportLinesIdentUnbound { package_name: missing } =>
+          Stage0ReexportLinesIdentUnbound { package_name: missing }
+        Stage0ReexportLinesOk { lines: lines } =>
+          match package_ident_bound(bindings: spec.package_idents, package_name: row.package_name) {
+            Absent => Stage0ReexportLinesIdentUnbound { package_name: row.package_name }
+            Present { value: ident } =>
+              Stage0ReexportLinesOk { lines: lines |> concat([concat("pub use ", ident, "::\{NonEmptyBTreeSet, NonEmptyVec};")]) }
+          }
+      }
+    })
+}
+
 fn stage0_partition_lookups_valid() -> Bool {
   match stage0_crate_boundary_emit_outcome() {
     Stage0CrateBoundaryEmitOk { files: _ } => true
@@ -546,6 +662,7 @@ fn emit_stage0_crate_lib_outcome(spec: Stage0CrateSpec) -> Stage0CrateLibEmitOut
       }
     LayeredCoreCrate => render_stage0_layered_core_lib_outcome(spec: spec)
     EmitCoreCrate => render_stage0_emit_core_lib_outcome(spec)
+    FacadeCrate => render_partition_facade_lib_outcome(spec: spec)
   }
 }
 
@@ -567,23 +684,23 @@ fn emit_stage0_crate_lib_outcome(spec: Stage0CrateSpec) -> Stage0CrateLibEmitOut
 // names are hyphen-only and cannot collide, so this admission changes no rendered byte. It is landed
 // because the derived partition will supply names nobody reviewed one at a time.
 fn stage0_crate_plan_outcome() -> Stage0CratePlanOutcome {
-  partition_crate_plan_outcome_over(rows: generated_partition_crate_rows)
+  partition_crate_plan_outcome_over(rows: generated_partition_crate_rows, registry_dependencies: stage0_foundation_runtime_dependencies())
 }
 
 // ONE RENDERER FOR EVERY PARTITION ROW SET. The committed stage0 rows are one set; a derivation
-// that partitions an emitted closure (v2.workflow.emitted_crate_workspace) produces another of the
+// that partitions an emitted closure (gunbc.emitted_crate_workspace) produces another of the
 // same shape, and it is rendered here rather than by a second manifest and lib.rs writer beside
 // this one. Every lookup below reads the set it was handed, never the committed one.
-fn partition_crate_plan_outcome_over(rows: List<GeneratedPartitionCrateRow>) -> Stage0CratePlanOutcome {
+fn partition_crate_plan_outcome_over(rows: List<GeneratedPartitionCrateRow>, registry_dependencies: List<CargoDependency>) -> Stage0CratePlanOutcome {
   match rust_crate_package_idents(
     package_names: rows |> map(row => row.package_name)
   ) {
     PackageIdentSetRefused { cause: cause } => Stage0CratePlanIdentRefused { cause: cause }
-    PackageIdentSetOk { bindings: bindings } => stage0_crate_plan_from_admitted_rows(package_idents: bindings, rows: rows)
+    PackageIdentSetOk { bindings: bindings } => stage0_crate_plan_from_admitted_rows(package_idents: bindings, rows: rows, registry_dependencies: registry_dependencies)
   }
 }
 
-fn stage0_crate_plan_from_admitted_rows(package_idents: List<PackageIdentBinding>, rows: List<GeneratedPartitionCrateRow>) -> Stage0CratePlanOutcome {
+fn stage0_crate_plan_from_admitted_rows(package_idents: List<PackageIdentBinding>, rows: List<GeneratedPartitionCrateRow>, registry_dependencies: List<CargoDependency>) -> Stage0CratePlanOutcome {
   rows
     |> fold(init: Stage0CratePlanOk { plan: Stage0CratePlan { crates: [] } }, f: fn(acc, row) {
       match acc {
@@ -592,7 +709,7 @@ fn stage0_crate_plan_from_admitted_rows(package_idents: List<PackageIdentBinding
         Stage0CratePlanIdentRefused { cause: cause } =>
           Stage0CratePlanIdentRefused { cause: cause }
         Stage0CratePlanOk { plan: plan } =>
-          match stage0_partition_row_to_spec_outcome(row: row, package_idents: package_idents, rows: rows) {
+          match stage0_partition_row_to_spec_outcome(row: row, package_idents: package_idents, rows: rows, registry_dependencies: registry_dependencies) {
             Stage0PartitionRowSpecRefused { cause: cause } =>
               Stage0CratePlanRefused { cause: cause }
             Stage0PartitionRowSpecOk { spec: spec } =>
@@ -637,11 +754,14 @@ fn emit_stage0_crate_boundary_files_outcome(
 }
 
 fn stage0_crate_boundary_emit_outcome() -> Stage0CrateBoundaryEmitOutcome {
-  partition_crate_boundary_emit_outcome_over(rows: generated_partition_crate_rows)
+  partition_crate_boundary_emit_outcome_over(rows: generated_partition_crate_rows, registry_dependencies: stage0_foundation_runtime_dependencies())
 }
 
-fn partition_crate_boundary_emit_outcome_over(rows: List<GeneratedPartitionCrateRow>) -> Stage0CrateBoundaryEmitOutcome {
-  match partition_crate_plan_outcome_over(rows: rows) {
+// The registry dependencies every crate of the set links: the committed stage0 set passes
+// stage0_foundation_runtime_dependencies; an emitted closure passes what its emission demanded
+// (emitted_crate_dependencies, above).
+fn partition_crate_boundary_emit_outcome_over(rows: List<GeneratedPartitionCrateRow>, registry_dependencies: List<CargoDependency>) -> Stage0CrateBoundaryEmitOutcome {
+  match partition_crate_plan_outcome_over(rows: rows, registry_dependencies: registry_dependencies) {
     Stage0CratePlanRefused { cause: cause } =>
       Stage0CrateBoundaryEmitRefused {
         cause: stage0_map_package_dir_refusal_to_boundary(cause: cause)
diff --git a/src/v1/stage0_emit_core/src/lib.rs b/src/v1/stage0_emit_core/src/lib.rs
index 0fb332f6a31..2818b4379af 100644
--- a/src/v1/stage0_emit_core/src/lib.rs
+++ b/src/v1/stage0_emit_core/src/lib.rs
@@ -20,6 +20,10 @@
 
 pub use v1_stage0_runtime::{NonEmptyBTreeSet, NonEmptyVec};
 
+pub mod gunbc_rust_emitted_crate {
+    pub use v1_stage0_std_core::gunbc_rust_emitted_crate::*;
+}
+
 pub mod gunbc_rust_emitted_edge {
     pub use v1_stage0_std_core::gunbc_rust_emitted_edge::*;
 }
diff --git a/src/v1/stage0_std_core/src/lib.rs b/src/v1/stage0_std_core/src/lib.rs
index 9078ed2d1b5..6300472e94d 100644
--- a/src/v1/stage0_std_core/src/lib.rs
+++ b/src/v1/stage0_std_core/src/lib.rs
@@ -152,3 +152,6 @@ pub mod v1_std_core;
 #[rustfmt::skip]
 #[path = "../../stage0/src/gunbc_rust_emitted_edge.rs"]
 pub mod gunbc_rust_emitted_edge;
+#[rustfmt::skip]
+#[path = "../../stage0/src/gunbc_rust_emitted_crate.rs"]
+pub mod gunbc_rust_emitted_crate;
diff --git a/src/v1/tests/claim/reference_derived_disposition_census_witness_test.dag b/src/v1/tests/claim/reference_derived_disposition_census_witness_test.dag
index 9f6d9fcb47d..69a9e3bcc39 100644
--- a/src/v1/tests/claim/reference_derived_disposition_census_witness_test.dag
+++ b/src/v1/tests/claim/reference_derived_disposition_census_witness_test.dag
@@ -24,7 +24,7 @@ import v1.compiler.infer_items { ItemInfo, FnItem }
 import v1.std.core {
   ErrorNode, SourceSpan, no_span, diagnostic_to_message, is_error_diagnostic
 }
-import v1.compiler.infer_emit_info { TypeSummary, EnumRepr, empty_emit_graph_info }
+import v1.compiler.infer_emit_info { TypeSummary, TypeSummaryIndex, EnumRepr, empty_emit_graph_info, empty_type_summary_index, type_summary_index_insert }
 import v1.compiler.compile { SourceFile, compile_to_resolved }
 
 data reference_derived_disposition_census_witness_note: String = "THE ROUTE HALF OF THIS FILE IS ABSENT AND THE REASON IS A WALL RATHER THAN A CHOICE, stated here because it is the first thing a reader of a five-row file should know: the end-to-end pair this file was designed around -- a two-module manifest whose consumer calls a peer fn in VALUE position with no import, against a control differing by one authored import line -- was authored and DOES NOT RUN. A nested compile is not evaluable in the interpreter: compile_to_resolved over an authored source vector refuses with NoSuchField Node.ident during the nested pipeline, measured 2026-08-27 on three separate subjects. CAUSE CORRECTED 2026-09-02 (quick-crab-396): THAT SENTENCE NAMES A SYMPTOM AND NOT THE CLASS. Nested compiles are one POPULATION that constructs Nodes through helpers omitting v1.std.core Node's `ident` and then reads it; the class is that the interpreter has NO DEFAULT FOR AN OMITTED OPTIONAL FIELD and refuses on read, general to any record type -- established by a two-row probe with a positive control on a fresh type unrelated to Node, filed as the fourth form of gunbc.recurring_failure_mode state_space_conflation, which is the producer to re-derive from. This matters for what to DO: the repair the symptom suggests -- route around the nested pipeline with a host builtin, as the two instruments below do -- does not touch the cause, and the capability that would is construction supplying every declared field. That is not a property of this change; it is why the two nested-compile instruments the corpus already has (gunbc.compile_diagnostic_census and tools.multi_module_compile_fixture) both route through a HOST BUILTIN rather than calling the pipeline from .dag. The rows are not retained in a form that cannot execute, because a probe that always errors is not a red -- it is an inert artifact that would be counted as coverage. NEXT-RUNG TRIGGER FOR THE ROUTE: a nested-compile builtin returning the resolved graph, the shape tools.multi_module_compile_fixture already has, widened to carry the emitter reference-derived rows.\n\nWHERE THIS RUNS, STATED FIRST AND WITHOUT FLATTERY. THIS WITNESS IS NOT RUN BY CI. gunbc.ci_layer_roots witness_discovery_scan_dirs is [dag/test/claim, src/v2/test/claim/manual, src/v2/test/claim/emit] -- src/v1/tests/claim is not among them -- and the required run invokes claim_executor with --source-root dag --source-root src/v2, which could not resolve this file's import of v1.compiler.emit_rust even if discovery reached it. The scoped batch that once ran this directory died in the 2026-08-15 floor cut; gunbc.ci_layer_roots v1_claim_scoped_witness_batch_deleted_note records that and states the entries here have no executing consumer. The roster its sibling checkpoint_identity_keying_witness_test claims to be enrolled in, v1_claim_scoped_witness_entries, is not declared anywhere in dag/gunbc/ci/ci_layer_roots.dag -- verified by grep in both directions rather than taken from the note. THE FIVE ROWS BELOW WERE RUN DIRECTLY ON 2026-08-27 AND ALL FIVE PASS. Direct execution is evidence the assertions HOLD, never evidence that CI runs them, and conflating those two is the rung inflation this directory has now recorded twice.\n\nWHAT THE SUBJECT IS. Since PR 6848 a cross-module name resolves whether or not it is imported. At TYPE positions the resolver says so advisorily (UnlistedImportUse, is_error_diagnostic false); at VALUE positions it says nothing at all, and the emitter silently synthesizes the use-line the author did not write. That synthesis is unchanged here and deliberately so. What changed is that the per-candidate decision behind it stopped being an inline flat_map whose three non-surviving arms all returned the empty list, and became a four-armed coproduct one census can count.\n\nWHY BOTH HALVES ARE HERE. The four unit rows discriminate the DECISION: each names a distinct arm, and two of them differ ONLY in whether the provider's export set proves the symbol, so no constant, disabled mechanism or name-keyed rule satisfies them together. The end-to-end rows discriminate the CENSUS ROUTE: a two-module manifest compiled through compile_to_resolved, whose consumer references a peer's fn in VALUE position with no import, against a control differing by exactly one authored import line. The unlisted arm must produce a survived row naming peer_answer; the control must produce no row for that name at all, because an already-provided name never reaches the decision. Neither can pass vacuously -- a census that always reported zero fails the first, and one that reported every reference fails the second.\n\nTHE RED IS AUTHORABLE AT THE FIXTURE BOUNDARY, which is what makes this a probe rather than a decoration. No Accepted corpus module can be relied on to hold a value-position unlisted use on demand, but a fixture manifest can author one directly, and this file does. DESIGN 4b: a check whose RED cannot be produced anywhere it runs is permanently green by construction and worse than absent, because it gets cited as coverage. What this file lacks is a RUNNER, not a reachable red.\n\nWHAT THIS DOES NOT ESTABLISH. Nothing about the SIZE of the live population -- these are fixtures; NO PRODUCER FOR A REAL FIGURE EXISTS YET, and this file does not name one: the only route from .dag to a corpus census is a nested compile, which the interpreter refuses, so any figure quoted today names nothing that can produce it. And nothing about the names the census never sees: a candidate already provided by an authored import, the prelude, a carrier use-line or the module's own declarations is filtered before the decision, so every count is a LOWER BOUND and the gap is unmeasured. Quote it as at least N.\n\nNEXT-RUNG TRIGGER FOR THIS FILE'S EVIDENCE, which is NOT the same trigger as the class's and must not be folded into it: one prepared subject spanning dag, src/v1 and src/v2 -- the restoration gunbc.ci_layer_roots already names for the deleted batch -- at which point these rows execute and this first paragraph deletes. The CLASS's own trigger (the value-position case joining the fail-closed wall, retiring the census and the synthesis together) lives on v1.compiler.emit_rust reference_derived_census_rung_note. Either can land first; neither closes the other."
@@ -60,7 +60,7 @@ fn fixture_disposition(registry: Map<String, ItemInfo>, export_sets: Map<String,
     typed_modules: [],
     source_indices: empty_map(),
     module_index: build_module_index(modules: [], leaf_owner_modules: empty_map()),
-    type_summaries: empty_map(),
+    type_summaries: empty_type_summary_index(),
     variant_to_enum: empty_map(),
     in_type_position: false
   ))
@@ -90,7 +90,7 @@ test fn cross_module_candidate_with_export_proof_survives() -> Bool {
     typed_modules: [],
     source_indices: empty_map(),
     module_index: build_module_index(modules: [], leaf_owner_modules: empty_map()),
-    type_summaries: empty_map(),
+    type_summaries: empty_type_summary_index(),
     variant_to_enum: empty_map(),
     in_type_position: false
   ) == CandidateSurvived { provider_module: "fixture.provider" }
@@ -119,9 +119,10 @@ test fn census_counts_each_arm_separately() -> Bool {
 
 data variant_arm_red_note: String = "THE DISCRIMINATING RED FOR THE FIFTH ARM, and it is the one this file most needs. Before the arm existed a bare variant name reached the registry lookup, missed, and answered registry-absent -- so the fixture below is RED against the four-arm classifier and green against the five-arm one, which is what makes it evidence rather than decoration. The positive control beside it is the census row above: a name that is NOT a known variant still answers registry-absent, so the arm narrows the class rather than emptying it."
 
-fn fixture_variant_type_summaries() -> Map<String, TypeSummary> {
-  map_insert(empty_map(), "E", TypeSummary {
+fn fixture_variant_type_summaries() -> TypeSummaryIndex {
+  type_summary_index_insert(index: empty_type_summary_index(), key: "fixture.E", leaf: "E", summary: TypeSummary {
     name: "E",
+    key: "fixture.E",
     repr: EnumRepr { unit_only: true },
     field_summaries: empty_map(),
     field_type_map: empty_map(),
@@ -143,16 +144,17 @@ test fn known_variant_is_delegated_to_its_parent_not_registry_absent() -> Bool {
     source_indices: empty_map(),
     module_index: build_module_index(modules: [], leaf_owner_modules: empty_map()),
     type_summaries: fixture_variant_type_summaries(),
-    variant_to_enum: map_insert(empty_map(), "V", "E"),
+    variant_to_enum: map_insert(empty_map(), "V", "fixture.E"),
     in_type_position: false
   ) == CandidateVariantDelegatedToParent { parent_enum: "E" }
 }
 
 data ambiguous_parent_red_note: String = "THE REACHABLE HALF of the unresolved-parent arm, and the reason it is not merely a tidier name. derive_variant_to_enum inserts the EMPTY STRING as the parent when one variant name appears in two enums, so the lookup answers Present with a parent naming nothing. Without this arm that produced CandidateVariantDelegatedToParent { parent_enum: \"\" } -- a delegation to no one, wearing the payload that was supposed to make delegation honest. This fixture authors the collision directly and is RED against the arm-less form."
 
-fn fixture_colliding_variant_type_summaries() -> Map<String, TypeSummary> {
-  map_insert(fixture_variant_type_summaries(), "F", TypeSummary {
+fn fixture_colliding_variant_type_summaries() -> TypeSummaryIndex {
+  type_summary_index_insert(index: fixture_variant_type_summaries(), key: "fixture.F", leaf: "F", summary: TypeSummary {
     name: "F",
+    key: "fixture.F",
     repr: EnumRepr { unit_only: true },
     field_summaries: empty_map(),
     field_type_map: empty_map(),
@@ -193,7 +195,7 @@ test fn a_known_variant_spelling_in_a_type_position_takes_the_registry_arm() ->
     source_indices: empty_map(),
     module_index: build_module_index(modules: [], leaf_owner_modules: empty_map()),
     type_summaries: fixture_variant_type_summaries(),
-    variant_to_enum: map_insert(empty_map(), "V", "E"),
+    variant_to_enum: map_insert(empty_map(), "V", "fixture.E"),
     in_type_position: true
   )) == "registry-absent"
 }
@@ -213,7 +215,7 @@ test fn non_variant_name_still_answers_registry_absent() -> Bool {
     source_indices: empty_map(),
     module_index: build_module_index(modules: [], leaf_owner_modules: empty_map()),
     type_summaries: fixture_variant_type_summaries(),
-    variant_to_enum: map_insert(empty_map(), "V", "E"),
+    variant_to_enum: map_insert(empty_map(), "V", "fixture.E"),
     in_type_position: false
   )) == "registry-absent"
 }
diff --git a/src/v1/tests/src/anonymous_record_struct_resolution_test.rs b/src/v1/tests/src/anonymous_record_struct_resolution_test.rs
index f999ea14d5e..c18b1361a19 100644
--- a/src/v1/tests/src/anonymous_record_struct_resolution_test.rs
+++ b/src/v1/tests/src/anonymous_record_struct_resolution_test.rs
@@ -3,7 +3,7 @@ use std::rc::Rc;
 use v1_compiler::v1_compiler_emit_rust::{
     anonymous_record_struct_candidates, find_struct_name_by_fields,
 };
-use v1_compiler::v1_compiler_infer_emit_info::{TypeRepr, TypeSummary};
+use v1_compiler::v1_compiler_infer_emit_info::{TypeRepr, TypeSummary, TypeSummaryIndex};
 
 fn summary(name: &str, fields: &[(&str, &str)]) -> Rc<TypeSummary> {
     let mut field_type_map = HashMap::new();
@@ -12,6 +12,7 @@ fn summary(name: &str, fields: &[(&str, &str)]) -> Rc<TypeSummary> {
     }
     Rc::new(TypeSummary {
         name: name.to_string(),
+        key: format!("fixture.{name}"),
         repr: Rc::new(TypeRepr::StructRepr),
         field_summaries: Rc::new(HashMap::new()),
         field_type_map: Rc::new(field_type_map),
@@ -22,12 +23,23 @@ fn summary(name: &str, fields: &[(&str, &str)]) -> Rc<TypeSummary> {
     })
 }
 
-fn summaries(rows: &[Rc<TypeSummary>]) -> Rc<HashMap<String, Rc<TypeSummary>>> {
-    let mut result = HashMap::new();
+// Summaries are keyed by declaring identity, with the leaf index beside them.
+fn summaries(rows: &[Rc<TypeSummary>]) -> Rc<TypeSummaryIndex> {
+    let mut by_key = HashMap::new();
+    let mut keys_by_leaf: HashMap<String, Rc<Vector<String>>> = HashMap::new();
     for row in rows {
-        result.insert(row.name.clone(), row.clone());
+        by_key.insert(row.key.clone(), row.clone());
+        let mut keys = keys_by_leaf
+            .get(&row.name)
+            .map(|k| (**k).clone())
+            .unwrap_or_default();
+        keys.push_back(row.key.clone());
+        keys_by_leaf.insert(row.name.clone(), Rc::new(keys));
     }
-    Rc::new(result)
+    Rc::new(TypeSummaryIndex {
+        by_key: Rc::new(by_key),
+        keys_by_leaf: Rc::new(keys_by_leaf),
+    })
 }
 
 #[test]
diff --git a/src/v1/trait_bound_witness.dag b/src/v1/trait_bound_witness.dag
index 11633d85e97..55698a11132 100644
--- a/src/v1/trait_bound_witness.dag
+++ b/src/v1/trait_bound_witness.dag
@@ -57,13 +57,10 @@ module v1.compiler.trait_bound_witness
 // and scoped narrowly to a function body that IS DIRECTLY a top-level match expression (the exact
 // shape of the two real specimens this was traced from, realize_route<T> and classify_write<T> in
 // dag/std/cache_interface.dag) -- a body wrapped in Let/If/Branch before reaching the match is NOT
-// walked. That is a declared boundary, not a silent gap: BoundedToDirectTopLevelMatchBody names it
-// below, and the next-rung trigger is a recursive body walker mirroring
-// emit_rust_expr_if/emit_rust_expr_let's accessor shapes once a second real specimen needs it
-// (DESIGN.md S4b no-untracked-stall).
-
-type TraitBoundWitnessScope
-  = | BoundedToDirectTopLevelMatchBody
+// walked. THAT BOUNDARY IS RETIRED: its trigger fired on gunbc.product.data_class admit_data_effect,
+// whose cloned-scrutinee match is a fold step's body, and v1_fn_body_rc_match_clone_bound_param_names
+// (05_emit_rust.dag) now walks every match in the body. The scope variant that named the boundary is
+// deleted with it, as BoundedToDirectSingleCallLambdaBody's was.
 
 // gunbc dashboard node://adhoc-574e999b-39c, Row 1b. A second, structurally distinct trigger from
 // the RC-match one above: a wrapper fn whose body forwards its own arguments directly into ONE
@@ -107,8 +104,8 @@ type TraitBoundWitnessScope
 // v1_call_forwarding_clone_bound_param_names now walks children recursively, mirroring the equality
 // half rather than special-casing scrutinee position -- the variant is deleted below because the
 // scope it named no longer exists, and a boundary declaration that outlives its boundary is the
-// stale citation DESIGN section 3 forbids. BoundedToDirectTopLevelMatchBody is UNCHANGED and still
-// stands: the RC-match trigger was not widened here, and its own next-rung trigger is still open.
+// stale citation DESIGN section 3 forbids. The RC-match trigger was later widened the same way (see
+// the retirement note above).
 
 fn v1_rc_match_scrutinee_clone_bound_param_names(
   generic_param_names: List<String>,
diff --git a/src/v2/cli/compile_cli.dag b/src/v2/cli/compile_cli.dag
index bc326c90c25..70b0c325dbd 100644
--- a/src/v2/cli/compile_cli.dag
+++ b/src/v2/cli/compile_cli.dag
@@ -11,7 +11,12 @@ import v2.compiler.self_host.closure_emission {
   closure_emission_refused_count,
   emit_closure_from_ingest_located
 }
-import v2.compiler.source_authority { SourceRootIngest, source_root_ingest_from_files }
+import v2.compiler.source_authority {
+  SourceRootIngest,
+  SourceRootIngestFromFilesBuilt,
+  SourceRootIngestFromFilesUnrecognizedRoot,
+  source_root_ingest_from_files
+}
 import v2.cli.if_arm_reader_differential {
   IardCensus,
   IardCensusTaken,
@@ -373,9 +378,8 @@ type CliRunOutcome
 // boundary. Measured on the built binary at gunbc#11507's head -- three different entries
 // (`v2.std.text`, this module, `v2.compiler.compile`) all refused with the same nine words.
 //
-// THE WHOLE ORDERED CHAIN, BECAUSE THE HEAD IS NOT THE CAUSE. Rendering only the head answers
-// `parse_grammar_choice_overlap_residue` for every entry tried; that is a grammar-global ADVISORY
-// and never the fatal. The fatal diagnostic is the last one, and `parse_g0_tokens_remain_diagnostic`
+// THE WHOLE ORDERED CHAIN, BECAUSE THE HEAD IS NOT THE CAUSE. A head can be a non-fatal advisory
+// that rejected_with_pending prepended; it is never by itself the fatal. The fatal diagnostic is the last one, and `parse_g0_tokens_remain_diagnostic`
 // builds its locus from the first remaining token. The fatal pick is `v2.std.diagnostic`
 // `diagnostics_fatal`, the chain is `lens_verdict_diagnostics_located_chain_text_in_spans` (every
 // link with its locus, so thirty-five advisories in front of the fatal each say where they are),
@@ -543,7 +547,21 @@ fn v2_cli_main(argv: FreeMonoid<String>) -> CliRunOutcome {
     CliPlanRefused { reason: reason, detail: detail } => CliUsageRefused { reason: reason, detail: detail }
     CliPlanParsed { verb: _ } => match source_root_read(roots: v2_cli_plan_source_roots(plan: plan)) {
       SourceRootFilesRead { files: files } =>
-        v2_cli_run(plan: plan, ingest: source_root_ingest_from_files(files: files))
+        match source_root_ingest_from_files(files: files) {
+          SourceRootIngestFromFilesBuilt { ingest: ingest } =>
+            v2_cli_run(plan: plan, ingest: ingest)
+          SourceRootIngestFromFilesUnrecognizedRoot { argument: argument, path: path } =>
+            CliUsageRefused {
+              reason: ^cli_source_root_unrecognized,
+              detail: concat(
+                "source root is not a dag or src/v2 tree: ",
+                argument,
+                " (file ",
+                path,
+                ")"
+              )
+            }
+        }
       SourceRootFilesRefused { path: path, kind: kind, cause: cause } =>
         CliUsageRefused { reason: ^cli_source_root_read_refused,
           detail: concat("could not read source root at ", path, " [", kind, "]: ", cause) }
diff --git a/src/v2/cli/if_arm_reader_differential.dag b/src/v2/cli/if_arm_reader_differential.dag
index d9347aaea27..c7e101b7a8a 100644
--- a/src/v2/cli/if_arm_reader_differential.dag
+++ b/src/v2/cli/if_arm_reader_differential.dag
@@ -23,6 +23,7 @@ import v2.extdeps.languages.dag {
   ParseSubtreeAbsent,
   ParseSubtreeFound,
   dag_lex,
+  dag_surface_identity_is_top_level_item,
   dag_surface_kw_then_ident_from_captured,
   parse_production_captured_child_optional,
   parse_production_emitted_identity_optional
@@ -30,7 +31,7 @@ import v2.extdeps.languages.dag {
 import v2.std.algebra { fold_list, list_reverse }
 import v2.std.diagnostic { Accepted, Diagnostics, NonEmptyDiagnostics, Rejected, Textual, NodeLocus, SourcePortLocus, InvariantPortLocus, DeclarationLocus, ByteRange, WholeFile, bind_outcome, diagnostics_fatal_reason }
 import v2.std.grammar { node_atom_identity_optional }
-import v2.std.integer { integer_int_to_decimal_string }
+import std.integer { int_to_decimal_string }
 import v2.std.node { Node, Symbol, is_empty_conj_root, symbol_lexeme }
 import std.optional { Absent, Optional, Present, optional_absent, optional_present }
 import v2.std.provenance { SpanIndex, node_occurrence_id_optional, span_index_textual_locus_optional }
@@ -280,13 +281,7 @@ fn iard_declaration_name(shell: Node, emitted: Symbol) -> String {
 }
 
 fn iard_is_declaration(id: Symbol) -> Bool {
-  (id == ^dag_surface_fn_decl)
-    || (id == ^dag_surface_test_fn_decl)
-    || (id == ^dag_surface_data_decl)
-    || (id == ^dag_surface_type_decl)
-    || (id == ^dag_surface_alias_decl)
-    || (id == ^dag_surface_service_decl)
-    || (id == ^dag_surface_resource_decl)
+  dag_surface_identity_is_top_level_item(id: id)
 }
 
 // EVERY if_expr IN THE TREE, IN PRE-ORDER, WITH ITS ENCLOSING DECLARATION. Nested ifs are visited:
@@ -344,7 +339,7 @@ fn iard_location(node: Node, spans: SpanIndex) -> String {
             Textual { file: _, extent: e } =>
               match e {
                 ByteRange { start: s, end: en } =>
-                  concat("bytes=", concat(integer_int_to_decimal_string(value: s), concat("..", integer_int_to_decimal_string(value: en))))
+                  concat("bytes=", concat(int_to_decimal_string(value: s), concat("..", int_to_decimal_string(value: en))))
                 WholeFile => "<whole file>"
               }
             NodeLocus { anchor: _ } => "<non-textual locus>"
@@ -362,10 +357,10 @@ type IardFileOutcome
   = IardFileRead { path: String, spans: SpanIndex, sites: FreeMonoid<IardSite> }
   | IardFileRefused { path: String, reason: Symbol }
 
-fn iard_file(prepared: PreparedGrammar, residue: Diagnostics, read: DagSourceReadWitness) -> IardFileOutcome {
+fn iard_file(prepared: PreparedGrammar, read: DagSourceReadWitness) -> IardFileOutcome {
   let parsed = bind_outcome(
     o: tokenize(text: read.source.carried, file: read.compilation_unit, rules: dag_lex()),
-    f: fn(stream) { parse_module_prepared(tokens: stream, prepared: prepared, validation_residue: residue) }
+    f: fn(stream) { parse_module_prepared(tokens: stream, prepared: prepared) }
   )
   match parsed {
     Rejected { diagnostics: d } => IardFileRefused { path: read.artifact.file_path, reason: diagnostics_fatal_reason(d: d) }
@@ -493,12 +488,12 @@ type IardCensus
 fn if_arm_reader_differential(ingest: SourceRootIngest) -> IardCensus {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => IardGrammarUnprepared { reason: diagnostics_fatal_reason(d: d) }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       IardCensusTaken {
         tally: fold_list(
           xs: ingest,
           empty: IardTally { text: "", files_read: 0, files_refused: 0, sites: 0, else_differs: 0, then_differs: 0, sites_differing: 0 },
-          cons: fn(acc, read) { iard_tally_file(t: acc, outcome: iard_file(prepared: prepared, residue: residue, read: read)) }
+          cons: fn(acc, read) { iard_tally_file(t: acc, outcome: iard_file(prepared: prepared, read: read)) }
         )
       }
   }
@@ -508,16 +503,16 @@ fn if_arm_reader_differential(ingest: SourceRootIngest) -> IardCensus {
 // sites can be read against how many sites and files were actually observed.
 fn if_arm_reader_differential_summary(t: IardTally) -> String {
   concat(
-    concat("if_arm_reader_differential files_read=", integer_int_to_decimal_string(value: t.files_read)),
+    concat("if_arm_reader_differential files_read=", int_to_decimal_string(value: t.files_read)),
     concat(
-      concat(" files_refused=", integer_int_to_decimal_string(value: t.files_refused)),
+      concat(" files_refused=", int_to_decimal_string(value: t.files_refused)),
       concat(
-        concat(" if_sites=", integer_int_to_decimal_string(value: t.sites)),
+        concat(" if_sites=", int_to_decimal_string(value: t.sites)),
         concat(
-          concat(" sites_differing=", integer_int_to_decimal_string(value: t.sites_differing)),
+          concat(" sites_differing=", int_to_decimal_string(value: t.sites_differing)),
           concat(
-            concat(" else_differs=", integer_int_to_decimal_string(value: t.else_differs)),
-            concat(concat(" then_differs=", integer_int_to_decimal_string(value: t.then_differs)), "\n")
+            concat(" else_differs=", int_to_decimal_string(value: t.else_differs)),
+            concat(concat(" then_differs=", int_to_decimal_string(value: t.then_differs)), "\n")
           )
         )
       )
diff --git a/src/v2/compiler/00_compile.dag b/src/v2/compiler/00_compile.dag
index f470fa96cc2..02c080f7b1a 100644
--- a/src/v2/compiler/00_compile.dag
+++ b/src/v2/compiler/00_compile.dag
@@ -36,7 +36,7 @@ import extdeps.bazel.target_pattern {
   SingleTarget, PackageTargets, SubtreeTargets,
   parse_target_pattern, target_pattern_matches, target_pattern_refusal_text, render_target_pattern
 }
-import v2.std.integer { integer_int_to_decimal_string }
+import std.integer { int_to_decimal_string }
 import v2.compiler.emit { emit }
 import v2.compiler.eval { eval, eval_node, eval_default_interpretation, inputs_root_only }
 import v2.compiler.infer { InferredTree }
@@ -178,14 +178,11 @@ import v2.compiler.resolve {
   ResolveWalkRefused,
   resolve,
   resolved_tree_of,
-  ResolvedTree
+  ResolvedTree,
+  ClosureProviderRefusal
 }
 import v2.compiler.tokenize { PreparedLexRules, prepare_lex_rules, tokenize }
-import v2.std.staging { then_outcome, CacheProbe, Miss }
-import v2.compiler.materialization_carriers {
-  cached_stage_realization,
-  cached_stage_governed,
-}
+import v2.std.staging { then_outcome }
 import v2.std.compilers.lexing { TokenStream }
 import v2.std.grammar { ParseTree }
 import v2.std.language_model { LanguageModel }
@@ -200,7 +197,8 @@ import v2.extdeps.languages.dag {
 import v2.lens.complexity_accumulator_copy.compile_gate { accumulator_copy_compile_gate }
 import v2.lens.determinism { determinism_compile_gate }
 import v2.lens.machine_shape { machine_shape_compile_gate }
-import v2.lens.mandatory_tag { mandatory_tag_compile_gate }
+import v2.lens.mandatory_tag { mandatory_tag_compile_gate, mandatory_tag_compile_gate_with_provenance }
+import v2.std.member_declaration_kind { MemberKindChannel, no_member_declaration_kinds }
 import v2.lens.undecidable_verdict_collapse { undecidable_verdict_collapse_compile_gate }
 import v2.lens.fact_density { fact_density_hollow_alias_gate }
 import v2.lens.unit_modeling { unit_modeling_gate }
@@ -209,7 +207,7 @@ import std.decl_ref { DeclarationRef, decl_ref, declaration_ref_display_key }
 import std.content_hash { Fnv1a64Structural, content_hash_of_value, serialize_content_hash }
 import std.types { NonEmptyStr, List }
 import std.algebra { Cons, Empty, FreeMonoid, FreeSemigroup, trim, list_append, list_snoc_item }
-import v2.std.algebra { any, contains, fold_list, is_empty, length, list_find_first, list_reverse }
+import v2.std.algebra { any, contains, filter, fold_list, is_empty, length, list_find_first, list_map, list_reverse, list_starts_with }
 import v2.std.collection { Map, empty_map, map_insert, map_lookup }
 import v2.std.integer { Int }
 import v2.std.diagnostic {
@@ -795,6 +793,20 @@ fn machine_shape_root_gate(tree: InferredTree) -> Outcome<Witness<Node>> {
   machine_shape_compile_gate(node: tree.root)
 }
 
+// The compile door's binding of the mandatory_tag gate: the same gate, handed the member-kind provenance
+// the resolved subject carries (ResolvedTree.member_kinds).
+fn mandatory_tag_root_lens_with_provenance(lens: CompileLens, channel: MemberKindChannel) -> CompileLens {
+  if lens.identity == mandatory_tag_lens.identity {
+    CompileLens {
+      identity: lens.identity,
+      grain: lens.grain,
+      gate: fn(tree) { mandatory_tag_compile_gate_with_provenance(node: tree.root, channel: channel) }
+    }
+  } else {
+    lens
+  }
+}
+
 fn mandatory_tag_root_gate(tree: InferredTree) -> Outcome<Witness<Node>> {
   mandatory_tag_compile_gate(node: tree.root)
 }
@@ -1042,9 +1054,13 @@ fn validate_then_compile(
           bind_outcome(
             o: run_required_lens_gates(
               inferred: inferred,
-              lenses: list_append(
-                left: required_lenses_at_grain(grain: CompileLensRoot),
-                right: lenses_at_grain(lenses: lenses, grain: CompileLensRoot)
+              lenses: fold(
+                list_append(
+                  left: required_lenses_at_grain(grain: CompileLensRoot),
+                  right: lenses_at_grain(lenses: lenses, grain: CompileLensRoot)
+                ),
+                init: [],
+                f: fn(acc, l) { list_snoc_item(xs: acc, item: mandatory_tag_root_lens_with_provenance(lens: l, channel: source.member_kinds)) }
               )
             ),
             f: fn(root_witnesses) {
@@ -1239,10 +1255,6 @@ fn stage_resolve(lm: LanguageModel) -> fn(NormalizedTree) -> Outcome<ResolvedTre
   fn(normalized) { resolve(tree: normalized, lm: lm) }
 }
 
-fn resolve_cache_miss(normalized: NormalizedTree) -> CacheProbe<ResolvedTree> {
-  Miss
-}
-
 fn stage_translate(target: TargetModel) -> fn(ResolvedTree) -> Outcome<Medium<String>> {
   fn(resolved) {
     bind_outcome(
@@ -1267,34 +1279,22 @@ fn stage_translate(target: TargetModel) -> fn(ResolvedTree) -> Outcome<Medium<St
   }
 }
 
-// A REFUSED STAGE ADMISSION REFUSES THE COMPILE. cached_stage_realization answers
-// Outcome<CachedStageRealization> because an unmet materialization obligation is not a licence
-// to run the stage unmemoized -- it is a typed cause, and this spine already speaks Outcome, so
-// it is returned as the stage outcome rather than absorbed into the recompute arm.
 fn compile_ingest_staging(source: Medium<String>, target: TargetModel) -> Outcome<Medium<String>> {
-  match cached_stage_realization() {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: realization, diagnostics: _ } =>
-      let lm = dag_language_model()
-      let pipeline = then_outcome(
-          f: stage_tokenize(lm: lm),
+  let lm = dag_language_model()
+  let pipeline = then_outcome(
+      f: stage_tokenize(lm: lm),
+      g: then_outcome(
+        f: stage_parse(lm: lm),
+        g: then_outcome(
+          f: stage_normalize(),
           g: then_outcome(
-            f: stage_parse(lm: lm),
-            g: then_outcome(
-              f: stage_normalize(),
-              g: then_outcome(
-                f: cached_stage_governed(
-                  realization: realization,
-                  lookup: resolve_cache_miss,
-                  stage: stage_resolve(lm: lm)
-                ),
-                g: stage_translate(target: target)
-              )
-            )
+            f: stage_resolve(lm: lm),
+            g: stage_translate(target: target)
           )
         )
-      pipeline(source)
-  }
+      )
+    )
+  pipeline(source)
 }
 
 // ═══════════════════════════════════════════════════════════════════════════════════════════
@@ -1555,14 +1555,12 @@ fn native_test_context_fold_step(
   read: DagSourceReadWitness,
   lex: PreparedLexRules,
   prepared: PreparedGrammar,
-  residue: Diagnostics,
   scope: Fnv1a64Structural
 ) -> NativeTestContextFoldState {
   let result = program_assembly_read_to_normalized_root_seeded(
     read: read,
     lex: lex,
     prepared: prepared,
-    residue: residue,
     seed: state.alloc,
     scope: scope
   )
@@ -1589,19 +1587,17 @@ type NativeTestFrontEnd {
   lm: LanguageModel
   lex: PreparedLexRules
   prepared: PreparedGrammar
-  residue: Diagnostics
 }
 
 fn native_test_front_end_prepare() -> Outcome<NativeTestFrontEnd> {
   let lm = dag_language_model()
   match prepare_grammar(grammar: lm.grammar) {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       outcome_accepted(value: NativeTestFrontEnd {
         lm: lm,
         lex: prepare_lex_rules(rules: lm.lex),
-        prepared: prepared,
-        residue: residue
+        prepared: prepared
       })
   }
 }
@@ -1652,7 +1648,6 @@ fn native_test_context_from_ingest(ingest: SourceRootIngest) -> Outcome<NativeTe
               read: read,
               lex: front.lex,
               prepared: front.prepared,
-              residue: front.residue,
               scope: scope
             )
           }
@@ -2889,9 +2884,9 @@ fn native_lane_closure_exhausted_detail(budget: Int, frontier: List<String>) ->
   }
   concat(
     "import-closure walk exhausted its budget of ",
-    integer_int_to_decimal_string(value: budget),
+    int_to_decimal_string(value: budget),
     " rounds with ",
-    integer_int_to_decimal_string(value: length(xs: frontier)),
+    int_to_decimal_string(value: length(xs: frontier)),
     " module(s) still unexpanded, first: ",
     first
   )
@@ -3513,6 +3508,7 @@ fn native_module_resolve_verdict(
                     symbol_index: shared.symbol_index,
                     closure_declarations: closure.declarations,
                     unavailable_providers: closure.refused,
+                    member_kinds: no_member_declaration_kinds(),
                     lexical: lexical
                   )
                 },
@@ -3756,7 +3752,7 @@ fn native_demand_census_read(
   match bind_outcome(
     o: program_assembly_phase_tokenize(read: read, lex: front.lex),
     f: fn(tokens) {
-      parse_module_prepared_seeded(tokens: tokens, prepared: front.prepared, validation_residue: front.residue, seed: state.context.alloc)
+      parse_module_prepared_seeded(tokens: tokens, prepared: front.prepared, seed: state.context.alloc)
     }
   ) {
     Rejected { diagnostics: d } =>
@@ -3987,12 +3983,16 @@ fn native_census_module_resolution(
       NativeModuleResolveAccepted { resolved: _ } => NativeCensusModuleResolved
     },
     context: step.context,
-    cascade: match step.import_attribution {
-      NativeImportTargetRefused { target: t } => NativeCensusCascadeMemberOf { root: t.path, root_reason: native_test_file_refusal_fatal_reason(fr: t) }
-      NativeImportTargetsUnreadable { reason: r } => NativeCensusCascadeUnattributed { reason: r }
-      NativeImportTargetsAdmitted => NativeCensusCascadeNone
-      NativeImportTargetNotAsked => NativeCensusCascadeNone
-    }
+    cascade: native_census_import_cascade(attribution: step.import_attribution)
+  }
+}
+
+fn native_census_import_cascade(attribution: NativeImportTargetAttribution) -> NativeCensusCascade {
+  match attribution {
+    NativeImportTargetRefused { target: t } => NativeCensusCascadeMemberOf { root: t.path, root_reason: native_test_file_refusal_fatal_reason(fr: t) }
+    NativeImportTargetsUnreadable { reason: r } => NativeCensusCascadeUnattributed { reason: r }
+    NativeImportTargetsAdmitted => NativeCensusCascadeNone
+    NativeImportTargetNotAsked => NativeCensusCascadeNone
   }
 }
 
@@ -4014,9 +4014,13 @@ type NativeInferCensusOutcome
   | NativeInferCensusInferred { resolved: ResolvedTree, inferred: InferredTree }
   | NativeInferCensusInferRefused { resolved: ResolvedTree, chain: NonEmptyDiagnostics }
 
+// `cascade` IS THE RESOLVE VERDICT'S IMPORT ATTRIBUTION, carried exactly as
+// native_census_module_resolution carries it, so a resolve refusal reached through this walk files
+// the same cascade it files through census-resolve (one attribution authority, not two).
 type NativeInferCensusStep {
   outcome: NativeInferCensusOutcome
   context: NativeTestContext
+  cascade: NativeCensusCascade
 }
 
 fn native_census_module_inference(
@@ -4045,7 +4049,8 @@ fn native_census_module_inference(
             NativeInferCensusInferRefused { resolved: resolved, chain: d }
         }
     },
-    context: step.context
+    context: step.context,
+    cascade: native_census_import_cascade(attribution: step.import_attribution)
   }
 }
 
@@ -4135,17 +4140,19 @@ fn native_census_residual_rows(
 
 // THE CENSUS IS GROUPED BY THE CAUSE THAT FIRED, NEVER BY THE ONE THAT CAME FIRST. A refusal's
 // diagnostic list PREPENDS the advisories that were pending when the refusal fired
-// (rejected_with_pending), so its head is whatever advisory was queued first -- on the dag grammar
-// that is the overlap-residue advisory every file carries -- and grouping by it files every refusal
-// under one advisory that refused nothing. v2.std.diagnostic diagnostics_fatal is the one authority
+// (rejected_with_pending), so its head is whatever advisory was queued first, and grouping by it
+// files every refusal under an advisory that refused nothing. v2.std.diagnostic diagnostics_fatal is the one authority
 // for which element fired: a file refusal already carries its answer as `fatal_reason`
 // (native_test_file_refusal), and a resolve chain is asked the same question here. The head stays on
 // the member as `head_reason` so the reader still sees what rode along; it is a field, not a key.
 // BOTH POPULATIONS LAND IN ONE GROUPING because they are one question -- what refused, and where --
 // asked at two stages, and the stage is a field on the member rather than a second roster.
+// INFER IS THE THIRD STAGE OF THE SAME QUESTION (census part 2, docs/plans/census-part-2-inference-design.md
+// section 5): one more arm, not a second carrier, so every exhaustive match over the stage enrols it.
 type NativeCensusCauseStage
   = NativeCensusCauseFrontEnd
   | NativeCensusCauseResolve
+  | NativeCensusCauseInfer
 
 // CENSUS C: A CASCADE IS COLLAPSED TO ITS ROOT, ON THE SAME ROW. A module that refused because an
 // import target's FILE was refused is a symptom: it is filed ONCE (one member per module, not one
@@ -4202,12 +4209,20 @@ type NativeCensusCauseGroup {
 // none: it is a root, and a root's own imports cannot unblock anything). A roster module that is
 // neither file-refused nor indexed has imports nobody can read, so the graph is INCOMPLETE and every
 // fan-out over it is refused with that reason -- an undercount would be the silent arm.
+// `imports_of` IS THE SAME EDGE SET READ FORWARD, collected in the same pass: the subject closure
+// (native_census_subject_closure) walks it, so neither direction is a second read of the graph.
 type NativeCensusClosureIndex
-  = NativeCensusClosureIndexRead { importers_of: Map<String, List<String>>, modules: Int, refused_modules: Int }
+  = NativeCensusClosureIndexRead {
+      importers_of: Map<String, List<String>>
+      imports_of: Map<String, List<String>>
+      modules: Int
+      refused_modules: Int
+    }
   | NativeCensusClosureIndexUnavailable { reason: Symbol }
 
 type NativeCensusClosureIndexStep {
   importers_of: Map<String, List<String>>
+  imports_of: Map<String, List<String>>
   unread: Int
 }
 
@@ -4222,13 +4237,13 @@ fn native_census_closure_index(
     Accepted { value: shared, diagnostics: _ } =>
       let read = fold_list(
         xs: modules,
-        empty: NativeCensusClosureIndexStep { importers_of: empty_map(), unread: 0 },
+        empty: NativeCensusClosureIndexStep { importers_of: empty_map(), imports_of: empty_map(), unread: 0 },
         cons: fn(acc, entry) {
           match map_lookup(m: shared.roots.by_name, key: qualified_name_from_dotted_string(dotted: entry.module)) {
             Absent =>
               match native_lane_file_refusal_for_path(index: refusal_index, path: entry.path) {
                 Present { value: _ } => acc
-                Absent => NativeCensusClosureIndexStep { importers_of: acc.importers_of, unread: acc.unread + 1 }
+                Absent => NativeCensusClosureIndexStep { importers_of: acc.importers_of, imports_of: acc.imports_of, unread: acc.unread + 1 }
               }
             Present { value: tree } =>
               NativeCensusClosureIndexStep {
@@ -4244,6 +4259,10 @@ fn native_census_closure_index(
                     }
                   }
                 ),
+                imports_of: map_insert(acc.imports_of, entry.module, list_map(
+                  xs: normalized_tree_import_bindings(tree: tree),
+                  f: fn(row) { qualified_name_to_dotted_string(qn: qualified_name_init(qn: row.target)) }
+                )),
                 unread: acc.unread
               }
           }
@@ -4254,6 +4273,7 @@ fn native_census_closure_index(
       } else {
         NativeCensusClosureIndexRead {
           importers_of: read.importers_of,
+          imports_of: read.imports_of,
           modules: length(xs: modules),
           refused_modules: fold_list(xs: context.file_refusals, empty: 0, cons: fn(n, r) {
             match r.module {
@@ -4270,10 +4290,16 @@ fn native_census_closure_index(
 // reverse graph from the root: one walk, two directions, no second closure fold. Its budget is the
 // roster size plus one, which bounds the rounds of any walk over that roster; exhaustion refuses.
 fn native_census_closure_fan_out(index: NativeCensusClosureIndex, root: NativeTestFileRefusal) -> NativeCensusClosureFanOut {
+  native_census_closure_fan_out_of(index: index, root: root.module)
+}
+
+// THE SAME COUNT FOR ANY ROOT MODULE, whatever stage refused it: a resolve or infer root blocks its
+// importers exactly as a file root does, and the reverse walk does not care which stage it was.
+fn native_census_closure_fan_out_of(index: NativeCensusClosureIndex, root: Optional<QualifiedName>) -> NativeCensusClosureFanOut {
   match index {
     NativeCensusClosureIndexUnavailable { reason: r } => NativeCensusClosureFanOutUnavailable { reason: r }
-    NativeCensusClosureIndexRead { importers_of: importers_of, modules: modules, refused_modules: refused_modules } =>
-      match root.module {
+    NativeCensusClosureIndexRead { importers_of: importers_of, imports_of: _, modules: modules, refused_modules: refused_modules } =>
+      match root {
         Absent => NativeCensusClosureFanOutUnavailable { reason: ^native_census_closure_root_declares_no_module }
         Present { value: qn } =>
           let seed = [qualified_name_to_dotted_string(qn: qn)]
@@ -4411,41 +4437,322 @@ fn native_census_cause_groups_add_cascade_member(
   }
 }
 
+// `first_cascade` IS FILED ON THE FIRST CHAIN AND `cascade` ON EVERY OTHER. A module that is its own
+// root carries the Root arm (with its fan-out) on ONE row, so the ranking names it once however many
+// chains it refused at; the rest of its chains are its own refusals and read None.
 fn native_census_cause_groups_add_chains(
   groups: NativeCensusCauseGroups,
   entry: NativeCensusModule,
   first: NonEmptyDiagnostics,
   rest: List<NonEmptyDiagnostics>,
+  first_cascade: NativeCensusCascade,
   cascade: NativeCensusCascade
 ) -> NativeCensusCauseGroups {
   fold_list(
-    xs: native_census_residual_rows(entry: entry, first: first, rest: rest),
-    empty: groups,
-    cons: fn(acc, row) { native_census_cause_groups_add_residual(groups: acc, cascade: cascade, row: row) }
+    xs: rest,
+    empty: native_census_cause_groups_add_residual(
+      groups: groups,
+      cascade: first_cascade,
+      row: NativeCensusResidualRow { module: entry.module, path: entry.path, chain: first }
+    ),
+    cons: fn(acc, c) {
+      native_census_cause_groups_add_residual(
+        groups: acc,
+        cascade: cascade,
+        row: NativeCensusResidualRow { module: entry.module, path: entry.path, chain: c }
+      )
+    }
   )
 }
 
+// A MODULE THAT REFUSED ON ITS OWN ACCOUNT IS A ROOT, AND ITS ROW SAYS WHAT FIXING IT UNBLOCKS: the
+// same closure fan-out a file root carries (census C), counted over the same reverse import graph.
+fn native_census_own_root(closure: NativeCensusClosureIndex, entry: NativeCensusModule) -> NativeCensusCascade {
+  NativeCensusCascadeRoot {
+    closure_fan_out: native_census_closure_fan_out_of(
+      index: closure,
+      root: optional_present(value: qualified_name_from_dotted_string(dotted: entry.module))
+    ),
+    resolve_refused_importers: optional_absent()
+  }
+}
+
 // ONE CENSUS MODULE'S CONTRIBUTION TO THE GROUPS, decided here rather than in the emitted main: a
-// cascade member is filed once under its root; any other resolve refusal files every chain.
+// cascade member is filed once under its root; any other resolve refusal files every chain, the
+// first as the module's root row.
 fn native_census_cause_groups_add_module(
   groups: NativeCensusCauseGroups,
+  closure: NativeCensusClosureIndex,
   entry: NativeCensusModule,
   step: NativeCensusModuleStep
 ) -> NativeCensusCauseGroups {
   match step.outcome {
     NativeCensusModuleResolveRefused { first: f, rest: r, observation: _ } =>
-      match step.cascade {
-        NativeCensusCascadeMemberOf { root: root, root_reason: root_reason } =>
-          native_census_cause_groups_add_cascade_member(groups: groups, entry: entry, root: root, root_reason: root_reason)
-        NativeCensusCascadeNone => native_census_cause_groups_add_chains(groups: groups, entry: entry, first: f, rest: r, cascade: step.cascade)
-        NativeCensusCascadeUnattributed { reason: _ } => native_census_cause_groups_add_chains(groups: groups, entry: entry, first: f, rest: r, cascade: step.cascade)
-        NativeCensusCascadeRoot { closure_fan_out: _, resolve_refused_importers: _ } => native_census_cause_groups_add_chains(groups: groups, entry: entry, first: f, rest: r, cascade: step.cascade)
-      }
+      native_census_cause_groups_add_resolve_refused(groups: groups, closure: closure, entry: entry, first: f, rest: r, cascade: step.cascade)
     NativeCensusModuleFileRefused => groups
     NativeCensusModuleResolved => groups
   }
 }
 
+fn native_census_cause_groups_add_resolve_refused(
+  groups: NativeCensusCauseGroups,
+  closure: NativeCensusClosureIndex,
+  entry: NativeCensusModule,
+  first: NonEmptyDiagnostics,
+  rest: List<NonEmptyDiagnostics>,
+  cascade: NativeCensusCascade
+) -> NativeCensusCauseGroups {
+  match cascade {
+    NativeCensusCascadeMemberOf { root: root, root_reason: root_reason } =>
+      native_census_cause_groups_add_cascade_member(groups: groups, entry: entry, root: root, root_reason: root_reason)
+    NativeCensusCascadeNone =>
+      native_census_cause_groups_add_chains(groups: groups, entry: entry, first: first, rest: rest, first_cascade: native_census_own_root(closure: closure, entry: entry), cascade: NativeCensusCascadeNone)
+    NativeCensusCascadeRoot { closure_fan_out: _, resolve_refused_importers: _ } =>
+      native_census_cause_groups_add_chains(groups: groups, entry: entry, first: first, rest: rest, first_cascade: native_census_own_root(closure: closure, entry: entry), cascade: NativeCensusCascadeNone)
+    NativeCensusCascadeUnattributed { reason: _ } =>
+      native_census_cause_groups_add_chains(groups: groups, entry: entry, first: first, rest: rest, first_cascade: cascade, cascade: cascade)
+  }
+}
+
+// ── census part 2: the infer stage ─────────────────────────────────────────────────────────────
+//
+// THE INFER CASCADE IS THE ONE CROSS-MODULE CAUSATION v2 INFER ACTUALLY HAS, AND NOTHING ELSE.
+// docs/plans/census-part-2-inference-design.md section 4 is SUPERSEDED on this point (sharp-raven-357
+// ruling, 2026-10-04). That section assumed an infer->infer edge: M's infer refusing because an imported
+// T's infer refused. No such edge exists. infer_and_discharge reads ONE module's ResolvedTree, and the
+// declarations it reads from imports come from the closure index at RESOLVE grain
+// (v2.compiler.name_resolve closure_declarations_demand). T's inferred tree is never an input, so T
+// refusing infer cannot make M refuse, and a control expecting that cascade would have a red no
+// program can author (DESIGN section 4b). Its proposed edge, a fatal located at T's declaration, is
+// not readable either, because every infer diagnostic is located at a node of M's own tree.
+// What does exist is the edge v2.compiler.infer infer_closure_miss_refusal builds: when a closure
+// provider's own RESOLVE refused (ResolvedTree unavailable_providers), M's projection through one of
+// its declarations refuses as a closure miss, with the provider's refusal chain carried immediately
+// ahead of that miss in M's chain. M
+// resolved, so it IS an infer subject. That is a cross-stage cascade the design said could not
+// happen. Such a module is filed ONCE, as a member of the provider's root, in census C's shape.
+// Every other infer refusal is a root of its own.
+// TRIGGER for an infer->infer edge: v2 infer reading another module's INFERRED facts. Until then,
+// none is attributed.
+//
+// THE MATCH IS BY REASON SUFFIX AND FATAL, NOT BY GUESS. The chain must end in the closure-miss reason,
+// and the reasons immediately before it must be exactly the provider's chain. That is the shape
+// infer_closure_miss_refusal builds. The binds enclosing it may prepend M's own pending advisories,
+// so the provider chain sits at the end of M's chain, not at its head (measured on the cascade control
+// in v2.test.claim.native_census.infer_cascade: a seven-element chain carrying a one-element provider
+// chain). A chain that two providers would both match is Unattributed, never assigned to the first. The provider's own root is one hop
+// further when the provider is itself a cascade member of a refused file: that is read through the
+// same attribution authority census C uses (native_import_target_attribution), so the member names the
+// earliest refused module, exactly as a resolve cascade does.
+fn native_census_infer_cascade(
+  context: NativeTestContext,
+  module_paths: Map<String, Symbol>,
+  resolved: ResolvedTree,
+  chain: NonEmptyDiagnostics
+) -> NativeCensusCascade {
+  native_census_infer_cascade_of(
+    module_paths: module_paths,
+    providers: resolved.unavailable_providers,
+    chain: chain,
+    attribution: fn(provider) { native_import_target_attribution(context: context, module: provider) }
+  )
+}
+
+// THE ATTRIBUTION DECISION ITSELF, over the values it reads: the census roster's paths, the tree's refused
+// providers, the module's chain, and the import attribution of a provider. The wrapper above binds the
+// last to the context's own authority; a claim supplies all four at this interface (DESIGN section 3).
+fn native_census_infer_cascade_of(
+  module_paths: Map<String, Symbol>,
+  providers: List<ClosureProviderRefusal>,
+  chain: NonEmptyDiagnostics,
+  attribution: fn(QualifiedName) -> NativeImportTargetAttribution
+) -> NativeCensusCascade {
+  if diagnostics_fatal_reason(d: chain) == ^infer_reason_projection_receiver_declaration_unavailable {
+    let reversed = list_reverse(xs: native_census_chain_reasons(chain: chain))
+    let leading = filter(xs: providers, predicate: fn(p) {
+      list_starts_with(
+        xs: reversed,
+        prefix: Cons { head: ^infer_reason_projection_receiver_declaration_unavailable, tail: list_reverse(xs: native_census_chain_reasons(chain: p.refusal)) },
+        eq: fn(a, b) { a == b }
+      )
+    })
+    match leading {
+      Empty => NativeCensusCascadeNone
+      Cons { head: provider, tail: others } =>
+        if length(xs: others) > 0 {
+          NativeCensusCascadeUnattributed { reason: ^native_census_infer_cascade_provider_ambiguous }
+        } else {
+          match map_lookup(module_paths, qualified_name_to_dotted_string(qn: provider.module)) {
+            Absent => NativeCensusCascadeUnattributed { reason: ^native_census_infer_cascade_provider_not_censused }
+            Present { value: provider_path } =>
+              match attribution(provider.module) {
+                NativeImportTargetRefused { target: t } => NativeCensusCascadeMemberOf { root: t.path, root_reason: native_test_file_refusal_fatal_reason(fr: t) }
+                NativeImportTargetsUnreadable { reason: r } => NativeCensusCascadeUnattributed { reason: r }
+                NativeImportTargetsAdmitted => NativeCensusCascadeMemberOf { root: provider_path, root_reason: diagnostics_fatal_reason(d: provider.refusal) }
+                NativeImportTargetNotAsked => NativeCensusCascadeMemberOf { root: provider_path, root_reason: diagnostics_fatal_reason(d: provider.refusal) }
+              }
+          }
+        }
+    }
+  } else {
+    NativeCensusCascadeNone
+  }
+}
+
+fn native_census_chain_reasons(chain: NonEmptyDiagnostics) -> List<Symbol> {
+  Cons { head: chain.head.reason, tail: list_map(xs: chain.tail, f: fn(d) { d.reason }) }
+}
+
+// THE CENSUS ROSTER'S MODULE NAMES TO THEIR PATHS, read once per census, so an attributed root is named
+// by the same path identity every other root carries.
+fn native_census_module_paths(modules: List<NativeCensusModule>) -> Map<String, Symbol> {
+  fold_list(xs: modules, empty: empty_map(), cons: fn(m, entry) { map_insert(m, entry.module, entry.path) })
+}
+
+// ONE census-infer MODULE'S CONTRIBUTION. A resolve refusal is filed exactly as census-resolve files it,
+// because it is the same decision. An infer refusal is ONE row: infer stops at its first fatal, so
+// native_census_infer_completeness reports that module's observation as a lower bound. The row is either
+// a member of the closure provider's root that led its chain, or a root of its own carrying its fan-out.
+fn native_census_cause_groups_add_infer_module(
+  groups: NativeCensusCauseGroups,
+  closure: NativeCensusClosureIndex,
+  module_paths: Map<String, Symbol>,
+  entry: NativeCensusModule,
+  step: NativeInferCensusStep
+) -> NativeCensusCauseGroups {
+  match step.outcome {
+    NativeInferCensusFileRefused => groups
+    NativeInferCensusResolveRefused { first: f, rest: r, observation: _ } =>
+      native_census_cause_groups_add_resolve_refused(groups: groups, closure: closure, entry: entry, first: f, rest: r, cascade: step.cascade)
+    NativeInferCensusInferred { resolved: _, inferred: _ } => groups
+    NativeInferCensusInferRefused { resolved: resolved, chain: chain } =>
+      match native_census_infer_cascade(context: step.context, module_paths: module_paths, resolved: resolved, chain: chain) {
+        NativeCensusCascadeMemberOf { root: root, root_reason: root_reason } =>
+          native_census_infer_member(groups: groups, fatal_reason: root_reason, entry: entry, chain: chain, cascade: NativeCensusCascadeMemberOf { root: root, root_reason: root_reason })
+        NativeCensusCascadeUnattributed { reason: r } =>
+          native_census_infer_member(groups: groups, fatal_reason: diagnostics_fatal_reason(d: chain), entry: entry, chain: chain, cascade: NativeCensusCascadeUnattributed { reason: r })
+        NativeCensusCascadeNone =>
+          native_census_infer_member(groups: groups, fatal_reason: diagnostics_fatal_reason(d: chain), entry: entry, chain: chain, cascade: native_census_own_root(closure: closure, entry: entry))
+        NativeCensusCascadeRoot { closure_fan_out: _, resolve_refused_importers: _ } =>
+          native_census_infer_member(groups: groups, fatal_reason: diagnostics_fatal_reason(d: chain), entry: entry, chain: chain, cascade: native_census_own_root(closure: closure, entry: entry))
+      }
+  }
+}
+
+fn native_census_infer_member(
+  groups: NativeCensusCauseGroups,
+  fatal_reason: Symbol,
+  entry: NativeCensusModule,
+  chain: NonEmptyDiagnostics,
+  cascade: NativeCensusCascade
+) -> NativeCensusCauseGroups {
+  native_census_cause_groups_add(
+    groups: groups,
+    fatal_reason: fatal_reason,
+    member: NativeCensusCauseMember {
+      stage: NativeCensusCauseInfer,
+      path: entry.path,
+      module: optional_present(value: qualified_name_from_dotted_string(dotted: entry.module)),
+      head_reason: chain.head.reason,
+      cascade: cascade
+    }
+  )
+}
+
+// WHETHER THE census-infer WALK OBSERVED EVERY REFUSAL OF A MODULE. infer_and_discharge returns at its
+// first fatal, so an infer refusal is a LOWER BOUND and says so; the resolve arms answer as census-resolve
+// answers them.
+fn native_census_infer_completeness(outcome: NativeInferCensusOutcome) -> NativeCensusOccurrenceCompleteness {
+  match outcome {
+    NativeInferCensusFileRefused =>
+      NativeCensusCompletenessUnavailable { reason: ^native_census_file_never_reached_resolve }
+    NativeInferCensusResolveRefused { first: _, rest: _, observation: o } =>
+      NativeCensusCompletenessObserved { observation: o }
+    NativeInferCensusInferred { resolved: _, inferred: _ } =>
+      NativeCensusCompletenessObserved { observation: ObservationComplete }
+    NativeInferCensusInferRefused { resolved: _, chain: _ } =>
+      NativeCensusCompletenessObserved { observation: ObservationIncomplete { reason: ^native_census_infer_stops_at_first_fatal } }
+  }
+}
+
+// THE NATIVE TEST TARGET THE INFER CENSUS MARKS ITS ROOTS AGAINST: roadmap node `native-seven`
+// (gunbc.roadmap.roadmap_authority), whose boundary names this label and rules that its population is
+// DERIVED from the label, never kept as a list. So there is no roster of its tests here. The label is
+// parsed by the one target-pattern authority, its package names the subject module by the same
+// correspondence the native lane uses (gunbc.witness_v2_native_route native_route_module_package_text),
+// and the subject's closure is walked over the census's own import graph. A root is "in the N7 closure"
+// exactly when the subject module reaches it. The label is the instrument's own fact, never a CLI option.
+data native_census_subject_label: String = "//v2/test/parse/expression_bodied_fn_decl_parse:all"
+
+type NativeCensusSubjectClosure
+  = NativeCensusSubjectClosureRead { subject: String, members: Map<String, Bool> }
+  | NativeCensusSubjectClosureUnavailable { reason: Symbol }
+
+fn native_census_subject_closure(
+  index: NativeCensusClosureIndex,
+  modules: List<NativeCensusModule>,
+  label: String
+) -> NativeCensusSubjectClosure {
+  match parse_target_pattern(text: label) {
+    TargetPatternRefused { cause: _ } =>
+      NativeCensusSubjectClosureUnavailable { reason: ^native_census_subject_label_refused }
+    TargetPatternParsed { pattern: pattern } =>
+      match pattern {
+        SingleTarget { label: _ } => NativeCensusSubjectClosureUnavailable { reason: ^native_census_subject_label_names_no_module }
+        SubtreeTargets { package: _ } => NativeCensusSubjectClosureUnavailable { reason: ^native_census_subject_label_names_no_module }
+        PackageTargets { package: package } =>
+          match list_find_first(xs: modules, predicate: fn(m) { native_route_module_package_text(module_qn: m.module) == render_package(p: package) }) {
+            Absent => NativeCensusSubjectClosureUnavailable { reason: ^native_census_subject_module_not_censused }
+            Present { value: subject } =>
+              match index {
+                NativeCensusClosureIndexUnavailable { reason: r } => NativeCensusSubjectClosureUnavailable { reason: r }
+                NativeCensusClosureIndexRead { importers_of: _, imports_of: imports_of, modules: n, refused_modules: _ } =>
+                  match native_lane_module_reachable(
+                    index: imports_of,
+                    frontier: [subject.module],
+                    seen: [subject.module],
+                    seen_set: map_insert(empty_map(), subject.module, true),
+                    fuel: n + 1,
+                    budget: n + 1
+                  ) {
+                    Rejected { diagnostics: _ } => NativeCensusSubjectClosureUnavailable { reason: ^native_census_closure_walk_exhausted }
+                    Accepted { value: reached, diagnostics: _ } =>
+                      NativeCensusSubjectClosureRead {
+                        subject: subject.module,
+                        members: fold_list(xs: reached, empty: empty_map(), cons: fn(m, r) { map_insert(m, r, true) })
+                      }
+                  }
+              }
+          }
+      }
+  }
+}
+
+// WHETHER ONE RANKED ROOT IS IN THE SUBJECT'S CLOSURE. Three answers: a root whose module is unknown, or a
+// subject closure that could not be read, is Unavailable, never "outside".
+type NativeCensusSubjectMembership
+  = NativeCensusInSubjectClosure
+  | NativeCensusOutsideSubjectClosure
+  | NativeCensusSubjectMembershipUnavailable { reason: Symbol }
+
+fn native_census_root_subject_membership(
+  subject: NativeCensusSubjectClosure,
+  root: NativeCensusCauseMember
+) -> NativeCensusSubjectMembership {
+  match subject {
+    NativeCensusSubjectClosureUnavailable { reason: r } => NativeCensusSubjectMembershipUnavailable { reason: r }
+    NativeCensusSubjectClosureRead { subject: _, members: members } =>
+      match root.module {
+        Absent => NativeCensusSubjectMembershipUnavailable { reason: ^native_census_closure_root_declares_no_module }
+        Present { value: qn } =>
+          match map_lookup(members, qualified_name_to_dotted_string(qn: qn)) {
+            Present { value: _ } => NativeCensusInSubjectClosure
+            Absent => NativeCensusOutsideSubjectClosure
+          }
+      }
+  }
+}
+
 fn native_census_cause_groups_from_file_refusals(
   refusals: FreeMonoid<NativeTestFileRefusal>,
   closure: NativeCensusClosureIndex,
diff --git a/src/v2/compiler/01_tokenize.dag b/src/v2/compiler/01_tokenize.dag
index 3c5077ef47e..cf6306d9966 100644
--- a/src/v2/compiler/01_tokenize.dag
+++ b/src/v2/compiler/01_tokenize.dag
@@ -16,6 +16,7 @@ import v2.std.compilers.lexing {
   AnnotationRule,
   BlockCommentTextChar,
   DigitChar,
+  EmptyPattern,
   HexDigitChar,
   IdentContinueChar,
   IdentStartChar,
diff --git a/src/v2/compiler/02_parse.dag b/src/v2/compiler/02_parse.dag
index 90c473d8748..9e5223f0914 100644
--- a/src/v2/compiler/02_parse.dag
+++ b/src/v2/compiler/02_parse.dag
@@ -1,12 +1,6 @@
 module v2.compiler.parse
 
 import std.types { List }
-import v2.compiler.parse_diagnostic {
-  NonEmptyParseStageDiagnostics,
-  non_empty_parse_stage_diagnostics_from_overlap_roster,
-  parse_overlap_residue_stage_diagnostic_at,
-  parse_stage_diagnostic_core
-}
 import std.optional {
   Absent,
   Optional,
@@ -29,13 +23,12 @@ import v2.std.diagnostic {
   Textual,
   Unavailable,
   UserInputBoundary,
-  diagnostics_merge,
   diagnostics_singleton,
   node_locus,
   outcome_accepted,
+  declaration_locus,
   invariant_port_locus,
   port_refusal_locus,
-  rejected_with_pending,
   source_port_locus
 }
 import v2.std.grammar_choice_ambiguity { GrammarChoiceAmbiguityRow }
@@ -43,24 +36,18 @@ import v2.std.node {
   Atom,
   Conj,
   Edge,
-  Hash,
   Authored,
   Node,
   Symbol,
   TypeNode,
-  combine_hash,
-  content_hash,
   node_synthetic,
   node_with_occurrence_id,
-  symbol_identity_digest,
   well_formed,
   symbol_intern_lexeme,
   symbol_lexeme,
 }
 import v2.std.occurrence_id {
   alloc_occurrence_id,
-  authored_token_ordinal_space_from_allocator,
-  occurrence_id_allocator_advance_to,
   occurrence_id_allocator_initial
 }
 import std.occurrence_identity { NodeOccurrenceIdentity, OccurrenceId, OccurrenceIdAllocator, OccurrenceMinted, OccurrencePending, OccurrenceProjected, OccurrenceSynthetic, node_occurrence_identity_minted }
@@ -77,14 +64,13 @@ import v2.std.provenance {
   SpanIndex,
   origin_event_from_source,
   span_index_empty,
-  span_index_adopt,
   span_index_record
 }
 import v2.std.collection {
   Map,
   empty_map,
   list_at_optional,
-  map_get,
+  map_get_checked,
   map_insert,
   map_lookup
 }
@@ -96,16 +82,6 @@ import std.optional {
 import std.algebra { Cons, Empty, FreeSemigroup, list_append, list_snoc_item }
 import v2.std.algebra { HeadAbsent, HeadFound, TailAbsent, TailFound, any, contains, filter, fold_list, fold_list_right, is_empty, length, list_head, list_reverse, list_tail, unique, zip_eq }
 import v2.std.witness { Holds, Violates, Witness, witness_from_optional }
-import std.cache_identity { ArtifactKindId, CacheInterfaceId }
-import std.realization { Materialization }
-import v2.std.integer { integer_int_content_digest }
-import v2.compiler.materialization_carriers {
-  parse_table_memo_artifact_kind,
-  parse_table_memo_provider_id,
-  ParseMemoRecurrence,
-  parse_table_memo_materialization_for,
-  materialization_allows_memo_store,
-}
 import v2.extdeps.languages.dag {
   dag_float_literal_node_from_lexeme,
   dag_int_literal_node_from_lexeme,
@@ -125,7 +101,7 @@ import v2.std.compilers.lexing {
   token_stream_remaining_count,
   token_stream_layout,
 }
-import v2.std.parse_refusal_reason { LayoutUnknownWithoutSource, ParseRefusalReason, TokenStartsNotIncreasing, parse_refusal_reason_symbol }
+import v2.std.parse_refusal_reason { LayoutUnknownWithoutSource, NonAssociativeOperatorChain, ParseRefusalReason, TokenStartsNotIncreasing, parse_refusal_reason_symbol }
 import v2.std.grammar {
   AfterLineBreak,
   Choice,
@@ -138,6 +114,10 @@ import v2.std.grammar {
   GrammarExprFold,
   GrammarProduction,
   GrammarRoot,
+  InfixLeft,
+  InfixNonAssociative,
+  InfixOperatorRow,
+  InfixTable,
   ModeledGrammar,
   Nonterminal,
   ParseTree,
@@ -152,26 +132,22 @@ import v2.std.grammar {
   StampLexeme,
   fold_grammar_expr,
   grammar_empty_node,
+  grammar_infix_right_min_power,
+  grammar_infix_row_binding_power,
+  grammar_infix_row_class,
+  grammar_infix_table_language,
   grammar_named_edge,
   grammar_to_node
 }
 
-// THE MEMO FRAME. `frame` names every occurrence id recorded since the innermost memoized
-// production started: a mint is one FrameMinted, and a memo hit or miss inside the frame is one
-// FrameNested sharing the inner frame's list (a snoc, never a copy). A memo hit replays exactly
-// its stored frame into the current index instead of merging the stored index whole. That is
-// exact for every consumer: a node the hit returns carries only ids minted or replayed inside
-// the memoized frame, so every id it can look up is in the replayed frame; entries the stored
-// index held from before the frame belong to a different parse path, no node on this path
-// references them, and the span index is read only by lookup(id).
-type ParseProvFrameItem
-  = FrameMinted { id: OccurrenceId }
-  | FrameNested { frame: List<ParseProvFrameItem> }
-
+// THE PARSE'S PROVENANCE IS ONE PATH'S STATE. Every backtracking construct restores the whole
+// value on a failed attempt, so the allocator and the span index describe exactly the surviving
+// path: an id minted on an abandoned attempt is minted again by the next one and recorded once.
+// Nothing is served across paths -- the packrat memo that did so was deleted (operator ruling R2,
+// 2026-10-08; gunbc.recurring_failure_mode parse_memo_hit_serves_occurrences_minted_on_an_abandoned_path).
 type ParseProvenanceState {
   alloc: OccurrenceIdAllocator
   index: v2.std.provenance.SpanIndex
-  frame: List<ParseProvFrameItem>
 }
 
 // THE ALLOCATOR RIDES BESIDE THE INDEX BECAUSE THEY ARE ONE FACT. `span_index` says where each
@@ -267,12 +243,6 @@ type ParseStampResult {
   prov: ParseProvenanceState
 }
 
-type ParseMemoStats {
-  hits: Int
-  misses: Int
-  lookup_calls: Int
-}
-
 // THE FURTHEST POSITION A REJECTED ALTERNATIVE REACHED, which is where a refusal is located.
 // `parse_g0_tokens_remain` used to report the FIRST LEFTOVER token: the start of the module item
 // whose production failed as a whole, after `repeat` stopped. That names the symptom item, not
@@ -291,17 +261,6 @@ type ParseFurthestFailure
   | FurthestAtToken { token: Token, expectation: Optional<ParseRefusalReason> }
   | FurthestAtEnd { expectation: Optional<ParseRefusalReason> }
 
-type ParseMemoEntry
-  = ParseMemoAccepted {
-      remaining: List<Token>,
-      captured: Node,
-      diagnostics: List<Diagnostic>,
-      prov: ParseProvenanceState,
-      furthest: ParseFurthestFailure,
-      refusal: Optional<Diagnostic>
-    }
-  | ParseMemoRejected { diagnostics: List<Diagnostic>, furthest: ParseFurthestFailure, refusal: Optional<Diagnostic> }
-
 type ParseExprResult
   = ParseExprAccepted {
       remaining: List<Token>,
@@ -331,21 +290,7 @@ type GrammarExprCornerFold {
   nullable: Bool
 }
 
-type ParsePositionKey {
-  position: Int
-  production: Symbol
-}
-
 type ParseTableRealization {
-  artifact_kind: std.cache_identity.ArtifactKindId
-  provider_id: std.cache_identity.CacheInterfaceId
-  materialization: Materialization
-  grammar_digest: Hash
-  token_stream_digest: Hash
-  entries: Map<ParsePositionKey, ParseMemoEntry>
-  memo_hits: Int
-  memo_misses: Int
-  memo_lookup_calls: Int
   furthest: ParseFurthestFailure
   nullable_set: List<Symbol>
   first_rows: Map<Symbol, List<FirstKey>>
@@ -360,14 +305,13 @@ type ParseTable = ParseTableRealization
 type PreparedModeledGrammar {
   validated: ValidatedGrammarRoot
   analysis: GrammarFirstAnalysis
-  overlap_residue_stage: Optional<NonEmptyParseStageDiagnostics>
 }
 
 type PreparedGrammar
   = PreparedVoidGrammar
-  | PreparedModeled { modeled: PreparedModeledGrammar, materialization: Materialization }
+  | PreparedModeled { modeled: PreparedModeledGrammar }
 
-data prepared_grammar_carrier_note: String = "PreparedGrammar is the once-per-grammar carrier: well-formedness, the five grammar_validate_for_parse checks, and the FIRST/nullable analysis (GrammarFirstAnalysis) are pure functions of the grammar, so prepare_grammar runs them ONCE and parse_module_prepared reuses the result per module. Previously parse_module re-ran the whole 5-check validation AND compute_grammar_first_analysis was computed twice (once in the ambiguity check, once in parse_table_for_production) on EVERY parse. Hoisting prepare_grammar above the assemble fold makes a door call over a K-module closure validate once, not K times — correctness-by-construction (the prepare sits above fold_list), no timing gate. The cache-interface fields on ParseTableRealization (grammar_digest/provider_id/materialization) stay for the cross-call content-addressed memo, which is gated on wiring the currently Miss-stubbed cache backend."
+data prepared_grammar_carrier_note: String = "PreparedGrammar is the once-per-grammar carrier: well-formedness, the five grammar_validate_for_parse checks, and the FIRST/nullable analysis (GrammarFirstAnalysis) are pure functions of the grammar, so prepare_grammar runs them ONCE and parse_module_prepared reuses the result per module. Previously parse_module re-ran the whole 5-check validation AND compute_grammar_first_analysis was computed twice (once in the ambiguity check, once in parse_table_for_production) on EVERY parse. Hoisting prepare_grammar above the assemble fold makes a door call over a K-module closure validate once, not K times — correctness-by-construction (the prepare sits above fold_list), no timing gate."
 
 fn parse_grammar_not_well_formed_diagnostic(at: Locus) -> Diagnostic {
   Diagnostic {
@@ -496,6 +440,14 @@ fn parse_grammar_duplicate_production_diagnostic(at: Locus) -> Diagnostic {
   }
 }
 
+fn parse_grammar_infix_operator_duplicate_diagnostic(at: Locus) -> Diagnostic {
+  Diagnostic {
+    reason: ^parse_grammar_infix_operator_duplicate,
+    at: port_refusal_locus(at: at, port: ^parse_stage_locus_port, invariant: ^parse_grammar_infix_operator_duplicate),
+    correction: Unavailable { reason: ExternalContractUnknown }
+  }
+}
+
 fn parse_e1_syntax_error_diagnostic(at: Locus) -> Diagnostic {
   Diagnostic {
     reason: ^parse_e1_syntax_error,
@@ -542,16 +494,15 @@ fn grammar_lookup_production(root: GrammarRoot, name: Symbol) -> Witness<Grammar
 // well-formedness/analysis authority, run once per grammar at prepare_grammar time (§6
 // already-hoisted cost) and is correct to keep as the single-authority derivation of the index
 // below. grammar_lookup_production_indexed is the per-dispatch consumer: every nonterminal
-// reference during recursive-descent parsing calls it, memoized or not
-// (parse_nonterminal_memoized looks the production up before consulting the memo table), so
+// reference during recursive-descent parsing calls it (parse_nonterminal), so
 // the P=204-production dag grammar turned this into the dominant cost of parsing even a trivial
 // source under the tree-walking v1 interpreter (measured: ~12s to parse a 3-line source, PR #8478).
 // productions_by_name is that lookup's index, built once by grammar_production_index and carried on
 // ParseTable exactly like nullable_set/first_rows already are (parse_table_carry_analysis threads
 // all three through every table mutation) — one Map<Symbol,GrammarProduction>, not a second
 // production roster (§3). Every ParseTableRealization construction site
-// (parse_table_for_production_analyzed, the real-parse path; parse_table_empty;
-// parse_table_carry_analysis, the pass-through on every table mutation) populates this field, so
+// (parse_table_for_stream_analyzed, the real-parse path; parse_table_empty; the furthest and
+// refusal updates, which pass it through) populates this field, so
 // the O(P)->O(1) change is not opt-in per call site. Measured effect (this host,
 // dag/test/claim/long/dag_arrow_lambda_witness_test.dag witness_single_param_lambda_parses via
 // `gunbc run --claim-run`, fix stashed vs applied around the identical whole-process invocation):
@@ -559,8 +510,8 @@ fn grammar_lookup_production(root: GrammarRoot, name: Symbol) -> Witness<Grammar
 // because the invocation's wall time is dominated by up-front module-load/typecheck of the full v2
 // closure — a cost this change does not touch — rather than by the repeated per-dispatch grammar
 // lookup inside the parse itself; the O(204)->O(1) asymptotic claim is the primary evidence
-// (grammar_lookup_production is an unmemoized linear filter reached before every memo-table check,
-// so even a memo HIT paid the full scan), not the crude wall-clock ratio. This is the class
+// (grammar_lookup_production is a linear filter, so every nonterminal dispatch paid the full scan),
+// not the crude wall-clock ratio. This is the class
 // docs/plans/measurements/floor-slow-rows-2026-08-18.md records dag_arrow_lambda_witness_test's
 // rows landing 1-4ms over its 1552ms ceiling for.
 
@@ -581,85 +532,6 @@ fn grammar_lookup_production_indexed(table: ParseTable, name: Symbol) -> Witness
   )
 }
 
-fn parse_table_memo_miss_diagnostic(at: Locus) -> Diagnostic {
-  Diagnostic {
-    reason: ^parse_table_memo_miss,
-    at: port_refusal_locus(at: at, port: ^parse_stage_locus_port, invariant: ^parse_table_memo_miss),
-    correction: Unavailable { reason: ExternalContractUnknown }
-  }
-}
-
-fn parse_table_entries_lookup(table: ParseTable, key: ParsePositionKey) -> Witness<ParseMemoEntry> {
-  witness_from_optional(
-    opt: table.entries.lookup(key),
-    absent: parse_table_memo_miss_diagnostic(at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^parse_table_memo_miss))
-  )
-}
-
-fn parse_table_lookup(table: ParseTable, key: ParsePositionKey) -> Witness<ParseMemoEntry> {
-  match v2.compiler.materialization_carriers.materialization_allows_memo_store(m: table.materialization) {
-    true => { parse_table_entries_lookup(table: table, key: key) }
-    false => {
-      Violates {
-        diagnostic: parse_table_memo_store_refused_diagnostic(
-          at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^parse_table_memo_store_refused)
-        )
-      }
-    }
-  }
-}
-
-fn parse_table_memo_store_refused_diagnostic(at: Locus) -> Diagnostic {
-  Diagnostic {
-    reason: ^parse_table_memo_store_refused,
-    at: port_refusal_locus(at: at, port: ^parse_stage_locus_port, invariant: ^parse_table_memo_store_refused),
-    correction: Unavailable { reason: ExternalContractUnknown }
-  }
-}
-
-fn parse_table_memo_store_refused_reason(d: Diagnostic) -> Bool {
-  match d {
-    Diagnostic { reason: r, at: _, correction: _ } =>
-      r == ^parse_table_memo_store_refused
-  }
-}
-
-fn parse_table_memo_lookup_refuses_store(table: ParseTable, key: ParsePositionKey) -> Bool {
-  match parse_table_lookup(table: table, key: key) {
-    Violates { diagnostic: d } => parse_table_memo_store_refused_reason(d: d)
-    Holds { value: _ } => false
-  }
-}
-
-fn parse_table_memo_insert_refused(
-  table: ParseTable,
-  key: ParsePositionKey,
-  value: ParseMemoEntry
-) -> Bool {
-  let after = parse_table_insert(table: table, key: key, value: value)
-  match v2.std.collection.map_get(m: after.entries, key: key) {
-    Accepted { value: Absent } => true
-    Accepted { value: Present { value: _ } } => false
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn parse_memo_entry_from_expr(result: ParseExprResult) -> ParseMemoEntry {
-  match result {
-    ParseExprAccepted { remaining: remaining, captured: captured, diagnostics: diagnostics, prov: prov, table: _ } =>
-      ParseMemoAccepted {
-        remaining: remaining,
-        captured: captured,
-        diagnostics: diagnostics,
-        prov: prov,
-        furthest: parse_expr_result_table(result: result).furthest,
-        refusal: parse_expr_result_table(result: result).refusal
-      }
-    ParseExprRejected { diagnostics: diagnostics, table: table } =>
-      ParseMemoRejected { diagnostics: diagnostics, furthest: table.furthest, refusal: table.refusal }
-  }
-}
-
 fn parse_expr_result_table(result: ParseExprResult) -> ParseTable {
   match result {
     ParseExprAccepted { remaining: _, captured: _, diagnostics: _, prov: _, table: table } => table
@@ -667,67 +539,6 @@ fn parse_expr_result_table(result: ParseExprResult) -> ParseTable {
   }
 }
 
-fn parse_table_memo_stats(table: ParseTable) -> ParseMemoStats {
-  ParseMemoStats {
-    hits: table.memo_hits,
-    misses: table.memo_misses,
-    lookup_calls: table.memo_lookup_calls
-  }
-}
-
-fn parse_memo_stats_empty() -> ParseMemoStats {
-  ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-}
-
-// THE PARSE'S OWN MEMO ACCOUNTING, CARRIED BESIDE ITS RESULT AND NOT INSIDE IT.
-//
-// WHY NOT A FIELD ON ParseArtifact, which is the shorter change. ParseArtifact answers WHAT was
-// parsed; the memo counters answer HOW the parse was executed, which is a realization fact about
-// one run and not a property of the tree. DESIGN section 3 keeps interface and realization as two
-// facts, so putting a counter on the semantic artifact would make every consumer of a parse result
-// carry a measurement it has no use for, and would make the artifact's identity depend on how many
-// times a memo happened to be consulted.
-//
-// AND THE COUNTERS MUST SURVIVE A REFUSAL, which a field on the accepted value cannot do. The
-// expensive case this instrument exists to read is a file that spends seconds in parse and THEN
-// rejects; an Outcome's Rejected arm carries no ParseArtifact, so the stats would be lost exactly
-// where they are most wanted. This carrier holds the outcome and the accounting side by side, so
-// both arms report.
-//
-// THE UNMEASURED ENTRY POINT IS A PROJECTION OF THIS ONE, never a second parse: parse_module_prepared
-// is `.outcome` of the measured fold, so there is one implementation and no caller pays a second
-// parse to be measured.
-type ParseProductionMeasured {
-  outcome: Outcome<ParseArtifact>
-  memo: ParseMemoStats
-}
-
-fn parse_table_carry_analysis(table: ParseTable, entries: Map<ParsePositionKey, ParseMemoEntry>, hits: Int, misses: Int, lookups: Int) -> ParseTable {
-  ParseTableRealization {
-    artifact_kind: table.artifact_kind,
-    provider_id: table.provider_id,
-    materialization: table.materialization,
-    grammar_digest: table.grammar_digest,
-    token_stream_digest: table.token_stream_digest,
-    entries: entries,
-    memo_hits: hits,
-    memo_misses: misses,
-    memo_lookup_calls: lookups,
-    furthest: table.furthest,
-    nullable_set: table.nullable_set,
-    first_rows: table.first_rows,
-    productions_by_name: table.productions_by_name,
-    prepared_exprs: table.prepared_exprs,
-    layout: table.layout,
-    refusal: table.refusal
-  }
-}
-
-// A MEMO ENTRY CARRIES ITS OWN SUBPARSE'S FURTHEST FAILURE, and a hit joins it back in. The
-// seed serves entries across parses of one token stream (v1_interpreter
-// parse_table_memo_scope_and_key), so a table-only record would lose the deep rejection inside a
-// served subparse and the refusal's locus would depend on cache warmth. The miss path runs the
-// subparse from the unit, stores what that subparse alone reached, then joins it with the caller's.
 fn parse_expectation_first(left: Optional<ParseRefusalReason>, right: Optional<ParseRefusalReason>) -> Optional<ParseRefusalReason> {
   match left {
     Present { value: _ } => left
@@ -778,15 +589,6 @@ fn parse_furthest_expected_at(tokens: List<Token>, reason: ParseRefusalReason) -
 
 fn parse_table_with_furthest(table: ParseTable, furthest: ParseFurthestFailure) -> ParseTable {
   ParseTableRealization {
-    artifact_kind: table.artifact_kind,
-    provider_id: table.provider_id,
-    materialization: table.materialization,
-    grammar_digest: table.grammar_digest,
-    token_stream_digest: table.token_stream_digest,
-    entries: table.entries,
-    memo_hits: table.memo_hits,
-    memo_misses: table.memo_misses,
-    memo_lookup_calls: table.memo_lookup_calls,
     furthest: furthest,
     nullable_set: table.nullable_set,
     first_rows: table.first_rows,
@@ -802,7 +604,7 @@ fn parse_table_join_furthest(table: ParseTable, furthest: ParseFurthestFailure)
 }
 
 // THE FIRST REFUSAL STANDS. A table that already refused keeps its refusal; one that has not takes
-// the incoming one (a memo hit replaying the refusal its subparse recorded).
+// the incoming one.
 fn parse_table_join_refusal(table: ParseTable, refusal: Optional<Diagnostic>) -> ParseTable {
   match table.refusal {
     Present { value: _ } => table
@@ -816,15 +618,6 @@ fn parse_table_join_refusal(table: ParseTable, refusal: Optional<Diagnostic>) ->
 
 fn parse_table_with_refusal(table: ParseTable, refusal: Diagnostic) -> ParseTable {
   ParseTableRealization {
-    artifact_kind: table.artifact_kind,
-    provider_id: table.provider_id,
-    materialization: table.materialization,
-    grammar_digest: table.grammar_digest,
-    token_stream_digest: table.token_stream_digest,
-    entries: table.entries,
-    memo_hits: table.memo_hits,
-    memo_misses: table.memo_misses,
-    memo_lookup_calls: table.memo_lookup_calls,
     furthest: table.furthest,
     nullable_set: table.nullable_set,
     first_rows: table.first_rows,
@@ -835,141 +628,28 @@ fn parse_table_with_refusal(table: ParseTable, refusal: Diagnostic) -> ParseTabl
   }
 }
 
-fn parse_table_record_lookup_call(table: ParseTable) -> ParseTable {
-  parse_table_carry_analysis(
-    table: table,
-    entries: table.entries,
-    hits: table.memo_hits,
-    misses: table.memo_misses,
-    lookups: table.memo_lookup_calls + 1
-  )
-}
-
-fn parse_table_record_hit(table: ParseTable) -> ParseTable {
-  parse_table_carry_analysis(
-    table: table,
-    entries: table.entries,
-    hits: table.memo_hits + 1,
-    misses: table.memo_misses,
-    lookups: table.memo_lookup_calls
-  )
-}
-
-fn parse_table_record_miss(table: ParseTable) -> ParseTable {
-  parse_table_carry_analysis(
-    table: table,
-    entries: table.entries,
-    hits: table.memo_hits,
-    misses: table.memo_misses + 1,
-    lookups: table.memo_lookup_calls
-  )
-}
-
-fn parse_table_insert(table: ParseTable, key: ParsePositionKey, value: ParseMemoEntry) -> ParseTable {
-  match v2.compiler.materialization_carriers.materialization_allows_memo_store(m: table.materialization) {
-    true =>
-      parse_table_carry_analysis(
-        table: table,
-        entries: map_insert(m: table.entries, key: key, value: value),
-        hits: table.memo_hits,
-        misses: table.memo_misses,
-        lookups: table.memo_lookup_calls
-      )
-    false => table
-  }
-}
-
-fn parse_grammar_digest(validated: ValidatedGrammarRoot) -> Hash {
-  content_hash(
-    n: grammar_to_node(grammar: ModeledGrammar { root: validated.root })
-  )
-}
-
-// ONE DIGEST PER TOKEN FIELD, NOT ONE HASH STEP PER UNIT OF MAGNITUDE. The stream digest used to
-// send both offsets and every lexeme codepoint through the single-byte-limb digest: unary in the
-// value (a codepoint near 100 cost ~100 combine_hash calls), and one shared tag for every value
-// above 255. On the native route that made the eager fill in parse_table_for_production_analyzed
-// 28% of the process (perf --children, bounded K=16 root, 2026-09-14), and it made offsets past
-// byte 255 and every non-Latin-1 codepoint collide in the seed interpreter's cross-parse memo key
-// (v1_interpreter parse_table_memo_scope_and_key reads this field). Offsets and positions now go
-// through the Int content authority and the lexeme through its interned symbol.
-// The token digest, combined with the stream layout's own digest (folded once, in the layout walk,
-// over the line-break-preceded tokens' starts and lines). Only a sourceless stream keys by the token
-// digest alone.
-fn parse_token_stream_layout_digest(all_tokens: List<Token>, layout: Optional<StreamLayout>) -> Hash {
-  match layout {
-    Absent => parse_token_stream_digest(all_tokens: all_tokens)
-    Present { value: l } => combine_hash(a: parse_token_stream_digest(all_tokens: all_tokens), b: l.digest)
-  }
-}
-
-fn parse_token_stream_digest(all_tokens: List<Token>) -> Hash {
-  fold_list(
-    xs: all_tokens,
-    empty: symbol_identity_digest(sym: ^parse_token_stream_digest_nil),
-    cons: fn(acc, tok) {
-      combine_hash(
-        a: acc,
-        b: combine_hash(
-          a: combine_hash(
-            a: symbol_identity_digest(sym: tok.class),
-            b: symbol_identity_digest(sym: tok.file)
-          ),
-          b: combine_hash(
-            a: combine_hash(
-              a: integer_int_content_digest(value: tok.start),
-              b: integer_int_content_digest(value: tok.end)
-            ),
-            b: symbol_identity_digest(sym: symbol_intern_lexeme(lexeme: tok.lexeme))
-          )
-        )
-      )
-    }
-  )
-}
-
-// THE MATERIALIZATION ARRIVES ADMITTED, it is not read here. This constructor runs once per
-// production parse; the admission is a function of the ladder verdicts alone, so reading the
-// door here would ask one question per table and give every caller its own place to mishandle
-// a refusal. prepare_grammar asks once per grammar and refuses there, and what reaches here is
-// a value that has already been admitted -- so this signature cannot express an unadmitted one.
 fn parse_table_for_production_analyzed(
   validated: ValidatedGrammarRoot,
   analysis: GrammarFirstAnalysis,
-  all_tokens: List<Token>,
-  materialization: Materialization
+  all_tokens: List<Token>
 ) -> ParseTable {
   parse_table_for_stream_analyzed(
     validated: validated,
     analysis: analysis,
     all_tokens: all_tokens,
-    layout: optional_absent(),
-    materialization: materialization
+    layout: optional_absent()
   )
 }
 
 // The stream's layout rides on the table so a layout-conditioned production can ask its question at
-// the point of use (v2.std.compilers.lexing token_stream_line_break_before), and its layout (the starts of
-// the line-break-preceded tokens) is part of the
-// stream's digest: two sources can lex to byte-identical tokens and differ only in layout, and a memo
-// entry must never serve one's answer to the other.
+// the point of use (v2.std.compilers.lexing token_stream_line_break_before).
 fn parse_table_for_stream_analyzed(
   validated: ValidatedGrammarRoot,
   analysis: GrammarFirstAnalysis,
   all_tokens: List<Token>,
-  layout: Optional<StreamLayout>,
-  materialization: Materialization
+  layout: Optional<StreamLayout>
 ) -> ParseTable {
   ParseTableRealization {
-    artifact_kind: v2.compiler.materialization_carriers.parse_table_memo_artifact_kind(),
-    provider_id: v2.compiler.materialization_carriers.parse_table_memo_provider_id(),
-    materialization: materialization,
-    grammar_digest: analysis.grammar_digest,
-    token_stream_digest: parse_token_stream_layout_digest(all_tokens: all_tokens, layout: layout),
-    entries: empty_map(),
-    memo_hits: 0,
-    memo_misses: 0,
-    memo_lookup_calls: 0,
     furthest: FurthestNone,
     nullable_set: analysis.nullable_set,
     first_rows: analysis.first_rows,
@@ -982,32 +662,18 @@ fn parse_table_for_stream_analyzed(
 
 fn parse_table_for_production(
   validated: ValidatedGrammarRoot,
-  all_tokens: List<Token>,
-  materialization: Materialization
+  all_tokens: List<Token>
 ) -> ParseTable {
   parse_table_for_production_analyzed(
     validated: validated,
     analysis: compute_grammar_first_analysis(root: validated.root),
-    all_tokens: all_tokens,
-    materialization: materialization
+    all_tokens: all_tokens
   )
 }
 
-// The empty grammar has no productions, so its recurrence census would be zero on both counts
-// and its demand case the ladder's single-demand arm. It is a test-only constructor with no
-// analysis to carry, so the materialization is SUPPLIED at the boundary rather than derived here
-// (DESIGN section 3's witness rule); the derived route is parse_table_for_production_analyzed.
-fn parse_table_empty(materialization: Materialization) -> ParseTable {
+// A test-only constructor with no analysis to carry: no productions, no FIRST rows, no layout.
+fn parse_table_empty() -> ParseTable {
   ParseTableRealization {
-    artifact_kind: v2.compiler.materialization_carriers.parse_table_memo_artifact_kind(),
-    provider_id: v2.compiler.materialization_carriers.parse_table_memo_provider_id(),
-    materialization: materialization,
-    grammar_digest: content_hash(n: grammar_empty_node()),
-    token_stream_digest: symbol_identity_digest(sym: ^parse_table_empty_token_stream),
-    entries: empty_map(),
-    memo_hits: 0,
-    memo_misses: 0,
-    memo_lookup_calls: 0,
     furthest: FurthestNone,
     nullable_set: std.algebra.Empty,
     first_rows: empty_map(),
@@ -1018,16 +684,6 @@ fn parse_table_empty(materialization: Materialization) -> ParseTable {
   }
 }
 
-fn parse_table_subject(table: ParseTable, key: ParsePositionKey) -> Hash {
-  combine_hash(
-    a: combine_hash(a: table.grammar_digest, b: table.token_stream_digest),
-    b: combine_hash(
-      a: integer_int_content_digest(value: key.position),
-      b: symbol_identity_digest(sym: key.production)
-    )
-  )
-}
-
 fn parse_current_position(tokens: List<Token>) -> Int {
   match list_head(xs: tokens) {
     HeadFound { value: t } => t.start + 1
@@ -1056,8 +712,7 @@ fn parse_non_empty_diagnostics_to_list(ned: NonEmptyDiagnostics) -> List<Diagnos
 fn parse_prov_seeded(seed: OccurrenceIdAllocator) -> ParseProvenanceState {
   ParseProvenanceState {
     alloc: seed,
-    index: span_index_empty(),
-    frame: Empty
+    index: span_index_empty()
   }
 }
 
@@ -1065,55 +720,6 @@ fn parse_prov_initial() -> ParseProvenanceState {
   parse_prov_seeded(seed: occurrence_id_allocator_initial())
 }
 
-fn parse_prov_replay_frame(
-  base: v2.std.provenance.SpanIndex,
-  incoming: v2.std.provenance.SpanIndex,
-  frame: List<ParseProvFrameItem>
-) -> v2.std.provenance.SpanIndex {
-  fold_list(
-    xs: frame,
-    empty: base,
-    cons: fn(acc, item) {
-      match item {
-        FrameMinted { id: id } => span_index_adopt(base: acc, incoming: incoming, id: id)
-        FrameNested { frame: inner } => parse_prov_replay_frame(base: acc, incoming: incoming, frame: inner)
-      }
-    }
-  )
-}
-
-// A memo hit: `incoming` is the stored result of the memoized frame, whose `frame` is that
-// frame's own record (the miss started it empty).
-fn parse_prov_merge(
-  base: ParseProvenanceState,
-  incoming: ParseProvenanceState
-) -> ParseProvenanceState {
-  ParseProvenanceState {
-    alloc: occurrence_id_allocator_advance_to(
-      alloc: base.alloc,
-      min_next: authored_token_ordinal_space_from_allocator(
-        alloc: incoming.alloc
-      )
-    ),
-    index: parse_prov_replay_frame(base: base.index, incoming: incoming.index, frame: incoming.frame),
-    frame: list_snoc_item(xs: base.frame, item: FrameNested { frame: incoming.frame })
-  }
-}
-
-// A memo miss: the production parses in a fresh frame so its memo entry records only its own ids.
-fn parse_prov_enter_frame(prov: ParseProvenanceState) -> ParseProvenanceState {
-  ParseProvenanceState { alloc: prov.alloc, index: prov.index, frame: Empty }
-}
-
-// Returning from a miss: the caller's frame gains the inner frame as one nested item.
-fn parse_prov_leave_frame(outer: ParseProvenanceState, inner: ParseProvenanceState) -> ParseProvenanceState {
-  ParseProvenanceState {
-    alloc: inner.alloc,
-    index: inner.index,
-    frame: list_snoc_item(xs: outer.frame, item: FrameNested { frame: inner.frame })
-  }
-}
-
 fn parse_mint_from_source(
   prov: ParseProvenanceState,
   file: Symbol,
@@ -1131,8 +737,7 @@ fn parse_mint_from_source(
     id: minted.id,
     prov: ParseProvenanceState {
       alloc: minted.alloc,
-      index: index,
-      frame: list_snoc_item(xs: prov.frame, item: FrameMinted { id: minted.id })
+      index: index
     }
   }
 }
@@ -1235,8 +840,36 @@ fn parse_stamp_derived_conj(
     ),
     prov: ParseProvenanceState {
       alloc: minted.alloc,
-      index: index,
-      frame: list_snoc_item(xs: prov.frame, item: FrameMinted { id: minted.id })
+      index: index
+    }
+  }
+}
+
+// ONE OPERATOR APPLICATION (v2.std.grammar InfixTable): its left operand, the operator's terminal and
+// its right operand, under one minted id derived from the three.
+fn parse_stamp_infix_application(
+  left: Node,
+  operator: Node,
+  right: Node,
+  prov: ParseProvenanceState
+) -> ParseStampResult {
+  let minted = alloc_occurrence_id(alloc: prov.alloc)
+  let from = parse_minted_id_list(nodes: [left, operator, right])
+  let event = DerivedBy { producer: ^parse_stage_producer, from: from }
+  let index = span_index_record(index: prov.index, id: minted.id, event: event)
+  ParseStampResult {
+    node: node_with_occurrence_id(
+      kind: TypeNode { connective: Conj },
+      children: [
+        grammar_named_edge(name: ^grammar_infix_left_node_projection, target: left),
+        grammar_named_edge(name: ^grammar_infix_operator_node_projection, target: operator),
+        grammar_named_edge(name: ^grammar_infix_right_node_projection, target: right)
+      ],
+      occurrence_id: node_occurrence_identity_minted(id: minted.id)
+    ),
+    prov: ParseProvenanceState {
+      alloc: minted.alloc,
+      index: index
     }
   }
 }
@@ -1256,16 +889,16 @@ fn parse_stamp_derived_repeat(
     ),
     prov: ParseProvenanceState {
       alloc: minted.alloc,
-      index: index,
-      frame: list_snoc_item(xs: prov.frame, item: FrameMinted { id: minted.id })
+      index: index
     }
   }
 }
 
 // THE PARSE TREE'S PROJECTION EDGES, AS A CLOSED ROSTER OWNED BY THEIR PRODUCER. A parse tree
-// carries exactly four Named edges that are parse-projection structure rather than authored
+// carries exactly seven Named edges that are parse-projection structure rather than authored
 // program data: the production identity and captured pair stamped by parse_wrap_production_captured,
-// and the sequence left/right pair stamped by the sequence and list spines. Every later stage that
+// the sequence left/right pair stamped by the sequence and list spines, and the left/operator/right
+// triple of one operator application stamped by parse_stamp_infix_application. Every later stage that
 // must see through projection structure (namespace_graft, name_resolve, symbol_index_fill) asks
 // THIS predicate. It was a lexeme-suffix test on "_node_projection" before, and a suffix is a
 // heuristic (DESIGN section 4): an authored fn or data declaration whose name ends in
@@ -1278,6 +911,9 @@ fn parse_tree_projection_edge(name: Symbol) -> Bool {
     || (name == ^grammar_production_captured_node_projection)
     || (name == ^grammar_sequence_left_node_projection)
     || (name == ^grammar_sequence_right_node_projection)
+    || (name == ^grammar_infix_left_node_projection)
+    || (name == ^grammar_infix_operator_node_projection)
+    || (name == ^grammar_infix_right_node_projection)
 }
 
 fn parse_wrap_production_captured(
@@ -1300,8 +936,7 @@ fn parse_wrap_production_captured(
     ),
     prov: ParseProvenanceState {
       alloc: minted.alloc,
-      index: index,
-      frame: list_snoc_item(xs: prov.frame, item: FrameMinted { id: minted.id })
+      index: index
     }
   }
 }
@@ -1335,9 +970,12 @@ fn parse_tokens_drop(tokens: List<Token>, count: Int) -> List<Token> {
   }
 }
 
-// A MEMO MISS JOINS CALLER FIRST: the caller's furthest record was made before the subparse ran, so
-// it is the left operand of parse_furthest_join -- the order an expectation tie is broken by.
-fn parse_nonterminal_memoized(
+// A NONTERMINAL IS PARSED WHERE IT IS DEMANDED, every time it is demanded. The table and the
+// provenance thread straight through the production's prepared expression: the furthest-failure
+// record is a join (parse_furthest_join is associative), so accumulating it across the subparse is
+// the same value the deleted memo's reset-then-join computed, and the provenance is the surviving
+// path's own -- nothing minted on another path is served here.
+fn parse_nonterminal(
   all_tokens: List<Token>,
   tokens: List<Token>,
   root: GrammarRoot,
@@ -1345,74 +983,32 @@ fn parse_nonterminal_memoized(
   prod_name: Symbol,
   prov: ParseProvenanceState
 ) -> ParseExprResult {
-  let key = ParsePositionKey {
-    position: parse_current_position(tokens: tokens),
-    production: prod_name
-  }
   match grammar_lookup_production_indexed(table: table, name: prod_name) {
     Violates { diagnostic: d } =>
       ParseExprRejected { diagnostics: [d], table: table }
     Holds { value: production } =>
-      let table_at_lookup = parse_table_record_lookup_call(table: table)
-      match parse_table_lookup(table: table_at_lookup, key: key) {
-        Holds { value: inner } =>
-          let table_hit = parse_table_record_hit(table: table_at_lookup)
-          match inner {
-            ParseMemoRejected { diagnostics: diags, furthest: served, refusal: served_refusal } =>
-              ParseExprRejected {
-                diagnostics: diags,
-                table: parse_table_join_refusal(table: parse_table_join_furthest(table: table_hit, furthest: served), refusal: served_refusal)
-              }
-            ParseMemoAccepted { remaining: remaining, captured: captured, diagnostics: diags, prov: inner_prov, furthest: served, refusal: served_refusal } =>
-              let merged_prov = parse_prov_merge(base: prov, incoming: inner_prov)
-              let stamped = parse_wrap_production_captured(
-                production: production,
-                captured: captured,
-                prov: merged_prov
-              )
-              ParseExprAccepted {
-                remaining: remaining,
-                captured: stamped.node,
-                diagnostics: diags,
-                prov: stamped.prov,
-                table: parse_table_join_refusal(table: parse_table_join_furthest(table: table_hit, furthest: served), refusal: served_refusal)
-              }
-          }
-        Violates { diagnostic: _ } =>
-          let table_miss = parse_table_record_miss(table: table_at_lookup)
-          let inner = parse_expr_with_first(
-            expr: parse_table_prepared_expr(table: table_miss, production: production),
-            tokens: tokens,
-            all_tokens: all_tokens,
-            root: root,
-            table: parse_table_with_furthest(table: table_miss, furthest: FurthestNone),
-            prov: parse_prov_enter_frame(prov: prov)
-          )
-          let table_inserted = parse_table_insert(
-            table: parse_expr_result_table(result: inner),
-            key: key,
-            value: parse_memo_entry_from_expr(result: inner)
-          )
-          let table_after_memo = parse_table_with_furthest(
-            table: table_inserted,
-            furthest: parse_furthest_join(left: table_miss.furthest, right: table_inserted.furthest)
+      match parse_expr_with_first(
+        expr: parse_table_prepared_expr(table: table, production: production),
+        tokens: tokens,
+        all_tokens: all_tokens,
+        root: root,
+        table: table,
+        prov: prov
+      ) {
+        ParseExprRejected { diagnostics: diags, table: table1 } =>
+          ParseExprRejected { diagnostics: diags, table: table1 }
+        ParseExprAccepted { remaining: remaining, captured: captured, diagnostics: diags, prov: inner_prov, table: table1 } =>
+          let stamped = parse_wrap_production_captured(
+            production: production,
+            captured: captured,
+            prov: inner_prov
           )
-          match inner {
-            ParseExprRejected { diagnostics: diags, table: _ } =>
-              ParseExprRejected { diagnostics: diags, table: table_after_memo }
-            ParseExprAccepted { remaining: remaining, captured: captured, diagnostics: diags, prov: inner_prov, table: _ } =>
-              let stamped = parse_wrap_production_captured(
-                production: production,
-                captured: captured,
-                prov: parse_prov_leave_frame(outer: prov, inner: inner_prov)
-              )
-              ParseExprAccepted {
-                remaining: remaining,
-                captured: stamped.node,
-                diagnostics: diags,
-                prov: stamped.prov,
-                table: table_after_memo
-              }
+          ParseExprAccepted {
+            remaining: remaining,
+            captured: stamped.node,
+            diagnostics: diags,
+            prov: stamped.prov,
+            table: table1
           }
       }
   }
@@ -1440,7 +1036,8 @@ fn expr_is_nullable_given_set(expr: GrammarExpr, nullable_set: List<Symbol>) ->
       expect: fn(element_nullable, _reason) { element_nullable },
       refuse_on_match: fn(element_nullable, _reason) { element_nullable },
       after_line_break: fn(element_nullable) { element_nullable },
-      not_predicate: fn(_) { true }
+      not_predicate: fn(_) { true },
+      infix_table: fn(operand_nullable, _guard, _operators) { operand_nullable }
     }
   )
 }
@@ -1594,18 +1191,12 @@ type GrammarExprFirstFold {
 // every parse of `.dag` source demands could never store, and every demanding claim recomputed
 // it until its own CPU budget stopped the fill mid-flight. The field is the enumeration it
 // always was; `first_rows` beside it was already enumeration-shaped.
-// THE GRAMMAR DIGEST AND THE PRODUCTION INDEX ARE ONCE-PER-GRAMMAR FACTS AND LIVE HERE, beside
-// the FIRST analysis they were already computed next to. Until this carrier held them,
-// parse_table_for_production_analyzed re-derived both on EVERY parse call -- a content hash of
-// the whole grammar node tree (grammar_to_node over the 200-production dag grammar, then
-// content_hash) plus an O(P) map build -- for a value that prepare_grammar had fixed before the
-// first token was read. The required floor's own cross-claim demand census (main run
-// 34556223550, required_floor_cross_claim_demand.tsv) named it: parse_grammar_digest at
-// claims=19 evals=19, ~128ms per claim on the lane's runner, every one of them a claim that
-// parses `.dag` text against the warm-shared dag_prepared_grammar -- so the preparation was
-// shared and the invariant derived FROM it was not, which is the DESIGN §6 per-call rebuild
-// #10992's write-up flagged. prepared_exprs is the precedent: a per-grammar derivation carried
-// once and read per parse. Nothing about the digest's value changes; only where it is paid.
+// THE PRODUCTION INDEX IS A ONCE-PER-GRAMMAR FACT AND LIVES HERE, beside the FIRST analysis it was
+// already computed next to. Before this carrier held it, parse_table_for_production_analyzed
+// re-derived it (and the grammar digest the deleted parse memo keyed on) on EVERY parse call --
+// an O(P) map build for a value prepare_grammar had fixed before the first token was read; the
+// required floor's cross-claim demand census (main run 34556223550) named the per-call rebuild.
+// prepared_exprs is the precedent: a per-grammar derivation carried once and read per parse.
 // The same per-parse rebuild had a second site: parse_production_prepared derived the grammar's
 // own locus eagerly (node_locus over grammar_to_node of the whole grammar) although only the
 // rejection arm that carried no diagnostic of its own ever read it; it is now derived on that
@@ -1614,10 +1205,8 @@ type GrammarFirstAnalysis {
   nullable_set: List<Symbol>
   first_rows: Map<Symbol, List<FirstKey>>
   prepared_exprs: Map<Symbol, PreparedGrammarExpr>
-  grammar_digest: Hash
   productions_by_name: Map<Symbol, GrammarProduction>
   choice_residue: List<GrammarChoiceAmbiguityRow>
-  memo_recurrence: ParseMemoRecurrence
 }
 
 fn grammar_empty_terminal_list() -> List<FirstKey> {
@@ -1651,7 +1240,7 @@ fn first_list_intersect(left: List<FirstKey>, right: List<FirstKey>) -> List<Fir
 }
 
 fn production_first_row_lookup(rows: Map<Symbol, List<FirstKey>>, name: Symbol) -> List<FirstKey> {
-  match v2.std.collection.map_get(m: rows, key: name) {
+  match v2.std.collection.map_get_checked(m: rows, key: name) {
     Accepted { value: Present { value: terminals }, diagnostics: _ } => terminals
     Accepted { value: Absent, diagnostics: _ } => grammar_empty_terminal_list()
     Rejected { diagnostics: _ } => grammar_empty_terminal_list()
@@ -1734,11 +1323,27 @@ fn expr_first_fold(
       expect: fn(element, _reason) { element },
       refuse_on_match: fn(element, _reason) { element },
       after_line_break: fn(element) { element },
-      not_predicate: fn(_element) { expr_first_fold_predicate() }
+      not_predicate: fn(_element) { expr_first_fold_predicate() },
+      infix_table: fn(operand, _guard, operators) { expr_first_fold_infix(operand: operand, operators: operators) }
     }
   )
 }
 
+// A table is its operand followed by any number of `guard operator operand` continuations; the guard
+// is a predicate, so a continuation begins with one of the rows' operator classes.
+fn expr_first_fold_infix(operand: GrammarExprFirstFold, operators: List<InfixOperatorRow>) -> GrammarExprFirstFold {
+  expr_first_fold_sequence(
+    left: operand,
+    right: expr_first_fold_repeat(
+      element: fold_list(
+        xs: operators,
+        empty: GrammarExprFirstFold { terminals: grammar_empty_terminal_list(), nullable: false },
+        cons: fn(acc, row) { expr_first_fold_choice(left: acc, right: expr_first_fold_terminal(token_class: grammar_infix_row_class(row: row))) }
+      )
+    )
+  )
+}
+
 fn compute_production_first_row_terminals(
   rows: Map<Symbol, List<FirstKey>>,
   p: GrammarProduction,
@@ -1872,6 +1477,12 @@ type PreparedGrammarExpr
   | PreparedRefuseOnMatch { element: PreparedGrammarExpr, reason: ParseRefusalReason }
   | PreparedAfterLineBreak { element: PreparedGrammarExpr }
   | PreparedNotPredicate { element: PreparedGrammarExpr, first: GrammarExprFirstFold }
+  | PreparedInfixTable {
+      operand: PreparedGrammarExpr
+      continuation_guard: PreparedGrammarExpr
+      operators: Map<Symbol, InfixOperatorRow>
+      first: GrammarExprFirstFold
+    }
 
 type PreparedExprFold {
   tree: PreparedGrammarExpr
@@ -1918,6 +1529,7 @@ fn flatten_choice_exprs(expr: GrammarExpr) -> List<GrammarExpr> {
     RefuseOnMatch { element: _, reason: _ } => Cons { head: expr, tail: std.algebra.Empty }
     AfterLineBreak { element: _ } => Cons { head: expr, tail: std.algebra.Empty }
     NotPredicate { element: _ } => Cons { head: expr, tail: std.algebra.Empty }
+    InfixTable { operand: _, continuation_guard: _, operators: _ } => Cons { head: expr, tail: std.algebra.Empty }
   }
 }
 
@@ -1960,6 +1572,7 @@ fn prepared_prefix_atom_eq(left: PreparedGrammarExpr, right: PreparedGrammarExpr
         PreparedRefuseOnMatch { element: _, reason: _ } => false
         PreparedAfterLineBreak { element: _ } => false
         PreparedNotPredicate { element: _, first: _ } => false
+        PreparedInfixTable { operand: _, continuation_guard: _, operators: _, first: _ } => false
       }
     PreparedLiteralTerminal { token_class: lc, lexeme: lw } =>
       match right {
@@ -1977,6 +1590,7 @@ fn prepared_prefix_atom_eq(left: PreparedGrammarExpr, right: PreparedGrammarExpr
         PreparedRefuseOnMatch { element: _, reason: _ } => false
         PreparedAfterLineBreak { element: _ } => false
         PreparedNotPredicate { element: _, first: _ } => false
+        PreparedInfixTable { operand: _, continuation_guard: _, operators: _, first: _ } => false
       }
     PreparedNonterminal { production: lp } =>
       match right {
@@ -1991,6 +1605,7 @@ fn prepared_prefix_atom_eq(left: PreparedGrammarExpr, right: PreparedGrammarExpr
         PreparedRefuseOnMatch { element: _, reason: _ } => false
         PreparedAfterLineBreak { element: _ } => false
         PreparedNotPredicate { element: _, first: _ } => false
+        PreparedInfixTable { operand: _, continuation_guard: _, operators: _, first: _ } => false
       }
     PreparedSequence { left: _, right: _ } => false
     PreparedChoice { plan: _, first: _ } => false
@@ -2000,6 +1615,7 @@ fn prepared_prefix_atom_eq(left: PreparedGrammarExpr, right: PreparedGrammarExpr
     PreparedRefuseOnMatch { element: _, reason: _ } => false
     PreparedAfterLineBreak { element: _ } => false
     PreparedNotPredicate { element: _, first: _ } => false
+    PreparedInfixTable { operand: _, continuation_guard: _, operators: _, first: _ } => false
   }
 }
 
@@ -2018,6 +1634,7 @@ fn prepared_sequence_left_atom(expr: PreparedGrammarExpr) -> Optional<PreparedGr
         PreparedRefuseOnMatch { element: _, reason: _ } => optional_absent()
         PreparedAfterLineBreak { element: _ } => optional_absent()
         PreparedNotPredicate { element: _, first: _ } => optional_absent()
+        PreparedInfixTable { operand: _, continuation_guard: _, operators: _, first: _ } => optional_absent()
       }
     PreparedTerminal { token_class: _, stamp: _ } => optional_absent()
     PreparedLiteralTerminal { token_class: _, lexeme: _ } => optional_absent()
@@ -2029,6 +1646,7 @@ fn prepared_sequence_left_atom(expr: PreparedGrammarExpr) -> Optional<PreparedGr
     PreparedRefuseOnMatch { element: _, reason: _ } => optional_absent()
     PreparedAfterLineBreak { element: _ } => optional_absent()
     PreparedNotPredicate { element: _, first: _ } => optional_absent()
+    PreparedInfixTable { operand: _, continuation_guard: _, operators: _, first: _ } => optional_absent()
   }
 }
 
@@ -2161,6 +1779,7 @@ fn prepared_terminal_prefix(expr: PreparedGrammarExpr, need: Int) -> Optional<Li
           PreparedRefuseOnMatch { element: _, reason: _ } => optional_absent()
           PreparedAfterLineBreak { element: _ } => optional_absent()
           PreparedNotPredicate { element: _, first: _ } => optional_absent()
+          PreparedInfixTable { operand: _, continuation_guard: _, operators: _, first: _ } => optional_absent()
         }
       PreparedNonterminal { production: _ } => optional_absent()
       PreparedChoice { plan: _, first: _ } => optional_absent()
@@ -2170,6 +1789,7 @@ fn prepared_terminal_prefix(expr: PreparedGrammarExpr, need: Int) -> Optional<Li
       PreparedRefuseOnMatch { element: _, reason: _ } => optional_absent()
       PreparedAfterLineBreak { element: _ } => optional_absent()
       PreparedNotPredicate { element: _, first: _ } => optional_absent()
+      PreparedInfixTable { operand: _, continuation_guard: _, operators: _, first: _ } => optional_absent()
     }
   }
 }
@@ -2292,6 +1912,7 @@ fn choice_shared_prefix_suffixes_from(
         PreparedRefuseOnMatch { element: _, reason: _ } => optional_absent()
         PreparedAfterLineBreak { element: _ } => optional_absent()
         PreparedNotPredicate { element: _, first: _ } => optional_absent()
+        PreparedInfixTable { operand: _, continuation_guard: _, operators: _, first: _ } => optional_absent()
       }
   }
 }
@@ -2329,6 +1950,7 @@ fn expr_first_fold_from_prepared(
     PreparedAfterLineBreak { element: element } =>
       expr_first_fold_from_prepared(expr: element, nullable_set: nullable_set, first_rows: first_rows)
     PreparedNotPredicate { element: _, first: _ } => expr_first_fold_predicate()
+    PreparedInfixTable { operand: _, continuation_guard: _, operators: _, first: first } => first
   }
 }
 
@@ -2517,6 +2139,14 @@ fn lookahead_prefixes(
     AfterLineBreak { element: element } =>
       lookahead_prefixes(expr: element, depth: depth, head_keys: head_keys, visiting: visiting, ctx: ctx)
     NotPredicate { element: _ } => lookahead_empty_only()
+    InfixTable { operand: operand, continuation_guard: guard, operators: operators } =>
+      lookahead_prefixes(
+        expr: grammar_infix_table_language(operand: operand, continuation_guard: guard, operators: operators),
+        depth: depth,
+        head_keys: head_keys,
+        visiting: visiting,
+        ctx: ctx
+      )
   }
 }
 
@@ -2583,6 +2213,7 @@ fn lookahead_leading_guard(expr: GrammarExpr) -> Optional<GrammarExpr> {
     Expect { element: _, reason: _ } => Absent
     RefuseOnMatch { element: _, reason: _ } => Absent
     AfterLineBreak { element: _ } => Absent
+    InfixTable { operand: _, continuation_guard: _, operators: _ } => Absent
   }
 }
 
@@ -2795,6 +2426,7 @@ fn lookahead_guard_strings(expr: GrammarExpr, visiting: List<Symbol>, ctx: Looka
     RefuseOnMatch { element: _, reason: _ } => Absent
     AfterLineBreak { element: _ } => Absent
     NotPredicate { element: _ } => Absent
+    InfixTable { operand: _, continuation_guard: _, operators: _ } => Absent
   }
 }
 
@@ -2830,6 +2462,7 @@ fn lookahead_guard_token_set(expr: GrammarExpr, visiting: List<Symbol>, ctx: Loo
     RefuseOnMatch { element: _, reason: _ } => Absent
     AfterLineBreak { element: _ } => Absent
     NotPredicate { element: _ } => Absent
+    InfixTable { operand: _, continuation_guard: _, operators: _ } => Absent
   }
 }
 
@@ -3090,6 +2723,7 @@ fn lookahead_leading_guard_length(expr: GrammarExpr, ctx: LookaheadContext) -> I
     RefuseOnMatch { element: _, reason: _ } => 0
     AfterLineBreak { element: _ } => 0
     NotPredicate { element: _ } => 0
+    InfixTable { operand: _, continuation_guard: _, operators: _ } => 0
   }
 }
 
@@ -3435,6 +3069,8 @@ fn compile_choice_plan(
   }
 }
 
+// An operator table's rows become an index keyed by token class, so selecting the operator at a
+// continuation is one lookup; no Choice is prepared and no choice-site residue can arise.
 fn prepare_grammar_expr(
   expr: GrammarExpr,
   nullable_set: List<Symbol>,
@@ -3547,6 +3183,24 @@ fn prepare_grammar_expr(
         first: expr_first_fold_predicate(),
         residue: element_prepared.residue
       }
+    InfixTable { operand: operand, continuation_guard: guard, operators: operators } =>
+      let operand_prepared = prepare_grammar_expr(expr: operand, nullable_set: nullable_set, first_rows: first_rows, productions: productions, production: production, token_dispatch: token_dispatch)
+      let guard_prepared = prepare_grammar_expr(expr: guard, nullable_set: nullable_set, first_rows: first_rows, productions: productions, production: production, token_dispatch: token_dispatch)
+      let first = expr_first_fold_infix(operand: operand_prepared.first, operators: operators)
+      PreparedExprFold {
+        tree: PreparedInfixTable {
+          operand: operand_prepared.tree,
+          continuation_guard: guard_prepared.tree,
+          operators: fold_list(
+            xs: operators,
+            empty: empty_map(),
+            cons: fn(acc, row) { map_insert(m: acc, key: grammar_infix_row_class(row: row), value: row) }
+          ),
+          first: first
+        },
+        first: first,
+        residue: list_append(left: operand_prepared.residue, right: guard_prepared.residue)
+      }
   }
 }
 
@@ -3565,7 +3219,7 @@ fn parse_table_token_dispatch(table: ParseTable, production: Symbol) -> Bool {
 // When the key is absent the Choice plan is ordered backtrack, the pre-cutover
 // interpreter. Analyzed tables always resolve Present here.
 fn parse_table_prepared_expr(table: ParseTable, production: GrammarProduction) -> PreparedGrammarExpr {
-  match v2.std.collection.map_get(m: table.prepared_exprs, key: production.name) {
+  match v2.std.collection.map_get_checked(m: table.prepared_exprs, key: production.name) {
     Accepted { value: Present { value: prepared }, diagnostics: _ } => prepared
     Accepted { value: Absent, diagnostics: _ } =>
       prepare_grammar_expr(
@@ -3621,84 +3275,8 @@ fn compute_grammar_first_analysis_given(
     nullable_set: nullable_set,
     first_rows: first_rows,
     prepared_exprs: prep.prepared_exprs,
-    grammar_digest: parse_grammar_digest(validated: ValidatedGrammarRoot { root: root }),
     productions_by_name: productions,
-    choice_residue: prep.residue,
-    memo_recurrence: parse_memo_recurrence_census(root: root, nullable_set: nullable_set)
-  }
-}
-
-// THE PARSE MEMO'S DEMAND CASE, READ OFF THE GRAMMAR ONCE PER PREPARATION. The meaning of both
-// counts, and why they are the whole of within-parse recurrence, is stated on
-// v2.compiler.materialization_carriers ParseMemoRecurrence. This fold only reads the structure:
-// a site is DISCARDING when the branch it may abandon -- a Choice's left, an Optional's or a
-// Repeat's element -- demands a nonterminal, since only an abandoned nonterminal demand can be
-// asked again at the position the parse resumes from.
-type ParseDemandFold {
-  demands_nonterminal: Bool
-  discarding_sites: Int
-}
-
-fn parse_demand_fold_site(attempted: ParseDemandFold) -> Int {
-  if attempted.demands_nonterminal { 1 } else { 0 }
-}
-
-fn parse_demand_fold_leaf() -> ParseDemandFold {
-  ParseDemandFold { demands_nonterminal: false, discarding_sites: 0 }
-}
-
-fn expr_parse_demand_fold(expr: GrammarExpr) -> ParseDemandFold {
-  fold_grammar_expr(
-    expr: expr,
-    algebra: GrammarExprFold {
-      terminal: fn(_, _) { parse_demand_fold_leaf() },
-      literal_terminal: fn(_, _) { parse_demand_fold_leaf() },
-      nonterminal: fn(_) { ParseDemandFold { demands_nonterminal: true, discarding_sites: 0 } },
-      sequence: fn(l, r) {
-        ParseDemandFold {
-          demands_nonterminal: l.demands_nonterminal || r.demands_nonterminal,
-          discarding_sites: l.discarding_sites + r.discarding_sites
-        }
-      },
-      choice: fn(l, r) {
-        ParseDemandFold {
-          demands_nonterminal: l.demands_nonterminal || r.demands_nonterminal,
-          discarding_sites: l.discarding_sites + r.discarding_sites + parse_demand_fold_site(attempted: l)
-        }
-      },
-      optional: fn(e) {
-        ParseDemandFold {
-          demands_nonterminal: e.demands_nonterminal,
-          discarding_sites: e.discarding_sites + parse_demand_fold_site(attempted: e)
-        }
-      },
-      repeat: fn(e) {
-        ParseDemandFold {
-          demands_nonterminal: e.demands_nonterminal,
-          discarding_sites: e.discarding_sites + parse_demand_fold_site(attempted: e)
-        }
-      },
-      expect: fn(e, _reason) { e },
-      refuse_on_match: fn(e, _reason) { e },
-      after_line_break: fn(e) { e },
-      not_predicate: fn(e) {
-        ParseDemandFold {
-          demands_nonterminal: e.demands_nonterminal,
-          discarding_sites: e.discarding_sites + parse_demand_fold_site(attempted: e)
-        }
-      }
-    }
-  )
-}
-
-fn parse_memo_recurrence_census(root: GrammarRoot, nullable_set: List<Symbol>) -> ParseMemoRecurrence {
-  ParseMemoRecurrence {
-    discarding_backtrack_sites: fold_list(
-      xs: root.productions,
-      empty: 0,
-      cons: fn(acc, p) { acc + expr_parse_demand_fold(expr: p.expression).discarding_sites }
-    ),
-    nullable_nonterminals: length(xs: nullable_set)
+    choice_residue: prep.residue
   }
 }
 
@@ -3728,52 +3306,31 @@ fn grammar_choice_ambiguity_count(root: GrammarRoot) -> Int {
   length(xs: grammar_choice_ambiguity_roster(root: root))
 }
 
-fn parse_grammar_choice_ambiguity_diagnostic(at: Locus, count: Int) -> Diagnostic {
+// A grammar choice whose alternatives overlap is refused AT THE PRODUCTION that owns the choice.
+// There is no accepting arm: an ordered choice resolved by authoring order is a reading the grammar
+// does not declare, so a grammar carrying one is not a grammar the parser may run.
+fn parse_grammar_choice_ambiguity_row_diagnostic(row: GrammarChoiceAmbiguityRow) -> Diagnostic {
   Diagnostic {
     reason: ^parse_grammar_choice_ambiguity,
-    at: port_refusal_locus(at: at, port: ^parse_stage_locus_port, invariant: ^parse_grammar_choice_ambiguity),
-    correction: match count > 0 {
-      true => Unavailable { reason: ExternalContractUnknown }
-      false => Unavailable { reason: UserInputBoundary }
-    }
+    at: declaration_locus(declaration: Cons { head: row.production, tail: std.algebra.Empty }),
+    correction: Unavailable { reason: ExternalContractUnknown }
   }
 }
 
-fn parse_grammar_choice_ambiguity_row_diagnostic(at: Locus, row: GrammarChoiceAmbiguityRow) -> Diagnostic {
-  let overlap_count = length(xs: row.overlap_terminals)
-  parse_grammar_choice_ambiguity_diagnostic(
-    at: at,
-    count: if row.both_nullable && overlap_count == 0 { 1 } else { overlap_count }
-  )
-}
-
-fn grammar_choice_ambiguity_row_diagnostic_list(
-  at: Locus,
-  roster: List<GrammarChoiceAmbiguityRow>
-) -> List<Diagnostic> {
-  fold_list(
-    xs: roster,
-    empty: std.algebra.Empty,
-    cons: fn(acc, row) {
-      list_snoc_item(
-        xs: acc,
-        item: parse_grammar_choice_ambiguity_row_diagnostic(at: at, row: row)
-      )
-    }
-  )
-}
-
 fn grammar_choice_ambiguity_rejection_diagnostics(
-  at: Locus,
-  roster: List<GrammarChoiceAmbiguityRow>
+  first: GrammarChoiceAmbiguityRow,
+  rest: List<GrammarChoiceAmbiguityRow>
 ) -> NonEmptyDiagnostics {
-  parse_diags_to_non_empty(
-    diags: grammar_choice_ambiguity_row_diagnostic_list(at: at, roster: roster),
-    default: parse_grammar_choice_ambiguity_diagnostic(
-      at: at,
-      count: length(xs: roster)
+  NonEmptyDiagnostics {
+    head: parse_grammar_choice_ambiguity_row_diagnostic(row: first),
+    tail: fold_list(
+      xs: rest,
+      empty: std.algebra.Empty,
+      cons: fn(acc, row) {
+        list_snoc_item(xs: acc, item: parse_grammar_choice_ambiguity_row_diagnostic(row: row))
+      }
     )
-  )
+  }
 }
 
 fn grammar_empty_corner_list() -> List<Symbol> {
@@ -3841,7 +3398,8 @@ fn expr_corner_nullable_fold(expr: GrammarExpr, nullable_set: List<Symbol>) -> G
       expect: fn(element, _reason) { element },
       refuse_on_match: fn(element, _reason) { element },
       after_line_break: fn(element) { element },
-      not_predicate: expr_corner_fold_optional
+      not_predicate: expr_corner_fold_optional,
+      infix_table: fn(operand, _guard, _operators) { operand }
     }
   )
 }
@@ -3892,7 +3450,7 @@ fn left_corner_direct_rows(root: GrammarRoot, nullable_set: List<Symbol>) -> Map
 }
 
 fn left_corner_row(rows: Map<Symbol, List<Symbol>>, name: Symbol) -> List<Symbol> {
-  match v2.std.collection.map_get(m: rows, key: name) {
+  match v2.std.collection.map_get_checked(m: rows, key: name) {
     Accepted { value: Present { value: reached }, diagnostics: _ } => reached
     Accepted { value: Absent, diagnostics: _ } => std.algebra.Empty
     Rejected { diagnostics: _ } => std.algebra.Empty
@@ -4008,7 +3566,8 @@ fn expr_has_undefined_nonterminal(expr: GrammarExpr, root: GrammarRoot) -> Bool
       expect: fn(element_undef, _reason) { element_undef },
       refuse_on_match: fn(element_undef, _reason) { element_undef },
       after_line_break: fn(element_undef) { element_undef },
-      not_predicate: fn(element_undef) { element_undef }
+      not_predicate: fn(element_undef) { element_undef },
+      infix_table: fn(operand_undef, guard_undef, _operators) { operand_undef || guard_undef }
     }
   )
 }
@@ -4024,6 +3583,37 @@ fn grammar_has_undefined_nonterminals(root: GrammarRoot) -> Bool {
   }
 }
 
+// AN OPERATOR TABLE NAMES EACH TOKEN CLASS ONCE (v2.std.grammar InfixTable). Its rows are an index
+// keyed by class, so a class named twice would be two answers for one lookup -- the overlap an
+// ordered choice would carry, here refused where the grammar is validated rather than resolved by
+// row order. With every class distinct the rows are disjoint by construction, and the table holds no
+// Choice for the overlap roster to inspect.
+fn grammar_infix_tables_well_formed(expr: GrammarExpr) -> Bool {
+  fold_grammar_expr(
+    expr: expr,
+    algebra: GrammarExprFold {
+      terminal: fn(_, _) { true },
+      literal_terminal: fn(_, _) { true },
+      nonterminal: fn(_) { true },
+      sequence: fn(l, r) { l && r },
+      choice: fn(l, r) { l && r },
+      optional: fn(e) { e },
+      repeat: fn(e) { e },
+      expect: fn(e, _reason) { e },
+      refuse_on_match: fn(e, _reason) { e },
+      after_line_break: fn(e) { e },
+      not_predicate: fn(e) { e },
+      infix_table: fn(operand, guard, operators) {
+        operand && guard && unique(xs: operators, eq: fn(a, b) { grammar_infix_row_class(row: a) == grammar_infix_row_class(row: b) })
+      }
+    }
+  )
+}
+
+fn grammar_has_malformed_infix_table(root: GrammarRoot) -> Bool {
+  fold_list(xs: root.productions, empty: false, cons: fn(acc, p) { acc || !grammar_infix_tables_well_formed(expr: p.expression) })
+}
+
 fn grammar_has_duplicate_productions(root: GrammarRoot) -> Bool {
   match unique(xs: root.productions, eq: fn(a, b) { a.name == b.name }) {
     true => false
@@ -4055,40 +3645,6 @@ fn parse_diags_to_non_empty(diags: List<Diagnostic>, default: Diagnostic) -> Non
   }
 }
 
-fn grammar_nullable_ambiguity_rows(roster: List<GrammarChoiceAmbiguityRow>) -> List<GrammarChoiceAmbiguityRow> {
-  filter(xs: roster, predicate: fn(row) { row.both_nullable })
-}
-
-fn parse_grammar_choice_overlap_residue_diagnostic(at: Locus, row: GrammarChoiceAmbiguityRow) -> Diagnostic {
-  parse_stage_diagnostic_core(
-    d: parse_overlap_residue_stage_diagnostic_at(at: at, row: row)
-  )
-}
-
-fn diagnostics_from_diagnostic_list(items: List<Diagnostic>) -> Diagnostics {
-  match list_at_optional(xs: items, index: 0) {
-    Absent => None
-    Present { value: first } =>
-      match list_tail(xs: items) {
-        TailAbsent => Some { diagnostics: NonEmptyDiagnostics { head: first, tail: std.algebra.Empty } }
-        TailFound { tail: rest } =>
-          Some { diagnostics: NonEmptyDiagnostics { head: first, tail: rest } }
-      }
-  }
-}
-
-fn grammar_overlap_residue_diagnostics(at: Locus, roster: List<GrammarChoiceAmbiguityRow>) -> Diagnostics {
-  diagnostics_from_diagnostic_list(
-    items: fold_list(
-      xs: roster,
-      empty: std.algebra.Empty,
-      cons: fn(acc, row) {
-        list_snoc_item(xs: acc, item: parse_grammar_choice_overlap_residue_diagnostic(at: at, row: row))
-      }
-    )
-  )
-}
-
 // ONE nullable fixpoint for the whole preparation. The left-recursion check and the FIRST analysis
 // both need the nullable set, and computing it here rather than inside each of them is the
 // difference between one fixpoint per preparation and three.
@@ -4098,30 +3654,25 @@ fn grammar_validate_and_analyze(root: GrammarRoot, at: Locus) -> Outcome<Prepare
   } else {
     if grammar_has_duplicate_productions(root: root) {
       Rejected { diagnostics: diagnostics_singleton(d: parse_grammar_duplicate_production_diagnostic(at: at)) }
+    } else if grammar_has_malformed_infix_table(root: root) {
+      Rejected { diagnostics: diagnostics_singleton(d: parse_grammar_infix_operator_duplicate_diagnostic(at: at)) }
     } else {
       let nullable_set = compute_nullable_set(root: root)
       if grammar_has_left_recursion_given(root: root, nullable_set: nullable_set) {
         Rejected { diagnostics: diagnostics_singleton(d: parse_grammar_left_recursive_diagnostic(at: at)) }
       } else {
         let analysis = compute_grammar_first_analysis_given(root: root, nullable_set: nullable_set)
-        let ambiguity_roster = grammar_choice_ambiguity_roster_from_analysis(root: root, analysis: analysis)
-        let nullable_rows = grammar_nullable_ambiguity_rows(roster: ambiguity_roster)
-        if !is_empty(xs: nullable_rows) {
-          Rejected {
-            diagnostics: grammar_choice_ambiguity_rejection_diagnostics(at: at, roster: nullable_rows)
-          }
-        } else {
-          Accepted {
-            value: PreparedModeledGrammar {
-              validated: ValidatedGrammarRoot { root: root },
-              analysis: analysis,
-              overlap_residue_stage: non_empty_parse_stage_diagnostics_from_overlap_roster(
-                at: at,
-                roster: ambiguity_roster
-              )
-            },
-            diagnostics: grammar_overlap_residue_diagnostics(at: at, roster: ambiguity_roster)
-          }
+        match grammar_choice_ambiguity_roster_from_analysis(root: root, analysis: analysis) {
+          Cons { head: first, tail: rest } =>
+            Rejected { diagnostics: grammar_choice_ambiguity_rejection_diagnostics(first: first, rest: rest) }
+          Empty =>
+            Accepted {
+              value: PreparedModeledGrammar {
+                validated: ValidatedGrammarRoot { root: root },
+                analysis: analysis
+              },
+              diagnostics: None
+            }
         }
       }
     }
@@ -4131,8 +3682,8 @@ fn grammar_validate_and_analyze(root: GrammarRoot, at: Locus) -> Outcome<Prepare
 fn grammar_validate_for_parse(root: GrammarRoot, at: Locus) -> Outcome<ValidatedGrammarRoot> {
   match grammar_validate_and_analyze(root: root, at: at) {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: modeled, diagnostics: residue } =>
-      Accepted { value: modeled.validated, diagnostics: residue }
+    Accepted { value: modeled, diagnostics: _ } =>
+      Accepted { value: modeled.validated, diagnostics: None }
   }
 }
 
@@ -4605,10 +4156,9 @@ fn parse_expr_optional(
   }
 }
 
-// PROGRESS IS READ OFF THE MEMO KEY'S POSITION, not off two list lengths. `rest` is a suffix of
+// PROGRESS IS READ OFF THE STREAM POSITION, not off two list lengths. `rest` is a suffix of
 // `acc.remaining`, so the element consumed a token exactly when the position changed, and
-// parse_current_position is already the authority that identifies a stream position (it keys the
-// memo, ParsePositionKey). Comparing lengths walked both lists on every accepted iteration -- O(n)
+// parse_current_position is the authority that identifies a stream position. Comparing lengths walked both lists on every accepted iteration -- O(n)
 // per iteration, O(n^2) over a long repeat -- to answer a question the head token answers. A
 // position identifies one token because the parse admits only strictly increasing starts
 // (parse_token_start_order_violation).
@@ -4751,8 +4301,8 @@ fn parse_expr_refuse_on_match(
 // attempted at this position; where it fails the predicate accepts with the input, provenance and
 // capture it was given (the empty capture), and where it matches the predicate rejects. Either way
 // the attempt was speculative, so the furthest-failure record is returned to what it was before the
-// attempt: a probe reaching past this position is not the place the parse stopped. The memo the
-// attempt filled is kept, and a refusal it raised is kept, since a refusal stops the parse.
+// attempt: a probe reaching past this position is not the place the parse stopped. A refusal it
+// raised is kept, since a refusal stops the parse.
 fn parse_expr_not_predicate(
   element: PreparedGrammarExpr,
   first: GrammarExprFirstFold,
@@ -4929,7 +4479,7 @@ fn parse_expr_dispatch(
           }
       }
     PreparedNonterminal { production: prod_name } =>
-      parse_nonterminal_memoized(
+      parse_nonterminal(
         all_tokens: all_tokens,
         tokens: tokens,
         root: root,
@@ -5013,6 +4563,171 @@ fn parse_expr_dispatch(
         table: table,
         prov: prov
       )
+    PreparedInfixTable { operand: operand, continuation_guard: guard, operators: operators, first: _ } =>
+      parse_expr_infix_climb(
+        table_expr: PreparedInfixClimb { operand: operand, continuation_guard: guard, operators: operators },
+        min_power: 0,
+        tokens: tokens,
+        all_tokens: all_tokens,
+        root: root,
+        table: table,
+        prov: prov
+      )
+  }
+}
+
+// PRECEDENCE CLIMBING (v2.std.grammar InfixTable). One operand is parsed; then, at each continuation,
+// the guard runs, the next token's class is LOOKED UP among the rows, and an operator whose binding
+// power reaches `min_power` is consumed and its right operand climbed at the power the row's
+// associativity demands. An operand with no operator after it returns as itself: nothing is attempted
+// or stamped for the precedence levels it does not use. Where an operator was consumed and its right
+// operand fails, the continuation is abandoned BEFORE the operator, with the input, capture and
+// provenance it had, exactly as a Repeat abandons an element that fails.
+type PreparedInfixClimb {
+  operand: PreparedGrammarExpr
+  continuation_guard: PreparedGrammarExpr
+  operators: Map<Symbol, InfixOperatorRow>
+}
+
+fn parse_expr_infix_climb(
+  table_expr: PreparedInfixClimb,
+  min_power: Int,
+  tokens: List<Token>,
+  all_tokens: List<Token>,
+  root: GrammarRoot,
+  table: ParseTable,
+  prov: ParseProvenanceState
+) -> ParseExprResult {
+  match parse_expr_with_first(expr: table_expr.operand, tokens: tokens, all_tokens: all_tokens, root: root, table: table, prov: prov) {
+    ParseExprRejected { diagnostics: diags, table: table1 } => ParseExprRejected { diagnostics: diags, table: table1 }
+    ParseExprAccepted { remaining: rest, captured: lhs, diagnostics: diags, prov: prov1, table: table1 } =>
+      parse_expr_infix_continue(
+        table_expr: table_expr,
+        min_power: min_power,
+        chained_power: optional_absent(),
+        lhs: lhs,
+        diagnostics: diags,
+        tokens: rest,
+        all_tokens: all_tokens,
+        root: root,
+        table: table1,
+        prov: prov1
+      )
+  }
+}
+
+// `chained_power` is the binding power of a NON-ASSOCIATIVE operator just applied at this level: a
+// second operator of that power refuses with NonAssociativeOperatorChain at the second operator.
+fn parse_expr_infix_continue(
+  table_expr: PreparedInfixClimb,
+  min_power: Int,
+  chained_power: Optional<Int>,
+  lhs: Node,
+  diagnostics: List<Diagnostic>,
+  tokens: List<Token>,
+  all_tokens: List<Token>,
+  root: GrammarRoot,
+  table: ParseTable,
+  prov: ParseProvenanceState
+) -> ParseExprResult {
+  match parse_expr_with_first(expr: table_expr.continuation_guard, tokens: tokens, all_tokens: all_tokens, root: root, table: table, prov: prov) {
+    ParseExprRejected { diagnostics: _, table: guarded } =>
+      ParseExprAccepted { remaining: tokens, captured: lhs, diagnostics: diagnostics, prov: prov, table: guarded }
+    ParseExprAccepted { remaining: _, captured: _, diagnostics: _, prov: _, table: guarded } =>
+      match parse_infix_row_at(operators: table_expr.operators, tokens: tokens) {
+        Absent => ParseExprAccepted { remaining: tokens, captured: lhs, diagnostics: diagnostics, prov: prov, table: guarded }
+        Present { value: row } =>
+          if grammar_infix_row_binding_power(row: row) < min_power {
+            ParseExprAccepted { remaining: tokens, captured: lhs, diagnostics: diagnostics, prov: prov, table: guarded }
+          } else if parse_infix_chains(chained_power: chained_power, row: row) {
+            ParseExprRejected {
+              diagnostics: [],
+              table: parse_table_join_refusal(
+                table: guarded,
+                refusal: optional_present(value: parse_refusal_at(reason: NonAssociativeOperatorChain, tokens: tokens, all_tokens: all_tokens))
+              )
+            }
+          } else {
+            parse_expr_infix_apply(
+              table_expr: table_expr,
+              min_power: min_power,
+              row: row,
+              lhs: lhs,
+              diagnostics: diagnostics,
+              tokens: tokens,
+              all_tokens: all_tokens,
+              root: root,
+              table: guarded,
+              prov: prov
+            )
+          }
+      }
+  }
+}
+
+fn parse_infix_row_at(operators: Map<Symbol, InfixOperatorRow>, tokens: List<Token>) -> Optional<InfixOperatorRow> {
+  match parse_token_first(tokens: tokens) {
+    Absent => optional_absent()
+    Present { value: tok } => map_lookup(m: operators, key: tok.class)
+  }
+}
+
+fn parse_infix_chains(chained_power: Optional<Int>, row: InfixOperatorRow) -> Bool {
+  match chained_power {
+    Absent => false
+    Present { value: power } => power == grammar_infix_row_binding_power(row: row)
+  }
+}
+
+fn parse_infix_chained_after(row: InfixOperatorRow) -> Optional<Int> {
+  match row.associativity {
+    InfixLeft => optional_absent()
+    InfixNonAssociative => optional_present(value: grammar_infix_row_binding_power(row: row))
+  }
+}
+
+fn parse_expr_infix_apply(
+  table_expr: PreparedInfixClimb,
+  min_power: Int,
+  row: InfixOperatorRow,
+  lhs: Node,
+  diagnostics: List<Diagnostic>,
+  tokens: List<Token>,
+  all_tokens: List<Token>,
+  root: GrammarRoot,
+  table: ParseTable,
+  prov: ParseProvenanceState
+) -> ParseExprResult {
+  match parse_expr_terminal(token_class: grammar_infix_row_class(row: row), stamp: StampClass, tokens: tokens, table: table, prov: prov) {
+    ParseExprRejected { diagnostics: _, table: table1 } =>
+      ParseExprAccepted { remaining: tokens, captured: lhs, diagnostics: diagnostics, prov: prov, table: table1 }
+    ParseExprAccepted { remaining: after_operator, captured: operator, diagnostics: _, prov: prov1, table: table1 } =>
+      match parse_expr_infix_climb(
+        table_expr: table_expr,
+        min_power: grammar_infix_right_min_power(row: row),
+        tokens: after_operator,
+        all_tokens: all_tokens,
+        root: root,
+        table: table1,
+        prov: prov1
+      ) {
+        ParseExprRejected { diagnostics: _, table: table2 } =>
+          ParseExprAccepted { remaining: tokens, captured: lhs, diagnostics: diagnostics, prov: prov, table: table2 }
+        ParseExprAccepted { remaining: rest, captured: rhs, diagnostics: rhs_diags, prov: prov2, table: table2 } =>
+          let stamped = parse_stamp_infix_application(left: lhs, operator: operator, right: rhs, prov: prov2)
+          parse_expr_infix_continue(
+            table_expr: table_expr,
+            min_power: min_power,
+            chained_power: parse_infix_chained_after(row: row),
+            lhs: stamped.node,
+            diagnostics: list_append(left: diagnostics, right: rhs_diags),
+            tokens: rest,
+            all_tokens: all_tokens,
+            root: root,
+            table: table2,
+            prov: stamped.prov
+          )
+      }
   }
 }
 
@@ -5044,91 +4759,36 @@ fn parse_expr(
   )
 }
 
-fn parse_production_memo_stats(
-  tokens: List<Token>,
-  validated: ValidatedGrammarRoot,
-  production_name: Symbol,
-  materialization: Materialization
-) -> ParseMemoStats {
-  let root = validated.root
-  match grammar_lookup_production(root: root, name: production_name) {
-    Violates { diagnostic: _ } =>
-      ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-    Holds { value: production } =>
-      let prov = parse_prov_initial()
-      let table = parse_table_for_production(
-        validated: validated,
-        all_tokens: tokens,
-        materialization: materialization
-      )
-      match parse_expr(
-        expr: production.expression,
-        tokens: tokens,
-        all_tokens: tokens,
-        root: root,
-        table: table,
-        prov: prov
-      ) {
-        ParseExprAccepted { remaining: _, captured: _, diagnostics: _, prov: _, table: final_table } =>
-          parse_table_memo_stats(table: final_table)
-        ParseExprRejected { diagnostics: _, table: final_table } =>
-          parse_table_memo_stats(table: final_table)
-      }
-  }
-}
-
 fn parse_production_prepared(
   tokens: List<Token>,
   validated: ValidatedGrammarRoot,
   analysis: GrammarFirstAnalysis,
-  production_name: Symbol,
-  materialization: Materialization
+  production_name: Symbol
 ) -> Outcome<ParseArtifact> {
-  parse_production_prepared_measured(
-    tokens: tokens,
-    validated: validated,
-    analysis: analysis,
-    production_name: production_name,
-    materialization: materialization
-  ).outcome
-}
-
-fn parse_production_prepared_measured(
-  tokens: List<Token>,
-  validated: ValidatedGrammarRoot,
-  analysis: GrammarFirstAnalysis,
-  production_name: Symbol,
-  materialization: Materialization
-) -> ParseProductionMeasured {
-  parse_production_prepared_measured_seeded(
+  parse_production_prepared_seeded(
     tokens: tokens,
     validated: validated,
     analysis: analysis,
     production_name: production_name,
     seed: occurrence_id_allocator_initial(),
-    layout: optional_absent(),
-    materialization: materialization
+    layout: optional_absent()
   )
 }
 
-fn parse_production_prepared_measured_seeded(
+fn parse_production_prepared_seeded(
   tokens: List<Token>,
   validated: ValidatedGrammarRoot,
   analysis: GrammarFirstAnalysis,
   production_name: Symbol,
   seed: OccurrenceIdAllocator,
-  layout: Optional<StreamLayout>,
-  materialization: Materialization
-) -> ParseProductionMeasured {
+  layout: Optional<StreamLayout>
+) -> Outcome<ParseArtifact> {
   match parse_token_start_order_violation(tokens: tokens) {
     Present { value: tok } =>
-      ParseProductionMeasured {
-        outcome: Rejected {
-          diagnostics: diagnostics_singleton(
-            d: parse_refusal_reason_diagnostic(reason: TokenStartsNotIncreasing, file: tok.file, start: tok.start, end: tok.end)
-          )
-        },
-        memo: parse_memo_stats_empty()
+      Rejected {
+        diagnostics: diagnostics_singleton(
+          d: parse_refusal_reason_diagnostic(reason: TokenStartsNotIncreasing, file: tok.file, start: tok.start, end: tok.end)
+        )
       }
     Absent =>
       parse_production_prepared_ordered(
@@ -5137,17 +4797,16 @@ fn parse_production_prepared_measured_seeded(
         analysis: analysis,
         production_name: production_name,
         seed: seed,
-        layout: layout,
-        materialization: materialization
+        layout: layout
       )
   }
 }
 
 // A STREAM POSITION IS ITS TOKEN'S START, so the parse admits only a stream whose starts strictly
-// increase (v2.std.compilers.lexing Token). parse_current_position keys the memo by that start and
-// decides repeat progress by it; two tokens at one start would be one position, and the memo would
-// serve one's answer for the other with no diagnostic. The order is checked once here, at the
-// parse's entry, and a stream that violates it refuses located at the first offending token.
+// increase (v2.std.compilers.lexing Token). parse_current_position decides repeat progress by that
+// start; two tokens at one start would be one position, and a repeat could stop or continue on the
+// wrong one with no diagnostic. The order is checked once here, at the parse's entry, and a stream
+// that violates it refuses located at the first offending token.
 fn parse_token_start_order_violation(tokens: List<Token>) -> Optional<Token> {
   fold_list(
     xs: tokens,
@@ -5178,7 +4837,7 @@ type ParseStartOrderAcc {
 // THE ENTRY PRODUCTION IS READ OFF THE PREPARED GRAMMAR, never re-derived per parse: its lookup is
 // the analysis's productions_by_name index and its prepared tree (choice plans, FIRST unions) is the
 // analysis's prepared_exprs row, exactly as every nested nonterminal already reads it
-// (parse_nonterminal_memoized). Routing the entry through parse_expr re-ran prepare_grammar_expr --
+// (parse_nonterminal). Routing the entry through parse_expr re-ran prepare_grammar_expr --
 // choice-plan compilation plus the authored-choice overlap residue, which the parse then discarded --
 // and an O(P) non-short-circuiting fold over every production, on EVERY parse, re-deriving a
 // property of the grammar that prepare_grammar already computed once.
@@ -5188,16 +4847,14 @@ fn parse_production_prepared_ordered(
   analysis: GrammarFirstAnalysis,
   production_name: Symbol,
   seed: OccurrenceIdAllocator,
-  layout: Optional<StreamLayout>,
-  materialization: Materialization
-) -> ParseProductionMeasured {
+  layout: Optional<StreamLayout>
+) -> Outcome<ParseArtifact> {
   let root = validated.root
   let table = parse_table_for_stream_analyzed(
     validated: validated,
     analysis: analysis,
     layout: layout,
-    all_tokens: tokens,
-    materialization: materialization
+    all_tokens: tokens
   )
   match grammar_lookup_production_indexed(table: table, name: production_name) {
     Holds { value: production } =>
@@ -5212,17 +4869,11 @@ fn parse_production_prepared_ordered(
       )
       match parse_expr_result_table(result: parsed).refusal {
         Present { value: refusal } =>
-          ParseProductionMeasured {
-            outcome: Rejected { diagnostics: diagnostics_singleton(d: refusal) },
-            memo: parse_table_memo_stats(table: parse_expr_result_table(result: parsed))
-          }
-        Absent => parse_production_measured_unrefused(parsed: parsed, production: production, root: root)
+          Rejected { diagnostics: diagnostics_singleton(d: refusal) }
+        Absent => parse_production_unrefused(parsed: parsed, production: production, root: root)
       }
     Violates { diagnostic: d } =>
-      ParseProductionMeasured {
-        outcome: Rejected { diagnostics: diagnostics_singleton(d: d) },
-        memo: parse_memo_stats_empty()
-      }
+      Rejected { diagnostics: diagnostics_singleton(d: d) }
   }
 }
 
@@ -5230,11 +4881,11 @@ fn parse_production_prepared_ordered(
 // happened to parse around it: RefuseOnMatch names source the seed refuses although another reading
 // succeeds, so an Accepted here would be exactly the success it exists to deny. Only an unrefused
 // parse reaches the ordinary accept / leftover-token / no-match reading below.
-fn parse_production_measured_unrefused(
+fn parse_production_unrefused(
   parsed: ParseExprResult,
   production: GrammarProduction,
   root: GrammarRoot
-) -> ParseProductionMeasured {
+) -> Outcome<ParseArtifact> {
   match parsed {
     ParseExprAccepted { remaining: remaining, captured: captured, diagnostics: diags, prov: inner_prov, table: final_table } =>
       if is_empty(xs: remaining) {
@@ -5243,34 +4894,25 @@ fn parse_production_measured_unrefused(
           captured: captured,
           prov: inner_prov
         )
-        ParseProductionMeasured {
-          outcome: Accepted {
-            value: ParseArtifact { tree: stamped.node, span_index: stamped.prov.index, alloc: stamped.prov.alloc },
-            diagnostics: parse_diags_to_diagnostics(diags: diags)
-          },
-          memo: parse_table_memo_stats(table: final_table)
+        Accepted {
+          value: ParseArtifact { tree: stamped.node, span_index: stamped.prov.index, alloc: stamped.prov.alloc },
+          diagnostics: parse_diags_to_diagnostics(diags: diags)
         }
       } else {
-        ParseProductionMeasured {
-          outcome: Rejected {
-            diagnostics: diagnostics_singleton(
-              d: parse_g0_tokens_remain_diagnostic_at(tokens: remaining, furthest: final_table.furthest)
-            )
-          },
-          memo: parse_table_memo_stats(table: final_table)
+        Rejected {
+          diagnostics: diagnostics_singleton(
+            d: parse_g0_tokens_remain_diagnostic_at(tokens: remaining, furthest: final_table.furthest)
+          )
         }
       }
-    ParseExprRejected { diagnostics: diags, table: final_table } =>
-      ParseProductionMeasured {
-        outcome: Rejected {
-          diagnostics: parse_diags_to_non_empty(
-            diags: diags,
-            default: parse_e1_syntax_error_diagnostic(
-              at: node_locus(node: grammar_to_node(grammar: ModeledGrammar { root: root }))
-            )
+    ParseExprRejected { diagnostics: diags, table: _ } =>
+      Rejected {
+        diagnostics: parse_diags_to_non_empty(
+          diags: diags,
+          default: parse_e1_syntax_error_diagnostic(
+            at: node_locus(node: grammar_to_node(grammar: ModeledGrammar { root: root }))
           )
-        },
-        memo: parse_table_memo_stats(table: final_table)
+        )
       }
   }
 }
@@ -5280,18 +4922,12 @@ fn parse_production(
   validated: ValidatedGrammarRoot,
   production_name: Symbol
 ) -> Outcome<ParseArtifact> {
-  let analysis = compute_grammar_first_analysis(root: validated.root)
-  match parse_table_memo_materialization_for(r: analysis.memo_recurrence) {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: materialization, diagnostics: _ } =>
-      parse_production_prepared(
-        tokens: tokens,
-        validated: validated,
-        analysis: analysis,
-        production_name: production_name,
-        materialization: materialization
-      )
-  }
+  parse_production_prepared(
+    tokens: tokens,
+    validated: validated,
+    analysis: compute_grammar_first_analysis(root: validated.root),
+    production_name: production_name
+  )
 }
 
 fn parse_production_tree(
@@ -5310,33 +4946,10 @@ fn parse_production_tree(
       Rejected { diagnostics: r }
   }
 }
-// WHERE THE PARSE-TABLE MATERIALIZATION IS ADMITTED, and the only place it is. PreparedGrammar
-// is already the once-per-grammar carrier and the admission is a once-per-grammar fact, so the
-// join belongs here: a refused admission REFUSES THE PREPARE, which is how the unmet obligation
-// reaches the caller as a located diagnostic instead of as a quiet recompute.
-//
-// THE PARAMETER IS THE DOOR, NOT ITS ANSWER, and that is forced by the derivation rather than
-// chosen. The parse demand's site is read off the grammar's own recurrence census, so the
-// admission is a FUNCTION of the analysis and cannot be evaluated before the analysis exists --
-// an already-computed Outcome passed in here would have to come from some other grammar. Passing
-// the door keeps the control's grip: a control supplies a door built on a refusing verdict list
-// and drives THIS body, the one parse_module runs, rather than a copy of it.
-fn prepare_grammar(grammar: ParseGrammar) -> Outcome<PreparedGrammar> {
-  prepare_grammar_with_admission(
-    admit: fn(r) { parse_table_memo_materialization_for(r: r) },
-    grammar: grammar
-  )
-}
 
-// A VOID GRAMMAR CONSULTS NO MEMO, so it does not consult the admission either. Refusing a void
-// parse because the parse-table obligation is unmet would forbid more than the obligation covers
-// (DESIGN section 4d): no table is built on that arm, so there is nothing for a provider to
-// discharge. The admission is demanded exactly where the table is, on the modeled arm -- and
-// there, only once the analysis has produced the census the door is asked about.
-fn prepare_grammar_with_admission(
-  admit: fn(ParseMemoRecurrence) -> Outcome<Materialization>,
-  grammar: ParseGrammar
-) -> Outcome<PreparedGrammar> {
+// PreparedGrammar is the once-per-grammar carrier: well-formedness, validation and the FIRST
+// analysis run here once, and every parse of every module reads the result.
+fn prepare_grammar(grammar: ParseGrammar) -> Outcome<PreparedGrammar> {
   let grammar_node = grammar_to_node(grammar: grammar)
   let at = node_locus(node: grammar_node)
   if well_formed(n: grammar_node) {
@@ -5346,14 +4959,10 @@ fn prepare_grammar_with_admission(
       ModeledGrammar { root: root } =>
         match grammar_validate_and_analyze(root: root, at: at) {
           Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-          Accepted { value: modeled, diagnostics: validation_residue } =>
-            match admit(modeled.analysis.memo_recurrence) {
-              Rejected { diagnostics: refusal } => Rejected { diagnostics: refusal }
-              Accepted { value: materialization, diagnostics: _ } =>
-                Accepted {
-                  value: PreparedModeled { modeled: modeled, materialization: materialization },
-                  diagnostics: validation_residue
-                }
+          Accepted { value: modeled, diagnostics: _ } =>
+            Accepted {
+              value: PreparedModeled { modeled: modeled },
+              diagnostics: None
             }
         }
     }
@@ -5362,61 +4971,14 @@ fn prepare_grammar_with_admission(
   }
 }
 
-fn overlap_residue_stage_from_prepared(prepared: PreparedGrammar) -> Optional<NonEmptyParseStageDiagnostics> {
-  match prepared {
-    PreparedVoidGrammar => optional_absent()
-    PreparedModeled { modeled: modeled, materialization: _ } => modeled.overlap_residue_stage
-  }
-}
-
-fn overlap_residue_stage_from_parse_grammar(grammar: ParseGrammar) -> Optional<NonEmptyParseStageDiagnostics> {
-  match prepare_grammar(grammar: grammar) {
-    Rejected { diagnostics: _ } => optional_absent()
-    Accepted { value: prepared, diagnostics: _ } =>
-      overlap_residue_stage_from_prepared(prepared: prepared)
-  }
-}
-
-// The unmeasured door, retained for every caller that does not own a clock or a relay, and defined
-// as the projection of the measured fold rather than restated beside it.
+// The unseeded door: one file, its own isolated occurrence scope.
 fn parse_module_prepared(
   tokens: TokenStream,
-  prepared: PreparedGrammar,
-  validation_residue: Diagnostics
+  prepared: PreparedGrammar
 ) -> Outcome<ParseArtifact> {
-  parse_module_prepared_measured(
+  parse_module_prepared_seeded(
     tokens: tokens,
     prepared: prepared,
-    validation_residue: validation_residue
-  ).outcome
-}
-
-fn parse_module_prepared_seeded(
-  tokens: TokenStream,
-  prepared: PreparedGrammar,
-  validation_residue: Diagnostics,
-  seed: OccurrenceIdAllocator
-) -> Outcome<ParseArtifact> {
-  parse_module_prepared_measured_seeded(
-    tokens: tokens,
-    prepared: prepared,
-    validation_residue: validation_residue,
-    seed: seed
-  ).outcome
-}
-
-// A VOID GRAMMAR CONSULTS NO MEMO, so its accounting is empty rather than absent: the counters are
-// zero because nothing was looked up, which is an answer. Reporting no stats at all would make a
-// void parse indistinguishable from a parse whose stats were dropped.
-fn parse_module_prepared_measured(
-  tokens: TokenStream,
-  prepared: PreparedGrammar,
-  validation_residue: Diagnostics
-) -> ParseProductionMeasured {
-  parse_module_prepared_measured_seeded(
-    tokens: tokens,
-    prepared: prepared,
-    validation_residue: validation_residue,
     seed: occurrence_id_allocator_initial()
   )
 }
@@ -5425,70 +4987,44 @@ fn parse_module_prepared_measured(
 // the same source graph left behind, so this file's occurrence ids continue where that one stopped
 // and no two files in one ingest mint the same id. The returned artifact carries the mark this
 // parse reached, which is what lets the assembly fold thread it to the next read. The unseeded
-// projection above is every other caller: one file, its own isolated scope, byte-identical to the
-// fold it was before this parameter existed.
-fn parse_module_prepared_measured_seeded(
+// projection above is every other caller: one file, its own isolated scope.
+fn parse_module_prepared_seeded(
   tokens: TokenStream,
   prepared: PreparedGrammar,
-  validation_residue: Diagnostics,
   seed: OccurrenceIdAllocator
-) -> ParseProductionMeasured {
+) -> Outcome<ParseArtifact> {
   let ntok = token_stream_remaining_count(stream: tokens)
   match prepared {
     PreparedVoidGrammar =>
       if ntok == 0 {
-        ParseProductionMeasured {
-          outcome: Accepted {
-            value: ParseArtifact { tree: grammar_to_node(grammar: VoidGrammar), span_index: span_index_empty(), alloc: seed },
-            diagnostics: validation_residue
-          },
-          memo: parse_memo_stats_empty()
+        Accepted {
+          value: ParseArtifact { tree: grammar_to_node(grammar: VoidGrammar), span_index: span_index_empty(), alloc: seed },
+          diagnostics: None
         }
       } else {
-        ParseProductionMeasured {
-          outcome: Rejected {
-            diagnostics: diagnostics_singleton(
-              d: parse_g0_tokens_remain_diagnostic(tokens: token_stream_remaining(stream: tokens))
-            )
-          },
-          memo: parse_memo_stats_empty()
+        Rejected {
+          diagnostics: diagnostics_singleton(
+            d: parse_g0_tokens_remain_diagnostic(tokens: token_stream_remaining(stream: tokens))
+          )
         }
       }
-    PreparedModeled { modeled: modeled, materialization: materialization } =>
-      let measured = parse_production_prepared_measured_seeded(
+    PreparedModeled { modeled: modeled } =>
+      parse_production_prepared_seeded(
         tokens: token_stream_remaining(stream: tokens),
         validated: modeled.validated,
         analysis: modeled.analysis,
         production_name: modeled.validated.root.start,
         seed: seed,
-        layout: token_stream_layout(stream: tokens),
-        materialization: materialization
+        layout: token_stream_layout(stream: tokens)
       )
-      match measured.outcome {
-        Accepted { value: artifact, diagnostics: parse_diags } =>
-          ParseProductionMeasured {
-            outcome: Accepted {
-              value: artifact,
-              diagnostics: diagnostics_merge(outer: validation_residue, inner: parse_diags)
-            },
-            memo: measured.memo
-          }
-        Rejected { diagnostics: parse_rejected } =>
-          ParseProductionMeasured {
-            outcome: Rejected {
-              diagnostics: rejected_with_pending(pending: validation_residue, rejected: parse_rejected)
-            },
-            memo: measured.memo
-          }
-      }
   }
 }
 
 fn parse_module(tokens: TokenStream, grammar: ParseGrammar) -> Outcome<ParseArtifact> {
   match prepare_grammar(grammar: grammar) {
     Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: prepared, diagnostics: validation_residue } =>
-      parse_module_prepared(tokens: tokens, prepared: prepared, validation_residue: validation_residue)
+    Accepted { value: prepared, diagnostics: _ } =>
+      parse_module_prepared(tokens: tokens, prepared: prepared)
   }
 }
 
diff --git a/src/v2/compiler/03_ingest.dag b/src/v2/compiler/03_ingest.dag
index 070cf7ea6e3..68fd2df9a66 100644
--- a/src/v2/compiler/03_ingest.dag
+++ b/src/v2/compiler/03_ingest.dag
@@ -10,7 +10,7 @@ import v2.std.collection {
   Map,
   Present,
   empty_map,
-  map_get,
+  map_get_checked,
   map_insert
 }
 import v2.std.grammar {
@@ -38,6 +38,7 @@ import v2.compiler.translate { coerce_grounded_node }
 import v2.compiler.target_serialize { target_bundle_child }
 import v2.std.inhabitant_neutralization { neutralize_core_for_target }
 import v2.std.node { Edge, Authored, StructuralLabel, Node, Positional, Symbol, TypeNode, Conj }
+import v2.std.member_declaration_kind { no_member_declaration_kinds }
 import v2.std.diagnostic {
   Accepted,
   Diagnostic,
@@ -69,7 +70,7 @@ fn parse_atom_frontier_class_direct(
   token_classes: Map<Symbol, Symbol>
 ) -> Outcome<Symbol> {
   bind_outcome(
-    o: map_get(token_classes, atom_identity),
+    o: map_get_checked(token_classes, atom_identity),
     f: fn(direct) {
       match direct {
         Present { value: token_class } => outcome_accepted(value: token_class)
@@ -86,7 +87,7 @@ fn parse_atom_frontier_class(
   token_classes: Map<Symbol, Symbol>
 ) -> Outcome<Symbol> {
   bind_outcome(
-    o: map_get(binding_to_class, atom_identity),
+    o: map_get_checked(binding_to_class, atom_identity),
     f: fn(bound) {
       match bound {
         Present { value: token_class } => outcome_accepted(value: token_class)
@@ -337,7 +338,7 @@ fn parse_tree_to_target_model_bridge(parse_tree: ParseTree, source_model: Target
     o: parse_tree_to_emitted_node(parse_tree: parse_tree, source_model: source_model),
     f: fn(emitted) {
       bind_outcome(
-        o: infer_and_discharge(tree: ResolvedTree { root: emitted, symbol_index: empty_symbol_index(), resolved_declarations: empty_symbol_index(), lexical_bindings: empty_map(), unavailable_providers: [] }),
+        o: infer_and_discharge(tree: ResolvedTree { root: emitted, symbol_index: empty_symbol_index(), resolved_declarations: empty_symbol_index(), lexical_bindings: empty_map(), unavailable_providers: [], member_kinds: no_member_declaration_kinds() }),
         f: fn(inferred) {
           bind_outcome(
             o: coerce_grounded_node(source: emitted, tree: inferred, target: source_model),
@@ -362,7 +363,7 @@ fn cross_language_compile(
         o: neutralize_core_for_target(core: core, target: target_model),
         f: fn(neutralized) {
           bind_outcome(
-            o: infer_and_discharge(tree: ResolvedTree { root: neutralized, symbol_index: empty_symbol_index(), resolved_declarations: empty_symbol_index(), lexical_bindings: empty_map(), unavailable_providers: [] }),
+            o: infer_and_discharge(tree: ResolvedTree { root: neutralized, symbol_index: empty_symbol_index(), resolved_declarations: empty_symbol_index(), lexical_bindings: empty_map(), unavailable_providers: [], member_kinds: no_member_declaration_kinds() }),
             f: fn(inferred) {
               emit(tree: inferred, target: target_model)
             }
diff --git a/src/v2/compiler/03_name_resolve.dag b/src/v2/compiler/03_name_resolve.dag
index 04c93a6c8ca..8d7eea51705 100644
--- a/src/v2/compiler/03_name_resolve.dag
+++ b/src/v2/compiler/03_name_resolve.dag
@@ -2,6 +2,7 @@ module v2.compiler.name_resolve
 
 import std.types { List }
 import v2.std.language_model { LanguageModel }
+import v2.std.member_declaration_kind { MemberKindChannel, no_member_declaration_kinds }
 
 import v2.compiler.symbol_index_fill { symbol_index_fill_module_declarations, symbol_index_fill_module_roots }
 import v2.compiler.normalized_tree { NormalizedTree, normalized_tree_roots_to_binding_sources }
@@ -16,6 +17,7 @@ import v2.compiler.resolve {
   ResolveNodeWalk,
   ResolveWalkRefused,
   ClosureProviderRefusal,
+  member_kind_channel_of_tree,
   ResolvedTree,
   resolved_tree_outcome,
   resolve_walk_prefix_pending,
@@ -38,7 +40,7 @@ import v2.compiler.namespace_graft {
 import v2.compiler.parse { parse_tree_projection_edge }
 import std.algebra { Cons, Empty, FreeMonoid, list_snoc_item }
 import v2.std.algebra { fold_list }
-import v2.std.collection { Absent, Map, Present, PointwisePower, empty_map, map_get, map_lookup, map_insert, optional_absent, optional_present }
+import v2.std.collection { Absent, Map, Present, PointwisePower, empty_map, map_get_checked, map_lookup, map_insert, optional_absent, optional_present }
 import std.optional { Optional }
 import v2.std.diagnostic {
   Accepted,
@@ -288,7 +290,7 @@ fn admit_export_symbol(
       AdmissionRejected { diagnostics: d }
     AdmissionAccepted { bindings: b, origins: os } =>
 
-      match v2.std.collection.map_get(os, sym) {
+      match v2.std.collection.map_get_checked(os, sym) {
         Accepted { value: opt, diagnostics: _ } => match opt {
           Present { value: _ } =>
             AdmissionRejected {
@@ -695,6 +697,16 @@ fn subject_module_root_for_name(
   }
 }
 
+// The subject root's member-kind channel, read from the validated roots by the subject's own name. A subject
+// with no root there has no provenance to give, which is Unavailable and not a refusal here: the module-not-found
+// refusal already belongs to admission.
+fn subject_member_kind_channel(roots: ValidatedModuleRoots, name: QualifiedName) -> Outcome<MemberKindChannel> {
+  match map_lookup(m: roots.by_name, key: name) {
+    Present { value: root } => member_kind_channel_of_tree(tree: root)
+    Absent => Accepted { value: no_member_declaration_kinds(), diagnostics: v2.std.diagnostic.None }
+  }
+}
+
 fn namespace_admission_initial_state(
   policy: NameResolutionPolicy,
   canonical_symbols: PointwisePower<Symbol>,
@@ -936,12 +948,17 @@ fn resolve_in_context(context: Outcome<ResolutionContext>, admission: Admission)
     Accepted { value: shared, diagnostics: d } =>
       let closure = closure_declarations_demand(shared: shared)
       ContextResolved {
-        resolved: resolved_tree_outcome(
-          w: walked.walk,
-          symbol_index: shared.symbol_index,
-          closure_declarations: closure.declarations,
-          unavailable_providers: closure.refused
-        ),
+        resolved: match subject_member_kind_channel(roots: shared.roots, name: admission.subject.name) {
+          Rejected { diagnostics: r } => Rejected { diagnostics: r }
+          Accepted { value: channel, diagnostics: _ } =>
+            resolved_tree_outcome(
+              w: walked.walk,
+              symbol_index: shared.symbol_index,
+              closure_declarations: closure.declarations,
+              unavailable_providers: closure.refused,
+              member_kinds: channel
+            )
+        },
         context: Accepted { value: closure.context, diagnostics: d }
       }
   }
diff --git a/src/v2/compiler/03_normalize.dag b/src/v2/compiler/03_normalize.dag
index 6f596597c4d..970b46b85aa 100644
--- a/src/v2/compiler/03_normalize.dag
+++ b/src/v2/compiler/03_normalize.dag
@@ -45,6 +45,7 @@ import v2.std.compilers.sugar {
 }
 import v2.compiler.body_lowering_fold {
   BodyLowering,
+  body_term_of,
   BodyLoweredTree,
   WrapperRetention,
   body_lowering_after_pending,
@@ -75,15 +76,24 @@ import v2.compiler.normalized_tree {
   NormalizedTree,
   admit_census_tree,
   admit_normalized_tree,
-  admit_retention_free
+  admit_retention_free,
+  normalized_tree_with_member_declarations
 }
+import v2.std.member_declaration_kind { DeclaredDataMember, DeclaredFnMember, DeclaredMember }
 import v2.compiler.test_marker_capture { test_marker_capture }
 import v2.compiler.namespace_graft {
   module_header_containment_graft,
-  namespace_graft_is_graft_candidate
+  namespace_graft_collect_unit_nodes_against,
+  namespace_graft_is_graft_candidate,
+  namespace_graft_top_level_item_alternative_emitted_ids
 }
 import v2.extdeps.languages.dag {
+  dag_grammar_root,
+  dag_surface_kw_then_ident_from_captured,
+  alias_binding_row_from_decl_node,
   import_binding_rows_from_decl_node,
+  namespace_graft_unwrap_module_working_root,
+  parse_production_captured_child_optional,
   parse_production_emitted_identity_optional
 }
 import std.types { List }
@@ -315,12 +325,42 @@ fn normalize_module_graft_finish(folded: Node, cd: Diagnostics) -> Outcome<Node>
   }
 }
 
+// A LEAF HAS NO INTERIOR (MQ-5). A literal token the parse minted with its payload already attached --
+// an Int literal's magnitude, a fold-list spine of digits (v2.std.integer) -- is one term
+// (body_term_of answers RawLeaf), and body_lower_fold already takes it whole. This
+// outer fold used to descend into its payload anyway, so the digit spine reached body_term_of as a
+// composite with no projection edge and no seal and refused as an unrecognised lowered shape; every
+// `data x: Int = <literal>` refused (the native door's accepting control, #12942). A leaf's edges are
+// kept as they stand; the leaf itself is still lowered below, as every node is. The question is asked
+// of the term authority, never of a second leaf predicate; a node it refuses is still descended, so
+// the refusal is raised, located, by the reader that lowers it rather than absorbed here.
+// ONE CLASSIFICATION PER PARENT (review 75069). Whether a child is kept whole depends only on the
+// parent n, so body_term_of is asked once here and the answer is carried into the fold, rather
+// than re-read once per child edge (DESIGN section 6, bare minimum cost: a quadratic fold is always
+// fixed). A RawLeaf parent keeps its payload whole; every other arm, Rejected included, descends.
 fn normalize_node_fold_children_ctx(n: Node, under_fn_decl: Bool) -> Outcome<BodyLoweredTree> {
+  normalize_node_fold_children_classified(
+    n: n,
+    under_fn_decl: under_fn_decl,
+    keep_children_whole: match body_term_of(node: n) {
+      Accepted { value: RawLeaf { node: _ }, diagnostics: _ } => true
+      Accepted { value: RawParse { node: _ }, diagnostics: _ } => false
+      Accepted { value: Lowered { node: _, shape: _ }, diagnostics: _ } => false
+      Rejected { diagnostics: _ } => false
+    }
+  )
+}
+
+fn normalize_node_fold_children_classified(n: Node, under_fn_decl: Bool, keep_children_whole: Bool) -> Outcome<BodyLoweredTree> {
   match fold(n.children, init: normalize_children_init(), f: fn(acc, e) {
     normalize_children_step(
       acc: acc,
       edge: e,
-      child: normalize_node_ctx(n: e.target, under_fn_decl: under_fn_decl)
+      child: if keep_children_whole {
+        Accepted { value: body_lowered_tree_over(node: e.target, retained: no_wrapper_retentions()), diagnostics: None }
+      } else {
+        normalize_node_ctx(n: e.target, under_fn_decl: under_fn_decl)
+      }
     )
   }) {
     Rejected { diagnostics: r } => Rejected { diagnostics: r }
@@ -344,6 +384,11 @@ fn normalize_node_fold_children_ctx(n: Node, under_fn_decl: Bool) -> Outcome<Bod
 // the caller and passed to each, rather than each folding node_subtree_nodes itself. DESIGN section
 // 2: two demands whose least common ancestor holds the value share it rather than recomputing it,
 // and this stage is one the floor already measures as over-budget.
+// AN `alias Name = a.b.C` DECLARATION IS THE SAME ROW (v2.std.namespace_alias AliasBindingRow): one
+// binding naming one target, read here for the same reason -- the graft dissolves the declaration
+// (v2.compiler.namespace_graft namespace_graft_unit_disposition), so this is the only moment it can
+// be read. An import is the transmutation of N such rows (docs/plans/namespace-resolution-design.md
+// section 13), so both forms land on one carrier and one binding fold.
 fn import_binding_capture(tree: ParseTree, nodes: List<Node>) -> Outcome<FreeMonoid<AliasBindingRow>> {
   fold_list(
     xs: nodes,
@@ -355,7 +400,13 @@ fn import_binding_capture(tree: ParseTree, nodes: List<Node>) -> Outcome<FreeMon
           match parse_production_emitted_identity_optional(node: n) {
             Absent => acc
             Present { value: id } =>
-              if id != ^dag_surface_import_decl {
+              if id == ^dag_surface_alias_decl {
+                match alias_binding_row_from_decl_node(decl: n, module_root: tree) {
+                  Rejected { diagnostics: r } => Rejected { diagnostics: r }
+                  Accepted { value: row, diagnostics: _ } =>
+                    Accepted { value: list_snoc_item(xs: rows, item: row), diagnostics: v2.std.diagnostic.None }
+                }
+              } else if id != ^dag_surface_import_decl {
                 acc
               } else {
                 match import_binding_rows_from_decl_node(decl: n, module_root: tree) {
@@ -408,6 +459,47 @@ fn type_declaration_kind_capture(nodes: List<Node>) -> FreeMonoid<DeclaredTypeKi
   )
 }
 
+// THE AUTHORED KIND OF EACH TOP-LEVEL MEMBER, read from the parse for the reason type_declaration_kind_capture
+// is: lowering turns `data x: T = v` and `fn x() -> T { v }` into one shape (a named nullary Arrow), so
+// after normalize nothing in the Node says which was authored. The population is the graft's own unit
+// census (namespace_graft_collect_unit_nodes_against over the module's working root, the same units the
+// graft partitions into members), NOT every node of the parse: a declaration nested in another unit is
+// not a member of the module. A data or fn unit whose name cannot be read contributes no row, so a
+// consumer asking for it finds it not declared and refuses, never a fabricated kind.
+// v2.std.member_declaration_kind MemberKindChannel is what carries these to a later grain.
+fn member_declaration_capture(tree: ParseTree) -> FreeMonoid<DeclaredMember> {
+  let unit_ids = namespace_graft_top_level_item_alternative_emitted_ids(productions: dag_grammar_root().productions)
+  fold_list(
+    xs: namespace_graft_collect_unit_nodes_against(node: namespace_graft_unwrap_module_working_root(root: tree), unit_ids: unit_ids),
+    empty: Empty,
+    cons: fn(acc, unit) {
+      match parse_production_emitted_identity_optional(node: unit) {
+        Absent => acc
+        Present { value: id } =>
+          if (id == ^dag_surface_data_decl) || (id == ^dag_surface_fn_decl) {
+            match parse_production_captured_child_optional(node: unit) {
+              Absent => acc
+              Present { value: captured } =>
+                match dag_surface_kw_then_ident_from_captured(captured: captured) {
+                  Absent => acc
+                  Present { value: name } =>
+                    list_snoc_item(
+                      xs: acc,
+                      item: DeclaredMember {
+                        name: name,
+                        kind: if id == ^dag_surface_data_decl { DeclaredDataMember } else { DeclaredFnMember }
+                      }
+                    )
+                }
+            }
+          } else {
+            acc
+          }
+      }
+    }
+  )
+}
+
 // WHICH MODIFIERS EACH TYPE DECLARATION'S SLOT CARRIES, read from the parse tree for the reason
 // type_declaration_kind_capture is: lowering leaves no trace of the slot in the node. The question is
 // answered by the lowering's own reader (v2.compiler.body_lowering_fold
@@ -507,7 +599,13 @@ fn normalize_with(parse_tree: ParseTree, source: NormalizeAllocatorSource) -> Ou
                         ) {
                           Rejected { diagnostics: r } => Rejected { diagnostics: r }
                           Accepted { value: tree, diagnostics: d2 } =>
-                            Accepted { value: ScopedNormalizedTree { tree: tree, allocator: allocated.allocator }, diagnostics: d2 }
+                            Accepted {
+                              value: ScopedNormalizedTree {
+                                tree: normalized_tree_with_member_declarations(tree: tree, members: member_declaration_capture(tree: parse_tree)),
+                                allocator: allocated.allocator
+                              },
+                              diagnostics: d2
+                            }
                         }
                     }
                 }
diff --git a/src/v2/compiler/03_resolve.dag b/src/v2/compiler/03_resolve.dag
index cda409b2df4..62a3fb41bfc 100644
--- a/src/v2/compiler/03_resolve.dag
+++ b/src/v2/compiler/03_resolve.dag
@@ -1,7 +1,16 @@
 module v2.compiler.resolve
 import v2.std.language_model { LanguageModel }
 
-import v2.compiler.normalized_tree { NormalizedTree, normalized_tree_resource_declarations }
+import v2.compiler.normalized_tree { normalized_tree_record_declarations, MemberDeclarationsNotRead, MemberDeclarationsRead, NormalizedTree, normalized_tree_resource_declarations }
+import v2.std.member_declaration_kind {
+  DeclaredMember,
+  declared_members_have_duplicate,
+  MemberKindChannel,
+  MemberKindsCaptured,
+  MemberKindsUnavailable,
+  QualifiedDeclaredMember,
+  no_member_declaration_kinds
+}
 import v2.compiler.namespace_graft { namespace_graft_module_body_optional }
 import v2.std.declaration_marker {
   ReachesNoTestCode,
@@ -37,13 +46,13 @@ import v2.extdeps.languages.dag {
 import v2.compiler.parse { parse_tree_projection_edge }
 import v2.std.anonymous_binder { is_anonymous_param_label }
 import std.algebra { Cons, Empty, FreeMonoid, list_append, list_snoc_item }
-import v2.std.algebra { any, fold_list, length, skip }
+import v2.std.algebra { any, fold_list, length, list_find_first, skip }
 import v2.std.collection {
   Map,
   PointwisePower,
   empty_map,
   list_at_optional,
-  map_get,
+  map_get_checked,
   map_insert,
   map_lookup
 }
@@ -78,6 +87,7 @@ import v2.std.diagnostic {
   Rejected,
   outcome_with_diagnostics
 }
+import v2.compiler.primitive_authority { primitive_authority_path, primitive_authority_row_names_head }
 import v2.compiler.fold_lowering { FoldRealization, FoldRealizesDeclaration, FoldRealizesRosterOperation, collection_roster_primitive_call_row_optional, fold_family_realization }
 import v2.std.qualified_name {
   QualifiedName,
@@ -120,6 +130,8 @@ import v2.std.symbol_index {
   symbol_index_declaring_path_of,
   symbol_index_lexical_lookup,
   symbol_index_declared_binders_at,
+  symbol_index_declared_type_params_at,
+  symbol_index_declares_primitive_contract_at,
   symbol_index_lookup,
   symbol_index_renaming_alias_at
 }
@@ -161,8 +173,9 @@ import v2.std.node {
   symbol_lexeme,
   arrow_domain_binds_a_name,
   arrow_first_positional_target,
-  arrow_named_edge_is_contract,
+  arrow_named_edge_is_metadata,
   ArrowResourceRequirementsEdge,
+  AdmitCallersEdge,
   FirstPositionalAbsent,
   FirstPositionalFound,
   edge_label_of,
@@ -207,6 +220,8 @@ import v2.std.node_query {
   NotAConstruct,
   construct_tag_optional,
   field_projection_node,
+  construct_tag_path_optional,
+  declared_field_named,
   node_positional_child_targets,
   find_named_child,
   is_wildcard_pattern,
@@ -258,6 +273,7 @@ type ResolvedTree {
   resolved_declarations: SymbolIndex
   lexical_bindings: Map<OccurrenceId, LexicalBinding>
   unavailable_providers: List<ClosureProviderRefusal>
+  member_kinds: MemberKindChannel
 }
 
 // A CLOSURE ROOT WHOSE OWN RESOLVE REFUSED, AND WHY. v2.compiler.name_resolve closure_declarations_demand
@@ -328,6 +344,7 @@ fn resolved_tree_of(
   symbol_index: SymbolIndex,
   closure_declarations: SymbolIndex,
   unavailable_providers: List<ClosureProviderRefusal>,
+  member_kinds: MemberKindChannel,
   lexical: List<LexicalBindingEntry>
 ) -> ResolvedTree {
   ResolvedTree {
@@ -335,7 +352,49 @@ fn resolved_tree_of(
     symbol_index: symbol_index,
     resolved_declarations: resolved_declarations_over(closure: closure_declarations, subject: root),
     lexical_bindings: fold(lexical, init: empty_map(), f: fn(m, e) { map_insert(m, e.reference, e.binding) }),
-    unavailable_providers: unavailable_providers
+    unavailable_providers: unavailable_providers,
+    member_kinds: member_kinds
+  }
+}
+
+// THE SUBJECT'S MEMBER-KIND CHANNEL, keyed by the DECLARING path (this module's qualified name + the member's
+// name). The channel covers the subject module only -- the one root mandatory_tag runs on -- so resolve pays
+// one pass over one module's members, not one per root in the closure. A tree normalize read no members for
+// (a hand-built root) is Unavailable, never an empty captured list. Roots are unique by name already
+// (ModuleRootsDuplicate refuses a second root for one module), so the only merge that can conflict is two
+// members of one module sharing a name: that refuses, located at the root, and is never first-wins.
+fn member_kind_channel_of_tree(tree: NormalizedTree) -> Outcome<MemberKindChannel> {
+  match tree.member_declarations {
+    MemberDeclarationsNotRead => Accepted { value: no_member_declaration_kinds(), diagnostics: None }
+    MemberDeclarationsRead { members: members } =>
+      match qualified_name_from_module_node(root: tree.root) {
+        Rejected { diagnostics: _ } => Accepted { value: no_member_declaration_kinds(), diagnostics: None }
+        Accepted { value: module_qn, diagnostics: _ } =>
+          let duplicated = declared_members_have_duplicate(members: members)
+          if duplicated {
+            Rejected {
+              diagnostics: diagnostics_singleton(
+                d: Diagnostic {
+                  reason: ^resolve_reason_member_kind_duplicate_declaration,
+                  at: node_locus(node: tree.root),
+                  correction: Unavailable { reason: ExternalContractUnknown }
+                }
+              )
+            }
+          } else {
+            Accepted {
+              value: MemberKindsCaptured {
+                covered: [module_qn],
+                members: fold_list(
+                  xs: members,
+                  empty: [],
+                  cons: fn(acc, m) { list_snoc_item(xs: acc, item: QualifiedDeclaredMember { module: module_qn, name: m.name, kind: m.kind }) }
+                )
+              },
+              diagnostics: None
+            }
+          }
+      }
   }
 }
 
@@ -418,6 +477,7 @@ type FrameKind
 type LexicalBinding {
   binder_site: NodeOccurrenceIdentity
   declared: Optional<Node>
+  value: Optional<Node>
 }
 
 // One answered lexical reference: the reference's own minted occurrence and the binding that
@@ -681,18 +741,6 @@ fn gate_value_binders(names: List<Symbol>, outer: Scope, at: Node) -> BinderGate
   }
 }
 
-// A LOOP'S CARRIER IS A BINDER, SO IT OPENS A FRAME AND IS NOT WALKED AS A REFERENCE. v2.std.node says
-// it outright -- "^loop_carrier_edge targets the loop-carried state's BINDER, never a value" -- and
-// resolve did neither: a Loop fell to resolve_children_homogeneous_scope, which opens a frame only for
-// an Arrow domain, so the carrier bound nothing and the iterated body's uses of it reached the bare-name
-// census. That is the whole of the `found` refusal in `fold(xs, init: false, f: fn(found, e) { ... })`:
-// v2.compiler.fold_lowering destructures the step literal into an iteration body and ONE carrier symbol
-// and builds this Loop, so the step's Arrow is never constructed and its second binder is dropped.
-//
-// The carrier edge is carried UNWALKED for the same reason the Arrow's declared-order edge is
-// (resolve_arrow_node_in): its target names a binder, not a reference, so resolving it would ask the
-// scope to answer for a name the scope is being opened to introduce.
-
 fn harvest_conj_named_bindings(root: Node, acc: Map<Symbol, Symbol>) -> Map<Symbol, Symbol> {
   match root.kind {
     TypeNode { connective: Conj } =>
@@ -720,7 +768,7 @@ data resolve_variant_visibility_disposition: Disposition = Scaffold {
   dissolves_to: SingleAuthority,
   bind: DeclarationRef {
     module_path: "v2.compiler.symbol_index_fill",
-    decl_name: "symbol_index_fill_unique_variant_aliases",
+    decl_name: "symbol_index_fill_containment_node",
     field: WholeDeclaration
   }
 }
@@ -823,10 +871,15 @@ fn arrow_domain_frame_binders(n: Node) -> FrameBinders {
               fold(domain.children, init: frame_binders_empty(), f: fn(fb, e) {
                 match try_edge_declared_binding(e: e) {
                   Present { value: b } =>
-                    frame_binders_add(fb: fb, name: b.name, binding: LexicalBinding {
-                      binder_site: n.occurrence_id,
-                      declared: member_edge_type_node(e: e)
-                    })
+                    frame_binders_add(
+                      fb: fb,
+                      name: b.name,
+                      binding: LexicalBinding {
+                        binder_site: n.occurrence_id,
+                        declared: member_edge_type_node(e: e),
+                        value: optional_absent()
+                      }
+                    )
                   Absent => fb
                 }
               })
@@ -847,10 +900,15 @@ fn bind_frame_binders(n: Node) -> FrameBinders {
           Present { value: e0 } =>
             match e0.target.kind {
               TypeNode { connective: Atom { identity: sym } } =>
-                frame_binders_add(fb: frame_binders_empty(), name: sym, binding: LexicalBinding {
-                  binder_site: e0.target.occurrence_id,
-                  declared: optional_absent()
-                })
+                frame_binders_add(
+                  fb: frame_binders_empty(),
+                  name: sym,
+                  binding: LexicalBinding {
+                    binder_site: e0.target.occurrence_id,
+                    declared: optional_absent(),
+                    value: list_at_optional(xs: node_positional_child_targets(node: n), index: 1)
+                  }
+                )
               _ => frame_binders_empty()
             }
           Absent => frame_binders_empty()
@@ -874,6 +932,12 @@ fn bind_frame_binders(n: Node) -> FrameBinders {
 // symbol_index_fill_module_declarations) over its one root, keyed at its module's paths. Parameter
 // references are verified against it (resolve_frame_bound_reference), so both routes verify against
 // the index each resolves through -- one authority, not a second table beside it.
+// THE INDEX'S KEYS AND THE LOOKUP'S POSITION ARE THE SAME PATH. The fill keys every declaration under
+// the module's own path, so module_qn -- the position an index lookup starts from -- is that path too,
+// as it is for the admitted subject. With module_qn left Empty, a name that is not a root binding (a
+// variant in value position) was looked up from the corpus root and refused unbound. And the fill takes
+// the record names the tree carries, as it takes its resource names: with Empty, no declaration was
+// marked RecordTypePayload, so every headless record literal refused as not a record.
 fn build_program_namespace(tree: NormalizedTree, lm: LanguageModel) -> Namespace {
   let declared_in = namespace_tree_module_qn(tree: tree)
   let bindings = namespace_bindings_augment_from_module_atoms(
@@ -883,8 +947,8 @@ fn build_program_namespace(tree: NormalizedTree, lm: LanguageModel) -> Namespace
   Namespace {
     bindings: bindings,
     canonical_symbols: lm.canonical_symbols,
-    symbol_index: symbol_index_fill_module_declarations(index: empty_symbol_index(), root: tree.root, record_declarations: Empty, resource_declarations: normalized_tree_resource_declarations(t: tree)),
-    module_qn: Empty,
+    symbol_index: symbol_index_fill_module_declarations(index: empty_symbol_index(), root: tree.root, record_declarations: normalized_tree_record_declarations(t: tree), resource_declarations: normalized_tree_resource_declarations(t: tree)),
+    module_qn: declared_in,
     test_code: test_code_index_add_module(
       index: test_code_index_empty(),
       module_qn: declared_in,
@@ -895,9 +959,9 @@ fn build_program_namespace(tree: NormalizedTree, lm: LanguageModel) -> Namespace
   }
 }
 
-// A single-tree namespace has no module path of its own (module_qn stays Empty, as before), but its
-// test-code index still needs the path its declarations live under. A root that names no module
-// keys them under Empty, which is the same key both sides of the lookup use.
+// The path a single tree's declarations live under: its module_qn, its index keys and its test-code
+// index all read it. A root that names no module keys them under Empty, which is the same key both
+// sides of the lookup use.
 fn namespace_tree_module_qn(tree: NormalizedTree) -> QualifiedName {
   match qualified_name_from_module_node(root: tree.root) {
     Accepted { value: qn, diagnostics: _ } => qn
@@ -1087,7 +1151,7 @@ type ScopeBinding
 fn lookup_chain(s: Scope, name: Symbol) -> Outcome<ScopeBinding> {
   match s {
     ScopeFrame { locals: m, outer: o, kind: kind } =>
-      match v2.std.collection.map_get(m, name) {
+      match v2.std.collection.map_get_checked(m, name) {
         Accepted { value: opt, diagnostics: d_here } => match opt {
           Present { value: v } =>
             Accepted { value: BoundInFrame { canonical: v, kind: kind }, diagnostics: d_here }
@@ -1107,7 +1171,7 @@ fn lookup_chain(s: Scope, name: Symbol) -> Outcome<ScopeBinding> {
         Rejected { diagnostics: ds } => Rejected { diagnostics: ds }
       }
     ScopeRoot { module: mod } =>
-      match v2.std.collection.map_get(mod.bindings, name) {
+      match v2.std.collection.map_get_checked(mod.bindings, name) {
         Accepted { value: opt, diagnostics: d } => match opt {
           Present { value: v } => Accepted { value: BoundAtRoot { canonical: v }, diagnostics: d }
           Absent => Accepted { value: ScopeUnbound, diagnostics: d }
@@ -1925,8 +1989,8 @@ fn kernel_type_spelling_foreign_diagnostic(n: Node) -> Diagnostic {
 }
 
 // WHETHER A DECLARATION IS THE REFERENCING MODULE'S OWN, read from where the namespace records its
-// owner. declared_in is that owner on both namespace routes: build_program_namespace (single tree,
-// whose module_qn stays Empty) and the admitted subject (where it equals module_qn). root_binding_origin
+// owner. declared_in is that owner on both namespace routes: build_program_namespace (single tree)
+// and the admitted subject, and on both it equals module_qn. root_binding_origin
 // reads the same field, so the root door and the symbol-index door agree on ownership.
 fn namespace_owns_declaration(namespace: Namespace, path: QualifiedName) -> Bool {
   qualified_name_init(qn: path) == namespace.declared_in
@@ -2230,9 +2294,45 @@ fn resolve_atom_unscoped(ctx: ResolveContext, n: Node, identity: Symbol, pending
         Absent =>
           match collection_roster_primitive_call_row_optional(head: identity) {
             Present { value: r } => resolve_atom_bound(ctx: ctx, n: n, path: declaration_ref_path(r: r.row), pending: pending)
-            Absent => resolve_atom_unbound(ctx: ctx, n: n, identity: identity, pending: pending)
+            Absent => resolve_atom_primitive_authority(ctx: ctx, n: n, identity: identity, pending: pending)
+          }
+      }
+  }
+}
+
+// THE LAST TIER: a free kernel primitive binds to its std.primitives contract row (v2.compiler.primitive_authority),
+// asked only after the frame, the imports, the indexed declarations, the kernel types and the collection roster
+// have all declined the name, so an ordinary declaration (a local fn, an imported v2.std.algebra any/filter) always
+// wins. A canonical symbol is not a primitive and keeps its own answer. A name no authority declares stays the
+// typed resolve_reason_unbound_symbol refusal. The found row is JOINED on its own `name` field: a row whose declaration
+// name disagrees with its name field is the typed resolve_reason_primitive_row_name_disagrees refusal, not a spelling bind.
+fn resolve_atom_primitive_authority(ctx: ResolveContext, n: Node, identity: Symbol, pending: Diagnostics) -> Outcome<Node> {
+  if namespace_has_canonical_symbol(namespace: ctx.namespace, name: identity) {
+    resolve_atom_unbound(ctx: ctx, n: n, identity: identity, pending: pending)
+  } else {
+    let path = primitive_authority_path(head: identity)
+    if symbol_index_declares_primitive_contract_at(index: ctx.namespace.symbol_index, qualified_path: path) {
+      match symbol_index_lookup(index: ctx.namespace.symbol_index, qualified_path: path) {
+        Present { value: row } =>
+          if primitive_authority_row_names_head(row: row, head: identity) {
+            resolve_atom_bound(ctx: ctx, n: n, path: path, pending: pending)
+          } else {
+            Rejected {
+              diagnostics: rejected_with_pending(
+                pending: pending,
+                rejected: diagnostics_singleton(d: Diagnostic {
+                  reason: ^resolve_reason_primitive_row_name_disagrees,
+                  at: node_locus(node: n),
+                  correction: Unavailable { reason: CorrectionNotModeled }
+                })
+              )
+            }
           }
+        Absent => resolve_atom_unbound(ctx: ctx, n: n, identity: identity, pending: pending)
       }
+    } else {
+      resolve_atom_unbound(ctx: ctx, n: n, identity: identity, pending: pending)
+    }
   }
 }
 
@@ -2355,12 +2455,13 @@ fn resolved_tree_outcome(
   w: ResolveNodeWalk,
   symbol_index: SymbolIndex,
   closure_declarations: SymbolIndex,
-  unavailable_providers: List<ClosureProviderRefusal>
+  unavailable_providers: List<ClosureProviderRefusal>,
+  member_kinds: MemberKindChannel
 ) -> Outcome<ResolvedTree> {
   match w {
     ResolveWalkAccepted { value: v, diagnostics: d, lexical: l } =>
       Accepted {
-        value: resolved_tree_of(root: v, symbol_index: symbol_index, closure_declarations: closure_declarations, unavailable_providers: unavailable_providers, lexical: l),
+        value: resolved_tree_of(root: v, symbol_index: symbol_index, closure_declarations: closure_declarations, unavailable_providers: unavailable_providers, member_kinds: member_kinds, lexical: l),
         diagnostics: d
       }
     ResolveWalkRefused { first: f, rest: _, observation: _ } => Rejected { diagnostics: f }
@@ -2662,29 +2763,253 @@ fn resolve_pattern_atom_names_constructor(ctx: ResolveContext, id: Symbol) -> Bo
   }
 }
 
-fn resolve_pattern_binders(ctx: ResolveContext, pat: Node, acc: FrameBinders) -> FrameBinders {
+fn resolve_pattern_binders(ctx: ResolveContext, pat: Node, acc: PatternBindersOutcome) -> PatternBindersOutcome {
   match construct_tag_optional(n: pat) {
     Absent => acc
     Present { value: _ } =>
       fold(construct_field_edges(n: pat), init: acc, f: fn(m, e) {
-        match node_atom_identity_optional(node: e.target) {
-          Present { value: id } =>
-            if is_wildcard_pattern(pattern: e.target) {
-              m
-            } else if resolve_pattern_atom_names_constructor(ctx: ctx, id: id) {
-              m
-            } else {
-              frame_binders_add(fb: m, name: id, binding: LexicalBinding {
-                binder_site: e.target.occurrence_id,
-                declared: optional_absent()
-              })
+        match m {
+          PatternBindersRefused { diagnostic: _ } => m
+          PatternBindersAdmitted { binders: fb } =>
+            match node_atom_identity_optional(node: e.target) {
+              Present { value: id } =>
+                if is_wildcard_pattern(pattern: e.target) {
+                  m
+                } else if resolve_pattern_atom_names_constructor(ctx: ctx, id: id) {
+                  m
+                } else {
+                  match resolve_pattern_binder_declared_type(ctx: ctx, pat: pat, field: e) {
+                    PatternBinderFormal { at: at } =>
+                      PatternBindersRefused {
+                        diagnostic: pattern_payload_formal_uninstantiated_diagnostic(at: at)
+                      }
+                    PatternBinderTyped { node: t } =>
+                      PatternBindersAdmitted {
+                        binders: frame_binders_add(
+                          fb: fb,
+                          name: id,
+                          binding: LexicalBinding {
+                            binder_site: e.target.occurrence_id,
+                            declared: optional_present(value: t),
+                            value: optional_absent()
+                          }
+                        )
+                      }
+                    PatternBinderUntyped =>
+                      PatternBindersAdmitted {
+                        binders: frame_binders_add(
+                          fb: fb,
+                          name: id,
+                          binding: LexicalBinding {
+                            binder_site: e.target.occurrence_id,
+                            declared: optional_absent(),
+                            value: optional_absent()
+                          }
+                        )
+                      }
+                  }
+                }
+              Absent => resolve_pattern_binders(ctx: ctx, pat: e.target, acc: m)
             }
-          Absent => resolve_pattern_binders(ctx: ctx, pat: e.target, acc: m)
         }
       })
   }
 }
 
+// A PATTERN BINDER'S TYPE IS THE VARIANT FIELD IT CAPTURES (v2.compiler.body_lowering_fold
+// body_lower_field_decl_optional). The arm the pattern's tag names declares the field -- positional
+// "0" and named alike, one grammar -- and the binder's declared type is that field's type node, so
+// the body's reference derives from its binding (v2.compiler.infer infer_lexical_reference_facts)
+// instead of staying on the frontier with the match spine. A tag that names no declared arm, or a
+// field the arm does not declare, leaves the binder untyped exactly as before: the match row judges
+// the pattern against the scrutinee's coproduct and refuses the mismatch at the arm row.
+//
+// A field whose type names the DECLARING TYPE's formal is neither of those: the type node exists
+// but names a type nothing instantiates at this stage (the scrutinee's arguments flow into the arm
+// frame only with central deep substitution -- the derivation follow-up). Minting the formal
+// fabricates a type the binder does not have (DESIGN 5), and leaving the binder untyped lets the
+// match frontier ACCEPT the arm as an advisory frontier -- the module prepares and the native lane
+// reports a prepared module whose binder has no type. Both fail open. The binders fold therefore
+// refuses the arm walk here, with the payload field as the location
+// (^resolve_reason_pattern_payload_formal_uninstantiated), and the deep-instantiation follow-up
+// flips this refusal to grounding by installing the scrutinee's arguments.
+type PatternBinderDeclared
+  = PatternBinderTyped { node: Node }
+  | PatternBinderUntyped
+  | PatternBinderFormal { at: Node }
+
+// The binders fold carries the mint's outcome so a formal-typed payload field refuses the walk
+// before any binder is admitted under an invented scope.
+type PatternBindersOutcome
+  = PatternBindersAdmitted { binders: FrameBinders }
+  | PatternBindersRefused { diagnostic: Diagnostic }
+
+fn pattern_payload_formal_uninstantiated_diagnostic(at: Node) -> Diagnostic {
+  Diagnostic {
+    reason: ^resolve_reason_pattern_payload_formal_uninstantiated,
+    at: node_locus(node: at),
+    correction: Unavailable { reason: ExternalContractUnknown }
+  }
+}
+
+// A payload field whose type still names the declaring type's formal is detected against the
+// declaring type's OWN parameter list -- `symbol_index_declared_type_params_at` at the arm's
+// parent path -- so a concrete user type or another declaration's parameter never trips this gate.
+fn resolve_payload_field_type_holds_declaring_formal(
+  ctx: ResolveContext,
+  arm_path: QualifiedName,
+  t: Node
+) -> Bool {
+  resolve_type_node_mentions_any_name(
+    t: t,
+    names: symbol_index_declared_type_params_at(
+      index: ctx.namespace.symbol_index,
+      qualified_path: qualified_name_init(qn: arm_path)
+    )
+  )
+}
+
+fn resolve_type_node_mentions_any_name(t: Node, names: List<Symbol>) -> Bool {
+  match t.kind {
+    TypeNode { connective: Atom { identity: id } } =>
+      any(xs: names, predicate: fn(n) { n == id })
+    TypeNode { connective: _ } =>
+      any(
+        xs: node_positional_child_targets(node: t),
+        predicate: fn(c) { resolve_type_node_mentions_any_name(t: c, names: names) }
+      )
+    ComputationNode { behavior: _ } =>
+      any(
+        xs: node_positional_child_targets(node: t),
+        predicate: fn(c) { resolve_type_node_mentions_any_name(t: c, names: names) }
+      )
+  }
+}
+
+fn resolve_pattern_binder_declared_type(ctx: ResolveContext, pat: Node, field: Edge) -> PatternBinderDeclared {
+  match resolve_pattern_tag_declared_payload_path_optional(ctx: ctx, pat: pat) {
+    Absent => PatternBinderUntyped
+    Present { value: arm_path } =>
+      match symbol_index_lookup(index: ctx.namespace.symbol_index, qualified_path: arm_path) {
+        Absent => PatternBinderUntyped
+        Present { value: payload } =>
+          match field.label {
+            Authored { name: field_name } =>
+              match declared_field_named(payload: payload, name: field_name) {
+                Present { value: f } =>
+                  if resolve_payload_field_type_holds_declaring_formal(
+                    ctx: ctx,
+                    arm_path: arm_path,
+                    t: f.type_node
+                  ) {
+                    PatternBinderFormal { at: field.target }
+                  } else {
+                    PatternBinderTyped { node: f.type_node }
+                  }
+                Absent => PatternBinderUntyped
+              }
+            StructuralLabel { label: _ } => PatternBinderUntyped
+            Positional => PatternBinderUntyped
+          }
+      }
+  }
+}
+
+// The declared arm a pattern's tag names, read BEFORE the walk (the binders mint first, so a
+// refused pattern never leaves the body under an invented scope). A one-segment tag looks up
+// lexically exactly as resolve_pattern_atom_names_constructor does; a qualified tag looks up
+// absolutely; only a candidate the declared-payload authority answers for names an arm.
+fn resolve_pattern_tag_declared_payload_path_optional(ctx: ResolveContext, pat: Node) -> Optional<QualifiedName> {
+  match construct_tag_path_optional(n: pat) {
+    Absent => optional_absent()
+    Present { value: path } =>
+      match path {
+        Cons { head: only, tail: rest } =>
+          match rest {
+            Empty => resolve_declared_payload_path_lookup(ctx: ctx, name: only)
+            Cons { head: _, tail: _ } => resolve_qualified_tag_declared_payload(ctx: ctx, path: path)
+          }
+        Empty => resolve_qualified_tag_declared_payload(ctx: ctx, path: path)
+      }
+  }
+}
+
+// A tag naming more than one segment is a qualified path; a zero-segment tag cannot happen at a
+// pattern (the parser requires a tag), so both non-solo shapes share this lookup.
+fn resolve_qualified_tag_declared_payload(ctx: ResolveContext, path: List<Symbol>) -> Optional<QualifiedName> {
+  match resolve_declared_payload_candidates(
+    ctx: ctx,
+    paths: list_map(
+      xs: symbol_index_absolute_candidates(index: ctx.namespace.symbol_index, qualified_path: path),
+      f: fn(c) { c.path }
+    )
+  ) {
+    Cons { head: only, tail: rest } =>
+      match rest {
+        Empty => optional_present(value: only)
+        Cons { head: _, tail: _ } => optional_absent()
+      }
+    Empty => optional_absent()
+  }
+}
+
+fn resolve_declared_payload_path_lookup(ctx: ResolveContext, name: Symbol) -> Optional<QualifiedName> {
+  match symbol_index_lexical_lookup(
+    index: ctx.namespace.symbol_index,
+    position: symbol_index_lookup_position(ctx: ctx),
+    name: name
+  ) {
+    LexicalHit { node: _, path: path } =>
+      if resolve_path_is_declared_payload(ctx: ctx, path: path) {
+        optional_present(value: path)
+      } else {
+        optional_absent()
+      }
+    LexicalAmbiguous { candidates: candidates } =>
+      resolve_sole_declared_payload_path(ctx: ctx, paths: list_map(xs: candidates, f: fn(c) { c.path }))
+    LexicalUnbound =>
+      match symbol_index_global_unique_lookup(index: ctx.namespace.symbol_index, name: name) {
+        GlobalBareHit { node: _, path: path } =>
+          if resolve_path_is_declared_payload(ctx: ctx, path: path) {
+            optional_present(value: path)
+          } else {
+            optional_absent()
+          }
+        GlobalBareLookupAmbiguous { paths: paths } => resolve_sole_declared_payload_path(ctx: ctx, paths: paths)
+        GlobalBareLookupUnbound => optional_absent()
+      }
+  }
+}
+
+// The declared-payload paths among a candidate set, in lookup order.
+fn resolve_declared_payload_candidates(ctx: ResolveContext, paths: FreeMonoid<QualifiedName>) -> FreeMonoid<QualifiedName> {
+  match paths {
+    Empty => Empty
+    Cons { head: p, tail: rest } =>
+      if resolve_path_is_declared_payload(ctx: ctx, path: p) {
+        Cons { head: p, tail: resolve_declared_payload_candidates(ctx: ctx, paths: rest) }
+      } else {
+        resolve_declared_payload_candidates(ctx: ctx, paths: rest)
+      }
+  }
+}
+
+// An ambiguous tag must not name an arm by candidate order: a binder typed by the first of several
+// declared payloads fabricates a plausible output (DESIGN §5 -- a failure arm refuses, never
+// widens). Exactly one declared-payload candidate names the arm; a wider set leaves the binder
+// untyped, the behaviour that preceded binder typing. The arm the binder means is settled by the
+// scrutinee's coproduct at infer, not by name order here.
+fn resolve_sole_declared_payload_path(ctx: ResolveContext, paths: List<QualifiedName>) -> Optional<QualifiedName> {
+  match resolve_declared_payload_candidates(ctx: ctx, paths: paths) {
+    Cons { head: only, tail: rest } =>
+      match rest {
+        Empty => optional_present(value: only)
+        Cons { head: _, tail: _ } => optional_absent()
+      }
+    Empty => optional_absent()
+  }
+}
+
 // The pat resolves under the ARM frame: the tag and any nested constructor resolve as
 // references, a binder answers BoundInFrame and stays itself, and the wildcard is kept as it is.
 //
@@ -3294,15 +3619,21 @@ fn resolve_match_arm_walk(ctx: ResolveContext, arm: Node) -> ResolveNodeWalk {
     Accepted { value: pat, diagnostics: _ } =>
       match gate_value_binders(names: pattern_binder_name_list(ctx: ctx, pat: pat), outer: ctx.scope, at: pat) {
         BinderGateRefused { diagnostic: d } => resolve_walk_refused_one(chain: diagnostics_singleton(d: d))
-        BinderGateAdmitted => resolve_match_arm_admitted(ctx: ctx, arm: arm, pat: pat)
+        BinderGateAdmitted =>
+          match resolve_pattern_binders(ctx: ctx, pat: pat, acc: PatternBindersAdmitted { binders: frame_binders_empty() }) {
+            PatternBindersRefused { diagnostic: d } =>
+              resolve_walk_refused_one(chain: diagnostics_singleton(d: d))
+            PatternBindersAdmitted { binders: fb } =>
+              resolve_match_arm_admitted(ctx: ctx, arm: arm, pat: pat, fb: fb)
+          }
       }
   }
 }
 
-fn resolve_match_arm_admitted(ctx: ResolveContext, arm: Node, pat: Node) -> ResolveNodeWalk {
+fn resolve_match_arm_admitted(ctx: ResolveContext, arm: Node, pat: Node, fb: FrameBinders) -> ResolveNodeWalk {
   let arm_ctx = resolve_ctx_with_scope(
     ctx: ctx,
-    scope: lexical_frame(fb: resolve_pattern_binders(ctx: ctx, pat: pat, acc: frame_binders_empty()), outer: ctx.scope)
+    scope: lexical_frame(fb: fb, outer: ctx.scope)
   )
   child_walk_node(n: arm, w: fold(arm.children, init: child_walk_init(), f: fn(acc, e) {
     child_walk_step(
@@ -3529,9 +3860,11 @@ fn resolve_type_application_diagnostic(reason: Symbol, at: Node) -> Diagnostic {
 // it must name a coproduct, and an argument inhabits it exactly when the argument resolves to one of
 // that coproduct's variants -- by the DECLARATION the index holds, never by leaf spelling. A unique
 // variant referenced bare resolves to its module-level path (p.Pointer), which
-// v2.compiler.symbol_index_fill symbol_index_fill_unique_variant_aliases files as a second ENTRY over
-// the same arm node rather than as a binding to p.Resolution.Pointer, so
-// symbol_index_declaring_path_of cannot relate the two paths; the arm node they share can. A Nat literal and a type
+// v2.compiler.symbol_index_fill symbol_index_fill_containment_node files as a BINDING to the
+// variant's declaring path (p.Resolution.Pointer) -- the repair the receipt
+// a_binding_position_recorded_as_a_declaring_identity names, landed here: the alias was a second
+// ENTRY over the same arm node, which was the double-entry defect that row describes, and
+// symbol_index_declaring_path_of now relates the two paths with no parallel carrier map. A Nat literal and a type
 // parameter of an enclosing declaration are not judged (v2.std.type_binder KindInhabitance).
 fn resolve_kind_inhabitance(ctx: ResolveContext, declaration: QualifiedName, argument: Node, kind: Node) -> KindInhabitance {
   if dag_node_is_int_literal_atom(node: argument) {
@@ -4113,6 +4446,12 @@ fn resolve_node_consumes_expectation(n: Node) -> Bool {
 // parameters under -- so its value frame is a ParameterFrame over that path. Nothing below an Arrow
 // is containment: its body, codomain and domain walk NotDeclaring, so an Arrow met there (a lambda)
 // opens a LexicalFrame.
+// THE DECLARED PERMITTED-CALLERS CLAUSE IS CARRIED UNWALKED, like the declared order below it:
+// its target is the clause's preserved spelling, evidence about the source rather than value
+// content, and walking it would resolve the list's decl_ref constructor as a reference. Its
+// reader is the caller-admission consumer (v2.compiler.infer infer_caller_admission_diags) and
+// its structural check is the Arrow wall's at-most-once guard
+// (v2.std.node arrow_signature_edges_conform).
 fn resolve_arrow_node_in(outer_ctx: ResolveContext, ctx: ResolveContext, n: Node) -> ResolveNodeWalk {
   match gate_value_binders(names: arrow_domain_binder_name_list(n: n), outer: ctx.scope, at: n) {
     BinderGateRefused { diagnostic: d } => resolve_walk_refused_one(chain: diagnostics_singleton(d: d))
@@ -4140,7 +4479,7 @@ fn resolve_arrow_node_admitted(outer_ctx: ResolveContext, ctx: ResolveContext, n
           child_walk_step(w: acc, e: e, r: ResolveWalkAccepted { value: e.target, diagnostics: None, lexical: [] })
         } else if edge_is_core(e: e, marker: ArrowResourceRequirementsEdge) {
           child_walk_step(w: acc, e: e, r: resolve_arrow_resource_requirements(ctx: resolve_ctx_with_scope(ctx: inner_ctx, scope: scope_type), requirements: e.target))
-        } else if arrow_named_edge_is_contract(e: e) {
+        } else if arrow_named_edge_is_metadata(e: e) {
           child_walk_step(w: acc, e: e, r: ResolveWalkAccepted { value: e.target, diagnostics: None, lexical: [] })
         } else {
           child_walk_step(
@@ -4409,7 +4748,10 @@ fn resolve_with_namespace_policy(
   lm: LanguageModel,
   policy: NameResolutionPolicy
 ) -> Outcome<ResolvedTree> {
-  resolved_tree_outcome(
+  match member_kind_channel_of_tree(tree: tree) {
+    Rejected { diagnostics: r } => Rejected { diagnostics: r }
+    Accepted { value: channel, diagnostics: _ } =>
+      resolved_tree_outcome(
     w: resolve_walk_with_namespace_policy(
       tree: tree,
       namespace: namespace,
@@ -4418,8 +4760,10 @@ fn resolve_with_namespace_policy(
     ),
     symbol_index: namespace.symbol_index,
     closure_declarations: empty_symbol_index(),
-    unavailable_providers: []
+    unavailable_providers: [],
+    member_kinds: channel
   )
+  }
 }
 
 fn resolve_walk_with_namespace_policy(
diff --git a/src/v2/compiler/04_infer.dag b/src/v2/compiler/04_infer.dag
index 93fcded72d2..2a3d15241b5 100644
--- a/src/v2/compiler/04_infer.dag
+++ b/src/v2/compiler/04_infer.dag
@@ -4,8 +4,8 @@ import std.types { List }
 
 import std.occurrence_identity { OccurrenceSynthetic }
 import std.kind { Kind, RosterKindIndex, TypeDenotationKind, kind_denoted_by_node, kind_node, roster_kind_index, roster_kind_index_lookup }
-import v2.std.algebra { any, Empty, TailAbsent, TailFound, length, list_map, list_tail, zip_map }
-import std.algebra { Cons, Empty, list_snoc_item }
+import v2.std.algebra { any, Empty, TailAbsent, TailFound, length, list_map, list_tail, skip, zip_map }
+import std.algebra { Cons, Empty, FreeMonoid, list_snoc_item }
 import v2.std.bounded_lattice_completeness {
   infer_bounded_lattice_consumer_gate,
   partial_bounded_lattice_instances_in_tree
@@ -17,9 +17,11 @@ import v2.std.compilers.target_model {
   canonical_operation_op_add,
   canonical_operation_op_coerce,
   canonical_operation_wire_matches_operation,
+  canonical_operation_op_sub,
   target_model_canonical_operation_member_declared_type,
 }
 import v2.compiler.resolve { ResolvedTree, resolved_tree_lexical_binding, resolved_tree_unavailable_provider }
+import v2.std.grammar { node_atom_identity_optional }
 import v2.compiler.inferred_tree {
   DerivedGrounding,
   GroundingNotDerived,
@@ -31,6 +33,9 @@ import v2.compiler.inferred_tree {
 }
 import v2.std.algebra_structure_signature { FieldDeclared, FieldNotDeclared, InhabitanceFieldRead, InhabitanceFieldReadMalformed, InhabitanceMalformed, algebra_inhabitance_field_reading }
 import v2.std.model_core { AlgebraInhabitanceDecl }
+import std.literal_elaboration { DirectLiteral, HomomorphismDuplicated, KernelGroundingAbsent, KernelGroundingAmbiguous, KernelGroundingFound, KernelIntLiteral, LiteralElaborationRefusal, LiteralElaborationRefused, ViaHomomorphism, elaborate_literal_at, kernel_grounding_admits, kernel_grounding_for }
+import gunbc.structural_realization_bindings { kernel_grounding_rows, literal_homomorphism_rows }
+import std.decl_ref { DeclarationRef, decl_ref }
 import v2.std.grammar { node_atom_identity_optional }
 import v2.extdeps.languages.dag {
   dag_algebra_inhabitance_decls,
@@ -40,10 +45,13 @@ import v2.extdeps.languages.dag {
   DagCanonicalStringLiteral,
   DagCanonicalLiteral,
   dag_binding_denotation,
+  dag_kernel_type_declaration_binding_optional,
   dag_canonical_literal_from_node,
   dag_declared_inhabitants_root,
   dag_declared_inhabitants_subject_field,
-  dag_grammar_production_member_declared_type
+  dag_grammar_production_member_declared_type,
+  parse_production_captured_child_optional,
+  qualified_name_from_module_node
 }
 import v2.extdeps.languages.python {
   python_declared_inhabitants_root,
@@ -69,12 +77,13 @@ import std.optional {
   optional_absent,
   optional_present
 }
-import v2.std.qualified_name { QualifiedName, declaration_reference_node, declaration_reference_path_optional, qualified_name_to_dotted_string, lexical_reference_label_optional, parameter_reference_path_optional }
-import v2.std.node_query { BinderParts, binder_node, binder_node_parts, construct_field_edges, construct_tag_optional, declared_field_from_edge, find_labeled_child }
-import v2.std.symbol_index { RecordTypePayload, SymbolIndex, VariantArmPayload, symbol_index_declared_payload_at, symbol_index_declared_type_params_at, symbol_index_lookup }
+import v2.std.qualified_name { QualifiedName, declaration_reference_node, declaration_reference_path_optional, qualified_name_to_dotted_string, lexical_reference_label_optional, parameter_reference_path_optional, qualified_name_init, qualified_name_last_segment }
+import v2.std.node_query { BinderParts, binder_node, binder_node_parts, construct_field_edges, construct_tag_optional, construct_tag_path_optional, declared_field_from_edge, declared_field_named, find_labeled_child, find_named_child, arrow_constant_member_codomain }
+import v2.std.compilers.sugar { sugar_sequence_pair_optional }
+import v2.std.symbol_index { RecordTypePayload, SymbolIndex, VariantArmPayload, symbol_index_declared_payload_at, symbol_index_declared_type_params_at, symbol_index_declares_primitive_contract_at, symbol_index_lookup }
 import v2.std.grammar { node_atom_identity_optional }
 import v2.compiler.fold_lowering { FoldMemberFormal, RosterSignatureLookup, NotARosterPrimitiveCallRow, RosterPrimitiveCallSignature, RosterPrimitiveCallSignatureUnreadable, collection_roster_primitive_call_signature_at, FoldMemberRole, FoldStepTakesCollectionMember, FoldStepTakesNoMember, fold_collection_member_type, fold_loop_step, fold_realized_member_role, fold_step_body_node, fold_step_carrier_formal, fold_step_declared_return, fold_step_member_formal }
-import v2.std.node { LoopBoundMeasure, LoopCarrierBinder, LoopDomainValue, LoopEdgeUnrecognized, LoopIteratedBody, LoopRealizedDeclaration, loop_edge_role, NodeFoldDependent, fold_node_dependent, loop_domain_value_target, loop_realized_declaration_target, Ambiguous, Found, NotMarkedReference, arrow_body_target_lookup, arrow_named_edge_is_contract, arrow_signature_order_edge, match_arm_pattern_edge, resolved_reference_body_kind, edge_label_of, MatchArmBodyEdge, MatchArmPatternEdge, production_edge_label }
+import v2.std.node { symbol_lexeme, LoopBoundMeasure, LoopCarrierBinder, LoopDomainValue, LoopEdgeUnrecognized, LoopIteratedBody, LoopRealizedDeclaration, loop_edge_role, NodeFoldDependent, fold_node_dependent, loop_domain_value_target, loop_realized_declaration_target, AdmitCallersEdge, Ambiguous, DeclarationReferenceKind, Found, MarkedReference, NodeFoldTopDown, NotMarkedReference, Symbol, arrow_body_target_lookup, arrow_named_edge_is_contract, arrow_named_edge_is_metadata, arrow_signature_order_edge, core_edge_target_lookup, edge_label_of, fold_node_topdown, match_arm_pattern_edge, MatchArmBodyEdge, MatchArmPatternEdge, node_subtree_nodes, production_edge_label, resolved_reference_body_kind, symbol_eq, symbol_intern_lexeme }
 import v2.std.list_introduction { list_introduction_elements_optional, list_introduction_head_path }
 import v2.std.arrow_signature {
   ApplicationBindingRefused,
@@ -120,6 +129,7 @@ import v2.std.inhabitance {
   position_record_field,
   position_let_annotation,
   position_direct_call_argument,
+  position_match_coverage,
   undecidable_argument_type_not_derived,
   undecidable_formal_unresolved,
   undecidable_where_predicate_subject_unmodelled
@@ -130,6 +140,7 @@ import v2.std.diagnostic {
   ExternalContractUnknown,
   Locus,
   NonEmptyDiagnostics,
+  Suggested,
   UserInputBoundary,
   node_locus,
   Outcome,
@@ -146,11 +157,15 @@ import v2.std.diagnostic {
   outcome_accepted,
   rejected_with_pending
 }
+import v2.std.integer { integer_int_type_node }
 import v2.std.logic { bool_node }
 import v2.std.node {
   StructuralLabel,
+  symbol_intern_lexeme,
   host_text_type_node,
   symbol_type_node,
+  node_rebuild,
+  node_with_occurrence_id,
   Arrow,
   Atom,
   Bind,
@@ -170,6 +185,7 @@ import v2.std.node {
   Symbol,
   Transform,
   TypeNode,
+  is_empty_conj_root,
   Value,
   Ambiguous,
   Found,
@@ -185,11 +201,15 @@ import v2.std.type_binder { GenericTypeDecl, OpaqueTypeDecl, PlainTypeDecl, Type
 import v2.std.coercion { coercion_cast_crossing }
 import v2.std.node_query {
   FieldProjection,
+  NamedChildAmbiguous,
+  NamedChildFound,
+  NamedChildMissing,
   construct_tag_path_optional,
   declared_field_named,
   field_projection_optional,
   find_core_child,
   find_named_child,
+  named_child_lookup,
   node_positional_child_targets,
   pattern_wildcard_name
 }
@@ -413,6 +433,17 @@ fn infer_match_non_exhaustive_diagnostic(node: Node) -> Diagnostic {
   }
 }
 
+// Undecided exhaustiveness is not exhaustiveness: coverage fails closed (DESIGN 5 -- a failure arm
+// refuses, never widens), and the refusal names its own reason rather than the non-exhaustive one,
+// because the relation did not decide the arms wrong; it could not decide them.
+fn infer_match_coverage_undecidable_diagnostic(node: Node) -> Diagnostic {
+  Diagnostic {
+    reason: ^infer_match_coverage_undecidable,
+    at: node_locus(node: node),
+    correction: Unavailable { reason: ExternalContractUnknown }
+  }
+}
+
 fn infer_transform_shape_invalid_diagnostic(node: Node) -> Diagnostic {
   Diagnostic {
     reason: ^infer_transform_shape_invalid,
@@ -710,7 +741,7 @@ fn infer_product_child_evidence_edges(
   infer_formation_child_evidence_edges(
     children: node.children,
     entries: entries,
-    is_metadata: fn(edge) { arrow_signature_order_edge(parent: node, edge: edge) || arrow_named_edge_is_contract(e: edge) }
+    is_metadata: fn(edge) { arrow_signature_order_edge(parent: node, edge: edge) || arrow_named_edge_is_metadata(e: edge) }
   )
 }
 
@@ -1156,14 +1187,16 @@ fn infer_field_projection_facts(
               outcome_rejected(infer_receiver_declares_no_fields_diagnostic(node: node))
             ReceiverDeclarationUnavailable { path: path } =>
               Rejected { diagnostics: infer_closure_miss_refusal(resolved: resolved, path: path, miss: infer_receiver_declaration_unavailable_diagnostic(node: node)) }
-            ReceiverPayload { payload: payload } =>
+            ReceiverArityMismatch =>
+              outcome_rejected(infer_receiver_arity_mismatch_diagnostic(node: node))
+            ReceiverPayload { payload: payload, instances: instances } =>
               match declared_field_named(payload: payload, name: projection.field) {
                 Present { value: declared } =>
                   bind_outcome_accepted(
                     od: cd,
                     inner: inferred_facts_from_derived_type(
                       node: node,
-                      derived_type: declared.type_node,
+                      derived_type: infer_projected_field_type(field_type: declared.type_node, instances: instances),
                       descent: Holds { value: descent_proof }
                     )
                   )
@@ -1175,6 +1208,30 @@ fn infer_field_projection_facts(
   }
 }
 
+// A FIELD OF AN INSTANTIATED GENERIC RECORD HAS ITS DECLARED TYPE AT THIS INSTANTIATION. A receiver
+// typed Box<Int> reads Box's payload and binds Box's type parameters to the application's arguments in
+// declared order, the same pairing infer_match_coproduct_of_type uses for a matched coproduct, so a field
+// declared `item: T` projects as Int. A non-generic receiver binds nothing and keeps its field type
+// exactly as declared.
+fn infer_projected_field_type(field_type: Node, instances: List<TypeVariableInstance>) -> Node {
+  if length(xs: instances) == 0 {
+    field_type
+  } else {
+    infer_type_instantiated(t: field_type, instances: instances)
+  }
+}
+
+// AN APPLICATION WHOSE ARGUMENT COUNT DIFFERS FROM ITS HEAD'S DECLARED PARAMETERS has no instantiation
+// to read a field at; that is a decided defect of the receiver's type, refused at the projection, never
+// read past or left at the frontier.
+fn infer_receiver_arity_mismatch_diagnostic(node: Node) -> Diagnostic {
+  Diagnostic {
+    reason: ^infer_reason_projection_receiver_type_arity_mismatch,
+    at: node_locus(node: node),
+    correction: Unavailable { reason: UserInputBoundary }
+  }
+}
+
 fn infer_field_not_declared_diagnostic(node: Node) -> Diagnostic {
   Diagnostic {
     reason: ^infer_reason_field_not_declared_on_receiver,
@@ -1222,8 +1279,9 @@ fn infer_field_not_declared_diagnostic(node: Node) -> Diagnostic {
 // never a claim about the receiver's fields. The arm carries the path so a reader can name the declaration
 // that could not be retrieved.
 type ProjectionReceiver
-  = ReceiverPayload { payload: Node }
+  = ReceiverPayload { payload: Node, instances: List<TypeVariableInstance> }
   | ReceiverTypeNotADeclaration
+  | ReceiverArityMismatch
   | ReceiverDeclarationUnavailable { path: QualifiedName }
   | ReceiverTypeUnderived
 
@@ -1238,13 +1296,37 @@ fn infer_projection_receiver(
       match inferred_facts_resolved_type(facts: base_facts) {
         Violates { diagnostic: _ } => ReceiverTypeUnderived
         Holds { value: receiver_type } =>
-          match declaration_reference_path_optional(node: receiver_type) {
-            Absent => ReceiverTypeNotADeclaration
-            Present { value: path } =>
-              match symbol_index_lookup(index: resolved.resolved_declarations, qualified_path: path) {
-                Absent => ReceiverDeclarationUnavailable { path: path }
-                Present { value: payload } => ReceiverPayload { payload: payload }
+          infer_projection_receiver_of_type(receiver_type: receiver_type, declarations: resolved.resolved_declarations)
+      }
+  }
+}
+
+// THE RECEIVER'S DECLARATION AND INSTANTIATION, FROM ITS ESTABLISHED TYPE. A plain declaration
+// reference binds nothing; an application binds the head's declared type parameters to its arguments
+// in declared order. Separate from the facts lookup above so the type-to-payload step is judged on its
+// own inputs.
+fn infer_projection_receiver_of_type(receiver_type: Node, declarations: SymbolIndex) -> ProjectionReceiver {
+  let head_args = infer_type_head_and_args(t: receiver_type)
+  match declaration_reference_path_optional(node: head_args.head) {
+    Absent => ReceiverTypeNotADeclaration
+    Present { value: path } =>
+      match symbol_index_lookup(index: declarations, qualified_path: path) {
+        Absent => ReceiverDeclarationUnavailable { path: path }
+        Present { value: payload } =>
+          if length(xs: head_args.args) == 0 {
+            ReceiverPayload { payload: payload, instances: infer_no_type_variable_instances() }
+          } else {
+            let params = symbol_index_declared_type_params_at(index: declarations, qualified_path: path)
+            if length(xs: params) != length(xs: head_args.args) {
+              ReceiverArityMismatch
+            } else {
+              ReceiverPayload {
+                payload: payload,
+                instances: zip_map(a: params, b: head_args.args, f: fn(p, arg) {
+                  TypeVariableInstance { binder: p, instance: arg }
+                })
               }
+            }
           }
       }
   }
@@ -1445,7 +1527,7 @@ fn infer_declaration_reference_facts_indexed(
                 o: infer_facts_denoting(
                   o: inferred_facts_from_derived_type(
                     node: n,
-                    derived_type: callable,
+                    derived_type: infer_reference_value_type(callable: callable),
                     descent: Holds { value: descent_proof }
                   ),
                   declaration: declared
@@ -1457,6 +1539,18 @@ fn infer_declaration_reference_facts_indexed(
       }
 }
 
+// A REFERENCE TO A `data` CONSTANT USES ITS VALUE, so it is typed at the constant's declared type, the
+// codomain of the Arrow body lowering realizes it as (v2.std.node_query arrow_constant_member_codomain
+// reads the ConstantMemberEdge marker that arm writes). Any other callable -- a nullary fn included --
+// denotes its function and is typed as the Arrow, exactly as before. The denotation recorded beside
+// either is the declaration, so eval applies the constant through the same declaration infer typed.
+fn infer_reference_value_type(callable: Node) -> Node {
+  match arrow_constant_member_codomain(arrow: callable) {
+    Present { value: declared_type } => declared_type
+    Absent => callable
+  }
+}
+
 // THE DENOTATION IS RECORDED HERE AND NOWHERE ELSE, because here is where the GUARDED reader answered.
 // eval cannot ask symbol_index_lookup -- it holds no index -- so without this the only routes open to
 // it are a weaker second resolution authority over the tree (which would accept references the guard
@@ -1676,6 +1770,45 @@ fn infer_arrow_declared_return_type(arrow: Node) -> Optional<Node> {
   }
 }
 
+// A CALL'S RESULT HAS THE TYPE ITS CALLEE DECLARES, KERNEL OR NOT. infer_arrow_declared_return_type
+// knows only the kernel value types (and Bool by authority), so a callee declared to return a
+// corpus type -- Nat, Outcome<ParseArtifact> -- answered Absent, the call stayed underived, and every
+// declared position it reached accepted it as undecidable. Every other declared type in this
+// stage is already used as written (a parameter's declared node, a lexical binding's instantiated
+// declaration); this reader now does the same. The kernel answer is consulted FIRST, so the Int and
+// Bool paths are byte-identical. Otherwise the declared return node, alias-normalized through the one
+// normalization (#13187) and instantiated with the instances the argument walk bound at THIS site, is
+// the result. A return that still mentions one of the callee's own type parameters after
+// instantiation is not derived (the counted frontier) -- never a fabricated instance; nor is a return
+// that is not a type node.
+fn infer_application_result_type(
+  arrow: Node,
+  instances: List<TypeVariableInstance>,
+  declarations: SymbolIndex
+) -> Optional<Node> {
+  match infer_arrow_declared_return_type(arrow: arrow) {
+    Present { value: kernel } => Present { value: kernel }
+    Absent =>
+      match list_at_optional(xs: node_positional_child_targets(node: arrow), index: 1) {
+        Absent => Absent
+        Present { value: ret } =>
+          match ret.kind {
+            TypeNode { connective: _ } =>
+              let declared = infer_type_instantiated(
+                t: infer_type_alias_normalized(t: ret, declarations: declarations),
+                instances: instances
+              )
+              if inhabitance_node_mentions_type_variable(n: declared, type_variables: type_param_names(n: arrow)) {
+                optional_absent()
+              } else {
+                optional_present(value: declared)
+              }
+            ComputationNode { behavior: _ } => optional_absent()
+          }
+      }
+  }
+}
+
 fn infer_atom_binding_sym(node: Node) -> Optional<Symbol> {
   node_atom_identity_optional(node: node)
 }
@@ -1780,15 +1913,194 @@ fn refinement_declared_carrier(index: SymbolIndex, source_type: Node) -> Optiona
 // unequal and were reported as an arm-type mismatch, while two structurally identical arms
 // compared equal and were reported as unified — both verdicts about node identity, not types.
 
+// A LET BINDER CARRIES NO DECLARED TYPE; ITS TYPE IS ITS VALUE'S. The binding names the binder
+// occurrence (binder_site), and the Bind node that owns it holds the value expression whose facts
+// the fold already derived — so an operand that reads the binder derives the value's type instead
+// of the GroundingNotDerived frontier (gunbc.recurring_failure_mode
+// native_infer_accepts_only_bool_and_int_match_scrutinees: the enrolled variant claims' scrutinees
+// are let-bound). A pattern binder or any other declared-less binding that is not a Bind still
+// falls through to the facts.
+// THE PUBLIC READ stays three-argument: an external caller holds the InferredTree only, whose
+// facts are an opaque partial function, so the construct-facts entries thread is not recoverable
+// there and the read falls back to the facts alone (the let-typed rule needs the entries). The
+// four-argument read below is the inference-internal form, threaded through construct reads.
 fn infer_branch_operand_resolved_type_in_tree(
   node: Node,
   facts: InferredFacts,
   resolved: ResolvedTree,
+) -> Witness<Node> {
+  infer_branch_operand_resolved_type_with_entries(
+    node: node,
+    facts: facts,
+    entries: Empty,
+    instances: infer_no_type_variable_instances(),
+    resolved: resolved
+  )
+}
+
+fn infer_branch_operand_resolved_type_with_entries(
+  node: Node,
+  facts: InferredFacts,
+  entries: List<InferredFactsEntry>,
+  instances: List<TypeVariableInstance>,
+  resolved: ResolvedTree,
 ) -> Witness<Node> {
   match dag_canonical_literal_from_node(node: node) {
     Accepted { value: literal, diagnostics: _ } =>
       infer_binding_value_type_witness(binding: infer_literal_type_binding(literal: literal), at: node)
-    Rejected { diagnostics: _ } => inferred_facts_resolved_type(facts: facts)
+    Rejected { diagnostics: _ } =>
+      match resolved_tree_lexical_binding(tree: resolved, reference: node) {
+        Present { value: binding } =>
+          match binding.declared {
+            Present { value: declared } =>
+              match infer_operand_declared_type_instantiated(declared: declared, instances: instances) {
+                Present { value: instantiated } => Holds { value: instantiated }
+                Absent =>
+                  match infer_let_binder_value_type_optional(entries: entries, binding: binding) {
+                    Present { value: value_type } => Holds { value: value_type }
+                    Absent => inferred_facts_resolved_type(facts: facts)
+                  }
+              }
+            Absent =>
+              match infer_let_binder_value_type_optional(entries: entries, binding: binding) {
+                Present { value: value_type } => Holds { value: value_type }
+                Absent => inferred_facts_resolved_type(facts: facts)
+              }
+          }
+        Absent => inferred_facts_resolved_type(facts: facts)
+      }
+  }
+}
+
+// THE DECLARED TYPE AN OPERAND READS IS THE INSTANTIATED ONE. The lexical facts instantiate a
+// binding's declared type with infer_frame_instantiated before deriving from it; a read that
+// preempts the facts with the raw declared node skips exactly that step, so a generic coproduct's
+// field (`Some { value: T }`) would hand the arm body the formal `T` instead of the scrutinee's
+// argument (DESIGN 5: no fabricated plausible output). The instantiation is the one the construct
+// read holds -- at a match, the scrutinee coproduct's instances. An atom no instance binds is held
+// only when it names a type-denoting binding (a concrete literal type, by the same
+// dag_binding_denotation test the facts fold applies); a free formal is NOT held -- the read falls
+// through to the facts, the answer the caller had before the read existed.
+fn infer_operand_declared_type_instantiated(declared: Node, instances: List<TypeVariableInstance>) -> Optional<Node> {
+  match declared.kind {
+    TypeNode { connective: Atom { identity: id } } =>
+      match type_variable_instance_lookup(instances: instances, binder: id) {
+        Present { value: instance } => optional_present(value: instance)
+        Absent =>
+          match dag_binding_denotation(sym: id) {
+            Present { value: _ } =>
+              match infer_declared_type_children_instantiated(children: declared.children, instances: instances) {
+                Present { value: children } =>
+                  if length(xs: children) == 0 {
+                    optional_present(value: declared)
+                  } else {
+                    optional_present(
+                      value: node_with_occurrence_id(
+                        kind: TypeNode { connective: Atom { identity: id } },
+                        children: children,
+                        occurrence_id: declared.occurrence_id
+                      )
+                    )
+                  }
+                Absent => optional_absent()
+              }
+            Absent => optional_absent()
+          }
+      }
+    TypeNode { connective: _ } =>
+      if any(
+        xs: node_positional_child_targets(node: declared),
+        predicate: fn(c) { infer_declared_type_mentions_free_formal(declared: c, instances: instances) }
+      ) {
+        optional_absent()
+      } else {
+        optional_present(value: declared)
+      }
+    ComputationNode { behavior: _ } =>
+      if any(
+        xs: node_positional_child_targets(node: declared),
+        predicate: fn(c) { infer_declared_type_mentions_free_formal(declared: c, instances: instances) }
+      ) {
+        optional_absent()
+      } else {
+        optional_present(value: declared)
+      }
+  }
+}
+
+// Whether a type node still names a formal no instance binds, anywhere in it. A concrete type
+// (every atom either instantiated or type-denoting) is safe to hold as written; a node carrying a
+// free formal is not, whatever connective wraps it.
+fn infer_declared_type_mentions_free_formal(declared: Node, instances: List<TypeVariableInstance>) -> Bool {
+  match declared.kind {
+    TypeNode { connective: Atom { identity: id } } =>
+      match type_variable_instance_lookup(instances: instances, binder: id) {
+        Present { value: _ } => false
+        Absent =>
+          match dag_binding_denotation(sym: id) {
+            Present { value: _ } => false
+            Absent => true
+          }
+      }
+    TypeNode { connective: _ } =>
+      any(
+        xs: node_positional_child_targets(node: declared),
+        predicate: fn(c) { infer_declared_type_mentions_free_formal(declared: c, instances: instances) }
+      )
+    ComputationNode { behavior: _ } =>
+      any(
+        xs: node_positional_child_targets(node: declared),
+        predicate: fn(c) { infer_declared_type_mentions_free_formal(declared: c, instances: instances) }
+      )
+  }
+}
+
+// Substitution descends through the arguments: a compound declared type
+// (`Box<T>`, `FreeMonoid<T>`) is not held with a formal riding inside it -- an argument no
+// instance binds leaves the whole declared type unheld, and the read falls through to the facts
+// rather than fabricate a partially formal type.
+fn infer_declared_type_children_instantiated(
+  children: FreeMonoid<Edge>,
+  instances: List<TypeVariableInstance>
+) -> Optional<FreeMonoid<Edge>> {
+  match children {
+    Empty => optional_present(value: Empty)
+    Cons { head: c, tail: rest } =>
+      match infer_operand_declared_type_instantiated(declared: c.target, instances: instances) {
+        Present { value: c2 } =>
+          match infer_declared_type_children_instantiated(children: rest, instances: instances) {
+            Present { value: rest2 } =>
+              optional_present(value: Cons { head: Edge { label: c.label, target: c2 }, tail: rest2 })
+            Absent => Absent
+          }
+        Absent => Absent
+      }
+  }
+}
+
+// THE LET'S VALUE IS THE LET'S TYPE. The binding carries the value node beside the binder site --
+// resolve's Bind frame mints it where the Bind node is in hand -- so the read is one map entry and
+// one fold-entry lookup, never a tree walk. Absent -- the binding carries no value (a parameter or
+// pattern binder), or the value's own facts are underived, as for a let over a still-frontier
+// expression -- leaves the caller's answer exactly as it stood.
+fn infer_let_binder_value_type_optional(
+  entries: List<InferredFactsEntry>,
+  binding: LexicalBinding,
+) -> Optional<Node> {
+  match binding.value {
+    Absent => optional_absent()
+    Present { value: value_target } =>
+      match lookup_inferred_facts_in_entries(entries: entries, key: value_target) {
+        Absent => optional_absent()
+        Present { value: facts } => inferred_facts_resolved_type_optional(facts: facts)
+      }
+  }
+}
+
+fn inferred_facts_resolved_type_optional(facts: InferredFacts) -> Optional<Node> {
+  match facts.grounding {
+    DerivedGrounding { grounding: g } => optional_present(value: g.witness.structural.evidence)
+    GroundingNotDerived { node: _ } => optional_absent()
   }
 }
 
@@ -1853,9 +2165,9 @@ fn infer_branch_type_is_int(type_node: Node) -> Bool {
 // 0/1 authority as eval allocate_literal), not a post-unification rewrite. dissolve-on: bool
 // keywords carry Int type in Int-valued match bodies at normalize/ingest. scaffold-widen: Int
 // scrutinee on bool-literal match emits infer_match_int_scrutinee_bool_literal_scaffold diagnostic
-// (countable on Accepted path). paired-scaffold: emit half =
-// target_value_expr_int_bool_octet_channel_dissolution_note (target_model.dag) — dissolve both
-// halves together on octet↔bool codec inhabitation.
+// (countable on Accepted path). emit match-seam production was uprooted after the Bool de-fork
+// (target_value_expr_int_bool_octet_channel_dissolution_note). Dissolve this diagnostic on
+// octet↔bool codec inhabitation.
 
 fn infer_match_bool_consumer_diagnostics_with_int_scrutinee_scaffold(
   consumer: Node,
@@ -1965,6 +2277,71 @@ fn infer_match_bool_arm_rows_accept(
   }
 }
 
+// THE ARMS' COVERED CARRIER, JUDGED BY THE ONE RELATION. The covered carrier is the scrutinee
+// coproduct's own alternative edges, rebuilt with only the alternatives the arms name, in
+// declaration order -- arm order and arm repetition cannot flatter the answer, and the relation
+// (declared_type_inhabitance over PositionMatchCoverage) answers exhaustive exactly when the
+// carrier structurally equals the whole coproduct. A wildcard arm covers every alternative, so it
+// contributes the whole coproduct. This replaces the per-tag inline count
+// (infer_coproduct_rows_cover) that stood in while the relation's carrier was missing:
+// gunbc.recurring_failure_mode native_infer_accepts_only_bool_and_int_match_scrutinees.
+//
+// The obligation carries no type variables because neither carrier poses an instantiation
+// question: both are projections of the same declaration (the declared Disj and a subset of its
+// edges), so the exact-structural-equality fold compares atom-for-atom within one declaration and
+// its verdict cannot depend on how the parameters are instantiated at the scrutinee.
+fn infer_coproduct_coverage_obligation(
+  node: Node,
+  scrutinee_target: Node,
+  coproduct: InferMatchCoproduct,
+  rows: List<InferCoproductArmRow>,
+) -> Outcome<Node> {
+  let covered_children = fold(coproduct.variants.children, init: Empty, f: fn(acc, e) {
+    match e.label {
+      Authored { name: variant_tag } =>
+        if any(xs: rows, predicate: fn(row) {
+          match row.covers {
+            CoversAll => true
+            CoversVariant { tag: t } => t == variant_tag
+          }
+        }) {
+          list_snoc_item(xs: acc, item: e)
+        } else {
+          acc
+        }
+      StructuralLabel { label: _ } => acc
+      Positional => acc
+    }
+  })
+  let covered_carrier = node_rebuild(n: coproduct.variants, children: covered_children)
+  match declared_type_inhabitance(
+    obligation: DeclaredTypeObligation {
+      position: position_match_coverage(match_node: node, scrutinee: scrutinee_target),
+      parameter_identity: infer_coproduct_coverage_parameter_identity(coproduct: coproduct),
+      declared: coproduct.variants,
+      produced: covered_carrier,
+      produced_declared_carrier: Absent,
+      application: node,
+      type_variables: Empty
+    }
+  ) {
+    Inhabits { homomorphism: _ } => outcome_accepted(value: covered_carrier)
+    InhabitanceUndecidable { reason: _ } =>
+      outcome_rejected(infer_match_coverage_undecidable_diagnostic(node: node))
+    InhabitanceRefused { find_witness_reason: _ } =>
+      outcome_rejected(infer_match_non_exhaustive_diagnostic(node: node))
+  }
+}
+
+// The obligation's parameter identity names the variant in a refusal: the declaration path the
+// scrutinee's type resolved through, by its last segment.
+fn infer_coproduct_coverage_parameter_identity(coproduct: InferMatchCoproduct) -> Symbol {
+  match qualified_name_last_segment(qn: coproduct.path) {
+    Present { value: s } => s
+    Absent => symbol_intern_lexeme(lexeme: "coproduct_coverage")
+  }
+}
+
 fn infer_unify_branch_arm_types(
   then_node: Node,
   then_facts: InferredFacts,
@@ -2234,9 +2611,11 @@ fn infer_match_bool(
                     match infer_bounded_lattice_consumer_gate(consumer: node, partials: partials) {
                       Rejected { diagnostics: r } => Rejected { diagnostics: r }
                       Accepted { value: _, diagnostics: cd } =>
-                        match infer_branch_operand_resolved_type_in_tree(
+                        match infer_branch_operand_resolved_type_with_entries(
                           node: scrutinee_target,
                           facts: scrutinee_facts,
+                          entries: entries,
+                          instances: infer_no_type_variable_instances(),
                           resolved: resolved
                         ) {
                           Violates { diagnostic: d } => outcome_rejected(d)
@@ -2289,7 +2668,7 @@ fn infer_match_arm_pattern_is_literal(arm: Node) -> Bool {
 // patterns are neither literals nor constructors -- bare atoms naming nothing, say -- keeps the literal
 // family's refusal (infer_match_pattern_not_bool_literal): routing it here instead would meet an
 // untyped scrutinee and accept it at the frontier, widening a refusal into an admission
-// (v2.test.claim.manual.match_infer_fail_open_audit complement_body_real_infer_refuses_unsupported_pattern_holds).
+// (v2.test.claim.manual.match_infer_fail_open_audit match_infer_fail_open_audit_rejects_holds).
 fn infer_match_arm_pattern_is_constructor(arm: Node) -> Bool {
   match find_core_child(root: arm, marker: MatchArmPatternEdge) {
     Rejected { diagnostics: _ } => false
@@ -2333,6 +2712,7 @@ fn infer_match(
 // index does not hold -- declares no variants to eliminate, and a count of arguments different from the
 // count of parameters binds no instance at all.
 type InferMatchCoproduct {
+  path: QualifiedName
   variants: Node
   instances: List<TypeVariableInstance>
 }
@@ -2369,17 +2749,18 @@ fn infer_match_coproduct_of_type(scrutinee_type: Node, resolved: ResolvedTree) -
   match declaration_reference_path_optional(node: head_args.head) {
     Absent => CoproductNotDeclared
     Present { value: path } =>
-      match symbol_index_lookup(index: resolved.symbol_index, qualified_path: path) {
+      match symbol_index_lookup(index: resolved.resolved_declarations, qualified_path: path) {
         Absent => CoproductNotDeclared
         Present { value: declared } =>
           match declared.kind {
             TypeNode { connective: Disj } =>
-              let params = symbol_index_declared_type_params_at(index: resolved.symbol_index, qualified_path: path)
+              let params = symbol_index_declared_type_params_at(index: resolved.resolved_declarations, qualified_path: path)
               if length(xs: params) != length(xs: head_args.args) {
                 CoproductArityMismatch
               } else {
                 CoproductRead {
                   coproduct: InferMatchCoproduct {
+                    path: path,
                     variants: declared,
                     instances: zip_map(a: params, b: head_args.args, f: fn(p, arg) {
                       TypeVariableInstance { binder: p, instance: arg }
@@ -2413,15 +2794,6 @@ fn infer_match_variant_payload(variants: Node, tag: Symbol) -> Optional<Node> {
   })
 }
 
-fn infer_match_variant_tags(variants: Node) -> List<Symbol> {
-  fold(variants.children, init: Empty, f: fn(acc, e) {
-    match e.label {
-      Authored { name: tag } => list_snoc_item(xs: acc, item: tag)
-      StructuralLabel { label: _ } => acc
-      Positional => acc
-    }
-  })
-}
 
 // A VARIANT FIELD'S TYPE AT THIS INSTANTIATION, OR NOTHING. A field declared as one of the
 // declaration's type parameters is that parameter's argument -- a type the USE SITE resolved. A field
@@ -2652,14 +3024,6 @@ fn infer_coproduct_arm_row(arm: Node, coproduct: InferMatchCoproduct) -> Outcome
   }
 }
 
-fn infer_coproduct_rows_cover(rows: List<InferCoproductArmRow>, tag: Symbol) -> Bool {
-  any(xs: rows, predicate: fn(row) {
-    match row.covers {
-      CoversAll => true
-      CoversVariant { tag: t } => t == tag
-    }
-  })
-}
 
 // THE ARM BODIES' ONE TYPE. Two DERIVED body types that differ are a mismatch and refuse; a body whose
 // type is not derived leaves the match at the frontier with one located advisory per such body, and
@@ -2674,13 +3038,14 @@ type InferArmBodyTypes {
 fn infer_coproduct_arm_body_types(
   rows: List<InferCoproductArmRow>,
   entries: List<InferredFactsEntry>,
+  instances: List<TypeVariableInstance>,
   resolved: ResolvedTree
 ) -> InferArmBodyTypes {
   fold(rows, init: InferArmBodyTypes { derived: Absent, mismatch: false, underived: None }, f: fn(acc, row) {
     let body_type = match lookup_inferred_facts_in_entries(entries: entries, key: row.body) {
       Absent => Absent
       Present { value: facts } =>
-        match infer_branch_operand_resolved_type_in_tree(node: row.body, facts: facts, resolved: resolved) {
+        match infer_branch_operand_resolved_type_with_entries(node: row.body, facts: facts, entries: entries, instances: instances, resolved: resolved) {
           Holds { value: t } => Present { value: t }
           Violates { diagnostic: _ } => Absent
         }
@@ -2728,6 +3093,7 @@ fn infer_match_coproduct_rows(
   coproduct: InferMatchCoproduct,
   entries: List<InferredFactsEntry>,
   resolved: ResolvedTree,
+  scrutinee_target: Node,
   cd: Diagnostics
 ) -> Outcome<InferredFacts> {
   match fold(arms, init: Accepted { value: Empty, diagnostics: None }, f: fn(acc, arm) {
@@ -2742,32 +3108,32 @@ fn infer_match_coproduct_rows(
   }) {
     Rejected { diagnostics: r } => Rejected { diagnostics: r }
     Accepted { value: rows, diagnostics: _ } =>
-      if any(xs: infer_match_variant_tags(variants: coproduct.variants), predicate: fn(tag) {
-        !infer_coproduct_rows_cover(rows: rows, tag: tag)
-      }) {
-        outcome_rejected(infer_match_non_exhaustive_diagnostic(node: node))
-      } else {
-        let bodies = infer_coproduct_arm_body_types(rows: rows, entries: entries, resolved: resolved)
-        if bodies.mismatch {
-          outcome_rejected(infer_match_arm_type_mismatch_diagnostic(node: node))
-        } else {
-          match bodies.underived {
-            Some { diagnostics: _ } => infer_match_frontier(node: node, cd: cd, advisories: bodies.underived)
-            None =>
-              match bodies.derived {
-                Absent => infer_match_frontier(node: node, cd: cd, advisories: None)
-                Present { value: t } =>
-                  match infer_descent_witness_for_node(n: node) {
-                    Violates { diagnostic: d } => Rejected { diagnostics: diagnostics_singleton(d: d) }
-                    Holds { value: descent_proof } =>
-                      bind_outcome(
-                        o: inferred_facts_from_derived_type(node: node, derived_type: t, descent: Holds { value: descent_proof }),
-                        f: fn(facts) { Accepted { value: facts, diagnostics: cd } }
-                      )
+      match infer_coproduct_coverage_obligation(node: node, scrutinee_target: scrutinee_target, coproduct: coproduct, rows: rows) {
+        Rejected { diagnostics: r } => Rejected { diagnostics: r }
+        Accepted { value: _, diagnostics: _ } =>
+          {
+            let bodies = infer_coproduct_arm_body_types(rows: rows, entries: entries, instances: coproduct.instances, resolved: resolved)
+            if bodies.mismatch {
+              outcome_rejected(infer_match_arm_type_mismatch_diagnostic(node: node))
+            } else {
+              match bodies.underived {
+                Some { diagnostics: _ } => infer_match_frontier(node: node, cd: cd, advisories: bodies.underived)
+                None =>
+                  match bodies.derived {
+                    Absent => infer_match_frontier(node: node, cd: cd, advisories: None)
+                    Present { value: t } =>
+                      match infer_descent_witness_for_node(n: node) {
+                        Violates { diagnostic: d } => Rejected { diagnostics: diagnostics_singleton(d: d) }
+                        Holds { value: descent_proof } =>
+                          bind_outcome(
+                            o: inferred_facts_from_derived_type(node: node, derived_type: t, descent: Holds { value: descent_proof }),
+                            f: fn(facts) { Accepted { value: facts, diagnostics: cd } }
+                          )
+                      }
                   }
               }
+            }
           }
-        }
       }
   }
 }
@@ -2794,7 +3160,7 @@ fn infer_match_coproduct(
                 match lookup_inferred_facts_in_entries(entries: entries, key: scrutinee_target) {
                   Absent => outcome_rejected(infer_facts_lookup_miss_diagnostic(key: scrutinee_target))
                   Present { value: scrutinee_facts } =>
-                    match infer_branch_operand_resolved_type_in_tree(node: scrutinee_target, facts: scrutinee_facts, resolved: resolved) {
+                    match infer_branch_operand_resolved_type_with_entries(node: scrutinee_target, facts: scrutinee_facts, entries: entries, instances: infer_no_type_variable_instances(), resolved: resolved) {
                       Violates { diagnostic: _ } =>
                         infer_match_frontier(
                           node: node,
@@ -2806,7 +3172,15 @@ fn infer_match_coproduct(
                           CoproductNotDeclared => outcome_rejected(infer_match_scrutinee_not_coproduct_diagnostic(node: scrutinee_target))
                           CoproductArityMismatch => outcome_rejected(infer_match_type_argument_arity_mismatch_diagnostic(node: scrutinee_target))
                           CoproductRead { coproduct: coproduct } =>
-                            infer_match_coproduct_rows(node: node, arms: arms, coproduct: coproduct, entries: entries, resolved: resolved, cd: cd)
+                            infer_match_coproduct_rows(
+                              node: node,
+                              arms: arms,
+                              coproduct: coproduct,
+                              scrutinee_target: scrutinee_target,
+                              entries: entries,
+                              resolved: resolved,
+                              cd: cd
+                            )
                         }
                     }
                 }
@@ -3041,14 +3415,17 @@ fn infer_unify_transform_operand_types(
   left_facts: InferredFacts,
   right_node: Node,
   right_facts: InferredFacts,
+  entries: List<InferredFactsEntry>,
   resolved: ResolvedTree,
 ) -> Outcome<Node> {
-  match infer_branch_operand_resolved_type_in_tree(node: left_node, facts: left_facts, resolved: resolved) {
+  match infer_branch_operand_resolved_type_with_entries(node: left_node, facts: left_facts, entries: entries, instances: infer_no_type_variable_instances(), resolved: resolved) {
     Violates { diagnostic: d } => outcome_rejected(d)
     Holds { value: left_type } =>
-      match infer_branch_operand_resolved_type_in_tree(
+      match infer_branch_operand_resolved_type_with_entries(
         node: right_node,
         facts: right_facts,
+        entries: entries,
+        instances: infer_no_type_variable_instances(),
         resolved: resolved
       ) {
         Violates { diagnostic: d } => outcome_rejected(d)
@@ -3379,6 +3756,11 @@ fn infer_judge_declared_position(
         reason: reason
       )
     Absent =>
+  match infer_literal_elaborates_at(literal_node: produced_at, expected: infer_declared_type_denotation(declared: formal.declared), declarations: declarations) {
+    InferLiteralElaboratesTo { destination_type: _ } => Accepted { value: true, diagnostics: None }
+    InferLiteralElaborationRefused { cause: cause } =>
+      outcome_rejected(Diagnostic { reason: cause, at: node_locus(node: produced_at), correction: Unavailable { reason: CorrectionNotModeled } })
+    InferLiteralNotElaborated =>
   match lookup_inferred_facts_in_entries(entries: entries, key: produced_at) {
     Absent =>
       infer_inhabitance_undecidable_accepted(
@@ -3412,8 +3794,10 @@ fn infer_judge_declared_position(
       }
   }
   }
+  }
 }
 
+
 fn infer_no_type_variable_instances() -> List<TypeVariableInstance> {
   Empty
 }
@@ -3525,22 +3909,29 @@ fn infer_type_alias_unfolded(t: Node, declarations: SymbolIndex) -> Optional<Nod
 // declared and the produced type, so every declared position -- argument, return, record field, let annotation,
 // binder default -- and both the plain and the generic routes see one type per alias family (review 75435;
 // calm-boar-904, option 1). v2.std.inhabitance holds no index, so the reading is supplied by the producer,
-// exactly as produced_declared_carrier is.
+// exactly as produced_declared_carrier is. KERNEL RECOGNITION IS PART OF EVERY STEP
+// (infer_kernel_value_type_optional): checked before each alias unfolding and inside every Instantiation argument,
+// so `type Alias = v2.std.integer.Int` stops at the kernel atom exactly as a direct reference does, and the generic
+// formal match and the declared-type obligation read ONE normalized type, not two.
 fn infer_type_alias_normalized(t: Node, declarations: SymbolIndex) -> Node {
-  match infer_type_alias_unfolded(t: t, declarations: declarations) {
-    Present { value: unfolded } => infer_type_alias_normalized(t: unfolded, declarations: declarations)
+  match infer_kernel_value_type_optional(t: t) {
+    Present { value: k } => k
     Absent =>
-      match t.kind {
-        TypeNode { connective: Instantiation } =>
-          Node {
-            kind: t.kind,
-            children: fold(t.children, init: Empty, f: fn(acc, e) {
-              list_snoc_item(xs: acc, item: Edge { label: e.label, target: infer_type_alias_normalized(t: e.target, declarations: declarations) })
-            }),
-            occurrence_id: t.occurrence_id
+      match infer_type_alias_unfolded(t: t, declarations: declarations) {
+        Present { value: unfolded } => infer_type_alias_normalized(t: unfolded, declarations: declarations)
+        Absent =>
+          match t.kind {
+            TypeNode { connective: Instantiation } =>
+              Node {
+                kind: t.kind,
+                children: fold(t.children, init: Empty, f: fn(acc, e) {
+                  list_snoc_item(xs: acc, item: Edge { label: e.label, target: infer_type_alias_normalized(t: e.target, declarations: declarations) })
+                }),
+                occurrence_id: t.occurrence_id
+              }
+            TypeNode { connective: _ } => t
+            ComputationNode { behavior: _ } => t
           }
-        TypeNode { connective: _ } => t
-        ComputationNode { behavior: _ } => t
       }
   }
 }
@@ -3563,6 +3954,36 @@ fn infer_match_generic_formal_or_carrier(formal: Node, produced: Node, type_para
   }
 }
 
+// THE KERNEL VALUE TYPE AND THE CORPUS DECLARATION ARE ONE TYPE. `v2.std.integer.Int`
+// (`type Int = GroupCompletion<Nat>`) and the kernel atom `dag_binding_type_int`
+// (integer_int_type_node) answer the same value-type question. Alias-normalizing first unfolds
+// that alias to GroupCompletion<Nat> and then the judge compares that product to the kernel atom.
+// Recognition is BY AUTHORITY, NOT BY SPELLING: a declaration reference joins only when
+// dag_kernel_type_declaration_binding_optional admits the FULL path (the same roster resolve
+// uses). A last-segment `Int` would recapture a module's own `type Int = | Mine` and admit
+// `let y: Int = 1` (gunbc.recurring_failure_mode kernel_type_spelling_captured_a_module_declaration;
+// review 77259). An atom joins only through dag_binding_denotation (binding -> value type).
+fn infer_kernel_value_type_optional(t: Node) -> Optional<Node> {
+  if infer_type_equal_ignoring_provenance(a: t, b: integer_int_type_node()) {
+    optional_present(value: integer_int_type_node())
+  } else if infer_type_equal_ignoring_provenance(a: t, b: bool_node()) {
+    optional_present(value: bool_node())
+  } else {
+    match declaration_reference_path_optional(node: t) {
+      Present { value: path } =>
+        match dag_kernel_type_declaration_binding_optional(path: path) {
+          Present { value: binding } => dag_binding_denotation(sym: binding)
+          Absent => optional_absent()
+        }
+      Absent =>
+        match node_atom_identity_optional(node: t) {
+          Present { value: id } => dag_binding_denotation(sym: id)
+          Absent => optional_absent()
+        }
+    }
+  }
+}
+
 // THE ONE PRODUCER OF A DeclaredTypeObligation in infer: every obligation -- a call argument, a declared return, a
 // fold member or carrier, a generic formal -- is built here, so the ONE alias rule (infer_type_alias_normalized)
 // reaches every judgment: the declared type, the produced type and the produced type's refinement carrier are
@@ -3591,6 +4012,138 @@ fn infer_declared_type_obligation(
   }
 }
 
+// A LITERAL ELABORATES AT AN EXPECTED TYPE THROUGH THE DECLARED TABLES, at a declared position (the declared-type
+// obligation, infer_judge_declared_position). Two tables, which partition the declarations they name
+// (std.literal_elaboration, "a declaration is never both"):
+//   - KERNEL GROUNDING (gunbc.structural_realization_bindings kernel_grounding_rows): the carrier IS the kernel value,
+//     so a literal at it is its own value (DirectLiteral) when the row's declared range admits it
+//     (std.literal_elaboration kernel_grounding_admits). std.nat Nat is here with min 0: 0 and 3 elaborate at Nat,
+//     and `-1` refuses, DERIVED from the range (infer_reason_literal_outside_kernel_grounding_range) -- calm-boar-904,
+//     ruling A on review 77219. v2 infer keeps Nat and Int distinct TYPES; the grounding only says which literals
+//     denote a value of Nat, and Nat is realized as the kernel integer, so the literal's value does not move.
+//   - LITERAL HOMOMORPHISM (literal_homomorphism_rows): a STRUCTURAL destination supplies the literal through its own
+//     constructors (test.fixture.structural_peano_nat StructuralNat), via std.literal_elaboration elaborate_literal_at,
+//     the same function and rows the seed consults. A negative literal has no image under a Peano unfold.
+// NOT READ BY THE OPERATOR UNIFY, AND THAT IS STATED: an operand partner would elaborate a literal only beside a
+// Nat, and Nat carries no algebra row, so `n + 1` refuses at the operator either way, while `==`/`<` are not
+// judged at all (gunbc.recurring_failure_mode comparison_operands_never_judged_in_v2_infer).
+//
+// SCOPE, STATED: integer literals. A string literal at the free monoid over Char (the Unicode scalar row) is
+// not elaborated here; that crossing stays the text-boundary lane's (DESIGN section 4, Ruling 3).
+type InferLiteralElaboration
+  = InferLiteralElaboratesTo { destination_type: Node }
+  | InferLiteralNotElaborated
+  | InferLiteralElaborationRefused { cause: Symbol }
+
+fn infer_type_declaration_ref(t: Node) -> Optional<DeclarationRef> {
+  match declaration_reference_path_optional(node: infer_type_head_and_args(t: t).head) {
+    Absent => optional_absent()
+    Present { value: path } =>
+      match qualified_name_last_segment(qn: path) {
+        Absent => optional_absent()
+        Present { value: leaf } =>
+          optional_present(value: decl_ref(module_path: qualified_name_to_dotted_string(qn: qualified_name_init(qn: path)), decl_name: symbol_lexeme(sym: leaf)))
+      }
+  }
+}
+
+// A NEGATED INTEGER LITERAL (`-1`) lowers to a unary Transform whose operator is the `-` token or the subtraction
+// wire resolve canonicalizes it to, over one integer literal. It is not a literal node, so without this reading it
+// reached the judge underived and was admitted at ANY declared type -- including Nat, which has no negative
+// values. Its value is the negated magnitude, judged like any literal's: a grounded destination's range decides
+// it, a Peano unfold has no image for it, and a destination with no row (Int) is not this function's subject.
+fn infer_negated_int_literal_value(node: Node) -> Optional<Int> {
+  match node.kind {
+    ComputationNode { behavior: Transform } =>
+      let targets = node_positional_child_targets(node: node)
+      if length(xs: targets) != 2 {
+        optional_absent()
+      } else {
+        match list_at_optional(xs: targets, index: 0) {
+          Absent => optional_absent()
+          Present { value: op } =>
+            if infer_operator_is_minus_token(op_node: op) || canonical_operation_wire_matches_operation(wire: op, operation: canonical_operation_op_sub()) {
+              match list_at_optional(xs: targets, index: 1) {
+                Absent => optional_absent()
+                Present { value: operand } =>
+                  match dag_canonical_literal_from_node(node: operand) {
+                    Accepted { value: DagCanonicalIntLiteral { magnitude: m }, diagnostics: _ } => optional_present(value: 0 - m)
+                    Accepted { value: _, diagnostics: _ } => optional_absent()
+                    Rejected { diagnostics: _ } => optional_absent()
+                  }
+              }
+            } else {
+              optional_absent()
+            }
+        }
+      }
+    ComputationNode { behavior: _ } => optional_absent()
+    TypeNode { connective: _ } => optional_absent()
+  }
+}
+
+fn infer_operator_is_minus_token(op_node: Node) -> Bool {
+  match node_atom_identity_optional(node: op_node) {
+    Present { value: id } => id == ^dag_token_minus
+    Absent => false
+  }
+}
+
+// The table's own refusal, carried through as its own typed reason rather than flattened to a generic one
+// (review 76326): a duplicated homomorphism row is an authoring defect in literal_homomorphism_rows.
+fn infer_literal_elaboration_refusal_reason(cause: LiteralElaborationRefusal) -> Symbol {
+  match cause {
+    HomomorphismDuplicated { source_kind: _, destination: _, row_count: _ } => ^infer_reason_literal_homomorphism_duplicated
+  }
+}
+
+fn infer_literal_elaborates_at(literal_node: Node, expected: Node, declarations: SymbolIndex) -> InferLiteralElaboration {
+  match dag_canonical_literal_from_node(node: literal_node) {
+    Rejected { diagnostics: _ } =>
+      match infer_negated_int_literal_value(node: literal_node) {
+        Absent => InferLiteralNotElaborated
+        Present { value: v } => infer_int_literal_value_at(value: v, expected: expected, declarations: declarations)
+      }
+    Accepted { value: literal, diagnostics: _ } =>
+      match literal {
+        DagCanonicalIntLiteral { magnitude: m } => infer_int_literal_value_at(value: m, expected: expected, declarations: declarations)
+        DagCanonicalBoolLiteral { value: _ } => InferLiteralNotElaborated
+        DagCanonicalSymbolLiteral { symbol: _ } => InferLiteralNotElaborated
+        DagCanonicalStringLiteral { value: _ } => InferLiteralNotElaborated
+      }
+  }
+}
+
+// An integer value at an expected type: the grounding row first (the carrier IS the kernel value, its range decides),
+// else the homomorphism table (a structural destination). The two never both answer, by the partition law.
+fn infer_int_literal_value_at(value: Int, expected: Node, declarations: SymbolIndex) -> InferLiteralElaboration {
+  let wanted = infer_type_alias_normalized(t: expected, declarations: declarations)
+  match infer_type_declaration_ref(t: wanted) {
+    Absent => InferLiteralNotElaborated
+    Present { value: destination } =>
+      match kernel_grounding_for(rows: kernel_grounding_rows, source_kind: KernelIntLiteral, carrier: destination) {
+        KernelGroundingFound { row: row } =>
+          if kernel_grounding_admits(row: row, value: value) {
+            InferLiteralElaboratesTo { destination_type: wanted }
+          } else {
+            InferLiteralElaborationRefused { cause: ^infer_reason_literal_outside_kernel_grounding_range }
+          }
+        KernelGroundingAmbiguous { row_count: _ } => InferLiteralElaborationRefused { cause: ^infer_reason_kernel_grounding_duplicated }
+        KernelGroundingAbsent =>
+          match elaborate_literal_at(rows: literal_homomorphism_rows, source_kind: KernelIntLiteral, destination: destination, element: none, destination_realizes_natively: false) {
+            ViaHomomorphism { homomorphism: _ } =>
+              if value < 0 {
+                InferLiteralElaborationRefused { cause: ^infer_reason_negative_literal_has_no_image_in_destination }
+              } else {
+                InferLiteralElaboratesTo { destination_type: wanted }
+              }
+            DirectLiteral => InferLiteralNotElaborated
+            LiteralElaborationRefused { cause: c } => InferLiteralElaborationRefused { cause: infer_literal_elaboration_refusal_reason(cause: c) }
+          }
+      }
+  }
+}
+
 // A REFINEMENT IS NOT A TRANSPARENT ALIAS. `type Pos = Int where positive` -- and a nominal brand, which is
 // spelled the same way (`where brand(..)`, std.types WherePredicateMarker) -- denotes a type distinct from its
 // carrier, so it never unfolds: normalizing it would admit a raw carrier where the refined or branded type is
@@ -3760,17 +4313,26 @@ fn infer_judge_application_argument_instantiating(
   }
 }
 
+// THE SITE'S INSTANTIATION IS KEPT, NOT DISCARDED. The argument walk already ends with the call's
+// TypeVariableInstance list (infer_judge_formal_args); the result step reads it to instantiate a
+// generic declared return (infer_application_result_type), so the one instantiation that judged the
+// arguments is the one that types the result. An unresolved formal set judges nothing and binds no
+// instance.
 fn infer_application_argument_inhabitance(
   node: Node,
   entries: List<InferredFactsEntry>,
   declarations: SymbolIndex
-) -> Outcome<Bool> {
+) -> Outcome<List<TypeVariableInstance>> {
   match infer_application_formals(node: node, entries: entries) {
     FormalsUnresolved =>
-      infer_inhabitance_undecidable_accepted(
+      match infer_inhabitance_undecidable_accepted(
         application: node,
         reason: undecidable_formal_unresolved()
-      )
+      ) {
+        Rejected { diagnostics: r } => Rejected { diagnostics: r }
+        Accepted { value: _, diagnostics: d } =>
+          Accepted { value: infer_no_type_variable_instances(), diagnostics: d }
+      }
     FormalsOrderRefused { reason: reason } =>
       outcome_rejected(application_parameter_order_diagnostic(application: node, reason: reason))
     FormalsInDeclaredOrder { formals: formals } =>
@@ -3786,7 +4348,7 @@ fn infer_application_argument_inhabitance(
             type_params: infer_application_type_params(node: node, entries: entries)
           ) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
-            Accepted { value: _, diagnostics: d } => Accepted { value: true, diagnostics: d }
+            Accepted { value: instances, diagnostics: d } => Accepted { value: instances, diagnostics: d }
           }
       }
   }
@@ -3975,6 +4537,7 @@ fn infer_transform_binary_infix(
                                 left_facts: left_facts,
                                 right_node: right_target,
                                 right_facts: right_facts,
+                                entries: entries,
                                 resolved: resolved
                               ) {
                                 Rejected { diagnostics: r } => Rejected { diagnostics: r }
@@ -4309,7 +4872,7 @@ fn infer_list_element_type(element: Node, entries: List<InferredFactsEntry>, res
   match lookup_inferred_facts_in_entries(entries: entries, key: element) {
     Absent => outcome_rejected(infer_facts_lookup_miss_diagnostic(key: element))
     Present { value: facts } =>
-      match infer_branch_operand_resolved_type_in_tree(node: element, facts: facts, resolved: resolved) {
+      match infer_branch_operand_resolved_type_with_entries(node: element, facts: facts, entries: entries, instances: infer_no_type_variable_instances(), resolved: resolved) {
         Violates { diagnostic: d } => outcome_rejected(d)
         Holds { value: t } => outcome_accepted(value: t)
       }
@@ -4444,6 +5007,33 @@ fn infer_gather_application_row_on_entries(
   partials: List<Node>,
   kinds: List<RosterKindIndex>,
   resolved: ResolvedTree,
+) -> InferGatherFoldAcc {
+  if infer_application_callee_is_primitive_authority(node: node, resolved: resolved) {
+    match infer_primitive_without_signature_refusal(node: node) {
+      Rejected { diagnostics: r } =>
+        infer_gather_fold_acc_failed(
+          node: node,
+          pending: rejected_with_pending(pending: pending, rejected: r),
+          await_branch_row: false,
+          await_match_row: false,
+          await_loop_row: false,
+          await_transform_row: false,
+          children_remaining: 0
+        )
+      Accepted { value: _, diagnostics: _ } => infer_gather_application_row_on_arguments(node: node, entries: entries, pending: pending, partials: partials, kinds: kinds, resolved: resolved)
+    }
+  } else {
+    infer_gather_application_row_on_arguments(node: node, entries: entries, pending: pending, partials: partials, kinds: kinds, resolved: resolved)
+  }
+}
+
+fn infer_gather_application_row_on_arguments(
+  node: Node,
+  entries: List<InferredFactsEntry>,
+  pending: Diagnostics,
+  partials: List<Node>,
+  kinds: List<RosterKindIndex>,
+  resolved: ResolvedTree,
 ) -> InferGatherFoldAcc {
   match infer_application_argument_inhabitance(node: node, entries: entries, declarations: resolved.resolved_declarations) {
     Rejected { diagnostics: r } =>
@@ -4456,14 +5046,15 @@ fn infer_gather_application_row_on_entries(
         await_transform_row: false,
         children_remaining: 0
       )
-    Accepted { value: _, diagnostics: id } =>
+    Accepted { value: instances, diagnostics: id } =>
       let merged_pending = diagnostics_merge(outer: pending, inner: id)
       match infer_transform_derived_optional(
         node: node,
         partials: partials,
         entries: entries,
         resolved: resolved,
-        arguments_decided: infer_diagnostics_none(d: id)
+        arguments_decided: infer_diagnostics_none(d: id),
+        instances: instances
       ) {
         Present { value: derived } =>
         match derived {
@@ -4590,6 +5181,30 @@ fn infer_diagnostics_none(d: Diagnostics) -> Bool {
   }
 }
 
+// A CALL WHOSE HEAD RESOLVED TO A std.primitives CONTRACT ROW (v2.compiler.primitive_authority) has a name and a
+// cost row but NO declared type signature: those live in the seed's builtin_function_registry, with no .dag
+// authority. Typing it as unknown and accepting would be silent wrongness (DESIGN §5), so it is REFUSED, typed
+// and located at the callee, until a .dag signature authority for primitives exists. The refusal is asked at call-head
+// position only (asked before argument binding, which would otherwise refuse the row as a non-arrow): a plain data reference to a *_contract row is an ordinary PrimitiveContract value.
+fn infer_application_callee_is_primitive_authority(node: Node, resolved: ResolvedTree) -> Bool {
+  match infer_application_callee_use(node: node) {
+    Absent => false
+    Present { value: callee } =>
+      match declaration_reference_path_optional(node: callee) {
+        Absent => false
+        Present { value: path } => symbol_index_declares_primitive_contract_at(index: resolved.symbol_index, qualified_path: path)
+      }
+  }
+}
+
+fn infer_primitive_without_signature_refusal(node: Node) -> Outcome<InferredFacts> {
+  let at = match infer_application_callee_use(node: node) {
+    Present { value: callee } => callee
+    Absent => node
+  }
+  outcome_rejected(Diagnostic { reason: ^infer_reason_primitive_without_declared_signature_authority, at: node_locus(node: at), correction: Unavailable { reason: CorrectionNotModeled } })
+}
+
 // arguments_decided: argument inhabitance returned no counted-undecidable obligation. Arrow
 // elimination derives only then -- an application whose argument obligation is still undecided
 // stays on the frontier rather than typing past it.
@@ -4599,13 +5214,14 @@ fn infer_transform_derived_optional(
   entries: List<InferredFactsEntry>,
   resolved: ResolvedTree,
   arguments_decided: Bool,
+  instances: List<TypeVariableInstance>,
 ) -> Optional<Outcome<InferredFacts>> {
   if infer_transform_is_binary_infix_algebra_shape(node: node) {
     optional_present(value: infer_transform_binary_infix(node: node, partials: partials, entries: entries, resolved: resolved))
   } else if infer_transform_is_cast(node: node) {
     infer_transform_cast_optional(node: node, entries: entries, resolved: resolved)
   } else if arguments_decided {
-    infer_transform_application_optional(node: node, entries: entries)
+    infer_transform_application_optional(node: node, entries: entries, instances: instances, declarations: resolved.resolved_declarations)
   } else {
     optional_absent()
   }
@@ -4617,7 +5233,12 @@ fn infer_transform_derived_optional(
 // derived -- so arrow introduction has checked its body against that return. An underived callee,
 // a non-Arrow operator, or a return the language join does not denote stays on the counted
 // frontier: Absent here, never an admission.
-fn infer_transform_application_optional(node: Node, entries: List<InferredFactsEntry>) -> Optional<Outcome<InferredFacts>> {
+fn infer_transform_application_optional(
+  node: Node,
+  entries: List<InferredFactsEntry>,
+  instances: List<TypeVariableInstance>,
+  declarations: SymbolIndex,
+) -> Optional<Outcome<InferredFacts>> {
   match infer_application_callee_arrow_with_facts(node: node, entries: entries) {
     Absent => optional_absent()
     Present { value: arrow } =>
@@ -4630,7 +5251,7 @@ fn infer_transform_application_optional(node: Node, entries: List<InferredFactsE
           if !inferred_facts_grounding_derived(facts: arrow_facts) {
             optional_absent()
           } else {
-            match infer_arrow_declared_return_type(arrow: arrow) {
+            match infer_application_result_type(arrow: arrow, instances: instances, declarations: declarations) {
               Absent => optional_absent()
               Present { value: return_type } =>
                 optional_present(
@@ -5300,7 +5921,7 @@ fn infer_gather_fold_step(
   if acc.failed {
     acc
   } else if arrow_signature_order_edge(parent: acc.node, edge: edge)
-    || arrow_named_edge_is_contract(e: edge)
+    || arrow_named_edge_is_metadata(e: edge)
     || infer_declaration_binder_edge(parent: acc.node, edge: edge)
     || match_arm_pattern_edge(parent: acc.node, edge: edge)
     || (resolved_reference_body_kind(target: acc.node) != NotMarkedReference) {
@@ -5483,10 +6104,13 @@ fn infer_gather_fold_step_merged(
 // trigger are rostered in gunbc.recurring_failure_mode
 // construct_field_value_not_typed_against_the_record_declaration.
 //
-// ONLY A DECLARED RECORD IS READ HERE. The index says which kind of payload a path denotes
-// (symbol_index_declared_payload_at); a variant arm's construct, a tag the guarded reader does not
-// answer for, and a Conj with no tag at all are ConstructNotARecord and keep product introduction,
-// where an underived tag leaves them on the counted frontier as before.
+// ONLY A DECLARED RECORD OR VARIANT ARM IS READ HERE. The index says which kind of payload a path
+// denotes (symbol_index_declared_payload_at); a tag the guarded reader does not answer for and a
+// Conj with no tag at all are ConstructNotARecord and keep product introduction, where an underived
+// tag leaves them on the counted frontier as before. A VARIANT ARM's construct is read at its own
+// path (the arm declares the fields) and derives the VARIANT's type: the declaration reference of
+// the arm path's parent (v2.compiler.body_lowering_fold variant_fields_unlowered_on_the_native_route
+// is retired by this read plus the variant match row beside it).
 type InferRecordFormals
   = RecordFormalsResolved { payload: Node }
   | RecordFormalsAuthored { payload: Node }
@@ -5498,8 +6122,20 @@ type InferRecordConstruct {
   type_params: List<Symbol>
 }
 
+// A variant arm's construct carries the arm path it was read at and the variant path whose
+// declaration reference names the construction's type. The arm's fields are the formals; the
+// variant's declared type params are the ones its fields may cite.
+type InferVariantArmConstruct {
+  record: Node
+  arm_path: QualifiedName
+  variant_path: QualifiedName
+  formals: InferRecordFormals
+  type_params: List<Symbol>
+}
+
 type InferConstructRead
   = ConstructIsRecord { construct: InferRecordConstruct }
+  | ConstructIsVariantArm { construct: InferVariantArmConstruct }
   | ConstructNotARecord
 
 fn infer_record_formals(resolved: ResolvedTree, path: QualifiedName, authored: Node) -> InferRecordFormals {
@@ -5516,6 +6152,46 @@ fn infer_record_formals_payload(formals: InferRecordFormals) -> Node {
   }
 }
 
+// ONE MINT FOR BOTH PATH FORMS. The tag's path is either the variant's declared path (the
+// containment form: `p.Seal.Boxed`) or the module-level unique-variant alias (`p.Boxed`), whose
+// carrier the index carries beside it; by here the path IS the declared path either way, so the
+// construction types by the declaring coproduct, its params, and the variant's own payload.
+fn infer_variant_arm_construct(
+  reference: Node,
+  resolved: ResolvedTree,
+  declared_path: QualifiedName
+) -> InferConstructRead {
+  match symbol_index_lookup(index: resolved.resolved_declarations, qualified_path: declared_path) {
+    Absent => ConstructNotARecord
+    Present { value: resolved_decl } =>
+      match qualified_name_init(qn: declared_path) {
+        Empty => ConstructNotARecord
+        Cons { head: _, tail: _ } =>
+          ConstructIsVariantArm {
+            construct: InferVariantArmConstruct {
+              record: reference,
+              arm_path: declared_path,
+              variant_path: qualified_name_init(qn: declared_path),
+              formals: infer_record_formals(resolved: resolved, path: declared_path, authored: resolved_decl),
+              type_params: symbol_index_declared_type_params_at(
+                index: resolved.resolved_declarations,
+                qualified_path: qualified_name_init(qn: declared_path)
+              )
+            }
+          }
+      }
+  }
+}
+
+// A CONSTRUCTION'S TAG IS A RESOLVED REFERENCE, BARE OR QUALIFIED ALIKE: resolve rewrites the tag
+// to the declaration it binds (the qualified door and the atom walk meet in resolve_atom_bound, the
+// same producer the bare door uses), so the variant's declaring path is the reference's own path --
+// no second lookup beside it. Reads go through resolved_declarations: declarations with resolved
+// bodies (gunbc#12629). The global bare index is dead as a mechanism (03_resolve at the global_bare
+// comment) and names no read here. THE DECLARING PATH OF A VARIANT-ARM PAYLOAD PATH: for the
+// variant's own row this is the row itself (no claimants); for its module-level alias the binding
+// filed by symbol_index_fill_containment_node answers the variant's declaring path. One authority,
+// no parallel carrier map.
 fn infer_record_construct_read(node: Node, resolved: ResolvedTree) -> InferConstructRead {
   match construct_tag_optional(n: node) {
     Absent => ConstructNotARecord
@@ -5523,21 +6199,32 @@ fn infer_record_construct_read(node: Node, resolved: ResolvedTree) -> InferConst
       match declaration_reference_path_optional(node: reference) {
         Absent => ConstructNotARecord
         Present { value: path } =>
-          match symbol_index_declared_payload_at(index: resolved.symbol_index, qualified_path: path) {
+          match symbol_index_declared_payload_at(index: resolved.resolved_declarations, qualified_path: path) {
             Absent => ConstructNotARecord
             Present { value: kind } =>
               match kind {
-                VariantArmPayload => ConstructNotARecord
+                VariantArmPayload =>
+                  infer_variant_arm_construct(
+                    reference: reference,
+                    resolved: resolved,
+                    declared_path: symbol_index_declaring_path_of(
+                      index: resolved.resolved_declarations,
+                      target: path
+                    )
+                  )
                 RecordTypePayload =>
-                  match symbol_index_lookup(index: resolved.symbol_index, qualified_path: path) {
+                  match symbol_index_lookup(index: resolved.resolved_declarations, qualified_path: path) {
                     Absent => ConstructNotARecord
-                    Present { value: authored } =>
+                    Present { value: resolved_decl } =>
                       ConstructIsRecord {
                         construct: InferRecordConstruct {
                           record: reference,
                           path: path,
-                          formals: infer_record_formals(resolved: resolved, path: path, authored: authored),
-                          type_params: symbol_index_declared_type_params_at(index: resolved.symbol_index, qualified_path: path)
+                          formals: infer_record_formals(resolved: resolved, path: path, authored: resolved_decl),
+                          type_params: symbol_index_declared_type_params_at(
+                            index: resolved.resolved_declarations,
+                            qualified_path: path
+                          )
                         }
                       }
                   }
@@ -5634,7 +6321,7 @@ fn infer_record_first_positional_actual(actuals: List<Edge>) -> Optional<Edge> {
 
 fn infer_record_construct_binding_refusal(
   node: Node,
-  construct: InferRecordConstruct,
+  record: Node,
   formals: List<InhabitanceFormal>,
   actuals: List<Edge>,
   plan_reason: Symbol,
@@ -5647,7 +6334,7 @@ fn infer_record_construct_binding_refusal(
         infer_record_construct_refusal(
           reason: reason,
           at: node,
-          record: construct.record,
+          record: record,
           field: Edge { label: Authored { name: missing.parameter_identity }, target: missing.declared }
         )
       Absent => application_parameter_order_diagnostic(application: node, reason: application_parameter_order_malformed_reason())
@@ -5655,7 +6342,7 @@ fn infer_record_construct_binding_refusal(
   } else {
     match list_at_optional(xs: actuals, index: at) {
       Present { value: actual } =>
-        infer_record_construct_refusal(reason: reason, at: actual.target, record: construct.record, field: actual)
+        infer_record_construct_refusal(reason: reason, at: actual.target, record: record, field: actual)
       Absent => application_parameter_order_diagnostic(application: node, reason: application_parameter_order_malformed_reason())
     }
   }
@@ -5669,8 +6356,8 @@ type InferRecordFieldBinding
   | RecordFieldsRefused { diagnostic: Diagnostic }
   | RecordPayloadUnread
 
-fn infer_record_field_binding(node: Node, construct: InferRecordConstruct) -> InferRecordFieldBinding {
-  match infer_formals_from_domain(domain: infer_record_formals_payload(formals: construct.formals)) {
+fn infer_record_field_binding(node: Node, record: Node, formals: InferRecordFormals) -> InferRecordFieldBinding {
+  match infer_formals_from_domain(domain: infer_record_formals_payload(formals: formals)) {
     Absent => RecordPayloadUnread
     Present { value: formals } =>
       let actuals = construct_field_edges(n: node)
@@ -5680,7 +6367,7 @@ fn infer_record_field_binding(node: Node, construct: InferRecordConstruct) -> In
             diagnostic: infer_record_construct_refusal(
               reason: ^record_construct_field_not_named,
               at: unnamed.target,
-              record: construct.record,
+              record: record,
               field: unnamed
             )
           }
@@ -5690,7 +6377,7 @@ fn infer_record_field_binding(node: Node, construct: InferRecordConstruct) -> In
               RecordFieldsRefused {
                 diagnostic: infer_record_construct_binding_refusal(
                   node: node,
-                  construct: construct,
+                  record: record,
                   formals: formals,
                   actuals: actuals,
                   plan_reason: reason,
@@ -5713,19 +6400,20 @@ fn infer_record_field_binding(node: Node, construct: InferRecordConstruct) -> In
 // field obligation, or a binder no field value fixed, stays on the frontier, exactly as an
 // application does (infer_transform_derived_optional arguments_decided).
 fn infer_record_construct_type(
-  construct: InferRecordConstruct,
+  type_path: QualifiedName,
+  type_params: List<Symbol>,
   instances: List<TypeVariableInstance>,
   decided: Bool
 ) -> Optional<Node> {
   if !decided {
     optional_absent()
   } else {
-    let reference = declaration_reference_node(qn: construct.path, occurrence_id: OccurrenceSynthetic)
-    if length(xs: construct.type_params) == 0 {
+    let reference = declaration_reference_node(qn: type_path, occurrence_id: OccurrenceSynthetic)
+    if length(xs: type_params) == 0 {
       optional_present(value: reference)
     } else {
       match fold(
-        construct.type_params,
+        type_params,
         init: optional_present(value: [Edge { label: Positional, target: reference }]),
         f: fn(acc, binder) {
           match acc {
@@ -5764,6 +6452,50 @@ fn infer_record_construct_facts(
   entries: List<InferredFactsEntry>,
   declarations: SymbolIndex,
   partials: List<Node>,
+) -> Outcome<InferredFacts> {
+  infer_construct_facts_on_entries(
+    node: node,
+    record: construct.record,
+    formals: construct.formals,
+    type_path: construct.path,
+    type_params: construct.type_params,
+    entries: entries,
+    declarations: declarations,
+    partials: partials
+  )
+}
+
+// A VARIANT ARM's construction derives the VARIANT's type (the arm path's parent declaration
+// reference), with the arm's fields as the formals: `Boxed(41)` is a value of `Seal`, judged at the
+// arm the construction names (v2.compiler.infer infer_record_construct_read reads the arm's path).
+fn infer_variant_construct_facts(
+  node: Node,
+  construct: InferVariantArmConstruct,
+  entries: List<InferredFactsEntry>,
+  declarations: SymbolIndex,
+  partials: List<Node>,
+) -> Outcome<InferredFacts> {
+  infer_construct_facts_on_entries(
+    node: node,
+    record: construct.record,
+    formals: construct.formals,
+    type_path: construct.variant_path,
+    type_params: construct.type_params,
+    entries: entries,
+    declarations: declarations,
+    partials: partials
+  )
+}
+
+fn infer_construct_facts_on_entries(
+  node: Node,
+  record: Node,
+  formals: InferRecordFormals,
+  type_path: QualifiedName,
+  type_params: List<Symbol>,
+  entries: List<InferredFactsEntry>,
+  declarations: SymbolIndex,
+  partials: List<Node>,
 ) -> Outcome<InferredFacts> {
   match infer_bounded_lattice_consumer_gate(consumer: node, partials: partials) {
     Rejected { diagnostics: r } => Rejected { diagnostics: r }
@@ -5772,12 +6504,12 @@ fn infer_record_construct_facts(
         Violates { diagnostic: d } =>
           Rejected { diagnostics: diagnostics_singleton(d: d) }
         Holds { value: descent_proof } =>
-          match infer_record_field_binding(node: node, construct: construct) {
+          match infer_record_field_binding(node: node, record: record, formals: formals) {
             RecordFieldsRefused { diagnostic: d } => outcome_rejected(d)
             RecordPayloadUnread =>
               bind_outcome_accepted(od: cd, inner: inferred_facts_not_derived(node: node, descent: Holds { value: descent_proof }))
             RecordFieldsBound { pairs: pairs } =>
-              match construct.formals {
+              match formals {
                 RecordFormalsAuthored { payload: _ } =>
                   bind_outcome_accepted(
                     od: diagnostics_merge(outer: cd, inner: infer_record_fields_unresolved_diagnostics(pairs: pairs)),
@@ -5785,19 +6517,20 @@ fn infer_record_construct_facts(
                   )
                 RecordFormalsResolved { payload: _ } =>
                   match infer_judge_formal_args(
-                    position: position_record_field(record: construct.record),
+                    position: position_record_field(record: record),
                     site: JudgedAtEachActual,
                     entries: entries,
                     declarations: declarations,
                     pairs: pairs,
-                    type_params: construct.type_params
+                    type_params: type_params
                   ) {
                     Rejected { diagnostics: r } => Rejected { diagnostics: r }
                     Accepted { value: instances, diagnostics: jd } =>
                       bind_outcome_accepted(
                         od: diagnostics_merge(outer: cd, inner: jd),
                         inner: match infer_record_construct_type(
-                          construct: construct,
+                          type_path: type_path,
+                          type_params: type_params,
                           instances: instances,
                           decided: infer_diagnostics_none(d: jd)
                         ) {
@@ -5849,6 +6582,22 @@ fn infer_gather_record_construct_row_on_entries(
   )
 }
 
+fn infer_gather_variant_construct_row_on_entries(
+  node: Node,
+  construct: InferVariantArmConstruct,
+  entries: List<InferredFactsEntry>,
+  declarations: SymbolIndex,
+  pending: Diagnostics,
+  partials: List<Node>,
+) -> InferGatherFoldAcc {
+  infer_gather_formed_facts_row(
+    node: node,
+    formed: infer_variant_construct_facts(node: node, construct: construct, entries: entries, declarations: declarations, partials: partials),
+    entries: entries,
+    pending: pending
+  )
+}
+
 // THE LAST CHILD OF A NODE NO BEHAVIOR ROW AWAITED. An annotated Bind (v2.std.type_binder
 // type_annotation_optional) checks its bound value against the annotation; a product or Arrow still
 // missing its own entry takes the product row; anything else stays as folded.
@@ -6074,6 +6823,15 @@ fn infer_gather_settled_unannotated_row(
               pending: merged_pending,
               partials: partials
             )
+          ConstructIsVariantArm { construct: construct } =>
+            infer_gather_variant_construct_row_on_entries(
+              node: acc.node,
+              construct: construct,
+              entries: merged_entries,
+              declarations: resolved.resolved_declarations,
+              pending: merged_pending,
+              partials: partials
+            )
           ConstructNotARecord =>
             infer_gather_product_row_on_entries(
               node: acc.node,
@@ -6475,21 +7233,625 @@ fn infer_malformed_tree_diagnostic(n: Node) -> Diagnostic {
   }
 }
 
+// THE CALLER-ADMISSION WALL RUNS AFTER THE FACTS GATHER, with the gather's entries in hand: a
+// callee is reached as a resolved reference (a Conj, not an Arrow), and the one authority for the
+// arrow behind such a reference is the use's facts entry (infer_application_callee_arrow_with_facts)
+// — the same accessor every other callee-arrow consumer (formals, type parameters, argument
+// inhabitance) runs through. Before this reorder the wall read infer_operator_arrow on the
+// reference itself and answered Absent for every name-resolved callee, admitting them unjudged —
+// the exact silent widen DESIGN section 5 refuses. Refusal keeps the gather's diagnostics, so no
+// evidence is dropped by the short-circuit.
 fn infer_well_formed(tree: ResolvedTree) -> Outcome<ObligatedInferredTree> {
   match infer_entries_for_tree(tree: tree) {
     Rejected { diagnostics: r } => Rejected { diagnostics: r }
     Accepted { value: entries, diagnostics: d } =>
-      match facts_map_from_entries(entries: entries) {
-        Rejected { diagnostics: r } => Rejected { diagnostics: r }
-        Accepted { value: facts_map, diagnostics: md } =>
-          Accepted {
-            value: ObligatedInferredTree {
-              root: tree.root,
-              facts: facts_map,
-              obligations: Empty
+      match infer_caller_admission_diags(tree: tree, entries: entries) {
+        Some { diagnostics: ned } =>
+          match d {
+            None => Rejected { diagnostics: ned }
+            Some { diagnostics: da } =>
+              Rejected { diagnostics: non_empty_diagnostics_append(a: da, b: ned) }
+          }
+        None =>
+          match facts_map_from_entries(entries: entries) {
+            Rejected { diagnostics: r } => Rejected { diagnostics: r }
+            Accepted { value: facts_map, diagnostics: md } =>
+              Accepted {
+                value: ObligatedInferredTree {
+                  root: tree.root,
+                  facts: facts_map,
+                  obligations: Empty
+                },
+                diagnostics: diagnostics_merge(outer: d, inner: md)
+              }
+          }
+      }
+  }
+}
+
+// ===================================================================
+// CALLER ADMISSION — the admit_callers wall.
+//
+// Restoration of the former drop gunbc.rung_drop.admit_callers_discarded_on_the_native_route:
+// a v2 stage (this one) now checks caller admission on the native route from the fn's declared
+// admit_callers list, refusing a call from a declaration outside it. The clause was parsed by
+// the v2 grammar and carried onto the Arrow by v2.compiler.body_lowering_fold
+// body_lower_fn_admit_clause_edges — the carrier added together with this consumer, as that
+// former drop's trigger requires.
+//
+// THE SEMANTICS ARE THE SEED'S, copied symbol for symbol from v1's wall
+// (src/v1/stage0/src/v1_compiler_infer.rs constructor_call_admission_diags, gated by
+// constructor_reference_admission_enforced() -> true):
+//   - a permitted caller is named by a decl_ref(module_path: "...", decl_name: "...") entry;
+//     an entry that cannot be read as that call refuses (v1 AdmitCallersEntryNotDeclRef) rather
+//     than shrinking the roster silently;
+//   - the caller's coords are its enclosing declaration's (module, name) — v1's
+//     caller_decl_coords read the enclosing fn scope; here the enclosing module member, keyed in
+//     infer_admission_child_context — and membership is v1's decl_ref_coords_equal;
+//   - a call under no declaration has no caller coords and refuses (v1's None arm, the recorded
+//     behavior of gunbc.recurring_failure_mode
+//     admit_callers_names_no_caller_for_a_data_declaration);
+//   - no same-module or test-module exemption exists in the seed and none is added here: the
+//     corpus's forged-proof probe modules are negative fixtures whose compile refusal is the
+//     designed and enrolled behavior (measured, ruling C of lively-ram-153, 2026-10-02: all five
+//     dag/test/probe modules refuse under the v1 seed with ConstructorCallAdmissionRefused among
+//     their blocking errors).
+// ===================================================================
+
+// THE ADMITTED CALLER'S COORDS, AS THE CLAUSE AUTHORS THEM (the ROSTER ENTRY's image): the
+// declaring module's dotted spelling and the declaration's name, both as interned lexemes. The
+// module path is a plain Symbol, not an Optional: every authored entry names its module, so no
+// Absent case can be WRITTEN here -- an entry whose module does not read is uninterpretable and
+// refuses at the entry (the record demand), never silently skipped (review 77558: the dead
+// `Absent => acc` arm the Optional invited).
+type InferAdmitCallerCoords {
+  module_path: Symbol
+  decl_name: Symbol
+}
+
+// THE CALLER'S KEY, AS DESCENT KEYED IT: the innermost enclosing declaration's name. The caller's
+// MODULE is the tree's module and is judged separately -- infer_admission_from_roster unwraps it
+// first and refuses ^infer_reason_caller_admission_module_unreadable when the root carries none.
+// A caller key without a module field cannot fall out of the judgment as a silent skip: the module
+// comparison cannot be written wrong at the point of judgment.
+type InferAdmissionCallerKey {
+  decl_name: Symbol
+}
+
+type InferAdmissionCtx {
+  caller: Optional<InferAdmissionCallerKey>
+  module_symbol: Optional<Symbol>
+}
+
+type InferAdmitEntry
+  = AdmitEntryCoords { coords: InferAdmitCallerCoords }
+  | AdmitEntryUninterpretable
+
+// THE RECORD SHAPE DEMAND: [ decl_ref -> atom(^decl_ref), module_path -> atom, decl_name -> atom ] —
+// the AUTHORED operator edge demands the authored spelling (^decl_ref, v1's gate: only a decl_ref
+// call states coordinates), and both atom identities must be present. Absent = the child is not such
+// a record.
+fn infer_admit_record_check(record: Node) -> Optional<InferAdmitCallerCoords> {
+  match infer_admit_record_operator_spelling(record: record) {
+    Absent => optional_absent()
+    Present { value: _ } =>
+      match infer_admit_entry_field_symbol(record: record, field: ^module_path) {
+        Absent => optional_absent()
+        Present { value: mp } =>
+          match infer_admit_entry_field_symbol(record: record, field: ^decl_name) {
+            Absent => optional_absent()
+            Present { value: dn } =>
+              optional_present(value: InferAdmitCallerCoords { module_path: mp, decl_name: dn })
+          }
+      }
+  }
+}
+
+// THE RECORD'S OPERATOR SPELLING: the AUTHORED `decl_ref` edge the lowering carried from the authored
+// call must name the ^decl_ref atom. A record without it is not a decl_ref call's image.
+fn infer_admit_record_operator_spelling(record: Node) -> Optional<Symbol> {
+  match named_child_lookup(root: record, name: ^decl_ref) {
+    NamedChildFound { target: target } =>
+      match infer_admit_atom_identity(node: target) {
+        Absent => optional_absent()
+        Present { value: op } =>
+          if symbol_eq(a: op, b: ^decl_ref) {
+            optional_present(value: op)
+          } else {
+            optional_absent()
+          }
+      }
+    NamedChildMissing => optional_absent()
+    NamedChildAmbiguous => optional_absent()
+  }
+}
+
+// ONE ENTRY OF THE LIST, READ OR REFUSED. The carrier re-hung the authored call as a POSITIONAL
+// record conj [ module_path -> atom, decl_name -> atom ]; the record's atom identities ARE the
+// coords. Anything else is uninterpretable and refuses at the entry — an entry that cannot be
+// interpreted would otherwise be dropped, silently shrinking the permitted-caller roster below
+// what was authored.
+fn infer_admit_entry_interpret(entry: Node) -> InferAdmitEntry {
+  match infer_admit_record_check(record: entry) {
+    Absent => AdmitEntryUninterpretable
+    Present { value: coords } => AdmitEntryCoords { coords: coords }
+  }
+}
+
+// THE ONE NAMED FIELD'S STRING VALUE, as an interned lexeme: the record conj's authored edge
+// `field` carries an atom whose identity is the interned lexeme.
+fn infer_admit_entry_field_symbol(record: Node, field: Symbol) -> Optional<Symbol> {
+  match named_child_lookup(root: record, name: field) {
+    NamedChildFound { target: target } => infer_admit_atom_identity(node: target)
+    NamedChildMissing => optional_absent()
+    NamedChildAmbiguous => optional_absent()
+  }
+}
+
+fn infer_admit_atom_identity(node: Node) -> Optional<Symbol> {
+  match node.kind {
+    TypeNode { connective: Atom { identity: id } } => optional_present(value: id)
+    TypeNode { connective: Conj } => optional_absent()
+    TypeNode { connective: Disj } => optional_absent()
+    TypeNode { connective: Arrow } => optional_absent()
+    TypeNode { connective: Cardinality } => optional_absent()
+    TypeNode { connective: Instantiation } => optional_absent()
+    ComputationNode { behavior: _ } => optional_absent()
+  }
+}
+
+// THE ROSTER'S RECORDS, read from the core edge target the carrier hung on the Arrow. The carrier
+// re-hung each authored entry as a record conj in a left-named spine — @left carries the record, @right
+// the rest, the empty conj root ends the spine (a conforming conj: every edge authored and distinct
+// within its node). A decl_ref call's image is a record conj; an entry that reads but is not such a
+// call is a marker record the record demand refuses at the entry (DESIGN §5: a failure arm must
+// refuse, never widen). A target that is NOT a walkable spine is the carrier's fail-closed fallback —
+// the authored spine did not read — and REFUSES with ^infer_reason_admit_callers_entries_unreadable
+// at the clause: a malformed clause is never a shorter roster, and the refusal names the cause instead
+// of the downstream refused-call verdict.
+fn infer_admit_clause_entries(roster: Node) -> Outcome<List<Node>> {
+  infer_admit_spine_entries(spine: roster)
+}
+
+fn infer_admit_spine_entries(spine: Node) -> Outcome<List<Node>> {
+  match spine.kind {
+    TypeNode { connective: Conj } =>
+      if is_empty_conj_root(n: spine) {
+        outcome_accepted(value: Empty)
+      } else {
+        match sugar_sequence_pair_optional(node: spine) {
+          Absent =>
+            outcome_rejected(Diagnostic {
+              reason: ^infer_reason_admit_callers_entries_unreadable,
+              at: node_locus(node: spine),
+              correction: Unavailable { reason: ExternalContractUnknown }
+            })
+          Present { value: pair } =>
+            match infer_admit_record_check(record: pair.left) {
+              Absent =>
+                outcome_rejected(Diagnostic {
+                  reason: ^infer_reason_admit_callers_entry_not_decl_ref,
+                  at: node_locus(node: pair.left),
+                  correction: Unavailable { reason: UserInputBoundary }
+                })
+              Present { value: _ } =>
+                match infer_admit_spine_entries(spine: pair.right) {
+                  Rejected { diagnostics: d } => Rejected { diagnostics: d }
+                  Accepted { value: rest, diagnostics: _ } =>
+                    outcome_accepted(value: Cons { head: pair.left, tail: rest })
+                }
+            }
+        }
+      }
+    TypeNode { connective: Atom { identity: _ } } =>
+      outcome_rejected(Diagnostic {
+        reason: ^infer_reason_admit_callers_entries_unreadable,
+        at: node_locus(node: spine),
+        correction: Unavailable { reason: ExternalContractUnknown }
+      })
+    TypeNode { connective: Arrow } =>
+      outcome_rejected(Diagnostic {
+        reason: ^infer_reason_admit_callers_entries_unreadable,
+        at: node_locus(node: spine),
+        correction: Unavailable { reason: ExternalContractUnknown }
+      })
+    TypeNode { connective: Cardinality } =>
+      outcome_rejected(Diagnostic {
+        reason: ^infer_reason_admit_callers_entries_unreadable,
+        at: node_locus(node: spine),
+        correction: Unavailable { reason: ExternalContractUnknown }
+      })
+    TypeNode { connective: Instantiation } =>
+      outcome_rejected(Diagnostic {
+        reason: ^infer_reason_admit_callers_entries_unreadable,
+        at: node_locus(node: spine),
+        correction: Unavailable { reason: ExternalContractUnknown }
+      })
+    TypeNode { connective: Disj } =>
+      outcome_rejected(Diagnostic {
+        reason: ^infer_reason_admit_callers_entries_unreadable,
+        at: node_locus(node: spine),
+        correction: Unavailable { reason: ExternalContractUnknown }
+      })
+    ComputationNode { behavior: _ } =>
+      outcome_rejected(Diagnostic {
+        reason: ^infer_reason_admit_callers_entries_unreadable,
+        at: node_locus(node: spine),
+        correction: Unavailable { reason: ExternalContractUnknown }
+      })
+  }
+}
+
+// EVERY DIAGNOSTIC THE LIST CARRIES, folded into the stage's Diagnostics carrier.
+fn infer_admission_diags_of(ds: List<Diagnostic>) -> Diagnostics {
+  fold(ds, init: None, f: fn(acc, d) {
+    diagnostics_merge(
+      outer: acc,
+      inner: Some { diagnostics: NonEmptyDiagnostics { head: d, tail: [] } }
+    )
+  })
+}
+
+type InferAdmitJudgement {
+  matched: Bool
+  diags: List<Diagnostic>
+}
+
+// EVERY ENTRY PLACED, THEN THE LIST'S VERDICT: uninterpretable entries refuse beside whatever
+// they sit with; the call refuses when no entry names its caller (v1: ConstructorCallAdmissionRefused).
+fn infer_admission_judge_entries(
+  application: Node,
+  entries: List<Node>,
+  caller: InferAdmissionCallerKey,
+  module_symbol: Symbol
+) -> Diagnostics {
+  let j = fold(entries, init: InferAdmitJudgement { matched: false, diags: [] }, f: fn(acc, entry) {
+    match infer_admit_entry_interpret(entry: entry) {
+      AdmitEntryUninterpretable =>
+        InferAdmitJudgement {
+          matched: acc.matched,
+          diags: list_snoc_item(
+            xs: acc.diags,
+            item: Diagnostic {
+              reason: ^infer_reason_admit_callers_entry_not_decl_ref,
+              at: node_locus(node: entry),
+              correction: Unavailable { reason: UserInputBoundary }
+            }
+          )
+        }
+      AdmitEntryCoords { coords: coords } =>
+        if symbol_eq(a: coords.module_path, b: module_symbol) && symbol_eq(a: coords.decl_name, b: caller.decl_name) {
+          InferAdmitJudgement { matched: true, diags: acc.diags }
+        } else {
+          acc
+        }
+    }
+  })
+  if j.matched {
+    infer_admission_diags_of(ds: j.diags)
+  } else {
+    infer_admission_diags_of(ds: list_snoc_item(
+      xs: j.diags,
+      item: Diagnostic {
+        reason: ^infer_reason_caller_admission_refused,
+        at: node_locus(node: application),
+        correction: Unavailable { reason: UserInputBoundary }
+      }
+    ))
+  }
+}
+
+// ONE APPLICATION'S VERDICT UNDER `caller`. Only a callee whose Arrow carries the admit edge is
+// judged; an unrostered callee imposes nothing (scope rule: the clause rides the fn Arrow, and a
+// fn whose Arrow does not carry it is not restricted). An Ambiguous admit edge refuses at the
+// application. The entries come from the facts gather, so an imported callee's clause is read the
+// same way a same-module one is.
+fn infer_caller_admission_application_diags(
+  application: Node,
+  caller: Optional<InferAdmissionCallerKey>,
+  module_symbol: Optional<Symbol>,
+  entries: List<InferredFactsEntry>,
+  declarations: SymbolIndex
+) -> Diagnostics {
+  match infer_application_callee_arrow_with_facts(node: application, entries: entries) {
+    Absent =>
+      match list_at_optional(xs: node_positional_child_targets(node: application), index: 0) {
+        Absent => None
+        Present { value: child0 } =>
+          match resolved_reference_body_kind(target: child0) {
+            NotMarkedReference => None
+            MarkedReference { kind: DeclarationReferenceKind } =>
+              match infer_callee_declaration_from_declarations(declarations: declarations, callee_ref: child0) {
+                Absent =>
+                  infer_admission_diags_of([
+                    Diagnostic {
+                      reason: ^infer_reason_caller_admission_callee_unresolved,
+                      at: node_locus(node: application),
+                      correction: Suggested { node: child0 }
+                    }
+                  ])
+                Present { value: decl } =>
+                  match infer_operator_arrow(operator: decl) {
+                    Absent =>
+                      infer_admission_diags_of([
+                        Diagnostic {
+                          reason: ^infer_reason_caller_admission_callee_unreadable,
+                          at: node_locus(node: application),
+                          correction: Suggested { node: child0 }
+                        }
+                      ])
+                    Present { value: arrow } =>
+                      infer_caller_admission_judged_diags(
+                        application: application,
+                        caller: caller,
+                        module_symbol: module_symbol,
+                        arrow: arrow,
+                        declarations: declarations
+                      )
+                  }
+              }
+            MarkedReference { kind: _ } => None
+          }
+      }
+    Present { value: arrow } =>
+      infer_caller_admission_judged_diags(
+        application: application,
+        caller: caller,
+        module_symbol: module_symbol,
+        arrow: arrow,
+        declarations: declarations
+      )
+  }
+}
+
+// THE CALLEE'S DECLARATION FROM THE RESOLVED-DECLARATIONS INDEX: a cross-module callee's facts are
+// never in the subject's gather (the gather walks the subject root), so the wall reads the callee's
+// own declaration node from resolved_declarations -- declarations WITH RESOLVED BODIES, imported
+// modules included. THE BOUNDARY BETWEEN NO JUDGMENT AND REFUSAL: an operator child that is not
+// marked as a declaration reference is no judgment -- the ordinary grounding machinery owns that
+// call, no clause can exist for it, the wall imposes nothing (NotMarkedReference). But a child
+// MARKED as a declaration reference (MarkedReference{DeclarationReferenceKind}) whose path has no
+// entry in the index is NOT "not declared": the mark asserts a declaration stands behind the
+// reference, so an unavailable one is an unresolved admission authority and the caller admission
+// REFUSES on it (RosterLookupUnresolved -> infer_reason_caller_admission_callee_unresolved, fail
+// closed). A FOUND declaration whose arrow cannot be read is the same kind of failure one step
+// later and refuses separately (infer_reason_caller_admission_callee_unreadable). The two are
+// distinct facts about the world -- the declaration missing versus the declaration present but
+// unreadable -- and both refuse; neither shortens the roster nor admits.
+fn infer_callee_declaration_from_declarations(declarations: SymbolIndex, callee_ref: Node) -> Optional<Node> {
+  match declaration_reference_path_optional(node: callee_ref) {
+    Absent => optional_absent()
+    Present { value: qn } => symbol_index_lookup(index: declarations, qualified_path: qn)
+  }
+}
+
+fn infer_caller_admission_judged_diags(
+  application: Node,
+  caller: Optional<InferAdmissionCallerKey>,
+  module_symbol: Optional<Symbol>,
+  arrow: Node,
+  declarations: SymbolIndex
+) -> Diagnostics {
+  match core_edge_target_lookup(children: arrow.children, marker: AdmitCallersEdge) {
+    Ambiguous =>
+      infer_admission_diags_of([
+        Diagnostic {
+          reason: ^infer_reason_admit_callers_edge_ambiguous,
+          at: node_locus(node: application),
+          correction: Unavailable { reason: UserInputBoundary }
+        }
+      ])
+    Absent =>
+      match infer_caller_admission_roster_from_declarations(
+        application: application,
+        declarations: declarations
+      ) {
+        RosterLookupAbsent => None
+        RosterLookupAmbiguous =>
+          infer_admission_diags_of([
+            Diagnostic {
+              reason: ^infer_reason_admit_callers_edge_ambiguous,
+              at: node_locus(node: application),
+              correction: Unavailable { reason: UserInputBoundary }
+            }
+          ])
+        RosterLookupUnreadable =>
+          infer_admission_diags_of([
+            Diagnostic {
+              reason: ^infer_reason_caller_admission_callee_unreadable,
+              at: node_locus(node: application),
+              correction: match list_at_optional(xs: node_positional_child_targets(node: application), index: 0) {
+                Absent => Unavailable { reason: ExternalContractUnknown }
+                Present { value: callee_ref } => Suggested { node: callee_ref }
+              }
+            }
+          ])
+        RosterLookupUnresolved =>
+          infer_admission_diags_of([
+            Diagnostic {
+              reason: ^infer_reason_caller_admission_callee_unresolved,
+              at: node_locus(node: application),
+              correction: match list_at_optional(xs: node_positional_child_targets(node: application), index: 0) {
+                Absent => Unavailable { reason: ExternalContractUnknown }
+                Present { value: callee_ref } => Suggested { node: callee_ref }
+              }
+            }
+          ])
+        RosterLookupFound { target: roster } => infer_admission_from_roster(
+          application: application,
+          caller: caller,
+          module_symbol: module_symbol,
+          roster: roster
+        )
+      }
+    Found { target: roster } => infer_admission_from_roster(
+      application: application,
+      caller: caller,
+      module_symbol: module_symbol,
+      roster: roster
+    )
+  }
+}
+
+// THE ADMIT ROSTER'S ONE HOME IS THE RESOLVED TREE'S ARROW. The facts arrow is infer's CANONICAL
+// GROUNDING of the callee reference -- a rebuilt copy whose formals and body survive but whose core
+// metadata edges (the carrier's AdmitCallersEdge among them) do not. When the facts copy is
+// unmarked, read the roster off the resolved-declarations arrow for the same declared callee.
+// Absent when the application's operator child is not a marked reference at all, or the resolved
+// arrow carries no roster (a fn without the clause -- the legitimate admit). Unresolved when the
+// child IS marked as a declaration reference but no declaration stands behind it: that is not
+// "not declared", it is a grounding failure, and the caller admission refuses on it (fail closed).
+type InferAdmitRosterLookup
+  = RosterLookupAbsent
+  | RosterLookupAmbiguous
+  | RosterLookupUnreadable
+  | RosterLookupUnresolved
+  | RosterLookupFound { target: Node }
+
+fn infer_caller_admission_roster_from_declarations(
+  application: Node,
+  declarations: SymbolIndex
+) -> InferAdmitRosterLookup {
+  match list_at_optional(xs: node_positional_child_targets(node: application), index: 0) {
+    Absent => RosterLookupAbsent
+    Present { value: child0 } =>
+      match resolved_reference_body_kind(target: child0) {
+        NotMarkedReference => RosterLookupAbsent
+        MarkedReference { kind: DeclarationReferenceKind } =>
+          match infer_callee_declaration_from_declarations(declarations: declarations, callee_ref: child0) {
+            Absent => RosterLookupUnresolved
+            Present { value: decl } =>
+              match infer_operator_arrow(operator: decl) {
+                Absent => RosterLookupUnreadable
+                Present { value: resolved_arrow } =>
+                  match core_edge_target_lookup(children: resolved_arrow.children, marker: AdmitCallersEdge) {
+                    Absent => RosterLookupAbsent
+                    Ambiguous => RosterLookupAmbiguous
+                    Found { target: roster } => RosterLookupFound { target: roster }
+                  }
+              }
+          }
+        MarkedReference { kind: _ } => RosterLookupAbsent
+      }
+  }
+}
+
+// THE JUDGMENT FROM A MINTED ROSTER. THE MODULE CHECK HAPPENS HERE, AT THE POINT OF JUDGMENT:
+// comparing the roster's entry coordinates against the caller's module is the judgment; a
+// fn-rooted grounding context carries no tree module, so the comparison is undetermined and the
+// call refuses (module_unreadable, located at the call) rather than judge with a fabricated
+// module -- fail closed where it matters, never at the root (a root-level refusal would refuse
+// every fn-rooted context wholesale).
+fn infer_admission_from_roster(
+  application: Node,
+  caller: Optional<InferAdmissionCallerKey>,
+  module_symbol: Optional<Symbol>,
+  roster: Node
+) -> Diagnostics {
+  match infer_admit_clause_entries(roster: roster) {
+    Rejected { diagnostics: d } => Some { diagnostics: d }
+    Accepted { value: records, diagnostics: _ } =>
+      match caller {
+        Absent => infer_admission_diags_of([
+          Diagnostic {
+            reason: ^infer_reason_caller_admission_caller_unkeyed,
+            at: node_locus(node: application),
+            correction: Unavailable { reason: UserInputBoundary }
+          }
+        ])
+        Present { value: coords } =>
+          match module_symbol {
+            Absent => infer_admission_diags_of([
+              Diagnostic {
+                reason: ^infer_reason_caller_admission_module_unreadable,
+                at: node_locus(node: application),
+                correction: Unavailable { reason: UserInputBoundary }
+              }
+            ])
+            Present { value: tree_module } =>
+              infer_admission_judge_entries(
+                application: application,
+                entries: records,
+                caller: coords,
+                module_symbol: tree_module
+              )
+          }
+      }
+  }
+}
+
+// DESCENT KEYING. The namespace graft DISSOLVES the declaration member wrap and re-hangs each
+// member's Arrow DIRECTLY under the module body conj, under an authored edge named for the
+// declaration (v2.compiler.body_lowering_fold body_lower_fn_decl_named_member_wrap: "the wrap is a
+// carrier, not the image root ... re-hangs the Arrow under the module; the Arrow is what stands for
+// the authored declaration in the admitted tree"). So an AUTHORED edge whose target is an Arrow
+// inside the grafted body names the declaration the calls below it sit in — the same edge resolve
+// harvests the binding from (v2.compiler.03_resolve harvest_module_root_named_bindings /
+// try_edge_declared_binding). Keying REPLACES the caller, so a nested declaration keys its own
+// calls once the descent passes its authored edge (innermost enclosing declaration wins, which is
+// the caller v1 judged). Descending through any other edge keeps the enclosing caller.
+fn infer_admission_child_context(self: Node, ctx: InferAdmissionCtx, edge: Edge) -> InferAdmissionCtx {
+  match edge.label {
+    Authored { name: member_name } =>
+      match edge.target.kind {
+        TypeNode { connective: Arrow } =>
+          InferAdmissionCtx {
+            caller: Present {
+              value: InferAdmissionCallerKey { decl_name: member_name }
             },
-            diagnostics: diagnostics_merge(outer: d, inner: md)
+            module_symbol: ctx.module_symbol
           }
+        TypeNode { connective: Atom { identity: _ } } => ctx
+        TypeNode { connective: Conj } => ctx
+        TypeNode { connective: Disj } => ctx
+        TypeNode { connective: Cardinality } => ctx
+        TypeNode { connective: Instantiation } => ctx
+        ComputationNode { behavior: _ } => ctx
       }
+    Positional => ctx
+    StructuralLabel { label: _ } => ctx
   }
 }
+
+// THE ROOT'S MODULE NAME, when the root is a module: the caller-module key for module-rooted
+// trees. A sub-tree root (a fn-rooted grounding context) reads as no module and the wall still
+// runs -- see the judgment-point check in infer_admission_from_roster.
+fn infer_admission_root_module_symbol(root: Node) -> Optional<Symbol> {
+  match qualified_name_from_module_node(root: root) {
+    Rejected { diagnostics: _ } => optional_absent()
+    Accepted { value: module_qn, diagnostics: _ } =>
+      optional_present(value: symbol_intern_lexeme(lexeme: qualified_name_to_dotted_string(qn: module_qn)))
+  }
+}
+
+// THE WALL, over the whole resolved tree, top-down so each application is judged under the
+// declaration it sits in. The tree is judged however it is rooted: a module-rooted tree carries
+// its module name in the descent context (it keys the caller's module); a sub-tree root (a
+// fn-rooted grounding context -- the cross-language and self-host fixtures run infer on slices)
+// carries NO module name, and the wall still runs. Failure arms FAIL CLOSED (DESIGN.md §5:
+// refuse, never widen) -- but where they fail matters: an unreadable module name is not a
+// tree-level fault, it is unreadable only where a judgment needs it, so the refusal fires at the
+// application being judged (module_unreadable, located at the call), never as a root-level
+// precondition that would refuse every fn-rooted context wholesale.
+fn infer_caller_admission_diags(tree: ResolvedTree, entries: List<InferredFactsEntry>) -> Diagnostics {
+  fold_node_topdown(
+    n: tree.root,
+    ctx: InferAdmissionCtx {
+      caller: Absent,
+      module_symbol: infer_admission_root_module_symbol(root: tree.root)
+    },
+        algebra: NodeFoldTopDown {
+          init: fn(self, ctx) {
+            infer_caller_admission_application_diags(
+              application: self,
+              caller: ctx.caller,
+              module_symbol: ctx.module_symbol,
+              entries: entries,
+              declarations: tree.resolved_declarations
+            )
+          },
+          child_context: fn(self, ctx, edge) { infer_admission_child_context(self: self, ctx: ctx, edge: edge) },
+          step: fn(acc, _edge, sub) { diagnostics_merge(outer: acc, inner: sub) }
+        }
+      )
+}
diff --git a/src/v2/compiler/05_eval.dag b/src/v2/compiler/05_eval.dag
index 3950432e690..267a87e4890 100644
--- a/src/v2/compiler/05_eval.dag
+++ b/src/v2/compiler/05_eval.dag
@@ -147,6 +147,7 @@ import v2.std.node {
   well_formed,
 }
 import v2.std.node_query {
+  arrow_constant_member_codomain,
   FieldProjection,
   field_projection_edge_base_optional,
   field_projection_optional,
@@ -527,37 +528,13 @@ type TestClaimEvalSubject<T> {
   input: TestClaimTypedInput<T>
 }
 
-type TestClaimCacheKey<T> {
-  eval_subject: TestClaimEvalSubject<T>
-}
-
-fn test_claim_cache_key_claim_hash<T>(key: TestClaimCacheKey<T>) -> Hash {
-  test_claim_claim_hash_digest(c: key.eval_subject.claim)
-}
-
-fn test_claim_cache_key_interpretation_hash_node(key: TestClaimCacheKey<Node>) -> Hash {
-  test_claim_cache_interpretation_hash_node(subject: key.eval_subject)
-}
-
-type TestClaimCacheReceipt<T> {
-  key: TestClaimCacheKey<T>
-}
-
 type TestClaimRun<S, A> {
-  cache: TestClaimCacheReceipt<S>
+  claim: TestClaim
   verdict: Verdict<TestClaimEvalSubject<S>, A>
 }
 
-fn test_claim_cache_key_claim<T>(key: TestClaimCacheKey<T>) -> TestClaim {
-  key.eval_subject.claim
-}
-
-fn test_claim_cache_receipt_claim<T>(receipt: TestClaimCacheReceipt<T>) -> TestClaim {
-  test_claim_cache_key_claim(key: receipt.key)
-}
-
 fn test_claim_run_claim<S, A>(run: TestClaimRun<S, A>) -> TestClaim {
-  test_claim_cache_receipt_claim(receipt: run.cache)
+  run.claim
 }
 
 fn test_claim_run_verdict<S, A>(run: TestClaimRun<S, A>) -> Verdict<TestClaimEvalSubject<S>, A> {
@@ -1008,18 +985,6 @@ fn test_claim_cache_interpretation_hash_node(subject: TestClaimEvalSubject<Node>
   )
 }
 
-fn test_claim_cache_receipt_node(subject: TestClaimEvalSubject<Node>) -> TestClaimCacheReceipt<Node> {
-  TestClaimCacheReceipt {
-    key: TestClaimCacheKey {
-      eval_subject: subject
-    }
-  }
-}
-
-fn test_claim_cache_receipt(subject: TestClaimEvalSubject<Node>) -> TestClaimCacheReceipt<Node> {
-  test_claim_cache_receipt_node(subject: subject)
-}
-
 fn eval_diagnostic(reason: Symbol, node: Node) -> Diagnostic {
   Diagnostic {
     reason: reason,
@@ -2509,6 +2474,63 @@ fn eval_interpret_node(
   )
 }
 
+// THE CONSTANT'S BODY RUNS THROUGH THE SAME BODY-FORM DISPATCH A NULLARY CALL USES (eval_transform_node's
+// callee arm): v2.std.node arrow_body_admits_eval_entry decides whether the form may enter, a direct atom
+// (a literal) is allocated by eval_type_node_atom without a facts lookup, and every other admitted form
+// is walked by eval_runtime_node. A form that may not enter refuses with eval_callee_body_refusal_reason,
+// the reason the call route gives for the same form, so the two routes cannot disagree about a body.
+fn eval_constant_member_value(
+  body: Node,
+  tree: InferredTree,
+  interpretation: InterpretationAlgebra,
+  environment: EvaluationEnvironment,
+  runtime: V4EvaluatorRuntime,
+  effect_io: EffectIoEvalContext
+) -> Outcome<RuntimeValue> {
+  let form = classify_arrow_body_form(target: body)
+  if !arrow_body_admits_eval_entry(form: form) {
+    outcome_rejected(d: eval_diagnostic(reason: eval_callee_body_refusal_reason(form: form), node: body))
+  } else {
+    match form {
+      DirectAtomBody => eval_type_node_atom(node: body, interpretation: interpretation, environment: environment)
+      RecordConstructBody => eval_runtime_node(node: body, tree: tree, interpretation: interpretation, environment: environment, runtime: runtime, effect_io: effect_io)
+      DeclarationReferenceBody => eval_runtime_node(node: body, tree: tree, interpretation: interpretation, environment: environment, runtime: runtime, effect_io: effect_io)
+      ParameterReferenceBody => eval_runtime_node(node: body, tree: tree, interpretation: interpretation, environment: environment, runtime: runtime, effect_io: effect_io)
+      LexicalReferenceBody => eval_runtime_node(node: body, tree: tree, interpretation: interpretation, environment: environment, runtime: runtime, effect_io: effect_io)
+      FunctionValueBody => eval_runtime_node(node: body, tree: tree, interpretation: interpretation, environment: environment, runtime: runtime, effect_io: effect_io)
+      ComputationBody { behavior: _ } => eval_runtime_node(node: body, tree: tree, interpretation: interpretation, environment: environment, runtime: runtime, effect_io: effect_io)
+      UnsupportedArrowBody => eval_runtime_node(node: body, tree: tree, interpretation: interpretation, environment: environment, runtime: runtime, effect_io: effect_io)
+    }
+  }
+}
+
+// A REFERENCE TO A `data` CONSTANT EVALUATES TO THE CONSTANT'S VALUE: the body of the nullary Arrow body
+// lowering realizes it as, evaluated as the nullary application the seed performs at every reference
+// (v1.compiler.emit_rust emits a data item as a nullary fn and calls it). The declaration is the
+// denotation infer recorded beside the reference, and it is a constant exactly when its Arrow carries
+// v2.std.node ConstantMemberEdge -- the same reader (v2.std.node_query arrow_constant_member_codomain)
+// infer typed the reference by, so a reference infer typed at T is the one eval applies, and every other
+// value-position declaration reference keeps the binding-miss refusal in eval_type_node_atom. The empty
+// domain binds nothing, so the body runs in the environment of the reference.
+fn eval_constant_member_body(node: Node, facts: InferredFacts) -> Optional<Node> {
+  match declaration_reference_path_optional(node: node) {
+    Absent => Absent
+    Present { value: _ } =>
+      match facts.denotation {
+        Absent => Absent
+        Present { value: declaration } =>
+          match arrow_constant_member_codomain(arrow: declaration) {
+            Absent => Absent
+            Present { value: _ } =>
+              match find_arrow_body_child(root: declaration) {
+                Accepted { value: body, diagnostics: _ } => Present { value: body }
+                Rejected { diagnostics: _ } => Absent
+              }
+          }
+      }
+  }
+}
+
 // A FIELD PROJECTION SELECTS A FIELD FROM THE RECEIVER'S VALUE, and refuses on anything else. Without
 // this arm a projection reached the default TypeNode route and was handed to allocate_literal, which
 // would fabricate a literal out of a two-edge Conj -- a value for an expression that selects, not one
@@ -2864,6 +2886,53 @@ fn eval_fold_tree(
   environment: EvaluationEnvironment,
   runtime: V4EvaluatorRuntime,
   effect_io: EffectIoEvalContext
+) -> EvalFoldState {
+  match eval_constant_reference_body(tree: tree, node: n) {
+    Present { value: body } =>
+      eval_fold_constant_reference_state(node: n, body: body, tree: tree, interpretation: interpretation, environment: environment, runtime: runtime, effect_io: effect_io)
+    Absent => eval_fold_tree_walk(n: n, tree: tree, interpretation: interpretation, environment: environment, runtime: runtime, effect_io: effect_io)
+  }
+}
+
+// A REFERENCE TO A `data` CONSTANT IS A LEAF OF THE WALK, AS A PARAMETER REFERENCE IS (eval_runtime_node's
+// first arm). Its only child is its declaring path spine, which is identity data built at
+// OccurrenceSynthetic with no facts entry of its own, so descending into it refused with
+// infer_facts_lookup_miss on the spine before the reference was ever valued. The leaf's value is the
+// constant's, through eval_constant_member_value; its structural check is the reference's own facts.
+fn eval_fold_constant_reference_state(
+  node: Node,
+  body: Node,
+  tree: InferredTree,
+  interpretation: InterpretationAlgebra,
+  environment: EvaluationEnvironment,
+  runtime: V4EvaluatorRuntime,
+  effect_io: EffectIoEvalContext
+) -> EvalFoldState {
+  EvalFoldState {
+    node: node,
+    progress: Interpreted,
+    structural: eval_structural_node_for_eval(tree: tree, node: node),
+    child_values: Accepted { value: empty_runtime_values(), diagnostics: None },
+    value: eval_constant_member_value(body: body, tree: tree, interpretation: interpretation, environment: environment, runtime: runtime, effect_io: effect_io)
+  }
+}
+
+// The constant body a node names when it is a declaration reference whose facts record a marked
+// declaration, Absent for every other node (so every other node keeps the ordinary walk).
+fn eval_constant_reference_body(tree: InferredTree, node: Node) -> Optional<Node> {
+  match tree.facts.lookup(node) {
+    Absent => Absent
+    Present { value: facts } => eval_constant_member_body(node: node, facts: facts)
+  }
+}
+
+fn eval_fold_tree_walk(
+  n: Node,
+  tree: InferredTree,
+  interpretation: InterpretationAlgebra,
+  environment: EvaluationEnvironment,
+  runtime: V4EvaluatorRuntime,
+  effect_io: EffectIoEvalContext
 ) -> EvalFoldState {
   if eval_runtime_node_is_control_transfer(node: n) {
     eval_fold_control_transfer_state(
@@ -3494,7 +3563,7 @@ fn run_test_claim_runtime_evaluated(
     inputs: inputs_root_only(root: subject.input.evaluator_input)
   )
   TestClaimRun {
-    cache: test_claim_cache_receipt_node(subject: subject),
+    claim: subject.claim,
     verdict: aggregate_verdicts(
       rs: [
         run_test_claim_runtime_assert(
@@ -3517,7 +3586,7 @@ fn run_test_claim(
   match subject.claim {
     RoundTripClaim { label: _, anchor: _, input: _, classification: _ } =>
       TestClaimRun {
-        cache: test_claim_cache_receipt_node(subject: subject),
+        claim: subject.claim,
         verdict: run_test_claim_round_trip_verdict_runtime(
           actual: eval_round_trip_claim_input_for_verdict(
             input: subject.input.evaluator_input
@@ -3528,7 +3597,7 @@ fn run_test_claim(
 
     StructuralEqualsClaim { rhs: rhs, label: _, anchor: _, lhs: _, classification: _ } =>
       TestClaimRun {
-        cache: test_claim_cache_receipt_node(subject: subject),
+        claim: subject.claim,
         verdict: run_test_claim_structural_equals_verdict(
           actual: eval_round_trip_claim_input_for_verdict(
             input: subject.input.evaluator_input
diff --git a/src/v2/compiler/06_translate.dag b/src/v2/compiler/06_translate.dag
index 230d2bcae89..e26c628038b 100644
--- a/src/v2/compiler/06_translate.dag
+++ b/src/v2/compiler/06_translate.dag
@@ -86,7 +86,7 @@ import v2.std.node {
   Positional,
   Symbol,
   TypeNode,
-  arrow_named_edge_is_contract,
+  arrow_named_edge_is_metadata,
   content_hash,
   fold_node,
   node_rebuild,
@@ -365,7 +365,7 @@ fn translate_derived_parent_underived_child_gate(
 // only there: the same label elsewhere is not a contract edge and is gated like any child.
 fn translate_edge_is_arrow_contract(parent: Node, edge: Edge) -> Bool {
   match parent.kind {
-    TypeNode { connective: Arrow } => arrow_named_edge_is_contract(e: edge)
+    TypeNode { connective: Arrow } => arrow_named_edge_is_metadata(e: edge)
     _ => false
   }
 }
diff --git a/src/v2/compiler/body_lowering_fold.dag b/src/v2/compiler/body_lowering_fold.dag
index 6386e88a2cc..b4ccb94bc48 100644
--- a/src/v2/compiler/body_lowering_fold.dag
+++ b/src/v2/compiler/body_lowering_fold.dag
@@ -68,6 +68,7 @@ import v2.extdeps.languages.dag {
   dag_string_literal_value_symbol_optional,
   dag_symbol_literal_name_optional,
   dag_symbol_literal_node,
+  parse_repeat_capture_items_with,
   dag_match_arm_node,
   dag_resolve_preserve_module_metadata_subtree,
   parse_production_captured_child_optional,
@@ -99,18 +100,49 @@ import std.optional {
   optional_present
 }
 import v2.std.compilers.body_lowering {
+  BodyTerm,
+  Lowered,
+  RawLeaf,
+  RawParse,
   lower_binary_infix,
   lower_branch,
   lower_bind,
   lower_bind_annotated,
   lower_loop,
   lower_match,
-  lower_unary_prefix
+  lower_unary_prefix,
+  application_head_read,
+  ApplicationHeadFound,
+  ApplicationHeadRefused,
+  ArrowHead,
+  AtomHead,
+  NotApplicationHead
+}
+import v2.std.compilers.lowered_shape {
+  LoweredBranch,
+  LoweredDataDeclaration,
+  LoweredFnBody,
+  LoweredFnDeclaration,
+  LoweredFoldEncoding,
+  LoweredFunctionValue,
+  LoweredLet,
+  LoweredLoop,
+  LoweredMatch,
+  LoweredOperand,
+  LoweredOperatorExpression,
+  LoweredPostfix,
+  LoweredPrimary,
+  LoweredResourceDeclaration,
+  LoweredServiceDeclaration,
+  LoweredShape,
+  LoweredStatementSequence,
+  LoweredTestDeclaration,
+  LoweredTypeDeclaration
 }
 import v2.std.list_introduction { lower_list_introduction }
 import v2.std.arrow_signature { anonymous_signature_arrow, declared_signature, signature_order_edge }
-import v2.std.compilers.sugar { SugarSequencePair, sugar_sequence_pair_optional }
-import v2.std.grammar { GrammarExpr, GrammarExprFold, fold_grammar_expr }
+import v2.std.compilers.sugar { SugarSequencePair, sugar_sequence_pair_optional, sugar_named_child_optional, sugar_type_node }
+import v2.std.grammar { GrammarExpr, GrammarExprFold, fold_grammar_expr, grammar_infix_row_class }
 import v2.std.diagnostic {
   Accepted,
   Diagnostic,
@@ -143,9 +175,15 @@ import v2.std.node {
   ArrowSignatureOrderEdge,
   ArrowExecutionModeClaimEdge,
   ArrowResourceRequirementsEdge,
+  BodyTermLoweredEdge,
+  BodyTermLoweredSeal,
+  CoreMarker,
+  body_term_lowered_seal,
+  AdmitCallersEdge,
   MapLiteralEntryEdge,
   MapLiteralEntriesEdge,
   MatchArmScopeExitEdge,
+  ConstantMemberEdge,
   core_edge,
   labeled_core_is,
   StructuralLabel,
@@ -196,6 +234,7 @@ import v2.std.arrow_contract { effect_claim_label, hermetic_claim_label }
 import std.effects { EffectClaim, ReadonlyClaim, IdempotentClaim }
 import v2.std.node_query {
   binder_edge,
+  construct_field_edges,
   member_edge_type_node,
   node_positional_child_targets,
   construct_node,
@@ -620,80 +659,7 @@ fn body_lower_wrapper_retained_shell(shell: Node) -> Outcome<BodyLowering> {
   }
 }
 
-// THE QUALIFIED-NAME SPINE IS LOWERED SUBSTRATE. body_lower_reduce runs bottom-up, so by the time
-// a fn declaration's body is read, a dotted chain in it has already been lowered to the spine
-// body_lower_qualified_name_spine_node builds -- a TypeNode Conj under the fold_list labels that no
-// grammar production emits. Before this arm the spine was not recognised as lowered, and the
-// expression-body readers (body_lower_eq_expr_to_body through body_lower_operand_ref_optional)
-// decomposed it to its FIRST ATOM: `fn f() -> Bool = wall.peer.peer_leaf` reached the arrow body
-// as the atom `wall`, measured on the normalize route by
-// v2.test.claim.body_lowering_qualified_path, while a call through the same chain survived only
-// because a Transform already counted as substrate. One shape, one verdict: what the spine
-// builder emits, every later reader keeps.
-// A CONSTRUCT IS LOWERED SUBSTRATE. The record-literal producer answers a Conj (v2.std.node_query
-// construct_node: tag edge, then field edges), and every reducer above it -- the postfix reduce
-// first -- must pass it through as it passes an Arrow or a Transform; the first-atom fallback
-// they otherwise take would answer the construct's tag and drop its fields, which is exactly how
-// `data d: R = R { .. }` reached the graft as the atom R before this arm.
-// A FIELD PROJECTION IS LOWERED SUBSTRATE, for the construct's reason. The postfix chain fold
-// answers `f(x).a` as v2.std.node_query field_projection_node, a two-edge Conj (base, field), and
-// until this arm nothing above the postfix reduce recognised it: an operator operand, a paren
-// group or a unary operand re-read the Conj as unlowered, and the first-child descent answered its
-// BASE -- `p + g(x).a` lowered to `p + g(x)` with no diagnostic, silent wrongness below the ladder
-// (DESIGN 4b). The producer and this predicate now agree on one shape, field_projection_optional,
-// the same reader the projection's consumers use.
-// A LOWERED INT LITERAL IS SUBSTRATE, AND ITS PAYLOAD IS NOT A NAME. body_lower_int_literal_with_magnitude_optional
-// produces an Atom(dag_token_int_literal) carrying the integer authority's decimal digit list as
-// its magnitude field, and that list is a FreeMonoid cons spine: the same head/tail shape
-// qualified_name_spine_shape_present recognizes. Until 2026-09-23 the literal atom was not
-// recognized here and its payload was, so a deep search from a `= expr` body (a data initializer,
-// or `fn f() -> Int = 606060`) stepped past the literal and returned its digit list as the body,
-// which resolve then refused as an unbound qualified name. Recognizing the literal stops every
-// search at the literal, before it reaches the payload.
-fn body_lower_is_core_substrate_leaf(node: Node) -> Bool {
-  (match body_lower_int_literal_with_magnitude_optional(node: node) { Present { value: lit } => lit == node  Absent => false })
-    || (match body_lower_string_literal_value_optional(node: node) { Present { value: lit } => lit == node  Absent => false })
-    || (match dag_symbol_literal_name_optional(node: node) { Present { value: _ } => true  Absent => false })
-    || qualified_name_spine_shape_present(root: node)
-    || (match construct_tag_reading(n: node) { ConstructTagAuthored { reference: _ } => true  ConstructTagElided => true  NotAConstruct => false })
-    || (match field_projection_optional(n: node) { Present { value: _ } => true  Absent => false })
-}
-
-fn body_lower_is_core_substrate(node: Node) -> Bool {
-  match node.kind {
-    TypeNode { connective: Arrow } => true
-    ComputationNode { behavior: _ } => true
-    TypeNode { connective: Atom { identity: _ } } =>
-      body_lower_is_core_substrate_leaf(node: node)
-    TypeNode { connective: Conj } =>
-      body_lower_is_core_substrate_leaf(node: node)
-    TypeNode { connective: Disj } =>
-      body_lower_is_core_substrate_leaf(node: node)
-    TypeNode { connective: Cardinality } =>
-      body_lower_is_core_substrate_leaf(node: node)
-    TypeNode { connective: Instantiation } =>
-      body_lower_is_core_substrate_leaf(node: node)
-  }
-}
-
-// A LOWERED SHAPE THE ALLOWLIST DOES NOT NAME REFUSES; IT IS NEVER RE-READ AS RAW PARSE. Every reader
-// that consults body_lower_is_core_substrate used to treat a node it did not recognise as unlowered
-// and walk it again with the parse readers, whose first-match descents answered a PART of it -- the
-// silent part-for-whole truncation behind the #12145 class (gunbc.recurring_failure_mode
-// lowered_output_reread_as_raw_parse_at_v2_body_lowering); #12269's field projection was one
-// instance, closed by growing the allowlist. The raw parse tree is recognisable by construction: every
-// non-atom node the parser emits carries at least one parse projection edge, and the roster of those
-// edges is v2.compiler.parse parse_tree_projection_edge (a production's identity or capture, a
-// sequence's sides -- what the parse stage's grammar_named_edge sites mint), while a producer's
-// output carries none. So a non-atom node with children that the allowlist rejects and
-// that carries no grammar projection edge is lowered output that no reader recognises, and it refuses
-// here, located at that node, instead of being re-read. The MQ-5 census (wise-ant-748, 2026-09-30:
-// the same test at these sites over the native population, positive control verified, baseline
-// identical) found no site taking the re-read today, so this refusal changes no verdict; it makes the
-// NEXT unrecognised shape loud. RUNG, HONESTLY: the diagnostic names the node, not its producer --
-// nothing on a Node says which lowering built it. The producer-declared shape (LoweredShape carried
-// in a BodyTerm through the reducers, neat-boar-16 ruling 2026-09-30) is the next rung, and it
-// deletes both this test and the allowlist.
+
 fn body_lower_has_grammar_projection_edge(node: Node) -> Bool {
   fold(node.children, init: false, f: fn(acc, e) {
     acc || (match e.label {
@@ -704,55 +670,232 @@ fn body_lower_has_grammar_projection_edge(node: Node) -> Bool {
   })
 }
 
-fn body_lower_is_unrecognised_lowered_shape(node: Node) -> Bool {
-  if body_lower_is_core_substrate(node: node) {
-    false
+type BodyTermWrapper {
+  node: Node
+  shape: LoweredShape
+}
+
+// Whether an edge carries the authored label `name`. The leaf reader uses it to admit a parse-minted
+// literal token's single payload edge (body_term_literal_token_payload_field) and nothing beside it.
+fn body_term_edge_named(e: Edge, name: Symbol) -> Bool {
+  match e.label {
+    Authored { name: n } => n == name
+    StructuralLabel { label: _ } => false
+    Positional => false
+  }
+}
+
+// THE STAGE'S TERM IS READ OFF THE TREE, AND ITS LOWERED ARM IS WRITTEN BY THE PRODUCER (MQ-5).
+// Body lowering is a bottom-up fold over a tree holding raw parse and lowered output at once. Every
+// reader used to ask a hand-kept shape allowlist, body_lower_is_core_substrate, whether a node was
+// lowered, and re-read anything the allowlist missed as raw parse: the parse readers' first-match
+// descents then answered a PART of it (gunbc.recurring_failure_mode
+// lowered_output_reread_as_raw_parse_at_v2_body_lowering, the #12145 class). That allowlist, the
+// unrecognised-shape test beside it and the descendant search body_lower_find_core_substrate_optional
+// are deleted. A producer's result now leaves it inside the stage's Lowered wrapper, minted only by
+// body_term_seal with the producer's own LoweredShape arm (v2.std.compilers.lowered_shape, carried by the seal itself), and every
+// reader asks body_term_of, which reads the wrapper back and identifies raw parse POSITIVELY: a
+// composite carrying a grammar projection edge (v2.compiler.parse parse_tree_projection_edge, the
+// roster the parse stage mints), or a childless leaf. A node that is neither wrapped, nor stamped by
+// the parse, nor a childless leaf refuses where it is read, located at it -- it is lowered output no
+// producer declared, and it is never re-read as raw parse.
+//
+// RUNG, HONESTLY (gunbc.recurring_failure_mode lowered_output_reread_as_raw_parse_at_v2_body_lowering,
+// which carries this class's rung per path; operator approval msg_63aee66e; STACK ruling, neat-boar-16): the wrapper is a Node, so the tag lives in the tree the
+// fold threads but is not a type. Its one edge is the v2.std.node core marker BodyTermLoweredEdge,
+// whose BodyTermLoweredSeal is sole_constructor and minted only through body_term_lowered_seal,
+// admit_callers-sealed to body_term_seal, so a lookalike does not compile on the seed and interpreted
+// path (structural). On the native route admit_callers is discarded (gunbc.rung_drop
+// admit_callers_discarded_on_the_native_route), so there the sole construction site is the wall.
+// The ceiling is a sealed BodyTerm term tree the fold produces and normalize consumes. The leaf arm
+// is bounded by today's occurrence model: a leaf inherits its source occurrence and has no
+// projection edge, so its provenance is not on it; gunbc#12790 (lowered nodes mint
+// OccurrenceProjected) puts it there.
+fn body_term_seal_shape(seal: BodyTermLoweredSeal) -> LoweredShape {
+  seal.shape
+}
+
+// The wrapper read back: one child, under the sealed core marker body_term_seal writes. The arm is
+// matched, never a spelling, and its seal names the producer's arm.
+fn body_term_wrapper_optional(n: Node) -> Optional<BodyTermWrapper> {
+  match n.kind {
+    TypeNode { connective: Conj } =>
+      if length(xs: n.children) == 1 {
+        match list_at_optional(xs: n.children, index: 0) {
+          Absent => optional_absent()
+          Present { value: e } =>
+            match e.label {
+              StructuralLabel { label: CoreMarker { marker: marker } } =>
+                match marker {
+                  BodyTermLoweredEdge { seal: seal } =>
+                    optional_present(value: BodyTermWrapper { node: e.target, shape: body_term_seal_shape(seal: seal) })
+                  _ => optional_absent()
+                }
+              StructuralLabel { label: ProductionEdge { language: _, edge: _ } } => optional_absent()
+              Authored { name: _ } => optional_absent()
+              Positional => optional_absent()
+            }
+        }
+      } else {
+        optional_absent()
+      }
+    TypeNode { connective: Atom { identity: _ } } => optional_absent()
+    TypeNode { connective: Disj } => optional_absent()
+    TypeNode { connective: Arrow } => optional_absent()
+    TypeNode { connective: Cardinality } => optional_absent()
+    TypeNode { connective: Instantiation } => optional_absent()
+    ComputationNode { behavior: _ } => optional_absent()
+  }
+}
+
+// THE ONE MINT, AND ITS TWO OUTCOME-SHAPED DOORS (body_term_sealed_outcome, body_term_sealed_lowering).
+// Each door is itself sealed to the producer dispatch that calls it, so neither is a proxy through
+// which a caller outside the producers could mint. A producer hands back what it built with the arm naming itself. A result that is
+// already a term keeps the term it is: raw parse the producer passed through stays raw parse (it is
+// identified positively, never wrapped), and a Lowered value a producer passed through keeps the arm
+// of the producer that built it. Everything else the producer returned -- a lowered composite, a
+// lowered atom, or an atom it passed through unchanged -- is that producer's lowered output.
+fn body_term_seal(node: Node, shape: LoweredShape) -> Node
+  admit_callers: [
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_term_sealed_outcome"),
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_term_sealed_lowering"),
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lower_fold_identity_absent"),
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lower_reduce_emitted")
+  ]
+{
+  if body_lower_has_grammar_projection_edge(node: node) {
+    node
   } else {
-    match node.kind {
-      TypeNode { connective: Atom { identity: _ } } => false
-      _ => (length(xs: node.children) > 0) && !body_lower_has_grammar_projection_edge(node: node)
+    match body_term_wrapper_optional(n: node) {
+      Present { value: _ } => node
+      Absent =>
+        node_lowered_from(
+          kind: TypeNode { connective: Conj },
+          children: [
+            core_edge(marker: BodyTermLoweredEdge { seal: body_term_lowered_seal(shape: shape) }, target: node)
+          ],
+          source: node
+        )
     }
   }
 }
 
-fn body_lower_unrecognised_lowered_shape_diagnostics(node: Node) -> NonEmptyDiagnostics {
-  diagnostics_singleton(
-    d: body_lower_diagnostic(reason: ^body_lowering_reason_unrecognised_lowered_shape, n: node)
-  )
+fn body_term_sealed_outcome(o: Outcome<Node>, shape: LoweredShape) -> Outcome<Node>
+  admit_callers: [
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lower_fold_by_identity"),
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lower_fold_dispatch"),
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lower_fold_raw"),
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lower_function_value_body"),
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lower_reduce_emitted")
+  ]
+{
+  match o {
+    Rejected { diagnostics: r } => Rejected { diagnostics: r }
+    Accepted { value: n, diagnostics: d } => Accepted { value: body_term_seal(node: n, shape: shape), diagnostics: d }
+  }
 }
 
-// The node body_lower_find_core_substrate_optional would step PAST on its own first-match path --
-// an unrecognised lowered node -- to answer a recognised DESCENDANT of it: a part for the whole.
-fn body_lower_find_core_substrate_passes_unrecognised(root: Node) -> Optional<Node> {
-  if body_lower_is_core_substrate(node: root) {
-    optional_absent()
+fn body_term_sealed_lowering(o: Outcome<BodyLowering>, shape: LoweredShape) -> Outcome<BodyLowering>
+  admit_callers: [
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lower_forward_row_apply"),
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lower_production_emitted")
+  ]
+{
+  match o {
+    Rejected { diagnostics: r } => Rejected { diagnostics: r }
+    Accepted { value: BodyLowered { node: n }, diagnostics: d } =>
+      Accepted { value: BodyLowered { node: body_term_seal(node: n, shape: shape) }, diagnostics: d }
+    Accepted { value: retained, diagnostics: d } => Accepted { value: retained, diagnostics: d }
+  }
+}
+
+// A LEAF IS A TOKEN AS THE PARSE WROTE IT: an atom or a childless conj, or one of the three literal
+// tokens the parse mints with their payload already attached (v2.compiler.parse parse_expr_terminal:
+// v2.extdeps.languages.dag dag_int_literal_node_from_lexeme, dag_string_literal_node_from_lexeme,
+// dag_float_literal_node_from_lexeme) -- that token's atom with exactly its own payload edge.
+fn body_term_literal_token_payload_field(id: Symbol) -> Optional<Symbol> {
+  if id == ^dag_token_int_literal {
+    optional_present(value: ^integer_literal_magnitude_field)
+  } else if id == ^dag_token_string_literal {
+    optional_present(value: ^string_literal_value_field)
+  } else if id == ^dag_token_float_literal {
+    optional_present(value: ^float_literal_lexeme_field)
   } else {
-    match body_lower_find_core_substrate_optional(root: root) {
-      Absent => optional_absent()
-      Present { value: _ } =>
-        if body_lower_is_unrecognised_lowered_shape(node: root) {
-          optional_present(value: root)
-        } else {
-          match body_lower_find_core_substrate_first_hit_child(root: root) {
-            Absent => optional_absent()
-            Present { value: child } => body_lower_find_core_substrate_passes_unrecognised(root: child)
-          }
-        }
-    }
+    optional_absent()
   }
 }
 
-fn body_lower_find_core_substrate_first_hit_child(root: Node) -> Optional<Node> {
-  fold(root.children, init: Absent, f: fn(acc, e) {
-    match acc {
-      Present { value: _ } => acc
-      Absent =>
-        match body_lower_find_core_substrate_optional(root: e.target) {
-          Present { value: _ } => optional_present(value: e.target)
-          Absent => optional_absent()
+fn body_term_is_leaf(n: Node) -> Bool
+  admit_callers: [
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_term_of")
+  ]
+{
+  match n.kind {
+    TypeNode { connective: Atom { identity: id } } =>
+      if length(xs: n.children) == 0 {
+        true
+      } else if length(xs: n.children) == 1 {
+        match body_term_literal_token_payload_field(id: id) {
+          Absent => false
+          Present { value: field } =>
+            match list_at_optional(xs: n.children, index: 0) {
+              Present { value: e } => body_term_edge_named(e: e, name: field)
+              Absent => false
+            }
         }
-    }
-  })
+      } else {
+        false
+      }
+    TypeNode { connective: Conj } => length(xs: n.children) == 0
+    TypeNode { connective: Disj } => false
+    TypeNode { connective: Arrow } => false
+    TypeNode { connective: Cardinality } => false
+    TypeNode { connective: Instantiation } => false
+    ComputationNode { behavior: _ } => false
+  }
+}
+
+// THE ONE READER. Four answers, each positive; the fourth refuses.
+fn body_term_of(node: Node) -> Outcome<BodyTerm> {
+  match body_term_wrapper_optional(n: node) {
+    Present { value: w } => outcome_accepted(value: Lowered { node: w.node, shape: w.shape })
+    Absent =>
+      if body_lower_has_grammar_projection_edge(node: node) {
+        outcome_accepted(value: RawParse { node: node })
+      } else if body_term_is_leaf(n: node) {
+        outcome_accepted(value: RawLeaf { node: node })
+      } else {
+        Rejected { diagnostics: body_term_unrecognised_diagnostics(node: node) }
+      }
+  }
+}
+
+fn body_term_unrecognised_diagnostics(node: Node) -> NonEmptyDiagnostics {
+  diagnostics_singleton(
+    d: body_lower_diagnostic(reason: ^body_lowering_reason_unrecognised_lowered_shape, n: node)
+  )
+}
+
+// THE ONE EGRESS. The stage leaves the term vocabulary exactly once, where normalize's module root
+// admits the lowered tree (v2.compiler.normalized_tree admit_retention_free): every wrapper anywhere
+// in the tree is replaced by the node it holds. Nothing else may erase a term, so a second exit
+// refuses at the call edge.
+fn body_term_erase_tree(n: Node) -> Node
+  admit_callers: [
+    decl_ref(module_path: "v2.compiler.normalized_tree", decl_name: "admit_retention_free"),
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_term_erase_tree")
+  ]
+{
+  match body_term_wrapper_optional(n: n) {
+    Present { value: w } => body_term_erase_tree(n: w.node)
+    Absent =>
+      node_rebuild(
+        n: n,
+        children: fold(n.children, init: Empty, f: fn(acc, e) {
+          list_snoc_item(xs: acc, item: Edge { label: e.label, target: body_term_erase_tree(n: e.target) })
+        })
+      )
+  }
 }
 
 fn body_lower_is_pass_through_emitted(emitted: Symbol) -> Bool {
@@ -1619,8 +1762,8 @@ fn body_lower_operand_from_shell_read(shell: Node) -> OperandRefRead {
 // operator expression, read whole by body_lower_read_operator_expression, or it is not an operand
 // this reader recognises. The arm this replaces returned pair.left for every sequence, so `a && b`
 // read as `a` and `!a` read as `!` (gunbc.recurring_failure_mode
-// lowering_accessor_collapses_a_sequence_operand). An operator expression the tower reader refuses is
-// a refusal here too, carrying the tower reader's cause at its position.
+// lowering_accessor_collapses_a_sequence_operand). An operator expression the application reader refuses is
+// a refusal here too, carrying that reader's cause at its position.
 fn body_lower_operand_ref_sequence_read(node: Node) -> OperandRefRead {
   match body_lower_read_operator_expression(node: node) {
     OperatorExpressionRead { lowered: lowered } => OperandRefLowered { lowered: lowered }
@@ -1667,12 +1810,15 @@ fn body_lower_operand_read_outcome(read: OperandRefRead, diagnostics: Diagnostic
 // happened to every literal argument (`f(1)` carried a bare dag_token_int_literal) until that
 // arm was ordered first.
 fn body_lower_operand_ref_read(node: Node) -> OperandRefRead {
-  if body_lower_is_unrecognised_lowered_shape(node: node) {
-    OperandRefRefused { diagnostics: body_lower_unrecognised_lowered_shape_diagnostics(node: node) }
-  } else {
-  match body_lower_is_core_substrate(node: node) {
-    true => OperandRefLowered { lowered: node }
-    false =>
+  match body_term_of(node: node) {
+    Rejected { diagnostics: r } => OperandRefRefused { diagnostics: r }
+    Accepted { value: Lowered { node: lowered, shape: _ }, diagnostics: _ } => OperandRefLowered { lowered: lowered }
+    Accepted { value: _, diagnostics: _ } => body_lower_operand_raw_read(node: node)
+  }
+}
+
+// The operand read of raw parse: a production, a token, or a sequence the parse stamped.
+fn body_lower_operand_raw_read(node: Node) -> OperandRefRead {
   match parse_production_emitted_identity_optional(node: node) {
     Present { value: _emitted } =>
       match parse_production_captured_child_optional(node: node) {
@@ -1734,8 +1880,6 @@ fn body_lower_operand_ref_read(node: Node) -> OperandRefRead {
       }
   }
   }
-  }
-  }
 }
 
 fn body_lower_is_block_delimiter_token(id: Symbol) -> Bool {
@@ -1825,29 +1969,22 @@ fn body_lower_unwrap_captured(shell: Node) -> Optional<Node> {
   parse_production_captured_child_optional(node: shell)
 }
 
-// AN OPERATOR EXPRESSION IS READ OFF THE GRAMMAR'S OWN PRECEDENCE TOWER, WHOLE, AND A POSITION THE
+// AN OPERATOR EXPRESSION IS READ OFF THE GRAMMAR'S OWN APPLICATION NODES, WHOLE, AND A POSITION THE
 // READER CANNOT READ REFUSES.
 //
-// v2.extdeps.languages.dag dag_grammar_binary_expr_expr is a tower of seven levels, each
-//   level = sequence(next_level, tail)
-// whose tail is a REPEAT of sequence(operator, next_level) for the pipe, or, and, additive and
-// multiplicative levels and an OPTIONAL of the same for equality and comparison. The parse captures
-// a repeat as a cons spine -- sequence(element, rest), ending in the empty conj -- and an optional
-// as its element or the empty conj, so a tail is exactly one of
-//   the empty conj                              (no operator at this level)
-//   sequence(operator, operand)                 (an optional that matched)
-//   sequence(sequence(operator, operand), rest) (a repeat element and the rest of the repeat)
-// and the bottom of the tower is dag_grammar_unary_expr_expr: a prefix `!` or `-` over another
-// unary, or a postfix expression.
+// v2.extdeps.languages.dag dag_grammar_binary_expr_expr is an operator table (v2.std.grammar
+// InfixTable): the parse captures each operator APPLICATION as one node carrying three projections
+// -- grammar_infix_left, grammar_infix_operator, grammar_infix_right -- and an operand with no
+// operator after it as the operand itself. Precedence and associativity are already decided by the
+// tree, so this reader lowers an application's two operands and applies its operator; it neither
+// re-folds a continuation spine nor strips precedence levels, because the tree carries neither
+// (docs/plans/precedence-climbing-tree-contract.md). The operand is dag_grammar_unary_expr_expr: a
+// prefix `!` or `-` over another unary, or a postfix expression.
 //
-// THE READER IT REPLACES READ ONE OPERATOR AND DROPPED THE REST, SILENTLY. It lowered the first
-// sequence(operator, operand) it found and returned, so `a && b && c` lowered to `a && b` with `c`
-// gone; its operand reader, body_lower_operand_ref_optional, narrowed any other sequence to its
-// LEFT element, so `!a && b` lost `a` (read as the bare `!`) and, in a body the bottom-up fold had
-// not lowered, `a && b` became `a`. Measured on the real tokenize -> parse -> normalize route: an
-// atom only on the right of those shapes reached no reference site
-// (gunbc.recurring_failure_mode lowering_accessor_collapses_a_sequence_operand). Every operand is
-// now lowered and folded left-associatively, and an unreadable position is a located refusal.
+// THE READER BEFORE THE TOWER READER READ ONE OPERATOR AND DROPPED THE REST, SILENTLY: `a && b && c`
+// lowered to `a && b`, and its operand reader narrowed any sequence to its LEFT element, so `!a && b`
+// lost `a` (gunbc.recurring_failure_mode lowering_accessor_collapses_a_sequence_operand). Every
+// operand is lowered and an unreadable position is a located refusal.
 type OperatorExpressionRead
   = OperatorExpressionAbsent
   | OperatorExpressionRead { lowered: Node }
@@ -1873,7 +2010,10 @@ fn body_lower_grammar_terminals(expr: GrammarExpr) -> List<Symbol> {
       expect: fn(e, _reason) { e },
       refuse_on_match: fn(e, _reason) { e },
       after_line_break: fn(e) { e },
-      not_predicate: fn(_e) { Empty }
+      not_predicate: fn(_e) { Empty },
+      infix_table: fn(operand, _guard, operators) {
+        list_append(left: operand, right: list_map(xs: operators, f: fn(row) { grammar_infix_row_class(row: row) }))
+      }
     }
   )
 }
@@ -1920,13 +2060,15 @@ fn body_lower_operator_token_optional(node: Node, binary: Bool) -> Optional<Node
   }
 }
 
-// A tower level with no operator is sequence(next_level, empty): the level is its next level.
-fn body_lower_strip_operator_free_levels(node: Node) -> Node {
+// A SEQUENCE WHOSE RIGHT IS THE EMPTY CONJ IS ITS LEFT: a production whose trailing repeat or
+// optional matched nothing (a postfix expression with no suffix) captures sequence(head, empty), and
+// the operand it denotes is the head.
+fn body_lower_strip_empty_tails(node: Node) -> Node {
   let stripped = body_lower_unwrap_surface_shell(node: node)
   match sugar_sequence_pair_optional(node: stripped) {
     Present { value: pair } =>
       if is_empty_conj_root(n: pair.right) {
-        body_lower_strip_operator_free_levels(node: pair.left)
+        body_lower_strip_empty_tails(node: pair.left)
       } else {
         stripped
       }
@@ -1934,21 +2076,24 @@ fn body_lower_strip_operator_free_levels(node: Node) -> Node {
   }
 }
 
-// Whether a tail carries an operator: its first element is one, or is sequence(operator, operand).
-fn body_lower_tail_has_binary_operator(tail: Node) -> Bool {
-  match sugar_sequence_pair_optional(node: tail) {
-    Absent => false
-    Present { value: pair } =>
-      match body_lower_operator_token_optional(node: pair.left, binary: true) {
-        Present { value: _ } => true
-        Absent =>
-          match sugar_sequence_pair_optional(node: pair.left) {
-            Present { value: element } =>
-              match body_lower_operator_token_optional(node: element.left, binary: true) {
-                Present { value: _ } => true
-                Absent => false
-              }
-            Absent => false
+// ONE OPERATOR APPLICATION, AS THE PARSE STAMPED IT (v2.compiler.parse parse_stamp_infix_application).
+type InfixApplication {
+  left: Node
+  operator: Node
+  right: Node
+}
+
+fn body_lower_infix_application_optional(node: Node) -> Optional<InfixApplication> {
+  match body_lower_seq_child(node: node, name: ^grammar_infix_operator_node_projection) {
+    Absent => optional_absent()
+    Present { value: operator } =>
+      match body_lower_seq_child(node: node, name: ^grammar_infix_left_node_projection) {
+        Absent => optional_absent()
+        Present { value: left } =>
+          match body_lower_seq_child(node: node, name: ^grammar_infix_right_node_projection) {
+            Absent => optional_absent()
+            Present { value: right } =>
+              optional_present(value: InfixApplication { left: left, operator: operator, right: right })
           }
       }
   }
@@ -1960,16 +2105,15 @@ fn body_lower_operator_refusal(reason: Symbol, at: Node) -> OperatorExpressionRe
 
 // One operand of an operator expression, lowered whole or refused at the operand.
 fn body_lower_operator_operand(node: Node) -> Outcome<Node> {
-  let operand = body_lower_strip_operator_free_levels(node: node)
+  let operand = body_lower_strip_empty_tails(node: node)
   match body_lower_read_operator_expression(node: operand) {
     OperatorExpressionRead { lowered: lowered } => outcome_accepted(value: lowered)
     OperatorExpressionRefused { diagnostics: r } => Rejected { diagnostics: r }
     OperatorExpressionAbsent =>
-      if body_lower_is_core_substrate(node: operand) {
-        outcome_accepted(value: operand)
-      } else if body_lower_is_unrecognised_lowered_shape(node: operand) {
-        Rejected { diagnostics: body_lower_unrecognised_lowered_shape_diagnostics(node: operand) }
-      } else {
+      match body_term_of(node: operand) {
+        Rejected { diagnostics: r } => Rejected { diagnostics: r }
+        Accepted { value: Lowered { node: lowered, shape: _ }, diagnostics: _ } => outcome_accepted(value: lowered)
+        Accepted { value: _, diagnostics: _ } =>
         match body_lower_try_body_lowered(node: operand) {
           Rejected { diagnostics: r } => Rejected { diagnostics: r }
           Accepted { value: Present { value: lowered }, diagnostics: d } =>
@@ -2014,7 +2158,7 @@ fn body_lower_operator_is_pipe(operator: Node) -> Bool {
 
 fn body_lower_piped_fold_optional(acc: Node, operator: Node, right: Node) -> Optional<Outcome<Node>> {
   if body_lower_operator_is_pipe(operator: operator) {
-    match body_lower_fold_call_beneath(node: body_lower_strip_operator_free_levels(node: right)) {
+    match body_lower_fold_call_beneath(node: body_lower_strip_empty_tails(node: right)) {
       Absent => optional_absent()
       Present { value: call } =>
         match fold_call_lowering_piped(fold_call: call, receiver: acc) {
@@ -2051,160 +2195,67 @@ fn body_lower_fold_call_beneath(node: Node) -> Optional<Node> {
   }
 }
 
-// Whether a tower tail element is `|> <fold-family call>`: the element is sequence(operator, operand).
-fn body_lower_tail_element_pipes_into_fold(element: Node) -> Bool {
-  match sugar_sequence_pair_optional(node: element) {
+// A PIPE INTO A FOLD IS READ AT ITS APPLICATION, BEFORE ITS OPERANDS ARE FOLDED. The bottom-up fold
+// lowers an operator expression's children first, so the fold call on the right of `|>` would be
+// lowered on its own -- with no collection, since the pipe supplies it -- before the application
+// could hand it the pipe's input. So an application whose operator is `|>` and whose right operand is
+// a fold-family call is read whole, raw, by body_lower_read_operator_expression, whose binary step
+// (body_lower_binary_apply) builds the fold encoding with the left operand as the collection. The
+// decision is the node's own: one projection lookup and one identity comparison, no walk -- the tree
+// states which operands each `|>` binds, so no tower root has to be found first. Every other
+// application takes the ordinary bottom-up path unchanged.
+fn body_lower_application_pipes_into_fold(node: Node) -> Bool {
+  match body_lower_infix_application_optional(node: node) {
     Absent => false
-    Present { value: e } =>
-      match body_lower_operator_token_optional(node: e.left, binary: true) {
-        Absent => false
-        Present { value: operator } =>
-          if body_lower_operator_is_pipe(operator: operator) {
-            match body_lower_fold_call_beneath(node: body_lower_strip_operator_free_levels(node: e.right)) {
+    Present { value: app } =>
+      match node_atom_identity_optional(node: app.operator) {
+        Present { value: id } =>
+          if id == ^dag_token_pipe_gt {
+            match body_lower_fold_call_beneath(node: body_lower_strip_empty_tails(node: app.right)) {
               Present { value: _ } => true
               Absent => false
             }
           } else {
             false
           }
+        Absent => false
       }
   }
 }
 
-// Whether a tower tail -- empty, sequence(operator, operand), or a repeat spine
-// sequence(sequence(operator, operand), rest) -- pipes into a fold-family call anywhere along it.
-fn body_lower_tail_pipes_into_fold(tail: Node) -> Bool {
-  if is_empty_conj_root(n: tail) {
-    false
-  } else if body_lower_tail_element_pipes_into_fold(element: tail) {
-    true
-  } else {
-    match sugar_sequence_pair_optional(node: tail) {
-      Absent => false
-      Present { value: pair } =>
-        body_lower_tail_element_pipes_into_fold(element: pair.left) || body_lower_tail_pipes_into_fold(tail: pair.right)
-    }
-  }
-}
-
-// Whether a node is the `|>` token: one identity comparison, no operator-list scan.
-fn body_lower_node_is_pipe_token(node: Node) -> Bool {
-  match node_atom_identity_optional(node: node) {
-    Present { value: id } => id == ^dag_token_pipe_gt
-    Absent => false
-  }
-}
-
-// Whether a tail's FIRST element is headed by `|>`: the tail is sequence(operator, operand) or
-// sequence(sequence(operator, operand), rest), read from the node's own shape.
-fn body_lower_tail_starts_with_pipe(tail: Node) -> Bool {
-  match sugar_sequence_pair_optional(node: tail) {
-    Absent => false
-    Present { value: pair } =>
-      if body_lower_node_is_pipe_token(node: pair.left) {
-        true
-      } else {
-        match sugar_sequence_pair_optional(node: pair.left) {
-          Absent => false
-          Present { value: element } => body_lower_node_is_pipe_token(node: element.left)
-        }
-      }
-  }
-}
-
-// THE ROOT OF A PIPE TOWER, DECIDED FROM THE NODE'S OWN SHAPE BY IDENTITY COMPARISONS ALONE.
-// body_lower_fold runs at every node, so this guard reads only the node's own sequence pair and
-// compares token identities with `|>`: no walk, and no scan of the operator roster (the first
-// constant-time cut asked body_lower_operator_token_optional, whose roster fold ran several times
-// per node and doubled the native route's context phase -- 918s at base against 1892s, census
-// gunbc#12550). The pipe is the outermost level of v2.extdeps.languages.dag
-// dag_grammar_binary_expr_expr, so a sequence whose tail starts with `|>` is a pipe tower; a
-// repeat-spine node inside that tail, sequence(sequence(`|>`, operand), rest), is excluded by its
-// left element starting with `|>`, so the tower is decided once, at its root.
-fn body_lower_is_pipe_tower_root(node: Node) -> Bool {
-  match sugar_sequence_pair_optional(node: node) {
-    Absent => false
-    Present { value: pair } =>
-      if body_lower_tail_starts_with_pipe(tail: pair.left) {
-        false
-      } else {
-        body_lower_tail_starts_with_pipe(tail: pair.right)
+fn body_lower_read_infix_application(app: InfixApplication) -> OperatorExpressionRead {
+  match body_lower_operator_token_optional(node: app.operator, binary: true) {
+    Absent => body_lower_operator_refusal(reason: ^body_lowering_reason_operator_tail_unread, at: app.operator)
+    Present { value: operator } =>
+      match body_lower_operator_operand(node: app.left) {
+        Rejected { diagnostics: r } => OperatorExpressionRefused { diagnostics: r }
+        Accepted { value: left, diagnostics: _ } =>
+          match body_lower_binary_apply(acc: left, operator: operator, right: app.right) {
+            Rejected { diagnostics: r } => OperatorExpressionRefused { diagnostics: r }
+            Accepted { value: applied, diagnostics: _ } => OperatorExpressionRead { lowered: applied }
+          }
       }
   }
 }
 
-// A TOWER THAT PIPES INTO A FOLD IS READ WHOLE, BEFORE ITS OPERANDS ARE FOLDED. The bottom-up fold
-// lowers an operator expression's children first, so the fold call on the right of `|>` would be
-// lowered on its own -- with no collection, since the pipe supplies it -- before the tower could hand
-// it the pipe's input. So such a tower -- recognised at its ROOT by structure (body_lower_is_pipe_tower_root,
-// constant time), whatever production identity the node carries, since the value reader unwraps shells
-// before folding; only a root then pays the tail scan below, once per tower -- is read by the
-// raw tower reader, whose binary step
-// (body_lower_binary_apply) builds the fold encoding with the accumulated left operand as the
-// collection. Every other tower takes the ordinary bottom-up path unchanged.
-fn body_lower_tower_pipes_into_fold(node: Node) -> Bool {
-  match sugar_sequence_pair_optional(node: body_lower_strip_operator_free_levels(node: node)) {
-    Absent => false
-    Present { value: pair } => body_lower_tail_pipes_into_fold(tail: pair.right)
-  }
-}
-
-fn body_lower_fold_operator_tail(acc: Node, tail: Node) -> OperatorExpressionRead {
-  if is_empty_conj_root(n: tail) {
-    OperatorExpressionRead { lowered: acc }
-  } else {
-    match sugar_sequence_pair_optional(node: tail) {
-      Absent => body_lower_operator_refusal(reason: ^body_lowering_reason_operator_tail_unread, at: tail)
-      Present { value: pair } =>
-        match body_lower_operator_token_optional(node: pair.left, binary: true) {
-          Present { value: operator } =>
-            match body_lower_binary_apply(acc: acc, operator: operator, right: pair.right) {
-              Rejected { diagnostics: r } => OperatorExpressionRefused { diagnostics: r }
-              Accepted { value: applied, diagnostics: _ } => OperatorExpressionRead { lowered: applied }
-            }
-          Absent =>
-            match sugar_sequence_pair_optional(node: pair.left) {
-              Absent => body_lower_operator_refusal(reason: ^body_lowering_reason_operator_tail_unread, at: tail)
-              Present { value: element } =>
-                match body_lower_operator_token_optional(node: element.left, binary: true) {
-                  Absent => body_lower_operator_refusal(reason: ^body_lowering_reason_operator_tail_unread, at: tail)
-                  Present { value: operator } =>
-                    match body_lower_binary_apply(acc: acc, operator: operator, right: element.right) {
-                      Rejected { diagnostics: r } => OperatorExpressionRefused { diagnostics: r }
-                      Accepted { value: applied, diagnostics: _ } =>
-                        body_lower_fold_operator_tail(acc: applied, tail: pair.right)
-                    }
-                }
-            }
-        }
-    }
-  }
-}
-
-// Absent: this node is not an operator expression -- no prefix operator heads it and no operator
-// sits in its tower tail. Read: every operand lowered. Refused: an operator was read and a position
-// under it was not.
+// Absent: this node is not an operator expression -- it is no application and no prefix operator
+// heads it. Read: every operand lowered. Refused: an operator was read and a position under it was not.
 fn body_lower_read_operator_expression(node: Node) -> OperatorExpressionRead {
-  let stripped = body_lower_strip_operator_free_levels(node: node)
-  match sugar_sequence_pair_optional(node: stripped) {
-    Absent => OperatorExpressionAbsent
-    Present { value: pair } =>
-      match body_lower_operator_token_optional(node: pair.left, binary: false) {
-        Present { value: operator } =>
-          match body_lower_operator_operand(node: pair.right) {
-            Rejected { diagnostics: r } => OperatorExpressionRefused { diagnostics: r }
-            Accepted { value: operand, diagnostics: _ } =>
-              OperatorExpressionRead { lowered: lower_unary_prefix(operator: operator, operand: operand) }
-          }
-        Absent =>
-          if body_lower_tail_has_binary_operator(tail: pair.right) {
-            match body_lower_operator_operand(node: pair.left) {
-              Rejected { diagnostics: r } => OperatorExpressionRefused { diagnostics: r }
-              Accepted { value: left, diagnostics: _ } =>
-                body_lower_fold_operator_tail(acc: left, tail: pair.right)
-            }
-          } else {
-            OperatorExpressionAbsent
+  let stripped = body_lower_strip_empty_tails(node: node)
+  match body_lower_infix_application_optional(node: stripped) {
+    Present { value: app } => body_lower_read_infix_application(app: app)
+    Absent =>
+      match sugar_sequence_pair_optional(node: stripped) {
+        Absent => OperatorExpressionAbsent
+        Present { value: pair } =>
+          match body_lower_operator_token_optional(node: pair.left, binary: false) {
+            Present { value: operator } =>
+              match body_lower_operator_operand(node: pair.right) {
+                Rejected { diagnostics: r } => OperatorExpressionRefused { diagnostics: r }
+                Accepted { value: operand, diagnostics: _ } =>
+                  OperatorExpressionRead { lowered: lower_unary_prefix(operator: operator, operand: operand) }
+              }
+            Absent => OperatorExpressionAbsent
           }
       }
   }
@@ -3272,19 +3323,6 @@ fn body_lower_return_type_from_fn_captured(captured: Node) -> Optional<Node> {
   }
 }
 
-fn body_lower_find_core_substrate_optional(root: Node) -> Optional<Node> {
-  if body_lower_is_core_substrate(node: root) {
-    optional_present(value: root)
-  } else {
-    fold(root.children, init: Absent, f: fn(acc, e) {
-      match acc {
-        Present { value: _ } => acc
-        Absent => body_lower_find_core_substrate_optional(root: e.target)
-      }
-    })
-  }
-}
-
 // THE FOLD'S ANSWER IS CARRIED, NOT RE-DEMANDED. The reducers leave a lowered node behind
 // pass-through shells (body_lower_lowered_behind_shells_read), so testing only the ROOT for core
 // substrate discarded a fold that had already lowered the node; every later strategy in
@@ -3307,11 +3345,16 @@ fn body_lower_try_fold_behavior_optional(node: Node) -> Outcome<Optional<Node>>
 // every call site then walks the interior. `{` is also unwritable as an
 // infix operator in body_lower_operator_atom_optional.
 fn body_lower_try_body_lowered(node: Node) -> Outcome<Optional<Node>> {
-  if body_lower_is_core_substrate(node: node) {
-    outcome_accepted(value: optional_present(value: node))
-  } else if body_lower_is_unrecognised_lowered_shape(node: node) {
-    Rejected { diagnostics: body_lower_unrecognised_lowered_shape_diagnostics(node: node) }
-  } else if body_lower_sequence_left_is_lbrace(captured: node) {
+  match body_term_of(node: node) {
+    Rejected { diagnostics: r } => Rejected { diagnostics: r }
+    Accepted { value: Lowered { node: lowered, shape: _ }, diagnostics: _ } => outcome_accepted(value: optional_present(value: lowered))
+    Accepted { value: _, diagnostics: _ } => body_lower_try_raw_body_lowered(node: node)
+  }
+}
+
+// The strategies over a node the parse stamped, in order; Absent means none of them lowers it.
+fn body_lower_try_raw_body_lowered(node: Node) -> Outcome<Optional<Node>> {
+  if body_lower_sequence_left_is_lbrace(captured: node) {
     outcome_accepted(value: optional_absent())
   } else {
     match body_lower_dotted_chain_lowered_optional(node: node) {
@@ -3395,38 +3438,40 @@ fn body_lower_reduce_emitted(folded: Node, emitted: Symbol) -> Outcome<Node> {
   } else if emitted == ^dag_surface_binary_expr {
     match body_lower_try_infix_transform(node: folded) {
       Rejected { diagnostics: r } => Rejected { diagnostics: r }
-      Accepted { value: Present { value: transform }, diagnostics: _ } => outcome_accepted(value: transform)
+      Accepted { value: Present { value: transform }, diagnostics: _ } => outcome_accepted(value: body_term_seal(node: transform, shape: LoweredOperatorExpression))
       Accepted { value: Absent, diagnostics: _ } => body_lower_reduce_passthrough(folded: folded)
     }
   } else if emitted == ^dag_surface_postfix_expr {
-    body_lower_reduce_or_keep(o: body_lower_postfix_expr(shell: folded), folded: folded)
+    body_lower_reduce_or_keep(o: body_term_sealed_outcome(o: body_lower_postfix_expr(shell: folded), shape: LoweredPostfix), folded: folded)
   } else if emitted == ^dag_surface_primary_expr {
-    body_lower_reduce_or_keep(o: body_lower_primary_expr(shell: folded), folded: folded)
+    body_lower_reduce_or_keep(o: body_term_sealed_outcome(o: body_lower_primary_expr(shell: folded), shape: LoweredPrimary), folded: folded)
   } else if body_lower_is_pass_through_emitted(emitted: emitted) {
     body_lower_reduce_passthrough(folded: folded)
   } else if emitted == ^dag_surface_fn_decl {
-    body_lower_reduce_or_keep(o: body_lowering_refuse_retained(o: body_lower_fn_decl_to_arrow(shell: folded)), folded: folded)
+    body_lower_reduce_or_keep(o: body_term_sealed_outcome(o: body_lowering_refuse_retained(o: body_lower_fn_decl_to_arrow(shell: folded)), shape: LoweredFnDeclaration), folded: folded)
   } else if emitted == ^dag_surface_test_fn_decl {
-    body_lower_reduce_or_keep(o: body_lowering_refuse_retained(o: body_lower_test_fn_decl_to_member(shell: folded)), folded: folded)
+    body_lower_reduce_or_keep(o: body_term_sealed_outcome(o: body_lowering_refuse_retained(o: body_lower_test_fn_decl_to_member(shell: folded)), shape: LoweredTestDeclaration), folded: folded)
   } else if emitted == ^dag_surface_data_decl {
-    body_lower_reduce_or_keep(o: body_lowering_refuse_retained(o: body_lower_data_decl_to_member(shell: folded)), folded: folded)
+    body_lower_reduce_or_keep(o: body_term_sealed_outcome(o: body_lowering_refuse_retained(o: body_lower_data_decl_to_member(shell: folded)), shape: LoweredDataDeclaration), folded: folded)
   } else {
     outcome_accepted(value: folded)
   }
 }
 
 fn body_lower_reduce(folded: Node) -> Outcome<Node> {
-  if body_lower_is_core_substrate(node: folded) {
-    outcome_accepted(value: folded)
-  } else if dag_resolve_preserve_module_metadata_subtree(node: folded) {
-    outcome_accepted(value: folded)
-  } else if body_lower_is_unrecognised_lowered_shape(node: folded) {
-    Rejected { diagnostics: body_lower_unrecognised_lowered_shape_diagnostics(node: folded) }
-  } else {
-    match parse_production_emitted_identity_optional(node: folded) {
-      Absent => outcome_accepted(value: folded)
-      Present { value: emitted } => body_lower_reduce_emitted(folded: folded, emitted: emitted)
-    }
+  match body_term_of(node: folded) {
+    Accepted { value: Lowered { node: _, shape: _ }, diagnostics: _ } => outcome_accepted(value: folded)
+    Rejected { diagnostics: r } =>
+      if dag_resolve_preserve_module_metadata_subtree(node: folded) { outcome_accepted(value: folded) } else { Rejected { diagnostics: r } }
+    Accepted { value: _, diagnostics: _ } =>
+      if dag_resolve_preserve_module_metadata_subtree(node: folded) {
+        outcome_accepted(value: folded)
+      } else {
+        match parse_production_emitted_identity_optional(node: folded) {
+          Absent => outcome_accepted(value: folded)
+          Present { value: emitted } => body_lower_reduce_emitted(folded: folded, emitted: emitted)
+        }
+      }
   }
 }
 
@@ -3459,7 +3504,7 @@ fn body_lower_fold_identity_absent(node: Node) -> Outcome<Node> {
       Rejected { diagnostics: r } => Rejected { diagnostics: r }
       Accepted { value: lowered_opt, diagnostics: d } =>
         match lowered_opt {
-          Present { value: lowered } => Accepted { value: lowered, diagnostics: d }
+          Present { value: lowered } => Accepted { value: body_term_seal(node: lowered, shape: LoweredMatch), diagnostics: d }
           Absent => body_lower_fold_reduce(node: node)
         }
     }
@@ -3477,13 +3522,19 @@ fn body_lower_fold_identity_absent(node: Node) -> Outcome<Node> {
 // step argument is still the literal fold_lowering reads; a call that is not a fold, or whose step
 // is not an inline literal, folds as any other expression.
 fn body_lower_fold(node: Node) -> Outcome<Node> {
-  if body_lower_is_core_substrate(node: node) {
-    outcome_accepted(value: node)
-  } else if body_lower_is_unrecognised_lowered_shape(node: node) {
-    Rejected { diagnostics: body_lower_unrecognised_lowered_shape_diagnostics(node: node) }
-  } else if body_lower_is_pipe_tower_root(node: node) && body_lower_tower_pipes_into_fold(node: node) {
+  match body_term_of(node: node) {
+    Rejected { diagnostics: r } => Rejected { diagnostics: r }
+    Accepted { value: Lowered { node: _, shape: _ }, diagnostics: _ } => outcome_accepted(value: node)
+    Accepted { value: RawLeaf { node: _ }, diagnostics: _ } => outcome_accepted(value: node)
+    Accepted { value: RawParse { node: _ }, diagnostics: _ } => body_lower_fold_raw(node: node)
+  }
+}
+
+// The fold over a node the parse stamped: what it lowers to leaves sealed with its producer's arm.
+fn body_lower_fold_raw(node: Node) -> Outcome<Node> {
+  if body_lower_application_pipes_into_fold(node: node) {
     match body_lower_read_operator_expression(node: node) {
-      OperatorExpressionRead { lowered: lowered } => outcome_accepted(value: lowered)
+      OperatorExpressionRead { lowered: lowered } => body_term_sealed_outcome(o: outcome_accepted(value: lowered), shape: LoweredOperatorExpression)
       OperatorExpressionRefused { diagnostics: r } => Rejected { diagnostics: r }
       OperatorExpressionAbsent => body_lower_fold_by_identity(node: node)
     }
@@ -3496,10 +3547,10 @@ fn body_lower_fold_by_identity(node: Node) -> Outcome<Node> {
     match parse_production_emitted_identity_optional(node: node) {
       Present { value: emitted } =>
         if (emitted == ^dag_surface_arrow_lambda) || (emitted == ^dag_surface_fn_literal) {
-          body_lower_function_value_in_fold(node: node)
+          body_term_sealed_outcome(o: body_lower_function_value_in_fold(node: node), shape: LoweredFunctionValue)
         } else {
           match body_lower_fold_family_call_first(node: node) {
-            Present { value: lowered } => lowered
+            Present { value: lowered } => body_term_sealed_outcome(o: lowered, shape: LoweredFoldEncoding)
             Absent => body_lower_fold_dispatch(node: node, emitted: emitted)
           }
         }
@@ -3707,15 +3758,15 @@ fn body_lower_fold_family_call_first(node: Node) -> Optional<Outcome<Node>> {
 
 fn body_lower_fold_dispatch(node: Node, emitted: Symbol) -> Outcome<Node> {
         if emitted == ^dag_surface_match_expr {
-          body_lower_match_expr(shell: node)
+          body_term_sealed_outcome(o: body_lower_match_expr(shell: node), shape: LoweredMatch)
         } else if emitted == ^dag_surface_if_expr {
-          body_lower_if_expr(shell: node)
+          body_term_sealed_outcome(o: body_lower_if_expr(shell: node), shape: LoweredBranch)
         } else if emitted == ^dag_surface_loop_expr {
-          body_lower_loop_expr(shell: node)
+          body_term_sealed_outcome(o: body_lower_loop_expr(shell: node), shape: LoweredLoop)
         } else if emitted == ^dag_surface_let_expr {
-          body_lower_let_expr(shell: node)
+          body_term_sealed_outcome(o: body_lower_let_expr(shell: node), shape: LoweredLet)
         } else if emitted == ^dag_surface_stmt_seq {
-          body_lower_stmt_seq(shell: node)
+          body_term_sealed_outcome(o: body_lower_stmt_seq(shell: node), shape: LoweredStatementSequence)
         } else if body_lower_is_metadata_preserved_emitted(emitted: emitted) {
           outcome_accepted(value: node)
         } else if body_lower_is_deferred_lower_emitted(emitted: emitted) {
@@ -3754,18 +3805,14 @@ fn body_lower_body_subtree_lower_from_primary(captured: Node) -> Outcome<Optiona
         ParseSubtreeFound { captured: stmt } =>
           body_lower_body_subtree_lower(captured: stmt)
         ParseSubtreeAbsent =>
-          match body_lower_find_core_substrate_passes_unrecognised(root: captured) {
-            Present { value: passed } =>
-              Rejected { diagnostics: body_lower_unrecognised_lowered_shape_diagnostics(node: passed) }
-            Absent =>
-            match body_lower_find_core_substrate_optional(root: captured) {
-              Present { value: lowered } =>
-                outcome_accepted(value: optional_present(value: lowered))
-              Absent =>
-                body_lower_try_body_lowered(
-                  node: body_lower_unwrap_surface_shell(node: captured)
-                )
-            }
+          match body_lower_lowered_behind_shells_read(node: captured) {
+            OperandRefLowered { lowered: lowered } =>
+              outcome_accepted(value: optional_present(value: lowered))
+            OperandRefRefused { diagnostics: r } => Rejected { diagnostics: r }
+            OperandRefAbsent =>
+              body_lower_try_body_lowered(
+                node: body_lower_unwrap_surface_shell(node: captured)
+              )
           }
       }
   }
@@ -4042,7 +4089,37 @@ fn body_lower_body_after_eq_token(captured: Node) -> Optional<Node> {
 // unsupported_form at the target -- the refusal-forgetting projection of
 // gunbc.recurring_failure_mode lowering_accessor_collapses_a_sequence_operand, on the reify route.
 // Only a target neither reader reads is unsupported_form, located at it.
+// THE INTERIOR OF A LOWERED VALUE IS LOWERED BY POSITION. The reify pass walks a value a producer
+// already built, so a composite under it that the parse did not stamp is that producer's own output,
+// not a node of unknown provenance: it is kept as it stands. A stamped composite or a leaf under it
+// is still read as the parse wrote it. This reading is confined to the reify pass; everywhere else
+// an unstamped, unwrapped composite refuses.
+// WHY THIS IS NOT A WIDENED FAILURE ARM (review 75108). body_term_of has exactly one Rejected arm:
+// a composite that is neither wrapped nor parse-stamped. The parse stamps every composite it mints,
+// and reify's input is the fold's own output (body_lower_reify_arrow_body is reached only from a
+// producer holding a body it lowered), so under reify that arm can hold only a producer's internal
+// structure. Refusing it was measured, not assumed: propagating the refusal turned three real paths
+// red (v2.test.claim.namespace_xl0.reference_conservation the_if_arm_call_argument_is_conserved_holds,
+// caret_symbol_payloads_are_conserved_holds, a_list_literal_call_argument_conserves_every_element_holds).
+// The reading is grounded in provenance by position, not in a shape list, and that is its rung:
+// mitigation, held by the reify call graph rather than by a type. The climb is the stage ceiling
+// named above, a sealed BodyTerm term tree in which a producer's interior is itself a term, after
+// which this arm deletes and an unplaceable composite refuses here as everywhere else.
+// The question is asked of the term authority: a parse production or a leaf is read as the parse
+// wrote it; a Lowered term, or a composite body_term_of cannot place, is lowered by position here.
+fn body_lower_reify_interior_is_lowered(node: Node) -> Bool {
+  match body_term_of(node: node) {
+    Accepted { value: RawParse { node: _ }, diagnostics: _ } => false
+    Accepted { value: RawLeaf { node: _ }, diagnostics: _ } => false
+    Accepted { value: Lowered { node: _, shape: _ }, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => true
+  }
+}
+
 fn body_lower_reify_operand_read(node: Node) -> Outcome<Node> {
+  if body_lower_reify_interior_is_lowered(node: node) {
+    outcome_accepted(value: node)
+  } else {
   match body_lower_operand_ref_read(node: node) {
     OperandRefLowered { lowered: op } => outcome_accepted(value: op)
     OperandRefRefused { diagnostics: r } => Rejected { diagnostics: r }
@@ -4056,6 +4133,7 @@ fn body_lower_reify_operand_read(node: Node) -> Outcome<Node> {
           )
       }
   }
+  }
 }
 
 // The head (positional 0) and a Named edge are kept as authored: the named edge is a
@@ -4413,8 +4491,10 @@ fn body_lower_repeated_param_binding_diagnostic(edge: Edge) -> Diagnostic {
 // returns it: that is the seed's own realization (v1.compiler.emit_rust emits a data item as a
 // nullary fn and calls it at every reference), and it lets the existing Arrow, product and literal
 // derivations ground the member with no data-specific infer rule. The data-versus-fn distinction a
-// reference site needs is not carried by this shape; it lives in the declaration index
-// (v2.std.decl_index data_decl_type_facts), which reads the parse, not this tree. A shell whose
+// reference site needs IS carried, by one marker on the Arrow (body_lower_constant_member_arrow, v2.std.node
+// ConstantMemberEdge): a reference to the member uses its value. v2.std.decl_index data_decl_type_facts
+// still answers the same question for a corpus CENSUS over the parse (a second reader of the fact, declared
+// as a frontier until a corpus index over lowered roots exists to read the marker instead). A shell whose
 // name, declared type or value is not reachable is retained as the counted frontier, exactly as
 // the fn arm retains, never guessed.
 // THE INITIALIZER IS ALREADY LOWERED WHEN THIS ARM RUNS. normalize_node_ctx folds a declaration's
@@ -4424,12 +4504,10 @@ fn body_lower_repeated_param_binding_diagnostic(edge: Edge) -> Diagnostic {
 // which retain on shapes they do not recognize (a record literal whose field is a fn literal).
 // Only an initializer that is not yet substrate goes through that reader.
 fn body_lower_data_initializer_body(expr: Node) -> Outcome<Optional<Node>> {
-  if body_lower_is_core_substrate(node: expr) {
-    outcome_accepted(value: optional_present(value: expr))
-  } else if body_lower_is_unrecognised_lowered_shape(node: expr) {
-    Rejected { diagnostics: body_lower_unrecognised_lowered_shape_diagnostics(node: expr) }
-  } else {
-    body_lower_eq_expr_to_body(expr: expr)
+  match body_term_of(node: expr) {
+    Rejected { diagnostics: r } => Rejected { diagnostics: r }
+    Accepted { value: Lowered { node: lowered, shape: _ }, diagnostics: _ } => outcome_accepted(value: optional_present(value: lowered))
+    Accepted { value: _, diagnostics: _ } => body_lower_eq_expr_to_body(expr: expr)
   }
 }
 
@@ -4465,7 +4543,7 @@ fn body_lower_data_decl_to_member(shell: Node) -> Outcome<BodyLowering> {
                                 )
                                 Present { value: data_name } =>
                                   let signature = declared_signature(params: [], source: shell)
-                                  let arrow = body_lower_callable_arrow(
+                                  let arrow = body_lower_constant_member_arrow(arrow: body_lower_callable_arrow(
                                     source: shell,
                                     domain: signature.domain,
                                     codomain: declared_type,
@@ -4474,7 +4552,7 @@ fn body_lower_data_decl_to_member(shell: Node) -> Outcome<BodyLowering> {
                                     body: optional_present(
                                       value: body_lower_position_function_values(node: reified_body, path: body_lower_unpositioned_path())
                                     )
-                                  )
+                                  ))
                                   body_lowering_lowered(
                                     o: outcome_with_diagnostics(
                                       value: body_lower_fn_decl_named_member_wrap(
@@ -4496,13 +4574,25 @@ fn body_lower_data_decl_to_member(shell: Node) -> Outcome<BodyLowering> {
   }
 }
 
+// THE DATA ARROW CARRIES THE ONE FACT THAT DISTINGUISHES IT FROM A NULLARY FN (v2.std.node
+// ConstantMemberEdge): a reference to it uses its value. Without the marker the lowered member was
+// indistinguishable from `fn x() -> T`, so infer typed a bare reference `x` as the function () -> T
+// and every data reference at a declared position refused (a String data row as a concat argument,
+// an Int data row as an Int initializer). The fact is kept on the carrier that owns it instead of
+// being re-read from the parse.
+fn body_lower_constant_member_arrow(arrow: Node) -> Node {
+  node_rebuild(
+    n: arrow,
+    children: list_snoc_item(xs: arrow.children, item: core_edge(marker: ConstantMemberEdge, target: node_synthetic(kind: TypeNode { connective: Conj }, children: [])))
+  )
+}
+
 // THE DECLARED ORDER, CARRIED ON THE ARROW. Every Arrow built from a declared signature carries one
 // ^arrow_signature_order_edge (v2.std.arrow_signature signature_order_edge) whose target is
 // the language's canonical FreeMonoid introduction (lower_list_introduction) of the parameter labels as childless
 // Atoms, in declared order: arity 0 is the empty introduction, arity 1 a singleton. It is the ONE
 // place positional binding reads parameter order (v2.std.node arrow_declared_parameter_order).
 // Resolve does not walk it (v2.compiler.resolve resolve_arrow_node): its atoms are labels, not
-// references, so a parameter spelled like a name in scope cannot bind through it.
 //
 // THE ONE CALLABLE ARROW. A lambda is surface sugar over the same Arrow a named `fn` declares, so the
 // child LAYOUT of a callable Arrow -- which children exist, in which order, under which labels -- is
@@ -4558,15 +4648,15 @@ fn body_lower_callable_arrow(
     )
   ))
 }
-
 fn body_lower_fn_decl_arrow(shell: Node, sig: BodyLowerFnSignature, body: Optional<Node>) -> Node {
+
   body_lower_fn_decl_named_member_wrap(
     arrow: body_lower_callable_arrow(
       source: shell,
       domain: Edge { label: Positional, target: sig.domain },
       codomain: sig.return_type,
       order_edge: signature_order_edge(order: sig.order, source: shell),
-      type_param_edges: body_lower_fn_decl_type_params_edges(sig: sig),
+      type_param_edges: list_append(left: body_lower_fn_decl_type_params_edges(sig: sig), right: body_lower_fn_admit_clause_edges(shell: shell)),
       body: match body {
         Absent => optional_absent()
         Present { value: b } =>
@@ -4578,6 +4668,317 @@ fn body_lower_fn_decl_arrow(shell: Node, sig: BodyLowerFnSignature, body: Option
   )
 }
 
+// THE ADMIT_CALLERS CARRIER, ONE BUILD PER CLAUSE. The generic dispatch (body_lower_after_children)
+// reaches the clause shell BOTTOM-UP, so the clause's OWN production case is where the authored
+// encoding is consumed: body_lower_admit_clause_image reads the roster off the raw spine (the reader
+// needs the parse encoding) and the image REPLACES the shell, so the raw token subtree never enters
+// the tree. The fn declaration's Arrow then finds the image by the shell's own identity (kept in
+// body_lower_admit_clause_image) and hangs it under the core marker AdmitCallersEdge — one build,
+// one fact, one place (DESIGN section 3).
+//
+// WHY THE ROSTER IS RE-HUNG AT ALL: a raw grammar-sequence encoding is token atoms, and token atoms
+// do not ground, so a raw roster in a subject's own module would refuse the whole fixture at
+// infer_grounding_not_derived before any wall could judge it (pinned by probe 2026-10-04) — the same
+// reason the where-clause lowering does not carry predicates raw.
+//
+// FALLBACK, FAIL-CLOSED: if the authored spine does not read, the carrier hangs a MARKER atom at
+// the clause's own occurrence instead of a roster. The reader demands a roster conj and REFUSES
+// (^infer_reason_admit_callers_entries_unreadable at the clause) — a malformed clause is never a
+// shorter roster (DESIGN section 5: a failure arm must refuse, never widen).
+// THE CARRIER (v2 body lowering): a fn's authored `admit_callers` clause becomes one AdmitCallersEdge
+// on the fn's Arrow, whose target is the clause's lowered roster. The clause is an OPTIONAL ELEMENT of
+// the fn-decl production, so it is read off the fn shell's optional-element projection — identified by
+// its own production identity (^dag_surface_admit_callers_clause), which distinguishes it from the
+// fn header's other optional (the return type). The outer Absent (no such optional) is the only
+// silence: a fn without the clause has nothing to judge. Once a clause IS present, every failure to
+// read it hangs the clause-fallback marker instead -- the reader refuses it as
+// ^infer_reason_admit_callers_entries_unreadable at the clause (DESIGN §5: a failure arm must refuse,
+// never widen). A grammar or graft change that reshapes the clause shell switches the wall to
+// REFUSING, never off.
+fn body_lower_fn_admit_clause_edges(shell: Node) -> List<Edge> {
+  match body_lower_admit_clause_shell_optional(shell: shell) {
+    Absent => []
+    Present { value: clause } =>
+      match body_lower_admit_clause_roster_optional(clause: clause) {
+        Absent =>
+          [core_edge(
+            marker: AdmitCallersEdge,
+            target: sugar_type_node(connective: Atom { identity: ^infer_reason_admit_callers_entries_unreadable }, children: [], n: clause)
+          )]
+        Present { value: roster } => [core_edge(marker: AdmitCallersEdge, target: roster)]
+      }
+  }
+}
+
+// THE FN SHELL'S ADMIT CLAUSE, among its optionals: the optional-element projection whose target's
+// production identity is ^dag_surface_admit_callers_clause.
+fn body_lower_admit_clause_shell_optional(shell: Node) -> Optional<Node> {
+  match parse_production_captured_child_optional(node: shell) {
+    Absent => optional_absent()
+    Present { value: captured } =>
+      match body_lower_find_production_shell_optional(root: captured, emitted: ^dag_surface_admit_callers_clause) {
+        Absent => optional_absent()
+        Present { value: clause } => optional_present(value: clause)
+      }
+  }
+}
+
+// THE CLAUSE'S ROSTER: the clause shell's named body value (the bracketed entry list), else its
+// captured child.
+fn body_lower_admit_clause_roster_optional(clause: Node) -> Optional<Node> {
+  match sugar_named_child_optional(root: clause, name: ^admit_callers_clause_body) {
+    Present { value: roster } => optional_present(value: roster)
+    Absent => parse_production_captured_child_optional(node: clause)
+  }
+}
+
+// THE CLAUSE'S LOWERED IMAGE: the shell's own kind and occurrence (so the Arrow finds it), carrying
+// the roster as one named value edge. The reused occurrence is legal BECAUSE the shell it came from
+// leaves the tree with this replacement, together with the whole raw spine (occurrence wall: a
+// minted id on two nodes with different content refuses). The production-identity projection is
+// KEPT verbatim, so body_lower_find_production_shell_optional and every graft that recognizes the
+// shell still do; only the value encoding is swapped.
+fn body_lower_admit_clause_image(clause: Node) -> Node {
+  let roster = match body_lower_admit_roster_node(clause: clause) {
+    Absent => sugar_type_node(connective: Atom { identity: ^infer_reason_admit_callers_entries_unreadable }, children: [], n: clause)
+    Present { value: r } => r
+  }
+  node_lowered_from(
+    source: clause,
+    kind: clause.kind,
+    children: list_append(
+      left: keep_production_projections(children: clause.children),
+      right: [Edge { label: Authored { name: ^admit_callers_clause_body }, target: roster }]
+    )
+  )
+}
+
+// The projection edges that are part of the shell's identity (the production-identity projection and
+// its peers), kept so the image remains a recognized production shell.
+fn keep_production_projections(children: List<Edge>) -> List<Edge> {
+  fold(
+    xs: children,
+    init: Empty,
+    f: fn(acc, e) {
+      if label_is_projection(e: e) { list_append(left: acc, right: [e]) } else { acc }
+    }
+  )
+}
+
+fn label_is_projection(e: Edge) -> Bool {
+  match e.label {
+    Authored { name: name } =>
+      (name == ^grammar_production_identity_node_projection)
+        || (name == ^grammar_optional_element_node_projection)
+    Positional => false
+    StructuralLabel { label: _ } => true
+  }
+}
+
+fn body_lower_admit_roster_node(clause: Node) -> Optional<Node> {
+  match parse_production_captured_child_optional(node: clause) {
+    Absent => optional_absent()
+    Present { value: captured } =>
+      match sugar_sequence_pair_optional(node: body_lower_deep_unwrap_optional(node: captured)) {
+        Absent => optional_absent()
+        Present { value: head_pair } =>
+          match sugar_sequence_pair_optional(node: body_lower_deep_unwrap_optional(node: head_pair.right)) {
+            Absent => optional_absent()
+            Present { value: colon_pair } =>
+              match sugar_sequence_pair_optional(node: body_lower_deep_unwrap_optional(node: colon_pair.right)) {
+                Absent => optional_absent()
+                Present { value: bracket_pair } =>
+                  match body_lower_comma_list_items_optional(list_capture: bracket_pair.right) {
+                    Absent => optional_absent()
+                    Present { value: entries } =>
+                      body_lower_admit_roster_from_entries(entries: entries, template: bracket_pair.right)
+                  }
+              }
+          }
+      }
+  }
+}
+
+fn body_lower_admit_roster_from_entries(entries: List<Node>, template: Node) -> Optional<Node> {
+  match body_lower_admit_record_spine(entries: entries, template: template) {
+    Absent => optional_absent()
+    Present { value: spine } =>
+      optional_present(value: close_lowered_image(root: spine))
+  }
+}
+
+// THE CONFORMING ROSTER: the declared sequence-pair spine — one record per entry, under the
+// grammar's sequence-projection edges (@grammar_sequence_left_node_projection carries the record,
+// @grammar_sequence_right_node_projection carries the rest, the empty conj root ends the spine).
+// This is the substrate's standing linked-list-in-a-tree shape, read by the shared
+// sugar_sequence_pair_optional; the carrier mints it and adds no second name for it (DESIGN §2).
+// Every edge is authored and distinct within its node, so connective_edges_conform accepts it, and
+// an empty authored list lowers to the empty conj root without refusing. All built nodes share the
+// template's minted occurrence (the template left the tree with the swap); close_lowered_image marks
+// every member below the root OccurrencePending so allocation gives each a real id after
+// normalization.
+fn body_lower_admit_record_spine(entries: List<Node>, template: Node) -> Optional<Node> {
+  fold(
+    xs: entries,
+    init: optional_present(value: sugar_type_node(connective: Conj, children: [], n: template)),
+    f: fn(acc, entry) {
+      match acc {
+        Absent => optional_absent()
+        Present { value: rest } =>
+          match body_lower_admit_entry_edge(entry: entry, template: template) {
+            Absent => optional_absent()
+            Present { value: record_edge } =>
+              optional_present(
+                value: sugar_type_node(
+                  connective: Conj,
+                  children: [
+                    Edge {
+                      label: Authored { name: ^grammar_sequence_left_node_projection },
+                      target: record_edge.target
+                    },
+                    Edge {
+                      label: Authored { name: ^grammar_sequence_right_node_projection },
+                      target: rest
+                    }
+                  ],
+                  n: template
+                )
+              )
+          }
+      }
+    }
+  )
+}
+
+// ONE ENTRY -> ONE RECORD CONJ IN THE SPINE, ALWAYS GROUNDABLE. The entry's call is read through the
+// shared readers -- application_head_read for the callee (the canonical Transform-head surface, the
+// same accessor every other callee consumer uses) and the authored field edges for the two
+// coordinates, whose string literals are read by the language's own
+// dag_string_literal_value_symbol_optional. The record carries
+// the operator spelling (^decl_ref) and the two lexemes as plain atoms. An entry that READS but is not
+// such a call lowers to a marker record the reader refuses at the entry
+// (^infer_reason_admit_callers_entry_not_decl_ref) — never dropped, never a raw token subtree. Only a
+// spine the reader cannot walk returns Absent, failing the whole roster into the clause fallback's
+// refusal. EVERY built node is minted with the roster template's id: close_lowered_image marks them
+// all OccurrencePending below the spine root, so allocation gives each a real id and no two built
+// nodes ever share one minted identity.
+fn body_lower_admit_entry_edge(entry: Node, template: Node) -> Optional<Edge> {
+  match body_lower_admit_entry_call_optional(item: entry) {
+    Absent => optional_absent()
+    Present { value: call } =>
+      match call.kind {
+        TypeNode { connective: Conj } =>
+          optional_present(value: body_lower_admit_entry_marker(template: template))
+        TypeNode { connective: Atom { identity: _ } } =>
+          optional_present(value: body_lower_admit_entry_marker(template: template))
+        TypeNode { connective: Arrow } =>
+          optional_present(value: body_lower_admit_entry_marker(template: template))
+        TypeNode { connective: Cardinality } =>
+          optional_present(value: body_lower_admit_entry_marker(template: template))
+        TypeNode { connective: Instantiation } =>
+          optional_present(value: body_lower_admit_entry_marker(template: template))
+        TypeNode { connective: Disj } =>
+          optional_present(value: body_lower_admit_entry_marker(template: template))
+        ComputationNode { behavior: Transform } =>
+          match application_head_read(site: call) {
+            ApplicationHeadFound { head: _, head_identity: AtomHead { identity: id }, operands: _ } =>
+              if symbol_eq(a: id, b: ^decl_ref) {
+                    match body_lower_admit_string_field_edge(call: call, field: ^module_path, template: template) {
+                      Absent => optional_present(value: body_lower_admit_entry_marker(template: template))
+                      Present { value: mp_edge } =>
+                        match body_lower_admit_string_field_edge(call: call, field: ^decl_name, template: template) {
+                          Absent => optional_present(value: body_lower_admit_entry_marker(template: template))
+                          Present { value: dn_edge } =>
+                            optional_present(
+                              value: Edge {
+                                label: Authored { name: ^admit_callers_clause_body },
+                                target: sugar_type_node(
+                                  connective: Conj,
+                                  children: [
+                                    Edge {
+                                      label: Authored { name: ^decl_ref },
+                                      target: sugar_type_node(connective: Atom { identity: ^decl_ref }, children: [], n: template)
+                                    },
+                                    mp_edge,
+                                    dn_edge
+                                  ],
+                                  n: template
+                                )
+                              }
+                            )
+                        }
+                    }
+                  } else {
+                    optional_present(value: body_lower_admit_entry_marker(template: template))
+                  }
+            ApplicationHeadFound { head: _, head_identity: ArrowHead, operands: _ } =>
+              optional_present(value: body_lower_admit_entry_marker(template: template))
+            ApplicationHeadRefused { diagnostics: _ } =>
+              optional_present(value: body_lower_admit_entry_marker(template: template))
+            NotApplicationHead =>
+              optional_present(value: body_lower_admit_entry_marker(template: template))
+          }
+        ComputationNode { behavior: Loop } =>
+          optional_present(value: body_lower_admit_entry_marker(template: template))
+        ComputationNode { behavior: Branch } =>
+          optional_present(value: body_lower_admit_entry_marker(template: template))
+        ComputationNode { behavior: Bind } =>
+          optional_present(value: body_lower_admit_entry_marker(template: template))
+        ComputationNode { behavior: Match } =>
+          optional_present(value: body_lower_admit_entry_marker(template: template))
+        ComputationNode { behavior: Value } =>
+          optional_present(value: body_lower_admit_entry_marker(template: template))
+      }
+  }
+}
+
+// @field -> string literal -> the value lexeme as an interned symbol, read by the language's own
+// string-literal reader, hung as the record's authored field edge. Absent when the edge is missing or
+// its target is not a string literal.
+fn body_lower_admit_string_field_edge(call: Node, field: Symbol, template: Node) -> Optional<Edge> {
+  match sugar_named_child_optional(root: call, name: field) {
+    Absent => optional_absent()
+    Present { value: literal } =>
+      match dag_string_literal_value_symbol_optional(node: literal) {
+        Absent => optional_absent()
+        Present { value: lexeme } =>
+          optional_present(
+            value: Edge {
+              label: Authored { name: field },
+              target: sugar_type_node(connective: Atom { identity: lexeme }, children: [], n: template)
+            }
+          )
+      }
+  }
+}
+
+// THE UNINTERPRETABLE-ENTRY MARKER: a record conj whose single edge names the refusal the reader
+// raises at the entry. Minted with the template's id like every other built node; close_lowered_image
+// marks it pending and allocation gives it a real id.
+fn body_lower_admit_entry_marker(template: Node) -> Edge {
+  Edge {
+    label: Authored { name: ^uninterpretable },
+    target: sugar_type_node(
+      connective: Conj,
+      children: [Edge {
+        label: Authored { name: ^infer_reason_admit_callers_entry_not_decl_ref },
+        target: sugar_type_node(connective: Atom { identity: ^infer_reason_admit_callers_entry_not_decl_ref }, children: [], n: template)
+      }],
+      n: template
+    )
+  }
+}
+
+// The entry item is the parse spine of the call expression: nested sequence pairs whose every right
+// component is empty (a call has no operator tail), bottoming at the lowered comp:transform. Descend
+// the left spine to the leaf; a non-empty tail is not an entry shape this reader admits.
+fn body_lower_admit_entry_call_optional(item: Node) -> Optional<Node> {
+  match body_lower_body_subtree_lower_from_binary(captured: item) {
+    Rejected { diagnostics: _ } => optional_absent()
+    Accepted { value: found, diagnostics: _ } => found
+  }
+}
+
 // CENSUS GRADE: THE SIGNATURE, NEVER THE BODY. A module outside the compiled closure is read only for
 // what resolution asks of it -- declaration paths and payload kinds -- and the symbol-index fill
 // descends into an Arrow's domain alone. So the census arm builds the full arm's Arrow from the same
@@ -4955,11 +5356,17 @@ fn body_lower_value_lowered(node: Node) -> Outcome<Optional<Node>> {
 // projection is an unlowered operator tail and is not peeled.
 fn body_lower_lowered_behind_shells_read(node: Node) -> OperandRefRead {
   let stripped = body_lower_deep_unwrap_optional(node: node)
-  if body_lower_is_core_substrate(node: stripped) {
-    OperandRefLowered { lowered: stripped }
-  } else if body_lower_is_unrecognised_lowered_shape(node: stripped) {
-    OperandRefRefused { diagnostics: body_lower_unrecognised_lowered_shape_diagnostics(node: stripped) }
-  } else if body_lower_node_is_lowered_atom(node: stripped) {
+  match body_term_of(node: stripped) {
+    Rejected { diagnostics: r } => OperandRefRefused { diagnostics: r }
+    Accepted { value: Lowered { node: lowered, shape: _ }, diagnostics: _ } => OperandRefLowered { lowered: lowered }
+    Accepted { value: _, diagnostics: _ } => body_lower_raw_behind_shells_read(stripped: stripped)
+  }
+}
+
+// Behind the shells of a node the parse stamped: a token is read as an operand, a production or an
+// empty-tailed sequence is peeled one level, anything else is not a lowered value.
+fn body_lower_raw_behind_shells_read(stripped: Node) -> OperandRefRead {
+  if body_lower_node_is_lowered_atom(node: stripped) {
     body_lower_operand_ref_read(node: stripped)
   } else {
     match parse_production_emitted_identity_optional(node: stripped) {
@@ -5100,7 +5507,7 @@ fn body_lower_function_value_body(body: FunctionLiteralBody) -> Outcome<Optional
         Absent =>
           match body_lower_fn_body_stmt_seq_optional(fn_body: b) {
             Absent => outcome_accepted(value: optional_absent())
-            Present { value: stmt_seq } => body_lower_function_value_lowered_whole(o: body_lower_stmt_seq(shell: stmt_seq))
+            Present { value: stmt_seq } => body_lower_function_value_lowered_whole(o: body_term_sealed_outcome(o: body_lower_stmt_seq(shell: stmt_seq), shape: LoweredStatementSequence))
           }
       }
     FunctionLiteralStatementBody { body: b } =>
@@ -5859,7 +6266,19 @@ fn body_lower_postfix_projection_step(repeat_elem: Node) -> Optional<Node> {
 // idiom the existing arms still erase (the receipt is on the class row; see DottedChainTailRead).
 // A brace record suffix (`a.b.C { f: v }`) is a construction, lowered by the chain fold's
 // PostfixRecord step, and an `as` suffix is a cast step; neither is read by this head reader.
+// A HEAD A PRODUCER PASSED THROUGH IS STILL A NAME. The primary producer returns a bare identifier
+// sealed as its output; whether `a.b` is one qualified name is decided by what the head IS, so a
+// Lowered head is read as the node it holds, exactly as this reader saw it before the seal.
 fn body_lower_dotted_head_atom_optional(node: Node) -> Optional<Node> {
+  match body_term_of(node: node) {
+    Accepted { value: Lowered { node: inner, shape: _ }, diagnostics: _ } => body_lower_dotted_head_raw_atom_optional(node: inner)
+    Accepted { value: RawParse { node: raw }, diagnostics: _ } => body_lower_dotted_head_raw_atom_optional(node: raw)
+    Accepted { value: RawLeaf { node: leaf }, diagnostics: _ } => body_lower_dotted_head_raw_atom_optional(node: leaf)
+    Rejected { diagnostics: _ } => optional_absent()
+  }
+}
+
+fn body_lower_dotted_head_raw_atom_optional(node: Node) -> Optional<Node> {
   match node_atom_identity_optional(node: node) {
     Present { value: sym } =>
       if dag_lex_token_symbol(sym: sym) {
@@ -7177,6 +7596,9 @@ fn body_lower_reify_branch_target(node: Node) -> Outcome<Node> {
       match body_lower_literal_bool_atom_optional(node: node) {
         Present { value: reified } => outcome_accepted(value: reified)
         Absent =>
+          if body_lower_reify_interior_is_lowered(node: node) {
+            outcome_accepted(value: node)
+          } else {
           match body_lower_operand_ref_read(node: node) {
             OperandRefLowered { lowered: op } => outcome_accepted(value: op)
             OperandRefRefused { diagnostics: r } => Rejected { diagnostics: r }
@@ -7187,6 +7609,7 @@ fn body_lower_reify_branch_target(node: Node) -> Outcome<Node> {
                 OperandRefAbsent => outcome_accepted(value: node)
               }
           }
+          }
       }
   }
 }
@@ -9053,7 +9476,12 @@ fn body_lowering_match_spine_identity_absent_dispatch_holds() -> Bool {
         match body_lower_fold_identity_absent(node: fixture) {
           Rejected { diagnostics: _ } => true
           Accepted { value: dispatched, diagnostics: _ } =>
-            body_lower_is_core_substrate(node: dispatched) || dispatched != reduced
+            (match body_term_of(node: dispatched) {
+              Accepted { value: Lowered { node: _, shape: _ }, diagnostics: _ } => true
+              Accepted { value: RawParse { node: _ }, diagnostics: _ } => false
+              Accepted { value: RawLeaf { node: _ }, diagnostics: _ } => false
+              Rejected { diagnostics: _ } => false
+            }) || dispatched != reduced
         }
     }
   }
@@ -9088,9 +9516,13 @@ fn body_lower_postfix_lowered_primary_optional(captured: Node) -> Optional<Node>
   match sugar_sequence_pair_optional(node: captured) {
     Absent => Absent
     Present { value: pair } =>
-      if body_lower_is_core_substrate(node: pair.left)
-        && is_empty_conj_root(n: body_lower_deep_unwrap_optional(node: pair.right)) {
-        optional_present(value: pair.left)
+      if is_empty_conj_root(n: body_lower_deep_unwrap_optional(node: pair.right)) {
+        match body_term_of(node: pair.left) {
+          Accepted { value: Lowered { node: lowered, shape: _ }, diagnostics: _ } => optional_present(value: lowered)
+          Accepted { value: RawParse { node: _ }, diagnostics: _ } => optional_absent()
+          Accepted { value: RawLeaf { node: _ }, diagnostics: _ } => optional_absent()
+          Rejected { diagnostics: _ } => optional_absent()
+        }
       } else {
         optional_absent()
       }
@@ -9626,11 +10058,10 @@ fn body_lower_primary_expr(shell: Node) -> Outcome<Node> {
     Present { value: inner } => inner
     Absent => shell
   }
-  if body_lower_is_core_substrate(node: captured) {
-    outcome_accepted(value: captured)
-  } else if body_lower_is_unrecognised_lowered_shape(node: captured) {
-    Rejected { diagnostics: body_lower_unrecognised_lowered_shape_diagnostics(node: captured) }
-  } else {
+  match body_term_of(node: captured) {
+    Rejected { diagnostics: r } => Rejected { diagnostics: r }
+    Accepted { value: Lowered { node: lowered, shape: _ }, diagnostics: _ } => outcome_accepted(value: lowered)
+    Accepted { value: _, diagnostics: _ } =>
   match body_lower_int_literal_with_magnitude_optional(node: captured) {
         Present { value: lit } => outcome_accepted(value: lit)
         Absent =>
@@ -9728,21 +10159,21 @@ fn body_lower_fn_body_shell(shell: Node) -> Outcome<BodyLowering> {
 
 fn body_lower_forward_row_apply(shell: Node, emitted: Symbol) -> Outcome<BodyLowering> {
   if emitted == ^dag_surface_fn_decl {
-    body_lower_fn_decl_to_arrow(shell: shell)
+    body_term_sealed_lowering(o: body_lower_fn_decl_to_arrow(shell: shell), shape: LoweredFnDeclaration)
   } else if emitted == ^dag_surface_test_fn_decl {
-    body_lower_test_fn_decl_to_member(shell: shell)
+    body_term_sealed_lowering(o: body_lower_test_fn_decl_to_member(shell: shell), shape: LoweredTestDeclaration)
   } else if emitted == ^dag_surface_data_decl {
-    body_lower_data_decl_to_member(shell: shell)
+    body_term_sealed_lowering(o: body_lower_data_decl_to_member(shell: shell), shape: LoweredDataDeclaration)
   } else if emitted == ^dag_surface_fn_body {
-    body_lower_fn_body_shell(shell: shell)
+    body_term_sealed_lowering(o: body_lower_fn_body_shell(shell: shell), shape: LoweredFnBody)
   } else if emitted == ^dag_surface_match_expr {
-    body_lowering_lowered(o: body_lower_match_expr(shell: shell))
+    body_term_sealed_lowering(o: body_lowering_lowered(o: body_lower_match_expr(shell: shell)), shape: LoweredMatch)
   } else if emitted == ^dag_surface_if_expr {
-    body_lowering_lowered(o: body_lower_if_expr(shell: shell))
+    body_term_sealed_lowering(o: body_lowering_lowered(o: body_lower_if_expr(shell: shell)), shape: LoweredBranch)
   } else if emitted == ^dag_surface_loop_expr {
-    body_lowering_lowered(o: body_lower_loop_expr(shell: shell))
+    body_term_sealed_lowering(o: body_lowering_lowered(o: body_lower_loop_expr(shell: shell)), shape: LoweredLoop)
   } else if emitted == ^dag_surface_let_expr {
-    body_lowering_lowered(o: body_lower_let_expr(shell: shell))
+    body_term_sealed_lowering(o: body_lowering_lowered(o: body_lower_let_expr(shell: shell)), shape: LoweredLet)
   } else {
     body_lower_wrapper_retained_shell(shell: shell)
   }
@@ -9877,21 +10308,12 @@ fn body_lower_type_decl_eq_rhs_optional(captured: Node) -> Optional<Node> {
 // time this lowering runs, so it takes the member arm.
 fn body_lower_eq_type_decl(shell: Node, captured: Node, type_name: Symbol, type_params: DeclTypeParams) -> Outcome<Node> {
   match body_lower_type_decl_eq_rhs_optional(captured: captured) {
-    Present { value: rhs } =>
-      match rhs.kind {
-        TypeNode { connective: Disj } =>
-          outcome_accepted(value: body_lower_type_decl_member(shell: shell, type_name: type_name, body: rhs, type_params: type_params))
-        TypeNode { connective: Conj } =>
-          if body_lower_node_is_production_shell(n: rhs) {
-            body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
-          } else {
-            outcome_accepted(value: body_lower_type_decl_member(shell: shell, type_name: type_name, body: rhs, type_params: type_params))
-          }
-        TypeNode { connective: Atom { identity: _ } } => body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
-        TypeNode { connective: Arrow } => body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
-        TypeNode { connective: Cardinality } => body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
-        TypeNode { connective: Instantiation } => body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
-        ComputationNode { behavior: _ } => body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
+    Present { value: rhs_term } =>
+      match body_term_wrapper_optional(n: rhs_term) {
+        Present { value: w } =>
+          body_lower_eq_type_decl_rhs(shell: shell, type_name: type_name, rhs: w.node, type_params: type_params)
+        Absent =>
+          body_lower_eq_type_decl_rhs(shell: shell, type_name: type_name, rhs: rhs_term, type_params: type_params)
       }
     Absent =>
       match body_lower_find_production_shell_optional(root: captured, emitted: ^dag_surface_type_alias_rhs_lead) {
@@ -9906,6 +10328,31 @@ fn body_lower_eq_type_decl(shell: Node, captured: Node, type_name: Symbol, type_
   }
 }
 
+// THE TYPE DECLARATION'S RIGHT-HAND SIDE (MQ-5). The rhs is a TYPE EXPRESSION -- raw parse, or a type
+// the type lowering built (a coproduct's Disj, a record's Conj), which is not a body term and is never
+// sealed -- but a body producer's sealed wrapper can still sit around it. A wrapper is a non-production
+// Conj, so reading its kind directly took the record-member arm and read the wrapper's one marker edge
+// as a field; body_lower_eq_type_decl unwraps a wrapper and passes everything else through unchanged.
+// It does NOT ask body_term_of: a type expression is outside the term vocabulary, and asking refused
+// every coproduct declaration (`type RcT = RcA | RcB | RcC`, a Disj; srv1 probe on #12942).
+fn body_lower_eq_type_decl_rhs(shell: Node, type_name: Symbol, rhs: Node, type_params: DeclTypeParams) -> Outcome<Node> {
+  match rhs.kind {
+    TypeNode { connective: Disj } =>
+      outcome_accepted(value: body_lower_type_decl_member(shell: shell, type_name: type_name, body: rhs, type_params: type_params))
+    TypeNode { connective: Conj } =>
+      if body_lower_node_is_production_shell(n: rhs) {
+        body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
+      } else {
+        outcome_accepted(value: body_lower_type_decl_member(shell: shell, type_name: type_name, body: rhs, type_params: type_params))
+      }
+    TypeNode { connective: Atom { identity: _ } } => body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
+    TypeNode { connective: Arrow } => body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
+    TypeNode { connective: Cardinality } => body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
+    TypeNode { connective: Instantiation } => body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
+    ComputationNode { behavior: _ } => body_lower_alias_type_decl(shell: shell, type_name: type_name, rhs: rhs, type_params: type_params)
+  }
+}
+
 fn body_lower_alias_type_decl(shell: Node, type_name: Symbol, rhs: Node, type_params: DeclTypeParams) -> Outcome<Node> {
   match body_lower_decl_binders(shell: shell, type_params: type_params) {
     Absent => body_lower_type_decl_uncarried(shell: shell)
@@ -10030,8 +10477,8 @@ fn body_lower_type_decl_record_name_optional(shell: Node) -> Optional<Symbol> {
 // v2.compiler.normalized_tree NormalizedTree type_declaration_kinds. One value per declaration: a record
 // and a refinement are authored alternatives, so the carrier has no state naming one declaration as
 // both. A record is what body_lower_type_decl_record_name_optional says; otherwise a where clause --
-// here still its dag_surface_where_refinement_clause production shell, the parse-level form of the arm
-// the by-body dispatch finds as a Named edge -- makes a refinement; anything else carries no kind, and
+// the same host body_lower_type_decl_by_body finds (body_lower_find_where_host_conj), not a second
+// walk that only recognises a production shell -- makes a refinement; anything else carries no kind, and
 // a plain Conj member without one is undecided downstream, never inferred.
 type DeclaredTypeKind
   = DeclaredRecord { name: Symbol }
@@ -10045,7 +10492,7 @@ fn body_lower_type_decl_declared_kind_optional(shell: Node) -> Optional<Declared
       match parse_production_captured_child_optional(node: shell) {
         Absent => Absent
         Present { value: captured } =>
-          match body_lower_find_production_shell_optional(root: captured, emitted: ^dag_surface_where_refinement_clause) {
+          match body_lower_find_where_host_conj(root: captured) {
             Absent => Absent
             Present { value: _ } =>
               match dag_surface_kw_then_ident_from_captured(captured: captured) {
@@ -11665,30 +12112,19 @@ fn body_lower_resource_decl_declared_kind_optional(shell: Node) -> Optional<Decl
   }
 }
 
-// AN `alias` DECLARATION REFUSES, AT ITSELF, UNTIL ITS BINDING ROW IS CARRIED (operator ruling via
-// stern-bear-500, 2026-10-05). The `alias Name = a.b.C` form (dag_grammar_alias_decl_expr, keyword
-// kw_alias) is NOT a type alias `type X = Y`, which lowers as a type declaration. Lowered as metadata,
-// the declaration was grafted as a member named Name whose row nothing read from the normalized tree,
-// so Name resolved to its own grafted node instead of a.b.C: a silent wrong answer (DESIGN section 5).
-// No .dag source declares one. The carry is gunbc.recurring_failure_mode
-// alias_declaration_binding_row_not_carried; when it lands this arm is deleted.
-fn body_lower_alias_decl_refused(shell: Node) -> Outcome<Node> {
-  outcome_rejected(d: body_lower_diagnostic(reason: ^body_lowering_reason_alias_binding_row_not_carried, n: shell))
-}
-
 fn body_lower_production_emitted(shell: Node, emitted: Symbol, fn_body_pass_through: Bool) -> Outcome<BodyLowering> {
   if emitted == ^dag_surface_service_decl {
-    body_lower_service_decl(shell: shell, admit_set_aside: false)
+    body_term_sealed_lowering(o: body_lower_service_decl(shell: shell, admit_set_aside: false), shape: LoweredServiceDeclaration)
   } else if emitted == ^dag_surface_resource_decl {
-    body_lower_resource_decl(shell: shell)
+    body_term_sealed_lowering(o: body_lower_resource_decl(shell: shell), shape: LoweredResourceDeclaration)
   } else if emitted == ^dag_surface_type_decl {
-    body_lowering_lowered(o: body_lower_type_decl(shell: shell))
-  } else if emitted == ^dag_surface_alias_decl {
-    body_lowering_lowered(o: body_lower_alias_decl_refused(shell: shell))
+    body_term_sealed_lowering(o: body_lowering_lowered(o: body_lower_type_decl(shell: shell)), shape: LoweredTypeDeclaration)
   } else if body_lower_is_metadata_preserved_emitted(emitted: emitted) {
     body_lowering_lowered(o: outcome_accepted(value: shell))
   } else if emitted == ^dag_surface_type_variant {
     body_lowering_lowered(o: body_lower_type_variant(shell: shell))
+  } else if emitted == ^dag_surface_admit_callers_clause {
+    body_lowering_lowered(o: outcome_accepted(value: body_lower_admit_clause_image(clause: shell)))
   } else if body_lower_is_structure_preserved_emitted(emitted: emitted) {
     body_lowering_lowered(o: outcome_accepted(value: shell))
   } else if emitted == ^dag_surface_fn_body && fn_body_pass_through {
@@ -11698,11 +12134,11 @@ fn body_lower_production_emitted(shell: Node, emitted: Symbol, fn_body_pass_thro
   } else if body_producer_forward_is_registered_surface_identity(surface_identity: emitted) {
     body_lower_forward_row_apply(shell: shell, emitted: emitted)
   } else if emitted == ^dag_surface_postfix_expr {
-    body_lowering_lowered(o: body_lower_postfix_expr(shell: shell))
+    body_term_sealed_lowering(o: body_lowering_lowered(o: body_lower_postfix_expr(shell: shell)), shape: LoweredPostfix)
   } else if body_lower_is_pass_through_emitted(emitted: emitted) {
     body_lowering_lowered(o: body_lower_unwrap_pass_through(shell: shell))
   } else if emitted == ^dag_surface_primary_expr {
-    body_lowering_lowered(o: body_lower_primary_expr(shell: shell))
+    body_term_sealed_lowering(o: body_lowering_lowered(o: body_lower_primary_expr(shell: shell)), shape: LoweredPrimary)
   } else {
     body_lower_wrapper_retained_shell(shell: shell)
   }
@@ -12090,12 +12526,17 @@ fn body_lower_tail_statement_read(stmt: Node) -> Outcome<Node> {
 }
 
 fn body_lower_after_children(folded: Node, fn_body_pass_through: Bool) -> Outcome<BodyLowering> {
-  if body_lower_is_core_substrate(node: folded) {
-    body_lowering_lowered(o: outcome_accepted(value: folded))
-  } else if dag_resolve_preserve_module_metadata_subtree(node: folded) {
+  match body_term_of(node: folded) {
+    Accepted { value: Lowered { node: _, shape: _ }, diagnostics: _ } => body_lowering_lowered(o: outcome_accepted(value: folded))
+    Rejected { diagnostics: r } =>
+      if dag_resolve_preserve_module_metadata_subtree(node: folded) { body_lowering_lowered(o: outcome_accepted(value: folded)) } else { Rejected { diagnostics: r } }
+    Accepted { value: _, diagnostics: _ } => body_lower_after_raw_children(folded: folded, fn_body_pass_through: fn_body_pass_through)
+  }
+}
+
+fn body_lower_after_raw_children(folded: Node, fn_body_pass_through: Bool) -> Outcome<BodyLowering> {
+  if dag_resolve_preserve_module_metadata_subtree(node: folded) {
     body_lowering_lowered(o: outcome_accepted(value: folded))
-  } else if body_lower_is_unrecognised_lowered_shape(node: folded) {
-    body_lowering_lowered(o: Rejected { diagnostics: body_lower_unrecognised_lowered_shape_diagnostics(node: folded) })
   } else {
     match parse_production_emitted_identity_optional(node: folded) {
       Absent => body_lowering_lowered(o: outcome_accepted(value: folded))
@@ -12130,3 +12571,4 @@ fn body_lower_finish_for_normalize(
   )
 }
 
+
diff --git a/src/v2/compiler/emit_host.dag b/src/v2/compiler/emit_host.dag
index fc0076030a5..5152c0d604d 100644
--- a/src/v2/compiler/emit_host.dag
+++ b/src/v2/compiler/emit_host.dag
@@ -21,8 +21,7 @@ import v2.compiler.eval {
   eval_context_interpretation,
   inputs_for_emit_host,
   inputs_root_only,
-  run_test_claim,
-  test_claim_cache_receipt_node
+  run_test_claim
 }
 import extdeps.communication.medium { Medium }
 import std.algebra { Cons, Empty }
@@ -825,7 +824,7 @@ fn run_test_claim_emit_vs_eval_run(
   verdict: Verdict<TestClaimEvalSubject<Node>, RuntimeValue>
 ) -> TestClaimRun<Node, RuntimeValue> {
   TestClaimRun {
-    cache: test_claim_cache_receipt_node(subject: subject),
+    claim: subject.claim,
     verdict: verdict
   }
 }
diff --git a/src/v2/compiler/emit_produced.dag b/src/v2/compiler/emit_produced.dag
index 31b35d5feb6..845e1792df7 100644
--- a/src/v2/compiler/emit_produced.dag
+++ b/src/v2/compiler/emit_produced.dag
@@ -20,7 +20,7 @@ import v2.std.compilers.target_model {
   FixedToken
 }
 import extdeps.communication.medium { Medium }
-import v2.std.collection { Absent, Present, list_at_optional, map_get }
+import v2.std.collection { Absent, Present, list_at_optional, map_get_checked }
 import v2.std.algebra { contains, fold_list, FreeMonoid }
 import std.algebra { Cons, Empty, list_append, list_snoc_item }
 import v2.std.diagnostic {
diff --git a/src/v2/compiler/emit_semantic_decl.dag b/src/v2/compiler/emit_semantic_decl.dag
index e499d1d6b51..9e2f55c13c7 100644
--- a/src/v2/compiler/emit_semantic_decl.dag
+++ b/src/v2/compiler/emit_semantic_decl.dag
@@ -11,7 +11,7 @@ import v2.std.compilers.semantic_decl_emission {
   target_semantic_enum_surface_from_coproduct,
   target_semantic_struct_surface_from_record
 }
-import v2.std.collection { Absent, Map, Present, empty_map, map_get }
+import v2.std.collection { Absent, Map, Present, empty_map, map_get_checked }
 import v2.std.qualified_name { declaration_reference_path_optional }
 import v2.std.compilers.target_model {
   TargetModel,
@@ -218,7 +218,7 @@ fn produced_type_binding_over(target: TargetModel, spellings: Map<Symbol, String
             match translate_target_atom_realization_for_carrier(target: target, source_carrier: type_node) {
               Accepted { value: row, diagnostics: _ } => outcome_accepted(value: target_atom_type_spelling(row: row))
               Rejected { diagnostics: _ } =>
-                match map_get(spellings, id) {
+                match map_get_checked(spellings, id) {
                   Accepted { value: Present { value: _ }, diagnostics: _ } => outcome_accepted(value: id)
                   _ => outcome_rejected(d: emit_type_reference_unrealized_diagnostic(node: type_node))
                 }
diff --git a/src/v2/compiler/fold_lowering.dag b/src/v2/compiler/fold_lowering.dag
index 89452cc5f05..840b422f46e 100644
--- a/src/v2/compiler/fold_lowering.dag
+++ b/src/v2/compiler/fold_lowering.dag
@@ -4,6 +4,7 @@ import std.types { List }
 import v2.extdeps.languages.dag {
   dag_call_named_arg_value_optional,
   dag_call_positional_arg_value_optional,
+  dag_kernel_value_type_first,
   dag_lex_token_symbol,
   parse_production_captured_child_optional,
   parse_production_emitted_identity_optional
@@ -33,6 +34,7 @@ import std.algebra {
   Empty,
   collection_all_shape,
   collection_concat_shape,
+  collection_count_shape,
   collection_fold_shape,
   collection_map_shape,
   template_accumulator_position,
@@ -249,7 +251,8 @@ data collection_roster_rows: List<CollectionRosterRow> = [
   collection_roster_row(t: collection_fold_shape(), decl_name: "collection_fold_shape", form: RosterAuthoredStep),
   collection_roster_row(t: collection_map_shape(), decl_name: "collection_map_shape", form: RosterCallbackStep { realization: CallbackMapsToCons }),
   collection_roster_row(t: collection_all_shape(), decl_name: "collection_all_shape", form: RosterCallbackStep { realization: CallbackAllByAnd }),
-  collection_roster_row(t: collection_concat_shape(), decl_name: "collection_concat_shape", form: RosterFreeMonoidPrimitiveCall)
+  collection_roster_row(t: collection_concat_shape(), decl_name: "collection_concat_shape", form: RosterFreeMonoidPrimitiveCall),
+  collection_roster_row(t: collection_count_shape(), decl_name: "collection_count_shape", form: RosterFreeMonoidPrimitiveCall)
 ]
 
 data collection_fold_head: Symbol = symbol_intern_lexeme(lexeme: collection_fold_shape().name)
@@ -323,7 +326,16 @@ fn collection_roster_template_type(t: AlgebraTypeTemplate) -> Optional<Node> {
     ReceiverElement => optional_present(value: collection_roster_element_type())
     ReceiverKey => optional_absent()
     ReceiverValue => optional_absent()
-    NamedTemplate { name: _ } => optional_absent()
+    NamedTemplate { name: n } =>
+      match dag_kernel_value_type_first(select: fn(row, _binding) {
+        match row.spelling {
+          Present { value: spelled } => spelled == n
+          Absent => false
+        }
+      }) {
+        Present { value: row } => optional_present(value: row.value_type)
+        Absent => optional_absent()
+      }
     ContainerOf { source: _, element: _ } => optional_absent()
     OptionalOf { inner: _ } => optional_absent()
     WitnessOf { inner: _ } => optional_absent()
diff --git a/src/v2/compiler/materialization_carriers.dag b/src/v2/compiler/materialization_carriers.dag
index 38aac4d32d6..ec0e39c16cf 100644
--- a/src/v2/compiler/materialization_carriers.dag
+++ b/src/v2/compiler/materialization_carriers.dag
@@ -1,59 +1,21 @@
 module v2.compiler.materialization_carriers
 
-import std.types { List, String }
-import std.cache_identity {
-  CacheInterfaceId,
-  ArtifactKindId,
-  parse_table_artifact_kind,
-}
-import std.realization {
-  Materialization, Memoize, Recompute, Share,
-  RealizedStep, Placement, LocalInProcess,
-}
-import std.measure { Nano }
-import std.realization_schedule { cost_account_predicted_zero }
-import std.effects { ReadEffect }
-import std.materialization_ladder {
-  Frame, FrameKind, SharedStateFrame, IsolatedChildrenFrame, UnboundedSiblingsFrame,
-  FrameDemand, DemandNature, PureComputation,
-  CacheProvider, CoversAllComputations,
-  LadderVerdict,
-  materialization_ladder, materialization_ladder_holds,
-  ladder_verdict_prescribes,
-  ladder_verdict_for,
-  ladder_verdict_is_green,
-  empty_frame_path, no_cost_floor_exemptions, no_cache_providers,
-  verdict_is_accepted_single_recompute,
-  verdict_is_discharged_by,
-  verdict_is_refused_no_provider,
-  verdict_is_refused_scope_too_narrow,
-}
-import extdeps.cache.materialization {
-  provider_from_catalog,
-}
-import extdeps.realization.parse_table_memo { parse_table_memo_facts, parse_table_memo_id }
-import extdeps.realization.compile_stage_memo { compile_stage_memo_facts, compile_stage_memo_id }
+import std.realization { Materialization, Memoize, Recompute, Share }
 import std.disposition { Disposition, Terminal }
-import v2.std.staging { CacheProbe, resolve_probe }
-import v2.std.diagnostic {
-  Accepted, Rejected, Outcome, None,
-  Diagnostic, Correction, Unavailable, ExternalContractUnknown,
-  diagnostics_singleton, invariant_port_locus,
-}
-import v2.std.node { Symbol }
-import std.optional { Present, Absent }
 
 data v2_compiler_materialization_memo_gate_predicate_contract: Disposition = Terminal {
-  reason: "Structural coproduct reader over std.realization.Materialization (materialization_allows_memo_store — Memoize => store permitted, Recompute/Share => refused) — closed by the three declared Materialization variants; .dag authority for parse_table_lookup/insert and cached_stage_governed; discriminating corpus: parse_table_memo_governed_witness_test.dag + compiler_materialization_witness_test.dag."
-}
-
-data v2_compiler_materialization_note: String = "The .dag-substrate demonstration lane (duplicate-work-graph-lens-design.md section 10b): ParseTable and cached_stage memoization flows through the governed carrier door — Memoize verdict consumed (non-Memoize refuses store), ContentKeyed law at parse_table_subject (grammar_digest × token_stream_digest × position × production). std.realization.reconcile-as-lookup-path is the following increment (no v2 runtime dispatch yet). Seed-side memo interceptor: extdeps/realization/parse_table_memo.dag parse_table_memo_seed_handler_dissolution_trigger (Scaffold dissolves_to RealizationDispatch on materialization_allows_memo_store; v1_interpreter.rs try_parse_table_memo_dispatch is the seed handler). In-process memo cannot span runs: RefusedScopeTooNarrow at IsolatedChildren LCA; persistent-tier discharge belongs to a store-tier provider row (materialization_store_local class). Collapsing plural sites into one process frame → AuthoredDuplication (rule 1). The parse demand's site is derived per grammar (ParseMemoRecurrence, computed in v2.compiler.parse compute_grammar_first_analysis_given) and carried on the table; the compile-stage demand is still authored. Dissolve-on: the remaining demands derive from demand-engine carriers (docs/plans/demand-engine-program.md M1) and the transport folds into materialize (Half A)."
-
-// TAIL probe 2026-07-17 (cssl_assemble, smart-newt-39): execution-measured Gate-A-shaped rustc
-// refusal (UNRESOLVED_CompilerError on emitter Rc/Optional surface) — NOT materialize-spine.
-// Frontier migration_trigger reclassified to ^migrate_when_closure_self_emits_cargo_green (#6775
-// lane). Receipt: TSV deleted 2026-08-16 (operator ruling: delete anything not actively derived).
-
+  reason: "Structural coproduct reader over std.realization.Materialization (materialization_allows_memo_store — Memoize => store permitted, Recompute/Share => refused) — closed by the three declared Materialization variants; discriminating corpus: v2.test.claim.self_host_contract.materialization_carriers_emitted_contract."
+}
+
+// THE COMPILER'S MEMO DEMANDS AND PROVIDERS ARE GONE, AND THIS MODULE KEEPS ONLY THE PREDICATE.
+// The parse-table demand was deleted with the packrat parse memo (operator ruling R2,
+// 2026-10-08) and the compile-stage demand with its always-Miss memo (roadmap
+// native-memory-inert-carriers): its only lookup answered Miss unconditionally, so the governed
+// door, its provider, its catalog row and its admission controls described a store that never
+// served. The generic ladder obligations those controls exercised -- RefusedScopeTooNarrow on
+// an isolated plural site, RefusedNoProvider without a provider, discharge inside the
+// provider's scope, single recompute -- stay enrolled on fixture subjects in
+// test.claim.materialization_ladder_witness.
 fn materialization_allows_memo_store(m: Materialization) -> Bool {
   match m {
     Memoize => true
@@ -61,569 +23,3 @@ fn materialization_allows_memo_store(m: Materialization) -> Bool {
     Share => false
   }
 }
-
-fn v2_compile_process_frame() -> std.materialization_ladder.Frame {
-  std.materialization_ladder.Frame { name: "v2-compile-ingest", kind: SharedStateFrame }
-}
-
-fn v2_compile_process_site() -> List<std.materialization_ladder.Frame> {
-  [v2_compile_process_frame()]
-}
-
-data parse_table_memo_demand_identity: String = "parse-nonterminal-memo"
-data compile_stage_memo_demand_identity: String = "compile-pipeline-stage"
-
-// THE PARSE DEMAND CASE IS DERIVED FROM THE GRAMMAR, NOT AUTHORED. The identity is one
-// (nonterminal, position) parse under one grammar and one token stream -- the ContentKeyed
-// preimage parse_table_subject already names. Whether that identity is demanded MORE THAN ONCE
-// within one parse is a structural fact of the grammar, and ParseMemoRecurrence is its census,
-// computed once per grammar by v2.compiler.parse compute_grammar_first_analysis_given.
-//
-// Why the census and not dependency_lens: a DependencyView is a (source, dependent, kind,
-// usage_site) edge over a Node. It records THAT a production references a nonterminal; it
-// carries no position, no ordered-choice retry and no nullability, and those three are exactly
-// what decide whether one (nonterminal, position) is asked twice. A reference-edge count is the
-// "import edge / lookup count" the demand case must not be equated with -- a grammar with a
-// nonterminal referenced from forty sites can still ask each (nonterminal, position) once.
-//
-// The two sources of within-parse recurrence, and why there is no third:
-//  - a DISCARDING backtrack site: an ordered Choice's left branch, or an Optional / Repeat
-//    element, whose attempt can fail after demanding a nonterminal. The failed attempt's
-//    result is thrown away and the continuation resumes at the SAME position, so any
-//    nonterminal it demanded can be demanded again there.
-//  - a NULLABLE nonterminal: it can succeed consuming nothing, so the next demand on the same
-//    successful path starts at the same position and may be the same nonterminal.
-// WHY THESE TWO ARE EXHAUSTIVE -- an argument over the constructors, so a new construct is
-// checked against it rather than against a list. A second demand of one (N, p) needs two demand
-// events for N at the same position p. Take any two such events in one parse's execution and
-// ask how the parse got from the first to the second. Either
-//  (a) the first event's subtree was ABANDONED and execution resumed at a position <= p: that
-//      needs a construct that attempts a branch and continues after its failure. In GrammarExpr
-//      only three do -- Choice (tries left, then right from the same position), Optional and
-//      Repeat (try the element, then continue from the same position). Terminal, LiteralTerminal
-//      and Nonterminal never resume after failure (they propagate it), and Sequence fails as a
-//      whole when either side fails, so the resuming point is always an enclosing
-//      Choice/Optional/Repeat. The abandoned subtree must contain the N demand, hence the
-//      "attempted branch demands a nonterminal" condition. Or
-//  (b) both events are on the SURVIVING path: then either one is an ancestor of the other at the
-//      same position, which is left recursion (refused by grammar_has_left_recursion_given), or
-//      they are ordered in the token stream and everything demanded between the first N's start
-//      and the second consumed zero tokens -- which requires the first N itself to consume
-//      nothing, i.e. N is nullable.
-// So (a) is a discarding backtrack site and (b) a nullable nonterminal; there is no third route.
-// THE TWO CODE FACTS (a) RESTS ON, named rather than inferred, because they are what a future
-// reader has to re-check and what a falsifier is aimed at. Both are in v2.compiler.parse.
-//  - parse_expr_sequence: when the RIGHT side rejects, the whole sequence returns
-//    ParseExprRejected. It never re-invokes the left side, so a failure downstream of a
-//    construct does not re-execute that construct or anything before it.
-//  - parse_expr_repeat_step: on a rejected element it sets done and KEEPS acc.remaining -- a
-//    successful iteration is never given back. Repeat is greedy and possessive, so it cannot
-//    shift the position at which a later nonterminal is demanded by yielding iterations. (It
-//    also stops on a zero-consumption iteration rather than looping at one position.)
-// Without those two, a Choice or Repeat branch containing NO Nonterminal could still cause a
-// later nonterminal to be re-demanded at the same position, and the syntactic site test would
-// not see it. That is the hole this argument would have.
-//
-// THE FALSIFIER, stated so this is an argument someone can kill rather than one they must
-// accept: either a parse_expr path that re-executes a continuation after a downstream failure,
-// or a demand of a nonterminal from inside a Choice / Optional / Repeat branch that contains no
-// Nonterminal node. Either one breaks (a) and the no-recurrence arm with it.
-//
-// WHO ACTUALLY TAKES THE NO-RECURRENCE ARM TODAY: no real grammar. It requires zero discarding
-// sites AND zero nullable nonterminals, and the .dag grammar has both, so it derives Memoize --
-// the same value the literal it replaced gave. The direct-computation arm is inhabited only by
-// synthetic fixtures (v2.test.provenance.parse_memo_frame_replay linear_root, and the
-// one-Terminal grammar in v2.test.claim.compiler_materialization_witness). That is declared
-// rather than left to be discovered: the arm is admitted and executed, but its only inhabitants
-// are fixtures, and a reader asking which real grammar recomputes should get "none today" from
-// here rather than from a search.
-// THE OBLIGATION ON A NEW CONSTRUCT: if it can resume after a failed attempt, it is a discarding
-// site and expr_parse_demand_fold in v2.compiler.parse must count it; if it can succeed consuming
-// nothing, the nullable fixpoint must include it. Parser error recovery (sync tokens) is outside
-// this argument: it is assumed to resume strictly later, and a recovery mode that re-enters at
-// the failed position is a third route that must be counted before it lands.
-//
-// Counting a Choice whose left branch token dispatch would never enter is a structural
-// over-approximation computed AS the answer (DESIGN section 5's admitted neighbour of the
-// absorbing fallback): it can only claim recurrence where none occurs, which costs a store and
-// never a wrong tree.
-type ParseMemoRecurrence {
-  discarding_backtrack_sites: Int
-  nullable_nonterminals: Int
-}
-
-fn parse_memo_recurrence_is_possible(r: ParseMemoRecurrence) -> Bool {
-  (r.discarding_backtrack_sites > 0) || (r.nullable_nonterminals > 0)
-}
-
-// Within-parse recurrence is a replay whose count the INPUT decides, so the emergent frame is
-// UnboundedSiblingsFrame -- it names the input-driven retry at one position, and it sits BELOW the
-// process frame: within-parse sharing is not cross-run reuse, and a run-spanning demand is a
-// different site (parse_table_memo_plural_demands below), refused, not discharged, by the
-// in-process provider.
-fn parse_backtrack_replay_frame() -> std.materialization_ladder.Frame {
-  std.materialization_ladder.Frame {
-    name: "parse-backtrack-replay",
-    kind: UnboundedSiblingsFrame
-  }
-}
-
-fn parse_table_memo_site_for(r: ParseMemoRecurrence) -> List<std.materialization_ladder.Frame> {
-  if parse_memo_recurrence_is_possible(r: r) {
-    [v2_compile_process_frame(), parse_backtrack_replay_frame()]
-  } else {
-    v2_compile_process_site()
-  }
-}
-
-fn parse_table_memo_demand_for(r: ParseMemoRecurrence) -> FrameDemand {
-  FrameDemand {
-    identity: parse_table_memo_demand_identity,
-    site: parse_table_memo_site_for(r: r),
-    nature: PureComputation
-  }
-}
-
-fn parse_table_memo_verdicts_for(r: ParseMemoRecurrence) -> List<LadderVerdict> {
-  materialization_ladder(
-    demands: [parse_table_memo_demand_for(r: r)],
-    providers: v2_compiler_cache_providers(),
-    cost_floor_exempt: no_cost_floor_exemptions
-  )
-}
-
-// ONCE PER GRAMMAR, ADMITTED AND THEN CARRIED. prepare_grammar asks this once, on the census the
-// grammar's own analysis derived, and a refused admission refuses the prepare; every ParseTable
-// built from that analysis carries the admitted value, so parse_table_lookup and parse_table_insert
-// read it and never re-run the ladder. It goes through admitted_prescription_in -- THE SAME DOOR
-// BODY the compile-stage demand uses -- so the green-only test and the preserved refusal are one
-// rule over two verdict lists, not a rule and a copy of it.
-//
-// WHICH ARMS THIS DOOR CAN REACH TODAY, stated deliberately rather than discovered: the ladder is
-// run here over exactly [parse_table_memo_demand_for(r)], so it always rules on this identity and
-// the Absent arm is unreachable from the parse path -- a refusal here would have to be a REFUSED
-// verdict, not a missing one. With the in-process provider both census outcomes are green:
-// recurrence Discharged (Memoize) and no recurrence AcceptedSingleRecompute (Recompute). So no
-// live parse behaviour moves; what changes is that an identity the ladder refuses now refuses the
-// prepare instead of quietly recomputing.
-fn parse_table_memo_materialization_for(r: ParseMemoRecurrence) -> Outcome<Materialization> {
-  admitted_prescription_in(
-    verdicts: parse_table_memo_verdicts_for(r: r),
-    identity: parse_table_memo_demand_identity,
-    port: ^parse_table_memo_demand_port
-  )
-}
-
-data parse_memo_no_recurrence: ParseMemoRecurrence = ParseMemoRecurrence {
-  discarding_backtrack_sites: 0,
-  nullable_nonterminals: 0
-}
-
-fn compile_stage_memo_demand() -> FrameDemand {
-  FrameDemand {
-    identity: compile_stage_memo_demand_identity,
-    site: v2_compile_process_site(),
-    nature: PureComputation
-  }
-}
-
-// The parse demand is not in this list: its site depends on the grammar, so it is ruled per
-// grammar by parse_table_memo_verdicts_for rather than once here for a grammar nobody named.
-fn v2_compiler_materialization_demands() -> List<FrameDemand> {
-  [compile_stage_memo_demand()]
-}
-
-fn parse_table_memo_provider() -> CacheProvider {
-  provider_from_catalog(
-    facts: parse_table_memo_facts,
-    scope: v2_compile_process_site(),
-    coverage: CoversAllComputations
-  )
-}
-
-fn compile_stage_memo_provider() -> CacheProvider {
-  provider_from_catalog(
-    facts: compile_stage_memo_facts,
-    scope: v2_compile_process_site(),
-    coverage: CoversAllComputations
-  )
-}
-
-fn v2_compiler_cache_providers() -> List<CacheProvider> {
-  [parse_table_memo_provider(), compile_stage_memo_provider()]
-}
-
-fn parse_table_memo_provider_id() -> CacheInterfaceId {
-  extdeps.realization.parse_table_memo.parse_table_memo_id
-}
-
-fn compile_stage_memo_provider_id() -> CacheInterfaceId {
-  extdeps.realization.compile_stage_memo.compile_stage_memo_id
-}
-
-fn parse_table_memo_artifact_kind() -> ArtifactKindId {
-  parse_table_artifact_kind
-}
-
-fn v2_compiler_materialization_verdicts() -> List<LadderVerdict> {
-  materialization_ladder(
-    demands: v2_compiler_materialization_demands(),
-    providers: v2_compiler_cache_providers(),
-    cost_floor_exempt: no_cost_floor_exemptions
-  )
-}
-
-fn v2_compiler_materialization_ladder_holds() -> Bool {
-  materialization_ladder_holds(
-    demands: v2_compiler_materialization_demands(),
-    providers: v2_compiler_cache_providers(),
-    cost_floor_exempt: no_cost_floor_exemptions
-  )
-}
-
-// DERIVED, NOT DECLARED. These two returned the literal Memoize while the ladder standing
-// beside them in this same module ruled on the same two identities, and nothing compared the
-// two answers -- one witness pinned the literal, another pinned the verdict, and both were
-// green while they disagreed. That is the fork this module exists to prevent (DESIGN section
-// 3), so the prescription is now read from the verdict for this demand's own identity.
-//
-// Absent -- no verdict for this identity -- is the fail-closed arm: a demand the ladder never
-// ruled on has no admission to consume, so the store is not permitted. It is deliberately NOT
-// the same answer as a ruled Recompute, which is why ladder_verdict_for hands back the VERDICT
-// and leaves the reading to this door instead of flattening it into a prescription.
-// A REFUSED VERDICT IS NOT AN ADMISSION, and this is the correction review 69770 asked for.
-// std.materialization_ladder.ladder_verdict_prescribes answers what materialization each verdict
-// IMPLIES, and for five of the six Refused arms it answers Memoize -- deliberately, because a
-// refusal is an UNMET OBLIGATION and the standing ruling is that it is not a licence to delete
-// the store. That table is right for what it is. What it is NOT is a door's admission, and this
-// module is what turned it into one: read as permission, "the obligation is unmet" became
-// "permission granted", which is DESIGN section 5's widen -- a failure arm must refuse.
-//
-// So admission is green-or-nothing. The obligation, the provider and the store all remain --
-// nothing here deletes them, and the refusal verdict stays enrolled and readable -- but an
-// unmet obligation does not open the door. Today the parse-table demand is Discharged, so no
-// live behaviour changes; what changes is that it is admitted BECAUSE it is green rather than
-// because every Refused arm happened to answer Memoize too.
-// A REFUSAL IS PRESERVED, NOT RE-ENCODED AS Recompute, and this is the correction the delta
-// review asked for. Green-or-nothing was first written as "green or Recompute", which prevented
-// a refused verdict from opening the store and then handed back a perfectly valid operational
-// materialization -- so the caller continued, unmemoized, with the obligation still unmet and
-// nothing anywhere saying so. DESIGN section 2 is explicit that a demand whose identity finds no
-// provider of sufficient scope, coverage, key and retention is refused WITH A TYPED CAUSE, and
-// section 5 is explicit that a failure arm refuses rather than widening. Recompute-as-fallback
-// widened: the answer was operationally fine and the deficit it stood on became unobservable,
-// which is exactly the absorbing fallback -- the signal that would have made the missing provider
-// rank for fixing is destroyed by the arm that papers over it. It was also inconsistent with this
-// package's own Share frontier, which rules that silently treating Share as recomputation is
-// wrong and that the door must refuse with a typed diagnostic; RefusedNoProvider is the stronger
-// case, since the ladder has already said the required realization is unavailable.
-// So the door answers Outcome<Materialization>: green admits its prescription, and every other
-// result -- refused, non-green, or an identity the ladder never ruled on -- is Rejected with a
-// located diagnostic. Absent is refused for the same reason and not a weaker one: a demand with
-// no ruling has no admission to consume, and the port symbol each named demand passes is what
-// keeps the two refusals distinguishable at their own sites.
-// ONE BODY, and the verdict list is a parameter so that a control can exercise THE DOOR rather
-// than a copy of it. Review 69791 caught the previous shape: refused_scope_prescription had this
-// body inlined with only the verdict source swapped, so deleting the green test HERE -- the
-// production door, which parse_table_memo_materialization_for and compile_stage_memo_materialization
-// consume -- left the control that exists to catch that deletion green. A control evaluating its
-// own copy of the property it guards cannot fail, which is the forged control DESIGN section
-// 4b(1) refuses: the discriminating RED has to run on the real acceptance path.
-// That parameter is also what makes this ONE ADMISSION RULE over whichever verdict list ruled the
-// identity: the compile-stage demand is ruled once in v2_compiler_materialization_verdicts, the
-// parse demand once per grammar in parse_table_memo_verdicts_for, and both doors are this body.
-fn materialization_obligation_unmet_diagnostic(port: Symbol) -> Diagnostic {
-  Diagnostic {
-    reason: ^materialization_obligation_unmet,
-    at: invariant_port_locus(port: port, invariant: ^materialization_obligation_unmet),
-    correction: Unavailable { reason: ExternalContractUnknown }
-  }
-}
-
-fn admitted_prescription_in(
-  verdicts: List<LadderVerdict>,
-  identity: String,
-  port: Symbol
-) -> Outcome<Materialization> {
-  match ladder_verdict_for(verdicts: verdicts, identity: identity) {
-    Absent =>
-      Rejected {
-        diagnostics: diagnostics_singleton(d: materialization_obligation_unmet_diagnostic(port: port))
-      }
-    Present { value: chosen } =>
-      if ladder_verdict_is_green(v: chosen) {
-        Accepted { value: ladder_verdict_prescribes(v: chosen), diagnostics: None }
-      } else {
-        Rejected {
-          diagnostics: diagnostics_singleton(d: materialization_obligation_unmet_diagnostic(port: port))
-        }
-      }
-  }
-}
-
-fn admitted_prescription(identity: String, port: Symbol) -> Outcome<Materialization> {
-  admitted_prescription_in(
-    verdicts: v2_compiler_materialization_verdicts(),
-    identity: identity,
-    port: port
-  )
-}
-
-fn compile_stage_memo_materialization() -> Outcome<Materialization> {
-  admitted_prescription(
-    identity: compile_stage_memo_demand_identity,
-    port: ^compile_stage_memo_demand_port
-  )
-}
-
-type CachedStageRealization {
-  provider_id: CacheInterfaceId
-  materialization: Materialization
-}
-
-// THE REALIZATION CARRIES AN ADMITTED MATERIALIZATION OR IT DOES NOT EXIST. Constructing a
-// CachedStageRealization out of a refused admission would put the refusal back inside a value
-// the stage spine consumes as though it had been admitted, so the refusal is answered here,
-// at the constructor, and compile_ingest_staging returns it as the stage outcome it already is.
-fn cached_stage_realization() -> Outcome<CachedStageRealization> {
-  match compile_stage_memo_materialization() {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: m, diagnostics: residue } =>
-      Accepted {
-        value: CachedStageRealization {
-          provider_id: compile_stage_memo_provider_id(),
-          materialization: m,
-        },
-        diagnostics: residue
-      }
-  }
-}
-
-fn cached_stage_governed<A, B>(
-  realization: CachedStageRealization,
-  lookup: fn(A) -> CacheProbe<B>,
-  stage: fn(A) -> Outcome<B>
-) -> fn(A) -> Outcome<B> {
-  fn(x) {
-    match materialization_allows_memo_store(m: realization.materialization) {
-      true => v2.std.staging.resolve_probe(probe: lookup(x), stage: stage, x: x)
-      false => stage(x)
-    }
-  }
-}
-
-fn realized_step_for(m: Materialization) -> RealizedStep<Nano> {
-  RealizedStep {
-    shape: ReadEffect,
-    placement: LocalInProcess,
-    materialization: m,
-    cost: cost_account_predicted_zero()
-  }
-}
-
-fn parse_table_realized_step(r: ParseMemoRecurrence) -> Outcome<RealizedStep<Nano>> {
-  match parse_table_memo_materialization_for(r: r) {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: m, diagnostics: residue } =>
-      Accepted { value: realized_step_for(m: m), diagnostics: residue }
-  }
-}
-
-fn compile_stage_realized_step() -> Outcome<RealizedStep<Nano>> {
-  match compile_stage_memo_materialization() {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: m, diagnostics: residue } =>
-      Accepted { value: realized_step_for(m: m), diagnostics: residue }
-  }
-}
-
-// ACCOUNTING CANNOT REFUSE, so the old projection_ok pair is gone rather than
-// rewritten: it asked whether classifying a cited row had failed, which is now
-// unaskable by type. What is still worth asserting is that the provider carries
-// the catalog's retention UNCHANGED — the property the pre-verdicting mapping
-// actually broke when it discarded placement retention and minted SpacePacked.
-fn parse_table_memo_retention_preserved() -> Bool {
-  parse_table_memo_provider().retention == parse_table_memo_facts.placement.retention
-}
-
-fn compile_stage_memo_retention_preserved() -> Bool {
-  compile_stage_memo_provider().retention == compile_stage_memo_facts.placement.retention
-}
-
-// The two arms the parse demand can reach from the grammar, each read off the verdict rather
-// than off the prescription, so a verdict that changed arm while keeping the same Materialization
-// (a refusal also prescribes Memoize) cannot pass for a discharge.
-fn parse_table_memo_verdict_is_discharged_for(r: ParseMemoRecurrence) -> Bool {
-  parse_table_memo_verdicts_for(r: r)
-    |> fold(init: false, f: (acc, v) =>
-      acc || verdict_is_discharged_by(
-        v: v,
-        identity: parse_table_memo_demand_identity,
-        provider_id: extdeps.realization.parse_table_memo.parse_table_memo_id
-      )
-    )
-}
-
-fn parse_table_memo_verdict_is_single_recompute_for(r: ParseMemoRecurrence) -> Bool {
-  parse_table_memo_verdicts_for(r: r)
-    |> fold(init: false, f: (acc, v) =>
-      acc || verdict_is_accepted_single_recompute(v: v, identity: parse_table_memo_demand_identity)
-    )
-}
-
-// A REFUSED ADMISSION IS A Rejected OUTCOME, and these controls now discriminate that rather
-// than the weaker property they used to. Asking only whether the store was permitted could not
-// tell a refusal apart from an admitted Recompute -- both answer false -- which is precisely how
-// the collapsed arm survived: the control that existed to catch it agreed with it.
-fn materialization_admission_is_refused(a: Outcome<Materialization>) -> Bool {
-  match a {
-    Rejected { diagnostics: _ } => true
-    Accepted { value: _, diagnostics: _ } => false
-  }
-}
-
-fn materialization_admission_admits_store(a: Outcome<Materialization>) -> Bool {
-  match a {
-    Rejected { diagnostics: _ } => false
-    Accepted { value: m, diagnostics: _ } => materialization_allows_memo_store(m: m)
-  }
-}
-
-// The discriminating RED for the fail-closed arm: an identity the ladder never ruled on has no
-// admitted decision, so the door must refuse rather than inherit the permissive answer.
-// Deleting the Absent arm of admitted_prescription_in makes this admit.
-data unruled_demand_identity: String = "identity-the-ladder-never-ruled-on"
-
-fn unruled_identity_prescription() -> Outcome<Materialization> {
-  admitted_prescription(
-    identity: unruled_demand_identity,
-    port: ^parse_table_memo_demand_port
-  )
-}
-
-// THE RED REVIEW 69770 ASKED FOR, now at the strength the delta review asked for: a REFUSED
-// identity must not be ADMITTED AT ALL. The plural parse-table demands refuse with
-// RefusedScopeTooNarrow against the very provider that discharges the single-site demand --
-// same identity, same provider, refused on scope rather than absence, which is exactly an arm
-// ladder_verdict_prescribes answers Memoize for. It runs through admitted_prescription_in, THE
-// DOOR'S OWN BODY, so dropping the green test there makes this admit and the control dies with
-// it; re-encoding the refusal as Recompute makes it admit too, which the old store-only form
-// could not see.
-fn refused_scope_prescription() -> Outcome<Materialization> {
-  admitted_prescription_in(
-    verdicts: parse_table_memo_plural_verdicts(providers: v2_compiler_cache_providers()),
-    identity: parse_table_memo_demand_identity,
-    port: ^parse_table_memo_demand_port
-  )
-}
-
-fn refused_scope_is_not_admitted() -> Bool {
-  materialization_admission_is_refused(a: refused_scope_prescription())
-}
-
-// The positive control that keeps the pair honest: the SAME fold over the SAME provider admits
-// the recurrent-grammar demand. Without this, refused_scope_is_not_admitted would also pass if
-// admitted_prescription_in simply never admitted anything.
-data parse_memo_one_discarding_site: ParseMemoRecurrence = ParseMemoRecurrence {
-  discarding_backtrack_sites: 1,
-  nullable_nonterminals: 0
-}
-
-fn discharged_scope_admits_store() -> Bool {
-  materialization_admission_admits_store(
-    a: parse_table_memo_materialization_for(r: parse_memo_one_discarding_site)
-  )
-}
-
-fn unruled_identity_is_not_admitted() -> Bool {
-  materialization_admission_is_refused(a: unruled_identity_prescription())
-}
-
-fn compile_stage_memo_verdict_is_single_recompute() -> Bool {
-  v2_compiler_materialization_verdicts()
-    |> fold(init: false, f: (acc, v) =>
-      acc || verdict_is_accepted_single_recompute(v: v, identity: compile_stage_memo_demand_identity)
-    )
-}
-
-fn parse_table_carrier_grounded_on_catalog() -> Bool {
-  (parse_table_memo_artifact_kind() == parse_table_artifact_kind)
-    && (parse_table_memo_provider_id() == extdeps.realization.parse_table_memo.parse_table_memo_id)
-}
-
-fn v2_compile_workflow_frame() -> std.materialization_ladder.Frame {
-  std.materialization_ladder.Frame { name: "v2-compile-workflow", kind: IsolatedChildrenFrame }
-}
-
-fn v2_compile_run_frame(name: String) -> std.materialization_ladder.Frame {
-  std.materialization_ladder.Frame { name: name, kind: SharedStateFrame }
-}
-
-fn parse_table_memo_plural_demands() -> List<FrameDemand> {
-  [
-    FrameDemand {
-      identity: parse_table_memo_demand_identity,
-      site: [
-        v2_compile_workflow_frame(),
-        v2_compile_run_frame(name: "compile-run-a"),
-        v2_compile_process_frame()
-      ],
-      nature: PureComputation
-    },
-    FrameDemand {
-      identity: parse_table_memo_demand_identity,
-      site: [
-        v2_compile_workflow_frame(),
-        v2_compile_run_frame(name: "compile-run-b"),
-        v2_compile_process_frame()
-      ],
-      nature: PureComputation
-    }
-  ]
-}
-
-fn parse_table_memo_plural_verdicts(providers: List<CacheProvider>) -> List<LadderVerdict> {
-  materialization_ladder(
-    demands: parse_table_memo_plural_demands(),
-    providers: providers,
-    cost_floor_exempt: no_cost_floor_exemptions
-  )
-}
-
-fn parse_table_memo_plural_holds_with_provider() -> Bool {
-  materialization_ladder_holds(
-    demands: parse_table_memo_plural_demands(),
-    providers: v2_compiler_cache_providers(),
-    cost_floor_exempt: no_cost_floor_exemptions
-  )
-}
-
-fn parse_table_memo_plural_holds_without_provider() -> Bool {
-  materialization_ladder_holds(
-    demands: parse_table_memo_plural_demands(),
-    providers: no_cache_providers,
-    cost_floor_exempt: no_cost_floor_exemptions
-  )
-}
-
-fn parse_table_memo_plural_refused_without_provider_count() -> Int {
-  parse_table_memo_plural_verdicts(providers: no_cache_providers)
-    |> fold(init: 0, f: (acc, v) =>
-      if verdict_is_refused_no_provider(v: v, identity: parse_table_memo_demand_identity) {
-        acc + 1
-      } else {
-        acc
-      }
-    )
-}
-
-fn parse_table_memo_plural_scope_too_narrow_count() -> Int {
-  parse_table_memo_plural_verdicts(providers: v2_compiler_cache_providers())
-    |> fold(init: 0, f: (acc, v) =>
-      if verdict_is_refused_scope_too_narrow(v: v, provider_id: extdeps.realization.parse_table_memo.parse_table_memo_id) {
-        acc + 1
-      } else {
-        acc
-      }
-    )
-}
diff --git a/src/v2/compiler/namespace_graft.dag b/src/v2/compiler/namespace_graft.dag
index 6a189e8b0c9..111e05205c5 100644
--- a/src/v2/compiler/namespace_graft.dag
+++ b/src/v2/compiler/namespace_graft.dag
@@ -193,7 +193,8 @@ fn namespace_graft_grammar_expr_nonterminal_productions(expr: GrammarExpr) -> Li
       expect: fn(xs, _reason) { xs },
       refuse_on_match: fn(xs, _reason) { xs },
       after_line_break: fn(xs) { xs },
-      not_predicate: fn(_xs) { [] }
+      not_predicate: fn(_xs) { [] },
+      infix_table: fn(operand, _guard, _operators) { operand }
     }
   )
 }
@@ -408,6 +409,14 @@ fn namespace_graft_disposition_from_named_opt(named: Edge?) -> NamespaceGraftUni
 // v2.test.claim.type_param_binder_frame and v2.test.claim.body_lowering.plain_type_decl_lowering held.
 // A type_decl shell that did arrive would fall to UnitResidual and be refused by normalize's retention
 // admission, never named from a shell.
+// AN `alias` DECLARATION DISSOLVES, AS AN IMPORT DOES. Its meaning is a binding row (binding name ->
+// target path), captured from the parse tree at normalize (v2.compiler.normalize
+// import_binding_capture) and bound by the symbol index fill at the declaring module's position,
+// so references resolve THROUGH it by unique-on-chain lookup (docs/plans/namespace-resolution-design.md
+// section 13). Grafting it as a member named by its binding made the name resolve to its own grafted
+// node instead of its target -- a silent wrong answer (gunbc.recurring_failure_mode
+// alias_declaration_binding_row_not_carried), refused as an interim by gunbc#13375 and carried by this arm; the discriminating control is v2.test.parse.alias_decl_parse
+// alias_decl_fill_lexical_lookup_holds.
 fn namespace_graft_unit_disposition(unit: Node, id: Symbol) -> NamespaceGraftUnitDisposition {
   match id == ^dag_surface_import_decl {
     true => UnitDissolved
@@ -422,7 +431,7 @@ fn namespace_graft_unit_disposition(unit: Node, id: Symbol) -> NamespaceGraftUni
                 true => namespace_graft_disposition_from_named_opt(named: namespace_graft_test_fn_named_edge(unit: unit))
                 false =>
                   match id == ^dag_surface_alias_decl {
-                    true => namespace_graft_disposition_from_named_opt(named: namespace_graft_kw_ident_named_edge(unit: unit))
+                    true => UnitDissolved
                     false => UnitResidual
                   }
               }
diff --git a/src/v2/compiler/normalized_tree.dag b/src/v2/compiler/normalized_tree.dag
index 0cea14bba87..7d310f27f05 100644
--- a/src/v2/compiler/normalized_tree.dag
+++ b/src/v2/compiler/normalized_tree.dag
@@ -1,6 +1,7 @@
 module v2.compiler.normalized_tree
 
 import v2.compiler.body_lowering_fold {
+  body_term_erase_tree,
   BodyLoweredTree,
   DeclaredTypeKind,
   DeclaredTypeModifiers,
@@ -26,6 +27,7 @@ import std.algebra { Cons, Empty, FreeMonoid, list_snoc_item }
 import v2.std.algebra { fold_list }
 import v2.std.node { Edge, Node, Symbol, content_hash }
 import v2.std.declaration_marker { TestMarkerChannel, test_marker_channel_empty }
+import v2.std.member_declaration_kind { DeclaredMember }
 import v2.std.namespace_alias { AliasBindingRow, ModuleBindingSource }
 
 // A NormalizedTree is the ADMITTED product of normalize: a root whose own lowering left no wrapper
@@ -59,8 +61,17 @@ type NormalizedTree sole_constructor {
   import_bindings: FreeMonoid<AliasBindingRow>,
   type_declaration_kinds: FreeMonoid<DeclaredTypeKind>,
   type_declaration_modifiers: FreeMonoid<DeclaredTypeModifiers>,
+  member_declarations: NormalizedMemberDeclarations,
 }
 
+// WHETHER THE TOP-LEVEL MEMBERS' AUTHORED KINDS WERE READ. normalize reads them from the parse
+// (member_declaration_capture); a hand-built root has no parse, and an empty list would say "this module
+// declares no members" about a module nothing was read for. So the unread arm is a value, never an empty
+// list (v2.std.member_declaration_kind MemberKindChannel carries the same distinction forward).
+type NormalizedMemberDeclarations
+  = MemberDeclarationsNotRead
+  | MemberDeclarationsRead { members: FreeMonoid<DeclaredMember> }
+
 // THE RETENTION DOOR (MQ-4). A shell the body lowering could not lower is a typed variant of its result
 // (v2.compiler.body_lowering_fold WrapperRetention), gathered by v2.compiler.normalize into the
 // BodyLoweredTree it hands here. This is where that list is CONSUMED: an empty list releases the
@@ -88,7 +99,7 @@ type NormalizedTree sole_constructor {
 // BodyWrapperRetained and drops it -- never through a silent `diagnostics: _`.
 fn admit_retention_free(tree: BodyLoweredTree, diagnostics: Diagnostics) -> Outcome<Node> {
   match tree.retained {
-    Empty => Accepted { value: tree.node, diagnostics: diagnostics }
+    Empty => Accepted { value: body_term_erase_tree(n: tree.node), diagnostics: diagnostics }
     Cons { head: first, tail: _ } =>
       Rejected {
         diagnostics: rejected_with_pending(
@@ -207,13 +218,27 @@ fn admit_normalized_tree(
           test_markers: test_markers,
           import_bindings: import_bindings,
           type_declaration_kinds: type_declaration_kinds,
-          type_declaration_modifiers: type_declaration_modifiers
+          type_declaration_modifiers: type_declaration_modifiers,
+          member_declarations: MemberDeclarationsNotRead
         },
         diagnostics: diagnostics
       }
   }
 }
 
+// The one place a read member roster joins a tree, so admit_normalized_tree keeps its signature for the
+// hand-built callers that hold no parse.
+fn normalized_tree_with_member_declarations(tree: NormalizedTree, members: FreeMonoid<DeclaredMember>) -> NormalizedTree {
+  NormalizedTree {
+    root: tree.root,
+    test_markers: tree.test_markers,
+    import_bindings: tree.import_bindings,
+    type_declaration_kinds: tree.type_declaration_kinds,
+    type_declaration_modifiers: tree.type_declaration_modifiers,
+    member_declarations: MemberDeclarationsRead { members: members }
+  }
+}
+
 fn normalized_tree_record_declarations(t: NormalizedTree) -> FreeMonoid<Symbol> {
   declared_record_names(kinds: t.type_declaration_kinds)
 }
@@ -356,7 +381,8 @@ fn admit_unmarked_normalized_roots(
             test_markers: test_marker_channel_empty(),
             import_bindings: no_import_bindings(),
             type_declaration_kinds: no_type_declaration_kinds(),
-            type_declaration_modifiers: no_type_declaration_modifiers()
+            type_declaration_modifiers: no_type_declaration_modifiers(),
+            member_declarations: MemberDeclarationsNotRead
           }
         )
       }
diff --git a/src/v2/compiler/occurrence_role.dag b/src/v2/compiler/occurrence_role.dag
index 2e6b189dcc9..76bf86eae67 100644
--- a/src/v2/compiler/occurrence_role.dag
+++ b/src/v2/compiler/occurrence_role.dag
@@ -293,7 +293,8 @@ fn production_holds_name_terminal(expr: GrammarExpr) -> Bool {
     expect: fn(a, _reason) { a },
     refuse_on_match: fn(a, _reason) { a },
     after_line_break: fn(a) { a },
-    not_predicate: fn(_a) { false }
+    not_predicate: fn(_a) { false },
+    infix_table: fn(a, _guard, _operators) { a }
   })
 }
 
diff --git a/src/v2/compiler/parse_acceptance_census.dag b/src/v2/compiler/parse_acceptance_census.dag
index 381815c019f..923baf9c9eb 100644
--- a/src/v2/compiler/parse_acceptance_census.dag
+++ b/src/v2/compiler/parse_acceptance_census.dag
@@ -19,7 +19,7 @@ import v2.std.diagnostic {
   WholeFile,
   diagnostics_fatal
 }
-import v2.std.integer { integer_int_to_decimal_string }
+import std.integer { int_to_decimal_string }
 import v2.std.node { symbol_intern_lexeme, symbol_lexeme }
 import v2.std.text { String }
 
@@ -52,11 +52,11 @@ fn parse_acceptance_census_line(path: String) -> String {
 fn parse_acceptance_of_text(text: String, path: String) -> String {
   match dag_prepared_grammar() {
     Rejected { diagnostics: _ } => "grammar-unprepared"
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       match tokenize(text: text, file: symbol_intern_lexeme(lexeme: path), rules: dag_lex()) {
         Rejected { diagnostics: d } => "refused " + parse_acceptance_fatal_text(d: d)
         Accepted { value: stream, diagnostics: _ } =>
-          match parse_module_prepared(tokens: stream, prepared: prepared, validation_residue: residue) {
+          match parse_module_prepared(tokens: stream, prepared: prepared) {
             Accepted { value: _, diagnostics: _ } => "accepted"
             Rejected { diagnostics: d } => "refused " + parse_acceptance_fatal_text(d: d)
           }
@@ -81,7 +81,7 @@ fn parse_acceptance_locus_text(at: Locus) -> String {
 
 fn parse_acceptance_extent_text(extent: v2.std.diagnostic.Extent) -> String {
   match extent {
-    ByteRange { start: s, end: e } => integer_int_to_decimal_string(value: s) + ".." + integer_int_to_decimal_string(value: e)
+    ByteRange { start: s, end: e } => int_to_decimal_string(value: s) + ".." + int_to_decimal_string(value: e)
     WholeFile => "whole-file"
   }
 }
diff --git a/src/v2/compiler/parse_diagnostic.dag b/src/v2/compiler/parse_diagnostic.dag
deleted file mode 100644
index da5e52d6d99..00000000000
--- a/src/v2/compiler/parse_diagnostic.dag
+++ /dev/null
@@ -1,172 +0,0 @@
-module v2.compiler.parse_diagnostic
-
-import std.types { List }
-import std.algebra { Cons, Empty, FreeMonoid, list_snoc_item }
-import v2.std.algebra {
-  Cons,
-  Empty,
-  HeadAbsent,
-  HeadFound,
-  TailAbsent,
-  TailFound,
-  fold_list,
-  list_head,
-  list_tail
-}
-import v2.std.diagnostic {
-  Diagnostic,
-  ExternalContractUnknown,
-  Locus,
-  NonEmptyDiagnostics,
-  Unavailable,
-  invariant_port_locus,
-  port_refusal_locus
-}
-import v2.std.grammar_choice_ambiguity {
-  GrammarChoiceAmbiguityRow,
-  NonEmptyGrammarChoiceAmbiguityRows
-}
-import std.optional { Optional, Present, optional_absent, optional_present, Absent }
-
-// ParseDiagnosticEvidence is parse-stage evidence orthogonal to the universal Diagnostic carrier. Grammar-choice overlap rows live here — never on Correction, Locus, or Diagnostic itself.
-type ParseDiagnosticEvidence
-  = NoParseDiagnosticEvidence
-  | GrammarChoiceAmbiguityEvidence { row: GrammarChoiceAmbiguityRow }
-
-type ParseStageDiagnostic {
-  diagnostic: Diagnostic
-  evidence: ParseDiagnosticEvidence
-}
-
-type NonEmptyParseStageDiagnostics {
-  head: ParseStageDiagnostic
-  tail: FreeMonoid<ParseStageDiagnostic>
-}
-
-fn parse_overlap_residue_stage_diagnostic_at(
-  at: Locus,
-  row: GrammarChoiceAmbiguityRow
-) -> ParseStageDiagnostic {
-  ParseStageDiagnostic {
-    diagnostic: Diagnostic {
-      reason: ^parse_grammar_choice_overlap_residue,
-      at: port_refusal_locus(
-        at: at,
-        port: ^parse_stage_locus_port,
-        invariant: ^parse_grammar_choice_overlap_residue
-      ),
-      correction: Unavailable { reason: ExternalContractUnknown }
-    },
-    evidence: GrammarChoiceAmbiguityEvidence { row: row }
-  }
-}
-
-fn parse_overlap_residue_stage_diagnostic(row: GrammarChoiceAmbiguityRow) -> ParseStageDiagnostic {
-  parse_overlap_residue_stage_diagnostic_at(
-    at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^parse_grammar_choice_overlap_residue),
-    row: row
-  )
-}
-
-fn non_empty_parse_stage_diagnostics_from_overlap_roster(
-  at: Locus,
-  roster: List<GrammarChoiceAmbiguityRow>
-) -> Optional<NonEmptyParseStageDiagnostics> {
-  match roster {
-    Empty => optional_absent()
-    Cons { head: first, tail: rest } =>
-      optional_present(
-        value: NonEmptyParseStageDiagnostics {
-          head: parse_overlap_residue_stage_diagnostic_at(at: at, row: first),
-          tail: fold_list(
-            xs: rest,
-            empty: Empty,
-            cons: fn(acc, row) {
-              list_snoc_item(
-                xs: acc,
-                item: parse_overlap_residue_stage_diagnostic_at(at: at, row: row)
-              )
-            }
-          )
-        }
-      )
-  }
-}
-
-fn parse_stage_diagnostic_from_diagnostic_only(d: Diagnostic) -> ParseStageDiagnostic {
-  ParseStageDiagnostic {
-    diagnostic: d,
-    evidence: NoParseDiagnosticEvidence
-  }
-}
-
-fn parse_stage_diagnostic_core(d: ParseStageDiagnostic) -> Diagnostic {
-  d.diagnostic
-}
-
-fn parse_stage_evidence_row_optional(d: ParseStageDiagnostic) -> Optional<GrammarChoiceAmbiguityRow> {
-  match d.evidence {
-    GrammarChoiceAmbiguityEvidence { row: row } => optional_present(value: row)
-    NoParseDiagnosticEvidence => optional_absent()
-  }
-}
-
-fn non_empty_diagnostics_from_parse_stage(d: NonEmptyParseStageDiagnostics) -> NonEmptyDiagnostics {
-  NonEmptyDiagnostics {
-    head: parse_stage_diagnostic_core(d: d.head),
-    tail: fold_list(
-      xs: d.tail,
-      empty: Empty,
-      cons: fn(acc, item) {
-        list_snoc_item(xs: acc, item: parse_stage_diagnostic_core(d: item))
-      }
-    )
-  }
-}
-
-fn grammar_choice_ambiguity_rows_append_parse_stage(
-  acc: FreeMonoid<GrammarChoiceAmbiguityRow>,
-  d: ParseStageDiagnostic
-) -> FreeMonoid<GrammarChoiceAmbiguityRow> {
-  match parse_stage_evidence_row_optional(d: d) {
-    Present { value: row } => list_snoc_item(xs: acc, item: row)
-    Absent => acc
-  }
-}
-
-fn grammar_choice_ambiguity_rows_from_non_empty_parse_stage(
-  d: NonEmptyParseStageDiagnostics
-) -> FreeMonoid<GrammarChoiceAmbiguityRow> {
-  let head_rows = grammar_choice_ambiguity_rows_append_parse_stage(acc: Empty, d: d.head)
-  fold_list(
-    xs: d.tail,
-    empty: head_rows,
-    cons: fn(acc, item) {
-      grammar_choice_ambiguity_rows_append_parse_stage(acc: acc, d: item)
-    }
-  )
-}
-
-fn non_empty_grammar_choice_ambiguity_rows_from_parse_stage(
-  d: NonEmptyParseStageDiagnostics
-) -> Optional<NonEmptyGrammarChoiceAmbiguityRows> {
-  let rows = grammar_choice_ambiguity_rows_from_non_empty_parse_stage(d: d)
-  match list_head(xs: rows) {
-    HeadFound { value: head } =>
-      optional_present(
-        value: NonEmptyGrammarChoiceAmbiguityRows {
-          head: head,
-          tail: list_tail_or_empty_rows(xs: rows)
-        }
-      )
-    HeadAbsent => optional_absent()
-  }
-}
-
-fn list_tail_or_empty_rows(xs: FreeMonoid<GrammarChoiceAmbiguityRow>) -> FreeMonoid<GrammarChoiceAmbiguityRow> {
-  match list_tail(xs: xs) {
-    TailAbsent => Empty
-    TailFound { tail: rest } => rest
-  }
-}
-
diff --git a/src/v2/compiler/primitive_authority.dag b/src/v2/compiler/primitive_authority.dag
new file mode 100644
index 00000000000..af25651920d
--- /dev/null
+++ b/src/v2/compiler/primitive_authority.dag
@@ -0,0 +1,69 @@
+module v2.compiler.primitive_authority
+
+import std.optional { Absent, Optional, Present, optional_absent, optional_present }
+import v2.std.node { Node, Symbol, symbol_lexeme }
+import v2.std.data_initializer_identity { projection_named_child_optional }
+import v2.extdeps.languages.dag { dag_string_literal_value_optional }
+import v2.std.qualified_name { QualifiedName, qualified_name_from_dotted_string, qualified_name_snoc, qualified_name_to_dotted_string }
+import v2.std.node_query { node_positional_child_targets }
+import v2.std.grammar { node_atom_identity_optional }
+
+// WHERE A KERNEL PRIMITIVE IS DECLARED. A std.primitives PrimitiveContract row carries `name: "<primitive>"`, and THAT
+// field is the primitive's identity. The row is FOUND by the declaration path std.primitives.<name>_contract (the
+// authority's declaration naming), then JOINED on its own name field: a call head binds only to a row whose declared name
+// equals the head (primitive_authority_row_names_head). A row whose declaration name and name field disagree is refused
+// by v2.compiler.resolve with resolve_reason_primitive_row_name_disagrees, never bound by the spelling alone.
+// v2.compiler.infer refuses a call head whose declaration carries the admission mark: the primitive's TYPE SIGNATURE
+// has no .dag authority yet (it lives in the seed's builtin_function_registry) and an untyped acceptance would be
+// silent wrongness.
+fn primitive_authority_path(head: Symbol) -> QualifiedName {
+  qualified_name_from_dotted_string(dotted: concat("std.primitives.", symbol_lexeme(sym: head), "_contract"))
+}
+
+// The contract row's OWN `name` field. The lowered row is a nullary arrow whose body edge is the initializer record;
+// that record's own `name` field is read from it, with no deeper search. A nested record carrying a `name` (a decoy
+// under another field) is never reached; a missing, non-literal or unreadable own name is Absent.
+fn primitive_authority_row_name_optional(row: Node) -> Optional<String> {
+  match projection_named_child_optional(node: row, label: "arrow_body_edge") {
+    Absent => optional_absent()
+    Present { value: initializer } =>
+      match projection_named_child_optional(node: initializer, label: "name") {
+        Absent => optional_absent()
+        Present { value: v } => dag_string_literal_value_optional(node: v)
+      }
+  }
+}
+
+// THE ADMISSION OF A PRIMITIVE CONTRACT ROW, decided ONCE by v2.compiler.symbol_index_fill (the arm that knows the
+// declaring module and the row) and recorded as v2.std.symbol_index symbol_index_declares_primitive_contract_at; resolve and
+// infer read that mark and never recompute it. A declaration is admitted when its declared type -- the row's codomain atom,
+// joined to the DECLARING MODULE's path -- is exactly std.primitives.PrimitiveContract. The path spelling of the row itself
+// admits nothing: an ordinary declaration at std.primitives.helper_contract declares some other type and stays ordinary.
+fn primitive_contract_type_path() -> QualifiedName {
+  qualified_name_from_dotted_string(dotted: "std.primitives.PrimitiveContract")
+}
+
+fn primitive_authority_row_declared_type_path_optional(module_qn: QualifiedName, row: Node) -> Optional<QualifiedName> {
+  match fold(node_positional_child_targets(node: row), init: optional_absent(), f: fn(acc, t) { optional_present(value: t) }) {
+    Absent => optional_absent()
+    Present { value: codomain } =>
+      match node_atom_identity_optional(node: codomain) {
+        Absent => optional_absent()
+        Present { value: sym } => optional_present(value: qualified_name_snoc(qn: module_qn, segment: sym))
+      }
+  }
+}
+
+fn primitive_authority_row_is_contract_declaration(module_qn: QualifiedName, row: Node) -> Bool {
+  match primitive_authority_row_declared_type_path_optional(module_qn: module_qn, row: row) {
+    Absent => false
+    Present { value: declared } => qualified_name_to_dotted_string(qn: declared) == qualified_name_to_dotted_string(qn: primitive_contract_type_path())
+  }
+}
+
+fn primitive_authority_row_names_head(row: Node, head: Symbol) -> Bool {
+  match primitive_authority_row_name_optional(row: row) {
+    Present { value: declared } => declared == symbol_lexeme(sym: head)
+    Absent => false
+  }
+}
diff --git a/src/v2/compiler/program_assembly.dag b/src/v2/compiler/program_assembly.dag
index f0e276f9805..1be835fe10f 100644
--- a/src/v2/compiler/program_assembly.dag
+++ b/src/v2/compiler/program_assembly.dag
@@ -19,11 +19,7 @@ import v2.compiler.tokenize { PreparedLexRules, prepare_lex_rules, tokenize, tok
 import v2.compiler.parse {
   ParseArtifact,
   parse_module_prepared_seeded,
-  parse_module_prepared_measured_seeded,
-  ParseProductionMeasured,
   PreparedGrammar,
-  parse_memo_stats_empty,
-  parse_module_prepared_measured,
   prepare_grammar
 }
 import v2.std.compilers.lexing { TokenStream, token_stream_remaining_count }
@@ -189,7 +185,7 @@ fn program_assembly_phase_tokenize(
   }
 }
 
-// THE SEEDED MEASURED PHASE, AND THE MARK READ BACK OUT AS A SCALAR. These two exist for the
+// THE SEEDED PARSE PHASE, AND THE MARK READ BACK OUT AS A SCALAR. These two exist for the
 // emitted `SourceRootEvalDriver`, which does not call the composed per-file fold: it open-codes the
 // sequence so a clock can sit between the phases, which is admitted debt filed at
 // `gunbc.recurring_failure_mode` `realization_respells_a_modeled_folds_sequencing_to_instrument_it`.
@@ -198,9 +194,8 @@ fn program_assembly_phase_tokenize(
 // driver silently keeps the per-file reset while the modeled fold no longer has it.
 //
 // THE REJECTED-INPUT ARM REPRODUCES bind_outcome EXACTLY, and is spelled out rather than reused
-// because bind_outcome cannot carry a second value out of the bound function: a Rejected token
-// stream passes its diagnostics through untouched and reports empty accounting, because no parse
-// ran -- an answer, not a missing measurement. The Accepted arm merges the incoming diagnostics
+// as the phase body the driver times: a Rejected token stream passes its diagnostics through
+// untouched, because no parse ran. The Accepted arm merges the incoming diagnostics
 // through bind_outcome_accepted, which is what bind_outcome itself calls. (That reasoning arrived
 // here with the unseeded twin this phase replaced; the twin is deleted, so the reasoning moves to
 // the survivor rather than being deleted with it.)
@@ -218,69 +213,43 @@ fn program_assembly_phase_tokenize(
 // exactly while nothing retains a refused parse's node loci; the precondition and the carrier that
 // would break it are named on `v2.compiler.compile` `native_test_context_absorb`, which is where
 // the reuse actually happens.
-fn program_assembly_phase_parse_measured_seeded(
+fn program_assembly_phase_parse_seeded(
   tokens: Outcome<TokenStream>,
   prepared: PreparedGrammar,
-  residue: Diagnostics,
   seed: OccurrenceIdAllocator
-) -> ParseProductionMeasured {
+) -> Outcome<ParseArtifact> {
   match tokens {
-    Rejected { diagnostics: d } =>
-      ParseProductionMeasured {
-        outcome: Rejected { diagnostics: d },
-        memo: parse_memo_stats_empty()
-      }
+    Rejected { diagnostics: d } => Rejected { diagnostics: d }
     Accepted { value: token_stream, diagnostics: od } =>
-      let measured = parse_module_prepared_measured_seeded(
-        tokens: token_stream,
-        prepared: prepared,
-        validation_residue: residue,
-        seed: seed
+      bind_outcome_accepted(
+        od: od,
+        inner: parse_module_prepared_seeded(
+          tokens: token_stream,
+          prepared: prepared,
+          seed: seed
+        )
       )
-      ParseProductionMeasured {
-        outcome: bind_outcome_accepted(od: od, inner: measured.outcome),
-        memo: measured.memo
-      }
   }
 }
 
-// THE MARK AS A SCALAR, for the same reason the three memo counters above are read out one at a
-// time: the driver prints scalars, and a record does not cross that boundary as one. This is what
-// makes the emitted loop's threading OBSERVABLE from outside the binary -- the per-file line carries
-// the mark it was handed and the mark it reached, so a run over several files shows one sequence
-// continuing rather than a claim that it does.
+// THE MARK AS A SCALAR: the driver prints scalars, and a record does not cross that boundary as
+// one. This is what makes the emitted loop's threading OBSERVABLE from outside the binary -- the
+// per-file line carries the mark it was handed and the mark it reached, so a run over several
+// files shows one sequence continuing rather than a claim that it does.
 fn program_assembly_allocator_next(alloc: OccurrenceIdAllocator) -> Int {
   alloc.next_id
 }
 
-fn program_assembly_measured_alloc(
-  measured: ParseProductionMeasured,
+fn program_assembly_parsed_alloc(
+  parsed: Outcome<ParseArtifact>,
   seed: OccurrenceIdAllocator
 ) -> OccurrenceIdAllocator {
-  match measured.outcome {
+  match parsed {
     Rejected { diagnostics: _ } => seed
     Accepted { value: artifact, diagnostics: _ } => artifact.alloc
   }
 }
 
-// The three counters, read out one at a time because the driver prints scalars and a record does
-// not cross that boundary as one.
-fn program_assembly_memo_hits(measured: ParseProductionMeasured) -> Int {
-  measured.memo.hits
-}
-
-fn program_assembly_memo_misses(measured: ParseProductionMeasured) -> Int {
-  measured.memo.misses
-}
-
-fn program_assembly_memo_lookup_calls(measured: ParseProductionMeasured) -> Int {
-  measured.memo.lookup_calls
-}
-
-fn program_assembly_measured_outcome(measured: ParseProductionMeasured) -> Outcome<ParseArtifact> {
-  measured.outcome
-}
-
 // THE NORMALIZE PHASE ADVANCES THE INGEST'S ALLOCATOR, and returns it beside the outcome so a loop
 // over the ingest seeds the next file's parse from it: lowering allocates every image member an id
 // (v2.compiler.normalize normalize_scoped), and the next file's authored ids must start above those.
@@ -380,7 +349,6 @@ fn program_assembly_read_to_normalized_root_seeded(
   read: DagSourceReadWitness,
   lex: PreparedLexRules,
   prepared: PreparedGrammar,
-  residue: Diagnostics,
   seed: OccurrenceIdAllocator,
   scope: Fnv1a64Structural
 ) -> ProgramAssemblySeededReadResult {
@@ -390,7 +358,6 @@ fn program_assembly_read_to_normalized_root_seeded(
       parse_module_prepared_seeded(
         tokens: token_stream,
         prepared: prepared,
-        validation_residue: residue,
         seed: seed
       )
     }
@@ -485,7 +452,6 @@ fn program_assembly_fold_step(
   read: DagSourceReadWitness,
   lex: PreparedLexRules,
   prepared: PreparedGrammar,
-  residue: Diagnostics,
   scope: Fnv1a64Structural
 ) -> ProgramAssemblyLocatedFoldState {
   match state {
@@ -496,7 +462,6 @@ fn program_assembly_fold_step(
         read: read,
         lex: lex,
         prepared: prepared,
-        residue: residue,
         seed: seed,
         scope: scope
       )
@@ -574,7 +539,7 @@ fn program_assembly_ingest_scope(ingest: SourceRootIngest) -> SourceRefListDiges
   source_ref_list_digest_build(refs: fold_list(
     xs: ingest,
     empty: Empty,
-    cons: fn(acc, read) { list_snoc_item(xs: acc, item: source_ref_for_storage_path(path: read.artifact.file_path)) }
+    cons: fn(acc, read) { list_snoc_item(xs: acc, item: source_ref_for_storage_path(path: read.artifact.file_path, source_root: read.source_root)) }
   ))
 }
 
@@ -595,7 +560,7 @@ fn program_assembly_fold_ingest_located(
       match prepare_grammar(grammar: lm.grammar) {
         Rejected { diagnostics: d } =>
           ProgramAssemblyLocatedFoldFailed { diagnostics: d, spans: span_index_empty() }
-        Accepted { value: prepared, diagnostics: residue } =>
+        Accepted { value: prepared, diagnostics: _ } =>
           let lex = prepare_lex_rules(rules: lm.lex)
           match program_assembly_ingest_scope(ingest: ingest) {
             SourceRefListDigestNonStructuralRefused { path: _ } =>
@@ -614,7 +579,7 @@ fn program_assembly_fold_ingest_located(
                   advisories: None
                 },
                 cons: fn(state, read) {
-                  program_assembly_fold_step(state: state, read: read, lex: lex, prepared: prepared, residue: residue, scope: scope)
+                  program_assembly_fold_step(state: state, read: read, lex: lex, prepared: prepared, scope: scope)
                 }
               )
           }
@@ -698,8 +663,7 @@ fn assemble_program_from_module_roots(
 // its file exactly when the program did NOT assemble, and `Outcome`'s Rejected arm carries no value
 // -- so an index returned as part of the accepted program is an index that has evaporated precisely
 // where it was wanted. This carrier holds both arms' worth: the span index the fold recorded before
-// it stopped, and the outcome itself. It is the same stance `ParseProductionMeasured` already takes
-// for memo counters one layer down, for the same reason.
+// it stopped, and the outcome itself.
 //
 // A REFUSED ASSEMBLY STILL CARRIES THE SPANS OF EVERY FILE IT GOT THROUGH, which is the honest
 // answer rather than a convenient one: the fold is fail-closed and stops at the first refusing read,
diff --git a/src/v2/compiler/reference_conservation.dag b/src/v2/compiler/reference_conservation.dag
index 729c6f0708b..95b19b8e776 100644
--- a/src/v2/compiler/reference_conservation.dag
+++ b/src/v2/compiler/reference_conservation.dag
@@ -5,7 +5,7 @@ import std.types { List }
 import v2.compiler.parse { ParseArtifact, PreparedGrammar }
 import v2.compiler.normalized_tree { NormalizedTree }
 import v2.compiler.program_assembly {
-  program_assembly_phase_parse_measured_seeded,
+  program_assembly_phase_parse_seeded,
   program_assembly_phase_tokenize
 }
 import v2.compiler.source_authority { DagSourceReadWitness, SourceRootIngest }
@@ -47,7 +47,8 @@ import std.optional { Absent, Optional, Present, optional_absent, optional_prese
 import v2.std.lens_verdict { lens_verdict_diagnostic_located_text_in_spans }
 import v2.std.provenance { SpanIndex, span_index_empty, span_index_resolve_textual_locus }
 import v2.std.text { String }
-import v2.std.integer { Int, integer_int_to_decimal_string }
+import v2.std.integer { Int }
+import std.integer { int_to_decimal_string }
 import v2.std.witness { Holds, Violates }
 import std.algebra { Cons, Empty, FreeMonoid, list_snoc_item }
 import std.occurrence_identity {
@@ -1125,15 +1126,13 @@ type ReferenceConservationSubject {
 fn reference_conservation_subject_of_read(
   read: DagSourceReadWitness,
   lex: PreparedLexRules,
-  prepared: PreparedGrammar,
-  residue: Diagnostics
+  prepared: PreparedGrammar
 ) -> ReferenceConservationSubject {
-  let parsed = program_assembly_phase_parse_measured_seeded(
+  let parsed = program_assembly_phase_parse_seeded(
     tokens: program_assembly_phase_tokenize(read: read, lex: lex),
     prepared: prepared,
-    residue: residue,
     seed: occurrence_id_allocator_initial()
-  ).outcome
+  )
   ReferenceConservationSubject {
     path: read.artifact.file_path,
     parsed: parsed,
@@ -1253,11 +1252,10 @@ fn reference_conservation_of_read(
   read: DagSourceReadWitness,
   lm: LanguageModel,
   lex: PreparedLexRules,
-  prepared: PreparedGrammar,
-  residue: Diagnostics
+  prepared: PreparedGrammar
 ) -> ReferenceConservationReport {
   reference_conservation_of_subject(
-    subject: reference_conservation_subject_of_read(read: read, lex: lex, prepared: prepared, residue: residue),
+    subject: reference_conservation_subject_of_read(read: read, lex: lex, prepared: prepared),
     token_classes: declared_token_classes(lm: lm)
   )
 }
@@ -1265,8 +1263,7 @@ fn reference_conservation_of_read(
 fn reference_conservation_of_ingest(
   ingest: SourceRootIngest,
   lm: LanguageModel,
-  prepared: PreparedGrammar,
-  residue: Diagnostics
+  prepared: PreparedGrammar
 ) -> FreeMonoid<ReferenceConservationReport> {
   let lex = prepare_lex_rules(rules: lm.lex)
   fold_list(
@@ -1275,7 +1272,7 @@ fn reference_conservation_of_ingest(
     cons: fn(acc, read) {
       list_snoc_item(
         xs: acc,
-        item: reference_conservation_of_read(read: read, lm: lm, lex: lex, prepared: prepared, residue: residue)
+        item: reference_conservation_of_read(read: read, lm: lm, lex: lex, prepared: prepared)
       )
     }
   )
@@ -1301,7 +1298,7 @@ fn authored_atom_extent_text(atom: AuthoredAtom) -> String {
     Textual { file: _, extent: extent } =>
       match extent {
         ByteRange { start: s, end: e } =>
-          integer_int_to_decimal_string(value: s) + "-" + integer_int_to_decimal_string(value: e)
+          int_to_decimal_string(value: s) + "-" + int_to_decimal_string(value: e)
         WholeFile => "whole-file"
       }
     NodeLocus { anchor: _ } => "unlocated"
@@ -1352,7 +1349,7 @@ fn reference_conservation_refusal_text(report: ReferenceConservationReport) -> S
 // the accepted subject carried, in chain order: the census's per-path record of what an accepted
 // module's front end attached without refusing.
 fn reference_conservation_report_lines(report: ReferenceConservationReport) -> FreeMonoid<String> {
-  let summary = "module " + report.path + " authored=" + integer_int_to_decimal_string(value: report.authored) + " conserved=" + integer_int_to_decimal_string(value: report.conserved) + " locus_erased=" + integer_int_to_decimal_string(value: report.locus_erased) + " role_excluded=" + integer_int_to_decimal_string(value: report.role_excluded) + " header_channel=" + integer_int_to_decimal_string(value: report.header_channel) + " role_not_yet_read=" + integer_int_to_decimal_string(value: report.role_not_yet_read) + " role_reader_refused=" + integer_int_to_decimal_string(value: report.role_reader_refused) + " refused=" + integer_int_to_decimal_string(value: report.refused) + " import_channel=" + integer_int_to_decimal_string(value: report.import_channel) + " dropped=" + integer_int_to_decimal_string(value: length(xs: report.dropped)) + " unmeasured=" + integer_int_to_decimal_string(value: length(xs: report.unmeasured)) + " refusal=" + reference_conservation_refusal_text(report: report)
+  let summary = "module " + report.path + " authored=" + int_to_decimal_string(value: report.authored) + " conserved=" + int_to_decimal_string(value: report.conserved) + " locus_erased=" + int_to_decimal_string(value: report.locus_erased) + " role_excluded=" + int_to_decimal_string(value: report.role_excluded) + " header_channel=" + int_to_decimal_string(value: report.header_channel) + " role_not_yet_read=" + int_to_decimal_string(value: report.role_not_yet_read) + " role_reader_refused=" + int_to_decimal_string(value: report.role_reader_refused) + " refused=" + int_to_decimal_string(value: report.refused) + " import_channel=" + int_to_decimal_string(value: report.import_channel) + " dropped=" + int_to_decimal_string(value: length(xs: report.dropped)) + " unmeasured=" + int_to_decimal_string(value: length(xs: report.unmeasured)) + " refusal=" + reference_conservation_refusal_text(report: report)
   let with_dropped = fold_list(
     xs: report.dropped,
     empty: Cons { head: summary, tail: Empty },
diff --git a/src/v2/compiler/reference_conservation_admission.dag b/src/v2/compiler/reference_conservation_admission.dag
index cd1ddf8acd8..bf4ba337c72 100644
--- a/src/v2/compiler/reference_conservation_admission.dag
+++ b/src/v2/compiler/reference_conservation_admission.dag
@@ -130,20 +130,13 @@ fn conservation_read_of(path: String, text: String) -> DagSourceReadWitness {
   }
 }
 
-// THE GRAMMAR'S VALIDATION RESIDUE IS NOT CARRIED INTO A FIXTURE'S OUTCOME. It is a fact about the
-// prepared grammar, reported where the grammar is prepared (dag_prepared_grammar's own Accepted
-// diagnostics), and threaded into a module's parse it stands at the HEAD of every refusal, so a
-// fixture asserting its refusal's cause would read the grammar's residue instead of its own. The
-// parse is the same prepared parse either way; only that one module-independent diagnostic is not
-// attached.
 fn conservation_subject_of_text(path: String, text: String) -> ReferenceConservationSubject {
   match dag_prepared_grammar() {
-    Accepted { value: prepared, diagnostics: _grammar_residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       reference_conservation_subject_of_read(
         read: conservation_read_of(path: path, text: text),
         lex: prepare_lex_rules(rules: dag_language_model().lex),
-        prepared: prepared,
-        residue: None
+        prepared: prepared
       )
     Rejected { diagnostics: d } =>
       ReferenceConservationSubject { path: path, parsed: Rejected { diagnostics: d }, normalized: Rejected { diagnostics: d } }
diff --git a/src/v2/compiler/reference_conservation_census.dag b/src/v2/compiler/reference_conservation_census.dag
index 595475a43f5..4ee5a89de4a 100644
--- a/src/v2/compiler/reference_conservation_census.dag
+++ b/src/v2/compiler/reference_conservation_census.dag
@@ -48,7 +48,7 @@ import v2.std.collection { empty_map, map_insert, map_lookup }
 import std.optional { Absent, Present }
 import std.bytes { bytes_octets, utf8_encode_bytes }
 import gunbc.namespace_step0_subject_collector { Step0SubjectCollected, Step0SubjectCollectionRefused, collect_step0_subject_vector_at }
-import v2.std.integer { integer_int_to_decimal_string }
+import std.integer { int_to_decimal_string }
 import std.algebra { Cons, Empty, FreeMonoid, list_snoc_item }
 import v2.std.diagnostic { Accepted, Rejected, diagnostics_fatal_reason }
 import v2.std.text { String }
@@ -120,14 +120,13 @@ fn sample_path_parts(path: String) -> SamplePathParts {
 fn sample_path_measured(path: String, text: String) -> SamplePathObservation {
   match dag_prepared_grammar() {
     Rejected { diagnostics: _ } => SamplePathGrammarUnprepared { path: path }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       SamplePathMeasured {
         report: reference_conservation_of_read(
           read: conservation_read_of(path: path, text: text),
           lm: dag_language_model(),
           lex: prepare_lex_rules(rules: dag_language_model().lex),
-          prepared: prepared,
-          residue: residue
+          prepared: prepared
         )
       }
   }
@@ -243,9 +242,9 @@ fn changed_scope_row_lines(rows: FreeMonoid<ChangedScopeRow>) -> String {
 fn changed_scope_verdict_line(observation: ChangedScopeConservationObservation) -> String {
   match observation {
     NoBodyLoweringChange { rows: _ } => "observation no-body-lowering-change"
-    ChangedScopeObservedConserved { rows: _, in_scope: n } => "observation conserved in_scope=" + integer_int_to_decimal_string(value: n)
+    ChangedScopeObservedConserved { rows: _, in_scope: n } => "observation conserved in_scope=" + int_to_decimal_string(value: n)
     ChangedScopeObservedDropped { rows: _, in_scope: n, refused: k } =>
-      "observation dropped in_scope=" + integer_int_to_decimal_string(value: n) + " refused=" + integer_int_to_decimal_string(value: k)
+      "observation dropped in_scope=" + int_to_decimal_string(value: n) + " refused=" + int_to_decimal_string(value: k)
   }
 }
 
@@ -441,7 +440,6 @@ data reference_conservation_stratified_sample_paths: List<String> = [
   "dag/gunbc/repo/repo_self_warning_policy.dag",
   "dag/gunbc/roadmap/roadmap_acceptance_history_projection.dag",
   "dag/gunbc/roadmap/roadmap_publish_admission.dag",
-  "dag/gunbc/rung_drop/admit_callers_discarded_on_the_native_route.dag",
   "dag/gunbc/rung_drop/dashboard_merge_ready_semantic_admissibility.dag",
   "dag/gunbc/rung_drop/floor_cut_effect_gates.dag",
   "dag/gunbc/rung_drop/lens_enforcement_censuses.dag",
@@ -531,7 +529,6 @@ data reference_conservation_stratified_sample_paths: List<String> = [
   "dag/test/claim/self_host_program_partition_behavioral_witness_test.dag",
   "dag/test/claim/service_effect_expansion_budget_witness_test.dag",
   "dag/test/claim/shell_spawn_refused_real_execution_witness_test.dag",
-  "dag/test/claim/spark/pair_incumbent_identity_wet_witness_test.dag",
   "dag/test/claim/spark/spark_pair_serving_apply_witness_test.dag",
   "dag/test/claim/srv3/srv3_bmc_credential_resolve_witness_test.dag",
   "dag/test/claim/srv3/srv3_runner_memory_converge_witness_test.dag",
@@ -811,7 +808,7 @@ fn reference_conservation_sample_by_rule_at_pin_exit() -> ProcessExit {
       if length(xs: missing) == 0 && length(xs: extra) == 0 && length(xs: derived) == length(xs: pinned) {
         ExitSuccess
       } else {
-        exit_failure(reason: "the rule at " + reference_conservation_stratified_sample_revision + " selects " + integer_int_to_decimal_string(value: length(xs: derived)) + " paths; the pin lists " + integer_int_to_decimal_string(value: length(xs: pinned)) + "; rule-only " + integer_int_to_decimal_string(value: length(xs: missing)) + fold_list(xs: missing, empty: "", cons: fn(a, p) { a + " " + p }) + "; pin-only " + integer_int_to_decimal_string(value: length(xs: extra)) + fold_list(xs: extra, empty: "", cons: fn(a, p) { a + " " + p }))
+        exit_failure(reason: "the rule at " + reference_conservation_stratified_sample_revision + " selects " + int_to_decimal_string(value: length(xs: derived)) + " paths; the pin lists " + int_to_decimal_string(value: length(xs: pinned)) + "; rule-only " + int_to_decimal_string(value: length(xs: missing)) + fold_list(xs: missing, empty: "", cons: fn(a, p) { a + " " + p }) + "; pin-only " + int_to_decimal_string(value: length(xs: extra)) + fold_list(xs: extra, empty: "", cons: fn(a, p) { a + " " + p }))
       }
   }
 }
diff --git a/src/v2/compiler/self_host/closure_emission.dag b/src/v2/compiler/self_host/closure_emission.dag
index 1f14d07ab0d..c2b2c1b2f01 100644
--- a/src/v2/compiler/self_host/closure_emission.dag
+++ b/src/v2/compiler/self_host/closure_emission.dag
@@ -1,5 +1,6 @@
 module v2.compiler.self_host.closure_emission
 
+import v2.std.member_declaration_kind { no_member_declaration_kinds }
 import v2.compiler.tokenize { PreparedLexRules, prepare_lex_rules }
 import std.algebra { Cons, Empty, FreeMonoid }
 import std.occurrence_identity { OccurrenceIdAllocator, occurrence_id_allocator_initial, scoped_occurrence_allocator }
@@ -62,6 +63,7 @@ import v2.std.diagnostic {
   bind_outcome,
   diagnostics_fatal,
   diagnostics_fatal_reason,
+  diagnostics_singleton,
   non_empty_diagnostics_append,
   node_locus,
   outcome_accepted,
@@ -77,7 +79,7 @@ import v2.std.resolution_policy { default_name_resolution_policy }
 import v2.std.symbol_index { SymbolIndex, empty_symbol_index }
 import v2.std.grammar { ParseTree }
 import v2.std.integer { Int }
-import std.optional { Absent, Optional, Present }
+import std.optional { Absent, Optional, Present, optional_absent, optional_present }
 import v2.std.text { String }
 import v2.compiler.refinement_discharge { infer_and_discharge }
 
@@ -193,8 +195,7 @@ fn closure_ingest_step(
   state: ClosureIngestState,
   read: DagSourceReadWitness,
   lex: PreparedLexRules,
-  prepared: PreparedGrammar,
-  residue: Diagnostics
+  prepared: PreparedGrammar
 ) -> ClosureIngestState {
   let acc = state.ingest
   match bind_outcome(
@@ -203,7 +204,6 @@ fn closure_ingest_step(
       parse_module_prepared_seeded(
         tokens: tokens,
         prepared: prepared,
-        validation_residue: residue,
         seed: state.alloc
       )
     }
@@ -218,22 +218,23 @@ fn closure_ingest_step(
           bind_outcome(
             o: qualified_name_from_module_node(root: census.root),
             f: fn(module_qn) {
-              if closure_ingest_declares(files: acc.files, member_module: module_qn) {
-                outcome_rejected(d: closure_emission_diagnostic(
-                  reason: ^closure_census_duplicate_module,
-                  at: census.root
-                ))
-              } else {
-                outcome_accepted(value: ClosureIngest {
-                  files: list_snoc_item(xs: acc.files, item: ClosureIngestFile {
-                    module: module_qn,
-                    parse_tree: artifact.tree,
-                    census: census,
-                    source_root: read.source_root
-                  }),
-                  index: source_root_index_insert(index: acc.index, module: module_qn, root: read.source_root),
-                  alloc: artifact.alloc
-                })
+              match closure_ingest_first_declaring(files: acc.files, member_module: module_qn) {
+                Present { value: first } =>
+                  closure_census_duplicate_module_outcome(
+                    first: first,
+                    second_root: census.root
+                  )
+                Absent =>
+                  outcome_accepted(value: ClosureIngest {
+                    files: list_snoc_item(xs: acc.files, item: ClosureIngestFile {
+                      module: module_qn,
+                      parse_tree: artifact.tree,
+                      census: census,
+                      source_root: read.source_root
+                    }),
+                    index: source_root_index_insert(index: acc.index, module: module_qn, root: read.source_root),
+                    alloc: artifact.alloc
+                  })
               }
             }
           )
@@ -258,7 +259,7 @@ type ClosureCensus
 fn closure_ingest(ingest: SourceRootIngest, lm: LanguageModel) -> ClosureCensus {
   match prepare_grammar(grammar: lm.grammar) {
     Rejected { diagnostics: d } => ClosureGrammarUnprepared { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       let lex = prepare_lex_rules(rules: lm.lex)
       ClosureCensusRead {
         state: fold_list(
@@ -270,7 +271,7 @@ fn closure_ingest(ingest: SourceRootIngest, lm: LanguageModel) -> ClosureCensus
             spans: span_index_empty()
           },
           cons: fn(state, read) {
-            closure_ingest_step(state: state, read: read, lex: lex, prepared: prepared, residue: residue)
+            closure_ingest_step(state: state, read: read, lex: lex, prepared: prepared)
           }
         )
       }
@@ -309,8 +310,43 @@ fn closure_census_index(files: FreeMonoid<ClosureIngestFile>) -> SymbolIndex {
 // would refuse a duplicate too (resolve_duplicate_module_name), but each member is resolved in a
 // context holding only itself, so that wall cannot fire here; the census is where the whole
 // population is in view, so the wall lives there (review of gunbc#12218 at 242b7af).
-fn closure_ingest_declares(files: FreeMonoid<ClosureIngestFile>, member_module: QualifiedName) -> Bool {
-  fold_list(xs: files, empty: false, cons: fn(found, f) { found || f.module == member_module })
+fn closure_ingest_first_declaring(
+  files: FreeMonoid<ClosureIngestFile>,
+  member_module: QualifiedName
+) -> Optional<ClosureIngestFile> {
+  fold_list(xs: files, empty: optional_absent(), cons: fn(found, f) {
+    match found {
+      Present { value: _ } => found
+      Absent =>
+        if f.module == member_module {
+          optional_present(value: f)
+        } else {
+          found
+        }
+    }
+  })
+}
+
+// BOTH FILES, because a collision is a two-place fact. Locating only the second file's module
+// node left the first unnamed, and a later resolve diagnostic at an innocent token was then
+// read as the cause.
+fn closure_census_duplicate_module_diagnostics(first: Node, second: Node) -> NonEmptyDiagnostics {
+  non_empty_diagnostics_append(
+    a: diagnostics_singleton(d: closure_emission_diagnostic(reason: ^closure_census_duplicate_module, at: first)),
+    b: diagnostics_singleton(d: closure_emission_diagnostic(reason: ^closure_census_duplicate_module, at: second))
+  )
+}
+
+fn closure_census_duplicate_module_outcome(
+  first: ClosureIngestFile,
+  second_root: Node
+) -> Outcome<ClosureIngest> {
+  Rejected {
+    diagnostics: closure_census_duplicate_module_diagnostics(
+      first: first.census.root,
+      second: second_root
+    )
+  }
 }
 
 // EXACTLY ONE FILE, OR A TYPED REFUSAL. The census makes more than one unreachable, and it is refused
@@ -349,7 +385,7 @@ fn closure_resolve_member(
           policy: default_name_resolution_policy()
         )),
         admission: Admission { subject: ResolutionSubject { name: member_module }, imports: Empty }
-      ).walk, symbol_index: symbol_index, closure_declarations: empty_symbol_index(), unavailable_providers: [])
+      ).walk, symbol_index: symbol_index, closure_declarations: empty_symbol_index(), unavailable_providers: [], member_kinds: no_member_declaration_kinds())
     }
   )
 }
diff --git a/src/v2/compiler/self_host/frontier_probe.dag b/src/v2/compiler/self_host/frontier_probe.dag
index de7282c9366..14c97cb77d7 100644
--- a/src/v2/compiler/self_host/frontier_probe.dag
+++ b/src/v2/compiler/self_host/frontier_probe.dag
@@ -15,9 +15,6 @@ import v2.compiler.name_resolve {
   resolve_diagnostics,
   validate_module_roots
 }
-import v2.compiler.parse {
-  overlap_residue_stage_from_parse_grammar
-}
 import v2.compiler.program_assembly {
   assemble_program_from_ingest,
   program_assembly_fold_ingest,
@@ -716,9 +713,6 @@ fn frontier_probe_emit_from_populated_ingest(
           d: d,
           ingest: ingest,
           admission: admission
-        ),
-        overlap_residue_stage: overlap_residue_stage_from_parse_grammar(
-          grammar: dag_language_model().grammar
         )
       )
     Accepted { value: _, diagnostics: _ } =>
diff --git a/src/v2/compiler/self_host/frontier_probe_assemble_detail.dag b/src/v2/compiler/self_host/frontier_probe_assemble_detail.dag
index ddd8027c298..8198177f506 100644
--- a/src/v2/compiler/self_host/frontier_probe_assemble_detail.dag
+++ b/src/v2/compiler/self_host/frontier_probe_assemble_detail.dag
@@ -1,27 +1,7 @@
 module v2.compiler.self_host.frontier_probe_assemble_detail
 
-import std.algebra { FreeMonoid, list_snoc_item }
-import v2.std.algebra {
-  Empty,
-  HeadAbsent,
-  HeadFound,
-  TailAbsent,
-  TailFound,
-  fold_list,
-  is_empty,
-  list_head,
-  list_tail
-}
-import v2.compiler.parse_diagnostic {
-  NoParseDiagnosticEvidence,
-  NonEmptyParseStageDiagnostics,
-  ParseStageDiagnostic,
-  grammar_choice_ambiguity_rows_from_non_empty_parse_stage,
-  non_empty_grammar_choice_ambiguity_rows_from_parse_stage,
-  parse_overlap_residue_stage_diagnostic_at,
-  parse_stage_diagnostic_from_diagnostic_only
-}
-import v2.std.grammar_choice_ambiguity { GrammarChoiceAmbiguityRow }
+import std.algebra { list_snoc_item }
+import v2.std.algebra { Empty, fold_list }
 import v2.compiler.self_host.frontier_probe_types {
   AssembleMissingModule,
   AssembleRejectionCause,
@@ -29,7 +9,6 @@ import v2.compiler.self_host.frontier_probe_types {
   FrontierProbeAssembleDetail,
   FrontierProbeDetail,
   FrontierProbeReceipt,
-  GrammarChoiceOverlap,
   MissingModuleIdentityUnavailable,
   NonEmptySymbolChain,
   OtherAssembleRefusal,
@@ -38,23 +17,10 @@ import v2.compiler.self_host.frontier_probe_types {
   ProbeStageAssemble
 }
 import v2.std.diagnostic { Diagnostic, NonEmptyDiagnostics, diagnostics_fatal, diagnostics_fatal_reason }
-import std.optional { Absent, Optional, Present, optional_absent, optional_present }
+import std.optional { Absent, Optional, Present, optional_absent }
 import v2.std.qualified_name { QualifiedName }
 import v2.std.text { String }
 
-fn non_empty_symbol_chain_from_non_empty_parse_stage(
-  d: NonEmptyParseStageDiagnostics
-) -> NonEmptySymbolChain {
-  NonEmptySymbolChain {
-    head: d.head.diagnostic.reason,
-    tail: fold_list(
-      xs: d.tail,
-      empty: Empty,
-      cons: fn(acc, item) { list_snoc_item(xs: acc, item: item.diagnostic.reason) }
-    )
-  }
-}
-
 fn non_empty_symbol_chain_from_non_empty_diagnostics(
   d: NonEmptyDiagnostics
 ) -> NonEmptySymbolChain {
@@ -68,192 +34,20 @@ fn non_empty_symbol_chain_from_non_empty_diagnostics(
   }
 }
 
+// diagnostic_module_root_missing_qn_optional always returns Absent: no diagnostic carries the
+// module root it failed to find, so resolve_module_not_found assemble causes classify as
+// MissingModuleIdentityUnavailable rather than AssembleMissingModule { requested }.
+// FrontierProbeDetail.MissingModule (#7762) carries the structural QualifiedName on receipt.detail
+// when frontier_probe_detail_from_diagnostic binds it. Trigger: a diagnostic evidence carrier for
+// ModuleRootMissing (one that does not reintroduce the diagnostic.dag ↔ qualified_name import
+// cycle); then extract it here and map Present -> AssembleMissingModule { requested }.
 fn diagnostic_module_root_missing_qn_optional(d: Diagnostic) -> Optional<QualifiedName> {
   optional_absent()
 }
 
-// diagnostic_module_root_missing_qn_optional is deliberately unavailable in this
-// module — it always returns Absent, so resolve_module_not_found assemble causes
-// classify as MissingModuleIdentityUnavailable rather than AssembleMissingModule {
-// requested }. FrontierProbeDetail.MissingModule (#7762) carries the structural
-// QualifiedName on receipt.detail when frontier_probe_detail_from_diagnostic binds
-// it. Parse-stage AssembleMissingModule awaits ModuleRootMissingEvidence on
-// ParseDiagnosticEvidence without reintroducing the diagnostic.dag ↔
-// qualified_name import cycle. Dissolve trigger: wire parse-stage diagnostics to
-// carry that evidence; then replace optional_absent() with extraction from
-// ParseStageDiagnostic.evidence and map Present -> AssembleMissingModule {
-// requested }.
-
-// THE CAUSE IS THE FATAL DIAGNOSTIC, THE CHAIN'S LAST. An advisory prepended to the refusal (the
-// grammar overlap residue heads every module's chain) is not the cause, so the chain is classified
-// by its fatal element and the residue no longer needs a masking arm of its own: its rows ride on
-// the detail's overlap_residue_stage. A refusal whose fatal element is itself the overlap residue
-// carries its rows as GrammarChoiceOverlap.
-fn assemble_rejection_cause_from_parse_stage(
-  d: NonEmptyParseStageDiagnostics
-) -> AssembleRejectionCause {
-  let fatal = parse_stage_fatal(d: d)
-  if fatal.diagnostic.reason == ^resolve_module_not_found {
-    match diagnostic_module_root_missing_qn_optional(d: fatal.diagnostic) {
-      Present { value: requested } => AssembleMissingModule { requested: requested }
-      Absent => MissingModuleIdentityUnavailable
-    }
-  } else if fatal.diagnostic.reason == ^parse_grammar_choice_overlap_residue {
-    match non_empty_grammar_choice_ambiguity_rows_from_parse_stage(d: d) {
-      Present { value: rows } => GrammarChoiceOverlap { rows: rows }
-      Absent => OtherAssembleRefusal { reason: fatal.diagnostic.reason }
-    }
-  } else {
-    OtherAssembleRefusal { reason: fatal.diagnostic.reason }
-  }
-}
-
-fn parse_stage_fatal(d: NonEmptyParseStageDiagnostics) -> ParseStageDiagnostic {
-  fold_list(xs: d.tail, empty: d.head, cons: fn(acc, item) { item })
-}
-
-fn diagnostic_reason_is_overlap_residue(d: Diagnostic) -> Bool {
-  d.reason == ^parse_grammar_choice_overlap_residue
-}
-
-fn all_overlap_residue_diagnostic_list(xs: FreeMonoid<Diagnostic>) -> Bool {
-  fold_list(
-    xs: xs,
-    empty: true,
-    cons: fn(acc, diag) { acc && diagnostic_reason_is_overlap_residue(d: diag) }
-  )
-}
-
-fn all_overlap_residue_non_empty_diagnostics(d: NonEmptyDiagnostics) -> Bool {
-  diagnostic_reason_is_overlap_residue(d: d.head)
-    && all_overlap_residue_diagnostic_list(xs: d.tail)
-}
-
-// parse_stage_head_from_overlap_row_queue_and_diagnostic and
-// parse_stage_tail_from_overlap_row_queue_and_diagnostics pair plain
-// NonEmptyDiagnostics overlap residues against a GrammarChoiceAmbiguityRow queue
-// from overlap_residue_stage. Both sides derive from the same ambiguity_roster in
-// grammar_validate_and_analyze today — count mismatch is unreachable in-tree.
-// HeadAbsent arms silently narrow to NoParseDiagnosticEvidence
-// (empty-observation narrow at this boundary if parallel representation diverges).
-// Dissolve trigger: carry overlap evidence only on parse-stage diagnostics and
-// delete this queue-merge path; then refuse on evidence deficit instead of narrowing.
-
-type OverlapQueueMergeAcc {
-  stages: FreeMonoid<ParseStageDiagnostic>
-  row_queue: FreeMonoid<GrammarChoiceAmbiguityRow>
-}
-
-fn overlap_row_queue_tail_after_pop(
-  row_queue: FreeMonoid<GrammarChoiceAmbiguityRow>
-) -> FreeMonoid<GrammarChoiceAmbiguityRow> {
-  match list_tail(xs: row_queue) {
-    TailAbsent => Empty
-    TailFound { tail: rest } => rest
-  }
-}
-
-fn overlap_queue_merge_acc_step(acc: OverlapQueueMergeAcc, diag: Diagnostic) -> OverlapQueueMergeAcc {
-  if diagnostic_reason_is_overlap_residue(d: diag) {
-    match list_head(xs: acc.row_queue) {
-      HeadFound { value: row } =>
-        OverlapQueueMergeAcc {
-          stages: list_snoc_item(
-            xs: acc.stages,
-            item: parse_overlap_residue_stage_diagnostic_at(at: diag.at, row: row)
-          ),
-          row_queue: overlap_row_queue_tail_after_pop(row_queue: acc.row_queue)
-        }
-      HeadAbsent =>
-        OverlapQueueMergeAcc {
-          stages: list_snoc_item(
-            xs: acc.stages,
-            item: parse_stage_diagnostic_from_diagnostic_only(d: diag)
-          ),
-          row_queue: acc.row_queue
-        }
-    }
-  } else {
-    OverlapQueueMergeAcc {
-      stages: list_snoc_item(
-        xs: acc.stages,
-        item: parse_stage_diagnostic_from_diagnostic_only(d: diag)
-      ),
-      row_queue: acc.row_queue
-    }
-  }
-}
-
-fn parse_stage_tail_from_overlap_row_queue_and_diagnostics(
-  tail: FreeMonoid<Diagnostic>,
-  row_queue: FreeMonoid<GrammarChoiceAmbiguityRow>
-) -> FreeMonoid<ParseStageDiagnostic> {
-  fold_list(
-    xs: tail,
-    empty: OverlapQueueMergeAcc { stages: Empty, row_queue: row_queue },
-    cons: fn(acc, diag) { overlap_queue_merge_acc_step(acc: acc, diag: diag) }
-  ).stages
-}
-
-fn parse_stage_head_from_overlap_row_queue_and_diagnostic(
-  diag: Diagnostic,
-  row_queue: FreeMonoid<GrammarChoiceAmbiguityRow>
-) -> ParseStageDiagnostic {
-  if diagnostic_reason_is_overlap_residue(d: diag) {
-    match list_head(xs: row_queue) {
-      HeadFound { value: row } =>
-        parse_overlap_residue_stage_diagnostic_at(at: diag.at, row: row)
-      HeadAbsent => parse_stage_diagnostic_from_diagnostic_only(d: diag)
-    }
-  } else {
-    parse_stage_diagnostic_from_diagnostic_only(d: diag)
-  }
-}
-
-fn overlap_row_queue_after_overlap_head(
-  diag: Diagnostic,
-  row_queue: FreeMonoid<GrammarChoiceAmbiguityRow>
-) -> FreeMonoid<GrammarChoiceAmbiguityRow> {
-  if diagnostic_reason_is_overlap_residue(d: diag) {
-    overlap_row_queue_tail_after_pop(row_queue: row_queue)
-  } else {
-    row_queue
-  }
-}
-
-fn non_empty_parse_stage_diagnostics_from_rejection_and_overlap_stage(
-  d: NonEmptyDiagnostics,
-  overlap_stage: NonEmptyParseStageDiagnostics
-) -> NonEmptyParseStageDiagnostics {
-  let row_queue = grammar_choice_ambiguity_rows_from_non_empty_parse_stage(d: overlap_stage)
-  let head = parse_stage_head_from_overlap_row_queue_and_diagnostic(
-    diag: d.head,
-    row_queue: row_queue
-  )
-  let row_queue_after_head = overlap_row_queue_after_overlap_head(diag: d.head, row_queue: row_queue)
-  NonEmptyParseStageDiagnostics {
-    head: head,
-    tail: parse_stage_tail_from_overlap_row_queue_and_diagnostics(
-      tail: d.tail,
-      row_queue: row_queue_after_head
-    )
-  }
-}
-
-fn non_empty_parse_stage_diagnostics_merged(
-  d: NonEmptyDiagnostics,
-  overlap_stage: NonEmptyParseStageDiagnostics
-) -> NonEmptyParseStageDiagnostics {
-  if all_overlap_residue_non_empty_diagnostics(d: d) {
-    overlap_stage
-  } else {
-    non_empty_parse_stage_diagnostics_from_rejection_and_overlap_stage(
-      d: d,
-      overlap_stage: overlap_stage
-    )
-  }
-}
-
+// THE CAUSE IS THE FATAL DIAGNOSTIC, THE CHAIN'S LAST (advisories step 2, gunbc#13103). An advisory
+// rejected_with_pending prepended is not the cause, so the cause, its location and the receipt's
+// located reason are all read from the fatal element; the chain keeps the whole ordered list.
 fn assemble_rejection_cause_from_diagnostics(
   d: NonEmptyDiagnostics
 ) -> AssembleRejectionCause {
@@ -268,16 +62,6 @@ fn assemble_rejection_cause_from_diagnostics(
   }
 }
 
-fn frontier_probe_assemble_detail_from_parse_stage(
-  d: NonEmptyParseStageDiagnostics
-) -> FrontierProbeAssembleDetail {
-  AssembleRejectionDetail {
-    rejection_chain: non_empty_symbol_chain_from_non_empty_parse_stage(d: d),
-    cause: assemble_rejection_cause_from_parse_stage(d: d),
-    at: frontier_probe_cause_location_from_locus(at: parse_stage_fatal(d: d).diagnostic.at)
-  }
-}
-
 fn frontier_probe_assemble_detail_from_rejection(
   d: NonEmptyDiagnostics
 ) -> FrontierProbeAssembleDetail {
@@ -288,39 +72,17 @@ fn frontier_probe_assemble_detail_from_rejection(
   }
 }
 
-fn frontier_probe_assemble_detail_from_rejection_with_overlap_stage(
-  d: NonEmptyDiagnostics,
-  overlap_residue_stage: Optional<NonEmptyParseStageDiagnostics>
-) -> FrontierProbeAssembleDetail {
-  match overlap_residue_stage {
-    Absent => frontier_probe_assemble_detail_from_rejection(d: d)
-    Present { value: stage } =>
-      AssembleRejectionDetail {
-        rejection_chain: non_empty_symbol_chain_from_non_empty_diagnostics(d: d),
-        cause: assemble_rejection_cause_from_parse_stage(
-          d: non_empty_parse_stage_diagnostics_merged(d: d, overlap_stage: stage)
-        ),
-        at: frontier_probe_cause_location_from_locus(at: diagnostics_fatal(d: d).at)
-      }
-  }
-}
-
 fn frontier_probe_receipt_from_assemble_rejection(
   module_path: String,
   diagnostics: NonEmptyDiagnostics,
-  detail: FrontierProbeDetail,
-  overlap_residue_stage: Optional<NonEmptyParseStageDiagnostics>
+  detail: FrontierProbeDetail
 ) -> FrontierProbeReceipt {
-  let located_reason = diagnostics_fatal_reason(d: diagnostics)
   FrontierProbeReceipt {
     module_path: module_path,
-    blocker_class: frontier_classify_rejection_reason(reason: located_reason),
+    blocker_class: frontier_classify_rejection_reason(reason: diagnostics_fatal_reason(d: diagnostics)),
     located_stage: ProbeStageAssemble,
-    located_reason: located_reason,
+    located_reason: diagnostics_fatal_reason(d: diagnostics),
     detail: detail,
-    assemble_detail: frontier_probe_assemble_detail_from_rejection_with_overlap_stage(
-      d: diagnostics,
-      overlap_residue_stage: overlap_residue_stage
-    )
+    assemble_detail: frontier_probe_assemble_detail_from_rejection(d: diagnostics)
   }
 }
diff --git a/src/v2/compiler/self_host/frontier_probe_semantic_family_receipt.dag b/src/v2/compiler/self_host/frontier_probe_semantic_family_receipt.dag
deleted file mode 100644
index 760764d7145..00000000000
--- a/src/v2/compiler/self_host/frontier_probe_semantic_family_receipt.dag
+++ /dev/null
@@ -1,241 +0,0 @@
-module v2.compiler.self_host.frontier_probe_semantic_family_receipt
-
-import std.types { List }
-import std.content_hash { Fnv1a64Structural }
-import v2.std.algebra { fold_list }
-import v2.std.integer { Int }
-import v2.std.node { Symbol }
-import v2.std.text { String }
-
-// SH-D D1: what the five semantic-pipeline shards MEASURE at the v2 direct Rust door, as executed
-// observations rather than expectations. Each row is one shard, and the two dispositions are not
-// two flavours of the same answer: a shard whose closure fits the manifest transport produces a
-// detailed cause, and a shard whose closure exceeds the inline row cap produces nothing at all —
-// the manifest emits zero rows and an empty ingest, so there is no observation to record. Recording
-// the second as a measurement with absent fields would make the cap look like a property of the
-// module. The rows carry no verdict about the frontier roster; frontier.dag is the program lead's
-// authority and this module supplies it evidence, never a correction.
-
-// Provenance of these observations, so a reader can re-derive rather than trust them: source_commit
-// 2bc11e0cd53, survey/probe binaries built from that tree, closures produced by
-// discover_source_root_ingest against source roots src/v2 and dag, receipts read through
-// frontier_probe_emit_from_ingest. The measured shards were read on UNPATCHED main for
-// materialization_carriers, and for use_site_verdict with the annotation-channel hunk of gunbc#8149
-// (commit fa2576a9) applied locally, because on unpatched main that shard's closure refuses at the
-// lexer before reaching the layer under study. Which side each row was read on is carried per row,
-// not assumed.
-
-type ShardObservationSide
-  = ObservedOnMain
-  | ObservedWithAnnotationChannelHunk { upstream_commit: String }
-
-type ShardDoorDisposition
-  = DetailedCauseObserved {
-      located_reason: Symbol,
-      chain_length: Int,
-      symbols_differing_from_head: Int,
-      first_differing_symbol: String
-    }
-  | ClosureExceedsManifestCap { read_count: Int, cap: Int }
-
-type SemanticFamilyShardRow {
-  module_path: String
-  closure_reads: Int
-  side: ShardObservationSide
-  disposition: ShardDoorDisposition
-}
-
-data shard_use_site_verdict: SemanticFamilyShardRow = SemanticFamilyShardRow {
-  module_path: "src/v2/compiler/use_site_verdict.dag",
-  closure_reads: 15,
-  side: ObservedWithAnnotationChannelHunk { upstream_commit: "fa2576a9" },
-  disposition: DetailedCauseObserved {
-    located_reason: ^parse_grammar_choice_overlap_residue,
-    chain_length: 126,
-    symbols_differing_from_head: 120,
-    first_differing_symbol: "body_lowering_reason_wrapper_retained_emitted"
-  }
-}
-
-data shard_materialization_carriers: SemanticFamilyShardRow = SemanticFamilyShardRow {
-  module_path: "src/v2/compiler/materialization_carriers.dag",
-  closure_reads: 48,
-  side: ObservedOnMain,
-  disposition: DetailedCauseObserved {
-    located_reason: ^parse_grammar_choice_overlap_residue,
-    chain_length: 11,
-    symbols_differing_from_head: 5,
-    first_differing_symbol: "body_lowering_reason_wrapper_retained_emitted"
-  }
-}
-
-data shard_03_resolve: SemanticFamilyShardRow = SemanticFamilyShardRow {
-  module_path: "src/v2/compiler/03_resolve.dag",
-  closure_reads: 71,
-  side: ObservedOnMain,
-  disposition: ClosureExceedsManifestCap { read_count: 71, cap: 64 }
-}
-
-data shard_04_infer: SemanticFamilyShardRow = SemanticFamilyShardRow {
-  module_path: "src/v2/compiler/04_infer.dag",
-  closure_reads: 75,
-  side: ObservedOnMain,
-  disposition: ClosureExceedsManifestCap { read_count: 75, cap: 64 }
-}
-
-data shard_03_name_resolve: SemanticFamilyShardRow = SemanticFamilyShardRow {
-  module_path: "src/v2/compiler/03_name_resolve.dag",
-  closure_reads: 143,
-  side: ObservedOnMain,
-  disposition: ClosureExceedsManifestCap { read_count: 143, cap: 64 }
-}
-
-data semantic_family_shard_rows: List<SemanticFamilyShardRow> = [
-  shard_use_site_verdict,
-  shard_materialization_carriers,
-  shard_03_resolve,
-  shard_04_infer,
-  shard_03_name_resolve
-]
-
-// CORRECTION (2026-08-13, vivid-bat-377 executed finding, mechanism re-verified here): the sentence
-// this row used to carry — that the recorded reason is CONFIRMED at reason grain — is WITHDRAWN,
-// and it was withdrawn for a stronger reason than being unproven.
-// ^parse_grammar_choice_overlap_residue is not a per-module cause at all. v2.compiler.02_parse
-// grammar_choice_ambiguity_roster_from_analysis folds over root.productions ALONE — no module, no
-// source text, no closure is an input — so the roster is grammar-global and constant, and
-// rejected_with_pending PREPENDS it to any later rejection. The head of a parse failure is
-// therefore that residue for ANY module under the dag grammar, unconditionally. Agreement between a
-// receipt and a frontier row on that symbol is agreement with a constant: it discriminates nothing,
-// so it can neither confirm nor disconfirm the row. A population that is everything is not
-// evidence.
-//
-// WHAT SURVIVES UNCHANGED, and why the distinction is not special pleading: every figure in the
-// rows above is a TAIL read. first_differing_symbol is by construction the first chain symbol
-// DIFFERING from the head, so the constant prefix is exactly what it skips; chain_length and
-// symbols_differing_from_head are counts over the whole chain. The body-lowering finding was
-// reached by going past the head, which is why it survived a defect that invalidated the head
-// reading. What changed is the standing of the recorded ROW, not the standing of the measurement.
-
-// THE FINDING, at the grain the evidence supports. Both measurable shards refuse with a head of
-// ^parse_grammar_choice_overlap_residue — a grammar-global constant that says nothing about either
-// module (see the correction note above; an earlier revision of this row read that agreement as
-// confirming the frontier rows, which it cannot). The cause in both was recorded under an arm since
-// deleted (the probe now classifies by the fatal element), and it meant that constant stood in
-// front of a further chain. Reading those chains:
-// use_site_verdict carries 126 symbols of which 120 differ from the head, materialization_carriers
-// carries 11 of which 5 differ, and in BOTH the first differing symbol is
-// body_lowering_reason_wrapper_retained_emitted. So the recorded reason is neither confirmed nor
-// terminal, and what the chains DO show is unaffected by that: the dominant refusal underneath is
-// body-lowering wrapper-retained residue, whose named prerequisite is the general body producer.
-// What this does NOT establish: that body lowering is the LAST layer. A chain read one symbol deep
-// answers what the mask hides, not what that in turn hides, and nothing here has looked beneath the
-// second layer.
-
-// The three shards above 64 reads were UNOBSERVED at commit 2bc11e0 because the inline-text carrier
-// capped at MANIFEST_INLINE_LIST_MAX. Capless closure transport (SourceRef rows, read-through
-// ingest) removes that transport ceiling; a fresh frontier_probe_survey at the current head is
-// required to replace ClosureExceedsManifestCap dispositions with detailed causes. This note
-// records the pre-capless measurement only.
-
-// OBSERVED DRIFT, reported and not acted on: the frontier roster records closure_reads 9 for
-// use_site_verdict and 35 for materialization_carriers; discover_source_root_ingest measures 15 and
-// 48 at this commit. The rows are the program lead's authority and are not edited from here. Stated
-// precisely, because the two are different claims: what is established is that the closure sizes
-// differ from the recorded ones at this commit, NOT that either row's blocker classification is
-// wrong.
-
-fn shard_count() -> Int {
-  fold_list(xs: semantic_family_shard_rows, empty: 0, cons: fn(n, _r) { n + 1 })
-}
-
-fn measured_shard_count() -> Int {
-  fold_list(
-    xs: semantic_family_shard_rows,
-    empty: 0,
-    cons: fn(n, r) {
-      match r.disposition {
-        DetailedCauseObserved {
-          located_reason: _,
-          chain_length: _,
-          symbols_differing_from_head: _,
-          first_differing_symbol: _
-        } => n + 1
-        ClosureExceedsManifestCap { read_count: _, cap: _ } => n
-      }
-    }
-  )
-}
-
-fn capped_shard_count() -> Int {
-  fold_list(
-    xs: semantic_family_shard_rows,
-    empty: 0,
-    cons: fn(n, r) {
-      match r.disposition {
-        ClosureExceedsManifestCap { read_count: _, cap: _ } => n + 1
-        DetailedCauseObserved {
-          located_reason: _,
-          chain_length: _,
-          symbols_differing_from_head: _,
-          first_differing_symbol: _
-        } => n
-      }
-    }
-  )
-}
-
-fn shards_naming_body_lowering_beneath_the_mask() -> Int {
-  fold_list(
-    xs: semantic_family_shard_rows,
-    empty: 0,
-    cons: fn(n, r) {
-      match r.disposition {
-        DetailedCauseObserved {
-          located_reason: _,
-          chain_length: _,
-          symbols_differing_from_head: _,
-          first_differing_symbol: s
-        } =>
-          if s == "body_lowering_reason_wrapper_retained_emitted" { n + 1 } else { n }
-        ClosureExceedsManifestCap { read_count: _, cap: _ } => n
-      }
-    }
-  )
-}
-
-fn every_capped_shard_exceeds_its_own_cap() -> Bool {
-  fold_list(
-    xs: semantic_family_shard_rows,
-    empty: true,
-    cons: fn(ok, r) {
-      match r.disposition {
-        ClosureExceedsManifestCap { read_count: reads, cap: cap } => ok && (reads > cap)
-        DetailedCauseObserved {
-          located_reason: _,
-          chain_length: _,
-          symbols_differing_from_head: _,
-          first_differing_symbol: _
-        } => ok
-      }
-    }
-  )
-}
-
-fn every_measured_chain_is_non_uniform() -> Bool {
-  fold_list(
-    xs: semantic_family_shard_rows,
-    empty: true,
-    cons: fn(ok, r) {
-      match r.disposition {
-        DetailedCauseObserved {
-          located_reason: _,
-          chain_length: len,
-          symbols_differing_from_head: differing,
-          first_differing_symbol: _
-        } => ok && (differing > 0) && (differing < len)
-        ClosureExceedsManifestCap { read_count: _, cap: _ } => ok
-      }
-    }
-  )
-}
diff --git a/src/v2/compiler/self_host/frontier_probe_types.dag b/src/v2/compiler/self_host/frontier_probe_types.dag
index 3446f0755e5..cfd0f945398 100644
--- a/src/v2/compiler/self_host/frontier_probe_types.dag
+++ b/src/v2/compiler/self_host/frontier_probe_types.dag
@@ -32,10 +32,6 @@ import std.content_hash {
 }
 import std.types { CommitSha, GitRef, List }
 import v2.std.algebra { fold_list }
-import v2.std.grammar_choice_ambiguity {
-  GrammarChoiceAmbiguityRow,
-  NonEmptyGrammarChoiceAmbiguityRows
-}
 import v2.std.integer { Int }
 import v2.std.diagnostic { DeclarationLocus, Extent, InvariantPortLocus, Locus, NodeLocus, SourcePortLocus, Textual }
 import v2.std.node { Symbol, symbol_lexeme }
@@ -112,8 +108,7 @@ type NonEmptySymbolChain {
 }
 
 type AssembleRejectionCause
-  = GrammarChoiceOverlap { rows: NonEmptyGrammarChoiceAmbiguityRows }
-  | AssembleMissingModule { requested: QualifiedName }
+  = AssembleMissingModule { requested: QualifiedName }
   | MissingModuleIdentityUnavailable
   | OtherAssembleRefusal { reason: Symbol }
 
@@ -163,14 +158,11 @@ type FrontierProbeAssembleDetail
       at: FrontierProbeCauseLocation
     }
 
-// AssembleRejectionDetail binds only parse-stage-carried evidence — never a global grammar roster.
-// GrammarChoiceOverlap rows are extracted from ParseDiagnosticEvidence on the parse-stage
-// diagnostic carrier. The cause is read from the chain's FATAL element: an overlap residue that
-// heads a chain only rode along, and the refusal is classified by what refused.
-// AssembleMissingModule in assemble_detail awaits parse-stage
-// ModuleRootMissingEvidence; FrontierProbeDetail.MissingModule (#7762) is the structural
-// resolve_module_not_found authority on detail. MissingModuleIdentityUnavailable remains when
-// assemble cause cannot bind parse-stage evidence. Emit-stage receipts use NoFrontierProbeDetail.
+// AssembleRejectionDetail binds only what the rejection's own diagnostics carry -- never a global
+// grammar roster. AssembleMissingModule awaits a ModuleRootMissing evidence carrier on the
+// diagnostic; FrontierProbeDetail.MissingModule (#7762) is the structural resolve_module_not_found
+// authority on detail. MissingModuleIdentityUnavailable remains when the assemble cause cannot bind
+// that evidence. Emit-stage receipts use NoFrontierProbeDetail.
 
 type FrontierProbeReceipt {
   module_path: String
diff --git a/src/v2/compiler/self_host/stage0_executable_assembly.dag b/src/v2/compiler/self_host/stage0_executable_assembly.dag
index b6014d4470e..9f57783b07b 100644
--- a/src/v2/compiler/self_host/stage0_executable_assembly.dag
+++ b/src/v2/compiler/self_host/stage0_executable_assembly.dag
@@ -1,14 +1,13 @@
 module v2.compiler.self_host.stage0_executable_assembly
 
+import gunbc.crate_partition { Stage0PartitionCrateRow }
+
 import std.types { List }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
 import v2.std.algebra { any, length }
 import v2.std.integer { Int }
 import v2.std.text { String }
-import v2.workflow.rust_crate_partition {
-  Stage0PartitionCrateRow,
-  stage0_module_bearing_crate_rows
-}
+import v2.workflow.rust_crate_partition { stage0_module_bearing_crate_rows }
 import v2.compiler.self_host.stage0_crate_layout {
   WetActuatorDeclarationRoute,
   WetActuatorGeneratedRegistration,
diff --git a/src/v2/compiler/source_authority.dag b/src/v2/compiler/source_authority.dag
index 4f449781656..c209616c85b 100644
--- a/src/v2/compiler/source_authority.dag
+++ b/src/v2/compiler/source_authority.dag
@@ -25,12 +25,11 @@ import v2.extdeps.languages.dag {
 import v2.std.compilers.lexing { TokenStream }
 import v2.std.provenance { span_index_empty }
 import std.algebra { Empty, FreeMonoid, list_snoc_item }
-import v2.std.algebra { fold_list, length }
+import v2.std.algebra { HeadAbsent, HeadFound, fold_list, list_head, skip }
 import v2.std.artifact { Artifact, NodeArtifactProvenance, SourceFile }
 import v2.std.diagnostic {
   Accepted,
   Diagnostic,
-  Diagnostics,
   ExternalContractUnknown,
   NonEmptyDiagnostics,
   Outcome,
@@ -483,18 +482,36 @@ fn source_ref_path(ref: SourceRef) -> String {
   ref.path
 }
 
-fn source_root_for_storage_path(path: String) -> SourceRootRef {
-  if starts_with(s: path, prefix: "src/") {
-    V2Tree
+// Tree identity is the --source-root argument that discovered the file, never a substring of
+// the file's storage path. SourceRootRef has two inhabitants (the dag tree and the src/v2
+// tree); an argument names one of those directories or is unrecognized. A parent of both, a
+// copied single-root dump, or any other spelling refuses rather than defaulting to DagTree.
+type SourceRootArgumentAdmission
+  = SourceRootArgumentAdmitted { tree: SourceRootRef }
+  | SourceRootArgumentUnrecognized { argument: String }
+
+fn admit_source_root_argument(argument: String) -> SourceRootArgumentAdmission {
+  if (argument == "src/v2")
+    || (argument == "./src/v2")
+    || (argument == "src/v2/")
+    || argument.ends_with(suffix: "/src/v2")
+    || argument.ends_with(suffix: "/src/v2/") {
+    SourceRootArgumentAdmitted { tree: V2Tree }
+  } else if (argument == "dag")
+    || (argument == "./dag")
+    || (argument == "dag/")
+    || argument.ends_with(suffix: "/dag")
+    || argument.ends_with(suffix: "/dag/") {
+    SourceRootArgumentAdmitted { tree: DagTree }
   } else {
-    DagTree
+    SourceRootArgumentUnrecognized { argument: argument }
   }
 }
 
-fn source_ref_for_storage_path(path: String) -> SourceRef {
+fn source_ref_for_storage_path(path: String, source_root: SourceRootRef) -> SourceRef {
   SourceRef {
     path: path,
-    source_root: source_root_for_storage_path(path: path),
+    source_root: source_root,
     content_hash: content_hash_of_value(value: "selection-unpinned" as NonEmptyStr)
   }
 }
@@ -791,8 +808,7 @@ fn module_storage_binding_from_parse_artifact(
 fn module_storage_binding_from_read_prepared(
   source_read: DagSourceReadWitness,
   lm: LanguageModel,
-  prepared: PreparedGrammar,
-  residue: Diagnostics
+  prepared: PreparedGrammar
 ) -> Outcome<ModuleStorageBinding> {
   match source_read.artifact.kind {
     SourceFile =>
@@ -806,8 +822,7 @@ fn module_storage_binding_from_read_prepared(
           bind_outcome(
             o: parse_module_prepared(
               tokens: token_stream,
-              prepared: prepared,
-              validation_residue: residue
+              prepared: prepared
             ),
             f: fn(artifact) {
               module_storage_binding_from_parse_artifact(
@@ -839,12 +854,11 @@ fn module_storage_binding_from_read_with_model(
 ) -> Outcome<ModuleStorageBinding> {
   match prepare_grammar(grammar: lm.grammar) {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       module_storage_binding_from_read_prepared(
         source_read: source_read,
         lm: lm,
-        prepared: prepared,
-        residue: residue
+        prepared: prepared
       )
   }
 }
@@ -900,8 +914,7 @@ fn module_storage_fold_step(
   state: ModuleStorageFoldState,
   read: DagSourceReadWitness,
   lm: LanguageModel,
-  prepared: PreparedGrammar,
-  residue: Diagnostics
+  prepared: PreparedGrammar
 ) -> ModuleStorageFoldState {
   match state {
     ModuleStorageFoldFailed { diagnostics: d } =>
@@ -910,8 +923,7 @@ fn module_storage_fold_step(
       match module_storage_binding_from_read_prepared(
         source_read: read,
         lm: lm,
-        prepared: prepared,
-        residue: residue
+        prepared: prepared
       ) {
         Rejected { diagnostics: d } =>
           ModuleStorageFoldFailed { diagnostics: d }
@@ -929,8 +941,7 @@ fn module_storage_fold_step(
 fn module_storage_bindings_from_ingest_prepared(
   ingest: SourceRootIngest,
   lm: LanguageModel,
-  prepared: PreparedGrammar,
-  residue: Diagnostics
+  prepared: PreparedGrammar
 ) -> Outcome<ModuleStorageIndex> {
   match fold_list(
     xs: ingest,
@@ -940,8 +951,7 @@ fn module_storage_bindings_from_ingest_prepared(
         state: state,
         read: read,
         lm: lm,
-        prepared: prepared,
-        residue: residue
+        prepared: prepared
       )
     }
   ) {
@@ -959,12 +969,11 @@ fn module_storage_bindings_from_ingest_with_model(
     _ =>
       match prepare_grammar(grammar: lm.grammar) {
         Rejected { diagnostics: d } => Rejected { diagnostics: d }
-        Accepted { value: prepared, diagnostics: residue } =>
+        Accepted { value: prepared, diagnostics: _ } =>
           module_storage_bindings_from_ingest_prepared(
             ingest: ingest,
             lm: lm,
-            prepared: prepared,
-            residue: residue
+            prepared: prepared
           )
       }
   }
@@ -1555,13 +1564,37 @@ fn source_authority_round_trip(
   )
 }
 
-// The native filesystem fold supplies observed bytes; provenance is constructed at the same
-// authority as every other source witness. Neither rendered main owns this conversion.
-fn source_root_ingest_from_files(files: List<SourceRootFile>) -> SourceRootIngest {
-  files |> map(file => DagSourceReadWitness {
-    source: Medium { carried: file.content, fidelity: Lossless },
-    artifact: Artifact { kind: SourceFile, id: file.path, file_path: file.path },
-    compilation_unit: file.path,
-    source_root: source_root_for_storage_path(path: file.path)
-  })
+// The native filesystem fold supplies observed bytes and the discovering --source-root
+// argument on each file. Tree identity is admitted from that argument. An unrecognized
+// argument refuses; the file path is never classified.
+type SourceRootIngestFromFiles
+  = SourceRootIngestFromFilesBuilt { ingest: SourceRootIngest }
+  | SourceRootIngestFromFilesUnrecognizedRoot { argument: String, path: String }
+
+fn source_root_ingest_from_files_go(
+  pending: List<SourceRootFile>,
+  acc: SourceRootIngest
+) -> SourceRootIngestFromFiles {
+  match list_head(xs: pending) {
+    HeadAbsent => SourceRootIngestFromFilesBuilt { ingest: acc }
+    HeadFound { value: file } =>
+      match admit_source_root_argument(argument: file.origin) {
+        SourceRootArgumentAdmitted { tree: tree } =>
+          source_root_ingest_from_files_go(
+            pending: skip(xs: pending, n: 1),
+            acc: list_snoc_item(xs: acc, item: DagSourceReadWitness {
+              source: Medium { carried: file.content, fidelity: Lossless },
+              artifact: Artifact { kind: SourceFile, id: file.path, file_path: file.path },
+              compilation_unit: file.path,
+              source_root: tree
+            })
+          )
+        SourceRootArgumentUnrecognized { argument: argument } =>
+          SourceRootIngestFromFilesUnrecognizedRoot { argument: argument, path: file.path }
+      }
+  }
+}
+
+fn source_root_ingest_from_files(files: List<SourceRootFile>) -> SourceRootIngestFromFiles {
+  source_root_ingest_from_files_go(pending: files, acc: Empty)
 }
diff --git a/src/v2/compiler/source_authority_read.dag b/src/v2/compiler/source_authority_read.dag
index de4d8bc9f96..4a4b6adda13 100644
--- a/src/v2/compiler/source_authority_read.dag
+++ b/src/v2/compiler/source_authority_read.dag
@@ -15,10 +15,9 @@ import std.content_hash {
 import v2.compiler.source_authority {
   DagSourceReadWitness,
   SourceRef,
-  SourceRootIngest,
-  source_ref_for_storage_path,
-  source_root_for_storage_path
+  SourceRootIngest
 }
+import v2.std.cross_tree.import_model { SourceRootRef }
 import extdeps.communication.medium { Lossless, Medium }
 import v2.std.algebra { fold_list }
 import v2.std.artifact { Artifact, SourceFile }
@@ -58,11 +57,11 @@ import v2.std.text { String }
 // witness is minted, a missing or unreadable path refuses as a read failure rather than a
 // misclassified parse error, and both refusals carry the observed digest. Nothing here widens on
 // failure.
-fn source_ref_for_observed_storage_path(path: String) -> SourceRef {
+fn source_ref_for_observed_storage_path(path: String, source_root: SourceRootRef) -> SourceRef {
   let read = Filesystem.Read(path: path)
   SourceRef {
     path: path,
-    source_root: source_root_for_storage_path(path: path),
+    source_root: source_root,
     content_hash: if read.success {
       dag_source_content_hash_for_text(text: read.content)
     } else {
@@ -79,11 +78,11 @@ data source_ref_read_refused: Symbol = ^source_ref_read_refused
 
 data source_ref_content_hash_mismatch: Symbol = ^source_ref_content_hash_mismatch
 
-fn source_ref_read_failed_diagnostic(ref: SourceRef, error: String) -> NonEmptyDiagnostics {
+fn source_ref_read_failed_diagnostic(path: String, error: String) -> NonEmptyDiagnostics {
   NonEmptyDiagnostics {
     head: Diagnostic {
       reason: source_ref_read_refused,
-      at: textual_whole_file_locus(file: symbol_intern_lexeme(lexeme: ref.path)),
+      at: textual_whole_file_locus(file: symbol_intern_lexeme(lexeme: path)),
       correction: Unavailable { reason: ExternalContractUnknown }
     },
     tail: [
@@ -184,7 +183,7 @@ fn source_ref_read_result_to_outcome(result: SourceRefReadResult) -> Outcome<Dag
       outcome_accepted(value: witness)
     SourceRefFilesystemReadRefused { ref: ref, error: error } =>
       Rejected {
-        diagnostics: source_ref_read_failed_diagnostic(ref: ref, error: error)
+        diagnostics: source_ref_read_failed_diagnostic(path: ref.path, error: error)
       }
     SourceRefReadHashMismatch { ref: ref, expected: _, observed: observed } =>
       Rejected {
@@ -244,7 +243,7 @@ fn source_root_ingest_from_source_refs(refs: List<SourceRef>) -> Outcome<SourceR
         Accepted { value: _, diagnostics: _ } =>
           Rejected {
             diagnostics: source_ref_read_failed_diagnostic(
-              ref: source_ref_for_storage_path(path: "source-root-ingest-build-impossible"),
+              path: "source-root-ingest-build-impossible",
               error: "internal: read-through accepted without ingest row"
             )
           }
diff --git a/src/v2/compiler/symbol_index_fill.dag b/src/v2/compiler/symbol_index_fill.dag
index bb6c5edc684..4d73f447f4b 100644
--- a/src/v2/compiler/symbol_index_fill.dag
+++ b/src/v2/compiler/symbol_index_fill.dag
@@ -49,6 +49,7 @@ import v2.std.symbol_index {
   symbol_index_lookup,
   symbol_index_mark_declared_payload,
   symbol_index_mark_declared_resource,
+  symbol_index_mark_primitive_contract,
   symbol_index_mark_declared_type_params
 }
 import v2.std.namespace_alias { ModuleBindingSource, PendingBinding }
@@ -60,6 +61,7 @@ import v2.extdeps.languages.dag {
   qualified_name_from_module_node
 }
 import v2.compiler.parse { parse_tree_projection_edge }
+import v2.compiler.primitive_authority { primitive_authority_row_is_contract_declaration }
 import v2.std.type_binder { OpaqueTypeDecl, TypeAlias, GenericTypeDecl, PlainTypeDecl, type_decl_view, type_param_names }
 import std.types { List }
 
@@ -122,7 +124,14 @@ fn symbol_index_mark_declared_binders(index: SymbolIndex, qualified_path: Qualif
 }
 
 // A labeled child declares a binding at path.segment and its members below it.
-fn symbol_index_fill_declared_child(index: SymbolIndex, path: QualifiedName, segment: Symbol, edge: Edge) -> SymbolIndex {
+fn symbol_index_fill_declared_child(
+  index: SymbolIndex,
+  path: QualifiedName,
+  segment: Symbol,
+  edge: Edge,
+  counts: Map<Symbol, Int>,
+  module_qn: QualifiedName
+) -> SymbolIndex {
   let child_path = qualified_name_snoc(qn: path, segment: segment)
   let declared = symbol_index_declared(target: symbol_index_binder_type_or_target(target: edge.target))
   let with_binding = symbol_index_mark_namespace_body_if(
@@ -138,14 +147,27 @@ fn symbol_index_fill_declared_child(index: SymbolIndex, path: QualifiedName, seg
     qualified_path: child_path,
     target: edge.target
   )
+  let with_admission = symbol_index_mark_primitive_contract_if(index: with_binding, path: path, child_path: child_path, target: edge.target)
   match declared.members {
     Present { value: member } =>
       symbol_index_fill_containment_node(
-        index: with_binding,
+        index: with_admission,
         path: child_path,
-        node: member
+        node: member,
+        counts: counts,
+        module_qn: module_qn
       )
-    Absent => with_binding
+    Absent => with_admission
+  }
+}
+
+// THE ONE ADMISSION OF A PRIMITIVE CONTRACT ROW (v2.compiler.primitive_authority): decided here, where the declaring module (`path`)
+// and the row are both in hand, and recorded for resolve and infer to read.
+fn symbol_index_mark_primitive_contract_if(index: SymbolIndex, path: QualifiedName, child_path: QualifiedName, target: Node) -> SymbolIndex {
+  if primitive_authority_row_is_contract_declaration(module_qn: path, row: target) {
+    symbol_index_mark_primitive_contract(index: index, qualified_path: child_path)
+  } else {
+    index
   }
 }
 
@@ -179,7 +201,9 @@ fn symbol_index_mark_namespace_body_if(index: SymbolIndex, qualified_path: Quali
 fn symbol_index_fill_containment_edge(
   index: SymbolIndex,
   path: QualifiedName,
-  edge: Edge
+  edge: Edge,
+  counts: Map<Symbol, Int>,
+  module_qn: QualifiedName
 ) -> SymbolIndex {
   match edge.label {
     StructuralLabel { label: _ } =>
@@ -187,28 +211,34 @@ fn symbol_index_fill_containment_edge(
         symbol_index_fill_containment_node(
           index: index,
           path: path,
-          node: edge.target
+          node: edge.target,
+          counts: counts,
+          module_qn: module_qn
         )
       } else {
-        symbol_index_fill_declared_child(index: index, path: path, segment: label_sort_key(label: edge.label), edge: edge)
+        symbol_index_fill_declared_child(index: index, path: path, segment: label_sort_key(label: edge.label), edge: edge, counts: counts, module_qn: module_qn)
       }
     Authored { name: sym } =>
       if parse_tree_projection_edge(name: sym) {
         symbol_index_fill_containment_node(
           index: index,
           path: path,
-          node: edge.target
+          node: edge.target,
+          counts: counts,
+          module_qn: module_qn
         )
       } else if sym == realization_root_label() {
         index
       } else {
-        symbol_index_fill_declared_child(index: index, path: path, segment: sym, edge: edge)
+        symbol_index_fill_declared_child(index: index, path: path, segment: sym, edge: edge, counts: counts, module_qn: module_qn)
       }
     Positional =>
       symbol_index_fill_containment_node(
         index: index,
         path: path,
-        node: edge.target
+        node: edge.target,
+        counts: counts,
+        module_qn: module_qn
       )
   }
 }
@@ -224,10 +254,12 @@ fn symbol_index_fill_containment_edge(
 fn symbol_index_fill_containment_children(
   index: SymbolIndex,
   path: QualifiedName,
-  node: Node
+  node: Node,
+  counts: Map<Symbol, Int>,
+  module_qn: QualifiedName
 ) -> SymbolIndex {
   fold(node.children, init: index, f: fn(acc, edge) {
-    symbol_index_fill_containment_edge(index: acc, path: path, edge: edge)
+    symbol_index_fill_containment_edge(index: acc, path: path, edge: edge, counts: counts, module_qn: module_qn)
   })
 }
 
@@ -236,21 +268,30 @@ fn symbol_index_fill_containment_children(
 // Conj arm: there, namespace_graft_spine_segment_edge_optional read a one-binder domain whose binder is
 // a record (an operation's ^operation_input, a fn of one record-typed parameter) as a dotted-name
 // segment, and indexed the record's fields at the Arrow's path with the binder's level erased.
+// A UNIQUE MODULE-LEVEL VARIANT SPELLING RESOLVES THROUGH THE ALIAS, AND THE ALIAS IS FILED AS A
+// BINDING TO ITS DECLARING PATH (the repair the receipt
+// a_binding_position_recorded_as_a_declaring_identity names): for a uniquely-named variant the
+// walk below files the binding in the same pass where the variant's declared path is in hand, so
+// symbol_index_declaring_path_of answers the variant's declaring path at the alias and the
+// variant's own row answers itself -- one authority, no parallel carrier map. (A second ENTRY over
+// the same arm node was the double-entry defect that row describes.)
 fn symbol_index_fill_containment_node(
   index: SymbolIndex,
   path: QualifiedName,
-  node: Node
+  node: Node,
+  counts: Map<Symbol, Int>,
+  module_qn: QualifiedName
 ) -> SymbolIndex {
   match node.kind {
     TypeNode { connective: Conj } =>
       match namespace_graft_spine_body_optional(node: node) {
         Present { value: body } =>
           fold(body.children, init: index, f: fn(acc, edge) {
-            symbol_index_fill_containment_edge(index: acc, path: path, edge: edge)
+            symbol_index_fill_containment_edge(index: acc, path: path, edge: edge, counts: counts, module_qn: module_qn)
           })
         Absent =>
           fold(node.children, init: index, f: fn(acc, edge) {
-            symbol_index_fill_containment_edge(index: acc, path: path, edge: edge)
+            symbol_index_fill_containment_edge(index: acc, path: path, edge: edge, counts: counts, module_qn: module_qn)
           })
       }
     TypeNode { connective: Disj } =>
@@ -268,11 +309,33 @@ fn symbol_index_fill_containment_node(
               qualified_path: variant_path,
               kind: VariantArmPayload
             )
-            symbol_index_fill_containment_node(
-              index: with_variant,
-              path: variant_path,
-              node: edge.target
-            )
+            if disj_variant_count_of(counts: counts, sym: sym) == 1 {
+              let alias_path = qualified_name_snoc(qn: module_qn, segment: sym)
+              symbol_index_fill_containment_node(
+                index: symbol_index_mark_declared_payload(
+                  index: symbol_index_bind_at(
+                    index: with_variant,
+                    binding_path: alias_path,
+                    declaring_path: variant_path,
+                    resolved: edge.target
+                  ),
+                  qualified_path: alias_path,
+                  kind: VariantArmPayload
+                ),
+                path: variant_path,
+                node: edge.target,
+                counts: counts,
+                module_qn: module_qn
+              )
+            } else {
+              symbol_index_fill_containment_node(
+                index: with_variant,
+                path: variant_path,
+                node: edge.target,
+                counts: counts,
+                module_qn: module_qn
+              )
+            }
           Positional => acc
         }
       })
@@ -282,26 +345,26 @@ fn symbol_index_fill_containment_node(
           match domain.kind {
             TypeNode { connective: Conj } =>
               fold(domain.children, init: index, f: fn(acc, edge) {
-                symbol_index_fill_containment_edge(index: acc, path: path, edge: edge)
+                symbol_index_fill_containment_edge(index: acc, path: path, edge: edge, counts: counts, module_qn: module_qn)
               })
-            TypeNode { connective: Atom { identity: _ } } => symbol_index_fill_containment_node(index: index, path: path, node: domain)
-            TypeNode { connective: Disj } => symbol_index_fill_containment_node(index: index, path: path, node: domain)
-            TypeNode { connective: Arrow } => symbol_index_fill_containment_node(index: index, path: path, node: domain)
-            TypeNode { connective: Cardinality } => symbol_index_fill_containment_node(index: index, path: path, node: domain)
-            TypeNode { connective: Instantiation } => symbol_index_fill_containment_node(index: index, path: path, node: domain)
-            ComputationNode { behavior: _ } => symbol_index_fill_containment_node(index: index, path: path, node: domain)
+            TypeNode { connective: Atom { identity: _ } } => symbol_index_fill_containment_node(index: index, path: path, node: domain, counts: counts, module_qn: module_qn)
+            TypeNode { connective: Disj } => symbol_index_fill_containment_node(index: index, path: path, node: domain, counts: counts, module_qn: module_qn)
+            TypeNode { connective: Arrow } => symbol_index_fill_containment_node(index: index, path: path, node: domain, counts: counts, module_qn: module_qn)
+            TypeNode { connective: Cardinality } => symbol_index_fill_containment_node(index: index, path: path, node: domain, counts: counts, module_qn: module_qn)
+            TypeNode { connective: Instantiation } => symbol_index_fill_containment_node(index: index, path: path, node: domain, counts: counts, module_qn: module_qn)
+            ComputationNode { behavior: _ } => symbol_index_fill_containment_node(index: index, path: path, node: domain, counts: counts, module_qn: module_qn)
           }
         FirstPositionalAbsent => index
       }
-    TypeNode { connective: Atom { identity: _ } } => symbol_index_fill_containment_children(index: index, path: path, node: node)
-    TypeNode { connective: Cardinality } => symbol_index_fill_containment_children(index: index, path: path, node: node)
-    TypeNode { connective: Instantiation } => symbol_index_fill_containment_children(index: index, path: path, node: node)
-    ComputationNode { behavior: _ } => symbol_index_fill_containment_children(index: index, path: path, node: node)
+    TypeNode { connective: Atom { identity: _ } } => symbol_index_fill_containment_children(index: index, path: path, node: node, counts: counts, module_qn: module_qn)
+    TypeNode { connective: Cardinality } => symbol_index_fill_containment_children(index: index, path: path, node: node, counts: counts, module_qn: module_qn)
+    TypeNode { connective: Instantiation } => symbol_index_fill_containment_children(index: index, path: path, node: node, counts: counts, module_qn: module_qn)
+    ComputationNode { behavior: _ } => symbol_index_fill_containment_children(index: index, path: path, node: node, counts: counts, module_qn: module_qn)
   }
 }
 
 fn disj_variant_count_of(counts: Map<Symbol, Int>, sym: Symbol) -> Int {
-  match v2.std.collection.map_get(counts, sym) {
+  match v2.std.collection.map_get_checked(counts, sym) {
     Accepted { value: opt, diagnostics: _ } => match opt {
       Present { value: n } => n
       Absent => 0
@@ -459,50 +522,6 @@ fn symbol_index_fill_alias_bindings(
     pending: symbol_index_alias_rows_of(module_qn: module_qn, root: root)
   )
 }
-
-fn symbol_index_fill_unique_variant_aliases(
-  index: SymbolIndex,
-  module_qn: QualifiedName,
-  root: Node
-) -> SymbolIndex {
-  let counts = disj_variant_counts_in_module(root: root)
-  fold(
-    node_subtree_nodes(root: root),
-    init: index,
-    f: fn(acc, n) {
-      match n.kind {
-        TypeNode { connective: Disj } =>
-          fold(n.children, init: acc, f: fn(a2, e) {
-            match e.label {
-              StructuralLabel { label: _ } => a2
-              Authored { name: sym } =>
-                if disj_variant_count_of(counts: counts, sym: sym) == 1 {
-                  symbol_index_mark_declared_payload(
-                    index: symbol_index_insert(
-                      index: a2,
-                      qualified_path: qualified_name_snoc(qn: module_qn, segment: sym),
-                      resolved: e.target
-                    ),
-                    qualified_path: qualified_name_snoc(qn: module_qn, segment: sym),
-                    kind: VariantArmPayload
-                  )
-                } else {
-                  a2
-                }
-              Positional => a2
-            }
-          })
-        TypeNode { connective: Atom { identity: _ } } => acc
-        TypeNode { connective: Conj } => acc
-        TypeNode { connective: Arrow } => acc
-        TypeNode { connective: Cardinality } => acc
-        TypeNode { connective: Instantiation } => acc
-        ComputationNode { behavior: _ } => acc
-      }
-    }
-  )
-}
-
 // PASS A -- WHAT THIS ROOT DECLARES. Every path here is rooted at this module's own qualified name,
 // so no other root can write it and the result does not depend on when this root is visited.
 // A RECORD IS MARKED FROM THE CARRIER, AND BY THE ARM THAT ALREADY DECIDED THE MODULE'S NAME.
@@ -529,14 +548,13 @@ fn symbol_index_fill_module_declarations(
       symbol_index_fill_resource_marks(
         index: fold_list(
         xs: record_declarations,
-        empty: symbol_index_fill_unique_variant_aliases(
-          index: symbol_index_fill_containment_node(
-            index: symbol_index_mark_module_root(index: index, qualified_path: module_qn),
-            path: module_qn,
-            node: root
-          ),
-          module_qn: module_qn,
-          root: root
+        empty: symbol_index_fill_containment_node(
+          index: symbol_index_mark_module_root(index: index, qualified_path: module_qn),
+          path: module_qn,
+          node: root,
+          counts: disj_variant_counts_in_module(root: root),
+          module_qn: module_qn
+
         ),
         cons: fn(acc, name) {
           symbol_index_mark_declared_payload(
@@ -553,6 +571,8 @@ fn symbol_index_fill_module_declarations(
   }
 }
 
+
+
 // A RESOURCE IS MARKED FROM THE CARRIER, AS A RECORD IS, by the module's own name: a lowered resource
 // has a service's Conj shape, so the containment walk cannot tell it apart (v2.compiler.body_lowering_fold
 // DeclaredResource). Its path is the containment path the walk already inserted.
diff --git a/src/v2/compiler/target_serialize.dag b/src/v2/compiler/target_serialize.dag
index 08db8c2d549..1b820fc3cd7 100644
--- a/src/v2/compiler/target_serialize.dag
+++ b/src/v2/compiler/target_serialize.dag
@@ -144,7 +144,7 @@ import v2.std.compilers.target_model {
 }
 import v2.std.collection {
   list_at_optional,
-  map_get
+  map_get_checked
 }
 import std.optional {
   Absent,
@@ -913,7 +913,7 @@ fn serialize_relation_row_nested_bounded(
   unit: Symbol,
   tokens: List<Node>
 ) -> Outcome<TargetText> {
-  match map_get(target.binding_spellings, unit) {
+  match map_get_checked(target.binding_spellings, unit) {
     Accepted { value: Present { value: unit_spelling }, diagnostics: _ } =>
       bind_outcome(
         o: serialize_relation_row_tokens_bounded(remaining: remaining, target: target, lex: lex, tokens: tokens),
diff --git a/src/v2/extdeps/languages/bash_orch_if.dag b/src/v2/extdeps/languages/bash_orch_if.dag
index fd13ee3e2da..681aeb91104 100644
--- a/src/v2/extdeps/languages/bash_orch_if.dag
+++ b/src/v2/extdeps/languages/bash_orch_if.dag
@@ -11,6 +11,10 @@ import v2.std.compilers.target_model {
 }
 import v2.std.collection { Map, empty_map, map_insert }
 import v2.std.diagnostic {
+  Accepted,
+  Rejected,
+  NonEmptyDiagnostics,
+  diagnostics_reason_lexemes,
   Diagnostic,
   ExternalContractUnknown,
   Outcome,
@@ -1043,28 +1047,36 @@ fn bash_nearest_ancestor_locate_assign_command(spec: NearestAncestorContaining)
   )
 }
 
-fn bash_nearest_ancestor_locate_cond_command(spec: NearestAncestorContaining) -> String {
-  match bash_path_predicate_target_model(
-    predicate: nearest_ancestor_while_predicate(spec: spec)
-  ) {
+// A LOWERED LEAF'S TEXT, OR ITS LOCATED REFUSAL -- NEVER THE EMPTY STRING. Run.command is a
+// String-typed seam, so a refusal cannot cross it as data; the text that crosses instead is a marker
+// that is not valid shell (so the committed-workflow drift gate goes red) and names the producing
+// symbol and the refusal's reasons. It used to be "", which said nothing about what refused, and
+// left every consumer to remember to test for it.
+fn bash_orch_if_leaf_text(producer: String, outcome: Outcome<TargetModel>) -> String {
+  match outcome {
     Accepted { value: source, diagnostics: d } =>
       match d {
         None => source.authority_source_text
-        Some { diagnostics: _ } => ""
+        Some { diagnostics: ds } => bash_orch_if_leaf_refusal(producer: producer, diagnostics: ds)
       }
-    Rejected { diagnostics: _ } => ""
+    Rejected { diagnostics: ds } => bash_orch_if_leaf_refusal(producer: producer, diagnostics: ds)
   }
 }
 
+fn bash_orch_if_leaf_refusal(producer: String, diagnostics: NonEmptyDiagnostics) -> String {
+  concat(concat(concat("__GUNBC_PATH_INTENT_LOWERING_REFUSED__ ", producer), concat(": refused (", diagnostics_reason_lexemes(diagnostics: diagnostics))), ")")
+}
+
+fn bash_nearest_ancestor_locate_cond_command(spec: NearestAncestorContaining) -> String {
+  bash_orch_if_leaf_text(
+    producer: "v2.extdeps.languages.bash_orch_if bash_nearest_ancestor_locate_cond_command",
+    outcome: bash_path_predicate_target_model(predicate: nearest_ancestor_while_predicate(spec: spec)),
+  )
+}
+
 fn bash_nearest_ancestor_locate_body_command(spec: NearestAncestorContaining) -> String {
-  match bash_dirname_ascent_target_model(
-    ascent: nearest_ancestor_while_ascent(spec: spec)
-  ) {
-    Accepted { value: source, diagnostics: d } =>
-      match d {
-        None => source.authority_source_text
-        Some { diagnostics: _ } => ""
-      }
-    Rejected { diagnostics: _ } => ""
-  }
+  bash_orch_if_leaf_text(
+    producer: "v2.extdeps.languages.bash_orch_if bash_nearest_ancestor_locate_body_command",
+    outcome: bash_dirname_ascent_target_model(ascent: nearest_ancestor_while_ascent(spec: spec)),
+  )
 }
diff --git a/src/v2/extdeps/languages/c.dag b/src/v2/extdeps/languages/c.dag
index 830381e6b02..8a1f849bbcf 100644
--- a/src/v2/extdeps/languages/c.dag
+++ b/src/v2/extdeps/languages/c.dag
@@ -1,5 +1,15 @@
 module v2.extdeps.languages.c
 
+import gunbc.crate_partition {
+  ByValueTypeCycle,
+  CompilationUnitId,
+  ModuleId,
+  PartitionInputRejected,
+  PartitionR4Refused,
+  PartitionR4Valid,
+  PartitionR4ValidityVerdict
+}
+
 import std.occurrence_identity { OccurrenceSynthetic }
 import v2.std.arrow_signature { anonymous_signature_arrow }
 import std.dissolution { DissolutionCondition, dissolution_description, unbound_dissolution }
@@ -119,11 +129,8 @@ import v2.std.host_transport {
   WorkspaceFile
 }
 import v2.std.compilers.compilation_unit {
-  ByValueTypeCycle,
   CompilationUnit,
-  CompilationUnitId,
   ModuleDag,
-  ModuleId,
   ModuleTypeDefinitionRow,
   MembersResolve,
   MembersResolveOk,
@@ -131,10 +138,6 @@ import v2.std.compilers.compilation_unit {
   PartitionFoldOk,
   PartitionFoldOutcome,
   PartitionFoldRefused,
-  PartitionInputRejected,
-  PartitionR4Refused,
-  PartitionR4Valid,
-  PartitionR4ValidityVerdict,
   ResolvedModuleInterface,
   module_unit_id,
   partition_fold_outcome,
diff --git a/src/v2/extdeps/languages/dag.dag b/src/v2/extdeps/languages/dag.dag
index e4b4bcb6d73..af7d2a0fe38 100644
--- a/src/v2/extdeps/languages/dag.dag
+++ b/src/v2/extdeps/languages/dag.dag
@@ -66,6 +66,11 @@ import v2.std.grammar {
   grammar_expr_expect,
   grammar_expr_not_predicate,
   grammar_expr_refuse_on_match,
+  grammar_expr_infix_table,
+  InfixAssociativity,
+  InfixLeft,
+  InfixNonAssociative,
+  InfixOperatorRow,
   derive_grammar_relation_row,
   derive_grammar_relation_row_node,
   formal_production_for_lhs_exact,
@@ -215,20 +220,8 @@ import v2.std.diagnostic {
 import std.algebra { Empty, list_append, list_snoc_item }
 import std.decl_ref { decl_ref }
 import std.dissolution { DissolutionCondition, retires_dissolution }
-import v2.std.integer {
-  decimal_digits_to_magnitude,
-  integer_decimal_magnitude_node,
-  integer_decimal_magnitude_node_to_int,
-  integer_int_to_decimal_string,
-  integer_int_type_node,
-  integer_string_to_decimal_digits_optional,
-  DecimalMagnitude,
-  DecimalNonZero,
-  DecimalNonZeroMagnitude,
-  Int,
-  NonZeroD1,
-  NonZeroD2
-}
+import v2.std.integer { decimal_digits_to_magnitude, integer_decimal_magnitude_node, integer_decimal_magnitude_node_to_int, integer_int_type_node, integer_string_to_decimal_digits_optional, DecimalMagnitude, DecimalNonZero, DecimalNonZeroMagnitude, Int, NonZeroD1, NonZeroD2 }
+import std.integer { int_to_decimal_string }
 import v2.std.text { String }
 import extdeps.numeric.base16 { base16_digit_rows }
 import std.unicode.types { unicode_scalar }
@@ -1493,11 +1486,11 @@ fn dag_grammar_let_sugar_expr() -> GrammarExpr {
 //
 // THE TRAILING `match_expr`/`if_expr`/`loop_expr` ALTERNATIVES WERE UNREACHABLE, AND ARE REMOVED.
 // They are reachable exactly where `binary_expr` fails and they succeed. But `binary_expr` derives
-// each of them as a complete operand -- pipe -> or -> and -> equality -> comparison -> additive ->
-// multiplicative -> unary -> postfix -> primary -> primary_expr_core -> match_expr / if_expr /
-// loop_expr, with every operator tail a `Repeat` or `Optional` that admits zero -- so wherever one
-// of them matches at a position, `binary_expr` has already matched at least that much there and the
-// ordered choice never tries them. Kept, they read as a second route to block forms that no input
+// each of them as a complete operand -- its operand is unary -> postfix -> primary ->
+// primary_expr_core -> match_expr / if_expr / loop_expr, and an operand with no operator after it is
+// a complete binary_expr (v2.std.grammar InfixTable) -- so wherever one of them matches at a
+// position, `binary_expr` has already matched at least that much there and the ordered choice never
+// tries them. Kept, they read as a second route to block forms that no input
 // can take, and as a second row emit could select backward.
 //
 // Evidence: `v2.test.parse.block_expr_as_binary_operand_parse` -- two arms red before this reorder
@@ -1567,71 +1560,51 @@ fn dag_grammar_expr_expr() -> GrammarExpr {
   )
 }
 
-fn dag_grammar_multiplicative_op_choice() -> GrammarExpr {
-  dag_grammar_choice(
-    left: dag_grammar_terminal(token_class: ^dag_token_star),
-    right: dag_grammar_choice(
-      left: dag_grammar_terminal(token_class: ^dag_token_slash),
-      right: dag_grammar_terminal(token_class: ^dag_token_percent)
-    )
-  )
-}
-
-fn dag_grammar_additive_op_choice() -> GrammarExpr {
-  dag_grammar_choice(
-    left: dag_grammar_terminal(token_class: ^dag_token_plus),
-    right: dag_grammar_terminal(token_class: ^dag_token_minus)
-  )
+// THE BINARY OPERATORS, ONE ROW EACH, WITH THE PRECEDENCE AS A BINDING POWER (higher binds tighter):
+// pipe, then `||`, `&&`, equality, comparison, additive, multiplicative. Equality and comparison do
+// not chain -- `a < b < c` refuses with NonAssociativeOperatorChain -- and every other row folds
+// left. `|>` binds LOOSEST: `a + b |> f` is `(a + b) |> f` (sharp-raven-357 ruling 2026-10-05; the
+// seed's tightest `|>`, dag/extdeps/languages/dag/syntax.dag dag_operators, is a seed defect under
+// DESIGN section 7, a declared divergence rather than a reading v2 owes). One row per token class, so
+// selecting a row is a lookup and no ordered alternative exists for the overlap roster to inspect
+// (v2.compiler.parse grammar_infix_tables_well_formed refuses a class named twice).
+fn dag_infix_row(token_class: Symbol, binding_power: Int, associativity: InfixAssociativity) -> InfixOperatorRow {
+  InfixOperatorRow { token_class: token_class, binding_power: binding_power, associativity: associativity }
 }
 
-fn dag_grammar_comparison_op_choice() -> GrammarExpr {
-  dag_grammar_choice(
-    left: dag_grammar_terminal(token_class: ^dag_token_gte),
-    right: dag_grammar_choice(
-      left: dag_grammar_terminal(token_class: ^dag_token_lte),
-      right: dag_grammar_choice(
-        left: dag_grammar_terminal(token_class: ^dag_token_lt),
-        right: dag_grammar_terminal(token_class: ^dag_token_gt)
-      )
-    )
-  )
-}
-
-fn dag_grammar_equality_op_choice() -> GrammarExpr {
-  dag_grammar_choice(
-    left: dag_grammar_terminal(token_class: ^dag_token_eq_eq),
-    right: dag_grammar_terminal(token_class: ^dag_token_neq)
-  )
-}
-
-fn dag_grammar_multiplicative_expr_helper() -> GrammarExpr {
-  dag_grammar_sequence(
-    left: dag_grammar_nonterminal(production: ^dag_production_unary_expr),
-    right: dag_grammar_repeat(
-      element: dag_grammar_sequence(
-        left: dag_grammar_multiplicative_op_choice(),
-        right: dag_grammar_nonterminal(production: ^dag_production_unary_expr)
-      )
-    )
-  )
+fn dag_infix_operators() -> List<InfixOperatorRow> {
+  [
+    dag_infix_row(token_class: ^dag_token_pipe_gt, binding_power: 1, associativity: InfixLeft),
+    dag_infix_row(token_class: ^dag_token_or_or, binding_power: 2, associativity: InfixLeft),
+    dag_infix_row(token_class: ^dag_token_and_and, binding_power: 3, associativity: InfixLeft),
+    dag_infix_row(token_class: ^dag_token_eq_eq, binding_power: 4, associativity: InfixNonAssociative),
+    dag_infix_row(token_class: ^dag_token_neq, binding_power: 4, associativity: InfixNonAssociative),
+    dag_infix_row(token_class: ^dag_token_gte, binding_power: 5, associativity: InfixNonAssociative),
+    dag_infix_row(token_class: ^dag_token_lte, binding_power: 5, associativity: InfixNonAssociative),
+    dag_infix_row(token_class: ^dag_token_lt, binding_power: 5, associativity: InfixNonAssociative),
+    dag_infix_row(token_class: ^dag_token_gt, binding_power: 5, associativity: InfixNonAssociative),
+    dag_infix_row(token_class: ^dag_token_plus, binding_power: 6, associativity: InfixLeft),
+    dag_infix_row(token_class: ^dag_token_minus, binding_power: 6, associativity: InfixLeft),
+    dag_infix_row(token_class: ^dag_token_star, binding_power: 7, associativity: InfixLeft),
+    dag_infix_row(token_class: ^dag_token_slash, binding_power: 7, associativity: InfixLeft),
+    dag_infix_row(token_class: ^dag_token_percent, binding_power: 7, associativity: InfixLeft)
+  ]
 }
 
 // A `-` THAT BEGINS A LINE AFTER A COMPLETE OPERAND REFUSES. `-` is both infix (subtraction) and
 // prefix (negation), and this grammar carries no statement terminator, so `x` then a line `-1` could
 // be `x - 1` or two statements; neither reading is safe to pick silently. The seed refuses it
 // (v1.compiler.parse is_ambiguous_prefix_infix_newline_boundary, whose dual-role set is exactly
-// `-`), and so does this row: where a `-` preceded by a line break (v2.std.grammar AfterLineBreak,
-// read from the stream's layout) stands at an additive continuation, the parse refuses at the `-`
-// with NewlineBeforeDualRoleOperator. A same-line `-` is subtraction. Every expression reaches this
-// continuation, so the rule holds for every statement form -- including a block-headed statement,
-// which is an operand since block forms are primaries of binary_expr (#12817).
-// THE REFUSAL IS A GUARD, NOT AN ALTERNATIVE. Offered as a choice alternative beside subtraction,
-// both arms began with `-` and only their order kept them apart -- the overlap the zero-ambiguity
-// ruling (2026-10-02) forbids, inlined once per expansion of this helper. As the not-predicate of a
-// refusing match it sits in SEQUENCE before the operator: it consumes nothing, it raises the
-// refusal where the line-break `-` stands (a refusal survives the predicate, v2.compiler.parse
-// parse_expr_not_predicate), and elsewhere it admits, so the continuation is one route and no
-// choice remains here to overlap.
+// `-`), and so does this table: it is the continuation guard of dag_grammar_binary_expr_expr, run at
+// every continuation point after a complete operand, so where a `-` preceded by a line break
+// (v2.std.grammar AfterLineBreak, read from the stream's layout) stands there, the parse refuses at
+// the `-` with NewlineBeforeDualRoleOperator. A same-line `-` is subtraction. Every expression reaches
+// a continuation point, so the rule holds for every statement form -- including a block-headed
+// statement, which is an operand since block forms are primaries of binary_expr (#12817).
+// THE REFUSAL IS A GUARD, NOT AN ALTERNATIVE. As the not-predicate of a refusing match it consumes
+// nothing, it raises the refusal where the line-break `-` stands (a refusal survives the predicate,
+// v2.compiler.parse parse_expr_not_predicate), and elsewhere it admits, so no choice exists here to
+// overlap (zero-ambiguity ruling 2026-10-02).
 fn dag_grammar_additive_newline_minus_guard() -> GrammarExpr {
   grammar_expr_not_predicate(
     element: grammar_expr_refuse_on_match(
@@ -1641,83 +1614,15 @@ fn dag_grammar_additive_newline_minus_guard() -> GrammarExpr {
   )
 }
 
-fn dag_grammar_additive_expr_helper() -> GrammarExpr {
-  dag_grammar_sequence(
-    left: dag_grammar_multiplicative_expr_helper(),
-    right: dag_grammar_repeat(
-      element: dag_grammar_sequence(
-        left: dag_grammar_additive_newline_minus_guard(),
-        right: dag_grammar_sequence(
-          left: dag_grammar_additive_op_choice(),
-          right: dag_grammar_multiplicative_expr_helper()
-        )
-      )
-    )
-  )
-}
-
-fn dag_grammar_comparison_expr_helper() -> GrammarExpr {
-  dag_grammar_sequence(
-    left: dag_grammar_additive_expr_helper(),
-    right: dag_grammar_optional(
-      element: dag_grammar_sequence(
-        left: dag_grammar_comparison_op_choice(),
-        right: dag_grammar_additive_expr_helper()
-      )
-    )
-  )
-}
-
-fn dag_grammar_equality_expr_helper() -> GrammarExpr {
-  dag_grammar_sequence(
-    left: dag_grammar_comparison_expr_helper(),
-    right: dag_grammar_optional(
-      element: dag_grammar_sequence(
-        left: dag_grammar_equality_op_choice(),
-        right: dag_grammar_comparison_expr_helper()
-      )
-    )
-  )
-}
-
-fn dag_grammar_and_expr_helper() -> GrammarExpr {
-  dag_grammar_sequence(
-    left: dag_grammar_equality_expr_helper(),
-    right: dag_grammar_repeat(
-      element: dag_grammar_sequence(
-        left: dag_grammar_terminal(token_class: ^dag_token_and_and),
-        right: dag_grammar_equality_expr_helper()
-      )
-    )
-  )
-}
-
-fn dag_grammar_or_expr_helper() -> GrammarExpr {
-  dag_grammar_sequence(
-    left: dag_grammar_and_expr_helper(),
-    right: dag_grammar_repeat(
-      element: dag_grammar_sequence(
-        left: dag_grammar_terminal(token_class: ^dag_token_or_or),
-        right: dag_grammar_and_expr_helper()
-      )
-    )
-  )
-}
-
-fn dag_grammar_pipe_expr_helper() -> GrammarExpr {
-  dag_grammar_sequence(
-    left: dag_grammar_or_expr_helper(),
-    right: dag_grammar_repeat(
-      element: dag_grammar_sequence(
-        left: dag_grammar_terminal(token_class: ^dag_token_pipe_gt),
-        right: dag_grammar_or_expr_helper()
-      )
-    )
-  )
-}
-
+// ONE TREE NODE PER OPERATOR APPLICATION (v2.std.grammar InfixTable;
+// docs/plans/precedence-climbing-tree-contract.md). An operand with no operator after it is captured
+// as itself; `a + b * c` is one application of `+` whose right operand is one application of `*`.
 fn dag_grammar_binary_expr_expr() -> GrammarExpr {
-  dag_grammar_pipe_expr_helper()
+  grammar_expr_infix_table(
+    operand: dag_grammar_nonterminal(production: ^dag_production_unary_expr),
+    continuation_guard: dag_grammar_additive_newline_minus_guard(),
+    operators: dag_infix_operators()
+  )
 }
 
 fn dag_grammar_unary_expr_expr() -> GrammarExpr {
@@ -2481,9 +2386,11 @@ fn dag_grammar_data_decl_expr() -> GrammarExpr {
 // A trailing comma before `]` is admitted, as dag_grammar_comma_list_expr admits it and as v1 reads
 // the list; without it every multi-line caller list written with one refused its whole module.
 // `admit_callers` is matched as an exact-word terminal and stays an ordinary identifier everywhere
-// else. The clause is consumed and then DISCARDED when the fn lowers to an Arrow: nothing on the
-// native route checks caller admission, and the stage that does adds its Arrow carrier together
-// with that consumer (gunbc.rung_drop admit_callers_discarded_on_the_native_route).
+// else. The clause is consumed when the fn lowers to an Arrow: the lowering mints the authored
+// roster onto the Arrow under the AdmitCallersEdge core marker, and v2.compiler.infer
+// infer_caller_admission_diags judges every call against it (a caller outside the list refuses,
+// never admits). The former drop gunbc.rung_drop.admit_callers_discarded_on_the_native_route is
+// retired by that carrier-plus-consumer restoration.
 // `uses net: Network, fs: Filesystem` after a fn's return clause declares the resources the fn
 // requires, as v1 02_parse parse_uses_clause reads it: one or more comma-separated entries, each a
 // name, a type and an optional parenthesised config. `uses` is matched as an exact-word terminal and
@@ -3113,28 +3020,67 @@ fn dag_grammar_resource_decl_expr() -> GrammarExpr {
   )
 }
 
-fn dag_grammar_top_level_item_expr() -> GrammarExpr {
-  dag_grammar_choice(
-    left: dag_grammar_nonterminal(production: ^dag_production_import_decl),
-    right: dag_grammar_choice(
-      left: dag_grammar_nonterminal(production: ^dag_production_alias_decl),
-      right: dag_grammar_choice(
-        left: dag_grammar_nonterminal(production: ^dag_production_type_decl),
-        right: dag_grammar_choice(
-          left: dag_grammar_nonterminal(production: ^dag_production_data_decl),
-          right: dag_grammar_choice(
-            left: dag_grammar_nonterminal(production: ^dag_production_fn_decl),
-            right: dag_grammar_choice(
-              left: dag_grammar_nonterminal(production: ^dag_production_test_fn_decl),
-              right: dag_grammar_choice(
-                left: dag_grammar_nonterminal(production: ^dag_production_service_decl),
-                right: dag_grammar_nonterminal(production: ^dag_production_resource_decl)
-              )
-            )
-          )
-        )
-      )
+// THE TOP-LEVEL DECLARATION ROWS: one list is the authority for which productions inhabit a
+// module as items, for the choice the module grammar repeats, and for which emitted identities
+// are declaration members rather than record binders.
+fn dag_grammar_top_level_item_productions() -> List<GrammarProduction> {
+  [
+    dag_grammar_production(
+      name: ^dag_production_import_decl,
+      expression: dag_grammar_import_decl_expr(),
+      emitted: ^dag_surface_import_decl
+    ),
+    dag_grammar_production(
+      name: ^dag_production_alias_decl,
+      expression: dag_grammar_alias_decl_expr(),
+      emitted: ^dag_surface_alias_decl
+    ),
+    dag_grammar_production(
+      name: ^dag_production_type_decl,
+      expression: dag_grammar_type_decl_expr(),
+      emitted: ^dag_surface_type_decl
+    ),
+    dag_grammar_production(
+      name: ^dag_production_data_decl,
+      expression: dag_grammar_data_decl_expr(),
+      emitted: ^dag_surface_data_decl
+    ),
+    dag_grammar_production(
+      name: ^dag_production_fn_decl,
+      expression: dag_grammar_fn_decl_expr(),
+      emitted: ^dag_surface_fn_decl
+    ),
+    dag_grammar_production(
+      name: ^dag_production_test_fn_decl,
+      expression: dag_grammar_test_fn_decl_expr(),
+      emitted: ^dag_surface_test_fn_decl
+    ),
+    dag_grammar_production(
+      name: ^dag_production_service_decl,
+      expression: dag_grammar_service_decl_expr(),
+      emitted: ^dag_surface_service_decl
+    ),
+    dag_grammar_production(
+      name: ^dag_production_resource_decl,
+      expression: dag_grammar_resource_decl_expr(),
+      emitted: ^dag_surface_resource_decl
     )
+  ]
+}
+
+fn dag_grammar_choice_of_production_names(names: List<Symbol>) -> GrammarExpr {
+  match names {
+    Cons { head: first, tail: rest } =>
+      fold(rest, init: dag_grammar_nonterminal(production: first), f: fn(acc, name) {
+        dag_grammar_choice(left: acc, right: dag_grammar_nonterminal(production: name))
+      })
+    Empty => dag_grammar_nonterminal(production: ^dag_production_top_level_item)
+  }
+}
+
+fn dag_grammar_top_level_item_expr() -> GrammarExpr {
+  dag_grammar_choice_of_production_names(
+    names: list_map(xs: dag_grammar_top_level_item_productions(), f: fn(p) { p.name })
   )
 }
 
@@ -3368,46 +3314,6 @@ fn dag_grammar_root() -> GrammarRoot {
     expression: dag_grammar_top_level_item_expr(),
     emitted: ^dag_surface_top_level_item
   )
-  let import_decl = dag_grammar_production(
-    name: ^dag_production_import_decl,
-    expression: dag_grammar_import_decl_expr(),
-    emitted: ^dag_surface_import_decl
-  )
-  let alias_decl = dag_grammar_production(
-    name: ^dag_production_alias_decl,
-    expression: dag_grammar_alias_decl_expr(),
-    emitted: ^dag_surface_alias_decl
-  )
-  let type_decl = dag_grammar_production(
-    name: ^dag_production_type_decl,
-    expression: dag_grammar_type_decl_expr(),
-    emitted: ^dag_surface_type_decl
-  )
-  let data_decl = dag_grammar_production(
-    name: ^dag_production_data_decl,
-    expression: dag_grammar_data_decl_expr(),
-    emitted: ^dag_surface_data_decl
-  )
-  let fn_decl = dag_grammar_production(
-    name: ^dag_production_fn_decl,
-    expression: dag_grammar_fn_decl_expr(),
-    emitted: ^dag_surface_fn_decl
-  )
-  let test_fn_decl = dag_grammar_production(
-    name: ^dag_production_test_fn_decl,
-    expression: dag_grammar_test_fn_decl_expr(),
-    emitted: ^dag_surface_test_fn_decl
-  )
-  let service_decl = dag_grammar_production(
-    name: ^dag_production_service_decl,
-    expression: dag_grammar_service_decl_expr(),
-    emitted: ^dag_surface_service_decl
-  )
-  let resource_decl = dag_grammar_production(
-    name: ^dag_production_resource_decl,
-    expression: dag_grammar_resource_decl_expr(),
-    emitted: ^dag_surface_resource_decl
-  )
   let resource_body_entry = dag_grammar_production(
     name: ^dag_production_resource_body_entry,
     expression: dag_grammar_resource_body_entry_expr(),
@@ -3823,19 +3729,12 @@ fn dag_grammar_root() -> GrammarRoot {
   )
   GrammarRoot {
     start: ^dag_production_module,
-    productions: [
-      module_prod,
-      module_header,
-      top_level_item,
-      import_decl,
-      alias_decl,
-      type_decl,
-      data_decl,
-      fn_decl,
-      test_fn_decl,
-      service_decl,
+    productions: list_append(
+      left: [module_prod, module_header, top_level_item],
+      right: list_append(
+        left: dag_grammar_top_level_item_productions(),
+        right: [
       service_body_entry,
-      resource_decl,
       resource_body_entry,
       resource_kind,
       resource_mode,
@@ -3917,7 +3816,9 @@ fn dag_grammar_root() -> GrammarRoot {
       if_expr,
       fn_literal,
       arrow_lambda
-    ],
+        ]
+      )
+    ),
     sync_tokens: dag_sync_tokens()
   }
 }
@@ -4930,10 +4831,9 @@ fn dag_node_is_float_literal_atom(node: Node) -> Bool {
 
 // Single authority for eval literal-vs-binding dispatch (v2_eval_is_literal_shaped_node projects
 // this). Fixture pick literals admit both token_class (^dag_pick_lit_*) and branded binding
-// (^dag_binding_pick_lit_*) rows — same ingest surface, two spellings. Complement bool literals
-// (^dag_complement_lit_*) are logic-ingest tokens used as scrutinee/body literals in complement
-// fixtures. dissolve-on: general body producer lands grammar-owned literal classification and this
-// roster folds into it.
+// (^dag_binding_pick_lit_*) rows — same ingest surface, two spellings. Complement/meet/join
+// fixtures use the same true/false atoms as match (dag_token_kw_true/false). dissolve-on: general
+// body producer lands grammar-owned literal classification and this roster folds into it.
 
 fn dag_symbol_is_fixture_pick_literal(id: Symbol) -> Bool {
   (id == ^dag_pick_lit_one)
@@ -4943,7 +4843,7 @@ fn dag_symbol_is_fixture_pick_literal(id: Symbol) -> Bool {
 }
 
 fn dag_symbol_is_complement_bool_literal(id: Symbol) -> Bool {
-  (id == ^dag_complement_lit_true) || (id == ^dag_complement_lit_false)
+  (id == ^dag_token_kw_true) || (id == ^dag_token_kw_false)
 }
 
 fn dag_symbol_is_fixture_record_literal_atom(id: Symbol) -> Bool {
@@ -5924,11 +5824,11 @@ fn dag_complement_match_body(
   dag_match_body_from_arms(
     scrutinee: scrutinee,
     true_arm: dag_match_arm_node(
-      pattern_lit: ^dag_complement_lit_true,
+      pattern_lit: ^dag_token_kw_true,
       body_lit: true_body_lit
     ),
     false_arm: dag_match_arm_node(
-      pattern_lit: ^dag_complement_lit_false,
+      pattern_lit: ^dag_token_kw_false,
       body_lit: false_body_lit
     )
   )
@@ -5951,16 +5851,16 @@ fn dag_complement_arrow_domain_node() -> Node {
 fn dag_complement_body_node() -> Node {
   dag_complement_match_body(
     scrutinee: dag_complement_param_scrutinee_node(),
-    true_body_lit: ^dag_complement_lit_false,
-    false_body_lit: ^dag_complement_lit_true
+    true_body_lit: ^dag_token_kw_false,
+    false_body_lit: ^dag_token_kw_true
   )
 }
 
 fn dag_complement_body_swapped_arms_node() -> Node {
   dag_complement_match_body(
     scrutinee: dag_complement_param_scrutinee_node(),
-    true_body_lit: ^dag_complement_lit_true,
-    false_body_lit: ^dag_complement_lit_false
+    true_body_lit: ^dag_token_kw_true,
+    false_body_lit: ^dag_token_kw_false
   )
 }
 
@@ -5982,9 +5882,9 @@ fn dag_complement_arrow_with_body_swapped_arms_node() -> Node {
 
 fn dag_complement_eval_subgraph_node() -> Node {
   dag_complement_match_body(
-    scrutinee: dag_type_atom_node(identity: ^dag_complement_lit_true),
-    true_body_lit: ^dag_complement_lit_false,
-    false_body_lit: ^dag_complement_lit_true
+    scrutinee: dag_type_atom_node(identity: ^dag_token_kw_true),
+    true_body_lit: ^dag_token_kw_false,
+    false_body_lit: ^dag_token_kw_true
   )
 }
 
@@ -6016,14 +5916,14 @@ fn dag_meet_body_node() -> Node {
   dag_complement_match_body(
     scrutinee: dag_complement_param_scrutinee_node(),
     true_body_lit: ^dag_binding_param_b,
-    false_body_lit: ^dag_complement_lit_false
+    false_body_lit: ^dag_token_kw_false
   )
 }
 
 fn dag_meet_body_swapped_arms_node() -> Node {
   dag_complement_match_body(
     scrutinee: dag_complement_param_scrutinee_node(),
-    true_body_lit: ^dag_complement_lit_false,
+    true_body_lit: ^dag_token_kw_false,
     false_body_lit: ^dag_binding_param_b
   )
 }
@@ -6031,7 +5931,7 @@ fn dag_meet_body_swapped_arms_node() -> Node {
 fn dag_join_body_node() -> Node {
   dag_complement_match_body(
     scrutinee: dag_complement_param_scrutinee_node(),
-    true_body_lit: ^dag_complement_lit_true,
+    true_body_lit: ^dag_token_kw_true,
     false_body_lit: ^dag_binding_param_b
   )
 }
@@ -6040,23 +5940,23 @@ fn dag_join_body_swapped_arms_node() -> Node {
   dag_complement_match_body(
     scrutinee: dag_complement_param_scrutinee_node(),
     true_body_lit: ^dag_binding_param_b,
-    false_body_lit: ^dag_complement_lit_true
+    false_body_lit: ^dag_token_kw_true
   )
 }
 
 fn dag_meet_eval_subgraph_node() -> Node {
   dag_complement_match_body(
-    scrutinee: dag_type_atom_node(identity: ^dag_complement_lit_true),
-    true_body_lit: ^dag_complement_lit_true,
-    false_body_lit: ^dag_complement_lit_false
+    scrutinee: dag_type_atom_node(identity: ^dag_token_kw_true),
+    true_body_lit: ^dag_token_kw_true,
+    false_body_lit: ^dag_token_kw_false
   )
 }
 
 fn dag_join_eval_subgraph_node() -> Node {
   dag_complement_match_body(
-    scrutinee: dag_type_atom_node(identity: ^dag_complement_lit_true),
-    true_body_lit: ^dag_complement_lit_true,
-    false_body_lit: ^dag_complement_lit_false
+    scrutinee: dag_type_atom_node(identity: ^dag_token_kw_true),
+    true_body_lit: ^dag_token_kw_true,
+    false_body_lit: ^dag_token_kw_false
   )
 }
 
@@ -6774,6 +6674,36 @@ fn parse_production_emitted_identity_optional(node: Node) -> Optional<Symbol> {
   }
 }
 
+fn dag_surface_identity_is_top_level_item(id: Symbol) -> Bool {
+  fold_list(
+    xs: dag_grammar_top_level_item_productions(),
+    empty: false,
+    cons: fn(acc, production) {
+      acc || match node_atom_identity_optional(node: production.emitted) {
+        Present { value: emitted } => emitted == id
+        Absent => false
+      }
+    }
+  )
+}
+
+// Parse identities that inhabit a module as Authored members and are not record binders:
+// the module surface and graft-body stamp as the only explicit extras, plus every emitted
+// identity of dag_grammar_top_level_item_productions. Identity only — a missing stamp is
+// false, never a Conj-shape guess (DESIGN §5: refuse the member, never widen to the container).
+fn dag_surface_identity_is_module_member(id: Symbol) -> Bool {
+  (id == ^dag_surface_module)
+    || (id == ^namespace_graft_module_body)
+    || dag_surface_identity_is_top_level_item(id: id)
+}
+
+fn dag_node_is_module_member_surface(node: Node) -> Bool {
+  match parse_production_emitted_identity_optional(node: node) {
+    Present { value: id } => dag_surface_identity_is_module_member(id: id)
+    Absent => false
+  }
+}
+
 fn dag_node_is_fn_decl(node: Node) -> Bool {
   match parse_production_emitted_identity_optional(node: node) {
     Present { value: id } => id == ^dag_surface_fn_decl
@@ -7135,18 +7065,17 @@ fn parse_qn_segment_with<T>(sym_node: Node, root: Node, seg: fn(Node, Symbol) ->
   }
 }
 
-fn parse_qn_repeat_suffix_ident_with<T>(sequence_capture: Node, root: Node, seg: fn(Node, Symbol) -> T) -> Outcome<T> {
-  match find_named_child(
-    root: sequence_capture,
-    name: ^grammar_sequence_right_node_projection
-  ) {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: ident_node, diagnostics: _ } =>
-      parse_qn_segment_with(sym_node: ident_node, root: root, seg: seg)
-  }
-}
-
-fn parse_qn_repeat_suffixes_with<T>(repeat_capture: Node, root: Node, seg: fn(Node, Symbol) -> T) -> Outcome<List<T>> {
+// ONE REPEAT-CAPTURE SPINE, by the rule above: one walker for the encoding, per-item readers on
+// top of it. THE ENCODING: a repeat capture is either an empty conj (no items) or a conj whose
+// left projection is the element sequence and whose right projection is the next capture, and each
+// element sequence's right projection is the item. The spine refuses when a projection the
+// encoding promises is missing -- a malformed spine is not an empty list -- and the item reader
+// owns every refusal about what an item is.
+fn parse_repeat_capture_items_with<T>(
+  repeat_capture: Node,
+  root: Node,
+  item: fn(Node, Node) -> Outcome<T>
+) -> Outcome<List<T>> {
   if is_empty_conj_root(n: repeat_capture) {
     outcome_accepted(value: Empty)
   } else {
@@ -7156,25 +7085,32 @@ fn parse_qn_repeat_suffixes_with<T>(repeat_capture: Node, root: Node, seg: fn(No
     ) {
       Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
       Accepted { value: head_sequence, diagnostics: _ } =>
-        match parse_qn_repeat_suffix_ident_with(sequence_capture: head_sequence, root: root, seg: seg) {
+        match find_named_child(
+          root: head_sequence,
+          name: ^grammar_sequence_right_node_projection
+        ) {
           Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-          Accepted { value: item, diagnostics: _ } =>
-            match find_named_child(
-              root: repeat_capture,
-              name: ^grammar_sequence_right_node_projection
-            ) {
+          Accepted { value: item_node, diagnostics: _ } =>
+            match item(item_node, root) {
               Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-              Accepted { value: tail, diagnostics: _ } =>
-                match parse_qn_repeat_suffixes_with(repeat_capture: tail, root: root, seg: seg) {
+              Accepted { value: item_value, diagnostics: _ } =>
+                match find_named_child(
+                  root: repeat_capture,
+                  name: ^grammar_sequence_right_node_projection
+                ) {
                   Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-                  Accepted { value: suffixes, diagnostics: tail_diag } =>
-                    outcome_with_diagnostics(
-                      value: list_append(
-                        left: Cons { head: item, tail: Empty },
-                        right: suffixes
-                      ),
-                      diagnostics: tail_diag
-                    )
+                  Accepted { value: tail, diagnostics: _ } =>
+                    match parse_repeat_capture_items_with(repeat_capture: tail, root: root, item: item) {
+                      Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
+                      Accepted { value: suffixes, diagnostics: tail_diag } =>
+                        outcome_with_diagnostics(
+                          value: list_append(
+                            left: Cons { head: item_value, tail: Empty },
+                            right: suffixes
+                          ),
+                          diagnostics: tail_diag
+                        )
+                    }
                 }
             }
         }
@@ -7182,6 +7118,14 @@ fn parse_qn_repeat_suffixes_with<T>(repeat_capture: Node, root: Node, seg: fn(No
   }
 }
 
+fn parse_qn_repeat_suffixes_with<T>(repeat_capture: Node, root: Node, seg: fn(Node, Symbol) -> T) -> Outcome<List<T>> {
+  parse_repeat_capture_items_with(
+    repeat_capture: repeat_capture,
+    root: root,
+    item: fn(n, r) { parse_qn_segment_with(sym_node: n, root: r, seg: seg) }
+  )
+}
+
 fn parse_qualified_name_segments_from_capture_with<T>(qn_capture: Node, root: Node, seg: fn(Node, Symbol) -> T) -> Outcome<List<T>> {
   match find_named_child(root: qn_capture, name: ^grammar_sequence_left_node_projection) {
     Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
@@ -7610,6 +7554,60 @@ fn namespace_graft_node_is_conj(node: Node) -> Bool {
 // would re-create the one-Named-Conj level the fill misreads.
 data namespace_graft_module_body_identity: Symbol = ^namespace_graft_module_body
 
+fn dag_identity_is_module_surface(id: Symbol) -> Bool {
+  (id == ^dag_surface_module) || (id == namespace_graft_module_body_identity)
+}
+
+// A MODULE SURFACE is identified by what the node IS: parse/emit production identity
+// dag_surface_module, the graft body's producer stamp, or a synthetic Atom whose
+// identity is dag_surface_module. A header child edge is not identity (review 77909).
+fn dag_node_is_module_surface(node: Node) -> Bool {
+  match parse_production_emitted_identity_optional(node: node) {
+    Present { value: id } => dag_identity_is_module_surface(id: id)
+    Absent =>
+      match node_atom_identity_optional(node: node) {
+        Present { value: id } => dag_identity_is_module_surface(id: id)
+        Absent => false
+      }
+  }
+}
+
+// THE RECORD-FIELD CARRIER PREDICATE the unit-modeling and lifecycle-carrier lenses share.
+// A Conj is a record-field carrier unless THIS NODE is a module surface. A sibling that
+// happens to be a module surface does not opt the whole Conj out (DESIGN §5: refuse the
+// member, never widen to the container). Other connectives are not record payloads; Disj
+// arm payloads are Conjs and are judged when those Conjs are visited.
+fn dag_node_is_record_field_carrier(node: Node) -> Bool {
+  namespace_graft_node_is_conj(node: node) && !dag_node_is_module_surface(node: node)
+}
+
+fn dag_authored_name_is_parse_production_projection(name: Symbol) -> Bool {
+  (name == ^grammar_production_identity_node_projection) ||
+    (name == ^grammar_production_captured_node_projection)
+}
+
+// Stamp edges on a MODULE SURFACE only. Same spelling on an ordinary record is a user field
+// and must still be judged (DESIGN §5: refuse, never widen).
+fn dag_edge_is_module_surface_parse_projection(carrier: Node, name: Symbol) -> Bool {
+  dag_node_is_module_surface(node: carrier) &&
+    dag_authored_name_is_parse_production_projection(name: name)
+}
+
+// Per-edge skip by identity only (DESIGN §5: refuse, never widen). A non-binder record
+// field that is an Atom or Disj must still be member_not_a_binder. fn-decl is the
+// production identity dag_surface_fn_decl (unchanged meaning for other callers).
+// test-fn identity lives only here, not in dag_node_is_fn_decl.
+fn dag_node_is_namespace_member_target(node: Node) -> Bool {
+  if dag_node_is_module_surface(node: node) || dag_node_is_fn_decl(node: node) {
+    true
+  } else {
+    match parse_production_emitted_identity_optional(node: node) {
+      Present { value: id } => id == ^dag_surface_test_fn_decl
+      Absent => false
+    }
+  }
+}
+
 // The one constructor of the marker node: emitted by namespace_graft_build_body_conj.
 // It is a surface identity atom, not a type denotation, so infer grounds it with the
 // grammar authority's surface-production type (dag_grammar_production_member_declared_type)
@@ -7863,7 +7861,7 @@ fn dag_emit_class_terminal_spelling(lex: LexRules, token_class: Symbol, captured
       Present { value: _ } =>
         bind_outcome(
           o: dag_int_literal_magnitude_int_from_node(node: captured),
-          f: fn(v) { outcome_accepted(value: integer_int_to_decimal_string(value: v)) }
+          f: fn(v) { outcome_accepted(value: int_to_decimal_string(value: v)) }
         )
     }
   } else if token_class == ^dag_token_string_literal {
diff --git a/src/v2/extdeps/languages/rust.dag b/src/v2/extdeps/languages/rust.dag
index 231a33e6917..ab47b50ee95 100644
--- a/src/v2/extdeps/languages/rust.dag
+++ b/src/v2/extdeps/languages/rust.dag
@@ -315,6 +315,7 @@ import v2.std.node {
   TypeNode,
   Instantiation,
 }
+import v2.std.node_query { binder_edge }
 import v2.std.logic { bool_node }
 import std.algebra {
   Empty,
@@ -4962,8 +4963,14 @@ fn rust_sg2_conj_source_type_node() -> Node {
   Node {
     kind: TypeNode { connective: Conj },
     children: [
-      rust_named_edge(name: ^rust_binding_sg2_x, target: rust_sg2_atom_node(binding: ^rust_binding_sg2_x)),
-      rust_named_edge(name: ^rust_binding_sg2_y, target: rust_sg2_atom_node(binding: ^rust_binding_sg2_y))
+      binder_edge(
+        name: ^rust_binding_sg2_x,
+        type_node: rust_sg2_atom_node(binding: ^rust_binding_sg2_x)
+      ),
+      binder_edge(
+        name: ^rust_binding_sg2_y,
+        type_node: rust_sg2_atom_node(binding: ^rust_binding_sg2_y)
+      )
     ],
     occurrence_id: OccurrenceSynthetic
 }
diff --git a/src/v2/extdeps/languages/rust_test_fixtures.dag b/src/v2/extdeps/languages/rust_test_fixtures.dag
index d39a8ce8804..85c0d8b1909 100644
--- a/src/v2/extdeps/languages/rust_test_fixtures.dag
+++ b/src/v2/extdeps/languages/rust_test_fixtures.dag
@@ -8,6 +8,7 @@ import std.algebra { Cons, Empty }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 
 import v2.extdeps.languages.dag { dag_bind_arrow_with_body_fixture }
+import v2.std.arrow_signature { declared_signature }
 
 import v2.extdeps.languages.rust {
   rust_add_declared_inhabitants_root,
@@ -1522,13 +1523,15 @@ fn rust_variant_construct_translation_rules_node() -> Node {
 }
 
 fn rust_variant_construct_binding_spellings() -> Map<Symbol, String> {
-  let m0 = map_insert(empty_map(), ^dag_binding_fn_one_or_two, "one_or_two")
-  let m1 = map_insert(m0, ^dag_binding_rec_lit_nine, "9")
-  let m2 = map_insert(m1, ^dag_binding_pick_lit_one, "1")
-  let m3 = map_insert(m2, ^dag_binding_pick_lit_two, "2")
-  let m4 = map_insert(m3, ^dag_binding_rec_v, "v")
-  let m5 = map_insert(m4, ^dag_binding_type_variant_holds, "Holds")
-  map_insert(m5, ^dag_binding_field_variant_value, "value")
+  let m0 = rust_binding_spellings()
+  let m1 = map_insert(m0, ^dag_binding_fn_one_or_two, "one_or_two")
+  let m2 = map_insert(m1, ^dag_binding_rec_lit_nine, "9")
+  let m3 = map_insert(m2, ^dag_binding_pick_lit_one, "1")
+  let m4 = map_insert(m3, ^dag_binding_pick_lit_two, "2")
+  let m5 = map_insert(m4, ^dag_binding_rec_v, "v")
+  let m6 = map_insert(m5, ^dag_binding_type_variant_holds, "Holds")
+  let m7 = map_insert(m6, ^dag_binding_field_variant_value, "value")
+  map_insert(m7, ^dag_binding_type_variant_true, "True")
 }
 
 fn rust_variant_construct_additional_lex_rules() -> List<LexRule> {
@@ -1542,8 +1545,11 @@ fn rust_variant_construct_additional_lex_rules() -> List<LexRule> {
 fn rust_variant_construct_lex_rules() -> LexRuleSet {
   LexRuleSet {
     rules: list_append(
-      left: rust_fn_add_lex_rules().rules,
-      right: rust_variant_construct_additional_lex_rules()
+      left: list_append(
+        left: rust_fn_add_lex_rules().rules,
+        right: rust_variant_construct_additional_lex_rules()
+      ),
+      right: rust_value_expression_family_lex_rules()
     ),
     modes: []
   }
@@ -1667,9 +1673,9 @@ fn rust_variant_construct_target_model_staging() -> TargetModel {
   }
 }
 
-data rust_logic_complement_source_text: String = "fn complement(a: Bool) -> Bool { match (a) { True => False, False => True } }"
+data rust_logic_complement_source_text: String = "fn complement(a: bool) -> bool { match (a) { true => false, false => true } }"
 
-data rust_logic_complement_swapped_arms_source_text: String = "fn complement(a: Bool) -> Bool { match (a) { True => True, False => False } }"
+data rust_logic_complement_swapped_arms_source_text: String = "fn complement(a: bool) -> bool { match (a) { true => true, false => false } }"
 
 fn rust_logic_complement_signature_with_open() -> List<ConcreteSyntaxToken> {
   [
@@ -1696,16 +1702,16 @@ fn rust_logic_complement_body_tokens() -> List<ConcreteSyntaxToken> {
   [
     FixedToken { token_class: ^rust_token_unwired_match },
     FixedToken { token_class: ^rust_token_lparen },
-    FixedToken { token_class: ^dag_binding_param_a },
+    BoundToken { token_class: ^rust_token_ident, binding: ^dag_binding_param_a },
     FixedToken { token_class: ^rust_token_rparen },
     FixedToken { token_class: ^rust_token_lbrace },
-    FixedToken { token_class: ^dag_complement_lit_true },
+    FixedToken { token_class: ^dag_token_kw_true },
     FixedToken { token_class: ^rust_token_unwired_fat_arrow },
-    FixedToken { token_class: ^dag_complement_lit_false },
+    FixedToken { token_class: ^dag_token_kw_false },
     FixedToken { token_class: ^rust_token_comma },
-    FixedToken { token_class: ^dag_complement_lit_false },
+    FixedToken { token_class: ^dag_token_kw_false },
     FixedToken { token_class: ^rust_token_unwired_fat_arrow },
-    FixedToken { token_class: ^dag_complement_lit_true },
+    FixedToken { token_class: ^dag_token_kw_true },
     FixedToken { token_class: ^rust_token_rbrace }
   ]
 }
@@ -1795,26 +1801,29 @@ fn rust_logic_complement_translation_rules_node() -> Node {
 }
 
 fn rust_logic_complement_binding_spellings() -> Map<Symbol, String> {
-  let m0 = map_insert(empty_map(), ^dag_binding_fn_complement, "complement")
-  map_insert(m0, ^dag_binding_param_a, "a")
+  let m0 = rust_binding_spellings()
+  let m1 = map_insert(m0, ^dag_binding_fn_complement, "complement")
+  map_insert(m1, ^dag_binding_param_a, "a")
 }
 
 fn rust_logic_complement_additional_lex_rules() -> List<LexRule> {
   [
     rust_lex_rule(token_class: ^rust_token_unwired_match, text: "match "),
     rust_lex_rule(token_class: ^rust_token_unwired_fat_arrow, text: " => "),
-    rust_lex_rule(token_class: ^rust_token_ty_bool, text: "Bool"),
-    rust_lex_rule(token_class: ^dag_binding_param_a, text: "a"),
-    rust_lex_rule(token_class: ^dag_complement_lit_true, text: "True"),
-    rust_lex_rule(token_class: ^dag_complement_lit_false, text: "False")
+    rust_lex_rule(token_class: ^rust_token_ty_bool, text: "bool"),
+    rust_lex_rule(token_class: ^dag_token_kw_true, text: "true"),
+    rust_lex_rule(token_class: ^dag_token_kw_false, text: "false")
   ]
 }
 
 fn rust_logic_complement_lex_rules() -> LexRuleSet {
   LexRuleSet {
     rules: list_append(
-      left: rust_fn_add_lex_rules().rules,
-      right: rust_logic_complement_additional_lex_rules()
+      left: list_append(
+        left: rust_fn_add_lex_rules().rules,
+        right: rust_logic_complement_additional_lex_rules()
+      ),
+      right: rust_value_expression_family_lex_rules()
     ),
     modes: []
   }
@@ -1883,7 +1892,7 @@ fn rust_logic_complement_target_model_bundle_core() -> Node {
   }
 }
 
-data rust_logic_complement_emit_host_main_suffix: String = "\n\nuse Bool::*;\n\nenum Bool { True, False }\n\nfn main() { let v = complement(True); let d: i32 = match v { False => 0, True => 1 }; let bytes = [0u8, (d & 0xff) as u8, ((d >> 8) & 0xff) as u8, ((d >> 16) & 0xff) as u8, ((d >> 24) & 0xff) as u8]; let _ = std::io::Write::write_all(&mut std::io::stdout(), &bytes); }\n"
+data rust_logic_complement_emit_host_main_suffix: String = "\n\nfn main() { let v = complement(true); let d: i32 = match v { false => 0, true => 1 }; let bytes = [0u8, (d & 0xff) as u8, ((d >> 8) & 0xff) as u8, ((d >> 16) & 0xff) as u8, ((d >> 24) & 0xff) as u8]; let _ = std::io::Write::write_all(&mut std::io::stdout(), &bytes); }\n"
 
 fn rust_logic_complement_host_transport_descriptor() -> HostTransportDescriptor {
   HostTransportDescriptor {
@@ -2031,11 +2040,10 @@ fn rust_bool_fn_additional_lex_rules() -> List<LexRule> {
   [
     rust_lex_rule(token_class: ^rust_token_unwired_match, text: "match "),
     rust_lex_rule(token_class: ^rust_token_unwired_fat_arrow, text: " => "),
-    rust_lex_rule(token_class: ^rust_token_ty_bool, text: "Bool"),
-    rust_lex_rule(token_class: ^dag_binding_param_a, text: "a"),
-    rust_lex_rule(token_class: ^dag_binding_param_b, text: "b"),
-    rust_lex_rule(token_class: ^dag_complement_lit_true, text: "True"),
-    rust_lex_rule(token_class: ^dag_complement_lit_false, text: "False")
+    rust_lex_rule(token_class: ^rust_token_ty_bool, text: "bool"),
+    rust_lex_rule(token_class: ^dag_token_kw_true, text: "true"),
+    rust_lex_rule(token_class: ^dag_token_kw_false, text: "false"),
+    rust_lex_rule(token_class: ^dag_binding_param_b, text: "b")
   ]
 }
 
@@ -2043,8 +2051,11 @@ fn rust_bool_fn_lex() -> LexRules {
   ModeledLexRules {
     root: LexRuleSet {
       rules: list_append(
-        left: rust_fn_add_lex_rules().rules,
-        right: rust_bool_fn_additional_lex_rules()
+        left: list_append(
+          left: rust_fn_add_lex_rules().rules,
+          right: rust_bool_fn_additional_lex_rules()
+        ),
+        right: rust_value_expression_family_lex_rules()
       ),
       modes: []
     }
@@ -2172,9 +2183,10 @@ fn rust_bool_fn_target_model(
     signature_with_open: signature_with_open,
     body_tokens: body_tokens
   )
-  let m0 = map_insert(empty_map(), fn_binding, fn_spelling)
-  let m1 = map_insert(m0, ^dag_binding_param_a, "a")
-  let binding_spellings = map_insert(m1, ^dag_binding_param_b, "b")
+  let m0 = rust_binding_spellings()
+  let m1 = map_insert(m0, fn_binding, fn_spelling)
+  let m2 = map_insert(m1, ^dag_binding_param_a, "a")
+  let binding_spellings = map_insert(m2, ^dag_binding_param_b, "b")
   TargetModel {
     produced_decl_support: ProducedDeclUnwired,
     bundle: Node {
@@ -2222,25 +2234,25 @@ fn rust_bool_binop_body_tokens(true_body: Symbol, false_body: Symbol) -> List<Co
   [
     FixedToken { token_class: ^rust_token_unwired_match },
     FixedToken { token_class: ^rust_token_lparen },
-    FixedToken { token_class: ^dag_binding_param_a },
+    BoundToken { token_class: ^rust_token_ident, binding: ^dag_binding_param_a },
     FixedToken { token_class: ^rust_token_rparen },
     FixedToken { token_class: ^rust_token_lbrace },
-    FixedToken { token_class: ^dag_complement_lit_true },
+    FixedToken { token_class: ^dag_token_kw_true },
     FixedToken { token_class: ^rust_token_unwired_fat_arrow },
     FixedToken { token_class: true_body },
     FixedToken { token_class: ^rust_token_comma },
-    FixedToken { token_class: ^dag_complement_lit_false },
+    FixedToken { token_class: ^dag_token_kw_false },
     FixedToken { token_class: ^rust_token_unwired_fat_arrow },
     FixedToken { token_class: false_body },
     FixedToken { token_class: ^rust_token_rbrace }
   ]
 }
 
-data rust_logic_meet_source_text: String = "fn meet(a: Bool, b: Bool) -> Bool { match (a) { True => b, False => False } }"
+data rust_logic_meet_source_text: String = "fn meet(a: bool, b: bool) -> bool { match (a) { true => b, false => false } }"
 
-data rust_logic_meet_swapped_arms_source_text: String = "fn meet(a: Bool, b: Bool) -> Bool { match (a) { True => False, False => b } }"
+data rust_logic_meet_swapped_arms_source_text: String = "fn meet(a: bool, b: bool) -> bool { match (a) { true => false, false => b } }"
 
-data rust_logic_meet_emit_host_main_suffix: String = "\n\nuse Bool::*;\n\nenum Bool { True, False }\n\nfn main() { let v = meet(True, True); let d: i32 = match v { False => 0, True => 1 }; let bytes = [0u8, (d & 0xff) as u8, ((d >> 8) & 0xff) as u8, ((d >> 16) & 0xff) as u8, ((d >> 24) & 0xff) as u8]; let _ = std::io::Write::write_all(&mut std::io::stdout(), &bytes); }\n"
+data rust_logic_meet_emit_host_main_suffix: String = "\n\nfn main() { let v = meet(true, true); let d: i32 = match v { false => 0, true => 1 }; let bytes = [0u8, (d & 0xff) as u8, ((d >> 8) & 0xff) as u8, ((d >> 16) & 0xff) as u8, ((d >> 24) & 0xff) as u8]; let _ = std::io::Write::write_all(&mut std::io::stdout(), &bytes); }\n"
 
 fn rust_logic_meet_target_model_staging() -> TargetModel {
   rust_bool_fn_target_model(
@@ -2250,7 +2262,7 @@ fn rust_logic_meet_target_model_staging() -> TargetModel {
     signature_with_open: rust_bool_binop_signature_with_open(fn_binding: ^dag_binding_fn_meet),
     body_tokens: rust_bool_binop_body_tokens(
       true_body: ^dag_binding_param_b,
-      false_body: ^dag_complement_lit_false
+      false_body: ^dag_token_kw_false
     ),
     production_sym: ^rust_production_fn_logic_meet,
     relation_sym: ^rust_relation_rule_fn_logic_meet,
@@ -2260,11 +2272,11 @@ fn rust_logic_meet_target_model_staging() -> TargetModel {
   )
 }
 
-data rust_logic_join_source_text: String = "fn join(a: Bool, b: Bool) -> Bool { match (a) { True => True, False => b } }"
+data rust_logic_join_source_text: String = "fn join(a: bool, b: bool) -> bool { match (a) { true => true, false => b } }"
 
-data rust_logic_join_swapped_arms_source_text: String = "fn join(a: Bool, b: Bool) -> Bool { match (a) { True => b, False => True } }"
+data rust_logic_join_swapped_arms_source_text: String = "fn join(a: bool, b: bool) -> bool { match (a) { true => b, false => true } }"
 
-data rust_logic_join_emit_host_main_suffix: String = "\n\nuse Bool::*;\n\nenum Bool { True, False }\n\nfn main() { let v = join(True, False); let d: i32 = match v { False => 0, True => 1 }; let bytes = [0u8, (d & 0xff) as u8, ((d >> 8) & 0xff) as u8, ((d >> 16) & 0xff) as u8, ((d >> 24) & 0xff) as u8]; let _ = std::io::Write::write_all(&mut std::io::stdout(), &bytes); }\n"
+data rust_logic_join_emit_host_main_suffix: String = "\n\nfn main() { let v = join(true, false); let d: i32 = match v { false => 0, true => 1 }; let bytes = [0u8, (d & 0xff) as u8, ((d >> 8) & 0xff) as u8, ((d >> 16) & 0xff) as u8, ((d >> 24) & 0xff) as u8]; let _ = std::io::Write::write_all(&mut std::io::stdout(), &bytes); }\n"
 
 fn rust_logic_join_target_model_staging() -> TargetModel {
   rust_bool_fn_target_model(
@@ -2273,7 +2285,7 @@ fn rust_logic_join_target_model_staging() -> TargetModel {
     source_text: rust_logic_join_source_text,
     signature_with_open: rust_bool_binop_signature_with_open(fn_binding: ^dag_binding_fn_join),
     body_tokens: rust_bool_binop_body_tokens(
-      true_body: ^dag_complement_lit_true,
+      true_body: ^dag_token_kw_true,
       false_body: ^dag_binding_param_b
     ),
     production_sym: ^rust_production_fn_logic_join,
@@ -2284,21 +2296,21 @@ fn rust_logic_join_target_model_staging() -> TargetModel {
   )
 }
 
-data rust_logic_family_prelude: String = "\n\nuse Bool::*;\n\nenum Bool { True, False }"
+data rust_logic_family_prelude: String = ""
 
 data rust_logic_family_member_meet: RustEmitHostFamilyMember = RustEmitHostFamilyMember {
   member_id: "meet",
-  result_expression: "match meet(True, True) { False => 0, True => 1 }"
+  result_expression: "match meet(true, true) { false => 0, true => 1 }"
 }
 
 data rust_logic_family_member_join: RustEmitHostFamilyMember = RustEmitHostFamilyMember {
   member_id: "join",
-  result_expression: "match join(True, False) { False => 0, True => 1 }"
+  result_expression: "match join(true, false) { false => 0, true => 1 }"
 }
 
 data rust_logic_family_member_complement: RustEmitHostFamilyMember = RustEmitHostFamilyMember {
   member_id: "complement",
-  result_expression: "match complement(True) { False => 0, True => 1 }"
+  result_expression: "match complement(true) { false => 0, true => 1 }"
 }
 
 fn rust_logic_family_dispatch_members() -> List<RustEmitHostFamilyMember> {
@@ -2402,7 +2414,7 @@ fn rust_logic_selected_bundle_target_model_staging() -> TargetModel {
 
 data rust_logic_family_member_meet_zero: RustEmitHostFamilyMember = RustEmitHostFamilyMember {
   member_id: "meet",
-  result_expression: "match meet(True, False) { False => 0, True => 1 }"
+  result_expression: "match meet(true, false) { false => 0, true => 1 }"
 }
 
 fn rust_logic_family_dispatch_members_meet_zero() -> List<RustEmitHostFamilyMember> {
@@ -3429,10 +3441,12 @@ fn rust_arrow_with_body_node(
   return_type_binding: Symbol,
   body: Node
 ) -> Node {
+  let domain = rust_nullary_arrow_domain_conj_node()
+  let signature = declared_signature(params: domain.children, source: domain)
   Node {
     kind: TypeNode { connective: Arrow },
     children: [
-      Edge { label: Positional, target: rust_nullary_arrow_domain_conj_node() },
+      signature.domain,
       Edge {
         label: Positional,
         target: rust_type_atom_node(identity: return_type_binding)
@@ -3441,6 +3455,7 @@ fn rust_arrow_with_body_node(
         label: Positional,
         target: rust_type_atom_node(identity: return_type_binding)
       },
+      signature.order,
       Edge { label: core_edge_label(marker: ArrowBodyEdge), target: body }
     ],
     occurrence_id: OccurrenceSynthetic
diff --git a/src/v2/extdeps/runtimes/v2_effect_io_pure.dag b/src/v2/extdeps/runtimes/v2_effect_io_pure.dag
index a33056d75c6..a31f3441d67 100644
--- a/src/v2/extdeps/runtimes/v2_effect_io_pure.dag
+++ b/src/v2/extdeps/runtimes/v2_effect_io_pure.dag
@@ -9,7 +9,7 @@ import v2.std.collection {
   Present,
   empty_map,
   list_nth,
-  map_get,
+  map_get_checked,
   map_insert
 }
 import v2.std.diagnostic {
@@ -202,7 +202,7 @@ fn effect_io_pure_store_lookup(
   locator: EffectIoResourceLocator
 ) -> Outcome<RuntimeValue> {
   if effect_io_pure_backends_match(left: locator.backend, right: store.backend) {
-    match map_get(m: store.entries, key: locator.identity) {
+    match map_get_checked(m: store.entries, key: locator.identity) {
       Accepted { value: opt, diagnostics: d } =>
         match opt {
           Present { value: payload } =>
diff --git a/src/v2/lens/affected_set.dag b/src/v2/lens/affected_set.dag
index c6ad9e219f5..38272ddaaee 100644
--- a/src/v2/lens/affected_set.dag
+++ b/src/v2/lens/affected_set.dag
@@ -4,7 +4,7 @@ import std.occurrence_identity { OccurrenceSynthetic }
 import v2.lens.common.construction_justification { ConstructionJustification, WallAfterGrounding }
 import std.disposition { SingleAuthority }
 
-import v2.std.collection { Absent, Map, Present, list_at_optional, map_get, map_insert }
+import v2.std.collection { Absent, Map, Present, list_at_optional, map_get_checked, map_insert }
 import v2.std.algebra { TailAbsent, TailFound, contains, length, list_tail }
 import std.algebra { list_append, list_snoc_item }
 import v2.compiler.infer { InferredTree }
@@ -590,7 +590,7 @@ fn mark_excluded(frontier: ReExecFrontier, key: ExclusionKey, proof: Propagation
     FailClosed { reason: e } => FailClosed { reason: e }
     ChangedSubgraphFrontier { boundary_exclusions: boundary_exclusions, decisions: decisions } =>
 
-      match map_get(decisions, key) {
+      match map_get_checked(decisions, key) {
         Accepted { value: opt, diagnostics: _ } => match opt {
           Present { value: decision } =>
             match decision {
diff --git a/src/v2/lens/complexity_accumulator_copy/corpus_census.dag b/src/v2/lens/complexity_accumulator_copy/corpus_census.dag
index c327036bade..3f68231473e 100644
--- a/src/v2/lens/complexity_accumulator_copy/corpus_census.dag
+++ b/src/v2/lens/complexity_accumulator_copy/corpus_census.dag
@@ -61,7 +61,8 @@ import v2.std.node {
 import v2.std.diagnostic { Accepted, Rejected }
 import v2.std.node_query { find_arrow_body_child, find_named_child }
 import v2.std.witness { Holds, Violates }
-import v2.std.integer { Int, integer_int_to_decimal_string }
+import v2.std.integer { Int }
+import std.integer { int_to_decimal_string }
 import v2.lens.common.source_analysis_standing {
   LanguageGrammarRejected,
   LanguageGrammarUnavailable,
@@ -259,8 +260,8 @@ fn census_tsv_line_for_path(path: String) -> String {
         concat(
           "\tscanned\t",
           concat(
-            integer_int_to_decimal_string(value: s),
-            concat("\t", integer_int_to_decimal_string(value: r))
+            int_to_decimal_string(value: s),
+            concat("\t", int_to_decimal_string(value: r))
           )
         )
       )
diff --git a/src/v2/lens/fact_density.dag b/src/v2/lens/fact_density.dag
index 67e201b7d23..d8b273dacc3 100644
--- a/src/v2/lens/fact_density.dag
+++ b/src/v2/lens/fact_density.dag
@@ -2,6 +2,7 @@ module v2.lens.fact_density
 
 import std.nat { Nat, Succ, Zero }
 import v2.std.node { Authored, StructuralLabel }
+import v2.extdeps.languages.dag { dag_node_is_module_surface }
 import v2.lens.common.construction_justification { ConstructionJustification }
 
 import v2.std.witness { Holds }
@@ -61,10 +62,14 @@ fn connective_spec_fact(c: Connective, named_facts: Nat) -> SourceSpecReadFact {
 }
 
 fn carrier_spec_fact(carrier: Node) -> SourceSpecReadFact {
-  match carrier.kind {
-    ComputationNode { behavior: _ } => NotATypeCarrier
-    TypeNode { connective: c } =>
-      connective_spec_fact(c: c, named_facts: named_fact_count(children: carrier.children))
+  if dag_node_is_module_surface(node: carrier) {
+    NotATypeCarrier
+  } else {
+    match carrier.kind {
+      ComputationNode { behavior: _ } => NotATypeCarrier
+      TypeNode { connective: c } =>
+        connective_spec_fact(c: c, named_facts: named_fact_count(children: carrier.children))
+    }
   }
 }
 // Node-local predicate (DESIGN 6 bare-minimum-cost): carrier_spec_fact reads only the node's direct
diff --git a/src/v2/lens/grounding.dag b/src/v2/lens/grounding.dag
index 2a59efd6f44..ae49484c88e 100644
--- a/src/v2/lens/grounding.dag
+++ b/src/v2/lens/grounding.dag
@@ -10,6 +10,12 @@ import v2.lens.common.construction_justification {
 }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import std.disposition { SingleAuthority }
+import v2.std.node { Node, symbol_lexeme }
+import v2.std.concept_index { ConceptByName, ConceptDecl, ConceptStruct, FieldRef, QualifiedConcept, build_concept_name_index, concept_from_decl, enumerate_concepts_from_decls }
+import v2.std.layer { LayerPrefix, LayerPrefixCompiler, LayerPrefixExtdeps, LayerPrefixStd, LayerPrefixWorkflow, layer_prefix_from_dotted_qualified_name }
+import v2.std.node_query { coproduct_arm_list_from_node, coproduct_arm_payload_pair_from_arm, node_is_coproduct }
+import v2.std.algebra { fold_list, is_prefix_of }
+import gunbc.ci_layer_roots { witness_layer_roots }
 
 data construction_justification: ConstructionJustification = ConstructionJustification {
   class: WallAfterGrounding { dissolves_to: SingleAuthority }
@@ -151,7 +157,7 @@ fn sibling_variant_names(node: Node) -> String {
   } else {
     fold(coproduct_arm_list_from_node(node: node), init: "", f: fn(acc, arm) {
       let pair = coproduct_arm_payload_pair_from_arm(arm: arm)
-      let piece = "{pair.label}"
+      let piece = symbol_lexeme(sym: pair.label)
       if acc == "" { piece } else { concat(acc, concat(", ", piece)) }
     })
   }
@@ -163,7 +169,7 @@ fn sibling_has_unrecognized_variant(node: Node) -> Bool {
   } else {
     fold(coproduct_arm_list_from_node(node: node), init: false, f: fn(acc, arm) {
       let pair = coproduct_arm_payload_pair_from_arm(arm: arm)
-      acc || name_has_unrecognized_prefix(name: "{pair.label}")
+      acc || name_has_unrecognized_prefix(name: symbol_lexeme(sym: pair.label))
     })
   }
 }
@@ -174,7 +180,7 @@ fn sibling_decode_optional_present(node: Node) -> Bool {
   } else {
     fold(coproduct_arm_list_from_node(node: node), init: false, f: fn(acc, arm) {
       let pair = coproduct_arm_payload_pair_from_arm(arm: arm)
-      acc || str_starts_with(s: "{pair.payload_type_name}", prefix: "Optional")
+      acc || str_starts_with(s: symbol_lexeme(sym: pair.payload_type_name), prefix: "Optional")
     })
   }
 }
diff --git a/src/v2/lens/lifecycle_carrier.dag b/src/v2/lens/lifecycle_carrier.dag
index 230468660b2..fba28b5bfd5 100644
--- a/src/v2/lens/lifecycle_carrier.dag
+++ b/src/v2/lens/lifecycle_carrier.dag
@@ -14,17 +14,20 @@ import v2.std.diagnostic {
 }
 import v2.std.witness { Holds, Witness }
 import v2.std.node {
-  ComputationNode,
   Edge,
   Authored,
   Node,
   Positional,
   Symbol,
-  TypeNode,
   symbol_lexeme,
   StructuralLabel,
 }
 import v2.std.node_query { edge_field_type_name, member_edge_type_node, member_not_a_binder_diagnostic }
+import v2.extdeps.languages.dag {
+  dag_edge_is_module_surface_parse_projection,
+  dag_node_is_namespace_member_target,
+  dag_node_is_record_field_carrier
+}
 import std.optional {
   Absent,
   Optional,
@@ -115,14 +118,23 @@ fn lifecycle_carrier_diagnostic(carrier: Node) -> Diagnostic {
 fn field_lifecycle_violation(carrier: Node, edge: Edge) -> Optional<Diagnostic> {
   match edge.label {
     Authored { name: nm } =>
-      match member_edge_type_node(e: edge) {
-        Absent => optional_present(value: member_not_a_binder_diagnostic(e: edge))
-        Present { value: t } =>
-          if type_is_bare_string(target: t) && name_is_lifecycle_field(name: nm) {
-            optional_present(value: lifecycle_carrier_diagnostic(carrier: carrier))
-          } else {
-            optional_absent()
-          }
+      if dag_edge_is_module_surface_parse_projection(carrier: carrier, name: nm) {
+        optional_absent()
+      } else {
+        match member_edge_type_node(e: edge) {
+          Absent =>
+            if dag_node_is_namespace_member_target(node: edge.target) {
+              optional_absent()
+            } else {
+              optional_present(value: member_not_a_binder_diagnostic(e: edge))
+            }
+          Present { value: t } =>
+            if type_is_bare_string(target: t) && name_is_lifecycle_field(name: nm) {
+              optional_present(value: lifecycle_carrier_diagnostic(carrier: carrier))
+            } else {
+              optional_absent()
+            }
+        }
       }
     StructuralLabel { label: _ } => optional_absent()
     Positional => optional_absent()
@@ -130,12 +142,12 @@ fn field_lifecycle_violation(carrier: Node, edge: Edge) -> Optional<Diagnostic>
 }
 
 fn carrier_first_lifecycle_violation(carrier: Node) -> Optional<Diagnostic> {
-  match carrier.kind {
-    TypeNode { connective: _ } =>
-      fold(carrier.children, init: optional_absent(), f: fn(acc, edge) {
-        optional_prefer_first_present(left: acc, right: field_lifecycle_violation(carrier: carrier, edge: edge))
-      })
-    ComputationNode { behavior: _ } => Absent
+  if dag_node_is_record_field_carrier(node: carrier) {
+    fold(carrier.children, init: optional_absent(), f: fn(acc, edge) {
+      optional_prefer_first_present(left: acc, right: field_lifecycle_violation(carrier: carrier, edge: edge))
+    })
+  } else {
+    optional_absent()
   }
 }
 
diff --git a/src/v2/lens/live_read_classification.dag b/src/v2/lens/live_read_classification.dag
index 6b124425cd0..8ea773fca33 100644
--- a/src/v2/lens/live_read_classification.dag
+++ b/src/v2/lens/live_read_classification.dag
@@ -30,7 +30,7 @@ import v2.lens.module_graph {
   module_declaration_facts_live,
   path_matches_touched
 }
-import v2.std.integer { integer_int_to_decimal_string }
+import std.integer { int_to_decimal_string }
 import v2.std.live_read { LiveReadUnestablished }
 import v2.std.text { string_eq }
 
@@ -547,7 +547,7 @@ fn live_read_selection_of(classification: LiveReadClassification) -> LiveReadSel
       LiveReadSelectionRefused {
         cause: concat(
           "G2 call walk met applications it could not read, so no classification was established: ",
-          integer_int_to_decimal_string(value: length(xs: r))
+          int_to_decimal_string(value: length(xs: r))
         )
       }
     LocalRead => LiveReadSelectionClassified { classification: classification }
diff --git a/src/v2/lens/mandatory_tag.dag b/src/v2/lens/mandatory_tag.dag
index 1109ea06f9c..25f70a88c6c 100644
--- a/src/v2/lens/mandatory_tag.dag
+++ b/src/v2/lens/mandatory_tag.dag
@@ -25,10 +25,36 @@ import v2.std.diagnostic {
   node_locus,
   outcome_accepted
 }
-import v2.std.node { Atom, Edge, Node, NodeFold, Symbol, TypeNode, fold_node }
+import v2.std.node {
+  ArrowBodyEdge,
+  Atom,
+  Authored,
+  ComputationNode,
+  StructuralLabel,
+  Edge,
+  Node,
+  NodeFold,
+  Positional,
+  Symbol,
+  TypeNode,
+  core_edge_label,
+  fold_node,
+  node_is_arrow
+}
 import v2.std.node_query { find_named_child }
 import v2.std.qualified_name { QualifiedName, qualified_name_to_dotted_string }
 import v2.std.text { String }
+import v2.compiler.namespace_graft { namespace_graft_module_body_optional }
+import v2.std.member_declaration_kind {
+  DeclaredDataMember,
+  DeclaredFnMember,
+  MemberKindChannel,
+  MemberKindDeclared,
+  MemberKindNotDeclared,
+  MemberKindProvenanceUnavailable,
+  member_kind_lookup,
+  no_member_declaration_kinds
+}
 import v2.std.witness { Holds, Witness }
 import v2.std.grammar { node_atom_identity_optional }
 import v2.extdeps.languages.dag {
@@ -52,6 +78,11 @@ import v2.extdeps.languages.dag {
 // same-path shadow module is unwritable upstream of this gate. Grain: root - one rooted whole-tree
 // walk locating dag_surface_module wrappers; per-module work is a bounded read of one small
 // declaration subtree, never a per-node subtree re-walk (the required_lens_grain_note O(n^2) bar).
+// Door grain (validate_then_compile / compile_source_root_ingest_with_admission) still
+// refuses a trivial module at member_not_a_binder on the unmarked QN spine. That is
+// not claimed green here (DESIGN §4b(1); review 77921). find_witness_reason_no_candidate
+// is infer, before lenses, and is not inhabitance (DESIGN §3). The member-kind channel
+// that would classify the spine is gunbc#13513.
 // Corpus grain: the same fold is consumed at parse grain by the live witness in
 // src/v2/test/claim/long/mandatory_tag_extdeps_corpus_test.dag over dag/extdeps/** via
 // filesystem_list_dag_files + filesystem_read + the v2 grammar - the Node-tree projection that
@@ -90,13 +121,12 @@ import v2.extdeps.languages.dag {
 // non-external, the old NonExternalAnchorScheme refusal). The tagged declaration's value subtree is
 // scanned for vocabulary atoms: any non-accepted atom refuses; none found refuses IF the value
 // region structurally carries its expression content (dag_surface_expr productions present -
-// parse-shaped and emit-shaped trees), and is out of representation IF the region carries no
-// expression productions (03_normalize currently collapses data-decl value internals to bare token
-// markers - the general-body-producer frontier, docs/plans/general-body-producer-design.md). The
-// out-of-representation arm contributes no finding at THIS grain because the fact is absent from
-// the carrier, not because the check widened - the corpus witness enforces the same rule at parse
-// grain, where value content is always present, so scheme enforcement stays whole-corpus while the
-// normalize-grain representation matures.
+// parse-shaped and emit-shaped trees) and when the declaration is a lowered Arrow member, whose
+// initializer body is its value content. A tree whose declaration carries neither is out of
+// representation and contributes no finding, because the fact is absent from the carrier, not
+// because the check widened. Since normalize lowers a data declaration to a named Arrow
+// (body_lower_data_decl_to_member) the normalized and inferred grains carry the value, so scheme
+// enforcement holds there too (see the lowered carrier shape beside mandatory_tag_decl_type_node).
 
 type MandatoryTagRegion {
   region_dotted_prefix: String
@@ -299,18 +329,83 @@ fn mandatory_tag_decl_name(d: Node) -> MandatoryTagDeclName {
   }
 }
 
+// THE LOWERED CARRIER SHAPE. Normalize lowers a `data` declaration to a named nullary Arrow member
+// (v2.compiler.body_lowering_fold body_lower_data_decl_to_member, 2026-09-24, #12197): the
+// dag_surface_data_decl production is consumed and the declaration stands as a Conj member whose
+// Authored edge carries the declared name and targets an Arrow whose domain is the first Positional
+// child, whose codomain is the second (body_lower_callable_arrow), and whose initializer is the
+// ArrowBodyEdge target. The root lens grain runs over the inferred tree, so this is the shape the
+// compile door actually hands this gate; a reader of only the parse and emit shapes finds no
+// declaration and reports every well-tagged module as missing its tag.
+type MandatoryTagPositionalScan {
+  seen: Int
+  second: Optional<Node>
+}
+
+fn mandatory_tag_lowered_codomain(d: Node) -> Optional<Node> {
+  let scan = fold(d.children, init: MandatoryTagPositionalScan { seen: 0, second: optional_absent() }, f: fn(acc, e) {
+    match e.label {
+      Positional =>
+        MandatoryTagPositionalScan {
+          seen: acc.seen + 1,
+          second: if acc.seen == 1 { optional_present(value: e.target) } else { acc.second }
+        }
+      Authored { name: _ } => acc
+      StructuralLabel { label: _ } => acc
+    }
+  })
+  scan.second
+}
+
+fn mandatory_tag_lowered_body(d: Node) -> Optional<Node> {
+  fold(d.children, init: optional_absent(), f: fn(acc, e) {
+    if e.label == core_edge_label(marker: ArrowBodyEdge) { optional_present(value: e.target) } else { acc }
+  })
+}
+
+// A DIRECT top-level member of the module body: an Authored edge on the grafted module body (never a
+// descendant of a member, so a nested Arrow-valued member of the same name is not it) whose target is an
+// Arrow. That a lowered Arrow is a DATA declaration is not readable here -- a zero-argument fn lowers to the
+// same shape -- so this finds the candidate and the member-kind channel decides what it is.
+fn mandatory_tag_lowered_member(module_node: Node, required_name: Symbol) -> Optional<Node> {
+  match namespace_graft_module_body_optional(root: module_node) {
+    Absent => optional_absent()
+    Present { value: body } =>
+      fold(body.children, init: optional_absent(), f: fn(acc, e) {
+        match e.label {
+          Authored { name: nm } =>
+            if (nm == required_name) && node_is_arrow(n: e.target) {
+              optional_present(value: e.target)
+            } else {
+              acc
+            }
+          StructuralLabel { label: _ } => acc
+          Positional => acc
+        }
+      })
+  }
+}
+
 fn mandatory_tag_decl_type_node(d: Node) -> Optional<Node> {
+  if node_is_arrow(n: d) {
+    mandatory_tag_lowered_codomain(d: d)
+  } else {
   match find_named_child(root: d, name: ^dag_surface_data_decl_type) {
     Accepted { value: ty, diagnostics: _ } => optional_present(value: ty)
     Rejected { diagnostics: _ } => mandatory_tag_parse_type_node(d: d)
   }
+  }
 }
 
 fn mandatory_tag_decl_value_node(d: Node) -> Optional<Node> {
+  if node_is_arrow(n: d) {
+    mandatory_tag_lowered_body(d: d)
+  } else {
   match find_named_child(root: d, name: ^dag_surface_data_decl_expr) {
     Accepted { value: v, diagnostics: _ } => optional_present(value: v)
     Rejected { diagnostics: _ } => mandatory_tag_parse_value_node(d: d)
   }
+  }
 }
 
 type MandatoryTagDeclScan {
@@ -355,6 +450,14 @@ fn mandatory_tag_missing_decl_diagnostic(module_node: Node) -> Diagnostic {
   }
 }
 
+fn mandatory_tag_member_provenance_unavailable_diagnostic(module_node: Node) -> Diagnostic {
+  Diagnostic {
+    reason: ^mandatory_tag_member_provenance_unavailable,
+    at: node_locus(node: module_node),
+    correction: Unavailable { reason: ExternalContractUnknown }
+  }
+}
+
 fn mandatory_tag_projection_gated_diagnostic(module_node: Node) -> Diagnostic {
   Diagnostic {
     reason: ^mandatory_tag_name_projection_gated,
@@ -422,7 +525,7 @@ fn mandatory_tag_value_findings(d: Node, region: MandatoryTagRegion) -> List<Dia
       )
       match value_hits {
         Empty =>
-          if mandatory_tag_subtree_has_production(n: v, want: ^dag_surface_expr) {
+          if node_is_arrow(n: d) || mandatory_tag_subtree_has_production(n: v, want: ^dag_surface_expr) {
             [mandatory_tag_value_unreadable_diagnostic(d: d)]
           } else {
             []
@@ -441,10 +544,45 @@ fn mandatory_tag_value_findings(d: Node, region: MandatoryTagRegion) -> List<Dia
   }
 }
 
+// A lowered Arrow candidate classified by the channel. Data: the declaration's codomain and body are
+// REQUIRED -- a positively identified data declaration missing either refuses, it is never an empty finding
+// set. Fn, or not declared by this module: the candidate is not a data declaration, so the required one is
+// missing. Unavailable: the provenance that would say which it is was never read for this module.
+fn mandatory_tag_lowered_candidate_findings(
+  region: MandatoryTagRegion,
+  module_node: Node,
+  dotted: String,
+  candidate: Node,
+  channel: MemberKindChannel
+) -> List<Diagnostic> {
+  match member_kind_lookup(channel: channel, module: dotted, name: region.required_decl_name) {
+    MemberKindProvenanceUnavailable => [mandatory_tag_member_provenance_unavailable_diagnostic(module_node: module_node)]
+    MemberKindNotDeclared => [mandatory_tag_missing_decl_diagnostic(module_node: module_node)]
+    MemberKindDeclared { kind: kind } =>
+      match kind {
+        DeclaredFnMember => [mandatory_tag_missing_decl_diagnostic(module_node: module_node)]
+        DeclaredDataMember =>
+          match mandatory_tag_lowered_codomain(d: candidate) {
+            Absent => [mandatory_tag_type_mismatch_diagnostic(d: candidate)]
+            Present { value: _ } =>
+              match mandatory_tag_lowered_body(d: candidate) {
+                Absent => [mandatory_tag_value_unreadable_diagnostic(d: candidate)]
+                Present { value: _ } =>
+                  concat(
+                    mandatory_tag_type_findings(d: candidate, region: region),
+                    mandatory_tag_value_findings(d: candidate, region: region)
+                  )
+              }
+          }
+      }
+  }
+}
+
 fn mandatory_tag_region_module_findings(
   region: MandatoryTagRegion,
   module_node: Node,
-  dotted: String
+  dotted: String,
+  channel: MemberKindChannel
 ) -> List<Diagnostic> {
   if mandatory_tag_region_applies(region: region, dotted: dotted) {
     let scan = mandatory_tag_scan_decls(
@@ -459,7 +597,17 @@ fn mandatory_tag_region_module_findings(
         )
       Absent =>
         if scan.projection_gated_count == 0 {
-          [mandatory_tag_missing_decl_diagnostic(module_node: module_node)]
+          match mandatory_tag_lowered_member(module_node: module_node, required_name: region.required_decl_name) {
+            Absent => [mandatory_tag_missing_decl_diagnostic(module_node: module_node)]
+            Present { value: candidate } =>
+              mandatory_tag_lowered_candidate_findings(
+                region: region,
+                module_node: module_node,
+                dotted: dotted,
+                candidate: candidate,
+                channel: channel
+              )
+          }
         } else {
           [mandatory_tag_projection_gated_diagnostic(module_node: module_node)]
         }
@@ -469,7 +617,7 @@ fn mandatory_tag_region_module_findings(
   }
 }
 
-fn mandatory_tag_module_findings(n: Node) -> List<Diagnostic> {
+fn mandatory_tag_module_findings(n: Node, channel: MemberKindChannel) -> List<Diagnostic> {
   if mandatory_tag_node_production_is(n: n, want: ^dag_surface_module) {
     match qualified_name_from_module_node(root: n) {
       Rejected { diagnostics: _ } => []
@@ -481,7 +629,8 @@ fn mandatory_tag_module_findings(n: Node) -> List<Diagnostic> {
             mandatory_tag_region_module_findings(
               region: region,
               module_node: n,
-              dotted: dotted
+              dotted: dotted,
+              channel: channel
             )
           )
         })
@@ -496,22 +645,32 @@ fn mandatory_tag_module_findings(n: Node) -> List<Diagnostic> {
 // malformed module headers upstream of every root lens, so the nameless-wrapper arm is unreachable
 // on a tree that reached the lens roster; keying region membership on a fabricated name would be
 // the fabricated-plausible-output trap the arm avoids.
-fn mandatory_tag_findings(root: Node) -> List<Diagnostic> {
+fn mandatory_tag_findings_with_provenance(root: Node, channel: MemberKindChannel) -> List<Diagnostic> {
   fold_node(
     n: root,
     algebra: NodeFold {
-      init: fn(n0) { mandatory_tag_module_findings(n: n0) },
+      init: fn(n0) { mandatory_tag_module_findings(n: n0, channel: channel) },
       step: fn(acc, _edge, child) { concat(acc, child) }
     }
   )
 }
 
+// The parse/emit grain: no provenance is read, so a lowered candidate refuses as provenance-unavailable.
+fn mandatory_tag_findings(root: Node) -> List<Diagnostic> {
+  mandatory_tag_findings_with_provenance(root: root, channel: no_member_declaration_kinds())
+}
+
 fn mandatory_tag_findings_count(root: Node) -> Int {
   length(xs: mandatory_tag_findings(root: root))
 }
 
 fn mandatory_tag_compile_gate(node: Node) -> Outcome<Witness<Node>> {
-  match mandatory_tag_findings(root: node) {
+  mandatory_tag_compile_gate_with_provenance(node: node, channel: no_member_declaration_kinds())
+}
+
+// The compile door's entry: the channel is the member-kind provenance ResolvedTree carries for this subject.
+fn mandatory_tag_compile_gate_with_provenance(node: Node, channel: MemberKindChannel) -> Outcome<Witness<Node>> {
+  match mandatory_tag_findings_with_provenance(root: node, channel: channel) {
     Cons { head: first, tail: rest } =>
       Rejected {
         diagnostics: NonEmptyDiagnostics { head: first, tail: rest }
diff --git a/src/v2/lens/manufactured_dependency_census.dag b/src/v2/lens/manufactured_dependency_census.dag
index 050063031e3..3b917ef15b5 100644
--- a/src/v2/lens/manufactured_dependency_census.dag
+++ b/src/v2/lens/manufactured_dependency_census.dag
@@ -103,7 +103,7 @@ fn import_targets_by_path(edges: List<ImportResolutionFact>) -> Map<String, List
 // constructor is `Accepted`, so that `Rejected` arm was UNCONSTRUCTIBLE: no fixture can hand the
 // compiler a source that produces one, which is why declining to enrol a probe for it is not
 // specification-without-execution. `v2.std.collection` says the same thing at the declaration --
-// a caller reaching for `map_get` must match an arm no producer can construct, and binds it to
+// a caller reaching for `map_get_checked` must match an arm no producer can construct, and binds it to
 // whichever domain answer is nearest, which is exactly what happened here.
 //
 // Calling the total `map_lookup` removes the arm from the return type instead of disposing of it
diff --git a/src/v2/lens/module_graph.dag b/src/v2/lens/module_graph.dag
index 238f781bd8d..f526ec85d89 100644
--- a/src/v2/lens/module_graph.dag
+++ b/src/v2/lens/module_graph.dag
@@ -12,7 +12,7 @@ import v2.std.algebra { any, contains, fold_list, is_empty, list_reverse }
 import v2.std.collection {
   Map,
   empty_map,
-  map_get,
+  map_get_checked,
   map_insert
 }
 import std.optional {
@@ -56,7 +56,10 @@ import v2.compiler.resolution_provenance {
 }
 import v2.compiler.source_authority {
   SourceRef,
+  SourceRootArgumentAdmitted,
+  SourceRootArgumentUnrecognized,
   SourceRootIngest,
+  admit_source_root_argument,
   source_ref_for_storage_path
 }
 import v2.compiler.source_authority_read { source_root_ingest_from_source_refs }
@@ -272,12 +275,67 @@ fn reference_derived_path_under_roots(path: String, roots: List<String>) -> Bool
   any(xs: roots, predicate: fn(root) { starts_with(s: path, prefix: concat(root, "/")) })
 }
 
-fn source_refs_from_declared(declared: List<ModuleDeclarationFact>) -> List<SourceRef> {
+fn path_is_under_pool_root(path: String, root: String) -> Bool {
+  path == root || starts_with(s: path, prefix: concat(root, "/"))
+}
+
+fn discovering_pool_root(path: String, pool_roots: List<String>) -> Optional<String> {
+  fold_list(
+    xs: pool_roots,
+    empty: Absent,
+    cons: fn(acc, root) {
+      match acc {
+        Present { value: found } => Present { value: found }
+        Absent => match path_is_under_pool_root(path: path, root: root) {
+          true => Present { value: root }
+          false => Absent
+        }
+      }
+    }
+  )
+}
+
+fn source_refs_from_declared(
+  declared: List<ModuleDeclarationFact>,
+  pool_roots: List<String>
+) -> Outcome<List<SourceRef>> {
   fold_list(
     xs: declared,
-    empty: no_source_refs,
+    empty: outcome_accepted(value: no_source_refs),
     cons: fn(acc, fact) {
-      list_snoc_item(xs: acc, item: source_ref_for_storage_path(path: fact.path))
+      bind_outcome(
+        o: acc,
+        f: fn(refs) {
+          match discovering_pool_root(path: fact.path, pool_roots: pool_roots) {
+            Absent =>
+              outcome_rejected(
+                d: Diagnostic {
+                  reason: ^declared_module_pool_root_unknown,
+                  at: Textual { file: ^declared_module_pool_root_unknown, extent: WholeFile },
+                  correction: Unavailable { reason: ExternalContractUnknown }
+                }
+              )
+            Present { value: origin } =>
+              match admit_source_root_argument(argument: origin) {
+                SourceRootArgumentAdmitted { tree: tree } =>
+                  outcome_accepted(
+                    value: list_snoc_item(
+                      xs: refs,
+                      item: source_ref_for_storage_path(path: fact.path, source_root: tree)
+                    )
+                  )
+                SourceRootArgumentUnrecognized { argument: _ } =>
+                  outcome_rejected(
+                    d: Diagnostic {
+                      reason: ^declared_module_source_root_undetermined,
+                      at: Textual { file: ^declared_module_source_root_undetermined, extent: WholeFile },
+                      correction: Unavailable { reason: ExternalContractUnknown }
+                    }
+                  )
+              }
+          }
+        }
+      )
     }
   )
 }
@@ -375,15 +433,21 @@ fn edges_from_provenance_owners(
 }
 
 fn load_reference_derived_pool(
-  declared: List<ModuleDeclarationFact>
+  declared: List<ModuleDeclarationFact>,
+  pool_roots: List<String>
 ) -> Outcome<ReferenceDerivedPool> {
   bind_outcome(
-    o: source_root_ingest_from_source_refs(refs: source_refs_from_declared(declared: declared)),
-    f: fn(ingest) {
+    o: source_refs_from_declared(declared: declared, pool_roots: pool_roots),
+    f: fn(refs) {
       bind_outcome(
-        o: located_roots_from_source_root_ingest(ingest: ingest),
-        f: fn(items) {
-          outcome_accepted(value: reference_derived_pool_from_located_roots(items: items))
+        o: source_root_ingest_from_source_refs(refs: refs),
+        f: fn(ingest) {
+          bind_outcome(
+            o: located_roots_from_source_root_ingest(ingest: ingest),
+            f: fn(items) {
+              outcome_accepted(value: reference_derived_pool_from_located_roots(items: items))
+            }
+          )
         }
       )
     }
@@ -599,7 +663,7 @@ fn reference_derived_resolution_facts(
   let declared = module_declaration_facts_live(pool_roots: pool_roots)
     |> filter(fact => !reference_derived_path_excluded(path: fact.path, exclude_substrings: exclude_substrings))
   bind_outcome(
-    o: load_reference_derived_pool(declared: declared),
+    o: load_reference_derived_pool(declared: declared, pool_roots: pool_roots),
     f: fn(pool) {
       bind_outcome(
         o: fold_list(
@@ -642,7 +706,7 @@ type ImportClosureBfsState {
 }
 
 fn map_lookup_where_rejected_unreachable<K, V>(m: Map<K, V>, key: K) -> Optional<V> {
-  match v2.std.collection.map_get(m: m, key: key) {
+  match v2.std.collection.map_get_checked(m: m, key: key) {
     Accepted { value: v, diagnostics: _ } => v
     Rejected { diagnostics: _ } => Absent
   }
diff --git a/src/v2/lens/reference_derived_residency_reading.dag b/src/v2/lens/reference_derived_residency_reading.dag
index 8f6fb06ca19..57a30b9abe7 100644
--- a/src/v2/lens/reference_derived_residency_reading.dag
+++ b/src/v2/lens/reference_derived_residency_reading.dag
@@ -20,6 +20,7 @@ import std.decl_ref { DeclarationRef }
 import v2.std.algebra { length }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import std.optional { Absent, Optional, Present, optional_absent, optional_present }
+import v2.extdeps.languages.dag { dag_node_is_module_member_surface }
 import v2.std.node_query { member_edge_type_node }
 import v2.std.node {
   Arrow,
@@ -168,7 +169,9 @@ fn decl_first_unrecognised_atom(decl: Node) -> Optional<Symbol> {
 }
 
 // A Named member that is not a binder is read first: the carrier declares no type for it, and that
-// refuses the whole reading rather than letting the remaining fields decide it.
+// refuses the whole reading rather than letting the remaining fields decide it. Identity-stamped
+// module or declaration members (v2.extdeps.languages.dag dag_node_is_module_member_surface) are
+// skipped per target; a hand-built field on the same Conj is still refused.
 fn decl_first_member_not_a_binder(decl: Node) -> Optional<Symbol> {
   match decl.kind {
     TypeNode { connective: _ } =>
@@ -180,9 +183,13 @@ fn decl_first_member_not_a_binder(decl: Node) -> Optional<Symbol> {
               Positional => acc
               StructuralLabel { label: _ } => acc
               Authored { name: nm } =>
-                match member_edge_type_node(e: edge) {
-                  Present { value: _ } => acc
-                  Absent => optional_present(value: nm)
+                if dag_node_is_module_member_surface(node: edge.target) {
+                  acc
+                } else {
+                  match member_edge_type_node(e: edge) {
+                    Present { value: _ } => acc
+                    Absent => optional_present(value: nm)
+                  }
                 }
             }
         }
diff --git a/src/v2/lens/text_string_importer_census.dag b/src/v2/lens/text_string_importer_census.dag
index 1e835bd51ed..2e6f27b229c 100644
--- a/src/v2/lens/text_string_importer_census.dag
+++ b/src/v2/lens/text_string_importer_census.dag
@@ -27,7 +27,8 @@ import v2.std.provenance { SpanIndex, span_index_empty, node_occurrence_id_optio
 import std.optional { Optional }
 import v2.std.diagnostic { Accepted, Rejected, Textual, ByteRange, WholeFile }
 import v2.std.algebra { contains, fold_list, length, list_reverse }
-import v2.std.integer { Int, integer_int_to_decimal_string }
+import v2.std.integer { Int }
+import std.integer { int_to_decimal_string }
 import v2.std.collection { Map, empty_map, map_insert, map_lookup }
 import std.optional { Absent, Present }
 import std.algebra { Cons, Empty, FreeMonoid }
@@ -62,7 +63,7 @@ import std.primitives {
 
 // THE CENSUS OF `import v2.std.text { String }` IMPORTERS, AT SITE GRAIN (gunbc#12760, decision A;
 // method ruled by neat-boar-16 2026-09-30). v1 binds a bare `String` in these modules to the KERNEL
-// host text whatever the import says (`v1.compiler.infer` `overlay_skips_kernel_name`); v2 binds it
+// host text whatever the import says (`v1.compiler.infer_env` `overlay_skips_kernel_name`); v2 binds it
 // to the structural `FreeMonoid<Char>` the import names. The fork resolves at the importers:
 // HOST-USING and MIXED importers drop `String` from the import, STRUCTURAL-USING importers keep it
 // as `gunbc.recurring_failure_mode` `carrier_by_spelling`'s declared v1/v2 divergence. This lens
@@ -1412,7 +1413,7 @@ fn site_tokens(k: SiteKind) -> String {
 }
 
 fn int_text(n: Int) -> String {
-  integer_int_to_decimal_string(value: n)
+  int_to_decimal_string(value: n)
 }
 
 // One module's lines: an `M` row carrying the verdict and the counts (host, structural, OTHER,
diff --git a/src/v2/lens/unit_modeling.dag b/src/v2/lens/unit_modeling.dag
index 38533e64004..74fbc3d3f04 100644
--- a/src/v2/lens/unit_modeling.dag
+++ b/src/v2/lens/unit_modeling.dag
@@ -7,6 +7,11 @@ import std.disposition { SingleAuthority }
 
 import v2.std.witness { Holds }
 import v2.std.node_query { edge_field_type_name, member_edge_type_node, member_not_a_binder_diagnostic }
+import v2.extdeps.languages.dag {
+  dag_edge_is_module_surface_parse_projection,
+  dag_node_is_namespace_member_target,
+  dag_node_is_record_field_carrier
+}
 import v2.std.diagnostic { node_locus, outcome_accepted, outcome_rejected }
 import std.optional { optional_absent, optional_present, optional_prefer_first_present }
 
@@ -60,7 +65,7 @@ fn unit_field_token_map() -> Map<Symbol, Symbol> {
 }
 
 fn field_name_has_known_carrier(name: Symbol) -> Bool {
-  match v2.std.collection.map_get(m: unit_field_token_map(), key: name) {
+  match v2.std.collection.map_get_checked(m: unit_field_token_map(), key: name) {
     Accepted { value: Present { value: _ } } => true
     Accepted { value: _, diagnostics: _ } => false
     Rejected { diagnostics: _ } => false
@@ -81,7 +86,7 @@ fn exemption_marker_set() -> Map<Symbol, Symbol> {
 }
 
 fn name_is_exempt(name: Symbol) -> Bool {
-  match v2.std.collection.map_get(m: exemption_marker_set(), key: name) {
+  match v2.std.collection.map_get_checked(m: exemption_marker_set(), key: name) {
     Accepted { value: Present { value: _ } } => true
     Accepted { value: _, diagnostics: _ } => false
     Rejected { diagnostics: _ } => false
@@ -95,8 +100,16 @@ fn type_is_flat_scalar(target: Node) -> Bool {
 fn field_unit_violation(carrier: Node, edge: Edge) -> Optional<Diagnostic> {
   match edge.label {
     Authored { name: nm } =>
+      if dag_edge_is_module_surface_parse_projection(carrier: carrier, name: nm) {
+        optional_absent()
+      } else {
       match member_edge_type_node(e: edge) {
-        Absent => optional_present(value: member_not_a_binder_diagnostic(e: edge))
+        Absent =>
+          if dag_node_is_namespace_member_target(node: edge.target) {
+            optional_absent()
+          } else {
+            optional_present(value: member_not_a_binder_diagnostic(e: edge))
+          }
         Present { value: t } =>
           if type_is_flat_scalar(target: t) {
             if name_is_exempt(name: nm) {
@@ -108,18 +121,19 @@ fn field_unit_violation(carrier: Node, edge: Edge) -> Optional<Diagnostic> {
             optional_absent()
           }
       }
+      }
     StructuralLabel { label: _ } => optional_absent()
     Positional => optional_absent()
   }
 }
 
 fn carrier_first_unit_violation(carrier: Node) -> Optional<Diagnostic> {
-  match carrier.kind {
-    TypeNode { connective: _ } =>
-      fold(carrier.children, init: optional_absent(), f: fn(acc, edge) {
-        optional_prefer_first_present(left: acc, right: field_unit_violation(carrier: carrier, edge: edge))
-      })
-    ComputationNode { behavior: _ } => Absent
+  if dag_node_is_record_field_carrier(node: carrier) {
+    fold(carrier.children, init: optional_absent(), f: fn(acc, edge) {
+      optional_prefer_first_present(left: acc, right: field_unit_violation(carrier: carrier, edge: edge))
+    })
+  } else {
+    optional_absent()
   }
 }
 
diff --git a/src/v2/std/anonymous_binder.dag b/src/v2/std/anonymous_binder.dag
index a15505809b3..e0f5d78fa77 100644
--- a/src/v2/std/anonymous_binder.dag
+++ b/src/v2/std/anonymous_binder.dag
@@ -3,7 +3,8 @@ module v2.std.anonymous_binder
 import std.types { List }
 import std.algebra { Cons, Empty }
 import v2.std.algebra { list_reverse }
-import v2.std.integer { Int, integer_int_to_decimal_string }
+import v2.std.integer { Int }
+import std.integer { int_to_decimal_string }
 import v2.std.node { Edge, Authored, Positional, Symbol, symbol_intern_lexeme, symbol_lexeme, StructuralLabel }
 import v2.std.node_query { binder_relabelled, pattern_wildcard_name }
 
@@ -34,7 +35,7 @@ fn anonymous_param_label_prefix() -> String {
 // minted slots.
 fn anonymous_param_label(slot: Int) -> Symbol {
   symbol_intern_lexeme(
-    lexeme: anonymous_param_label_prefix() + integer_int_to_decimal_string(value: slot) + ">"
+    lexeme: anonymous_param_label_prefix() + int_to_decimal_string(value: slot) + ">"
   )
 }
 
@@ -59,7 +60,7 @@ fn fresh_type_variable_prefix() -> String {
 
 fn fresh_type_variable(path: List<Int>, label: Symbol) -> Symbol {
   let p = fold(path, init: "", f: fn(acc, i) {
-    if acc == "" { integer_int_to_decimal_string(value: i) } else { acc + "." + integer_int_to_decimal_string(value: i) }
+    if acc == "" { int_to_decimal_string(value: i) } else { acc + "." + int_to_decimal_string(value: i) }
   })
   symbol_intern_lexeme(lexeme: fresh_type_variable_prefix() + p + ":" + symbol_lexeme(sym: label) + ">")
 }
diff --git a/src/v2/std/collection.dag b/src/v2/std/collection.dag
index 16d531b476d..4d3fa33ed2c 100644
--- a/src/v2/std/collection.dag
+++ b/src/v2/std/collection.dag
@@ -63,7 +63,7 @@ fn map_insert<K, V>(m: Map<K, V>, key: K, value: V) -> Map<K, V> {
 // third state in which the map fails to say. So the total form is the primitive and the
 // Outcome-wrapped form below is a projection of it, not the other way round.
 //
-// The direction matters at the consumer. A caller reaching for `map_get` must match a
+// The direction matters at the consumer. A caller reaching for `map_get_checked` must match a
 // `Rejected` arm that no producer can construct, and the only arms available to it are the
 // caller's own domain answers — so the unreachable arm gets bound to whichever domain answer is
 // nearest, and a substrate failure would report as a domain fact. Exposing the total lookup
@@ -85,7 +85,7 @@ fn map_contains_key<K, V>(m: Map<K, V>, key: K) -> Bool {
   }
 }
 
-fn map_get<K, V>(m: Map<K, V>, key: K) -> Outcome<Optional<V>> {
+fn map_get_checked<K, V>(m: Map<K, V>, key: K) -> Outcome<Optional<V>> {
   outcome_accepted(value: map_lookup(m: m, key: key))
 }
 fn list_nth<T>(xs: List<T>, wanted: Int, absent: Diagnostic) -> Witness<T> {
diff --git a/src/v2/std/compilers/body_lowering.dag b/src/v2/std/compilers/body_lowering.dag
index 87af912e6b0..2d3b822acca 100644
--- a/src/v2/std/compilers/body_lowering.dag
+++ b/src/v2/std/compilers/body_lowering.dag
@@ -1,6 +1,7 @@
 module v2.std.compilers.body_lowering
 
 import std.types { List }
+import v2.std.compilers.lowered_shape { LoweredShape }
 import v2.std.type_binder { edge_is_cast_target, type_annotation_edge }
 import std.algebra { Cons, Empty, FreeMonoid, list_append, list_snoc_item }
 import v2.std.algebra { contains, fold_list }
@@ -703,3 +704,16 @@ fn branch_view(site: Node) -> Outcome<BranchView> {
     ComputationNode { behavior: Match } => view_refusal(reason: ^body_view_not_branch, at: site)
   }
 }
+
+
+// A NODE IN THE FOLD'S TREE IS ONE OF THREE THINGS, EACH IDENTIFIED POSITIVELY. Raw parse is a
+// composite the parse stage stamped (it carries a grammar projection edge); a raw leaf is an atom or
+// the childless conj the parse emits as a repeat or optional terminator, and is its own arm so it can
+// never stand in for a composite; lowered output is a node a producer wrapped. Anything else is not a
+// term and refuses where it is read (body_term_of). The leaf arm is the honest limit of today's
+// occurrence model: a leaf carries no projection edge and inherits its source occurrence, so its
+// provenance is not on it; it has no interior, so no part of it can be re-read for the whole.
+type BodyTerm
+  = RawParse { node: Node }
+  | RawLeaf { node: Node }
+  | Lowered { node: Node, shape: LoweredShape }
diff --git a/src/v2/std/compilers/cli_surface.dag b/src/v2/std/compilers/cli_surface.dag
index 331d1b57358..7968467b85d 100644
--- a/src/v2/std/compilers/cli_surface.dag
+++ b/src/v2/std/compilers/cli_surface.dag
@@ -12,7 +12,7 @@ import v2.std.compilers.target_model {
   LexRules,
   lex_rules_literal_for_class
 }
-import v2.std.collection { map_get }
+import v2.std.collection { map_get_checked }
 import v2.std.diagnostic {
   Accepted,
   Diagnostic,
@@ -262,7 +262,7 @@ fn required_bound_spelling(
   binding_spellings: Map<Symbol, String>,
   binding: Symbol
 ) -> Outcome<String> {
-  match map_get(binding_spellings, binding) {
+  match map_get_checked(binding_spellings, binding) {
     Rejected { diagnostics: ds } => Rejected { diagnostics: ds }
     Accepted { value: found, diagnostics: pending } =>
       match found {
diff --git a/src/v2/std/compilers/compilation_unit.dag b/src/v2/std/compilers/compilation_unit.dag
index 03e542e5b56..f5cb5b16767 100644
--- a/src/v2/std/compilers/compilation_unit.dag
+++ b/src/v2/std/compilers/compilation_unit.dag
@@ -1,5 +1,22 @@
 module v2.std.compilers.compilation_unit
 
+import gunbc.crate_partition {
+  CompilationUnitId,
+  HandExplicit,
+  InterfaceClosureUnreachedFixpoint,
+  ModuleAssignmentLookupRejected,
+  ModuleDagEdge,
+  ModuleDagExportsLookupRejected,
+  ModuleDagTypeDefinitionsLookupRejected,
+  ModuleId,
+  PartitionFoldRefusalCause,
+  PartitionProvenance,
+  PartitionR4Refused,
+  PartitionR4ValidityVerdict,
+  PolicyDerived,
+  SccSplit,
+  list_unique_sorted_ids
+}
 
 import std.algebra { Empty }
 import std.types { NonEmptyStr, List, Bool, String, Int, brand }
@@ -9,7 +26,7 @@ import std.disposition { SingleAuthority }
 import v2.lens.common.construction_justification { ConstructionJustification, WallNow }
 import v2.std.algebra { any, fold_list, length }
 import v2.std.collection {
-  map_get
+  map_get_checked
 }
 import std.optional {
   Absent,
@@ -31,18 +48,6 @@ import v2.std.node {
   node_synthetic,
 }
 
-type ModuleId = NonEmptyStr where brand("ModuleId")
-type CompilationUnitId = NonEmptyStr where brand("CompilationUnitId")
-
-type PartitionProvenance
-  = HandExplicit
-  | PolicyDerived { policy: DeclarationRef }
-
-type ModuleDagEdge {
-  from: ModuleId
-  to: ModuleId
-}
-
 type ModuleTypeDefinitionRow {
   identity: Symbol
   definition: Node
@@ -66,23 +71,6 @@ type PartitionInterfaceClosureResult
   = PartitionInterfaceClosed { nodes: List<Node> }
   | PartitionInterfaceTruncated
 
-type PartitionFoldRefusalCause
-  = InterfaceClosureUnreachedFixpoint { unit_id: CompilationUnitId }
-  | ModuleDagExportsLookupRejected { module: ModuleId }
-  | ModuleDagTypeDefinitionsLookupRejected { module: ModuleId }
-  | ModuleAssignmentLookupRejected { module: ModuleId }
-
-type PartitionR4ValidityCause
-  = SccSplit { detail: String }
-  | UnitGraphCycle { detail: String }
-  | LinkageCycle { detail: String }
-  | ByValueTypeCycle { detail: String }
-  | PartitionInputRejected { cause: PartitionFoldRefusalCause }
-
-type PartitionR4ValidityVerdict
-  = PartitionR4Valid
-  | PartitionR4Refused { cause: PartitionR4ValidityCause }
-
 type PartitionFoldOutcome
   = PartitionFoldOk { units: List<CompilationUnit> }
   | PartitionFoldRefused { cause: PartitionFoldRefusalCause }
@@ -183,14 +171,6 @@ data partition_r4_witness_refused_scc_split: PartitionR4ValidityVerdict = Partit
   cause: SccSplit { detail: "witness-only carrier; realization-owned predicate" }
 }
 
-fn partition_provenance_hand_explicit() -> PartitionProvenance {
-  HandExplicit
-}
-
-fn partition_provenance_policy_derived(policy: DeclarationRef) -> PartitionProvenance {
-  PolicyDerived { policy: policy }
-}
-
 fn partition_provenance_eq(left: PartitionProvenance, right: PartitionProvenance) -> Bool {
   match left {
     HandExplicit => match right {
@@ -210,7 +190,7 @@ fn module_unit_id_outcome(
   assignment: Map<ModuleId, CompilationUnitId>,
   module: ModuleId
 ) -> Outcome<Optional<CompilationUnitId>> {
-  match map_get(assignment, module) {
+  match map_get_checked(assignment, module) {
     Accepted { value: opt, diagnostics: _ } => outcome_accepted(value: opt)
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
   }
@@ -220,7 +200,7 @@ fn module_unit_id(
   assignment: Map<ModuleId, CompilationUnitId>,
   module: ModuleId
 ) -> Optional<CompilationUnitId> {
-  match map_get(assignment, module) {
+  match map_get_checked(assignment, module) {
     Accepted { value: opt, diagnostics: _ } => opt
     Rejected { diagnostics: _ } => Absent
   }
@@ -289,30 +269,6 @@ fn list_snoc_unique_node(items: List<Node>, item: Node) -> List<Node> {
   }
 }
 
-// SORT BEFORE DEDUP, not after. `assignment |> map_values` is this function's production input
-// at all three partition folds below, and a Map has no encounter-order contract. The old fold
-// scanned the growing accumulator with `any` and only sorted its result afterward: the result was
-// canonical, but the amount of evaluator work depended on the HAMT iteration order because a
-// duplicate stopped the scan wherever its earlier copy happened to sit. Required-floor's
-// same-tree corpus A/B measured that defect directly: identical source moved this family's
-// per-claim evaluator-step counts in both directions.
-//
-// Sorting first makes equal ids adjacent. Membership is then decidable against the last kept
-// identity alone, so the work no longer depends on the unmodeled Map order and the growing
-// accumulator is not rescanned for every item. This is the same sort-then-neighbour substrate
-// pattern used by gunbc.self_host_compile_phase_frontier.deduplicate_identities; it lives here
-// because CompilationUnitId, and the partition semantics being preserved, are owned here.
-fn list_unique_sorted_ids(items: List<CompilationUnitId>) -> List<CompilationUnitId> {
-  fold(
-    items |> sort_by(id => id),
-    init: [],
-    f: (unique, item) => match unique |> last {
-      Present { value: prior } => if prior == item { unique } else { unique |> list_push(item) }
-      Absent => [item]
-    }
-  )
-}
-
 // A DETERMINISM ORDER WITH NO SEMANTIC MEANING. Its only consumer, list_unique_sorted_nodes, sorts so
 // that equal content hashes are adjacent; which of two distinct hashes comes first carries no fact.
 // So the key is the digest's hex text, the orderable representation Fnv1a64Structural already
@@ -341,7 +297,7 @@ fn module_export_declarations_outcome(
   module_dag: ModuleDag,
   module: ModuleId
 ) -> Outcome<List<Node>> {
-  match map_get(module_dag.exports, module) {
+  match map_get_checked(module_dag.exports, module) {
     Accepted { value: opt, diagnostics: _ } =>
       outcome_accepted(value: match opt {
         Present { value: nodes } => nodes
@@ -355,7 +311,7 @@ fn module_type_definition_rows_outcome(
   module_dag: ModuleDag,
   module: ModuleId
 ) -> Outcome<List<ModuleTypeDefinitionRow>> {
-  match map_get(module_dag.type_definitions, module) {
+  match map_get_checked(module_dag.type_definitions, module) {
     Accepted { value: opt, diagnostics: _ } =>
       outcome_accepted(value: match opt {
         Present { value: rows } => rows
@@ -373,7 +329,7 @@ fn module_type_definition_rows_outcome(
 // then discarded both values, so the closure below it re-established a fact its predecessor already
 // had (DESIGN section 6b). With the rows carried, no map lookup runs inside the closure at all:
 // the swallowing arm has no site to exist at rather than being refused at one, and the repeated
-// map_get is gone with it.
+// map_get_checked is gone with it.
 fn resolve_module_interface(
   module_dag: ModuleDag,
   module: ModuleId
diff --git a/src/v2/std/compilers/lexing.dag b/src/v2/std/compilers/lexing.dag
index 39782008475..4a5ca5bbc6f 100644
--- a/src/v2/std/compilers/lexing.dag
+++ b/src/v2/std/compilers/lexing.dag
@@ -20,9 +20,7 @@ import std.optional {
   optional_absent,
   optional_present
 }
-import v2.std.node { Atom, Conj, Node, Symbol, TypeNode, combine_hash, symbol_identity_digest }
-import std.content_hash { Fnv1a64Structural }
-import v2.std.integer { integer_int_content_digest }
+import v2.std.node { Atom, Conj, Node, Symbol, TypeNode }
 import v2.std.node_shape { stamp_node_shape_synthetic, type_shape }
 import v2.std.text { Char, String }
 import std.unicode.char_class { unicode_char_code_point }
@@ -231,9 +229,10 @@ fn phrase_to_source_text(p: LexicalPhrase) -> String {
 }
 
 // TOKEN STARTS STRICTLY INCREASE ALONG A STREAM. A token's start is its stream position: the parse
-// keys its memo and decides repeat progress by it (v2.compiler.parse parse_current_position), and
-// refuses a stream that breaks the order at its entry (parse_token_start_order_violation,
-// TokenStartsNotIncreasing) rather than serve one position's answer for another.
+// identifies a stream position and decides repeat progress by it (v2.compiler.parse
+// parse_current_position), and refuses a stream that breaks the order at its entry
+// (parse_token_start_order_violation, TokenStartsNotIncreasing) rather than take one position's
+// progress for another's.
 type Token {
   class: Symbol
   lexeme: Lexeme
@@ -254,13 +253,10 @@ type Token {
 // (v2.compiler.tokenize lex_walk_step), the one place the source is read, through the two builders
 // below, so there is no second pass over the source and a layout question is a lookup. A line feed
 // counts when it is in a gap -- in trivia or an annotation between tokens -- never inside a token (a
-// multi-line string). `digest` summarizes exactly the recorded entries, folded as each is recorded, so
-// the parse memo key covers layout without a lookup per token. A stream built from tokens alone
-// (fixtures) carries no layout, and a layout question on it answers `LineBreakUnknownWithoutSource`
+// multi-line string). A stream built from tokens alone (fixtures) carries no layout, and a layout question on it answers `LineBreakUnknownWithoutSource`
 // -- never an assumed single line.
 type StreamLayout {
   line_break_before: Map<Int, Int>
-  digest: Fnv1a64Structural
 }
 
 type TokenStream {
@@ -292,14 +288,13 @@ type LineBreakAnswer
   | LineBreakUnknownWithoutSource
 
 fn stream_layout_empty() -> StreamLayout {
-  StreamLayout { line_break_before: empty_map(), digest: symbol_identity_digest(sym: ^stream_layout_digest_nil) }
+  StreamLayout { line_break_before: empty_map() }
 }
 
 // The token starting at octet `token_start` has a line break in its gap, which began at `gap_start`.
 fn stream_layout_with_break(layout: StreamLayout, token_start: Int, gap_start: Int) -> StreamLayout {
   StreamLayout {
-    line_break_before: map_insert(m: layout.line_break_before, key: token_start, value: gap_start),
-    digest: combine_hash(a: layout.digest, b: combine_hash(a: integer_int_content_digest(value: token_start), b: integer_int_content_digest(value: gap_start)))
+    line_break_before: map_insert(m: layout.line_break_before, key: token_start, value: gap_start)
   }
 }
 
diff --git a/src/v2/std/compilers/lowered_shape.dag b/src/v2/std/compilers/lowered_shape.dag
new file mode 100644
index 00000000000..75788b3f712
--- /dev/null
+++ b/src/v2/std/compilers/lowered_shape.dag
@@ -0,0 +1,41 @@
+module v2.std.compilers.lowered_shape
+
+// WHICH PRODUCER LOWERED A NODE IS A FACT OF ITS CONSTRUCTION, NOT A READING OF ITS SHAPE (MQ-5,
+// neat-boar-16 ruling 2026-09-30, option A; realized as the operator-approved interim B, msg_63aee66e).
+// Body lowering is a bottom-up fold over a tree that holds raw parse and lowered output at once, and
+// nothing on a Node says which is which, so every reader used to ask a hand-kept shape allowlist
+// (body_lower_is_core_substrate) and re-read anything it missed as raw parse. Each producer now
+// declares what it built: its result leaves the producer inside the stage's Lowered wrapper, carrying
+// one of these arms as a constant the producer writes, and a reader matches the term
+// (v2.compiler.body_lowering_fold body_term_of) instead of classifying the node. The arms name the
+// producer family that built the value.
+// WHO READS THE ARM, STATED AS IT IS (review 76884; DESIGN section 3c). In this change the SEAL is
+// consumed -- body_term_of keys Lowered versus RawParse/RawLeaf on its presence -- and the arm it
+// carries is not: every reader takes a Lowered term whole (shape: _). That is a declared frontier,
+// not a consumer. Its named consumer is the stage ceiling body_lowering_fold states beside the seal:
+// a sealed BodyTerm term tree that normalize consumes by dispatching on the producer arm instead of
+// re-reading node shapes (MQ-6). TRIGGER: that change lands its first normalize match over
+// LoweredShape. If it does not, this arm collapses to a unit seal -- the discriminator alone is what
+// this change needs -- rather than staying as data nothing reads.
+// It sits in its own module, below v2.std.node, because the seal on the Lowered wrapper's edge
+// carries it (v2.std.node BodyTermLoweredSeal): the seal holds the closed shape itself, so no
+// symbol round-trip, roster list or unknown-shape arm exists to drift from this declaration.
+type LoweredShape
+  = LoweredOperatorExpression
+  | LoweredFunctionValue
+  | LoweredFoldEncoding
+  | LoweredMatch
+  | LoweredBranch
+  | LoweredLoop
+  | LoweredLet
+  | LoweredStatementSequence
+  | LoweredPostfix
+  | LoweredPrimary
+  | LoweredFnDeclaration
+  | LoweredTestDeclaration
+  | LoweredDataDeclaration
+  | LoweredFnBody
+  | LoweredTypeDeclaration
+  | LoweredServiceDeclaration
+  | LoweredResourceDeclaration
+  | LoweredOperand
diff --git a/src/v2/std/compilers/target_model.dag b/src/v2/std/compilers/target_model.dag
index 563b81853cc..114a000f091 100644
--- a/src/v2/std/compilers/target_model.dag
+++ b/src/v2/std/compilers/target_model.dag
@@ -38,7 +38,7 @@ import v2.std.collection {
   Map,
   empty_map,
   list_at_optional,
-  map_get,
+  map_get_checked,
   map_insert,
   map_lookup
 }
@@ -215,10 +215,8 @@ import v2.std.host_transport {
   TargetEmitHostRuntimeRow,
   configured_emit_host_runtime_row_from_target_row
 }
-import v2.std.integer {
-  integer_decimal_magnitude_node_to_int,
-  integer_int_to_decimal_string
-}
+import v2.std.integer { integer_decimal_magnitude_node_to_int }
+import std.integer { int_to_decimal_string }
 import v2.std.fold_assembly {
   node_list_from_node
 }
@@ -1343,7 +1341,7 @@ fn bound_spelling_from_map(
   binding_spellings: Map<Symbol, String>,
   binding: Symbol
 ) -> Outcome<String> {
-  match map_get(binding_spellings, binding) {
+  match map_get_checked(binding_spellings, binding) {
     Accepted { value: opt, diagnostics: pending } => match opt {
       Present { value: spelling } => Accepted { value: spelling, diagnostics: pending }
       Absent =>
@@ -1544,7 +1542,7 @@ fn fixed_token_spelling_from_model(
   bind_outcome(
     o: lex_rules_literal_for_class(rules: target.lex, token_class: token_class),
     f: fn(spelling) {
-      match map_get(target.token_class_emit_transforms, token_class) {
+      match map_get_checked(target.token_class_emit_transforms, token_class) {
         Accepted { value: Present { value: transform }, diagnostics: d } =>
           bind_outcome(
             o: apply_emit_spelling_transform(transform: transform, token_class: token_class, spelling: spelling),
@@ -1566,7 +1564,7 @@ fn bound_token_spelling_from_model(
   bind_outcome(
     o: target_binding_spelling_lookup(target: target, binding: binding),
     f: fn(spelling) {
-      match map_get(target.token_class_emit_transforms, token_class) {
+      match map_get_checked(target.token_class_emit_transforms, token_class) {
         Accepted { value: Present { value: transform }, diagnostics: d } =>
           bind_outcome(
             o: apply_emit_spelling_transform(transform: transform, token_class: token_class, spelling: spelling),
@@ -1581,7 +1579,7 @@ fn bound_token_spelling_from_model(
 }
 
 fn layout_or_atom_in(transforms: Map<Symbol, TokenClassEmitTransform>, token_class: Symbol, spelling: String) -> Outcome<TargetText> {
-  match map_get(transforms, token_class) {
+  match map_get_checked(transforms, token_class) {
     Accepted { value: Present { value: transform }, diagnostics: d } =>
       match transform {
         EmitLineBreaks { before: b, after: a } =>
@@ -5658,7 +5656,7 @@ fn target_value_expr_effect_apply_callee(
   shape: TargetEffectApplyShape,
   expr: TargetValueExpression
 ) -> Outcome<Symbol> {
-  match map_get(
+  match map_get_checked(
     m: fold_list(
       xs: shape.callees,
       empty: empty_map(),
@@ -8125,7 +8123,7 @@ fn target_value_expr_match_arm_tokens(
   }
 }
 
-data target_value_expr_int_bool_octet_channel_dissolution_note: String = "Staging bridge only: inline scrutinee `x != 0` decodes Int wire to bool at the match seam. Ground on the modeled octet↔bool codec authority once inhabited ({0,1} domain, not general nonzero) — do not let this bridge harden into a second decode nickname. interim bindings: ^dag_binding_octet_zero/^dag_binding_octet_one spell 0/1 until codec rows land. scaffold-widen: infer half emits infer_match_int_scrutinee_bool_literal_scaffold diagnostic on Int-scrutinee bool-literal match (countable). paired-scaffold: infer half = infer_match_int_scrutinee_bool_literal_body_note (04_infer.dag) — dissolve both halves together on octet↔bool codec inhabitation."
+data target_value_expr_int_bool_octet_channel_dissolution_note: String = "Emit half deleted (DESIGN §3/§4b(4)): after the Bool de-fork, BindingRef bool-param match is not an Int octet wire, and the predicate that selected `x != 0` plus 0/1 arm bodies was constantly false, so the match-seam production was uprooted rather than left as a dead parallel route. Remaining paired half is infer: infer_match_int_scrutinee_bool_literal_scaffold on Int-scrutinee bool-literal match (countable). Dissolve that diagnostic on octet↔bool codec inhabitation ({0,1} domain, not general nonzero) — v2.compiler.infer infer_match_int_scrutinee_bool_literal_body_note."
 
 fn target_value_expr_bool_literal_value_from_atom(node: Node) -> Optional<Bool> {
   match node.kind {
@@ -8256,217 +8254,6 @@ fn target_value_expr_is_source_bool_literal_atom(
   }
 }
 
-fn target_value_expr_match_arms_are_int_bool_octet_channel(
-  arms: List<TargetValueExprMatchArmSlot>
-) -> Bool {
-  if is_empty(xs: arms) {
-    false
-  } else {
-    !any(
-      xs: arms,
-      predicate: fn(arm) {
-        arm.pattern.kind != TargetValueExprBoolLiteral
-          || arm.body.kind != TargetValueExprBoolLiteral
-      }
-    )
-  }
-}
-
-fn target_value_expr_match_is_int_bool_octet_channel(
-  scrutinee: TargetValueExpression,
-  arms: List<TargetValueExprMatchArmSlot>
-) -> Bool {
-  match scrutinee.kind {
-    TargetValueExprBindingRef =>
-      target_value_expr_match_arms_are_int_bool_octet_channel(arms: arms)
-    TargetValueExprSymbolIdentity => false
-    TargetValueExprSymbolToOwnedString => false
-    TargetValueExprBoolLiteral => false
-    TargetValueExprCharUnicodeScalar => false
-    TargetValueExprStringLiteral => false
-    TargetValueExprIntLiteral => false
-    TargetValueExprReferenceRcNew => false
-    TargetValueExprReferenceBoxNew => false
-    TargetValueExprPrimitiveApply => false
-    TargetValueExprEffectApply => false
-    TargetValueExprCallableApply => false
-    TargetValueExprClosure => false
-    TargetValueExprConditional => false
-    TargetValueExprBindLet => false
-    TargetValueExprLoop => false
-    TargetValueExprRecordConstruct => false
-    TargetValueExprFieldAccess => false
-    TargetValueExprMatch => false
-  }
-}
-
-fn target_value_expr_bool_literal_octet_body_tokens(
-  expr: TargetValueExpression,
-  projection: TargetValueExpressionProjection
-) -> Outcome<List<ConcreteSyntaxToken>> {
-  match expr.kind {
-    TargetValueExprBoolLiteral =>
-      match target_value_expression_bool_literal_value_from_wire(wire: expr.node) {
-        Present { value: false } =>
-          outcome_accepted(
-            Cons {
-              head: target_value_expression_binding_ref_token(
-                binding: ^dag_binding_octet_zero,
-                projection: projection
-              ),
-              tail: Empty
-            }
-          )
-        Present { value: true } =>
-          outcome_accepted(
-            Cons {
-              head: target_value_expression_binding_ref_token(
-                binding: ^dag_binding_octet_one,
-                projection: projection
-              ),
-              tail: Empty
-            }
-          )
-        Absent =>
-          outcome_rejected(
-            target_value_expr_diagnostic(
-              reason: ^target_value_expr_reason_transform_shape_invalid,
-              node: expr.node
-            )
-          )
-      }
-    TargetValueExprSymbolIdentity => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprSymbolToOwnedString => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprCharUnicodeScalar => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprStringLiteral => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprIntLiteral => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprReferenceRcNew => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprReferenceBoxNew => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprBindingRef => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprPrimitiveApply => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprEffectApply => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprCallableApply => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprClosure => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprConditional => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprBindLet => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprLoop => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprRecordConstruct => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprFieldAccess => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-    TargetValueExprMatch => target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: expr)
-  }
-}
-
-fn target_value_expr_bool_literal_octet_body_tokens_otherwise(expr: TargetValueExpression) -> Outcome<List<ConcreteSyntaxToken>> {
-  outcome_rejected(
-    target_value_expr_diagnostic(
-      reason: ^target_value_expr_reason_transform_shape_invalid,
-      node: expr.node
-    )
-  )
-}
-
-fn target_value_expr_int_bool_octet_scrutinee_carrier_tokens(
-  scrutinee_tokens: List<ConcreteSyntaxToken>,
-  catalog: Node,
-  projection: TargetValueExpressionProjection
-) -> Outcome<List<ConcreteSyntaxToken>> {
-  bind_outcome(
-    o: target_operator_realization_catalog_lookup(
-      catalog: catalog,
-      canonical_op: canonical_operation_op_ne()
-    ),
-    f: fn(ne_realization) {
-      match ne_realization.shape {
-        InfixToken { token: ne_token } =>
-          outcome_accepted(
-            concrete_syntax_tokens_extend(
-              acc: concrete_syntax_tokens_extend(
-                acc: scrutinee_tokens,
-                more: Cons {
-                  head: FixedToken { token_class: ne_token },
-                  tail: Empty
-                }
-              ),
-              more: Cons {
-                head: target_value_expression_binding_ref_token(
-                  binding: ^dag_binding_octet_zero,
-                  projection: projection
-                ),
-                tail: Empty
-              }
-            )
-          )
-        PrefixToken { token: _ } => target_value_expr_int_bool_octet_scrutinee_carrier_tokens_otherwise(catalog: catalog)
-        CallIdent { ident: _ } => target_value_expr_int_bool_octet_scrutinee_carrier_tokens_otherwise(catalog: catalog)
-        MethodIdent { ident: _ } => target_value_expr_int_bool_octet_scrutinee_carrier_tokens_otherwise(catalog: catalog)
-        OperandUnchanged => target_value_expr_int_bool_octet_scrutinee_carrier_tokens_otherwise(catalog: catalog)
-      }
-    }
-  )
-}
-
-fn target_value_expr_int_bool_octet_scrutinee_carrier_tokens_otherwise(catalog: Node) -> Outcome<List<ConcreteSyntaxToken>> {
-  outcome_rejected(
-    target_operator_realization_catalog_miss_diagnostic(catalog: catalog)
-  )
-}
-
-fn target_value_expr_match_arm_tokens_int_bool_octet_channel(
-  arms: List<TargetValueExprMatchArmSlot>,
-  projection: TargetValueExpressionProjection,
-  catalog: Node
-) -> Outcome<List<ConcreteSyntaxToken>> {
-  match fold(
-    arms,
-    init: Accepted { value: Empty, diagnostics: None },
-    f: fn(acc, arm) {
-      match acc {
-        Rejected { diagnostics: r } => acc
-        Accepted { value: prior_tokens, diagnostics: d } =>
-          bind_outcome(
-            o: target_value_expression_to_concrete_tokens(
-              expr: arm.pattern,
-              projection: projection,
-              catalog: catalog
-            ),
-            f: fn(pattern_tokens) {
-              bind_outcome(
-                o: target_value_expr_bool_literal_octet_body_tokens(
-                  expr: arm.body,
-                  projection: projection
-                ),
-                f: fn(body_tokens) {
-                  let arm_chunk = concrete_syntax_tokens_extend(
-                    acc: concrete_syntax_tokens_snoc_fixed(
-                      acc: pattern_tokens,
-                      token_class: projection.match_form.fat_arrow
-                    ),
-                    more: body_tokens
-                  )
-                  if is_empty(xs: prior_tokens) {
-                    outcome_accepted(arm_chunk)
-                  } else {
-                    outcome_accepted(
-                      concrete_syntax_tokens_extend(
-                        acc: concrete_syntax_tokens_snoc_fixed(
-                          acc: prior_tokens,
-                          token_class: projection.match_form.arm_separator
-                        ),
-                        more: arm_chunk
-                      )
-                    )
-                  }
-                }
-              )
-            }
-          )
-      }
-    }
-  ) {
-    Accepted { value: tokens, diagnostics: d } => Accepted { value: tokens, diagnostics: d }
-    Rejected { diagnostics: r } => Rejected { diagnostics: r }
-  }
-}
 
 fn target_value_expression_match_to_concrete_tokens(
   expr: TargetValueExpression,
@@ -8509,53 +8296,22 @@ fn target_value_expression_match_to_concrete_tokens_inner(
                   catalog: catalog
                 ),
                 f: fn(scrutinee_tokens) {
-                  if target_value_expr_match_is_int_bool_octet_channel(
-                    scrutinee: scrutinee,
-                    arms: arms
-                  ) {
-                    bind_outcome(
-                      o: target_value_expr_int_bool_octet_scrutinee_carrier_tokens(
-                        scrutinee_tokens: scrutinee_tokens,
-                        catalog: catalog,
-                        projection: projection
-                      ),
-                      f: fn(carrier_scrutinee_tokens) {
-                        bind_outcome(
-                          o: target_value_expr_match_arm_tokens_int_bool_octet_channel(
-                            arms: arms,
-                            projection: projection,
-                            catalog: catalog
-                          ),
-                          f: fn(arm_tokens) {
-                            outcome_accepted(
-                              target_value_expression_match_concrete_token_shell(
-                                scrutinee_tokens: carrier_scrutinee_tokens,
-                                arm_tokens: arm_tokens,
-                                projection: projection
-                              )
-                            )
-                          }
-                        )
-                      }
-                    )
-                  } else {
-                    bind_outcome(
-                      o: target_value_expr_match_arm_tokens(
-                        arms: arms,
-                        projection: projection,
-                        catalog: catalog
-                      ),
-                      f: fn(arm_tokens) {
-                        outcome_accepted(
-                          target_value_expression_match_concrete_token_shell(
-                            scrutinee_tokens: scrutinee_tokens,
-                            arm_tokens: arm_tokens,
-                            projection: projection
-                          )
+                  bind_outcome(
+                    o: target_value_expr_match_arm_tokens(
+                      arms: arms,
+                      projection: projection,
+                      catalog: catalog
+                    ),
+                    f: fn(arm_tokens) {
+                      outcome_accepted(
+                        target_value_expression_match_concrete_token_shell(
+                          scrutinee_tokens: scrutinee_tokens,
+                          arm_tokens: arm_tokens,
+                          projection: projection
                         )
-                      }
-                    )
-                  }
+                      )
+                    }
+                  )
                 }
               )
             }
@@ -15378,7 +15134,7 @@ fn target_value_expr_project_int_literal_atom(node: Node) -> Outcome<TargetValue
             Absent =>
               outcome_accepted(
                 target_value_expression_int_literal(
-                  lexeme: integer_int_to_decimal_string(value: magnitude),
+                  lexeme: int_to_decimal_string(value: magnitude),
                   source: node
                 )
               )
@@ -15402,6 +15158,10 @@ fn target_value_expr_binding_ref_for_literal_atom(id: Symbol) -> Optional<Symbol
     optional_present(value: ^dag_binding_pick_lit_two)
   } else if id == ^dag_rec_lit_nine {
     optional_present(value: ^dag_binding_rec_lit_nine)
+  } else if id == ^dag_binding_rec_v {
+    optional_present(value: ^dag_binding_rec_v)
+  } else if id == ^dag_binding_type_variant_true {
+    optional_present(value: ^dag_binding_type_variant_true)
   } else {
     optional_absent()
   }
@@ -16720,4 +16480,4 @@ fn target_project_arrow_body_by_kind_otherwise(body: Node) -> Outcome<TargetValu
   )
 }
 
-data target_value_expr_int_bool_octet_channel_dissolve_on: DissolutionCondition = unbound_dissolution(description: "the modeled octet-to-bool codec authority is inhabited over the \{0,1} domain (NOT general nonzero), at which point this inline `x != 0` scrutinee staging bridge at the match seam grounds on it and deletes")
+data target_value_expr_int_bool_octet_channel_dissolve_on: DissolutionCondition = unbound_dissolution(description: "the modeled octet-to-bool codec authority is inhabited over the \{0,1} domain (NOT general nonzero), at which point the remaining infer_match_int_scrutinee_bool_literal_scaffold diagnostic grounds on it and deletes (emit match-seam production already uprooted)")
diff --git a/src/v2/std/demand_engine.dag b/src/v2/std/demand_engine.dag
index 8f1d3cdd514..42c36305b17 100644
--- a/src/v2/std/demand_engine.dag
+++ b/src/v2/std/demand_engine.dag
@@ -17,7 +17,7 @@ import std.optional { Absent, Optional, Present, optional_absent, optional_prese
 import v2.std.dependency { DependencyRelation }
 import v2.std.integer { Int }
 import v2.std.text { String }
-import std.materialization_ladder { DemandNature, FreshEffect, IdempotentEffect, PureComputation, WorldRead }
+import std.materialization_ladder { DemandNature, FreshEffect, IdempotentEffect, PureComputation, WorldRead, nature_eq }
 import std.judgment_contract { DemandIdentity, demand_identity_canonical }
 
 // ═══════════════════════════════════════════════════════════════════════════════════════════
@@ -68,7 +68,7 @@ type DemandBlockedCause
   | BlockedWaitingForCapacity
   | BlockedLookupPending
   | BlockedNoDemand
-  | BlockedKeyConflict
+  | BlockedKeyConflict { stored: DemandNature, requested: DemandNature }
 
 fn demand_blocked_cause_text(c: DemandBlockedCause) -> String {
   match c {
@@ -78,7 +78,7 @@ fn demand_blocked_cause_text(c: DemandBlockedCause) -> String {
     BlockedWaitingForCapacity => "ready, but no lease was offered for its requirements"
     BlockedLookupPending => "a materialization lookup for this demand has not answered"
     BlockedNoDemand => "nothing demanded this judgment"
-    BlockedKeyConflict => "two distinct subjects derived one demand key"
+    BlockedKeyConflict { stored: _, requested: _ } => "one demand key was requested under two different natures, so it names two demands"
   }
 }
 
@@ -170,7 +170,7 @@ fn demand_state_is_cycle_blocked<V>(s: DemandState<V>) -> Bool {
         BlockedWaitingForCapacity => false
         BlockedLookupPending => false
         BlockedNoDemand => false
-        BlockedKeyConflict => false
+        BlockedKeyConflict { stored: _, requested: _ } => false
       }
     DemandWaiting => false
     DemandReady => false
@@ -183,10 +183,82 @@ fn demand_state_is_cycle_blocked<V>(s: DemandState<V>) -> Bool {
   }
 }
 
+// A KEY CONFLICT IS ALSO A VERDICT FOR THE WHOLE RUN. The key was requested under two different
+// natures, so it does not name one demand and no later lifecycle step can make it name one again:
+// readiness, seal and settlement each carry it rather than re-deriving over it.
+fn demand_state_is_key_conflict<V>(s: DemandState<V>) -> Bool {
+  match s {
+    DemandBlocked { cause: c } =>
+      match c {
+        BlockedKeyConflict { stored: _, requested: _ } => true
+        BlockedByCycle { members: _ } => false
+        BlockedByMissingEdge { prerequisite: _ } => false
+        BlockedByRefusedPrerequisite { prerequisite: _ } => false
+        BlockedWaitingForCapacity => false
+        BlockedLookupPending => false
+        BlockedNoDemand => false
+      }
+    DemandWaiting => false
+    DemandReady => false
+    DemandLeasePending => false
+    DemandRunning => false
+    DemandSuspended => false
+    DemandCommitPending => false
+    DemandAvailable { value: _ } => false
+    DemandRefused => false
+  }
+}
+
+// A dependent reads a key-conflicted prerequisite as refused: its value can no longer be trusted to
+// answer the demand the dependent named, so waiting on it would be a stall with no cause.
+fn demand_state_refuses_dependents<V>(s: DemandState<V>) -> Bool {
+  demand_state_is_refused(s: s) || demand_state_is_key_conflict(s: s)
+}
+
 fn demand_state_is_settled<V>(s: DemandState<V>) -> Bool {
   demand_state_is_available(s: s) || demand_state_is_refused(s: s)
 }
 
+fn demand_state_is_blocked<V>(s: DemandState<V>) -> Bool {
+  match s {
+    DemandBlocked { cause: _ } => true
+    DemandWaiting => false
+    DemandReady => false
+    DemandLeasePending => false
+    DemandRunning => false
+    DemandSuspended => false
+    DemandCommitPending => false
+    DemandAvailable { value: _ } => false
+    DemandRefused => false
+  }
+}
+
+// A VERDICT THAT OUTLIVES THE PRODUCTION UNDER IT. A production may finish after its own key was found
+// conflicted or after a prerequisite it read refused; its report is counted, but its result answers no
+// demand that still stands, so it does not replace the verdict.
+fn demand_state_stands_over_a_report<V>(s: DemandState<V>) -> Bool {
+  match s {
+    DemandBlocked { cause: c } =>
+      match c {
+        BlockedKeyConflict { stored: _, requested: _ } => true
+        BlockedByRefusedPrerequisite { prerequisite: _ } => true
+        BlockedByCycle { members: _ } => false
+        BlockedByMissingEdge { prerequisite: _ } => false
+        BlockedWaitingForCapacity => false
+        BlockedLookupPending => false
+        BlockedNoDemand => false
+      }
+    DemandWaiting => false
+    DemandReady => false
+    DemandLeasePending => false
+    DemandRunning => false
+    DemandSuspended => false
+    DemandCommitPending => false
+    DemandAvailable { value: _ } => false
+    DemandRefused => false
+  }
+}
+
 // ═══════════════════════════════════════════════════════════════════════════════════════════
 // THE ENTRY: ONE PRODUCTION, MANY ATTACHMENTS
 // ═══════════════════════════════════════════════════════════════════════════════════════════
@@ -202,6 +274,7 @@ type DemandEntry<V> {
   state: DemandState<V>
   attachments: Int
   productions: Int
+  seat_held: Bool
 }
 
 fn demand_entry_new<V>(identity: DemandIdentity, nature: DemandNature) -> DemandEntry<V> {
@@ -210,7 +283,8 @@ fn demand_entry_new<V>(identity: DemandIdentity, nature: DemandNature) -> Demand
     nature: nature,
     state: DemandWaiting,
     attachments: 0,
-    productions: 0
+    productions: 0,
+    seat_held: false
   }
 }
 
@@ -284,13 +358,18 @@ fn demand_entry_state<V>(entry: DemandEntry<V>) -> DemandState<V> {
   entry.state
 }
 
+fn demand_entry_holds_seat<V>(entry: DemandEntry<V>) -> Bool {
+  entry.seat_held
+}
+
 fn demand_entry_with_state<V>(entry: DemandEntry<V>, state: DemandState<V>) -> DemandEntry<V> {
   DemandEntry {
     identity: entry.identity,
     nature: entry.nature,
     state: state,
     attachments: entry.attachments,
-    productions: entry.productions
+    productions: entry.productions,
+    seat_held: entry.seat_held
   }
 }
 
@@ -300,7 +379,21 @@ fn demand_entry_produced<V>(entry: DemandEntry<V>, state: DemandState<V>) -> Dem
     nature: entry.nature,
     state: state,
     attachments: entry.attachments,
-    productions: entry.productions + 1
+    productions: entry.productions + 1,
+    seat_held: entry.seat_held
+  }
+}
+
+// A SETTLEMENT IS THE PRODUCER'S REPORT, AND ONLY THE PRODUCER MOVES THE SEAT. The seat is held exactly
+// while the producer last reported running, whatever verdict the demand's state carries meanwhile.
+fn demand_entry_settled<V>(entry: DemandEntry<V>, state: DemandState<V>, reported: DemandState<V>) -> DemandEntry<V> {
+  DemandEntry {
+    identity: entry.identity,
+    nature: entry.nature,
+    state: state,
+    attachments: entry.attachments,
+    productions: entry.productions + 1,
+    seat_held: demand_state_is_running(s: reported)
   }
 }
 
@@ -310,7 +403,8 @@ fn demand_entry_attached<V>(entry: DemandEntry<V>) -> DemandEntry<V> {
     nature: entry.nature,
     state: entry.state,
     attachments: entry.attachments + 1,
-    productions: entry.productions
+    productions: entry.productions,
+    seat_held: entry.seat_held
   }
 }
 
@@ -408,7 +502,11 @@ fn demand_engine_request<V>(
 ) -> DemandEngine<V> {
   match demand_engine_entry(e: e, id: id) {
     Present { value: existing } =>
-      if demand_nature_admits_sharing(nature: existing.nature) {
+      if demand_state_is_key_conflict(s: existing.state) {
+        e
+      } else if !nature_eq(a: existing.nature, b: nature) {
+        demand_engine_key_conflict(e: e, existing: existing, requested: nature)
+      } else if demand_nature_admits_sharing(nature: existing.nature) {
         DemandEngine {
           entries: map_insert(
             m: e.entries,
@@ -463,6 +561,51 @@ fn demand_engine_request<V>(
   }
 }
 
+// ONE KEY, TWO NATURES. Sharing is decided by the nature, so an entry may answer a request only when
+// the request declares the SAME complete nature: comparing either side's sharing permission alone
+// would attach a fresh effect to a pure entry in one order and a pure request to a fresh entry in the
+// other, and Pure and Idempotent both share while being different contracts. The comparison is the
+// ladder's own nature_eq, not a second one written here. The entry leaves the ready order, its direct
+// dependents are re-derived (they now read a refused prerequisite), and the conflict stands for the
+// rest of the run -- including over a result that was already available, which is no longer a
+// trustworthy answer for either demand. A production already running keeps its seat: the conflict is a
+// verdict about the key, not the end of the work, and the seat is released when that production reports.
+fn demand_engine_key_conflict<V>(
+  e: DemandEngine<V>,
+  existing: DemandEntry<V>,
+  requested: DemandNature
+) -> DemandEngine<V> {
+  let id = existing.identity
+  let conflict: DemandState<V> = DemandBlocked {
+    cause: BlockedKeyConflict { stored: existing.nature, requested: requested }
+  }
+  let marked = DemandEngine {
+    entries: map_insert(m: e.entries, key: id, value: demand_entry_with_state(entry: existing, state: conflict)),
+    entry_order: e.entry_order,
+    relations: e.relations,
+    dependents_of: e.dependents_of,
+    prerequisites_of: e.prerequisites_of,
+    ready: demand_ready_remove(ready: e.ready, id: id),
+    in_flight: e.in_flight,
+    completion_order: e.completion_order,
+    readiness_computations: e.readiness_computations,
+    entries_visited: e.entries_visited + 1
+  }
+  let direct = demand_engine_dependents(e: marked, id: id)
+  DemandEngine {
+    entries: demand_engine_reevaluate_only(e: marked, ids: direct),
+    entry_order: marked.entry_order,
+    relations: marked.relations,
+    dependents_of: marked.dependents_of,
+    prerequisites_of: marked.prerequisites_of,
+    ready: demand_ready_sync_many(e: marked, ready: marked.ready, ids: direct),
+    in_flight: marked.in_flight,
+    completion_order: marked.completion_order,
+    readiness_computations: marked.readiness_computations + length(xs: direct),
+    entries_visited: marked.entries_visited + length(xs: direct)
+  }
+}
+
 fn demand_engine_adjacency_push(
   m: Map<DemandIdentity, List<DemandIdentity>>,
   key: DemandIdentity,
@@ -558,6 +701,10 @@ fn demand_in_cycle<V>(e: DemandEngine<V>, id: DemandIdentity) -> Bool {
 //
 // A SETTLED DEMAND KEEPS ITS OWN STATE. Recomputing readiness for something already available
 // would discard the value it carries.
+//
+// A DEMAND WHOSE PRODUCTION HOLDS A SEAT KEEPS ITS LIFECYCLE STATE unless a prerequisite now blocks it.
+// Re-deriving it to ready would offer a second admission for work already in flight; a block is a
+// verdict on the demand and lands, while the seat stays with the production until it reports.
 fn demand_readiness<V>(e: DemandEngine<V>, id: DemandIdentity) -> DemandState<V> {
   match demand_engine_entry(e: e, id: id) {
     Absent => DemandBlocked { cause: BlockedNoDemand }
@@ -566,40 +713,47 @@ fn demand_readiness<V>(e: DemandEngine<V>, id: DemandIdentity) -> DemandState<V>
         entry.state
       } else if demand_state_is_cycle_blocked(s: entry.state) {
         entry.state
+      } else if demand_state_is_key_conflict(s: entry.state) {
+        entry.state
       } else {
-        let prereqs = demand_engine_prerequisites(e: e, id: id)
-        let missing = filter(xs: prereqs, predicate: fn(p) { !demand_engine_has(e: e, id: p) })
-        let refused = filter(
-          xs: prereqs,
-          predicate: fn(p) {
-            match demand_engine_entry(e: e, id: p) {
-              Absent => false
-              Present { value: pe } => demand_state_is_refused(s: pe.state)
+        let derived = demand_readiness_from_prerequisites(e: e, id: id)
+        if demand_entry_holds_seat(entry: entry) && !demand_state_is_blocked(s: derived) { entry.state } else { derived }
+      }
+  }
+}
+
+fn demand_readiness_from_prerequisites<V>(e: DemandEngine<V>, id: DemandIdentity) -> DemandState<V> {
+  let prereqs = demand_engine_prerequisites(e: e, id: id)
+  let missing = filter(xs: prereqs, predicate: fn(p) { !demand_engine_has(e: e, id: p) })
+  let refused = filter(
+    xs: prereqs,
+    predicate: fn(p) {
+      match demand_engine_entry(e: e, id: p) {
+        Absent => false
+        Present { value: pe } => demand_state_refuses_dependents(s: pe.state)
+      }
+    }
+  )
+  match missing {
+    Cons { head: m, tail: _ } => DemandBlocked { cause: BlockedByMissingEdge { prerequisite: m } }
+    Empty =>
+      match refused {
+        Cons { head: r, tail: _ } =>
+          DemandBlocked { cause: BlockedByRefusedPrerequisite { prerequisite: r } }
+        Empty =>
+          if for_all(
+            xs: prereqs,
+            predicate: fn(p) {
+              match demand_engine_entry(e: e, id: p) {
+                Absent => false
+                Present { value: pe } => demand_state_is_available(s: pe.state)
+              }
             }
+          ) {
+            DemandReady
+          } else {
+            DemandWaiting
           }
-        )
-        match missing {
-          Cons { head: m, tail: _ } => DemandBlocked { cause: BlockedByMissingEdge { prerequisite: m } }
-          Empty =>
-            match refused {
-              Cons { head: r, tail: _ } =>
-                DemandBlocked { cause: BlockedByRefusedPrerequisite { prerequisite: r } }
-              Empty =>
-                if for_all(
-                  xs: prereqs,
-                  predicate: fn(p) {
-                    match demand_engine_entry(e: e, id: p) {
-                      Absent => false
-                      Present { value: pe } => demand_state_is_available(s: pe.state)
-                    }
-                  }
-                ) {
-                  DemandReady
-                } else {
-                  DemandWaiting
-                }
-            }
-        }
       }
   }
 }
@@ -618,13 +772,14 @@ fn demand_engine_seal<V>(e: DemandEngine<V>) -> DemandEngine<V> {
       entries: demand_engine_entries_mapped(
         e: e,
         f: fn(entry) {
-          if demand_in_cycle(e: e, id: entry.identity) {
+          if demand_in_cycle(e: e, id: entry.identity) && !demand_state_is_key_conflict(s: entry.state) {
             DemandEntry {
               identity: entry.identity,
               nature: entry.nature,
               state: DemandBlocked { cause: BlockedByCycle { members: [entry.identity] } },
               attachments: entry.attachments,
-              productions: entry.productions
+              productions: entry.productions,
+              seat_held: entry.seat_held
             }
           } else {
             entry
@@ -676,7 +831,8 @@ fn demand_engine_reevaluated_states<V>(e: DemandEngine<V>) -> DemandEngine<V> {
           nature: entry.nature,
           state: demand_readiness(e: e, id: entry.identity),
           attachments: entry.attachments,
-          productions: entry.productions
+          productions: entry.productions,
+          seat_held: entry.seat_held
         }
       }
     ),
@@ -761,14 +917,19 @@ fn demand_ready_sync<V>(
 // no demand is ever observably in flight, so the state has nothing to mark; with more than one, the
 // admission must mark it and settlement must clear it, and the delta below is what clears it.
 //
-// IT STAYS DERIVED FROM STATE RATHER THAN HARDCODED for the same reason. Returning 0 with a comment
-// would be correct today and a fail-open the moment that producer lands -- admitting past the seat
-// count because the count was a literal -- and the delta costs nothing while the frontier stands.
-fn demand_in_flight_delta<V>(before: DemandState<V>, after: DemandState<V>) -> Int {
-  if demand_state_is_running(s: after) {
-    if demand_state_is_running(s: before) { 0 } else { 1 }
+// IT STAYS DERIVED RATHER THAN HARDCODED for the same reason. Returning 0 with a comment would be
+// correct today and a fail-open the moment that producer lands -- admitting past the seat count because
+// the count was a literal -- and the delta costs nothing while the frontier stands.
+//
+// IT IS DERIVED FROM THE ENTRY'S SEAT, NOT FROM ITS STATE. A verdict (a key conflict, a refused
+// prerequisite) can replace a running demand's state while its production is still underway; reading
+// the seat off the state would release it at the verdict and lose it at the report. Only the producer's
+// own report moves the seat (demand_entry_settled).
+fn demand_in_flight_delta(before: Bool, after: Bool) -> Int {
+  if after {
+    if before { 0 } else { 1 }
   } else {
-    if demand_state_is_running(s: before) { 0 - 1 } else { 0 }
+    if before { 0 - 1 } else { 0 }
   }
 }
 
@@ -791,7 +952,7 @@ fn demand_ready_rebuild<V>(e: DemandEngine<V>) -> List<DemandIdentity> {
 }
 
 fn demand_in_flight_rebuild<V>(e: DemandEngine<V>) -> Int {
-  length(xs: filter(xs: demand_engine_all_entries(e: e), predicate: fn(entry) { demand_state_is_running(s: entry.state) }))
+  length(xs: filter(xs: demand_engine_all_entries(e: e), predicate: fn(entry) { demand_entry_holds_seat(entry: entry) }))
 }
 
 // ═══════════════════════════════════════════════════════════════════════════════════════════
@@ -846,6 +1007,10 @@ fn demand_engine_next<V>(e: DemandEngine<V>, offer: DemandLeaseOffer) -> DemandA
 // bound checkable from outside, since a rescan would reach the same final states. The completion order is recorded rather than derived afterwards because it is the
 // receipt the A/B cutover compares: two runs of one closure must complete in one order, and an
 // order reconstructed from final states has already lost it.
+//
+// A production that completes after its key was found conflicted, or after a prerequisite it read
+// refused, still counts as produced and releases its seat, but its result does not replace the verdict
+// (demand_state_stands_over_a_report).
 fn demand_engine_settle<V>(
   e: DemandEngine<V>,
   id: DemandIdentity,
@@ -855,14 +1020,19 @@ fn demand_engine_settle<V>(
     Absent => DemandWaiting
     Present { value: prior } => demand_entry_state(entry: prior)
   }
+  let held = match map_lookup(m: e.entries, key: id) {
+    Absent => false
+    Present { value: prior } => demand_entry_holds_seat(entry: prior)
+  }
+  let landed = if demand_state_stands_over_a_report(s: before) { before } else { state }
   let settled = DemandEngine {
-    entries: demand_engine_settle_entry(e: e, id: id, state: state),
+    entries: demand_engine_settle_entry(e: e, id: id, state: landed, reported: state),
     entry_order: e.entry_order,
     relations: e.relations,
     dependents_of: e.dependents_of,
     prerequisites_of: e.prerequisites_of,
-    ready: demand_ready_sync(ready: e.ready, id: id, state: state),
-    in_flight: e.in_flight + demand_in_flight_delta(before: before, after: state),
+    ready: demand_ready_sync(ready: e.ready, id: id, state: landed),
+    in_flight: e.in_flight + demand_in_flight_delta(before: held, after: demand_state_is_running(s: state)),
     completion_order: list_snoc_item(xs: e.completion_order, item: id),
     readiness_computations: e.readiness_computations,
     entries_visited: e.entries_visited + 1
@@ -889,12 +1059,13 @@ fn demand_engine_settle<V>(
 fn demand_engine_settle_entry<V>(
   e: DemandEngine<V>,
   id: DemandIdentity,
-  state: DemandState<V>
+  state: DemandState<V>,
+  reported: DemandState<V>
 ) -> Map<DemandIdentity, DemandEntry<V>> {
   match map_lookup(m: e.entries, key: id) {
     Absent => e.entries
     Present { value: entry } =>
-      map_insert(m: e.entries, key: id, value: demand_entry_produced(entry: entry, state: state))
+      map_insert(m: e.entries, key: id, value: demand_entry_settled(entry: entry, state: state, reported: reported))
   }
 }
 
diff --git a/src/v2/std/diagnostic.dag b/src/v2/std/diagnostic.dag
index 8956d54c4c7..64221d2dd4b 100644
--- a/src/v2/std/diagnostic.dag
+++ b/src/v2/std/diagnostic.dag
@@ -4,7 +4,7 @@ import std.types { List }
 import v2.std.algebra { bag_eq, fold_list }
 import std.algebra { FreeMonoid, Monoid, Semigroup, list_append, list_snoc_item, freemonoid_empty }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
-import v2.std.node { Node, Symbol }
+import v2.std.node { Node, Symbol, symbol_lexeme }
 
 type Extent
   = WholeFile
@@ -56,6 +56,12 @@ type NonEmptyDiagnostics {
 
 data non_empty_diagnostics_dissolve_trigger: DissolutionCondition = unbound_dissolution(description: "migrate_when_host_emit_names_free_semigroup — NonEmptyDiagnostics is FreeSemigroup<Diagnostic> by shape (one required Diagnostic plus a list of Diagnostic). It is not an Option alias: that host-emit mapping is Diagnostics -> Option<NonEmptyDiagnostics> via v1.compiler.emit_rust render_rust_diagnostics_carrier_applied, which hardcodes the type name NonEmptyDiagnostics as the Option inner. Dissolve into std.algebra FreeSemigroup<Diagnostic> when that renderer names FreeSemigroup rather than this monomorph; until then a second pair carrier remains.")
 
+// A refusal's reasons by name, in order. A producer whose consumer seam is String-typed cannot hand
+// the refusal on as data, so the text it hands on instead must still name what refused and why.
+fn diagnostics_reason_lexemes(diagnostics: NonEmptyDiagnostics) -> String {
+  join(map(concat([diagnostics.head], diagnostics.tail), d => symbol_lexeme(sym: d.reason)), ", ")
+}
+
 type Diagnostics
   = None
   | Some { diagnostics: NonEmptyDiagnostics }
diff --git a/src/v2/std/generic_instantiation.dag b/src/v2/std/generic_instantiation.dag
index 53b4b848fe5..f795fd4bce1 100644
--- a/src/v2/std/generic_instantiation.dag
+++ b/src/v2/std/generic_instantiation.dag
@@ -24,7 +24,7 @@ fn generic_substitution_bind_once(
   name: String,
   concrete: Node,
 ) -> Outcome<GenericSubstitution> {
-  match v2.std.collection.map_get(subst, name) {
+  match v2.std.collection.map_get_checked(subst, name) {
     Accepted { value: Absent, diagnostics: _ } =>
       outcome_accepted(value: map_insert(subst, name, concrete))
     Accepted { value: Present { value: bound }, diagnostics: _ } =>
diff --git a/src/v2/std/grammar.dag b/src/v2/std/grammar.dag
index 4508ed40a68..eb45528c11d 100644
--- a/src/v2/std/grammar.dag
+++ b/src/v2/std/grammar.dag
@@ -15,7 +15,6 @@ import v2.std.collection {
 }
 import std.optional {
   Absent,
-  Optional,
   Present,
   optional_absent,
   optional_present
@@ -53,6 +52,7 @@ import v2.std.node {
   Symbol,
   TypeNode,
   StructuralLabel,
+  symbol_intern_lexeme,
 }
 import v2.std.node_shape { stamp_node_shape_synthetic, type_shape }
 import v2.std.compilers.target_model {
@@ -64,6 +64,7 @@ import v2.std.compilers.target_model {
   concrete_syntax_token_to_node,
 }
 import v2.std.text { String }
+import std.integer { int_to_decimal_string }
 
 type FormalTerminal {
   identity: Symbol
@@ -74,7 +75,7 @@ type FormalNonterminal {
 }
 
 type FormalGrammarSymbol
-  = FormalTerminalOccurrence { terminal: FormalTerminal, binding: Optional<Symbol> }
+  = FormalTerminalOccurrence { terminal: FormalTerminal, binding: std.optional.Optional<Symbol> }
   | FormalNonterminalOccurrence { nonterminal: FormalNonterminal }
   | FormalNestedNonterminalOccurrence { nonterminal: FormalNonterminal, unit: Symbol }
 
@@ -241,6 +242,116 @@ type GrammarExpr
   | RefuseOnMatch { element: GrammarExpr, reason: ParseRefusalReason }
   | AfterLineBreak { element: GrammarExpr }
   | NotPredicate { element: GrammarExpr }
+  | InfixTable { operand: GrammarExpr, continuation_guard: GrammarExpr, operators: List<InfixOperatorRow> }
+
+// AN OPERATOR TABLE, READ BY PRECEDENCE CLIMBING: ONE TREE NODE PER OPERATOR APPLICATION.
+// `InfixTable { operand, continuation_guard, operators }` matches an operand followed by any number
+// of `operator operand` continuations, and states WHICH operands each operator binds by the rows'
+// binding powers rather than by nesting one grammar level per precedence. A tower of levels --
+// `level = sequence(next_level, repeat(sequence(op, next_level)))`, once per precedence -- states
+// the same language, but every operand then walks every level and the parse stamps an empty
+// continuation at each, so the tree carries one node per LEVEL per operand that no reader wants and
+// the lowering had to strip again (docs/plans/precedence-climbing-tree-contract.md). Here an operand
+// with no operator after it is captured as itself, and each operator consumed is ONE application
+// node with three projections (grammar_infix_left / _operator / _right).
+//
+// The rows are an index, never an ordered alternative: each row names ONE token class, and grammar
+// validation refuses a table that names a class twice (v2.compiler.parse
+// grammar_infix_tables_well_formed), so selecting a row is a lookup and no choice exists to overlap.
+// `continuation_guard` is a zero-width predicate run at every continuation point before the
+// operator is read -- the place a layout refusal such as the dag newline-minus guard stands.
+// A higher binding_power binds tighter. InfixLeft folds `a - b - c` as `(a - b) - c`;
+// InfixNonAssociative refuses a second operator of the same binding power
+// (NonAssociativeOperatorChain), so `a < b < c` is describable source no accepted tree contains.
+type InfixAssociativity = InfixLeft | InfixNonAssociative
+
+type InfixOperatorRow {
+  token_class: Symbol
+  binding_power: Int
+  associativity: InfixAssociativity
+}
+
+fn grammar_expr_infix_table(
+  operand: GrammarExpr,
+  continuation_guard: GrammarExpr,
+  operators: List<InfixOperatorRow>
+) -> GrammarExpr {
+  InfixTable { operand: operand, continuation_guard: continuation_guard, operators: operators }
+}
+
+fn grammar_infix_row_lookup(rows: List<InfixOperatorRow>, token_class: Symbol) -> Optional<InfixOperatorRow> {
+  match list_head(xs: rows) {
+    HeadAbsent => optional_absent()
+    HeadFound { value: row } =>
+      if grammar_infix_row_class(row: row) == token_class {
+        optional_present(value: row)
+      } else {
+        match list_tail(xs: rows) {
+          TailAbsent => optional_absent()
+          TailFound { tail: rest } => grammar_infix_row_lookup(rows: rest, token_class: token_class)
+        }
+      }
+  }
+}
+
+// Projectors at a typed parameter (gunbc.recurring_failure_mode.list_head_bound_record_element_stays_t).
+fn grammar_infix_row_class(row: InfixOperatorRow) -> Symbol { row.token_class }
+fn grammar_infix_row_binding_power(row: InfixOperatorRow) -> Int { row.binding_power }
+
+// The minimum binding power an operand on each side of an application of `row` must carry: a
+// left-associative left operand may repeat the row's own power, nothing else may.
+fn grammar_infix_left_min_power(row: InfixOperatorRow) -> Int {
+  match row.associativity {
+    InfixLeft => row.binding_power
+    InfixNonAssociative => row.binding_power + 1
+  }
+}
+
+fn grammar_infix_right_min_power(row: InfixOperatorRow) -> Int {
+  row.binding_power + 1
+}
+
+fn grammar_infix_operator_choice(rows: List<InfixOperatorRow>) -> Optional<GrammarExpr> {
+  match list_head(xs: rows) {
+    HeadAbsent => optional_absent()
+    HeadFound { value: row } =>
+      let here = grammar_expr_terminal(token_class: grammar_infix_row_class(row: row))
+      match list_tail(xs: rows) {
+        TailAbsent => optional_present(value: here)
+        TailFound { tail: rest } =>
+          match grammar_infix_operator_choice(rows: rest) {
+            Absent => optional_present(value: here)
+            Present { value: others } => optional_present(value: Choice { left: here, right: others })
+          }
+      }
+  }
+}
+
+// THE STRING LANGUAGE A TABLE ACCEPTS, AS AN ORDINARY EXPRESSION, for the analyses that read only
+// the language and never the tree: nullability, FIRST and k-token lookahead. Precedence decides
+// which operands an operator binds, never which token strings are admitted, so the language is
+// `operand (guard operator operand)*` -- an over-approximation by exactly the non-associative chains
+// the table refuses, which is the conservative side for an overlap proof. It is DERIVED from the
+// table and never parsed, emitted or stamped: the tree contract is the table's own.
+fn grammar_infix_table_language(
+  operand: GrammarExpr,
+  continuation_guard: GrammarExpr,
+  operators: List<InfixOperatorRow>
+) -> GrammarExpr {
+  match grammar_infix_operator_choice(rows: operators) {
+    Absent => operand
+    Present { value: ops } =>
+      Sequence {
+        left: operand,
+        right: Repeat {
+          element: Sequence {
+            left: continuation_guard,
+            right: Sequence { left: ops, right: operand }
+          }
+        }
+      }
+  }
+}
 
 // A PRODUCTION WHOSE MATCH IS A REFUSAL. `RefuseOnMatch { element, reason }` parses `element` and,
 // where it MATCHES, refuses the whole parse with `reason`, located at the first token of the match:
@@ -286,7 +397,7 @@ fn grammar_expr_expect(element: GrammarExpr, reason: ParseRefusalReason) -> Gram
 }
 
 fn grammar_expr_optional(element: GrammarExpr) -> GrammarExpr {
-  Optional { element: element }
+  v2.std.grammar.Optional { element: element }
 }
 
 fn grammar_expr_terminal(token_class: Symbol) -> GrammarExpr {
@@ -337,6 +448,7 @@ type GrammarExprFold<R> {
   refuse_on_match: fn(R, ParseRefusalReason) -> R
   after_line_break: fn(R) -> R
   not_predicate: fn(R) -> R
+  infix_table: fn(R, R, List<InfixOperatorRow>) -> R
 }
 
 fn fold_grammar_expr<R>(expr: GrammarExpr, algebra: GrammarExprFold<R>) -> R {
@@ -356,7 +468,7 @@ fn fold_grammar_expr<R>(expr: GrammarExpr, algebra: GrammarExprFold<R>) -> R {
         fold_grammar_expr(expr: left, algebra: algebra),
         fold_grammar_expr(expr: right, algebra: algebra)
       )
-    Optional { element: element } =>
+    v2.std.grammar.Optional { element: element } =>
       algebra.optional(fold_grammar_expr(expr: element, algebra: algebra))
     Repeat { element: element } =>
       algebra.repeat(fold_grammar_expr(expr: element, algebra: algebra))
@@ -368,6 +480,12 @@ fn fold_grammar_expr<R>(expr: GrammarExpr, algebra: GrammarExprFold<R>) -> R {
       algebra.after_line_break(fold_grammar_expr(expr: element, algebra: algebra))
     NotPredicate { element: element } =>
       algebra.not_predicate(fold_grammar_expr(expr: element, algebra: algebra))
+    InfixTable { operand: operand, continuation_guard: guard, operators: operators } =>
+      algebra.infix_table(
+        fold_grammar_expr(expr: operand, algebra: algebra),
+        fold_grammar_expr(expr: guard, algebra: algebra),
+        operators
+      )
   }
 }
 
@@ -540,7 +658,7 @@ fn formal_terminal_to_node(terminal: FormalTerminal) -> Node {
 }
 }
 
-fn formal_terminal_occurrence_to_node(terminal: FormalTerminal, binding: Optional<Symbol>) -> Node {
+fn formal_terminal_occurrence_to_node(terminal: FormalTerminal, binding: std.optional.Optional<Symbol>) -> Node {
   match binding {
     Present { value: binding } =>
       Node {
@@ -1149,7 +1267,7 @@ fn grammar_nested_block_edge(unit: Symbol, edges: List<Edge>) -> Edge {
   }
 }
 
-fn grammar_terminal_occurrence_to_token_edge(terminal: FormalTerminal, binding: Optional<Symbol>) -> Edge {
+fn grammar_terminal_occurrence_to_token_edge(terminal: FormalTerminal, binding: std.optional.Optional<Symbol>) -> Edge {
   match binding {
     Present { value: binding } =>
       Edge {
@@ -1634,7 +1752,7 @@ fn formal_symbol_list_insert(xs: List<Symbol>, item: Symbol) -> List<Symbol> {
 // does slot i want" by rescanning the rhs from the start for every i made resolving one node of N
 // slots O(N^2) -- the term under every long grammar row (an N-item orchestration sequence
 // measured superlinear through it).
-fn formal_production_slot_nonterminals(production: FormalProduction) -> List<Optional<Symbol>> {
+fn formal_production_slot_nonterminals(production: FormalProduction) -> List<std.optional.Optional<Symbol>> {
   fold_list(
     xs: production.rhs,
     empty: Empty,
@@ -1655,7 +1773,7 @@ fn formal_production_slot_nonterminals(production: FormalProduction) -> List<Opt
 }
 
 // The lhs set the current slot is asked for: each candidate's next slot entry, in candidate order.
-fn formal_slot_cursor_heads_asked(cursors: List<List<Optional<Symbol>>>) -> List<Symbol> {
+fn formal_slot_cursor_heads_asked(cursors: List<List<std.optional.Optional<Symbol>>>) -> List<Symbol> {
   fold_list(
     xs: cursors,
     empty: Empty,
@@ -1669,7 +1787,7 @@ fn formal_slot_cursor_heads_asked(cursors: List<List<Optional<Symbol>>>) -> List
   )
 }
 
-fn formal_slot_cursors_advanced(cursors: List<List<Optional<Symbol>>>) -> List<List<Optional<Symbol>>> {
+fn formal_slot_cursors_advanced(cursors: List<List<std.optional.Optional<Symbol>>>) -> List<List<std.optional.Optional<Symbol>>> {
   fold_list(
     xs: cursors,
     empty: Empty,
@@ -1678,7 +1796,7 @@ fn formal_slot_cursors_advanced(cursors: List<List<Optional<Symbol>>>) -> List<L
 }
 
 type SlotResolutionScan {
-  cursors: List<List<Optional<Symbol>>>
+  cursors: List<List<std.optional.Optional<Symbol>>>
   slots: List<EmittedProductionResolution>
 }
 
@@ -2443,11 +2561,61 @@ fn grammar_expr_to_node(expr: GrammarExpr) -> Node {
         grammar_expr_node(children: [
           grammar_named_edge(name: ^grammar_not_predicate_element_node_projection, target: element_node)
         ])
+      },
+      infix_table: fn(operand_node, guard_node, operators) {
+        grammar_expr_node(children: [
+          grammar_named_edge(name: ^grammar_infix_table_operand_node_projection, target: operand_node),
+          grammar_named_edge(name: ^grammar_infix_table_guard_node_projection, target: guard_node),
+          grammar_named_edge(
+            name: ^grammar_infix_table_operators_node_projection,
+            target: grammar_infix_rows_node(rows: operators)
+          )
+        ])
       }
     }
   )
 }
 
+fn grammar_infix_associativity_symbol(associativity: InfixAssociativity) -> Symbol {
+  match associativity {
+    InfixLeft => ^grammar_infix_left_associative
+    InfixNonAssociative => ^grammar_infix_non_associative
+  }
+}
+
+// The rows as a right-folded spine, as a repeat's capture is: a Conj's labels are unique, so a list
+// cannot be one Conj with a repeated label.
+fn grammar_infix_rows_node(rows: List<InfixOperatorRow>) -> Node {
+  match list_head(xs: rows) {
+    HeadAbsent => grammar_expr_node(children: [])
+    HeadFound { value: row } =>
+      grammar_expr_node(children: [
+        grammar_named_edge(name: ^grammar_sequence_left_node_projection, target: grammar_infix_row_node(row: row)),
+        grammar_named_edge(
+          name: ^grammar_sequence_right_node_projection,
+          target: match list_tail(xs: rows) {
+            TailAbsent => grammar_expr_node(children: [])
+            TailFound { tail: rest } => grammar_infix_rows_node(rows: rest)
+          }
+        )
+      ])
+  }
+}
+
+fn grammar_infix_row_node(row: InfixOperatorRow) -> Node {
+    grammar_expr_node(children: [
+      grammar_named_edge(name: ^grammar_terminal_token_class_node_projection, target: grammar_atom(identity: row.token_class)),
+      grammar_named_edge(
+        name: ^grammar_infix_binding_power_node_projection,
+        target: grammar_atom(identity: symbol_intern_lexeme(lexeme: int_to_decimal_string(value: row.binding_power)))
+      ),
+      grammar_named_edge(
+        name: ^grammar_infix_associativity_node_projection,
+        target: grammar_atom(identity: grammar_infix_associativity_symbol(associativity: row.associativity))
+      )
+    ])
+}
+
 fn grammar_production_to_node(production: GrammarProduction) -> Node {
   Node {
     kind: TypeNode {
@@ -3524,12 +3692,77 @@ fn grammar_emit_expr(index: GrammarEmitIndex, expr: GrammarExpr, node: Node) ->
     Nonterminal { production: p } => grammar_emit_production_capture(index: index, expected: p, node: node)
     Sequence { left: l, right: r } => grammar_emit_sequence(index: index, left: l, right: r, node: node)
     Choice { left: l, right: r } => grammar_emit_choice(index: index, left: l, right: r, node: node)
-    Optional { element: e } => grammar_emit_optional(index: index, element: e, node: node)
+    v2.std.grammar.Optional { element: e } => grammar_emit_optional(index: index, element: e, node: node)
     Repeat { element: e } => grammar_emit_repeat(index: index, element: e, node: node)
     Expect { element: e, reason: _ } => grammar_emit_expr(index: index, expr: e, node: node)
     RefuseOnMatch { element: _, reason: _ } => grammar_emit_mismatch(reason: ^grammar_emit_refuse_on_match_derives_no_tree, at: node)
     AfterLineBreak { element: e } => grammar_emit_after_line_break(index: index, element: e, node: node)
     NotPredicate { element: _ } => GrammarEmitWalked { terminals: [] }
+    InfixTable { operand: operand, continuation_guard: _, operators: operators } =>
+      grammar_emit_infix(index: index, operand: operand, operators: operators, node: node, min_power: 0)
+  }
+}
+
+// THE INVERSE OF v2.compiler.parse parse_expr_infix_table. A node carrying the operator projection is
+// one application: its left side, the operator's terminal, its right side. Any other node is an
+// operand. An application whose operator no row names, or whose binding power is below what its
+// position admits -- `a - (b - c)` stamped without its parentheses, or a non-associative operator
+// directly under another of the same power -- REFUSES: emitting it would write text that reads back
+// as a different tree, and a parse tree never needs a parenthesis inserted, because a grouping is an
+// operand of its own. The continuation guard is a predicate, so it emits nothing.
+fn grammar_emit_infix(
+  index: GrammarEmitIndex,
+  operand: GrammarExpr,
+  operators: List<InfixOperatorRow>,
+  node: Node,
+  min_power: Int
+) -> GrammarEmitWalk {
+  match named_child_lookup(root: node, name: ^grammar_infix_operator_node_projection) {
+    NamedChildMissing => grammar_emit_expr(index: index, expr: operand, node: node)
+    NamedChildAmbiguous => grammar_emit_projection_ambiguous(at: node)
+    NamedChildFound { target: op } =>
+      match node_atom_identity_optional(node: op) {
+        Absent => GrammarEmitRefused { diagnostic: grammar_emit_diagnostic(reason: ^grammar_emit_infix_operator_unknown, at: op) }
+        Present { value: token_class } =>
+          match grammar_infix_row_lookup(rows: operators, token_class: token_class) {
+            Absent => GrammarEmitRefused { diagnostic: grammar_emit_diagnostic(reason: ^grammar_emit_infix_operator_unknown, at: op) }
+            Present { value: row } =>
+              if grammar_infix_row_binding_power(row: row) < min_power {
+                GrammarEmitRefused { diagnostic: grammar_emit_diagnostic(reason: ^grammar_emit_infix_binding_violated, at: node) }
+              } else {
+                grammar_emit_infix_application(index: index, operand: operand, operators: operators, node: node, op: op, row: row)
+              }
+          }
+      }
+  }
+}
+
+fn grammar_emit_infix_application(
+  index: GrammarEmitIndex,
+  operand: GrammarExpr,
+  operators: List<InfixOperatorRow>,
+  node: Node,
+  op: Node,
+  row: InfixOperatorRow
+) -> GrammarEmitWalk {
+  match named_child_lookup(root: node, name: ^grammar_infix_left_node_projection) {
+    NamedChildMissing => GrammarEmitRefused { diagnostic: grammar_emit_diagnostic(reason: ^grammar_emit_infix_shape_mismatch, at: node) }
+    NamedChildAmbiguous => grammar_emit_projection_ambiguous(at: node)
+    NamedChildFound { target: left } =>
+      match named_child_lookup(root: node, name: ^grammar_infix_right_node_projection) {
+        NamedChildMissing => GrammarEmitRefused { diagnostic: grammar_emit_diagnostic(reason: ^grammar_emit_infix_shape_mismatch, at: node) }
+        NamedChildAmbiguous => grammar_emit_projection_ambiguous(at: node)
+        NamedChildFound { target: right } =>
+          match grammar_emit_infix(index: index, operand: operand, operators: operators, node: left, min_power: grammar_infix_left_min_power(row: row)) {
+            GrammarEmitWalked { terminals: l } =>
+              grammar_emit_concat(
+                left: list_snoc_item(xs: l, item: GrammarEmitClassTerminal { token_class: grammar_infix_row_class(row: row), captured: op }),
+                right: grammar_emit_infix(index: index, operand: operand, operators: operators, node: right, min_power: grammar_infix_right_min_power(row: row))
+              )
+            GrammarEmitArmMismatch { diagnostic: d } => GrammarEmitArmMismatch { diagnostic: d }
+            GrammarEmitRefused { diagnostic: d } => GrammarEmitRefused { diagnostic: d }
+          }
+      }
   }
 }
 
diff --git a/src/v2/std/grammar_choice_ambiguity.dag b/src/v2/std/grammar_choice_ambiguity.dag
index bc9e1fcc2e7..495064ae759 100644
--- a/src/v2/std/grammar_choice_ambiguity.dag
+++ b/src/v2/std/grammar_choice_ambiguity.dag
@@ -1,13 +1,11 @@
 module v2.std.grammar_choice_ambiguity
 
-import std.dissolution { DissolutionCondition, dissolution_description, unbound_dissolution }
-
 import std.algebra { FreeMonoid }
 import v2.std.node { Symbol }
 
 // GrammarChoiceAmbiguityRow is the grammar-analysis authority for FIRST-set choice overlap facts.
-// Compiler parse stage and frontier probe receipts import this module — not v2.compiler.parse — so
-// probe instrumentation does not pull the parse implementation into generic receipt consumers.
+// The parse stage's validation refuses on any row, so a row is a fact about a grammar a caller
+// supplied, never a residue an accepted grammar carries.
 
 type GrammarChoiceAmbiguityRow {
   production: Symbol
@@ -16,10 +14,3 @@ type GrammarChoiceAmbiguityRow {
   overlap_terminals: FreeMonoid<Symbol>
   both_nullable: Bool
 }
-
-type NonEmptyGrammarChoiceAmbiguityRows {
-  head: GrammarChoiceAmbiguityRow
-  tail: FreeMonoid<GrammarChoiceAmbiguityRow>
-}
-
-data non_empty_grammar_choice_ambiguity_rows_dissolve_trigger: DissolutionCondition = unbound_dissolution(description: "cut_over_overlap_row_chain — NonEmptyGrammarChoiceAmbiguityRows is FreeSemigroup<GrammarChoiceAmbiguityRow> by shape. std.algebra FreeSemigroup is already in the tree. Dissolve when v2.compiler.parse_diagnostic non_empty_grammar_choice_ambiguity_rows_from_parse_stage (and the three literals in v2.test.claim.self_host.frontier_probe_overlap_detail_test) construct FreeSemigroup<GrammarChoiceAmbiguityRow>, then delete this type. The previous event name migrate_when_free_semigroup_available has already fired.")
diff --git a/src/v2/std/grounding.dag b/src/v2/std/grounding.dag
index d403e540b7f..e7fb593e4c3 100644
--- a/src/v2/std/grounding.dag
+++ b/src/v2/std/grounding.dag
@@ -76,7 +76,7 @@ fn insert_per_language_fact_bundle_entry(
   key: PerLanguageFactBundleKey,
   fact_value: Node
 ) -> Outcome<PerLanguageFactBundleRegistry> {
-  match v2.std.collection.map_get(m: registry.by_key, key: key) {
+  match v2.std.collection.map_get_checked(m: registry.by_key, key: key) {
     Accepted { value: opt, diagnostics: _ } => match opt {
       Present { value: _ } =>
         outcome_rejected(d: per_language_fact_bundle_duplicate_key_diagnostic())
@@ -110,7 +110,7 @@ fn per_language_fact_bundle_insert_subject_axis(
   target: TargetModel,
   fact_axis: ModelCorePrimitiveFactAxis
 ) -> Outcome<PerLanguageFactBundleSpecFactsFoldState> {
-  match v2.std.collection.map_get(
+  match v2.std.collection.map_get_checked(
     m: registry.by_key,
     key: per_language_fact_bundle_subject_axis_key(
       subject_carrier: subject_carrier,
diff --git a/src/v2/std/inhabitance.dag b/src/v2/std/inhabitance.dag
index fd0c0135184..001b215407a 100644
--- a/src/v2/std/inhabitance.dag
+++ b/src/v2/std/inhabitance.dag
@@ -86,12 +86,17 @@ fn type_variable_instance_lookup(
   })
 }
 
+// A match's arms against its scrutinee's coproduct: `declared` is the scrutinee's declared
+// coproduct and `produced` is the arms' covered carrier, so the one relation decides coverage --
+// exhaustive exactly when the arms structurally equal the whole coproduct
+// (gunbc.recurring_failure_mode native_infer_accepts_only_bool_and_int_match_scrutinees).
 type DeclaredTypePosition
   = PositionDirectCallArgument
   | PositionDeclaredReturn
   | PositionRecordField { record: Node }
   | PositionLetAnnotation { bound: Node }
   | PositionBinderDefault { default: Node }
+  | PositionMatchCoverage { match_node: Node, scrutinee: Node }
 
 // type_variables are the declaring Arrow's type parameters (v2.std.type_binder type_param_names):
 // the only atoms in `declared` that name no type, and so the only thing that keeps an
@@ -142,6 +147,10 @@ fn position_record_field(record: Node) -> DeclaredTypePosition {
   PositionRecordField { record: record }
 }
 
+fn position_match_coverage(match_node: Node, scrutinee: Node) -> DeclaredTypePosition {
+  PositionMatchCoverage { match_node: match_node, scrutinee: scrutinee }
+}
+
 // An annotated let (`let x: T = e`) is a declared position like the others, not a cast. Its
 // obligation is located at the authored annotation (the declared type the author wrote, as a
 // declared return is located at the body it judges), and the position names the bound value e
@@ -161,6 +170,10 @@ fn inhabitance_no_candidate_binder_default_reason() -> Symbol {
   ^infer_reason_default_does_not_inhabit_binder_type
 }
 
+fn inhabitance_no_candidate_match_coverage_reason() -> Symbol {
+  ^infer_reason_match_arms_do_not_cover_scrutinee
+}
+
 fn inhabitance_position_symbol(position: DeclaredTypePosition) -> Symbol {
   match position {
     PositionDirectCallArgument => ^position_direct_call_argument
@@ -168,6 +181,7 @@ fn inhabitance_position_symbol(position: DeclaredTypePosition) -> Symbol {
     PositionRecordField { record: _ } => ^position_record_field
     PositionLetAnnotation { bound: _ } => ^position_let_annotation
     PositionBinderDefault { default: _ } => ^position_binder_default
+    PositionMatchCoverage { match_node: _, scrutinee: _ } => ^position_match_coverage
   }
 }
 
@@ -398,6 +412,7 @@ fn inhabitance_position_context_edges(position: DeclaredTypePosition) -> List<Ed
     PositionRecordField { record: record } => [Edge { label: Authored { name: ^inhabitance_record }, target: record }]
     PositionLetAnnotation { bound: bound } => [Edge { label: Authored { name: ^inhabitance_bound_value }, target: bound }]
     PositionBinderDefault { default: default } => [Edge { label: Authored { name: ^inhabitance_default_value }, target: default }]
+    PositionMatchCoverage { match_node: _, scrutinee: scrutinee } => [Edge { label: Authored { name: ^inhabitance_scrutinee }, target: scrutinee }]
   }
 }
 
@@ -408,6 +423,7 @@ fn inhabitance_no_candidate_reason(position: DeclaredTypePosition) -> Symbol {
     PositionRecordField { record: _ } => inhabitance_no_candidate_record_field_reason()
     PositionLetAnnotation { bound: _ } => inhabitance_no_candidate_let_annotation_reason()
     PositionBinderDefault { default: _ } => inhabitance_no_candidate_binder_default_reason()
+    PositionMatchCoverage { match_node: _, scrutinee: _ } => inhabitance_no_candidate_match_coverage_reason()
   }
 }
 
diff --git a/src/v2/std/integer.dag b/src/v2/std/integer.dag
index b1764d4b420..61488f4f00a 100644
--- a/src/v2/std/integer.dag
+++ b/src/v2/std/integer.dag
@@ -18,12 +18,12 @@ import std.optional {
 import v2.std.diagnostic { Correction, Diagnostic, ExternalContractUnknown, Locus, NoCorrectionReason, Outcome, Accepted, None, Rejected, diagnostics_singleton, node_locus, outcome_accepted, outcome_rejected, invariant_port_locus, port_refusal_locus, Unavailable, AmbiguousIntent }
 import v2.std.node { Arrow, Atom, Cardinality, ComputationNode, Conj, Disj, Edge, Instantiation, Authored, Node, Symbol, TypeNode, is_empty_conj_root }
 import v2.std.node_query { find_named_child }
-import std.integer { Signedness, Signed, Unsigned }
+import std.integer { Signedness, Signed, Unsigned, decimal_digit_of_units, int_to_decimal_string }
 import std.content_hash { Fnv1a64Structural, content_hash_atom, content_hash_tagged_structural }
 import std.types { NonEmptyStr, List }
 import v2.std.machine { Byte }
 import std.machine_constraints { Compose, MachineWidth, PointerWidth }
-import std.nat { Nat, Zero, Succ, NatQuotient, nat_div_rem_by_succ }
+import std.nat { Nat, Zero, Succ, NatQuotient, nat_div_rem_by_succ, DecimalDigit, D0, D1, D2, D3, D4, D5, D6, D7, D8, D9, decimal_digit_value }
 import v2.std.text { Char, CharAbsent, CharFound, String, string_head, string_tail }
 import std.bit { Word64 }
 type Int = GroupCompletion<Nat>
@@ -59,18 +59,6 @@ type IntegerRangeEndpoint
   = IntegerRangeInclusiveMin
   | IntegerRangeInclusiveMax
 
-type DecimalDigit
-  = D0
-  | D1
-  | D2
-  | D3
-  | D4
-  | D5
-  | D6
-  | D7
-  | D8
-  | D9
-
 type NonZeroDecimalDigit
   = NonZeroD1
   | NonZeroD2
@@ -117,39 +105,10 @@ fn integer_signed_i32_le_decode_invalid_diagnostic() -> Diagnostic {
   }
 }
 
-fn decimal_digit_value(d: DecimalDigit) -> Int {
-  match d {
-    D0 => 0
-    D1 => 1
-    D2 => 2
-    D3 => 3
-    D4 => 4
-    D5 => 5
-    D6 => 6
-    D7 => 7
-    D8 => 8
-    D9 => 9
-  }
-}
-
-data decimal_digit_roster: List<DecimalDigit> = [D0, D1, D2, D3, D4, D5, D6, D7, D8, D9]
-
 data nonzero_decimal_digit_roster: List<NonZeroDecimalDigit> = [
   NonZeroD1, NonZeroD2, NonZeroD3, NonZeroD4, NonZeroD5, NonZeroD6, NonZeroD7, NonZeroD8, NonZeroD9
 ]
 
-fn decimal_digit_of_units(value: Int) -> DecimalDigit {
-  if value >= 10 {
-    decimal_digit_of_units(value: value - 10)
-  } else {
-    fold_list(
-      xs: decimal_digit_roster,
-      empty: D0,
-      cons: fn(acc, d) { if decimal_digit_value(d: d) == value { d } else { acc } }
-    )
-  }
-}
-
 fn nonzero_decimal_digit_of_positive_units(value: Int) -> NonZeroDecimalDigit {
   fold_list(
     xs: nonzero_decimal_digit_roster,
@@ -1409,101 +1368,6 @@ fn integer_signed_i32_le_bytes_to_int(bytes: List<Byte>) -> Outcome<Int> {
   }
 }
 
-// ONE GLYPH TABLE for the ten decimal digits, keyed on the DecimalDigit coproduct this module
-// already owns; both the Peano and the machine-integer renderings below reach it through their
-// own digit selection rather than each carrying a second copy of the ten glyphs.
-fn decimal_digit_glyph(d: DecimalDigit) -> String {
-  match d {
-    D0 => "0"
-    D1 => "1"
-    D2 => "2"
-    D3 => "3"
-    D4 => "4"
-    D5 => "5"
-    D6 => "6"
-    D7 => "7"
-    D8 => "8"
-    D9 => "9"
-  }
-}
-
-// The Peano value of each decimal digit. Every arm is a kernel integer literal at a
-// Nat return boundary: the literal elaborates through the declared homomorphism
-// (gunbc.structural_realization_bindings literal_homomorphism_rows) to its Zero/Succ image --
-// this function is the return-position exemplar of std.literal_elaboration.
-fn decimal_digit_nat(d: DecimalDigit) -> Nat {
-  match d {
-    D0 => 0
-    D1 => 1
-    D2 => 2
-    D3 => 3
-    D4 => 4
-    D5 => 5
-    D6 => 6
-    D7 => 7
-    D8 => 8
-    D9 => 9
-  }
-}
-
-// A Peano digit (a Nat below ten) to its glyph: select the DecimalDigit whose Peano value equals
-// the digit by STRUCTURAL equality (std.operator_realization StructuralEquality on Nat),
-// then read the one glyph table. A digit outside the roster (ten or more) is not a decimal digit
-// and this function is not its authority: the caller obtains digits from nat_div_rem_by_succ by
-// ten, whose remainder is below ten by construction, so the fold's D0 seed is never the answer
-// for an in-domain input.
-fn integer_nat_decimal_digit_char(digit: Nat) -> String {
-  decimal_digit_glyph(d: fold_list(
-    xs: decimal_digit_roster,
-    empty: D0,
-    cons: fn(acc, d) { if decimal_digit_nat(d: d) == digit { d } else { acc } }
-  ))
-}
-
-// PEANO NAT TO DECIMAL TEXT over the DECLARED structural operations: division by ten is
-// nat_div_rem_by_succ with divisor predecessor nine (the divisor Succ { prev: 9 } is nonzero by
-// construction, so no zero-divisor arm exists to be handled), and the recursion descends on the
-// quotient. The literal 9 elaborates at the argument boundary (std.literal_elaboration). No host
-// operator is applied to a Nat here: the previous body spelled `value == 0`, `value < 10`,
-// `value / 10` and `value - (rest * 10)` on Rc<Nat>, which rustc refused (E0308 x10, E0369) and
-// which the operator realization authority now refuses at emission by typed diagnostic instead.
-fn integer_nat_to_decimal_string(value: Nat) -> String {
-  let q = nat_div_rem_by_succ(a: value, divisor_prev: 9)
-  match q.quotient {
-    Zero => integer_nat_decimal_digit_char(digit: q.remainder)
-    Succ { prev: _ } =>
-      concat(
-        integer_nat_to_decimal_string(value: q.quotient),
-        integer_nat_decimal_digit_char(digit: q.remainder)
-      )
-  }
-}
-
-// MACHINE INTEGER TO DECIMAL TEXT. Int realizes as the host integer, so host division and
-// remainder are its declared operations (std.operator_realization HostOperator); the digit glyph
-// comes from the same one table. This is the formatter the two Int-valued callers that previously
-// passed an Int into the Nat renderer's parameter (v2.std.native_agreement octet_display,
-// v2.workflow.realization_sweep sweep_histogram_tsv) actually asked for -- the interpreter's
-// numeric grounding made that mismatch invisible there, and the emitted closure refused it
-// (E0308 Rc<Nat> vs integer).
-fn integer_int_to_decimal_string(value: Int) -> String {
-  if value < 0 {
-    concat("-", integer_int_magnitude_to_decimal_string(value: 0 - value))
-  } else {
-    integer_int_magnitude_to_decimal_string(value: value)
-  }
-}
-
-fn integer_int_magnitude_to_decimal_string(value: Int) -> String {
-  let rest = value / 10
-  let digit = decimal_digit_glyph(d: decimal_digit_of_units(value: value - (rest * 10)))
-  if rest == 0 {
-    digit
-  } else {
-    concat(integer_int_magnitude_to_decimal_string(value: rest), digit)
-  }
-}
-
 // THE CONTENT IDENTITY OF AN Int, at cost proportional to its digits. The digests already in the
 // corpus that take an integer are unary -- v2.std.node byte_limb_hash_peano_digest (one
 // combine_hash per unit, one shared tag for every value outside 0..255) and the byte-offset cache
@@ -1513,6 +1377,6 @@ fn integer_int_magnitude_to_decimal_string(value: Int) -> String {
 fn integer_int_content_digest(value: Int) -> Fnv1a64Structural {
   content_hash_tagged_structural(
     tag: "integer-int-decimal",
-    payload: content_hash_atom(value: integer_int_to_decimal_string(value: value) as NonEmptyStr)
+    payload: content_hash_atom(value: int_to_decimal_string(value: value) as NonEmptyStr)
   )
 }
diff --git a/src/v2/std/lens_verdict.dag b/src/v2/std/lens_verdict.dag
index 6b7002fa82e..984237da1ec 100644
--- a/src/v2/std/lens_verdict.dag
+++ b/src/v2/std/lens_verdict.dag
@@ -17,7 +17,7 @@ import v2.std.diagnostic {
   WholeFile,
   textual_whole_file_diagnostic,
 }
-import v2.std.integer { integer_int_to_decimal_string }
+import std.integer { int_to_decimal_string }
 import extdeps.languages.json.emit { quote_json_string }
 import v2.std.node { Node, Symbol, symbol_intern_lexeme, symbol_lexeme }
 import v2.std.grammar { node_atom_identity_optional }
@@ -83,8 +83,8 @@ fn lens_verdict_extent_text(e: Extent) -> String {
     WholeFile => "(whole file)"
     ByteRange { start: st, end: en } =>
       concat(
-        concat("bytes ", integer_int_to_decimal_string(value: st)),
-        concat("..", integer_int_to_decimal_string(value: en))
+        concat("bytes ", int_to_decimal_string(value: st)),
+        concat("..", int_to_decimal_string(value: en))
       )
   }
 }
@@ -123,11 +123,11 @@ fn lens_verdict_node_occurrence_text(node: Node) -> String {
   match node.occurrence_id {
     OccurrenceSynthetic => concat("<synthetic node occurrence", concat(atom, ">"))
     OccurrenceMinted { id: id } =>
-      concat("<node occurrence #", concat(integer_int_to_decimal_string(value: id.value), concat(atom, ">")))
+      concat("<node occurrence #", concat(int_to_decimal_string(value: id.value), concat(atom, ">")))
     OccurrenceProjected { id: id, caused_by: _ } =>
-      concat("<projected node occurrence #", concat(integer_int_to_decimal_string(value: id.value), concat(atom, ">")))
+      concat("<projected node occurrence #", concat(int_to_decimal_string(value: id.value), concat(atom, ">")))
     OccurrencePending { caused_by: cause } =>
-      concat("<pending node occurrence caused by #", concat(integer_int_to_decimal_string(value: cause.value), concat(atom, ">")))
+      concat("<pending node occurrence caused by #", concat(int_to_decimal_string(value: cause.value), concat(atom, ">")))
   }
 }
 
diff --git a/src/v2/std/member_declaration_kind.dag b/src/v2/std/member_declaration_kind.dag
new file mode 100644
index 00000000000..cd332a3a74b
--- /dev/null
+++ b/src/v2/std/member_declaration_kind.dag
@@ -0,0 +1,105 @@
+module v2.std.member_declaration_kind
+
+import std.types { List }
+import std.algebra { FreeMonoid }
+import v2.std.algebra { fold_list }
+import v2.std.collection { Map, empty_map, map_contains_key, map_insert }
+import v2.std.integer { Int }
+import v2.std.node { Symbol }
+import v2.std.qualified_name { QualifiedName, qualified_name_to_dotted_string }
+import v2.std.text { String }
+
+// WHICH KIND OF DECLARATION AUTHORED EACH TOP-LEVEL MEMBER, carried because lowering erases it.
+// Normalize lowers a `data` declaration to a named nullary Arrow member
+// (v2.compiler.body_lowering_fold body_lower_data_decl_to_member) whose shape is, by design,
+// identical to a zero-argument `fn` lowered by body_lower_fn_decl_to_arrow: both are a Conj member
+// whose Authored edge names an Arrow with an empty domain, a codomain and a body. After lowering no
+// reader of the Node can tell `data x: T = v` from `fn x() -> T { v }`, so a reader that must hold
+// the first and refuse the second has nothing to read, and classifying a generic Arrow as a data
+// declaration is the impersonation hole. The fact is read where it still exists -- on the parse, at
+// the one capture site of v2.compiler.normalize -- exactly as type_declaration_kinds is, sealed on
+// NormalizedTree beside the root rather than as a structural child edge (which would change the
+// content hash of every data declaration), and handed forward by the caller that holds it.
+type MemberDeclarationKind
+  = DeclaredDataMember
+  | DeclaredFnMember
+
+// A top-level member by its authored name and kind, as read from ONE module's parse. Unqualified:
+// the module that declares it is the NormalizedTree it rides on.
+type DeclaredMember {
+  name: Symbol
+  kind: MemberDeclarationKind
+}
+
+// A member by its DECLARING path -- the module's qualified name and the member's own name, never a
+// bare spelling, because .dag member names are corpus-global (the way symbol_index_fill qualifies).
+type QualifiedDeclaredMember {
+  module: QualifiedName
+  name: Symbol
+  kind: MemberDeclarationKind
+}
+
+// THE CHANNEL A LATER-GRAIN CONSUMER RECEIVES. It names the modules it COVERS, because an empty member
+// list is ambiguous between "this module declares no such member" and "nothing was read": the first is
+// a fact, the second is the absence of one, and a consumer that reads the second as the first refuses
+// every module (a false absence) while one that reads it as "fine" accepts every module (a fabricated
+// pass). MemberKindsUnavailable is the explicit second arm, so a constructor site that holds no parse
+// says so by value (no_member_declaration_kinds), like no_type_declaration_kinds.
+type MemberKindChannel
+  = MemberKindsUnavailable
+  | MemberKindsCaptured { covered: List<QualifiedName>, members: List<QualifiedDeclaredMember> }
+
+fn no_member_declaration_kinds() -> MemberKindChannel {
+  MemberKindsUnavailable
+}
+
+type MemberKindLookup
+  = MemberKindProvenanceUnavailable
+  | MemberKindNotDeclared
+  | MemberKindDeclared { kind: MemberDeclarationKind }
+
+fn member_kind_module_is(module: QualifiedName, wanted: String) -> Bool {
+  qualified_name_to_dotted_string(qn: module) == wanted
+}
+
+// The kind the channel records for `name` declared at the top level of the module whose dotted name is
+// `module`. Unavailable when the channel was never read OR does not cover that module: both mean the
+// provenance is not there, and neither may answer "not declared".
+fn member_kind_lookup(channel: MemberKindChannel, module: String, name: Symbol) -> MemberKindLookup {
+  match channel {
+    MemberKindsUnavailable => MemberKindProvenanceUnavailable
+    MemberKindsCaptured { covered: covered, members: members } =>
+      if fold(covered, init: false, f: fn(acc, m) { acc || member_kind_module_is(module: m, wanted: module) }) {
+        fold(members, init: MemberKindNotDeclared, f: fn(acc, m) {
+          if member_kind_module_is(module: m.module, wanted: module) && (m.name == name) {
+            MemberKindDeclared { kind: m.kind }
+          } else {
+            acc
+          }
+        })
+      } else {
+        MemberKindProvenanceUnavailable
+      }
+  }
+}
+
+// Two members of one module sharing a name is a duplicate declaration whatever their kinds (a data and a fn of
+// one name conflict as surely as two of one kind); the channel refuses it, never first-wins. ONE PASS: the names
+// seen so far ride a map, so each member costs one membership probe instead of a rescan of the list.
+type MemberNamesSeen {
+  seen: Map<Symbol, Bool>
+  duplicate: Bool
+}
+
+fn declared_members_have_duplicate(members: FreeMonoid<DeclaredMember>) -> Bool {
+  fold_list(
+    xs: members,
+    empty: MemberNamesSeen { seen: empty_map(), duplicate: false },
+    cons: fn(acc, m) {
+      MemberNamesSeen {
+        seen: map_insert(m: acc.seen, key: m.name, value: true),
+        duplicate: acc.duplicate || map_contains_key(m: acc.seen, key: m.name)
+      }
+    }
+  ).duplicate
+}
diff --git a/src/v2/std/native_agreement.dag b/src/v2/std/native_agreement.dag
index 093573a73b1..1d3719b26b4 100644
--- a/src/v2/std/native_agreement.dag
+++ b/src/v2/std/native_agreement.dag
@@ -10,7 +10,8 @@ import std.optional {
   Present,
   Absent
 }
-import v2.std.integer { integer_int_to_decimal_string, integer_u8_from_byte }
+import v2.std.integer { integer_u8_from_byte }
+import std.integer { int_to_decimal_string }
 import v2.std.runtime { RuntimePrimitive, RuntimePrimitiveValue, RuntimeValue }
 import v2.std.text { String }
 import std.algebra { Cons, Empty }
@@ -31,7 +32,7 @@ type NativeAgreementDivergence {
 // std cannot import compiler back).
 
 fn octet_display(octet: Int) -> String {
-  integer_int_to_decimal_string(value: octet)
+  int_to_decimal_string(value: octet)
 }
 
 // THE OCTET IS AN Int AND THE LIST HOLDS Byte. `list_at_optional` over a `List<Byte>` yields
diff --git a/src/v2/std/node.dag b/src/v2/std/node.dag
index 28e9f79bdeb..27c64435ae5 100644
--- a/src/v2/std/node.dag
+++ b/src/v2/std/node.dag
@@ -1,5 +1,6 @@
 module v2.std.node
 
+import v2.std.compilers.lowered_shape { LoweredShape }
 import std.types { List }
 import std.algebra { Cons, Empty, list_snoc_item }
 import std.optional { Present }
@@ -157,6 +158,19 @@ type StructuralEdgeLabel
 // in the scope enclosing the match, so no pattern binder reaches the rest
 // (v2.compiler.resolve resolve_match_arm_admitted, its one consumer). It adds no behavior kind;
 // a marked Bind anywhere else is a malformed tree.
+//
+// ConstantMemberEdge: A NULLARY ARROW THAT IS A `data` CONSTANT. A named edge (targeting an empty
+// Conj, as MatchArmScopeExitEdge is) on the Arrow body lowering builds for `data x: T = e`
+// (v2.compiler.body_lowering_fold body_lower_data_decl_to_member, its one producer). The Arrow is the
+// same member a nullary `fn x() -> T` lowers to; the marker is the one fact that differs: a reference
+// to a marked Arrow USES ITS VALUE, so it is typed at the Arrow's declared codomain T
+// (v2.compiler.infer infer_declaration_reference_facts_indexed) and evaluates to the value of the
+// nullary application (v2.compiler.eval), while a reference to an unmarked Arrow denotes the function.
+// It adds no behavior kind. WHAT HOLDS IT, stated at its rung: its one producer marks only the Arrow
+// of a `data` declaration (nullary by construction), and the reader answers Absent for the marker on a
+// non-Arrow (v2.test.claim.compiler.data_reference_value drv_a_marked_non_arrow_is_not_a_constant). No
+// wall refuses the marker on a NON-nullary Arrow: that holds only by the single producer, so a second
+// producer must add that wall rather than rely on this note.
 type CoreEdgeLabel
   = ArrowBodyEdge
   | ArrowSignatureOrderEdge
@@ -182,10 +196,34 @@ type CoreEdgeLabel
   | BinderTypeEdge
   | BinderDefaultEdge
   | ArrowResourceRequirementsEdge
+  | AdmitCallersEdge
   | LexicalReferenceEdge
   | MapLiteralEntryEdge
   | MapLiteralEntriesEdge
+  | BodyTermLoweredEdge { seal: BodyTermLoweredSeal }
   | MatchArmScopeExitEdge
+  | ConstantMemberEdge
+
+// THE LOWERED TERM'S SEAL (MQ-5). Body lowering wraps each producer's result in a node whose one edge
+// carries this marker, and readers take a node under it as lowered output, whole
+// (v2.compiler.body_lowering_fold body_term_of). The marker carries a sole_constructor record, so the
+// only way to write the label is through body_term_lowered_seal, and that mint admits one caller: the
+// body-lowering mint. A lookalike built anywhere else does not compile -- the record has no other
+// constructor and the mint refuses the call. The record is not on the codec's closed marker list
+// (core_edge_labels), so no wire form decodes to it either. On the native route admit_callers is
+// discarded (gunbc.rung_drop admit_callers_discarded_on_the_native_route), so there the record's
+// sole construction site is the whole wall.
+type BodyTermLoweredSeal sole_constructor {
+  shape: LoweredShape,
+}
+
+fn body_term_lowered_seal(shape: LoweredShape) -> BodyTermLoweredSeal
+  admit_callers: [
+    decl_ref(module_path: "v2.compiler.body_lowering_fold", decl_name: "body_term_seal")
+  ]
+{
+  BodyTermLoweredSeal { shape: shape }
+}
 
 fn core_edge_label(marker: CoreEdgeLabel) -> EdgeLabel {
   StructuralLabel { label: CoreMarker { marker: marker } }
@@ -246,10 +284,12 @@ fn core_edge_labels() -> List<CoreEdgeLabel> {
     BinderTypeEdge,
     BinderDefaultEdge,
     ArrowResourceRequirementsEdge,
+    AdmitCallersEdge,
     LexicalReferenceEdge,
     MapLiteralEntryEdge,
     MapLiteralEntriesEdge,
     MatchArmScopeExitEdge,
+    ConstantMemberEdge,
   ]
 }
 
@@ -281,10 +321,13 @@ fn core_edge_label_canonical_symbol(marker: CoreEdgeLabel) -> Symbol {
     BinderTypeEdge => ^core_binder_type_edge
     BinderDefaultEdge => ^core_binder_default_edge
     ArrowResourceRequirementsEdge => ^core_arrow_resource_requirements_edge
+    AdmitCallersEdge => ^core_admit_callers_edge
     LexicalReferenceEdge => ^core_lexical_reference_edge
     MapLiteralEntryEdge => ^core_map_literal_entry_edge
     MapLiteralEntriesEdge => ^core_map_literal_entries_edge
+    BodyTermLoweredEdge { seal: _ } => ^core_body_term_lowered_edge
     MatchArmScopeExitEdge => ^core_match_arm_scope_exit_edge
+    ConstantMemberEdge => ^core_constant_member_edge
   }
 }
 type Edge {
@@ -309,6 +352,16 @@ fn node_with_occurrence_id(
   Node { kind: kind, children: children, occurrence_id: occurrence_id }
 }
 
+// Whether the node is an Arrow type node -- the one connective question every reader of a lowered callable or
+// nullary-member shape asks. Single accessor: readers import this rather than re-matching the coproduct.
+fn node_is_arrow(n: Node) -> Bool {
+  match n.kind {
+    TypeNode { connective: Arrow } => true
+    TypeNode { connective: _ } => false
+    ComputationNode { behavior: _ } => false
+  }
+}
+
 fn node_rebuild(n: Node, children: List<Edge>) -> Node {
   node_with_occurrence_id(
     kind: n.kind,
@@ -828,16 +881,43 @@ data arrow_signature_order_label: EdgeLabel = StructuralLabel { label: CoreMarke
 // (v2.std.symbol_index symbol_index_declares_resource_at) or that repeats one. Like the other two it is
 // metadata to every value reader: v2.compiler.infer and v2.std.type_binder node_inferred_subtree_nodes
 // skip every arrow_named_edge_is_contract edge.
+
+// THE DECLARED PERMITTED-CALLERS EDGE, restored with its consumer for the former drop
+// gunbc.rung_drop.admit_callers_discarded_on_the_native_route. A fn Arrow built from a signature that declared an
+// admit_callers clause carries the clause's STRUCTURED ROSTER under the core marker AdmitCallersEdge
+// (v2.compiler body_lowering_fold body_lower_fn_admit_clause_edges: the carrier consumes the authored
+// spine at lowering and re-hangs each entry as a positional record conj), and the consumer reads the
+// declared permitted callers off it (v2.compiler.infer infer_caller_admission_diags). It is NOT a
+// contract edge: a contract edge's target is a claim the Arrow makes in a ruled vocabulary
+// (std.effects EffectClaim, std.execution_mode ExecutionMode), while this edge's target is the
+// roster the consumer judges. Like a contract edge it is optional, appears at most once, and is
+// never a binder.
+//
+// THE FOURTH, ConstantMemberEdge: what a `data` Arrow promises about its USE -- a reference to it is the
+// value of its nullary application, not the function. Its target is an empty Conj and carries no
+// vocabulary, so v2.std.arrow_contract has nothing to check on it; like the other three it is metadata to
+// every value reader, and it is read only by v2.std.node_query arrow_constant_member_codomain.
 fn arrow_named_edge_is_contract(e: Edge) -> Bool {
   edge_is_core(e: e, marker: ArrowEffectClaimsEdge)
     || edge_is_core(e: e, marker: ArrowExecutionModeClaimEdge)
     || edge_is_core(e: e, marker: ArrowResourceRequirementsEdge)
+    || edge_is_core(e: e, marker: ConstantMemberEdge)
 }
 
+// THE ONE METADATA FACT FOR ARROW NAMED EDGES: this edge's target is metadata to every value
+// reader -- never a value the Arrow is built from, never a binder. The single predicate every value
+// reader that walks an Arrow consumes (v2.compiler.infer's gather fold and product evidence,
+// v2.compiler.translate's grounding gate, v2.std.type_binder node_inferred_subtree_nodes) and every
+// count of an Arrow's binders reads (arrow_named_edge_is_non_binder here and v2.std.type_binder
+// arrow_named_labels_conform), so no reader keeps its own list of metadata labels. DESIGN section 3:
+// each fact lives in exactly one place.
+fn arrow_named_edge_is_metadata(e: Edge) -> Bool {
+  arrow_named_edge_is_contract(e: e) || edge_is_core(e: e, marker: AdmitCallersEdge)
+}
 
-// The Arrow named edges that are not binders: its body, its declared order and its contract edges.
-// The one predicate every count of an Arrow's binders reads (here and v2.std.type_binder
-// arrow_named_labels_conform), so they agree on what a binder is.
+// The Arrow named edges that are not binders: its body, its declared order, and the metadata edges.
+// The one predicate every count of an Arrow's binders
+// reads (here and v2.std.type_binder arrow_named_labels_conform), so they agree on what a binder is.
 fn arrow_named_edge_is_non_binder(e: Edge) -> Bool {
   match e.label {
     Positional => false
@@ -845,7 +925,7 @@ fn arrow_named_edge_is_non_binder(e: Edge) -> Bool {
     StructuralLabel { label: _ } =>
       edge_is_core(e: e, marker: ArrowBodyEdge)
         || edge_is_core(e: e, marker: ArrowSignatureOrderEdge)
-        || arrow_named_edge_is_contract(e: e)
+        || arrow_named_edge_is_metadata(e: e)
   }
 }
 
@@ -876,6 +956,7 @@ fn arrow_signature_edges_conform(children: List<Edge>) -> Bool {
   && (core_occurrences(marker: ArrowEffectClaimsEdge, children: children) <= 1)
   && (core_occurrences(marker: ArrowExecutionModeClaimEdge, children: children) <= 1)
   && (core_occurrences(marker: ArrowResourceRequirementsEdge, children: children) <= 1)
+  && (core_occurrences(marker: AdmitCallersEdge, children: children) <= 1)
   && fold(children, init: true, f: fn(acc, e) {
     match e.label {
       Positional => acc
@@ -1416,12 +1497,18 @@ fn classify_arrow_body_form(target: Node) -> ArrowBodyForm {
 // not hold still refuses with the same reason, now raised at the USE by eval_type_node_atom's own arm, where
 // it means what it says. What disappears is a refusal based solely on the body's FORM; what remains is the
 // refusal based on a missing binding, which is the only one that was ever a fact about the program.
+//
+// DeclarationReferenceBody IS ADMITTED ON THE SAME REASONING. A fn whose body is a reference to a `data`
+// constant (`fn f() -> Int { k }`) refused here by FORM before eval reached the reference, so the one
+// route that evaluates a constant (v2.compiler.eval eval_constant_member_body, keyed on v2.std.node
+// ConstantMemberEdge) could never run. A declaration reference that is not a constant still refuses at
+// the USE, with ^eval_rejected_runtime_binding_lookup_miss raised by eval_type_node_atom's own arm.
 fn arrow_body_admits_eval_entry(form: ArrowBodyForm) -> Bool {
   match form {
     UnsupportedArrowBody => false
     DirectAtomBody => true
     RecordConstructBody => false
-    DeclarationReferenceBody => false
+    DeclarationReferenceBody => true
     ParameterReferenceBody => true
     LexicalReferenceBody => true
     FunctionValueBody => false
diff --git a/src/v2/std/node_query.dag b/src/v2/std/node_query.dag
index fcc060cf91c..ba12200fd02 100644
--- a/src/v2/std/node_query.dag
+++ b/src/v2/std/node_query.dag
@@ -20,6 +20,7 @@ import std.types { Map, List }
 import v2.std.node {
   Instantiation,
   BinderTypeEdge,
+  ConstantMemberEdge,
   BinderDefaultEdge,
   core_edge,
   Cardinality,
@@ -867,6 +868,27 @@ fn nullary_inhabitant_by_discriminant<T>(
   }
 }
 
+// THE VALUE TYPE A REFERENCE TO A `data` CONSTANT DENOTES: the declared codomain of an Arrow that
+// carries v2.std.node ConstantMemberEdge, or Absent for any other node (an unmarked Arrow, including a
+// nullary fn, denotes its function). The one reader of the marker; infer types the reference by it and
+// eval applies the constant by it, so the two cannot disagree on which Arrows are constants.
+fn arrow_constant_member_codomain(arrow: Node) -> Optional<Node> {
+  match arrow.kind {
+    TypeNode { connective: Arrow } =>
+      if fold(arrow.children, init: false, f: fn(acc, e) { acc || edge_is_core(e: e, marker: ConstantMemberEdge) }) {
+        list_at_optional(xs: node_positional_child_targets(node: arrow), index: 1)
+      } else {
+        Absent
+      }
+    TypeNode { connective: Atom { identity: _ } } => Absent
+    TypeNode { connective: Conj } => Absent
+    TypeNode { connective: Disj } => Absent
+    TypeNode { connective: v2.std.node.Cardinality } => Absent
+    TypeNode { connective: Instantiation } => Absent
+    ComputationNode { behavior: _ } => Absent
+  }
+}
+
 fn node_positional_child_targets(node: Node) -> List<Node> {
   fold(node.children, init: Empty, f: fn(acc, e) {
     match e.label {
@@ -978,7 +1000,14 @@ fn named_child_lookup(root: Node, name: Symbol) -> NamedChildLookup {
     TypeNode { connective: Arrow } => NamedChildMissing
     TypeNode { connective: Cardinality } => NamedChildMissing
     TypeNode { connective: Instantiation } => NamedChildMissing
-    ComputationNode { behavior: _ } => NamedChildMissing
+    ComputationNode { behavior: _ } =>
+      fold(root.children, init: NamedChildMissing, f: fn(acc, e) {
+        match e.label {
+          Positional => acc
+          StructuralLabel { label: _ } => acc
+          Authored { name: edge_name } => child_lookup_step(acc: acc, hit: edge_name == name, target: e.target)
+        }
+      })
   }
 }
 
diff --git a/src/v2/std/parse_refusal_reason.dag b/src/v2/std/parse_refusal_reason.dag
index c6cf80eaddc..d8fbb2e9c62 100644
--- a/src/v2/std/parse_refusal_reason.dag
+++ b/src/v2/std/parse_refusal_reason.dag
@@ -37,11 +37,17 @@ import v2.std.node { Symbol }
 //                                     (`x.module`, `Rec { module: e }`). Located at the keyword.
 //   TokenStartsNotIncreasing       -- the token stream handed to the parse does not have strictly
 //                                     increasing token starts. A stream position IS its token's
-//                                     start (v2.compiler.parse parse_current_position keys the memo
-//                                     and decides repeat progress), so two tokens at one start would
-//                                     be one position and the parse would silently serve one's
-//                                     answer for the other. Located at the first token whose start
+//                                     start (v2.compiler.parse parse_current_position identifies a
+//                                     stream position and decides repeat progress by it), so two
+//                                     tokens at one start would be one position and the parse would
+//                                     silently take one's progress for the other's. Located at the first token whose start
 //                                     does not exceed its predecessor's.
+//   NonAssociativeOperatorChain    -- a non-associative infix operator (an equality or a comparison)
+//                                     follows an application of an operator of the same binding
+//                                     power (`a < b < c`, `a == b != c`). Neither grouping is the
+//                                     one the author meant by rule, so it refuses rather than pick:
+//                                     parenthesize, or join the comparisons with `&&`. Located at
+//                                     the second operator (v2.std.grammar InfixTable).
 type ParseRefusalReason =
     FnExpressionBodyMissingAfterEq
   | DataValueMissingAfterEq
@@ -52,6 +58,7 @@ type ParseRefusalReason =
   | DeclarationMarkerNotTest
   | KeywordAsValueName
   | TokenStartsNotIncreasing
+  | NonAssociativeOperatorChain
 
 // The diagnostic identity each reason refuses under (`v2.std.diagnostic` `Diagnostic.reason`).
 fn parse_refusal_reason_symbol(reason: ParseRefusalReason) -> Symbol {
@@ -65,5 +72,6 @@ fn parse_refusal_reason_symbol(reason: ParseRefusalReason) -> Symbol {
     DeclarationMarkerNotTest => ^parse_declaration_marker_not_test
     KeywordAsValueName => ^parse_keyword_as_value_name
     TokenStartsNotIncreasing => ^parse_token_starts_not_increasing
+    NonAssociativeOperatorChain => ^parse_non_associative_operator_chain
   }
 }
diff --git a/src/v2/std/provenance.dag b/src/v2/std/provenance.dag
index f2f1b9c42f6..68e3b3e953b 100644
--- a/src/v2/std/provenance.dag
+++ b/src/v2/std/provenance.dag
@@ -72,22 +72,6 @@ fn span_index_merge(base: SpanIndex, incoming: SpanIndex) -> SpanIndex {
   }
 }
 
-// ONE ENTRY OF span_index_merge, for a caller that knows WHICH incoming ids it needs. The merge
-// rule is unchanged -- the base's entry wins, an absent id takes the incoming entry -- but the
-// cost is one lookup pair instead of a walk over every incoming key. The parser's memo hit is the
-// consumer: its incoming index carries every entry minted before the memoized frame started, so
-// the whole-key merge paid the size of the file so far on every hit.
-fn span_index_adopt(base: SpanIndex, incoming: SpanIndex, id: OccurrenceId) -> SpanIndex {
-  match base.entries.lookup(id) {
-    Present { value: _ } => base
-    Absent =>
-      match incoming.entries.lookup(id) {
-        Present { value: event } => SpanIndex { entries: map_insert(m: base.entries, key: id, value: event) }
-        Absent => base
-      }
-  }
-}
-
 fn span_index_origin_chain_exhausted_diagnostic() -> Diagnostic {
   Diagnostic {
     reason: ^span_index_origin_chain_exhausted,
diff --git a/src/v2/std/staging.dag b/src/v2/std/staging.dag
index fdce7920be1..065c897b5a4 100644
--- a/src/v2/std/staging.dag
+++ b/src/v2/std/staging.dag
@@ -1,6 +1,6 @@
 module v2.std.staging
 
-import v2.std.diagnostic { Outcome, bind_outcome, outcome_accepted }
+import v2.std.diagnostic { Outcome, bind_outcome }
 
 fn then_outcome<A, B, C>(
   f: fn(A) -> Outcome<B>,
@@ -8,27 +8,3 @@ fn then_outcome<A, B, C>(
 ) -> fn(A) -> Outcome<C> {
   fn(x) { bind_outcome(o: f(x), f: g) }
 }
-
-type CacheProbe<B>
-  = Miss
-  | Hit { value: B }
-
-fn resolve_probe<A, B>(
-  probe: CacheProbe<B>,
-  stage: fn(A) -> Outcome<B>,
-  x: A
-) -> Outcome<B> {
-  match probe {
-    Hit { value: hit } => outcome_accepted(value: hit)
-    Miss => stage(x)
-  }
-}
-
-fn cached_stage<A, B>(
-  lookup: fn(A) -> CacheProbe<B>,
-  stage: fn(A) -> Outcome<B>
-) -> fn(A) -> Outcome<B> {
-  fn(x) {
-    resolve_probe(probe: lookup(x), stage: stage, x: x)
-  }
-}
diff --git a/src/v2/std/symbol_index.dag b/src/v2/std/symbol_index.dag
index 6526f9c933d..a382daa043d 100644
--- a/src/v2/std/symbol_index.dag
+++ b/src/v2/std/symbol_index.dag
@@ -15,7 +15,7 @@ import v2.std.algebra {
 import v2.std.collection {
   Map,
   empty_map,
-  map_get,
+  map_get_checked,
   map_insert,
   map_contains_key,
   map_lookup
@@ -91,6 +91,7 @@ type SymbolIndex {
   declared_resources: Map<QualifiedName, ResourceDeclared>
   namespace_bodies: Map<QualifiedName, NamespaceBodyDeclared>
   module_roots: Map<QualifiedName, ModuleRootDeclared>
+  primitive_contracts: Map<QualifiedName, PrimitiveContractDeclared>
 }
 
 // WHICH KIND OF DECLARED PAYLOAD A PATH DENOTES, stored as the map's value so the map cannot hold a
@@ -136,6 +137,12 @@ type NamespaceBodyDeclared {}
 // docs/plans/native-resolve-frontier-root-causes.md.
 type ModuleRootDeclared {}
 
+// A PATH THAT IS AN ADMITTED PRIMITIVE CONTRACT ROW: a nullary declaration whose declared type is, by path join in its declaring module, std.primitives.PrimitiveContract
+// (v2.compiler.primitive_authority primitive_authority_row_is_contract_declaration). Stored as the map's value for the reason ResourceDeclared is. Written ONCE by
+// v2.compiler.symbol_index_fill, the arm that knows the declaring module and the row; read by v2.compiler.resolve (the bind tier) and v2.compiler.infer
+// (the refusal), neither of which recomputes it.
+type PrimitiveContractDeclared {}
+
 fn empty_symbol_index() -> SymbolIndex {
   SymbolIndex {
     entries: empty_map(),
@@ -146,7 +153,8 @@ fn empty_symbol_index() -> SymbolIndex {
     declared_type_params: empty_map(),
     declared_resources: empty_map(),
     namespace_bodies: empty_map(),
-    module_roots: empty_map()
+    module_roots: empty_map(),
+    primitive_contracts: empty_map()
   }
 }
 
@@ -170,7 +178,7 @@ fn empty_symbol_index() -> SymbolIndex {
 // a two-binder refusal back to one binder the first time this split was written. `entries` is where
 // a declaration is stored; `symbol_index_lookup` is what a reference is entitled to be told.
 fn symbol_index_entry_at(index: SymbolIndex, qualified_path: QualifiedName) -> Optional<Node> {
-  match v2.std.collection.map_get(index.entries, qualified_path) {
+  match v2.std.collection.map_get_checked(index.entries, qualified_path) {
     Accepted { value: opt, diagnostics: _ } => opt
     Rejected { diagnostics: _ } => optional_absent()
   }
@@ -210,7 +218,7 @@ fn symbol_index_track_global_bare(
   match qualified_name_last_segment(qn: qualified_path) {
     Absent => index
     Present { value: leaf } =>
-      match v2.std.collection.map_get(index.global_bare, leaf) {
+      match v2.std.collection.map_get_checked(index.global_bare, leaf) {
         Accepted { value: opt, diagnostics: _ } => match opt {
           Present { value: GlobalBareAmbiguous { paths: paths } } =>
             SymbolIndex {
@@ -226,7 +234,8 @@ fn symbol_index_track_global_bare(
               declared_type_params: index.declared_type_params,
               declared_resources: index.declared_resources,
               namespace_bodies: index.namespace_bodies,
-              module_roots: index.module_roots
+              module_roots: index.module_roots,
+              primitive_contracts: index.primitive_contracts
             }
           Present { value: GlobalBareUnique { node: existing, path: existing_path } } =>
             if existing_path == qualified_path && existing == resolved {
@@ -247,7 +256,8 @@ fn symbol_index_track_global_bare(
                 declared_type_params: index.declared_type_params,
                 declared_resources: index.declared_resources,
                 namespace_bodies: index.namespace_bodies,
-                module_roots: index.module_roots
+                module_roots: index.module_roots,
+                primitive_contracts: index.primitive_contracts
               }
             }
           Absent =>
@@ -264,7 +274,8 @@ fn symbol_index_track_global_bare(
               declared_type_params: index.declared_type_params,
               declared_resources: index.declared_resources,
               namespace_bodies: index.namespace_bodies,
-              module_roots: index.module_roots
+              module_roots: index.module_roots,
+              primitive_contracts: index.primitive_contracts
             }
         }
         Rejected { diagnostics: _ } => index
@@ -296,7 +307,8 @@ fn symbol_index_insert(index: SymbolIndex, qualified_path: QualifiedName, resolv
     declared_type_params: index.declared_type_params,
     declared_resources: index.declared_resources,
     namespace_bodies: index.namespace_bodies,
-    module_roots: index.module_roots
+    module_roots: index.module_roots,
+    primitive_contracts: index.primitive_contracts
   }
   symbol_index_track_global_bare(
     index: with_entry,
@@ -327,14 +339,15 @@ fn symbol_index_mark_declared_payload(index: SymbolIndex, qualified_path: Qualif
     declared_type_params: index.declared_type_params,
     declared_resources: index.declared_resources,
     namespace_bodies: index.namespace_bodies,
-    module_roots: index.module_roots
+    module_roots: index.module_roots,
+    primitive_contracts: index.primitive_contracts
   }
 }
 
 // WHAT THE PATH DENOTES, WITH NO FAILURE ARM TO WIDEN (review 70226). The first cut read this
-// through map_get, whose Outcome carries a Rejected arm, and answered binder there -- which matches
+// through map_get_checked, whose Outcome carries a Rejected arm, and answered binder there -- which matches
 // every value, so a lookup that could not answer would have widened the arm silently, the fail-open
-// shape DESIGN section 5 forbids. map_lookup is the total read underneath map_get (which is
+// shape DESIGN section 5 forbids. map_lookup is the total read underneath map_get_checked (which is
 // `outcome_accepted(map_lookup(..))`, so its refusal arm is unreachable by construction): the kind,
 // or Absent for a path that denotes no declared payload. The caller matches on it.
 fn symbol_index_declared_payload_at(index: SymbolIndex, qualified_path: QualifiedName) -> Optional<DeclaredPayloadKind> {
@@ -359,7 +372,8 @@ fn symbol_index_mark_declared_resource(index: SymbolIndex, qualified_path: Quali
     declared_type_params: index.declared_type_params,
     declared_resources: map_insert(m: index.declared_resources, key: qualified_path, value: ResourceDeclared {}),
     namespace_bodies: index.namespace_bodies,
-    module_roots: index.module_roots
+    module_roots: index.module_roots,
+    primitive_contracts: index.primitive_contracts
   }
 }
 
@@ -373,7 +387,8 @@ fn symbol_index_mark_namespace_body(index: SymbolIndex, qualified_path: Qualifie
     declared_type_params: index.declared_type_params,
     declared_resources: index.declared_resources,
     namespace_bodies: map_insert(m: index.namespace_bodies, key: qualified_path, value: NamespaceBodyDeclared {}),
-    module_roots: index.module_roots
+    module_roots: index.module_roots,
+    primitive_contracts: index.primitive_contracts
   }
 }
 
@@ -387,7 +402,8 @@ fn symbol_index_mark_module_root(index: SymbolIndex, qualified_path: QualifiedNa
     declared_type_params: index.declared_type_params,
     declared_resources: index.declared_resources,
     namespace_bodies: index.namespace_bodies,
-    module_roots: map_insert(m: index.module_roots, key: qualified_path, value: ModuleRootDeclared {})
+    module_roots: map_insert(m: index.module_roots, key: qualified_path, value: ModuleRootDeclared {}),
+    primitive_contracts: index.primitive_contracts
   }
 }
 
@@ -413,7 +429,8 @@ fn symbol_index_mark_declared_type_params(index: SymbolIndex, qualified_path: Qu
     declared_type_params: map_insert(m: index.declared_type_params, key: qualified_path, value: params),
     declared_resources: index.declared_resources,
     namespace_bodies: index.namespace_bodies,
-    module_roots: index.module_roots
+    module_roots: index.module_roots,
+    primitive_contracts: index.primitive_contracts
   }
 }
 
@@ -431,7 +448,7 @@ fn symbol_index_declared_binders_at(index: SymbolIndex, qualified_path: Qualifie
 }
 
 fn symbol_index_global_unique_lookup(index: SymbolIndex, name: Symbol) -> GlobalBareLookup {
-  match v2.std.collection.map_get(index.global_bare, name) {
+  match v2.std.collection.map_get_checked(index.global_bare, name) {
     Accepted { value: opt, diagnostics: _ } => match opt {
       Present { value: GlobalBareUnique { node: n, path: p } } => GlobalBareHit { node: n, path: p }
       Present { value: GlobalBareAmbiguous { paths: paths } } => GlobalBareLookupAmbiguous { paths: paths }
@@ -540,7 +557,8 @@ fn symbol_index_bind_at(
       declared_type_params: index.declared_type_params,
       declared_resources: index.declared_resources,
       namespace_bodies: index.namespace_bodies,
-      module_roots: index.module_roots
+      module_roots: index.module_roots,
+      primitive_contracts: index.primitive_contracts
     }
     if is_empty(xs: prior) {
       SymbolIndex {
@@ -552,7 +570,8 @@ fn symbol_index_bind_at(
         declared_type_params: recorded.declared_type_params,
         declared_resources: recorded.declared_resources,
         namespace_bodies: recorded.namespace_bodies,
-        module_roots: recorded.module_roots
+        module_roots: recorded.module_roots,
+        primitive_contracts: recorded.primitive_contracts
       }
     } else {
       recorded
@@ -564,7 +583,7 @@ fn symbol_index_bound_declarings(
   index: SymbolIndex,
   binding_path: QualifiedName
 ) -> FreeMonoid<QualifiedName> {
-  match v2.std.collection.map_get(index.bound_declarings, binding_path) {
+  match v2.std.collection.map_get_checked(index.bound_declarings, binding_path) {
     Accepted { value: opt, diagnostics: _ } => match opt {
       Present { value: declarings } => declarings
       Absent => Empty
@@ -695,3 +714,22 @@ fn symbol_index_lexical_lookup(
     )
   )
 }
+
+fn symbol_index_mark_primitive_contract(index: SymbolIndex, qualified_path: QualifiedName) -> SymbolIndex {
+  SymbolIndex {
+    entries: index.entries,
+    global_bare: index.global_bare,
+    bound_declarings: index.bound_declarings,
+    declared_payloads: index.declared_payloads,
+    renaming_aliases: index.renaming_aliases,
+    declared_type_params: index.declared_type_params,
+    declared_resources: index.declared_resources,
+    namespace_bodies: index.namespace_bodies,
+    module_roots: index.module_roots,
+    primitive_contracts: map_insert(m: index.primitive_contracts, key: qualified_path, value: PrimitiveContractDeclared {})
+  }
+}
+
+fn symbol_index_declares_primitive_contract_at(index: SymbolIndex, qualified_path: QualifiedName) -> Bool {
+  map_contains_key(m: index.primitive_contracts, key: qualified_path)
+}
diff --git a/src/v2/std/type_binder.dag b/src/v2/std/type_binder.dag
index f1e43bc482e..05a00d5cd97 100644
--- a/src/v2/std/type_binder.dag
+++ b/src/v2/std/type_binder.dag
@@ -31,7 +31,7 @@ import v2.std.node {
   TypeNode,
   match_arm_pattern_edge,
   arrow_signature_order_label,
-  arrow_named_edge_is_contract,
+  arrow_named_edge_is_metadata,
   node_subtree_nodes,
   node_synthetic,
   type_binder_conj_conforms,
@@ -234,7 +234,7 @@ fn declaration_binder_edge(parent: Node, edge: Edge) -> Bool {
 // (infer_facts_key_conflict). v2.compiler.infer's gather skips the same cells by the same accessor.
 fn node_inferred_subtree_nodes(root: Node) -> List<Node> {
   fold(root.children, init: [root], f: fn(acc, e) {
-    if (e.label == arrow_signature_order_label) || arrow_named_edge_is_contract(e: e) || declaration_binder_edge(parent: root, edge: e) || match_arm_pattern_edge(parent: root, edge: e) || (resolved_reference_body_kind(target: root) != NotMarkedReference) {
+    if (e.label == arrow_signature_order_label) || arrow_named_edge_is_metadata(e: e) || declaration_binder_edge(parent: root, edge: e) || match_arm_pattern_edge(parent: root, edge: e) || (resolved_reference_body_kind(target: root) != NotMarkedReference) {
       acc
     } else {
       concat(acc, node_inferred_subtree_nodes(root: e.target))
diff --git a/src/v2/test/claim/advisories/fatal_first_readers_test.dag b/src/v2/test/claim/advisories/fatal_first_readers_test.dag
index 976ee41e813..76a74bac49d 100644
--- a/src/v2/test/claim/advisories/fatal_first_readers_test.dag
+++ b/src/v2/test/claim/advisories/fatal_first_readers_test.dag
@@ -66,9 +66,11 @@ test fn grammar_coverage_stage_rejected_reports_each_chains_fatal_holds() -> Boo
 }
 
 // THE DOOR LEDGER'S HISTOGRAM IS OF FATAL CAUSES. The three refusal chains the long claim
-// v2.test.long.compile_door_ledger's real subjects produce (determinism, error_primitives, bit) are
-// SUPPLIED here, each headed by one shared advisory: the histogram must count their fatals, and every
-// fatal must be owned. A head-grain reader counts the advisory three times and nothing else.
+// v2.test.long.compile_door_ledger's real subjects historically produced (determinism,
+// error_primitives, bit) are SUPPLIED here, each headed by one shared advisory: the histogram
+// must count their fatals, and every fatal must be owned. A head-grain reader counts the
+// advisory three times and nothing else. Do not substitute unrelated causes for
+// member_not_a_binder on error_primitives/bit.
 test fn door_ledger_histogram_counts_each_refusals_fatal_holds() -> Bool {
   let rows = [
     door_refused_row(path: "dag/std/determinism.dag", d: residue_headed_chain(fatal: ^resolve_reason_unbound_symbol)),
diff --git a/src/v2/test/claim/arrow_order_edge/admission_wall_test.dag b/src/v2/test/claim/arrow_order_edge/admission_wall_test.dag
index d16fc6f172b..55a8e49ba39 100644
--- a/src/v2/test/claim/arrow_order_edge/admission_wall_test.dag
+++ b/src/v2/test/claim/arrow_order_edge/admission_wall_test.dag
@@ -1,5 +1,6 @@
 module v2.test.claim.arrow_order_edge.admission_wall
 
+import v2.std.member_declaration_kind { no_member_declaration_kinds }
 import std.occurrence_identity { OccurrenceSynthetic }
 import std.algebra { Cons, Empty }
 import v2.compiler.infer { infer }
@@ -81,7 +82,7 @@ test fn aoe_well_formed_refuses_a_named_domain_without_order() -> Bool {
 
 // PATH: infer, entered directly with a ResolvedTree.
 fn aoe_infer_reason(arrow: Node) -> Symbol {
-  match infer(tree: ResolvedTree { root: aoe_module_root(arrow: arrow), symbol_index: empty_symbol_index(), resolved_declarations: empty_symbol_index(), lexical_bindings: empty_map(), unavailable_providers: [] }) {
+  match infer(tree: ResolvedTree { root: aoe_module_root(arrow: arrow), symbol_index: empty_symbol_index(), resolved_declarations: empty_symbol_index(), lexical_bindings: empty_map(), unavailable_providers: [], member_kinds: no_member_declaration_kinds() }) {
     Rejected { diagnostics: d } => diagnostics_fatal_reason(d: d)
     Accepted { value: _, diagnostics: _ } => ^aoe_accepted
   }
diff --git a/src/v2/test/claim/binder_admission/arm_scope_exit_marker_test.dag b/src/v2/test/claim/binder_admission/arm_scope_exit_marker_test.dag
index f35847e9848..b19e7f614d7 100644
--- a/src/v2/test/claim/binder_admission/arm_scope_exit_marker_test.dag
+++ b/src/v2/test/claim/binder_admission/arm_scope_exit_marker_test.dag
@@ -52,7 +52,7 @@ fn asem_scope_binding_y() -> Scope {
     fb: frame_binders_add(
       fb: frame_binders_empty(),
       name: ^y,
-      binding: LexicalBinding { binder_site: OccurrenceMinted { id: OccurrenceId { value: 1 } }, declared: optional_absent() }
+      binding: LexicalBinding { binder_site: OccurrenceMinted { id: OccurrenceId { value: 1 } }, declared: optional_absent(), value: optional_absent() }
     ),
     outer: ScopeRoot { module: empty_namespace() }
   )
diff --git a/src/v2/test/claim/binder_admission/callable_binder_slice_test.dag b/src/v2/test/claim/binder_admission/callable_binder_slice_test.dag
index c2f8441146b..3f0b34a5550 100644
--- a/src/v2/test/claim/binder_admission/callable_binder_slice_test.dag
+++ b/src/v2/test/claim/binder_admission/callable_binder_slice_test.dag
@@ -26,7 +26,8 @@ import v2.compiler.resolve {
 }
 import v2.std.resolution_policy { default_name_resolution_policy }
 import v2.compiler.fold_lowering { fold_carrier_binder_atom }
-import v2.std.collection { Map, empty_map, map_insert, map_lookup }
+import v2.std.collection { Map, empty_map, list_at_optional, map_insert, map_lookup }
+import v2.std.node_query { node_positional_child_targets }
 import std.algebra { Cons, Empty }
 import v2.std.language_model { void_language_model }
 import v2.std.text { String }
@@ -56,10 +57,10 @@ import std.occurrence_identity { OccurrenceId, OccurrenceMinted, OccurrenceSynth
 // witness rule) -- and it is exactly the reach whose cost refused this lane's other claim sets at the
 // enrolment margin.
 //
-// WHAT THE SLICE ESTABLISHES. `fold(xs, init: false, f: fn(found, e) { found || ... })` refuses at
-// resolve with resolve_unbound_name_is_declared_in_several_modules on `found`. The rows below locate
-// that in the lowering rather than in resolve's binder model: the Arrow path admits its binders, and
-// the fold seam the step is lowered to carries none.
+// WHAT THE SLICE ESTABLISHES. A fn-literal-shaped Arrow admits every Named domain binder and no
+// undeclared name. The fold encoding's Loop positional is that same Arrow (v2.compiler.fold_lowering
+// fold_recurrence_encoding), so harvesting the step admits the handler's binders; harvesting the Loop
+// itself does not, because a Loop is not an Arrow.
 
 // THE LOOP THESE ROWS SUPPLY MIRRORS THE FOLD ENCODING'S, and it is built here rather than by calling the
 // producer because gunbc#12550 retired the old single-purpose seam builder: the encoding is now a Bind
@@ -130,22 +131,21 @@ test fn cbs_the_arrow_path_admits_no_undeclared_name_holds() -> Bool {
   !cbs_admits(locals: cbs_arrow_locals(), name: ^unrelated)
 }
 
-// (3) THE FOLD SEAM ADMITS NEITHER BINDER -- THE DISCRIMINATING RED FOR THIS SLICE. The step literal
-// is destructured into an iteration body and ONE carrier symbol (v2.compiler.fold_lowering
-// fold_call_seam_from_step), and the seam it builds is a Loop, not an Arrow. arrow_domain_frame_binders
-// answers the empty map for it because it is not an Arrow at all, and resolve harvests binders in
-// exactly two places -- an Arrow's domain and a Bind's atom -- with NO loop-carrier harvester. So the
-// body's `found` reaches the bare-name census and refuses as declared in several modules.
-//
-// THIS ROW FLIPS WHEN THE CONSOLIDATION LANDS: once the step lowers through the one callable Arrow
-// constructor and loop carriers go through the one binder-admission operation, the seam admits its
-// binders and this row must be rewritten to assert that, not deleted (DESIGN section 4b(4)).
-test fn cbs_the_fold_seam_admits_no_binder_today_holds() -> Bool {
-  let seam_locals = arrow_domain_frame_binders(
-    n: cbs_carrier_loop(body: cbs_atom(id: ^step_body), carrier: ^found)
-  ).locals
-  !cbs_admits(locals: seam_locals, name: ^found)
-    && !cbs_admits(locals: seam_locals, name: ^e)
+// (3) THE FOLD ENCODING'S STEP IS AN ARROW, SO ITS HANDLER BINDERS HARVEST. The Loop around it still
+// harvests none: arrow_domain_frame_binders is an Arrow reader. Resolve walks the positional step as
+// that Arrow (resolve_arrow_node), which is why a handler binder binds on the native ingest route
+// (v2.test.claim.resolve.fold_handler_binder_resolve).
+test fn cbs_the_fold_encoding_step_admits_handler_binders_holds() -> Bool {
+  let loop_node = cbs_carrier_loop(body: cbs_fn_literal_shaped_arrow(), carrier: ^found)
+  let loop_locals = arrow_domain_frame_binders(n: loop_node).locals
+  match list_at_optional(xs: node_positional_child_targets(node: loop_node), index: 0) {
+    Absent => false
+    Present { value: step } =>
+      let step_locals = arrow_domain_frame_binders(n: step).locals
+      !cbs_admits(locals: loop_locals, name: ^found)
+        && cbs_admits(locals: step_locals, name: ^found)
+        && cbs_admits(locals: step_locals, name: ^e)
+  }
 }
 
 // THE ADMISSION'S THREE RULES, each at its own interface with a supplied Scope. The scopes are
@@ -177,7 +177,7 @@ fn cbs_frame_binding(name: Symbol) -> Scope {
     fb: frame_binders_add(
       fb: frame_binders_empty(),
       name: name,
-      binding: LexicalBinding { binder_site: OccurrenceMinted { id: OccurrenceId { value: 1 } }, declared: optional_absent() }
+      binding: LexicalBinding { binder_site: OccurrenceMinted { id: OccurrenceId { value: 1 } }, declared: optional_absent(), value: optional_absent() }
     ),
     outer: cbs_root_scope()
   )
diff --git a/src/v2/test/claim/body_lowering/arrow_body_form_witness_test.dag b/src/v2/test/claim/body_lowering/arrow_body_form_witness_test.dag
index 7f9afbe01e7..5b587fd9d1e 100644
--- a/src/v2/test/claim/body_lowering/arrow_body_form_witness_test.dag
+++ b/src/v2/test/claim/body_lowering/arrow_body_form_witness_test.dag
@@ -481,6 +481,10 @@ test fn arrow_body_form_reference_shape_without_marker_refused_at_resolve_holds(
   }
 }
 
-test fn arrow_body_form_declaration_reference_not_an_eval_entry_holds() -> Bool {
-  !arrow_body_admits_eval_entry(form: DeclarationReferenceBody)
+// FLIPPED (v2.std.node arrow_body_admits_eval_entry): a declaration-reference body enters eval, and the
+// reference refuses or evaluates at its USE -- a `data` constant evaluates to its value
+// (v2.test.claim.compiler.data_reference_value drv_a_data_reference_is_typed_at_its_declared_type_and_evaluates_to_its_value), any other
+// declaration reference refuses with the binding-miss reason. The body's FORM is no longer the refusal.
+test fn arrow_body_form_declaration_reference_is_an_eval_entry_holds() -> Bool {
+  arrow_body_admits_eval_entry(form: DeclarationReferenceBody)
 }
diff --git a/src/v2/test/claim/body_lowering/arrow_lambda_block_body_test.dag b/src/v2/test/claim/body_lowering/arrow_lambda_block_body_test.dag
index 7f852d7e06b..7f5ce058cdc 100644
--- a/src/v2/test/claim/body_lowering/arrow_lambda_block_body_test.dag
+++ b/src/v2/test/claim/body_lowering/arrow_lambda_block_body_test.dag
@@ -227,7 +227,7 @@ test fn no_statement_begins_with_a_comma_or_a_close_paren_holds() -> Bool {
     Accepted { value: prepared, diagnostics: _ } =>
       match prepared {
         PreparedVoidGrammar => false
-        PreparedModeled { modeled: modeled, materialization: _ } =>
+        PreparedModeled { modeled: modeled } =>
           let first = production_first_row_lookup(rows: modeled.analysis.first_rows, name: ^dag_production_stmt)
           !alb_first_has(keys: first, token_class: ^dag_token_comma)
             && !alb_first_has(keys: first, token_class: ^dag_token_rparen)
diff --git a/src/v2/test/claim/body_lowering/peeled_shell_fold_head_test.dag b/src/v2/test/claim/body_lowering/peeled_shell_fold_head_test.dag
index 0d1e70bfc07..2528e155003 100644
--- a/src/v2/test/claim/body_lowering/peeled_shell_fold_head_test.dag
+++ b/src/v2/test/claim/body_lowering/peeled_shell_fold_head_test.dag
@@ -3,9 +3,9 @@ module v2.test.claim.body_lowering.peeled_shell_fold_head
 import v2.compiler.body_lowering_fold { body_lower_is_pass_through_emitted }
 import v2.compiler.fold_lowering { fold_call_head_symbol, fold_family_realization }
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex, parse_production_emitted_identity_optional }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
+import v2.extdeps.languages.dag { parse_production_emitted_identity_optional }
 import v2.std.diagnostic { Accepted, Outcome, Rejected, bind_outcome }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.node { Node }
@@ -27,18 +27,17 @@ data peeled_shell_fold_head_source: String = "module w.p\n\ndata d: I = fold(x,
 fn peeled_shell_fold_head_parsed() -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(
+        o: tokenize_prepared(
           text: peeled_shell_fold_head_source,
           file: ^peeled_shell_fold_head_file,
-          rules: dag_lex()
+          prepared: dag_prepared_lex()
         ),
         f: fn(token_stream) {
           match parse_module_prepared(
             tokens: token_stream,
-            prepared: prepared,
-            validation_residue: residue
+            prepared: prepared
           ) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } =>
diff --git a/src/v2/test/claim/body_lowering/single_arm_match_test.dag b/src/v2/test/claim/body_lowering/single_arm_match_test.dag
index 7045d270d20..2596aec0dbf 100644
--- a/src/v2/test/claim/body_lowering/single_arm_match_test.dag
+++ b/src/v2/test/claim/body_lowering/single_arm_match_test.dag
@@ -9,6 +9,7 @@ import v2.compiler.reference_conservation_admission {
 }
 import v2.compiler.reference_conservation { ReferenceConservationSubject }
 import std.algebra { Cons, Empty, FreeMonoid }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.test.claim.body_lowering.normalize_outcome_helpers {
   body_lowering_normalize_outcome
 }
diff --git a/src/v2/test/claim/body_lowering_block_body_call_test.dag b/src/v2/test/claim/body_lowering_block_body_call_test.dag
index e9288951b37..4d6b87e1fe8 100644
--- a/src/v2/test/claim/body_lowering_block_body_call_test.dag
+++ b/src/v2/test/claim/body_lowering_block_body_call_test.dag
@@ -3,9 +3,8 @@ module v2.test.claim.body_lowering_block_body_call
 import v2.compiler.reference_conservation_admission { conservation_subject_of_text, conserved_normalize, no_explained_drops }
 import v2.compiler.reference_conservation { ReferenceConservationSubject }
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.diagnostic { Accepted, Outcome, Rejected, bind_outcome }
 import v2.std.compilers.body_lowering {
   Application,
@@ -26,18 +25,17 @@ data body_lowering_block_call_source: String = "module wall.same\n\nfn leaf() ->
 fn body_lowering_block_call_parsed() -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(
+        o: tokenize_prepared(
           text: body_lowering_block_call_source,
           file: ^body_lowering_block_call_file,
-          rules: dag_lex()
+          prepared: dag_prepared_lex()
         ),
         f: fn(token_stream) {
           match parse_module_prepared(
             tokens: token_stream,
-            prepared: prepared,
-            validation_residue: residue
+            prepared: prepared
           ) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } =>
diff --git a/src/v2/test/claim/body_lowering_data_literal_door_test.dag b/src/v2/test/claim/body_lowering_data_literal_door_test.dag
new file mode 100644
index 00000000000..569f5a85604
--- /dev/null
+++ b/src/v2/test/claim/body_lowering_data_literal_door_test.dag
@@ -0,0 +1,43 @@
+module v2.test.claim.body_lowering_data_literal_door
+
+import v2.compiler.normalize { normalize }
+import v2.test.parse.expression_bodied_fn_decl_parse { g_tokenize_parse, g_tree_has_arrow_body }
+import v2.std.diagnostic { Accepted, Outcome, Rejected }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import v2.std.logic { Bool }
+import v2.std.node { Node }
+import v2.std.text { String }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE NATIVE DOOR'S ONE-LINE CONTROL, ON THE INTERPRETED v2 ROUTE (MQ-5, #12942). The door's accepting
+// control (fixture.native_cli_door.door_probe) is a `data` declaration whose initializer is one Int
+// literal; the emitted compiler refused it with body_lowering_reason_unrecognised_lowered_shape at a
+// synthetic node once the cut made every reader classify its input through body_term_of. Nothing on the
+// required floor normalized that shape, so the refusal surfaced only on the native emit-build lane. This
+// claim normalizes the same source through the same v2 pipeline, interpreted, and asserts it is admitted
+// with its arrow body present -- the data declaration lowered to its nullary member.
+//
+// The parse and normalize are one nullary producer, filled in preparation under the single-claim fill
+// debt of v2.workflow.floor_pure_producer_share floor_single_claim_fill_debt:
+// a whole-grammar parse plus normalize is past one claim's budget, and the claim reads the result.
+
+data door_data_literal_source: String = "module fixture.native_cli_door.door_probe\n\ndata native_cli_door_probe_value: Int = 606060\n"
+
+fn door_data_literal_normalized() -> Outcome<Node> {
+  match g_tokenize_parse(text: door_data_literal_source, file: ^probe_door_data_literal) {
+    Rejected { diagnostics: d } => Rejected { diagnostics: d }
+    Accepted { value: tree, diagnostics: _ } =>
+      match normalize(parse_tree: tree) {
+        Rejected { diagnostics: d } => Rejected { diagnostics: d }
+        Accepted { value: normalized, diagnostics: d } => Accepted { value: normalized.root, diagnostics: d }
+      }
+  }
+}
+
+test fn a_data_declaration_with_an_int_literal_normalizes_holds() -> Bool {
+  match door_data_literal_normalized() {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: root, diagnostics: _ } => g_tree_has_arrow_body(root: root)
+  }
+}
diff --git a/src/v2/test/claim/body_lowering_qualified_path_test.dag b/src/v2/test/claim/body_lowering_qualified_path_test.dag
index 3cebefcc46d..ba28f78d11f 100644
--- a/src/v2/test/claim/body_lowering_qualified_path_test.dag
+++ b/src/v2/test/claim/body_lowering_qualified_path_test.dag
@@ -21,9 +21,8 @@ import v2.std.compilers.sugar { sugar_sequence_pair_optional }
 import v2.compiler.reference_conservation_admission { conserved_normalize_of_text, no_explained_drops }
 import v2.compiler.normalized_tree { NormalizedTree }
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import std.algebra { Cons, Empty }
 import v2.std.algebra { length, list_snoc_item }
 import v2.std.diagnostic { Accepted, Outcome, Rejected, bind_outcome }
@@ -527,14 +526,13 @@ data body_lowering_qualified_call_source: String = "module wall.peer\n\nfn uses_
 fn body_lowering_source_parsed(text: String, file: Symbol) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: file, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
           match parse_module_prepared(
             tokens: token_stream,
-            prepared: prepared,
-            validation_residue: residue
+            prepared: prepared
           ) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } =>
diff --git a/src/v2/test/claim/body_lowering_unrecognised_lowered_shape_test.dag b/src/v2/test/claim/body_lowering_unrecognised_lowered_shape_test.dag
index a0c343e3cd6..cd4e8bbac97 100644
--- a/src/v2/test/claim/body_lowering_unrecognised_lowered_shape_test.dag
+++ b/src/v2/test/claim/body_lowering_unrecognised_lowered_shape_test.dag
@@ -1,21 +1,35 @@
 module v2.test.claim.body_lowering_unrecognised_lowered_shape
 
+import gunbc.compile_diagnostic_census {
+  CensusNotRunnable,
+  CensusObserved,
+  census_rows_of_class,
+  census_total_count
+}
 import v2.compiler.body_lowering_fold {
   OperandRefAbsent,
   OperandRefLowered,
-  OperandRefRead,
   OperandRefRefused,
-  body_lower_find_core_substrate_passes_unrecognised,
   body_lower_fold,
-  body_lower_operand_ref_read
+  body_lower_operand_ref_read,
+  body_term_of
+}
+import v2.test.parse.expression_bodied_fn_decl_parse { g_tokenize_parse }
+import v2.extdeps.languages.dag {
+  dag_int_literal_node_from_lexeme,
+  parse_production_emitted_identity_optional
 }
+import v2.std.compilers.body_lowering { BodyTerm, Lowered, RawLeaf, RawParse }
 import v2.std.diagnostic { Accepted, Outcome, Rejected, node_locus }
+import std.types { Bool }
+import v2.std.grammar { node_atom_identity_optional }
+import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
 import v2.std.node {
   Atom,
+  Authored,
   ComputationNode,
   Conj,
   Edge,
-  Authored,
   Node,
   Positional,
   Symbol,
@@ -23,25 +37,28 @@ import v2.std.node {
   TypeNode,
   node_synthetic
 }
-import v2.std.node_query { field_projection_node }
-import std.optional { Absent, Present }
+import std.optional { Absent, Optional, Present, optional_absent, optional_present }
+import v2.std.text { String }
+import std.types { Int }
+import std.occurrence_identity { OccurrenceSynthetic }
+
+data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
 
-// The subject is the refusal body lowering gives a lowered shape no reader recognises
-// (v2.compiler.body_lowering_fold body_lower_is_unrecognised_lowered_shape), so the inputs are
-// SUPPLIED at that boundary (DESIGN section 3): a producer-shaped node no producer emits today, beside
-// the shapes that must still pass. The route pairing -- that real producers' outputs still lower whole
-// on the real stages -- is held by the enrolled claims over real text:
-// v2.test.claim.namespace_xl0.value_position_whole_read
-// a_field_projection_on_a_call_result_in_an_operand_lowers_whole and
-// v2.test.claim.namespace_xl0.reference_conservation_admission
-// a_field_projection_on_a_call_result_in_an_operand_is_admitted_holds.
+// THE SUBJECT IS THE TERM BODY LOWERING READS OFF ITS TREE (v2.compiler.body_lowering_fold
+// body_term_of) AND THE WALLS AROUND IT (MQ-5). The first group supplies inputs at that boundary
+// (DESIGN section 3): a node that is neither wrapped by a producer nor stamped by the parse refuses
+// wherever it is read, and the raw forms the parse does write are read positively. The second group
+// runs the real route: source text through tokenize, parse and the bottom-up fold, so the claim is
+// about what a producer actually emits. The third hands the compiler fixture sources that try to
+// forge the Lowered label, on the seed acceptance path. The route pairing for real programs is held
+// by v2.test.claim.namespace_xl0.value_position_whole_read and
+// v2.test.claim.namespace_xl0.reference_conservation_admission.
 
 fn ulsh_leaf() -> Node {
   node_synthetic(kind: TypeNode { connective: Atom { identity: ^ulsh_leaf } }, children: [])
 }
 
-// A Conj under a label no grammar production and no lowering emits: lowered-shaped (no grammar
-// projection edge) and outside the allowlist.
+// A Conj under a label no grammar production and no lowering emits, with no wrapper over it.
 fn ulsh_unknown_shape() -> Node {
   node_synthetic(
     kind: TypeNode { connective: Conj },
@@ -49,8 +66,6 @@ fn ulsh_unknown_shape() -> Node {
   )
 }
 
-// The same unknown shape wrapping a recognised node: the first-match descendant search would answer
-// the Transform inside it, a part for the whole.
 fn ulsh_unknown_over_transform() -> Node {
   node_synthetic(
     kind: TypeNode { connective: Conj },
@@ -66,6 +81,14 @@ fn ulsh_unknown_over_transform() -> Node {
   )
 }
 
+// A producer's output with its seal missing: the allowlist used to take this whole.
+fn ulsh_unsealed_transform() -> Node {
+  node_synthetic(
+    kind: ComputationNode { behavior: Transform },
+    children: [Edge { label: Positional, target: ulsh_leaf() }]
+  )
+}
+
 fn ulsh_raw_sequence() -> Node {
   node_synthetic(
     kind: TypeNode { connective: Conj },
@@ -76,6 +99,13 @@ fn ulsh_raw_sequence() -> Node {
   )
 }
 
+fn ulsh_int_literal_token() -> Optional<Node> {
+  match dag_int_literal_node_from_lexeme(lexeme: "7", occurrence_id: OccurrenceSynthetic) {
+    Accepted { value: lit, diagnostics: _ } => optional_present(value: lit)
+    Rejected { diagnostics: _ } => optional_absent()
+  }
+}
+
 fn ulsh_refused_unrecognised(o: Outcome<Node>) -> Bool {
   match o {
     Rejected { diagnostics: d } => d.head.reason == ^body_lowering_reason_unrecognised_lowered_shape
@@ -83,7 +113,14 @@ fn ulsh_refused_unrecognised(o: Outcome<Node>) -> Bool {
   }
 }
 
-// RED if the fold re-reads the shape (the re-lower fallback restored) or refuses it for another reason.
+fn ulsh_term_refused(n: Node) -> Bool {
+  match body_term_of(node: n) {
+    Rejected { diagnostics: d } => d.head.reason == ^body_lowering_reason_unrecognised_lowered_shape
+    Accepted { value: _, diagnostics: _ } => false
+  }
+}
+
+// RED if the fold re-reads the shape as raw parse or refuses it for another reason.
 test fn an_unrecognised_lowered_shape_refuses_at_the_fold() -> Bool {
   ulsh_refused_unrecognised(o: body_lower_fold(node: ulsh_unknown_shape()))
 }
@@ -105,22 +142,123 @@ test fn an_unrecognised_lowered_shape_refuses_at_the_operand_reader() -> Bool {
   }
 }
 
-test fn the_descendant_search_does_not_answer_a_part_of_an_unrecognised_shape() -> Bool {
-  match body_lower_find_core_substrate_passes_unrecognised(root: ulsh_unknown_over_transform()) {
-    Present { value: passed } => passed == ulsh_unknown_over_transform()
+// THE RE-READ IS UNWRITABLE, NOT RECOGNISED BY SHAPE. A Transform no producer sealed was taken whole
+// by the deleted allowlist; it is now neither a term nor raw parse, and refuses.
+test fn an_unsealed_producer_output_refuses_at_the_fold() -> Bool {
+  ulsh_refused_unrecognised(o: body_lower_fold(node: ulsh_unsealed_transform()))
+}
+
+// POSITIVE CONTROLS: what the parse writes is read as the parse wrote it, by a positive test.
+test fn a_raw_parse_sequence_is_raw_parse() -> Bool {
+  match body_term_of(node: ulsh_raw_sequence()) {
+    Accepted { value: RawParse { node: _ }, diagnostics: _ } => true
+    _ => false
+  }
+}
+
+test fn a_childless_atom_is_a_raw_leaf() -> Bool {
+  match body_term_of(node: ulsh_leaf()) {
+    Accepted { value: RawLeaf { node: _ }, diagnostics: _ } => true
+    _ => false
+  }
+}
+
+test fn a_parse_minted_literal_token_is_a_raw_leaf() -> Bool {
+  match ulsh_int_literal_token() {
+    Absent => false
+    Present { value: lit } =>
+      match body_term_of(node: lit) {
+        Accepted { value: RawLeaf { node: _ }, diagnostics: _ } => true
+        _ => false
+      }
+  }
+}
+
+// The literal-token arm admits the token's own payload edge and nothing beside it.
+test fn a_literal_token_carrying_a_foreign_edge_refuses() -> Bool {
+  match ulsh_int_literal_token() {
     Absent => false
+    Present { value: lit } =>
+      ulsh_term_refused(n: node_synthetic(kind: lit.kind, children: [Edge { label: Authored { name: ^ulsh_probe_edge }, target: ulsh_leaf() }]))
   }
 }
 
-// POSITIVE CONTROLS: a known producer shape passes whole, and raw parse is never mistaken for output.
-test fn a_field_projection_still_lowers_whole() -> Bool {
-  let projection = field_projection_node(base: ulsh_leaf(), field: ulsh_leaf(), source: ulsh_leaf())
-  match body_lower_fold(node: projection) {
-    Accepted { value: v, diagnostics: _ } => v == projection
-    Rejected { diagnostics: _ } => false
+// THE ROUTE: a value position the fold lowers to a bare identifier. The postfix producer passes the
+// atom through unchanged, and the atom must still leave the fold sealed as that producer's output.
+// RED if the postfix arm of body_lower_reduce_emitted stops sealing: the atom then reads as a raw leaf.
+data ulsh_route_source: String = "module ulsh_route\n\ndata ulsh_value: Int = ulsh_name\n"
+
+// THE PARSE IS ONE NULLARY PRODUCER, filled in preparation under the single-claim fill debt of
+// v2.workflow.floor_pure_producer_share floor_single_claim_fill_debt, as the door claim's is
+// (v2.test.claim.body_lowering_data_literal_door door_data_literal_normalized). The
+// route claim reads the postfix node it yields; building the language model, tokenizing and parsing
+// inside the claim cost 399ms against a 302ms enrolment margin on the merge-group floor. It parses
+// through the shared prepared grammar (g_tokenize_parse), the same route the door claim reads.
+fn ulsh_route_postfix() -> Optional<Node> {
+  match g_tokenize_parse(text: ulsh_route_source, file: ^ulsh_route_file) {
+    Rejected { diagnostics: _ } => optional_absent()
+    Accepted { value: tree, diagnostics: _ } =>
+      ulsh_first_emitted(root: tree, production: ^dag_surface_postfix_expr)
+  }
+}
+
+fn ulsh_first_emitted(root: Node, production: Symbol) -> Optional<Node> {
+  let own = match parse_production_emitted_identity_optional(node: root) {
+    Present { value: e } => e == production
+    Absent => false
   }
+  if own {
+    optional_present(value: root)
+  } else {
+    fold(root.children, init: optional_absent(), f: fn(acc, e) {
+      match acc {
+        Present { value: _ } => acc
+        Absent => ulsh_first_emitted(root: e.target, production: production)
+      }
+    })
+  }
+}
+
+test fn a_passed_through_atom_leaves_the_fold_sealed() -> Bool {
+  match ulsh_route_postfix() {
+        Absent => false
+        Present { value: postfix } =>
+          match body_lower_fold(node: postfix) {
+            Rejected { diagnostics: _ } => false
+            Accepted { value: folded, diagnostics: _ } =>
+              match body_term_of(node: folded) {
+                Accepted { value: Lowered { node: atom, shape: _ }, diagnostics: _ } =>
+                  match node_atom_identity_optional(node: atom) {
+                    Present { value: id } => id == ^ulsh_name
+                    Absent => false
+                  }
+                _ => false
+              }
+          }
+  }
+}
+
+// THE FORGERY WALL, ON THE SEED ACCEPTANCE PATH. The Lowered label carries a sole_constructor seal
+// (v2.std.node BodyTermLoweredSeal) minted only for the body-lowering mint. A fixture that calls the
+// seal's mint from outside its admitted caller refuses, and so does one that builds the seal record
+// directly; the positive control is that the corpus compiles the real mint (this module resolves).
+// Each fixture is well typed apart from the forgery (the seal carries a LoweredShape arm), so the
+// forgery is the only thing that can refuse.
+fn ulsh_refusals(source: String, wanted: String) -> Int {
+  match compile_dag_diagnostic_census(source) {
+    CensusObserved { rows: rows } => census_total_count(rows: census_rows_of_class(rows: rows, wanted: wanted))
+    CensusNotRunnable { cause: _ } => 0 - 1
+  }
+}
+
+data ulsh_forged_mint_call_source: String = "module ulsh_forge_call\nimport v2.std.compilers.lowered_shape { LoweredOperand }\nimport v2.std.node { BodyTermLoweredSeal, body_term_lowered_seal }\nfn ulsh_forge() -> BodyTermLoweredSeal = body_term_lowered_seal(shape: LoweredOperand)\n"
+
+data ulsh_forged_record_source: String = "module ulsh_forge_record\nimport v2.std.compilers.lowered_shape { LoweredOperand }\nimport v2.std.node { BodyTermLoweredSeal }\nfn ulsh_forge() -> BodyTermLoweredSeal = BodyTermLoweredSeal { shape: LoweredOperand }\n"
+
+test fn a_forged_seal_mint_call_refuses() -> Bool {
+  ulsh_refusals(source: ulsh_forged_mint_call_source, wanted: "ConstructorCallAdmissionRefused") >= 1
 }
 
-test fn a_raw_parse_sequence_is_not_an_unrecognised_lowered_shape() -> Bool {
-  !ulsh_refused_unrecognised(o: body_lower_fold(node: ulsh_raw_sequence()))
+test fn a_forged_seal_record_refuses() -> Bool {
+  ulsh_refusals(source: ulsh_forged_record_source, wanted: "SoleConstructorViolation") >= 1
 }
diff --git a/src/v2/test/claim/c_compilation_unit_witness_test.dag b/src/v2/test/claim/c_compilation_unit_witness_test.dag
index 96ff751d102..8024e66c896 100644
--- a/src/v2/test/claim/c_compilation_unit_witness_test.dag
+++ b/src/v2/test/claim/c_compilation_unit_witness_test.dag
@@ -1,5 +1,15 @@
 module v2.test.claim.c_compilation_unit_witness
 
+import gunbc.crate_partition {
+  ByValueTypeCycle,
+  CompilationUnitId,
+  InterfaceClosureUnreachedFixpoint,
+  ModuleDagEdge,
+  ModuleId,
+  PartitionR4Refused,
+  PartitionR4Valid
+}
+
 import std.algebra { Empty }
 import v2.std.arrow_signature { anonymous_signature_arrow }
 import std.types { NonEmptyStr, List, String }
@@ -16,17 +26,10 @@ import v2.extdeps.languages.c {
   c_validate_partition_r4
 }
 import v2.std.compilers.compilation_unit {
-  ByValueTypeCycle,
-  CompilationUnitId,
-  InterfaceClosureUnreachedFixpoint,
   ModuleDag,
-  ModuleDagEdge,
-  ModuleId,
   ModuleTypeDefinitionRow,
   PartitionFoldOk,
   PartitionFoldRefused,
-  PartitionR4Refused,
-  PartitionR4Valid,
   partition_fold_outcome,
   partition_fold_outcome_with_closure_fuel,
   partition_interface_contains_node,
diff --git a/src/v2/test/claim/caller_admission_native_wall_test.dag b/src/v2/test/claim/caller_admission_native_wall_test.dag
new file mode 100644
index 00000000000..026237ed24b
--- /dev/null
+++ b/src/v2/test/claim/caller_admission_native_wall_test.dag
@@ -0,0 +1,390 @@
+// caller_admission_native_wall_test -- HERMETIC WALL WITNESSES for the former drop
+// gunbc.rung_drop.admit_callers_discarded_on_the_native_route.
+//
+// The wall's contract is judged over VALUES, so these claims build the roster records, the marker
+// atoms, and the caller coordinates by hand (the parameter_reference_test idiom: minted occurrence
+// identities, Node literals) and call the wall's pure entry points directly. No claim here runs the
+// ingest pipeline; the ONE real-path inhabitance claim -- the native route refusing an outside
+// cross-module call end to end -- lives in the long home
+// (src/v2/test/claim/long/caller_admission_native_wall_red_test.dag): it runs the real
+// parse -> assemble -> lower -> infer pipeline over a two-module source, so it is withheld from
+// the required floor's charged clock by its typed v2.workflow.floor_cost_debt row and
+// verdict-proven in the changed-witness lane; deleting the carrier or the consumer turns it red.
+//
+// THE RECORD SHAPE these claims build is the image the lowering's carrier hangs: a left-named
+// roster spine (each node a conj with one @left record edge and one @right rest edge, the empty
+// conj root ending it), each record carrying the authored operator edge (name ^decl_ref, target the
+// ^decl_ref atom) and the two string lexemes as authored edges (module_path, decl_name). An entry
+// that reads but is not such a call lowers to a MARKER record whose single edge names the entry
+// refusal (^infer_reason_admit_callers_entry_not_decl_ref); a clause whose spine does not read
+// lowers to the clause-fallback marker (^infer_reason_admit_callers_entries_unreadable). The claims
+// pin both failure arms and the positive direction, so:
+//   - deleting the judge or its refusal arm turns (1) red, and (2) red if it refuses everything;
+//   - dropping an uninterpretable entry turns (3) red;
+//   - accepting a non-conj roster (silently narrowing the roster) turns (4) red;
+//   - breaking the record reader's coordinates turns (5) red.
+//
+// THE SEAM CLAIMS close the fail-open review found (side chat review 5439746794): a callee marked
+// as a declaration reference whose declaration is unavailable refuses (typed, located) rather than
+// falling out of the lookup as "absent"; an unmarked callee is not judged at all. The marker
+// closed-list control -- the codec decoding AdmitCallersEdge -- lives in the codec's own witness
+// (dag/test/claim/scm/scm_object_table_json_witness_test.dag), where the decode idiom already
+// stands; hand-building the codec's sealed records here is not possible outside their defining
+// module.
+
+module v2.test.claim.caller_admission_native_wall
+
+import std.algebra { Cons, Empty }
+import std.occurrence_identity { NodeOccurrenceIdentity, OccurrenceId, OccurrenceMinted, OccurrenceProjected, OccurrencePending, OccurrenceSynthetic }
+import v2.compiler.infer { InferAdmissionCallerKey, infer_admission_judge_entries, infer_admit_clause_entries, infer_admit_record_check, infer_caller_admission_application_diags, infer_caller_admission_judged_diags }
+import v2.std.node_query { declaration_reference_path_optional }
+import v2.std.symbol_index { empty_symbol_index, symbol_index_insert }
+import std.optional { optional_absent, optional_present }
+import v2.std.diagnostic { None, Some, Suggested, Unavailable, diagnostics_has_reason }
+import v2.std.logic { Bool }
+import v2.std.node { Edge, Node, Symbol, symbol_eq, Atom, Conj, TypeNode, Authored, StructuralLabel, CoreMarker, DeclarationReferenceEdge, Positional }
+import std.optional { Absent, Present }
+
+// ---------------------------------------------------------------------------
+// Hand-built values: the lowering's roster record image, plus the two markers.
+// ---------------------------------------------------------------------------
+
+// The application locus: the judge reports the refused call at its call site. Any node carries a
+// locus; the atom below is the wall's witness spelling for one.
+data wall_call_site_locus: NodeOccurrenceIdentity = OccurrenceMinted { id: OccurrenceId { value: 910 } }
+data wall_record_locus: NodeOccurrenceIdentity = OccurrenceMinted { id: OccurrenceId { value: 911 } }
+data wall_marker_locus: NodeOccurrenceIdentity = OccurrenceMinted { id: OccurrenceId { value: 912 } }
+data wall_roster_locus: NodeOccurrenceIdentity = OccurrenceMinted { id: OccurrenceId { value: 913 } }
+data wall_clause_fallback_locus: NodeOccurrenceIdentity = OccurrenceMinted { id: OccurrenceId { value: 914 } }
+
+data wall_application: Node = Node {
+  kind: TypeNode { connective: Atom { identity: ^wall_call_site } },
+  children: [],
+  occurrence_id: wall_call_site_locus
+}
+
+// ONE RECORD: the image of `decl_ref(module_path: "<mp>", decl_name: "<dn>")` -- the authored
+// operator edge naming the ^decl_ref atom, the lexemes as authored edges.
+fn wall_record(mp: Symbol, dn: Symbol) -> Node {
+  Node {
+    kind: TypeNode { connective: Conj },
+    children: [
+      Edge {
+        label: Authored { name: ^decl_ref },
+        target: Node { kind: TypeNode { connective: Atom { identity: ^decl_ref } }, children: [], occurrence_id: OccurrenceSynthetic }
+      },
+      Edge {
+        label: Authored { name: ^module_path },
+        target: Node { kind: TypeNode { connective: Atom { identity: mp } }, children: [], occurrence_id: OccurrenceSynthetic }
+      },
+      Edge {
+        label: Authored { name: ^decl_name },
+        target: Node { kind: TypeNode { connective: Atom { identity: dn } }, children: [], occurrence_id: OccurrenceSynthetic }
+      }
+    ],
+    occurrence_id: wall_record_locus
+  }
+}
+
+// THE UNINTERPRETABLE-ENTRY MARKER: what the carrier hangs for an entry that reads but is not a
+// decl_ref(module_path, decl_name) call -- a record conj whose single edge names the refusal.
+data wall_marker_entry: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge {
+      label: Authored { name: ^infer_reason_admit_callers_entry_not_decl_ref },
+      target: Node { kind: TypeNode { connective: Atom { identity: ^infer_reason_admit_callers_entry_not_decl_ref } }, children: [], occurrence_id: OccurrenceSynthetic }
+    }
+  ],
+  occurrence_id: wall_marker_locus
+}
+
+// THE CLAUSE-FALLBACK MARKER: what the carrier hangs under AdmitCallersEdge when the authored
+// spine does not read.
+data wall_clause_fallback: Node = Node {
+  kind: TypeNode { connective: Atom { identity: ^infer_reason_admit_callers_entries_unreadable } },
+  children: [],
+  occurrence_id: wall_clause_fallback_locus
+}
+
+// A ROSTER SPINE with one well-formed record: the record rides the grammar's
+// sequence-left projection edge, the empty conj root rides the sequence-right one — the declared
+// sequence-pair shape (sugar_sequence_pair_optional reads exactly these symbols).
+data wall_roster_single: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge {
+      label: Authored { name: ^grammar_sequence_left_node_projection },
+      target: wall_record(mp: ^bcb, dn: ^listed_caller)
+    },
+    Edge {
+      label: Authored { name: ^grammar_sequence_right_node_projection },
+      target: Node { kind: TypeNode { connective: Conj }, children: [], occurrence_id: OccurrenceSynthetic }
+    }
+  ],
+  occurrence_id: wall_roster_locus
+}
+
+// ---------------------------------------------------------------------------
+// (1) THE RED: a call from a declaration outside the list refuses.
+// ---------------------------------------------------------------------------
+
+test fn the_wall_refuses_a_call_from_a_declaration_outside_the_list_holds() -> Bool {
+  match infer_admission_judge_entries(
+    application: wall_application,
+    entries: [wall_record(mp: ^bcb, dn: ^listed_caller)],
+    caller: InferAdmissionCallerKey { decl_name: ^outside_caller },
+    module_symbol: ^bcb
+  ) {
+    None => false
+    Some { diagnostics: d } =>
+      diagnostics_has_reason(d: Some { diagnostics: d }, reason: ^infer_reason_caller_admission_refused)
+  }
+}
+
+// ---------------------------------------------------------------------------
+// (2) THE CONTROL: the listed declaration is admitted -- the judge's positive direction.
+// ---------------------------------------------------------------------------
+test fn the_wall_admits_a_call_from_the_listed_declaration_holds() -> Bool {
+  match infer_admission_judge_entries(
+    application: wall_application,
+    entries: [wall_record(mp: ^bcb, dn: ^listed_caller)],
+    caller: InferAdmissionCallerKey { decl_name: ^listed_caller },
+    module_symbol: ^bcb
+  ) {
+    None => true
+    Some { diagnostics: _ } => false
+  }
+}
+
+// ---------------------------------------------------------------------------
+// (3) THE ENTRY-SHAPE RED: an entry that is not a decl_ref call refuses at the entry and is
+// reported beside the refusal -- never dropped from the roster.
+// ---------------------------------------------------------------------------
+
+test fn an_entry_that_is_not_a_decl_ref_call_refuses_at_the_entry_holds() -> Bool {
+  match infer_admission_judge_entries(
+    application: wall_application,
+    entries: [wall_marker_entry],
+    caller: InferAdmissionCallerKey { decl_name: ^outside_caller },
+    module_symbol: ^bcb
+  ) {
+    None => false
+    Some { diagnostics: d } =>
+      diagnostics_has_reason(d: Some { diagnostics: d }, reason: ^infer_reason_admit_callers_entry_not_decl_ref)
+  }
+}
+
+// ---------------------------------------------------------------------------
+// (4) THE CLAUSE-FALLBACK RED: a clause the carrier could not read refuses at the clause as
+// entries_unreadable -- a malformed clause is never a shorter roster.
+// ---------------------------------------------------------------------------
+
+test fn a_clause_the_carrier_cannot_read_refuses_as_entries_unreadable_holds() -> Bool {
+  match infer_admit_clause_entries(roster: wall_clause_fallback) {
+    Rejected { diagnostics: d } =>
+      diagnostics_has_reason(d: Some { diagnostics: d }, reason: ^infer_reason_admit_callers_entries_unreadable)
+    Accepted { value: _, diagnostics: _ } => false
+  }
+}
+
+// ---------------------------------------------------------------------------
+// (5) THE READER'S POSITIVE CONTROL: a well-formed roster reads as exactly the authored
+// coordinates -- one record, spelling bcb.listed_caller.
+// ---------------------------------------------------------------------------
+
+test fn a_well_formed_roster_reads_as_the_authored_coordinates_holds() -> Bool {
+  match infer_admit_clause_entries(roster: wall_roster_single) {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: records, diagnostics: _ } =>
+      match records {
+        Empty => false
+        Cons { head: record, tail: tail } =>
+          match tail {
+            Empty =>
+              match infer_admit_record_check(record: record) {
+                Absent => false
+                Present { value: coords } =>
+                  if symbol_eq(a: coords.module_path, b: ^bcb) {
+                    symbol_eq(a: coords.decl_name, b: ^listed_caller)
+                  } else {
+                    false
+                  }
+              }
+            Cons { head: _, tail: _ } => false
+          }
+      }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// (6) FAIL CLOSED: a DECLARED callee whose arrow cannot be read refuses with a typed,
+// located cause carrying the looked-up key -- never an admit. The declaration is present in
+// resolved_declarations (keyed by the reference's own qualified path) but is not an Arrow, so
+// the arrow read fails: undetermined check, refusal. The boundary: a child not marked as a
+// declaration reference is no judgment (the ordinary grounding machinery owns it); a child
+// MARKED as a declaration reference with no index entry is unresolved and refuses (the seam
+// claims below pin that boundary).
+// ---------------------------------------------------------------------------
+
+data wall_decl_ref_locus: NodeOccurrenceIdentity = OccurrenceMinted { id: OccurrenceId { value: 915 } }
+
+fn wall_decl_ref_target() -> Node {
+  Node {
+    kind: TypeNode { connective: Conj },
+    children: [
+      Edge {
+        label: StructuralLabel { label: CoreMarker { marker: DeclarationReferenceEdge } },
+        target: Node {
+          kind: TypeNode { connective: Conj },
+          children: [
+            Edge {
+              label: Authored { name: ^fold_list_node_head },
+              target: Node {
+                kind: TypeNode { connective: Atom { identity: ^wall_callee } },
+                children: [],
+                occurrence_id: wall_call_site_locus
+              }
+            },
+            Edge {
+              label: Authored { name: ^fold_list_node_tail },
+              target: Node {
+                kind: TypeNode { connective: Conj },
+                children: [],
+                occurrence_id: wall_call_site_locus
+              }
+            }
+          ],
+          occurrence_id: wall_call_site_locus
+        }
+      }
+    ],
+    occurrence_id: wall_decl_ref_locus
+  }
+}
+
+fn wall_unreadable_callee_application() -> Node {
+  Node {
+    kind: TypeNode { connective: Conj },
+    children: [Edge { label: Positional, target: wall_decl_ref_target() }],
+    occurrence_id: wall_call_site_locus
+  }
+}
+
+// THE INDEX FOR THE FAIL-CLOSED WITNESS: the declaration IS present — keyed by the very qualified
+// path the callee reference yields — but the declared node is not an Arrow, so the arrow read
+// cannot succeed. This pins the refusal's true scope: a DECLARED callee whose arrow is unreadable
+// refuses (fail closed); a callee that names no declaration at all is not judged (the ordinary
+// grounding machinery owns it).
+fn wall_index_with_unreadable_arrow() -> SymbolIndex {
+  match declaration_reference_path_optional(node: wall_decl_ref_target()) {
+    Absent => empty_symbol_index()
+    Present { value: qn } =>
+      symbol_index_insert(
+        index: empty_symbol_index(),
+        qualified_path: qn,
+        resolved: Node {
+          kind: TypeNode { connective: Conj },
+          children: [],
+          occurrence_id: OccurrenceSynthetic
+        }
+      )
+  }
+}
+
+test fn a_declared_callee_whose_arrow_is_unreadable_refuses_holds() -> Bool {
+  match infer_caller_admission_application_diags(
+    application: wall_unreadable_callee_application(),
+    caller: optional_present(value: InferAdmissionCallerKey { decl_name: ^outside_caller }),
+    module_symbol: optional_present(value: ^bcb),
+    entries: [],
+    declarations: wall_index_with_unreadable_arrow()
+  ) {
+    None => false
+    Some { diagnostics: d } =>
+      diagnostics_has_reason(d: Some { diagnostics: d }, reason: ^infer_reason_caller_admission_callee_unreadable)
+        && match d.head.correction {
+          Suggested { node: key } =>
+            match key.occurrence_id {
+              OccurrenceMinted { id: kid } => kid.value == 915
+              OccurrenceProjected { id: kid, caused_by: _ } => kid.value == 915
+              OccurrencePending { caused_by: _ } => false
+              OccurrenceSynthetic => false
+            }
+          Unavailable { reason: _ } => false
+        }
+  }
+}
+
+// THE SEAM CONTROLS (side chat review 5439746794): a callee marked as a declaration reference
+// whose declaration is unavailable is NOT "not declared" -- it is a grounding failure, and the
+// call refuses with a typed, located cause. A callee that is not marked as a declaration
+// reference at all stays outside the judgment: no marker, no admit list to consult.
+
+test fn a_marked_callee_whose_declaration_is_unavailable_refuses_holds() -> Bool {
+  match infer_caller_admission_application_diags(
+    application: wall_unreadable_callee_application(),
+    caller: optional_present(value: InferAdmissionCallerKey { decl_name: ^outside_caller }),
+    module_symbol: optional_present(value: ^bcb),
+    entries: [],
+    declarations: empty_symbol_index()
+  ) {
+    None => false
+    Some { diagnostics: d } => diagnostics_has_reason(d: Some { diagnostics: d }, reason: ^infer_reason_caller_admission_callee_unresolved)
+  }
+}
+
+fn wall_unmarked_application() -> Node {
+  Node {
+    kind: TypeNode { connective: Conj },
+    children: [Edge { label: Positional, target: Node {
+      kind: TypeNode { connective: Atom { identity: ^wall_not_a_declaration } },
+      children: [],
+      occurrence_id: OccurrenceSynthetic
+    } }],
+    occurrence_id: wall_call_site_locus
+  }
+}
+
+test fn an_unmarked_callee_is_not_judged_holds() -> Bool {
+  match infer_caller_admission_application_diags(
+    application: wall_unmarked_application(),
+    caller: optional_present(value: InferAdmissionCallerKey { decl_name: ^outside_caller }),
+    module_symbol: optional_present(value: ^bcb),
+    entries: [],
+    declarations: empty_symbol_index()
+  ) {
+    None => true
+    Some { diagnostics: _ } => false
+  }
+}
+
+// ---------------------------------------------------------------------------
+// (8) THE FACTS-PRESENT DISCRIMINATOR (side chat review 5442100127): the wrapper's first branch
+// (facts Absent) refuses on its own; the JUDGED path must refuse too when the facts DO supply a
+// callee Arrow -- one that carries no carrier edge -- and the resolved-declarations index lacks
+// the marked callee. The shared judged helper is called in exactly that state: roster lookup
+// Absent (no edge on the arrow), child0 marked, declaration missing -> RosterLookupUnresolved ->
+// the typed refusal. Collapsing RosterLookupUnresolved back into RosterLookupAbsent (the
+// fail-open seam) turns exactly this claim red.
+// ---------------------------------------------------------------------------
+fn wall_arrow_without_the_carrier_edge() -> Node {
+  Node {
+    kind: TypeNode { connective: Arrow },
+    children: [],
+    occurrence_id: OccurrenceSynthetic
+  }
+}
+
+test fn a_facts_arrow_without_the_carrier_edge_and_an_unresolved_declaration_refuses_holds() -> Bool {
+  diagnostics_has_reason(
+    d: infer_caller_admission_judged_diags(
+      application: wall_unreadable_callee_application(),
+      caller: optional_present(value: InferAdmissionCallerKey { decl_name: ^outside_caller }),
+      module_symbol: optional_present(value: ^bcb),
+      arrow: wall_arrow_without_the_carrier_edge(),
+      declarations: empty_symbol_index()
+    ),
+    reason: ^infer_reason_caller_admission_callee_unresolved
+  )
+}
diff --git a/src/v2/test/claim/cli/v2_native_cli_test.dag b/src/v2/test/claim/cli/v2_native_cli_test.dag
index d0818b9f6a7..5bae435b17b 100644
--- a/src/v2/test/claim/cli/v2_native_cli_test.dag
+++ b/src/v2/test/claim/cli/v2_native_cli_test.dag
@@ -416,12 +416,12 @@ test fn an_emit_refusal_exits_general_error_holds() -> Bool {
 // THE REFUSAL NAMES THE REFUSING LINK, NOT THE FIRST ADVISORY. This is the run-level claim the emit
 // arm's frontier above does not block: a refusal at ASSEMBLE happens before the single-module
 // emit frontier is reached, so a supplied ingest holding one file with tokens left after its module
-// body refuses through the real front end (tokenize, parse, normalize over dag_language_model),
-// with the grammar's overlap-residue advisory riding in front. The outcome's `reason` must be the
+// body refuses through the real front end (tokenize, parse, normalize over dag_language_model).
+// The outcome's `reason` must be the
 // FATAL -- the last link, parse_g0_tokens_remain -- and the detail must locate it: the compilation
 // unit the front end was handed (v2.compiler.program_assembly names the read's compilation_unit as
 // the diagnostic file) and the byte extent of the first remaining token. Before this change the `reason` field carried the head,
-// which on every such refusal is the same grammar-global advisory, so three different broken
+// which on every such refusal was then the same grammar-global advisory (a residue since retired), so three different broken
 // entries refused with one indistinguishable reason (gunbc#11507 measured it on the built binary).
 data cli_probe_entry_source: String = "module v2.cli_probe.entry\n\nimport std.types { Bool }\n\nfn cli_probe_entry_value(p: Bool) -> Bool { p }\n"
 
diff --git a/src/v2/test/claim/coercion/identity_cast_emission_route_test.dag b/src/v2/test/claim/coercion/identity_cast_emission_route_test.dag
index 004f4d2237a..3306e95285b 100644
--- a/src/v2/test/claim/coercion/identity_cast_emission_route_test.dag
+++ b/src/v2/test/claim/coercion/identity_cast_emission_route_test.dag
@@ -6,6 +6,7 @@ import std.optional { Absent }
 import v2.compiler.self_host.closure_emission {
   ClosureEmissionLocated, ClosureMemberEmitted, ClosureMemberRefused, emit_closure_from_ingest_located,
 }
+import v2.compiler.target_carriers { emit_module_decl_separator }
 import v2.compiler.source_authority { DagSourceReadWitness }
 import v2.extdeps.languages.dag { dag_type_atom_node }
 import v2.extdeps.languages.rust { rust_target_model }
@@ -28,12 +29,14 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // section 3). Two inhabitance rows still drive the door on this module, on the required gate.
 // gunbc.rung_drop identity_cast_route_new_witness_eval_step_cost retired when those inhabitance
 // identities billed inside the new-witness eval-step budget on gunbc#13489 required floor run
-// 37522243686 (artifact required-floor-claim-cost). The native partner builds and runs the emitted
-// text; it is not the last execution of the door.
+// 37522243686 (artifact required-floor-claim-cost). Native builds the same member text this
+// inhabitance asserts by exact equality.
 data identity_cast_source: String = "module v2.test.identity_cast\n\nfn f(x: Int) -> Int { x as Int }\n"
 
 data refused_cast_source: String = "module v2.test.identity_cast\n\nfn f(x: Int) -> Bool { x as Bool }\n"
 
+data identity_cast_supplied_emitted_text: String = concat("fn f(x: i32) -> i32 { x }", emit_module_decl_separator)
+
 type IdentityCastRouteVerdict
   = IdentityCastEntryEmitted { text: String, members: Int }
   | IdentityCastEntryRefused { reason: Symbol, members: Int }
@@ -84,7 +87,7 @@ fn refused_cast_route_verdict() -> IdentityCastRouteVerdict {
 fn identity_cast_route_admitted_holds(v: IdentityCastRouteVerdict) -> Bool {
   match v {
     IdentityCastEntryEmitted { text: t, members: n } =>
-      n == 1 && string_contains(s: t, pattern: "fn f(x: i32) -> i32")
+      n == 1 && t == identity_cast_supplied_emitted_text
     IdentityCastEntryRefused { reason: _, members: _ } => false
     IdentityCastClosureRefused { reason: _ } => false
   }
diff --git a/src/v2/test/claim/compilation_unit_witness_test.dag b/src/v2/test/claim/compilation_unit_witness_test.dag
index 43b37036ce7..bcfbad076fb 100644
--- a/src/v2/test/claim/compilation_unit_witness_test.dag
+++ b/src/v2/test/claim/compilation_unit_witness_test.dag
@@ -1,29 +1,34 @@
 module v2.test.claim.compilation_unit_witness
 
+import gunbc.crate_partition {
+  CompilationUnitId,
+  HandExplicit,
+  ModuleDagEdge,
+  ModuleId,
+  InterfaceClosureUnreachedFixpoint,
+  PartitionR4Refused,
+  PartitionR4Valid,
+  PartitionR4ValidityVerdict,
+  PolicyDerived,
+  partition_provenance_hand_explicit,
+  partition_provenance_policy_derived
+}
+
 import std.algebra { Empty }
 import v2.std.arrow_signature { anonymous_signature_arrow }
 import std.types { NonEmptyStr, List }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import v2.std.compilers.compilation_unit {
   CompilationUnit,
-  CompilationUnitId,
-  HandExplicit,
   ModuleDag,
-  ModuleDagEdge,
-  ModuleId,
   MembersResolveOk,
   MembersResolveRefused,
   ModuleTypeDefinitionRow,
-  InterfaceClosureUnreachedFixpoint,
   PartitionFoldOk,
   PartitionFoldOutcome,
   PartitionFoldRefused,
   PartitionInterfaceClosed,
   PartitionInterfaceTruncated,
-  PartitionR4Refused,
-  PartitionR4Valid,
-  PartitionR4ValidityVerdict,
-  PolicyDerived,
   partition_r4_witness_refused_scc_split,
   partition_fold_deps_match_boundary_edges,
   partition_fold_outcome,
@@ -31,10 +36,8 @@ import v2.std.compilers.compilation_unit {
   partition_interface_closure_saturate_result,
   partition_interface_contains_node,
   partition_provenance_eq,
-  partition_provenance_hand_explicit,
-  partition_provenance_policy_derived,
   partition_unit_by_id,
-  resolve_member_interfaces,
+  resolve_member_interfaces
 }
 import v2.std.collection { empty_map, map_insert }
 import std.optional { Absent, Optional, Present }
diff --git a/src/v2/test/claim/compiler/collection_count_realization_test.dag b/src/v2/test/claim/compiler/collection_count_realization_test.dag
new file mode 100644
index 00000000000..cbc088e0028
--- /dev/null
+++ b/src/v2/test/claim/compiler/collection_count_realization_test.dag
@@ -0,0 +1,123 @@
+module v2.test.claim.compiler.collection_count_realization
+
+import v2.compiler.fold_lowering { collection_roster_primitive_call_row_optional, collection_roster_signature_arrow }
+import v2.compiler.infer { InferFormalMatched, InferFormalShapeMismatch, infer_formals_from_domain, infer_match_generic_formal }
+import v2.test.claim.compiler.infer_fold_member_instance { fmi_assemble, fmi_infer_tree, fmi_reason }
+import std.types { Bool, List }
+import v2.std.diagnostic { Accepted, Rejected }
+import v2.std.qualified_name { declaration_reference_path_optional, qualified_name_to_dotted_string }
+import std.optional { Absent, Optional, Present }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import v2.std.node { Atom, Instantiation, Node, TypeNode, node_subtree_nodes, node_synthetic }
+import v2.std.node_query { node_positional_child_targets }
+import v2.std.collection { list_at_optional }
+import v2.std.symbol_index { empty_symbol_index }
+import v2.extdeps.languages.dag { dag_binding_denotation }
+import std.algebra { Cons, Empty }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// SUBJECT: a bare `count` whose name no declaration claims binds to the std.algebra collection roster's
+// primitive-call row (collection_count_shape), and v2 infer types the call by that row: the free-monoid carrier in,
+// a STATED Int out -- the declared departure whose authority is gunbc.rung_drop collection_count_result_stated_int_until_declared_results_are_judged.
+//
+// SHAPE, PER DESIGN SECTION 3's WITNESS RULE (sharp-raven-357): exactly ONE claim runs the real route (assemble plus
+// infer, ccc_route_runs_on_the_real_path); the others supply the row's signature at its interface, through the
+// production projection, reader and matcher (v2.compiler.infer infer_match_generic_formal, gunbc#13187). DELETING THE
+// ROUTE REDS THE REAL-PATH CLAIM: remove the count row from collection_roster_rows and `count(` is refused
+// resolve_reason_unbound_symbol (mutation run cited in the PR).
+
+data ccc_route_source: String = "module p\n\nimport v2.std.collection { List }\n\ntype Pair {\n  target: Int\n}\n\nfn f(xs: List<Pair>) -> Bool {\n  count(xs) == 0\n}\n\nfn g(xs: List<Pair>) -> Int {\n  count(xs)\n}\n"
+
+type CccRouteReading {
+  row_references: Int
+  infer_accepted: Bool
+}
+
+fn ccc_route_reading() -> CccRouteReading {
+  match fmi_assemble(src: ccc_route_source) {
+    Rejected { diagnostics: _ } => CccRouteReading { row_references: 0, infer_accepted: false }
+    Accepted { value: tree, diagnostics: _ } =>
+      CccRouteReading {
+        row_references: fold(node_subtree_nodes(root: tree.root), init: 0, f: fn(acc, n) {
+          match declaration_reference_path_optional(node: n) {
+            Present { value: p } => if qualified_name_to_dotted_string(qn: p) == "std.algebra.collection_count_shape" { acc + 1 } else { acc }
+            Absent => acc
+          }
+        }),
+        infer_accepted: fmi_reason(o: fmi_infer_tree(tree: tree)) == ^accepted
+      }
+  }
+}
+
+// THE REAL PATH: both heads bind the row; a size compared with a literal, and a size returned at a declared Int,
+// are accepted.
+test fn ccc_route_runs_on_the_real_path() -> Bool {
+  let r = ccc_route_reading()
+  r.row_references == 2 && r.infer_accepted
+}
+
+fn ccc_arrow() -> Optional<Node> {
+  match collection_roster_primitive_call_row_optional(head: ^count) {
+    Absent => Absent
+    Present { value: row } => collection_roster_signature_arrow(row: row)
+  }
+}
+
+fn ccc_formals() -> List<Node> {
+  match ccc_arrow() {
+    Absent => Empty
+    Present { value: arrow } =>
+      match list_at_optional(xs: node_positional_child_targets(node: arrow), index: 0) {
+        Absent => Empty
+        Present { value: domain } =>
+          match infer_formals_from_domain(domain: domain) {
+            Absent => Empty
+            Present { value: formals } => fold(formals, init: Empty, f: fn(acc, formal) { Cons { head: formal.declared, tail: acc } })
+          }
+      }
+  }
+}
+
+fn ccc_int_type() -> Node {
+  match dag_binding_denotation(sym: ^dag_binding_type_int) {
+    Present { value: t } => t
+    Absent => node_synthetic(kind: TypeNode { connective: Atom { identity: ^dag_binding_type_int } }, children: [])
+  }
+}
+
+fn ccc_is_instantiation(t: Node) -> Bool {
+  match t.kind {
+    TypeNode { connective: Instantiation } => true
+    TypeNode { connective: _ } => false
+    _ => false
+  }
+}
+
+// SUPPLIED: one formal, the free monoid.
+test fn ccc_signature_is_one_free_monoid_formal() -> Bool {
+  match ccc_formals() {
+    Cons { head: f, tail: Empty } => ccc_is_instantiation(t: f)
+    _ => false
+  }
+}
+
+// SUPPLIED, RED: an Int at the row's formal is a shape mismatch to the production matcher (the size of a non-collection).
+test fn ccc_size_of_a_non_collection_is_a_shape_mismatch() -> Bool {
+  match list_at_optional(xs: ccc_formals(), index: 0) {
+    Absent => false
+    Present { value: formal } =>
+      match infer_match_generic_formal(formal: formal, produced: ccc_int_type(), type_params: [^collection_roster_element], instances: Empty, declarations: empty_symbol_index()) {
+        InferFormalShapeMismatch => true
+        InferFormalMatched { instances: _ } => false
+      }
+  }
+}
+
+// SUPPLIED: the row's result is the stated kernel Int (the declared departure), read off the signature's codomain.
+test fn ccc_size_result_is_the_stated_int() -> Bool {
+  match ccc_arrow() {
+    Absent => false
+    Present { value: arrow } => list_at_optional(xs: node_positional_child_targets(node: arrow), index: 1) == Present { value: ccc_int_type() }
+  }
+}
diff --git a/src/v2/test/claim/compiler/data_reference_value_test.dag b/src/v2/test/claim/compiler/data_reference_value_test.dag
new file mode 100644
index 00000000000..77ddda3e1d2
--- /dev/null
+++ b/src/v2/test/claim/compiler/data_reference_value_test.dag
@@ -0,0 +1,182 @@
+module v2.test.claim.compiler.data_reference_value
+
+import v2.compiler.resolve { ResolvedTree }
+import v2.compiler.infer { infer, infer_reference_value_type }
+import v2.compiler.inferred_tree { InferredTree }
+import v2.compiler.eval { eval, inputs_root_only }
+import v2.extdeps.runtimes.v2_evaluator { v2_evaluator_interpretation }
+import v2.test.claim.callexec.declaration_reference_eval { CrefReading, cref_assemble, cref_call_carries_declaration, cref_executes_to, cref_reading_of_outcome, cref_the_call_to }
+import v2.std.diagnostic { Accepted, Outcome, Rejected, diagnostics_fatal_reason }
+import v2.std.node { Arrow, Atom, Symbol, Authored, ConstantMemberEdge, Conj, Edge, Node, Positional, TypeNode, core_edge, edge_is_core, node_subtree_nodes }
+import v2.std.node_query { arrow_constant_member_codomain }
+import std.occurrence_identity { OccurrenceSynthetic }
+import std.optional { Absent, Present }
+import std.algebra { list_append }
+import std.types { List }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// SUBJECT: a reference to a module-level `data` row USES ITS VALUE. Body lowering realizes `data x: T = e`
+// as the nullary Arrow a `fn x() -> T` lowers to, and marks it (v2.std.node ConstantMemberEdge, written by
+// v2.compiler.body_lowering_fold body_lower_constant_member_arrow); v2.compiler.infer types a reference to a
+// marked Arrow at its declared codomain (infer_reference_value_type) and v2.compiler.eval applies it
+// (eval_constant_member_body), both through the one reader v2.std.node_query arrow_constant_member_codomain.
+// BOUNDARY: source text in, through the production assembly route, then infer (and eval for the
+// execution row) -- except the marker-reader rows, whose input is supplied (see their header).
+//
+// RED ON THE BASE: before the marker, a bare `k` over `data k: Int` was typed as the function () -> Int, so
+// `data j: Int = k` refused arrow_body_does_not_inhabit_declared_return, `fn consumer() -> Int { k }` refused
+// the same way, and eval refused the reference with eval_rejected_runtime_binding_lookup_miss.
+
+// THE REAL PATH, ONCE: one source carrying every accepted case, assembled once and read whole by the rows
+// below, so the floor fills it once (v2.workflow.floor_pure_producer_share). The smallest source that holds
+// the subject: one constant, a fn whose body is a reference to it, and a call to that fn.
+data drv_source: String = "module p\n\ndata k: Int = 7\n\nfn callee() -> Int {\n  k\n}\n\nfn consumer() -> Int {\n  callee()\n}\n"
+
+// ONE ASSEMBLY, read whole by every real-path row below (the infer rows, the marker row and the eval row),
+// so the floor fills it once. The call-execution route's assembly is used because the eval row needs
+// exactly the tree that route evaluates, and this source needs no peer modules.
+fn drv_assembled() -> Outcome<ResolvedTree> {
+  cref_assemble(src: drv_source)
+}
+
+// THE ONE INFERENCE of that assembly, read by row (1) only: an inferred tree is not a portable served value,
+// so a second reader would pay it again rather than share it.
+fn drv_inferred() -> Outcome<InferredTree> {
+  match drv_assembled() {
+    Rejected { diagnostics: d } => Rejected { diagnostics: d }
+    Accepted { value: tree, diagnostics: _ } => infer(tree: tree)
+  }
+}
+
+fn drv_reason(o: Outcome<InferredTree>) -> Symbol {
+  match o {
+    Rejected { diagnostics: d } => diagnostics_fatal_reason(d: d)
+    Accepted { value: _, diagnostics: _ } => ^accepted
+  }
+}
+
+// The call to `callee`, evaluated over the shared inference: the call-execution route's own locator and
+// reader (cref_the_call_to, cref_reading_of_outcome), so this row reads the same vocabulary those rows do.
+fn drv_eval_reading(o: Outcome<InferredTree>) -> CrefReading {
+  let unfound = CrefReading { call_found: false, declaration_carried: false, executed: false, int_result: Absent, result_bytes: Absent }
+  match o {
+    Rejected { diagnostics: _ } => unfound
+    Accepted { value: inferred, diagnostics: _ } =>
+      match cref_the_call_to(root: inferred.root, name: ^callee) {
+        Absent => unfound
+        Present { value: call } =>
+          cref_reading_of_outcome(
+            declaration_carried: cref_call_carries_declaration(inferred: inferred, call: call),
+            outcome: eval(tree: inferred, interpretation: v2_evaluator_interpretation(), inputs: inputs_root_only(root: call))
+          )
+      }
+  }
+}
+
+// (1) THE ONE REAL-PATH ROW: infer accepts a data reference at its declared position (a constant as a fn
+// body, at the fn's declared return), AND eval agrees -- the call to `callee` evaluates its body `k` to the
+// constant's VALUE 7, not a closure and not the binding-miss refusal it took before. ONE ROW BECAUSE BOTH
+// ASSERTIONS READ ONE INFERENCE and an inferred tree is not a portable served value
+// (ServeCacheValueNotPortable), so two rows would pay the inference twice for no coverage the one row lacks.
+test fn drv_a_data_reference_is_typed_at_its_declared_type_and_evaluates_to_its_value() -> Bool {
+  let o = drv_inferred()
+  drv_reason(o: o) == ^accepted && cref_executes_to(r: drv_eval_reading(o: o), n: 7)
+}
+
+// (2) THE MARKER IS PRODUCED, NOT ONLY SUPPLIED: lowering the real source yields exactly the data Arrow
+// marked (k) and leaves the nullary fn Arrows (callee, consumer) unmarked -- so a nullary fn is not
+// mistaken for a constant, which is the meaning fork a marker-free "type every nullary Arrow by its
+// codomain" rule would have been.
+fn drv_marked_arrow_count(o: Outcome<ResolvedTree>) -> Int {
+  match o {
+    Rejected { diagnostics: _ } => 0 - 1
+    Accepted { value: tree, diagnostics: _ } =>
+      fold(node_subtree_nodes(root: tree.root), init: 0, f: fn(acc, n) {
+        match arrow_constant_member_codomain(arrow: n) {
+          Present { value: _ } => acc + 1
+          Absent => acc
+        }
+      })
+  }
+}
+
+fn drv_unmarked_arrow_count(o: Outcome<ResolvedTree>) -> Int {
+  match o {
+    Rejected { diagnostics: _ } => 0 - 1
+    Accepted { value: tree, diagnostics: _ } =>
+      fold(node_subtree_nodes(root: tree.root), init: 0, f: fn(acc, n) {
+        match n.kind {
+          TypeNode { connective: Arrow } =>
+            match arrow_constant_member_codomain(arrow: n) {
+              Present { value: _ } => acc
+              Absent => acc + 1
+            }
+          _ => acc
+        }
+      })
+  }
+}
+
+test fn drv_lowering_marks_the_data_arrow_and_not_the_two_fn_arrows() -> Bool {
+  let o = drv_assembled()
+  drv_marked_arrow_count(o: o) == 1 && drv_unmarked_arrow_count(o: o) == 2
+}
+
+// (4) TYPING THE REFERENCE AT T IS NOT ADMITTING IT ANYWHERE: a reference to a marked Arrow is typed at
+// EXACTLY its declared codomain (v2.compiler.infer infer_reference_value_type), so an Int constant presents
+// Int to the judge and an Int-at-String position refuses there by the judge's own existing rule. The input
+// is supplied (DESIGN section 3: one interface); the real path that types references through it is row (1).
+test fn drv_a_marked_reference_is_typed_at_exactly_its_codomain() -> Bool {
+  infer_reference_value_type(callable: drv_nullary_arrow(extra: [drv_marker()])) == drv_int()
+}
+
+test fn drv_an_unmarked_callable_is_typed_as_itself() -> Bool {
+  let f = drv_nullary_arrow(extra: [])
+  infer_reference_value_type(callable: f) == f
+}
+
+// THE MARKER READER, SUPPLIED (DESIGN section 3: a witness discriminates at one interface). Its subject is
+// v2.std.node_query arrow_constant_member_codomain alone: a marked nullary Arrow answers its codomain, the
+// SAME Arrow unmarked answers Absent, and a non-Arrow carrying the marker answers Absent. The real path
+// that produces the marker is row (2).
+fn drv_int() -> Node { Node { kind: TypeNode { connective: Atom { identity: ^Int } }, children: [], occurrence_id: OccurrenceSynthetic } }
+fn drv_empty() -> Node { Node { kind: TypeNode { connective: Conj }, children: [], occurrence_id: OccurrenceSynthetic } }
+fn drv_marker() -> Edge { core_edge(marker: ConstantMemberEdge, target: drv_empty()) }
+
+fn drv_nullary_arrow(extra: List<Edge>) -> Node {
+  Node {
+    kind: TypeNode { connective: Arrow },
+    children: list_append(
+      left: [
+        Edge { label: Positional, target: drv_empty() },
+        Edge { label: Positional, target: drv_int() },
+        Edge { label: Positional, target: drv_int() }
+      ],
+      right: extra
+    ),
+    occurrence_id: OccurrenceSynthetic
+  }
+}
+
+test fn drv_a_marked_nullary_arrow_answers_its_codomain() -> Bool {
+  match arrow_constant_member_codomain(arrow: drv_nullary_arrow(extra: [drv_marker()])) {
+    Present { value: t } => t == drv_int()
+    Absent => false
+  }
+}
+
+test fn drv_an_unmarked_nullary_arrow_denotes_its_function() -> Bool {
+  match arrow_constant_member_codomain(arrow: drv_nullary_arrow(extra: [])) {
+    Present { value: _ } => false
+    Absent => true
+  }
+}
+
+test fn drv_a_marked_non_arrow_is_not_a_constant() -> Bool {
+  match arrow_constant_member_codomain(arrow: Node { kind: TypeNode { connective: Conj }, children: [drv_marker()], occurrence_id: OccurrenceSynthetic }) {
+    Present { value: _ } => false
+    Absent => true
+  }
+}
diff --git a/src/v2/test/claim/compiler/declared_return_result_test.dag b/src/v2/test/claim/compiler/declared_return_result_test.dag
new file mode 100644
index 00000000000..39a723c99eb
--- /dev/null
+++ b/src/v2/test/claim/compiler/declared_return_result_test.dag
@@ -0,0 +1,195 @@
+module v2.test.claim.compiler.declared_return_result
+
+import v2.test.claim.compiler.infer_fold_member_instance { fmi_assemble, fmi_infer_tree, fmi_reason }
+import v2.compiler.infer {
+  infer_application_result_type,
+  infer_arrow_declared_return_type,
+  infer_projected_field_type,
+  infer_projection_receiver_of_type,
+  infer_receiver_arity_mismatch_diagnostic,
+  infer_type_equal_ignoring_provenance,
+  ProjectionReceiver,
+  ReceiverArityMismatch,
+  ReceiverDeclarationUnavailable,
+  ReceiverPayload,
+  ReceiverTypeNotADeclaration,
+  ReceiverTypeUnderived
+}
+import v2.std.qualified_name { declaration_reference_node }
+import v2.std.diagnostic { Accepted, Rejected }
+import v2.std.inhabitance { TypeVariableInstance }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import v2.std.node { Arrow, Atom, Authored, Conj, Edge, Instantiation, Node, OccurrenceSynthetic, Positional, Symbol, TypeNode, node_synthetic }
+import std.optional { Absent, Optional, Present }
+import v2.std.algebra { length, list_map }
+import std.algebra { Cons, list_snoc_item }
+import std.types { List, String }
+import v2.std.symbol_index { SymbolIndex, empty_symbol_index, symbol_index_insert, symbol_index_mark_declared_type_params }
+import v2.std.type_binder { type_binder_set_children, type_params_edge }
+import std.types { Bool }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// SUBJECT: a call's result type when its callee declares a non-kernel return
+// (v2.compiler.infer infer_application_result_type), and a field read off an instantiated generic
+// record (infer_projected_field_type).
+//
+// WITNESS SHAPE (DESIGN section 3, a witness discriminates at one interface): five claims SUPPLY the
+// callee's arrow and the call's instances at the result-type interface, built here, so each judges
+// only its own case and pays no assembly. Each asserts where the replaced reader disagrees:
+// infer_arrow_declared_return_type, the only reader before this change, answers Absent for a
+// declared return. ONE claim runs the real path, source through the production assembly route into
+// infer, and asserts the ROUTE: a generic declared return, instantiated at the call, projected, and
+// judged at a declared parameter, refuses for a reason only that whole route produces.
+
+fn drr_atom(sym: Symbol) -> Node {
+  node_synthetic(kind: TypeNode { connective: Atom { identity: sym } }, children: [])
+}
+
+fn drr_positional(target: Node) -> Edge {
+  Edge { label: Positional, target: target }
+}
+
+// fn <params>(<no domain>) -> ret
+fn drr_arrow(params: List<Symbol>, ret: Node) -> Node {
+  let domain = node_synthetic(kind: TypeNode { connective: Conj }, children: [])
+  let positional = [drr_positional(target: domain), drr_positional(target: ret)]
+  if length(xs: params) == 0 {
+    node_synthetic(kind: TypeNode { connective: Arrow }, children: positional)
+  } else {
+    let binders = drr_binder_set(params: params)
+    node_synthetic(kind: TypeNode { connective: Arrow }, children: list_snoc_item(xs: positional, item: type_params_edge(conj: binders)))
+  }
+}
+
+// A binder set built through the one mint (v2.std.type_binder type_binder_set_children), so it carries
+// its declared-order edge and conforms, as a lowered signature's does.
+fn drr_binder_set(params: List<Symbol>) -> Node {
+  let edges = list_map(xs: params, f: fn(p) { Edge { label: Authored { name: p }, target: drr_atom(sym: p) } })
+  let source = drr_atom(sym: ^drr_binder_source)
+  node_synthetic(kind: TypeNode { connective: Conj }, children: type_binder_set_children(binders: edges, source: source))
+}
+
+fn drr_box_of(arg: Node) -> Node {
+  node_synthetic(kind: TypeNode { connective: Instantiation }, children: [drr_positional(target: drr_atom(sym: ^drr_box)), drr_positional(target: arg)])
+}
+
+fn drr_present_equals(o: Optional<Node>, expected: Node) -> Bool {
+  match o {
+    Absent => false
+    Present { value: v } => infer_type_equal_ignoring_provenance(a: v, b: expected)
+  }
+}
+
+fn drr_is_absent(o: Optional<Node>) -> Bool {
+  match o {
+    Absent => true
+    Present { value: _ } => false
+  }
+}
+
+// DECLARED RETURN: `fn mk() -> Tally` types its call as Tally. The replaced reader answered Absent.
+test fn drr_a_declared_return_is_the_call_result() -> Bool {
+  let arrow = drr_arrow(params: [], ret: drr_atom(sym: ^drr_tally))
+  drr_is_absent(o: infer_arrow_declared_return_type(arrow: arrow))
+    && drr_present_equals(o: infer_application_result_type(arrow: arrow, instances: [], declarations: empty_symbol_index()), expected: drr_atom(sym: ^drr_tally))
+}
+
+// KERNEL FIRST: a kernel return answers exactly what the replaced reader answers.
+test fn drr_a_kernel_return_is_unchanged() -> Bool {
+  let arrow = drr_arrow(params: [], ret: drr_atom(sym: ^dag_binding_type_int))
+  match infer_arrow_declared_return_type(arrow: arrow) {
+    Absent => false
+    Present { value: kernel } =>
+      drr_present_equals(o: infer_application_result_type(arrow: arrow, instances: [], declarations: empty_symbol_index()), expected: kernel)
+  }
+}
+
+// INSTANTIATED: `fn boxed<T>(..) -> Box<T>` called with T bound to Tally types as Box<Tally>.
+test fn drr_a_generic_return_is_instantiated_at_the_call() -> Bool {
+  let arrow = drr_arrow(params: [^drr_t], ret: drr_box_of(arg: drr_atom(sym: ^drr_t)))
+  let instances = [TypeVariableInstance { binder: ^drr_t, instance: drr_atom(sym: ^drr_tally) }]
+  drr_is_absent(o: infer_arrow_declared_return_type(arrow: arrow))
+    && drr_present_equals(o: infer_application_result_type(arrow: arrow, instances: instances, declarations: empty_symbol_index()), expected: drr_box_of(arg: drr_atom(sym: ^drr_tally)))
+}
+
+// FRONTIER: the same callee with T bound by no argument stays NOT derived -- never typed as Box<T>.
+test fn drr_a_return_mentioning_an_unbound_type_parameter_is_not_derived() -> Bool {
+  let arrow = drr_arrow(params: [^drr_t], ret: drr_box_of(arg: drr_atom(sym: ^drr_t)))
+  drr_is_absent(o: infer_application_result_type(arrow: arrow, instances: [], declarations: empty_symbol_index()))
+}
+
+// PROJECTED FIELD: `item: T` read off a Box<Tally> receiver is Tally (the replaced reader kept T as
+// written); a receiver that binds nothing keeps the field's declared type.
+test fn drr_a_generic_record_field_projects_at_its_instantiation() -> Bool {
+  let bound = [TypeVariableInstance { binder: ^drr_t, instance: drr_atom(sym: ^drr_tally) }]
+  infer_type_equal_ignoring_provenance(a: infer_projected_field_type(field_type: drr_atom(sym: ^drr_t), instances: bound), b: drr_atom(sym: ^drr_tally))
+    && infer_type_equal_ignoring_provenance(a: infer_projected_field_type(field_type: drr_atom(sym: ^drr_t), instances: []), b: drr_atom(sym: ^drr_t))
+}
+
+// WRONG TYPE-ARGUMENT COUNT: Box declares one type parameter, so a receiver typed Box<Tally, Tally>
+// has no instantiation to read a field at and refuses as an arity mismatch; Box<Tally> reads its payload.
+fn drr_box_path() -> List<Symbol> {
+  [^drr_p, ^drr_box]
+}
+
+fn drr_box_index() -> SymbolIndex {
+  let payload = node_synthetic(kind: TypeNode { connective: Conj }, children: [Edge { label: Authored { name: ^item }, target: drr_atom(sym: ^drr_t) }])
+  symbol_index_mark_declared_type_params(
+    index: symbol_index_insert(index: empty_symbol_index(), qualified_path: drr_box_path(), resolved: payload),
+    qualified_path: drr_box_path(),
+    params: drr_binder_set(params: [^drr_t])
+  )
+}
+
+fn drr_box_applied(args: List<Node>) -> Node {
+  let head = declaration_reference_node(qn: drr_box_path(), occurrence_id: OccurrenceSynthetic)
+  node_synthetic(kind: TypeNode { connective: Instantiation }, children: list_map(xs: Cons { head: head, tail: args }, f: fn(n) { drr_positional(target: n) }))
+}
+
+fn drr_is_arity_mismatch(r: ProjectionReceiver) -> Bool {
+  match r {
+    ReceiverArityMismatch => true
+    ReceiverPayload { payload: _, instances: _ } => false
+    ReceiverTypeNotADeclaration => false
+    ReceiverDeclarationUnavailable { path: _ } => false
+    ReceiverTypeUnderived => false
+  }
+}
+
+fn drr_is_payload(r: ProjectionReceiver) -> Bool {
+  match r {
+    ReceiverPayload { payload: _, instances: _ } => true
+    ReceiverArityMismatch => false
+    ReceiverTypeNotADeclaration => false
+    ReceiverDeclarationUnavailable { path: _ } => false
+    ReceiverTypeUnderived => false
+  }
+}
+
+test fn drr_a_wrong_type_argument_count_at_a_generic_record_projection_refuses() -> Bool {
+  let tally = drr_atom(sym: ^drr_tally)
+  drr_is_arity_mismatch(r: infer_projection_receiver_of_type(receiver_type: drr_box_applied(args: [tally, tally]), declarations: drr_box_index()))
+    && drr_is_payload(r: infer_projection_receiver_of_type(receiver_type: drr_box_applied(args: [tally]), declarations: drr_box_index()))
+    && infer_receiver_arity_mismatch_diagnostic(node: tally).reason == ^infer_reason_projection_receiver_type_arity_mismatch
+}
+
+// THE ONE REAL-PATH CLAIM, ASSERTING THE ROUTE. `boxed(1).item` at a Bool parameter refuses as an
+// argument mismatch only if the call's generic declared return is derived (Box<Int>), the field is
+// projected at that instantiation (Int), and the projection is judged at the declared Bool. Before
+// this change the call stayed underived and the program was ACCEPTED.
+data drr_route_source: String = "module p\n\ntype Box<T> {\n  item: T\n}\n\nfn boxed<T>(x: T) -> Box<T> {\n  Box { item: x }\n}\n\nfn wants_bool(b: Bool) -> Int {\n  0\n}\n\nfn k() -> Int {\n  wants_bool(boxed(1).item)\n}\n"
+
+// The route's verdict is one nullary producer, assembled AND inferred once, so the floor fills the
+// whole real path as this claim's shared fill (its single-claim fill debt) and the claim itself only
+// compares the reason.
+fn drr_route_reason() -> Symbol {
+  match fmi_assemble(src: drr_route_source) {
+    Rejected { diagnostics: _ } => ^drr_assembly_refused
+    Accepted { value: tree, diagnostics: _ } => fmi_reason(o: fmi_infer_tree(tree: tree))
+  }
+}
+
+test fn drr_the_real_route_judges_a_projected_generic_call_result() -> Bool {
+  drr_route_reason() == ^application_argument_does_not_inhabit
+}
diff --git a/src/v2/test/claim/compiler/generic_closure_outcome_construct_probe_test.dag b/src/v2/test/claim/compiler/generic_closure_outcome_construct_probe_test.dag
new file mode 100644
index 00000000000..a87b764c309
--- /dev/null
+++ b/src/v2/test/claim/compiler/generic_closure_outcome_construct_probe_test.dag
@@ -0,0 +1,128 @@
+module v2.test.claim.compiler.generic_closure_outcome_construct_probe
+
+import v2.compiler.infer {
+  infer,
+  infer_kernel_value_type_optional,
+  infer_type_equal_ignoring_provenance
+}
+import v2.compiler.name_resolve {
+  Admission,
+  ResolutionSubject,
+  resolution_context,
+  resolve_in_context
+}
+import v2.compiler.normalized_tree { NormalizedTree }
+import v2.compiler.program_assembly { module_roots_from_source_root_ingest }
+import v2.compiler.resolve { ResolvedTree }
+import v2.compiler.source_authority { SourceRootIngest }
+import v2.extdeps.languages.dag { dag_language_model }
+import v2.std.cross_tree.resolution { source_root_index_empty }
+import v2.std.diagnostic { Accepted, None, Outcome, Rejected, Some, diagnostics_fatal_reason }
+import v2.std.integer { integer_int_type_node }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import std.occurrence_identity { OccurrenceSynthetic }
+import v2.std.node { Atom, Node, Symbol, TypeNode, node_synthetic }
+import std.optional { Absent, Present }
+import v2.std.qualified_name { declaration_reference_node, qualified_name_from_dotted_string }
+import v2.std.resolution_policy { default_name_resolution_policy }
+import v2.std.text { String }
+import std.algebra { Empty, FreeMonoid }
+import v2.test.claim.compiler.infer_record_construct_field_inhabitance_witness_test {
+  rcf_member_accepted_and_decided,
+  rcf_read
+}
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// SUBJECT: infer_declared_type_obligation's kernel-value join (infer_kernel_value_type_optional, applied at
+// every step of infer_type_alias_normalized). A position declared with the kernel Int (dag_binding_type_int)
+// and one declared with the corpus v2.std.integer.Int (type Int = GroupCompletion<Nat>) are one value type. The
+// join keys the kernel declaration roster (full path) and dag_binding_denotation, never a last-segment Int.
+//
+// SUPPLIED claims judge the join at its own interface. ONE claim runs the real ingest -> resolve -> infer route
+// (the alias claim). The negative side of the join is
+// supplied (gbo_a_bool_name_is_not_the_kernel_int_holds), not re-run end to end.
+//
+// DECLARED FRONTIER, NOT CLAIMED HERE: generic-variant constructs undecided. A direct generic-variant construct
+// (Acc { value: 1, n: 0 } at Out<Int>) is not accepted-and-decided on this base, with or without the join (measured
+// at 41afbbbb, BuildBuddy 36e48268). Owner: gunbc#13558 (payload binders over Outcome<T> via #13210's formal-payload
+// obligation), which carries the claim that turns it green.
+
+data gbo_integer_stub_source: String = "module v2.std.integer\n\ntype Nat = Zero | One\n\ntype Int = Nat\n"
+
+data gbo_alias_source: String = "module v2.test.gbo_alias\n\nimport v2.std.integer { Int }\n\ntype Alias = v2.std.integer.Int\n\nfn one() -> Alias {\n  1\n}\n"
+
+data gbo_ingest: SourceRootIngest = [
+  rcf_read(source: gbo_integer_stub_source, id: ^gbo_integer_stub_read, unit: ^gbo_integer_stub_cu, path: "src/v2/test/fixture/gbo/integer.dag"),
+  rcf_read(source: gbo_alias_source, id: ^gbo_alias_read, unit: ^gbo_alias_cu, path: "src/v2/test/fixture/gbo/alias.dag")
+]
+
+fn gbo_fixture_normalized() -> Outcome<FreeMonoid<NormalizedTree>> {
+  module_roots_from_source_root_ingest(ingest: gbo_ingest, lm: dag_language_model())
+}
+
+fn gbo_resolve_subject(subject: String) -> Outcome<ResolvedTree> {
+  match gbo_fixture_normalized() {
+    Rejected { diagnostics: d } => Rejected { diagnostics: d }
+    Accepted { value: roots, diagnostics: _ } =>
+      resolve_in_context(
+        context: resolution_context(lm: dag_language_model(), roots: roots, index: source_root_index_empty(), active_roots: Empty, policy: default_name_resolution_policy()),
+        admission: Admission {
+          subject: ResolutionSubject { name: qualified_name_from_dotted_string(dotted: subject) },
+          imports: Empty
+        }
+      ).resolved
+  }
+}
+
+fn gbo_resolved_alias() -> Outcome<ResolvedTree> { gbo_resolve_subject(subject: "v2.test.gbo_alias") }
+
+fn gbo_atom(id: Symbol) -> Node {
+  node_synthetic(kind: TypeNode { connective: Atom { identity: id } }, children: [])
+}
+
+fn gbo_is_kernel_int(t: Node) -> Bool {
+  match infer_kernel_value_type_optional(t: t) {
+    Absent => false
+    Present { value: k } => infer_type_equal_ignoring_provenance(a: k, b: integer_int_type_node())
+  }
+}
+
+test fn gbo_an_int_spelling_atom_is_not_the_kernel_int_holds() -> Bool {
+  !gbo_is_kernel_int(t: gbo_atom(id: ^Int))
+}
+
+test fn gbo_a_module_int_declaration_is_not_the_kernel_int_holds() -> Bool {
+  !gbo_is_kernel_int(
+    t: declaration_reference_node(
+      qn: qualified_name_from_dotted_string(dotted: "v2.test.gbo_shadow.Int"),
+      occurrence_id: OccurrenceSynthetic
+    )
+  )
+}
+
+test fn gbo_the_integer_int_declaration_is_the_kernel_int_holds() -> Bool {
+  gbo_is_kernel_int(
+    t: declaration_reference_node(
+      qn: qualified_name_from_dotted_string(dotted: "v2.std.integer.Int"),
+      occurrence_id: OccurrenceSynthetic
+    )
+  )
+}
+
+test fn gbo_a_kernel_int_atom_is_the_kernel_int_holds() -> Bool {
+  gbo_is_kernel_int(t: gbo_atom(id: ^dag_binding_type_int))
+}
+
+test fn gbo_a_bool_name_is_not_the_kernel_int_holds() -> Bool {
+  !gbo_is_kernel_int(t: gbo_atom(id: ^Bool))
+}
+
+// THE ROUTE: a kernel Int literal returned at a declared `Alias` of the corpus Int (`fn one() -> Alias { 1 }`),
+// on the real ingest -> resolve -> infer path, ACCEPTED AND DECIDED. The literal is the kernel atom; the declared
+// side reaches the kernel atom only through the join, and only if recognition re-enters after the alias step. So it
+// goes red both when the join is deleted (Alias unfolds to its right-hand side) and when recognition happens only at
+// the input -- the integration and the regression in one claim (BuildBuddy 50c58a76 and 2002ea86).
+test fn gbo_a_kernel_literal_inhabits_an_alias_of_the_corpus_int_holds() -> Bool {
+  rcf_member_accepted_and_decided(resolved: gbo_resolved_alias(), member: ^one)
+}
diff --git a/src/v2/test/claim/compiler/infer_fold_member_instance_test.dag b/src/v2/test/claim/compiler/infer_fold_member_instance_test.dag
index a123a758a94..288fae16854 100644
--- a/src/v2/test/claim/compiler/infer_fold_member_instance_test.dag
+++ b/src/v2/test/claim/compiler/infer_fold_member_instance_test.dag
@@ -216,7 +216,8 @@ fn fmi_infer_with_member_formal_authored(tree: ResolvedTree) -> Outcome<Bool> {
                     symbol_index: tree.symbol_index,
                     resolved_declarations: tree.resolved_declarations,
                     lexical_bindings: tree.lexical_bindings,
-                    unavailable_providers: tree.unavailable_providers
+                    unavailable_providers: tree.unavailable_providers,
+    member_kinds: tree.member_kinds
                   }) {
                     Rejected { diagnostics: d } => Rejected { diagnostics: d }
                     Accepted { value: _, diagnostics: d } => Accepted { value: true, diagnostics: d }
diff --git a/src/v2/test/claim/compiler/infer_record_construct_field_inhabitance_witness_test.dag b/src/v2/test/claim/compiler/infer_record_construct_field_inhabitance_witness_test.dag
index d9c43a793a3..18332fd701d 100644
--- a/src/v2/test/claim/compiler/infer_record_construct_field_inhabitance_witness_test.dag
+++ b/src/v2/test/claim/compiler/infer_record_construct_field_inhabitance_witness_test.dag
@@ -53,11 +53,11 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // can be satisfied by a check that refuses every construct, and no acceptance by one that judges
 // nothing: the accepted module is also asserted DECIDED (no counted obligation at its constructs).
 //
-// WHAT IS NOT CLAIMED. A record declared in ANOTHER module has its field SET checked and its field
-// VALUES counted, not judged: v2.compiler.resolve ResolvedTree resolved_declarations holds the
-// subject module's declarations with resolved bodies, and no other module's. rcf_far_value pins that state as it is -- accepted, with
-// a counted UndecidableFormalUnresolved at the value -- so it flips when infer can read a resolved
-// declaration across modules (the row's trigger), and is then rewritten as a refusal.
+// CROSS-MODULE FIELD VALUES ARE JUDGED TOO. A record declared in another module has its field SET
+// checked (missing still refuses) and its field VALUES judged: `n: true` against `RcfFar.n: Int`
+// refuses as `record_field_value_does_not_inhabit`, the same reason as a same-module Int field.
+// The former pin (`UndecidableFormalUnresolved` on an Accepted construct) went red when that
+// trigger landed.
 data rcf_provider_source: String = "module v2.test.rcfp\n\ntype RcfFar {\n  n: Int\n  m: Int\n}\n"
 
 data rcf_bad_source: String = "module v2.test.rcf_bad\n\ntype ArB {\n  n: Int\n  m: Int\n}\n\ndata ar_bad: ArB = ArB { n: true, m: 3 }\n"
@@ -299,7 +299,7 @@ fn rcf_member_accepted_and_decided(resolved: Outcome<ResolvedTree>, member: Symb
       match rcf_member_arrow(root: tree.root, name: member) {
         Absent => false
         Present { value: arrow } =>
-          match infer(tree: ResolvedTree { root: arrow, symbol_index: tree.symbol_index, resolved_declarations: tree.resolved_declarations, lexical_bindings: tree.lexical_bindings, unavailable_providers: tree.unavailable_providers }) {
+          match infer(tree: ResolvedTree { root: arrow, symbol_index: tree.symbol_index, resolved_declarations: tree.resolved_declarations, lexical_bindings: tree.lexical_bindings, unavailable_providers: tree.unavailable_providers, member_kinds: tree.member_kinds }) {
             Rejected { diagnostics: _ } => false
             Accepted { value: _, diagnostics: ds } =>
               !diagnostics_has_reason(d: ds, reason: ^inhabitance_undecidable_formal_unresolved)
@@ -389,15 +389,10 @@ test fn rcf_a_cross_module_records_missing_field_refuses_holds() -> Bool {
   rcf_refuses_with(resolved: rcf_resolved_far_missing(), reason: ^record_construct_field_missing)
 }
 
-// Its field VALUES are counted, not judged: the specimen's mismatch against a record declared in
-// another module is accepted with a counted UndecidableFormalUnresolved. This claim goes red when
-// infer reads a resolved declaration across modules, and is then rewritten to assert the refusal.
-test fn rcf_a_cross_module_records_field_value_is_counted_not_judged_holds() -> Bool {
-  match rcf_verdict(resolved: rcf_resolved_far_value()) {
-    RcfInferAccepted { diagnostics: ds } => diagnostics_has_reason(d: ds, reason: ^inhabitance_undecidable_formal_unresolved)
-    RcfInferRefused { diagnostics: _ } => false
-    RcfResolveRefused => false
-  }
+// Its field VALUES are judged: `n: true` against a record declared in another module refuses at
+// the value, same class as the same-module Int specimen.
+test fn rcf_a_cross_module_records_field_value_of_the_wrong_type_refuses_holds() -> Bool {
+  rcf_refuses_with(resolved: rcf_resolved_far_value(), reason: ^record_field_value_does_not_inhabit)
 }
 
 // A PATTERN IS NOT A CONSTRUCTION. `ArB { n: x }` in a match arm names one of ArB's two fields, and
diff --git a/src/v2/test/claim/compiler/kernel_value_type_roster_witness_test.dag b/src/v2/test/claim/compiler/kernel_value_type_roster_witness_test.dag
index 8df7137c1ea..161eb4b8994 100644
--- a/src/v2/test/claim/compiler/kernel_value_type_roster_witness_test.dag
+++ b/src/v2/test/claim/compiler/kernel_value_type_roster_witness_test.dag
@@ -200,7 +200,7 @@ test fn kvr_a_named_calls_bool_formal_holding_an_int_refuses_holds() -> Bool {
       match rcf_member_arrow(root: tree.root, name: ^kvr_g) {
         Absent => false
         Present { value: arrow } =>
-          match infer(tree: ResolvedTree { root: arrow, symbol_index: tree.symbol_index, resolved_declarations: tree.resolved_declarations, lexical_bindings: tree.lexical_bindings, unavailable_providers: tree.unavailable_providers }) {
+          match infer(tree: ResolvedTree { root: arrow, symbol_index: tree.symbol_index, resolved_declarations: tree.resolved_declarations, lexical_bindings: tree.lexical_bindings, unavailable_providers: tree.unavailable_providers, member_kinds: tree.member_kinds }) {
             Rejected { diagnostics: d } => diagnostics_fatal_reason(d: d) == ^application_argument_does_not_inhabit
             Accepted { value: _, diagnostics: _ } => false
           }
diff --git a/src/v2/test/claim/compiler/literal_elaboration_test.dag b/src/v2/test/claim/compiler/literal_elaboration_test.dag
new file mode 100644
index 00000000000..627ec0340c3
--- /dev/null
+++ b/src/v2/test/claim/compiler/literal_elaboration_test.dag
@@ -0,0 +1,231 @@
+module v2.test.claim.compiler.literal_elaboration
+
+import std.literal_elaboration { KernelGroundingAbsent, KernelGroundingAmbiguous, KernelGroundingFound, KernelIntLiteral, kernel_grounding_admits, kernel_grounding_for }
+import gunbc.structural_realization_bindings { kernel_grounding_rows }
+import std.decl_ref { decl_ref }
+import v2.compiler.resolve { ResolvedTree }
+import v2.compiler.infer { InferLiteralElaborationRefused, InferLiteralElaboratesTo, InferLiteralNotElaborated, infer, infer_application_callee_use, infer_literal_elaborates_at }
+import v2.compiler.inferred_tree { InferredTree }
+import v2.compiler.eval { eval, inputs_root_only }
+import v2.extdeps.runtimes.v2_evaluator { v2_eval_bool_runtime_value, v2_evaluator_interpretation }
+import v2.compiler.name_resolve { Admission, ResolutionSubject }
+import v2.compiler.program_assembly { assemble_program_from_ingest }
+import v2.compiler.source_authority { DagSourceReadWitness }
+import v2.extdeps.languages.dag { dag_binding_denotation, dag_int_literal_node_from_lexeme, dag_language_model, dag_string_literal_node }
+import extdeps.communication.medium { Lossless, Medium }
+import std.algebra { Cons, Empty, list_append }
+import v2.std.cross_tree.import_model { V2Tree }
+import v2.std.artifact { Artifact, SourceFile }
+import v2.std.diagnostic { Accepted, Outcome, Rejected, diagnostics_fatal_reason }
+import v2.std.node { Atom, Edge, Node, NodeFold, Positional, Symbol, TypeNode, fold_node, node_synthetic }
+import v2.std.compilers.body_lowering { lower_unary_prefix }
+import v2.std.symbol_index { empty_symbol_index }
+import v2.std.qualified_name { declaration_reference_node, qualified_name_from_dotted_string }
+import std.occurrence_identity { OccurrenceSynthetic }
+import std.optional { Absent, Optional, Present, optional_absent, optional_present }
+import v2.std.runtime { RuntimeValue }
+import v2.std.qualified_name { declaration_reference_path_optional }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import std.types { Bool, List }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// SUBJECT: v2 infer elaborates an integer literal at an expected type through the declared tables
+// (v2.compiler.infer infer_literal_elaborates_at) at a declared position. std.nat Nat is KERNEL-GROUNDED
+// (gunbc.structural_realization_bindings kernel_grounding_rows, declared range min 0): a literal at Nat is its own
+// value when std.literal_elaboration kernel_grounding_admits says so, and `-1` refuses from that range
+// (calm-boar-904, ruling A on review 77219). Nat has no literal homomorphism row.
+//
+// SHAPE, PER DESIGN SECTION 3's WITNESS RULE (sharp-raven-357): exactly ONE claim runs the real route
+// (lel_route_runs_on_the_real_path: one module, assembled with a std.nat peer, inferred, and two calls evaluated on
+// the v2 eval route). Every other claim supplies a literal node and an expected type to infer_literal_elaborates_at,
+// the one interface under test. DELETING THE ROUTE REDS THE REAL-PATH CLAIM: remove std.nat Nat's row from
+// kernel_grounding_rows and `g(n: 0)` at Nat is refused.
+
+data lel_artifact: Artifact = Artifact { kind: SourceFile, id: ^literal_elaboration_p_artifact, file_path: "src/v2/pilot/literal_elaboration_p.dag" }
+data lel_nat_artifact: Artifact = Artifact { kind: SourceFile, id: ^literal_elaboration_nat_artifact, file_path: "src/v2/pilot/literal_elaboration_nat.dag" }
+
+data lel_nat_peer: String = "module std.nat\n\ntype Nat\n  = Zero\n  | Succ { prev: Nat }\n"
+
+fn lel_source(src: String, artifact: Artifact, cu: Symbol) -> DagSourceReadWitness {
+  DagSourceReadWitness { source: Medium { carried: src, fidelity: Lossless }, artifact: artifact, compilation_unit: cu, source_root: V2Tree }
+}
+
+fn lel_assemble(src: String) -> Outcome<ResolvedTree> {
+  assemble_program_from_ingest(
+    ingest: Cons {
+      head: lel_source(src: src, artifact: lel_artifact, cu: ^literal_elaboration_p_cu),
+      tail: Cons { head: lel_source(src: lel_nat_peer, artifact: lel_nat_artifact, cu: ^literal_elaboration_nat_cu), tail: Empty }
+    },
+    admission: Admission { subject: ResolutionSubject { name: Cons { head: ^p, tail: Empty } }, imports: Empty },
+    lm: dag_language_model()
+  )
+}
+
+fn lel_inferred(src: String) -> Outcome<InferredTree> {
+  match lel_assemble(src: src) {
+    Rejected { diagnostics: d } => Rejected { diagnostics: d }
+    Accepted { value: resolved, diagnostics: _ } => infer(tree: resolved)
+  }
+}
+
+fn lel_reason(src: String) -> Symbol {
+  match lel_inferred(src: src) {
+    Accepted { value: _, diagnostics: _ } => ^accepted
+    Rejected { diagnostics: d } => diagnostics_fatal_reason(d: d)
+  }
+}
+
+// THE ONE REAL-PATH FIXTURE: literals at a declared Nat (0, 3), a literal at Int, an Int expression, and two calls
+// whose comparison the v2 eval route is asked to run.
+data lel_route_source: String = "module p\n\nimport std.nat { Nat, Zero, Succ }\n\nfn g(n: Nat) -> Bool {\n  true\n}\n\nfn gi(n: Int) -> Bool {\n  true\n}\n\nfn uses() -> Bool {\n  g(n: 0) && g(n: 3) && gi(n: 3)\n}\n\nfn sum() -> Int {\n  0 + 1\n}\n\nfn zz(n: Nat) -> Bool {\n  n == 0\n}\n\nfn zo(n: Nat) -> Bool {\n  n == 0\n}\n\nfn k0() -> Bool {\n  zz(n: Zero)\n}\n\nfn k1() -> Bool {\n  zo(n: Succ { prev: Zero })\n}\n"
+
+fn lel_callee_path_is(callee: Node, name: Symbol) -> Bool {
+  match declaration_reference_path_optional(node: callee) {
+    Absent => false
+    Present { value: path } => path == Cons { head: ^p, tail: Cons { head: name, tail: Empty } }
+  }
+}
+
+fn lel_calls_to(root: Node, name: Symbol) -> List<Node> {
+  fold_node(
+    n: root,
+    algebra: NodeFold {
+      init: fn(n0) {
+        match infer_application_callee_use(node: n0) {
+          Absent => []
+          Present { value: callee } => if lel_callee_path_is(callee: callee, name: name) { [n0] } else { [] }
+        }
+      },
+      step: fn(acc, _e, child) { list_append(left: acc, right: child) }
+    }
+  )
+}
+
+fn lel_eval_call_bool(inferred: InferredTree, name: Symbol) -> Optional<Bool> {
+  match lel_calls_to(root: inferred.root, name: name) {
+    Cons { head: call, tail: Empty } =>
+      match eval(tree: inferred, interpretation: v2_evaluator_interpretation(), inputs: inputs_root_only(root: call)) {
+        Rejected { diagnostics: _ } => optional_absent()
+        Accepted { value: v, diagnostics: _ } =>
+          if v == v2_eval_bool_runtime_value(is_true: true) {
+            optional_present(value: true)
+          } else if v == v2_eval_bool_runtime_value(is_true: false) {
+            optional_present(value: false)
+          } else {
+            optional_absent()
+          }
+      }
+    Cons { head: _, tail: _ } => optional_absent()
+    Empty => optional_absent()
+  }
+}
+
+type LelRouteReading {
+  infer_accepted: Bool
+  zero_answer: Optional<Bool>
+  one_answer: Optional<Bool>
+}
+
+fn lel_route_reading() -> LelRouteReading {
+  match lel_inferred(src: lel_route_source) {
+    Rejected { diagnostics: _ } => LelRouteReading { infer_accepted: false, zero_answer: optional_absent(), one_answer: optional_absent() }
+    Accepted { value: inferred, diagnostics: _ } =>
+      LelRouteReading { infer_accepted: true, zero_answer: lel_eval_call_bool(inferred: inferred, name: ^zz), one_answer: lel_eval_call_bool(inferred: inferred, name: ^zo) }
+  }
+}
+
+// THE REAL PATH: the module is accepted (0 and 3 at a declared Nat, 3 at Int, 0 + 1 an Int), and on the v2 eval
+// route a Nat compared with 0 NEVER ANSWERS WRONGLY. Today eval refuses both calls -- `==` is not judged in v2 infer
+// (gunbc.recurring_failure_mode comparison_operands_never_judged_in_v2_infer), so the comparison is underived, and a
+// Nat constructor argument is refused too; refusing is not answering wrongly. When comparisons are judged, Zero must
+// answer true and Succ { prev: Zero } false; a one-sided answer or a wrong Bool -- the constructor-versus-literal
+// representation mismatch -- turns this red.
+test fn lel_route_runs_on_the_real_path() -> Bool {
+  let r = lel_route_reading()
+  r.infer_accepted
+    && ((r.zero_answer == optional_absent() && r.one_answer == optional_absent())
+      || (r.zero_answer == optional_present(value: true) && r.one_answer == optional_present(value: false)))
+}
+
+// SUPPLIED INPUTS: a literal node and an expected type, handed to infer_literal_elaborates_at.
+fn lel_literal(lexeme: String) -> Node {
+  match dag_int_literal_node_from_lexeme(lexeme: lexeme, occurrence_id: OccurrenceSynthetic) {
+    Accepted { value: n, diagnostics: _ } => n
+    Rejected { diagnostics: _ } => node_synthetic(kind: TypeNode { connective: Atom { identity: ^lel_literal_unbuilt } }, children: [])
+  }
+}
+
+fn lel_nat_type() -> Node { declaration_reference_node(qn: qualified_name_from_dotted_string(dotted: "std.nat.Nat"), occurrence_id: OccurrenceSynthetic) }
+fn lel_pair_type() -> Node { declaration_reference_node(qn: qualified_name_from_dotted_string(dotted: "p.Pair"), occurrence_id: OccurrenceSynthetic) }
+fn lel_int_type() -> Node {
+  match dag_binding_denotation(sym: ^dag_binding_type_int) {
+    Present { value: t } => t
+    Absent => node_synthetic(kind: TypeNode { connective: Atom { identity: ^dag_binding_type_int } }, children: [])
+  }
+}
+
+fn lel_elaborates(literal: Node, expected: Node) -> Bool {
+  match infer_literal_elaborates_at(literal_node: literal, expected: expected, declarations: empty_symbol_index()) {
+    InferLiteralElaboratesTo { destination_type: _ } => true
+    InferLiteralNotElaborated => false
+    InferLiteralElaborationRefused { cause: _ } => false
+  }
+}
+
+fn lel_not_elaborated(literal: Node, expected: Node) -> Bool {
+  match infer_literal_elaborates_at(literal_node: literal, expected: expected, declarations: empty_symbol_index()) {
+    InferLiteralElaboratesTo { destination_type: _ } => false
+    InferLiteralNotElaborated => true
+    InferLiteralElaborationRefused { cause: _ } => false
+  }
+}
+
+// SUPPLIED: 0 and 3 elaborate at std.nat Nat through its kernel grounding (inside its declared range).
+test fn lel_literals_elaborate_at_nat() -> Bool {
+  lel_elaborates(literal: lel_literal(lexeme: "0"), expected: lel_nat_type()) && lel_elaborates(literal: lel_literal(lexeme: "3"), expected: lel_nat_type())
+}
+
+// SUPPLIED: a literal at the kernel Int is not elaborated (it is already an Int).
+test fn lel_literal_at_int_is_not_elaborated() -> Bool {
+  lel_not_elaborated(literal: lel_literal(lexeme: "3"), expected: lel_int_type())
+}
+
+// SUPPLIED, RED: a literal at a type with no row is not elaborated, so the judge refuses it with its own cause
+// (application_argument_does_not_inhabit; v2.test.claim.compiler.generic_formal_instantiation is that judge's subject).
+test fn lel_literal_at_a_type_without_a_row_is_not_elaborated() -> Bool {
+  lel_not_elaborated(literal: lel_literal(lexeme: "0"), expected: lel_pair_type())
+}
+
+// SUPPLIED, RED: `-1` -- a unary Transform over the literal 1, not a literal node -- refuses at Nat, typed, pinned to the
+// RANGE's reason so a later parse change (a signed literal token) cannot make it silent and so the refusal is the
+// grounding row's, not a check of infer's own. Before #13320 it was admitted at Nat.
+test fn lel_negative_literal_at_nat_refuses() -> Bool {
+  match infer_literal_elaborates_at(literal_node: lower_unary_prefix(operator: node_synthetic(kind: TypeNode { connective: Atom { identity: ^dag_token_minus } }, children: []), operand: lel_literal(lexeme: "1")), expected: lel_nat_type(), declarations: empty_symbol_index()) {
+    InferLiteralElaborationRefused { cause: c } => c == ^infer_reason_literal_outside_kernel_grounding_range
+    InferLiteralElaboratesTo { destination_type: _ } => false
+    InferLiteralNotElaborated => false
+  }
+}
+
+// SUPPLIED, RED: a string literal has no row into Nat and is not elaborated (never a row picked for another kind).
+test fn lel_literal_of_another_kind_is_not_elaborated_at_nat() -> Bool {
+  lel_not_elaborated(literal: dag_string_literal_node(value: "a", occurrence_id: OccurrenceSynthetic), expected: lel_nat_type())
+}
+
+// THE SEED ROUTE EXECUTES THE SAME COMPARISON (the claim body runs on the seed interpreter).
+test fn lel_count_compared_with_a_literal_executes_on_the_seed() -> Bool {
+  count([]) == 0 && !(count([1]) == 0)
+}
+
+// SUPPLIED: THE RANGE IS THE ROW'S. Nat's grounding row, read from the production table, admits 0 and 3 and not -1 --
+// so the RED above is derived from the declared range (std.literal_elaboration kernel_grounding_admits over the
+// std.types range bounds the row carries), and changing the row's min is what would move it.
+test fn lel_nat_grounding_row_declares_the_range() -> Bool {
+  match kernel_grounding_for(rows: kernel_grounding_rows, source_kind: KernelIntLiteral, carrier: decl_ref(module_path: "std.nat", decl_name: "Nat")) {
+    KernelGroundingFound { row: row } =>
+      kernel_grounding_admits(row: row, value: 0) && kernel_grounding_admits(row: row, value: 3) && !kernel_grounding_admits(row: row, value: 0 - 1)
+    KernelGroundingAbsent => false
+    KernelGroundingAmbiguous { row_count: _ } => false
+  }
+}
diff --git a/src/v2/test/claim/compiler/primitive_authority_resolve_test.dag b/src/v2/test/claim/compiler/primitive_authority_resolve_test.dag
new file mode 100644
index 00000000000..857b6388e3f
--- /dev/null
+++ b/src/v2/test/claim/compiler/primitive_authority_resolve_test.dag
@@ -0,0 +1,135 @@
+module v2.test.claim.compiler.primitive_authority_resolve
+
+import v2.compiler.resolve { ResolvedTree }
+import v2.compiler.infer { infer }
+import v2.compiler.primitive_authority { primitive_authority_path }
+import v2.test.claim.body_let_annotation { bla_assemble_with_peers, bla_q_artifact, bla_r_artifact, bla_source }
+import v2.test.claim.compiler.infer_fold_member_instance { fmi_infer_tree }
+import v2.compiler.source_authority { DagSourceReadWitness }
+import v2.std.collection { List }
+import v2.std.diagnostic { Accepted, Outcome, Rejected, diagnostics_fatal_reason }
+import v2.std.qualified_name { qualified_name_to_dotted_string }
+import v2.std.node { symbol_intern_lexeme }
+import std.types { Bool }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// SUBJECT: a free kernel call head no frame, import or indexed declaration claims binds to its std.primitives contract
+// row (v2.compiler.resolve resolve_atom_primitive_authority, the LAST tier), and v2.compiler.infer REFUSES the call
+// with infer_reason_primitive_without_declared_signature_authority -- the primitive has a cost row but no .dag type
+// signature authority, and typing it as unknown would be silent wrongness (DESIGN section 5).
+//
+// THE PEERS RESTATE the contract row (std.primitives) and, for the shadowing control, the ordinary v2.std.algebra
+// declaration; the real corpus is covered by the bounded native re-measure cited in the PR.
+
+fn par_primitives_peer(rows: String) -> DagSourceReadWitness {
+  bla_source(src: rows, artifact: bla_q_artifact, cu: ^body_let_annotation_q_cu)
+}
+
+data par_reverse_row: String = "module std.primitives\n\ntype PrimitiveContract {\n  name: String\n}\n\ndata reverse_contract: PrimitiveContract = {\n  name: \"reverse\"\n}\n"
+data par_any_row: String = "module std.primitives\n\ntype PrimitiveContract {\n  name: String\n}\n\ndata any_contract: PrimitiveContract = {\n  name: \"any\"\n}\n"
+data par_decoy_row: String = "module std.primitives\n\ntype PrimitiveContract {\n  metadata: Meta\n}\n\ntype Meta {\n  name: String\n}\n\ndata reverse_contract: PrimitiveContract = {\n  metadata: { name: \"reverse\" }\n}\n"
+data par_label_fn_row: String = "module std.primitives\n\ntype Label {\n  name: String\n}\n\nfn helper_contract(x: Int) -> Label {\n  Label { name: \"helper\" }\n}\n"
+data par_label_typed_row: String = "module std.primitives\n\ntype Label {\n  name: String\n}\n\ndata reverse_contract: Label = {\n  name: \"reverse\"\n}\n"
+data par_disagreeing_row: String = "module std.primitives\n\ntype PrimitiveContract {\n  name: String\n}\n\ndata reverse_contract: PrimitiveContract = {\n  name: \"rewind\"\n}\n"
+
+fn par_reason(o: Outcome<ResolvedTree>) -> Symbol {
+  match o {
+    Rejected { diagnostics: d } => diagnostics_fatal_reason(d: d)
+    Accepted { value: tree, diagnostics: _ } =>
+      match fmi_infer_tree(tree: tree) {
+        Rejected { diagnostics: d } => diagnostics_fatal_reason(d: d)
+        Accepted { value: _, diagnostics: _ } => ^accepted
+      }
+  }
+}
+
+// (1) THE REAL PATH: resolves (the assembly is Accepted), then infer refuses with the typed variant.
+test fn par_primitive_call_resolves_then_infer_refuses_without_signature() -> Bool {
+  let assembled = bla_assemble_with_peers(p_src: "module p\n\nfn f(x: Int) -> Int {\n  reverse(x)\n}\n", peers: [par_primitives_peer(rows: par_reverse_row)])
+  (match assembled {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }) && par_reason(o: assembled) == ^infer_reason_primitive_without_declared_signature_authority
+}
+
+// (2) RED WHERE THE COLLISION WOULD MIS-BIND: a local fn named like a primitive wins; infer accepts the call.
+test fn par_local_fn_wins_over_primitive() -> Bool {
+  par_reason(o: bla_assemble_with_peers(
+    p_src: "module p\n\nfn reverse(x: Int) -> Int {\n  x\n}\n\nfn f(x: Int) -> Int {\n  reverse(x)\n}\n",
+    peers: [par_primitives_peer(rows: par_reverse_row)]
+  )) == ^accepted
+}
+
+// (3) CONTROL: with std.primitives indexed AND holding any_contract, an imported ordinary `any` (as v2.std.algebra any) still wins.
+test fn par_imported_ordinary_fn_wins_over_primitive() -> Bool {
+  par_reason(o: bla_assemble_with_peers(
+    p_src: "module p\n\nimport q { any }\n\nfn f(x: Int) -> Int {\n  any(x)\n}\n",
+    peers: [par_primitives_peer(rows: par_any_row), bla_source(src: "module q\n\nfn any(x: Int) -> Int {\n  x\n}\n", artifact: bla_r_artifact, cu: ^body_let_annotation_r_cu)]
+  )) == ^accepted
+}
+
+// (4) A NAME IN NO AUTHORITY refuses unbound, typed (the variant, not text), even with std.primitives indexed.
+test fn par_name_in_no_authority_is_unbound() -> Bool {
+  par_reason(o: bla_assemble_with_peers(
+    p_src: "module p\n\nfn f(x: Int) -> Int {\n  nonesuch(x)\n}\n",
+    peers: [par_primitives_peer(rows: par_reverse_row)]
+  )) == ^resolve_reason_unbound_symbol
+}
+
+// (5) PATH DERIVATION ONLY (not six bound rows): each name derives exactly std.primitives.<name>_contract. Binding is claims 1, 6, 7.
+data par_census: List<String> = ["reverse", "none", "sorted_map_keys", "replace", "any", "filter"]
+
+test fn par_census_names_map_to_their_contract_identity() -> Bool {
+  fold(par_census, init: true, f: fn(ok, name) {
+    ok
+      && qualified_name_to_dotted_string(qn: primitive_authority_path(head: symbol_intern_lexeme(lexeme: name))) == concat("std.primitives.", name, "_contract")
+  })
+}
+
+
+// (6) IDENTITY JOIN: the row is joined on its own name field. A row declared reverse_contract whose name field says
+// "rewind" is neither bound for `reverse` nor silently accepted: resolve refuses with the typed variant.
+test fn par_row_whose_name_field_disagrees_is_refused() -> Bool {
+  par_reason(o: bla_assemble_with_peers(
+    p_src: "module p\n\nfn f(x: Int) -> Int {\n  reverse(x)\n}\n",
+    peers: [par_primitives_peer(rows: par_disagreeing_row)]
+  )) == ^resolve_reason_primitive_row_name_disagrees
+}
+
+// (7) NESTED DECOY: a row with no own `name` whose nested `metadata` record carries name "reverse" is not an identity;
+// only the contract record's OWN field joins, so resolve refuses (nothing found by a deeper search).
+test fn par_nested_name_decoy_is_not_an_identity() -> Bool {
+  par_reason(o: bla_assemble_with_peers(
+    p_src: "module p\n\nfn f(x: Int) -> Int {\n  reverse(x)\n}\n",
+    peers: [par_primitives_peer(rows: par_decoy_row)]
+  )) == ^resolve_reason_primitive_row_name_disagrees
+}
+
+// (8) CLASSIFIED BY THE ADMITTED DECLARATION, NOT NAME SHAPE: an ordinary fn at std.primitives.helpers.helper_contract
+// is an ordinary fn; infer reads its real signature and accepts the call.
+test fn par_ordinary_fn_at_contract_shaped_path_still_infers() -> Bool {
+  par_reason(o: bla_assemble_with_peers(
+    p_src: "module p\n\nimport std.primitives.helpers { helper_contract }\n\nfn f(x: Int) -> Int {\n  helper_contract(x)\n}\n",
+    peers: [bla_source(src: "module std.primitives.helpers\n\nfn helper_contract(x: Int) -> Int {\n  x\n}\n", artifact: bla_r_artifact, cu: ^body_let_annotation_r_cu)]
+  )) == ^accepted
+}
+
+// (9) CONTRACT-SHAPED PATH AND MATCHING NAME FIELD ARE NOT ADMISSION: an ordinary fn at std.primitives.helper_contract returning
+// Label { name: "helper" } is not a PrimitiveContract row (its declared type is Label), so it stays ordinary and infer reads its signature.
+test fn par_ordinary_fn_with_matching_name_field_stays_ordinary() -> Bool {
+  par_reason(o: bla_assemble_with_peers(
+    p_src: "module p\n\nimport std.primitives { Label, helper_contract }\n\nfn f(x: Int) -> Label {\n  helper_contract(x)\n}\n",
+    peers: [par_primitives_peer(rows: par_label_fn_row)]
+  )) == ^accepted
+}
+
+// (10) AN UNRELATED DECLARATION AT std.primitives.reverse_contract WITH name "reverse" DOES NOT BIND: its declared type is not
+// PrimitiveContract, so `reverse` stays unbound at resolve.
+test fn par_wrong_typed_row_at_contract_path_does_not_bind() -> Bool {
+  par_reason(o: bla_assemble_with_peers(
+    p_src: "module p\n\nfn f(x: Int) -> Int {\n  reverse(x)\n}\n",
+    peers: [par_primitives_peer(rows: par_label_typed_row)]
+  )) == ^resolve_reason_unbound_symbol
+}
diff --git a/src/v2/test/claim/compiler_materialization_witness_test.dag b/src/v2/test/claim/compiler_materialization_witness_test.dag
deleted file mode 100644
index 247f4fbd67d..00000000000
--- a/src/v2/test/claim/compiler_materialization_witness_test.dag
+++ /dev/null
@@ -1,225 +0,0 @@
-module v2.test.claim.compiler_materialization_witness
-
-import v2.std.live_tree { LiveTreeDisposition }
-import std.realization { LocalInProcess, Memoize, Recompute }
-import v2.std.diagnostic { Accepted, Rejected }
-import v2.compiler.materialization_carriers {
-  cached_stage_realization,
-  compile_stage_memo_provider_id,
-  compile_stage_memo_retention_preserved,
-  compile_stage_memo_verdict_is_single_recompute,
-  compile_stage_realized_step,
-  discharged_scope_admits_store,
-  materialization_admission_admits_store,
-  parse_memo_no_recurrence,
-  ParseMemoRecurrence,
-  parse_table_carrier_grounded_on_catalog,
-  parse_table_memo_materialization_for,
-  parse_table_memo_plural_holds_without_provider,
-  parse_table_memo_plural_holds_with_provider,
-  parse_table_memo_plural_refused_without_provider_count,
-  parse_table_memo_plural_scope_too_narrow_count,
-  parse_table_memo_provider_id,
-  parse_table_memo_retention_preserved,
-  parse_table_memo_verdict_is_discharged_for,
-  parse_table_memo_verdict_is_single_recompute_for,
-  parse_table_realized_step,
-  refused_scope_is_not_admitted,
-  refused_scope_prescription,
-  unruled_identity_is_not_admitted,
-  v2_compiler_materialization_ladder_holds
-}
-import v2.compiler.parse { prepare_grammar, prepare_grammar_with_admission }
-import extdeps.realization.compile_stage_memo { compile_stage_memo_id }
-import extdeps.realization.parse_table_memo { parse_table_memo_id }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-// Green-by-execution receipt that v2 ParseTable and cached_stage memoization flows through the
-// governed carrier door, and that the materialization each door consumes is the one the ladder
-// ADMITTED for that demand's identity rather than a literal standing beside it, and that an
-// admission the ladder did not green is REFUSED rather than re-encoded as an operational
-// materialization. RED: plural RefusedScopeTooNarrow / RefusedNoProvider; governed-store refusal
-// when Recompute; bypass insert on non-Memoize carrier; an identity with no verdict being
-// admitted; a refused admission letting the parse realization be built anyway.
-// reconcile-as-lookup-path is the next increment.
-
-test fn compiler_materialization_ladder_holds() -> Bool {
-  v2_compiler_materialization_ladder_holds()
-}
-
-test fn parse_table_memo_provider_preserves_catalog_retention() -> Bool {
-  parse_table_memo_retention_preserved()
-    && (parse_table_memo_provider_id() == parse_table_memo_id)
-}
-
-test fn compile_stage_memo_provider_preserves_catalog_retention() -> Bool {
-  compile_stage_memo_retention_preserved()
-    && (compile_stage_memo_provider_id() == compile_stage_memo_id)
-}
-
-// The parse demand's site is derived from the grammar's recurrence census, so the carrier is
-// asked for a census rather than for one grammar-less answer. The real producer's route -- a real
-// grammar through compute_grammar_first_analysis into the table -- is the inhabitance claim in
-// v2.test.provenance.parse_memo_frame_replay.
-fn recurrent_census() -> ParseMemoRecurrence {
-  ParseMemoRecurrence { discarding_backtrack_sites: 1, nullable_nonterminals: 0 }
-}
-
-fn nullable_only_census() -> ParseMemoRecurrence {
-  ParseMemoRecurrence { discarding_backtrack_sites: 0, nullable_nonterminals: 1 }
-}
-
-test fn parse_table_carrier_inhabits_realization() -> Bool {
-  match parse_table_realized_step(r: recurrent_census()) {
-    Rejected { diagnostics: _ } => false
-    Accepted { value: step, diagnostics: _ } =>
-      (step.materialization == Memoize)
-        && (step.placement == LocalInProcess)
-        && materialization_admission_admits_store(
-             a: parse_table_memo_materialization_for(r: recurrent_census())
-           )
-        && !materialization_admission_admits_store(
-             a: parse_table_memo_materialization_for(r: parse_memo_no_recurrence)
-           )
-  }
-}
-
-// Recompute, not Memoize, and the change is a correction rather than a regression: the
-// compile-stage lookup is resolve_cache_miss, which returns Miss unconditionally, so the
-// governed door has been taking the recompute path on every compile regardless of what the
-// literal said. The literal was the only thing claiming otherwise.
-test fn compile_stage_carrier_inhabits_realization() -> Bool {
-  match compile_stage_realized_step() {
-    Rejected { diagnostics: _ } => false
-    Accepted { value: step, diagnostics: _ } =>
-      match cached_stage_realization() {
-        Rejected { diagnostics: _ } => false
-        Accepted { value: realization, diagnostics: _ } =>
-          (step.materialization == Recompute)
-            && (step.placement == LocalInProcess)
-            && (realization.materialization == Recompute)
-            && (realization.provider_id == compile_stage_memo_id)
-      }
-  }
-}
-
-test fn parse_table_empty_uses_catalog_identity() -> Bool {
-  parse_table_carrier_grounded_on_catalog()
-}
-
-// Both arms read off the VERDICT: a refusal also prescribes Memoize, so the prescription alone
-// could not tell a discharge from an unmet obligation. The nullable-only census discriminates the
-// second recurrence source -- dropping it from parse_memo_recurrence_is_possible reds here.
-test fn parse_table_demand_is_discharged_by_its_catalog_provider() -> Bool {
-  parse_table_memo_verdict_is_discharged_for(r: recurrent_census())
-    && parse_table_memo_verdict_is_discharged_for(r: nullable_only_census())
-    && !parse_table_memo_verdict_is_discharged_for(r: parse_memo_no_recurrence)
-}
-
-test fn parse_table_demand_without_recurrence_is_accepted_single_recompute() -> Bool {
-  parse_table_memo_verdict_is_single_recompute_for(r: parse_memo_no_recurrence)
-    && !parse_table_memo_verdict_is_single_recompute_for(r: recurrent_census())
-}
-
-test fn compile_stage_demand_is_accepted_single_recompute() -> Bool {
-  compile_stage_memo_verdict_is_single_recompute()
-}
-
-// The fail-closed arm, by execution: an identity carrying no verdict yields no admitted
-// decision, and the door REFUSES rather than handing back an operational materialization.
-test fn an_unruled_identity_is_not_admitted() -> Bool {
-  unruled_identity_is_not_admitted()
-}
-
-// Review 69770's finding, as a discriminating pair. A REFUSED identity must not permit the
-// store: ladder_verdict_prescribes answers Memoize for five of the six Refused arms, so a door
-// that read the bare prescription would take an unmet obligation as permission. The negative
-// is RefusedScopeTooNarrow against the very provider that discharges the single-site demand,
-// and the positive is that same provider still admitting that same demand -- so the negative
-// cannot pass by the admission having been broken for everything.
-// STRENGTHENED past "refuses the store": the previous form asked only whether the store was
-// permitted, which a refusal and an admitted Recompute both answer false, so it could not tell
-// a preserved refusal from one re-encoded as recomputation -- and that was the defect.
-test fn a_refused_identity_is_not_admitted() -> Bool {
-  refused_scope_is_not_admitted()
-    && discharged_scope_admits_store()
-}
-
-test fn parse_table_memo_plural_reds_without_provider() -> Bool {
-  !parse_table_memo_plural_holds_with_provider()
-    && (parse_table_memo_plural_scope_too_narrow_count() == 1)
-    && !parse_table_memo_plural_holds_without_provider()
-    && (parse_table_memo_plural_refused_without_provider_count() == 1)
-}
-
-// THE CONSUMER-BOUNDARY CONTROL the delta review asked for, and the one the module-level pair
-// above cannot stand in for. Those show the DOOR refuses; this shows the thing that consumes the
-// door refuses WITH it -- that a parse-table realization is not constructed, and the prepare that
-// would have built it hands back the located diagnostic instead. The negative drives
-// prepare_grammar_with_admission, which IS the body prepare_grammar runs, and the refusing
-// admission it supplies is produced by the real door fed the plural verdict list, not by a
-// literal: re-encoding the refusal as Recompute inside admitted_prescription_in makes this parse
-// succeed and the control dies with it.
-fn materialization_control_grammar() -> ParseGrammar {
-  ModeledGrammar {
-    root: GrammarRoot {
-      start: ^mat_control_start,
-      productions: Cons {
-        head: GrammarProduction {
-          name: ^mat_control_start,
-          expression: v2.std.grammar.Terminal { token_class: ^mat_control_tok, stamp: StampClass },
-          emitted: grammar_atom(identity: ^mat_control_start)
-        },
-        tail: std.algebra.Empty
-      },
-      sync_tokens: grammar_empty_sync_tokens()
-    }
-  }
-}
-
-fn materialization_control_prepare_is_refused() -> Bool {
-  match prepare_grammar_with_admission(
-    admit: fn(_) { refused_scope_prescription() },
-    grammar: materialization_control_grammar()
-  ) {
-    Rejected { diagnostics: _ } => true
-    Accepted { value: _, diagnostics: _ } => false
-  }
-}
-
-// The positive control on the same grammar through the REAL door: without it the negative would
-// also pass if prepare_grammar_with_admission simply refused this grammar for any reason.
-//
-// IT ASSERTS THE DERIVED VALUE, NOT MERELY THAT SOMETHING WAS ADMITTED, and the value is
-// Recompute rather than Memoize BECAUSE OF THE DERIVATION: this grammar is one Terminal
-// production, so its recurrence census is zero on both counts, no (nonterminal, position) is
-// asked twice, and the ladder answers AcceptedSingleRecompute. That is the admitted
-// direct-computation arm reaching the real prepare -- a grammar that needs no memo does not get
-// one -- and pinning Memoize here would have pinned a memo the grammar does not demand.
-//
-// WHERE THE OTHER ADMITTED ARM IS EXERCISED, cited because this control no longer carries it.
-// THIS pair drives prepare_grammar to a Recompute admission; the MEMOIZE admission through the
-// same door is driven by v2.test.provenance.parse_memo_frame_replay
-// parse_memo_demand_derived_discharged_when_the_grammar_abandons_a_demand, on a grammar whose
-// census counts a discarding backtrack site. Those two claims are the only place the real
-// prepare produces a store-permitting answer, and their stated subject is REPLAY, so retargeting
-// them for replay reasons would delete this module's Memoize counterpart while every control
-// here stayed green. That is why the citation runs both ways: the replay claims carry a matching
-// note naming this control.
-fn materialization_control_prepare_is_admitted() -> Bool {
-  match prepare_grammar(grammar: materialization_control_grammar()) {
-    Rejected { diagnostics: _ } => false
-    Accepted { value: prepared, diagnostics: _ } =>
-      match prepared {
-        PreparedVoidGrammar => false
-        PreparedModeled { modeled: _, materialization: m } => m == Recompute
-      }
-  }
-}
-
-test fn a_refused_admission_refuses_the_parse_realization() -> Bool {
-  materialization_control_prepare_is_refused()
-    && materialization_control_prepare_is_admitted()
-}
diff --git a/src/v2/test/claim/demand_engine/demand_engine_test.dag b/src/v2/test/claim/demand_engine/demand_engine_test.dag
index 01a03c3ab9c..dca6fedd4ae 100644
--- a/src/v2/test/claim/demand_engine/demand_engine_test.dag
+++ b/src/v2/test/claim/demand_engine/demand_engine_test.dag
@@ -8,6 +8,7 @@ import v2.std.demand_engine {
   BlockedByCycle,
   BlockedByMissingEdge,
   BlockedByRefusedPrerequisite,
+  BlockedKeyConflict,
   BlockedNoDemand,
   BlockedWaitingForCapacity,
   DemandAdmitted,
@@ -40,7 +41,7 @@ import std.optional { Absent, Present }
 import v2.std.text { String }
 import std.cache_identity { parse_source_artifact_kind }
 import std.content_hash { Fnv1a64Structural }
-import std.materialization_ladder { FreshEffect, PureComputation }
+import std.materialization_ladder { DemandNature, FreshEffect, IdempotentEffect, PureComputation, WorldRead, nature_eq }
 import std.judgment_contract { DemandIdentity }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
@@ -111,6 +112,11 @@ fn g_cause_eq(a: DemandBlockedCause, b: DemandBlockedCause) -> Bool {
     BlockedWaitingForCapacity =>
       match b { BlockedWaitingForCapacity => true  _ => false }
     BlockedNoDemand => match b { BlockedNoDemand => true  _ => false }
+    BlockedKeyConflict { stored: sa, requested: ra } =>
+      match b {
+        BlockedKeyConflict { stored: bs, requested: br } => nature_eq(a: sa, b: bs) && nature_eq(a: ra, b: br)
+        _ => false
+      }
     _ => false
   }
 }
@@ -726,3 +732,169 @@ test fn a_duplicated_dependency_does_not_duplicate_a_ready_identity_holds() -> B
     )
   ) == 1
 }
+
+// ── one key, two natures ───────────────────────────────────────────────────────────────────────
+//
+// An existing entry answers a request only when the request declares the SAME complete nature
+// (std.materialization_ladder nature_eq). Each pair below is a request the engine used to attach or
+// re-produce under the stored nature alone; each must now stand as a typed key conflict naming both.
+
+fn g_conflict(stored: DemandNature, requested: DemandNature) -> DemandState<Int> {
+  DemandBlocked { cause: BlockedKeyConflict { stored: stored, requested: requested } }
+}
+
+fn g_requested_twice(first: DemandNature, second: DemandNature) -> DemandEngine<Int> {
+  demand_engine_request(
+    e: demand_engine_request(e: demand_engine_empty(), id: g_a(), nature: first),
+    id: g_a(),
+    nature: second
+  )
+}
+
+// Neither request is served from the other: no attachment and no extra production is recorded.
+fn g_conflict_recorded(first: DemandNature, second: DemandNature) -> Bool {
+  let e = g_requested_twice(first: first, second: second)
+  g_state_is(e: e, id: g_a(), want: g_conflict(stored: first, requested: second))
+    && match demand_engine_entry(e: e, id: g_a()) {
+      Absent => false
+      Present { value: entry } => entry.attachments == 0 && entry.productions == 0
+    }
+}
+
+test fn a_fresh_request_does_not_attach_to_a_pure_entry_holds() -> Bool {
+  g_conflict_recorded(first: PureComputation, second: FreshEffect)
+}
+
+test fn a_pure_request_does_not_attach_to_a_fresh_entry_holds() -> Bool {
+  g_conflict_recorded(first: FreshEffect, second: PureComputation)
+}
+
+// Both share, and they are still different contracts.
+test fn pure_and_idempotent_are_different_demands_holds() -> Bool {
+  g_conflict_recorded(first: PureComputation, second: IdempotentEffect)
+    && g_conflict_recorded(first: IdempotentEffect, second: PureComputation)
+}
+
+test fn a_changed_world_read_envelope_is_a_different_demand_holds() -> Bool {
+  g_conflict_recorded(
+    first: WorldRead { staleness_envelope_declared: true },
+    second: WorldRead { staleness_envelope_declared: false }
+  )
+    && g_conflict_recorded(
+      first: WorldRead { staleness_envelope_declared: false },
+      second: WorldRead { staleness_envelope_declared: true }
+    )
+}
+
+// THE POSITIVE CONTROL. Equal natures still share, for every share-admitted nature, so the conflict
+// above is decided by the nature and not by the second request alone.
+fn g_equal_nature_attaches(n: DemandNature) -> Bool {
+  let e = g_requested_twice(first: n, second: n)
+  match demand_engine_entry(e: e, id: g_a()) {
+    Absent => false
+    Present { value: entry } => entry.attachments == 1 && entry.productions == 0
+  }
+}
+
+test fn equal_share_admitted_natures_still_attach_holds() -> Bool {
+  g_equal_nature_attaches(n: PureComputation)
+    && g_equal_nature_attaches(n: IdempotentEffect)
+    && g_equal_nature_attaches(n: WorldRead { staleness_envelope_declared: true })
+}
+
+// AND THE SHARED DEMAND RUNS ONCE. Two equal requests, one admission, one settlement: the second
+// request is served by that one execution and nothing is left ready to run again.
+test fn equal_natures_share_one_execution_holds() -> Bool {
+  let sealed = demand_engine_seal(e: g_requested_twice(first: PureComputation, second: PureComputation))
+  let admitted = demand_engine_next(e: sealed, offer: DemandLeaseOffer { seats: 1 })
+  let after = demand_engine_settle(e: sealed, id: g_a(), state: DemandAvailable { value: 7 })
+  match admitted {
+    DemandAdmitted { identity: id } => demand_identity_key(id: id) == demand_identity_key(id: g_a())
+    DemandNotAdmitted { cause: _ } => false
+  }
+    && g_state_is(e: after, id: g_a(), want: DemandAvailable { value: 7 })
+    && length(xs: demand_engine_ready_queue(e: after)) == 0
+    && match demand_engine_entry(e: after, id: g_a()) {
+      Absent => false
+      Present { value: entry } => entry.attachments == 1 && entry.productions == 1
+    }
+}
+
+// A -> B, both pure, sealed. Used to show the conflict reaches a dependent and outlives the lifecycle.
+fn g_chain() -> DemandEngine<Int> {
+  demand_engine_seal(
+    e: demand_engine_relate(
+      e: demand_engine_request(
+        e: demand_engine_request(e: demand_engine_empty(), id: g_a(), nature: PureComputation),
+        id: g_b(),
+        nature: PureComputation
+      ),
+      relation: g_edge(prerequisite: g_a(), dependent: g_b())
+    )
+  )
+}
+
+// AFTER THE RESULT IS AVAILABLE. A was settled with a value and B became ready on it; a fresh request
+// for A's key must not be served that value, and B -- which named A's key -- leaves the ready order
+// with a refused prerequisite rather than running on an answer to a different demand.
+test fn a_conflict_after_an_available_result_is_not_served_holds() -> Bool {
+  let available = demand_engine_settle(e: g_chain(), id: g_a(), state: DemandAvailable { value: 1 })
+  let conflicted = demand_engine_request(e: available, id: g_a(), nature: FreshEffect)
+  g_state_is(e: available, id: g_b(), want: DemandReady)
+    && g_state_is(e: conflicted, id: g_a(), want: g_conflict(stored: PureComputation, requested: FreshEffect))
+    && g_state_is(e: conflicted, id: g_b(), want: DemandBlocked { cause: BlockedByRefusedPrerequisite { prerequisite: g_a() } })
+    && length(xs: demand_engine_ready_queue(e: conflicted)) == 0
+}
+
+// THE CONFLICT IS DURABLE. Readiness used to preserve only settled and cycle-blocked states, so a
+// bare blocked state would have been re-derived to ready by seal. Here it survives seal, a later
+// settlement of the in-flight production, and a further request under either nature -- and is
+// never admitted.
+test fn a_key_conflict_survives_seal_settle_and_rerequest_holds() -> Bool {
+  let want = g_conflict(stored: PureComputation, requested: FreshEffect)
+  let conflicted = g_requested_twice(first: PureComputation, second: FreshEffect)
+  let sealed = demand_engine_seal(e: conflicted)
+  let settled = demand_engine_settle(e: sealed, id: g_a(), state: DemandAvailable { value: 1 })
+  let again_pure = demand_engine_request(e: settled, id: g_a(), nature: PureComputation)
+  let again_fresh = demand_engine_request(e: settled, id: g_a(), nature: FreshEffect)
+  g_state_is(e: sealed, id: g_a(), want: want)
+    && g_state_is(e: settled, id: g_a(), want: want)
+    && g_state_is(e: again_pure, id: g_a(), want: want)
+    && g_state_is(e: again_fresh, id: g_a(), want: want)
+    && match demand_engine_next(e: sealed, offer: DemandLeaseOffer { seats: 1 }) {
+      DemandAdmitted { identity: _ } => false
+      DemandNotAdmitted { cause: _ } => true
+    }
+}
+
+// THE CONFLICT DOES NOT END THE WORK UNDER IT. A is running when its key is found conflicted: the
+// seat stays held until A's production reports, and the report releases it without replacing the
+// conflict. Releasing at the conflict would admit past the seat count while A still runs.
+test fn a_conflict_on_a_running_demand_keeps_its_seat_until_it_reports_holds() -> Bool {
+  let running = demand_engine_settle(e: g_chain(), id: g_a(), state: DemandRunning)
+  let conflicted = demand_engine_request(e: running, id: g_a(), nature: FreshEffect)
+  let reported = demand_engine_settle(e: conflicted, id: g_a(), state: DemandAvailable { value: 1 })
+  demand_engine_in_flight(e: running) == 1
+    && demand_engine_in_flight(e: conflicted) == 1
+    && demand_engine_in_flight(e: reported) == 0
+    && g_state_is(e: reported, id: g_a(), want: g_conflict(stored: PureComputation, requested: FreshEffect))
+    && g_state_is(e: reported, id: g_b(), want: DemandBlocked { cause: BlockedByRefusedPrerequisite { prerequisite: g_a() } })
+}
+
+// AND A RUNNING DEPENDENT KEEPS BOTH ITS SEAT AND ITS REFUSAL. B is running on A's value when A's key
+// is found conflicted: B is refused at once and leaves no seat behind it, and when B's production
+// later reports a value, the seat is released and the refusal still stands -- B read an answer to a
+// different demand, so its value answers nothing.
+test fn a_running_dependent_keeps_its_seat_and_refusal_when_a_prerequisite_conflicts_holds() -> Bool {
+  let want_b = DemandBlocked { cause: BlockedByRefusedPrerequisite { prerequisite: g_a() } }
+  let available = demand_engine_settle(e: g_chain(), id: g_a(), state: DemandAvailable { value: 1 })
+  let b_running = demand_engine_settle(e: available, id: g_b(), state: DemandRunning)
+  let conflicted = demand_engine_request(e: b_running, id: g_a(), nature: FreshEffect)
+  let reported = demand_engine_settle(e: conflicted, id: g_b(), state: DemandAvailable { value: 2 })
+  demand_engine_in_flight(e: b_running) == 1
+    && demand_engine_in_flight(e: conflicted) == 1
+    && g_state_is(e: conflicted, id: g_b(), want: want_b)
+    && demand_engine_in_flight(e: reported) == 0
+    && g_state_is(e: reported, id: g_b(), want: want_b)
+    && length(xs: demand_engine_ready_queue(e: reported)) == 0
+}
diff --git a/src/v2/test/claim/diagnostic_sequence_outcome_witness_test.dag b/src/v2/test/claim/diagnostic_sequence_outcome_witness_test.dag
index b4635134ba2..29b5ceb8bba 100644
--- a/src/v2/test/claim/diagnostic_sequence_outcome_witness_test.dag
+++ b/src/v2/test/claim/diagnostic_sequence_outcome_witness_test.dag
@@ -54,7 +54,13 @@ test fn witness_sequence_outcome_collects_values() -> Bool {
     policy: short_circuit_policy
   ) {
     Accepted { value: vs, diagnostics: None } =>
-      (vs.length() == 2) && (vs.first() == 1) && (vs.skip(n: 1).first() == 2)
+      (vs.length() == 2) && ((match vs.first() {
+          Present { value: v } => v == 1
+          Absent => false
+        })) && ((match vs.skip(n: 1).first() {
+          Present { value: v } => v == 2
+          Absent => false
+        }))
     Accepted { value: _, diagnostics: Some { diagnostics: _ } } => false
     Rejected { diagnostics: _ } => false
   }
@@ -80,7 +86,13 @@ test fn witness_sequence_outcome_accumulate_collects_both_values() -> Bool {
     policy: accumulate_policy
   ) {
     Accepted { value: vs, diagnostics: None } =>
-      (vs.length() == 2) && (vs.first() == 1) && (vs.skip(n: 1).first() == 2)
+      (vs.length() == 2) && ((match vs.first() {
+          Present { value: v } => v == 1
+          Absent => false
+        })) && ((match vs.skip(n: 1).first() {
+          Present { value: v } => v == 2
+          Absent => false
+        }))
     Accepted { value: _, diagnostics: Some { diagnostics: _ } } => false
     Rejected { diagnostics: _ } => false
   }
diff --git a/src/v2/test/claim/emit/dag_bind_let_block_scoped_test.dag b/src/v2/test/claim/emit/dag_bind_let_block_scoped_test.dag
index 3cabd8d55a5..6ea3abfeb2c 100644
--- a/src/v2/test/claim/emit/dag_bind_let_block_scoped_test.dag
+++ b/src/v2/test/claim/emit/dag_bind_let_block_scoped_test.dag
@@ -58,13 +58,12 @@ fn dbl_parse(concrete: List<ConcreteSyntaxToken>) -> Optional<Node> {
     Accepted { value: prepared, diagnostics: _ } =>
       match prepared {
         PreparedVoidGrammar => Absent
-        PreparedModeled { modeled: modeled, materialization: m } =>
+        PreparedModeled { modeled: modeled } =>
           match parse_production_prepared(
             tokens: dbl_lexed(concrete: concrete),
             validated: modeled.validated,
             analysis: modeled.analysis,
-            production_name: ^dag_production_expr,
-            materialization: m
+            production_name: ^dag_production_expr
           ) {
             Rejected { diagnostics: _ } => Absent
             Accepted { value: artifact, diagnostics: _ } => dbl_tree(node: artifact.tree)
diff --git a/src/v2/test/claim/emit/dag_target_text_round_trip_test.dag b/src/v2/test/claim/emit/dag_target_text_round_trip_test.dag
index ff8e7d1994d..2583ed9ce85 100644
--- a/src/v2/test/claim/emit/dag_target_text_round_trip_test.dag
+++ b/src/v2/test/claim/emit/dag_target_text_round_trip_test.dag
@@ -1,9 +1,9 @@
 module v2.test.emit.dag_target_text_round_trip
 
 import v2.compiler.parse { PreparedModeled, PreparedVoidGrammar, parse_production_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
 import v2.compiler.target_serialize { serialize_concrete_syntax_tokens_to_source_string }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.extdeps.languages.dag {
   dag_lex,
   dag_target_model,
@@ -92,7 +92,7 @@ fn trt_text(tokens: List<ConcreteSyntaxToken>, transforms: Map<Symbol, TokenClas
 }
 
 fn trt_lex(text: String) -> List<Token> {
-  match tokenize(text: text, file: ^trt_probe, rules: dag_lex()) {
+  match tokenize_prepared(text: text, file: ^trt_probe, prepared: dag_prepared_lex()) {
     Accepted { value: stream, diagnostics: _ } => stream.all
     Rejected { diagnostics: _ } => []
   }
@@ -122,13 +122,12 @@ fn trt_parse(tokens: List<Token>, production: Symbol) -> Optional<Node> {
     Accepted { value: prepared, diagnostics: _ } =>
       match prepared {
         PreparedVoidGrammar => Absent
-        PreparedModeled { modeled: modeled, materialization: m } =>
+        PreparedModeled { modeled: modeled } =>
           match parse_production_prepared(
             tokens: tokens,
             validated: modeled.validated,
             analysis: modeled.analysis,
-            production_name: production,
-            materialization: m
+            production_name: production
           ) {
             Rejected { diagnostics: _ } => Absent
             Accepted { value: artifact, diagnostics: _ } => trt_present(node: artifact.tree)
diff --git a/src/v2/test/claim/emit/produced_item_parameter_order_test.dag b/src/v2/test/claim/emit/produced_item_parameter_order_test.dag
index ac2a0986eb2..65d0d3e2194 100644
--- a/src/v2/test/claim/emit/produced_item_parameter_order_test.dag
+++ b/src/v2/test/claim/emit/produced_item_parameter_order_test.dag
@@ -6,7 +6,7 @@ import v2.std.arrow_signature { ArrowParameterOrderMalformed, arrow_declared_par
 import v2.std.compilers.target_model { ProducedDeclSignatureSubject, arrow_domain_binder_names, produced_decl_subject_from_name_and_arrow }
 import v2.std.diagnostic { Accepted, Rejected, diagnostics_fatal_reason }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import v2.std.node_query { binder_edge }
+import v2.std.node_query { binder_edge, declared_field_from_edge }
 import v2.std.node {
   Arrow,
   Atom,
@@ -97,20 +97,22 @@ fn ipo_without_order(arrow: Node) -> Node {
   }
 }
 
-// Each parameter as its label then its type atom, so the claim reads order AND the binding of each
-// label to its own type.
+// Each parameter as its label then its declared type atom, so the claim reads order AND the binding
+// of each label to its own type. The renderer’s param edges are binders (v2.std.node_query
+// binder_edge): the type lives on the binder, not as the edge target’s connective. Reading the
+// target as an Atom is the pre-XL-2 shape and would accept a renderer that dropped the type into
+// the edge target while refusing the production encoding.
 fn ipo_param_symbols(params: List<Edge>) -> List<Symbol> {
   fold(params, init: [], f: fn(acc, e) {
-    let name = match e.label {
-      StructuralLabel { label: _ } => ^ipo_structural
-      Authored { name: n } => n
-      Positional => ^ipo_positional
-    }
-    let ty = match e.target.kind {
-      TypeNode { connective: Atom { identity: t } } => t
-      _ => ^ipo_not_an_atom
+    match declared_field_from_edge(e: e) {
+      Present { value: field } =>
+        let ty = match field.type_node.kind {
+          TypeNode { connective: Atom { identity: t } } => t
+          _ => ^ipo_not_an_atom
+        }
+        concat(acc, [field.name, ty])
+      Absent => concat(acc, [^ipo_not_a_binder, ^ipo_not_an_atom])
     }
-    concat(acc, [name, ty])
   })
 }
 
diff --git a/src/v2/test/claim/emit/rust_logic_complement_emit_test.dag b/src/v2/test/claim/emit/rust_logic_complement_emit_test.dag
index 55c8ac43e3a..d173f91f784 100644
--- a/src/v2/test/claim/emit/rust_logic_complement_emit_test.dag
+++ b/src/v2/test/claim/emit/rust_logic_complement_emit_test.dag
@@ -28,6 +28,7 @@ import v2.std.diagnostic {
   None,
   Rejected,
   Unavailable,
+  diagnostics_fatal_reason,
   node_locus
 }
 import v2.std.node { Node }
@@ -58,7 +59,8 @@ test fn rust_logic_complement_emit_accepts() -> Bool {
   ) {
     Accepted { value: source, diagnostics: d } =>
       (source.carried == rust_logic_complement_source_text) && (d == None)
-    Rejected { diagnostics: _ } => false
+    Rejected { diagnostics: ds } =>
+      diagnostics_fatal_reason(d: ds) == ^rust_logic_complement_emit_accepts
   }
 }
 
@@ -71,7 +73,8 @@ test fn rust_logic_complement_emit_swapped_discriminates() -> Bool {
       (source.carried == rust_logic_complement_swapped_arms_source_text) &&
       (source.carried != rust_logic_complement_source_text) &&
       (d == None)
-    Rejected { diagnostics: _ } => false
+    Rejected { diagnostics: ds } =>
+      diagnostics_fatal_reason(d: ds) == ^rust_logic_complement_emit_swapped_discriminates
   }
 }
 
diff --git a/src/v2/test/claim/emit/rust_logic_meet_join_emit_test.dag b/src/v2/test/claim/emit/rust_logic_meet_join_emit_test.dag
index a52ccdfb0e4..0c886313d3c 100644
--- a/src/v2/test/claim/emit/rust_logic_meet_join_emit_test.dag
+++ b/src/v2/test/claim/emit/rust_logic_meet_join_emit_test.dag
@@ -34,6 +34,7 @@ import v2.std.diagnostic {
   None,
   Rejected,
   Unavailable,
+  diagnostics_fatal_reason,
   node_locus
 }
 import v2.std.node { Node }
@@ -57,7 +58,8 @@ fn meet_join_emit_source_equals(root: Node, target: TargetModel, expected: Strin
   match emit(tree: meet_join_emit_tree_for(root: root), target: target) {
     Accepted { value: source, diagnostics: d } =>
       (source.carried == expected) && (d == None)
-    Rejected { diagnostics: _ } => false
+    Rejected { diagnostics: ds } =>
+      diagnostics_fatal_reason(d: ds) == ^rust_logic_meet_emit_holds
   }
 }
 
@@ -70,7 +72,8 @@ fn meet_join_emit_discriminates(
   match emit(tree: meet_join_emit_tree_for(root: root), target: target) {
     Accepted { value: source, diagnostics: d } =>
       (source.carried == expected) && (source.carried != wrong) && (d == None)
-    Rejected { diagnostics: _ } => false
+    Rejected { diagnostics: ds } =>
+      diagnostics_fatal_reason(d: ds) == ^rust_logic_meet_emit_holds
   }
 }
 
diff --git a/src/v2/test/claim/emitted_closure_crate_partition_test.dag b/src/v2/test/claim/emitted_closure_crate_partition_test.dag
index 4f5868da1cb..63be3453484 100644
--- a/src/v2/test/claim/emitted_closure_crate_partition_test.dag
+++ b/src/v2/test/claim/emitted_closure_crate_partition_test.dag
@@ -2,10 +2,13 @@ module v2.test.claim.emitted_closure_crate_partition
 
 import std.types { Bool, Int, List, String }
 import v2.lens.module_graph { dependency_resolution_facts_live, module_declaration_facts_live }
-import v2.std.collection { map_get }
+import v2.std.collection { map_get_checked }
 import v2.std.diagnostic { Accepted, Rejected }
 import std.optional { Absent, Present }
-import v2.std.compilers.compilation_unit {
+import gunbc.crate_partition {
+  PartitionPolicy,
+  ResolvePartitionOk,
+  ResolvePartitionRefused,
   CompilationUnitId,
   HandExplicit,
   ModuleId,
@@ -20,11 +23,6 @@ import v2.workflow.emitted_closure_crate_partition {
   derived_policy_partition,
   module_dag_from_dependency_facts
 }
-import v2.workflow.rust_crate_partition {
-  PartitionPolicy,
-  ResolvePartitionOk,
-  ResolvePartitionRefused
-}
 
 // THE INHABITANCE CLAIM FOR THE DERIVED CRATE PARTITION: the real fact producers, the real DAG
 // derivation and the real policy resolver, run over a source tree rather than handed a DAG. The
@@ -59,7 +57,7 @@ fn fixture_partition_at(root: String, entry: String) -> EmittedClosurePartitionO
 }
 
 fn owner_of(assignment: Map<ModuleId, CompilationUnitId>, module_id: String) -> String {
-  match map_get(assignment, module_id as ModuleId) {
+  match map_get_checked(assignment, module_id as ModuleId) {
     Accepted { value: Present { value: unit }, diagnostics: _ } => unit as String
     Accepted { value: Absent, diagnostics: _ } => "unowned"
     Rejected { diagnostics: _ } => "unowned"
diff --git a/src/v2/test/claim/emitted_crate_workspace_witness_test.dag b/src/v2/test/claim/emitted_crate_workspace_witness_test.dag
index 65e52531931..b8f146aba2a 100644
--- a/src/v2/test/claim/emitted_crate_workspace_witness_test.dag
+++ b/src/v2/test/claim/emitted_crate_workspace_witness_test.dag
@@ -1,63 +1,68 @@
 module test.claim.emitted_crate_workspace_witness
 
-import std.types { Bool, List, String }
-import v2.std.collection { empty_map }
-import v2.std.compilers.compilation_unit { ModuleDag, ModuleDagEdge, ModuleId }
+import std.types { Bool, Int, List, String }
+import gunbc.crate_partition { EmitterReverseEdge }
+import gunbc.rust_emitted_edge {
+  EmittedEdge,
+  declared_import_edge,
+  inline_path_reference_edge,
+  rust_prelude_emitted_edges,
+  semantic_source_reference_edge
+}
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import v2.workflow.emitted_crate_workspace {
+import gunbc.emitted_crate_workspace {
   EmittedWorkspacePlanned,
+  EmittedWorkspaceOutcome,
   EmittedWorkspaceRefused,
-  EmittedWorkspaceClosuresDisagree,
   EmittedWorkspaceNoDiscriminatingEdge,
-  emitted_workspace_plan_over,
+  EmittedWorkspaceRedPlanned,
+  EmittedWorkspaceRedRefused,
+  emitted_workspace_plan_from_emission,
+  emitted_workspace_build_from_emission,
+  EmittedWorkspaceBuildOutcome,
+  EmittedWorkspaceBuildPlanned,
+  EmittedWorkspaceBuildRefused,
+  EmittedWorkspaceEdgeMergeRefused,
+  emitted_workspace_red_over,
   emitted_workspace_runtime_package
 }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
-// ── THE PLAN OVER A SUPPLIED CHAIN, a -> b -> c, ONE MODULE PER CRATE ─────────────────────────
+// ── THE PLAN OF AN EMITTED CHAIN, a -> b -> c, ONE MODULE PER CRATE ─────────────────────────
 //
-// The subject is v2.workflow.emitted_crate_workspace emitted_workspace_plan_over: given a module
-// DAG, the basenames the emission wrote and its returned edges, which crate rows does it
-// derive and which dependency does the RED drop. The DAG and edges are supplied, because the claim
-// is about the plan, not about the live closure; the live closure is the instrument
-// //gunbc/instruments:emitted-crate-workspace's subject, which renders these rows and builds them.
-
-fn chain_dag() -> ModuleDag {
-  ModuleDag {
-    modules: ["fx.a" as ModuleId, "fx.b" as ModuleId, "fx.c" as ModuleId],
-    edges: [
-      ModuleDagEdge { from: "fx.a" as ModuleId, to: "fx.b" as ModuleId },
-      ModuleDagEdge { from: "fx.b" as ModuleId, to: "fx.c" as ModuleId }
-    ],
-    exports: empty_map(),
-    type_definitions: empty_map()
-  }
-}
+// The subject is gunbc.emitted_crate_workspace emitted_workspace_plan_from_emission: given the
+// basenames an emission wrote and its returned edges, which crate rows does it derive and which
+// dependency does the RED drop. The emission is supplied, because the claim is about the plan; the
+// real emission reaching it is exercised by every emitted-Rust build (the v2-native-cli and
+// self-host instruments, and //gunbc/instruments:emitted-crate-workspace, which also builds the RED).
 
 fn chain_emitted_basenames() -> List<String> { ["fx_a", "fx_b", "fx_c", "v1_rt"] }
 
-// The emission's own edges for the chain: every module's prelude into the runtime and the crate
-// root, and the use-lines a names b and b names c.
-fn chain_edge_froms() -> List<String> { ["fx_a", "fx_a", "fx_b", "fx_b", "fx_c", "fx_c", "fx_a", "fx_b"] }
-fn chain_edge_tos() -> List<String> { ["v1_rt", "", "v1_rt", "", "v1_rt", "", "fx_b", "fx_c"] }
-fn chain_edge_provenances() -> List<String> {
-  ["runtime-prelude", "reexport-facade", "runtime-prelude", "reexport-facade", "runtime-prelude", "reexport-facade",
-   "semantic-source-reference", "semantic-source-reference"]
+fn chain_preludes() -> List<EmittedEdge> {
+  ["fx_a", "fx_b", "fx_c"] |> flat_map(m => rust_prelude_emitted_edges(module: m))
+}
+
+// The chain's source edges are its declared imports, and the emitter also wrote them as use-lines,
+// which is what gives the RED a path rustc must stop resolving.
+fn chain_edges() -> List<EmittedEdge> {
+  concat(chain_preludes(), [
+    declared_import_edge(from: "fx_a", to_module: "fx_b"),
+    declared_import_edge(from: "fx_b", to_module: "fx_c"),
+    semantic_source_reference_edge(from: "fx_a", to_module: "fx_b"),
+    semantic_source_reference_edge(from: "fx_b", to_module: "fx_c")
+  ])
+}
+
+fn chain_plan(target_crate_count: Int) -> EmittedWorkspaceOutcome {
+  emitted_workspace_plan_from_emission(emitted_basenames: chain_emitted_basenames(), edges: chain_edges(), target_crate_count: target_crate_count)
 }
 
 // A crate's re-exports are its TRANSITIVE dependency packages plus the runtime; the top crate
 // therefore re-exports both crates below it, and the RED drops an IRREDUNDANT edge -- one no other
 // dependency re-exports by a second road.
 test fn the_chain_plans_three_crates_plus_the_runtime_with_transitive_reexports() -> Bool {
-  match emitted_workspace_plan_over(
-    module_dag: chain_dag(),
-    emitted_basenames: chain_emitted_basenames(),
-    edge_froms: chain_edge_froms(),
-    edge_tos: chain_edge_tos(),
-    edge_provenances: chain_edge_provenances(),
-    target_crate_count: 3
-  ) {
+  match chain_plan(target_crate_count: 3) {
     EmittedWorkspacePlanned { plan: plan } =>
       plan.crate_count == 4
         && plan.module_count == 3
@@ -69,97 +74,147 @@ test fn the_chain_plans_three_crates_plus_the_runtime_with_transitive_reexports(
 }
 
 test fn the_red_drops_an_edge_the_emitter_wrote_as_a_use_line() -> Bool {
-  match emitted_workspace_plan_over(
-    module_dag: chain_dag(),
+  match chain_plan(target_crate_count: 3) {
+    EmittedWorkspacePlanned { plan: plan } =>
+      match emitted_workspace_red_over(plan: plan) {
+        EmittedWorkspaceRedPlanned { red: red, red_rows: red_rows } =>
+          red.package != red.dropped_package
+            && ((red.from_module == "fx_a" && red.to_module == "fx_b") || (red.from_module == "fx_b" && red.to_module == "fx_c"))
+            && red_rows |> any(r => r.package_name == red.package && !(r.reexport_packages |> any(p => p == red.dropped_package)))
+            && plan.rows |> any(r => r.package_name == red.package && (r.reexport_packages |> any(p => p == red.dropped_package)))
+        EmittedWorkspaceRedRefused { cause: _ } => false
+      }
+    EmittedWorkspaceRefused { cause: _ } => false
+  }
+}
+
+// One crate: the layout is a valid workspace (one module crate plus the runtime crate), so the
+// partitioner subsumes the single-package case. Nothing crosses a crate boundary, so the
+// instrument's RED is not authorable and only `emitted_workspace_red_over` refuses.
+test fn a_single_crate_plan_is_a_layout_with_the_runtime_crate() -> Bool {
+  match chain_plan(target_crate_count: 1) {
+    EmittedWorkspacePlanned { plan: plan } =>
+      plan.crate_count == 2
+        && plan.rows |> any(r => r.package_name == emitted_workspace_runtime_package)
+        && plan.rows |> any(r => (r.modules |> count) == 3)
+    EmittedWorkspaceRefused { cause: _ } => false
+  }
+}
+
+test fn a_single_crate_plan_has_no_red_for_want_of_a_discriminating_edge() -> Bool {
+  match chain_plan(target_crate_count: 1) {
+    EmittedWorkspacePlanned { plan: plan } =>
+      match emitted_workspace_red_over(plan: plan) {
+        EmittedWorkspaceRedRefused { cause: EmittedWorkspaceNoDiscriminatingEdge } => true
+        _ => false
+      }
+    EmittedWorkspaceRefused { cause: _ } => false
+  }
+}
+
+// ── THE PRODUCTION PLAN, FROM THE EMISSION ALONE ─────────────────────────────────────────────
+//
+// The DAG's nodes are the emitted basenames and its source edges are the DeclaredImport and
+// InlinePathReference edges. Here the chain's dependencies arrive only as source edges (no
+// surviving use-line), which is the case those edges exist for.
+
+fn emission_edges() -> List<EmittedEdge> {
+  concat(chain_preludes(), [
+    declared_import_edge(from: "fx_a", to_module: "fx_b"),
+    declared_import_edge(from: "fx_b", to_module: "fx_c")
+  ])
+}
+
+test fn the_emission_alone_plans_the_chain_by_its_declared_imports() -> Bool {
+  match emitted_workspace_plan_from_emission(
     emitted_basenames: chain_emitted_basenames(),
-    edge_froms: chain_edge_froms(),
-    edge_tos: chain_edge_tos(),
-    edge_provenances: chain_edge_provenances(),
+    edges: emission_edges(),
     target_crate_count: 3
   ) {
     EmittedWorkspacePlanned { plan: plan } =>
-      plan.red.package != plan.red.dropped_package
-        && ((plan.red.from_module == "fx_a" && plan.red.to_module == "fx_b") || (plan.red.from_module == "fx_b" && plan.red.to_module == "fx_c"))
-        && plan.red_rows |> any(r => r.package_name == plan.red.package && !(r.reexport_packages |> any(p => p == plan.red.dropped_package)))
-        && plan.rows |> any(r => r.package_name == plan.red.package && (r.reexport_packages |> any(p => p == plan.red.dropped_package)))
+      plan.crate_count == 4
+        && plan.module_count == 3
+        && plan.rows |> any(r => (r.modules |> any(m => m == "fx_a")) && (r.reexport_packages |> count) == 3)
+        && plan.rows |> any(r => (r.modules |> any(m => m == "fx_c")) && (r.reexport_packages |> count) == 1)
     EmittedWorkspaceRefused { cause: _ } => false
   }
 }
 
-// One crate: nothing crosses a crate boundary, so no RED is authorable, and the plan refuses
-// rather than reporting a build it cannot discriminate.
-test fn a_single_crate_plan_refuses_for_want_of_a_discriminating_edge() -> Bool {
-  match emitted_workspace_plan_over(
-    module_dag: chain_dag(),
+// The required refusal survives the move off the corpus: a use-line c -> a against the declared
+// a -> b -> c closes a cycle the source never had, and refuses by name rather than merging.
+test fn an_emitter_edge_against_the_declared_imports_refuses_as_a_reverse_edge() -> Bool {
+  match emitted_workspace_plan_from_emission(
     emitted_basenames: chain_emitted_basenames(),
-    edge_froms: chain_edge_froms(),
-    edge_tos: chain_edge_tos(),
-    edge_provenances: chain_edge_provenances(),
-    target_crate_count: 1
+    edges: concat(emission_edges(), [semantic_source_reference_edge(from: "fx_c", to_module: "fx_a")]),
+    target_crate_count: 3
   ) {
-    EmittedWorkspaceRefused { cause: EmittedWorkspaceNoDiscriminatingEdge } => true
+    EmittedWorkspaceRefused { cause: EmittedWorkspaceEdgeMergeRefused { cause: EmitterReverseEdge { from: _, to: _, provenance: _ } } } => true
     _ => false
   }
 }
 
-test fn a_dag_module_the_emission_did_not_produce_refuses_by_name() -> Bool {
-  match emitted_workspace_plan_over(
-    module_dag: chain_dag(),
-    emitted_basenames: ["fx_a", "fx_b", "v1_rt"],
-    edge_froms: [],
-    edge_tos: [],
-    edge_provenances: [],
-    target_crate_count: 3
-  ) {
-    EmittedWorkspaceRefused { cause: EmittedWorkspaceClosuresDisagree { not_emitted: n, outside_dag: o } } =>
-      n == ["fx.c"] && (o |> count) == 0
-    _ => false
+// ── THE BUILDABLE WORKSPACE: LAYOUT PLUS THE TOP PACKAGE THE EMITTED MAIN PATHS THROUGH ───────
+
+fn chain_build(bin_name: String) -> EmittedWorkspaceBuildOutcome {
+  emitted_workspace_build_from_emission(
+    emitted_basenames: chain_emitted_basenames(),
+    edges: emission_edges(),
+    target_crate_count: 3,
+    crate_name: "fx_app",
+    bin_name: bin_name
+  )
+}
+
+test fn the_top_package_re_exports_every_module_of_the_layout() -> Bool {
+  match chain_build(bin_name: "fx_app") {
+    EmittedWorkspaceBuildPlanned { build: build } =>
+      (build.rows |> count) == 5
+        && build.top_package == "fx_app"
+        && build.rows |> any(r => r.package_name == "fx_app" && r.crate_dir == "."
+          && ["fx_a", "fx_b", "fx_c", "v1_rt"] |> all(m => r.modules |> any(x => x == m)))
+        && build.bin_source_path == "src/main.rs"
+    EmittedWorkspaceBuildRefused { cause: _ } => false
   }
 }
 
-// dry_run is a declared emit-only basename: emitted with no DAG module, it is admitted beside v1_rt.
-test fn a_declared_emit_only_basename_is_not_outside_the_dag() -> Bool {
-  match emitted_workspace_plan_over(
-    module_dag: chain_dag(),
-    emitted_basenames: ["fx_a", "fx_b", "fx_c", "v1_rt", "dry_run"],
-    edge_froms: chain_edge_froms(),
-    edge_tos: chain_edge_tos(),
-    edge_provenances: chain_edge_provenances(),
-    target_crate_count: 3
-  ) {
-    EmittedWorkspacePlanned { plan: plan } =>
-      plan.rows |> any(r => r.package_name == emitted_workspace_runtime_package && r.modules |> any(m => m == "dry_run"))
-    EmittedWorkspaceRefused { cause: _ } => false
+// A binary named apart from its package lives where Cargo discovers a named binary.
+test fn a_binary_named_apart_from_its_package_takes_cargos_bin_path() -> Bool {
+  match chain_build(bin_name: "probe_fx") {
+    EmittedWorkspaceBuildPlanned { build: build } => build.bin_source_path == "src/bin/probe_fx.rs"
+    EmittedWorkspaceBuildRefused { cause: _ } => false
   }
 }
 
-// A closure the emitter wrote no dry_run for (no services) plans a runtime crate that names none.
-test fn the_runtime_crate_names_dry_run_only_when_the_emission_wrote_it() -> Bool {
-  match emitted_workspace_plan_over(
-    module_dag: chain_dag(),
+// Two modules that reach each other ONLY by inline path are a source SCC: InlinePathReference is a
+// source edge, so the pair is one component in one crate rather than an emitter edge refused as
+// reversed against the other.
+test fn modules_reaching_each_other_only_by_path_share_one_crate() -> Bool {
+  match emitted_workspace_plan_from_emission(
     emitted_basenames: chain_emitted_basenames(),
-    edge_froms: chain_edge_froms(),
-    edge_tos: chain_edge_tos(),
-    edge_provenances: chain_edge_provenances(),
+    edges: concat(chain_preludes(), [
+      declared_import_edge(from: "fx_a", to_module: "fx_b"),
+      inline_path_reference_edge(from: "fx_b", to_module: "fx_c"),
+      inline_path_reference_edge(from: "fx_c", to_module: "fx_b")
+    ]),
     target_crate_count: 3
   ) {
     EmittedWorkspacePlanned { plan: plan } =>
-      plan.rows |> any(r => r.package_name == emitted_workspace_runtime_package && !(r.modules |> any(m => m == "dry_run")))
+      plan.rows |> any(r => (r.modules |> any(m => m == "fx_b")) && (r.modules |> any(m => m == "fx_c")))
     EmittedWorkspaceRefused { cause: _ } => false
   }
 }
 
-test fn an_emitted_module_outside_the_dag_refuses_by_name() -> Bool {
-  match emitted_workspace_plan_over(
-    module_dag: chain_dag(),
-    emitted_basenames: ["fx_a", "fx_b", "fx_c", "v1_rt", "fx_stray"],
-    edge_froms: [],
-    edge_tos: [],
-    edge_provenances: [],
+// The same cycle closed by a USE-LINE the emitter proposed is an emitter defect, and still refuses.
+test fn a_use_line_closing_a_cycle_against_an_inline_path_refuses_as_a_reverse_edge() -> Bool {
+  match emitted_workspace_plan_from_emission(
+    emitted_basenames: chain_emitted_basenames(),
+    edges: concat(chain_preludes(), [
+      inline_path_reference_edge(from: "fx_b", to_module: "fx_c"),
+      semantic_source_reference_edge(from: "fx_c", to_module: "fx_b")
+    ]),
     target_crate_count: 3
   ) {
-    EmittedWorkspaceRefused { cause: EmittedWorkspaceClosuresDisagree { not_emitted: n, outside_dag: o } } =>
-      (n |> count) == 0 && o == ["fx_stray"]
+    EmittedWorkspaceRefused { cause: EmittedWorkspaceEdgeMergeRefused { cause: EmitterReverseEdge { from: _, to: _, provenance: _ } } } => true
     _ => false
   }
 }
diff --git a/src/v2/test/claim/execution/dag_grammar_backward_round_trip_test.dag b/src/v2/test/claim/execution/dag_grammar_backward_round_trip_test.dag
index 99d31721b47..ac9147312dd 100644
--- a/src/v2/test/claim/execution/dag_grammar_backward_round_trip_test.dag
+++ b/src/v2/test/claim/execution/dag_grammar_backward_round_trip_test.dag
@@ -31,7 +31,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 fn rt_parse(text: String) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } => dag_round_trip_parse(prepared: prepared, residue: residue, text: text)
+    Accepted { value: prepared, diagnostics: _ } => dag_round_trip_parse(prepared: prepared, text: text)
   }
 }
 
diff --git a/src/v2/test/claim/execution/emit_host_complement_equals_eval_test.dag b/src/v2/test/claim/execution/emit_host_complement_equals_eval_test.dag
index e2e450e1e22..4428a4072dc 100644
--- a/src/v2/test/claim/execution/emit_host_complement_equals_eval_test.dag
+++ b/src/v2/test/claim/execution/emit_host_complement_equals_eval_test.dag
@@ -141,9 +141,9 @@ fn emit_complement_eval_bool_false(value: RuntimeValue) -> Bool {
 fn emit_complement_eval_allocate_literal(node: Node, _env: EvaluationEnvironment) -> Outcome<RuntimeValue> {
   match node.kind {
     TypeNode { connective: Atom { identity: id } } =>
-      if id == ^dag_complement_lit_true {
+      if id == ^dag_token_kw_true {
         outcome_accepted(value: emit_complement_eval_octet_value(n: 1))
-      } else if id == ^dag_complement_lit_false {
+      } else if id == ^dag_token_kw_false {
         outcome_accepted(value: emit_complement_eval_octet_value(n: 0))
       } else {
         outcome_rejected(
diff --git a/src/v2/test/claim/execution/emit_host_identity_cast_native_test.dag b/src/v2/test/claim/execution/emit_host_identity_cast_native_test.dag
index 634d8e9d899..4079912436d 100644
--- a/src/v2/test/claim/execution/emit_host_identity_cast_native_test.dag
+++ b/src/v2/test/claim/execution/emit_host_identity_cast_native_test.dag
@@ -14,16 +14,15 @@ import v2.std.text { String }
 import v2.std.witness { Violates }
 import v2.test.claim.coercion.identity_cast_emission_route {
   IdentityCastClosureRefused, IdentityCastEntryEmitted, IdentityCastEntryRefused,
-  identity_cast_route_admitted_holds, identity_cast_route_verdict,
+  identity_cast_route_verdict,
 }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
-// THE ADMITTED IDENTITY CAST, BUILT AND RUN. identity_cast_route_verdict is the real door; this
-// module reads the same verdict the required-gate inhabitance already asserted, then builds and
-// runs it. The last merge-time execution of the door is
-// v2.test.claim.coercion.identity_cast_emission_route.an_admitted_identity_cast_emits_through_the_closure_route_holds,
-// not this module.
+// THE ADMITTED IDENTITY CAST, BUILT AND RUN. One native control reads the REAL member text from
+// identity_cast_route_verdict and every runtime case builds and runs that artifact (DESIGN section 3
+// pairing). The last merge-time execution of the door on the required gate is still
+// v2.test.claim.coercion.identity_cast_emission_route.an_admitted_identity_cast_emits_through_the_closure_route_holds.
 //
 // STANDING, STATED SO IT IS NOT READ AS COVERAGE: this module is outside the required gate
 // (v2.workflow.required_floor required_gate_authored_modules) by operator decision, because every
@@ -46,19 +45,18 @@ fn identity_cast_native_inputs() -> Inputs {
   inputs_root_only(root: node_synthetic(kind: v2.std.node.TypeNode { connective: v2.std.node.Atom { identity: ^identity_cast_native_probe } }, children: []))
 }
 
-// The entry member's emitted text, read from the route module's shared verdict rather than emitted a
-// second time: the text built here is the text the admission row asserted on. Absent when the route
-// did not emit exactly the entry.
+// The entry member's emitted text from the closure door. Absent when the route did not emit exactly
+// one admitted entry. Runtime cases share this control; they do not substitute a supplied spelling.
 fn identity_cast_native_emitted() -> Optional<String> {
-  let v = identity_cast_route_verdict()
-  if identity_cast_route_admitted_holds(v: v) {
-    match v {
-      IdentityCastEntryEmitted { text: t, members: _ } => optional_present(value: t)
-      IdentityCastEntryRefused { reason: _, members: _ } => optional_absent()
-      IdentityCastClosureRefused { reason: _ } => optional_absent()
-    }
-  } else {
-    optional_absent()
+  match identity_cast_route_verdict() {
+    IdentityCastEntryEmitted { text: t, members: n } =>
+      if n == 1 {
+        optional_present(value: t)
+      } else {
+        optional_absent()
+      }
+    IdentityCastEntryRefused { reason: _, members: _ } => optional_absent()
+    IdentityCastClosureRefused { reason: _ } => optional_absent()
   }
 }
 
diff --git a/src/v2/test/claim/execution/emit_host_meet_join_equals_eval_test.dag b/src/v2/test/claim/execution/emit_host_meet_join_equals_eval_test.dag
index ce7e332aeaf..3918c781669 100644
--- a/src/v2/test/claim/execution/emit_host_meet_join_equals_eval_test.dag
+++ b/src/v2/test/claim/execution/emit_host_meet_join_equals_eval_test.dag
@@ -148,9 +148,9 @@ fn meet_join_eval_bool_false(value: RuntimeValue) -> Bool {
 fn meet_join_eval_allocate_literal(node: Node, _env: EvaluationEnvironment) -> Outcome<RuntimeValue> {
   match node.kind {
     TypeNode { connective: Atom { identity: id } } =>
-      if id == ^dag_complement_lit_true {
+      if id == ^dag_token_kw_true {
         outcome_accepted(value: meet_join_eval_octet_value(n: 1))
-      } else if id == ^dag_complement_lit_false {
+      } else if id == ^dag_token_kw_false {
         outcome_accepted(value: meet_join_eval_octet_value(n: 0))
       } else {
         outcome_rejected(
diff --git a/src/v2/test/claim/execution/emit_host_variant_construct_equals_eval_test.dag b/src/v2/test/claim/execution/emit_host_variant_construct_equals_eval_test.dag
index 55e2a0f2e4b..f571a23991a 100644
--- a/src/v2/test/claim/execution/emit_host_variant_construct_equals_eval_test.dag
+++ b/src/v2/test/claim/execution/emit_host_variant_construct_equals_eval_test.dag
@@ -49,6 +49,7 @@ import v2.std.diagnostic {
 import v2.std.node {
   Atom,
   Conj,
+  ConstructTagEdge,
   Edge,
   Node,
   Symbol,
@@ -56,7 +57,6 @@ import v2.std.node {
   MatchArmBodyEdge,
 }
 import v2.std.node_query {
-  find_named_child,
   find_core_child,
 }
 import v2.std.runtime {
@@ -141,7 +141,7 @@ fn emit_variant_construct_eval_variant_tag_id(node: Node) -> Outcome<Symbol> {
   match node.kind {
     TypeNode { connective: Atom { identity: id } } => outcome_accepted(value: id)
     TypeNode { connective: Conj } =>
-      match find_named_child(root: node, name: ^dag_binding_type_variant_holds) {
+      match find_core_child(root: node, marker: ConstructTagEdge) {
         Accepted { value: tag_node, diagnostics: _ } =>
           match tag_node.kind {
             TypeNode { connective: Atom { identity: id } } => outcome_accepted(value: id)
diff --git a/src/v2/test/claim/execution/long/emit_host_classical_not_ingested_equals_eval_test.dag b/src/v2/test/claim/execution/long/emit_host_classical_not_ingested_equals_eval_test.dag
index 976bf823584..f63f6434c8f 100644
--- a/src/v2/test/claim/execution/long/emit_host_classical_not_ingested_equals_eval_test.dag
+++ b/src/v2/test/claim/execution/long/emit_host_classical_not_ingested_equals_eval_test.dag
@@ -1,5 +1,6 @@
 module v2.test.long.emit_host_classical_not_ingested_equals_eval
 
+import v2.std.member_declaration_kind { no_member_declaration_kinds }
 import std.types { List }
 import v2.compiler.refinement_discharge { infer_and_discharge }
 import std.occurrence_identity { OccurrenceSynthetic }
@@ -148,7 +149,7 @@ fn ingested_arrow_from_source(source: String) -> Outcome<ResolvedTree> {
     f: fn(resolved) {
       match ingested_find_arrow_in_module(root: resolved.root) {
         Present { value: arrow } =>
-          outcome_accepted(value: ResolvedTree { root: arrow, symbol_index: empty_symbol_index(), resolved_declarations: resolved.resolved_declarations, lexical_bindings: resolved.lexical_bindings, unavailable_providers: resolved.unavailable_providers })
+          outcome_accepted(value: ResolvedTree { root: arrow, symbol_index: empty_symbol_index(), resolved_declarations: resolved.resolved_declarations, lexical_bindings: resolved.lexical_bindings, unavailable_providers: resolved.unavailable_providers, member_kinds: no_member_declaration_kinds() })
         Absent =>
           outcome_rejected(
             d: ingested_classical_not_diagnostic(reason: ^ingested_classical_not_arrow_miss, node: resolved.root)
diff --git a/src/v2/test/claim/execution/self_host_candidate_generation_test.dag b/src/v2/test/claim/execution/self_host_candidate_generation_test.dag
index e914a9d3d8c..bcfc589788e 100644
--- a/src/v2/test/claim/execution/self_host_candidate_generation_test.dag
+++ b/src/v2/test/claim/execution/self_host_candidate_generation_test.dag
@@ -37,7 +37,7 @@ import v2.test.manual.sg2_type_expression_projection {
 }
 import v2.std.algebra { bag_eq, length }
 import std.algebra { list_snoc_item }
-import v2.std.diagnostic { Accepted, None, Rejected }
+import v2.std.diagnostic { Accepted, None, Rejected, diagnostics_fatal_reason }
 import v2.std.node { Symbol }
 import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree }
 
@@ -154,7 +154,8 @@ fn translate_error_profile_sg2_projected_arrow_serialize_known() -> Bool {
     emitted: sg2_project_arrow_emitted()
   ) {
     Accepted { value: source, diagnostics: _ } => source.carried == sg2_expected_arrow_text
-    Rejected { diagnostics: _ } => false
+    Rejected { diagnostics: ds } =>
+      diagnostics_fatal_reason(d: ds) == ^translate_error_profile_sg2_projected_arrow_serialize_accepts
   }
 }
 
@@ -164,7 +165,8 @@ fn translate_error_profile_sg2_projected_conj_serialize_known() -> Bool {
     emitted: sg2_project_conj_emitted()
   ) {
     Accepted { value: source, diagnostics: _ } => source.carried == sg2_expected_conj_text
-    Rejected { diagnostics: _ } => false
+    Rejected { diagnostics: ds } =>
+      diagnostics_fatal_reason(d: ds) == ^translate_error_profile_sg2_projected_conj_serialize_accepts
   }
 }
 
@@ -174,7 +176,8 @@ fn translate_error_profile_sg2_projected_instantiation_serialize_known() -> Bool
     emitted: sg2_project_instantiation_emitted()
   ) {
     Accepted { value: source, diagnostics: _ } => source.carried == sg2_expected_type_text
-    Rejected { diagnostics: _ } => false
+    Rejected { diagnostics: ds } =>
+      diagnostics_fatal_reason(d: ds) == ^translate_error_profile_sg2_projected_instantiation_serialize_accepts
   }
 }
 
diff --git a/src/v2/test/claim/field_projection/field_projection_stages_test.dag b/src/v2/test/claim/field_projection/field_projection_stages_test.dag
index 8752abcbfab..ce727a5adb6 100644
--- a/src/v2/test/claim/field_projection/field_projection_stages_test.dag
+++ b/src/v2/test/claim/field_projection/field_projection_stages_test.dag
@@ -769,7 +769,8 @@ fn fps_root_kind_namespace() -> Namespace {
       declared_type_params: index.declared_type_params,
       declared_resources: index.declared_resources,
       namespace_bodies: index.namespace_bodies,
-      module_roots: index.module_roots
+      module_roots: index.module_roots,
+      primitive_contracts: index.primitive_contracts
     },
     module_qn: base.module_qn,
     test_code: base.test_code,
diff --git a/src/v2/test/claim/fold_lowering_test.dag b/src/v2/test/claim/fold_lowering_test.dag
index 414fa990b89..b65c01fa67d 100644
--- a/src/v2/test/claim/fold_lowering_test.dag
+++ b/src/v2/test/claim/fold_lowering_test.dag
@@ -82,7 +82,7 @@ data paramless_step_fold_snippet: String = "module paramless_step_probe\n\nfn f(
 // refusal it produced was correct.
 fn ingest(source_text: String, file: Symbol) -> Optional<Node> {
   let lm = dag_language_model()
-  match tokenize(text: source_text, file: file, rules: lm.lex) {
+  match tokenize_prepared(text: source_text, file: file, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: _ } => Absent
     Accepted { value: ts, diagnostics: _ } =>
       match parse_module(tokens: ts, grammar: lm.grammar) {
diff --git a/src/v2/test/claim/generated/language_behavior_equivalence_test.dag b/src/v2/test/claim/generated/language_behavior_equivalence_test.dag
index 0287688d57c..acdb1e5a669 100644
--- a/src/v2/test/claim/generated/language_behavior_equivalence_test.dag
+++ b/src/v2/test/claim/generated/language_behavior_equivalence_test.dag
@@ -9,7 +9,6 @@ import v2.compiler.eval {
   eval_diagnostic,
   run_test_claim,
   run_test_claim_assert,
-  test_claim_cache_receipt,
   test_claim_typed_input_node
 }
 import v2.std.collection { Absent }
@@ -238,15 +237,6 @@ fn lbe_emit_rejection_sentinel_claim(
   }
 }
 
-fn lbe_rejected_emit_cache_receipt(
-  label: String,
-  mock: LanguageBehaviorIoMock,
-  expected: NonEmptyDiagnostics
-) -> TestClaimCacheReceipt<Node> {
-  let claim = lbe_emit_rejection_sentinel_claim(label: label, mock: mock, expected: expected)
-  test_claim_cache_receipt(subject: lbe_subject_from_claim(claim: claim))
-}
-
 fn lbe_run_test_claim_assert_from_emit(
   anchor: ManualAnchorKey,
   label: String,
@@ -270,7 +260,7 @@ fn lbe_test_claim_run_from_emit(
       lbe_run_via_test_claim(claim: claim)
     Rejected { diagnostics: d } =>
       TestClaimRun {
-        cache: lbe_rejected_emit_cache_receipt(label: label, mock: mock, expected: d),
+        claim: lbe_emit_rejection_sentinel_claim(label: label, mock: mock, expected: d),
         verdict: SemanticMismatch { actual: Rejected { diagnostics: d }, falsification: Absent }
       }
   }
diff --git a/src/v2/test/claim/integer/interval_derivation_test.dag b/src/v2/test/claim/integer/interval_derivation_test.dag
index e20f959b651..bab9b6fee5f 100644
--- a/src/v2/test/claim/integer/interval_derivation_test.dag
+++ b/src/v2/test/claim/integer/interval_derivation_test.dag
@@ -4,28 +4,8 @@ import std.types { List }
 import std.algebra { Cons, Empty, FreeMonoid }
 import v2.std.algebra { Equal, Ordering, fold_list, length }
 import v2.std.diagnostic { Accepted, Outcome, Rejected }
-import v2.std.integer {
-  D0, D1, D2, D3, D4, D5, D6, D7, D8, D9,
-  DecimalNonZeroMagnitude,
-  IntegerBoundNegative, IntegerBoundNonNegative,
-  IntegerIntervalBound, IntegerIntervalSpec,
-  NonZeroD1, NonZeroD2, NonZeroD3, NonZeroD4, NonZeroD6, NonZeroD9,
-  Signed, Unsigned, Signedness,
-  StandardIntegerType,
-  Int8, Int16, Int32, Int64, Int128,
-  UInt8, UInt16, UInt32, UInt64, UInt128,
-  integer_concrete_bound, integer_concrete_zero, integer_interval,
-  integer_interval_bound_compare, integer_interval_bound_less_or_equal,
-  integer_interval_spec_node,
-  integer_machine_interval_spec,
-  integer_pow2_magnitude,
-  integer_standard_integer_type_from_node,
-  integer_standard_integer_type_interval_spec,
-  integer_standard_integer_type_roster,
-  integer_standard_integer_type_signedness,
-  integer_standard_integer_type_width_bits,
-  integer_nonzero_decimal_digit_widen
-}
+import v2.std.integer { DecimalNonZeroMagnitude, IntegerBoundNegative, IntegerBoundNonNegative, IntegerIntervalBound, IntegerIntervalSpec, NonZeroD1, NonZeroD2, NonZeroD3, NonZeroD4, NonZeroD6, NonZeroD9, Signed, Unsigned, Signedness, StandardIntegerType, Int8, Int16, Int32, Int64, Int128, UInt8, UInt16, UInt32, UInt64, UInt128, integer_concrete_bound, integer_concrete_zero, integer_interval, integer_interval_bound_compare, integer_interval_bound_less_or_equal, integer_interval_spec_node, integer_machine_interval_spec, integer_pow2_magnitude, integer_standard_integer_type_from_node, integer_standard_integer_type_interval_spec, integer_standard_integer_type_roster, integer_standard_integer_type_signedness, integer_standard_integer_type_width_bits, integer_nonzero_decimal_digit_widen }
+import std.nat { D0, D1, D2, D3, D4, D5, D6, D7, D8, D9 }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
diff --git a/src/v2/test/claim/long/caller_admission_native_wall_red_test.dag b/src/v2/test/claim/long/caller_admission_native_wall_red_test.dag
new file mode 100644
index 00000000000..5443f8220b2
--- /dev/null
+++ b/src/v2/test/claim/long/caller_admission_native_wall_red_test.dag
@@ -0,0 +1,116 @@
+// caller_admission_native_wall_red_test -- THE ONE REAL-PATH INHABITANCE CLAIM for the
+// former drop gunbc.rung_drop.admit_callers_discarded_on_the_native_route, in the LONG HOME
+// (module v2.test.claim.long.* is structurally too expensive for the armed line: the interpreter's
+// parse of even a trivial source dominates -- 496,179 eval steps / 1421ms cpu for a two-module
+// fixture against the 72,300 new-witness budget, CI floor run at 8528a59b45 -- so the whole-pipeline
+// cost is admitted here and nowhere else: withheld from the required floor's charged clock by its
+// typed v2.workflow.floor_cost_debt row, verdict-proven in the changed-witness lane where
+// required_floor long_home_prefixes admit it as ChangedCostDebtVerdictOnly, and proven for its
+// verdict without the eval budget: the claim PASSED when run for its verdict, receipts in the row
+// and in the PR).
+//
+// WHAT IT INHABITS: the native route end to end -- the peer module's body lowering carries the
+// admit clause onto the sealed fn's Arrow as a structured roster, the subject module imports the
+// sealed fn, infer gathers the imported callee's clause through the call's facts entry, and the
+// wall refuses a call from a declaration the roster does not name. That is the trigger the drop
+// was declared against, and the claim goes red if any stage of it is removed: no carrier edge, no
+// facts read across the import, no judge, and the wall does not fire.
+//
+// The judge's positive direction and both failure arms are pinned hermetically in
+// src/v2/test/claim/caller_admission_native_wall_test.dag over hand-built values, so this file
+// carries exactly one pipeline claim (DESIGN section 3's witness rule: one real-path inhabitance
+// claim, admitted where over-budget claims are admitted).
+
+module v2.test.claim.long.caller_admission_native_wall_red
+
+import extdeps.communication.medium { Lossless, Medium }
+import std.algebra { Cons, Empty }
+import v2.compiler.infer { infer }
+import v2.compiler.name_resolve { Admission, ResolutionSubject }
+import v2.compiler.program_assembly { assemble_program_from_ingest }
+import v2.compiler.resolve { ResolvedTree }
+import v2.compiler.source_authority { DagSourceReadWitness }
+import v2.extdeps.languages.dag { dag_language_model }
+import v2.std.artifact { Artifact, SourceFile }
+import v2.std.cross_tree.import_model { V2Tree }
+import v2.std.algebra { fold_list }
+import v2.std.diagnostic { Accepted, Diagnostic, Outcome, Rejected, diagnostics_fatal_reason }
+import v2.std.integer { Int }
+import v2.std.logic { Bool }
+import v2.std.node { Symbol }
+import v2.std.text { String }
+
+// THE CROSS-MODULE PEER: the sealed fn in module aca, naming its one permitted caller by the
+// caller's OWN module path and declaration name.
+fn wall_red_peer_text() -> String {
+  "module aca\n\nfn sealed_mint(n: Int) -> Int\n  admit_callers: [decl_ref(module_path: \"bcb\", decl_name: \"listed_caller\")]\n  = n + 1\n"
+}
+
+// THE CROSS-MODULE RED: the subject module imports the sealed fn and calls it from a declaration
+// the peer's list does not name. The refusal must reach across the import: the judge reads the
+// callee's declared Arrow through the call's facts entry, so the edge the peer's body_lowering
+// carried survives into the subject module's judgment.
+fn wall_red_subject_text() -> String {
+  "module bcb\n\nimport aca { sealed_mint }\n\nfn listed_caller(n: Int) -> Int = sealed_mint(n: n)\n\nfn unlisted_caller(n: Int) -> Int = sealed_mint(n: n)\n\nfn second_unlisted_caller(n: Int) -> Int = sealed_mint(n: n)\n"
+}
+
+data wall_red_subject_artifact: Artifact = Artifact {
+  kind: SourceFile,
+  id: ^wall_red_subject_artifact,
+  file_path: "src/v2/pilot/caller_admission_wall_red_subject.dag"
+}
+
+data wall_red_peer_artifact: Artifact = Artifact {
+  kind: SourceFile,
+  id: ^wall_red_peer_artifact,
+  file_path: "src/v2/pilot/caller_admission_wall_red_peer.dag"
+}
+
+fn wall_red_source(src: String, artifact: Artifact, cu: Symbol) -> DagSourceReadWitness {
+  DagSourceReadWitness {
+    source: Medium { carried: src, fidelity: Lossless },
+    artifact: artifact,
+    compilation_unit: cu,
+    source_root: V2Tree
+  }
+}
+
+fn wall_red_assembled(subject_src: String, peer_src: String) -> Outcome<ResolvedTree> {
+  assemble_program_from_ingest(
+    ingest: Cons {
+      head: wall_red_source(src: subject_src, artifact: wall_red_subject_artifact, cu: ^wall_red_subject_cu),
+      tail: [
+        wall_red_source(src: peer_src, artifact: wall_red_peer_artifact, cu: ^wall_red_peer_cu)
+      ]
+    },
+    admission: Admission {
+      subject: ResolutionSubject { name: Cons { head: ^bcb, tail: Empty } },
+      imports: Empty
+    },
+    lm: dag_language_model()
+  )
+}
+
+fn wall_red_refusal_count(head: Diagnostic, tail: List<Diagnostic>) -> Int {
+  fold_list(
+    xs: tail,
+    empty: if head.reason == ^infer_reason_caller_admission_refused { 1 } else { 0 },
+    cons: fn(n, d) { if d.reason == ^infer_reason_caller_admission_refused { n + 1 } else { n } }
+  )
+}
+
+// THE INHABITANCE CLAIM (the retargeted evidence of the withdrawn construction_confinement
+// stage, DESIGN section 4b(4)): assemble peer + subject through the real ingest, infer, and the
+// wall refuses EXACTLY the two outside cross-module calls with caller_admission_refused while the
+// listed caller beside them is admitted -- one extra or one missing refusal moves the count, and
+// with the wall removed the program is accepted, so the claim is red.
+test fn the_native_route_refuses_exactly_the_outside_cross_module_calls_holds() -> Bool {
+  match wall_red_assembled(subject_src: wall_red_subject_text(), peer_src: wall_red_peer_text()) {
+    Rejected { diagnostics: d } => wall_red_refusal_count(head: d.head, tail: d.tail) == 2
+    Accepted { value: rt, diagnostics: _ } =>
+      match infer(tree: rt) {
+        Rejected { diagnostics: d } => wall_red_refusal_count(head: d.head, tail: d.tail) == 2
+        Accepted { value: _, diagnostics: _ } => false
+      }
+  }
+}
diff --git a/src/v2/test/claim/long/cwc_resolution_probe_test.dag b/src/v2/test/claim/long/cwc_resolution_probe_test.dag
index 5755b5432a2..b932aa9bc21 100644
--- a/src/v2/test/claim/long/cwc_resolution_probe_test.dag
+++ b/src/v2/test/claim/long/cwc_resolution_probe_test.dag
@@ -1,144 +1,282 @@
 module v2.test.long.cwc_resolution_probe
 
-import v2.std.live_tree { LiveTreeDisposition }
-import v2.compiler.normalized_tree { NormalizedTree }
+import std.occurrence_identity { OccurrenceSynthetic }
+import v2.compiler.body_lowering_fold { DeclaredRecord }
+import v2.compiler.normalize { normalize }
+import v2.compiler.normalized_tree { NormalizedTree, admit_normalized_tree, no_import_bindings, no_type_declaration_modifiers }
+import v2.compiler.tokenize { tokenize }
+import v2.extdeps.languages.dag { dag_string_literal_node, namespace_graft_module_body_marker_node }
+import v2.std.arrow_signature { declared_signature }
+import v2.std.declaration_marker { test_marker_channel_empty }
+import v2.std.diagnostic { diagnostics_fatal_reason }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import v2.std.node { Connective, content_hash, core_edge_label }
+import v2.std.node_query { binder_edge, construct_node, construct_node_elided }
+import v2.std.qualified_name { qualified_name_spine_of_atoms }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
-data cwc_src_type_two: String = "module probe\ntype T = A | B\n"
-data cwc_src_type_three: String = "module probe\ntype T = A | B | C\n"
-data cwc_src_type_review: String = "module probe\ntype ReviewEvent = Approve | RequestChanges | Comment | Pending\n"
+// EACH CLAIM DISCRIMINATES AT ONE INTERFACE (DESIGN section 3). A claim that tokenizes, parses and
+// normalizes its own source costs about twice the required floor's new-witness budget before it
+// asserts anything (v2.workflow.required_floor claim_eval_step_budget_for_identity), so the claims
+// below take their input at the boundary under test as a SUPPLIED value:
+//   - the normalize claim takes a parse tree, built with the four shapes the parser emits
+//     (a production, a sequence, a token, an empty node);
+//   - the resolve claims take normalized roots, built with the constructors normalize itself uses
+//     (binder_edge, declared_signature, construct_node, dag_string_literal_node).
+// One claim runs the real path, cwc_cwc_module_resolve_accepts, and it pairs both kinds of fixture
+// with their producers: the real parser's tree for the malformed source has the supplied parse
+// tree's content hash, and real normalize of the cwc module has the supplied cwc root's content
+// hash. If a fixture drifts from what its producer emits, that claim turns red. It is admitted as a
+// cost row in v2.workflow.floor_cost_debt.
 
-data cwc_src_type_scalar: String = "module probe\ntype T = Int\n"
-
-data cwc_src_type_malformed_coproduct: String = "module probe\ntype T = { x: Int } | B | C\n"
+data cwc_src_type_malformed_coproduct: String = "module probe\ntype T = { x: Int } | B\n"
 
 data cwc_src_cwc_module: String = "module probe\ntype VariantNaming = AsAuthored | ScreamingSnakeCase\ntype VariantEncoding = StringVariant { naming: VariantNaming }\ntype CoproductWireContract { coproduct: String, encoding: VariantEncoding }\ntype ReviewEvent = Approve | RequestChanges | Comment | Pending\ndata review_event_wire_contract: CoproductWireContract = { coproduct: \"ReviewEvent\", encoding: StringVariant { naming: ScreamingSnakeCase } }\n"
 
-fn cwc_norm_of(src: String) -> Outcome<NormalizedTree> {
-  let lm = dag_language_model()
-  bind_outcome(
-    o: tokenize(text: src, file: ^cwc_probe_file, rules: lm.lex),
-    f: fn(toks) {
-      bind_outcome(o: parse(tokens: toks, grammar: lm.grammar), f: fn(ptree) {
-        normalize(parse_tree: ptree)
-      })
-    }
-  )
+// ---- the parse-tree fixture -------------------------------------------------------------------
+
+fn cwc_pt_empty() -> Node {
+  Node { kind: TypeNode { connective: Conj }, children: [], occurrence_id: OccurrenceSynthetic }
 }
 
-fn cwc_norm_accepts(src: String) -> Bool {
-  match cwc_norm_of(src: src) {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
+fn cwc_pt_token(sym: Symbol) -> Node {
+  Node { kind: TypeNode { connective: Atom { identity: sym } }, children: [], occurrence_id: OccurrenceSynthetic }
+}
+
+fn cwc_pt_production(identity: Symbol, captured: Node) -> Node {
+  Node {
+    kind: TypeNode { connective: Conj },
+    children: [
+      Edge { label: Authored { name: ^grammar_production_identity_node_projection }, target: cwc_pt_token(sym: identity) },
+      Edge { label: Authored { name: ^grammar_production_captured_node_projection }, target: captured }
+    ],
+    occurrence_id: OccurrenceSynthetic
   }
 }
 
-test fn cwc_norm_two_variant_accepts() -> Bool {
-  cwc_norm_accepts(src: cwc_src_type_two)
+fn cwc_pt_seq(left: Node, right: Node) -> Node {
+  Node {
+    kind: TypeNode { connective: Conj },
+    children: [
+      Edge { label: Authored { name: ^grammar_sequence_left_node_projection }, target: left },
+      Edge { label: Authored { name: ^grammar_sequence_right_node_projection }, target: right }
+    ],
+    occurrence_id: OccurrenceSynthetic
+  }
 }
 
-test fn cwc_norm_three_variant_accepts() -> Bool {
-  cwc_norm_accepts(src: cwc_src_type_three)
+// `module probe` / `type T = { x: Int } | B`, as the parser emits it.
+fn cwc_pt_malformed() -> Node {
+  cwc_pt_production(identity: ^dag_surface_module, captured: cwc_pt_seq(left: cwc_pt_production(identity: ^dag_surface_module_header, captured: cwc_pt_seq(left: cwc_pt_token(sym: ^dag_token_kw_module), right: cwc_pt_production(identity: ^dag_surface_qualified_name, captured: cwc_pt_seq(left: cwc_pt_token(sym: ^probe), right: cwc_pt_empty())))), right: cwc_pt_seq(left: cwc_pt_production(identity: ^dag_surface_top_level_item, captured: cwc_pt_production(identity: ^dag_surface_type_decl, captured: cwc_pt_seq(left: cwc_pt_token(sym: ^dag_token_kw_type), right: cwc_pt_seq(left: cwc_pt_token(sym: ^T), right: cwc_pt_seq(left: cwc_pt_empty(), right: cwc_pt_seq(left: cwc_pt_seq(left: cwc_pt_empty(), right: cwc_pt_empty()), right: cwc_pt_seq(left: cwc_pt_token(sym: ^dag_token_eq), right: cwc_pt_production(identity: ^dag_surface_type_alias_rhs_lead, captured: cwc_pt_seq(left: cwc_pt_empty(), right: cwc_pt_production(identity: ^dag_surface_type_alias_rhs, captured: cwc_pt_seq(left: cwc_pt_production(identity: ^dag_surface_type_variant, captured: cwc_pt_seq(left: cwc_pt_production(identity: ^dag_surface_type_expr, captured: cwc_pt_production(identity: ^dag_surface_field_decl_block, captured: cwc_pt_seq(left: cwc_pt_token(sym: ^dag_token_lbrace), right: cwc_pt_seq(left: cwc_pt_seq(left: cwc_pt_seq(left: cwc_pt_seq(left: cwc_pt_token(sym: ^x), right: cwc_pt_seq(left: cwc_pt_token(sym: ^dag_token_colon), right: cwc_pt_production(identity: ^dag_surface_type_expr, captured: cwc_pt_seq(left: cwc_pt_seq(left: cwc_pt_production(identity: ^dag_surface_qualified_name, captured: cwc_pt_seq(left: cwc_pt_token(sym: ^Int), right: cwc_pt_empty())), right: cwc_pt_empty()), right: cwc_pt_empty())))), right: cwc_pt_seq(left: cwc_pt_empty(), right: cwc_pt_empty())), right: cwc_pt_seq(left: cwc_pt_empty(), right: cwc_pt_empty())), right: cwc_pt_token(sym: ^dag_token_rbrace))))), right: cwc_pt_seq(left: cwc_pt_empty(), right: cwc_pt_empty()))), right: cwc_pt_seq(left: cwc_pt_seq(left: cwc_pt_token(sym: ^dag_token_pipe), right: cwc_pt_production(identity: ^dag_surface_type_variant, captured: cwc_pt_seq(left: cwc_pt_production(identity: ^dag_surface_type_expr, captured: cwc_pt_seq(left: cwc_pt_seq(left: cwc_pt_production(identity: ^dag_surface_qualified_name, captured: cwc_pt_seq(left: cwc_pt_token(sym: ^B), right: cwc_pt_empty())), right: cwc_pt_empty()), right: cwc_pt_empty())), right: cwc_pt_seq(left: cwc_pt_empty(), right: cwc_pt_empty())))), right: cwc_pt_empty())))))))))))), right: cwc_pt_empty())))
 }
 
-fn cwc_tree_has_disj_algebra() -> NodeFold<Bool> {
-  NodeFold {
-    init: fn(node) {
-      match node.kind {
-        TypeNode { connective: Disj } => true
-        _ => false
-      }
-    },
-    step: fn(acc, _edge, child_acc) {
-      if acc {
-        true
-      } else {
-        child_acc
-      }
-    }
-  }
+// ---- the normalized-root fixtures -------------------------------------------------------------
+
+fn cwc_atom(identity: Symbol) -> Node {
+  Node { kind: TypeNode { connective: Atom { identity: identity } }, children: [], occurrence_id: OccurrenceSynthetic }
 }
 
-fn cwc_tree_has_disj(n: Node) -> Bool {
-  fold_node(n: n, algebra: cwc_tree_has_disj_algebra())
+fn cwc_node(connective: Connective, children: List<Edge>) -> Node {
+  Node { kind: TypeNode { connective: connective }, children: children, occurrence_id: OccurrenceSynthetic }
 }
 
-fn cwc_disj_arm_count_algebra() -> NodeFold<Int> {
-  NodeFold {
-    init: fn(node) {
-      match node.kind {
-        TypeNode { connective: Disj } => count(node.children)
-        _ => 0
-      }
-    },
-    step: fn(acc, _edge, child_acc) {
-      if acc > 0 {
-        acc
-      } else {
-        child_acc
-      }
-    }
-  }
+fn cwc_member(name: Symbol, target: Node) -> Edge {
+  Edge { label: Authored { name: name }, target: target }
 }
 
-fn cwc_disj_arm_count(n: Node) -> Int {
-  fold_node(n: n, algebra: cwc_disj_arm_count_algebra())
+// `type Name = V1 | V2 ...`, each variant with its own fields (none for a bare variant).
+fn cwc_coproduct(name: Symbol, variants: List<Edge>) -> Edge {
+  cwc_member(name: name, target: cwc_node(connective: Disj, children: variants))
 }
 
-fn cwc_norm_rejects(src: String) -> Bool {
-  match cwc_norm_of(src: src) {
-    Accepted { value: _, diagnostics: _ } => false
-    Rejected { diagnostics: _ } => true
-  }
+fn cwc_variant(name: Symbol, fields: List<Edge>) -> Edge {
+  cwc_member(name: name, target: cwc_node(connective: Conj, children: fields))
 }
 
-test fn cwc_non_coproduct_rhs_passes_through() -> Bool {
-  match cwc_norm_of(src: cwc_src_type_scalar) {
-    Accepted { value: root, diagnostics: _ } => !cwc_tree_has_disj(n: root.root)
-    Rejected { diagnostics: _ } => false
-  }
+fn cwc_record(name: Symbol, fields: List<Edge>) -> Edge {
+  cwc_member(name: name, target: cwc_node(connective: Conj, children: fields))
 }
 
-test fn cwc_malformed_nary_coproduct_normalize_rejects() -> Bool {
+fn cwc_field(name: Symbol, type_name: Symbol) -> Edge {
+  binder_edge(name: name, type_node: cwc_atom(identity: type_name))
+}
 
-  cwc_norm_rejects(src: cwc_src_type_malformed_coproduct)
+// `data name: type_name = body`.
+fn cwc_data(name: Symbol, type_name: Symbol, body: Node) -> Edge {
+  let signature = declared_signature(params: [], source: body)
+  cwc_member(name: name, target: cwc_node(connective: Arrow, children: [
+    signature.domain,
+    Edge { label: Positional, target: cwc_atom(identity: type_name) },
+    Edge { label: Positional, target: cwc_atom(identity: type_name) },
+    signature.order,
+    Edge { label: core_edge_label(marker: ArrowBodyEdge), target: body }
+  ]))
 }
 
-test fn cwc_malformed_nary_coproduct_fail_open_control() -> Bool {
-  !cwc_norm_rejects(src: cwc_src_type_malformed_coproduct)
+fn cwc_headless(fields: List<Edge>) -> Node {
+  construct_node_elided(field_edges: fields, source: cwc_pt_empty())
 }
 
-test fn cwc_norm_review_event_accepts() -> Bool {
-  cwc_norm_accepts(src: cwc_src_type_review)
+fn cwc_headed(tag: Symbol, fields: List<Edge>) -> Node {
+  construct_node(reference: qualified_name_spine_of_atoms(atoms: [cwc_atom(identity: tag)], occurrence_id: OccurrenceSynthetic), field_edges: fields, source: cwc_pt_empty())
 }
 
-fn cwc_resolve_accepts(src: String) -> Bool {
-  let lm = dag_language_model()
-  match cwc_norm_of(src: src) {
+// `module probe` with `members`, as normalize grafts a one-segment module.
+fn cwc_module_root(members: List<Edge>) -> Node {
+  cwc_node(connective: Conj, children: [
+    Edge { label: Authored { name: ^grammar_production_identity_node_projection }, target: cwc_atom(identity: ^dag_surface_module) },
+    Edge {
+      label: Authored { name: ^grammar_production_captured_node_projection },
+      target: cwc_node(connective: Conj, children: [
+        Edge {
+          label: Authored { name: ^probe },
+          target: cwc_node(connective: Conj, children: concat(
+            [Edge { label: Authored { name: ^grammar_production_identity_node_projection }, target: namespace_graft_module_body_marker_node() }],
+            members
+          ))
+        }
+      ])
+    }
+  ])
+}
+
+fn cwc_variant_naming() -> Edge {
+  cwc_coproduct(name: ^VariantNaming, variants: [cwc_variant(name: ^AsAuthored, fields: []), cwc_variant(name: ^ScreamingSnakeCase, fields: [])])
+}
+
+fn cwc_coproduct_wire_contract() -> Edge {
+  cwc_record(name: ^CoproductWireContract, fields: [cwc_field(name: ^coproduct, type_name: ^String), cwc_field(name: ^encoding, type_name: ^VariantEncoding)])
+}
+
+// The cwc module, member for member. The ReviewEvent arms are in the order normalize emits them.
+fn cwc_root_cwc_module() -> Node {
+  cwc_module_root(members: [
+    cwc_variant_naming(),
+    cwc_coproduct(name: ^VariantEncoding, variants: [cwc_variant(name: ^StringVariant, fields: [cwc_field(name: ^naming, type_name: ^VariantNaming)])]),
+    cwc_coproduct_wire_contract(),
+    cwc_coproduct(name: ^ReviewEvent, variants: [
+      cwc_variant(name: ^Approve, fields: []), cwc_variant(name: ^Pending, fields: []),
+      cwc_variant(name: ^Comment, fields: []), cwc_variant(name: ^RequestChanges, fields: [])
+    ]),
+    cwc_data(name: ^review_event_wire_contract, type_name: ^CoproductWireContract, body: cwc_headless(fields: [
+      cwc_member(name: ^coproduct, target: dag_string_literal_node(value: "ReviewEvent", occurrence_id: OccurrenceSynthetic)),
+      cwc_member(name: ^encoding, target: cwc_headed(tag: ^StringVariant, fields: [cwc_member(name: ^naming, target: cwc_atom(identity: ^ScreamingSnakeCase))]))
+    ]))
+  ])
+}
+
+fn cwc_tree(root: Node, records: List<Symbol>) -> Outcome<NormalizedTree> {
+  admit_normalized_tree(
+    import_bindings: no_import_bindings(),
+    type_declaration_kinds: fold(records, init: [], f: fn(acc, name) { list_snoc_item(xs: acc, item: DeclaredRecord { name: name }) }),
+    type_declaration_modifiers: no_type_declaration_modifiers(),
+    root: root,
+    test_markers: test_marker_channel_empty(),
+    diagnostics: None
+  )
+}
+
+// The resolve verdict over a supplied root: ACCEPTED, or the fatal refusal reason.
+fn cwc_resolve_verdict(root: Node, records: List<Symbol>) -> Symbol {
+  match cwc_tree(root: root, records: records) {
+    Rejected { diagnostics: _ } => ^cwc_fixture_not_admitted
     Accepted { value: tree, diagnostics: _ } =>
-      match v2.compiler.resolve.resolve(tree: tree, lm: lm) {
-        Accepted { value: _, diagnostics: _ } => true
-        Rejected { diagnostics: _ } => false
+      match v2.compiler.resolve.resolve(tree: tree, lm: dag_language_model()) {
+        Accepted { value: _, diagnostics: _ } => ^ACCEPTED
+        Rejected { diagnostics: d } => diagnostics_fatal_reason(d: d)
       }
-    Rejected { diagnostics: _ } => false
   }
 }
 
-test fn cwc_cwc_module_resolve_accepts() -> Bool {
-  cwc_resolve_accepts(src: cwc_src_cwc_module)
+// ---- the real path ----------------------------------------------------------------------------
+
+fn cwc_parse_of(src: String) -> Outcome<Node> {
+  let lm = dag_language_model()
+  bind_outcome(o: tokenize(text: src, file: ^cwc_probe_file, rules: lm.lex), f: fn(toks) {
+    parse(tokens: toks, grammar: lm.grammar)
+  })
 }
 
-test fn cwc_review_normalized_has_disj() -> Bool {
-  match cwc_norm_of(src: cwc_src_type_review) {
-    Accepted { value: root, diagnostics: _ } => cwc_tree_has_disj(n: root.root)
-    Rejected { diagnostics: _ } => false
+fn cwc_norm_of_module() -> Outcome<NormalizedTree> {
+  match cwc_parse_of(src: cwc_src_cwc_module) {
+    Accepted { value: p, diagnostics: _ } => normalize(parse_tree: p)
+    Rejected { diagnostics: d } => Rejected { diagnostics: d }
   }
 }
 
-test fn cwc_review_disj_has_four_arms() -> Bool {
-  match cwc_norm_of(src: cwc_src_type_review) {
-    Accepted { value: root, diagnostics: _ } => cwc_disj_arm_count(n: root.root) == 4
+// THE ONE REAL-PATH CLAIM, and the pairing for every fixture above. It asserts the route, not only
+// the answer: the real parser emits the supplied malformed-coproduct parse tree; real normalize of the
+// cwc module emits the supplied cwc root, so its ReviewEvent Disj and the shapes the resolve fixtures
+// are built from are what the producer emits; and resolve accepts that tree. Before gunbc#13333 the
+// last conjunct was red: the single-tree door looked a variant value up from the corpus root and
+// marked no declaration as a record.
+test fn cwc_cwc_module_resolve_accepts() -> Bool {
+  let parse_pairs = match cwc_parse_of(src: cwc_src_type_malformed_coproduct) {
+    Accepted { value: p, diagnostics: _ } => content_hash(n: p) == content_hash(n: cwc_pt_malformed())
     Rejected { diagnostics: _ } => false
   }
+  parse_pairs && match cwc_norm_of_module() {
+    Accepted { value: tree, diagnostics: _ } =>
+      (content_hash(n: tree.root) == content_hash(n: cwc_root_cwc_module()))
+        && match v2.compiler.resolve.resolve(tree: tree, lm: dag_language_model()) {
+          Accepted { value: _, diagnostics: _ } => true
+          Rejected { diagnostics: _ } => false
+        }
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+// ---- normalize, over a supplied parse tree ----------------------------------------------------
+
+// A coproduct arm with no constructor name cannot be built or matched, so normalize owes a refusal.
+// RED today: normalize accepts it (gunbc.recurring_failure_mode
+// a_coproduct_arm_without_a_constructor_name_is_accepted; enrolled in v2.workflow.floor_expected_red).
+test fn cwc_malformed_nary_coproduct_normalize_rejects() -> Bool {
+  match normalize(parse_tree: cwc_pt_malformed()) {
+    Accepted { value: _, diagnostics: _ } => false
+    Rejected { diagnostics: _ } => true
+  }
+}
+
+// ---- resolve on the single-tree door, over supplied roots -------------------------------------
+
+// A variant in value position binds to the module's own declaration. Red before gunbc#13333, where
+// the door's lookup started at the corpus root.
+test fn cwc_single_tree_variant_value_resolves() -> Bool {
+  cwc_resolve_verdict(
+    root: cwc_module_root(members: [cwc_variant_naming(), cwc_data(name: ^naming, type_name: ^VariantNaming, body: cwc_atom(identity: ^ScreamingSnakeCase))]),
+    records: []
+  ) == ^ACCEPTED
+}
+
+// A headless record literal elaborates against a record the module declares. Red before gunbc#13333,
+// where the door marked no declaration as a record.
+test fn cwc_single_tree_headless_record_resolves() -> Bool {
+  cwc_resolve_verdict(
+    root: cwc_module_root(members: [
+      cwc_variant_naming(),
+      cwc_record(name: ^NamingHolder, fields: [cwc_field(name: ^naming, type_name: ^VariantNaming)]),
+      cwc_data(name: ^holder, type_name: ^NamingHolder, body: cwc_headless(fields: [cwc_member(name: ^naming, target: cwc_atom(identity: ^AsAuthored))]))
+    ]),
+    records: [^NamingHolder]
+  ) == ^ACCEPTED
+}
+
+// Controls: the door still refuses what it should, for the reason it should.
+test fn cwc_single_tree_undeclared_variant_refuses() -> Bool {
+  cwc_resolve_verdict(
+    root: cwc_module_root(members: [cwc_variant_naming(), cwc_data(name: ^naming, type_name: ^VariantNaming, body: cwc_atom(identity: ^Undeclared))]),
+    records: []
+  ) == ^resolve_reason_unbound_symbol
+}
+
+test fn cwc_single_tree_headless_at_coproduct_refuses() -> Bool {
+  cwc_resolve_verdict(
+    root: cwc_module_root(members: [
+      cwc_variant_naming(),
+      cwc_data(name: ^naming, type_name: ^VariantNaming, body: cwc_headless(fields: [cwc_member(name: ^a, target: cwc_atom(identity: ^AsAuthored))]))
+    ]),
+    records: []
+  ) == ^resolve_anonymous_record_expected_type_not_record
 }
diff --git a/src/v2/test/claim/long/door_real_module_probe_test.dag b/src/v2/test/claim/long/door_real_module_probe_test.dag
index 9a705e3c7aa..816c5418b32 100644
--- a/src/v2/test/claim/long/door_real_module_probe_test.dag
+++ b/src/v2/test/claim/long/door_real_module_probe_test.dag
@@ -19,8 +19,6 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // Cause ownership (sharp-bee-290 + nimble-boar-198 reconciliation 2026-07-13; durable table in
 // v2.workflow.compile_door_ledger known_frontier_causes): resolve_ambiguous_export LANDED fix in
 // phase-2 flip (this file's ImportScoped RED / NamespaceOnlyY GREEN pair).
-// parse_grammar_choice_overlap_residue on import syntax remains migration-owned until phase-3
-// grammar deletion.
 
 fn quad_qn_node(seg: Symbol) -> Node {
   fold_list_node(
diff --git a/src/v2/test/claim/long/frontier_probe_closure_matrix_integration_test.dag b/src/v2/test/claim/long/frontier_probe_closure_matrix_integration_test.dag
index 333f7ffad6f..966f76a317f 100644
--- a/src/v2/test/claim/long/frontier_probe_closure_matrix_integration_test.dag
+++ b/src/v2/test/claim/long/frontier_probe_closure_matrix_integration_test.dag
@@ -17,6 +17,7 @@ import v2.compiler.source_authority {
   SourceRootCoverageComplete,
   frontier_probe_discovered_closure_seal
 }
+import v2.std.cross_tree.import_model { DagTree, V2Tree }
 import v2.compiler.source_authority_read {
   source_ref_for_observed_storage_path
 }
@@ -34,11 +35,11 @@ data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree
 // exact-head eval (784772ms / 742109ms).
 
 fn fp_matrix_ref_a() -> SourceRef {
-  source_ref_for_observed_storage_path(path: "dag/std/algebra.dag")
+  source_ref_for_observed_storage_path(path: "dag/std/algebra.dag", source_root: DagTree)
 }
 
 fn fp_matrix_ref_v2() -> SourceRef {
-  source_ref_for_observed_storage_path(path: "src/v2/std/text.dag")
+  source_ref_for_observed_storage_path(path: "src/v2/std/text.dag", source_root: V2Tree)
 }
 
 fn fp_matrix_closure_subject_matching_digest(
diff --git a/src/v2/test/claim/long/mandatory_tag_gate_witness_test.dag b/src/v2/test/claim/long/mandatory_tag_gate_witness_test.dag
index 46339204fa7..cf9e6043703 100644
--- a/src/v2/test/claim/long/mandatory_tag_gate_witness_test.dag
+++ b/src/v2/test/claim/long/mandatory_tag_gate_witness_test.dag
@@ -7,7 +7,10 @@ import v2.compiler.normalize { normalize }
 import v2.compiler.compile { CompileLens, CompileLensRoot, required_lenses_at_grain }
 import v2.compiler.infer { InferredTree }
 import v2.extdeps.languages.dag { dag_language_model }
-import v2.lens.mandatory_tag { mandatory_tag_compile_gate }
+import v2.lens.mandatory_tag { mandatory_tag_compile_gate_with_provenance }
+import v2.compiler.resolve { member_kind_channel_of_tree }
+import v2.std.member_declaration_kind { MemberKindChannel }
+import v2.compiler.namespace_graft { namespace_graft_build_body_conj, namespace_graft_fold_spine, namespace_graft_wrap_module_shell }
 import std.algebra { Cons, Empty }
 import v2.std.collection { empty_map}
 import v2.std.diagnostic { Accepted, NonEmptyDiagnostics, Outcome, Rejected }
@@ -27,12 +30,16 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // fast-lane eval budget - discovery excludes test/claim/long/ at dir grain and the run-29892063728
 // receipt shows all 12 witnesses EvalBudgetExceeded in place. Recipe: claim_batch --source-root
 // src/v2 --source-root dag --entry src/v2/test/claim/long/mandatory_tag_gate_witness_test.dag
-// --functions <csv of the 12 test fns> --claim-run --wet (~2min; run receipted green 2026-07-22,
+// --functions <csv of the test fns> --claim-run --wet (~2min; run receipted green 2026-07-22,
 // 12/12 PASS). Parse grain carries the full declaration (name lexeme, type annotation, value
 // vocabulary), so every arm is exercised there, including the misnamed-anchor control - the exact
-// #6991 regression class this wall makes unwritable. Normalize grain currently collapses data-decl
-// value internals (general-body-producer frontier), so its controls cover name/type/missing only;
-// scheme enforcement at corpus scale rides the parse-grain corpus witness. The roster control
+// #6991 regression class this wall makes unwritable. Normalize grain lowers a data declaration to a named
+// nullary Arrow member (body_lower_data_decl_to_member, #12197, 2026-09-24), which the gate reads
+// for name, type and value; the normalized controls cover clean/missing/misnamed (the wrong-type,
+// file-scheme and bogus-scheme reds at this grain were measured and each exceeds the new-witness
+// eval-step budget, so they are not enrolled; parse grain carries those arms). Regression receipt: the 2026-07-22 12/12 run predates that
+// lowering, after which the gate read no declaration at this grain and reported every tagged module
+// missing (eea7e8ea86); scheme enforcement at corpus scale rides the parse-grain corpus witness. The roster control
 // proves enrollment by execution: a violating module tree pushed through every enrolled root lens
 // yields a rejection whose head reason is mandatory_tag_missing_required_decl - a reason only this
 // lens emits.
@@ -55,7 +62,7 @@ data src_exempt_fixture: String = "module extdeps.fixture.gate_probe_planted\n\n
 
 type GrainProbe
   = GrainStageRejected
-  | GrainTree { root: Node }
+  | GrainTree { root: Node, channel: MemberKindChannel }
 
 fn parse_grain_tree(source: String) -> GrainProbe {
   let lm = dag_language_model()
@@ -64,7 +71,7 @@ fn parse_grain_tree(source: String) -> GrainProbe {
     Accepted { value: ts, diagnostics: _ } =>
       match parse_module(tokens: ts, grammar: lm.grammar) {
         Rejected { diagnostics: _ } => GrainStageRejected
-        Accepted { value: artifact, diagnostics: _ } => GrainTree { root: artifact.tree }
+        Accepted { value: artifact, diagnostics: _ } => GrainTree { root: artifact.tree, channel: no_member_declaration_kinds() }
       }
   }
 }
@@ -75,7 +82,11 @@ fn normalized_grain_tree(source: String) -> GrainProbe {
     GrainTree { root: parse_root } =>
       match normalize(parse_tree: parse_root) {
         Rejected { diagnostics: _ } => GrainStageRejected
-        Accepted { value: normalized, diagnostics: _ } => GrainTree { root: normalized.root }
+        Accepted { value: normalized, diagnostics: _ } =>
+          match member_kind_channel_of_tree(tree: normalized) {
+            Rejected { diagnostics: _ } => GrainStageRejected
+            Accepted { value: channel, diagnostics: _ } => GrainTree { root: normalized.root, channel: channel }
+          }
       }
   }
 }
@@ -83,8 +94,8 @@ fn normalized_grain_tree(source: String) -> GrainProbe {
 fn gate_accepts_tree(probe: GrainProbe) -> Bool {
   match probe {
     GrainStageRejected => false
-    GrainTree { root: root } =>
-      match mandatory_tag_compile_gate(node: root) {
+    GrainTree { root: root, channel: channel } =>
+      match mandatory_tag_compile_gate_with_provenance(node: root, channel: channel) {
         Accepted { value: _, diagnostics: _ } => true
         Rejected { diagnostics: _ } => false
       }
@@ -94,8 +105,8 @@ fn gate_accepts_tree(probe: GrainProbe) -> Bool {
 fn gate_rejects_tree_with(probe: GrainProbe, reason: Symbol) -> Bool {
   match probe {
     GrainStageRejected => false
-    GrainTree { root: root } =>
-      match mandatory_tag_compile_gate(node: root) {
+    GrainTree { root: root, channel: channel } =>
+      match mandatory_tag_compile_gate_with_provenance(node: root, channel: channel) {
         Accepted { value: _, diagnostics: _ } => false
         Rejected { diagnostics: d } =>
           if d.head.reason == reason {
@@ -175,7 +186,7 @@ test fn mandatory_tag_normalized_grain_misnamed_rejects() -> Bool {
 fn roster_rejects_with(probe: GrainProbe, reason: Symbol) -> Bool {
   match probe {
     GrainStageRejected => false
-    GrainTree { root: root } =>
+    GrainTree { root: root, channel: _ } =>
       let inferred = InferredTree { root: root, facts: empty_map() }
       fold(required_lenses_at_grain(grain: CompileLensRoot), init: false, f: fn(acc, lens) {
         acc
diff --git a/src/v2/test/claim/long/parse_table_memo_amortization_test.dag b/src/v2/test/claim/long/parse_table_memo_amortization_test.dag
deleted file mode 100644
index 5a0c77b92ad..00000000000
--- a/src/v2/test/claim/long/parse_table_memo_amortization_test.dag
+++ /dev/null
@@ -1,171 +0,0 @@
-module v2.test.long.parse_table_memo_amortization
-
-import v2.compiler.program_assembly { module_roots_from_source_root_ingest }
-import extdeps.communication.medium { Lossless, Medium }
-import v2.compiler.source_authority { DagSourceReadWitness, SourceRootIngest }
-import v2.extdeps.languages.dag { dag_language_model }
-import std.algebra { Cons, Empty }
-import v2.std.algebra { fold_list, length }
-import v2.std.artifact { Artifact, SourceFile }
-import v2.std.diagnostic {
-  Accepted,
-  CorrectionNotModeled,
-  Diagnostic,
-  Outcome,
-  Rejected,
-  Unavailable,
-  diagnostics_singleton,
-  outcome_accepted,
-  invariant_port_locus
-}
-import v2.std.cross_tree.import_model { V2Tree }
-import v2.std.node { Hash, Node, content_hash }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-data memo_amort_empty_a_source: Medium<String> = Medium { carried: "module memo_amort_a\n", fidelity: Lossless }
-data memo_amort_empty_b_source: Medium<String> = Medium { carried: "module memo_amort_b\n", fidelity: Lossless }
-data memo_amort_bisect_add_source: Medium<String> = Medium { carried: "module bisect.add\n\nfn add(x:Int, y:Int) -> Int { x + y }", fidelity: Lossless }
-data memo_amort_file_a_read: DagSourceReadWitness = DagSourceReadWitness {
-  source: memo_amort_empty_a_source,
-  artifact: Artifact {
-    kind: SourceFile,
-    id: ^memo_amort_file_a_artifact,
-    file_path: "src/v2/test/fixture/memo_amort_file_a.dag"
-  },
-  compilation_unit: ^memo_amort_cu_a,
-  source_root: V2Tree
-}
-
-data memo_amort_file_b_read: DagSourceReadWitness = DagSourceReadWitness {
-  source: memo_amort_empty_b_source,
-  artifact: Artifact {
-    kind: SourceFile,
-    id: ^memo_amort_file_b_artifact,
-    file_path: "src/v2/test/fixture/memo_amort_file_b.dag"
-  },
-  compilation_unit: ^memo_amort_cu_b,
-  source_root: V2Tree
-}
-
-data memo_amort_bisect_add_read: DagSourceReadWitness = DagSourceReadWitness {
-  source: memo_amort_bisect_add_source,
-  artifact: Artifact {
-    kind: SourceFile,
-    id: ^memo_amort_bisect_add_artifact,
-    file_path: "src/v2/test/fixture/memo_amort_bisect_add.dag"
-  },
-  compilation_unit: ^memo_amort_cu_bisect_add,
-  source_root: V2Tree
-}
-
-data memo_amort_ingest_one_file: SourceRootIngest = Cons {
-  head: memo_amort_file_a_read,
-  tail: Empty
-}
-
-data memo_amort_ingest_two_files: SourceRootIngest = Cons {
-  head: memo_amort_file_a_read,
-  tail: Cons { head: memo_amort_file_b_read, tail: Empty }
-}
-
-data memo_amort_ingest_bisect_add: SourceRootIngest = Cons {
-  head: memo_amort_bisect_add_read,
-  tail: Empty
-}
-
-fn memo_amort_not_single_root_rejection<T>() -> Outcome<T> {
-  Rejected {
-    diagnostics: diagnostics_singleton(
-      d: Diagnostic {
-        reason: ^memo_amort_expected_exactly_one_module_root,
-        at: invariant_port_locus(port: ^memo_amort_single_root_locus_port, invariant: ^memo_amort_expected_exactly_one_module_root),
-        correction: Unavailable { reason: CorrectionNotModeled }
-      }
-    )
-  }
-}
-
-fn memo_amort_single_root_content_hash(ingest: SourceRootIngest) -> Outcome<Hash> {
-  match module_roots_from_source_root_ingest(
-    ingest: ingest,
-    lm: dag_language_model()
-  ) {
-    Accepted { value: roots, diagnostics: _ } =>
-      match length(xs: roots) == 1 {
-        true =>
-          fold_list(
-            xs: roots,
-            empty: memo_amort_not_single_root_rejection(),
-            cons: fn(_acc, root) {
-              outcome_accepted(value: content_hash(n: root.root))
-            }
-          )
-        false =>
-          memo_amort_not_single_root_rejection()
-      }
-    Rejected { diagnostics: d } =>
-      Rejected { diagnostics: d }
-  }
-}
-
-test fn memo_amort_parse_one_file_holds() -> Bool {
-  match module_roots_from_source_root_ingest(
-    ingest: memo_amort_ingest_one_file,
-    lm: dag_language_model()
-  ) {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn memo_amort_parse_two_files_holds() -> Bool {
-  match module_roots_from_source_root_ingest(
-    ingest: memo_amort_ingest_two_files,
-    lm: dag_language_model()
-  ) {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-test fn memo_amort_parse_two_files_twice_holds() -> Bool {
-  memo_amort_parse_two_files_holds() && memo_amort_parse_two_files_holds()
-}
-
-fn witness_parse_table_memo_hit_path_content_hash_stable() -> Bool {
-  match memo_amort_single_root_content_hash(ingest: memo_amort_ingest_bisect_add) {
-    Accepted { value: hash_miss, diagnostics: _ } =>
-      match memo_amort_single_root_content_hash(ingest: memo_amort_ingest_bisect_add) {
-        Accepted { value: hash_hit, diagnostics: _ } =>
-          match memo_amort_single_root_content_hash(ingest: memo_amort_ingest_one_file) {
-            Accepted { value: hash_empty, diagnostics: _ } =>
-              hash_miss == hash_hit && hash_miss != hash_empty
-            Rejected { diagnostics: _ } => false
-          }
-        Rejected { diagnostics: _ } => false
-      }
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-test fn parse_table_grammar_memo_multi_file_ingest_parses() -> Bool {
-  memo_amort_parse_two_files_holds()
-}
-
-test fn parse_table_memo_hit_path_content_hash_stable_holds() -> Bool {
-  witness_parse_table_memo_hit_path_content_hash_stable()
-}
-
-data empty_ingest_guard_note: String = "Covers the empty-ingest branch of program_assembly_fold_ingest, added with the prepare-once hoist: an empty ingest must assemble to empty roots WITHOUT paying the one-time grammar preparation (well-formed + 5-check validation + FIRST analysis) for zero modules. Discriminating — RED if the guard rejected, fabricated a root, or (regression) fell through to prepare_grammar for no modules. Fast by construction (no prepare, no parse), unlike the multi-file amortization witnesses above which each pay exactly ONE preparation for the whole fold."
-
-test fn empty_ingest_assembles_to_empty_roots_without_prepare() -> Bool {
-  match module_roots_from_source_root_ingest(
-    ingest: Empty,
-    lm: dag_language_model()
-  ) {
-    Accepted { value: roots, diagnostics: _ } => length(xs: roots) == 0
-    Rejected { diagnostics: _ } => false
-  }
-}
diff --git a/src/v2/test/claim/long/parse_table_memo_counter_witness_test.dag b/src/v2/test/claim/long/parse_table_memo_counter_witness_test.dag
deleted file mode 100644
index 04561a3c324..00000000000
--- a/src/v2/test/claim/long/parse_table_memo_counter_witness_test.dag
+++ /dev/null
@@ -1,58 +0,0 @@
-module v2.test.long.parse_table_memo_counter_witness
-
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-data parse_memo_counter_fixture_source: String = "module bisect.add\n\nfn add(x:Int, y:Int) -> Int { x + y }"
-
-fn parse_memo_counter_stats_for_grammar(
-  source_text: String,
-  grammar: ParseGrammar
-) -> ParseMemoStats {
-  let lm = dag_language_model()
-  let at = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^parse_table_memo_counter_witness_test_grammar_contract)
-  match tokenize(text: source_text, file: ^probe, rules: lm.lex) {
-    Rejected { diagnostics: _ } =>
-      ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-    Accepted { value: stream, diagnostics: _ } =>
-      match grammar {
-        ModeledGrammar { root: root } =>
-          match grammar_validate_for_parse(root: root, at: at) {
-            Rejected { diagnostics: _ } =>
-              ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-            Accepted { value: validated, diagnostics: _ } =>
-              parse_production_memo_stats(
-                tokens: token_stream_remaining(stream: stream),
-                validated: validated,
-                production_name: validated.root.start,
-                materialization: Memoize
-              )
-          }
-        VoidGrammar =>
-          ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-      }
-  }
-}
-
-fn parse_memo_counter_fixture_stats() -> ParseMemoStats {
-  parse_memo_counter_stats_for_grammar(
-    source_text: parse_memo_counter_fixture_source,
-    grammar: dag_language_model().grammar
-  )
-}
-
-fn parse_memo_counter_counters_consistent(stats: ParseMemoStats) -> Bool {
-  stats.lookup_calls == (stats.hits + stats.misses)
-}
-
-test fn parse_memo_counter_lookup_calls_recorded_holds() -> Bool {
-  parse_memo_counter_fixture_stats().lookup_calls > 0
-}
-
-test fn parse_memo_counter_counters_consistent_holds() -> Bool {
-  parse_memo_counter_counters_consistent(stats: parse_memo_counter_fixture_stats())
-}
-
-test fn parse_memo_counter_misses_recorded_holds() -> Bool {
-  parse_memo_counter_fixture_stats().misses > 0
-}
diff --git a/src/v2/test/claim/long/parse_table_memo_governed_witness_test.dag b/src/v2/test/claim/long/parse_table_memo_governed_witness_test.dag
deleted file mode 100644
index 49a31f42ed7..00000000000
--- a/src/v2/test/claim/long/parse_table_memo_governed_witness_test.dag
+++ /dev/null
@@ -1,150 +0,0 @@
-module v2.test.long.parse_table_memo_governed_witness
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-// Governed memo door receipts: Memoize verdict consumed at parse_table_lookup/insert (non-Memoize refuses store); warm==cold content-hash purity on the bisect fixture; RED on bypass insert (Recompute carrier with hand-populated entries). Door fns parse_table_memo_lookup_refuses_store / parse_table_memo_insert_refused are the direct oracle — witnesses call them, not map shape alone. Both doors refuse independently on the Recompute carrier (Case A: seed ParseTableMemo must not serve/populate on non-Memoize — v1_interpreter.rs gated). reconcile-as-lookup-path is the next increment.
-fn governed_witness_probe_key() -> ParsePositionKey {
-  ParsePositionKey { position: 0, production: ^governed_witness_probe_prod }
-}
-
-fn governed_witness_dummy_entry() -> ParseMemoEntry {
-  ParseMemoRejected { diagnostics: [], furthest: FurthestNone, refusal: optional_absent() }
-}
-
-fn parse_table_recompute_fixture() -> ParseTable {
-  let base = parse_table_empty(materialization: Memoize)
-  ParseTableRealization {
-    artifact_kind: base.artifact_kind,
-    provider_id: base.provider_id,
-    materialization: Recompute,
-    grammar_digest: base.grammar_digest,
-    token_stream_digest: base.token_stream_digest,
-    entries: base.entries,
-    memo_hits: base.memo_hits,
-    memo_misses: base.memo_misses,
-    memo_lookup_calls: base.memo_lookup_calls,
-    furthest: base.furthest,
-    nullable_set: base.nullable_set,
-    first_rows: base.first_rows,
-    productions_by_name: base.productions_by_name,
-    prepared_exprs: base.prepared_exprs,
-    layout: base.layout,
-    refusal: base.refusal
-  }
-}
-
-fn parse_table_memoize_fixture() -> ParseTable {
-  let base = parse_table_empty(materialization: Memoize)
-  ParseTableRealization {
-    artifact_kind: base.artifact_kind,
-    provider_id: base.provider_id,
-    materialization: Memoize,
-    grammar_digest: base.grammar_digest,
-    token_stream_digest: base.token_stream_digest,
-    entries: base.entries,
-    memo_hits: base.memo_hits,
-    memo_misses: base.memo_misses,
-    memo_lookup_calls: base.memo_lookup_calls,
-    furthest: base.furthest,
-    nullable_set: base.nullable_set,
-    first_rows: base.first_rows,
-    productions_by_name: base.productions_by_name,
-    prepared_exprs: base.prepared_exprs,
-    layout: base.layout,
-    refusal: base.refusal
-  }
-}
-
-test fn witness_materialization_gate_recompute_denies_store() -> Bool {
-  !materialization_allows_memo_store(m: Recompute)
-}
-
-test fn witness_recompute_fixture_carries_recompute_verdict() -> Bool {
-  !materialization_allows_memo_store(m: parse_table_recompute_fixture().materialization)
-}
-
-test fn witness_door_insert_refused_for_recompute_table() -> Bool {
-  parse_table_memo_insert_refused(
-    table: parse_table_recompute_fixture(),
-    key: governed_witness_probe_key(),
-    value: governed_witness_dummy_entry()
-  )
-}
-
-test fn witness_door_lookup_refused_for_recompute_table() -> Bool {
-  parse_table_memo_lookup_refuses_store(
-    table: parse_table_recompute_fixture(),
-    key: governed_witness_probe_key()
-  )
-}
-
-fn parse_table_entries_contain_key(table: ParseTable, key: ParsePositionKey) -> Bool {
-  match v2.std.collection.map_get(m: table.entries, key: key) {
-    Accepted { value: Present { value: _ } } => true
-    Accepted { value: Absent } => false
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn parse_table_memo_store_well_formed_at(table: ParseTable, key: ParsePositionKey) -> Bool {
-  match materialization_allows_memo_store(m: table.materialization) {
-    true => true
-    false => !parse_table_entries_contain_key(table: table, key: key)
-  }
-}
-
-fn witness_bypass_store_reds_non_memoize_carrier() -> Bool {
-  let key = governed_witness_probe_key()
-  let base = parse_table_recompute_fixture()
-  let bypass = ParseTableRealization {
-    artifact_kind: base.artifact_kind,
-    provider_id: base.provider_id,
-    materialization: Recompute,
-    grammar_digest: base.grammar_digest,
-    token_stream_digest: base.token_stream_digest,
-    entries: map_insert(
-      m: empty_map(),
-      key: key,
-      value: governed_witness_dummy_entry()
-    ),
-    memo_hits: base.memo_hits,
-    memo_misses: base.memo_misses,
-    memo_lookup_calls: base.memo_lookup_calls,
-    furthest: base.furthest,
-    nullable_set: base.nullable_set,
-    first_rows: base.first_rows,
-    productions_by_name: base.productions_by_name,
-    prepared_exprs: base.prepared_exprs,
-    layout: base.layout,
-    refusal: base.refusal
-  }
-  !parse_table_memo_store_well_formed_at(table: bypass, key: key)
-}
-
-test fn witness_memoize_carrier_allows_store() -> Bool {
-  let table = parse_table_memoize_fixture()
-  let key = governed_witness_probe_key()
-  let after = parse_table_insert(
-    table: table,
-    key: key,
-    value: governed_witness_dummy_entry()
-  )
-  parse_table_entries_contain_key(table: after, key: key)
-}
-
-test fn witness_content_key_subject_stable() -> Bool {
-  let table = parse_table_memoize_fixture()
-  let key = governed_witness_probe_key()
-  let a = parse_table_subject(table: table, key: key)
-  let b = parse_table_subject(table: table, key: key)
-  a == b
-}
-
-test fn parse_table_memo_bypass_store_reds() -> Bool {
-  witness_bypass_store_reds_non_memoize_carrier()
-}
-
-test fn parse_table_memo_warm_equals_cold_content_hash() -> Bool {
-  witness_parse_table_memo_hit_path_content_hash_stable()
-}
-
diff --git a/src/v2/test/claim/long/program_assembly_advisory_route_test.dag b/src/v2/test/claim/long/program_assembly_advisory_route_test.dag
index c6aeaccb315..b25768d9aa3 100644
--- a/src/v2/test/claim/long/program_assembly_advisory_route_test.dag
+++ b/src/v2/test/claim/long/program_assembly_advisory_route_test.dag
@@ -4,15 +4,14 @@ import v2.compiler.program_assembly {
   ProgramAssemblyLocatedFoldOk,
   ProgramAssemblyLocatedFoldFailed,
   dag_prepared_grammar,
+  dag_prepared_lex,
   program_assembly_fold_step,
   program_assembly_ingest_scope_outcome
 }
 import v2.compiler.source_authority { DagSourceReadWitness }
-import v2.compiler.tokenize { prepare_lex_rules }
 import v2.std.artifact { Artifact, SourceFile }
 import v2.std.cross_tree.import_model { DagTree }
 import extdeps.communication.medium { Lossless, Medium }
-import v2.extdeps.languages.dag { dag_language_model }
 import v2.std.cross_tree.resolution { source_root_index_empty }
 import v2.std.provenance { span_index_empty }
 import std.occurrence_identity { occurrence_id_allocator_initial }
@@ -35,66 +34,6 @@ import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
-// THE REAL ASSEMBLY FOLD CARRIES EACH ACCEPTED FILE'S ADVISORIES (advisories step 1b, the
-// program_assembly half). No advisory reaches this route from real source today -- the dag grammar's
-// overlap residue is empty (gunbc#13056) and body lowering's postfix_suffix_carried advisory has no
-// known reaching source -- so the one advisory input is SUPPLIED at the boundary the fold already
-// takes it through: program_assembly_fold_step's `residue`, which the real parse merges into every
-// file's accepted outcome. One real read goes through the real fold step; the supplied advisory must
-// reach the fold's chain, once. Before the fold carried advisories it matched them
-// away, so this reds there. It lives in the long home because a real parse exceeds the new-witness
-// CPU margin; the extend's own discrimination is the cheap supplied claim
-// v2.test.provenance.occurrence_file_attribution
-// the_assembly_advisory_extend_keeps_every_files_advisories_in_order_holds.
-// ONE minimal accepted read: the claim's subject is the fold's carry, not parsing, so the smallest
-// module the front end accepts is the honest input (two reads measured 280014 eval steps on CI,
-// past the new-witness budget).
-fn advisory_route_read() -> DagSourceReadWitness {
-  DagSourceReadWitness {
-    source: Medium { carried: "module v2.test.fixture.advisory_route\n", fidelity: Lossless },
-    artifact: Artifact { kind: SourceFile, id: ^advisory_route_read, file_path: "src/v2/test/fixture/advisory_route.dag" },
-    compilation_unit: ^advisory_route_file,
-    source_root: DagTree
-  }
-}
-
-test fn a_supplied_residue_rides_each_accepted_file_through_the_real_assembly_fold_holds() -> Bool {
-  let advisory = Some {
-    diagnostics: diagnostics_singleton(d: Diagnostic {
-      reason: ^program_assembly_supplied_advisory,
-      at: invariant_port_locus(port: ^program_assembly_advisory_route, invariant: ^program_assembly_supplied_advisory),
-      correction: Unavailable { reason: ExternalContractUnknown }
-    })
-  }
-  let reads = [advisory_route_read()]
-  match dag_prepared_grammar() {
-    Rejected { diagnostics: _ } => false
-    Accepted { value: prepared, diagnostics: _ } =>
-      match program_assembly_ingest_scope_outcome(ingest: reads) {
-        Rejected { diagnostics: _ } => false
-        Accepted { value: scope, diagnostics: _ } =>
-          let start = ProgramAssemblyLocatedFoldOk {
-            located: Empty,
-            index: source_root_index_empty(),
-            alloc: occurrence_id_allocator_initial(),
-            spans: span_index_empty(),
-            advisories: None
-          }
-          match program_assembly_fold_step(state: start, read: advisory_route_read(), lex: prepare_lex_rules(rules: dag_language_model().lex), prepared: prepared, residue: advisory, scope: scope) {
-            ProgramAssemblyLocatedFoldFailed { diagnostics: _, spans: _ } => false
-            ProgramAssemblyLocatedFoldOk { located: located, index: _, alloc: _, spans: _, advisories: carried } =>
-              length(xs: located) == 1
-                && (match carried {
-                  None => false
-                  Some { diagnostics: d } =>
-                    d.head.reason == ^program_assembly_supplied_advisory
-                      && length(xs: d.tail) == 0
-                })
-          }
-      }
-  }
-}
-
 // A REFUSING FILE KEEPS THE ADVISORIES THE INGEST ACCUMULATED BEFORE IT. The fold state is supplied
 // already holding one accepted file's advisory (adv_a); the next real read refuses at parse. The
 // failed state must carry adv_a ahead of the refusal, exactly as rejected_with_pending orders a
@@ -131,7 +70,7 @@ test fn a_later_refusal_keeps_the_accumulated_advisories_ahead_of_its_fatal_hold
               })
             }
           }
-          match program_assembly_fold_step(state: accumulated, read: advisory_route_refusing_read(), lex: prepare_lex_rules(rules: dag_language_model().lex), prepared: prepared, residue: None, scope: scope) {
+          match program_assembly_fold_step(state: accumulated, read: advisory_route_refusing_read(), lex: prepare_lex_rules(rules: dag_language_model().lex), prepared: prepared, scope: scope) {
             ProgramAssemblyLocatedFoldOk { located: _, index: _, alloc: _, spans: _, advisories: _ } => false
             ProgramAssemblyLocatedFoldFailed { diagnostics: d, spans: _ } =>
               d.head.reason == ^adv_a
diff --git a/src/v2/test/claim/long/reference_conservation_advisory_route_test.dag b/src/v2/test/claim/long/reference_conservation_advisory_route_test.dag
deleted file mode 100644
index e8349a7e5c4..00000000000
--- a/src/v2/test/claim/long/reference_conservation_advisory_route_test.dag
+++ /dev/null
@@ -1,49 +0,0 @@
-module v2.test.claim.long.reference_conservation_advisory_route
-
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.reference_conservation { reference_conservation_report_lines, reference_conservation_subject_of_read }
-import v2.test.claim.namespace_xl0.reference_conservation { conservation_fixture_read, conservation_report_of }
-import v2.compiler.tokenize { prepare_lex_rules }
-import v2.extdeps.languages.dag { dag_language_model }
-import v2.std.algebra { any }
-import v2.std.diagnostic { Accepted, Diagnostic, Rejected, Some, Unavailable, UserInputBoundary, diagnostics_has_reason, diagnostics_singleton, invariant_port_locus }
-import v2.std.logic { Bool }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-// AN ACCEPTED SUBJECT'S ADVISORIES REACH THE REPORT AND ITS CENSUS LINES BY IDENTITY, THROUGH THE
-// REAL ROUTE. No advisory reaches the front end from real source today: the dag grammar's overlap
-// residue is empty (gunbc#13056). So the one advisory input is SUPPLIED at the boundary the route
-// already takes it through, reference_conservation_subject_of_read's `residue`, which the real
-// parse merges into the accepted outcome. A one-line module then goes through the real subject and
-// report path, and the report and its census lines must name the supplied reason. Dropping the
-// advisories at reference_conservation_of_subject_admitted (the old `diagnostics: _`) reds both
-// conjuncts. It lives in the long home because one real parse exceeds the new-witness CPU margin
-// (450ms against 302ms on CI); the renderer's supplied claim stays in
-// v2.test.claim.namespace_xl0.reference_conservation.
-data supplied_route_source: String = "module v2.test.reference_conservation_advisory_route\n"
-
-test fn an_accepted_subjects_advisories_reach_the_report_by_identity_holds() -> Bool {
-  match dag_prepared_grammar() {
-    Rejected { diagnostics: _ } => false
-    Accepted { value: prepared, diagnostics: _ } =>
-      let report = conservation_report_of(subject: reference_conservation_subject_of_read(
-        read: conservation_fixture_read(id_tail: "advisory_route", source: supplied_route_source),
-        lex: prepare_lex_rules(rules: dag_language_model().lex),
-        prepared: prepared,
-        residue: Some {
-          diagnostics: diagnostics_singleton(d: Diagnostic {
-            reason: ^reference_conservation_supplied_advisory,
-            at: invariant_port_locus(port: ^body_lowering_locus_port, invariant: ^reference_conservation_supplied_advisory),
-            correction: Unavailable { reason: UserInputBoundary }
-          })
-        }
-      ))
-      diagnostics_has_reason(d: report.advisories, reason: ^reference_conservation_supplied_advisory)
-        && any(
-          xs: reference_conservation_report_lines(report: report),
-          predicate: fn(line) { line == "advisory " + report.path + " reference_conservation_supplied_advisory" }
-        )
-  }
-}
diff --git a/src/v2/test/claim/mandatory_tag_supplied_carrier_witness_test.dag b/src/v2/test/claim/mandatory_tag_supplied_carrier_witness_test.dag
new file mode 100644
index 00000000000..4b0b12c0965
--- /dev/null
+++ b/src/v2/test/claim/mandatory_tag_supplied_carrier_witness_test.dag
@@ -0,0 +1,285 @@
+module v2.test.claim.mandatory_tag_supplied_carrier_witness
+
+import std.types { List }
+import v2.lens.mandatory_tag { mandatory_tag_compile_gate_with_provenance, mandatory_tag_lowered_candidate_findings, extdeps_external_authority_region }
+import v2.compiler.namespace_graft { namespace_graft_build_body_conj, namespace_graft_fold_spine, namespace_graft_wrap_module_shell }
+import v2.std.member_declaration_kind {
+  DeclaredDataMember,
+  DeclaredFnMember,
+  DeclaredMember,
+  MemberKindChannel,
+  MemberKindsCaptured,
+  QualifiedDeclaredMember,
+  declared_members_have_duplicate,
+  no_member_declaration_kinds
+}
+import v2.std.qualified_name { QualifiedName }
+import std.occurrence_identity { OccurrenceSynthetic }
+import v2.std.node { Arrow, Authored, ArrowBodyEdge, Atom, Edge, Node, Positional, TypeNode, Conj, core_edge_label }
+import std.algebra { Cons, Empty }
+import v2.std.diagnostic { Accepted, Rejected }
+import v2.std.integer { Int }
+import v2.std.node { Symbol }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+// FAST-LANE supplied-carrier controls for the mandatory-tag gate's lowered-member path (DESIGN section 3: a
+// witness discriminates at ONE interface, its inputs supplied rather than derived). No tokenize, parse or
+// normalize runs: the candidate Arrow, the grafted module and the member-kind channel are built values, so each
+// control costs a few hundred to ~2k eval steps and is selected by the required floor. The real route
+// (normalize -> captured member channel -> member_kind_channel_of_tree -> mandatory_tag_compile_gate_with_provenance)
+// is the pairing inhabitance claim in v2.test.long.mandatory_tag_gate_witness
+// (mandatory_tag_normalized_grain_clean_accepts); NOT executed by any claim: resolve_in_context ->
+// ResolvedTree.member_kinds -> validate_then_compile rebinding (gunbc.guarantee_stall
+// member_kind_door_binding_executed_by_no_claim_stall).
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+type GateProbe { root: Node  channel: MemberKindChannel }
+
+fn gate_accepts_tree(probe: GateProbe) -> Bool {
+  match mandatory_tag_compile_gate_with_provenance(node: probe.root, channel: probe.channel) {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+fn gate_rejects_tree_with(probe: GateProbe, reason: Symbol) -> Bool {
+  match mandatory_tag_compile_gate_with_provenance(node: probe.root, channel: probe.channel) {
+    Accepted { value: _, diagnostics: _ } => false
+    Rejected { diagnostics: d } =>
+      if d.head.reason == reason {
+        true
+      } else {
+        fold(d.tail, init: false, f: fn(acc, diag) { acc || diag.reason == reason })
+      }
+  }
+}
+
+// SUPPLIED-CARRIER CONTROLS at the lens's own interface (DESIGN section 3, a witness discriminates at one
+// interface): the candidate Arrow and the member-kind channel are supplied values, so no frontend runs. The
+// real route is executed only as far as: normalize -> captured member channel -> member_kind_channel_of_tree ->
+// mandatory_tag_compile_gate_with_provenance (mandatory_tag_normalized_grain_clean_accepts above; deleting that
+// integration makes it fail). NOT executed by any claim: resolve_in_context -> ResolvedTree.member_kinds ->
+// validate_then_compile rebinding; that link is the standing GuaranteeStall
+// gunbc.guarantee_stall member_kind_door_binding_executed_by_no_claim_stall.
+fn mt_atom(s: Symbol) -> Node {
+  Node { kind: TypeNode { connective: Atom { identity: s } }, children: [], occurrence_id: OccurrenceSynthetic }
+}
+
+fn mt_domain() -> Node {
+  Node { kind: TypeNode { connective: Conj }, children: [], occurrence_id: OccurrenceSynthetic }
+}
+
+fn mt_candidate(codomain: Symbol, body: List<Symbol>) -> Node {
+  Node {
+    kind: TypeNode { connective: Arrow },
+    children: [
+      Edge { label: Positional, target: mt_domain() },
+      Edge { label: Positional, target: mt_atom(s: codomain) },
+      Edge { label: core_edge_label(marker: ArrowBodyEdge), target: mt_body(atoms: body) }
+    ],
+    occurrence_id: OccurrenceSynthetic
+  }
+}
+
+fn mt_body(atoms: List<Symbol>) -> Node {
+  Node {
+    kind: TypeNode { connective: Conj },
+    children: fold(atoms, init: [], f: fn(acc, a) { concat(acc, [Edge { label: Positional, target: mt_atom(s: a) }]) }),
+    occurrence_id: OccurrenceSynthetic
+  }
+}
+
+fn mt_no_codomain() -> Node {
+  Node {
+    kind: TypeNode { connective: Arrow },
+    children: [Edge { label: Positional, target: mt_domain() }, Edge { label: core_edge_label(marker: ArrowBodyEdge), target: mt_body(atoms: [^Https]) }],
+    occurrence_id: OccurrenceSynthetic
+  }
+}
+
+fn mt_no_body() -> Node {
+  Node {
+    kind: TypeNode { connective: Arrow },
+    children: [Edge { label: Positional, target: mt_domain() }, Edge { label: Positional, target: mt_atom(s: ^ExternalAuthority) }],
+    occurrence_id: OccurrenceSynthetic
+  }
+}
+
+fn mt_channel(kind: MemberKindChannel) -> MemberKindChannel {
+  kind
+}
+
+fn mt_captured(kind: MemberKindDeclaredFor) -> MemberKindChannel {
+  MemberKindsCaptured {
+    covered: [mt_module()],
+    members: mt_members(kind: kind)
+  }
+}
+
+type MemberKindDeclaredFor
+  = ForData
+  | ForFn
+  | ForNothing
+
+fn mt_module() -> QualifiedName {
+  [^extdeps, ^gate_probe_supplied]
+}
+
+fn mt_members(kind: MemberKindDeclaredFor) -> List<QualifiedDeclaredMember> {
+  match kind {
+    ForData => [QualifiedDeclaredMember { module: mt_module(), name: ^extdeps_external_authority_anchor, kind: DeclaredDataMember }]
+    ForFn => [QualifiedDeclaredMember { module: mt_module(), name: ^extdeps_external_authority_anchor, kind: DeclaredFnMember }]
+    ForNothing => []
+  }
+}
+
+fn mt_findings(candidate: Node, channel: MemberKindChannel) -> List<Symbol> {
+  fold(
+    mandatory_tag_lowered_candidate_findings(
+      region: extdeps_external_authority_region,
+      module_node: candidate,
+      dotted: "extdeps.gate_probe_supplied",
+      candidate: candidate,
+      channel: channel
+    ),
+    init: [],
+    f: fn(acc, d) { concat(acc, [d.reason]) }
+  )
+}
+
+fn mt_only(candidate: Node, channel: MemberKindChannel, reason: Symbol) -> Bool {
+  match mt_findings(candidate: candidate, channel: channel) {
+    Cons { head: h, tail: Empty } => h == reason
+    Cons { head: _, tail: Cons { head: _, tail: _ } } => false
+    Empty => false
+  }
+}
+
+// TOP-LEVEL SELECTOR, SUPPLIED-CARRIER GRAIN: the grafted module is built directly (no parse, no normalize) by the
+// graft's own constructors. Its one DIRECT member is unrelated; the required name appears only NESTED inside that
+// member's Arrow as a valid Arrow, and the channel would admit that name as a data member. Must refuse as missing.
+fn mt_unrelated_member_nesting_anchor() -> Node {
+  Node {
+    kind: TypeNode { connective: Arrow },
+    children: [
+      Edge { label: Positional, target: mt_domain() },
+      Edge { label: Positional, target: mt_atom(s: ^Int) },
+      Edge { label: Authored { name: ^extdeps_external_authority_anchor }, target: mt_candidate(codomain: ^ExternalAuthority, body: [^Https]) }
+    ],
+    occurrence_id: OccurrenceSynthetic
+  }
+}
+
+fn mt_nested_anchor_module() -> Node {
+  namespace_graft_wrap_module_shell(captured: mt_nested_anchor_spine(), source: mt_domain())
+}
+
+fn mt_nested_anchor_spine() -> Node {
+  mt_spine_with(edges: [Edge { label: Authored { name: ^gate_probe_unrelated_row }, target: mt_unrelated_member_nesting_anchor() }])
+}
+
+fn mt_direct_anchor_module() -> Node {
+  namespace_graft_wrap_module_shell(
+    captured: mt_spine_with(edges: [Edge { label: Authored { name: ^extdeps_external_authority_anchor }, target: mt_candidate(codomain: ^ExternalAuthority, body: [^Https]) }]),
+    source: mt_domain()
+  )
+}
+
+fn mt_spine_with(edges: List<Edge>) -> Node {
+  namespace_graft_fold_spine(
+    qn: mt_module(),
+    body: namespace_graft_build_body_conj(
+      edges: edges,
+      source: mt_domain()
+    ),
+    source: mt_domain()
+  )
+}
+
+test fn mandatory_tag_supplied_nested_anchor_under_unrelated_member_refuses_as_missing() -> Bool {
+  gate_rejects_tree_with(
+    probe: GateProbe { root: mt_nested_anchor_module(), channel: mt_captured(kind: ForData) },
+    reason: ^mandatory_tag_missing_required_decl
+  )
+}
+
+test fn mandatory_tag_supplied_direct_anchor_member_in_grafted_module_accepts() -> Bool {
+  gate_accepts_tree(probe: GateProbe { root: mt_direct_anchor_module(), channel: mt_captured(kind: ForData) })
+}
+
+test fn mandatory_tag_supplied_data_member_with_good_carrier_accepts() -> Bool {
+  match mt_findings(candidate: mt_candidate(codomain: ^ExternalAuthority, body: [^Https]), channel: mt_captured(kind: ForData)) {
+    Empty => true
+    Cons { head: _, tail: _ } => false
+  }
+}
+
+test fn mandatory_tag_supplied_zero_arg_fn_same_shape_refuses_as_missing() -> Bool {
+  mt_only(
+    candidate: mt_candidate(codomain: ^ExternalAuthority, body: [^Https]),
+    channel: mt_captured(kind: ForFn),
+    reason: ^mandatory_tag_missing_required_decl
+  )
+}
+
+test fn mandatory_tag_supplied_member_not_declared_refuses_as_missing() -> Bool {
+  mt_only(
+    candidate: mt_candidate(codomain: ^ExternalAuthority, body: [^Https]),
+    channel: mt_captured(kind: ForNothing),
+    reason: ^mandatory_tag_missing_required_decl
+  )
+}
+
+test fn mandatory_tag_supplied_unread_provenance_refuses_as_unavailable() -> Bool {
+  mt_only(
+    candidate: mt_candidate(codomain: ^ExternalAuthority, body: [^Https]),
+    channel: no_member_declaration_kinds(),
+    reason: ^mandatory_tag_member_provenance_unavailable
+  )
+}
+
+test fn mandatory_tag_supplied_uncovered_module_refuses_as_unavailable() -> Bool {
+  mt_only(
+    candidate: mt_candidate(codomain: ^ExternalAuthority, body: [^Https]),
+    channel: MemberKindsCaptured { covered: [[^extdeps, ^some_other_module]], members: [] },
+    reason: ^mandatory_tag_member_provenance_unavailable
+  )
+}
+
+test fn mandatory_tag_supplied_wrong_codomain_refuses_as_type_mismatch() -> Bool {
+  mt_only(
+    candidate: mt_candidate(codomain: ^SomethingElse, body: [^Https]),
+    channel: mt_captured(kind: ForData),
+    reason: ^mandatory_tag_required_decl_type_mismatch
+  )
+}
+
+test fn mandatory_tag_supplied_missing_codomain_or_body_refuses() -> Bool {
+  mt_only(candidate: mt_no_codomain(), channel: mt_captured(kind: ForData), reason: ^mandatory_tag_required_decl_type_mismatch)
+    && mt_only(candidate: mt_no_body(), channel: mt_captured(kind: ForData), reason: ^mandatory_tag_value_vocabulary_unreadable)
+}
+
+test fn mandatory_tag_supplied_wrong_or_missing_vocabulary_atom_refuses() -> Bool {
+  mt_only(
+    candidate: mt_candidate(codomain: ^ExternalAuthority, body: [^File]),
+    channel: mt_captured(kind: ForData),
+    reason: ^mandatory_tag_value_not_accepted
+  )
+    && mt_only(
+      candidate: mt_candidate(codomain: ^ExternalAuthority, body: []),
+      channel: mt_captured(kind: ForData),
+      reason: ^mandatory_tag_value_vocabulary_unreadable
+    )
+}
+
+test fn member_kind_channel_duplicate_declaration_is_detected() -> Bool {
+  declared_members_have_duplicate(members: [
+    DeclaredMember { name: ^extdeps_external_authority_anchor, kind: DeclaredDataMember },
+    DeclaredMember { name: ^extdeps_external_authority_anchor, kind: DeclaredFnMember }
+  ])
+    && !declared_members_have_duplicate(members: [
+      DeclaredMember { name: ^extdeps_external_authority_anchor, kind: DeclaredDataMember },
+      DeclaredMember { name: ^other_member, kind: DeclaredFnMember }
+    ])
+}
diff --git a/src/v2/test/claim/manual/bind_demand_driven_eval_test.dag b/src/v2/test/claim/manual/bind_demand_driven_eval_test.dag
index 64b708f8015..7fced9579db 100644
--- a/src/v2/test/claim/manual/bind_demand_driven_eval_test.dag
+++ b/src/v2/test/claim/manual/bind_demand_driven_eval_test.dag
@@ -28,7 +28,7 @@ import v2.extdeps.runtimes.v2_evaluator {
 import v2.std.cardinality { termination_proof_witness_for_node }
 import v2.std.collection {
   Map,
-  map_get,
+  map_get_checked,
   map_insert
 }
 import std.optional {
@@ -171,7 +171,7 @@ fn bind_eval_int_from_runtime(value: RuntimeValue) -> Int {
 }
 
 fn bind_eval_touch_from_env(env: EvaluationEnvironment, key: EnvironmentBindingKey) -> Int {
-  match v2.std.collection.map_get(m: env.bindings, key: key) {
+  match v2.std.collection.map_get_checked(m: env.bindings, key: key) {
     Accepted { value: opt, diagnostics: _ } =>
       match opt {
         Present { value: v } => bind_eval_int_from_runtime(value: v)
diff --git a/src/v2/test/claim/manual/branch_lazy_arm_eval_acceptance_test.dag b/src/v2/test/claim/manual/branch_lazy_arm_eval_acceptance_test.dag
index 54f891e64a4..b95d3437bbd 100644
--- a/src/v2/test/claim/manual/branch_lazy_arm_eval_acceptance_test.dag
+++ b/src/v2/test/claim/manual/branch_lazy_arm_eval_acceptance_test.dag
@@ -25,7 +25,7 @@ import v2.std.cardinality { termination_proof_witness_for_node }
 import v2.std.collection {
   Map,
   list_at_optional,
-  map_get,
+  map_get_checked,
   map_insert
 }
 import std.optional {
@@ -228,7 +228,7 @@ fn lazy_arm_int_from_runtime(value: RuntimeValue) -> Int {
 }
 
 fn lazy_arm_touch_from_env(env: EvaluationEnvironment) -> Int {
-  match v2.std.collection.map_get(m: env.bindings, key: lazy_arm_touch_key()) {
+  match v2.std.collection.map_get_checked(m: env.bindings, key: lazy_arm_touch_key()) {
     Accepted { value: opt, diagnostics: _ } =>
       match opt {
         Present { value: v } => lazy_arm_int_from_runtime(value: v)
diff --git a/src/v2/test/claim/manual/cpp_add_emit_translate_test.dag b/src/v2/test/claim/manual/cpp_add_emit_translate_test.dag
index 37e4dd2dbad..4c9878b3cf3 100644
--- a/src/v2/test/claim/manual/cpp_add_emit_translate_test.dag
+++ b/src/v2/test/claim/manual/cpp_add_emit_translate_test.dag
@@ -13,7 +13,6 @@ import v2.compiler.eval {
   TestClaimEvalSubject,
   TestClaimRun,
   run_test_claim_assert,
-  test_claim_cache_receipt,
   test_claim_typed_input_node
 }
 import v2.compiler.translate { translate }
diff --git a/src/v2/test/claim/manual/go_add_emit_translate_test.dag b/src/v2/test/claim/manual/go_add_emit_translate_test.dag
index 35d03876949..9964e5d93d9 100644
--- a/src/v2/test/claim/manual/go_add_emit_translate_test.dag
+++ b/src/v2/test/claim/manual/go_add_emit_translate_test.dag
@@ -13,7 +13,6 @@ import v2.compiler.eval {
   TestClaimEvalSubject,
   TestClaimRun,
   run_test_claim_assert,
-  test_claim_cache_receipt,
   test_claim_typed_input_node
 }
 import v2.compiler.translate { translate }
diff --git a/src/v2/test/claim/manual/grammar_choice_ambiguity_audit.dag b/src/v2/test/claim/manual/grammar_choice_ambiguity_audit.dag
index a1916fd25a4..0e69b642523 100644
--- a/src/v2/test/claim/manual/grammar_choice_ambiguity_audit.dag
+++ b/src/v2/test/claim/manual/grammar_choice_ambiguity_audit.dag
@@ -5,7 +5,7 @@ fn witness_python_choice_ambiguity_count() -> Int {
   grammar_choice_ambiguity_count(root: python_grammar_root())
 }
 
-fn witness_python_grammar_validate_accepts_with_overlap_residue() -> Bool {
+fn witness_python_grammar_validate_accepts() -> Bool {
   let at = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^grammar_choice_ambiguity_audit_grammar_contract)
   match grammar_validate_for_parse(root: python_grammar_root(), at: at) {
     Accepted { value: _, diagnostics: _ } => true
@@ -17,16 +17,6 @@ fn witness_dag_choice_ambiguity_count() -> Int {
   grammar_choice_ambiguity_count(root: dag_grammar_root())
 }
 
-fn witness_dag_zero_nullable_choice_ambiguity() -> Bool {
-  is_empty(xs: grammar_nullable_ambiguity_rows(
-    roster: grammar_choice_ambiguity_roster(root: dag_grammar_root())
-  ))
-}
-
-fn witness_dag_overlap_residue_row_count() -> Int {
-  length(xs: grammar_choice_ambiguity_roster(root: dag_grammar_root()))
-}
-
 fn witness_dag_grammar_validate_accepts() -> Bool {
   let at = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^grammar_choice_ambiguity_audit_grammar_contract)
   match grammar_validate_for_parse(root: dag_grammar_root(), at: at) {
@@ -35,7 +25,7 @@ fn witness_dag_grammar_validate_accepts() -> Bool {
   }
 }
 
-// THE RESIDUE ROSTER BY IDENTITY, not a count plus its first row. Two rosters of equal length can
+// THE OVERLAP ROSTER BY IDENTITY, not a count plus its first row. Two rosters of equal length can
 // differ in every row, so a count cannot show a row was removed and another added. One line per
 // row: `production#k: overlap=[..] left=[..] right=[..]`, in roster order.
 //
@@ -56,7 +46,7 @@ fn grammar_choice_terminals_text(xs: FreeMonoid<Symbol>) -> String {
 }
 
 fn grammar_choice_ambiguity_row_identity(row: GrammarChoiceAmbiguityRow, ordinal: Int) -> String {
-  symbol_lexeme(sym: row.production) + "#" + integer_int_to_decimal_string(value: ordinal)
+  symbol_lexeme(sym: row.production) + "#" + int_to_decimal_string(value: ordinal)
     + ": overlap=[" + grammar_choice_terminals_text(xs: row.overlap_terminals)
     + "] left=[" + grammar_choice_terminals_text(xs: row.left_first_terminals)
     + "] right=[" + grammar_choice_terminals_text(xs: row.right_first_terminals) + "]"
@@ -69,7 +59,7 @@ type AuditRosterFold {
   lines: FreeMonoid<String>
 }
 
-fn witness_dag_overlap_residue_row_identities() -> String {
+fn witness_dag_overlap_row_identities() -> String {
   let folded = fold_list(
     xs: grammar_choice_ambiguity_roster(root: dag_grammar_root()),
     empty: AuditRosterFold { seen: empty_map(), lines: [] },
diff --git a/src/v2/test/claim/manual/infer_ground_add.dag b/src/v2/test/claim/manual/infer_ground_add.dag
index d4644b997bc..a38d7e0a6da 100644
--- a/src/v2/test/claim/manual/infer_ground_add.dag
+++ b/src/v2/test/claim/manual/infer_ground_add.dag
@@ -10,7 +10,6 @@ import v2.compiler.eval {
   TestClaimEvalSubject,
   TestClaimRun,
   eval_context_with_semantics,
-  test_claim_cache_receipt,
   test_claim_typed_input_node
 }
 import v2.std.verdict { Verdict, Pass, verdict_fail }
@@ -281,7 +280,7 @@ fn infer_add_receipt_run(
 ) -> TestClaimRun<Node, InferredTree> {
   let actual = anchor_infer_add()
   TestClaimRun {
-    cache: test_claim_cache_receipt(subject: subject),
+    claim: subject.claim,
     verdict: match test_claim_expected_outcome(c: subject.claim) {
       Accepted { value: expected, diagnostics: _ } =>
         match actual {
@@ -314,7 +313,7 @@ fn infer_descent_witness_receipt_run(
 ) -> TestClaimRun<Node, Node> {
   let actual = infer_descent_witness_contract_node(n: subject.input.evaluator_input)
   TestClaimRun {
-    cache: test_claim_cache_receipt(subject: subject),
+    claim: subject.claim,
     verdict: match test_claim_expected_outcome(c: subject.claim) {
       Accepted { value: expected, diagnostics: _ } =>
         if outcome_node_eq(a: actual, b: expected) {
diff --git a/src/v2/test/claim/manual/match_infer_fail_open_audit_test.dag b/src/v2/test/claim/manual/match_infer_fail_open_audit_test.dag
index 1ec0df9042b..d9d0f7030cc 100644
--- a/src/v2/test/claim/manual/match_infer_fail_open_audit_test.dag
+++ b/src/v2/test/claim/manual/match_infer_fail_open_audit_test.dag
@@ -19,7 +19,8 @@ import v2.std.diagnostic {
   NonEmptyDiagnostics,
   Outcome,
   Rejected,
-  Some
+  Some,
+  diagnostics_fatal_reason
 }
 import v2.std.node {
   Atom,
@@ -185,10 +186,16 @@ fn classical_not_int_match_arrow_fixture() -> Node {
   )
 }
 
+// Arms use dag_token_kw_true/false (bool-literal authority). infer still Rejects:
+// claim_resolved_tree_without_declarations never types the BindingRef scrutinee `a`
+// (GroundingNotDerived, not infer_match_pattern_not_bool_literal). Frozen
+// grandfathered identities stay the refuse names.
+
 test fn complement_body_real_infer_refuses_unsupported_pattern_holds() -> Bool {
   match infer(tree: claim_resolved_tree_without_declarations(root: dag_complement_body_fixture)) {
     Accepted { value: _, diagnostics: _ } => false
-    Rejected { diagnostics: _ } => true
+    Rejected { diagnostics: ds } =>
+      diagnostics_fatal_reason(d: ds) == ^infer_grounding_not_derived
   }
 }
 
@@ -237,15 +244,10 @@ test fn classical_not_int_match_non_octet_arm_rejects_holds() -> Bool {
   }
 }
 
-// complement infer refuses because match patterns use dag_complement_lit_* (unsupported by
-// infer_bool_literal_pattern_classify — only dag_token_kw_true/false). Refuse is
-// fail-closed-correct for that unsupported shape. Counted deficit: ground complement_lit on the
-// bool-literal authority (post-exit breadth); target witness is then
-// complement_arrow_real_infer_holds.
-
 test fn complement_arrow_real_infer_refuses_unsupported_pattern_holds() -> Bool {
   match infer(tree: claim_resolved_tree_without_declarations(root: dag_complement_arrow_with_body_fixture)) {
     Accepted { value: _, diagnostics: _ } => false
-    Rejected { diagnostics: _ } => true
+    Rejected { diagnostics: ds } =>
+      diagnostics_fatal_reason(d: ds) == ^infer_grounding_not_derived
   }
 }
diff --git a/src/v2/test/claim/manual/parse_mechanism_probe.dag b/src/v2/test/claim/manual/parse_mechanism_probe.dag
index 146eb5df6a8..d9da6d52055 100644
--- a/src/v2/test/claim/manual/parse_mechanism_probe.dag
+++ b/src/v2/test/claim/manual/parse_mechanism_probe.dag
@@ -20,54 +20,8 @@ fn pmp_tokenize_parse_path(path: String) -> Bool {
   pmp_tokenize_parse_text(source_text: source)
 }
 
-fn pmp_memo_stats_text(source_text: String) -> ParseMemoStats {
-  let lm = dag_language_model()
-  let at = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^parse_mechanism_probe_grammar_contract)
-  match tokenize(text: source_text, file: pmp_anchor, rules: lm.lex) {
-    Rejected { diagnostics: _ } =>
-      ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-    Accepted { value: stream, diagnostics: _ } =>
-      match lm.grammar {
-        VoidGrammar =>
-          ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-        ModeledGrammar { root: root } =>
-          match grammar_validate_for_parse(root: root, at: at) {
-            Rejected { diagnostics: _ } =>
-              ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-            Accepted { value: validated, diagnostics: _ } =>
-              parse_production_memo_stats(
-                tokens: token_stream_remaining(stream: stream),
-                validated: validated,
-                production_name: validated.root.start,
-                materialization: Memoize
-              )
-          }
-      }
-  }
-}
-
-fn pmp_memo_stats_path(path: String) -> ParseMemoStats {
-  let source = filesystem_read(path: path).content
-  pmp_memo_stats_text(source_text: source)
-}
-
-fn pmp_memo_stats_report_path(path: String) -> List<Int> {
-  let stats = pmp_memo_stats_path(path: path)
-  Cons {
-    head: stats.hits,
-    tail: Cons {
-      head: stats.misses,
-      tail: Cons { head: stats.lookup_calls, tail: std.algebra.Empty }
-    }
-  }
-}
-
 data pmp_through_decimal_path: String = "src/v2/test/fixture/integer_census_trunc/through_decimal_compare.txt"
 
-fn pmp_through_decimal_memo_report() -> List<Int> {
-  pmp_memo_stats_report_path(path: pmp_through_decimal_path)
-}
-
 fn exp_nest_d1_parse_holds() -> Bool {
   pmp_tokenize_parse_path(path: "src/v2/test/fixture/parse_mechanism/nest_d1.dag")
 }
@@ -104,10 +58,6 @@ fn exp_through_compose_parse_holds() -> Bool {
   pmp_tokenize_parse_path(path: "src/v2/test/fixture/integer_census_trunc/through_compose_types.txt")
 }
 
-fn pmp_through_compose_memo_report() -> List<Int> {
-  pmp_memo_stats_report_path(path: "src/v2/test/fixture/integer_census_trunc/through_compose_types.txt")
-}
-
 fn exp_through_decimal_parse_holds() -> Bool {
   pmp_tokenize_parse_path(path: pmp_through_decimal_path)
 }
diff --git a/src/v2/test/claim/manual/python_add_emit_translate_test.dag b/src/v2/test/claim/manual/python_add_emit_translate_test.dag
index c61d3617e0c..d43a3142295 100644
--- a/src/v2/test/claim/manual/python_add_emit_translate_test.dag
+++ b/src/v2/test/claim/manual/python_add_emit_translate_test.dag
@@ -14,7 +14,6 @@ import v2.compiler.eval {
   TestClaimEvalSubject,
   TestClaimRun,
   run_test_claim_assert,
-  test_claim_cache_receipt,
   test_claim_typed_input_node
 }
 import v2.compiler.translate { translate }
diff --git a/src/v2/test/claim/manual/python_grammar_claim_test.dag b/src/v2/test/claim/manual/python_grammar_claim_test.dag
index bc25edc43fb..21675624869 100644
--- a/src/v2/test/claim/manual/python_grammar_claim_test.dag
+++ b/src/v2/test/claim/manual/python_grammar_claim_test.dag
@@ -1,11 +1,8 @@
 module v2.test.manual.python_grammar_claim
 
 import v2.compiler.parse {
-  grammar_choice_ambiguity_count,
   grammar_validate_for_parse,
-  parse_module_prepared,
   parse_production_tree,
-  prepare_grammar,
 }
 import v2.compiler.tokenize { tokenize }
 import v2.extdeps.languages.python {
@@ -15,7 +12,7 @@ import v2.extdeps.languages.python {
 }
 import v2.std.compilers.lexing { token_stream_remaining }
 import v2.std.diagnostic { Accepted, Outcome, Rejected, invariant_port_locus }
-import v2.std.grammar { ModeledGrammar, ParseTree }
+import v2.std.grammar { ParseTree }
 
 test fn python_grammar_validates_fixture() -> Bool {
   let at = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^python_grammar_claim_test_grammar_contract)
@@ -52,52 +49,3 @@ fn python_grammar_parse_fixture() -> Outcome<ParseTree> {
       }
   }
 }
-
-// ROUTE CONTROL for the suite production on real python source: a two-statement body
-// (assignment, return) lexes with python_lex and parses through python_production_fn_def, so the
-// suite's repetition is executed past its first statement. Two statements is the least input
-// that reaches the repetition; a longer body adds parse cost without adding a route.
-data python_multi_statement_suite_text: String = "def f(x):\n    y = x\n    return y"
-
-// The discriminating red: a suite is one or more statements, so a def whose body is empty refuses.
-data python_empty_suite_text: String = "def f(x):\n    "
-
-// Through the prepared door: prepare_grammar validates AND analyzes the grammar once, and the
-// module parse starts at the grammar's start production, python_production_fn_def. (Validating
-// with grammar_validate_for_parse and then calling parse_production_tree computes the FIRST
-// analysis twice, which is what put this control over its floor budget.)
-fn python_fn_def_parse(text: String) -> Outcome<ParseTree> {
-  match prepare_grammar(grammar: ModeledGrammar { root: python_grammar_root() }) {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: prepared, diagnostics: residue } =>
-      match tokenize(text: text, file: ^python_parse_fixture_file, rules: python_lex()) {
-        Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-        Accepted { value: stream, diagnostics: _ } =>
-          match parse_module_prepared(tokens: stream, prepared: prepared, validation_residue: residue) {
-            Rejected { diagnostics: r } => Rejected { diagnostics: r }
-            Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
-          }
-      }
-  }
-}
-
-test fn python_multi_statement_suite_parses() -> Bool {
-  match python_fn_def_parse(text: python_multi_statement_suite_text) {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-test fn python_empty_suite_refuses() -> Bool {
-  match python_fn_def_parse(text: python_empty_suite_text) {
-    Accepted { value: _, diagnostics: _ } => false
-    Rejected { diagnostics: _ } => true
-  }
-}
-
-// The family's discriminating control: the suite was python's one choice-overlap row
-// (count 1 as `stmt suite | stmt`); restructured, the roster is empty. The parse controls above
-// hold on both shapes because the language did not change -- this claim is what goes red.
-test fn python_grammar_has_no_choice_overlap() -> Bool {
-  grammar_choice_ambiguity_count(root: python_grammar_root()) == 0
-}
diff --git a/src/v2/test/claim/manual/rust_add_emit_translate_test.dag b/src/v2/test/claim/manual/rust_add_emit_translate_test.dag
index 1abd47de3b1..ee864317c2d 100644
--- a/src/v2/test/claim/manual/rust_add_emit_translate_test.dag
+++ b/src/v2/test/claim/manual/rust_add_emit_translate_test.dag
@@ -13,7 +13,6 @@ import v2.compiler.eval {
   TestClaimEvalSubject,
   TestClaimRun,
   run_test_claim_assert,
-  test_claim_cache_receipt,
   test_claim_typed_input_node
 }
 import v2.compiler.translate { coerce_grounded_node, translate }
diff --git a/src/v2/test/claim/manual/typescript_add_emit_translate_test.dag b/src/v2/test/claim/manual/typescript_add_emit_translate_test.dag
index 604d7809670..7793128bb79 100644
--- a/src/v2/test/claim/manual/typescript_add_emit_translate_test.dag
+++ b/src/v2/test/claim/manual/typescript_add_emit_translate_test.dag
@@ -14,7 +14,6 @@ import v2.compiler.eval {
   TestClaimEvalSubject,
   TestClaimRun,
   run_test_claim_assert,
-  test_claim_cache_receipt,
   test_claim_typed_input_node
 }
 import v2.compiler.translate { translate }
diff --git a/src/v2/test/claim/manual/typescript_pr3_typed_fn_translate_test.dag b/src/v2/test/claim/manual/typescript_pr3_typed_fn_translate_test.dag
index 4117f17bf30..1fb617564c9 100644
--- a/src/v2/test/claim/manual/typescript_pr3_typed_fn_translate_test.dag
+++ b/src/v2/test/claim/manual/typescript_pr3_typed_fn_translate_test.dag
@@ -11,7 +11,6 @@ import v2.compiler.eval {
   TestClaimEvalSubject,
   TestClaimRun,
   run_test_claim_assert,
-  test_claim_cache_receipt,
   test_claim_typed_input_node
 }
 import v2.compiler.target_serialize { target_serialize_source_from_model }
diff --git a/src/v2/test/claim/manual/typescript_record_task_translate_test.dag b/src/v2/test/claim/manual/typescript_record_task_translate_test.dag
index eb86a1c3614..eb8b453e5a4 100644
--- a/src/v2/test/claim/manual/typescript_record_task_translate_test.dag
+++ b/src/v2/test/claim/manual/typescript_record_task_translate_test.dag
@@ -11,7 +11,6 @@ import v2.compiler.eval {
   TestClaimEvalSubject,
   TestClaimRun,
   run_test_claim_assert,
-  test_claim_cache_receipt,
   test_claim_typed_input_node
 }
 import v2.compiler.target_serialize { target_serialize_source_from_model }
diff --git a/src/v2/test/claim/manual/value_null_split_witness_test.dag b/src/v2/test/claim/manual/value_null_split_witness_test.dag
index 2f7f12de851..a0afcf0f256 100644
--- a/src/v2/test/claim/manual/value_null_split_witness_test.dag
+++ b/src/v2/test/claim/manual/value_null_split_witness_test.dag
@@ -40,7 +40,7 @@ test fn optional_present_matches_present_pattern() -> Bool {
 }
 
 test fn map_get_miss_is_absent_not_present() -> Bool {
-  match v2.std.collection.map_get(empty_map(), "missing") {
+  match v2.std.collection.map_get_checked(empty_map(), "missing") {
     Accepted { value: Absent, diagnostics: _ } => true
     Accepted { value: Present { value: _ }, diagnostics: _ } => false
     Rejected { diagnostics: _ } => false
@@ -49,7 +49,7 @@ test fn map_get_miss_is_absent_not_present() -> Bool {
 
 test fn map_get_hit_is_present() -> Bool {
   let m = empty_map() |> map_insert("k", 7)
-  match v2.std.collection.map_get(m, "k") {
+  match v2.std.collection.map_get_checked(m, "k") {
     Accepted { value: Present { value: v }, diagnostics: _ } => v == 7
     Accepted { value: Absent, diagnostics: _ } => false
     Rejected { diagnostics: _ } => false
diff --git a/src/v2/test/claim/match_arm_binder_frame_test.dag b/src/v2/test/claim/match_arm_binder_frame_test.dag
index 583429fa7bc..a2b631e456a 100644
--- a/src/v2/test/claim/match_arm_binder_frame_test.dag
+++ b/src/v2/test/claim/match_arm_binder_frame_test.dag
@@ -9,13 +9,13 @@ import v2.compiler.name_resolve {
 }
 import v2.compiler.normalize { normalize }
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { assemble_program_from_ingest, dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { assemble_program_from_ingest, dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.compiler.source_authority {
   DagSourceReadWitness,
   SourceRootIngest
 }
-import v2.extdeps.languages.dag { dag_language_model, dag_lex }
+import v2.extdeps.languages.dag { dag_language_model }
 import std.algebra { Cons, Empty, FreeMonoid }
 import v2.std.cross_tree.import_model { V2Tree }
 import v2.std.artifact { Artifact, SourceFile }
@@ -331,13 +331,13 @@ test fn mab_binder_spelling_a_variant_declared_in_two_modules_refuses() -> Bool
 // capture itself is asserted, over all four spellings: a record, a nullary record, a where-alias,
 // and a coproduct with a fielded variant -- exactly the two records, in declaration order.
 fn mab_record_declarations(src: String) -> Outcome<FreeMonoid<Symbol>> {
-  match tokenize(text: src, file: ^match_arm_binder_record_probe, rules: dag_lex()) {
+  match tokenize_prepared(text: src, file: ^match_arm_binder_record_probe, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: r } => Rejected { diagnostics: r }
     Accepted { value: tokens, diagnostics: _ } =>
       match dag_prepared_grammar() {
         Rejected { diagnostics: r } => Rejected { diagnostics: r }
-        Accepted { value: prepared, diagnostics: residue } =>
-          match parse_module_prepared(tokens: tokens, prepared: prepared, validation_residue: residue) {
+        Accepted { value: prepared, diagnostics: _ } =>
+          match parse_module_prepared(tokens: tokens, prepared: prepared) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: _ } =>
               match normalize(parse_tree: artifact.tree) {
diff --git a/src/v2/test/claim/match_binder/match_binder_typing_test.dag b/src/v2/test/claim/match_binder/match_binder_typing_test.dag
index bdece9299d3..a1a69ae4b01 100644
--- a/src/v2/test/claim/match_binder/match_binder_typing_test.dag
+++ b/src/v2/test/claim/match_binder/match_binder_typing_test.dag
@@ -1,5 +1,6 @@
 module v2.test.claim.match_binder.match_binder_typing
 
+import v2.std.member_declaration_kind { no_member_declaration_kinds }
 import v2.compiler.resolve { ResolvedTree }
 import v2.compiler.infer { infer, inferred_facts_resolved_type }
 import v2.std.qualified_name { declaration_reference_path_optional, lexical_reference_label_optional, qualified_name_last_segment }
@@ -731,7 +732,8 @@ fn mbt_resolved() -> ResolvedTree {
     symbol_index: mbt_index(),
     resolved_declarations: empty_symbol_index(),
     lexical_bindings: empty_map(),
-    unavailable_providers: []
+    unavailable_providers: [],
+    member_kinds: no_member_declaration_kinds()
   }
 }
 
diff --git a/src/v2/test/claim/name_resolve/arrow_domain_is_first_positional_test.dag b/src/v2/test/claim/name_resolve/arrow_domain_is_first_positional_test.dag
index 84355b6d9ff..56f056137b2 100644
--- a/src/v2/test/claim/name_resolve/arrow_domain_is_first_positional_test.dag
+++ b/src/v2/test/claim/name_resolve/arrow_domain_is_first_positional_test.dag
@@ -2,7 +2,7 @@ module v2.test.name_resolve.arrow_domain_is_first_positional
 
 import v2.compiler.resolve { arrow_domain_frame_binders, arrow_domain_has_named_bindings }
 import v2.std.arrow_signature { declared_signature }
-import v2.compiler.symbol_index_fill { symbol_index_fill_containment_node }
+import v2.compiler.symbol_index_fill { disj_variant_counts_in_module, symbol_index_fill_containment_node }
 import v2.std.symbol_index { empty_symbol_index, symbol_index_lookup }
 import v2.std.qualified_name { qualified_name_from_dotted_string }
 import v2.std.collection { map_lookup }
@@ -58,7 +58,9 @@ test fn arrow_domain_is_first_positional_in_symbol_index_fill_holds() -> Bool {
     index: symbol_index_fill_containment_node(
       index: empty_symbol_index(),
       path: qualified_name_from_dotted_string(dotted: "m.f"),
-      node: adf_named_first_arrow()
+      node: adf_named_first_arrow(),
+      counts: disj_variant_counts_in_module(root: adf_named_first_arrow()),
+      module_qn: qualified_name_from_dotted_string(dotted: "m.f")
     ),
     qualified_path: qualified_name_from_dotted_string(dotted: "m.f.x")
   ) {
diff --git a/src/v2/test/claim/name_resolve/one_member_cost_probe_test.dag b/src/v2/test/claim/name_resolve/one_member_cost_probe_test.dag
index 04523fe0e4c..b9a577d0982 100644
--- a/src/v2/test/claim/name_resolve/one_member_cost_probe_test.dag
+++ b/src/v2/test/claim/name_resolve/one_member_cost_probe_test.dag
@@ -10,14 +10,14 @@ import v2.compiler.normalized_tree { NormalizedTree, admit_normalized_tree, no_i
 import v2.std.declaration_marker { test_marker_channel_empty }
 import v2.compiler.parse { parse_module }
 import v2.compiler.resolve { ResolvedTree }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.extdeps.languages.dag {
   dag_canonical_symbols,
   dag_grammar,
   dag_grammar_atom,
   dag_language_model,
   dag_language_model_surface_empty_prelude,
-  dag_lex,
   dag_named_edge,
   dag_surface_edge,
 }
@@ -177,10 +177,10 @@ test fn language_model_carries_its_canonical_symbols() -> Bool {
 data probe_front_end_source: String = "module probe.one_member\n"
 
 test fn tokenize_parse_one_member_does_not_run_resolve() -> Bool {
-  match tokenize(
+  match tokenize_prepared(
     text: probe_front_end_source,
     file: ^probe_front_end_file,
-    rules: dag_lex()
+    prepared: dag_prepared_lex()
   ) {
     Rejected { diagnostics: _ } => false
     Accepted { value: tokens, diagnostics: _ } =>
diff --git a/src/v2/test/claim/namespace_graft/marker_strip_test.dag b/src/v2/test/claim/namespace_graft/marker_strip_test.dag
index f80a39f8ce8..706436ac6e8 100644
--- a/src/v2/test/claim/namespace_graft/marker_strip_test.dag
+++ b/src/v2/test/claim/namespace_graft/marker_strip_test.dag
@@ -11,12 +11,8 @@ import v2.compiler.namespace_graft {
   namespace_graft_strip_provenance_marker
 }
 import v2.std.node { Atom, Edge, Authored, Node, Symbol, TypeNode }
-import v2.std.symbol_index {
-  empty_symbol_index,
-  symbol_index_lexical_lookup,
-  symbol_index_lookup
-}
-import v2.compiler.symbol_index_fill { symbol_index_fill_containment_node }
+import v2.std.symbol_index { empty_symbol_index, symbol_index_lexical_lookup, symbol_index_lookup }
+import v2.compiler.symbol_index_fill { disj_variant_counts_in_module, symbol_index_fill_containment_node }
 import v2.std.qualified_name {
   QualifiedName,
   qualified_name_from_dotted_string,
@@ -111,7 +107,9 @@ fn ms_fill_index(root: Node) -> SymbolIndex {
   symbol_index_fill_containment_node(
     index: empty_symbol_index(),
     path: Empty,
-    node: root
+    node: root,
+    counts: disj_variant_counts_in_module(root: root),
+    module_qn: Empty
   )
 }
 
diff --git a/src/v2/test/claim/namespace_xl0/body_shape_contract_test.dag b/src/v2/test/claim/namespace_xl0/body_shape_contract_test.dag
index 840188d3dfb..6a86f6c885d 100644
--- a/src/v2/test/claim/namespace_xl0/body_shape_contract_test.dag
+++ b/src/v2/test/claim/namespace_xl0/body_shape_contract_test.dag
@@ -4,9 +4,8 @@ import std.types { List }
 import v2.compiler.body_lowering_fold { body_lower_binary_operators, body_lower_prefix_operators }
 import v2.compiler.normalize { normalize }
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import std.algebra { list_append }
 import v2.std.collection { list_at_optional }
 import v2.std.compilers.body_lowering {
@@ -88,11 +87,11 @@ data body_shape_source: String = "module mq.shape\n\nimport std.types { Bool }\n
 fn body_shape_normalized_root() -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: body_shape_source, file: ^body_shape_contract_file, rules: dag_lex()),
+        o: tokenize_prepared(text: body_shape_source, file: ^body_shape_contract_file, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
-          match parse_module_prepared(tokens: token_stream, prepared: prepared, validation_residue: residue) {
+          match parse_module_prepared(tokens: token_stream, prepared: prepared) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: _ } =>
               match normalize(parse_tree: artifact.tree) {
diff --git a/src/v2/test/claim/namespace_xl0/reference_conservation_test.dag b/src/v2/test/claim/namespace_xl0/reference_conservation_test.dag
index a190cdecbd1..a30bb40e627 100644
--- a/src/v2/test/claim/namespace_xl0/reference_conservation_test.dag
+++ b/src/v2/test/claim/namespace_xl0/reference_conservation_test.dag
@@ -1,7 +1,6 @@
 module v2.test.claim.namespace_xl0.reference_conservation
 
-import v2.compiler.tokenize { prepare_lex_rules }
-import v2.compiler.program_assembly { dag_prepared_grammar }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
 import v2.compiler.reference_conservation {
   ReferenceConservationReport,
   ReferenceConservationSubject,
@@ -20,7 +19,7 @@ import std.algebra { Cons, Empty }
 import std.optional { Absent, Present }
 import v2.compiler.source_authority { DagSourceReadWitness }
 import v2.compiler.occurrence_role { NameProductionTableAdmission, NameProductionTableRefused, NameRoleNotYetRead, dag_name_production_rows, name_production_table_admission, name_row }
-import v2.extdeps.languages.dag { dag_grammar_root, dag_language_model }
+import v2.extdeps.languages.dag { dag_grammar_root }
 import v2.std.algebra { any, fold_list, length, list_map }
 import v2.std.artifact { Artifact, SourceFile }
 import v2.std.cross_tree.import_model { DagTree }
@@ -28,7 +27,8 @@ import v2.std.diagnostic { Accepted, ByteRange, Diagnostic, Rejected, Some, Text
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.node { Symbol, symbol_intern_lexeme }
 import v2.std.text { String }
-import v2.std.integer { Int, integer_int_to_decimal_string }
+import v2.std.integer { Int }
+import std.integer { int_to_decimal_string }
 import extdeps.communication.medium { Lossless, Medium }
 import std.process { ProcessExit, exit_failure }
 
@@ -67,12 +67,11 @@ fn conservation_fixture_read(id_tail: String, source: String) -> DagSourceReadWi
 // once; every claim still executes reference_conservation_of_subject, which is what it names.
 fn conservation_subject(id_tail: String, source: String) -> ReferenceConservationSubject {
   match dag_prepared_grammar() {
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       reference_conservation_subject_of_read(
         read: conservation_fixture_read(id_tail: id_tail, source: source),
         lex: prepare_lex_rules(rules: dag_language_model().lex),
-        prepared: prepared,
-        residue: residue
+        prepared: prepared
       )
     Rejected { diagnostics: d } =>
       ReferenceConservationSubject { path: "grammar-unprepared", parsed: Rejected { diagnostics: d }, normalized: Rejected { diagnostics: d } }
@@ -175,7 +174,7 @@ test fn a_block_with_a_second_statement_is_refused_not_accepted_holds() -> Bool
 // how the report counts a refused body.
 fn block_second_statement_numbers() -> ProcessExit {
   let r = block_second_statement_report()
-  exit_failure(reason: "authored=" + integer_int_to_decimal_string(value: r.authored) + " conserved=" + integer_int_to_decimal_string(value: r.conserved) + " locus_erased=" + integer_int_to_decimal_string(value: r.locus_erased) + " refused=" + integer_int_to_decimal_string(value: r.refused) + " dropped=" + integer_int_to_decimal_string(value: length(xs: r.dropped)))
+  exit_failure(reason: "authored=" + int_to_decimal_string(value: r.authored) + " conserved=" + int_to_decimal_string(value: r.conserved) + " locus_erased=" + int_to_decimal_string(value: r.locus_erased) + " refused=" + int_to_decimal_string(value: r.refused) + " dropped=" + int_to_decimal_string(value: length(xs: r.dropped)))
 }
 
 // ---- former drop 2: a call argument inside an if-arm (repaired by #12221) ---------------------
diff --git a/src/v2/test/claim/namespace_xl0/value_position_whole_read_test.dag b/src/v2/test/claim/namespace_xl0/value_position_whole_read_test.dag
index 45cbf69e8c6..2e05f68ca63 100644
--- a/src/v2/test/claim/namespace_xl0/value_position_whole_read_test.dag
+++ b/src/v2/test/claim/namespace_xl0/value_position_whole_read_test.dag
@@ -117,8 +117,8 @@ data vpw_two_lambdas_source: String = "module v2.test.vpw_two_lambdas\n\nimport
 // once lowered to the literal's first token, dropping the literal and its `-> Bool`.
 data vpw_let_fn_literal_source: String = "module v2.test.vpw_let_fn_literal\n\nimport std.types { Bool }\n\nfn vpw_probe(x: Bool) -> Bool {\n  let g = fn(y) -> Bool { y }\n  x\n}\n"
 
-// A FIELD PROJECTION ON A CALL RESULT (warm-bear-132's 02_parse c02590, parse_memo_recurrence_census:
-// `acc + expr_parse_demand_fold(expr: p.expression).discarding_sites`), once as an operator operand
+// A FIELD PROJECTION ON A CALL RESULT (warm-bear-132's 02_parse c02590, in a parse census since
+// deleted with the parse memo: `acc + expr_parse_demand_fold(expr: p.expression).discarding_sites`), once as an operator operand
 // inside a fn literal -- the specimen -- and once as a two-step projection in fn-body value position.
 // Before the chain door lowered a call head, the first refused its module operator_operand_unread.
 data vpw_call_projection_source: String = "module v2.test.vpw_call_projection\n\nimport std.types { Bool }\n\nfn vpw_probe(p: Bool) -> Bool { vpw_fold(f: fn(acc, q) { acc + vpw_demand(e: q.expression).sites }) }\n\nfn vpw_probe_chain(p: Bool) -> Bool { vpw_demand_two(e: p).outer.inner }\n"
diff --git a/src/v2/test/claim/namespace_xl0/value_read_refusal_test.dag b/src/v2/test/claim/namespace_xl0/value_read_refusal_test.dag
index b7178591e51..02ffbdd0b18 100644
--- a/src/v2/test/claim/namespace_xl0/value_read_refusal_test.dag
+++ b/src/v2/test/claim/namespace_xl0/value_read_refusal_test.dag
@@ -2,9 +2,9 @@ module v2.test.claim.namespace_xl0.value_read_refusal
 
 import v2.compiler.normalize { normalize }
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex, parse_production_emitted_identity_optional }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
+import v2.extdeps.languages.dag { parse_production_emitted_identity_optional }
 import v2.std.algebra { fold_list }
 import v2.std.diagnostic { Accepted, Diagnostic, NodeLocus, Rejected, diagnostics_fatal }
 import v2.std.grammar { node_atom_identity_optional }
@@ -46,7 +46,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 //
 // WHAT IS NOT CLAIMED HERE, AND WHY. The brief asked for a control that an arm missing `=>` still
 // refuses as match_arm_navigation_refused. That source does not reach lowering: the parser refuses
-// it (parse_grammar_choice_overlap_residue), so no source text can drive the navigation arm from
+// it, so no source text can drive the navigation arm from
 // this route, and a control that cannot go red on this route would be a decoration (DESIGN section
 // 4b). The navigation refusal survives only for a parse tree whose arm has no pattern or no `=>`.
 data vrr_header: String = "module mq.vrr\n\nimport std.types { Bool }\n\ntype VrrRecord { f: Bool }\n\n"
@@ -142,11 +142,11 @@ fn vrr_observe_refusal(d: Diagnostic) -> VrrObserved {
 fn vrr_observe(source: String) -> VrrObserved {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => vrr_observe_refusal(d: diagnostics_fatal(d: d))
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       match tokenize(text: source, file: ^value_read_refusal_file, rules: dag_lex()) {
         Rejected { diagnostics: d } => vrr_observe_refusal(d: diagnostics_fatal(d: d))
         Accepted { value: token_stream, diagnostics: _ } =>
-          match parse_module_prepared(tokens: token_stream, prepared: prepared, validation_residue: residue) {
+          match parse_module_prepared(tokens: token_stream, prepared: prepared) {
             Rejected { diagnostics: d } => vrr_observe_refusal(d: diagnostics_fatal(d: d))
             Accepted { value: artifact, diagnostics: _ } =>
               match normalize(parse_tree: artifact.tree) {
diff --git a/src/v2/test/claim/native_cache_fusion_test.dag b/src/v2/test/claim/native_cache_fusion_test.dag
deleted file mode 100644
index 0afc1a09d93..00000000000
--- a/src/v2/test/claim/native_cache_fusion_test.dag
+++ /dev/null
@@ -1,30 +0,0 @@
-module v2.test.claim.native_cache_fusion_test
-
-import v2.workflow.native_cache_fusion {
-  HostWarmObservation,
-  host_compile_skipped,
-  fusion_agreement_holds_for
-}
-
-test fn witness_warm_marker_agrees_share() -> Bool {
-  fusion_agreement_holds_for(
-    o: HostWarmObservation { marker_exists: true, cold_control: false }
-  )
-}
-
-test fn witness_cold_marker_absent_agrees_recompute() -> Bool {
-  fusion_agreement_holds_for(
-    o: HostWarmObservation { marker_exists: false, cold_control: false }
-  )
-}
-
-test fn witness_cold_control_forces_recompute_agreement() -> Bool {
-  let skipped = host_compile_skipped(
-    o: HostWarmObservation { marker_exists: true, cold_control: true }
-  )
-  skipped == false
-    && fusion_agreement_holds_for(
-      o: HostWarmObservation { marker_exists: true, cold_control: true }
-    )
-}
-
diff --git a/src/v2/test/claim/native_census/cascade_root_fan_out_test.dag b/src/v2/test/claim/native_census/cascade_root_fan_out_test.dag
index f774715c27f..45ac2a4efd2 100644
--- a/src/v2/test/claim/native_census/cascade_root_fan_out_test.dag
+++ b/src/v2/test/claim/native_census/cascade_root_fan_out_test.dag
@@ -117,6 +117,7 @@ fn cascade_census(ingest: SourceRootIngest) -> CascadeCensus {
           cons: fn(acc, entry) {
             native_census_cause_groups_add_module(
               groups: acc,
+              closure: closure,
               entry: entry,
               step: native_census_module_resolution(context: context, refusal_index: refusal_index, entry: entry)
             )
diff --git a/src/v2/test/claim/native_census/infer_cascade_test.dag b/src/v2/test/claim/native_census/infer_cascade_test.dag
new file mode 100644
index 00000000000..2877be8adb7
--- /dev/null
+++ b/src/v2/test/claim/native_census/infer_cascade_test.dag
@@ -0,0 +1,332 @@
+module v2.test.claim.native_census.infer_cascade
+
+import v2.compiler.compile {
+  NativeCensusCascadeMemberOf,
+  NativeCensusCascadeNone,
+  NativeCensusCascadeUnattributed,
+  NativeCensusCascadeRoot,
+  NativeCensusCauseFrontEnd,
+  NativeCensusCauseInfer,
+  NativeCensusCauseMember,
+  NativeCensusCauseResolve,
+  NativeCensusCauseStage,
+  NativeCensusClosureFanOutAtLeast,
+  NativeCensusClosureFanOutCounted,
+  NativeCensusClosureFanOutUnavailable,
+  NativeCensusClosureIndexRead,
+  NativeCensusInSubjectClosure,
+  NativeCensusModule,
+  NativeCensusOutsideSubjectClosure,
+  NativeCensusSubjectMembership,
+  NativeCensusSubjectMembershipUnavailable,
+  NativeImportTargetAttribution,
+  NativeImportTargetsAdmitted,
+  native_census_infer_cascade_of,
+  native_census_cause_group_rows,
+  native_census_cause_groups_add_infer_module,
+  native_census_cause_groups_from_file_refusals,
+  native_census_closure_index,
+  native_census_module_inference,
+  native_census_module_paths,
+  native_census_modules,
+  native_census_root_subject_membership,
+  native_census_roots_ranked,
+  native_census_subject_closure,
+  native_lane_file_refusal_index,
+  native_test_context_from_ingest
+}
+import v2.compiler.resolve { ClosureProviderRefusal }
+import v2.compiler.source_authority { DagSourceReadWitness, SourceRootIngest }
+import v2.std.algebra { fold_list, length, list_map }
+import v2.std.integer { Int }
+import std.algebra { Cons, Empty }
+import v2.std.artifact { Artifact, SourceFile }
+import extdeps.communication.medium { Lossless, Medium }
+import v2.std.cross_tree.import_model { DagTree }
+import v2.std.diagnostic { Accepted, CorrectionNotModeled, DeclarationLocus, Diagnostic, NonEmptyDiagnostics, Rejected, Unavailable }
+import v2.std.collection { List, Map, empty_map, map_insert }
+import std.optional { optional_present }
+import v2.std.qualified_name { QualifiedName, qualified_name_from_dotted_string }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import v2.std.logic { Bool }
+import v2.std.node { Symbol }
+import v2.std.text { String }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// CENSUS PART 2'S CASCADE CONTROLS, STRUCTURED BY THE DESIGN SECTION 3 WITNESS RULE. ONE inhabitance
+// claim runs the real census-infer route over supplied source bytes: native_test_context_from_ingest, the
+// census roster, the closure index, native_census_module_inference per module (resolve, then the real
+// infer_and_discharge) and native_census_cause_groups_add_infer_module. Removing the infer cascade from
+// that route reds it. Every other control supplies values to the decision it judges
+// (native_census_infer_cascade_of, native_census_subject_closure, native_census_root_subject_membership)
+// and runs no front end.
+//
+// THE EDGE THESE CONTROLS EXERCISE IS THE ONE v2 INFER HAS (v2.compiler.compile
+// native_census_infer_cascade, superseding docs/plans/census-part-2-inference-design.md section 4 on
+// this point). Provider b fails RESOLVE (an unbound name in a body beside the record). Importer a
+// resolves, because b's declarations are indexed, and then fails INFER projecting that record, because
+// a provider that never resolved contributes nothing to the closure index. a's chain carries b's
+// resolve chain immediately ahead of its closure-miss fatal.
+
+data infer_b_unresolvable_source: String = "module v2.census_infer_b\n\ntype InferLeg {\n  target: Int\n}\n\nfn census_infer_b_broken() -> Int {\n  no_such_name_anywhere\n}\n"
+
+data infer_a_source: String = "module v2.census_infer_a\n\nimport v2.census_infer_b { InferLeg }\n\nfn census_infer_a_read(l: InferLeg) -> Int {\n  l.target\n}\n"
+
+fn infer_read(source: String, unit: Symbol, path: String) -> DagSourceReadWitness {
+  DagSourceReadWitness {
+    source: Medium { carried: source, fidelity: Lossless },
+    artifact: Artifact { kind: SourceFile, id: unit, file_path: path },
+    compilation_unit: unit,
+    source_root: DagTree
+  }
+}
+
+fn infer_ingest(b_source: String) -> SourceRootIngest {
+  [
+    infer_read(source: infer_a_source, unit: ^census_infer_a_cu, path: "dag/census_infer_a.dag"),
+    infer_read(source: b_source, unit: ^census_infer_b_cu, path: "dag/census_infer_b.dag")
+  ]
+}
+
+// WHAT THE CENSUS REPORTED, reduced to what the claims read. `walls` counts every member that is NOT a
+// cascade member, so a census that filed a's infer refusal as a root of its own is counted there.
+type InferCensus
+  = InferCensusContextRefused
+  | InferCensusReported {
+      walls: Int
+      roots: List<NativeCensusCauseMember>
+      a_members: List<NativeCensusCauseMember>
+    }
+
+fn infer_census(ingest: SourceRootIngest) -> InferCensus {
+  match native_test_context_from_ingest(ingest: ingest) {
+    Rejected { diagnostics: _ } => InferCensusContextRefused
+    Accepted { value: context, diagnostics: _ } =>
+      {
+        let refusal_index = native_lane_file_refusal_index(refusals: context.file_refusals)
+        let modules = native_census_modules(ingest: ingest)
+        let closure = native_census_closure_index(context: context, refusal_index: refusal_index, modules: modules)
+        let module_paths = native_census_module_paths(modules: modules)
+        let groups = fold_list(
+          xs: modules,
+          empty: native_census_cause_groups_from_file_refusals(refusals: context.file_refusals, closure: closure, resolves: true),
+          cons: fn(acc, entry) {
+            native_census_cause_groups_add_infer_module(
+              groups: acc,
+              closure: closure,
+              module_paths: module_paths,
+              entry: entry,
+              step: native_census_module_inference(context: context, refusal_index: refusal_index, entry: entry)
+            )
+          }
+        )
+        let rows = native_census_cause_group_rows(groups: groups)
+        let roots = native_census_roots_ranked(rows: rows)
+        InferCensusReported {
+          walls: fold_list(xs: rows, empty: 0, cons: fn(n, g) {
+            fold_list(xs: g.members, empty: n, cons: fn(k, m) {
+              match m.cascade {
+                NativeCensusCascadeMemberOf { root: _, root_reason: _ } => k
+                NativeCensusCascadeNone => k + 1
+                NativeCensusCascadeUnattributed { reason: _ } => k + 1
+                NativeCensusCascadeRoot { closure_fan_out: _, resolve_refused_importers: _ } => k + 1
+              }
+            })
+          }),
+          roots: roots,
+          a_members: fold_list(xs: rows, empty: Empty, cons: fn(acc, g) {
+            fold_list(xs: g.members, empty: acc, cons: fn(ms, m) {
+              if m.path == ^census_infer_a_cu { Cons { head: m, tail: ms } } else { ms }
+            })
+          })
+        }
+      }
+  }
+}
+
+// THE ONE REAL-ROUTE PRODUCER, read by the one inhabitance claim below. It is a single-claim fill-debt
+// member of v2.workflow.floor_pure_producer_share floor_single_claim_fill_debt: assemble, resolve and
+// infer of a two-module fixture is more than one claim's budget.
+fn infer_cascade_census() -> InferCensus { infer_census(ingest: infer_ingest(b_source: infer_b_unresolvable_source)) }
+
+fn infer_stage_is(stage: NativeCensusCauseStage, infer: Bool) -> Bool {
+  match stage {
+    NativeCensusCauseInfer => infer
+    NativeCensusCauseResolve => !infer
+    NativeCensusCauseFrontEnd => false
+  }
+}
+
+// THE ONE ROOT IS b, AT THE GIVEN STAGE, WITH AN EXACT CLOSURE FAN-OUT.
+fn infer_single_root_is_b(roots: List<NativeCensusCauseMember>, infer: Bool, fan_out: Int) -> Bool {
+  match roots {
+    Empty => false
+    Cons { head: m, tail: rest } =>
+      length(xs: rest) == 0 && m.path == ^census_infer_b_cu && infer_stage_is(stage: m.stage, infer: infer) && match m.cascade {
+        NativeCensusCascadeRoot { closure_fan_out: f, resolve_refused_importers: _ } =>
+          match f {
+            NativeCensusClosureFanOutCounted { modules: n } => n == fan_out
+            NativeCensusClosureFanOutAtLeast { modules: _, unread_refused_files: _ } => false
+            NativeCensusClosureFanOutUnavailable { reason: _ } => false
+          }
+        NativeCensusCascadeNone => false
+        NativeCensusCascadeMemberOf { root: _, root_reason: _ } => false
+        NativeCensusCascadeUnattributed { reason: _ } => false
+      }
+  }
+}
+
+// THE INHABITANCE CLAIM (DESIGN section 3 pairing): THE CASCADE OVER THE REAL ROUTE. b refuses resolve, a refuses infer only because b's record never entered the
+// closure index. Expected: ONE wall, b, a Resolve-stage root with closure fan-out 1 ({a}). a has exactly
+// one member, at the Infer stage, a cascade member of b. RED if a's infer refusal is filed as its own root
+// (walls 2), if a's row is stamped Resolve (the stage conflation design section 3 forbids), if b carries no
+// fan-out, or if the infer call is gone (a has no member at all).
+test fn census_infer_provider_cascade_is_one_root_with_fan_out_one_holds() -> Bool {
+  match infer_cascade_census() {
+    InferCensusContextRefused => false
+    InferCensusReported { walls: w, roots: roots, a_members: a } =>
+      w == 1
+        && infer_single_root_is_b(roots: roots, infer: false, fan_out: 1)
+        && match a {
+          Empty => false
+          Cons { head: m, tail: rest } =>
+            length(xs: rest) == 0 && infer_stage_is(stage: m.stage, infer: true) && match m.cascade {
+              NativeCensusCascadeMemberOf { root: r, root_reason: _ } => r == ^census_infer_b_cu
+              NativeCensusCascadeNone => false
+              NativeCensusCascadeRoot { closure_fan_out: _, resolve_refused_importers: _ } => false
+              NativeCensusCascadeUnattributed { reason: _ } => false
+            }
+        }
+  }
+}
+
+
+// ── supplied-value claims: native_census_infer_cascade_of and the subject closure, at their interface ──
+//
+// The real route above establishes that infer emits the chain shape these claims supply: a provider's
+// resolve chain carried immediately before the closure-miss fatal, with the module's own advisories
+// ahead of it. Each claim below hands the decision that shape directly, so none re-runs a front end.
+
+fn sv_diagnostic(reason: Symbol) -> Diagnostic {
+  Diagnostic { reason: reason, at: DeclarationLocus { declaration: [] }, correction: Unavailable { reason: CorrectionNotModeled } }
+}
+
+fn sv_chain(reasons: List<Symbol>) -> NonEmptyDiagnostics {
+  match reasons {
+    Empty => NonEmptyDiagnostics { head: sv_diagnostic(reason: ^sv_empty), tail: [] }
+    Cons { head: h, tail: t } => NonEmptyDiagnostics { head: sv_diagnostic(reason: h), tail: list_map(xs: t, f: fn(r) { sv_diagnostic(reason: r) }) }
+  }
+}
+
+fn sv_provider(module: String, reasons: List<Symbol>) -> ClosureProviderRefusal {
+  ClosureProviderRefusal { module: qualified_name_from_dotted_string(dotted: module), refusal: sv_chain(reasons: reasons) }
+}
+
+data sv_paths: Map<String, Symbol> = map_insert(map_insert(empty_map(), "v2.sv_b", ^sv_b_cu), "v2.sv_c", ^sv_c_cu)
+
+fn sv_admitted(provider: QualifiedName) -> NativeImportTargetAttribution { NativeImportTargetsAdmitted }
+
+// b's resolve chain [own advisory, unbound], carried before the miss, behind a's own advisory.
+data sv_cascade_chain: List<Symbol> = [^sv_a_advisory, ^sv_b_advisory, ^resolve_reason_unbound_symbol, ^infer_reason_projection_receiver_declaration_unavailable]
+
+fn sv_cascade_is_member_of(cascade: NativeCensusCascade, root: Symbol) -> Bool {
+  match cascade {
+    NativeCensusCascadeMemberOf { root: r, root_reason: _ } => r == root
+    NativeCensusCascadeNone => false
+    NativeCensusCascadeUnattributed { reason: _ } => false
+    NativeCensusCascadeRoot { closure_fan_out: _, resolve_refused_importers: _ } => false
+  }
+}
+
+fn sv_cascade_is_own_root(cascade: NativeCensusCascade) -> Bool {
+  match cascade {
+    NativeCensusCascadeNone => true
+    NativeCensusCascadeMemberOf { root: _, root_reason: _ } => false
+    NativeCensusCascadeUnattributed { reason: _ } => false
+    NativeCensusCascadeRoot { closure_fan_out: _, resolve_refused_importers: _ } => false
+  }
+}
+
+fn sv_cascade_is_unattributed(cascade: NativeCensusCascade) -> Bool {
+  match cascade {
+    NativeCensusCascadeUnattributed { reason: _ } => true
+    NativeCensusCascadeNone => false
+    NativeCensusCascadeMemberOf { root: _, root_reason: _ } => false
+    NativeCensusCascadeRoot { closure_fan_out: _, resolve_refused_importers: _ } => false
+  }
+}
+
+// THE PROVIDER CHAIN AT THE END, NOT THE HEAD. RED under a prefix match (a's own advisory leads), and RED
+// if the module's own advisories were required to be absent.
+test fn census_infer_cascade_matches_the_provider_chain_ahead_of_the_miss_holds() -> Bool {
+  sv_cascade_is_member_of(
+    cascade: native_census_infer_cascade_of(module_paths: sv_paths, providers: [sv_provider(module: "v2.sv_b", reasons: [^sv_b_advisory, ^resolve_reason_unbound_symbol])], chain: sv_chain(reasons: sv_cascade_chain), attribution: sv_admitted),
+    root: ^sv_b_cu
+  )
+}
+
+// THE NEGATIVE: an infer refusal whose fatal is not the closure miss is its own root even with a refused
+// provider in the tree, and so is a miss no refused provider leads. RED if any refused provider in the
+// tree were blamed (the infer->infer edge v2 infer does not have).
+test fn census_infer_refusal_not_led_by_a_provider_is_its_own_root_holds() -> Bool {
+  let providers = [sv_provider(module: "v2.sv_b", reasons: [^resolve_reason_unbound_symbol])]
+  sv_cascade_is_own_root(cascade: native_census_infer_cascade_of(module_paths: sv_paths, providers: providers, chain: sv_chain(reasons: [^sv_a_advisory, ^infer_reason_projection_receiver_declares_no_fields]), attribution: sv_admitted))
+    && sv_cascade_is_own_root(cascade: native_census_infer_cascade_of(module_paths: sv_paths, providers: [], chain: sv_chain(reasons: sv_cascade_chain), attribution: sv_admitted))
+}
+
+// TWO PROVIDERS WHOSE CHAINS BOTH MATCH: Unattributed, never the first. RED if the fold picked one.
+test fn census_infer_cascade_two_matching_providers_is_unattributed_holds() -> Bool {
+  let providers = [
+    sv_provider(module: "v2.sv_b", reasons: [^resolve_reason_unbound_symbol]),
+    sv_provider(module: "v2.sv_c", reasons: [^resolve_reason_unbound_symbol])
+  ]
+  sv_cascade_is_unattributed(cascade: native_census_infer_cascade_of(module_paths: sv_paths, providers: providers, chain: sv_chain(reasons: [^resolve_reason_unbound_symbol, ^infer_reason_projection_receiver_declaration_unavailable]), attribution: sv_admitted))
+}
+
+// THE SUBJECT CLOSURE OVER A SUPPLIED IMPORT GRAPH: subject s imports a, a imports b; u imports nothing
+// and nothing imports u. b is inside, u outside. RED if every root were marked inside, or if the walk
+// followed importers instead of imports (b would be outside).
+fn sv_member(module: String) -> NativeCensusCauseMember {
+  NativeCensusCauseMember {
+    stage: NativeCensusCauseInfer,
+    path: ^sv_root,
+    module: optional_present(value: qualified_name_from_dotted_string(dotted: module)),
+    head_reason: ^sv_head,
+    cascade: NativeCensusCascadeNone
+  }
+}
+
+fn sv_membership_is_inside(m: NativeCensusSubjectMembership) -> Bool {
+  match m {
+    NativeCensusInSubjectClosure => true
+    NativeCensusOutsideSubjectClosure => false
+    NativeCensusSubjectMembershipUnavailable { reason: _ } => false
+  }
+}
+
+fn sv_membership_is_outside(m: NativeCensusSubjectMembership) -> Bool {
+  match m {
+    NativeCensusOutsideSubjectClosure => true
+    NativeCensusInSubjectClosure => false
+    NativeCensusSubjectMembershipUnavailable { reason: _ } => false
+  }
+}
+
+test fn census_infer_roots_are_marked_against_the_subject_closure_holds() -> Bool {
+  let index = NativeCensusClosureIndexRead {
+    importers_of: map_insert(map_insert(empty_map(), "v2.sv_a", ["v2.sv_s"]), "v2.sv_b", ["v2.sv_a"]),
+    imports_of: map_insert(map_insert(empty_map(), "v2.sv_s", ["v2.sv_a"]), "v2.sv_a", ["v2.sv_b"]),
+    modules: 4,
+    refused_modules: 0
+  }
+  let modules = [
+    NativeCensusModule { module: "v2.sv_s", path: ^sv_s_cu },
+    NativeCensusModule { module: "v2.sv_a", path: ^sv_a_cu },
+    NativeCensusModule { module: "v2.sv_b", path: ^sv_b_cu },
+    NativeCensusModule { module: "v2.sv_u", path: ^sv_u_cu }
+  ]
+  let subject = native_census_subject_closure(index: index, modules: modules, label: "//v2/sv_s:all")
+  sv_membership_is_inside(m: native_census_root_subject_membership(subject: subject, root: sv_member(module: "v2.sv_b")))
+    && sv_membership_is_outside(m: native_census_root_subject_membership(subject: subject, root: sv_member(module: "v2.sv_u")))
+}
diff --git a/src/v2/test/claim/native_census/whole_tree_census_resolve_test.dag b/src/v2/test/claim/native_census/whole_tree_census_resolve_test.dag
index f24f3580f31..0e1baa26fdb 100644
--- a/src/v2/test/claim/native_census/whole_tree_census_resolve_test.dag
+++ b/src/v2/test/claim/native_census/whole_tree_census_resolve_test.dag
@@ -520,7 +520,7 @@ fn census_supplied_file_refusal(path: Symbol, fatal: Symbol) -> NativeTestFileRe
     path: path,
     module: optional_absent(),
     chain: FreeSemigroup {
-      head: FileRefusalLink { reason: ^parse_grammar_choice_overlap_residue, at: FileRefusalAtWholeFile },
+      head: FileRefusalLink { reason: ^tokenize_lex_e1_unrecognized_char, at: FileRefusalAtWholeFile },
       tail: [FileRefusalLink { reason: fatal, at: FileRefusalAtWholeFile }]
     }
   }
@@ -541,6 +541,6 @@ test fn census_file_refusals_group_under_fatal_not_shared_head_holds() -> Bool {
   length(xs: listed) == 2
     && census_cause_group_of(groups: listed, reason: ^tokenize_lex_e0_source_not_exhausted) == 2
     && census_cause_group_of(groups: listed, reason: ^parse_unexpected_token) == 1
-    && census_cause_group_of(groups: listed, reason: ^parse_grammar_choice_overlap_residue) == 0
+    && census_cause_group_of(groups: listed, reason: ^tokenize_lex_e1_unrecognized_char) == 0
     && census_first_group_reason(groups: listed) == ^tokenize_lex_e0_source_not_exhausted
 }
diff --git a/src/v2/test/claim/normalize/authored_marker_spelling_test.dag b/src/v2/test/claim/normalize/authored_marker_spelling_test.dag
index 6995b238c35..ae1dbbbbbef 100644
--- a/src/v2/test/claim/normalize/authored_marker_spelling_test.dag
+++ b/src/v2/test/claim/normalize/authored_marker_spelling_test.dag
@@ -3,7 +3,8 @@ module v2.test.claim.normalize.authored_marker_spelling
 import std.types { List }
 import v2.compiler.normalize { normalize }
 import v2.compiler.parse { parse_module }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import std.algebra { Cons, Empty }
 import v2.extdeps.languages.dag { dag_canonical_symbols, dag_language_model }
 import v2.std.diagnostic { Accepted, Rejected, diagnostics_fatal_reason }
@@ -88,7 +89,7 @@ fn ams_names_member(nodes: List<Node>, name: Symbol) -> Bool {
 
 fn ams_verdict(src: String, authored: Symbol) -> MarkerSpellingVerdict {
   let lm = dag_language_model()
-  match tokenize(text: src, file: ^authored_marker_spelling_file, rules: lm.lex) {
+  match tokenize_prepared(text: src, file: ^authored_marker_spelling_file, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: _ } => MarkerSpellingVerdict { outcome: ^ams_tokenize_refused, carries_authored_atom: false }
     Accepted { value: ts, diagnostics: _ } =>
       match parse_module(tokens: ts, grammar: lm.grammar) {
diff --git a/src/v2/test/claim/normalize/census_mode_test.dag b/src/v2/test/claim/normalize/census_mode_test.dag
index fc5f61b9982..5558036b2d6 100644
--- a/src/v2/test/claim/normalize/census_mode_test.dag
+++ b/src/v2/test/claim/normalize/census_mode_test.dag
@@ -21,8 +21,8 @@ import v2.compiler.resolution_provenance {
 import v2.compiler.symbol_index_fill { symbol_index_fill_module_roots }
 import v2.test.parse.supplied_token_stream_support { supplied_stream_matches_tokenize, supplied_stream_parse }
 import v2.std.compilers.lexing { Token, TokenStream, token_stream_new }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.namespace_alias { ModuleBindingSource }
 import v2.std.symbol_index { SymbolIndex, empty_symbol_index, symbol_index_lookup }
 import v2.std.node_query { find_arrow_body_child }
@@ -75,7 +75,7 @@ data census_member_qn: QualifiedName = qualified_name_from_dotted_string(dotted:
 
 fn census_parse(source: String) -> Outcome<Node> {
   bind_outcome(
-    o: tokenize(text: source, file: ^census_mode_probe, rules: dag_lex()),
+    o: tokenize_prepared(text: source, file: ^census_mode_probe, prepared: dag_prepared_lex()),
     f: fn(tokens) { supplied_stream_parse(tokens: tokens) }
   )
 }
diff --git a/src/v2/test/claim/parameter_reference_test.dag b/src/v2/test/claim/parameter_reference_test.dag
index d0c101c78fd..64f21171d53 100644
--- a/src/v2/test/claim/parameter_reference_test.dag
+++ b/src/v2/test/claim/parameter_reference_test.dag
@@ -292,7 +292,8 @@ test fn pr_lambda_reference_grounds_through_recorded_binding_holds() -> Bool {
 // Lexical twin over the same name accepts, so the red is the kind, not the name.
 data pr_binder_site: NodeOccurrenceIdentity = OccurrenceMinted { id: OccurrenceId { value: 41 } }
 
-data pr_lexical_binders: Map<Symbol, LexicalBinding> = map_insert(empty_map(), ^pr_x, LexicalBinding { binder_site: pr_binder_site, declared: Absent })
+data pr_lexical_binders: Map<Symbol, LexicalBinding> = map_insert(empty_map(), ^pr_x, LexicalBinding { binder_site: pr_binder_site, declared: Absent,
+ value: optional_absent() })
 
 fn pr_ctx(kind: FrameKind) -> ResolveContext {
   let namespace = Namespace {
diff --git a/src/v2/test/claim/parse/admit_callers_trailing_comma_test.dag b/src/v2/test/claim/parse/admit_callers_trailing_comma_test.dag
index cc2b365fa9f..fd3688e48ce 100644
--- a/src/v2/test/claim/parse/admit_callers_trailing_comma_test.dag
+++ b/src/v2/test/claim/parse/admit_callers_trailing_comma_test.dag
@@ -1,9 +1,8 @@
 module v2.test.claim.parse.admit_callers_trailing_comma
 
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.diagnostic { Accepted, Outcome, Rejected, bind_outcome }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.node { Node }
@@ -24,11 +23,11 @@ fn admit_source(list: String) -> String {
 fn admit_parse(text: String) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: ^admit_trailing_comma_probe, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: ^admit_trailing_comma_probe, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
-          match parse_module_prepared(tokens: token_stream, prepared: prepared, validation_residue: residue) {
+          match parse_module_prepared(tokens: token_stream, prepared: prepared) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
           }
diff --git a/src/v2/test/claim/parse/alias_decl_parse.dag b/src/v2/test/claim/parse/alias_decl_parse.dag
index 1d22e950785..3f93ec15a60 100644
--- a/src/v2/test/claim/parse/alias_decl_parse.dag
+++ b/src/v2/test/claim/parse/alias_decl_parse.dag
@@ -9,6 +9,7 @@ import std.optional {
 }
 import v2.std.diagnostic {
   Accepted,
+  Diagnostic,
   DeclarationLocus,
   InvariantPortLocus,
   NodeLocus,
@@ -18,12 +19,26 @@ import v2.std.diagnostic {
   Textual,
   bind_outcome
 }
-import v2.std.node { Node }
-import v2.compiler.normalized_tree { NormalizedTree }
+import std.algebra { Empty, FreeMonoid }
+import v2.std.node { Node, symbol_lexeme }
+import v2.std.grammar { node_atom_identity_optional }
+import v2.compiler.normalized_tree { NormalizedTree, normalized_tree_roots_to_binding_sources }
+import v2.compiler.name_resolve { Admission, ResolutionSubject, resolve_with_admission }
+import v2.compiler.symbol_index_fill { symbol_index_fill_module_roots }
+import v2.std.symbol_index {
+  LexicalAmbiguous,
+  LexicalHit,
+  LexicalUnbound,
+  SymbolIndex,
+  empty_symbol_index,
+  symbol_index_lexical_lookup,
+  symbol_index_lookup
+}
 import v2.compiler.normalize { normalize }
 import v2.std.qualified_name { qualified_name_from_dotted_string }
 import v2.std.namespace_alias { AliasBindingRow }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.compiler.parse { parse, parse_module }
 import v2.extdeps.languages.dag {
   alias_binding_row_from_decl_node,
@@ -36,10 +51,10 @@ data alias_decl_parse_source: String = "module v2.test.parse.alias_decl_probe\n\
 fn alias_decl_parse_tree() -> Outcome<Node> {
   let lm = dag_language_model()
   bind_outcome(
-    o: tokenize(
+    o: tokenize_prepared(
       text: alias_decl_parse_source,
       file: ^alias_decl_parse_probe,
-      rules: lm.lex
+      prepared: dag_prepared_lex()
     ),
     f: fn(token_stream) {
       parse(tokens: token_stream, grammar: lm.grammar)
@@ -95,10 +110,10 @@ fn alias_decl_parse_and_binding_row_holds() -> Bool {
 fn alias_decl_keyword_reserved_in_binding_position_red_control_holds() -> Bool {
   let lm = dag_language_model()
   match bind_outcome(
-    o: tokenize(
+    o: tokenize_prepared(
       text: "module probe\nalias alias = v2.std.node.Node\n",
       file: ^alias_decl_reserved_keyword_probe,
-      rules: lm.lex
+      prepared: dag_prepared_lex()
     ),
     f: fn(token_stream) {
       parse(tokens: token_stream, grammar: lm.grammar)
@@ -112,12 +127,12 @@ fn alias_decl_keyword_reserved_in_binding_position_red_control_holds() -> Bool {
 data alias_decl_fill_parse_source: String = "module v2.test.parse.alias_decl_fill_probe\n\ntype AliasTargetType {}\n\nalias AliasBinding = v2.test.parse.alias_decl_fill_probe.AliasTargetType\n"
 
 // THE NORMALIZED ROUTE IS THE ONE EVERY PRODUCTION CALLER USES (v2.compiler.normalized_tree
-// normalized_tree_roots_to_binding_sources into symbol_index_fill_module_roots), so the claim
-// normalizes the real source rather than handing the fill a raw parse tree (on which nothing was
-// indexed at all).
-fn alias_decl_fill_normalized() -> Outcome<NormalizedTree> {
+// normalized_tree_roots_to_binding_sources into symbol_index_fill_module_roots), so every claim below
+// normalizes real source and fills the index through that route rather than handing the fill a raw
+// parse tree.
+fn alias_decl_normalized(text: String, file: Symbol) -> Outcome<NormalizedTree> {
   let lm = dag_language_model()
-  match tokenize(text: alias_decl_fill_parse_source, file: ^alias_decl_fill_probe, rules: lm.lex) {
+  match tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
     Accepted { value: ts, diagnostics: _ } =>
       match parse_module(tokens: ts, grammar: lm.grammar) {
@@ -127,30 +142,84 @@ fn alias_decl_fill_normalized() -> Outcome<NormalizedTree> {
   }
 }
 
-// THE DISCRIMINATING CONTROL FOR THE INTERIM REFUSAL (operator ruling via stern-bear-500, 2026-10-05).
-// Measured at main 6296275 before the refusal: normalize ACCEPTED this source and the alias name
-// resolved to its own grafted node, not AliasTargetType (lexical HIT, hit != target) -- a silent
-// wrong answer. Normalize now refuses the declaration with
-// body_lowering_reason_alias_binding_row_not_carried, located AT the alias declaration, so this claim
-// was red on main and is green with the refusal. When alias rows are carried
-// (gunbc.recurring_failure_mode alias_declaration_binding_row_not_carried), this claim returns to
-// asserting that the lexical hit IS the target.
-fn alias_decl_fill_lexical_lookup_holds() -> Bool {
-  match alias_decl_fill_normalized() {
-    Accepted { value: _, diagnostics: _ } => false
-    Rejected { diagnostics: r } =>
-      (r.head.reason == ^body_lowering_reason_alias_binding_row_not_carried)
-        && (match r.head.at {
-          NodeLocus { anchor: a } =>
-            match parse_production_emitted_identity_optional(node: a.at) {
-              Present { value: id } => id == ^dag_surface_alias_decl
-              Absent => false
-            }
-          Textual { file: _, extent: _ } => false
-          SourcePortLocus { anchor: _, file: _, extent: _ } => false
-          InvariantPortLocus { anchor: _, invariant: _ } => false
-          DeclarationLocus { declaration: _ } => false
-        })
+fn alias_decl_index_of(trees: FreeMonoid<NormalizedTree>) -> SymbolIndex {
+  symbol_index_fill_module_roots(
+    index: empty_symbol_index(),
+    roots: normalized_tree_roots_to_binding_sources(roots: trees)
+  )
+}
+
+// The lexical lookup of `name` at `position`, compared with the node the index holds at `target`.
+fn alias_decl_lookup_hits_target(idx: SymbolIndex, position: String, name: Symbol, target: String) -> Bool {
+  match symbol_index_lexical_lookup(index: idx, position: qualified_name_from_dotted_string(dotted: position), name: name) {
+    LexicalHit { node: hit, path: _ } =>
+      match symbol_index_lookup(index: idx, qualified_path: qualified_name_from_dotted_string(dotted: target)) {
+        Present { value: t } => hit == t
+        Absent => false
+      }
+    LexicalAmbiguous { candidates: _ } => false
+    LexicalUnbound => false
   }
 }
 
+// AN ALIAS TO A TARGET NOTHING DECLARES BINDS NOTHING, AND THE REFERENCE THROUGH IT REFUSES, LOCATED.
+// The row stays deferred at the fill's fixed point (v2.compiler.symbol_index_fill
+// symbol_index_fill_bindings_to_fixed_point), so the alias name is UNBOUND -- never a hit on the
+// alias's own node -- and resolution refuses the reference that wanted it, at the reference site
+// (docs/plans/namespace-resolution-design.md section 13), exactly as it refuses an import of a
+// name its module does not declare.
+data alias_decl_unresolved_source: String = "module v2.test.parse.alias_decl_unresolved_probe\n\nalias Missing = v2.test.parse.alias_decl_unresolved_probe.Nowhere\n\nfn uses_missing(x: Missing) -> Missing = x\n"
+
+fn alias_decl_resolve_verdict(t: NormalizedTree, module: String) -> String {
+  match resolve_with_admission(
+    lm: dag_language_model(),
+    roots: [t],
+    admission: Admission {
+      subject: ResolutionSubject { name: qualified_name_from_dotted_string(dotted: module) },
+      imports: Empty
+    }
+  ) {
+    Accepted { value: _, diagnostics: _ } => "ACCEPTED"
+    Rejected { diagnostics: d } => symbol_lexeme(sym: d.head.reason) + "@" + alias_decl_locus_lexeme(d: d.head)
+  }
+}
+
+fn alias_decl_locus_lexeme(d: Diagnostic) -> String {
+  match d.at {
+    NodeLocus { anchor: a } =>
+      match node_atom_identity_optional(node: a.at) {
+        Present { value: id } => symbol_lexeme(sym: id)
+        Absent => "node"
+      }
+    Textual { file: _, extent: _ } => "textual"
+    SourcePortLocus { anchor: _, file: _, extent: _ } => "source_port"
+    InvariantPortLocus { anchor: _, invariant: _ } => "invariant_port"
+    DeclarationLocus { declaration: _ } => "declaration"
+  }
+}
+
+// AN ALIAS DISAMBIGUATES WHAT UNIQUE-ON-CHAIN REFUSES. Two imports bind X at the subject from two
+// providers, so X is Ambiguous there (two declarations, one name -- refused, never first-wins). The
+// alias names ONE of them under a name only it binds, so AX resolves to alias_amb_a.X: the fix menu of
+// docs/plans/namespace-resolution-design.md section 13 ("qualify by containment path / introduce an
+// alias / rename"), executed. The ambiguity on X itself is not hidden by the alias: X stays refused.
+data alias_amb_a_source: String = "module v2.test.parse.alias_amb_a\n\ntype X {}\n"
+
+data alias_amb_b_source: String = "module v2.test.parse.alias_amb_b\n\ntype X {}\n"
+
+data alias_amb_subject_source: String = "module v2.test.parse.alias_amb_s\n\nimport v2.test.parse.alias_amb_a { X }\nimport v2.test.parse.alias_amb_b { X }\n\nalias AX = v2.test.parse.alias_amb_a.X\n"
+
+// THE LEGACY LONG-LANE ENTRY (gunbc.witness_deferral_freeze names its wrapper), kept as the
+// conjunction of the per-PR route claims in test.claim.parse_test_alias_decl_carry, which are what execute.
+fn alias_decl_fill_lexical_lookup_holds() -> Bool {
+  match alias_decl_normalized(text: alias_decl_fill_parse_source, file: ^alias_decl_fill_probe) {
+    Rejected { diagnostics: _ } => false
+    Accepted { value: t, diagnostics: _ } =>
+      alias_decl_lookup_hits_target(
+        idx: alias_decl_index_of(trees: [t]),
+        position: "v2.test.parse.alias_decl_fill_probe",
+        name: ^AliasBinding,
+        target: "v2.test.parse.alias_decl_fill_probe.AliasTargetType"
+      )
+  }
+}
diff --git a/src/v2/test/claim/parse/block_expr_as_binary_operand_parse_test.dag b/src/v2/test/claim/parse/block_expr_as_binary_operand_parse_test.dag
index c9885ae2fbd..e0d7eab80e5 100644
--- a/src/v2/test/claim/parse/block_expr_as_binary_operand_parse_test.dag
+++ b/src/v2/test/claim/parse/block_expr_as_binary_operand_parse_test.dag
@@ -2,9 +2,8 @@ module v2.test.parse.block_expr_as_binary_operand_parse
 
 import v2.compiler.normalize { normalize }
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.diagnostic { Accepted, Outcome, Rejected, bind_outcome }
 import std.optional { Absent, Optional, Present }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
@@ -44,14 +43,13 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 fn g_tokenize_parse(text: String, file: Symbol) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: file, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
           match parse_module_prepared(
             tokens: token_stream,
-            prepared: prepared,
-            validation_residue: residue
+            prepared: prepared
           ) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } =>
diff --git a/src/v2/test/claim/parse/choice_plan_test.dag b/src/v2/test/claim/parse/choice_plan_test.dag
index 3010c248df2..d2c74fd0101 100644
--- a/src/v2/test/claim/parse/choice_plan_test.dag
+++ b/src/v2/test/claim/parse/choice_plan_test.dag
@@ -45,9 +45,8 @@ import v2.compiler.parse {
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import std.optional { Absent, Present }
 import v2.std.algebra { fold_list, length }
-import v2.std.diagnostic { Accepted, Diagnostic, NonEmptyDiagnostics, None, Rejected, Some, invariant_port_locus }
+import v2.std.diagnostic { Accepted, Rejected, declaration_locus, invariant_port_locus, locus_eq }
 import v2.std.node { Hash, Symbol, content_hash }
-import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
@@ -78,13 +77,12 @@ fn pcp_choice_root(expr: GrammarExpr) -> GrammarRoot {
   }
 }
 
-fn pcp_validate_accepts_without_overlap_residue(expr: GrammarExpr) -> Bool {
+fn pcp_validate_accepts(expr: GrammarExpr) -> Bool {
   match grammar_validate_for_parse(
     root: pcp_choice_root(expr: expr),
     at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^pcp_grammar_contract)
   ) {
-    Accepted { value: _, diagnostics: None } => true
-    Accepted { value: _, diagnostics: Some { diagnostics: _ } } => false
+    Accepted { value: _, diagnostics: _ } => true
     Rejected { diagnostics: _ } => false
   }
 }
@@ -134,7 +132,7 @@ fn pcp_observe(expr: GrammarExpr, tokens: List<Token>) -> ChoiceParseObservation
   ) {
     Rejected { diagnostics: _ } => ObservedRejected
     Accepted { value: validated, diagnostics: _ } =>
-      let table = parse_table_for_production(validated: validated, all_tokens: tokens, materialization: Memoize)
+      let table = parse_table_for_production(validated: validated, all_tokens: tokens)
       match map_lookup(m: table.prepared_exprs, key: root.start) {
         Absent => ObservedRejected
         Present { value: prepared } =>
@@ -159,7 +157,7 @@ fn pcp_observe_root(root: GrammarRoot, expr: GrammarExpr, tokens: List<Token>) -
       tokens: tokens,
       all_tokens: tokens,
       root: root,
-      table: parse_table_empty(materialization: Memoize),
+      table: parse_table_empty(),
       prov: parse_prov_initial()
     )
   )
@@ -196,7 +194,7 @@ fn oracle_parse_choice(left: GrammarExpr, right: GrammarExpr, tokens: List<Token
     tokens: tokens,
     all_tokens: tokens,
     root: pcp_root(),
-    table: parse_table_empty(materialization: Memoize),
+    table: parse_table_empty(),
     prov: parse_prov_initial()
   ) {
     ParseExprAccepted { remaining: remaining, captured: captured, diagnostics: _, prov: _, table: _ } =>
@@ -207,7 +205,7 @@ fn oracle_parse_choice(left: GrammarExpr, right: GrammarExpr, tokens: List<Token
         tokens: tokens,
         all_tokens: tokens,
         root: pcp_root(),
-        table: parse_table_empty(materialization: Memoize),
+        table: parse_table_empty(),
         prov: parse_prov_initial()
       ) {
         ParseExprAccepted { remaining: remaining, captured: captured, diagnostics: _, prov: _, table: _ } =>
@@ -287,7 +285,7 @@ test fn prepared_choice_nonterminal_alts_empty_table_agrees_with_ordered_oracle(
     tokens: tokens_b,
     all_tokens: tokens_b,
     root: root,
-    table: parse_table_empty(materialization: Memoize),
+    table: parse_table_empty(),
     prov: parse_prov_initial()
   ) {
     ParseExprAccepted { remaining: remaining, captured: captured, diagnostics: _, prov: _, table: _ } =>
@@ -298,7 +296,7 @@ test fn prepared_choice_nonterminal_alts_empty_table_agrees_with_ordered_oracle(
         tokens: tokens_b,
         all_tokens: tokens_b,
         root: root,
-        table: parse_table_empty(materialization: Memoize),
+        table: parse_table_empty(),
         prov: parse_prov_initial()
       ) {
         ParseExprAccepted { remaining: remaining, captured: captured, diagnostics: _, prov: _, table: _ } =>
@@ -316,7 +314,7 @@ test fn prepared_choice_one_nullable_alt_agrees_after_aa_rejects() -> Bool {
   let aa = seq(left: term(token_class: ^pcp_a), right: term(token_class: ^pcp_a))
   let expr = Choice { left: aa, right: opt(element: term(token_class: ^pcp_b)) }
   let tokens_a = [pcp_token(token_class: ^pcp_a)]
-  pcp_validate_accepts_without_overlap_residue(expr: expr)
+  pcp_validate_accepts(expr: expr)
     && match pcp_choice_plan(expr: expr) {
       ChoiceByToken { on_token: _, on_other: _, on_end: _ } =>
         pcp_observe(expr: expr, tokens: tokens_a) == oracle_parse_choice(left: aa, right: opt(element: term(token_class: ^pcp_b)), tokens: tokens_a)
@@ -324,7 +322,7 @@ test fn prepared_choice_one_nullable_alt_agrees_after_aa_rejects() -> Bool {
     }
 }
 
-// Two nullable siblings never reach the prepared runtime: validate refuses both_nullable residue.
+// Two nullable siblings never reach the prepared runtime: validate refuses every overlap row, nullable or not.
 test fn prepared_choice_two_nullable_alts_validate_refuses() -> Bool {
   let aa = seq(left: term(token_class: ^pcp_a), right: term(token_class: ^pcp_a))
   let both_nullable = Choice {
@@ -389,14 +387,14 @@ test fn prepared_choice_stamp_split_agrees_with_ordered_oracle() -> Bool {
   }
 }
 
-// LITERAL TERMINALS: DIFFERENT EXACT WORDS ELIMINATE A FIRST-OVERLAP RESIDUE THAT CLASS KEYS KEEP.
+// LITERAL TERMINALS: DIFFERENT EXACT WORDS SEPARATE A PAIR THAT CLASS KEYS CANNOT.
 //
 // The comparison pair below is IDENTICAL once its leading word is erased: both alternatives are
-// word . pcp_a. Keyed on (class, word) the two are FIRST-disjoint and validation reports no overlap
-// residue; the control is the same pair with the words erased to the bare class, which validation
-// must ACCEPT WITH the specific `^parse_grammar_choice_overlap_residue` diagnostic -- named, not
-// inferred from the absence of a clean acceptance, so an unrelated rejection fails the control.
-// What this establishes is the FIRST-overlap residue, which is a different fact from whether a
+// word . pcp_a. Keyed on (class, word) the two are FIRST-disjoint and validation accepts; the
+// control is the same pair with the words erased to the bare class, which validation must REFUSE
+// with the specific `^parse_grammar_choice_ambiguity` diagnostic located at the owning production
+// -- named, not inferred from the absence of an acceptance, so an unrelated rejection fails the
+// control. What this establishes is the FIRST overlap, which is a different fact from whether a
 // deeper class lookahead could have separated some other pair. The unequal-suffix pair further
 // down is kept for a separate purpose: executing a parse through the second word's alternative.
 
@@ -422,28 +420,15 @@ fn pcp_same_suffix_class_pair() -> GrammarExpr {
   }
 }
 
-fn pcp_diagnostic_is_overlap_residue(d: Diagnostic) -> Bool {
-  d.reason == ^parse_grammar_choice_overlap_residue
-}
-
-fn pcp_any_overlap_residue(ne: NonEmptyDiagnostics) -> Bool {
-  fold_list(
-    xs: ne.tail,
-    empty: pcp_diagnostic_is_overlap_residue(d: ne.head),
-    cons: fn(found, d) { found || pcp_diagnostic_is_overlap_residue(d: d) }
-  )
-}
-
-// Positive: the ACCEPTED arm carrying the overlap-residue diagnostic. Rejection, or acceptance with
-// only unrelated diagnostics, or clean acceptance, all answer false.
-fn pcp_validate_accepts_with_overlap_residue(expr: GrammarExpr) -> Bool {
+fn pcp_validate_refuses_as_overlap_at_start(expr: GrammarExpr) -> Bool {
   match grammar_validate_for_parse(
     root: pcp_choice_root(expr: expr),
     at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^pcp_grammar_contract)
   ) {
-    Accepted { value: _, diagnostics: Some { diagnostics: ne } } => pcp_any_overlap_residue(ne: ne)
-    Accepted { value: _, diagnostics: None } => false
-    Rejected { diagnostics: _ } => false
+    Accepted { value: _, diagnostics: _ } => false
+    Rejected { diagnostics: d } =>
+      (d.head.reason == ^parse_grammar_choice_ambiguity)
+        && locus_eq(a: d.head.at, b: declaration_locus(declaration: Cons { head: ^pcp_start, tail: std.algebra.Empty }))
   }
 }
 
@@ -454,12 +439,12 @@ fn pcp_word_pair() -> GrammarExpr {
   }
 }
 
-test fn literal_words_sharing_a_class_prefix_validate_without_overlap_residue() -> Bool {
-  pcp_validate_accepts_without_overlap_residue(expr: pcp_same_suffix_word_pair())
+test fn literal_words_sharing_a_class_prefix_validate() -> Bool {
+  pcp_validate_accepts(expr: pcp_same_suffix_word_pair())
 }
 
-test fn the_same_pair_keyed_by_class_alone_leaves_overlap_residue() -> Bool {
-  pcp_validate_accepts_with_overlap_residue(expr: pcp_same_suffix_class_pair())
+test fn the_same_pair_keyed_by_class_alone_refuses_at_its_production() -> Bool {
+  pcp_validate_refuses_as_overlap_at_start(expr: pcp_same_suffix_class_pair())
 }
 
 test fn the_class_bucket_of_a_word_pair_dispatches_on_the_word() -> Bool {
diff --git a/src/v2/test/claim/parse/d1_declaration_grammar_parse_test.dag b/src/v2/test/claim/parse/d1_declaration_grammar_parse_test.dag
index 93c8f4a4a10..ac5a80795d6 100644
--- a/src/v2/test/claim/parse/d1_declaration_grammar_parse_test.dag
+++ b/src/v2/test/claim/parse/d1_declaration_grammar_parse_test.dag
@@ -2,10 +2,9 @@ module v2.test.parse.d1_declaration_grammar_parse
 
 import v2.compiler.normalize { normalize }
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.extdeps.languages.dag {
-  dag_lex,
   parse_subtree_find_production_captured,
   ParseSubtreeAbsent,
   ParseSubtreeFound,
@@ -22,14 +21,13 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 fn d1_tokenize_parse(text: String, file: Symbol) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: file, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
           match parse_module_prepared(
             tokens: token_stream,
-            prepared: prepared,
-            validation_residue: residue
+            prepared: prepared
           ) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } =>
diff --git a/src/v2/test/claim/parse/d5_expression_grammar_parse_test.dag b/src/v2/test/claim/parse/d5_expression_grammar_parse_test.dag
index 12dea97c443..708c2f9e8c7 100644
--- a/src/v2/test/claim/parse/d5_expression_grammar_parse_test.dag
+++ b/src/v2/test/claim/parse/d5_expression_grammar_parse_test.dag
@@ -1,8 +1,7 @@
 module v2.test.parse.d5_expression_grammar_parse
 
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
 import v2.std.diagnostic { Accepted, Outcome, Rejected, bind_outcome }
 import v2.std.grammar { node_atom_identity_optional }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
@@ -14,14 +13,13 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 fn d5_tokenize_parse(text: String, file: Symbol) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: file, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
           match parse_module_prepared(
             tokens: token_stream,
-            prepared: prepared,
-            validation_residue: residue
+            prepared: prepared
           ) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } =>
diff --git a/src/v2/test/claim/parse/data_keyword_as_value_test.dag b/src/v2/test/claim/parse/data_keyword_as_value_test.dag
index fe8d6707aa1..3a4620c1377 100644
--- a/src/v2/test/claim/parse/data_keyword_as_value_test.dag
+++ b/src/v2/test/claim/parse/data_keyword_as_value_test.dag
@@ -2,9 +2,8 @@ module v2.test.claim.parse.data_keyword_as_value
 
 import v2.compiler.parse { parse_module_prepared }
 import v2.compiler.reference_conservation_admission { conservation_subject_of_text }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.diagnostic { Accepted, Outcome, Rejected, bind_outcome }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.node { Node }
@@ -22,11 +21,11 @@ fn value_source(name: String) -> String {
 fn value_parse(text: String) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: ^data_keyword_value_probe, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: ^data_keyword_value_probe, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
-          match parse_module_prepared(tokens: token_stream, prepared: prepared, validation_residue: residue) {
+          match parse_module_prepared(tokens: token_stream, prepared: prepared) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
           }
diff --git a/src/v2/test/claim/parse/expression_bodied_continuation_test.dag b/src/v2/test/claim/parse/expression_bodied_continuation_test.dag
index ff90b1858fc..0f06e1a9d2b 100644
--- a/src/v2/test/claim/parse/expression_bodied_continuation_test.dag
+++ b/src/v2/test/claim/parse/expression_bodied_continuation_test.dag
@@ -3,18 +3,14 @@ module v2.test.claim.parse.expression_bodied_continuation
 import v2.compiler.normalize { normalize }
 import v2.compiler.normalized_tree { NormalizedTree }
 import v2.compiler.parse { ParseArtifact, parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.diagnostic {
   Accepted,
-  Diagnostics,
-  None,
   Outcome,
   Rejected,
   bind_outcome,
-  outcome_accepted,
-  outcome_diagnostics
+  outcome_accepted
 }
 import v2.std.node { Arrow, ArrowBodyEdge, Atom, Conj, Edge, Authored, Node, Positional, Symbol, TypeNode, core_edge_label }
 import v2.std.node_query { find_arrow_body_child }
@@ -53,13 +49,12 @@ fn cont_parse(text: String, file: Symbol) -> Outcome<Node> {
     o: dag_prepared_grammar(),
     f: fn(prepared) {
       bind_outcome(
-        o: tokenize(text: text, file: file, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
           bind_outcome(
             o: parse_module_prepared(
               tokens: token_stream,
-              prepared: prepared,
-              validation_residue: outcome_diagnostics(o: dag_prepared_grammar())
+              prepared: prepared
             ),
             f: fn(artifact) { cont_artifact_tree(artifact: artifact) }
           )
@@ -78,19 +73,6 @@ fn cont_artifact_tree(artifact: ParseArtifact) -> Outcome<Node> {
   outcome_accepted(value: artifact.tree)
 }
 
-// THE RESIDUE THE SUBJECT THREADS EXPLICITLY IS THREADED HERE TOO, and that is not a formality: the
-// prepared grammar DOES carry residue. An earlier version of this file passed None on the assumption
-// that it did not, and the claim written to check that assumption went RED -- which is the only
-// reason this control now forwards the real thing rather than parsing under a residue the seven
-// never use. bind_outcome cannot supply it, because it merges diagnostics into the continuation
-// instead of handing them back, so the residue is read with v2.std.diagnostic outcome_diagnostics.
-test fn cont_the_prepared_grammar_carries_residue_holds() -> Bool {
-  match outcome_diagnostics(o: dag_prepared_grammar()) {
-    None => false
-    _ => true
-  }
-}
-
 fn cont_accepted(o: Outcome<Node>) -> Bool {
   match o {
     Accepted { value: _, diagnostics: _ } => true
@@ -275,7 +257,7 @@ fn cont_root_itself_has_arrow_body(root: Node) -> Bool {
 
 // THE CONTROL PRODUCES WHAT THE SUBJECT PRODUCES, asserted rather than assumed. Everything above is
 // only evidence about the seven if this chain and theirs agree, and "I used the same functions" is
-// not that evidence -- the residue defect this file already caught is exactly how they can diverge
+// not that evidence -- a diagnostics-threading difference this file once caught is how they can diverge
 // while every row still looks green. So the two trees are compared directly, for each source, through
 // the subject's own entry point.
 //
diff --git a/src/v2/test/claim/parse/expression_bodied_fn_decl_parse_test.dag b/src/v2/test/claim/parse/expression_bodied_fn_decl_parse_test.dag
index 3107c142807..118b7de331e 100644
--- a/src/v2/test/claim/parse/expression_bodied_fn_decl_parse_test.dag
+++ b/src/v2/test/claim/parse/expression_bodied_fn_decl_parse_test.dag
@@ -2,9 +2,8 @@ module v2.test.parse.expression_bodied_fn_decl_parse
 
 import v2.compiler.normalize { normalize }
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.diagnostic {
   Accepted,
   ByteRange,
@@ -36,14 +35,13 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 fn g_tokenize_parse(text: String, file: Symbol) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: file, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
           match parse_module_prepared(
             tokens: token_stream,
-            prepared: prepared,
-            validation_residue: residue
+            prepared: prepared
           ) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } =>
diff --git a/src/v2/test/claim/parse/g0_service_decl_parse_probe_test.dag b/src/v2/test/claim/parse/g0_service_decl_parse_probe_test.dag
index b0f69b8aee5..d492361cd8c 100644
--- a/src/v2/test/claim/parse/g0_service_decl_parse_probe_test.dag
+++ b/src/v2/test/claim/parse/g0_service_decl_parse_probe_test.dag
@@ -2,7 +2,8 @@ module v2.test.parse.g0_service_decl_parse_probe
 
 import v2.compiler.normalize { normalize }
 import v2.compiler.parse { ParseArtifact, parse_module }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.extdeps.languages.dag { dag_language_model }
 import v2.std.diagnostic { Accepted, Diagnostic, NonEmptyDiagnostics, Outcome, Rejected }
 import v2.std.language_model { LanguageModel }
@@ -24,7 +25,7 @@ data probe_cached_lm: LanguageModel = dag_language_model()
 
 fn parse_src(src: String) -> Outcome<ParseArtifact> {
   let lm = probe_cached_lm
-  match tokenize(text: src, file: ^probe, rules: lm.lex) {
+  match tokenize_prepared(text: src, file: ^probe, prepared: dag_prepared_lex()) {
     Accepted { value: ts, diagnostics: _ } => parse_module(tokens: ts, grammar: lm.grammar)
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
   }
@@ -50,7 +51,7 @@ fn smallest_service_parsed() -> Outcome<ParseArtifact> {
 // stage is pinned and a fixture that dies in the lexer reds instead of flattering the claim.
 fn refuses_at_parse(src: String) -> Bool {
   let lm = probe_cached_lm
-  match tokenize(text: src, file: ^probe, rules: lm.lex) {
+  match tokenize_prepared(text: src, file: ^probe, prepared: dag_prepared_lex()) {
     Accepted { value: ts, diagnostics: _ } =>
       match parse_module(tokens: ts, grammar: lm.grammar) {
         Accepted { value: _, diagnostics: _ } => false
diff --git a/src/v2/test/claim/parse/go.dag b/src/v2/test/claim/parse/go.dag
deleted file mode 100644
index 6a716923c2a..00000000000
--- a/src/v2/test/claim/parse/go.dag
+++ /dev/null
@@ -1,41 +0,0 @@
-module v2.test.parse.go
-
-fn go_parse_bool_atom(b: Bool) -> Node {
-  match b {
-    true => Node { kind: TypeNode { connective: Atom { identity: ^go_parse_bool_true } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-    false => Node { kind: TypeNode { connective: Atom { identity: ^go_parse_bool_false } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-  }
-}
-
-fn go_parse_accepted(out: Outcome<ParseTree>) -> Bool {
-  match out {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn go_tokenize_and_parse() -> Outcome<ParseTree> {
-  match tokenize(
-    text: go_source_text,
-    file: ^go_parse_file,
-    rules: go_lex()
-  ) {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: tokens, diagnostics: _ } =>
-      parse(tokens: tokens, grammar: go_grammar())
-  }
-}
-
-data claim_go_add_function_parses: TestClaim = EqualsClaim {
-  label: "Go corpus symmetry accepts the current add-function source through the Go lex/grammar",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: go_parse_bool_atom(
-    b: go_parse_accepted(out: go_tokenize_and_parse())
-  ),
-  rhs: go_parse_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Integration }
-}
diff --git a/src/v2/test/claim/parse/grammar_validation_test.dag b/src/v2/test/claim/parse/grammar_validation_test.dag
index 59d80749888..27a9408599a 100644
--- a/src/v2/test/claim/parse/grammar_validation_test.dag
+++ b/src/v2/test/claim/parse/grammar_validation_test.dag
@@ -28,7 +28,7 @@ import v2.compiler.parse {
   parse_skip_to_sync,
 }
 import v2.std.witness { Holds, Violates }
-import v2.std.diagnostic { Accepted, Diagnostics, None, Outcome, Rejected, Some, invariant_port_locus }
+import v2.std.diagnostic { Accepted, Outcome, Rejected, declaration_locus, invariant_port_locus, locus_eq }
 import std.algebra { Cons, Empty }
 import v2.std.node { Atom, Node, Symbol, TypeNode }
 import v2.std.verification {
@@ -172,18 +172,20 @@ data validation_disjoint_choice_root: GrammarRoot = GrammarRoot {
   sync_tokens: grammar_empty_sync_tokens()
 }
 
-fn validation_overlap_choice_validate_accepts_with_residue() -> Bool {
+// An overlapping choice is REFUSED at validation, located at the production that owns it. The
+// single-overlap control is enrolled on the merge path in test.claim.parse_test_grammar_choice_overlap;
+// this one holds the same wall for an overlap in the TAIL of a three-way choice.
+fn validation_refuses_overlap_at_production(root: GrammarRoot, production: Symbol) -> Bool {
   let at = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^grammar_validation_grammar_contract)
-  match grammar_validate_for_parse(root: validation_ambiguous_choice_root, at: at) {
-    Accepted { value: _, diagnostics: d } =>
-      match d {
-        Some { diagnostics: residue } => residue.head.reason == ^parse_grammar_choice_overlap_residue
-        None => false
-      }
-    Rejected { diagnostics: _ } => false
+  match grammar_validate_for_parse(root: root, at: at) {
+    Accepted { value: _, diagnostics: _ } => false
+    Rejected { diagnostics: d } =>
+      (d.head.reason == ^parse_grammar_choice_ambiguity)
+        && locus_eq(a: d.head.at, b: declaration_locus(declaration: Cons { head: production, tail: Empty }))
   }
 }
 
+
 data validation_nullable_ambiguous_choice_root: GrammarRoot = GrammarRoot {
   start: ^validation_start,
   productions: Cons {
@@ -254,28 +256,8 @@ test fn validation_three_alt_inner_nullable_pair_rejects() -> Bool {
   }
 }
 
-test fn validation_three_alt_tail_overlap_accepts_with_residue() -> Bool {
-  let at = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^grammar_validation_grammar_contract)
-  match grammar_validate_for_parse(root: validation_three_alt_tail_overlap_root, at: at) {
-    Accepted { value: _, diagnostics: d } =>
-      match d {
-        Some { diagnostics: residue } => residue.head.reason == ^parse_grammar_choice_overlap_residue
-        None => false
-      }
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn validation_disjoint_choice_residue_is_none() -> Bool {
-  let at = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^grammar_validation_grammar_contract)
-  match grammar_validate_for_parse(root: validation_disjoint_choice_root, at: at) {
-    Accepted { value: _, diagnostics: d } =>
-      match d {
-        None => true
-        Some { diagnostics: _ } => false
-      }
-    Rejected { diagnostics: _ } => false
-  }
+test fn validation_three_alt_tail_overlap_refuses_at_production() -> Bool {
+  validation_refuses_overlap_at_production(root: validation_three_alt_tail_overlap_root, production: ^validation_start)
 }
 
 fn validation_disjoint_choice_validate_accepts() -> Bool {
@@ -430,14 +412,6 @@ data claim_disjoint_choice_not_ambiguous: TestClaim = EqualsClaim {
   classification: TestClassification { tier: Tier1, layer: Unit }
 }
 
-data claim_validate_accepts_overlap_with_counted_residue: TestClaim = EqualsClaim {
-  label: "grammar_validate_for_parse accepts non-nullable FIRST-overlap OrderedBacktrack as counted typed residue (reason parse_grammar_choice_overlap_residue); the roster is overlap/both-nullable rows, not every backtrack node",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: validation_bool_atom(b: validation_overlap_choice_validate_accepts_with_residue()),
-  rhs: validation_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Unit }
-}
-
 data claim_validate_rejects_nullable_choice_ambiguity: TestClaim = EqualsClaim {
   label: "grammar_validate_for_parse stays fail-closed on genuine ambiguity: both-nullable Choice arms sharing a FIRST terminal are Rejected",
   anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
@@ -446,14 +420,6 @@ data claim_validate_rejects_nullable_choice_ambiguity: TestClaim = EqualsClaim {
   classification: TestClassification { tier: Tier1, layer: Unit }
 }
 
-data claim_disjoint_choice_validate_residue_none: TestClaim = EqualsClaim {
-  label: "disjoint-FIRST Choice validates with zero residue diagnostics (residue channel discriminates overlap from clean)",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: validation_bool_atom(b: validation_disjoint_choice_residue_is_none()),
-  rhs: validation_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Unit }
-}
-
 data claim_validate_accepts_disjoint_choice: TestClaim = EqualsClaim {
   label: "grammar_validate_for_parse accepts grammars whose Choice branches have disjoint FIRST sets",
   anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
diff --git a/src/v2/test/claim/parse/keyword_value_name_parse_test.dag b/src/v2/test/claim/parse/keyword_value_name_parse_test.dag
index d74b20fd9ce..c45ab0f29d2 100644
--- a/src/v2/test/claim/parse/keyword_value_name_parse_test.dag
+++ b/src/v2/test/claim/parse/keyword_value_name_parse_test.dag
@@ -6,7 +6,8 @@ import v2.std.compilers.lexing { StreamLayout, Token, TokenStream, stream_layout
 import v2.test.parse.expression_bodied_fn_decl_parse { g_fatal_at, g_tokenize_parse }
 import v2.test.parse.supplied_token_stream_support { supplied_stream_parse }
 import v2.std.algebra { Cons, Empty }
-import v2.std.collection { List }
+import v2.std.collection { List, Map, map_lookup }
+import v2.std.integer { Int }
 import v2.std.diagnostic { Accepted, Outcome, Rejected }
 import v2.std.node { Symbol }
 import std.optional { Absent, Optional, Present }
@@ -222,7 +223,7 @@ test fn kvn_contextual_pattern_binder_control_holds() -> Bool {
 // EACH SUPPLIED STREAM IS PROVEN TO BE THE TOKENIZER'S OUTPUT, POSITIONS AND LAYOUT INCLUDED. The located
 // claims assert byte ranges and the statement claims depend on line breaks, so the shared class-and-lexeme
 // projection is not enough here: kvn_stream_matches_tokenize compares every token's class, lexeme, start and
-// end, and the recorded layout's digest, against the real tokenizer over the same source text.
+// end, and the recorded layout's line breaks, against the real tokenizer over the same source text.
 fn kvn_tokens_agree(left: List<Token>, right: List<Token>) -> Bool {
   match left {
     Empty =>
@@ -246,11 +247,20 @@ fn kvn_layouts_agree(left: Optional<StreamLayout>, right: Optional<StreamLayout>
     Present { value: l } =>
       match right {
         Absent => false
-        Present { value: r } => l.digest == r.digest
+        Present { value: r } => kvn_line_breaks_agree(left: l.line_break_before, right: r.line_break_before)
       }
   }
 }
 
+// The same recorded gaps on both sides: equal entry counts, and every left entry found on the right
+// with the same gap start.
+fn kvn_line_breaks_agree(left: Map<Int, Int>, right: Map<Int, Int>) -> Bool {
+  ((map_keys(left) |> count) == (map_keys(right) |> count))
+    && (map_keys(left) |> fold(init: true, f: (acc, k) =>
+      acc && (map_lookup(m: right, key: k) == map_lookup(m: left, key: k))
+    ))
+}
+
 fn kvn_stream_matches_tokenize(text: String, file: Symbol, supplied: TokenStream) -> Bool {
   match tokenize(text: text, file: file, rules: dag_lex()) {
     Rejected { diagnostics: _ } => false
diff --git a/src/v2/test/claim/parse/kotlin.dag b/src/v2/test/claim/parse/kotlin.dag
deleted file mode 100644
index 1438086e3a6..00000000000
--- a/src/v2/test/claim/parse/kotlin.dag
+++ /dev/null
@@ -1,43 +0,0 @@
-module v2.test.parse.kotlin
-
-data kotlin_extended_fn_source: String = "fun choose(x: Int): Int { val y: Int = x + 1; if (y > 0) { return y }; return 0 }"
-
-fn kotlin_parse_bool_atom(b: Bool) -> Node {
-  match b {
-    true => Node { kind: TypeNode { connective: Atom { identity: ^kotlin_parse_bool_true } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-    false => Node { kind: TypeNode { connective: Atom { identity: ^kotlin_parse_bool_false } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-  }
-}
-
-fn kotlin_parse_accepted(out: Outcome<ParseTree>) -> Bool {
-  match out {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn kotlin_tokenize_and_parse() -> Outcome<ParseTree> {
-  match tokenize(
-    text: kotlin_extended_fn_source,
-    file: ^kotlin_parse_file,
-    rules: kotlin_lex()
-  ) {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: tokens, diagnostics: _ } =>
-      parse(tokens: tokens, grammar: kotlin_grammar())
-  }
-}
-
-data claim_kotlin_extended_function_parses: TestClaim = EqualsClaim {
-  label: "Kotlin lex/grammar accepts an extended function with val, if, return, and binary expressions",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: kotlin_parse_bool_atom(
-    b: kotlin_parse_accepted(out: kotlin_tokenize_and_parse())
-  ),
-  rhs: kotlin_parse_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Integration }
-}
diff --git a/src/v2/test/claim/parse/layout_line_break_test.dag b/src/v2/test/claim/parse/layout_line_break_test.dag
index 1d6321d917a..3099ec141dc 100644
--- a/src/v2/test/claim/parse/layout_line_break_test.dag
+++ b/src/v2/test/claim/parse/layout_line_break_test.dag
@@ -1,6 +1,6 @@
 module v2.test.parse.layout_line_break
 
-import v2.compiler.parse { ParseArtifact, parse_module, parse_module_prepared, parse_token_stream_digest, parse_token_stream_layout_digest }
+import v2.compiler.parse { ParseArtifact, parse_module, parse_module_prepared }
 import v2.compiler.program_assembly { dag_prepared_grammar }
 import v2.compiler.tokenize { tokenize }
 import v2.extdeps.languages.dag { dag_lex }
@@ -72,7 +72,7 @@ data same_line_text: String = "x - 1"
 data next_line_text: String = "x\n- 1"
 
 fn lexed(text: String, file: Symbol) -> Outcome<TokenStream> {
-  tokenize(text: text, file: file, rules: dag_lex())
+  tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex())
 }
 
 // The gap before the second token (`-`): from the end of `x` to the start of `-`.
@@ -156,8 +156,8 @@ data identity_module_text: String = "module probe.layout_identity\n\ndata d: Int
 fn identity_parse(stream: TokenStream) -> Outcome<ParseArtifact> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
-      parse_module_prepared(tokens: stream, prepared: prepared, validation_residue: residue)
+    Accepted { value: prepared, diagnostics: _ } =>
+      parse_module_prepared(tokens: stream, prepared: prepared)
   }
 }
 
@@ -272,25 +272,6 @@ test fn a_layout_question_without_source_refuses_holds() -> Bool {
   }
 }
 
-// THE MEMO CANNOT SERVE ONE LAYOUT'S ANSWER TO THE OTHER. `x - 1` and `x` newline `- 1` lex to the
-// same tokens at the same octets, so a stream digest over tokens alone would key them together and a
-// warm memo entry could replay a same-line acceptance for a next-line refusal. The layout (its line-break-preceded starts) is part of
-// the stream's digest (v2.compiler.parse parse_token_stream_layout_digest): same tokens, different
-// digest; and the token-only digest, which is what a sourceless stream keys by, is unchanged.
-test fn same_tokens_different_layout_have_different_stream_digests_holds() -> Bool {
-  match lexed(text: same_line_text, file: ^layout_digest) {
-    Rejected { diagnostics: _ } => false
-    Accepted { value: same, diagnostics: _ } =>
-      match lexed(text: next_line_text, file: ^layout_digest) {
-        Rejected { diagnostics: _ } => false
-        Accepted { value: next, diagnostics: _ } =>
-          (parse_token_stream_digest(all_tokens: token_stream_all(stream: same)) == parse_token_stream_digest(all_tokens: token_stream_all(stream: next)))
-            && (parse_token_stream_layout_digest(all_tokens: token_stream_all(stream: same), layout: token_stream_layout(stream: same))
-              != parse_token_stream_layout_digest(all_tokens: token_stream_all(stream: next), layout: token_stream_layout(stream: next)))
-      }
-  }
-}
-
 // A LINE FEED INSIDE A TOKEN IS NOT LAYOUT. The layout walk counts a line feed only at or after the
 // previous token's end, so a multi-line string literal between two tokens on one line leaves the next
 // token's gap line-break-free; only the gap after the string is asked about.
diff --git a/src/v2/test/claim/parse/lean.dag b/src/v2/test/claim/parse/lean.dag
deleted file mode 100644
index bae662517bc..00000000000
--- a/src/v2/test/claim/parse/lean.dag
+++ /dev/null
@@ -1,41 +0,0 @@
-module v2.test.parse.lean
-
-fn lean_parse_bool_atom(b: Bool) -> Node {
-  match b {
-    true => Node { kind: TypeNode { connective: Atom { identity: ^lean_parse_bool_true } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-    false => Node { kind: TypeNode { connective: Atom { identity: ^lean_parse_bool_false } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-  }
-}
-
-fn lean_parse_accepted(out: Outcome<ParseTree>) -> Bool {
-  match out {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn lean_tokenize_and_parse() -> Outcome<ParseTree> {
-  match tokenize(
-    text: lean_source_text,
-    file: ^lean_parse_fixture_file,
-    rules: lean_lex()
-  ) {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: tokens, diagnostics: _ } =>
-      parse(tokens: tokens, grammar: lean_grammar())
-  }
-}
-
-data claim_lean_source_parses: TestClaim = EqualsClaim {
-  label: "Lean lex/grammar accepts the PROOF-1 def+termination_by fixture via tokenize+parse",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: lean_parse_bool_atom(
-    b: lean_parse_accepted(out: lean_tokenize_and_parse())
-  ),
-  rhs: lean_parse_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Integration }
-}
diff --git a/src/v2/test/claim/parse/list_literal_parse_cost_test.dag b/src/v2/test/claim/parse/list_literal_parse_cost_test.dag
index d68f1da467d..e6895e0e48d 100644
--- a/src/v2/test/claim/parse/list_literal_parse_cost_test.dag
+++ b/src/v2/test/claim/parse/list_literal_parse_cost_test.dag
@@ -100,8 +100,8 @@ fn lpc_text(n: Int) -> String {
 fn lpc_parses(n: Int) -> Bool {
   match dag_prepared_grammar() {
     Rejected { diagnostics: _ } => false
-    Accepted { value: prepared, diagnostics: residue } =>
-      match parse_module_prepared(tokens: lpc_stream(n: n), prepared: prepared, validation_residue: residue) {
+    Accepted { value: prepared, diagnostics: _ } =>
+      match parse_module_prepared(tokens: lpc_stream(n: n), prepared: prepared) {
         Rejected { diagnostics: _ } => false
         Accepted { value: _, diagnostics: _ } => true
       }
diff --git a/src/v2/test/claim/parse/newline_dual_role_operator_parse_test.dag b/src/v2/test/claim/parse/newline_dual_role_operator_parse_test.dag
index d950913498e..8168564ab27 100644
--- a/src/v2/test/claim/parse/newline_dual_role_operator_parse_test.dag
+++ b/src/v2/test/claim/parse/newline_dual_role_operator_parse_test.dag
@@ -1,9 +1,9 @@
 module v2.test.parse.newline_dual_role_operator_parse
 
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex, dag_lex_rules, dag_target_model, parse_production_emitted_identity_optional }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
+import v2.extdeps.languages.dag { dag_lex_rules, dag_target_model, parse_production_emitted_identity_optional }
 import v2.std.algebra { fold_list }
 import v2.std.collection { map_lookup }
 import v2.std.compilers.lexing { lex_rule_set_matching_rules, lex_rule_token_class_optional }
@@ -41,9 +41,10 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // (v1.compiler.parse is_ambiguous_prefix_infix_newline_boundary). `-` is infix and prefix, and the
 // dag grammar has no statement terminator, so `x` then a line `- 1` is either one subtraction or two
 // statements; v2 read it as one, silently, and since block forms became operands (#12817) a block
-// statement followed by a `-` line merged the same way. The dag grammar's additive continuation now
-// refuses a line-break-preceded `-` with NewlineBeforeDualRoleOperator at the `-`
-// (v2.extdeps.languages.dag dag_grammar_additive_expr_helper). Each side of the rule, through the
+// statement followed by a `-` line merged the same way. The dag grammar's binary operator table now
+// refuses a line-break-preceded `-` with NewlineBeforeDualRoleOperator at the `-`: its continuation
+// guard (v2.extdeps.languages.dag dag_grammar_additive_newline_minus_guard) runs at every
+// continuation point of dag_grammar_binary_expr_expr. Each side of the rule, through the
 // live prepared grammar on a lexed stream (which carries its layout): the next-line forms refuse at
 // the `-`, for a plain operand and for a block, and the same-line form parses. The
 // mutation that reds the refusals is test.claim.parse_test_newline_dual_role_operator_mutation.
@@ -51,11 +52,11 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 fn n_tokenize_parse(text: String, file: Symbol) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: file, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
-          match parse_module_prepared(tokens: token_stream, prepared: prepared, validation_residue: residue) {
+          match parse_module_prepared(tokens: token_stream, prepared: prepared) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
           }
@@ -103,13 +104,13 @@ test fn a_newline_minus_after_a_block_refuses_holds() -> Bool {
   n_refuses_at_minus(text: newline_minus_after_block_source, file: ^probe_nl_block, start: 58, end: 59)
 }
 
-// THE ROUTE, NOT ONLY THE VERDICT. The newline refusal is a not-predicate guard in sequence before
-// the additive operator, not a choice alternative beside subtraction (the 2026-10-02 zero-ambiguity
+// THE ROUTE, NOT ONLY THE VERDICT. The newline refusal is a not-predicate guard run before the
+// operator table reads an operator, not a choice alternative beside subtraction (the 2026-10-02 zero-ambiguity
 // ruling: both arms began with `-`, so only order kept them apart). A same-line `-` must therefore
 // reach the subtraction route: its tree holds no NEGATION -- a unary_expr node with another
 // unary_expr beneath it (`-` then the operand's own unary layer), as opposed to the single unary layer
 // every operand passes through, which subtraction's two operands each hold side by side under the
-// binary node. A leading `-` takes the negation route and holds exactly one, which is the control
+// one application node. A leading `-` takes the negation route and holds exactly one, which is the control
 // that the count discriminates the two routes at all. Each claim pays one parse.
 data leading_minus_source: String = "module probe.nl_neg\n\ndata d: Int = -1\n"
 
diff --git a/src/v2/test/claim/parse/parse_binding_fidelity_support.dag b/src/v2/test/claim/parse/parse_binding_fidelity_support.dag
index e8ccc247aa7..e7163f16aa9 100644
--- a/src/v2/test/claim/parse/parse_binding_fidelity_support.dag
+++ b/src/v2/test/claim/parse/parse_binding_fidelity_support.dag
@@ -16,7 +16,8 @@ import v2.compiler.ingested_fixture_arrows {
 import v2.compiler.normalize { normalize }
 import v2.compiler.parse { parse_module }
 import v2.compiler.resolve { ResolvedTree, resolve }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.extdeps.languages.dag {
   dag_grammar_atom,
   dag_language_model_surface_empty_prelude,
@@ -62,8 +63,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // consumer). Fast-lane tests stay in parse_binding_fidelity_test.dag.
 
 fn pbf_tokenize() -> Outcome<TokenStream> {
-  let lm = dag_language_model()
-  tokenize(text: ingested_add_module_source, file: ^pbf_source_file, rules: lm.lex)
+  tokenize_prepared(text: ingested_add_module_source, file: ^pbf_source_file, prepared: dag_prepared_lex())
 }
 
 fn pbf_parse_tokens(tokens: TokenStream) -> Outcome<ParseTree> {
diff --git a/src/v2/test/claim/parse/parse_g0_tokens_remain_furthest_locus_test.dag b/src/v2/test/claim/parse/parse_g0_tokens_remain_furthest_locus_test.dag
index 1f4ea877ec4..7174f70c3d4 100644
--- a/src/v2/test/claim/parse/parse_g0_tokens_remain_furthest_locus_test.dag
+++ b/src/v2/test/claim/parse/parse_g0_tokens_remain_furthest_locus_test.dag
@@ -2,8 +2,8 @@ module v2.test.claim.parse.parse_g0_tokens_remain_furthest_locus
 
 import v2.test.parse.supplied_token_stream_support { supplied_stream_matches_tokenize, supplied_stream_parse }
 import v2.std.compilers.lexing { Token, TokenStream, token_stream_new }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.diagnostic {
   Accepted,
   ByteRange,
@@ -111,14 +111,10 @@ test fn control_stream_is_what_tokenize_emits() -> Bool {
   supplied_stream_matches_tokenize(text: control_source, file: ^furthest_locus_probe, supplied: control_stream())
 }
 
-// THE TREATMENT, AND THE LOCUS DOES NOT DEPEND ON CACHE WARMTH. The seed serves parse memo entries
-// across parses of one token stream (v1_interpreter parse_table_memo_scope_and_key), so the second
-// parse meets entries the first stored; each entry carries its own subparse's furthest record, and
-// the served parse must land on the same token. The cold assertion alone is implied by this claim.
-test fn tokens_remain_mid_item_locus_holds_cold_and_served() -> Bool {
-  let cold = tokens_remain_start(parsed: supplied_stream_parse(tokens: treatment_stream()))
-  let warm = tokens_remain_start(parsed: supplied_stream_parse(tokens: treatment_stream()))
-  cold == 24 && warm == 24
+// THE TREATMENT: the refusal lands on the token where the furthest rejected alternative stopped,
+// inside the item, not at the item's start.
+test fn tokens_remain_mid_item_locus_holds() -> Bool {
+  tokens_remain_start(parsed: supplied_stream_parse(tokens: treatment_stream())) == 24
 }
 
 test fn tokens_remain_item_level_failure_stays_at_the_item_start() -> Bool {
@@ -126,7 +122,7 @@ test fn tokens_remain_item_level_failure_stays_at_the_item_start() -> Bool {
 }
 
 fn rbracket_start(src: String) -> Int {
-  match tokenize(text: src, file: ^furthest_locus_probe, rules: dag_lex()) {
+  match tokenize_prepared(text: src, file: ^furthest_locus_probe, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: _ } => -1
     Accepted { value: ts, diagnostics: _ } =>
       fold(ts.all, init: -1, f: fn(acc, t) { if t.lexeme == "]" { t.start } else { acc } })
diff --git a/src/v2/test/claim/parse/bare_node_statement_route_test.dag b/src/v2/test/claim/parse/parse_test_bare_node_statement_route_test.dag
similarity index 90%
rename from src/v2/test/claim/parse/bare_node_statement_route_test.dag
rename to src/v2/test/claim/parse/parse_test_bare_node_statement_route_test.dag
index 419fe139600..04191ca37ea 100644
--- a/src/v2/test/claim/parse/bare_node_statement_route_test.dag
+++ b/src/v2/test/claim/parse/parse_test_bare_node_statement_route_test.dag
@@ -1,9 +1,9 @@
-module v2.test.parse.bare_node_statement_route
+module test.claim.parse_test_bare_node_statement_route
 
 import v2.compiler.parse { PreparedModeled, PreparedVoidGrammar, parse_production_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex, parse_production_emitted_identity_optional }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
+import v2.extdeps.languages.dag { parse_production_emitted_identity_optional }
 import v2.std.diagnostic { Accepted, Rejected }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.logic { Bool }
@@ -33,7 +33,7 @@ fn bns_parse(text: String, file: Symbol, production: Symbol) -> Optional<Node> {
     Accepted { value: prepared, diagnostics: _ } =>
       match prepared {
         PreparedVoidGrammar => Absent
-        PreparedModeled { modeled: modeled, materialization: m } =>
+        PreparedModeled { modeled: modeled } =>
           match tokenize(text: text, file: file, rules: dag_lex()) {
             Rejected { diagnostics: _ } => Absent
             Accepted { value: token_stream, diagnostics: _ } =>
@@ -41,8 +41,7 @@ fn bns_parse(text: String, file: Symbol, production: Symbol) -> Optional<Node> {
                 tokens: token_stream.all,
                 validated: modeled.validated,
                 analysis: modeled.analysis,
-                production_name: production,
-                materialization: m
+                production_name: production
               ) {
                 Rejected { diagnostics: _ } => Absent
                 Accepted { value: artifact, diagnostics: _ } => Present { value: artifact.tree }
diff --git a/src/v2/test/claim/parse/parse_test_block_headed_operand_class_test.dag b/src/v2/test/claim/parse/parse_test_block_headed_operand_class_test.dag
index f65bb3e8c0c..0449a32bc86 100644
--- a/src/v2/test/claim/parse/parse_test_block_headed_operand_class_test.dag
+++ b/src/v2/test/claim/parse/parse_test_block_headed_operand_class_test.dag
@@ -1,6 +1,6 @@
 module test.claim.parse_test_block_headed_operand_class
 
-import v2.compiler.parse { PreparedModeled, PreparedVoidGrammar, parse_production_prepared_measured_seeded }
+import v2.compiler.parse { PreparedModeled, PreparedVoidGrammar, parse_production_prepared_seeded }
 import v2.compiler.parse_acceptance_census { parse_acceptance_of_text }
 import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
 import v2.compiler.tokenize { tokenize_prepared }
@@ -41,16 +41,15 @@ fn bc_parse_at(text: String, production: Symbol) -> Outcome<Node> {
       match dag_prepared_grammar() {
         Rejected { diagnostics: d } => Rejected { diagnostics: d }
         Accepted { value: PreparedVoidGrammar, diagnostics: d } => Rejected { diagnostics: d }
-        Accepted { value: PreparedModeled { modeled: modeled, materialization: materialization }, diagnostics: _ } =>
-          match parse_production_prepared_measured_seeded(
+        Accepted { value: PreparedModeled { modeled: modeled }, diagnostics: _ } =>
+          match parse_production_prepared_seeded(
             tokens: token_stream_remaining(stream: ts),
             validated: modeled.validated,
             analysis: modeled.analysis,
             production_name: production,
             seed: occurrence_id_allocator_initial(),
-            layout: token_stream_layout(stream: ts),
-            materialization: materialization
-          ).outcome {
+            layout: token_stream_layout(stream: ts)
+          ) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
           }
diff --git a/src/v2/test/claim/parse/brace_and_lambda_head_route_test.dag b/src/v2/test/claim/parse/parse_test_brace_and_lambda_head_route_test.dag
similarity index 90%
rename from src/v2/test/claim/parse/brace_and_lambda_head_route_test.dag
rename to src/v2/test/claim/parse/parse_test_brace_and_lambda_head_route_test.dag
index b373a66c3b2..0de190175fc 100644
--- a/src/v2/test/claim/parse/brace_and_lambda_head_route_test.dag
+++ b/src/v2/test/claim/parse/parse_test_brace_and_lambda_head_route_test.dag
@@ -1,9 +1,9 @@
-module v2.test.parse.brace_and_lambda_head_route
+module test.claim.parse_test_brace_and_lambda_head_route
 
 import v2.compiler.parse { PreparedModeled, PreparedVoidGrammar, parse_production_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex, parse_production_emitted_identity_optional }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
+import v2.extdeps.languages.dag { parse_production_emitted_identity_optional }
 import v2.std.diagnostic { Accepted, Rejected }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.node { Node, Symbol }
@@ -30,7 +30,7 @@ fn bhr_parse(text: String, file: Symbol, production: Symbol) -> Optional<Node> {
     Accepted { value: prepared, diagnostics: _ } =>
       match prepared {
         PreparedVoidGrammar => Absent
-        PreparedModeled { modeled: modeled, materialization: m } =>
+        PreparedModeled { modeled: modeled } =>
           match tokenize(text: text, file: file, rules: dag_lex()) {
             Rejected { diagnostics: _ } => Absent
             Accepted { value: token_stream, diagnostics: _ } =>
@@ -38,8 +38,7 @@ fn bhr_parse(text: String, file: Symbol, production: Symbol) -> Optional<Node> {
                 tokens: token_stream.all,
                 validated: modeled.validated,
                 analysis: modeled.analysis,
-                production_name: production,
-                materialization: m
+                production_name: production
               ) {
                 Rejected { diagnostics: _ } => Absent
                 Accepted { value: artifact, diagnostics: _ } => Present { value: artifact.tree }
diff --git a/src/v2/test/claim/parse/declaration_choice_route_test.dag b/src/v2/test/claim/parse/parse_test_declaration_choice_route_test.dag
similarity index 96%
rename from src/v2/test/claim/parse/declaration_choice_route_test.dag
rename to src/v2/test/claim/parse/parse_test_declaration_choice_route_test.dag
index 2639affc398..ccbf2024bde 100644
--- a/src/v2/test/claim/parse/declaration_choice_route_test.dag
+++ b/src/v2/test/claim/parse/parse_test_declaration_choice_route_test.dag
@@ -1,4 +1,4 @@
-module v2.test.claim.parse.declaration_choice_route
+module test.claim.parse_test_declaration_choice_route
 
 import v2.compiler.body_lowering_fold {
   BodyLowerTypedParam,
@@ -43,7 +43,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 // header and items are not this claim's subject (DESIGN section 3, a witness discriminates at one
 // interface) -- and asserts the ROUTE each former alternative took, read by the real reader where one
 // exists. The real module path still parses every one of these forms in the corpus. The `test`
-// marker's half of the family is held in v2.test.claim.parse.test_marker_channel.
+// marker's half of the family is held in test.claim.parse_test_marker_channel.
 
 // One fragment parsed at one production of the real prepared grammar.
 fn route_parse_at(text: String, production: Symbol) -> Outcome<Node> {
@@ -53,13 +53,12 @@ fn route_parse_at(text: String, production: Symbol) -> Outcome<Node> {
       match dag_prepared_grammar() {
         Rejected { diagnostics: d } => Rejected { diagnostics: d }
         Accepted { value: PreparedVoidGrammar, diagnostics: d } => Rejected { diagnostics: d }
-        Accepted { value: PreparedModeled { modeled: modeled, materialization: materialization }, diagnostics: _ } =>
+        Accepted { value: PreparedModeled { modeled: modeled }, diagnostics: _ } =>
           match parse_production_prepared(
             tokens: token_stream_remaining(stream: ts),
             validated: modeled.validated,
             analysis: modeled.analysis,
-            production_name: production,
-            materialization: materialization
+            production_name: production
           ) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
diff --git a/src/v2/test/claim/parse/else_less_if_value_category_test.dag b/src/v2/test/claim/parse/parse_test_else_less_if_value_category_test.dag
similarity index 94%
rename from src/v2/test/claim/parse/else_less_if_value_category_test.dag
rename to src/v2/test/claim/parse/parse_test_else_less_if_value_category_test.dag
index 05192cbacb2..19b28916c8f 100644
--- a/src/v2/test/claim/parse/else_less_if_value_category_test.dag
+++ b/src/v2/test/claim/parse/parse_test_else_less_if_value_category_test.dag
@@ -1,4 +1,4 @@
-module v2.test.parse.else_less_if_value_category
+module test.claim.parse_test_else_less_if_value_category
 
 import v2.compiler.body_lowering_fold {
   body_lower_admitted_guard_optional,
@@ -6,9 +6,9 @@ import v2.compiler.body_lowering_fold {
   body_lower_if_expr
 }
 import v2.compiler.parse { PreparedModeled, PreparedVoidGrammar, parse_production_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex, parse_production_emitted_identity_optional }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
+import v2.extdeps.languages.dag { parse_production_emitted_identity_optional }
 import v2.std.diagnostic { Accepted, DeclarationLocus, InvariantPortLocus, Locus, NodeLocus, Rejected, SourcePortLocus, Textual, diagnostics_fatal }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.node { Node, Symbol }
@@ -38,7 +38,7 @@ fn elif_parse_as(text: String, production: Symbol) -> Optional<Node> {
     Accepted { value: prepared, diagnostics: _ } =>
       match prepared {
         PreparedVoidGrammar => Absent
-        PreparedModeled { modeled: modeled, materialization: m } =>
+        PreparedModeled { modeled: modeled } =>
           match tokenize(text: text, file: ^elif_probe, rules: dag_lex()) {
             Rejected { diagnostics: _ } => Absent
             Accepted { value: token_stream, diagnostics: _ } =>
@@ -46,8 +46,7 @@ fn elif_parse_as(text: String, production: Symbol) -> Optional<Node> {
                 tokens: token_stream.all,
                 validated: modeled.validated,
                 analysis: modeled.analysis,
-                production_name: production,
-                materialization: m
+                production_name: production
               ) {
                 Rejected { diagnostics: _ } => Absent
                 Accepted { value: artifact, diagnostics: _ } => elif_some(node: artifact.tree)
diff --git a/src/v2/test/claim/parse/parse_test_go_grammar_test.dag b/src/v2/test/claim/parse/parse_test_go_grammar_test.dag
new file mode 100644
index 00000000000..05b0d3f553f
--- /dev/null
+++ b/src/v2/test/claim/parse/parse_test_go_grammar_test.dag
@@ -0,0 +1,28 @@
+module test.claim.parse_test_go_grammar
+
+fn go_parse_accepted(out: Outcome<ParseTree>) -> Bool {
+  match out {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+fn go_tokenize_and_parse() -> Outcome<ParseTree> {
+  match tokenize(
+    text: go_source_text,
+    file: ^go_parse_file,
+    rules: go_lex()
+  ) {
+    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
+    Accepted { value: tokens, diagnostics: _ } =>
+      parse(tokens: tokens, grammar: go_grammar())
+  }
+}
+
+// Go corpus symmetry accepts the current add-function source through the Go lex/grammar.
+// Formerly the data row `claim_go_add_function_parses: TestClaim = EqualsClaim`, which no runner executes (the
+// required floor runs `test fn` claims only): the same lhs == rhs predicate, made runnable by the
+// v2.test.parse census (gunbc#13372).
+test fn claim_go_add_function_parses_holds() -> Bool {
+  (go_parse_accepted(out: go_tokenize_and_parse())) == true
+}
diff --git a/src/v2/test/claim/parse/parse_test_grammar_expect_test.dag b/src/v2/test/claim/parse/parse_test_grammar_expect_test.dag
index de2e7c5a4fd..203142af2f9 100644
--- a/src/v2/test/claim/parse/parse_test_grammar_expect_test.dag
+++ b/src/v2/test/claim/parse/parse_test_grammar_expect_test.dag
@@ -17,6 +17,7 @@ import v2.std.diagnostic {
   diagnostics_fatal
 }
 import v2.std.grammar {
+  InfixTable,
   AfterLineBreak,
   Choice,
   Expect,
@@ -158,7 +159,8 @@ fn ge_wrap_all(expr: GrammarExpr) -> GrammarExpr {
       expect: fn(e, reason) { Expect { element: Expect { element: e, reason: reason }, reason: FnExpressionBodyMissingAfterEq } },
       refuse_on_match: fn(e, reason) { Expect { element: RefuseOnMatch { element: e, reason: reason }, reason: FnExpressionBodyMissingAfterEq } },
       after_line_break: fn(e) { Expect { element: AfterLineBreak { element: e }, reason: FnExpressionBodyMissingAfterEq } },
-      not_predicate: fn(e) { Expect { element: NotPredicate { element: e }, reason: FnExpressionBodyMissingAfterEq } }
+      not_predicate: fn(e) { Expect { element: NotPredicate { element: e }, reason: FnExpressionBodyMissingAfterEq } },
+      infix_table: fn(operand, guard, operators) { Expect { element: InfixTable { operand: operand, continuation_guard: guard, operators: operators }, reason: FnExpressionBodyMissingAfterEq } }
     }
   )
 }
@@ -173,23 +175,26 @@ fn ge_plain_item() -> GrammarExpr {
   }
 }
 
-// `a b a c a`: exercises both alternatives, the optional present and absent, and the repeat.
+// `a b d c d`: exercises both alternatives, the optional present and absent, and the repeat. The
+// second alternative's head production `ge_a` is the token `d` here, so the two alternatives start
+// differently: grammar validation refuses any choice whose alternatives overlap (gunbc#13126), and
+// this claim's subject is Expect transparency, not choice resolution.
 data ge_accept_tokens: List<Token> = [
   ge_token(class: ^ge_tok_a, start: 0),
   ge_token(class: ^ge_tok_b, start: 2),
-  ge_token(class: ^ge_tok_a, start: 4),
+  ge_token(class: ^ge_tok_d, start: 4),
   ge_token(class: ^ge_tok_c, start: 6),
-  ge_token(class: ^ge_tok_a, start: 8)
+  ge_token(class: ^ge_tok_d, start: 8)
 ]
 
 test fn expect_wrapping_every_row_changes_no_accepted_tree_holds() -> Bool {
-  let plain = ge_root(item: ge_plain_item(), a_expr: ge_terminal(class: ^ge_tok_a))
+  let plain = ge_root(item: ge_plain_item(), a_expr: ge_terminal(class: ^ge_tok_d))
   let wrapped = GrammarRoot {
     start: ^ge_start,
     productions: [
       ge_production(name: ^ge_start, expression: ge_wrap_all(expr: Repeat { element: Nonterminal { production: ^ge_item } })),
       ge_production(name: ^ge_item, expression: ge_wrap_all(expr: ge_plain_item())),
-      ge_production(name: ^ge_a, expression: ge_wrap_all(expr: ge_terminal(class: ^ge_tok_a)))
+      ge_production(name: ^ge_a, expression: ge_wrap_all(expr: ge_terminal(class: ^ge_tok_d)))
     ],
     sync_tokens: grammar_empty_sync_tokens()
   }
diff --git a/src/v2/test/claim/parse/parse_test_kotlin_grammar_test.dag b/src/v2/test/claim/parse/parse_test_kotlin_grammar_test.dag
new file mode 100644
index 00000000000..0032c6ba95f
--- /dev/null
+++ b/src/v2/test/claim/parse/parse_test_kotlin_grammar_test.dag
@@ -0,0 +1,30 @@
+module test.claim.parse_test_kotlin_grammar
+
+data kotlin_extended_fn_source: String = "fun choose(x: Int): Int { val y: Int = x + 1; if (y > 0) { return y }; return 0 }"
+
+fn kotlin_parse_accepted(out: Outcome<ParseTree>) -> Bool {
+  match out {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+fn kotlin_tokenize_and_parse() -> Outcome<ParseTree> {
+  match tokenize(
+    text: kotlin_extended_fn_source,
+    file: ^kotlin_parse_file,
+    rules: kotlin_lex()
+  ) {
+    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
+    Accepted { value: tokens, diagnostics: _ } =>
+      parse(tokens: tokens, grammar: kotlin_grammar())
+  }
+}
+
+// Kotlin lex/grammar accepts an extended function with val, if, return, and binary expressions.
+// Formerly the data row `claim_kotlin_extended_function_parses: TestClaim = EqualsClaim`, which no runner executes (the
+// required floor runs `test fn` claims only): the same lhs == rhs predicate, made runnable by the
+// v2.test.parse census (gunbc#13372).
+test fn claim_kotlin_extended_function_parses_holds() -> Bool {
+  (kotlin_parse_accepted(out: kotlin_tokenize_and_parse())) == true
+}
diff --git a/src/v2/test/claim/parse/parse_test_lean_grammar_test.dag b/src/v2/test/claim/parse/parse_test_lean_grammar_test.dag
new file mode 100644
index 00000000000..71dff873243
--- /dev/null
+++ b/src/v2/test/claim/parse/parse_test_lean_grammar_test.dag
@@ -0,0 +1,28 @@
+module test.claim.parse_test_lean_grammar
+
+fn lean_parse_accepted(out: Outcome<ParseTree>) -> Bool {
+  match out {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+fn lean_tokenize_and_parse() -> Outcome<ParseTree> {
+  match tokenize(
+    text: lean_source_text,
+    file: ^lean_parse_fixture_file,
+    rules: lean_lex()
+  ) {
+    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
+    Accepted { value: tokens, diagnostics: _ } =>
+      parse(tokens: tokens, grammar: lean_grammar())
+  }
+}
+
+// Lean lex/grammar accepts the PROOF-1 def+termination_by fixture via tokenize+parse.
+// Formerly the data row `claim_lean_source_parses: TestClaim = EqualsClaim`, which no runner executes (the
+// required floor runs `test fn` claims only): the same lhs == rhs predicate, made runnable by the
+// v2.test.parse census (gunbc#13372).
+test fn claim_lean_source_parses_holds() -> Bool {
+  (lean_parse_accepted(out: lean_tokenize_and_parse())) == true
+}
diff --git a/src/v2/test/claim/parse/parse_test_marker_channel_test.dag b/src/v2/test/claim/parse/parse_test_marker_channel_test.dag
new file mode 100644
index 00000000000..f82fba1e01a
--- /dev/null
+++ b/src/v2/test/claim/parse/parse_test_marker_channel_test.dag
@@ -0,0 +1,40 @@
+module test.claim.parse_test_marker_channel
+
+import test.claim.parse_test_declaration_choice_route { route_parse_at }
+import v2.test.claim.parse.test_marker_channel {
+  test_marker_find_emitted,
+  test_marker_inner_declaration,
+  test_marker_lowered_pair_agrees
+}
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE TEST MARKER'S GRAMMAR ROUTE CONTROL AT top_level_item (gunbc#13126). One marked declaration is
+// parsed AT the item production, and the real readers of v2.test.claim.parse.test_marker_channel
+// consume that parse: the marked shell lowers to the identical semantic projection as the declaration
+// inside it (DESIGN 4c). This is the production-grain subject; the module-grain capture and projection
+// claims stay in v2.test.claim.parse.test_marker_channel, unchanged and off the gate (their per-token
+// parse and lowering cost exceeds the new-witness budget until 02_parse's slope work lands).
+data marked_declaration_source: String = "test data w: Bool = true\n"
+
+fn marked_item_shell_agrees_with_its_declaration() -> Optional<Bool> {
+  match route_parse_at(text: marked_declaration_source, production: ^dag_production_top_level_item) {
+    Rejected { diagnostics: _ } => optional_absent()
+    Accepted { value: tree, diagnostics: _ } =>
+      match test_marker_find_emitted(n: tree, emitted: ^dag_surface_test_fn_decl) {
+        Absent => optional_absent()
+        Present { value: shell } =>
+          match test_marker_inner_declaration(shell: shell) {
+            Absent => optional_absent()
+            Present { value: inner } => test_marker_lowered_pair_agrees(left: shell, right: inner)
+          }
+      }
+  }
+}
+
+test fn a_marked_item_shares_one_semantic_projection_with_its_declaration_holds() -> Bool {
+  match marked_item_shell_agrees_with_its_declaration() {
+    Present { value: agrees } => agrees
+    Absent => false
+  }
+}
diff --git a/src/v2/test/claim/parse/parse_test_parse_table_claims_test.dag b/src/v2/test/claim/parse/parse_test_parse_table_claims_test.dag
index c3c98d841f9..1f7e201a2d7 100644
--- a/src/v2/test/claim/parse/parse_test_parse_table_claims_test.dag
+++ b/src/v2/test/claim/parse/parse_test_parse_table_claims_test.dag
@@ -209,7 +209,7 @@ test fn parse_table_undefined_nonterminal_morphism_holds() -> Bool {
 
 test fn parse_table_parse_expr_combinator_holds() -> Bool {
   let prov = parse_prov_initial()
-  let table = parse_table_empty(materialization: Memoize)
+  let table = parse_table_empty()
   let root = GrammarRoot {
     start: ^pt_parse_expr_start,
     productions: std.algebra.Empty,
diff --git a/src/v2/test/claim/parse/parse_test_parse_table_content_key_test.dag b/src/v2/test/claim/parse/parse_test_parse_table_content_key_test.dag
deleted file mode 100644
index c29a559c4cf..00000000000
--- a/src/v2/test/claim/parse/parse_test_parse_table_content_key_test.dag
+++ /dev/null
@@ -1,107 +0,0 @@
-module test.claim.parse_test_parse_table_content_key
-
-data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
-
-fn mk_table(grammar: Hash, tokens: Hash) -> ParseTable {
-  let base = parse_table_empty(materialization: Memoize)
-  ParseTableRealization {
-    artifact_kind: base.artifact_kind,
-    provider_id: base.provider_id,
-    materialization: base.materialization,
-    grammar_digest: grammar,
-    token_stream_digest: tokens,
-    entries: base.entries,
-    memo_hits: base.memo_hits,
-    memo_misses: base.memo_misses,
-    memo_lookup_calls: base.memo_lookup_calls,
-    furthest: base.furthest,
-    nullable_set: base.nullable_set,
-    first_rows: base.first_rows,
-    productions_by_name: base.productions_by_name,
-    prepared_exprs: base.prepared_exprs,
-    layout: base.layout,
-    refusal: base.refusal
-  }
-}
-
-fn grammar_one() -> Hash { symbol_identity_digest(sym: ^ctk_grammar_one) }
-fn grammar_two() -> Hash { symbol_identity_digest(sym: ^ctk_grammar_two) }
-fn tokens_one() -> Hash { symbol_identity_digest(sym: ^ctk_tokens_one) }
-fn tokens_two() -> Hash { symbol_identity_digest(sym: ^ctk_tokens_two) }
-
-fn table_g1_t1() -> ParseTable { mk_table(grammar: grammar_one(), tokens: tokens_one()) }
-fn table_g2_t1() -> ParseTable { mk_table(grammar: grammar_two(), tokens: tokens_one()) }
-fn table_g1_t2() -> ParseTable { mk_table(grammar: grammar_one(), tokens: tokens_two()) }
-
-fn key_p0_a() -> ParsePositionKey { ParsePositionKey { position: 0, production: ^ctk_prod_a } }
-fn key_p1_a() -> ParsePositionKey { ParsePositionKey { position: 1, production: ^ctk_prod_a } }
-fn key_p0_b() -> ParsePositionKey { ParsePositionKey { position: 0, production: ^ctk_prod_b } }
-
-test fn witness_subject_deterministic() -> Bool {
-  let a = parse_table_subject(table: table_g1_t1(), key: key_p0_a())
-  let b = parse_table_subject(table: mk_table(grammar: grammar_one(), tokens: tokens_one()), key: key_p0_a())
-  a == b
-}
-
-test fn witness_subject_position_sensitive() -> Bool {
-  let a = parse_table_subject(table: table_g1_t1(), key: key_p0_a())
-  let b = parse_table_subject(table: table_g1_t1(), key: key_p1_a())
-  a != b
-}
-
-test fn witness_subject_production_sensitive() -> Bool {
-  let a = parse_table_subject(table: table_g1_t1(), key: key_p0_a())
-  let b = parse_table_subject(table: table_g1_t1(), key: key_p0_b())
-  a != b
-}
-
-test fn witness_subject_grammar_scope_sensitive() -> Bool {
-  let a = parse_table_subject(table: table_g1_t1(), key: key_p0_a())
-  let b = parse_table_subject(table: table_g2_t1(), key: key_p0_a())
-  a != b
-}
-
-test fn witness_subject_token_stream_scope_sensitive() -> Bool {
-  let a = parse_table_subject(table: table_g1_t1(), key: key_p0_a())
-  let b = parse_table_subject(table: table_g1_t2(), key: key_p0_a())
-  a != b
-}
-
-// DOMAINS PAST ONE BYTE LIMB. The subject and the stream digest used to send positions, offsets
-// and lexeme codepoints through the single-byte-limb digest, which gives every value above 255 one
-// tag: positions 256 and 257 hashed equal, as did two token streams differing only in an offset
-// past byte 255 or only in a non-Latin-1 lexeme. Each witness below returned false under it.
-fn key_at(position: Int) -> ParsePositionKey { ParsePositionKey { position: position, production: ^ctk_prod_a } }
-
-fn subject_at(position: Int) -> Hash {
-  parse_table_subject(table: table_g1_t1(), key: key_at(position: position))
-}
-
-test fn witness_subject_positions_255_256_257_pairwise_distinct() -> Bool {
-  (subject_at(position: 255) != subject_at(position: 256))
-    && (subject_at(position: 256) != subject_at(position: 257))
-    && (subject_at(position: 255) != subject_at(position: 257))
-}
-
-fn ctk_token(lexeme: Lexeme, start: Int, end: Int) -> Token {
-  Token { class: ^ctk_token_class, lexeme: lexeme, file: ^ctk_token_file, start: start, end: end }
-}
-
-fn stream_digest_one(tok: Token) -> Hash {
-  parse_token_stream_digest(all_tokens: Cons { head: tok, tail: std.algebra.Empty })
-}
-
-test fn witness_stream_digest_offsets_past_one_limb_distinct() -> Bool {
-  stream_digest_one(tok: ctk_token(lexeme: "a", start: 300, end: 301))
-    != stream_digest_one(tok: ctk_token(lexeme: "a", start: 301, end: 302))
-}
-
-test fn witness_stream_digest_lexemes_past_latin1_distinct() -> Bool {
-  stream_digest_one(tok: ctk_token(lexeme: "λ", start: 0, end: 2))
-    != stream_digest_one(tok: ctk_token(lexeme: "μ", start: 0, end: 2))
-}
-
-test fn witness_stream_digest_deterministic() -> Bool {
-  stream_digest_one(tok: ctk_token(lexeme: "λ", start: 300, end: 302))
-    == stream_digest_one(tok: ctk_token(lexeme: "λ", start: 300, end: 302))
-}
diff --git a/src/v2/test/claim/parse/pattern_and_let_sugar_test.dag b/src/v2/test/claim/parse/parse_test_pattern_and_let_sugar_test.dag
similarity index 99%
rename from src/v2/test/claim/parse/pattern_and_let_sugar_test.dag
rename to src/v2/test/claim/parse/parse_test_pattern_and_let_sugar_test.dag
index 9befbcd1874..7f1e2c9e750 100644
--- a/src/v2/test/claim/parse/pattern_and_let_sugar_test.dag
+++ b/src/v2/test/claim/parse/parse_test_pattern_and_let_sugar_test.dag
@@ -1,4 +1,4 @@
-module v2.test.claim.parse.pattern_and_let_sugar
+module test.claim.parse_test_pattern_and_let_sugar
 
 import v2.compiler.reference_conservation_admission { conservation_subject_of_text }
 import v2.extdeps.languages.dag { parse_production_emitted_identity_optional }
diff --git a/src/v2/test/claim/parse/parse_test_python_grammar_test.dag b/src/v2/test/claim/parse/parse_test_python_grammar_test.dag
new file mode 100644
index 00000000000..1802dcabb73
--- /dev/null
+++ b/src/v2/test/claim/parse/parse_test_python_grammar_test.dag
@@ -0,0 +1,30 @@
+module test.claim.parse_test_python_grammar
+
+data python_extended_fn_source: String = "def choose(x):\n    y = x + 1\n    if y > 0:\n        return y\n    return 0"
+
+fn python_parse_accepted(out: Outcome<ParseTree>) -> Bool {
+  match out {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+fn python_tokenize_and_parse_source(text: String) -> Outcome<ParseTree> {
+  match tokenize(
+    text: text,
+    file: ^python_parse_file,
+    rules: python_lex()
+  ) {
+    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
+    Accepted { value: stream, diagnostics: _ } =>
+      parse(tokens: stream, grammar: python_grammar())
+  }
+}
+
+// Python lex/grammar accepts an extended function with assignment, if, and indented returns.
+// Formerly the data row `claim_python_extended_function_parses: TestClaim = EqualsClaim`, which no runner executes (the
+// required floor runs `test fn` claims only): the same lhs == rhs predicate, made runnable by the
+// v2.test.parse census (gunbc#13372).
+test fn claim_python_extended_function_parses_holds() -> Bool {
+  (python_parse_accepted(out: python_tokenize_and_parse_source(text: python_extended_fn_source))) == true
+}
diff --git a/src/v2/test/claim/parse/parse_test_python_suite_route_test.dag b/src/v2/test/claim/parse/parse_test_python_suite_route_test.dag
new file mode 100644
index 00000000000..ee57a708b10
--- /dev/null
+++ b/src/v2/test/claim/parse/parse_test_python_suite_route_test.dag
@@ -0,0 +1,63 @@
+module test.claim.parse_test_python_suite_route
+
+import v2.compiler.parse {
+  grammar_choice_ambiguity_count,
+  parse_module_prepared,
+  prepare_grammar,
+}
+import v2.compiler.tokenize { tokenize }
+import v2.extdeps.languages.python { python_grammar_root, python_lex }
+import v2.std.diagnostic { Accepted, Outcome, Rejected }
+import v2.std.grammar { ModeledGrammar, ParseTree }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// ROUTE CONTROL for the suite production on real python source: a two-statement body
+// (assignment, return) lexes with python_lex and parses through python_production_fn_def, so the
+// suite's repetition is executed past its first statement. Two statements is the least input
+// that reaches the repetition; a longer body adds parse cost without adding a route.
+data python_multi_statement_suite_text: String = "def f(x):\n    y = x\n    return y"
+
+// The discriminating red: a suite is one or more statements, so a def whose body is empty refuses.
+data python_empty_suite_text: String = "def f(x):\n    "
+
+// Through the prepared door: prepare_grammar validates AND analyzes the grammar once, and the
+// module parse starts at the grammar's start production, python_production_fn_def. (Validating
+// with grammar_validate_for_parse and then calling parse_production_tree computes the FIRST
+// analysis twice, which is what put this control over its floor budget.)
+fn python_fn_def_parse(text: String) -> Outcome<ParseTree> {
+  match prepare_grammar(grammar: ModeledGrammar { root: python_grammar_root() }) {
+    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
+    Accepted { value: prepared, diagnostics: _ } =>
+      match tokenize(text: text, file: ^python_parse_fixture_file, rules: python_lex()) {
+        Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
+        Accepted { value: stream, diagnostics: _ } =>
+          match parse_module_prepared(tokens: stream, prepared: prepared) {
+            Rejected { diagnostics: r } => Rejected { diagnostics: r }
+            Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
+          }
+      }
+  }
+}
+
+test fn python_multi_statement_suite_parses() -> Bool {
+  match python_fn_def_parse(text: python_multi_statement_suite_text) {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+test fn python_empty_suite_refuses() -> Bool {
+  match python_fn_def_parse(text: python_empty_suite_text) {
+    Accepted { value: _, diagnostics: _ } => false
+    Rejected { diagnostics: _ } => true
+  }
+}
+
+// The family's discriminating control: the suite was python's one choice-overlap row
+// (count 1 as `stmt suite | stmt`); restructured, the roster is empty. The parse controls above
+// hold on both shapes because the language did not change -- this claim is what goes red.
+test fn python_grammar_has_no_choice_overlap() -> Bool {
+  grammar_choice_ambiguity_count(root: python_grammar_root()) == 0
+}
diff --git a/src/v2/test/claim/parse/parse_test_rust_grammar_test.dag b/src/v2/test/claim/parse/parse_test_rust_grammar_test.dag
new file mode 100644
index 00000000000..118d7c6477e
--- /dev/null
+++ b/src/v2/test/claim/parse/parse_test_rust_grammar_test.dag
@@ -0,0 +1,58 @@
+module test.claim.parse_test_rust_grammar
+
+data rust_extended_fn_source: String = "fn choose(x: i32, y: i32) -> i32 { let z = x + 1;\nif z > 0 { return z }\nreturn 0 }"
+
+data rust_return_semi_source: String = "fn r() -> i32 { return; }"
+
+fn rust_parse_bool_atom(b: Bool) -> Node {
+  match b {
+    true => Node { kind: TypeNode { connective: Atom { identity: ^rust_parse_bool_true } }, children: [],
+ occurrence_id: OccurrenceSynthetic
+}
+    false => Node { kind: TypeNode { connective: Atom { identity: ^rust_parse_bool_false } }, children: [],
+ occurrence_id: OccurrenceSynthetic
+}
+  }
+}
+
+fn rust_parse_accepted(out: Outcome<ParseTree>) -> Bool {
+  match out {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+fn rust_tokenize_and_parse_source(text: String) -> Outcome<ParseTree> {
+  match tokenize(
+    text: text,
+    file: ^rust_parse_file,
+    rules: rust_lex()
+  ) {
+    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
+    Accepted { value: tokens, diagnostics: _ } =>
+      parse(tokens: tokens, grammar: rust_grammar())
+  }
+}
+
+fn rust_tokenize_and_parse() -> Outcome<ParseTree> {
+  rust_tokenize_and_parse_source(text: rust_extended_fn_source)
+}
+
+// Rust lex/grammar accepts an extended function with let, if, return, and binary expressions.
+// Formerly the data row `claim_rust_extended_function_parses: TestClaim = EqualsClaim`, which no runner executes (the
+// required floor runs `test fn` claims only): the same lhs == rhs predicate, made runnable by the
+// v2.test.parse census (gunbc#13372).
+test fn claim_rust_extended_function_parses_holds() -> Bool {
+  (rust_parse_accepted(out: rust_tokenize_and_parse())) == true
+}
+
+// Rust grammar accepts return; with layout-free return lexeme and trivia between tokens.
+// Formerly the data row `claim_rust_return_semi_parses: TestClaim = EqualsClaim`, which no runner executes (the
+// required floor runs `test fn` claims only): the same lhs == rhs predicate, made runnable by the
+// v2.test.parse census (gunbc#13372).
+test fn claim_rust_return_semi_parses_holds() -> Bool {
+  (rust_parse_accepted(
+      out: rust_tokenize_and_parse_source(text: rust_return_semi_source)
+    )) == true
+}
+
diff --git a/src/v2/test/claim/parse/parse_test_swift_grammar_test.dag b/src/v2/test/claim/parse/parse_test_swift_grammar_test.dag
new file mode 100644
index 00000000000..07b2a0f05ef
--- /dev/null
+++ b/src/v2/test/claim/parse/parse_test_swift_grammar_test.dag
@@ -0,0 +1,30 @@
+module test.claim.parse_test_swift_grammar
+
+data swift_extended_fn_source: String = "func choose(x: Int) -> Int { let y = x + 1\nif y > 0 { return y }\nreturn 0 }"
+
+fn swift_parse_accepted(out: Outcome<ParseTree>) -> Bool {
+  match out {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+fn swift_tokenize_and_parse_source(text: String) -> Outcome<ParseTree> {
+  match tokenize(
+    text: text,
+    file: ^swift_parse_file,
+    rules: swift_lex()
+  ) {
+    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
+    Accepted { value: tokens, diagnostics: _ } =>
+      parse(tokens: tokens, grammar: swift_grammar())
+  }
+}
+
+// Swift lex/grammar accepts an extended function with let, if, return, and binary expressions.
+// Formerly the data row `claim_swift_extended_function_parses: TestClaim = EqualsClaim`, which no runner executes (the
+// required floor runs `test fn` claims only): the same lhs == rhs predicate, made runnable by the
+// v2.test.parse census (gunbc#13372).
+test fn claim_swift_extended_function_parses_holds() -> Bool {
+  (swift_parse_accepted(out: swift_tokenize_and_parse_source(text: swift_extended_fn_source))) == true
+}
diff --git a/src/v2/test/claim/parse/parse_test_type_decl_modifier_carrier_test.dag b/src/v2/test/claim/parse/parse_test_type_decl_modifier_carrier_test.dag
index 38e74ea354f..f032bd3e10e 100644
--- a/src/v2/test/claim/parse/parse_test_type_decl_modifier_carrier_test.dag
+++ b/src/v2/test/claim/parse/parse_test_type_decl_modifier_carrier_test.dag
@@ -11,7 +11,8 @@ import v2.compiler.body_lowering_fold {
 }
 import v2.compiler.normalize { normalize }
 import v2.compiler.parse { parse }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.extdeps.languages.dag { dag_language_model, parse_production_emitted_identity_optional }
 import v2.std.algebra { Cons, Empty, FreeMonoid, fold_list }
 import v2.std.diagnostic { Accepted, Outcome, Rejected, bind_outcome }
@@ -39,7 +40,7 @@ data tdm_lm: LanguageModel = dag_language_model()
 
 fn tdm_parse(src: String) -> Outcome<Node> {
   bind_outcome(
-    o: tokenize(text: src, file: ^type_decl_modifier_carrier_probe, rules: tdm_lm.lex),
+    o: tokenize_prepared(text: src, file: ^type_decl_modifier_carrier_probe, prepared: dag_prepared_lex()),
     f: fn(ts) { parse(tokens: ts, grammar: tdm_lm.grammar) }
   )
 }
diff --git a/src/v2/test/claim/parse/parse_test_type_decl_modifier_g0_parse_probe_test.dag b/src/v2/test/claim/parse/parse_test_type_decl_modifier_g0_parse_probe_test.dag
index df9d2dff6ce..67f7cc5026d 100644
--- a/src/v2/test/claim/parse/parse_test_type_decl_modifier_g0_parse_probe_test.dag
+++ b/src/v2/test/claim/parse/parse_test_type_decl_modifier_g0_parse_probe_test.dag
@@ -2,7 +2,8 @@ module test.claim.parse_test_type_decl_modifier_g0_parse_probe
 
 import std.types { List }
 import v2.compiler.parse { parse_module }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.extdeps.languages.dag { dag_language_model }
 import v2.std.diagnostic { Accepted, Outcome, Rejected }
 import v2.std.grammar { node_atom_identity_optional }
@@ -26,7 +27,7 @@ data probe_cached_lm: LanguageModel = dag_language_model()
 
 fn parse_outcome(src: String) -> String {
   let lm = probe_cached_lm
-  match tokenize(text: src, file: ^probe, rules: lm.lex) {
+  match tokenize_prepared(text: src, file: ^probe, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: _ } => "TOKENIZE_REFUSED"
     Accepted { value: ts, diagnostics: _ } =>
       match parse_module(tokens: ts, grammar: lm.grammar) {
@@ -85,7 +86,7 @@ test fn sole_constructor_as_a_caret_symbol_still_parses_holds() -> Bool {
 // v2.workflow.floor_pure_producer_share) and each claim reads the list rather than re-parsing.
 fn caret_tree_atom_identities() -> List<Symbol> {
   let lm = probe_cached_lm
-  match tokenize(text: modifier_spelling_as_caret_source, file: ^probe, rules: lm.lex) {
+  match tokenize_prepared(text: modifier_spelling_as_caret_source, file: ^probe, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: _ } => [^caret_probe_tokenize_refused]
     Accepted { value: ts, diagnostics: _ } =>
       match parse_module(tokens: ts, grammar: lm.grammar) {
@@ -111,7 +112,7 @@ fn caret_tree_carries(identity: Symbol) -> Bool {
 
 fn parsed_tree_carries_atom(src: String, identity: Symbol) -> Bool {
   let lm = probe_cached_lm
-  match tokenize(text: src, file: ^probe, rules: lm.lex) {
+  match tokenize_prepared(text: src, file: ^probe, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: _ } => false
     Accepted { value: ts, diagnostics: _ } =>
       match parse_module(tokens: ts, grammar: lm.grammar) {
diff --git a/src/v2/test/claim/parse/parse_test_typescript_grammar_test.dag b/src/v2/test/claim/parse/parse_test_typescript_grammar_test.dag
new file mode 100644
index 00000000000..31ae8e39dd0
--- /dev/null
+++ b/src/v2/test/claim/parse/parse_test_typescript_grammar_test.dag
@@ -0,0 +1,79 @@
+module test.claim.parse_test_typescript_grammar
+
+data ts_type_alias_task_source: String = "type Task = { id: TaskId, title: string, status: TaskStatus };"
+
+data ts_type_alias_minimal_source: String = "type Box = { value: number };"
+
+data ts_type_alias_missing_eq_source: String = "type Box { value: number };"
+
+fn ts_parse_bool_atom(b: Bool) -> Node {
+  match b {
+    true => Node { kind: TypeNode { connective: Atom { identity: ^ts_parse_bool_true } }, children: [],
+ occurrence_id: OccurrenceSynthetic
+}
+    false => Node { kind: TypeNode { connective: Atom { identity: ^ts_parse_bool_false } }, children: [],
+ occurrence_id: OccurrenceSynthetic
+}
+  }
+}
+
+fn ts_parse_accepted(out: Outcome<ParseTree>) -> Bool {
+  match out {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+fn ts_tokenize_and_parse_source(text: String) -> Outcome<ParseTree> {
+  match tokenize(
+    text: text,
+    file: ^ts_parse_file,
+    rules: ts_lex()
+  ) {
+    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
+    Accepted { value: tokens, diagnostics: _ } =>
+      parse(tokens: tokens, grammar: ts_grammar())
+  }
+}
+
+// TS grammar accepts the Task record-type alias: type Task = { id: TaskId, title: string, status: TaskStatus };.
+// Formerly the data row `claim_ts_type_alias_task_parses: TestClaim = EqualsClaim`, which no runner executes (the
+// required floor runs `test fn` claims only): the same lhs == rhs predicate, made runnable by the
+// v2.test.parse census (gunbc#13372).
+test fn claim_ts_type_alias_task_parses_holds() -> Bool {
+  (ts_parse_accepted(
+      out: ts_tokenize_and_parse_source(text: ts_type_alias_task_source)
+    )) == true
+}
+
+// TS grammar accepts a minimal single-field record-type alias with the spec-required `=` token.
+// Formerly the data row `claim_ts_type_alias_minimal_parses: TestClaim = EqualsClaim`, which no runner executes (the
+// required floor runs `test fn` claims only): the same lhs == rhs predicate, made runnable by the
+// v2.test.parse census (gunbc#13372).
+test fn claim_ts_type_alias_minimal_parses_holds() -> Bool {
+  (ts_parse_accepted(
+      out: ts_tokenize_and_parse_source(text: ts_type_alias_minimal_source)
+    )) == true
+}
+
+// TS grammar REJECTS the no-`=` form `type Box { value: number };` — parse rejects missing ts_token_eq after ident.
+// Formerly the data row `claim_ts_type_alias_missing_eq_rejected: TestClaim = EqualsClaim`, which no runner executes (the
+// required floor runs `test fn` claims only): the same lhs == rhs predicate, made runnable by the
+// v2.test.parse census (gunbc#13372).
+test fn claim_ts_type_alias_missing_eq_rejected_holds() -> Bool {
+  (ts_parse_accepted(
+      out: ts_tokenize_and_parse_source(text: ts_type_alias_missing_eq_source)
+    )) == false
+}
+
+data ts_typed_fn_list_tasks_source: String = "function list_tasks(): Task[] { return x; }"
+
+// TS grammar accepts a typed-return fn with array-of-named-type: function list_tasks(): Task[] { return x; }.
+// Formerly the data row `claim_ts_typed_fn_list_tasks_parses: TestClaim = EqualsClaim`, which no runner executes (the
+// required floor runs `test fn` claims only): the same lhs == rhs predicate, made runnable by the
+// v2.test.parse census (gunbc#13372).
+test fn claim_ts_typed_fn_list_tasks_parses_holds() -> Bool {
+  (ts_parse_accepted(
+      out: ts_tokenize_and_parse_source(text: ts_typed_fn_list_tasks_source)
+    )) == true
+}
diff --git a/src/v2/test/claim/parse/parse_test_weather_g0_prefix_parse_probe_test.dag b/src/v2/test/claim/parse/parse_test_weather_g0_prefix_parse_probe_test.dag
index 973d428cd4b..f01daa12327 100644
--- a/src/v2/test/claim/parse/parse_test_weather_g0_prefix_parse_probe_test.dag
+++ b/src/v2/test/claim/parse/parse_test_weather_g0_prefix_parse_probe_test.dag
@@ -12,7 +12,8 @@ import v2.compiler.resolve {
   resolve_node,
   scope_from_namespace
 }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.extdeps.languages.dag {
   dag_float_literal_node_from_lexeme,
   dag_language_model
@@ -57,7 +58,7 @@ data probe_cached_lm: LanguageModel = dag_language_model()
 
 fn parses(src: String) -> Bool {
   let lm = probe_cached_lm
-  match tokenize(text: src, file: ^probe, rules: lm.lex) {
+  match tokenize_prepared(text: src, file: ^probe, prepared: dag_prepared_lex()) {
     Accepted { value: ts, diagnostics: _ } =>
       match parse_module(tokens: ts, grammar: lm.grammar) {
         Accepted { value: _, diagnostics: _ } => true
@@ -68,8 +69,7 @@ fn parses(src: String) -> Bool {
 }
 
 fn lexed_tokens(src: String) -> Outcome<TokenStream> {
-  let lm = probe_cached_lm
-  tokenize(text: src, file: ^probe, rules: lm.lex)
+  tokenize_prepared(text: src, file: ^probe, prepared: dag_prepared_lex())
 }
 
 fn three_classes(src: String, a: Symbol, b: Symbol, c: Symbol) -> Bool {
diff --git a/src/v2/test/claim/parse/python.dag b/src/v2/test/claim/parse/python.dag
deleted file mode 100644
index 1c44db2faf4..00000000000
--- a/src/v2/test/claim/parse/python.dag
+++ /dev/null
@@ -1,43 +0,0 @@
-module v2.test.parse.python
-
-data python_extended_fn_source: String = "def choose(x):\n    y = x + 1\n    if y > 0:\n        return y\n    return 0"
-
-fn python_parse_bool_atom(b: Bool) -> Node {
-  match b {
-    true => Node { kind: TypeNode { connective: Atom { identity: ^python_parse_bool_true } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-    false => Node { kind: TypeNode { connective: Atom { identity: ^python_parse_bool_false } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-  }
-}
-
-fn python_parse_accepted(out: Outcome<ParseTree>) -> Bool {
-  match out {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn python_tokenize_and_parse() -> Outcome<ParseTree> {
-  match tokenize(
-    text: python_extended_fn_source,
-    file: ^python_parse_file,
-    rules: python_lex()
-  ) {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: stream, diagnostics: _ } =>
-      parse(tokens: stream, grammar: python_grammar())
-  }
-}
-
-data claim_python_extended_function_parses: TestClaim = EqualsClaim {
-  label: "Python lex/grammar accepts an extended function with assignment, if, and indented returns",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: python_parse_bool_atom(
-    b: python_parse_accepted(out: python_tokenize_and_parse())
-  ),
-  rhs: python_parse_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Integration }
-}
diff --git a/src/v2/test/claim/parse/repeat_progress_test.dag b/src/v2/test/claim/parse/repeat_progress_test.dag
index eba19a4f880..a8faa30cc54 100644
--- a/src/v2/test/claim/parse/repeat_progress_test.dag
+++ b/src/v2/test/claim/parse/repeat_progress_test.dag
@@ -6,7 +6,6 @@ import v2.std.grammar { GrammarExpr, ModeledGrammar, GrammarProduction, GrammarR
 import v2.compiler.parse { ParseExprAccepted, ParseExprRejected, PreparedModeled, PreparedVoidGrammar, parse_expr, parse_production_prepared, parse_prov_initial, parse_refusal_reason_diagnostic, parse_table_empty, prepare_grammar }
 import v2.std.diagnostic { Accepted, Rejected }
 import v2.std.parse_refusal_reason { TokenStartsNotIncreasing }
-import std.realization { Memoize }
 import std.algebra { Cons }
 import v2.std.algebra { length }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
@@ -35,7 +34,7 @@ fn rp_root() -> GrammarRoot {
 }
 
 fn rp_remaining(expr: GrammarExpr, tokens: List<Token>) -> Int {
-  match parse_expr(expr: expr, tokens: tokens, all_tokens: tokens, root: rp_root(), table: parse_table_empty(materialization: Memoize), prov: parse_prov_initial()) {
+  match parse_expr(expr: expr, tokens: tokens, all_tokens: tokens, root: rp_root(), table: parse_table_empty(), prov: parse_prov_initial()) {
     ParseExprAccepted { remaining: remaining, captured: _, diagnostics: _, prov: _, table: _ } => length(xs: remaining)
     ParseExprRejected { diagnostics: _, table: _ } => -1
   }
@@ -65,13 +64,12 @@ test fn colliding_token_starts_refuse_at_the_first_offending_token_holds() -> Bo
   match prepare_grammar(grammar: ModeledGrammar { root: rp_root() }) {
     Rejected { diagnostics: _ } => false
     Accepted { value: PreparedVoidGrammar, diagnostics: _ } => false
-    Accepted { value: PreparedModeled { modeled: m, materialization: mat }, diagnostics: _ } =>
+    Accepted { value: PreparedModeled { modeled: m }, diagnostics: _ } =>
       match parse_production_prepared(
         tokens: [rp_token(token_class: ^rp_x, start: 0), Token { class: ^rp_x, lexeme: "", file: ^rp_file, start: 0, end: 2 }],
         validated: m.validated,
         analysis: m.analysis,
-        production_name: ^rp_start,
-        materialization: mat
+        production_name: ^rp_start
       ) {
         Accepted { value: _, diagnostics: _ } => false
         Rejected { diagnostics: ds } =>
diff --git a/src/v2/test/claim/parse/rust.dag b/src/v2/test/claim/parse/rust.dag
index 2a8f85d2861..2d61373eb76 100644
--- a/src/v2/test/claim/parse/rust.dag
+++ b/src/v2/test/claim/parse/rust.dag
@@ -1,66 +1,13 @@
 module v2.test.parse.rust
 
-data rust_extended_fn_source: String = "fn choose(x: i32, y: i32) -> i32 { let z = x + 1;\nif z > 0 { return z }\nreturn 0 }"
-
-data rust_return_semi_source: String = "fn r() -> i32 { return; }"
+import v2.std.verification { EqualsClaim, Integration, ManualAnchorAbsent, TestClaim, TestClassification, Tier1, manual_claim_anchor }
+import test.claim.parse_test_rust_grammar { rust_parse_accepted, rust_parse_bool_atom, rust_tokenize_and_parse_source }
 
 data rust_layout_tight_source: String = "fn choose(x: i32, y: i32) -> i32 { let\nz=x+1;\nif z>0 { return z; }\nreturn 0; }"
 
-fn rust_parse_bool_atom(b: Bool) -> Node {
-  match b {
-    true => Node { kind: TypeNode { connective: Atom { identity: ^rust_parse_bool_true } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-    false => Node { kind: TypeNode { connective: Atom { identity: ^rust_parse_bool_false } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-  }
-}
-
-fn rust_parse_accepted(out: Outcome<ParseTree>) -> Bool {
-  match out {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn rust_tokenize_and_parse_source(text: String) -> Outcome<ParseTree> {
-  match tokenize(
-    text: text,
-    file: ^rust_parse_file,
-    rules: rust_lex()
-  ) {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: tokens, diagnostics: _ } =>
-      parse(tokens: tokens, grammar: rust_grammar())
-  }
-}
-
-fn rust_tokenize_and_parse() -> Outcome<ParseTree> {
-  rust_tokenize_and_parse_source(text: rust_extended_fn_source)
-}
-
-data claim_rust_extended_function_parses: TestClaim = EqualsClaim {
-  label: "Rust lex/grammar accepts an extended function with let, if, return, and binary expressions",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: rust_parse_bool_atom(
-    b: rust_parse_accepted(out: rust_tokenize_and_parse())
-  ),
-  rhs: rust_parse_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Integration }
-}
-
-data claim_rust_return_semi_parses: TestClaim = EqualsClaim {
-  label: "Rust grammar accepts return; with layout-free return lexeme and trivia between tokens",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: rust_parse_bool_atom(
-    b: rust_parse_accepted(
-      out: rust_tokenize_and_parse_source(text: rust_return_semi_source)
-    )
-  ),
-  rhs: rust_parse_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Integration }
-}
+// THE RUST GRAMMAR CLAIMS THAT ARE RED ON MAIN, held here ungated while they are diagnosed
+// (v2.test.parse census, gunbc#13372, phase 4 item D). Their green siblings are gated in test.claim.parse_test_rust_grammar.
+// These rows are data TestClaims, which no runner executes; the diagnosis PR, gunbc#13426, converts or frontiers them.
 
 data claim_rust_layout_tight_parses: TestClaim = EqualsClaim {
   label: "Rust grammar accepts tight/newline-separated layout with trivia-separated tokens",
diff --git a/src/v2/test/claim/parse/status_class_pattern_test.dag b/src/v2/test/claim/parse/status_class_pattern_test.dag
index e2fecbf95e4..57a3f2b38e8 100644
--- a/src/v2/test/claim/parse/status_class_pattern_test.dag
+++ b/src/v2/test/claim/parse/status_class_pattern_test.dag
@@ -1,9 +1,8 @@
 module v2.test.claim.parse.status_class_pattern
 
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.diagnostic {
   Accepted,
   ByteRange,
@@ -35,11 +34,11 @@ fn status_source(pattern: String) -> String {
 fn status_parse(text: String) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: ^status_class_probe, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: ^status_class_probe, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
-          match parse_module_prepared(tokens: token_stream, prepared: prepared, validation_residue: residue) {
+          match parse_module_prepared(tokens: token_stream, prepared: prepared) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
           }
@@ -62,7 +61,7 @@ test fn an_exact_status_code_parses_holds() -> Bool { status_parses(pattern: "40
 test fn a_named_status_parses_holds() -> Bool { status_parses(pattern: "nonzero") }
 
 fn token_start(text: String, lexeme: String) -> Int {
-  match tokenize(text: text, file: ^status_class_probe, rules: dag_lex()) {
+  match tokenize_prepared(text: text, file: ^status_class_probe, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: _ } => -1
     Accepted { value: ts, diagnostics: _ } =>
       fold(ts.all, init: -1, f: fn(acc, t) { if acc < 0 && t.lexeme == lexeme { t.start } else { acc } })
diff --git a/src/v2/test/claim/parse/supplied_token_stream_support.dag b/src/v2/test/claim/parse/supplied_token_stream_support.dag
index 2f6304aa0c0..d14cb559c75 100644
--- a/src/v2/test/claim/parse/supplied_token_stream_support.dag
+++ b/src/v2/test/claim/parse/supplied_token_stream_support.dag
@@ -3,9 +3,8 @@ module v2.test.parse.supplied_token_stream_support
 import v2.compiler.normalize { normalize }
 import v2.compiler.normalized_tree { NormalizedTree }
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.compilers.lexing { Token, TokenStream }
 import v2.std.diagnostic { Accepted, Outcome, Rejected }
 import v2.std.node { Node, symbol_lexeme }
@@ -44,7 +43,7 @@ fn supplied_stream_projection(ts: TokenStream) -> String {
 }
 
 fn supplied_stream_matches_tokenize(text: String, file: Symbol, supplied: TokenStream) -> Bool {
-  match tokenize(text: text, file: file, rules: dag_lex()) {
+  match tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: _ } => false
     Accepted { value: real, diagnostics: _ } =>
       supplied_stream_projection(ts: real) == supplied_stream_projection(ts: supplied)
@@ -57,11 +56,10 @@ fn supplied_stream_matches_tokenize(text: String, file: Symbol, supplied: TokenS
 fn supplied_stream_parse(tokens: TokenStream) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       match parse_module_prepared(
         tokens: tokens,
-        prepared: prepared,
-        validation_residue: residue
+        prepared: prepared
       ) {
         Rejected { diagnostics: r } => Rejected { diagnostics: r }
         Accepted { value: artifact, diagnostics: d } =>
diff --git a/src/v2/test/claim/parse/swift.dag b/src/v2/test/claim/parse/swift.dag
deleted file mode 100644
index c857128870b..00000000000
--- a/src/v2/test/claim/parse/swift.dag
+++ /dev/null
@@ -1,43 +0,0 @@
-module v2.test.parse.swift
-
-data swift_extended_fn_source: String = "func choose(x: Int) -> Int { let y = x + 1\nif y > 0 { return y }\nreturn 0 }"
-
-fn swift_parse_bool_atom(b: Bool) -> Node {
-  match b {
-    true => Node { kind: TypeNode { connective: Atom { identity: ^swift_parse_bool_true } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-    false => Node { kind: TypeNode { connective: Atom { identity: ^swift_parse_bool_false } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-  }
-}
-
-fn swift_parse_accepted(out: Outcome<ParseTree>) -> Bool {
-  match out {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn swift_tokenize_and_parse() -> Outcome<ParseTree> {
-  match tokenize(
-    text: swift_extended_fn_source,
-    file: ^swift_parse_file,
-    rules: swift_lex()
-  ) {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: tokens, diagnostics: _ } =>
-      parse(tokens: tokens, grammar: swift_grammar())
-  }
-}
-
-data claim_swift_extended_function_parses: TestClaim = EqualsClaim {
-  label: "Swift lex/grammar accepts an extended function with let, if, return, and binary expressions",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: swift_parse_bool_atom(
-    b: swift_parse_accepted(out: swift_tokenize_and_parse())
-  ),
-  rhs: swift_parse_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Integration }
-}
diff --git a/src/v2/test/claim/parse/test_data_decl_parse_test.dag b/src/v2/test/claim/parse/test_data_decl_parse_test.dag
index 4dbecc8a3eb..468a5a34e48 100644
--- a/src/v2/test/claim/parse/test_data_decl_parse_test.dag
+++ b/src/v2/test/claim/parse/test_data_decl_parse_test.dag
@@ -30,7 +30,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
 fn parse_outcome(src: String, file: Symbol) -> String {
   let lm = dag_language_model()
-  match tokenize(text: src, file: file, rules: lm.lex) {
+  match tokenize_prepared(text: src, file: file, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: _ } => "TOKENIZE_REFUSED"
     Accepted { value: ts, diagnostics: _ } =>
       match parse_module(tokens: ts, grammar: lm.grammar) {
diff --git a/src/v2/test/claim/parse/test_marker_channel_test.dag b/src/v2/test/claim/parse/test_marker_channel_test.dag
index c836fd8a9a8..5ed3cd3d50d 100644
--- a/src/v2/test/claim/parse/test_marker_channel_test.dag
+++ b/src/v2/test/claim/parse/test_marker_channel_test.dag
@@ -19,7 +19,7 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
 fn test_marker_parsed(src: String, file: Symbol) -> Outcome<ParseArtifact> {
   let lm = dag_language_model()
-  match tokenize(text: src, file: file, rules: lm.lex) {
+  match tokenize_prepared(text: src, file: file, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
     Accepted { value: ts, diagnostics: _ } => parse_module(tokens: ts, grammar: lm.grammar)
   }
diff --git a/src/v2/test/claim/parse/transport_kind_closed_choice_test.dag b/src/v2/test/claim/parse/transport_kind_closed_choice_test.dag
index 7a23224ba00..b46ff637910 100644
--- a/src/v2/test/claim/parse/transport_kind_closed_choice_test.dag
+++ b/src/v2/test/claim/parse/transport_kind_closed_choice_test.dag
@@ -1,9 +1,8 @@
 module v2.test.claim.parse.transport_kind_closed_choice
 
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
-import v2.extdeps.languages.dag { dag_lex }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.std.diagnostic {
   Accepted,
   ByteRange,
@@ -35,11 +34,11 @@ fn transport_source(kind: String) -> String {
 fn transport_parse(text: String) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: ^transport_kind_probe, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: ^transport_kind_probe, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
-          match parse_module_prepared(tokens: token_stream, prepared: prepared, validation_residue: residue) {
+          match parse_module_prepared(tokens: token_stream, prepared: prepared) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
           }
@@ -67,7 +66,7 @@ test fn the_local_transport_kind_parses_holds() -> Bool { transport_kind_parses(
 
 // The byte offset of the first token spelled `lexeme`, from the same lexer the parse reads.
 fn token_start(text: String, lexeme: String) -> Int {
-  match tokenize(text: text, file: ^transport_kind_probe, rules: dag_lex()) {
+  match tokenize_prepared(text: text, file: ^transport_kind_probe, prepared: dag_prepared_lex()) {
     Rejected { diagnostics: _ } => -1
     Accepted { value: ts, diagnostics: _ } =>
       fold(ts.all, init: -1, f: fn(acc, t) { if acc < 0 && t.lexeme == lexeme { t.start } else { acc } })
diff --git a/src/v2/test/claim/parse/typescript.dag b/src/v2/test/claim/parse/typescript.dag
index 29318f9435e..e9272fcfcdc 100644
--- a/src/v2/test/claim/parse/typescript.dag
+++ b/src/v2/test/claim/parse/typescript.dag
@@ -1,81 +1,15 @@
 module v2.test.parse.typescript
 
-
-data ts_type_alias_task_source: String = "type Task = { id: TaskId, title: string, status: TaskStatus };"
-
-data ts_type_alias_minimal_source: String = "type Box = { value: number };"
-
-data ts_type_alias_missing_eq_source: String = "type Box { value: number };"
+import v2.std.verification { EqualsClaim, Integration, ManualAnchorAbsent, TestClaim, TestClassification, Tier1, manual_claim_anchor }
+import test.claim.parse_test_typescript_grammar { ts_parse_accepted, ts_parse_bool_atom, ts_tokenize_and_parse_source }
 
 data ts_union_task_status_source: String = "const status: 'Open' | 'InProgress' | 'Done' = status;"
 
 data ts_union_minimal_source: String = "const bit: 'On' | 'Off' = bit;"
 
-fn ts_parse_bool_atom(b: Bool) -> Node {
-  match b {
-    true => Node { kind: TypeNode { connective: Atom { identity: ^ts_parse_bool_true } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-    false => Node { kind: TypeNode { connective: Atom { identity: ^ts_parse_bool_false } }, children: [],
- occurrence_id: OccurrenceSynthetic
-}
-  }
-}
-
-fn ts_parse_accepted(out: Outcome<ParseTree>) -> Bool {
-  match out {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn ts_tokenize_and_parse_source(text: String) -> Outcome<ParseTree> {
-  match tokenize(
-    text: text,
-    file: ^ts_parse_file,
-    rules: ts_lex()
-  ) {
-    Rejected { diagnostics: diags } => Rejected { diagnostics: diags }
-    Accepted { value: tokens, diagnostics: _ } =>
-      parse(tokens: tokens, grammar: ts_grammar())
-  }
-}
-
-data claim_ts_type_alias_task_parses: TestClaim = EqualsClaim {
-  label: "TS grammar accepts the Task record-type alias: type Task = { id: TaskId, title: string, status: TaskStatus };",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: ts_parse_bool_atom(
-    b: ts_parse_accepted(
-      out: ts_tokenize_and_parse_source(text: ts_type_alias_task_source)
-    )
-  ),
-  rhs: ts_parse_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Integration }
-}
-
-data claim_ts_type_alias_minimal_parses: TestClaim = EqualsClaim {
-  label: "TS grammar accepts a minimal single-field record-type alias with the spec-required `=` token",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: ts_parse_bool_atom(
-    b: ts_parse_accepted(
-      out: ts_tokenize_and_parse_source(text: ts_type_alias_minimal_source)
-    )
-  ),
-  rhs: ts_parse_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Integration }
-}
-
-data claim_ts_type_alias_missing_eq_rejected: TestClaim = EqualsClaim {
-  label: "TS grammar REJECTS the no-`=` form `type Box { value: number };` — parse rejects missing ts_token_eq after ident",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: ts_parse_bool_atom(
-    b: ts_parse_accepted(
-      out: ts_tokenize_and_parse_source(text: ts_type_alias_missing_eq_source)
-    )
-  ),
-  rhs: ts_parse_bool_atom(b: false),
-  classification: TestClassification { tier: Tier1, layer: Integration }
-}
+// THE TYPESCRIPT GRAMMAR CLAIMS THAT ARE RED ON MAIN, held here ungated while they are diagnosed
+// (v2.test.parse census, gunbc#13372, phase 4 item D). Their green siblings are gated in test.claim.parse_test_typescript_grammar.
+// These rows are data TestClaims, which no runner executes; the diagnosis PR, gunbc#13426, converts or frontiers them.
 
 data claim_ts_union_task_status_parses: TestClaim = EqualsClaim {
   label: "TS grammar accepts a 3-variant string-literal discriminated union in a const annotation (TaskStatus surface): const status: 'Open' | 'InProgress' | 'Done' = status;",
@@ -100,17 +34,3 @@ data claim_ts_union_minimal_parses: TestClaim = EqualsClaim {
   rhs: ts_parse_bool_atom(b: true),
   classification: TestClassification { tier: Tier1, layer: Integration }
 }
-
-data ts_typed_fn_list_tasks_source: String = "function list_tasks(): Task[] { return x; }"
-
-data claim_ts_typed_fn_list_tasks_parses: TestClaim = EqualsClaim {
-  label: "TS grammar accepts a typed-return fn with array-of-named-type: function list_tasks(): Task[] { return x; }",
-  anchor: manual_claim_anchor(anchor: ManualAnchorAbsent),
-  lhs: ts_parse_bool_atom(
-    b: ts_parse_accepted(
-      out: ts_tokenize_and_parse_source(text: ts_typed_fn_list_tasks_source)
-    )
-  ),
-  rhs: ts_parse_bool_atom(b: true),
-  classification: TestClassification { tier: Tier1, layer: Integration }
-}
diff --git a/src/v2/test/claim/parse/variant_field_lowering_test.dag b/src/v2/test/claim/parse/variant_field_lowering_test.dag
index a7f1c4451ed..8032fe02370 100644
--- a/src/v2/test/claim/parse/variant_field_lowering_test.dag
+++ b/src/v2/test/claim/parse/variant_field_lowering_test.dag
@@ -77,8 +77,8 @@ data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 fn vf_parse(tokens: TokenStream) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
-      match parse_module_prepared(tokens: tokens, prepared: prepared, validation_residue: residue) {
+    Accepted { value: prepared, diagnostics: _ } =>
+      match parse_module_prepared(tokens: tokens, prepared: prepared) {
         Rejected { diagnostics: r } => Rejected { diagnostics: r }
         Accepted { value: artifact, diagnostics: d } => Accepted { value: artifact.tree, diagnostics: d }
       }
diff --git a/src/v2/test/claim/parse/where_refinement_clause_parse_test.dag b/src/v2/test/claim/parse/where_refinement_clause_parse_test.dag
index 03479615671..474e0812fe4 100644
--- a/src/v2/test/claim/parse/where_refinement_clause_parse_test.dag
+++ b/src/v2/test/claim/parse/where_refinement_clause_parse_test.dag
@@ -2,10 +2,9 @@ module v2.test.parse.where_refinement_clause_parse
 
 import v2.compiler.normalize { normalize }
 import v2.compiler.parse { parse_module_prepared }
-import v2.compiler.program_assembly { dag_prepared_grammar }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_grammar, dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.extdeps.languages.dag {
-  dag_lex,
   parse_subtree_find_production_captured,
   ParseSubtreeAbsent,
   ParseSubtreeFound,
@@ -30,14 +29,13 @@ data where_refinement_negative_empty_clause_source: String = "module probe.where
 fn where_refinement_tokenize_parse(text: String, file: Symbol) -> Outcome<Node> {
   match dag_prepared_grammar() {
     Rejected { diagnostics: d } => Rejected { diagnostics: d }
-    Accepted { value: prepared, diagnostics: residue } =>
+    Accepted { value: prepared, diagnostics: _ } =>
       bind_outcome(
-        o: tokenize(text: text, file: file, rules: dag_lex()),
+        o: tokenize_prepared(text: text, file: file, prepared: dag_prepared_lex()),
         f: fn(token_stream) {
           match parse_module_prepared(
             tokens: token_stream,
-            prepared: prepared,
-            validation_residue: residue
+            prepared: prepared
           ) {
             Rejected { diagnostics: r } => Rejected { diagnostics: r }
             Accepted { value: artifact, diagnostics: d } =>
diff --git a/src/v2/test/claim/provenance/parse_memo_frame_replay_test.dag b/src/v2/test/claim/provenance/parse_memo_frame_replay_test.dag
index af69e43bfb1..c0b2f9f85d0 100644
--- a/src/v2/test/claim/provenance/parse_memo_frame_replay_test.dag
+++ b/src/v2/test/claim/provenance/parse_memo_frame_replay_test.dag
@@ -2,94 +2,55 @@ module v2.test.provenance.parse_memo_frame_replay
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
-// A MEMO HIT MUST RESOLVE EVERY NODE IT RETURNS EXACTLY AS A PARSE WITH NO MEMO DOES. A memo hit
-// replays the stored frame -- the ids minted or replayed inside the memoized production -- into
-// the current span index, instead of merging the stored index whole. The oracle is independent of
-// that mechanism: the same tokens under the same prepared grammar, once with the table's
-// materialization Memoize (hits happen) and once with Recompute (the door refuses every store, so
-// no hit can happen), must give every minted node in the tree a span-index entry, and the
-// pre-order list of their textual-locus resolutions must be identical. A replay that drops an id the
-// returned subtree references reds on the entry check; one that adopts the wrong event reds on the
-// comparison.
+// EVERY NODE A PARSE RETURNS RESOLVES TO ITS OWN SURVIVING-PATH PROVENANCE. Backtracking restores
+// the whole ParseProvenanceState on a failed attempt, so occurrence ids are a counter along
+// whichever path survives: an id minted on an abandoned attempt is minted again by the next one
+// and recorded once. The packrat memo that served captures across paths -- and with them ids
+// minted on an abandoned path -- was deleted (operator ruling R2, 2026-10-08;
+// gunbc.recurring_failure_mode parse_memo_hit_serves_occurrences_minted_on_an_abandoned_path), and
+// this module keeps the grammars that exposed it as regression controls on the memo-free door.
 //
-// Both specimens are hand grammars small enough for the floor's per-witness step budget. The first
-// was a real .dag specimen under the real .dag grammar, which cost ~489k eval steps and was refused
-// at enrolment; what it uniquely exercised -- a memo hit whose frame holds a NESTED memoized frame --
-// is built directly below.
+// The expected results are stated without reference to any memo: every minted occurrence in the
+// accepted tree is distinct, every one has a span-index entry, the index holds nothing the
+// surviving path did not mint, and the tree's terminals, in token order, each carry their own class
+// and resolve through their own id to their own bytes. Every run goes through
+// the PRODUCTION DOOR -- prepare_grammar, then parse_production_prepared over the prepared
+// analysis, the route parse_module_prepared_seeded takes -- so a door that served a capture across
+// paths again reds here.
+//
+// The module name is kept because the failure-mode row above cites its colliding-grammar claim.
 
-type ParseMemoFrameReplayRun {
+type ParsePathRun {
   tree: Node
   index: SpanIndex
-  hits: Int
 }
 
-fn parse_memo_frame_replay_run_modeled(
-  tokens: List<Token>,
-  validated: ValidatedGrammarRoot,
-  analysis: GrammarFirstAnalysis,
-  materialization: Materialization
-) -> Optional<ParseMemoFrameReplayRun> {
-  let root = validated.root
-  let base = parse_table_for_production_analyzed(
-    validated: validated,
-    analysis: analysis,
-    all_tokens: tokens,
-    materialization: Memoize
-  )
-  let table = ParseTableRealization {
-    artifact_kind: base.artifact_kind,
-    provider_id: base.provider_id,
-    materialization: materialization,
-    grammar_digest: base.grammar_digest,
-    token_stream_digest: base.token_stream_digest,
-    entries: base.entries,
-    memo_hits: base.memo_hits,
-    memo_misses: base.memo_misses,
-    memo_lookup_calls: base.memo_lookup_calls,
-    furthest: base.furthest,
-    nullable_set: base.nullable_set,
-    first_rows: base.first_rows,
-    productions_by_name: base.productions_by_name,
-    prepared_exprs: base.prepared_exprs,
-    layout: base.layout,
-    refusal: base.refusal
-  }
-  match grammar_lookup_production(root: root, name: root.start) {
-    Violates { diagnostic: _ } => optional_absent()
-    Holds { value: production } =>
-      match parse_expr(
-        expr: production.expression,
-        tokens: tokens,
-        all_tokens: tokens,
-        root: root,
-        table: table,
-        prov: parse_prov_initial()
-      ) {
-        ParseExprRejected { diagnostics: _, table: _ } => optional_absent()
-        ParseExprAccepted { remaining: _, captured: captured, diagnostics: _, prov: prov, table: final_table } =>
-          optional_present(value: ParseMemoFrameReplayRun {
-            tree: captured,
-            index: prov.index,
-            hits: final_table.memo_hits
-          })
+fn parse_path_run_through_door(root: GrammarRoot, tokens: List<Token>) -> Optional<ParsePathRun> {
+  match prepare_grammar(grammar: ModeledGrammar { root: root }) {
+    Rejected { diagnostics: _ } => optional_absent()
+    Accepted { value: prepared, diagnostics: _ } =>
+      match prepared {
+        PreparedVoidGrammar => optional_absent()
+        PreparedModeled { modeled: modeled } =>
+          match parse_production_prepared(
+            tokens: tokens,
+            validated: modeled.validated,
+            analysis: modeled.analysis,
+            production_name: modeled.validated.root.start
+          ) {
+            Rejected { diagnostics: _ } => optional_absent()
+            Accepted { value: artifact, diagnostics: _ } =>
+              optional_present(value: ParsePathRun { tree: artifact.tree, index: artifact.span_index })
+          }
       }
   }
 }
 
-// THROUGH A TYPED PARAMETER, deliberately. Inside this module a field read on a variable bound by
-// `Present { value: r }` from an Optional of this module's own record type evaluates to an error type
-// under the seed interpreter's inference ("error type cascade" at the read), while the same read on a
-// declared parameter, or from any other module, types correctly. The defect is recorded on the PR
-// that added these witnesses; this accessor is the one spelling that reads the field here.
-fn parse_memo_frame_replay_hits(run: ParseMemoFrameReplayRun) -> Int {
-  run.hits
-}
-
-// Absent when any minted node has no span-index entry -- the fact a dropped replay breaks.
+// Absent when any minted node has no span-index entry -- the fact a dropped record breaks.
 // Otherwise each minted node's textual-locus resolution in pre-order. Resolution itself is not
 // total (a DerivedBy over children with no minted id exhausts its chain), so an unresolved node is
-// recorded as Absent and compared, never treated as failure.
-fn parse_memo_frame_replay_loci(run: ParseMemoFrameReplayRun) -> Optional<List<Optional<Locus>>> {
+// recorded as Absent, never treated as failure.
+fn parse_path_run_loci(run: ParsePathRun) -> Optional<List<Optional<Locus>>> {
   fold_list(
     xs: node_subtree_nodes(root: run.tree),
     empty: optional_present(value: std.algebra.Empty),
@@ -118,22 +79,129 @@ fn parse_memo_frame_replay_loci(run: ParseMemoFrameReplayRun) -> Optional<List<O
   )
 }
 
+fn parse_path_minted_ids(tree: Node) -> List<std.occurrence_identity.OccurrenceId> {
+  fold_list(
+    xs: node_subtree_nodes(root: tree),
+    empty: std.algebra.Empty,
+    cons: fn(acc, n) {
+      match n.occurrence_id {
+        OccurrenceMinted { id: id } => list_snoc_item(xs: acc, item: id)
+        OccurrenceSynthetic => acc
+        OccurrenceProjected { id: _, caused_by: _ } => acc
+        OccurrencePending { caused_by: _ } => acc
+      }
+    }
+  )
+}
+
+fn occurrence_id_set_empty() -> Map<std.occurrence_identity.OccurrenceId, Bool> {
+  empty_map()
+}
+
+fn parse_path_minted_ids_distinct(run: ParsePathRun) -> Bool {
+  let ids = parse_path_minted_ids(tree: run.tree)
+  let distinct = fold_list(
+    xs: ids,
+    empty: occurrence_id_set_empty(),
+    cons: fn(acc, id) { map_insert(m: acc, key: id, value: true) }
+  )
+  length(xs: map_keys(distinct)) == length(xs: ids)
+}
+
+// The index holds exactly the surviving path's mints: one entry per minted node in the tree, none
+// left over from an abandoned attempt.
+fn parse_path_index_is_the_tree(run: ParsePathRun) -> Bool {
+  length(xs: map_keys(run.index.entries)) == length(xs: parse_path_minted_ids(tree: run.tree))
+}
+
+// A terminal is a childless minted Atom, stamped by its token class. Each one is paired with the
+// locus ITS OWN id resolves to, in pre-order -- token order -- so the comparison below asks which
+// bytes each terminal owns, not merely whether some node owns a given range. Absent when a
+// terminal's id does not resolve to a textual locus.
+type TerminalAt {
+  class: Symbol
+  locus: Locus
+}
+
+fn parse_path_terminals(run: ParsePathRun) -> Optional<List<TerminalAt>> {
+  fold_list(
+    xs: node_subtree_nodes(root: run.tree),
+    empty: optional_present(value: std.algebra.Empty),
+    cons: fn(acc, n) {
+      match acc {
+        Absent => acc
+        Present { value: terminals } =>
+          if length(xs: n.children) != 0 {
+            acc
+          } else {
+            match n.kind {
+              TypeNode { connective: Atom { identity: class } } =>
+                match n.occurrence_id {
+                  OccurrenceMinted { id: id } =>
+                    match span_index_resolve_textual_locus(index: run.index, id: id) {
+                      Holds { value: locus } =>
+                        optional_present(value: list_snoc_item(xs: terminals, item: TerminalAt { class: class, locus: locus }))
+                      Violates { diagnostic: _ } => optional_absent()
+                    }
+                  OccurrenceSynthetic => acc
+                  OccurrenceProjected { id: _, caused_by: _ } => acc
+                  OccurrencePending { caused_by: _ } => acc
+                }
+              _ => acc
+            }
+          }
+      }
+    }
+  )
+}
+
+type TerminalCursor {
+  agrees: Bool
+  rest: List<TerminalAt>
+}
+
+// The accepted tree's terminals, in order, are exactly `want`: same count, and each one carries the
+// expected class and resolves to the expected bytes. Swapping two terminals' span records reds here
+// even though both ranges are still present in the index.
+fn parse_path_terminals_are(run: ParsePathRun, want: List<TerminalAt>) -> Bool {
+  match parse_path_terminals(run: run) {
+    Absent => false
+    Present { value: got } =>
+      let walked = fold_list(
+        xs: want,
+        empty: TerminalCursor { agrees: true, rest: got },
+        cons: fn(cursor, w) {
+          match cursor.rest {
+            Empty => TerminalCursor { agrees: false, rest: cursor.rest }
+            Cons { head: g, tail: tail } =>
+              TerminalCursor {
+                agrees: cursor.agrees && g.class == w.class && g.locus == w.locus,
+                rest: tail
+              }
+          }
+        }
+      )
+      walked.agrees && length(xs: walked.rest) == 0
+  }
+}
+
+fn expected_terminal_at(token_class: Symbol, start: Int) -> TerminalAt {
+  TerminalAt { class: token_class, locus: abandoned_locus(start: start) }
+}
+
+fn abandoned_path_terminals() -> List<TerminalAt> {
+  [
+    expected_terminal_at(token_class: ^abandoned_tok_a, start: 0),
+    expected_terminal_at(token_class: ^abandoned_tok_a, start: 1),
+    expected_terminal_at(token_class: ^abandoned_tok_b, start: 2),
+    expected_terminal_at(token_class: ^abandoned_tok_y, start: 3)
+  ]
+}
+
+fn abandoned_locus(start: Int) -> Locus {
+  Textual { file: ^abandoned_path_file, extent: ByteRange { start: start, end: start + 1 } }
+}
 
-// THE ACCEPTED ARTIFACT CARRIES ONLY ACCEPTED-PATH PROVENANCE. A memo-free parse discards a failed
-// branch's provenance with the branch, so its index holds exactly the entries minted on the accepted
-// path. The stored index a memo hit used to merge whole also held entries the MISS path minted
-// before the memoized production started. Those only survive when the miss path minted more ids
-// before that production than the hit path did -- a shorter hit path re-mints the low ids itself,
-// and the base entry wins -- so the real .dag specimen above cannot show the difference, and this
-// hand grammar is built to:
-//
-//   S = R X z | a a X y      R = a a      X = b      tokens: a a b y
-//
-// Alternative one mints four ids before X (a, a, their conjunction, R's wrap), memoizes X at
-// position 2, and fails at z. Alternative two mints three ids before X and hits that memo entry,
-// whose stored index carries alternative one's fourth id. Replaying the memoized frame imports
-// nothing but X's own ids, so the memoized index holds exactly the memo-free index's entry count;
-// the whole-index merge held one more.
 fn abandoned_token(token_class: Symbol, offset: Int) -> Token {
   Token { class: token_class, lexeme: std.algebra.Empty, file: ^abandoned_path_file, start: offset, end: offset + 1 }
 }
@@ -142,6 +210,22 @@ fn abandoned_terminal(token_class: Symbol) -> GrammarExpr {
   Terminal { token_class: token_class, stamp: StampClass }
 }
 
+fn abandoned_path_tokens() -> List<Token> {
+  Cons { head: abandoned_token(token_class: ^abandoned_tok_a, offset: 0),
+  tail: Cons { head: abandoned_token(token_class: ^abandoned_tok_a, offset: 1),
+  tail: Cons { head: abandoned_token(token_class: ^abandoned_tok_b, offset: 2),
+  tail: Cons { head: abandoned_token(token_class: ^abandoned_tok_y, offset: 3),
+  tail: std.algebra.Empty } } } }
+}
+
+// THE ABANDONED-PATH DIRECTION.
+//
+//   S = R X z | a a X y      R = a a      X = b      tokens: a a b y
+//
+// Alternative one mints four ids before X (a, a, their conjunction, R's wrap), parses X at position
+// 2, and fails at z. Alternative two mints three ids before X and parses X again. Nothing the first
+// alternative minted may survive into the accepted artifact: the index holds exactly the tree's
+// minted ids, they are distinct, and every terminal resolves to its own byte.
 fn abandoned_path_root() -> GrammarRoot {
   GrammarRoot {
     start: ^abandoned_path_s,
@@ -188,95 +272,73 @@ fn abandoned_path_root() -> GrammarRoot {
   }
 }
 
-fn abandoned_path_tokens() -> List<Token> {
-  Cons { head: abandoned_token(token_class: ^abandoned_tok_a, offset: 0),
-  tail: Cons { head: abandoned_token(token_class: ^abandoned_tok_a, offset: 1),
-  tail: Cons { head: abandoned_token(token_class: ^abandoned_tok_b, offset: 2),
-  tail: Cons { head: abandoned_token(token_class: ^abandoned_tok_y, offset: 3),
-  tail: std.algebra.Empty } } } }
-}
-
-fn abandoned_path_run(materialization: Materialization) -> Optional<ParseMemoFrameReplayRun> {
-  let contract_locus = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^abandoned_path_grammar_contract)
-  match grammar_validate_for_parse(root: abandoned_path_root(), at: contract_locus) {
-    Rejected { diagnostics: _ } => optional_absent()
-    Accepted { value: validated, diagnostics: _ } =>
-      parse_memo_frame_replay_run_modeled(
-        tokens: abandoned_path_tokens(),
-        validated: validated,
-        analysis: compute_grammar_first_analysis(root: validated.root),
-        materialization: materialization
-      )
+fn abandoned_run_holds(run: ParsePathRun) -> Bool {
+  match parse_path_run_loci(run: run) {
+    Absent => false
+    Present { value: _ } =>
+      parse_path_minted_ids_distinct(run: run)
+        && parse_path_index_is_the_tree(run: run)
+        && parse_path_terminals_are(run: run, want: abandoned_path_terminals())
   }
 }
 
-fn parse_memo_frame_replay_entry_count(run: ParseMemoFrameReplayRun) -> Int {
-  length(xs: map_keys(run.index.entries))
-}
-
-test fn parse_memo_hit_carries_no_abandoned_path_provenance() -> Bool {
-  match abandoned_path_run(materialization: Memoize) {
+test fn abandoned_path_parse_carries_only_surviving_path_provenance() -> Bool {
+  match parse_path_run_through_door(root: abandoned_path_root(), tokens: abandoned_path_tokens()) {
     Absent => false
-    Present { value: memo_run } =>
-      match abandoned_path_run(materialization: Recompute) {
-        Absent => false
-        Present { value: free_run } =>
-          match parse_memo_frame_replay_loci(run: memo_run) {
-            Absent => false
-            Present { value: memo_loci } =>
-              match parse_memo_frame_replay_loci(run: free_run) {
-                Absent => false
-                Present { value: free_loci } =>
-                  (parse_memo_frame_replay_hits(run: memo_run) > 0)
-                    && (parse_memo_frame_replay_hits(run: free_run) == 0)
-                    && (memo_loci == free_loci)
-                    && (parse_memo_frame_replay_entry_count(run: memo_run) == parse_memo_frame_replay_entry_count(run: free_run))
-              }
-          }
-      }
+    Present { value: run } => abandoned_run_holds(run: run)
   }
 }
 
-// A HIT WHOSE FRAME HOLDS A NESTED MEMOIZED FRAME.
+// THE COLLIDING DIRECTION, and the specimen behind gunbc.recurring_failure_mode
+// parse_memo_hit_serves_occurrences_minted_on_an_abandoned_path. The mirror of abandoned_path_root:
 //
-//   S = X z | (X y) z*      X = W b      W = a      tokens: a b y
+//   S = a a X z | R X y      R = a a      X = b      tokens: a a b y
 //
-// The second alternative is nested so it does not share a sequence-left atom with the first.
-// SharedPrefix would parse X once and never hit the memo. OrderedBacktrack tries X z (miss,
-// nested W miss, fail at z), then (X y) z* (hit X, whose stored frame holds W).
-fn nested_frame_root() -> GrammarRoot {
+// Alternative one mints three ids before X, then X's own, and fails at z. Alternative two mints FOUR
+// ids before X (a, a, their conjunction, R's wrap) -- one more than the first -- so an X served from
+// the first attempt would carry a b whose id the surviving path has already given to R's wrap. This
+// claim was red under the memo and is the permanent regression control for its deletion (DESIGN
+// section 4b(4)): every minted occurrence in the accepted tree is distinct, the index is exactly
+// the tree's mints, and each terminal -- b among them, at 2..3 -- resolves to its own bytes.
+fn collision_path_root() -> GrammarRoot {
   GrammarRoot {
-    start: ^nested_frame_s,
+    start: ^collision_path_s,
     productions: Cons {
       head: GrammarProduction {
-        name: ^nested_frame_s,
+        name: ^collision_path_s,
         expression: Choice {
           left: Sequence {
-            left: Nonterminal { production: ^nested_frame_x },
-            right: abandoned_terminal(token_class: ^nested_tok_z)
-          },
-          right: Sequence {
             left: Sequence {
-              left: Nonterminal { production: ^nested_frame_x },
-              right: abandoned_terminal(token_class: ^nested_tok_y)
+              left: abandoned_terminal(token_class: ^abandoned_tok_a),
+              right: abandoned_terminal(token_class: ^abandoned_tok_a)
             },
-            right: Repeat { element: abandoned_terminal(token_class: ^nested_tok_z) }
+            right: Sequence {
+              left: Nonterminal { production: ^collision_path_x },
+              right: abandoned_terminal(token_class: ^abandoned_tok_z)
+            }
+          },
+          right: Sequence {
+            left: Nonterminal { production: ^collision_path_r },
+            right: Sequence {
+              left: Nonterminal { production: ^collision_path_x },
+              right: abandoned_terminal(token_class: ^abandoned_tok_y)
+            }
           }
         },
-        emitted: grammar_atom(identity: ^nested_frame_s)
+        emitted: grammar_atom(identity: ^collision_path_s)
       },
       tail: Cons { head: GrammarProduction {
-        name: ^nested_frame_x,
+        name: ^collision_path_r,
         expression: Sequence {
-          left: Nonterminal { production: ^nested_frame_w },
-          right: abandoned_terminal(token_class: ^nested_tok_b)
+          left: abandoned_terminal(token_class: ^abandoned_tok_a),
+          right: abandoned_terminal(token_class: ^abandoned_tok_a)
         },
-        emitted: grammar_atom(identity: ^nested_frame_x)
+        emitted: grammar_atom(identity: ^collision_path_r)
       },
       tail: Cons { head: GrammarProduction {
-        name: ^nested_frame_w,
-        expression: abandoned_terminal(token_class: ^nested_tok_a),
-        emitted: grammar_atom(identity: ^nested_frame_w)
+        name: ^collision_path_x,
+        expression: abandoned_terminal(token_class: ^abandoned_tok_b),
+        emitted: grammar_atom(identity: ^collision_path_x)
       },
       tail: std.algebra.Empty } }
     },
@@ -284,97 +346,64 @@ fn nested_frame_root() -> GrammarRoot {
   }
 }
 
-fn nested_frame_tokens() -> List<Token> {
-  Cons { head: abandoned_token(token_class: ^nested_tok_a, offset: 0),
-  tail: Cons { head: abandoned_token(token_class: ^nested_tok_b, offset: 1),
-  tail: Cons { head: abandoned_token(token_class: ^nested_tok_y, offset: 2),
-  tail: std.algebra.Empty } } }
-}
-
-fn nested_frame_run(materialization: Materialization) -> Optional<ParseMemoFrameReplayRun> {
-  let contract_locus = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^nested_frame_grammar_contract)
-  match grammar_validate_for_parse(root: nested_frame_root(), at: contract_locus) {
-    Rejected { diagnostics: _ } => optional_absent()
-    Accepted { value: validated, diagnostics: _ } =>
-      parse_memo_frame_replay_run_modeled(
-        tokens: nested_frame_tokens(),
-        validated: validated,
-        analysis: compute_grammar_first_analysis(root: validated.root),
-        materialization: materialization
-      )
+fn collision_run_holds(run: ParsePathRun) -> Bool {
+  match parse_path_run_loci(run: run) {
+    Absent => false
+    Present { value: _ } =>
+      parse_path_minted_ids_distinct(run: run)
+        && parse_path_index_is_the_tree(run: run)
+        && parse_path_terminals_are(run: run, want: abandoned_path_terminals())
   }
 }
 
-test fn parse_memo_hit_replays_nested_frames_like_a_memo_free_parse() -> Bool {
-  match nested_frame_run(materialization: Memoize) {
+test fn parse_memo_production_door_keeps_occurrences_distinct_on_a_colliding_grammar() -> Bool {
+  match parse_path_run_through_door(root: collision_path_root(), tokens: abandoned_path_tokens()) {
     Absent => false
-    Present { value: warm } =>
-      match nested_frame_run(materialization: Recompute) {
-        Absent => false
-        Present { value: cold } =>
-          match parse_memo_frame_replay_loci(run: warm) {
-            Absent => false
-            Present { value: warm_loci } =>
-              match parse_memo_frame_replay_loci(run: cold) {
-                Absent => false
-                Present { value: cold_loci } =>
-                  (parse_memo_frame_replay_hits(run: warm) > 0)
-                    && (parse_memo_frame_replay_hits(run: cold) == 0)
-                    && (length(xs: warm_loci) > 0)
-                    && (warm_loci == cold_loci)
-              }
-          }
-      }
+    Present { value: run } => collision_run_holds(run: run)
   }
 }
 
-// THE PARSE MEMO'S DEMAND CASE IS DERIVED BY THE REAL PRODUCER, AND THE DIRECT ARM PRESERVES THE
-// WHOLE PARSE. v2.compiler.parse compute_grammar_first_analysis rules each grammar's
-// (nonterminal, position) demand through std.materialization_ladder once, and every table built
-// from that analysis carries the answer. Two grammars, one per arm the grammar can reach:
-//
-//   abandoned_path_root above: S's Choice abandons a left branch that demands R and X, so X can be
-//   asked again at position 2 -- the ladder discharges the demand to the in-process provider and
-//   the table stores (Memoize).
+// A NESTED NONTERMINAL PARSED TWICE AT ONE POSITION.
 //
-//   S = R X y      R = a a      X = b      tokens: a a b y
-//
-//   no Choice, Optional or Repeat abandons a nonterminal demand and nothing is nullable, so each
-//   (nonterminal, position) is asked at most once -- AcceptedSingleRecompute, and the table does
-//   no memo work (Recompute).
+//   S = X z | (X y) z*      X = W b      W = a      tokens: a b y
 //
-// The direct arm is qualified on the full result, not on acceptance: the same tokens under the
-// same analysis with the store FORCED ON must record zero hits -- the census's claim, checked by
-// execution -- and must return the identical remaining input, tree, diagnostics and provenance
-// state (allocator, span index, frame). If the census missed a recurrence the forced run hits and
-// this reds; if the direct arm changed the parse, the equality reds.
-fn linear_root() -> GrammarRoot {
+// The first alternative parses X -- and W inside it -- then fails at z; the second parses both again
+// at the same position. The second alternative is nested so it does not share a sequence-left atom
+// with the first (SharedPrefix would parse X once). The accepted artifact must carry exactly the
+// surviving path's ids, distinct, each terminal at its own byte.
+fn nested_frame_root() -> GrammarRoot {
   GrammarRoot {
-    start: ^linear_s,
+    start: ^nested_frame_s,
     productions: Cons {
       head: GrammarProduction {
-        name: ^linear_s,
-        expression: Sequence {
-          left: Nonterminal { production: ^linear_r },
+        name: ^nested_frame_s,
+        expression: Choice {
+          left: Sequence {
+            left: Nonterminal { production: ^nested_frame_x },
+            right: abandoned_terminal(token_class: ^nested_tok_z)
+          },
           right: Sequence {
-            left: Nonterminal { production: ^linear_x },
-            right: abandoned_terminal(token_class: ^abandoned_tok_y)
+            left: Sequence {
+              left: Nonterminal { production: ^nested_frame_x },
+              right: abandoned_terminal(token_class: ^nested_tok_y)
+            },
+            right: Repeat { element: abandoned_terminal(token_class: ^nested_tok_z) }
           }
         },
-        emitted: grammar_atom(identity: ^linear_s)
+        emitted: grammar_atom(identity: ^nested_frame_s)
       },
       tail: Cons { head: GrammarProduction {
-        name: ^linear_r,
+        name: ^nested_frame_x,
         expression: Sequence {
-          left: abandoned_terminal(token_class: ^abandoned_tok_a),
-          right: abandoned_terminal(token_class: ^abandoned_tok_a)
+          left: Nonterminal { production: ^nested_frame_w },
+          right: abandoned_terminal(token_class: ^nested_tok_b)
         },
-        emitted: grammar_atom(identity: ^linear_r)
+        emitted: grammar_atom(identity: ^nested_frame_x)
       },
       tail: Cons { head: GrammarProduction {
-        name: ^linear_x,
-        expression: abandoned_terminal(token_class: ^abandoned_tok_b),
-        emitted: grammar_atom(identity: ^linear_x)
+        name: ^nested_frame_w,
+        expression: abandoned_terminal(token_class: ^nested_tok_a),
+        emitted: grammar_atom(identity: ^nested_frame_w)
       },
       tail: std.algebra.Empty } }
     },
@@ -382,164 +411,30 @@ fn linear_root() -> GrammarRoot {
   }
 }
 
-// THE INHABITANCE CLAIM FOR THE DERIVATION, and it runs the PRODUCTION DOOR rather than a
-// reconstruction of it. prepare_grammar is where the admission is made -- it analyzes the grammar,
-// takes the recurrence census off that analysis, and asks parse_table_memo_materialization_for --
-// so reading the materialization off its PreparedModeled arm is reading exactly the value every
-// ParseTable built from this grammar will carry. Supplying a materialization to
-// parse_table_for_production_analyzed here instead would have asserted only that the constructor
-// copies its argument, which is the thing the derivation is not.
-fn derived_memo_materialization(root: GrammarRoot) -> Optional<Materialization> {
-  match prepare_grammar(grammar: ModeledGrammar { root: root }) {
-    Rejected { diagnostics: _ } => optional_absent()
-    Accepted { value: prepared, diagnostics: _ } =>
-      match prepared {
-        PreparedVoidGrammar => optional_absent()
-        PreparedModeled { modeled: _, materialization: m } => optional_present(value: m)
-      }
-  }
+fn nested_frame_tokens() -> List<Token> {
+  Cons { head: abandoned_token(token_class: ^nested_tok_a, offset: 0),
+  tail: Cons { head: abandoned_token(token_class: ^nested_tok_b, offset: 1),
+  tail: Cons { head: abandoned_token(token_class: ^nested_tok_y, offset: 2),
+  tail: std.algebra.Empty } } }
 }
 
-// Through a typed parameter: a bare constructor inside the generic optional_present has no
-// expected type to resolve against, while a declared Materialization parameter supplies one.
-fn derived_memo_materialization_is(root: GrammarRoot, want: Materialization) -> Bool {
-  match derived_memo_materialization(root: root) {
+fn nested_run_holds(run: ParsePathRun) -> Bool {
+  match parse_path_run_loci(run: run) {
     Absent => false
-    Present { value: got } => got == want
+    Present { value: _ } =>
+      parse_path_minted_ids_distinct(run: run)
+        && parse_path_index_is_the_tree(run: run)
+        && parse_path_terminals_are(run: run, want: [
+          expected_terminal_at(token_class: ^nested_tok_a, start: 0),
+          expected_terminal_at(token_class: ^nested_tok_b, start: 1),
+          expected_terminal_at(token_class: ^nested_tok_y, start: 2)
+        ])
   }
 }
 
-// THESE TWO CLAIMS CARRY AN ADMISSION ARM, NOT ONLY A REPLAY ONE, and that is a load the module
-// name does not advertise. Between them they are the only controls that drive the REAL
-// prepare_grammar across both admitted outcomes: Memoize here, from a census that counts a
-// discarding backtrack site, and Recompute below, from a census that counts nothing. The
-// direct-computation half is also asserted by
-// v2.test.claim.compiler_materialization_witness.materialization_control_prepare_is_admitted,
-// but nothing over there reaches a store-permitting admission through the production door -- so
-// if these are retargeted or rewritten for replay reasons, that coverage leaves with them and
-// every remaining control stays green. Keep an admitted-Memoize route through prepare_grammar
-// somewhere, or move it deliberately and say where it went.
-test fn parse_memo_demand_derived_discharged_when_the_grammar_abandons_a_demand() -> Bool {
-  derived_memo_materialization_is(root: abandoned_path_root(), want: Memoize)
-}
-
-test fn parse_memo_demand_derived_single_when_the_grammar_cannot_recur() -> Bool {
-  derived_memo_materialization_is(root: linear_root(), want: Recompute)
-}
-
-type ParseFullRun {
-  remaining: List<Token>
-  captured: Node
-  diagnostics: List<Diagnostic>
-  prov: ParseProvenanceState
-  hits: Int
-}
-
-// THE UNFORCED RUN IS THE DERIVED ONE, so the base table's materialization comes from the real
-// door asked about THIS grammar's census -- not from a literal, which would make the equality
-// claim compare two runs the derivation never chose.
-//
-// A REFUSAL FAILS THE CLAIM RATHER THAN SUBSTITUTING FOR IT. Standing in Recompute on the
-// Rejected arm would be the very move this package exists to remove, one layer down: a refusal
-// replaced by a valid operational value so the caller can proceed. The objection is not about
-// the store -- Recompute does turn it off and the comparison would still run -- it is about this
-// claim's PREMISE. A refused admission means the derived side of the pair does not exist, so the
-// claim would go green having evaluated a state it was never written to evaluate, with nothing
-// saying so. Refusal is owned elsewhere for COVERAGE (refused_scope_is_not_admitted, and the
-// consumer-boundary control over prepare_grammar); it is not owned elsewhere for this claim's
-// honesty. optional_absent() reaches the claim's own Absent arm, which is false.
-fn linear_run(forced: Optional<Materialization>) -> Optional<ParseFullRun> {
-  let contract_locus = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^abandoned_path_grammar_contract)
-  match grammar_validate_for_parse(root: linear_root(), at: contract_locus) {
-    Rejected { diagnostics: _ } => optional_absent()
-    Accepted { value: validated, diagnostics: _ } =>
-      let tokens = abandoned_path_tokens()
-      let root = validated.root
-      let analysis = compute_grammar_first_analysis(root: root)
-      match parse_table_memo_materialization_for(r: analysis.memo_recurrence) {
-        Rejected { diagnostics: _ } => optional_absent()
-        Accepted { value: derived, diagnostics: _ } =>
-      let base = parse_table_for_production_analyzed(
-        validated: validated,
-        analysis: analysis,
-        all_tokens: tokens,
-        materialization: derived
-      )
-      let table = ParseTableRealization {
-        artifact_kind: base.artifact_kind,
-        provider_id: base.provider_id,
-        materialization: match forced {
-          Absent => base.materialization
-          Present { value: m } => m
-        },
-        grammar_digest: base.grammar_digest,
-        token_stream_digest: base.token_stream_digest,
-        entries: base.entries,
-        memo_hits: base.memo_hits,
-        memo_misses: base.memo_misses,
-        memo_lookup_calls: base.memo_lookup_calls,
-        furthest: base.furthest,
-        nullable_set: base.nullable_set,
-        first_rows: base.first_rows,
-        productions_by_name: base.productions_by_name,
-        prepared_exprs: base.prepared_exprs,
-        layout: base.layout,
-        refusal: base.refusal
-      }
-      match grammar_lookup_production(root: root, name: root.start) {
-        Violates { diagnostic: _ } => optional_absent()
-        Holds { value: production } =>
-          match parse_expr(
-            expr: production.expression,
-            tokens: tokens,
-            all_tokens: tokens,
-            root: root,
-            table: table,
-            prov: parse_prov_initial()
-          ) {
-            ParseExprRejected { diagnostics: _, table: _ } => optional_absent()
-            ParseExprAccepted { remaining: remaining, captured: captured, diagnostics: diags, prov: prov, table: final_table } =>
-              optional_present(value: ParseFullRun {
-                remaining: remaining,
-                captured: captured,
-                diagnostics: diags,
-                prov: prov,
-                hits: final_table.memo_hits
-              })
-          }
-      }
-      }
-  }
-}
-
-fn linear_run_forced(m: Materialization) -> Optional<ParseFullRun> {
-  linear_run(forced: optional_present(value: m))
-}
-
-fn linear_run_forced_memoize() -> Optional<ParseFullRun> {
-  linear_run_forced(m: Memoize)
-}
-
-fn parse_full_run_same_parse(a: ParseFullRun, b: ParseFullRun) -> Bool {
-  (a.remaining == b.remaining)
-    && (a.captured == b.captured)
-    && (a.diagnostics == b.diagnostics)
-    && (a.prov == b.prov)
-}
-
-fn parse_full_run_hits(run: ParseFullRun) -> Int {
-  run.hits
-}
-
-test fn parse_memo_direct_arm_preserves_the_whole_parse() -> Bool {
-  match linear_run(forced: optional_absent()) {
+test fn nested_reparse_carries_only_surviving_path_provenance() -> Bool {
+  match parse_path_run_through_door(root: nested_frame_root(), tokens: nested_frame_tokens()) {
     Absent => false
-    Present { value: direct } =>
-      match linear_run_forced_memoize() {
-        Absent => false
-        Present { value: stored } =>
-          (parse_full_run_hits(run: stored) == 0)
-            && parse_full_run_same_parse(a: direct, b: stored)
-      }
+    Present { value: run } => nested_run_holds(run: run)
   }
 }
diff --git a/src/v2/test/claim/reference_derived_graph_fixture.dag b/src/v2/test/claim/reference_derived_graph_fixture.dag
index 615c572a8b9..c79444248e0 100644
--- a/src/v2/test/claim/reference_derived_graph_fixture.dag
+++ b/src/v2/test/claim/reference_derived_graph_fixture.dag
@@ -8,7 +8,8 @@ import v2.compiler.normalized_tree { no_resource_declarations }
 import v2.compiler.normalize { record_declaration_capture }
 import v2.compiler.parse { parse_module }
 import v2.compiler.source_authority { DagSourceReadWitness, SourceRootIngest }
-import v2.compiler.tokenize { tokenize }
+import v2.compiler.program_assembly { dag_prepared_lex }
+import v2.compiler.tokenize { tokenize_prepared }
 import v2.extdeps.languages.dag { dag_language_model }
 import v2.lens.module_graph {
   LocatedModuleRoot,
@@ -118,7 +119,7 @@ fn fixture_ingest() -> SourceRootIngest {
 fn parse_one(w: DagSourceReadWitness) -> Outcome<LocatedModuleRoot> {
   let lm = dag_language_model()
   bind_outcome(
-    o: tokenize(text: w.source.carried, file: w.compilation_unit, rules: lm.lex),
+    o: tokenize_prepared(text: w.source.carried, file: w.compilation_unit, prepared: dag_prepared_lex()),
     f: fn(token_stream) {
       bind_outcome(
         o: parse_module(tokens: token_stream, grammar: lm.grammar),
diff --git a/src/v2/test/claim/reference_derived_residency_reading_test.dag b/src/v2/test/claim/reference_derived_residency_reading_test.dag
index 206bdda0a43..2a10574d00f 100644
--- a/src/v2/test/claim/reference_derived_residency_reading_test.dag
+++ b/src/v2/test/claim/reference_derived_residency_reading_test.dag
@@ -34,7 +34,13 @@ import v2.lens.reference_derived_residency_reading { carrier_reading_from_type_d
 import v2.std.diagnostic { Accepted, Rejected }
 import std.optional { Absent, Present }
 import v2.std.qualified_name { qualified_name_snoc }
-import v2.extdeps.languages.dag { qualified_name_from_module_node }
+import v2.extdeps.languages.dag {
+  qualified_name_from_module_node,
+  dag_named_edge,
+  dag_surface_edge,
+  dag_surface_identity_is_module_member,
+  dag_surface_identity_is_top_level_item,
+}
 import v2.std.symbol_index { empty_symbol_index, symbol_index_lookup }
 import v2.test.claim.reference_derived_graph_fixture { xl4_fixture_trees, xl4_item_at, consumer_field_bare_local_path }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
@@ -238,6 +244,105 @@ test fn an_alias_typed_field_is_not_readable() -> Bool {
   !readability_is_recognised(r: reading_of(decl_name: "ReferenceDerivedPool", decl: alias_typed_declaration()))
 }
 
+fn identity_stamped(id: Symbol) -> Node {
+  Node {
+    kind: TypeNode { connective: Conj },
+    children: [dag_named_edge(name: ^grammar_production_identity_node_projection, target: atom(identity: id))],
+    occurrence_id: OccurrenceSynthetic,
+  }
+}
+
+fn module_container_with_surface_members() -> Node {
+  Node {
+    kind: TypeNode { connective: Conj },
+    children: [
+      dag_surface_edge(edge: ^dag_surface_module_header, target: atom(identity: ^dag_surface_module_header)),
+      Edge { label: Authored { name: ^bit }, target: identity_stamped(id: ^dag_surface_fn_decl) },
+      Edge { label: Authored { name: ^nested }, target: identity_stamped(id: ^dag_surface_module) },
+      Edge { label: Authored { name: ^probe }, target: identity_stamped(id: ^dag_surface_test_fn_decl) },
+      Edge { label: Authored { name: ^Flag }, target: identity_stamped(id: ^dag_surface_data_decl) },
+      Edge { label: Authored { name: ^Wrapper }, target: identity_stamped(id: ^dag_surface_type_decl) },
+      Edge { label: Authored { name: ^Alias }, target: identity_stamped(id: ^dag_surface_alias_decl) },
+    ],
+    occurrence_id: OccurrenceSynthetic,
+  }
+}
+
+fn mixed_declaration_and_hand_built_field() -> Node {
+  Node {
+    kind: TypeNode { connective: Conj },
+    children: [
+      Edge { label: Authored { name: ^Flag }, target: identity_stamped(id: ^dag_surface_data_decl) },
+      Edge { label: Authored { name: ^trees }, target: atom(identity: ^Node) },
+    ],
+    occurrence_id: OccurrenceSynthetic,
+  }
+}
+
+fn conj_with_header_edge_and_hand_built_field() -> Node {
+  Node {
+    kind: TypeNode { connective: Conj },
+    children: [
+      dag_surface_edge(edge: ^dag_surface_module_header, target: atom(identity: ^dag_surface_module_header)),
+      Edge { label: Authored { name: ^trees }, target: atom(identity: ^Node) },
+    ],
+    occurrence_id: OccurrenceSynthetic,
+  }
+}
+
+fn hand_built_record_field_declaration() -> Node {
+  record_of(fields: [Edge { label: Authored { name: ^trees }, target: atom(identity: ^Node) }])
+}
+
+fn readability_is_member_not_a_binder(r: ProducerCarrierReading, expected: Symbol) -> Bool {
+  match r.readability {
+    CarrierMemberNotABinder { member: member } => member == expected
+    CarrierTypeRecognized => false
+    CarrierTypeUnrecognized { spelling: _ } => false
+  }
+}
+
+// A MODULE CONTAINER IS NOT A RECORD PAYLOAD. Its Authored members are dag_surface_module nodes and
+// declarations; asking member_edge_type_node of them used to mint CarrierMemberNotABinder.
+test fn a_module_container_is_not_read_as_a_non_binder_record() -> Bool {
+  readability_is_recognised(r: reading_of(decl_name: "ModuleContainer", decl: module_container_with_surface_members()))
+}
+
+// THE RED THE SKIP MUST NOT ERASE: a hand-built name-to-type field on a genuine record still reports
+// CarrierMemberNotABinder, named.
+test fn a_hand_built_record_field_still_reports_member_not_a_binder() -> Bool {
+  readability_is_member_not_a_binder(
+    r: reading_of(decl_name: "HandBuiltCarrier", decl: hand_built_record_field_declaration()),
+    expected: ^trees,
+  )
+}
+
+// A HEADER EDGE ON THE CONJ IS NOT A CONTAINER-WIDE SKIP. The member that is not identity-stamped
+// is still CarrierMemberNotABinder; skipping the whole Conj because it carries a header is the
+// widen the door-lens ruling forbids.
+test fn a_header_edge_on_a_conj_does_not_skip_a_hand_built_field() -> Bool {
+  readability_is_member_not_a_binder(
+    r: reading_of(decl_name: "HeaderAndField", decl: conj_with_header_edge_and_hand_built_field()),
+    expected: ^trees,
+  )
+}
+
+test fn top_level_item_identities_come_from_the_grammar_rows() -> Bool {
+  dag_surface_identity_is_top_level_item(id: ^dag_surface_data_decl)
+    && dag_surface_identity_is_top_level_item(id: ^dag_surface_import_decl)
+    && !dag_surface_identity_is_top_level_item(id: ^dag_surface_module)
+    && dag_surface_identity_is_module_member(id: ^dag_surface_module)
+}
+
+// A DATA DECLARATION SIBLING DOES NOT WIDEN THE SKIP. The identity-stamped member is skipped;
+// the hand-built field on the same Conj is still CarrierMemberNotABinder.
+test fn a_data_decl_member_does_not_skip_a_hand_built_sibling() -> Bool {
+  readability_is_member_not_a_binder(
+    r: reading_of(decl_name: "Mixed", decl: mixed_declaration_and_hand_built_field()),
+    expected: ^trees,
+  )
+}
+
 // THE BLOCKING ARM. Under the earlier derivation this qualified -- both axes fell through to their
 // admitting values -- so a producer could buy the admission by renaming a type while the same corpus
 // stayed resident (review 68724). It must refuse, and it must refuse NAMING the carrier and the
diff --git a/src/v2/test/claim/reference_evidence/declaration_reference_evidence_test.dag b/src/v2/test/claim/reference_evidence/declaration_reference_evidence_test.dag
index 3841a9065f5..fd5463354f6 100644
--- a/src/v2/test/claim/reference_evidence/declaration_reference_evidence_test.dag
+++ b/src/v2/test/claim/reference_evidence/declaration_reference_evidence_test.dag
@@ -1,5 +1,6 @@
 module v2.test.claim.reference_evidence.declaration_reference_evidence
 
+import v2.std.member_declaration_kind { no_member_declaration_kinds }
 import v2.compiler.resolve { ResolvedTree }
 import v2.std.symbol_index { symbol_index_lookup }
 import v2.compiler.infer { infer, inferred_facts_grounding_derived, infer_type_equal_ignoring_provenance }
@@ -333,7 +334,8 @@ fn dre_same_leaf_resolved() -> ResolvedTree {
     symbol_index: call.symbol_index,
     resolved_declarations: symbol_index_insert(index: call.resolved_declarations, qualified_path: [^p, ^Wrap], resolved: dre_same_leaf_wrap_declaration()),
     lexical_bindings: call.lexical_bindings,
-    unavailable_providers: call.unavailable_providers
+    unavailable_providers: call.unavailable_providers,
+    member_kinds: no_member_declaration_kinds()
   }
 }
 
diff --git a/src/v2/test/claim/resolve/fold_handler_binder_resolve_test.dag b/src/v2/test/claim/resolve/fold_handler_binder_resolve_test.dag
new file mode 100644
index 00000000000..2501c1214d9
--- /dev/null
+++ b/src/v2/test/claim/resolve/fold_handler_binder_resolve_test.dag
@@ -0,0 +1,175 @@
+module v2.test.claim.resolve.fold_handler_binder_resolve
+
+import v2.compiler.compile {
+  NativeCensusModule,
+  NativeCensusModuleFileRefused,
+  NativeCensusModuleOutcome,
+  NativeCensusModuleResolveRefused,
+  NativeCensusModuleResolved,
+  NativeTestContext,
+  native_census_module_resolution,
+  native_census_modules,
+  native_lane_file_refusal_index,
+  native_test_context_from_ingest
+}
+import v2.compiler.source_authority { DagSourceReadWitness, SourceRootIngest }
+import v2.std.artifact { Artifact, SourceFile }
+import v2.std.cross_tree.import_model { DagTree }
+import v2.std.diagnostic { Accepted, NodeLocus, Rejected }
+import v2.std.grammar { node_atom_identity_optional }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import v2.std.node { Symbol }
+import std.optional { Absent, Optional, Present, optional_absent }
+import v2.std.text { String }
+import std.algebra { Cons, Empty }
+import extdeps.communication.medium { Lossless, Medium }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// A FOLD HANDLER'S PARAMETERS BIND AT NATIVE RESOLVE, THE SAME WAY AN ORDINARY LAMBDA'S DO.
+//
+// THE SUBJECT IS v2.compiler.resolve on the native ingest route (native_test_context_from_ingest,
+// then native_census_module_resolution). gunbc.recurring_failure_mode
+// fold_cons_handler_binder_unbound_on_the_native_resolver recorded a 2026-10-02 native prepare
+// refusal at `candidate.path` in a cons handler; the exact prepare-refusal cause is unestablished.
+// These claims are today's inhabitance at that boundary, not a replay of that revision.
+//
+// THREE MODULES, ONE VARIABLE EACH. `fold` is the specimen: the item binder is used in the handler
+// body. `lambda` is the already-binding control: the same two-parameter fn literal as a call
+// argument, not a fold step. `undeclared` keeps an unbound name in a fold handler as the sole
+// refusal at its atom, so the repair did not start accepting names the handler does not bind.
+//
+// The census walk over those three modules is unrolled, not a fold_list: a fold in THIS file would
+// make the claim module itself the class's subject (the vfb_specimen residual). The subject is the
+// ingest strings.
+
+data fhb_fold_source: String = "module v2.test.fhb_fold\n\ntype Item { path: Bool }\n\nfn fhb_probe(xs: Item) -> Bool {\n  fold(xs, false, fn(acc, candidate) { acc || candidate.path })\n}\n"
+
+data fhb_lambda_source: String = "module v2.test.fhb_lambda\n\ntype Item { path: Bool }\n\nfn fhb_apply(f: Bool, v: Bool) -> Bool { v }\n\nfn fhb_probe(p: Item) -> Bool { fhb_apply(f: fn(acc, candidate) { acc || candidate.path }, v: true) }\n"
+
+data fhb_undeclared_source: String = "module v2.test.fhb_undeclared\n\ntype Item { path: Bool }\n\nfn fhb_probe(xs: Item) -> Bool {\n  fold(xs, false, fn(acc, candidate) { acc || fhb_undeclared_item })\n}\n"
+
+fn fhb_read(source: String, id: Symbol, unit: Symbol, path: String) -> DagSourceReadWitness {
+  DagSourceReadWitness {
+    source: Medium { carried: source, fidelity: Lossless },
+    artifact: Artifact { kind: SourceFile, id: id, file_path: path },
+    compilation_unit: unit,
+    source_root: DagTree
+  }
+}
+
+data fhb_ingest: SourceRootIngest = Cons {
+    head: fhb_read(source: fhb_fold_source, id: ^fhb_fold_artifact, unit: ^fhb_fold_cu, path: "src/v2/test/fixture/resolve/fhb_fold.dag"),
+    tail: Cons {
+    head: fhb_read(source: fhb_lambda_source, id: ^fhb_lambda_artifact, unit: ^fhb_lambda_cu, path: "src/v2/test/fixture/resolve/fhb_lambda.dag"),
+    tail: Cons {
+    head: fhb_read(source: fhb_undeclared_source, id: ^fhb_undeclared_artifact, unit: ^fhb_undeclared_cu, path: "src/v2/test/fixture/resolve/fhb_undeclared.dag"),
+    tail: Empty
+  }
+  }
+  }
+
+type FhbVerdict
+  = FhbResolved
+  | FhbRefused { reason: Symbol, at_atom: Optional<Symbol>, sole_chain: Bool }
+  | FhbFileRefused
+  | FhbAbsent
+
+type FhbOutcomes
+  = FhbContextRefused
+  | FhbOutcomesDecided { fold: FhbVerdict, lambda: FhbVerdict, undeclared: FhbVerdict }
+
+fn fhb_verdict_of(outcome: NativeCensusModuleOutcome) -> FhbVerdict {
+  match outcome {
+    NativeCensusModuleResolved => FhbResolved
+    NativeCensusModuleFileRefused => FhbFileRefused
+    NativeCensusModuleResolveRefused { first: d, rest: rest, observation: _ } =>
+      FhbRefused {
+        reason: d.head.reason,
+        at_atom: match d.head.at {
+          NodeLocus { anchor: a } => node_atom_identity_optional(node: a.at)
+          _ => optional_absent()
+        },
+        sole_chain: match rest {
+          Empty => true
+          Cons { head: _, tail: _ } => false
+        }
+      }
+  }
+}
+
+fn fhb_entry_verdict(context: NativeTestContext, entry: NativeCensusModule) -> FhbVerdict {
+  fhb_verdict_of(
+    outcome: native_census_module_resolution(
+      context: context,
+      refusal_index: native_lane_file_refusal_index(refusals: context.file_refusals),
+      entry: entry
+    ).outcome
+  )
+}
+
+fn fhb_if_name(entry: NativeCensusModule, verdict: FhbVerdict, module_name: String, acc: FhbVerdict) -> FhbVerdict {
+  if entry.module == module_name { verdict } else { acc }
+}
+
+fn fhb_outcomes() -> FhbOutcomes {
+  match native_test_context_from_ingest(ingest: fhb_ingest) {
+    Rejected { diagnostics: _ } => FhbContextRefused
+    Accepted { value: context, diagnostics: _ } =>
+      match native_census_modules(ingest: fhb_ingest) {
+        Cons { head: a, tail: Cons { head: b, tail: Cons { head: c, tail: _ } } } =>
+          let va = fhb_entry_verdict(context: context, entry: a)
+          let vb = fhb_entry_verdict(context: context, entry: b)
+          let vc = fhb_entry_verdict(context: context, entry: c)
+          FhbOutcomesDecided {
+            fold: fhb_if_name(entry: c, verdict: vc, module_name: "v2.test.fhb_fold", acc: fhb_if_name(entry: b, verdict: vb, module_name: "v2.test.fhb_fold", acc: fhb_if_name(entry: a, verdict: va, module_name: "v2.test.fhb_fold", acc: FhbAbsent))),
+            lambda: fhb_if_name(entry: c, verdict: vc, module_name: "v2.test.fhb_lambda", acc: fhb_if_name(entry: b, verdict: vb, module_name: "v2.test.fhb_lambda", acc: fhb_if_name(entry: a, verdict: va, module_name: "v2.test.fhb_lambda", acc: FhbAbsent))),
+            undeclared: fhb_if_name(entry: c, verdict: vc, module_name: "v2.test.fhb_undeclared", acc: fhb_if_name(entry: b, verdict: vb, module_name: "v2.test.fhb_undeclared", acc: fhb_if_name(entry: a, verdict: va, module_name: "v2.test.fhb_undeclared", acc: FhbAbsent)))
+          }
+        _ => FhbOutcomesDecided { fold: FhbAbsent, lambda: FhbAbsent, undeclared: FhbAbsent }
+      }
+  }
+}
+
+fn fhb_is_resolved(v: FhbVerdict) -> Bool {
+  match v {
+    FhbResolved => true
+    _ => false
+  }
+}
+
+fn fhb_undeclared_is_sole_unbound_at_its_atom(v: FhbVerdict) -> Bool {
+  match v {
+    FhbRefused { reason: r, at_atom: Present { value: id }, sole_chain: sole } =>
+      (r == ^resolve_reason_unbound_symbol) && (id == ^fhb_undeclared_item) && sole
+    _ => false
+  }
+}
+
+// ONE FRONT END FOR EVERY CLAIM. Native ingest of even three tiny modules is ~1.1M eval steps,
+// over the new-witness enrolment margin (~72k). A single `test fn` therefore blocks the floor
+// (enrolment_measured_over_margin on fold_handler_binders_resolve_on_native_ingest, required-ci
+// run 37776210394). Three planned claims reaching this nullary producer admit it to
+// v2.workflow.floor_pure_producer_share: the fill is netted from the first claim and later claims
+// are served. Local `--function` of one name still pays ingest in that process.
+test fn a_fold_handler_item_binder_resolves() -> Bool {
+  match fhb_outcomes() {
+    FhbOutcomesDecided { fold: v, lambda: _, undeclared: _ } => fhb_is_resolved(v: v)
+    FhbContextRefused => false
+  }
+}
+
+test fn a_non_fold_lambda_argument_still_resolves() -> Bool {
+  match fhb_outcomes() {
+    FhbOutcomesDecided { fold: _, lambda: v, undeclared: _ } => fhb_is_resolved(v: v)
+    FhbContextRefused => false
+  }
+}
+
+test fn an_undeclared_name_in_a_fold_handler_is_the_sole_refusal_at_its_atom() -> Bool {
+  match fhb_outcomes() {
+    FhbOutcomesDecided { fold: _, lambda: _, undeclared: v } =>
+      fhb_undeclared_is_sole_unbound_at_its_atom(v: v)
+    FhbContextRefused => false
+  }
+}
diff --git a/src/v2/test/claim/rust_crate_partition_witness_test.dag b/src/v2/test/claim/rust_crate_partition_witness_test.dag
index 85c4164ee97..62f374dc0f3 100644
--- a/src/v2/test/claim/rust_crate_partition_witness_test.dag
+++ b/src/v2/test/claim/rust_crate_partition_witness_test.dag
@@ -1,34 +1,41 @@
 module v2.test.claim.rust_crate_partition_witness
 
-import std.decl_ref { DeclarationRef, WholeDeclaration }
-import std.perturbation { ForwardSameInSameOut, perturbation_consistent }
-import std.types { NonEmptyStr }
-import v2.std.collection { Absent, Present, empty_map, map_get, map_insert }
-import v2.std.diagnostic { Accepted, Rejected }
-import v2.std.compilers.compilation_unit {
+import gunbc.crate_partition {
+  crate_partition_declared_core_target,
+  AssignmentNamesModuleOutsideDag,
+  AssignmentOmitsModule,
+  ByValueTypeCycle,
   CompilationUnitId,
+  EmittedEdgeEndpointOutsideDag,
+  EmitterReverseEdge,
+  ExplicitPartition,
+  ExplicitPartitionParam,
   HandExplicit,
-  ModuleDag,
+  LinkageCycle,
   ModuleDagEdge,
   ModuleId,
-  PolicyDerived,
-  ByValueTypeCycle,
+  PartitionEmittedEdgeRefused,
   PartitionInputRejected,
-  LinkageCycle,
+  PartitionParameter,
+  PartitionPolicy,
+  PartitionRustAdmissibilityRefused,
+  PolicyDerived,
+  PolicyPartitionParam,
+  PolicyTargetCountNotPositive,
+  ResolvePartitionOk,
+  ResolvePartitionOutcome,
+  ResolvePartitionRefused,
   SccSplit,
+  Stage0LayeredCoreCrate,
+  Stage0PartitionCrateRow,
+  UnitDepEdge,
   UnitGraphCycle,
-  partition_provenance_eq,
   partition_provenance_hand_explicit,
   partition_provenance_policy_derived,
-  partition_unit_by_id
+  stage0_module_id
 }
-import gunbc.rust_emitted_edge {
-  EmittedEdge,
-  EmittedModuleTarget,
-  RuntimePrelude,
-  rust_runtime_prelude_module
-}
-import v2.workflow.rust_crate_partition {
+
+import gunbc.crate_partition {
   AssignmentNamesModuleOutsideDag,
   AssignmentOmitsModule,
   ExplicitPartition,
@@ -42,8 +49,40 @@ import v2.workflow.rust_crate_partition {
   ResolvePartitionOutcome,
   ResolvePartitionRefused,
   ResolvePartitionOk,
+  EmitterReverseEdge,
+  EmittedEdgeEndpointOutsideDag,
+  Stage0PartitionCrateRow,
+  Stage0LayeredCoreCrate,
+  UnitDepEdge,
+  stage0_module_id,
+  CompilationUnitId,
+  HandExplicit,
+  ModuleDagEdge,
+  ModuleId,
+  PolicyDerived,
+  ByValueTypeCycle,
+  PartitionInputRejected,
+  LinkageCycle,
+  SccSplit,
+  UnitGraphCycle,
+  partition_provenance_hand_explicit,
+  partition_provenance_policy_derived
+}
+
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import std.perturbation { ForwardSameInSameOut, perturbation_consistent }
+import std.types { NonEmptyStr }
+import v2.std.collection { Absent, Present, empty_map, map_get_checked, map_insert }
+import v2.std.diagnostic { Accepted, Rejected }
+import v2.std.compilers.compilation_unit { ModuleDag, partition_provenance_eq, partition_unit_by_id }
+import gunbc.rust_emitted_edge {
+  EmittedEdge,
+  EmittedModuleTarget,
+  RuntimePrelude,
+  rust_runtime_prelude_module
+}
+import v2.workflow.rust_crate_partition {
   resolve_partition_outcome,
-  rust_crate_partition_declared_core_target,
   rust_crate_partition_module_bearing_unit_target,
   stage0_interim_explicit_assignment,
   stage0_source_module_dag,
@@ -56,11 +95,6 @@ import v2.workflow.rust_crate_partition {
   ModuleDagEmittedMerge,
   ModuleDagEmittedMerged,
   ModuleDagEmittedRefused,
-  EmitterReverseEdge,
-  EmittedEdgeEndpointOutsideDag,
-  Stage0PartitionCrateRow,
-  Stage0LayeredCoreCrate,
-  UnitDepEdge,
   ReexportDisagreementScanOk,
   ReexportDisagreementScanUnitHasNoRow,
   Stage0ReexportDisagreementsDerived,
@@ -76,7 +110,6 @@ import v2.workflow.rust_crate_partition {
   stage0_module_dag_interface_grounding_is_debt,
   stage0_module_interface_grounding_target,
   stage0_module_bearing_unit_count,
-  stage0_module_id,
   stage0_v1_infer_modules,
   stage0_partition_fold_ok,
   stage0_partition_member_coverage_consistent,
@@ -244,7 +277,7 @@ fn witness_policy_two() -> PartitionParameter {
 }
 
 fn witness_owner(assignment: Map<ModuleId, CompilationUnitId>, module_id: ModuleId) -> String {
-  match map_get(assignment, module_id) {
+  match map_get_checked(assignment, module_id) {
     Accepted { value: Present { value: unit }, diagnostics: _ } => unit as String
     Accepted { value: Absent, diagnostics: _ } => "unowned"
     Rejected { diagnostics: _ } => "unowned"
@@ -258,7 +291,7 @@ fn witness_owner(assignment: Map<ModuleId, CompilationUnitId>, module_id: Module
 test fn policy_partition_admits_a_balanced_acyclic_assignment() -> Bool {
   match resolve_partition_outcome(parameter: witness_policy_two(), module_dag: witness_chain_dag(edges: witness_chain_edges())) {
     ResolvePartitionOk { assignment: assignment, provenance: PolicyDerived { policy: policy } } =>
-      (policy.decl_name as String) == "policy_partition_assignment"
+      (policy.module_path as String) == "gunbc.crate_partition" && (policy.decl_name as String) == "policy_partition_assignment_over"
         && witness_owner(assignment: assignment, module_id: witness_chain_a) == "policy-unit-0"
         && witness_owner(assignment: assignment, module_id: witness_chain_b) == "policy-unit-0"
         && witness_owner(assignment: assignment, module_id: witness_chain_c) == "policy-unit-0"
@@ -296,7 +329,7 @@ test fn witness_partition_perturbation_member_coverage_holds() -> Bool {
 }
 
 test fn witness_interim_physical_crate_count_holds() -> Bool {
-  stage0_physical_crate_count() == rust_crate_partition_declared_core_target
+  stage0_physical_crate_count() == crate_partition_declared_core_target
 }
 
 test fn witness_interim_module_bearing_unit_count_holds() -> Bool {
diff --git a/src/v2/test/claim/self_host/closure_emission_test.dag b/src/v2/test/claim/self_host/closure_emission_test.dag
index ab2e11ec364..680297c21f1 100644
--- a/src/v2/test/claim/self_host/closure_emission_test.dag
+++ b/src/v2/test/claim/self_host/closure_emission_test.dag
@@ -30,6 +30,7 @@ import v2.std.algebra { contains, fold_list, length }
 import v2.std.artifact { Artifact, SourceFile }
 import v2.std.cross_tree.import_model { DagTree }
 import v2.std.diagnostic { Accepted, Rejected, diagnostics_fatal_reason }
+import v2.std.lens_verdict { lens_verdict_diagnostics_located_chain_text_in_spans }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.node { Node, Symbol, node_synthetic }
 import v2.std.qualified_name { QualifiedName, qualified_name_from_dotted_string, qualified_name_to_dotted_string }
@@ -322,9 +323,19 @@ test fn the_emission_renders_through_its_codec_and_reads_back_the_same_identitie
 // A MODULE IDENTITY DECLARED BY TWO FILES REFUSES THE EMISSION AT THE CENSUS, even when the two
 // files' declarations are independent and neither is a closure member.
 test fn two_files_declaring_one_module_refuse_the_emission_at_the_census_holds() -> Bool {
-  match ce_emission_duplicate_module().outcome {
+  let located = ce_emission_duplicate_module()
+  match located.outcome {
     Accepted { value: _, diagnostics: _ } => false
-    Rejected { diagnostics: d } => diagnostics_fatal_reason(d: d) == ^closure_census_duplicate_module
+    Rejected { diagnostics: d } =>
+      diagnostics_fatal_reason(d: d) == ^closure_census_duplicate_module
+        && string_contains(
+          s: lens_verdict_diagnostics_located_chain_text_in_spans(d: d, index: located.spans),
+          pattern: "ce_duplicate_a_read"
+        )
+        && string_contains(
+          s: lens_verdict_diagnostics_located_chain_text_in_spans(d: d, index: located.spans),
+          pattern: "ce_duplicate_b_read"
+        )
   }
 }
 
diff --git a/src/v2/test/claim/self_host/direct_rust_door_group_algebra_test.dag b/src/v2/test/claim/self_host/direct_rust_door_group_algebra_test.dag
index 288c55511fc..3ce02609d86 100644
--- a/src/v2/test/claim/self_host/direct_rust_door_group_algebra_test.dag
+++ b/src/v2/test/claim/self_host/direct_rust_door_group_algebra_test.dag
@@ -541,8 +541,8 @@ test fn behavioral_advance_still_reachable_with_a_bound_probe() -> Bool {
 fn residue_headed_diag(fatal: Symbol) -> NonEmptyDiagnostics {
   NonEmptyDiagnostics {
     head: Diagnostic {
-      reason: ^parse_grammar_choice_overlap_residue,
-      at: invariant_port_locus(port: ^direct_rust_door_group_algebra, invariant: ^parse_grammar_choice_overlap_residue),
+      reason: ^tokenize_lex_e1_unrecognized_char,
+      at: invariant_port_locus(port: ^direct_rust_door_group_algebra, invariant: ^tokenize_lex_e1_unrecognized_char),
       correction: Unavailable { reason: ExternalContractUnknown }
     },
     tail: [
@@ -555,9 +555,9 @@ fn residue_headed_diag(fatal: Symbol) -> NonEmptyDiagnostics {
   }
 }
 
-// THE PROGRAM'S RED CONTROL AT THE DIRECT-RUST DOOR. Two assembly refusals share the overlap
-// residue as their head and differ in their fatal cause; the observation must name each fatal.
-// Reading the head named the residue for both.
+// THE PROGRAM'S RED CONTROL AT THE DIRECT-RUST DOOR. Two assembly refusals share a non-fatal
+// advisory as their head and differ in their fatal cause; the observation must name each fatal.
+// Reading the head named the advisory for both.
 test fn a_shared_residue_head_yields_each_assembly_refusals_own_fatal_holds() -> Bool {
   let a = project_direct_rust_door_observation(group: group_of(emission: AssemblyRejected { diagnostics: residue_headed_diag(fatal: ^normalize_rejected) }))
   let b = project_direct_rust_door_observation(group: group_of(emission: AssemblyRejected { diagnostics: residue_headed_diag(fatal: ^resolve_reason_unbound_symbol) }))
diff --git a/src/v2/test/claim/self_host/frontier_probe_assemble_detail_test.dag b/src/v2/test/claim/self_host/frontier_probe_assemble_detail_test.dag
new file mode 100644
index 00000000000..cfc9c371b5f
--- /dev/null
+++ b/src/v2/test/claim/self_host/frontier_probe_assemble_detail_test.dag
@@ -0,0 +1,68 @@
+module v2.test.self_host.frontier_probe_assemble_detail
+
+import v2.std.diagnostic {
+  Diagnostic,
+  ExternalContractUnknown,
+  NonEmptyDiagnostics,
+  Unavailable,
+  invariant_port_locus
+}
+import v2.compiler.self_host.frontier_probe_assemble_detail {
+  frontier_probe_receipt_from_assemble_rejection
+}
+import v2.compiler.self_host.frontier_probe_types {
+  AssembleRejectionDetail,
+  FrontierProbeDetailAbsent,
+  NoFrontierProbeDetail,
+  MissingModuleIdentityUnavailable,
+  ProbeStageEmit,
+  frontier_probe_receipt_without_assemble_detail,
+  RealizationGap
+}
+import v2.std.algebra { Cons, Empty, length }
+import v2.std.node { Symbol }
+
+fn assemble_detail_test_diagnostic(reason: Symbol) -> Diagnostic {
+  Diagnostic {
+    reason: reason,
+    at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: reason),
+    correction: Unavailable { reason: ExternalContractUnknown }
+  }
+}
+
+test fn emit_stage_receipt_has_no_assemble_detail() -> Bool {
+  match frontier_probe_receipt_without_assemble_detail(
+    module_path: "src/v2/compiler/example.dag",
+    blocker: RealizationGap,
+    located_stage: ProbeStageEmit,
+    located_reason: ^probe_emit_accept_self_host_bar_unbound,
+    detail: FrontierProbeDetailAbsent
+  ).assemble_detail {
+    NoFrontierProbeDetail => true
+    _ => false
+  }
+}
+
+// The receipt's located reason and its cause come from the rejection's FATAL (last) diagnostic, and
+// the chain keeps the whole list in order: a two-diagnostic rejection reads as head then tail.
+test fn assemble_receipt_carries_the_whole_rejection_chain_and_its_fatal_cause() -> Bool {
+  let receipt = frontier_probe_receipt_from_assemble_rejection(
+    module_path: "src/v2/compiler/example.dag",
+    diagnostics: NonEmptyDiagnostics {
+      head: assemble_detail_test_diagnostic(reason: ^normalize_rejected),
+      tail: Cons { head: assemble_detail_test_diagnostic(reason: ^resolve_module_not_found), tail: Empty }
+    },
+    detail: FrontierProbeDetailAbsent
+  )
+  (receipt.located_reason == ^resolve_module_not_found)
+    && match receipt.assemble_detail {
+      AssembleRejectionDetail { rejection_chain: chain, cause: cause, at: _ } =>
+        (chain.head == ^normalize_rejected)
+          && (length(xs: chain.tail) == 1)
+          && match cause {
+            MissingModuleIdentityUnavailable => true
+            _ => false
+          }
+      _ => false
+    }
+}
diff --git a/src/v2/test/claim/self_host/frontier_probe_cause_location_test.dag b/src/v2/test/claim/self_host/frontier_probe_cause_location_test.dag
index 78968ae9384..4dfc0d6417b 100644
--- a/src/v2/test/claim/self_host/frontier_probe_cause_location_test.dag
+++ b/src/v2/test/claim/self_host/frontier_probe_cause_location_test.dag
@@ -1,15 +1,11 @@
 module v2.test.claim.self_host.frontier_probe_cause_location
 
-import v2.compiler.parse_diagnostic {
-  NonEmptyParseStageDiagnostics,
-  parse_stage_diagnostic_from_diagnostic_only
-}
 import v2.compiler.self_host.frontier_probe_assemble_detail {
-  frontier_probe_assemble_detail_from_parse_stage
+  frontier_probe_assemble_detail_from_rejection
 }
 import v2.compiler.self_host.frontier_probe_types {
   AssembleRejectionDetail,
-  NonEmptySymbolChain,
+  OtherAssembleRefusal,
   CauseLocationDeclaration,
   CauseLocationNodeNotSerializable,
   CauseLocationInvariantPort,
@@ -22,6 +18,7 @@ import std.occurrence_identity { OccurrenceSynthetic }
 import v2.std.diagnostic {
   ByteRange,
   Diagnostic,
+  NonEmptyDiagnostics,
   Textual,
   Unavailable,
   UserInputBoundary,
@@ -43,17 +40,14 @@ import v2.std.text { String }
 // data and keeps its symbol, and only a Node, which has no manifest rendering, reaches the
 // not-serializable arm. A two-diagnostic control pins the PAIRING: with a second diagnostic
 // carrying a different reason at a different position, the reason and the location must both come
-// from the head, so neither field can be drawn from a diagnostic the other did not come from. The
+// from the FATAL (the last), so neither field can be drawn from a diagnostic the other did not come from. The
 // location is asserted on the DETAIL and never inside the cause, because a clustering key reads the
 // cause and two modules refusing for the same reason at different positions are the same detailed
 // cause.
 
 fn detail_location_of(d: Diagnostic) -> Symbol {
-  match frontier_probe_assemble_detail_from_parse_stage(
-    d: NonEmptyParseStageDiagnostics {
-      head: parse_stage_diagnostic_from_diagnostic_only(d: d),
-      tail: Empty
-    }
+  match frontier_probe_assemble_detail_from_rejection(
+    d: NonEmptyDiagnostics { head: d, tail: Empty }
   ) {
     NoFrontierProbeDetail => ^no_detail
     AssembleRejectionDetail { rejection_chain: _, cause: _, at: a } =>
@@ -99,11 +93,8 @@ fn port_locus_diagnostic() -> Diagnostic {
 }
 
 fn textual_extent_start() -> Int {
-  match frontier_probe_assemble_detail_from_parse_stage(
-    d: NonEmptyParseStageDiagnostics {
-      head: parse_stage_diagnostic_from_diagnostic_only(d: textual_diagnostic()),
-      tail: Empty
-    }
+  match frontier_probe_assemble_detail_from_rejection(
+    d: NonEmptyDiagnostics { head: textual_diagnostic(), tail: Empty }
   ) {
     NoFrontierProbeDetail => 0 - 1
     AssembleRejectionDetail { rejection_chain: _, cause: _, at: a } =>
@@ -121,13 +112,10 @@ fn textual_extent_start() -> Int {
   }
 }
 
-fn two_diagnostic_stage() -> NonEmptyParseStageDiagnostics {
-  NonEmptyParseStageDiagnostics {
-    head: parse_stage_diagnostic_from_diagnostic_only(d: textual_diagnostic()),
-    tail: Cons {
-      head: parse_stage_diagnostic_from_diagnostic_only(d: later_diagnostic()),
-      tail: Empty
-    }
+fn two_diagnostic_stage() -> NonEmptyDiagnostics {
+  NonEmptyDiagnostics {
+    head: textual_diagnostic(),
+    tail: Cons { head: later_diagnostic(), tail: Empty }
   }
 }
 
@@ -143,7 +131,7 @@ fn later_diagnostic() -> Diagnostic {
 }
 
 fn paired_start_of_two() -> Int {
-  match frontier_probe_assemble_detail_from_parse_stage(d: two_diagnostic_stage()) {
+  match frontier_probe_assemble_detail_from_rejection(d: two_diagnostic_stage()) {
     NoFrontierProbeDetail => 0 - 1
     AssembleRejectionDetail { rejection_chain: _, cause: _, at: a } =>
       match a {
@@ -161,17 +149,18 @@ fn paired_start_of_two() -> Int {
 }
 
 fn paired_reason_of_two() -> Symbol {
-  match frontier_probe_assemble_detail_from_parse_stage(d: two_diagnostic_stage()) {
+  match frontier_probe_assemble_detail_from_rejection(d: two_diagnostic_stage()) {
     NoFrontierProbeDetail => ^no_detail
-    AssembleRejectionDetail { rejection_chain: c, cause: _, at: _ } =>
-      match c {
-        NonEmptySymbolChain { head: h, tail: _ } => h
+    AssembleRejectionDetail { rejection_chain: _, cause: cause, at: _ } =>
+      match cause {
+        OtherAssembleRefusal { reason: r } => r
+        _ => ^cause_not_other
       }
   }
 }
 
 test fn location_and_reason_are_drawn_from_the_same_diagnostic_holds() -> Bool {
-  paired_start_of_two() == 7 && paired_reason_of_two() == ^cause_location_probe_unclassified_reason
+  paired_start_of_two() == 99 && paired_reason_of_two() == ^cause_location_probe_second_reason
 }
 
 test fn textual_locus_reaches_the_textual_arm_holds() -> Bool {
diff --git a/src/v2/test/claim/self_host/frontier_probe_overlap_detail_test.dag b/src/v2/test/claim/self_host/frontier_probe_overlap_detail_test.dag
deleted file mode 100644
index 9ca8b0bbc87..00000000000
--- a/src/v2/test/claim/self_host/frontier_probe_overlap_detail_test.dag
+++ /dev/null
@@ -1,248 +0,0 @@
-module v2.test.self_host.frontier_probe_overlap_detail
-
-import v2.compiler.parse_diagnostic {
-  NoParseDiagnosticEvidence,
-  NonEmptyParseStageDiagnostics,
-  ParseStageDiagnostic,
-  non_empty_diagnostics_from_parse_stage,
-  parse_overlap_residue_stage_diagnostic_at
-}
-import v2.std.diagnostic {
-  Diagnostic,
-  ExternalContractUnknown,
-  NonEmptyDiagnostics,
-  Unavailable,
-  diagnostics_fatal_reason,
-  invariant_port_locus
-}
-import v2.std.grammar_choice_ambiguity {
-  GrammarChoiceAmbiguityRow,
-  NonEmptyGrammarChoiceAmbiguityRows
-}
-import v2.compiler.self_host.frontier_probe_assemble_detail {
-  assemble_rejection_cause_from_parse_stage,
-  frontier_probe_assemble_detail_from_parse_stage,
-  frontier_probe_assemble_detail_from_rejection_with_overlap_stage,
-  frontier_probe_receipt_from_assemble_rejection
-}
-import v2.compiler.self_host.frontier_probe_types {
-  AssembleRejectionDetail,
-  FrontierProbeDetailAbsent,
-  GrammarChoiceOverlap,
-  OtherAssembleRefusal,
-  NoFrontierProbeDetail,
-  ProbeStageEmit,
-  frontier_probe_receipt_without_assemble_detail,
-  RealizationGap
-}
-import std.optional { Absent, Present, optional_absent, optional_present }
-import v2.std.algebra { Cons, Empty, length }
-
-fn sample_overlap_row() -> GrammarChoiceAmbiguityRow {
-  GrammarChoiceAmbiguityRow {
-    production: ^dag_production_expr,
-    left_first_terminals: Cons { head: ^dag_token_ident, tail: Empty },
-    right_first_terminals: Cons { head: ^dag_token_kw_fn, tail: Empty },
-    overlap_terminals: Empty,
-    both_nullable: true
-  }
-}
-
-fn overlap_residue_stage_diagnostic(row: GrammarChoiceAmbiguityRow) -> ParseStageDiagnostic {
-  parse_overlap_residue_stage_diagnostic_at(
-    at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^frontier_probe_overlap_detail_test_grammar_contract),
-    row: row
-  )
-}
-
-test fn overlap_evidence_binds_exact_row_not_global_roster() -> Bool {
-  let row = sample_overlap_row()
-  let detail = frontier_probe_assemble_detail_from_parse_stage(
-    d: NonEmptyParseStageDiagnostics {
-      head: overlap_residue_stage_diagnostic(row: row),
-      tail: Empty
-    }
-  )
-  match detail {
-    AssembleRejectionDetail {
-      cause: GrammarChoiceOverlap { rows: rows },
-      rejection_chain: _,
-      at: _
-    } =>
-      match rows {
-        NonEmptyGrammarChoiceAmbiguityRows {
-          head: bound,
-          tail: Empty
-        } => bound.production == row.production
-      }
-    _ => false
-  }
-}
-
-fn residue_headed_stage_chain(row: GrammarChoiceAmbiguityRow, fatal: Symbol) -> NonEmptyParseStageDiagnostics {
-  NonEmptyParseStageDiagnostics {
-    head: overlap_residue_stage_diagnostic(row: row),
-    tail: [
-      ParseStageDiagnostic {
-        diagnostic: Diagnostic {
-          reason: fatal,
-          at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: fatal),
-          correction: Unavailable { reason: ExternalContractUnknown }
-        },
-        evidence: NoParseDiagnosticEvidence
-      }
-    ]
-  }
-}
-
-// THE PROGRAM'S RED CONTROL AT THE ASSEMBLE CAUSE. Two refusals share the overlap residue as their
-// head and differ in their fatal cause; the cause reader must report the two distinct fatals.
-// Reading the head (or masking on it) gave both the same residue-shaped answer.
-test fn a_shared_residue_head_yields_each_chains_own_fatal_cause_holds() -> Bool {
-  let row = sample_overlap_row()
-  let a = assemble_rejection_cause_from_parse_stage(d: residue_headed_stage_chain(row: row, fatal: ^normalize_rejected))
-  let b = assemble_rejection_cause_from_parse_stage(d: residue_headed_stage_chain(row: row, fatal: ^body_lowering_reason_wrapper_retained_emitted))
-  match a {
-    OtherAssembleRefusal { reason: ra } =>
-      match b {
-        OtherAssembleRefusal { reason: rb } =>
-          (ra == ^normalize_rejected) && (rb == ^body_lowering_reason_wrapper_retained_emitted)
-        _ => false
-      }
-    _ => false
-  }
-}
-
-// THE RENDERING KEEPS THE HEAD. The receipt's rejection_chain is the whole chain in order, so the
-// advisory head stays visible to an operator while the cause above is the fatal element.
-test fn a_residue_headed_receipt_chain_keeps_the_advisory_head_holds() -> Bool {
-  let row = sample_overlap_row()
-  let stage = residue_headed_stage_chain(row: row, fatal: ^normalize_rejected)
-  let receipt = frontier_probe_receipt_from_assemble_rejection(
-    module_path: "src/v2/compiler/example.dag",
-    diagnostics: non_empty_diagnostics_from_parse_stage(d: stage),
-    detail: FrontierProbeDetailAbsent,
-    overlap_residue_stage: optional_present(value: stage)
-  )
-  match receipt.assemble_detail {
-    AssembleRejectionDetail { rejection_chain: chain, cause: OtherAssembleRefusal { reason: r }, at: _ } =>
-      (chain.head == ^parse_grammar_choice_overlap_residue) && (r == ^normalize_rejected)
-        && (receipt.located_reason == ^normalize_rejected)
-    _ => false
-  }
-}
-
-test fn emit_stage_receipt_has_no_assemble_detail() -> Bool {
-  match frontier_probe_receipt_without_assemble_detail(
-    module_path: "src/v2/compiler/example.dag",
-    blocker: RealizationGap,
-    located_stage: ProbeStageEmit,
-    located_reason: ^probe_emit_accept_self_host_bar_unbound,
-    detail: FrontierProbeDetailAbsent
-  ).assemble_detail {
-    NoFrontierProbeDetail => true
-    _ => false
-  }
-}
-
-test fn assemble_receipt_carries_nonempty_rejection_chain() -> Bool {
-  let row = sample_overlap_row()
-  let stage = NonEmptyParseStageDiagnostics {
-    head: overlap_residue_stage_diagnostic(row: row),
-    tail: Empty
-  }
-  let receipt = frontier_probe_receipt_from_assemble_rejection(
-    module_path: "src/v2/compiler/example.dag",
-    diagnostics: non_empty_diagnostics_from_parse_stage(d: stage),
-    detail: FrontierProbeDetailAbsent,
-    overlap_residue_stage: optional_present(value: stage)
-  )
-  match receipt.assemble_detail {
-    AssembleRejectionDetail { rejection_chain: chain, cause: cause, at: _ } =>
-      match cause {
-        GrammarChoiceOverlap { rows: rows } =>
-          (chain.head == ^parse_grammar_choice_overlap_residue)
-            && (length(xs: chain.tail) == 0)
-            && (rows.head.production == row.production)
-        _ => false
-      }
-    _ => false
-  }
-}
-
-test fn overlap_stage_attaches_evidence_when_diagnostics_stripped() -> Bool {
-  let row = sample_overlap_row()
-  let stage = NonEmptyParseStageDiagnostics {
-    head: overlap_residue_stage_diagnostic(row: row),
-    tail: Empty
-  }
-  let stripped = non_empty_diagnostics_from_parse_stage(d: stage)
-  let detail = frontier_probe_assemble_detail_from_rejection_with_overlap_stage(
-    d: stripped,
-    overlap_residue_stage: optional_present(value: stage)
-  )
-  match detail {
-    AssembleRejectionDetail {
-      cause: GrammarChoiceOverlap { rows: rows },
-      rejection_chain: _,
-      at: _
-    } =>
-      match rows {
-        NonEmptyGrammarChoiceAmbiguityRows {
-          head: bound,
-          tail: Empty
-        } => bound.production == row.production
-      }
-    _ => false
-  }
-}
-
-test fn masked_overlap_located_reason_unmasks_terminal_refusal() -> Bool {
-  let masked = NonEmptyDiagnostics {
-    head: Diagnostic {
-      reason: ^parse_grammar_choice_overlap_residue,
-      at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^parse_grammar_choice_overlap_residue),
-      correction: Unavailable { reason: ExternalContractUnknown }
-    },
-    tail: [
-      Diagnostic {
-        reason: ^body_lowering_reason_wrapper_retained_emitted,
-        at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^body_lowering_reason_wrapper_retained_emitted),
-        correction: Unavailable { reason: ExternalContractUnknown }
-      }
-    ]
-  }
-  let located = diagnostics_fatal_reason(d: masked)
-  located == ^body_lowering_reason_wrapper_retained_emitted
-}
-
-test fn overlap_only_chain_keeps_overlap_located_reason() -> Bool {
-  let overlap_only = NonEmptyDiagnostics {
-    head: Diagnostic {
-      reason: ^parse_grammar_choice_overlap_residue,
-      at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^parse_grammar_choice_overlap_residue),
-      correction: Unavailable { reason: ExternalContractUnknown }
-    },
-    tail: Empty
-  }
-  let located = diagnostics_fatal_reason(d: overlap_only)
-  located == ^parse_grammar_choice_overlap_residue
-}
-
-test fn masked_resolve_not_found_unmasks_located_reason() -> Bool {
-  let masked = NonEmptyDiagnostics {
-    head: Diagnostic {
-      reason: ^parse_grammar_choice_overlap_residue,
-      at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^parse_grammar_choice_overlap_residue),
-      correction: Unavailable { reason: ExternalContractUnknown }
-    },
-    tail: [
-      Diagnostic {
-        reason: ^resolve_module_not_found,
-        at: invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^resolve_module_not_found),
-        correction: Unavailable { reason: ExternalContractUnknown }
-      }
-    ]
-  }
-  diagnostics_fatal_reason(d: masked) == ^resolve_module_not_found
-}
diff --git a/src/v2/test/claim/self_host/frontier_probe_semantic_family_receipt_test.dag b/src/v2/test/claim/self_host/frontier_probe_semantic_family_receipt_test.dag
deleted file mode 100644
index 288e1c65cfe..00000000000
--- a/src/v2/test/claim/self_host/frontier_probe_semantic_family_receipt_test.dag
+++ /dev/null
@@ -1,43 +0,0 @@
-module v2.test.claim.self_host.frontier_probe_semantic_family_receipt
-
-import v2.compiler.self_host.frontier_probe_semantic_family_receipt {
-  capped_shard_count,
-  every_capped_shard_exceeds_its_own_cap,
-  every_measured_chain_is_non_uniform,
-  measured_shard_count,
-  shard_count,
-  shards_naming_body_lowering_beneath_the_mask
-}
-import v2.std.text { String }
-
-// What these claims can and cannot do, stated so the coverage is not overread. The rows are
-// OBSERVATIONS — a witness cannot re-derive them without re-running a twenty-minute probe per
-// readout, so nothing here re-measures the door. What it does enforce is the internal discipline
-// the rows must keep to stay readable as evidence: the five shards are partitioned into exactly two
-// dispositions with no third state and no shard in both, a capped row's read count actually exceeds
-// the cap it names (a row claiming a cap it does not breach would be a refusal with no cause), and
-// a measured row's differing-symbol count sits strictly inside its chain length — zero would mean
-// the chain was uniform and the masking finding would not follow, and equal to the length would
-// mean the head appears nowhere in its own chain. The body-lowering count is pinned at 2 rather
-// than asserted as 'both', so adding a third measured shard that lands elsewhere reds this instead
-// of silently weakening the finding.
-
-test fn the_five_shards_partition_into_measured_and_capped_holds() -> Bool {
-  (shard_count() == 5) && (measured_shard_count() + capped_shard_count() == shard_count())
-}
-
-test fn two_shards_are_measured_and_three_are_capped_holds() -> Bool {
-  (measured_shard_count() == 2) && (capped_shard_count() == 3)
-}
-
-test fn every_capped_shard_exceeds_the_cap_it_names_holds() -> Bool {
-  every_capped_shard_exceeds_its_own_cap()
-}
-
-test fn both_measured_shards_name_body_lowering_beneath_the_mask_holds() -> Bool {
-  shards_naming_body_lowering_beneath_the_mask() == 2
-}
-
-test fn every_measured_chain_is_non_uniform_holds() -> Bool {
-  every_measured_chain_is_non_uniform()
-}
diff --git a/src/v2/test/claim/self_host/peano_nat_structural_realization_test.dag b/src/v2/test/claim/self_host/peano_nat_structural_realization_test.dag
index f97735f41bc..e83d3138bdb 100644
--- a/src/v2/test/claim/self_host/peano_nat_structural_realization_test.dag
+++ b/src/v2/test/claim/self_host/peano_nat_structural_realization_test.dag
@@ -21,14 +21,14 @@ import std.operator_realization {
 }
 import std.syntax { BinOp, Lt, Le, Gt, Ge, Eq, Div, Mod, Sub, And, Add }
 import gunbc.structural_realization_bindings { literal_homomorphism_rows, structural_ordering_rows }
-import std.nat { Nat, Zero, Succ, nat_compare }
+import std.nat { Nat, Zero, Succ, nat_compare, nat_to_decimal_string, decimal_digit_nat, D0, D1, D7, D9 }
 import test.fixture.structural_peano_nat {
   StructuralNat, StructuralZero, StructuralSucc,
   StructuralNatDifference, StructuralNatSubtrahendExceedsMinuend,
   StructuralNatQuotientRemainder, StructuralNatDivisionByZero,
   structural_nat_compare, structural_nat_sub, structural_nat_div_rem, structural_nat_div_rem_by_succ
 }
-import v2.std.integer { integer_nat_to_decimal_string, integer_int_to_decimal_string, decimal_digit_nat, D0, D7 }
+import std.integer { int_to_decimal_string, decimal_digit_of_units }
 
 // FALSIFIERS FOR THE STRUCTURAL PEANO NAT REALIZATION (XL-0N, adhoc-aec65f93-b00), the
 // interpreter-executed half. The emitted-bytes half -- that a kernel literal at a test.fixture.structural_peano_nat.StructuralNat
@@ -99,10 +99,13 @@ test fn nat_div_rem_by_succ_has_no_zero_arm_and_divides() -> Bool {
 fn std_seven() -> Nat { Succ { prev: Succ { prev: Succ { prev: Succ { prev: Succ { prev: Succ { prev: Succ { prev: Zero } } } } } } } }
 
 test fn nat_to_decimal_converts_nontrivial_values() -> Bool {
-  integer_nat_to_decimal_string(value: Zero) == "0"
-    && integer_nat_to_decimal_string(value: std_seven()) == "7"
-    && integer_nat_to_decimal_string(value: Succ { prev: Succ { prev: Succ { prev: std_seven() } } }) == "10"
-    && integer_nat_to_decimal_string(value: 23) == "23"
+  nat_to_decimal_string(value: Zero) == "0"
+    && nat_to_decimal_string(value: std_seven()) == "7"
+    && nat_to_decimal_string(value: Succ { prev: Succ { prev: Succ { prev: std_seven() } } }) == "10"
+    && nat_to_decimal_string(value: 23) == "23"
+    && nat_to_decimal_string(value: 9) == "9"
+    && nat_to_decimal_string(value: 19) == "19"
+    && nat_to_decimal_string(value: 100) == "100"
 }
 
 test fn decimal_digit_nat_supplies_the_peano_value() -> Bool {
@@ -130,10 +133,30 @@ test fn structural_peano_constructors_stay_constructors() -> Bool {
 }
 
 test fn int_to_decimal_is_the_machine_integer_formatter() -> Bool {
-  integer_int_to_decimal_string(value: 0) == "0"
-    && integer_int_to_decimal_string(value: 42) == "42"
-    && integer_int_to_decimal_string(value: 0 - 7) == "-7"
-    && integer_int_to_decimal_string(value: 1000) == "1000"
+  int_to_decimal_string(value: 0) == "0"
+    && int_to_decimal_string(value: 42) == "42"
+    && int_to_decimal_string(value: 0 - 7) == "-7"
+    && int_to_decimal_string(value: 1000) == "1000"
+    && int_to_decimal_string(value: 0 - 10) == "-10"
+    && int_to_decimal_string(value: 0 - 19) == "-19"
+    && int_to_decimal_string(value: 99) == "99"
+}
+
+// The units digit is constructed, not looked up, so no Int is out of range: 9 is D9 by derivation
+// (not by a default arm), and -1, 10 and 99 each answer their own units digit rather than D9.
+test fn decimal_digit_of_units_is_constructed_not_defaulted() -> Bool {
+  decimal_digit_of_units(value: 9) == D9
+    && decimal_digit_of_units(value: 0) == D0
+    && decimal_digit_of_units(value: 0 - 1) == D1
+    && decimal_digit_of_units(value: 10) == D0
+    && decimal_digit_of_units(value: 99) == D9
+    && decimal_digit_of_units(value: 0 - 10) == D0
+}
+
+// The minimum host integer has no representable negation, so a renderer that negates before it
+// divides overflows here; this one divides the signed value and never negates it.
+test fn int_to_decimal_renders_the_minimum_machine_integer() -> Bool {
+  int_to_decimal_string(value: 0 - 9223372036854775807 - 1) == "-9223372036854775808"
 }
 
 // ---------------------------------------------------------------------------------------------
diff --git a/src/v2/test/claim/self_host/stage0_executable_assembly_test.dag b/src/v2/test/claim/self_host/stage0_executable_assembly_test.dag
index 8ebd1e8697a..8b37287a53c 100644
--- a/src/v2/test/claim/self_host/stage0_executable_assembly_test.dag
+++ b/src/v2/test/claim/self_host/stage0_executable_assembly_test.dag
@@ -1,5 +1,7 @@
 module v2.test.claim.self_host.stage0_executable_assembly_test
 
+import gunbc.crate_partition { Stage0FoundationCrate, Stage0LayeredCoreCrate, Stage0PartitionCrateRow }
+
 import std.types { List }
 import extdeps.filesystem.filesystem_io { Filesystem }
 import v2.compiler.self_host.stage0_executable_assembly {
@@ -38,14 +40,7 @@ import v2.compiler.self_host.seed_retention_frontier {
   SeedRetainedIntrinsicSource,
   retained_reason_undeclared
 }
-import v2.workflow.rust_crate_partition {
-  Stage0FoundationCrate,
-  Stage0LayeredCoreCrate,
-  Stage0PartitionCrateRow,
-  stage0_module_bearing_crate_rows,
-  stage0_unit_runtime,
-  stage0_unit_std_core
-}
+import v2.workflow.rust_crate_partition { stage0_module_bearing_crate_rows, stage0_unit_runtime, stage0_unit_std_core }
 import v2.std.algebra { any, length }
 import v2.std.text { String }
 
diff --git a/src/v2/test/claim/self_host/stage0_production_target_test.dag b/src/v2/test/claim/self_host/stage0_production_target_test.dag
index cb4fca7dedd..4e711038ca4 100644
--- a/src/v2/test/claim/self_host/stage0_production_target_test.dag
+++ b/src/v2/test/claim/self_host/stage0_production_target_test.dag
@@ -13,6 +13,7 @@ import v2.compiler.self_host.stage0_production_target {
   stage0_production_target_model
 }
 import v2.compiler.source_authority { DagSourceReadWitness, SourceRef }
+import v2.std.cross_tree.import_model { V2Tree }
 import v2.compiler.source_authority_read {
   source_ref_for_observed_storage_path,
   source_root_ingest_from_source_refs
@@ -232,7 +233,7 @@ type Stage0BoundaryRead
 
 fn stage0_boundary_read_of(path: String) -> Stage0BoundaryRead {
   match source_root_ingest_from_source_refs(
-    refs: Cons { head: source_ref_for_observed_storage_path(path: path), tail: Empty }
+    refs: Cons { head: source_ref_for_observed_storage_path(path: path, source_root: V2Tree), tail: Empty }
   ) {
     Rejected { diagnostics: _ } => Stage0BoundaryReadRefused
     Accepted { value: ingest, diagnostics: _ } =>
diff --git a/src/v2/test/claim/service_realization_conformance_test.dag b/src/v2/test/claim/service_realization_conformance_test.dag
index fda1cdc6e06..e05647e8159 100644
--- a/src/v2/test/claim/service_realization_conformance_test.dag
+++ b/src/v2/test/claim/service_realization_conformance_test.dag
@@ -13,7 +13,7 @@ import v2.std.service_realization_labels {
   realization_arm_payload_label,
   realization_status_code_label
 }
-import v2.compiler.symbol_index_fill { symbol_index_fill_containment_node }
+import v2.compiler.symbol_index_fill { disj_variant_counts_in_module, symbol_index_fill_containment_node }
 import v2.extdeps.languages.dag { dag_int_literal_node_from_lexeme, dag_string_literal_node }
 import v2.std.arrow_signature { declared_signature_arrow }
 import v2.std.node_query { binder_edge }
@@ -208,7 +208,13 @@ fn sr_module(realization_label: Symbol) -> Node {
 }
 
 fn sr_index(module: Node) -> SymbolIndex {
-  symbol_index_fill_containment_node(index: empty_symbol_index(), path: Cons { head: ^m, tail: Empty }, node: module)
+  symbol_index_fill_containment_node(
+    index: empty_symbol_index(),
+    path: Cons { head: ^m, tail: Empty },
+    node: module,
+    counts: disj_variant_counts_in_module(root: module),
+    module_qn: Cons { head: ^m, tail: Empty }
+  )
 }
 
 fn sr_indexed(index: SymbolIndex, path: List<Symbol>) -> Bool {
diff --git a/src/v2/test/claim/source_root_tagging_test.dag b/src/v2/test/claim/source_root_tagging_test.dag
index 4130e059635..015d6032123 100644
--- a/src/v2/test/claim/source_root_tagging_test.dag
+++ b/src/v2/test/claim/source_root_tagging_test.dag
@@ -1,11 +1,21 @@
 module v2.test.claim.source_root_tagging
 
-import v2.std.live_tree { LiveTreeDisposition }
-import v2.compiler.source_authority { DagSourceReadWitness }
+import gunbc.source_root_read { SourceRootFile }
+import v2.compiler.source_authority {
+  DagSourceReadWitness,
+  SourceRootArgumentAdmitted,
+  SourceRootArgumentUnrecognized,
+  SourceRootIngest,
+  SourceRootIngestFromFilesBuilt,
+  SourceRootIngestFromFilesUnrecognizedRoot,
+  admit_source_root_argument,
+  source_root_ingest_from_files,
+  source_root_set_from_ingest
+}
 import v2.std.artifact { Artifact, SourceFile }
 import extdeps.communication.medium { Lossless, Medium }
-import v2.compiler.source_authority { DagSourceReadWitness, source_root_set_from_ingest }
 import v2.std.cross_tree.import_model { DagTree, V2Tree, source_root_set_contains }
+import std.algebra { Cons, Empty }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 
 
@@ -36,6 +46,78 @@ data sr_tag_dag_read: DagSourceReadWitness = DagSourceReadWitness {
 data sr_tag_mixed_ingest: SourceRootIngest = [sr_tag_v2_read, sr_tag_dag_read]
 data sr_tag_v2_only_ingest: SourceRootIngest = [sr_tag_v2_read]
 
+test fn a_dag_source_root_argument_is_dag_tree() -> Bool {
+  match admit_source_root_argument(argument: "dag") {
+    SourceRootArgumentAdmitted { tree: DagTree } => true
+    SourceRootArgumentAdmitted { tree: V2Tree } => false
+    SourceRootArgumentUnrecognized { argument: _ } => false
+  }
+}
+
+test fn a_v2_source_root_argument_is_v2_tree() -> Bool {
+  match admit_source_root_argument(argument: "src/v2") {
+    SourceRootArgumentAdmitted { tree: V2Tree } => true
+    SourceRootArgumentAdmitted { tree: DagTree } => false
+    SourceRootArgumentUnrecognized { argument: _ } => false
+  }
+}
+
+test fn a_copied_single_root_argument_is_unrecognized() -> Bool {
+  match admit_source_root_argument(argument: "/tmp/copied-closure") {
+    SourceRootArgumentUnrecognized { argument: argument } => argument == "/tmp/copied-closure"
+    SourceRootArgumentAdmitted { tree: _ } => false
+  }
+}
+
+fn sr_file(path: String, origin: String) -> SourceRootFile {
+  SourceRootFile { path: path, content: "module fixture.sr_tag\n", origin: origin }
+}
+
+test fn a_dag_file_whose_path_contains_src_is_still_dag_tree() -> Bool {
+  match source_root_ingest_from_files(
+    files: [sr_file(path: "dag/pkg/src/leaf.dag", origin: "dag")]
+  ) {
+    SourceRootIngestFromFilesUnrecognizedRoot { argument: _, path: _ } => false
+    SourceRootIngestFromFilesBuilt { ingest: ingest } =>
+      match ingest {
+        Empty => false
+        Cons { head: read, tail: rest } =>
+          match rest {
+            Empty => match read.source_root {
+              DagTree => true
+              V2Tree => false
+            }
+            Cons { head: _, tail: _ } => false
+          }
+      }
+  }
+}
+
+test fn ingest_from_an_unrecognized_origin_refuses() -> Bool {
+  match source_root_ingest_from_files(
+    files: [sr_file(path: "/tmp/copied-closure/src/v2/std/algebra.dag", origin: "/tmp/copied-closure")]
+  ) {
+    SourceRootIngestFromFilesUnrecognizedRoot { argument: argument, path: path } =>
+      (argument == "/tmp/copied-closure")
+        && (path == "/tmp/copied-closure/src/v2/std/algebra.dag")
+    SourceRootIngestFromFilesBuilt { ingest: _ } => false
+  }
+}
+
+test fn two_root_origins_tag_each_tree() -> Bool {
+  match source_root_ingest_from_files(
+    files: [
+      sr_file(path: "dag/std/algebra.dag", origin: "dag"),
+      sr_file(path: "src/v2/std/algebra.dag", origin: "src/v2")
+    ]
+  ) {
+    SourceRootIngestFromFilesUnrecognizedRoot { argument: _, path: _ } => false
+    SourceRootIngestFromFilesBuilt { ingest: ingest } =>
+      source_root_set_contains(roots: source_root_set_from_ingest(ingest: ingest), r: DagTree)
+        && source_root_set_contains(roots: source_root_set_from_ingest(ingest: ingest), r: V2Tree)
+  }
+}
+
 test fn source_root_tag_carried_and_folded_to_grounded_set() -> Bool {
   let mixed = source_root_set_from_ingest(ingest: sr_tag_mixed_ingest)
   let v2_only = source_root_set_from_ingest(ingest: sr_tag_v2_only_ingest)
diff --git a/src/v2/test/claim/staging_test.dag b/src/v2/test/claim/staging_test.dag
index adbed81ab58..325cee68ed7 100644
--- a/src/v2/test/claim/staging_test.dag
+++ b/src/v2/test/claim/staging_test.dag
@@ -37,16 +37,3 @@ test fn then_outcome_builder_capture() -> Bool {
   let stage = then_outcome(f: add5, g: s_double)
   acc_int(o: stage(1), dflt: 0) == 12
 }
-
-fn lookup_always_42(n: Int) -> CacheProbe<Int> { Hit { value: 42 } }
-fn lookup_never(n: Int) -> CacheProbe<Int> { Miss }
-
-test fn cached_stage_hit_skips_stage() -> Bool {
-  let staged = cached_stage(lookup: lookup_always_42, stage: s_double)
-  acc_int(o: staged(5), dflt: 0) == 42
-}
-
-test fn cached_stage_miss_runs_stage() -> Bool {
-  let staged = cached_stage(lookup: lookup_never, stage: s_double)
-  acc_int(o: staged(5), dflt: 0) == 10
-}
diff --git a/src/v2/test/claim/std/named_child_lookup_test.dag b/src/v2/test/claim/std/named_child_lookup_test.dag
index 913b948c7a1..2da18caa806 100644
--- a/src/v2/test/claim/std/named_child_lookup_test.dag
+++ b/src/v2/test/claim/std/named_child_lookup_test.dag
@@ -73,6 +73,27 @@ test fn named_child_lookup_decides_all_three_states_in_one_pass() -> Bool {
     && ncl_is_missing(lookup: named_child_lookup(root: ncl_atom(s: ^ncl_not_a_conj), name: ^ncl_unique))
 }
 
+// A lowered call is a ComputationNode whose authored edges carry its named arguments
+// (body-lowering mints comp:transform[ *=atom:callee[] @arg=atom:... ]). The lookup must read
+// them: this arm goes red against the pre-fix behavior, which answered NamedChildMissing for
+// every ComputationNode regardless of its children.
+fn ncl_transform() -> Node {
+  Node {
+    kind: ComputationNode { behavior: Transform },
+    children: [
+      Edge { label: Positional, target: ncl_atom(s: ^ncl_callee) },
+      ncl_named(name: ^ncl_arg, target: ncl_atom(s: ^ncl_arg_value))
+    ],
+    occurrence_id: OccurrenceSynthetic
+  }
+}
+
+test fn named_child_lookup_reads_a_lowered_call_s_named_args_holds() -> Bool {
+  ncl_found_is(lookup: named_child_lookup(root: ncl_transform(), name: ^ncl_arg), expected: ncl_atom(s: ^ncl_arg_value))
+    && ncl_is_missing(lookup: named_child_lookup(root: ncl_transform(), name: ^ncl_absent))
+    && ncl_is_missing(lookup: named_child_lookup(root: ncl_transform(), name: ^ncl_unique))
+}
+
 test fn find_named_child_projects_the_lookup_with_its_refusal_reasons() -> Bool {
   ncl_accepted_is(o: find_named_child(root: ncl_conj(), name: ^ncl_unique), expected: ncl_atom(s: ^ncl_unique_target))
     && ncl_rejected_with(o: find_named_child(root: ncl_conj(), name: ^ncl_repeated), reason: ^named_child_ambiguous)
diff --git a/src/v2/test/claim/symbol_index/containment_test.dag b/src/v2/test/claim/symbol_index/containment_test.dag
index 3f999dc7a5e..1cc515dc903 100644
--- a/src/v2/test/claim/symbol_index/containment_test.dag
+++ b/src/v2/test/claim/symbol_index/containment_test.dag
@@ -99,7 +99,9 @@ data si_unique_index: SymbolIndex = symbol_index_fill_module_root(
 data si_unique_index_containment_only: SymbolIndex = symbol_index_fill_containment_node(
   index: empty_symbol_index(),
   path: si_unique_module_qn,
-  node: si_unique_module_root_node
+  node: si_unique_module_root_node,
+  counts: disj_variant_counts_in_module(root: si_unique_module_root_node),
+  module_qn: si_unique_module_qn
 )
 
 test fn symbol_index_materializes_type_variant_paths_holds() -> Bool {
@@ -237,18 +239,34 @@ test fn symbol_index_unique_variant_alias_at_module_holds() -> Bool {
   }
 }
 
-test fn symbol_index_unique_variant_without_alias_red_control_holds() -> Bool {
+// THE COUNT RULE IS THE WITHOUT SIDE. The module-level variant alias exists only where the tag is
+// declared by ONE coproduct in the module (disj_variant_counts_in_module): this module declares
+// ^Yes twice (^Mood and ^Classical), so the fused containment walk mints nothing for it — the
+// WITHOUT side — while the unique module mints for ^Yes — the WITH side. A fill that minted a
+// module alias for a twice-declared tag reds the first arm; a containment walk that stopped
+// minting reds the second. THE PAIR IS THE EVIDENCE, NOT EITHER ARM.
+test fn symbol_index_module_variant_alias_requires_a_unique_count_holds() -> Bool {
   match symbol_index_lexical_lookup(
-    index: si_unique_index_containment_only,
-    position: si_unique_module_qn,
+    index: si_index,
+    position: si_module_qn,
     name: ^Yes
   ) {
+    LexicalUnbound =>
+      match symbol_index_lexical_lookup(
+        index: si_unique_index,
+        position: si_unique_module_qn,
+        name: ^Yes
+      ) {
+        LexicalHit { node: _, path: _ } => true
+        LexicalAmbiguous { candidates: _ } => false
+        LexicalUnbound => false
+      }
     LexicalHit { node: _, path: _ } => false
     LexicalAmbiguous { candidates: _ } => false
-    LexicalUnbound => true
   }
 }
 
+
 test fn symbol_index_variant_visibility_equivalence_holds() -> Bool {
   match symbol_index_lexical_lookup(
     index: si_unique_index,
diff --git a/src/v2/test/claim/variant_field_infer_probe_test.dag b/src/v2/test/claim/variant_field_infer_probe_test.dag
new file mode 100644
index 00000000000..b45cbb9214f
--- /dev/null
+++ b/src/v2/test/claim/variant_field_infer_probe_test.dag
@@ -0,0 +1,720 @@
+module v2.test.claim.variant_field_infer_probe
+
+import v2.compiler.infer {
+  ConstructIsRecord,
+  ConstructIsVariantArm,
+  ConstructNotARecord,
+  infer,
+  infer_record_construct_read,
+  inferred_facts_resolved_type
+}
+import v2.std.qualified_name { declaration_reference_path_optional, qualified_name_last_segment }
+import v2.std.witness { Holds, Violates }
+import v2.compiler.name_resolve { Admission, ResolutionSubject }
+import v2.compiler.program_assembly { assemble_program_from_ingest }
+import v2.compiler.source_authority { DagSourceReadWitness }
+import v2.extdeps.languages.dag { dag_language_model }
+import extdeps.communication.medium { Lossless, Medium }
+import std.algebra { Cons, Empty, list_append }
+import v2.std.cross_tree.import_model { V2Tree }
+import v2.std.artifact { Artifact, SourceFile }
+import v2.std.diagnostic { Accepted, NonEmptyDiagnostics, None, Outcome, Rejected, Some }
+import v2.std.algebra { contains, list_map }
+import v2.compiler.inferred_tree { ObligatedInferredTree }
+import v2.std.node_query { construct_tag_optional }
+import v2.std.node {
+  Atom,
+  ComputationNode,
+  CoreMarker,
+  FieldProjectionBaseEdge,
+  Match,
+  MatchArmBodyEdge,
+  Node,
+  Positional,
+  StructuralLabel,
+  Symbol,
+  TypeNode,
+  symbol_lexeme
+}
+import std.optional { Absent, Optional, Present }
+import v2.std.text { String }
+import v2.std.collection { List }
+import gunbc.cli_wire { CliWireResponse, CliWirePrintable }
+import std.process { ExitSuccess }
+
+fn vfp_assemble(src: String) -> Outcome<ResolvedTree> {
+  assemble_program_from_ingest(
+    ingest: Cons {
+      head: DagSourceReadWitness {
+        source: Medium { carried: src, fidelity: Lossless },
+        artifact: vfp_variant_artifact,
+        compilation_unit: ^vfp_variant_cu,
+        source_root: V2Tree
+      },
+      tail: Empty
+    },
+    admission: Admission { subject: ResolutionSubject { name: Cons { head: ^p, tail: Empty } }, imports: Empty },
+    lm: dag_language_model()
+  )
+}
+
+fn vfp_reasons(r: NonEmptyDiagnostics) -> List<Symbol> {
+  Cons { head: r.head.reason, tail: list_map(xs: r.tail, f: fn(d) { d.reason }) }
+}
+
+fn vfp_last(xs: List<Symbol>) -> Symbol {
+  fold(xs, init: ^vfp_no_reason, f: fn(acc, x) { x })
+}
+
+fn vfp_find_match(n: Node) -> Optional<Node> {
+  match n.kind {
+    ComputationNode { behavior: Match } => Present { value: n }
+    _ => fold(n.children, init: Absent, f: fn(acc, e) {
+      match acc {
+        Present { value: _ } => acc
+        Absent => vfp_find_match(n: e.target)
+      }
+    })
+  }
+}
+
+fn vfp_find_construction(n: Node) -> Optional<Node> {
+  match construct_tag_optional(n: n) {
+    Present { value: _ } => Present { value: n }
+    Absent => fold(n.children, init: Absent, f: fn(acc, e) {
+      match acc {
+        Present { value: _ } => acc
+        Absent => vfp_find_construction(n: e.target)
+      }
+    })
+  }
+}
+
+// THE PROJECTION FINDER: preorder for the FieldProjection conj (base edge first). The projection
+// now stands as a fn body (pick), not an arm body, so it needs its own walk.
+fn vfp_projection_shape(n: Node) -> Optional<Node> {
+  match n.kind {
+    TypeNode { connective: Conj } =>
+      fold(n.children, init: Absent, f: fn(acc, e) {
+        match acc {
+          Present { value: _ } => acc
+          Absent =>
+            match e.label {
+              StructuralLabel { label: CoreMarker { marker: FieldProjectionBaseEdge } } => Present { value: n }
+              _ => Absent
+            }
+        }
+      })
+    _ => Absent
+  }
+}
+
+fn vfp_find_projection(n: Node) -> Optional<Node> {
+  match vfp_projection_shape(n: n) {
+    Present { value: p } => Present { value: p }
+    Absent => fold(n.children, init: Absent, f: fn(acc, e) {
+      match acc {
+        Present { value: _ } => acc
+        Absent => vfp_find_projection(n: e.target)
+      }
+    })
+  }
+}
+
+// THE MATCH SCRUTINEE: the match's first positional child (the caller's match is optional, so the
+// optional unwraps here like vfp_arm_body_first does).
+fn vfp_match_scrutinee(m: Optional<Node>) -> Optional<Node> {
+  match m {
+    Present { value: n } =>
+      fold(n.children, init: Absent, f: fn(acc, e) {
+        match acc {
+          Present { value: _ } => acc
+          Absent =>
+            match e.label {
+              Positional => Present { value: e.target }
+              _ => Absent
+            }
+        }
+      })
+    Absent => Absent
+  }
+}
+
+fn vfp_type_name(t: Node) -> Symbol {
+  match declaration_reference_path_optional(node: t) {
+    Present { value: path } =>
+      match qualified_name_last_segment(qn: path) {
+        Present { value: s } => s
+        Absent => ^vfp_empty_path
+      }
+    Absent =>
+      match t.kind {
+        TypeNode { connective: Atom { identity: s } } => s
+        _ => ^vfp_type_not_named
+      }
+  }
+}
+
+
+fn vfp_fact_in(inferred: ObligatedInferredTree, subject: Optional<Node>) -> Symbol {
+  match subject {
+    Absent => ^vfp_subject_absent
+    Present { value: s } =>
+      match inferred.facts.lookup(s) {
+        Absent => ^vfp_no_facts
+        Present { value: facts } =>
+          match inferred_facts_resolved_type(facts: facts) {
+            Violates { diagnostic: _ } => ^vfp_underived
+            Holds { value: t } => vfp_type_name(t: t)
+          }
+      }
+  }
+}
+
+fn vfp_reports(reading: VfpReading, reason: Symbol) -> Bool {
+  contains(xs: reading.reasons, item: reason, eq: fn(a, b) { a == b })
+}
+
+fn vfp_infers(reading: VfpReading) -> Bool {
+  match reading.reasons {
+    Cons { head: h, tail: _ } => h == ^infers
+    Empty => false
+  }
+}
+
+// THE CONSTRUCT READ, DECODED: what infer_record_construct_read answers for the fixture's
+// construction, read directly on the resolved tree. The variant arm is named by its declaring
+// path's last segment (^Boxed when the read mints the variant row); the sentinels say where the
+// read stopped instead. TEMPORARY decode instrument: goes out with the RFM retirement once the
+// per-identity evidence is recorded.
+fn vfp_construct_read_decode(resolved: ResolvedTree) -> Symbol {
+  match vfp_find_construction(n: resolved.root) {
+    Absent => ^vfp_read_subject_absent
+    Present { value: node } =>
+      match infer_record_construct_read(node: node, resolved: resolved) {
+        ConstructIsRecord { construct: _ } => ^vfp_read_record
+        ConstructIsVariantArm { construct: c } =>
+          match qualified_name_last_segment(qn: c.arm_path) {
+            Present { value: s } => s
+            Absent => ^vfp_read_arm_path_absent
+          }
+        ConstructNotARecord => ^vfp_read_not_a_record
+      }
+  }
+}
+
+// THE CARRIER HALF OF THE SAME DECODE: what the read names as the variant's declaring coproduct
+// (^Seal for the fixture) -- the field the alias mechanism exists to fill, since the tag's own
+// path (the module-level alias `p.Boxed`) does not carry it. TEMPORARY: goes out with the RFM
+// retirement.
+fn vfp_construct_read_carrier_decode(resolved: ResolvedTree) -> Symbol {
+  match vfp_find_construction(n: resolved.root) {
+    Absent => ^vfp_read_subject_absent
+    Present { value: node } =>
+      match infer_record_construct_read(node: node, resolved: resolved) {
+        ConstructIsRecord { construct: _ } => ^vfp_read_record
+        ConstructIsVariantArm { construct: c } =>
+          match qualified_name_last_segment(qn: c.variant_path) {
+            Present { value: s } => s
+            Absent => ^vfp_read_no_carrier
+          }
+        ConstructNotARecord => ^vfp_read_not_a_record
+      }
+  }
+}
+
+// WHAT THE FIXTURE ESTABLISHES, decided once per program by one nullary producer enrolled WARM in
+// v2.workflow.floor_pure_producer_share. `reasons` is the whole chain in order: a resolve or infer
+// refusal's reasons, or `^infers` followed by the accepted inference's advisories. A FACT field is
+// the picked node's resolved type name on an accepted inference, or the sentinels where the route
+// stops: ^vfp_subject_absent when the finder found nothing, ^vfp_no_facts when the node carries no
+// facts, ^vfp_underived when the facts do not resolve, or the refusal's reason (the head at resolve,
+// the last at infer).
+type VfpReading {
+  reasons: List<Symbol>
+  construction_fact: Symbol
+  match_fact: Symbol
+  arm_body_fact: Symbol
+  construct_read: Symbol
+  construct_read_carrier: Symbol
+}
+
+// THE COMBINED FIXTURE'S READING: one module exercising the shapes the enrolled claims measure
+// (a named payload binder, a nullary arm, a variant construction, a monomorphic record
+// projection). ONE nullary producer so every planned claim reaches one
+// closed computation identity and the derived producer-share admits it -- per-claim re-runs of
+// this fill refused the enrolment margin (~609k eval steps each).
+type VfpFixtureReading {
+  reasons: List<Symbol>
+  construct_read: Symbol
+  construct_read_carrier: Symbol
+  rt_construction_fact: Symbol
+  rt_match_fact: Symbol
+  rt_arm_fact: Symbol
+  nullary_arm_fact: Symbol
+  projection_fact: Symbol
+}
+
+// THE ARROW FIXTURE'S READING: the module whose match scrutinee is a NULLARY CALL -- the N7 shape
+// (g_tokenize_parse matching dag_prepared_grammar()). call_result_fact reads the scrutinee, i.e.
+// the call's derived result type; arrow_arm_fact reads the arm's payload binder.
+type VfpArrowReading {
+  reasons: List<Symbol>
+  construct_read: Symbol
+  call_result_fact: Symbol
+  arrow_arm_fact: Symbol
+}
+
+// PREORDER COLLECTORS over the resolved tree: all matches, and a match's arm bodies in order.
+fn vfp_matches_of(n: Node) -> List<Node> { vfp_matches_of_at(n: n, depth: 24) }
+
+fn vfp_matches_of_at(n: Node, depth: Int) -> List<Node> {
+  match depth <= 0 {
+    true => Empty
+    false =>
+      match n.kind {
+        ComputationNode { behavior: Match } =>
+          Cons { head: n, tail: fold(n.children, init: Empty, f: fn(acc, e) { list_append(left: acc, right: vfp_matches_of_at(n: e.target, depth: depth - 1)) }) }
+        _ =>
+          fold(n.children, init: Empty, f: fn(acc, e) { list_append(left: acc, right: vfp_matches_of_at(n: e.target, depth: depth - 1)) })
+      }
+  }
+}
+
+fn vfp_arm_bodies_of(m: Node) -> List<Node> { vfp_arm_bodies_of_at(m: m, depth: 24) }
+
+// The arm-body edges hang under the match's ARM nodes, not under the match itself, so the walk
+// descends and stays bound (a fixture has no nested matches; the bound guards a cyclic tree).
+fn vfp_arm_bodies_of_at(m: Node, depth: Int) -> List<Node> {
+  match depth <= 0 {
+    true => Empty
+    false =>
+      fold(m.children, init: Empty, f: fn(acc, e) {
+        match e.label {
+          StructuralLabel { label: CoreMarker { marker: MatchArmBodyEdge } } => list_append(left: acc, right: Cons { head: e.target, tail: vfp_arm_bodies_of_at(m: e.target, depth: depth - 1) })
+          _ => list_append(left: acc, right: vfp_arm_bodies_of_at(m: e.target, depth: depth - 1))
+        }
+      })
+  }
+}
+
+fn vfp_first_of(xs: List<Node>) -> Optional<Node> {
+  match xs {
+    Cons { head: h, tail: _ } => Present { value: h }
+    Empty => Absent
+  }
+}
+
+fn vfp_second_of(xs: List<Node>) -> Optional<Node> {
+  match xs {
+    Cons { head: _, tail: t } => vfp_first_of(xs: t)
+    Empty => Absent
+  }
+}
+
+fn vfp_arm_body_first(m: Optional<Node>) -> Optional<Node> {
+  match m {
+    Absent => Absent
+    Present { value: n } => vfp_first_of(xs: vfp_arm_bodies_of(m: n))
+  }
+}
+
+fn vfp_arm_body_second(m: Optional<Node>) -> Optional<Node> {
+  match m {
+    Absent => Absent
+    Present { value: n } => vfp_second_of(xs: vfp_arm_bodies_of(m: n))
+  }
+}
+
+// THE EXHAUSTIVENESS CONTROL: the same carrier with one arm dropped, so the match must refuse for
+// want of coverage -- decided by the single inhabitance relation, which surfaces the established
+// non-exhaustive reason (the same one the inline count it replaced reported).
+
+// THE TEXT ROUTE (DESIGN 3: the subject as authored source). The fact-level probes read the REAL
+// pipeline -- assemble_program_from_ingest, the same tokenize/parse/normalize/resolve/admission the
+// corpus compile runs -- over authored fixture modules. The earlier hand-lowered route
+// (ClaimLoweredModule values built node by node) is retired: reproducing the real lowering's
+// conventions by hand made the probe a second copy of the lowering rather than an observation of
+// it, and its binder minting refused on exactly the conventions it copied (DESIGN 5: the reading
+// must come from the thing itself). The resolve-side and refusal controls ride the same route
+// (vfp_partial_src).
+
+data vfp_fixture_src: String = "module vfp_fixture\n\ntype ParseTree {\n  root: Int\n}\n\ntype Verdict = Pass { at: Int } | Fail\n\nfn make() -> Verdict {\n  Pass { at: 1 }\n}\n\nfn unbox(s: Verdict) -> Int {\n  match s {\n    Pass { at: b1 } => b1\n    Fail => 0\n  }\n}\n\nfn pick(t: ParseTree) -> Int {\n  t.root\n}"
+
+// THE ARROW FIXTURE (the N7 shape): h's match scrutinee is the NULLARY CALL g(), and the arm binds
+// the payload with the SHORTHAND binder (name == field name) -- the two halves of the shape that
+// dies on the native route (g_tokenize_parse matching dag_prepared_grammar(), binding `d`).
+data vfp_arrow_src: String = "module vfp_arrow\n\ntype Result2 = Ok { v: Int } | Bad\n\nfn g() -> Result2 {\n  Ok { v: 7 }\n}\n\nfn h() -> Int {\n  match g() {\n    Ok { v } => v\n    Bad => 0\n  }\n}"
+
+// Each fixture assembles under its own artifact so the two programs never share a source identity;
+// the admission subject must match the module's own declaration.
+fn vfp_assemble_module(src: String, name: Symbol, artifact: Artifact, cu: Symbol) -> Outcome<ResolvedTree> {
+  assemble_program_from_ingest(
+    ingest: Cons {
+      head: DagSourceReadWitness {
+        source: Medium { carried: src, fidelity: Lossless },
+        artifact: artifact,
+        compilation_unit: cu,
+        source_root: V2Tree
+      },
+      tail: Empty
+    },
+    admission: Admission { subject: ResolutionSubject { name: Cons { head: name, tail: Empty } }, imports: Empty },
+    lm: dag_language_model()
+  )
+}
+
+data vfp_variant_artifact: Artifact = Artifact {
+  kind: SourceFile,
+  id: ^variant_field_infer_probe_variant_artifact,
+  file_path: "src/v2/pilot/variant_field_infer_probe_variant_pilot.dag"
+}
+
+data vfp_fixture_artifact: Artifact = Artifact {
+  kind: SourceFile,
+  id: ^variant_field_infer_probe_fixture_artifact,
+  file_path: "src/v2/pilot/variant_field_infer_probe_fixture_pilot.dag"
+}
+
+data vfp_arrow_artifact: Artifact = Artifact {
+  kind: SourceFile,
+  id: ^variant_field_infer_probe_arrow_artifact,
+  file_path: "src/v2/pilot/variant_field_infer_probe_arrow_pilot.dag"
+}
+
+// THE WARM PRODUCERS: vfp_fixture_resolved is what the probe claims share; vfp_fixture_resolved_direct
+// is its own identity so the long-home claim that must bill its own frame is not admitted by the
+// derived producer-share.
+fn vfp_fixture_resolved() -> Outcome<ResolvedTree> {
+  vfp_assemble_module(src: vfp_fixture_src, name: ^vfp_fixture, artifact: vfp_fixture_artifact, cu: ^vfp_fixture_cu)
+}
+
+fn vfp_fixture_resolved_direct() -> Outcome<ResolvedTree> {
+  vfp_assemble_module(src: vfp_fixture_src, name: ^vfp_fixture, artifact: vfp_fixture_artifact, cu: ^vfp_fixture_cu)
+}
+
+fn vfp_arrow_resolved() -> Outcome<ResolvedTree> {
+  vfp_assemble_module(src: vfp_arrow_src, name: ^vfp_arrow, artifact: vfp_arrow_artifact, cu: ^vfp_arrow_cu)
+}
+
+fn vfp_partial_reading() -> VfpReading { vfp_reading(src: vfp_partial_src) }
+
+// THE ARROW FIXTURE, ITS OWN MODULE: the payload field's type is an arrow whose RESULT is the
+// formal (`f: fn(ParseTree) -> T`) -- the one shape the match_binder fixture never exercises, and
+// the current suspect for the grounding cascade. It rides alone so a refusal here cannot take the
+// other readings' facts down with it, and it carries a second consumer claim (its resolve-side
+// construct read) so the derived producer-share admits its fill.
+
+data vfp_partial_src: String = "module p\n\ntype Seal = Boxed(Int) | Held { value: Int }\n\nfn partial(s: Seal) -> Int {\n  match s {\n    Boxed(v) => v\n  }\n}"
+
+
+
+fn vfp_reading(src: String) -> VfpReading {
+  match vfp_assemble(src: src) {
+    Rejected { diagnostics: r } => VfpReading {
+      reasons: vfp_reasons(r: r),
+      construction_fact: r.head.reason,
+      match_fact: r.head.reason,
+      arm_body_fact: r.head.reason,
+      construct_read: ^vfp_refused_at_resolve,
+      construct_read_carrier: ^vfp_refused_at_resolve
+    }
+    Accepted { value: resolved, diagnostics: _ } =>
+      match infer(tree: resolved) {
+        Rejected { diagnostics: r } => VfpReading {
+          reasons: vfp_reasons(r: r),
+          construction_fact: vfp_last(xs: vfp_reasons(r: r)),
+          match_fact: vfp_last(xs: vfp_reasons(r: r)),
+          arm_body_fact: vfp_last(xs: vfp_reasons(r: r)),
+          construct_read: vfp_construct_read_decode(resolved: resolved),
+          construct_read_carrier: vfp_construct_read_carrier_decode(resolved: resolved)
+        }
+        Accepted { value: inferred, diagnostics: d } => VfpReading {
+          reasons: match d {
+            None => [^infers]
+            Some { diagnostics: r } => Cons { head: ^infers, tail: vfp_reasons(r: r) }
+          },
+          construction_fact: vfp_fact_in(
+            inferred: inferred,
+            subject: vfp_find_construction(n: resolved.root)
+          ),
+          match_fact: vfp_fact_in(
+            inferred: inferred,
+            subject: vfp_find_match(n: resolved.root)
+          ),
+          arm_body_fact: vfp_fact_in(
+            inferred: inferred,
+            subject: vfp_arm_body_first(m: vfp_find_match(n: resolved.root))
+          ),
+          construct_read: vfp_construct_read_decode(resolved: resolved),
+          construct_read_carrier: vfp_construct_read_carrier_decode(resolved: resolved)
+        }
+      }
+  }
+}
+
+// THE COMBINED FIXTURE'S PRODUCER: matches appear in fixture declaration order -- unbox, pick,
+// unkeep, useit. The first construct-tagged node in preorder is make's `Boxed(n)`.
+fn vfp_fixture_reading_over(resolved: Outcome<ResolvedTree>) -> VfpFixtureReading {
+  match resolved {
+    Rejected { diagnostics: r } => VfpFixtureReading {
+      reasons: vfp_reasons(r: r),
+      construct_read: ^vfp_refused_at_resolve,
+      construct_read_carrier: ^vfp_refused_at_resolve,
+      rt_construction_fact: r.head.reason,
+      rt_match_fact: r.head.reason,
+      rt_arm_fact: r.head.reason,
+      nullary_arm_fact: r.head.reason,
+      projection_fact: r.head.reason
+    }
+    Accepted { value: resolved, diagnostics: _ } =>
+      match infer(tree: resolved) {
+        Rejected { diagnostics: r } => VfpFixtureReading {
+          reasons: Cons { head: ^infers, tail: vfp_reasons(r: r) },
+          construct_read: vfp_construct_read_decode(resolved: resolved),
+          construct_read_carrier: vfp_construct_read_carrier_decode(resolved: resolved),
+          rt_construction_fact: vfp_last(xs: vfp_reasons(r: r)),
+          rt_match_fact: vfp_last(xs: vfp_reasons(r: r)),
+          rt_arm_fact: vfp_last(xs: vfp_reasons(r: r)),
+          nullary_arm_fact: vfp_last(xs: vfp_reasons(r: r)),
+          projection_fact: vfp_last(xs: vfp_reasons(r: r))
+        }
+        Accepted { value: inferred, diagnostics: d } => VfpFixtureReading {
+          reasons: match d {
+            None => [^infers]
+            Some { diagnostics: r } => Cons { head: ^infers, tail: vfp_reasons(r: r) }
+          },
+          construct_read: vfp_construct_read_decode(resolved: resolved),
+          construct_read_carrier: vfp_construct_read_carrier_decode(resolved: resolved),
+          rt_construction_fact: vfp_fact_in(
+            inferred: inferred,
+            subject: vfp_find_construction(n: resolved.root)
+          ),
+          rt_match_fact: vfp_fact_in(
+            inferred: inferred,
+            subject: vfp_first_of(xs: vfp_matches_of(n: resolved.root))
+          ),
+          rt_arm_fact: vfp_fact_in(
+            inferred: inferred,
+            subject: vfp_arm_body_first(m: vfp_first_of(xs: vfp_matches_of(n: resolved.root)))
+          ),
+          nullary_arm_fact: vfp_fact_in(
+            inferred: inferred,
+            subject: vfp_arm_body_second(m: vfp_first_of(xs: vfp_matches_of(n: resolved.root)))
+          ),
+          projection_fact: vfp_fact_in(
+            inferred: inferred,
+            subject: vfp_find_projection(n: resolved.root)
+          )
+        }
+      }
+  }
+}
+
+// THE COMBINED FIXTURE'S PRODUCER: matches appear in fixture declaration order -- unbox, pick,
+// unkeep. The first construct-tagged node in preorder is make's `Boxed(n)`.
+fn vfp_fixture_reading() -> VfpFixtureReading {
+  vfp_fixture_reading_over(resolved: vfp_fixture_resolved())
+}
+
+// THE COMBINED FIXTURE'S OWN-FRAME READING: a separate computation identity from the warm producer
+// so the long-home claim that must bill its own frame is not admitted by the derived
+// producer-share.
+fn vfp_reading_direct() -> VfpReading {
+  let r = vfp_fixture_reading_over(resolved: vfp_fixture_resolved_direct())
+  VfpReading {
+    reasons: r.reasons,
+    construction_fact: r.rt_construction_fact,
+    match_fact: r.rt_match_fact,
+    arm_body_fact: r.rt_arm_fact,
+    construct_read: r.construct_read,
+    construct_read_carrier: r.construct_read_carrier
+  }
+}
+
+fn vfp_arrow_reading_over(resolved: Outcome<ResolvedTree>) -> VfpArrowReading {
+  match resolved {
+    Rejected { diagnostics: r } => VfpArrowReading {
+      reasons: vfp_reasons(r: r),
+      construct_read: ^vfp_refused_at_resolve,
+      call_result_fact: r.head.reason,
+      arrow_arm_fact: r.head.reason
+    }
+    Accepted { value: resolved, diagnostics: _ } =>
+      match infer(tree: resolved) {
+        Rejected { diagnostics: r } => VfpArrowReading {
+          reasons: vfp_reasons(r: r),
+          construct_read: vfp_construct_read_decode(resolved: resolved),
+          call_result_fact: vfp_last(xs: vfp_reasons(r: r)),
+          arrow_arm_fact: vfp_last(xs: vfp_reasons(r: r))
+        }
+        Accepted { value: inferred, diagnostics: d } => VfpArrowReading {
+          reasons: match d {
+            None => [^infers]
+            Some { diagnostics: r } => Cons { head: ^infers, tail: vfp_reasons(r: r) }
+          },
+          construct_read: vfp_construct_read_decode(resolved: resolved),
+          call_result_fact: vfp_fact_in(
+            inferred: inferred,
+            subject: vfp_match_scrutinee(m: vfp_first_of(xs: vfp_matches_of(n: resolved.root)))
+          ),
+          arrow_arm_fact: vfp_fact_in(
+            inferred: inferred,
+            subject: vfp_arm_body_first(m: vfp_first_of(xs: vfp_matches_of(n: resolved.root)))
+          )
+        }
+      }
+  }
+}
+
+// THE ARROW FIXTURE'S PRODUCER.
+fn vfp_arrow_reading() -> VfpArrowReading {
+  vfp_arrow_reading_over(resolved: vfp_arrow_resolved())
+}
+
+// THE CLAIMS OVER THE ROUND-TRIP FIXTURE. The RESOLVE-side rows (construction carrier, construct
+// read, its carrier) ground on the text route. The INFER typed-fact rows over the two-arm
+// param-scrutinee match DO NOT: the walk refuses at the match node with infer_match_arm_type_mismatch
+// (terminal, under active bisect in #13210) while the resolver's own binder records carry the
+// canonical payload type -- so those rows are DECLARED REDS on that specific located defect, not
+// positives; the positive evidence for the typed payload-binder facts is the ARROW fixture's arm row
+// (accepted-with-advisories walk) and the enrolled native claims on the real route.
+// The construction green cannot hold on the fixture module while the two-arm mismatch stands: infer
+// refuses the fixture MODULE-WIDE (the match's arm types), so every fact field on this reading reads
+// the terminal reason, construction included. The construction-typing invariant is pinned on the
+// route by the ARROW fixture's greens (whose module grounds); this row is a DECLARED RED on the
+// located module refusal until the two-arm fix flips it.
+test fn vfp_the_fixture_construction_fact_reads_the_module_refusal_red() -> Bool {
+  vfp_fixture_reading().rt_construction_fact == ^infer_match_arm_type_mismatch
+}
+
+test fn vfp_the_construct_read_names_the_variant_holds() -> Bool {
+  vfp_fixture_reading().construct_read == ^Pass
+}
+
+test fn vfp_the_construct_read_carrier_is_the_declaring_coproduct_holds() -> Bool {
+  vfp_fixture_reading().construct_read_carrier == ^Verdict
+}
+
+// DECLARED RED (the two-arm mismatch): the terminal diagnostic is anchored at the match node itself,
+// and the reading's fact fields read that terminal reason on a refused walk. This row goes green
+// exactly when the mismatch is understood and fixed or the fixture's context stops producing it.
+test fn vfp_the_two_arm_match_refuses_with_the_located_mismatch_red() -> Bool {
+  vfp_fixture_reading().rt_match_fact == ^infer_match_arm_type_mismatch
+}
+
+// THE COVERAGE CONTROL: a one-arm match over a two-variant carrier must refuse, and the refusal must
+// be the non-exhaustive reason the coverage obligation reports on the inhabitance relation's refusal.
+test fn vfp_the_partial_match_refuses_as_not_covering_the_carrier_holds() -> Bool {
+  vfp_reports(reading: vfp_partial_reading(), reason: ^infer_match_non_exhaustive)
+}
+
+// THE CALL-RESULT SCRUTINEE (the N7 shape): h's match scrutinee is the nullary call `g()`. At the
+// assembled route the call's derived result type does not reach the facts (the walk reports
+// infer_match_scrutinee_type_underived, advisory), so the coverage check runs undecidable and the
+// ARM BINDER still types from the payload -- the row below pins the binder; this row pins the
+// KNOWN route gap on the scrutinee's own fact so the gap cannot silently become a pass.
+test fn vfp_the_call_result_scrutinee_fact_stays_underived_on_the_assembled_route_red() -> Bool {
+  vfp_arrow_reading().call_result_fact == ^vfp_underived
+}
+
+// DECLARED RED: same refused walk as the two-arm mismatch row -- the projection's fact reads the
+// terminal reason until the mismatch is settled.
+test fn vfp_the_projection_fact_reads_the_located_refusal_red() -> Bool {
+  vfp_fixture_reading().projection_fact == ^infer_match_arm_type_mismatch
+}
+
+// DECLARED RED: the nullary arm rides the same refused walk. When the mismatch settles, this row
+// flips to `== ^Int` beside the arrow binder row.
+test fn vfp_the_nullary_arm_fact_reads_the_located_refusal_red() -> Bool {
+  vfp_fixture_reading().nullary_arm_fact == ^infer_match_arm_type_mismatch
+}
+
+// THE PAYLOAD-BINDER REGRESSION CONTROL (the N7 shape, flipped from the declared red per DESIGN
+// 4b(4)): before the payload reader landed, the arm binder's fact lookup was Absent -- NO_ENTRY,
+// warm-ferret-741's N7 locate of #2891785 (facts.lookup Absent under the #2891781
+// GroundingNotDerived parent) -- and the declared-red row asserting that defect value went red the
+// moment the reader landed. Flipped, it does not retire: the binder on the CALL-RESULT scrutinee
+// (the shape that dies on the native route) must read its payload field's type -- the regression
+// guard the param-scrutinee positive control does not cover.
+test fn vfp_the_call_result_arm_binder_types_from_its_payload_field_holds() -> Bool {
+  vfp_arrow_reading().arrow_arm_fact == ^Int
+}
+
+// THE ARROW FIXTURE'S RESOLVE-SIDE CONTROL (its second consumer claim): resolve must bind the
+// module's sole variant tag so the construct read names Ok, separating resolve binding from
+// whatever the infer facts say about the call-result scrutinee.
+test fn vfp_the_arrow_fixture_resolves_and_names_its_variant_holds() -> Bool {
+  vfp_arrow_reading().construct_read == ^Ok
+}
+// THE RESOLVE-SIDE CONTROL ON THE SAME READING: even while infer refuses the partial match for
+// want of coverage, resolve has already bound the construction's tag to its variant's declaring
+// path -- the control separates the resolve binding (green on both sides of the fix) from the
+// infer facts (red on main, green here), and gives the partial reading its second consumer under
+// the warm-producer sharing conjunct.
+test fn vfp_the_partial_fixture_still_mints_its_variant_row_holds() -> Bool {
+  vfp_partial_reading().construct_read == ^Boxed
+}
+
+// THE BISECT FIXTURES THE LEDGER CITES (temporary; they go out when their rows' follow-ups
+// land): the nullary single-arm sum the single_arm_sum_parses_as_an_alias row's 2026-10-06
+// receipt cites, and the recursive record the grounding-cascade row cites.
+
+
+// TEMPORARY DECODE INSTRUMENT -- the one reading for the combined fixture: prints every field
+// through `gunbc run --function` so the actual values are readable, not guessed. DELETED WITH THE
+// RFM RETIREMENT RECEIPT.
+fn vfp_decode_fixture_reading(r: VfpFixtureReading) -> CliWireResponse {
+  CliWirePrintable { bytes: "read=" + symbol_lexeme(sym: r.construct_read) + " carr=" + symbol_lexeme(sym: r.construct_read_carrier) + " rt_constr=" + symbol_lexeme(sym: r.rt_construction_fact) + " rt_match=" + symbol_lexeme(sym: r.rt_match_fact) + " rt_arm=" + symbol_lexeme(sym: r.rt_arm_fact) + " null_arm=" + symbol_lexeme(sym: r.nullary_arm_fact) + " proj=" + symbol_lexeme(sym: r.projection_fact) + " reasons=" + fold(r.reasons, init: "", f: fn(acc, sym) { acc + "/" + symbol_lexeme(sym: sym) }), exit: ExitSuccess }
+}
+
+fn vfp_decode_fixture() -> CliWireResponse { vfp_decode_fixture_reading(r: vfp_fixture_reading()) }
+
+fn vfp_decode_arrow_reading(r: VfpArrowReading) -> CliWireResponse {
+  CliWirePrintable { bytes: "arr_read=" + symbol_lexeme(sym: r.construct_read) + " scrut=" + symbol_lexeme(sym: r.call_result_fact) + " arr=" + symbol_lexeme(sym: r.arrow_arm_fact) + " arr_reasons=" + fold(r.reasons, init: "", f: fn(acc, sym) { acc + "/" + symbol_lexeme(sym: sym) }), exit: ExitSuccess }
+}
+
+fn vfp_decode_arrow() -> CliWireResponse { vfp_decode_arrow_reading(r: vfp_arrow_reading()) }
+
+// THE FORMAL-PAYLOAD GATE (side-chat review 5452786886): a pattern binder whose variant field is
+// typed by the DECLARING TYPE's formal must refuse the PREPARE stage -- a typed, located refusal
+// (^resolve_reason_pattern_payload_formal_uninstantiated, at the payload field), not an advisory
+// frontier the module could prepare under and the native lane could report as prepared. The
+// concrete sibling beside it runs the same two-arm shape with a CONCRETE Int payload and prepares
+// (accepted, with this route's known advisories), isolating the formal as the refusal's cause. Its
+// match sits over the fixture's construction because a match over a variant-typed PARAMETER refuses
+// on this route with the declared two-arm defect regardless of payload (the red the two-arm claim
+// carries), so the parameter shape cannot serve as the preparing sibling. The red flips to grounding
+// when the deep-instantiation follow-up installs the scrutinee's arguments into the arm frame.
+data vfp_formal_gate_src: String = "module p\n\ntype Out<T> = Acc { value: T } | Rej\n\nfn read(x: Out<Int>) -> Int {\n  match x {\n    Acc { value: v } => v\n    Rej => 0\n  }\n}"
+
+data vfp_formal_gate_concrete_src: String = "module p\n\ntype Out = Acc { value: Int } | Rej\n\nfn make() -> Out {\n  Acc { value: 5 }\n}\n\nfn id(n: Int) -> Int {\n  n\n}\n\nfn read() -> Int {\n  match make() {\n    Acc { value: v } => id(5)\n    Rej => 0\n  }\n}"
+
+fn vfp_formal_gate_reading() -> VfpReading { vfp_reading(src: vfp_formal_gate_src) }
+
+fn vfp_formal_gate_concrete_reading() -> VfpReading { vfp_reading(src: vfp_formal_gate_concrete_src) }
+
+// ONE WARM NULLARY PRODUCER for both formal-gate claims (the match_binder pattern
+// mbt_program_reading uses): two claims demanding one producer put its least common ancestor at
+// the shared preparation frame, so the two fixture fills run once and each claim's own frame is
+// its field reads -- per-fixture fills measured 341,777 and 727,954 eval steps against the 72,300
+// new-witness budget on floor run 37757604769 when each claim demanded its own fill.
+type VfpFormalGatePair {
+  formal: VfpReading
+  concrete: VfpReading
+}
+
+fn vfp_formal_gate_pair() -> VfpFormalGatePair {
+  VfpFormalGatePair {
+    formal: vfp_formal_gate_reading(),
+    concrete: vfp_formal_gate_concrete_reading()
+  }
+}
+
+test fn vfp_the_formal_payload_binder_refuses_at_prepare_red() -> Bool {
+  vfp_formal_gate_pair().formal.match_fact == ^resolve_reason_pattern_payload_formal_uninstantiated
+}
+
+test fn vfp_the_concrete_payload_sibling_still_prepares_holds() -> Bool {
+  vfp_infers(reading: vfp_formal_gate_pair().concrete)
+}
diff --git a/src/v2/test/lens_common/infer_fixture.dag b/src/v2/test/lens_common/infer_fixture.dag
index c6d2cca2bd4..a77e6441a48 100644
--- a/src/v2/test/lens_common/infer_fixture.dag
+++ b/src/v2/test/lens_common/infer_fixture.dag
@@ -1,4 +1,5 @@
 module v2.test.lens_common.infer_fixture
+import v2.std.member_declaration_kind { no_member_declaration_kinds }
 import std.optional { optional_absent }
 
 import std.occurrence_identity { OccurrenceSynthetic }
@@ -33,7 +34,7 @@ import std.algebra { Cons }
 // resolution consulted; a supplied tree was never resolved, so it carries an index holding NO
 // declarations -- the name says so, and a declaration lookup through it finds nothing and refuses.
 fn claim_resolved_tree_without_declarations(root: Node) -> ResolvedTree {
-  ResolvedTree { root: root, symbol_index: empty_symbol_index(), resolved_declarations: empty_symbol_index(), lexical_bindings: empty_map(), unavailable_providers: [] }
+  ResolvedTree { root: root, symbol_index: empty_symbol_index(), resolved_declarations: empty_symbol_index(), lexical_bindings: empty_map(), unavailable_providers: [], member_kinds: no_member_declaration_kinds() }
 }
 
 fn claim_atom_node(s: Symbol) -> Node {
@@ -234,7 +235,8 @@ fn claim_resolved_call_tree(
       params: params
     ),
     lexical_bindings: empty_map(),
-    unavailable_providers: []
+    unavailable_providers: [],
+    member_kinds: no_member_declaration_kinds()
   }
 }
 
@@ -297,7 +299,8 @@ fn claim_resolved_projection_tree(
       params: [param]
     ),
     lexical_bindings: empty_map(),
-    unavailable_providers: unavailable
+    unavailable_providers: unavailable,
+    member_kinds: no_member_declaration_kinds()
   }
 }
 
diff --git a/src/v2/test/lens_lifecycle_carrier/raw_prose_field_flagged_test.dag b/src/v2/test/lens_lifecycle_carrier/raw_prose_field_flagged_test.dag
index bb4e93af12f..1525dc4b07d 100644
--- a/src/v2/test/lens_lifecycle_carrier/raw_prose_field_flagged_test.dag
+++ b/src/v2/test/lens_lifecycle_carrier/raw_prose_field_flagged_test.dag
@@ -1,17 +1,28 @@
 module v2.test.lens_lifecycle_carrier.raw_prose_field_flagged
 
 import std.occurrence_identity { OccurrenceSynthetic }
+import v2.compiler.compile {
+  lifecycle_carrier_lens,
+  run_required_lens_gates_on_subtree
+}
+import v2.compiler.infer { InferredTree }
 import v2.lens.lifecycle_carrier { lifecycle_carrier_gate }
 import v2.std.diagnostic { Accepted, Rejected }
 import v2.std.node {
   Atom,
+  Arrow,
   Conj,
   Edge,
   Authored,
   Node,
+  Positional,
   Symbol,
   TypeNode,
 }
+import v2.test.lens_common.infer_fixture {
+  claim_inferred_facts,
+  claim_inferred_tree
+}
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import v2.std.node_query { binder_edge }
 
@@ -112,3 +123,56 @@ test fn ordinary_string_field_is_accepted() -> Bool {
     Rejected { diagnostics: _ } => false
   }
 }
+
+// RED (parameter domain): fn f(dissolve_on: String) -> Int. The domain Conj is a record
+// carrier; fold_node must still reach it under the Arrow (not stop at Arrow).
+data arrow_param_domain: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    binder_edge(name: ^dissolve_on, type_node: string_leaf_target)
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+data arrow_param_codomain: Node = Node {
+  kind: TypeNode { connective: Atom { identity: ^Int } },
+  children: [],
+  occurrence_id: OccurrenceSynthetic
+}
+
+data arrow_with_dissolve_on_param: Node = Node {
+  kind: TypeNode { connective: Arrow },
+  children: [
+    Edge { label: Positional, target: arrow_param_domain },
+    Edge { label: Positional, target: arrow_param_codomain }
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+fn arrow_param_tree() -> InferredTree {
+  claim_inferred_tree(
+    root: arrow_with_dissolve_on_param,
+    facts: claim_inferred_facts(
+      type_symbol: ^arrow_param_type_sym,
+      algebra_symbol: ^arrow_param_algebra_sym,
+      descent_symbol: ^arrow_param_descent_sym
+    )
+  )
+}
+
+test fn arrow_parameter_dissolve_on_string_is_rejected_on_the_domain() -> Bool {
+  match lifecycle_carrier_gate(node: arrow_param_domain) {
+    Rejected { diagnostics: r } => r.head.reason == ^lifecycle_carrier_raw_prose_field
+    Accepted { value: _, diagnostics: _ } => false
+  }
+}
+
+test fn subtree_walk_reaches_arrow_parameter_dissolve_on() -> Bool {
+  match run_required_lens_gates_on_subtree(
+    inferred: arrow_param_tree(),
+    lenses: [lifecycle_carrier_lens]
+  ) {
+    Rejected { diagnostics: r } => r.head.reason == ^lifecycle_carrier_raw_prose_field
+    Accepted { value: _, diagnostics: _ } => false
+  }
+}
diff --git a/src/v2/test/lens_unit_modeling/module_container_not_judged_as_record_carrier_test.dag b/src/v2/test/lens_unit_modeling/module_container_not_judged_as_record_carrier_test.dag
new file mode 100644
index 00000000000..16a0f328b00
--- /dev/null
+++ b/src/v2/test/lens_unit_modeling/module_container_not_judged_as_record_carrier_test.dag
@@ -0,0 +1,324 @@
+module v2.test.lens_unit_modeling.module_container_not_judged_as_record_carrier
+
+import std.occurrence_identity { OccurrenceSynthetic }
+import v2.compiler.compile {
+  CompileLensSubtree,
+  required_lenses_at_grain,
+  run_required_lens_gates_on_subtree
+}
+import v2.compiler.infer { InferredTree }
+import v2.lens.lifecycle_carrier { lifecycle_carrier_gate }
+import v2.lens.unit_modeling { unit_modeling_gate }
+import v2.std.diagnostic { Accepted, Rejected }
+import v2.std.node {
+  Atom,
+  Arrow,
+  ComputationNode,
+  Conj,
+  Edge,
+  Authored,
+  Node,
+  TypeNode,
+  Value,
+}
+import v2.test.lens_common.infer_fixture {
+  claim_inferred_facts,
+  claim_inferred_tree
+}
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import v2.std.node_query { binder_edge }
+import v2.extdeps.languages.dag {
+  dag_grammar_atom,
+  dag_node_is_module_surface,
+  dag_node_is_record_field_carrier,
+  dag_surface_edge_label
+}
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// GREEN: a Conj whose Authored member is a synthetic dag_surface_module Atom. The PARENT
+// remains a record-field carrier (a module-surface child does not opt the whole Conj out).
+// The member is skipped because its TARGET is a module surface, per-edge.
+data module_surface_atom: Node = Node {
+  kind: TypeNode { connective: Atom { identity: ^dag_surface_module } },
+  children: [],
+  occurrence_id: OccurrenceSynthetic
+}
+
+data module_container_root: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge { label: Authored { name: ^child_mod }, target: module_surface_atom }
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+fn module_container_tree() -> InferredTree {
+  claim_inferred_tree(
+    root: module_container_root,
+    facts: claim_inferred_facts(
+      type_symbol: ^mod_container_type_sym,
+      algebra_symbol: ^mod_container_algebra_sym,
+      descent_symbol: ^mod_container_descent_sym
+    )
+  )
+}
+
+test fn module_container_with_a_module_surface_child_is_still_a_record_field_carrier() -> Bool {
+  dag_node_is_record_field_carrier(node: module_container_root)
+}
+
+test fn unit_modeling_accepts_a_module_container() -> Bool {
+  match unit_modeling_gate(node: module_container_root) {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+test fn lifecycle_carrier_accepts_a_module_container() -> Bool {
+  match lifecycle_carrier_gate(node: module_container_root) {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: _ } => false
+  }
+}
+
+// The door used to refuse this shape with member_not_a_binder at the module-surface child
+// before later lenses (mandatory_tag at root grain among them) ran. After the carrier
+// narrowing, that cause is gone. A later subtree lens may still refuse a different class
+// (fact_density on a bare identity Atom is a separate subject).
+test fn subtree_required_lenses_do_not_refuse_member_not_a_binder_on_a_module_container() -> Bool {
+  match run_required_lens_gates_on_subtree(
+    inferred: module_container_tree(),
+    lenses: required_lenses_at_grain(grain: CompileLensSubtree)
+  ) {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: r } => r.head.reason != ^member_not_a_binder
+  }
+}
+
+data malformed_record_root: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge {
+      label: Authored { name: ^x },
+      target: Node {
+        kind: TypeNode { connective: Atom { identity: ^Text } },
+        children: [],
+        occurrence_id: OccurrenceSynthetic
+      }
+    }
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+// RED: a payload Conj whose Authored member is not a binder is still refused. The carrier
+// narrowing must not swallow this wall.
+test fn a_hand_built_record_field_is_still_member_not_a_binder() -> Bool {
+  match unit_modeling_gate(node: malformed_record_root) {
+    Rejected { diagnostics: r } => r.head.reason == ^member_not_a_binder
+    Accepted { value: _, diagnostics: _ } => false
+  }
+}
+
+// RED (review 77884): a user field whose name happens to be a parse-projection spelling
+// is still a record field. Skip those names only on a module-surface carrier.
+data projection_named_record_root: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge {
+      label: Authored { name: ^grammar_production_identity_node_projection },
+      target: Node {
+        kind: TypeNode { connective: Atom { identity: ^Text } },
+        children: [],
+        occurrence_id: OccurrenceSynthetic
+      }
+    }
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+test fn a_projection_spelled_record_field_is_still_member_not_a_binder() -> Bool {
+  match unit_modeling_gate(node: projection_named_record_root) {
+    Rejected { diagnostics: r } => r.head.reason == ^member_not_a_binder
+    Accepted { value: _, diagnostics: _ } => false
+  }
+}
+
+data record_with_binder: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    binder_edge(
+      name: ^note,
+      type_node: Node {
+        kind: TypeNode { connective: Atom { identity: ^Text } },
+        children: [],
+        occurrence_id: OccurrenceSynthetic
+      }
+    )
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+test fn a_binder_payload_is_still_a_record_field_carrier() -> Bool {
+  dag_node_is_record_field_carrier(node: record_with_binder)
+}
+
+data mixed_int_leaf: Node = Node {
+  kind: TypeNode { connective: Atom { identity: ^dag_binding_type_int } },
+  children: [],
+  occurrence_id: OccurrenceSynthetic
+}
+
+// RED (review 38602): a Conj that CONTAINS a module-surface member must still judge its
+// other members. A clock_hz binder typed as bare Int was refused before the container-wide
+// skip and must stay refused.
+data mixed_module_and_unit_field_root: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge { label: Authored { name: ^child_mod }, target: module_surface_atom },
+    binder_edge(name: ^clock_hz, type_node: mixed_int_leaf)
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+test fn a_mixed_conj_still_refuses_a_bare_int_unit_field() -> Bool {
+  match unit_modeling_gate(node: mixed_module_and_unit_field_root) {
+    Rejected { diagnostics: r } => r.head.reason == ^unit_modeling_flat_scalar_unit_leaf_fixable
+    Accepted { value: _, diagnostics: _ } => false
+  }
+}
+
+// RED (review 77837): skipping every Conj/Arrow/ComputationNode member would swallow a
+// real record field. Only module-surface and fn-decl identities skip.
+data conj_shaped_member_root: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge {
+      label: Authored { name: ^payload },
+      target: Node {
+        kind: TypeNode { connective: Conj },
+        children: [],
+        occurrence_id: OccurrenceSynthetic
+      }
+    }
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+test fn a_conj_shaped_record_field_is_still_member_not_a_binder() -> Bool {
+  match unit_modeling_gate(node: conj_shaped_member_root) {
+    Rejected { diagnostics: r } => r.head.reason == ^member_not_a_binder
+    Accepted { value: _, diagnostics: _ } => false
+  }
+}
+
+data arrow_shaped_member_root: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge {
+      label: Authored { name: ^payload },
+      target: Node {
+        kind: TypeNode { connective: Arrow },
+        children: [],
+        occurrence_id: OccurrenceSynthetic
+      }
+    }
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+test fn an_arrow_shaped_record_field_is_still_member_not_a_binder() -> Bool {
+  match unit_modeling_gate(node: arrow_shaped_member_root) {
+    Rejected { diagnostics: r } => r.head.reason == ^member_not_a_binder
+    Accepted { value: _, diagnostics: _ } => false
+  }
+}
+
+data computation_shaped_member_root: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge {
+      label: Authored { name: ^payload },
+      target: Node {
+        kind: ComputationNode { behavior: Value },
+        children: [],
+        occurrence_id: OccurrenceSynthetic
+      }
+    }
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+test fn a_computation_shaped_record_field_is_still_member_not_a_binder() -> Bool {
+  match unit_modeling_gate(node: computation_shaped_member_root) {
+    Rejected { diagnostics: r } => r.head.reason == ^member_not_a_binder
+    Accepted { value: _, diagnostics: _ } => false
+  }
+}
+
+data unstamped_conj_with_module_header_edge: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge {
+      label: dag_surface_edge_label(edge: ^dag_surface_module_header),
+      target: dag_grammar_atom(id: ^dag_surface_module_header)
+    },
+    Edge {
+      label: Authored { name: ^x },
+      target: Node {
+        kind: TypeNode { connective: Atom { identity: ^Text } },
+        children: [],
+        occurrence_id: OccurrenceSynthetic
+      }
+    }
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+test fn an_unstamped_conj_is_not_a_module_surface_just_because_it_has_a_header_edge() -> Bool {
+  dag_node_is_module_surface(node: unstamped_conj_with_module_header_edge) == false
+}
+
+test fn an_unstamped_conj_with_a_header_edge_is_still_a_record_field_carrier() -> Bool {
+  dag_node_is_record_field_carrier(node: unstamped_conj_with_module_header_edge)
+}
+
+test fn an_unstamped_header_edge_conj_still_refuses_member_not_a_binder() -> Bool {
+  match unit_modeling_gate(node: unstamped_conj_with_module_header_edge) {
+    Rejected { diagnostics: r } => r.head.reason == ^member_not_a_binder
+    Accepted { value: _, diagnostics: _ } => false
+  }
+}
+
+// GREEN: the exception is producer identity dag_surface_fn_decl on the member, not Conj shape.
+data fn_decl_identity_atom: Node = Node {
+  kind: TypeNode { connective: Atom { identity: ^dag_surface_fn_decl } },
+  children: [],
+  occurrence_id: OccurrenceSynthetic
+}
+
+data stamped_fn_shell: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge {
+      label: Authored { name: ^grammar_production_identity_node_projection },
+      target: fn_decl_identity_atom
+    }
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+data module_with_stamped_fn_member: Node = Node {
+  kind: TypeNode { connective: Conj },
+  children: [
+    Edge { label: Authored { name: ^f }, target: stamped_fn_shell }
+  ],
+  occurrence_id: OccurrenceSynthetic
+}
+
+test fn a_stamped_fn_decl_member_is_not_member_not_a_binder() -> Bool {
+  match unit_modeling_gate(node: module_with_stamped_fn_member) {
+    Accepted { value: _, diagnostics: _ } => true
+    Rejected { diagnostics: r } => r.head.reason != ^member_not_a_binder
+  }
+}
diff --git a/src/v2/test/manual/parse_forensics_scaling_witness.dag b/src/v2/test/manual/parse_forensics_scaling_witness.dag
deleted file mode 100644
index 0dc39364715..00000000000
--- a/src/v2/test/manual/parse_forensics_scaling_witness.dag
+++ /dev/null
@@ -1,70 +0,0 @@
-module v2.test.manual.parse_forensics_scaling_witness
-
-// adhoc-c328b166-bca interpreted-parse cost forensics: per-file packrat memo stats
-// (hits/misses/lookup_calls) at increasing corpus-file sizes, timed externally via `time
-// ./target/release/gunbc run --claim-run`. One fn per fixture file so each can be timed as an
-// isolated process (amortizes nothing; each pays full corpus-load overhead, which is the point --
-// wall time here is (fixed load) + (parse cost) and the parse-cost delta across sizes is read off
-// the growth curve, not the absolute number).
-
-fn forensics_scaling_stats_for_path(path: String) -> ParseMemoStats {
-  let lm = dag_language_model()
-  let at = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^parse_forensics_scaling_witness_grammar_contract)
-  let source_text = filesystem_read(path: path).content
-  match tokenize(text: source_text, file: ^parse_forensics_scaling_file_anchor, rules: lm.lex) {
-    Rejected { diagnostics: _ } =>
-      ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-    Accepted { value: stream, diagnostics: _ } =>
-      match lm.grammar {
-        ModeledGrammar { root: root } =>
-          match grammar_validate_for_parse(root: root, at: at) {
-            Rejected { diagnostics: _ } =>
-              ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-            Accepted { value: validated, diagnostics: _ } =>
-              parse_production_memo_stats(
-                tokens: token_stream_remaining(stream: stream),
-                validated: validated,
-                production_name: validated.root.start,
-                materialization: Memoize
-              )
-          }
-        VoidGrammar =>
-          ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-      }
-  }
-}
-
-fn forensics_scaling_report(path: String) -> List<Int> {
-  let stats = forensics_scaling_stats_for_path(path: path)
-  Cons {
-    head: stats.hits,
-    tail: Cons {
-      head: stats.misses,
-      tail: Cons { head: stats.lookup_calls, tail: std.algebra.Empty }
-    }
-  }
-}
-
-fn witness_forensics_scale_tiny_report() -> List<Int> {
-  forensics_scaling_report(path: "src/v2/std/witness.dag")
-}
-
-fn witness_forensics_scale_small_report() -> List<Int> {
-  forensics_scaling_report(path: "dag/std/execution_mode.dag")
-}
-
-fn witness_forensics_scale_medium_report() -> List<Int> {
-  forensics_scaling_report(path: "src/v2/std/datetime.dag")
-}
-
-fn witness_forensics_scale_bisect_report() -> List<Int> {
-  forensics_scaling_report(path: "/tmp/claude-1000/-home-briansrls--worktrees-gunbc-neat-stag-780/8faadfe5-0411-48d9-980a-f8a213df0415/scratchpad/bisect/datetime_half.dag")
-}
-
-fn witness_forensics_scale_mediumlarge_report() -> List<Int> {
-  forensics_scaling_report(path: "src/v2/std/node.dag")
-}
-
-fn witness_forensics_scale_large_report() -> List<Int> {
-  forensics_scaling_report(path: "src/v2/std/grammar.dag")
-}
diff --git a/src/v2/test/manual/parse_table_memo_scale_witness.dag b/src/v2/test/manual/parse_table_memo_scale_witness.dag
deleted file mode 100644
index ec83d974965..00000000000
--- a/src/v2/test/manual/parse_table_memo_scale_witness.dag
+++ /dev/null
@@ -1,85 +0,0 @@
-module v2.test.manual.parse_table_memo_scale_witness
-
-
-
-data parse_memo_scale_tokenize_path: String = "src/v1/01_tokenize.dag"
-
-fn parse_memo_scale_stats_for_grammar(
-  source_text: String,
-  grammar: ParseGrammar
-) -> ParseMemoStats {
-  let lm = dag_language_model()
-  let at = invariant_port_locus(port: ^parse_stage_locus_port, invariant: ^parse_table_memo_scale_witness_grammar_contract)
-  match tokenize(text: source_text, file: ^parse_memo_scale_file_anchor, rules: lm.lex) {
-    Rejected { diagnostics: _ } =>
-      ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-    Accepted { value: stream, diagnostics: _ } =>
-      match grammar {
-        ModeledGrammar { root: root } =>
-          match grammar_validate_for_parse(root: root, at: at) {
-            Rejected { diagnostics: _ } =>
-              ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-            Accepted { value: validated, diagnostics: _ } =>
-              parse_production_memo_stats(
-                tokens: token_stream_remaining(stream: stream),
-                validated: validated,
-                production_name: validated.root.start,
-                materialization: Memoize
-              )
-          }
-        VoidGrammar =>
-          ParseMemoStats { hits: 0, misses: 0, lookup_calls: 0 }
-      }
-  }
-}
-
-fn parse_memo_scale_tokenize_stats() -> ParseMemoStats {
-  let source_text = filesystem_read(path: parse_memo_scale_tokenize_path).content
-  parse_memo_scale_stats_for_grammar(
-    source_text: source_text,
-    grammar: dag_language_model().grammar
-  )
-}
-
-fn witness_parse_memo_scale_tokenize_hits() -> Int {
-  parse_memo_scale_tokenize_stats().hits
-}
-
-fn witness_parse_memo_scale_tokenize_misses() -> Int {
-  parse_memo_scale_tokenize_stats().misses
-}
-
-fn witness_parse_memo_scale_tokenize_lookup_calls() -> Int {
-  parse_memo_scale_tokenize_stats().lookup_calls
-}
-
-fn witness_parse_memo_scale_tokenize_report() -> List<Int> {
-  let stats = parse_memo_scale_tokenize_stats()
-  Cons {
-    head: stats.hits,
-    tail: Cons {
-      head: stats.misses,
-      tail: Cons { head: stats.lookup_calls, tail: std.algebra.Empty }
-    }
-  }
-}
-
-fn witness_stage_tokenize_only_holds() -> Bool {
-  let lm = dag_language_model()
-  let source_text = filesystem_read(path: parse_memo_scale_tokenize_path).content
-  match tokenize(text: source_text, file: ^parse_memo_scale_file_anchor, rules: lm.lex) {
-    Accepted { value: _, diagnostics: _ } => true
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn witness_stage_parse_only_holds() -> Bool {
-  let source_text = filesystem_read(path: parse_memo_scale_tokenize_path).content
-  match parse_memo_scale_stats_for_grammar(
-    source_text: source_text,
-    grammar: dag_language_model().grammar
-  ) {
-    ParseMemoStats { hits: _, misses: misses, lookup_calls: calls } =>
-      (misses > 0) && (calls > 0)
-  }
-}
diff --git a/src/v2/test/manual/s1_stall_probe.dag b/src/v2/test/manual/s1_stall_probe.dag
index 55302c4c98d..b7ee303b95a 100644
--- a/src/v2/test/manual/s1_stall_probe.dag
+++ b/src/v2/test/manual/s1_stall_probe.dag
@@ -23,7 +23,7 @@ fn stall_offset(path: String) -> Int {
                     tokens: tokens,
                     all_tokens: tokens,
                     root: validated.root,
-                    table: parse_table_for_production(validated: validated, all_tokens: tokens, materialization: Memoize),
+                    table: parse_table_for_production(validated: validated, all_tokens: tokens),
                     prov: parse_prov_initial()
                   ) {
                     ParseExprRejected { diagnostics: _, table: _ } => 0 - 2
diff --git a/src/v2/test/native_file_refusal_locus_test.dag b/src/v2/test/native_file_refusal_locus_test.dag
index 30dcaa4ba95..c39b633509c 100644
--- a/src/v2/test/native_file_refusal_locus_test.dag
+++ b/src/v2/test/native_file_refusal_locus_test.dag
@@ -23,10 +23,10 @@ fn at_text(file: Symbol, start: Int) -> Diagnostic {
   }
 }
 
-fn residue_head() -> Diagnostic {
+fn advisory_head() -> Diagnostic {
   Diagnostic {
-    reason: ^parse_grammar_choice_overlap_residue,
-    at: invariant_port_locus(port: ^native_file_refusal_locus_port, invariant: ^grammar_choice_overlap),
+    reason: ^tokenize_lex_e1_unrecognized_char,
+    at: invariant_port_locus(port: ^native_file_refusal_locus_port, invariant: ^tokenize_lex_e1_unrecognized_char),
     correction: Unavailable { reason: ExternalContractUnknown }
   }
 }
@@ -39,7 +39,7 @@ fn located_row() -> NativeTestFileRefusal {
   native_test_file_refusal(
     path: ^native_file_refusal_locus_fixture,
     module: optional_absent(),
-    d: NonEmptyDiagnostics { head: residue_head(), tail: [at_text(file: ^native_file_refusal_locus_fixture, start: 4)] },
+    d: NonEmptyDiagnostics { head: advisory_head(), tail: [at_text(file: ^native_file_refusal_locus_fixture, start: 4)] },
     spans: span_index_empty(),
     text: "\u{00e9}\u{000a}ab"
   )
diff --git a/src/v2/test/v2_native_route_test.dag b/src/v2/test/v2_native_route_test.dag
index 62282253d3f..fe48f961066 100644
--- a/src/v2/test/v2_native_route_test.dag
+++ b/src/v2/test/v2_native_route_test.dag
@@ -190,7 +190,7 @@ fn receipt_over(
     false_control: Present { value: NativeTestReturnedFalse },
     true_control: Present { value: NativeTestPassed },
     malformed_control: MalformedSpecimenRefused {
-      path: "target/v2-native-lane/malformed-control-root/poison.dag",
+      path: "target/v2-native-lane/malformed-control-root/dag/poison.dag",
       reason: ^tokenize_lex_e1_unterminated_string
     },
     old_route_control: OldRouteWithdrawn { withdrawn_executable: "/seed/gunbc" },
@@ -906,7 +906,7 @@ test fn an_unattributed_file_refusal_is_refused() -> Bool {
       population: [passed_row(module: "v2.test.alpha", declaration: "passes")],
       file_refusals: [file_refusal_row(
         path: ^some_path,
-        head: ^parse_grammar_choice_overlap_residue,
+        head: ^tokenize_lex_e1_unrecognized_char,
         fatal: ^some_unowned_cause
       )]
     )),
@@ -921,10 +921,10 @@ test fn an_unattributed_file_refusal_is_refused() -> Bool {
 // cause has no ownership row still fails it, so the owned rows did not become a catch-all.
 fn body_lowering_frontier_refusals() -> List<NativeTestFileRefusal> {
   [
-    file_refusal_row(path: ^bl_a, head: ^parse_grammar_choice_overlap_residue, fatal: ^body_lowering_reason_call_argument_unread),
-    file_refusal_row(path: ^bl_b, head: ^parse_grammar_choice_overlap_residue, fatal: ^body_lowering_reason_operator_operand_unread),
-    file_refusal_row(path: ^bl_c, head: ^parse_grammar_choice_overlap_residue, fatal: ^body_lowering_reason_type_annotation_not_carried),
-    file_refusal_row(path: ^bl_d, head: ^parse_grammar_choice_overlap_residue, fatal: ^body_lowering_reason_paren_group_unread)
+    file_refusal_row(path: ^bl_a, head: ^tokenize_lex_e1_unrecognized_char, fatal: ^body_lowering_reason_call_argument_unread),
+    file_refusal_row(path: ^bl_b, head: ^tokenize_lex_e1_unrecognized_char, fatal: ^body_lowering_reason_operator_operand_unread),
+    file_refusal_row(path: ^bl_c, head: ^tokenize_lex_e1_unrecognized_char, fatal: ^body_lowering_reason_type_annotation_not_carried),
+    file_refusal_row(path: ^bl_d, head: ^tokenize_lex_e1_unrecognized_char, fatal: ^body_lowering_reason_paren_group_unread)
   ]
 }
 
@@ -949,7 +949,7 @@ test fn an_unknown_fatal_cause_beside_the_owned_ones_still_refuses_unowned() ->
     module_source_index: [],
     population: [],
     file_refusals: Cons {
-      head: file_refusal_row(path: ^bl_e, head: ^parse_grammar_choice_overlap_residue, fatal: ^some_unowned_cause),
+      head: file_refusal_row(path: ^bl_e, head: ^tokenize_lex_e1_unrecognized_char, fatal: ^some_unowned_cause),
       tail: body_lowering_frontier_refusals()
     }
   ))
@@ -1025,7 +1025,7 @@ test fn a_context_refusal_backed_by_another_modules_file_is_refused() -> Bool {
       ],
       file_refusals: [file_refusal_row(
         path: ^alpha_path,
-        head: ^parse_grammar_choice_overlap_residue,
+        head: ^tokenize_lex_e1_unrecognized_char,
         fatal: ^parse_g0_tokens_remain
       )]
     )),
@@ -1056,7 +1056,7 @@ test fn a_context_refusal_at_its_own_path_with_the_wrong_reason_is_refused() ->
       ],
       file_refusals: [file_refusal_row(
         path: ^beta_path,
-        head: ^parse_grammar_choice_overlap_residue,
+        head: ^tokenize_lex_e1_unrecognized_char,
         fatal: ^resolve_module_not_found
       )]
     )),
@@ -1091,7 +1091,7 @@ test fn a_context_refusal_backed_by_its_file_refusal_is_not_refused_on_that_clau
     ],
     file_refusals: [file_refusal_row(
       path: ^beta_path,
-      head: ^parse_grammar_choice_overlap_residue,
+      head: ^tokenize_lex_e1_unrecognized_char,
       fatal: ^parse_g0_tokens_remain
     )]
   ))
@@ -1613,8 +1613,8 @@ fn native_route_tally_probe() -> List<NativeRouteCauseTally> {
     module_source_index: [],
     population: [],
     file_refusals: [
-      file_refusal_row(path: ^tally_a, head: ^parse_grammar_choice_overlap_residue, fatal: ^parse_g0_tokens_remain),
-      file_refusal_row(path: ^tally_b, head: ^parse_grammar_choice_overlap_residue, fatal: ^parse_g0_tokens_remain),
+      file_refusal_row(path: ^tally_a, head: ^tokenize_lex_e1_unrecognized_char, fatal: ^parse_g0_tokens_remain),
+      file_refusal_row(path: ^tally_b, head: ^tokenize_lex_e1_unrecognized_char, fatal: ^parse_g0_tokens_remain),
       file_refusal_row(path: ^tally_c, head: ^resolve_reason_unbound_symbol, fatal: ^resolve_reason_unbound_symbol)
     ]
   ))
diff --git a/src/v2/workflow/ci_floor_peak_emit.dag b/src/v2/workflow/ci_floor_peak_emit.dag
index b67e21419dd..2dcaffbc265 100644
--- a/src/v2/workflow/ci_floor_peak_emit.dag
+++ b/src/v2/workflow/ci_floor_peak_emit.dag
@@ -68,21 +68,16 @@ data ci_floor_peak_nearest_ancestor_spec: NearestAncestorContaining = NearestAnc
 // reimplementing the parser. Peak reset/cat/echo calibration leaves stay raw String — Phase 2 typed
 // filesystem observation.
 
-data ci_floor_peak_path_model_refused_poison: String = "__GUNBC_PATH_INTENT_LOWERING_REFUSED__ floor-peak cgroup path-intent leaf lowering was rejected by v2.extdeps.languages.bash_orch_if; this marker is not valid workflow shell, so the committed ci.yml drift gate goes red (DESIGN 5: refuse, never widen). WHY A POISON RATHER THAN EMPTY TEXT, on the measured facts rather than the intuitive ones: the Run.command seam is String-typed and cannot carry an Outcome, so the refusal arm has to be SOME string, and the sibling witness file's model-text helpers return \"\" there. An earlier draft of this row justified the poison by claiming an empty while-condition is an always-true loop that would spin forever. THAT IS FALSE, tested 2026-08-05 against /bin/sh, /bin/dash and /bin/bash: 'while ; do' is a SYNTAX ERROR in all three, so an empty leaf would fail loudly rather than hang. The real argument is smaller and survives the correction. An empty String is a well-typed, ordinary-looking value flowing through an untyped seam; it says nothing about which lowering refused or why, and its first observable symptom is a shell parse failure inside a generated workflow — attributed to ci.yml at CI runtime, several layers from the path model that actually refused. The poison carries the cause to the place the reader lands. In practice the drift gate catches either one, because both differ from the committed bytes; what the poison buys is a LOCATED refusal instead of an anonymous one, which is the half of DESIGN section 5 that a mere red does not supply."
-
 fn ci_floor_peak_assign_cgroup_dir_command() -> String {
-  let cmd = bash_nearest_ancestor_locate_assign_command(spec: ci_floor_peak_nearest_ancestor_spec)
-  if cmd == "" { ci_floor_peak_path_model_refused_poison } else { cmd }
+  bash_nearest_ancestor_locate_assign_command(spec: ci_floor_peak_nearest_ancestor_spec)
 }
 
 fn ci_floor_peak_while_cond_command() -> String {
-  let cmd = bash_nearest_ancestor_locate_cond_command(spec: ci_floor_peak_nearest_ancestor_spec)
-  if cmd == "" { ci_floor_peak_path_model_refused_poison } else { cmd }
+  bash_nearest_ancestor_locate_cond_command(spec: ci_floor_peak_nearest_ancestor_spec)
 }
 
 fn ci_floor_peak_while_body_command() -> String {
-  let cmd = bash_nearest_ancestor_locate_body_command(spec: ci_floor_peak_nearest_ancestor_spec)
-  if cmd == "" { ci_floor_peak_path_model_refused_poison } else { cmd }
+  bash_nearest_ancestor_locate_body_command(spec: ci_floor_peak_nearest_ancestor_spec)
 }
 
 data ci_floor_peak_test_f_memory_peak_command: String = "[ -f \"$d/memory.peak\" ]"
diff --git a/src/v2/workflow/compile_door_cause_ownership.dag b/src/v2/workflow/compile_door_cause_ownership.dag
index e8d0bcf3bf7..869e94d081c 100644
--- a/src/v2/workflow/compile_door_cause_ownership.dag
+++ b/src/v2/workflow/compile_door_cause_ownership.dag
@@ -57,12 +57,12 @@ data known_frontier_causes: List<CauseOwnership> = [
   CauseOwnership {
     cause: ^member_not_a_binder,
     lane: MigrationOwned,
-    flip_trigger: "RETIRED WHEN v2.lens.lifecycle_carrier and v2.lens.unit_modeling narrow their carrier predicate so that a node whose Authored members are module surface nodes (a container of modules, not a record or payload type) is never judged as a record carrier; this row is then deleted and the door-ledger long test's member_not_a_binder count returns to zero. DIAGNOSIS (advisories step 2, bold-lynx-438): reading the fatal element exposed this cause on dag/std/error_primitives.dag and dag/std/bit.dag. Each refusal is located at the TARGET of the offending member edge, a synthetic dag_surface_module node: both lenses fold every TypeNode's Authored children through v2.std.node_query member_edge_type_node and refuse a child that is not a binder, and a node carrying modules as Authored members reaches that fold. That is a lens defect (the carrier predicate admits a module container), not a correct refusal of these subjects. It was masked at head grain by parse_grammar_choice_overlap_residue. The fix is owned by its own work item, not this row"
+    flip_trigger: "KEEP until an executed door-ledger census of dag/std/error_primitives.dag and dag/std/bit.dag shows member_not_a_binder at zero on those subjects (fatals moved), then delete this row. The carrier predicate no longer judges a module-surface Authored member as a record field; that is not by itself the census. DIAGNOSIS (advisories step 2, bold-lynx-438): reading the fatal element exposed this cause on those two files at synthetic dag_surface_module targets. Do not retire on an unrelated histogram substitution."
   },
   CauseOwnership {
     cause: ^parse_g0_tokens_remain,
     lane: MigrationOwned,
-    flip_trigger: "no per-cause trigger — same grammar-surgery class as parse_grammar_choice_overlap_residue (nimble-boar-198). Measured 2026-09-09 by the gunbc.witness_v2_native_route census as the fatal refusal on 706 real v2.test.* modules through the emitted native binary"
+    flip_trigger: "no per-cause trigger — grammar-surgery class (nimble-boar-198). Measured 2026-09-09 by the gunbc.witness_v2_native_route census as the fatal refusal on 706 real v2.test.* modules through the emitted native binary"
   },
   CauseOwnership {
     cause: ^tokenize_lex_e1_unrecognized_char,
@@ -117,7 +117,7 @@ data known_frontier_causes: List<CauseOwnership> = [
   CauseOwnership {
     cause: ^body_lowering_reason_unrecognised_lowered_shape,
     lane: SharedSelfHostCriticalPath,
-    flip_trigger: "a reader in v2.compiler.body_lowering_fold meets a node that is lowered output (no grammar projection edge) but that body_lower_is_core_substrate does not name, and refuses at it instead of re-reading it as raw parse and answering a part of it (body_lower_is_unrecognised_lowered_shape). The MQ-5 census found no producer that reaches this today. Flips when every producer declares the shape it emits (LoweredShape carried in a BodyTerm through the reducers, neat-boar-16 ruling 2026-09-30), so a reader never classifies a node by shape and the reason has no producer (gunbc.recurring_failure_mode lowered_output_reread_as_raw_parse_at_v2_body_lowering)"
+    flip_trigger: "v2.compiler.body_lowering_fold body_term_of reads a node in the fold's tree that is neither under the sealed Lowered marker a producer writes (body_term_seal), nor a composite the parse stamped, nor a leaf, and refuses at it: lowered output no producer declared, never re-read as raw parse. Since MQ-5 every producer seals its result and the shape allowlist is deleted, so this fires only on an unsealed producer output. Flips when the fold's tree is a typed BodyTerm term tree that normalize consumes, so an unsealed composite has no representation and the reason has no producer (gunbc.recurring_failure_mode lowered_output_reread_as_raw_parse_at_v2_body_lowering)"
   },
   CauseOwnership {
     cause: ^body_lowering_reason_pattern_form_not_admitted,
diff --git a/src/v2/workflow/emitted_closure_crate_partition.dag b/src/v2/workflow/emitted_closure_crate_partition.dag
index 4f0a816e80e..3edc5d1704c 100644
--- a/src/v2/workflow/emitted_closure_crate_partition.dag
+++ b/src/v2/workflow/emitted_closure_crate_partition.dag
@@ -1,5 +1,22 @@
 module v2.workflow.emitted_closure_crate_partition
 
+import gunbc.crate_partition {
+  crate_partition_declared_core_target,
+  ModuleDagEdge,
+  ModuleId,
+  PartitionPolicy,
+  PolicyPartitionParam,
+  ResolvePartitionOutcome
+}
+
+import gunbc.crate_partition {
+  PartitionPolicy,
+  PolicyPartitionParam,
+  ResolvePartitionOutcome,
+  ModuleDagEdge,
+  ModuleId
+}
+
 import std.types { List, String, Bool, Int, Map }
 import v2.std.algebra { any }
 import v2.workflow.compiler_closure_ingest_transport { closure_entry }
@@ -10,17 +27,11 @@ import v2.lens.module_graph {
   dependency_resolution_facts_live,
   module_declaration_facts_live
 }
-import v2.std.collection { empty_map, map_get, map_insert }
+import v2.std.collection { empty_map, map_get_checked, map_insert }
 import v2.std.diagnostic { Accepted, Rejected }
 import std.optional { Absent, Optional, Present }
-import v2.std.compilers.compilation_unit { ModuleDag, ModuleDagEdge, ModuleId }
-import v2.workflow.rust_crate_partition {
-  PartitionPolicy,
-  PolicyPartitionParam,
-  ResolvePartitionOutcome,
-  resolve_partition_outcome,
-  rust_crate_partition_declared_core_target
-}
+import v2.std.compilers.compilation_unit { ModuleDag }
+import v2.workflow.rust_crate_partition { resolve_partition_outcome }
 
 // THE MODULE DAG OF THE RETAINED EMITTED COMPILER CLOSURE, DERIVED -- NOT AUTHORED. The subject is
 // the closure the self-host route emits: v2.compiler.compile's, whose entry is imported from its
@@ -58,7 +69,7 @@ fn emitted_closure_module_by_path(
   closure: Map<String, Bool>
 ) -> Map<String, String> {
   declarations |> fold(init: empty_map(), f: fn(acc, decl) {
-    match map_get(closure, decl.path) {
+    match map_get_checked(closure, decl.path) {
       Accepted { value: Present { value: _ }, diagnostics: _ } => map_insert(acc, decl.path, decl.module)
       Accepted { value: Absent, diagnostics: _ } => acc
       Rejected { diagnostics: _ } => acc
@@ -67,7 +78,7 @@ fn emitted_closure_module_by_path(
 }
 
 fn emitted_closure_module_at(by_path: Map<String, String>, path: String) -> Optional<String> {
-  match map_get(by_path, path) {
+  match map_get_checked(by_path, path) {
     Accepted { value: found, diagnostics: _ } => found
     Rejected { diagnostics: _ } => Absent
   }
@@ -115,7 +126,7 @@ fn closure_edge_step(
           if !edge.target_declared {
             unresolved
           } else {
-            match map_get(module_set, edge.target_module) {
+            match map_get_checked(module_set, edge.target_module) {
               Accepted { value: Present { value: _ }, diagnostics: _ } =>
                 if importer == edge.target_module {
                   acc
@@ -204,6 +215,6 @@ fn derived_policy_partition(derivation: ModuleDagDerivation, policy: PartitionPo
 fn emitted_compiler_closure_policy_partition() -> EmittedClosurePartitionOutcome {
   derived_policy_partition(
     derivation: emitted_compiler_closure_module_dag(),
-    policy: PartitionPolicy { target_crate_count: rust_crate_partition_declared_core_target }
+    policy: PartitionPolicy { target_crate_count: crate_partition_declared_core_target }
   )
 }
diff --git a/src/v2/workflow/emitted_crate_workspace.dag b/src/v2/workflow/emitted_crate_workspace.dag
deleted file mode 100644
index 171f33e1c45..00000000000
--- a/src/v2/workflow/emitted_crate_workspace.dag
+++ /dev/null
@@ -1,474 +0,0 @@
-module v2.workflow.emitted_crate_workspace
-
-import std.types { List, String, Bool, Int, NonEmptyStr }
-import v2.std.collection { empty_map, map_get, map_insert }
-import std.optional { Absent, Optional, Present, optional_present }
-import v2.std.diagnostic { Accepted, Rejected }
-import v2.std.compilers.compilation_unit {
-  CompilationUnitId,
-  ModuleDag,
-  ModuleDagEdge,
-  ModuleId,
-  list_unique_sorted_ids
-}
-import gunbc.rust_emitted_edge {
-  EmittedEdge,
-  EmittedEdgeProvenance,
-  EmittedModuleTarget,
-  EmittedCrateRootTarget,
-  RuntimePrelude,
-  ReexportFacade,
-  SemanticSourceReference,
-  rust_module_emit_filename,
-  rust_emit_only_basenames,
-  rust_runtime_prelude_module
-}
-import gunbc.stage0_crate_partition_generated {
-  GeneratedPartitionCrateRow,
-  GeneratedFoundationCrate,
-  GeneratedLayeredCoreCrate
-}
-import v2.workflow.emitted_closure_crate_partition {
-  ModuleDagDerivationRefusal,
-  ModuleDagDerived,
-  ModuleDagDerivationRefused,
-  emitted_compiler_closure_module_dag
-}
-import v2.workflow.rust_crate_partition {
-  EmittedEdgeRefusal,
-  ModuleDagEmittedMerged,
-  ModuleDagEmittedRefused,
-  PartitionPolicy,
-  PolicyPartitionParam,
-  ResolvePartitionOk,
-  ResolvePartitionRefused,
-  ResolvePartitionRefusalCause,
-  Stage0FoundationCrate,
-  Stage0LayeredCoreCrate,
-  Stage0PartitionCrateRow,
-  UnitDepEdge,
-  DerivedDepPackagesOk,
-  DerivedDepPackagesUnitHasNoRow,
-  assignment_unit_dep_edges,
-  derived_dep_packages,
-  module_dag_with_emitted_edges,
-  resolve_partition_outcome,
-  rust_crate_partition_declared_core_target,
-  unit_dep_closure,
-  unit_direct_deps
-}
-
-// THE EMITTED COMPILER CLOSURE AS A CARGO WORKSPACE, DERIVED (Pkg7d render, Pkg7e build).
-//
-// Every fact here is derived, and none is read from the committed stage0 rows: the module DAG is
-// v2.workflow.emitted_closure_crate_partition's derivation from the live dependency facts; the
-// emitter's own edges (gunbc.rust_emitted_edge, returned beside the text by the emission this
-// workspace is built from) are merged into it with the typed reverse-edge refusal; the balanced
-// policy assigns modules to units; and each unit's dependency packages are the TRANSITIVE CLOSURE
-// of the unit dep edges the assignment induces (rust_crate_partition derived_dep_packages, the
-// #12035 derivation). The rows produced here have the shape v1.compiler.stage0_crates renders, so
-// the manifests and lib.rs files come from the one partition renderer, not a second one.
-//
-// WHAT THE FACADE PROVES AND WHAT IT DOES NOT. A layered crate's lib.rs re-exports every package in
-// its transitive dependency closure as `pub use <ident>::*;`, which is how an emitted
-// `crate::<module>::` path resolves in a crate that does not own the module. That is an
-// OVER-APPROXIMATION of the direct edges, deliberately: the inline paths the expression emitter
-// writes are not returned as edges (gunbc.guarantee_stall
-// emitted_inline_crate_path_edges_unreturned_stall), so the facade must cover what the edge set
-// cannot name. The plan reports whether the facade degenerates to the whole closure
-// (facade_is_whole_closure) so a green over that degenerate case is never read as a partition.
-//
-// A DAG module is placed by the basename the emitter writes for it (gunbc.rust_emitted_edge
-// rust_module_emit_filename, the one home of that rule, which the edge rows name endpoints by). The
-// caller supplies the basenames the emission actually wrote. The two closures -- the one the live
-// dependency facts derive and the one the emission compiled -- must be the SAME population: a DAG
-// module whose file the emission did not produce, and an emitted file that is neither a DAG module
-// nor the runtime, are refused together, every member named, never narrowed to the intersection.
-
-type EmittedWorkspaceRefusal
-  = EmittedWorkspaceDagRefused { cause: ModuleDagDerivationRefusal }
-  | EmittedWorkspaceBasenameShared { basename: String }
-  | EmittedWorkspaceClosuresDisagree { not_emitted: List<String>, outside_dag: List<String> }
-  | EmittedWorkspaceEdgeListsMisaligned { froms: Int, tos: Int, provenances: Int }
-  | EmittedWorkspaceEdgeProvenanceUnknown { provenance: String }
-  | EmittedWorkspaceEdgeMergeRefused { cause: EmittedEdgeRefusal }
-  | EmittedWorkspacePartitionRefused { cause: ResolvePartitionRefusalCause }
-  | EmittedWorkspaceUnitHasNoRow { unit_id: CompilationUnitId }
-  | EmittedWorkspaceNoDiscriminatingEdge
-
-// The one crate dependency the RED drops: a direct unit dep edge in the TRANSITIVE REDUCTION (no
-// other dependency of the source crate reaches the target, so no glob facade can re-export it by
-// another road) that the emitter also wrote as a use-line from a source-crate module into a
-// target-crate module, so rustc has a path that must stop resolving.
-type EmittedWorkspaceRedDrop {
-  package: String
-  dropped_package: String
-  from_module: String
-  to_module: String
-}
-
-type EmittedWorkspacePlan {
-  rows: List<GeneratedPartitionCrateRow>
-  red_rows: List<GeneratedPartitionCrateRow>
-  red: EmittedWorkspaceRedDrop
-  module_count: Int
-  crate_count: Int
-  facade_is_whole_closure: Bool
-}
-
-type EmittedWorkspaceOutcome
-  = EmittedWorkspacePlanned { plan: EmittedWorkspacePlan }
-  | EmittedWorkspaceRefused { cause: EmittedWorkspaceRefusal }
-
-data emitted_workspace_runtime_package: String = "v2-emitted-runtime"
-
-fn emitted_workspace_package(unit_id: CompilationUnitId) -> String {
-  concat("v2-emitted-", unit_id as String)
-}
-
-fn emitted_workspace_crate_dir(package: String) -> String {
-  concat("src/v1/", package)
-}
-
-fn emitted_workspace_lookup(m: Map<String, String>, key: String) -> Optional<String> {
-  match map_get(m, key) {
-    Accepted { value: found, diagnostics: _ } => found
-    Rejected { diagnostics: _ } => Absent
-  }
-}
-
-fn emitted_workspace_provenance(name: String) -> Optional<EmittedEdgeProvenance> {
-  if name == "runtime-prelude" { optional_present(value: RuntimePrelude) }
-  else if name == "reexport-facade" { optional_present(value: ReexportFacade) }
-  else if name == "semantic-source-reference" { optional_present(value: SemanticSourceReference) }
-  else { Absent }
-}
-
-type SharedBasenameScan {
-  seen: Map<String, String>
-  shared: Optional<String>
-}
-
-// The DAG's modules by their emitted basename. Two modules projecting to one basename would write
-// one file, so that is refused rather than letting the second overwrite the first.
-fn emitted_workspace_basename_index(module_dag: ModuleDag) -> BasenameIndexBuild {
-  let scan = module_dag.modules |> fold(init: SharedBasenameScan { seen: empty_map(), shared: Absent }, f: fn(acc, m) {
-    match acc.shared {
-      Present { value: _ } => acc
-      Absent => {
-        let b = rust_module_emit_filename(module_name: m as String)
-        match emitted_workspace_lookup(m: acc.seen, key: b) {
-          Present { value: _ } => SharedBasenameScan { seen: acc.seen, shared: optional_present(value: b) }
-          Absent => SharedBasenameScan { seen: map_insert(acc.seen, b, m as String), shared: Absent }
-        }
-      }
-    }
-  })
-  match scan.shared {
-    Present { value: b } => BasenameIndexRefused { cause: EmittedWorkspaceBasenameShared { basename: b } }
-    Absent => BasenameIndexOk { module_by_basename: scan.seen }
-  }
-}
-
-type BasenameIndexBuild
-  = BasenameIndexOk { module_by_basename: Map<String, String> }
-  | BasenameIndexRefused { cause: EmittedWorkspaceRefusal }
-
-type EdgeListBuild
-  = EdgeListOk { edges: List<EmittedEdge> }
-  | EdgeListRefused { cause: EmittedWorkspaceRefusal }
-
-fn emitted_workspace_edges(froms: List<String>, tos: List<String>, provenances: List<String>) -> EdgeListBuild {
-  if ((froms |> count) != (tos |> count)) || ((froms |> count) != (provenances |> count)) {
-    EdgeListRefused { cause: EmittedWorkspaceEdgeListsMisaligned { froms: froms |> count, tos: tos |> count, provenances: provenances |> count } }
-  } else {
-    froms |> enumerate |> fold(init: EdgeListOk { edges: [] }, f: fn(acc, pair) {
-      match acc {
-        EdgeListRefused { cause: c } => EdgeListRefused { cause: c }
-        EdgeListOk { edges: edges } => {
-          let to = match tos |> get(pair.first) { Present { value: t } => t  Absent => "" }
-          let provenance_name = match provenances |> get(pair.first) { Present { value: n } => n  Absent => "" }
-          match emitted_workspace_provenance(name: provenance_name) {
-            Absent => EdgeListRefused { cause: EmittedWorkspaceEdgeProvenanceUnknown { provenance: provenance_name } }
-            Present { value: p } =>
-              EdgeListOk {
-                edges: edges |> list_push(EmittedEdge {
-                  from: pair.second,
-                  to: if to == "" { EmittedCrateRootTarget } else { EmittedModuleTarget { module: to } },
-                  provenance: p
-                })
-              }
-          }
-        }
-      }
-    })
-  }
-}
-
-// The derived DAG in BASENAME space, with the runtime module as a node, because that is the space
-// the emitter's edges and the rendered includes speak.
-type BasenameDagBuild
-  = BasenameDagOk { module_dag: ModuleDag }
-  | BasenameDagRefused { cause: EmittedWorkspaceRefusal }
-
-fn emitted_workspace_basename_dag(module_dag: ModuleDag, module_by_basename: Map<String, String>, emitted_basenames: List<String>) -> BasenameDagBuild {
-  let emitted_set = emitted_basenames |> fold(init: empty_map(), f: fn(acc, b) { map_insert(acc, b, b) })
-  let not_emitted = module_dag.modules |> filter(m =>
-    match emitted_workspace_lookup(m: emitted_set, key: rust_module_emit_filename(module_name: m as String)) { Present { value: _ } => false  Absent => true })
-  let outside = emitted_basenames |> filter(b =>
-    b != rust_runtime_prelude_module
-      && !(rust_emit_only_basenames |> any(e => e == b))
-      && match emitted_workspace_lookup(m: module_by_basename, key: b) { Present { value: _ } => false  Absent => true })
-  if ((not_emitted |> count) + (outside |> count)) > 0 {
-    BasenameDagRefused {
-      cause: EmittedWorkspaceClosuresDisagree {
-        not_emitted: not_emitted |> map(m => m as String),
-        outside_dag: outside
-      }
-    }
-  } else {
-    BasenameDagOk {
-      module_dag: ModuleDag {
-        modules: concat(
-          module_dag.modules |> map(m => rust_module_emit_filename(module_name: m as String) as ModuleId),
-          [rust_runtime_prelude_module as ModuleId]
-        ),
-        edges: module_dag.edges |> map(e => ModuleDagEdge {
-          from: rust_module_emit_filename(module_name: e.from as String) as ModuleId,
-          to: rust_module_emit_filename(module_name: e.to as String) as ModuleId
-        }),
-        exports: empty_map(),
-        type_definitions: empty_map()
-      }
-    }
-  }
-}
-
-// The runtime is a FIXED foundation crate every unit depends on, so the policy partitions the
-// closure without it: an edge into the runtime is a dependency on the runtime package, never a
-// reason to place a closure module beside it.
-fn emitted_workspace_without_runtime(module_dag: ModuleDag) -> ModuleDag {
-  ModuleDag {
-    modules: module_dag.modules |> filter(m => (m as String) != rust_runtime_prelude_module),
-    edges: module_dag.edges |> filter(e => (e.from as String) != rust_runtime_prelude_module && (e.to as String) != rust_runtime_prelude_module),
-    exports: module_dag.exports,
-    type_definitions: module_dag.type_definitions
-  }
-}
-
-fn emitted_workspace_unit_rows(modules: List<ModuleId>, assignment: Map<ModuleId, CompilationUnitId>, unit_ids: List<CompilationUnitId>) -> List<Stage0PartitionCrateRow> {
-  unit_ids |> map(unit_id => {
-    let package = emitted_workspace_package(unit_id: unit_id)
-    Stage0PartitionCrateRow {
-      unit_id: unit_id,
-      package_name: package,
-      crate_dir: emitted_workspace_crate_dir(package: package),
-      kind: Stage0LayeredCoreCrate,
-      modules: modules |> filter(m => match map_get(assignment, m) {
-          Accepted { value: Present { value: u }, diagnostics: _ } => u == unit_id
-          Accepted { value: Absent, diagnostics: _ } => false
-          Rejected { diagnostics: _ } => false
-        }) |> map(m => m as String) |> sort_by(m => m),
-      reexport_packages: [],
-      carries_non_empty_wrappers: false
-    }
-  })
-}
-
-fn emitted_workspace_generated_row(row: Stage0PartitionCrateRow, reexports: List<String>) -> GeneratedPartitionCrateRow {
-  GeneratedPartitionCrateRow {
-    package_name: row.package_name,
-    crate_dir: row.crate_dir,
-    kind: GeneratedLayeredCoreCrate,
-    modules: row.modules,
-    reexport_packages: reexports,
-    carries_non_empty_wrappers: false
-  }
-}
-
-fn emitted_workspace_runtime_row(emitted_basenames: List<String>) -> GeneratedPartitionCrateRow {
-  GeneratedPartitionCrateRow {
-    package_name: emitted_workspace_runtime_package,
-    crate_dir: emitted_workspace_crate_dir(package: emitted_workspace_runtime_package),
-    kind: GeneratedFoundationCrate,
-    modules: concat([rust_runtime_prelude_module], rust_emit_only_basenames |> filter(e => emitted_basenames |> any(b => b == e))),
-    reexport_packages: [],
-    carries_non_empty_wrappers: true
-  }
-}
-
-type DerivedRowsBuild
-  = DerivedRowsOk { rows: List<GeneratedPartitionCrateRow> }
-  | DerivedRowsRefused { cause: EmittedWorkspaceRefusal }
-
-fn emitted_workspace_derived_rows(unit_rows: List<Stage0PartitionCrateRow>, unit_edges: List<UnitDepEdge>, emitted_basenames: List<String>) -> DerivedRowsBuild {
-  unit_rows |> fold(init: DerivedRowsOk { rows: [emitted_workspace_runtime_row(emitted_basenames: emitted_basenames)] }, f: fn(acc, row) {
-    match acc {
-      DerivedRowsRefused { cause: c } => DerivedRowsRefused { cause: c }
-      DerivedRowsOk { rows: rows } =>
-        match derived_dep_packages(edges: unit_edges, rows: unit_rows, row: row) {
-          DerivedDepPackagesUnitHasNoRow { unit_id: u } => DerivedRowsRefused { cause: EmittedWorkspaceUnitHasNoRow { unit_id: u } }
-          DerivedDepPackagesOk { packages: packages } =>
-            DerivedRowsOk {
-              rows: rows |> list_push(emitted_workspace_generated_row(
-                row: row,
-                reexports: concat([emitted_workspace_runtime_package], packages |> sort_by(p => p))
-              ))
-            }
-        }
-    }
-  })
-}
-
-fn emitted_workspace_unit_of(assignment: Map<ModuleId, CompilationUnitId>, module: String) -> Optional<CompilationUnitId> {
-  match map_get(assignment, module as ModuleId) {
-    Accepted { value: owner, diagnostics: _ } => owner
-    Rejected { diagnostics: _ } => Absent
-  }
-}
-
-// An edge (from_unit -> to_unit) of the unit graph is in the TRANSITIVE REDUCTION when no OTHER
-// direct dependency of from_unit reaches to_unit. Only such an edge can be dropped without another
-// crate's glob facade re-exporting the target by a second road.
-fn emitted_workspace_edge_is_irredundant(unit_edges: List<UnitDepEdge>, from_unit: CompilationUnitId, to_unit: CompilationUnitId) -> Bool {
-  let others = unit_direct_deps(edges: unit_edges, unit_id: from_unit) |> filter(d => d != to_unit)
-  !(unit_dep_closure(edges: unit_edges, acc: others, fuel: (unit_edges |> count) + 1) |> any(u => u == to_unit))
-}
-
-fn emitted_workspace_red(
-  edges: List<EmittedEdge>,
-  assignment: Map<ModuleId, CompilationUnitId>,
-  unit_edges: List<UnitDepEdge>
-) -> Optional<EmittedWorkspaceRedDrop> {
-  edges |> fold(init: Absent, f: fn(acc, edge) {
-    match acc {
-      Present { value: _ } => acc
-      Absent =>
-        match edge.provenance {
-          SemanticSourceReference =>
-            match edge.to {
-              EmittedCrateRootTarget => Absent
-              EmittedModuleTarget { module: to_module } =>
-                match emitted_workspace_unit_of(assignment: assignment, module: edge.from) {
-                  Absent => Absent
-                  Present { value: from_unit } =>
-                    match emitted_workspace_unit_of(assignment: assignment, module: to_module) {
-                      Absent => Absent
-                      Present { value: to_unit } =>
-                        if from_unit != to_unit && emitted_workspace_edge_is_irredundant(unit_edges: unit_edges, from_unit: from_unit, to_unit: to_unit) {
-                          optional_present(
-                            value: EmittedWorkspaceRedDrop {
-                              package: emitted_workspace_package(unit_id: from_unit),
-                              dropped_package: emitted_workspace_package(unit_id: to_unit),
-                              from_module: edge.from,
-                              to_module: to_module
-                            }
-                          )
-                        } else { Absent }
-                    }
-                }
-            }
-          RuntimePrelude => Absent
-          ReexportFacade => Absent
-        }
-    }
-  })
-}
-
-fn emitted_workspace_red_rows(rows: List<GeneratedPartitionCrateRow>, red: EmittedWorkspaceRedDrop) -> List<GeneratedPartitionCrateRow> {
-  rows |> map(row =>
-    if row.package_name == red.package {
-      GeneratedPartitionCrateRow {
-        package_name: row.package_name,
-        crate_dir: row.crate_dir,
-        kind: row.kind,
-        modules: row.modules,
-        reexport_packages: row.reexport_packages |> filter(p => p != red.dropped_package),
-        carries_non_empty_wrappers: row.carries_non_empty_wrappers
-      }
-    } else { row }
-  )
-}
-
-fn emitted_workspace_facade_is_whole_closure(rows: List<GeneratedPartitionCrateRow>) -> Bool {
-  let layered = rows |> filter(r => r.package_name != emitted_workspace_runtime_package)
-  layered |> all(r => (r.reexport_packages |> count) == (rows |> count) - 1)
-}
-
-fn emitted_workspace_plan_over(
-  module_dag: ModuleDag,
-  emitted_basenames: List<String>,
-  edge_froms: List<String>,
-  edge_tos: List<String>,
-  edge_provenances: List<String>,
-  target_crate_count: Int
-) -> EmittedWorkspaceOutcome {
-  match emitted_workspace_basename_index(module_dag: module_dag) {
-    BasenameIndexRefused { cause: c } => EmittedWorkspaceRefused { cause: c }
-    BasenameIndexOk { module_by_basename: module_by_basename } =>
-      match emitted_workspace_edges(froms: edge_froms, tos: edge_tos, provenances: edge_provenances) {
-        EdgeListRefused { cause: c } => EmittedWorkspaceRefused { cause: c }
-        EdgeListOk { edges: edges } =>
-          match emitted_workspace_basename_dag(module_dag: module_dag, module_by_basename: module_by_basename, emitted_basenames: emitted_basenames) {
-            BasenameDagRefused { cause: c } => EmittedWorkspaceRefused { cause: c }
-            BasenameDagOk { module_dag: basename_dag } =>
-              match module_dag_with_emitted_edges(module_dag: basename_dag, emitted: edges) {
-                ModuleDagEmittedRefused { cause: c } => EmittedWorkspaceRefused { cause: EmittedWorkspaceEdgeMergeRefused { cause: c } }
-                ModuleDagEmittedMerged { module_dag: merged } => {
-                  let closure_dag = emitted_workspace_without_runtime(module_dag: merged)
-                  match resolve_partition_outcome(
-                    parameter: PolicyPartitionParam { policy: PartitionPolicy { target_crate_count: target_crate_count } },
-                    module_dag: closure_dag
-                  ) {
-                    ResolvePartitionRefused { cause: c } => EmittedWorkspaceRefused { cause: EmittedWorkspacePartitionRefused { cause: c } }
-                    ResolvePartitionOk { assignment: assignment, provenance: _ } => {
-                      let unit_ids = list_unique_sorted_ids(items: assignment |> map_values)
-                      let unit_edges = assignment_unit_dep_edges(module_dag: closure_dag, assignment: assignment)
-                      match emitted_workspace_derived_rows(unit_rows: emitted_workspace_unit_rows(modules: closure_dag.modules, assignment: assignment, unit_ids: unit_ids), unit_edges: unit_edges, emitted_basenames: emitted_basenames) {
-                        DerivedRowsRefused { cause: c } => EmittedWorkspaceRefused { cause: c }
-                        DerivedRowsOk { rows: rows } =>
-                          match emitted_workspace_red(edges: edges, assignment: assignment, unit_edges: unit_edges) {
-                            Absent => EmittedWorkspaceRefused { cause: EmittedWorkspaceNoDiscriminatingEdge }
-                            Present { value: red } =>
-                              EmittedWorkspacePlanned {
-                                plan: EmittedWorkspacePlan {
-                                  rows: rows,
-                                  red_rows: emitted_workspace_red_rows(rows: rows, red: red),
-                                  red: red,
-                                  module_count: closure_dag.modules |> count,
-                                  crate_count: rows |> count,
-                                  facade_is_whole_closure: emitted_workspace_facade_is_whole_closure(rows: rows)
-                                }
-                              }
-                          }
-                      }
-                    }
-                  }
-                }
-              }
-          }
-      }
-  }
-}
-
-// THE PRODUCTION ENTRY: the live closure derivation, the emission's own basenames and edges, and
-// the declared core target the closure's policy partition already uses.
-fn emitted_workspace_plan(
-  emitted_basenames: List<String>,
-  edge_froms: List<String>,
-  edge_tos: List<String>,
-  edge_provenances: List<String>
-) -> EmittedWorkspaceOutcome {
-  match emitted_compiler_closure_module_dag() {
-    ModuleDagDerivationRefused { cause: c } => EmittedWorkspaceRefused { cause: EmittedWorkspaceDagRefused { cause: c } }
-    ModuleDagDerived { module_dag: module_dag } =>
-      emitted_workspace_plan_over(
-        module_dag: module_dag,
-        emitted_basenames: emitted_basenames,
-        edge_froms: edge_froms,
-        edge_tos: edge_tos,
-        edge_provenances: edge_provenances,
-        target_crate_count: rust_crate_partition_declared_core_target
-      )
-  }
-}
diff --git a/src/v2/workflow/floor2_prepared_subject.dag b/src/v2/workflow/floor2_prepared_subject.dag
index f7139d71458..480778ebd8f 100644
--- a/src/v2/workflow/floor2_prepared_subject.dag
+++ b/src/v2/workflow/floor2_prepared_subject.dag
@@ -17,11 +17,6 @@ import v2.std.node { Symbol }
 // eval_wall_ms). One preparation serving every claim is the same work with the
 // entry removed from the key.
 
-type PreparedSubjectSpec {
-  source_roots: List<String>
-  exclusions: List<String>
-}
-
 // The exclusion set is PART OF THE SUBJECT, so it is declared beside the roots and
 // never borrowed from a roster that answers a different question. The probe exclusion
 // roster is pattern rows UNION a derived strict-resolve failure closure, and its
@@ -90,50 +85,6 @@ fn witness_identity_qualified_name(identity: WitnessIdentity) -> String {
   concat(concat(identity.module_path, "."), identity.function)
 }
 
-// WHICH EXECUTION KEY A BATCH GETS IS FLOOR POLICY, so it is a row here rather than a
-// condition in the seed. The note above claims changing floor policy is a row edit and not
-// a Rust edit; landing the routing rule only in cli_run would have made that sentence false
-// in the same change that wrote it.
-//
-// ONE INPUT DECIDES, and it used to be two. An earlier revision of this rule also read
-// roster provenance -- walked from scan_dirs versus named by the batch -- because a batch
-// naming ten entries would have paid a whole-tree preparation to serve them, which is the
-// entry-major cost-shape defect pointing the other way. That ground was real and it is now
-// dissolved rather than merely unused: ExecutionMode is not an input to resolution, so the
-// seed memoizes the resolved graph by its source digest and a second consumer over the same
-// tree pays a file walk and builds its own context. The distinction bought nothing once the
-// cost it named was gone, so FloorRosterProvenance and the
-// WholeTreePreparationNotAmortized ground are DELETED here rather than left standing beside
-// the climb that obsoleted them.
-type FloorSelectionPosture
-  = NoSelectionMachinery
-  | SelectionRequiresPerEntryFrontier
-
-// The surviving entry-major arm names its own dissolution in its constructor: a
-// selection-bearing lane evaluates a per-entry frontier, and an entry-private context is
-// what supplies one. It retires when node_frontier_selection leaves Runnable, at which point
-// this coproduct collapses to a single inhabitant and deletes with it.
-type FloorExecutionKey
-  = OnePreparedSubjectKey { subject: PreparedSubjectSpec }
-  | EntryMajorUntilFrontierRetires
-
-fn floor_execution_key(
-  posture: FloorSelectionPosture,
-  subject: PreparedSubjectSpec
-) -> FloorExecutionKey {
-  match posture {
-    SelectionRequiresPerEntryFrontier => EntryMajorUntilFrontierRetires
-    NoSelectionMachinery => OnePreparedSubjectKey { subject: subject }
-  }
-}
-
-fn floor_execution_key_is_one_prepared_subject(key: FloorExecutionKey) -> Bool {
-  match key {
-    OnePreparedSubjectKey { subject: _ } => true
-    EntryMajorUntilFrontierRetires => false
-  }
-}
-
 // A DECLARED RUNG REGRESSION, measured on this change rather than discovered after it.
 //
 // Under one prepared subject every module of the tree is present at once, which is the most
diff --git a/src/v2/workflow/floor_cost_debt.dag b/src/v2/workflow/floor_cost_debt.dag
index 1aab917f794..4a758c4d515 100644
--- a/src/v2/workflow/floor_cost_debt.dag
+++ b/src/v2/workflow/floor_cost_debt.dag
@@ -782,8 +782,13 @@ fn floor_cost_debt_censored_chunk_02() -> List<String> {
 // match_keyword_after_dot_is_not_a_match_expr_sniff_holds, and both Cause R data-record
 // discriminators (data_record_arrow_lambda_field_is_not_retained_holds,
 // data_record_fn_literal_field_is_not_retained_holds).
+// RETIRED (2026-10-05): single_arm_match two_arm_match_still_accepts_holds and
+// three_arm_match_keeps_every_arm_holds. Run with no cost budget, they reached FAIL, not an
+// interrupt: a semantic red that this row masked. They now pass after the parse repair
+// (gunbc.recurring_failure_mode memo_retained_occurrence_id_reminted_after_a_rejected_attempt),
+// so they return to the floor and its budget.
 fn floor_cost_debt_censored_chunk_03() -> List<String> {
-  Cons { head: "v2.test.claim.body_lowering.single_arm_match.single_arm_wildcard_match_normalizes_holds", tail: Cons { head: "v2.test.claim.body_lowering.single_arm_match.two_arm_match_still_accepts_holds", tail: Cons { head: "v2.test.claim.body_lowering.single_arm_match.three_arm_match_keeps_every_arm_holds", tail: Cons { head: "v2.test.claim.body_lowering.single_arm_match.one_arm_constructor_pattern_normalizes_holds", tail: Cons { head: "v2.test.claim.body_lowering.single_arm_match.one_arm_shorthand_field_pattern_normalizes_holds", tail: Cons { head: "v2.test.claim.body_lowering.match_as_field_name.field_named_match_normalizes_holds", tail: Cons { head: "v2.test.claim.body_lowering.match_as_field_name.field_renamed_other_control_holds", tail: Cons { head: "v2.test.claim.body_lowering.match_as_field_name.field_named_loop_control_holds", tail: Cons { head: "v2.test.claim.body_lowering.match_as_field_name.field_named_type_control_holds", tail: Cons { head: "v2.test.claim.body_lowering.match_as_field_name.infix_field_named_match_normalizes_holds", tail: Cons { head: "v2.test.claim.body_lowering.data_initializer_fn_value.lambda_in_fn_body_control_holds", tail: Empty {} } } } } } } } } } } }
+  Cons { head: "v2.test.claim.body_lowering.single_arm_match.single_arm_wildcard_match_normalizes_holds", tail: Cons { head: "v2.test.claim.body_lowering.single_arm_match.one_arm_constructor_pattern_normalizes_holds", tail: Cons { head: "v2.test.claim.body_lowering.single_arm_match.one_arm_shorthand_field_pattern_normalizes_holds", tail: Cons { head: "v2.test.claim.body_lowering.match_as_field_name.field_named_match_normalizes_holds", tail: Cons { head: "v2.test.claim.body_lowering.match_as_field_name.field_renamed_other_control_holds", tail: Cons { head: "v2.test.claim.body_lowering.match_as_field_name.field_named_loop_control_holds", tail: Cons { head: "v2.test.claim.body_lowering.match_as_field_name.field_named_type_control_holds", tail: Cons { head: "v2.test.claim.body_lowering.match_as_field_name.infix_field_named_match_normalizes_holds", tail: Cons { head: "v2.test.claim.body_lowering.data_initializer_fn_value.lambda_in_fn_body_control_holds", tail: Empty {} } } } } } } } } }
 }
 
 // CENSORED: thirteen identities interrupted_before_verdict on this PR's floor of
@@ -1035,8 +1040,40 @@ fn floor_cost_debt_proven_chunk_21() -> List<String> {
   Cons { head: "v2.test.parse.expression_bodied_fn_decl_parse.braced_fn_decl_survives_normalize_holds", tail: Empty {} }
 }
 
+// PROVEN: reached its verdict (passed) over the new-witness budget on the required floor of
+// record at 8528a59b45 (floor run 2026-10-06T14:35Z; the same gate re-measured it at run
+// 37499673683 / floor job 112393139664, head d4ec92f) -- the figures live in those runs, not
+// here. The only real-path inhabitance claim for the former drop
+// gunbc.rung_drop.admit_callers_discarded_on_the_native_route. Row admitted by
+// operator escalation, default-approved (lively-ram-153 relaying, 2026-10-07). The cost is the
+// interpreter's realization of the parse+lower pipeline, not the claim's shape: 02_parse
+// documents that parsing even a trivial source dominates under the tree-walking v1
+// interpreter, and every cheaper shape (hand-built parse shells) was rejected by review 77470
+// as fixture-standing. Owner: the long-home changed-witness lane, where required_floor
+// long_home_prefixes admit module v2.test.claim.long.* as ChangedCostDebtVerdictOnly; the
+// claim also PASSES when run for its verdict without the eval budget (runner receipt, PR
+// #13108). Retirement: structural (the native emitter stops billing claims for the interpreter's
+// pipeline) or observational -- this identity measures below the charged budget on a required run
+// and is re-enrolled in required execution (side chat review 5439746794).
+fn floor_cost_debt_proven_chunk_22() -> List<String> {
+  Cons { head: "v2.test.claim.long.caller_admission_native_wall_red.the_native_route_refuses_exactly_the_outside_cross_module_calls_holds", tail: Empty {} }
+}
+
+// PROVEN, ADMITTED AS THE ONE REAL-PATH INHABITANCE CLAIM OF ITS MODULE (DESIGN section 3, the
+// pairing obligation). v2.test.long.cwc_resolution_probe takes every other input at the interface
+// under test as a supplied value; this claim runs the real tokenize -> parse -> normalize -> resolve
+// route and checks that each supplied fixture is what its producer emits, so it cannot itself be
+// cheap. Measure it with claim_batch --entry src/v2/test/claim/long/cwc_resolution_probe_test.dag
+// --functions cwc_cwc_module_resolve_accepts and read the [witness] eval_steps line.
+// ADMISSION AUTHORITY: operator decision B, default-approved, escalation msg_e427bf73 (2026-10-05,
+// relayed by clever-crane-847). It is admitted through v2.workflow.floor_cost_debt_verdict, which
+// runs a newly added row unbudgeted for its verdict and refuses it if the claim does not pass.
+fn floor_cost_debt_proven_chunk_23() -> List<String> {
+  Cons { head: "v2.test.long.cwc_resolution_probe.cwc_cwc_module_resolve_accepts", tail: Empty {} }
+}
+
 fn floor_cost_debt_proven_chunks() -> List<List<String>> {
-  Cons { head: floor_cost_debt_proven_chunk_00(), tail: Cons { head: floor_cost_debt_proven_chunk_01(), tail: Cons { head: floor_cost_debt_proven_chunk_02(), tail: Cons { head: floor_cost_debt_proven_chunk_03(), tail: Cons { head: floor_cost_debt_proven_chunk_04(), tail: Cons { head: floor_cost_debt_proven_chunk_05(), tail: Cons { head: floor_cost_debt_proven_chunk_06(), tail: Cons { head: floor_cost_debt_proven_chunk_07(), tail: Cons { head: floor_cost_debt_proven_chunk_08(), tail: Cons { head: floor_cost_debt_proven_chunk_09(), tail: Cons { head: floor_cost_debt_proven_chunk_10(), tail: Cons { head: floor_cost_debt_proven_chunk_11(), tail: Cons { head: floor_cost_debt_proven_chunk_12(), tail: Cons { head: floor_cost_debt_proven_chunk_13(), tail: Cons { head: floor_cost_debt_proven_chunk_14(), tail: Cons { head: floor_cost_debt_proven_chunk_15(), tail: Cons { head: floor_cost_debt_proven_chunk_16(), tail: Cons { head: floor_cost_debt_proven_chunk_17(), tail: Cons { head: floor_cost_debt_proven_chunk_18(), tail: Cons { head: floor_cost_debt_proven_chunk_19(), tail: Cons { head: floor_cost_debt_proven_chunk_20(), tail: Cons { head: floor_cost_debt_proven_chunk_21(), tail: Empty {} } } } } } } } } } } }}}}}}}}}}}}
+  Cons { head: floor_cost_debt_proven_chunk_00(), tail: Cons { head: floor_cost_debt_proven_chunk_01(), tail: Cons { head: floor_cost_debt_proven_chunk_02(), tail: Cons { head: floor_cost_debt_proven_chunk_03(), tail: Cons { head: floor_cost_debt_proven_chunk_04(), tail: Cons { head: floor_cost_debt_proven_chunk_05(), tail: Cons { head: floor_cost_debt_proven_chunk_06(), tail: Cons { head: floor_cost_debt_proven_chunk_07(), tail: Cons { head: floor_cost_debt_proven_chunk_08(), tail: Cons { head: floor_cost_debt_proven_chunk_09(), tail: Cons { head: floor_cost_debt_proven_chunk_10(), tail: Cons { head: floor_cost_debt_proven_chunk_11(), tail: Cons { head: floor_cost_debt_proven_chunk_12(), tail: Cons { head: floor_cost_debt_proven_chunk_13(), tail: Cons { head: floor_cost_debt_proven_chunk_14(), tail: Cons { head: floor_cost_debt_proven_chunk_15(), tail: Cons { head: floor_cost_debt_proven_chunk_16(), tail: Cons { head: floor_cost_debt_proven_chunk_17(), tail: Cons { head: floor_cost_debt_proven_chunk_18(), tail: Cons { head: floor_cost_debt_proven_chunk_19(), tail: Cons { head: floor_cost_debt_proven_chunk_20(), tail: Cons { head: floor_cost_debt_proven_chunk_21(), tail: Cons { head: floor_cost_debt_proven_chunk_22(), tail: Cons { head: floor_cost_debt_proven_chunk_23(), tail: Empty {} } } } } } } } } } } } }}}}}}}}}}}}}
 }
 
 fn floor_cost_debt_censored_chunks() -> List<List<String>> {
diff --git a/src/v2/workflow/floor_enrolment_dead_band.dag b/src/v2/workflow/floor_enrolment_dead_band.dag
index a042186f362..5c369cb9b0c 100644
--- a/src/v2/workflow/floor_enrolment_dead_band.dag
+++ b/src/v2/workflow/floor_enrolment_dead_band.dag
@@ -80,10 +80,6 @@ fn mtcollins1_boot_matrix_enrolment_dead_band_observed_only() -> List<EnrolmentD
     identity: "test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_mount_error_refuses_by_name",
     reason: "the real boot entry end to end over the dry realization through an accepted start whose row falls back to Stopped and the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it sits at the margin as media_that_never_becomes_ready_refuses_before_any_power_action does -- PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 288 ms CPU, inside the runner envelope below the 302 ms margin (EnrolmentDeadBandWithinRunnerEnvelope), and a slower runner reads it above" as NonEmptyStr,
   },
-  EnrolmentDeadBandObservation {
-    identity: "test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_device_ejected_refuses_by_name_as_no_fault",
-    reason: "the real boot entry end to end over the dry realization through an accepted start whose row falls back to Stopped and the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it sits at the margin as media_that_never_becomes_ready_refuses_before_any_power_action does -- PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor) observed 291 ms CPU, inside the runner envelope below the 302 ms margin (EnrolmentDeadBandWithinRunnerEnvelope), and a slower runner reads it above" as NonEmptyStr,
-  },
   EnrolmentDeadBandObservation {
     identity: "test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.media_that_never_becomes_ready_refuses_before_any_power_action",
     reason: "the real boot entry end to end over the dry realization through the whole readiness wait, whose cost is gunbc#12434's own SOL polling route run faithfully (the subject gunbc#12423 requires); it straddles the margin between runners at identical eval_steps -- PR required floor run 36783312538 of gunbc#12800 at 8042d175c2a (srv3) observed 320 ms CPU, strictly above the 302 ms margin and under the 500 ms line, and run 36765162766 at 6cac35eb1a6 (srv1) observed 283 ms, inside the runner envelope below the margin (EnrolmentDeadBandWithinRunnerEnvelope)" as NonEmptyStr,
diff --git a/src/v2/workflow/floor_eval_step_cost_drop.dag b/src/v2/workflow/floor_eval_step_cost_drop.dag
index 14228f13a85..fc992f0d887 100644
--- a/src/v2/workflow/floor_eval_step_cost_drop.dag
+++ b/src/v2/workflow/floor_eval_step_cost_drop.dag
@@ -36,8 +36,12 @@ import std.types { NonEmptyStr, List }
 //     approval-request constructor (`approval_intent_digest_new_witness_eval_step_cost`).
 //   - `floor_eval_step_cost_drop_dag_text_round_trip_rows`: the two nested-Bind text round trips
 //     of the dag target (`dag_text_round_trip_nested_bind_new_witness_eval_step_cost`).
+//   - `floor_eval_step_cost_drop_foreign_grammar_extended_parse_rows`: the kotlin and rust
+//     extended-function grammar parses (`foreign_grammar_extended_parse_new_witness_eval_step_cost`).
 //   - `floor_eval_step_cost_drop_coproduct_fragment_normalize_rows`: the three coproduct type-declaration
 //     fragment-lowering claims (`coproduct_fragment_normalize_new_witness_eval_step_cost`).
+//   - `floor_eval_step_cost_drop_bmc_secure_apply_converge_rows`: the one Apply inhabitance of
+//     converge_arrival_through_bmc_secure (`bmc_secure_apply_converge_new_witness_eval_step_cost`).
 // The loss is a WORKFLOW fact -- which
 // identities the eval-step ceiling does not refuse -- so it lives beside the other two rosters the
 // ceiling consults (`v2.workflow.floor_grandfathered_roster`, `v2.workflow.floor_cost_debt`) and
@@ -223,10 +227,6 @@ data floor_eval_step_cost_drop_app_attest_verifier_rows: List<EvalStepCostDropMe
 ]
 
 data floor_eval_step_cost_drop_span_program_rows: List<EvalStepCostDropMeasurement> = [
-  EvalStepCostDropMeasurement {
-    identity: "test.claim.spark.v41_checkpoint_materialize_witness.the_span_read_reads_exactly_its_region" as NonEmptyStr,
-    measured_by: "gunbc#12010, claim_batch over dag/test/claim/spark/v41_checkpoint_materialize_witness_test.dag; planned_as_changed_witness, verdict pass, over the new-witness budget. The billed work is the one real serialization of gunbc.sha256sum_byte_span sha256sum_byte_span_program through gunbc.shell_command_text, which this claim is the argv's only inhabitance route for" as NonEmptyStr,
-  },
 ]
 
 data floor_eval_step_cost_drop_approval_intent_digest_rows: List<EvalStepCostDropMeasurement> = [
@@ -346,7 +346,7 @@ data floor_eval_step_cost_drop_boot_matrix_rows: List<EvalStepCostDropMeasuremen
     measured_by: "PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=162614 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through an accepted start whose row falls back to Stopped, up to the readiness refusal" as NonEmptyStr,
   },
   EvalStepCostDropMeasurement {
-    identity: "test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_device_ejected_refuses_by_name_as_no_fault" as NonEmptyStr,
+    identity: "test.claim.machine_intake.mtcollins1_boot_acceptance_matrix_test.a_start_that_stops_with_code_16_refuses_as_a_timeout_carrying_the_raw_code" as NonEmptyStr,
     measured_by: "PR required floor run 36846505084 of gunbc#12889 at 0b436b6 (job floor), the [over-cost] line for this identity: planned_as_changed_witness, verdict pass, eval_steps=161874 against the 72,300 new-witness budget (eval_steps are host-independent); the billed work is the real boot entry executed end to end in the seed interpreter over the dry realization, through an accepted start whose row falls back to Stopped, up to the readiness refusal" as NonEmptyStr,
   },
   EvalStepCostDropMeasurement {
@@ -421,6 +421,22 @@ data floor_eval_step_cost_drop_dag_text_round_trip_rows: List<EvalStepCostDropMe
   },
 ]
 
+// THE FOREIGN-GRAMMAR EXTENDED-FUNCTION PARSE CLAIMS (v2.test.parse census phase 4; `gunbc.rung_drop`
+// `foreign_grammar_extended_parse_new_witness_eval_step_cost`). Two identities, the kotlin and rust
+// extended-function parses, each one tokenize and one real parse of a function exercising let/val, if,
+// return and binary expressions through that language's grammar. Their grammar preparation is billed
+// apart; the parse alone exceeds the budget.
+data floor_eval_step_cost_drop_foreign_grammar_extended_parse_rows: List<EvalStepCostDropMeasurement> = [
+  EvalStepCostDropMeasurement {
+    identity: "test.claim.parse_test_kotlin_grammar.claim_kotlin_extended_function_parses_holds" as NonEmptyStr,
+    measured_by: "v2.test.parse census phase 4, claim_batch BuildBuddy invocations 2c8f9d0b and 9241511f on main of 2026-10-05 plus this change: verdict pass, the claim's own marginal over the new-witness budget even with its grammar preparation billed apart; re-derived by claim_batch --source-root dag --source-root src/v2 --entry src/v2/test/claim/parse/parse_test_kotlin_grammar_test.dag --functions claim_kotlin_extended_function_parses_holds. The billed work is one tokenize and one real parse of an extended function with the language's own grammar" as NonEmptyStr,
+  },
+  EvalStepCostDropMeasurement {
+    identity: "test.claim.parse_test_rust_grammar.claim_rust_extended_function_parses_holds" as NonEmptyStr,
+    measured_by: "v2.test.parse census phase 4, claim_batch BuildBuddy invocations 2c8f9d0b and 9241511f on main of 2026-10-05 plus this change: verdict pass, the claim's own marginal over the new-witness budget even with its grammar preparation billed apart; re-derived by claim_batch --source-root dag --source-root src/v2 --entry src/v2/test/claim/parse/parse_test_rust_grammar_test.dag --functions claim_rust_extended_function_parses_holds. The billed work is one tokenize and one real parse of an extended function with the language's own grammar" as NonEmptyStr,
+    },
+  ]
+
 // THE COPRODUCT FRAGMENT-LOWERING CLAIMS (v2.test.parse census phase 3; `gunbc.rung_drop`
 // `coproduct_fragment_normalize_new_witness_eval_step_cost`). Three identities, each parsing ONE type
 // declaration fragment at its production and lowering it with normalize_node (two, for the two
@@ -442,8 +458,15 @@ data floor_eval_step_cost_drop_coproduct_fragment_normalize_rows: List<EvalStepC
   },
 ]
 
+data floor_eval_step_cost_drop_bmc_secure_apply_converge_rows: List<EvalStepCostDropMeasurement> = [
+  EvalStepCostDropMeasurement {
+    identity: "test.claim.machine_intake_arrival_converge_witness.w_bmc_secure_apply_with_the_mtjade1_standing_grant_converges_over_the_dry_world" as NonEmptyStr,
+    measured_by: "claim_batch --hermetic --source-root dag --source-root src/v2 --entry dag/test/claim/machine_intake/machine_intake_arrival_converge_witness_test.dag --function w_bmc_secure_apply_with_the_mtjade1_standing_grant_converges_over_the_dry_world (BuildBuddy, GUNBC_BIND_MEMORY_CGROUP_BYTES=30064771072): PASS, eval_steps over the new-witness budget. The billed work is converge_arrival_through_bmc_secure over the production prefix captures plus dry Apply+grant, which this claim is the only Apply execution of" as NonEmptyStr,
+  },
+]
+
 fn floor_eval_step_cost_drop_all_rows() -> List<EvalStepCostDropMeasurement> {
-  concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(floor_eval_step_cost_drop_rows, floor_eval_step_cost_drop_apply_render_rows), floor_eval_step_cost_drop_live_forecast_rows), floor_eval_step_cost_drop_page_style_rows), floor_eval_step_cost_drop_interpreted_crypto_rows), floor_eval_step_cost_drop_app_attest_verifier_rows), floor_eval_step_cost_drop_span_program_rows), floor_eval_step_cost_drop_python_to_typescript_inhabitance_rows), floor_eval_step_cost_drop_boot_matrix_rows), floor_eval_step_cost_drop_dark_install_render_rows), floor_eval_step_cost_drop_build_job_membership_rows), floor_eval_step_cost_drop_dag_emit_round_trip_rows), floor_eval_step_cost_drop_approval_intent_digest_rows), floor_eval_step_cost_drop_dag_text_round_trip_rows), floor_eval_step_cost_drop_coproduct_fragment_normalize_rows)
+  concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(concat(floor_eval_step_cost_drop_rows, floor_eval_step_cost_drop_apply_render_rows), floor_eval_step_cost_drop_live_forecast_rows), floor_eval_step_cost_drop_page_style_rows), floor_eval_step_cost_drop_interpreted_crypto_rows), floor_eval_step_cost_drop_app_attest_verifier_rows), floor_eval_step_cost_drop_span_program_rows), floor_eval_step_cost_drop_python_to_typescript_inhabitance_rows), floor_eval_step_cost_drop_boot_matrix_rows), floor_eval_step_cost_drop_dark_install_render_rows), floor_eval_step_cost_drop_build_job_membership_rows), floor_eval_step_cost_drop_dag_emit_round_trip_rows), floor_eval_step_cost_drop_approval_intent_digest_rows), floor_eval_step_cost_drop_dag_text_round_trip_rows), floor_eval_step_cost_drop_coproduct_fragment_normalize_rows), floor_eval_step_cost_drop_foreign_grammar_extended_parse_rows), floor_eval_step_cost_drop_bmc_secure_apply_converge_rows)
 }
 
 // THE PROJECTION THE SEED RUNNER READS AND THE MODEL TESTS AGAINST. The runner refuses an empty or
diff --git a/src/v2/workflow/floor_expected_red.dag b/src/v2/workflow/floor_expected_red.dag
index 023c612a157..3bdd05a31b9 100644
--- a/src/v2/workflow/floor_expected_red.dag
+++ b/src/v2/workflow/floor_expected_red.dag
@@ -691,7 +691,7 @@ fn floor_expected_red_chunk_20() -> List<String> {
 // spelling collides with a builtin or module free function; the gate is widened against a
 // measured population, never speculatively.
 fn floor_expected_red_chunk_21() -> List<String> {
-  Cons { head: "v2.test.claim.local_binding_shadow.a_noncallable_local_binding_does_not_fall_through_to_the_module_function", tail:Cons { head: "test.claim.compile_accepted_unevaluable_program_control.primitive_call_with_extra_argument_must_refuse_at_compile", tail: Cons { head: "test.claim.compile_accepted_unevaluable_program_control.primitive_call_with_missing_argument_must_refuse_at_compile", tail: Cons { head: "test.claim.compile_accepted_unevaluable_program_control.primitive_call_with_wrong_argument_type_must_refuse_at_compile", tail: Cons { head: "test.claim.fabric_cell_evidence_algebra_witness.evidence_full_value_is_order_independent", tail: Empty {} } } } } }
+  Cons { head: "v2.test.claim.local_binding_shadow.a_noncallable_local_binding_does_not_fall_through_to_the_module_function", tail:Cons { head: "test.claim.compile_accepted_unevaluable_program_control.primitive_call_with_extra_argument_must_refuse_at_compile", tail: Cons { head: "test.claim.compile_accepted_unevaluable_program_control.primitive_call_with_missing_argument_must_refuse_at_compile", tail: Cons { head: "test.claim.compile_accepted_unevaluable_program_control.primitive_call_with_wrong_argument_type_must_refuse_at_compile", tail: Empty {} } } } }
 }
 
 // THE SHADOW CHUNK IS DELETED AND THE ROSTER IS RENUMBERED RATHER THAN LEFT WITH A HOLE. The chunk
@@ -805,6 +805,14 @@ fn floor_expected_red_chunk_interpreter_first_optional_divergence() -> List<Stri
   Cons { head: "test.claim.cli_dispatch_surface.interpreter_first_returns_the_modeled_optional", tail: Empty {} }
 }
 
+// A coproduct arm with no constructor name (`type T = { x: Int } | B`) is accepted by v2
+// normalize. The claim asserts the refusal normalize owes, and was committed knowing it is red.
+// Recurring failure mode: gunbc.recurring_failure_mode.a_coproduct_arm_without_a_constructor_name_is_accepted.
+// When the declaration fold refuses the arm, this row is deleted and the claim stays as the control.
+fn floor_expected_red_chunk_coproduct_arm_without_constructor_name() -> List<String> {
+  Cons { head: "v2.test.long.cwc_resolution_probe.cwc_malformed_nary_coproduct_normalize_rejects", tail: Empty {} }
+}
+
 // THIRTEEN FURTHER IDENTITIES RETIRED 2026-08-26 BY ONE REPAIR, and the number is the finding. The
 // local-binding-shadow repair -- a call site spelling a name held by both a local binding and a
 // module-level free function now reaches the LOCAL -- was enrolled with ONE row of its own. On the
@@ -1275,7 +1283,7 @@ fn floor_expected_red_chunk_infer_checking_mode() -> List<String> {
 }
 
 fn floor_expected_red_chunks() -> List<List<String>> {
-  Cons { head: floor_expected_red_chunk_text_wall_generic_formal(), tail: Cons { head: floor_expected_red_chunk_00(), tail: Cons { head: floor_expected_red_chunk_02(), tail: Cons { head: floor_expected_red_chunk_03(), tail: Cons { head: floor_expected_red_chunk_04(), tail: Cons { head: floor_expected_red_chunk_05(), tail: Cons { head: floor_expected_red_chunk_06(), tail: Cons { head: floor_expected_red_chunk_07(), tail: Cons { head: floor_expected_red_chunk_08(), tail: Cons { head: floor_expected_red_chunk_09(), tail: Cons { head: floor_expected_red_chunk_10(), tail: Cons { head: floor_expected_red_chunk_13(), tail: Cons { head: floor_expected_red_chunk_14(), tail: Cons { head: floor_expected_red_chunk_15(), tail: Cons { head: floor_expected_red_chunk_16(), tail: Cons { head: floor_expected_red_chunk_17(), tail: Cons { head: floor_expected_red_chunk_18(), tail: Cons { head: floor_expected_red_chunk_19(), tail: Cons { head: floor_expected_red_chunk_20(), tail: Cons { head: floor_expected_red_chunk_21(), tail: Cons { head: floor_expected_red_chunk_24(), tail: Cons { head: floor_expected_red_chunk_interpreter_first_optional_divergence(), tail: Cons { head: floor_expected_red_chunk_optional_equality_by_representation(), tail: Cons { head: floor_expected_red_chunk_disjoint_refinement_chains(), tail: Cons { head: floor_expected_red_chunk_shell_dag_cron_entry_line_builder(), tail: Cons { head: floor_expected_red_chunk_shell_dag_floor_peak_calibration_rows(), tail: Cons { head: floor_expected_red_chunk_shell_dag_ci_fmt_gate_line(), tail: Cons { head: floor_expected_red_chunk_shell_dag_ci_deploy_invoke_prelude(), tail: Cons { head: floor_expected_red_chunk_shell_dag_ci_heal_regen_invoke(), tail: Cons { head: floor_expected_red_chunk_shell_dag_codex_app_server_trip_script(), tail: Cons { head: floor_expected_red_chunk_shell_dag_live_deploy_install_owned(), tail: Cons { head: floor_expected_red_chunk_shell_dag_live_deploy_restart_tailscale(), tail: Cons { head: floor_expected_red_chunk_live_tree_admission(), tail: Cons { head: floor_expected_red_chunk_emitted_add_algebra_ref_ungrounded(), tail: Cons { head: floor_expected_red_chunk_infer_checking_mode(), tail: Cons { head: floor_expected_red_chunk_product_at_kernel_scalar_formal(), tail: Empty {} } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } }
+  Cons { head: floor_expected_red_chunk_text_wall_generic_formal(), tail: Cons { head: floor_expected_red_chunk_00(), tail: Cons { head: floor_expected_red_chunk_02(), tail: Cons { head: floor_expected_red_chunk_03(), tail: Cons { head: floor_expected_red_chunk_04(), tail: Cons { head: floor_expected_red_chunk_05(), tail: Cons { head: floor_expected_red_chunk_06(), tail: Cons { head: floor_expected_red_chunk_07(), tail: Cons { head: floor_expected_red_chunk_08(), tail: Cons { head: floor_expected_red_chunk_09(), tail: Cons { head: floor_expected_red_chunk_10(), tail: Cons { head: floor_expected_red_chunk_13(), tail: Cons { head: floor_expected_red_chunk_14(), tail: Cons { head: floor_expected_red_chunk_15(), tail: Cons { head: floor_expected_red_chunk_16(), tail: Cons { head: floor_expected_red_chunk_17(), tail: Cons { head: floor_expected_red_chunk_18(), tail: Cons { head: floor_expected_red_chunk_19(), tail: Cons { head: floor_expected_red_chunk_20(), tail: Cons { head: floor_expected_red_chunk_21(), tail: Cons { head: floor_expected_red_chunk_24(), tail: Cons { head: floor_expected_red_chunk_interpreter_first_optional_divergence(), tail: Cons { head: floor_expected_red_chunk_optional_equality_by_representation(), tail: Cons { head: floor_expected_red_chunk_disjoint_refinement_chains(), tail: Cons { head: floor_expected_red_chunk_shell_dag_cron_entry_line_builder(), tail: Cons { head: floor_expected_red_chunk_shell_dag_floor_peak_calibration_rows(), tail: Cons { head: floor_expected_red_chunk_shell_dag_ci_fmt_gate_line(), tail: Cons { head: floor_expected_red_chunk_shell_dag_ci_deploy_invoke_prelude(), tail: Cons { head: floor_expected_red_chunk_shell_dag_ci_heal_regen_invoke(), tail: Cons { head: floor_expected_red_chunk_shell_dag_codex_app_server_trip_script(), tail: Cons { head: floor_expected_red_chunk_shell_dag_live_deploy_install_owned(), tail: Cons { head: floor_expected_red_chunk_shell_dag_live_deploy_restart_tailscale(), tail: Cons { head: floor_expected_red_chunk_live_tree_admission(), tail: Cons { head: floor_expected_red_chunk_emitted_add_algebra_ref_ungrounded(), tail: Cons { head: floor_expected_red_chunk_infer_checking_mode(), tail: Cons { head: floor_expected_red_chunk_product_at_kernel_scalar_formal(), tail: Cons { head: floor_expected_red_chunk_coproduct_arm_without_constructor_name(), tail: Empty {} } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } }
 }
 
 // The three compile_accepted_unevaluable_program_control rows in chunk 21 are live again: run
diff --git a/src/v2/workflow/floor_grandfathered_roster.dag b/src/v2/workflow/floor_grandfathered_roster.dag
index f358282b043..28732672de6 100644
--- a/src/v2/workflow/floor_grandfathered_roster.dag
+++ b/src/v2/workflow/floor_grandfathered_roster.dag
@@ -374,6 +374,59 @@ data floor_grandfathered_removals: List<GrandfatheredRemoval> = [
     identity: "v2.test.claim.realize_advisory_soundness_test.witness_window_reds_on_one_unsound" as NonEmptyStr,
     deleted_in: "Advisories 5.4: v2.workflow.realize_advisory_soundness judged pairs from the GUNBC_REALIZE_ADVISORY logger, which no run sets and whose feeding runs were cut; the law, its test module and the logger are deleted together" as NonEmptyStr
   },
+  WitnessDeleted {
+    identity: "v2.test.self_host.frontier_probe_overlap_detail.assemble_receipt_carries_nonempty_rejection_chain" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: grammar validation REFUSES every choice-overlap row, located at the owning production, so parse_grammar_choice_overlap_residue has no producer and the parse-stage overlap evidence carrier (v2.compiler.parse_diagnostic) is deleted. v2.test.self_host.frontier_probe_overlap_detail witnessed that carrier's merge and masking; its subject no longer exists" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.self_host.frontier_probe_overlap_detail.masked_overlap_located_reason_unmasks_terminal_refusal" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: grammar validation REFUSES every choice-overlap row, located at the owning production, so parse_grammar_choice_overlap_residue has no producer and the parse-stage overlap evidence carrier (v2.compiler.parse_diagnostic) is deleted. v2.test.self_host.frontier_probe_overlap_detail witnessed that carrier's merge and masking; its subject no longer exists" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.self_host.frontier_probe_overlap_detail.masked_overlap_tail_preserves_overlap_evidence_and_remaining_chain" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: grammar validation REFUSES every choice-overlap row, located at the owning production, so parse_grammar_choice_overlap_residue has no producer and the parse-stage overlap evidence carrier (v2.compiler.parse_diagnostic) is deleted. v2.test.self_host.frontier_probe_overlap_detail witnessed that carrier's merge and masking; its subject no longer exists" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.self_host.frontier_probe_overlap_detail.masked_resolve_not_found_unmasks_located_reason" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: grammar validation REFUSES every choice-overlap row, located at the owning production, so parse_grammar_choice_overlap_residue has no producer and the parse-stage overlap evidence carrier (v2.compiler.parse_diagnostic) is deleted. v2.test.self_host.frontier_probe_overlap_detail witnessed that carrier's merge and masking; its subject no longer exists" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.self_host.frontier_probe_overlap_detail.overlap_evidence_binds_exact_row_not_global_roster" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: grammar validation REFUSES every choice-overlap row, located at the owning production, so parse_grammar_choice_overlap_residue has no producer and the parse-stage overlap evidence carrier (v2.compiler.parse_diagnostic) is deleted. v2.test.self_host.frontier_probe_overlap_detail witnessed that carrier's merge and masking; its subject no longer exists" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.self_host.frontier_probe_overlap_detail.overlap_only_chain_keeps_overlap_located_reason" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: grammar validation REFUSES every choice-overlap row, located at the owning production, so parse_grammar_choice_overlap_residue has no producer and the parse-stage overlap evidence carrier (v2.compiler.parse_diagnostic) is deleted. v2.test.self_host.frontier_probe_overlap_detail witnessed that carrier's merge and masking; its subject no longer exists" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.self_host.frontier_probe_overlap_detail.overlap_stage_attaches_evidence_when_diagnostics_stripped" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: grammar validation REFUSES every choice-overlap row, located at the owning production, so parse_grammar_choice_overlap_residue has no producer and the parse-stage overlap evidence carrier (v2.compiler.parse_diagnostic) is deleted. v2.test.self_host.frontier_probe_overlap_detail witnessed that carrier's merge and masking; its subject no longer exists" as NonEmptyStr,
+  },
+  WitnessRenamed {
+    previous_identity: "v2.test.self_host.frontier_probe_overlap_detail.emit_stage_receipt_has_no_assemble_detail" as NonEmptyStr,
+    new_identity: "v2.test.self_host.frontier_probe_assemble_detail.emit_stage_receipt_has_no_assemble_detail" as NonEmptyStr,
+    renamed_in: "the grammar-overlap cut: the claim is unchanged and its subject survives, but its module was named for the overlap-detail carrier the cut deletes, so it moved to v2.test.self_host.frontier_probe_assemble_detail and is judged against the new-witness tier" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.self_host.frontier_probe_semantic_family_receipt.both_measured_shards_name_body_lowering_beneath_the_mask_holds" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: v2.compiler.self_host.frontier_probe_semantic_family_receipt recorded a 2026-08 observation whose subject was the grammar-overlap residue masking a deeper chain. Validation now refuses every overlap, so that mask cannot exist and the module's own note required a fresh survey to replace its rows; the module and its consistency claims are deleted, the receipt stays in git history" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.self_host.frontier_probe_semantic_family_receipt.every_capped_shard_exceeds_the_cap_it_names_holds" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: v2.compiler.self_host.frontier_probe_semantic_family_receipt recorded a 2026-08 observation whose subject was the grammar-overlap residue masking a deeper chain. Validation now refuses every overlap, so that mask cannot exist and the module's own note required a fresh survey to replace its rows; the module and its consistency claims are deleted, the receipt stays in git history" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.self_host.frontier_probe_semantic_family_receipt.every_measured_chain_is_non_uniform_holds" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: v2.compiler.self_host.frontier_probe_semantic_family_receipt recorded a 2026-08 observation whose subject was the grammar-overlap residue masking a deeper chain. Validation now refuses every overlap, so that mask cannot exist and the module's own note required a fresh survey to replace its rows; the module and its consistency claims are deleted, the receipt stays in git history" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.self_host.frontier_probe_semantic_family_receipt.the_five_shards_partition_into_measured_and_capped_holds" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: v2.compiler.self_host.frontier_probe_semantic_family_receipt recorded a 2026-08 observation whose subject was the grammar-overlap residue masking a deeper chain. Validation now refuses every overlap, so that mask cannot exist and the module's own note required a fresh survey to replace its rows; the module and its consistency claims are deleted, the receipt stays in git history" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.self_host.frontier_probe_semantic_family_receipt.two_shards_are_measured_and_three_are_capped_holds" as NonEmptyStr,
+    deleted_in: "the grammar-overlap cut: v2.compiler.self_host.frontier_probe_semantic_family_receipt recorded a 2026-08 observation whose subject was the grammar-overlap residue masking a deeper chain. Validation now refuses every overlap, so that mask cannot exist and the module's own note required a fresh survey to replace its rows; the module and its consistency claims are deleted, the receipt stays in git history" as NonEmptyStr,
+  },
   WitnessRenamed {
     previous_identity: "v2.test.parse.parse_binding_fidelity.witness_ambiguous_export_fail_closed_holds" as NonEmptyStr,
     new_identity: "test.claim.parse_test_parse_binding_fidelity.witness_ambiguous_export_fail_closed_holds" as NonEmptyStr,
@@ -484,6 +537,60 @@ data floor_grandfathered_removals: List<GrandfatheredRemoval> = [
     new_identity: "test.claim.parse_test_token_stream_cursor.token_stream_cursor_remaining_matches_skip_holds" as NonEmptyStr,
     renamed_in: "the v2.test.parse ungated census (gunbc#13372) phase 1: v2.test.parse.* modules sat outside required_gate_prefixes and ran only as changed witnesses; the module moved into the gated test.claim.parse_test family with a byte-identical claim body, so the identity changed and the claim is judged against the new-witness tier" as NonEmptyStr,
   },
+  WitnessRenamed {
+    previous_identity: "v2.test.claim.symbol_index.containment.symbol_index_unique_variant_without_alias_red_control_holds" as NonEmptyStr,
+    new_identity: "v2.test.claim.symbol_index.containment.symbol_index_module_variant_alias_requires_a_unique_count_holds" as NonEmptyStr,
+    renamed_in: "the variant-field native binding repair (gunbc#13210): the alias-binding repair files a module variant alias whenever a tag's declaration count is unique, so the state the old red control pinned -- a unique variant whose alias is MISSING -- no longer occurs and the red is unwritable as stated; the successor establishes the two-sided rule the repair implements (alias present when the count is unique, absent when the tag is declared twice), and as a new identity it is judged against the new-witness tier rather than inheriting the cut row's grandfathered one" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.compiler_materialization_witness.parse_table_memo_provider_preserves_catalog_retention" as NonEmptyStr,
+    deleted_in: "the parse memo deletion (operator ruling R2 2026-10-08): the v2 packrat parse memo served captures whose occurrence ids were minted on abandoned backtrack paths, so its carrier (v2.compiler.parse ParseTableRealization entries, the extdeps.realization.parse_table_memo catalog row, and the parse-table demand of v2.compiler.materialization_carriers) is deleted; this claim pinned the retention of the deleted parse_table_memo provider, which no longer exists. Its compile-stage sibling compile_stage_memo_provider_preserves_catalog_retention stays" as NonEmptyStr
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.compiler_materialization_witness.parse_table_carrier_inhabits_realization" as NonEmptyStr,
+    deleted_in: "the parse memo deletion (operator ruling R2 2026-10-08): the v2 packrat parse memo served captures whose occurrence ids were minted on abandoned backtrack paths, so its carrier (v2.compiler.parse ParseTableRealization entries, the extdeps.realization.parse_table_memo catalog row, and the parse-table demand of v2.compiler.materialization_carriers) is deleted; this claim pinned the deleted ParseTableRealization carrier inhabiting the Realization model. Its compile-stage sibling compile_stage_carrier_inhabits_realization stays" as NonEmptyStr
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.compiler_materialization_witness.parse_table_empty_uses_catalog_identity" as NonEmptyStr,
+    deleted_in: "the parse memo deletion (operator ruling R2 2026-10-08): the v2 packrat parse memo served captures whose occurrence ids were minted on abandoned backtrack paths, so its carrier (v2.compiler.parse ParseTableRealization entries, the extdeps.realization.parse_table_memo catalog row, and the parse-table demand of v2.compiler.materialization_carriers) is deleted; this claim pinned the empty parse table's catalog identity (the deleted parse_table_memo_id)" as NonEmptyStr
+  },
+  WitnessRenamed {
+    previous_identity: "v2.test.claim.compiler_materialization_witness.parse_table_memo_plural_reds_without_provider" as NonEmptyStr,
+    new_identity: "v2.test.claim.compiler_materialization_witness.compile_stage_memo_plural_reds_without_provider" as NonEmptyStr,
+    renamed_in: "the parse memo deletion (operator ruling R2 2026-10-08): the v2 packrat parse memo served captures whose occurrence ids were minted on abandoned backtrack paths, so its carrier (v2.compiler.parse ParseTableRealization entries, the extdeps.realization.parse_table_memo catalog row, and the parse-table demand of v2.compiler.materialization_carriers) is deleted; the plural-demand red control was retargeted from the deleted parse-table demand to the compile-stage demand, and it is named for the demand it now exercises" as NonEmptyStr
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.compiler_materialization_witness.compiler_materialization_ladder_holds" as NonEmptyStr,
+    deleted_in: "the compile-stage memo deletion (roadmap native-memory-inert-carriers, operator ruling 2026-10-08): the compile-stage memo's only lookup answered Miss unconditionally, so its carrier (v2.compiler.materialization_carriers compile-stage demand, provider, governed door and admission controls, and the extdeps.realization.compile_stage_memo catalog row) is deleted; this claim pinned that carrier, and the generic ladder obligations it exercised stay enrolled on fixture subjects in test.claim.materialization_ladder_witness" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.compiler_materialization_witness.compile_stage_carrier_inhabits_realization" as NonEmptyStr,
+    deleted_in: "the compile-stage memo deletion (roadmap native-memory-inert-carriers, operator ruling 2026-10-08): the compile-stage memo's only lookup answered Miss unconditionally, so its carrier (v2.compiler.materialization_carriers compile-stage demand, provider, governed door and admission controls, and the extdeps.realization.compile_stage_memo catalog row) is deleted; this claim pinned that carrier, and the generic ladder obligations it exercised stay enrolled on fixture subjects in test.claim.materialization_ladder_witness" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.compiler_materialization_witness.compile_stage_memo_provider_preserves_catalog_retention" as NonEmptyStr,
+    deleted_in: "the compile-stage memo deletion (roadmap native-memory-inert-carriers, operator ruling 2026-10-08): the compile-stage memo's only lookup answered Miss unconditionally, so its carrier (v2.compiler.materialization_carriers compile-stage demand, provider, governed door and admission controls, and the extdeps.realization.compile_stage_memo catalog row) is deleted; this claim pinned that carrier, and the generic ladder obligations it exercised stay enrolled on fixture subjects in test.claim.materialization_ladder_witness" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.staging.cached_stage_hit_skips_stage" as NonEmptyStr,
+    deleted_in: "the compile-stage memo deletion (roadmap native-memory-inert-carriers, operator ruling 2026-10-08): v2.std.staging cached_stage, resolve_probe and CacheProbe had one production caller, the always-Miss compile-stage memo, and are deleted with it; this claim exercised only that lookup wrapper, while then_outcome and its claims remain" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.staging.cached_stage_miss_runs_stage" as NonEmptyStr,
+    deleted_in: "the compile-stage memo deletion (roadmap native-memory-inert-carriers, operator ruling 2026-10-08): v2.std.staging cached_stage, resolve_probe and CacheProbe had one production caller, the always-Miss compile-stage memo, and are deleted with it; this claim exercised only that lookup wrapper, while then_outcome and its claims remain" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.native_cache_fusion_test.witness_warm_marker_agrees_share" as NonEmptyStr,
+    deleted_in: "the inert-carrier deletion (roadmap native-memory-inert-carriers, census #5): v2.workflow.native_cache_fusion stated a synthetic agreement law between a modeled host warm-marker observation and std.emit_on_demand lookup; no production code read it, so the module and its own claims are deleted and the real emit-host native build cache is untouched" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.native_cache_fusion_test.witness_cold_marker_absent_agrees_recompute" as NonEmptyStr,
+    deleted_in: "the inert-carrier deletion (roadmap native-memory-inert-carriers, census #5): v2.workflow.native_cache_fusion stated a synthetic agreement law between a modeled host warm-marker observation and std.emit_on_demand lookup; no production code read it, so the module and its own claims are deleted and the real emit-host native build cache is untouched" as NonEmptyStr,
+  },
+  WitnessDeleted {
+    identity: "v2.test.claim.native_cache_fusion_test.witness_cold_control_forces_recompute_agreement" as NonEmptyStr,
+    deleted_in: "the inert-carrier deletion (roadmap native-memory-inert-carriers, census #5): v2.workflow.native_cache_fusion stated a synthetic agreement law between a modeled host warm-marker observation and std.emit_on_demand lookup; no production code read it, so the module and its own claims are deleted and the real emit-host native build cache is untouched" as NonEmptyStr,
+  },
 ]
 
 fn floor_grandfathered_chunk_000() -> List<String> {
@@ -567,7 +674,7 @@ fn floor_grandfathered_chunk_019() -> List<String> {
 }
 
 fn floor_grandfathered_chunk_020() -> List<String> {
-  Cons { head: "test.claim.prose_citation_census_witness.a_longer_identifier_ending_in_the_suffix_is_not_read_as_its_tail", tail: Cons { head: "test.claim.prose_citation_census_witness.a_name_retired_from_one_path_resolves_its_locality", tail: Cons { head: "test.claim.prose_citation_census_witness.a_name_retired_from_several_paths_refuses_to_pick_a_locality", tail: Cons { head: "test.claim.prose_citation_census_witness.an_annotation_citation_in_another_file_is_one_site_at_its_line", tail: Cons { head: "test.claim.prose_citation_census_witness.an_annotation_line_and_a_prose_row_line_are_different_carriers", tail: Cons { head: "test.claim.prose_citation_census_witness.a_partial_module_index_splits_the_rows_across_both_lists", tail: Cons { head: "test.claim.prose_citation_census_witness.a_populated_module_index_leaves_nothing_unidentified", tail: Cons { head: "test.claim.prose_citation_census_witness.a_program_data_line_is_read_as_not_a_prose_row_not_as_malformed", tail: Cons { head: "test.claim.prose_citation_census_witness.a_prose_row_citation_is_a_prose_row_site", tail: Cons { head: "test.claim.prose_citation_census_witness.a_row_still_declared_in_its_own_module_is_not_retired", tail: Cons { head: "test.claim.prose_citation_census_witness.a_row_whose_bare_name_survives_only_in_another_module_is_retired", tail: Cons { head: "test.claim.prose_citation_census_witness.a_semantic_line_naming_a_retired_row_is_not_a_citation_site", tail: Cons { head: "test.claim.prose_citation_census_witness.a_word_that_merely_starts_with_the_suffix_is_not_a_name", tail: Cons { head: "test.claim.prose_citation_census_witness.every_baseline_line_lands_in_exactly_one_arm", tail: Cons { head: "test.claim.prose_citation_census_witness.prose_naming_a_row_outside_the_retired_index_is_not_a_site", tail: Cons { head: "test.claim.prose_citation_census_witness.the_census_totals_are_projections_of_its_own_site_list", tail: Cons { head: "test.claim.prose_citation_census_witness.the_module_index_reads_module_lines_and_ignores_others", tail: Cons { head: "test.claim.prose_citation_census_witness.the_produced_site_identities_join_with_the_expected_ones_both_ways", tail: Cons { head: "test.claim.prose_citation_census_witness.the_qualified_identity_is_the_module_dot_name_spelling", tail: Cons { head: "test.claim.prose_citation_census_witness.the_same_path_seen_twice_is_still_one_origin", tail: Cons { head: "test.claim.prose_citation_census_witness.the_sample_is_the_twelve_sites_that_were_drawn", tail: Cons { head: "test.claim.prose_citation_census_witness.the_scan_is_non_constant_in_its_retired_index", tail: Cons { head: "test.claim.prose_citation_census_witness.the_trailing_blank_line_is_blank_not_malformed", tail: Cons { head: "test.claim.prose_citation_census_witness.the_twelve_sampled_specimens_are_all_recognised", tail: Cons { head: "test.claim.resolved_call_emission_identity_witness_test.w_divergent_map_get_keeps_declared_outcome_identity", tail: Empty {} } } } } } } } } } } } } } } } } } } } } } } } } }
+  Cons { head: "test.claim.prose_citation_census_witness.a_longer_identifier_ending_in_the_suffix_is_not_read_as_its_tail", tail: Cons { head: "test.claim.prose_citation_census_witness.a_name_retired_from_one_path_resolves_its_locality", tail: Cons { head: "test.claim.prose_citation_census_witness.a_name_retired_from_several_paths_refuses_to_pick_a_locality", tail: Cons { head: "test.claim.prose_citation_census_witness.an_annotation_citation_in_another_file_is_one_site_at_its_line", tail: Cons { head: "test.claim.prose_citation_census_witness.an_annotation_line_and_a_prose_row_line_are_different_carriers", tail: Cons { head: "test.claim.prose_citation_census_witness.a_partial_module_index_splits_the_rows_across_both_lists", tail: Cons { head: "test.claim.prose_citation_census_witness.a_populated_module_index_leaves_nothing_unidentified", tail: Cons { head: "test.claim.prose_citation_census_witness.a_program_data_line_is_read_as_not_a_prose_row_not_as_malformed", tail: Cons { head: "test.claim.prose_citation_census_witness.a_prose_row_citation_is_a_prose_row_site", tail: Cons { head: "test.claim.prose_citation_census_witness.a_row_still_declared_in_its_own_module_is_not_retired", tail: Cons { head: "test.claim.prose_citation_census_witness.a_row_whose_bare_name_survives_only_in_another_module_is_retired", tail: Cons { head: "test.claim.prose_citation_census_witness.a_semantic_line_naming_a_retired_row_is_not_a_citation_site", tail: Cons { head: "test.claim.prose_citation_census_witness.a_word_that_merely_starts_with_the_suffix_is_not_a_name", tail: Cons { head: "test.claim.prose_citation_census_witness.every_baseline_line_lands_in_exactly_one_arm", tail: Cons { head: "test.claim.prose_citation_census_witness.prose_naming_a_row_outside_the_retired_index_is_not_a_site", tail: Cons { head: "test.claim.prose_citation_census_witness.the_census_totals_are_projections_of_its_own_site_list", tail: Cons { head: "test.claim.prose_citation_census_witness.the_module_index_reads_module_lines_and_ignores_others", tail: Cons { head: "test.claim.prose_citation_census_witness.the_produced_site_identities_join_with_the_expected_ones_both_ways", tail: Cons { head: "test.claim.prose_citation_census_witness.the_qualified_identity_is_the_module_dot_name_spelling", tail: Cons { head: "test.claim.prose_citation_census_witness.the_same_path_seen_twice_is_still_one_origin", tail: Cons { head: "test.claim.prose_citation_census_witness.the_sample_is_the_twelve_sites_that_were_drawn", tail: Cons { head: "test.claim.prose_citation_census_witness.the_scan_is_non_constant_in_its_retired_index", tail: Cons { head: "test.claim.prose_citation_census_witness.the_trailing_blank_line_is_blank_not_malformed", tail: Cons { head: "test.claim.prose_citation_census_witness.the_twelve_sampled_specimens_are_all_recognised", tail: Cons { head: "test.claim.resolved_call_emission_identity_witness_test.w_divergent_map_get_checked_keeps_declared_outcome_identity", tail: Empty {} } } } } } } } } } } } } } } } } } } } } } } } } }
 }
 
 fn floor_grandfathered_chunk_021() -> List<String> {
diff --git a/src/v2/workflow/floor_preparation.dag b/src/v2/workflow/floor_preparation.dag
deleted file mode 100644
index 41a5aae7161..00000000000
--- a/src/v2/workflow/floor_preparation.dag
+++ /dev/null
@@ -1,443 +0,0 @@
-module v2.workflow.floor_preparation
-
-import std.types { Bool, List, Map, String }
-import std.content_hash {
-  Fnv1a64Structural,
-  content_hash_atom,
-  content_hash_combine_structural,
-  serialize_content_hash,
-}
-import std.materialization_provider {
-  ArtifactRequest,
-  MaterializedArtifact,
-  ProviderProbe,
-  ProviderLookup,
-  ProviderHit,
-  ResolveClosureRequest,
-  compiler_identity_input,
-  provider_serve,
-  request_key,
-}
-import std.realization_schedule {
-  ScheduleWitnessEntry,
-  CorpusWitnessKind,
-  ExecutionWitnessKind,
-  NativeBundleWitnessKind,
-}
-import v2.workflow.floor_discovery {
-  FloorDiscoveryRequest,
-  floor_discovery_request_identity,
-}
-import v2.std.algebra { list_reverse }
-import std.optional { Absent, Present }
-
-// The prepared floor subject is an opaque semantic identity over the exact discovery request,
-// selected witness identities, and the existing std.materialization_provider ResolveClosureRequest
-// keys. It deliberately does NOT carry MultiEntryIndex or any other compiler container.
-// ProviderProbe is the host read-back seam and provider_serve remains the one request/artifact
-// binding authority. A miss, damaged artifact, incomplete artifact, wrong key, wrong content, or
-// wrong hash family remains the corresponding typed ProviderLookup inside
-// PreparedFloorProviderRefused. There is no cold-construction or fallback arm.
-// SequentialChildProcess may therefore realize this identity as verified materialized
-// resolved-closure artifacts while SharedWalkProcess may realize it as live capabilities; neither
-// realization changes the semantic identity. FIRST CONSUMER: the scoped-witness population named by
-// ROADMAP ci-scoped-worker-shared-substrate. The old scoped cold constructor may delete only after
-// that consumer can serve every exact selected identity through this contract.
-
-type FloorPreparationPolicy
-  = ResolveSelectedClosuresV1 {}
-
-type PreparedFloorEntryRequest {
-  witness: ScheduleWitnessEntry
-  closure_digest: Fnv1a64Structural
-}
-
-type PreparedFloorSubjectRequest {
-  discovery: FloorDiscoveryRequest
-  selected: List<PreparedFloorEntryRequest>
-  policy: FloorPreparationPolicy
-}
-
-type PreparedClaimSubjectIdentity sole_constructor {
-  discovery_request_identity: Fnv1a64Structural
-  selected_identity_digest: Fnv1a64Structural
-  preparation_policy_identity: Fnv1a64Structural
-  artifact_set_identity: Fnv1a64Structural
-}
-
-type PreparedFloorEntryProbe {
-  witness: ScheduleWitnessEntry
-  probe: ProviderProbe
-}
-
-type PreparedFloorEntryArtifact {
-  witness: ScheduleWitnessEntry
-  artifact: MaterializedArtifact
-}
-
-type PreparedFloorSubjectRefusal
-  = PreparedFloorDuplicateSelectedIdentities { duplicates: List<ScheduleWitnessEntry> }
-  | PreparedFloorDuplicateProbeIdentities { duplicates: List<ScheduleWitnessEntry> }
-  | PreparedFloorMissingProbeIdentities { missing: List<ScheduleWitnessEntry> }
-  | PreparedFloorUnexpectedProbeIdentities { unexpected: List<ScheduleWitnessEntry> }
-  | PreparedFloorProviderRefused { witness: ScheduleWitnessEntry, lookup: ProviderLookup }
-
-type PreparedFloorSubjectServe
-  = PreparedFloorSubjectReady {
-      identity: PreparedClaimSubjectIdentity
-      entries: List<PreparedFloorEntryArtifact>
-    }
-  | PreparedFloorSubjectRefused { cause: PreparedFloorSubjectRefusal }
-
-fn floor_preparation_policy_identity(policy: FloorPreparationPolicy) -> Fnv1a64Structural {
-  match policy {
-    ResolveSelectedClosuresV1 {} => content_hash_atom(value: "floor-preparation.resolve-selected-closures-v1")
-  }
-}
-
-fn prepared_floor_witness_kind_identity(witness: ScheduleWitnessEntry) -> String {
-  match witness.kind {
-    CorpusWitnessKind => "corpus"
-    ExecutionWitnessKind => "execution"
-    NativeBundleWitnessKind => "native-bundle"
-  }
-}
-
-fn prepared_floor_witness_identity(witness: ScheduleWitnessEntry) -> Fnv1a64Structural {
-  let with_entry = content_hash_combine_structural(
-    left: content_hash_atom(value: "prepared-floor-witness-v1"),
-    right: content_hash_atom(value: witness.entry),
-  )
-  let with_function = content_hash_combine_structural(
-    left: with_entry,
-    right: content_hash_atom(value: witness.function),
-  )
-  content_hash_combine_structural(
-    left: with_function,
-    right: content_hash_atom(value: prepared_floor_witness_kind_identity(witness: witness)),
-  )
-}
-
-fn prepared_floor_selected_identity(
-  selected: List<PreparedFloorEntryRequest>,
-) -> Fnv1a64Structural {
-  selected |> fold(
-    init: content_hash_atom(value: "prepared-floor-selected-v1"),
-    f: (acc, entry) => content_hash_combine_structural(
-      left: acc,
-      right: prepared_floor_witness_identity(witness: entry.witness),
-    )
-  )
-}
-
-fn prepared_floor_entry_artifact_request(
-  discovery: FloorDiscoveryRequest,
-  entry: PreparedFloorEntryRequest,
-) -> ArtifactRequest {
-  ResolveClosureRequest {
-    closure_digest: entry.closure_digest,
-    compiler: compiler_identity_input(digest: discovery.subject.tool_identity),
-  }
-}
-
-fn prepared_floor_artifact_set_identity(
-  request: PreparedFloorSubjectRequest,
-) -> Fnv1a64Structural {
-  request.selected |> fold(
-    init: content_hash_atom(value: "prepared-floor-artifact-set-v1"),
-    f: (acc, entry) => content_hash_combine_structural(
-      left: acc,
-      right: content_hash_atom(
-        value: serialize_content_hash(
-          hash: request_key(
-            req: prepared_floor_entry_artifact_request(
-              discovery: request.discovery,
-              entry: entry,
-            )
-          )
-        )
-      ),
-    )
-  )
-}
-
-fn prepared_claim_subject_identity(
-  request: PreparedFloorSubjectRequest,
-) -> PreparedClaimSubjectIdentity {
-  PreparedClaimSubjectIdentity {
-    discovery_request_identity: floor_discovery_request_identity(request: request.discovery),
-    selected_identity_digest: prepared_floor_selected_identity(selected: request.selected),
-    preparation_policy_identity: floor_preparation_policy_identity(policy: request.policy),
-    artifact_set_identity: prepared_floor_artifact_set_identity(request: request),
-  }
-}
-
-type PreparedFloorWitnessMultiplicityIndex {
-  witnessed: Map<ScheduleWitnessEntry, Bool>
-  duplicated: Map<ScheduleWitnessEntry, Bool>
-}
-
-fn prepared_floor_identity_map_contains(
-  identities: Map<ScheduleWitnessEntry, Bool>,
-  witness: ScheduleWitnessEntry,
-) -> Bool {
-  match identities.lookup(witness) {
-    Absent => false
-    Present { value: _ } => true
-  }
-}
-
-fn prepared_floor_witness_multiplicity_step(
-  index: PreparedFloorWitnessMultiplicityIndex,
-  witness: ScheduleWitnessEntry,
-) -> PreparedFloorWitnessMultiplicityIndex {
-  if prepared_floor_identity_map_contains(identities: index.witnessed, witness: witness) {
-    PreparedFloorWitnessMultiplicityIndex {
-      witnessed: index.witnessed,
-      duplicated: map_insert(index.duplicated, witness, true),
-    }
-  } else {
-    PreparedFloorWitnessMultiplicityIndex {
-      witnessed: map_insert(index.witnessed, witness, true),
-      duplicated: index.duplicated,
-    }
-  }
-}
-
-fn prepared_floor_selected_multiplicity_index(
-  selected: List<PreparedFloorEntryRequest>,
-) -> PreparedFloorWitnessMultiplicityIndex {
-  selected |> fold(
-    init: PreparedFloorWitnessMultiplicityIndex {
-      witnessed: empty_map(),
-      duplicated: empty_map(),
-    },
-    f: (index, entry) => prepared_floor_witness_multiplicity_step(
-      index: index,
-      witness: entry.witness,
-    )
-  )
-}
-
-type PreparedFloorProbeIndex {
-  multiplicity: PreparedFloorWitnessMultiplicityIndex
-  by_witness: Map<ScheduleWitnessEntry, PreparedFloorEntryProbe>
-}
-
-fn prepared_floor_probe_index_step(
-  index: PreparedFloorProbeIndex,
-  entry: PreparedFloorEntryProbe,
-) -> PreparedFloorProbeIndex {
-  PreparedFloorProbeIndex {
-    multiplicity: prepared_floor_witness_multiplicity_step(
-      index: index.multiplicity,
-      witness: entry.witness,
-    ),
-    by_witness: map_insert(index.by_witness, entry.witness, entry),
-  }
-}
-
-fn prepared_floor_probe_index(
-  probes: List<PreparedFloorEntryProbe>,
-) -> PreparedFloorProbeIndex {
-  probes |> fold(
-    init: PreparedFloorProbeIndex {
-      multiplicity: PreparedFloorWitnessMultiplicityIndex {
-        witnessed: empty_map(),
-        duplicated: empty_map(),
-      },
-      by_witness: empty_map(),
-    },
-    f: (index, entry) => prepared_floor_probe_index_step(index: index, entry: entry)
-  )
-}
-
-type PreparedFloorIdentityIndex {
-  selected: PreparedFloorWitnessMultiplicityIndex
-  probes: PreparedFloorProbeIndex
-}
-
-fn prepared_floor_identity_index(
-  selected: List<PreparedFloorEntryRequest>,
-  probes: List<PreparedFloorEntryProbe>,
-) -> PreparedFloorIdentityIndex {
-  PreparedFloorIdentityIndex {
-    selected: prepared_floor_selected_multiplicity_index(selected: selected),
-    probes: prepared_floor_probe_index(probes: probes),
-  }
-}
-
-fn prepared_floor_probe_for_witness(
-  index: PreparedFloorIdentityIndex,
-  witness: ScheduleWitnessEntry,
-) -> PreparedFloorEntryProbe? {
-  index.probes.by_witness.lookup(witness)
-}
-
-// THE SELECTED/PROBE JOIN IS INDEXED ON THE EXISTING ScheduleWitnessEntry IDENTITY. The former
-// duplicate, missing, unexpected, and serve lookups filtered an entire population once per row, so
-// preparing n witnesses performed quadratic identity comparisons before any artifact could be
-// served. Each side now makes one pass through the existing native Map substrate: the witnessed map
-// establishes membership, the duplicated map preserves multiplicity standing, and the probe map
-// serves the already-proven singleton row. The four refusal projections then make one linear pass
-// each while preserving input order. There is no digest-key shortcut and therefore no collision
-// state — every map key is ScheduleWitnessEntry itself, whose structural equality is the same
-// entry/function/kind grain as schedule_witness_entry_eq.
-
-fn prepared_floor_duplicate_selected_identities(
-  selected: List<PreparedFloorEntryRequest>,
-  index: PreparedFloorIdentityIndex,
-) -> List<ScheduleWitnessEntry> {
-  selected
-    |> filter(entry => prepared_floor_identity_map_contains(
-      identities: index.selected.duplicated,
-      witness: entry.witness,
-    ))
-    |> map(entry => entry.witness)
-}
-
-fn prepared_floor_duplicate_probe_identities(
-  probes: List<PreparedFloorEntryProbe>,
-  index: PreparedFloorIdentityIndex,
-) -> List<ScheduleWitnessEntry> {
-  probes
-    |> filter(entry => prepared_floor_identity_map_contains(
-      identities: index.probes.multiplicity.duplicated,
-      witness: entry.witness,
-    ))
-    |> map(entry => entry.witness)
-}
-
-fn prepared_floor_missing_probe_identities(
-  selected: List<PreparedFloorEntryRequest>,
-  index: PreparedFloorIdentityIndex,
-) -> List<ScheduleWitnessEntry> {
-  selected
-    |> filter(entry => !prepared_floor_identity_map_contains(
-      identities: index.probes.multiplicity.witnessed,
-      witness: entry.witness,
-    ))
-    |> map(entry => entry.witness)
-}
-
-fn prepared_floor_unexpected_probe_identities(
-  probes: List<PreparedFloorEntryProbe>,
-  index: PreparedFloorIdentityIndex,
-) -> List<ScheduleWitnessEntry> {
-  probes
-    |> filter(entry => !prepared_floor_identity_map_contains(
-      identities: index.selected.witnessed,
-      witness: entry.witness,
-    ))
-    |> map(entry => entry.witness)
-}
-
-type PreparedFloorServeFold
-  = PreparedFloorServeContinue { entries: List<PreparedFloorEntryArtifact> }
-  | PreparedFloorServeStopped { cause: PreparedFloorSubjectRefusal }
-
-fn prepared_floor_serve_one(
-  request: PreparedFloorSubjectRequest,
-  index: PreparedFloorIdentityIndex,
-  state: PreparedFloorServeFold,
-  entry: PreparedFloorEntryRequest,
-) -> PreparedFloorServeFold {
-  match state {
-    PreparedFloorServeStopped { cause: c } => PreparedFloorServeStopped { cause: c }
-    PreparedFloorServeContinue { entries: entries } => {
-      match prepared_floor_probe_for_witness(
-        index: index,
-        witness: entry.witness,
-      ) {
-        Absent => PreparedFloorServeStopped {
-          cause: PreparedFloorMissingProbeIdentities { missing: [entry.witness] }
-        }
-        Present { value: prepared_probe } => match provider_serve(
-          req: prepared_floor_entry_artifact_request(
-            discovery: request.discovery,
-            entry: entry,
-          ),
-          probe: prepared_probe.probe,
-        ) {
-          ProviderHit { artifact: artifact, identity: _ } =>
-            PreparedFloorServeContinue {
-              entries: concat([PreparedFloorEntryArtifact {
-                witness: entry.witness,
-                artifact: artifact,
-              }], entries),
-            }
-          other => PreparedFloorServeStopped {
-            cause: PreparedFloorProviderRefused {
-              witness: entry.witness,
-              lookup: other,
-            }
-          }
-        }
-      }
-    }
-  }
-}
-
-// THE SERVE FOLD PREPENDS AND REVERSES ONCE. Right-appending one artifact to the growing prefix
-// copied the accumulated list on every selected witness, making the success path quadratic even
-// after identity lookup was indexed. prepared_floor_serve_one now conses the singleton artifact
-// before the accumulator; prepared_floor_subject_serve reverses exactly once at the successful
-// boundary so PreparedFloorSubjectReady.entries remains in selected-request order. The
-// exact_prepared_artifact_set_serves control observes that order and reds if the terminal reverse
-// is removed.
-
-fn prepared_floor_subject_serve(
-  request: PreparedFloorSubjectRequest,
-  probes: List<PreparedFloorEntryProbe>,
-) -> PreparedFloorSubjectServe {
-  let index = prepared_floor_identity_index(selected: request.selected, probes: probes)
-  let duplicate_selected = prepared_floor_duplicate_selected_identities(
-    selected: request.selected,
-    index: index,
-  )
-  let duplicate_probes = prepared_floor_duplicate_probe_identities(
-    probes: probes,
-    index: index,
-  )
-  let missing = prepared_floor_missing_probe_identities(
-    selected: request.selected,
-    index: index,
-  )
-  let unexpected = prepared_floor_unexpected_probe_identities(
-    probes: probes,
-    index: index,
-  )
-  if duplicate_selected.count() > 0 {
-    PreparedFloorSubjectRefused {
-      cause: PreparedFloorDuplicateSelectedIdentities { duplicates: duplicate_selected }
-    }
-  } else if duplicate_probes.count() > 0 {
-    PreparedFloorSubjectRefused {
-      cause: PreparedFloorDuplicateProbeIdentities { duplicates: duplicate_probes }
-    }
-  } else if missing.count() > 0 {
-    PreparedFloorSubjectRefused {
-      cause: PreparedFloorMissingProbeIdentities { missing: missing }
-    }
-  } else if unexpected.count() > 0 {
-    PreparedFloorSubjectRefused {
-      cause: PreparedFloorUnexpectedProbeIdentities { unexpected: unexpected }
-    }
-  } else {
-    match request.selected |> fold(
-      init: PreparedFloorServeContinue { entries: [] },
-      f: (state, entry) => prepared_floor_serve_one(
-        request: request,
-        index: index,
-        state: state,
-        entry: entry,
-      )
-    ) {
-      PreparedFloorServeContinue { entries: entries } => PreparedFloorSubjectReady {
-        identity: prepared_claim_subject_identity(request: request),
-        entries: list_reverse(xs: entries),
-      }
-      PreparedFloorServeStopped { cause: cause } => PreparedFloorSubjectRefused { cause: cause }
-    }
-  }
-}
diff --git a/src/v2/workflow/floor_pure_producer_share.dag b/src/v2/workflow/floor_pure_producer_share.dag
index 28d3129de9e..3efe867e1e0 100644
--- a/src/v2/workflow/floor_pure_producer_share.dag
+++ b/src/v2/workflow/floor_pure_producer_share.dag
@@ -17,7 +17,7 @@ import std.materialization_ladder {
 import std.measure { Millisecond, Nanosecond, byte_size, millisecond_count, nanosecond, nanosecond_count }
 import v2.workflow.required_floor { required_floor_new_witness_envelope_ms }
 import v2.std.algebra { any, list_flat_map, list_map }
-import v2.std.collection { empty_map, map_get, map_insert }
+import v2.std.collection { empty_map, map_get_checked, map_insert }
 import v2.std.diagnostic { Accepted, Rejected, Outcome }
 import std.optional { Absent, Present, Optional }
 
@@ -401,7 +401,7 @@ fn share_map_lookup_causes<T>(o: Outcome<Optional<T>>) -> List<ConsumerReadCause
 }
 
 fn reads_whole_value(wholes: Map<String, Bool>, claim: String) -> Bool {
-  let o = map_get(wholes, claim)
+  let o = map_get_checked(wholes, claim)
   if length(xs: share_map_lookup_causes(o: o)) > 0 {
     false
   } else {
@@ -414,7 +414,7 @@ fn reads_whole_value(wholes: Map<String, Bool>, claim: String) -> Bool {
 }
 
 fn projection_count(counts: Map<String, Int>, field: String) -> Int {
-  let o = map_get(counts, field)
+  let o = map_get_checked(counts, field)
   if length(xs: share_map_lookup_causes(o: o)) > 0 {
     0
   } else {
@@ -432,14 +432,14 @@ type ShareCountState {
 }
 
 fn add_projection_count(state: ShareCountState, wholes: Map<String, Bool>, claim: String, field: String) -> ShareCountState {
-  let whole_o = map_get(wholes, claim)
+  let whole_o = map_get_checked(wholes, claim)
   let whole_unread = share_map_lookup_causes(o: whole_o)
   if length(xs: whole_unread) > 0 {
     ShareCountState { counts: state.counts, unread: concat(state.unread, whole_unread) }
   } else if reads_whole_value(wholes: wholes, claim: claim) {
     state
   } else {
-    let count_o = map_get(state.counts, field)
+    let count_o = map_get_checked(state.counts, field)
     let count_unread = share_map_lookup_causes(o: count_o)
     if length(xs: count_unread) > 0 {
       ShareCountState { counts: state.counts, unread: concat(state.unread, count_unread) }
@@ -475,7 +475,7 @@ fn sole_projections_from_state(reads: List<ClaimConsumerRead>, counts: Map<Strin
   list_flat_map(xs: reads, f: fn(r) {
     match r.read {
       ProjectedField { field: f } =>
-        let count_o = map_get(counts, f)
+        let count_o = map_get_checked(counts, f)
         let unread = share_map_lookup_causes(o: count_o)
         if length(xs: unread) > 0 {
           []
@@ -798,7 +798,25 @@ fn floor_single_claim_fill_debt_active_claims() -> List<String> {
 // steps each against the 72300 new-witness budget). That run names exactly these nine.
 // Twelve more were added from probe 37238532455, for the sixteen rows gunbc#13187 added to the hand
 // roster (v2.test.claim.compiler.generic_formal_instantiation): all twelve claims of the module.
+// One more was added from gunbc#13308's own floor run 37270043819 (head dc9a7079), which measured it
+// COMPLETED-OVER-COST-REQUIREMENT as a single-claim demander: v2.test.claim.native_census.infer_cascade
+// census_infer_provider_cascade_is_one_root_with_fan_out_one_holds, the one real-route inhabitance
+// claim; assemble + resolve + infer of the cascade fixture. Its module's other controls supply values
+// at the folds they judge (DESIGN section 3 witness rule) and are not members. Trigger: assemble + infer
+// of a one-module fixture under the per-claim budget.
 // Re-derive with that probe; do not extend by hand.
+// gunbc#13320 (XL-2): its ONE real-path inhabitance claim, kept per the DESIGN section 3 witness rule (every
+// other claim in the module supplies its input; sharp-raven-357 approved this member). Over the 72,300
+// new-witness budget on its floor run at a2485f0 by the pipeline's per-claim fixed
+// cost of assembling and inferring a one-module fixture, not the test's own work. Trigger: assemble plus infer
+// of a one-module fixture runs under the per-claim budget (gunbc.recurring_failure_mode
+// shared_precondition_re_derived_once_per_claim_frame).
+// gunbc#13307 (XL-2): its ONE real-path inhabitance claim, kept per the DESIGN section 3 witness rule (every
+// other claim in the module supplies its input; sharp-raven-357 approved this member). Over the 72,300
+// new-witness budget on that PR's floor run 37240332005 (886,357 steps) by the pipeline's per-claim fixed cost
+// of assembling and inferring a one-module fixture, not the test's own work. Trigger: assemble plus infer of a
+// one-module fixture runs under the per-claim budget (gunbc.recurring_failure_mode
+// shared_precondition_re_derived_once_per_claim_frame).
 //
 // THE xl2 MEMBERS (test.claim.namespace_xl2_rehearsal_census) were the bundle `xl2_control_runs`,
 // declined as BundleOfDisjointProjections on floor run 37194676016: each reads its own rehearsal
@@ -815,13 +833,76 @@ fn floor_single_claim_fill_debt_active_claims() -> List<String> {
 // is SHARED; what remains over the new-witness budget on floor run 37207183924 is each claim's OWN
 // stage (its route, infer or front end), which the bundle had been netting from the claim silently.
 // That transfer is named here per claim instead.
+// Two more, from gunbc#12942 (body lowering's sealed term), on the same ground as every member above:
+// each claim is the one demander of a nullary parse producer that change had added to the hand
+// roster before main deleted it (door_data_literal_normalized, ulsh_route_postfix), and each is that
+// module's ONE inhabitance claim on the real front-end path, so supplying its subject is not available
+// without removing the last real execution (DESIGN section 3, the pairing obligation). These two were
+// written in the change itself rather than read from a probe pair, because the change and the
+// roster's deletion met only at the merge; re-derive them with the probe like every other member.
+// One more for gunbc#13325, from floor run 37247019357 (930,914 eval steps): the ONE real-path
+// inhabitance claim of v2.test.claim.compiler.declared_return_result, whose other five claims supply
+// their inputs at the result-type interface (DESIGN section 3). Its fixture program, drr_route_source,
+// has no other demander, so derived sharing cannot cover it.
 // gunbc#13207 (XL-2 collection concat): its ONE real-path inhabitance claim, kept per the DESIGN section 3
 // witness rule (every other claim in the module supplies its input; sharp-raven-357 approved this member).
 // Measured on that PR's floor run 37238836376: 902,997 eval steps against the 72,300 new-witness budget -- the
 // pipeline's per-claim fixed cost of assembling and inferring a one-module fixture, not the test's own work.
 // Trigger: assemble plus infer of a one-module fixture runs under the per-claim budget
 // (gunbc.recurring_failure_mode shared_precondition_re_derived_once_per_claim_frame).
+// gunbc#13511 (kernel-value join): the ONE real-path inhabitance of v2.test.claim.compiler.generic_closure_outcome_construct_probe,
+// gbo_a_kernel_literal_inhabits_an_alias_of_the_corpus_int_holds (red with the join deleted and with input-only recognition). Its own-frame eval steps are
+// re-derived by claim_batch --hermetic --entry src/v2/test/claim/compiler/generic_closure_outcome_construct_probe_test.dag
+// --functions gbo_a_kernel_literal_inhabits_an_alias_of_the_corpus_int_holds (receipt: BuildBuddy a63835e8, pinned
+// 46da0c8fa0; red with the join deleted, BuildBuddy 50c58a76, and with input-only recognition, BuildBuddy 2002ea86).
+// Trigger: shared_precondition_re_derived_once_per_claim_frame, as above.
+// gunbc#13621 (a data reference uses its value): its ONE real-path inhabitance claim,
+// drv_a_data_reference_is_typed_at_its_declared_type_and_evaluates_to_its_value, kept per the DESIGN section 3
+// witness rule (the module's other six claims supply their input; sharp-raven-357 approved this member). Measured
+// by that PR's required floor (claim_executor --required-ci --required-lane witnesses) on run 37941635939 at
+// 315f7ec8: 86,566 eval steps against the 72,300 new-witness budget, after the fixture was reduced to one
+// constant, one fn and one call, assembled once (a served shared fill) and inferred once. The residual is the
+// one inference, which the floor cannot share or net because an inferred tree is not a portable served value
+// (cross-claim-share-store-declined cause=ServeCacheValueNotPortable). Trigger: the served-value tier admits
+// an InferredTree as a portable value, SUFFICIENT FOR a one-claim inference fixture to be netted like an
+// assembly -- or the shared_precondition_re_derived_once_per_claim_frame trigger above, whichever lands first.
 data floor_single_claim_fill_debt: List<SingleClaimFillDebtModule> = [
+  SingleClaimFillDebtModule {
+    module: "v2.test.claim.body_lowering_data_literal_door",
+    claims: [
+      SingleClaimFillDebtClaim { claim: "a_data_declaration_with_an_int_literal_normalizes_holds", standing: ActiveFillDebt }
+    ]
+  },
+  SingleClaimFillDebtModule {
+    module: "v2.test.claim.body_lowering_unrecognised_lowered_shape",
+    claims: [
+      SingleClaimFillDebtClaim { claim: "a_passed_through_atom_leaves_the_fold_sealed", standing: ActiveFillDebt }
+    ]
+  },
+  SingleClaimFillDebtModule {
+    module: "v2.test.claim.compiler.literal_elaboration",
+    claims: [
+      SingleClaimFillDebtClaim { claim: "lel_route_runs_on_the_real_path", standing: ActiveFillDebt },
+    ]
+  },
+  SingleClaimFillDebtModule {
+    module: "v2.test.claim.compiler.collection_count_realization",
+    claims: [
+      SingleClaimFillDebtClaim { claim: "ccc_route_runs_on_the_real_path", standing: ActiveFillDebt },
+    ]
+  },
+  SingleClaimFillDebtModule {
+    module: "v2.test.claim.compiler.declared_return_result",
+    claims: [
+      SingleClaimFillDebtClaim { claim: "drr_the_real_route_judges_a_projected_generic_call_result", standing: ActiveFillDebt }
+    ]
+  },
+  SingleClaimFillDebtModule {
+    module: "v2.test.claim.compiler.generic_closure_outcome_construct_probe",
+    claims: [
+      SingleClaimFillDebtClaim { claim: "gbo_a_kernel_literal_inhabits_an_alias_of_the_corpus_int_holds", standing: ActiveFillDebt }
+    ]
+  },
   SingleClaimFillDebtModule {
     module: "v2.test.claim.body_lowering.fold_operand_structure",
     claims: [
@@ -838,6 +919,12 @@ data floor_single_claim_fill_debt: List<SingleClaimFillDebtModule> = [
       SingleClaimFillDebtClaim { claim: "xl2_nested_reference_is_residual_after_the_strip_holds", standing: ActiveFillDebt }
     ]
   },
+  SingleClaimFillDebtModule {
+    module: "v2.test.claim.compiler.data_reference_value",
+    claims: [
+      SingleClaimFillDebtClaim { claim: "drv_a_data_reference_is_typed_at_its_declared_type_and_evaluates_to_its_value", standing: ActiveFillDebt }
+    ]
+  },
   SingleClaimFillDebtModule {
     module: "v2.test.claim.compiler.collection_concat_realization",
     claims: [
@@ -907,6 +994,12 @@ data floor_single_claim_fill_debt: List<SingleClaimFillDebtModule> = [
       SingleClaimFillDebtClaim { claim: "ccr_piped_map_head_binds_its_row", standing: ActiveFillDebt }
     ]
   },
+  SingleClaimFillDebtModule {
+    module: "v2.test.claim.native_census.infer_cascade",
+    claims: [
+      SingleClaimFillDebtClaim { claim: "census_infer_provider_cascade_is_one_root_with_fan_out_one_holds", standing: ActiveFillDebt }
+    ]
+  },
   SingleClaimFillDebtModule {
     module: "v2.test.claim.native_census.cascade_root_fan_out",
     claims: [
@@ -1145,7 +1238,7 @@ data floor_single_claim_fill_debt: List<SingleClaimFillDebtModule> = [
     claims: [
       SingleClaimFillDebtClaim { claim: "rcf_a_bool_declared_field_value_of_the_wrong_type_refuses_holds", standing: ActiveFillDebt },
       SingleClaimFillDebtClaim { claim: "rcf_a_construct_is_its_declared_record_at_a_declared_type_holds", standing: ActiveFillDebt },
-      SingleClaimFillDebtClaim { claim: "rcf_a_cross_module_records_field_value_is_counted_not_judged_holds", standing: ActiveFillDebt },
+      SingleClaimFillDebtClaim { claim: "rcf_a_cross_module_records_field_value_of_the_wrong_type_refuses_holds", standing: ActiveFillDebt },
       SingleClaimFillDebtClaim { claim: "rcf_a_cross_module_records_missing_field_refuses_holds", standing: ActiveFillDebt },
       SingleClaimFillDebtClaim { claim: "rcf_a_generic_record_at_its_instantiation_is_accepted_and_decided_holds", standing: ActiveFillDebt },
       SingleClaimFillDebtClaim { claim: "rcf_a_generic_records_second_field_must_inhabit_the_instance_holds", standing: ActiveFillDebt },
@@ -1413,7 +1506,7 @@ data floor_single_claim_fill_debt: List<SingleClaimFillDebtModule> = [
     ]
   },
   SingleClaimFillDebtModule {
-    module: "v2.test.claim.parse.pattern_and_let_sugar",
+    module: "test.claim.parse_test_pattern_and_let_sugar",
     claims: [
       SingleClaimFillDebtClaim { claim: "a_bare_assignment_lowers_identically_to_let_holds", standing: ActiveFillDebt },
       SingleClaimFillDebtClaim { claim: "a_generic_pattern_refuses_at_its_generic_params_holds", standing: ActiveFillDebt },
diff --git a/src/v2/workflow/floor_route_gap.dag b/src/v2/workflow/floor_route_gap.dag
index dbd2cd7655a..d84df73bb4a 100644
--- a/src/v2/workflow/floor_route_gap.dag
+++ b/src/v2/workflow/floor_route_gap.dag
@@ -487,6 +487,8 @@ fn floor_route_gap_expectation_chunk_00() -> List<FloorRouteGapExpectation> {
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.codex_app_server_press_wet_witness_test.press_account_trip_yields_standing_or_typed_refusal_never_turn_started_holds", operation: "Dir", ground: NoMockResponse {} },
     tail: Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.srv3_seeded_install_media_real_execution.a_seed_artifact_is_fetched_read_back_and_an_escaping_name_moves_no_byte_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
+    tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.codex_package_delivery_wet_witness_test.acquire_required_codex_tarball_sha512_matches_lock", operation: "Dir", ground: NoMockResponse {} },
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.codex_package_delivery_wet_witness_test.acquire_exact_target_pair_admits_wrapper_and_platform", operation: "KernelName", ground: NoMockResponse {} },
@@ -520,7 +522,7 @@ fn floor_route_gap_expectation_chunk_00() -> List<FloorRouteGapExpectation> {
     head: FloorRouteGapExpectation { identity: "test.claim.codex_supervised_turn_wet_witness_test.wet_finish_observe_native_digest_only", operation: "Check", ground: NoMockResponse {} },
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.codex_supervised_turn_wet_witness_test.wet_finish_observe_toolchain_only", operation: "Check", ground: NoMockResponse {} },
-    tail: Empty {}
+    tail: Empty {} }
   }
   }
   }
@@ -952,63 +954,15 @@ fn floor_route_gap_expectation_chunk_08() -> List<FloorRouteGapExpectation> {
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.devboot_text_blob_real_execution.a_lease_claim_is_stored_as_exactly_its_bytes_in_the_bare_store_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
     tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_authority_log_real_execution.a_standing_recovery_selects_the_one_claim_quiesces_after_selection_and_reads_back_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_authority_log_real_execution.a_transition_is_read_back_and_a_stale_one_names_the_current_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_authority_log_real_execution.an_unclaimed_group_is_refused_at_the_claim_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
     tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.the_production_route_settles_and_the_lease_governs_launch_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_authorization_witness.a_frozen_intent_re_derives_the_filed_request_and_refuses_another_transaction", operation: "DigestStdin", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_filing_frozen_once_is_read_back_as_the_same_request_without_a_live_subject_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_standing_release_resumes_from_its_frozen_approval_after_the_main_row_changes_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.the_door_reads_the_frozen_filing_to_decide_a_rerun_without_a_live_subject_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_grant_whose_window_passed_before_the_claim_takes_no_claim_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_rerun_resumes_its_own_pending_state_and_restores_the_exact_active_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_fence_and_a_restore_each_reach_their_terminal_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_seat_granted_after_the_suspension_landed_is_released_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.durable_cas_fabric_storage_real_execution.one_slot_is_one_head_and_two_bindings_see_one_generation_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.durable_cas_fabric_storage_real_execution.a_cycled_value_does_not_let_a_stale_writer_advance_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
     tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.the_same_grant_claimed_from_two_executors_is_held_once_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_crash_after_the_claim_and_before_the_first_write_is_recovered_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_crash_after_the_settling_write_and_before_completion_completes_the_claim_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_grant_over_another_host_population_is_refused_before_any_claim_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_front_door_real_execution.an_error_status_is_an_answer_and_no_listener_is_silence_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_front_door_real_execution.a_front_door_answering_500_fences_the_group_through_the_transaction_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_fresh_authorization_under_a_reused_word_is_not_completed_from_the_old_history_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_population_change_after_the_claim_aborts_before_a_write_and_fences_after_one_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_front_door_real_execution.a_listener_that_accepts_and_never_answers_fences_rather_than_reading_as_absent_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.a_second_executor_cannot_abort_a_pending_lifecycle_it_did_not_write_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_front_door_real_execution.a_failed_connect_fences_under_an_active_head_unit_and_suspends_only_under_a_quiet_one_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.any_executor_completes_a_settled_lifecycle_and_never_restarts_it_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_real_execution.the_production_admission_commits_the_frozen_hosts_of_a_fenced_lifecycle_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_front_door_real_execution.a_listener_behind_a_failed_connect_is_read_on_the_host_and_fences_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_authority_log_real_execution.a_live_host_effect_claim_fences_the_reclaim_until_released_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
+    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_authority_log_real_execution.a_serving_arm_host_is_refused_by_the_real_commitment_and_nothing_is_appended_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_authority_log_real_execution.an_overdue_host_effect_claim_fences_until_released_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
     tail: Cons {
@@ -1031,31 +985,7 @@ fn floor_route_gap_expectation_chunk_08() -> List<FloorRouteGapExpectation> {
   }
   }
   }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
-  }
+    }
   }
   }
   }
@@ -1149,6 +1079,8 @@ fn floor_route_gap_expectation_chunk_09() -> List<FloorRouteGapExpectation> {
     head: FloorRouteGapExpectation { identity: "test.claim.materialization_store_local_wet_witness.a_refused_part_publish_leaves_no_temporary_copy_by_real_execution", operation: "DirWithTemplate", ground: NoMockResponse {} },
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.materialization_store_local_wet_witness.a_leftover_copy_that_cannot_be_removed_leaves_the_store_unwritable_by_real_execution", operation: "DirWithTemplate", ground: NoMockResponse {} },
+    tail: Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.materialization_store_local_wet_witness.n_commits_under_one_held_session_acquire_the_hold_once_by_real_execution", operation: "DirWithTemplate", ground: NoMockResponse {} },
     tail: Empty {}
     }
     }
@@ -1180,6 +1112,7 @@ fn floor_route_gap_expectation_chunk_09() -> List<FloorRouteGapExpectation> {
     }
     }
     }
+    }
   }
   }
   }
@@ -1190,22 +1123,18 @@ fn floor_route_gap_expectation_chunk_09() -> List<FloorRouteGapExpectation> {
   }
 }
 
-// MegaRAC committed-artifact sha256sum: first host effect is shell.Mktemp.Dir (checksum
+// Committed SOL host payload sha256sum: first host effect is shell.Mktemp.Dir (checksum
 // file), which declares no mock_response. Triple with local_repo_wet_schedule and the
-// LocalRepoWetLane exclusion on megarac_spx_ui_surface_artifact_integrity_witness_test.dag.
-// The catalog-contents Read of the same checkout path is hermetic input, not a route gap.
+// LocalRepoWetLane exclusion on mtcollins_sol_host_payload_integrity_witness_test.dag.
 // Memory capture verification consumes DigestStdin over the bytes read once.
 fn floor_route_gap_expectation_chunk_10() -> List<FloorRouteGapExpectation> {
   Cons { head: FloorRouteGapExpectation { identity: "test.claim.memory_capture_real_execution_witness.w_capture_digest_binds_consumed_content", operation: "DigestStdin", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.pre_os_capture_replay_witness.w_early_exit_refuses_absence_on_real_bytes", operation: "DigestStdin", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.pre_os_capture_replay_witness.w_four_real_captures_retain_statement_inventory_and_missing_receipts", operation: "DigestStdin", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.pre_os_capture_replay_witness.w_truncated_configuration_cannot_support_absence", operation: "DigestStdin", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.pre_os_capture_replay_witness.w_real_host_userspace_positive_and_truncated_negative", operation: "DigestStdin", ground: NoMockResponse {} }, tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.megarac_spx_ui_surface_artifact_integrity_witness.committed_spx_ui_surface_hashes_to_the_catalog_identity", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.megarac_spx_ui_surface_artifact_integrity_witness.committed_sol_host_payload_hashes_to_the_positive_control_identity", operation: "Dir", ground: NoMockResponse {} },
+    head: FloorRouteGapExpectation { identity: "test.claim.mtcollins_sol_host_payload_integrity_witness.committed_sol_host_payload_hashes_to_the_positive_control_identity", operation: "Dir", ground: NoMockResponse {} },
     tail: Empty {}
   }
   }
   }
   }
-  }
 
   }
   }
@@ -1292,6 +1221,10 @@ fn floor_route_gap_expectation_chunk_12() -> List<FloorRouteGapExpectation> {
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.durable_cas_file_store_wet_witness.a_racing_writer_under_a_window_retries_and_loses_no_commit_by_real_execution", operation: "DirWithTemplate", ground: NoMockResponse {} },
     tail: Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.durable_cas_file_store_wet_witness.a_window_observation_at_generation_1500_terminates_by_real_execution", operation: "DirWithTemplate", ground: NoMockResponse {} },
+    tail: Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.durable_cas_file_store_wet_witness.reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution", operation: "DirWithTemplate", ground: NoMockResponse {} },
+    tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.filesystem_link_create_new_wet_witness.a_link_publishes_the_source_bytes_and_keeps_the_source_by_real_execution", operation: "DirWithTemplate", ground: NoMockResponse {} },
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.filesystem_link_create_new_wet_witness.an_existing_target_refuses_as_occupied_and_is_unchanged_by_real_execution", operation: "DirWithTemplate", ground: NoMockResponse {} },
@@ -1307,6 +1240,8 @@ fn floor_route_gap_expectation_chunk_12() -> List<FloorRouteGapExpectation> {
     }
     }
     }
+    }
+    }
   }
   }
   }
@@ -1335,7 +1270,7 @@ fn floor_route_gap_expectation_chunk_12() -> List<FloorRouteGapExpectation> {
 // WetScheduledClaim row, and the gunbc.ci_layer_roots
 // LocalRepoWetLane row for approval_device_routes_wet_witness_test.dag.
 fn floor_route_gap_expectation_chunk_13() -> List<FloorRouteGapExpectation> {
-  Cons { head: FloorRouteGapExpectation { identity: "test.claim.spark.v41_row_store_encode_witness.the_receipt_was_produced_by_the_rendered_program_the_mode_ships", operation: "DigestStdin", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.spark.v41_engram_runtime_witness.the_live_storage_backed_patches_are_digestfile_of_committed_bytes", operation: "DigestFile", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.spark.v41_runtime_candidate_witness.observed_patches_do_not_mint_a_patched_source_tree", operation: "DigestFile", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.spark.v41_runtime_candidate_witness.the_live_candidate_is_keyed_end_to_end", operation: "DigestFile", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_authorization_witness.the_live_subject_exists_exactly_when_the_candidate_is_keyed_and_read_back", operation: "DigestFile", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.spark.v41_engram_runtime_witness.control_published_infeasibility_is_not_weakened_by_a_keyed_specification", operation: "DigestFile", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.spark.v41_source_patch_converge_witness.digestfile_inhabits_the_committed_patch_population", operation: "DigestFile", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.spark.v41_source_patch_converge_witness.empty_diff_has_a_real_digest", operation: "DigestStdin", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.spark.v41_source_patch_converge_witness.red5_the_arm_a_set_srv8_carried_is_derived_byte_exactly_from_history", operation: "Dir", ground: NoMockResponse {} }, tail: Cons { head: FloorRouteGapExpectation { identity: "test.claim.approval_device_routes_wet_witness_test.a_bound_realization_passes_the_read_past_the_gate", operation: "Read", ground: NoMockResponse {} }, tail: Empty {} } } } } } } } } } }
+  Cons { head: FloorRouteGapExpectation { identity: "test.claim.approval_device_routes_wet_witness_test.a_bound_realization_passes_the_read_past_the_gate", operation: "Read", ground: NoMockResponse {} }, tail: Empty {} }
 }
 
 // THE DECLARED-UNIT DIGEST MINT IS THE ONE ROUTE GAP THESE IDENTITIES SHARE.
@@ -1379,8 +1314,6 @@ fn floor_route_gap_expectation_chunk_14() -> List<FloorRouteGapExpectation> {
       tail: Cons {
         head: FloorRouteGapExpectation { identity: "test.claim.serving.serving_availability_bind_wet_witness.a_ready_route_reaches_the_existing_incarnation_frontier_in_the_product_path", operation: "DigestStdin", ground: NoMockResponse {} },
         tail: Cons {
-        head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_incumbent_identity_wet_witness.the_production_declaration_keys_group_a_and_refuses_group_b", operation: "DigestStdin", ground: NoMockResponse {} },
-          tail: Cons {
             head: FloorRouteGapExpectation { identity: "test.claim.spark.spark_serving_offer_route_witness_test.a_different_reported_path_does_not_bind_an_offer", operation: "DigestStdin", ground: NoMockResponse {} },
             tail: Cons {
               head: FloorRouteGapExpectation { identity: "test.claim.spark.spark_serving_offer_route_witness_test.a_different_reported_path_refuses_the_service_without_claiming_a_different_launch", operation: "DigestStdin", ground: NoMockResponse {} },
@@ -1441,13 +1374,12 @@ fn floor_route_gap_expectation_chunk_14() -> List<FloorRouteGapExpectation> {
               }
             }
           }
-        }
       }
     }
   }
   }}}
 
-// The ten test.claim.durable_exclusive_hold_file_store_wet_witness identities: the hold protocol
+// The test.claim.durable_exclusive_hold_file_store_wet_witness identities: the hold protocol
 // over the real file store -- absent acquires at 1, held refuses without writing (another owner and
 // its own spelling), release to N+1 and reacquire at N+2, two contenders over one free observation,
 // store refusal distinct from contention, refused releases leave no next generation, and a commit
@@ -1477,7 +1409,16 @@ fn floor_route_gap_expectation_chunk_15() -> List<FloorRouteGapExpectation> {
     head: FloorRouteGapExpectation { identity: "test.claim.durable_exclusive_hold_file_store_wet_witness.a_write_time_store_refusal_is_reported_as_unavailable_not_as_a_lost_race_by_real_execution", operation: "DirWithTemplate", ground: NoMockResponse {} },
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.durable_exclusive_hold_file_store_wet_witness.a_live_release_plan_carries_the_observed_generation_and_the_free_bytes_by_real_execution", operation: "DirWithTemplate", ground: NoMockResponse {} },
+    tail: Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.durable_exclusive_hold_file_store_wet_witness.w_after_acquire_invokes_the_real_slot_release", operation: "DirWithTemplate", ground: NoMockResponse {} },
+    tail: Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.durable_exclusive_hold_file_store_wet_witness.w_failed_acquire_runs_no_body", operation: "DirWithTemplate", ground: NoMockResponse {} },
+    tail: Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.durable_exclusive_hold_file_store_wet_witness.w_refused_acquire_body_writes_a_marker_when_called_directly", operation: "DirWithTemplate", ground: NoMockResponse {} },
     tail: Empty {}
+    }
+    }
+    }
   }
   }
   }
@@ -2098,6 +2039,23 @@ fn floor_route_gap_expectation_chunk_41() -> List<FloorRouteGapExpectation> {
   }
 }
 
+// The two wet witnesses of the workspace source pack: test.claim.seeded_filler_real_execution (the
+// seeded filler by real truncate/openssl) and test.claim.workspace_source_pack_archive_real_execution
+// (the two-root tar and its digest readback). Each first mints a directory with shell.Mktemp.Dir,
+// which the hermetic route has no arm for. Triple enrollment as for chunk_31: these expectations, a
+// WetScheduledClaim row per function in local_repo_wet_schedule, and the gunbc.ci_layer_roots
+// LocalRepoWetLane rows for both files.
+fn floor_route_gap_expectation_chunk_42() -> List<FloorRouteGapExpectation> {
+  [
+    FloorRouteGapExpectation { identity: "test.claim.seeded_filler_real_execution.a_seeded_filler_is_exactly_its_size_and_reproducible_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
+    FloorRouteGapExpectation { identity: "test.claim.seeded_filler_real_execution.two_seeds_give_different_fillers_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
+    FloorRouteGapExpectation { identity: "test.claim.seeded_filler_real_execution.a_zero_stand_in_compresses_and_the_filler_does_not_red_control_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
+    FloorRouteGapExpectation { identity: "test.claim.workspace_source_pack_archive_real_execution.the_two_root_archive_carries_the_placeholder_and_reads_back_clean_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
+    FloorRouteGapExpectation { identity: "test.claim.workspace_source_pack_archive_real_execution.same_size_real_content_at_the_placeholder_path_is_refused_by_digest_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
+    FloorRouteGapExpectation { identity: "test.claim.workspace_source_pack_archive_real_execution.one_ordinary_file_and_zero_placeholders_packs_clean_by_real_execution", operation: "Dir", ground: NoMockResponse {} }
+  ]
+}
+
 // The test.claim.scm_repository_save_real_execution_witness identities: the guarded save's real
 // write over the committed v7 fixture (first effect Filesystem.Write), and a first save from
 // absence on a throwaway path (first effect shell.Mktemp.DirWithTemplate). Triple enrollment as
@@ -2130,40 +2088,13 @@ fn floor_route_gap_expectation_chunk_30() -> List<FloorRouteGapExpectation> {
   }
 }
 
-// THE mtcollins1 KVM OBSERVER WET CONTROLS (gunbc#12492) and the SOL channel-loss control that asks the
-// screen run on the local-repo wet lane (v2.workflow.local_repo_wet_terminal local_repo_wet_schedule),
-// where all held on required-floor run 36583319535 (srv4-03). The same run measured each identity's
-// hermetic route gap: shell.Mktemp.Dir / DirWithTemplate declares no mock_response.
+// The SOL channel-loss control that asks the screen runs on the local-repo wet lane
+// (v2.workflow.local_repo_wet_terminal local_repo_wet_schedule); its hermetic route gap is
+// shell.Mktemp.Dir, which declares no mock_response.
 fn floor_route_gap_expectation_chunk_29() -> List<FloorRouteGapExpectation> {
   Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.a_busy_viewer_slot_refuses_the_observer_and_the_handoff", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.a_connection_lost_mid_boot_is_reported_and_no_still_is_claimed_after_it", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.a_held_observer_is_admitted_and_its_triggered_still_is_hash_bound", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.a_launch_that_cannot_publish_its_pid_stops_its_child", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.an_owned_process_is_released_and_observed_gone", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.an_unreadable_canvas_is_acquisition_failed_with_the_browsers_words", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.an_unreadable_process_state_never_skips_the_kill_of_an_unpublished_child", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.a_record_naming_another_process_is_foreign_and_not_released", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.a_term_ignoring_child_with_an_unpublished_record_is_observed_stopped", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.a_transport_that_exits_at_once_is_not_serving", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.a_relative_observer_directory_is_resolved_once", operation: "DirWithTemplate", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.a_root_page_that_navigates_cannot_destroy_the_login", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness.a_viewer_without_its_feature_list_never_opens_kvm", operation: "Dir", ground: NoMockResponse {} },
-    tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.machine_intake.sol_hold_stdin_wet_witness.a_channel_loss_asks_the_screen_and_the_ask_does_not_change_the_verdict", operation: "DirWithTemplate", ground: NoMockResponse {} },
-    tail: Empty {} } } } } } } } } } } } } } }
+    tail: Empty {} }
 }
 
 // test.claim.roadmap.session_placement_wet_witness (dogfood G5, gunbc#13074): all five reach
@@ -2211,9 +2142,7 @@ fn floor_route_gap_expectation_chunk_33() -> List<FloorRouteGapExpectation> {
     head: FloorRouteGapExpectation { identity: "test.claim.auth.login_callback_hold_wet_witness.foreign_browser_cannot_consume_and_cached_replay_cannot_exchange", operation: "Dir", ground: NoMockResponse {} },
     tail: Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.fabric.fabric_state_namespace_wet_witness.witness_public_head_cannot_alias_private_state_object", operation: "DirWithTemplate", ground: NoMockResponse {} },
-    tail: Cons {
-    head: FloorRouteGapExpectation { identity: "test.claim.spark.pair_serving_d0_grant_row_wet_witness.the_captured_row_is_hashed_as_its_exact_bytes_by_real_execution", operation: "HashObjectStdinNoWrite", ground: NoMockResponse {} },
-    tail: Empty {} } } } } }
+    tail: Empty {} } } } }
 }
 
 // test.claim.roadmap.roadmap_dogfood_route_wet_witness (gunbc#13077): every claim builds a fresh
@@ -2323,7 +2252,7 @@ fn floor_route_gap_expectation_chunk_37() -> List<FloorRouteGapExpectation> {
 }
 
 fn floor_route_gap_expectation_chunks() -> List<List<FloorRouteGapExpectation>> {
-  Cons { head: floor_route_gap_expectation_chunk_00(), tail: Cons { head: floor_route_gap_expectation_chunk_01(), tail: Cons { head: floor_route_gap_expectation_chunk_02(), tail: Cons { head: floor_route_gap_expectation_chunk_03(), tail: Cons { head: floor_route_gap_expectation_chunk_04(), tail: Cons { head: floor_route_gap_expectation_chunk_05(), tail: Cons { head: floor_route_gap_expectation_chunk_06(), tail: Cons { head: floor_route_gap_expectation_chunk_07(), tail: Cons { head: floor_route_gap_expectation_chunk_08(), tail: Cons { head: floor_route_gap_expectation_chunk_09(), tail: Cons { head: floor_route_gap_expectation_chunk_10(), tail: Cons { head: floor_route_gap_expectation_chunk_11(), tail: Cons { head: floor_route_gap_expectation_chunk_12(), tail: Cons { head: floor_route_gap_expectation_chunk_13(), tail: Cons { head: floor_route_gap_expectation_chunk_14(), tail: Cons { head: floor_route_gap_expectation_chunk_15(), tail: Cons { head: floor_route_gap_expectation_chunk_16(), tail: Cons { head: floor_route_gap_expectation_chunk_17(), tail: Cons { head: floor_route_gap_expectation_chunk_18(), tail: Cons { head: floor_route_gap_expectation_chunk_19(), tail: Cons { head: floor_route_gap_expectation_chunk_20(), tail: Cons { head: floor_route_gap_expectation_chunk_21(), tail: Cons { head: floor_route_gap_expectation_chunk_22(), tail: Cons { head: floor_route_gap_expectation_chunk_23(), tail: Cons { head: floor_route_gap_expectation_chunk_24(), tail: Cons { head: floor_route_gap_expectation_chunk_25(), tail: Cons { head: floor_route_gap_expectation_chunk_26(), tail: Cons { head: floor_route_gap_expectation_chunk_27(), tail: Cons { head: floor_route_gap_expectation_chunk_28(), tail: Cons { head: floor_route_gap_expectation_chunk_29(), tail: Cons { head: floor_route_gap_expectation_chunk_30(), tail: Cons { head: floor_route_gap_expectation_chunk_31(), tail: Cons { head: floor_route_gap_expectation_chunk_32(), tail: Cons { head: floor_route_gap_expectation_chunk_33(), tail: Cons { head: floor_route_gap_expectation_chunk_34(), tail: Cons { head: floor_route_gap_expectation_chunk_35(), tail: Cons { head: floor_route_gap_expectation_chunk_36(), tail: Cons { head: floor_route_gap_expectation_chunk_37(), tail: Cons { head: floor_route_gap_expectation_chunk_38(), tail: Cons { head: floor_route_gap_expectation_chunk_39(), tail: Cons { head: floor_route_gap_expectation_chunk_40(), tail: Cons { head: floor_route_gap_expectation_chunk_41(), tail: Empty {} } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } }}
+  Cons { head: floor_route_gap_expectation_chunk_00(), tail: Cons { head: floor_route_gap_expectation_chunk_01(), tail: Cons { head: floor_route_gap_expectation_chunk_02(), tail: Cons { head: floor_route_gap_expectation_chunk_03(), tail: Cons { head: floor_route_gap_expectation_chunk_04(), tail: Cons { head: floor_route_gap_expectation_chunk_05(), tail: Cons { head: floor_route_gap_expectation_chunk_06(), tail: Cons { head: floor_route_gap_expectation_chunk_07(), tail: Cons { head: floor_route_gap_expectation_chunk_08(), tail: Cons { head: floor_route_gap_expectation_chunk_09(), tail: Cons { head: floor_route_gap_expectation_chunk_10(), tail: Cons { head: floor_route_gap_expectation_chunk_11(), tail: Cons { head: floor_route_gap_expectation_chunk_12(), tail: Cons { head: floor_route_gap_expectation_chunk_13(), tail: Cons { head: floor_route_gap_expectation_chunk_14(), tail: Cons { head: floor_route_gap_expectation_chunk_15(), tail: Cons { head: floor_route_gap_expectation_chunk_16(), tail: Cons { head: floor_route_gap_expectation_chunk_17(), tail: Cons { head: floor_route_gap_expectation_chunk_18(), tail: Cons { head: floor_route_gap_expectation_chunk_19(), tail: Cons { head: floor_route_gap_expectation_chunk_20(), tail: Cons { head: floor_route_gap_expectation_chunk_21(), tail: Cons { head: floor_route_gap_expectation_chunk_22(), tail: Cons { head: floor_route_gap_expectation_chunk_23(), tail: Cons { head: floor_route_gap_expectation_chunk_24(), tail: Cons { head: floor_route_gap_expectation_chunk_25(), tail: Cons { head: floor_route_gap_expectation_chunk_26(), tail: Cons { head: floor_route_gap_expectation_chunk_27(), tail: Cons { head: floor_route_gap_expectation_chunk_28(), tail: Cons { head: floor_route_gap_expectation_chunk_29(), tail: Cons { head: floor_route_gap_expectation_chunk_30(), tail: Cons { head: floor_route_gap_expectation_chunk_31(), tail: Cons { head: floor_route_gap_expectation_chunk_32(), tail: Cons { head: floor_route_gap_expectation_chunk_33(), tail: Cons { head: floor_route_gap_expectation_chunk_34(), tail: Cons { head: floor_route_gap_expectation_chunk_35(), tail: Cons { head: floor_route_gap_expectation_chunk_36(), tail: Cons { head: floor_route_gap_expectation_chunk_37(), tail: Cons { head: floor_route_gap_expectation_chunk_38(), tail: Cons { head: floor_route_gap_expectation_chunk_39(), tail: Cons { head: floor_route_gap_expectation_chunk_40(), tail: Cons { head: floor_route_gap_expectation_chunk_41(), tail: Cons { head: floor_route_gap_expectation_chunk_42(), tail: Cons { head: floor_route_gap_expectation_chunk_43(), tail: Empty {} } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } }}
 }
 
 
@@ -2381,7 +2310,9 @@ fn floor_route_gap_chunk_05() -> List<String> {
       head: "test.claim.repository_convergence_wet_witness_test.unreadable_head_refuses_before_fetch_or_mutation",
       tail: Cons {
       head: "test.claim.repository_convergence_wet_witness_test.wrong_primary_standing_refuses_from_gits_roster",
-      tail: Empty {} } } } } } } }
+      tail: Cons {
+      head: "test.claim.repository_convergence_wet_witness_test.a_legacy_derived_roster_file_is_retired_and_read_back_absent",
+      tail: Empty {} } } } } } } } }
 }
 
 fn floor_route_gap_chunks() -> List<List<String>> {
@@ -2402,8 +2333,28 @@ fn floor_route_gap_roster() -> List<String> {
 fn floor_route_gap_expectation_chunk_38() -> List<FloorRouteGapExpectation> {
   Cons {
     head: FloorRouteGapExpectation { identity: "test.claim.workspace_network_real_reader_witness_test.real_reader_takes_the_route_the_reader_identity_dictates", operation: "Read", ground: NoMockResponse {} },
+    tail: Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.workspace_transcript_rate_real_execution.a_real_tree_grows_gains_a_transcript_and_truncates_one_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
+    tail: Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.workspace_transcript_rate_real_execution.a_root_that_does_not_exist_refuses_by_real_execution", operation: "Dir", ground: NoMockResponse {} },
     tail: Empty {}
-  }
+  } } }
+}
+
+// test.claim.roadmap.roadmap_belt_exit_drain_wet_witness (dogfood #4/#6, the exit drain and the
+// collected-worker read over a real spool): every control's first effect is fresh_spool, which is
+// shell.Mktemp.DirWithTemplate and declares no mock_response, so the nominal floor holds each identity
+// here and the local-repo wet schedule runs it. Added BY PREDICTION, as chunk 32's post-gate controls
+// were: each identity's first effect is that unconditional DirWithTemplate.
+fn floor_route_gap_expectation_chunk_43() -> List<FloorRouteGapExpectation> {
+  Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.roadmap.roadmap_belt_exit_drain_wet_witness.a_recorded_worker_exit_is_handed_to_its_attempt_and_leaves_the_inbox", operation: "DirWithTemplate", ground: NoMockResponse {} },
+    tail: Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.roadmap.roadmap_belt_exit_drain_wet_witness.a_reviewer_exit_queues_no_launch_and_a_malformed_entry_is_refused", operation: "DirWithTemplate", ground: NoMockResponse {} },
+    tail: Cons {
+    head: FloorRouteGapExpectation { identity: "test.claim.roadmap.roadmap_belt_exit_drain_wet_witness.a_collected_workers_exit_is_read_from_the_spool_alone", operation: "DirWithTemplate", ground: NoMockResponse {} },
+    tail: Empty {}
+  }  }  }
 }
 
 // THE ADMISSION PARTITION, MODELED ON THE AUTHORITY THAT OWNS THE REGISTER. This is the single
diff --git a/src/v2/workflow/floor_unimported_bare_provider_debt_roster.dag b/src/v2/workflow/floor_unimported_bare_provider_debt_roster.dag
index 792a8896cb0..9b384c57888 100644
--- a/src/v2/workflow/floor_unimported_bare_provider_debt_roster.dag
+++ b/src/v2/workflow/floor_unimported_bare_provider_debt_roster.dag
@@ -166,7 +166,7 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "dag/extdeps/container/oci/reference.dag", name: "append", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/extdeps/container/oci/reference.dag", name: "get", standing: Retired { cause: NotAReference } },
   UnimportedBareProviderDisposition { file: "dag/extdeps/container/oci/reference.dag", name: "tag", standing: Retired { cause: NotAReference } },
-  UnimportedBareProviderDisposition { file: "dag/extdeps/cooling/dynatron.dag", name: "ampere_lga4926_cooling_mount", standing: ActiveDebt },
+  UnimportedBareProviderDisposition { file: "dag/extdeps/cooling/dynatron.dag", name: "ampere_lga4926_cooling_mount", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/extdeps/cpu/ampere_altra_memory_controller.dag", name: "any", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/extdeps/cpu/ampere_altra_package.dag", name: "empty_map", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/extdeps/cpu/ampere_altra_package.dag", name: "map_get", standing: Retired { cause: BindsWithoutDeclaration } },
@@ -556,7 +556,7 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "dag/gunbc/harness/harness_seat.dag", name: "append", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/host/host_assimilation_program.dag", name: "append", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/host/host_assimilation_program.dag", name: "filter", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/host/host_assimilation_program.dag", name: "fold_list", standing: ActiveDebt },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/host/host_assimilation_program.dag", name: "fold_list", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/host/host_identity_access.dag", name: "ComputeHost", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/host/host_identity_access.dag", name: "SshShell", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/host/host_identity_access.dag", name: "grounded_principal_privileged_commands", standing: Retired { cause: ImportsFixed } },
@@ -796,12 +796,12 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "dag/gunbc/source_integration_proof_kernel.dag", name: "append", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/cell_role.dag", name: "filter", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/cell_role.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/llama_cpp_rpc_observed.dag", name: "any", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/llama_cpp_rpc_observed.dag", name: "filter", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/llama_cpp_rpc_observed.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/llama_cpp_rpc_observed.dag", name: "any", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/llama_cpp_rpc_observed.dag", name: "filter", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/llama_cpp_rpc_observed.dag", name: "length", standing: Retired { cause: FileDeleted } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/oobe_execution_placement.dag", name: "append", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/pair_serving_d0.dag", name: "ends_with", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/pair_serving_d0_door.dag", name: "decided", standing: Retired { cause: NotAReference } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/pair_serving_d0.dag", name: "ends_with", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/pair_serving_d0_door.dag", name: "decided", standing: Retired { cause: FileDeleted } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/pinned_base_env_classification.dag", name: "append", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/pinned_base_env_classification.dag", name: "get", standing: Retired { cause: NotAReference } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/prefill_batch_sweep.dag", name: "filter", standing: Retired { cause: BindsWithoutDeclaration } },
@@ -820,16 +820,16 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/serving_runtime_capability_probe.dag", name: "any", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/serving_runtime_capability_probe.dag", name: "append", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/serving_runtime_capability_probe.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_checkpoint_materialize.dag", name: "get", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "any", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "empty_map", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "filter", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "get", standing: Retired { cause: NotAReference } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "map_get", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "map_insert", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_runtime_candidate.dag", name: "get", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_checkpoint_materialize.dag", name: "get", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "any", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "empty_map", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "filter", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "get", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "map_get", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_engram_row_store.dag", name: "map_insert", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_runtime_candidate.dag", name: "get", standing: Retired { cause: FileDeleted } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_runtime_image_probe.dag", name: "append", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_source_patch_converge.dag", name: "get", standing: Retired { cause: BindsWithoutDeclaration } },
+  UnimportedBareProviderDisposition { file: "dag/gunbc/spark/v41_source_patch_converge.dag", name: "get", standing: Retired { cause: FileDeleted } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/vllm_observed.dag", name: "contains", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/vllm_rank_population.dag", name: "any", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/gunbc/spark/vllm_rank_population.dag", name: "filter", standing: Retired { cause: BindsWithoutDeclaration } },
@@ -1279,7 +1279,7 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "dag/test/claim/fleet/fleet_receipt_collector_witness_test.dag", name: "converge_revision_observed_hex", standing: ActiveDebt },
   UnimportedBareProviderDisposition { file: "dag/test/claim/fleet/fleet_receipt_collector_witness_test.dag", name: "converge_verdict_label", standing: ActiveDebt },
   UnimportedBareProviderDisposition { file: "dag/test/claim/fleet/fleet_receipt_collector_witness_test.dag", name: "fleet_convergence_verdict", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/fleet/fleet_receipt_collector_witness_test.dag", name: "fleet_subsumption_enrollments", standing: ActiveDebt },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/fleet/fleet_receipt_collector_witness_test.dag", name: "fleet_subsumption_enrollments", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/fleet/fleet_receipt_collector_witness_test.dag", name: "parse_converge_receipt_line", standing: ActiveDebt },
   UnimportedBareProviderDisposition { file: "dag/test/claim/fleet/fleet_work_energy_cost_witness_test.dag", name: "filter", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/floor/incremental_floor_authority_witness_test.dag", name: "any", standing: Retired { cause: NotAReference } },
@@ -1669,9 +1669,9 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/engram_materialization_witness_test.dag", name: "filter", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/pair_serving_authority_log_real_execution_witness_test.dag", name: "get", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/pair_serving_authority_log_witness_test.dag", name: "get", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/pair_serving_d0_front_door_real_execution_witness_test.dag", name: "get", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag", name: "get", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/pair_serving_d0_witness_test.dag", name: "get", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/pair_serving_d0_front_door_real_execution_witness_test.dag", name: "get", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag", name: "get", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/pair_serving_d0_witness_test.dag", name: "get", standing: Retired { cause: FileDeleted } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/relaunch_hostconfig_witness_test.dag", name: "filter", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/relaunch_vertical_witness_test.dag", name: "filter", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/relaunch_vertical_witness_test.dag", name: "skip", standing: Retired { cause: ImportsFixed } },
@@ -1683,8 +1683,8 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/serving_runtime_capability_probe_witness_test.dag", name: "any", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/serving_runtime_capability_probe_witness_test.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/spark_bootstrap_provision_witness_test.dag", name: "SubstrateInputsOnly", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/spark_llama_cpp_rpc_witness_test.dag", name: "any", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/spark_llama_cpp_rpc_witness_test.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/spark_llama_cpp_rpc_witness_test.dag", name: "any", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/spark_llama_cpp_rpc_witness_test.dag", name: "length", standing: Retired { cause: FileDeleted } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/spark_oobe_screen_observation_witness_test.dag", name: "length", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/spark_vllm_observed_witness_test.dag", name: "any", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/spark_vllm_observed_witness_test.dag", name: "contains", standing: Retired { cause: BindsWithoutDeclaration } },
@@ -1692,12 +1692,12 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/spark_vllm_observed_witness_test.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/spark_vllm_rank_population_witness_test.dag", name: "any", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spark/spark_vllm_rank_population_witness_test.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_checkpoint_materialize_witness_test.dag", name: "get", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_index_engram_selection_witness_test.dag", name: "any", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_index_engram_selection_witness_test.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_published_row_store_witness_test.dag", name: "get", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_row_store_encode_witness_test.dag", name: "get", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_source_patch_converge_witness_test.dag", name: "get", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_checkpoint_materialize_witness_test.dag", name: "get", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_index_engram_selection_witness_test.dag", name: "any", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_index_engram_selection_witness_test.dag", name: "length", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_published_row_store_witness_test.dag", name: "get", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_row_store_encode_witness_test.dag", name: "get", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/test/claim/spark/v41_source_patch_converge_witness_test.dag", name: "get", standing: Retired { cause: FileDeleted } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spatial_connectivity_witness_test.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/spatial_projection_witness_test.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/supplier/hetzner_route_witness_test.dag", name: "filter", standing: Retired { cause: BindsWithoutDeclaration } },
@@ -1726,9 +1726,9 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "dag/test/claim/witness_purpose_taxonomy_witness_test.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/x509_rfc5280_witness_test.dag", name: "get", standing: Retired { cause: NotAReference } },
   UnimportedBareProviderDisposition { file: "dag/test/claim/x509_rfc5280_witness_test.dag", name: "skip", standing: Retired { cause: NotAReference } },
-  UnimportedBareProviderDisposition { file: "dag/test/fixture/health_read_only/mutation_probe.dag", name: "SshShell", standing: Retired { cause: RelocatedOutOfSourceRoots { to: "fixtures/health_read_only/mutation_probe.dag" } } },
-  UnimportedBareProviderDisposition { file: "dag/test/fixture/health_read_only/mutation_probe.dag", name: "redfish.Http", standing: Retired { cause: RelocatedOutOfSourceRoots { to: "fixtures/health_read_only/mutation_probe.dag" } } },
-  UnimportedBareProviderDisposition { file: "dag/test/fixture/health_read_only/mutation_probe.dag", name: "ssh_session_exec", standing: Retired { cause: RelocatedOutOfSourceRoots { to: "fixtures/health_read_only/mutation_probe.dag" } } },
+  UnimportedBareProviderDisposition { file: "dag/test/fixture/health_read_only/mutation_probe.dag", name: "SshShell", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/test/fixture/health_read_only/mutation_probe.dag", name: "redfish.Http", standing: Retired { cause: FileDeleted } },
+  UnimportedBareProviderDisposition { file: "dag/test/fixture/health_read_only/mutation_probe.dag", name: "ssh_session_exec", standing: Retired { cause: FileDeleted } },
   UnimportedBareProviderDisposition { file: "dag/test/manual/mercurial_upstream_model_execution_test.dag", name: "append", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "dag/test/manual/pijul_upstream_model_execution_test.dag", name: "append", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/compiler/body_producer_forward.dag", name: "dag_translation_rules_node", standing: Retired { cause: ImportsFixed } },
@@ -1768,31 +1768,31 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "src/v2/lens/fact_cardinality.dag", name: "SingleAuthority", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/lens/fact_density.dag", name: "NonZeroNat", standing: ActiveDebt },
   UnimportedBareProviderDisposition { file: "src/v2/lens/fact_density.dag", name: "SubstrateMandatoryTag", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "ConceptByName", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "ConceptDecl", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "ConceptStruct", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "FieldRef", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "LayerPrefix", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "LayerPrefixCompiler", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "LayerPrefixExtdeps", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "LayerPrefixStd", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "LayerPrefixWorkflow", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "Node", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "QualifiedConcept", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "build_concept_name_index", standing: ActiveDebt },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "ConceptByName", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "ConceptDecl", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "ConceptStruct", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "FieldRef", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "LayerPrefix", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "LayerPrefixCompiler", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "LayerPrefixExtdeps", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "LayerPrefixStd", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "LayerPrefixWorkflow", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "Node", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "QualifiedConcept", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "build_concept_name_index", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "concept_decl_facts", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "concept_from_decl", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "coproduct_arm_list_from_node", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "coproduct_arm_payload_pair_from_arm", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "enumerate_concepts_from_decls", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "fold_list", standing: ActiveDebt },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "concept_from_decl", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "coproduct_arm_list_from_node", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "coproduct_arm_payload_pair_from_arm", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "enumerate_concepts_from_decls", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "fold_list", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "is_empty", standing: Retired { cause: BindsWithoutDeclaration } },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "is_prefix_of", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "layer_prefix_from_dotted_qualified_name", standing: ActiveDebt },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "is_prefix_of", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "layer_prefix_from_dotted_qualified_name", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "length", standing: Retired { cause: BindsWithoutDeclaration } },
   UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "list_snoc_item", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "node_is_coproduct", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "witness_layer_roots", standing: ActiveDebt },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "node_is_coproduct", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/lens/grounding.dag", name: "witness_layer_roots", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/lens/identity_captured_navigation/roster_gate.dag", name: "identity_captured_navigation_findings", standing: ActiveDebt },
   UnimportedBareProviderDisposition { file: "src/v2/lens/languages_consumer_census.dag", name: "SingleAuthority", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/lens/leaf_model_verification.dag", name: "LeafModelCrossRuntimeDriftProbe", standing: ActiveDebt },
@@ -1892,7 +1892,7 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/body_lowering/single_arm_match_test.dag", name: "SubstrateInputsOnly", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/body_lowering/statement_let_bind_test.dag", name: "SubstrateInputsOnly", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/cargo_build_run_argv_witness_test.dag", name: "SubstrateInputsOnly", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "src/v2/test/claim/compiler_materialization_witness_test.dag", name: "SubstrateInputsOnly", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/test/claim/compiler_materialization_witness_test.dag", name: "SubstrateInputsOnly", standing: Retired { cause: FileDeleted } },
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/effect_demand/effect_demand_census_test.dag", name: "closure_entry", standing: Retired { cause: NotAReference } },
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/extdeps/spice_rc_passive_deck_claims_test.dag", name: "Capacitor", standing: Retired { cause: NotAReference } },
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/extdeps/spice_rc_passive_deck_claims_test.dag", name: "DeckComponent", standing: Retired { cause: NotAReference } },
@@ -2025,8 +2025,8 @@ data unimported_bare_provider_dispositions: List<UnimportedBareProviderDispositi
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/long/accumulator_copy_fold_analysis_test.dag", name: "Accepted", standing: ActiveDebt },
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/long/accumulator_copy_fold_analysis_test.dag", name: "SubstrateInputsOnly", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/long/cwc_resolution_probe_test.dag", name: "SubstrateInputsOnly", standing: Retired { cause: ImportsFixed } },
-  UnimportedBareProviderDisposition { file: "src/v2/test/claim/long/cwc_resolution_probe_test.dag", name: "normalize", standing: ActiveDebt },
-  UnimportedBareProviderDisposition { file: "src/v2/test/claim/long/cwc_resolution_probe_test.dag", name: "tokenize", standing: ActiveDebt },
+  UnimportedBareProviderDisposition { file: "src/v2/test/claim/long/cwc_resolution_probe_test.dag", name: "normalize", standing: Retired { cause: ImportsFixed } },
+  UnimportedBareProviderDisposition { file: "src/v2/test/claim/long/cwc_resolution_probe_test.dag", name: "tokenize", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/long/qualified_record_literal_parse_test.dag", name: "SubstrateInputsOnly", standing: Retired { cause: ImportsFixed } },
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/manual/medium_node_instantiation_test.dag", name: "Lossless", standing: ActiveDebt },
   UnimportedBareProviderDisposition { file: "src/v2/test/claim/manual/medium_node_instantiation_test.dag", name: "Lossy", standing: ActiveDebt },
diff --git a/src/v2/workflow/local_repo_wet_terminal.dag b/src/v2/workflow/local_repo_wet_terminal.dag
index 536251cec66..c8cafc0a8e6 100644
--- a/src/v2/workflow/local_repo_wet_terminal.dag
+++ b/src/v2/workflow/local_repo_wet_terminal.dag
@@ -85,6 +85,12 @@ fn local_repo_wet_requirement(candidate: String) -> WetEvidenceRequirement {
 // this population and false for BinWitnessWet, whose members also download ISOs, fetch over the
 // network, build with real cargo and provision remote hosts.
 //
+// The repository-convergence legacy-roster retirement member (a mktemp scratch repository and bare
+// remote, git plumbing over them, one planted file deleted through extdeps.filesystem and read back
+// absent, then RecursiveForce) has the same local-repo-only property: no network, no cargo, no
+// remote host. It is scheduled so the retirement route reaches a terminal verdict on the candidate
+// rather than standing as a held hermetic route gap.
+//
 // THE ROSTER DOES NOT LAND EMPTY, and that is deliberate rather than incidental. An empty roster
 // would make the lane's coverage claim vacuously true and leave nothing proving the executor runs
 // anything at all -- a gate permanently green by construction, which DESIGN section 4b calls a
@@ -495,6 +501,24 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       function: "an_undecodable_slot_is_unreadable_and_never_absent",
       expectation: ExpectedToHold {}
     },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.roadmap.roadmap_belt_exit_drain_wet_witness", function: "a_recorded_worker_exit_is_handed_to_its_attempt_and_leaves_the_inbox" },
+      entry: "dag/test/claim/roadmap/roadmap_belt_exit_drain_wet_witness_test.dag",
+      function: "a_recorded_worker_exit_is_handed_to_its_attempt_and_leaves_the_inbox",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.roadmap.roadmap_belt_exit_drain_wet_witness", function: "a_reviewer_exit_queues_no_launch_and_a_malformed_entry_is_refused" },
+      entry: "dag/test/claim/roadmap/roadmap_belt_exit_drain_wet_witness_test.dag",
+      function: "a_reviewer_exit_queues_no_launch_and_a_malformed_entry_is_refused",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.roadmap.roadmap_belt_exit_drain_wet_witness", function: "a_collected_workers_exit_is_read_from_the_spool_alone" },
+      entry: "dag/test/claim/roadmap/roadmap_belt_exit_drain_wet_witness_test.dag",
+      function: "a_collected_workers_exit_is_read_from_the_spool_alone",
+      expectation: ExpectedToHold {}
+    },
     WetScheduledClaim {
       identity: WitnessIdentity { module_path: "test.claim.roadmap.session_placement_wet_witness", function: "a_slot_with_no_placement_record_is_kept_in_window_and_released_after" },
       entry: "dag/test/claim/roadmap/session_placement_wet_witness_test.dag",
@@ -699,12 +723,6 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       function: "the_production_roster_carries_the_declared_digest_to_the_incarnation_frontier",
       expectation: ExpectedToHold {}
     },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_incumbent_identity_wet_witness", function: "the_production_declaration_keys_group_a_and_refuses_group_b" },
-      entry: "dag/test/claim/spark/pair_incumbent_identity_wet_witness_test.dag",
-      function: "the_production_declaration_keys_group_a_and_refuses_group_b",
-      expectation: ExpectedToHold {}
-    },
     WetScheduledClaim {
       identity: WitnessIdentity { module_path: "test.claim.spark.spark_serving_offer_route_witness_test", function: "an_assembled_looking_arm_with_adrift_ranks_refuses" },
       entry: "dag/test/claim/spark/spark_serving_offer_route_witness_test.dag",
@@ -987,6 +1005,12 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       function: "install_media_remaster_ensure_grub_cmdline_inserts_by_real_execution",
       expectation: ExpectedToHold {}
     },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.srv3_seeded_install_media_real_execution", function: "a_seed_artifact_is_fetched_read_back_and_an_escaping_name_moves_no_byte_by_real_execution" },
+      entry: "dag/test/claim/srv3/srv3_seeded_install_media_real_execution_witness_test.dag",
+      function: "a_seed_artifact_is_fetched_read_back_and_an_escaping_name_moves_no_byte_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
     WetScheduledClaim {
       identity: WitnessIdentity { module_path: "test.claim.mtcollins1_census_image_local_wet", function: "the_attempt_three_capture_binds_and_reads_by_real_execution" },
       entry: "dag/test/claim/machine_intake/mtcollins1_census_image_local_wet_test.dag",
@@ -1293,12 +1317,6 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       function: "a_let_bound_effect_still_runs",
       expectation: ExpectedToHold {}
     },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_authority_log_real_execution", function: "a_standing_recovery_selects_the_one_claim_quiesces_after_selection_and_reads_back_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_authority_log_real_execution_witness_test.dag",
-      function: "a_standing_recovery_selects_the_one_claim_quiesces_after_selection_and_reads_back_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
     WetScheduledClaim {
       identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_authority_log_real_execution", function: "a_transition_is_read_back_and_a_stale_one_names_the_current_by_real_execution" },
       entry: "dag/test/claim/spark/pair_serving_authority_log_real_execution_witness_test.dag",
@@ -1311,60 +1329,6 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       function: "an_unclaimed_group_is_refused_at_the_claim_by_real_execution",
       expectation: ExpectedToHold {}
     },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_authorization_witness", function: "a_frozen_intent_re_derives_the_filed_request_and_refuses_another_transaction" },
-      entry: "dag/test/claim/spark/pair_serving_d0_authorization_witness_test.dag",
-      function: "a_frozen_intent_re_derives_the_filed_request_and_refuses_another_transaction",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_filing_frozen_once_is_read_back_as_the_same_request_without_a_live_subject_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_filing_frozen_once_is_read_back_as_the_same_request_without_a_live_subject_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_standing_release_resumes_from_its_frozen_approval_after_the_main_row_changes_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_standing_release_resumes_from_its_frozen_approval_after_the_main_row_changes_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "the_door_reads_the_frozen_filing_to_decide_a_rerun_without_a_live_subject_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "the_door_reads_the_frozen_filing_to_decide_a_rerun_without_a_live_subject_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_grant_whose_window_passed_before_the_claim_takes_no_claim_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_grant_whose_window_passed_before_the_claim_takes_no_claim_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "the_production_route_settles_and_the_lease_governs_launch_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "the_production_route_settles_and_the_lease_governs_launch_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_rerun_resumes_its_own_pending_state_and_restores_the_exact_active_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_rerun_resumes_its_own_pending_state_and_restores_the_exact_active_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_fence_and_a_restore_each_reach_their_terminal_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_fence_and_a_restore_each_reach_their_terminal_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_seat_granted_after_the_suspension_landed_is_released_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_seat_granted_after_the_suspension_landed_is_released_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
     WetScheduledClaim {
       identity: WitnessIdentity { module_path: "test.claim.durable_cas_fabric_storage_real_execution", function: "one_slot_is_one_head_and_two_bindings_see_one_generation_by_real_execution" },
       entry: "dag/test/claim/durable_cas_fabric_storage_real_execution_witness_test.dag",
@@ -1378,99 +1342,15 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       expectation: ExpectedToHold {}
     },
     WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "the_same_grant_claimed_from_two_executors_is_held_once_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "the_same_grant_claimed_from_two_executors_is_held_once_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_crash_after_the_claim_and_before_the_first_write_is_recovered_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_crash_after_the_claim_and_before_the_first_write_is_recovered_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_crash_after_the_settling_write_and_before_completion_completes_the_claim_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_crash_after_the_settling_write_and_before_completion_completes_the_claim_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_grant_over_another_host_population_is_refused_before_any_claim_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_grant_over_another_host_population_is_refused_before_any_claim_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_front_door_real_execution", function: "an_error_status_is_an_answer_and_no_listener_is_silence_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_front_door_real_execution_witness_test.dag",
-      function: "an_error_status_is_an_answer_and_no_listener_is_silence_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_front_door_real_execution", function: "a_front_door_answering_500_fences_the_group_through_the_transaction_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_front_door_real_execution_witness_test.dag",
-      function: "a_front_door_answering_500_fences_the_group_through_the_transaction_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_fresh_authorization_under_a_reused_word_is_not_completed_from_the_old_history_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_fresh_authorization_under_a_reused_word_is_not_completed_from_the_old_history_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_population_change_after_the_claim_aborts_before_a_write_and_fences_after_one_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_population_change_after_the_claim_aborts_before_a_write_and_fences_after_one_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_front_door_real_execution", function: "a_listener_that_accepts_and_never_answers_fences_rather_than_reading_as_absent_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_front_door_real_execution_witness_test.dag",
-      function: "a_listener_that_accepts_and_never_answers_fences_rather_than_reading_as_absent_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "a_second_executor_cannot_abort_a_pending_lifecycle_it_did_not_write_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "a_second_executor_cannot_abort_a_pending_lifecycle_it_did_not_write_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_front_door_real_execution", function: "a_failed_connect_fences_under_an_active_head_unit_and_suspends_only_under_a_quiet_one_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_front_door_real_execution_witness_test.dag",
-      function: "a_failed_connect_fences_under_an_active_head_unit_and_suspends_only_under_a_quiet_one_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "any_executor_completes_a_settled_lifecycle_and_never_restarts_it_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "any_executor_completes_a_settled_lifecycle_and_never_restarts_it_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_real_execution", function: "the_production_admission_commits_the_frozen_hosts_of_a_fenced_lifecycle_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag",
-      function: "the_production_admission_commits_the_frozen_hosts_of_a_fenced_lifecycle_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_front_door_real_execution", function: "a_listener_behind_a_failed_connect_is_read_on_the_host_and_fences_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_front_door_real_execution_witness_test.dag",
-      function: "a_listener_behind_a_failed_connect_is_read_on_the_host_and_fences_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_authority_log_real_execution", function: "a_live_host_effect_claim_fences_the_reclaim_until_released_by_real_execution" },
+      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_authority_log_real_execution", function: "an_overdue_host_effect_claim_fences_until_released_by_real_execution" },
       entry: "dag/test/claim/spark/pair_serving_authority_log_real_execution_witness_test.dag",
-      function: "a_live_host_effect_claim_fences_the_reclaim_until_released_by_real_execution",
+      function: "an_overdue_host_effect_claim_fences_until_released_by_real_execution",
       expectation: ExpectedToHold {}
     },
     WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_authority_log_real_execution", function: "an_overdue_host_effect_claim_fences_until_released_by_real_execution" },
+      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_authority_log_real_execution", function: "a_serving_arm_host_is_refused_by_the_real_commitment_and_nothing_is_appended_by_real_execution" },
       entry: "dag/test/claim/spark/pair_serving_authority_log_real_execution_witness_test.dag",
-      function: "an_overdue_host_effect_claim_fences_until_released_by_real_execution",
+      function: "a_serving_arm_host_is_refused_by_the_real_commitment_and_nothing_is_appended_by_real_execution",
       expectation: ExpectedToHold {}
     },
     WetScheduledClaim {
@@ -1875,6 +1755,18 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       function: "a_racing_writer_under_a_window_retries_and_loses_no_commit_by_real_execution",
       expectation: ExpectedToHold {}
     },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.durable_cas_file_store_wet_witness", function: "a_window_observation_at_generation_1500_terminates_by_real_execution" },
+      entry: "dag/test/claim/durable_cas_file_store_wet_witness_test.dag",
+      function: "a_window_observation_at_generation_1500_terminates_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.durable_cas_file_store_wet_witness", function: "reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution" },
+      entry: "dag/test/claim/durable_cas_file_store_wet_witness_test.dag",
+      function: "reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
     WetScheduledClaim {
       identity: WitnessIdentity { module_path: "test.claim.filesystem_link_create_new_wet_witness", function: "a_link_publishes_the_source_bytes_and_keeps_the_source_by_real_execution" },
       entry: "dag/test/claim/filesystem_link_create_new_wet_witness_test.dag",
@@ -1959,6 +1851,24 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       function: "a_live_release_plan_carries_the_observed_generation_and_the_free_bytes_by_real_execution",
       expectation: ExpectedToHold {}
     },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.durable_exclusive_hold_file_store_wet_witness", function: "w_after_acquire_invokes_the_real_slot_release" },
+      entry: "dag/test/claim/durable_exclusive_hold_file_store_wet_witness_test.dag",
+      function: "w_after_acquire_invokes_the_real_slot_release",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.durable_exclusive_hold_file_store_wet_witness", function: "w_failed_acquire_runs_no_body" },
+      entry: "dag/test/claim/durable_exclusive_hold_file_store_wet_witness_test.dag",
+      function: "w_failed_acquire_runs_no_body",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.durable_exclusive_hold_file_store_wet_witness", function: "w_refused_acquire_body_writes_a_marker_when_called_directly" },
+      entry: "dag/test/claim/durable_exclusive_hold_file_store_wet_witness_test.dag",
+      function: "w_refused_acquire_body_writes_a_marker_when_called_directly",
+      expectation: ExpectedToHold {}
+    },
     WetScheduledClaim {
       identity: WitnessIdentity { module_path: "test.claim.fabric.fabric_control_plane_wet_witness", function: "the_right_reservation_releases_its_cell_to_free_at_the_next_generation_by_real_execution" },
       entry: "dag/test/claim/fabric/fabric_control_plane_wet_witness_test.dag",
@@ -2217,6 +2127,12 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       function: "a_leftover_copy_that_cannot_be_removed_leaves_the_store_unwritable_by_real_execution",
       expectation: ExpectedToHold {}
     },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.materialization_store_local_wet_witness", function: "n_commits_under_one_held_session_acquire_the_hold_once_by_real_execution" },
+      entry: "dag/test/claim/materialization_store_local_wet_witness_test.dag",
+      function: "n_commits_under_one_held_session_acquire_the_hold_once_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
     WetScheduledClaim {
       identity: WitnessIdentity { module_path: "test.claim.pre_os_capture_replay_witness", function: "w_early_exit_refuses_absence_on_real_bytes" },
       entry: "dag/test/claim/machine_intake/pre_os_capture_replay_witness_test.dag",
@@ -2242,77 +2158,11 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       expectation: ExpectedToHold {}
     },
     WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.megarac_spx_ui_surface_artifact_integrity_witness", function: "committed_spx_ui_surface_hashes_to_the_catalog_identity" },
-      entry: "dag/test/claim/bmc/megarac_spx_ui_surface_artifact_integrity_witness_test.dag",
-      function: "committed_spx_ui_surface_hashes_to_the_catalog_identity",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.megarac_spx_ui_surface_artifact_integrity_witness", function: "committed_spx_ui_surface_agrees_with_every_served_ui_surface_standing" },
-      entry: "dag/test/claim/bmc/megarac_spx_ui_surface_artifact_integrity_witness_test.dag",
-      function: "committed_spx_ui_surface_agrees_with_every_served_ui_surface_standing",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.megarac_spx_ui_surface_artifact_integrity_witness", function: "committed_sol_host_payload_hashes_to_the_positive_control_identity" },
-      entry: "dag/test/claim/bmc/megarac_spx_ui_surface_artifact_integrity_witness_test.dag",
+      identity: WitnessIdentity { module_path: "test.claim.mtcollins_sol_host_payload_integrity_witness", function: "committed_sol_host_payload_hashes_to_the_positive_control_identity" },
+      entry: "dag/test/claim/bmc/mtcollins_sol_host_payload_integrity_witness_test.dag",
       function: "committed_sol_host_payload_hashes_to_the_positive_control_identity",
       expectation: ExpectedToHold {}
     },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.v41_engram_runtime_witness", function: "the_live_storage_backed_patches_are_digestfile_of_committed_bytes" },
-      entry: "dag/test/claim/spark/v41_engram_runtime_witness_test.dag",
-      function: "the_live_storage_backed_patches_are_digestfile_of_committed_bytes",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.v41_runtime_candidate_witness", function: "observed_patches_do_not_mint_a_patched_source_tree" },
-      entry: "dag/test/claim/spark/v41_runtime_candidate_witness_test.dag",
-      function: "observed_patches_do_not_mint_a_patched_source_tree",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_authorization_witness", function: "the_live_subject_exists_exactly_when_the_candidate_is_keyed_and_read_back" },
-      entry: "dag/test/claim/spark/pair_serving_d0_authorization_witness_test.dag",
-      function: "the_live_subject_exists_exactly_when_the_candidate_is_keyed_and_read_back",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.v41_engram_runtime_witness", function: "control_published_infeasibility_is_not_weakened_by_a_keyed_specification" },
-      entry: "dag/test/claim/spark/v41_engram_runtime_witness_test.dag",
-      function: "control_published_infeasibility_is_not_weakened_by_a_keyed_specification",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.v41_runtime_candidate_witness", function: "the_live_candidate_is_keyed_end_to_end" },
-      entry: "dag/test/claim/spark/v41_runtime_candidate_witness_test.dag",
-      function: "the_live_candidate_is_keyed_end_to_end",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.v41_source_patch_converge_witness", function: "digestfile_inhabits_the_committed_patch_population" },
-      entry: "dag/test/claim/spark/v41_source_patch_converge_witness_test.dag",
-      function: "digestfile_inhabits_the_committed_patch_population",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.v41_source_patch_converge_witness", function: "empty_diff_has_a_real_digest" },
-      entry: "dag/test/claim/spark/v41_source_patch_converge_witness_test.dag",
-      function: "empty_diff_has_a_real_digest",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.v41_source_patch_converge_witness", function: "red5_the_arm_a_set_srv8_carried_is_derived_byte_exactly_from_history" },
-      entry: "dag/test/claim/spark/v41_source_patch_converge_witness_test.dag",
-      function: "red5_the_arm_a_set_srv8_carried_is_derived_byte_exactly_from_history",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.v41_row_store_encode_witness", function: "the_receipt_was_produced_by_the_rendered_program_the_mode_ships" },
-      entry: "dag/test/claim/spark/v41_row_store_encode_witness_test.dag",
-      function: "the_receipt_was_produced_by_the_rendered_program_the_mode_ships",
-      expectation: ExpectedToHold {}
-    },
     WetScheduledClaim {
       identity: WitnessIdentity { module_path: "test.claim.shell_spawn_refused_real_execution_witness", function: "absent_binary_is_a_typed_spawn_refusal" },
       entry: "dag/test/claim/shell_spawn_refused_real_execution_witness_test.dag",
@@ -2679,90 +2529,6 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       function: "a_channel_loss_asks_the_screen_and_the_ask_does_not_change_the_verdict",
       expectation: ExpectedToHold {}
     },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_held_observer_is_admitted_and_its_triggered_still_is_hash_bound" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "a_held_observer_is_admitted_and_its_triggered_still_is_hash_bound",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_root_page_that_navigates_cannot_destroy_the_login" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "a_root_page_that_navigates_cannot_destroy_the_login",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_viewer_without_its_feature_list_never_opens_kvm" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "a_viewer_without_its_feature_list_never_opens_kvm",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_busy_viewer_slot_refuses_the_observer_and_the_handoff" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "a_busy_viewer_slot_refuses_the_observer_and_the_handoff",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_connection_lost_mid_boot_is_reported_and_no_still_is_claimed_after_it" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "a_connection_lost_mid_boot_is_reported_and_no_still_is_claimed_after_it",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "an_unreadable_canvas_is_acquisition_failed_with_the_browsers_words" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "an_unreadable_canvas_is_acquisition_failed_with_the_browsers_words",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_stale_listening_line_from_another_pid_is_not_readiness" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "a_stale_listening_line_from_another_pid_is_not_readiness",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_transport_that_exits_at_once_is_not_serving" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "a_transport_that_exits_at_once_is_not_serving",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_launch_that_cannot_publish_its_pid_stops_its_child" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "a_launch_that_cannot_publish_its_pid_stops_its_child",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_term_ignoring_child_with_an_unpublished_record_is_observed_stopped" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "a_term_ignoring_child_with_an_unpublished_record_is_observed_stopped",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "an_unreadable_process_state_never_skips_the_kill_of_an_unpublished_child" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "an_unreadable_process_state_never_skips_the_kill_of_an_unpublished_child",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_relative_observer_directory_is_resolved_once" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "a_relative_observer_directory_is_resolved_once",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_record_naming_another_process_is_foreign_and_not_released" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "a_record_naming_another_process_is_foreign_and_not_released",
-      expectation: ExpectedToHold {}
-    },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "an_owned_process_is_released_and_observed_gone" },
-      entry: "dag/test/claim/machine_intake/mtcollins1_kvm_observer_protocol_wet_witness_test.dag",
-      function: "an_owned_process_is_released_and_observed_gone",
-      expectation: ExpectedToHold {}
-    },
     WetScheduledClaim {
       identity: WitnessIdentity { module_path: "test.claim.machine_intake.sol_hold_stdin_wet_witness", function: "an_unreadable_incident_is_reported_and_is_not_success" },
       entry: "dag/test/claim/machine_intake/sol_hold_stdin_wet_witness_test.dag",
@@ -2967,12 +2733,6 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       function: "witness_public_head_cannot_alias_private_state_object",
       expectation: ExpectedToHold {}
     },
-    WetScheduledClaim {
-      identity: WitnessIdentity { module_path: "test.claim.spark.pair_serving_d0_grant_row_wet_witness", function: "the_captured_row_is_hashed_as_its_exact_bytes_by_real_execution" },
-      entry: "dag/test/claim/spark/pair_serving_d0_grant_row_wet_witness_test.dag",
-      function: "the_captured_row_is_hashed_as_its_exact_bytes_by_real_execution",
-      expectation: ExpectedToHold {}
-    },
     WetScheduledClaim {
       identity: WitnessIdentity { module_path: "test.claim.fleet.fleet_authorized_key_enroll_real_path_witness_test", function: "fleet_authorized_key_enroll_route_twice_by_real_execution" },
       entry: "dag/test/claim/fleet/fleet_authorized_key_enroll_real_path_witness_test.dag",
@@ -3050,6 +2810,60 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
       entry: "dag/test/claim/runner/browser_ready_label_real_path_witness_test.dag",
       function: "revoke_executes_the_dropin_removal_for_real_on_a_scratch_root",
       expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.workspace_transcript_rate_real_execution", function: "a_real_tree_grows_gains_a_transcript_and_truncates_one_by_real_execution" },
+      entry: "dag/test/claim/workspace_transcript_rate_real_execution_witness_test.dag",
+      function: "a_real_tree_grows_gains_a_transcript_and_truncates_one_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.workspace_transcript_rate_real_execution", function: "a_root_that_does_not_exist_refuses_by_real_execution" },
+      entry: "dag/test/claim/workspace_transcript_rate_real_execution_witness_test.dag",
+      function: "a_root_that_does_not_exist_refuses_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.seeded_filler_real_execution", function: "a_seeded_filler_is_exactly_its_size_and_reproducible_by_real_execution" },
+      entry: "dag/test/claim/seeded_filler_real_execution_witness_test.dag",
+      function: "a_seeded_filler_is_exactly_its_size_and_reproducible_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.seeded_filler_real_execution", function: "two_seeds_give_different_fillers_by_real_execution" },
+      entry: "dag/test/claim/seeded_filler_real_execution_witness_test.dag",
+      function: "two_seeds_give_different_fillers_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.seeded_filler_real_execution", function: "a_zero_stand_in_compresses_and_the_filler_does_not_red_control_by_real_execution" },
+      entry: "dag/test/claim/seeded_filler_real_execution_witness_test.dag",
+      function: "a_zero_stand_in_compresses_and_the_filler_does_not_red_control_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.workspace_source_pack_archive_real_execution", function: "the_two_root_archive_carries_the_placeholder_and_reads_back_clean_by_real_execution" },
+      entry: "dag/test/claim/workspace_source_pack_archive_real_execution_witness_test.dag",
+      function: "the_two_root_archive_carries_the_placeholder_and_reads_back_clean_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.workspace_source_pack_archive_real_execution", function: "same_size_real_content_at_the_placeholder_path_is_refused_by_digest_by_real_execution" },
+      entry: "dag/test/claim/workspace_source_pack_archive_real_execution_witness_test.dag",
+      function: "same_size_real_content_at_the_placeholder_path_is_refused_by_digest_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.workspace_source_pack_archive_real_execution", function: "one_ordinary_file_and_zero_placeholders_packs_clean_by_real_execution" },
+      entry: "dag/test/claim/workspace_source_pack_archive_real_execution_witness_test.dag",
+      function: "one_ordinary_file_and_zero_placeholders_packs_clean_by_real_execution",
+      expectation: ExpectedToHold {}
+    },
+    WetScheduledClaim {
+      identity: WitnessIdentity { module_path: "test.claim.repository_convergence_wet_witness_test", function: "a_legacy_derived_roster_file_is_retired_and_read_back_absent" },
+      entry: "dag/test/claim/repository_convergence_wet_witness_test.dag",
+      function: "a_legacy_derived_roster_file_is_retired_and_read_back_absent",
+      expectation: ExpectedToHold {}
     }
   ]
 }
@@ -3068,26 +2882,6 @@ fn local_repo_wet_schedule() -> List<WetScheduledClaim> {
 // without it is never handed this lane (docs/plans/wet-witness-host-premise-census.md).
 fn local_repo_wet_premise_roster() -> List<WetPremisedClaim> {
   [
-    WetPremisedClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_held_observer_is_admitted_and_its_triggered_still_is_hash_bound" },
-      premise: RunnerBrowserToolchainReadyForJobUser {}
-    },
-    WetPremisedClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_busy_viewer_slot_refuses_the_observer_and_the_handoff" },
-      premise: RunnerBrowserToolchainReadyForJobUser {}
-    },
-    WetPremisedClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_connection_lost_mid_boot_is_reported_and_no_still_is_claimed_after_it" },
-      premise: RunnerBrowserToolchainReadyForJobUser {}
-    },
-    WetPremisedClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "an_unreadable_canvas_is_acquisition_failed_with_the_browsers_words" },
-      premise: RunnerBrowserToolchainReadyForJobUser {}
-    },
-    WetPremisedClaim {
-      identity: WitnessIdentity { module_path: "test.claim.machine_intake.mtcollins1_kvm_observer_protocol_wet_witness", function: "a_relative_observer_directory_is_resolved_once" },
-      premise: RunnerBrowserToolchainReadyForJobUser {}
-    },
     WetPremisedClaim {
       identity: WitnessIdentity { module_path: "test.claim.roadmap.allocation_client_execution_wet_witness", function: "client_json_reject_keeps_intent" },
       premise: RunnerBrowserToolchainReadyForJobUser {}
diff --git a/src/v2/workflow/native_cache_fusion.dag b/src/v2/workflow/native_cache_fusion.dag
deleted file mode 100644
index 8f8295ff094..00000000000
--- a/src/v2/workflow/native_cache_fusion.dag
+++ /dev/null
@@ -1,44 +0,0 @@
-module v2.workflow.native_cache_fusion
-
-import std.emit_on_demand {
-  EmitOnDemandLookup, EmitOnDemandHit, EmitOnDemandMiss,
-  EmitOnDemandCacheReceipt, materialization_for_lookup
-}
-import std.content_hash { ContentHash }
-import std.content_hash { content_hash_atom, as_content_hash_structural }
-import std.realization { Materialization, Share, Recompute }
-
-// P2/host fusion law (census R6 projection, 2026-07-22): the host transport decides warmness as
-// compile_skipped = !cold_control && marker_exists (v1_interpreter.rs
-// emit_host_run_transport_cached_in_workspace, the .native_ready rule), while the P2 model decides
-// Share|Recompute via emit_on_demand_lookup over the artifact store. These are two realizations of
-// ONE decision and must agree: marker-present under no control == store hit == Share; marker-absent
-// or control-forced == miss == Recompute. This module states that agreement as the executable law
-// over a modeled host observation (mirroring the cited Rust rule), so divergence between the model
-// and the realization is a red, not silent drift. Full fusion — the host transport reading the P2
-// store itself — is the R6 construction end-state; until then this law is the tripwire.
-
-type HostWarmObservation {
-  marker_exists: Bool
-  cold_control: Bool
-}
-
-fn host_compile_skipped(o: HostWarmObservation) -> Bool {
-  o.cold_control == false && o.marker_exists
-}
-
-fn model_lookup_for(o: HostWarmObservation, key: ContentHash) -> EmitOnDemandLookup {
-  if host_compile_skipped(o: o) {
-    EmitOnDemandHit {
-      receipt: EmitOnDemandCacheReceipt { key: key, compile_skipped: true }
-    }
-  } else {
-    EmitOnDemandMiss
-  }
-}
-
-fn fusion_agreement_holds_for(o: HostWarmObservation) -> Bool {
-  let key = as_content_hash_structural(structural: content_hash_atom(value: "fusion-law-synthetic-key"))
-  let model_share = materialization_for_lookup(lookup: model_lookup_for(o: o, key: key)) == Share
-  host_compile_skipped(o: o) == model_share
-}
diff --git a/src/v2/workflow/realization_attempt.dag b/src/v2/workflow/realization_attempt.dag
index b0c0be62455..95ca8a7a922 100644
--- a/src/v2/workflow/realization_attempt.dag
+++ b/src/v2/workflow/realization_attempt.dag
@@ -1,5 +1,6 @@
 module v2.workflow.realization_attempt
 
+import v2.std.member_declaration_kind { no_member_declaration_kinds }
 import v2.compiler.ingested_fixture_arrows { ingested_resolved_module_from_source }
 import v2.compiler.program_assembly { assemble_program_from_ingest }
 import v2.compiler.resolve { ResolvedTree }
@@ -70,7 +71,7 @@ type EntryRealizationAttempt {
 }
 
 // The exact cause is the chain's FATAL element (its last), never its head: an advisory prepended
-// to the refusal (the grammar overlap residue heads every module's chain) only rode along.
+// to the refusal by rejected_with_pending only rode along.
 fn first_located_cause(ds: NonEmptyDiagnostics) -> Symbol {
   diagnostics_fatal_reason(d: ds)
 }
@@ -287,7 +288,7 @@ fn attempt_joined(program: ResolvedTree, fn_name: Symbol, entry: String) -> Entr
     match list_at_optional(xs: joined, index: 0) {
       Absent => attempt_refused(entry: entry, phase: PhaseResolve, cause: ^realization_attempt_identity_absent)
       Present { value: decl } =>
-        match infer_and_discharge(tree: ResolvedTree { root: decl, symbol_index: program.symbol_index, resolved_declarations: program.resolved_declarations, lexical_bindings: program.lexical_bindings, unavailable_providers: program.unavailable_providers }) {
+        match infer_and_discharge(tree: ResolvedTree { root: decl, symbol_index: program.symbol_index, resolved_declarations: program.resolved_declarations, lexical_bindings: program.lexical_bindings, unavailable_providers: program.unavailable_providers, member_kinds: no_member_declaration_kinds() }) {
           Rejected { diagnostics: ds } =>
             attempt_refused_at(entry: entry, phase: PhaseInfer, cause: first_located_cause(ds: ds), located: first_located_file(ds: ds))
           Accepted { value: inferred, diagnostics: _ } =>
diff --git a/src/v2/workflow/realization_sweep.dag b/src/v2/workflow/realization_sweep.dag
index 1df3540b6c9..a02f1b1451e 100644
--- a/src/v2/workflow/realization_sweep.dag
+++ b/src/v2/workflow/realization_sweep.dag
@@ -27,7 +27,7 @@ import v2.compiler.source_authority_read {
   SourceRootIngestBuildReadFailed,
   source_root_ingest_build_from_source_refs
 }
-import v2.std.integer { integer_int_to_decimal_string }
+import std.integer { int_to_decimal_string }
 import std.optional { Optional, Present, Absent }
 import v2.std.algebra { fold_list, length }
 import v2.std.collection { list_at_optional }
@@ -372,15 +372,15 @@ fn sweep_histogram_tsv(rows: List<RealizationSweepRow>) -> String {
       SweepHistogramState {
         prev: k,
         count: 1,
-        out: if st.out == "" { concat(st.prev, "\t", integer_int_to_decimal_string(value: st.count)) } else { concat(st.out, "\n", st.prev, "\t", integer_int_to_decimal_string(value: st.count)) }
+        out: if st.out == "" { concat(st.prev, "\t", int_to_decimal_string(value: st.count)) } else { concat(st.out, "\n", st.prev, "\t", int_to_decimal_string(value: st.count)) }
       }
     }
   })
   if folded.count == 0 {
     folded.out
   } else if folded.out == "" {
-    concat(folded.prev, "\t", integer_int_to_decimal_string(value: folded.count))
+    concat(folded.prev, "\t", int_to_decimal_string(value: folded.count))
   } else {
-    concat(folded.out, "\n", folded.prev, "\t", integer_int_to_decimal_string(value: folded.count))
+    concat(folded.out, "\n", folded.prev, "\t", int_to_decimal_string(value: folded.count))
   }
 }
diff --git a/src/v2/workflow/required_floor.dag b/src/v2/workflow/required_floor.dag
index fe18b4286d0..0d609d9c36c 100644
--- a/src/v2/workflow/required_floor.dag
+++ b/src/v2/workflow/required_floor.dag
@@ -819,9 +819,9 @@ fn required_gate_prefixes() -> List<String> {
 // the stage0 partition rows.
 //
 // THE EMITTED-WORKSPACE PLAN'S WITNESSES (gunbc#12214, parent ruling msg_d375b91d from
-// loyal-swift-608). They run v2.workflow.emitted_crate_workspace emitted_workspace_plan_over over a
-// SUPPLIED three-module DAG and supplied edges -- the plan's RED selection, its transitive re-export
-// derivation and its ClosuresDisagree / NoDiscriminatingEdge refusals -- so the refusals keep
+// loyal-swift-608). They run gunbc.emitted_crate_workspace emitted_workspace_plan_from_emission over
+// a SUPPLIED three-module emission and its edges -- the plan's RED selection, its transitive
+// re-export derivation and its EmitterReverseEdge / NoDiscriminatingEdge refusals -- so the refusals keep
 // executing after merge (DESIGN 4b(4)). They never derive the live closure: that run, with the
 // emission and both cargo builds, stays in the author-run instrument
 // //gunbc/instruments:emitted-crate-workspace. SubstrateInputsOnly.
diff --git a/src/v2/workflow/rust_crate_partition.dag b/src/v2/workflow/rust_crate_partition.dag
index ce1c8b2a30a..d3534239378 100644
--- a/src/v2/workflow/rust_crate_partition.dag
+++ b/src/v2/workflow/rust_crate_partition.dag
@@ -1,5 +1,48 @@
 module v2.workflow.rust_crate_partition
 
+import gunbc.crate_partition {
+  CompilationUnitId,
+  ModuleDagEdge,
+  ModuleId,
+  PartitionProvenance,
+  PartitionR4Refused,
+  PartitionR4Valid,
+  PartitionR4ValidityCause,
+  PartitionR4ValidityVerdict,
+  SccSplit,
+  UnitGraphCycle,
+  PartitionFoldRefusalCause,
+  partition_provenance_hand_explicit,
+  partition_provenance_policy_derived,
+  DerivedDepPackagesOk,
+  DerivedDepPackagesUnitHasNoRow,
+  EmittedEdgeRefusal,
+  EmittedEdgesMerged,
+  EmittedEdgesRefused,
+  ExplicitPartition,
+  ExplicitPartitionParam,
+  PartitionEmittedEdgeRefused,
+  PartitionParameter,
+  PartitionPolicy,
+  ResolvePartitionOk,
+  ResolvePartitionOutcome,
+  ResolvePartitionRefusalCause,
+  ResolvePartitionRefused,
+  Stage0EmitCoreCrate,
+  Stage0FoundationCrate,
+  Stage0LayeredCoreCrate,
+  Stage0PartitionCrateRow,
+  UnitDepEdge,
+  assignment_owner,
+  assignment_unit_dep_edges_over,
+  derived_dep_packages,
+  merge_emitted_edges,
+  policy_partition_assignment_over,
+  resolve_partition_over,
+  stage0_module_id,
+  validate_partition_r4_over
+}
+
 import std.dissolution { DissolutionCondition, unbound_dissolution }
 
 import std.algebra { Empty }
@@ -24,7 +67,7 @@ import v2.lens.common.construction_justification { ConstructionJustification, Wa
 import v2.std.algebra { any, fold_list, length }
 import v2.std.collection {
   empty_map,
-  map_get,
+  map_get_checked,
   map_insert
 }
 import std.optional {
@@ -35,87 +78,21 @@ import std.optional {
 }
 import v2.std.compilers.compilation_unit {
   CompilationUnit,
-  CompilationUnitId,
   ModuleDag,
-  ModuleDagEdge,
-  ModuleId,
   ModuleTypeDefinitionRow,
   PartitionFoldOk,
   PartitionFoldRefused,
-  PartitionProvenance,
-  PartitionR4Refused,
-  PartitionR4Valid,
-  PartitionR4ValidityCause,
-  PartitionR4ValidityVerdict,
-  SccSplit,
-  UnitGraphCycle,
   PartitionFoldOutcome,
-  PartitionFoldRefusalCause,
-  partition_fold_outcome,
-  partition_provenance_hand_explicit,
-  partition_provenance_policy_derived
+  partition_fold_outcome
 }
 import v2.std.diagnostic { Accepted, Rejected }
 import v2.std.node { Node, Symbol }
 
-type PartitionPolicy {
-  target_crate_count: Int
-}
-
-type ExplicitPartition {
-  assignment: Map<ModuleId, CompilationUnitId>
-}
-
-type PartitionParameter
-  = ExplicitPartitionParam { partition: ExplicitPartition }
-  | PolicyPartitionParam { policy: PartitionPolicy }
-
-// Every refusal names the module or the Rust rule it is about. An assignment is admitted only when
-// every module of the DAG has exactly one owner (the Map gives uniqueness; coverage and the absence
-// of strangers are checked here) and the R4 verdict is valid -- on BOTH arms, because a partition an
-// author supplied is no more trusted than one the policy derived.
-type ResolvePartitionRefusalCause
-  = PolicyTargetCountNotPositive { policy: PartitionPolicy }
-  | AssignmentOmitsModule { module_id: ModuleId }
-  | AssignmentNamesModuleOutsideDag { module_id: ModuleId }
-  | PartitionRustAdmissibilityRefused { cause: PartitionR4ValidityCause }
-  | PartitionEmittedEdgeRefused { cause: EmittedEdgeRefusal }
-
-type ResolvePartitionOutcome
-  = ResolvePartitionOk {
-      assignment: Map<ModuleId, CompilationUnitId>
-      provenance: PartitionProvenance
-    }
-  | ResolvePartitionRefused { cause: ResolvePartitionRefusalCause }
-
 type Stage0PartitionReceiptOutcome
   = Stage0PartitionReceiptOk { units: List<CompilationUnit> }
   | Stage0PartitionReceiptResolveRefused { cause: ResolvePartitionRefusalCause }
   | Stage0PartitionReceiptFoldRefused { cause: PartitionFoldRefusalCause }
 
-type Stage0PartitionCrateKind
-  = Stage0FoundationCrate
-  | Stage0LayeredCoreCrate
-  | Stage0EmitCoreCrate
-
-type Stage0PartitionCrateRow {
-  unit_id: CompilationUnitId
-  package_name: String
-  crate_dir: String
-  kind: Stage0PartitionCrateKind
-  modules: List<String>
-  reexport_packages: List<String>
-  carries_non_empty_wrappers: Bool
-}
-
-// Rust R3 workflow realization of the shared CompilationUnit home
-// (emitted-crate-partition-design.md §2/§13). resolve_partition_outcome is the sole entry for the
-// assignment Map; partition_fold_outcome is the sole producer of interface + deps. Phase 0:
-// HandExplicit provenance + ExplicitPartition interim ~8-crate layered grouping (dissolves to
-// PolicyPartition when balanced crates≈cores policy lands).
-
-data rust_crate_partition_declared_core_target: Int = 7
-
 data rust_crate_partition_module_bearing_unit_target: Int = 6
 
 // R3-only emit shell crate (reexport surface, NOT a partition_fold_outcome CompilationUnit): modules list
@@ -273,10 +250,6 @@ fn stage0_module_dag_type_definitions_map() -> Map<ModuleId, List<ModuleTypeDefi
     })
 }
 
-fn stage0_module_id(basename: String) -> ModuleId {
-  basename as NonEmptyStr
-}
-
 fn stage0_runtime_modules() -> List<String> {
   ["v1_rt"]
 }
@@ -347,7 +320,8 @@ fn stage0_std_core_modules() -> List<String> {
       "std_operator_realization",
       "std_import",
       "v1_std_core",
-      "gunbc_rust_emitted_edge"
+      "gunbc_rust_emitted_edge",
+      "gunbc_rust_emitted_crate"
     ])
 }
 
@@ -457,6 +431,7 @@ fn stage0_v1_artifact_modules() -> List<String> {
 
 fn stage0_r3_emit_reexport_surface_modules() -> List<String> {
   [
+    "gunbc_rust_emitted_crate",
     "gunbc_rust_emitted_edge",
     "v1_compiler_artifact",
     "v1_compiler_infer_env",
@@ -622,6 +597,8 @@ fn stage0_cross_unit_import_edges() -> List<ModuleDagEdge> {
     stage0_module_dag_edge(from: "v1_compiler_parse", to: "v1_std_core"),
     stage0_module_dag_edge(from: "gunbc_rust_emitted_edge", to: "std_types"),
     stage0_module_dag_edge(from: "v1_compiler_emit_core_support", to: "gunbc_rust_emitted_edge"),
+    stage0_module_dag_edge(from: "gunbc_rust_emitted_crate", to: "std_types"),
+    stage0_module_dag_edge(from: "v1_compiler_emit_core_support", to: "gunbc_rust_emitted_crate"),
   ]
 }
 
@@ -642,139 +619,24 @@ data stage0_module_dag_merge: ModuleDagEmittedMerge = module_dag_with_emitted_ed
   emitted: module_dag_runtime_prelude_edges(module_dag: stage0_source_module_dag)
 )
 
-// AN EMITTED EDGE IS A REALIZATION EDGE WITH ITS PROVENANCE, AND THE PARTITION ADMITS IT OR REFUSES
-// IT BY NAME. A source-acyclic closure can be emitted into a crate graph that does not compile when
-// the emitter writes a path the source never declared, so the partition must decide over every
-// module edge the emitted code carries. An emitted edge whose target already reaches its source
-// through the source edges would close a cycle the source does not have: that is an emitter
-// defect, refused as EmitterReverseEdge with the provenance that produced it, never merged into a
-// DAG whose R4 verdict would then report an anonymous UnitGraphCycle. An endpoint the DAG does not
-// declare is refused rather than dropped, because dropping it answers for a smaller graph.
-type EmittedEdgeRefusal
-  = EmitterReverseEdge { from: ModuleId, to: ModuleId, provenance: EmittedEdgeProvenance }
-  | EmittedEdgeEndpointOutsideDag { from: String, to: String }
-
 type ModuleDagEmittedMerge
   = ModuleDagEmittedMerged { module_dag: ModuleDag }
   | ModuleDagEmittedRefused { cause: EmittedEdgeRefusal }
 
-type EmittedEdgeMergeFold {
-  edges: List<ModuleDagEdge>
-  present: Map<String, Bool>
-  refusal: Optional<EmittedEdgeRefusal>
-}
-
 fn module_dag_runtime_prelude_edges(module_dag: ModuleDag) -> List<EmittedEdge> {
   module_dag.modules |> flat_map(module_id => rust_prelude_emitted_edges(module: module_id as String))
 }
 
-fn module_dag_edge_key(from: String, to: String) -> String {
-  concat(from, concat(" -> ", to))
-}
-
-// What each distinct emitted target reaches along the SOURCE edges, one walk per target rather
-// than one per edge: every emitted module shares the runtime target.
-fn emitted_target_reach(module_dag: ModuleDag, emitted: List<EmittedEdge>) -> Map<String, Map<String, Bool>> {
-  let names = module_dag.modules |> map(module_id => module_id as String)
-  let forward_as_reverse = CallGraph {
-    edges: module_dag.edges |> map(edge => GraphEdge { caller: edge.to as String, callee: edge.from as String })
-  }
-  emitted |> fold(init: empty_map(), f: fn(acc, edge) {
-    match edge.to {
-      EmittedCrateRootTarget => acc
-      EmittedModuleTarget { module: target } =>
-        match map_get(acc, target) {
-          Accepted { value: Present { value: _ }, diagnostics: _ } => acc
-          Accepted { value: _, diagnostics: _ } =>
-            map_insert(acc, target,
-              graph_reverse_reachable_members(names: names, graph: forward_as_reverse, start: target)
-                |> fold(init: empty_map(), f: fn(reached, member) { map_insert(reached, member, true) }))
-          Rejected { diagnostics: _ } =>
-            map_insert(acc, target,
-              graph_reverse_reachable_members(names: names, graph: forward_as_reverse, start: target)
-                |> fold(init: empty_map(), f: fn(reached, member) { map_insert(reached, member, true) }))
-        }
-    }
-  })
-}
-
-fn string_member(set: Map<String, Bool>, key: String) -> Bool {
-  match map_get(set, key) {
-    Accepted { value: Present { value: _ }, diagnostics: _ } => true
-    Accepted { value: _, diagnostics: _ } => false
-    Rejected { diagnostics: _ } => false
-  }
-}
-
-fn emitted_edge_merge_step(
-  acc: EmittedEdgeMergeFold,
-  edge: EmittedEdge,
-  module_set: Map<String, Bool>,
-  reach: Map<String, Map<String, Bool>>
-) -> EmittedEdgeMergeFold {
-  match acc.refusal {
-    Present { value: _ } => acc
-    Absent =>
-      match edge.to {
-        EmittedCrateRootTarget => acc
-        EmittedModuleTarget { module: target } =>
-          if edge.from == target {
-            acc
-          } else if !string_member(set: module_set, key: edge.from) || !string_member(set: module_set, key: target) {
-            EmittedEdgeMergeFold {
-              edges: acc.edges,
-              present: acc.present,
-              refusal: optional_present(value: EmittedEdgeEndpointOutsideDag { from: edge.from, to: target })
-            }
-          } else {
-            let target_reaches_source = match map_get(reach, target) {
-              Accepted { value: Present { value: reached }, diagnostics: _ } => string_member(set: reached, key: edge.from)
-              Accepted { value: _, diagnostics: _ } => false
-              Rejected { diagnostics: _ } => false
-            }
-            if target_reaches_source {
-              EmittedEdgeMergeFold {
-                edges: acc.edges,
-                present: acc.present,
-                refusal: optional_present(value: EmitterReverseEdge {
-                  from: stage0_module_id(basename: edge.from),
-                  to: stage0_module_id(basename: target),
-                  provenance: edge.provenance
-                })
-              }
-            } else if string_member(set: acc.present, key: module_dag_edge_key(from: edge.from, to: target)) {
-              acc
-            } else {
-              EmittedEdgeMergeFold {
-                edges: acc.edges |> list_push(ModuleDagEdge {
-                  from: stage0_module_id(basename: edge.from),
-                  to: stage0_module_id(basename: target)
-                }),
-                present: map_insert(acc.present, module_dag_edge_key(from: edge.from, to: target), true),
-                refusal: Absent
-              }
-            }
-          }
-      }
-  }
-}
-
+// The MODULE DAG's adapters onto gunbc.crate_partition, which owns every rule below over a graph's
+// modules and edges: the DAG's interface maps ride through unchanged.
 fn module_dag_with_emitted_edges(module_dag: ModuleDag, emitted: List<EmittedEdge>) -> ModuleDagEmittedMerge {
-  let module_set = module_dag.modules |> fold(init: empty_map(), f: fn(acc, module_id) { map_insert(acc, module_id as String, true) })
-  let present = module_dag.edges |> fold(init: empty_map(), f: fn(acc, edge) {
-    map_insert(acc, module_dag_edge_key(from: edge.from as String, to: edge.to as String), true)
-  })
-  let reach = emitted_target_reach(module_dag: module_dag, emitted: emitted)
-  let folded = emitted |> fold(init: EmittedEdgeMergeFold { edges: module_dag.edges, present: present, refusal: Absent }, f: fn(acc, edge) {
-    emitted_edge_merge_step(acc: acc, edge: edge, module_set: module_set, reach: reach)
-  })
-  match folded.refusal {
-    Present { value: cause } => ModuleDagEmittedRefused { cause: cause }
-    Absent =>
+  match merge_emitted_edges(modules: module_dag.modules, edges: module_dag.edges, emitted: emitted) {
+    EmittedEdgesRefused { cause: cause } => ModuleDagEmittedRefused { cause: cause }
+    EmittedEdgesMerged { edges: edges } =>
       ModuleDagEmittedMerged {
         module_dag: ModuleDag {
           modules: module_dag.modules,
-          edges: folded.edges,
+          edges: edges,
           exports: module_dag.exports,
           type_definitions: module_dag.type_definitions,
         }
@@ -782,167 +644,20 @@ fn module_dag_with_emitted_edges(module_dag: ModuleDag, emitted: List<EmittedEdg
   }
 }
 
-// ONE COMPONENTS PASS PER RESOLVE: the policy lays out the DAG's components and the R4 verdict
-// reads SCC membership from the same list, so both are handed the value rather than each
-// re-deriving it.
-fn resolve_partition_outcome(
-  parameter: PartitionParameter,
-  module_dag: ModuleDag
-) -> ResolvePartitionOutcome {
-  let components = module_dag_components_dependencies_first(module_dag: module_dag)
-  match parameter {
-    ExplicitPartitionParam { partition: explicit } =>
-      admit_partition_assignment(
-        module_dag: module_dag,
-        components: components,
-        assignment: explicit.assignment,
-        provenance: partition_provenance_hand_explicit()
-      )
-    PolicyPartitionParam { policy: policy } =>
-      if policy.target_crate_count < 1 {
-        ResolvePartitionRefused { cause: PolicyTargetCountNotPositive { policy: policy } }
-      } else {
-        admit_partition_assignment(
-          module_dag: module_dag,
-          components: components,
-          assignment: policy_partition_assignment(module_dag: module_dag, components: components, policy: policy),
-          provenance: partition_provenance_policy_derived(policy: policy_partition_resolver_ref())
-        )
-      }
-  }
+fn resolve_partition_outcome(parameter: PartitionParameter, module_dag: ModuleDag) -> ResolvePartitionOutcome {
+  resolve_partition_over(parameter: parameter, modules: module_dag.modules, edges: module_dag.edges)
 }
 
-fn policy_partition_resolver_ref() -> DeclarationRef {
-  DeclarationRef {
-    module_path: "v2.workflow.rust_crate_partition" as NonEmptyStr,
-    decl_name: "policy_partition_assignment" as NonEmptyStr,
-    field: WholeDeclaration,
-  }
-}
-
-fn module_dag_call_graph(module_dag: ModuleDag) -> CallGraph {
-  CallGraph {
-    edges: module_dag.edges
-      |> map(edge => GraphEdge { caller: edge.from as String, callee: edge.to as String })
-  }
-}
-
-// The strongly connected components of the module DAG, dependencies first. Kosaraju yields them
-// importers first (std.graph graph_strongly_connected_components), so this reverses once.
-fn module_dag_components_dependencies_first(module_dag: ModuleDag) -> List<List<String>> {
-  graph_strongly_connected_components(
-    names: module_dag.modules |> map(module_id => module_id as String),
-    graph: module_dag_call_graph(module_dag: module_dag)
-  ) |> reverse
-}
-
-type PolicyPartitionFill {
-  assignment: Map<ModuleId, CompilationUnitId>
-  unit_index: Int
-  filled: Int
-}
-
-fn policy_partition_unit_id(unit_index: Int) -> CompilationUnitId {
-  ("policy-unit-" + to_string(unit_index)) as CompilationUnitId
-}
-
-// THE BALANCED POLICY, AND WHY IT CANNOT PRODUCE AN INADMISSIBLE PARTITION. Components are laid out
-// dependencies first and cut into contiguous runs of about ceil(modules / target) members, so:
-// a component is never divided (no SccSplit), and every module edge runs from a later run to an
-// earlier or the same one, so the unit graph points strictly backwards (no UnitGraphCycle). The R4
-// verdict is still asked of the result in admit_partition_assignment -- the argument above is why
-// the policy should pass, and the verdict is what establishes that it did.
 fn policy_partition_assignment(
   module_dag: ModuleDag,
   components: List<List<String>>,
   policy: PartitionPolicy
 ) -> Map<ModuleId, CompilationUnitId> {
-  let quota = (length(module_dag.modules) + policy.target_crate_count - 1) / policy.target_crate_count
-  let filled = components
-    |> fold(init: PolicyPartitionFill { assignment: empty_map(), unit_index: 0, filled: 0 }, f: fn(acc, component) {
-      let opens_next_unit = (acc.filled >= quota) && (acc.unit_index + 1 < policy.target_crate_count)
-      let unit_index = if opens_next_unit { acc.unit_index + 1 } else { acc.unit_index }
-      let already = if opens_next_unit { 0 } else { acc.filled }
-      let unit_id = policy_partition_unit_id(unit_index: unit_index)
-      PolicyPartitionFill {
-        assignment: component |> fold(init: acc.assignment, f: fn(inner, member) {
-          map_insert(inner, member as ModuleId, unit_id)
-        }),
-        unit_index: unit_index,
-        filled: already + length(component)
-      }
-    })
-  filled.assignment
-}
-
-fn assignment_owner(
-  assignment: Map<ModuleId, CompilationUnitId>,
-  module_id: ModuleId
-) -> Optional<CompilationUnitId> {
-  match map_get(assignment, module_id) {
-    Accepted { value: owner, diagnostics: _ } => owner
-    Rejected { diagnostics: _ } => Absent
-  }
-}
-
-fn assignment_first_omitted_module(
-  module_dag: ModuleDag,
-  assignment: Map<ModuleId, CompilationUnitId>
-) -> Optional<ModuleId> {
-  module_dag.modules |> fold(init: Absent, f: fn(acc, module_id) {
-    match acc {
-      Present { value: _ } => acc
-      Absent =>
-        match assignment_owner(assignment: assignment, module_id: module_id) {
-          Present { value: _ } => Absent
-          Absent => Present { value: module_id }
-        }
-    }
-  })
-}
-
-fn assignment_first_stranger(
-  module_dag: ModuleDag,
-  assignment: Map<ModuleId, CompilationUnitId>
-) -> Optional<ModuleId> {
-  let known = module_dag.modules |> fold(init: empty_map(), f: fn(acc, module_id) {
-    map_insert(acc, module_id, true)
-  })
-  sorted_map_keys(assignment) |> fold(init: Absent, f: fn(acc, module_id) {
-    match acc {
-      Present { value: _ } => acc
-      Absent =>
-        match map_get(known, module_id) {
-          Accepted { value: Present { value: _ }, diagnostics: _ } => Absent
-          Accepted { value: Absent, diagnostics: _ } => Present { value: module_id }
-          Rejected { diagnostics: _ } => Present { value: module_id }
-        }
-    }
-  })
+  policy_partition_assignment_over(modules: module_dag.modules, components: components, policy: policy)
 }
 
-fn admit_partition_assignment(
-  module_dag: ModuleDag,
-  components: List<List<String>>,
-  assignment: Map<ModuleId, CompilationUnitId>,
-  provenance: PartitionProvenance
-) -> ResolvePartitionOutcome {
-  match assignment_first_omitted_module(module_dag: module_dag, assignment: assignment) {
-    Present { value: module_id } =>
-      ResolvePartitionRefused { cause: AssignmentOmitsModule { module_id: module_id } }
-    Absent =>
-      match assignment_first_stranger(module_dag: module_dag, assignment: assignment) {
-        Present { value: module_id } =>
-          ResolvePartitionRefused { cause: AssignmentNamesModuleOutsideDag { module_id: module_id } }
-        Absent =>
-          match validate_partition_r4(module_dag: module_dag, components: components, assignment: assignment) {
-            PartitionR4Refused { cause: cause } =>
-              ResolvePartitionRefused { cause: PartitionRustAdmissibilityRefused { cause: cause } }
-            PartitionR4Valid =>
-              ResolvePartitionOk { assignment: assignment, provenance: provenance }
-          }
-      }
-  }
+fn assignment_unit_dep_edges(module_dag: ModuleDag, assignment: Map<ModuleId, CompilationUnitId>) -> List<UnitDepEdge> {
+  assignment_unit_dep_edges_over(edges: module_dag.edges, assignment: assignment)
 }
 
 // THE RESOLVE IS ONE FACT, SO IT IS ONE BINDING. Both the receipt below and
@@ -984,62 +699,12 @@ data stage0_partition_receipt_outcome: Stage0PartitionReceiptOutcome = match sta
     Stage0PartitionReceiptResolveRefused { cause: cause }
 }
 
-// SCC membership is read from the components, not re-derived per pair: the pairwise reachability
-// walk this replaces had no visited set, so on a cyclic DAG it did not terminate, and it paid a walk
-// per ordered pair besides.
-fn assignment_has_scc_split(
-  components: List<List<String>>,
-  assignment: Map<ModuleId, CompilationUnitId>
-) -> Bool {
-  components
-    |> any(component => {
-      let owners = component |> fold(init: [], f: fn(acc, member) {
-        match assignment_owner(assignment: assignment, module_id: member as ModuleId) {
-          Present { value: owner } => if acc |> any(seen => seen == owner) { acc } else { acc |> list_push(owner) }
-          Absent => acc
-        }
-      })
-      length(owners) > 1
-    })
-}
-
-// The unit graph is the module edges projected through the assignment -- the same fact
-// partition_fold_outcome derives as CompilationUnit.deps, read here without asking for interfaces.
-// The projection itself is assignment_unit_dep_edges and is NOT repeated here: this function used
-// to carry its own copy, and two independent producers of one fact can drift on exactly the
-// details that matter (the self-loop filter, the dedup rule), which is the fork DESIGN section 3
-// forbids and section 2 prices. This maps that one producer's output into the CallGraph shape the
-// SCC check reads.
-fn assignment_unit_graph_has_cycle(
-  module_dag: ModuleDag,
-  assignment: Map<ModuleId, CompilationUnitId>
-) -> Bool {
-  let unit_edges = assignment_unit_dep_edges(module_dag: module_dag, assignment: assignment)
-    |> map(e => GraphEdge { caller: e.from as String, callee: e.to as String })
-  graph_has_multi_node_scc(
-    names: map_values(assignment) |> fold(init: [], f: fn(acc, unit) {
-      if acc |> any(seen => seen == (unit as String)) { acc } else { acc |> list_push(unit as String) }
-    }),
-    graph: CallGraph { edges: unit_edges }
-  )
-}
-
 fn validate_partition_r4(
   module_dag: ModuleDag,
   components: List<List<String>>,
   assignment: Map<ModuleId, CompilationUnitId>
 ) -> PartitionR4ValidityVerdict {
-  if assignment_has_scc_split(components: components, assignment: assignment) {
-    PartitionR4Refused {
-      cause: SccSplit { detail: "Rust R4: mutually dependent modules assigned to different compilation units" }
-    }
-  } else if assignment_unit_graph_has_cycle(module_dag: module_dag, assignment: assignment) {
-    PartitionR4Refused {
-      cause: UnitGraphCycle { detail: "Rust R4: compilation-unit dependency graph is cyclic" }
-    }
-  } else {
-    PartitionR4Valid
-  }
+  validate_partition_r4_over(edges: module_dag.edges, components: components, assignment: assignment)
 }
 
 fn stage0_single_crate_assignment() -> Map<ModuleId, CompilationUnitId> {
@@ -1229,134 +894,6 @@ fn stage0_partition_fold_ok() -> Bool {
   }
 }
 
-// UNIT DEPENDENCY EDGES WITHOUT ASKING FOR INTERFACES. This is the same projection
-// assignment_unit_graph_has_cycle already performs and its note already names: the unit graph is
-// the module edges projected through the assignment, which is the fact partition_fold_outcome
-// derives as CompilationUnit.deps.
-//
-// WHY THIS ROUTE AND NOT THE FOLD. Asking stage0_partition_receipt_outcome for units dominated
-// the claim's cost, and what it bought was a CompilationUnit interface saturation the claim never
-// inspects -- it reads deps only. That is the shape DESIGN section 3 names exactly: a claim
-// dominated by one call whose RESULT SHAPE is all it looks at, whose cost does not move when its
-// assertions change. The earliest unjustified boundary was demanding a whole CompilationUnit for a
-// dependency question, so the derivation is re-taken here rather than the symptom optimized.
-// The figures are NOT copied here: claim_batch reports eval_steps per witness and re-derives them
-// on demand, and DESIGN section 6 asks for the producer to be named rather than its output
-// transcribed -- a number copied into prose rots without anyone touching either end.
-type UnitDepEdge {
-  from: CompilationUnitId
-  to: CompilationUnitId
-}
-
-fn assignment_unit_dep_edges(
-  module_dag: ModuleDag,
-  assignment: Map<ModuleId, CompilationUnitId>
-) -> List<UnitDepEdge> {
-  module_dag.edges |> fold(init: [], f: fn(acc, edge) {
-    match assignment_owner(assignment: assignment, module_id: edge.from) {
-      Absent => acc
-      Present { value: from_unit } =>
-        match assignment_owner(assignment: assignment, module_id: edge.to) {
-          Absent => acc
-          Present { value: to_unit } =>
-            if from_unit == to_unit {
-              acc
-            } else {
-              if acc |> any(e => (e.from == from_unit) && (e.to == to_unit)) {
-                acc
-              } else {
-                acc |> list_push(UnitDepEdge { from: from_unit, to: to_unit })
-              }
-            }
-        }
-    }
-  })
-}
-
-fn unit_direct_deps(edges: List<UnitDepEdge>, unit_id: CompilationUnitId) -> List<CompilationUnitId> {
-  edges |> fold(init: [], f: fn(acc, e) {
-    if (e.from == unit_id) && !(acc |> any(seen => seen == e.to)) { acc |> list_push(e.to) } else { acc }
-  })
-}
-
-fn unit_dep_closure_step(
-  edges: List<UnitDepEdge>,
-  acc: List<CompilationUnitId>
-) -> List<CompilationUnitId> {
-  acc |> fold(init: acc, f: fn(outer, uid) {
-    unit_direct_deps(edges: edges, unit_id: uid) |> fold(init: outer, f: fn(inner, dep) {
-      if inner |> any(seen => seen == dep) { inner } else { inner |> list_push(dep) }
-    })
-  })
-}
-
-// Fuel bounds the rounds: each round adds at least one unit or the closure is complete, so the
-// edge count is an upper bound rather than a guess (DESIGN section 4: bounded and forward).
-fn unit_dep_closure(
-  edges: List<UnitDepEdge>,
-  acc: List<CompilationUnitId>,
-  fuel: Int
-) -> List<CompilationUnitId> {
-  if fuel <= 0 {
-    acc
-  } else {
-    let grown = unit_dep_closure_step(edges: edges, acc: acc)
-    if (grown |> count) == (acc |> count) { acc } else {
-      unit_dep_closure(edges: edges, acc: grown, fuel: fuel - 1)
-    }
-  }
-}
-
-fn unit_package_name(rows: List<Stage0PartitionCrateRow>, unit_id: CompilationUnitId) -> Optional<String> {
-  rows
-    |> fold(init: Absent, f: fn(acc, row) {
-      match acc {
-        Present { value: _ } => acc
-        Absent =>
-          if row.unit_id == unit_id { optional_present(value: row.package_name) } else { Absent }
-      }
-    })
-}
-
-// A DEP EDGE WHOSE DESTINATION HAS NO PACKAGE ROW IS NOT A DEP THAT CONTRIBUTES NOTHING. This
-// fold used to answer Absent => acc, dropping the edge, and the consequence is the false green
-// this whole declaration exists to make impossible: for a FOUNDATION row whose authored
-// reexport_packages is itself [], a dropped edge leaves derived [] against authored [], and the
-// detector CERTIFIES AGREEMENT FROM AN INCOMPLETE PROJECTION.
-//
-// That the current stage0 rows pair every unit id with a row -- so the arm is unreachable on the
-// production route today -- is not the test that applies here. This detector is DELIBERATELY
-// EXPOSED over supplied inputs and is meant to SURVIVE as the permanent debt control once the
-// edge list is derived, so what matters is what its signature PERMITS, not what it currently
-// reports. A permanent control that can be handed an input for which it lies is a different
-// object from a production path that happens not to reach the case.
-type DerivedDepPackages
-  = DerivedDepPackagesOk { packages: List<String> }
-  | DerivedDepPackagesUnitHasNoRow { unit_id: CompilationUnitId }
-
-fn derived_dep_packages(
-  edges: List<UnitDepEdge>,
-  rows: List<Stage0PartitionCrateRow>,
-  row: Stage0PartitionCrateRow
-) -> DerivedDepPackages {
-  unit_dep_closure(
-    edges: edges,
-    acc: unit_direct_deps(edges: edges, unit_id: row.unit_id),
-    fuel: (edges |> count) + 1
-  )
-    |> fold(init: DerivedDepPackagesOk { packages: [] }, f: fn(acc, dep) {
-      match acc {
-        DerivedDepPackagesUnitHasNoRow { unit_id: unit_id } =>
-          DerivedDepPackagesUnitHasNoRow { unit_id: unit_id }
-        DerivedDepPackagesOk { packages: packages } =>
-          match unit_package_name(rows: rows, unit_id: dep) {
-            Present { value: pkg } => DerivedDepPackagesOk { packages: packages |> list_push(pkg) }
-            Absent => DerivedDepPackagesUnitHasNoRow { unit_id: dep }
-          }
-      }
-    })
-}
-
 fn stage0_package_sets_agree(left: List<String>, right: List<String>) -> Bool {
   (left |> fold(init: true, f: fn(ok, pkg) { ok && (right |> any(p => p == pkg)) }))
     && (right |> fold(init: true, f: fn(ok, pkg) { ok && (left |> any(p => p == pkg)) }))
diff --git a/tools/fabric_ci_fci1_bounded_execution_context.env b/tools/fabric_ci_fci1_bounded_execution_context.env
index 255ce5668b2..6bf84485694 100644
--- a/tools/fabric_ci_fci1_bounded_execution_context.env
+++ b/tools/fabric_ci_fci1_bounded_execution_context.env
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # GENERATED by dag/gunbc/fabric/fci1_bounded_execution_context_emit.dag — DO NOT HAND-EDIT.
-FCI1_MEMORY_MAX_BYTES=27917287424
-FCI1_MEMORY_HIGH_BYTES=26843545600
+FCI1_MEMORY_MAX_BYTES=23622320128
+FCI1_MEMORY_HIGH_BYTES=22548578304
 FCI1_DRIVER_UNIT=fci1-bounded-driver.service
 readonly FCI1_MEMORY_MAX_BYTES FCI1_MEMORY_HIGH_BYTES FCI1_DRIVER_UNIT
 fci1_run_bounded_driver() {